1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * USB Raw Gadget driver.
4 * See Documentation/usb/raw-gadget.rst for more details.
5 *
6 * Copyright (c) 2020 Google, Inc.
7 * Author: Andrey Konovalov <andreyknvl@gmail.com>
8 */
9
10 #include <linux/compiler.h>
11 #include <linux/ctype.h>
12 #include <linux/debugfs.h>
13 #include <linux/delay.h>
14 #include <linux/idr.h>
15 #include <linux/kref.h>
16 #include <linux/miscdevice.h>
17 #include <linux/module.h>
18 #include <linux/semaphore.h>
19 #include <linux/sched.h>
20 #include <linux/slab.h>
21 #include <linux/uaccess.h>
22 #include <linux/wait.h>
23
24 #include <linux/usb.h>
25 #include <linux/usb/ch9.h>
26 #include <linux/usb/ch11.h>
27 #include <linux/usb/gadget.h>
28
29 #include <uapi/linux/usb/raw_gadget.h>
30
31 #define DRIVER_DESC "USB Raw Gadget"
32 #define DRIVER_NAME "raw-gadget"
33
34 MODULE_DESCRIPTION(DRIVER_DESC);
35 MODULE_AUTHOR("Andrey Konovalov");
36 MODULE_LICENSE("GPL");
37
38 /*----------------------------------------------------------------------*/
39
40 static DEFINE_IDA(driver_id_numbers);
41 #define DRIVER_DRIVER_NAME_LENGTH_MAX 32
42
43 #define RAW_EVENT_QUEUE_SIZE 16
44
45 struct raw_event_queue {
46 /* See the comment in raw_event_queue_fetch() for locking details. */
47 spinlock_t lock;
48 struct semaphore sema;
49 struct usb_raw_event *events[RAW_EVENT_QUEUE_SIZE];
50 int size;
51 };
52
raw_event_queue_init(struct raw_event_queue * queue)53 static void raw_event_queue_init(struct raw_event_queue *queue)
54 {
55 spin_lock_init(&queue->lock);
56 sema_init(&queue->sema, 0);
57 queue->size = 0;
58 }
59
raw_event_queue_add(struct raw_event_queue * queue,enum usb_raw_event_type type,size_t length,const void * data)60 static int raw_event_queue_add(struct raw_event_queue *queue,
61 enum usb_raw_event_type type, size_t length, const void *data)
62 {
63 unsigned long flags;
64 struct usb_raw_event *event;
65
66 spin_lock_irqsave(&queue->lock, flags);
67 if (WARN_ON(queue->size >= RAW_EVENT_QUEUE_SIZE)) {
68 spin_unlock_irqrestore(&queue->lock, flags);
69 return -ENOMEM;
70 }
71 event = kmalloc(sizeof(*event) + length, GFP_ATOMIC);
72 if (!event) {
73 spin_unlock_irqrestore(&queue->lock, flags);
74 return -ENOMEM;
75 }
76 event->type = type;
77 event->length = length;
78 if (event->length)
79 memcpy(&event->data[0], data, length);
80 queue->events[queue->size] = event;
81 queue->size++;
82 up(&queue->sema);
83 spin_unlock_irqrestore(&queue->lock, flags);
84 return 0;
85 }
86
raw_event_queue_fetch(struct raw_event_queue * queue)87 static struct usb_raw_event *raw_event_queue_fetch(
88 struct raw_event_queue *queue)
89 {
90 int ret;
91 unsigned long flags;
92 struct usb_raw_event *event;
93
94 /*
95 * This function can be called concurrently. We first check that
96 * there's at least one event queued by decrementing the semaphore,
97 * and then take the lock to protect queue struct fields.
98 */
99 ret = down_interruptible(&queue->sema);
100 if (ret)
101 return ERR_PTR(ret);
102 spin_lock_irqsave(&queue->lock, flags);
103 /*
104 * queue->size must have the same value as queue->sema counter (before
105 * the down_interruptible() call above), so this check is a fail-safe.
106 */
107 if (WARN_ON(!queue->size)) {
108 spin_unlock_irqrestore(&queue->lock, flags);
109 return ERR_PTR(-ENODEV);
110 }
111 event = queue->events[0];
112 queue->size--;
113 memmove(&queue->events[0], &queue->events[1],
114 queue->size * sizeof(queue->events[0]));
115 spin_unlock_irqrestore(&queue->lock, flags);
116 return event;
117 }
118
raw_event_queue_destroy(struct raw_event_queue * queue)119 static void raw_event_queue_destroy(struct raw_event_queue *queue)
120 {
121 int i;
122
123 for (i = 0; i < queue->size; i++)
124 kfree(queue->events[i]);
125 queue->size = 0;
126 }
127
128 /*----------------------------------------------------------------------*/
129
130 struct raw_dev;
131
132 enum ep_state {
133 STATE_EP_DISABLED,
134 STATE_EP_ENABLED,
135 };
136
137 struct raw_ep {
138 struct raw_dev *dev;
139 enum ep_state state;
140 struct usb_ep *ep;
141 u8 addr;
142 struct usb_request *req;
143 bool urb_queued;
144 bool disabling;
145 ssize_t status;
146 };
147
148 enum dev_state {
149 STATE_DEV_INVALID = 0,
150 STATE_DEV_OPENED,
151 STATE_DEV_INITIALIZED,
152 STATE_DEV_REGISTERING,
153 STATE_DEV_RUNNING,
154 STATE_DEV_CLOSED,
155 STATE_DEV_FAILED
156 };
157
158 struct raw_dev {
159 struct kref count;
160 spinlock_t lock;
161
162 const char *udc_name;
163 struct usb_gadget_driver driver;
164
165 /* Reference to misc device: */
166 struct device *dev;
167
168 /* Make driver names unique */
169 int driver_id_number;
170
171 /* Protected by lock: */
172 enum dev_state state;
173 bool gadget_registered;
