inode.c 52 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0+
Linus Torvalds's avatar
Linus Torvalds committed
2 3 4 5 6 7 8 9
/*
 * inode.c -- user mode filesystem api for usb gadget controllers
 *
 * Copyright (C) 2003-2004 David Brownell
 * Copyright (C) 2003 Agilent Technologies
 */


10
/* #define VERBOSE_DEBUG */
Linus Torvalds's avatar
Linus Torvalds committed
11 12 13 14

#include <linux/init.h>
#include <linux/module.h>
#include <linux/fs.h>
15
#include <linux/fs_context.h>
Linus Torvalds's avatar
Linus Torvalds committed
16 17 18 19
#include <linux/pagemap.h>
#include <linux/uts.h>
#include <linux/wait.h>
#include <linux/compiler.h>
20
#include <linux/uaccess.h>
21
#include <linux/sched.h>
Linus Torvalds's avatar
Linus Torvalds committed
22
#include <linux/slab.h>
23
#include <linux/poll.h>
24
#include <linux/kthread.h>
25
#include <linux/aio.h>
26
#include <linux/uio.h>
27
#include <linux/refcount.h>
28
#include <linux/delay.h>
Linus Torvalds's avatar
Linus Torvalds committed
29 30 31
#include <linux/device.h>
#include <linux/moduleparam.h>

32
#include <linux/usb/gadgetfs.h>
33
#include <linux/usb/gadget.h>
Linus Torvalds's avatar
Linus Torvalds committed
34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53


/*
 * The gadgetfs API maps each endpoint to a file descriptor so that you
 * can use standard synchronous read/write calls for I/O.  There's some
 * O_NONBLOCK and O_ASYNC/FASYNC style i/o support.  Example usermode
 * drivers show how this works in practice.  You can also use AIO to
 * eliminate I/O gaps between requests, to help when streaming data.
 *
 * Key parts that must be USB-specific are protocols defining how the
 * read/write operations relate to the hardware state machines.  There
 * are two types of files.  One type is for the device, implementing ep0.
 * The other type is for each IN or OUT endpoint.  In both cases, the
 * user mode driver must configure the hardware before using it.
 *
 * - First, dev_config() is called when /dev/gadget/$CHIP is configured
 *   (by writing configuration and device descriptors).  Afterwards it
 *   may serve as a source of device events, used to handle all control
 *   requests other than basic enumeration.
 *
54 55 56 57 58
 * - Then, after a SET_CONFIGURATION control request, ep_config() is
 *   called when each /dev/gadget/ep* file is configured (by writing
 *   endpoint descriptors).  Afterwards these files are used to write()
 *   IN data or to read() OUT data.  To halt the endpoint, a "wrong
 *   direction" request is issued (like reading an IN endpoint).
Linus Torvalds's avatar
Linus Torvalds committed
59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75
 *
 * Unlike "usbfs" the only ioctl()s are for things that are rare, and maybe
 * not possible on all hardware.  For example, precise fault handling with
 * respect to data left in endpoint fifos after aborted operations; or
 * selective clearing of endpoint halts, to implement SET_INTERFACE.
 */

#define	DRIVER_DESC	"USB Gadget filesystem"
#define	DRIVER_VERSION	"24 Aug 2004"

static const char driver_desc [] = DRIVER_DESC;
static const char shortname [] = "gadgetfs";

MODULE_DESCRIPTION (DRIVER_DESC);
MODULE_AUTHOR ("David Brownell");
MODULE_LICENSE ("GPL");

76 77
static int ep_open(struct inode *, struct file *);

Linus Torvalds's avatar
Linus Torvalds committed
78 79 80 81 82 83 84

/*----------------------------------------------------------------------*/

#define GADGETFS_MAGIC		0xaee71ee7

/* /dev/gadget/$CHIP represents ep0 and the whole device */
enum ep0_state {
85
	/* DISABLED is the initial state. */
Linus Torvalds's avatar
Linus Torvalds committed
86 87 88 89 90 91 92
	STATE_DEV_DISABLED = 0,

	/* Only one open() of /dev/gadget/$CHIP; only one file tracks
	 * ep0/device i/o modes and binding to the controller.  Driver
	 * must always write descriptors to initialize the device, then
	 * the device becomes UNCONNECTED until enumeration.
	 */
David Brownell's avatar
David Brownell committed
93
	STATE_DEV_OPENED,
Linus Torvalds's avatar
Linus Torvalds committed
94 95 96 97 98 99

	/* From then on, ep0 fd is in either of two basic modes:
	 * - (UN)CONNECTED: read usb_gadgetfs_event(s) from it
	 * - SETUP: read/write will transfer control data and succeed;
	 *   or if "wrong direction", performs protocol stall
	 */
David Brownell's avatar
David Brownell committed
100 101 102
	STATE_DEV_UNCONNECTED,
	STATE_DEV_CONNECTED,
	STATE_DEV_SETUP,
Linus Torvalds's avatar
Linus Torvalds committed
103 104 105 106 107 108 109 110 111 112

	/* UNBOUND means the driver closed ep0, so the device won't be
	 * accessible again (DEV_DISABLED) until all fds are closed.
	 */
	STATE_DEV_UNBOUND,
};

/* enough for the whole queue: most events invalidate others */
#define	N_EVENT			5

113 114
#define RBUF_SIZE		256

Linus Torvalds's avatar
Linus Torvalds committed
115 116
struct dev_data {
	spinlock_t			lock;
117
	refcount_t			count;
118
	int				udc_usage;
David Brownell's avatar
David Brownell committed
119
	enum ep0_state			state;		/* P: lock */
Linus Torvalds's avatar
Linus Torvalds committed
120 121 122 123 124 125 126 127 128 129 130 131 132
	struct usb_gadgetfs_event	event [N_EVENT];
	unsigned			ev_next;
	struct fasync_struct		*fasync;
	u8				current_config;

	/* drivers reading ep0 MUST handle control requests (SETUP)
	 * reported that way; else the host will time out.
	 */
	unsigned			usermode_setup : 1,
					setup_in : 1,
					setup_can_stall : 1,
					setup_out_ready : 1,
					setup_out_error : 1,
133 134
					setup_abort : 1,
					gadget_registered : 1;
135
	unsigned			setup_wLength;
Linus Torvalds's avatar
Linus Torvalds committed
136 137 138 139 140 141 142 143 144 145 146 147 148

	/* the rest is basically write-once */
	struct usb_config_descriptor	*config, *hs_config;
	struct usb_device_descriptor	*dev;
	struct usb_request		*req;
	struct usb_gadget		*gadget;
	struct list_head		epfiles;
	void				*buf;
	wait_queue_head_t		wait;
	struct super_block		*sb;
	struct dentry			*dentry;

	/* except this scratch i/o buffer for ep0 */
149
	u8				rbuf[RBUF_SIZE];
Linus Torvalds's avatar
Linus Torvalds committed
150 151 152 153
};

static inline void get_dev (struct dev_data *data)
{
154
	refcount_inc (&data->count);
Linus Torvalds's avatar
Linus Torvalds committed
155 156 157 158
}

static void put_dev (struct dev_data *data)
{
159
	if (likely (!refcount_dec_and_test (&data->count)))
Linus Torvalds's avatar
Linus Torvalds committed
160 161 162 163 164 165 166 167 168 169
		return;
	/* needs no more cleanup */
	BUG_ON (waitqueue_active (&data->wait));
	kfree (data);
}

static struct dev_data *dev_new (void)
{
	struct dev_data		*dev;

170
	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
Linus Torvalds's avatar
Linus Torvalds committed
171 172 173
	if (!dev)
		return NULL;
	dev->state = STATE_DEV_DISABLED;
174
	refcount_set (&dev->count, 1);
Linus Torvalds's avatar
Linus Torvalds committed
175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191
	spin_lock_init (&dev->lock);
	INIT_LIST_HEAD (&dev->epfiles);
	init_waitqueue_head (&dev->wait);
	return dev;
}

/*----------------------------------------------------------------------*/

/* other /dev/gadget/$ENDPOINT files represent endpoints */
enum ep_state {
	STATE_EP_DISABLED = 0,
	STATE_EP_READY,
	STATE_EP_ENABLED,
	STATE_EP_UNBOUND,
};

struct ep_data {
192
	struct mutex			lock;
Linus Torvalds's avatar
Linus Torvalds committed
193
	enum ep_state			state;
194
	refcount_t			count;
Linus Torvalds's avatar
Linus Torvalds committed
195 196 197 198 199 200 201 202 203 204 205 206 207 208
	struct dev_data			*dev;
	/* must hold dev->lock before accessing ep or req */
	struct usb_ep			*ep;
	struct usb_request		*req;
	ssize_t				status;
	char				name [16];
	struct usb_endpoint_descriptor	desc, hs_desc;
	struct list_head		epfiles;
	wait_queue_head_t		wait;
	struct dentry			*dentry;
};

static inline void get_ep (struct ep_data *data)
{
209
	refcount_inc (&data->count);
Linus Torvalds's avatar
Linus Torvalds committed
210 211 212 213
}

static void put_ep (struct ep_data *data)
{
214
	if (likely (!refcount_dec_and_test (&data->count)))
Linus Torvalds's avatar
Linus Torvalds committed
215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231
		return;
	put_dev (data->dev);
	/* needs no more cleanup */
	BUG_ON (!list_empty (&data->epfiles));
	BUG_ON (waitqueue_active (&data->wait));
	kfree (data);
}

/*----------------------------------------------------------------------*/

/* most "how to use the hardware" policy choices are in userspace:
 * mapping endpoint roles (which the driver needs) to the capabilities
 * which the usb controller has.  most of those capabilities are exposed
 * implicitly, starting with the driver name and then endpoint names.
 */

static const char *CHIP;
232
static DEFINE_MUTEX(sb_mutex);		/* Serialize superblock operations */
Linus Torvalds's avatar
Linus Torvalds committed
233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251

/*----------------------------------------------------------------------*/

/* NOTE:  don't use dev_printk calls before binding to the gadget
 * at the end of ep0 configuration, or after unbind.
 */

/* too wordy: dev_printk(level , &(d)->gadget->dev , fmt , ## args) */
#define xprintk(d,level,fmt,args...) \
	printk(level "%s: " fmt , shortname , ## args)

#ifdef DEBUG
#define DBG(dev,fmt,args...) \
	xprintk(dev , KERN_DEBUG , fmt , ## args)
#else
#define DBG(dev,fmt,args...) \
	do { } while (0)
#endif /* DEBUG */

252
#ifdef VERBOSE_DEBUG
Linus Torvalds's avatar
Linus Torvalds committed
253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270
#define VDEBUG	DBG
#else
#define VDEBUG(dev,fmt,args...) \
	do { } while (0)
#endif /* DEBUG */

#define ERROR(dev,fmt,args...) \
	xprintk(dev , KERN_ERR , fmt , ## args)
#define INFO(dev,fmt,args...) \
	xprintk(dev , KERN_INFO , fmt , ## args)


