vhci_sysfs.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (C) 2003-2008 Takahiro Hirofuchi
  4. * Copyright (C) 2015-2016 Nobuo Iwata
  5. */
  6. #include <linux/kthread.h>
  7. #include <linux/file.h>
  8. #include <linux/net.h>
  9. #include <linux/platform_device.h>
  10. #include <linux/slab.h>
  11. /* Hardening for Spectre-v1 */
  12. #include <linux/nospec.h>
  13. #include "usbip_common.h"
  14. #include "vhci.h"
  15. /* TODO: refine locking ?*/
  16. /*
  17. * output example:
  18. * hub port sta spd dev sockfd local_busid
  19. * hs 0000 004 000 00000000 000003 1-2.3
  20. * ................................................
  21. * ss 0008 004 000 00000000 000004 2-3.4
  22. * ................................................
  23. *
  24. * Output includes socket fd instead of socket pointer address to avoid
  25. * leaking kernel memory address in:
  26. * /sys/devices/platform/vhci_hcd.0/status and in debug output.
  27. * The socket pointer address is not used at the moment and it was made
  28. * visible as a convenient way to find IP address from socket pointer
  29. * address by looking up /proc/net/{tcp,tcp6}. As this opens a security
  30. * hole, the change is made to use sockfd instead.
  31. *
  32. */
  33. static void port_show_vhci(char **out, int hub, int port, struct vhci_device *vdev)
  34. {
  35. if (hub == HUB_SPEED_HIGH)
  36. *out += sprintf(*out, "hs %04u %03u ",
  37. port, vdev->ud.status);
  38. else /* hub == HUB_SPEED_SUPER */
  39. *out += sprintf(*out, "ss %04u %03u ",
  40. port, vdev->ud.status);
  41. if (vdev->ud.status == VDEV_ST_USED) {
  42. *out += sprintf(*out, "%03u %08x ",
  43. vdev->speed, vdev->devid);
  44. *out += sprintf(*out, "%06u %s",
  45. vdev->ud.sockfd,
  46. dev_name(&vdev->udev->dev));
  47. } else {
  48. *out += sprintf(*out, "000 00000000 ");
  49. *out += sprintf(*out, "000000 0-0");
  50. }
  51. *out += sprintf(*out, "\n");
  52. }
  53. /* Sysfs entry to show port status */
  54. static ssize_t status_show_vhci(int pdev_nr, char *out)
  55. {
  56. struct platform_device *pdev = vhcis[pdev_nr].pdev;
  57. struct vhci *vhci;
  58. struct usb_hcd *hcd;
  59. struct vhci_hcd *vhci_hcd;
  60. char *s = out;
  61. int i;
  62. unsigned long flags;
  63. if (!pdev || !out) {
  64. usbip_dbg_vhci_sysfs("show status error\n");
  65. return 0;
  66. }
  67. hcd = platform_get_drvdata(pdev);
  68. vhci_hcd = hcd_to_vhci_hcd(hcd);
  69. vhci = vhci_hcd->vhci;
  70. spin_lock_irqsave(&vhci->lock, flags);
  71. for (i = 0; i < VHCI_HC_PORTS; i++) {
  72. struct vhci_device *vdev = &vhci->vhci_hcd_hs->vdev[i];
  73. spin_lock(&vdev->ud.lock);
  74. port_show_vhci(&out, HUB_SPEED_HIGH,
  75. pdev_nr * VHCI_PORTS + i, vdev);
  76. spin_unlock(&vdev->ud.lock);
  77. }
  78. for (i = 0; i < VHCI_HC_PORTS; i++) {
  79. struct vhci_device *vdev = &vhci->vhci_hcd_ss->vdev[i];
  80. spin_lock(&vdev->ud.lock);
  81. port_show_vhci(&out, HUB_SPEED_SUPER,
  82. pdev_nr * VHCI_PORTS + VHCI_HC_PORTS + i, vdev);
  83. spin_unlock(&vdev->ud.lock);
  84. }
  85. spin_unlock_irqrestore(&vhci->lock, flags);
  86. return out - s;
  87. }
  88. static ssize_t status_show_not_ready(int pdev_nr, char *out)
  89. {
  90. char *s = out;
  91. int i = 0;
  92. for (i = 0; i < VHCI_HC_PORTS; i++) {
  93. out += sprintf(out, "hs %04u %03u ",
  94. (pdev_nr * VHCI_PORTS) + i,
  95. VDEV_ST_NOTASSIGNED);
  96. out += sprintf(out, "000 00000000 0000000000000000 0-0");
  97. out += sprintf(out, "\n");
  98. }
  99. for (i = 0; i < VHCI_HC_PORTS; i++) {
  100. out += sprintf(out, "ss %04u %03u ",
  101. (pdev_nr * VHCI_PORTS) + VHCI_HC_PORTS + i,
  102. VDEV_ST_NOTASSIGNED);
  103. out += sprintf(out, "000 00000000 0000000000000000 0-0");
  104. out += sprintf(out, "\n");
  105. }
  106. return out - s;
  107. }
  108. static int status_name_to_id(const char *name)
  109. {
  110. char *c;
  111. long val;
  112. int ret;
  113. c = strchr(name, '.');
  114. if (c == NULL)
  115. return 0;
  116. ret = kstrtol(c+1, 10, &val);
  117. if (ret < 0)
  118. return ret;
  119. return val;
  120. }
  121. static ssize_t status_show(struct device *dev,
  122. struct device_attribute *attr, char *out)
  123. {
  124. char *s = out;
  125. int pdev_nr;
  126. out += sprintf(out,
  127. "hub port sta spd dev sockfd local_busid\n");
  128. pdev_nr = status_name_to_id(attr->attr.name);
  129. if (pdev_nr < 0)
  130. out += status_show_not_ready(pdev_nr, out);
  131. else
  132. out += status_show_vhci(pdev_nr, out);
  133. return out - s;
  134. }
  135. static ssize_t nports_show(struct device *dev, struct device_attribute *attr,
  136. char *out)
  137. {
  138. char *s = out;
  139. /*
  140. * Half the ports are for SPEED_HIGH and half for SPEED_SUPER,
  141. * thus the * 2.
