1/*
   2 * cdc-wdm.c
   3 *
   4 * This driver supports USB CDC WCM Device Management.
   5 *
   6 * Copyright (c) 2007-2009 Oliver Neukum
   7 *
   8 * Some code taken from cdc-acm.c
   9 *
  10 * Released under the GPLv2.
  11 *
  12 * Many thanks to Carl Nordbeck
  13 */
  14#include <linux/kernel.h>
  15#include <linux/errno.h>
  16#include <linux/ioctl.h>
  17#include <linux/slab.h>
  18#include <linux/module.h>
  19#include <linux/mutex.h>
  20#include <linux/uaccess.h>
  21#include <linux/bitops.h>
  22#include <linux/poll.h>
  23#include <linux/usb.h>
  24#include <linux/usb/cdc.h>
  25#include <asm/byteorder.h>
  26#include <asm/unaligned.h>
  27#include <linux/usb/cdc-wdm.h>
  28
  29/*
  30 * Version Information
  31 */
  32#define DRIVER_VERSION "v0.03"
  33#define DRIVER_AUTHOR "Oliver Neukum"
  34#define DRIVER_DESC "USB Abstract Control Model driver for USB WCM Device Management"
  35
  36static const struct usb_device_id wdm_ids[] = {
  37	{
  38		.match_flags = USB_DEVICE_ID_MATCH_INT_CLASS |
  39				 USB_DEVICE_ID_MATCH_INT_SUBCLASS,
  40		.bInterfaceClass = USB_CLASS_COMM,
  41		.bInterfaceSubClass = USB_CDC_SUBCLASS_DMM
  42	},
  43	{ }
  44};
  45
  46MODULE_DEVICE_TABLE (usb, wdm_ids);
  47
  48#define WDM_MINOR_BASE	176
  49
  50
  51#define WDM_IN_USE		1
  52#define WDM_DISCONNECTING	2
  53#define WDM_RESULT		3
  54#define WDM_READ		4
  55#define WDM_INT_STALL		5
  56#define WDM_POLL_RUNNING	6
  57#define WDM_RESPONDING		7
  58#define WDM_SUSPENDING		8
  59#define WDM_RESETTING		9
  60#define WDM_OVERFLOW		10
  61
  62#define WDM_MAX			16
  63
  64/* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 decimal (0x100)" */
  65#define WDM_DEFAULT_BUFSIZE	256
  66
  67static DEFINE_MUTEX(wdm_mutex);
  68static DEFINE_SPINLOCK(wdm_device_list_lock);
  69static LIST_HEAD(wdm_device_list);
  70
  71/* --- method tables --- */
  72
  73struct wdm_device {
  74	u8			*inbuf; /* buffer for response */
  75	u8			*outbuf; /* buffer for command */
  76	u8			*sbuf; /* buffer for status */
  77	u8			*ubuf; /* buffer for copy to user space */
  78
  79	struct urb		*command;
  80	struct urb		*response;
  81	struct urb		*validity;
  82	struct usb_interface	*intf;
  83	struct usb_ctrlrequest	*orq;
  84	struct usb_ctrlrequest	*irq;
  85	spinlock_t		iuspin;
  86
  87	unsigned long		flags;
  88	u16			bufsize;
  89	u16			wMaxCommand;
  90	u16			wMaxPacketSize;
  91	__le16			inum;
  92	int			reslength;
  93	int			length;
  94	int			read;
  95	int			count;
  96	dma_addr_t		shandle;
  97	dma_addr_t		ihandle;
  98	struct mutex		wlock;
  99	struct mutex		rlock;
 100	wait_queue_head_t	wait;
 101	struct work_struct	rxwork;
 102	int			werr;
 103	int			rerr;
 104	int                     resp_count;
 105
 106	struct list_head	device_list;
 107	int			(*manage_power)(struct usb_interface *, int);
 108};
 109
 110static struct usb_driver wdm_driver;
 111
 112/* return intfdata if we own the interface, else look up intf in the list */
 113static struct wdm_device *wdm_find_device(struct usb_interface *intf)
 114{
 115	struct wdm_device *desc;
 116
 117	spin_lock(&wdm_device_list_lock);
 118	list_for_each_entry(desc, &wdm_device_list, device_list)
 119		if (desc->intf == intf)
 120			goto found;
 121	desc = NULL;
 122found:
 123	spin_unlock(&wdm_device_list_lock);
 124
 125	return desc;
 126}
 127
 128static struct wdm_device *wdm_find_device_by_minor(int minor)
 129{
 130	struct wdm_device *desc;
 131
 132	spin_lock(&wdm_device_list_lock);
 133	list_for_each_entry(desc, &wdm_device_list, device_list)
 134		if (desc->intf->minor == minor)
 135			goto found;
 136	desc = NULL;
 137found:
 138	spin_unlock(&wdm_device_list_lock);
 139
 140	return desc;
 141}
 142
 143/* --- callbacks --- */
 144static void wdm_out_callback(struct urb *urb)
 145{
 146	struct wdm_device *desc;
 147	desc = urb->context;
 148	spin_lock(&desc->iuspin);
 149	desc->werr = urb->status;
 150	spin_unlock(&desc->iuspin);
