1 /* 2 * inode.c -- user mode filesystem api for usb gadget controllers 3 * 4 * Copyright (C) 2003-2004 David Brownell 5 * Copyright (C) 2003 Agilent Technologies 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License as published by 9 * the Free Software Foundation; either version 2 of the License, or 10 * (at your option) any later version. 11 */ 12 13 14 /* #define VERBOSE_DEBUG */ 15 16 #include <linux/init.h> 17 #include <linux/module.h> 18 #include <linux/fs.h> 19 #include <linux/pagemap.h> 20 #include <linux/uts.h> 21 #include <linux/wait.h> 22 #include <linux/compiler.h> 23 #include <asm/uaccess.h> 24 #include <linux/sched.h> 25 #include <linux/slab.h> 26 #include <linux/poll.h> 27 #include <linux/mmu_context.h> 28 #include <linux/aio.h> 29 #include <linux/uio.h> 30 31 #include <linux/device.h> 32 #include <linux/moduleparam.h> 33 34 #include <linux/usb/gadgetfs.h> 35 #include <linux/usb/gadget.h> 36 37 38 /* 39 * The gadgetfs API maps each endpoint to a file descriptor so that you 40 * can use standard synchronous read/write calls for I/O. There's some 41 * O_NONBLOCK and O_ASYNC/FASYNC style i/o support. Example usermode 42 * drivers show how this works in practice. You can also use AIO to 43 * eliminate I/O gaps between requests, to help when streaming data. 44 * 45 * Key parts that must be USB-specific are protocols defining how the 46 * read/write operations relate to the hardware state machines. There 47 * are two types of files. One type is for the device, implementing ep0. 48 * The other type is for each IN or OUT endpoint. In both cases, the 49 * user mode driver must configure the hardware before using it. 50 * 51 * - First, dev_config() is called when /dev/gadget/$CHIP is configured 52 * (by writing configuration and device descriptors). Afterwards it 53 * may serve as a source of device events, used to handle all control 54 * requests other than basic enumeration. 55 * 56 * - Then, after a SET_CONFIGURATION control request, ep_config() is 57 * called when each /dev/gadget/ep* file is configured (by writing 58 * endpoint descriptors). Afterwards these files are used to write() 59 * IN data or to read() OUT data. To halt the endpoint, a "wrong 60 * direction" request is issued (like reading an IN endpoint). 61 * 62 * Unlike "usbfs" the only ioctl()s are for things that are rare, and maybe 63 * not possible on all hardware. For example, precise fault handling with 64 * respect to data left in endpoint fifos after aborted operations; or 65 * selective clearing of endpoint halts, to implement SET_INTERFACE. 66 */ 67 68 #define DRIVER_DESC "USB Gadget filesystem" 69 #define DRIVER_VERSION "24 Aug 2004" 70 71 static const char driver_desc [] = DRIVER_DESC; 72 static const char shortname [] = "gadgetfs"; 73 74 MODULE_DESCRIPTION (DRIVER_DESC); 75 MODULE_AUTHOR ("David Brownell"); 76 MODULE_LICENSE ("GPL"); 77 78 static int ep_open(struct inode *, struct file *); 79 80 81 /*----------------------------------------------------------------------*/ 82 83 #define GADGETFS_MAGIC 0xaee71ee7 84 85 /* /dev/gadget/$CHIP represents ep0 and the whole device */ 86 enum ep0_state { 87 /* DISBLED is the initial state. 88 */ 89 STATE_DEV_DISABLED = 0, 90 91 /* Only one open() of /dev/gadget/$CHIP; only one file tracks 92 * ep0/device i/o modes and binding to the controller. Driver 93 * must always write descriptors to initialize the device, then 94 * the device becomes UNCONNECTED until enumeration. 95 */ 96 STATE_DEV_OPENED, 97 98 /* From then on, ep0 fd is in either of two basic modes: 99 * - (UN)CONNECTED: read usb_gadgetfs_event(s) from it 100 * - SETUP: read/write will transfer control data and succeed; 101 * or if "wrong direction", performs protocol stall 102 */ 103 STATE_DEV_UNCONNECTED, 104 STATE_DEV_CONNECTED, 105 STATE_DEV_SETUP, 106 107 /* UNBOUND means the driver closed ep0, so the device won't be 108 * accessible again (DEV_DISABLED) until all fds are closed. 109 */ 110 STATE_DEV_UNBOUND, 111 }; 112 113 /* enough for the whole queue: most events invalidate others */ 114 #define N_EVENT 5 115 116 struct dev_data { 117 spinlock_t lock; 118 atomic_t count; 119 enum ep0_state state; /* P: lock */ 120 struct usb_gadgetfs_event event [N_EVENT]; 121 unsigned ev_next; 122 struct fasync_struct *fasync; 123 u8 current_config; 124 125 /* drivers reading ep0 MUST handle control requests (SETUP) 126 * reported that way; else the host will time out. 127 */ 128 unsigned usermode_setup : 1, 129 setup_in : 1, 130 setup_can_stall : 1, 131 setup_out_ready : 1, 132 setup_out_error : 1, 133 setup_abort : 1; 134 unsigned setup_wLength; 135 136 /* the rest is basically write-once */ 137 struct usb_config_descriptor *config, *hs_config; 138 struct usb_device_descriptor *dev; 139 struct usb_request *req; 140 struct usb_gadget *gadget; 141 struct list_head epfiles; 142 void *buf; 143 wait_queue_head_t wait; 144 struct super_block *sb; 145 struct dentry *dentry; 146 147 /* except this scratch i/o buffer for ep0 */ 148 u8 rbuf [256]; 149 }; 150 151 static inline void get_dev (struct dev_data *data) 152 { 153 atomic_inc (&data->count); 154 } 155 156 static void put_dev (struct dev_data *data) 157 { 158 if (likely (!atomic_dec_and_test (&data->count))) 159 return; 160 /* needs no more cleanup */ 161 BUG_ON (waitqueue_active (&data->wait)); 162 kfree (data); 163 } 164 165 static struct dev_data *dev_new (void) 166 { 167 struct dev_data *dev; 168 169 dev = kzalloc(sizeof(*dev), GFP_KERNEL); 170 if (!dev) 171 return NULL; 172 dev->state = STATE_DEV_DISABLED; 173 atomic_set (&dev->count, 1); 174 spin_lock_init (&dev->lock); 175 INIT_LIST_HEAD (&dev->epfiles); 176 init_waitqueue_head (&dev->wait); 177 return dev; 178 } 179 180 /*----------------------------------------------------------------------*/ 181 182 /* other /dev/gadget/$ENDPOINT files represent endpoints */ 183 enum ep_state { 184 STATE_EP_DISABLED = 0, 185 STATE_EP_READY, 186 STATE_EP_ENABLED, 187 STATE_EP_UNBOUND, 188 }; 189 190 struct ep_data { 191 struct mutex lock; 192 enum ep_state state; 193 atomic_t count; 194 struct dev_data *dev; 195 /* must hold dev->lock before accessing ep or req */ 196 struct usb_ep *ep; 197 struct usb_request *req; 198 ssize_t status; 199 char name [16]; 200 struct usb_endpoint_descriptor desc, hs_desc; 201 struct list_head epfiles; 202 wait_queue_head_t wait; 203 struct dentry *dentry; 204 }; 205 206 static inline void get_ep (struct ep_data *data) 207 { 208 atomic_inc (&data->count); 209 } 210 211 static void put_ep (struct ep_data *data) 212 { 213 if (likely (!atomic_dec_and_test (&data->count))) 214 return; 215 put_dev (data->dev); 216 /* needs no more cleanup */ 217 BUG_ON (!list_empty (&data->epfiles)); 218 BUG_ON (waitqueue_active (&data->wait)); 219 kfree (data); 220 } 221 222 /*----------------------------------------------------------------------*/ 223 224 /* most "how to use the hardware" policy choices are in userspace: 225 * mapping endpoint roles (which the driver needs) to the capabilities 226 * which the usb controller has. most of those capabilities are exposed 227 * implicitly, starting with the driver name and then endpoint names. 