aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/usb/gadget/inode.c
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@ppc970.osdl.org>2005-04-16 18:20:36 -0400
committerLinus Torvalds <torvalds@ppc970.osdl.org>2005-04-16 18:20:36 -0400
commit1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (patch)
tree0bba044c4ce775e45a88a51686b5d9f90697ea9d /drivers/usb/gadget/inode.c
Linux-2.6.12-rc2v2.6.12-rc2
Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
Diffstat (limited to 'drivers/usb/gadget/inode.c')
-rw-r--r--drivers/usb/gadget/inode.c2110
1 files changed, 2110 insertions, 0 deletions
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
new file mode 100644
index 000000000000..2cff67ccce45
--- /dev/null
+++ b/drivers/usb/gadget/inode.c
@@ -0,0 +1,2110 @@
1/*
2 * inode.c -- user mode filesystem api for usb gadget controllers
3 *
4 * Copyright (C) 2003-2004 David Brownell
5 * Copyright (C) 2003 Agilent Technologies
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 */
21
22
23// #define DEBUG /* data to help fault diagnosis */
24// #define VERBOSE /* extra debug messages (success too) */
25
26#include <linux/init.h>
27#include <linux/module.h>
28#include <linux/fs.h>
29#include <linux/pagemap.h>
30#include <linux/uts.h>
31#include <linux/wait.h>
32#include <linux/compiler.h>
33#include <asm/uaccess.h>
34#include <linux/slab.h>
35
36#include <linux/device.h>
37#include <linux/moduleparam.h>
38
39#include <linux/usb_gadgetfs.h>
40#include <linux/usb_gadget.h>
41
42
43/*
44 * The gadgetfs API maps each endpoint to a file descriptor so that you
45 * can use standard synchronous read/write calls for I/O. There's some
46 * O_NONBLOCK and O_ASYNC/FASYNC style i/o support. Example usermode
47 * drivers show how this works in practice. You can also use AIO to
48 * eliminate I/O gaps between requests, to help when streaming data.
49 *
50 * Key parts that must be USB-specific are protocols defining how the
51 * read/write operations relate to the hardware state machines. There
52 * are two types of files. One type is for the device, implementing ep0.
53 * The other type is for each IN or OUT endpoint. In both cases, the
54 * user mode driver must configure the hardware before using it.
55 *
56 * - First, dev_config() is called when /dev/gadget/$CHIP is configured
57 * (by writing configuration and device descriptors). Afterwards it
58 * may serve as a source of device events, used to handle all control
59 * requests other than basic enumeration.
60 *
61 * - Then either immediately, or after a SET_CONFIGURATION control request,
62 * ep_config() is called when each /dev/gadget/ep* file is configured
63 * (by writing endpoint descriptors). Afterwards these files are used
64 * to write() IN data or to read() OUT data. To halt the endpoint, a
65 * "wrong direction" request is issued (like reading an IN endpoint).
66 *
67 * Unlike "usbfs" the only ioctl()s are for things that are rare, and maybe
68 * not possible on all hardware. For example, precise fault handling with
69 * respect to data left in endpoint fifos after aborted operations; or
70 * selective clearing of endpoint halts, to implement SET_INTERFACE.
71 */
72
73#define DRIVER_DESC "USB Gadget filesystem"
74#define DRIVER_VERSION "24 Aug 2004"
75
76static const char driver_desc [] = DRIVER_DESC;
77static const char shortname [] = "gadgetfs";
78
79MODULE_DESCRIPTION (DRIVER_DESC);
80MODULE_AUTHOR ("David Brownell");
81MODULE_LICENSE ("GPL");
82
83
84/*----------------------------------------------------------------------*/
85
86#define GADGETFS_MAGIC 0xaee71ee7
87#define DMA_ADDR_INVALID (~(dma_addr_t)0)
88
89/* /dev/gadget/$CHIP represents ep0 and the whole device */
90enum ep0_state {
91 /* DISBLED is the initial state.
92 */
93 STATE_DEV_DISABLED = 0,
94
95 /* Only one open() of /dev/gadget/$CHIP; only one file tracks
96 * ep0/device i/o modes and binding to the controller. Driver
97 * must always write descriptors to initialize the device, then
98 * the device becomes UNCONNECTED until enumeration.
99 */
100 STATE_OPENED,
101
102 /* From then on, ep0 fd is in either of two basic modes:
103 * - (UN)CONNECTED: read usb_gadgetfs_event(s) from it
104 * - SETUP: read/write will transfer control data and succeed;
105 * or if "wrong direction", performs protocol stall
106 */
107 STATE_UNCONNECTED,
108 STATE_CONNECTED,
109 STATE_SETUP,
110
111 /* UNBOUND means the driver closed ep0, so the device won't be
112 * accessible again (DEV_DISABLED) until all fds are closed.
113 */
114 STATE_DEV_UNBOUND,
115};
116
117/* enough for the whole queue: most events invalidate others */
118#define N_EVENT 5
119
120struct dev_data {
121 spinlock_t lock;
122 atomic_t count;
123 enum ep0_state state;
124 struct usb_gadgetfs_event event [N_EVENT];
125 unsigned ev_next;
126 struct fasync_struct *fasync;
127 u8 current_config;
128
129 /* drivers reading ep0 MUST handle control requests (SETUP)
130 * reported that way; else the host will time out.
131 */
132 unsigned usermode_setup : 1,
133 setup_in : 1,
134 setup_can_stall : 1,
135 setup_out_ready : 1,
136 setup_out_error : 1,
137 setup_abort : 1;
138
139 /* the rest is basically write-once */
140 struct usb_config_descriptor *config, *hs_config;
141 struct usb_device_descriptor *dev;
142 struct usb_request *req;
143 struct usb_gadget *gadget;
144 struct list_head epfiles;
145 void *buf;
146 wait_queue_head_t wait;
147 struct super_block *sb;
148 struct dentry *dentry;
149
150 /* except this scratch i/o buffer for ep0 */
151 u8 rbuf [256];
152};
153
154static inline void get_dev (struct dev_data *data)
155{
156 atomic_inc (&data->count);
157}
158
159static void put_dev (struct dev_data *data)
160{
161 if (likely (!atomic_dec_and_test (&data->count)))
162 return;
163 /* needs no more cleanup */
164 BUG_ON (waitqueue_active (&data->wait));
165 kfree (data);
166}
167
168static struct dev_data *dev_new (void)
169{
170 struct dev_data *dev;
171
172 dev = kmalloc (sizeof *dev, GFP_KERNEL);
173 if (!dev)
174 return NULL;
175 memset (dev, 0, sizeof *dev);
176 dev->state = STATE_DEV_DISABLED;
177 atomic_set (&dev->count, 1);
178 spin_lock_init (&dev->lock);
179 INIT_LIST_HEAD (&dev->epfiles);
180 init_waitqueue_head (&dev->wait);
181 return dev;
182}
183
184/*----------------------------------------------------------------------*/
185
186/* other /dev/gadget/$ENDPOINT files represent endpoints */
187enum ep_state {
188 STATE_EP_DISABLED = 0,
189 STATE_EP_READY,
190 STATE_EP_DEFER_ENABLE,
191 STATE_EP_ENABLED,
192 STATE_EP_UNBOUND,
193};
194
195struct ep_data {
196 struct semaphore lock;
197 enum ep_state state;
198 atomic_t count;
199 struct dev_data *dev;
200 /* must hold dev->lock before accessing ep or req */
201 struct usb_ep *ep;
202 struct usb_request *req;
203 ssize_t status;
204 char name [16];
205 struct usb_endpoint_descriptor desc, hs_desc;
206 struct list_head epfiles;
207 wait_queue_head_t wait;
208 struct dentry *dentry;
209 struct inode *inode;
210};
211
212static inline void get_ep (struct ep_data *data)
213{
214 atomic_inc (&data->count);
215}
216
217static void put_ep (struct ep_data *data)
218{
219 if (likely (!atomic_dec_and_test (&data->count)))
220 return;
221 put_dev (data->dev);
222 /* needs no more cleanup */
223 BUG_ON (!list_empty (&data->epfiles));
224 BUG_ON (waitqueue_active (&data->wait));
225 BUG_ON (down_trylock (&data->lock) != 0);
226 kfree (data);
227}
228
229/*----------------------------------------------------------------------*/
230
231/* most "how to use the hardware" policy choices are in userspace:
232 * mapping endpoint roles (which the driver needs) to the capabilities
233 * which the usb controller has. most of those capabilities are exposed
234 * implicitly, starting with the driver name and then endpoint names.
235 */
236
237static const char *CHIP;
238
239/*----------------------------------------------------------------------*/
240
241/* NOTE: don't use dev_printk calls before binding to the gadget
242 * at the end of ep0 configuration, or after unbind.