 151	kfree(desc->outbuf);
 152	desc->outbuf = NULL;
 153	clear_bit(WDM_IN_USE, &desc->flags);
 154	wake_up(&desc->wait);
 155}
 156
 157static void wdm_in_callback(struct urb *urb)
 158{
 159	struct wdm_device *desc = urb->context;
 160	int status = urb->status;
 161	int length = urb->actual_length;
 162
 163	spin_lock(&desc->iuspin);
 164	clear_bit(WDM_RESPONDING, &desc->flags);
 165
 166	if (status) {
 167		switch (status) {
 168		case -ENOENT:
 169			dev_dbg(&desc->intf->dev,
 170				"nonzero urb status received: -ENOENT");
 171			goto skip_error;
 172		case -ECONNRESET:
 173			dev_dbg(&desc->intf->dev,
 174				"nonzero urb status received: -ECONNRESET");
 175			goto skip_error;
 176		case -ESHUTDOWN:
 177			dev_dbg(&desc->intf->dev,
 178				"nonzero urb status received: -ESHUTDOWN");
 179			goto skip_error;
 180		case -EPIPE:
 181			dev_err(&desc->intf->dev,
 182				"nonzero urb status received: -EPIPE\n");
 183			break;
 184		default:
 185			dev_err(&desc->intf->dev,
 186				"Unexpected error %d\n", status);
 187			break;
 188		}
 189	}
 190
 191	desc->rerr = status;
 192	if (length + desc->length > desc->wMaxCommand) {
 193		/* The buffer would overflow */
 194		set_bit(WDM_OVERFLOW, &desc->flags);
 195	} else {
 196		/* we may already be in overflow */
 197		if (!test_bit(WDM_OVERFLOW, &desc->flags)) {
 198			memmove(desc->ubuf + desc->length, desc->inbuf, length);
 199			desc->length += length;
 200			desc->reslength = length;
 201		}
 202	}
 203skip_error:
 204	wake_up(&desc->wait);
 205
 206	set_bit(WDM_READ, &desc->flags);
 207	spin_unlock(&desc->iuspin);
 208}
 209
 210static void wdm_int_callback(struct urb *urb)
 211{
 212	int rv = 0;
 213	int responding;
 214	int status = urb->status;
 215	struct wdm_device *desc;
 216	struct usb_cdc_notification *dr;
 217
 218	desc = urb->context;
 219	dr = (struct usb_cdc_notification *)desc->sbuf;
 220
 221	if (status) {
 222		switch (status) {
 223		case -ESHUTDOWN:
 224		case -ENOENT:
 225		case -ECONNRESET:
 226			return; /* unplug */
 227		case -EPIPE:
 228			set_bit(WDM_INT_STALL, &desc->flags);
 229			dev_err(&desc->intf->dev, "Stall on int endpoint\n");
 230			goto sw; /* halt is cleared in work */
 231		default:
 232			dev_err(&desc->intf->dev,
 233				"nonzero urb status received: %d\n", status);
 234			break;
 235		}
 236	}
 237
 238	if (urb->actual_length < sizeof(struct usb_cdc_notification)) {
 239		dev_err(&desc->intf->dev, "wdm_int_callback - %d bytes\n",
 240			urb->actual_length);
 241		goto exit;
 242	}
 243
 244	switch (dr->bNotificationType) {
 245	case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
 246		dev_dbg(&desc->intf->dev,
 247			"NOTIFY_RESPONSE_AVAILABLE received: index %d len %d",
 248			le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength));
 249		break;
 250
 251	case USB_CDC_NOTIFY_NETWORK_CONNECTION:
 252
 253		dev_dbg(&desc->intf->dev,
 254			"NOTIFY_NETWORK_CONNECTION %s network",
 255			dr->wValue ? "connected to" : "disconnected from");
 256		goto exit;
 257	case USB_CDC_NOTIFY_SPEED_CHANGE:
 258		dev_dbg(&desc->intf->dev, "SPEED_CHANGE received (len %u)",
 259			urb->actual_length);
 260		goto exit;
 261	default:
 262		clear_bit(WDM_POLL_RUNNING, &desc->flags);
 263		dev_err(&desc->intf->dev,
 264			"unknown notification %d received: index %d len %d\n",
 265			dr->bNotificationType,
 266			le16_to_cpu(dr->wIndex),
 267			le16_to_cpu(dr->wLength));
 268		goto exit;
 269	}
 270
 271	spin_lock(&desc->iuspin);
 272	responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
 273	if (!desc->resp_count++ && !responding
 274		&& !test_bit(WDM_DISCONNECTING, &desc->flags)
 275		&& !test_bit(WDM_SUSPENDING, &desc->flags)) {
 276		rv = usb_submit_urb(desc->response, GFP_ATOMIC);
 277		dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
 278			__func__, rv);
 279	}
 280	spin_unlock(&desc->iuspin);
 281	if (rv < 0) {
 282		clear_bit(WDM_RESPONDING, &desc->flags);