228 */ 229 230 static const char *CHIP; 231 232 /*----------------------------------------------------------------------*/ 233 234 /* NOTE: don't use dev_printk calls before binding to the gadget 235 * at the end of ep0 configuration, or after unbind. 236 */ 237 238 /* too wordy: dev_printk(level , &(d)->gadget->dev , fmt , ## args) */ 239 #define xprintk(d,level,fmt,args...) \ 240 printk(level "%s: " fmt , shortname , ## args) 241 242 #ifdef DEBUG 243 #define DBG(dev,fmt,args...) \ 244 xprintk(dev , KERN_DEBUG , fmt , ## args) 245 #else 246 #define DBG(dev,fmt,args...) \ 247 do { } while (0) 248 #endif /* DEBUG */ 249 250 #ifdef VERBOSE_DEBUG 251 #define VDEBUG DBG 252 #else 253 #define VDEBUG(dev,fmt,args...) \ 254 do { } while (0) 255 #endif /* DEBUG */ 256 257 #define ERROR(dev,fmt,args...) \ 258 xprintk(dev , KERN_ERR , fmt , ## args) 259 #define INFO(dev,fmt,args...) \ 260 xprintk(dev , KERN_INFO , fmt , ## args) 261 262 263 /*----------------------------------------------------------------------*/ 264 265 /* SYNCHRONOUS ENDPOINT OPERATIONS (bulk/intr/iso) 266 * 267 * After opening, configure non-control endpoints. Then use normal 268 * stream read() and write() requests; and maybe ioctl() to get more 269 * precise FIFO status when recovering from cancellation. 270 */ 271 272 static void epio_complete (struct usb_ep *ep, struct usb_request *req) 273 { 274 struct ep_data *epdata = ep->driver_data; 275 276 if (!req->context) 277 return; 278 if (req->status) 279 epdata->status = req->status; 280 else 281 epdata->status = req->actual; 282 complete ((struct completion *)req->context); 283 } 284 285 /* tasklock endpoint, returning when it's connected. 286 * still need dev->lock to use epdata->ep. 287 */ 288 static int 289 get_ready_ep (unsigned f_flags, struct ep_data *epdata, bool is_write) 290 { 291 int val; 292 293 if (f_flags & O_NONBLOCK) { 294 if (!mutex_trylock(&epdata->lock)) 295 goto nonblock; 296 if (epdata->state != STATE_EP_ENABLED && 297 (!is_write || epdata->state != STATE_EP_READY)) { 298 mutex_unlock(&epdata->lock); 299 nonblock: 300 val = -EAGAIN; 301 } else 302 val = 0; 303 return val; 304 } 305 306 val = mutex_lock_interruptible(&epdata->lock); 307 if (val < 0) 308 return val; 309 310 switch (epdata->state) { 311 case STATE_EP_ENABLED: 312 return 0; 313 case STATE_EP_READY: /* not configured yet */ 314 if (is_write) 315 return 0; 316 // FALLTHRU 317 case STATE_EP_UNBOUND: /* clean disconnect */ 318 break; 319 // case STATE_EP_DISABLED: /* "can't happen" */ 320 default: /* error! */ 321 pr_debug ("%s: ep %p not available, state %d\n", 322 shortname, epdata, epdata->state); 323 } 324 mutex_unlock(&epdata->lock); 325 return -ENODEV; 326 } 327 328 static ssize_t 329 ep_io (struct ep_data *epdata, void *buf, unsigned len) 330 { 331 DECLARE_COMPLETION_ONSTACK (done); 332 int value; 333 334 spin_lock_irq (&epdata->dev->lock); 335 if (likely (epdata->ep != NULL)) { 336 struct usb_request *req = epdata->req; 337 338 req->context = &done; 339 req->complete = epio_complete; 340 req->buf = buf; 341 req->length = len; 342 value = usb_ep_queue (epdata->ep, req, GFP_ATOMIC); 343 } else 344 value = -ENODEV; 345 spin_unlock_irq (&epdata->dev->lock); 346 347 if (likely (value == 0)) { 348 value = wait_event_interruptible (done.wait, done.done); 349 if (value != 0) { 350 spin_lock_irq (&epdata->dev->lock); 351 if (likely (epdata->ep != NULL)) { 352 DBG (epdata->dev, "%s i/o interrupted\n", 353 epdata->name); 354 usb_ep_dequeue (epdata->ep, epdata->req); 355 spin_unlock_irq (&epdata->dev->lock); 356 357 wait_event (done.wait, done.done); 358 if (epdata->status == -ECONNRESET) 359 epdata->status = -EINTR; 360 } else { 361 spin_unlock_irq (&epdata->dev->lock); 362 363 DBG (epdata->dev, "endpoint gone\n"); 364 epdata->status = -ENODEV; 365 } 366 } 367 return epdata->status; 368 } 369 return value; 370 } 371 372 static int 373 ep_release (struct inode *inode, struct file *fd) 374 { 375 struct ep_data *data = fd->private_data; 376 int value; 377 378 value = mutex_lock_interruptible(&data->lock); 379 if (value < 0) 380 return value; 381 382 /* clean up if this can be reopened */ 383 if (data->state != STATE_EP_UNBOUND) { 384 data->state = STATE_EP_DISABLED; 385 data->desc.bDescriptorType = 0; 386 data->hs_desc.bDescriptorType = 0; 387 usb_ep_disable(data->ep); 388 } 389 mutex_unlock(&data->lock); 390 put_ep (data); 391 return 0; 392 } 393 394 static long ep_ioctl(struct file *fd, unsigned code, unsigned long value) 395 { 396 struct ep_data *data = fd->private_data; 397 int status; 398 399 if ((status = get_ready_ep (fd->f_flags, data, false)) < 0) 400 return status; 401 402 spin_lock_irq (&data->dev->lock); 403 if (likely (data->ep != NULL)) { 404 switch (code) { 405 case GADGETFS_FIFO_STATUS: 406 status = usb_ep_fifo_status (data->ep); 407 break; 408 case GADGETFS_FIFO_FLUSH: 409 usb_ep_fifo_flush (data->ep); 410 break; 411 case GADGETFS_CLEAR_HALT: 412 status = usb_ep_clear_halt (data->ep); 413 break; 414 default: 415 status = -ENOTTY; 416 } 417 } else 418 status = -ENODEV; 419 spin_unlock_irq (&data->dev->lock); 420 mutex_unlock(&data->lock); 421 return status; 422 } 423 424 /*----------------------------------------------------------------------*/ 425 426 /* ASYNCHRONOUS ENDPOINT I/O OPERATIONS (bulk/intr/iso) */ 427 428 struct kiocb_priv { 429 struct usb_request *req; 430 struct ep_data *epdata; 431 struct kiocb *iocb; 432 struct mm_struct *mm; 433 struct work_struct work; 434 void *buf; 435 struct iov_iter to; 436 const void *to_free; 437 unsigned actual; 438 }; 439 440 static int ep_aio_cancel(struct kiocb *iocb) 441 { 442 struct kiocb_priv *priv = iocb->private; 443 struct ep_data *epdata; 444 int value; 445 446 local_irq_disable(); 447 epdata = priv->epdata; 448 // spin_lock(&epdata->dev->lock); 449 if (likely(epdata && epdata->ep && priv->req)) 450 value = usb_ep_dequeue (epdata->ep, priv->req); 451 else 452 value = -EINVAL; 453 // spin_unlock(&epdata->dev->lock); 454 local_irq_enable(); 455 456 return value; 457 } 458 459 static void ep_user_copy_worker(struct work_struct *work) 460 { 461 struct kiocb_priv *priv = container_of(work, struct kiocb_priv, work); 462 struct mm_struct *mm = priv->mm; 463 struct kiocb *iocb = priv->iocb; 464 size_t ret; 465 466 use_mm(mm); 467 ret = copy_to_iter(priv->buf, priv->actual, &priv->to); 468 unuse_mm(mm); 469 if (!ret) 470 ret = -EFAULT; 471 472 /* completing the iocb can drop the ctx and mm, don't touch mm after */ 473 iocb->ki_complete(iocb, ret, ret); 474 475 kfree(priv->buf); 476 kfree(priv->to_free); 477 kfree(priv); 478 } 479 480 static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req) 481 { 482 struct kiocb *iocb = req->context; 483 struct kiocb_priv *priv = iocb->private; 484 struct ep_data *epdata = priv->epdata; 485 486 /* lock against disconnect (and ideally, cancel) */ 487 spin_lock(&epdata->dev->lock); 488 priv->req = NULL; 489 priv->epdata = NULL; 490 491 /* if this was a write or a read returning no data then we 492 * don't need to copy anything to userspace, so we can 493 * complete the aio request immediately. 