drivers/usb/gadget/f_fs.c

   1 /*
   2  * f_fs.c -- user mode file system API for USB composite function controllers
   3  *
   4  * Copyright (C) 2010 Samsung Electronics
   5  * Author: Michal Nazarewicz <mina86@mina86.com>
   6  *
   7  * Based on inode.c (GadgetFS) which was:
   8  * Copyright (C) 2003-2004 David Brownell
   9  * Copyright (C) 2003 Agilent Technologies
  10  *
  11  * This program is free software; you can redistribute it and/or modify
  12  * it under the terms of the GNU General Public License as published by
  13  * the Free Software Foundation; either version 2 of the License, or
  14  * (at your option) any later version.
  15  */
  16
  17
  18 /* #define DEBUG */
  19 /* #define VERBOSE_DEBUG */
  20
  21 #include <linux/blkdev.h>
  22 #include <linux/pagemap.h>
  23 #include <linux/export.h>
  24 #include <linux/hid.h>
  25 #include <linux/module.h>
  26 #include <asm/unaligned.h>
  27
  28 #include <linux/usb/composite.h>
  29 #include <linux/usb/functionfs.h>
  30
  31 #include <linux/poll.h>
  32
  33 #include "u_fs.h"
  34 #include "configfs.h"
  35
  36 #define FUNCTIONFS_MAGIC        0xa647361 /* Chosen by a honest dice roll ;) */
  37
  38 /* Variable Length Array Macros **********************************************/
  39 #define vla_group(groupname) size_t groupname##__next = 0
  40 #define vla_group_size(groupname) groupname##__next
  41
  42 #define vla_item(groupname, type, name, n) \
  43         size_t groupname##_##name##__offset = ({                               \
  44                 size_t align_mask = __alignof__(type) - 1;                     \
  45                 size_t offset = (groupname##__next + align_mask) & ~align_mask;\
  46                 size_t size = (n) * sizeof(type);                              \
  47                 groupname##__next = offset + size;                             \
  48                 offset;                                                        \
  49         })
  50
  51 #define vla_item_with_sz(groupname, type, name, n) \
  52         size_t groupname##_##name##__sz = (n) * sizeof(type);                  \
  53         size_t groupname##_##name##__offset = ({                               \
  54                 size_t align_mask = __alignof__(type) - 1;                     \
  55                 size_t offset = (groupname##__next + align_mask) & ~align_mask;\
  56                 size_t size = groupname##_##name##__sz;                        \
  57                 groupname##__next = offset + size;                             \
  58                 offset;                                                        \
  59         })
  60
  61 #define vla_ptr(ptr, groupname, name) \
  62         ((void *) ((char *)ptr + groupname##_##name##__offset))
  63
  64 /* Reference counter handling */
  65 static void ffs_data_get(struct ffs_data *ffs);
  66 static void ffs_data_put(struct ffs_data *ffs);
  67 /* Creates new ffs_data object. */
  68 static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc));
  69
  70 /* Opened counter handling. */
  71 static void ffs_data_opened(struct ffs_data *ffs);
  72 static void ffs_data_closed(struct ffs_data *ffs);
  73
  74 /* Called with ffs->mutex held; take over ownership of data. */
  75 static int __must_check
  76 __ffs_data_got_descs(struct ffs_data *ffs, char *data, size_t len);
  77 static int __must_check
  78 __ffs_data_got_strings(struct ffs_data *ffs, char *data, size_t len);
  79
  80
  81 /* The function structure ***************************************************/
  82
  83 struct ffs_ep;
  84
  85 struct ffs_function {
  86         struct usb_configuration        *conf;
  87         struct usb_gadget               *gadget;
  88         struct ffs_data                 *ffs;
  89
  90         struct ffs_ep                   *eps;
  91         u8                              eps_revmap[16];
  92         short                           *interfaces_nums;
  93
  94         struct usb_function             function;
  95 };
  96
  97
  98 static struct ffs_function *ffs_func_from_usb(struct usb_function *f)
  99 {
 100         return container_of(f, struct ffs_function, function);
 101 }
 102
 103
 104 static inline enum ffs_setup_state
 105 ffs_setup_state_clear_cancelled(struct ffs_data *ffs)