 283		if (rv == -EPERM)
 284			return;
 285		if (rv == -ENOMEM) {
 286sw:
 287			rv = schedule_work(&desc->rxwork);
 288			if (rv)
 289				dev_err(&desc->intf->dev,
 290					"Cannot schedule work\n");
 291		}
 292	}
 293exit:
 294	rv = usb_submit_urb(urb, GFP_ATOMIC);
 295	if (rv)
 296		dev_err(&desc->intf->dev,
 297			"%s - usb_submit_urb failed with result %d\n",
 298			__func__, rv);
 299
 300}
 301
 302static void kill_urbs(struct wdm_device *desc)
 303{
 304	/* the order here is essential */
 305	usb_kill_urb(desc->command);
 306	usb_kill_urb(desc->validity);
 307	usb_kill_urb(desc->response);
 308}
 309
 310static void free_urbs(struct wdm_device *desc)
 311{
 312	usb_free_urb(desc->validity);
 313	usb_free_urb(desc->response);
 314	usb_free_urb(desc->command);
 315}
 316
 317static void cleanup(struct wdm_device *desc)
 318{
 319	kfree(desc->sbuf);
 320	kfree(desc->inbuf);
 321	kfree(desc->orq);
 322	kfree(desc->irq);
 323	kfree(desc->ubuf);
 324	free_urbs(desc);
 325	kfree(desc);
 326}
 327
 328static ssize_t wdm_write
 329(struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
 330{
 331	u8 *buf;
 332	int rv = -EMSGSIZE, r, we;
 333	struct wdm_device *desc = file->private_data;
 334	struct usb_ctrlrequest *req;
 335
 336	if (count > desc->wMaxCommand)
 337		count = desc->wMaxCommand;
 338
 339	spin_lock_irq(&desc->iuspin);
 340	we = desc->werr;
 341	desc->werr = 0;
 342	spin_unlock_irq(&desc->iuspin);
 343	if (we < 0)
 344		return usb_translate_errors(we);
 345
 346	buf = kmalloc(count, GFP_KERNEL);
 347	if (!buf) {
 348		rv = -ENOMEM;
 349		goto outnl;
 350	}
 351
 352	r = copy_from_user(buf, buffer, count);
 353	if (r > 0) {
 354		rv = -EFAULT;
 355		goto out_free_mem;
 356	}
 357
 358	/* concurrent writes and disconnect */
 359	r = mutex_lock_interruptible(&desc->wlock);
 360	rv = -ERESTARTSYS;
 361	if (r)
 362		goto out_free_mem;
 363
 364	if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
 365		rv = -ENODEV;
 366		goto out_free_mem_lock;
 367	}
 368
 369	r = usb_autopm_get_interface(desc->intf);
 370	if (r < 0) {
 371		rv = usb_translate_errors(r);
 372		goto out_free_mem_lock;
 373	}
 374
 375	if (!(file->f_flags & O_NONBLOCK))
 376		r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
 377								&desc->flags));
 378	else
 379		if (test_bit(WDM_IN_USE, &desc->flags))
 380			r = -EAGAIN;
 381
 382	if (test_bit(WDM_RESETTING, &desc->flags))
 383		r = -EIO;
 384
 385	if (r < 0) {
 386		rv = r;
 387		goto out_free_mem_pm;
 388	}
 389
 390	req = desc->orq;
 391	usb_fill_control_urb(
 392		desc->command,
 393		interface_to_usbdev(desc->intf),
 394		/* using common endpoint 0 */
 395		usb_sndctrlpipe(interface_to_usbdev(desc->intf), 0),
 396		(unsigned char *)req,
 397		buf,
 398		count,
 399		wdm_out_callback,
 400		desc
 401	);
 402
 403	req->bRequestType = (USB_DIR_OUT | USB_TYPE_CLASS |
 404			     USB_RECIP_INTERFACE);
 405	req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND;
 406	req->wValue = 0;
 407	req->wIndex = desc->inum; /* already converted */
 408	req->wLength = cpu_to_le16(count);
 409	set_bit(WDM_IN_USE, &desc->flags);
 410	desc->outbuf = buf;
 411
 412	rv = usb_submit_urb(desc->command, GFP_KERNEL);
 413	if (rv < 0) {
 414		desc->outbuf = NULL;
 415		clear_bit(WDM_IN_USE, &desc->flags);
 416		dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
 417		rv = usb_translate_errors(rv);
 418		goto out_free_mem_pm;
 419	} else {
 420		dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d",
 421			le16_to_cpu(req->wIndex));
 422	}
 423
 424	usb_autopm_put_interface(desc->intf);
 425	mutex_unlock(&desc->wlock);
 426outnl:
 427	return rv < 0 ? rv : count;
 428
 429out_free_mem_pm:
 430	usb_autopm_put_interface(desc->intf);
 431out_free_mem_lock:
 432	mutex_unlock(&desc->wlock);
 433out_free_mem:
 434	kfree(buf);
 435	return rv;
 436}
 437
 438/*
 439 * clear WDM_READ flag and possibly submit the read urb if resp_count
 440 * is non-zero.
