1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * f_hid.c -- USB HID function driver 4 * 5 * Copyright (C) 2010 Fabien Chouteau <fabien.chouteau@barco.com> 6 */ 7 8 #include <linux/kernel.h> 9 #include <linux/module.h> 10 #include <linux/hid.h> 11 #include <linux/idr.h> 12 #include <linux/cdev.h> 13 #include <linux/mutex.h> 14 #include <linux/poll.h> 15 #include <linux/uaccess.h> 16 #include <linux/wait.h> 17 #include <linux/sched.h> 18 #include <linux/usb/g_hid.h> 19 20 #include "u_f.h" 21 #include "u_hid.h" 22 23 #define HIDG_MINORS 4 24 25 static int major, minors; 26 static struct class *hidg_class; 27 static DEFINE_IDA(hidg_ida); 28 static DEFINE_MUTEX(hidg_ida_lock); /* protects access to hidg_ida */ 29 30 /*-------------------------------------------------------------------------*/ 31 /* HID gadget struct */ 32 33 struct f_hidg_req_list { 34 struct usb_request *req; 35 unsigned int pos; 36 struct list_head list; 37 }; 38 39 struct f_hidg { 40 /* configuration */ 41 unsigned char bInterfaceSubClass; 42 unsigned char bInterfaceProtocol; 43 unsigned char protocol; 44 unsigned short report_desc_length; 45 char *report_desc; 46 unsigned short report_length; 47 48 /* recv report */ 49 struct list_head completed_out_req; 50 spinlock_t read_spinlock; 51 wait_queue_head_t read_queue; 52 unsigned int qlen; 53 54 /* send report */ 55 spinlock_t write_spinlock; 56 bool write_pending; 57 wait_queue_head_t write_queue; 58 struct usb_request *req; 59 60 int minor; 61 struct cdev cdev; 62 struct usb_function func; 63 64 struct usb_ep *in_ep; 65 struct usb_ep *out_ep; 66 }; 67 68 static inline struct f_hidg *func_to_hidg(struct usb_function *f) 69 { 70 return container_of(f, struct f_hidg, func); 71 } 72 73 /*-------------------------------------------------------------------------*/ 74 /* Static descriptors */ 75 76 static struct usb_interface_descriptor hidg_interface_desc = { 77 .bLength = sizeof hidg_interface_desc, 78 .bDescriptorType = USB_DT_INTERFACE, 79 /* .bInterfaceNumber = DYNAMIC */ 80 .bAlternateSetting = 0, 81 .bNumEndpoints = 2, 82 .bInterfaceClass = USB_CLASS_HID, 83 /* .bInterfaceSubClass = DYNAMIC */ 84 /* .bInterfaceProtocol = DYNAMIC */ 85 /* .iInterface = DYNAMIC */ 86 }; 87 88 static struct hid_descriptor hidg_desc = { 89 .bLength = sizeof hidg_desc, 90 .bDescriptorType = HID_DT_HID, 91 .bcdHID = 0x0101, 92 .bCountryCode = 0x00, 93 .bNumDescriptors = 0x1, 94 /*.desc[0].bDescriptorType = DYNAMIC */ 95 /*.desc[0].wDescriptorLenght = DYNAMIC */ 96 }; 97 98 /* Super-Speed Support */ 99 100 static struct usb_endpoint_descriptor hidg_ss_in_ep_desc = { 101 .bLength = USB_DT_ENDPOINT_SIZE, 102 .bDescriptorType = USB_DT_ENDPOINT, 103 .bEndpointAddress = USB_DIR_IN, 104 .bmAttributes = USB_ENDPOINT_XFER_INT, 105 /*.wMaxPacketSize = DYNAMIC */ 106 .bInterval = 4, /* FIXME: Add this field in the 107 * HID gadget configuration? 108 * (struct hidg_func_descriptor) 109 */ 110 }; 111 112 static struct usb_ss_ep_comp_descriptor hidg_ss_in_comp_desc = { 113 .bLength = sizeof(hidg_ss_in_comp_desc), 114 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP, 115 116 /* .bMaxBurst = 0, */ 117 /* .bmAttributes = 0, */ 118 /* .wBytesPerInterval = DYNAMIC */ 119 }; 120 121 static struct usb_endpoint_descriptor hidg_ss_out_ep_desc = { 122 .bLength = USB_DT_ENDPOINT_SIZE, 123 .bDescriptorType = USB_DT_ENDPOINT, 124 .bEndpointAddress = USB_DIR_OUT, 125 .bmAttributes = USB_ENDPOINT_XFER_INT, 126 /*.wMaxPacketSize = DYNAMIC */ 127 .bInterval = 4, /* FIXME: Add this field in the 128 * HID gadget configuration? 