1// SPDX-License-Identifier: GPL-2.0 2/* 3 * USB Raw Gadget driver. 4 * See Documentation/usb/raw-gadget.rst for more details. 5 * 6 * Copyright (c) 2020 Google, Inc. 7 * Author: Andrey Konovalov <andreyknvl@gmail.com> 8 */ 9 10#include <linux/compiler.h> 11#include <linux/ctype.h> 12#include <linux/debugfs.h> 13#include <linux/delay.h> 14#include <linux/idr.h> 15#include <linux/kref.h> 16#include <linux/miscdevice.h> 17#include <linux/module.h> 18#include <linux/semaphore.h> 19#include <linux/sched.h> 20#include <linux/slab.h> 21#include <linux/uaccess.h> 22#include <linux/wait.h> 23 24#include <linux/usb.h> 25#include <linux/usb/ch9.h> 26#include <linux/usb/ch11.h> 27#include <linux/usb/gadget.h> 28 29#include <uapi/linux/usb/raw_gadget.h> 30 31#define DRIVER_DESC "USB Raw Gadget" 32#define DRIVER_NAME "raw-gadget" 33 34MODULE_DESCRIPTION(DRIVER_DESC); 35MODULE_AUTHOR("Andrey Konovalov"); 36MODULE_LICENSE("GPL"); 37 38/*----------------------------------------------------------------------*/ 39 40static DEFINE_IDA(driver_id_numbers); 41#define DRIVER_DRIVER_NAME_LENGTH_MAX 32 42 43#define RAW_EVENT_QUEUE_SIZE 16 44 45struct raw_event_queue { 46 /* See the comment in raw_event_queue_fetch() for locking details. */ 47 spinlock_t lock; 48 struct semaphore sema; 49 struct usb_raw_event *events[RAW_EVENT_QUEUE_SIZE]; 50 int size; 51}; 52 53static void raw_event_queue_init(struct raw_event_queue *queue) 54{ 55 spin_lock_init(&queue->lock); 56 sema_init(&queue->sema, 0); 57 queue->size = 0; 58} 59 60static int raw_event_queue_add(struct raw_event_queue *queue, 61 enum usb_raw_event_type type, size_t length, const void *data) 62{ 63 unsigned long flags; 64 struct usb_raw_event *event; 65 66 spin_lock_irqsave(&queue->lock, flags); 67 if (WARN_ON(queue->size >= RAW_EVENT_QUEUE_SIZE)) { 68 spin_unlock_irqrestore(&queue->lock, flags); 69 return -ENOMEM; 70 } 71 event = kmalloc(sizeof(*event) + length, GFP_ATOMIC); 72 if (!event) { 73 spin_unlock_irqrestore(&queue->lock, flags); 74 return -ENOMEM; 75 } 76 event->type = type; 77 event->length = length; 78 if (event->length) 79 memcpy(&event->data[0], data, length); 80 queue->events[queue->size] = event; 81 queue->size++; 82 up(&queue->sema); 83 spin_unlock_irqrestore(&queue->lock, flags); 84 return 0; 85} 86 87static struct usb_raw_event *raw_event_queue_fetch( 88 struct raw_event_queue *queue) 89{ 90 int ret; 91 unsigned long flags; 92 struct usb_raw_event *event; 93 94 /* 95 * This function can be called concurrently. We first check that 96 * there's at least one event queued by decrementing the semaphore, 97 * and then take the lock to protect queue struct fields. 98 */ 99 ret = down_interruptible(&queue->sema); 100 if (ret) 101 return ERR_PTR(ret); 102 spin_lock_irqsave(&queue->lock, flags); 103 /* 104 * queue->size must have the same value as queue->sema counter (before 105 * the down_interruptible() call above), so this check is a fail-safe. 106 */ 107 if (WARN_ON(!queue->size)) { 108 spin_unlock_irqrestore(&queue->lock, flags); 109 return ERR_PTR(-ENODEV); 110 } 111 event = queue->events[0]; 112 queue->size--; 113 memmove(&queue->events[0], &queue->events[1], 114 queue->size * sizeof(queue->events[0])); 115 spin_unlock_irqrestore(&queue->lock, flags); 116 return event; 117} 118 119static void raw_event_queue_destroy(struct raw_event_queue *queue) 120{ 121 int i; 122 123 for (i = 0; i < queue->size; i++) 124 kfree(queue->events[i]); 125 queue->size = 0; 126} 127 128/*----------------------------------------------------------------------*/ 129 130struct raw_dev; 131 132enum ep_state { 133 STATE_EP_DISABLED, 134 STATE_EP_ENABLED, 135}; 136 137struct raw_ep { 138 struct raw_dev *dev; 139 enum ep_state state; 140 struct usb_ep *ep; 141 u8 addr; 142 struct usb_request *req; 143 bool urb_queued; 144 bool disabling; 145 ssize_t status; 146}; 147 148enum dev_state { 149 STATE_DEV_INVALID = 0, 150 STATE_DEV_OPENED, 151 STATE_DEV_INITIALIZED, 152 STATE_DEV_REGISTERING, 153 STATE_DEV_RUNNING, 154 STATE_DEV_CLOSED, 155 STATE_DEV_FAILED 156}; 157 158struct raw_dev { 159 struct kref count; 160 spinlock_t lock; 161 162 const char *udc_name; 163 struct usb_gadget_driver driver; 164 165 /* Reference to misc device: */ 166 struct device *dev; 167 168 /* Make driver names unique */ 169 int driver_id_number; 170 171 /* Protected by lock: */ 172 enum dev_state state; 173 bool gadget_registered; 174 struct usb_gadget *gadget; 175 struct usb_request *req; 176 bool ep0_in_pending; 177 bool ep0_out_pending; 178 bool ep0_urb_queued; 179 ssize_t