4 * This driver supports USB CDC WCM Device Management.
6 * Copyright (c) 2007-2009 Oliver Neukum
8 * Some code taken from cdc-acm.c
10 * Released under the GPLv2.
12 * Many thanks to Carl Nordbeck
14 #include <linux/kernel.h>
15 #include <linux/errno.h>
16 #include <linux/slab.h>
17 #include <linux/module.h>
18 #include <linux/mutex.h>
19 #include <linux/uaccess.h>
20 #include <linux/bitops.h>
21 #include <linux/poll.h>
22 #include <linux/usb.h>
23 #include <linux/usb/cdc.h>
24 #include <asm/byteorder.h>
25 #include <asm/unaligned.h>
30 #define DRIVER_VERSION "v0.03"
31 #define DRIVER_AUTHOR "Oliver Neukum"
32 #define DRIVER_DESC "USB Abstract Control Model driver for USB WCM Device Management"
34 #define HUAWEI_VENDOR_ID 0x12D1
36 static const struct usb_device_id wdm_ids[] = {
38 .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS |
39 USB_DEVICE_ID_MATCH_INT_SUBCLASS,
40 .bInterfaceClass = USB_CLASS_COMM,
41 .bInterfaceSubClass = USB_CDC_SUBCLASS_DMM
45 * Huawei E392, E398 and possibly other Qualcomm based modems
46 * embed the Qualcomm QMI protocol inside CDC on CDC ECM like
47 * control interfaces. Userspace access to this is required
48 * to configure the accompanying data interface
50 .match_flags = USB_DEVICE_ID_MATCH_VENDOR |
51 USB_DEVICE_ID_MATCH_INT_INFO,
52 .idVendor = HUAWEI_VENDOR_ID,
53 .bInterfaceClass = USB_CLASS_VENDOR_SPEC,
54 .bInterfaceSubClass = 1,
55 .bInterfaceProtocol = 9, /* NOTE: CDC ECM control interface! */
60 MODULE_DEVICE_TABLE (usb, wdm_ids);
62 #define WDM_MINOR_BASE 176
66 #define WDM_DISCONNECTING 2
69 #define WDM_INT_STALL 5
70 #define WDM_POLL_RUNNING 6
71 #define WDM_RESPONDING 7
72 #define WDM_SUSPENDING 8
73 #define WDM_RESETTING 9
77 /* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 decimal (0x100)" */
78 #define WDM_DEFAULT_BUFSIZE 256
80 static DEFINE_MUTEX(wdm_mutex);
81 static DEFINE_SPINLOCK(wdm_device_list_lock);
82 static LIST_HEAD(wdm_device_list);
84 /* --- method tables --- */
87 u8 *inbuf; /* buffer for response */
88 u8 *outbuf; /* buffer for command */
89 u8 *sbuf; /* buffer for status */
90 u8 *ubuf; /* buffer for copy to user space */
95 struct usb_interface *intf;
96 struct usb_ctrlrequest *orq;
97 struct usb_ctrlrequest *irq;
113 wait_queue_head_t wait;
114 struct work_struct rxwork;
118 struct list_head device_list;
121 static struct usb_driver wdm_driver;
123 /* return intfdata if we own the interface, else look up intf in the list */
124 static struct wdm_device *wdm_find_device(struct usb_interface *intf)
126 struct wdm_device *desc = NULL;
128 spin_lock(&wdm_device_list_lock);
129 list_for_each_entry(desc, &wdm_device_list, device_list)
130 if (desc->intf == intf)
132 spin_unlock(&wdm_device_list_lock);
137 static struct wdm_device *wdm_find_device_by_minor(int minor)
139 struct wdm_device *desc = NULL;
141 spin_lock(&wdm_device_list_lock);
142 list_for_each_entry(desc, &wdm_device_list, device_list)
143 if (desc->intf->minor == minor)
145 spin_unlock(&wdm_device_list_lock);
150 /* --- callbacks --- */
151 static void wdm_out_callback(struct urb *urb)