243 */
244
245/* too wordy: dev_printk(level , &(d)->gadget->dev , fmt , ## args) */
246#define xprintk(d,level,fmt,args...) \
247 printk(level "%s: " fmt , shortname , ## args)
248
249#ifdef DEBUG
250#define DBG(dev,fmt,args...) \
251 xprintk(dev , KERN_DEBUG , fmt , ## args)
252#else
253#define DBG(dev,fmt,args...) \
254 do { } while (0)
255#endif /* DEBUG */
256
257#ifdef VERBOSE
258#define VDEBUG DBG
259#else
260#define VDEBUG(dev,fmt,args...) \
261 do { } while (0)
262#endif /* DEBUG */
263
264#define ERROR(dev,fmt,args...) \
265 xprintk(dev , KERN_ERR , fmt , ## args)
266#define WARN(dev,fmt,args...) \
267 xprintk(dev , KERN_WARNING , fmt , ## args)
268#define INFO(dev,fmt,args...) \
269 xprintk(dev , KERN_INFO , fmt , ## args)
270
271
272/*----------------------------------------------------------------------*/
273
274/* SYNCHRONOUS ENDPOINT OPERATIONS (bulk/intr/iso)
275 *
276 * After opening, configure non-control endpoints. Then use normal
277 * stream read() and write() requests; and maybe ioctl() to get more
278 * precise FIFO status when recovering from cancelation.
279 */
280
281static void epio_complete (struct usb_ep *ep, struct usb_request *req)
282{
283 struct ep_data *epdata = ep->driver_data;
284
285 if (!req->context)
286 return;
287 if (req->status)
288 epdata->status = req->status;
289 else
290 epdata->status = req->actual;
291 complete ((struct completion *)req->context);
292}
293
294/* tasklock endpoint, returning when it's connected.
295 * still need dev->lock to use epdata->ep.
296 */
297static int
298get_ready_ep (unsigned f_flags, struct ep_data *epdata)
299{
300 int val;
301
302 if (f_flags & O_NONBLOCK) {
303 if (down_trylock (&epdata->lock) != 0)
304 goto nonblock;
305 if (epdata->state != STATE_EP_ENABLED) {
306 up (&epdata->lock);
307nonblock:
308 val = -EAGAIN;
309 } else
310 val = 0;
311 return val;
312 }
313
314 if ((val = down_interruptible (&epdata->lock)) < 0)
315 return val;
316newstate:
317 switch (epdata->state) {
318 case STATE_EP_ENABLED:
319 break;
320 case STATE_EP_DEFER_ENABLE:
321 DBG (epdata->dev, "%s wait for host\n", epdata->name);
322 if ((val = wait_event_interruptible (epdata->wait,
323 epdata->state != STATE_EP_DEFER_ENABLE
324 || epdata->dev->state == STATE_DEV_UNBOUND
325 )) < 0)
326 goto fail;
327 goto newstate;
328 // case STATE_EP_DISABLED: /* "can't happen" */
329 // case STATE_EP_READY: /* "can't happen" */
330 default: /* error! */
331 pr_debug ("%s: ep %p not available, state %d\n",
332 shortname, epdata, epdata->state);
333 // FALLTHROUGH
334 case STATE_EP_UNBOUND: /* clean disconnect */
335 val = -ENODEV;
336fail:
337 up (&epdata->lock);
338 }
339 return val;
340}
341
342static ssize_t
343ep_io (struct ep_data *epdata, void *buf, unsigned len)
344{
345 DECLARE_COMPLETION (done);
346 int value;
347
348 spin_lock_irq (&epdata->dev->lock);
349 if (likely (epdata->ep != NULL)) {
350 struct usb_request *req = epdata->req;
351
352 req->context = &done;
353 req->complete = epio_complete;
354 req->buf = buf;
355 req->length = len;
356 value = usb_ep_queue (epdata->ep, req, GFP_ATOMIC);
357 } else
358 value = -ENODEV;
359 spin_unlock_irq (&epdata->dev->lock);
360
361 if (likely (value == 0)) {
362 value = wait_event_interruptible (done.wait, done.done);
363 if (value != 0) {
364 spin_lock_irq (&epdata->dev->lock);
365 if (likely (epdata->ep != NULL)) {
366 DBG (epdata->dev, "%s i/o interrupted\n",
367 epdata->name);
368 usb_ep_dequeue (epdata->ep, epdata->req);
369 spin_unlock_irq (&epdata->dev->lock);
370
371 wait_event (done.wait, done.done);
372 if (epdata->status == -ECONNRESET)
373 epdata->status = -EINTR;
374 } else {
375 spin_unlock_irq (&epdata->dev->lock);
376
377 DBG (epdata->dev, "endpoint gone\n");
378 epdata->status = -ENODEV;
379 }
380 }
381 return epdata->status;
382 }
383 return value;
384}
385
386
387/* handle a synchronous OUT bulk/intr/iso transfer */
388static ssize_t
389ep_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
390{
391 struct ep_data *data = fd->private_data;
392 void *kbuf;
393 ssize_t value;
394
395 if ((value = get_ready_ep (fd->f_flags, data)) < 0)
396 return value;
397
398 /* halt any endpoint by doing a "wrong direction" i/o call */
399 if (data->desc.bEndpointAddress & USB_DIR_IN) {
400 if ((data->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
401 == USB_ENDPOINT_XFER_ISOC)
402 return -EINVAL;
403 DBG (data->dev, "%s halt\n", data->name);
404 spin_lock_irq (&data->dev->lock);
405 if (likely (data->ep != NULL))
406 usb_ep_set_halt (data->ep);
407 spin_unlock_irq (&data->dev->lock);
408 up (&data->lock);
409 return -EBADMSG;
410 }
411
412 /* FIXME readahead for O_NONBLOCK and poll(); careful with ZLPs */
413
414 value = -ENOMEM;
415 kbuf = kmalloc (len, SLAB_KERNEL);
416 if (unlikely (!kbuf))
417 goto free1;
418
419 value = ep_io (data, kbuf, len);
420 VDEBUG (data->dev, "%s read %d OUT, status %d\n",
421 data->name, len, value);
422 if (value >= 0 && copy_to_user (buf, kbuf, value))
423 value = -EFAULT;
424
425free1:
426 up (&data->lock);
427 kfree (kbuf);
428 return value;
429}
430
431/* handle a synchronous IN bulk/intr/iso transfer */
432static ssize_t
433ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
434{
435 struct ep_data *data = fd->private_data;
436 void *kbuf;
437 ssize_t value;
438
439 if ((value = get_ready_ep (fd->f_flags, data)) < 0)
440 return value;
441
442 /* halt any endpoint by doing a "wrong direction" i/o call */
443 if (!(data->desc.bEndpointAddress & USB_DIR_IN)) {
444 if ((data->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
445 == USB_ENDPOINT_XFER_ISOC)
446 return -EINVAL;
447 DBG (data->dev, "%s halt\n", data->name);
448 spin_lock_irq (&data->dev->lock);
449 if (likely (data->ep != NULL))
450 usb_ep_set_halt (data->ep);
451 spin_unlock_irq (&data->dev->lock);
452 up (&data->lock);
453 return -EBADMSG;
454 }
455
456 /* FIXME writebehind for O_NONBLOCK and poll(), qlen = 1 */
457
458 value = -ENOMEM;
459 kbuf = kmalloc (len, SLAB_KERNEL);
460 if (!kbuf)
461 goto free1;
462 if (copy_from_user (kbuf, buf, len)) {
463 value = -EFAULT;
464 goto free1;
465 }
466
467 value = ep_io (data, kbuf, len);
468 VDEBUG (data->dev, "%s write %d IN, status %d\n",
469 data->name, len, value);
470free1:
471 up (&data->lock);
472 kfree (kbuf);
473 return value;
474}
475
476static int
477ep_release (struct inode *inode, struct file *fd)
478{
479 struct ep_data *data = fd->private_data;
480
481 /* clean up if this can be reopened */
482 if (data->state != STATE_EP_UNBOUND) {
483 data->state = STATE_EP_DISABLED;
484 data->desc.bDescriptorType = 0;
485 data->hs_desc.bDescriptorType = 0;
486 }
487 put_ep (data);
488 return 0;
489}
490
491static int ep_ioctl (struct inode *inode, struct file *fd,
492 unsigned code, unsigned long value)
493{
494 struct ep_data *data = fd->private_data;
495 int status;
496
497 if ((status = get_ready_ep (fd->f_flags, data)) < 0)
498 return status;
499
500 spin_lock_irq (&data->dev->lock);
501 if (likely (data->ep != NULL)) {
