drivers/usb/gadget/legacy/raw_gadget.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * USB Raw Gadget driver.
   4  * See Documentation/usb/raw-gadget.rst for more details.
   5  *
   6  * Copyright (c) 2020 Google, Inc.
   7  * Author: Andrey Konovalov <andreyknvl@gmail.com>
   8  */
   9
  10 #include <linux/compiler.h>
  11 #include <linux/ctype.h>
  12 #include <linux/debugfs.h>
  13 #include <linux/delay.h>
  14 #include <linux/kref.h>
  15 #include <linux/miscdevice.h>
  16 #include <linux/module.h>
  17 #include <linux/semaphore.h>
  18 #include <linux/sched.h>
  19 #include <linux/slab.h>
  20 #include <linux/uaccess.h>
  21 #include <linux/wait.h>
  22
  23 #include <linux/usb.h>
  24 #include <linux/usb/ch9.h>
  25 #include <linux/usb/ch11.h>
  26 #include <linux/usb/gadget.h>
  27
  28 #include <uapi/linux/usb/raw_gadget.h>
  29
  30 #define DRIVER_DESC "USB Raw Gadget"
  31 #define DRIVER_NAME "raw-gadget"
  32
  33 MODULE_DESCRIPTION(DRIVER_DESC);
  34 MODULE_AUTHOR("Andrey Konovalov");
  35 MODULE_LICENSE("GPL");
  36
  37 /*----------------------------------------------------------------------*/
  38
  39 #define RAW_EVENT_QUEUE_SIZE    16
  40
  41 struct raw_event_queue {
  42         /* See the comment in raw_event_queue_fetch() for locking details. */
  43         spinlock_t              lock;
  44         struct semaphore        sema;
  45         struct usb_raw_event    *events[RAW_EVENT_QUEUE_SIZE];
  46         int                     size;
  47 };
  48
  49 static void raw_event_queue_init(struct raw_event_queue *queue)
  50 {
  51         spin_lock_init(&queue->lock);
  52         sema_init(&queue->sema, 0);
  53         queue->size = 0;
  54 }
  55
  56 static int raw_event_queue_add(struct raw_event_queue *queue,
  57         enum usb_raw_event_type type, size_t length, const void *data)
  58 {
  59         unsigned long flags;
  60         struct usb_raw_event *event;
  61
  62         spin_lock_irqsave(&queue->lock, flags);
  63         if (WARN_ON(queue->size >= RAW_EVENT_QUEUE_SIZE)) {
  64                 spin_unlock_irqrestore(&queue->lock, flags);
  65                 return -ENOMEM;
  66         }
  67         event = kmalloc(sizeof(*event) + length, GFP_ATOMIC);
  68         if (!event) {
  69                 spin_unlock_irqrestore(&queue->lock, flags);
  70                 return -ENOMEM;
  71         }
  72         event->type = type;
  73         event->length = length;
  74         if (event->length)
  75                 memcpy(&event->data[0], data, length);
  76         queue->events[queue->size] = event;
  77         queue->size++;
  78         up(&queue->sema);
  79         spin_unlock_irqrestore(&queue->lock, flags);
  80         return 0;
  81 }
  82
  83 static struct usb_raw_event *raw_event_queue_fetch(
  84                                 struct raw_event_queue *queue)
  85 {
  86         int ret;
  87         unsigned long flags;
  88         struct usb_raw_event *event;
  89
  90         /*
  91          * This function can be called concurrently. We first check that
  92          * there's at least one event queued by decrementing the semaphore,
  93          * and then take the lock to protect queue struct fields.
  94          */
  95         ret = down_interruptible(&queue->sema);
  96         if (ret)
  97                 return ERR_PTR(ret);
  98         spin_lock_irqsave(&queue->lock, flags);
  99         /*
 100          * queue->size must have the same value as queue->sema counter (before
 101          * the down_interruptible() call above), so this check is a fail-safe.
 102          */
 103         if (WARN_ON(!queue->size)) {
 104                 spin_unlock_irqrestore(&queue->lock, flags);
 105                 return ERR_PTR(-ENODEV);
 106         }
 107         event = queue->events[0];
 108         queue->size--;
 109         memmove(&queue->events[0], &queue->events[1],
 110                         queue->size * sizeof(queue->events[0]));
 111         spin_unlock_irqrestore(&queue->lock, flags);
 112         return event;
 113 }
 114
 115 static void raw_event_queue_destroy(struct raw_event_queue *queue)
 116 {
 117         int i;
 118
 119         for (i = 0; i < queue->size; i++)
 120                 kfree(queue->events[i]);
 121         queue->size = 0;
 122 }
 123
 124 /*----------------------------------------------------------------------*/
 125
 126 struct raw_dev;
 127
 128 enum ep_state {
 129         STATE_EP_DISABLED,
 130         STATE_EP_ENABLED,
 131 };
 132
 133 struct raw_ep {
 134         struct raw_dev          *dev;
 135         enum ep_state           state;
 136         struct usb_ep           *ep;
 137         u8                      addr;
 138         struct usb_request      *req;
 139         bool                    urb_queued;
 140         bool                    disabling;
 141         ssize_t                 status;
 142 };
 143
 144 enum dev_state {
 145         STATE_DEV_INVALID = 0,
 146         STATE_DEV_OPENED,
 147         STATE_DEV_INITIALIZED,
 148         STATE_DEV_RUNNING,
 149         STATE_DEV_CLOSED,
 150         STATE_DEV_FAILED
 151 };
 152
 153 struct raw_dev {
 154         struct kref                     count;
 155         spinlock_t                      lock;
 156
 157         const char                      *udc_name;
 158         struct usb_gadget_driver        driver;
 159
 160         /* Reference to misc device: */
 161         struct device                   *dev;
 162
 163         /* Protected by lock: */
 164         enum dev_state                  state;
 165         bool                            gadget_registered;
