1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * inode.c -- user mode filesystem api for usb gadget controllers 4 * 5 * Copyright (C) 2003-2004 David Brownell 6 * Copyright (C) 2003 Agilent Technologies 7 */ 8 9 10 /* #define VERBOSE_DEBUG */ 11 12 #include <linux/init.h> 13 #include <linux/module.h> 14 #include <linux/fs.h> 15 #include <linux/fs_context.h> 16 #include <linux/pagemap.h> 17 #include <linux/uts.h> 18 #include <linux/wait.h> 19 #include <linux/compiler.h> 20 #include <linux/uaccess.h> 21 #include <linux/sched.h> 22 #include <linux/slab.h> 23 #include <linux/string_choices.h> 24 #include <linux/poll.h> 25 #include <linux/kthread.h> 26 #include <linux/aio.h> 27 #include <linux/uio.h> 28 #include <linux/refcount.h> 29 #include <linux/delay.h> 30 #include <linux/device.h> 31 #include <linux/moduleparam.h> 32 33 #include <linux/usb/gadgetfs.h> 34 #include <linux/usb/gadget.h> 35 #include <linux/usb/composite.h> /* for USB_GADGET_DELAYED_STATUS */ 36 37 /* Undef helpers from linux/usb/composite.h as gadgetfs redefines them */ 38 #undef DBG 39 #undef ERROR 40 #undef INFO 41 42 43 /* 44 * The gadgetfs API maps each endpoint to a file descriptor so that you 45 * can use standard synchronous read/write calls for I/O. There's some 46 * O_NONBLOCK and O_ASYNC/FASYNC style i/o support. Example usermode 47 * drivers show how this works in practice. You can also use AIO to 48 * eliminate I/O gaps between requests, to help when streaming data. 49 * 50 * Key parts that must be USB-specific are protocols defining how the 51 * read/write operations relate to the hardware state machines. There 52 * are two types of files. One type is for the device, implementing ep0. 53 * The other type is for each IN or OUT endpoint. In both cases, the 54 * user mode driver must configure the hardware before using it. 55 * 56 * - First, dev_config() is called when /dev/gadget/$CHIP is configured 57 * (by writing configuration and device descriptors). Afterwards it 58 * may serve as a source of device events, used to handle all control 59 * requests other than basic enumeration. 60 * 61 * - Then, after a SET_CONFIGURATION control request, ep_config() is 62 * called when each /dev/gadget/ep* file is configured (by writing 63 * endpoint descriptors). Afterwards these files are used to write() 64 * IN data or to read() OUT data. To halt the endpoint, a "wrong 65 * direction" request is issued (like reading an IN endpoint). 66 * 67 * Unlike "usbfs" the only ioctl()s are for things that are rare, and maybe 68 * not possible on all hardware. For example, precise fault handling with 69 * respect to data left in endpoint fifos after aborted operations; or 70 * selective clearing of endpoint halts, to implement SET_INTERFACE. 71 */ 72 73 #define DRIVER_DESC "USB Gadget filesystem" 74 #define DRIVER_VERSION "24 Aug 2004" 75 76 static const char driver_desc [] = DRIVER_DESC; 77 static const char shortname [] = "gadgetfs"; 78 79 MODULE_DESCRIPTION (DRIVER_DESC); 80 MODULE_AUTHOR ("David Brownell"); 81 MODULE_LICENSE ("GPL"); 82 83 static int ep_open(struct inode *, struct file *); 84 85 86 /*----------------------------------------------------------------------*/ 87 88 #define GADGETFS_MAGIC 0xaee71ee7 89 90 /* /dev/gadget/$CHIP represents ep0 and the whole device */ 91 enum ep0_state { 92 /* DISABLED is the initial state. */ 93 STATE_DEV_DISABLED = 0, 94 95 /* Only one open() of /dev/gadget/$CHIP; only one file tracks 96 * ep0/device i/o modes and binding to the controller. Driver 97 * must always write descriptors to initialize the device, then 98 * the device becomes UNCONNECTED until enumeration. 99 */ 100 STATE_DEV_OPENED, 101 102 /* From then on, ep0 fd is in either of two basic modes: 103 * - (UN)CONNECTED: read usb_gadgetfs_event(s) from it 104 * - SETUP: read/write will transfer control data and succeed; 105 * or if "wrong direction", performs protocol stall 106 */ 107 STATE_DEV_UNCONNECTED, 108 STATE_DEV_CONNECTED, 109 STATE_DEV_SETUP, 110 111 /* UNBOUND means the driver closed ep0, so the device won't be 112 * accessible again (DEV_DISABLED) until all fds are closed. 113 */ 114 STATE_DEV_UNBOUND, 115 }; 116 117 /* enough for the whole queue: most events invalidate others */ 118 #define N_EVENT 5 119 120 #define RBUF_SIZE 256 121 122 struct dev_data { 123 spinlock_t lock; 124 refcount_t count; 125 int udc_usage; 126 enum ep0_state state; /* P: lock */ 127 struct usb_gadgetfs_event event [N_EVENT]; 128 unsigned ev_next; 129 struct fasync_struct *fasync; 130 u8 current_config; 131 132 /* drivers reading ep0 MUST handle control requests (SETUP) 133 * reported that way; else the host will time out. 134 */ 135 unsigned usermode_setup : 1, 136 setup_in : 1, 137 setup_can_stall : 1, 138 setup_out_ready : 1, 139 setup_out_error : 1, 140 setup_abort : 1, 141 gadget_registered : 1; 142 unsigned setup_wLength; 143 144 /* the rest is basically write-once */ 145 struct usb_config_descriptor *config, *hs_config; 146 struct usb_device_descriptor *dev; 147 struct usb_request *req; 148 struct usb_gadget *gadget; 149 struct list_head epfiles; 150 void *buf; 151 wait_queue_head_t wait; 152 struct super_block *sb; 153 154 /* except this scratch i/o buffer for ep0 */ 155 u8 rbuf[RBUF_SIZE]; 156 }; 157 158 static inline void get_dev (struct dev_data *data) 159 { 160 refcount_inc (&data->count); 161 } 162 163 static void put_dev (struct dev_data *data) 164 { 165 if (likely (!refcount_dec_and_test (&data->count))) 166 return; 167 /* needs no more cleanup */ 168 BUG_ON (waitqueue_active (&data->wait)); 169 kfree (data); 170 } 171 172 static struct dev_data *dev_new (void) 173 { 174 struct dev_data *dev; 175 176 dev = kzalloc_obj(*dev); 177 if (!dev) 178 return NULL; 179 dev->state = STATE_DEV_DISABLED; 180 refcount_set (&dev->count, 1); 181 spin_lock_init (&dev->lock); 182 INIT_LIST_HEAD (&dev->epfiles); 183 init_waitqueue_head (&dev->wait); 184 return dev; 185 } 186 187 /*----------------------------------------------------------------------*/ 188 189 /* other /dev/gadget/$ENDPOINT files represent endpoints */ 190 enum ep_state { 191 STATE_EP_DISABLED = 0, 192 STATE_EP_READY, 193 STATE_EP_ENABLED, 194 STATE_EP_UNBOUND, 195 }; 196 197 struct ep_data { 198 struct mutex lock; 199 enum ep_state state; 200 refcount_t count; 201 struct dev_data *dev; 202 /* must hold dev->lock before accessing ep or req */ 203 struct usb_ep *ep; 204 struct usb_request *req; 205 ssize_t status; 206 char name [16]; 207 struct usb_endpoint_descriptor desc, hs_desc; 208 struct list_head epfiles; 209 wait_queue_head_t wait; 210 }; 211 212 static inline void get_ep (struct ep_data *data) 213 { 214 refcount_inc (&data->count); 215 } 216 217 static void put_ep (struct ep_data *data) 218 { 219 if (likely (!refcount_dec_and_test (&data->count))) 220 return; 221 put_dev (data->dev); 222 /* needs no more cleanup */ 223 BUG_ON (!list_empty (&data->epfiles)); 224 BUG_ON (waitqueue_active (&data->wait)); 225 kfree (data); 226 } 227 228 /*----------------------------------------------------------------------*/ 229 230 /* most "how to use the hardware" policy choices are in userspace: 231 * mapping endpoint roles (which the driver needs) to the capabilities 232 * which the usb controller has. most of those capabilities are exposed 233 * implicitly, starting with the driver name and then endpoint names. 