drivers/usb/gadget/legacy/raw_gadget.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * USB Raw Gadget driver.
   4  * See Documentation/usb/raw-gadget.rst for more details.
   5  *
   6  * Andrey Konovalov <andreyknvl@gmail.com>
   7  */
   8
   9 #include <linux/compiler.h>
  10 #include <linux/ctype.h>
  11 #include <linux/debugfs.h>
  12 #include <linux/delay.h>
  13 #include <linux/idr.h>
  14 #include <linux/kref.h>
  15 #include <linux/miscdevice.h>
  16 #include <linux/module.h>
  17 #include <linux/semaphore.h>
  18 #include <linux/sched.h>
  19 #include <linux/slab.h>
  20 #include <linux/uaccess.h>
  21 #include <linux/wait.h>
  22
  23 #include <linux/usb.h>
  24 #include <linux/usb/ch9.h>
  25 #include <linux/usb/ch11.h>
  26 #include <linux/usb/gadget.h>
  27
  28 #include <uapi/linux/usb/raw_gadget.h>
  29
  30 #define DRIVER_DESC "USB Raw Gadget"
  31 #define DRIVER_NAME "raw-gadget"
  32
  33 MODULE_DESCRIPTION(DRIVER_DESC);
  34 MODULE_AUTHOR("Andrey Konovalov");
  35 MODULE_LICENSE("GPL");
  36
  37 /*----------------------------------------------------------------------*/
  38
  39 static DEFINE_IDA(driver_id_numbers);
  40 #define DRIVER_DRIVER_NAME_LENGTH_MAX   32
  41
  42 #define RAW_EVENT_QUEUE_SIZE    16
  43
  44 struct raw_event_queue {
  45         /* See the comment in raw_event_queue_fetch() for locking details. */
  46         spinlock_t              lock;
  47         struct semaphore        sema;
  48         struct usb_raw_event    *events[RAW_EVENT_QUEUE_SIZE];
  49         int                     size;
  50 };
  51
  52 static void raw_event_queue_init(struct raw_event_queue *queue)
  53 {
  54         spin_lock_init(&queue->lock);
  55         sema_init(&queue->sema, 0);
  56         queue->size = 0;
  57 }
  58
  59 static int raw_event_queue_add(struct raw_event_queue *queue,
  60         enum usb_raw_event_type type, size_t length, const void *data)
  61 {
  62         unsigned long flags;
  63         struct usb_raw_event *event;
  64
  65         spin_lock_irqsave(&queue->lock, flags);
  66         if (WARN_ON(queue->size >= RAW_EVENT_QUEUE_SIZE)) {
  67                 spin_unlock_irqrestore(&queue->lock, flags);
  68                 return -ENOMEM;
  69         }
  70         event = kmalloc(sizeof(*event) + length, GFP_ATOMIC);
  71         if (!event) {
  72                 spin_unlock_irqrestore(&queue->lock, flags);
  73                 return -ENOMEM;
  74         }
  75         event->type = type;
  76         event->length = length;
  77         if (event->length)
  78                 memcpy(&event->data[0], data, length);
  79         queue->events[queue->size] = event;
  80         queue->size++;
  81         up(&queue->sema);
  82         spin_unlock_irqrestore(&queue->lock, flags);
  83         return 0;
  84 }
  85
  86 static struct usb_raw_event *raw_event_queue_fetch(
  87                                 struct raw_event_queue *queue)
  88 {
  89         int ret;
  90         unsigned long flags;
  91         struct usb_raw_event *event;
  92
  93         /*
  94          * This function can be called concurrently. We first check that
  95          * there's at least one event queued by decrementing the semaphore,
  96          * and then take the lock to protect queue struct fields.
  97          */
  98         ret = down_interruptible(&queue->sema);
  99         if (ret)
 100                 return ERR_PTR(ret);
 101         spin_lock_irqsave(&queue->lock, flags);
 102         /*
 103          * queue->size must have the same value as queue->sema counter (before
 104          * the down_interruptible() call above), so this check is a fail-safe.
 105          */
 106         if (WARN_ON(!queue->size)) {
 107                 spin_unlock_irqrestore(&queue->lock, flags);
 108                 return ERR_PTR(-ENODEV);
 109         }
 110         event = queue->events[0];
 111         queue->size--;
 112         memmove(&queue->events[0], &queue->events[1],
 113                         queue->size * sizeof(queue->events[0]));
 114         spin_unlock_irqrestore(&queue->lock, flags);
 115         return event;
 116 }
 117
 118 static void raw_event_queue_destroy(struct raw_event_queue *queue)
 119 {
 120         int i;
 121
 122         for (i = 0; i < queue->size; i++)
 123                 kfree(queue->events[i]);
 124         queue->size = 0;
 125 }
 126
 127 /*----------------------------------------------------------------------*/
 128
 129 struct raw_dev;
 130
 131 enum ep_state {
 132         STATE_EP_DISABLED,
 133         STATE_EP_ENABLED,
 134 };
 135
 136 struct raw_ep {
 137         struct raw_dev          *dev;
 138         enum ep_state           state;
 139         struct usb_ep           *ep;
 140         u8                      addr;
 141         struct usb_request      *req;
 142         bool                    urb_queued;
 143         bool                    disabling;
 144         ssize_t                 status;
 145 };
 146
 147 enum dev_state {
 148         STATE_DEV_INVALID = 0,
 149         STATE_DEV_OPENED,
 150         STATE_DEV_INITIALIZED,
 151         STATE_DEV_REGISTERING,
 152         STATE_DEV_RUNNING,
 153         STATE_DEV_CLOSED,
 154         STATE_DEV_FAILED
 155 };
 156
 157 struct raw_dev {
 158         struct kref                     count;
 159         spinlock_t                      lock;
 160
 161         const char                      *udc_name;
 162         struct usb_gadget_driver        driver;
 163
 164         /* Reference to misc device: */
 165         struct device                   *dev;
 166
 167         /* Make driver names unique */
 168         int                             driver_id_number;
 169
 170         /* Protected by lock: */
 171         enum dev_state                  state;
 172         bool                            gadget_registered;
