1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * inode.c -- user mode filesystem api for usb gadget controllers 4 * 5 * Copyright (C) 2003-2004 David Brownell 6 * Copyright (C) 2003 Agilent Technologies 7 */ 8 9 10 /* #define VERBOSE_DEBUG */ 11 12 #include <linux/init.h> 13 #include <linux/module.h> 14 #include <linux/fs.h> 15 #include <linux/fs_context.h> 16 #include <linux/pagemap.h> 17 #include <linux/uts.h> 18 #include <linux/wait.h> 19 #include <linux/compiler.h> 20 #include <linux/uaccess.h> 21 #include <linux/sched.h> 22 #include <linux/slab.h> 23 #include <linux/string_choices.h> 24 #include <linux/poll.h> 25 #include <linux/kthread.h> 26 #include <linux/aio.h> 27 #include <linux/uio.h> 28 #include <linux/refcount.h> 29 #include <linux/delay.h> 30 #include <linux/device.h> 31 #include <linux/moduleparam.h> 32 33 #include <linux/usb/gadgetfs.h> 34 #include <linux/usb/gadget.h> 35 #include <linux/usb/composite.h> /* for USB_GADGET_DELAYED_STATUS */ 36 37 /* Undef helpers from linux/usb/composite.h as gadgetfs redefines them */ 38 #undef DBG 39 #undef ERROR 40 #undef INFO 41 42 43 /* 44 * The gadgetfs API maps each endpoint to a file descriptor so that you 45 * can use standard synchronous read/write calls for I/O. There's some 46 * O_NONBLOCK and O_ASYNC/FASYNC style i/o support. Example usermode 47 * drivers show how this works in practice. You can also use AIO to 48 * eliminate I/O gaps between requests, to help when streaming data. 49 * 50 * Key parts that must be USB-specific are protocols defining how the 51 * read/write operations relate to the hardware state machines. There 52 * are two types of files. One type is for the device, implementing ep0. 53 * The other type is for each IN or OUT endpoint. In both cases, the 54 * user mode driver must configure the hardware before using it. 55 * 56 * - First, dev_config() is called when /dev/gadget/$CHIP is configured 57 * (by writing configuration and device descriptors). Afterwards it 58 * may serve as a source of device events, used to handle all control 59 * requests other than basic enumeration. 60 * 61 * - Then, after a SET_CONFIGURATION control request, ep_config() is 62 * called when each /dev/gadget/ep* file is configured (by writing 63 * endpoint descriptors). Afterwards these files are used to write() 64 * IN data or to read() OUT data. To halt the endpoint, a "wrong 65 * direction" request is issued (like reading an IN endpoint). 66 * 67 * Unlike "usbfs" the only ioctl()s are for things that are rare, and maybe 68 * not possible on all hardware. For example, precise fault handling with 69 * respect to data left in endpoint fifos after aborted operations; or 70 * selective clearing of endpoint halts, to implement SET_INTERFACE. 71 */ 72 73 #define DRIVER_DESC "USB Gadget filesystem" 74 #define DRIVER_VERSION "24 Aug 2004" 75 76 static const char driver_desc [] = DRIVER_DESC; 77 static const char shortname [] = "gadgetfs"; 78 79 MODULE_DESCRIPTION (DRIVER_DESC); 80 MODULE_AUTHOR ("David Brownell"); 81 MODULE_LICENSE ("GPL"); 82 83 static int ep_open(struct inode *, struct file *); 84 85 86 /*----------------------------------------------------------------------*/ 87 88 #define GADGETFS_MAGIC 0xaee71ee7 89 90 /* /dev/gadget/$CHIP represents ep0 and the whole device */ 91 enum ep0_state { 92 /* DISABLED is the initial state. */ 93 STATE_DEV_DISABLED = 0, 94 95 /* Only one open() of /dev/gadget/$CHIP; only one file tracks 96 * ep0/device i/o modes and binding to the controller. Driver 97 * must always write descriptors to initialize the device, then 98 * the device becomes UNCONNECTED until enumeration. 99 */ 100 STATE_DEV_OPENED, 101 102 /* From then on, ep0 fd is in either of two basic modes: 103 * - (UN)CONNECTED: read usb_gadgetfs_event(s) from it 104 * - SETUP: read/write will transfer control data and succeed; 105 * or if "wrong direction", performs protocol stall 106 */ 107 STATE_DEV_UNCONNECTED, 108 STATE_DEV_CONNECTED, 109 STATE_DEV_SETUP, 110 111 /* UNBOUND means the driver closed ep0, so the device won't be 112 * accessible again (DEV_DISABLED) until all fds are closed. 113 */ 114 STATE_DEV_UNBOUND, 115 }; 116 117 /* enough for the whole queue: most events invalidate others */ 118 #define N_EVENT 5 119 120 #define RBUF_SIZE 256 121 122 struct dev_data { 123 spinlock_t lock; 124 refcount_t count; 125 int udc_usage; 126 enum ep0_state state; /* P: lock */ 127 struct usb_gadgetfs_event event [N_EVENT]; 128 unsigned ev_next; 129 struct fasync_struct *fasync; 130 u8 current_config; 131 132 /* drivers reading ep0 MUST handle control requests (SETUP) 133 * reported that way; else the host will time out. 134 */ 135 unsigned usermode_setup : 1, 136 setup_in : 1, 137 setup_can_stall : 1, 138 setup_out_ready : 1, 139 setup_out_error : 1, 140 setup_abort : 1, 141 gadget_registered : 1; 142 unsigned setup_wLength; 143 144 /* the rest is basically write-once */ 145 struct usb_config_descriptor *config, *hs_config; 146 struct usb_device_descriptor *dev; 147 struct usb_request *req; 148 struct usb_gadget *gadget; 149 struct list_head epfiles; 150 void *buf; 151 wait_queue_head_t wait; 152 struct super_block *sb; 153 154 /* except this scratch i/o buffer for ep0 */ 155 u8 rbuf[RBUF_SIZE]; 156 }; 157 158 static inline void get_dev (struct dev_data *data) 159 { 160 refcount_inc (&data->count); 161 } 162 163 static void put_dev (struct dev_data *data) 164 { 165 if (likely (!refcount_dec_and_test (&data->count))) 166 return; 167 /* needs no more cleanup */ 168 BUG_ON (waitqueue_active (&data->wait)); 169 kfree (data); 170 } 171 172 static struct dev_data *dev_new (void) 173 { 174 struct dev_data *dev; 175 176 dev = kzalloc_obj(*dev); 177 if (!dev) 178 return NULL; 179 dev->state = STATE_DEV_DISABLED; 180 refcount_set (&dev->count, 1); 181 spin_lock_init (&dev->lock); 182 INIT_LIST_HEAD (&dev->epfiles); 183 init_waitqueue_head (&dev->wait); 184 return dev; 185 } 186 187 /*----------------------------------------------------------------------*/ 188 189 /* other /dev/gadget/$ENDPOINT files represent endpoints */ 190 enum ep_state { 191 STATE_EP_DISABLED = 0, 192 STATE_EP_READY, 193 STATE_EP_ENABLED, 194 STATE_EP_UNBOUND, 195 }; 196 197 struct ep_data { 198 struct mutex lock; 199 enum ep_state state; 200 refcount_t count; 201 struct dev_data *dev; 202 /* must hold dev->lock before accessing ep or req */ 203 struct usb_ep *ep; 204 struct usb_request *req; 205 ssize_t status; 206 char name [16]; 207 struct usb_endpoint_descriptor desc, hs_desc; 208 struct list_head epfiles; 209 wait_queue_head_t wait; 210 }; 211 212 static inline void get_ep (struct ep_data *data) 213 { 214 refcount_inc (&data->count); 215 } 216 217 static void put_ep (struct ep_data *data) 218 { 219 if (likely (!refcount_dec_and_test (&data->count))) 220 return; 221 put_dev (data->dev); 222 /* needs no more cleanup */ 223 BUG_ON (!list_empty (&data->epfiles)); 224 BUG_ON (waitqueue_active (&data->wait)); 225 kfree (data); 226 } 227 228 /*----------------------------------------------------------------------*/ 229 230 /* most "how to use the hardware" policy choices are in userspace: 231 * mapping endpoint roles (which the driver needs) to the capabilities 232 * which the usb controller has. most of those capabilities are exposed 233 * implicitly, starting with the driver name and then endpoint names. 234 */ 235 236 static const char *CHIP; 237 static DEFINE_MUTEX(sb_mutex); /* Serialize superblock operations */ 238 239 static DEFINE_SPINLOCK(aio_lock); /* Protect aio cancellation info */ 240 static struct workqueue_struct *gadgetfs_wq; 241 242 /*----------------------------------------------------------------------*/ 243 244 /* NOTE: don't use dev_printk calls before binding to the gadget 245 * at the end of ep0 configuration, or after unbind. 