153 struct wdm_device *desc;
155 spin_lock(&desc->iuspin);
156 desc->werr = urb->status;
157 spin_unlock(&desc->iuspin);
158 clear_bit(WDM_IN_USE, &desc->flags);
160 wake_up(&desc->wait);
163 static void wdm_in_callback(struct urb *urb)
165 struct wdm_device *desc = urb->context;
166 int status = urb->status;
168 spin_lock(&desc->iuspin);
169 clear_bit(WDM_RESPONDING, &desc->flags);
174 dev_dbg(&desc->intf->dev,
175 "nonzero urb status received: -ENOENT");
178 dev_dbg(&desc->intf->dev,
179 "nonzero urb status received: -ECONNRESET");
182 dev_dbg(&desc->intf->dev,
183 "nonzero urb status received: -ESHUTDOWN");
186 dev_err(&desc->intf->dev,
187 "nonzero urb status received: -EPIPE\n");
190 dev_err(&desc->intf->dev,
191 "Unexpected error %d\n", status);
197 desc->reslength = urb->actual_length;
198 memmove(desc->ubuf + desc->length, desc->inbuf, desc->reslength);
199 desc->length += desc->reslength;
201 wake_up(&desc->wait);
203 set_bit(WDM_READ, &desc->flags);
204 spin_unlock(&desc->iuspin);
207 static void wdm_int_callback(struct urb *urb)
210 int status = urb->status;
211 struct wdm_device *desc;
212 struct usb_cdc_notification *dr;
215 dr = (struct usb_cdc_notification *)desc->sbuf;
224 set_bit(WDM_INT_STALL, &desc->flags);
225 dev_err(&desc->intf->dev, "Stall on int endpoint\n");
226 goto sw; /* halt is cleared in work */
228 dev_err(&desc->intf->dev,
229 "nonzero urb status received: %d\n", status);
234 if (urb->actual_length < sizeof(struct usb_cdc_notification)) {
235 dev_err(&desc->intf->dev, "wdm_int_callback - %d bytes\n",
240 switch (dr->bNotificationType) {
241 case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
242 dev_dbg(&desc->intf->dev,
243 "NOTIFY_RESPONSE_AVAILABLE received: index %d len %d",
244 dr->wIndex, dr->wLength);
247 case USB_CDC_NOTIFY_NETWORK_CONNECTION:
249 dev_dbg(&desc->intf->dev,
250 "NOTIFY_NETWORK_CONNECTION %s network",
251 dr->wValue ? "connected to" : "disconnected from");
254 clear_bit(WDM_POLL_RUNNING, &desc->flags);
255 dev_err(&desc->intf->dev,
256 "unknown notification %d received: index %d len %d\n",
257 dr->bNotificationType, dr->wIndex, dr->wLength);
261 spin_lock(&desc->iuspin);
262 clear_bit(WDM_READ, &desc->flags);
263 set_bit(WDM_RESPONDING, &desc->flags);
264 if (!test_bit(WDM_DISCONNECTING, &desc->flags)
265 && !test_bit(WDM_SUSPENDING, &desc->flags)) {
266 rv = usb_submit_urb(desc->response, GFP_ATOMIC);
267 dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
270 spin_unlock(&desc->iuspin);
272 clear_bit(WDM_RESPONDING, &desc->flags);
277 rv = schedule_work(&desc->rxwork);
279 dev_err(&desc->intf->dev,
280 "Cannot schedule work\n");
284 rv = usb_submit_urb(urb, GFP_ATOMIC);
286 dev_err(&desc->intf->dev,
287 "%s - usb_submit_urb failed with result %d\n",
292 static void kill_urbs(struct wdm_device *desc)
294 /* the order here is essential */
295 usb_kill_urb(desc->command);
296 usb_kill_urb(desc->validity);
297 usb_kill_urb(desc->response);
300 static void free_urbs(struct wdm_device *desc)
302 usb_free_urb(desc->validity);
303 usb_free_urb(desc->response);