 173         struct usb_gadget               *gadget;
 174         struct usb_request              *req;
 175         bool                            ep0_in_pending;
 176         bool                            ep0_out_pending;
 177         bool                            ep0_urb_queued;
 178         ssize_t                         ep0_status;
 179         struct raw_ep                   eps[USB_RAW_EPS_NUM_MAX];
 180         int                             eps_num;
 181
 182         struct completion               ep0_done;
 183         struct raw_event_queue          queue;
 184 };
 185
 186 static struct raw_dev *dev_new(void)
 187 {
 188         struct raw_dev *dev;
 189
 190         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
 191         if (!dev)
 192                 return NULL;
 193         /* Matches kref_put() in raw_release(). */
 194         kref_init(&dev->count);
 195         spin_lock_init(&dev->lock);
 196         init_completion(&dev->ep0_done);
 197         raw_event_queue_init(&dev->queue);
 198         dev->driver_id_number = -1;
 199         return dev;
 200 }
 201
 202 static void dev_free(struct kref *kref)
 203 {
 204         struct raw_dev *dev = container_of(kref, struct raw_dev, count);
 205         int i;
 206
 207         kfree(dev->udc_name);
 208         kfree(dev->driver.udc_name);
 209         kfree(dev->driver.driver.name);
 210         if (dev->driver_id_number >= 0)
 211                 ida_free(&driver_id_numbers, dev->driver_id_number);
 212         if (dev->req) {
 213                 if (dev->ep0_urb_queued)
 214                         usb_ep_dequeue(dev->gadget->ep0, dev->req);
 215                 usb_ep_free_request(dev->gadget->ep0, dev->req);
 216         }
 217         raw_event_queue_destroy(&dev->queue);
 218         for (i = 0; i < dev->eps_num; i++) {
 219                 if (dev->eps[i].state == STATE_EP_DISABLED)
 220                         continue;
 221                 usb_ep_disable(dev->eps[i].ep);
 222                 usb_ep_free_request(dev->eps[i].ep, dev->eps[i].req);
 223                 kfree(dev->eps[i].ep->desc);
 224                 dev->eps[i].state = STATE_EP_DISABLED;
 225         }
 226         kfree(dev);
 227 }
 228
 229 /*----------------------------------------------------------------------*/
 230
 231 static int raw_queue_event(struct raw_dev *dev,
 232         enum usb_raw_event_type type, size_t length, const void *data)
 233 {
 234         int ret = 0;
 235         unsigned long flags;
 236
 237         ret = raw_event_queue_add(&dev->queue, type, length, data);
 238         if (ret < 0) {
 239                 spin_lock_irqsave(&dev->lock, flags);
 240                 dev->state = STATE_DEV_FAILED;
 241                 spin_unlock_irqrestore(&dev->lock, flags);
 242         }
 243         return ret;
 244 }
 245
 246 static void gadget_ep0_complete(struct usb_ep *ep, struct usb_request *req)
 247 {
 248         struct raw_dev *dev = req->context;
 249         unsigned long flags;
 250
 251         spin_lock_irqsave(&dev->lock, flags);
 252         if (req->status)
 253                 dev->ep0_status = req->status;
 254         else
 255                 dev->ep0_status = req->actual;
 256         if (dev->ep0_in_pending)
 257                 dev->ep0_in_pending = false;
 258         else
 259                 dev->ep0_out_pending = false;
 260         spin_unlock_irqrestore(&dev->lock, flags);
 261
 262         complete(&dev->ep0_done);
 263 }
 264
 265 static u8 get_ep_addr(const char *name)
 266 {
 267         /* If the endpoint has fixed function (named as e.g. "ep12out-bulk"),
 268          * parse the endpoint address from its name. We deliberately use
 269          * deprecated simple_strtoul() function here, as the number isn't
 270          * followed by '\0' nor '\n'.
 271          */
 272         if (isdigit(name[2]))
 273                 return simple_strtoul(&name[2], NULL, 10);
 274         /* Otherwise the endpoint is configurable (named as e.g. "ep-a"). */
 275         return USB_RAW_EP_ADDR_ANY;
 276 }
 277
 278 static int gadget_bind(struct usb_gadget *gadget,
 279                         struct usb_gadget_driver *driver)
 280 {
 281         int ret = 0, i = 0;
 282         struct raw_dev *dev = container_of(driver, struct raw_dev, driver);
 283         struct usb_request *req;
 284         struct usb_ep *ep;
 285         unsigned long flags;
 286
 287         if (strcmp(gadget->name, dev->udc_name) != 0)
 288                 return -ENODEV;
 289
 290         set_gadget_data(gadget, dev);
 291         req = usb_ep_alloc_request(gadget->ep0, GFP_KERNEL);
 292         if (!req) {
 293                 dev_err(&gadget->dev, "usb_ep_alloc_request failed\n");
 294                 set_gadget_data(gadget, NULL);
 295                 return -ENOMEM;
 296         }
 297
 298         spin_lock_irqsave(&dev->lock, flags);
 299         dev->req = req;
 300         dev->req->context = dev;
 301         dev->req->complete = gadget_ep0_complete;
 302         dev->gadget = gadget;
 303         gadget_for_each_ep(ep, dev->gadget) {
 304                 dev->eps[i].ep = ep;
 305                 dev->eps[i].addr = get_ep_addr(ep->name);
 306                 dev->eps[i].state = STATE_EP_DISABLED;
 307                 i++;
 308         }
 309         dev->eps_num = i;
 310         spin_unlock_irqrestore(&dev->lock, flags);
 311
 312         /* Matches kref_put() in gadget_unbind(). */
 313         kref_get(&dev->count);
 314
 315         ret = raw_queue_event(dev, USB_RAW_EVENT_CONNECT, 0, NULL);
 316         if (ret < 0)
 317                 dev_err(&gadget->dev, "failed to queue event\n");
 318
 319         return ret;
 320 }
 321
 322 static void gadget_unbind(struct usb_gadget *gadget)
 323 {
 324         struct raw_dev *dev = get_gadget_data(gadget);
 325
 326         set_gadget_data(gadget, NULL);