174 struct usb_gadget *gadget;
175 struct usb_request *req;
176 bool ep0_in_pending;
177 bool ep0_out_pending;
178 bool ep0_urb_queued;
179 ssize_t ep0_status;
180 struct raw_ep eps[USB_RAW_EPS_NUM_MAX];
181 int eps_num;
182
183 struct completion ep0_done;
184 struct raw_event_queue queue;
185 };
186
dev_new(void)187 static struct raw_dev *dev_new(void)
188 {
189 struct raw_dev *dev;
190
191 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
192 if (!dev)
193 return NULL;
194 /* Matches kref_put() in raw_release(). */
195 kref_init(&dev->count);
196 spin_lock_init(&dev->lock);
197 init_completion(&dev->ep0_done);
198 raw_event_queue_init(&dev->queue);
199 dev->driver_id_number = -1;
200 return dev;
201 }
202
dev_free(struct kref * kref)203 static void dev_free(struct kref *kref)
204 {
205 struct raw_dev *dev = container_of(kref, struct raw_dev, count);
206 int i;
207
208 kfree(dev->udc_name);
209 kfree(dev->driver.udc_name);
210 kfree(dev->driver.driver.name);
211 if (dev->driver_id_number >= 0)
212 ida_free(&driver_id_numbers, dev->driver_id_number);
213 if (dev->req) {
214 if (dev->ep0_urb_queued)
215 usb_ep_dequeue(dev->gadget->ep0, dev->req);
216 usb_ep_free_request(dev->gadget->ep0, dev->req);
217 }
218 raw_event_queue_destroy(&dev->queue);
219 for (i = 0; i < dev->eps_num; i++) {
220 if (dev->eps[i].state == STATE_EP_DISABLED)
221 continue;
222 usb_ep_disable(dev->eps[i].ep);
223 usb_ep_free_request(dev->eps[i].ep, dev->eps[i].req);
224 kfree(dev->eps[i].ep->desc);
225 dev->eps[i].state = STATE_EP_DISABLED;
226 }
227 kfree(dev);
228 }
229
230 /*----------------------------------------------------------------------*/
231
raw_queue_event(struct raw_dev * dev,enum usb_raw_event_type type,size_t length,const void * data)232 static int raw_queue_event(struct raw_dev *dev,
233 enum usb_raw_event_type type, size_t length, const void *data)
234 {
235 int ret = 0;
236 unsigned long flags;
237
238 ret = raw_event_queue_add(&dev->queue, type, length, data);
239 if (ret < 0) {
240 spin_lock_irqsave(&dev->lock, flags);
241 dev->state = STATE_DEV_FAILED;
242 spin_unlock_irqrestore(&dev->lock, flags);
243 }
244 return ret;
245 }
246
gadget_ep0_complete(struct usb_ep * ep,struct usb_request * req)247 static void gadget_ep0_complete(struct usb_ep *ep, struct usb_request *req)
248 {
249 struct raw_dev *dev = req->context;
250 unsigned long flags;
251
252 spin_lock_irqsave(&dev->lock, flags);
253 if (req->status)
254 dev->ep0_status = req->status;
255 else
256 dev->ep0_status = req->actual;
257 if (dev->ep0_in_pending)
258 dev->ep0_in_pending = false;
259 else
260 dev->ep0_out_pending = false;
261 spin_unlock_irqrestore(&dev->lock, flags);
262
263 complete(&dev->ep0_done);
264 }
265
get_ep_addr(const char * name)266 static u8 get_ep_addr(const char *name)
267 {
268 /* If the endpoint has fixed function (named as e.g. "ep12out-bulk"),
269 * parse the endpoint address from its name. We deliberately use
270 * deprecated simple_strtoul() function here, as the number isn't
271 * followed by '\0' nor '\n'.
272 */
273 if (isdigit(name[2]))
274 return simple_strtoul(&name[2], NULL, 10);
275 /* Otherwise the endpoint is configurable (named as e.g. "ep-a"). */
276 return USB_RAW_EP_ADDR_ANY;
277 }
278
gadget_bind(struct usb_gadget * gadget,struct usb_gadget_driver * driver)279 static int gadget_bind(struct usb_gadget *gadget,
280 struct usb_gadget_driver *driver)
281 {
282 int ret = 0, i = 0;
283 struct raw_dev *dev = container_of(driver, struct raw_dev, driver);
284 struct usb_request *req;
285 struct usb_ep *ep;
286 unsigned long flags;
287
288 if (strcmp(gadget->name, dev->udc_name) != 0)
289 return -ENODEV;
290
291 set_gadget_data(gadget, dev);
292 req = usb_ep_alloc_request(gadget->ep0, GFP_KERNEL);
293 if (!req) {
294 dev_err(&gadget->dev, "usb_ep_alloc_request failed\n");
295 set_gadget_data(gadget, NULL);
296 return -ENOMEM;
297 }
298
299 spin_lock_irqsave(&dev->lock, flags);
300 dev->req = req;
301 dev->req->context = dev;
302 dev->req->complete = gadget_ep0_complete;
303 dev->gadget = gadget;
304 gadget_for_each_ep(ep, dev->gadget) {
305 dev->eps[i].ep = ep;
306 dev->eps[i].addr = get_ep_addr(ep->name);
307 dev->eps[i].state = STATE_EP_DISABLED;
308 i++;
309 }
310 dev->eps_num = i;
311 spin_unlock_irqrestore(&dev->lock, flags);
312
313 ret = raw_queue_event(dev, USB_RAW_EVENT_CONNECT, 0, NULL);
314 if (ret < 0) {
315 dev_err(&gadget->dev, "failed to queue event\n");
316 set_gadget_data(gadget, NULL);
317 return ret;
318 }
319
320 /* Matches kref_put() in gadget_unbind(). */
321 kref_get(&dev->count);
322 return ret;
323 }
324
gadget_unbind(struct usb_gadget * gadget)325 static void gadget_unbind(struct usb_gadget *gadget)
326 {
327 struct raw_dev *dev = get_gadget_data(gadget);
328