304 usb_free_urb(desc->command);
307 static void cleanup(struct wdm_device *desc)
309 spin_lock(&wdm_device_list_lock);
310 list_del(&desc->device_list);
311 spin_unlock(&wdm_device_list_lock);
321 static ssize_t wdm_write
322 (struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
325 int rv = -EMSGSIZE, r, we;
326 struct wdm_device *desc = file->private_data;
327 struct usb_ctrlrequest *req;
329 if (count > desc->wMaxCommand)
330 count = desc->wMaxCommand;
332 spin_lock_irq(&desc->iuspin);
335 spin_unlock_irq(&desc->iuspin);
339 desc->outbuf = buf = kmalloc(count, GFP_KERNEL);
345 r = copy_from_user(buf, buffer, count);
352 /* concurrent writes and disconnect */
353 r = mutex_lock_interruptible(&desc->wlock);
360 if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
366 r = usb_autopm_get_interface(desc->intf);
372 if (!(file->f_flags & O_NONBLOCK))
373 r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
376 if (test_bit(WDM_IN_USE, &desc->flags))
379 if (test_bit(WDM_RESETTING, &desc->flags))
388 usb_fill_control_urb(
390 interface_to_usbdev(desc->intf),
391 /* using common endpoint 0 */
392 usb_sndctrlpipe(interface_to_usbdev(desc->intf), 0),
393 (unsigned char *)req,
400 req->bRequestType = (USB_DIR_OUT | USB_TYPE_CLASS |
401 USB_RECIP_INTERFACE);
402 req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND;
404 req->wIndex = desc->inum;
405 req->wLength = cpu_to_le16(count);
406 set_bit(WDM_IN_USE, &desc->flags);
408 rv = usb_submit_urb(desc->command, GFP_KERNEL);
411 clear_bit(WDM_IN_USE, &desc->flags);
412 dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
414 dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d",
418 usb_autopm_put_interface(desc->intf);
420 mutex_unlock(&desc->wlock);
422 return rv < 0 ? rv : count;
425 static ssize_t wdm_read
426 (struct file *file, char __user *buffer, size_t count, loff_t *ppos)
430 struct wdm_device *desc = file->private_data;
433 rv = mutex_lock_interruptible(&desc->rlock); /*concurrent reads */
437 cntr = ACCESS_ONCE(desc->length);
441 if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
446 if (file->f_flags & O_NONBLOCK) {
447 if (!test_bit(WDM_READ, &desc->flags)) {
448 rv = cntr ? cntr : -EAGAIN;
453 rv = wait_event_interruptible(desc->wait,
454 test_bit(WDM_READ, &desc->flags));
457 /* may have happened while we slept */
458 if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
462 if (test_bit(WDM_RESETTING, &desc->flags)) {
466 usb_mark_last_busy(interface_to_usbdev(desc->intf));
472 spin_lock_irq(&desc->iuspin);
474 if (desc->rerr) { /* read completed, error happened */
476 spin_unlock_irq(&desc->iuspin);
481 * recheck whether we've lost the race
482 * against the completion handler
484 if (!test_bit(WDM_READ, &desc->flags)) { /* lost race */
485 spin_unlock_irq(&desc->iuspin);
488 if (!desc->reslength) { /* zero length read */
489 spin_unlock_irq(&desc->iuspin);
493 spin_unlock_irq(&desc->iuspin);
498 rv = copy_to_user(buffer, desc->ubuf, cntr);
504 spin_lock_irq(&desc->iuspin);
506 for (i = 0; i < desc->length - cntr; i++)