 166         struct usb_gadget               *gadget;
 167         struct usb_request              *req;
 168         bool                            ep0_in_pending;
 169         bool                            ep0_out_pending;
 170         bool                            ep0_urb_queued;
 171         ssize_t                         ep0_status;
 172         struct raw_ep                   eps[USB_RAW_EPS_NUM_MAX];
 173         int                             eps_num;
 174
 175         struct completion               ep0_done;
 176         struct raw_event_queue          queue;
 177 };
 178
 179 static struct raw_dev *dev_new(void)
 180 {
 181         struct raw_dev *dev;
 182
 183         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
 184         if (!dev)
 185                 return NULL;
 186         /* Matches kref_put() in raw_release(). */
 187         kref_init(&dev->count);
 188         spin_lock_init(&dev->lock);
 189         init_completion(&dev->ep0_done);
 190         raw_event_queue_init(&dev->queue);
 191         return dev;
 192 }
 193
 194 static void dev_free(struct kref *kref)
 195 {
 196         struct raw_dev *dev = container_of(kref, struct raw_dev, count);
 197         int i;
 198
 199         kfree(dev->udc_name);
 200         kfree(dev->driver.udc_name);
 201         if (dev->req) {
 202                 if (dev->ep0_urb_queued)
 203                         usb_ep_dequeue(dev->gadget->ep0, dev->req);
 204                 usb_ep_free_request(dev->gadget->ep0, dev->req);
 205         }
 206         raw_event_queue_destroy(&dev->queue);
 207         for (i = 0; i < dev->eps_num; i++) {
 208                 if (dev->eps[i].state == STATE_EP_DISABLED)
 209                         continue;
 210                 usb_ep_disable(dev->eps[i].ep);
 211                 usb_ep_free_request(dev->eps[i].ep, dev->eps[i].req);
 212                 kfree(dev->eps[i].ep->desc);
 213                 dev->eps[i].state = STATE_EP_DISABLED;
 214         }
 215         kfree(dev);
 216 }
 217
 218 /*----------------------------------------------------------------------*/
 219
 220 static int raw_queue_event(struct raw_dev *dev,
 221         enum usb_raw_event_type type, size_t length, const void *data)
 222 {
 223         int ret = 0;
 224         unsigned long flags;
 225
 226         ret = raw_event_queue_add(&dev->queue, type, length, data);
 227         if (ret < 0) {
 228                 spin_lock_irqsave(&dev->lock, flags);
 229                 dev->state = STATE_DEV_FAILED;
 230                 spin_unlock_irqrestore(&dev->lock, flags);
 231         }
 232         return ret;
 233 }
 234
 235 static void gadget_ep0_complete(struct usb_ep *ep, struct usb_request *req)
 236 {
 237         struct raw_dev *dev = req->context;
 238         unsigned long flags;
 239
 240         spin_lock_irqsave(&dev->lock, flags);
 241         if (req->status)
 242                 dev->ep0_status = req->status;
 243         else
 244                 dev->ep0_status = req->actual;
 245         if (dev->ep0_in_pending)
 246                 dev->ep0_in_pending = false;
 247         else
 248                 dev->ep0_out_pending = false;
 249         spin_unlock_irqrestore(&dev->lock, flags);
 250
 251         complete(&dev->ep0_done);
 252 }
 253
 254 static u8 get_ep_addr(const char *name)
 255 {
 256         /* If the endpoint has fixed function (named as e.g. "ep12out-bulk"),
 257          * parse the endpoint address from its name. We deliberately use
 258          * deprecated simple_strtoul() function here, as the number isn't
 259          * followed by '\0' nor '\n'.
 260          */
 261         if (isdigit(name[2]))
 262                 return simple_strtoul(&name[2], NULL, 10);
 263         /* Otherwise the endpoint is configurable (named as e.g. "ep-a"). */
 264         return USB_RAW_EP_ADDR_ANY;
 265 }
 266
 267 static int gadget_bind(struct usb_gadget *gadget,
 268                         struct usb_gadget_driver *driver)
 269 {
 270         int ret = 0, i = 0;
 271         struct raw_dev *dev = container_of(driver, struct raw_dev, driver);
 272         struct usb_request *req;
 273         struct usb_ep *ep;
 274         unsigned long flags;
 275
 276         if (strcmp(gadget->name, dev->udc_name) != 0)
 277                 return -ENODEV;
 278
 279         set_gadget_data(gadget, dev);
 280         req = usb_ep_alloc_request(gadget->ep0, GFP_KERNEL);
 281         if (!req) {
 282                 dev_err(&gadget->dev, "usb_ep_alloc_request failed\n");
 283                 set_gadget_data(gadget, NULL);
 284                 return -ENOMEM;
 285         }
 286
 287         spin_lock_irqsave(&dev->lock, flags);
 288         dev->req = req;
 289         dev->req->context = dev;
 290         dev->req->complete = gadget_ep0_complete;
 291         dev->gadget = gadget;
 292         gadget_for_each_ep(ep, dev->gadget) {
 293                 dev->eps[i].ep = ep;
 294                 dev->eps[i].addr = get_ep_addr(ep->name);
 295                 dev->eps[i].state = STATE_EP_DISABLED;
 296                 i++;
 297         }
 298         dev->eps_num = i;
 299         spin_unlock_irqrestore(&dev->lock, flags);
 300
 301         /* Matches kref_put() in gadget_unbind(). */
 302         kref_get(&dev->count);
 303
 304         ret = raw_queue_event(dev, USB_RAW_EVENT_CONNECT, 0, NULL);
 305         if (ret < 0)
 306                 dev_err(&gadget->dev, "failed to queue event\n");
 307
 308         return ret;
 309 }
 310
 311 static void gadget_unbind(struct usb_gadget *gadget)
 312 {