502 switch (code) {
503 case GADGETFS_FIFO_STATUS:
504 status = usb_ep_fifo_status (data->ep);
505 break;
506 case GADGETFS_FIFO_FLUSH:
507 usb_ep_fifo_flush (data->ep);
508 break;
509 case GADGETFS_CLEAR_HALT:
510 status = usb_ep_clear_halt (data->ep);
511 break;
512 default:
513 status = -ENOTTY;
514 }
515 } else
516 status = -ENODEV;
517 spin_unlock_irq (&data->dev->lock);
518 up (&data->lock);
519 return status;
520}
521
522/*----------------------------------------------------------------------*/
523
524/* ASYNCHRONOUS ENDPOINT I/O OPERATIONS (bulk/intr/iso) */
525
526struct kiocb_priv {
527 struct usb_request *req;
528 struct ep_data *epdata;
529 void *buf;
530 char __user *ubuf;
531 unsigned actual;
532};
533
534static int ep_aio_cancel(struct kiocb *iocb, struct io_event *e)
535{
536 struct kiocb_priv *priv = iocb->private;
537 struct ep_data *epdata;
538 int value;
539
540 local_irq_disable();
541 epdata = priv->epdata;
542 // spin_lock(&epdata->dev->lock);
543 kiocbSetCancelled(iocb);
544 if (likely(epdata && epdata->ep && priv->req))
545 value = usb_ep_dequeue (epdata->ep, priv->req);
546 else
547 value = -EINVAL;
548 // spin_unlock(&epdata->dev->lock);
549 local_irq_enable();
550
551 aio_put_req(iocb);
552 return value;
553}
554
555static ssize_t ep_aio_read_retry(struct kiocb *iocb)
556{
557 struct kiocb_priv *priv = iocb->private;
558 ssize_t status = priv->actual;
559
560 /* we "retry" to get the right mm context for this: */
561 status = copy_to_user(priv->ubuf, priv->buf, priv->actual);
562 if (unlikely(0 != status))
563 status = -EFAULT;
564 else
565 status = priv->actual;
566 kfree(priv->buf);
567 kfree(priv);
568 aio_put_req(iocb);
569 return status;
570}
571
572static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
573{
574 struct kiocb *iocb = req->context;
575 struct kiocb_priv *priv = iocb->private;
576 struct ep_data *epdata = priv->epdata;
577
578 /* lock against disconnect (and ideally, cancel) */
579 spin_lock(&epdata->dev->lock);
580 priv->req = NULL;
581 priv->epdata = NULL;
582 if (NULL == iocb->ki_retry
583 || unlikely(0 == req->actual)
584 || unlikely(kiocbIsCancelled(iocb))) {
585 kfree(req->buf);
586 kfree(priv);
587 iocb->private = NULL;
588 /* aio_complete() reports bytes-transferred _and_ faults */
589 if (unlikely(kiocbIsCancelled(iocb)))
590 aio_put_req(iocb);
591 else
592 aio_complete(iocb,
593 req->actual ? req->actual : req->status,
594 req->status);
595 } else {
596 /* retry() won't report both; so we hide some faults */
597 if (unlikely(0 != req->status))
598 DBG(epdata->dev, "%s fault %d len %d\n",
599 ep->name, req->status, req->actual);
600
601 priv->buf = req->buf;
602 priv->actual = req->actual;
603 kick_iocb(iocb);
604 }
605 spin_unlock(&epdata->dev->lock);
606
607 usb_ep_free_request(ep, req);
608 put_ep(epdata);
609}
610
611static ssize_t
612ep_aio_rwtail(
613 struct kiocb *iocb,
614 char *buf,
615 size_t len,
616 struct ep_data *epdata,
617 char __user *ubuf
618)
619{
620 struct kiocb_priv *priv = (void *) &iocb->private;
621 struct usb_request *req;
622 ssize_t value;
623
624 priv = kmalloc(sizeof *priv, GFP_KERNEL);
625 if (!priv) {
626 value = -ENOMEM;
627fail:
628 kfree(buf);
629 return value;
630 }
631 iocb->private = priv;
632 priv->ubuf = ubuf;
633
634 value = get_ready_ep(iocb->ki_filp->f_flags, epdata);
635 if (unlikely(value < 0)) {
636 kfree(priv);
637 goto fail;
638 }
639
640 iocb->ki_cancel = ep_aio_cancel;
641 get_ep(epdata);
642 priv->epdata = epdata;
643 priv->actual = 0;
644
645 /* each kiocb is coupled to one usb_request, but we can't
646 * allocate or submit those if the host disconnected.
647 */
648 spin_lock_irq(&epdata->dev->lock);
649 if (likely(epdata->ep)) {
650 req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
651 if (likely(req)) {
652 priv->req = req;
653 req->buf = buf;
654 req->length = len;
655 req->complete = ep_aio_complete;
656 req->context = iocb;
657 value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC);
658 if (unlikely(0 != value))
659 usb_ep_free_request(epdata->ep, req);
660 } else
661 value = -EAGAIN;
662 } else
663 value = -ENODEV;
664 spin_unlock_irq(&epdata->dev->lock);
665
666 up(&epdata->lock);
667
668 if (unlikely(value)) {
669 kfree(priv);
670 put_ep(epdata);
671 } else
672 value = -EIOCBQUEUED;
673 return value;
674}
675
676static ssize_t
677ep_aio_read(struct kiocb *iocb, char __user *ubuf, size_t len, loff_t o)
678{
679 struct ep_data *epdata = iocb->ki_filp->private_data;
680 char *buf;
681
682 if (unlikely(epdata->desc.bEndpointAddress & USB_DIR_IN))
683 return -EINVAL;
684 buf = kmalloc(len, GFP_KERNEL);
685 if (unlikely(!buf))
686 return -ENOMEM;
687 iocb->ki_retry = ep_aio_read_retry;
688 return ep_aio_rwtail(iocb, buf, len, epdata, ubuf);
689}
690
691static ssize_t
692ep_aio_write(struct kiocb *iocb, const char __user *ubuf, size_t len, loff_t o)
693{
694 struct ep_data *epdata = iocb->ki_filp->private_data;
695 char *buf;
696
697 if (unlikely(!(epdata->desc.bEndpointAddress & USB_DIR_IN)))
698 return -EINVAL;
699 buf = kmalloc(len, GFP_KERNEL);
700 if (unlikely(!buf))
701 return -ENOMEM;
702 if (unlikely(copy_from_user(buf, ubuf, len) != 0)) {
703 kfree(buf);
704 return -EFAULT;
705 }
706 return ep_aio_rwtail(iocb, buf, len, epdata, NULL);
707}
708
709/*----------------------------------------------------------------------*/
710
711/* used after endpoint configuration */
712static struct file_operations ep_io_operations = {
713 .owner = THIS_MODULE,
714 .llseek = no_llseek,
715
716 .read = ep_read,
717 .write = ep_write,
718 .ioctl = ep_ioctl,
719 .release = ep_release,
720
721 .aio_read = ep_aio_read,
722 .aio_write = ep_aio_write,
723};
724
725/* ENDPOINT INITIALIZATION
726 *
727 * fd = open ("/dev/gadget/$ENDPOINT", O_RDWR)
728 * status = write (fd, descriptors, sizeof descriptors)
729 *
730 * That write establishes the endpoint configuration, configuring
731 * the controller to process bulk, interrupt, or isochronous transfers
732 * at the right maxpacket size, and so on.
733 *
734 * The descriptors are message type 1, identified by a host order u32
735 * at the beginning of what's written. Descriptor order is: full/low
736 * speed descriptor, then optional high speed descriptor.
737 */
738static ssize_t
739ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
740{
741 struct ep_data *data = fd->private_data;
742 struct usb_ep *ep;
743 u32 tag;
744 int value;
745
746 if ((value = down_interruptible (&data->lock)) < 0)
747 return value;
748
749 if (data->state != STATE_EP_READY) {
750 value = -EL2HLT;
751 goto fail;
752 }
753
754 value = len;
755 if (len < USB_DT_ENDPOINT_SIZE + 4)
756 goto fail0;
757
758 /* we might need to change message format someday */
759 if (copy_from_user (&tag, buf, 4)) {
760 goto fail1;
761 }
762 if (tag != 1) {
763 DBG(data->dev, "config %s, bad tag %d\n", data->name, tag);
764 goto fail0;
765 }
766 buf += 4;
767 len -= 4;
768
769 /* NOTE: audio endpoint extensions not accepted here;
770 * just don't include the extra bytes.
