1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * USB Raw Gadget driver. 4 * See Documentation/usb/raw-gadget.rst for more details. 5 * 6 * Copyright (c) 2020 Google, Inc. 7 * Author: Andrey Konovalov <andreyknvl@gmail.com> 8 */ 9 10 #include <linux/compiler.h> 11 #include <linux/ctype.h> 12 #include <linux/debugfs.h> 13 #include <linux/delay.h> 14 #include <linux/kref.h> 15 #include <linux/miscdevice.h> 16 #include <linux/module.h> 17 #include <linux/semaphore.h> 18 #include <linux/sched.h> 19 #include <linux/slab.h> 20 #include <linux/uaccess.h> 21 #include <linux/wait.h> 22 23 #include <linux/usb.h> 24 #include <linux/usb/ch9.h> 25 #include <linux/usb/ch11.h> 26 #include <linux/usb/gadget.h> 27 28 #include <uapi/linux/usb/raw_gadget.h> 29 30 #define DRIVER_DESC "USB Raw Gadget" 31 #define DRIVER_NAME "raw-gadget" 32 33 MODULE_DESCRIPTION(DRIVER_DESC); 34 MODULE_AUTHOR("Andrey Konovalov"); 35 MODULE_LICENSE("GPL"); 36 37 /*----------------------------------------------------------------------*/ 38 39 #define RAW_EVENT_QUEUE_SIZE 16 40 41 struct raw_event_queue { 42 /* See the comment in raw_event_queue_fetch() for locking details. */ 43 spinlock_t lock; 44 struct semaphore sema; 45 struct usb_raw_event *events[RAW_EVENT_QUEUE_SIZE]; 46 int size; 47 }; 48 49 static void raw_event_queue_init(struct raw_event_queue *queue) 50 { 51 spin_lock_init(&queue->lock); 52 sema_init(&queue->sema, 0); 53 queue->size = 0; 54 } 55 56 static int raw_event_queue_add(struct raw_event_queue *queue, 57 enum usb_raw_event_type type, size_t length, const void *data) 58 { 59 unsigned long flags; 60 struct usb_raw_event *event; 61 62 spin_lock_irqsave(&queue->lock, flags); 63 if (WARN_ON(queue->size >= RAW_EVENT_QUEUE_SIZE)) { 64 spin_unlock_irqrestore(&queue->lock, flags); 65 return -ENOMEM; 66 } 67 event = kmalloc(sizeof(*event) + length, GFP_ATOMIC); 68 if (!event) { 69 spin_unlock_irqrestore(&queue->lock, flags); 70 return -ENOMEM; 71 } 72 event->type = type; 73 event->length = length; 74 if (event->length) 75 memcpy(&event->data[0], data, length); 76 queue->events[queue->size] = event; 77 queue->size++; 78 up(&queue->sema); 79 spin_unlock_irqrestore(&queue->lock, flags); 80 return 0; 81 } 82 83 static struct usb_raw_event *raw_event_queue_fetch( 84 struct raw_event_queue *queue) 85 { 86 int ret; 87 unsigned long flags; 88 struct usb_raw_event *event; 89 90 /* 91 * This function can be called concurrently. We first check that 92 * there's at least one event queued by decrementing the semaphore, 93 * and then take the lock to protect queue struct fields. 94 */ 95 ret = down_interruptible(&queue->sema); 96 if (ret) 97 return ERR_PTR(ret); 98 spin_lock_irqsave(&queue->lock, flags); 99 /* 100 * queue->size must have the same value as queue->sema counter (before 101 * the down_interruptible() call above), so this check is a fail-safe. 102 */ 103 if (WARN_ON(!queue->size)) { 104 spin_unlock_irqrestore(&queue->lock, flags); 105 return ERR_PTR(-ENODEV); 106 } 107 event = queue->events[0]; 108 queue->size--; 109 memmove(&queue->events[0], &queue->events[1], 110 queue->size * sizeof(queue->events[0])); 111 spin_unlock_irqrestore(&queue->lock, flags); 112 return event; 113 } 114 115 static void raw_event_queue_destroy(struct raw_event_queue *queue) 116 { 117 int i; 118 119 for (i = 0; i < queue->size; i++) 120 kfree(queue->events[i]); 121 queue->size = 0; 122 } 123 124 /*----------------------------------------------------------------------*/ 125 126 struct raw_dev; 127 128 enum ep_state { 129 STATE_EP_DISABLED, 130 STATE_EP_ENABLED, 131 }; 132 133 struct raw_ep { 134 struct raw_dev *dev; 135 enum ep_state state; 136 struct usb_ep *ep; 137 u8 addr; 138 struct usb_request *req; 139 bool urb_queued; 140 bool disabling; 141 ssize_t status; 142 }; 143 144 enum dev_state { 145 STATE_DEV_INVALID = 0, 146 STATE_DEV_OPENED, 147 STATE_DEV_INITIALIZED, 148 STATE_DEV_RUNNING, 149 STATE_DEV_CLOSED, 150 STATE_DEV_FAILED 151 }; 152 153 struct raw_dev { 154 struct kref count; 155 spinlock_t lock; 156 157 const char *udc_name; 158 struct usb_gadget_driver driver; 159 160 /* Reference to misc device: */ 161 struct device *dev; 162 163 /* Protected by lock: */ 164 enum dev_state state; 165 bool gadget_registered; 166 struct usb_gadget *gadget; 167 struct usb_request *req; 168 bool ep0_in_pending; 169 bool ep0_out_pending; 170 bool ep0_urb_queued; 