129 * (struct hidg_func_descriptor) 130 */ 131 }; 132 133 static struct usb_ss_ep_comp_descriptor hidg_ss_out_comp_desc = { 134 .bLength = sizeof(hidg_ss_out_comp_desc), 135 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP, 136 137 /* .bMaxBurst = 0, */ 138 /* .bmAttributes = 0, */ 139 /* .wBytesPerInterval = DYNAMIC */ 140 }; 141 142 static struct usb_descriptor_header *hidg_ss_descriptors[] = { 143 (struct usb_descriptor_header *)&hidg_interface_desc, 144 (struct usb_descriptor_header *)&hidg_desc, 145 (struct usb_descriptor_header *)&hidg_ss_in_ep_desc, 146 (struct usb_descriptor_header *)&hidg_ss_in_comp_desc, 147 (struct usb_descriptor_header *)&hidg_ss_out_ep_desc, 148 (struct usb_descriptor_header *)&hidg_ss_out_comp_desc, 149 NULL, 150 }; 151 152 /* High-Speed Support */ 153 154 static struct usb_endpoint_descriptor hidg_hs_in_ep_desc = { 155 .bLength = USB_DT_ENDPOINT_SIZE, 156 .bDescriptorType = USB_DT_ENDPOINT, 157 .bEndpointAddress = USB_DIR_IN, 158 .bmAttributes = USB_ENDPOINT_XFER_INT, 159 /*.wMaxPacketSize = DYNAMIC */ 160 .bInterval = 4, /* FIXME: Add this field in the 161 * HID gadget configuration? 162 * (struct hidg_func_descriptor) 163 */ 164 }; 165 166 static struct usb_endpoint_descriptor hidg_hs_out_ep_desc = { 167 .bLength = USB_DT_ENDPOINT_SIZE, 168 .bDescriptorType = USB_DT_ENDPOINT, 169 .bEndpointAddress = USB_DIR_OUT, 170 .bmAttributes = USB_ENDPOINT_XFER_INT, 171 /*.wMaxPacketSize = DYNAMIC */ 172 .bInterval = 4, /* FIXME: Add this field in the 173 * HID gadget configuration? 174 * (struct hidg_func_descriptor) 175 */ 176 }; 177 178 static struct usb_descriptor_header *hidg_hs_descriptors[] = { 179 (struct usb_descriptor_header *)&hidg_interface_desc, 180 (struct usb_descriptor_header *)&hidg_desc, 181 (struct usb_descriptor_header *)&hidg_hs_in_ep_desc, 182 (struct usb_descriptor_header *)&hidg_hs_out_ep_desc, 183 NULL, 184 }; 185 186 /* Full-Speed Support */ 187 188 static struct usb_endpoint_descriptor hidg_fs_in_ep_desc = { 189 .bLength = USB_DT_ENDPOINT_SIZE, 190 .bDescriptorType = USB_DT_ENDPOINT, 191 .bEndpointAddress = USB_DIR_IN, 192 .bmAttributes = USB_ENDPOINT_XFER_INT, 193 /*.wMaxPacketSize = DYNAMIC */ 194 .bInterval = 10, /* FIXME: Add this field in the 195 * HID gadget configuration? 196 * (struct hidg_func_descriptor) 197 */ 198 }; 199 200 static struct usb_endpoint_descriptor hidg_fs_out_ep_desc = { 201 .bLength = USB_DT_ENDPOINT_SIZE, 202 .bDescriptorType = USB_DT_ENDPOINT, 203 .bEndpointAddress = USB_DIR_OUT, 204 .bmAttributes = USB_ENDPOINT_XFER_INT, 205 /*.wMaxPacketSize = DYNAMIC */ 206 .bInterval = 10, /* FIXME: Add this field in the 207 * HID gadget configuration? 208 * (struct hidg_func_descriptor) 209 */ 210 }; 211 212 static struct usb_descriptor_header *hidg_fs_descriptors[] = { 213 (struct usb_descriptor_header *)&hidg_interface_desc, 214 (struct usb_descriptor_header *)&hidg_desc, 215 (struct usb_descriptor_header *)&hidg_fs_in_ep_desc, 216 (struct usb_descriptor_header *)&hidg_fs_out_ep_desc, 217 NULL, 218 }; 219 220 /*-------------------------------------------------------------------------*/ 221 /* Strings */ 222 223 #define CT_FUNC_HID_IDX 0 224 225 static struct usb_string ct_func_string_defs[] = { 226 [CT_FUNC_HID_IDX].s = "HID Interface", 227 {}, /* end of list */ 228 }; 229 230 static struct usb_gadget_strings ct_func_string_table = { 231 .language = 0x0409, /* en-US */ 232 .strings = ct_func_string_defs, 233 }; 234 235 static struct usb_gadget_strings *ct_func_strings[] = { 236 &ct_func_string_table, 237 NULL, 238 }; 239 240 /*-------------------------------------------------------------------------*/ 241 /* Char Device */ 242 243 static ssize_t f_hidg_read(struct file *file, char __user *buffer, 244 size_t count, loff_t *ptr) 245 { 246 struct f_hidg *hidg = file->private_data; 247 struct f_hidg_req_list *list; 248 struct usb_request *req; 249 unsigned long flags; 250 int ret; 251 252 if (!count) 253 return 0; 254 255 spin_lock_irqsave(&hidg->read_spinlock, flags); 256 257 #define READ_COND (!list_empty(&hidg->completed_out_req)) 258 259 /* wait for at least one buffer to complete */ 260 while (!READ_COND) { 261 spin_unlock_irqrestore(&hidg->read_spinlock, flags); 262 if (file->f_flags & O_NONBLOCK) 263 return -EAGAIN; 264 265 if (wait_event_interruptible(hidg->read_queue, READ_COND)) 266 return -ERESTARTSYS; 267 268 spin_lock_irqsave(&hidg->read_spinlock, flags); 