771 */
772
773 /* full/low speed descriptor, then high speed */
774 if (copy_from_user (&data->desc, buf, USB_DT_ENDPOINT_SIZE)) {
775 goto fail1;
776 }
777 if (data->desc.bLength != USB_DT_ENDPOINT_SIZE
778 || data->desc.bDescriptorType != USB_DT_ENDPOINT)
779 goto fail0;
780 if (len != USB_DT_ENDPOINT_SIZE) {
781 if (len != 2 * USB_DT_ENDPOINT_SIZE)
782 goto fail0;
783 if (copy_from_user (&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE,
784 USB_DT_ENDPOINT_SIZE)) {
785 goto fail1;
786 }
787 if (data->hs_desc.bLength != USB_DT_ENDPOINT_SIZE
788 || data->hs_desc.bDescriptorType
789 != USB_DT_ENDPOINT) {
790 DBG(data->dev, "config %s, bad hs length or type\n",
791 data->name);
792 goto fail0;
793 }
794 }
795 value = len;
796
797 spin_lock_irq (&data->dev->lock);
798 if (data->dev->state == STATE_DEV_UNBOUND) {
799 value = -ENOENT;
800 goto gone;
801 } else if ((ep = data->ep) == NULL) {
802 value = -ENODEV;
803 goto gone;
804 }
805 switch (data->dev->gadget->speed) {
806 case USB_SPEED_LOW:
807 case USB_SPEED_FULL:
808 value = usb_ep_enable (ep, &data->desc);
809 if (value == 0)
810 data->state = STATE_EP_ENABLED;
811 break;
812#ifdef HIGHSPEED
813 case USB_SPEED_HIGH:
814 /* fails if caller didn't provide that descriptor... */
815 value = usb_ep_enable (ep, &data->hs_desc);
816 if (value == 0)
817 data->state = STATE_EP_ENABLED;
818 break;
819#endif
820 default:
821 DBG (data->dev, "unconnected, %s init deferred\n",
822 data->name);
823 data->state = STATE_EP_DEFER_ENABLE;
824 }
825 if (value == 0)
826 fd->f_op = &ep_io_operations;
827gone:
828 spin_unlock_irq (&data->dev->lock);
829 if (value < 0) {
830fail:
831 data->desc.bDescriptorType = 0;
832 data->hs_desc.bDescriptorType = 0;
833 }
834 up (&data->lock);
835 return value;
836fail0:
837 value = -EINVAL;
838 goto fail;
839fail1:
840 value = -EFAULT;
841 goto fail;
842}
843
844static int
845ep_open (struct inode *inode, struct file *fd)
846{
847 struct ep_data *data = inode->u.generic_ip;
848 int value = -EBUSY;
849
850 if (down_interruptible (&data->lock) != 0)
851 return -EINTR;
852 spin_lock_irq (&data->dev->lock);
853 if (data->dev->state == STATE_DEV_UNBOUND)
854 value = -ENOENT;
855 else if (data->state == STATE_EP_DISABLED) {
856 value = 0;
857 data->state = STATE_EP_READY;
858 get_ep (data);
859 fd->private_data = data;
860 VDEBUG (data->dev, "%s ready\n", data->name);
861 } else
862 DBG (data->dev, "%s state %d\n",
863 data->name, data->state);
864 spin_unlock_irq (&data->dev->lock);
865 up (&data->lock);
866 return value;
867}
868
869/* used before endpoint configuration */
870static struct file_operations ep_config_operations = {
871 .owner = THIS_MODULE,
872 .llseek = no_llseek,
873
874 .open = ep_open,
875 .write = ep_config,
876 .release = ep_release,
877};
878
879/*----------------------------------------------------------------------*/
880
881/* EP0 IMPLEMENTATION can be partly in userspace.
882 *
883 * Drivers that use this facility receive various events, including
884 * control requests the kernel doesn't handle. Drivers that don't
885 * use this facility may be too simple-minded for real applications.
886 */
887
888static inline void ep0_readable (struct dev_data *dev)
889{
890 wake_up (&dev->wait);
891 kill_fasync (&dev->fasync, SIGIO, POLL_IN);
892}
893
894static void clean_req (struct usb_ep *ep, struct usb_request *req)
895{
896 struct dev_data *dev = ep->driver_data;
897
898 if (req->buf != dev->rbuf) {
899 usb_ep_free_buffer (ep, req->buf, req->dma, req->length);
900 req->buf = dev->rbuf;
901 req->dma = DMA_ADDR_INVALID;
902 }
903 req->complete = epio_complete;
904 dev->setup_out_ready = 0;
905}
906
907static void ep0_complete (struct usb_ep *ep, struct usb_request *req)
908{
909 struct dev_data *dev = ep->driver_data;
910 int free = 1;
911
912 /* for control OUT, data must still get to userspace */
913 if (!dev->setup_in) {
914 dev->setup_out_error = (req->status != 0);
915 if (!dev->setup_out_error)
916 free = 0;
917 dev->setup_out_ready = 1;
918 ep0_readable (dev);
919 } else if (dev->state == STATE_SETUP)
920 dev->state = STATE_CONNECTED;
921
922 /* clean up as appropriate */
923 if (free && req->buf != &dev->rbuf)
924 clean_req (ep, req);
925 req->complete = epio_complete;
926}
927
928static int setup_req (struct usb_ep *ep, struct usb_request *req, u16 len)
929{
930 struct dev_data *dev = ep->driver_data;
931
932 if (dev->setup_out_ready) {
933 DBG (dev, "ep0 request busy!\n");
934 return -EBUSY;
935 }
936 if (len > sizeof (dev->rbuf))
937 req->buf = usb_ep_alloc_buffer (ep, len, &req->dma, GFP_ATOMIC);
938 if (req->buf == 0) {
939 req->buf = dev->rbuf;
940 return -ENOMEM;
941 }
942 req->complete = ep0_complete;
943 req->length = len;
944 return 0;
945}
946
947static ssize_t
948ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
949{
950 struct dev_data *dev = fd->private_data;
951 ssize_t retval;
952 enum ep0_state state;
953
954 spin_lock_irq (&dev->lock);
955
956 /* report fd mode change before acting on it */
957 if (dev->setup_abort) {
958 dev->setup_abort = 0;
959 retval = -EIDRM;
960 goto done;
961 }
962
963 /* control DATA stage */
964 if ((state = dev->state) == STATE_SETUP) {
965
966 if (dev->setup_in) { /* stall IN */
967 VDEBUG(dev, "ep0in stall\n");
968 (void) usb_ep_set_halt (dev->gadget->ep0);
969 retval = -EL2HLT;
970 dev->state = STATE_CONNECTED;
971
972 } else if (len == 0) { /* ack SET_CONFIGURATION etc */
973 struct usb_ep *ep = dev->gadget->ep0;
974 struct usb_request *req = dev->req;
975
976 if ((retval = setup_req (ep, req, 0)) == 0)
977 retval = usb_ep_queue (ep, req, GFP_ATOMIC);
978 dev->state = STATE_CONNECTED;
979
980 /* assume that was SET_CONFIGURATION */
981 if (dev->current_config) {
982 unsigned power;
983#ifdef HIGHSPEED
984 if (dev->gadget->speed == USB_SPEED_HIGH)
985 power = dev->hs_config->bMaxPower;
986 else
987#endif
988 power = dev->config->bMaxPower;
989 usb_gadget_vbus_draw(dev->gadget, 2 * power);
990 }
991
992 } else { /* collect OUT data */
993 if ((fd->f_flags & O_NONBLOCK) != 0
994 && !dev->setup_out_ready) {
995 retval = -EAGAIN;
996 goto done;
997 }
998 spin_unlock_irq (&dev->lock);
999 retval = wait_event_interruptible (dev->wait,
1000 dev->setup_out_ready != 0);
1001
1002 /* FIXME state could change from under us */
1003 spin_lock_irq (&dev->lock);
1004 if (retval)
1005 goto done;
1006 if (dev->setup_out_error)
1007 retval = -EIO;
1008 else {
1009 len = min (len, (size_t)dev->req->actual);
1010// FIXME don't call this with the spinlock held ...
1011 if (copy_to_user (buf, &dev->req->buf, len))
1012 retval = -EFAULT;
1013 clean_req (dev->gadget->ep0, dev->req);
1014 /* NOTE userspace can't yet choose to stall */
1015 }
1016 }
1017 goto done;
1018 }
1019
1020 /* else normal: return event data */
1021 if (len < sizeof dev->event [0]) {
1022 retval = -EINVAL;
1023 goto done;
1024 }
1025 len -= len % sizeof (struct usb_gadgetfs_event);
1026 dev->usermode_setup = 1;
1027
1028scan:
1029 /* return queued events right away */
1030 if (dev->ev_next != 0) {
1031 unsigned i, n;
1032 int tmp = dev->ev_next;
1033
1034 len = min (len, tmp * sizeof (struct usb_gadgetfs_event));
1035 n = len / sizeof (struct usb_gadgetfs_event);
1036
1037 /* ep0 can't deliver events when STATE_SETUP */
1038 for (i = 0; i < n; i++) {
1039 if (dev->event [i].type == GADGETFS_SETUP) {
1040 len = n = i + 1;
1041 len *= sizeof (struct usb_gadgetfs_event);
1042 n = 0;
1043 break;
1044 }
1045 }
1046 spin_unlock_irq (&dev->lock);
1047 if (copy_to_user (buf, &dev->event, len))
1048 retval = -EFAULT;
1049 else
1050 retval = len;
1051 if (len > 0) {
1052 len /= sizeof (struct usb_gadgetfs_event);
1053
1054 /* NOTE this doesn't guard against broken drivers;
1055 * concurrent ep0 readers may lose events.
