Loading...
1/*
2 * WUSB Wire Adapter: Control/Data Streaming Interface (WUSB[8])
3 * Device Connect handling
4 *
5 * Copyright (C) 2006 Intel Corporation
6 * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
7 *
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License version
10 * 2 as published by the Free Software Foundation.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
20 * 02110-1301, USA.
21 *
22 *
23 * FIXME: docs
24 * FIXME: this file needs to be broken up, it's grown too big
25 *
26 *
27 * WUSB1.0[7.1, 7.5.1, ]
28 *
29 * WUSB device connection is kind of messy. Some background:
30 *
31 * When a device wants to connect it scans the UWB radio channels
32 * looking for a WUSB Channel; a WUSB channel is defined by MMCs
33 * (Micro Managed Commands or something like that) [see
34 * Design-overview for more on this] .
35 *
36 * So, device scans the radio, finds MMCs and thus a host and checks
37 * when the next DNTS is. It sends a Device Notification Connect
38 * (DN_Connect); the host picks it up (through nep.c and notif.c, ends
39 * up in wusb_devconnect_ack(), which creates a wusb_dev structure in
40 * wusbhc->port[port_number].wusb_dev), assigns an unauth address
41 * to the device (this means from 0x80 to 0xfe) and sends, in the MMC
42 * a Connect Ack Information Element (ConnAck IE).
43 *
44 * So now the device now has a WUSB address. From now on, we use
45 * that to talk to it in the RPipes.
46 *
47 * ASSUMPTIONS:
48 *
49 * - We use the the as device address the port number where it is
50 * connected (port 0 doesn't exist). For unauth, it is 128 + that.
51 *
52 * ROADMAP:
53 *
54 * This file contains the logic for doing that--entry points:
55 *
56 * wusb_devconnect_ack() Ack a device until _acked() called.
57 * Called by notif.c:wusb_handle_dn_connect()
58 * when a DN_Connect is received.
59 *
60 * wusb_devconnect_acked() Ack done, release resources.
61 *
62 * wusb_handle_dn_alive() Called by notif.c:wusb_handle_dn()
63 * for processing a DN_Alive pong from a device.
64 *
65 * wusb_handle_dn_disconnect()Called by notif.c:wusb_handle_dn() to
66 * process a disconenct request from a
67 * device.
68 *
69 * __wusb_dev_disable() Called by rh.c:wusbhc_rh_clear_port_feat() when
70 * disabling a port.
71 *
72 * wusb_devconnect_create() Called when creating the host by
73 * lc.c:wusbhc_create().
74 *
75 * wusb_devconnect_destroy() Cleanup called removing the host. Called
76 * by lc.c:wusbhc_destroy().
77 *
78 * Each Wireless USB host maintains a list of DN_Connect requests
79 * (actually we maintain a list of pending Connect Acks, the
80 * wusbhc->ca_list).
81 *
82 * LIFE CYCLE OF port->wusb_dev
83 *
84 * Before the @wusbhc structure put()s the reference it owns for
85 * port->wusb_dev [and clean the wusb_dev pointer], it needs to
86 * lock @wusbhc->mutex.
87 */
88
89#include <linux/jiffies.h>
90#include <linux/ctype.h>
91#include <linux/slab.h>
92#include <linux/workqueue.h>
93#include "wusbhc.h"
94
95static void wusbhc_devconnect_acked_work(struct work_struct *work);
96
97static void wusb_dev_free(struct wusb_dev *wusb_dev)
98{
99 if (wusb_dev) {
100 kfree(wusb_dev->set_gtk_req);
101 usb_free_urb(wusb_dev->set_gtk_urb);
102 kfree(wusb_dev);
103 }
104}
105
106static struct wusb_dev *wusb_dev_alloc(struct wusbhc *wusbhc)
107{
108 struct wusb_dev *wusb_dev;
109 struct urb *urb;
110 struct usb_ctrlrequest *req;
111
112 wusb_dev = kzalloc(sizeof(*wusb_dev), GFP_KERNEL);
113 if (wusb_dev == NULL)
114 goto err;
115
116 wusb_dev->wusbhc = wusbhc;
117
118 INIT_WORK(&wusb_dev->devconnect_acked_work, wusbhc_devconnect_acked_work);
119
120 urb = usb_alloc_urb(0, GFP_KERNEL);
121 if (urb == NULL)
122 goto err;
123 wusb_dev->set_gtk_urb = urb;
124
125 req = kmalloc(sizeof(*req), GFP_KERNEL);
126 if (req == NULL)
127 goto err;
128 wusb_dev->set_gtk_req = req;
129
130 req->bRequestType = USB_DIR_OUT | USB_TYPE_STANDARD | USB_RECIP_DEVICE;
131 req->bRequest = USB_REQ_SET_DESCRIPTOR;
132 req->wValue = cpu_to_le16(USB_DT_KEY << 8 | wusbhc->gtk_index);
133 req->wIndex = 0;
134 req->wLength = cpu_to_le16(wusbhc->gtk.descr.bLength);
135
136 return wusb_dev;
137err:
138 wusb_dev_free(wusb_dev);
139 return NULL;
140}
141
142
143/*
144 * Using the Connect-Ack list, fill out the @wusbhc Connect-Ack WUSB IE
145 * properly so that it can be added to the MMC.
146 *
147 * We just get the @wusbhc->ca_list and fill out the first four ones or
148 * less (per-spec WUSB1.0[7.5, before T7-38). If the ConnectAck WUSB
149 * IE is not allocated, we alloc it.
150 *
151 * @wusbhc->mutex must be taken
152 */
153static void wusbhc_fill_cack_ie(struct wusbhc *wusbhc)
154{
155 unsigned cnt;
156 struct wusb_dev *dev_itr;
157 struct wuie_connect_ack *cack_ie;
158
159 cack_ie = &wusbhc->cack_ie;
160 cnt = 0;
161 list_for_each_entry(dev_itr, &wusbhc->cack_list, cack_node) {
162 cack_ie->blk[cnt].CDID = dev_itr->cdid;
163 cack_ie->blk[cnt].bDeviceAddress = dev_itr->addr;
164 if (++cnt >= WUIE_ELT_MAX)
165 break;
166 }
167 cack_ie->hdr.bLength = sizeof(cack_ie->hdr)
168 + cnt * sizeof(cack_ie->blk[0]);
169}
170
171/*
172 * Register a new device that wants to connect
173 *
174 * A new device wants to connect, so we add it to the Connect-Ack
175 * list. We give it an address in the unauthorized range (bit 8 set);
176 * user space will have to drive authorization further on.
177 *
178 * @dev_addr: address to use for the device (which is also the port
179 * number).
180 *
181 * @wusbhc->mutex must be taken
182 */
183static struct wusb_dev *wusbhc_cack_add(struct wusbhc *wusbhc,
184 struct wusb_dn_connect *dnc,
185 const char *pr_cdid, u8 port_idx)
186{
187 struct device *dev = wusbhc->dev;
188 struct wusb_dev *wusb_dev;
189 int new_connection = wusb_dn_connect_new_connection(dnc);
190 u8 dev_addr;
191 int result;
192
193 /* Is it registered already? */
194 list_for_each_entry(wusb_dev, &wusbhc->cack_list, cack_node)
195 if (!memcmp(&wusb_dev->cdid, &dnc->CDID,
196 sizeof(wusb_dev->cdid)))
197 return wusb_dev;
198 /* We don't have it, create an entry, register it */
199 wusb_dev = wusb_dev_alloc(wusbhc);
200 if (wusb_dev == NULL)
201 return NULL;
202 wusb_dev_init(wusb_dev);
203 wusb_dev->cdid = dnc->CDID;
204 wusb_dev->port_idx = port_idx;
205
206 /*
207 * Devices are always available within the cluster reservation
208 * and since the hardware will take the intersection of the
209 * per-device availability and the cluster reservation, the
210 * per-device availability can simply be set to always
211 * available.
212 */
213 bitmap_fill(wusb_dev->availability.bm, UWB_NUM_MAS);
214
215 /* FIXME: handle reconnects instead of assuming connects are
216 always new. */
217 if (1 && new_connection == 0)
218 new_connection = 1;
219 if (new_connection) {
220 dev_addr = (port_idx + 2) | WUSB_DEV_ADDR_UNAUTH;
221
222 dev_info(dev, "Connecting new WUSB device to address %u, "
223 "port %u\n", dev_addr, port_idx);
224
225 result = wusb_set_dev_addr(wusbhc, wusb_dev, dev_addr);
226 if (result < 0)
227 return NULL;
228 }
229 wusb_dev->entry_ts = jiffies;
230 list_add_tail(&wusb_dev->cack_node, &wusbhc->cack_list);
231 wusbhc->cack_count++;
232 wusbhc_fill_cack_ie(wusbhc);
233
234 return wusb_dev;
235}
236
237/*
238 * Remove a Connect-Ack context entry from the HCs view
239 *
240 * @wusbhc->mutex must be taken
241 */
242static void wusbhc_cack_rm(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
243{
244 list_del_init(&wusb_dev->cack_node);
245 wusbhc->cack_count--;
246 wusbhc_fill_cack_ie(wusbhc);
247}
248
249/*
250 * @wusbhc->mutex must be taken */
251static
252void wusbhc_devconnect_acked(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
253{
254 wusbhc_cack_rm(wusbhc, wusb_dev);
255 if (wusbhc->cack_count)
256 wusbhc_mmcie_set(wusbhc, 0, 0, &wusbhc->cack_ie.hdr);
257 else
258 wusbhc_mmcie_rm(wusbhc, &wusbhc->cack_ie.hdr);
259}
260
261static void wusbhc_devconnect_acked_work(struct work_struct *work)
262{
263 struct wusb_dev *wusb_dev = container_of(work, struct wusb_dev,
264 devconnect_acked_work);
265 struct wusbhc *wusbhc = wusb_dev->wusbhc;
266
267 mutex_lock(&wusbhc->mutex);
268 wusbhc_devconnect_acked(wusbhc, wusb_dev);
269 mutex_unlock(&wusbhc->mutex);
270
271 wusb_dev_put(wusb_dev);
272}
273
274/*
275 * Ack a device for connection
276 *
277 * FIXME: docs
278 *
279 * @pr_cdid: Printable CDID...hex Use @dnc->cdid for the real deal.
280 *
281 * So we get the connect ack IE (may have been allocated already),
282 * find an empty connect block, an empty virtual port, create an
283 * address with it (see below), make it an unauth addr [bit 7 set] and
284 * set the MMC.
285 *
286 * Addresses: because WUSB hosts have no downstream hubs, we can do a
287 * 1:1 mapping between 'port number' and device
288 * address. This simplifies many things, as during this
289 * initial connect phase the USB stack has no knoledge of
290 * the device and hasn't assigned an address yet--we know
291 * USB's choose_address() will use the same euristics we
292 * use here, so we can assume which address will be assigned.
293 *
294 * USB stack always assigns address 1 to the root hub, so
295 * to the port number we add 2 (thus virtual port #0 is
296 * addr #2).
