1	// SPDX-License-Identifier: GPL-2.0+
2	/*
3	* inode.c -- user mode filesystem api for usb gadget controllers
4	*
5	* Copyright (C) 2003-2004 David Brownell
6	* Copyright (C) 2003 Agilent Technologies
7	*/
8
9
10	/* #define VERBOSE_DEBUG */
11
12	#include <linux/init.h>
13	#include <linux/module.h>
14	#include <linux/fs.h>
15	#include <linux/fs_context.h>
16	#include <linux/pagemap.h>
17	#include <linux/uts.h>
18	#include <linux/wait.h>
19	#include <linux/compiler.h>
20	#include <linux/uaccess.h>
21	#include <linux/sched.h>
22	#include <linux/slab.h>
23	#include <linux/poll.h>
24	#include <linux/kthread.h>
25	#include <linux/aio.h>
26	#include <linux/uio.h>
27	#include <linux/refcount.h>
28	#include <linux/delay.h>
29	#include <linux/device.h>
30	#include <linux/moduleparam.h>
31
32	#include <linux/usb/gadgetfs.h>
33	#include <linux/usb/gadget.h>
34	#include <linux/usb/composite.h> /* for USB_GADGET_DELAYED_STATUS */
35
36	/* Undef helpers from linux/usb/composite.h as gadgetfs redefines them */
37	#undef DBG
38	#undef ERROR
39	#undef INFO
40
41
42	/*
43	* The gadgetfs API maps each endpoint to a file descriptor so that you
44	* can use standard synchronous read/write calls for I/O. There's some
45	* O_NONBLOCK and O_ASYNC/FASYNC style i/o support. Example usermode
46	* drivers show how this works in practice. You can also use AIO to
47	* eliminate I/O gaps between requests, to help when streaming data.
48	*
49	* Key parts that must be USB-specific are protocols defining how the
50	* read/write operations relate to the hardware state machines. There
51	* are two types of files. One type is for the device, implementing ep0.
52	* The other type is for each IN or OUT endpoint. In both cases, the
53	* user mode driver must configure the hardware before using it.
54	*
55	* - First, dev_config() is called when /dev/gadget/$CHIP is configured
56	* (by writing configuration and device descriptors). Afterwards it
57	* may serve as a source of device events, used to handle all control
58	* requests other than basic enumeration.
59	*
60	* - Then, after a SET_CONFIGURATION control request, ep_config() is
61	* called when each /dev/gadget/ep* file is configured (by writing
62	* endpoint descriptors). Afterwards these files are used to write()
63	* IN data or to read() OUT data. To halt the endpoint, a "wrong
64	* direction" request is issued (like reading an IN endpoint).
65	*
66	* Unlike "usbfs" the only ioctl()s are for things that are rare, and maybe
67	* not possible on all hardware. For example, precise fault handling with
68	* respect to data left in endpoint fifos after aborted operations; or
69	* selective clearing of endpoint halts, to implement SET_INTERFACE.
70	*/
71
72	#define DRIVER_DESC "USB Gadget filesystem"
73	#define DRIVER_VERSION "24 Aug 2004"
74
75	static const char driver_desc [] = DRIVER_DESC;
76	static const char shortname [] = "gadgetfs";
77
78	MODULE_DESCRIPTION (DRIVER_DESC);
79	MODULE_AUTHOR ("David Brownell");
80	MODULE_LICENSE ("GPL");
81
82	static int ep_open(struct inode *, struct file *);
83
84
85	/*----------------------------------------------------------------------*/
86
87	#define GADGETFS_MAGIC 0xaee71ee7
88
89	/* /dev/gadget/$CHIP represents ep0 and the whole device */
90	enum ep0_state {
91	/* DISABLED is the initial state. */
92	STATE_DEV_DISABLED = 0,
93
94	/* Only one open() of /dev/gadget/$CHIP; only one file tracks
95	* ep0/device i/o modes and binding to the controller. Driver
96	* must always write descriptors to initialize the device, then
97	* the device becomes UNCONNECTED until enumeration.
98	*/
99	STATE_DEV_OPENED,
100
101	/* From then on, ep0 fd is in either of two basic modes:
102	* - (UN)CONNECTED: read usb_gadgetfs_event(s) from it
103	* - SETUP: read/write will transfer control data and succeed;
104	* or if "wrong direction", performs protocol stall
105	*/
106	STATE_DEV_UNCONNECTED,
107	STATE_DEV_CONNECTED,
108	STATE_DEV_SETUP,
109
110	/* UNBOUND means the driver closed ep0, so the device won't be
111	* accessible again (DEV_DISABLED) until all fds are closed.
112	*/
113	STATE_DEV_UNBOUND,
114	};
115
116	/* enough for the whole queue: most events invalidate others */
117	#define N_EVENT 5
118
119	#define RBUF_SIZE 256
120
121	struct dev_data {
122	spinlock_t lock;
123	refcount_t count;
124	int udc_usage;
125	enum ep0_state state; /* P: lock */
126	struct usb_gadgetfs_event event [N_EVENT];
127	unsigned ev_next;
128	struct fasync_struct *fasync;
129	u8 current_config;
130
131	/* drivers reading ep0 MUST handle control requests (SETUP)
132	* reported that way; else the host will time out.
133	*/
134	unsigned usermode_setup : 1,
135	setup_in : 1,
136	setup_can_stall : 1,
137	setup_out_ready : 1,
138	setup_out_error : 1,
139	setup_abort : 1,
140	gadget_registered : 1;
141	unsigned setup_wLength;
142
143	/* the rest is basically write-once */
144	struct usb_config_descriptor *config, *hs_config;
145	struct usb_device_descriptor *dev;
146	struct usb_request *req;
147	struct usb_gadget *gadget;
148	struct list_head epfiles;
149	void *buf;
150	wait_queue_head_t wait;
151	struct super_block *sb;
152	struct dentry *dentry;
153
154	/* except this scratch i/o buffer for ep0 */
155	u8 rbuf[RBUF_SIZE];
156	};
157
158	static inline void get_dev (struct dev_data *data)
159	{
160	refcount_inc (r: &data->count);
161	}
162
163	static void put_dev (struct dev_data *data)
164	{
165	if (likely (!refcount_dec_and_test (&data->count)))
166	return;
167	/* needs no more cleanup */
168	BUG_ON (waitqueue_active (&data->wait));
169	kfree (objp: data);
170	}
171
172	static struct dev_data *dev_new (void)
173	{
174	struct dev_data *dev;
175
176	dev = kzalloc(size: sizeof(*dev), GFP_KERNEL);
177	if (!dev)
178	return NULL;
179	dev->state = STATE_DEV_DISABLED;
180	refcount_set (r: &dev->count, n: 1);
181	spin_lock_init (&dev->lock);
182	INIT_LIST_HEAD (list: &dev->epfiles);
183	init_waitqueue_head (&dev->wait);
184	return dev;
185	}
186
187	/*----------------------------------------------------------------------*/
188
189	/* other /dev/gadget/$ENDPOINT files represent endpoints */
190	enum ep_state {
191	STATE_EP_DISABLED = 0,
192	STATE_EP_READY,
193	STATE_EP_ENABLED,
194	STATE_EP_UNBOUND,
195	};
196
197	struct ep_data {
198	struct mutex lock;
199	enum ep_state state;
200	refcount_t count;
201	struct dev_data *dev;
202	/* must hold dev->lock before accessing ep or req */
203	struct usb_ep *ep;
204	struct usb_request *req;
205	ssize_t status;
206	char name [16];
207	struct usb_endpoint_descriptor desc, hs_desc;
208	struct list_head epfiles;
209	wait_queue_head_t wait;
210	struct dentry *dentry;
211	};
212
213	static inline void get_ep (struct ep_data *data)
214	{
215	refcount_inc (r: &data->count);
216	}
217
218	static void put_ep (struct ep_data *data)
219	{
220	if (likely (!refcount_dec_and_test (&data->count)))
221	return;
222	put_dev (data: data->dev);
223	/* needs no more cleanup */
224	BUG_ON (!list_empty (&data->epfiles));
225	BUG_ON (waitqueue_active (&data->wait));
226	kfree (objp: data);
227	}
228
229	/*----------------------------------------------------------------------*/
230
231	/* most "how to use the hardware" policy choices are in userspace:
232	* mapping endpoint roles (which the driver needs) to the capabilities
233	* which the usb controller has. most of those capabilities are exposed
234	* implicitly, starting with the driver name and then endpoint names.
235	*/
236
237	static const char *CHIP;
238	static DEFINE_MUTEX(sb_mutex); /* Serialize superblock operations */
239
240	/*----------------------------------------------------------------------*/
241
242	/* NOTE: don't use dev_printk calls before binding to the gadget
243	* at the end of ep0 configuration, or after unbind.
244	*/
245
246	/* too wordy: dev_printk(level , &(d)->gadget->dev , fmt , ## args) */
247	#define xprintk(d,level,fmt,args...) \
248	printk(level "%s: " fmt , shortname , ## args)
249
250	#ifdef DEBUG
251	#define DBG(dev,fmt,args...) \
252	xprintk(dev , KERN_DEBUG , fmt , ## args)
253	#else
254	#define DBG(dev,fmt,args...) \
255	do { } while (0)
256	#endif /* DEBUG */
257
258	#ifdef VERBOSE_DEBUG
259	#define VDEBUG DBG
260	#else
261	#define VDEBUG(dev,fmt,args...) \
262	do { } while (0)
263	#endif /* DEBUG */
264
265	#define ERROR(dev,fmt,args...) \
266	xprintk(dev , KERN_ERR , fmt , ## args)
267	#define INFO(dev,fmt,args...) \
268	xprintk(dev , KERN_INFO , fmt , ## args)
269
270
271	/*----------------------------------------------------------------------*/
272
273	/* SYNCHRONOUS ENDPOINT OPERATIONS (bulk/intr/iso)
274	*
275	* After opening, configure non-control endpoints. Then use normal
276	* stream read() and write() requests; and maybe ioctl() to get more
277	* precise FIFO status when recovering from cancellation.
