1/* 2 * inode.c -- user mode filesystem api for usb gadget controllers 3 * 4 * Copyright (C) 2003-2004 David Brownell 5 * Copyright (C) 2003 Agilent Technologies 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License as published by 9 * the Free Software Foundation; either version 2 of the License, or 10 * (at your option) any later version. 11 */ 12 13 14/* #define VERBOSE_DEBUG */ 15 16#include <linux/init.h> 17#include <linux/module.h> 18#include <linux/fs.h> 19#include <linux/pagemap.h> 20#include <linux/uts.h> 21#include <linux/wait.h> 22#include <linux/compiler.h> 23#include <asm/uaccess.h> 24#include <linux/sched.h> 25#include <linux/slab.h> 26#include <linux/poll.h> 27#include <linux/mmu_context.h> 28#include <linux/aio.h> 29#include <linux/uio.h> 30 31#include <linux/device.h> 32#include <linux/moduleparam.h> 33 34#include <linux/usb/gadgetfs.h> 35#include <linux/usb/gadget.h> 36 37 38/* 39 * The gadgetfs API maps each endpoint to a file descriptor so that you 40 * can use standard synchronous read/write calls for I/O. There's some 41 * O_NONBLOCK and O_ASYNC/FASYNC style i/o support. Example usermode 42 * drivers show how this works in practice. You can also use AIO to 43 * eliminate I/O gaps between requests, to help when streaming data. 44 * 45 * Key parts that must be USB-specific are protocols defining how the 46 * read/write operations relate to the hardware state machines. There 47 * are two types of files. One type is for the device, implementing ep0. 48 * The other type is for each IN or OUT endpoint. In both cases, the 49 * user mode driver must configure the hardware before using it. 50 * 51 * - First, dev_config() is called when /dev/gadget/$CHIP is configured 52 * (by writing configuration and device descriptors). Afterwards it 53 * may serve as a source of device events, used to handle all control 54 * requests other than basic enumeration. 55 * 56 * - Then, after a SET_CONFIGURATION control request, ep_config() is 57 * called when each /dev/gadget/ep* file is configured (by writing 58 * endpoint descriptors). Afterwards these files are used to write() 59 * IN data or to read() OUT data. To halt the endpoint, a "wrong 60 * direction" request is issued (like reading an IN endpoint). 61 * 62 * Unlike "usbfs" the only ioctl()s are for things that are rare, and maybe 63 * not possible on all hardware. For example, precise fault handling with 64 * respect to data left in endpoint fifos after aborted operations; or 65 * selective clearing of endpoint halts, to implement SET_INTERFACE. 66 */ 67 68#define DRIVER_DESC "USB Gadget filesystem" 69#define DRIVER_VERSION "24 Aug 2004" 70 71static const char driver_desc [] = DRIVER_DESC; 72static const char shortname [] = "gadgetfs"; 73 74MODULE_DESCRIPTION (DRIVER_DESC); 75MODULE_AUTHOR ("David Brownell"); 76MODULE_LICENSE ("GPL"); 77 78static int ep_open(struct inode *, struct file *); 79 80 81/*----------------------------------------------------------------------*/ 82 83#define GADGETFS_MAGIC 0xaee71ee7 84 85/* /dev/gadget/$CHIP represents ep0 and the whole device */ 86enum ep0_state { 87 /* DISBLED is the initial state. 88 */ 89 STATE_DEV_DISABLED = 0, 90 91 /* Only one open() of /dev/gadget/$CHIP; only one file tracks 92 * ep0/device i/o modes and binding to the controller. Driver 93 * must always write descriptors to initialize the device, then 94 * the device becomes UNCONNECTED until enumeration. 95 */ 96 STATE_DEV_OPENED, 97 98 /* From then on, ep0 fd is in either of two basic modes: 99 * - (UN)CONNECTED: read usb_gadgetfs_event(s) from it 100 * - SETUP: read/write will transfer control data and succeed; 101 * or if "wrong direction", performs protocol stall 102 */ 103 STATE_DEV_UNCONNECTED, 104 STATE_DEV_CONNECTED, 105 STATE_DEV_SETUP, 106 107 /* UNBOUND means the driver closed ep0, so the device won't be 108 * accessible again (DEV_DISABLED) until all fds are closed. 109 */ 110 STATE_DEV_UNBOUND, 111}; 112 113/* enough for the whole queue: most events invalidate others */ 114#define N_EVENT 5 115 116struct dev_data { 117 spinlock_t lock; 118 atomic_t count; 119 enum ep0_state state; /* P: lock */ 120 struct usb_gadgetfs_event event [N_EVENT]; 121 unsigned ev_next; 122 struct fasync_struct *fasync; 123 u8 current_config; 124 125 /* drivers reading ep0 MUST handle control requests (SETUP) 126 * reported that way; else the host will time out. 127 */ 128 unsigned usermode_setup : 1, 129 setup_in : 1, 130 setup_can_stall : 1, 131 setup_out_ready : 1, 132 setup_out_error : 1, 133 setup_abort : 1; 134 unsigned setup_wLength; 135 136 /* the rest is basically write-once */ 137 struct usb_config_descriptor *config, *hs_config; 138 struct usb_device_descriptor *dev; 139 struct usb_request *req; 140 struct usb_gadget *gadget; 141 struct list_head epfiles; 142 void *buf; 143 wait_queue_head_t wait; 144 struct super_block *sb; 145 struct dentry *dentry; 146 147 /* except this scratch i/o buffer for ep0 */ 148 u8 rbuf [256]; 149}; 150 151static inline void get_dev (struct dev_data *data) 152{ 153 atomic_inc (&data->count); 154} 155 156static void put_dev (struct dev_data *data) 157{ 158 if (likely (!atomic_dec_and_test (&data->count))) 159 return; 160 /* needs no more cleanup */ 161 BUG_ON (waitqueue_active (&data->wait)); 162 kfree (data); 163} 164 165static struct dev_data *dev_new (void) 166{ 167 struct dev_data *dev; 168 169 dev = kzalloc(sizeof(*dev), GFP_KERNEL); 170 if (!dev) 171 return NULL; 172 dev->state = STATE_DEV_DISABLED; 173 atomic_set (&dev->count, 1); 174 spin_lock_init (&dev->lock); 175 INIT_LIST_HEAD (&dev->epfiles); 176 init_waitqueue_head (&dev->wait); 177 return dev; 178} 179 180/*----------------------------------------------------------------------*/ 181 182/* other /dev/gadget/$ENDPOINT files represent endpoints */ 183enum ep_state { 184 STATE_EP_DISABLED = 0, 185 STATE_EP_READY, 186 STATE_EP_ENABLED, 187 STATE_EP_UNBOUND, 188}; 189 190struct ep_data { 191 struct mutex lock; 192 enum ep_state state; 193 atomic_t count; 194 struct dev_data *dev; 195 /* must hold dev->lock before accessing ep or req */ 196 struct usb_ep *ep; 197 struct usb_request *req; 198 ssize_t status; 199 char name [16]; 200 struct usb_endpoint_descriptor desc, hs_desc; 201 struct list_head epfiles; 202 wait_queue_head_t wait; 203 struct dentry *dentry; 204}; 205 206static inline void get_ep (struct ep_data *data) 207{ 208 atomic_inc (&data->count); 209} 210 211static void put_ep (struct ep_data *data) 212{ 213 if (likely (!atomic_dec_and_test (&data->count))) 214 return; 215 put_dev (data->dev); 216 /* needs no more cleanup */ 217 BUG_ON (!list_empty (&data->epfiles)); 218 BUG_ON (waitqueue_active (&data->wait)); 219 kfree (data); 220} 221 222/*----------------------------------------------------------------------*/ 223 224/* most "how to use the hardware" policy choices are in userspace: 225 * mapping endpoint roles (which the driver needs) to the capabilities 226 * which the usb controller has. most of those capabilities are exposed 227 * implicitly, starting with the driver name and then endpoint names. 