297 *
298 * @wusbhc shall be referenced
299 */
300static
301void wusbhc_devconnect_ack(struct wusbhc *wusbhc, struct wusb_dn_connect *dnc,
302 const char *pr_cdid)
303{
304 int result;
305 struct device *dev = wusbhc->dev;
306 struct wusb_dev *wusb_dev;
307 struct wusb_port *port;
308 unsigned idx, devnum;
309
310 mutex_lock(&wusbhc->mutex);
311
312 /* Check we are not handling it already */
313 for (idx = 0; idx < wusbhc->ports_max; idx++) {
314 port = wusb_port_by_idx(wusbhc, idx);
315 if (port->wusb_dev
316 && memcmp(&dnc->CDID, &port->wusb_dev->cdid, sizeof(dnc->CDID)) == 0)
317 goto error_unlock;
318 }
319 /* Look up those fake ports we have for a free one */
320 for (idx = 0; idx < wusbhc->ports_max; idx++) {
321 port = wusb_port_by_idx(wusbhc, idx);
322 if ((port->status & USB_PORT_STAT_POWER)
323 && !(port->status & USB_PORT_STAT_CONNECTION))
324 break;
325 }
326 if (idx >= wusbhc->ports_max) {
327 dev_err(dev, "Host controller can't connect more devices "
328 "(%u already connected); device %s rejected\n",
329 wusbhc->ports_max, pr_cdid);
330 /* NOTE: we could send a WUIE_Disconnect here, but we haven't
331 * event acked, so the device will eventually timeout the
332 * connection, right? */
333 goto error_unlock;
334 }
335
336 devnum = idx + 2;
337
338 /* Make sure we are using no crypto on that "virtual port" */
339 wusbhc->set_ptk(wusbhc, idx, 0, NULL, 0);
340
341 /* Grab a filled in Connect-Ack context, fill out the
342 * Connect-Ack Wireless USB IE, set the MMC */
343 wusb_dev = wusbhc_cack_add(wusbhc, dnc, pr_cdid, idx);
344 if (wusb_dev == NULL)
345 goto error_unlock;
346 result = wusbhc_mmcie_set(wusbhc, 0, 0, &wusbhc->cack_ie.hdr);
347 if (result < 0)
348 goto error_unlock;
349 /* Give the device at least 2ms (WUSB1.0[7.5.1p3]), let's do
350 * three for a good measure */
351 msleep(3);
352 port->wusb_dev = wusb_dev;
353 port->status |= USB_PORT_STAT_CONNECTION;
354 port->change |= USB_PORT_STAT_C_CONNECTION;
355 /* Now the port status changed to connected; khubd will
356 * pick the change up and try to reset the port to bring it to
357 * the enabled state--so this process returns up to the stack
358 * and it calls back into wusbhc_rh_port_reset().
359 */
360error_unlock:
361 mutex_unlock(&wusbhc->mutex);
362 return;
363
364}
365
366/*
367 * Disconnect a Wireless USB device from its fake port
368 *
369 * Marks the port as disconnected so that khubd can pick up the change
370 * and drops our knowledge about the device.
371 *
372 * Assumes there is a device connected
373 *
374 * @port_index: zero based port number
375 *
376 * NOTE: @wusbhc->mutex is locked
377 *
378 * WARNING: From here it is not very safe to access anything hanging off
379 * wusb_dev
380 */
381static void __wusbhc_dev_disconnect(struct wusbhc *wusbhc,
382 struct wusb_port *port)
383{
384 struct wusb_dev *wusb_dev = port->wusb_dev;
385
386 port->status &= ~(USB_PORT_STAT_CONNECTION | USB_PORT_STAT_ENABLE
387 | USB_PORT_STAT_SUSPEND | USB_PORT_STAT_RESET
388 | USB_PORT_STAT_LOW_SPEED | USB_PORT_STAT_HIGH_SPEED);
389 port->change |= USB_PORT_STAT_C_CONNECTION | USB_PORT_STAT_C_ENABLE;
390 if (wusb_dev) {
391 dev_dbg(wusbhc->dev, "disconnecting device from port %d\n", wusb_dev->port_idx);
392 if (!list_empty(&wusb_dev->cack_node))
393 list_del_init(&wusb_dev->cack_node);
394 /* For the one in cack_add() */
395 wusb_dev_put(wusb_dev);
396 }
397 port->wusb_dev = NULL;
398
399 /* After a device disconnects, change the GTK (see [WUSB]
400 * section 6.2.11.2). */
401 if (wusbhc->active)
402 wusbhc_gtk_rekey(wusbhc);
403
404 /* The Wireless USB part has forgotten about the device already; now
405 * khubd's timer will pick up the disconnection and remove the USB
406 * device from the system
407 */
408}
409
410/*
411 * Refresh the list of keep alives to emit in the MMC
412 *
413 * Some devices don't respond to keep alives unless they've been
414 * authenticated, so skip unauthenticated devices.
415 *
416 * We only publish the first four devices that have a coming timeout
417 * condition. Then when we are done processing those, we go for the
418 * next ones. We ignore the ones that have timed out already (they'll
419 * be purged).
420 *
421 * This might cause the first devices to timeout the last devices in
422 * the port array...FIXME: come up with a better algorithm?
423 *
424 * Note we can't do much about MMC's ops errors; we hope next refresh
425 * will kind of handle it.
426 *
427 * NOTE: @wusbhc->mutex is locked
428 */
429static void __wusbhc_keep_alive(struct wusbhc *wusbhc)
430{
431 struct device *dev = wusbhc->dev;
432 unsigned cnt;
433 struct wusb_dev *wusb_dev;
434 struct wusb_port *wusb_port;
435 struct wuie_keep_alive *ie = &wusbhc->keep_alive_ie;
436 unsigned keep_alives, old_keep_alives;
437
438 old_keep_alives = ie->hdr.bLength - sizeof(ie->hdr);
439 keep_alives = 0;
440 for (cnt = 0;
441 keep_alives < WUIE_ELT_MAX && cnt < wusbhc->ports_max;
442 cnt++) {
443 unsigned tt = msecs_to_jiffies(wusbhc->trust_timeout);
444
445 wusb_port = wusb_port_by_idx(wusbhc, cnt);
446 wusb_dev = wusb_port->wusb_dev;
447
448 if (wusb_dev == NULL)
449 continue;
450 if (wusb_dev->usb_dev == NULL || !wusb_dev->usb_dev->authenticated)
451 continue;
452
453 if (time_after(jiffies, wusb_dev->entry_ts + tt)) {
454 dev_err(dev, "KEEPALIVE: device %u timed out\n",
455 wusb_dev->addr);
456 __wusbhc_dev_disconnect(wusbhc, wusb_port);
457 } else if (time_after(jiffies, wusb_dev->entry_ts + tt/2)) {
458 /* Approaching timeout cut out, need to refresh */
459 ie->bDeviceAddress[keep_alives++] = wusb_dev->addr;
460 }
461 }
462 if (keep_alives & 0x1) /* pad to even number ([WUSB] section 7.5.9) */
463 ie->bDeviceAddress[keep_alives++] = 0x7f;
464 ie->hdr.bLength = sizeof(ie->hdr) +
465 keep_alives*sizeof(ie->bDeviceAddress[0]);
466 if (keep_alives > 0)
467 wusbhc_mmcie_set(wusbhc, 10, 5, &ie->hdr);
468 else if (old_keep_alives != 0)
469 wusbhc_mmcie_rm(wusbhc, &ie->hdr);
470}
471
472/*
473 * Do a run through all devices checking for timeouts
474 */
475static void wusbhc_keep_alive_run(struct work_struct *ws)
476{
477 struct delayed_work *dw = to_delayed_work(ws);
478 struct wusbhc *wusbhc = container_of(dw, struct wusbhc, keep_alive_timer);
479
480 mutex_lock(&wusbhc->mutex);
481 __wusbhc_keep_alive(wusbhc);
482 mutex_unlock(&wusbhc->mutex);
483
484 queue_delayed_work(wusbd, &wusbhc->keep_alive_timer,
485 msecs_to_jiffies(wusbhc->trust_timeout / 2));
486}
487
488/*
489 * Find the wusb_dev from its device address.
490 *
491 * The device can be found directly from the address (see
492 * wusb_cack_add() for where the device address is set to port_idx
493 * +2), except when the address is zero.
494 */
495static struct wusb_dev *wusbhc_find_dev_by_addr(struct wusbhc *wusbhc, u8 addr)
496{
497 int p;
498
499 if (addr == 0xff) /* unconnected */
500 return NULL;
501
502 if (addr > 0) {
503 int port = (addr & ~0x80) - 2;
504 if (port < 0 || port >= wusbhc->ports_max)
505 return NULL;
506 return wusb_port_by_idx(wusbhc, port)->wusb_dev;
507 }
508
509 /* Look for the device with address 0. */
510 for (p = 0; p < wusbhc->ports_max; p++) {
511 struct wusb_dev *wusb_dev = wusb_port_by_idx(wusbhc, p)->wusb_dev;
512 if (wusb_dev && wusb_dev->addr == addr)
513 return wusb_dev;
514 }
515 return NULL;
516}
517
518/*
519 * Handle a DN_Alive notification (WUSB1.0[7.6.1])
520 *
521 * This just updates the device activity timestamp and then refreshes
522 * the keep alive IE.
523 *
524 * @wusbhc shall be referenced and unlocked
525 */
526static void wusbhc_handle_dn_alive(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
527{
528 mutex_lock(&wusbhc->mutex);
529 wusb_dev->entry_ts = jiffies;
530 __wusbhc_keep_alive(wusbhc);
531 mutex_unlock(&wusbhc->mutex);
532}
533
534/*
535 * Handle a DN_Connect notification (WUSB1.0[7.6.1])
536 *
537 * @wusbhc
538 * @pkt_hdr
539 * @size: Size of the buffer where the notification resides; if the
540 * notification data suggests there should be more data than
541 * available, an error will be signaled and the whole buffer
542 * consumed.
543 *
544 * @wusbhc->mutex shall be held
545 */
546static void wusbhc_handle_dn_connect(struct wusbhc *wusbhc,
547 struct wusb_dn_hdr *dn_hdr,
548 size_t size)
549{
550 struct device *dev = wusbhc->dev;
551 struct wusb_dn_connect *dnc;
552 char pr_cdid[WUSB_CKHDID_STRSIZE];
553 static const char *beacon_behaviour[] = {
554 "reserved",
555 "self-beacon",
556 "directed-beacon",
557 "no-beacon"
558 };
559
560 if (size < sizeof(*dnc)) {
561 dev_err(dev, "DN CONNECT: short notification (%zu < %zu)\n",
562 size, sizeof(*dnc));
563 return;
564 }
565
566 dnc = container_of(dn_hdr, struct wusb_dn_connect, hdr);
567 ckhdid_printf(pr_cdid, sizeof(pr_cdid), &dnc->CDID);
568 dev_info(dev, "DN CONNECT: device %s @ %x (%s) wants to %s\n",
569 pr_cdid,
570 wusb_dn_connect_prev_dev_addr(dnc),
571 beacon_behaviour[wusb_dn_connect_beacon_behavior(dnc)],
572 wusb_dn_connect_new_connection(dnc) ? "connect" : "reconnect");
573 /* ACK the connect */
574 wusbhc_devconnect_ack(wusbhc, dnc, pr_cdid);
575}
576
577/*
578 * Handle a DN_Disconnect notification (WUSB1.0[7.6.1])
579 *
580 * Device is going down -- do the disconnect.
