root/drivers/staging/wusbcore/devconnect.c

DEFINITIONS

1. wusb_dev_free
2. wusb_dev_alloc
3. wusbhc_fill_cack_ie
4. wusbhc_cack_add
5. wusbhc_cack_rm
6. wusbhc_devconnect_acked
7. wusbhc_devconnect_acked_work
8. wusbhc_devconnect_ack
9. __wusbhc_dev_disconnect
10. __wusbhc_keep_alive
11. wusbhc_keep_alive_run
12. wusbhc_find_dev_by_addr
13. wusbhc_handle_dn_alive
14. wusbhc_handle_dn_connect
15. wusbhc_handle_dn_disconnect
16. wusbhc_handle_dn
17. __wusbhc_dev_disable
18. wusb_dev_bos_grok
19. wusb_dev_bos_add
20. wusb_dev_bos_rm
21. wusb_dev_add_ncb
22. wusb_dev_rm_ncb
23. wusb_usb_ncb
24. __wusb_dev_get_by_usb_dev
25. wusb_dev_destroy
26. wusbhc_devconnect_create
27. wusbhc_devconnect_destroy
28. wusbhc_devconnect_start
29. wusbhc_devconnect_stop
30. wusb_set_dev_addr

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * WUSB Wire Adapter: Control/Data Streaming Interface (WUSB[8])
   4  * Device Connect handling
   5  *
   6  * Copyright (C) 2006 Intel Corporation
   7  * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
   8  *
   9  * FIXME: docs
  10  * FIXME: this file needs to be broken up, it's grown too big
  11  *
  12  *
  13  * WUSB1.0[7.1, 7.5.1, ]
  14  *
  15  * WUSB device connection is kind of messy. Some background:
  16  *
  17  *     When a device wants to connect it scans the UWB radio channels
  18  *     looking for a WUSB Channel; a WUSB channel is defined by MMCs
  19  *     (Micro Managed Commands or something like that) [see
  20  *     Design-overview for more on this] .
  21  *
  22  * So, device scans the radio, finds MMCs and thus a host and checks
  23  * when the next DNTS is. It sends a Device Notification Connect
  24  * (DN_Connect); the host picks it up (through nep.c and notif.c, ends
  25  * up in wusb_devconnect_ack(), which creates a wusb_dev structure in
  26  * wusbhc->port[port_number].wusb_dev), assigns an unauth address
  27  * to the device (this means from 0x80 to 0xfe) and sends, in the MMC
  28  * a Connect Ack Information Element (ConnAck IE).
  29  *
  30  * So now the device now has a WUSB address. From now on, we use
  31  * that to talk to it in the RPipes.
  32  *
  33  * ASSUMPTIONS:
  34  *
  35  *  - We use the the as device address the port number where it is
  36  *    connected (port 0 doesn't exist). For unauth, it is 128 + that.
  37  *
  38  * ROADMAP:
  39  *
  40  *   This file contains the logic for doing that--entry points:
  41  *
  42  *   wusb_devconnect_ack()      Ack a device until _acked() called.
  43  *                              Called by notif.c:wusb_handle_dn_connect()
  44  *                              when a DN_Connect is received.
  45  *
  46  *     wusb_devconnect_acked()  Ack done, release resources.
  47  *
  48  *   wusb_handle_dn_alive()     Called by notif.c:wusb_handle_dn()
  49  *                              for processing a DN_Alive pong from a device.
  50  *
  51  *   wusb_handle_dn_disconnect()Called by notif.c:wusb_handle_dn() to
  52  *                              process a disconnect request from a
  53  *                              device.
  54  *
  55  *   __wusb_dev_disable()       Called by rh.c:wusbhc_rh_clear_port_feat() when
  56  *                              disabling a port.
  57  *
  58  *   wusb_devconnect_create()   Called when creating the host by
  59  *                              lc.c:wusbhc_create().
  60  *
  61  *   wusb_devconnect_destroy()  Cleanup called removing the host. Called
  62  *                              by lc.c:wusbhc_destroy().
  63  *
  64  *   Each Wireless USB host maintains a list of DN_Connect requests
  65  *   (actually we maintain a list of pending Connect Acks, the
  66  *   wusbhc->ca_list).
  67  *
  68  * LIFE CYCLE OF port->wusb_dev
  69  *
  70  *   Before the @wusbhc structure put()s the reference it owns for
  71  *   port->wusb_dev [and clean the wusb_dev pointer], it needs to
  72  *   lock @wusbhc->mutex.
  73  */
  74 
  75 #include <linux/jiffies.h>
  76 #include <linux/ctype.h>
  77 #include <linux/slab.h>
  78 #include <linux/workqueue.h>
  79 #include <linux/export.h>
  80 #include "wusbhc.h"
  81 
  82 static void wusbhc_devconnect_acked_work(struct work_struct *work);
  83 
  84 static void wusb_dev_free(struct wusb_dev *wusb_dev)
  85 {
  86         kfree(wusb_dev);
  87 }
  88 
  89 static struct wusb_dev *wusb_dev_alloc(struct wusbhc *wusbhc)
  90 {
  91         struct wusb_dev *wusb_dev;
  92 
  93         wusb_dev = kzalloc(sizeof(*wusb_dev), GFP_KERNEL);
  94         if (wusb_dev == NULL)
  95                 goto err;
  96 
  97         wusb_dev->wusbhc = wusbhc;
  98 
  99         INIT_WORK(&wusb_dev->devconnect_acked_work, wusbhc_devconnect_acked_work);
 100 
 101         return wusb_dev;
 102 err:
 103         wusb_dev_free(wusb_dev);
 104         return NULL;
 105 }
 106 
 107 
 108 /*
 109  * Using the Connect-Ack list, fill out the @wusbhc Connect-Ack WUSB IE
 110  * properly so that it can be added to the MMC.
 111  *
 112  * We just get the @wusbhc->ca_list and fill out the first four ones or
 113  * less (per-spec WUSB1.0[7.5, before T7-38). If the ConnectAck WUSB
 114  * IE is not allocated, we alloc it.
