projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
aio: io_cancel() no longer returns the io_event
[deliverable/linux.git] / drivers / usb / gadget / inode.c
1 /*
2 * inode.c -- user mode filesystem api for usb gadget controllers
3 *
4 * Copyright (C) 2003-2004 David Brownell
5 * Copyright (C) 2003 Agilent Technologies
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
11 */
12
13
14 /* #define VERBOSE_DEBUG */
15
16 #include <linux/init.h>
17 #include <linux/module.h>
18 #include <linux/fs.h>
19 #include <linux/pagemap.h>
20 #include <linux/uts.h>
21 #include <linux/wait.h>
22 #include <linux/compiler.h>
23 #include <asm/uaccess.h>
24 #include <linux/sched.h>
25 #include <linux/slab.h>
26 #include <linux/poll.h>
27 #include <linux/mmu_context.h>
28 #include <linux/aio.h>
29
30 #include <linux/device.h>
31 #include <linux/moduleparam.h>
32
33 #include <linux/usb/gadgetfs.h>
34 #include <linux/usb/gadget.h>
35
36
37 /*
38 * The gadgetfs API maps each endpoint to a file descriptor so that you
39 * can use standard synchronous read/write calls for I/O. There's some
40 * O_NONBLOCK and O_ASYNC/FASYNC style i/o support. Example usermode
41 * drivers show how this works in practice. You can also use AIO to
42 * eliminate I/O gaps between requests, to help when streaming data.
43 *
44 * Key parts that must be USB-specific are protocols defining how the
45 * read/write operations relate to the hardware state machines. There
46 * are two types of files. One type is for the device, implementing ep0.
47 * The other type is for each IN or OUT endpoint. In both cases, the
48 * user mode driver must configure the hardware before using it.
49 *
50 * - First, dev_config() is called when /dev/gadget/$CHIP is configured
51 * (by writing configuration and device descriptors). Afterwards it
52 * may serve as a source of device events, used to handle all control
53 * requests other than basic enumeration.
54 *
55 * - Then, after a SET_CONFIGURATION control request, ep_config() is
56 * called when each /dev/gadget/ep* file is configured (by writing
57 * endpoint descriptors). Afterwards these files are used to write()
58 * IN data or to read() OUT data. To halt the endpoint, a "wrong
59 * direction" request is issued (like reading an IN endpoint).
60 *
61 * Unlike "usbfs" the only ioctl()s are for things that are rare, and maybe
62 * not possible on all hardware. For example, precise fault handling with
63 * respect to data left in endpoint fifos after aborted operations; or
64 * selective clearing of endpoint halts, to implement SET_INTERFACE.
65 */
66
67 #define DRIVER_DESC "USB Gadget filesystem"
68 #define DRIVER_VERSION "24 Aug 2004"
69
70 static const char driver_desc [] = DRIVER_DESC;
71 static const char shortname [] = "gadgetfs";
72
73 MODULE_DESCRIPTION (DRIVER_DESC);
74 MODULE_AUTHOR ("David Brownell");
75 MODULE_LICENSE ("GPL");
76
77
78 /*----------------------------------------------------------------------*/
79
80 #define GADGETFS_MAGIC 0xaee71ee7
81
82 /* /dev/gadget/$CHIP represents ep0 and the whole device */
83 enum ep0_state {
84 /* DISBLED is the initial state.
85 */
86 STATE_DEV_DISABLED = 0,
87
88 /* Only one open() of /dev/gadget/$CHIP; only one file tracks
89 * ep0/device i/o modes and binding to the controller. Driver
90 * must always write descriptors to initialize the device, then
91 * the device becomes UNCONNECTED until enumeration.
92 */
93 STATE_DEV_OPENED,
94
95 /* From then on, ep0 fd is in either of two basic modes:
96 * - (UN)CONNECTED: read usb_gadgetfs_event(s) from it
97 * - SETUP: read/write will transfer control data and succeed;
98 * or if "wrong direction", performs protocol stall
99 */
100 STATE_DEV_UNCONNECTED,
101 STATE_DEV_CONNECTED,
102 STATE_DEV_SETUP,
103
104 /* UNBOUND means the driver closed ep0, so the device won't be
105 * accessible again (DEV_DISABLED) until all fds are closed.
106 */
107 STATE_DEV_UNBOUND,
108 };
109
110 /* enough for the whole queue: most events invalidate others */
111 #define N_EVENT 5
112
113 struct dev_data {
114 spinlock_t lock;
115 atomic_t count;
116 enum ep0_state state; /* P: lock */
117 struct usb_gadgetfs_event event [N_EVENT];
118 unsigned ev_next;
119 struct fasync_struct *fasync;
120 u8 current_config;
121
122 /* drivers reading ep0 MUST handle control requests (SETUP)
123 * reported that way; else the host will time out.
124 */
125 unsigned usermode_setup : 1,
126 setup_in : 1,
127 setup_can_stall : 1,
128 setup_out_ready : 1,
129 setup_out_error : 1,
130 setup_abort : 1;
131 unsigned setup_wLength;
132
133 /* the rest is basically write-once */
134 struct usb_config_descriptor *config, *hs_config;
135 struct usb_device_descriptor *dev;
136 struct usb_request *req;
137 struct usb_gadget *gadget;
138 struct list_head epfiles;
139 void *buf;
140 wait_queue_head_t wait;
141 struct super_block *sb;
142 struct dentry *dentry;
143
144 /* except this scratch i/o buffer for ep0 */
145 u8 rbuf [256];
146 };
147
148 static inline void get_dev (struct dev_data *data)
149 {
150 atomic_inc (&data->count);
151 }
152
153 static void put_dev (struct dev_data *data)
154 {
155 if (likely (!atomic_dec_and_test (&data->count)))
156 return;
157 /* needs no more cleanup */
158 BUG_ON (waitqueue_active (&data->wait));
159 kfree (data);
160 }
161
162 static struct dev_data *dev_new (void)
163 {
164 struct dev_data *dev;
165
166 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
167 if (!dev)
168 return NULL;
169 dev->state = STATE_DEV_DISABLED;
170 atomic_set (&dev->count, 1);
171 spin_lock_init (&dev->lock);
172 INIT_LIST_HEAD (&dev->epfiles);
173 init_waitqueue_head (&dev->wait);
174 return dev;
175 }
176
177 /*----------------------------------------------------------------------*/
178
179 /* other /dev/gadget/$ENDPOINT files represent endpoints */
180 enum ep_state {
181 STATE_EP_DISABLED = 0,
182 STATE_EP_READY,
183 STATE_EP_ENABLED,
184 STATE_EP_UNBOUND,
185 };
186
187 struct ep_data {
188 struct mutex lock;
189 enum ep_state state;
190 atomic_t count;
191 struct dev_data *dev;
192 /* must hold dev->lock before accessing ep or req */
193 struct usb_ep *ep;
194 struct usb_request *req;
195 ssize_t status;
196 char name [16];
197 struct usb_endpoint_descriptor desc, hs_desc;
198 struct list_head epfiles;
199 wait_queue_head_t wait;
200 struct dentry *dentry;
201 struct inode *inode;
202 };
203
204 static inline void get_ep (struct ep_data *data)
205 {
206 atomic_inc (&data->count);
207 }
208
209 static void put_ep (struct ep_data *data)
210 {
211 if (likely (!atomic_dec_and_test (&data->count)))
212 return;
213 put_dev (data->dev);
214 /* needs no more cleanup */
215 BUG_ON (!list_empty (&data->epfiles));
216 BUG_ON (waitqueue_active (&data->wait));
217 kfree (data);
218 }
219
220 /*----------------------------------------------------------------------*/
221
222 /* most "how to use the hardware" policy choices are in userspace:
223 * mapping endpoint roles (which the driver needs) to the capabilities
224 * which the usb controller has. most of those capabilities are exposed
225 * implicitly, starting with the driver name and then endpoint names.
226 */
227
228 static const char *CHIP;
229
230 /*----------------------------------------------------------------------*/
231
232 /* NOTE: don't use dev_printk calls before binding to the gadget
233 * at the end of ep0 configuration, or after unbind.
234 */
235
236 /* too wordy: dev_printk(level , &(d)->gadget->dev , fmt , ## args) */
237 #define xprintk(d,level,fmt,args...) \
238 printk(level "%s: " fmt , shortname , ## args)
239
240 #ifdef DEBUG
241 #define DBG(dev,fmt,args...) \
242 xprintk(dev , KERN_DEBUG , fmt , ## args)
243 #else
244 #define DBG(dev,fmt,args...) \
245 do { } while (0)
246 #endif /* DEBUG */
247
248 #ifdef VERBOSE_DEBUG
249 #define VDEBUG DBG
250 #else
251 #define VDEBUG(dev,fmt,args...) \
252 do { } while (0)
253 #endif /* DEBUG */
254
255 #define ERROR(dev,fmt,args...) \
256 xprintk(dev , KERN_ERR , fmt , ## args)
257 #define INFO(dev,fmt,args...) \
258 xprintk(dev , KERN_INFO , fmt , ## args)
259
260
261 /*----------------------------------------------------------------------*/
262
263 /* SYNCHRONOUS ENDPOINT OPERATIONS (bulk/intr/iso)
264 *
265 * After opening, configure non-control endpoints. Then use normal
266 * stream read() and write() requests; and maybe ioctl() to get more
267 * precise FIFO status when recovering from cancellation.
