• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * WUSB Wire Adapter: Control/Data Streaming Interface (WUSB[8])
3  * Device Connect handling
4  *
5  * Copyright (C) 2006 Intel Corporation
6  * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
7  *
8  * This program is free software; you can redistribute it and/or
9  * modify it under the terms of the GNU General Public License version
10  * 2 as published by the Free Software Foundation.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program; if not, write to the Free Software
19  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
20  * 02110-1301, USA.
21  *
22  *
23  * FIXME: docs
24  * FIXME: this file needs to be broken up, it's grown too big
25  *
26  *
27  * WUSB1.0[7.1, 7.5.1, ]
28  *
29  * WUSB device connection is kind of messy. Some background:
30  *
31  *     When a device wants to connect it scans the UWB radio channels
32  *     looking for a WUSB Channel; a WUSB channel is defined by MMCs
33  *     (Micro Managed Commands or something like that) [see
34  *     Design-overview for more on this] .
35  *
36  * So, device scans the radio, finds MMCs and thus a host and checks
37  * when the next DNTS is. It sends a Device Notification Connect
38  * (DN_Connect); the host picks it up (through nep.c and notif.c, ends
39  * up in wusb_devconnect_ack(), which creates a wusb_dev structure in
40  * wusbhc->port[port_number].wusb_dev), assigns an unauth address
41  * to the device (this means from 0x80 to 0xfe) and sends, in the MMC
42  * a Connect Ack Information Element (ConnAck IE).
43  *
44  * So now the device now has a WUSB address. From now on, we use
45  * that to talk to it in the RPipes.
46  *
47  * ASSUMPTIONS:
48  *
49  *  - We use the the as device address the port number where it is
50  *    connected (port 0 doesn't exist). For unauth, it is 128 + that.
51  *
52  * ROADMAP:
53  *
54  *   This file contains the logic for doing that--entry points:
55  *
56  *   wusb_devconnect_ack()      Ack a device until _acked() called.
57  *                              Called by notif.c:wusb_handle_dn_connect()
58  *                              when a DN_Connect is received.
59  *
60  *     wusb_devconnect_acked()  Ack done, release resources.
61  *
62  *   wusb_handle_dn_alive()     Called by notif.c:wusb_handle_dn()
63  *                              for processing a DN_Alive pong from a device.
64  *
65  *   wusb_handle_dn_disconnect()Called by notif.c:wusb_handle_dn() to
66  *                              process a disconenct request from a
67  *                              device.
68  *
69  *   __wusb_dev_disable()       Called by rh.c:wusbhc_rh_clear_port_feat() when
70  *                              disabling a port.
71  *
72  *   wusb_devconnect_create()   Called when creating the host by
73  *                              lc.c:wusbhc_create().
74  *
75  *   wusb_devconnect_destroy()  Cleanup called removing the host. Called
76  *                              by lc.c:wusbhc_destroy().
77  *
78  *   Each Wireless USB host maintains a list of DN_Connect requests
79  *   (actually we maintain a list of pending Connect Acks, the
80  *   wusbhc->ca_list).
81  *
82  * LIFE CYCLE OF port->wusb_dev
83  *
84  *   Before the @wusbhc structure put()s the reference it owns for
85  *   port->wusb_dev [and clean the wusb_dev pointer], it needs to
86  *   lock @wusbhc->mutex.
87  */
88 
89 #include <linux/jiffies.h>
90 #include <linux/ctype.h>
91 #include <linux/slab.h>
92 #include <linux/workqueue.h>
93 #include <linux/export.h>
94 #include "wusbhc.h"
95 
96 static void wusbhc_devconnect_acked_work(struct work_struct *work);
97 
wusb_dev_free(struct wusb_dev * wusb_dev)98 static void wusb_dev_free(struct wusb_dev *wusb_dev)
99 {
100 	kfree(wusb_dev);
101 }
102 
wusb_dev_alloc(struct wusbhc * wusbhc)103 static struct wusb_dev *wusb_dev_alloc(struct wusbhc *wusbhc)
104 {
105 	struct wusb_dev *wusb_dev;
106 
107 	wusb_dev = kzalloc(sizeof(*wusb_dev), GFP_KERNEL);
108 	if (wusb_dev == NULL)
109 		goto err;
110 
111 	wusb_dev->wusbhc = wusbhc;
112 
113 	INIT_WORK(&wusb_dev->devconnect_acked_work, wusbhc_devconnect_acked_work);
114 
115 	return wusb_dev;
116 err:
117 	wusb_dev_free(wusb_dev);
118 	return NULL;
119 }
120 
121 
122 /*
123  * Using the Connect-Ack list, fill out the @wusbhc Connect-Ack WUSB IE
124  * properly so that it can be added to the MMC.
125  *
126  * We just get the @wusbhc->ca_list and fill out the first four ones or
127  * less (per-spec WUSB1.0[7.5, before T7-38). If the ConnectAck WUSB
128  * IE is not allocated, we alloc it.
129  *
130  * @wusbhc->mutex must be taken
131  */
wusbhc_fill_cack_ie(struct wusbhc * wusbhc)132 static void wusbhc_fill_cack_ie(struct wusbhc *wusbhc)
133 {
134 	unsigned cnt;
135 	struct wusb_dev *dev_itr;
136 	struct wuie_connect_ack *cack_ie;
137 
138 	cack_ie = &wusbhc->cack_ie;
139 	cnt = 0;
140 	list_for_each_entry(dev_itr, &wusbhc->cack_list, cack_node) {
141 		cack_ie->blk[cnt].CDID = dev_itr->cdid;
142 		cack_ie->blk[cnt].bDeviceAddress = dev_itr->addr;
143 		if (++cnt >= WUIE_ELT_MAX)
144 			break;
145 	}
146 	cack_ie->hdr.bLength = sizeof(cack_ie->hdr)
147 		+ cnt * sizeof(cack_ie->blk[0]);
148 }
149 
150 /*
151  * Register a new device that wants to connect
152  *
153  * A new device wants to connect, so we add it to the Connect-Ack
154  * list. We give it an address in the unauthorized range (bit 8 set);
155  * user space will have to drive authorization further on.