234 */ 235 236 static const char *CHIP; 237 static DEFINE_MUTEX(sb_mutex); /* Serialize superblock operations */ 238 239 /*----------------------------------------------------------------------*/ 240 241 /* NOTE: don't use dev_printk calls before binding to the gadget 242 * at the end of ep0 configuration, or after unbind. 243 */ 244 245 /* too wordy: dev_printk(level , &(d)->gadget->dev , fmt , ## args) */ 246 #define xprintk(d,level,fmt,args...) \ 247 printk(level "%s: " fmt , shortname , ## args) 248 249 #ifdef DEBUG 250 #define DBG(dev,fmt,args...) \ 251 xprintk(dev , KERN_DEBUG , fmt , ## args) 252 #else 253 #define DBG(dev,fmt,args...) \ 254 do { } while (0) 255 #endif /* DEBUG */ 256 257 #ifdef VERBOSE_DEBUG 258 #define VDEBUG DBG 259 #else 260 #define VDEBUG(dev,fmt,args...) \ 261 do { } while (0) 262 #endif /* DEBUG */ 263 264 #define ERROR(dev,fmt,args...) \ 265 xprintk(dev , KERN_ERR , fmt , ## args) 266 #define INFO(dev,fmt,args...) \ 267 xprintk(dev , KERN_INFO , fmt , ## args) 268 269 270 /*----------------------------------------------------------------------*/ 271 272 /* SYNCHRONOUS ENDPOINT OPERATIONS (bulk/intr/iso) 273 * 274 * After opening, configure non-control endpoints. Then use normal 275 * stream read() and write() requests; and maybe ioctl() to get more 276 * precise FIFO status when recovering from cancellation. 277 */ 278 279 static void epio_complete (struct usb_ep *ep, struct usb_request *req) 280 { 281 struct ep_data *epdata = ep->driver_data; 282 283 if (!req->context) 284 return; 285 if (req->status) 286 epdata->status = req->status; 287 else 288 epdata->status = req->actual; 289 complete ((struct completion *)req->context); 290 } 291 292 /* tasklock endpoint, returning when it's connected. 293 * still need dev->lock to use epdata->ep. 294 */ 295 static int 296 get_ready_ep (unsigned f_flags, struct ep_data *epdata, bool is_write) 297 { 298 int val; 299 300 if (f_flags & O_NONBLOCK) { 301 if (!mutex_trylock(&epdata->lock)) 302 goto nonblock; 303 if (epdata->state != STATE_EP_ENABLED && 304 (!is_write || epdata->state != STATE_EP_READY)) { 305 mutex_unlock(&epdata->lock); 306 nonblock: 307 val = -EAGAIN; 308 } else 309 val = 0; 310 return val; 311 } 312 313 val = mutex_lock_interruptible(&epdata->lock); 314 if (val < 0) 315 return val; 316 317 switch (epdata->state) { 318 case STATE_EP_ENABLED: 319 return 0; 320 case STATE_EP_READY: /* not configured yet */ 321 if (is_write) 322 return 0; 323 fallthrough; 324 case STATE_EP_UNBOUND: /* clean disconnect */ 325 break; 326 // case STATE_EP_DISABLED: /* "can't happen" */ 327 default: /* error! */ 328 pr_debug ("%s: ep %p not available, state %d\n", 329 shortname, epdata, epdata->state); 330 } 331 mutex_unlock(&epdata->lock); 332 return -ENODEV; 333 } 334 335 static ssize_t 336 ep_io (struct ep_data *epdata, void *buf, unsigned len) 337 { 338 DECLARE_COMPLETION_ONSTACK (done); 339 int value; 340 341 spin_lock_irq (&epdata->dev->lock); 342 if (likely (epdata->ep != NULL)) { 343 struct usb_request *req = epdata->req; 344 345 req->context = &done; 346 req->complete = epio_complete; 347 req->buf = buf; 348 req->length = len; 349 value = usb_ep_queue (epdata->ep, req, GFP_ATOMIC); 350 } else 351 value = -ENODEV; 352 spin_unlock_irq (&epdata->dev->lock); 353 354 if (likely (value == 0)) { 355 value = wait_for_completion_interruptible(&done); 356 if (value != 0) { 357 spin_lock_irq (&epdata->dev->lock); 358 if (likely (epdata->ep != NULL)) { 359 DBG (epdata->dev, "%s i/o interrupted\n", 360 epdata->name); 361 usb_ep_dequeue (epdata->ep, epdata->req); 362 spin_unlock_irq (&epdata->dev->lock); 363 364 wait_for_completion(&done); 365 if (epdata->status == -ECONNRESET) 366 epdata->status = -EINTR; 367 } else { 368 spin_unlock_irq (&epdata->dev->lock); 369 370 DBG (epdata->dev, "endpoint gone\n"); 371 wait_for_completion(&done); 372 epdata->status = -ENODEV; 373 } 374 } 375 return epdata->status; 376 } 377 return value; 378 } 379 380 static int 381 ep_release (struct inode *inode, struct file *fd) 382 { 383 struct ep_data *data = fd->private_data; 384 int value; 385 386 value = mutex_lock_interruptible(&data->lock); 387 if (value < 0) 388 return value; 389 390 /* clean up if this can be reopened */ 391 if (data->state != STATE_EP_UNBOUND) { 392 data->state = STATE_EP_DISABLED; 393 data->desc.bDescriptorType = 0; 394 data->hs_desc.bDescriptorType = 0; 395 usb_ep_disable(data->ep); 396 } 397 mutex_unlock(&data->lock); 398 put_ep (data); 399 return 0; 400 } 401 402 static long ep_ioctl(struct file *fd, unsigned code, unsigned long value) 403 { 404 struct ep_data *data = fd->private_data; 405 int status; 406 407 if ((status = get_ready_ep (fd->f_flags, data, false)) < 0) 408 return status; 409 410 spin_lock_irq (&data->dev->lock); 411 if (likely (data->ep != NULL)) { 412 switch (code) { 413 case GADGETFS_FIFO_STATUS: 414 status = usb_ep_fifo_status (data->ep); 415 break; 416 case GADGETFS_FIFO_FLUSH: 417 usb_ep_fifo_flush (data->ep); 418 break; 419 case GADGETFS_CLEAR_HALT: 420 status = usb_ep_clear_halt (data->ep); 421 break; 422 default: 423 status = -ENOTTY; 424 } 425 } else 426 status = -ENODEV; 427 spin_unlock_irq (&data->dev->lock); 428 mutex_unlock(&data->lock); 429 return status; 430 } 431 432 /*----------------------------------------------------------------------*/ 433 434 /* ASYNCHRONOUS ENDPOINT I/O OPERATIONS (bulk/intr/iso) */ 435 436 struct kiocb_priv { 437 struct usb_request *req; 438 struct ep_data *epdata; 439 struct kiocb *iocb; 440 struct mm_struct *mm; 441 struct work_struct work; 442 void *buf; 443 struct iov_iter to; 444 const void *to_free; 445 unsigned actual; 446 }; 447 448 static int ep_aio_cancel(struct kiocb *iocb) 449 { 450 struct kiocb_priv *priv = iocb->private; 451 struct ep_data *epdata; 452 int value; 453 454 local_irq_disable(); 455 epdata = priv->epdata; 456 // spin_lock(&epdata->dev->lock); 457 if (likely(epdata && epdata->ep && priv->req)) 458 value = usb_ep_dequeue (epdata->ep, priv->req); 459 else 460 value = -EINVAL; 461 // spin_unlock(&epdata->dev->lock); 462 local_irq_enable(); 463 464 return value; 465 } 466 467 static void ep_user_copy_worker(struct work_struct *work) 468 { 469 struct kiocb_priv *priv = container_of(work, struct kiocb_priv, work); 470 struct mm_struct *mm = priv->mm; 471 struct kiocb *iocb = priv->iocb; 472 size_t ret; 473 474 if (mmget_not_zero(mm)) { 475 kthread_use_mm(mm); 476 ret = copy_to_iter(priv->buf, priv->actual, &priv->to); 477 kthread_unuse_mm(mm); 478 mmput(mm); 479 if (!ret) 480 ret = -EFAULT; 481 } else { 482 ret = -EFAULT; 483 } 484 mmdrop(mm); 485 486 /* completing the iocb can drop the ctx and mm, don't touch mm after */ 487 iocb->ki_complete(iocb, ret); 488 489 kfree(priv->buf); 490 kfree(priv->to_free); 491 kfree(priv); 492 } 493 494 static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req) 495 { 496 struct kiocb *iocb = req->context; 497 struct kiocb_priv *priv = iocb->private; 498 struct ep_data *epdata = priv->epdata; 499 500 /* lock against disconnect (and ideally, cancel) */ 501 spin_lock(&epdata->dev->lock); 502 priv->req = NULL; 503 priv->epdata = NULL; 504 505 /* if this was a write or a read returning no data then we 506 * don't need to copy anything to userspace, so we can 507 * complete the aio request immediately. 