228 */ 229 230static const char *CHIP; 231 232/*----------------------------------------------------------------------*/ 233 234/* NOTE: don't use dev_printk calls before binding to the gadget 235 * at the end of ep0 configuration, or after unbind. 236 */ 237 238/* too wordy: dev_printk(level , &(d)->gadget->dev , fmt , ## args) */ 239#define xprintk(d,level,fmt,args...) \ 240 printk(level "%s: " fmt , shortname , ## args) 241 242#ifdef DEBUG 243#define DBG(dev,fmt,args...) \ 244 xprintk(dev , KERN_DEBUG , fmt , ## args) 245#else 246#define DBG(dev,fmt,args...) \ 247 do { } while (0) 248#endif /* DEBUG */ 249 250#ifdef VERBOSE_DEBUG 251#define VDEBUG DBG 252#else 253#define VDEBUG(dev,fmt,args...) \ 254 do { } while (0) 255#endif /* DEBUG */ 256 257#define ERROR(dev,fmt,args...) \ 258 xprintk(dev , KERN_ERR , fmt , ## args) 259#define INFO(dev,fmt,args...) \ 260 xprintk(dev , KERN_INFO , fmt , ## args) 261 262 263/*----------------------------------------------------------------------*/ 264 265/* SYNCHRONOUS ENDPOINT OPERATIONS (bulk/intr/iso) 266 * 267 * After opening, configure non-control endpoints. Then use normal 268 * stream read() and write() requests; and maybe ioctl() to get more 269 * precise FIFO status when recovering from cancellation. 270 */ 271 272static void epio_complete (struct usb_ep *ep, struct usb_request *req) 273{ 274 struct ep_data *epdata = ep->driver_data; 275 276 if (!req->context) 277 return; 278 if (req->status) 279 epdata->status = req->status; 280 else 281 epdata->status = req->actual; 282 complete ((struct completion *)req->context); 283} 284 285/* tasklock endpoint, returning when it's connected. 286 * still need dev->lock to use epdata->ep. 287 */ 288static int 289get_ready_ep (unsigned f_flags, struct ep_data *epdata, bool is_write) 290{ 291 int val; 292 293 if (f_flags & O_NONBLOCK) { 294 if (!mutex_trylock(&epdata->lock)) 295 goto nonblock; 296 if (epdata->state != STATE_EP_ENABLED && 297 (!is_write || epdata->state != STATE_EP_READY)) { 298 mutex_unlock(&epdata->lock); 299nonblock: 300 val = -EAGAIN; 301 } else 302 val = 0; 303 return val; 304 } 305 306 val = mutex_lock_interruptible(&epdata->lock); 307 if (val < 0) 308 return val; 309 310 switch (epdata->state) { 311 case STATE_EP_ENABLED: 312 return 0; 313 case STATE_EP_READY: /* not configured yet */ 314 if (is_write) 315 return 0; 316 // FALLTHRU 317 case STATE_EP_UNBOUND: /* clean disconnect */ 318 break; 319 // case STATE_EP_DISABLED: /* "can't happen" */ 320 default: /* error! */ 321 pr_debug ("%s: ep %p not available, state %d\n", 322 shortname, epdata, epdata->state); 323 } 324 mutex_unlock(&epdata->lock); 325 return -ENODEV; 326} 327 328static ssize_t 329ep_io (struct ep_data *epdata, void *buf, unsigned len) 330{ 331 DECLARE_COMPLETION_ONSTACK (done); 332 int value; 333 334 spin_lock_irq (&epdata->dev->lock); 335 if (likely (epdata->ep != NULL)) { 336 struct usb_request *req = epdata->req; 337 338 req->context = &done; 339 req->complete = epio_complete; 340 req->buf = buf; 341 req->length = len; 342 value = usb_ep_queue (epdata->ep, req, GFP_ATOMIC); 343 } else 344 value = -ENODEV; 345 spin_unlock_irq (&epdata->dev->lock); 346 347 if (likely (value == 0)) { 348 value = wait_event_interruptible (done.wait, done.done); 349 if (value != 0) { 350 spin_lock_irq (&epdata->dev->lock); 351 if (likely (epdata->ep != NULL)) { 352 DBG (epdata->dev, "%s i/o interrupted\n", 353 epdata->name); 354 usb_ep_dequeue (epdata->ep, epdata->req); 355 spin_unlock_irq (&epdata->dev->lock); 356 357 wait_event (done.wait, done.done); 358 if (epdata->status == -ECONNRESET) 359 epdata->status = -EINTR; 360 } else { 361 spin_unlock_irq (&epdata->dev->lock); 362 363 DBG (epdata->dev, "endpoint gone\n"); 364 epdata->status = -ENODEV; 365 } 366 } 367 return epdata->status; 368 } 369 return value; 370} 371 372static int 373ep_release (struct inode *inode, struct file *fd) 374{ 375 struct ep_data *data = fd->private_data; 376 int value; 377 378 value = mutex_lock_interruptible(&data->lock); 379 if (value < 0) 380 return value; 381 382 /* clean up if this can be reopened */ 383 if (data->state != STATE_EP_UNBOUND) { 384 data->state = STATE_EP_DISABLED; 385 data->desc.bDescriptorType = 0; 386 data->hs_desc.bDescriptorType = 0; 387 usb_ep_disable(data->ep); 388 } 389 mutex_unlock(&data->lock); 390 put_ep (data); 391 return 0; 392} 393 394static long ep_ioctl(struct file *fd, unsigned code, unsigned long value) 395{ 396 struct ep_data *data = fd->private_data; 397 int status; 398 399 if ((status = get_ready_ep (fd->f_flags, data, false)) < 0) 400 return status; 401 402 spin_lock_irq (&data->dev->lock); 403 if (likely (data->ep != NULL)) { 404 switch (code) { 405 case GADGETFS_FIFO_STATUS: 406 status = usb_ep_fifo_status (data->ep); 407 break; 408 case GADGETFS_FIFO_FLUSH: 409 usb_ep_fifo_flush (data->ep); 410 break; 411 case GADGETFS_CLEAR_HALT: 412 status = usb_ep_clear_halt (data->ep); 413 break; 414 default: 415 status = -ENOTTY; 416 } 417 } else 418 status = -ENODEV; 419 spin_unlock_irq (&data->dev->lock); 420 mutex_unlock(&data->lock); 421 return status; 422} 423 424/*----------------------------------------------------------------------*/ 425 426/* ASYNCHRONOUS ENDPOINT I/O OPERATIONS (bulk/intr/iso) */ 427 428struct kiocb_priv { 429 struct usb_request *req; 430 struct ep_data *epdata; 431 struct kiocb *iocb; 432 struct mm_struct *mm; 433 struct work_struct work; 434 void *buf; 435 struct iov_iter to; 436 const void *to_free; 437 unsigned actual; 438}; 439 440static int ep_aio_cancel(struct kiocb *iocb) 441{ 442 struct kiocb_priv *priv = iocb->private; 443 struct ep_data *epdata; 444 int value; 445 446 local_irq_disable(); 447 epdata = priv->epdata; 448 // spin_lock(&epdata->dev->lock); 449 if (likely(epdata && epdata->ep && priv->req)) 450 value = usb_ep_dequeue (epdata->ep, priv->req); 451 else 452 value = -EINVAL; 453 // spin_unlock(&epdata->dev->lock); 454 local_irq_enable(); 455 456 return value; 457} 458 459static void ep_user_copy_worker(struct work_struct *work) 460{ 461 struct kiocb_priv *priv = container_of(work, struct kiocb_priv, work); 462 struct mm_struct *mm = priv->mm; 463 struct kiocb *iocb = priv->iocb; 464 size_t ret; 465 466 use_mm(mm); 467 ret = copy_to_iter(priv->buf, priv->actual, &priv->to); 468 unuse_mm(mm); 469 if (!ret) 470 ret = -EFAULT; 471 472 /* completing the iocb can drop the ctx and mm, don't touch mm after */ 473 iocb->ki_complete(iocb, ret, ret); 474 475 kfree(priv->buf); 476 kfree(priv->to_free); 477 kfree(priv); 478} 479 480static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req) 481{ 482 struct kiocb *iocb = req->context; 483 struct kiocb_priv *priv = iocb->private; 484 struct ep_data *epdata = priv->epdata; 485 486 /* lock against disconnect (and ideally, cancel) */ 487 spin_lock(&epdata->dev->lock); 488 priv->req = NULL; 489 priv->epdata = NULL; 490 491 /* if this was a write or a read returning no data then we 492 * don't need to copy anything to userspace, so we can 493 * complete the aio request immediately. 