171 ssize_t ep0_status; 172 struct raw_ep eps[USB_RAW_EPS_NUM_MAX]; 173 int eps_num; 174 175 struct completion ep0_done; 176 struct raw_event_queue queue; 177 }; 178 179 static struct raw_dev *dev_new(void) 180 { 181 struct raw_dev *dev; 182 183 dev = kzalloc(sizeof(*dev), GFP_KERNEL); 184 if (!dev) 185 return NULL; 186 /* Matches kref_put() in raw_release(). */ 187 kref_init(&dev->count); 188 spin_lock_init(&dev->lock); 189 init_completion(&dev->ep0_done); 190 raw_event_queue_init(&dev->queue); 191 return dev; 192 } 193 194 static void dev_free(struct kref *kref) 195 { 196 struct raw_dev *dev = container_of(kref, struct raw_dev, count); 197 int i; 198 199 kfree(dev->udc_name); 200 kfree(dev->driver.udc_name); 201 if (dev->req) { 202 if (dev->ep0_urb_queued) 203 usb_ep_dequeue(dev->gadget->ep0, dev->req); 204 usb_ep_free_request(dev->gadget->ep0, dev->req); 205 } 206 raw_event_queue_destroy(&dev->queue); 207 for (i = 0; i < dev->eps_num; i++) { 208 if (dev->eps[i].state == STATE_EP_DISABLED) 209 continue; 210 usb_ep_disable(dev->eps[i].ep); 211 usb_ep_free_request(dev->eps[i].ep, dev->eps[i].req); 212 kfree(dev->eps[i].ep->desc); 213 dev->eps[i].state = STATE_EP_DISABLED; 214 } 215 kfree(dev); 216 } 217 218 /*----------------------------------------------------------------------*/ 219 220 static int raw_queue_event(struct raw_dev *dev, 221 enum usb_raw_event_type type, size_t length, const void *data) 222 { 223 int ret = 0; 224 unsigned long flags; 225 226 ret = raw_event_queue_add(&dev->queue, type, length, data); 227 if (ret < 0) { 228 spin_lock_irqsave(&dev->lock, flags); 229 dev->state = STATE_DEV_FAILED; 230 spin_unlock_irqrestore(&dev->lock, flags); 231 } 232 return ret; 233 } 234 235 static void gadget_ep0_complete(struct usb_ep *ep, struct usb_request *req) 236 { 237 struct raw_dev *dev = req->context; 238 unsigned long flags; 239 240 spin_lock_irqsave(&dev->lock, flags); 241 if (req->status) 242 dev->ep0_status = req->status; 243 else 244 dev->ep0_status = req->actual; 245 if (dev->ep0_in_pending) 246 dev->ep0_in_pending = false; 247 else 248 dev->ep0_out_pending = false; 249 spin_unlock_irqrestore(&dev->lock, flags); 250 251 complete(&dev->ep0_done); 252 } 253 254 static u8 get_ep_addr(const char *name) 255 { 256 /* If the endpoint has fixed function (named as e.g. "ep12out-bulk"), 257 * parse the endpoint address from its name. We deliberately use 258 * deprecated simple_strtoul() function here, as the number isn't 259 * followed by '\0' nor '\n'. 260 */ 261 if (isdigit(name[2])) 262 return simple_strtoul(&name[2], NULL, 10); 263 /* Otherwise the endpoint is configurable (named as e.g. "ep-a"). */ 264 return USB_RAW_EP_ADDR_ANY; 265 } 266 267 static int gadget_bind(struct usb_gadget *gadget, 268 struct usb_gadget_driver *driver) 269 { 270 int ret = 0, i = 0; 271 struct raw_dev *dev = container_of(driver, struct raw_dev, driver); 272 struct usb_request *req; 273 struct usb_ep *ep; 274 unsigned long flags; 275 276 if (strcmp(gadget->name, dev->udc_name) != 0) 277 return -ENODEV; 278 279 set_gadget_data(gadget, dev); 280 req = usb_ep_alloc_request(gadget->ep0, GFP_KERNEL); 281 if (!req) { 282 dev_err(&gadget->dev, "usb_ep_alloc_request failed\n"); 283 set_gadget_data(gadget, NULL); 284 return -ENOMEM; 285 } 286 287 spin_lock_irqsave(&dev->lock, flags); 288 dev->req = req; 289 dev->req->context = dev; 290 dev->req->complete = gadget_ep0_complete; 291 dev->gadget = gadget; 292 gadget_for_each_ep(ep, dev->gadget) { 293 dev->eps[i].ep = ep; 294 dev->eps[i].addr = get_ep_addr(ep->name); 295 dev->eps[i].state = STATE_EP_DISABLED; 296 i++; 297 } 298 dev->eps_num = i; 299 spin_unlock_irqrestore(&dev->lock, flags); 300 301 /* Matches kref_put() in gadget_unbind(). */ 302 kref_get(&dev->count); 303 304 ret = raw_queue_event(dev, USB_RAW_EVENT_CONNECT, 0, NULL); 305 if (ret < 0) 306 dev_err(&gadget->dev, "failed to queue event\n"); 307 308 return ret; 309 } 310 311 static void gadget_unbind(struct usb_gadget *gadget) 312 { 313 struct raw_dev *dev = get_gadget_data(gadget); 314 315 set_gadget_data(gadget, NULL); 316 /* Matches kref_get() in gadget_bind(). */ 317 kref_put(&dev->count, dev_free); 318 } 319 320 static int gadget_setup(struct usb_gadget *gadget, 321 const struct usb_ctrlrequest *ctrl) 322 { 323 int ret = 0; 324 struct raw_dev *dev = get_gadget_data(gadget); 325 unsigned long flags; 326 