268 */
269
270 static void epio_complete (struct usb_ep *ep, struct usb_request *req)
271 {
272 struct ep_data *epdata = ep->driver_data;
273
274 if (!req->context)
275 return;
276 if (req->status)
277 epdata->status = req->status;
278 else
279 epdata->status = req->actual;
280 complete ((struct completion *)req->context);
281 }
282
283 /* tasklock endpoint, returning when it's connected.
284 * still need dev->lock to use epdata->ep.
285 */
286 static int
287 get_ready_ep (unsigned f_flags, struct ep_data *epdata)
288 {
289 int val;
290
291 if (f_flags & O_NONBLOCK) {
292 if (!mutex_trylock(&epdata->lock))
293 goto nonblock;
294 if (epdata->state != STATE_EP_ENABLED) {
295 mutex_unlock(&epdata->lock);
296 nonblock:
297 val = -EAGAIN;
298 } else
299 val = 0;
300 return val;
301 }
302
303 val = mutex_lock_interruptible(&epdata->lock);
304 if (val < 0)
305 return val;
306
307 switch (epdata->state) {
308 case STATE_EP_ENABLED:
309 break;
310 // case STATE_EP_DISABLED: /* "can't happen" */
311 // case STATE_EP_READY: /* "can't happen" */
312 default: /* error! */
313 pr_debug ("%s: ep %p not available, state %d\n",
314 shortname, epdata, epdata->state);
315 // FALLTHROUGH
316 case STATE_EP_UNBOUND: /* clean disconnect */
317 val = -ENODEV;
318 mutex_unlock(&epdata->lock);
319 }
320 return val;
321 }
322
323 static ssize_t
324 ep_io (struct ep_data *epdata, void *buf, unsigned len)
325 {
326 DECLARE_COMPLETION_ONSTACK (done);
327 int value;
328
329 spin_lock_irq (&epdata->dev->lock);
330 if (likely (epdata->ep != NULL)) {
331 struct usb_request *req = epdata->req;
332
333 req->context = &done;
334 req->complete = epio_complete;
335 req->buf = buf;
336 req->length = len;
337 value = usb_ep_queue (epdata->ep, req, GFP_ATOMIC);
338 } else
339 value = -ENODEV;
340 spin_unlock_irq (&epdata->dev->lock);
341
342 if (likely (value == 0)) {
343 value = wait_event_interruptible (done.wait, done.done);
344 if (value != 0) {
345 spin_lock_irq (&epdata->dev->lock);
346 if (likely (epdata->ep != NULL)) {
347 DBG (epdata->dev, "%s i/o interrupted\n",
348 epdata->name);
349 usb_ep_dequeue (epdata->ep, epdata->req);
350 spin_unlock_irq (&epdata->dev->lock);
351
352 wait_event (done.wait, done.done);
353 if (epdata->status == -ECONNRESET)
354 epdata->status = -EINTR;
355 } else {
356 spin_unlock_irq (&epdata->dev->lock);
357
358 DBG (epdata->dev, "endpoint gone\n");
359 epdata->status = -ENODEV;
360 }
361 }
362 return epdata->status;
363 }
364 return value;
365 }
366
367
368 /* handle a synchronous OUT bulk/intr/iso transfer */
369 static ssize_t
370 ep_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
371 {
372 struct ep_data *data = fd->private_data;
373 void *kbuf;
374 ssize_t value;
375
376 if ((value = get_ready_ep (fd->f_flags, data)) < 0)
377 return value;
378
379 /* halt any endpoint by doing a "wrong direction" i/o call */
380 if (usb_endpoint_dir_in(&data->desc)) {
381 if (usb_endpoint_xfer_isoc(&data->desc)) {
382 mutex_unlock(&data->lock);
383 return -EINVAL;
384 }
385 DBG (data->dev, "%s halt\n", data->name);
386 spin_lock_irq (&data->dev->lock);
387 if (likely (data->ep != NULL))
388 usb_ep_set_halt (data->ep);
389 spin_unlock_irq (&data->dev->lock);
390 mutex_unlock(&data->lock);
391 return -EBADMSG;
392 }
393
394 /* FIXME readahead for O_NONBLOCK and poll(); careful with ZLPs */
395
396 value = -ENOMEM;
397 kbuf = kmalloc (len, GFP_KERNEL);
398 if (unlikely (!kbuf))
399 goto free1;
400
401 value = ep_io (data, kbuf, len);
402 VDEBUG (data->dev, "%s read %zu OUT, status %d\n",
403 data->name, len, (int) value);
404 if (value >= 0 && copy_to_user (buf, kbuf, value))
405 value = -EFAULT;
406
407 free1:
408 mutex_unlock(&data->lock);
409 kfree (kbuf);
410 return value;
411 }
412
413 /* handle a synchronous IN bulk/intr/iso transfer */
414 static ssize_t
415 ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
416 {
417 struct ep_data *data = fd->private_data;
418 void *kbuf;
419 ssize_t value;
420
421 if ((value = get_ready_ep (fd->f_flags, data)) < 0)
422 return value;
423
424 /* halt any endpoint by doing a "wrong direction" i/o call */
425 if (!usb_endpoint_dir_in(&data->desc)) {
426 if (usb_endpoint_xfer_isoc(&data->desc)) {
427 mutex_unlock(&data->lock);
428 return -EINVAL;
429 }
430 DBG (data->dev, "%s halt\n", data->name);
431 spin_lock_irq (&data->dev->lock);
432 if (likely (data->ep != NULL))
433 usb_ep_set_halt (data->ep);
434 spin_unlock_irq (&data->dev->lock);
435 mutex_unlock(&data->lock);
436 return -EBADMSG;
437 }
438
439 /* FIXME writebehind for O_NONBLOCK and poll(), qlen = 1 */
440
441 value = -ENOMEM;
442 kbuf = kmalloc (len, GFP_KERNEL);
443 if (!kbuf)
444 goto free1;
445 if (copy_from_user (kbuf, buf, len)) {
446 value = -EFAULT;
447 goto free1;
448 }
449
450 value = ep_io (data, kbuf, len);
451 VDEBUG (data->dev, "%s write %zu IN, status %d\n",
452 data->name, len, (int) value);
453 free1:
454 mutex_unlock(&data->lock);
455 kfree (kbuf);
456 return value;
457 }
458
459 static int
460 ep_release (struct inode *inode, struct file *fd)
461 {
462 struct ep_data *data = fd->private_data;
463 int value;
464
465 value = mutex_lock_interruptible(&data->lock);
466 if (value < 0)
467 return value;
468
469 /* clean up if this can be reopened */
470 if (data->state != STATE_EP_UNBOUND) {
471 data->state = STATE_EP_DISABLED;
472 data->desc.bDescriptorType = 0;
473 data->hs_desc.bDescriptorType = 0;
474 usb_ep_disable(data->ep);
475 }
476 mutex_unlock(&data->lock);
477 put_ep (data);
478 return 0;
479 }
480
481 static long ep_ioctl(struct file *fd, unsigned code, unsigned long value)
482 {
483 struct ep_data *data = fd->private_data;
484 int status;
485
486 if ((status = get_ready_ep (fd->f_flags, data)) < 0)
487 return status;
488
489 spin_lock_irq (&data->dev->lock);
490 if (likely (data->ep != NULL)) {
491 switch (code) {
492 case GADGETFS_FIFO_STATUS:
493 status = usb_ep_fifo_status (data->ep);
494 break;
495 case GADGETFS_FIFO_FLUSH:
496 usb_ep_fifo_flush (data->ep);
497 break;
498 case GADGETFS_CLEAR_HALT:
499 status = usb_ep_clear_halt (data->ep);
500 break;
501 default:
502 status = -ENOTTY;
503 }
504 } else
505 status = -ENODEV;
506 spin_unlock_irq (&data->dev->lock);
507 mutex_unlock(&data->lock);
508 return status;
509 }
510
511 /*----------------------------------------------------------------------*/
512
513 /* ASYNCHRONOUS ENDPOINT I/O OPERATIONS (bulk/intr/iso) */
514
515 struct kiocb_priv {
516 struct usb_request *req;
517 struct ep_data *epdata;
518 struct kiocb *iocb;
519 struct mm_struct *mm;
520 struct work_struct work;
521 void *buf;
522 const struct iovec *iv;
523 unsigned long nr_segs;
524 unsigned actual;
525 };
526
527 static int ep_aio_cancel(struct kiocb *iocb)
528 {
529 struct kiocb_priv *priv = iocb->private;
530 struct ep_data *epdata;
531 int value;
532
533 local_irq_disable();
534 epdata = priv->epdata;
535 // spin_lock(&epdata->dev->lock);
536 if (likely(epdata && epdata->ep && priv->req))
537 value = usb_ep_dequeue (epdata->ep, priv->req);
538 else
539 value = -EINVAL;
540 // spin_unlock(&epdata->dev->lock);
541 local_irq_enable();
542
543 return value;
544 }
545
546 static ssize_t ep_copy_to_user(struct kiocb_priv *priv)
547 {
548 ssize_t len, total;
549 void *to_copy;
550 int i;
551
552 /* copy stuff into user buffers */
553 total = priv->actual;
554 len = 0;
555 to_copy = priv->buf;
556 for (i=0; i < priv->nr_segs; i++) {
557 ssize_t this = min((ssize_t)(priv->iv[i].iov_len), total);
558
559 if (copy_to_user(priv->iv[i].iov_base, to_copy, this)) {
560 if (len == 0)
561 len = -EFAULT;
562 break;
563 }
564
565 total -= this;
566 len += this;
567 to_copy += this;
568 if (total == 0)
569 break;
570 }
571
572 return len;
573 }
574
575 static void ep_user_copy_worker(struct work_struct *work)
576 {
577 struct kiocb_priv *priv = container_of(work, struct kiocb_priv, work);
578 struct mm_struct *mm = priv->mm;
579 struct kiocb *iocb = priv->iocb;
580 size_t ret;
581
582 use_mm(mm);
583 ret = ep_copy_to_user(priv);
584 unuse_mm(mm);
585
586 /* completing the iocb can drop the ctx and mm, don't touch mm after */
587 aio_complete(iocb, ret, ret);
588
589 kfree(priv->buf);
590 kfree(priv);
591 }
592
593 static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
594 {
595 struct kiocb *iocb = req->context;
596 struct kiocb_priv *priv = iocb->private;
597 struct ep_data *epdata = priv->epdata;
598
599 /* lock against disconnect (and ideally, cancel) */
600 spin_lock(&epdata->dev->lock);
601 priv->req = NULL;
602 priv->epdata = NULL;
603
604 /* if this was a write or a read returning no data then we
605 * don't need to copy anything to userspace, so we can
606 * complete the aio request immediately.