494 */ 495 if (priv->to_free == NULL || unlikely(req->actual == 0)) { 496 kfree(req->buf); 497 kfree(priv->to_free); 498 kfree(priv); 499 iocb->private = NULL; 500 /* aio_complete() reports bytes-transferred _and_ faults */ 501 502 iocb->ki_complete(iocb, req->actual ? req->actual : req->status, 503 req->status); 504 } else { 505 /* ep_copy_to_user() won't report both; we hide some faults */ 506 if (unlikely(0 != req->status)) 507 DBG(epdata->dev, "%s fault %d len %d\n", 508 ep->name, req->status, req->actual); 509 510 priv->buf = req->buf; 511 priv->actual = req->actual; 512 INIT_WORK(&priv->work, ep_user_copy_worker); 513 schedule_work(&priv->work); 514 } 515 spin_unlock(&epdata->dev->lock); 516 517 usb_ep_free_request(ep, req); 518 put_ep(epdata); 519} 520 521static ssize_t ep_aio(struct kiocb *iocb, 522 struct kiocb_priv *priv, 523 struct ep_data *epdata, 524 char *buf, 525 size_t len) 526{ 527 struct usb_request *req; 528 ssize_t value; 529 530 iocb->private = priv; 531 priv->iocb = iocb; 532 533 kiocb_set_cancel_fn(iocb, ep_aio_cancel); 534 get_ep(epdata); 535 priv->epdata = epdata; 536 priv->actual = 0; 537 priv->mm = current->mm; /* mm teardown waits for iocbs in exit_aio() */ 538 539 /* each kiocb is coupled to one usb_request, but we can't 540 * allocate or submit those if the host disconnected. 541 */ 542 spin_lock_irq(&epdata->dev->lock); 543 value = -ENODEV; 544 if (unlikely(epdata->ep)) 545 goto fail; 546 547 req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC); 548 value = -ENOMEM; 549 if (unlikely(!req)) 550 goto fail; 551 552 priv->req = req; 553 req->buf = buf; 554 req->length = len; 555 req->complete = ep_aio_complete; 556 req->context = iocb; 557 value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC); 558 if (unlikely(0 != value)) { 559 usb_ep_free_request(epdata->ep, req); 560 goto fail; 561 } 562 spin_unlock_irq(&epdata->dev->lock); 563 return -EIOCBQUEUED; 564 565fail: 566 spin_unlock_irq(&epdata->dev->lock); 567 kfree(priv->to_free); 568 kfree(priv); 569 put_ep(epdata); 570 return value; 571} 572 573static ssize_t 574ep_read_iter(struct kiocb *iocb, struct iov_iter *to) 575{ 576 struct file *file = iocb->ki_filp; 577 struct ep_data *epdata = file->private_data; 578 size_t len = iov_iter_count(to); 579 ssize_t value; 580 char *buf; 581 582 if ((value = get_ready_ep(file->f_flags, epdata, false)) < 0) 583 return value; 584 585 /* halt any endpoint by doing a "wrong direction" i/o call */ 586 if (usb_endpoint_dir_in(&epdata->desc)) { 587 if (usb_endpoint_xfer_isoc(&epdata->desc) || 588 !is_sync_kiocb(iocb)) { 589 mutex_unlock(&epdata->lock); 590 return -EINVAL; 591 } 592 DBG (epdata->dev, "%s halt\n", epdata->name); 593 spin_lock_irq(&epdata->dev->lock); 594 if (likely(epdata->ep != NULL)) 595 usb_ep_set_halt(epdata->ep); 596 spin_unlock_irq(&epdata->dev->lock); 597 mutex_unlock(&epdata->lock); 598 return -EBADMSG; 599 } 600 601 buf = kmalloc(len, GFP_KERNEL); 602 if (unlikely(!buf)) { 603 mutex_unlock(&epdata->lock); 604 return -ENOMEM; 605 } 606 if (is_sync_kiocb(iocb)) { 607 value = ep_io(epdata, buf, len); 608 if (value >= 0 && copy_to_iter(buf, value, to)) 609 value = -EFAULT; 610 } else { 611 struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL); 612 value = -ENOMEM; 613 if (!priv) 614 goto fail; 615 priv->to_free = dup_iter(&priv->to, to, GFP_KERNEL); 616 if (!priv->to_free) { 617 kfree(priv); 618 goto fail; 619 } 620 value = ep_aio(iocb, priv, epdata, buf, len); 621 if (value == -EIOCBQUEUED) 622 buf = NULL; 623 } 624fail: 625 kfree(buf); 626 mutex_unlock(&epdata->lock); 627 return value; 628} 629 630static ssize_t ep_config(struct ep_data *, const char *, size_t); 631 632static ssize_t 633ep_write_iter(struct kiocb *iocb, struct iov_iter *from) 634{ 635 struct file *file = iocb->ki_filp; 636 struct ep_data *epdata = file->private_data; 637 size_t len = iov_iter_count(from); 638 bool configured; 639 ssize_t value; 640 char *buf; 641 642 if ((value = get_ready_ep(file->f_flags, epdata, true)) < 0) 643 return value; 644 645 configured = epdata->state == STATE_EP_ENABLED; 646 647 /* halt any endpoint by doing a "wrong direction" i/o call */ 648 if (configured && !usb_endpoint_dir_in(&epdata->desc)) { 649 if (usb_endpoint_xfer_isoc(&epdata->desc) || 650 !is_sync_kiocb(iocb)) { 651 mutex_unlock(&epdata->lock); 652 return -EINVAL; 653 } 654 DBG (epdata->dev, "%s halt\n", epdata->name); 655 spin_lock_irq(&epdata->dev->lock); 656 if (likely(epdata->ep != NULL)) 657 usb_ep_set_halt(epdata->ep); 658 spin_unlock_irq(&epdata->dev->lock); 659 mutex_unlock(&epdata->lock); 660 return -EBADMSG; 661 } 662 663 buf = kmalloc(len, GFP_KERNEL); 664 if (unlikely(!buf)) { 665 mutex_unlock(&epdata->lock); 666 return -ENOMEM; 667 } 668 669 if (unlikely(copy_from_iter(buf, len, from) != len)) { 670 value = -EFAULT; 671 goto out; 672 } 673 674 if (unlikely(!configured)) { 675 value = ep_config(epdata, buf, len); 676 } else if (is_sync_kiocb(iocb)) { 677 value = ep_io(epdata, buf, len); 678 } else { 679 struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL); 680 value = -ENOMEM; 681 if (priv) { 682 value = ep_aio(iocb, priv, epdata, buf, len); 683 if (value == -EIOCBQUEUED) 684 buf = NULL; 685 } 686 } 687out: 688 kfree(buf); 689 mutex_unlock(&epdata->lock); 690 return value; 691} 692 693/*----------------------------------------------------------------------*/ 694 695/* used after endpoint configuration */ 696static const struct file_operations ep_io_operations = { 697 .owner = THIS_MODULE, 698 699 .open = ep_open, 700 .release = ep_release, 701 .llseek = no_llseek, 702 .unlocked_ioctl = ep_ioctl, 703 .read_iter = ep_read_iter, 704 .write_iter = ep_write_iter, 705}; 706 707/* ENDPOINT INITIALIZATION 708 * 709 * fd = open ("/dev/gadget/$ENDPOINT", O_RDWR) 710 * status = write (fd, descriptors, sizeof descriptors) 711 * 712 * That write establishes the endpoint configuration, configuring 713 * the controller to process bulk, interrupt, or isochronous transfers 714 * at the right maxpacket size, and so on. 715 * 716 * The descriptors are message type 1, identified by a host order u32 717 * at the beginning of what's written. Descriptor order is: full/low 718 * speed descriptor, then optional high speed descriptor. 719 */ 720static ssize_t 721ep_config (struct ep_data *data, const char *buf, size_t len) 722{ 723 struct usb_ep *ep; 724 u32 tag; 725 int value, length = len; 726 727 if (data->state != STATE_EP_READY) { 728 value = -EL2HLT; 729 goto fail; 730 } 731 732 value = len; 733 if (len < USB_DT_ENDPOINT_SIZE + 4) 734 goto fail0; 735 736 /* we might need to change message format someday */ 737 memcpy(&tag, buf, 4); 738 if (tag != 1) { 739 DBG(data->dev, "config %s, bad tag %d\n", data->name, tag); 740 goto fail0; 741 } 742 buf += 4; 743 len -= 4; 744 745 /* NOTE: audio endpoint extensions not accepted here; 746 * just don't include the extra bytes. 