581 *
582 * @wusbhc shall be referenced and unlocked
583 */
584static void wusbhc_handle_dn_disconnect(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
585{
586 struct device *dev = wusbhc->dev;
587
588 dev_info(dev, "DN DISCONNECT: device 0x%02x going down\n", wusb_dev->addr);
589
590 mutex_lock(&wusbhc->mutex);
591 __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc, wusb_dev->port_idx));
592 mutex_unlock(&wusbhc->mutex);
593}
594
595/*
596 * Handle a Device Notification coming a host
597 *
598 * The Device Notification comes from a host (HWA, DWA or WHCI)
599 * wrapped in a set of headers. Somebody else has peeled off those
600 * headers for us and we just get one Device Notifications.
601 *
602 * Invalid DNs (e.g., too short) are discarded.
603 *
604 * @wusbhc shall be referenced
605 *
606 * FIXMES:
607 * - implement priorities as in WUSB1.0[Table 7-55]?
608 */
609void wusbhc_handle_dn(struct wusbhc *wusbhc, u8 srcaddr,
610 struct wusb_dn_hdr *dn_hdr, size_t size)
611{
612 struct device *dev = wusbhc->dev;
613 struct wusb_dev *wusb_dev;
614
615 if (size < sizeof(struct wusb_dn_hdr)) {
616 dev_err(dev, "DN data shorter than DN header (%d < %d)\n",
617 (int)size, (int)sizeof(struct wusb_dn_hdr));
618 return;
619 }
620
621 wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
622 if (wusb_dev == NULL && dn_hdr->bType != WUSB_DN_CONNECT) {
623 dev_dbg(dev, "ignoring DN %d from unconnected device %02x\n",
624 dn_hdr->bType, srcaddr);
625 return;
626 }
627
628 switch (dn_hdr->bType) {
629 case WUSB_DN_CONNECT:
630 wusbhc_handle_dn_connect(wusbhc, dn_hdr, size);
631 break;
632 case WUSB_DN_ALIVE:
633 wusbhc_handle_dn_alive(wusbhc, wusb_dev);
634 break;
635 case WUSB_DN_DISCONNECT:
636 wusbhc_handle_dn_disconnect(wusbhc, wusb_dev);
637 break;
638 case WUSB_DN_MASAVAILCHANGED:
639 case WUSB_DN_RWAKE:
640 case WUSB_DN_SLEEP:
641 /* FIXME: handle these DNs. */
642 break;
643 case WUSB_DN_EPRDY:
644 /* The hardware handles these. */
645 break;
646 default:
647 dev_warn(dev, "unknown DN %u (%d octets) from %u\n",
648 dn_hdr->bType, (int)size, srcaddr);
649 }
650}
651EXPORT_SYMBOL_GPL(wusbhc_handle_dn);
652
653/*
654 * Disconnect a WUSB device from a the cluster
655 *
656 * @wusbhc
657 * @port Fake port where the device is (wusbhc index, not USB port number).
658 *
659 * In Wireless USB, a disconnect is basically telling the device he is
660 * being disconnected and forgetting about him.
661 *
662 * We send the device a Device Disconnect IE (WUSB1.0[7.5.11]) for 100
663 * ms and then keep going.
664 *
665 * We don't do much in case of error; we always pretend we disabled
666 * the port and disconnected the device. If physically the request
667 * didn't get there (many things can fail in the way there), the stack
668 * will reject the device's communication attempts.
669 *
670 * @wusbhc should be refcounted and locked
671 */
672void __wusbhc_dev_disable(struct wusbhc *wusbhc, u8 port_idx)
673{
674 int result;
675 struct device *dev = wusbhc->dev;
676 struct wusb_dev *wusb_dev;
677 struct wuie_disconnect *ie;
678
679 wusb_dev = wusb_port_by_idx(wusbhc, port_idx)->wusb_dev;
680 if (wusb_dev == NULL) {
681 /* reset no device? ignore */
682 dev_dbg(dev, "DISCONNECT: no device at port %u, ignoring\n",
683 port_idx);
684 return;
685 }
686 __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc, port_idx));
687
688 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
689 if (ie == NULL)
690 return;
691 ie->hdr.bLength = sizeof(*ie);
692 ie->hdr.bIEIdentifier = WUIE_ID_DEVICE_DISCONNECT;
693 ie->bDeviceAddress = wusb_dev->addr;
694 result = wusbhc_mmcie_set(wusbhc, 0, 0, &ie->hdr);
695 if (result < 0)
696 dev_err(dev, "DISCONNECT: can't set MMC: %d\n", result);
697 else {
698 /* At least 6 MMCs, assuming at least 1 MMC per zone. */
699 msleep(7*4);
700 wusbhc_mmcie_rm(wusbhc, &ie->hdr);
701 }
702 kfree(ie);
703}
704
705/*
706 * Walk over the BOS descriptor, verify and grok it
707 *
708 * @usb_dev: referenced
709 * @wusb_dev: referenced and unlocked
710 *
711 * The BOS descriptor is defined at WUSB1.0[7.4.1], and it defines a
712 * "flexible" way to wrap all kinds of descriptors inside an standard
713 * descriptor (wonder why they didn't use normal descriptors,
714 * btw). Not like they lack code.
715 *
716 * At the end we go to look for the WUSB Device Capabilities
717 * (WUSB1.0[7.4.1.1]) that is wrapped in a device capability descriptor
718 * that is part of the BOS descriptor set. That tells us what does the
719 * device support (dual role, beacon type, UWB PHY rates).
720 */
721static int wusb_dev_bos_grok(struct usb_device *usb_dev,
722 struct wusb_dev *wusb_dev,
723 struct usb_bos_descriptor *bos, size_t desc_size)
724{
725 ssize_t result;
726 struct device *dev = &usb_dev->dev;
727 void *itr, *top;
728
729 /* Walk over BOS capabilities, verify them */
730 itr = (void *)bos + sizeof(*bos);
731 top = itr + desc_size - sizeof(*bos);
732 while (itr < top) {
733 struct usb_dev_cap_header *cap_hdr = itr;
734 size_t cap_size;
735 u8 cap_type;
736 if (top - itr < sizeof(*cap_hdr)) {
737 dev_err(dev, "Device BUG? premature end of BOS header "
738 "data [offset 0x%02x]: only %zu bytes left\n",
739 (int)(itr - (void *)bos), top - itr);
740 result = -ENOSPC;
741 goto error_bad_cap;
742 }
743 cap_size = cap_hdr->bLength;
744 cap_type = cap_hdr->bDevCapabilityType;
745 if (cap_size == 0)
746 break;
747 if (cap_size > top - itr) {
748 dev_err(dev, "Device BUG? premature end of BOS data "
749 "[offset 0x%02x cap %02x %zu bytes]: "
750 "only %zu bytes left\n",
751 (int)(itr - (void *)bos),
752 cap_type, cap_size, top - itr);
753 result = -EBADF;
754 goto error_bad_cap;
755 }
756 switch (cap_type) {
757 case USB_CAP_TYPE_WIRELESS_USB:
758 if (cap_size != sizeof(*wusb_dev->wusb_cap_descr))
759 dev_err(dev, "Device BUG? WUSB Capability "
760 "descriptor is %zu bytes vs %zu "
761 "needed\n", cap_size,
762 sizeof(*wusb_dev->wusb_cap_descr));
763 else
764 wusb_dev->wusb_cap_descr = itr;
765 break;
766 default:
767 dev_err(dev, "BUG? Unknown BOS capability 0x%02x "
768 "(%zu bytes) at offset 0x%02x\n", cap_type,
769 cap_size, (int)(itr - (void *)bos));
770 }
771 itr += cap_size;
772 }
773 result = 0;
774error_bad_cap:
775 return result;
776}
777
778/*
779 * Add information from the BOS descriptors to the device
780 *
781 * @usb_dev: referenced
782 * @wusb_dev: referenced and unlocked
783 *
784 * So what we do is we alloc a space for the BOS descriptor of 64
785 * bytes; read the first four bytes which include the wTotalLength
786 * field (WUSB1.0[T7-26]) and if it fits in those 64 bytes, read the
787 * whole thing. If not we realloc to that size.
788 *
789 * Then we call the groking function, that will fill up
790 * wusb_dev->wusb_cap_descr, which is what we'll need later on.
791 */
792static int wusb_dev_bos_add(struct usb_device *usb_dev,
793 struct wusb_dev *wusb_dev)
794{
795 ssize_t result;
796 struct device *dev = &usb_dev->dev;
797 struct usb_bos_descriptor *bos;
798 size_t alloc_size = 32, desc_size = 4;
799
800 bos = kmalloc(alloc_size, GFP_KERNEL);
801 if (bos == NULL)
802 return -ENOMEM;
803 result = usb_get_descriptor(usb_dev, USB_DT_BOS, 0, bos, desc_size);
804 if (result < 4) {
805 dev_err(dev, "Can't get BOS descriptor or too short: %zd\n",
806 result);
807 goto error_get_descriptor;
808 }
809 desc_size = le16_to_cpu(bos->wTotalLength);
810 if (desc_size >= alloc_size) {
811 kfree(bos);
812 alloc_size = desc_size;
813 bos = kmalloc(alloc_size, GFP_KERNEL);
814 if (bos == NULL)
815 return -ENOMEM;
816 }
817 result = usb_get_descriptor(usb_dev, USB_DT_BOS, 0, bos, desc_size);
818 if (result < 0 || result != desc_size) {
819 dev_err(dev, "Can't get BOS descriptor or too short (need "
820 "%zu bytes): %zd\n", desc_size, result);
821 goto error_get_descriptor;
822 }
823 if (result < sizeof(*bos)
824 || le16_to_cpu(bos->wTotalLength) != desc_size) {
825 dev_err(dev, "Can't get BOS descriptor or too short (need "
826 "%zu bytes): %zd\n", desc_size, result);
827 goto error_get_descriptor;
828 }
829
830 result = wusb_dev_bos_grok(usb_dev, wusb_dev, bos, result);
831 if (result < 0)
832 goto error_bad_bos;
833 wusb_dev->bos = bos;
834 return 0;
835
836error_bad_bos:
837error_get_descriptor:
838 kfree(bos);
839 wusb_dev->wusb_cap_descr = NULL;
840 return result;
841}
842
843static void wusb_dev_bos_rm(struct wusb_dev *wusb_dev)
844{
845 kfree(wusb_dev->bos);
846 wusb_dev->wusb_cap_descr = NULL;
847};
848
849static struct usb_wireless_cap_descriptor wusb_cap_descr_default = {
850 .bLength = sizeof(wusb_cap_descr_default),
851 .bDescriptorType = USB_DT_DEVICE_CAPABILITY,
852 .bDevCapabilityType = USB_CAP_TYPE_WIRELESS_USB,
853
854 .bmAttributes = USB_WIRELESS_BEACON_NONE,
855 .wPHYRates = cpu_to_le16(USB_WIRELESS_PHY_53),
856 .bmTFITXPowerInfo = 0,
857 .bmFFITXPowerInfo = 0,
858 .bmBandGroup = cpu_to_le16(0x0001), /* WUSB1.0[7.4.1] bottom */
859 .bReserved = 0
860};
861
862/*
863 * USB stack's device addition Notifier Callback
864 *
865 * Called from drivers/usb/core/hub.c when a new device is added; we
866 * use this hook to perform certain WUSB specific setup work on the
867 * new device. As well, it is the first time we can connect the
868 * wusb_dev and the usb_dev. So we note it down in wusb_dev and take a
869 * reference that we'll drop.