246 */ 247 248 /* too wordy: dev_printk(level , &(d)->gadget->dev , fmt , ## args) */ 249 #define xprintk(d,level,fmt,args...) \ 250 printk(level "%s: " fmt , shortname , ## args) 251 252 #ifdef DEBUG 253 #define DBG(dev,fmt,args...) \ 254 xprintk(dev , KERN_DEBUG , fmt , ## args) 255 #else 256 #define DBG(dev,fmt,args...) \ 257 do { } while (0) 258 #endif /* DEBUG */ 259 260 #ifdef VERBOSE_DEBUG 261 #define VDEBUG DBG 262 #else 263 #define VDEBUG(dev,fmt,args...) \ 264 do { } while (0) 265 #endif /* DEBUG */ 266 267 #define ERROR(dev,fmt,args...) \ 268 xprintk(dev , KERN_ERR , fmt , ## args) 269 #define INFO(dev,fmt,args...) \ 270 xprintk(dev , KERN_INFO , fmt , ## args) 271 272 273 /*----------------------------------------------------------------------*/ 274 275 /* SYNCHRONOUS ENDPOINT OPERATIONS (bulk/intr/iso) 276 * 277 * After opening, configure non-control endpoints. Then use normal 278 * stream read() and write() requests; and maybe ioctl() to get more 279 * precise FIFO status when recovering from cancellation. 280 */ 281 282 static void epio_complete (struct usb_ep *ep, struct usb_request *req) 283 { 284 struct ep_data *epdata = ep->driver_data; 285 286 if (!req->context) 287 return; 288 if (req->status) 289 epdata->status = req->status; 290 else 291 epdata->status = req->actual; 292 complete ((struct completion *)req->context); 293 } 294 295 /* tasklock endpoint, returning when it's connected. 296 * still need dev->lock to use epdata->ep. 297 */ 298 static int 299 get_ready_ep (unsigned f_flags, struct ep_data *epdata, bool is_write) 300 { 301 int val; 302 303 if (f_flags & O_NONBLOCK) { 304 if (!mutex_trylock(&epdata->lock)) 305 goto nonblock; 306 if (epdata->state != STATE_EP_ENABLED && 307 (!is_write || epdata->state != STATE_EP_READY)) { 308 mutex_unlock(&epdata->lock); 309 nonblock: 310 val = -EAGAIN; 311 } else 312 val = 0; 313 return val; 314 } 315 316 val = mutex_lock_interruptible(&epdata->lock); 317 if (val < 0) 318 return val; 319 320 switch (epdata->state) { 321 case STATE_EP_ENABLED: 322 return 0; 323 case STATE_EP_READY: /* not configured yet */ 324 if (is_write) 325 return 0; 326 fallthrough; 327 case STATE_EP_UNBOUND: /* clean disconnect */ 328 break; 329 // case STATE_EP_DISABLED: /* "can't happen" */ 330 default: /* error! */ 331 pr_debug ("%s: ep %p not available, state %d\n", 332 shortname, epdata, epdata->state); 333 } 334 mutex_unlock(&epdata->lock); 335 return -ENODEV; 336 } 337 338 static ssize_t 339 ep_io (struct ep_data *epdata, void *buf, unsigned len) 340 { 341 DECLARE_COMPLETION_ONSTACK (done); 342 int value; 343 344 spin_lock_irq (&epdata->dev->lock); 345 if (likely (epdata->ep != NULL)) { 346 struct usb_request *req = epdata->req; 347 348 req->context = &done; 349 req->complete = epio_complete; 350 req->buf = buf; 351 req->length = len; 352 value = usb_ep_queue (epdata->ep, req, GFP_ATOMIC); 353 } else 354 value = -ENODEV; 355 spin_unlock_irq (&epdata->dev->lock); 356 357 if (likely (value == 0)) { 358 value = wait_for_completion_interruptible(&done); 359 if (value != 0) { 360 spin_lock_irq (&epdata->dev->lock); 361 if (likely (epdata->ep != NULL)) { 362 DBG (epdata->dev, "%s i/o interrupted\n", 363 epdata->name); 364 usb_ep_dequeue (epdata->ep, epdata->req); 365 spin_unlock_irq (&epdata->dev->lock); 366 367 wait_for_completion(&done); 368 if (epdata->status == -ECONNRESET) 369 epdata->status = -EINTR; 370 } else { 371 spin_unlock_irq (&epdata->dev->lock); 372 373 DBG (epdata->dev, "endpoint gone\n"); 374 wait_for_completion(&done); 375 epdata->status = -ENODEV; 376 } 377 } 378 return epdata->status; 379 } 380 return value; 381 } 382 383 static int 384 ep_release (struct inode *inode, struct file *fd) 385 { 386 struct ep_data *data = fd->private_data; 387 int value; 388 389 value = mutex_lock_interruptible(&data->lock); 390 if (value < 0) 391 return value; 392 393 /* clean up if this can be reopened */ 394 if (data->state != STATE_EP_UNBOUND) { 395 data->state = STATE_EP_DISABLED; 396 data->desc.bDescriptorType = 0; 397 data->hs_desc.bDescriptorType = 0; 398 usb_ep_disable(data->ep); 399 } 400 mutex_unlock(&data->lock); 401 put_ep (data); 402 return 0; 403 } 404 405 static long ep_ioctl(struct file *fd, unsigned code, unsigned long value) 406 { 407 struct ep_data *data = fd->private_data; 408 int status; 409 410 if ((status = get_ready_ep (fd->f_flags, data, false)) < 0) 411 return status; 412 413 spin_lock_irq (&data->dev->lock); 414 if (likely (data->ep != NULL)) { 415 switch (code) { 416 case GADGETFS_FIFO_STATUS: 417 status = usb_ep_fifo_status (data->ep); 418 break; 419 case GADGETFS_FIFO_FLUSH: 420 usb_ep_fifo_flush (data->ep); 421 break; 422 case GADGETFS_CLEAR_HALT: 423 status = usb_ep_clear_halt (data->ep); 424 break; 425 default: 426 status = -ENOTTY; 427 } 428 } else 429 status = -ENODEV; 430 spin_unlock_irq (&data->dev->lock); 431 mutex_unlock(&data->lock); 432 return status; 433 } 434 435 /*----------------------------------------------------------------------*/ 436 437 /* ASYNCHRONOUS ENDPOINT I/O OPERATIONS (bulk/intr/iso) */ 438 439 enum aio_req_state { 440 AIO_SUBMITTING, 441 AIO_RUNNING, 442 AIO_COMPLETED, 443 AIO_GIVEN_BACK, 444 }; 445 446 enum aio_cancel_state { 447 AIO_NOT_CANCELLED, 448 AIO_UNLINKING, 449 AIO_UNLINK_DONE, 450 }; 451 452 struct kiocb_priv { 453 struct usb_request *req; 454 struct ep_data *epdata; 455 struct usb_ep *ep; 456 struct kiocb *iocb; 457 struct mm_struct *mm; 458 struct work_struct copy_work; 459 struct work_struct unlink_work; 460 void *buf; 461 struct iov_iter to; 462 const void *to_free; 463 unsigned actual; 464 enum aio_req_state req_state; 465 enum aio_cancel_state cancel_state; 466 bool is_read; 467 }; 468 469 static void ep_unlink_worker(struct work_struct *work) 470 { 471 struct kiocb_priv *priv; 472 struct usb_request *req; 473 struct ep_data *epdata; 474 struct usb_ep *ep; 475 enum aio_req_state req_state; 476 477 priv = container_of(work, struct kiocb_priv, unlink_work); 478 req = priv->req; 479 epdata = priv->epdata; 480 ep = priv->ep; 481 482 usb_ep_dequeue(ep, req); 483 484 spin_lock_irq(&aio_lock); 485 req_state = priv->req_state; 486 priv->cancel_state = AIO_UNLINK_DONE; 487 spin_unlock_irq(&aio_lock); 488 489 /* 490 * req and epdata are freed after unlinking and completion are both done. 491 * priv is freed after unlinking and giveback are both done. 492 */ 493 if (req_state >= AIO_COMPLETED) { 494 /* priv may have been freed already, depending on req_state */ 495 usb_ep_free_request(ep, req); 496 put_ep(epdata); 497 if (req_state == AIO_GIVEN_BACK) 498 kfree(priv); 499 } 500 } 501 502 static int ep_aio_cancel(struct kiocb *iocb) 503 { 504 struct kiocb_priv *priv; 505 unsigned long flags; 506 507 spin_lock_irqsave(&aio_lock, flags); 508 priv = iocb->private; 509 if (!priv || priv->cancel_state != AIO_NOT_CANCELLED) { 510 spin_unlock_irqrestore(&aio_lock, flags); 511 return -EINVAL; /* Already completed or cancelled */ 512 } 513 if (priv->req_state == AIO_SUBMITTING) { 514 priv->cancel_state = AIO_UNLINK_DONE; 515 spin_unlock_irqrestore(&aio_lock, flags); 516 return 0; /* ep_aio() will call us again if needed */ 517 } 518 priv->cancel_state = AIO_UNLINKING; 519 520 /* 521 * We are called with the aio core holding iocb's context lock. 522 * usb_ep_dequeue() is allowed to run synchronously, calling the 523 * completion handler ep_aio_complete() before it returns. 524 * But ep_aio_complete() may call iocb->io_complete(), which 525 * tries to acquire the context lock, leading to deadlock. 526 * For this reason, do the dequeue operation in a work routine. 