508 */ 509 if (priv->to_free == NULL || unlikely(req->actual == 0)) { 510 mmdrop(priv->mm); 511 kfree(req->buf); 512 kfree(priv->to_free); 513 kfree(priv); 514 iocb->private = NULL; 515 iocb->ki_complete(iocb, 516 req->actual ? req->actual : (long)req->status); 517 } else { 518 /* ep_copy_to_user() won't report both; we hide some faults */ 519 if (unlikely(0 != req->status)) 520 DBG(epdata->dev, "%s fault %d len %d\n", 521 ep->name, req->status, req->actual); 522 523 priv->buf = req->buf; 524 priv->actual = req->actual; 525 INIT_WORK(&priv->work, ep_user_copy_worker); 526 schedule_work(&priv->work); 527 } 528 529 usb_ep_free_request(ep, req); 530 spin_unlock(&epdata->dev->lock); 531 put_ep(epdata); 532 } 533 534 static ssize_t ep_aio(struct kiocb *iocb, 535 struct kiocb_priv *priv, 536 struct ep_data *epdata, 537 char *buf, 538 size_t len) 539 { 540 struct usb_request *req; 541 ssize_t value; 542 543 iocb->private = priv; 544 priv->iocb = iocb; 545 546 kiocb_set_cancel_fn(iocb, ep_aio_cancel); 547 get_ep(epdata); 548 priv->epdata = epdata; 549 priv->actual = 0; 550 priv->mm = current->mm; /* mm teardown waits for iocbs in exit_aio() */ 551 mmgrab(priv->mm); 552 553 /* each kiocb is coupled to one usb_request, but we can't 554 * allocate or submit those if the host disconnected. 555 */ 556 spin_lock_irq(&epdata->dev->lock); 557 value = -ENODEV; 558 if (unlikely(epdata->ep == NULL)) 559 goto fail; 560 561 req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC); 562 value = -ENOMEM; 563 if (unlikely(!req)) 564 goto fail; 565 566 priv->req = req; 567 req->buf = buf; 568 req->length = len; 569 req->complete = ep_aio_complete; 570 req->context = iocb; 571 value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC); 572 if (unlikely(0 != value)) { 573 usb_ep_free_request(epdata->ep, req); 574 goto fail; 575 } 576 spin_unlock_irq(&epdata->dev->lock); 577 return -EIOCBQUEUED; 578 579 fail: 580 spin_unlock_irq(&epdata->dev->lock); 581 mmdrop(priv->mm); 582 kfree(priv->to_free); 583 kfree(priv); 584 put_ep(epdata); 585 return value; 586 } 587 588 static ssize_t 589 ep_read_iter(struct kiocb *iocb, struct iov_iter *to) 590 { 591 struct file *file = iocb->ki_filp; 592 struct ep_data *epdata = file->private_data; 593 size_t len = iov_iter_count(to); 594 ssize_t value; 595 char *buf; 596 597 if ((value = get_ready_ep(file->f_flags, epdata, false)) < 0) 598 return value; 599 600 /* halt any endpoint by doing a "wrong direction" i/o call */ 601 if (usb_endpoint_dir_in(&epdata->desc)) { 602 if (usb_endpoint_xfer_isoc(&epdata->desc) || 603 !is_sync_kiocb(iocb)) { 604 mutex_unlock(&epdata->lock); 605 return -EINVAL; 606 } 607 DBG (epdata->dev, "%s halt\n", epdata->name); 608 spin_lock_irq(&epdata->dev->lock); 609 if (likely(epdata->ep != NULL)) 610 usb_ep_set_halt(epdata->ep); 611 spin_unlock_irq(&epdata->dev->lock); 612 mutex_unlock(&epdata->lock); 613 return -EBADMSG; 614 } 615 616 buf = kmalloc(len, GFP_KERNEL); 617 if (unlikely(!buf)) { 618 mutex_unlock(&epdata->lock); 619 return -ENOMEM; 620 } 621 if (is_sync_kiocb(iocb)) { 622 value = ep_io(epdata, buf, len); 623 if (value >= 0 && (copy_to_iter(buf, value, to) != value)) 624 value = -EFAULT; 625 } else { 626 struct kiocb_priv *priv = kzalloc_obj(*priv); 627 value = -ENOMEM; 628 if (!priv) 629 goto fail; 630 priv->to_free = dup_iter(&priv->to, to, GFP_KERNEL); 631 if (!iter_is_ubuf(&priv->to) && !priv->to_free) { 632 kfree(priv); 633 goto fail; 634 } 635 value = ep_aio(iocb, priv, epdata, buf, len); 636 if (value == -EIOCBQUEUED) 637 buf = NULL; 638 } 639 fail: 640 kfree(buf); 641 mutex_unlock(&epdata->lock); 642 return value; 643 } 644 645 static ssize_t ep_config(struct ep_data *, const char *, size_t); 646 647 static ssize_t 648 ep_write_iter(struct kiocb *iocb, struct iov_iter *from) 649 { 650 struct file *file = iocb->ki_filp; 651 struct ep_data *epdata = file->private_data; 652 size_t len = iov_iter_count(from); 653 bool configured; 654 ssize_t value; 655 char *buf; 656 657 if ((value = get_ready_ep(file->f_flags, epdata, true)) < 0) 658 return value; 659 660 configured = epdata->state == STATE_EP_ENABLED; 661 662 /* halt any endpoint by doing a "wrong direction" i/o call */ 663 if (configured && !usb_endpoint_dir_in(&epdata->desc)) { 664 if (usb_endpoint_xfer_isoc(&epdata->desc) || 665 !is_sync_kiocb(iocb)) { 666 mutex_unlock(&epdata->lock); 667 return -EINVAL; 668 } 669 DBG (epdata->dev, "%s halt\n", epdata->name); 670 spin_lock_irq(&epdata->dev->lock); 671 if (likely(epdata->ep != NULL)) 672 usb_ep_set_halt(epdata->ep); 673 spin_unlock_irq(&epdata->dev->lock); 674 mutex_unlock(&epdata->lock); 675 return -EBADMSG; 676 } 677 678 buf = kmalloc(len, GFP_KERNEL); 679 if (unlikely(!buf)) { 680 mutex_unlock(&epdata->lock); 681 return -ENOMEM; 682 } 683 684 if (unlikely(!copy_from_iter_full(buf, len, from))) { 685 value = -EFAULT; 686 goto out; 687 } 688 689 if (unlikely(!configured)) { 690 value = ep_config(epdata, buf, len); 691 } else if (is_sync_kiocb(iocb)) { 692 value = ep_io(epdata, buf, len); 693 } else { 694 struct kiocb_priv *priv = kzalloc_obj(*priv); 695 value = -ENOMEM; 696 if (priv) { 697 value = ep_aio(iocb, priv, epdata, buf, len); 698 if (value == -EIOCBQUEUED) 699 buf = NULL; 700 } 701 } 702 out: 703 kfree(buf); 704 mutex_unlock(&epdata->lock); 705 return value; 706 } 707 708 /*----------------------------------------------------------------------*/ 709 710 /* used after endpoint configuration */ 711 static const struct file_operations ep_io_operations = { 712 .owner = THIS_MODULE, 713 714 .open = ep_open, 715 .release = ep_release, 716 .unlocked_ioctl = ep_ioctl, 717 .read_iter = ep_read_iter, 718 .write_iter = ep_write_iter, 719 }; 720 721 /* ENDPOINT INITIALIZATION 722 * 723 * fd = open ("/dev/gadget/$ENDPOINT", O_RDWR) 724 * status = write (fd, descriptors, sizeof descriptors) 725 * 726 * That write establishes the endpoint configuration, configuring 727 * the controller to process bulk, interrupt, or isochronous transfers 728 * at the right maxpacket size, and so on. 729 * 730 * The descriptors are message type 1, identified by a host order u32 731 * at the beginning of what's written. Descriptor order is: full/low 732 * speed descriptor, then optional high speed descriptor. 733 */ 734 static ssize_t 735 ep_config (struct ep_data *data, const char *buf, size_t len) 736 { 737 struct usb_ep *ep; 738 u32 tag; 739 int value, length = len; 740 741 if (data->state != STATE_EP_READY) { 742 value = -EL2HLT; 743 goto fail; 744 } 745 746 value = len; 747 if (len < USB_DT_ENDPOINT_SIZE + 4) 748 goto fail0; 749 750 /* we might need to change message format someday */ 751 memcpy(&tag, buf, 4); 752 if (tag != 1) { 753 DBG(data->dev, "config %s, bad tag %d\n", data->name, tag); 754 goto fail0; 755 } 756 buf += 4; 757 len -= 4; 758 759 /* NOTE: audio endpoint extensions not accepted here; 760 * just don't include the extra bytes. 