156  *
157  * @dev_addr: address to use for the device (which is also the port
158  *            number).
159  *
160  * @wusbhc->mutex must be taken
161  */
wusbhc_cack_add(struct wusbhc * wusbhc,struct wusb_dn_connect * dnc,const char * pr_cdid,u8 port_idx)162 static struct wusb_dev *wusbhc_cack_add(struct wusbhc *wusbhc,
163 					struct wusb_dn_connect *dnc,
164 					const char *pr_cdid, u8 port_idx)
165 {
166 	struct device *dev = wusbhc->dev;
167 	struct wusb_dev *wusb_dev;
168 	int new_connection = wusb_dn_connect_new_connection(dnc);
169 	u8 dev_addr;
170 	int result;
171 
172 	/* Is it registered already? */
173 	list_for_each_entry(wusb_dev, &wusbhc->cack_list, cack_node)
174 		if (!memcmp(&wusb_dev->cdid, &dnc->CDID,
175 			    sizeof(wusb_dev->cdid)))
176 			return wusb_dev;
177 	/* We don't have it, create an entry, register it */
178 	wusb_dev = wusb_dev_alloc(wusbhc);
179 	if (wusb_dev == NULL)
180 		return NULL;
181 	wusb_dev_init(wusb_dev);
182 	wusb_dev->cdid = dnc->CDID;
183 	wusb_dev->port_idx = port_idx;
184 
185 	/*
186 	 * Devices are always available within the cluster reservation
187 	 * and since the hardware will take the intersection of the
188 	 * per-device availability and the cluster reservation, the
189 	 * per-device availability can simply be set to always
190 	 * available.
191 	 */
192 	bitmap_fill(wusb_dev->availability.bm, UWB_NUM_MAS);
193 
194 	/* FIXME: handle reconnects instead of assuming connects are
195 	   always new. */
196 	if (1 && new_connection == 0)
197 		new_connection = 1;
198 	if (new_connection) {
199 		dev_addr = (port_idx + 2) | WUSB_DEV_ADDR_UNAUTH;
200 
201 		dev_info(dev, "Connecting new WUSB device to address %u, "
202 			"port %u\n", dev_addr, port_idx);
203 
204 		result = wusb_set_dev_addr(wusbhc, wusb_dev, dev_addr);
205 		if (result < 0)
206 			return NULL;
207 	}
208 	wusb_dev->entry_ts = jiffies;
209 	list_add_tail(&wusb_dev->cack_node, &wusbhc->cack_list);
210 	wusbhc->cack_count++;
211 	wusbhc_fill_cack_ie(wusbhc);
212 
213 	return wusb_dev;
214 }
215 
216 /*
217  * Remove a Connect-Ack context entry from the HCs view
218  *
219  * @wusbhc->mutex must be taken
220  */
wusbhc_cack_rm(struct wusbhc * wusbhc,struct wusb_dev * wusb_dev)221 static void wusbhc_cack_rm(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
222 {
223 	list_del_init(&wusb_dev->cack_node);
224 	wusbhc->cack_count--;
225 	wusbhc_fill_cack_ie(wusbhc);
226 }
227 
228 /*
229  * @wusbhc->mutex must be taken */
230 static
wusbhc_devconnect_acked(struct wusbhc * wusbhc,struct wusb_dev * wusb_dev)231 void wusbhc_devconnect_acked(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
232 {
233 	wusbhc_cack_rm(wusbhc, wusb_dev);
234 	if (wusbhc->cack_count)
235 		wusbhc_mmcie_set(wusbhc, 0, 0, &wusbhc->cack_ie.hdr);
236 	else
237 		wusbhc_mmcie_rm(wusbhc, &wusbhc->cack_ie.hdr);
238 }
239 
wusbhc_devconnect_acked_work(struct work_struct * work)240 static void wusbhc_devconnect_acked_work(struct work_struct *work)
241 {
242 	struct wusb_dev *wusb_dev = container_of(work, struct wusb_dev,
243 						 devconnect_acked_work);
244 	struct wusbhc *wusbhc = wusb_dev->wusbhc;
245 
246 	mutex_lock(&wusbhc->mutex);
247 	wusbhc_devconnect_acked(wusbhc, wusb_dev);
248 	mutex_unlock(&wusbhc->mutex);
249 
250 	wusb_dev_put(wusb_dev);
251 }
252 
253 /*
254  * Ack a device for connection
255  *
256  * FIXME: docs
257  *
258  * @pr_cdid:	Printable CDID...hex Use @dnc->cdid for the real deal.
259  *
260  * So we get the connect ack IE (may have been allocated already),
261  * find an empty connect block, an empty virtual port, create an
262  * address with it (see below), make it an unauth addr [bit 7 set] and
263  * set the MMC.
264  *
265  * Addresses: because WUSB hosts have no downstream hubs, we can do a
266  *            1:1 mapping between 'port number' and device
267  *            address. This simplifies many things, as during this
268  *            initial connect phase the USB stack has no knowledge of
269  *            the device and hasn't assigned an address yet--we know
270  *            USB's choose_address() will use the same heuristics we
271  *            use here, so we can assume which address will be assigned.
272  *
273  *            USB stack always assigns address 1 to the root hub, so
274  *            to the port number we add 2 (thus virtual port #0 is
275  *            addr #2).