 106 {
 107         return (enum ffs_setup_state)
 108                 cmpxchg(&ffs->setup_state, FFS_SETUP_CANCELLED, FFS_NO_SETUP);
 109 }
 110
 111
 112 static void ffs_func_eps_disable(struct ffs_function *func);
 113 static int __must_check ffs_func_eps_enable(struct ffs_function *func);
 114
 115 static int ffs_func_bind(struct usb_configuration *,
 116                          struct usb_function *);
 117 static int ffs_func_set_alt(struct usb_function *, unsigned, unsigned);
 118 static void ffs_func_disable(struct usb_function *);
 119 static int ffs_func_setup(struct usb_function *,
 120                           const struct usb_ctrlrequest *);
 121 static void ffs_func_suspend(struct usb_function *);
 122 static void ffs_func_resume(struct usb_function *);
 123
 124
 125 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num);
 126 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf);
 127
 128
 129 /* The endpoints structures *************************************************/
 130
 131 struct ffs_ep {
 132         struct usb_ep                   *ep;    /* P: ffs->eps_lock */
 133         struct usb_request              *req;   /* P: epfile->mutex */
 134
 135         /* [0]: full speed, [1]: high speed */
 136         struct usb_endpoint_descriptor  *descs[2];
 137
 138         u8                              num;
 139
 140         int                             status; /* P: epfile->mutex */
 141 };
 142
 143 struct ffs_epfile {
 144         /* Protects ep->ep and ep->req. */
 145         struct mutex                    mutex;
 146         wait_queue_head_t               wait;
 147
 148         struct ffs_data                 *ffs;
 149         struct ffs_ep                   *ep;    /* P: ffs->eps_lock */
 150
 151         struct dentry                   *dentry;
 152
 153         char                            name[5];
 154
 155         unsigned char                   in;     /* P: ffs->eps_lock */
 156         unsigned char                   isoc;   /* P: ffs->eps_lock */
 157
 158         unsigned char                   _pad;
 159 };
 160
 161 static int  __must_check ffs_epfiles_create(struct ffs_data *ffs);
 162 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count);
 163
 164 static struct inode *__must_check
 165 ffs_sb_create_file(struct super_block *sb, const char *name, void *data,
 166                    const struct file_operations *fops,
 167                    struct dentry **dentry_p);
 168
 169 /* Devices management *******************************************************/
 170
 171 DEFINE_MUTEX(ffs_lock);
 172 EXPORT_SYMBOL(ffs_lock);
 173
 174 static struct ffs_dev *_ffs_find_dev(const char *name);
 175 static struct ffs_dev *_ffs_alloc_dev(void);
 176 static int _ffs_name_dev(struct ffs_dev *dev, const char *name);
 177 static void _ffs_free_dev(struct ffs_dev *dev);
 178 static void *ffs_acquire_dev(const char *dev_name);
 179 static void ffs_release_dev(struct ffs_data *ffs_data);
 180 static int ffs_ready(struct ffs_data *ffs);
 181 static void ffs_closed(struct ffs_data *ffs);
 182
 183 /* Misc helper functions ****************************************************/
 184
 185 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
 186         __attribute__((warn_unused_result, nonnull));
 187 static char *ffs_prepare_buffer(const char __user *buf, size_t len)
 188         __attribute__((warn_unused_result, nonnull));
 189
 190
 191 /* Control file aka ep0 *****************************************************/
 192
 193 static void ffs_ep0_complete(struct usb_ep *ep, struct usb_request *req)
 194 {
 195         struct ffs_data *ffs = req->context;
 196
 197         complete_all(&ffs->ep0req_completion);
 198 }
 199
 200 static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
 201 {
 202         struct usb_request *req = ffs->ep0req;
 203         int ret;
 204
 205         req->zero     = len < le16_to_cpu(ffs->ev.setup.wLength);
 206
 207         spin_unlock_irq(&ffs->ev.waitq.lock);
 208
 209         req->buf      = data;
 210         req->length   = len;
 211
 212         /*
 213          * UDC layer requires to provide a buffer even for ZLP, but should
 214          * not use it at all. Let's provide some poisoned pointer to catch
 215          * possible bug in the driver.