278	*/
279
280	static void epio_complete (struct usb_ep *ep, struct usb_request *req)
281	{
282	struct ep_data *epdata = ep->driver_data;
283
284	if (!req->context)
285	return;
286	if (req->status)
287	epdata->status = req->status;
288	else
289	epdata->status = req->actual;
290	complete ((struct completion *)req->context);
291	}
292
293	/* tasklock endpoint, returning when it's connected.
294	* still need dev->lock to use epdata->ep.
295	*/
296	static int
297	get_ready_ep (unsigned f_flags, struct ep_data *epdata, bool is_write)
298	{
299	int val;
300
301	if (f_flags & O_NONBLOCK) {
302	if (!mutex_trylock(lock: &epdata->lock))
303	goto nonblock;
304	if (epdata->state != STATE_EP_ENABLED &&
305	(!is_write || epdata->state != STATE_EP_READY)) {
306	mutex_unlock(lock: &epdata->lock);
307	nonblock:
308	val = -EAGAIN;
309	} else
310	val = 0;
311	return val;
312	}
313
314	val = mutex_lock_interruptible(&epdata->lock);
315	if (val < 0)
316	return val;
317
318	switch (epdata->state) {
319	case STATE_EP_ENABLED:
320	return 0;
321	case STATE_EP_READY: /* not configured yet */
322	if (is_write)
323	return 0;
324	fallthrough;
325	case STATE_EP_UNBOUND: /* clean disconnect */
326	break;
327	// case STATE_EP_DISABLED: /* "can't happen" */
328	default: /* error! */
329	pr_debug ("%s: ep %p not available, state %d\n",
330	shortname, epdata, epdata->state);
331	}
332	mutex_unlock(lock: &epdata->lock);
333	return -ENODEV;
334	}
335
336	static ssize_t
337	ep_io (struct ep_data *epdata, void *buf, unsigned len)
338	{
339	DECLARE_COMPLETION_ONSTACK (done);
340	int value;
341
342	spin_lock_irq (lock: &epdata->dev->lock);
343	if (likely (epdata->ep != NULL)) {
344	struct usb_request *req = epdata->req;
345
346	req->context = &done;
347	req->complete = epio_complete;
348	req->buf = buf;
349	req->length = len;
350	value = usb_ep_queue (ep: epdata->ep, req, GFP_ATOMIC);
351	} else
352	value = -ENODEV;
353	spin_unlock_irq (lock: &epdata->dev->lock);
354
355	if (likely (value == 0)) {
356	value = wait_for_completion_interruptible(x: &done);
357	if (value != 0) {
358	spin_lock_irq (lock: &epdata->dev->lock);
359	if (likely (epdata->ep != NULL)) {
360	DBG (epdata->dev, "%s i/o interrupted\n",
361	epdata->name);
362	usb_ep_dequeue (ep: epdata->ep, req: epdata->req);
363	spin_unlock_irq (lock: &epdata->dev->lock);
364
365	wait_for_completion(&done);
366	if (epdata->status == -ECONNRESET)
367	epdata->status = -EINTR;
368	} else {
369	spin_unlock_irq (lock: &epdata->dev->lock);
370
371	DBG (epdata->dev, "endpoint gone\n");
372	wait_for_completion(&done);
373	epdata->status = -ENODEV;
374	}
375	}
376	return epdata->status;
377	}
378	return value;
379	}
380
381	static int
382	ep_release (struct inode *inode, struct file *fd)
383	{
384	struct ep_data *data = fd->private_data;
385	int value;
386
387	value = mutex_lock_interruptible(&data->lock);
388	if (value < 0)
389	return value;
390
391	/* clean up if this can be reopened */
392	if (data->state != STATE_EP_UNBOUND) {
393	data->state = STATE_EP_DISABLED;
394	data->desc.bDescriptorType = 0;
395	data->hs_desc.bDescriptorType = 0;
396	usb_ep_disable(ep: data->ep);
397	}
398	mutex_unlock(lock: &data->lock);
399	put_ep (data);
400	return 0;
401	}
402
403	static long ep_ioctl(struct file *fd, unsigned code, unsigned long value)
404	{
405	struct ep_data *data = fd->private_data;
406	int status;
407
408	if ((status = get_ready_ep (f_flags: fd->f_flags, epdata: data, is_write: false)) < 0)
409	return status;
410
411	spin_lock_irq (lock: &data->dev->lock);
412	if (likely (data->ep != NULL)) {
413	switch (code) {
414	case GADGETFS_FIFO_STATUS:
415	status = usb_ep_fifo_status (ep: data->ep);
416	break;
417	case GADGETFS_FIFO_FLUSH:
418	usb_ep_fifo_flush (ep: data->ep);
419	break;
420	case GADGETFS_CLEAR_HALT:
421	status = usb_ep_clear_halt (ep: data->ep);
422	break;
423	default:
424	status = -ENOTTY;
425	}
426	} else
427	status = -ENODEV;
428	spin_unlock_irq (lock: &data->dev->lock);
429	mutex_unlock(lock: &data->lock);
430	return status;
431	}
432
433	/*----------------------------------------------------------------------*/
434
435	/* ASYNCHRONOUS ENDPOINT I/O OPERATIONS (bulk/intr/iso) */
436
437	struct kiocb_priv {
438	struct usb_request *req;
439	struct ep_data *epdata;
440	struct kiocb *iocb;
441	struct mm_struct *mm;
442	struct work_struct work;
443	void *buf;
444	struct iov_iter to;
445	const void *to_free;
446	unsigned actual;
447	};
448
449	static int ep_aio_cancel(struct kiocb *iocb)
450	{
451	struct kiocb_priv *priv = iocb->private;
452	struct ep_data *epdata;
453	int value;
454
455	local_irq_disable();
456	epdata = priv->epdata;
457	// spin_lock(&epdata->dev->lock);
458	if (likely(epdata && epdata->ep && priv->req))
459	value = usb_ep_dequeue (ep: epdata->ep, req: priv->req);
460	else
461	value = -EINVAL;
462	// spin_unlock(&epdata->dev->lock);
463	local_irq_enable();
464
465	return value;
466	}
467
468	static void ep_user_copy_worker(struct work_struct *work)
469	{
470	struct kiocb_priv *priv = container_of(work, struct kiocb_priv, work);
471	struct mm_struct *mm = priv->mm;
472	struct kiocb *iocb = priv->iocb;
473	size_t ret;
474
475	kthread_use_mm(mm);
476	ret = copy_to_iter(addr: priv->buf, bytes: priv->actual, i: &priv->to);
477	kthread_unuse_mm(mm);
478	if (!ret)
479	ret = -EFAULT;
480
481	/* completing the iocb can drop the ctx and mm, don't touch mm after */
482	iocb->ki_complete(iocb, ret);
483
484	kfree(objp: priv->buf);
485	kfree(objp: priv->to_free);
486	kfree(objp: priv);
487	}
488
489	static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
490	{
491	struct kiocb *iocb = req->context;
492	struct kiocb_priv *priv = iocb->private;
493	struct ep_data *epdata = priv->epdata;
494
495	/* lock against disconnect (and ideally, cancel) */
496	spin_lock(lock: &epdata->dev->lock);
497	priv->req = NULL;
498	priv->epdata = NULL;
499
500	/* if this was a write or a read returning no data then we
501	* don't need to copy anything to userspace, so we can
502	* complete the aio request immediately.
503	*/
504	if (priv->to_free == NULL || unlikely(req->actual == 0)) {
505	kfree(objp: req->buf);
506	kfree(objp: priv->to_free);
507	kfree(objp: priv);
508	iocb->private = NULL;
509	iocb->ki_complete(iocb,
510	req->actual ? req->actual : (long)req->status);
511	} else {
512	/* ep_copy_to_user() won't report both; we hide some faults */
513	if (unlikely(0 != req->status))
514	DBG(epdata->dev, "%s fault %d len %d\n",
515	ep->name, req->status, req->actual);
516
517	priv->buf = req->buf;
518	priv->actual = req->actual;
519	INIT_WORK(&priv->work, ep_user_copy_worker);
520	schedule_work(work: &priv->work);
521	}
522
523	usb_ep_free_request(ep, req);
524	spin_unlock(lock: &epdata->dev->lock);
525	put_ep(data: epdata);
526	}
527
528	static ssize_t ep_aio(struct kiocb *iocb,
529	struct kiocb_priv *priv,
530	struct ep_data *epdata,
531	char *buf,
532	size_t len)
533	{
534	struct usb_request *req;
535	ssize_t value;
536
537	iocb->private = priv;
538	priv->iocb = iocb;
539
540	kiocb_set_cancel_fn(req: iocb, cancel: ep_aio_cancel);
541	get_ep(data: epdata);
542	priv->epdata = epdata;
543	priv->actual = 0;
544	priv->mm = current->mm; /* mm teardown waits for iocbs in exit_aio() */
545
546	/* each kiocb is coupled to one usb_request, but we can't
547	* allocate or submit those if the host disconnected.