747 */ 748 749 /* full/low speed descriptor, then high speed */ 750 memcpy(&data->desc, buf, USB_DT_ENDPOINT_SIZE); 751 if (data->desc.bLength != USB_DT_ENDPOINT_SIZE 752 || data->desc.bDescriptorType != USB_DT_ENDPOINT) 753 goto fail0; 754 if (len != USB_DT_ENDPOINT_SIZE) { 755 if (len != 2 * USB_DT_ENDPOINT_SIZE) 756 goto fail0; 757 memcpy(&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE, 758 USB_DT_ENDPOINT_SIZE); 759 if (data->hs_desc.bLength != USB_DT_ENDPOINT_SIZE 760 || data->hs_desc.bDescriptorType 761 != USB_DT_ENDPOINT) { 762 DBG(data->dev, "config %s, bad hs length or type\n", 763 data->name); 764 goto fail0; 765 } 766 } 767 768 spin_lock_irq (&data->dev->lock); 769 if (data->dev->state == STATE_DEV_UNBOUND) { 770 value = -ENOENT; 771 goto gone; 772 } else if ((ep = data->ep) == NULL) { 773 value = -ENODEV; 774 goto gone; 775 } 776 switch (data->dev->gadget->speed) { 777 case USB_SPEED_LOW: 778 case USB_SPEED_FULL: 779 ep->desc = &data->desc; 780 break; 781 case USB_SPEED_HIGH: 782 /* fails if caller didn't provide that descriptor... */ 783 ep->desc = &data->hs_desc; 784 break; 785 default: 786 DBG(data->dev, "unconnected, %s init abandoned\n", 787 data->name); 788 value = -EINVAL; 789 goto gone; 790 } 791 value = usb_ep_enable(ep); 792 if (value == 0) { 793 data->state = STATE_EP_ENABLED; 794 value = length; 795 } 796gone: 797 spin_unlock_irq (&data->dev->lock); 798 if (value < 0) { 799fail: 800 data->desc.bDescriptorType = 0; 801 data->hs_desc.bDescriptorType = 0; 802 } 803 return value; 804fail0: 805 value = -EINVAL; 806 goto fail; 807} 808 809static int 810ep_open (struct inode *inode, struct file *fd) 811{ 812 struct ep_data *data = inode->i_private; 813 int value = -EBUSY; 814 815 if (mutex_lock_interruptible(&data->lock) != 0) 816 return -EINTR; 817 spin_lock_irq (&data->dev->lock); 818 if (data->dev->state == STATE_DEV_UNBOUND) 819 value = -ENOENT; 820 else if (data->state == STATE_EP_DISABLED) { 821 value = 0; 822 data->state = STATE_EP_READY; 823 get_ep (data); 824 fd->private_data = data; 825 VDEBUG (data->dev, "%s ready\n", data->name); 826 } else 827 DBG (data->dev, "%s state %d\n", 828 data->name, data->state); 829 spin_unlock_irq (&data->dev->lock); 830 mutex_unlock(&data->lock); 831 return value; 832} 833 834/*----------------------------------------------------------------------*/ 835 836/* EP0 IMPLEMENTATION can be partly in userspace. 837 * 838 * Drivers that use this facility receive various events, including 839 * control requests the kernel doesn't handle. Drivers that don't 840 * use this facility may be too simple-minded for real applications. 841 */ 842 843static inline void ep0_readable (struct dev_data *dev) 844{ 845 wake_up (&dev->wait); 846 kill_fasync (&dev->fasync, SIGIO, POLL_IN); 847} 848 849static void clean_req (struct usb_ep *ep, struct usb_request *req) 850{ 851 struct dev_data *dev = ep->driver_data; 852 853 if (req->buf != dev->rbuf) { 854 kfree(req->buf); 855 req->buf = dev->rbuf; 856 } 857 req->complete = epio_complete; 858 dev->setup_out_ready = 0; 859} 860 861static void ep0_complete (struct usb_ep *ep, struct usb_request *req) 862{ 863 struct dev_data *dev = ep->driver_data; 864 unsigned long flags; 865 int free = 1; 866 867 /* for control OUT, data must still get to userspace */ 868 spin_lock_irqsave(&dev->lock, flags); 869 if (!dev->setup_in) { 870 dev->setup_out_error = (req->status != 0); 871 if (!dev->setup_out_error) 872 free = 0; 873 dev->setup_out_ready = 1; 874 ep0_readable (dev); 875 } 876 877 /* clean up as appropriate */ 878 if (free && req->buf != &dev->rbuf) 879 clean_req (ep, req); 880 req->complete = epio_complete; 881 spin_unlock_irqrestore(&dev->lock, flags); 882} 883 884static int setup_req (struct usb_ep *ep, struct usb_request *req, u16 len) 885{ 886 struct dev_data *dev = ep->driver_data; 887 888 if (dev->setup_out_ready) { 889 DBG (dev, "ep0 request busy!\n"); 890 return -EBUSY; 891 } 892 if (len > sizeof (dev->rbuf)) 893 req->buf = kmalloc(len, GFP_ATOMIC); 894 if (req->buf == NULL) { 895 req->buf = dev->rbuf; 896 return -ENOMEM; 897 } 898 req->complete = ep0_complete; 899 req->length = len; 900 req->zero = 0; 901 return 0; 902} 903 904static ssize_t 905ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) 906{ 907 struct dev_data *dev = fd->private_data; 908 ssize_t retval; 909 enum ep0_state state; 910 911 spin_lock_irq (&dev->lock); 912 if (dev->state <= STATE_DEV_OPENED) { 913 retval = -EINVAL; 914 goto done; 915 } 916 917 /* report fd mode change before acting on it */ 918 if (dev->setup_abort) { 919 dev->setup_abort = 0; 920 retval = -EIDRM; 921 goto done; 922 } 923 924 /* control DATA stage */ 925 if ((state = dev->state) == STATE_DEV_SETUP) { 926 927 if (dev->setup_in) { /* stall IN */ 928 VDEBUG(dev, "ep0in stall\n"); 929 (void) usb_ep_set_halt (dev->gadget->ep0); 930 retval = -EL2HLT; 931 dev->state = STATE_DEV_CONNECTED; 932 933 } else if (len == 0) { /* ack SET_CONFIGURATION etc */ 934 struct usb_ep *ep = dev->gadget->ep0; 935 struct usb_request *req = dev->req; 936 937 if ((retval = setup_req (ep, req, 0)) == 0) 938 retval = usb_ep_queue (ep, req, GFP_ATOMIC); 939 dev->state = STATE_DEV_CONNECTED; 940 941 /* assume that was SET_CONFIGURATION */ 942 if (dev->current_config) { 943 unsigned power; 944 945 if (gadget_is_dualspeed(dev->gadget) 946 && (dev->gadget->speed 947 == USB_SPEED_HIGH)) 948 power = dev->hs_config->bMaxPower; 949 else 950 power = dev->config->bMaxPower; 951 usb_gadget_vbus_draw(dev->gadget, 2 * power); 952 } 953 954 } else { /* collect OUT data */ 955 if ((fd->f_flags & O_NONBLOCK) != 0 956 && !dev->setup_out_ready) { 957 retval = -EAGAIN; 958 goto done; 959 } 960 spin_unlock_irq (&dev->lock); 961 retval = wait_event_interruptible (dev->wait, 962 dev->setup_out_ready != 0); 963 964 /* FIXME state could change from under us */ 965 spin_lock_irq (&dev->lock); 966 if (retval) 967 goto done; 968 969 if (dev->state != STATE_DEV_SETUP) { 970 retval = -ECANCELED; 971 goto done; 972 } 973 dev->state = STATE_DEV_CONNECTED; 974 975 if (dev->setup_out_error) 976 retval = -EIO; 977 else { 978 len = min (len, (size_t)dev->req->actual); 979// FIXME don't call this with the spinlock held ... 980 if (copy_to_user (buf, dev->req->buf, len)) 981 retval = -EFAULT; 982 else 983 retval = len; 984 clean_req (dev->gadget->ep0, dev->req); 985 /* NOTE userspace can't yet choose to stall */ 986 } 987 } 988 goto done; 989 } 990 991 /* else normal: return event data */ 992 if (len < sizeof dev->event [0]) { 993 retval = -EINVAL; 994 goto done; 995 } 996 len -= len % sizeof (struct usb_gadgetfs_event); 997 dev->usermode_setup = 1; 998 999scan: 1000 /* return queued events right away */ 1001 if (dev->ev_next != 0) { 1002 unsigned i, n; 1003 1004 n = len / sizeof (struct usb_gadgetfs_event); 1005 if (dev->ev_next < n) 1006 n = dev->ev_next; 1007 1008 /* ep0 i/o has special semantics during STATE_DEV_SETUP */ 1009 for (i = 0; i < n; i++) { 1010 if (dev->event [i].type == GADGETFS_SETUP) { 1011 dev->state = STATE_DEV_SETUP; 1012 n = i + 1; 1013 break; 1014 } 1015 } 1016 spin_unlock_irq (&dev->lock); 1017 len = n * sizeof (struct usb_gadgetfs_event); 1018 if (copy_to_user (buf, &dev->event, len)) 1019 retval = -EFAULT; 1020 else 1021 retval = len; 1022 if (len > 0) { 1023 /* NOTE this doesn't guard against broken drivers; 1024 * concurrent ep0 readers may lose events. 