870 *
871 * First we need to determine if the device is a WUSB device (else we
872 * ignore it). For that we use the speed setting (USB_SPEED_WIRELESS)
873 * [FIXME: maybe we'd need something more definitive]. If so, we track
874 * it's usb_busd and from there, the WUSB HC.
875 *
876 * Because all WUSB HCs are contained in a 'struct wusbhc', voila, we
877 * get the wusbhc for the device.
878 *
879 * We have a reference on @usb_dev (as we are called at the end of its
880 * enumeration).
881 *
882 * NOTE: @usb_dev locked
883 */
884static void wusb_dev_add_ncb(struct usb_device *usb_dev)
885{
886 int result = 0;
887 struct wusb_dev *wusb_dev;
888 struct wusbhc *wusbhc;
889 struct device *dev = &usb_dev->dev;
890 u8 port_idx;
891
892 if (usb_dev->wusb == 0 || usb_dev->devnum == 1)
893 return; /* skip non wusb and wusb RHs */
894
895 usb_set_device_state(usb_dev, USB_STATE_UNAUTHENTICATED);
896
897 wusbhc = wusbhc_get_by_usb_dev(usb_dev);
898 if (wusbhc == NULL)
899 goto error_nodev;
900 mutex_lock(&wusbhc->mutex);
901 wusb_dev = __wusb_dev_get_by_usb_dev(wusbhc, usb_dev);
902 port_idx = wusb_port_no_to_idx(usb_dev->portnum);
903 mutex_unlock(&wusbhc->mutex);
904 if (wusb_dev == NULL)
905 goto error_nodev;
906 wusb_dev->usb_dev = usb_get_dev(usb_dev);
907 usb_dev->wusb_dev = wusb_dev_get(wusb_dev);
908 result = wusb_dev_sec_add(wusbhc, usb_dev, wusb_dev);
909 if (result < 0) {
910 dev_err(dev, "Cannot enable security: %d\n", result);
911 goto error_sec_add;
912 }
913 /* Now query the device for it's BOS and attach it to wusb_dev */
914 result = wusb_dev_bos_add(usb_dev, wusb_dev);
915 if (result < 0) {
916 dev_err(dev, "Cannot get BOS descriptors: %d\n", result);
917 goto error_bos_add;
918 }
919 result = wusb_dev_sysfs_add(wusbhc, usb_dev, wusb_dev);
920 if (result < 0)
921 goto error_add_sysfs;
922out:
923 wusb_dev_put(wusb_dev);
924 wusbhc_put(wusbhc);
925error_nodev:
926 return;
927
928 wusb_dev_sysfs_rm(wusb_dev);
929error_add_sysfs:
930 wusb_dev_bos_rm(wusb_dev);
931error_bos_add:
932 wusb_dev_sec_rm(wusb_dev);
933error_sec_add:
934 mutex_lock(&wusbhc->mutex);
935 __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc, port_idx));
936 mutex_unlock(&wusbhc->mutex);
937 goto out;
938}
939
940/*
941 * Undo all the steps done at connection by the notifier callback
942 *
943 * NOTE: @usb_dev locked
944 */
945static void wusb_dev_rm_ncb(struct usb_device *usb_dev)
946{
947 struct wusb_dev *wusb_dev = usb_dev->wusb_dev;
948
949 if (usb_dev->wusb == 0 || usb_dev->devnum == 1)
950 return; /* skip non wusb and wusb RHs */
951
952 wusb_dev_sysfs_rm(wusb_dev);
953 wusb_dev_bos_rm(wusb_dev);
954 wusb_dev_sec_rm(wusb_dev);
955 wusb_dev->usb_dev = NULL;
956 usb_dev->wusb_dev = NULL;
957 wusb_dev_put(wusb_dev);
958 usb_put_dev(usb_dev);
959}
960
961/*
962 * Handle notifications from the USB stack (notifier call back)
963 *
964 * This is called when the USB stack does a
965 * usb_{bus,device}_{add,remove}() so we can do WUSB specific
966 * handling. It is called with [for the case of
967 * USB_DEVICE_{ADD,REMOVE} with the usb_dev locked.
968 */
969int wusb_usb_ncb(struct notifier_block *nb, unsigned long val,
970 void *priv)
971{
972 int result = NOTIFY_OK;
973
974 switch (val) {
975 case USB_DEVICE_ADD:
976 wusb_dev_add_ncb(priv);
977 break;
978 case USB_DEVICE_REMOVE:
979 wusb_dev_rm_ncb(priv);
980 break;
981 case USB_BUS_ADD:
982 /* ignore (for now) */
983 case USB_BUS_REMOVE:
984 break;
985 default:
986 WARN_ON(1);
987 result = NOTIFY_BAD;
988 };
989 return result;
990}
991
992/*
993 * Return a referenced wusb_dev given a @wusbhc and @usb_dev
994 */
995struct wusb_dev *__wusb_dev_get_by_usb_dev(struct wusbhc *wusbhc,
996 struct usb_device *usb_dev)
997{
998 struct wusb_dev *wusb_dev;
999 u8 port_idx;
1000
1001 port_idx = wusb_port_no_to_idx(usb_dev->portnum);
1002 BUG_ON(port_idx > wusbhc->ports_max);
1003 wusb_dev = wusb_port_by_idx(wusbhc, port_idx)->wusb_dev;
1004 if (wusb_dev != NULL) /* ops, device is gone */
1005 wusb_dev_get(wusb_dev);
1006 return wusb_dev;
1007}
1008EXPORT_SYMBOL_GPL(__wusb_dev_get_by_usb_dev);
1009
1010void wusb_dev_destroy(struct kref *_wusb_dev)
1011{
1012 struct wusb_dev *wusb_dev = container_of(_wusb_dev, struct wusb_dev, refcnt);
1013
1014 list_del_init(&wusb_dev->cack_node);
1015 wusb_dev_free(wusb_dev);
1016}
1017EXPORT_SYMBOL_GPL(wusb_dev_destroy);
1018
1019/*
1020 * Create all the device connect handling infrastructure
1021 *
1022 * This is basically the device info array, Connect Acknowledgement
1023 * (cack) lists, keep-alive timers (and delayed work thread).
1024 */
1025int wusbhc_devconnect_create(struct wusbhc *wusbhc)
1026{
1027 wusbhc->keep_alive_ie.hdr.bIEIdentifier = WUIE_ID_KEEP_ALIVE;
1028 wusbhc->keep_alive_ie.hdr.bLength = sizeof(wusbhc->keep_alive_ie.hdr);
1029 INIT_DELAYED_WORK(&wusbhc->keep_alive_timer, wusbhc_keep_alive_run);
1030
1031 wusbhc->cack_ie.hdr.bIEIdentifier = WUIE_ID_CONNECTACK;
1032 wusbhc->cack_ie.hdr.bLength = sizeof(wusbhc->cack_ie.hdr);
1033 INIT_LIST_HEAD(&wusbhc->cack_list);
1034
1035 return 0;
1036}
1037
1038/*
1039 * Release all resources taken by the devconnect stuff
1040 */
1041void wusbhc_devconnect_destroy(struct wusbhc *wusbhc)
1042{
1043 /* no op */
1044}
1045
1046/*
1047 * wusbhc_devconnect_start - start accepting device connections
1048 * @wusbhc: the WUSB HC
1049 *
1050 * Sets the Host Info IE to accept all new connections.
1051 *
1052 * FIXME: This also enables the keep alives but this is not necessary
1053 * until there are connected and authenticated devices.
1054 */
1055int wusbhc_devconnect_start(struct wusbhc *wusbhc)
1056{
1057 struct device *dev = wusbhc->dev;
1058 struct wuie_host_info *hi;
1059 int result;
1060
1061 hi = kzalloc(sizeof(*hi), GFP_KERNEL);
1062 if (hi == NULL)
1063 return -ENOMEM;
1064
1065 hi->hdr.bLength = sizeof(*hi);
1066 hi->hdr.bIEIdentifier = WUIE_ID_HOST_INFO;
1067 hi->attributes = cpu_to_le16((wusbhc->rsv->stream << 3) | WUIE_HI_CAP_ALL);
1068 hi->CHID = wusbhc->chid;
1069 result = wusbhc_mmcie_set(wusbhc, 0, 0, &hi->hdr);
1070 if (result < 0) {
1071 dev_err(dev, "Cannot add Host Info MMCIE: %d\n", result);
1072 goto error_mmcie_set;
1073 }
1074 wusbhc->wuie_host_info = hi;
1075
1076 queue_delayed_work(wusbd, &wusbhc->keep_alive_timer,
1077 (wusbhc->trust_timeout*CONFIG_HZ)/1000/2);
1078
1079 return 0;
1080
1081error_mmcie_set:
1082 kfree(hi);
1083 return result;
1084}
1085
1086/*
1087 * wusbhc_devconnect_stop - stop managing connected devices
1088 * @wusbhc: the WUSB HC
1089 *
1090 * Disconnects any devices still connected, stops the keep alives and
1091 * removes the Host Info IE.