 115  *
 116  * @wusbhc->mutex must be taken
 117  */
 118 static void wusbhc_fill_cack_ie(struct wusbhc *wusbhc)
 119 {
 120         unsigned cnt;
 121         struct wusb_dev *dev_itr;
 122         struct wuie_connect_ack *cack_ie;
 123 
 124         cack_ie = &wusbhc->cack_ie;
 125         cnt = 0;
 126         list_for_each_entry(dev_itr, &wusbhc->cack_list, cack_node) {
 127                 cack_ie->blk[cnt].CDID = dev_itr->cdid;
 128                 cack_ie->blk[cnt].bDeviceAddress = dev_itr->addr;
 129                 if (++cnt >= WUIE_ELT_MAX)
 130                         break;
 131         }
 132         cack_ie->hdr.bLength = sizeof(cack_ie->hdr)
 133                 + cnt * sizeof(cack_ie->blk[0]);
 134 }
 135 
 136 /*
 137  * Register a new device that wants to connect
 138  *
 139  * A new device wants to connect, so we add it to the Connect-Ack
 140  * list. We give it an address in the unauthorized range (bit 8 set);
 141  * user space will have to drive authorization further on.
 142  *
 143  * @dev_addr: address to use for the device (which is also the port
 144  *            number).
 145  *
 146  * @wusbhc->mutex must be taken
 147  */
 148 static struct wusb_dev *wusbhc_cack_add(struct wusbhc *wusbhc,
 149                                         struct wusb_dn_connect *dnc,
 150                                         const char *pr_cdid, u8 port_idx)
 151 {
 152         struct device *dev = wusbhc->dev;
 153         struct wusb_dev *wusb_dev;
 154         int new_connection = wusb_dn_connect_new_connection(dnc);
 155         u8 dev_addr;
 156         int result;
 157 
 158         /* Is it registered already? */
 159         list_for_each_entry(wusb_dev, &wusbhc->cack_list, cack_node)
 160                 if (!memcmp(&wusb_dev->cdid, &dnc->CDID,
 161                             sizeof(wusb_dev->cdid)))
 162                         return wusb_dev;
 163         /* We don't have it, create an entry, register it */
 164         wusb_dev = wusb_dev_alloc(wusbhc);
 165         if (wusb_dev == NULL)
 166                 return NULL;
 167         wusb_dev_init(wusb_dev);
 168         wusb_dev->cdid = dnc->CDID;
 169         wusb_dev->port_idx = port_idx;
 170 
 171         /*
 172          * Devices are always available within the cluster reservation
 173          * and since the hardware will take the intersection of the
 174          * per-device availability and the cluster reservation, the
 175          * per-device availability can simply be set to always
 176          * available.
 177          */
 178         bitmap_fill(wusb_dev->availability.bm, UWB_NUM_MAS);
 179 
 180         /* FIXME: handle reconnects instead of assuming connects are
 181            always new. */
 182         if (1 && new_connection == 0)
 183                 new_connection = 1;
 184         if (new_connection) {
 185                 dev_addr = (port_idx + 2) | WUSB_DEV_ADDR_UNAUTH;
 186 
 187                 dev_info(dev, "Connecting new WUSB device to address %u, "
 188                         "port %u\n", dev_addr, port_idx);
 189 
 190                 result = wusb_set_dev_addr(wusbhc, wusb_dev, dev_addr);
 191                 if (result < 0)
 192                         return NULL;
 193         }
 194         wusb_dev->entry_ts = jiffies;
 195         list_add_tail(&wusb_dev->cack_node, &wusbhc->cack_list);
 196         wusbhc->cack_count++;
 197         wusbhc_fill_cack_ie(wusbhc);
 198 
 199         return wusb_dev;
 200 }
 201 
 202 /*
 203  * Remove a Connect-Ack context entry from the HCs view
 204  *
 205  * @wusbhc->mutex must be taken
 206  */
 207 static void wusbhc_cack_rm(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
 208 {
 209         list_del_init(&wusb_dev->cack_node);
 210         wusbhc->cack_count--;
 211         wusbhc_fill_cack_ie(wusbhc);
 212 }
 213 
 214 /*
 215  * @wusbhc->mutex must be taken */
 216 static
 217 void wusbhc_devconnect_acked(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
 218 {
 219         wusbhc_cack_rm(wusbhc, wusb_dev);
 220         if (wusbhc->cack_count)
 221                 wusbhc_mmcie_set(wusbhc, 0, 0, &wusbhc->cack_ie.hdr);
 222         else
 223                 wusbhc_mmcie_rm(wusbhc, &wusbhc->cack_ie.hdr);
 224 }
 225 
 226 static void wusbhc_devconnect_acked_work(struct work_struct *work)
 227 {
 228         struct wusb_dev *wusb_dev = container_of(work, struct wusb_dev,
 229                                                  devconnect_acked_work);
 230         struct wusbhc *wusbhc = wusb_dev->wusbhc;
 231 
 232         mutex_lock(&wusbhc->mutex);
 233         wusbhc_devconnect_acked(wusbhc, wusb_dev);
 234         mutex_unlock(&wusbhc->mutex);
 235 
 236         wusb_dev_put(wusb_dev);
 237 }
 238 
 239 /*
 240  * Ack a device for connection
 241  *
 242  * FIXME: docs
 243  *
 244  * @pr_cdid:    Printable CDID...hex Use @dnc->cdid for the real deal.
 245  *
 246  * So we get the connect ack IE (may have been allocated already),
 247  * find an empty connect block, an empty virtual port, create an
 248  * address with it (see below), make it an unauth addr [bit 7 set] and
 249  * set the MMC.
 250  *
 251  * Addresses: because WUSB hosts have no downstream hubs, we can do a
 252  *            1:1 mapping between 'port number' and device
 253  *            address. This simplifies many things, as during this
 254  *            initial connect phase the USB stack has no knowledge of
 255  *            the device and hasn't assigned an address yet--we know
 256  *            USB's choose_address() will use the same heuristics we
 257  *            use here, so we can assume which address will be assigned.