327 spin_lock_irqsave(&dev->lock, flags); 328 if (dev->state != STATE_DEV_RUNNING) { 329 dev_err(&gadget->dev, "ignoring, device is not running\n"); 330 ret = -ENODEV; 331 goto out_unlock; 332 } 333 if (dev->ep0_in_pending || dev->ep0_out_pending) { 334 dev_dbg(&gadget->dev, "stalling, request already pending\n"); 335 ret = -EBUSY; 336 goto out_unlock; 337 } 338 if ((ctrl->bRequestType & USB_DIR_IN) && ctrl->wLength) 339 dev->ep0_in_pending = true; 340 else 341 dev->ep0_out_pending = true; 342 spin_unlock_irqrestore(&dev->lock, flags); 343 344 ret = raw_queue_event(dev, USB_RAW_EVENT_CONTROL, sizeof(*ctrl), ctrl); 345 if (ret < 0) 346 dev_err(&gadget->dev, "failed to queue event\n"); 347 goto out; 348 349 out_unlock: 350 spin_unlock_irqrestore(&dev->lock, flags); 351 out: 352 return ret; 353 } 354 355 /* These are currently unused but present in case UDC driver requires them. */ 356 static void gadget_disconnect(struct usb_gadget *gadget) { } 357 static void gadget_suspend(struct usb_gadget *gadget) { } 358 static void gadget_resume(struct usb_gadget *gadget) { } 359 static void gadget_reset(struct usb_gadget *gadget) { } 360 361 /*----------------------------------------------------------------------*/ 362 363 static struct miscdevice raw_misc_device; 364 365 static int raw_open(struct inode *inode, struct file *fd) 366 { 367 struct raw_dev *dev; 368 369 /* Nonblocking I/O is not supported yet. */ 370 if (fd->f_flags & O_NONBLOCK) 371 return -EINVAL; 372 373 dev = dev_new(); 374 if (!dev) 375 return -ENOMEM; 376 fd->private_data = dev; 377 dev->state = STATE_DEV_OPENED; 378 dev->dev = raw_misc_device.this_device; 379 return 0; 380 } 381 382 static int raw_release(struct inode *inode, struct file *fd) 383 { 384 int ret = 0; 385 struct raw_dev *dev = fd->private_data; 386 unsigned long flags; 387 bool unregister = false; 388 389 spin_lock_irqsave(&dev->lock, flags); 390 dev->state = STATE_DEV_CLOSED; 391 if (!dev->gadget) { 392 spin_unlock_irqrestore(&dev->lock, flags); 393 goto out_put; 394 } 395 if (dev->gadget_registered) 396 unregister = true; 397 dev->gadget_registered = false; 398 spin_unlock_irqrestore(&dev->lock, flags); 399 400 if (unregister) { 401 ret = usb_gadget_unregister_driver(&dev->driver); 402 if (ret != 0) 403 dev_err(dev->dev, 404 "usb_gadget_unregister_driver() failed with %d\n", 405 ret); 406 /* Matches kref_get() in raw_ioctl_run(). */ 407 kref_put(&dev->count, dev_free); 408 } 409 410 out_put: 411 /* Matches dev_new() in raw_open(). */ 412 kref_put(&dev->count, dev_free); 413 return ret; 414 } 415 416 /*----------------------------------------------------------------------*/ 417 418 static int raw_ioctl_init(struct raw_dev *dev, unsigned long value) 419 { 420 int ret = 0; 421 struct usb_raw_init arg; 422 char *udc_driver_name; 423 char *udc_device_name; 424 unsigned long flags; 425 426 if (copy_from_user(&arg, (void __user *)value, sizeof(arg))) 427 return -EFAULT; 428 429 switch (arg.speed) { 430 case USB_SPEED_UNKNOWN: 431 arg.speed = USB_SPEED_HIGH; 432 break; 433 case USB_SPEED_LOW: 434 case USB_SPEED_FULL: 435 case USB_SPEED_HIGH: 436 case USB_SPEED_SUPER: 437 break; 438 default: 439 return -EINVAL; 440 } 441 442 udc_driver_name = kmalloc(UDC_NAME_LENGTH_MAX, GFP_KERNEL); 443 if (!udc_driver_name) 444 return -ENOMEM; 445 ret = strscpy(udc_driver_name, &arg.driver_name[0], 446 UDC_NAME_LENGTH_MAX); 447 if (ret < 0) { 448 kfree(udc_driver_name); 449 return ret; 450 } 451 ret = 0; 452 453 udc_device_name = kmalloc(UDC_NAME_LENGTH_MAX, GFP_KERNEL); 454 if (!udc_device_name) { 455 kfree(udc_driver_name); 456 return -ENOMEM; 457 } 458 ret = strscpy(udc_device_name, &arg.device_name[0], 459 UDC_NAME_LENGTH_MAX); 460 if (ret < 0) { 461 kfree(udc_driver_name); 462 kfree(udc_device_name); 463 return ret; 464 } 465 ret = 0; 466 467 spin_lock_irqsave(&dev->lock, flags); 468 if (dev->state != STATE_DEV_OPENED) { 469 dev_dbg(dev->dev, "fail, device is not opened\n"); 470 kfree(udc_driver_name); 471 kfree(udc_device_name); 472 ret = -EINVAL; 473 goto out_unlock; 474 } 475 dev->udc_name = udc_driver_name; 476 477 dev->driver.function = DRIVER_DESC; 478 dev->driver.max_speed = arg.speed; 479 dev->driver.setup = gadget_setup; 480 dev->driver.disconnect = gadget_disconnect; 481 dev->driver.bind = gadget_bind; 482 dev->driver.unbind = gadget_unbind; 483 dev->driver.suspend = gadget_suspend; 