329 set_gadget_data(gadget, NULL);
330 /* Matches kref_get() in gadget_bind(). */
331 kref_put(&dev->count, dev_free);
332 }
333
gadget_setup(struct usb_gadget * gadget,const struct usb_ctrlrequest * ctrl)334 static int gadget_setup(struct usb_gadget *gadget,
335 const struct usb_ctrlrequest *ctrl)
336 {
337 int ret = 0;
338 struct raw_dev *dev = get_gadget_data(gadget);
339 unsigned long flags;
340
341 spin_lock_irqsave(&dev->lock, flags);
342 if (dev->state != STATE_DEV_RUNNING) {
343 dev_err(&gadget->dev, "ignoring, device is not running\n");
344 ret = -ENODEV;
345 goto out_unlock;
346 }
347 if (dev->ep0_in_pending || dev->ep0_out_pending) {
348 dev_dbg(&gadget->dev, "stalling, request already pending\n");
349 ret = -EBUSY;
350 goto out_unlock;
351 }
352 if ((ctrl->bRequestType & USB_DIR_IN) && ctrl->wLength)
353 dev->ep0_in_pending = true;
354 else
355 dev->ep0_out_pending = true;
356 spin_unlock_irqrestore(&dev->lock, flags);
357
358 ret = raw_queue_event(dev, USB_RAW_EVENT_CONTROL, sizeof(*ctrl), ctrl);
359 if (ret < 0)
360 dev_err(&gadget->dev, "failed to queue event\n");
361 goto out;
362
363 out_unlock:
364 spin_unlock_irqrestore(&dev->lock, flags);
365 out:
366 return ret;
367 }
368
369 /* These are currently unused but present in case UDC driver requires them. */
gadget_disconnect(struct usb_gadget * gadget)370 static void gadget_disconnect(struct usb_gadget *gadget) { }
gadget_suspend(struct usb_gadget * gadget)371 static void gadget_suspend(struct usb_gadget *gadget) { }
gadget_resume(struct usb_gadget * gadget)372 static void gadget_resume(struct usb_gadget *gadget) { }
gadget_reset(struct usb_gadget * gadget)373 static void gadget_reset(struct usb_gadget *gadget) { }
374
375 /*----------------------------------------------------------------------*/
376
377 static struct miscdevice raw_misc_device;
378
raw_open(struct inode * inode,struct file * fd)379 static int raw_open(struct inode *inode, struct file *fd)
380 {
381 struct raw_dev *dev;
382
383 /* Nonblocking I/O is not supported yet. */
384 if (fd->f_flags & O_NONBLOCK)
385 return -EINVAL;
386
387 dev = dev_new();
388 if (!dev)
389 return -ENOMEM;
390 fd->private_data = dev;
391 dev->state = STATE_DEV_OPENED;
392 dev->dev = raw_misc_device.this_device;
393 return 0;
394 }
395
raw_release(struct inode * inode,struct file * fd)396 static int raw_release(struct inode *inode, struct file *fd)
397 {
398 int ret = 0;
399 struct raw_dev *dev = fd->private_data;
400 unsigned long flags;
401 bool unregister = false;
402
403 spin_lock_irqsave(&dev->lock, flags);
404 dev->state = STATE_DEV_CLOSED;
405 if (!dev->gadget) {
406 spin_unlock_irqrestore(&dev->lock, flags);
407 goto out_put;
408 }
409 if (dev->gadget_registered)
410 unregister = true;
411 dev->gadget_registered = false;
412 spin_unlock_irqrestore(&dev->lock, flags);
413
414 if (unregister) {
415 ret = usb_gadget_unregister_driver(&dev->driver);
416 if (ret != 0)
417 dev_err(dev->dev,
418 "usb_gadget_unregister_driver() failed with %d\n",
419 ret);
420 /* Matches kref_get() in raw_ioctl_run(). */
421 kref_put(&dev->count, dev_free);
422 }
423
424 out_put:
425 /* Matches dev_new() in raw_open(). */
426 kref_put(&dev->count, dev_free);
427 return ret;
428 }
429
430 /*----------------------------------------------------------------------*/
431
raw_ioctl_init(struct raw_dev * dev,unsigned long value)432 static int raw_ioctl_init(struct raw_dev *dev, unsigned long value)
433 {
434 int ret = 0;
435 int driver_id_number;
436 struct usb_raw_init arg;
437 char *udc_driver_name;
438 char *udc_device_name;
439 char *driver_driver_name;
440 unsigned long flags;
441
442 if (copy_from_user(&arg, (void __user *)value, sizeof(arg)))
443 return -EFAULT;
444
445 switch (arg.speed) {
446 case USB_SPEED_UNKNOWN:
447 arg.speed = USB_SPEED_HIGH;
448 break;
449 case USB_SPEED_LOW:
450 case USB_SPEED_FULL:
451 case USB_SPEED_HIGH:
452 case USB_SPEED_SUPER:
453 break;
454 default:
455 return -EINVAL;
456 }
457
458 driver_id_number = ida_alloc(&driver_id_numbers, GFP_KERNEL);
459 if (driver_id_number < 0)
460 return driver_id_number;
461
462 driver_driver_name = kmalloc(DRIVER_DRIVER_NAME_LENGTH_MAX, GFP_KERNEL);
463 if (!driver_driver_name) {
464 ret = -ENOMEM;
465 goto out_free_driver_id_number;
466 }
467 snprintf(driver_driver_name, DRIVER_DRIVER_NAME_LENGTH_MAX,
468 DRIVER_NAME ".%d", driver_id_number);
469
470 udc_driver_name = kmalloc(UDC_NAME_LENGTH_MAX, GFP_KERNEL);
471 if (!udc_driver_name) {
472 ret = -ENOMEM;
473 goto out_free_driver_driver_name;
474 }
475 ret = strscpy(udc_driver_name, &arg.driver_name[0],
476 UDC_NAME_LENGTH_MAX);
477 if (ret < 0)
478 goto out_free_udc_driver_name;
479 ret = 0;
480
481 udc_device_name = kmalloc(UDC_NAME_LENGTH_MAX, GFP_KERNEL);