 258  *
 259  *            USB stack always assigns address 1 to the root hub, so
 260  *            to the port number we add 2 (thus virtual port #0 is
 261  *            addr #2).
 262  *
 263  * @wusbhc shall be referenced
 264  */
 265 static
 266 void wusbhc_devconnect_ack(struct wusbhc *wusbhc, struct wusb_dn_connect *dnc,
 267                            const char *pr_cdid)
 268 {
 269         int result;
 270         struct device *dev = wusbhc->dev;
 271         struct wusb_dev *wusb_dev;
 272         struct wusb_port *port;
 273         unsigned idx;
 274 
 275         mutex_lock(&wusbhc->mutex);
 276 
 277         /* Check we are not handling it already */
 278         for (idx = 0; idx < wusbhc->ports_max; idx++) {
 279                 port = wusb_port_by_idx(wusbhc, idx);
 280                 if (port->wusb_dev
 281                     && memcmp(&dnc->CDID, &port->wusb_dev->cdid, sizeof(dnc->CDID)) == 0)
 282                         goto error_unlock;
 283         }
 284         /* Look up those fake ports we have for a free one */
 285         for (idx = 0; idx < wusbhc->ports_max; idx++) {
 286                 port = wusb_port_by_idx(wusbhc, idx);
 287                 if ((port->status & USB_PORT_STAT_POWER)
 288                     && !(port->status & USB_PORT_STAT_CONNECTION))
 289                         break;
 290         }
 291         if (idx >= wusbhc->ports_max) {
 292                 dev_err(dev, "Host controller can't connect more devices "
 293                         "(%u already connected); device %s rejected\n",
 294                         wusbhc->ports_max, pr_cdid);
 295                 /* NOTE: we could send a WUIE_Disconnect here, but we haven't
 296                  *       event acked, so the device will eventually timeout the
 297                  *       connection, right? */
 298                 goto error_unlock;
 299         }
 300 
 301         /* Make sure we are using no crypto on that "virtual port" */
 302         wusbhc->set_ptk(wusbhc, idx, 0, NULL, 0);
 303 
 304         /* Grab a filled in Connect-Ack context, fill out the
 305          * Connect-Ack Wireless USB IE, set the MMC */
 306         wusb_dev = wusbhc_cack_add(wusbhc, dnc, pr_cdid, idx);
 307         if (wusb_dev == NULL)
 308                 goto error_unlock;
 309         result = wusbhc_mmcie_set(wusbhc, 0, 0, &wusbhc->cack_ie.hdr);
 310         if (result < 0)
 311                 goto error_unlock;
 312         /* Give the device at least 2ms (WUSB1.0[7.5.1p3]), let's do
 313          * three for a good measure */
 314         msleep(3);
 315         port->wusb_dev = wusb_dev;
 316         port->status |= USB_PORT_STAT_CONNECTION;
 317         port->change |= USB_PORT_STAT_C_CONNECTION;
 318         /* Now the port status changed to connected; hub_wq will
 319          * pick the change up and try to reset the port to bring it to
 320          * the enabled state--so this process returns up to the stack
 321          * and it calls back into wusbhc_rh_port_reset().
 322          */
 323 error_unlock:
 324         mutex_unlock(&wusbhc->mutex);
 325         return;
 326 
 327 }
 328 
 329 /*
 330  * Disconnect a Wireless USB device from its fake port
 331  *
 332  * Marks the port as disconnected so that hub_wq can pick up the change
 333  * and drops our knowledge about the device.
 334  *
 335  * Assumes there is a device connected
 336  *
 337  * @port_index: zero based port number
 338  *
 339  * NOTE: @wusbhc->mutex is locked
 340  *
 341  * WARNING: From here it is not very safe to access anything hanging off
 342  *          wusb_dev
 343  */
 344 static void __wusbhc_dev_disconnect(struct wusbhc *wusbhc,
 345                                     struct wusb_port *port)
 346 {
 347         struct wusb_dev *wusb_dev = port->wusb_dev;
 348 
 349         port->status &= ~(USB_PORT_STAT_CONNECTION | USB_PORT_STAT_ENABLE
 350                           | USB_PORT_STAT_SUSPEND | USB_PORT_STAT_RESET
 351                           | USB_PORT_STAT_LOW_SPEED | USB_PORT_STAT_HIGH_SPEED);
 352         port->change |= USB_PORT_STAT_C_CONNECTION | USB_PORT_STAT_C_ENABLE;
 353         if (wusb_dev) {
 354                 dev_dbg(wusbhc->dev, "disconnecting device from port %d\n", wusb_dev->port_idx);
 355                 if (!list_empty(&wusb_dev->cack_node))
 356                         list_del_init(&wusb_dev->cack_node);
 357                 /* For the one in cack_add() */
 358                 wusb_dev_put(wusb_dev);
 359         }
 360         port->wusb_dev = NULL;
 361 
 362         /* After a device disconnects, change the GTK (see [WUSB]
 363          * section 6.2.11.2). */
 364         if (wusbhc->active)
 365                 wusbhc_gtk_rekey(wusbhc);
 366 
 367         /* The Wireless USB part has forgotten about the device already; now
 368          * hub_wq's timer will pick up the disconnection and remove the USB
 369          * device from the system
 370          */
 371 }
 372 
 373 /*
 374  * Refresh the list of keep alives to emit in the MMC
 375  *
 376  * We only publish the first four devices that have a coming timeout
 377  * condition. Then when we are done processing those, we go for the
 378  * next ones. We ignore the ones that have timed out already (they'll
 379  * be purged).
 380  *
 381  * This might cause the first devices to timeout the last devices in
 382  * the port array...FIXME: come up with a better algorithm?
 383  *
 384  * Note we can't do much about MMC's ops errors; we hope next refresh
 385  * will kind of handle it.