1056 */
1057 spin_lock_irq (&dev->lock);
1058 dev->ev_next -= len;
1059 if (dev->ev_next != 0)
1060 memmove (&dev->event, &dev->event [len],
1061 sizeof (struct usb_gadgetfs_event)
1062 * (tmp - len));
1063 if (n == 0)
1064 dev->state = STATE_SETUP;
1065 spin_unlock_irq (&dev->lock);
1066 }
1067 return retval;
1068 }
1069 if (fd->f_flags & O_NONBLOCK) {
1070 retval = -EAGAIN;
1071 goto done;
1072 }
1073
1074 switch (state) {
1075 default:
1076 DBG (dev, "fail %s, state %d\n", __FUNCTION__, state);
1077 retval = -ESRCH;
1078 break;
1079 case STATE_UNCONNECTED:
1080 case STATE_CONNECTED:
1081 spin_unlock_irq (&dev->lock);
1082 DBG (dev, "%s wait\n", __FUNCTION__);
1083
1084 /* wait for events */
1085 retval = wait_event_interruptible (dev->wait,
1086 dev->ev_next != 0);
1087 if (retval < 0)
1088 return retval;
1089 spin_lock_irq (&dev->lock);
1090 goto scan;
1091 }
1092
1093done:
1094 spin_unlock_irq (&dev->lock);
1095 return retval;
1096}
1097
1098static struct usb_gadgetfs_event *
1099next_event (struct dev_data *dev, enum usb_gadgetfs_event_type type)
1100{
1101 struct usb_gadgetfs_event *event;
1102 unsigned i;
1103
1104 switch (type) {
1105 /* these events purge the queue */
1106 case GADGETFS_DISCONNECT:
1107 if (dev->state == STATE_SETUP)
1108 dev->setup_abort = 1;
1109 // FALL THROUGH
1110 case GADGETFS_CONNECT:
1111 dev->ev_next = 0;
1112 break;
1113 case GADGETFS_SETUP: /* previous request timed out */
1114 case GADGETFS_SUSPEND: /* same effect */
1115 /* these events can't be repeated */
1116 for (i = 0; i != dev->ev_next; i++) {
1117 if (dev->event [i].type != type)
1118 continue;
1119 DBG (dev, "discard old event %d\n", type);
1120 dev->ev_next--;
1121 if (i == dev->ev_next)
1122 break;
1123 /* indices start at zero, for simplicity */
1124 memmove (&dev->event [i], &dev->event [i + 1],
1125 sizeof (struct usb_gadgetfs_event)
1126 * (dev->ev_next - i));
1127 }
1128 break;
1129 default:
1130 BUG ();
1131 }
1132 event = &dev->event [dev->ev_next++];
1133 BUG_ON (dev->ev_next > N_EVENT);
1134 VDEBUG (dev, "ev %d, next %d\n", type, dev->ev_next);
1135 memset (event, 0, sizeof *event);
1136 event->type = type;
1137 return event;
1138}
1139
1140static ssize_t
1141ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
1142{
1143 struct dev_data *dev = fd->private_data;
1144 ssize_t retval = -ESRCH;
1145
1146 spin_lock_irq (&dev->lock);
1147
1148 /* report fd mode change before acting on it */
1149 if (dev->setup_abort) {
1150 dev->setup_abort = 0;
1151 retval = -EIDRM;
1152
1153 /* data and/or status stage for control request */
1154 } else if (dev->state == STATE_SETUP) {
1155
1156 /* IN DATA+STATUS caller makes len <= wLength */
1157 if (dev->setup_in) {
1158 retval = setup_req (dev->gadget->ep0, dev->req, len);
1159 if (retval == 0) {
1160 spin_unlock_irq (&dev->lock);
1161 if (copy_from_user (dev->req->buf, buf, len))
1162 retval = -EFAULT;
1163 else
1164 retval = usb_ep_queue (
1165 dev->gadget->ep0, dev->req,
1166 GFP_KERNEL);
1167 if (retval < 0) {
1168 spin_lock_irq (&dev->lock);
1169 clean_req (dev->gadget->ep0, dev->req);
1170 spin_unlock_irq (&dev->lock);
1171 } else
1172 retval = len;
1173
1174 return retval;
1175 }
1176
1177 /* can stall some OUT transfers */
1178 } else if (dev->setup_can_stall) {
1179 VDEBUG(dev, "ep0out stall\n");
1180 (void) usb_ep_set_halt (dev->gadget->ep0);
1181 retval = -EL2HLT;
1182 dev->state = STATE_CONNECTED;
1183 } else {
1184 DBG(dev, "bogus ep0out stall!\n");
1185 }
1186 } else
1187 DBG (dev, "fail %s, state %d\n", __FUNCTION__, dev->state);
1188
1189 spin_unlock_irq (&dev->lock);
1190 return retval;
1191}
1192
1193static int
1194ep0_fasync (int f, struct file *fd, int on)
1195{
1196 struct dev_data *dev = fd->private_data;
1197 // caller must F_SETOWN before signal delivery happens
1198 VDEBUG (dev, "%s %s\n", __FUNCTION__, on ? "on" : "off");
1199 return fasync_helper (f, fd, on, &dev->fasync);
1200}
1201
1202static struct usb_gadget_driver gadgetfs_driver;
1203
1204static int
1205dev_release (struct inode *inode, struct file *fd)
1206{
1207 struct dev_data *dev = fd->private_data;
1208
1209 /* closing ep0 === shutdown all */
1210
1211 usb_gadget_unregister_driver (&gadgetfs_driver);
1212
1213 /* at this point "good" hardware has disconnected the
1214 * device from USB; the host won't see it any more.
1215 * alternatively, all host requests will time out.
1216 */
1217
1218 fasync_helper (-1, fd, 0, &dev->fasync);
1219 kfree (dev->buf);
1220 dev->buf = NULL;
1221 put_dev (dev);
1222
1223 /* other endpoints were all decoupled from this device */
1224 dev->state = STATE_DEV_DISABLED;
1225 return 0;
1226}
1227
1228static int dev_ioctl (struct inode *inode, struct file *fd,
1229 unsigned code, unsigned long value)
1230{
1231 struct dev_data *dev = fd->private_data;
1232 struct usb_gadget *gadget = dev->gadget;
1233
1234 if (gadget->ops->ioctl)
1235 return gadget->ops->ioctl (gadget, code, value);
1236 return -ENOTTY;
1237}
1238
1239/* used after device configuration */
1240static struct file_operations ep0_io_operations = {
1241 .owner = THIS_MODULE,
1242 .llseek = no_llseek,
1243
1244 .read = ep0_read,
1245 .write = ep0_write,
1246 .fasync = ep0_fasync,
1247 // .poll = ep0_poll,
1248 .ioctl = dev_ioctl,
1249 .release = dev_release,
1250};
1251
1252/*----------------------------------------------------------------------*/
1253
1254/* The in-kernel gadget driver handles most ep0 issues, in particular
1255 * enumerating the single configuration (as provided from user space).
1256 *
1257 * Unrecognized ep0 requests may be handled in user space.
1258 */
1259
1260#ifdef HIGHSPEED
1261static void make_qualifier (struct dev_data *dev)
1262{
1263 struct usb_qualifier_descriptor qual;
1264 struct usb_device_descriptor *desc;
1265
1266 qual.bLength = sizeof qual;
1267 qual.bDescriptorType = USB_DT_DEVICE_QUALIFIER;
1268 qual.bcdUSB = __constant_cpu_to_le16 (0x0200);
1269
1270 desc = dev->dev;
1271 qual.bDeviceClass = desc->bDeviceClass;
1272 qual.bDeviceSubClass = desc->bDeviceSubClass;
1273 qual.bDeviceProtocol = desc->bDeviceProtocol;
1274
1275 /* assumes ep0 uses the same value for both speeds ... */
1276 qual.bMaxPacketSize0 = desc->bMaxPacketSize0;
1277
1278 qual.bNumConfigurations = 1;
1279 qual.bRESERVED = 0;
1280
1281 memcpy (dev->rbuf, &qual, sizeof qual);
1282}
1283#endif
1284
1285static int
1286config_buf (struct dev_data *dev, u8 type, unsigned index)
1287{
1288 int len;
1289#ifdef HIGHSPEED
1290 int hs;
1291#endif
1292
1293 /* only one configuration */
1294 if (index > 0)
1295 return -EINVAL;
1296
1297#ifdef HIGHSPEED
1298 hs = (dev->gadget->speed == USB_SPEED_HIGH);
1299 if (type == USB_DT_OTHER_SPEED_CONFIG)
1300 hs = !hs;
1301 if (hs) {
1302 dev->req->buf = dev->hs_config;
1303 len = le16_to_cpup (&dev->hs_config->wTotalLength);
1304 } else
1305#endif
1306 {
1307 dev->req->buf = dev->config;
1308 len = le16_to_cpup (&dev->config->wTotalLength);
1309 }
1310 ((u8 *)dev->req->buf) [1] = type;
1311 return len;
1312}
1313
1314static int
1315gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
1316{
1317 struct dev_data *dev = get_gadget_data (gadget);
1318 struct usb_request *req = dev->req;
1319 int value = -EOPNOTSUPP;
1320 struct usb_gadgetfs_event *event;
1321 u16 w_value = ctrl->wValue;
1322 u16 w_length = ctrl->wLength;
1323
1324 spin_lock (&dev->lock);
1325 dev->setup_abort = 0;
1326 if (dev->state == STATE_UNCONNECTED) {
1327 struct usb_ep *ep;
1328 struct ep_data *data;
1329
1330 dev->state = STATE_CONNECTED;
1331 dev->dev->bMaxPacketSize0 = gadget->ep0->maxpacket;
1332
1333#ifdef HIGHSPEED
1334 if (gadget->speed == USB_SPEED_HIGH && dev->hs_config == 0) {
1335 ERROR (dev, "no high speed config??\n");
1336 return -EINVAL;
1337 }
1338#endif /* HIGHSPEED */
1339
1340 INFO (dev, "connected\n");
1341 event = next_event (dev, GADGETFS_CONNECT);
1342 event->u.speed = gadget->speed;
1343 ep0_readable (dev);
1344
1345 list_for_each_entry (ep, &gadget->ep_list, ep_list) {
1346 data = ep->driver_data;
1347 /* ... down_trylock (&data->lock) ... */
1348 if (data->state != STATE_EP_DEFER_ENABLE)
1349 continue;
1350#ifdef HIGHSPEED
1351 if (gadget->speed == USB_SPEED_HIGH)
1352 value = usb_ep_enable (ep, &data->hs_desc);
1353 else
1354#endif /* HIGHSPEED */
1355 value = usb_ep_enable (ep, &data->desc);
1356 if (value) {
1357 ERROR (dev, "deferred %s enable --> %d\n",
1358 data->name, value);
1359 continue;
1360 }
1361 data->state = STATE_EP_ENABLED;
1362 wake_up (&data->wait);
1363 DBG (dev, "woke up %s waiters\n", data->name);
1364 }
1365
1366 /* host may have given up waiting for response. we can miss control
1367 * requests handled lower down (device/endpoint status and features);
1368 * then ep0_{read,write} will report the wrong status. controller
1369 * driver will have aborted pending i/o.