494 */ 495 if (priv->to_free == NULL || unlikely(req->actual == 0)) { 496 kfree(req->buf); 497 kfree(priv->to_free); 498 kfree(priv); 499 iocb->private = NULL; 500 /* aio_complete() reports bytes-transferred _and_ faults */ 501 502 iocb->ki_complete(iocb, req->actual ? req->actual : req->status, 503 req->status); 504 } else { 505 /* ep_copy_to_user() won't report both; we hide some faults */ 506 if (unlikely(0 != req->status)) 507 DBG(epdata->dev, "%s fault %d len %d\n", 508 ep->name, req->status, req->actual); 509 510 priv->buf = req->buf; 511 priv->actual = req->actual; 512 INIT_WORK(&priv->work, ep_user_copy_worker); 513 schedule_work(&priv->work); 514 } 515 spin_unlock(&epdata->dev->lock); 516 517 usb_ep_free_request(ep, req); 518 put_ep(epdata); 519 } 520 521 static ssize_t ep_aio(struct kiocb *iocb, 522 struct kiocb_priv *priv, 523 struct ep_data *epdata, 524 char *buf, 525 size_t len) 526 { 527 struct usb_request *req; 528 ssize_t value; 529 530 iocb->private = priv; 531 priv->iocb = iocb; 532 533 kiocb_set_cancel_fn(iocb, ep_aio_cancel); 534 get_ep(epdata); 535 priv->epdata = epdata; 536 priv->actual = 0; 537 priv->mm = current->mm; /* mm teardown waits for iocbs in exit_aio() */ 538 539 /* each kiocb is coupled to one usb_request, but we can't 540 * allocate or submit those if the host disconnected. 541 */ 542 spin_lock_irq(&epdata->dev->lock); 543 value = -ENODEV; 544 if (unlikely(epdata->ep)) 545 goto fail; 546 547 req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC); 548 value = -ENOMEM; 549 if (unlikely(!req)) 550 goto fail; 551 552 priv->req = req; 553 req->buf = buf; 554 req->length = len; 555 req->complete = ep_aio_complete; 556 req->context = iocb; 557 value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC); 558 if (unlikely(0 != value)) { 559 usb_ep_free_request(epdata->ep, req); 560 goto fail; 561 } 562 spin_unlock_irq(&epdata->dev->lock); 563 return -EIOCBQUEUED; 564 565 fail: 566 spin_unlock_irq(&epdata->dev->lock); 567 kfree(priv->to_free); 568 kfree(priv); 569 put_ep(epdata); 570 return value; 571 } 572 573 static ssize_t 574 ep_read_iter(struct kiocb *iocb, struct iov_iter *to) 575 { 576 struct file *file = iocb->ki_filp; 577 struct ep_data *epdata = file->private_data; 578 size_t len = iov_iter_count(to); 579 ssize_t value; 580 char *buf; 581 582 if ((value = get_ready_ep(file->f_flags, epdata, false)) < 0) 583 return value; 584 585 /* halt any endpoint by doing a "wrong direction" i/o call */ 586 if (usb_endpoint_dir_in(&epdata->desc)) { 587 if (usb_endpoint_xfer_isoc(&epdata->desc) || 588 !is_sync_kiocb(iocb)) { 589 mutex_unlock(&epdata->lock); 590 return -EINVAL; 591 } 592 DBG (epdata->dev, "%s halt\n", epdata->name); 593 spin_lock_irq(&epdata->dev->lock); 594 if (likely(epdata->ep != NULL)) 595 usb_ep_set_halt(epdata->ep); 596 spin_unlock_irq(&epdata->dev->lock); 597 mutex_unlock(&epdata->lock); 598 return -EBADMSG; 599 } 600 601 buf = kmalloc(len, GFP_KERNEL); 602 if (unlikely(!buf)) { 603 mutex_unlock(&epdata->lock); 604 return -ENOMEM; 605 } 606 if (is_sync_kiocb(iocb)) { 607 value = ep_io(epdata, buf, len); 608 if (value >= 0 && copy_to_iter(buf, value, to)) 609 value = -EFAULT; 610 } else { 611 struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL); 612 value = -ENOMEM; 613 if (!priv) 614 goto fail; 615 priv->to_free = dup_iter(&priv->to, to, GFP_KERNEL); 616 if (!priv->to_free) { 617 kfree(priv); 618 goto fail; 619 } 620 value = ep_aio(iocb, priv, epdata, buf, len); 621 if (value == -EIOCBQUEUED) 622 buf = NULL; 623 } 624 fail: 625 kfree(buf); 626 mutex_unlock(&epdata->lock); 627 return value; 628 } 629 630 static ssize_t ep_config(struct ep_data *, const char *, size_t); 631 632 static ssize_t 633 ep_write_iter(struct kiocb *iocb, struct iov_iter *from) 634 { 635 struct file *file = iocb->ki_filp; 636 struct ep_data *epdata = file->private_data; 637 size_t len = iov_iter_count(from); 638 bool configured; 639 ssize_t value; 640 char *buf; 641 642 if ((value = get_ready_ep(file->f_flags, epdata, true)) < 0) 643 return value; 644 645 configured = epdata->state == STATE_EP_ENABLED; 646 647 /* halt any endpoint by doing a "wrong direction" i/o call */ 648 if (configured && !usb_endpoint_dir_in(&epdata->desc)) { 649 if (usb_endpoint_xfer_isoc(&epdata->desc) || 650 !is_sync_kiocb(iocb)) { 651 mutex_unlock(&epdata->lock); 652 return -EINVAL; 653 } 654 DBG (epdata->dev, "%s halt\n", epdata->name); 655 spin_lock_irq(&epdata->dev->lock); 656 if (likely(epdata->ep != NULL)) 657 usb_ep_set_halt(epdata->ep); 658 spin_unlock_irq(&epdata->dev->lock); 659 mutex_unlock(&epdata->lock); 660 return -EBADMSG; 661 } 662 663 buf = kmalloc(len, GFP_KERNEL); 664 if (unlikely(!buf)) { 665 mutex_unlock(&epdata->lock); 666 return -ENOMEM; 667 } 668 669 if (unlikely(copy_from_iter(buf, len, from) != len)) { 670 value = -EFAULT; 671 goto out; 672 } 673 674 if (unlikely(!configured)) { 675 value = ep_config(epdata, buf, len); 676 } else if (is_sync_kiocb(iocb)) { 677 value = ep_io(epdata, buf, len); 678 } else { 679 struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL); 680 value = -ENOMEM; 681 if (priv) { 682 value = ep_aio(iocb, priv, epdata, buf, len); 683 if (value == -EIOCBQUEUED) 684 buf = NULL; 685 } 686 } 687 out: 688 kfree(buf); 689 mutex_unlock(&epdata->lock); 690 return value; 691 } 692 693 /*----------------------------------------------------------------------*/ 694 695 /* used after endpoint configuration */ 696 static const struct file_operations ep_io_operations = { 697 .owner = THIS_MODULE, 698 699 .open = ep_open, 700 .release = ep_release, 701 .llseek = no_llseek, 702 .unlocked_ioctl = ep_ioctl, 703 .read_iter = ep_read_iter, 704 .write_iter = ep_write_iter, 705 }; 706 707 /* ENDPOINT INITIALIZATION 708 * 709 * fd = open ("/dev/gadget/$ENDPOINT", O_RDWR) 710 * status = write (fd, descriptors, sizeof descriptors) 711 * 712 * That write establishes the endpoint configuration, configuring 713 * the controller to process bulk, interrupt, or isochronous transfers 714 * at the right maxpacket size, and so on. 715 * 716 * The descriptors are message type 1, identified by a host order u32 717 * at the beginning of what's written. Descriptor order is: full/low 718 * speed descriptor, then optional high speed descriptor. 719 */ 720 static ssize_t 721 ep_config (struct ep_data *data, const char *buf, size_t len) 722 { 723 struct usb_ep *ep; 724 u32 tag; 725 int value, length = len; 726 727 if (data->state != STATE_EP_READY) { 728 value = -EL2HLT; 729 goto fail; 730 } 731 732 value = len; 733 if (len < USB_DT_ENDPOINT_SIZE + 4) 734 goto fail0; 735 736 /* we might need to change message format someday */ 737 memcpy(&tag, buf, 4); 738 if (tag != 1) { 739 DBG(data->dev, "config %s, bad tag %d\n", data->name, tag); 740 goto fail0; 741 } 742 buf += 4; 743 len -= 4; 744 745 /* NOTE: audio endpoint extensions not accepted here; 746 * just don't include the extra bytes. 