269 } 270 271 /* pick the first one */ 272 list = list_first_entry(&hidg->completed_out_req, 273 struct f_hidg_req_list, list); 274 275 /* 276 * Remove this from list to protect it from beign free() 277 * while host disables our function 278 */ 279 list_del(&list->list); 280 281 req = list->req; 282 count = min_t(unsigned int, count, req->actual - list->pos); 283 spin_unlock_irqrestore(&hidg->read_spinlock, flags); 284 285 /* copy to user outside spinlock */ 286 count -= copy_to_user(buffer, req->buf + list->pos, count); 287 list->pos += count; 288 289 /* 290 * if this request is completely handled and transfered to 291 * userspace, remove its entry from the list and requeue it 292 * again. Otherwise, we will revisit it again upon the next 293 * call, taking into account its current read position. 294 */ 295 if (list->pos == req->actual) { 296 kfree(list); 297 298 req->length = hidg->report_length; 299 ret = usb_ep_queue(hidg->out_ep, req, GFP_KERNEL); 300 if (ret < 0) { 301 free_ep_req(hidg->out_ep, req); 302 return ret; 303 } 304 } else { 305 spin_lock_irqsave(&hidg->read_spinlock, flags); 306 list_add(&list->list, &hidg->completed_out_req); 307 spin_unlock_irqrestore(&hidg->read_spinlock, flags); 308 309 wake_up(&hidg->read_queue); 310 } 311 312 return count; 313 } 314 315 static void f_hidg_req_complete(struct usb_ep *ep, struct usb_request *req) 316 { 317 struct f_hidg *hidg = (struct f_hidg *)ep->driver_data; 318 unsigned long flags; 319 320 if (req->status != 0) { 321 ERROR(hidg->func.config->cdev, 322 "End Point Request ERROR: %d\n", req->status); 323 } 324 325 spin_lock_irqsave(&hidg->write_spinlock, flags); 326 hidg->write_pending = 0; 327 spin_unlock_irqrestore(&hidg->write_spinlock, flags); 328 wake_up(&hidg->write_queue); 329 } 330 331 static ssize_t f_hidg_write(struct file *file, const char __user *buffer, 332 size_t count, loff_t *offp) 333 { 334 struct f_hidg *hidg = file->private_data; 335 struct usb_request *req; 336 unsigned long flags; 337 ssize_t status = -ENOMEM; 338 339 spin_lock_irqsave(&hidg->write_spinlock, flags); 340 341 #define WRITE_COND (!hidg->write_pending) 342 try_again: 343 /* write queue */ 344 while (!WRITE_COND) { 345 spin_unlock_irqrestore(&hidg->write_spinlock, flags); 346 if (file->f_flags & O_NONBLOCK) 347 return -EAGAIN; 348 349 if (wait_event_interruptible_exclusive( 350 hidg->write_queue, WRITE_COND)) 351 return -ERESTARTSYS; 352 353 spin_lock_irqsave(&hidg->write_spinlock, flags); 354 } 355 356 hidg->write_pending = 1; 357 req = hidg->req; 358 count = min_t(unsigned, count, hidg->report_length); 359 360 spin_unlock_irqrestore(&hidg->write_spinlock, flags); 361 status = copy_from_user(req->buf, buffer, count); 362 363 if (status != 0) { 364 ERROR(hidg->func.config->cdev, 365 "copy_from_user error\n"); 366 status = -EINVAL; 367 goto release_write_pending; 368 } 369 370 spin_lock_irqsave(&hidg->write_spinlock, flags); 371 372 /* when our function has been disabled by host */ 373 if (!hidg->req) { 374 free_ep_req(hidg->in_ep, req); 375 /* 376 * TODO 377 * Should we fail with error here? 378 */ 379 goto try_again; 380 } 381 382 req->status = 0; 383 req->zero = 0; 384 req->length = count; 385 req->complete = f_hidg_req_complete; 386 req->context = hidg; 387 388 spin_unlock_irqrestore(&hidg->write_spinlock, flags); 389 390 status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC); 391 if (status < 0) { 392 ERROR(hidg->func.config->cdev, 393 "usb_ep_queue error on int endpoint %zd\n", status); 394 goto release_write_pending; 395 } else { 396 status = count; 397 } 398 399 return status; 400 release_write_pending: 401 spin_lock_irqsave(&hidg->write_spinlock, flags); 402 hidg->write_pending = 0; 403 spin_unlock_irqrestore(&hidg->write_spinlock, flags); 404 405 wake_up(&hidg->write_queue); 406 407 return status; 408 } 409 410 static __poll_t f_hidg_poll(struct file *file, poll_table *wait) 411 { 412 struct f_hidg *hidg = file->private_data; 413 __poll_t ret = 