 441 *
 442 * Called with desc->iuspin locked
 443 */
 444static int clear_wdm_read_flag(struct wdm_device *desc)
 445{
 446	int rv = 0;
 447
 448	clear_bit(WDM_READ, &desc->flags);
 449
 450	/* submit read urb only if the device is waiting for it */
 451	if (!desc->resp_count || !--desc->resp_count)
 452		goto out;
 453
 454	set_bit(WDM_RESPONDING, &desc->flags);
 455	spin_unlock_irq(&desc->iuspin);
 456	rv = usb_submit_urb(desc->response, GFP_KERNEL);
 457	spin_lock_irq(&desc->iuspin);
 458	if (rv) {
 459		dev_err(&desc->intf->dev,
 460			"usb_submit_urb failed with result %d\n", rv);
 461
 462		/* make sure the next notification trigger a submit */
 463		clear_bit(WDM_RESPONDING, &desc->flags);
 464		desc->resp_count = 0;
 465	}
 466out:
 467	return rv;
 468}
 469
 470static ssize_t wdm_read
 471(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 472{
 473	int rv, cntr;
 474	int i = 0;
 475	struct wdm_device *desc = file->private_data;
 476
 477
 478	rv = mutex_lock_interruptible(&desc->rlock); /*concurrent reads */
 479	if (rv < 0)
 480		return -ERESTARTSYS;
 481
 482	cntr = ACCESS_ONCE(desc->length);
 483	if (cntr == 0) {
 484		desc->read = 0;
 485retry:
 486		if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
 487			rv = -ENODEV;
 488			goto err;
 489		}
 490		if (test_bit(WDM_OVERFLOW, &desc->flags)) {
 491			clear_bit(WDM_OVERFLOW, &desc->flags);
 492			rv = -ENOBUFS;
 493			goto err;
 494		}
 495		i++;
 496		if (file->f_flags & O_NONBLOCK) {
 497			if (!test_bit(WDM_READ, &desc->flags)) {
 498				rv = cntr ? cntr : -EAGAIN;
 499				goto err;
 500			}
 501			rv = 0;
 502		} else {
 503			rv = wait_event_interruptible(desc->wait,
 504				test_bit(WDM_READ, &desc->flags));
 505		}
 506
 507		/* may have happened while we slept */
 508		if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
 509			rv = -ENODEV;
 510			goto err;
 511		}
 512		if (test_bit(WDM_RESETTING, &desc->flags)) {
 513			rv = -EIO;
 514			goto err;
 515		}
 516		usb_mark_last_busy(interface_to_usbdev(desc->intf));
 517		if (rv < 0) {
 518			rv = -ERESTARTSYS;
 519			goto err;
 520		}
 521
 522		spin_lock_irq(&desc->iuspin);
 523
 524		if (desc->rerr) { /* read completed, error happened */
 525			rv = usb_translate_errors(desc->rerr);
 526			desc->rerr = 0;
 527			spin_unlock_irq(&desc->iuspin);
 528			goto err;
 529		}
 530		/*
 531		 * recheck whether we've lost the race
 532		 * against the completion handler
 533		 */
 534		if (!test_bit(WDM_READ, &desc->flags)) { /* lost race */
 535			spin_unlock_irq(&desc->iuspin);
 536			goto retry;
 537		}
 538
 539		if (!desc->reslength) { /* zero length read */
 540			dev_dbg(&desc->intf->dev, "%s: zero length - clearing WDM_READ\n", __func__);
 541			rv = clear_wdm_read_flag(desc);
 542			spin_unlock_irq(&desc->iuspin);
 543			if (rv < 0)
 544				goto err;
 545			goto retry;
 546		}
 547		cntr = desc->length;
 548		spin_unlock_irq(&desc->iuspin);
 549	}
 550
 551	if (cntr > count)
 552		cntr = count;
 553	rv = copy_to_user(buffer, desc->ubuf, cntr);
 554	if (rv > 0) {
 555		rv = -EFAULT;
 556		goto err;
 557	}
 558
 559	spin_lock_irq(&desc->iuspin);
 560
 561	for (i = 0; i < desc->length - cntr; i++)
 562		desc->ubuf[i] = desc->ubuf[i + cntr];
 563
 564	desc->length -= cntr;
 565	/* in case we had outstanding data */
 566	if (!desc->length)
 567		clear_wdm_read_flag(desc);
 568	spin_unlock_irq(&desc->iuspin);
 569	rv = cntr;
 570
 571err:
 572	mutex_unlock(&desc->rlock);
 573	return rv;
 574}
 575
 576static int wdm_flush(struct file *file, fl_owner_t id)
 577{
 578	struct wdm_device *desc = file->private_data;
 579
 580	wait_event(desc->wait, !test_bit(WDM_IN_USE, &desc->flags));
 581
 582	/* cannot dereference desc->intf if WDM_DISCONNECTING */
 583	if (desc->werr < 0 && !test_bit(WDM_DISCONNECTING, &desc->flags))
 584		dev_err(&desc->intf->dev, "Error in flush path: %d\n",