  142. */
  143. out += sprintf(out, "%d\n", VHCI_PORTS * vhci_num_controllers);
  144. return out - s;
  145. }
  146. static DEVICE_ATTR_RO(nports);
  147. /* Sysfs entry to shutdown a virtual connection */
  148. static int vhci_port_disconnect(struct vhci_hcd *vhci_hcd, __u32 rhport)
  149. {
  150. struct vhci_device *vdev = &vhci_hcd->vdev[rhport];
  151. struct vhci *vhci = vhci_hcd->vhci;
  152. unsigned long flags;
  153. usbip_dbg_vhci_sysfs("enter\n");
  154. mutex_lock(&vdev->ud.sysfs_lock);
  155. /* lock */
  156. spin_lock_irqsave(&vhci->lock, flags);
  157. spin_lock(&vdev->ud.lock);
  158. if (vdev->ud.status == VDEV_ST_NULL) {
  159. pr_err("not connected %d\n", vdev->ud.status);
  160. /* unlock */
  161. spin_unlock(&vdev->ud.lock);
  162. spin_unlock_irqrestore(&vhci->lock, flags);
  163. mutex_unlock(&vdev->ud.sysfs_lock);
  164. return -EINVAL;
  165. }
  166. /* unlock */
  167. spin_unlock(&vdev->ud.lock);
  168. spin_unlock_irqrestore(&vhci->lock, flags);
  169. usbip_event_add(&vdev->ud, VDEV_EVENT_DOWN);
  170. mutex_unlock(&vdev->ud.sysfs_lock);
  171. return 0;
  172. }
  173. static int valid_port(__u32 *pdev_nr, __u32 *rhport)
  174. {
  175. if (*pdev_nr >= vhci_num_controllers) {
  176. pr_err("pdev %u\n", *pdev_nr);
  177. return 0;
  178. }
  179. *pdev_nr = array_index_nospec(*pdev_nr, vhci_num_controllers);
  180. if (*rhport >= VHCI_HC_PORTS) {
  181. pr_err("rhport %u\n", *rhport);
  182. return 0;
  183. }
  184. *rhport = array_index_nospec(*rhport, VHCI_HC_PORTS);
  185. return 1;
  186. }
  187. static ssize_t detach_store(struct device *dev, struct device_attribute *attr,
  188. const char *buf, size_t count)
  189. {
  190. __u32 port = 0, pdev_nr = 0, rhport = 0;
  191. struct usb_hcd *hcd;
  192. struct vhci_hcd *vhci_hcd;
  193. int ret;
  194. if (kstrtoint(buf, 10, &port) < 0)
  195. return -EINVAL;
  196. pdev_nr = port_to_pdev_nr(port);
  197. rhport = port_to_rhport(port);
  198. if (!valid_port(&pdev_nr, &rhport))
  199. return -EINVAL;
  200. hcd = platform_get_drvdata(vhcis[pdev_nr].pdev);
  201. if (hcd == NULL) {
  202. dev_err(dev, "port is not ready %u\n", port);
  203. return -EAGAIN;
  204. }
  205. usbip_dbg_vhci_sysfs("rhport %d\n", rhport);
  206. if ((port / VHCI_HC_PORTS) % 2)
  207. vhci_hcd = hcd_to_vhci_hcd(hcd)->vhci->vhci_hcd_ss;
  208. else
  209. vhci_hcd = hcd_to_vhci_hcd(hcd)->vhci->vhci_hcd_hs;
  210. ret = vhci_port_disconnect(vhci_hcd, rhport);
  211. if (ret < 0)
  212. return -EINVAL;
  213. usbip_dbg_vhci_sysfs("Leave\n");
  214. return count;
  215. }
  216. static DEVICE_ATTR_WO(detach);
  217. static int valid_args(__u32 *pdev_nr, __u32 *rhport,
  218. enum usb_device_speed speed)
  219. {
  220. if (!valid_port(pdev_nr, rhport)) {
  221. return 0;
  222. }
  223. switch (speed) {
  224. case USB_SPEED_LOW:
  225. case USB_SPEED_FULL:
  226. case USB_SPEED_HIGH:
  227. case USB_SPEED_WIRELESS:
  228. case USB_SPEED_SUPER:
  229. break;
  230. default:
  231. pr_err("Failed attach request for unsupported USB speed: %s\n",
  232. usb_speed_string(speed));
  233. return 0;
  234. }
  235. return 1;
  236. }
  237. /* Sysfs entry to establish a virtual connection */
  238. /*
  239. * To start a new USB/IP attachment, a userland program needs to setup a TCP
  240. * connection and then write its socket descriptor with remote device
  241. * information into this sysfs file.