0; 414 415 poll_wait(file, &hidg->read_queue, wait); 416 poll_wait(file, &hidg->write_queue, wait); 417 418 if (WRITE_COND) 419 ret |= EPOLLOUT | EPOLLWRNORM; 420 421 if (READ_COND) 422 ret |= EPOLLIN | EPOLLRDNORM; 423 424 return ret; 425 } 426 427 #undef WRITE_COND 428 #undef READ_COND 429 430 static int f_hidg_release(struct inode *inode, struct file *fd) 431 { 432 fd->private_data = NULL; 433 return 0; 434 } 435 436 static int f_hidg_open(struct inode *inode, struct file *fd) 437 { 438 struct f_hidg *hidg = 439 container_of(inode->i_cdev, struct f_hidg, cdev); 440 441 fd->private_data = hidg; 442 443 return 0; 444 } 445 446 /*-------------------------------------------------------------------------*/ 447 /* usb_function */ 448 449 static inline struct usb_request *hidg_alloc_ep_req(struct usb_ep *ep, 450 unsigned length) 451 { 452 return alloc_ep_req(ep, length); 453 } 454 455 static void hidg_set_report_complete(struct usb_ep *ep, struct usb_request *req) 456 { 457 struct f_hidg *hidg = (struct f_hidg *) req->context; 458 struct usb_composite_dev *cdev = hidg->func.config->cdev; 459 struct f_hidg_req_list *req_list; 460 unsigned long flags; 461 462 switch (req->status) { 463 case 0: 464 req_list = kzalloc(sizeof(*req_list), GFP_ATOMIC); 465 if (!req_list) { 466 ERROR(cdev, "Unable to allocate mem for req_list\n"); 467 goto free_req; 468 } 469 470 req_list->req = req; 471 472 spin_lock_irqsave(&hidg->read_spinlock, flags); 473 list_add_tail(&req_list->list, &hidg->completed_out_req); 474 spin_unlock_irqrestore(&hidg->read_spinlock, flags); 475 476 wake_up(&hidg->read_queue); 477 break; 478 default: 479 ERROR(cdev, "Set report failed %d\n", req->status); 480 fallthrough; 481 case -ECONNABORTED: /* hardware forced ep reset */ 482 case -ECONNRESET: /* request dequeued */ 483 case -ESHUTDOWN: /* disconnect from host */ 484 free_req: 485 free_ep_req(ep, req); 486 return; 487 } 488 } 489 490 static int hidg_setup(struct usb_function *f, 491 const struct usb_ctrlrequest *ctrl) 492 { 493 struct f_hidg *hidg = func_to_hidg(f); 494 struct usb_composite_dev *cdev = f->config->cdev; 495 struct usb_request *req = cdev->req; 496 int status = 0; 497 __u16 value, length; 498 499 value = __le16_to_cpu(ctrl->wValue); 500 length = __le16_to_cpu(ctrl->wLength); 501 502 VDBG(cdev, 503 "%s crtl_request : bRequestType:0x%x bRequest:0x%x Value:0x%x\n", 504 __func__, ctrl->bRequestType, ctrl->bRequest, value); 505 506 switch ((ctrl->bRequestType << 8) | ctrl->bRequest) { 507 case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 508 | HID_REQ_GET_REPORT): 509 VDBG(cdev, "get_report\n"); 510 511 /* send an empty report */ 512 length = min_t(unsigned, length, hidg->report_length); 513 memset(req->buf, 0x0, length); 514 515 goto respond; 516 break; 517 518 case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 519 | HID_REQ_GET_PROTOCOL): 520 VDBG(cdev, "get_protocol\n"); 521 length = min_t(unsigned int, length, 1); 522 ((u8 *) req->buf)[0] = hidg->protocol; 523 goto respond; 524 break; 525 526 case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 527 | HID_REQ_SET_REPORT): 528 VDBG(cdev, "set_report | wLength=%d\n", ctrl->wLength); 529 goto stall; 530 break; 531 532 case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 533 | HID_REQ_SET_PROTOCOL): 534 VDBG(cdev, "set_protocol\n"); 535 if (value > HID_REPORT_PROTOCOL) 536 goto stall; 537 length = 0; 538 /* 539 * We assume that programs implementing the Boot protocol 540 * are also compatible with the Report Protocol 541 */ 542 if (hidg->bInterfaceSubClass == USB_INTERFACE_SUBCLASS_BOOT) { 543 hidg->protocol = value; 544 goto respond; 545 } 546 goto stall; 547 break; 548 549 case ((USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_INTERFACE) << 8 550 | USB_REQ_GET_DESCRIPTOR): 551 switch (value >> 8) { 552 case HID_DT_HID: 553 { 554 struct hid_descriptor hidg_desc_copy = hidg_desc; 555 556 VDBG(cdev, "USB_REQ_GET_DESCRIPTOR: HID\n"); 557 hidg_desc_copy.desc[0].bDescriptorType = HID_DT_REPORT; 558 hidg_desc_copy.desc[0].wDescriptorLength = 559 cpu_to_le16(hidg->report_desc_length); 560 561 length = min_t(unsigned short, length, 562 hidg_desc_copy.bLength); 563 memcpy(req->buf, &hidg_desc_copy, length); 564 goto respond; 565 break; 566 } 567 case HID_DT_REPORT: 568 VDBG(cdev, "USB_REQ_GET_DESCRIPTOR: REPORT\n"); 569 length = min_t(unsigned short, length, 570 hidg->report_desc_length); 571 memcpy(req->buf, hidg->report_desc, length); 572 goto respond; 573 break; 574 575 default: 576 VDBG(cdev, "Unknown descriptor request 0x%x\n", 577 value >> 8); 578 goto stall; 579 break; 580 } 581 break; 582 583 default: 584 VDBG(cdev, "Unknown request 0x%x\n", 585 ctrl->bRequest); 586 goto stall; 587 break; 588 } 589 590 stall: 591 return -EOPNOTSUPP; 592 593 respond: 594 req->zero = 0; 595 req->length = length; 596 status = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC); 597 if (status < 0) 598 ERROR(cdev, "usb_ep_queue error on ep0 %d\n", value); 599 return status; 600 } 601 602 static void hidg_disable(struct usb_function *f) 603 { 604 struct f_hidg *hidg = func_to_hidg(f); 605 struct f_hidg_req_list *list, *next; 606 unsigned long flags; 607 608 usb_ep_disable(hidg->in_ep); 609 usb_ep_disable(hidg->out_ep); 610 611 spin_lock_irqsave(&hidg->read_spinlock, flags); 612 list_for_each_entry_safe(list, next, &hidg->completed_out_req, list) { 613 free_ep_req(hidg->out_ep, list->req); 614 list_del(&list->list); 615 kfree(list); 616 } 617 spin_unlock_irqrestore(&hidg->read_spinlock, flags); 618 619 spin_lock_irqsave(&hidg->write_spinlock, flags); 620 if (!hidg->write_pending) { 621 free_ep_req(hidg->in_ep, hidg->req); 622 hidg->write_pending = 1; 623 } 624 625 hidg->req = NULL; 626 spin_unlock_irqrestore(&hidg->write_spinlock, flags); 627 } 628 629 static int hidg_set_alt(struct usb_function *f, unsigned intf, unsigned alt) 630 { 631 struct usb_composite_dev *cdev = f->config->cdev; 632 struct f_hidg *hidg = func_to_hidg(f); 633 struct usb_request *req_in = NULL; 634 unsigned long flags; 635 int i, status = 0; 636 637 VDBG(cdev, "hidg_set_alt intf:%d alt:%d\n", intf, alt); 638 639 if (hidg->in_ep != NULL) { 640 /* restart endpoint */ 641 usb_ep_disable(hidg->in_ep); 642 643 status = config_ep_by_speed(f->config->cdev->gadget, f, 644 hidg->in_ep); 645 if (status) { 646 ERROR(cdev, "config_ep_by_speed FAILED!\n"); 647 goto fail; 648 } 649 status = usb_ep_enable(hidg->in_ep); 650 if (status < 0) { 651 ERROR(cdev, "Enable IN endpoint FAILED!\n"); 652 goto fail; 653 } 654 hidg->in_ep->driver_data = hidg; 655 656 req_in = hidg_alloc_ep_req(hidg->in_ep, hidg->report_length); 657 if (!req_in) { 658 status = -ENOMEM; 659 goto disable_ep_in; 660 } 661 } 662 663 664 if (hidg->out_ep != NULL) { 665 /* restart endpoint */ 666 usb_ep_disable(hidg->out_ep); 667 668 status = config_ep_by_speed(f->config->cdev->gadget, f, 669 hidg->out_ep); 670 if (status) { 671 ERROR(cdev, "config_ep_by_speed FAILED!\n"); 672 goto free_req_in; 673 } 674 status = usb_ep_enable(hidg->out_ep); 675 if (status < 0) { 676 ERROR(cdev, "Enable OUT endpoint FAILED!\n"); 677 goto free_req_in; 678 } 679 hidg->out_ep->driver_data = hidg; 680 681 /* 682 * allocate a bunch of read buffers and queue them all at once. 683 */ 684 for (i = 0; i < hidg->qlen && status == 0; i++) { 685 struct usb_request *req = 686 hidg_alloc_ep_req(hidg->out_ep, 687 hidg->report_length); 688 if (req) { 689 req->complete = hidg_set_report_complete; 690 req->context = hidg; 691 status = usb_ep_queue(hidg->out_ep, req, 692 GFP_ATOMIC); 693 if (status) { 694 ERROR(cdev, "%s queue req --> %d\n", 695 hidg->out_ep->name, status); 696 free_ep_req(hidg->out_ep, req); 697 } 698 } else { 699 status = -ENOMEM; 700 goto disable_out_ep; 701 } 702 } 703 } 704 705 if (hidg->in_ep != NULL) { 706 spin_lock_irqsave(&hidg->write_spinlock, flags); 707 hidg->req = req_in; 708 hidg->write_pending = 0; 709 spin_unlock_irqrestore(&hidg->write_spinlock, flags); 710 711 