 386  *
 387  * NOTE: @wusbhc->mutex is locked
 388  */
 389 static void __wusbhc_keep_alive(struct wusbhc *wusbhc)
 390 {
 391         struct device *dev = wusbhc->dev;
 392         unsigned cnt;
 393         struct wusb_dev *wusb_dev;
 394         struct wusb_port *wusb_port;
 395         struct wuie_keep_alive *ie = &wusbhc->keep_alive_ie;
 396         unsigned keep_alives, old_keep_alives;
 397 
 398         old_keep_alives = ie->hdr.bLength - sizeof(ie->hdr);
 399         keep_alives = 0;
 400         for (cnt = 0;
 401              keep_alives < WUIE_ELT_MAX && cnt < wusbhc->ports_max;
 402              cnt++) {
 403                 unsigned tt = msecs_to_jiffies(wusbhc->trust_timeout);
 404 
 405                 wusb_port = wusb_port_by_idx(wusbhc, cnt);
 406                 wusb_dev = wusb_port->wusb_dev;
 407 
 408                 if (wusb_dev == NULL)
 409                         continue;
 410                 if (wusb_dev->usb_dev == NULL)
 411                         continue;
 412 
 413                 if (time_after(jiffies, wusb_dev->entry_ts + tt)) {
 414                         dev_err(dev, "KEEPALIVE: device %u timed out\n",
 415                                 wusb_dev->addr);
 416                         __wusbhc_dev_disconnect(wusbhc, wusb_port);
 417                 } else if (time_after(jiffies, wusb_dev->entry_ts + tt/3)) {
 418                         /* Approaching timeout cut off, need to refresh */
 419                         ie->bDeviceAddress[keep_alives++] = wusb_dev->addr;
 420                 }
 421         }
 422         if (keep_alives & 0x1)  /* pad to even number ([WUSB] section 7.5.9) */
 423                 ie->bDeviceAddress[keep_alives++] = 0x7f;
 424         ie->hdr.bLength = sizeof(ie->hdr) +
 425                 keep_alives*sizeof(ie->bDeviceAddress[0]);
 426         if (keep_alives > 0)
 427                 wusbhc_mmcie_set(wusbhc, 10, 5, &ie->hdr);
 428         else if (old_keep_alives != 0)
 429                 wusbhc_mmcie_rm(wusbhc, &ie->hdr);
 430 }
 431 
 432 /*
 433  * Do a run through all devices checking for timeouts
 434  */
 435 static void wusbhc_keep_alive_run(struct work_struct *ws)
 436 {
 437         struct delayed_work *dw = to_delayed_work(ws);
 438         struct wusbhc *wusbhc = container_of(dw, struct wusbhc, keep_alive_timer);
 439 
 440         mutex_lock(&wusbhc->mutex);
 441         __wusbhc_keep_alive(wusbhc);
 442         mutex_unlock(&wusbhc->mutex);
 443 
 444         queue_delayed_work(wusbd, &wusbhc->keep_alive_timer,
 445                            msecs_to_jiffies(wusbhc->trust_timeout / 2));
 446 }
 447 
 448 /*
 449  * Find the wusb_dev from its device address.
 450  *
 451  * The device can be found directly from the address (see
 452  * wusb_cack_add() for where the device address is set to port_idx
 453  * +2), except when the address is zero.
 454  */
 455 static struct wusb_dev *wusbhc_find_dev_by_addr(struct wusbhc *wusbhc, u8 addr)
 456 {
 457         int p;
 458 
 459         if (addr == 0xff) /* unconnected */
 460                 return NULL;
 461 
 462         if (addr > 0) {
 463                 int port = (addr & ~0x80) - 2;
 464                 if (port < 0 || port >= wusbhc->ports_max)
 465                         return NULL;
 466                 return wusb_port_by_idx(wusbhc, port)->wusb_dev;
 467         }
 468 
 469         /* Look for the device with address 0. */
 470         for (p = 0; p < wusbhc->ports_max; p++) {
 471                 struct wusb_dev *wusb_dev = wusb_port_by_idx(wusbhc, p)->wusb_dev;
 472                 if (wusb_dev && wusb_dev->addr == addr)
 473                         return wusb_dev;
 474         }
 475         return NULL;
 476 }
 477 
 478 /*
 479  * Handle a DN_Alive notification (WUSB1.0[7.6.1])
 480  *
 481  * This just updates the device activity timestamp and then refreshes
 482  * the keep alive IE.
 483  *
 484  * @wusbhc shall be referenced and unlocked
 485  */
 486 static void wusbhc_handle_dn_alive(struct wusbhc *wusbhc, u8 srcaddr)
 487 {
 488         struct wusb_dev *wusb_dev;
 489 
 490         mutex_lock(&wusbhc->mutex);
 491         wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
 492         if (wusb_dev == NULL) {
 493                 dev_dbg(wusbhc->dev, "ignoring DN_Alive from unconnected device %02x\n",
 494                         srcaddr);
 495         } else {
 496                 wusb_dev->entry_ts = jiffies;
 497                 __wusbhc_keep_alive(wusbhc);
 498         }
 499         mutex_unlock(&wusbhc->mutex);
 500 }
 501 
 502 /*
 503  * Handle a DN_Connect notification (WUSB1.0[7.6.1])
 504  *
 505  * @wusbhc
 506  * @pkt_hdr
 507  * @size:    Size of the buffer where the notification resides; if the
 508  *           notification data suggests there should be more data than
 509  *           available, an error will be signaled and the whole buffer
 510  *           consumed.