761 */ 762 763 /* full/low speed descriptor, then high speed */ 764 memcpy(&data->desc, buf, USB_DT_ENDPOINT_SIZE); 765 if (data->desc.bLength != USB_DT_ENDPOINT_SIZE 766 || data->desc.bDescriptorType != USB_DT_ENDPOINT) 767 goto fail0; 768 if (len != USB_DT_ENDPOINT_SIZE) { 769 if (len != 2 * USB_DT_ENDPOINT_SIZE) 770 goto fail0; 771 memcpy(&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE, 772 USB_DT_ENDPOINT_SIZE); 773 if (data->hs_desc.bLength != USB_DT_ENDPOINT_SIZE 774 || data->hs_desc.bDescriptorType 775 != USB_DT_ENDPOINT) { 776 DBG(data->dev, "config %s, bad hs length or type\n", 777 data->name); 778 goto fail0; 779 } 780 } 781 782 spin_lock_irq (&data->dev->lock); 783 if (data->dev->state == STATE_DEV_UNBOUND) { 784 value = -ENOENT; 785 goto gone; 786 } else { 787 ep = data->ep; 788 if (ep == NULL) { 789 value = -ENODEV; 790 goto gone; 791 } 792 } 793 switch (data->dev->gadget->speed) { 794 case USB_SPEED_LOW: 795 case USB_SPEED_FULL: 796 ep->desc = &data->desc; 797 break; 798 case USB_SPEED_HIGH: 799 /* fails if caller didn't provide that descriptor... */ 800 ep->desc = &data->hs_desc; 801 break; 802 default: 803 DBG(data->dev, "unconnected, %s init abandoned\n", 804 data->name); 805 value = -EINVAL; 806 goto gone; 807 } 808 value = usb_ep_enable(ep); 809 if (value == 0) { 810 data->state = STATE_EP_ENABLED; 811 value = length; 812 } 813 gone: 814 spin_unlock_irq (&data->dev->lock); 815 if (value < 0) { 816 fail: 817 data->desc.bDescriptorType = 0; 818 data->hs_desc.bDescriptorType = 0; 819 } 820 return value; 821 fail0: 822 value = -EINVAL; 823 goto fail; 824 } 825 826 static int 827 ep_open (struct inode *inode, struct file *fd) 828 { 829 struct ep_data *data = inode->i_private; 830 int value = -EBUSY; 831 832 if (mutex_lock_interruptible(&data->lock) != 0) 833 return -EINTR; 834 spin_lock_irq (&data->dev->lock); 835 if (data->dev->state == STATE_DEV_UNBOUND) 836 value = -ENOENT; 837 else if (data->state == STATE_EP_DISABLED) { 838 value = 0; 839 data->state = STATE_EP_READY; 840 get_ep (data); 841 fd->private_data = data; 842 VDEBUG (data->dev, "%s ready\n", data->name); 843 } else 844 DBG (data->dev, "%s state %d\n", 845 data->name, data->state); 846 spin_unlock_irq (&data->dev->lock); 847 mutex_unlock(&data->lock); 848 return value; 849 } 850 851 /*----------------------------------------------------------------------*/ 852 853 /* EP0 IMPLEMENTATION can be partly in userspace. 854 * 855 * Drivers that use this facility receive various events, including 856 * control requests the kernel doesn't handle. Drivers that don't 857 * use this facility may be too simple-minded for real applications. 858 */ 859 860 static inline void ep0_readable (struct dev_data *dev) 861 { 862 wake_up (&dev->wait); 863 kill_fasync (&dev->fasync, SIGIO, POLL_IN); 864 } 865 866 static void clean_req (struct usb_ep *ep, struct usb_request *req) 867 { 868 struct dev_data *dev = ep->driver_data; 869 870 if (req->buf != dev->rbuf) { 871 kfree(req->buf); 872 req->buf = dev->rbuf; 873 } 874 req->complete = epio_complete; 875 dev->setup_out_ready = 0; 876 } 877 878 static void ep0_complete (struct usb_ep *ep, struct usb_request *req) 879 { 880 struct dev_data *dev = ep->driver_data; 881 unsigned long flags; 882 int free = 1; 883 884 /* for control OUT, data must still get to userspace */ 885 spin_lock_irqsave(&dev->lock, flags); 886 if (!dev->setup_in) { 887 dev->setup_out_error = (req->status != 0); 888 if (!dev->setup_out_error) 889 free = 0; 890 dev->setup_out_ready = 1; 891 ep0_readable (dev); 892 } 893 894 /* clean up as appropriate */ 895 if (free && req->buf != &dev->rbuf) 896 clean_req (ep, req); 897 req->complete = epio_complete; 898 spin_unlock_irqrestore(&dev->lock, flags); 899 } 900 901 static int setup_req (struct usb_ep *ep, struct usb_request *req, u16 len) 902 { 903 struct dev_data *dev = ep->driver_data; 904 905 if (dev->setup_out_ready) { 906 DBG (dev, "ep0 request busy!\n"); 907 return -EBUSY; 908 } 909 if (len > sizeof (dev->rbuf)) 910 req->buf = kmalloc(len, GFP_ATOMIC); 911 if (req->buf == NULL) { 912 req->buf = dev->rbuf; 913 return -ENOMEM; 914 } 915 req->complete = ep0_complete; 916 req->length = len; 917 req->zero = 0; 918 return 0; 919 } 920 921 static ssize_t 922 ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) 923 { 924 struct dev_data *dev = fd->private_data; 925 ssize_t retval; 926 enum ep0_state state; 927 928 spin_lock_irq (&dev->lock); 929 if (dev->state <= STATE_DEV_OPENED) { 930 retval = -EINVAL; 931 goto done; 932 } 933 934 /* report fd mode change before acting on it */ 935 if (dev->setup_abort) { 936 dev->setup_abort = 0; 937 retval = -EIDRM; 938 goto done; 939 } 940 941 /* control DATA stage */ 942 if ((state = dev->state) == STATE_DEV_SETUP) { 943 944 if (dev->setup_in) { /* stall IN */ 945 VDEBUG(dev, "ep0in stall\n"); 946 (void) usb_ep_set_halt (dev->gadget->ep0); 947 retval = -EL2HLT; 948 dev->state = STATE_DEV_CONNECTED; 949 950 } else if (len == 0) { /* ack SET_CONFIGURATION etc */ 951 struct usb_ep *ep = dev->gadget->ep0; 952 struct usb_request *req = dev->req; 953 954 if ((retval = setup_req (ep, req, 0)) == 0) { 955 ++dev->udc_usage; 956 spin_unlock_irq (&dev->lock); 957 retval = usb_ep_queue (ep, req, GFP_KERNEL); 958 spin_lock_irq (&dev->lock); 959 --dev->udc_usage; 960 } 961 dev->state = STATE_DEV_CONNECTED; 962 963 /* assume that was SET_CONFIGURATION */ 964 if (dev->current_config) { 965 unsigned power; 966 967 if (gadget_is_dualspeed(dev->gadget) 968 && (dev->gadget->speed 969 == USB_SPEED_HIGH)) 970 power = dev->hs_config->bMaxPower; 971 else 972 power = dev->config->bMaxPower; 973 usb_gadget_vbus_draw(dev->gadget, 2 * power); 974 } 975 976 } else { /* collect OUT data */ 977 if ((fd->f_flags & O_NONBLOCK) != 0 978 && !dev->setup_out_ready) { 979 retval = -EAGAIN; 980 goto done; 981 } 982 spin_unlock_irq (&dev->lock); 983 retval = wait_event_interruptible (dev->wait, 984 dev->setup_out_ready != 0); 985 986 /* FIXME state could change from under us */ 987 spin_lock_irq (&dev->lock); 988 if (retval) 989 goto done; 990 991 if (dev->state != STATE_DEV_SETUP) { 992 retval = -ECANCELED; 993 goto done; 994 } 995 dev->state = STATE_DEV_CONNECTED; 996 997 if (dev->setup_out_error) 998 retval = -EIO; 999 else { 1000 len = min (len, (size_t)dev->req->actual); 1001 ++dev->udc_usage; 1002 spin_unlock_irq(&dev->lock); 1003 if (copy_to_user (buf, dev->req->buf, len)) 1004 retval = -EFAULT; 1005 else 1006 retval = len; 1007 spin_lock_irq(&dev->lock); 1008 --dev->udc_usage; 1009 clean_req (dev->gadget->ep0, dev->req); 1010 /* NOTE userspace can't yet choose to stall */ 1011 } 1012 } 1013 goto done; 1014 } 1015 1016 /* else normal: return event data */ 1017 if (len < sizeof dev->event [0]) { 1018 retval = -EINVAL; 1019 goto done; 1020 } 1021 len -= len % sizeof (struct usb_gadgetfs_event); 1022 dev->usermode_setup = 1; 1023 1024 scan: 1025 /* return queued events right away */ 1026 if (dev->ev_next != 0) { 1027 unsigned i, n; 1028 1029 n = len / sizeof (struct usb_gadgetfs_event); 1030 if (dev->ev_next < n) 1031 n = dev->ev_next; 1032 1033 /* ep0 i/o has special semantics during STATE_DEV_SETUP */ 1034 for (i = 0; i < n; i++) { 1035 if (dev->event [i].type == GADGETFS_SETUP) { 1036 dev->state = STATE_DEV_SETUP; 1037 n = i + 1; 1038 break; 1039 } 1040 } 1041 spin_unlock_irq (&dev->lock); 1042 len = n * sizeof (struct usb_gadgetfs_event); 1043 if (copy_to_user (buf, &dev->event, len)) 1044 retval = -EFAULT; 1045 else 1046 retval = len; 1047 if (len > 0) { 1048 /* NOTE this doesn't guard against broken drivers; 1049 * concurrent ep0 readers may lose events. 