 327         /* Matches kref_get() in gadget_bind(). */
 328         kref_put(&dev->count, dev_free);
 329 }
 330
 331 static int gadget_setup(struct usb_gadget *gadget,
 332                         const struct usb_ctrlrequest *ctrl)
 333 {
 334         int ret = 0;
 335         struct raw_dev *dev = get_gadget_data(gadget);
 336         unsigned long flags;
 337
 338         spin_lock_irqsave(&dev->lock, flags);
 339         if (dev->state != STATE_DEV_RUNNING) {
 340                 dev_err(&gadget->dev, "ignoring, device is not running\n");
 341                 ret = -ENODEV;
 342                 goto out_unlock;
 343         }
 344         if (dev->ep0_in_pending || dev->ep0_out_pending) {
 345                 dev_dbg(&gadget->dev, "stalling, request already pending\n");
 346                 ret = -EBUSY;
 347                 goto out_unlock;
 348         }
 349         if ((ctrl->bRequestType & USB_DIR_IN) && ctrl->wLength)
 350                 dev->ep0_in_pending = true;
 351         else
 352                 dev->ep0_out_pending = true;
 353         spin_unlock_irqrestore(&dev->lock, flags);
 354
 355         ret = raw_queue_event(dev, USB_RAW_EVENT_CONTROL, sizeof(*ctrl), ctrl);
 356         if (ret < 0)
 357                 dev_err(&gadget->dev, "failed to queue event\n");
 358         goto out;
 359
 360 out_unlock:
 361         spin_unlock_irqrestore(&dev->lock, flags);
 362 out:
 363         return ret;
 364 }
 365
 366 /* These are currently unused but present in case UDC driver requires them. */
 367 static void gadget_disconnect(struct usb_gadget *gadget) { }
 368 static void gadget_suspend(struct usb_gadget *gadget) { }
 369 static void gadget_resume(struct usb_gadget *gadget) { }
 370 static void gadget_reset(struct usb_gadget *gadget) { }
 371
 372 /*----------------------------------------------------------------------*/
 373
 374 static struct miscdevice raw_misc_device;
 375
 376 static int raw_open(struct inode *inode, struct file *fd)
 377 {
 378         struct raw_dev *dev;
 379
 380         /* Nonblocking I/O is not supported yet. */
 381         if (fd->f_flags & O_NONBLOCK)
 382                 return -EINVAL;
 383
 384         dev = dev_new();
 385         if (!dev)
 386                 return -ENOMEM;
 387         fd->private_data = dev;
 388         dev->state = STATE_DEV_OPENED;
 389         dev->dev = raw_misc_device.this_device;
 390         return 0;
 391 }
 392
 393 static int raw_release(struct inode *inode, struct file *fd)
 394 {
 395         int ret = 0;
 396         struct raw_dev *dev = fd->private_data;
 397         unsigned long flags;
 398         bool unregister = false;
 399
 400         spin_lock_irqsave(&dev->lock, flags);
 401         dev->state = STATE_DEV_CLOSED;
 402         if (!dev->gadget) {
 403                 spin_unlock_irqrestore(&dev->lock, flags);
 404                 goto out_put;
 405         }
 406         if (dev->gadget_registered)
 407                 unregister = true;
 408         dev->gadget_registered = false;
 409         spin_unlock_irqrestore(&dev->lock, flags);
 410
 411         if (unregister) {
 412                 ret = usb_gadget_unregister_driver(&dev->driver);
 413                 if (ret != 0)
 414                         dev_err(dev->dev,
 415                                 "usb_gadget_unregister_driver() failed with %d\n",
 416                                 ret);
 417                 /* Matches kref_get() in raw_ioctl_run(). */
 418                 kref_put(&dev->count, dev_free);
 419         }
 420
 421 out_put:
 422         /* Matches dev_new() in raw_open(). */
 423         kref_put(&dev->count, dev_free);
 424         return ret;
 425 }
 426
 427 /*----------------------------------------------------------------------*/
 428
 429 static int raw_ioctl_init(struct raw_dev *dev, unsigned long value)
 430 {
 431         int ret = 0;
 432         int driver_id_number;
 433         struct usb_raw_init arg;
 434         char *udc_driver_name;
 435         char *udc_device_name;
 436         char *driver_driver_name;
 437         unsigned long flags;
 438
 439         if (copy_from_user(&arg, (void __user *)value, sizeof(arg)))
 440                 return -EFAULT;
 441
 442         switch (arg.speed) {
 443         case USB_SPEED_UNKNOWN:
 444                 arg.speed = USB_SPEED_HIGH;
 445                 break;
 446         case USB_SPEED_LOW:
 447         case USB_SPEED_FULL:
 448         case USB_SPEED_HIGH:
 449         case USB_SPEED_SUPER:
 450                 break;
 451         default:
 452                 return -EINVAL;
 453         }
 454
 455         driver_id_number = ida_alloc(&driver_id_numbers, GFP_KERNEL);
 456         if (driver_id_number < 0)
 457                 return driver_id_number;
 458
 459         driver_driver_name = kmalloc(DRIVER_DRIVER_NAME_LENGTH_MAX, GFP_KERNEL);
 460         if (!driver_driver_name) {
 461                 ret = -ENOMEM;
 462                 goto out_free_driver_id_number;
 463         }
 464         snprintf(driver_driver_name, DRIVER_DRIVER_NAME_LENGTH_MAX,
 465                                 DRIVER_NAME ".%d", driver_id_number);
 466
 467         udc_driver_name = kmalloc(UDC_NAME_LENGTH_MAX, GFP_KERNEL);
 468         if (!udc_driver_name) {
 469                 ret = -ENOMEM;
 470                 goto out_free_driver_driver_name;
 471         }
 472         ret = strscpy(udc_driver_name, &arg.driver_name[0],
 473                                 UDC_NAME_LENGTH_MAX);
 474         if (ret < 0)
 475                 goto out_free_udc_driver_name;
 476         ret = 0;
 477
 478         udc_device_name = kmalloc(UDC_NAME_LENGTH_MAX, GFP_KERNEL);
 479         if (!udc_device_name) {
 480                 ret = -ENOMEM;
 481                 goto out_free_udc_driver_name;
 482         }
 483         ret = strscpy(udc_device_name, &arg.device_name[0],