 511  *
 512  * @wusbhc->mutex shall be held
 513  */
 514 static void wusbhc_handle_dn_connect(struct wusbhc *wusbhc,
 515                                      struct wusb_dn_hdr *dn_hdr,
 516                                      size_t size)
 517 {
 518         struct device *dev = wusbhc->dev;
 519         struct wusb_dn_connect *dnc;
 520         char pr_cdid[WUSB_CKHDID_STRSIZE];
 521         static const char *beacon_behaviour[] = {
 522                 "reserved",
 523                 "self-beacon",
 524                 "directed-beacon",
 525                 "no-beacon"
 526         };
 527 
 528         if (size < sizeof(*dnc)) {
 529                 dev_err(dev, "DN CONNECT: short notification (%zu < %zu)\n",
 530                         size, sizeof(*dnc));
 531                 return;
 532         }
 533 
 534         dnc = container_of(dn_hdr, struct wusb_dn_connect, hdr);
 535         sprintf(pr_cdid, "%16ph", dnc->CDID.data);
 536         dev_info(dev, "DN CONNECT: device %s @ %x (%s) wants to %s\n",
 537                  pr_cdid,
 538                  wusb_dn_connect_prev_dev_addr(dnc),
 539                  beacon_behaviour[wusb_dn_connect_beacon_behavior(dnc)],
 540                  wusb_dn_connect_new_connection(dnc) ? "connect" : "reconnect");
 541         /* ACK the connect */
 542         wusbhc_devconnect_ack(wusbhc, dnc, pr_cdid);
 543 }
 544 
 545 /*
 546  * Handle a DN_Disconnect notification (WUSB1.0[7.6.1])
 547  *
 548  * Device is going down -- do the disconnect.
 549  *
 550  * @wusbhc shall be referenced and unlocked
 551  */
 552 static void wusbhc_handle_dn_disconnect(struct wusbhc *wusbhc, u8 srcaddr)
 553 {
 554         struct device *dev = wusbhc->dev;
 555         struct wusb_dev *wusb_dev;
 556 
 557         mutex_lock(&wusbhc->mutex);
 558         wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
 559         if (wusb_dev == NULL) {
 560                 dev_dbg(dev, "ignoring DN DISCONNECT from unconnected device %02x\n",
 561                         srcaddr);
 562         } else {
 563                 dev_info(dev, "DN DISCONNECT: device 0x%02x going down\n",
 564                         wusb_dev->addr);
 565                 __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc,
 566                         wusb_dev->port_idx));
 567         }
 568         mutex_unlock(&wusbhc->mutex);
 569 }
 570 
 571 /*
 572  * Handle a Device Notification coming a host
 573  *
 574  * The Device Notification comes from a host (HWA, DWA or WHCI)
 575  * wrapped in a set of headers. Somebody else has peeled off those
 576  * headers for us and we just get one Device Notifications.
 577  *
 578  * Invalid DNs (e.g., too short) are discarded.
 579  *
 580  * @wusbhc shall be referenced
 581  *
 582  * FIXMES:
 583  *  - implement priorities as in WUSB1.0[Table 7-55]?
 584  */
 585 void wusbhc_handle_dn(struct wusbhc *wusbhc, u8 srcaddr,
 586                       struct wusb_dn_hdr *dn_hdr, size_t size)
 587 {
 588         struct device *dev = wusbhc->dev;
 589 
 590         if (size < sizeof(struct wusb_dn_hdr)) {
 591                 dev_err(dev, "DN data shorter than DN header (%d < %d)\n",
 592                         (int)size, (int)sizeof(struct wusb_dn_hdr));
 593                 return;
 594         }
 595         switch (dn_hdr->bType) {
 596         case WUSB_DN_CONNECT:
 597                 wusbhc_handle_dn_connect(wusbhc, dn_hdr, size);
 598                 break;
 599         case WUSB_DN_ALIVE:
 600                 wusbhc_handle_dn_alive(wusbhc, srcaddr);
 601                 break;
 602         case WUSB_DN_DISCONNECT:
 603                 wusbhc_handle_dn_disconnect(wusbhc, srcaddr);
 604                 break;
 605         case WUSB_DN_MASAVAILCHANGED:
 606         case WUSB_DN_RWAKE:
 607         case WUSB_DN_SLEEP:
 608                 /* FIXME: handle these DNs. */
 609                 break;
 610         case WUSB_DN_EPRDY:
 611                 /* The hardware handles these. */
 612                 break;
 613         default:
 614                 dev_warn(dev, "unknown DN %u (%d octets) from %u\n",
 615                          dn_hdr->bType, (int)size, srcaddr);
 616         }
 617 }
 618 EXPORT_SYMBOL_GPL(wusbhc_handle_dn);
 619 
 620 /*
 621  * Disconnect a WUSB device from a the cluster
 622  *
 623  * @wusbhc
 624  * @port     Fake port where the device is (wusbhc index, not USB port number).
 625  *
 626  * In Wireless USB, a disconnect is basically telling the device he is
 627  * being disconnected and forgetting about him.
 628  *
 629  * We send the device a Device Disconnect IE (WUSB1.0[7.5.11]) for 100
 630  * ms and then keep going.
 631  *
 632  * We don't do much in case of error; we always pretend we disabled
 633  * the port and disconnected the device. If physically the request
 634  * didn't get there (many things can fail in the way there), the stack
 635  * will reject the device's communication attempts.
 636  *
 637  * @wusbhc should be refcounted and locked
 638  */
 639 void __wusbhc_dev_disable(struct wusbhc *wusbhc, u8 port_idx)
 640 {
 641         int result;
 642         struct device *dev = wusbhc->dev;
 643         struct wusb_dev *wusb_dev;
 644         struct wuie_disconnect *ie;
 645 
 646         wusb_dev = wusb_port_by_idx(wusbhc, port_idx)->wusb_dev;
 647         if (wusb_dev == NULL) {
 648                 /* reset no device? ignore */
 649                 dev_dbg(dev, "DISCONNECT: no device at port %u, ignoring\n",
 650                         port_idx);
 651                 return;
 652         }
 653         __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc, port_idx));
 654 
 655         ie = kzalloc(sizeof(*ie), GFP_KERNEL);
 656         if (ie == NULL)
 657                 return;
 658         ie->hdr.bLength = sizeof(*ie);
 659         ie->hdr.bIEIdentifier = WUIE_ID_DEVICE_DISCONNECT;
 660         ie->bDeviceAddress = wusb_dev->addr;
 661         result = wusbhc_mmcie_set(wusbhc, 0, 0, &ie->hdr);
 662         if (result < 0)
 663                 dev_err(dev, "DISCONNECT: can't set MMC: %d\n", result);
 664         else {
 665                 /* At least 6 MMCs, assuming at least 1 MMC per zone. */
 666                 msleep(7*4);
 667                 wusbhc_mmcie_rm(wusbhc, &ie->hdr);
 668         }
 669         kfree(ie);
 670 }
 671 
 672 /*
 673  * Walk over the BOS descriptor, verify and grok it
 674  *
 675  * @usb_dev: referenced
 676  * @wusb_dev: referenced and unlocked
 677  *
 678  * The BOS descriptor is defined at WUSB1.0[7.4.1], and it defines a
 679  * "flexible" way to wrap all kinds of descriptors inside an standard
 680  * descriptor (wonder why they didn't use normal descriptors,
 681  * btw). Not like they lack code.