ep0_status; 180 struct raw_ep eps[USB_RAW_EPS_NUM_MAX]; 181 int eps_num; 182 183 struct completion ep0_done; 184 struct raw_event_queue queue; 185}; 186 187static struct raw_dev *dev_new(void) 188{ 189 struct raw_dev *dev; 190 191 dev = kzalloc(sizeof(*dev), GFP_KERNEL); 192 if (!dev) 193 return NULL; 194 /* Matches kref_put() in raw_release(). */ 195 kref_init(&dev->count); 196 spin_lock_init(&dev->lock); 197 init_completion(&dev->ep0_done); 198 raw_event_queue_init(&dev->queue); 199 dev->driver_id_number = -1; 200 return dev; 201} 202 203static void dev_free(struct kref *kref) 204{ 205 struct raw_dev *dev = container_of(kref, struct raw_dev, count); 206 int i; 207 208 kfree(dev->udc_name); 209 kfree(dev->driver.udc_name); 210 kfree(dev->driver.driver.name); 211 if (dev->driver_id_number >= 0) 212 ida_free(&driver_id_numbers, dev->driver_id_number); 213 if (dev->req) { 214 if (dev->ep0_urb_queued) 215 usb_ep_dequeue(dev->gadget->ep0, dev->req); 216 usb_ep_free_request(dev->gadget->ep0, dev->req); 217 } 218 raw_event_queue_destroy(&dev->queue); 219 for (i = 0; i < dev->eps_num; i++) { 220 if (dev->eps[i].state == STATE_EP_DISABLED) 221 continue; 222 usb_ep_disable(dev->eps[i].ep); 223 usb_ep_free_request(dev->eps[i].ep, dev->eps[i].req); 224 kfree(dev->eps[i].ep->desc); 225 dev->eps[i].state = STATE_EP_DISABLED; 226 } 227 kfree(dev); 228} 229 230/*----------------------------------------------------------------------*/ 231 232static int raw_queue_event(struct raw_dev *dev, 233 enum usb_raw_event_type type, size_t length, const void *data) 234{ 235 int ret = 0; 236 unsigned long flags; 237 238 ret = raw_event_queue_add(&dev->queue, type, length, data); 239 if (ret < 0) { 240 spin_lock_irqsave(&dev->lock, flags); 241 dev->state = STATE_DEV_FAILED; 242 spin_unlock_irqrestore(&dev->lock, flags); 243 } 244 return ret; 245} 246 247static void gadget_ep0_complete(struct usb_ep *ep, struct usb_request *req) 248{ 249 struct raw_dev *dev = req->context; 250 unsigned long flags; 251 252 spin_lock_irqsave(&dev->lock, flags); 253 if (req->status) 254 dev->ep0_status = req->status; 255 else 256 dev->ep0_status = req->actual; 257 if (dev->ep0_in_pending) 258 dev->ep0_in_pending = false; 259 else 260 dev->ep0_out_pending = false; 261 spin_unlock_irqrestore(&dev->lock, flags); 262 263 complete(&dev->ep0_done); 264} 265 266static u8 get_ep_addr(const char *name) 267{ 268 /* If the endpoint has fixed function (named as e.g. "ep12out-bulk"), 269 * parse the endpoint address from its name. We deliberately use 270 * deprecated simple_strtoul() function here, as the number isn't 271 * followed by '\0' nor '\n'. 272 */ 273 if (isdigit(name[2])) 274 return simple_strtoul(&name[2], NULL, 10); 275 /* Otherwise the endpoint is configurable (named as e.g. "ep-a"). */ 276 return USB_RAW_EP_ADDR_ANY; 277} 278 279static int gadget_bind(struct usb_gadget *gadget, 280 struct usb_gadget_driver *driver) 281{ 282 int ret = 0, i = 0; 283 struct raw_dev *dev = container_of(driver, struct raw_dev, driver); 284 struct usb_request *req; 285 struct usb_ep *ep; 286 unsigned long flags; 287 288 if (strcmp(gadget->name, dev->udc_name) != 0) 289 return -ENODEV; 290 291 set_gadget_data(gadget, dev); 292 req = usb_ep_alloc_request(gadget->ep0, GFP_KERNEL); 293 if (!req) { 294 dev_err(&gadget->dev, "usb_ep_alloc_request failed\n"); 295 set_gadget_data(gadget, NULL); 296 return -ENOMEM; 297 } 298 299 spin_lock_irqsave(&dev->lock, flags); 300 dev->req = req; 301 dev->req->context = dev; 302 dev->req->complete = gadget_ep0_complete; 303 dev->gadget = gadget; 304 gadget_for_each_ep(ep, dev->gadget) { 305 dev->eps[i].ep = ep; 306 dev->eps[i].addr = get_ep_addr(ep->name); 307 dev->eps[i].state = STATE_EP_DISABLED; 308 i++; 309 } 310 dev->eps_num = i; 311 spin_unlock_irqrestore(&dev->lock, flags); 312 313 ret = raw_queue_event(dev, USB_RAW_EVENT_CONNECT, 0, NULL); 314 if (ret < 0) { 315 dev_err(&gadget->dev, "failed to queue event\n"); 316 set_gadget_data(gadget, NULL); 317 return ret; 318 } 319 320 /* Matches kref_put() in gadget_unbind(). */ 321 kref_get(&dev->count); 322 return ret; 323} 324 325static void gadget_unbind(struct usb_gadget *gadget) 326{ 327 struct raw_dev *dev = get_gadget_data(gadget); 328 329 set_gadget_data(gadget, NULL); 330 /* Matches kref_get() in gadget_bind(). */ 331 kref_put(&dev->count, dev_free); 332} 333 334static int gadget_setup(struct usb_gadget *gadget, 335 const struct usb_ctrlrequest *ctrl) 336{ 337 int ret = 0; 338 struct raw_dev *dev = get_gadget_data(gadget); 339 unsigned long