/*----------------------------------------------------------------------*/

/* SYNCHRONOUS ENDPOINT OPERATIONS (bulk/intr/iso)
 *
 * After opening, configure non-control endpoints.  Then use normal
 * stream read() and write() requests; and maybe ioctl() to get more
271
 * precise FIFO status when recovering from cancellation.
Linus Torvalds's avatar
Linus Torvalds committed
272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290
 */

static void epio_complete (struct usb_ep *ep, struct usb_request *req)
{
	struct ep_data	*epdata = ep->driver_data;

	if (!req->context)
		return;
	if (req->status)
		epdata->status = req->status;
	else
		epdata->status = req->actual;
	complete ((struct completion *)req->context);
}

/* tasklock endpoint, returning when it's connected.
 * still need dev->lock to use epdata->ep.
 */
static int
291
get_ready_ep (unsigned f_flags, struct ep_data *epdata, bool is_write)
Linus Torvalds's avatar
Linus Torvalds committed
292 293 294 295
{
	int	val;

	if (f_flags & O_NONBLOCK) {
296
		if (!mutex_trylock(&epdata->lock))
Linus Torvalds's avatar
Linus Torvalds committed
297
			goto nonblock;
298 299
		if (epdata->state != STATE_EP_ENABLED &&
		    (!is_write || epdata->state != STATE_EP_READY)) {
300
			mutex_unlock(&epdata->lock);
Linus Torvalds's avatar
Linus Torvalds committed
301 302 303 304 305 306 307
nonblock:
			val = -EAGAIN;
		} else
			val = 0;
		return val;
	}

308 309
	val = mutex_lock_interruptible(&epdata->lock);
	if (val < 0)
Linus Torvalds's avatar
Linus Torvalds committed
310
		return val;
311

Linus Torvalds's avatar
Linus Torvalds committed
312 313
	switch (epdata->state) {
	case STATE_EP_ENABLED:
314 315 316 317
		return 0;
	case STATE_EP_READY:			/* not configured yet */
		if (is_write)
			return 0;
318
		fallthrough;
319
	case STATE_EP_UNBOUND:			/* clean disconnect */
Linus Torvalds's avatar
Linus Torvalds committed
320 321 322 323 324 325
		break;
	// case STATE_EP_DISABLED:		/* "can't happen" */
	default:				/* error! */
		pr_debug ("%s: ep %p not available, state %d\n",
				shortname, epdata, epdata->state);
	}
326 327
	mutex_unlock(&epdata->lock);
	return -ENODEV;
Linus Torvalds's avatar
Linus Torvalds committed
328 329 330 331 332
}

static ssize_t
ep_io (struct ep_data *epdata, void *buf, unsigned len)
{
333
	DECLARE_COMPLETION_ONSTACK (done);
Linus Torvalds's avatar
Linus Torvalds committed
334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349
	int value;

	spin_lock_irq (&epdata->dev->lock);
	if (likely (epdata->ep != NULL)) {
		struct usb_request	*req = epdata->req;

		req->context = &done;
		req->complete = epio_complete;
		req->buf = buf;
		req->length = len;
		value = usb_ep_queue (epdata->ep, req, GFP_ATOMIC);
	} else
		value = -ENODEV;
	spin_unlock_irq (&epdata->dev->lock);

	if (likely (value == 0)) {
350
		value = wait_for_completion_interruptible(&done);
Linus Torvalds's avatar
Linus Torvalds committed
351 352 353 354 355 356 357 358
		if (value != 0) {
			spin_lock_irq (&epdata->dev->lock);
			if (likely (epdata->ep != NULL)) {
				DBG (epdata->dev, "%s i/o interrupted\n",
						epdata->name);
				usb_ep_dequeue (epdata->ep, epdata->req);
				spin_unlock_irq (&epdata->dev->lock);

359
				wait_for_completion(&done);
Linus Torvalds's avatar
Linus Torvalds committed
360 361 362 363 364 365
				if (epdata->status == -ECONNRESET)
					epdata->status = -EINTR;
			} else {
				spin_unlock_irq (&epdata->dev->lock);

				DBG (epdata->dev, "endpoint gone\n");
366
				wait_for_completion(&done);
Linus Torvalds's avatar
Linus Torvalds committed
367 368 369 370 371 372 373 374 375 376 377 378
				epdata->status = -ENODEV;
			}
		}
		return epdata->status;
	}
	return value;
}

static int
ep_release (struct inode *inode, struct file *fd)
{
	struct ep_data		*data = fd->private_data;
379 380
	int value;

381 382
	value = mutex_lock_interruptible(&data->lock);
	if (value < 0)
383
		return value;
Linus Torvalds's avatar
Linus Torvalds committed
384 385 386 387 388 389

	/* clean up if this can be reopened */
	if (data->state != STATE_EP_UNBOUND) {
		data->state = STATE_EP_DISABLED;
		data->desc.bDescriptorType = 0;
		data->hs_desc.bDescriptorType = 0;
390
		usb_ep_disable(data->ep);
Linus Torvalds's avatar
Linus Torvalds committed
391
	}
392
	mutex_unlock(&data->lock);
Linus Torvalds's avatar
Linus Torvalds committed
393 394 395 396
	put_ep (data);
	return 0;
}

397
static long ep_ioctl(struct file *fd, unsigned code, unsigned long value)
Linus Torvalds's avatar
Linus Torvalds committed
398 399 400 401
{
	struct ep_data		*data = fd->private_data;
	int			status;

402
	if ((status = get_ready_ep (fd->f_flags, data, false)) < 0)
Linus Torvalds's avatar
Linus Torvalds committed
403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422
		return status;

	spin_lock_irq (&data->dev->lock);
	if (likely (data->ep != NULL)) {
		switch (code) {
		case GADGETFS_FIFO_STATUS:
			status = usb_ep_fifo_status (data->ep);
			break;
		case GADGETFS_FIFO_FLUSH:
			usb_ep_fifo_flush (data->ep);
			break;
		case GADGETFS_CLEAR_HALT:
			status = usb_ep_clear_halt (data->ep);
			break;
		default:
			status = -ENOTTY;
		}
	} else
		status = -ENODEV;
	spin_unlock_irq (&data->dev->lock);
423
	mutex_unlock(&data->lock);
Linus Torvalds's avatar
Linus Torvalds committed
424 425 426 427 428 429 430 431 432 433
	return status;
}

/*----------------------------------------------------------------------*/

/* ASYNCHRONOUS ENDPOINT I/O OPERATIONS (bulk/intr/iso) */

struct kiocb_priv {
	struct usb_request	*req;
	struct ep_data		*epdata;
434 435 436
	struct kiocb		*iocb;
	struct mm_struct	*mm;
	struct work_struct	work;
Linus Torvalds's avatar
Linus Torvalds committed
437
	void			*buf;
438 439
	struct iov_iter		to;
	const void		*to_free;
Linus Torvalds's avatar
Linus Torvalds committed
440 441 442
	unsigned		actual;
};

443
static int ep_aio_cancel(struct kiocb *iocb)
Linus Torvalds's avatar
Linus Torvalds committed
444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461
{
	struct kiocb_priv	*priv = iocb->private;
	struct ep_data		*epdata;
	int			value;

	local_irq_disable();
	epdata = priv->epdata;
	// spin_lock(&epdata->dev->lock);
	if (likely(epdata && epdata->ep && priv->req))
		value = usb_ep_dequeue (epdata->ep, priv->req);
	else
		value = -EINVAL;
	// spin_unlock(&epdata->dev->lock);
	local_irq_enable();

	return value;
}

462 463 464 465 466 467 468
static void ep_user_copy_worker(struct work_struct *work)
{
	struct kiocb_priv *priv = container_of(work, struct kiocb_priv, work);
	struct mm_struct *mm = priv->mm;
	struct kiocb *iocb = priv->iocb;
	size_t ret;

469
	kthread_use_mm(mm);
470
	ret = copy_to_iter(priv->buf, priv->actual, &priv->to);
471
	kthread_unuse_mm(mm);
472 473
	if (!ret)
		ret = -EFAULT;
474 475

	/* completing the iocb can drop the ctx and mm, don't touch mm after */
476
	iocb->ki_complete(iocb, ret);
477

478
	kfree(priv->buf);
479
	kfree(priv->to_free);
480
	kfree(priv);
Linus Torvalds's avatar
Linus Torvalds committed
481 482 483 484 485 486 487 488 489 490 491 492
}

static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
{
	struct kiocb		*iocb = req->context;
	struct kiocb_priv	*priv = iocb->private;
	struct ep_data		*epdata = priv->epdata;

	/* lock against disconnect (and ideally, cancel) */
	spin_lock(&epdata->dev->lock);
	priv->req = NULL;
	priv->epdata = NULL;
Alan Stern's avatar
Alan Stern committed
493 494 495 496 497

	/* if this was a write or a read returning no data then we
	 * don't need to copy anything to userspace, so we can
	 * complete the aio request immediately.
	 */
498
	if (priv->to_free == NULL || unlikely(req->actual == 0)) {
Linus Torvalds's avatar
Linus Torvalds committed
499
		kfree(req->buf);
500
		kfree(priv->to_free);
Linus Torvalds's avatar
Linus Torvalds committed
501 502
		kfree(priv);
		iocb->private = NULL;
503
		iocb->ki_complete(iocb,
504
				req->actual ? req->actual : (long)req->status);
Linus Torvalds's avatar
Linus Torvalds committed
505
	} else {
506
		/* ep_copy_to_user() won't report both; we hide some faults */
Linus Torvalds's avatar
Linus Torvalds committed
507 508 509 510 511 512
		if (unlikely(0 != req->status))
			DBG(epdata->dev, "%s fault %d len %d\n",
				ep->name, req->status, req->actual);

		priv->buf = req->buf;
		priv->actual = req->actual;
513
		INIT_WORK(&priv->work, ep_user_copy_worker);
514
		schedule_work(&priv->work);
Linus Torvalds's avatar
Linus Torvalds committed
515 516 517
	}

	usb_ep_free_request(ep, req);
518
	spin_unlock(&epdata->dev->lock);
Linus Torvalds's avatar
Linus Torvalds committed
519 520 521
	put_ep(epdata);
}

522 523 524 525 526
static ssize_t ep_aio(struct kiocb *iocb,
		      struct kiocb_priv *priv,
		      struct ep_data *epdata,
		      char *buf,
		      size_t len)
Linus Torvalds's avatar
Linus Torvalds committed
527
{
528 529
	struct usb_request *req;
	ssize_t value;
Linus Torvalds's avatar
Linus Torvalds committed
530 531

	iocb->private = priv;
532
	priv->iocb = iocb;
Linus Torvalds's avatar
Linus Torvalds committed
533

534
	kiocb_set_cancel_fn(iocb, ep_aio_cancel);
Linus Torvalds's avatar
Linus Torvalds committed
535 536 537
	get_ep(epdata);
	priv->epdata = epdata;
	priv->actual = 0;
538
	priv->mm = current->mm; /* mm teardown waits for iocbs in exit_aio() */
Linus Torvalds's avatar
Linus Torvalds committed
539 540 541 542 543

	/* each kiocb is coupled to one usb_request, but we can't
	 * allocate or submit those if the host disconnected.
	 */
	spin_lock_irq(&epdata->dev->lock);
544
	value = -ENODEV;
545
	if (unlikely(epdata->ep == NULL))
546
		goto fail;
Linus Torvalds's avatar
Linus Torvalds committed
547