548	*/
549	spin_lock_irq(lock: &epdata->dev->lock);
550	value = -ENODEV;
551	if (unlikely(epdata->ep == NULL))
552	goto fail;
553
554	req = usb_ep_alloc_request(ep: epdata->ep, GFP_ATOMIC);
555	value = -ENOMEM;
556	if (unlikely(!req))
557	goto fail;
558
559	priv->req = req;
560	req->buf = buf;
561	req->length = len;
562	req->complete = ep_aio_complete;
563	req->context = iocb;
564	value = usb_ep_queue(ep: epdata->ep, req, GFP_ATOMIC);
565	if (unlikely(0 != value)) {
566	usb_ep_free_request(ep: epdata->ep, req);
567	goto fail;
568	}
569	spin_unlock_irq(lock: &epdata->dev->lock);
570	return -EIOCBQUEUED;
571
572	fail:
573	spin_unlock_irq(lock: &epdata->dev->lock);
574	kfree(objp: priv->to_free);
575	kfree(objp: priv);
576	put_ep(data: epdata);
577	return value;
578	}
579
580	static ssize_t
581	ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
582	{
583	struct file *file = iocb->ki_filp;
584	struct ep_data *epdata = file->private_data;
585	size_t len = iov_iter_count(i: to);
586	ssize_t value;
587	char *buf;
588
589	if ((value = get_ready_ep(f_flags: file->f_flags, epdata, is_write: false)) < 0)
590	return value;
591
592	/* halt any endpoint by doing a "wrong direction" i/o call */
593	if (usb_endpoint_dir_in(epd: &epdata->desc)) {
594	if (usb_endpoint_xfer_isoc(epd: &epdata->desc) ||
595	!is_sync_kiocb(kiocb: iocb)) {
596	mutex_unlock(lock: &epdata->lock);
597	return -EINVAL;
598	}
599	DBG (epdata->dev, "%s halt\n", epdata->name);
600	spin_lock_irq(lock: &epdata->dev->lock);
601	if (likely(epdata->ep != NULL))
602	usb_ep_set_halt(ep: epdata->ep);
603	spin_unlock_irq(lock: &epdata->dev->lock);
604	mutex_unlock(lock: &epdata->lock);
605	return -EBADMSG;
606	}
607
608	buf = kmalloc(size: len, GFP_KERNEL);
609	if (unlikely(!buf)) {
610	mutex_unlock(lock: &epdata->lock);
611	return -ENOMEM;
612	}
613	if (is_sync_kiocb(kiocb: iocb)) {
614	value = ep_io(epdata, buf, len);
615	if (value >= 0 && (copy_to_iter(addr: buf, bytes: value, i: to) != value))
616	value = -EFAULT;
617	} else {
618	struct kiocb_priv *priv = kzalloc(size: sizeof *priv, GFP_KERNEL);
619	value = -ENOMEM;
620	if (!priv)
621	goto fail;
622	priv->to_free = dup_iter(new: &priv->to, old: to, GFP_KERNEL);
623	if (!iter_is_ubuf(i: &priv->to) && !priv->to_free) {
624	kfree(objp: priv);
625	goto fail;
626	}
627	value = ep_aio(iocb, priv, epdata, buf, len);
628	if (value == -EIOCBQUEUED)
629	buf = NULL;
630	}
631	fail:
632	kfree(objp: buf);
633	mutex_unlock(lock: &epdata->lock);
634	return value;
635	}
636
637	static ssize_t ep_config(struct ep_data *, const char *, size_t);
638
639	static ssize_t
640	ep_write_iter(struct kiocb *iocb, struct iov_iter *from)
641	{
642	struct file *file = iocb->ki_filp;
643	struct ep_data *epdata = file->private_data;
644	size_t len = iov_iter_count(i: from);
645	bool configured;
646	ssize_t value;
647	char *buf;
648
649	if ((value = get_ready_ep(f_flags: file->f_flags, epdata, is_write: true)) < 0)
650	return value;
651
652	configured = epdata->state == STATE_EP_ENABLED;
653
654	/* halt any endpoint by doing a "wrong direction" i/o call */
655	if (configured && !usb_endpoint_dir_in(epd: &epdata->desc)) {
656	if (usb_endpoint_xfer_isoc(epd: &epdata->desc) ||
657	!is_sync_kiocb(kiocb: iocb)) {
658	mutex_unlock(lock: &epdata->lock);
659	return -EINVAL;
660	}
661	DBG (epdata->dev, "%s halt\n", epdata->name);
662	spin_lock_irq(lock: &epdata->dev->lock);
663	if (likely(epdata->ep != NULL))
664	usb_ep_set_halt(ep: epdata->ep);
665	spin_unlock_irq(lock: &epdata->dev->lock);
666	mutex_unlock(lock: &epdata->lock);
667	return -EBADMSG;
668	}
669
670	buf = kmalloc(size: len, GFP_KERNEL);
671	if (unlikely(!buf)) {
672	mutex_unlock(lock: &epdata->lock);
673	return -ENOMEM;
674	}
675
676	if (unlikely(!copy_from_iter_full(buf, len, from))) {
677	value = -EFAULT;
678	goto out;
679	}
680
681	if (unlikely(!configured)) {
682	value = ep_config(epdata, buf, len);
683	} else if (is_sync_kiocb(kiocb: iocb)) {
684	value = ep_io(epdata, buf, len);
685	} else {
686	struct kiocb_priv *priv = kzalloc(size: sizeof *priv, GFP_KERNEL);
687	value = -ENOMEM;
688	if (priv) {
689	value = ep_aio(iocb, priv, epdata, buf, len);
690	if (value == -EIOCBQUEUED)
691	buf = NULL;
692	}
693	}
694	out:
695	kfree(objp: buf);
696	mutex_unlock(lock: &epdata->lock);
697	return value;
698	}
699
700	/*----------------------------------------------------------------------*/
701
702	/* used after endpoint configuration */
703	static const struct file_operations ep_io_operations = {
704	.owner = THIS_MODULE,
705
706	.open = ep_open,
707	.release = ep_release,
708	.llseek = no_llseek,
709	.unlocked_ioctl = ep_ioctl,
710	.read_iter = ep_read_iter,
711	.write_iter = ep_write_iter,
712	};
713
714	/* ENDPOINT INITIALIZATION
715	*
716	* fd = open ("/dev/gadget/$ENDPOINT", O_RDWR)
717	* status = write (fd, descriptors, sizeof descriptors)
718	*
719	* That write establishes the endpoint configuration, configuring
720	* the controller to process bulk, interrupt, or isochronous transfers
721	* at the right maxpacket size, and so on.
722	*
723	* The descriptors are message type 1, identified by a host order u32
724	* at the beginning of what's written. Descriptor order is: full/low
725	* speed descriptor, then optional high speed descriptor.
726	*/
727	static ssize_t
728	ep_config (struct ep_data *data, const char *buf, size_t len)
729	{
730	struct usb_ep *ep;
731	u32 tag;
732	int value, length = len;
733
734	if (data->state != STATE_EP_READY) {
735	value = -EL2HLT;
736	goto fail;
737	}
738
739	value = len;
740	if (len < USB_DT_ENDPOINT_SIZE + 4)
741	goto fail0;
742
743	/* we might need to change message format someday */
744	memcpy(&tag, buf, 4);
745	if (tag != 1) {
746	DBG(data->dev, "config %s, bad tag %d\n", data->name, tag);
747	goto fail0;
748	}
749	buf += 4;
750	len -= 4;
751
752	/* NOTE: audio endpoint extensions not accepted here;
753	* just don't include the extra bytes.
754	*/
755
756	/* full/low speed descriptor, then high speed */
757	memcpy(&data->desc, buf, USB_DT_ENDPOINT_SIZE);
758	if (data->desc.bLength != USB_DT_ENDPOINT_SIZE
759	|| data->desc.bDescriptorType != USB_DT_ENDPOINT)
760	goto fail0;
761	if (len != USB_DT_ENDPOINT_SIZE) {
762	if (len != 2 * USB_DT_ENDPOINT_SIZE)
763	goto fail0;
764	memcpy(&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE,
765	USB_DT_ENDPOINT_SIZE);
766	if (data->hs_desc.bLength != USB_DT_ENDPOINT_SIZE
767	|| data->hs_desc.bDescriptorType
768	!= USB_DT_ENDPOINT) {
769	DBG(data->dev, "config %s, bad hs length or type\n",
770	data->name);
771	goto fail0;
772	}
773	}
774
775	spin_lock_irq (lock: &data->dev->lock);
776	if (data->dev->state == STATE_DEV_UNBOUND) {
777	value = -ENOENT;
778	goto gone;
779	} else {
780	ep = data->ep;
781	if (ep == NULL) {
782	value = -ENODEV;
783	goto gone;
784	}
785	}
786	switch (data->dev->gadget->speed) {
787	case USB_SPEED_LOW:
788	case USB_SPEED_FULL:
789	ep->desc = &data->desc;
790	break;
791	case USB_SPEED_HIGH:
792	/* fails if caller didn't provide that descriptor... */
793	ep->desc = &data->hs_desc;
794	break;
795	default:
796	DBG(data->dev, "unconnected, %s init abandoned\n",
797	data->name);
798	value = -EINVAL;
799	goto gone;
800	}
801	value = usb_ep_enable(ep);
802	if (value == 0) {
803	data->state = STATE_EP_ENABLED;
804	value = length;
805	}
806	gone:
807	spin_unlock_irq (lock: &data->dev->lock);
808	if (value < 0) {
809	fail:
810	data->desc.bDescriptorType = 0;
811	data->hs_desc.bDescriptorType = 0;
812	}
813	return value;
814	fail0:
815	value = -EINVAL;
816	goto fail;
817	}
818
819	static int
820	ep_open (struct inode *inode, struct file *fd)
821	{
822	struct ep_data *data = inode->i_private;
823	int value = -EBUSY;
824
825	if (mutex_lock_interruptible(&data->lock) != 0)
826	return -EINTR;
827	spin_lock_irq (lock: &data->dev->lock);
828	if (data->dev->state == STATE_DEV_UNBOUND)
829	value = -ENOENT;
830	else if (data->state == STATE_EP_DISABLED) {
831	value = 0;
832	data->state = STATE_EP_READY;
833	get_ep (data);
834	fd->private_data = data;
835	VDEBUG (data->dev, "%s ready\n", data->name);
836	} else
837	DBG (data->dev, "%s state %d\n",
838	data->name, data->state);
839	spin_unlock_irq (lock: &data->dev->lock);
840	mutex_unlock(lock: &data->lock);
841	return value;
842	}
843
844	/*----------------------------------------------------------------------*/
845
846	/* EP0 IMPLEMENTATION can be partly in userspace.