747 */ 748 749 /* full/low speed descriptor, then high speed */ 750 memcpy(&data->desc, buf, USB_DT_ENDPOINT_SIZE); 751 if (data->desc.bLength != USB_DT_ENDPOINT_SIZE 752 || data->desc.bDescriptorType != USB_DT_ENDPOINT) 753 goto fail0; 754 if (len != USB_DT_ENDPOINT_SIZE) { 755 if (len != 2 * USB_DT_ENDPOINT_SIZE) 756 goto fail0; 757 memcpy(&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE, 758 USB_DT_ENDPOINT_SIZE); 759 if (data->hs_desc.bLength != USB_DT_ENDPOINT_SIZE 760 || data->hs_desc.bDescriptorType 761 != USB_DT_ENDPOINT) { 762 DBG(data->dev, "config %s, bad hs length or type\n", 763 data->name); 764 goto fail0; 765 } 766 } 767 768 spin_lock_irq (&data->dev->lock); 769 if (data->dev->state == STATE_DEV_UNBOUND) { 770 value = -ENOENT; 771 goto gone; 772 } else { 773 ep = data->ep; 774 if (ep == NULL) { 775 value = -ENODEV; 776 goto gone; 777 } 778 } 779 switch (data->dev->gadget->speed) { 780 case USB_SPEED_LOW: 781 case USB_SPEED_FULL: 782 ep->desc = &data->desc; 783 break; 784 case USB_SPEED_HIGH: 785 /* fails if caller didn't provide that descriptor... */ 786 ep->desc = &data->hs_desc; 787 break; 788 default: 789 DBG(data->dev, "unconnected, %s init abandoned\n", 790 data->name); 791 value = -EINVAL; 792 goto gone; 793 } 794 value = usb_ep_enable(ep); 795 if (value == 0) { 796 data->state = STATE_EP_ENABLED; 797 value = length; 798 } 799 gone: 800 spin_unlock_irq (&data->dev->lock); 801 if (value < 0) { 802 fail: 803 data->desc.bDescriptorType = 0; 804 data->hs_desc.bDescriptorType = 0; 805 } 806 return value; 807 fail0: 808 value = -EINVAL; 809 goto fail; 810 } 811 812 static int 813 ep_open (struct inode *inode, struct file *fd) 814 { 815 struct ep_data *data = inode->i_private; 816 int value = -EBUSY; 817 818 if (mutex_lock_interruptible(&data->lock) != 0) 819 return -EINTR; 820 spin_lock_irq (&data->dev->lock); 821 if (data->dev->state == STATE_DEV_UNBOUND) 822 value = -ENOENT; 823 else if (data->state == STATE_EP_DISABLED) { 824 value = 0; 825 data->state = STATE_EP_READY; 826 get_ep (data); 827 fd->private_data = data; 828 VDEBUG (data->dev, "%s ready\n", data->name); 829 } else 830 DBG (data->dev, "%s state %d\n", 831 data->name, data->state); 832 spin_unlock_irq (&data->dev->lock); 833 mutex_unlock(&data->lock); 834 return value; 835 } 836 837 /*----------------------------------------------------------------------*/ 838 839 /* EP0 IMPLEMENTATION can be partly in userspace. 840 * 841 * Drivers that use this facility receive various events, including 842 * control requests the kernel doesn't handle. Drivers that don't 843 * use this facility may be too simple-minded for real applications. 844 */ 845 846 static inline void ep0_readable (struct dev_data *dev) 847 { 848 wake_up (&dev->wait); 849 kill_fasync (&dev->fasync, SIGIO, POLL_IN); 850 } 851 852 static void clean_req (struct usb_ep *ep, struct usb_request *req) 853 { 854 struct dev_data *dev = ep->driver_data; 855 856 if (req->buf != dev->rbuf) { 857 kfree(req->buf); 858 req->buf = dev->rbuf; 859 } 860 req->complete = epio_complete; 861 dev->setup_out_ready = 0; 862 } 863 864 static void ep0_complete (struct usb_ep *ep, struct usb_request *req) 865 { 866 struct dev_data *dev = ep->driver_data; 867 unsigned long flags; 868 int free = 1; 869 870 /* for control OUT, data must still get to userspace */ 871 spin_lock_irqsave(&dev->lock, flags); 872 if (!dev->setup_in) { 873 dev->setup_out_error = (req->status != 0); 874 if (!dev->setup_out_error) 875 free = 0; 876 dev->setup_out_ready = 1; 877 ep0_readable (dev); 878 } 879 880 /* clean up as appropriate */ 881 if (free && req->buf != &dev->rbuf) 882 clean_req (ep, req); 883 req->complete = epio_complete; 884 spin_unlock_irqrestore(&dev->lock, flags); 885 } 886 887 static int setup_req (struct usb_ep *ep, struct usb_request *req, u16 len) 888 { 889 struct dev_data *dev = ep->driver_data; 890 891 if (dev->setup_out_ready) { 892 DBG (dev, "ep0 request busy!\n"); 893 return -EBUSY; 894 } 895 if (len > sizeof (dev->rbuf)) 896 req->buf = kmalloc(len, GFP_ATOMIC); 897 if (req->buf == NULL) { 898 req->buf = dev->rbuf; 899 return -ENOMEM; 900 } 901 req->complete = ep0_complete; 902 req->length = len; 903 req->zero = 0; 904 return 0; 905 } 906 907 static ssize_t 908 ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) 909 { 910 struct dev_data *dev = fd->private_data; 911 ssize_t retval; 912 enum ep0_state state; 913 914 spin_lock_irq (&dev->lock); 915 if (dev->state <= STATE_DEV_OPENED) { 916 retval = -EINVAL; 917 goto done; 918 } 919 920 /* report fd mode change before acting on it */ 921 if (dev->setup_abort) { 922 dev->setup_abort = 0; 923 retval = -EIDRM; 924 goto done; 925 } 926 927 /* control DATA stage */ 928 if ((state = dev->state) == STATE_DEV_SETUP) { 929 930 if (dev->setup_in) { /* stall IN */ 931 VDEBUG(dev, "ep0in stall\n"); 932 (void) usb_ep_set_halt (dev->gadget->ep0); 933 retval = -EL2HLT; 934 dev->state = STATE_DEV_CONNECTED; 935 936 } else if (len == 0) { /* ack SET_CONFIGURATION etc */ 937 struct usb_ep *ep = dev->gadget->ep0; 938 struct usb_request *req = dev->req; 939 940 if ((retval = setup_req (ep, req, 0)) == 0) 941 retval = usb_ep_queue (ep, req, GFP_ATOMIC); 942 dev->state = STATE_DEV_CONNECTED; 943 944 /* assume that was SET_CONFIGURATION */ 945 if (dev->current_config) { 946 unsigned power; 947 948 if (gadget_is_dualspeed(dev->gadget) 949 && (dev->gadget->speed 950 == USB_SPEED_HIGH)) 951 power = dev->hs_config->bMaxPower; 952 else 953 power = dev->config->bMaxPower; 954 usb_gadget_vbus_draw(dev->gadget, 2 * power); 955 } 956 957 } else { /* collect OUT data */ 958 if ((fd->f_flags & O_NONBLOCK) != 0 959 && !dev->setup_out_ready) { 960 retval = -EAGAIN; 961 goto done; 962 } 963 spin_unlock_irq (&dev->lock); 964 retval = wait_event_interruptible (dev->wait, 965 dev->setup_out_ready != 0); 966 967 /* FIXME state could change from under us */ 968 spin_lock_irq (&dev->lock); 969 if (retval) 970 goto done; 971 972 if (dev->state != STATE_DEV_SETUP) { 973 retval = -ECANCELED; 974 goto done; 975 } 976 dev->state = STATE_DEV_CONNECTED; 977 978 if (dev->setup_out_error) 979 retval = -EIO; 980 else { 981 len = min (len, (size_t)dev->req->actual); 982 // FIXME don't call this with the spinlock held ... 983 if (copy_to_user (buf, dev->req->buf, len)) 984 retval = -EFAULT; 985 else 986 retval = len; 987 clean_req (dev->gadget->ep0, dev->req); 988 /* NOTE userspace can't yet choose to stall */ 989 } 990 } 991 goto done; 992 } 993 994 /* else normal: return event data */ 995 if (len < sizeof dev->event [0]) { 996 retval = -EINVAL; 997 goto done; 998 } 999 len -= len % sizeof (struct usb_gadgetfs_event); 1000 dev->usermode_setup = 1; 1001 1002 scan: 1003 /* return queued events right away */ 1004 if (dev->ev_next != 0) { 1005 unsigned i, n; 1006 1007 n = len / sizeof (struct usb_gadgetfs_event); 1008 if (dev->ev_next < n) 1009 n = dev->ev_next; 1010 1011 /* ep0 i/o has special semantics during STATE_DEV_SETUP */ 1012 for (i = 0; i < n; i++) { 1013 if (dev->event [i].type == GADGETFS_SETUP) { 1014 dev->state = STATE_DEV_SETUP; 1015 n = i + 1; 1016 break; 1017 } 1018 } 1019 spin_unlock_irq (&dev->lock); 1020 len = n * sizeof (struct usb_gadgetfs_event); 1021 if (copy_to_user (buf, &dev->event, len)) 1022 retval = -EFAULT; 1023 else 1024 retval = len; 1025 if (len > 0) { 1026 /* NOTE this doesn't guard against broken drivers; 1027 * concurrent ep0 readers may lose events. 