276  *
277  * @wusbhc shall be referenced
278  */
279 static
wusbhc_devconnect_ack(struct wusbhc * wusbhc,struct wusb_dn_connect * dnc,const char * pr_cdid)280 void wusbhc_devconnect_ack(struct wusbhc *wusbhc, struct wusb_dn_connect *dnc,
281 			   const char *pr_cdid)
282 {
283 	int result;
284 	struct device *dev = wusbhc->dev;
285 	struct wusb_dev *wusb_dev;
286 	struct wusb_port *port;
287 	unsigned idx;
288 
289 	mutex_lock(&wusbhc->mutex);
290 
291 	/* Check we are not handling it already */
292 	for (idx = 0; idx < wusbhc->ports_max; idx++) {
293 		port = wusb_port_by_idx(wusbhc, idx);
294 		if (port->wusb_dev
295 		    && memcmp(&dnc->CDID, &port->wusb_dev->cdid, sizeof(dnc->CDID)) == 0)
296 			goto error_unlock;
297 	}
298 	/* Look up those fake ports we have for a free one */
299 	for (idx = 0; idx < wusbhc->ports_max; idx++) {
300 		port = wusb_port_by_idx(wusbhc, idx);
301 		if ((port->status & USB_PORT_STAT_POWER)
302 		    && !(port->status & USB_PORT_STAT_CONNECTION))
303 			break;
304 	}
305 	if (idx >= wusbhc->ports_max) {
306 		dev_err(dev, "Host controller can't connect more devices "
307 			"(%u already connected); device %s rejected\n",
308 			wusbhc->ports_max, pr_cdid);
309 		/* NOTE: we could send a WUIE_Disconnect here, but we haven't
310 		 *       event acked, so the device will eventually timeout the
311 		 *       connection, right? */
312 		goto error_unlock;
313 	}
314 
315 	/* Make sure we are using no crypto on that "virtual port" */
316 	wusbhc->set_ptk(wusbhc, idx, 0, NULL, 0);
317 
318 	/* Grab a filled in Connect-Ack context, fill out the
319 	 * Connect-Ack Wireless USB IE, set the MMC */
320 	wusb_dev = wusbhc_cack_add(wusbhc, dnc, pr_cdid, idx);
321 	if (wusb_dev == NULL)
322 		goto error_unlock;
323 	result = wusbhc_mmcie_set(wusbhc, 0, 0, &wusbhc->cack_ie.hdr);
324 	if (result < 0)
325 		goto error_unlock;
326 	/* Give the device at least 2ms (WUSB1.0[7.5.1p3]), let's do
327 	 * three for a good measure */
328 	msleep(3);
329 	port->wusb_dev = wusb_dev;
330 	port->status |= USB_PORT_STAT_CONNECTION;
331 	port->change |= USB_PORT_STAT_C_CONNECTION;
332 	/* Now the port status changed to connected; hub_wq will
333 	 * pick the change up and try to reset the port to bring it to
334 	 * the enabled state--so this process returns up to the stack
335 	 * and it calls back into wusbhc_rh_port_reset().
336 	 */
337 error_unlock:
338 	mutex_unlock(&wusbhc->mutex);
339 	return;
340 
341 }
342 
343 /*
344  * Disconnect a Wireless USB device from its fake port
345  *
346  * Marks the port as disconnected so that hub_wq can pick up the change
347  * and drops our knowledge about the device.
348  *
349  * Assumes there is a device connected
350  *
351  * @port_index: zero based port number
352  *
353  * NOTE: @wusbhc->mutex is locked
354  *
355  * WARNING: From here it is not very safe to access anything hanging off
356  *	    wusb_dev
357  */
__wusbhc_dev_disconnect(struct wusbhc * wusbhc,struct wusb_port * port)358 static void __wusbhc_dev_disconnect(struct wusbhc *wusbhc,
359 				    struct wusb_port *port)
360 {
361 	struct wusb_dev *wusb_dev = port->wusb_dev;
362 
363 	port->status &= ~(USB_PORT_STAT_CONNECTION | USB_PORT_STAT_ENABLE
364 			  | USB_PORT_STAT_SUSPEND | USB_PORT_STAT_RESET
365 			  | USB_PORT_STAT_LOW_SPEED | USB_PORT_STAT_HIGH_SPEED);
366 	port->change |= USB_PORT_STAT_C_CONNECTION | USB_PORT_STAT_C_ENABLE;
367 	if (wusb_dev) {
368 		dev_dbg(wusbhc->dev, "disconnecting device from port %d\n", wusb_dev->port_idx);
369 		if (!list_empty(&wusb_dev->cack_node))
370 			list_del_init(&wusb_dev->cack_node);
371 		/* For the one in cack_add() */
372 		wusb_dev_put(wusb_dev);
373 	}
374 	port->wusb_dev = NULL;
375 
376 	/* After a device disconnects, change the GTK (see [WUSB]
377 	 * section 6.2.11.2). */
378 	if (wusbhc->active)
379 		wusbhc_gtk_rekey(wusbhc);
380 
381 	/* The Wireless USB part has forgotten about the device already; now
382 	 * hub_wq's timer will pick up the disconnection and remove the USB
383 	 * device from the system
384 	 */
385 }
386 
387 /*
388  * Refresh the list of keep alives to emit in the MMC
389  *
390  * We only publish the first four devices that have a coming timeout
391  * condition. Then when we are done processing those, we go for the
392  * next ones. We ignore the ones that have timed out already (they'll
393  * be purged).
394  *
395  * This might cause the first devices to timeout the last devices in
396  * the port array...FIXME: come up with a better algorithm?
397  *
398  * Note we can't do much about MMC's ops errors; we hope next refresh
399  * will kind of handle it.