 682  *
 683  * At the end we go to look for the WUSB Device Capabilities
 684  * (WUSB1.0[7.4.1.1]) that is wrapped in a device capability descriptor
 685  * that is part of the BOS descriptor set. That tells us what does the
 686  * device support (dual role, beacon type, UWB PHY rates).
 687  */
 688 static int wusb_dev_bos_grok(struct usb_device *usb_dev,
 689                              struct wusb_dev *wusb_dev,
 690                              struct usb_bos_descriptor *bos, size_t desc_size)
 691 {
 692         ssize_t result;
 693         struct device *dev = &usb_dev->dev;
 694         void *itr, *top;
 695 
 696         /* Walk over BOS capabilities, verify them */
 697         itr = (void *)bos + sizeof(*bos);
 698         top = itr + desc_size - sizeof(*bos);
 699         while (itr < top) {
 700                 struct usb_dev_cap_header *cap_hdr = itr;
 701                 size_t cap_size;
 702                 u8 cap_type;
 703                 if (top - itr < sizeof(*cap_hdr)) {
 704                         dev_err(dev, "Device BUG? premature end of BOS header "
 705                                 "data [offset 0x%02x]: only %zu bytes left\n",
 706                                 (int)(itr - (void *)bos), top - itr);
 707                         result = -ENOSPC;
 708                         goto error_bad_cap;
 709                 }
 710                 cap_size = cap_hdr->bLength;
 711                 cap_type = cap_hdr->bDevCapabilityType;
 712                 if (cap_size == 0)
 713                         break;
 714                 if (cap_size > top - itr) {
 715                         dev_err(dev, "Device BUG? premature end of BOS data "
 716                                 "[offset 0x%02x cap %02x %zu bytes]: "
 717                                 "only %zu bytes left\n",
 718                                 (int)(itr - (void *)bos),
 719                                 cap_type, cap_size, top - itr);
 720                         result = -EBADF;
 721                         goto error_bad_cap;
 722                 }
 723                 switch (cap_type) {
 724                 case USB_CAP_TYPE_WIRELESS_USB:
 725                         if (cap_size != sizeof(*wusb_dev->wusb_cap_descr))
 726                                 dev_err(dev, "Device BUG? WUSB Capability "
 727                                         "descriptor is %zu bytes vs %zu "
 728                                         "needed\n", cap_size,
 729                                         sizeof(*wusb_dev->wusb_cap_descr));
 730                         else
 731                                 wusb_dev->wusb_cap_descr = itr;
 732                         break;
 733                 default:
 734                         dev_err(dev, "BUG? Unknown BOS capability 0x%02x "
 735                                 "(%zu bytes) at offset 0x%02x\n", cap_type,
 736                                 cap_size, (int)(itr - (void *)bos));
 737                 }
 738                 itr += cap_size;
 739         }
 740         result = 0;
 741 error_bad_cap:
 742         return result;
 743 }
 744 
 745 /*
 746  * Add information from the BOS descriptors to the device
 747  *
 748  * @usb_dev: referenced
 749  * @wusb_dev: referenced and unlocked
 750  *
 751  * So what we do is we alloc a space for the BOS descriptor of 64
 752  * bytes; read the first four bytes which include the wTotalLength
 753  * field (WUSB1.0[T7-26]) and if it fits in those 64 bytes, read the
 754  * whole thing. If not we realloc to that size.
 755  *
 756  * Then we call the groking function, that will fill up
 757  * wusb_dev->wusb_cap_descr, which is what we'll need later on.
 758  */
 759 static int wusb_dev_bos_add(struct usb_device *usb_dev,
 760                             struct wusb_dev *wusb_dev)
 761 {
 762         ssize_t result;
 763         struct device *dev = &usb_dev->dev;
 764         struct usb_bos_descriptor *bos;
 765         size_t alloc_size = 32, desc_size = 4;
 766 
 767         bos = kmalloc(alloc_size, GFP_KERNEL);
 768         if (bos == NULL)
 769                 return -ENOMEM;
 770         result = usb_get_descriptor(usb_dev, USB_DT_BOS, 0, bos, desc_size);
 771         if (result < 4) {
 772                 dev_err(dev, "Can't get BOS descriptor or too short: %zd\n",
 773                         result);
 774                 goto error_get_descriptor;
 775         }
 776         desc_size = le16_to_cpu(bos->wTotalLength);
 777         if (desc_size >= alloc_size) {
 778                 kfree(bos);
 779                 alloc_size = desc_size;
 780                 bos = kmalloc(alloc_size, GFP_KERNEL);
 781                 if (bos == NULL)
 782                         return -ENOMEM;
 783         }
 784         result = usb_get_descriptor(usb_dev, USB_DT_BOS, 0, bos, desc_size);
 785         if (result < 0 || result != desc_size) {
 786                 dev_err(dev, "Can't get  BOS descriptor or too short (need "
 787                         "%zu bytes): %zd\n", desc_size, result);
 788                 goto error_get_descriptor;
 789         }
 790         if (result < sizeof(*bos)
 791             || le16_to_cpu(bos->wTotalLength) != desc_size) {
 792                 dev_err(dev, "Can't get  BOS descriptor or too short (need "
 793                         "%zu bytes): %zd\n", desc_size, result);
 794                 goto error_get_descriptor;
 795         }
 796 
 797         result = wusb_dev_bos_grok(usb_dev, wusb_dev, bos, result);
 798         if (result < 0)
 799                 goto error_bad_bos;
 800         wusb_dev->bos = bos;
 801         return 0;
 802 
 803 error_bad_bos:
 804 error_get_descriptor:
 805         kfree(bos);
 806         wusb_dev->wusb_cap_descr = NULL;
 807         return result;
 808 }
 809 
 810 static void wusb_dev_bos_rm(struct wusb_dev *wusb_dev)
 811 {
 812         kfree(wusb_dev->bos);
 813         wusb_dev->wusb_cap_descr = NULL;
 814 };
 815 
 816 /*
 817  * USB stack's device addition Notifier Callback
 818  *
 819  * Called from drivers/usb/core/hub.c when a new device is added; we
 820  * use this hook to perform certain WUSB specific setup work on the
 821  * new device. As well, it is the first time we can connect the
 822  * wusb_dev and the usb_dev. So we note it down in wusb_dev and take a
 823  * reference that we'll drop.