flags; 340 341 spin_lock_irqsave(&dev->lock, flags); 342 if (dev->state != STATE_DEV_RUNNING) { 343 dev_err(&gadget->dev, "ignoring, device is not running\n"); 344 ret = -ENODEV; 345 goto out_unlock; 346 } 347 if (dev->ep0_in_pending || dev->ep0_out_pending) { 348 dev_dbg(&gadget->dev, "stalling, request already pending\n"); 349 ret = -EBUSY; 350 goto out_unlock; 351 } 352 if ((ctrl->bRequestType & USB_DIR_IN) && ctrl->wLength) 353 dev->ep0_in_pending = true; 354 else 355 dev->ep0_out_pending = true; 356 spin_unlock_irqrestore(&dev->lock, flags); 357 358 ret = raw_queue_event(dev, USB_RAW_EVENT_CONTROL, sizeof(*ctrl), ctrl); 359 if (ret < 0) 360 dev_err(&gadget->dev, "failed to queue event\n"); 361 goto out; 362 363out_unlock: 364 spin_unlock_irqrestore(&dev->lock, flags); 365out: 366 return ret; 367} 368 369/* These are currently unused but present in case UDC driver requires them. */ 370static void gadget_disconnect(struct usb_gadget *gadget) { } 371static void gadget_suspend(struct usb_gadget *gadget) { } 372static void gadget_resume(struct usb_gadget *gadget) { } 373static void gadget_reset(struct usb_gadget *gadget) { } 374 375/*----------------------------------------------------------------------*/ 376 377static struct miscdevice raw_misc_device; 378 379static int raw_open(struct inode *inode, struct file *fd) 380{ 381 struct raw_dev *dev; 382 383 /* Nonblocking I/O is not supported yet. */ 384 if (fd->f_flags & O_NONBLOCK) 385 return -EINVAL; 386 387 dev = dev_new(); 388 if (!dev) 389 return -ENOMEM; 390 fd->private_data = dev; 391 dev->state = STATE_DEV_OPENED; 392 dev->dev = raw_misc_device.this_device; 393 return 0; 394} 395 396static int raw_release(struct inode *inode, struct file *fd) 397{ 398 int ret = 0; 399 struct raw_dev *dev = fd->private_data; 400 unsigned long flags; 401 bool unregister = false; 402 403 spin_lock_irqsave(&dev->lock, flags); 404 dev->state = STATE_DEV_CLOSED; 405 if (!dev->gadget) { 406 spin_unlock_irqrestore(&dev->lock, flags); 407 goto out_put; 408 } 409 if (dev->gadget_registered) 410 unregister = true; 411 dev->gadget_registered = false; 412 spin_unlock_irqrestore(&dev->lock, flags); 413 414 if (unregister) { 415 ret = usb_gadget_unregister_driver(&dev->driver); 416 if (ret != 0) 417 dev_err(dev->dev, 418 "usb_gadget_unregister_driver() failed with %d\n", 419 ret); 420 /* Matches kref_get() in raw_ioctl_run(). */ 421 kref_put(&dev->count, dev_free); 422 } 423 424out_put: 425 /* Matches dev_new() in raw_open(). */ 426 kref_put(&dev->count, dev_free); 427 return ret; 428} 429 430/*----------------------------------------------------------------------*/ 431 432static int raw_ioctl_init(struct raw_dev *dev, unsigned long value) 433{ 434 int ret = 0; 435 int driver_id_number; 436 struct usb_raw_init arg; 437 char *udc_driver_name; 438 char *udc_device_name; 439 char *driver_driver_name; 440 unsigned long flags; 441 442 if (copy_from_user(&arg, (void __user *)value, sizeof(arg))) 443 return -EFAULT; 444 445 switch (arg.speed) { 446 case USB_SPEED_UNKNOWN: 447 arg.speed = USB_SPEED_HIGH; 448 break; 449 case USB_SPEED_LOW: 450 case USB_SPEED_FULL: 451 case USB_SPEED_HIGH: 452 case USB_SPEED_SUPER: 453 break; 454 default: 455 return -EINVAL; 456 } 457 458 driver_id_number = ida_alloc(&driver_id_numbers, GFP_KERNEL); 459 if (driver_id_number < 0) 460 return driver_id_number; 461 462 driver_driver_name = kmalloc(DRIVER_DRIVER_NAME_LENGTH_MAX, GFP_KERNEL); 463 if (!driver_driver_name) { 464 ret = -ENOMEM; 465 goto out_free_driver_id_number; 466 } 467 snprintf(driver_driver_name, DRIVER_DRIVER_NAME_LENGTH_MAX, 468 DRIVER_NAME ".%d", driver_id_number); 469 470 udc_driver_name = kmalloc(UDC_NAME_LENGTH_MAX, GFP_KERNEL); 471 if (!udc_driver_name) { 472 ret = -ENOMEM; 473 goto out_free_driver_driver_name; 474 } 475 ret = strscpy(udc_driver_name, &arg.driver_name[0], 476 UDC_NAME_LENGTH_MAX); 477 if (ret < 0) 478 goto out_free_udc_driver_name; 479 ret = 0; 480 481 udc_device_name = kmalloc(UDC_NAME_LENGTH_MAX, GFP_KERNEL); 482 if (!udc_device_name) { 483 ret = -ENOMEM; 484 goto out_free_udc_driver_name; 485 } 486 ret = strscpy(udc_device_name, &arg.device_name[0], 487 UDC_NAME_LENGTH_MAX); 488 if (ret < 0) 489 goto out_free_udc_device_name; 490 ret = 0; 491 492 spin_lock_irqsave(&dev->lock, flags); 493 if (dev->state != STATE_DEV_OPENED) { 494 dev_dbg(dev->dev, "fail, device is not opened\n"); 495 ret = -EINVAL; 496 goto out_unlock; 497 } 498 dev->udc_name = udc_driver_name; 499 500 dev->driver.function = DRIVER_DESC; 501 dev->driver.max_speed = arg.speed; 502 dev->driver.setup = gadget_setup; 503 dev->driver.disconnect = gadget_disconnect; 504 dev->driver.bind = gadget_bind; 505 dev->driver.unbind = gadget_unbind; 506 dev->driver.suspend = gadget_suspend; 507 dev->driver.resume = gadget_resume; 508 dev->driver.reset = gadget_reset; 509 dev->driver.driver.name = driver_driver_name; 510 dev->driver.udc_name = udc_device_name; 511 dev->driver.match_existing_only = 1; 512 dev->driver_id_number = driver_id_number; 513 514 dev->state = STATE_DEV_INITIALIZED; 515 spin_unlock_irqrestore(&dev->lock, flags); 516 return ret; 517 518out_unlock: 519 spin_unlock_irqrestore(&dev->lock, flags); 520out_free_udc_device_name: 521 kfree(udc_device_name); 522out_free_udc_driver_name: 523 kfree(udc_driver_name); 524out_free_driver_driver_name: 525 kfree(driver_driver_name); 526out_free_driver_id_number: 527 ida_free(&driver_id_numbers, driver_id_number); 528 return ret; 529} 530 531static int raw_ioctl_run(struct raw_dev *dev, unsigned long value) 532{ 533 int ret = 0; 534 unsigned long flags; 535 536 if (value) 537 return -EINVAL; 538 539 spin_lock_irqsave(&dev->lock, flags); 540 if (dev->state != STATE_DEV_INITIALIZED) { 541 dev_dbg(dev->dev, "fail, device is not initialized\n"); 542 ret = -EINVAL; 543 goto out_unlock; 544 } 545 dev->state = STATE_DEV_REGISTERING; 546 spin_unlock_irqrestore(&dev->lock, flags); 547 548 ret = usb_gadget_register_driver(&dev->driver); 549 550 spin_lock_irqsave(&dev->lock, flags); 551 if (ret) { 552 dev_err(dev->dev, 553 "fail, usb_gadget_register_driver returned %d\n", ret); 554 dev->state = STATE_DEV_FAILED; 555 goto out_unlock; 556 } 557 dev->gadget_registered = true; 558 dev->state = STATE_DEV_RUNNING; 559 /* Matches kref_put() in raw_release(). */ 560 kref_get(&dev->count); 561 562out_unlock: 563 spin_unlock_irqrestore(&dev->lock, flags); 564 return ret; 565} 566 567static int raw_ioctl_event_fetch(struct raw_dev *dev, unsigned long value) 568{ 569 struct usb_raw_event arg; 570 unsigned long flags; 571 struct usb_raw_event *event; 572 uint32_t length; 573 574 if (copy_from_user(&arg, (void __user *)value, sizeof(arg))) 575 return -EFAULT; 576 577 spin_lock_irqsave(&dev->lock, flags); 578 if (dev->state != STATE_DEV_RUNNING) { 579 dev_dbg(dev->dev, "fail, device is not running\n"); 580 spin_unlock_irqrestore(&dev->lock, flags); 581 return -EINVAL; 582 } 583 if (!dev->gadget) { 584 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 585 spin_unlock_irqrestore(&dev->lock, flags); 586 return -EBUSY; 587 } 588 spin_unlock_irqrestore(&dev->lock, flags); 589 590 event = raw_event_queue_fetch(&dev->queue); 591 if (PTR_ERR(event) == -EINTR) { 592 dev_dbg(&dev->gadget->dev, "event fetching interrupted\n"); 593 return -EINTR; 594 } 595 if (IS_ERR(event)) { 596 dev_err(&dev->gadget->dev, "failed to fetch event\n"); 597 spin_lock_irqsave(&dev->lock, flags); 598 dev->state = STATE_DEV_FAILED; 599 spin_unlock_irqrestore(&dev->lock, flags); 600 return -ENODEV; 601 } 602 length = min(arg.length, event->length); 603 if (copy_to_user((void __user *)value, event, sizeof(*event) + length)) { 604 kfree(event); 605 return -EFAULT; 606 } 607 608 kfree(event); 609 return 0; 610} 611 612static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr, 613 bool get_from_user) 614{ 615 void *data; 616 617 if (copy_from_user(io, ptr, sizeof(*io))) 618 return ERR_PTR(-EFAULT); 619 if (io->ep >= USB_RAW_EPS_NUM_MAX) 620 return ERR_PTR(-EINVAL); 621 if (!usb_raw_io_flags_valid(io->flags)) 622 return ERR_PTR(-EINVAL); 623 if (io->length > PAGE_SIZE) 624 return ERR_PTR(-EINVAL); 625 if (get_from_user) 626 data = memdup_user(ptr + sizeof(*io), io->length); 627 else { 628 data = kmalloc(io->length, GFP_KERNEL); 629 if (!data) 630 data = ERR_PTR(-ENOMEM); 631 } 632 return data; 633} 634 635static int raw_process_ep0_io(struct raw_dev *dev, struct usb_raw_ep_io *io, 636 void *data, bool in) 637{ 638 int ret = 0; 639 unsigned long flags; 640 641 spin_lock_irqsave(&dev->lock, flags); 642 if (dev->state != STATE_DEV_RUNNING) { 643 dev_dbg(dev->dev, "fail, device is not running\n"); 644 ret = -EINVAL; 645 goto out_unlock; 646 } 647 if (!dev->gadget) { 648 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 649 ret = -EBUSY; 650 goto out_unlock; 651 } 652 if (dev->ep0_urb_queued) { 653 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n"); 654 ret = -EBUSY; 655 goto out_unlock; 656 } 657 if ((in && !dev->ep0_in_pending) || 658 (!in && !dev->ep0_out_pending)) { 659 dev_dbg(&dev->gadget->dev, "fail, wrong direction\n"); 