1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Copyright (C) 2015 Karol Kosik <karo9@interia.eu>
4 * Copyright (C) 2015-2016 Samsung Electronics
5 * Igor Kotrasinski <i.kotrasinsk@samsung.com>
6 *
7 * Based on dummy_hcd.c, which is:
8 * Copyright (C) 2003 David Brownell
9 * Copyright (C) 2003-2005 Alan Stern
10 */
11
12 #include <linux/usb.h>
13 #include <linux/timer.h>
14 #include <linux/usb/ch9.h>
15
16 #include "vudc.h"
17
18 #define DEV_REQUEST (USB_TYPE_STANDARD | USB_RECIP_DEVICE)
19 #define DEV_INREQUEST (DEV_REQUEST | USB_DIR_IN)
20 #define INTF_REQUEST (USB_TYPE_STANDARD | USB_RECIP_INTERFACE)
21 #define INTF_INREQUEST (INTF_REQUEST | USB_DIR_IN)
22 #define EP_REQUEST (USB_TYPE_STANDARD | USB_RECIP_ENDPOINT)
23 #define EP_INREQUEST (EP_REQUEST | USB_DIR_IN)
24
25 static int get_frame_limit(enum usb_device_speed speed)
26 {
27 switch (speed) {
28 case USB_SPEED_LOW:
29 return 8 /*bytes*/ * 12 /*packets*/;
30 case USB_SPEED_FULL:
31 return 64 /*bytes*/ * 19 /*packets*/;
32 case USB_SPEED_HIGH:
33 return 512 /*bytes*/ * 13 /*packets*/ * 8 /*uframes*/;
34 case USB_SPEED_SUPER:
35 /* Bus speed is 500000 bytes/ms, so use a little less */
36 return 490000;
37 default:
38 /* error */
39 return -1;
40 }
41
42 }
43
44 /*
45 * handle_control_request() - handles all control transfers
46 * @udc: pointer to vudc
47 * @urb: the urb request to handle
48 * @setup: pointer to the setup data for a USB device control
49 * request
50 * @status: pointer to request handling status
51 *
52 * Return 0 - if the request was handled
53 * 1 - if the request wasn't handles
54 * error code on error
55 *
56 * Adapted from drivers/usb/gadget/udc/dummy_hcd.c
57 */
58 static int handle_control_request(struct vudc *udc, struct urb *urb,
59 struct usb_ctrlrequest *setup,
60 int *status)
61 {
62 struct vep *ep2;
63 int ret_val = 1;
64 unsigned int w_index;
65 unsigned int w_value;
66
67 w_index = le16_to_cpu(setup->wIndex);
68 w_value = le16_to_cpu(setup->wValue);
69 switch (setup->bRequest) {
70 case USB_REQ_SET_ADDRESS:
71 if (setup->bRequestType != DEV_REQUEST)
72 break;
73 udc->address = w_value;
74 ret_val = 0;
75 *status = 0;
76 break;
77 case USB_REQ_SET_FEATURE:
78 if (setup->bRequestType == DEV_REQUEST) {
79 ret_val = 0;
80 switch (w_value) {
81 case USB_DEVICE_REMOTE_WAKEUP:
82 break;
83 case USB_DEVICE_B_HNP_ENABLE:
84 udc->gadget.b_hnp_enable = 1;
85 break;
86 case USB_DEVICE_A_HNP_SUPPORT:
87 udc->gadget.a_hnp_support = 1;
88 break;
89 case USB_DEVICE_A_ALT_HNP_SUPPORT:
90 udc->gadget.a_alt_hnp_support = 1;
91 break;
92 default:
93 ret_val = -EOPNOTSUPP;
94 }
95 if (ret_val == 0) {
96 udc->devstatus |= (1 << w_value);
97 *status = 0;
98 }
99 } else if (setup->bRequestType == EP_REQUEST) {
100 /* endpoint halt */
101 ep2 = vudc_find_endpoint(udc, w_index);
102 if (!ep2 || ep2->ep.name == udc->ep[0].ep.name) {
103 ret_val = -EOPNOTSUPP;
104 break;
105 }
106 ep2->halted = 1;
107 ret_val = 0;
108 *status = 0;
109 }
110 break;
111 case USB_REQ_CLEAR_FEATURE:
112 if (setup->bRequestType == DEV_REQUEST) {
113 ret_val = 0;
114 switch (w_value) {
115 case USB_DEVICE_REMOTE_WAKEUP:
116 w_value = USB_DEVICE_REMOTE_WAKEUP;
117 break;
118
119 case USB_DEVICE_U1_ENABLE:
120 case USB_DEVICE_U2_ENABLE:
121 case USB_DEVICE_LTM_ENABLE:
122 ret_val = -EOPNOTSUPP;
123 break;
124 default:
125 ret_val = -EOPNOTSUPP;
126 break;
127 }
128 if (ret_val == 0) {
129 udc->devstatus &= ~(1 << w_value);
130 *status = 0;
131 }
132 } else if (setup->bRequestType == EP_REQUEST) {
133 /* endpoint halt */
134 ep2 = vudc_find_endpoint(udc, w_index);
135 if (!ep2) {
136 ret_val = -EOPNOTSUPP;
137 break;
138 }
139 if (!ep2->wedged)
140 ep2->halted = 0;
141 ret_val = 0;
142 *status = 0;
143 }
144 break;
145 case USB_REQ_GET_STATUS:
146 if (setup->bRequestType == DEV_INREQUEST
147 || setup->bRequestType == INTF_INREQUEST
148 || setup->bRequestType == EP_INREQUEST) {
149 char *buf;
150 /*
151 * device: remote wakeup, selfpowered
152 * interface: nothing
153 * endpoint: halt
154 */
155 buf = (char *)urb->transfer_buffer;
156 if (urb->transfer_buffer_length > 0) {
157 if (setup->bRequestType == EP_INREQUEST) {
158 ep2 = vudc_find_endpoint(udc, w_index);
159 if (!ep2) {
160 ret_val = -EOPNOTSUPP;
161 break;
162 }
163 buf[0] = ep2->halted;
164 } else if (setup->bRequestType ==
165 DEV_INREQUEST) {
166 buf[0] = (u8)udc->devstatus;
167 } else
168 buf[0] = 0;
169 }
170 if (urb->transfer_buffer_length > 1)
171 buf[1] = 0;
172 urb->actual_length = min_t(u32, 2,
173 urb->transfer_buffer_length);
174 ret_val = 0;
175 *status = 0;
176 }
177 break;
178 }
179 return ret_val;
180 }
181
182 /* Adapted from dummy_hcd.c ; caller must hold lock */
183 static int transfer(struct vudc *udc,
184 struct urb *urb, struct vep *ep, int limit)
185 {
186 struct vrequest *req;
187 int sent = 0;
188 top:
189 /* if there's no request queued, the device is NAKing; return */
190 list_for_each_entry(req, &ep->req_queue, req_entry) {
191 unsigned int host_len, dev_len, len;
192 void *ubuf_pos, *rbuf_pos;
193 int is_short, to_host;
194 int rescan = 0;
195
196 /*
197 * 1..N packets of ep->ep.maxpacket each ... the last one
198 * may be short (including zero length).
199 *
200 * writer can send a zlp explicitly (length 0) or implicitly
201 * (length mod maxpacket zero, and 'zero' flag); they always
202 * terminate reads.
203 */
204 host_len = urb->transfer_buffer_length - urb->actual_length;
205 dev_len = req->req.length - req->req.actual;
206 len = min(host_len, dev_len);
207
208 to_host = usb_pipein(urb->pipe);
209 if (unlikely(len == 0))
210 is_short = 1;
211 else {
212 /* send multiple of maxpacket first, then remainder */
213 if (len >= ep->ep.maxpacket) {
214 is_short = 0;
215 if (len % ep->ep.maxpacket > 0)
216 rescan = 1;
217 len -= len % ep->ep.maxpacket;
218 } else {
219 is_short = 1;
220 }
221
222 ubuf_pos = urb->transfer_buffer + urb->actual_length;
223 rbuf_pos = req->req.buf + req->req.actual;
224
225 if (urb->pipe & USB_DIR_IN)
226 memcpy(ubuf_pos, rbuf_pos, len);
227 else
228 memcpy(rbuf_pos, ubuf_pos, len);
229
230 urb->actual_length += len;
231 req->req.actual += len;
232 sent += len;
233 }
234
235 /*
236 * short packets terminate, maybe with overflow/underflow.