482 if (!udc_device_name) {
483 ret = -ENOMEM;
484 goto out_free_udc_driver_name;
485 }
486 ret = strscpy(udc_device_name, &arg.device_name[0],
487 UDC_NAME_LENGTH_MAX);
488 if (ret < 0)
489 goto out_free_udc_device_name;
490 ret = 0;
491
492 spin_lock_irqsave(&dev->lock, flags);
493 if (dev->state != STATE_DEV_OPENED) {
494 dev_dbg(dev->dev, "fail, device is not opened\n");
495 ret = -EINVAL;
496 goto out_unlock;
497 }
498 dev->udc_name = udc_driver_name;
499
500 dev->driver.function = DRIVER_DESC;
501 dev->driver.max_speed = arg.speed;
502 dev->driver.setup = gadget_setup;
503 dev->driver.disconnect = gadget_disconnect;
504 dev->driver.bind = gadget_bind;
505 dev->driver.unbind = gadget_unbind;
506 dev->driver.suspend = gadget_suspend;
507 dev->driver.resume = gadget_resume;
508 dev->driver.reset = gadget_reset;
509 dev->driver.driver.name = driver_driver_name;
510 dev->driver.udc_name = udc_device_name;
511 dev->driver.match_existing_only = 1;
512 dev->driver_id_number = driver_id_number;
513
514 dev->state = STATE_DEV_INITIALIZED;
515 spin_unlock_irqrestore(&dev->lock, flags);
516 return ret;
517
518 out_unlock:
519 spin_unlock_irqrestore(&dev->lock, flags);
520 out_free_udc_device_name:
521 kfree(udc_device_name);
522 out_free_udc_driver_name:
523 kfree(udc_driver_name);
524 out_free_driver_driver_name:
525 kfree(driver_driver_name);
526 out_free_driver_id_number:
527 ida_free(&driver_id_numbers, driver_id_number);
528 return ret;
529 }
530
raw_ioctl_run(struct raw_dev * dev,unsigned long value)531 static int raw_ioctl_run(struct raw_dev *dev, unsigned long value)
532 {
533 int ret = 0;
534 unsigned long flags;
535
536 if (value)
537 return -EINVAL;
538
539 spin_lock_irqsave(&dev->lock, flags);
540 if (dev->state != STATE_DEV_INITIALIZED) {
541 dev_dbg(dev->dev, "fail, device is not initialized\n");
542 ret = -EINVAL;
543 goto out_unlock;
544 }
545 dev->state = STATE_DEV_REGISTERING;
546 spin_unlock_irqrestore(&dev->lock, flags);
547
548 ret = usb_gadget_register_driver(&dev->driver);
549
550 spin_lock_irqsave(&dev->lock, flags);
551 if (ret) {
552 dev_err(dev->dev,
553 "fail, usb_gadget_register_driver returned %d\n", ret);
554 dev->state = STATE_DEV_FAILED;
555 goto out_unlock;
556 }
557 dev->gadget_registered = true;
558 dev->state = STATE_DEV_RUNNING;
559 /* Matches kref_put() in raw_release(). */
560 kref_get(&dev->count);
561
562 out_unlock:
563 spin_unlock_irqrestore(&dev->lock, flags);
564 return ret;
565 }
566
raw_ioctl_event_fetch(struct raw_dev * dev,unsigned long value)567 static int raw_ioctl_event_fetch(struct raw_dev *dev, unsigned long value)
568 {
569 struct usb_raw_event arg;
570 unsigned long flags;
571 struct usb_raw_event *event;
572 uint32_t length;
573
574 if (copy_from_user(&arg, (void __user *)value, sizeof(arg)))
575 return -EFAULT;
576
577 spin_lock_irqsave(&dev->lock, flags);
578 if (dev->state != STATE_DEV_RUNNING) {
579 dev_dbg(dev->dev, "fail, device is not running\n");
580 spin_unlock_irqrestore(&dev->lock, flags);
581 return -EINVAL;
582 }
583 if (!dev->gadget) {
584 dev_dbg(dev->dev, "fail, gadget is not bound\n");
585 spin_unlock_irqrestore(&dev->lock, flags);
586 return -EBUSY;
587 }
588 spin_unlock_irqrestore(&dev->lock, flags);
589
590 event = raw_event_queue_fetch(&dev->queue);
591 if (PTR_ERR(event) == -EINTR) {
592 dev_dbg(&dev->gadget->dev, "event fetching interrupted\n");
593 return -EINTR;
594 }
595 if (IS_ERR(event)) {
596 dev_err(&dev->gadget->dev, "failed to fetch event\n");
597 spin_lock_irqsave(&dev->lock, flags);
598 dev->state = STATE_DEV_FAILED;
599 spin_unlock_irqrestore(&dev->lock, flags);
600 return -ENODEV;
601 }
602 length = min(arg.length, event->length);
603 if (copy_to_user((void __user *)value, event, sizeof(*event) + length)) {
604 kfree(event);
605 return -EFAULT;
606 }
607
608 kfree(event);
609 return 0;
610 }
611
raw_alloc_io_data(struct usb_raw_ep_io * io,void __user * ptr,bool get_from_user)612 static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr,
613 bool get_from_user)
614 {
615 void *data;
616
617 if (copy_from_user(io, ptr, sizeof(*io)))
618 return ERR_PTR(-EFAULT);
619 if (io->ep >= USB_RAW_EPS_NUM_MAX)
620 return ERR_PTR(-EINVAL);
621 if (!usb_raw_io_flags_valid(io->flags))
622 return ERR_PTR(-EINVAL);
623 if (io->length > PAGE_SIZE)
624 return ERR_PTR(-EINVAL);
625 if (get_from_user)
626 data = memdup_user(ptr + sizeof(*io), io->length);
627 else {
628 data = kmalloc(io->length, GFP_KERNEL);
629 if (!data)
630 data = ERR_PTR(-ENOMEM);
631 }
632 return data;
633 }
634
raw_process_ep0_io(struct raw_dev * dev,struct usb_raw_ep_io * io,void * data,bool in)635 static int raw_process_ep0_io(struct raw_dev *dev, struct usb_raw_ep_io *io,
636 void *data, bool in)
637 {