607 */
608 if (priv->iv == NULL || unlikely(req->actual == 0)) {
609 kfree(req->buf);
610 kfree(priv);
611 iocb->private = NULL;
612 /* aio_complete() reports bytes-transferred _and_ faults */
613 aio_complete(iocb, req->actual ? req->actual : req->status,
614 req->status);
615 } else {
616 /* ep_copy_to_user() won't report both; we hide some faults */
617 if (unlikely(0 != req->status))
618 DBG(epdata->dev, "%s fault %d len %d\n",
619 ep->name, req->status, req->actual);
620
621 priv->buf = req->buf;
622 priv->actual = req->actual;
623 schedule_work(&priv->work);
624 }
625 spin_unlock(&epdata->dev->lock);
626
627 usb_ep_free_request(ep, req);
628 put_ep(epdata);
629 }
630
631 static ssize_t
632 ep_aio_rwtail(
633 struct kiocb *iocb,
634 char *buf,
635 size_t len,
636 struct ep_data *epdata,
637 const struct iovec *iv,
638 unsigned long nr_segs
639 )
640 {
641 struct kiocb_priv *priv;
642 struct usb_request *req;
643 ssize_t value;
644
645 priv = kmalloc(sizeof *priv, GFP_KERNEL);
646 if (!priv) {
647 value = -ENOMEM;
648 fail:
649 kfree(buf);
650 return value;
651 }
652 iocb->private = priv;
653 priv->iocb = iocb;
654 priv->iv = iv;
655 priv->nr_segs = nr_segs;
656 INIT_WORK(&priv->work, ep_user_copy_worker);
657
658 value = get_ready_ep(iocb->ki_filp->f_flags, epdata);
659 if (unlikely(value < 0)) {
660 kfree(priv);
661 goto fail;
662 }
663
664 kiocb_set_cancel_fn(iocb, ep_aio_cancel);
665 get_ep(epdata);
666 priv->epdata = epdata;
667 priv->actual = 0;
668 priv->mm = current->mm; /* mm teardown waits for iocbs in exit_aio() */
669
670 /* each kiocb is coupled to one usb_request, but we can't
671 * allocate or submit those if the host disconnected.
672 */
673 spin_lock_irq(&epdata->dev->lock);
674 if (likely(epdata->ep)) {
675 req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
676 if (likely(req)) {
677 priv->req = req;
678 req->buf = buf;
679 req->length = len;
680 req->complete = ep_aio_complete;
681 req->context = iocb;
682 value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC);
683 if (unlikely(0 != value))
684 usb_ep_free_request(epdata->ep, req);
685 } else
686 value = -EAGAIN;
687 } else
688 value = -ENODEV;
689 spin_unlock_irq(&epdata->dev->lock);
690
691 mutex_unlock(&epdata->lock);
692
693 if (unlikely(value)) {
694 kfree(priv);
695 put_ep(epdata);
696 } else
697 value = -EIOCBQUEUED;
698 return value;
699 }
700
701 static ssize_t
702 ep_aio_read(struct kiocb *iocb, const struct iovec *iov,
703 unsigned long nr_segs, loff_t o)
704 {
705 struct ep_data *epdata = iocb->ki_filp->private_data;
706 char *buf;
707
708 if (unlikely(usb_endpoint_dir_in(&epdata->desc)))
709 return -EINVAL;
710
711 buf = kmalloc(iocb->ki_left, GFP_KERNEL);
712 if (unlikely(!buf))
713 return -ENOMEM;
714
715 return ep_aio_rwtail(iocb, buf, iocb->ki_left, epdata, iov, nr_segs);
716 }
717
718 static ssize_t
719 ep_aio_write(struct kiocb *iocb, const struct iovec *iov,
720 unsigned long nr_segs, loff_t o)
721 {
722 struct ep_data *epdata = iocb->ki_filp->private_data;
723 char *buf;
724 size_t len = 0;
725 int i = 0;
726
727 if (unlikely(!usb_endpoint_dir_in(&epdata->desc)))
728 return -EINVAL;
729
730 buf = kmalloc(iocb->ki_left, GFP_KERNEL);
731 if (unlikely(!buf))
732 return -ENOMEM;
733
734 for (i=0; i < nr_segs; i++) {
735 if (unlikely(copy_from_user(&buf[len], iov[i].iov_base,
736 iov[i].iov_len) != 0)) {
737 kfree(buf);
738 return -EFAULT;
739 }
740 len += iov[i].iov_len;
741 }
742 return ep_aio_rwtail(iocb, buf, len, epdata, NULL, 0);
743 }
744
745 /*----------------------------------------------------------------------*/
746
747 /* used after endpoint configuration */
748 static const struct file_operations ep_io_operations = {
749 .owner = THIS_MODULE,
750 .llseek = no_llseek,
751
752 .read = ep_read,
753 .write = ep_write,
754 .unlocked_ioctl = ep_ioctl,
755 .release = ep_release,
756
757 .aio_read = ep_aio_read,
758 .aio_write = ep_aio_write,
759 };
760
761 /* ENDPOINT INITIALIZATION
762 *
763 * fd = open ("/dev/gadget/$ENDPOINT", O_RDWR)
764 * status = write (fd, descriptors, sizeof descriptors)
765 *
766 * That write establishes the endpoint configuration, configuring
767 * the controller to process bulk, interrupt, or isochronous transfers
768 * at the right maxpacket size, and so on.
769 *
770 * The descriptors are message type 1, identified by a host order u32
771 * at the beginning of what's written. Descriptor order is: full/low
772 * speed descriptor, then optional high speed descriptor.
773 */
774 static ssize_t
775 ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
776 {
777 struct ep_data *data = fd->private_data;
778 struct usb_ep *ep;
779 u32 tag;
780 int value, length = len;
781
782 value = mutex_lock_interruptible(&data->lock);
783 if (value < 0)
784 return value;
785
786 if (data->state != STATE_EP_READY) {
787 value = -EL2HLT;
788 goto fail;
789 }
790
791 value = len;
792 if (len < USB_DT_ENDPOINT_SIZE + 4)
793 goto fail0;
794
795 /* we might need to change message format someday */
796 if (copy_from_user (&tag, buf, 4)) {
797 goto fail1;
798 }
799 if (tag != 1) {
800 DBG(data->dev, "config %s, bad tag %d\n", data->name, tag);
801 goto fail0;
802 }
803 buf += 4;
804 len -= 4;
805
806 /* NOTE: audio endpoint extensions not accepted here;
807 * just don't include the extra bytes.