484 dev->driver.resume = gadget_resume; 485 dev->driver.reset = gadget_reset; 486 dev->driver.driver.name = DRIVER_NAME; 487 dev->driver.udc_name = udc_device_name; 488 dev->driver.match_existing_only = 1; 489 490 dev->state = STATE_DEV_INITIALIZED; 491 492 out_unlock: 493 spin_unlock_irqrestore(&dev->lock, flags); 494 return ret; 495 } 496 497 static int raw_ioctl_run(struct raw_dev *dev, unsigned long value) 498 { 499 int ret = 0; 500 unsigned long flags; 501 502 if (value) 503 return -EINVAL; 504 505 spin_lock_irqsave(&dev->lock, flags); 506 if (dev->state != STATE_DEV_INITIALIZED) { 507 dev_dbg(dev->dev, "fail, device is not initialized\n"); 508 ret = -EINVAL; 509 goto out_unlock; 510 } 511 spin_unlock_irqrestore(&dev->lock, flags); 512 513 ret = usb_gadget_probe_driver(&dev->driver); 514 515 spin_lock_irqsave(&dev->lock, flags); 516 if (ret) { 517 dev_err(dev->dev, 518 "fail, usb_gadget_probe_driver returned %d\n", ret); 519 dev->state = STATE_DEV_FAILED; 520 goto out_unlock; 521 } 522 dev->gadget_registered = true; 523 dev->state = STATE_DEV_RUNNING; 524 /* Matches kref_put() in raw_release(). */ 525 kref_get(&dev->count); 526 527 out_unlock: 528 spin_unlock_irqrestore(&dev->lock, flags); 529 return ret; 530 } 531 532 static int raw_ioctl_event_fetch(struct raw_dev *dev, unsigned long value) 533 { 534 struct usb_raw_event arg; 535 unsigned long flags; 536 struct usb_raw_event *event; 537 uint32_t length; 538 539 if (copy_from_user(&arg, (void __user *)value, sizeof(arg))) 540 return -EFAULT; 541 542 spin_lock_irqsave(&dev->lock, flags); 543 if (dev->state != STATE_DEV_RUNNING) { 544 dev_dbg(dev->dev, "fail, device is not running\n"); 545 spin_unlock_irqrestore(&dev->lock, flags); 546 return -EINVAL; 547 } 548 if (!dev->gadget) { 549 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 550 spin_unlock_irqrestore(&dev->lock, flags); 551 return -EBUSY; 552 } 553 spin_unlock_irqrestore(&dev->lock, flags); 554 555 event = raw_event_queue_fetch(&dev->queue); 556 if (PTR_ERR(event) == -EINTR) { 557 dev_dbg(&dev->gadget->dev, "event fetching interrupted\n"); 558 return -EINTR; 559 } 560 if (IS_ERR(event)) { 561 dev_err(&dev->gadget->dev, "failed to fetch event\n"); 562 spin_lock_irqsave(&dev->lock, flags); 563 dev->state = STATE_DEV_FAILED; 564 spin_unlock_irqrestore(&dev->lock, flags); 565 return -ENODEV; 566 } 567 length = min(arg.length, event->length); 568 if (copy_to_user((void __user *)value, event, sizeof(*event) + length)) { 569 kfree(event); 570 return -EFAULT; 571 } 572 573 kfree(event); 574 return 0; 575 } 576 577 static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr, 578 bool get_from_user) 579 { 580 void *data; 581 582 if (copy_from_user(io, ptr, sizeof(*io))) 583 return ERR_PTR(-EFAULT); 584 if (io->ep >= USB_RAW_EPS_NUM_MAX) 585 return ERR_PTR(-EINVAL); 586 if (!usb_raw_io_flags_valid(io->flags)) 587 return ERR_PTR(-EINVAL); 588 if (io->length > PAGE_SIZE) 589 return ERR_PTR(-EINVAL); 590 if (get_from_user) 591 data = memdup_user(ptr + sizeof(*io), io->length); 592 else { 593 data = kmalloc(io->length, GFP_KERNEL); 594 if (!data) 595 data = ERR_PTR(-ENOMEM); 596 } 597 return data; 598 } 599 600 static int raw_process_ep0_io(struct raw_dev *dev, struct usb_raw_ep_io *io, 601 void *data, bool in) 602 { 603 int ret = 0; 604 unsigned long flags; 605 606 spin_lock_irqsave(&dev->lock, flags); 607 if (dev->state != STATE_DEV_RUNNING) { 608 dev_dbg(dev->dev, "fail, device is not running\n"); 609 ret = -EINVAL; 610 goto out_unlock; 611 } 612 if (!dev->gadget) { 613 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 614 ret = -EBUSY; 615 goto out_unlock; 616 } 617 if (dev->ep0_urb_queued) { 618 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n"); 619 ret = -EBUSY; 620 goto out_unlock; 621 } 622 if ((in && !dev->ep0_in_pending) || 623 (!in && !dev->ep0_out_pending)) { 624 dev_dbg(&dev->gadget->dev, "fail, wrong direction\n"); 625 ret = -EBUSY; 626 goto out_unlock; 627 } 628 if (WARN_ON(in && dev->ep0_out_pending)) { 629 ret = -ENODEV; 630 dev->state = STATE_DEV_FAILED; 631 goto out_done; 632 } 633 if (WARN_ON(!in && dev->ep0_in_pending)) { 634 ret = -ENODEV; 635 dev->state = STATE_DEV_FAILED; 636 goto out_done; 637 } 638 639 dev->req->buf = data; 640 dev->req->length = io->length; 641 dev->req->zero = usb_raw_io_flags_zero(io->flags); 642 dev->ep0_urb_queued = true; 643 