1092 */
1093void wusbhc_devconnect_stop(struct wusbhc *wusbhc)
1094{
1095 int i;
1096
1097 mutex_lock(&wusbhc->mutex);
1098 for (i = 0; i < wusbhc->ports_max; i++) {
1099 if (wusbhc->port[i].wusb_dev)
1100 __wusbhc_dev_disconnect(wusbhc, &wusbhc->port[i]);
1101 }
1102 mutex_unlock(&wusbhc->mutex);
1103
1104 cancel_delayed_work_sync(&wusbhc->keep_alive_timer);
1105 wusbhc_mmcie_rm(wusbhc, &wusbhc->wuie_host_info->hdr);
1106 kfree(wusbhc->wuie_host_info);
1107 wusbhc->wuie_host_info = NULL;
1108}
1109
1110/*
1111 * wusb_set_dev_addr - set the WUSB device address used by the host
1112 * @wusbhc: the WUSB HC the device is connect to
1113 * @wusb_dev: the WUSB device
1114 * @addr: new device address
1115 */
1116int wusb_set_dev_addr(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev, u8 addr)
1117{
1118 int result;
1119
1120 wusb_dev->addr = addr;
1121 result = wusbhc->dev_info_set(wusbhc, wusb_dev);
1122 if (result < 0)
1123 dev_err(wusbhc->dev, "device %d: failed to set device "
1124 "address\n", wusb_dev->port_idx);
1125 else
1126 dev_info(wusbhc->dev, "device %d: %s addr %u\n",
1127 wusb_dev->port_idx,
1128 (addr & WUSB_DEV_ADDR_UNAUTH) ? "unauth" : "auth",
1129 wusb_dev->addr);
1130
1131 return result;
1132}
1/*
2 * WUSB Wire Adapter: Control/Data Streaming Interface (WUSB[8])
3 * Device Connect handling
4 *
5 * Copyright (C) 2006 Intel Corporation
6 * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
7 *
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License version
10 * 2 as published by the Free Software Foundation.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
20 * 02110-1301, USA.
21 *
22 *
23 * FIXME: docs
24 * FIXME: this file needs to be broken up, it's grown too big
25 *
26 *
27 * WUSB1.0[7.1, 7.5.1, ]
28 *
29 * WUSB device connection is kind of messy. Some background:
30 *
31 * When a device wants to connect it scans the UWB radio channels
32 * looking for a WUSB Channel; a WUSB channel is defined by MMCs
33 * (Micro Managed Commands or something like that) [see
34 * Design-overview for more on this] .
35 *
36 * So, device scans the radio, finds MMCs and thus a host and checks
37 * when the next DNTS is. It sends a Device Notification Connect
38 * (DN_Connect); the host picks it up (through nep.c and notif.c, ends
39 * up in wusb_devconnect_ack(), which creates a wusb_dev structure in
40 * wusbhc->port[port_number].wusb_dev), assigns an unauth address
41 * to the device (this means from 0x80 to 0xfe) and sends, in the MMC
42 * a Connect Ack Information Element (ConnAck IE).
43 *
44 * So now the device now has a WUSB address. From now on, we use
45 * that to talk to it in the RPipes.
46 *
47 * ASSUMPTIONS:
48 *
49 * - We use the the as device address the port number where it is
50 * connected (port 0 doesn't exist). For unauth, it is 128 + that.
51 *
52 * ROADMAP:
53 *
54 * This file contains the logic for doing that--entry points:
55 *
56 * wusb_devconnect_ack() Ack a device until _acked() called.
57 * Called by notif.c:wusb_handle_dn_connect()
58 * when a DN_Connect is received.
59 *
60 * wusb_devconnect_acked() Ack done, release resources.
61 *
62 * wusb_handle_dn_alive() Called by notif.c:wusb_handle_dn()
63 * for processing a DN_Alive pong from a device.
64 *
65 * wusb_handle_dn_disconnect()Called by notif.c:wusb_handle_dn() to
66 * process a disconenct request from a
67 * device.
68 *
69 * __wusb_dev_disable() Called by rh.c:wusbhc_rh_clear_port_feat() when
70 * disabling a port.
71 *
72 * wusb_devconnect_create() Called when creating the host by
73 * lc.c:wusbhc_create().
74 *
75 * wusb_devconnect_destroy() Cleanup called removing the host. Called
76 * by lc.c:wusbhc_destroy().
77 *
78 * Each Wireless USB host maintains a list of DN_Connect requests
79 * (actually we maintain a list of pending Connect Acks, the
80 * wusbhc->ca_list).
81 *
82 * LIFE CYCLE OF port->wusb_dev
83 *
84 * Before the @wusbhc structure put()s the reference it owns for
85 * port->wusb_dev [and clean the wusb_dev pointer], it needs to
86 * lock @wusbhc->mutex.
87 */
88
89#include <linux/jiffies.h>
90#include <linux/ctype.h>
91#include <linux/slab.h>
92#include <linux/workqueue.h>
93#include <linux/export.h>
94#include "wusbhc.h"
95
96static void wusbhc_devconnect_acked_work(struct work_struct *work);
97
98static void wusb_dev_free(struct wusb_dev *wusb_dev)
99{
100 kfree(wusb_dev);
101}
102
103static struct wusb_dev *wusb_dev_alloc(struct wusbhc *wusbhc)
104{
105 struct wusb_dev *wusb_dev;
106
107 wusb_dev = kzalloc(sizeof(*wusb_dev), GFP_KERNEL);
108 if (wusb_dev == NULL)
109 goto err;
110
111 wusb_dev->wusbhc = wusbhc;
112
113 INIT_WORK(&wusb_dev->devconnect_acked_work, wusbhc_devconnect_acked_work);
114
115 return wusb_dev;
116err:
117 wusb_dev_free(wusb_dev);
118 return NULL;
119}
120
121
122/*
123 * Using the Connect-Ack list, fill out the @wusbhc Connect-Ack WUSB IE
124 * properly so that it can be added to the MMC.
125 *
126 * We just get the @wusbhc->ca_list and fill out the first four ones or
127 * less (per-spec WUSB1.0[7.5, before T7-38). If the ConnectAck WUSB
128 * IE is not allocated, we alloc it.
129 *
130 * @wusbhc->mutex must be taken
131 */
132static void wusbhc_fill_cack_ie(struct wusbhc *wusbhc)
133{
134 unsigned cnt;
135 struct wusb_dev *dev_itr;
136 struct wuie_connect_ack *cack_ie;
137
138 cack_ie = &wusbhc->cack_ie;
139 cnt = 0;
140 list_for_each_entry(dev_itr, &wusbhc->cack_list, cack_node) {
141 cack_ie->blk[cnt].CDID = dev_itr->cdid;
142 cack_ie->blk[cnt].bDeviceAddress = dev_itr->addr;
143 if (++cnt >= WUIE_ELT_MAX)
144 break;
145 }
146 cack_ie->hdr.bLength = sizeof(cack_ie->hdr)
147 + cnt * sizeof(cack_ie->blk[0]);
148}
149
150/*
151 * Register a new device that wants to connect
152 *
153 * A new device wants to connect, so we add it to the Connect-Ack
154 * list. We give it an address in the unauthorized range (bit 8 set);
155 * user space will have to drive authorization further on.
156 *
157 * @dev_addr: address to use for the device (which is also the port
158 * number).
159 *
160 * @wusbhc->mutex must be taken
161 */
162static struct wusb_dev *wusbhc_cack_add(struct wusbhc *wusbhc,
163 struct wusb_dn_connect *dnc,
164 const char *pr_cdid, u8 port_idx)
165{
166 struct device *dev = wusbhc->dev;
167 struct wusb_dev *wusb_dev;
168 int new_connection = wusb_dn_connect_new_connection(dnc);
169 u8 dev_addr;
170 int result;
171
172 /* Is it registered already? */
173 list_for_each_entry(wusb_dev, &wusbhc->cack_list, cack_node)
174 if (!memcmp(&wusb_dev->cdid, &dnc->CDID,
175 sizeof(wusb_dev->cdid)))
176 return wusb_dev;
177 /* We don't have it, create an entry, register it */
178 wusb_dev = wusb_dev_alloc(wusbhc);
179 if (wusb_dev == NULL)
180 return NULL;
181 wusb_dev_init(wusb_dev);
182 wusb_dev->cdid = dnc->CDID;
183 wusb_dev->port_idx = port_idx;
184
185 /*
186 * Devices are always available within the cluster reservation
187 * and since the hardware will take the intersection of the
188 * per-device availability and the cluster reservation, the
189 * per-device availability can simply be set to always
190 * available.
191 */
192 bitmap_fill(wusb_dev->availability.bm, UWB_NUM_MAS);
193
194 /* FIXME: handle reconnects instead of assuming connects are
195 always new. */
196 if (1 && new_connection == 0)
197 new_connection = 1;
198 if (new_connection) {
199 dev_addr = (port_idx + 2) | WUSB_DEV_ADDR_UNAUTH;
200
201 dev_info(dev, "Connecting new WUSB device to address %u, "
202 "port %u\n", dev_addr, port_idx);
203
204 result = wusb_set_dev_addr(wusbhc, wusb_dev, dev_addr);
205 if (result < 0)
206 return NULL;
207 }
208 wusb_dev->entry_ts = jiffies;
209 list_add_tail(&wusb_dev->cack_node, &wusbhc->cack_list);
210 wusbhc->cack_count++;
211 wusbhc_fill_cack_ie(wusbhc);
212
213 return wusb_dev;
214}
215
216/*
217 * Remove a Connect-Ack context entry from the HCs view
218 *
219 * @wusbhc->mutex must be taken
220 */
221static void wusbhc_cack_rm(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
222{
223 list_del_init(&wusb_dev->cack_node);
224 wusbhc->cack_count--;
225 wusbhc_fill_cack_ie(wusbhc);
226}
227
228/*
229 * @wusbhc->mutex must be taken */
230static
231void wusbhc_devconnect_acked(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
232{
233 wusbhc_cack_rm(wusbhc, wusb_dev);
234 if (wusbhc->cack_count)
235 wusbhc_mmcie_set(wusbhc, 0, 0, &wusbhc->cack_ie.hdr);
236 else
237 wusbhc_mmcie_rm(wusbhc, &wusbhc->cack_ie.hdr);
238}
239
240static void wusbhc_devconnect_acked_work(struct work_struct *work)
241{
242 struct wusb_dev *wusb_dev = container_of(work, struct wusb_dev,
243 devconnect_acked_work);
244 struct wusbhc *wusbhc = wusb_dev->wusbhc;
245
246 mutex_lock(&wusbhc->mutex);
247 wusbhc_devconnect_acked(wusbhc, wusb_dev);
248 mutex_unlock(&wusbhc->mutex);
249
250 wusb_dev_put(wusb_dev);
251}
252
253/*
254 * Ack a device for connection
255 *
256 * FIXME: docs
257 *
258 * @pr_cdid: Printable CDID...hex Use @dnc->cdid for the real deal.
259 *
260 * So we get the connect ack IE (may have been allocated already),
261 * find an empty connect block, an empty virtual port, create an
262 * address with it (see below), make it an unauth addr [bit 7 set] and
263 * set the MMC.
264 *
265 * Addresses: because WUSB hosts have no downstream hubs, we can do a
266 * 1:1 mapping between 'port number' and device
267 * address. This simplifies many things, as during this
268 * initial connect phase the USB stack has no knowledge of
269 * the device and hasn't assigned an address yet--we know
270 * USB's choose_address() will use the same heuristics we
271 * use here, so we can assume which address will be assigned.
272 *
273 * USB stack always assigns address 1 to the root hub, so
274 * to the port number we add 2 (thus virtual port #0 is
275 * addr #2).