 484                                 UDC_NAME_LENGTH_MAX);
 485         if (ret < 0)
 486                 goto out_free_udc_device_name;
 487         ret = 0;
 488
 489         spin_lock_irqsave(&dev->lock, flags);
 490         if (dev->state != STATE_DEV_OPENED) {
 491                 dev_dbg(dev->dev, "fail, device is not opened\n");
 492                 ret = -EINVAL;
 493                 goto out_unlock;
 494         }
 495         dev->udc_name = udc_driver_name;
 496
 497         dev->driver.function = DRIVER_DESC;
 498         dev->driver.max_speed = arg.speed;
 499         dev->driver.setup = gadget_setup;
 500         dev->driver.disconnect = gadget_disconnect;
 501         dev->driver.bind = gadget_bind;
 502         dev->driver.unbind = gadget_unbind;
 503         dev->driver.suspend = gadget_suspend;
 504         dev->driver.resume = gadget_resume;
 505         dev->driver.reset = gadget_reset;
 506         dev->driver.driver.name = driver_driver_name;
 507         dev->driver.udc_name = udc_device_name;
 508         dev->driver.match_existing_only = 1;
 509         dev->driver_id_number = driver_id_number;
 510
 511         dev->state = STATE_DEV_INITIALIZED;
 512         spin_unlock_irqrestore(&dev->lock, flags);
 513         return ret;
 514
 515 out_unlock:
 516         spin_unlock_irqrestore(&dev->lock, flags);
 517 out_free_udc_device_name:
 518         kfree(udc_device_name);
 519 out_free_udc_driver_name:
 520         kfree(udc_driver_name);
 521 out_free_driver_driver_name:
 522         kfree(driver_driver_name);
 523 out_free_driver_id_number:
 524         ida_free(&driver_id_numbers, driver_id_number);
 525         return ret;
 526 }
 527
 528 static int raw_ioctl_run(struct raw_dev *dev, unsigned long value)
 529 {
 530         int ret = 0;
 531         unsigned long flags;
 532
 533         if (value)
 534                 return -EINVAL;
 535
 536         spin_lock_irqsave(&dev->lock, flags);
 537         if (dev->state != STATE_DEV_INITIALIZED) {
 538                 dev_dbg(dev->dev, "fail, device is not initialized\n");
 539                 ret = -EINVAL;
 540                 goto out_unlock;
 541         }
 542         dev->state = STATE_DEV_REGISTERING;
 543         spin_unlock_irqrestore(&dev->lock, flags);
 544
 545         ret = usb_gadget_probe_driver(&dev->driver);
 546
 547         spin_lock_irqsave(&dev->lock, flags);
 548         if (ret) {
 549                 dev_err(dev->dev,
 550                         "fail, usb_gadget_probe_driver returned %d\n", ret);
 551                 dev->state = STATE_DEV_FAILED;
 552                 goto out_unlock;
 553         }
 554         dev->gadget_registered = true;
 555         dev->state = STATE_DEV_RUNNING;
 556         /* Matches kref_put() in raw_release(). */
 557         kref_get(&dev->count);
 558
 559 out_unlock:
 560         spin_unlock_irqrestore(&dev->lock, flags);
 561         return ret;
 562 }
 563
 564 static int raw_ioctl_event_fetch(struct raw_dev *dev, unsigned long value)
 565 {
 566         struct usb_raw_event arg;
 567         unsigned long flags;
 568         struct usb_raw_event *event;
 569         uint32_t length;
 570
 571         if (copy_from_user(&arg, (void __user *)value, sizeof(arg)))
 572                 return -EFAULT;
 573
 574         spin_lock_irqsave(&dev->lock, flags);
 575         if (dev->state != STATE_DEV_RUNNING) {
 576                 dev_dbg(dev->dev, "fail, device is not running\n");
 577                 spin_unlock_irqrestore(&dev->lock, flags);
 578                 return -EINVAL;
 579         }
 580         if (!dev->gadget) {
 581                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 582                 spin_unlock_irqrestore(&dev->lock, flags);
 583                 return -EBUSY;
 584         }
 585         spin_unlock_irqrestore(&dev->lock, flags);
 586
 587         event = raw_event_queue_fetch(&dev->queue);
 588         if (PTR_ERR(event) == -EINTR) {
 589                 dev_dbg(&dev->gadget->dev, "event fetching interrupted\n");
 590                 return -EINTR;
 591         }
 592         if (IS_ERR(event)) {
 593                 dev_err(&dev->gadget->dev, "failed to fetch event\n");
 594                 spin_lock_irqsave(&dev->lock, flags);
 595                 dev->state = STATE_DEV_FAILED;
 596                 spin_unlock_irqrestore(&dev->lock, flags);
 597                 return -ENODEV;
 598         }
 599         length = min(arg.length, event->length);
 600         if (copy_to_user((void __user *)value, event, sizeof(*event) + length)) {
 601                 kfree(event);
 602                 return -EFAULT;
 603         }
 604
 605         kfree(event);
 606         return 0;
 607 }
 608
 609 static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr,
 610                                 bool get_from_user)
 611 {
 612         void *data;
 613
 614         if (copy_from_user(io, ptr, sizeof(*io)))
 615                 return ERR_PTR(-EFAULT);
 616         if (io->ep >= USB_RAW_EPS_NUM_MAX)
 617                 return ERR_PTR(-EINVAL);
 618         if (!usb_raw_io_flags_valid(io->flags))
 619                 return ERR_PTR(-EINVAL);
 620         if (io->length > PAGE_SIZE)
 621                 return ERR_PTR(-EINVAL);
 622         if (get_from_user)
 623                 data = memdup_user(ptr + sizeof(*io), io->length);
 624         else {
 625                 data = kmalloc(io->length, GFP_KERNEL);
 626                 if (!data)
 627                         data = ERR_PTR(-ENOMEM);
 628         }
 629         return data;
 630 }
 631
 632 static int raw_process_ep0_io(struct raw_dev *dev, struct usb_raw_ep_io *io,
 633                                 void *data, bool in)
 634 {
 635         int ret = 0;
 636         unsigned long flags;
 637
 638         spin_lock_irqsave(&dev->lock, flags);