548 549 550 551
	req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
	value = -ENOMEM;
	if (unlikely(!req))
		goto fail;
Linus Torvalds's avatar
Linus Torvalds committed
552

553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570
	priv->req = req;
	req->buf = buf;
	req->length = len;
	req->complete = ep_aio_complete;
	req->context = iocb;
	value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC);
	if (unlikely(0 != value)) {
		usb_ep_free_request(epdata->ep, req);
		goto fail;
	}
	spin_unlock_irq(&epdata->dev->lock);
	return -EIOCBQUEUED;

fail:
	spin_unlock_irq(&epdata->dev->lock);
	kfree(priv->to_free);
	kfree(priv);
	put_ep(epdata);
Linus Torvalds's avatar
Linus Torvalds committed
571 572 573 574
	return value;
}

static ssize_t
575
ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
Linus Torvalds's avatar
Linus Torvalds committed
576
{
577 578 579 580 581
	struct file *file = iocb->ki_filp;
	struct ep_data *epdata = file->private_data;
	size_t len = iov_iter_count(to);
	ssize_t value;
	char *buf;
Linus Torvalds's avatar
Linus Torvalds committed
582

583
	if ((value = get_ready_ep(file->f_flags, epdata, false)) < 0)
584
		return value;
585

586 587 588 589 590 591 592 593 594 595 596 597 598 599 600
	/* halt any endpoint by doing a "wrong direction" i/o call */
	if (usb_endpoint_dir_in(&epdata->desc)) {
		if (usb_endpoint_xfer_isoc(&epdata->desc) ||
		    !is_sync_kiocb(iocb)) {
			mutex_unlock(&epdata->lock);
			return -EINVAL;
		}
		DBG (epdata->dev, "%s halt\n", epdata->name);
		spin_lock_irq(&epdata->dev->lock);
		if (likely(epdata->ep != NULL))
			usb_ep_set_halt(epdata->ep);
		spin_unlock_irq(&epdata->dev->lock);
		mutex_unlock(&epdata->lock);
		return -EBADMSG;
	}
601

602 603 604 605 606 607 608
	buf = kmalloc(len, GFP_KERNEL);
	if (unlikely(!buf)) {
		mutex_unlock(&epdata->lock);
		return -ENOMEM;
	}
	if (is_sync_kiocb(iocb)) {
		value = ep_io(epdata, buf, len);
609
		if (value >= 0 && (copy_to_iter(buf, value, to) != value))
610 611 612 613 614 615 616
			value = -EFAULT;
	} else {
		struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
		value = -ENOMEM;
		if (!priv)
			goto fail;
		priv->to_free = dup_iter(&priv->to, to, GFP_KERNEL);
617
		if (!iter_is_ubuf(&priv->to) && !priv->to_free) {
618 619 620 621 622 623 624 625 626 627 628
			kfree(priv);
			goto fail;
		}
		value = ep_aio(iocb, priv, epdata, buf, len);
		if (value == -EIOCBQUEUED)
			buf = NULL;
	}
fail:
	kfree(buf);
	mutex_unlock(&epdata->lock);
	return value;
Linus Torvalds's avatar
Linus Torvalds committed
629 630
}

631 632
static ssize_t ep_config(struct ep_data *, const char *, size_t);

Linus Torvalds's avatar
Linus Torvalds committed
633
static ssize_t
634
ep_write_iter(struct kiocb *iocb, struct iov_iter *from)
Linus Torvalds's avatar
Linus Torvalds committed
635
{
636 637 638
	struct file *file = iocb->ki_filp;
	struct ep_data *epdata = file->private_data;
	size_t len = iov_iter_count(from);
639
	bool configured;
640 641
	ssize_t value;
	char *buf;
Linus Torvalds's avatar
Linus Torvalds committed
642

643
	if ((value = get_ready_ep(file->f_flags, epdata, true)) < 0)
644 645
		return value;

646 647
	configured = epdata->state == STATE_EP_ENABLED;

648
	/* halt any endpoint by doing a "wrong direction" i/o call */
649
	if (configured && !usb_endpoint_dir_in(&epdata->desc)) {
650 651 652 653 654 655 656 657 658 659 660 661 662
		if (usb_endpoint_xfer_isoc(&epdata->desc) ||
		    !is_sync_kiocb(iocb)) {
			mutex_unlock(&epdata->lock);
			return -EINVAL;
		}
		DBG (epdata->dev, "%s halt\n", epdata->name);
		spin_lock_irq(&epdata->dev->lock);
		if (likely(epdata->ep != NULL))
			usb_ep_set_halt(epdata->ep);
		spin_unlock_irq(&epdata->dev->lock);
		mutex_unlock(&epdata->lock);
		return -EBADMSG;
	}
663

664 665 666
	buf = kmalloc(len, GFP_KERNEL);
	if (unlikely(!buf)) {
		mutex_unlock(&epdata->lock);
Linus Torvalds's avatar
Linus Torvalds committed
667
		return -ENOMEM;
668
	}
669

670
	if (unlikely(!copy_from_iter_full(buf, len, from))) {
671 672 673 674
		value = -EFAULT;
		goto out;
	}

675 676 677
	if (unlikely(!configured)) {
		value = ep_config(epdata, buf, len);
	} else if (is_sync_kiocb(iocb)) {
678 679 680 681 682 683 684 685
		value = ep_io(epdata, buf, len);
	} else {
		struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
		value = -ENOMEM;
		if (priv) {
			value = ep_aio(iocb, priv, epdata, buf, len);
			if (value == -EIOCBQUEUED)
				buf = NULL;
686
		}
Linus Torvalds's avatar
Linus Torvalds committed
687
	}
688 689 690 691
out:
	kfree(buf);
	mutex_unlock(&epdata->lock);
	return value;
Linus Torvalds's avatar
Linus Torvalds committed
692 693 694 695 696
}

/*----------------------------------------------------------------------*/

/* used after endpoint configuration */
697
static const struct file_operations ep_io_operations = {
Linus Torvalds's avatar
Linus Torvalds committed
698 699
	.owner =	THIS_MODULE,

700 701 702
	.open =		ep_open,
	.release =	ep_release,
	.llseek =	no_llseek,
703
	.unlocked_ioctl = ep_ioctl,
704 705
	.read_iter =	ep_read_iter,
	.write_iter =	ep_write_iter,
Linus Torvalds's avatar
Linus Torvalds committed
706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721
};

/* ENDPOINT INITIALIZATION
 *
 *     fd = open ("/dev/gadget/$ENDPOINT", O_RDWR)
 *     status = write (fd, descriptors, sizeof descriptors)
 *
 * That write establishes the endpoint configuration, configuring
 * the controller to process bulk, interrupt, or isochronous transfers
 * at the right maxpacket size, and so on.
 *
 * The descriptors are message type 1, identified by a host order u32
 * at the beginning of what's written.  Descriptor order is: full/low
 * speed descriptor, then optional high speed descriptor.
 */
static ssize_t
722
ep_config (struct ep_data *data, const char *buf, size_t len)
Linus Torvalds's avatar
Linus Torvalds committed
723 724 725
{
	struct usb_ep		*ep;
	u32			tag;
726
	int			value, length = len;
Linus Torvalds's avatar
Linus Torvalds committed
727 728 729 730 731 732 733 734 735 736 737

	if (data->state != STATE_EP_READY) {
		value = -EL2HLT;
		goto fail;
	}

	value = len;
	if (len < USB_DT_ENDPOINT_SIZE + 4)
		goto fail0;

	/* we might need to change message format someday */
738
	memcpy(&tag, buf, 4);
Linus Torvalds's avatar
Linus Torvalds committed
739 740 741 742 743 744 745 746 747 748 749 750
	if (tag != 1) {
		DBG(data->dev, "config %s, bad tag %d\n", data->name, tag);
		goto fail0;
	}
	buf += 4;
	len -= 4;

	/* NOTE:  audio endpoint extensions not accepted here;
	 * just don't include the extra bytes.
	 */

	/* full/low speed descriptor, then high speed */
751
	memcpy(&data->desc, buf, USB_DT_ENDPOINT_SIZE);
Linus Torvalds's avatar
Linus Torvalds committed
752 753 754 755 756 757
	if (data->desc.bLength != USB_DT_ENDPOINT_SIZE
			|| data->desc.bDescriptorType != USB_DT_ENDPOINT)
		goto fail0;
	if (len != USB_DT_ENDPOINT_SIZE) {
		if (len != 2 * USB_DT_ENDPOINT_SIZE)
			goto fail0;
758 759
		memcpy(&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE,
			USB_DT_ENDPOINT_SIZE);
Linus Torvalds's avatar
Linus Torvalds committed
760 761 762 763 764 765 766 767 768 769 770 771 772
		if (data->hs_desc.bLength != USB_DT_ENDPOINT_SIZE
				|| data->hs_desc.bDescriptorType
					!= USB_DT_ENDPOINT) {
			DBG(data->dev, "config %s, bad hs length or type\n",
					data->name);
			goto fail0;
		}
	}

	spin_lock_irq (&data->dev->lock);
	if (data->dev->state == STATE_DEV_UNBOUND) {
		value = -ENOENT;
		goto gone;
773 774 775 776 777 778
	} else {
		ep = data->ep;
		if (ep == NULL) {
			value = -ENODEV;
			goto gone;
		}
Linus Torvalds's avatar
Linus Torvalds committed
779 780 781 782
	}
	switch (data->dev->gadget->speed) {
	case USB_SPEED_LOW:
	case USB_SPEED_FULL:
783
		ep->desc = &data->desc;
Linus Torvalds's avatar
Linus Torvalds committed
784 785 786
		break;
	case USB_SPEED_HIGH:
		/* fails if caller didn't provide that descriptor... */
787
		ep->desc = &data->hs_desc;
Linus Torvalds's avatar
Linus Torvalds committed
788 789
		break;
	default:
790
		DBG(data->dev, "unconnected, %s init abandoned\n",
Linus Torvalds's avatar
Linus Torvalds committed
791
				data->name);
792
		value = -EINVAL;
793
		goto gone;
Linus Torvalds's avatar
Linus Torvalds committed
794
	}
795
	value = usb_ep_enable(ep);
796
	if (value == 0) {
797
		data->state = STATE_EP_ENABLED;
798 799
		value = length;
	}
Linus Torvalds's avatar
Linus Torvalds committed
800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815
gone:
	spin_unlock_irq (&data->dev->lock);
	if (value < 0) {
fail:
		data->desc.bDescriptorType = 0;
		data->hs_desc.bDescriptorType = 0;
	}
	return value;
fail0:
	value = -EINVAL;
	goto fail;
}

static int
ep_open (struct inode *inode, struct file *fd)
{
816
	struct ep_data		*data = inode->i_private;
Linus Torvalds's avatar
Linus Torvalds committed
817 818
	int			value = -EBUSY;