1050 */ 1051 spin_lock_irq (&dev->lock); 1052 if (dev->ev_next > n) { 1053 memmove(&dev->event[0], &dev->event[n], 1054 sizeof (struct usb_gadgetfs_event) 1055 * (dev->ev_next - n)); 1056 } 1057 dev->ev_next -= n; 1058 spin_unlock_irq (&dev->lock); 1059 } 1060 return retval; 1061 } 1062 if (fd->f_flags & O_NONBLOCK) { 1063 retval = -EAGAIN; 1064 goto done; 1065 } 1066 1067 switch (state) { 1068 default: 1069 DBG (dev, "fail %s, state %d\n", __func__, state); 1070 retval = -ESRCH; 1071 break; 1072 case STATE_DEV_UNCONNECTED: 1073 case STATE_DEV_CONNECTED: 1074 spin_unlock_irq (&dev->lock); 1075 DBG (dev, "%s wait\n", __func__); 1076 1077 /* wait for events */ 1078 retval = wait_event_interruptible (dev->wait, 1079 dev->ev_next != 0); 1080 if (retval < 0) 1081 return retval; 1082 spin_lock_irq (&dev->lock); 1083 goto scan; 1084 } 1085 1086 done: 1087 spin_unlock_irq (&dev->lock); 1088 return retval; 1089 } 1090 1091 static struct usb_gadgetfs_event * 1092 next_event (struct dev_data *dev, enum usb_gadgetfs_event_type type) 1093 { 1094 struct usb_gadgetfs_event *event; 1095 unsigned i; 1096 1097 switch (type) { 1098 /* these events purge the queue */ 1099 case GADGETFS_DISCONNECT: 1100 if (dev->state == STATE_DEV_SETUP) 1101 dev->setup_abort = 1; 1102 fallthrough; 1103 case GADGETFS_CONNECT: 1104 dev->ev_next = 0; 1105 break; 1106 case GADGETFS_SETUP: /* previous request timed out */ 1107 case GADGETFS_SUSPEND: /* same effect */ 1108 /* these events can't be repeated */ 1109 for (i = 0; i != dev->ev_next; i++) { 1110 if (dev->event [i].type != type) 1111 continue; 1112 DBG(dev, "discard old event[%d] %d\n", i, type); 1113 dev->ev_next--; 1114 if (i == dev->ev_next) 1115 break; 1116 /* indices start at zero, for simplicity */ 1117 memmove (&dev->event [i], &dev->event [i + 1], 1118 sizeof (struct usb_gadgetfs_event) 1119 * (dev->ev_next - i)); 1120 } 1121 break; 1122 default: 1123 BUG (); 1124 } 1125 VDEBUG(dev, "event[%d] = %d\n", dev->ev_next, type); 1126 event = &dev->event [dev->ev_next++]; 1127 BUG_ON (dev->ev_next > N_EVENT); 1128 memset (event, 0, sizeof *event); 1129 event->type = type; 1130 return event; 1131 } 1132 1133 static ssize_t 1134 ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) 1135 { 1136 struct dev_data *dev = fd->private_data; 1137 ssize_t retval = -ESRCH; 1138 1139 /* report fd mode change before acting on it */ 1140 if (dev->setup_abort) { 1141 dev->setup_abort = 0; 1142 retval = -EIDRM; 1143 1144 /* data and/or status stage for control request */ 1145 } else if (dev->state == STATE_DEV_SETUP) { 1146 1147 len = min_t(size_t, len, dev->setup_wLength); 1148 if (dev->setup_in) { 1149 retval = setup_req (dev->gadget->ep0, dev->req, len); 1150 if (retval == 0) { 1151 dev->state = STATE_DEV_CONNECTED; 1152 ++dev->udc_usage; 1153 spin_unlock_irq (&dev->lock); 1154 if (copy_from_user (dev->req->buf, buf, len)) 1155 retval = -EFAULT; 1156 else { 1157 if (len < dev->setup_wLength) 1158 dev->req->zero = 1; 1159 retval = usb_ep_queue ( 1160 dev->gadget->ep0, dev->req, 1161 GFP_KERNEL); 1162 } 1163 spin_lock_irq(&dev->lock); 1164 --dev->udc_usage; 1165 if (retval < 0) { 1166 clean_req (dev->gadget->ep0, dev->req); 1167 } else 1168 retval = len; 1169 1170 return retval; 1171 } 1172 1173 /* can stall some OUT transfers */ 1174 } else if (dev->setup_can_stall) { 1175 VDEBUG(dev, "ep0out stall\n"); 1176 (void) usb_ep_set_halt (dev->gadget->ep0); 1177 retval = -EL2HLT; 1178 dev->state = STATE_DEV_CONNECTED; 1179 } else { 1180 DBG(dev, "bogus ep0out stall!\n"); 1181 } 1182 } else 1183 DBG (dev, "fail %s, state %d\n", __func__, dev->state); 1184 1185 return retval; 1186 } 1187 1188 static int 1189 ep0_fasync (int f, struct file *fd, int on) 1190 { 1191 struct dev_data *dev = fd->private_data; 1192 // caller must F_SETOWN before signal delivery happens 1193 VDEBUG(dev, "%s %s\n", __func__, str_on_off(on)); 1194 return fasync_helper (f, fd, on, &dev->fasync); 1195 } 1196 1197 static struct usb_gadget_driver gadgetfs_driver; 1198 1199 static int 1200 dev_release (struct inode *inode, struct file *fd) 1201 { 1202 struct dev_data *dev = fd->private_data; 1203 1204 /* closing ep0 === shutdown all */ 1205 1206 if (dev->gadget_registered) { 1207 usb_gadget_unregister_driver (&gadgetfs_driver); 1208 dev->gadget_registered = false; 1209 } 1210 1211 /* at this point "good" hardware has disconnected the 1212 * device from USB; the host won't see it any more. 1213 * alternatively, all host requests will time out. 1214 */ 1215 1216 kfree (dev->buf); 1217 dev->buf = NULL; 1218 1219 /* other endpoints were all decoupled from this device */ 1220 spin_lock_irq(&dev->lock); 1221 dev->state = STATE_DEV_DISABLED; 1222 spin_unlock_irq(&dev->lock); 1223 1224 put_dev (dev); 1225 return 0; 1226 } 1227 1228 static __poll_t 1229 ep0_poll (struct file *fd, poll_table *wait) 1230 { 1231 struct dev_data *dev = fd->private_data; 1232 __poll_t mask = 0; 1233 1234 if (dev->state <= STATE_DEV_OPENED) 1235 return DEFAULT_POLLMASK; 1236 1237 poll_wait(fd, &dev->wait, wait); 1238 1239 spin_lock_irq(&dev->lock); 1240 1241 /* report fd mode change before acting on it */ 1242 if (dev->setup_abort) { 1243 dev->setup_abort = 0; 1244 mask = EPOLLHUP; 1245 goto out; 1246 } 1247 1248 if (dev->state == STATE_DEV_SETUP) { 1249 if (dev->setup_in || dev->setup_can_stall) 1250 mask = EPOLLOUT; 1251 } else { 1252 if (dev->ev_next != 0) 1253 mask = EPOLLIN; 1254 } 1255 out: 1256 spin_unlock_irq(&dev->lock); 1257 return mask; 1258 } 1259 1260 static long gadget_dev_ioctl (struct file *fd, unsigned code, unsigned long value) 1261 { 1262 struct dev_data *dev = fd->private_data; 1263 struct usb_gadget *gadget; 1264 long ret = -ENOTTY; 1265 1266 spin_lock_irq(&dev->lock); 1267 gadget = dev->gadget; 1268 if (dev->state == STATE_DEV_OPENED || 1269 dev->state == STATE_DEV_UNBOUND) { 1270 /* Not bound to a UDC */ 1271 } else if (gadget->ops->ioctl) { 1272 ++dev->udc_usage; 1273 spin_unlock_irq(&dev->lock); 1274 1275 ret = gadget->ops->ioctl (gadget, code, value); 1276 1277 spin_lock_irq(&dev->lock); 1278 --dev->udc_usage; 1279 } 1280 spin_unlock_irq(&dev->lock); 1281 1282 return ret; 1283 } 1284 1285 /*----------------------------------------------------------------------*/ 1286 1287 /* The in-kernel gadget driver handles most ep0 issues, in particular 1288 * enumerating the single configuration (as provided from user space). 1289 * 1290 * Unrecognized ep0 requests may be handled in user space. 1291 */ 1292 1293 static void make_qualifier (struct dev_data *dev) 1294 { 1295 struct usb_qualifier_descriptor qual; 1296 struct usb_device_descriptor *desc; 1297 1298 qual.bLength = sizeof qual; 1299 qual.bDescriptorType = USB_DT_DEVICE_QUALIFIER; 1300 qual.bcdUSB = cpu_to_le16 (0x0200); 1301 1302 desc = dev->dev; 1303 qual.bDeviceClass = desc->bDeviceClass; 1304 qual.bDeviceSubClass = desc->bDeviceSubClass; 1305 qual.bDeviceProtocol = desc->bDeviceProtocol; 1306 1307 /* assumes ep0 uses the same value for both speeds ... */ 1308 qual.bMaxPacketSize0 = dev->gadget->ep0->maxpacket; 1309 1310 qual.bNumConfigurations = 1; 1311 qual.bRESERVED = 0; 1312 1313 memcpy (dev->rbuf, &qual, sizeof qual); 1314 } 1315 1316 static int 1317 config_buf (struct dev_data *dev, u8 type, unsigned index) 1318 { 1319 int len; 1320 int hs = 0; 1321 1322 /* only one configuration */ 1323 if (index > 0) 1324 return -EINVAL; 1325 1326 if (gadget_is_dualspeed(dev->gadget)) { 1327 hs = (dev->gadget->speed == USB_SPEED_HIGH); 1328 if (type == USB_DT_OTHER_SPEED_CONFIG) 1329 hs = !hs; 1330 } 1331 if (hs) { 1332 dev->req->buf = dev->hs_config; 1333 len = le16_to_cpu(dev->hs_config->wTotalLength); 1334 } else { 1335 dev->req->buf = dev->config; 1336 len = le16_to_cpu(dev->config->wTotalLength); 1337 } 1338 ((u8 *)dev->req->buf) [1] = type; 1339 return len; 1340 } 1341 1342 static int 1343 gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) 1344 { 1345 struct dev_data *dev = get_gadget_data (gadget); 1346 struct usb_request *req = dev->req; 1347 int value = -EOPNOTSUPP; 1348 struct usb_gadgetfs_event *event; 1349 u16 w_value = le16_to_cpu(ctrl->wValue); 1350 u16 w_length = le16_to_cpu(ctrl->wLength); 1351 1352 if (w_length > RBUF_SIZE) { 1353 if (ctrl->bRequestType & USB_DIR_IN) { 1354 /* Cast away the const, we are going to overwrite on purpose. */ 1355 __le16 *temp = (__le16 *)&ctrl->wLength; 1356 1357 *temp = cpu_to_le16(RBUF_SIZE); 1358 w_length = RBUF_SIZE; 1359 } else { 1360 return value; 1361 } 1362 } 1363 1364 spin_lock (&dev->lock); 1365 dev->setup_abort = 0; 1366 if (dev->state == STATE_DEV_UNCONNECTED) { 1367 if (gadget_is_dualspeed(gadget) 1368 && gadget->speed == USB_SPEED_HIGH 1369 && dev->hs_config == NULL) { 1370 spin_unlock(&dev->lock); 1371 ERROR (dev, "no high speed config??