wake_up(&hidg->write_queue); 712 } 713 return 0; 714 disable_out_ep: 715 usb_ep_disable(hidg->out_ep); 716 free_req_in: 717 if (req_in) 718 free_ep_req(hidg->in_ep, req_in); 719 720 disable_ep_in: 721 if (hidg->in_ep) 722 usb_ep_disable(hidg->in_ep); 723 724 fail: 725 return status; 726 } 727 728 static const struct file_operations f_hidg_fops = { 729 .owner = THIS_MODULE, 730 .open = f_hidg_open, 731 .release = f_hidg_release, 732 .write = f_hidg_write, 733 .read = f_hidg_read, 734 .poll = f_hidg_poll, 735 .llseek = noop_llseek, 736 }; 737 738 static int hidg_bind(struct usb_configuration *c, struct usb_function *f) 739 { 740 struct usb_ep *ep; 741 struct f_hidg *hidg = func_to_hidg(f); 742 struct usb_string *us; 743 struct device *device; 744 int status; 745 dev_t dev; 746 747 /* maybe allocate device-global string IDs, and patch descriptors */ 748 us = usb_gstrings_attach(c->cdev, ct_func_strings, 749 ARRAY_SIZE(ct_func_string_defs)); 750 if (IS_ERR(us)) 751 return PTR_ERR(us); 752 hidg_interface_desc.iInterface = us[CT_FUNC_HID_IDX].id; 753 754 /* allocate instance-specific interface IDs, and patch descriptors */ 755 status = usb_interface_id(c, f); 756 if (status < 0) 757 goto fail; 758 hidg_interface_desc.bInterfaceNumber = status; 759 760 /* allocate instance-specific endpoints */ 761 status = -ENODEV; 762 ep = usb_ep_autoconfig(c->cdev->gadget, &hidg_fs_in_ep_desc); 763 if (!ep) 764 goto fail; 765 hidg->in_ep = ep; 766 767 ep = usb_ep_autoconfig(c->cdev->gadget, &hidg_fs_out_ep_desc); 768 if (!ep) 769 goto fail; 770 hidg->out_ep = ep; 771 772 /* set descriptor dynamic values */ 773 hidg_interface_desc.bInterfaceSubClass = hidg->bInterfaceSubClass; 774 hidg_interface_desc.bInterfaceProtocol = hidg->bInterfaceProtocol; 775 hidg->protocol = HID_REPORT_PROTOCOL; 776 hidg_ss_in_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length); 777 hidg_ss_in_comp_desc.wBytesPerInterval = 778 cpu_to_le16(hidg->report_length); 779 hidg_hs_in_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length); 780 hidg_fs_in_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length); 781 hidg_ss_out_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length); 782 hidg_ss_out_comp_desc.wBytesPerInterval = 783 cpu_to_le16(hidg->report_length); 784 hidg_hs_out_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length); 785 hidg_fs_out_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length); 786 /* 787 * We can use hidg_desc struct here but we should not relay 788 * that its content won't change after returning from this function. 789 */ 790 hidg_desc.desc[0].bDescriptorType = HID_DT_REPORT; 791 hidg_desc.desc[0].wDescriptorLength = 792 cpu_to_le16(hidg->report_desc_length); 793 794 hidg_hs_in_ep_desc.bEndpointAddress = 795 hidg_fs_in_ep_desc.bEndpointAddress; 796 hidg_hs_out_ep_desc.bEndpointAddress = 797 hidg_fs_out_ep_desc.bEndpointAddress; 798 799 hidg_ss_in_ep_desc.bEndpointAddress = 800 hidg_fs_in_ep_desc.bEndpointAddress; 801 hidg_ss_out_ep_desc.bEndpointAddress = 802 hidg_fs_out_ep_desc.bEndpointAddress; 803 804 status = usb_assign_descriptors(f, hidg_fs_descriptors, 805 hidg_hs_descriptors, hidg_ss_descriptors, NULL); 806 if (status) 807 goto fail; 808 809 spin_lock_init(&hidg->write_spinlock); 810 hidg->write_pending = 1; 811 hidg->req = NULL; 812 spin_lock_init(&hidg->read_spinlock); 813 init_waitqueue_head(&hidg->write_queue); 814 init_waitqueue_head(&hidg->read_queue); 815 INIT_LIST_HEAD(&hidg->completed_out_req); 816 817 /* create char device */ 818 cdev_init(&hidg->cdev, &f_hidg_fops); 819 dev = MKDEV(major, hidg->minor); 820 status = cdev_add(&hidg->cdev, dev, 1); 821 if (status) 822 goto fail_free_descs; 823 824 device = device_create(hidg_class, NULL, dev, NULL, 825 "%s%d", "hidg", hidg->minor); 826 if (IS_ERR(device)) { 827 status = PTR_ERR(device); 828 goto del; 829 } 830 831 return 0; 832 del: 833 cdev_del(&hidg->cdev); 834 fail_free_descs: 835 usb_free_all_descriptors(f); 836 fail: 837 ERROR(f->config->cdev, "hidg_bind