 313         struct raw_dev *dev = get_gadget_data(gadget);
 314
 315         set_gadget_data(gadget, NULL);
 316         /* Matches kref_get() in gadget_bind(). */
 317         kref_put(&dev->count, dev_free);
 318 }
 319
 320 static int gadget_setup(struct usb_gadget *gadget,
 321                         const struct usb_ctrlrequest *ctrl)
 322 {
 323         int ret = 0;
 324         struct raw_dev *dev = get_gadget_data(gadget);
 325         unsigned long flags;
 326
 327         spin_lock_irqsave(&dev->lock, flags);
 328         if (dev->state != STATE_DEV_RUNNING) {
 329                 dev_err(&gadget->dev, "ignoring, device is not running\n");
 330                 ret = -ENODEV;
 331                 goto out_unlock;
 332         }
 333         if (dev->ep0_in_pending || dev->ep0_out_pending) {
 334                 dev_dbg(&gadget->dev, "stalling, request already pending\n");
 335                 ret = -EBUSY;
 336                 goto out_unlock;
 337         }
 338         if ((ctrl->bRequestType & USB_DIR_IN) && ctrl->wLength)
 339                 dev->ep0_in_pending = true;
 340         else
 341                 dev->ep0_out_pending = true;
 342         spin_unlock_irqrestore(&dev->lock, flags);
 343
 344         ret = raw_queue_event(dev, USB_RAW_EVENT_CONTROL, sizeof(*ctrl), ctrl);
 345         if (ret < 0)
 346                 dev_err(&gadget->dev, "failed to queue event\n");
 347         goto out;
 348
 349 out_unlock:
 350         spin_unlock_irqrestore(&dev->lock, flags);
 351 out:
 352         return ret;
 353 }
 354
 355 /* These are currently unused but present in case UDC driver requires them. */
 356 static void gadget_disconnect(struct usb_gadget *gadget) { }
 357 static void gadget_suspend(struct usb_gadget *gadget) { }
 358 static void gadget_resume(struct usb_gadget *gadget) { }
 359 static void gadget_reset(struct usb_gadget *gadget) { }
 360
 361 /*----------------------------------------------------------------------*/
 362
 363 static struct miscdevice raw_misc_device;
 364
 365 static int raw_open(struct inode *inode, struct file *fd)
 366 {
 367         struct raw_dev *dev;
 368
 369         /* Nonblocking I/O is not supported yet. */
 370         if (fd->f_flags & O_NONBLOCK)
 371                 return -EINVAL;
 372
 373         dev = dev_new();
 374         if (!dev)
 375                 return -ENOMEM;
 376         fd->private_data = dev;
 377         dev->state = STATE_DEV_OPENED;
 378         dev->dev = raw_misc_device.this_device;
 379         return 0;
 380 }
 381
 382 static int raw_release(struct inode *inode, struct file *fd)
 383 {
 384         int ret = 0;
 385         struct raw_dev *dev = fd->private_data;
 386         unsigned long flags;
 387         bool unregister = false;
 388
 389         spin_lock_irqsave(&dev->lock, flags);
 390         dev->state = STATE_DEV_CLOSED;
 391         if (!dev->gadget) {
 392                 spin_unlock_irqrestore(&dev->lock, flags);
 393                 goto out_put;
 394         }
 395         if (dev->gadget_registered)
 396                 unregister = true;
 397         dev->gadget_registered = false;
 398         spin_unlock_irqrestore(&dev->lock, flags);
 399
 400         if (unregister) {
 401                 ret = usb_gadget_unregister_driver(&dev->driver);
 402                 if (ret != 0)
 403                         dev_err(dev->dev,
 404                                 "usb_gadget_unregister_driver() failed with %d\n",
 405                                 ret);
 406                 /* Matches kref_get() in raw_ioctl_run(). */
 407                 kref_put(&dev->count, dev_free);
 408         }
 409
 410 out_put:
 411         /* Matches dev_new() in raw_open(). */
 412         kref_put(&dev->count, dev_free);
 413         return ret;
 414 }
 415
 416 /*----------------------------------------------------------------------*/
 417
 418 static int raw_ioctl_init(struct raw_dev *dev, unsigned long value)
 419 {
 420         int ret = 0;
 421         struct usb_raw_init arg;
 422         char *udc_driver_name;
 423         char *udc_device_name;
 424         unsigned long flags;
 425
 426         if (copy_from_user(&arg, (void __user *)value, sizeof(arg)))
 427                 return -EFAULT;
 428
 429         switch (arg.speed) {
 430         case USB_SPEED_UNKNOWN:
 431                 arg.speed = USB_SPEED_HIGH;
 432                 break;
 433         case USB_SPEED_LOW:
 434         case USB_SPEED_FULL:
 435         case USB_SPEED_HIGH:
 436         case USB_SPEED_SUPER:
 437                 break;
 438         default:
 439                 return -EINVAL;
 440         }
 441
 442         udc_driver_name = kmalloc(UDC_NAME_LENGTH_MAX, GFP_KERNEL);
 443         if (!udc_driver_name)
 444                 return -ENOMEM;
 445         ret = strscpy(udc_driver_name, &arg.driver_name[0],
 446                                 UDC_NAME_LENGTH_MAX);
 447         if (ret < 0) {
 448                 kfree(udc_driver_name);
 449                 return ret;
 450         }
 451         ret = 0;
 452
 453         udc_device_name = kmalloc(UDC_NAME_LENGTH_MAX, GFP_KERNEL);
 454         if (!udc_device_name) {
 455                 kfree(udc_driver_name);
 456                 return -ENOMEM;
 457         }
 458         ret = strscpy(udc_device_name, &arg.device_name[0],
 459                                 UDC_NAME_LENGTH_MAX);
 460         if (ret < 0) {
 461                 kfree(udc_driver_name);
 462                 kfree(udc_device_name);
 463                 return ret;
 464         }
 465         ret = 0;
 466