  242. *
  243. * A remote device is virtually attached to the root-hub port of @rhport with
  244. * @speed. @devid is embedded into a request to specify the remote device in a
  245. * server host.
  246. *
  247. * write() returns 0 on success, else negative errno.
  248. */
  249. static ssize_t attach_store(struct device *dev, struct device_attribute *attr,
  250. const char *buf, size_t count)
  251. {
  252. struct socket *socket;
  253. int sockfd = 0;
  254. __u32 port = 0, pdev_nr = 0, rhport = 0, devid = 0, speed = 0;
  255. struct usb_hcd *hcd;
  256. struct vhci_hcd *vhci_hcd;
  257. struct vhci_device *vdev;
  258. struct vhci *vhci;
  259. int err;
  260. unsigned long flags;
  261. struct task_struct *tcp_rx = NULL;
  262. struct task_struct *tcp_tx = NULL;
  263. /*
  264. * @rhport: port number of vhci_hcd
  265. * @sockfd: socket descriptor of an established TCP connection
  266. * @devid: unique device identifier in a remote host
  267. * @speed: usb device speed in a remote host
  268. */
  269. if (sscanf(buf, "%u %u %u %u", &port, &sockfd, &devid, &speed) != 4)
  270. return -EINVAL;
  271. pdev_nr = port_to_pdev_nr(port);
  272. rhport = port_to_rhport(port);
  273. usbip_dbg_vhci_sysfs("port(%u) pdev(%d) rhport(%u)\n",
  274. port, pdev_nr, rhport);
  275. usbip_dbg_vhci_sysfs("sockfd(%u) devid(%u) speed(%u)\n",
  276. sockfd, devid, speed);
  277. /* check received parameters */
  278. if (!valid_args(&pdev_nr, &rhport, speed))
  279. return -EINVAL;
  280. hcd = platform_get_drvdata(vhcis[pdev_nr].pdev);
  281. if (hcd == NULL) {
  282. dev_err(dev, "port %d is not ready\n", port);
  283. return -EAGAIN;
  284. }
  285. vhci_hcd = hcd_to_vhci_hcd(hcd);
  286. vhci = vhci_hcd->vhci;
  287. if (speed == USB_SPEED_SUPER)
  288. vdev = &vhci->vhci_hcd_ss->vdev[rhport];
  289. else
  290. vdev = &vhci->vhci_hcd_hs->vdev[rhport];
  291. mutex_lock(&vdev->ud.sysfs_lock);
  292. /* Extract socket from fd. */
  293. socket = sockfd_lookup(sockfd, &err);
  294. if (!socket) {
  295. dev_err(dev, "failed to lookup sock");
  296. err = -EINVAL;
  297. goto unlock_mutex;
  298. }
  299. if (socket->type != SOCK_STREAM) {
  300. dev_err(dev, "Expecting SOCK_STREAM - found %d",
  301. socket->type);
  302. sockfd_put(socket);
  303. err = -EINVAL;
  304. goto unlock_mutex;
  305. }
  306. /* create threads before locking */
  307. tcp_rx = kthread_create(vhci_rx_loop, &vdev->ud, "vhci_rx");
  308. if (IS_ERR(tcp_rx)) {
  309. sockfd_put(socket);
  310. err = -EINVAL;
  311. goto unlock_mutex;
  312. }
  313. tcp_tx = kthread_create(vhci_tx_loop, &vdev->ud, "vhci_tx");
  314. if (IS_ERR(tcp_tx)) {
  315. kthread_stop(tcp_rx);
  316. sockfd_put(socket);
  317. err = -EINVAL;
  318. goto unlock_mutex;
  319. }
  320. /* get task structs now */
  321. get_task_struct(tcp_rx);
  322. get_task_struct(tcp_tx);
  323. /* now begin lock until setting vdev status set */
  324. spin_lock_irqsave(&vhci->lock, flags);
  325. spin_lock(&vdev->ud.lock);
  326. if (vdev->ud.status != VDEV_ST_NULL) {
  327. /* end of the lock */
  328. spin_unlock(&vdev->ud.lock);
  329. spin_unlock_irqrestore(&vhci->lock, flags);
  330. sockfd_put(socket);
  331. kthread_stop_put(tcp_rx);
  332. kthread_stop_put(tcp_tx);
  333. dev_err(dev, "port %d already used\n", rhport);
  334. /*
  335. * Will be retried from userspace
  336. * if there's another free port.