527 */ 528 INIT_WORK(&priv->unlink_work, ep_unlink_worker); 529 queue_work(gadgetfs_wq, &priv->unlink_work); 530 531 spin_unlock_irqrestore(&aio_lock, flags); 532 return 0; 533 } 534 535 static void ep_user_copy_worker(struct work_struct *work) 536 { 537 struct kiocb_priv *priv = container_of(work, struct kiocb_priv, copy_work); 538 struct mm_struct *mm = priv->mm; 539 struct kiocb *iocb = priv->iocb; 540 size_t ret; 541 542 if (mmget_not_zero(mm)) { 543 kthread_use_mm(mm); 544 ret = copy_to_iter(priv->buf, priv->actual, &priv->to); 545 kthread_unuse_mm(mm); 546 mmput(mm); 547 if (!ret) 548 ret = -EFAULT; 549 } else { 550 ret = -EFAULT; 551 } 552 mmdrop(mm); 553 554 /* completing the iocb can drop the ctx and mm, don't touch mm after */ 555 iocb->ki_complete(iocb, ret); 556 557 kfree(priv->buf); 558 kfree(priv->to_free); 559 560 spin_lock_irq(&aio_lock); 561 priv->req_state = AIO_GIVEN_BACK; 562 if (priv->cancel_state != AIO_UNLINKING) 563 kfree(priv); 564 spin_unlock_irq(&aio_lock); 565 } 566 567 static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req) 568 { 569 struct kiocb *iocb = req->context; 570 struct kiocb_priv *priv = iocb->private; 571 enum aio_req_state new_req_state; 572 enum aio_cancel_state cancel_state; 573 574 /* Prevent future cancellation */ 575 spin_lock(&aio_lock); 576 iocb->private = NULL; 577 spin_unlock(&aio_lock); 578 579 /* if this was a write or a read returning no data then we 580 * don't need to copy anything to userspace, so we can 581 * complete the aio request immediately. 582 */ 583 if (!priv->is_read || unlikely(req->actual == 0)) { 584 mmdrop(priv->mm); 585 kfree(req->buf); 586 kfree(priv->to_free); 587 iocb->ki_complete(iocb, 588 req->actual ? req->actual : (long)req->status); 589 new_req_state = AIO_GIVEN_BACK; 590 } else { 591 /* ep_copy_to_user() won't report both; we hide some faults */ 592 if (unlikely(0 != req->status)) 593 DBG(priv->epdata->dev, "%s fault %d len %d\n", 594 ep->name, req->status, req->actual); 595 596 priv->buf = req->buf; 597 priv->actual = req->actual; 598 new_req_state = AIO_COMPLETED; 599 } 600 601 spin_lock(&aio_lock); 602 priv->req_state = new_req_state; 603 cancel_state = priv->cancel_state; 604 spin_unlock(&aio_lock); 605 606 if (new_req_state == AIO_COMPLETED) { 607 INIT_WORK(&priv->copy_work, ep_user_copy_worker); 608 queue_work(gadgetfs_wq, &priv->copy_work); 609 } 610 if (cancel_state != AIO_UNLINKING) { 611 usb_ep_free_request(ep, req); 612 put_ep(priv->epdata); 613 if (new_req_state == AIO_GIVEN_BACK) 614 kfree(priv); 615 } 616 } 617 618 static ssize_t ep_aio(struct kiocb *iocb, 619 struct kiocb_priv *priv, 620 struct ep_data *epdata, 621 char *buf, 622 size_t len) 623 { 624 struct usb_request *req; 625 ssize_t value; 626 struct usb_ep *ep; 627 bool need_unlink = false; 628 629 iocb->private = priv; 630 priv->iocb = iocb; 631 632 get_ep(epdata); 633 priv->epdata = epdata; 634 priv->actual = 0; 635 priv->mm = current->mm; /* mm teardown waits for iocbs in exit_aio() */ 636 mmgrab(priv->mm); 637 638 /* each kiocb is coupled to one usb_request, but we can't 639 * allocate or submit those if the host disconnected. 640 */ 641 spin_lock_irq(&epdata->dev->lock); 642 value = -ENODEV; 643 ep = epdata->ep; 644 if (unlikely(ep == NULL)) 645 goto fail; 646 priv->ep = ep; 647 648 req = usb_ep_alloc_request(ep, GFP_ATOMIC); 649 value = -ENOMEM; 650 if (unlikely(!req)) 651 goto fail; 652 653 priv->req = req; 654 req->buf = buf; 655 req->length = len; 656 req->complete = ep_aio_complete; 657 req->context = iocb; 658 659 priv->req_state = AIO_SUBMITTING; 660 priv->cancel_state = AIO_NOT_CANCELLED; 661 662 /* Not allowed to manipulate the aio context while holding dev->lock */ 663 ++epdata->dev->udc_usage; 664 spin_unlock_irq(&epdata->dev->lock); 665 666 kiocb_set_cancel_fn(iocb, ep_aio_cancel); 667 value = usb_ep_queue(ep, req, GFP_KERNEL); 668 669 spin_lock_irq(&epdata->dev->lock); 670 --epdata->dev->udc_usage; 671 672 if (unlikely(0 != value)) { 673 spin_lock(&aio_lock); 674 iocb->private = NULL; 675 spin_unlock(&aio_lock); 676 677 usb_ep_free_request(ep, req); 678 goto fail; 679 } 680 spin_unlock_irq(&epdata->dev->lock); 681 682 spin_lock_irq(&aio_lock); 683 if (iocb->private != NULL) { 684 priv->req_state = AIO_RUNNING; 685 686 /* Cancelled before or just after submission? */ 687 if (priv->cancel_state == AIO_UNLINK_DONE) { 688 priv->cancel_state = AIO_NOT_CANCELLED; 689 need_unlink = true; 690 } 691 } /* Otherwise already completed */ 692 spin_unlock_irq(&aio_lock); 693 694 if (need_unlink) /* Redo cancel that was too early */ 695 ep_aio_cancel(iocb); 696 697 return -EIOCBQUEUED; 698 699 fail: 700 spin_unlock_irq(&epdata->dev->lock); 701 mmdrop(priv->mm); 702 kfree(priv->to_free); 703 kfree(priv); 704 put_ep(epdata); 705 return value; 706 } 707 708 static ssize_t 709 ep_read_iter(struct kiocb *iocb, struct iov_iter *to) 710 { 711 struct file *file = iocb->ki_filp; 712 struct ep_data *epdata = file->private_data; 713 size_t len = iov_iter_count(to); 714 ssize_t value; 715 char *buf; 716 717 if ((value = get_ready_ep(file->f_flags, epdata, false)) < 0) 718 return value; 719 720 /* halt any endpoint by doing a "wrong direction" i/o call */ 721 if (usb_endpoint_dir_in(&epdata->desc)) { 722 if (usb_endpoint_xfer_isoc(&epdata->desc) || 723 !is_sync_kiocb(iocb)) { 724 mutex_unlock(&epdata->lock); 725 return -EINVAL; 726 } 727 DBG (epdata->dev, "%s halt\n", epdata->name); 728 spin_lock_irq(&epdata->dev->lock); 729 if (likely(epdata->ep != NULL)) 730 usb_ep_set_halt(epdata->ep); 731 spin_unlock_irq(&epdata->dev->lock); 732 mutex_unlock(&epdata->lock); 733 return -EBADMSG; 734 } 735 736 buf = kmalloc(len, GFP_KERNEL); 737 if (unlikely(!buf)) { 738 mutex_unlock(&epdata->lock); 739 return -ENOMEM; 740 } 741 if (is_sync_kiocb(iocb)) { 742 value = ep_io(epdata, buf, len); 743 if (value >= 0 && (copy_to_iter(buf, value, to) != value)) 744 value = -EFAULT; 745 } else { 746 struct kiocb_priv *priv = kzalloc_obj(*priv); 747 value = -ENOMEM; 748 if (!priv) 749 goto fail; 750 priv->is_read = true; 751 priv->to_free = dup_iter(&priv->to, to, GFP_KERNEL); 752 if (!iter_is_ubuf(&priv->to) && !priv->to_free) { 753 kfree(priv); 754 goto fail; 755 } 756 value = ep_aio(iocb, priv, epdata, buf, len); 757 if (value == -EIOCBQUEUED) 758 buf = NULL; 759 } 760 fail: 761 kfree(buf); 762 mutex_unlock(&epdata->lock); 763 return value; 764 } 765 766 static ssize_t ep_config(struct ep_data *, const char *, size_t); 767 768 static ssize_t 769 ep_write_iter(struct kiocb *iocb, struct iov_iter *from) 770 { 771 struct file *file = iocb->ki_filp; 772 struct ep_data *epdata = file->private_data; 773 size_t len = iov_iter_count(from); 774 bool configured; 775 ssize_t value; 776 char *buf; 777 778 if ((value = get_ready_ep(file->f_flags, epdata, true)) < 0) 779 return value; 780 781 configured = epdata->state == STATE_EP_ENABLED; 782 783 /* halt any endpoint by doing a "wrong direction" i/o call */ 784 if (configured && !usb_endpoint_dir_in(&epdata->desc)) { 785 if (usb_endpoint_xfer_isoc(&epdata->desc) || 786 !is_sync_kiocb(iocb)) { 787 mutex_unlock(&epdata->lock); 788 return -EINVAL; 789 } 790 DBG (epdata->dev, "%s halt\n", epdata->name); 791 spin_lock_irq(&epdata->dev->lock); 792 if (likely(epdata->ep != NULL)) 793 usb_ep_set_halt(epdata->ep); 794 spin_unlock_irq(&epdata->dev->lock); 795 mutex_unlock(&epdata->lock); 796 return -EBADMSG; 797 } 798 799 buf = kmalloc(len, GFP_KERNEL); 800 if (unlikely(!buf)) { 801 mutex_unlock(&epdata->lock); 802 return -ENOMEM; 803 } 804 805 if (unlikely(!copy_from_iter_full(buf, len, from))) { 806 value = -EFAULT; 807 goto out; 808 } 809 810 if (unlikely(!configured)) { 811 value = ep_config(epdata, buf, len); 812 } else if (is_sync_kiocb(iocb)) { 813 value = ep_io(epdata, buf, len); 814 } else { 815 struct kiocb_priv *priv = kzalloc_obj(*priv); 816 value = -ENOMEM; 817 if (priv) { 818 value = ep_aio(iocb, priv, epdata, buf, len); 819 if (value == -EIOCBQUEUED) 820 buf = NULL; 821 } 822 } 823 out: 824 kfree(buf); 825 mutex_unlock(&epdata->lock); 826 return value; 827 } 828 829 /*----------------------------------------------------------------------*/ 830 831 /* used after endpoint configuration */ 832 static const struct file_operations ep_io_operations = { 833 .owner = THIS_MODULE, 834 835 .open = ep_open, 836 .release = ep_release, 837 .unlocked_ioctl = ep_ioctl, 838 .read_iter = ep_read_iter, 839 .write_iter = ep_write_iter, 840 }; 841 842 /* ENDPOINT INITIALIZATION 843 * 844 * fd = open ("/dev/gadget/$ENDPOINT", O_RDWR) 845 * status = write (fd, descriptors, sizeof descriptors) 846 * 847 * That write establishes the endpoint configuration, configuring 848 * the controller to process bulk, interrupt, or isochronous transfers 849 * at the right maxpacket size, and so on. 850 * 851 * The descriptors are message type 1, identified by a host order u32 852 * at the beginning of what's written. Descriptor order is: full/low 853 * speed descriptor, then optional high speed descriptor. 