 639         if (dev->state != STATE_DEV_RUNNING) {
 640                 dev_dbg(dev->dev, "fail, device is not running\n");
 641                 ret = -EINVAL;
 642                 goto out_unlock;
 643         }
 644         if (!dev->gadget) {
 645                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 646                 ret = -EBUSY;
 647                 goto out_unlock;
 648         }
 649         if (dev->ep0_urb_queued) {
 650                 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n");
 651                 ret = -EBUSY;
 652                 goto out_unlock;
 653         }
 654         if ((in && !dev->ep0_in_pending) ||
 655                         (!in && !dev->ep0_out_pending)) {
 656                 dev_dbg(&dev->gadget->dev, "fail, wrong direction\n");
 657                 ret = -EBUSY;
 658                 goto out_unlock;
 659         }
 660         if (WARN_ON(in && dev->ep0_out_pending)) {
 661                 ret = -ENODEV;
 662                 dev->state = STATE_DEV_FAILED;
 663                 goto out_done;
 664         }
 665         if (WARN_ON(!in && dev->ep0_in_pending)) {
 666                 ret = -ENODEV;
 667                 dev->state = STATE_DEV_FAILED;
 668                 goto out_done;
 669         }
 670
 671         dev->req->buf = data;
 672         dev->req->length = io->length;
 673         dev->req->zero = usb_raw_io_flags_zero(io->flags);
 674         dev->ep0_urb_queued = true;
 675         spin_unlock_irqrestore(&dev->lock, flags);
 676
 677         ret = usb_ep_queue(dev->gadget->ep0, dev->req, GFP_KERNEL);
 678         if (ret) {
 679                 dev_err(&dev->gadget->dev,
 680                                 "fail, usb_ep_queue returned %d\n", ret);
 681                 spin_lock_irqsave(&dev->lock, flags);
 682                 dev->state = STATE_DEV_FAILED;
 683                 goto out_done;
 684         }
 685
 686         ret = wait_for_completion_interruptible(&dev->ep0_done);
 687         if (ret) {
 688                 dev_dbg(&dev->gadget->dev, "wait interrupted\n");
 689                 usb_ep_dequeue(dev->gadget->ep0, dev->req);
 690                 wait_for_completion(&dev->ep0_done);
 691                 spin_lock_irqsave(&dev->lock, flags);
 692                 goto out_done;
 693         }
 694
 695         spin_lock_irqsave(&dev->lock, flags);
 696         ret = dev->ep0_status;
 697
 698 out_done:
 699         dev->ep0_urb_queued = false;
 700 out_unlock:
 701         spin_unlock_irqrestore(&dev->lock, flags);
 702         return ret;
 703 }
 704
 705 static int raw_ioctl_ep0_write(struct raw_dev *dev, unsigned long value)
 706 {
 707         int ret = 0;
 708         void *data;
 709         struct usb_raw_ep_io io;
 710
 711         data = raw_alloc_io_data(&io, (void __user *)value, true);
 712         if (IS_ERR(data))
 713                 return PTR_ERR(data);
 714         ret = raw_process_ep0_io(dev, &io, data, true);
 715         kfree(data);
 716         return ret;
 717 }
 718
 719 static int raw_ioctl_ep0_read(struct raw_dev *dev, unsigned long value)
 720 {
 721         int ret = 0;
 722         void *data;
 723         struct usb_raw_ep_io io;
 724         unsigned int length;
 725
 726         data = raw_alloc_io_data(&io, (void __user *)value, false);
 727         if (IS_ERR(data))
 728                 return PTR_ERR(data);
 729         ret = raw_process_ep0_io(dev, &io, data, false);
 730         if (ret < 0)
 731                 goto free;
 732
 733         length = min(io.length, (unsigned int)ret);
 734         if (copy_to_user((void __user *)(value + sizeof(io)), data, length))
 735                 ret = -EFAULT;
 736         else
 737                 ret = length;
 738 free:
 739         kfree(data);
 740         return ret;
 741 }
 742
 743 static int raw_ioctl_ep0_stall(struct raw_dev *dev, unsigned long value)
 744 {
 745         int ret = 0;
 746         unsigned long flags;
 747
 748         if (value)
 749                 return -EINVAL;
 750         spin_lock_irqsave(&dev->lock, flags);
 751         if (dev->state != STATE_DEV_RUNNING) {
 752                 dev_dbg(dev->dev, "fail, device is not running\n");
 753                 ret = -EINVAL;
 754                 goto out_unlock;
 755         }
 756         if (!dev->gadget) {
 757                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 758                 ret = -EBUSY;
 759                 goto out_unlock;
 760         }
 761         if (dev->ep0_urb_queued) {
 762                 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n");
 763                 ret = -EBUSY;
 764                 goto out_unlock;
 765         }
 766         if (!dev->ep0_in_pending && !dev->ep0_out_pending) {
 767                 dev_dbg(&dev->gadget->dev, "fail, no request pending\n");
 768                 ret = -EBUSY;
 769                 goto out_unlock;
 770         }
 771
 772         ret = usb_ep_set_halt(dev->gadget->ep0);
 773         if (ret < 0)
 774                 dev_err(&dev->gadget->dev,
 775                                 "fail, usb_ep_set_halt returned %d\n", ret);
 776
 777         if (dev->ep0_in_pending)
 778                 dev->ep0_in_pending = false;
 779         else
 780                 dev->ep0_out_pending = false;
 781
 782 out_unlock:
 783         spin_unlock_irqrestore(&dev->lock, flags);
 784         return ret;
 785 }
 786
 787 static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
 788 {
 789         int ret = 0, i;
 790         unsigned long flags;
 791         struct usb_endpoint_descriptor *desc;
 792         struct raw_ep *ep;
 793
 794         desc = memdup_user((void __user *)value, sizeof(*desc));
 795         if (IS_ERR(desc))
 796                 return PTR_ERR(desc);
 797
 798         /*
 799          * Endpoints with a maxpacket length of 0 can cause crashes in UDC
 800          * drivers.