 216          */
 217         if (req->buf == NULL)
 218                 req->buf = (void *)0xDEADBABE;
 219
 220         reinit_completion(&ffs->ep0req_completion);
 221
 222         ret = usb_ep_queue(ffs->gadget->ep0, req, GFP_ATOMIC);
 223         if (unlikely(ret < 0))
 224                 return ret;
 225
 226         ret = wait_for_completion_interruptible(&ffs->ep0req_completion);
 227         if (unlikely(ret)) {
 228                 usb_ep_dequeue(ffs->gadget->ep0, req);
 229                 return -EINTR;
 230         }
 231
 232         ffs->setup_state = FFS_NO_SETUP;
 233         return req->status ? req->status : req->actual;
 234 }
 235
 236 static int __ffs_ep0_stall(struct ffs_data *ffs)
 237 {
 238         if (ffs->ev.can_stall) {
 239                 pr_vdebug("ep0 stall\n");
 240                 usb_ep_set_halt(ffs->gadget->ep0);
 241                 ffs->setup_state = FFS_NO_SETUP;
 242                 return -EL2HLT;
 243         } else {
 244                 pr_debug("bogus ep0 stall!\n");
 245                 return -ESRCH;
 246         }
 247 }
 248
 249 static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
 250                              size_t len, loff_t *ptr)
 251 {
 252         struct ffs_data *ffs = file->private_data;
 253         ssize_t ret;
 254         char *data;
 255
 256         ENTER();
 257
 258         /* Fast check if setup was canceled */
 259         if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
 260                 return -EIDRM;
 261
 262         /* Acquire mutex */
 263         ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
 264         if (unlikely(ret < 0))
 265                 return ret;
 266
 267         /* Check state */
 268         switch (ffs->state) {
 269         case FFS_READ_DESCRIPTORS:
 270         case FFS_READ_STRINGS:
 271                 /* Copy data */
 272                 if (unlikely(len < 16)) {
 273                         ret = -EINVAL;
 274                         break;
 275                 }
 276
 277                 data = ffs_prepare_buffer(buf, len);
 278                 if (IS_ERR(data)) {
 279                         ret = PTR_ERR(data);
 280                         break;
 281                 }
 282
 283                 /* Handle data */
 284                 if (ffs->state == FFS_READ_DESCRIPTORS) {
 285                         pr_info("read descriptors\n");
 286                         ret = __ffs_data_got_descs(ffs, data, len);
 287                         if (unlikely(ret < 0))
 288                                 break;
 289
 290                         ffs->state = FFS_READ_STRINGS;
 291                         ret = len;
 292                 } else {
 293                         pr_info("read strings\n");
 294                         ret = __ffs_data_got_strings(ffs, data, len);
 295                         if (unlikely(ret < 0))
 296                                 break;
 297
 298                         ret = ffs_epfiles_create(ffs);
 299                         if (unlikely(ret)) {
 300                                 ffs->state = FFS_CLOSING;
 301                                 break;
 302                         }
 303
 304                         ffs->state = FFS_ACTIVE;
 305                         mutex_unlock(&ffs->mutex);
 306
 307                         ret = ffs_ready(ffs);
 308                         if (unlikely(ret < 0)) {
 309                                 ffs->state = FFS_CLOSING;
 310                                 return ret;
 311                         }
 312
 313                         set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags);
 314                         return len;
 315                 }
 316                 break;
 317
 318         case FFS_ACTIVE:
 319                 data = NULL;
 320                 /*
 321                  * We're called from user space, we can use _irq
 322                  * rather then _irqsave
 323                  */
 324                 spin_lock_irq(&ffs->ev.waitq.lock);
 325                 switch (ffs_setup_state_clear_cancelled(ffs)) {
 326                 case FFS_SETUP_CANCELLED:
 327                         ret = -EIDRM;
 328                         goto done_spin;
 329
 330                 case FFS_NO_SETUP:
 331                         ret = -ESRCH;
 332                         goto done_spin;
 333
 334                 case FFS_SETUP_PENDING:
 335                         break;
 336                 }
 337
 338                 /* FFS_SETUP_PENDING */
 339                 if (!(ffs->ev.setup.bRequestType & USB_DIR_IN)) {
 340                         spin_unlock_irq(&ffs->ev.waitq.lock);
 341                         ret = __ffs_ep0_stall(ffs);
 342                         break;
 343                 }
 344
 345                 /* FFS_SETUP_PENDING and not stall */
 346                 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength));
 347
 348                 spin_unlock_irq(&ffs->ev.waitq.lock);
 349
 350                 data = ffs_prepare_buffer(buf, len);
 351                 if (IS_ERR(data)) {
 352                         ret = PTR_ERR(data);
 353                         break;
 354                 }
 355
 356                 spin_lock_irq(&ffs->ev.waitq.lock);
 357
 358                 /*
 359                  * We are guaranteed to be still in FFS_ACTIVE state
 360                  * but the state of setup could have changed from
 361                  * FFS_SETUP_PENDING to FFS_SETUP_CANCELLED so we need
 362                  * to check for that.  If that happened we copied data
 363                  * from user space in vain but it's unlikely.