 585			desc->werr);
 586
 587	return usb_translate_errors(desc->werr);
 588}
 589
 590static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait)
 591{
 592	struct wdm_device *desc = file->private_data;
 593	unsigned long flags;
 594	unsigned int mask = 0;
 595
 596	spin_lock_irqsave(&desc->iuspin, flags);
 597	if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
 598		mask = POLLHUP | POLLERR;
 599		spin_unlock_irqrestore(&desc->iuspin, flags);
 600		goto desc_out;
 601	}
 602	if (test_bit(WDM_READ, &desc->flags))
 603		mask = POLLIN | POLLRDNORM;
 604	if (desc->rerr || desc->werr)
 605		mask |= POLLERR;
 606	if (!test_bit(WDM_IN_USE, &desc->flags))
 607		mask |= POLLOUT | POLLWRNORM;
 608	spin_unlock_irqrestore(&desc->iuspin, flags);
 609
 610	poll_wait(file, &desc->wait, wait);
 611
 612desc_out:
 613	return mask;
 614}
 615
 616static int wdm_open(struct inode *inode, struct file *file)
 617{
 618	int minor = iminor(inode);
 619	int rv = -ENODEV;
 620	struct usb_interface *intf;
 621	struct wdm_device *desc;
 622
 623	mutex_lock(&wdm_mutex);
 624	desc = wdm_find_device_by_minor(minor);
 625	if (!desc)
 626		goto out;
 627
 628	intf = desc->intf;
 629	if (test_bit(WDM_DISCONNECTING, &desc->flags))
 630		goto out;
 631	file->private_data = desc;
 632
 633	rv = usb_autopm_get_interface(desc->intf);
 634	if (rv < 0) {
 635		dev_err(&desc->intf->dev, "Error autopm - %d\n", rv);
 636		goto out;
 637	}
 638
 639	/* using write lock to protect desc->count */
 640	mutex_lock(&desc->wlock);
 641	if (!desc->count++) {
 642		desc->werr = 0;
 643		desc->rerr = 0;
 644		rv = usb_submit_urb(desc->validity, GFP_KERNEL);
 645		if (rv < 0) {
 646			desc->count--;
 647			dev_err(&desc->intf->dev,
 648				"Error submitting int urb - %d\n", rv);
 649			rv = usb_translate_errors(rv);
 650		}
 651	} else {
 652		rv = 0;
 653	}
 654	mutex_unlock(&desc->wlock);
 655	if (desc->count == 1)
 656		desc->manage_power(intf, 1);
 657	usb_autopm_put_interface(desc->intf);
 658out:
 659	mutex_unlock(&wdm_mutex);
 660	return rv;
 661}
 662
 663static int wdm_release(struct inode *inode, struct file *file)
 664{
 665	struct wdm_device *desc = file->private_data;
 666
 667	mutex_lock(&wdm_mutex);
 668
 669	/* using write lock to protect desc->count */
 670	mutex_lock(&desc->wlock);
 671	desc->count--;
 672	mutex_unlock(&desc->wlock);
 673
 674	if (!desc->count) {
 675		if (!test_bit(WDM_DISCONNECTING, &desc->flags)) {
 676			dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
 677			kill_urbs(desc);
 678			spin_lock_irq(&desc->iuspin);
 679			desc->resp_count = 0;
 680			spin_unlock_irq(&desc->iuspin);
 681			desc->manage_power(desc->intf, 0);
 682		} else {
 683			/* must avoid dev_printk here as desc->intf is invalid */
 684			pr_debug(KBUILD_MODNAME " %s: device gone - cleaning up\n", __func__);
 685			cleanup(desc);
 686		}
 687	}
 688	mutex_unlock(&wdm_mutex);
 689	return 0;
 690}
 691
 692static long wdm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 693{
 694	struct wdm_device *desc = file->private_data;
 695	int rv = 0;
 696
 697	switch (cmd) {
 698	case IOCTL_WDM_MAX_COMMAND:
 699		if (copy_to_user((void __user *)arg, &desc->wMaxCommand, sizeof(desc->wMaxCommand)))
 700			rv = -EFAULT;
 701		break;
 702	default:
 703		rv = -ENOTTY;
 704	}
 705	return rv;
 706}
 707
 708static const struct file_operations wdm_fops = {
 709	.owner =	THIS_MODULE,
 710	.read =		wdm_read,
 711	.write =	wdm_write,
 712	.open =		wdm_open,
 713	.flush =	wdm_flush,
 714	.release =	wdm_release,
 715	.poll =		wdm_poll,
 716	.unlocked_ioctl = wdm_ioctl,
 717	.compat_ioctl = wdm_ioctl,
 718	.llseek =	noop_llseek,
 719};
 720
 721static struct usb_class_driver wdm_class = {
 722	.name =		"cdc-wdm%d",
 723	.fops =		&wdm_fops,
 724	.minor_base =	WDM_MINOR_BASE,
 725};
 726
 727/* --- error handling --- */