1025 */ 1026 spin_lock_irq (&dev->lock); 1027 if (dev->ev_next > n) { 1028 memmove(&dev->event[0], &dev->event[n], 1029 sizeof (struct usb_gadgetfs_event) 1030 * (dev->ev_next - n)); 1031 } 1032 dev->ev_next -= n; 1033 spin_unlock_irq (&dev->lock); 1034 } 1035 return retval; 1036 } 1037 if (fd->f_flags & O_NONBLOCK) { 1038 retval = -EAGAIN; 1039 goto done; 1040 } 1041 1042 switch (state) { 1043 default: 1044 DBG (dev, "fail %s, state %d\n", __func__, state); 1045 retval = -ESRCH; 1046 break; 1047 case STATE_DEV_UNCONNECTED: 1048 case STATE_DEV_CONNECTED: 1049 spin_unlock_irq (&dev->lock); 1050 DBG (dev, "%s wait\n", __func__); 1051 1052 /* wait for events */ 1053 retval = wait_event_interruptible (dev->wait, 1054 dev->ev_next != 0); 1055 if (retval < 0) 1056 return retval; 1057 spin_lock_irq (&dev->lock); 1058 goto scan; 1059 } 1060 1061done: 1062 spin_unlock_irq (&dev->lock); 1063 return retval; 1064} 1065 1066static struct usb_gadgetfs_event * 1067next_event (struct dev_data *dev, enum usb_gadgetfs_event_type type) 1068{ 1069 struct usb_gadgetfs_event *event; 1070 unsigned i; 1071 1072 switch (type) { 1073 /* these events purge the queue */ 1074 case GADGETFS_DISCONNECT: 1075 if (dev->state == STATE_DEV_SETUP) 1076 dev->setup_abort = 1; 1077 // FALL THROUGH 1078 case GADGETFS_CONNECT: 1079 dev->ev_next = 0; 1080 break; 1081 case GADGETFS_SETUP: /* previous request timed out */ 1082 case GADGETFS_SUSPEND: /* same effect */ 1083 /* these events can't be repeated */ 1084 for (i = 0; i != dev->ev_next; i++) { 1085 if (dev->event [i].type != type) 1086 continue; 1087 DBG(dev, "discard old event[%d] %d\n", i, type); 1088 dev->ev_next--; 1089 if (i == dev->ev_next) 1090 break; 1091 /* indices start at zero, for simplicity */ 1092 memmove (&dev->event [i], &dev->event [i + 1], 1093 sizeof (struct usb_gadgetfs_event) 1094 * (dev->ev_next - i)); 1095 } 1096 break; 1097 default: 1098 BUG (); 1099 } 1100 VDEBUG(dev, "event[%d] = %d\n", dev->ev_next, type); 1101 event = &dev->event [dev->ev_next++]; 1102 BUG_ON (dev->ev_next > N_EVENT); 1103 memset (event, 0, sizeof *event); 1104 event->type = type; 1105 return event; 1106} 1107 1108static ssize_t 1109ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) 1110{ 1111 struct dev_data *dev = fd->private_data; 1112 ssize_t retval = -ESRCH; 1113 1114 /* report fd mode change before acting on it */ 1115 if (dev->setup_abort) { 1116 dev->setup_abort = 0; 1117 retval = -EIDRM; 1118 1119 /* data and/or status stage for control request */ 1120 } else if (dev->state == STATE_DEV_SETUP) { 1121 1122 /* IN DATA+STATUS caller makes len <= wLength */ 1123 if (dev->setup_in) { 1124 retval = setup_req (dev->gadget->ep0, dev->req, len); 1125 if (retval == 0) { 1126 dev->state = STATE_DEV_CONNECTED; 1127 spin_unlock_irq (&dev->lock); 1128 if (copy_from_user (dev->req->buf, buf, len)) 1129 retval = -EFAULT; 1130 else { 1131 if (len < dev->setup_wLength) 1132 dev->req->zero = 1; 1133 retval = usb_ep_queue ( 1134 dev->gadget->ep0, dev->req, 1135 GFP_KERNEL); 1136 } 1137 if (retval < 0) { 1138 spin_lock_irq (&dev->lock); 1139 clean_req (dev->gadget->ep0, dev->req); 1140 spin_unlock_irq (&dev->lock); 1141 } else 1142 retval = len; 1143 1144 return retval; 1145 } 1146 1147 /* can stall some OUT transfers */ 1148 } else if (dev->setup_can_stall) { 1149 VDEBUG(dev, "ep0out stall\n"); 1150 (void) usb_ep_set_halt (dev->gadget->ep0); 1151 retval = -EL2HLT; 1152 dev->state = STATE_DEV_CONNECTED; 1153 } else { 1154 DBG(dev, "bogus ep0out stall!\n"); 1155 } 1156 } else 1157 DBG (dev, "fail %s, state %d\n", __func__, dev->state); 1158 1159 return retval; 1160} 1161 1162static int 1163ep0_fasync (int f, struct file *fd, int on) 1164{ 1165 struct dev_data *dev = fd->private_data; 1166 // caller must F_SETOWN before signal delivery happens 1167 VDEBUG (dev, "%s %s\n", __func__, on ? "on" : "off"); 1168 return fasync_helper (f, fd, on, &dev->fasync); 1169} 1170 1171static struct usb_gadget_driver gadgetfs_driver; 1172 1173static int 1174dev_release (struct inode *inode, struct file *fd) 1175{ 1176 struct dev_data *dev = fd->private_data; 1177 1178 /* closing ep0 === shutdown all */ 1179 1180 usb_gadget_unregister_driver (&gadgetfs_driver); 1181 1182 /* at this point "good" hardware has disconnected the 1183 * device from USB; the host won't see it any more. 1184 * alternatively, all host requests will time out. 1185 */ 1186 1187 kfree (dev->buf); 1188 dev->buf = NULL; 1189 1190 /* other endpoints were all decoupled from this device */ 1191 spin_lock_irq(&dev->lock); 1192 dev->state = STATE_DEV_DISABLED; 1193 spin_unlock_irq(&dev->lock); 1194 1195 put_dev (dev); 1196 return 0; 1197} 1198 1199static unsigned int 1200ep0_poll (struct file *fd, poll_table *wait) 1201{ 1202 struct dev_data *dev = fd->private_data; 1203 int mask = 0; 1204 1205 if (dev->state <= STATE_DEV_OPENED) 1206 return DEFAULT_POLLMASK; 1207 1208 poll_wait(fd, &dev->wait, wait); 1209 1210 spin_lock_irq (&dev->lock); 1211 1212 /* report fd mode change before acting on it */ 1213 if (dev->setup_abort) { 1214 dev->setup_abort = 0; 1215 mask = POLLHUP; 1216 goto out; 1217 } 1218 1219 if (dev->state == STATE_DEV_SETUP) { 1220 if (dev->setup_in || dev->setup_can_stall) 1221 mask = POLLOUT; 1222 } else { 1223 if (dev->ev_next != 0) 1224 mask = POLLIN; 1225 } 1226out: 1227 spin_unlock_irq(&dev->lock); 1228 return mask; 1229} 1230 1231static long dev_ioctl (struct file *fd, unsigned code, unsigned long value) 1232{ 1233 struct dev_data *dev = fd->private_data; 1234 struct usb_gadget *gadget = dev->gadget; 1235 long ret = -ENOTTY; 1236 1237 if (gadget->ops->ioctl) 1238 ret = gadget->ops->ioctl (gadget, code, value); 1239 1240 return ret; 1241} 1242 1243/*----------------------------------------------------------------------*/ 1244 1245/* The in-kernel gadget driver handles most ep0 issues, in particular 1246 * enumerating the single configuration (as provided from user space). 1247 * 1248 * Unrecognized ep0 requests may be handled in user space. 1249 */ 1250 1251static void make_qualifier (struct dev_data *dev) 1252{ 1253 struct usb_qualifier_descriptor qual; 1254 struct usb_device_descriptor *desc; 1255 1256 qual.bLength = sizeof qual; 1257 qual.bDescriptorType = USB_DT_DEVICE_QUALIFIER; 1258 qual.bcdUSB = cpu_to_le16 (0x0200); 1259 1260 desc = dev->dev; 1261 qual.bDeviceClass = desc->bDeviceClass; 1262 qual.bDeviceSubClass = desc->bDeviceSubClass; 1263 qual.bDeviceProtocol = desc->bDeviceProtocol; 1264 1265 /* assumes ep0 uses the same value for both speeds ... */ 1266 qual.bMaxPacketSize0 = dev->gadget->ep0->maxpacket; 1267 1268 qual.bNumConfigurations = 1; 1269 qual.bRESERVED = 0; 1270 1271 memcpy (dev->rbuf, &qual, sizeof qual); 1272} 1273 1274static int 1275config_buf (struct dev_data *dev, u8 type, unsigned index) 1276{ 1277 int len; 1278 int hs = 0; 1279 1280 /* only one configuration */ 1281 if (index > 0) 1282 return -EINVAL; 1283 1284 if (gadget_is_dualspeed(dev->gadget)) { 1285 hs = (dev->gadget->speed == USB_SPEED_HIGH); 1286 if (type == USB_DT_OTHER_SPEED_CONFIG) 1287 hs = !hs; 1288 } 1289 if (hs) { 1290 dev->req->buf = dev->hs_config; 1291 len = le16_to_cpu(dev->hs_config->wTotalLength); 1292 } else { 1293 dev->req->buf = dev->config; 1294 len = le16_to_cpu(dev->config->wTotalLength); 1295 } 1296 ((u8 *)dev->req->buf) [1] = type; 1297 return len; 1298} 1299 1300static int 1301gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) 1302{ 1303 struct dev_data *dev = get_gadget_data (gadget); 1304 struct usb_request *req = dev->req; 1305 int value = -EOPNOTSUPP; 1306 struct usb_gadgetfs_event *event; 1307 u16 w_value = le16_to_cpu(ctrl->wValue); 1308 u16 w_length = le16_to_cpu(ctrl->wLength); 1309 1310 spin_lock (&dev->lock); 1311 dev->setup_abort = 0; 1312 if (dev->state == STATE_DEV_UNCONNECTED) { 1313 if (gadget_is_dualspeed(gadget) 1314 && gadget->speed == USB_SPEED_HIGH 1315 && dev->hs_config == NULL) { 1316 spin_unlock(&dev->lock); 1317 ERROR (dev, "no high speed config??