808 */
809
810 /* full/low speed descriptor, then high speed */
811 if (copy_from_user (&data->desc, buf, USB_DT_ENDPOINT_SIZE)) {
812 goto fail1;
813 }
814 if (data->desc.bLength != USB_DT_ENDPOINT_SIZE
815 || data->desc.bDescriptorType != USB_DT_ENDPOINT)
816 goto fail0;
817 if (len != USB_DT_ENDPOINT_SIZE) {
818 if (len != 2 * USB_DT_ENDPOINT_SIZE)
819 goto fail0;
820 if (copy_from_user (&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE,
821 USB_DT_ENDPOINT_SIZE)) {
822 goto fail1;
823 }
824 if (data->hs_desc.bLength != USB_DT_ENDPOINT_SIZE
825 || data->hs_desc.bDescriptorType
826 != USB_DT_ENDPOINT) {
827 DBG(data->dev, "config %s, bad hs length or type\n",
828 data->name);
829 goto fail0;
830 }
831 }
832
833 spin_lock_irq (&data->dev->lock);
834 if (data->dev->state == STATE_DEV_UNBOUND) {
835 value = -ENOENT;
836 goto gone;
837 } else if ((ep = data->ep) == NULL) {
838 value = -ENODEV;
839 goto gone;
840 }
841 switch (data->dev->gadget->speed) {
842 case USB_SPEED_LOW:
843 case USB_SPEED_FULL:
844 ep->desc = &data->desc;
845 value = usb_ep_enable(ep);
846 if (value == 0)
847 data->state = STATE_EP_ENABLED;
848 break;
849 case USB_SPEED_HIGH:
850 /* fails if caller didn't provide that descriptor... */
851 ep->desc = &data->hs_desc;
852 value = usb_ep_enable(ep);
853 if (value == 0)
854 data->state = STATE_EP_ENABLED;
855 break;
856 default:
857 DBG(data->dev, "unconnected, %s init abandoned\n",
858 data->name);
859 value = -EINVAL;
860 }
861 if (value == 0) {
862 fd->f_op = &ep_io_operations;
863 value = length;
864 }
865 gone:
866 spin_unlock_irq (&data->dev->lock);
867 if (value < 0) {
868 fail:
869 data->desc.bDescriptorType = 0;
870 data->hs_desc.bDescriptorType = 0;
871 }
872 mutex_unlock(&data->lock);
873 return value;
874 fail0:
875 value = -EINVAL;
876 goto fail;
877 fail1:
878 value = -EFAULT;
879 goto fail;
880 }
881
882 static int
883 ep_open (struct inode *inode, struct file *fd)
884 {
885 struct ep_data *data = inode->i_private;
886 int value = -EBUSY;
887
888 if (mutex_lock_interruptible(&data->lock) != 0)
889 return -EINTR;
890 spin_lock_irq (&data->dev->lock);
891 if (data->dev->state == STATE_DEV_UNBOUND)
892 value = -ENOENT;
893 else if (data->state == STATE_EP_DISABLED) {
894 value = 0;
895 data->state = STATE_EP_READY;
896 get_ep (data);
897 fd->private_data = data;
898 VDEBUG (data->dev, "%s ready\n", data->name);
899 } else
900 DBG (data->dev, "%s state %d\n",
901 data->name, data->state);
902 spin_unlock_irq (&data->dev->lock);
903 mutex_unlock(&data->lock);
904 return value;
905 }
906
907 /* used before endpoint configuration */
908 static const struct file_operations ep_config_operations = {
909 .llseek = no_llseek,
910
911 .open = ep_open,
912 .write = ep_config,
913 .release = ep_release,
914 };
915
916 /*----------------------------------------------------------------------*/
917
918 /* EP0 IMPLEMENTATION can be partly in userspace.
919 *
920 * Drivers that use this facility receive various events, including
921 * control requests the kernel doesn't handle. Drivers that don't
922 * use this facility may be too simple-minded for real applications.
923 */
924
925 static inline void ep0_readable (struct dev_data *dev)
926 {
927 wake_up (&dev->wait);
928 kill_fasync (&dev->fasync, SIGIO, POLL_IN);
929 }
930
931 static void clean_req (struct usb_ep *ep, struct usb_request *req)
932 {
933 struct dev_data *dev = ep->driver_data;
934
935 if (req->buf != dev->rbuf) {
936 kfree(req->buf);
937 req->buf = dev->rbuf;
938 }
939 req->complete = epio_complete;
940 dev->setup_out_ready = 0;
941 }
942
943 static void ep0_complete (struct usb_ep *ep, struct usb_request *req)
944 {
945 struct dev_data *dev = ep->driver_data;
946 unsigned long flags;
947 int free = 1;
948
949 /* for control OUT, data must still get to userspace */
950 spin_lock_irqsave(&dev->lock, flags);
951 if (!dev->setup_in) {
952 dev->setup_out_error = (req->status != 0);
953 if (!dev->setup_out_error)
954 free = 0;
955 dev->setup_out_ready = 1;
956 ep0_readable (dev);
957 }
958
959 /* clean up as appropriate */
960 if (free && req->buf != &dev->rbuf)
961 clean_req (ep, req);
962 req->complete = epio_complete;
963 spin_unlock_irqrestore(&dev->lock, flags);
964 }
965
966 static int setup_req (struct usb_ep *ep, struct usb_request *req, u16 len)
967 {
968 struct dev_data *dev = ep->driver_data;
969
970 if (dev->setup_out_ready) {
971 DBG (dev, "ep0 request busy!\n");
972 return -EBUSY;
973 }
974 if (len > sizeof (dev->rbuf))
975 req->buf = kmalloc(len, GFP_ATOMIC);
976 if (req->buf == NULL) {
977 req->buf = dev->rbuf;
978 return -ENOMEM;
979 }
980 req->complete = ep0_complete;
981 req->length = len;
982 req->zero = 0;
983 return 0;
984 }
985
986 static ssize_t
987 ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
988 {
989 struct dev_data *dev = fd->private_data;
990 ssize_t retval;
991 enum ep0_state state;
992
993 spin_lock_irq (&dev->lock);
994
995 /* report fd mode change before acting on it */
996 if (dev->setup_abort) {
997 dev->setup_abort = 0;
998 retval = -EIDRM;
999 goto done;
1000 }
1001
1002 /* control DATA stage */
1003 if ((state = dev->state) == STATE_DEV_SETUP) {
1004
1005 if (dev->setup_in) { /* stall IN */
1006 VDEBUG(dev, "ep0in stall\n");
1007 (void) usb_ep_set_halt (dev->gadget->ep0);
1008 retval = -EL2HLT;
1009 dev->state = STATE_DEV_CONNECTED;
1010
1011 } else if (len == 0) { /* ack SET_CONFIGURATION etc */
1012 struct usb_ep *ep = dev->gadget->ep0;
1013 struct usb_request *req = dev->req;
1014
1015 if ((retval = setup_req (ep, req, 0)) == 0)
1016 retval = usb_ep_queue (ep, req, GFP_ATOMIC);
1017 dev->state = STATE_DEV_CONNECTED;
1018
1019 /* assume that was SET_CONFIGURATION */
1020 if (dev->current_config) {
1021 unsigned power;
1022
1023 if (gadget_is_dualspeed(dev->gadget)
1024 && (dev->gadget->speed
1025 == USB_SPEED_HIGH))
1026 power = dev->hs_config->bMaxPower;
1027 else
1028 power = dev->config->bMaxPower;
1029 usb_gadget_vbus_draw(dev->gadget, 2 * power);
1030 }
1031
1032 } else { /* collect OUT data */
1033 if ((fd->f_flags & O_NONBLOCK) != 0
1034 && !dev->setup_out_ready) {
1035 retval = -EAGAIN;
1036 goto done;
1037 }
1038 spin_unlock_irq (&dev->lock);
1039 retval = wait_event_interruptible (dev->wait,
1040 dev->setup_out_ready != 0);
1041
1042 /* FIXME state could change from under us */
1043 spin_lock_irq (&dev->lock);
1044 if (retval)
1045 goto done;
1046
1047 if (dev->state != STATE_DEV_SETUP) {
1048 retval = -ECANCELED;
1049 goto done;
1050 }
1051 dev->state = STATE_DEV_CONNECTED;
1052
1053 if (dev->setup_out_error)
1054 retval = -EIO;
1055 else {
1056 len = min (len, (size_t)dev->req->actual);
1057 // FIXME don't call this with the spinlock held ...
1058 if (copy_to_user (buf, dev->req->buf, len))
1059 retval = -EFAULT;
1060 else
1061 retval = len;
1062 clean_req (dev->gadget->ep0, dev->req);
1063 /* NOTE userspace can't yet choose to stall */
1064 }
1065 }
1066 goto done;
1067 }
1068
1069 /* else normal: return event data */
1070 if (len < sizeof dev->event [0]) {
1071 retval = -EINVAL;
1072 goto done;
1073 }
1074 len -= len % sizeof (struct usb_gadgetfs_event);
1075 dev->usermode_setup = 1;
1076
1077 scan:
1078 /* return queued events right away */
1079 if (dev->ev_next != 0) {
1080 unsigned i, n;
1081
1082 n = len / sizeof (struct usb_gadgetfs_event);
1083 if (dev->ev_next < n)
1084 n = dev->ev_next;
1085
1086 /* ep0 i/o has special semantics during STATE_DEV_SETUP */
1087 for (i = 0; i < n; i++) {
1088 if (dev->event [i].type == GADGETFS_SETUP) {
1089 dev->state = STATE_DEV_SETUP;
1090 n = i + 1;
1091 break;
1092 }
1093 }
1094 spin_unlock_irq (&dev->lock);
1095 len = n * sizeof (struct usb_gadgetfs_event);
1096 if (copy_to_user (buf, &dev->event, len))
1097 retval = -EFAULT;
1098 else
1099 retval = len;
1100 if (len > 0) {
1101 /* NOTE this doesn't guard against broken drivers;
1102 * concurrent ep0 readers may lose events.