 364                  *
 365                  * For sure we are not in FFS_NO_SETUP since this is
 366                  * the only place FFS_SETUP_PENDING -> FFS_NO_SETUP
 367                  * transition can be performed and it's protected by
 368                  * mutex.
 369                  */
 370                 if (ffs_setup_state_clear_cancelled(ffs) ==
 371                     FFS_SETUP_CANCELLED) {
 372                         ret = -EIDRM;
 373 done_spin:
 374                         spin_unlock_irq(&ffs->ev.waitq.lock);
 375                 } else {
 376                         /* unlocks spinlock */
 377                         ret = __ffs_ep0_queue_wait(ffs, data, len);
 378                 }
 379                 kfree(data);
 380                 break;
 381
 382         default:
 383                 ret = -EBADFD;
 384                 break;
 385         }
 386
 387         mutex_unlock(&ffs->mutex);
 388         return ret;
 389 }
 390
 391 static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
 392                                      size_t n)
 393 {
 394         /*
 395          * We are holding ffs->ev.waitq.lock and ffs->mutex and we need
 396          * to release them.
 397          */
 398         struct usb_functionfs_event events[n];
 399         unsigned i = 0;
 400
 401         memset(events, 0, sizeof events);
 402
 403         do {
 404                 events[i].type = ffs->ev.types[i];
 405                 if (events[i].type == FUNCTIONFS_SETUP) {
 406                         events[i].u.setup = ffs->ev.setup;
 407                         ffs->setup_state = FFS_SETUP_PENDING;
 408                 }
 409         } while (++i < n);
 410
 411         if (n < ffs->ev.count) {
 412                 ffs->ev.count -= n;
 413                 memmove(ffs->ev.types, ffs->ev.types + n,
 414                         ffs->ev.count * sizeof *ffs->ev.types);
 415         } else {
 416                 ffs->ev.count = 0;
 417         }
 418
 419         spin_unlock_irq(&ffs->ev.waitq.lock);
 420         mutex_unlock(&ffs->mutex);
 421
 422         return unlikely(__copy_to_user(buf, events, sizeof events))
 423                 ? -EFAULT : sizeof events;
 424 }
 425
 426 static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
 427                             size_t len, loff_t *ptr)
 428 {
 429         struct ffs_data *ffs = file->private_data;
 430         char *data = NULL;
 431         size_t n;
 432         int ret;
 433
 434         ENTER();
 435
 436         /* Fast check if setup was canceled */
 437         if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
 438                 return -EIDRM;
 439
 440         /* Acquire mutex */
 441         ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
 442         if (unlikely(ret < 0))
 443                 return ret;
 444
 445         /* Check state */
 446         if (ffs->state != FFS_ACTIVE) {
 447                 ret = -EBADFD;
 448                 goto done_mutex;
 449         }
 450
 451         /*
 452          * We're called from user space, we can use _irq rather then
 453          * _irqsave
 454          */
 455         spin_lock_irq(&ffs->ev.waitq.lock);
 456
 457         switch (ffs_setup_state_clear_cancelled(ffs)) {
 458         case FFS_SETUP_CANCELLED:
 459                 ret = -EIDRM;
 460                 break;
 461
 462         case FFS_NO_SETUP:
 463                 n = len / sizeof(struct usb_functionfs_event);
 464                 if (unlikely(!n)) {
 465                         ret = -EINVAL;
 466                         break;
 467                 }
 468
 469                 if ((file->f_flags & O_NONBLOCK) && !ffs->ev.count) {
 470                         ret = -EAGAIN;
 471                         break;
 472                 }
 473
 474                 if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq,
 475                                                         ffs->ev.count)) {
 476                         ret = -EINTR;
 477                         break;
 478                 }
 479
 480                 return __ffs_ep0_read_events(ffs, buf,
 481                                              min(n, (size_t)ffs->ev.count));
 482
 483         case FFS_SETUP_PENDING:
 484                 if (ffs->ev.setup.bRequestType & USB_DIR_IN) {
 485                         spin_unlock_irq(&ffs->ev.waitq.lock);
 486                         ret = __ffs_ep0_stall(ffs);
 487                         goto done_mutex;
 488                 }
 489
 490                 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength));