 467         spin_lock_irqsave(&dev->lock, flags);
 468         if (dev->state != STATE_DEV_OPENED) {
 469                 dev_dbg(dev->dev, "fail, device is not opened\n");
 470                 kfree(udc_driver_name);
 471                 kfree(udc_device_name);
 472                 ret = -EINVAL;
 473                 goto out_unlock;
 474         }
 475         dev->udc_name = udc_driver_name;
 476
 477         dev->driver.function = DRIVER_DESC;
 478         dev->driver.max_speed = arg.speed;
 479         dev->driver.setup = gadget_setup;
 480         dev->driver.disconnect = gadget_disconnect;
 481         dev->driver.bind = gadget_bind;
 482         dev->driver.unbind = gadget_unbind;
 483         dev->driver.suspend = gadget_suspend;
 484         dev->driver.resume = gadget_resume;
 485         dev->driver.reset = gadget_reset;
 486         dev->driver.driver.name = DRIVER_NAME;
 487         dev->driver.udc_name = udc_device_name;
 488         dev->driver.match_existing_only = 1;
 489
 490         dev->state = STATE_DEV_INITIALIZED;
 491
 492 out_unlock:
 493         spin_unlock_irqrestore(&dev->lock, flags);
 494         return ret;
 495 }
 496
 497 static int raw_ioctl_run(struct raw_dev *dev, unsigned long value)
 498 {
 499         int ret = 0;
 500         unsigned long flags;
 501
 502         if (value)
 503                 return -EINVAL;
 504
 505         spin_lock_irqsave(&dev->lock, flags);
 506         if (dev->state != STATE_DEV_INITIALIZED) {
 507                 dev_dbg(dev->dev, "fail, device is not initialized\n");
 508                 ret = -EINVAL;
 509                 goto out_unlock;
 510         }
 511         spin_unlock_irqrestore(&dev->lock, flags);
 512
 513         ret = usb_gadget_register_driver(&dev->driver);
 514
 515         spin_lock_irqsave(&dev->lock, flags);
 516         if (ret) {
 517                 dev_err(dev->dev,
 518                         "fail, usb_gadget_register_driver returned %d\n", ret);
 519                 dev->state = STATE_DEV_FAILED;
 520                 goto out_unlock;
 521         }
 522         dev->gadget_registered = true;
 523         dev->state = STATE_DEV_RUNNING;
 524         /* Matches kref_put() in raw_release(). */
 525         kref_get(&dev->count);
 526
 527 out_unlock:
 528         spin_unlock_irqrestore(&dev->lock, flags);
 529         return ret;
 530 }
 531
 532 static int raw_ioctl_event_fetch(struct raw_dev *dev, unsigned long value)
 533 {
 534         struct usb_raw_event arg;
 535         unsigned long flags;
 536         struct usb_raw_event *event;
 537         uint32_t length;
 538
 539         if (copy_from_user(&arg, (void __user *)value, sizeof(arg)))
 540                 return -EFAULT;
 541
 542         spin_lock_irqsave(&dev->lock, flags);
 543         if (dev->state != STATE_DEV_RUNNING) {
 544                 dev_dbg(dev->dev, "fail, device is not running\n");
 545                 spin_unlock_irqrestore(&dev->lock, flags);
 546                 return -EINVAL;
 547         }
 548         if (!dev->gadget) {
 549                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 550                 spin_unlock_irqrestore(&dev->lock, flags);
 551                 return -EBUSY;
 552         }
 553         spin_unlock_irqrestore(&dev->lock, flags);
 554
 555         event = raw_event_queue_fetch(&dev->queue);
 556         if (PTR_ERR(event) == -EINTR) {
 557                 dev_dbg(&dev->gadget->dev, "event fetching interrupted\n");
 558                 return -EINTR;
 559         }
 560         if (IS_ERR(event)) {
 561                 dev_err(&dev->gadget->dev, "failed to fetch event\n");
 562                 spin_lock_irqsave(&dev->lock, flags);
 563                 dev->state = STATE_DEV_FAILED;
 564                 spin_unlock_irqrestore(&dev->lock, flags);
 565                 return -ENODEV;
 566         }
 567         length = min(arg.length, event->length);
 568         if (copy_to_user((void __user *)value, event, sizeof(*event) + length)) {
 569                 kfree(event);
 570                 return -EFAULT;
 571         }
 572
 573         kfree(event);
 574         return 0;
 575 }
 576
 577 static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr,
 578                                 bool get_from_user)
 579 {
 580         void *data;
 581
 582         if (copy_from_user(io, ptr, sizeof(*io)))
 583                 return ERR_PTR(-EFAULT);
 584         if (io->ep >= USB_RAW_EPS_NUM_MAX)
 585                 return ERR_PTR(-EINVAL);
 586         if (!usb_raw_io_flags_valid(io->flags))
 587                 return ERR_PTR(-EINVAL);
 588         if (io->length > PAGE_SIZE)
 589                 return ERR_PTR(-EINVAL);
 590         if (get_from_user)
 591                 data = memdup_user(ptr + sizeof(*io), io->length);
 592         else {
 593                 data = kmalloc(io->length, GFP_KERNEL);
 594                 if (!data)
 595                         data = ERR_PTR(-ENOMEM);
 596         }
 597         return data;
 598 }
 599
 600 static int raw_process_ep0_io(struct raw_dev *dev, struct usb_raw_ep_io *io,
 601                                 void *data, bool in)
 602 {
 603         int ret = 0;
 604         unsigned long flags;
 605
 606         spin_lock_irqsave(&dev->lock, flags);
 607         if (dev->state != STATE_DEV_RUNNING) {
 608                 dev_dbg(dev->dev, "fail, device is not running\n");
 609                 ret = -EINVAL;
 610                 goto out_unlock;
 611         }
 612         if (!dev->gadget) {
 613                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 614                 ret = -EBUSY;