 728static void wdm_rxwork(struct work_struct *work)
 729{
 730	struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);
 731	unsigned long flags;
 732	int rv = 0;
 733	int responding;
 734
 735	spin_lock_irqsave(&desc->iuspin, flags);
 736	if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
 737		spin_unlock_irqrestore(&desc->iuspin, flags);
 738	} else {
 739		responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
 740		spin_unlock_irqrestore(&desc->iuspin, flags);
 741		if (!responding)
 742			rv = usb_submit_urb(desc->response, GFP_KERNEL);
 743		if (rv < 0 && rv != -EPERM) {
 744			spin_lock_irqsave(&desc->iuspin, flags);
 745			clear_bit(WDM_RESPONDING, &desc->flags);
 746			if (!test_bit(WDM_DISCONNECTING, &desc->flags))
 747				schedule_work(&desc->rxwork);
 748			spin_unlock_irqrestore(&desc->iuspin, flags);
 749		}
 750	}
 751}
 752
 753/* --- hotplug --- */
 754
 755static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor *ep,
 756		u16 bufsize, int (*manage_power)(struct usb_interface *, int))
 757{
 758	int rv = -ENOMEM;
 759	struct wdm_device *desc;
 760
 761	desc = kzalloc(sizeof(struct wdm_device), GFP_KERNEL);
 762	if (!desc)
 763		goto out;
 764	INIT_LIST_HEAD(&desc->device_list);
 765	mutex_init(&desc->rlock);
 766	mutex_init(&desc->wlock);
 767	spin_lock_init(&desc->iuspin);
 768	init_waitqueue_head(&desc->wait);
 769	desc->wMaxCommand = bufsize;
 770	/* this will be expanded and needed in hardware endianness */
 771	desc->inum = cpu_to_le16((u16)intf->cur_altsetting->desc.bInterfaceNumber);
 772	desc->intf = intf;
 773	INIT_WORK(&desc->rxwork, wdm_rxwork);
 774
 775	rv = -EINVAL;
 776	if (!usb_endpoint_is_int_in(ep))
 777		goto err;
 778
 779	desc->wMaxPacketSize = usb_endpoint_maxp(ep);
 780
 781	desc->orq = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
 782	if (!desc->orq)
 783		goto err;
 784	desc->irq = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
 785	if (!desc->irq)
 786		goto err;
 787
 788	desc->validity = usb_alloc_urb(0, GFP_KERNEL);
 789	if (!desc->validity)
 790		goto err;
 791
 792	desc->response = usb_alloc_urb(0, GFP_KERNEL);
 793	if (!desc->response)
 794		goto err;
 795
 796	desc->command = usb_alloc_urb(0, GFP_KERNEL);
 797	if (!desc->command)
 798		goto err;
 799
 800	desc->ubuf = kmalloc(desc->wMaxCommand, GFP_KERNEL);
 801	if (!desc->ubuf)
 802		goto err;
 803
 804	desc->sbuf = kmalloc(desc->wMaxPacketSize, GFP_KERNEL);
 805	if (!desc->sbuf)
 806		goto err;
 807
 808	desc->inbuf = kmalloc(desc->wMaxCommand, GFP_KERNEL);
 809	if (!desc->inbuf)
 810		goto err;
 811
 812	usb_fill_int_urb(
 813		desc->validity,
 814		interface_to_usbdev(intf),
 815		usb_rcvintpipe(interface_to_usbdev(intf), ep->bEndpointAddress),
 816		desc->sbuf,
 817		desc->wMaxPacketSize,
 818		wdm_int_callback,
 819		desc,
 820		ep->bInterval
 821	);
 822
 823	desc->irq->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE);
 824	desc->irq->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE;
 825	desc->irq->wValue = 0;
 826	desc->irq->wIndex = desc->inum; /* already converted */
 827	desc->irq->wLength = cpu_to_le16(desc->wMaxCommand);
 828
 829	usb_fill_control_urb(
 830		desc->response,
 831		interface_to_usbdev(intf),
 832		/* using common endpoint 0 */
 833		usb_rcvctrlpipe(interface_to_usbdev(desc->intf), 0),
 834		(unsigned char *)desc->irq,
 835		desc->inbuf,
 836		desc->wMaxCommand,
 837		wdm_in_callback,
 838		desc
 839	);
 840
 841	desc->manage_power = manage_power;
 842
 843	spin_lock(&wdm_device_list_lock);
 844	list_add(&desc->device_list, &wdm_device_list);
 845	spin_unlock(&wdm_device_list_lock);
 846
 847	rv = usb_register_dev(intf, &wdm_class);
 848	if (rv < 0)
 849		goto err;
 850	else
 851		dev_info(&intf->dev, "%s: USB WDM device\n", dev_name(intf->usb_dev));
 852out:
 853	return rv;
 854err:
 855	spin_lock(&wdm_device_list_lock);
 856	list_del(&desc->device_list);
 857	spin_unlock(&wdm_device_list_lock);
 858	cleanup(desc);
 859	return rv;
 860}
 861
 862static int wdm_manage_power(struct usb_interface *intf, int on)
 863{
 864	/* need autopm_get/put here to ensure the usbcore sees the new value */
 865	int rv = usb_autopm_get_interface(intf);
 866
 867	intf->needs_remote_wakeup = on;
 868	if (!rv)
 869		usb_autopm_put_interface(intf);
 870	return 0;
 871}
 872
 873static int wdm_probe(struct usb_interface *intf, const struct usb_device_id *id)
 874{
 875	int rv = -EINVAL;
 876	struct usb_host_interface *iface;
 877	struct usb_endpoint_descriptor *ep;
 878	struct usb_cdc_dmm_desc *dmhd;
 879	u8 *buffer = intf->altsetting->extra;
 880	int buflen = intf->altsetting->extralen;
 881	u16 maxcom = WDM_DEFAULT_BUFSIZE;
 882
 883	if (!buffer)
 884		goto err;
 885	while (buflen > 2) {
 886		if (buffer[1] != USB_DT_CS_INTERFACE) {
 887			dev_err(&intf->dev, "skipping garbage\n");
 888			goto next_desc;
 889		}
 890
 891		switch (buffer[2]) {
 892		case USB_CDC_HEADER_TYPE:
 893			break;
 894		case USB_CDC_DMM_TYPE:
 895			dmhd = (struct usb_cdc_dmm_desc *)buffer;
 896			maxcom = le16_to_cpu(dmhd->wMaxCommand);
 897			dev_dbg(&intf->dev,
 898				"Finding maximum buffer length: %d", maxcom);
 899			break;
 900		default:
 901			dev_err(&intf->dev,
 902				"Ignoring extra header, type %d, length %d\n",
 903				buffer[2], buffer[0]);
 904			break;
 905		}
 906next_desc:
 907		buflen -= buffer[0];
 908		buffer += buffer[0];
 909	}
 910
 911	iface = intf->cur_altsetting;
 912	if (iface->desc.bNumEndpoints != 1)
 913		goto err;
 914	ep = &iface->endpoint[0].desc;
 915
 916	rv = wdm_create(intf, ep, maxcom, &wdm_manage_power);
 917
 918err:
 919	return rv;
 920}
 921
 922/**
 923 * usb_cdc_wdm_register - register a WDM subdriver
 924 * @intf: usb interface the subdriver will associate with
 925 * @ep: interrupt endpoint to monitor for notifications
 926 * @bufsize: maximum message size to support for read/write
 927 *
 928 * Create WDM usb class character device and associate it with intf
 929 * without binding, allowing another driver to manage the interface.
 930 *
 931 * The subdriver will manage the given interrupt endpoint exclusively
 932 * and will issue control requests referring to the given intf. It
 933 * will otherwise avoid interferring, and in particular not do
 934 * usb_set_intfdata/usb_get_intfdata on intf.
 935 *
 936 * The return value is a pointer to the subdriver's struct usb_driver.
 937 * The registering driver is responsible for calling this subdriver's
 938 * disconnect, suspend, resume, pre_reset and post_reset methods from
 939 * its own.
 940 */
 941struct usb_driver *usb_cdc_wdm_register(struct usb_interface *intf,
 942					struct usb_endpoint_descriptor *ep,
 943					int bufsize,
 944					int (*manage_power)(struct usb_interface *, int))
 945{
 946	int rv = -EINVAL;
 947
 948	rv = wdm_create(intf, ep, bufsize, manage_power);
 949	if (rv < 0)
 950		goto err;
 951
 952	return &wdm_driver;
 953err:
 954	return ERR_PTR(rv);
 955}
 956EXPORT_SYMBOL(usb_cdc_wdm_register);
 957
 958static void wdm_disconnect(struct usb_interface *intf)
 959{
 960	struct wdm_device *desc;
 961	unsigned long flags;
 962
 963	usb_deregister_dev(intf, &wdm_class);
 964	desc = wdm_find_device(intf);
 965	mutex_lock(&wdm_mutex);
 966
 967	/* the spinlock makes sure no new urbs are generated in the callbacks */
 968	spin_lock_irqsave(&desc->iuspin, flags);
 969	set_bit(WDM_DISCONNECTING, &desc->flags);
 970	set_bit(WDM_READ, &desc->flags);
 971	/* to terminate pending flushes */
 972	clear_bit(WDM_IN_USE, &desc->flags);
 973	spin_unlock_irqrestore(&desc->iuspin, flags);
 974	wake_up_all(&desc->wait);
 975	mutex_lock(&desc->rlock);
 976	mutex_lock(&desc->wlock);
 977	kill_urbs(desc);