1103 */
1104 spin_lock_irq (&dev->lock);
1105 if (dev->ev_next > n) {
1106 memmove(&dev->event[0], &dev->event[n],
1107 sizeof (struct usb_gadgetfs_event)
1108 * (dev->ev_next - n));
1109 }
1110 dev->ev_next -= n;
1111 spin_unlock_irq (&dev->lock);
1112 }
1113 return retval;
1114 }
1115 if (fd->f_flags & O_NONBLOCK) {
1116 retval = -EAGAIN;
1117 goto done;
1118 }
1119
1120 switch (state) {
1121 default:
1122 DBG (dev, "fail %s, state %d\n", __func__, state);
1123 retval = -ESRCH;
1124 break;
1125 case STATE_DEV_UNCONNECTED:
1126 case STATE_DEV_CONNECTED:
1127 spin_unlock_irq (&dev->lock);
1128 DBG (dev, "%s wait\n", __func__);
1129
1130 /* wait for events */
1131 retval = wait_event_interruptible (dev->wait,
1132 dev->ev_next != 0);
1133 if (retval < 0)
1134 return retval;
1135 spin_lock_irq (&dev->lock);
1136 goto scan;
1137 }
1138
1139 done:
1140 spin_unlock_irq (&dev->lock);
1141 return retval;
1142 }
1143
1144 static struct usb_gadgetfs_event *
1145 next_event (struct dev_data *dev, enum usb_gadgetfs_event_type type)
1146 {
1147 struct usb_gadgetfs_event *event;
1148 unsigned i;
1149
1150 switch (type) {
1151 /* these events purge the queue */
1152 case GADGETFS_DISCONNECT:
1153 if (dev->state == STATE_DEV_SETUP)
1154 dev->setup_abort = 1;
1155 // FALL THROUGH
1156 case GADGETFS_CONNECT:
1157 dev->ev_next = 0;
1158 break;
1159 case GADGETFS_SETUP: /* previous request timed out */
1160 case GADGETFS_SUSPEND: /* same effect */
1161 /* these events can't be repeated */
1162 for (i = 0; i != dev->ev_next; i++) {
1163 if (dev->event [i].type != type)
1164 continue;
1165 DBG(dev, "discard old event[%d] %d\n", i, type);
1166 dev->ev_next--;
1167 if (i == dev->ev_next)
1168 break;
1169 /* indices start at zero, for simplicity */
1170 memmove (&dev->event [i], &dev->event [i + 1],
1171 sizeof (struct usb_gadgetfs_event)
1172 * (dev->ev_next - i));
1173 }
1174 break;
1175 default:
1176 BUG ();
1177 }
1178 VDEBUG(dev, "event[%d] = %d\n", dev->ev_next, type);
1179 event = &dev->event [dev->ev_next++];
1180 BUG_ON (dev->ev_next > N_EVENT);
1181 memset (event, 0, sizeof *event);
1182 event->type = type;
1183 return event;
1184 }
1185
1186 static ssize_t
1187 ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
1188 {
1189 struct dev_data *dev = fd->private_data;
1190 ssize_t retval = -ESRCH;
1191
1192 spin_lock_irq (&dev->lock);
1193
1194 /* report fd mode change before acting on it */
1195 if (dev->setup_abort) {
1196 dev->setup_abort = 0;
1197 retval = -EIDRM;
1198
1199 /* data and/or status stage for control request */
1200 } else if (dev->state == STATE_DEV_SETUP) {
1201
1202 /* IN DATA+STATUS caller makes len <= wLength */
1203 if (dev->setup_in) {
1204 retval = setup_req (dev->gadget->ep0, dev->req, len);
1205 if (retval == 0) {
1206 dev->state = STATE_DEV_CONNECTED;
1207 spin_unlock_irq (&dev->lock);
1208 if (copy_from_user (dev->req->buf, buf, len))
1209 retval = -EFAULT;
1210 else {
1211 if (len < dev->setup_wLength)
1212 dev->req->zero = 1;
1213 retval = usb_ep_queue (
1214 dev->gadget->ep0, dev->req,
1215 GFP_KERNEL);
1216 }
1217 if (retval < 0) {
1218 spin_lock_irq (&dev->lock);
1219 clean_req (dev->gadget->ep0, dev->req);
1220 spin_unlock_irq (&dev->lock);
1221 } else
1222 retval = len;
1223
1224 return retval;
1225 }
1226
1227 /* can stall some OUT transfers */
1228 } else if (dev->setup_can_stall) {
1229 VDEBUG(dev, "ep0out stall\n");
1230 (void) usb_ep_set_halt (dev->gadget->ep0);
1231 retval = -EL2HLT;
1232 dev->state = STATE_DEV_CONNECTED;
1233 } else {
1234 DBG(dev, "bogus ep0out stall!\n");
1235 }
1236 } else
1237 DBG (dev, "fail %s, state %d\n", __func__, dev->state);
1238
1239 spin_unlock_irq (&dev->lock);
1240 return retval;
1241 }
1242
1243 static int
1244 ep0_fasync (int f, struct file *fd, int on)
1245 {
1246 struct dev_data *dev = fd->private_data;
1247 // caller must F_SETOWN before signal delivery happens
1248 VDEBUG (dev, "%s %s\n", __func__, on ? "on" : "off");
1249 return fasync_helper (f, fd, on, &dev->fasync);
1250 }
1251
1252 static struct usb_gadget_driver gadgetfs_driver;
1253
1254 static int
1255 dev_release (struct inode *inode, struct file *fd)
1256 {
1257 struct dev_data *dev = fd->private_data;
1258
1259 /* closing ep0 === shutdown all */
1260
1261 usb_gadget_unregister_driver (&gadgetfs_driver);
1262
1263 /* at this point "good" hardware has disconnected the
1264 * device from USB; the host won't see it any more.
1265 * alternatively, all host requests will time out.
1266 */
1267
1268 kfree (dev->buf);
1269 dev->buf = NULL;
1270 put_dev (dev);
1271
1272 /* other endpoints were all decoupled from this device */
1273 spin_lock_irq(&dev->lock);
1274 dev->state = STATE_DEV_DISABLED;
1275 spin_unlock_irq(&dev->lock);
1276 return 0;
1277 }
1278
1279 static unsigned int
1280 ep0_poll (struct file *fd, poll_table *wait)
1281 {
1282 struct dev_data *dev = fd->private_data;
1283 int mask = 0;
1284
1285 poll_wait(fd, &dev->wait, wait);
1286
1287 spin_lock_irq (&dev->lock);
1288
1289 /* report fd mode change before acting on it */
1290 if (dev->setup_abort) {
1291 dev->setup_abort = 0;
1292 mask = POLLHUP;
1293 goto out;
1294 }
1295
1296 if (dev->state == STATE_DEV_SETUP) {
1297 if (dev->setup_in || dev->setup_can_stall)
1298 mask = POLLOUT;
1299 } else {
1300 if (dev->ev_next != 0)
1301 mask = POLLIN;
1302 }
1303 out:
1304 spin_unlock_irq(&dev->lock);
1305 return mask;
1306 }
1307
1308 static long dev_ioctl (struct file *fd, unsigned code, unsigned long value)
1309 {
1310 struct dev_data *dev = fd->private_data;
1311 struct usb_gadget *gadget = dev->gadget;
1312 long ret = -ENOTTY;
1313
1314 if (gadget->ops->ioctl)
1315 ret = gadget->ops->ioctl (gadget, code, value);
1316
1317 return ret;
1318 }
1319
1320 /* used after device configuration */
1321 static const struct file_operations ep0_io_operations = {
1322 .owner = THIS_MODULE,
1323 .llseek = no_llseek,
1324
1325 .read = ep0_read,
1326 .write = ep0_write,
1327 .fasync = ep0_fasync,
1328 .poll = ep0_poll,
1329 .unlocked_ioctl = dev_ioctl,
1330 .release = dev_release,
1331 };
1332
1333 /*----------------------------------------------------------------------*/
1334
1335 /* The in-kernel gadget driver handles most ep0 issues, in particular
1336 * enumerating the single configuration (as provided from user space).
1337 *
1338 * Unrecognized ep0 requests may be handled in user space.