854 */ 855 static ssize_t 856 ep_config (struct ep_data *data, const char *buf, size_t len) 857 { 858 struct usb_ep *ep; 859 u32 tag; 860 int value, length = len; 861 862 if (data->state != STATE_EP_READY) { 863 value = -EL2HLT; 864 goto fail; 865 } 866 867 value = len; 868 if (len < USB_DT_ENDPOINT_SIZE + 4) 869 goto fail0; 870 871 /* we might need to change message format someday */ 872 memcpy(&tag, buf, 4); 873 if (tag != 1) { 874 DBG(data->dev, "config %s, bad tag %d\n", data->name, tag); 875 goto fail0; 876 } 877 buf += 4; 878 len -= 4; 879 880 /* NOTE: audio endpoint extensions not accepted here; 881 * just don't include the extra bytes. 882 */ 883 884 /* full/low speed descriptor, then high speed */ 885 memcpy(&data->desc, buf, USB_DT_ENDPOINT_SIZE); 886 if (data->desc.bLength != USB_DT_ENDPOINT_SIZE 887 || data->desc.bDescriptorType != USB_DT_ENDPOINT) 888 goto fail0; 889 if (len != USB_DT_ENDPOINT_SIZE) { 890 if (len != 2 * USB_DT_ENDPOINT_SIZE) 891 goto fail0; 892 memcpy(&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE, 893 USB_DT_ENDPOINT_SIZE); 894 if (data->hs_desc.bLength != USB_DT_ENDPOINT_SIZE 895 || data->hs_desc.bDescriptorType 896 != USB_DT_ENDPOINT) { 897 DBG(data->dev, "config %s, bad hs length or type\n", 898 data->name); 899 goto fail0; 900 } 901 } 902 903 spin_lock_irq (&data->dev->lock); 904 if (data->dev->state == STATE_DEV_UNBOUND) { 905 value = -ENOENT; 906 goto gone; 907 } else { 908 ep = data->ep; 909 if (ep == NULL) { 910 value = -ENODEV; 911 goto gone; 912 } 913 } 914 switch (data->dev->gadget->speed) { 915 case USB_SPEED_LOW: 916 case USB_SPEED_FULL: 917 ep->desc = &data->desc; 918 break; 919 case USB_SPEED_HIGH: 920 /* fails if caller didn't provide that descriptor... */ 921 ep->desc = &data->hs_desc; 922 break; 923 default: 924 DBG(data->dev, "unconnected, %s init abandoned\n", 925 data->name); 926 value = -EINVAL; 927 goto gone; 928 } 929 value = usb_ep_enable(ep); 930 if (value == 0) { 931 data->state = STATE_EP_ENABLED; 932 value = length; 933 } 934 gone: 935 spin_unlock_irq (&data->dev->lock); 936 if (value < 0) { 937 fail: 938 data->desc.bDescriptorType = 0; 939 data->hs_desc.bDescriptorType = 0; 940 } 941 return value; 942 fail0: 943 value = -EINVAL; 944 goto fail; 945 } 946 947 static int 948 ep_open (struct inode *inode, struct file *fd) 949 { 950 struct ep_data *data = inode->i_private; 951 int value = -EBUSY; 952 953 if (mutex_lock_interruptible(&data->lock) != 0) 954 return -EINTR; 955 spin_lock_irq (&data->dev->lock); 956 if (data->dev->state == STATE_DEV_UNBOUND) 957 value = -ENOENT; 958 else if (data->state == STATE_EP_DISABLED) { 959 value = 0; 960 data->state = STATE_EP_READY; 961 get_ep (data); 962 fd->private_data = data; 963 VDEBUG (data->dev, "%s ready\n", data->name); 964 } else 965 DBG (data->dev, "%s state %d\n", 966 data->name, data->state); 967 spin_unlock_irq (&data->dev->lock); 968 mutex_unlock(&data->lock); 969 return value; 970 } 971 972 /*----------------------------------------------------------------------*/ 973 974 /* EP0 IMPLEMENTATION can be partly in userspace. 975 * 976 * Drivers that use this facility receive various events, including 977 * control requests the kernel doesn't handle. Drivers that don't 978 * use this facility may be too simple-minded for real applications. 979 */ 980 981 static inline void ep0_readable (struct dev_data *dev) 982 { 983 wake_up (&dev->wait); 984 kill_fasync (&dev->fasync, SIGIO, POLL_IN); 985 } 986 987 static void clean_req (struct usb_ep *ep, struct usb_request *req) 988 { 989 struct dev_data *dev = ep->driver_data; 990 991 if (req->buf != dev->rbuf) { 992 kfree(req->buf); 993 req->buf = dev->rbuf; 994 } 995 req->complete = epio_complete; 996 dev->setup_out_ready = 0; 997 } 998 999 static void ep0_complete (struct usb_ep *ep, struct usb_request *req) 1000 { 1001 struct dev_data *dev = ep->driver_data; 1002 unsigned long flags; 1003 int free = 1; 1004 1005 /* for control OUT, data must still get to userspace */ 1006 spin_lock_irqsave(&dev->lock, flags); 1007 if (!dev->setup_in) { 1008 dev->setup_out_error = (req->status != 0); 1009 if (!dev->setup_out_error) 1010 free = 0; 1011 dev->setup_out_ready = 1; 1012 ep0_readable (dev); 1013 } 1014 1015 /* clean up as appropriate */ 1016 if (free && req->buf != &dev->rbuf) 1017 clean_req (ep, req); 1018 req->complete = epio_complete; 1019 spin_unlock_irqrestore(&dev->lock, flags); 1020 } 1021 1022 static int setup_req (struct usb_ep *ep, struct usb_request *req, u16 len) 1023 { 1024 struct dev_data *dev = ep->driver_data; 1025 1026 if (dev->setup_out_ready) { 1027 DBG (dev, "ep0 request busy!\n"); 1028 return -EBUSY; 1029 } 1030 if (len > sizeof (dev->rbuf)) 1031 req->buf = kmalloc(len, GFP_ATOMIC); 1032 if (req->buf == NULL) { 1033 req->buf = dev->rbuf; 1034 return -ENOMEM; 1035 } 1036 req->complete = ep0_complete; 1037 req->length = len; 1038 req->zero = 0; 1039 return 0; 1040 } 1041 1042 static ssize_t 1043 ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) 1044 { 1045 struct dev_data *dev = fd->private_data; 1046 ssize_t retval; 1047 enum ep0_state state; 1048 1049 spin_lock_irq (&dev->lock); 1050 if (dev->state <= STATE_DEV_OPENED) { 1051 retval = -EINVAL; 1052 goto done; 1053 } 1054 1055 /* report fd mode change before acting on it */ 1056 if (dev->setup_abort) { 1057 dev->setup_abort = 0; 1058 retval = -EIDRM; 1059 goto done; 1060 } 1061 1062 /* control DATA stage */ 1063 if ((state = dev->state) == STATE_DEV_SETUP) { 1064 1065 if (dev->setup_in) { /* stall IN */ 1066 VDEBUG(dev, "ep0in stall\n"); 1067 (void) usb_ep_set_halt (dev->gadget->ep0); 1068 retval = -EL2HLT; 1069 dev->state = STATE_DEV_CONNECTED; 1070 1071 } else if (len == 0) { /* ack SET_CONFIGURATION etc */ 1072 struct usb_ep *ep = dev->gadget->ep0; 1073 struct usb_request *req = dev->req; 1074 1075 if ((retval = setup_req (ep, req, 0)) == 0) { 1076 ++dev->udc_usage; 1077 spin_unlock_irq (&dev->lock); 1078 retval = usb_ep_queue (ep, req, GFP_KERNEL); 1079 spin_lock_irq (&dev->lock); 1080 --dev->udc_usage; 1081 } 1082 dev->state = STATE_DEV_CONNECTED; 1083 1084 /* assume that was SET_CONFIGURATION */ 1085 if (dev->current_config) { 1086 unsigned power; 1087 1088 if (gadget_is_dualspeed(dev->gadget) 1089 && (dev->gadget->speed 1090 == USB_SPEED_HIGH)) 1091 power = dev->hs_config->bMaxPower; 1092 else 1093 power = dev->config->bMaxPower; 1094 usb_gadget_vbus_draw(dev->gadget, 2 * power); 1095 } 1096 1097 } else { /* collect OUT data */ 1098 if ((fd->f_flags & O_NONBLOCK) != 0 1099 && !dev->setup_out_ready) { 1100 retval = -EAGAIN; 1101 goto done; 1102 } 1103 spin_unlock_irq (&dev->lock); 1104 retval = wait_event_interruptible (dev->wait, 1105 dev->setup_out_ready != 0); 1106 1107 /* FIXME state could change from under us */ 1108 spin_lock_irq (&dev->lock); 1109 if (retval) 1110 goto done; 1111 1112 if (dev->state != STATE_DEV_SETUP) { 1113 retval = -ECANCELED; 1114 goto done; 1115 } 1116 dev->state = STATE_DEV_CONNECTED; 1117 1118 if (dev->setup_out_error) 1119 retval = -EIO; 1120 else { 1121 len = min (len, (size_t)dev->req->actual); 1122 ++dev->udc_usage; 1123 spin_unlock_irq(&dev->lock); 1124 if (copy_to_user (buf, dev->req->buf, len)) 1125 retval = -EFAULT; 1126 else 1127 retval = len; 1128 spin_lock_irq(&dev->lock); 1129 --dev->udc_usage; 1130 clean_req (dev->gadget->ep0, dev->req); 1131 /* NOTE userspace can't yet choose to stall */ 1132 } 1133 } 1134 goto done; 1135 } 1136 1137 /* else normal: return event data */ 1138 if (len < sizeof dev->event [0]) { 1139 retval = -EINVAL; 1140 goto done; 1141 } 1142 len -= len % sizeof (struct usb_gadgetfs_event); 1143 dev->usermode_setup = 1; 1144 1145 scan: 1146 /* return queued events right away */ 1147 if (dev->ev_next != 0) { 1148 unsigned i, n; 1149 1150 n = len / sizeof (struct usb_gadgetfs_event); 1151 if (dev->ev_next < n) 1152 n = dev->ev_next; 1153 1154 /* ep0 i/o has special semantics during STATE_DEV_SETUP */ 1155 for (i = 0; i < n; i++) { 1156 if (dev->event [i].type == GADGETFS_SETUP) { 1157 dev->state = STATE_DEV_SETUP; 1158 n = i + 1; 1159 break; 1160 } 1161 } 1162 spin_unlock_irq (&dev->lock); 1163 len = n * sizeof (struct usb_gadgetfs_event); 1164 if (copy_to_user (buf, &dev->event, len)) 1165 retval = -EFAULT; 1166 else 1167 retval = len; 1168 if (len > 0) { 1169 /* NOTE this doesn't guard against broken drivers; 1170 * concurrent ep0 readers may lose events. 