847	*
848	* Drivers that use this facility receive various events, including
849	* control requests the kernel doesn't handle. Drivers that don't
850	* use this facility may be too simple-minded for real applications.
851	*/
852
853	static inline void ep0_readable (struct dev_data *dev)
854	{
855	wake_up (&dev->wait);
856	kill_fasync (&dev->fasync, SIGIO, POLL_IN);
857	}
858
859	static void clean_req (struct usb_ep *ep, struct usb_request *req)
860	{
861	struct dev_data *dev = ep->driver_data;
862
863	if (req->buf != dev->rbuf) {
864	kfree(objp: req->buf);
865	req->buf = dev->rbuf;
866	}
867	req->complete = epio_complete;
868	dev->setup_out_ready = 0;
869	}
870
871	static void ep0_complete (struct usb_ep *ep, struct usb_request *req)
872	{
873	struct dev_data *dev = ep->driver_data;
874	unsigned long flags;
875	int free = 1;
876
877	/* for control OUT, data must still get to userspace */
878	spin_lock_irqsave(&dev->lock, flags);
879	if (!dev->setup_in) {
880	dev->setup_out_error = (req->status != 0);
881	if (!dev->setup_out_error)
882	free = 0;
883	dev->setup_out_ready = 1;
884	ep0_readable (dev);
885	}
886
887	/* clean up as appropriate */
888	if (free && req->buf != &dev->rbuf)
889	clean_req (ep, req);
890	req->complete = epio_complete;
891	spin_unlock_irqrestore(lock: &dev->lock, flags);
892	}
893
894	static int setup_req (struct usb_ep *ep, struct usb_request *req, u16 len)
895	{
896	struct dev_data *dev = ep->driver_data;
897
898	if (dev->setup_out_ready) {
899	DBG (dev, "ep0 request busy!\n");
900	return -EBUSY;
901	}
902	if (len > sizeof (dev->rbuf))
903	req->buf = kmalloc(size: len, GFP_ATOMIC);
904	if (req->buf == NULL) {
905	req->buf = dev->rbuf;
906	return -ENOMEM;
907	}
908	req->complete = ep0_complete;
909	req->length = len;
910	req->zero = 0;
911	return 0;
912	}
913
914	static ssize_t
915	ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
916	{
917	struct dev_data *dev = fd->private_data;
918	ssize_t retval;
919	enum ep0_state state;
920
921	spin_lock_irq (lock: &dev->lock);
922	if (dev->state <= STATE_DEV_OPENED) {
923	retval = -EINVAL;
924	goto done;
925	}
926
927	/* report fd mode change before acting on it */
928	if (dev->setup_abort) {
929	dev->setup_abort = 0;
930	retval = -EIDRM;
931	goto done;
932	}
933
934	/* control DATA stage */
935	if ((state = dev->state) == STATE_DEV_SETUP) {
936
937	if (dev->setup_in) { /* stall IN */
938	VDEBUG(dev, "ep0in stall\n");
939	(void) usb_ep_set_halt (ep: dev->gadget->ep0);
940	retval = -EL2HLT;
941	dev->state = STATE_DEV_CONNECTED;
942
943	} else if (len == 0) { /* ack SET_CONFIGURATION etc */
944	struct usb_ep *ep = dev->gadget->ep0;
945	struct usb_request *req = dev->req;
946
947	if ((retval = setup_req (ep, req, len: 0)) == 0) {
948	++dev->udc_usage;
949	spin_unlock_irq (lock: &dev->lock);
950	retval = usb_ep_queue (ep, req, GFP_KERNEL);
951	spin_lock_irq (lock: &dev->lock);
952	--dev->udc_usage;
953	}
954	dev->state = STATE_DEV_CONNECTED;
955
956	/* assume that was SET_CONFIGURATION */
957	if (dev->current_config) {
958	unsigned power;
959
960	if (gadget_is_dualspeed(g: dev->gadget)
961	&& (dev->gadget->speed
962	== USB_SPEED_HIGH))
963	power = dev->hs_config->bMaxPower;
964	else
965	power = dev->config->bMaxPower;
966	usb_gadget_vbus_draw(gadget: dev->gadget, mA: 2 * power);
967	}
968
969	} else { /* collect OUT data */
970	if ((fd->f_flags & O_NONBLOCK) != 0
971	&& !dev->setup_out_ready) {
972	retval = -EAGAIN;
973	goto done;
974	}
975	spin_unlock_irq (lock: &dev->lock);
976	retval = wait_event_interruptible (dev->wait,
977	dev->setup_out_ready != 0);
978
979	/* FIXME state could change from under us */
980	spin_lock_irq (lock: &dev->lock);
981	if (retval)
982	goto done;
983
984	if (dev->state != STATE_DEV_SETUP) {
985	retval = -ECANCELED;
986	goto done;
987	}
988	dev->state = STATE_DEV_CONNECTED;
989
990	if (dev->setup_out_error)
991	retval = -EIO;
992	else {
993	len = min (len, (size_t)dev->req->actual);
994	++dev->udc_usage;
995	spin_unlock_irq(lock: &dev->lock);
996	if (copy_to_user (to: buf, from: dev->req->buf, n: len))
997	retval = -EFAULT;
998	else
999	retval = len;
1000	spin_lock_irq(lock: &dev->lock);
1001	--dev->udc_usage;
1002	clean_req (ep: dev->gadget->ep0, req: dev->req);
1003	/* NOTE userspace can't yet choose to stall */
1004	}
1005	}
1006	goto done;
1007	}
1008
1009	/* else normal: return event data */
1010	if (len < sizeof dev->event [0]) {
1011	retval = -EINVAL;
1012	goto done;
1013	}
1014	len -= len % sizeof (struct usb_gadgetfs_event);
1015	dev->usermode_setup = 1;
1016
1017	scan:
1018	/* return queued events right away */
1019	if (dev->ev_next != 0) {
1020	unsigned i, n;
1021
1022	n = len / sizeof (struct usb_gadgetfs_event);
1023	if (dev->ev_next < n)
1024	n = dev->ev_next;
1025
1026	/* ep0 i/o has special semantics during STATE_DEV_SETUP */
1027	for (i = 0; i < n; i++) {
1028	if (dev->event [i].type == GADGETFS_SETUP) {
1029	dev->state = STATE_DEV_SETUP;
1030	n = i + 1;
1031	break;
1032	}
1033	}
1034	spin_unlock_irq (lock: &dev->lock);
1035	len = n * sizeof (struct usb_gadgetfs_event);
1036	if (copy_to_user (to: buf, from: &dev->event, n: len))
1037	retval = -EFAULT;
1038	else
1039	retval = len;
1040	if (len > 0) {
1041	/* NOTE this doesn't guard against broken drivers;
1042	* concurrent ep0 readers may lose events.