\n"); 1318 return -EINVAL; 1319 } 1320 1321 dev->state = STATE_DEV_CONNECTED; 1322 1323 INFO (dev, "connected\n"); 1324 event = next_event (dev, GADGETFS_CONNECT); 1325 event->u.speed = gadget->speed; 1326 ep0_readable (dev); 1327 1328 /* host may have given up waiting for response. we can miss control 1329 * requests handled lower down (device/endpoint status and features); 1330 * then ep0_{read,write} will report the wrong status. controller 1331 * driver will have aborted pending i/o. 1332 */ 1333 } else if (dev->state == STATE_DEV_SETUP) 1334 dev->setup_abort = 1; 1335 1336 req->buf = dev->rbuf; 1337 req->context = NULL; 1338 value = -EOPNOTSUPP; 1339 switch (ctrl->bRequest) { 1340 1341 case USB_REQ_GET_DESCRIPTOR: 1342 if (ctrl->bRequestType != USB_DIR_IN) 1343 goto unrecognized; 1344 switch (w_value >> 8) { 1345 1346 case USB_DT_DEVICE: 1347 value = min (w_length, (u16) sizeof *dev->dev); 1348 dev->dev->bMaxPacketSize0 = dev->gadget->ep0->maxpacket; 1349 req->buf = dev->dev; 1350 break; 1351 case USB_DT_DEVICE_QUALIFIER: 1352 if (!dev->hs_config) 1353 break; 1354 value = min (w_length, (u16) 1355 sizeof (struct usb_qualifier_descriptor)); 1356 make_qualifier (dev); 1357 break; 1358 case USB_DT_OTHER_SPEED_CONFIG: 1359 // FALLTHROUGH 1360 case USB_DT_CONFIG: 1361 value = config_buf (dev, 1362 w_value >> 8, 1363 w_value & 0xff); 1364 if (value >= 0) 1365 value = min (w_length, (u16) value); 1366 break; 1367 case USB_DT_STRING: 1368 goto unrecognized; 1369 1370 default: // all others are errors 1371 break; 1372 } 1373 break; 1374 1375 /* currently one config, two speeds */ 1376 case USB_REQ_SET_CONFIGURATION: 1377 if (ctrl->bRequestType != 0) 1378 goto unrecognized; 1379 if (0 == (u8) w_value) { 1380 value = 0; 1381 dev->current_config = 0; 1382 usb_gadget_vbus_draw(gadget, 8 /* mA */ ); 1383 // user mode expected to disable endpoints 1384 } else { 1385 u8 config, power; 1386 1387 if (gadget_is_dualspeed(gadget) 1388 && gadget->speed == USB_SPEED_HIGH) { 1389 config = dev->hs_config->bConfigurationValue; 1390 power = dev->hs_config->bMaxPower; 1391 } else { 1392 config = dev->config->bConfigurationValue; 1393 power = dev->config->bMaxPower; 1394 } 1395 1396 if (config == (u8) w_value) { 1397 value = 0; 1398 dev->current_config = config; 1399 usb_gadget_vbus_draw(gadget, 2 * power); 1400 } 1401 } 1402 1403 /* report SET_CONFIGURATION like any other control request, 1404 * except that usermode may not stall this. the next 1405 * request mustn't be allowed start until this finishes: 1406 * endpoints and threads set up, etc. 1407 * 1408 * NOTE: older PXA hardware (before PXA 255: without UDCCFR) 1409 * has bad/racey automagic that prevents synchronizing here. 1410 * even kernel mode drivers often miss them. 1411 */ 1412 if (value == 0) { 1413 INFO (dev, "configuration #%d\n", dev->current_config); 1414 usb_gadget_set_state(gadget, USB_STATE_CONFIGURED); 1415 if (dev->usermode_setup) { 1416 dev->setup_can_stall = 0; 1417 goto delegate; 1418 } 1419 } 1420 break; 1421 1422#ifndef CONFIG_USB_PXA25X 1423 /* PXA automagically handles this request too */ 1424 case USB_REQ_GET_CONFIGURATION: 1425 if (ctrl->bRequestType != 0x80) 1426 goto unrecognized; 1427 *(u8 *)req->buf = dev->current_config; 1428 value = min (w_length, (u16) 1); 1429 break; 1430#endif 1431 1432 default: 1433unrecognized: 1434 VDEBUG (dev, "%s req%02x.%02x v%04x i%04x l%d\n", 1435 dev->usermode_setup ? "delegate" : "fail", 1436 ctrl->bRequestType, ctrl->bRequest, 1437 w_value, le16_to_cpu(ctrl->wIndex), w_length); 1438 1439 /* if there's an ep0 reader, don't stall */ 1440 if (dev->usermode_setup) { 1441 dev->setup_can_stall = 1; 1442delegate: 1443 dev->setup_in = (ctrl->bRequestType & USB_DIR_IN) 1444 ? 1 : 0; 1445 dev->setup_wLength = w_length; 1446 dev->setup_out_ready = 0; 1447 dev->setup_out_error = 0; 1448 value = 0; 1449 1450 /* read DATA stage for OUT right away */ 1451 if (unlikely (!dev->setup_in && w_length)) { 1452 value = setup_req (gadget->ep0, dev->req, 1453 w_length); 1454 if (value < 0) 1455 break; 1456 value = usb_ep_queue (gadget->ep0, dev->req, 1457 GFP_ATOMIC); 1458 if (value < 0) { 1459 clean_req (gadget->ep0, dev->req); 1460 break; 1461 } 1462 1463 /* we can't currently stall these */ 1464 dev->setup_can_stall = 0; 1465 } 1466 1467 /* state changes when reader collects event */ 1468 event = next_event (dev, GADGETFS_SETUP); 1469 event->u.setup = *ctrl; 1470 ep0_readable (dev); 1471 spin_unlock (&dev->lock); 1472 return 0; 1473 } 1474 } 1475 1476 /* proceed with data transfer and status phases? */ 1477 if (value >= 0 && dev->state != STATE_DEV_SETUP) { 1478 req->length = value; 1479 req->zero = value < w_length; 1480 value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC); 1481 if (value < 0) { 1482 DBG (dev, "ep_queue --> %d\n", value); 1483 req->status = 0; 1484 } 1485 } 1486 1487 /* device stalls when value < 0 */ 1488 spin_unlock (&dev->lock); 1489 return value; 1490} 1491 1492static void destroy_ep_files (struct dev_data *dev) 1493{ 1494 DBG (dev, "%s %d\n", __func__, dev->state); 1495 1496 /* dev->state must prevent interference */ 1497 spin_lock_irq (&dev->lock); 1498 while (!list_empty(&dev->epfiles)) { 1499 struct ep_data *ep; 1500 struct inode *parent; 1501 struct dentry *dentry; 1502 1503 /* break link to FS */ 1504 ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles); 1505 list_del_init (&ep->epfiles); 1506 dentry = ep->dentry; 1507 ep->dentry = NULL; 1508 parent = d_inode(dentry->d_parent); 1509 1510 /* break link to controller */ 1511 if (ep->state == STATE_EP_ENABLED) 1512 (void) usb_ep_disable (ep->ep); 1513 ep->state = STATE_EP_UNBOUND; 1514 usb_ep_free_request (ep->ep, ep->req); 1515 ep->ep = NULL; 1516 wake_up (&ep->wait); 1517 put_ep (ep); 1518 1519 spin_unlock_irq (&dev->lock); 1520 1521 /* break link to dcache */ 1522 mutex_lock (&parent->i_mutex); 1523 d_delete (dentry); 1524 dput (dentry); 1525 mutex_unlock (&parent->i_mutex); 1526 1527 spin_lock_irq (&dev->lock); 1528 } 1529 spin_unlock_irq (&dev->lock); 1530} 1531 1532 1533static struct dentry * 1534gadgetfs_create_file (struct super_block *sb, char const *name, 1535 void *data, const struct file_operations *fops); 1536 1537static int activate_ep_files (struct dev_data *dev) 1538{ 1539 struct usb_ep *ep; 1540 struct ep_data *data; 1541 1542 gadget_for_each_ep (ep, dev->gadget) { 1543 1544 data = kzalloc(sizeof(*data), GFP_KERNEL); 1545 if (!data) 1546 goto enomem0; 1547 data->state = STATE_EP_DISABLED; 1548 mutex_init(&data->lock); 1549 init_waitqueue_head (&data->wait); 1550 1551 strncpy (data->name, ep->name, sizeof (data->name) - 1); 1552 atomic_set (&data->count, 