276 *
277 * @wusbhc shall be referenced
278 */
279static
280void wusbhc_devconnect_ack(struct wusbhc *wusbhc, struct wusb_dn_connect *dnc,
281 const char *pr_cdid)
282{
283 int result;
284 struct device *dev = wusbhc->dev;
285 struct wusb_dev *wusb_dev;
286 struct wusb_port *port;
287 unsigned idx;
288
289 mutex_lock(&wusbhc->mutex);
290
291 /* Check we are not handling it already */
292 for (idx = 0; idx < wusbhc->ports_max; idx++) {
293 port = wusb_port_by_idx(wusbhc, idx);
294 if (port->wusb_dev
295 && memcmp(&dnc->CDID, &port->wusb_dev->cdid, sizeof(dnc->CDID)) == 0)
296 goto error_unlock;
297 }
298 /* Look up those fake ports we have for a free one */
299 for (idx = 0; idx < wusbhc->ports_max; idx++) {
300 port = wusb_port_by_idx(wusbhc, idx);
301 if ((port->status & USB_PORT_STAT_POWER)
302 && !(port->status & USB_PORT_STAT_CONNECTION))
303 break;
304 }
305 if (idx >= wusbhc->ports_max) {
306 dev_err(dev, "Host controller can't connect more devices "
307 "(%u already connected); device %s rejected\n",
308 wusbhc->ports_max, pr_cdid);
309 /* NOTE: we could send a WUIE_Disconnect here, but we haven't
310 * event acked, so the device will eventually timeout the
311 * connection, right? */
312 goto error_unlock;
313 }
314
315 /* Make sure we are using no crypto on that "virtual port" */
316 wusbhc->set_ptk(wusbhc, idx, 0, NULL, 0);
317
318 /* Grab a filled in Connect-Ack context, fill out the
319 * Connect-Ack Wireless USB IE, set the MMC */
320 wusb_dev = wusbhc_cack_add(wusbhc, dnc, pr_cdid, idx);
321 if (wusb_dev == NULL)
322 goto error_unlock;
323 result = wusbhc_mmcie_set(wusbhc, 0, 0, &wusbhc->cack_ie.hdr);
324 if (result < 0)
325 goto error_unlock;
326 /* Give the device at least 2ms (WUSB1.0[7.5.1p3]), let's do
327 * three for a good measure */
328 msleep(3);
329 port->wusb_dev = wusb_dev;
330 port->status |= USB_PORT_STAT_CONNECTION;
331 port->change |= USB_PORT_STAT_C_CONNECTION;
332 /* Now the port status changed to connected; khubd will
333 * pick the change up and try to reset the port to bring it to
334 * the enabled state--so this process returns up to the stack
335 * and it calls back into wusbhc_rh_port_reset().
336 */
337error_unlock:
338 mutex_unlock(&wusbhc->mutex);
339 return;
340
341}
342
343/*
344 * Disconnect a Wireless USB device from its fake port
345 *
346 * Marks the port as disconnected so that khubd can pick up the change
347 * and drops our knowledge about the device.
348 *
349 * Assumes there is a device connected
350 *
351 * @port_index: zero based port number
352 *
353 * NOTE: @wusbhc->mutex is locked
354 *
355 * WARNING: From here it is not very safe to access anything hanging off
356 * wusb_dev
357 */
358static void __wusbhc_dev_disconnect(struct wusbhc *wusbhc,
359 struct wusb_port *port)
360{
361 struct wusb_dev *wusb_dev = port->wusb_dev;
362
363 port->status &= ~(USB_PORT_STAT_CONNECTION | USB_PORT_STAT_ENABLE
364 | USB_PORT_STAT_SUSPEND | USB_PORT_STAT_RESET
365 | USB_PORT_STAT_LOW_SPEED | USB_PORT_STAT_HIGH_SPEED);
366 port->change |= USB_PORT_STAT_C_CONNECTION | USB_PORT_STAT_C_ENABLE;
367 if (wusb_dev) {
368 dev_dbg(wusbhc->dev, "disconnecting device from port %d\n", wusb_dev->port_idx);
369 if (!list_empty(&wusb_dev->cack_node))
370 list_del_init(&wusb_dev->cack_node);
371 /* For the one in cack_add() */
372 wusb_dev_put(wusb_dev);
373 }
374 port->wusb_dev = NULL;
375
376 /* After a device disconnects, change the GTK (see [WUSB]
377 * section 6.2.11.2). */
378 if (wusbhc->active)
379 wusbhc_gtk_rekey(wusbhc);
380
381 /* The Wireless USB part has forgotten about the device already; now
382 * khubd's timer will pick up the disconnection and remove the USB
383 * device from the system
384 */
385}
386
387/*
388 * Refresh the list of keep alives to emit in the MMC
389 *
390 * We only publish the first four devices that have a coming timeout
391 * condition. Then when we are done processing those, we go for the
392 * next ones. We ignore the ones that have timed out already (they'll
393 * be purged).
394 *
395 * This might cause the first devices to timeout the last devices in
396 * the port array...FIXME: come up with a better algorithm?
397 *
398 * Note we can't do much about MMC's ops errors; we hope next refresh
399 * will kind of handle it.
400 *
401 * NOTE: @wusbhc->mutex is locked
402 */
403static void __wusbhc_keep_alive(struct wusbhc *wusbhc)
404{
405 struct device *dev = wusbhc->dev;
406 unsigned cnt;
407 struct wusb_dev *wusb_dev;
408 struct wusb_port *wusb_port;
409 struct wuie_keep_alive *ie = &wusbhc->keep_alive_ie;
410 unsigned keep_alives, old_keep_alives;
411
412 old_keep_alives = ie->hdr.bLength - sizeof(ie->hdr);
413 keep_alives = 0;
414 for (cnt = 0;
415 keep_alives < WUIE_ELT_MAX && cnt < wusbhc->ports_max;
416 cnt++) {
417 unsigned tt = msecs_to_jiffies(wusbhc->trust_timeout);
418
419 wusb_port = wusb_port_by_idx(wusbhc, cnt);
420 wusb_dev = wusb_port->wusb_dev;
421
422 if (wusb_dev == NULL)
423 continue;
424 if (wusb_dev->usb_dev == NULL)
425 continue;
426
427 if (time_after(jiffies, wusb_dev->entry_ts + tt)) {
428 dev_err(dev, "KEEPALIVE: device %u timed out\n",
429 wusb_dev->addr);
430 __wusbhc_dev_disconnect(wusbhc, wusb_port);
431 } else if (time_after(jiffies, wusb_dev->entry_ts + tt/3)) {
432 /* Approaching timeout cut off, need to refresh */
433 ie->bDeviceAddress[keep_alives++] = wusb_dev->addr;
434 }
435 }
436 if (keep_alives & 0x1) /* pad to even number ([WUSB] section 7.5.9) */
437 ie->bDeviceAddress[keep_alives++] = 0x7f;
438 ie->hdr.bLength = sizeof(ie->hdr) +
439 keep_alives*sizeof(ie->bDeviceAddress[0]);
440 if (keep_alives > 0)
441 wusbhc_mmcie_set(wusbhc, 10, 5, &ie->hdr);
442 else if (old_keep_alives != 0)
443 wusbhc_mmcie_rm(wusbhc, &ie->hdr);
444}
445
446/*
447 * Do a run through all devices checking for timeouts
448 */
449static void wusbhc_keep_alive_run(struct work_struct *ws)
450{
451 struct delayed_work *dw = to_delayed_work(ws);
452 struct wusbhc *wusbhc = container_of(dw, struct wusbhc, keep_alive_timer);
453
454 mutex_lock(&wusbhc->mutex);
455 __wusbhc_keep_alive(wusbhc);
456 mutex_unlock(&wusbhc->mutex);
457
458 queue_delayed_work(wusbd, &wusbhc->keep_alive_timer,
459 msecs_to_jiffies(wusbhc->trust_timeout / 2));
460}
461
462/*
463 * Find the wusb_dev from its device address.
464 *
465 * The device can be found directly from the address (see
466 * wusb_cack_add() for where the device address is set to port_idx
467 * +2), except when the address is zero.
468 */
469static struct wusb_dev *wusbhc_find_dev_by_addr(struct wusbhc *wusbhc, u8 addr)
470{
471 int p;
472
473 if (addr == 0xff) /* unconnected */
474 return NULL;
475
476 if (addr > 0) {
477 int port = (addr & ~0x80) - 2;
478 if (port < 0 || port >= wusbhc->ports_max)
479 return NULL;
480 return wusb_port_by_idx(wusbhc, port)->wusb_dev;
481 }
482
483 /* Look for the device with address 0. */
484 for (p = 0; p < wusbhc->ports_max; p++) {
485 struct wusb_dev *wusb_dev = wusb_port_by_idx(wusbhc, p)->wusb_dev;
486 if (wusb_dev && wusb_dev->addr == addr)
487 return wusb_dev;
488 }
489 return NULL;
490}
491
492/*
493 * Handle a DN_Alive notification (WUSB1.0[7.6.1])
494 *
495 * This just updates the device activity timestamp and then refreshes
496 * the keep alive IE.
497 *
498 * @wusbhc shall be referenced and unlocked
499 */
500static void wusbhc_handle_dn_alive(struct wusbhc *wusbhc, u8 srcaddr)
501{
502 struct wusb_dev *wusb_dev;
503
504 mutex_lock(&wusbhc->mutex);
505 wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
506 if (wusb_dev == NULL) {
507 dev_dbg(wusbhc->dev, "ignoring DN_Alive from unconnected device %02x\n",
508 srcaddr);
509 } else {
510 wusb_dev->entry_ts = jiffies;
511 __wusbhc_keep_alive(wusbhc);
512 }
513 mutex_unlock(&wusbhc->mutex);
514}
515
516/*
517 * Handle a DN_Connect notification (WUSB1.0[7.6.1])
518 *
519 * @wusbhc
520 * @pkt_hdr
521 * @size: Size of the buffer where the notification resides; if the
522 * notification data suggests there should be more data than
523 * available, an error will be signaled and the whole buffer
524 * consumed.
525 *
526 * @wusbhc->mutex shall be held
527 */
528static void wusbhc_handle_dn_connect(struct wusbhc *wusbhc,
529 struct wusb_dn_hdr *dn_hdr,
530 size_t size)
531{
532 struct device *dev = wusbhc->dev;
533 struct wusb_dn_connect *dnc;
534 char pr_cdid[WUSB_CKHDID_STRSIZE];
535 static const char *beacon_behaviour[] = {
536 "reserved",
537 "self-beacon",
538 "directed-beacon",
539 "no-beacon"
540 };
541
542 if (size < sizeof(*dnc)) {
543 dev_err(dev, "DN CONNECT: short notification (%zu < %zu)\n",
544 size, sizeof(*dnc));
545 return;
546 }
547
548 dnc = container_of(dn_hdr, struct wusb_dn_connect, hdr);
549 ckhdid_printf(pr_cdid, sizeof(pr_cdid), &dnc->CDID);
550 dev_info(dev, "DN CONNECT: device %s @ %x (%s) wants to %s\n",
551 pr_cdid,
552 wusb_dn_connect_prev_dev_addr(dnc),
553 beacon_behaviour[wusb_dn_connect_beacon_behavior(dnc)],
554 wusb_dn_connect_new_connection(dnc) ? "connect" : "reconnect");
555 /* ACK the connect */
556 wusbhc_devconnect_ack(wusbhc, dnc, pr_cdid);
557}
558
559/*
560 * Handle a DN_Disconnect notification (WUSB1.0[7.6.1])
561 *
562 * Device is going down -- do the disconnect.