 491
 492                 spin_unlock_irq(&ffs->ev.waitq.lock);
 493
 494                 if (likely(len)) {
 495                         data = kmalloc(len, GFP_KERNEL);
 496                         if (unlikely(!data)) {
 497                                 ret = -ENOMEM;
 498                                 goto done_mutex;
 499                         }
 500                 }
 501
 502                 spin_lock_irq(&ffs->ev.waitq.lock);
 503
 504                 /* See ffs_ep0_write() */
 505                 if (ffs_setup_state_clear_cancelled(ffs) ==
 506                     FFS_SETUP_CANCELLED) {
 507                         ret = -EIDRM;
 508                         break;
 509                 }
 510
 511                 /* unlocks spinlock */
 512                 ret = __ffs_ep0_queue_wait(ffs, data, len);
 513                 if (likely(ret > 0) && unlikely(__copy_to_user(buf, data, len)))
 514                         ret = -EFAULT;
 515                 goto done_mutex;
 516
 517         default:
 518                 ret = -EBADFD;
 519                 break;
 520         }
 521
 522         spin_unlock_irq(&ffs->ev.waitq.lock);
 523 done_mutex:
 524         mutex_unlock(&ffs->mutex);
 525         kfree(data);
 526         return ret;
 527 }
 528
 529 static int ffs_ep0_open(struct inode *inode, struct file *file)
 530 {
 531         struct ffs_data *ffs = inode->i_private;
 532
 533         ENTER();
 534
 535         if (unlikely(ffs->state == FFS_CLOSING))
 536                 return -EBUSY;
 537
 538         file->private_data = ffs;
 539         ffs_data_opened(ffs);
 540
 541         return 0;
 542 }
 543
 544 static int ffs_ep0_release(struct inode *inode, struct file *file)
 545 {
 546         struct ffs_data *ffs = file->private_data;
 547
 548         ENTER();
 549
 550         ffs_data_closed(ffs);
 551
 552         return 0;
 553 }
 554
 555 static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
 556 {
 557         struct ffs_data *ffs = file->private_data;
 558         struct usb_gadget *gadget = ffs->gadget;
 559         long ret;
 560
 561         ENTER();
 562
 563         if (code == FUNCTIONFS_INTERFACE_REVMAP) {
 564                 struct ffs_function *func = ffs->func;
 565                 ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
 566         } else if (gadget && gadget->ops->ioctl) {
 567                 ret = gadget->ops->ioctl(gadget, code, value);
 568         } else {
 569                 ret = -ENOTTY;
 570         }
 571
 572         return ret;
 573 }
 574
 575 static unsigned int ffs_ep0_poll(struct file *file, poll_table *wait)
 576 {
 577         struct ffs_data *ffs = file->private_data;
 578         unsigned int mask = POLLWRNORM;
 579         int ret;
 580
 581         poll_wait(file, &ffs->ev.waitq, wait);
 582
 583         ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
 584         if (unlikely(ret < 0))
 585                 return mask;
 586
 587         switch (ffs->state) {
 588         case FFS_READ_DESCRIPTORS:
 589         case FFS_READ_STRINGS:
 590                 mask |= POLLOUT;
 591                 break;
 592
 593         case FFS_ACTIVE:
 594                 switch (ffs->setup_state) {
 595                 case FFS_NO_SETUP:
 596                         if (ffs->ev.count)
 597                                 mask |= POLLIN;
 598                         break;
 599
 600                 case FFS_SETUP_PENDING:
 601                 case FFS_SETUP_CANCELLED:
 602                         mask |= (POLLIN | POLLOUT);
 603                         break;
 604                 }
 605         case FFS_CLOSING:
 606                 break;
 607         }
 608
 609         mutex_unlock(&ffs->mutex);
 610
 611         return mask;
 612 }
 613
 614 static const struct file_operations ffs_ep0_operations = {
 615         .llseek =       no_llseek,
 616
 617         .open =         ffs_ep0_open,
 618         .write =        ffs_ep0_write,
 619         .read =         ffs_ep0_read,
 620         .release =      ffs_ep0_release,
 621         .unlocked_ioctl =       ffs_ep0_ioctl,
 622         .poll =         ffs_ep0_poll,
 623 };
 624
 625
 626 /* "Normal" endpoints operations ********************************************/
 627
 628 static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req)
 629 {
 630         ENTER();
 631         if (likely(req->context)) {
 632                 struct ffs_ep *ep = _ep->driver_data;
 633                 ep->status = req->status ? req->status : req->actual;
 634                 complete(req->context);
 635         }
 636 }
 637