1); 1553 data->dev = dev; 1554 get_dev (dev); 1555 1556 data->ep = ep; 1557 ep->driver_data = data; 1558 1559 data->req = usb_ep_alloc_request (ep, GFP_KERNEL); 1560 if (!data->req) 1561 goto enomem1; 1562 1563 data->dentry = gadgetfs_create_file (dev->sb, data->name, 1564 data, &ep_io_operations); 1565 if (!data->dentry) 1566 goto enomem2; 1567 list_add_tail (&data->epfiles, &dev->epfiles); 1568 } 1569 return 0; 1570 1571enomem2: 1572 usb_ep_free_request (ep, data->req); 1573enomem1: 1574 put_dev (dev); 1575 kfree (data); 1576enomem0: 1577 DBG (dev, "%s enomem\n", __func__); 1578 destroy_ep_files (dev); 1579 return -ENOMEM; 1580} 1581 1582static void 1583gadgetfs_unbind (struct usb_gadget *gadget) 1584{ 1585 struct dev_data *dev = get_gadget_data (gadget); 1586 1587 DBG (dev, "%s\n", __func__); 1588 1589 spin_lock_irq (&dev->lock); 1590 dev->state = STATE_DEV_UNBOUND; 1591 spin_unlock_irq (&dev->lock); 1592 1593 destroy_ep_files (dev); 1594 gadget->ep0->driver_data = NULL; 1595 set_gadget_data (gadget, NULL); 1596 1597 /* we've already been disconnected ... no i/o is active */ 1598 if (dev->req) 1599 usb_ep_free_request (gadget->ep0, dev->req); 1600 DBG (dev, "%s done\n", __func__); 1601 put_dev (dev); 1602} 1603 1604static struct dev_data *the_device; 1605 1606static int gadgetfs_bind(struct usb_gadget *gadget, 1607 struct usb_gadget_driver *driver) 1608{ 1609 struct dev_data *dev = the_device; 1610 1611 if (!dev) 1612 return -ESRCH; 1613 if (0 != strcmp (CHIP, gadget->name)) { 1614 pr_err("%s expected %s controller not %s\n", 1615 shortname, CHIP, gadget->name); 1616 return -ENODEV; 1617 } 1618 1619 set_gadget_data (gadget, dev); 1620 dev->gadget = gadget; 1621 gadget->ep0->driver_data = dev; 1622 1623 /* preallocate control response and buffer */ 1624 dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL); 1625 if (!dev->req) 1626 goto enomem; 1627 dev->req->context = NULL; 1628 dev->req->complete = epio_complete; 1629 1630 if (activate_ep_files (dev) < 0) 1631 goto enomem; 1632 1633 INFO (dev, "bound to %s driver\n", gadget->name); 1634 spin_lock_irq(&dev->lock); 1635 dev->state = STATE_DEV_UNCONNECTED; 1636 spin_unlock_irq(&dev->lock); 1637 get_dev (dev); 1638 return 0; 1639 1640enomem: 1641 gadgetfs_unbind (gadget); 1642 return -ENOMEM; 1643} 1644 1645static void 1646gadgetfs_disconnect (struct usb_gadget *gadget) 1647{ 1648 struct dev_data *dev = get_gadget_data (gadget); 1649 unsigned long flags; 1650 1651 spin_lock_irqsave (&dev->lock, flags); 1652 if (dev->state == STATE_DEV_UNCONNECTED) 1653 goto exit; 1654 dev->state = STATE_DEV_UNCONNECTED; 1655 1656 INFO (dev, "disconnected\n"); 1657 next_event (dev, GADGETFS_DISCONNECT); 1658 ep0_readable (dev); 1659exit: 1660 spin_unlock_irqrestore (&dev->lock, flags); 1661} 1662 1663static void 1664gadgetfs_suspend (struct usb_gadget *gadget) 1665{ 1666 struct dev_data *dev = get_gadget_data (gadget); 1667 1668 INFO (dev, "suspended from state %d\n", dev->state); 1669 spin_lock (&dev->lock); 1670 switch (dev->state) { 1671 case STATE_DEV_SETUP: // VERY odd... host died?? 1672 case STATE_DEV_CONNECTED: 1673 case STATE_DEV_UNCONNECTED: 1674 next_event (dev, GADGETFS_SUSPEND); 1675 ep0_readable (dev); 1676 /* FALLTHROUGH */ 1677 default: 1678 break; 1679 } 1680 spin_unlock (&dev->lock); 1681} 1682 1683static struct usb_gadget_driver gadgetfs_driver = { 1684 .function = (char *) driver_desc, 1685 .bind = gadgetfs_bind, 1686 .unbind = gadgetfs_unbind, 1687 .setup = gadgetfs_setup, 1688 .reset = gadgetfs_disconnect, 1689 .disconnect = gadgetfs_disconnect, 1690 .suspend = gadgetfs_suspend, 1691 1692 .driver = { 1693 .name = (char *) shortname, 1694 }, 1695}; 1696 1697/*----------------------------------------------------------------------*/ 1698 1699static void gadgetfs_nop(struct usb_gadget *arg) { } 1700 1701static int gadgetfs_probe(struct usb_gadget *gadget, 1702 struct usb_gadget_driver *driver) 1703{ 1704 CHIP = gadget->name; 1705 return -EISNAM; 1706} 1707 1708static struct usb_gadget_driver probe_driver = { 1709 .max_speed = USB_SPEED_HIGH, 1710 .bind = gadgetfs_probe, 1711 .unbind = gadgetfs_nop, 1712 .setup = (void *)gadgetfs_nop, 1713 .disconnect = gadgetfs_nop, 1714 .driver = { 1715 .name = "nop", 1716 }, 1717}; 1718 1719 1720/* DEVICE INITIALIZATION 1721 * 1722 * fd = open ("/dev/gadget/$CHIP", O_RDWR) 1723 * status = write (fd, descriptors, sizeof descriptors) 1724 * 1725 * That write establishes the device configuration, so the kernel can 1726 * bind to the controller ... guaranteeing it can handle enumeration 1727 * at all necessary speeds. Descriptor order is: 1728 * 1729 * . message tag (u32, host order) ... for now, must be zero; it 1730 * would change to support features like multi-config devices 1731 * . full/low speed config ... all wTotalLength bytes (with interface, 1732 * class, altsetting, endpoint, and other descriptors) 1733 * . high speed config ... all descriptors, for high speed operation; 1734 * this one's optional except for high-speed hardware 1735 * . device descriptor 1736 * 1737 * Endpoints are not yet enabled. Drivers must wait until device 1738 * configuration and interface altsetting changes create 1739 * the need to configure (or unconfigure) them. 1740 * 1741 * After initialization, the device stays active for as long as that 1742 * $CHIP file is open. Events must then be read from that descriptor, 1743 * such as configuration notifications. 1744 */ 1745 1746static int is_valid_config (struct usb_config_descriptor *config) 1747{ 1748 return config->bDescriptorType == USB_DT_CONFIG 1749 && config->bLength == USB_DT_CONFIG_SIZE 1750 && config->bConfigurationValue != 0 1751 && (config->bmAttributes & USB_CONFIG_ATT_ONE) != 0 1752 && (config->bmAttributes & USB_CONFIG_ATT_WAKEUP) == 0; 1753 /* FIXME if gadget->is_otg, _must_ include an otg descriptor */ 1754 /* FIXME check lengths: walk to end */ 1755} 1756 1757static ssize_t 1758dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) 1759{ 1760 struct dev_data *dev = fd->private_data; 1761 ssize_t value = len, length = len; 1762 unsigned total; 1763 u32 tag; 1764 char *kbuf; 1765 1766 spin_lock_irq(&dev->lock); 1767 if (dev->state > STATE_DEV_OPENED) { 1768 value = ep0_write(fd, buf, len, ptr); 1769 spin_unlock_irq(&dev->lock); 1770 return value; 1771 } 1772 spin_unlock_irq(&dev->lock); 1773 1774 if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4)) 1775 return -EINVAL; 1776 1777 /* we might need to change message format someday */ 1778 if (copy_from_user (&tag, buf, 4)) 1779 return -EFAULT; 1780 if (tag != 0) 1781 return -EINVAL; 1782 buf += 4; 1783 length -= 4; 1784 1785 kbuf = memdup_user(buf, length); 1786 if (IS_ERR(kbuf)) 1787 return PTR_ERR(kbuf); 1788 1789 spin_lock_irq (&dev->lock); 1790 value = -EINVAL; 1791 if (dev->buf) 1792 goto fail; 1793 dev->buf = kbuf; 1794 1795 /* full or low speed config */ 1796 dev->config = (void *) kbuf; 1797 total = le16_to_cpu(dev->config->wTotalLength); 1798 if (!is_valid_config (dev->config) || total >= length) 1799 goto fail; 1800 kbuf += total; 1801 length -= total; 1802 1803 /* optional high speed config */ 1804 if (kbuf [1] == USB_DT_CONFIG) { 1805 