1171 */ 1172 spin_lock_irq (&dev->lock); 1173 if (dev->ev_next > n) { 1174 memmove(&dev->event[0], &dev->event[n], 1175 sizeof (struct usb_gadgetfs_event) 1176 * (dev->ev_next - n)); 1177 } 1178 dev->ev_next -= n; 1179 spin_unlock_irq (&dev->lock); 1180 } 1181 return retval; 1182 } 1183 if (fd->f_flags & O_NONBLOCK) { 1184 retval = -EAGAIN; 1185 goto done; 1186 } 1187 1188 switch (state) { 1189 default: 1190 DBG (dev, "fail %s, state %d\n", __func__, state); 1191 retval = -ESRCH; 1192 break; 1193 case STATE_DEV_UNCONNECTED: 1194 case STATE_DEV_CONNECTED: 1195 spin_unlock_irq (&dev->lock); 1196 DBG (dev, "%s wait\n", __func__); 1197 1198 /* wait for events */ 1199 retval = wait_event_interruptible (dev->wait, 1200 dev->ev_next != 0); 1201 if (retval < 0) 1202 return retval; 1203 spin_lock_irq (&dev->lock); 1204 goto scan; 1205 } 1206 1207 done: 1208 spin_unlock_irq (&dev->lock); 1209 return retval; 1210 } 1211 1212 static struct usb_gadgetfs_event * 1213 next_event (struct dev_data *dev, enum usb_gadgetfs_event_type type) 1214 { 1215 struct usb_gadgetfs_event *event; 1216 unsigned i; 1217 1218 switch (type) { 1219 /* these events purge the queue */ 1220 case GADGETFS_DISCONNECT: 1221 if (dev->state == STATE_DEV_SETUP) 1222 dev->setup_abort = 1; 1223 fallthrough; 1224 case GADGETFS_CONNECT: 1225 dev->ev_next = 0; 1226 break; 1227 case GADGETFS_SETUP: /* previous request timed out */ 1228 case GADGETFS_SUSPEND: /* same effect */ 1229 /* these events can't be repeated */ 1230 for (i = 0; i != dev->ev_next; i++) { 1231 if (dev->event [i].type != type) 1232 continue; 1233 DBG(dev, "discard old event[%d] %d\n", i, type); 1234 dev->ev_next--; 1235 if (i == dev->ev_next) 1236 break; 1237 /* indices start at zero, for simplicity */ 1238 memmove (&dev->event [i], &dev->event [i + 1], 1239 sizeof (struct usb_gadgetfs_event) 1240 * (dev->ev_next - i)); 1241 } 1242 break; 1243 default: 1244 BUG (); 1245 } 1246 VDEBUG(dev, "event[%d] = %d\n", dev->ev_next, type); 1247 event = &dev->event [dev->ev_next++]; 1248 BUG_ON (dev->ev_next > N_EVENT); 1249 memset (event, 0, sizeof *event); 1250 event->type = type; 1251 return event; 1252 } 1253 1254 static ssize_t 1255 ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) 1256 { 1257 struct dev_data *dev = fd->private_data; 1258 ssize_t retval = -ESRCH; 1259 1260 /* report fd mode change before acting on it */ 1261 if (dev->setup_abort) { 1262 dev->setup_abort = 0; 1263 retval = -EIDRM; 1264 1265 /* data and/or status stage for control request */ 1266 } else if (dev->state == STATE_DEV_SETUP) { 1267 1268 len = min_t(size_t, len, dev->setup_wLength); 1269 if (dev->setup_in) { 1270 retval = setup_req (dev->gadget->ep0, dev->req, len); 1271 if (retval == 0) { 1272 dev->state = STATE_DEV_CONNECTED; 1273 ++dev->udc_usage; 1274 spin_unlock_irq (&dev->lock); 1275 if (copy_from_user (dev->req->buf, buf, len)) 1276 retval = -EFAULT; 1277 else { 1278 if (len < dev->setup_wLength) 1279 dev->req->zero = 1; 1280 retval = usb_ep_queue ( 1281 dev->gadget->ep0, dev->req, 1282 GFP_KERNEL); 1283 } 1284 spin_lock_irq(&dev->lock); 1285 --dev->udc_usage; 1286 if (retval < 0) { 1287 clean_req (dev->gadget->ep0, dev->req); 1288 } else 1289 retval = len; 1290 1291 return retval; 1292 } 1293 1294 /* can stall some OUT transfers */ 1295 } else if (dev->setup_can_stall) { 1296 VDEBUG(dev, "ep0out stall\n"); 1297 (void) usb_ep_set_halt (dev->gadget->ep0); 1298 retval = -EL2HLT; 1299 dev->state = STATE_DEV_CONNECTED; 1300 } else { 1301 DBG(dev, "bogus ep0out stall!\n"); 1302 } 1303 } else 1304 DBG (dev, "fail %s, state %d\n", __func__, dev->state); 1305 1306 return retval; 1307 } 1308 1309 static int 1310 ep0_fasync (int f, struct file *fd, int on) 1311 { 1312 struct dev_data *dev = fd->private_data; 1313 // caller must F_SETOWN before signal delivery happens 1314 VDEBUG(dev, "%s %s\n", __func__, str_on_off(on)); 1315 return fasync_helper (f, fd, on, &dev->fasync); 1316 } 1317 1318 static struct usb_gadget_driver gadgetfs_driver; 1319 1320 static int 1321 dev_release (struct inode *inode, struct file *fd) 1322 { 1323 struct dev_data *dev = fd->private_data; 1324 1325 /* closing ep0 === shutdown all */ 1326 1327 if (dev->gadget_registered) { 1328 usb_gadget_unregister_driver (&gadgetfs_driver); 1329 dev->gadget_registered = false; 1330 } 1331 1332 /* at this point "good" hardware has disconnected the 1333 * device from USB; the host won't see it any more. 1334 * alternatively, all host requests will time out. 1335 */ 1336 1337 kfree (dev->buf); 1338 dev->buf = NULL; 1339 1340 /* other endpoints were all decoupled from this device */ 1341 spin_lock_irq(&dev->lock); 1342 dev->state = STATE_DEV_DISABLED; 1343 spin_unlock_irq(&dev->lock); 1344 1345 put_dev (dev); 1346 return 0; 1347 } 1348 1349 static __poll_t 1350 ep0_poll (struct file *fd, poll_table *wait) 1351 { 1352 struct dev_data *dev = fd->private_data; 1353 __poll_t mask = 0; 1354 1355 if (dev->state <= STATE_DEV_OPENED) 1356 return DEFAULT_POLLMASK; 1357 1358 poll_wait(fd, &dev->wait, wait); 1359 1360 spin_lock_irq(&dev->lock); 1361 1362 /* report fd mode change before acting on it */ 1363 if (dev->setup_abort) { 1364 dev->setup_abort = 0; 1365 mask = EPOLLHUP; 1366 goto out; 1367 } 1368 1369 if (dev->state == STATE_DEV_SETUP) { 1370 if (dev->setup_in || dev->setup_can_stall) 1371 mask = EPOLLOUT; 1372 } else { 1373 if (dev->ev_next != 0) 1374 mask = EPOLLIN; 1375 } 1376 out: 1377 spin_unlock_irq(&dev->lock); 1378 return mask; 1379 } 1380 1381 static long gadget_dev_ioctl (struct file *fd, unsigned code, unsigned long value) 1382 { 1383 struct dev_data *dev = fd->private_data; 1384 struct usb_gadget *gadget; 1385 long ret = -ENOTTY; 1386 1387 spin_lock_irq(&dev->lock); 1388 gadget = dev->gadget; 1389 if (dev->state == STATE_DEV_OPENED || 1390 dev->state == STATE_DEV_UNBOUND) { 1391 /* Not bound to a UDC */ 1392 } else if (gadget->ops->ioctl) { 1393 ++dev->udc_usage; 1394 spin_unlock_irq(&dev->lock); 1395 1396 ret = gadget->ops->ioctl (gadget, code, value); 1397 1398 spin_lock_irq(&dev->lock); 1399 --dev->udc_usage; 1400 } 1401 spin_unlock_irq(&dev->lock); 1402 1403 return ret; 1404 } 1405 1406 /*----------------------------------------------------------------------*/ 1407 1408 /* The in-kernel gadget driver handles most ep0 issues, in particular 1409 * enumerating the single configuration (as provided from user space). 1410 * 1411 * Unrecognized ep0 requests may be handled in user space. 