 615                 goto out_unlock;
 616         }
 617         if (dev->ep0_urb_queued) {
 618                 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n");
 619                 ret = -EBUSY;
 620                 goto out_unlock;
 621         }
 622         if ((in && !dev->ep0_in_pending) ||
 623                         (!in && !dev->ep0_out_pending)) {
 624                 dev_dbg(&dev->gadget->dev, "fail, wrong direction\n");
 625                 ret = -EBUSY;
 626                 goto out_unlock;
 627         }
 628         if (WARN_ON(in && dev->ep0_out_pending)) {
 629                 ret = -ENODEV;
 630                 dev->state = STATE_DEV_FAILED;
 631                 goto out_done;
 632         }
 633         if (WARN_ON(!in && dev->ep0_in_pending)) {
 634                 ret = -ENODEV;
 635                 dev->state = STATE_DEV_FAILED;
 636                 goto out_done;
 637         }
 638
 639         dev->req->buf = data;
 640         dev->req->length = io->length;
 641         dev->req->zero = usb_raw_io_flags_zero(io->flags);
 642         dev->ep0_urb_queued = true;
 643         spin_unlock_irqrestore(&dev->lock, flags);
 644
 645         ret = usb_ep_queue(dev->gadget->ep0, dev->req, GFP_KERNEL);
 646         if (ret) {
 647                 dev_err(&dev->gadget->dev,
 648                                 "fail, usb_ep_queue returned %d\n", ret);
 649                 spin_lock_irqsave(&dev->lock, flags);
 650                 dev->state = STATE_DEV_FAILED;
 651                 goto out_done;
 652         }
 653
 654         ret = wait_for_completion_interruptible(&dev->ep0_done);
 655         if (ret) {
 656                 dev_dbg(&dev->gadget->dev, "wait interrupted\n");
 657                 usb_ep_dequeue(dev->gadget->ep0, dev->req);
 658                 wait_for_completion(&dev->ep0_done);
 659                 spin_lock_irqsave(&dev->lock, flags);
 660                 goto out_done;
 661         }
 662
 663         spin_lock_irqsave(&dev->lock, flags);
 664         ret = dev->ep0_status;
 665
 666 out_done:
 667         dev->ep0_urb_queued = false;
 668 out_unlock:
 669         spin_unlock_irqrestore(&dev->lock, flags);
 670         return ret;
 671 }
 672
 673 static int raw_ioctl_ep0_write(struct raw_dev *dev, unsigned long value)
 674 {
 675         int ret = 0;
 676         void *data;
 677         struct usb_raw_ep_io io;
 678
 679         data = raw_alloc_io_data(&io, (void __user *)value, true);
 680         if (IS_ERR(data))
 681                 return PTR_ERR(data);
 682         ret = raw_process_ep0_io(dev, &io, data, true);
 683         kfree(data);
 684         return ret;
 685 }
 686
 687 static int raw_ioctl_ep0_read(struct raw_dev *dev, unsigned long value)
 688 {
 689         int ret = 0;
 690         void *data;
 691         struct usb_raw_ep_io io;
 692         unsigned int length;
 693
 694         data = raw_alloc_io_data(&io, (void __user *)value, false);
 695         if (IS_ERR(data))
 696                 return PTR_ERR(data);
 697         ret = raw_process_ep0_io(dev, &io, data, false);
 698         if (ret < 0)
 699                 goto free;
 700
 701         length = min(io.length, (unsigned int)ret);
 702         if (copy_to_user((void __user *)(value + sizeof(io)), data, length))
 703                 ret = -EFAULT;
 704         else
 705                 ret = length;
 706 free:
 707         kfree(data);
 708         return ret;
 709 }
 710
 711 static int raw_ioctl_ep0_stall(struct raw_dev *dev, unsigned long value)
 712 {
 713         int ret = 0;
 714         unsigned long flags;
 715
 716         if (value)
 717                 return -EINVAL;
 718         spin_lock_irqsave(&dev->lock, flags);
 719         if (dev->state != STATE_DEV_RUNNING) {
 720                 dev_dbg(dev->dev, "fail, device is not running\n");
 721                 ret = -EINVAL;
 722                 goto out_unlock;
 723         }
 724         if (!dev->gadget) {
 725                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 726                 ret = -EBUSY;
 727                 goto out_unlock;
 728         }
 729         if (dev->ep0_urb_queued) {
 730                 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n");
 731                 ret = -EBUSY;
 732                 goto out_unlock;
 733         }
 734         if (!dev->ep0_in_pending && !dev->ep0_out_pending) {
 735                 dev_dbg(&dev->gadget->dev, "fail, no request pending\n");
 736                 ret = -EBUSY;
 737                 goto out_unlock;
 738         }
 739
 740         ret = usb_ep_set_halt(dev->gadget->ep0);
 741         if (ret < 0)
 742                 dev_err(&dev->gadget->dev,
 743                                 "fail, usb_ep_set_halt returned %d\n", ret);
 744
 745         if (dev->ep0_in_pending)
 746                 dev->ep0_in_pending = false;
 747         else
 748                 dev->ep0_out_pending = false;
 749
 750 out_unlock:
 751         spin_unlock_irqrestore(&dev->lock, flags);
 752         return ret;
 753 }
 754
 755 static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
 756 {
 757         int ret = 0, i;
 758         unsigned long flags;
 759         struct usb_endpoint_descriptor *desc;
 760         struct raw_ep *ep;
 761         bool ep_props_matched = false;
 762
 763         desc = memdup_user((void __user *)value, sizeof(*desc));
 764         if (IS_ERR(desc))
 765                 return PTR_ERR(desc);
 766
 767         /*
 768          * Endpoints with a maxpacket length of 0 can cause crashes in UDC
 769          * drivers.