FAILED\n"); 838 if (hidg->req != NULL) 839 free_ep_req(hidg->in_ep, hidg->req); 840 841 return status; 842 } 843 844 static inline int hidg_get_minor(void) 845 { 846 int ret; 847 848 ret = ida_simple_get(&hidg_ida, 0, 0, GFP_KERNEL); 849 if (ret >= HIDG_MINORS) { 850 ida_simple_remove(&hidg_ida, ret); 851 ret = -ENODEV; 852 } 853 854 return ret; 855 } 856 857 static inline struct f_hid_opts *to_f_hid_opts(struct config_item *item) 858 { 859 return container_of(to_config_group(item), struct f_hid_opts, 860 func_inst.group); 861 } 862 863 static void hid_attr_release(struct config_item *item) 864 { 865 struct f_hid_opts *opts = to_f_hid_opts(item); 866 867 usb_put_function_instance(&opts->func_inst); 868 } 869 870 static struct configfs_item_operations hidg_item_ops = { 871 .release = hid_attr_release, 872 }; 873 874 #define F_HID_OPT(name, prec, limit) \ 875 static ssize_t f_hid_opts_##name##_show(struct config_item *item, char *page)\ 876 { \ 877 struct f_hid_opts *opts = to_f_hid_opts(item); \ 878 int result; \ 879 \ 880 mutex_lock(&opts->lock); \ 881 result = sprintf(page, "%d\n", opts->name); \ 882 mutex_unlock(&opts->lock); \ 883 \ 884 return result; \ 885 } \ 886 \ 887 static ssize_t f_hid_opts_##name##_store(struct config_item *item, \ 888 const char *page, size_t len) \ 889 { \ 890 struct f_hid_opts *opts = to_f_hid_opts(item); \ 891 int ret; \ 892 u##prec num; \ 893 \ 894 mutex_lock(&opts->lock); \ 895 if (opts->refcnt) { \ 896 ret = -EBUSY; \ 897 goto end; \ 898 } \ 899 \ 900 ret = kstrtou##prec(page, 0, &num); \ 901 if (ret) \ 902 goto end; \ 903 \ 904 if (num > limit) { \ 905 ret = -EINVAL; \ 906 goto end; \ 907 } \ 908 opts->name = num; \ 909 ret = len; \ 910 \ 911 end: \ 912 mutex_unlock(&opts->lock); \ 913 return ret; \ 914 } \ 915 \ 916 CONFIGFS_ATTR(f_hid_opts_, name) 917 918 F_HID_OPT(subclass, 8, 255); 919 F_HID_OPT(protocol, 8, 255); 920 F_HID_OPT(report_length, 16, 65535); 921 922 static ssize_t f_hid_opts_report_desc_show(struct config_item *item, char *page) 923 { 924 struct f_hid_opts *opts = to_f_hid_opts(item); 925 int result; 926 927 mutex_lock(&opts->lock); 928 result = opts->report_desc_length; 929 memcpy(page, opts->report_desc, opts->report_desc_length); 930 mutex_unlock(&opts->lock); 931 932 return result; 933 } 934 935 static ssize_t f_hid_opts_report_desc_store(struct config_item *item, 936 const char *page, size_t len) 937 { 938 struct f_hid_opts *opts = to_f_hid_opts(item); 939 int ret = -EBUSY; 940 char *d; 941 942 mutex_lock(&opts->lock); 943 944 if (opts->refcnt) 945 goto end; 946 if (len > PAGE_SIZE) { 947 ret = -ENOSPC; 948 goto end; 949 } 950 d = kmemdup(page, len, GFP_KERNEL); 951 if (!d) { 952 ret = -ENOMEM; 953 goto end; 954 } 955 kfree(opts->report_desc); 956 opts->report_desc = d; 957 opts->report_desc_length = len; 958 opts->report_desc_alloc = true; 959 ret = len; 960 end: 961 mutex_unlock(&opts->lock); 962 return ret; 963 } 964 965 CONFIGFS_ATTR(f_hid_opts_, report_desc); 966 967 static ssize_t f_hid_opts_dev_show(struct config_item *item, char *page) 968 { 969 struct f_hid_opts *opts = to_f_hid_opts(item); 970 971 return sprintf(page, "%d:%d\n", major, opts->minor); 972 } 973 974 CONFIGFS_ATTR_RO(f_hid_opts_, dev); 975 976 static struct configfs_attribute *hid_attrs[] = { 977 &f_hid_opts_attr_subclass, 978 &f_hid_opts_attr_protocol, 979 &f_hid_opts_attr_report_length, 980 &f_hid_opts_attr_report_desc, 981 &f_hid_opts_attr_dev, 982 NULL, 983 }; 984 985 static const struct config_item_type hid_func_type = { 986 .ct_item_ops = &hidg_item_ops, 987 .ct_attrs = hid_attrs, 988 .ct_owner = THIS_MODULE, 989 }; 990 991 static inline void hidg_put_minor(int minor) 992 { 993 ida_simple_remove(&hidg_ida, minor); 994 } 995 996 static void hidg_free_inst(struct usb_function_instance *f) 997 { 998 struct f_hid_opts *opts; 999 1000 opts = container_of(f, struct f_hid_opts, func_inst); 1001 1002 mutex_lock(&hidg_ida_lock); 1003 1004 hidg_put_minor(opts->minor); 1005 