\n"); 1372 return -EINVAL; 1373 } 1374 1375 dev->state = STATE_DEV_CONNECTED; 1376 1377 INFO (dev, "connected\n"); 1378 event = next_event (dev, GADGETFS_CONNECT); 1379 event->u.speed = gadget->speed; 1380 ep0_readable (dev); 1381 1382 /* host may have given up waiting for response. we can miss control 1383 * requests handled lower down (device/endpoint status and features); 1384 * then ep0_{read,write} will report the wrong status. controller 1385 * driver will have aborted pending i/o. 1386 */ 1387 } else if (dev->state == STATE_DEV_SETUP) 1388 dev->setup_abort = 1; 1389 1390 req->buf = dev->rbuf; 1391 req->context = NULL; 1392 switch (ctrl->bRequest) { 1393 1394 case USB_REQ_GET_DESCRIPTOR: 1395 if (ctrl->bRequestType != USB_DIR_IN) 1396 goto unrecognized; 1397 switch (w_value >> 8) { 1398 1399 case USB_DT_DEVICE: 1400 value = min (w_length, (u16) sizeof *dev->dev); 1401 dev->dev->bMaxPacketSize0 = dev->gadget->ep0->maxpacket; 1402 req->buf = dev->dev; 1403 break; 1404 case USB_DT_DEVICE_QUALIFIER: 1405 if (!dev->hs_config) 1406 break; 1407 value = min (w_length, (u16) 1408 sizeof (struct usb_qualifier_descriptor)); 1409 make_qualifier (dev); 1410 break; 1411 case USB_DT_OTHER_SPEED_CONFIG: 1412 case USB_DT_CONFIG: 1413 value = config_buf (dev, 1414 w_value >> 8, 1415 w_value & 0xff); 1416 if (value >= 0) 1417 value = min (w_length, (u16) value); 1418 break; 1419 case USB_DT_STRING: 1420 goto unrecognized; 1421 1422 default: // all others are errors 1423 break; 1424 } 1425 break; 1426 1427 /* currently one config, two speeds */ 1428 case USB_REQ_SET_CONFIGURATION: 1429 if (ctrl->bRequestType != 0) 1430 goto unrecognized; 1431 if (0 == (u8) w_value) { 1432 value = 0; 1433 dev->current_config = 0; 1434 usb_gadget_vbus_draw(gadget, 8 /* mA */ ); 1435 // user mode expected to disable endpoints 1436 } else { 1437 u8 config, power; 1438 1439 if (gadget_is_dualspeed(gadget) 1440 && gadget->speed == USB_SPEED_HIGH) { 1441 config = dev->hs_config->bConfigurationValue; 1442 power = dev->hs_config->bMaxPower; 1443 } else { 1444 config = dev->config->bConfigurationValue; 1445 power = dev->config->bMaxPower; 1446 } 1447 1448 if (config == (u8) w_value) { 1449 value = 0; 1450 dev->current_config = config; 1451 usb_gadget_vbus_draw(gadget, 2 * power); 1452 } 1453 } 1454 1455 /* report SET_CONFIGURATION like any other control request, 1456 * except that usermode may not stall this. the next 1457 * request mustn't be allowed start until this finishes: 1458 * endpoints and threads set up, etc. 1459 * 1460 * NOTE: older PXA hardware (before PXA 255: without UDCCFR) 1461 * has bad/racey automagic that prevents synchronizing here. 1462 * even kernel mode drivers often miss them. 1463 */ 1464 if (value == 0) { 1465 INFO (dev, "configuration #%d\n", dev->current_config); 1466 usb_gadget_set_state(gadget, USB_STATE_CONFIGURED); 1467 if (dev->usermode_setup) { 1468 dev->setup_can_stall = 0; 1469 goto delegate; 1470 } 1471 } 1472 break; 1473 1474 #ifndef CONFIG_USB_PXA25X 1475 /* PXA automagically handles this request too */ 1476 case USB_REQ_GET_CONFIGURATION: 1477 if (ctrl->bRequestType != 0x80) 1478 goto unrecognized; 1479 *(u8 *)req->buf = dev->current_config; 1480 value = min (w_length, (u16) 1); 1481 break; 1482 #endif 1483 1484 default: 1485 unrecognized: 1486 VDEBUG (dev, "%s req%02x.%02x v%04x i%04x l%d\n", 1487 dev->usermode_setup ? "delegate" : "fail", 1488 ctrl->bRequestType, ctrl->bRequest, 1489 w_value, le16_to_cpu(ctrl->wIndex), w_length); 1490 1491 /* if there's an ep0 reader, don't stall */ 1492 if (dev->usermode_setup) { 1493 dev->setup_can_stall = 1; 1494 delegate: 1495 dev->setup_in = (ctrl->bRequestType & USB_DIR_IN) 1496 ? 1 : 0; 1497 dev->setup_wLength = w_length; 1498 dev->setup_out_ready = 0; 1499 dev->setup_out_error = 0; 1500 1501 /* read DATA stage for OUT right away */ 1502 if (unlikely (!dev->setup_in && w_length)) { 1503 value = setup_req (gadget->ep0, dev->req, 1504 w_length); 1505 if (value < 0) 1506 break; 1507 1508 ++dev->udc_usage; 1509 spin_unlock (&dev->lock); 1510 value = usb_ep_queue (gadget->ep0, dev->req, 1511 GFP_KERNEL); 1512 spin_lock (&dev->lock); 1513 --dev->udc_usage; 1514 if (value < 0) { 1515 clean_req (gadget->ep0, dev->req); 1516 break; 1517 } 1518 1519 /* we can't currently stall these */ 1520 dev->setup_can_stall = 0; 1521 } 1522 1523 /* state changes when reader collects event */ 1524 event = next_event (dev, GADGETFS_SETUP); 1525 event->u.setup = *ctrl; 1526 ep0_readable (dev); 1527 spin_unlock (&dev->lock); 1528 /* 1529 * Return USB_GADGET_DELAYED_STATUS as a workaround to 1530 * stop some UDC drivers (e.g. dwc3) from automatically 1531 * proceeding with the status stage for 0-length 1532 * transfers. 1533 * Should be removed once all UDC drivers are fixed to 1534 * always delay the status stage until a response is 1535 * queued to EP0. 1536 */ 1537 return w_length == 0 ? USB_GADGET_DELAYED_STATUS : 0; 1538 } 1539 } 1540 1541 /* proceed with data transfer and status phases? */ 1542 if (value >= 0 && dev->state != STATE_DEV_SETUP) { 1543 req->length = value; 1544 req->zero = value < w_length; 1545 1546 ++dev->udc_usage; 1547 spin_unlock (&dev->lock); 1548 value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL); 1549 spin_lock(&dev->lock); 1550 --dev->udc_usage; 1551 spin_unlock(&dev->lock); 1552 if (value < 0) { 1553 DBG (dev, "ep_queue --> %d\n", value); 1554 req->status = 0; 1555 } 1556 return value; 1557 } 1558 1559 /* device stalls when value < 0 */ 1560 spin_unlock (&dev->lock); 1561 return value; 1562 } 1563 1564 static void destroy_ep_files (struct dev_data *dev) 1565 { 1566 DBG (dev, "%s %d\n", __func__, dev->state); 1567 1568 /* dev->state must prevent interference */ 1569 spin_lock_irq (&dev->lock); 1570 while (!list_empty(&dev->epfiles)) { 1571 struct ep_data *ep; 1572 1573 /* break link to FS */ 1574 ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles); 1575 list_del_init (&ep->epfiles); 1576 spin_unlock_irq (&dev->lock); 1577 1578 /* break link to controller */ 1579 mutex_lock(&ep->lock); 1580 if (ep->state == STATE_EP_ENABLED) 1581 (void) usb_ep_disable (ep->ep); 1582 ep->state = STATE_EP_UNBOUND; 1583 usb_ep_free_request (ep->ep, ep->req); 1584 ep->ep = NULL; 1585 mutex_unlock(&ep->lock); 1586 1587 wake_up (&ep->wait); 1588 1589 /* break link to dcache */ 1590 simple_remove_by_name(dev->sb->s_root, ep->name, NULL); 1591 1592 put_ep (ep); 1593 1594 spin_lock_irq (&dev->lock); 1595 } 1596 spin_unlock_irq (&dev->lock); 1597 } 1598 1599 1600 static int gadgetfs_create_file (struct super_block *sb, char const *name, 1601 void *data, const struct file_operations *fops); 1602 1603 static int activate_ep_files (struct dev_data *dev) 1604 { 1605 struct usb_ep *ep; 1606 struct ep_data *data; 1607 int err; 1608 1609 gadget_for_each_ep (ep, dev->gadget) { 1610 1611 data = kzalloc_obj(*data); 1612 if (!data) 1613 goto enomem0; 1614 data->state = STATE_EP_DISABLED; 1615 mutex_init(&data->lock); 1616 