237 * it's only really an error to write too much.
238 *
239 * partially filling a buffer optionally blocks queue advances
240 * (so completion handlers can clean up the queue) but we don't
241 * need to emulate such data-in-flight.
242 */
243 if (is_short) {
244 if (host_len == dev_len) {
245 req->req.status = 0;
246 urb->status = 0;
247 } else if (to_host) {
248 req->req.status = 0;
249 if (dev_len > host_len)
250 urb->status = -EOVERFLOW;
251 else
252 urb->status = 0;
253 } else {
254 urb->status = 0;
255 if (host_len > dev_len)
256 req->req.status = -EOVERFLOW;
257 else
258 req->req.status = 0;
259 }
260
261 /* many requests terminate without a short packet */
262 /* also check if we need to send zlp */
263 } else {
264 if (req->req.length == req->req.actual) {
265 if (req->req.zero && to_host)
266 rescan = 1;
267 else
268 req->req.status = 0;
269 }
270 if (urb->transfer_buffer_length == urb->actual_length) {
271 if (urb->transfer_flags & URB_ZERO_PACKET &&
272 !to_host)
273 rescan = 1;
274 else
275 urb->status = 0;
276 }
277 }
278
279 /* device side completion --> continuable */
280 if (req->req.status != -EINPROGRESS) {
281
282 list_del_init(&req->req_entry);
283 spin_unlock(&udc->lock);
284 usb_gadget_giveback_request(&ep->ep, &req->req);
285 spin_lock(&udc->lock);
286
287 /* requests might have been unlinked... */
288 rescan = 1;
289 }
290
291 /* host side completion --> terminate */
292 if (urb->status != -EINPROGRESS)
293 break;
294
295 /* rescan to continue with any other queued i/o */
296 if (rescan)
297 goto top;
298 }
299 return sent;
300 }
301
302 static void v_timer(struct timer_list *t)
303 {
304 struct vudc *udc = from_timer(udc, t, tr_timer.timer);
305 struct transfer_timer *timer = &udc->tr_timer;
306 struct urbp *urb_p, *tmp;
307 unsigned long flags;
308 struct usb_ep *_ep;
309 struct vep *ep;
310 int ret = 0;
311 int total, limit;
312
313 spin_lock_irqsave(&udc->lock, flags);
314
315 total = get_frame_limit(udc->gadget.speed);
316 if (total < 0) { /* unknown speed, or not set yet */
317 timer->state = VUDC_TR_IDLE;
318 spin_unlock_irqrestore(&udc->lock, flags);
319 return;
320 }
321 /* is it next frame now? */
322 if (time_after(jiffies, timer->frame_start + msecs_to_jiffies(1))) {
323 timer->frame_limit = total;
324 /* FIXME: how to make it accurate? */
325 timer->frame_start = jiffies;
326 } else {
327 total = timer->frame_limit;
328 }
329
330 /* We have to clear ep0 flags separately as it's not on the list */
331 udc->ep[0].already_seen = 0;
332 list_for_each_entry(_ep, &udc->gadget.ep_list, ep_list) {
333 ep = to_vep(_ep);
334 ep->already_seen = 0;
335 }
336
337 restart:
338 list_for_each_entry_safe(urb_p, tmp, &udc->urb_queue, urb_entry) {
339 struct urb *urb = urb_p->urb;
340
341 ep = urb_p->ep;
342 if (urb->unlinked)
343 goto return_urb;
344 if (timer->state != VUDC_TR_RUNNING)
345 continue;
346
347 if (!ep) {
348 urb->status = -EPROTO;
349 goto return_urb;
350 }
351
352 /* Used up bandwidth? */
353 if (total <= 0 && ep->type == USB_ENDPOINT_XFER_BULK)
354 continue;
355
356 if (ep->already_seen)
357 continue;
358 ep->already_seen = 1;
359 if (ep == &udc->ep[0] && urb_p->new) {
360 ep->setup_stage = 1;
361 urb_p->new = 0;
362 }
363 if (ep->halted && !ep->setup_stage) {