1370 */
1371 } else if (dev->state == STATE_SETUP)
1372 dev->setup_abort = 1;
1373
1374 req->buf = dev->rbuf;
1375 req->dma = DMA_ADDR_INVALID;
1376 req->context = NULL;
1377 value = -EOPNOTSUPP;
1378 switch (ctrl->bRequest) {
1379
1380 case USB_REQ_GET_DESCRIPTOR:
1381 if (ctrl->bRequestType != USB_DIR_IN)
1382 goto unrecognized;
1383 switch (w_value >> 8) {
1384
1385 case USB_DT_DEVICE:
1386 value = min (w_length, (u16) sizeof *dev->dev);
1387 req->buf = dev->dev;
1388 break;
1389#ifdef HIGHSPEED
1390 case USB_DT_DEVICE_QUALIFIER:
1391 if (!dev->hs_config)
1392 break;
1393 value = min (w_length, (u16)
1394 sizeof (struct usb_qualifier_descriptor));
1395 make_qualifier (dev);
1396 break;
1397 case USB_DT_OTHER_SPEED_CONFIG:
1398 // FALLTHROUGH
1399#endif
1400 case USB_DT_CONFIG:
1401 value = config_buf (dev,
1402 w_value >> 8,
1403 w_value & 0xff);
1404 if (value >= 0)
1405 value = min (w_length, (u16) value);
1406 break;
1407 case USB_DT_STRING:
1408 goto unrecognized;
1409
1410 default: // all others are errors
1411 break;
1412 }
1413 break;
1414
1415 /* currently one config, two speeds */
1416 case USB_REQ_SET_CONFIGURATION:
1417 if (ctrl->bRequestType != 0)
1418 break;
1419 if (0 == (u8) w_value) {
1420 value = 0;
1421 dev->current_config = 0;
1422 usb_gadget_vbus_draw(gadget, 8 /* mA */ );
1423 // user mode expected to disable endpoints
1424 } else {
1425 u8 config, power;
1426#ifdef HIGHSPEED
1427 if (gadget->speed == USB_SPEED_HIGH) {
1428 config = dev->hs_config->bConfigurationValue;
1429 power = dev->hs_config->bMaxPower;
1430 } else
1431#endif
1432 {
1433 config = dev->config->bConfigurationValue;
1434 power = dev->config->bMaxPower;
1435 }
1436
1437 if (config == (u8) w_value) {
1438 value = 0;
1439 dev->current_config = config;
1440 usb_gadget_vbus_draw(gadget, 2 * power);
1441 }
1442 }
1443
1444 /* report SET_CONFIGURATION like any other control request,
1445 * except that usermode may not stall this. the next
1446 * request mustn't be allowed start until this finishes:
1447 * endpoints and threads set up, etc.
1448 *
1449 * NOTE: older PXA hardware (before PXA 255: without UDCCFR)
1450 * has bad/racey automagic that prevents synchronizing here.
1451 * even kernel mode drivers often miss them.
1452 */
1453 if (value == 0) {
1454 INFO (dev, "configuration #%d\n", dev->current_config);
1455 if (dev->usermode_setup) {
1456 dev->setup_can_stall = 0;
1457 goto delegate;
1458 }
1459 }
1460 break;
1461
1462#ifndef CONFIG_USB_GADGETFS_PXA2XX
1463 /* PXA automagically handles this request too */
1464 case USB_REQ_GET_CONFIGURATION:
1465 if (ctrl->bRequestType != 0x80)
1466 break;
1467 *(u8 *)req->buf = dev->current_config;
1468 value = min (w_length, (u16) 1);
1469 break;
1470#endif
1471
1472 default:
1473unrecognized:
1474 VDEBUG (dev, "%s req%02x.%02x v%04x i%04x l%d\n",
1475 dev->usermode_setup ? "delegate" : "fail",
1476 ctrl->bRequestType, ctrl->bRequest,
1477 w_value, le16_to_cpu(ctrl->wIndex), w_length);
1478
1479 /* if there's an ep0 reader, don't stall */
1480 if (dev->usermode_setup) {
1481 dev->setup_can_stall = 1;
1482delegate:
1483 dev->setup_in = (ctrl->bRequestType & USB_DIR_IN)
1484 ? 1 : 0;
1485 dev->setup_out_ready = 0;
1486 dev->setup_out_error = 0;
1487 value = 0;
1488
1489 /* read DATA stage for OUT right away */
1490 if (unlikely (!dev->setup_in && w_length)) {
1491 value = setup_req (gadget->ep0, dev->req,
1492 w_length);
1493 if (value < 0)
1494 break;
1495 value = usb_ep_queue (gadget->ep0, dev->req,
1496 GFP_ATOMIC);
1497 if (value < 0) {
1498 clean_req (gadget->ep0, dev->req);
1499 break;
1500 }
1501
1502 /* we can't currently stall these */
1503 dev->setup_can_stall = 0;
1504 }
1505
1506 /* state changes when reader collects event */
1507 event = next_event (dev, GADGETFS_SETUP);
1508 event->u.setup = *ctrl;
1509 ep0_readable (dev);
1510 spin_unlock (&dev->lock);
1511 return 0;
1512 }
1513 }
1514
1515 /* proceed with data transfer and status phases? */
1516 if (value >= 0 && dev->state != STATE_SETUP) {
1517 req->length = value;
1518 req->zero = value < w_length;
1519 value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC);
1520 if (value < 0) {
1521 DBG (dev, "ep_queue --> %d\n", value);
1522 req->status = 0;
1523 }
1524 }
1525
1526 /* device stalls when value < 0 */
1527 spin_unlock (&dev->lock);
1528 return value;
1529}
1530
1531static void destroy_ep_files (struct dev_data *dev)
1532{
1533 struct list_head *entry, *tmp;
1534
1535 DBG (dev, "%s %d\n", __FUNCTION__, dev->state);
1536
1537 /* dev->state must prevent interference */
1538restart:
1539 spin_lock_irq (&dev->lock);
1540 list_for_each_safe (entry, tmp, &dev->epfiles) {
1541 struct ep_data *ep;
1542 struct inode *parent;
1543 struct dentry *dentry;
1544
1545 /* break link to FS */
1546 ep = list_entry (entry, struct ep_data, epfiles);
1547 list_del_init (&ep->epfiles);
1548 dentry = ep->dentry;
1549 ep->dentry = NULL;
1550 parent = dentry->d_parent->d_inode;
1551
1552 /* break link to controller */
1553 if (ep->state == STATE_EP_ENABLED)
1554 (void) usb_ep_disable (ep->ep);
1555 ep->state = STATE_EP_UNBOUND;
1556 usb_ep_free_request (ep->ep, ep->req);
1557 ep->ep = NULL;
1558 wake_up (&ep->wait);
1559 put_ep (ep);
1560
1561 spin_unlock_irq (&dev->lock);
1562
1563 /* break link to dcache */
1564 down (&parent->i_sem);
1565 d_delete (dentry);
1566 dput (dentry);
1567 up (&parent->i_sem);
1568
1569 /* fds may still be open */
1570 goto restart;
1571 }
1572 spin_unlock_irq (&dev->lock);
1573}
1574
1575
1576static struct inode *
1577gadgetfs_create_file (struct super_block *sb, char const *name,
1578 void *data, struct file_operations *fops,
1579 struct dentry **dentry_p);
1580
1581static int activate_ep_files (struct dev_data *dev)
1582{
1583 struct usb_ep *ep;
1584
1585 gadget_for_each_ep (ep, dev->gadget) {
1586 struct ep_data *data;
1587
1588 data = kmalloc (sizeof *data, GFP_KERNEL);