spin_unlock_irqrestore(&dev->lock, flags); 644 645 ret = usb_ep_queue(dev->gadget->ep0, dev->req, GFP_KERNEL); 646 if (ret) { 647 dev_err(&dev->gadget->dev, 648 "fail, usb_ep_queue returned %d\n", ret); 649 spin_lock_irqsave(&dev->lock, flags); 650 dev->state = STATE_DEV_FAILED; 651 goto out_done; 652 } 653 654 ret = wait_for_completion_interruptible(&dev->ep0_done); 655 if (ret) { 656 dev_dbg(&dev->gadget->dev, "wait interrupted\n"); 657 usb_ep_dequeue(dev->gadget->ep0, dev->req); 658 wait_for_completion(&dev->ep0_done); 659 spin_lock_irqsave(&dev->lock, flags); 660 goto out_done; 661 } 662 663 spin_lock_irqsave(&dev->lock, flags); 664 ret = dev->ep0_status; 665 666 out_done: 667 dev->ep0_urb_queued = false; 668 out_unlock: 669 spin_unlock_irqrestore(&dev->lock, flags); 670 return ret; 671 } 672 673 static int raw_ioctl_ep0_write(struct raw_dev *dev, unsigned long value) 674 { 675 int ret = 0; 676 void *data; 677 struct usb_raw_ep_io io; 678 679 data = raw_alloc_io_data(&io, (void __user *)value, true); 680 if (IS_ERR(data)) 681 return PTR_ERR(data); 682 ret = raw_process_ep0_io(dev, &io, data, true); 683 kfree(data); 684 return ret; 685 } 686 687 static int raw_ioctl_ep0_read(struct raw_dev *dev, unsigned long value) 688 { 689 int ret = 0; 690 void *data; 691 struct usb_raw_ep_io io; 692 unsigned int length; 693 694 data = raw_alloc_io_data(&io, (void __user *)value, false); 695 if (IS_ERR(data)) 696 return PTR_ERR(data); 697 ret = raw_process_ep0_io(dev, &io, data, false); 698 if (ret < 0) 699 goto free; 700 701 length = min(io.length, (unsigned int)ret); 702 if (copy_to_user((void __user *)(value + sizeof(io)), data, length)) 703 ret = -EFAULT; 704 else 705 ret = length; 706 free: 707 kfree(data); 708 return ret; 709 } 710 711 static int raw_ioctl_ep0_stall(struct raw_dev *dev, unsigned long value) 712 { 713 int ret = 0; 714 unsigned long flags; 715 716 if (value) 717 return -EINVAL; 718 spin_lock_irqsave(&dev->lock, flags); 719 if (dev->state != STATE_DEV_RUNNING) { 720 dev_dbg(dev->dev, "fail, device is not running\n"); 721 ret = -EINVAL; 722 goto out_unlock; 723 } 724 if (!dev->gadget) { 725 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 726 ret = -EBUSY; 727 goto out_unlock; 728 } 729 if (dev->ep0_urb_queued) { 730 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n"); 731 ret = -EBUSY; 732 goto out_unlock; 733 } 734 if (!dev->ep0_in_pending && !dev->ep0_out_pending) { 735 dev_dbg(&dev->gadget->dev, "fail, no request pending\n"); 736 ret = -EBUSY; 737 goto out_unlock; 738 } 739 740 ret = usb_ep_set_halt(dev->gadget->ep0); 741 if (ret < 0) 742 dev_err(&dev->gadget->dev, 743 "fail, usb_ep_set_halt returned %d\n", ret); 744 745 if (dev->ep0_in_pending) 746 dev->ep0_in_pending = false; 747 else 748 dev->ep0_out_pending = false; 749 750 out_unlock: 751 spin_unlock_irqrestore(&dev->lock, flags); 752 return ret; 753 } 754 755 static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value) 756 { 757 int ret = 0, i; 758 unsigned long flags; 759 struct usb_endpoint_descriptor *desc; 760 struct raw_ep *ep; 761 bool ep_props_matched = false; 762 763 desc = memdup_user((void __user *)value, sizeof(*desc)); 764 if (IS_ERR(desc)) 765 return PTR_ERR(desc); 766 767 /* 768 * Endpoints with a maxpacket length of 0 can cause crashes in UDC 769 * drivers. 770 */ 771 if (usb_endpoint_maxp(desc) == 0) { 772 dev_dbg(dev->dev, "fail, bad endpoint maxpacket\n"); 773 kfree(desc); 774 return -EINVAL; 775 } 776 777 spin_lock_irqsave(&dev->lock, flags); 778 if (dev->state != STATE_DEV_RUNNING) { 779 dev_dbg(dev->dev, "fail, device is not running\n"); 780 ret = -EINVAL; 781 goto out_free; 782 } 783 if (!dev->gadget) { 784 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 785 ret = -EBUSY; 786 goto out_free; 787 } 788 789 for (i = 0; i < dev->eps_num; i++) { 790 ep = &dev->eps[i]; 791 if (ep->addr != usb_endpoint_num(desc) && 792 ep->addr != USB_RAW_EP_ADDR_ANY) 793 continue; 794 if (!usb_gadget_ep_match_desc(dev->gadget, ep->ep, desc, NULL)) 795 continue; 796 ep_props_matched = true; 797 if (ep->state != STATE_EP_DISABLED) 798 continue; 799 ep->ep->desc = desc; 800 ret = usb_ep_enable(ep->ep); 801 if (ret < 0) { 802 dev_err(&dev->gadget->dev, 803 "fail, usb_ep_enable returned %d\n", ret); 804 goto out_free; 805 } 806 ep->req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC); 807 if (!ep->req) { 808 dev_err(&dev->gadget->dev, 