1412 */ 1413 1414 static void make_qualifier (struct dev_data *dev) 1415 { 1416 struct usb_qualifier_descriptor qual; 1417 struct usb_device_descriptor *desc; 1418 1419 qual.bLength = sizeof qual; 1420 qual.bDescriptorType = USB_DT_DEVICE_QUALIFIER; 1421 qual.bcdUSB = cpu_to_le16 (0x0200); 1422 1423 desc = dev->dev; 1424 qual.bDeviceClass = desc->bDeviceClass; 1425 qual.bDeviceSubClass = desc->bDeviceSubClass; 1426 qual.bDeviceProtocol = desc->bDeviceProtocol; 1427 1428 /* assumes ep0 uses the same value for both speeds ... */ 1429 qual.bMaxPacketSize0 = dev->gadget->ep0->maxpacket; 1430 1431 qual.bNumConfigurations = 1; 1432 qual.bRESERVED = 0; 1433 1434 memcpy (dev->rbuf, &qual, sizeof qual); 1435 } 1436 1437 static int 1438 config_buf (struct dev_data *dev, u8 type, unsigned index) 1439 { 1440 int len; 1441 int hs = 0; 1442 1443 /* only one configuration */ 1444 if (index > 0) 1445 return -EINVAL; 1446 1447 if (gadget_is_dualspeed(dev->gadget)) { 1448 hs = (dev->gadget->speed == USB_SPEED_HIGH); 1449 if (type == USB_DT_OTHER_SPEED_CONFIG) 1450 hs = !hs; 1451 } 1452 if (hs) { 1453 dev->req->buf = dev->hs_config; 1454 len = le16_to_cpu(dev->hs_config->wTotalLength); 1455 } else { 1456 dev->req->buf = dev->config; 1457 len = le16_to_cpu(dev->config->wTotalLength); 1458 } 1459 ((u8 *)dev->req->buf) [1] = type; 1460 return len; 1461 } 1462 1463 static int 1464 gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) 1465 { 1466 struct dev_data *dev = get_gadget_data (gadget); 1467 struct usb_request *req = dev->req; 1468 int value = -EOPNOTSUPP; 1469 struct usb_gadgetfs_event *event; 1470 u16 w_value = le16_to_cpu(ctrl->wValue); 1471 u16 w_length = le16_to_cpu(ctrl->wLength); 1472 1473 if (w_length > RBUF_SIZE) { 1474 if (ctrl->bRequestType & USB_DIR_IN) { 1475 /* Cast away the const, we are going to overwrite on purpose. */ 1476 __le16 *temp = (__le16 *)&ctrl->wLength; 1477 1478 *temp = cpu_to_le16(RBUF_SIZE); 1479 w_length = RBUF_SIZE; 1480 } else { 1481 return value; 1482 } 1483 } 1484 1485 spin_lock (&dev->lock); 1486 dev->setup_abort = 0; 1487 if (dev->state == STATE_DEV_UNCONNECTED) { 1488 if (gadget_is_dualspeed(gadget) 1489 && gadget->speed == USB_SPEED_HIGH 1490 && dev->hs_config == NULL) { 1491 spin_unlock(&dev->lock); 1492 ERROR (dev, "no high speed config??\n"); 1493 return -EINVAL; 1494 } 1495 1496 dev->state = STATE_DEV_CONNECTED; 1497 1498 INFO (dev, "connected\n"); 1499 event = next_event (dev, GADGETFS_CONNECT); 1500 event->u.speed = gadget->speed; 1501 ep0_readable (dev); 1502 1503 /* host may have given up waiting for response. we can miss control 1504 * requests handled lower down (device/endpoint status and features); 1505 * then ep0_{read,write} will report the wrong status. controller 1506 * driver will have aborted pending i/o. 1507 */ 1508 } else if (dev->state == STATE_DEV_SETUP) 1509 dev->setup_abort = 1; 1510 1511 req->buf = dev->rbuf; 1512 req->context = NULL; 1513 switch (ctrl->bRequest) { 1514 1515 case USB_REQ_GET_DESCRIPTOR: 1516 if (ctrl->bRequestType != USB_DIR_IN) 1517 goto unrecognized; 1518 switch (w_value >> 8) { 1519 1520 case USB_DT_DEVICE: 1521 value = min (w_length, (u16) sizeof *dev->dev); 1522 dev->dev->bMaxPacketSize0 = dev->gadget->ep0->maxpacket; 1523 req->buf = dev->dev; 1524 break; 1525 case USB_DT_DEVICE_QUALIFIER: 1526 if (!dev->hs_config) 1527 break; 1528 value = min (w_length, (u16) 1529 sizeof (struct usb_qualifier_descriptor)); 1530 make_qualifier (dev); 1531 break; 1532 case USB_DT_OTHER_SPEED_CONFIG: 1533 case USB_DT_CONFIG: 1534 value = config_buf (dev, 1535 w_value >> 8, 1536 w_value & 0xff); 1537 if (value >= 0) 1538 value = min (w_length, (u16) value); 1539 break; 1540 case USB_DT_STRING: 1541 goto unrecognized; 1542 1543 default: // all others are errors 1544 break; 1545 } 1546 break; 1547 1548 /* currently one config, two speeds */ 1549 case USB_REQ_SET_CONFIGURATION: 1550 if (ctrl->bRequestType != 0) 1551 goto unrecognized; 1552 if (0 == (u8) w_value) { 1553 value = 0; 1554 dev->current_config = 0; 1555 usb_gadget_vbus_draw(gadget, 8 /* mA */ ); 1556 // user mode expected to disable endpoints 1557 } else { 1558 u8 config, power; 1559 1560 if (gadget_is_dualspeed(gadget) 1561 && gadget->speed == USB_SPEED_HIGH) { 1562 config = dev->hs_config->bConfigurationValue; 1563 power = dev->hs_config->bMaxPower; 1564 } else { 1565 config = dev->config->bConfigurationValue; 1566 power = dev->config->bMaxPower; 1567 } 1568 1569 if (config == (u8) w_value) { 1570 value = 0; 1571 dev->current_config = config; 1572 usb_gadget_vbus_draw(gadget, 2 * power); 1573 } 1574 } 1575 1576 /* report SET_CONFIGURATION like any other control request, 1577 * except that usermode may not stall this. the next 1578 * request mustn't be allowed start until this finishes: 1579 * endpoints and threads set up, etc. 1580 * 1581 * NOTE: older PXA hardware (before PXA 255: without UDCCFR) 1582 * has bad/racey automagic that prevents synchronizing here. 1583 * even kernel mode drivers often miss them. 1584 */ 1585 if (value == 0) { 1586 INFO (dev, "configuration #%d\n", dev->current_config); 1587 usb_gadget_set_state(gadget, USB_STATE_CONFIGURED); 1588 if (dev->usermode_setup) { 1589 dev->setup_can_stall = 0; 1590 goto delegate; 1591 } 1592 } 1593 break; 1594 1595 #ifndef CONFIG_USB_PXA25X 1596 /* PXA automagically handles this request too */ 1597 case USB_REQ_GET_CONFIGURATION: 1598 if (ctrl->bRequestType != 0x80) 1599 goto unrecognized; 1600 *(u8 *)req->buf = dev->current_config; 1601 value = min (w_length, (u16) 1); 1602 break; 1603 #endif 1604 1605 default: 1606 unrecognized: 1607 VDEBUG (dev, "%s req%02x.%02x v%04x i%04x l%d\n", 1608 dev->usermode_setup ? "delegate" : "fail", 1609 ctrl->bRequestType, ctrl->bRequest, 1610 w_value, le16_to_cpu(ctrl->wIndex), w_length); 1611 1612 /* if there's an ep0 reader, don't stall */ 1613 if (dev->usermode_setup) { 1614 dev->setup_can_stall = 1; 1615 delegate: 1616 dev->setup_in = (ctrl->bRequestType & USB_DIR_IN) 1617 ? 1 : 0; 1618 dev->setup_wLength = w_length; 1619 dev->setup_out_ready = 0; 1620 dev->setup_out_error = 0; 1621 1622 /* read DATA stage for OUT right away */ 1623 if (unlikely (!dev->setup_in && w_length)) { 1624 value = setup_req (gadget->ep0, dev->req, 1625 w_length); 1626 if (value < 0) 1627 break; 1628 1629 ++dev->udc_usage; 1630 spin_unlock (&dev->lock); 1631 value = usb_ep_queue (gadget->ep0, dev->req, 1632 GFP_KERNEL); 1633 spin_lock (&dev->lock); 1634 --dev->udc_usage; 1635 if (value < 0) { 1636 clean_req (gadget->ep0, dev->req); 1637 break; 1638 } 1639 1640 /* we can't currently stall these */ 1641 dev->setup_can_stall = 0; 1642 } 1643 1644 /* state changes when reader collects event */ 1645 event = next_event (dev, GADGETFS_SETUP); 1646 event->u.setup = *ctrl; 1647 ep0_readable (dev); 1648 spin_unlock (&dev->lock); 1649 /* 1650 * Return USB_GADGET_DELAYED_STATUS as a workaround to 1651 * stop some UDC drivers (e.g. dwc3) from automatically 1652 * proceeding with the status stage for 0-length 1653 * transfers. 1654 * Should be removed once all UDC drivers are fixed to 1655 * always delay the status stage until a response is 1656 * queued to EP0. 1657 */ 1658 return w_length == 0 ? USB_GADGET_DELAYED_STATUS : 0; 1659 } 1660 } 1661 1662 /* proceed with data transfer and status phases? */ 1663 if (value >= 0 && dev->state != STATE_DEV_SETUP) { 1664 req->length = value; 1665 req->zero = value < w_length; 1666 1667 ++dev->udc_usage; 1668 spin_unlock (&dev->lock); 1669 value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL); 1670 spin_lock(&dev->lock); 1671 --dev->udc_usage; 1672 spin_unlock(&dev->lock); 1673 if (value < 0) { 1674 DBG (dev, "ep_queue --> %d\n", value); 1675 req->status = 0; 1676 } 1677 return value; 1678 } 1679 1680 /* device stalls when value < 0 */ 1681 spin_unlock (&dev->lock); 1682 return value; 1683 } 1684 1685 static void destroy_ep_files (struct dev_data *dev) 1686 { 1687 DBG (dev, "%s %d\n", __func__, dev->state); 1688 1689 /* dev->state must prevent interference */ 1690 spin_lock_irq (&dev->lock); 1691 while (!list_empty(&dev->epfiles)) { 1692 struct ep_data *ep; 1693 1694 /* break link to FS */ 1695 ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles); 1696 list_del_init (&ep->epfiles); 1697 spin_unlock_irq (&dev->lock); 1698 1699 /* break link to controller */ 1700 mutex_lock(&ep->lock); 1701 if (ep->state == STATE_EP_ENABLED) 1702 (void) usb_ep_disable (ep->ep); 1703 ep->state = STATE_EP_UNBOUND; 1704 usb_ep_free_request (ep->ep, ep->req); 1705 ep->ep = NULL; 