 824  *
 825  * First we need to determine if the device is a WUSB device (else we
 826  * ignore it). For that we use the speed setting (USB_SPEED_WIRELESS)
 827  * [FIXME: maybe we'd need something more definitive]. If so, we track
 828  * it's usb_busd and from there, the WUSB HC.
 829  *
 830  * Because all WUSB HCs are contained in a 'struct wusbhc', voila, we
 831  * get the wusbhc for the device.
 832  *
 833  * We have a reference on @usb_dev (as we are called at the end of its
 834  * enumeration).
 835  *
 836  * NOTE: @usb_dev locked
 837  */
 838 static void wusb_dev_add_ncb(struct usb_device *usb_dev)
 839 {
 840         int result = 0;
 841         struct wusb_dev *wusb_dev;
 842         struct wusbhc *wusbhc;
 843         struct device *dev = &usb_dev->dev;
 844         u8 port_idx;
 845 
 846         if (usb_dev->wusb == 0 || usb_dev->devnum == 1)
 847                 return;         /* skip non wusb and wusb RHs */
 848 
 849         usb_set_device_state(usb_dev, USB_STATE_UNAUTHENTICATED);
 850 
 851         wusbhc = wusbhc_get_by_usb_dev(usb_dev);
 852         if (wusbhc == NULL)
 853                 goto error_nodev;
 854         mutex_lock(&wusbhc->mutex);
 855         wusb_dev = __wusb_dev_get_by_usb_dev(wusbhc, usb_dev);
 856         port_idx = wusb_port_no_to_idx(usb_dev->portnum);
 857         mutex_unlock(&wusbhc->mutex);
 858         if (wusb_dev == NULL)
 859                 goto error_nodev;
 860         wusb_dev->usb_dev = usb_get_dev(usb_dev);
 861         usb_dev->wusb_dev = wusb_dev_get(wusb_dev);
 862         result = wusb_dev_sec_add(wusbhc, usb_dev, wusb_dev);
 863         if (result < 0) {
 864                 dev_err(dev, "Cannot enable security: %d\n", result);
 865                 goto error_sec_add;
 866         }
 867         /* Now query the device for it's BOS and attach it to wusb_dev */
 868         result = wusb_dev_bos_add(usb_dev, wusb_dev);
 869         if (result < 0) {
 870                 dev_err(dev, "Cannot get BOS descriptors: %d\n", result);
 871                 goto error_bos_add;
 872         }
 873         result = wusb_dev_sysfs_add(wusbhc, usb_dev, wusb_dev);
 874         if (result < 0)
 875                 goto error_add_sysfs;
 876 out:
 877         wusb_dev_put(wusb_dev);
 878         wusbhc_put(wusbhc);
 879 error_nodev:
 880         return;
 881 
 882 error_add_sysfs:
 883         wusb_dev_bos_rm(wusb_dev);
 884 error_bos_add:
 885         wusb_dev_sec_rm(wusb_dev);
 886 error_sec_add:
 887         mutex_lock(&wusbhc->mutex);
 888         __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc, port_idx));
 889         mutex_unlock(&wusbhc->mutex);
 890         goto out;
 891 }
 892 
 893 /*
 894  * Undo all the steps done at connection by the notifier callback
 895  *
 896  * NOTE: @usb_dev locked
 897  */
 898 static void wusb_dev_rm_ncb(struct usb_device *usb_dev)
 899 {
 900         struct wusb_dev *wusb_dev = usb_dev->wusb_dev;
 901 
 902         if (usb_dev->wusb == 0 || usb_dev->devnum == 1)
 903                 return;         /* skip non wusb and wusb RHs */
 904 
 905         wusb_dev_sysfs_rm(wusb_dev);
 906         wusb_dev_bos_rm(wusb_dev);
 907         wusb_dev_sec_rm(wusb_dev);
 908         wusb_dev->usb_dev = NULL;
 909         usb_dev->wusb_dev = NULL;
 910         wusb_dev_put(wusb_dev);
 911         usb_put_dev(usb_dev);
 912 }
 913 
 914 /*
 915  * Handle notifications from the USB stack (notifier call back)
 916  *
 917  * This is called when the USB stack does a
 918  * usb_{bus,device}_{add,remove}() so we can do WUSB specific
 919  * handling. It is called with [for the case of
 920  * USB_DEVICE_{ADD,REMOVE} with the usb_dev locked.