809 "fail, usb_ep_alloc_request failed\n"); 810 usb_ep_disable(ep->ep); 811 ret = -ENOMEM; 812 goto out_free; 813 } 814 ep->state = STATE_EP_ENABLED; 815 ep->ep->driver_data = ep; 816 ret = i; 817 goto out_unlock; 818 } 819 820 if (!ep_props_matched) { 821 dev_dbg(&dev->gadget->dev, "fail, bad endpoint descriptor\n"); 822 ret = -EINVAL; 823 } else { 824 dev_dbg(&dev->gadget->dev, "fail, no endpoints available\n"); 825 ret = -EBUSY; 826 } 827 828 out_free: 829 kfree(desc); 830 out_unlock: 831 spin_unlock_irqrestore(&dev->lock, flags); 832 return ret; 833 } 834 835 static int raw_ioctl_ep_disable(struct raw_dev *dev, unsigned long value) 836 { 837 int ret = 0, i = value; 838 unsigned long flags; 839 840 spin_lock_irqsave(&dev->lock, flags); 841 if (dev->state != STATE_DEV_RUNNING) { 842 dev_dbg(dev->dev, "fail, device is not running\n"); 843 ret = -EINVAL; 844 goto out_unlock; 845 } 846 if (!dev->gadget) { 847 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 848 ret = -EBUSY; 849 goto out_unlock; 850 } 851 if (i < 0 || i >= dev->eps_num) { 852 dev_dbg(dev->dev, "fail, invalid endpoint\n"); 853 ret = -EBUSY; 854 goto out_unlock; 855 } 856 if (dev->eps[i].state == STATE_EP_DISABLED) { 857 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n"); 858 ret = -EINVAL; 859 goto out_unlock; 860 } 861 if (dev->eps[i].disabling) { 862 dev_dbg(&dev->gadget->dev, 863 "fail, disable already in progress\n"); 864 ret = -EINVAL; 865 goto out_unlock; 866 } 867 if (dev->eps[i].urb_queued) { 868 dev_dbg(&dev->gadget->dev, 869 "fail, waiting for urb completion\n"); 870 ret = -EINVAL; 871 goto out_unlock; 872 } 873 dev->eps[i].disabling = true; 874 spin_unlock_irqrestore(&dev->lock, flags); 875 876 usb_ep_disable(dev->eps[i].ep); 877 878 spin_lock_irqsave(&dev->lock, flags); 879 usb_ep_free_request(dev->eps[i].ep, dev->eps[i].req); 880 kfree(dev->eps[i].ep->desc); 881 dev->eps[i].state = STATE_EP_DISABLED; 882 dev->eps[i].disabling = false; 883 884 out_unlock: 885 spin_unlock_irqrestore(&dev->lock, flags); 886 return ret; 887 } 888 889 static int raw_ioctl_ep_set_clear_halt_wedge(struct raw_dev *dev, 890 unsigned long value, bool set, bool halt) 891 { 892 int ret = 0, i = value; 893 unsigned long flags; 894 895 spin_lock_irqsave(&dev->lock, flags); 896 if (dev->state != STATE_DEV_RUNNING) { 897 dev_dbg(dev->dev, "fail, device is not running\n"); 898 ret = -EINVAL; 899 goto out_unlock; 900 } 901 if (!dev->gadget) { 902 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 903 ret = -EBUSY; 904 goto out_unlock; 905 } 906 if (i < 0 || i >= dev->eps_num) { 907 dev_dbg(dev->dev, "fail, invalid endpoint\n"); 908 ret = -EBUSY; 909 goto out_unlock; 910 } 911 if (dev->eps[i].state == STATE_EP_DISABLED) { 912 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n"); 913 ret = -EINVAL; 914 goto out_unlock; 915 } 916 if (dev->eps[i].disabling) { 917 dev_dbg(&dev->gadget->dev, 918 "fail, disable is in progress\n"); 919 ret = -EINVAL; 920 goto out_unlock; 921 } 922 if (dev->eps[i].urb_queued) { 923 dev_dbg(&dev->gadget->dev, 924 "fail, waiting for urb completion\n"); 925 ret = -EINVAL; 926 goto out_unlock; 927 } 928 if (usb_endpoint_xfer_isoc(dev->eps[i].ep->desc)) { 929 dev_dbg(&dev->gadget->dev, 930 "fail, can't halt/wedge ISO endpoint\n"); 931 ret = -EINVAL; 932 goto out_unlock; 933 } 934 935 if (set && halt) { 936 ret = usb_ep_set_halt(dev->eps[i].ep); 937 if (ret < 0) 938 dev_err(&dev->gadget->dev, 939 "fail, usb_ep_set_halt returned %d\n", ret); 940 } else if (!set && halt) { 941 ret = usb_ep_clear_halt(dev->eps[i].ep); 942 if (ret < 0) 943 dev_err(&dev->gadget->dev, 944 "fail, usb_ep_clear_halt returned %d\n", ret); 945 } else if (set && !halt) { 946 ret = usb_ep_set_wedge(dev->eps[i].ep); 947 if (ret < 0) 948 dev_err(&dev->gadget->dev, 949 "fail, usb_ep_set_wedge returned %d\n", ret); 950 } 951 952 out_unlock: 953 spin_unlock_irqrestore(&dev->lock, flags); 954 return ret; 955 } 956 957 static void gadget_ep_complete(struct usb_ep *ep, struct usb_request *req) 958 { 959 struct raw_ep *r_ep = (struct raw_ep *)ep->driver_data; 960 struct raw_dev *dev = r_ep->dev; 961 unsigned long flags; 962 963 spin_lock_irqsave(&dev->lock, flags); 964 if (req->status) 965 r_ep->status = req->status; 966 else 967 r_ep->status = req->actual; 968 spin_unlock_irqrestore(&dev->lock, flags); 969 970 complete((struct completion *)req->context); 