507 desc->ubuf[i] = desc->ubuf[i + cntr];
509 desc->length -= cntr;
510 /* in case we had outstanding data */
512 clear_bit(WDM_READ, &desc->flags);
514 spin_unlock_irq(&desc->iuspin);
519 mutex_unlock(&desc->rlock);
523 static int wdm_flush(struct file *file, fl_owner_t id)
525 struct wdm_device *desc = file->private_data;
527 wait_event(desc->wait, !test_bit(WDM_IN_USE, &desc->flags));
529 dev_err(&desc->intf->dev, "Error in flush path: %d\n",
535 static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait)
537 struct wdm_device *desc = file->private_data;
539 unsigned int mask = 0;
541 spin_lock_irqsave(&desc->iuspin, flags);
542 if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
544 spin_unlock_irqrestore(&desc->iuspin, flags);
547 if (test_bit(WDM_READ, &desc->flags))
548 mask = POLLIN | POLLRDNORM;
549 if (desc->rerr || desc->werr)
551 if (!test_bit(WDM_IN_USE, &desc->flags))
552 mask |= POLLOUT | POLLWRNORM;
553 spin_unlock_irqrestore(&desc->iuspin, flags);
555 poll_wait(file, &desc->wait, wait);
561 static int wdm_open(struct inode *inode, struct file *file)
563 int minor = iminor(inode);
565 struct usb_interface *intf;
566 struct wdm_device *desc;
568 mutex_lock(&wdm_mutex);
569 desc = wdm_find_device_by_minor(minor);
574 if (test_bit(WDM_DISCONNECTING, &desc->flags))
576 file->private_data = desc;
578 rv = usb_autopm_get_interface(desc->intf);
580 dev_err(&desc->intf->dev, "Error autopm - %d\n", rv);
583 intf->needs_remote_wakeup = 1;
585 /* using write lock to protect desc->count */
586 mutex_lock(&desc->wlock);
587 if (!desc->count++) {
590 rv = usb_submit_urb(desc->validity, GFP_KERNEL);
593 dev_err(&desc->intf->dev,
594 "Error submitting int urb - %d\n", rv);
599 mutex_unlock(&desc->wlock);
600 usb_autopm_put_interface(desc->intf);
602 mutex_unlock(&wdm_mutex);
606 static int wdm_release(struct inode *inode, struct file *file)
608 struct wdm_device *desc = file->private_data;
610 mutex_lock(&wdm_mutex);
612 /* using write lock to protect desc->count */
613 mutex_lock(&desc->wlock);
615 mutex_unlock(&desc->wlock);
618 dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
620 if (!test_bit(WDM_DISCONNECTING, &desc->flags))
621 desc->intf->needs_remote_wakeup = 0;
623 mutex_unlock(&wdm_mutex);
627 static const struct file_operations wdm_fops = {
628 .owner = THIS_MODULE,
633 .release = wdm_release,
635 .llseek = noop_llseek,
638 static struct usb_class_driver wdm_class = {
641 .minor_base = WDM_MINOR_BASE,
644 /* --- error handling --- */
645 static void wdm_rxwork(struct work_struct *work)
647 struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);
651 spin_lock_irqsave(&desc->iuspin, flags);
652 if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
653 spin_unlock_irqrestore(&desc->iuspin, flags);
655 spin_unlock_irqrestore(&desc->iuspin, flags);
656 rv = usb_submit_urb(desc->response, GFP_KERNEL);
657 if (rv < 0 && rv != -EPERM) {
658 spin_lock_irqsave(&desc->iuspin, flags);
659 if (!test_bit(WDM_DISCONNECTING, &desc->flags))
660 schedule_work(&desc->rxwork);