638 int ret = 0;
639 unsigned long flags;
640
641 spin_lock_irqsave(&dev->lock, flags);
642 if (dev->state != STATE_DEV_RUNNING) {
643 dev_dbg(dev->dev, "fail, device is not running\n");
644 ret = -EINVAL;
645 goto out_unlock;
646 }
647 if (!dev->gadget) {
648 dev_dbg(dev->dev, "fail, gadget is not bound\n");
649 ret = -EBUSY;
650 goto out_unlock;
651 }
652 if (dev->ep0_urb_queued) {
653 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n");
654 ret = -EBUSY;
655 goto out_unlock;
656 }
657 if ((in && !dev->ep0_in_pending) ||
658 (!in && !dev->ep0_out_pending)) {
659 dev_dbg(&dev->gadget->dev, "fail, wrong direction\n");
660 ret = -EBUSY;
661 goto out_unlock;
662 }
663 if (WARN_ON(in && dev->ep0_out_pending)) {
664 ret = -ENODEV;
665 dev->state = STATE_DEV_FAILED;
666 goto out_unlock;
667 }
668 if (WARN_ON(!in && dev->ep0_in_pending)) {
669 ret = -ENODEV;
670 dev->state = STATE_DEV_FAILED;
671 goto out_unlock;
672 }
673
674 dev->req->buf = data;
675 dev->req->length = io->length;
676 dev->req->zero = usb_raw_io_flags_zero(io->flags);
677 dev->ep0_urb_queued = true;
678 spin_unlock_irqrestore(&dev->lock, flags);
679
680 ret = usb_ep_queue(dev->gadget->ep0, dev->req, GFP_KERNEL);
681 if (ret) {
682 dev_err(&dev->gadget->dev,
683 "fail, usb_ep_queue returned %d\n", ret);
684 spin_lock_irqsave(&dev->lock, flags);
685 dev->state = STATE_DEV_FAILED;
686 goto out_queue_failed;
687 }
688
689 ret = wait_for_completion_interruptible(&dev->ep0_done);
690 if (ret) {
691 dev_dbg(&dev->gadget->dev, "wait interrupted\n");
692 usb_ep_dequeue(dev->gadget->ep0, dev->req);
693 wait_for_completion(&dev->ep0_done);
694 spin_lock_irqsave(&dev->lock, flags);
695 if (dev->ep0_status == -ECONNRESET)
696 dev->ep0_status = -EINTR;
697 goto out_interrupted;
698 }
699
700 spin_lock_irqsave(&dev->lock, flags);
701
702 out_interrupted:
703 ret = dev->ep0_status;
704 out_queue_failed:
705 dev->ep0_urb_queued = false;
706 out_unlock:
707 spin_unlock_irqrestore(&dev->lock, flags);
708 return ret;
709 }
710
raw_ioctl_ep0_write(struct raw_dev * dev,unsigned long value)711 static int raw_ioctl_ep0_write(struct raw_dev *dev, unsigned long value)
712 {
713 int ret = 0;
714 void *data;
715 struct usb_raw_ep_io io;
716
717 data = raw_alloc_io_data(&io, (void __user *)value, true);
718 if (IS_ERR(data))
719 return PTR_ERR(data);
720 ret = raw_process_ep0_io(dev, &io, data, true);
721 kfree(data);
722 return ret;
723 }
724
raw_ioctl_ep0_read(struct raw_dev * dev,unsigned long value)725 static int raw_ioctl_ep0_read(struct raw_dev *dev, unsigned long value)
726 {
727 int ret = 0;
728 void *data;
729 struct usb_raw_ep_io io;
730 unsigned int length;
731
732 data = raw_alloc_io_data(&io, (void __user *)value, false);
733 if (IS_ERR(data))
734 return PTR_ERR(data);
735 ret = raw_process_ep0_io(dev, &io, data, false);
736 if (ret < 0)
737 goto free;
738
739 length = min(io.length, (unsigned int)ret);
740 if (copy_to_user((void __user *)(value + sizeof(io)), data, length))
741 ret = -EFAULT;
742 else
743 ret = length;
744 free:
745 kfree(data);
746 return ret;
747 }
748
raw_ioctl_ep0_stall(struct raw_dev * dev,unsigned long value)749 static int raw_ioctl_ep0_stall(struct raw_dev *dev, unsigned long value)
750 {
751 int ret = 0;
752 unsigned long flags;
753
754 if (value)
755 return -EINVAL;
756 spin_lock_irqsave(&dev->lock, flags);
757 if (dev->state != STATE_DEV_RUNNING) {
758 dev_dbg(dev->dev, "fail, device is not running\n");
759 ret = -EINVAL;
760 goto out_unlock;
761 }
762 if (!dev->gadget) {
763 dev_dbg(dev->dev, "fail, gadget is not bound\n");
764 ret = -EBUSY;
765 goto out_unlock;
766 }
767 if (dev->ep0_urb_queued) {
768 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n");
769 ret = -EBUSY;
770 goto out_unlock;
771 }
772 if (!dev->ep0_in_pending && !dev->ep0_out_pending) {
773 dev_dbg(&dev->gadget->dev, "fail, no request pending\n");
774 ret = -EBUSY;
775 goto out_unlock;
776 }
777
778 ret = usb_ep_set_halt(dev->gadget->ep0);
779 if (ret < 0)
780 dev_err(&dev->gadget->dev,
781 "fail, usb_ep_set_halt returned %d\n", ret);
782
783 if (dev->ep0_in_pending)
784 dev->ep0_in_pending = false;
785 else
786 dev->ep0_out_pending = false;
787
788 out_unlock:
789 spin_unlock_irqrestore(&dev->lock, flags);
790 return ret;
791 }
792
raw_ioctl_ep_enable(struct raw_dev * dev,unsigned long value)793 static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
794 {
795 int ret = 0, i;
796 unsigned long flags;
797 struct usb_endpoint_descriptor *desc;
798 struct raw_ep *ep;
799 bool ep_props_matched = false;
800
801 desc = memdup_user((void __user *)value, sizeof(*desc));
802 if (IS_ERR(desc))
803 return PTR_ERR(desc);
804
805 /*
806 * Endpoints with a maxpacket length of 0 can cause crashes in UDC
807 * drivers.