971 } 972 973 static int raw_process_ep_io(struct raw_dev *dev, struct usb_raw_ep_io *io, 974 void *data, bool in) 975 { 976 int ret = 0; 977 unsigned long flags; 978 struct raw_ep *ep; 979 DECLARE_COMPLETION_ONSTACK(done); 980 981 spin_lock_irqsave(&dev->lock, flags); 982 if (dev->state != STATE_DEV_RUNNING) { 983 dev_dbg(dev->dev, "fail, device is not running\n"); 984 ret = -EINVAL; 985 goto out_unlock; 986 } 987 if (!dev->gadget) { 988 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 989 ret = -EBUSY; 990 goto out_unlock; 991 } 992 if (io->ep >= dev->eps_num) { 993 dev_dbg(&dev->gadget->dev, "fail, invalid endpoint\n"); 994 ret = -EINVAL; 995 goto out_unlock; 996 } 997 ep = &dev->eps[io->ep]; 998 if (ep->state != STATE_EP_ENABLED) { 999 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n"); 1000 ret = -EBUSY; 1001 goto out_unlock; 1002 } 1003 if (ep->disabling) { 1004 dev_dbg(&dev->gadget->dev, 1005 "fail, endpoint is already being disabled\n"); 1006 ret = -EBUSY; 1007 goto out_unlock; 1008 } 1009 if (ep->urb_queued) { 1010 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n"); 1011 ret = -EBUSY; 1012 goto out_unlock; 1013 } 1014 if (in != usb_endpoint_dir_in(ep->ep->desc)) { 1015 dev_dbg(&dev->gadget->dev, "fail, wrong direction\n"); 1016 ret = -EINVAL; 1017 goto out_unlock; 1018 } 1019 1020 ep->dev = dev; 1021 ep->req->context = &done; 1022 ep->req->complete = gadget_ep_complete; 1023 ep->req->buf = data; 1024 ep->req->length = io->length; 1025 ep->req->zero = usb_raw_io_flags_zero(io->flags); 1026 ep->urb_queued = true; 1027 spin_unlock_irqrestore(&dev->lock, flags); 1028 1029 ret = usb_ep_queue(ep->ep, ep->req, GFP_KERNEL); 1030 if (ret) { 1031 dev_err(&dev->gadget->dev, 1032 "fail, usb_ep_queue returned %d\n", ret); 1033 spin_lock_irqsave(&dev->lock, flags); 1034 dev->state = STATE_DEV_FAILED; 1035 goto out_done; 1036 } 1037 1038 ret = wait_for_completion_interruptible(&done); 1039 if (ret) { 1040 dev_dbg(&dev->gadget->dev, "wait interrupted\n"); 1041 usb_ep_dequeue(ep->ep, ep->req); 1042 wait_for_completion(&done); 1043 spin_lock_irqsave(&dev->lock, flags); 1044 goto out_done; 1045 } 1046 1047 spin_lock_irqsave(&dev->lock, flags); 1048 ret = ep->status; 1049 1050 out_done: 1051 ep->urb_queued = false; 1052 out_unlock: 1053 spin_unlock_irqrestore(&dev->lock, flags); 1054 return ret; 1055 } 1056 1057 static int raw_ioctl_ep_write(struct raw_dev *dev, unsigned long value) 1058 { 1059 int ret = 0; 1060 char *data; 1061 struct usb_raw_ep_io io; 1062 1063 data = raw_alloc_io_data(&io, (void __user *)value, true); 1064 if (IS_ERR(data)) 1065 return PTR_ERR(data); 1066 ret = raw_process_ep_io(dev, &io, data, true); 1067 kfree(data); 1068 return ret; 1069 } 1070 1071 static int raw_ioctl_ep_read(struct raw_dev *dev, unsigned long value) 1072 { 1073 int ret = 0; 1074 char *data; 1075 struct usb_raw_ep_io io; 1076 unsigned int length; 1077 1078 data = raw_alloc_io_data(&io, (void __user *)value, false); 1079 if (IS_ERR(data)) 1080 return PTR_ERR(data); 1081 ret = raw_process_ep_io(dev, &io, data, false); 1082 if (ret < 0) 1083 goto free; 1084 1085 length = min(io.length, (unsigned int)ret); 1086 if (copy_to_user((void __user *)(value + sizeof(io)), data, length)) 1087 ret = -EFAULT; 1088 else 1089 ret = length; 1090 free: 1091 kfree(data); 1092 return ret; 1093 } 1094 1095 static int raw_ioctl_configure(struct raw_dev *dev, unsigned long value) 1096 { 1097 int ret = 0; 1098 unsigned long flags; 1099 1100 if (value) 1101 return -EINVAL; 1102 spin_lock_irqsave(&dev->lock, flags); 1103 if (dev->state != STATE_DEV_RUNNING) { 1104 dev_dbg(dev->dev, "fail, device is not running\n"); 1105 ret = -EINVAL; 1106 goto out_unlock; 1107 } 1108 if (!dev->gadget) { 1109 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 1110 ret = -EBUSY; 1111 goto out_unlock; 1112 } 1113 usb_gadget_set_state(dev->gadget, USB_STATE_CONFIGURED); 1114 1115 out_unlock: 1116 spin_unlock_irqrestore(&dev->lock, flags); 1117 return ret; 1118 } 1119 1120 static int raw_ioctl_vbus_draw(struct raw_dev *dev, unsigned long value) 1121 { 1122 int ret = 0; 1123 unsigned long flags; 1124 1125 spin_lock_irqsave(&dev->lock, flags); 1126 if (dev->state != STATE_DEV_RUNNING) { 1127 dev_dbg(dev->dev, "fail, device is not running\n"); 1128 ret = -EINVAL; 1129 goto out_unlock; 1130 } 1131 if (!dev->gadget) { 1132 