1339 */
1340
1341 static void make_qualifier (struct dev_data *dev)
1342 {
1343 struct usb_qualifier_descriptor qual;
1344 struct usb_device_descriptor *desc;
1345
1346 qual.bLength = sizeof qual;
1347 qual.bDescriptorType = USB_DT_DEVICE_QUALIFIER;
1348 qual.bcdUSB = cpu_to_le16 (0x0200);
1349
1350 desc = dev->dev;
1351 qual.bDeviceClass = desc->bDeviceClass;
1352 qual.bDeviceSubClass = desc->bDeviceSubClass;
1353 qual.bDeviceProtocol = desc->bDeviceProtocol;
1354
1355 /* assumes ep0 uses the same value for both speeds ... */
1356 qual.bMaxPacketSize0 = dev->gadget->ep0->maxpacket;
1357
1358 qual.bNumConfigurations = 1;
1359 qual.bRESERVED = 0;
1360
1361 memcpy (dev->rbuf, &qual, sizeof qual);
1362 }
1363
1364 static int
1365 config_buf (struct dev_data *dev, u8 type, unsigned index)
1366 {
1367 int len;
1368 int hs = 0;
1369
1370 /* only one configuration */
1371 if (index > 0)
1372 return -EINVAL;
1373
1374 if (gadget_is_dualspeed(dev->gadget)) {
1375 hs = (dev->gadget->speed == USB_SPEED_HIGH);
1376 if (type == USB_DT_OTHER_SPEED_CONFIG)
1377 hs = !hs;
1378 }
1379 if (hs) {
1380 dev->req->buf = dev->hs_config;
1381 len = le16_to_cpu(dev->hs_config->wTotalLength);
1382 } else {
1383 dev->req->buf = dev->config;
1384 len = le16_to_cpu(dev->config->wTotalLength);
1385 }
1386 ((u8 *)dev->req->buf) [1] = type;
1387 return len;
1388 }
1389
1390 static int
1391 gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
1392 {
1393 struct dev_data *dev = get_gadget_data (gadget);
1394 struct usb_request *req = dev->req;
1395 int value = -EOPNOTSUPP;
1396 struct usb_gadgetfs_event *event;
1397 u16 w_value = le16_to_cpu(ctrl->wValue);
1398 u16 w_length = le16_to_cpu(ctrl->wLength);
1399
1400 spin_lock (&dev->lock);
1401 dev->setup_abort = 0;
1402 if (dev->state == STATE_DEV_UNCONNECTED) {
1403 if (gadget_is_dualspeed(gadget)
1404 && gadget->speed == USB_SPEED_HIGH
1405 && dev->hs_config == NULL) {
1406 spin_unlock(&dev->lock);
1407 ERROR (dev, "no high speed config??\n");
1408 return -EINVAL;
1409 }
1410
1411 dev->state = STATE_DEV_CONNECTED;
1412
1413 INFO (dev, "connected\n");
1414 event = next_event (dev, GADGETFS_CONNECT);
1415 event->u.speed = gadget->speed;
1416 ep0_readable (dev);
1417
1418 /* host may have given up waiting for response. we can miss control
1419 * requests handled lower down (device/endpoint status and features);
1420 * then ep0_{read,write} will report the wrong status. controller
1421 * driver will have aborted pending i/o.
1422 */
1423 } else if (dev->state == STATE_DEV_SETUP)
1424 dev->setup_abort = 1;
1425
1426 req->buf = dev->rbuf;
1427 req->context = NULL;
1428 value = -EOPNOTSUPP;
1429 switch (ctrl->bRequest) {
1430
1431 case USB_REQ_GET_DESCRIPTOR:
1432 if (ctrl->bRequestType != USB_DIR_IN)
1433 goto unrecognized;
1434 switch (w_value >> 8) {
1435
1436 case USB_DT_DEVICE:
1437 value = min (w_length, (u16) sizeof *dev->dev);
1438 dev->dev->bMaxPacketSize0 = dev->gadget->ep0->maxpacket;
1439 req->buf = dev->dev;
1440 break;
1441 case USB_DT_DEVICE_QUALIFIER:
1442 if (!dev->hs_config)
1443 break;
1444 value = min (w_length, (u16)
1445 sizeof (struct usb_qualifier_descriptor));
1446 make_qualifier (dev);
1447 break;
1448 case USB_DT_OTHER_SPEED_CONFIG:
1449 // FALLTHROUGH
1450 case USB_DT_CONFIG:
1451 value = config_buf (dev,
1452 w_value >> 8,
1453 w_value & 0xff);
1454 if (value >= 0)
1455 value = min (w_length, (u16) value);
1456 break;
1457 case USB_DT_STRING:
1458 goto unrecognized;
1459
1460 default: // all others are errors
1461 break;
1462 }
1463 break;
1464
1465 /* currently one config, two speeds */
1466 case USB_REQ_SET_CONFIGURATION:
1467 if (ctrl->bRequestType != 0)
1468 goto unrecognized;
1469 if (0 == (u8) w_value) {
1470 value = 0;
1471 dev->current_config = 0;
1472 usb_gadget_vbus_draw(gadget, 8 /* mA */ );
1473 // user mode expected to disable endpoints
1474 } else {
1475 u8 config, power;
1476
1477 if (gadget_is_dualspeed(gadget)
1478 && gadget->speed == USB_SPEED_HIGH) {
1479 config = dev->hs_config->bConfigurationValue;
1480 power = dev->hs_config->bMaxPower;
1481 } else {
1482 config = dev->config->bConfigurationValue;
1483 power = dev->config->bMaxPower;
1484 }
1485
1486 if (config == (u8) w_value) {
1487 value = 0;
1488 dev->current_config = config;
1489 usb_gadget_vbus_draw(gadget, 2 * power);
1490 }
1491 }
1492
1493 /* report SET_CONFIGURATION like any other control request,
1494 * except that usermode may not stall this. the next
1495 * request mustn't be allowed start until this finishes:
1496 * endpoints and threads set up, etc.
1497 *
1498 * NOTE: older PXA hardware (before PXA 255: without UDCCFR)
1499 * has bad/racey automagic that prevents synchronizing here.
1500 * even kernel mode drivers often miss them.
1501 */
1502 if (value == 0) {
1503 INFO (dev, "configuration #%d\n", dev->current_config);
1504 if (dev->usermode_setup) {
1505 dev->setup_can_stall = 0;
1506 goto delegate;
1507 }
1508 }
1509 break;
1510
1511 #ifndef CONFIG_USB_GADGET_PXA25X
1512 /* PXA automagically handles this request too */
1513 case USB_REQ_GET_CONFIGURATION:
1514 if (ctrl->bRequestType != 0x80)
1515 goto unrecognized;
1516 *(u8 *)req->buf = dev->current_config;
1517 value = min (w_length, (u16) 1);
1518 break;
1519 #endif
1520
1521 default:
1522 unrecognized:
1523 VDEBUG (dev, "%s req%02x.%02x v%04x i%04x l%d\n",
1524 dev->usermode_setup ? "delegate" : "fail",
1525 ctrl->bRequestType, ctrl->bRequest,
1526 w_value, le16_to_cpu(ctrl->wIndex), w_length);
1527
1528 /* if there's an ep0 reader, don't stall */
1529 if (dev->usermode_setup) {
1530 dev->setup_can_stall = 1;
1531 delegate:
1532 dev->setup_in = (ctrl->bRequestType & USB_DIR_IN)
1533 ? 1 : 0;
1534 dev->setup_wLength = w_length;
1535 dev->setup_out_ready = 0;
1536 dev->setup_out_error = 0;
1537 value = 0;
1538
1539 /* read DATA stage for OUT right away */
1540 if (unlikely (!dev->setup_in && w_length)) {
1541 value = setup_req (gadget->ep0, dev->req,
1542 w_length);
1543 if (value < 0)
1544 break;
1545 value = usb_ep_queue (gadget->ep0, dev->req,
1546 GFP_ATOMIC);
1547 if (value < 0) {
1548 clean_req (gadget->ep0, dev->req);
1549 break;
1550 }
1551
1552 /* we can't currently stall these */
1553 dev->setup_can_stall = 0;
1554 }
1555
1556 /* state changes when reader collects event */
1557 event = next_event (dev, GADGETFS_SETUP);
1558 event->u.setup = *ctrl;
1559 ep0_readable (dev);
1560 spin_unlock (&dev->lock);
1561 return 0;
1562 }
1563 }
1564
1565 /* proceed with data transfer and status phases? */
1566 if (value >= 0 && dev->state != STATE_DEV_SETUP) {
1567 req->length = value;
1568 req->zero = value < w_length;
1569 value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC);
1570 if (value < 0) {
1571 DBG (dev, "ep_queue --> %d\n", value);
1572 req->status = 0;
1573 }
1574 }
1575
1576 /* device stalls when value < 0 */
1577 spin_unlock (&dev->lock);
1578 return value;
1579 }
1580
1581 static void destroy_ep_files (struct dev_data *dev)
1582 {
1583 DBG (dev, "%s %d\n", __func__, dev->state);
1584
1585 /* dev->state must prevent interference */