808 */
809 if (usb_endpoint_maxp(desc) == 0) {
810 dev_dbg(dev->dev, "fail, bad endpoint maxpacket\n");
811 kfree(desc);
812 return -EINVAL;
813 }
814
815 spin_lock_irqsave(&dev->lock, flags);
816 if (dev->state != STATE_DEV_RUNNING) {
817 dev_dbg(dev->dev, "fail, device is not running\n");
818 ret = -EINVAL;
819 goto out_free;
820 }
821 if (!dev->gadget) {
822 dev_dbg(dev->dev, "fail, gadget is not bound\n");
823 ret = -EBUSY;
824 goto out_free;
825 }
826
827 for (i = 0; i < dev->eps_num; i++) {
828 ep = &dev->eps[i];
829 if (ep->addr != usb_endpoint_num(desc) &&
830 ep->addr != USB_RAW_EP_ADDR_ANY)
831 continue;
832 if (!usb_gadget_ep_match_desc(dev->gadget, ep->ep, desc, NULL))
833 continue;
834 ep_props_matched = true;
835 if (ep->state != STATE_EP_DISABLED)
836 continue;
837 ep->ep->desc = desc;
838 ret = usb_ep_enable(ep->ep);
839 if (ret < 0) {
840 dev_err(&dev->gadget->dev,
841 "fail, usb_ep_enable returned %d\n", ret);
842 goto out_free;
843 }
844 ep->req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC);
845 if (!ep->req) {
846 dev_err(&dev->gadget->dev,
847 "fail, usb_ep_alloc_request failed\n");
848 usb_ep_disable(ep->ep);
849 ret = -ENOMEM;
850 goto out_free;
851 }
852 ep->state = STATE_EP_ENABLED;
853 ep->ep->driver_data = ep;
854 ret = i;
855 goto out_unlock;
856 }
857
858 if (!ep_props_matched) {
859 dev_dbg(&dev->gadget->dev, "fail, bad endpoint descriptor\n");
860 ret = -EINVAL;
861 } else {
862 dev_dbg(&dev->gadget->dev, "fail, no endpoints available\n");
863 ret = -EBUSY;
864 }
865
866 out_free:
867 kfree(desc);
868 out_unlock:
869 spin_unlock_irqrestore(&dev->lock, flags);
870 return ret;
871 }
872
raw_ioctl_ep_disable(struct raw_dev * dev,unsigned long value)873 static int raw_ioctl_ep_disable(struct raw_dev *dev, unsigned long value)
874 {
875 int ret = 0, i = value;
876 unsigned long flags;
877
878 spin_lock_irqsave(&dev->lock, flags);
879 if (dev->state != STATE_DEV_RUNNING) {
880 dev_dbg(dev->dev, "fail, device is not running\n");
881 ret = -EINVAL;
882 goto out_unlock;
883 }
884 if (!dev->gadget) {
885 dev_dbg(dev->dev, "fail, gadget is not bound\n");
886 ret = -EBUSY;
887 goto out_unlock;
888 }
889 if (i < 0 || i >= dev->eps_num) {
890 dev_dbg(dev->dev, "fail, invalid endpoint\n");
891 ret = -EBUSY;
892 goto out_unlock;
893 }
894 if (dev->eps[i].state == STATE_EP_DISABLED) {
895 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n");
896 ret = -EINVAL;
897 goto out_unlock;
898 }
899 if (dev->eps[i].disabling) {
900 dev_dbg(&dev->gadget->dev,
901 "fail, disable already in progress\n");
902 ret = -EINVAL;
903 goto out_unlock;
904 }
905 if (dev->eps[i].urb_queued) {
906 dev_dbg(&dev->gadget->dev,
907 "fail, waiting for urb completion\n");
908 ret = -EINVAL;
909 goto out_unlock;
910 }
911 dev->eps[i].disabling = true;
912 spin_unlock_irqrestore(&dev->lock, flags);
913
914 usb_ep_disable(dev->eps[i].ep);
915
916 spin_lock_irqsave(&dev->lock, flags);
917 usb_ep_free_request(dev->eps[i].ep, dev->eps[i].req);
918 kfree(dev->eps[i].ep->desc);
919 dev->eps[i].state = STATE_EP_DISABLED;
920 dev->eps[i].disabling = false;
921
922 out_unlock:
923 spin_unlock_irqrestore(&dev->lock, flags);
924 return ret;
925 }
926
raw_ioctl_ep_set_clear_halt_wedge(struct raw_dev * dev,unsigned long value,bool set,bool halt)927 static int raw_ioctl_ep_set_clear_halt_wedge(struct raw_dev *dev,
928 unsigned long value, bool set, bool halt)
929 {
930 int ret = 0, i = value;
931 unsigned long flags;
932
933 spin_lock_irqsave(&dev->lock, flags);
934 if (dev->state != STATE_DEV_RUNNING) {
935 dev_dbg(dev->dev, "fail, device is not running\n");
936 ret = -EINVAL;
937 goto out_unlock;
938 }
939 if (!dev->gadget) {
940 dev_dbg(dev->dev, "fail, gadget is not bound\n");
941 ret = -EBUSY;
942 goto out_unlock;
943 }
944 if (i < 0 || i >= dev->eps_num) {
945 dev_dbg(dev->dev, "fail, invalid endpoint\n");
946 ret = -EBUSY;
947 goto out_unlock;
948 }
949 if (dev->eps[i].state == STATE_EP_DISABLED) {
950 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n");
951 ret = -EINVAL;
952 goto out_unlock;
953 }
954 if (dev->eps[i].disabling) {
955 dev_dbg(&dev->gadget->dev,
956 "fail, disable is in progress\n");
957 ret = -EINVAL;
958 goto out_unlock;
959 }
960 if (dev->eps[i].urb_queued) {
961 dev_dbg(&dev->gadget->dev,
962 "fail, waiting for urb completion\n");
963 ret = -EINVAL;
964 goto out_unlock;
965 }
966 if (usb_endpoint_xfer_isoc(dev->eps[i].ep->desc)) {
967 dev_dbg(&dev->gadget->dev,
968 "fail, can't halt/wedge ISO endpoint\n");
969 ret = -EINVAL;
970 goto out_unlock;
971 }
972
973 if (set && halt) {
974 ret = usb_ep_set_halt(dev->eps[i].ep);
975 if (ret < 0)
976 dev_err(&dev->gadget->dev,
977 "fail, usb_ep_set_halt returned %d\n", ret);
978 } else if (!set && halt) {
979 ret = usb_ep_clear_halt(dev->eps[i].ep);
980 if (ret < 0)
981 dev_err(&dev->gadget->dev,
982 "fail, usb_ep_clear_halt returned %d\n", ret);
983 } else if (set && !halt) {
984 ret = usb_ep_set_wedge(dev->eps[i].ep);
985 if (ret < 0)
986 dev_err(&dev->gadget->dev,
987 "fail, usb_ep_set_wedge returned %d\n", ret);