 921  */
 922 int wusb_usb_ncb(struct notifier_block *nb, unsigned long val,
 923                  void *priv)
 924 {
 925         int result = NOTIFY_OK;
 926 
 927         switch (val) {
 928         case USB_DEVICE_ADD:
 929                 wusb_dev_add_ncb(priv);
 930                 break;
 931         case USB_DEVICE_REMOVE:
 932                 wusb_dev_rm_ncb(priv);
 933                 break;
 934         case USB_BUS_ADD:
 935                 /* ignore (for now) */
 936         case USB_BUS_REMOVE:
 937                 break;
 938         default:
 939                 WARN_ON(1);
 940                 result = NOTIFY_BAD;
 941         }
 942         return result;
 943 }
 944 
 945 /*
 946  * Return a referenced wusb_dev given a @wusbhc and @usb_dev
 947  */
 948 struct wusb_dev *__wusb_dev_get_by_usb_dev(struct wusbhc *wusbhc,
 949                                            struct usb_device *usb_dev)
 950 {
 951         struct wusb_dev *wusb_dev;
 952         u8 port_idx;
 953 
 954         port_idx = wusb_port_no_to_idx(usb_dev->portnum);
 955         BUG_ON(port_idx > wusbhc->ports_max);
 956         wusb_dev = wusb_port_by_idx(wusbhc, port_idx)->wusb_dev;
 957         if (wusb_dev != NULL)           /* ops, device is gone */
 958                 wusb_dev_get(wusb_dev);
 959         return wusb_dev;
 960 }
 961 EXPORT_SYMBOL_GPL(__wusb_dev_get_by_usb_dev);
 962 
 963 void wusb_dev_destroy(struct kref *_wusb_dev)
 964 {
 965         struct wusb_dev *wusb_dev = container_of(_wusb_dev, struct wusb_dev, refcnt);
 966 
 967         list_del_init(&wusb_dev->cack_node);
 968         wusb_dev_free(wusb_dev);
 969 }
 970 EXPORT_SYMBOL_GPL(wusb_dev_destroy);
 971 
 972 /*
 973  * Create all the device connect handling infrastructure
 974  *
 975  * This is basically the device info array, Connect Acknowledgement
 976  * (cack) lists, keep-alive timers (and delayed work thread).
 977  */
 978 int wusbhc_devconnect_create(struct wusbhc *wusbhc)
 979 {
 980         wusbhc->keep_alive_ie.hdr.bIEIdentifier = WUIE_ID_KEEP_ALIVE;
 981         wusbhc->keep_alive_ie.hdr.bLength = sizeof(wusbhc->keep_alive_ie.hdr);
 982         INIT_DELAYED_WORK(&wusbhc->keep_alive_timer, wusbhc_keep_alive_run);
 983 
 984         wusbhc->cack_ie.hdr.bIEIdentifier = WUIE_ID_CONNECTACK;
 985         wusbhc->cack_ie.hdr.bLength = sizeof(wusbhc->cack_ie.hdr);
 986         INIT_LIST_HEAD(&wusbhc->cack_list);
 987 
 988         return 0;
 989 }
 990 
 991 /*
 992  * Release all resources taken by the devconnect stuff
 993  */
 994 void wusbhc_devconnect_destroy(struct wusbhc *wusbhc)
 995 {
 996         /* no op */
 997 }
 998 
 999 /*
1000  * wusbhc_devconnect_start - start accepting device connections
1001  * @wusbhc: the WUSB HC
1002  *
1003  * Sets the Host Info IE to accept all new connections.
1004  *
1005  * FIXME: This also enables the keep alives but this is not necessary
1006  * until there are connected and authenticated devices.
1007  */
1008 int wusbhc_devconnect_start(struct wusbhc *wusbhc)
1009 {
1010         struct device *dev = wusbhc->dev;
1011         struct wuie_host_info *hi;
1012         int result;
1013 
1014         hi = kzalloc(sizeof(*hi), GFP_KERNEL);
1015         if (hi == NULL)
1016                 return -ENOMEM;
1017 
1018         hi->hdr.bLength       = sizeof(*hi);
1019         hi->hdr.bIEIdentifier = WUIE_ID_HOST_INFO;
1020         hi->attributes        = cpu_to_le16((wusbhc->rsv->stream << 3) | WUIE_HI_CAP_ALL);
1021         hi->CHID              = wusbhc->chid;
1022         result = wusbhc_mmcie_set(wusbhc, 0, 0, &hi->hdr);
1023         if (result < 0) {
1024                 dev_err(dev, "Cannot add Host Info MMCIE: %d\n", result);
1025                 goto error_mmcie_set;
1026         }
1027         wusbhc->wuie_host_info = hi;
1028 
1029         queue_delayed_work(wusbd, &wusbhc->keep_alive_timer,
1030                            msecs_to_jiffies(wusbhc->trust_timeout / 2));
1031 
1032         return 0;
1033 
1034 error_mmcie_set:
1035         kfree(hi);
1036         return result;
1037 }
1038 
1039 /*
1040  * wusbhc_devconnect_stop - stop managing connected devices
1041  * @wusbhc: the WUSB HC
1042  *
1043  * Disconnects any devices still connected, stops the keep alives and
1044  * removes the Host Info IE.
1045  */
1046 void wusbhc_devconnect_stop(struct wusbhc *wusbhc)
1047 {
1048         int i;
1049 
1050         mutex_lock(&wusbhc->mutex);
1051         for (i = 0; i < wusbhc->ports_max; i++) {
1052                 if (wusbhc->port[i].wusb_dev)
1053                         __wusbhc_dev_disconnect(wusbhc, &wusbhc->port[i]);
1054         }
1055         mutex_unlock(&wusbhc->mutex);
1056 
1057         cancel_delayed_work_sync(&wusbhc->keep_alive_timer);
1058         wusbhc_mmcie_rm(wusbhc, &wusbhc->wuie_host_info->hdr);
1059         kfree(wusbhc->wuie_host_info);
1060         wusbhc->wuie_host_info = NULL;
1061 }
1062 
1063 /*
1064  * wusb_set_dev_addr - set the WUSB device address used by the host
1065  * @wusbhc: the WUSB HC the device is connect to
1066  * @wusb_dev: the WUSB device
1067  * @addr: new device address
1068  */
1069 int wusb_set_dev_addr(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev, u8 addr)
1070 {
1071         int result;
1072 
1073         wusb_dev->addr = addr;
1074         result = wusbhc->dev_info_set(wusbhc, wusb_dev);
1075         if (result < 0)
1076                 dev_err(wusbhc->dev, "device %d: failed to set device "
1077                         "address\n", wusb_dev->port_idx);
1078         else
1079                 dev_info(wusbhc->dev, "device %d: %s addr %u\n",
1080                          wusb_dev->port_idx,
1081                          (addr & WUSB_DEV_ADDR_UNAUTH) ? "unauth" : "auth",
1082                          wusb_dev->addr);
1083 
1084         return result;
1085 }