 801          */
 802         if (usb_endpoint_maxp(desc) == 0) {
 803                 dev_dbg(dev->dev, "fail, bad endpoint maxpacket\n");
 804                 kfree(desc);
 805                 return -EINVAL;
 806         }
 807
 808         spin_lock_irqsave(&dev->lock, flags);
 809         if (dev->state != STATE_DEV_RUNNING) {
 810                 dev_dbg(dev->dev, "fail, device is not running\n");
 811                 ret = -EINVAL;
 812                 goto out_free;
 813         }
 814         if (!dev->gadget) {
 815                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 816                 ret = -EBUSY;
 817                 goto out_free;
 818         }
 819
 820         for (i = 0; i < dev->eps_num; i++) {
 821                 ep = &dev->eps[i];
 822                 if (ep->state != STATE_EP_DISABLED)
 823                         continue;
 824                 if (ep->addr != usb_endpoint_num(desc) &&
 825                                 ep->addr != USB_RAW_EP_ADDR_ANY)
 826                         continue;
 827                 if (!usb_gadget_ep_match_desc(dev->gadget, ep->ep, desc, NULL))
 828                         continue;
 829                 ep->ep->desc = desc;
 830                 ret = usb_ep_enable(ep->ep);
 831                 if (ret < 0) {
 832                         dev_err(&dev->gadget->dev,
 833                                 "fail, usb_ep_enable returned %d\n", ret);
 834                         goto out_free;
 835                 }
 836                 ep->req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC);
 837                 if (!ep->req) {
 838                         dev_err(&dev->gadget->dev,
 839                                 "fail, usb_ep_alloc_request failed\n");
 840                         usb_ep_disable(ep->ep);
 841                         ret = -ENOMEM;
 842                         goto out_free;
 843                 }
 844                 ep->state = STATE_EP_ENABLED;
 845                 ep->ep->driver_data = ep;
 846                 ret = i;
 847                 goto out_unlock;
 848         }
 849
 850         dev_dbg(&dev->gadget->dev, "fail, no gadget endpoints available\n");
 851         ret = -EBUSY;
 852
 853 out_free:
 854         kfree(desc);
 855 out_unlock:
 856         spin_unlock_irqrestore(&dev->lock, flags);
 857         return ret;
 858 }
 859
 860 static int raw_ioctl_ep_disable(struct raw_dev *dev, unsigned long value)
 861 {
 862         int ret = 0, i = value;
 863         unsigned long flags;
 864
 865         spin_lock_irqsave(&dev->lock, flags);
 866         if (dev->state != STATE_DEV_RUNNING) {
 867                 dev_dbg(dev->dev, "fail, device is not running\n");
 868                 ret = -EINVAL;
 869                 goto out_unlock;
 870         }
 871         if (!dev->gadget) {
 872                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 873                 ret = -EBUSY;
 874                 goto out_unlock;
 875         }
 876         if (i < 0 || i >= dev->eps_num) {
 877                 dev_dbg(dev->dev, "fail, invalid endpoint\n");
 878                 ret = -EBUSY;
 879                 goto out_unlock;
 880         }
 881         if (dev->eps[i].state == STATE_EP_DISABLED) {
 882                 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n");
 883                 ret = -EINVAL;
 884                 goto out_unlock;
 885         }
 886         if (dev->eps[i].disabling) {
 887                 dev_dbg(&dev->gadget->dev,
 888                                 "fail, disable already in progress\n");
 889                 ret = -EINVAL;
 890                 goto out_unlock;
 891         }
 892         if (dev->eps[i].urb_queued) {
 893                 dev_dbg(&dev->gadget->dev,
 894                                 "fail, waiting for urb completion\n");
 895                 ret = -EINVAL;
 896                 goto out_unlock;
 897         }
 898         dev->eps[i].disabling = true;
 899         spin_unlock_irqrestore(&dev->lock, flags);
 900
 901         usb_ep_disable(dev->eps[i].ep);
 902
 903         spin_lock_irqsave(&dev->lock, flags);
 904         usb_ep_free_request(dev->eps[i].ep, dev->eps[i].req);
 905         kfree(dev->eps[i].ep->desc);
 906         dev->eps[i].state = STATE_EP_DISABLED;
 907         dev->eps[i].disabling = false;
 908
 909 out_unlock:
 910         spin_unlock_irqrestore(&dev->lock, flags);
 911         return ret;
 912 }
 913
 914 static int raw_ioctl_ep_set_clear_halt_wedge(struct raw_dev *dev,
 915                 unsigned long value, bool set, bool halt)
 916 {
 917         int ret = 0, i = value;
 918         unsigned long flags;
 919
 920         spin_lock_irqsave(&dev->lock, flags);
 921         if (dev->state != STATE_DEV_RUNNING) {
 922                 dev_dbg(dev->dev, "fail, device is not running\n");
 923                 ret = -EINVAL;
 924                 goto out_unlock;
 925         }
 926         if (!dev->gadget) {
 927                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
 928                 ret = -EBUSY;
 929                 goto out_unlock;
 930         }
 931         if (i < 0 || i >= dev->eps_num) {
 932                 dev_dbg(dev->dev, "fail, invalid endpoint\n");
 933                 ret = -EBUSY;
 934                 goto out_unlock;
 935         }
 936         if (dev->eps[i].state == STATE_EP_DISABLED) {
 937                 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n");
 938                 ret = -EINVAL;
 939                 goto out_unlock;
 940         }
 941         if (dev->eps[i].disabling) {
 942                 dev_dbg(&dev->gadget->dev,
 943                                 "fail, disable is in progress\n");
 944                 ret = -EINVAL;
 945                 goto out_unlock;
 946         }
 947         if (dev->eps[i].urb_queued) {
 948                 dev_dbg(&dev->gadget->dev,
 949                                 "fail, waiting for urb completion\n");
 950                 ret = -EINVAL;
 951                 goto out_unlock;
 952         }
 953         if (usb_endpoint_xfer_isoc(dev->eps[i].ep->desc)) {
 954                 dev_dbg(&dev->gadget->dev,
 955                                 "fail, can't halt/wedge ISO endpoint\n");
 956                 ret = -EINVAL;
 957                 goto out_unlock;
 958         }
 959
 960         if (set && halt) {
 961                 ret = usb_ep_set_halt(dev->eps[i].ep);
 962                 if (ret < 0)
 963                         dev_err(&dev->gadget->dev,