988 }
989
990 out_unlock:
991 spin_unlock_irqrestore(&dev->lock, flags);
992 return ret;
993 }
994
gadget_ep_complete(struct usb_ep * ep,struct usb_request * req)995 static void gadget_ep_complete(struct usb_ep *ep, struct usb_request *req)
996 {
997 struct raw_ep *r_ep = (struct raw_ep *)ep->driver_data;
998 struct raw_dev *dev = r_ep->dev;
999 unsigned long flags;
1000
1001 spin_lock_irqsave(&dev->lock, flags);
1002 if (req->status)
1003 r_ep->status = req->status;
1004 else
1005 r_ep->status = req->actual;
1006 spin_unlock_irqrestore(&dev->lock, flags);
1007
1008 complete((struct completion *)req->context);
1009 }
1010
raw_process_ep_io(struct raw_dev * dev,struct usb_raw_ep_io * io,void * data,bool in)1011 static int raw_process_ep_io(struct raw_dev *dev, struct usb_raw_ep_io *io,
1012 void *data, bool in)
1013 {
1014 int ret = 0;
1015 unsigned long flags;
1016 struct raw_ep *ep;
1017 DECLARE_COMPLETION_ONSTACK(done);
1018
1019 spin_lock_irqsave(&dev->lock, flags);
1020 if (dev->state != STATE_DEV_RUNNING) {
1021 dev_dbg(dev->dev, "fail, device is not running\n");
1022 ret = -EINVAL;
1023 goto out_unlock;
1024 }
1025 if (!dev->gadget) {
1026 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1027 ret = -EBUSY;
1028 goto out_unlock;
1029 }
1030 if (io->ep >= dev->eps_num) {
1031 dev_dbg(&dev->gadget->dev, "fail, invalid endpoint\n");
1032 ret = -EINVAL;
1033 goto out_unlock;
1034 }
1035 ep = &dev->eps[io->ep];
1036 if (ep->state != STATE_EP_ENABLED) {
1037 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n");
1038 ret = -EBUSY;
1039 goto out_unlock;
1040 }
1041 if (ep->disabling) {
1042 dev_dbg(&dev->gadget->dev,
1043 "fail, endpoint is already being disabled\n");
1044 ret = -EBUSY;
1045 goto out_unlock;
1046 }
1047 if (ep->urb_queued) {
1048 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n");
1049 ret = -EBUSY;
1050 goto out_unlock;
1051 }
1052 if (in != usb_endpoint_dir_in(ep->ep->desc)) {
1053 dev_dbg(&dev->gadget->dev, "fail, wrong direction\n");
1054 ret = -EINVAL;
1055 goto out_unlock;
1056 }
1057
1058 ep->dev = dev;
1059 ep->req->context = &done;
1060 ep->req->complete = gadget_ep_complete;
1061 ep->req->buf = data;
1062 ep->req->length = io->length;
1063 ep->req->zero = usb_raw_io_flags_zero(io->flags);
1064 ep->urb_queued = true;
1065 spin_unlock_irqrestore(&dev->lock, flags);
1066
1067 ret = usb_ep_queue(ep->ep, ep->req, GFP_KERNEL);
1068 if (ret) {
1069 dev_err(&dev->gadget->dev,
1070 "fail, usb_ep_queue returned %d\n", ret);
1071 spin_lock_irqsave(&dev->lock, flags);
1072 dev->state = STATE_DEV_FAILED;
1073 goto out_queue_failed;
1074 }
1075
1076 ret = wait_for_completion_interruptible(&done);
1077 if (ret) {
1078 dev_dbg(&dev->gadget->dev, "wait interrupted\n");
1079 usb_ep_dequeue(ep->ep, ep->req);
1080 wait_for_completion(&done);
1081 spin_lock_irqsave(&dev->lock, flags);
1082 if (ep->status == -ECONNRESET)
1083 ep->status = -EINTR;
1084 goto out_interrupted;
1085 }
1086
1087 spin_lock_irqsave(&dev->lock, flags);
1088
1089 out_interrupted:
1090 ret = ep->status;
1091 out_queue_failed:
1092 ep->urb_queued = false;
1093 out_unlock:
1094 spin_unlock_irqrestore(&dev->lock, flags);
1095 return ret;
1096 }
1097
raw_ioctl_ep_write(struct raw_dev * dev,unsigned long value)1098 static int raw_ioctl_ep_write(struct raw_dev *dev, unsigned long value)
1099 {
1100 int ret = 0;
1101 char *data;
1102 struct usb_raw_ep_io io;
1103
1104 data = raw_alloc_io_data(&io, (void __user *)value, true);
1105 if (IS_ERR(data))
1106 return PTR_ERR(data);
1107 ret = raw_process_ep_io(dev, &io, data, true);
1108 kfree(data);
1109 return ret;
1110 }
1111
raw_ioctl_ep_read(struct raw_dev * dev,unsigned long value)1112 static int raw_ioctl_ep_read(struct raw_dev *dev, unsigned long value)
1113 {
1114 int ret = 0;
1115 char *data;
1116 struct usb_raw_ep_io io;
1117 unsigned int length;
1118
1119 data = raw_alloc_io_data(&io, (void __user *)value, false);
1120 if (IS_ERR(data))
1121 return PTR_ERR(data);
1122 ret = raw_process_ep_io(dev, &io, data, false);
1123 if (ret < 0)
1124 goto free;
1125
1126 length = min(io.length, (unsigned int)ret);
1127 if (copy_to_user((void __user *)(value + sizeof(io)), data, length))
1128 ret = -EFAULT;
1129 else
1130 ret = length;
1131 free:
1132 kfree(data);
1133 return ret;
1134 }
1135
raw_ioctl_configure(struct raw_dev * dev,unsigned long value)1136 static int raw_ioctl_configure(struct raw_dev *dev, unsigned long value)
1137 {
1138 int ret = 0;
1139 unsigned long flags;
1140
1141 if (value)
1142 return -EINVAL;
1143 spin_lock_irqsave(&dev->lock, flags);
1144 if (dev->state != STATE_DEV_RUNNING) {
1145 dev_dbg(dev->dev, "fail, device is not running\n");
1146 ret = -EINVAL;
1147 goto out_unlock;
1148 }
1149 if (!dev->gadget) {
1150 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1151 ret = -EBUSY;
1152 goto out_unlock;
1153 }
1154 usb_gadget_set_state(dev->gadget, USB_STATE_CONFIGURED);
1155
1156 out_unlock:
1157 spin_unlock_irqrestore(&dev->lock, flags);
1158 return ret;
1159 }
1160