660 ret = -EBUSY; 661 goto out_unlock; 662 } 663 if (WARN_ON(in && dev->ep0_out_pending)) { 664 ret = -ENODEV; 665 dev->state = STATE_DEV_FAILED; 666 goto out_unlock; 667 } 668 if (WARN_ON(!in && dev->ep0_in_pending)) { 669 ret = -ENODEV; 670 dev->state = STATE_DEV_FAILED; 671 goto out_unlock; 672 } 673 674 dev->req->buf = data; 675 dev->req->length = io->length; 676 dev->req->zero = usb_raw_io_flags_zero(io->flags); 677 dev->ep0_urb_queued = true; 678 spin_unlock_irqrestore(&dev->lock, flags); 679 680 ret = usb_ep_queue(dev->gadget->ep0, dev->req, GFP_KERNEL); 681 if (ret) { 682 dev_err(&dev->gadget->dev, 683 "fail, usb_ep_queue returned %d\n", ret); 684 spin_lock_irqsave(&dev->lock, flags); 685 dev->state = STATE_DEV_FAILED; 686 goto out_queue_failed; 687 } 688 689 ret = wait_for_completion_interruptible(&dev->ep0_done); 690 if (ret) { 691 dev_dbg(&dev->gadget->dev, "wait interrupted\n"); 692 usb_ep_dequeue(dev->gadget->ep0, dev->req); 693 wait_for_completion(&dev->ep0_done); 694 spin_lock_irqsave(&dev->lock, flags); 695 if (dev->ep0_status == -ECONNRESET) 696 dev->ep0_status = -EINTR; 697 goto out_interrupted; 698 } 699 700 spin_lock_irqsave(&dev->lock, flags); 701 702out_interrupted: 703 ret = dev->ep0_status; 704out_queue_failed: 705 dev->ep0_urb_queued = false; 706out_unlock: 707 spin_unlock_irqrestore(&dev->lock, flags); 708 return ret; 709} 710 711static int raw_ioctl_ep0_write(struct raw_dev *dev, unsigned long value) 712{ 713 int ret = 0; 714 void *data; 715 struct usb_raw_ep_io io; 716 717 data = raw_alloc_io_data(&io, (void __user *)value, true); 718 if (IS_ERR(data)) 719 return PTR_ERR(data); 720 ret = raw_process_ep0_io(dev, &io, data, true); 721 kfree(data); 722 return ret; 723} 724 725static int raw_ioctl_ep0_read(struct raw_dev *dev, unsigned long value) 726{ 727 int ret = 0; 728 void *data; 729 struct usb_raw_ep_io io; 730 unsigned int length; 731 732 data = raw_alloc_io_data(&io, (void __user *)value, false); 733 if (IS_ERR(data)) 734 return PTR_ERR(data); 735 ret = raw_process_ep0_io(dev, &io, data, false); 736 if (ret < 0) 737 goto free; 738 739 length = min(io.length, (unsigned int)ret); 740 if (copy_to_user((void __user *)(value + sizeof(io)), data, length)) 741 ret = -EFAULT; 742 else 743 ret = length; 744free: 745 kfree(data); 746 return ret; 747} 748 749static int raw_ioctl_ep0_stall(struct raw_dev *dev, unsigned long value) 750{ 751 int ret = 0; 752 unsigned long flags; 753 754 if (value) 755 return -EINVAL; 756 spin_lock_irqsave(&dev->lock, flags); 757 if (dev->state != STATE_DEV_RUNNING) { 758 dev_dbg(dev->dev, "fail, device is not running\n"); 759 ret = -EINVAL; 760 goto out_unlock; 761 } 762 if (!dev->gadget) { 763 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 764 ret = -EBUSY; 765 goto out_unlock; 766 } 767 if (dev->ep0_urb_queued) { 768 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n"); 769 ret = -EBUSY; 770 goto out_unlock; 771 } 772 if (!dev->ep0_in_pending && !dev->ep0_out_pending) { 773 dev_dbg(&dev->gadget->dev, "fail, no request pending\n"); 774 ret = -EBUSY; 775 goto out_unlock; 776 } 777 778 ret = usb_ep_set_halt(dev->gadget->ep0); 779 if (ret < 0) 780 dev_err(&dev->gadget->dev, 781 "fail, usb_ep_set_halt returned %d\n", ret); 782 783 if (dev->ep0_in_pending) 784 dev->ep0_in_pending = false; 785 else 786 dev->ep0_out_pending = false; 787 788out_unlock: 789 spin_unlock_irqrestore(&dev->lock, flags); 790 return ret; 791} 792 793static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value) 794{ 795 int ret = 0, i; 796 unsigned long flags; 797 struct usb_endpoint_descriptor *desc; 798 struct raw_ep *ep; 799 bool ep_props_matched = false; 800 801 desc = memdup_user((void __user *)value, sizeof(*desc)); 802 if (IS_ERR(desc)) 803 return PTR_ERR(desc); 804 805 /* 806 * Endpoints with a maxpacket length of 0 can cause crashes in UDC 807 * drivers. 