1043	*/
1044	spin_lock_irq (lock: &dev->lock);
1045	if (dev->ev_next > n) {
1046	memmove(&dev->event[0], &dev->event[n],
1047	sizeof (struct usb_gadgetfs_event)
1048	* (dev->ev_next - n));
1049	}
1050	dev->ev_next -= n;
1051	spin_unlock_irq (lock: &dev->lock);
1052	}
1053	return retval;
1054	}
1055	if (fd->f_flags & O_NONBLOCK) {
1056	retval = -EAGAIN;
1057	goto done;
1058	}
1059
1060	switch (state) {
1061	default:
1062	DBG (dev, "fail %s, state %d\n", __func__, state);
1063	retval = -ESRCH;
1064	break;
1065	case STATE_DEV_UNCONNECTED:
1066	case STATE_DEV_CONNECTED:
1067	spin_unlock_irq (lock: &dev->lock);
1068	DBG (dev, "%s wait\n", __func__);
1069
1070	/* wait for events */
1071	retval = wait_event_interruptible (dev->wait,
1072	dev->ev_next != 0);
1073	if (retval < 0)
1074	return retval;
1075	spin_lock_irq (lock: &dev->lock);
1076	goto scan;
1077	}
1078
1079	done:
1080	spin_unlock_irq (lock: &dev->lock);
1081	return retval;
1082	}
1083
1084	static struct usb_gadgetfs_event *
1085	next_event (struct dev_data *dev, enum usb_gadgetfs_event_type type)
1086	{
1087	struct usb_gadgetfs_event *event;
1088	unsigned i;
1089
1090	switch (type) {
1091	/* these events purge the queue */
1092	case GADGETFS_DISCONNECT:
1093	if (dev->state == STATE_DEV_SETUP)
1094	dev->setup_abort = 1;
1095	fallthrough;
1096	case GADGETFS_CONNECT:
1097	dev->ev_next = 0;
1098	break;
1099	case GADGETFS_SETUP: /* previous request timed out */
1100	case GADGETFS_SUSPEND: /* same effect */
1101	/* these events can't be repeated */
1102	for (i = 0; i != dev->ev_next; i++) {
1103	if (dev->event [i].type != type)
1104	continue;
1105	DBG(dev, "discard old event[%d] %d\n", i, type);
1106	dev->ev_next--;
1107	if (i == dev->ev_next)
1108	break;
1109	/* indices start at zero, for simplicity */
1110	memmove (&dev->event [i], &dev->event [i + 1],
1111	sizeof (struct usb_gadgetfs_event)
1112	* (dev->ev_next - i));
1113	}
1114	break;
1115	default:
1116	BUG ();
1117	}
1118	VDEBUG(dev, "event[%d] = %d\n", dev->ev_next, type);
1119	event = &dev->event [dev->ev_next++];
1120	BUG_ON (dev->ev_next > N_EVENT);
1121	memset (event, 0, sizeof *event);
1122	event->type = type;
1123	return event;
1124	}
1125
1126	static ssize_t
1127	ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
1128	{
1129	struct dev_data *dev = fd->private_data;
1130	ssize_t retval = -ESRCH;
1131
1132	/* report fd mode change before acting on it */
1133	if (dev->setup_abort) {
1134	dev->setup_abort = 0;
1135	retval = -EIDRM;
1136
1137	/* data and/or status stage for control request */
1138	} else if (dev->state == STATE_DEV_SETUP) {
1139
1140	len = min_t(size_t, len, dev->setup_wLength);
1141	if (dev->setup_in) {
1142	retval = setup_req (ep: dev->gadget->ep0, req: dev->req, len);
1143	if (retval == 0) {
1144	dev->state = STATE_DEV_CONNECTED;
1145	++dev->udc_usage;
1146	spin_unlock_irq (lock: &dev->lock);
1147	if (copy_from_user (to: dev->req->buf, from: buf, n: len))
1148	retval = -EFAULT;
1149	else {
1150	if (len < dev->setup_wLength)
1151	dev->req->zero = 1;
1152	retval = usb_ep_queue (
1153	ep: dev->gadget->ep0, req: dev->req,
1154	GFP_KERNEL);
1155	}
1156	spin_lock_irq(lock: &dev->lock);
1157	--dev->udc_usage;
1158	if (retval < 0) {
1159	clean_req (ep: dev->gadget->ep0, req: dev->req);
1160	} else
1161	retval = len;
1162
1163	return retval;
1164	}
1165
1166	/* can stall some OUT transfers */
1167	} else if (dev->setup_can_stall) {
1168	VDEBUG(dev, "ep0out stall\n");
1169	(void) usb_ep_set_halt (ep: dev->gadget->ep0);
1170	retval = -EL2HLT;
1171	dev->state = STATE_DEV_CONNECTED;
1172	} else {
1173	DBG(dev, "bogus ep0out stall!\n");
1174	}
1175	} else
1176	DBG (dev, "fail %s, state %d\n", __func__, dev->state);
1177
1178	return retval;
1179	}
1180
1181	static int
1182	ep0_fasync (int f, struct file *fd, int on)
1183	{
1184	struct dev_data *dev = fd->private_data;
1185	// caller must F_SETOWN before signal delivery happens
1186	VDEBUG (dev, "%s %s\n", __func__, on ? "on" : "off");
1187	return fasync_helper (f, fd, on, &dev->fasync);
1188	}
1189
1190	static struct usb_gadget_driver gadgetfs_driver;
1191
1192	static int
1193	dev_release (struct inode *inode, struct file *fd)
1194	{
1195	struct dev_data *dev = fd->private_data;
1196
1197	/* closing ep0 === shutdown all */
1198
1199	if (dev->gadget_registered) {
1200	usb_gadget_unregister_driver (driver: &gadgetfs_driver);
1201	dev->gadget_registered = false;
1202	}
1203
1204	/* at this point "good" hardware has disconnected the
1205	* device from USB; the host won't see it any more.
1206	* alternatively, all host requests will time out.
1207	*/
1208
1209	kfree (objp: dev->buf);
1210	dev->buf = NULL;
1211
1212	/* other endpoints were all decoupled from this device */
1213	spin_lock_irq(lock: &dev->lock);
1214	dev->state = STATE_DEV_DISABLED;
1215	spin_unlock_irq(lock: &dev->lock);
1216
1217	put_dev (data: dev);
1218	return 0;
1219	}
1220
1221	static __poll_t
1222	ep0_poll (struct file *fd, poll_table *wait)
1223	{
1224	struct dev_data *dev = fd->private_data;
1225	__poll_t mask = 0;
1226
1227	if (dev->state <= STATE_DEV_OPENED)
1228	return DEFAULT_POLLMASK;
1229
1230	poll_wait(filp: fd, wait_address: &dev->wait, p: wait);
1231
1232	spin_lock_irq(lock: &dev->lock);
1233
1234	/* report fd mode change before acting on it */
1235	if (dev->setup_abort) {
1236	dev->setup_abort = 0;
1237	mask = EPOLLHUP;
1238	goto out;
1239	}
1240
1241	if (dev->state == STATE_DEV_SETUP) {
1242	if (dev->setup_in || dev->setup_can_stall)
1243	mask = EPOLLOUT;
1244	} else {
1245	if (dev->ev_next != 0)
1246	mask = EPOLLIN;
1247	}
1248	out:
1249	spin_unlock_irq(lock: &dev->lock);
1250	return mask;
1251	}
1252
1253	static long gadget_dev_ioctl (struct file *fd, unsigned code, unsigned long value)
1254	{
1255	struct dev_data *dev = fd->private_data;
1256	struct usb_gadget *gadget = dev->gadget;
1257	long ret = -ENOTTY;
1258
1259	spin_lock_irq(lock: &dev->lock);
1260	if (dev->state == STATE_DEV_OPENED ||
1261	dev->state == STATE_DEV_UNBOUND) {
1262	/* Not bound to a UDC */
1263	} else if (gadget->ops->ioctl) {
1264	++dev->udc_usage;
1265	spin_unlock_irq(lock: &dev->lock);
1266
1267	ret = gadget->ops->ioctl (gadget, code, value);
1268
1269	spin_lock_irq(lock: &dev->lock);
1270	--dev->udc_usage;
1271	}
1272	spin_unlock_irq(lock: &dev->lock);
1273
1274	return ret;
1275	}
1276
1277	/*----------------------------------------------------------------------*/
1278
1279	/* The in-kernel gadget driver handles most ep0 issues, in particular
1280	* enumerating the single configuration (as provided from user space).
1281	*
1282	* Unrecognized ep0 requests may be handled in user space.
1283	*/
1284
1285	static void make_qualifier (struct dev_data *dev)
1286	{
1287	struct usb_qualifier_descriptor qual;
1288	struct usb_device_descriptor *desc;
1289
1290	qual.bLength = sizeof qual;
1291	qual.bDescriptorType = USB_DT_DEVICE_QUALIFIER;
1292	qual.bcdUSB = cpu_to_le16 (0x0200);
1293
1294	desc = dev->dev;
1295	qual.bDeviceClass = desc->bDeviceClass;
1296	qual.bDeviceSubClass = desc->bDeviceSubClass;
1297	qual.bDeviceProtocol = desc->bDeviceProtocol;
1298
1299	/* assumes ep0 uses the same value for both speeds ... */
1300	qual.bMaxPacketSize0 = dev->gadget->ep0->maxpacket;
1301
1302	qual.bNumConfigurations = 1;
1303	qual.bRESERVED = 0;
1304
1305	memcpy (dev->rbuf, &qual, sizeof qual);
1306	}
1307
1308	static int
1309	config_buf (struct dev_data *dev, u8 type, unsigned index)
1310	{
1311	int len;
1312	int hs = 0;
1313
1314	/* only one configuration */
1315	if (index > 0)
1316	return -EINVAL;
1317
1318	if (gadget_is_dualspeed(g: dev->gadget)) {
1319	hs = (dev->gadget->speed == USB_SPEED_HIGH);
1320	if (type == USB_DT_OTHER_SPEED_CONFIG)
1321	hs = !hs;
1322	}
1323	if (hs) {
1324	dev->req->buf = dev->hs_config;
1325	len = le16_to_cpu(dev->hs_config->wTotalLength);
1326	} else {
1327	dev->req->buf = dev->config;
1328	len = le16_to_cpu(dev->config->wTotalLength);
1329	}
1330	((u8 *)dev->req->buf) [1] = type;
1331	return len;
1332	}
1333
1334	static int
1335	gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
1336	{
1337	struct dev_data *dev = get_gadget_data (gadget);
1338	struct usb_request *req = dev->req;
1339	int value = -EOPNOTSUPP;
1340	struct usb_gadgetfs_event *event;
1341	u16 w_value = le16_to_cpu(ctrl->wValue);
1342	u16 w_length = le16_to_cpu(ctrl->wLength);
1343
1344	if (w_length > RBUF_SIZE) {
1345	if (ctrl->bRequestType & USB_DIR_IN) {
1346	/* Cast away the const, we are going to overwrite on purpose. */
1347	__le16 *temp = (__le16 *)&ctrl->wLength;
1348
1349	*temp = cpu_to_le16(RBUF_SIZE);
1350	w_length = RBUF_SIZE;
1351	} else {
1352	return value;
1353	}
1354	}
1355
1356	spin_lock (lock: &dev->lock);
1357	dev->setup_abort = 0;
1358	if (dev->state == STATE_DEV_UNCONNECTED) {
1359	if (gadget_is_dualspeed(g: gadget)
1360	&& gadget->speed == USB_SPEED_HIGH
1361	&& dev->hs_config == NULL) {
1362	spin_unlock(lock: &dev->lock);
1363	ERROR (dev, "no high speed config??\n");
1364	return -EINVAL;
1365	}
1366
1367	dev->state = STATE_DEV_CONNECTED;
1368
1369	INFO (dev, "connected\n");
1370	event = next_event (dev, type: GADGETFS_CONNECT);
1371	event->u.speed = gadget->speed;
1372	ep0_readable (dev);
1373
1374	/* host may have given up waiting for response. we can miss control
1375	* requests handled lower down (device/endpoint status and features);
1376	* then ep0_{read,write} will report the wrong status. controller
1377	* driver will have aborted pending i/o.