1586 spin_lock_irq (&dev->lock);
1587 while (!list_empty(&dev->epfiles)) {
1588 struct ep_data *ep;
1589 struct inode *parent;
1590 struct dentry *dentry;
1591
1592 /* break link to FS */
1593 ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles);
1594 list_del_init (&ep->epfiles);
1595 dentry = ep->dentry;
1596 ep->dentry = NULL;
1597 parent = dentry->d_parent->d_inode;
1598
1599 /* break link to controller */
1600 if (ep->state == STATE_EP_ENABLED)
1601 (void) usb_ep_disable (ep->ep);
1602 ep->state = STATE_EP_UNBOUND;
1603 usb_ep_free_request (ep->ep, ep->req);
1604 ep->ep = NULL;
1605 wake_up (&ep->wait);
1606 put_ep (ep);
1607
1608 spin_unlock_irq (&dev->lock);
1609
1610 /* break link to dcache */
1611 mutex_lock (&parent->i_mutex);
1612 d_delete (dentry);
1613 dput (dentry);
1614 mutex_unlock (&parent->i_mutex);
1615
1616 spin_lock_irq (&dev->lock);
1617 }
1618 spin_unlock_irq (&dev->lock);
1619 }
1620
1621
1622 static struct inode *
1623 gadgetfs_create_file (struct super_block *sb, char const *name,
1624 void *data, const struct file_operations *fops,
1625 struct dentry **dentry_p);
1626
1627 static int activate_ep_files (struct dev_data *dev)
1628 {
1629 struct usb_ep *ep;
1630 struct ep_data *data;
1631
1632 gadget_for_each_ep (ep, dev->gadget) {
1633
1634 data = kzalloc(sizeof(*data), GFP_KERNEL);
1635 if (!data)
1636 goto enomem0;
1637 data->state = STATE_EP_DISABLED;
1638 mutex_init(&data->lock);
1639 init_waitqueue_head (&data->wait);
1640
1641 strncpy (data->name, ep->name, sizeof (data->name) - 1);
1642 atomic_set (&data->count, 1);
1643 data->dev = dev;
1644 get_dev (dev);
1645
1646 data->ep = ep;
1647 ep->driver_data = data;
1648
1649 data->req = usb_ep_alloc_request (ep, GFP_KERNEL);
1650 if (!data->req)
1651 goto enomem1;
1652
1653 data->inode = gadgetfs_create_file (dev->sb, data->name,
1654 data, &ep_config_operations,
1655 &data->dentry);
1656 if (!data->inode)
1657 goto enomem2;
1658 list_add_tail (&data->epfiles, &dev->epfiles);
1659 }
1660 return 0;
1661
1662 enomem2:
1663 usb_ep_free_request (ep, data->req);
1664 enomem1:
1665 put_dev (dev);
1666 kfree (data);
1667 enomem0:
1668 DBG (dev, "%s enomem\n", __func__);
1669 destroy_ep_files (dev);
1670 return -ENOMEM;
1671 }
1672
1673 static void
1674 gadgetfs_unbind (struct usb_gadget *gadget)
1675 {
1676 struct dev_data *dev = get_gadget_data (gadget);
1677
1678 DBG (dev, "%s\n", __func__);
1679
1680 spin_lock_irq (&dev->lock);
1681 dev->state = STATE_DEV_UNBOUND;
1682 spin_unlock_irq (&dev->lock);
1683
1684 destroy_ep_files (dev);
1685 gadget->ep0->driver_data = NULL;
1686 set_gadget_data (gadget, NULL);
1687
1688 /* we've already been disconnected ... no i/o is active */
1689 if (dev->req)
1690 usb_ep_free_request (gadget->ep0, dev->req);
1691 DBG (dev, "%s done\n", __func__);
1692 put_dev (dev);
1693 }
1694
1695 static struct dev_data *the_device;
1696
1697 static int gadgetfs_bind(struct usb_gadget *gadget,
1698 struct usb_gadget_driver *driver)
1699 {
1700 struct dev_data *dev = the_device;
1701
1702 if (!dev)
1703 return -ESRCH;
1704 if (0 != strcmp (CHIP, gadget->name)) {
1705 pr_err("%s expected %s controller not %s\n",
1706 shortname, CHIP, gadget->name);
1707 return -ENODEV;
1708 }
1709
1710 set_gadget_data (gadget, dev);
1711 dev->gadget = gadget;
1712 gadget->ep0->driver_data = dev;
1713
1714 /* preallocate control response and buffer */
1715 dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
1716 if (!dev->req)
1717 goto enomem;
1718 dev->req->context = NULL;
1719 dev->req->complete = epio_complete;
1720
1721 if (activate_ep_files (dev) < 0)
1722 goto enomem;
1723
1724 INFO (dev, "bound to %s driver\n", gadget->name);
1725 spin_lock_irq(&dev->lock);
1726 dev->state = STATE_DEV_UNCONNECTED;
1727 spin_unlock_irq(&dev->lock);
1728 get_dev (dev);
1729 return 0;
1730
1731 enomem:
1732 gadgetfs_unbind (gadget);
1733 return -ENOMEM;
1734 }
1735
1736 static void
1737 gadgetfs_disconnect (struct usb_gadget *gadget)
1738 {
1739 struct dev_data *dev = get_gadget_data (gadget);
1740 unsigned long flags;
1741
1742 spin_lock_irqsave (&dev->lock, flags);
1743 if (dev->state == STATE_DEV_UNCONNECTED)
1744 goto exit;
1745 dev->state = STATE_DEV_UNCONNECTED;
1746
1747 INFO (dev, "disconnected\n");
1748 next_event (dev, GADGETFS_DISCONNECT);
1749 ep0_readable (dev);
1750 exit:
1751 spin_unlock_irqrestore (&dev->lock, flags);
1752 }
1753
1754 static void
1755 gadgetfs_suspend (struct usb_gadget *gadget)
1756 {
1757 struct dev_data *dev = get_gadget_data (gadget);
1758
1759 INFO (dev, "suspended from state %d\n", dev->state);
1760 spin_lock (&dev->lock);
1761 switch (dev->state) {
1762 case STATE_DEV_SETUP: // VERY odd... host died??
1763 case STATE_DEV_CONNECTED:
1764 case STATE_DEV_UNCONNECTED:
1765 next_event (dev, GADGETFS_SUSPEND);
1766 ep0_readable (dev);
1767 /* FALLTHROUGH */
1768 default:
1769 break;
1770 }
1771 spin_unlock (&dev->lock);
1772 }
1773
1774 static struct usb_gadget_driver gadgetfs_driver = {
1775 .function = (char *) driver_desc,
1776 .bind = gadgetfs_bind,
1777 .unbind = gadgetfs_unbind,
1778 .setup = gadgetfs_setup,
1779 .disconnect = gadgetfs_disconnect,
1780 .suspend = gadgetfs_suspend,
1781
1782 .driver = {
1783 .name = (char *) shortname,
1784 },
1785 };
1786
1787 /*----------------------------------------------------------------------*/
1788
1789 static void gadgetfs_nop(struct usb_gadget *arg) { }
1790
1791 static int gadgetfs_probe(struct usb_gadget *gadget,
1792 struct usb_gadget_driver *driver)
1793 {
1794 CHIP = gadget->name;
1795 return -EISNAM;
1796 }
1797
1798 static struct usb_gadget_driver probe_driver = {
1799 .max_speed = USB_SPEED_HIGH,
1800 .bind = gadgetfs_probe,
1801 .unbind = gadgetfs_nop,
1802 .setup = (void *)gadgetfs_nop,
1803 .disconnect = gadgetfs_nop,
1804 .driver = {
1805 .name = "nop",
1806 },
1807 };
1808
1809
1810 /* DEVICE INITIALIZATION
1811 *
1812 * fd = open ("/dev/gadget/$CHIP", O_RDWR)
1813 * status = write (fd, descriptors, sizeof descriptors)
1814 *
1815 * That write establishes the device configuration, so the kernel can
1816 * bind to the controller ... guaranteeing it can handle enumeration
1817 * at all necessary speeds. Descriptor order is:
1818 *
1819 * . message tag (u32, host order) ... for now, must be zero; it
1820 * would change to support features like multi-config devices
1821 * . full/low speed config ... all wTotalLength bytes (with interface,
1822 * class, altsetting, endpoint, and other descriptors)
1823 * . high speed config ... all descriptors, for high speed operation;
1824 * this one's optional except for high-speed hardware
1825 * . device descriptor
1826 *
1827 * Endpoints are not yet enabled. Drivers must wait until device
1828 * configuration and interface altsetting changes create
1829 * the need to configure (or unconfigure) them.
1830 *
1831 * After initialization, the device stays active for as long as that
1832 * $CHIP file is open. Events must then be read from that descriptor,
1833 * such as configuration notifications.