dev->hs_config = (void *) kbuf; 1806 total = le16_to_cpu(dev->hs_config->wTotalLength); 1807 if (!is_valid_config (dev->hs_config) || total >= length) 1808 goto fail; 1809 kbuf += total; 1810 length -= total; 1811 } 1812 1813 /* could support multiple configs, using another encoding! */ 1814 1815 /* device descriptor (tweaked for paranoia) */ 1816 if (length != USB_DT_DEVICE_SIZE) 1817 goto fail; 1818 dev->dev = (void *)kbuf; 1819 if (dev->dev->bLength != USB_DT_DEVICE_SIZE 1820 || dev->dev->bDescriptorType != USB_DT_DEVICE 1821 || dev->dev->bNumConfigurations != 1) 1822 goto fail; 1823 dev->dev->bNumConfigurations = 1; 1824 dev->dev->bcdUSB = cpu_to_le16 (0x0200); 1825 1826 /* triggers gadgetfs_bind(); then we can enumerate. */ 1827 spin_unlock_irq (&dev->lock); 1828 if (dev->hs_config) 1829 gadgetfs_driver.max_speed = USB_SPEED_HIGH; 1830 else 1831 gadgetfs_driver.max_speed = USB_SPEED_FULL; 1832 1833 value = usb_gadget_probe_driver(&gadgetfs_driver); 1834 if (value != 0) { 1835 kfree (dev->buf); 1836 dev->buf = NULL; 1837 } else { 1838 /* at this point "good" hardware has for the first time 1839 * let the USB the host see us. alternatively, if users 1840 * unplug/replug that will clear all the error state. 1841 * 1842 * note: everything running before here was guaranteed 1843 * to choke driver model style diagnostics. from here 1844 * on, they can work ... except in cleanup paths that 1845 * kick in after the ep0 descriptor is closed. 1846 */ 1847 value = len; 1848 } 1849 return value; 1850 1851fail: 1852 spin_unlock_irq (&dev->lock); 1853 pr_debug ("%s: %s fail %Zd, %p\n", shortname, __func__, value, dev); 1854 kfree (dev->buf); 1855 dev->buf = NULL; 1856 return value; 1857} 1858 1859static int 1860dev_open (struct inode *inode, struct file *fd) 1861{ 1862 struct dev_data *dev = inode->i_private; 1863 int value = -EBUSY; 1864 1865 spin_lock_irq(&dev->lock); 1866 if (dev->state == STATE_DEV_DISABLED) { 1867 dev->ev_next = 0; 1868 dev->state = STATE_DEV_OPENED; 1869 fd->private_data = dev; 1870 get_dev (dev); 1871 value = 0; 1872 } 1873 spin_unlock_irq(&dev->lock); 1874 return value; 1875} 1876 1877static const struct file_operations ep0_operations = { 1878 .llseek = no_llseek, 1879 1880 .open = dev_open, 1881 .read = ep0_read, 1882 .write = dev_config, 1883 .fasync = ep0_fasync, 1884 .poll = ep0_poll, 1885 .unlocked_ioctl = dev_ioctl, 1886 .release = dev_release, 1887}; 1888 1889/*----------------------------------------------------------------------*/ 1890 1891/* FILESYSTEM AND SUPERBLOCK OPERATIONS 1892 * 1893 * Mounting the filesystem creates a controller file, used first for 1894 * device configuration then later for event monitoring. 1895 */ 1896 1897 1898/* FIXME PAM etc could set this security policy without mount options 1899 * if epfiles inherited ownership and permissons from ep0 ... 1900 */ 1901 1902static unsigned default_uid; 1903static unsigned default_gid; 1904static unsigned default_perm = S_IRUSR | S_IWUSR; 1905 1906module_param (default_uid, uint, 0644); 1907module_param (default_gid, uint, 0644); 1908module_param (default_perm, uint, 0644); 1909 1910 1911static struct inode * 1912gadgetfs_make_inode (struct super_block *sb, 1913 void *data, const struct file_operations *fops, 1914 int mode) 1915{ 1916 struct inode *inode = new_inode (sb); 1917 1918 if (inode) { 1919 inode->i_ino = get_next_ino(); 1920 inode->i_mode = mode; 1921 inode->i_uid = make_kuid(&init_user_ns, default_uid); 1922 inode->i_gid = make_kgid(&init_user_ns, default_gid); 1923 inode->i_atime = inode->i_mtime = inode->i_ctime 1924 = CURRENT_TIME; 1925 inode->i_private = data; 1926 inode->i_fop = fops; 1927 } 1928 return inode; 1929} 1930 1931/* creates in fs root directory, so non-renamable and non-linkable. 1932 * so inode and dentry are paired, until device reconfig. 1933 */ 1934static struct dentry * 1935gadgetfs_create_file (struct super_block *sb, char const *name, 1936 void *data, const struct file_operations *fops) 1937{ 1938 struct dentry *dentry; 1939 struct inode *inode; 1940 1941 dentry = d_alloc_name(sb->s_root, name); 1942 if (!dentry) 1943 return NULL; 1944 1945 inode = gadgetfs_make_inode (sb, data, fops, 1946 S_IFREG | (default_perm & S_IRWXUGO)); 1947 if (!inode) { 1948 dput(dentry); 1949 return NULL; 1950 } 1951 d_add (dentry, inode); 1952 return dentry; 1953} 1954 1955static const struct super_operations gadget_fs_operations = { 1956 .statfs = simple_statfs, 1957 .drop_inode = generic_delete_inode, 1958}; 1959 1960static int 1961gadgetfs_fill_super (struct super_block *sb, void *opts, int silent) 1962{ 1963 struct inode *inode; 1964 struct dev_data *dev; 1965 1966 if (the_device) 1967 return -ESRCH; 1968 1969 /* fake probe to determine $CHIP */ 1970 CHIP = NULL; 1971 usb_gadget_probe_driver(&probe_driver); 1972 if (!CHIP) 1973 return -ENODEV; 1974 1975 /* superblock */ 1976 sb->s_blocksize = PAGE_CACHE_SIZE; 1977 sb->s_blocksize_bits = PAGE_CACHE_SHIFT; 1978 sb->s_magic = GADGETFS_MAGIC; 1979 sb->s_op = &gadget_fs_operations; 1980 sb->s_time_gran = 1; 1981 1982 /* root inode */ 1983 inode = gadgetfs_make_inode (sb, 1984 NULL, &simple_dir_operations, 1985 S_IFDIR | S_IRUGO | S_IXUGO); 1986 if (!inode) 1987 goto Enomem; 1988 inode->i_op = &simple_dir_inode_operations; 1989 if (!(sb->s_root = d_make_root (inode))) 1990 goto Enomem; 1991 1992 /* the ep0 file is named after the controller we expect; 1993 * user mode code can use it for sanity checks, like we do. 1994 */ 1995 dev = dev_new (); 1996 if (!dev) 1997 goto Enomem; 1998 1999 dev->sb = sb; 2000 dev->dentry = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations); 2001 if (!dev->dentry) { 2002 put_dev(dev); 2003 goto Enomem; 2004 } 2005 2006 /* other endpoint files are available after hardware setup, 2007 * from binding to a controller. 2008 */ 2009 the_device = dev; 2010 return 0; 2011 2012Enomem: 2013 return -ENOMEM; 2014} 2015 2016/* "mount -t gadgetfs path /dev/gadget" ends up here */ 2017static struct dentry * 2018gadgetfs_mount (struct file_system_type *t, int flags, 2019 const char *path, void *opts) 2020{ 2021 return mount_single (t, flags, opts, gadgetfs_fill_super); 2022} 2023 2024static void 2025gadgetfs_kill_sb (struct super_block *sb) 2026{ 2027 kill_litter_super (sb); 2028 if (the_device) { 2029 put_dev (the_device); 2030 the_device = NULL; 2031 } 2032} 2033 2034/*----------------------------------------------------------------------*/ 2035 2036static struct file_system_type gadgetfs_type = { 2037 .owner = THIS_MODULE, 2038 .name = shortname, 2039 .mount = gadgetfs_mount, 2040 .kill_sb = gadgetfs_kill_sb, 2041}; 2042MODULE_ALIAS_FS("gadgetfs"); 2043 2044/*----------------------------------------------------------------------*/ 2045 2046static int __init init (void) 2047{ 2048 int status; 2049 2050 status = register_filesystem (&gadgetfs_type); 2051 if (status == 0) 2052 pr_info ("%s: %s, version " DRIVER_VERSION "\n", 2053 shortname, driver_desc); 2054 return status; 2055} 2056module_init (init); 2057 2058static void __exit cleanup (void) 2059{ 2060 pr_debug ("unregister %s\n", shortname); 2061 unregister_filesystem (&gadgetfs_type); 2062} 2063module_exit (cleanup); 2064 2065