819
	if (mutex_lock_interruptible(&data->lock) != 0)
Linus Torvalds's avatar
Linus Torvalds committed
820 821 822 823 824 825 826 827 828 829 830 831 832 833
		return -EINTR;
	spin_lock_irq (&data->dev->lock);
	if (data->dev->state == STATE_DEV_UNBOUND)
		value = -ENOENT;
	else if (data->state == STATE_EP_DISABLED) {
		value = 0;
		data->state = STATE_EP_READY;
		get_ep (data);
		fd->private_data = data;
		VDEBUG (data->dev, "%s ready\n", data->name);
	} else
		DBG (data->dev, "%s state %d\n",
			data->name, data->state);
	spin_unlock_irq (&data->dev->lock);
834
	mutex_unlock(&data->lock);
Linus Torvalds's avatar
Linus Torvalds committed
835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857
	return value;
}

/*----------------------------------------------------------------------*/

/* EP0 IMPLEMENTATION can be partly in userspace.
 *
 * Drivers that use this facility receive various events, including
 * control requests the kernel doesn't handle.  Drivers that don't
 * use this facility may be too simple-minded for real applications.
 */

static inline void ep0_readable (struct dev_data *dev)
{
	wake_up (&dev->wait);
	kill_fasync (&dev->fasync, SIGIO, POLL_IN);
}

static void clean_req (struct usb_ep *ep, struct usb_request *req)
{
	struct dev_data		*dev = ep->driver_data;

	if (req->buf != dev->rbuf) {
858
		kfree(req->buf);
Linus Torvalds's avatar
Linus Torvalds committed
859 860 861 862 863 864 865 866 867
		req->buf = dev->rbuf;
	}
	req->complete = epio_complete;
	dev->setup_out_ready = 0;
}

static void ep0_complete (struct usb_ep *ep, struct usb_request *req)
{
	struct dev_data		*dev = ep->driver_data;
David Brownell's avatar
David Brownell committed
868
	unsigned long		flags;
Linus Torvalds's avatar
Linus Torvalds committed
869 870 871
	int			free = 1;

	/* for control OUT, data must still get to userspace */
David Brownell's avatar
David Brownell committed
872
	spin_lock_irqsave(&dev->lock, flags);
Linus Torvalds's avatar
Linus Torvalds committed
873 874 875 876 877 878
	if (!dev->setup_in) {
		dev->setup_out_error = (req->status != 0);
		if (!dev->setup_out_error)
			free = 0;
		dev->setup_out_ready = 1;
		ep0_readable (dev);
David Brownell's avatar
David Brownell committed
879
	}
Linus Torvalds's avatar
Linus Torvalds committed
880 881 882 883 884

	/* clean up as appropriate */
	if (free && req->buf != &dev->rbuf)
		clean_req (ep, req);
	req->complete = epio_complete;
David Brownell's avatar
David Brownell committed
885
	spin_unlock_irqrestore(&dev->lock, flags);
Linus Torvalds's avatar
Linus Torvalds committed
886 887 888 889 890 891 892 893 894 895 896
}

static int setup_req (struct usb_ep *ep, struct usb_request *req, u16 len)
{
	struct dev_data	*dev = ep->driver_data;

	if (dev->setup_out_ready) {
		DBG (dev, "ep0 request busy!\n");
		return -EBUSY;
	}
	if (len > sizeof (dev->rbuf))
897
		req->buf = kmalloc(len, GFP_ATOMIC);
898
	if (req->buf == NULL) {
Linus Torvalds's avatar
Linus Torvalds committed
899 900 901 902 903
		req->buf = dev->rbuf;
		return -ENOMEM;
	}
	req->complete = ep0_complete;
	req->length = len;
904
	req->zero = 0;
Linus Torvalds's avatar
Linus Torvalds committed
905 906 907 908 909 910 911 912 913 914 915
	return 0;
}

static ssize_t
ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
{
	struct dev_data			*dev = fd->private_data;
	ssize_t				retval;
	enum ep0_state			state;

	spin_lock_irq (&dev->lock);
916 917 918 919
	if (dev->state <= STATE_DEV_OPENED) {
		retval = -EINVAL;
		goto done;
	}
Linus Torvalds's avatar
Linus Torvalds committed
920 921 922 923 924 925 926 927 928

	/* report fd mode change before acting on it */
	if (dev->setup_abort) {
		dev->setup_abort = 0;
		retval = -EIDRM;
		goto done;
	}

	/* control DATA stage */
David Brownell's avatar
David Brownell committed
929
	if ((state = dev->state) == STATE_DEV_SETUP) {
Linus Torvalds's avatar
Linus Torvalds committed
930 931 932 933 934

		if (dev->setup_in) {		/* stall IN */
			VDEBUG(dev, "ep0in stall\n");
			(void) usb_ep_set_halt (dev->gadget->ep0);
			retval = -EL2HLT;
David Brownell's avatar
David Brownell committed
935
			dev->state = STATE_DEV_CONNECTED;
Linus Torvalds's avatar
Linus Torvalds committed
936 937 938 939 940

		} else if (len == 0) {		/* ack SET_CONFIGURATION etc */
			struct usb_ep		*ep = dev->gadget->ep0;
			struct usb_request	*req = dev->req;

941
			if ((retval = setup_req (ep, req, 0)) == 0) {
942
				++dev->udc_usage;
943 944 945
				spin_unlock_irq (&dev->lock);
				retval = usb_ep_queue (ep, req, GFP_KERNEL);
				spin_lock_irq (&dev->lock);
946
				--dev->udc_usage;
947
			}
David Brownell's avatar
David Brownell committed
948
			dev->state = STATE_DEV_CONNECTED;
Linus Torvalds's avatar
Linus Torvalds committed
949 950 951 952

			/* assume that was SET_CONFIGURATION */
			if (dev->current_config) {
				unsigned power;
953 954 955 956

				if (gadget_is_dualspeed(dev->gadget)
						&& (dev->gadget->speed
							== USB_SPEED_HIGH))
Linus Torvalds's avatar
Linus Torvalds committed
957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976
					power = dev->hs_config->bMaxPower;
				else
					power = dev->config->bMaxPower;
				usb_gadget_vbus_draw(dev->gadget, 2 * power);
			}

		} else {			/* collect OUT data */
			if ((fd->f_flags & O_NONBLOCK) != 0
					&& !dev->setup_out_ready) {
				retval = -EAGAIN;
				goto done;
			}
			spin_unlock_irq (&dev->lock);
			retval = wait_event_interruptible (dev->wait,
					dev->setup_out_ready != 0);

			/* FIXME state could change from under us */
			spin_lock_irq (&dev->lock);
			if (retval)
				goto done;
David Brownell's avatar
David Brownell committed
977 978 979 980 981 982 983

			if (dev->state != STATE_DEV_SETUP) {
				retval = -ECANCELED;
				goto done;
			}
			dev->state = STATE_DEV_CONNECTED;

Linus Torvalds's avatar
Linus Torvalds committed
984 985 986 987
			if (dev->setup_out_error)
				retval = -EIO;
			else {
				len = min (len, (size_t)dev->req->actual);
988 989
				++dev->udc_usage;
				spin_unlock_irq(&dev->lock);
Skip Hansen's avatar
Skip Hansen committed
990
				if (copy_to_user (buf, dev->req->buf, len))
Linus Torvalds's avatar
Linus Torvalds committed
991
					retval = -EFAULT;
992 993
				else
					retval = len;
994 995
				spin_lock_irq(&dev->lock);
				--dev->udc_usage;
Linus Torvalds's avatar
Linus Torvalds committed
996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016
				clean_req (dev->gadget->ep0, dev->req);
				/* NOTE userspace can't yet choose to stall */
			}
		}
		goto done;
	}

	/* else normal: return event data */
	if (len < sizeof dev->event [0]) {
		retval = -EINVAL;
		goto done;
	}
	len -= len % sizeof (struct usb_gadgetfs_event);
	dev->usermode_setup = 1;

scan:
	/* return queued events right away */
	if (dev->ev_next != 0) {
		unsigned		i, n;

		n = len / sizeof (struct usb_gadgetfs_event);
1017 1018
		if (dev->ev_next < n)
			n = dev->ev_next;
Linus Torvalds's avatar
Linus Torvalds committed
1019

1020
		/* ep0 i/o has special semantics during STATE_DEV_SETUP */
Linus Torvalds's avatar
Linus Torvalds committed
1021 1022
		for (i = 0; i < n; i++) {
			if (dev->event [i].type == GADGETFS_SETUP) {
1023 1024
				dev->state = STATE_DEV_SETUP;
				n = i + 1;
Linus Torvalds's avatar
Linus Torvalds committed
1025 1026 1027 1028
				break;
			}
		}
		spin_unlock_irq (&dev->lock);
1029
		len = n * sizeof (struct usb_gadgetfs_event);
Linus Torvalds's avatar
Linus Torvalds committed
1030 1031 1032 1033 1034 1035 1036 1037 1038
		if (copy_to_user (buf, &dev->event, len))
			retval = -EFAULT;
		else
			retval = len;
		if (len > 0) {
			/* NOTE this doesn't guard against broken drivers;
			 * concurrent ep0 readers may lose events.
			 */
			spin_lock_irq (&dev->lock);
1039 1040
			if (dev->ev_next > n) {
				memmove(&dev->event[0], &dev->event[n],
Linus Torvalds's avatar
Linus Torvalds committed
1041
					sizeof (struct usb_gadgetfs_event)
1042 1043 1044
						* (dev->ev_next - n));
			}
			dev->ev_next -= n;
Linus Torvalds's avatar
Linus Torvalds committed
1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055
			spin_unlock_irq (&dev->lock);
		}
		return retval;
	}
	if (fd->f_flags & O_NONBLOCK) {
		retval = -EAGAIN;
		goto done;
	}

	switch (state) {
	default:
1056
		DBG (dev, "fail %s, state %d\n", __func__, state);
Linus Torvalds's avatar
Linus Torvalds committed
1057 1058
		retval = -ESRCH;
		break;
David Brownell's avatar
David Brownell committed
1059 1060
	case STATE_DEV_UNCONNECTED:
	case STATE_DEV_CONNECTED:
Linus Torvalds's avatar
Linus Torvalds committed
1061
		spin_unlock_irq (&dev->lock);
1062
		DBG (dev, "%s wait\n", __func__);
Linus Torvalds's avatar
Linus Torvalds committed
1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086

		/* wait for events */
		retval = wait_event_interruptible (dev->wait,
				dev->ev_next != 0);
		if (retval < 0)
			return retval;
		spin_lock_irq (&dev->lock);
		goto scan;
	}

done:
	spin_unlock_irq (&dev->lock);
	return retval;
}

static struct usb_gadgetfs_event *
next_event (struct dev_data *dev, enum usb_gadgetfs_event_type type)
{
	struct usb_gadgetfs_event	*event;
	unsigned			i;

	switch (type) {
	/* these events purge the queue */
	case GADGETFS_DISCONNECT:
David Brownell's avatar
David Brownell committed
1087
		if (dev->state == STATE_DEV_SETUP)
Linus Torvalds's avatar
Linus Torvalds committed
1088
			dev->setup_abort = 1;
1089
		fallthrough;
Linus Torvalds's avatar
Linus Torvalds committed
1090 1091 1092 1093 1094 1095 1096 1097 1098
	case GADGETFS_CONNECT:
		dev->ev_next = 0;
		break;
	case GADGETFS_SETUP:		/* previous request timed out */
	case GADGETFS_SUSPEND:		/* same effect */
		/* these events can't be repeated */
		for (i = 0; i != dev->ev_next; i++) {
			if (dev->event [i].type != type)
				continue;
1099
			DBG(dev, "discard old event[%d] %d\n", i, type);
Linus Torvalds's avatar
Linus Torvalds committed
1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111
			dev->ev_next--;
			if (i == dev->ev_next)
				break;
			/* indices start at zero, for simplicity */
			memmove (&dev->event [i], &dev->event [i + 1],
				sizeof (struct usb_gadgetfs_event)
					* (dev->ev_next - i));
		}
		break;
	default:
		BUG ();
	}
1112
	VDEBUG(dev, "event[%d] = %d\n", dev->ev_next, type);
Linus Torvalds's avatar
Linus Torvalds committed
1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131
	event = &dev->event [dev->ev_next++];
	BUG_ON (dev->ev_next > N_EVENT);
	memset (event, 0, sizeof *event);
	event->type = type;
	return event;
}

static ssize_t
ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
{
	struct dev_data		*dev = fd->private_data;
	ssize_t			retval = -ESRCH;