1706 mutex_unlock(&ep->lock); 1707 1708 wake_up (&ep->wait); 1709 1710 /* break link to dcache */ 1711 simple_remove_by_name(dev->sb->s_root, ep->name, NULL); 1712 1713 put_ep (ep); 1714 1715 spin_lock_irq (&dev->lock); 1716 } 1717 spin_unlock_irq (&dev->lock); 1718 } 1719 1720 1721 static int gadgetfs_create_file (struct super_block *sb, char const *name, 1722 void *data, const struct file_operations *fops); 1723 1724 static int activate_ep_files (struct dev_data *dev) 1725 { 1726 struct usb_ep *ep; 1727 struct ep_data *data; 1728 int err; 1729 1730 gadget_for_each_ep (ep, dev->gadget) { 1731 1732 data = kzalloc_obj(*data); 1733 if (!data) 1734 goto enomem0; 1735 data->state = STATE_EP_DISABLED; 1736 mutex_init(&data->lock); 1737 init_waitqueue_head (&data->wait); 1738 1739 strscpy(data->name, ep->name); 1740 refcount_set (&data->count, 1); 1741 data->dev = dev; 1742 get_dev (dev); 1743 1744 data->ep = ep; 1745 ep->driver_data = data; 1746 1747 data->req = usb_ep_alloc_request (ep, GFP_KERNEL); 1748 if (!data->req) 1749 goto enomem1; 1750 1751 err = gadgetfs_create_file (dev->sb, data->name, 1752 data, &ep_io_operations); 1753 if (err) 1754 goto enomem2; 1755 list_add_tail (&data->epfiles, &dev->epfiles); 1756 } 1757 return 0; 1758 1759 enomem2: 1760 usb_ep_free_request (ep, data->req); 1761 enomem1: 1762 put_dev (dev); 1763 kfree (data); 1764 enomem0: 1765 DBG (dev, "%s enomem\n", __func__); 1766 destroy_ep_files (dev); 1767 return -ENOMEM; 1768 } 1769 1770 static void 1771 gadgetfs_unbind (struct usb_gadget *gadget) 1772 { 1773 struct dev_data *dev = get_gadget_data (gadget); 1774 1775 DBG (dev, "%s\n", __func__); 1776 1777 spin_lock_irq (&dev->lock); 1778 dev->state = STATE_DEV_UNBOUND; 1779 while (dev->udc_usage > 0) { 1780 spin_unlock_irq(&dev->lock); 1781 usleep_range(1000, 2000); 1782 spin_lock_irq(&dev->lock); 1783 } 1784 spin_unlock_irq (&dev->lock); 1785 1786 destroy_ep_files (dev); 1787 gadget->ep0->driver_data = NULL; 1788 set_gadget_data (gadget, NULL); 1789 1790 /* we've already been disconnected ... no i/o is active */ 1791 if (dev->req) 1792 usb_ep_free_request (gadget->ep0, dev->req); 1793 DBG (dev, "%s done\n", __func__); 1794 put_dev (dev); 1795 } 1796 1797 static struct dev_data *the_device; 1798 1799 static int gadgetfs_bind(struct usb_gadget *gadget, 1800 struct usb_gadget_driver *driver) 1801 { 1802 struct dev_data *dev = the_device; 1803 1804 if (!dev) 1805 return -ESRCH; 1806 if (0 != strcmp (CHIP, gadget->name)) { 1807 pr_err("%s expected %s controller not %s\n", 1808 shortname, CHIP, gadget->name); 1809 return -ENODEV; 1810 } 1811 1812 set_gadget_data (gadget, dev); 1813 dev->gadget = gadget; 1814 gadget->ep0->driver_data = dev; 1815 1816 get_dev (dev); 1817 1818 /* preallocate control response and buffer */ 1819 dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL); 1820 if (!dev->req) 1821 goto enomem; 1822 dev->req->context = NULL; 1823 dev->req->complete = epio_complete; 1824 1825 if (activate_ep_files (dev) < 0) 1826 goto enomem; 1827 1828 INFO (dev, "bound to %s driver\n", gadget->name); 1829 spin_lock_irq(&dev->lock); 1830 dev->state = STATE_DEV_UNCONNECTED; 1831 spin_unlock_irq(&dev->lock); 1832 return 0; 1833 1834 enomem: 1835 gadgetfs_unbind (gadget); 1836 return -ENOMEM; 1837 } 1838 1839 static void 1840 gadgetfs_disconnect (struct usb_gadget *gadget) 1841 { 1842 struct dev_data *dev = get_gadget_data (gadget); 1843 unsigned long flags; 1844 1845 spin_lock_irqsave (&dev->lock, flags); 1846 if (dev->state == STATE_DEV_UNCONNECTED) 1847 goto exit; 1848 dev->state = STATE_DEV_UNCONNECTED; 1849 1850 INFO (dev, "disconnected\n"); 1851 next_event (dev, GADGETFS_DISCONNECT); 1852 ep0_readable (dev); 1853 exit: 1854 spin_unlock_irqrestore (&dev->lock, flags); 1855 } 1856 1857 static void 1858 gadgetfs_suspend (struct usb_gadget *gadget) 1859 { 1860 struct dev_data *dev = get_gadget_data (gadget); 1861 unsigned long flags; 1862 1863 INFO (dev, "suspended from state %d\n", dev->state); 1864 spin_lock_irqsave(&dev->lock, flags); 1865 switch (dev->state) { 1866 case STATE_DEV_SETUP: // VERY odd... host died?? 1867 case STATE_DEV_CONNECTED: 1868 case STATE_DEV_UNCONNECTED: 1869 next_event (dev, GADGETFS_SUSPEND); 1870 ep0_readable (dev); 1871 fallthrough; 1872 default: 1873 break; 1874 } 1875 spin_unlock_irqrestore(&dev->lock, flags); 1876 } 1877 1878 static struct usb_gadget_driver gadgetfs_driver = { 1879 .function = (char *) driver_desc, 1880 .bind = gadgetfs_bind, 1881 .unbind = gadgetfs_unbind, 1882 .setup = gadgetfs_setup, 1883 .reset = gadgetfs_disconnect, 1884 .disconnect = gadgetfs_disconnect, 1885 .suspend = gadgetfs_suspend, 1886 1887 .driver = { 1888 .name = shortname, 1889 }, 1890 }; 1891 1892 /*----------------------------------------------------------------------*/ 1893 /* DEVICE INITIALIZATION 1894 * 1895 * fd = open ("/dev/gadget/$CHIP", O_RDWR) 1896 * status = write (fd, descriptors, sizeof descriptors) 1897 * 1898 * That write establishes the device configuration, so the kernel can 1899 * bind to the controller ... guaranteeing it can handle enumeration 1900 * at all necessary speeds. Descriptor order is: 1901 * 1902 * . message tag (u32, host order) ... for now, must be zero; it 1903 * would change to support features like multi-config devices 1904 * . full/low speed config ... all wTotalLength bytes (with interface, 1905 * class, altsetting, endpoint, and other descriptors) 1906 * . high speed config ... all descriptors, for high speed operation; 1907 * this one's optional except for high-speed hardware 1908 * . device descriptor 1909 * 1910 * Endpoints are not yet enabled. Drivers must wait until device 1911 * configuration and interface altsetting changes create 1912 * the need to configure (or unconfigure) them. 1913 * 1914 * After initialization, the device stays active for as long as that 1915 * $CHIP file is open. Events must then be read from that descriptor, 1916 * such as configuration notifications. 1917 */ 1918 1919 static int is_valid_config(struct usb_config_descriptor *config, 1920 unsigned int total) 1921 { 1922 return config->bDescriptorType == USB_DT_CONFIG 1923 && config->bLength == USB_DT_CONFIG_SIZE 1924 && total >= USB_DT_CONFIG_SIZE 1925 && config->bConfigurationValue != 0 1926 && (config->bmAttributes & USB_CONFIG_ATT_ONE) != 0 1927 && (config->bmAttributes & USB_CONFIG_ATT_WAKEUP) == 0; 1928 /* FIXME if gadget->is_otg, _must_ include an otg descriptor */ 1929 /* FIXME check lengths: walk to end */ 1930 } 1931 1932 static ssize_t 1933 dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) 1934 { 1935 struct dev_data *dev = fd->private_data; 1936 ssize_t value, length = len; 1937 unsigned total; 1938 u32 tag; 1939 char *kbuf; 1940 1941 spin_lock_irq(&dev->lock); 1942 if (dev->state > STATE_DEV_OPENED) { 1943 value = ep0_write(fd, buf, len, ptr); 1944 spin_unlock_irq(&dev->lock); 1945 return value; 1946 } 1947 spin_unlock_irq(&dev->lock); 1948 1949 if ((len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4)) || 1950 (len > PAGE_SIZE * 4)) 1951 return -EINVAL; 1952 1953 /* we might need to change message format someday */ 1954 if (copy_from_user (&tag, buf, 4)) 1955 return -EFAULT; 1956 if (tag != 0) 1957 return -EINVAL; 1958 buf += 4; 1959 length -= 4; 1960 1961 kbuf = memdup_user(buf, length); 1962 if (IS_ERR(kbuf)) 1963 return PTR_ERR(kbuf); 1964 1965 spin_lock_irq (&dev->lock); 1966 value = -EINVAL; 1967 if (dev->buf) { 1968 spin_unlock_irq(&dev->lock); 1969 kfree(kbuf); 1970 return value; 1971 } 1972 dev->buf = kbuf; 1973 1974 /* full or low speed config */ 1975 dev->config = (void *) kbuf; 1976 total = le16_to_cpu(dev->config->wTotalLength); 1977 if (!is_valid_config(dev->config, total) || 1978 total > length - USB_DT_DEVICE_SIZE) 1979 goto fail; 1980 kbuf += total; 1981 length -= total; 1982 1983 /* optional high speed config */ 1984 if (kbuf [1] == USB_DT_CONFIG) { 1985 dev->hs_config = (void *) kbuf; 1986 total = le16_to_cpu(dev->hs_config->wTotalLength); 