1378	*/
1379	} else if (dev->state == STATE_DEV_SETUP)
1380	dev->setup_abort = 1;
1381
1382	req->buf = dev->rbuf;
1383	req->context = NULL;
1384	switch (ctrl->bRequest) {
1385
1386	case USB_REQ_GET_DESCRIPTOR:
1387	if (ctrl->bRequestType != USB_DIR_IN)
1388	goto unrecognized;
1389	switch (w_value >> 8) {
1390
1391	case USB_DT_DEVICE:
1392	value = min (w_length, (u16) sizeof *dev->dev);
1393	dev->dev->bMaxPacketSize0 = dev->gadget->ep0->maxpacket;
1394	req->buf = dev->dev;
1395	break;
1396	case USB_DT_DEVICE_QUALIFIER:
1397	if (!dev->hs_config)
1398	break;
1399	value = min (w_length, (u16)
1400	sizeof (struct usb_qualifier_descriptor));
1401	make_qualifier (dev);
1402	break;
1403	case USB_DT_OTHER_SPEED_CONFIG:
1404	case USB_DT_CONFIG:
1405	value = config_buf (dev,
1406	type: w_value >> 8,
1407	index: w_value & 0xff);
1408	if (value >= 0)
1409	value = min (w_length, (u16) value);
1410	break;
1411	case USB_DT_STRING:
1412	goto unrecognized;
1413
1414	default: // all others are errors
1415	break;
1416	}
1417	break;
1418
1419	/* currently one config, two speeds */
1420	case USB_REQ_SET_CONFIGURATION:
1421	if (ctrl->bRequestType != 0)
1422	goto unrecognized;
1423	if (0 == (u8) w_value) {
1424	value = 0;
1425	dev->current_config = 0;
1426	usb_gadget_vbus_draw(gadget, mA: 8 /* mA */ );
1427	// user mode expected to disable endpoints
1428	} else {
1429	u8 config, power;
1430
1431	if (gadget_is_dualspeed(g: gadget)
1432	&& gadget->speed == USB_SPEED_HIGH) {
1433	config = dev->hs_config->bConfigurationValue;
1434	power = dev->hs_config->bMaxPower;
1435	} else {
1436	config = dev->config->bConfigurationValue;
1437	power = dev->config->bMaxPower;
1438	}
1439
1440	if (config == (u8) w_value) {
1441	value = 0;
1442	dev->current_config = config;
1443	usb_gadget_vbus_draw(gadget, mA: 2 * power);
1444	}
1445	}
1446
1447	/* report SET_CONFIGURATION like any other control request,
1448	* except that usermode may not stall this. the next
1449	* request mustn't be allowed start until this finishes:
1450	* endpoints and threads set up, etc.
1451	*
1452	* NOTE: older PXA hardware (before PXA 255: without UDCCFR)
1453	* has bad/racey automagic that prevents synchronizing here.
1454	* even kernel mode drivers often miss them.
1455	*/
1456	if (value == 0) {
1457	INFO (dev, "configuration #%d\n", dev->current_config);
1458	usb_gadget_set_state(gadget, state: USB_STATE_CONFIGURED);
1459	if (dev->usermode_setup) {
1460	dev->setup_can_stall = 0;
1461	goto delegate;
1462	}
1463	}
1464	break;
1465
1466	#ifndef CONFIG_USB_PXA25X
1467	/* PXA automagically handles this request too */
1468	case USB_REQ_GET_CONFIGURATION:
1469	if (ctrl->bRequestType != 0x80)
1470	goto unrecognized;
1471	*(u8 *)req->buf = dev->current_config;
1472	value = min (w_length, (u16) 1);
1473	break;
1474	#endif
1475
1476	default:
1477	unrecognized:
1478	VDEBUG (dev, "%s req%02x.%02x v%04x i%04x l%d\n",
1479	dev->usermode_setup ? "delegate" : "fail",
1480	ctrl->bRequestType, ctrl->bRequest,
1481	w_value, le16_to_cpu(ctrl->wIndex), w_length);
1482
1483	/* if there's an ep0 reader, don't stall */
1484	if (dev->usermode_setup) {
1485	dev->setup_can_stall = 1;
1486	delegate:
1487	dev->setup_in = (ctrl->bRequestType & USB_DIR_IN)
1488	? 1 : 0;
1489	dev->setup_wLength = w_length;
1490	dev->setup_out_ready = 0;
1491	dev->setup_out_error = 0;
1492
1493	/* read DATA stage for OUT right away */
1494	if (unlikely (!dev->setup_in && w_length)) {
1495	value = setup_req (ep: gadget->ep0, req: dev->req,
1496	len: w_length);
1497	if (value < 0)
1498	break;
1499
1500	++dev->udc_usage;
1501	spin_unlock (lock: &dev->lock);
1502	value = usb_ep_queue (ep: gadget->ep0, req: dev->req,
1503	GFP_KERNEL);
1504	spin_lock (lock: &dev->lock);
1505	--dev->udc_usage;
1506	if (value < 0) {
1507	clean_req (ep: gadget->ep0, req: dev->req);
1508	break;
1509	}
1510
1511	/* we can't currently stall these */
1512	dev->setup_can_stall = 0;
1513	}
1514
1515	/* state changes when reader collects event */
1516	event = next_event (dev, type: GADGETFS_SETUP);
1517	event->u.setup = *ctrl;
1518	ep0_readable (dev);
1519	spin_unlock (lock: &dev->lock);
1520	/*
1521	* Return USB_GADGET_DELAYED_STATUS as a workaround to
1522	* stop some UDC drivers (e.g. dwc3) from automatically
1523	* proceeding with the status stage for 0-length
1524	* transfers.
1525	* Should be removed once all UDC drivers are fixed to
1526	* always delay the status stage until a response is
1527	* queued to EP0.
1528	*/
1529	return w_length == 0 ? USB_GADGET_DELAYED_STATUS : 0;
1530	}
1531	}
1532
1533	/* proceed with data transfer and status phases? */
1534	if (value >= 0 && dev->state != STATE_DEV_SETUP) {
1535	req->length = value;
1536	req->zero = value < w_length;
1537
1538	++dev->udc_usage;
1539	spin_unlock (lock: &dev->lock);
1540	value = usb_ep_queue (ep: gadget->ep0, req, GFP_KERNEL);
1541	spin_lock(lock: &dev->lock);
1542	--dev->udc_usage;
1543	spin_unlock(lock: &dev->lock);
1544	if (value < 0) {
1545	DBG (dev, "ep_queue --> %d\n", value);
1546	req->status = 0;
1547	}
1548	return value;
1549	}
1550
1551	/* device stalls when value < 0 */
1552	spin_unlock (lock: &dev->lock);
1553	return value;
1554	}
1555
1556	static void destroy_ep_files (struct dev_data *dev)
1557	{
1558	DBG (dev, "%s %d\n", __func__, dev->state);
1559
1560	/* dev->state must prevent interference */
1561	spin_lock_irq (lock: &dev->lock);
1562	while (!list_empty(head: &dev->epfiles)) {
1563	struct ep_data *ep;
1564	struct inode *parent;
1565	struct dentry *dentry;
1566
1567	/* break link to FS */
1568	ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles);
1569	list_del_init (entry: &ep->epfiles);
1570	spin_unlock_irq (lock: &dev->lock);
1571
1572	dentry = ep->dentry;
1573	ep->dentry = NULL;
1574	parent = d_inode(dentry: dentry->d_parent);
1575
1576	/* break link to controller */
1577	mutex_lock(&ep->lock);
1578	if (ep->state == STATE_EP_ENABLED)
1579	(void) usb_ep_disable (ep: ep->ep);
1580	ep->state = STATE_EP_UNBOUND;
1581	usb_ep_free_request (ep: ep->ep, req: ep->req);
1582	ep->ep = NULL;
1583	mutex_unlock(lock: &ep->lock);
1584
1585	wake_up (&ep->wait);
1586	put_ep (data: ep);
1587
1588	/* break link to dcache */
1589	inode_lock(inode: parent);
1590	d_delete (dentry);
1591	dput (dentry);
1592	inode_unlock(inode: parent);
1593
1594	spin_lock_irq (lock: &dev->lock);
1595	}
1596	spin_unlock_irq (lock: &dev->lock);
1597	}
1598
1599
1600	static struct dentry *
1601	gadgetfs_create_file (struct super_block *sb, char const *name,
1602	void *data, const struct file_operations *fops);
1603
1604	static int activate_ep_files (struct dev_data *dev)
1605	{
1606	struct usb_ep *ep;
1607	struct ep_data *data;
1608
1609	gadget_for_each_ep (ep, dev->gadget) {
1610
1611	data = kzalloc(size: sizeof(*data), GFP_KERNEL);
1612	if (!data)
1613	goto enomem0;
1614	data->state = STATE_EP_DISABLED;
1615	mutex_init(&data->lock);
1616	init_waitqueue_head (&data->wait);
1617
1618	strncpy (p: data->name, q: ep->name, size: sizeof (data->name) - 1);
1619	refcount_set (r: &data->count, n: 1);
1620	data->dev = dev;
1621	get_dev (data: dev);
1622
1623	data->ep = ep;
1624	ep->driver_data = data;
1625
1626	data->req = usb_ep_alloc_request (ep, GFP_KERNEL);
1627	if (!data->req)
1628	goto enomem1;
1629
1630	data->dentry = gadgetfs_create_file (sb: dev->sb, name: data->name,
1631	data, fops: &ep_io_operations);
1632	if (!data->dentry)
1633	goto enomem2;
1634	list_add_tail (new: &data->epfiles, head: &dev->epfiles);
1635	}
1636	return 0;
1637
1638	enomem2:
1639	usb_ep_free_request (ep, req: data->req);
1640	enomem1:
1641	put_dev (data: dev);
1642	kfree (objp: data);
1643	enomem0:
1644	DBG (dev, "%s enomem\n", __func__);
1645	destroy_ep_files (dev);
1646	return -ENOMEM;
1647	}
1648
1649	static void
1650	gadgetfs_unbind (struct usb_gadget *gadget)
1651	{