raw_ioctl_vbus_draw(struct raw_dev * dev,unsigned long value)1161 static int raw_ioctl_vbus_draw(struct raw_dev *dev, unsigned long value)
1162 {
1163 int ret = 0;
1164 unsigned long flags;
1165
1166 spin_lock_irqsave(&dev->lock, flags);
1167 if (dev->state != STATE_DEV_RUNNING) {
1168 dev_dbg(dev->dev, "fail, device is not running\n");
1169 ret = -EINVAL;
1170 goto out_unlock;
1171 }
1172 if (!dev->gadget) {
1173 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1174 ret = -EBUSY;
1175 goto out_unlock;
1176 }
1177 usb_gadget_vbus_draw(dev->gadget, 2 * value);
1178
1179 out_unlock:
1180 spin_unlock_irqrestore(&dev->lock, flags);
1181 return ret;
1182 }
1183
fill_ep_caps(struct usb_ep_caps * caps,struct usb_raw_ep_caps * raw_caps)1184 static void fill_ep_caps(struct usb_ep_caps *caps,
1185 struct usb_raw_ep_caps *raw_caps)
1186 {
1187 raw_caps->type_control = caps->type_control;
1188 raw_caps->type_iso = caps->type_iso;
1189 raw_caps->type_bulk = caps->type_bulk;
1190 raw_caps->type_int = caps->type_int;
1191 raw_caps->dir_in = caps->dir_in;
1192 raw_caps->dir_out = caps->dir_out;
1193 }
1194
fill_ep_limits(struct usb_ep * ep,struct usb_raw_ep_limits * limits)1195 static void fill_ep_limits(struct usb_ep *ep, struct usb_raw_ep_limits *limits)
1196 {
1197 limits->maxpacket_limit = ep->maxpacket_limit;
1198 limits->max_streams = ep->max_streams;
1199 }
1200
raw_ioctl_eps_info(struct raw_dev * dev,unsigned long value)1201 static int raw_ioctl_eps_info(struct raw_dev *dev, unsigned long value)
1202 {
1203 int ret = 0, i;
1204 unsigned long flags;
1205 struct usb_raw_eps_info *info;
1206 struct raw_ep *ep;
1207
1208 info = kzalloc(sizeof(*info), GFP_KERNEL);
1209 if (!info) {
1210 ret = -ENOMEM;
1211 goto out;
1212 }
1213
1214 spin_lock_irqsave(&dev->lock, flags);
1215 if (dev->state != STATE_DEV_RUNNING) {
1216 dev_dbg(dev->dev, "fail, device is not running\n");
1217 ret = -EINVAL;
1218 spin_unlock_irqrestore(&dev->lock, flags);
1219 goto out_free;
1220 }
1221 if (!dev->gadget) {
1222 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1223 ret = -EBUSY;
1224 spin_unlock_irqrestore(&dev->lock, flags);
1225 goto out_free;
1226 }
1227
1228 for (i = 0; i < dev->eps_num; i++) {
1229 ep = &dev->eps[i];
1230 strscpy(&info->eps[i].name[0], ep->ep->name,
1231 USB_RAW_EP_NAME_MAX);
1232 info->eps[i].addr = ep->addr;
1233 fill_ep_caps(&ep->ep->caps, &info->eps[i].caps);
1234 fill_ep_limits(ep->ep, &info->eps[i].limits);
1235 }
1236 ret = dev->eps_num;
1237 spin_unlock_irqrestore(&dev->lock, flags);
1238
1239 if (copy_to_user((void __user *)value, info, sizeof(*info)))
1240 ret = -EFAULT;
1241
1242 out_free:
1243 kfree(info);
1244 out:
1245 return ret;
1246 }
1247
raw_ioctl(struct file * fd,unsigned int cmd,unsigned long value)1248 static long raw_ioctl(struct file *fd, unsigned int cmd, unsigned long value)
1249 {
1250 struct raw_dev *dev = fd->private_data;
1251 int ret = 0;
1252
1253 if (!dev)
1254 return -EBUSY;
1255
1256 switch (cmd) {
1257 case USB_RAW_IOCTL_INIT:
1258 ret = raw_ioctl_init(dev, value);
1259 break;
1260 case USB_RAW_IOCTL_RUN:
1261 ret = raw_ioctl_run(dev, value);
1262 break;
1263 case USB_RAW_IOCTL_EVENT_FETCH:
1264 ret = raw_ioctl_event_fetch(dev, value);
1265 break;
1266 case USB_RAW_IOCTL_EP0_WRITE:
1267 ret = raw_ioctl_ep0_write(dev, value);
1268 break;
1269 case USB_RAW_IOCTL_EP0_READ:
1270 ret = raw_ioctl_ep0_read(dev, value);
1271 break;
1272 case USB_RAW_IOCTL_EP_ENABLE:
1273 ret = raw_ioctl_ep_enable(dev, value);
1274 break;
1275 case USB_RAW_IOCTL_EP_DISABLE:
1276 ret = raw_ioctl_ep_disable(dev, value);
1277 break;
1278 case USB_RAW_IOCTL_EP_WRITE:
1279 ret = raw_ioctl_ep_write(dev, value);
1280 break;
1281 case USB_RAW_IOCTL_EP_READ:
1282 ret = raw_ioctl_ep_read(dev, value);
1283 break;
1284 case USB_RAW_IOCTL_CONFIGURE:
1285 ret = raw_ioctl_configure(dev, value);
1286 break;
1287 case USB_RAW_IOCTL_VBUS_DRAW:
1288 ret = raw_ioctl_vbus_draw(dev, value);
1289 break;
1290 case USB_RAW_IOCTL_EPS_INFO:
1291 ret = raw_ioctl_eps_info(dev, value);
1292 break;
1293 case USB_RAW_IOCTL_EP0_STALL:
1294 ret = raw_ioctl_ep0_stall(dev, value);
1295 break;
1296 case USB_RAW_IOCTL_EP_SET_HALT:
1297 ret = raw_ioctl_ep_set_clear_halt_wedge(
1298 dev, value, true, true);
1299 break;
1300 case USB_RAW_IOCTL_EP_CLEAR_HALT:
1301 ret = raw_ioctl_ep_set_clear_halt_wedge(
1302 dev, value, false, true);
1303 break;
1304 case USB_RAW_IOCTL_EP_SET_WEDGE:
1305 ret = raw_ioctl_ep_set_clear_halt_wedge(
1306 dev, value, true, false);
1307 break;
1308 default:
1309 ret = -EINVAL;
1310 }
1311
1312 return ret;
1313 }
1314
1315 /*----------------------------------------------------------------------*/
1316
1317 static const struct file_operations raw_fops = {
1318 .open = raw_open,
1319 .unlocked_ioctl = raw_ioctl,
1320 .compat_ioctl = raw_ioctl,
1321 .release = raw_release,
1322 .llseek = no_llseek,
1323 };
1324
1325 static struct miscdevice raw_misc_device = {
1326 .minor = MISC_DYNAMIC_MINOR,
1327 .name = DRIVER_NAME,
1328 .fops = &raw_fops,
1329 };
1330
1331 module_misc_device(raw_misc_device);
1332