364 urb->status = -EPIPE;
365 goto return_urb;
366 }
367
368 if (ep == &udc->ep[0] && ep->setup_stage) {
369 /* TODO - flush any stale requests */
370 ep->setup_stage = 0;
371 ep->halted = 0;
372
373 ret = handle_control_request(udc, urb,
374 (struct usb_ctrlrequest *) urb->setup_packet,
375 (&urb->status));
376 if (ret > 0) {
377 spin_unlock(&udc->lock);
378 ret = udc->driver->setup(&udc->gadget,
379 (struct usb_ctrlrequest *)
380 urb->setup_packet);
381 spin_lock(&udc->lock);
382 }
383 if (ret >= 0) {
384 /* no delays (max 64kb data stage) */
385 limit = 64 * 1024;
386 goto treat_control_like_bulk;
387 } else {
388 urb->status = -EPIPE;
389 urb->actual_length = 0;
390 goto return_urb;
391 }
392 }
393
394 limit = total;
395 switch (ep->type) {
396 case USB_ENDPOINT_XFER_ISOC:
397 /* TODO: support */
398 urb->status = -EXDEV;
399 break;
400
401 case USB_ENDPOINT_XFER_INT:
402 /*
403 * TODO: figure out bandwidth guarantees
404 * for now, give unlimited bandwidth
405 */
406 limit += urb->transfer_buffer_length;
407 /* fallthrough */
408 default:
409 treat_control_like_bulk:
410 total -= transfer(udc, urb, ep, limit);
411 }
412 if (urb->status == -EINPROGRESS)
413 continue;
414
415 return_urb:
416 if (ep)
417 ep->already_seen = ep->setup_stage = 0;
418
419 spin_lock(&udc->lock_tx);
420 list_del(&urb_p->urb_entry);
421 if (!urb->unlinked) {
422 v_enqueue_ret_submit(udc, urb_p);
423 } else {
424 v_enqueue_ret_unlink(udc, urb_p->seqnum,
425 urb->unlinked);
426 free_urbp_and_urb(urb_p);
427 }
428 wake_up(&udc->tx_waitq);
429 spin_unlock(&udc->lock_tx);
430
431 goto restart;
432 }
433
434 /* TODO - also wait on empty usb_request queues? */
435 if (list_empty(&udc->urb_queue))
436 timer->state = VUDC_TR_IDLE;
437 else
438 mod_timer(&timer->timer,
439 timer->frame_start + msecs_to_jiffies(1));
440
441 spin_unlock_irqrestore(&udc->lock, flags);
442 }
443
444 /* All timer functions are run with udc->lock held */
445
446 void v_init_timer(struct vudc *udc)
447 {
448 struct transfer_timer *t = &udc->tr_timer;
449
450 timer_setup(&t->timer, v_timer, 0);
451 t->state = VUDC_TR_STOPPED;
452 }
453
454 void v_start_timer(struct vudc *udc)
455 {
456 struct transfer_timer *t = &udc->tr_timer;
457
458 dev_dbg(&udc->pdev->dev, "timer start");
459 switch (t->state) {
460 case VUDC_TR_RUNNING:
461 return;
462 case VUDC_TR_IDLE:
463 return v_kick_timer(udc, jiffies);
464 case VUDC_TR_STOPPED:
465 t->state = VUDC_TR_IDLE;
466 t->frame_start = jiffies;
467 t->frame_limit = get_frame_limit(udc->gadget.speed);
468 return v_kick_timer(udc, jiffies);
469 }
470 }
471
472 void v_kick_timer(struct vudc *udc, unsigned long time)
473 {
474 struct transfer_timer *t = &udc->tr_timer;
475
476 dev_dbg(&udc->pdev->dev, "timer kick");
477 switch (t->state) {
478 case VUDC_TR_RUNNING:
479 return;
480 case VUDC_TR_IDLE:
481 t->state = VUDC_TR_RUNNING;
482 /* fallthrough */
483 case VUDC_TR_STOPPED:
484 /* we may want to kick timer to unqueue urbs */
485 mod_timer(&t->timer, time);
486 }
487 }
488
489 void v_stop_timer(struct vudc *udc)
490 {
491 struct transfer_timer *t = &udc->tr_timer;
492
493 /* timer itself will take care of stopping */
494 dev_dbg(&udc->pdev->dev, "timer stop");
495 t->state = VUDC_TR_STOPPED;
496 }