hidg->req should be accessed only with write_spinlock held as it is
set to NULL when we get disabled by host.
Signed-off-by: NKrzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Since commit: ba1582f2 ("usb: gadget: f_hid: use alloc_ep_req()")
we cannot allocate any requests in bind() as we check if we should
align request buffer based on endpoint descriptor which is assigned
in set_alt().

Allocating request in bind() function causes a NULL pointer
dereference.

This commit moves allocation of IN request from bind() to set_alt()
to prevent this issue.

Fixes: ba1582f2 ("usb: gadget: f_hid: use alloc_ep_req()")
Cc: stable@vger.kernel.org
Tested-by: NDavid Lechner <david@lechnology.com>
Signed-off-by: NKrzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

As IN request has to be allocated in set_alt() and released in
disable() we cannot use mutex to protect it as we cannot sleep
in those funcitons. Let's replace this mutex with a spinlock.

Cc: stable@vger.kernel.org
Tested-by: NDavid Lechner <david@lechnology.com>
Signed-off-by: NKrzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

When we unlock our spinlock to copy data to user we may get
disabled by USB host and free the whole list of completed out
requests including the one from which we are copying the data
to user memory.

To prevent from this let's remove our working element from
the list and place it back only if there is sth left when we
finish with it.

Fixes: 99c51500 ("usb: gadget: hidg: register OUT INT endpoint for SET_REPORT")
Cc: stable@vger.kernel.org
Tested-by: NDavid Lechner <david@lechnology.com>
Signed-off-by: NKrzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Requests for out endpoint are allocated in bind() function
but never released.

This commit ensures that all pending requests are released
when we disable out endpoint.

Fixes: 99c51500 ("usb: gadget: hidg: register OUT INT endpoint for SET_REPORT")
Cc: stable@vger.kernel.org
Tested-by: NDavid Lechner <david@lechnology.com>
Signed-off-by: NKrzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

This fixes an error message that was probably copied and pasted. The same
message is used for both the in and out endpoints, so it makes it impossible
to know which one actually failed because both cases say "IN".

Make the out endpoint error message say "OUT".
Signed-off-by: NDavid Lechner <david@lechnology.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Two of the USB Gadgets were poking around in the internals of struct ida
in order to determine if it is empty.  Add the appropriate abstraction.

Link: http://lkml.kernel.org/r/1480369871-5271-63-git-send-email-mawilcox@linuxonhyperv.comSigned-off-by: NMatthew Wilcox <willy@linux.intel.com>
Acked-by: NKonstantin Khlebnikov <koct9i@gmail.com>
Tested-by: NKirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Ross Zwisler <ross.zwisler@linux.intel.com>
Cc: Felipe Balbi <balbi@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Michal Nazarewicz <mina86@mina86.com>
Cc: Matthew Wilcox <mawilcox@microsoft.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Add super speed descriptors to f_hid.
Signed-off-by: NJanusz Dziedzic <januszx.dziedzic@linux.intel.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Use gadget's framework allocation function instead of directly calling
usb_ep_alloc_request().
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

We should always use free_ep_req() when allocating requests with
alloc_ep_req().
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

The default_length parameter of alloc_ep_req was not really necessary
and gadget drivers would almost always create an inline function to pass
the same value to len and default_len.

This patch removes that parameter and updates all calls to alloc_ep_req() to
use the new API.
Signed-off-by: NFelipe F. Tonello <eu@felipetonello.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Even if the /dev/hidg* chardev is automatically created, one
has to guess which one belongs to which function. In the case
of multiple HID functions, or maybe even multiple peripherals,
this becomes difficult.

Add the dev (with major and minor number) to configfs to allow
looking up (or even creating) the right device node for each
function. This file is read-only.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Add the 'ssp_descriptors' parameter to the usb_assign_descriptors()
function. This allows a function driver to add descriptors for
SuperSpeedPlus speeds if it supports it.

Also update all uses of this function in the gadget subsystem so that
they pass NULL for the ssp_descriptors parameters.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

To simplify the configfs interface and remove boilerplate code that also
causes binary bloat.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Reviewed-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Acked-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

Since ep->driver_data is not used for endpoint claiming, neither for
enabled/disabled state storing, we can reduce number of places where
we read or modify it's value, as now it has no particular meaning for
function or framework logic.

In case of f_hid we only need to store in ep->driver_data pointer to
struct f_hidg, as it's used in f_hidg_req_complete() callback. All
other uses of ep->driver_data are now meaningless and can be safely
removed.
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

There is a predefined maximum number of hid instances, currently 4.
A chrdev region is allocated accordingly, but with configfs the user
can create as many hid function directories as they like. To make
the number of hid instances consistent with the number of allocated minors,
the limit is enforced at directory creation time.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

If we have multiple instances of hid function, each of
them may have different report descriptor, also their
length may be different.