1834 */
1835
1836 static int is_valid_config (struct usb_config_descriptor *config)
1837 {
1838 return config->bDescriptorType == USB_DT_CONFIG
1839 && config->bLength == USB_DT_CONFIG_SIZE
1840 && config->bConfigurationValue != 0
1841 && (config->bmAttributes & USB_CONFIG_ATT_ONE) != 0
1842 && (config->bmAttributes & USB_CONFIG_ATT_WAKEUP) == 0;
1843 /* FIXME if gadget->is_otg, _must_ include an otg descriptor */
1844 /* FIXME check lengths: walk to end */
1845 }
1846
1847 static ssize_t
1848 dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
1849 {
1850 struct dev_data *dev = fd->private_data;
1851 ssize_t value = len, length = len;
1852 unsigned total;
1853 u32 tag;
1854 char *kbuf;
1855
1856 if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4))
1857 return -EINVAL;
1858
1859 /* we might need to change message format someday */
1860 if (copy_from_user (&tag, buf, 4))
1861 return -EFAULT;
1862 if (tag != 0)
1863 return -EINVAL;
1864 buf += 4;
1865 length -= 4;
1866
1867 kbuf = memdup_user(buf, length);
1868 if (IS_ERR(kbuf))
1869 return PTR_ERR(kbuf);
1870
1871 spin_lock_irq (&dev->lock);
1872 value = -EINVAL;
1873 if (dev->buf)
1874 goto fail;
1875 dev->buf = kbuf;
1876
1877 /* full or low speed config */
1878 dev->config = (void *) kbuf;
1879 total = le16_to_cpu(dev->config->wTotalLength);
1880 if (!is_valid_config (dev->config) || total >= length)
1881 goto fail;
1882 kbuf += total;
1883 length -= total;
1884
1885 /* optional high speed config */
1886 if (kbuf [1] == USB_DT_CONFIG) {
1887 dev->hs_config = (void *) kbuf;
1888 total = le16_to_cpu(dev->hs_config->wTotalLength);
1889 if (!is_valid_config (dev->hs_config) || total >= length)
1890 goto fail;
1891 kbuf += total;
1892 length -= total;
1893 }
1894
1895 /* could support multiple configs, using another encoding! */
1896
1897 /* device descriptor (tweaked for paranoia) */
1898 if (length != USB_DT_DEVICE_SIZE)
1899 goto fail;
1900 dev->dev = (void *)kbuf;
1901 if (dev->dev->bLength != USB_DT_DEVICE_SIZE
1902 || dev->dev->bDescriptorType != USB_DT_DEVICE
1903 || dev->dev->bNumConfigurations != 1)
1904 goto fail;
1905 dev->dev->bNumConfigurations = 1;
1906 dev->dev->bcdUSB = cpu_to_le16 (0x0200);
1907
1908 /* triggers gadgetfs_bind(); then we can enumerate. */
1909 spin_unlock_irq (&dev->lock);
1910 if (dev->hs_config)
1911 gadgetfs_driver.max_speed = USB_SPEED_HIGH;
1912 else
1913 gadgetfs_driver.max_speed = USB_SPEED_FULL;
1914
1915 value = usb_gadget_probe_driver(&gadgetfs_driver);
1916 if (value != 0) {
1917 kfree (dev->buf);
1918 dev->buf = NULL;
1919 } else {
1920 /* at this point "good" hardware has for the first time
1921 * let the USB the host see us. alternatively, if users
1922 * unplug/replug that will clear all the error state.
1923 *
1924 * note: everything running before here was guaranteed
1925 * to choke driver model style diagnostics. from here
1926 * on, they can work ... except in cleanup paths that
1927 * kick in after the ep0 descriptor is closed.
1928 */
1929 fd->f_op = &ep0_io_operations;
1930 value = len;
1931 }
1932 return value;
1933
1934 fail:
1935 spin_unlock_irq (&dev->lock);
1936 pr_debug ("%s: %s fail %Zd, %p\n", shortname, __func__, value, dev);
1937 kfree (dev->buf);
1938 dev->buf = NULL;
1939 return value;
1940 }
1941
1942 static int
1943 dev_open (struct inode *inode, struct file *fd)
1944 {
1945 struct dev_data *dev = inode->i_private;
1946 int value = -EBUSY;
1947
1948 spin_lock_irq(&dev->lock);
1949 if (dev->state == STATE_DEV_DISABLED) {
1950 dev->ev_next = 0;
1951 dev->state = STATE_DEV_OPENED;
1952 fd->private_data = dev;
1953 get_dev (dev);
1954 value = 0;
1955 }
1956 spin_unlock_irq(&dev->lock);
1957 return value;
1958 }
1959
1960 static const struct file_operations dev_init_operations = {
1961 .llseek = no_llseek,
1962
1963 .open = dev_open,
1964 .write = dev_config,
1965 .fasync = ep0_fasync,
1966 .unlocked_ioctl = dev_ioctl,
1967 .release = dev_release,
1968 };
1969
1970 /*----------------------------------------------------------------------*/
1971
1972 /* FILESYSTEM AND SUPERBLOCK OPERATIONS
1973 *
1974 * Mounting the filesystem creates a controller file, used first for
1975 * device configuration then later for event monitoring.
1976 */
1977
1978
1979 /* FIXME PAM etc could set this security policy without mount options
1980 * if epfiles inherited ownership and permissons from ep0 ...
1981 */
1982
1983 static unsigned default_uid;
1984 static unsigned default_gid;
1985 static unsigned default_perm = S_IRUSR | S_IWUSR;
1986
1987 module_param (default_uid, uint, 0644);
1988 module_param (default_gid, uint, 0644);
1989 module_param (default_perm, uint, 0644);
1990
1991
1992 static struct inode *
1993 gadgetfs_make_inode (struct super_block *sb,
1994 void *data, const struct file_operations *fops,
1995 int mode)
1996 {
1997 struct inode *inode = new_inode (sb);
1998
1999 if (inode) {
2000 inode->i_ino = get_next_ino();
2001 inode->i_mode = mode;
2002 inode->i_uid = make_kuid(&init_user_ns, default_uid);
2003 inode->i_gid = make_kgid(&init_user_ns, default_gid);
2004 inode->i_atime = inode->i_mtime = inode->i_ctime
2005 = CURRENT_TIME;
2006 inode->i_private = data;
2007 inode->i_fop = fops;
2008 }
2009 return inode;
2010 }
2011
2012 /* creates in fs root directory, so non-renamable and non-linkable.
2013 * so inode and dentry are paired, until device reconfig.
2014 */
2015 static struct inode *
2016 gadgetfs_create_file (struct super_block *sb, char const *name,
2017 void *data, const struct file_operations *fops,
2018 struct dentry **dentry_p)
2019 {
2020 struct dentry *dentry;
2021 struct inode *inode;
2022
2023 dentry = d_alloc_name(sb->s_root, name);
2024 if (!dentry)
2025 return NULL;
2026
2027 inode = gadgetfs_make_inode (sb, data, fops,
2028 S_IFREG | (default_perm & S_IRWXUGO));
2029 if (!inode) {
2030 dput(dentry);
2031 return NULL;
2032 }
2033 d_add (dentry, inode);
2034 *dentry_p = dentry;
2035 return inode;
2036 }
2037
2038 static const struct super_operations gadget_fs_operations = {
2039 .statfs = simple_statfs,
2040 .drop_inode = generic_delete_inode,
2041 };
2042
2043 static int
2044 gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
2045 {
2046 struct inode *inode;
2047 struct dev_data *dev;
2048
2049 if (the_device)
2050 return -ESRCH;
2051
2052 /* fake probe to determine $CHIP */
2053 usb_gadget_probe_driver(&probe_driver);
2054 if (!CHIP)
2055 return -ENODEV;
2056
2057 /* superblock */
2058 sb->s_blocksize = PAGE_CACHE_SIZE;
2059 sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
2060 sb->s_magic = GADGETFS_MAGIC;
2061 sb->s_op = &gadget_fs_operations;
2062 sb->s_time_gran = 1;
2063
2064 /* root inode */
2065 inode = gadgetfs_make_inode (sb,
2066 NULL, &simple_dir_operations,
2067 S_IFDIR | S_IRUGO | S_IXUGO);
2068 if (!inode)
2069 goto Enomem;
2070 inode->i_op = &simple_dir_inode_operations;
2071 if (!(sb->s_root = d_make_root (inode)))
2072 goto Enomem;
2073
2074 /* the ep0 file is named after the controller we expect;
2075 * user mode code can use it for sanity checks, like we do.
2076 */
2077 dev = dev_new ();
2078 if (!dev)
2079 goto Enomem;
2080
2081 dev->sb = sb;
2082 if (!gadgetfs_create_file (sb, CHIP,
2083 dev, &dev_init_operations,
2084 &dev->dentry)) {
2085 put_dev(dev);
2086 goto Enomem;
2087 }
2088
2089 /* other endpoint files are available after hardware setup,
2090 * from binding to a controller.
2091 */
2092 the_device = dev;
2093 return 0;
2094
2095 Enomem:
2096 return -ENOMEM;
2097 }
2098
2099 /* "mount -t gadgetfs path /dev/gadget" ends up here */
2100 static struct dentry *
2101 gadgetfs_mount (struct file_system_type *t, int flags,
2102 const char *path, void *opts)
2103 {
2104 return mount_single (t, flags, opts, gadgetfs_fill_super);
2105 }
2106
2107 static void
2108 gadgetfs_kill_sb (struct super_block *sb)
2109 {
2110 kill_litter_super (sb);
2111 if (the_device) {
2112 put_dev (the_device);
2113 the_device = NULL;
2114 }
2115 }
2116
2117 /*----------------------------------------------------------------------*/
2118
2119 static struct file_system_type gadgetfs_type = {
2120 .owner = THIS_MODULE,
2121 .name = shortname,
2122 .mount = gadgetfs_mount,
2123 .kill_sb = gadgetfs_kill_sb,
2124 };
2125 MODULE_ALIAS_FS("gadgetfs");
2126
2127 /*----------------------------------------------------------------------*/
2128
2129 static int __init init (void)
2130 {
2131 int status;
2132
2133 status = register_filesystem (&gadgetfs_type);
2134 if (status == 0)
2135 pr_info ("%s: %s, version " DRIVER_VERSION "\n",
2136 shortname, driver_desc);
2137 return status;
2138 }
2139 module_init (init);
2140
2141 static void __exit cleanup (void)
2142 {
2143 pr_debug ("unregister %s\n", shortname);
2144 unregister_filesystem (&gadgetfs_type);
2145 }
2146 module_exit (cleanup);
2147
Linux kernel - Deliverables
This page took 0.137038 seconds and 5 git commands to generate.