808 */ 809 if (usb_endpoint_maxp(desc) == 0) { 810 dev_dbg(dev->dev, "fail, bad endpoint maxpacket\n"); 811 kfree(desc); 812 return -EINVAL; 813 } 814 815 spin_lock_irqsave(&dev->lock, flags); 816 if (dev->state != STATE_DEV_RUNNING) { 817 dev_dbg(dev->dev, "fail, device is not running\n"); 818 ret = -EINVAL; 819 goto out_free; 820 } 821 if (!dev->gadget) { 822 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 823 ret = -EBUSY; 824 goto out_free; 825 } 826 827 for (i = 0; i < dev->eps_num; i++) { 828 ep = &dev->eps[i]; 829 if (ep->addr != usb_endpoint_num(desc) && 830 ep->addr != USB_RAW_EP_ADDR_ANY) 831 continue; 832 if (!usb_gadget_ep_match_desc(dev->gadget, ep->ep, desc, NULL)) 833 continue; 834 ep_props_matched = true; 835 if (ep->state != STATE_EP_DISABLED) 836 continue; 837 ep->ep->desc = desc; 838 ret = usb_ep_enable(ep->ep); 839 if (ret < 0) { 840 dev_err(&dev->gadget->dev, 841 "fail, usb_ep_enable returned %d\n", ret); 842 goto out_free; 843 } 844 ep->req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC); 845 if (!ep->req) { 846 dev_err(&dev->gadget->dev, 847 "fail, usb_ep_alloc_request failed\n"); 848 usb_ep_disable(ep->ep); 849 ret = -ENOMEM; 850 goto out_free; 851 } 852 ep->state = STATE_EP_ENABLED; 853 ep->ep->driver_data = ep; 854 ret = i; 855 goto out_unlock; 856 } 857 858 if (!ep_props_matched) { 859 dev_dbg(&dev->gadget->dev, "fail, bad endpoint descriptor\n"); 860 ret = -EINVAL; 861 } else { 862 dev_dbg(&dev->gadget->dev, "fail, no endpoints available\n"); 863 ret = -EBUSY; 864 } 865 866out_free: 867 kfree(desc); 868out_unlock: 869 spin_unlock_irqrestore(&dev->lock, flags); 870 return ret; 871} 872 873static int raw_ioctl_ep_disable(struct raw_dev *dev, unsigned long value) 874{ 875 int ret = 0, i = value; 876 unsigned long flags; 877 878 spin_lock_irqsave(&dev->lock, flags); 879 if (dev->state != STATE_DEV_RUNNING) { 880 dev_dbg(dev->dev, "fail, device is not running\n"); 881 ret = -EINVAL; 882 goto out_unlock; 883 } 884 if (!dev->gadget) { 885 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 886 ret = -EBUSY; 887 goto out_unlock; 888 } 889 if (i < 0 || i >= dev->eps_num) { 890 dev_dbg(dev->dev, "fail, invalid endpoint\n"); 891 ret = -EBUSY; 892 goto out_unlock; 893 } 894 if (dev->eps[i].state == STATE_EP_DISABLED) { 895 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n"); 896 ret = -EINVAL; 897 goto out_unlock; 898 } 899 if (dev->eps[i].disabling) { 900 dev_dbg(&dev->gadget->dev, 901 "fail, disable already in progress\n"); 902 ret = -EINVAL; 903 goto out_unlock; 904 } 905 if (dev->eps[i].urb_queued) { 906 dev_dbg(&dev->gadget->dev, 907 "fail, waiting for urb completion\n"); 908 ret = -EINVAL; 909 goto out_unlock; 910 } 911 dev->eps[i].disabling = true; 912 spin_unlock_irqrestore(&dev->lock, flags); 913 914 usb_ep_disable(dev->eps[i].ep); 915 916 spin_lock_irqsave(&dev->lock, flags); 917 usb_ep_free_request(dev->eps[i].ep, dev->eps[i].req); 918 kfree(dev->eps[i].ep->desc); 919 dev->eps[i].state = STATE_EP_DISABLED; 920 dev->eps[i].disabling = false; 921 922out_unlock: 923 spin_unlock_irqrestore(&dev->lock, flags); 924 return ret; 925} 926 927static int raw_ioctl_ep_set_clear_halt_wedge(struct raw_dev *dev, 928 unsigned long value, bool set, bool halt) 929{ 930 int ret = 0, i = value; 931 unsigned long flags; 932 933 spin_lock_irqsave(&dev->lock, flags); 934 if (dev->state != STATE_DEV_RUNNING) { 935 dev_dbg(dev->dev, "fail, device is not running\n"); 936 ret = -EINVAL; 937 goto out_unlock; 938 } 939 if (!dev->gadget) { 940 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 941 ret = -EBUSY; 942 goto out_unlock; 943 } 944 if (i < 0 || i >= dev->eps_num) { 945 dev_dbg(dev->dev, "fail, invalid endpoint\n"); 946 ret = -EBUSY; 947 goto out_unlock; 948 } 949 if (dev->eps[i].state == STATE_EP_DISABLED) { 950 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n"); 951 ret = -EINVAL; 952 goto out_unlock; 953 } 954 if (dev->eps[i].disabling) { 955 dev_dbg(&dev->gadget->dev, 956 "fail, disable is in progress\n"); 957 ret = -EINVAL; 958 goto out_unlock; 959 } 960 if (dev->eps[i].urb_queued) { 961 dev_dbg(&dev->gadget->dev, 962 "fail, waiting for urb completion\n"); 963 ret = -EINVAL; 964 goto out_unlock; 965 } 966 if (usb_endpoint_xfer_isoc(dev->eps[i].ep->desc)) { 967 dev_dbg(&dev->gadget->dev, 968 "fail, can't halt/wedge ISO endpoint\n"); 969 ret = -EINVAL; 970 goto out_unlock; 971 } 972 973 if (set && halt) { 974 ret = usb_ep_set_halt(dev->eps[i].ep); 975 if (ret < 0) 976 dev_err(&dev->gadget->dev, 977 "fail, usb_ep_set_halt returned %d\n", ret); 978 } else if (!set && halt) { 979 ret = usb_ep_clear_halt(dev->eps[i].ep); 980 if (ret < 0) 981 dev_err(&dev->gadget->dev, 982 "fail, usb_ep_clear_halt returned %d\n", ret); 983 } else if (set && !halt) { 984 ret = usb_ep_set_wedge(dev->eps[i].ep); 985 if (ret < 0) 986 dev_err(&dev->gadget->dev, 987 "fail, usb_ep_set_wedge returned %d\n", ret); 988 } 989 990out_unlock: 991 spin_unlock_irqrestore(&dev->lock, flags); 992 return ret; 993} 994 995static void gadget_ep_complete(struct usb_ep *ep, struct usb_request *req) 996{ 997 struct raw_ep *r_ep = (struct raw_ep *)ep->driver_data; 998 struct raw_dev *dev = r_ep->dev; 999 unsigned long flags; 1000 