1652	struct dev_data *dev = get_gadget_data (gadget);
1653
1654	DBG (dev, "%s\n", __func__);
1655
1656	spin_lock_irq (lock: &dev->lock);
1657	dev->state = STATE_DEV_UNBOUND;
1658	while (dev->udc_usage > 0) {
1659	spin_unlock_irq(lock: &dev->lock);
1660	usleep_range(min: 1000, max: 2000);
1661	spin_lock_irq(lock: &dev->lock);
1662	}
1663	spin_unlock_irq (lock: &dev->lock);
1664
1665	destroy_ep_files (dev);
1666	gadget->ep0->driver_data = NULL;
1667	set_gadget_data (gadget, NULL);
1668
1669	/* we've already been disconnected ... no i/o is active */
1670	if (dev->req)
1671	usb_ep_free_request (ep: gadget->ep0, req: dev->req);
1672	DBG (dev, "%s done\n", __func__);
1673	put_dev (data: dev);
1674	}
1675
1676	static struct dev_data *the_device;
1677
1678	static int gadgetfs_bind(struct usb_gadget *gadget,
1679	struct usb_gadget_driver *driver)
1680	{
1681	struct dev_data *dev = the_device;
1682
1683	if (!dev)
1684	return -ESRCH;
1685	if (0 != strcmp (CHIP, gadget->name)) {
1686	pr_err("%s expected %s controller not %s\n",
1687	shortname, CHIP, gadget->name);
1688	return -ENODEV;
1689	}
1690
1691	set_gadget_data (gadget, data: dev);
1692	dev->gadget = gadget;
1693	gadget->ep0->driver_data = dev;
1694
1695	/* preallocate control response and buffer */
1696	dev->req = usb_ep_alloc_request (ep: gadget->ep0, GFP_KERNEL);
1697	if (!dev->req)
1698	goto enomem;
1699	dev->req->context = NULL;
1700	dev->req->complete = epio_complete;
1701
1702	if (activate_ep_files (dev) < 0)
1703	goto enomem;
1704
1705	INFO (dev, "bound to %s driver\n", gadget->name);
1706	spin_lock_irq(lock: &dev->lock);
1707	dev->state = STATE_DEV_UNCONNECTED;
1708	spin_unlock_irq(lock: &dev->lock);
1709	get_dev (data: dev);
1710	return 0;
1711
1712	enomem:
1713	gadgetfs_unbind (gadget);
1714	return -ENOMEM;
1715	}
1716
1717	static void
1718	gadgetfs_disconnect (struct usb_gadget *gadget)
1719	{
1720	struct dev_data *dev = get_gadget_data (gadget);
1721	unsigned long flags;
1722
1723	spin_lock_irqsave (&dev->lock, flags);
1724	if (dev->state == STATE_DEV_UNCONNECTED)
1725	goto exit;
1726	dev->state = STATE_DEV_UNCONNECTED;
1727
1728	INFO (dev, "disconnected\n");
1729	next_event (dev, type: GADGETFS_DISCONNECT);
1730	ep0_readable (dev);
1731	exit:
1732	spin_unlock_irqrestore (lock: &dev->lock, flags);
1733	}
1734
1735	static void
1736	gadgetfs_suspend (struct usb_gadget *gadget)
1737	{
1738	struct dev_data *dev = get_gadget_data (gadget);
1739	unsigned long flags;
1740
1741	INFO (dev, "suspended from state %d\n", dev->state);
1742	spin_lock_irqsave(&dev->lock, flags);
1743	switch (dev->state) {
1744	case STATE_DEV_SETUP: // VERY odd... host died??
1745	case STATE_DEV_CONNECTED:
1746	case STATE_DEV_UNCONNECTED:
1747	next_event (dev, type: GADGETFS_SUSPEND);
1748	ep0_readable (dev);
1749	fallthrough;
1750	default:
1751	break;
1752	}
1753	spin_unlock_irqrestore(lock: &dev->lock, flags);
1754	}
1755
1756	static struct usb_gadget_driver gadgetfs_driver = {
1757	.function = (char *) driver_desc,
1758	.bind = gadgetfs_bind,
1759	.unbind = gadgetfs_unbind,
1760	.setup = gadgetfs_setup,
1761	.reset = gadgetfs_disconnect,
1762	.disconnect = gadgetfs_disconnect,
1763	.suspend = gadgetfs_suspend,
1764
1765	.driver = {
1766	.name = shortname,
1767	},
1768	};
1769
1770	/*----------------------------------------------------------------------*/
1771	/* DEVICE INITIALIZATION
1772	*
1773	* fd = open ("/dev/gadget/$CHIP", O_RDWR)
1774	* status = write (fd, descriptors, sizeof descriptors)
1775	*
1776	* That write establishes the device configuration, so the kernel can
1777	* bind to the controller ... guaranteeing it can handle enumeration
1778	* at all necessary speeds. Descriptor order is:
1779	*
1780	* . message tag (u32, host order) ... for now, must be zero; it
1781	* would change to support features like multi-config devices
1782	* . full/low speed config ... all wTotalLength bytes (with interface,
1783	* class, altsetting, endpoint, and other descriptors)
1784	* . high speed config ... all descriptors, for high speed operation;
1785	* this one's optional except for high-speed hardware
1786	* . device descriptor
1787	*
1788	* Endpoints are not yet enabled. Drivers must wait until device
1789	* configuration and interface altsetting changes create
1790	* the need to configure (or unconfigure) them.
1791	*
1792	* After initialization, the device stays active for as long as that
1793	* $CHIP file is open. Events must then be read from that descriptor,
1794	* such as configuration notifications.
1795	*/
1796
1797	static int is_valid_config(struct usb_config_descriptor *config,
1798	unsigned int total)
1799	{
1800	return config->bDescriptorType == USB_DT_CONFIG
1801	&& config->bLength == USB_DT_CONFIG_SIZE
1802	&& total >= USB_DT_CONFIG_SIZE
1803	&& config->bConfigurationValue != 0
1804	&& (config->bmAttributes & USB_CONFIG_ATT_ONE) != 0
1805	&& (config->bmAttributes & USB_CONFIG_ATT_WAKEUP) == 0;
1806	/* FIXME if gadget->is_otg, _must_ include an otg descriptor */
1807	/* FIXME check lengths: walk to end */
1808	}
1809
1810	static ssize_t
1811	dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
1812	{
1813	struct dev_data *dev = fd->private_data;
1814	ssize_t value, length = len;
1815	unsigned total;
1816	u32 tag;
1817	char *kbuf;
1818
1819	spin_lock_irq(lock: &dev->lock);
1820	if (dev->state > STATE_DEV_OPENED) {
1821	value = ep0_write(fd, buf, len, ptr);
1822	spin_unlock_irq(lock: &dev->lock);
1823	return value;
1824	}
1825	spin_unlock_irq(lock: &dev->lock);
1826
1827	if ((len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4)) ||
1828	(len > PAGE_SIZE * 4))
1829	return -EINVAL;
1830
1831	/* we might need to change message format someday */
1832	if (copy_from_user (to: &tag, from: buf, n: 4))
1833	return -EFAULT;
1834	if (tag != 0)
1835	return -EINVAL;
1836	buf += 4;
1837	length -= 4;
1838
1839	kbuf = memdup_user(buf, length);
1840	if (IS_ERR(ptr: kbuf))
1841	return PTR_ERR(ptr: kbuf);
1842
1843	spin_lock_irq (lock: &dev->lock);
1844	value = -EINVAL;
1845	if (dev->buf) {
1846	spin_unlock_irq(lock: &dev->lock);
1847	kfree(objp: kbuf);
1848	return value;
1849	}
1850	dev->buf = kbuf;
1851
1852	/* full or low speed config */
1853	dev->config = (void *) kbuf;
1854	total = le16_to_cpu(dev->config->wTotalLength);
1855	if (!is_valid_config(config: dev->config, total) ||
1856	total > length - USB_DT_DEVICE_SIZE)
1857	goto fail;
1858	kbuf += total;
1859	length -= total;
1860
1861	/* optional high speed config */
1862	if (kbuf [1] == USB_DT_CONFIG) {
1863	dev->hs_config = (void *) kbuf;
1864	total = le16_to_cpu(dev->hs_config->wTotalLength);
1865	if (!is_valid_config(config: dev->hs_config, total) ||
1866	total > length - USB_DT_DEVICE_SIZE)
1867	goto fail;
1868	kbuf += total;
1869	length -= total;
1870	} else {
1871	dev->hs_config = NULL;
1872	}
1873
1874	/* could support multiple configs, using another encoding! */
1875
1876	/* device descriptor (tweaked for paranoia) */
1877	if (length != USB_DT_DEVICE_SIZE)
1878	goto fail;
1879	dev->dev = (void *)kbuf;
1880	if (dev->dev->bLength != USB_DT_DEVICE_SIZE
1881	|| dev->dev->bDescriptorType != USB_DT_DEVICE
1882	|| dev->dev->bNumConfigurations != 1)
1883	goto fail;
1884	dev->dev->bcdUSB = cpu_to_le16 (0x0200);
1885
1886	/* triggers gadgetfs_bind(); then we can enumerate. */
1887	spin_unlock_irq (lock: &dev->lock);
1888	if (dev->hs_config)
1889	gadgetfs_driver.max_speed = USB_SPEED_HIGH;
1890	else
1891	gadgetfs_driver.max_speed = USB_SPEED_FULL;
1892
1893	value = usb_gadget_register_driver(&gadgetfs_driver);
1894	if (value != 0) {
1895	spin_lock_irq(lock: &dev->lock);
1896	goto fail;
1897	} else {
1898	/* at this point "good" hardware has for the first time
1899	* let the USB the host see us. alternatively, if users
1900	* unplug/replug that will clear all the error state.