400  *
401  * NOTE: @wusbhc->mutex is locked
402  */
__wusbhc_keep_alive(struct wusbhc * wusbhc)403 static void __wusbhc_keep_alive(struct wusbhc *wusbhc)
404 {
405 	struct device *dev = wusbhc->dev;
406 	unsigned cnt;
407 	struct wusb_dev *wusb_dev;
408 	struct wusb_port *wusb_port;
409 	struct wuie_keep_alive *ie = &wusbhc->keep_alive_ie;
410 	unsigned keep_alives, old_keep_alives;
411 
412 	old_keep_alives = ie->hdr.bLength - sizeof(ie->hdr);
413 	keep_alives = 0;
414 	for (cnt = 0;
415 	     keep_alives < WUIE_ELT_MAX && cnt < wusbhc->ports_max;
416 	     cnt++) {
417 		unsigned tt = msecs_to_jiffies(wusbhc->trust_timeout);
418 
419 		wusb_port = wusb_port_by_idx(wusbhc, cnt);
420 		wusb_dev = wusb_port->wusb_dev;
421 
422 		if (wusb_dev == NULL)
423 			continue;
424 		if (wusb_dev->usb_dev == NULL)
425 			continue;
426 
427 		if (time_after(jiffies, wusb_dev->entry_ts + tt)) {
428 			dev_err(dev, "KEEPALIVE: device %u timed out\n",
429 				wusb_dev->addr);
430 			__wusbhc_dev_disconnect(wusbhc, wusb_port);
431 		} else if (time_after(jiffies, wusb_dev->entry_ts + tt/3)) {
432 			/* Approaching timeout cut off, need to refresh */
433 			ie->bDeviceAddress[keep_alives++] = wusb_dev->addr;
434 		}
435 	}
436 	if (keep_alives & 0x1)	/* pad to even number ([WUSB] section 7.5.9) */
437 		ie->bDeviceAddress[keep_alives++] = 0x7f;
438 	ie->hdr.bLength = sizeof(ie->hdr) +
439 		keep_alives*sizeof(ie->bDeviceAddress[0]);
440 	if (keep_alives > 0)
441 		wusbhc_mmcie_set(wusbhc, 10, 5, &ie->hdr);
442 	else if (old_keep_alives != 0)
443 		wusbhc_mmcie_rm(wusbhc, &ie->hdr);
444 }
445 
446 /*
447  * Do a run through all devices checking for timeouts
448  */
wusbhc_keep_alive_run(struct work_struct * ws)449 static void wusbhc_keep_alive_run(struct work_struct *ws)
450 {
451 	struct delayed_work *dw = to_delayed_work(ws);
452 	struct wusbhc *wusbhc =	container_of(dw, struct wusbhc, keep_alive_timer);
453 
454 	mutex_lock(&wusbhc->mutex);
455 	__wusbhc_keep_alive(wusbhc);
456 	mutex_unlock(&wusbhc->mutex);
457 
458 	queue_delayed_work(wusbd, &wusbhc->keep_alive_timer,
459 			   msecs_to_jiffies(wusbhc->trust_timeout / 2));
460 }
461 
462 /*
463  * Find the wusb_dev from its device address.
464  *
465  * The device can be found directly from the address (see
466  * wusb_cack_add() for where the device address is set to port_idx
467  * +2), except when the address is zero.
468  */
wusbhc_find_dev_by_addr(struct wusbhc * wusbhc,u8 addr)469 static struct wusb_dev *wusbhc_find_dev_by_addr(struct wusbhc *wusbhc, u8 addr)
470 {
471 	int p;
472 
473 	if (addr == 0xff) /* unconnected */
474 		return NULL;
475 
476 	if (addr > 0) {
477 		int port = (addr & ~0x80) - 2;
478 		if (port < 0 || port >= wusbhc->ports_max)
479 			return NULL;
480 		return wusb_port_by_idx(wusbhc, port)->wusb_dev;
481 	}
482 
483 	/* Look for the device with address 0. */
484 	for (p = 0; p < wusbhc->ports_max; p++) {
485 		struct wusb_dev *wusb_dev = wusb_port_by_idx(wusbhc, p)->wusb_dev;
486 		if (wusb_dev && wusb_dev->addr == addr)
487 			return wusb_dev;
488 	}
489 	return NULL;
490 }
491 
492 /*
493  * Handle a DN_Alive notification (WUSB1.0[7.6.1])
494  *
495  * This just updates the device activity timestamp and then refreshes
496  * the keep alive IE.
497  *
498  * @wusbhc shall be referenced and unlocked
499  */
wusbhc_handle_dn_alive(struct wusbhc * wusbhc,u8 srcaddr)500 static void wusbhc_handle_dn_alive(struct wusbhc *wusbhc, u8 srcaddr)
501 {
502 	struct wusb_dev *wusb_dev;
503 
504 	mutex_lock(&wusbhc->mutex);
505 	wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
506 	if (wusb_dev == NULL) {
507 		dev_dbg(wusbhc->dev, "ignoring DN_Alive from unconnected device %02x\n",
508 			srcaddr);
509 	} else {
510 		wusb_dev->entry_ts = jiffies;
511 		__wusbhc_keep_alive(wusbhc);
512 	}
513 	mutex_unlock(&wusbhc->mutex);
514 }
515 
516 /*
517  * Handle a DN_Connect notification (WUSB1.0[7.6.1])
518  *
519  * @wusbhc
520  * @pkt_hdr
521  * @size:    Size of the buffer where the notification resides; if the
522  *           notification data suggests there should be more data than
523  *           available, an error will be signaled and the whole buffer
524  *           consumed.
525  *
526  * @wusbhc->mutex shall be held
527  */
wusbhc_handle_dn_connect(struct wusbhc * wusbhc,struct wusb_dn_hdr * dn_hdr,size_t size)528 static void wusbhc_handle_dn_connect(struct wusbhc *wusbhc,
529 				     struct wusb_dn_hdr *dn_hdr,
530 				     size_t size)
531 {
532 	struct device *dev = wusbhc->dev;
533 	struct wusb_dn_connect *dnc;
534 	char pr_cdid[WUSB_CKHDID_STRSIZE];
535 	static const char *beacon_behaviour[] = {
536 		"reserved",
537 		"self-beacon",
538 		"directed-beacon",
539 		"no-beacon"
540 	};
541 
542 	if (size < sizeof(*dnc)) {
543 		dev_err(dev, "DN CONNECT: short notification (%zu < %zu)\n",
544 			size, sizeof(*dnc));
545 		return;
546 	}
547 
548 	dnc = container_of(dn_hdr, struct wusb_dn_connect, hdr);
549 	ckhdid_printf(pr_cdid, sizeof(pr_cdid), &dnc->CDID);
550 	dev_info(dev, "DN CONNECT: device %s @ %x (%s) wants to %s\n",
551 		 pr_cdid,
552 		 wusb_dn_connect_prev_dev_addr(dnc),
553 		 beacon_behaviour[wusb_dn_connect_beacon_behavior(dnc)],
554 		 wusb_dn_connect_new_connection(dnc) ? "connect" : "reconnect");
555 	/* ACK the connect */
556 	wusbhc_devconnect_ack(wusbhc, dnc, pr_cdid);
557 }
558 
559 /*
560  * Handle a DN_Disconnect notification (WUSB1.0[7.6.1])
561  *
562  * Device is going down -- do the disconnect.