 964                                 "fail, usb_ep_set_halt returned %d\n", ret);
 965         } else if (!set && halt) {
 966                 ret = usb_ep_clear_halt(dev->eps[i].ep);
 967                 if (ret < 0)
 968                         dev_err(&dev->gadget->dev,
 969                                 "fail, usb_ep_clear_halt returned %d\n", ret);
 970         } else if (set && !halt) {
 971                 ret = usb_ep_set_wedge(dev->eps[i].ep);
 972                 if (ret < 0)
 973                         dev_err(&dev->gadget->dev,
 974                                 "fail, usb_ep_set_wedge returned %d\n", ret);
 975         }
 976
 977 out_unlock:
 978         spin_unlock_irqrestore(&dev->lock, flags);
 979         return ret;
 980 }
 981
 982 static void gadget_ep_complete(struct usb_ep *ep, struct usb_request *req)
 983 {
 984         struct raw_ep *r_ep = (struct raw_ep *)ep->driver_data;
 985         struct raw_dev *dev = r_ep->dev;
 986         unsigned long flags;
 987
 988         spin_lock_irqsave(&dev->lock, flags);
 989         if (req->status)
 990                 r_ep->status = req->status;
 991         else
 992                 r_ep->status = req->actual;
 993         spin_unlock_irqrestore(&dev->lock, flags);
 994
 995         complete((struct completion *)req->context);
 996 }
 997
 998 static int raw_process_ep_io(struct raw_dev *dev, struct usb_raw_ep_io *io,
 999                                 void *data, bool in)
1000 {
1001         int ret = 0;
1002         unsigned long flags;
1003         struct raw_ep *ep;
1004         DECLARE_COMPLETION_ONSTACK(done);
1005
1006         spin_lock_irqsave(&dev->lock, flags);
1007         if (dev->state != STATE_DEV_RUNNING) {
1008                 dev_dbg(dev->dev, "fail, device is not running\n");
1009                 ret = -EINVAL;
1010                 goto out_unlock;
1011         }
1012         if (!dev->gadget) {
1013                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1014                 ret = -EBUSY;
1015                 goto out_unlock;
1016         }
1017         if (io->ep >= dev->eps_num) {
1018                 dev_dbg(&dev->gadget->dev, "fail, invalid endpoint\n");
1019                 ret = -EINVAL;
1020                 goto out_unlock;
1021         }
1022         ep = &dev->eps[io->ep];
1023         if (ep->state != STATE_EP_ENABLED) {
1024                 dev_dbg(&dev->gadget->dev, "fail, endpoint is not enabled\n");
1025                 ret = -EBUSY;
1026                 goto out_unlock;
1027         }
1028         if (ep->disabling) {
1029                 dev_dbg(&dev->gadget->dev,
1030                                 "fail, endpoint is already being disabled\n");
1031                 ret = -EBUSY;
1032                 goto out_unlock;
1033         }
1034         if (ep->urb_queued) {
1035                 dev_dbg(&dev->gadget->dev, "fail, urb already queued\n");
1036                 ret = -EBUSY;
1037                 goto out_unlock;
1038         }
1039         if (in != usb_endpoint_dir_in(ep->ep->desc)) {
1040                 dev_dbg(&dev->gadget->dev, "fail, wrong direction\n");
1041                 ret = -EINVAL;
1042                 goto out_unlock;
1043         }
1044
1045         ep->dev = dev;
1046         ep->req->context = &done;
1047         ep->req->complete = gadget_ep_complete;
1048         ep->req->buf = data;
1049         ep->req->length = io->length;
1050         ep->req->zero = usb_raw_io_flags_zero(io->flags);
1051         ep->urb_queued = true;
1052         spin_unlock_irqrestore(&dev->lock, flags);
1053
1054         ret = usb_ep_queue(ep->ep, ep->req, GFP_KERNEL);
1055         if (ret) {
1056                 dev_err(&dev->gadget->dev,
1057                                 "fail, usb_ep_queue returned %d\n", ret);
1058                 spin_lock_irqsave(&dev->lock, flags);
1059                 dev->state = STATE_DEV_FAILED;
1060                 goto out_done;
1061         }
1062
1063         ret = wait_for_completion_interruptible(&done);
1064         if (ret) {
1065                 dev_dbg(&dev->gadget->dev, "wait interrupted\n");
1066                 usb_ep_dequeue(ep->ep, ep->req);
1067                 wait_for_completion(&done);
1068                 spin_lock_irqsave(&dev->lock, flags);
1069                 goto out_done;
1070         }
1071
1072         spin_lock_irqsave(&dev->lock, flags);
1073         ret = ep->status;
1074
1075 out_done:
1076         ep->urb_queued = false;
1077 out_unlock:
1078         spin_unlock_irqrestore(&dev->lock, flags);
1079         return ret;
1080 }
1081
1082 static int raw_ioctl_ep_write(struct raw_dev *dev, unsigned long value)
1083 {
1084         int ret = 0;
1085         char *data;
1086         struct usb_raw_ep_io io;
1087
1088         data = raw_alloc_io_data(&io, (void __user *)value, true);
1089         if (IS_ERR(data))
1090                 return PTR_ERR(data);
1091         ret = raw_process_ep_io(dev, &io, data, true);
1092         kfree(data);
1093         return ret;
1094 }
1095
1096 static int raw_ioctl_ep_read(struct raw_dev *dev, unsigned long value)
1097 {
1098         int ret = 0;
1099         char *data;
1100         struct usb_raw_ep_io io;
1101         unsigned int length;
1102
1103         data = raw_alloc_io_data(&io, (void __user *)value, false);
1104         if (IS_ERR(data))
1105                 return PTR_ERR(data);
1106         ret = raw_process_ep_io(dev, &io, data, false);
1107         if (ret < 0)
1108                 goto free;
1109
1110         length = min(io.length, (unsigned int)ret);
1111         if (copy_to_user((void __user *)(value + sizeof(io)), data, length))
1112                 ret = -EFAULT;
1113         else
1114                 ret = length;
1115 free:
1116         kfree(data);
1117         return ret;
1118 }
1119
1120 static int raw_ioctl_configure(struct raw_dev *dev, unsigned long value)
1121 {
1122         int ret = 0;
1123         unsigned long flags;
1124
1125         if (value)
1126                 return -EINVAL;
1127         spin_lock_irqsave(&dev->lock, flags);
1128         if (dev->state != STATE_DEV_RUNNING) {
1129                 dev_dbg(dev->dev, "fail, device is not running\n");
1130                 ret = -EINVAL;
1131                 goto out_unlock;
1132         }
1133         if (!dev->gadget) {
1134                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1135                 ret = -EBUSY;
1136                 goto out_unlock;
1137         }
1138         usb_gadget_set_state(dev->gadget, USB_STATE_CONFIGURED);
1139
1140 out_unlock:
1141         spin_unlock_irqrestore(&dev->lock, flags);
1142         return ret;
1143 }
1144
1145 static int raw_ioctl_vbus_draw(struct raw_dev *dev, unsigned long value)
1146 {
1147         int ret = 0;
1148         unsigned long flags;
1149
1150         spin_lock_irqsave(&dev->lock, flags);
1151         if (dev->state != STATE_DEV_RUNNING) {
1152                 dev_dbg(dev->dev, "fail, device is not running\n");
1153                 ret = -EINVAL;
1154                 goto out_unlock;
1155         }
1156         if (!dev->gadget) {
1157                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1158                 ret = -EBUSY;
1159                 goto out_unlock;
1160         }
1161         usb_gadget_vbus_draw(dev->gadget, 2 * value);
1162
1163 out_unlock:
1164         spin_unlock_irqrestore(&dev->lock, flags);
1165         return ret;
1166 }
1167
1168 static void fill_ep_caps(struct usb_ep_caps *caps,
1169                                 struct usb_raw_ep_caps *raw_caps)
1170 {
1171         raw_caps->type_control = caps->type_control;
1172         raw_caps->type_iso = caps->type_iso;
1173         raw_caps->type_bulk = caps->type_bulk;
1174         raw_caps->type_int = caps->type_int;
1175         raw_caps->dir_in = caps->dir_in;
1176         raw_caps->dir_out = caps->dir_out;
1177 }
1178
1179 static void fill_ep_limits(struct usb_ep *ep, struct usb_raw_ep_limits *limits)
1180 {
1181         limits->maxpacket_limit = ep->maxpacket_limit;
1182         limits->max_streams = ep->max_streams;
1183 }
1184
1185 static int raw_ioctl_eps_info(struct raw_dev *dev, unsigned long value)
1186 {
1187         int ret = 0, i;
1188         unsigned long flags;
1189         struct usb_raw_eps_info *info;
1190         struct raw_ep *ep;
1191
1192         info = kmalloc(sizeof(*info), GFP_KERNEL);
1193         if (!info) {
1194                 ret = -ENOMEM;
1195                 goto out;
1196         }
1197
1198         spin_lock_irqsave(&dev->lock, flags);
1199         if (dev->state != STATE_DEV_RUNNING) {
1200                 dev_dbg(dev->dev, "fail, device is not running\n");
1201                 ret = -EINVAL;
1202                 spin_unlock_irqrestore(&dev->lock, flags);
1203                 goto out_free;
1204         }
1205         if (!dev->gadget) {
1206                 dev_dbg(dev->dev, "fail, gadget is not bound\n");
1207                 ret = -EBUSY;
1208                 spin_unlock_irqrestore(&dev->lock, flags);
1209                 goto out_free;
1210         }
1211
1212         memset(info, 0, sizeof(*info));
1213         for (i = 0; i < dev->eps_num; i++) {
1214                 ep = &dev->eps[i];
1215                 strscpy(&info->eps[i].name[0], ep->ep->name,
1216                                 USB_RAW_EP_NAME_MAX);
1217                 info->eps[i].addr = ep->addr;
1218                 fill_ep_caps(&ep->ep->caps, &info->eps[i].caps);
1219                 fill_ep_limits(ep->ep, &info->eps[i].limits);
1220         }
1221         ret = dev->eps_num;
1222         spin_unlock_irqrestore(&dev->lock, flags);
1223
1224         if (copy_to_user((void __user *)value, info, sizeof(*info)))
1225                 ret = -EFAULT;
1226
1227 out_free:
1228         kfree(info);
1229 out:
1230         return ret;
1231 }
1232
1233 static long raw_ioctl(struct file *fd, unsigned int cmd, unsigned long value)
1234 {
1235         struct raw_dev *dev = fd->private_data;
1236         int ret = 0;
1237
1238         if (!dev)
1239                 return -EBUSY;
1240
1241         switch (cmd) {
1242         case USB_RAW_IOCTL_INIT:
1243                 ret = raw_ioctl_init(dev, value);
1244                 break;
1245         case USB_RAW_IOCTL_RUN:
1246                 ret = raw_ioctl_run(dev, value);
1247                 break;
1248         case USB_RAW_IOCTL_EVENT_FETCH:
1249                 ret = raw_ioctl_event_fetch(dev, value);
1250                 break;
1251         case USB_RAW_IOCTL_EP0_WRITE:
1252                 ret = raw_ioctl_ep0_write(dev, value);
1253                 break;
1254         case USB_RAW_IOCTL_EP0_READ:
1255                 ret = raw_ioctl_ep0_read(dev, value);
1256                 break;
1257         case USB_RAW_IOCTL_EP_ENABLE:
1258                 ret = raw_ioctl_ep_enable(dev, value);
1259                 break;
1260         case USB_RAW_IOCTL_EP_DISABLE:
1261                 ret = raw_ioctl_ep_disable(dev, value);
1262                 break;
1263         case USB_RAW_IOCTL_EP_WRITE:
1264                 ret = raw_ioctl_ep_write(dev, value);
1265                 break;
1266         case USB_RAW_IOCTL_EP_READ:
1267                 ret = raw_ioctl_ep_read(dev, value);
1268                 break;
1269         case USB_RAW_IOCTL_CONFIGURE:
1270                 ret = raw_ioctl_configure(dev, value);
1271                 break;
1272         case USB_RAW_IOCTL_VBUS_DRAW:
1273                 ret = raw_ioctl_vbus_draw(dev, value);
1274                 break;
1275         case USB_RAW_IOCTL_EPS_INFO:
1276                 ret = raw_ioctl_eps_info(dev, value);
1277                 break;
1278         case USB_RAW_IOCTL_EP0_STALL:
1279                 ret = raw_ioctl_ep0_stall(dev, value);
1280                 break;
1281         case USB_RAW_IOCTL_EP_SET_HALT:
1282                 ret = raw_ioctl_ep_set_clear_halt_wedge(
1283                                         dev, value, true, true);
1284                 break;
1285         case USB_RAW_IOCTL_EP_CLEAR_HALT:
1286                 ret = raw_ioctl_ep_set_clear_halt_wedge(
1287                                         dev, value, false, true);
1288                 break;
1289         case USB_RAW_IOCTL_EP_SET_WEDGE:
1290                 ret = raw_ioctl_ep_set_clear_halt_wedge(
1291                                         dev, value, true, false);
1292                 break;
1293         default:
1294                 ret = -EINVAL;
1295         }
1296
1297         return ret;
1298 }
1299
1300 /*----------------------------------------------------------------------*/
1301
1302 static const struct file_operations raw_fops = {
1303         .open =                 raw_open,
1304         .unlocked_ioctl =       raw_ioctl,
1305         .compat_ioctl =         raw_ioctl,
1306         .release =              raw_release,
1307         .llseek =               no_llseek,
1308 };
1309
1310 static struct miscdevice raw_misc_device = {
1311         .minor = MISC_DYNAMIC_MINOR,
1312         .name = DRIVER_NAME,
1313         .fops = &raw_fops,
1314 };
1315
1316 module_misc_device(raw_misc_device);