1028 */ 1029 spin_lock_irq (&dev->lock); 1030 if (dev->ev_next > n) { 1031 memmove(&dev->event[0], &dev->event[n], 1032 sizeof (struct usb_gadgetfs_event) 1033 * (dev->ev_next - n)); 1034 } 1035 dev->ev_next -= n; 1036 spin_unlock_irq (&dev->lock); 1037 } 1038 return retval; 1039 } 1040 if (fd->f_flags & O_NONBLOCK) { 1041 retval = -EAGAIN; 1042 goto done; 1043 } 1044 1045 switch (state) { 1046 default: 1047 DBG (dev, "fail %s, state %d\n", __func__, state); 1048 retval = -ESRCH; 1049 break; 1050 case STATE_DEV_UNCONNECTED: 1051 case STATE_DEV_CONNECTED: 1052 spin_unlock_irq (&dev->lock); 1053 DBG (dev, "%s wait\n", __func__); 1054 1055 /* wait for events */ 1056 retval = wait_event_interruptible (dev->wait, 1057 dev->ev_next != 0); 1058 if (retval < 0) 1059 return retval; 1060 spin_lock_irq (&dev->lock); 1061 goto scan; 1062 } 1063 1064 done: 1065 spin_unlock_irq (&dev->lock); 1066 return retval; 1067 } 1068 1069 static struct usb_gadgetfs_event * 1070 next_event (struct dev_data *dev, enum usb_gadgetfs_event_type type) 1071 { 1072 struct usb_gadgetfs_event *event; 1073 unsigned i; 1074 1075 switch (type) { 1076 /* these events purge the queue */ 1077 case GADGETFS_DISCONNECT: 1078 if (dev->state == STATE_DEV_SETUP) 1079 dev->setup_abort = 1; 1080 // FALL THROUGH 1081 case GADGETFS_CONNECT: 1082 dev->ev_next = 0; 1083 break; 1084 case GADGETFS_SETUP: /* previous request timed out */ 1085 case GADGETFS_SUSPEND: /* same effect */ 1086 /* these events can't be repeated */ 1087 for (i = 0; i != dev->ev_next; i++) { 1088 if (dev->event [i].type != type) 1089 continue; 1090 DBG(dev, "discard old event[%d] %d\n", i, type); 1091 dev->ev_next--; 1092 if (i == dev->ev_next) 1093 break; 1094 /* indices start at zero, for simplicity */ 1095 memmove (&dev->event [i], &dev->event [i + 1], 1096 sizeof (struct usb_gadgetfs_event) 1097 * (dev->ev_next - i)); 1098 } 1099 break; 1100 default: 1101 BUG (); 1102 } 1103 VDEBUG(dev, "event[%d] = %d\n", dev->ev_next, type); 1104 event = &dev->event [dev->ev_next++]; 1105 BUG_ON (dev->ev_next > N_EVENT); 1106 memset (event, 0, sizeof *event); 1107 event->type = type; 1108 return event; 1109 } 1110 1111 static ssize_t 1112 ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) 1113 { 1114 struct dev_data *dev = fd->private_data; 1115 ssize_t retval = -ESRCH; 1116 1117 /* report fd mode change before acting on it */ 1118 if (dev->setup_abort) { 1119 dev->setup_abort = 0; 1120 retval = -EIDRM; 1121 1122 /* data and/or status stage for control request */ 1123 } else if (dev->state == STATE_DEV_SETUP) { 1124 1125 /* IN DATA+STATUS caller makes len <= wLength */ 1126 if (dev->setup_in) { 1127 retval = setup_req (dev->gadget->ep0, dev->req, len); 1128 if (retval == 0) { 1129 dev->state = STATE_DEV_CONNECTED; 1130 spin_unlock_irq (&dev->lock); 1131 if (copy_from_user (dev->req->buf, buf, len)) 1132 retval = -EFAULT; 1133 else { 1134 if (len < dev->setup_wLength) 1135 dev->req->zero = 1; 1136 retval = usb_ep_queue ( 1137 dev->gadget->ep0, dev->req, 1138 GFP_KERNEL); 1139 } 1140 spin_lock_irq(&dev->lock); 1141 if (retval < 0) { 1142 clean_req (dev->gadget->ep0, dev->req); 1143 } else 1144 retval = len; 1145 1146 return retval; 1147 } 1148 1149 /* can stall some OUT transfers */ 1150 } else if (dev->setup_can_stall) { 1151 VDEBUG(dev, "ep0out stall\n"); 1152 (void) usb_ep_set_halt (dev->gadget->ep0); 1153 retval = -EL2HLT; 1154 dev->state = STATE_DEV_CONNECTED; 1155 } else { 1156 DBG(dev, "bogus ep0out stall!\n"); 1157 } 1158 } else 1159 DBG (dev, "fail %s, state %d\n", __func__, dev->state); 1160 1161 return retval; 1162 } 1163 1164 static int 1165 ep0_fasync (int f, struct file *fd, int on) 1166 { 1167 struct dev_data *dev = fd->private_data; 1168 // caller must F_SETOWN before signal delivery happens 1169 VDEBUG (dev, "%s %s\n", __func__, on ? "on" : "off"); 1170 return fasync_helper (f, fd, on, &dev->fasync); 1171 } 1172 1173 static struct usb_gadget_driver gadgetfs_driver; 1174 1175 static int 1176 dev_release (struct inode *inode, struct file *fd) 1177 { 1178 struct dev_data *dev = fd->private_data; 1179 1180 /* closing ep0 === shutdown all */ 1181 1182 usb_gadget_unregister_driver (&gadgetfs_driver); 1183 1184 /* at this point "good" hardware has disconnected the 1185 * device from USB; the host won't see it any more. 1186 * alternatively, all host requests will time out. 1187 */ 1188 1189 kfree (dev->buf); 1190 dev->buf = NULL; 1191 1192 /* other endpoints were all decoupled from this device */ 1193 spin_lock_irq(&dev->lock); 1194 dev->state = STATE_DEV_DISABLED; 1195 spin_unlock_irq(&dev->lock); 1196 1197 put_dev (dev); 1198 return 0; 1199 } 1200 1201 static unsigned int 1202 ep0_poll (struct file *fd, poll_table *wait) 1203 { 1204 struct dev_data *dev = fd->private_data; 1205 int mask = 0; 1206 1207 if (dev->state <= STATE_DEV_OPENED) 1208 return DEFAULT_POLLMASK; 1209 1210 poll_wait(fd, &dev->wait, wait); 1211 1212 spin_lock_irq (&dev->lock); 1213 1214 /* report fd mode change before acting on it */ 1215 if (dev->setup_abort) { 1216 dev->setup_abort = 0; 1217 mask = POLLHUP; 1218 goto out; 1219 } 1220 1221 if (dev->state == STATE_DEV_SETUP) { 1222 if (dev->setup_in || dev->setup_can_stall) 1223 mask = POLLOUT; 1224 } else { 1225 if (dev->ev_next != 0) 1226 mask = POLLIN; 1227 } 1228 out: 1229 spin_unlock_irq(&dev->lock); 1230 return mask; 1231 } 1232 1233 static long dev_ioctl (struct file *fd, unsigned code, unsigned long value) 1234 { 1235 struct dev_data *dev = fd->private_data; 1236 struct usb_gadget *gadget = dev->gadget; 1237 long ret = -ENOTTY; 1238 1239 if (gadget->ops->ioctl) 1240 ret = gadget->ops->ioctl (gadget, code, value); 1241 1242 return ret; 1243 } 1244 1245 /*----------------------------------------------------------------------*/ 1246 1247 /* The in-kernel gadget driver handles most ep0 issues, in particular 1248 * enumerating the single configuration (as provided from user space). 1249 * 1250 * Unrecognized ep0 requests may be handled in user space. 1251 */ 1252 1253 static void make_qualifier (struct dev_data *dev) 1254 { 1255 struct usb_qualifier_descriptor qual; 1256 struct usb_device_descriptor *desc; 1257 1258 qual.bLength = sizeof qual; 1259 qual.bDescriptorType = USB_DT_DEVICE_QUALIFIER; 1260 qual.bcdUSB = cpu_to_le16 (0x0200); 1261 1262 desc = dev->dev; 1263 qual.bDeviceClass = desc->bDeviceClass; 1264 qual.bDeviceSubClass = desc->bDeviceSubClass; 1265 qual.bDeviceProtocol = desc->bDeviceProtocol; 1266 1267 /* assumes ep0 uses the same value for both speeds ... */ 1268 qual.bMaxPacketSize0 = dev->gadget->ep0->maxpacket; 1269 1270 qual.bNumConfigurations = 1; 1271 qual.bRESERVED = 0; 1272 1273 memcpy (dev->rbuf, &qual, sizeof qual); 1274 } 1275 1276 static int 1277 config_buf (struct dev_data *dev, u8 type, unsigned index) 1278 { 1279 int len; 1280 int hs = 0; 1281 1282 /* only one configuration */ 1283 if (index > 0) 1284 return -EINVAL; 1285 1286 if (gadget_is_dualspeed(dev->gadget)) { 1287 hs = (dev->gadget->speed == USB_SPEED_HIGH); 1288 if (type == USB_DT_OTHER_SPEED_CONFIG) 1289 hs = !hs; 1290 } 1291 if (hs) { 1292 dev->req->buf = dev->hs_config; 1293 len = le16_to_cpu(dev->hs_config->wTotalLength); 1294 } else { 1295 dev->req->buf = dev->config; 1296 len = le16_to_cpu(dev->config->wTotalLength); 1297 } 1298 ((u8 *)dev->req->buf) [1] = type; 1299 return len; 1300 } 1301 1302 static int 1303 gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) 1304 { 1305 struct dev_data *dev = get_gadget_data (gadget); 1306 struct usb_request *req = dev->req; 1307 int value = -EOPNOTSUPP; 1308 struct usb_gadgetfs_event *event; 1309 u16 w_value = le16_to_cpu(ctrl->wValue); 1310 u16 w_length = le16_to_cpu(ctrl->wLength); 1311 1312 spin_lock (&dev->lock); 1313 dev->setup_abort = 0; 1314 if (dev->state == STATE_DEV_UNCONNECTED) { 1315 if (gadget_is_dualspeed(gadget) 1316 && gadget->speed == USB_SPEED_HIGH 1317 && dev->hs_config == NULL) { 1318 spin_unlock(&dev->lock); 1319 ERROR (dev, "no high speed config??