init_waitqueue_head (&data->wait); 1617 1618 strscpy(data->name, ep->name); 1619 refcount_set (&data->count, 1); 1620 data->dev = dev; 1621 get_dev (dev); 1622 1623 data->ep = ep; 1624 ep->driver_data = data; 1625 1626 data->req = usb_ep_alloc_request (ep, GFP_KERNEL); 1627 if (!data->req) 1628 goto enomem1; 1629 1630 err = gadgetfs_create_file (dev->sb, data->name, 1631 data, &ep_io_operations); 1632 if (err) 1633 goto enomem2; 1634 list_add_tail (&data->epfiles, &dev->epfiles); 1635 } 1636 return 0; 1637 1638 enomem2: 1639 usb_ep_free_request (ep, data->req); 1640 enomem1: 1641 put_dev (dev); 1642 kfree (data); 1643 enomem0: 1644 DBG (dev, "%s enomem\n", __func__); 1645 destroy_ep_files (dev); 1646 return -ENOMEM; 1647 } 1648 1649 static void 1650 gadgetfs_unbind (struct usb_gadget *gadget) 1651 { 1652 struct dev_data *dev = get_gadget_data (gadget); 1653 1654 DBG (dev, "%s\n", __func__); 1655 1656 spin_lock_irq (&dev->lock); 1657 dev->state = STATE_DEV_UNBOUND; 1658 while (dev->udc_usage > 0) { 1659 spin_unlock_irq(&dev->lock); 1660 usleep_range(1000, 2000); 1661 spin_lock_irq(&dev->lock); 1662 } 1663 spin_unlock_irq (&dev->lock); 1664 1665 destroy_ep_files (dev); 1666 gadget->ep0->driver_data = NULL; 1667 set_gadget_data (gadget, NULL); 1668 1669 /* we've already been disconnected ... no i/o is active */ 1670 if (dev->req) 1671 usb_ep_free_request (gadget->ep0, dev->req); 1672 DBG (dev, "%s done\n", __func__); 1673 put_dev (dev); 1674 } 1675 1676 static struct dev_data *the_device; 1677 1678 static int gadgetfs_bind(struct usb_gadget *gadget, 1679 struct usb_gadget_driver *driver) 1680 { 1681 struct dev_data *dev = the_device; 1682 1683 if (!dev) 1684 return -ESRCH; 1685 if (0 != strcmp (CHIP, gadget->name)) { 1686 pr_err("%s expected %s controller not %s\n", 1687 shortname, CHIP, gadget->name); 1688 return -ENODEV; 1689 } 1690 1691 set_gadget_data (gadget, dev); 1692 dev->gadget = gadget; 1693 gadget->ep0->driver_data = dev; 1694 1695 /* preallocate control response and buffer */ 1696 dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL); 1697 if (!dev->req) 1698 goto enomem; 1699 dev->req->context = NULL; 1700 dev->req->complete = epio_complete; 1701 1702 if (activate_ep_files (dev) < 0) 1703 goto enomem; 1704 1705 INFO (dev, "bound to %s driver\n", gadget->name); 1706 spin_lock_irq(&dev->lock); 1707 dev->state = STATE_DEV_UNCONNECTED; 1708 spin_unlock_irq(&dev->lock); 1709 get_dev (dev); 1710 return 0; 1711 1712 enomem: 1713 gadgetfs_unbind (gadget); 1714 return -ENOMEM; 1715 } 1716 1717 static void 1718 gadgetfs_disconnect (struct usb_gadget *gadget) 1719 { 1720 struct dev_data *dev = get_gadget_data (gadget); 1721 unsigned long flags; 1722 1723 spin_lock_irqsave (&dev->lock, flags); 1724 if (dev->state == STATE_DEV_UNCONNECTED) 1725 goto exit; 1726 dev->state = STATE_DEV_UNCONNECTED; 1727 1728 INFO (dev, "disconnected\n"); 1729 next_event (dev, GADGETFS_DISCONNECT); 1730 ep0_readable (dev); 1731 exit: 1732 spin_unlock_irqrestore (&dev->lock, flags); 1733 } 1734 1735 static void 1736 gadgetfs_suspend (struct usb_gadget *gadget) 1737 { 1738 struct dev_data *dev = get_gadget_data (gadget); 1739 unsigned long flags; 1740 1741 INFO (dev, "suspended from state %d\n", dev->state); 1742 spin_lock_irqsave(&dev->lock, flags); 1743 switch (dev->state) { 1744 case STATE_DEV_SETUP: // VERY odd... host died?? 1745 case STATE_DEV_CONNECTED: 1746 case STATE_DEV_UNCONNECTED: 1747 next_event (dev, GADGETFS_SUSPEND); 1748 ep0_readable (dev); 1749 fallthrough; 1750 default: 1751 break; 1752 } 1753 spin_unlock_irqrestore(&dev->lock, flags); 1754 } 1755 1756 static struct usb_gadget_driver gadgetfs_driver = { 1757 .function = (char *) driver_desc, 1758 .bind = gadgetfs_bind, 1759 .unbind = gadgetfs_unbind, 1760 .setup = gadgetfs_setup, 1761 .reset = gadgetfs_disconnect, 1762 .disconnect = gadgetfs_disconnect, 1763 .suspend = gadgetfs_suspend, 1764 1765 .driver = { 1766 .name = shortname, 1767 }, 1768 }; 1769 1770 /*----------------------------------------------------------------------*/ 1771 /* DEVICE INITIALIZATION 1772 * 1773 * fd = open ("/dev/gadget/$CHIP", O_RDWR) 1774 * status = write (fd, descriptors, sizeof descriptors) 1775 * 1776 * That write establishes the device configuration, so the kernel can 1777 * bind to the controller ... guaranteeing it can handle enumeration 1778 * at all necessary speeds. Descriptor order is: 1779 * 1780 * . message tag (u32, host order) ... for now, must be zero; it 1781 * would change to support features like multi-config devices 1782 * . full/low speed config ... all wTotalLength bytes (with interface, 1783 * class, altsetting, endpoint, and other descriptors) 1784 * . high speed config ... all descriptors, for high speed operation; 1785 * this one's optional except for high-speed hardware 1786 * . device descriptor 1787 * 1788 * Endpoints are not yet enabled. Drivers must wait until device 1789 * configuration and interface altsetting changes create 1790 * the need to configure (or unconfigure) them. 1791 * 1792 * After initialization, the device stays active for as long as that 1793 * $CHIP file is open. Events must then be read from that descriptor, 1794 * such as configuration notifications. 1795 */ 1796 1797 static int is_valid_config(struct usb_config_descriptor *config, 1798 unsigned int total) 1799 { 1800 return config->bDescriptorType == USB_DT_CONFIG 1801 && config->bLength == USB_DT_CONFIG_SIZE 1802 && total >= USB_DT_CONFIG_SIZE 1803 && config->bConfigurationValue != 0 1804 && (config->bmAttributes & USB_CONFIG_ATT_ONE) != 0 1805 && (config->bmAttributes & USB_CONFIG_ATT_WAKEUP) == 0; 1806 /* FIXME if gadget->is_otg, _must_ include an otg descriptor */ 1807 /* FIXME check lengths: walk to end */ 1808 } 1809 1810 static ssize_t 1811 dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) 1812 { 1813 struct dev_data *dev = fd->private_data; 1814 ssize_t value, length = len; 1815 unsigned total; 1816 u32 tag; 1817 char *kbuf; 1818 1819 spin_lock_irq(&dev->lock); 1820 if (dev->state > STATE_DEV_OPENED) { 1821 value = ep0_write(fd, buf, len, ptr); 1822 spin_unlock_irq(&dev->lock); 1823 return value; 1824 } 1825 spin_unlock_irq(&dev->lock); 1826 1827 if ((len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4)) || 1828 (len > PAGE_SIZE * 4)) 1829 return -EINVAL; 1830 1831 /* we might need to change message format someday */ 1832 if (copy_from_user (&tag, buf, 4)) 1833 return -EFAULT; 1834 if (tag != 0) 1835 return -EINVAL; 1836 buf += 4; 1837 length -= 4; 1838 1839 kbuf = memdup_user(buf, length); 1840 if (IS_ERR(kbuf)) 1841 return PTR_ERR(kbuf); 1842 1843 spin_lock_irq (&dev->lock); 1844 value = -EINVAL; 1845 if (dev->buf) { 1846 spin_unlock_irq(&dev->lock); 1847 kfree(kbuf); 1848 return value; 1849 } 1850 dev->buf = kbuf; 1851 1852 /* full or low speed config */ 1853 dev->config = (void *) kbuf; 1854 total = le16_to_cpu(dev->config->wTotalLength); 1855 if (!is_valid_config(dev->config, total) || 1856 total > length - USB_DT_DEVICE_SIZE) 1857 goto fail; 1858 kbuf += total; 1859 length -= total; 1860 1861 /* optional high speed config */ 1862 if (kbuf [1] == USB_DT_CONFIG) { 1863 dev->hs_config = (void *) kbuf; 1864 total = le16_to_cpu(dev->hs_config->wTotalLength); 1865 if (!is_valid_config(dev->hs_config, total) || 1866 total > length - USB_DT_DEVICE_SIZE) 1867 goto fail; 1868 kbuf += total; 1869 length -= total; 1870 } else { 1871 dev->hs_config = NULL; 1872 } 1873 1874 /* could support multiple configs, using another encoding! */ 1875 1876 /* device descriptor (tweaked for paranoia) */ 1877 if (length != USB_DT_DEVICE_SIZE) 1878 goto fail; 1879 dev->dev = (void *)kbuf; 1880 if (dev->dev->bLength != USB_DT_DEVICE_SIZE 1881 || dev->dev->bDescriptorType != USB_DT_DEVICE 1882 || dev->dev->bNumConfigurations != 1) 1883 goto fail; 1884 dev->dev->bcdUSB = cpu_to_le16 (0x0200); 1885 1886 /* triggers gadgetfs_bind(); then we can enumerate. */ 1887 spin_unlock_irq (&dev->lock); 1888 if (dev->hs_config) 1889 gadgetfs_driver.max_speed = USB_SPEED_HIGH; 1890 else 1891 gadgetfs_driver.max_speed = USB_SPEED_FULL; 1892 1893 value = usb_gadget_register_driver(&gadgetfs_driver); 1894 if (value != 0) { 1895 spin_lock_irq(&dev->lock); 1896 goto fail; 1897 } else { 1898 /* at this point "good" hardware has for the first time 1899 * let the USB the host see us. alternatively, if users 1900 * unplug/replug that will clear all the error state. 