1987 if (!is_valid_config(dev->hs_config, total) || 1988 total > length - USB_DT_DEVICE_SIZE) 1989 goto fail; 1990 kbuf += total; 1991 length -= total; 1992 } else { 1993 dev->hs_config = NULL; 1994 } 1995 1996 /* could support multiple configs, using another encoding! */ 1997 1998 /* device descriptor (tweaked for paranoia) */ 1999 if (length != USB_DT_DEVICE_SIZE) 2000 goto fail; 2001 dev->dev = (void *)kbuf; 2002 if (dev->dev->bLength != USB_DT_DEVICE_SIZE 2003 || dev->dev->bDescriptorType != USB_DT_DEVICE 2004 || dev->dev->bNumConfigurations != 1) 2005 goto fail; 2006 dev->dev->bcdUSB = cpu_to_le16 (0x0200); 2007 2008 /* triggers gadgetfs_bind(); then we can enumerate. */ 2009 spin_unlock_irq (&dev->lock); 2010 if (dev->hs_config) 2011 gadgetfs_driver.max_speed = USB_SPEED_HIGH; 2012 else 2013 gadgetfs_driver.max_speed = USB_SPEED_FULL; 2014 2015 value = usb_gadget_register_driver(&gadgetfs_driver); 2016 if (value != 0) { 2017 spin_lock_irq(&dev->lock); 2018 goto fail; 2019 } else { 2020 /* at this point "good" hardware has for the first time 2021 * let the USB the host see us. alternatively, if users 2022 * unplug/replug that will clear all the error state. 2023 * 2024 * note: everything running before here was guaranteed 2025 * to choke driver model style diagnostics. from here 2026 * on, they can work ... except in cleanup paths that 2027 * kick in after the ep0 descriptor is closed. 2028 */ 2029 value = len; 2030 dev->gadget_registered = true; 2031 } 2032 return value; 2033 2034 fail: 2035 dev->config = NULL; 2036 dev->hs_config = NULL; 2037 dev->dev = NULL; 2038 spin_unlock_irq (&dev->lock); 2039 pr_debug ("%s: %s fail %zd, %p\n", shortname, __func__, value, dev); 2040 kfree (dev->buf); 2041 dev->buf = NULL; 2042 return value; 2043 } 2044 2045 static int 2046 gadget_dev_open (struct inode *inode, struct file *fd) 2047 { 2048 struct dev_data *dev = inode->i_private; 2049 int value = -EBUSY; 2050 2051 spin_lock_irq(&dev->lock); 2052 if (dev->state == STATE_DEV_DISABLED) { 2053 dev->ev_next = 0; 2054 dev->state = STATE_DEV_OPENED; 2055 fd->private_data = dev; 2056 get_dev (dev); 2057 value = 0; 2058 } 2059 spin_unlock_irq(&dev->lock); 2060 return value; 2061 } 2062 2063 static const struct file_operations ep0_operations = { 2064 2065 .open = gadget_dev_open, 2066 .read = ep0_read, 2067 .write = dev_config, 2068 .fasync = ep0_fasync, 2069 .poll = ep0_poll, 2070 .unlocked_ioctl = gadget_dev_ioctl, 2071 .release = dev_release, 2072 }; 2073 2074 /*----------------------------------------------------------------------*/ 2075 2076 /* FILESYSTEM AND SUPERBLOCK OPERATIONS 2077 * 2078 * Mounting the filesystem creates a controller file, used first for 2079 * device configuration then later for event monitoring. 2080 */ 2081 2082 2083 /* FIXME PAM etc could set this security policy without mount options 2084 * if epfiles inherited ownership and permissons from ep0 ... 2085 */ 2086 2087 static unsigned default_uid; 2088 static unsigned default_gid; 2089 static unsigned default_perm = S_IRUSR | S_IWUSR; 2090 2091 module_param (default_uid, uint, 0644); 2092 module_param (default_gid, uint, 0644); 2093 module_param (default_perm, uint, 0644); 2094 2095 2096 static struct inode * 2097 gadgetfs_make_inode (struct super_block *sb, 2098 void *data, const struct file_operations *fops, 2099 int mode) 2100 { 2101 struct inode *inode = new_inode (sb); 2102 2103 if (inode) { 2104 inode->i_ino = get_next_ino(); 2105 inode->i_mode = mode; 2106 inode->i_uid = make_kuid(&init_user_ns, default_uid); 2107 inode->i_gid = make_kgid(&init_user_ns, default_gid); 2108 simple_inode_init_ts(inode); 2109 inode->i_private = data; 2110 inode->i_fop = fops; 2111 } 2112 return inode; 2113 } 2114 2115 /* creates in fs root directory, so non-renamable and non-linkable. 2116 * so inode and dentry are paired, until device reconfig. 2117 */ 2118 static int gadgetfs_create_file (struct super_block *sb, char const *name, 2119 void *data, const struct file_operations *fops) 2120 { 2121 struct dentry *dentry; 2122 struct inode *inode; 2123 2124 inode = gadgetfs_make_inode (sb, data, fops, 2125 S_IFREG | (default_perm & S_IRWXUGO)); 2126 if (!inode) 2127 return -ENOMEM; 2128 2129 dentry = simple_start_creating(sb->s_root, name); 2130 if (IS_ERR(dentry)) { 2131 iput(inode); 2132 return PTR_ERR(dentry); 2133 } 2134 2135 d_make_persistent(dentry, inode); 2136 2137 simple_done_creating(dentry); 2138 return 0; 2139 } 2140 2141 static const struct super_operations gadget_fs_operations = { 2142 .statfs = simple_statfs, 2143 .drop_inode = inode_just_drop, 2144 }; 2145 2146 static int 2147 gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc) 2148 { 2149 struct inode *inode; 2150 struct dev_data *dev; 2151 int rc; 2152 2153 mutex_lock(&sb_mutex); 2154 2155 if (the_device) { 2156 rc = -ESRCH; 2157 goto Done; 2158 } 2159 2160 CHIP = usb_get_gadget_udc_name(); 2161 if (!CHIP) { 2162 rc = -ENODEV; 2163 goto Done; 2164 } 2165 2166 /* superblock */ 2167 sb->s_blocksize = PAGE_SIZE; 2168 sb->s_blocksize_bits = PAGE_SHIFT; 2169 sb->s_magic = GADGETFS_MAGIC; 2170 sb->s_op = &gadget_fs_operations; 2171 sb->s_time_gran = 1; 2172 2173 /* root inode */ 2174 inode = gadgetfs_make_inode (sb, 2175 NULL, &simple_dir_operations, 2176 S_IFDIR | S_IRUGO | S_IXUGO); 2177 if (!inode) 2178 goto Enomem; 2179 inode->i_op = &simple_dir_inode_operations; 2180 if (!(sb->s_root = d_make_root (inode))) 2181 goto Enomem; 2182 2183 /* the ep0 file is named after the controller we expect; 2184 * user mode code can use it for sanity checks, like we do. 2185 */ 2186 dev = dev_new (); 2187 if (!dev) 2188 goto Enomem; 2189 2190 dev->sb = sb; 2191 rc = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations); 2192 if (rc) { 2193 put_dev(dev); 2194 goto Enomem; 2195 } 2196 2197 /* other endpoint files are available after hardware setup, 2198 * from binding to a controller. 2199 */ 2200 the_device = dev; 2201 rc = 0; 2202 goto Done; 2203 2204 Enomem: 2205 kfree(CHIP); 2206 CHIP = NULL; 2207 rc = -ENOMEM; 2208 2209 Done: 2210 mutex_unlock(&sb_mutex); 2211 return rc; 2212 } 2213 2214 /* "mount -t gadgetfs path /dev/gadget" ends up here */ 2215 static int gadgetfs_get_tree(struct fs_context *fc) 2216 { 2217 return get_tree_single(fc, gadgetfs_fill_super); 2218 } 2219 2220 static const struct fs_context_operations gadgetfs_context_ops = { 2221 .get_tree = gadgetfs_get_tree, 2222 }; 2223 2224 static int gadgetfs_init_fs_context(struct fs_context *fc) 2225 { 2226 fc->ops = &gadgetfs_context_ops; 2227 return 0; 2228 } 2229 2230 static void 2231 gadgetfs_kill_sb (struct super_block *sb) 2232 { 2233 mutex_lock(&sb_mutex); 2234 kill_anon_super (sb); 2235 if (the_device) { 2236 put_dev (the_device); 2237 the_device = NULL; 2238 } 2239 kfree(CHIP); 2240 CHIP = NULL; 2241 mutex_unlock(&sb_mutex); 2242 } 2243 2244 /*----------------------------------------------------------------------*/ 2245 2246 static struct file_system_type gadgetfs_type = { 2247 .owner = THIS_MODULE, 2248 .name = shortname, 2249 .init_fs_context = gadgetfs_init_fs_context, 2250 .kill_sb = gadgetfs_kill_sb, 2251 }; 2252 MODULE_ALIAS_FS("gadgetfs"); 2253 2254 /*----------------------------------------------------------------------*/ 2255 2256 static int __init gadgetfs_init (void) 2257 { 2258 int status; 2259 2260 gadgetfs_wq = alloc_workqueue("gadgetfs", WQ_PERCPU, 0); 2261 if (!gadgetfs_wq) 2262 return -ENOMEM; 2263 2264 status = register_filesystem (&gadgetfs_type); 2265 if (status) { 2266 destroy_workqueue(gadgetfs_wq); 2267 return status; 2268 } 2269 2270 pr_info("%s: %s, version " DRIVER_VERSION "\n", shortname, driver_desc); 2271 return status; 2272 } 2273 module_init (gadgetfs_init); 2274 2275 static void __exit gadgetfs_cleanup (void) 2276 { 2277 pr_debug ("unregister %s\n", shortname); 2278 unregister_filesystem (&gadgetfs_type); 2279 destroy_workqueue(gadgetfs_wq); 2280 } 2281 module_exit (gadgetfs_cleanup); 2282 2283