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 1133 ret = -EBUSY; 1134 goto out_unlock; 1135 } 1136 usb_gadget_vbus_draw(dev->gadget, 2 * value); 1137 1138 out_unlock: 1139 spin_unlock_irqrestore(&dev->lock, flags); 1140 return ret; 1141 } 1142 1143 static void fill_ep_caps(struct usb_ep_caps *caps, 1144 struct usb_raw_ep_caps *raw_caps) 1145 { 1146 raw_caps->type_control = caps->type_control; 1147 raw_caps->type_iso = caps->type_iso; 1148 raw_caps->type_bulk = caps->type_bulk; 1149 raw_caps->type_int = caps->type_int; 1150 raw_caps->dir_in = caps->dir_in; 1151 raw_caps->dir_out = caps->dir_out; 1152 } 1153 1154 static void fill_ep_limits(struct usb_ep *ep, struct usb_raw_ep_limits *limits) 1155 { 1156 limits->maxpacket_limit = ep->maxpacket_limit; 1157 limits->max_streams = ep->max_streams; 1158 } 1159 1160 static int raw_ioctl_eps_info(struct raw_dev *dev, unsigned long value) 1161 { 1162 int ret = 0, i; 1163 unsigned long flags; 1164 struct usb_raw_eps_info *info; 1165 struct raw_ep *ep; 1166 1167 info = kzalloc(sizeof(*info), GFP_KERNEL); 1168 if (!info) { 1169 ret = -ENOMEM; 1170 goto out; 1171 } 1172 1173 spin_lock_irqsave(&dev->lock, flags); 1174 if (dev->state != STATE_DEV_RUNNING) { 1175 dev_dbg(dev->dev, "fail, device is not running\n"); 1176 ret = -EINVAL; 1177 spin_unlock_irqrestore(&dev->lock, flags); 1178 goto out_free; 1179 } 1180 if (!dev->gadget) { 1181 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 1182 ret = -EBUSY; 1183 spin_unlock_irqrestore(&dev->lock, flags); 1184 goto out_free; 1185 } 1186 1187 for (i = 0; i < dev->eps_num; i++) { 1188 ep = &dev->eps[i]; 1189 strscpy(&info->eps[i].name[0], ep->ep->name, 1190 USB_RAW_EP_NAME_MAX); 1191 info->eps[i].addr = ep->addr; 1192 fill_ep_caps(&ep->ep->caps, &info->eps[i].caps); 1193 fill_ep_limits(ep->ep, &info->eps[i].limits); 1194 } 1195 ret = dev->eps_num; 1196 spin_unlock_irqrestore(&dev->lock, flags); 1197 1198 if (copy_to_user((void __user *)value, info, sizeof(*info))) 1199 ret = -EFAULT; 1200 1201 out_free: 1202 kfree(info); 1203 out: 1204 return ret; 1205 } 1206 1207 static long raw_ioctl(struct file *fd, unsigned int cmd, unsigned long value) 1208 { 1209 struct raw_dev *dev = fd->private_data; 1210 int ret = 0; 1211 1212 if (!dev) 1213 return -EBUSY; 1214 1215 switch (cmd) { 1216 case USB_RAW_IOCTL_INIT: 1217 ret = raw_ioctl_init(dev, value); 1218 break; 1219 case USB_RAW_IOCTL_RUN: 1220 ret = raw_ioctl_run(dev, value); 1221 break; 1222 case USB_RAW_IOCTL_EVENT_FETCH: 1223 ret = raw_ioctl_event_fetch(dev, value); 1224 break; 1225 case USB_RAW_IOCTL_EP0_WRITE: 1226 ret = raw_ioctl_ep0_write(dev, value); 1227 break; 1228 case USB_RAW_IOCTL_EP0_READ: 1229 ret = raw_ioctl_ep0_read(dev, value); 1230 break; 1231 case USB_RAW_IOCTL_EP_ENABLE: 1232 ret = raw_ioctl_ep_enable(dev, value); 1233 break; 1234 case USB_RAW_IOCTL_EP_DISABLE: 1235 ret = raw_ioctl_ep_disable(dev, value); 1236 break; 1237 case USB_RAW_IOCTL_EP_WRITE: 1238 ret = raw_ioctl_ep_write(dev, value); 1239 break; 1240 case USB_RAW_IOCTL_EP_READ: 1241 ret = raw_ioctl_ep_read(dev, value); 1242 break; 1243 case USB_RAW_IOCTL_CONFIGURE: 1244 ret = raw_ioctl_configure(dev, value); 1245 break; 1246 case USB_RAW_IOCTL_VBUS_DRAW: 1247 ret = raw_ioctl_vbus_draw(dev, value); 1248 break; 1249 case USB_RAW_IOCTL_EPS_INFO: 1250 ret = raw_ioctl_eps_info(dev, value); 1251 break; 1252 case USB_RAW_IOCTL_EP0_STALL: 1253 ret = raw_ioctl_ep0_stall(dev, value); 1254 break; 1255 case USB_RAW_IOCTL_EP_SET_HALT: 1256 ret = raw_ioctl_ep_set_clear_halt_wedge( 1257 dev, value, true, true); 1258 break; 1259 case USB_RAW_IOCTL_EP_CLEAR_HALT: 1260 ret = raw_ioctl_ep_set_clear_halt_wedge( 1261 dev, value, false, true); 1262 break; 1263 case USB_RAW_IOCTL_EP_SET_WEDGE: 1264 ret = raw_ioctl_ep_set_clear_halt_wedge( 1265 dev, value, true, false); 1266 break; 1267 default: 1268 ret = -EINVAL; 1269 } 1270 1271 return ret; 1272 } 1273 1274 /*----------------------------------------------------------------------*/ 1275 1276 static const struct file_operations raw_fops = { 1277 .open = raw_open, 1278 .unlocked_ioctl = raw_ioctl, 1279 .compat_ioctl = raw_ioctl, 1280 .release = raw_release, 1281 .llseek = no_llseek, 1282 }; 1283 1284 static struct miscdevice raw_misc_device = { 1285 .minor = MISC_DYNAMIC_MINOR, 1286 .name = DRIVER_NAME, 1287 .fops = &raw_fops, 1288 }; 1289 1290 module_misc_device(raw_misc_device); 1291