1901 * 1902 * note: everything running before here was guaranteed 1903 * to choke driver model style diagnostics. from here 1904 * on, they can work ... except in cleanup paths that 1905 * kick in after the ep0 descriptor is closed. 1906 */ 1907 value = len; 1908 dev->gadget_registered = true; 1909 } 1910 return value; 1911 1912 fail: 1913 dev->config = NULL; 1914 dev->hs_config = NULL; 1915 dev->dev = NULL; 1916 spin_unlock_irq (&dev->lock); 1917 pr_debug ("%s: %s fail %zd, %p\n", shortname, __func__, value, dev); 1918 kfree (dev->buf); 1919 dev->buf = NULL; 1920 return value; 1921 } 1922 1923 static int 1924 gadget_dev_open (struct inode *inode, struct file *fd) 1925 { 1926 struct dev_data *dev = inode->i_private; 1927 int value = -EBUSY; 1928 1929 spin_lock_irq(&dev->lock); 1930 if (dev->state == STATE_DEV_DISABLED) { 1931 dev->ev_next = 0; 1932 dev->state = STATE_DEV_OPENED; 1933 fd->private_data = dev; 1934 get_dev (dev); 1935 value = 0; 1936 } 1937 spin_unlock_irq(&dev->lock); 1938 return value; 1939 } 1940 1941 static const struct file_operations ep0_operations = { 1942 1943 .open = gadget_dev_open, 1944 .read = ep0_read, 1945 .write = dev_config, 1946 .fasync = ep0_fasync, 1947 .poll = ep0_poll, 1948 .unlocked_ioctl = gadget_dev_ioctl, 1949 .release = dev_release, 1950 }; 1951 1952 /*----------------------------------------------------------------------*/ 1953 1954 /* FILESYSTEM AND SUPERBLOCK OPERATIONS 1955 * 1956 * Mounting the filesystem creates a controller file, used first for 1957 * device configuration then later for event monitoring. 1958 */ 1959 1960 1961 /* FIXME PAM etc could set this security policy without mount options 1962 * if epfiles inherited ownership and permissons from ep0 ... 1963 */ 1964 1965 static unsigned default_uid; 1966 static unsigned default_gid; 1967 static unsigned default_perm = S_IRUSR | S_IWUSR; 1968 1969 module_param (default_uid, uint, 0644); 1970 module_param (default_gid, uint, 0644); 1971 module_param (default_perm, uint, 0644); 1972 1973 1974 static struct inode * 1975 gadgetfs_make_inode (struct super_block *sb, 1976 void *data, const struct file_operations *fops, 1977 int mode) 1978 { 1979 struct inode *inode = new_inode (sb); 1980 1981 if (inode) { 1982 inode->i_ino = get_next_ino(); 1983 inode->i_mode = mode; 1984 inode->i_uid = make_kuid(&init_user_ns, default_uid); 1985 inode->i_gid = make_kgid(&init_user_ns, default_gid); 1986 simple_inode_init_ts(inode); 1987 inode->i_private = data; 1988 inode->i_fop = fops; 1989 } 1990 return inode; 1991 } 1992 1993 /* creates in fs root directory, so non-renamable and non-linkable. 1994 * so inode and dentry are paired, until device reconfig. 1995 */ 1996 static int gadgetfs_create_file (struct super_block *sb, char const *name, 1997 void *data, const struct file_operations *fops) 1998 { 1999 struct dentry *dentry; 2000 struct inode *inode; 2001 2002 inode = gadgetfs_make_inode (sb, data, fops, 2003 S_IFREG | (default_perm & S_IRWXUGO)); 2004 if (!inode) 2005 return -ENOMEM; 2006 2007 dentry = simple_start_creating(sb->s_root, name); 2008 if (IS_ERR(dentry)) { 2009 iput(inode); 2010 return PTR_ERR(dentry); 2011 } 2012 2013 d_make_persistent(dentry, inode); 2014 2015 simple_done_creating(dentry); 2016 return 0; 2017 } 2018 2019 static const struct super_operations gadget_fs_operations = { 2020 .statfs = simple_statfs, 2021 .drop_inode = inode_just_drop, 2022 }; 2023 2024 static int 2025 gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc) 2026 { 2027 struct inode *inode; 2028 struct dev_data *dev; 2029 int rc; 2030 2031 mutex_lock(&sb_mutex); 2032 2033 if (the_device) { 2034 rc = -ESRCH; 2035 goto Done; 2036 } 2037 2038 CHIP = usb_get_gadget_udc_name(); 2039 if (!CHIP) { 2040 rc = -ENODEV; 2041 goto Done; 2042 } 2043 2044 /* superblock */ 2045 sb->s_blocksize = PAGE_SIZE; 2046 sb->s_blocksize_bits = PAGE_SHIFT; 2047 sb->s_magic = GADGETFS_MAGIC; 2048 sb->s_op = &gadget_fs_operations; 2049 sb->s_time_gran = 1; 2050 2051 /* root inode */ 2052 inode = gadgetfs_make_inode (sb, 2053 NULL, &simple_dir_operations, 2054 S_IFDIR | S_IRUGO | S_IXUGO); 2055 if (!inode) 2056 goto Enomem; 2057 inode->i_op = &simple_dir_inode_operations; 2058 if (!(sb->s_root = d_make_root (inode))) 2059 goto Enomem; 2060 2061 /* the ep0 file is named after the controller we expect; 2062 * user mode code can use it for sanity checks, like we do. 2063 */ 2064 dev = dev_new (); 2065 if (!dev) 2066 goto Enomem; 2067 2068 dev->sb = sb; 2069 rc = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations); 2070 if (rc) { 2071 put_dev(dev); 2072 goto Enomem; 2073 } 2074 2075 /* other endpoint files are available after hardware setup, 2076 * from binding to a controller. 2077 */ 2078 the_device = dev; 2079 rc = 0; 2080 goto Done; 2081 2082 Enomem: 2083 kfree(CHIP); 2084 CHIP = NULL; 2085 rc = -ENOMEM; 2086 2087 Done: 2088 mutex_unlock(&sb_mutex); 2089 return rc; 2090 } 2091 2092 /* "mount -t gadgetfs path /dev/gadget" ends up here */ 2093 static int gadgetfs_get_tree(struct fs_context *fc) 2094 { 2095 return get_tree_single(fc, gadgetfs_fill_super); 2096 } 2097 2098 static const struct fs_context_operations gadgetfs_context_ops = { 2099 .get_tree = gadgetfs_get_tree, 2100 }; 2101 2102 static int gadgetfs_init_fs_context(struct fs_context *fc) 2103 { 2104 fc->ops = &gadgetfs_context_ops; 2105 return 0; 2106 } 2107 2108 static void 2109 gadgetfs_kill_sb (struct super_block *sb) 2110 { 2111 mutex_lock(&sb_mutex); 2112 kill_anon_super (sb); 2113 if (the_device) { 2114 put_dev (the_device); 2115 the_device = NULL; 2116 } 2117 kfree(CHIP); 2118 CHIP = NULL; 2119 mutex_unlock(&sb_mutex); 2120 } 2121 2122 /*----------------------------------------------------------------------*/ 2123 2124 static struct file_system_type gadgetfs_type = { 2125 .owner = THIS_MODULE, 2126 .name = shortname, 2127 .init_fs_context = gadgetfs_init_fs_context, 2128 .kill_sb = gadgetfs_kill_sb, 2129 }; 2130 MODULE_ALIAS_FS("gadgetfs"); 2131 2132 /*----------------------------------------------------------------------*/ 2133 2134 static int __init gadgetfs_init (void) 2135 { 2136 int status; 2137 2138 status = register_filesystem (&gadgetfs_type); 2139 if (status == 0) 2140 pr_info ("%s: %s, version " DRIVER_VERSION "\n", 2141 shortname, driver_desc); 2142 return status; 2143 } 2144 module_init (gadgetfs_init); 2145 2146 static void __exit gadgetfs_cleanup (void) 2147 { 2148 pr_debug ("unregister %s\n", shortname); 2149 unregister_filesystem (&gadgetfs_type); 2150 } 2151 module_exit (gadgetfs_cleanup); 2152 2153