563  *
564  * @wusbhc shall be referenced and unlocked
565  */
wusbhc_handle_dn_disconnect(struct wusbhc * wusbhc,u8 srcaddr)566 static void wusbhc_handle_dn_disconnect(struct wusbhc *wusbhc, u8 srcaddr)
567 {
568 	struct device *dev = wusbhc->dev;
569 	struct wusb_dev *wusb_dev;
570 
571 	mutex_lock(&wusbhc->mutex);
572 	wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
573 	if (wusb_dev == NULL) {
574 		dev_dbg(dev, "ignoring DN DISCONNECT from unconnected device %02x\n",
575 			srcaddr);
576 	} else {
577 		dev_info(dev, "DN DISCONNECT: device 0x%02x going down\n",
578 			wusb_dev->addr);
579 		__wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc,
580 			wusb_dev->port_idx));
581 	}
582 	mutex_unlock(&wusbhc->mutex);
583 }
584 
585 /*
586  * Handle a Device Notification coming a host
587  *
588  * The Device Notification comes from a host (HWA, DWA or WHCI)
589  * wrapped in a set of headers. Somebody else has peeled off those
590  * headers for us and we just get one Device Notifications.
591  *
592  * Invalid DNs (e.g., too short) are discarded.
593  *
594  * @wusbhc shall be referenced
595  *
596  * FIXMES:
597  *  - implement priorities as in WUSB1.0[Table 7-55]?
598  */
wusbhc_handle_dn(struct wusbhc * wusbhc,u8 srcaddr,struct wusb_dn_hdr * dn_hdr,size_t size)599 void wusbhc_handle_dn(struct wusbhc *wusbhc, u8 srcaddr,
600 		      struct wusb_dn_hdr *dn_hdr, size_t size)
601 {
602 	struct device *dev = wusbhc->dev;
603 
604 	if (size < sizeof(struct wusb_dn_hdr)) {
605 		dev_err(dev, "DN data shorter than DN header (%d < %d)\n",
606 			(int)size, (int)sizeof(struct wusb_dn_hdr));
607 		return;
608 	}
609 	switch (dn_hdr->bType) {
610 	case WUSB_DN_CONNECT:
611 		wusbhc_handle_dn_connect(wusbhc, dn_hdr, size);
612 		break;
613 	case WUSB_DN_ALIVE:
614 		wusbhc_handle_dn_alive(wusbhc, srcaddr);
615 		break;
616 	case WUSB_DN_DISCONNECT:
617 		wusbhc_handle_dn_disconnect(wusbhc, srcaddr);
618 		break;
619 	case WUSB_DN_MASAVAILCHANGED:
620 	case WUSB_DN_RWAKE:
621 	case WUSB_DN_SLEEP:
622 		/* FIXME: handle these DNs. */
623 		break;
624 	case WUSB_DN_EPRDY:
625 		/* The hardware handles these. */
626 		break;
627 	default:
628 		dev_warn(dev, "unknown DN %u (%d octets) from %u\n",
629 			 dn_hdr->bType, (int)size, srcaddr);
630 	}
631 }
632 EXPORT_SYMBOL_GPL(wusbhc_handle_dn);
633 
634 /*
635  * Disconnect a WUSB device from a the cluster
636  *
637  * @wusbhc
638  * @port     Fake port where the device is (wusbhc index, not USB port number).
639  *
640  * In Wireless USB, a disconnect is basically telling the device he is
641  * being disconnected and forgetting about him.
642  *
643  * We send the device a Device Disconnect IE (WUSB1.0[7.5.11]) for 100
644  * ms and then keep going.
645  *
646  * We don't do much in case of error; we always pretend we disabled
647  * the port and disconnected the device. If physically the request
648  * didn't get there (many things can fail in the way there), the stack
649  * will reject the device's communication attempts.
650  *
651  * @wusbhc should be refcounted and locked
652  */
__wusbhc_dev_disable(struct wusbhc * wusbhc,u8 port_idx)653 void __wusbhc_dev_disable(struct wusbhc *wusbhc, u8 port_idx)
654 {
655 	int result;
656 	struct device *dev = wusbhc->dev;
657 	struct wusb_dev *wusb_dev;
658 	struct wuie_disconnect *ie;
659 
660 	wusb_dev = wusb_port_by_idx(wusbhc, port_idx)->wusb_dev;
661 	if (wusb_dev == NULL) {
662 		/* reset no device? ignore */
663 		dev_dbg(dev, "DISCONNECT: no device at port %u, ignoring\n",
664 			port_idx);
665 		return;
666 	}
667 	__wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc, port_idx));
668 
669 	ie = kzalloc(sizeof(*ie), GFP_KERNEL);
670 	if (ie == NULL)
671 		return;
672 	ie->hdr.bLength = sizeof(*ie);
673 	ie->hdr.bIEIdentifier = WUIE_ID_DEVICE_DISCONNECT;
674 	ie->bDeviceAddress = wusb_dev->addr;
675 	result = wusbhc_mmcie_set(wusbhc, 0, 0, &ie->hdr);
676 	if (result < 0)
677 		dev_err(dev, "DISCONNECT: can't set MMC: %d\n", result);
678 	else {
679 		/* At least 6 MMCs, assuming at least 1 MMC per zone. */
680 		msleep(7*4);
681 		wusbhc_mmcie_rm(wusbhc, &ie->hdr);
682 	}
683 	kfree(ie);
684 }
685 
686 /*
687  * Walk over the BOS descriptor, verify and grok it
688  *
689  * @usb_dev: referenced
690  * @wusb_dev: referenced and unlocked
691  *
692  * The BOS descriptor is defined at WUSB1.0[7.4.1], and it defines a
693  * "flexible" way to wrap all kinds of descriptors inside an standard
694  * descriptor (wonder why they didn't use normal descriptors,
695  * btw). Not like they lack code.