563 *
564 * @wusbhc shall be referenced and unlocked
565 */
566static void wusbhc_handle_dn_disconnect(struct wusbhc *wusbhc, u8 srcaddr)
567{
568 struct device *dev = wusbhc->dev;
569 struct wusb_dev *wusb_dev;
570
571 mutex_lock(&wusbhc->mutex);
572 wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
573 if (wusb_dev == NULL) {
574 dev_dbg(dev, "ignoring DN DISCONNECT from unconnected device %02x\n",
575 srcaddr);
576 } else {
577 dev_info(dev, "DN DISCONNECT: device 0x%02x going down\n",
578 wusb_dev->addr);
579 __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc,
580 wusb_dev->port_idx));
581 }
582 mutex_unlock(&wusbhc->mutex);
583}
584
585/*
586 * Handle a Device Notification coming a host
587 *
588 * The Device Notification comes from a host (HWA, DWA or WHCI)
589 * wrapped in a set of headers. Somebody else has peeled off those
590 * headers for us and we just get one Device Notifications.
591 *
592 * Invalid DNs (e.g., too short) are discarded.
593 *
594 * @wusbhc shall be referenced
595 *
596 * FIXMES:
597 * - implement priorities as in WUSB1.0[Table 7-55]?
598 */
599void wusbhc_handle_dn(struct wusbhc *wusbhc, u8 srcaddr,
600 struct wusb_dn_hdr *dn_hdr, size_t size)
601{
602 struct device *dev = wusbhc->dev;
603
604 if (size < sizeof(struct wusb_dn_hdr)) {
605 dev_err(dev, "DN data shorter than DN header (%d < %d)\n",
606 (int)size, (int)sizeof(struct wusb_dn_hdr));
607 return;
608 }
609 switch (dn_hdr->bType) {
610 case WUSB_DN_CONNECT:
611 wusbhc_handle_dn_connect(wusbhc, dn_hdr, size);
612 break;
613 case WUSB_DN_ALIVE:
614 wusbhc_handle_dn_alive(wusbhc, srcaddr);
615 break;
616 case WUSB_DN_DISCONNECT:
617 wusbhc_handle_dn_disconnect(wusbhc, srcaddr);
618 break;
619 case WUSB_DN_MASAVAILCHANGED:
620 case WUSB_DN_RWAKE:
621 case WUSB_DN_SLEEP:
622 /* FIXME: handle these DNs. */
623 break;
624 case WUSB_DN_EPRDY:
625 /* The hardware handles these. */
626 break;
627 default:
628 dev_warn(dev, "unknown DN %u (%d octets) from %u\n",
629 dn_hdr->bType, (int)size, srcaddr);
630 }
631}
632EXPORT_SYMBOL_GPL(wusbhc_handle_dn);
633
634/*
635 * Disconnect a WUSB device from a the cluster
636 *
637 * @wusbhc
638 * @port Fake port where the device is (wusbhc index, not USB port number).
639 *
640 * In Wireless USB, a disconnect is basically telling the device he is
641 * being disconnected and forgetting about him.
642 *
643 * We send the device a Device Disconnect IE (WUSB1.0[7.5.11]) for 100
644 * ms and then keep going.
645 *
646 * We don't do much in case of error; we always pretend we disabled
647 * the port and disconnected the device. If physically the request
648 * didn't get there (many things can fail in the way there), the stack
649 * will reject the device's communication attempts.
650 *
651 * @wusbhc should be refcounted and locked
652 */
653void __wusbhc_dev_disable(struct wusbhc *wusbhc, u8 port_idx)
654{
655 int result;
656 struct device *dev = wusbhc->dev;
657 struct wusb_dev *wusb_dev;
658 struct wuie_disconnect *ie;
659
660 wusb_dev = wusb_port_by_idx(wusbhc, port_idx)->wusb_dev;
661 if (wusb_dev == NULL) {
662 /* reset no device? ignore */
663 dev_dbg(dev, "DISCONNECT: no device at port %u, ignoring\n",
664 port_idx);
665 return;
666 }
667 __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc, port_idx));
668
669 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
670 if (ie == NULL)
671 return;
672 ie->hdr.bLength = sizeof(*ie);
673 ie->hdr.bIEIdentifier = WUIE_ID_DEVICE_DISCONNECT;
674 ie->bDeviceAddress = wusb_dev->addr;
675 result = wusbhc_mmcie_set(wusbhc, 0, 0, &ie->hdr);
676 if (result < 0)
677 dev_err(dev, "DISCONNECT: can't set MMC: %d\n", result);
678 else {
679 /* At least 6 MMCs, assuming at least 1 MMC per zone. */
680 msleep(7*4);
681 wusbhc_mmcie_rm(wusbhc, &ie->hdr);
682 }
683 kfree(ie);
684}
685
686/*
687 * Walk over the BOS descriptor, verify and grok it
688 *
689 * @usb_dev: referenced
690 * @wusb_dev: referenced and unlocked
691 *
692 * The BOS descriptor is defined at WUSB1.0[7.4.1], and it defines a
693 * "flexible" way to wrap all kinds of descriptors inside an standard
694 * descriptor (wonder why they didn't use normal descriptors,
695 * btw). Not like they lack code.
696 *
697 * At the end we go to look for the WUSB Device Capabilities
698 * (WUSB1.0[7.4.1.1]) that is wrapped in a device capability descriptor
699 * that is part of the BOS descriptor set. That tells us what does the
700 * device support (dual role, beacon type, UWB PHY rates).
701 */
702static int wusb_dev_bos_grok(struct usb_device *usb_dev,
703 struct wusb_dev *wusb_dev,
704 struct usb_bos_descriptor *bos, size_t desc_size)
705{
706 ssize_t result;
707 struct device *dev = &usb_dev->dev;
708 void *itr, *top;
709
710 /* Walk over BOS capabilities, verify them */
711 itr = (void *)bos + sizeof(*bos);
712 top = itr + desc_size - sizeof(*bos);
713 while (itr < top) {
714 struct usb_dev_cap_header *cap_hdr = itr;
715 size_t cap_size;
716 u8 cap_type;
717 if (top - itr < sizeof(*cap_hdr)) {
718 dev_err(dev, "Device BUG? premature end of BOS header "
719 "data [offset 0x%02x]: only %zu bytes left\n",
720 (int)(itr - (void *)bos), top - itr);
721 result = -ENOSPC;
722 goto error_bad_cap;
723 }
724 cap_size = cap_hdr->bLength;
725 cap_type = cap_hdr->bDevCapabilityType;
726 if (cap_size == 0)
727 break;
728 if (cap_size > top - itr) {
729 dev_err(dev, "Device BUG? premature end of BOS data "
730 "[offset 0x%02x cap %02x %zu bytes]: "
731 "only %zu bytes left\n",
732 (int)(itr - (void *)bos),
733 cap_type, cap_size, top - itr);
734 result = -EBADF;
735 goto error_bad_cap;
736 }
737 switch (cap_type) {
738 case USB_CAP_TYPE_WIRELESS_USB:
739 if (cap_size != sizeof(*wusb_dev->wusb_cap_descr))
740 dev_err(dev, "Device BUG? WUSB Capability "
741 "descriptor is %zu bytes vs %zu "
742 "needed\n", cap_size,
743 sizeof(*wusb_dev->wusb_cap_descr));
744 else
745 wusb_dev->wusb_cap_descr = itr;
746 break;
747 default:
748 dev_err(dev, "BUG? Unknown BOS capability 0x%02x "
749 "(%zu bytes) at offset 0x%02x\n", cap_type,
750 cap_size, (int)(itr - (void *)bos));
751 }
752 itr += cap_size;
753 }
754 result = 0;
755error_bad_cap:
756 return result;
757}
758
759/*
760 * Add information from the BOS descriptors to the device
761 *
762 * @usb_dev: referenced
763 * @wusb_dev: referenced and unlocked
764 *
765 * So what we do is we alloc a space for the BOS descriptor of 64
766 * bytes; read the first four bytes which include the wTotalLength
767 * field (WUSB1.0[T7-26]) and if it fits in those 64 bytes, read the
768 * whole thing. If not we realloc to that size.
769 *
770 * Then we call the groking function, that will fill up
771 * wusb_dev->wusb_cap_descr, which is what we'll need later on.
772 */
773static int wusb_dev_bos_add(struct usb_device *usb_dev,
774 struct wusb_dev *wusb_dev)
775{
776 ssize_t result;
777 struct device *dev = &usb_dev->dev;
778 struct usb_bos_descriptor *bos;
779 size_t alloc_size = 32, desc_size = 4;
780
781 bos = kmalloc(alloc_size, GFP_KERNEL);
782 if (bos == NULL)
783 return -ENOMEM;
784 result = usb_get_descriptor(usb_dev, USB_DT_BOS, 0, bos, desc_size);
785 if (result < 4) {
786 dev_err(dev, "Can't get BOS descriptor or too short: %zd\n",
787 result);
788 goto error_get_descriptor;
789 }
790 desc_size = le16_to_cpu(bos->wTotalLength);
791 if (desc_size >= alloc_size) {
792 kfree(bos);
793 alloc_size = desc_size;
794 bos = kmalloc(alloc_size, GFP_KERNEL);
795 if (bos == NULL)
796 return -ENOMEM;
797 }
798 result = usb_get_descriptor(usb_dev, USB_DT_BOS, 0, bos, desc_size);
799 if (result < 0 || result != desc_size) {
800 dev_err(dev, "Can't get BOS descriptor or too short (need "
801 "%zu bytes): %zd\n", desc_size, result);
802 goto error_get_descriptor;
803 }
804 if (result < sizeof(*bos)
805 || le16_to_cpu(bos->wTotalLength) != desc_size) {
806 dev_err(dev, "Can't get BOS descriptor or too short (need "
807 "%zu bytes): %zd\n", desc_size, result);
808 goto error_get_descriptor;
809 }
810
811 result = wusb_dev_bos_grok(usb_dev, wusb_dev, bos, result);
812 if (result < 0)
813 goto error_bad_bos;
814 wusb_dev->bos = bos;
815 return 0;
816
817error_bad_bos:
818error_get_descriptor:
819 kfree(bos);
820 wusb_dev->wusb_cap_descr = NULL;
821 return result;
822}
823
824static void wusb_dev_bos_rm(struct wusb_dev *wusb_dev)
825{
826 kfree(wusb_dev->bos);
827 wusb_dev->wusb_cap_descr = NULL;
828};
829
830/*
831 * USB stack's device addition Notifier Callback
832 *
833 * Called from drivers/usb/core/hub.c when a new device is added; we
834 * use this hook to perform certain WUSB specific setup work on the
835 * new device. As well, it is the first time we can connect the
836 * wusb_dev and the usb_dev. So we note it down in wusb_dev and take a
837 * reference that we'll drop.