661 spin_unlock_irqrestore(&desc->iuspin, flags);
666 /* --- hotplug --- */
668 static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor *ep, u16 bufsize)
671 struct wdm_device *desc;
673 desc = kzalloc(sizeof(struct wdm_device), GFP_KERNEL);
676 INIT_LIST_HEAD(&desc->device_list);
677 mutex_init(&desc->rlock);
678 mutex_init(&desc->wlock);
679 spin_lock_init(&desc->iuspin);
680 init_waitqueue_head(&desc->wait);
681 desc->wMaxCommand = bufsize;
682 /* this will be expanded and needed in hardware endianness */
683 desc->inum = cpu_to_le16((u16)intf->cur_altsetting->desc.bInterfaceNumber);
685 INIT_WORK(&desc->rxwork, wdm_rxwork);
688 if (!usb_endpoint_is_int_in(ep))
691 desc->wMaxPacketSize = usb_endpoint_maxp(ep);
693 desc->orq = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
696 desc->irq = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
700 desc->validity = usb_alloc_urb(0, GFP_KERNEL);
704 desc->response = usb_alloc_urb(0, GFP_KERNEL);
708 desc->command = usb_alloc_urb(0, GFP_KERNEL);
712 desc->ubuf = kmalloc(desc->wMaxCommand, GFP_KERNEL);
716 desc->sbuf = kmalloc(desc->wMaxPacketSize, GFP_KERNEL);
720 desc->inbuf = kmalloc(desc->wMaxCommand, GFP_KERNEL);
726 interface_to_usbdev(intf),
727 usb_rcvintpipe(interface_to_usbdev(intf), ep->bEndpointAddress),
729 desc->wMaxPacketSize,
735 desc->irq->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE);
736 desc->irq->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE;
737 desc->irq->wValue = 0;
738 desc->irq->wIndex = desc->inum;
739 desc->irq->wLength = cpu_to_le16(desc->wMaxCommand);
741 usb_fill_control_urb(
743 interface_to_usbdev(intf),
744 /* using common endpoint 0 */
745 usb_rcvctrlpipe(interface_to_usbdev(desc->intf), 0),
746 (unsigned char *)desc->irq,
753 spin_lock(&wdm_device_list_lock);
754 list_add(&desc->device_list, &wdm_device_list);
755 spin_unlock(&wdm_device_list_lock);
757 rv = usb_register_dev(intf, &wdm_class);
761 dev_info(&intf->dev, "%s: USB WDM device\n", dev_name(intf->usb_dev));
769 static int wdm_probe(struct usb_interface *intf, const struct usb_device_id *id)
772 struct usb_host_interface *iface;
773 struct usb_endpoint_descriptor *ep;
774 struct usb_cdc_dmm_desc *dmhd;
775 u8 *buffer = intf->altsetting->extra;
776 int buflen = intf->altsetting->extralen;
777 u16 maxcom = WDM_DEFAULT_BUFSIZE;
782 if (buffer[1] != USB_DT_CS_INTERFACE) {
783 dev_err(&intf->dev, "skipping garbage\n");
788 case USB_CDC_HEADER_TYPE:
790 case USB_CDC_DMM_TYPE:
791 dmhd = (struct usb_cdc_dmm_desc *)buffer;
792 maxcom = le16_to_cpu(dmhd->wMaxCommand);
794 "Finding maximum buffer length: %d", maxcom);
798 "Ignoring extra header, type %d, length %d\n",
799 buffer[2], buffer[0]);
807 iface = intf->cur_altsetting;
808 if (iface->desc.bNumEndpoints != 1)
810 ep = &iface->endpoint[0].desc;
812 rv = wdm_create(intf, ep, maxcom);
818 static void wdm_disconnect(struct usb_interface *intf)
820 struct wdm_device *desc;
823 usb_deregister_dev(intf, &wdm_class);
824 desc = wdm_find_device(intf);
825 mutex_lock(&wdm_mutex);
827 /* the spinlock makes sure no new urbs are generated in the callbacks */