696  *
697  * At the end we go to look for the WUSB Device Capabilities
698  * (WUSB1.0[7.4.1.1]) that is wrapped in a device capability descriptor
699  * that is part of the BOS descriptor set. That tells us what does the
700  * device support (dual role, beacon type, UWB PHY rates).
701  */
wusb_dev_bos_grok(struct usb_device * usb_dev,struct wusb_dev * wusb_dev,struct usb_bos_descriptor * bos,size_t desc_size)702 static int wusb_dev_bos_grok(struct usb_device *usb_dev,
703 			     struct wusb_dev *wusb_dev,
704 			     struct usb_bos_descriptor *bos, size_t desc_size)
705 {
706 	ssize_t result;
707 	struct device *dev = &usb_dev->dev;
708 	void *itr, *top;
709 
710 	/* Walk over BOS capabilities, verify them */
711 	itr = (void *)bos + sizeof(*bos);
712 	top = itr + desc_size - sizeof(*bos);
713 	while (itr < top) {
714 		struct usb_dev_cap_header *cap_hdr = itr;
715 		size_t cap_size;
716 		u8 cap_type;
717 		if (top - itr < sizeof(*cap_hdr)) {
718 			dev_err(dev, "Device BUG? premature end of BOS header "
719 				"data [offset 0x%02x]: only %zu bytes left\n",
720 				(int)(itr - (void *)bos), top - itr);
721 			result = -ENOSPC;
722 			goto error_bad_cap;
723 		}
724 		cap_size = cap_hdr->bLength;
725 		cap_type = cap_hdr->bDevCapabilityType;
726 		if (cap_size == 0)
727 			break;
728 		if (cap_size > top - itr) {
729 			dev_err(dev, "Device BUG? premature end of BOS data "
730 				"[offset 0x%02x cap %02x %zu bytes]: "
731 				"only %zu bytes left\n",
732 				(int)(itr - (void *)bos),
733 				cap_type, cap_size, top - itr);
734 			result = -EBADF;
735 			goto error_bad_cap;
736 		}
737 		switch (cap_type) {
738 		case USB_CAP_TYPE_WIRELESS_USB:
739 			if (cap_size != sizeof(*wusb_dev->wusb_cap_descr))
740 				dev_err(dev, "Device BUG? WUSB Capability "
741 					"descriptor is %zu bytes vs %zu "
742 					"needed\n", cap_size,
743 					sizeof(*wusb_dev->wusb_cap_descr));
744 			else
745 				wusb_dev->wusb_cap_descr = itr;
746 			break;
747 		default:
748 			dev_err(dev, "BUG? Unknown BOS capability 0x%02x "
749 				"(%zu bytes) at offset 0x%02x\n", cap_type,
750 				cap_size, (int)(itr - (void *)bos));
751 		}
752 		itr += cap_size;
753 	}
754 	result = 0;
755 error_bad_cap:
756 	return result;
757 }
758 
759 /*
760  * Add information from the BOS descriptors to the device
761  *
762  * @usb_dev: referenced
763  * @wusb_dev: referenced and unlocked
764  *
765  * So what we do is we alloc a space for the BOS descriptor of 64
766  * bytes; read the first four bytes which include the wTotalLength
767  * field (WUSB1.0[T7-26]) and if it fits in those 64 bytes, read the
768  * whole thing. If not we realloc to that size.
769  *
770  * Then we call the groking function, that will fill up
771  * wusb_dev->wusb_cap_descr, which is what we'll need later on.
772  */
wusb_dev_bos_add(struct usb_device * usb_dev,struct wusb_dev * wusb_dev)773 static int wusb_dev_bos_add(struct usb_device *usb_dev,
774 			    struct wusb_dev *wusb_dev)
775 {
776 	ssize_t result;
777 	struct device *dev = &usb_dev->dev;
778 	struct usb_bos_descriptor *bos;
779 	size_t alloc_size = 32, desc_size = 4;
780 
781 	bos = kmalloc(alloc_size, GFP_KERNEL);
782 	if (bos == NULL)
783 		return -ENOMEM;
784 	result = usb_get_descriptor(usb_dev, USB_DT_BOS, 0, bos, desc_size);
785 	if (result < 4) {
786 		dev_err(dev, "Can't get BOS descriptor or too short: %zd\n",
787 			result);
788 		goto error_get_descriptor;
789 	}
790 	desc_size = le16_to_cpu(bos->wTotalLength);
791 	if (desc_size >= alloc_size) {
792 		kfree(bos);
793 		alloc_size = desc_size;
794 		bos = kmalloc(alloc_size, GFP_KERNEL);
795 		if (bos == NULL)
796 			return -ENOMEM;
797 	}
798 	result = usb_get_descriptor(usb_dev, USB_DT_BOS, 0, bos, desc_size);
799 	if (result < 0 || result != desc_size) {
800 		dev_err(dev, "Can't get  BOS descriptor or too short (need "
801 			"%zu bytes): %zd\n", desc_size, result);
802 		goto error_get_descriptor;
803 	}
804 	if (result < sizeof(*bos)
805 	    || le16_to_cpu(bos->wTotalLength) != desc_size) {
806 		dev_err(dev, "Can't get  BOS descriptor or too short (need "
807 			"%zu bytes): %zd\n", desc_size, result);
808 		goto error_get_descriptor;
809 	}
810 
811 	result = wusb_dev_bos_grok(usb_dev, wusb_dev, bos, result);
812 	if (result < 0)
813 		goto error_bad_bos;
814 	wusb_dev->bos = bos;
815 	return 0;
816 
817 error_bad_bos:
818 error_get_descriptor:
819 	kfree(bos);
820 	wusb_dev->wusb_cap_descr = NULL;
821 	return result;
822 }
823 
wusb_dev_bos_rm(struct wusb_dev * wusb_dev)824 static void wusb_dev_bos_rm(struct wusb_dev *wusb_dev)
825 {
826 	kfree(wusb_dev->bos);
827 	wusb_dev->wusb_cap_descr = NULL;
828 };
829 
830 /*
831  * USB stack's device addition Notifier Callback
832  *
833  * Called from drivers/usb/core/hub.c when a new device is added; we
834  * use this hook to perform certain WUSB specific setup work on the
835  * new device. As well, it is the first time we can connect the
836  * wusb_dev and the usb_dev. So we note it down in wusb_dev and take a
837  * reference that we'll drop.