\n"); 1320 return -EINVAL; 1321 } 1322 1323 dev->state = STATE_DEV_CONNECTED; 1324 1325 INFO (dev, "connected\n"); 1326 event = next_event (dev, GADGETFS_CONNECT); 1327 event->u.speed = gadget->speed; 1328 ep0_readable (dev); 1329 1330 /* host may have given up waiting for response. we can miss control 1331 * requests handled lower down (device/endpoint status and features); 1332 * then ep0_{read,write} will report the wrong status. controller 1333 * driver will have aborted pending i/o. 1334 */ 1335 } else if (dev->state == STATE_DEV_SETUP) 1336 dev->setup_abort = 1; 1337 1338 req->buf = dev->rbuf; 1339 req->context = NULL; 1340 value = -EOPNOTSUPP; 1341 switch (ctrl->bRequest) { 1342 1343 case USB_REQ_GET_DESCRIPTOR: 1344 if (ctrl->bRequestType != USB_DIR_IN) 1345 goto unrecognized; 1346 switch (w_value >> 8) { 1347 1348 case USB_DT_DEVICE: 1349 value = min (w_length, (u16) sizeof *dev->dev); 1350 dev->dev->bMaxPacketSize0 = dev->gadget->ep0->maxpacket; 1351 req->buf = dev->dev; 1352 break; 1353 case USB_DT_DEVICE_QUALIFIER: 1354 if (!dev->hs_config) 1355 break; 1356 value = min (w_length, (u16) 1357 sizeof (struct usb_qualifier_descriptor)); 1358 make_qualifier (dev); 1359 break; 1360 case USB_DT_OTHER_SPEED_CONFIG: 1361 // FALLTHROUGH 1362 case USB_DT_CONFIG: 1363 value = config_buf (dev, 1364 w_value >> 8, 1365 w_value & 0xff); 1366 if (value >= 0) 1367 value = min (w_length, (u16) value); 1368 break; 1369 case USB_DT_STRING: 1370 goto unrecognized; 1371 1372 default: // all others are errors 1373 break; 1374 } 1375 break; 1376 1377 /* currently one config, two speeds */ 1378 case USB_REQ_SET_CONFIGURATION: 1379 if (ctrl->bRequestType != 0) 1380 goto unrecognized; 1381 if (0 == (u8) w_value) { 1382 value = 0; 1383 dev->current_config = 0; 1384 usb_gadget_vbus_draw(gadget, 8 /* mA */ ); 1385 // user mode expected to disable endpoints 1386 } else { 1387 u8 config, power; 1388 1389 if (gadget_is_dualspeed(gadget) 1390 && gadget->speed == USB_SPEED_HIGH) { 1391 config = dev->hs_config->bConfigurationValue; 1392 power = dev->hs_config->bMaxPower; 1393 } else { 1394 config = dev->config->bConfigurationValue; 1395 power = dev->config->bMaxPower; 1396 } 1397 1398 if (config == (u8) w_value) { 1399 value = 0; 1400 dev->current_config = config; 1401 usb_gadget_vbus_draw(gadget, 2 * power); 1402 } 1403 } 1404 1405 /* report SET_CONFIGURATION like any other control request, 1406 * except that usermode may not stall this. the next 1407 * request mustn't be allowed start until this finishes: 1408 * endpoints and threads set up, etc. 1409 * 1410 * NOTE: older PXA hardware (before PXA 255: without UDCCFR) 1411 * has bad/racey automagic that prevents synchronizing here. 1412 * even kernel mode drivers often miss them. 1413 */ 1414 if (value == 0) { 1415 INFO (dev, "configuration #%d\n", dev->current_config); 1416 usb_gadget_set_state(gadget, USB_STATE_CONFIGURED); 1417 if (dev->usermode_setup) { 1418 dev->setup_can_stall = 0; 1419 goto delegate; 1420 } 1421 } 1422 break; 1423 1424 #ifndef CONFIG_USB_PXA25X 1425 /* PXA automagically handles this request too */ 1426 case USB_REQ_GET_CONFIGURATION: 1427 if (ctrl->bRequestType != 0x80) 1428 goto unrecognized; 1429 *(u8 *)req->buf = dev->current_config; 1430 value = min (w_length, (u16) 1); 1431 break; 1432 #endif 1433 1434 default: 1435 unrecognized: 1436 VDEBUG (dev, "%s req%02x.%02x v%04x i%04x l%d\n", 1437 dev->usermode_setup ? "delegate" : "fail", 1438 ctrl->bRequestType, ctrl->bRequest, 1439 w_value, le16_to_cpu(ctrl->wIndex), w_length); 1440 1441 /* if there's an ep0 reader, don't stall */ 1442 if (dev->usermode_setup) { 1443 dev->setup_can_stall = 1; 1444 delegate: 1445 dev->setup_in = (ctrl->bRequestType & USB_DIR_IN) 1446 ? 1 : 0; 1447 dev->setup_wLength = w_length; 1448 dev->setup_out_ready = 0; 1449 dev->setup_out_error = 0; 1450 value = 0; 1451 1452 /* read DATA stage for OUT right away */ 1453 if (unlikely (!dev->setup_in && w_length)) { 1454 value = setup_req (gadget->ep0, dev->req, 1455 w_length); 1456 if (value < 0) 1457 break; 1458 value = usb_ep_queue (gadget->ep0, dev->req, 1459 GFP_ATOMIC); 1460 if (value < 0) { 1461 clean_req (gadget->ep0, dev->req); 1462 break; 1463 } 1464 1465 /* we can't currently stall these */ 1466 dev->setup_can_stall = 0; 1467 } 1468 1469 /* state changes when reader collects event */ 1470 event = next_event (dev, GADGETFS_SETUP); 1471 event->u.setup = *ctrl; 1472 ep0_readable (dev); 1473 spin_unlock (&dev->lock); 1474 return 0; 1475 } 1476 } 1477 1478 /* proceed with data transfer and status phases? */ 1479 if (value >= 0 && dev->state != STATE_DEV_SETUP) { 1480 req->length = value; 1481 req->zero = value < w_length; 1482 value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC); 1483 if (value < 0) { 1484 DBG (dev, "ep_queue --> %d\n", value); 1485 req->status = 0; 1486 } 1487 } 1488 1489 /* device stalls when value < 0 */ 1490 spin_unlock (&dev->lock); 1491 return value; 1492 } 1493 1494 static void destroy_ep_files (struct dev_data *dev) 1495 { 1496 DBG (dev, "%s %d\n", __func__, dev->state); 1497 1498 /* dev->state must prevent interference */ 1499 spin_lock_irq (&dev->lock); 1500 while (!list_empty(&dev->epfiles)) { 1501 struct ep_data *ep; 1502 struct inode *parent; 1503 struct dentry *dentry; 1504 1505 /* break link to FS */ 1506 ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles); 1507 list_del_init (&ep->epfiles); 1508 dentry = ep->dentry; 1509 ep->dentry = NULL; 1510 parent = d_inode(dentry->d_parent); 1511 1512 /* break link to controller */ 1513 if (ep->state == STATE_EP_ENABLED) 1514 (void) usb_ep_disable (ep->ep); 1515 ep->state = STATE_EP_UNBOUND; 1516 usb_ep_free_request (ep->ep, ep->req); 1517 ep->ep = NULL; 1518 wake_up (&ep->wait); 1519 put_ep (ep); 1520 1521 spin_unlock_irq (&dev->lock); 1522 1523 /* break link to dcache */ 1524 inode_lock(parent); 1525 d_delete (dentry); 1526 dput (dentry); 1527 inode_unlock(parent); 1528 1529 spin_lock_irq (&dev->lock); 1530 } 1531 spin_unlock_irq (&dev->lock); 1532 } 1533 1534 1535 static struct dentry * 1536 gadgetfs_create_file (struct super_block *sb, char const *name, 1537 void *data, const struct file_operations *fops); 1538 1539 static int activate_ep_files (struct dev_data *dev) 1540 { 1541 struct usb_ep *ep; 1542 struct ep_data *data; 1543 1544 gadget_for_each_ep (ep, dev->gadget) { 1545 1546 data = kzalloc(sizeof(*data), GFP_KERNEL); 1547 if (!data) 1548 goto enomem0; 1549 data->state = STATE_EP_DISABLED; 1550 mutex_init(&data->lock); 1551 init_waitqueue_head (&data->wait); 1552 1553 strncpy (data->name, ep->name, sizeof (data->name) - 1); 1554 atomic_set (&data->count, 1); 1555 data->dev = dev; 1556 get_dev (dev); 1557 1558 data->ep = ep; 1559 ep->driver_data = data; 1560 1561 data->req = usb_ep_alloc_request (ep, GFP_KERNEL); 1562 if (!data->req) 1563 goto enomem1; 1564 1565 data->dentry = gadgetfs_create_file (dev->sb, data->name, 1566 data, &ep_io_operations); 1567 if (!data->dentry) 1568 goto enomem2; 1569 list_add_tail (&data->epfiles, &dev->epfiles); 1570 } 1571 return 0; 1572 1573 enomem2: 1574 usb_ep_free_request (ep, data->req); 1575 enomem1: 1576 put_dev (dev); 1577 kfree (data); 1578 enomem0: 1579 DBG (dev, "%s enomem\n", __func__); 1580 destroy_ep_files (dev); 1581 return -ENOMEM; 1582 } 1583 1584 static void 1585 gadgetfs_unbind (struct usb_gadget *gadget) 1586 { 1587 struct dev_data *dev = get_gadget_data (gadget); 1588 1589 DBG (dev, "%s\n", __func__); 1590 1591 spin_lock_irq (&dev->lock); 1592 dev->state = STATE_DEV_UNBOUND; 1593 spin_unlock_irq (&dev->lock); 1594 1595 destroy_ep_files (dev); 1596 gadget->ep0->driver_data = NULL; 1597 set_gadget_data (gadget, NULL); 1598 1599 /* we've already been disconnected ... no i/o is active */ 1600 if (dev->req) 1601 usb_ep_free_request (gadget->ep0, dev->req); 1602 DBG (dev, "%s done\n", __func__); 1603 put_dev (dev); 1604 } 1605 1606 static struct dev_data *the_device; 1607 1608 static int gadgetfs_bind(struct usb_gadget *gadget, 1609 struct usb_gadget_driver *driver) 1610 { 1611 struct dev_data *dev = the_device; 1612 1613 if (!dev) 1614 return -ESRCH; 1615 if (0 != strcmp (CHIP, gadget->name)) { 1616 pr_err("%s expected %s controller not %s\n", 1617 shortname, CHIP, gadget->name); 1618 return -ENODEV; 1619 } 1620 1621 set_gadget_data (gadget, dev); 1622 dev->gadget = gadget; 1623 gadget->ep0->driver_data = dev; 1624 1625 /* preallocate control response and buffer */ 1626 dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL); 1627 if (!dev->req) 1628 goto enomem; 1629 dev->req->context = NULL; 1630 dev->req->complete = epio_complete; 1631 1632 if (activate_ep_files (dev) < 0) 1633 goto enomem; 1634 1635 INFO (dev, "bound to %s driver\n", gadget->name); 1636 spin_lock_irq(&dev->lock); 1637 dev->state = STATE_DEV_UNCONNECTED; 1638 spin_unlock_irq(&dev->lock); 1639 get_dev (dev); 1640 return 0; 1641 1642 enomem: 1643 gadgetfs_unbind (gadget); 1644 return -ENOMEM; 1645 } 1646 1647 static void 1648 gadgetfs_disconnect (struct usb_gadget *gadget) 1649 { 1650 struct dev_data *dev = get_gadget_data (gadget); 1651 unsigned long flags; 1652 1653 spin_lock_irqsave (&dev->lock, flags); 1654 if (dev->state == STATE_DEV_UNCONNECTED) 1655 goto exit; 1656 dev->state = STATE_DEV_UNCONNECTED; 1657 1658 INFO (dev, "disconnected\n"); 1659 next_event (dev, GADGETFS_DISCONNECT); 1660 ep0_readable (dev); 1661 exit: 1662 spin_unlock_irqrestore (&dev->lock, flags); 1663 } 1664 1665 static void 1666 gadgetfs_suspend (struct usb_gadget *gadget) 1667 { 1668 struct dev_data *dev = get_gadget_data (gadget); 1669 1670 INFO (dev, "suspended from state %d\n", dev->state); 1671 spin_lock (&dev->lock); 1672 switch (dev->state) { 1673 case STATE_DEV_SETUP: // VERY odd... host died?? 1674 case STATE_DEV_CONNECTED: 1675 case STATE_DEV_UNCONNECTED: 1676 next_event (dev, GADGETFS_SUSPEND); 1677 ep0_readable (dev); 1678 /* FALLTHROUGH */ 1679 default: 1680 break; 1681 } 1682 spin_unlock (&dev->lock); 1683 } 1684 1685 static struct usb_gadget_driver gadgetfs_driver = { 1686 .function = (char *) driver_desc, 1687 .bind = gadgetfs_bind, 1688 .unbind = gadgetfs_unbind, 1689 .setup = gadgetfs_setup, 1690 .reset = gadgetfs_disconnect, 1691 .disconnect = gadgetfs_disconnect, 1692 .suspend = gadgetfs_suspend, 1693 1694 .driver = { 1695 .name = (char *) shortname, 1696 }, 1697 }; 1698 1699 /*----------------------------------------------------------------------*/ 1700 1701 static void gadgetfs_nop(struct usb_gadget *arg) { } 1702 1703 static int gadgetfs_probe(struct usb_gadget *gadget, 1704 struct usb_gadget_driver *driver) 1705 { 1706 CHIP = gadget->name; 1707 return -EISNAM; 1708 } 1709 1710 static struct usb_gadget_driver probe_driver = { 1711 .max_speed = USB_SPEED_HIGH, 1712 .bind = gadgetfs_probe, 1713 .unbind = gadgetfs_nop, 1714 .setup = (void *)gadgetfs_nop, 1715 .disconnect = gadgetfs_nop, 1716 .driver = { 1717 .name = "nop", 1718 }, 1719 }; 1720 1721 1722 /* DEVICE INITIALIZATION 1723 * 1724 * fd = open ("/dev/gadget/$CHIP", O_RDWR) 1725 * status = write (fd, descriptors, sizeof descriptors) 1726 * 1727 * That write establishes the device configuration, so the kernel can 1728 * bind to the controller ... guaranteeing it can handle enumeration 1729 * at all necessary speeds. Descriptor order is: 1730 * 1731 * . message tag (u32, host order) ... for now, must be zero; it 1732 * would change to support features like multi-config devices 1733 * . full/low speed config ... all wTotalLength bytes (with interface, 1734 * class, altsetting, endpoint, and other descriptors) 1735 * . high speed config ... all descriptors, for high speed operation; 1736 * this one's optional except for high-speed hardware 1737 * . device descriptor 1738 * 1739 * Endpoints are not yet enabled. Drivers must wait until device 1740 * configuration and interface altsetting changes create 1741 * the need to configure (or unconfigure) them. 1742 * 1743 * After initialization, the device stays active for as long as that 1744 * $CHIP file is open. Events must then be read from that descriptor, 1745 * such as configuration notifications. 1746 */ 1747 1748 static int is_valid_config (struct usb_config_descriptor *config) 1749 { 1750 return config->bDescriptorType == USB_DT_CONFIG 1751 && config->bLength == USB_DT_CONFIG_SIZE 1752 && config->bConfigurationValue != 0 1753 && (config->bmAttributes & USB_CONFIG_ATT_ONE) != 0 1754 && (config->bmAttributes & USB_CONFIG_ATT_WAKEUP) == 0; 1755 /* FIXME if gadget->is_otg, _must_ include an otg descriptor */ 1756 /* FIXME check lengths: walk to end */ 1757 } 1758 1759 static ssize_t 1760 dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) 1761 { 1762 struct dev_data *dev = fd->private_data; 1763 ssize_t value = len, length = len; 1764 unsigned total; 1765 u32 tag; 1766 char *kbuf; 1767 1768 spin_lock_irq(&dev->lock); 1769 if (dev->state > STATE_DEV_OPENED) { 1770 value = ep0_write(fd, buf, len, ptr); 1771 spin_unlock_irq(&dev->lock); 1772 return value; 1773 } 1774 spin_unlock_irq(&dev->lock); 1775 1776 if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4)) 1777 return -EINVAL; 1778 1779 /* we might need to change message format someday */ 1780 if (copy_from_user (&tag, buf, 4)) 1781 return -EFAULT; 1782 if (tag != 0) 1783 return -EINVAL; 1784 buf += 4; 1785 length -= 4; 1786 1787 kbuf = memdup_user(buf, length); 1788 if (IS_ERR(kbuf)) 1789 return PTR_ERR(kbuf); 1790 1791 spin_lock_irq (&dev->lock); 1792 value = -EINVAL; 1793 if (dev->buf) 1794 goto fail; 1795 dev->buf = kbuf; 1796 1797 /* full or low speed config */ 1798 dev->config = (void *) kbuf; 1799 total = le16_to_cpu(dev->config->wTotalLength); 1800 if (!is_valid_config (dev->config) || total >= length) 1801 goto fail; 1802 kbuf += total; 1803 length -= total; 1804 1805 /* optional high speed config */ 1806 if (kbuf [1] == USB_DT_CONFIG) { 1807 dev->hs_config = (void *) kbuf; 1808 total = le16_to_cpu(dev->hs_config->wTotalLength); 1809 if (!is_valid_config (dev->hs_config) || total >= length) 1810 goto fail; 1811 kbuf += total; 1812 length -= total; 1813 } 1814 1815 /* could support multiple configs, using another encoding! */ 1816 1817 /* device descriptor (tweaked for paranoia) */ 1818 if (length != USB_DT_DEVICE_SIZE) 1819 goto fail; 1820 dev->dev = (void *)kbuf; 1821 if (dev->dev->bLength != USB_DT_DEVICE_SIZE 1822 || dev->dev->bDescriptorType != USB_DT_DEVICE 1823 || dev->dev->bNumConfigurations != 1) 1824 goto fail; 1825 dev->dev->bNumConfigurations = 1; 1826 dev->dev->bcdUSB = cpu_to_le16 (0x0200); 1827 1828 /* triggers gadgetfs_bind(); then we can enumerate. */ 1829 spin_unlock_irq (&dev->lock); 1830 if (dev->hs_config) 1831 gadgetfs_driver.max_speed = USB_SPEED_HIGH; 1832 else 1833 gadgetfs_driver.max_speed = USB_SPEED_FULL; 1834 1835 value = usb_gadget_probe_driver(&gadgetfs_driver); 1836 if (value != 0) { 1837 kfree (dev->buf); 1838 dev->buf = NULL; 1839 } else { 1840 /* at this point "good" hardware has for the first time 1841 * let the USB the host see us. alternatively, if users 1842 * unplug/replug that will clear all the error state. 1843 * 1844 * note: everything running before here was guaranteed 1845 * to choke driver model style diagnostics. from here 1846 * on, they can work ... except in cleanup paths that 1847 * kick in after the ep0 descriptor is closed. 1848 */ 1849 value = len; 1850 } 1851 return value; 1852 1853 fail: 1854 spin_unlock_irq (&dev->lock); 1855 pr_debug ("%s: %s fail %Zd, %p\n", shortname, __func__, value, dev); 1856 kfree (dev->buf); 1857 dev->buf = NULL; 1858 return value; 1859 } 1860 1861 static int 1862 dev_open (struct inode *inode, struct file *fd) 1863 { 1864 struct dev_data *dev = inode->i_private; 1865 int value = -EBUSY; 1866 1867 spin_lock_irq(&dev->lock); 1868 if (dev->state == STATE_DEV_DISABLED) { 1869 dev->ev_next = 0; 1870 dev->state = STATE_DEV_OPENED; 1871 fd->private_data = dev; 1872 get_dev (dev); 1873 value = 0; 1874 } 1875 spin_unlock_irq(&dev->lock); 1876 return value; 1877 } 1878 1879 static const struct file_operations ep0_operations = { 1880 .llseek = no_llseek, 1881 1882 .open = dev_open, 1883 .read = ep0_read, 1884 .write = dev_config, 1885 .fasync = ep0_fasync, 1886 .poll = ep0_poll, 1887 .unlocked_ioctl = dev_ioctl, 1888 .release = dev_release, 1889 }; 1890 1891 /*----------------------------------------------------------------------*/ 1892 1893 /* FILESYSTEM AND SUPERBLOCK OPERATIONS 1894 * 1895 * Mounting the filesystem creates a controller file, used first for 1896 * device configuration then later for event monitoring. 1897 */ 1898 1899 1900 /* FIXME PAM etc could set this security policy without mount options 1901 * if epfiles inherited ownership and permissons from ep0 ... 1902 */ 1903 1904 static unsigned default_uid; 1905 static unsigned default_gid; 1906 static unsigned default_perm = S_IRUSR | S_IWUSR; 1907 1908 module_param (default_uid, uint, 0644); 1909 module_param (default_gid, uint, 0644); 1910 module_param (default_perm, uint, 0644); 1911 1912 1913 static struct inode * 1914 gadgetfs_make_inode (struct super_block *sb, 1915 void *data, const struct file_operations *fops, 1916 int mode) 1917 { 1918 struct inode *inode = new_inode (sb); 1919 1920 if (inode) { 1921 inode->i_ino = get_next_ino(); 1922 inode->i_mode = mode; 1923 inode->i_uid = make_kuid(&init_user_ns, default_uid); 1924 inode->i_gid = make_kgid(&init_user_ns, default_gid); 1925 inode->i_atime = inode->i_mtime = inode->i_ctime 1926 = CURRENT_TIME; 1927 inode->i_private = data; 1928 inode->i_fop = fops; 1929 } 1930 return inode; 1931 } 1932 1933 /* creates in fs root directory, so non-renamable and non-linkable. 1934 * so inode and dentry are paired, until device reconfig. 1935 */ 1936 static struct dentry * 1937 gadgetfs_create_file (struct super_block *sb, char const *name, 1938 void *data, const struct file_operations *fops) 1939 { 1940 struct dentry *dentry; 1941 struct inode *inode; 1942 1943 dentry = d_alloc_name(sb->s_root, name); 1944 if (!dentry) 1945 return NULL; 1946 1947 inode = gadgetfs_make_inode (sb, data, fops, 1948 S_IFREG | (default_perm & S_IRWXUGO)); 1949 if (!inode) { 1950 dput(dentry); 1951 return NULL; 1952 } 1953 d_add (dentry, inode); 1954 return dentry; 1955 } 1956 1957 static const struct super_operations gadget_fs_operations = { 1958 .statfs = simple_statfs, 1959 .drop_inode = generic_delete_inode, 1960 }; 1961 1962 static int 1963 gadgetfs_fill_super (struct super_block *sb, void *opts, int silent) 1964 { 1965 struct inode *inode; 1966 struct dev_data *dev; 1967 1968 if (the_device) 1969 return -ESRCH; 1970 1971 /* fake probe to determine $CHIP */ 1972 CHIP = NULL; 1973 usb_gadget_probe_driver(&probe_driver); 1974 if (!CHIP) 1975 return -ENODEV; 1976 1977 /* superblock */ 1978 sb->s_blocksize = PAGE_CACHE_SIZE; 1979 sb->s_blocksize_bits = PAGE_CACHE_SHIFT; 1980 sb->s_magic = GADGETFS_MAGIC; 1981 sb->s_op = &gadget_fs_operations; 1982 sb->s_time_gran = 1; 1983 1984 /* root inode */ 1985 inode = gadgetfs_make_inode (sb, 1986 NULL, &simple_dir_operations, 1987 S_IFDIR | S_IRUGO | S_IXUGO); 1988 if (!inode) 1989 goto Enomem; 1990 inode->i_op = &simple_dir_inode_operations; 1991 if (!(sb->s_root = d_make_root (inode))) 1992 goto Enomem; 1993 1994 /* the ep0 file is named after the controller we expect; 1995 * user mode code can use it for sanity checks, like we do. 1996 */ 1997 dev = dev_new (); 1998 if (!dev) 1999 goto Enomem; 2000 2001 dev->sb = sb; 2002 dev->dentry = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations); 2003 if (!dev->dentry) { 2004 put_dev(dev); 2005 goto Enomem; 2006 } 2007 2008 /* other endpoint files are available after hardware setup, 2009 * from binding to a controller. 2010 */ 2011 the_device = dev; 2012 return 0; 2013 2014 Enomem: 2015 return -ENOMEM; 2016 } 2017 2018 /* "mount -t gadgetfs path /dev/gadget" ends up here */ 2019 static struct dentry * 2020 gadgetfs_mount (struct file_system_type *t, int flags, 2021 const char *path, void *opts) 2022 { 2023 return mount_single (t, flags, opts, gadgetfs_fill_super); 2024 } 2025 2026 static void 2027 gadgetfs_kill_sb (struct super_block *sb) 2028 { 2029 kill_litter_super (sb); 2030 if (the_device) { 2031 put_dev (the_device); 2032 the_device = NULL; 2033 } 2034 } 2035 2036 /*----------------------------------------------------------------------*/ 2037 2038 static struct file_system_type gadgetfs_type = { 2039 .owner = THIS_MODULE, 2040 .name = shortname, 2041 .mount = gadgetfs_mount, 2042 .kill_sb = gadgetfs_kill_sb, 2043 }; 2044 MODULE_ALIAS_FS("gadgetfs"); 2045 2046 /*----------------------------------------------------------------------*/ 2047 2048 static int __init init (void) 2049 { 2050 int status; 2051 2052 status = register_filesystem (&gadgetfs_type); 2053 if (status == 0) 2054 pr_info ("%s: %s, version " DRIVER_VERSION "\n", 2055 shortname, driver_desc); 2056 return status; 2057 } 2058 module_init (init); 2059 2060 static void __exit cleanup (void) 2061 { 2062 pr_debug ("unregister %s\n", shortname); 2063 unregister_filesystem (&gadgetfs_type); 2064 } 2065 module_exit (cleanup); 2066 2067