 978	cancel_work_sync(&desc->rxwork);
 979	mutex_unlock(&desc->wlock);
 980	mutex_unlock(&desc->rlock);
 981
 982	/* the desc->intf pointer used as list key is now invalid */
 983	spin_lock(&wdm_device_list_lock);
 984	list_del(&desc->device_list);
 985	spin_unlock(&wdm_device_list_lock);
 986
 987	if (!desc->count)
 988		cleanup(desc);
 989	else
 990		dev_dbg(&intf->dev, "%s: %d open files - postponing cleanup\n", __func__, desc->count);
 991	mutex_unlock(&wdm_mutex);
 992}
 993
 994#ifdef CONFIG_PM
 995static int wdm_suspend(struct usb_interface *intf, pm_message_t message)
 996{
 997	struct wdm_device *desc = wdm_find_device(intf);
 998	int rv = 0;
 999
1000	dev_dbg(&desc->intf->dev, "wdm%d_suspend\n", intf->minor);
1001
1002	/* if this is an autosuspend the caller does the locking */
1003	if (!PMSG_IS_AUTO(message)) {
1004		mutex_lock(&desc->rlock);
1005		mutex_lock(&desc->wlock);
1006	}
1007	spin_lock_irq(&desc->iuspin);
1008
1009	if (PMSG_IS_AUTO(message) &&
1010			(test_bit(WDM_IN_USE, &desc->flags)
1011			|| test_bit(WDM_RESPONDING, &desc->flags))) {
1012		spin_unlock_irq(&desc->iuspin);
1013		rv = -EBUSY;
1014	} else {
1015
1016		set_bit(WDM_SUSPENDING, &desc->flags);
1017		spin_unlock_irq(&desc->iuspin);
1018		/* callback submits work - order is essential */
1019		kill_urbs(desc);
1020		cancel_work_sync(&desc->rxwork);
1021	}
1022	if (!PMSG_IS_AUTO(message)) {
1023		mutex_unlock(&desc->wlock);
1024		mutex_unlock(&desc->rlock);
1025	}
1026
1027	return rv;
1028}
1029#endif
1030
1031static int recover_from_urb_loss(struct wdm_device *desc)
1032{
1033	int rv = 0;
1034
1035	if (desc->count) {
1036		rv = usb_submit_urb(desc->validity, GFP_NOIO);
1037		if (rv < 0)
1038			dev_err(&desc->intf->dev,
1039				"Error resume submitting int urb - %d\n", rv);
1040	}
1041	return rv;
1042}
1043
1044#ifdef CONFIG_PM
1045static int wdm_resume(struct usb_interface *intf)
1046{
1047	struct wdm_device *desc = wdm_find_device(intf);
1048	int rv;
1049
1050	dev_dbg(&desc->intf->dev, "wdm%d_resume\n", intf->minor);
1051
1052	clear_bit(WDM_SUSPENDING, &desc->flags);
1053	rv = recover_from_urb_loss(desc);
1054
1055	return rv;
1056}
1057#endif
1058
1059static int wdm_pre_reset(struct usb_interface *intf)
1060{
1061	struct wdm_device *desc = wdm_find_device(intf);
1062
1063	/*
1064	 * we notify everybody using poll of
1065	 * an exceptional situation
1066	 * must be done before recovery lest a spontaneous
1067	 * message from the device is lost
1068	 */
1069	spin_lock_irq(&desc->iuspin);
1070	set_bit(WDM_RESETTING, &desc->flags);	/* inform read/write */
1071	set_bit(WDM_READ, &desc->flags);	/* unblock read */
1072	clear_bit(WDM_IN_USE, &desc->flags);	/* unblock write */
1073	desc->rerr = -EINTR;
1074	spin_unlock_irq(&desc->iuspin);
1075	wake_up_all(&desc->wait);
1076	mutex_lock(&desc->rlock);
1077	mutex_lock(&desc->wlock);
1078	kill_urbs(desc);
1079	cancel_work_sync(&desc->rxwork);
1080	return 0;
1081}
1082
1083static int wdm_post_reset(struct usb_interface *intf)
1084{
1085	struct wdm_device *desc = wdm_find_device(intf);
1086	int rv;
1087
1088	clear_bit(WDM_OVERFLOW, &desc->flags);
1089	clear_bit(WDM_RESETTING, &desc->flags);
1090	rv = recover_from_urb_loss(desc);
1091	mutex_unlock(&desc->wlock);
1092	mutex_unlock(&desc->rlock);
1093	return 0;
1094}
1095
1096static struct usb_driver wdm_driver = {
1097	.name =		"cdc_wdm",
1098	.probe =	wdm_probe,
1099	.disconnect =	wdm_disconnect,
1100#ifdef CONFIG_PM
1101	.suspend =	wdm_suspend,
1102	.resume =	wdm_resume,
1103	.reset_resume =	wdm_resume,
1104#endif
1105	.pre_reset =	wdm_pre_reset,
1106	.post_reset =	wdm_post_reset,
1107	.id_table =	wdm_ids,
1108	.supports_autosuspend = 1,
1109	.disable_hub_initiated_lpm = 1,
1110};
1111
1112module_usb_driver(wdm_driver);
1113
1114MODULE_AUTHOR(DRIVER_AUTHOR);
1115MODULE_DESCRIPTION(DRIVER_DESC);
1116MODULE_LICENSE("GPL");