 770          */
 771         if (usb_endpoint_maxp(desc) == 0) {
 772                 dev_dbg(dev->dev, "fail, bad endpoint maxpacket\n");
 773                 kfree(desc);
 774                 return -EINVAL;
 775         }
 776
 777         spin_lock_irqsave(&dev->lock, flags);
 778         if (dev->state != STATE_DEV_RUNNING) {
 779                 dev_dbg(dev->dev, "fail, device is not running\n");
 780                 ret = -EINVAL;
 781                 goto out_free;
 782         }
 783         if (!dev->gadget) {
 784                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 785                 ret = -EBUSY;
 786                 goto out_free;
 787         }
 788
 789         for (i = 0; i < dev->eps_num; i++) {
 790                 ep = &dev->eps[i];
 791                 if (ep->addr != usb_endpoint_num(desc) &&
 792                                 ep->addr != USB_RAW_EP_ADDR_ANY)
 793                         continue;
 794                 if (!usb_gadget_ep_match_desc(dev->gadget, ep->ep, desc, NULL))
 795                         continue;
 796                 ep_props_matched = true;
 797                 if (ep->state != STATE_EP_DISABLED)
 798                         continue;
 799                 ep->ep->desc = desc;
 800                 ret = usb_ep_enable(ep->ep);
 801                 if (ret < 0) {
 802                         dev_err(&dev->gadget->dev,
 803                                 "fail, usb_ep_enable returned %d\n", ret);
 804                         goto out_free;
 805                 }
 806                 ep->req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC);
 807                 if (!ep->req) {
 808                         dev_err(&dev->gadget->dev,
 809                                 "fail, usb_ep_alloc_request failed\n");
 810                         usb_ep_disable(ep->ep);
 811                         ret = -ENOMEM;
 812                         goto out_free;
 813                 }
 814                 ep->state = STATE_EP_ENABLED;
 815                 ep->ep->driver_data = ep;
 816                 ret = i;
 817                 goto out_unlock;
 818         }
 819
 820         if (!ep_props_matched) {
 821                 dev_dbg(&dev->gadget->dev, "fail, bad endpoint descriptor\n");
 822                 ret = -EINVAL;
 823         } else {
 824                 dev_dbg(&dev->gadget->dev, "fail, no endpoints available\n");
 825                 ret = -EBUSY;
 826         }
 827
 828 out_free:
 829         kfree(desc);
 830 out_unlock:
 831         spin_unlock_irqrestore(&dev->lock, flags);
 832         return ret;
 833 }
 834
 835 static int raw_ioctl_ep_disable(struct raw_dev *dev, unsigned long value)
 836 {
 837         int ret = 0, i = value;
 838         unsigned long flags;
 839
 840         spin_lock_irqsave(&dev->lock, flags);
 841         if (dev->state != STATE_DEV_RUNNING) {
 842                 dev_dbg(dev->dev, "fail, device is not running\n");
 843                 ret = -EINVAL;
 844                 goto out_unlock;
 845         }
 846         if (!dev->gadget) {
 847                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 848                 ret = -EBUSY;
 849                 goto out_unlock;
 850         }
 851         if (i < 0 || i >= dev->eps_num) {
 852                 dev_dbg(dev->dev, "fail, invalid endpoint\n");
 853                 ret = -EBUSY;
 854                 goto out_unlock;
 855         }
 856         if (dev->eps[i].state == STATE_EP_DISABLED) {
 857                 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n");
 858                 ret = -EINVAL;
 859                 goto out_unlock;
 860         }
 861         if (dev->eps[i].disabling) {
 862                 dev_dbg(&dev->gadget->dev,
 863                                 "fail, disable already in progress\n");
 864                 ret = -EINVAL;
 865                 goto out_unlock;
 866         }
 867         if (dev->eps[i].urb_queued) {
 868                 dev_dbg(&dev->gadget->dev,
 869                                 "fail, waiting for urb completion\n");
 870                 ret = -EINVAL;
 871                 goto out_unlock;
 872         }
 873         dev->eps[i].disabling = true;
 874         spin_unlock_irqrestore(&dev->lock, flags);
 875
 876         usb_ep_disable(dev->eps[i].ep);
 877
 878         spin_lock_irqsave(&dev->lock, flags);
 879         usb_ep_free_request(dev->eps[i].ep, dev->eps[i].req);
 880         kfree(dev->eps[i].ep->desc);
 881         dev->eps[i].state = STATE_EP_DISABLED;
 882         dev->eps[i].disabling = false;
 883
 884 out_unlock:
 885         spin_unlock_irqrestore(&dev->lock, flags);
 886         return ret;
 887 }
 888
 889 static int raw_ioctl_ep_set_clear_halt_wedge(struct raw_dev *dev,
 890                 unsigned long value, bool set, bool halt)
 891 {
 892         int ret = 0, i = value;
 893         unsigned long flags;
 894
 895         spin_lock_irqsave(&dev->lock, flags);
 896         if (dev->state != STATE_DEV_RUNNING) {
 897                 dev_dbg(dev->dev, "fail, device is not running\n");
 898                 ret = -EINVAL;
 899                 goto out_unlock;
 900         }
 901         if (!dev->gadget) {
 902                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 903                 ret = -EBUSY;
 904                 goto out_unlock;
 905         }
 906         if (i < 0 || i >= dev->eps_num) {
 907                 dev_dbg(dev->dev, "fail, invalid endpoint\n");
 908                 ret = -EBUSY;
 909                 goto out_unlock;
 910         }
 911         if (dev->eps[i].state == STATE_EP_DISABLED) {
 912                 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n");
 913                 ret = -EINVAL;
 914                 goto out_unlock;
 915         }
 916         if (dev->eps[i].disabling) {
 917                 dev_dbg(&dev->gadget->dev,
 918                                 "fail, disable is in progress\n");
 919                 ret = -EINVAL;
 920                 goto out_unlock;
 921         }
 922         if (dev->eps[i].urb_queued) {
 923                 dev_dbg(&dev->gadget->dev,
 924                                 "fail, waiting for urb completion\n");
 925                 ret = -EINVAL;
 926                 goto out_unlock;
 927         }
 928         if (usb_endpoint_xfer_isoc(dev->eps[i].ep->desc)) {
 929                 dev_dbg(&dev->gadget->dev,
 930                                 "fail, can't halt/wedge ISO endpoint\n");
 931                 ret = -EINVAL;
 932                 goto out_unlock;
 933         }
 934
 935         if (set && halt) {