828 spin_lock_irqsave(&desc->iuspin, flags);
829 set_bit(WDM_DISCONNECTING, &desc->flags);
830 set_bit(WDM_READ, &desc->flags);
831 /* to terminate pending flushes */
832 clear_bit(WDM_IN_USE, &desc->flags);
833 spin_unlock_irqrestore(&desc->iuspin, flags);
834 wake_up_all(&desc->wait);
835 mutex_lock(&desc->rlock);
836 mutex_lock(&desc->wlock);
838 cancel_work_sync(&desc->rxwork);
839 mutex_unlock(&desc->wlock);
840 mutex_unlock(&desc->rlock);
843 mutex_unlock(&wdm_mutex);
847 static int wdm_suspend(struct usb_interface *intf, pm_message_t message)
849 struct wdm_device *desc = wdm_find_device(intf);
852 dev_dbg(&desc->intf->dev, "wdm%d_suspend\n", intf->minor);
854 /* if this is an autosuspend the caller does the locking */
855 if (!PMSG_IS_AUTO(message)) {
856 mutex_lock(&desc->rlock);
857 mutex_lock(&desc->wlock);
859 spin_lock_irq(&desc->iuspin);
861 if (PMSG_IS_AUTO(message) &&
862 (test_bit(WDM_IN_USE, &desc->flags)
863 || test_bit(WDM_RESPONDING, &desc->flags))) {
864 spin_unlock_irq(&desc->iuspin);
868 set_bit(WDM_SUSPENDING, &desc->flags);
869 spin_unlock_irq(&desc->iuspin);
870 /* callback submits work - order is essential */
872 cancel_work_sync(&desc->rxwork);
874 if (!PMSG_IS_AUTO(message)) {
875 mutex_unlock(&desc->wlock);
876 mutex_unlock(&desc->rlock);
883 static int recover_from_urb_loss(struct wdm_device *desc)
888 rv = usb_submit_urb(desc->validity, GFP_NOIO);
890 dev_err(&desc->intf->dev,
891 "Error resume submitting int urb - %d\n", rv);
897 static int wdm_resume(struct usb_interface *intf)
899 struct wdm_device *desc = wdm_find_device(intf);
902 dev_dbg(&desc->intf->dev, "wdm%d_resume\n", intf->minor);
904 clear_bit(WDM_SUSPENDING, &desc->flags);
905 rv = recover_from_urb_loss(desc);
911 static int wdm_pre_reset(struct usb_interface *intf)
913 struct wdm_device *desc = wdm_find_device(intf);
916 * we notify everybody using poll of
917 * an exceptional situation
918 * must be done before recovery lest a spontaneous
919 * message from the device is lost
921 spin_lock_irq(&desc->iuspin);
922 set_bit(WDM_RESETTING, &desc->flags); /* inform read/write */
923 set_bit(WDM_READ, &desc->flags); /* unblock read */
924 clear_bit(WDM_IN_USE, &desc->flags); /* unblock write */
926 spin_unlock_irq(&desc->iuspin);
927 wake_up_all(&desc->wait);
928 mutex_lock(&desc->rlock);
929 mutex_lock(&desc->wlock);
931 cancel_work_sync(&desc->rxwork);
935 static int wdm_post_reset(struct usb_interface *intf)
937 struct wdm_device *desc = wdm_find_device(intf);
940 clear_bit(WDM_RESETTING, &desc->flags);
941 rv = recover_from_urb_loss(desc);
942 mutex_unlock(&desc->wlock);
943 mutex_unlock(&desc->rlock);
947 static struct usb_driver wdm_driver = {
950 .disconnect = wdm_disconnect,
952 .suspend = wdm_suspend,
953 .resume = wdm_resume,
954 .reset_resume = wdm_resume,
956 .pre_reset = wdm_pre_reset,
957 .post_reset = wdm_post_reset,
959 .supports_autosuspend = 1,
962 module_usb_driver(wdm_driver);
964 MODULE_AUTHOR(DRIVER_AUTHOR);
965 MODULE_DESCRIPTION(DRIVER_DESC);
966 MODULE_LICENSE("GPL");