838  *
839  * First we need to determine if the device is a WUSB device (else we
840  * ignore it). For that we use the speed setting (USB_SPEED_WIRELESS)
841  * [FIXME: maybe we'd need something more definitive]. If so, we track
842  * it's usb_busd and from there, the WUSB HC.
843  *
844  * Because all WUSB HCs are contained in a 'struct wusbhc', voila, we
845  * get the wusbhc for the device.
846  *
847  * We have a reference on @usb_dev (as we are called at the end of its
848  * enumeration).
849  *
850  * NOTE: @usb_dev locked
851  */
wusb_dev_add_ncb(struct usb_device * usb_dev)852 static void wusb_dev_add_ncb(struct usb_device *usb_dev)
853 {
854 	int result = 0;
855 	struct wusb_dev *wusb_dev;
856 	struct wusbhc *wusbhc;
857 	struct device *dev = &usb_dev->dev;
858 	u8 port_idx;
859 
860 	if (usb_dev->wusb == 0 || usb_dev->devnum == 1)
861 		return;		/* skip non wusb and wusb RHs */
862 
863 	usb_set_device_state(usb_dev, USB_STATE_UNAUTHENTICATED);
864 
865 	wusbhc = wusbhc_get_by_usb_dev(usb_dev);
866 	if (wusbhc == NULL)
867 		goto error_nodev;
868 	mutex_lock(&wusbhc->mutex);
869 	wusb_dev = __wusb_dev_get_by_usb_dev(wusbhc, usb_dev);
870 	port_idx = wusb_port_no_to_idx(usb_dev->portnum);
871 	mutex_unlock(&wusbhc->mutex);
872 	if (wusb_dev == NULL)
873 		goto error_nodev;
874 	wusb_dev->usb_dev = usb_get_dev(usb_dev);
875 	usb_dev->wusb_dev = wusb_dev_get(wusb_dev);
876 	result = wusb_dev_sec_add(wusbhc, usb_dev, wusb_dev);
877 	if (result < 0) {
878 		dev_err(dev, "Cannot enable security: %d\n", result);
879 		goto error_sec_add;
880 	}
881 	/* Now query the device for it's BOS and attach it to wusb_dev */
882 	result = wusb_dev_bos_add(usb_dev, wusb_dev);
883 	if (result < 0) {
884 		dev_err(dev, "Cannot get BOS descriptors: %d\n", result);
885 		goto error_bos_add;
886 	}
887 	result = wusb_dev_sysfs_add(wusbhc, usb_dev, wusb_dev);
888 	if (result < 0)
889 		goto error_add_sysfs;
890 out:
891 	wusb_dev_put(wusb_dev);
892 	wusbhc_put(wusbhc);
893 error_nodev:
894 	return;
895 
896 	wusb_dev_sysfs_rm(wusb_dev);
897 error_add_sysfs:
898 	wusb_dev_bos_rm(wusb_dev);
899 error_bos_add:
900 	wusb_dev_sec_rm(wusb_dev);
901 error_sec_add:
902 	mutex_lock(&wusbhc->mutex);
903 	__wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc, port_idx));
904 	mutex_unlock(&wusbhc->mutex);
905 	goto out;
906 }
907 
908 /*
909  * Undo all the steps done at connection by the notifier callback
910  *
911  * NOTE: @usb_dev locked
912  */
wusb_dev_rm_ncb(struct usb_device * usb_dev)913 static void wusb_dev_rm_ncb(struct usb_device *usb_dev)
914 {
915 	struct wusb_dev *wusb_dev = usb_dev->wusb_dev;
916 
917 	if (usb_dev->wusb == 0 || usb_dev->devnum == 1)
918 		return;		/* skip non wusb and wusb RHs */
919 
920 	wusb_dev_sysfs_rm(wusb_dev);
921 	wusb_dev_bos_rm(wusb_dev);
922 	wusb_dev_sec_rm(wusb_dev);
923 	wusb_dev->usb_dev = NULL;
924 	usb_dev->wusb_dev = NULL;
925 	wusb_dev_put(wusb_dev);
926 	usb_put_dev(usb_dev);
927 }
928 
929 /*
930  * Handle notifications from the USB stack (notifier call back)
931  *
932  * This is called when the USB stack does a
933  * usb_{bus,device}_{add,remove}() so we can do WUSB specific
934  * handling. It is called with [for the case of
935  * USB_DEVICE_{ADD,REMOVE} with the usb_dev locked.
936  */
wusb_usb_ncb(struct notifier_block * nb,unsigned long val,void * priv)937 int wusb_usb_ncb(struct notifier_block *nb, unsigned long val,
938 		 void *priv)
939 {
940 	int result = NOTIFY_OK;
941 
942 	switch (val) {
943 	case USB_DEVICE_ADD:
944 		wusb_dev_add_ncb(priv);
945 		break;
946 	case USB_DEVICE_REMOVE:
947 		wusb_dev_rm_ncb(priv);
948 		break;
949 	case USB_BUS_ADD:
950 		/* ignore (for now) */
951 	case USB_BUS_REMOVE:
952 		break;
953 	default:
954 		WARN_ON(1);
955 		result = NOTIFY_BAD;
956 	}
957 	return result;
958 }
959 
960 /*
961  * Return a referenced wusb_dev given a @wusbhc and @usb_dev
962  */
__wusb_dev_get_by_usb_dev(struct wusbhc * wusbhc,struct usb_device * usb_dev)963 struct wusb_dev *__wusb_dev_get_by_usb_dev(struct wusbhc *wusbhc,
964 					   struct usb_device *usb_dev)
965 {
966 	struct wusb_dev *wusb_dev;
967 	u8 port_idx;
968 
969 	port_idx = wusb_port_no_to_idx(usb_dev->portnum);
970 	BUG_ON(port_idx > wusbhc->ports_max);
971 	wusb_dev = wusb_port_by_idx(wusbhc, port_idx)->wusb_dev;
972 	if (wusb_dev != NULL)		/* ops, device is gone */
973 		wusb_dev_get(wusb_dev);
974 	return wusb_dev;
975 }
976 EXPORT_SYMBOL_GPL(__wusb_dev_get_by_usb_dev);
977 
wusb_dev_destroy(struct kref * _wusb_dev)978 void wusb_dev_destroy(struct kref *_wusb_dev)
979 {
980 	struct wusb_dev *wusb_dev = container_of(_wusb_dev, struct wusb_dev, refcnt);
981 
982 	list_del_init(&wusb_dev->cack_node);
983 	wusb_dev_free(wusb_dev);
984 }
985 EXPORT_SYMBOL_GPL(wusb_dev_destroy);
986 
987 /*
988  * Create all the device connect handling infrastructure
989  *
990  * This is basically the device info array, Connect Acknowledgement
991  * (cack) lists, keep-alive timers (and delayed work thread).