 936                 ret = usb_ep_set_halt(dev->eps[i].ep);
 937                 if (ret < 0)
 938                         dev_err(&dev->gadget->dev,
 939                                 "fail, usb_ep_set_halt returned %d\n", ret);
 940         } else if (!set && halt) {
 941                 ret = usb_ep_clear_halt(dev->eps[i].ep);
 942                 if (ret < 0)
 943                         dev_err(&dev->gadget->dev,
 944                                 "fail, usb_ep_clear_halt returned %d\n", ret);
 945         } else if (set && !halt) {
 946                 ret = usb_ep_set_wedge(dev->eps[i].ep);
 947                 if (ret < 0)
 948                         dev_err(&dev->gadget->dev,
 949                                 "fail, usb_ep_set_wedge returned %d\n", ret);
 950         }
 951
 952 out_unlock:
 953         spin_unlock_irqrestore(&dev->lock, flags);
 954         return ret;
 955 }
 956
 957 static void gadget_ep_complete(struct usb_ep *ep, struct usb_request *req)
 958 {
 959         struct raw_ep *r_ep = (struct raw_ep *)ep->driver_data;
 960         struct raw_dev *dev = r_ep->dev;
 961         unsigned long flags;
 962
 963         spin_lock_irqsave(&dev->lock, flags);
 964         if (req->status)
 965                 r_ep->status = req->status;
 966         else
 967                 r_ep->status = req->actual;
 968         spin_unlock_irqrestore(&dev->lock, flags);
 969
 970         complete((struct completion *)req->context);
 971 }
 972
 973 static int raw_process_ep_io(struct raw_dev *dev, struct usb_raw_ep_io *io,
 974                                 void *data, bool in)
 975 {
 976         int ret = 0;
 977         unsigned long flags;
 978         struct raw_ep *ep;
 979         DECLARE_COMPLETION_ONSTACK(done);
 980
 981         spin_lock_irqsave(&dev->lock, flags);
 982         if (dev->state != STATE_DEV_RUNNING) {
 983                 dev_dbg(dev->dev, "fail, device is not running\n");
 984                 ret = -EINVAL;
 985                 goto out_unlock;
 986         }
 987         if (!dev->gadget) {
 988                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 989                 ret = -EBUSY;
 990                 goto out_unlock;
 991         }
 992         if (io->ep >= dev->eps_num) {
 993                 dev_dbg(&dev->gadget->dev, "fail, invalid endpoint\n");
 994                 ret = -EINVAL;
 995                 goto out_unlock;
 996         }
 997         ep = &dev->eps[io->ep];
 998         if (ep->state != STATE_EP_ENABLED) {
 999                 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n");
1000                 ret = -EBUSY;
1001                 goto out_unlock;
1002         }
1003         if (ep->disabling) {
1004                 dev_dbg(&dev->gadget->dev,
1005                                 "fail, endpoint is already being disabled\n");
1006                 ret = -EBUSY;
1007                 goto out_unlock;
1008         }
1009         if (ep->urb_queued) {
1010                 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n");
1011                 ret = -EBUSY;
1012                 goto out_unlock;
1013         }
1014         if (in != usb_endpoint_dir_in(ep->ep->desc)) {
1015                 dev_dbg(&dev->gadget->dev, "fail, wrong direction\n");
1016                 ret = -EINVAL;
1017                 goto out_unlock;
1018         }
1019
1020         ep->dev = dev;
1021         ep->req->context = &done;
1022         ep->req->complete = gadget_ep_complete;
1023         ep->req->buf = data;
1024         ep->req->length = io->length;
1025         ep->req->zero = usb_raw_io_flags_zero(io->flags);
1026         ep->urb_queued = true;
1027         spin_unlock_irqrestore(&dev->lock, flags);
1028
1029         ret = usb_ep_queue(ep->ep, ep->req, GFP_KERNEL);
1030         if (ret) {
1031                 dev_err(&dev->gadget->dev,
1032                                 "fail, usb_ep_queue returned %d\n", ret);
1033                 spin_lock_irqsave(&dev->lock, flags);
1034                 dev->state = STATE_DEV_FAILED;
1035                 goto out_done;
1036         }
1037
1038         ret = wait_for_completion_interruptible(&done);
1039         if (ret) {
1040                 dev_dbg(&dev->gadget->dev, "wait interrupted\n");
1041                 usb_ep_dequeue(ep->ep, ep->req);
1042                 wait_for_completion(&done);
1043                 spin_lock_irqsave(&dev->lock, flags);
1044                 goto out_done;
1045         }
1046
1047         spin_lock_irqsave(&dev->lock, flags);
1048         ret = ep->status;
1049
1050 out_done:
1051         ep->urb_queued = false;
1052 out_unlock:
1053         spin_unlock_irqrestore(&dev->lock, flags);
1054         return ret;
1055 }
1056
1057 static int raw_ioctl_ep_write(struct raw_dev *dev, unsigned long value)
1058 {
1059         int ret = 0;
1060         char *data;
1061         struct usb_raw_ep_io io;
1062
1063         data = raw_alloc_io_data(&io, (void __user *)value, true);
1064         if (IS_ERR(data))
1065                 return PTR_ERR(data);
1066         ret = raw_process_ep_io(dev, &io, data, true);
1067         kfree(data);
1068         return ret;
1069 }
1070
1071 static int raw_ioctl_ep_read(struct raw_dev *dev, unsigned long value)
1072 {
1073         int ret = 0;
1074         char *data;
1075         struct usb_raw_ep_io io;
1076         unsigned int length;
1077
1078         data = raw_alloc_io_data(&io, (void __user *)value, false);
1079         if (IS_ERR(data))
1080                 return PTR_ERR(data);
1081         ret = raw_process_ep_io(dev, &io, data, false);
1082         if (ret < 0)
1083                 goto free;
1084
1085         length = min(io.length, (unsigned int)ret);
1086         if (copy_to_user((void __user *)(value + sizeof(io)), data, length))
1087                 ret = -EFAULT;
1088         else
1089                 ret = length;
1090 free:
1091         kfree(data);
1092         return ret;
1093 }
1094
1095 static int raw_ioctl_configure(struct raw_dev *dev, unsigned long value)
1096 {
1097         int ret = 0;
1098         unsigned long flags;
1099
1100         if (value)
1101                 return -EINVAL;
1102         spin_lock_irqsave(&dev->lock, flags);
1103         if (dev->state != STATE_DEV_RUNNING) {
1104                 dev_dbg(dev->dev, "fail, device is not running\n");
1105                 ret = -EINVAL;
1106                 goto out_unlock;
1107         }
1108         if (!dev->gadget) {
1109                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1110                 ret = -EBUSY;
1111                 goto out_unlock;