  337. */
  338. err = -EBUSY;
  339. goto unlock_mutex;
  340. }
  341. dev_info(dev, "pdev(%u) rhport(%u) sockfd(%d)\n",
  342. pdev_nr, rhport, sockfd);
  343. dev_info(dev, "devid(%u) speed(%u) speed_str(%s)\n",
  344. devid, speed, usb_speed_string(speed));
  345. vdev->devid = devid;
  346. vdev->speed = speed;
  347. vdev->ud.sockfd = sockfd;
  348. vdev->ud.tcp_socket = socket;
  349. vdev->ud.tcp_rx = tcp_rx;
  350. vdev->ud.tcp_tx = tcp_tx;
  351. vdev->ud.status = VDEV_ST_NOTASSIGNED;
  352. spin_unlock(&vdev->ud.lock);
  353. spin_unlock_irqrestore(&vhci->lock, flags);
  354. /* end the lock */
  355. wake_up_process(vdev->ud.tcp_rx);
  356. wake_up_process(vdev->ud.tcp_tx);
  357. rh_port_connect(vdev, speed);
  358. dev_info(dev, "Device attached\n");
  359. mutex_unlock(&vdev->ud.sysfs_lock);
  360. return count;
  361. unlock_mutex:
  362. mutex_unlock(&vdev->ud.sysfs_lock);
  363. return err;
  364. }
  365. static DEVICE_ATTR_WO(attach);
  366. #define MAX_STATUS_NAME 16
  367. struct status_attr {
  368. struct device_attribute attr;
  369. char name[MAX_STATUS_NAME+1];
  370. };
  371. static struct status_attr *status_attrs;
  372. static void set_status_attr(int id)
  373. {
  374. struct status_attr *status;
  375. status = status_attrs + id;
  376. if (id == 0)
  377. strcpy(status->name, "status");
  378. else
  379. snprintf(status->name, MAX_STATUS_NAME+1, "status.%d", id);
  380. status->attr.attr.name = status->name;
  381. status->attr.attr.mode = S_IRUGO;
  382. status->attr.show = status_show;
  383. sysfs_attr_init(&status->attr.attr);
  384. }
  385. static int init_status_attrs(void)
  386. {
  387. int id;
  388. status_attrs = kcalloc(vhci_num_controllers, sizeof(struct status_attr),
  389. GFP_KERNEL);
  390. if (status_attrs == NULL)
  391. return -ENOMEM;
  392. for (id = 0; id < vhci_num_controllers; id++)
  393. set_status_attr(id);
  394. return 0;
  395. }
  396. static void finish_status_attrs(void)
  397. {
  398. kfree(status_attrs);
  399. }
  400. struct attribute_group vhci_attr_group = {
  401. .attrs = NULL,
  402. };
  403. int vhci_init_attr_group(void)
  404. {
  405. struct attribute **attrs;
  406. int ret, i;
  407. attrs = kcalloc((vhci_num_controllers + 5), sizeof(struct attribute *),
  408. GFP_KERNEL);
  409. if (attrs == NULL)
  410. return -ENOMEM;
  411. ret = init_status_attrs();
  412. if (ret) {
  413. kfree(attrs);
  414. return ret;
  415. }
  416. *attrs = &dev_attr_nports.attr;
  417. *(attrs + 1) = &dev_attr_detach.attr;
  418. *(attrs + 2) = &dev_attr_attach.attr;
  419. *(attrs + 3) = &dev_attr_usbip_debug.attr;
  420. for (i = 0; i < vhci_num_controllers; i++)
  421. *(attrs + i + 4) = &((status_attrs + i)->attr.attr);
  422. vhci_attr_group.attrs = attrs;
  423. return 0;
  424. }
  425. void vhci_finish_attr_group(void)
  426. {
  427. finish_status_attrs();
  428. kfree(vhci_attr_group.attrs);
  429. }