if (ida_is_empty(&hidg_ida)) 1006 ghid_cleanup(); 1007 1008 mutex_unlock(&hidg_ida_lock); 1009 1010 if (opts->report_desc_alloc) 1011 kfree(opts->report_desc); 1012 1013 kfree(opts); 1014 } 1015 1016 static struct usb_function_instance *hidg_alloc_inst(void) 1017 { 1018 struct f_hid_opts *opts; 1019 struct usb_function_instance *ret; 1020 int status = 0; 1021 1022 opts = kzalloc(sizeof(*opts), GFP_KERNEL); 1023 if (!opts) 1024 return ERR_PTR(-ENOMEM); 1025 mutex_init(&opts->lock); 1026 opts->func_inst.free_func_inst = hidg_free_inst; 1027 ret = &opts->func_inst; 1028 1029 mutex_lock(&hidg_ida_lock); 1030 1031 if (ida_is_empty(&hidg_ida)) { 1032 status = ghid_setup(NULL, HIDG_MINORS); 1033 if (status) { 1034 ret = ERR_PTR(status); 1035 kfree(opts); 1036 goto unlock; 1037 } 1038 } 1039 1040 opts->minor = hidg_get_minor(); 1041 if (opts->minor < 0) { 1042 ret = ERR_PTR(opts->minor); 1043 kfree(opts); 1044 if (ida_is_empty(&hidg_ida)) 1045 ghid_cleanup(); 1046 goto unlock; 1047 } 1048 config_group_init_type_name(&opts->func_inst.group, "", &hid_func_type); 1049 1050 unlock: 1051 mutex_unlock(&hidg_ida_lock); 1052 return ret; 1053 } 1054 1055 static void hidg_free(struct usb_function *f) 1056 { 1057 struct f_hidg *hidg; 1058 struct f_hid_opts *opts; 1059 1060 hidg = func_to_hidg(f); 1061 opts = container_of(f->fi, struct f_hid_opts, func_inst); 1062 kfree(hidg->report_desc); 1063 kfree(hidg); 1064 mutex_lock(&opts->lock); 1065 --opts->refcnt; 1066 mutex_unlock(&opts->lock); 1067 } 1068 1069 static void hidg_unbind(struct usb_configuration *c, struct usb_function *f) 1070 { 1071 struct f_hidg *hidg = func_to_hidg(f); 1072 1073 device_destroy(hidg_class, MKDEV(major, hidg->minor)); 1074 cdev_del(&hidg->cdev); 1075 1076 usb_free_all_descriptors(f); 1077 } 1078 1079 static struct usb_function *hidg_alloc(struct usb_function_instance *fi) 1080 { 1081 struct f_hidg *hidg; 1082 struct f_hid_opts *opts; 1083 1084 /* allocate and initialize one new instance */ 1085 hidg = kzalloc(sizeof(*hidg), GFP_KERNEL); 1086 if (!hidg) 1087 return ERR_PTR(-ENOMEM); 1088 1089 opts = container_of(fi, struct f_hid_opts, func_inst); 1090 1091 mutex_lock(&opts->lock); 1092 ++opts->refcnt; 1093 1094 hidg->minor = opts->minor; 1095 hidg->bInterfaceSubClass = opts->subclass; 1096 hidg->bInterfaceProtocol = opts->protocol; 1097 hidg->report_length = opts->report_length; 1098 hidg->report_desc_length = opts->report_desc_length; 1099 if (opts->report_desc) { 1100 hidg->report_desc = kmemdup(opts->report_desc, 1101 opts->report_desc_length, 1102 GFP_KERNEL); 1103 if (!hidg->report_desc) { 1104 kfree(hidg); 1105 mutex_unlock(&opts->lock); 1106 return ERR_PTR(-ENOMEM); 1107 } 1108 } 1109 1110 mutex_unlock(&opts->lock); 1111 1112 hidg->func.name = "hid"; 1113 hidg->func.bind = hidg_bind; 1114 hidg->func.unbind = hidg_unbind; 1115 hidg->func.set_alt = hidg_set_alt; 1116 hidg->func.disable = hidg_disable; 1117 hidg->func.setup = hidg_setup; 1118 hidg->func.free_func = hidg_free; 1119 1120 /* this could me made configurable at some point */ 1121 hidg->qlen = 4; 1122 1123 return &hidg->func; 1124 } 1125 1126 DECLARE_USB_FUNCTION_INIT(hid, hidg_alloc_inst, hidg_alloc); 1127 MODULE_LICENSE("GPL"); 1128 MODULE_AUTHOR("Fabien Chouteau"); 1129 1130 int ghid_setup(struct usb_gadget *g, int count) 1131 { 1132 int status; 1133 dev_t dev; 1134 1135 hidg_class = class_create(THIS_MODULE, "hidg"); 1136 if (IS_ERR(hidg_class)) { 1137 status = PTR_ERR(hidg_class); 1138 hidg_class = NULL; 1139 return status; 1140 } 1141 1142 status = alloc_chrdev_region(&dev, 0, count, "hidg"); 1143 if (status) { 1144 class_destroy(hidg_class); 1145 hidg_class = NULL; 1146 return status; 1147 } 1148 1149 major = MAJOR(dev); 1150 minors = count; 1151 1152 return 0; 1153 } 1154 1155 void ghid_cleanup(void) 1156 { 1157 if (major) { 1158 unregister_chrdev_region(MKDEV(major, 0), minors); 1159 major = minors = 0; 1160 } 1161 1162 class_destroy(hidg_class); 1163 hidg_class = NULL; 1164 } 1165