	/* report fd mode change before acting on it */
	if (dev->setup_abort) {
		dev->setup_abort = 0;
		retval = -EIDRM;

	/* data and/or status stage for control request */
David Brownell's avatar
David Brownell committed
1132
	} else if (dev->state == STATE_DEV_SETUP) {
Linus Torvalds's avatar
Linus Torvalds committed
1133

1134
		len = min_t(size_t, len, dev->setup_wLength);
Linus Torvalds's avatar
Linus Torvalds committed
1135 1136 1137
		if (dev->setup_in) {
			retval = setup_req (dev->gadget->ep0, dev->req, len);
			if (retval == 0) {
David Brownell's avatar
David Brownell committed
1138
				dev->state = STATE_DEV_CONNECTED;
1139
				++dev->udc_usage;
Linus Torvalds's avatar
Linus Torvalds committed
1140 1141 1142
				spin_unlock_irq (&dev->lock);
				if (copy_from_user (dev->req->buf, buf, len))
					retval = -EFAULT;
1143 1144 1145
				else {
					if (len < dev->setup_wLength)
						dev->req->zero = 1;
Linus Torvalds's avatar
Linus Torvalds committed
1146 1147 1148
					retval = usb_ep_queue (
						dev->gadget->ep0, dev->req,
						GFP_KERNEL);
1149
				}
1150
				spin_lock_irq(&dev->lock);
1151
				--dev->udc_usage;
Linus Torvalds's avatar
Linus Torvalds committed
1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164
				if (retval < 0) {
					clean_req (dev->gadget->ep0, dev->req);
				} else
					retval = len;

				return retval;
			}

		/* can stall some OUT transfers */
		} else if (dev->setup_can_stall) {
			VDEBUG(dev, "ep0out stall\n");
			(void) usb_ep_set_halt (dev->gadget->ep0);
			retval = -EL2HLT;
David Brownell's avatar
David Brownell committed
1165
			dev->state = STATE_DEV_CONNECTED;
Linus Torvalds's avatar
Linus Torvalds committed
1166 1167 1168 1169
		} else {
			DBG(dev, "bogus ep0out stall!\n");
		}
	} else
1170
		DBG (dev, "fail %s, state %d\n", __func__, dev->state);
Linus Torvalds's avatar
Linus Torvalds committed
1171 1172 1173 1174 1175 1176 1177 1178 1179

	return retval;
}

static int
ep0_fasync (int f, struct file *fd, int on)
{
	struct dev_data		*dev = fd->private_data;
	// caller must F_SETOWN before signal delivery happens
1180
	VDEBUG (dev, "%s %s\n", __func__, on ? "on" : "off");
Linus Torvalds's avatar
Linus Torvalds committed
1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192
	return fasync_helper (f, fd, on, &dev->fasync);
}

static struct usb_gadget_driver gadgetfs_driver;

static int
dev_release (struct inode *inode, struct file *fd)
{
	struct dev_data		*dev = fd->private_data;

	/* closing ep0 === shutdown all */

1193
	if (dev->gadget_registered) {
1194
		usb_gadget_unregister_driver (&gadgetfs_driver);
1195 1196
		dev->gadget_registered = false;
	}
Linus Torvalds's avatar
Linus Torvalds committed
1197 1198 1199 1200 1201 1202 1203 1204 1205

	/* at this point "good" hardware has disconnected the
	 * device from USB; the host won't see it any more.
	 * alternatively, all host requests will time out.
	 */

	kfree (dev->buf);
	dev->buf = NULL;

1206 1207 1208 1209 1210 1211
	/* other endpoints were all decoupled from this device */
	spin_lock_irq(&dev->lock);
	dev->state = STATE_DEV_DISABLED;
	spin_unlock_irq(&dev->lock);

	put_dev (dev);
Linus Torvalds's avatar
Linus Torvalds committed
1212 1213 1214
	return 0;
}

1215
static __poll_t
1216 1217
ep0_poll (struct file *fd, poll_table *wait)
{
1218 1219
	struct dev_data         *dev = fd->private_data;
	__poll_t                mask = 0;
1220

1221 1222 1223
	if (dev->state <= STATE_DEV_OPENED)
		return DEFAULT_POLLMASK;

1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241
	poll_wait(fd, &dev->wait, wait);

	spin_lock_irq(&dev->lock);

	/* report fd mode change before acting on it */
	if (dev->setup_abort) {
		dev->setup_abort = 0;
		mask = EPOLLHUP;
		goto out;
	}

	if (dev->state == STATE_DEV_SETUP) {
		if (dev->setup_in || dev->setup_can_stall)
			mask = EPOLLOUT;
	} else {
		if (dev->ev_next != 0)
			mask = EPOLLIN;
	}
1242
out:
1243 1244
	spin_unlock_irq(&dev->lock);
	return mask;
1245 1246
}

1247
static long gadget_dev_ioctl (struct file *fd, unsigned code, unsigned long value)
Linus Torvalds's avatar
Linus Torvalds committed
1248 1249 1250
{
	struct dev_data		*dev = fd->private_data;
	struct usb_gadget	*gadget = dev->gadget;
1251
	long ret = -ENOTTY;
Linus Torvalds's avatar
Linus Torvalds committed
1252

1253 1254 1255 1256 1257 1258 1259 1260
	spin_lock_irq(&dev->lock);
	if (dev->state == STATE_DEV_OPENED ||
			dev->state == STATE_DEV_UNBOUND) {
		/* Not bound to a UDC */
	} else if (gadget->ops->ioctl) {
		++dev->udc_usage;
		spin_unlock_irq(&dev->lock);

1261
		ret = gadget->ops->ioctl (gadget, code, value);
1262

1263 1264 1265 1266 1267
		spin_lock_irq(&dev->lock);
		--dev->udc_usage;
	}
	spin_unlock_irq(&dev->lock);

1268
	return ret;
Linus Torvalds's avatar
Linus Torvalds committed
1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285
}

/*----------------------------------------------------------------------*/

/* The in-kernel gadget driver handles most ep0 issues, in particular
 * enumerating the single configuration (as provided from user space).
 *
 * Unrecognized ep0 requests may be handled in user space.
 */

static void make_qualifier (struct dev_data *dev)
{
	struct usb_qualifier_descriptor		qual;
	struct usb_device_descriptor		*desc;

	qual.bLength = sizeof qual;
	qual.bDescriptorType = USB_DT_DEVICE_QUALIFIER;
1286
	qual.bcdUSB = cpu_to_le16 (0x0200);
Linus Torvalds's avatar
Linus Torvalds committed
1287 1288 1289 1290 1291 1292 1293

	desc = dev->dev;
	qual.bDeviceClass = desc->bDeviceClass;
	qual.bDeviceSubClass = desc->bDeviceSubClass;
	qual.bDeviceProtocol = desc->bDeviceProtocol;

	/* assumes ep0 uses the same value for both speeds ... */
1294
	qual.bMaxPacketSize0 = dev->gadget->ep0->maxpacket;
Linus Torvalds's avatar
Linus Torvalds committed
1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305

	qual.bNumConfigurations = 1;
	qual.bRESERVED = 0;

	memcpy (dev->rbuf, &qual, sizeof qual);
}

static int
config_buf (struct dev_data *dev, u8 type, unsigned index)
{
	int		len;
1306
	int		hs = 0;
Linus Torvalds's avatar
Linus Torvalds committed
1307 1308 1309 1310 1311

	/* only one configuration */
	if (index > 0)
		return -EINVAL;

1312 1313 1314 1315 1316
	if (gadget_is_dualspeed(dev->gadget)) {
		hs = (dev->gadget->speed == USB_SPEED_HIGH);
		if (type == USB_DT_OTHER_SPEED_CONFIG)
			hs = !hs;
	}
Linus Torvalds's avatar
Linus Torvalds committed
1317 1318
	if (hs) {
		dev->req->buf = dev->hs_config;
1319
		len = le16_to_cpu(dev->hs_config->wTotalLength);
1320
	} else {
Linus Torvalds's avatar
Linus Torvalds committed
1321
		dev->req->buf = dev->config;
1322
		len = le16_to_cpu(dev->config->wTotalLength);
Linus Torvalds's avatar
Linus Torvalds committed
1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334
	}
	((u8 *)dev->req->buf) [1] = type;
	return len;
}

static int
gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
{
	struct dev_data			*dev = get_gadget_data (gadget);
	struct usb_request		*req = dev->req;
	int				value = -EOPNOTSUPP;
	struct usb_gadgetfs_event	*event;
1335 1336
	u16				w_value = le16_to_cpu(ctrl->wValue);
	u16				w_length = le16_to_cpu(ctrl->wLength);
Linus Torvalds's avatar
Linus Torvalds committed
1337

1338
	if (w_length > RBUF_SIZE) {
1339
		if (ctrl->bRequestType & USB_DIR_IN) {
1340 1341 1342 1343 1344
			/* Cast away the const, we are going to overwrite on purpose. */
			__le16 *temp = (__le16 *)&ctrl->wLength;

			*temp = cpu_to_le16(RBUF_SIZE);
			w_length = RBUF_SIZE;
1345 1346
		} else {
			return value;
1347 1348 1349
		}
	}

Linus Torvalds's avatar
Linus Torvalds committed
1350 1351
	spin_lock (&dev->lock);
	dev->setup_abort = 0;
David Brownell's avatar
David Brownell committed
1352
	if (dev->state == STATE_DEV_UNCONNECTED) {
1353 1354 1355
		if (gadget_is_dualspeed(gadget)
				&& gadget->speed == USB_SPEED_HIGH
				&& dev->hs_config == NULL) {
1356
			spin_unlock(&dev->lock);
Linus Torvalds's avatar
Linus Torvalds committed
1357 1358 1359 1360
			ERROR (dev, "no high speed config??\n");
			return -EINVAL;
		}

1361 1362
		dev->state = STATE_DEV_CONNECTED;

Linus Torvalds's avatar
Linus Torvalds committed
1363 1364 1365 1366 1367 1368 1369 1370 1371 1372
		INFO (dev, "connected\n");
		event = next_event (dev, GADGETFS_CONNECT);
		event->u.speed = gadget->speed;
		ep0_readable (dev);