1589 if (!data)
1590 goto enomem;
1591 memset (data, 0, sizeof data);
1592 data->state = STATE_EP_DISABLED;
1593 init_MUTEX (&data->lock);
1594 init_waitqueue_head (&data->wait);
1595
1596 strncpy (data->name, ep->name, sizeof (data->name) - 1);
1597 atomic_set (&data->count, 1);
1598 data->dev = dev;
1599 get_dev (dev);
1600
1601 data->ep = ep;
1602 ep->driver_data = data;
1603
1604 data->req = usb_ep_alloc_request (ep, GFP_KERNEL);
1605 if (!data->req)
1606 goto enomem;
1607
1608 data->inode = gadgetfs_create_file (dev->sb, data->name,
1609 data, &ep_config_operations,
1610 &data->dentry);
1611 if (!data->inode) {
1612 kfree (data);
1613 goto enomem;
1614 }
1615 list_add_tail (&data->epfiles, &dev->epfiles);
1616 }
1617 return 0;
1618
1619enomem:
1620 DBG (dev, "%s enomem\n", __FUNCTION__);
1621 destroy_ep_files (dev);
1622 return -ENOMEM;
1623}
1624
1625static void
1626gadgetfs_unbind (struct usb_gadget *gadget)
1627{
1628 struct dev_data *dev = get_gadget_data (gadget);
1629
1630 DBG (dev, "%s\n", __FUNCTION__);
1631
1632 spin_lock_irq (&dev->lock);
1633 dev->state = STATE_DEV_UNBOUND;
1634 spin_unlock_irq (&dev->lock);
1635
1636 destroy_ep_files (dev);
1637 gadget->ep0->driver_data = NULL;
1638 set_gadget_data (gadget, NULL);
1639
1640 /* we've already been disconnected ... no i/o is active */
1641 if (dev->req)
1642 usb_ep_free_request (gadget->ep0, dev->req);
1643 DBG (dev, "%s done\n", __FUNCTION__);
1644 put_dev (dev);
1645}
1646
1647static struct dev_data *the_device;
1648
1649static int
1650gadgetfs_bind (struct usb_gadget *gadget)
1651{
1652 struct dev_data *dev = the_device;
1653
1654 if (!dev)
1655 return -ESRCH;
1656 if (0 != strcmp (CHIP, gadget->name)) {
1657 printk (KERN_ERR "%s expected %s controller not %s\n",
1658 shortname, CHIP, gadget->name);
1659 return -ENODEV;
1660 }
1661
1662 set_gadget_data (gadget, dev);
1663 dev->gadget = gadget;
1664 gadget->ep0->driver_data = dev;
1665 dev->dev->bMaxPacketSize0 = gadget->ep0->maxpacket;
1666
1667 /* preallocate control response and buffer */
1668 dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
1669 if (!dev->req)
1670 goto enomem;
1671 dev->req->context = NULL;
1672 dev->req->complete = epio_complete;
1673
1674 if (activate_ep_files (dev) < 0)
1675 goto enomem;
1676
1677 INFO (dev, "bound to %s driver\n", gadget->name);
1678 dev->state = STATE_UNCONNECTED;
1679 get_dev (dev);
1680 return 0;
1681
1682enomem:
1683 gadgetfs_unbind (gadget);
1684 return -ENOMEM;
1685}
1686
1687static void
1688gadgetfs_disconnect (struct usb_gadget *gadget)
1689{
1690 struct dev_data *dev = get_gadget_data (gadget);
1691
1692 if (dev->state == STATE_UNCONNECTED) {
1693 DBG (dev, "already unconnected\n");
1694 return;
1695 }
1696 dev->state = STATE_UNCONNECTED;
1697
1698 INFO (dev, "disconnected\n");
1699 spin_lock (&dev->lock);
1700 next_event (dev, GADGETFS_DISCONNECT);
1701 ep0_readable (dev);
1702 spin_unlock (&dev->lock);
1703}
1704
1705static void
1706gadgetfs_suspend (struct usb_gadget *gadget)
1707{
1708 struct dev_data *dev = get_gadget_data (gadget);
1709
1710 INFO (dev, "suspended from state %d\n", dev->state);
1711 spin_lock (&dev->lock);
1712 switch (dev->state) {
1713 case STATE_SETUP: // VERY odd... host died??
1714 case STATE_CONNECTED:
1715 case STATE_UNCONNECTED:
1716 next_event (dev, GADGETFS_SUSPEND);
1717 ep0_readable (dev);
1718 /* FALLTHROUGH */
1719 default:
1720 break;
1721 }
1722 spin_unlock (&dev->lock);
1723}
1724
1725static struct usb_gadget_driver gadgetfs_driver = {
1726#ifdef HIGHSPEED
1727 .speed = USB_SPEED_HIGH,
1728#else
1729 .speed = USB_SPEED_FULL,
1730#endif
1731 .function = (char *) driver_desc,
1732 .bind = gadgetfs_bind,
1733 .unbind = gadgetfs_unbind,
1734 .setup = gadgetfs_setup,
1735 .disconnect = gadgetfs_disconnect,
1736 .suspend = gadgetfs_suspend,
1737
1738 .driver = {
1739 .name = (char *) shortname,
1740 // .shutdown = ...
1741 // .suspend = ...
1742 // .resume = ...
1743 },
1744};
1745
1746/*----------------------------------------------------------------------*/
1747
1748static void gadgetfs_nop(struct usb_gadget *arg) { }
1749
1750static int gadgetfs_probe (struct usb_gadget *gadget)
1751{
1752 CHIP = gadget->name;
1753 return -EISNAM;
1754}
1755
1756static struct usb_gadget_driver probe_driver = {
1757 .speed = USB_SPEED_HIGH,
1758 .bind = gadgetfs_probe,
1759 .unbind = gadgetfs_nop,
1760 .setup = (void *)gadgetfs_nop,
1761 .disconnect = gadgetfs_nop,
1762 .driver = {
1763 .name = "nop",
1764 },
1765};
1766
1767
1768/* DEVICE INITIALIZATION
1769 *
1770 * fd = open ("/dev/gadget/$CHIP", O_RDWR)
1771 * status = write (fd, descriptors, sizeof descriptors)
1772 *
1773 * That write establishes the device configuration, so the kernel can
1774 * bind to the controller ... guaranteeing it can handle enumeration
1775 * at all necessary speeds. Descriptor order is:
1776 *
1777 * . message tag (u32, host order) ... for now, must be zero; it
1778 * would change to support features like multi-config devices
1779 * . full/low speed config ... all wTotalLength bytes (with interface,
1780 * class, altsetting, endpoint, and other descriptors)
1781 * . high speed config ... all descriptors, for high speed operation;
1782 * this one's optional except for high-speed hardware
1783 * . device descriptor
1784 *
1785 * Endpoints are not yet enabled. Drivers may want to immediately
1786 * initialize them, using the /dev/gadget/ep* files that are available
1787 * as soon as the kernel sees the configuration, or they can wait
1788 * until device configuration and interface altsetting changes create
1789 * the need to configure (or unconfigure) them.
1790 *
1791 * After initialization, the device stays active for as long as that
1792 * $CHIP file is open. Events may then be read from that descriptor,
1793 * such configuration notifications. More complex drivers will handle
1794 * some control requests in user space.