1001 spin_lock_irqsave(&dev->lock, flags); 1002 if (req->status) 1003 r_ep->status = req->status; 1004 else 1005 r_ep->status = req->actual; 1006 spin_unlock_irqrestore(&dev->lock, flags); 1007 1008 complete((struct completion *)req->context); 1009} 1010 1011static int raw_process_ep_io(struct raw_dev *dev, struct usb_raw_ep_io *io, 1012 void *data, bool in) 1013{ 1014 int ret = 0; 1015 unsigned long flags; 1016 struct raw_ep *ep; 1017 DECLARE_COMPLETION_ONSTACK(done); 1018 1019 spin_lock_irqsave(&dev->lock, flags); 1020 if (dev->state != STATE_DEV_RUNNING) { 1021 dev_dbg(dev->dev, "fail, device is not running\n"); 1022 ret = -EINVAL; 1023 goto out_unlock; 1024 } 1025 if (!dev->gadget) { 1026 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 1027 ret = -EBUSY; 1028 goto out_unlock; 1029 } 1030 if (io->ep >= dev->eps_num) { 1031 dev_dbg(&dev->gadget->dev, "fail, invalid endpoint\n"); 1032 ret = -EINVAL; 1033 goto out_unlock; 1034 } 1035 ep = &dev->eps[io->ep]; 1036 if (ep->state != STATE_EP_ENABLED) { 1037 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n"); 1038 ret = -EBUSY; 1039 goto out_unlock; 1040 } 1041 if (ep->disabling) { 1042 dev_dbg(&dev->gadget->dev, 1043 "fail, endpoint is already being disabled\n"); 1044 ret = -EBUSY; 1045 goto out_unlock; 1046 } 1047 if (ep->urb_queued) { 1048 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n"); 1049 ret = -EBUSY; 1050 goto out_unlock; 1051 } 1052 if (in != usb_endpoint_dir_in(ep->ep->desc)) { 1053 dev_dbg(&dev->gadget->dev, "fail, wrong direction\n"); 1054 ret = -EINVAL; 1055 goto out_unlock; 1056 } 1057 1058 ep->dev = dev; 1059 ep->req->context = &done; 1060 ep->req->complete = gadget_ep_complete; 1061 ep->req->buf = data; 1062 ep->req->length = io->length; 1063 ep->req->zero = usb_raw_io_flags_zero(io->flags); 1064 ep->urb_queued = true; 1065 spin_unlock_irqrestore(&dev->lock, flags); 1066 1067 ret = usb_ep_queue(ep->ep, ep->req, GFP_KERNEL); 1068 if (ret) { 1069 dev_err(&dev->gadget->dev, 1070 "fail, usb_ep_queue returned %d\n", ret); 1071 spin_lock_irqsave(&dev->lock, flags); 1072 dev->state = STATE_DEV_FAILED; 1073 goto out_queue_failed; 1074 } 1075 1076 ret = wait_for_completion_interruptible(&done); 1077 if (ret) { 1078 dev_dbg(&dev->gadget->dev, "wait interrupted\n"); 1079 usb_ep_dequeue(ep->ep, ep->req); 1080 wait_for_completion(&done); 1081 spin_lock_irqsave(&dev->lock, flags); 1082 if (ep->status == -ECONNRESET) 1083 ep->status = -EINTR; 1084 goto out_interrupted; 1085 } 1086 1087 spin_lock_irqsave(&dev->lock, flags); 1088 1089out_interrupted: 1090 ret = ep->status; 1091out_queue_failed: 1092 ep->urb_queued = false; 1093out_unlock: 1094 spin_unlock_irqrestore(&dev->lock, flags); 1095 return ret; 1096} 1097 1098static int raw_ioctl_ep_write(struct raw_dev *dev, unsigned long value) 1099{ 1100 int ret = 0; 1101 char *data; 1102 struct usb_raw_ep_io io; 1103 1104 data = raw_alloc_io_data(&io, (void __user *)value, true); 1105 if (IS_ERR(data)) 1106 return PTR_ERR(data); 1107 ret = raw_process_ep_io(dev, &io, data, true); 1108 kfree(data); 1109 return ret; 1110} 1111 1112static int raw_ioctl_ep_read(struct raw_dev *dev, unsigned long value) 1113{ 1114 int ret = 0; 1115 char *data; 1116 struct usb_raw_ep_io io; 1117 unsigned int length; 1118 1119 data = raw_alloc_io_data(&io, (void __user *)value, false); 1120 if (IS_ERR(data)) 1121 return PTR_ERR(data); 1122 ret = raw_process_ep_io(dev, &io, data, false); 1123 if (ret < 0) 1124 goto free; 1125 1126 length = min(io.length, (unsigned int)ret); 1127 if (copy_to_user((void __user *)(value + sizeof(io)), data, length)) 1128 ret = -EFAULT; 1129 else 1130 ret = length; 1131free: 1132 kfree(data); 1133 return ret; 1134} 1135 1136static int raw_ioctl_configure(struct raw_dev *dev, unsigned long value) 1137{ 1138 int ret = 0; 1139 unsigned long flags; 1140 1141 if (value) 1142 return -EINVAL; 1143 spin_lock_irqsave(&dev->lock, flags); 1144 if (dev->state != STATE_DEV_RUNNING) { 1145 dev_dbg(dev->dev, "fail, device is not running\n"); 1146 ret = -EINVAL; 1147 goto out_unlock; 1148 } 1149 if (!dev->gadget) { 1150 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 1151 ret = -EBUSY; 1152 goto out_unlock; 1153 } 1154 usb_gadget_set_state(dev->gadget, USB_STATE_CONFIGURED); 1155 1156out_unlock: 1157 spin_unlock_irqrestore(&dev->lock, flags); 1158 return ret; 1159} 1160 1161static int raw_ioctl_vbus_draw(struct raw_dev *dev, unsigned long value) 1162{ 1163 int ret = 0; 1164 unsigned long flags; 1165 1166 spin_lock_irqsave(&dev->lock, flags); 1167 if (dev->state != STATE_DEV_RUNNING) { 1168 dev_dbg(dev->dev, "fail, device is not running\n"); 1169 ret = -EINVAL; 1170 goto out_unlock; 1171 } 1172 if (!dev->gadget) { 1173 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 1174 ret = -EBUSY; 1175 goto out_unlock; 1176 } 1177 usb_gadget_vbus_draw(dev->gadget, 2 * value); 1178 1179out_unlock: 1180 spin_unlock_irqrestore(&dev->lock, flags); 1181 return ret; 1182} 1183 1184static void fill_ep_caps(struct usb_ep_caps *caps, 1185 struct usb_raw_ep_caps *raw_caps) 1186{ 1187 raw_caps->type_control = caps->type_control; 1188 raw_caps->type_iso = caps->type_iso; 1189 raw_caps->type_bulk = caps->type_bulk; 1190 raw_caps->type_int = caps->type_int; 1191 raw_caps->dir_in = caps->dir_in; 1192 raw_caps->dir_out = caps->dir_out; 1193} 1194 1195static void fill_ep_limits(struct usb_ep *ep, struct usb_raw_ep_limits *limits) 1196{ 1197 limits->maxpacket_limit = ep->maxpacket_limit; 1198 limits->max_streams = ep->max_streams; 1199} 1200 1201static int raw_ioctl_eps_info(struct raw_dev *dev, unsigned long value) 1202{ 1203 int ret = 0, i; 1204 unsigned long flags; 1205 struct usb_raw_eps_info *info; 1206 struct raw_ep *ep; 1207 1208 info = kzalloc(sizeof(*info), GFP_KERNEL); 1209 if (!info) { 1210 ret = -ENOMEM; 1211 goto out; 1212 } 1213 1214 spin_lock_irqsave(&dev->lock, flags); 1215 if (dev->state != STATE_DEV_RUNNING) { 1216 dev_dbg(dev->dev, "fail, device is not running\n"); 1217 ret = -EINVAL; 1218 spin_unlock_irqrestore(&dev->lock, flags); 1219 goto out_free; 1220 } 1221 if (!dev->gadget) { 1222 dev_dbg(dev->dev, "fail, gadget is not bound\n"); 1223 ret = -EBUSY; 1224 spin_unlock_irqrestore(&dev->lock, flags); 1225 goto out_free; 1226 } 1227 1228 for (i = 0; i < dev->eps_num; i++) { 1229 ep = &dev->eps[i]; 1230 strscpy(&info->eps[i].name[0], ep->ep->name, 1231 USB_RAW_EP_NAME_MAX); 1232 info->eps[i].addr = ep->addr; 1233 fill_ep_caps(&ep->ep->caps, &info->eps[i].caps); 1234 fill_ep_limits(ep->ep, &info->eps[i].limits); 1235 } 1236 ret = dev->eps_num; 1237 spin_unlock_irqrestore(&dev->lock, flags); 1238 1239 if (copy_to_user((void __user *)value, info, sizeof(*info))) 1240 ret = -EFAULT; 1241 1242out_free: 1243 kfree(info); 1244out: 1245 return ret; 1246} 1247 1248static long raw_ioctl(struct file *fd, unsigned int cmd, unsigned long value) 1249{ 1250 struct raw_dev *dev = fd->private_data; 1251 int ret = 0; 1252 1253 if (!dev) 1254 return -EBUSY; 1255 1256 switch (cmd) { 1257 case USB_RAW_IOCTL_INIT: 1258 ret = raw_ioctl_init(dev, value); 1259 break; 1260 case USB_RAW_IOCTL_RUN: 1261 ret = raw_ioctl_run(dev, value); 1262 break; 1263 case USB_RAW_IOCTL_EVENT_FETCH: 1264 ret = raw_ioctl_event_fetch(dev, value); 1265 break; 1266 case USB_RAW_IOCTL_EP0_WRITE: 1267 ret = raw_ioctl_ep0_write(dev, value); 1268 break; 1269 case USB_RAW_IOCTL_EP0_READ: 1270 ret = raw_ioctl_ep0_read(dev, value); 1271 break; 1272 case USB_RAW_IOCTL_EP_ENABLE: 1273 ret = raw_ioctl_ep_enable(dev, value); 1274 break; 1275 case USB_RAW_IOCTL_EP_DISABLE: 1276 ret = raw_ioctl_ep_disable(dev, value); 1277 break; 1278 case USB_RAW_IOCTL_EP_WRITE: 1279 ret = raw_ioctl_ep_write(dev, value); 1280 break; 1281 case USB_RAW_IOCTL_EP_READ: 1282 ret = raw_ioctl_ep_read(dev, value); 1283 break; 1284 case USB_RAW_IOCTL_CONFIGURE: 1285 ret = raw_ioctl_configure(dev, value); 1286 break; 1287 case USB_RAW_IOCTL_VBUS_DRAW: 1288 ret = raw_ioctl_vbus_draw(dev, value); 1289 break; 1290 case USB_RAW_IOCTL_EPS_INFO: 1291 ret = raw_ioctl_eps_info(dev, value); 1292 break; 1293 case USB_RAW_IOCTL_EP0_STALL: 1294 ret = raw_ioctl_ep0_stall(dev, value); 1295 break; 1296 case USB_RAW_IOCTL_EP_SET_HALT: 1297 ret = raw_ioctl_ep_set_clear_halt_wedge( 1298 dev, value, true, true); 1299 break; 1300 case USB_RAW_IOCTL_EP_CLEAR_HALT: 1301 ret = raw_ioctl_ep_set_clear_halt_wedge( 1302 dev, value, false, true); 1303 break; 1304 case USB_RAW_IOCTL_EP_SET_WEDGE: 1305 ret = raw_ioctl_ep_set_clear_halt_wedge( 1306 dev, value, true, false); 1307 break; 1308 default: 1309 ret = -EINVAL; 1310 } 1311 1312 return ret; 1313} 1314 1315/*----------------------------------------------------------------------*/ 1316 1317static const struct file_operations raw_fops = { 1318 .open = raw_open, 1319 .unlocked_ioctl = raw_ioctl, 1320 .compat_ioctl = raw_ioctl, 1321 .release = raw_release, 1322 .llseek = no_llseek, 1323}; 1324 1325static struct miscdevice raw_misc_device = { 1326 .minor = MISC_DYNAMIC_MINOR, 1327 .name = DRIVER_NAME, 1328 .fops = &raw_fops, 1329}; 1330 1331module_misc_device(raw_misc_device); 1332