	/* host may have given up waiting for response.  we can miss control
	 * requests handled lower down (device/endpoint status and features);
	 * then ep0_{read,write} will report the wrong status. controller
	 * driver will have aborted pending i/o.
	 */
David Brownell's avatar
David Brownell committed
1373
	} else if (dev->state == STATE_DEV_SETUP)
Linus Torvalds's avatar
Linus Torvalds committed
1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386
		dev->setup_abort = 1;

	req->buf = dev->rbuf;
	req->context = NULL;
	switch (ctrl->bRequest) {

	case USB_REQ_GET_DESCRIPTOR:
		if (ctrl->bRequestType != USB_DIR_IN)
			goto unrecognized;
		switch (w_value >> 8) {

		case USB_DT_DEVICE:
			value = min (w_length, (u16) sizeof *dev->dev);
1387
			dev->dev->bMaxPacketSize0 = dev->gadget->ep0->maxpacket;
Linus Torvalds's avatar
Linus Torvalds committed
1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415
			req->buf = dev->dev;
			break;
		case USB_DT_DEVICE_QUALIFIER:
			if (!dev->hs_config)
				break;
			value = min (w_length, (u16)
				sizeof (struct usb_qualifier_descriptor));
			make_qualifier (dev);
			break;
		case USB_DT_OTHER_SPEED_CONFIG:
		case USB_DT_CONFIG:
			value = config_buf (dev,
					w_value >> 8,
					w_value & 0xff);
			if (value >= 0)
				value = min (w_length, (u16) value);
			break;
		case USB_DT_STRING:
			goto unrecognized;

		default:		// all others are errors
			break;
		}
		break;

	/* currently one config, two speeds */
	case USB_REQ_SET_CONFIGURATION:
		if (ctrl->bRequestType != 0)
1416
			goto unrecognized;
Linus Torvalds's avatar
Linus Torvalds committed
1417 1418 1419 1420 1421 1422 1423
		if (0 == (u8) w_value) {
			value = 0;
			dev->current_config = 0;
			usb_gadget_vbus_draw(gadget, 8 /* mA */ );
			// user mode expected to disable endpoints
		} else {
			u8	config, power;
1424 1425 1426

			if (gadget_is_dualspeed(gadget)
					&& gadget->speed == USB_SPEED_HIGH) {
Linus Torvalds's avatar
Linus Torvalds committed
1427 1428
				config = dev->hs_config->bConfigurationValue;
				power = dev->hs_config->bMaxPower;
1429
			} else {
Linus Torvalds's avatar
Linus Torvalds committed
1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451
				config = dev->config->bConfigurationValue;
				power = dev->config->bMaxPower;
			}

			if (config == (u8) w_value) {
				value = 0;
				dev->current_config = config;
				usb_gadget_vbus_draw(gadget, 2 * power);
			}
		}

		/* report SET_CONFIGURATION like any other control request,
		 * except that usermode may not stall this.  the next
		 * request mustn't be allowed start until this finishes:
		 * endpoints and threads set up, etc.
		 *
		 * NOTE:  older PXA hardware (before PXA 255: without UDCCFR)
		 * has bad/racey automagic that prevents synchronizing here.
		 * even kernel mode drivers often miss them.
		 */
		if (value == 0) {
			INFO (dev, "configuration #%d\n", dev->current_config);
1452
			usb_gadget_set_state(gadget, USB_STATE_CONFIGURED);
Linus Torvalds's avatar
Linus Torvalds committed
1453 1454 1455 1456 1457 1458 1459
			if (dev->usermode_setup) {
				dev->setup_can_stall = 0;
				goto delegate;
			}
		}
		break;

1460
#ifndef	CONFIG_USB_PXA25X
Linus Torvalds's avatar
Linus Torvalds committed
1461 1462 1463
	/* PXA automagically handles this request too */
	case USB_REQ_GET_CONFIGURATION:
		if (ctrl->bRequestType != 0x80)
1464
			goto unrecognized;
Linus Torvalds's avatar
Linus Torvalds committed
1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482
		*(u8 *)req->buf = dev->current_config;
		value = min (w_length, (u16) 1);
		break;
#endif

	default:
unrecognized:
		VDEBUG (dev, "%s req%02x.%02x v%04x i%04x l%d\n",
			dev->usermode_setup ? "delegate" : "fail",
			ctrl->bRequestType, ctrl->bRequest,
			w_value, le16_to_cpu(ctrl->wIndex), w_length);

		/* if there's an ep0 reader, don't stall */
		if (dev->usermode_setup) {
			dev->setup_can_stall = 1;
delegate:
			dev->setup_in = (ctrl->bRequestType & USB_DIR_IN)
						? 1 : 0;
1483
			dev->setup_wLength = w_length;
Linus Torvalds's avatar
Linus Torvalds committed
1484 1485 1486 1487 1488 1489 1490 1491 1492
			dev->setup_out_ready = 0;
			dev->setup_out_error = 0;

			/* read DATA stage for OUT right away */
			if (unlikely (!dev->setup_in && w_length)) {
				value = setup_req (gadget->ep0, dev->req,
							w_length);
				if (value < 0)
					break;
1493

1494
				++dev->udc_usage;
1495
				spin_unlock (&dev->lock);
Linus Torvalds's avatar
Linus Torvalds committed
1496
				value = usb_ep_queue (gadget->ep0, dev->req,
1497 1498
							GFP_KERNEL);
				spin_lock (&dev->lock);
1499
				--dev->udc_usage;
Linus Torvalds's avatar
Linus Torvalds committed
1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518
				if (value < 0) {
					clean_req (gadget->ep0, dev->req);
					break;
				}

				/* we can't currently stall these */
				dev->setup_can_stall = 0;
			}

			/* state changes when reader collects event */
			event = next_event (dev, GADGETFS_SETUP);
			event->u.setup = *ctrl;
			ep0_readable (dev);
			spin_unlock (&dev->lock);
			return 0;
		}
	}

	/* proceed with data transfer and status phases? */
David Brownell's avatar
David Brownell committed
1519
	if (value >= 0 && dev->state != STATE_DEV_SETUP) {
Linus Torvalds's avatar
Linus Torvalds committed
1520 1521
		req->length = value;
		req->zero = value < w_length;
1522

1523
		++dev->udc_usage;
1524 1525
		spin_unlock (&dev->lock);
		value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL);
1526 1527 1528
		spin_lock(&dev->lock);
		--dev->udc_usage;
		spin_unlock(&dev->lock);
Linus Torvalds's avatar
Linus Torvalds committed
1529 1530 1531 1532
		if (value < 0) {
			DBG (dev, "ep_queue --> %d\n", value);
			req->status = 0;
		}
1533
		return value;
Linus Torvalds's avatar
Linus Torvalds committed
1534 1535 1536 1537 1538 1539 1540 1541 1542
	}

	/* device stalls when value < 0 */
	spin_unlock (&dev->lock);
	return value;
}

static void destroy_ep_files (struct dev_data *dev)
{
1543
	DBG (dev, "%s %d\n", __func__, dev->state);
Linus Torvalds's avatar
Linus Torvalds committed
1544 1545 1546

	/* dev->state must prevent interference */
	spin_lock_irq (&dev->lock);
1547
	while (!list_empty(&dev->epfiles)) {
Linus Torvalds's avatar
Linus Torvalds committed
1548 1549 1550 1551 1552
		struct ep_data	*ep;
		struct inode	*parent;
		struct dentry	*dentry;

		/* break link to FS */
1553
		ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles);
Linus Torvalds's avatar
Linus Torvalds committed
1554
		list_del_init (&ep->epfiles);
1555 1556
		spin_unlock_irq (&dev->lock);

Linus Torvalds's avatar
Linus Torvalds committed
1557 1558
		dentry = ep->dentry;
		ep->dentry = NULL;
1559
		parent = d_inode(dentry->d_parent);
Linus Torvalds's avatar
Linus Torvalds committed
1560 1561

		/* break link to controller */
1562
		mutex_lock(&ep->lock);
Linus Torvalds's avatar
Linus Torvalds committed
1563 1564 1565 1566 1567
		if (ep->state == STATE_EP_ENABLED)
			(void) usb_ep_disable (ep->ep);
		ep->state = STATE_EP_UNBOUND;
		usb_ep_free_request (ep->ep, ep->req);
		ep->ep = NULL;
1568 1569
		mutex_unlock(&ep->lock);

Linus Torvalds's avatar
Linus Torvalds committed
1570 1571 1572 1573
		wake_up (&ep->wait);
		put_ep (ep);

		/* break link to dcache */
Al Viro's avatar
Al Viro committed
1574
		inode_lock(parent);
Linus Torvalds's avatar
Linus Torvalds committed
1575 1576
		d_delete (dentry);
		dput (dentry);
Al Viro's avatar
Al Viro committed
1577
		inode_unlock(parent);
Linus Torvalds's avatar
Linus Torvalds committed
1578

1579
		spin_lock_irq (&dev->lock);
Linus Torvalds's avatar
Linus Torvalds committed
1580 1581 1582 1583 1584
	}
	spin_unlock_irq (&dev->lock);
}


1585
static struct dentry *
Linus Torvalds's avatar
Linus Torvalds committed
1586
gadgetfs_create_file (struct super_block *sb, char const *name,
1587
		void *data, const struct file_operations *fops);
Linus Torvalds's avatar
Linus Torvalds committed
1588 1589 1590 1591

static int activate_ep_files (struct dev_data *dev)
{
	struct usb_ep	*ep;
1592
	struct ep_data	*data;
Linus Torvalds's avatar
Linus Torvalds committed
1593 1594 1595

	gadget_for_each_ep (ep, dev->gadget) {

1596
		data = kzalloc(sizeof(*data), GFP_KERNEL);
Linus Torvalds's avatar
Linus Torvalds committed
1597
		if (!data)
1598
			goto enomem0;
Linus Torvalds's avatar
Linus Torvalds committed
1599
		data->state = STATE_EP_DISABLED;
1600
		mutex_init(&data->lock);
Linus Torvalds's avatar
Linus Torvalds committed
1601 1602 1603
		init_waitqueue_head (&data->wait);

		strncpy (data->name, ep->name, sizeof (data->name) - 1);
1604
		refcount_set (&data->count, 1);
Linus Torvalds's avatar
Linus Torvalds committed
1605 1606 1607 1608 1609 1610 1611 1612
		data->dev = dev;
		get_dev (dev);

		data->ep = ep;
		ep->driver_data = data;

		data->req = usb_ep_alloc_request (ep, GFP_KERNEL);
		if (!data->req)
1613
			goto enomem1;
Linus Torvalds's avatar
Linus Torvalds committed
1614

1615
		data->dentry = gadgetfs_create_file (dev->sb, data->name,
1616
				data, &ep_io_operations);
1617
		if (!data->dentry)
1618
			goto enomem2;
Linus Torvalds's avatar
Linus Torvalds committed
1619 1620 1621 1622
		list_add_tail (&data->epfiles, &dev->epfiles);
	}
	return 0;