838 *
839 * First we need to determine if the device is a WUSB device (else we
840 * ignore it). For that we use the speed setting (USB_SPEED_WIRELESS)
841 * [FIXME: maybe we'd need something more definitive]. If so, we track
842 * it's usb_busd and from there, the WUSB HC.
843 *
844 * Because all WUSB HCs are contained in a 'struct wusbhc', voila, we
845 * get the wusbhc for the device.
846 *
847 * We have a reference on @usb_dev (as we are called at the end of its
848 * enumeration).
849 *
850 * NOTE: @usb_dev locked
851 */
852static void wusb_dev_add_ncb(struct usb_device *usb_dev)
853{
854 int result = 0;
855 struct wusb_dev *wusb_dev;
856 struct wusbhc *wusbhc;
857 struct device *dev = &usb_dev->dev;
858 u8 port_idx;
859
860 if (usb_dev->wusb == 0 || usb_dev->devnum == 1)
861 return; /* skip non wusb and wusb RHs */
862
863 usb_set_device_state(usb_dev, USB_STATE_UNAUTHENTICATED);
864
865 wusbhc = wusbhc_get_by_usb_dev(usb_dev);
866 if (wusbhc == NULL)
867 goto error_nodev;
868 mutex_lock(&wusbhc->mutex);
869 wusb_dev = __wusb_dev_get_by_usb_dev(wusbhc, usb_dev);
870 port_idx = wusb_port_no_to_idx(usb_dev->portnum);
871 mutex_unlock(&wusbhc->mutex);
872 if (wusb_dev == NULL)
873 goto error_nodev;
874 wusb_dev->usb_dev = usb_get_dev(usb_dev);
875 usb_dev->wusb_dev = wusb_dev_get(wusb_dev);
876 result = wusb_dev_sec_add(wusbhc, usb_dev, wusb_dev);
877 if (result < 0) {
878 dev_err(dev, "Cannot enable security: %d\n", result);
879 goto error_sec_add;
880 }
881 /* Now query the device for it's BOS and attach it to wusb_dev */
882 result = wusb_dev_bos_add(usb_dev, wusb_dev);
883 if (result < 0) {
884 dev_err(dev, "Cannot get BOS descriptors: %d\n", result);
885 goto error_bos_add;
886 }
887 result = wusb_dev_sysfs_add(wusbhc, usb_dev, wusb_dev);
888 if (result < 0)
889 goto error_add_sysfs;
890out:
891 wusb_dev_put(wusb_dev);
892 wusbhc_put(wusbhc);
893error_nodev:
894 return;
895
896 wusb_dev_sysfs_rm(wusb_dev);
897error_add_sysfs:
898 wusb_dev_bos_rm(wusb_dev);
899error_bos_add:
900 wusb_dev_sec_rm(wusb_dev);
901error_sec_add:
902 mutex_lock(&wusbhc->mutex);
903 __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc, port_idx));
904 mutex_unlock(&wusbhc->mutex);
905 goto out;
906}
907
908/*
909 * Undo all the steps done at connection by the notifier callback
910 *
911 * NOTE: @usb_dev locked
912 */
913static void wusb_dev_rm_ncb(struct usb_device *usb_dev)
914{
915 struct wusb_dev *wusb_dev = usb_dev->wusb_dev;
916
917 if (usb_dev->wusb == 0 || usb_dev->devnum == 1)
918 return; /* skip non wusb and wusb RHs */
919
920 wusb_dev_sysfs_rm(wusb_dev);
921 wusb_dev_bos_rm(wusb_dev);
922 wusb_dev_sec_rm(wusb_dev);
923 wusb_dev->usb_dev = NULL;
924 usb_dev->wusb_dev = NULL;
925 wusb_dev_put(wusb_dev);
926 usb_put_dev(usb_dev);
927}
928
929/*
930 * Handle notifications from the USB stack (notifier call back)
931 *
932 * This is called when the USB stack does a
933 * usb_{bus,device}_{add,remove}() so we can do WUSB specific
934 * handling. It is called with [for the case of
935 * USB_DEVICE_{ADD,REMOVE} with the usb_dev locked.
936 */
937int wusb_usb_ncb(struct notifier_block *nb, unsigned long val,
938 void *priv)
939{
940 int result = NOTIFY_OK;
941
942 switch (val) {
943 case USB_DEVICE_ADD:
944 wusb_dev_add_ncb(priv);
945 break;
946 case USB_DEVICE_REMOVE:
947 wusb_dev_rm_ncb(priv);
948 break;
949 case USB_BUS_ADD:
950 /* ignore (for now) */
951 case USB_BUS_REMOVE:
952 break;
953 default:
954 WARN_ON(1);
955 result = NOTIFY_BAD;
956 }
957 return result;
958}
959
960/*
961 * Return a referenced wusb_dev given a @wusbhc and @usb_dev
962 */
963struct wusb_dev *__wusb_dev_get_by_usb_dev(struct wusbhc *wusbhc,
964 struct usb_device *usb_dev)
965{
966 struct wusb_dev *wusb_dev;
967 u8 port_idx;
968
969 port_idx = wusb_port_no_to_idx(usb_dev->portnum);
970 BUG_ON(port_idx > wusbhc->ports_max);
971 wusb_dev = wusb_port_by_idx(wusbhc, port_idx)->wusb_dev;
972 if (wusb_dev != NULL) /* ops, device is gone */
973 wusb_dev_get(wusb_dev);
974 return wusb_dev;
975}
976EXPORT_SYMBOL_GPL(__wusb_dev_get_by_usb_dev);
977
978void wusb_dev_destroy(struct kref *_wusb_dev)
979{
980 struct wusb_dev *wusb_dev = container_of(_wusb_dev, struct wusb_dev, refcnt);
981
982 list_del_init(&wusb_dev->cack_node);
983 wusb_dev_free(wusb_dev);
984}
985EXPORT_SYMBOL_GPL(wusb_dev_destroy);
986
987/*
988 * Create all the device connect handling infrastructure
989 *
990 * This is basically the device info array, Connect Acknowledgement
991 * (cack) lists, keep-alive timers (and delayed work thread).
992 */
993int wusbhc_devconnect_create(struct wusbhc *wusbhc)
994{
995 wusbhc->keep_alive_ie.hdr.bIEIdentifier = WUIE_ID_KEEP_ALIVE;
996 wusbhc->keep_alive_ie.hdr.bLength = sizeof(wusbhc->keep_alive_ie.hdr);
997 INIT_DELAYED_WORK(&wusbhc->keep_alive_timer, wusbhc_keep_alive_run);
998
999 wusbhc->cack_ie.hdr.bIEIdentifier = WUIE_ID_CONNECTACK;
1000 wusbhc->cack_ie.hdr.bLength = sizeof(wusbhc->cack_ie.hdr);
1001 INIT_LIST_HEAD(&wusbhc->cack_list);
1002
1003 return 0;
1004}
1005
1006/*
1007 * Release all resources taken by the devconnect stuff
1008 */
1009void wusbhc_devconnect_destroy(struct wusbhc *wusbhc)
1010{
1011 /* no op */
1012}
1013
1014/*
1015 * wusbhc_devconnect_start - start accepting device connections
1016 * @wusbhc: the WUSB HC
1017 *
1018 * Sets the Host Info IE to accept all new connections.
1019 *
1020 * FIXME: This also enables the keep alives but this is not necessary
1021 * until there are connected and authenticated devices.
1022 */
1023int wusbhc_devconnect_start(struct wusbhc *wusbhc)
1024{
1025 struct device *dev = wusbhc->dev;
1026 struct wuie_host_info *hi;
1027 int result;
1028
1029 hi = kzalloc(sizeof(*hi), GFP_KERNEL);
1030 if (hi == NULL)
1031 return -ENOMEM;
1032
1033 hi->hdr.bLength = sizeof(*hi);
1034 hi->hdr.bIEIdentifier = WUIE_ID_HOST_INFO;
1035 hi->attributes = cpu_to_le16((wusbhc->rsv->stream << 3) | WUIE_HI_CAP_ALL);
1036 hi->CHID = wusbhc->chid;
1037 result = wusbhc_mmcie_set(wusbhc, 0, 0, &hi->hdr);
1038 if (result < 0) {
1039 dev_err(dev, "Cannot add Host Info MMCIE: %d\n", result);
1040 goto error_mmcie_set;
1041 }
1042 wusbhc->wuie_host_info = hi;
1043
1044 queue_delayed_work(wusbd, &wusbhc->keep_alive_timer,
1045 msecs_to_jiffies(wusbhc->trust_timeout / 2));
1046
1047 return 0;
1048
1049error_mmcie_set:
1050 kfree(hi);
1051 return result;
1052}
1053
1054/*
1055 * wusbhc_devconnect_stop - stop managing connected devices
1056 * @wusbhc: the WUSB HC
1057 *
1058 * Disconnects any devices still connected, stops the keep alives and
1059 * removes the Host Info IE.
1060 */
1061void wusbhc_devconnect_stop(struct wusbhc *wusbhc)
1062{
1063 int i;
1064
1065 mutex_lock(&wusbhc->mutex);
1066 for (i = 0; i < wusbhc->ports_max; i++) {
1067 if (wusbhc->port[i].wusb_dev)
1068 __wusbhc_dev_disconnect(wusbhc, &wusbhc->port[i]);
1069 }
1070 mutex_unlock(&wusbhc->mutex);
1071
1072 cancel_delayed_work_sync(&wusbhc->keep_alive_timer);
1073 wusbhc_mmcie_rm(wusbhc, &wusbhc->wuie_host_info->hdr);
1074 kfree(wusbhc->wuie_host_info);
1075 wusbhc->wuie_host_info = NULL;
1076}
1077
1078/*
1079 * wusb_set_dev_addr - set the WUSB device address used by the host
1080 * @wusbhc: the WUSB HC the device is connect to
1081 * @wusb_dev: the WUSB device
1082 * @addr: new device address
1083 */
1084int wusb_set_dev_addr(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev, u8 addr)
1085{
1086 int result;
1087
1088 wusb_dev->addr = addr;
1089 result = wusbhc->dev_info_set(wusbhc, wusb_dev);
1090 if (result < 0)
1091 dev_err(wusbhc->dev, "device %d: failed to set device "
1092 "address\n", wusb_dev->port_idx);
1093 else
1094 dev_info(wusbhc->dev, "device %d: %s addr %u\n",
1095 wusb_dev->port_idx,
1096 (addr & WUSB_DEV_ADDR_UNAUTH) ? "unauth" : "auth",
1097 wusb_dev->addr);
1098
1099 return result;
1100}