1112         }
1113         usb_gadget_set_state(dev->gadget, USB_STATE_CONFIGURED);
1114
1115 out_unlock:
1116         spin_unlock_irqrestore(&dev->lock, flags);
1117         return ret;
1118 }
1119
1120 static int raw_ioctl_vbus_draw(struct raw_dev *dev, unsigned long value)
1121 {
1122         int ret = 0;
1123         unsigned long flags;
1124
1125         spin_lock_irqsave(&dev->lock, flags);
1126         if (dev->state != STATE_DEV_RUNNING) {
1127                 dev_dbg(dev->dev, "fail, device is not running\n");
1128                 ret = -EINVAL;
1129                 goto out_unlock;
1130         }
1131         if (!dev->gadget) {
1132                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1133                 ret = -EBUSY;
1134                 goto out_unlock;
1135         }
1136         usb_gadget_vbus_draw(dev->gadget, 2 * value);
1137
1138 out_unlock:
1139         spin_unlock_irqrestore(&dev->lock, flags);
1140         return ret;
1141 }
1142
1143 static void fill_ep_caps(struct usb_ep_caps *caps,
1144                                 struct usb_raw_ep_caps *raw_caps)
1145 {
1146         raw_caps->type_control = caps->type_control;
1147         raw_caps->type_iso = caps->type_iso;
1148         raw_caps->type_bulk = caps->type_bulk;
1149         raw_caps->type_int = caps->type_int;
1150         raw_caps->dir_in = caps->dir_in;
1151         raw_caps->dir_out = caps->dir_out;
1152 }
1153
1154 static void fill_ep_limits(struct usb_ep *ep, struct usb_raw_ep_limits *limits)
1155 {
1156         limits->maxpacket_limit = ep->maxpacket_limit;
1157         limits->max_streams = ep->max_streams;
1158 }
1159
1160 static int raw_ioctl_eps_info(struct raw_dev *dev, unsigned long value)
1161 {
1162         int ret = 0, i;
1163         unsigned long flags;
1164         struct usb_raw_eps_info *info;
1165         struct raw_ep *ep;
1166
1167         info = kzalloc(sizeof(*info), GFP_KERNEL);
1168         if (!info) {
1169                 ret = -ENOMEM;
1170                 goto out;
1171         }
1172
1173         spin_lock_irqsave(&dev->lock, flags);
1174         if (dev->state != STATE_DEV_RUNNING) {
1175                 dev_dbg(dev->dev, "fail, device is not running\n");
1176                 ret = -EINVAL;
1177                 spin_unlock_irqrestore(&dev->lock, flags);
1178                 goto out_free;
1179         }
1180         if (!dev->gadget) {
1181                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1182                 ret = -EBUSY;
1183                 spin_unlock_irqrestore(&dev->lock, flags);
1184                 goto out_free;
1185         }
1186
1187         for (i = 0; i < dev->eps_num; i++) {
1188                 ep = &dev->eps[i];
1189                 strscpy(&info->eps[i].name[0], ep->ep->name,
1190                                 USB_RAW_EP_NAME_MAX);
1191                 info->eps[i].addr = ep->addr;
1192                 fill_ep_caps(&ep->ep->caps, &info->eps[i].caps);
1193                 fill_ep_limits(ep->ep, &info->eps[i].limits);
1194         }
1195         ret = dev->eps_num;
1196         spin_unlock_irqrestore(&dev->lock, flags);
1197
1198         if (copy_to_user((void __user *)value, info, sizeof(*info)))
1199                 ret = -EFAULT;
1200
1201 out_free:
1202         kfree(info);
1203 out:
1204         return ret;
1205 }
1206
1207 static long raw_ioctl(struct file *fd, unsigned int cmd, unsigned long value)
1208 {
1209         struct raw_dev *dev = fd->private_data;
1210         int ret = 0;
1211
1212         if (!dev)
1213                 return -EBUSY;
1214
1215         switch (cmd) {
1216         case USB_RAW_IOCTL_INIT:
1217                 ret = raw_ioctl_init(dev, value);
1218                 break;
1219         case USB_RAW_IOCTL_RUN:
1220                 ret = raw_ioctl_run(dev, value);
1221                 break;
1222         case USB_RAW_IOCTL_EVENT_FETCH:
1223                 ret = raw_ioctl_event_fetch(dev, value);
1224                 break;
1225         case USB_RAW_IOCTL_EP0_WRITE:
1226                 ret = raw_ioctl_ep0_write(dev, value);
1227                 break;
1228         case USB_RAW_IOCTL_EP0_READ:
1229                 ret = raw_ioctl_ep0_read(dev, value);
1230                 break;
1231         case USB_RAW_IOCTL_EP_ENABLE:
1232                 ret = raw_ioctl_ep_enable(dev, value);
1233                 break;
1234         case USB_RAW_IOCTL_EP_DISABLE:
1235                 ret = raw_ioctl_ep_disable(dev, value);
1236                 break;
1237         case USB_RAW_IOCTL_EP_WRITE:
1238                 ret = raw_ioctl_ep_write(dev, value);
1239                 break;
1240         case USB_RAW_IOCTL_EP_READ:
1241                 ret = raw_ioctl_ep_read(dev, value);
1242                 break;
1243         case USB_RAW_IOCTL_CONFIGURE:
1244                 ret = raw_ioctl_configure(dev, value);
1245                 break;
1246         case USB_RAW_IOCTL_VBUS_DRAW:
1247                 ret = raw_ioctl_vbus_draw(dev, value);
1248                 break;
1249         case USB_RAW_IOCTL_EPS_INFO:
1250                 ret = raw_ioctl_eps_info(dev, value);
1251                 break;
1252         case USB_RAW_IOCTL_EP0_STALL:
1253                 ret = raw_ioctl_ep0_stall(dev, value);
1254                 break;
1255         case USB_RAW_IOCTL_EP_SET_HALT:
1256                 ret = raw_ioctl_ep_set_clear_halt_wedge(
1257                                         dev, value, true, true);
1258                 break;
1259         case USB_RAW_IOCTL_EP_CLEAR_HALT:
1260                 ret = raw_ioctl_ep_set_clear_halt_wedge(
1261                                         dev, value, false, true);
1262                 break;
1263         case USB_RAW_IOCTL_EP_SET_WEDGE:
1264                 ret = raw_ioctl_ep_set_clear_halt_wedge(
1265                                         dev, value, true, false);
1266                 break;
1267         default:
1268                 ret = -EINVAL;
1269         }
1270
1271         return ret;
1272 }
1273
1274 /*----------------------------------------------------------------------*/
1275
1276 static const struct file_operations raw_fops = {
1277         .open =                 raw_open,
1278         .unlocked_ioctl =       raw_ioctl,
1279         .compat_ioctl =         raw_ioctl,
1280         .release =              raw_release,
1281         .llseek =               no_llseek,
1282 };
1283
1284 static struct miscdevice raw_misc_device = {
1285         .minor = MISC_DYNAMIC_MINOR,
1286         .name = DRIVER_NAME,
1287         .fops = &raw_fops,
1288 };
1289
1290 module_misc_device(raw_misc_device);