1623 1624 1625 1626 1627 1628
enomem2:
	usb_ep_free_request (ep, data->req);
enomem1:
	put_dev (dev);
	kfree (data);
enomem0:
1629
	DBG (dev, "%s enomem\n", __func__);
Linus Torvalds's avatar
Linus Torvalds committed
1630 1631 1632 1633 1634 1635 1636 1637 1638
	destroy_ep_files (dev);
	return -ENOMEM;
}

static void
gadgetfs_unbind (struct usb_gadget *gadget)
{
	struct dev_data		*dev = get_gadget_data (gadget);

1639
	DBG (dev, "%s\n", __func__);
Linus Torvalds's avatar
Linus Torvalds committed
1640 1641 1642

	spin_lock_irq (&dev->lock);
	dev->state = STATE_DEV_UNBOUND;
1643 1644 1645 1646 1647
	while (dev->udc_usage > 0) {
		spin_unlock_irq(&dev->lock);
		usleep_range(1000, 2000);
		spin_lock_irq(&dev->lock);
	}
Linus Torvalds's avatar
Linus Torvalds committed
1648 1649 1650 1651 1652 1653 1654 1655 1656
	spin_unlock_irq (&dev->lock);

	destroy_ep_files (dev);
	gadget->ep0->driver_data = NULL;
	set_gadget_data (gadget, NULL);

	/* we've already been disconnected ... no i/o is active */
	if (dev->req)
		usb_ep_free_request (gadget->ep0, dev->req);
1657
	DBG (dev, "%s done\n", __func__);
Linus Torvalds's avatar
Linus Torvalds committed
1658 1659 1660 1661 1662
	put_dev (dev);
}

static struct dev_data		*the_device;

1663 1664
static int gadgetfs_bind(struct usb_gadget *gadget,
		struct usb_gadget_driver *driver)
Linus Torvalds's avatar
Linus Torvalds committed
1665 1666 1667 1668 1669 1670
{
	struct dev_data		*dev = the_device;

	if (!dev)
		return -ESRCH;
	if (0 != strcmp (CHIP, gadget->name)) {
1671
		pr_err("%s expected %s controller not %s\n",
Linus Torvalds's avatar
Linus Torvalds committed
1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690
			shortname, CHIP, gadget->name);
		return -ENODEV;
	}

	set_gadget_data (gadget, dev);
	dev->gadget = gadget;
	gadget->ep0->driver_data = dev;

	/* preallocate control response and buffer */
	dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
	if (!dev->req)
		goto enomem;
	dev->req->context = NULL;
	dev->req->complete = epio_complete;

	if (activate_ep_files (dev) < 0)
		goto enomem;

	INFO (dev, "bound to %s driver\n", gadget->name);
David Brownell's avatar
David Brownell committed
1691 1692 1693
	spin_lock_irq(&dev->lock);
	dev->state = STATE_DEV_UNCONNECTED;
	spin_unlock_irq(&dev->lock);
Linus Torvalds's avatar
Linus Torvalds committed
1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705
	get_dev (dev);
	return 0;

enomem:
	gadgetfs_unbind (gadget);
	return -ENOMEM;
}

static void
gadgetfs_disconnect (struct usb_gadget *gadget)
{
	struct dev_data		*dev = get_gadget_data (gadget);
1706
	unsigned long		flags;
Linus Torvalds's avatar
Linus Torvalds committed
1707

1708
	spin_lock_irqsave (&dev->lock, flags);
David Brownell's avatar
David Brownell committed
1709
	if (dev->state == STATE_DEV_UNCONNECTED)
1710
		goto exit;
David Brownell's avatar
David Brownell committed
1711
	dev->state = STATE_DEV_UNCONNECTED;
Linus Torvalds's avatar
Linus Torvalds committed
1712 1713 1714 1715

	INFO (dev, "disconnected\n");
	next_event (dev, GADGETFS_DISCONNECT);
	ep0_readable (dev);
1716
exit:
1717
	spin_unlock_irqrestore (&dev->lock, flags);
Linus Torvalds's avatar
Linus Torvalds committed
1718 1719 1720 1721 1722 1723
}

static void
gadgetfs_suspend (struct usb_gadget *gadget)
{
	struct dev_data		*dev = get_gadget_data (gadget);
1724
	unsigned long		flags;
Linus Torvalds's avatar
Linus Torvalds committed
1725 1726

	INFO (dev, "suspended from state %d\n", dev->state);
1727
	spin_lock_irqsave(&dev->lock, flags);
Linus Torvalds's avatar
Linus Torvalds committed
1728
	switch (dev->state) {
David Brownell's avatar
David Brownell committed
1729 1730 1731
	case STATE_DEV_SETUP:		// VERY odd... host died??
	case STATE_DEV_CONNECTED:
	case STATE_DEV_UNCONNECTED:
Linus Torvalds's avatar
Linus Torvalds committed
1732 1733
		next_event (dev, GADGETFS_SUSPEND);
		ep0_readable (dev);
1734
		fallthrough;
Linus Torvalds's avatar
Linus Torvalds committed
1735 1736 1737
	default:
		break;
	}
1738
	spin_unlock_irqrestore(&dev->lock, flags);
Linus Torvalds's avatar
Linus Torvalds committed
1739 1740 1741 1742
}

static struct usb_gadget_driver gadgetfs_driver = {
	.function	= (char *) driver_desc,
1743
	.bind		= gadgetfs_bind,
Linus Torvalds's avatar
Linus Torvalds committed
1744 1745
	.unbind		= gadgetfs_unbind,
	.setup		= gadgetfs_setup,
1746
	.reset		= gadgetfs_disconnect,
Linus Torvalds's avatar
Linus Torvalds committed
1747 1748 1749
	.disconnect	= gadgetfs_disconnect,
	.suspend	= gadgetfs_suspend,

1750
	.driver	= {
1751
		.name		= shortname,
Linus Torvalds's avatar
Linus Torvalds committed
1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769
	},
};

/*----------------------------------------------------------------------*/
/* DEVICE INITIALIZATION
 *
 *     fd = open ("/dev/gadget/$CHIP", O_RDWR)
 *     status = write (fd, descriptors, sizeof descriptors)
 *
 * That write establishes the device configuration, so the kernel can
 * bind to the controller ... guaranteeing it can handle enumeration
 * at all necessary speeds.  Descriptor order is:
 *
 * . message tag (u32, host order) ... for now, must be zero; it
 *	would change to support features like multi-config devices
 * . full/low speed config ... all wTotalLength bytes (with interface,
 *	class, altsetting, endpoint, and other descriptors)
 * . high speed config ... all descriptors, for high speed operation;
1770
 *	this one's optional except for high-speed hardware
Linus Torvalds's avatar
Linus Torvalds committed
1771 1772
 * . device descriptor
 *
1773 1774
 * Endpoints are not yet enabled. Drivers must wait until device
 * configuration and interface altsetting changes create
Linus Torvalds's avatar
Linus Torvalds committed
1775 1776 1777
 * the need to configure (or unconfigure) them.
 *
 * After initialization, the device stays active for as long as that
1778 1779
 * $CHIP file is open.  Events must then be read from that descriptor,
 * such as configuration notifications.
Linus Torvalds's avatar
Linus Torvalds committed
1780 1781
 */

1782 1783
static int is_valid_config(struct usb_config_descriptor *config,
		unsigned int total)
Linus Torvalds's avatar
Linus Torvalds committed
1784 1785 1786
{
	return config->bDescriptorType == USB_DT_CONFIG
		&& config->bLength == USB_DT_CONFIG_SIZE
1787
		&& total >= USB_DT_CONFIG_SIZE
Linus Torvalds's avatar
Linus Torvalds committed
1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798
		&& config->bConfigurationValue != 0
		&& (config->bmAttributes & USB_CONFIG_ATT_ONE) != 0
		&& (config->bmAttributes & USB_CONFIG_ATT_WAKEUP) == 0;
	/* FIXME if gadget->is_otg, _must_ include an otg descriptor */
	/* FIXME check lengths: walk to end */
}

static ssize_t
dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
{
	struct dev_data		*dev = fd->private_data;
1799
	ssize_t			value, length = len;
Linus Torvalds's avatar
Linus Torvalds committed
1800 1801 1802 1803
	unsigned		total;
	u32			tag;
	char			*kbuf;

1804 1805 1806 1807 1808 1809 1810 1811
	spin_lock_irq(&dev->lock);
	if (dev->state > STATE_DEV_OPENED) {
		value = ep0_write(fd, buf, len, ptr);
		spin_unlock_irq(&dev->lock);
		return value;
	}
	spin_unlock_irq(&dev->lock);

1812 1813
	if ((len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4)) ||
	    (len > PAGE_SIZE * 4))
Linus Torvalds's avatar
Linus Torvalds committed
1814 1815 1816 1817 1818 1819 1820 1821 1822 1823
		return -EINVAL;

	/* we might need to change message format someday */
	if (copy_from_user (&tag, buf, 4))
		return -EFAULT;
	if (tag != 0)
		return -EINVAL;
	buf += 4;
	length -= 4;

Julia Lawall's avatar
Julia Lawall committed
1824 1825 1826
	kbuf = memdup_user(buf, length);
	if (IS_ERR(kbuf))
		return PTR_ERR(kbuf);
Linus Torvalds's avatar
Linus Torvalds committed
1827 1828 1829

	spin_lock_irq (&dev->lock);
	value = -EINVAL;
1830
	if (dev->buf) {
1831
		spin_unlock_irq(&dev->lock);
1832
		kfree(kbuf);
1833
		return value;
1834
	}
Linus Torvalds's avatar
Linus Torvalds committed
1835 1836 1837 1838
	dev->buf = kbuf;

	/* full or low speed config */
	dev->config = (void *) kbuf;
1839
	total = le16_to_cpu(dev->config->wTotalLength);
1840 1841
	if (!is_valid_config(dev->config, total) ||
			total > length - USB_DT_DEVICE_SIZE)
Linus Torvalds's avatar
Linus Torvalds committed
1842 1843 1844 1845 1846 1847 1848
		goto fail;
	kbuf += total;
	length -= total;

	/* optional high speed config */
	if (kbuf [1] == USB_DT_CONFIG) {
		dev->hs_config = (void *) kbuf;
1849
		total = le16_to_cpu(dev->hs_config->wTotalLength);
1850 1851
		if (!is_valid_config(dev->hs_config, total) ||
				total > length - USB_DT_DEVICE_SIZE)
Linus Torvalds's avatar
Linus Torvalds committed
1852 1853 1854
			goto fail;
		kbuf += total;
		length -= total;
1855 1856
	} else {
		dev->hs_config = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
1857 1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868
	}

	/* could support multiple configs, using another encoding! */

	/* device descriptor (tweaked for paranoia) */
	if (length != USB_DT_DEVICE_SIZE)
		goto fail;
	dev->dev = (void *)kbuf;
	if (dev->dev->bLength != USB_DT_DEVICE_SIZE
			|| dev->dev->bDescriptorType != USB_DT_DEVICE
			|| dev->dev->bNumConfigurations != 1)
		goto fail;
1869
	dev->dev->bcdUSB = cpu_to_le16 (0x0200);
Linus Torvalds's avatar
Linus Torvalds committed
1870 1871 1872