992  */
wusbhc_devconnect_create(struct wusbhc * wusbhc)993 int wusbhc_devconnect_create(struct wusbhc *wusbhc)
994 {
995 	wusbhc->keep_alive_ie.hdr.bIEIdentifier = WUIE_ID_KEEP_ALIVE;
996 	wusbhc->keep_alive_ie.hdr.bLength = sizeof(wusbhc->keep_alive_ie.hdr);
997 	INIT_DELAYED_WORK(&wusbhc->keep_alive_timer, wusbhc_keep_alive_run);
998 
999 	wusbhc->cack_ie.hdr.bIEIdentifier = WUIE_ID_CONNECTACK;
1000 	wusbhc->cack_ie.hdr.bLength = sizeof(wusbhc->cack_ie.hdr);
1001 	INIT_LIST_HEAD(&wusbhc->cack_list);
1002 
1003 	return 0;
1004 }
1005 
1006 /*
1007  * Release all resources taken by the devconnect stuff
1008  */
wusbhc_devconnect_destroy(struct wusbhc * wusbhc)1009 void wusbhc_devconnect_destroy(struct wusbhc *wusbhc)
1010 {
1011 	/* no op */
1012 }
1013 
1014 /*
1015  * wusbhc_devconnect_start - start accepting device connections
1016  * @wusbhc: the WUSB HC
1017  *
1018  * Sets the Host Info IE to accept all new connections.
1019  *
1020  * FIXME: This also enables the keep alives but this is not necessary
1021  * until there are connected and authenticated devices.
1022  */
wusbhc_devconnect_start(struct wusbhc * wusbhc)1023 int wusbhc_devconnect_start(struct wusbhc *wusbhc)
1024 {
1025 	struct device *dev = wusbhc->dev;
1026 	struct wuie_host_info *hi;
1027 	int result;
1028 
1029 	hi = kzalloc(sizeof(*hi), GFP_KERNEL);
1030 	if (hi == NULL)
1031 		return -ENOMEM;
1032 
1033 	hi->hdr.bLength       = sizeof(*hi);
1034 	hi->hdr.bIEIdentifier = WUIE_ID_HOST_INFO;
1035 	hi->attributes        = cpu_to_le16((wusbhc->rsv->stream << 3) | WUIE_HI_CAP_ALL);
1036 	hi->CHID              = wusbhc->chid;
1037 	result = wusbhc_mmcie_set(wusbhc, 0, 0, &hi->hdr);
1038 	if (result < 0) {
1039 		dev_err(dev, "Cannot add Host Info MMCIE: %d\n", result);
1040 		goto error_mmcie_set;
1041 	}
1042 	wusbhc->wuie_host_info = hi;
1043 
1044 	queue_delayed_work(wusbd, &wusbhc->keep_alive_timer,
1045 			   msecs_to_jiffies(wusbhc->trust_timeout / 2));
1046 
1047 	return 0;
1048 
1049 error_mmcie_set:
1050 	kfree(hi);
1051 	return result;
1052 }
1053 
1054 /*
1055  * wusbhc_devconnect_stop - stop managing connected devices
1056  * @wusbhc: the WUSB HC
1057  *
1058  * Disconnects any devices still connected, stops the keep alives and
1059  * removes the Host Info IE.
1060  */
wusbhc_devconnect_stop(struct wusbhc * wusbhc)1061 void wusbhc_devconnect_stop(struct wusbhc *wusbhc)
1062 {
1063 	int i;
1064 
1065 	mutex_lock(&wusbhc->mutex);
1066 	for (i = 0; i < wusbhc->ports_max; i++) {
1067 		if (wusbhc->port[i].wusb_dev)
1068 			__wusbhc_dev_disconnect(wusbhc, &wusbhc->port[i]);
1069 	}
1070 	mutex_unlock(&wusbhc->mutex);
1071 
1072 	cancel_delayed_work_sync(&wusbhc->keep_alive_timer);
1073 	wusbhc_mmcie_rm(wusbhc, &wusbhc->wuie_host_info->hdr);
1074 	kfree(wusbhc->wuie_host_info);
1075 	wusbhc->wuie_host_info = NULL;
1076 }
1077 
1078 /*
1079  * wusb_set_dev_addr - set the WUSB device address used by the host
1080  * @wusbhc: the WUSB HC the device is connect to
1081  * @wusb_dev: the WUSB device
1082  * @addr: new device address
1083  */
wusb_set_dev_addr(struct wusbhc * wusbhc,struct wusb_dev * wusb_dev,u8 addr)1084 int wusb_set_dev_addr(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev, u8 addr)
1085 {
1086 	int result;
1087 
1088 	wusb_dev->addr = addr;
1089 	result = wusbhc->dev_info_set(wusbhc, wusb_dev);
1090 	if (result < 0)
1091 		dev_err(wusbhc->dev, "device %d: failed to set device "
1092 			"address\n", wusb_dev->port_idx);
1093 	else
1094 		dev_info(wusbhc->dev, "device %d: %s addr %u\n",
1095 			 wusb_dev->port_idx,
1096 			 (addr & WUSB_DEV_ADDR_UNAUTH) ? "unauth" : "auth",
1097 			 wusb_dev->addr);
1098 
1099 	return result;
1100 }
1101