1901	*
1902	* note: everything running before here was guaranteed
1903	* to choke driver model style diagnostics. from here
1904	* on, they can work ... except in cleanup paths that
1905	* kick in after the ep0 descriptor is closed.
1906	*/
1907	value = len;
1908	dev->gadget_registered = true;
1909	}
1910	return value;
1911
1912	fail:
1913	dev->config = NULL;
1914	dev->hs_config = NULL;
1915	dev->dev = NULL;
1916	spin_unlock_irq (lock: &dev->lock);
1917	pr_debug ("%s: %s fail %zd, %p\n", shortname, __func__, value, dev);
1918	kfree (objp: dev->buf);
1919	dev->buf = NULL;
1920	return value;
1921	}
1922
1923	static int
1924	gadget_dev_open (struct inode *inode, struct file *fd)
1925	{
1926	struct dev_data *dev = inode->i_private;
1927	int value = -EBUSY;
1928
1929	spin_lock_irq(lock: &dev->lock);
1930	if (dev->state == STATE_DEV_DISABLED) {
1931	dev->ev_next = 0;
1932	dev->state = STATE_DEV_OPENED;
1933	fd->private_data = dev;
1934	get_dev (data: dev);
1935	value = 0;
1936	}
1937	spin_unlock_irq(lock: &dev->lock);
1938	return value;
1939	}
1940
1941	static const struct file_operations ep0_operations = {
1942	.llseek = no_llseek,
1943
1944	.open = gadget_dev_open,
1945	.read = ep0_read,
1946	.write = dev_config,
1947	.fasync = ep0_fasync,
1948	.poll = ep0_poll,
1949	.unlocked_ioctl = gadget_dev_ioctl,
1950	.release = dev_release,
1951	};
1952
1953	/*----------------------------------------------------------------------*/
1954
1955	/* FILESYSTEM AND SUPERBLOCK OPERATIONS
1956	*
1957	* Mounting the filesystem creates a controller file, used first for
1958	* device configuration then later for event monitoring.
1959	*/
1960
1961
1962	/* FIXME PAM etc could set this security policy without mount options
1963	* if epfiles inherited ownership and permissons from ep0 ...
1964	*/
1965
1966	static unsigned default_uid;
1967	static unsigned default_gid;
1968	static unsigned default_perm = S_IRUSR | S_IWUSR;
1969
1970	module_param (default_uid, uint, 0644);
1971	module_param (default_gid, uint, 0644);
1972	module_param (default_perm, uint, 0644);
1973
1974
1975	static struct inode *
1976	gadgetfs_make_inode (struct super_block *sb,
1977	void *data, const struct file_operations *fops,
1978	int mode)
1979	{
1980	struct inode *inode = new_inode (sb);
1981
1982	if (inode) {
1983	inode->i_ino = get_next_ino();
1984	inode->i_mode = mode;
1985	inode->i_uid = make_kuid(from: &init_user_ns, uid: default_uid);
1986	inode->i_gid = make_kgid(from: &init_user_ns, gid: default_gid);
1987	simple_inode_init_ts(inode);
1988	inode->i_private = data;
1989	inode->i_fop = fops;
1990	}
1991	return inode;
1992	}
1993
1994	/* creates in fs root directory, so non-renamable and non-linkable.
1995	* so inode and dentry are paired, until device reconfig.
1996	*/
1997	static struct dentry *
1998	gadgetfs_create_file (struct super_block *sb, char const *name,
1999	void *data, const struct file_operations *fops)
2000	{
2001	struct dentry *dentry;
2002	struct inode *inode;
2003
2004	dentry = d_alloc_name(sb->s_root, name);
2005	if (!dentry)
2006	return NULL;
2007
2008	inode = gadgetfs_make_inode (sb, data, fops,
2009	S_IFREG | (default_perm & S_IRWXUGO));
2010	if (!inode) {
2011	dput(dentry);
2012	return NULL;
2013	}
2014	d_add (dentry, inode);
2015	return dentry;
2016	}
2017
2018	static const struct super_operations gadget_fs_operations = {
2019	.statfs = simple_statfs,
2020	.drop_inode = generic_delete_inode,
2021	};
2022
2023	static int
2024	gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc)
2025	{
2026	struct inode *inode;
2027	struct dev_data *dev;
2028	int rc;
2029
2030	mutex_lock(&sb_mutex);
2031
2032	if (the_device) {
2033	rc = -ESRCH;
2034	goto Done;
2035	}
2036
2037	CHIP = usb_get_gadget_udc_name();
2038	if (!CHIP) {
2039	rc = -ENODEV;
2040	goto Done;
2041	}
2042
2043	/* superblock */
2044	sb->s_blocksize = PAGE_SIZE;
2045	sb->s_blocksize_bits = PAGE_SHIFT;
2046	sb->s_magic = GADGETFS_MAGIC;
2047	sb->s_op = &gadget_fs_operations;
2048	sb->s_time_gran = 1;
2049
2050	/* root inode */
2051	inode = gadgetfs_make_inode (sb,
2052	NULL, fops: &simple_dir_operations,
2053	S_IFDIR | S_IRUGO | S_IXUGO);
2054	if (!inode)
2055	goto Enomem;
2056	inode->i_op = &simple_dir_inode_operations;
2057	if (!(sb->s_root = d_make_root (inode)))
2058	goto Enomem;
2059
2060	/* the ep0 file is named after the controller we expect;
2061	* user mode code can use it for sanity checks, like we do.
2062	*/
2063	dev = dev_new ();
2064	if (!dev)
2065	goto Enomem;
2066
2067	dev->sb = sb;
2068	dev->dentry = gadgetfs_create_file(sb, name: CHIP, data: dev, fops: &ep0_operations);
2069	if (!dev->dentry) {
2070	put_dev(data: dev);
2071	goto Enomem;
2072	}
2073
2074	/* other endpoint files are available after hardware setup,
2075	* from binding to a controller.
2076	*/
2077	the_device = dev;
2078	rc = 0;
2079	goto Done;
2080
2081	Enomem:
2082	kfree(objp: CHIP);
2083	CHIP = NULL;
2084	rc = -ENOMEM;
2085
2086	Done:
2087	mutex_unlock(lock: &sb_mutex);
2088	return rc;
2089	}
2090
2091	/* "mount -t gadgetfs path /dev/gadget" ends up here */
2092	static int gadgetfs_get_tree(struct fs_context *fc)
2093	{
2094	return get_tree_single(fc, fill_super: gadgetfs_fill_super);
2095	}
2096
2097	static const struct fs_context_operations gadgetfs_context_ops = {
2098	.get_tree = gadgetfs_get_tree,
2099	};
2100
2101	static int gadgetfs_init_fs_context(struct fs_context *fc)
2102	{
2103	fc->ops = &gadgetfs_context_ops;
2104	return 0;
2105	}
2106
2107	static void
2108	gadgetfs_kill_sb (struct super_block *sb)
2109	{
2110	mutex_lock(&sb_mutex);
2111	kill_litter_super (sb);
2112	if (the_device) {
2113	put_dev (data: the_device);
2114	the_device = NULL;
2115	}
2116	kfree(objp: CHIP);
2117	CHIP = NULL;
2118	mutex_unlock(lock: &sb_mutex);
2119	}
2120
2121	/*----------------------------------------------------------------------*/
2122
2123	static struct file_system_type gadgetfs_type = {
2124	.owner = THIS_MODULE,
2125	.name = shortname,
2126	.init_fs_context = gadgetfs_init_fs_context,
2127	.kill_sb = gadgetfs_kill_sb,
2128	};
2129	MODULE_ALIAS_FS("gadgetfs");
2130
2131	/*----------------------------------------------------------------------*/
2132
2133	static int __init gadgetfs_init (void)
2134	{
2135	int status;
2136
2137	status = register_filesystem (&gadgetfs_type);
2138	if (status == 0)
2139	pr_info ("%s: %s, version " DRIVER_VERSION "\n",
2140	shortname, driver_desc);
2141	return status;
2142	}
2143	module_init (gadgetfs_init);
2144
2145	static void __exit gadgetfs_cleanup (void)
2146	{
2147	pr_debug ("unregister %s\n", shortname);
2148	unregister_filesystem (&gadgetfs_type);
2149	}
2150	module_exit (gadgetfs_cleanup);
2151
2152