	/* triggers gadgetfs_bind(); then we can enumerate. */
	spin_unlock_irq (&dev->lock);
1873 1874 1875 1876
	if (dev->hs_config)
		gadgetfs_driver.max_speed = USB_SPEED_HIGH;
	else
		gadgetfs_driver.max_speed = USB_SPEED_FULL;
1877

1878
	value = usb_gadget_register_driver(&gadgetfs_driver);
Linus Torvalds's avatar
Linus Torvalds committed
1879
	if (value != 0) {
1880 1881
		spin_lock_irq(&dev->lock);
		goto fail;
Linus Torvalds's avatar
Linus Torvalds committed
1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892
	} else {
		/* at this point "good" hardware has for the first time
		 * let the USB the host see us.  alternatively, if users
		 * unplug/replug that will clear all the error state.
		 *
		 * note:  everything running before here was guaranteed
		 * to choke driver model style diagnostics.  from here
		 * on, they can work ... except in cleanup paths that
		 * kick in after the ep0 descriptor is closed.
		 */
		value = len;
1893
		dev->gadget_registered = true;
Linus Torvalds's avatar
Linus Torvalds committed
1894 1895 1896 1897
	}
	return value;

fail:
1898 1899 1900
	dev->config = NULL;
	dev->hs_config = NULL;
	dev->dev = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
1901
	spin_unlock_irq (&dev->lock);
1902
	pr_debug ("%s: %s fail %zd, %p\n", shortname, __func__, value, dev);
Linus Torvalds's avatar
Linus Torvalds committed
1903 1904 1905 1906 1907 1908
	kfree (dev->buf);
	dev->buf = NULL;
	return value;
}

static int
1909
gadget_dev_open (struct inode *inode, struct file *fd)
Linus Torvalds's avatar
Linus Torvalds committed
1910
{
1911
	struct dev_data		*dev = inode->i_private;
Linus Torvalds's avatar
Linus Torvalds committed
1912 1913
	int			value = -EBUSY;

David Brownell's avatar
David Brownell committed
1914
	spin_lock_irq(&dev->lock);
Linus Torvalds's avatar
Linus Torvalds committed
1915 1916
	if (dev->state == STATE_DEV_DISABLED) {
		dev->ev_next = 0;
David Brownell's avatar
David Brownell committed
1917
		dev->state = STATE_DEV_OPENED;
Linus Torvalds's avatar
Linus Torvalds committed
1918 1919 1920 1921
		fd->private_data = dev;
		get_dev (dev);
		value = 0;
	}
David Brownell's avatar
David Brownell committed
1922
	spin_unlock_irq(&dev->lock);
Linus Torvalds's avatar
Linus Torvalds committed
1923 1924 1925
	return value;
}

1926
static const struct file_operations ep0_operations = {
Linus Torvalds's avatar
Linus Torvalds committed
1927 1928
	.llseek =	no_llseek,

1929
	.open =		gadget_dev_open,
1930
	.read =		ep0_read,
Linus Torvalds's avatar
Linus Torvalds committed
1931 1932
	.write =	dev_config,
	.fasync =	ep0_fasync,
1933
	.poll =		ep0_poll,
1934
	.unlocked_ioctl = gadget_dev_ioctl,
Linus Torvalds's avatar
Linus Torvalds committed
1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961
	.release =	dev_release,
};

/*----------------------------------------------------------------------*/

/* FILESYSTEM AND SUPERBLOCK OPERATIONS
 *
 * Mounting the filesystem creates a controller file, used first for
 * device configuration then later for event monitoring.
 */


/* FIXME PAM etc could set this security policy without mount options
 * if epfiles inherited ownership and permissons from ep0 ...
 */

static unsigned default_uid;
static unsigned default_gid;
static unsigned default_perm = S_IRUSR | S_IWUSR;

module_param (default_uid, uint, 0644);
module_param (default_gid, uint, 0644);
module_param (default_perm, uint, 0644);


static struct inode *
gadgetfs_make_inode (struct super_block *sb,
1962
		void *data, const struct file_operations *fops,
Linus Torvalds's avatar
Linus Torvalds committed
1963 1964 1965 1966 1967
		int mode)
{
	struct inode *inode = new_inode (sb);

	if (inode) {
1968
		inode->i_ino = get_next_ino();
Linus Torvalds's avatar
Linus Torvalds committed
1969
		inode->i_mode = mode;
1970 1971
		inode->i_uid = make_kuid(&init_user_ns, default_uid);
		inode->i_gid = make_kgid(&init_user_ns, default_gid);
1972
		simple_inode_init_ts(inode);
1973
		inode->i_private = data;
Linus Torvalds's avatar
Linus Torvalds committed
1974 1975 1976 1977 1978 1979 1980 1981
		inode->i_fop = fops;
	}
	return inode;
}

/* creates in fs root directory, so non-renamable and non-linkable.
 * so inode and dentry are paired, until device reconfig.
 */
1982
static struct dentry *
Linus Torvalds's avatar
Linus Torvalds committed
1983
gadgetfs_create_file (struct super_block *sb, char const *name,
1984
		void *data, const struct file_operations *fops)
Linus Torvalds's avatar
Linus Torvalds committed
1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999
{
	struct dentry	*dentry;
	struct inode	*inode;

	dentry = d_alloc_name(sb->s_root, name);
	if (!dentry)
		return NULL;

	inode = gadgetfs_make_inode (sb, data, fops,
			S_IFREG | (default_perm & S_IRWXUGO));
	if (!inode) {
		dput(dentry);
		return NULL;
	}
	d_add (dentry, inode);
2000
	return dentry;
Linus Torvalds's avatar
Linus Torvalds committed
2001 2002
}

2003
static const struct super_operations gadget_fs_operations = {
Linus Torvalds's avatar
Linus Torvalds committed
2004 2005 2006 2007 2008
	.statfs =	simple_statfs,
	.drop_inode =	generic_delete_inode,
};

static int
2009
gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc)
Linus Torvalds's avatar
Linus Torvalds committed
2010 2011 2012
{
	struct inode	*inode;
	struct dev_data	*dev;
2013
	int		rc;
Linus Torvalds's avatar
Linus Torvalds committed
2014

2015 2016 2017 2018 2019 2020
	mutex_lock(&sb_mutex);

	if (the_device) {
		rc = -ESRCH;
		goto Done;
	}
Linus Torvalds's avatar
Linus Torvalds committed
2021

2022
	CHIP = usb_get_gadget_udc_name();
2023 2024 2025 2026
	if (!CHIP) {
		rc = -ENODEV;
		goto Done;
	}
Linus Torvalds's avatar
Linus Torvalds committed
2027 2028

	/* superblock */
2029 2030
	sb->s_blocksize = PAGE_SIZE;
	sb->s_blocksize_bits = PAGE_SHIFT;
Linus Torvalds's avatar
Linus Torvalds committed
2031 2032 2033 2034 2035 2036 2037 2038 2039
	sb->s_magic = GADGETFS_MAGIC;
	sb->s_op = &gadget_fs_operations;
	sb->s_time_gran = 1;

	/* root inode */
	inode = gadgetfs_make_inode (sb,
			NULL, &simple_dir_operations,
			S_IFDIR | S_IRUGO | S_IXUGO);
	if (!inode)
Al Viro's avatar
Al Viro committed
2040
		goto Enomem;
Linus Torvalds's avatar
Linus Torvalds committed
2041
	inode->i_op = &simple_dir_inode_operations;
2042
	if (!(sb->s_root = d_make_root (inode)))
Al Viro's avatar
Al Viro committed
2043
		goto Enomem;
Linus Torvalds's avatar
Linus Torvalds committed
2044 2045 2046 2047 2048 2049

	/* the ep0 file is named after the controller we expect;
	 * user mode code can use it for sanity checks, like we do.
	 */
	dev = dev_new ();
	if (!dev)
Al Viro's avatar
Al Viro committed
2050
		goto Enomem;
Linus Torvalds's avatar
Linus Torvalds committed
2051 2052

	dev->sb = sb;
2053
	dev->dentry = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations);
2054
	if (!dev->dentry) {
Al Viro's avatar
Al Viro committed
2055 2056 2057
		put_dev(dev);
		goto Enomem;
	}
Linus Torvalds's avatar
Linus Torvalds committed
2058 2059 2060 2061 2062

	/* other endpoint files are available after hardware setup,
	 * from binding to a controller.
	 */
	the_device = dev;
2063 2064
	rc = 0;
	goto Done;
2065

2066
 Enomem:
2067 2068
	kfree(CHIP);
	CHIP = NULL;
2069
	rc = -ENOMEM;
2070

2071 2072 2073
 Done:
	mutex_unlock(&sb_mutex);
	return rc;
Linus Torvalds's avatar
Linus Torvalds committed
2074 2075 2076
}

/* "mount -t gadgetfs path /dev/gadget" ends up here */
2077
static int gadgetfs_get_tree(struct fs_context *fc)
Linus Torvalds's avatar
Linus Torvalds committed
2078
{
2079 2080 2081 2082 2083 2084 2085 2086 2087 2088 2089
	return get_tree_single(fc, gadgetfs_fill_super);
}

static const struct fs_context_operations gadgetfs_context_ops = {
	.get_tree	= gadgetfs_get_tree,
};

static int gadgetfs_init_fs_context(struct fs_context *fc)
{
	fc->ops = &gadgetfs_context_ops;
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
2090 2091 2092 2093 2094
}

static void
gadgetfs_kill_sb (struct super_block *sb)
{
2095
	mutex_lock(&sb_mutex);
Linus Torvalds's avatar
Linus Torvalds committed
2096 2097 2098 2099 2100
	kill_litter_super (sb);
	if (the_device) {
		put_dev (the_device);
		the_device = NULL;
	}
2101 2102
	kfree(CHIP);
	CHIP = NULL;
2103
	mutex_unlock(&sb_mutex);
Linus Torvalds's avatar
Linus Torvalds committed
2104 2105 2106 2107 2108 2109 2110
}

/*----------------------------------------------------------------------*/

static struct file_system_type gadgetfs_type = {
	.owner		= THIS_MODULE,
	.name		= shortname,
2111
	.init_fs_context = gadgetfs_init_fs_context,
Linus Torvalds's avatar
Linus Torvalds committed
2112 2113
	.kill_sb	= gadgetfs_kill_sb,
};
2114
MODULE_ALIAS_FS("gadgetfs");
Linus Torvalds's avatar
Linus Torvalds committed
2115 2116 2117

/*----------------------------------------------------------------------*/

2118
static int __init gadgetfs_init (void)
Linus Torvalds's avatar
Linus Torvalds committed
2119 2120 2121 2122 2123 2124 2125 2126 2127
{
	int status;

	status = register_filesystem (&gadgetfs_type);
	if (status == 0)
		pr_info ("%s: %s, version " DRIVER_VERSION "\n",
			shortname, driver_desc);
	return status;
}
2128
module_init (gadgetfs_init);
Linus Torvalds's avatar
Linus Torvalds committed
2129

2130
static void __exit gadgetfs_cleanup (void)
Linus Torvalds's avatar
Linus Torvalds committed
2131 2132 2133 2134
{
	pr_debug ("unregister %s\n", shortname);
	unregister_filesystem (&gadgetfs_type);
}
2135
module_exit (gadgetfs_cleanup);
Linus Torvalds's avatar
Linus Torvalds committed
2136