Currently we are using static hidg_desc varable which
is being filled in hidg_bind(). Then we send its content
to host in hidg_setup() function. This content may
have been already overwriten if another instance
has executed hidg_bind().
Signed-off-by: NKrzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Function usb_ep_disable() causes completion of all requests queued
for given endpoint, so there is no need to dequeue them after endpoint
disabling.
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

this patch fixes following sparse warning:
f_hid.c:572:30: warning: symbol 'f_hidg_fops' was not declared. Should it be static?
Signed-off-by: NLad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

A maximum value which fits in 16 bits, unsigned, is 65535.
Acked-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Replace a misspelled function name by %s and then __func__.

This was done using Coccinelle, including the use of Levenshtein distance,
as proposed by Rasmus Villemoes.
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch fix spelling typo in printk and Kconfig within
various part of kernel sources.
Signed-off-by: NMasanari Iida <standby24x7@gmail.com>
Acked-by: NRandy Dunlap <rdunlap@infradead.org>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

There were a two issues here.

1) We returned PTR_ERR(NULL) which means success if class_create()
   failed.
2) If alloc_chrdev_region() failed then we should clean up before
   returning.

Also kernel style is to have "error handling" as opposed to "success
handling".  In the original code checking for "if (!status) " is
confusing and this bad style is what lead to bug #2.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

We free "opts" on the error path and then dereference it.

Fixes: 21a9476a ('usb: gadget: hid: add configfs support')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

drivers/usb/gadget/function/f_hid.c:852:21: sparse: symbol 'hidg_alloc' was not declared. Should it be static?
Signed-off-by: NFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Make the hid function available for gadgets composed with configfs.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Before configfs is integrated the usb_gstrings_attach() interface
must be used.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

There are no old function interface users left, so remove it.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Converting hid to the new function interface requires converting
the USB hid's function code and its users.

This patch converts the f_hid.c to the new function interface.

The file can now be compiled into a separate usb_f_hid.ko module.

The old function interface is provided by means of a preprocessor
conditional directives. After all users are converted, the old interface
can be removed.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

device_create() might fail, so check its return value and react
appropriately.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

class_create() might fail, so check its return value and react
appropriately.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Removed usb_free_all_descriptors in the bind functions, which
results in double-free corruption of the descriptors on error path.
The usb descriptors are allocated by usb_assign_descriptors.
Signed-off-by: NPavitrakumar Managutte <pavitra1729@gmail.com>
Reviewed-by: NRobert Baldyga <r.baldyga@samsung.com>
Reviewed-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The drivers/usb/gadget directory contains many files.
Files which are related can be distributed into separate directories.
This patch moves the USB functions implementations into a separate directory.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

alloc_ep_req() is a function repeated in several modules.
Make a common implementation and use it.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

HS and SS descriptors are staticaly created. They are updated during the
bind process with the endpoint address, string id or interface numbers.

After that, the descriptor chain is linked to struct usb_function which
is used by composite in order to serve the GET_DESCRIPTOR requests,
number of available configs and so on.

There is no need to assign the HS descriptor only if the UDC supports
HS speed because composite won't report those to the host if HS support
has not been reached. The same reasoning is valid for SS.

This patch makes sure each function updates HS/SS descriptors
unconditionally and uses the newly introduced helper function to create a
copy the descriptors for the speed which is supported by the UDC.

While at that, also rename f->descriptors to f->fs_descriptors in order
to make it more explicit what that means.

Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This moves composite.c into libcomposite and updates all gadgets.
Finally!
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Some gadgets provide custom entry here. Some may override it with an
etntry that is also created by composite if there was no value sumbitted
at all.
This patch removes all "custom manufacturer" strings which are the same
as these which are created by composite. Then it moves the creation of
the default manufacturer string to usb_composite_overwrite_options() in
case no command line argument has been used and the entry is still an
empty string.
By doing this we get rid of the global variable "composite_manufacturer"
in composite.
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The hidg function driver currently handles its SET_REPORT calls via EP0.
This is the implicit behaviour when no OUT interrupt endpoint is
configured and generally works fine.

The problem is that due to EP0's role in the gadget framework, we cannot
hold back packets and control traffic flow to sync it to the char device,
and hence there's a high risk of loosing packets with this
implementation.

This patch adds an OUT interrupt endpoint to the interface and queues a
fix number of request to catch SET_REPORT events. According to the
specs, host drivers should always use the dedicated OUT endpoint when
present.

The char device's read implementation was rewritten to retrieve data
from the list of completed output requests.
Signed-off-by: NDaniel Mack <zonque@gmail.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Correct spelling typo within usb
Signed-off-by: NMasanari Iida <standby24x7@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

remove the following two paragraphs as they are not needed:

This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
License for more details.

You should have received a copy of the GNU General Public License along with
this program; if not, write to the Free Software Foundation, Inc.,59
Temple Place - Suite 330, Boston, MA  02111-1307, USA.
Signed-off-by: NKlaus Schwarzkopf <schwarzkopf@sensortherm.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>