1795 */
1796
1797static int is_valid_config (struct usb_config_descriptor *config)
1798{
1799 return config->bDescriptorType == USB_DT_CONFIG
1800 && config->bLength == USB_DT_CONFIG_SIZE
1801 && config->bConfigurationValue != 0
1802 && (config->bmAttributes & USB_CONFIG_ATT_ONE) != 0
1803 && (config->bmAttributes & USB_CONFIG_ATT_WAKEUP) == 0;
1804 /* FIXME if gadget->is_otg, _must_ include an otg descriptor */
1805 /* FIXME check lengths: walk to end */
1806}
1807
1808static ssize_t
1809dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
1810{
1811 struct dev_data *dev = fd->private_data;
1812 ssize_t value = len, length = len;
1813 unsigned total;
1814 u32 tag;
1815 char *kbuf;
1816
1817 if (dev->state != STATE_OPENED)
1818 return -EEXIST;
1819
1820 if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4))
1821 return -EINVAL;
1822
1823 /* we might need to change message format someday */
1824 if (copy_from_user (&tag, buf, 4))
1825 return -EFAULT;
1826 if (tag != 0)
1827 return -EINVAL;
1828 buf += 4;
1829 length -= 4;
1830
1831 kbuf = kmalloc (length, SLAB_KERNEL);
1832 if (!kbuf)
1833 return -ENOMEM;
1834 if (copy_from_user (kbuf, buf, length)) {
1835 kfree (kbuf);
1836 return -EFAULT;
1837 }
1838
1839 spin_lock_irq (&dev->lock);
1840 value = -EINVAL;
1841 if (dev->buf)
1842 goto fail;
1843 dev->buf = kbuf;
1844
1845 /* full or low speed config */
1846 dev->config = (void *) kbuf;
1847 total = le16_to_cpup (&dev->config->wTotalLength);
1848 if (!is_valid_config (dev->config) || total >= length)
1849 goto fail;
1850 kbuf += total;
1851 length -= total;
1852
1853 /* optional high speed config */
1854 if (kbuf [1] == USB_DT_CONFIG) {
1855 dev->hs_config = (void *) kbuf;
1856 total = le16_to_cpup (&dev->hs_config->wTotalLength);
1857 if (!is_valid_config (dev->hs_config) || total >= length)
1858 goto fail;
1859 kbuf += total;
1860 length -= total;
1861 }
1862
1863 /* could support multiple configs, using another encoding! */
1864
1865 /* device descriptor (tweaked for paranoia) */
1866 if (length != USB_DT_DEVICE_SIZE)
1867 goto fail;
1868 dev->dev = (void *)kbuf;
1869 if (dev->dev->bLength != USB_DT_DEVICE_SIZE
1870 || dev->dev->bDescriptorType != USB_DT_DEVICE
1871 || dev->dev->bNumConfigurations != 1)
1872 goto fail;
1873 dev->dev->bNumConfigurations = 1;
1874 dev->dev->bcdUSB = __constant_cpu_to_le16 (0x0200);
1875
1876 /* triggers gadgetfs_bind(); then we can enumerate. */
1877 spin_unlock_irq (&dev->lock);
1878 value = usb_gadget_register_driver (&gadgetfs_driver);
1879 if (value != 0) {
1880 kfree (dev->buf);
1881 dev->buf = NULL;
1882 } else {
1883 /* at this point "good" hardware has for the first time
1884 * let the USB the host see us. alternatively, if users
1885 * unplug/replug that will clear all the error state.
1886 *
1887 * note: everything running before here was guaranteed
1888 * to choke driver model style diagnostics. from here
1889 * on, they can work ... except in cleanup paths that
1890 * kick in after the ep0 descriptor is closed.
1891 */
1892 fd->f_op = &ep0_io_operations;
1893 value = len;
1894 }
1895 return value;
1896
1897fail:
1898 spin_unlock_irq (&dev->lock);
1899 pr_debug ("%s: %s fail %Zd, %p\n", shortname, __FUNCTION__, value, dev);
1900 kfree (dev->buf);
1901 dev->buf = NULL;
1902 return value;
1903}
1904
1905static int
1906dev_open (struct inode *inode, struct file *fd)
1907{
1908 struct dev_data *dev = inode->u.generic_ip;
1909 int value = -EBUSY;
1910
1911 if (dev->state == STATE_DEV_DISABLED) {
1912 dev->ev_next = 0;
1913 dev->state = STATE_OPENED;
1914 fd->private_data = dev;
1915 get_dev (dev);
1916 value = 0;
1917 }
1918 return value;
1919}
1920
1921static struct file_operations dev_init_operations = {
1922 .owner = THIS_MODULE,
1923 .llseek = no_llseek,
1924
1925 .open = dev_open,
1926 .write = dev_config,
1927 .fasync = ep0_fasync,
1928 .ioctl = dev_ioctl,
1929 .release = dev_release,
1930};
1931
1932/*----------------------------------------------------------------------*/
1933
1934/* FILESYSTEM AND SUPERBLOCK OPERATIONS
1935 *
1936 * Mounting the filesystem creates a controller file, used first for
1937 * device configuration then later for event monitoring.
1938 */
1939
1940
1941/* FIXME PAM etc could set this security policy without mount options
1942 * if epfiles inherited ownership and permissons from ep0 ...
1943 */
1944
1945static unsigned default_uid;
1946static unsigned default_gid;
1947static unsigned default_perm = S_IRUSR | S_IWUSR;
1948
1949module_param (default_uid, uint, 0644);
1950module_param (default_gid, uint, 0644);
1951module_param (default_perm, uint, 0644);
1952
1953
1954static struct inode *
1955gadgetfs_make_inode (struct super_block *sb,
1956 void *data, struct file_operations *fops,
1957 int mode)
1958{
1959 struct inode *inode = new_inode (sb);
1960
1961 if (inode) {
1962 inode->i_mode = mode;
1963 inode->i_uid = default_uid;
1964 inode->i_gid = default_gid;
1965 inode->i_blksize = PAGE_CACHE_SIZE;
1966 inode->i_blocks = 0;
1967 inode->i_atime = inode->i_mtime = inode->i_ctime
1968 = CURRENT_TIME;
1969 inode->u.generic_ip = data;
1970 inode->i_fop = fops;
1971 }
1972 return inode;
1973}
1974
1975/* creates in fs root directory, so non-renamable and non-linkable.
1976 * so inode and dentry are paired, until device reconfig.
1977 */
1978static struct inode *
1979gadgetfs_create_file (struct super_block *sb, char const *name,
1980 void *data, struct file_operations *fops,
1981 struct dentry **dentry_p)
1982{
1983 struct dentry *dentry;
1984 struct inode *inode;
1985
1986 dentry = d_alloc_name(sb->s_root, name);
1987 if (!dentry)
1988 return NULL;
1989
1990 inode = gadgetfs_make_inode (sb, data, fops,
1991 S_IFREG | (default_perm & S_IRWXUGO));
1992 if (!inode) {
1993 dput(dentry);
1994 return NULL;
1995 }
1996 d_add (dentry, inode);
1997 *dentry_p = dentry;
1998 return inode;
1999}
2000
2001static struct super_operations gadget_fs_operations = {
2002 .statfs = simple_statfs,
2003 .drop_inode = generic_delete_inode,
2004};
2005
2006static int
2007gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
2008{
2009 struct inode *inode;
2010 struct dentry *d;
2011 struct dev_data *dev;
2012
2013 if (the_device)
2014 return -ESRCH;
2015
2016 /* fake probe to determine $CHIP */
2017 (void) usb_gadget_register_driver (&probe_driver);
2018 if (!CHIP)
2019 return -ENODEV;
2020
2021 /* superblock */
2022 sb->s_blocksize = PAGE_CACHE_SIZE;
2023 sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
2024 sb->s_magic = GADGETFS_MAGIC;
2025 sb->s_op = &gadget_fs_operations;
2026 sb->s_time_gran = 1;
2027
2028 /* root inode */
2029 inode = gadgetfs_make_inode (sb,
2030 NULL, &simple_dir_operations,
2031 S_IFDIR | S_IRUGO | S_IXUGO);
2032 if (!inode)
2033 return -ENOMEM;
2034 inode->i_op = &simple_dir_inode_operations;
2035 if (!(d = d_alloc_root (inode))) {
2036 iput (inode);
2037 return -ENOMEM;
2038 }
2039 sb->s_root = d;
2040
2041 /* the ep0 file is named after the controller we expect;
2042 * user mode code can use it for sanity checks, like we do.
2043 */
2044 dev = dev_new ();
2045 if (!dev)
2046 return -ENOMEM;
2047
2048 dev->sb = sb;
2049 if (!(inode = gadgetfs_create_file (sb, CHIP,
2050 dev, &dev_init_operations,
2051 &dev->dentry))) {
2052 put_dev(dev);
2053 return -ENOMEM;
2054 }
2055
2056 /* other endpoint files are available after hardware setup,
2057 * from binding to a controller.
2058 */
2059 the_device = dev;
2060 return 0;
2061}
2062
2063/* "mount -t gadgetfs path /dev/gadget" ends up here */
2064static struct super_block *
2065gadgetfs_get_sb (struct file_system_type *t, int flags,
2066 const char *path, void *opts)
2067{
2068 return get_sb_single (t, flags, opts, gadgetfs_fill_super);
2069}
2070
2071static void
2072gadgetfs_kill_sb (struct super_block *sb)
2073{
2074 kill_litter_super (sb);
2075 if (the_device) {
2076 put_dev (the_device);
2077 the_device = NULL;
2078 }
2079}
2080
2081/*----------------------------------------------------------------------*/
2082
2083static struct file_system_type gadgetfs_type = {
2084 .owner = THIS_MODULE,
2085 .name = shortname,
2086 .get_sb = gadgetfs_get_sb,
2087 .kill_sb = gadgetfs_kill_sb,
2088};
2089
2090/*----------------------------------------------------------------------*/
2091
2092static int __init init (void)
2093{
2094 int status;
2095
2096 status = register_filesystem (&gadgetfs_type);
2097 if (status == 0)
2098 pr_info ("%s: %s, version " DRIVER_VERSION "\n",
2099 shortname, driver_desc);
2100 return status;
2101}
2102module_init (init);
2103
2104static void __exit cleanup (void)
2105{
2106 pr_debug ("unregister %s\n", shortname);
2107 unregister_filesystem (&gadgetfs_type);
2108}
2109module_exit (cleanup);
2110
generated by cgit v1.2.2 (git 2.25.0) at 2024-12-19 23:50:10 -0500