 638 static ssize_t ffs_epfile_io(struct file *file,
 639                              char __user *buf, size_t len, int read)
 640 {
 641         struct ffs_epfile *epfile = file->private_data;
 642         struct usb_gadget *gadget = epfile->ffs->gadget;
 643         struct ffs_ep *ep;
 644         char *data = NULL;
 645         ssize_t ret, data_len;
 646         int halt;
 647
 648         /* Are we still active? */
 649         if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) {
 650                 ret = -ENODEV;
 651                 goto error;
 652         }
 653
 654         /* Wait for endpoint to be enabled */
 655         ep = epfile->ep;
 656         if (!ep) {
 657                 if (file->f_flags & O_NONBLOCK) {
 658                         ret = -EAGAIN;
 659                         goto error;
 660                 }
 661
 662                 ret = wait_event_interruptible(epfile->wait, (ep = epfile->ep));
 663                 if (ret) {
 664                         ret = -EINTR;
 665                         goto error;
 666                 }
 667         }
 668
 669         /* Do we halt? */
 670         halt = !read == !epfile->in;
 671         if (halt && epfile->isoc) {
 672                 ret = -EINVAL;
 673                 goto error;
 674         }
 675
 676         /* Allocate & copy */
 677         if (!halt) {
 678                 /*
 679                  * Controller may require buffer size to be aligned to
 680                  * maxpacketsize of an out endpoint.
 681                  */
 682                 data_len = read ? usb_ep_align_maybe(gadget, ep->ep, len) : len;
 683
 684                 data = kmalloc(data_len, GFP_KERNEL);
 685                 if (unlikely(!data))
 686                         return -ENOMEM;
 687
 688                 if (!read && unlikely(copy_from_user(data, buf, len))) {
 689                         ret = -EFAULT;
 690                         goto error;
 691                 }
 692         }
 693
 694         /* We will be using request */
 695         ret = ffs_mutex_lock(&epfile->mutex, file->f_flags & O_NONBLOCK);
 696         if (unlikely(ret))
 697                 goto error;
 698
 699         spin_lock_irq(&epfile->ffs->eps_lock);
 700
 701         if (epfile->ep != ep) {
 702                 /* In the meantime, endpoint got disabled or changed. */
 703                 ret = -ESHUTDOWN;
 704                 spin_unlock_irq(&epfile->ffs->eps_lock);
 705         } else if (halt) {
 706                 /* Halt */
 707                 if (likely(epfile->ep == ep) && !WARN_ON(!ep->ep))
 708                         usb_ep_set_halt(ep->ep);
 709                 spin_unlock_irq(&epfile->ffs->eps_lock);
 710                 ret = -EBADMSG;
 711         } else {
 712                 /* Fire the request */
 713                 DECLARE_COMPLETION_ONSTACK(done);
 714
 715                 struct usb_request *req = ep->req;
 716                 req->context  = &done;
 717                 req->complete = ffs_epfile_io_complete;
 718                 req->buf      = data;
 719                 req->length   = data_len;
 720
 721                 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
 722
 723                 spin_unlock_irq(&epfile->ffs->eps_lock);
 724
 725                 if (unlikely(ret < 0)) {
 726                         /* nop */
 727                 } else if (unlikely(wait_for_completion_interruptible(&done))) {
 728                         ret = -EINTR;
 729                         usb_ep_dequeue(ep->ep, req);
 730                 } else {
 731                         /*
 732                          * XXX We may end up silently droping data here.
 733                          * Since data_len (i.e. req->length) may be bigger
 734                          * than len (after being rounded up to maxpacketsize),
 735                          * we may end up with more data then user space has
 736                          * space for.
 737                          */
 738                         ret = ep->status;
 739                         if (read && ret > 0 &&
 740                             unlikely(copy_to_user(buf, data,
 741                                                   min_t(size_t, ret, len))))
 742                                 ret = -EFAULT;
 743                 }
 744         }
 745
 746         mutex_unlock(&epfile->mutex);
 747 error:
 748         kfree(data);
 749         return ret;
 750 }
 751
 752 static ssize_t
 753 ffs_epfile_write(struct file *file, const char __user *buf, size_t len,
 754                  loff_t *ptr)
 755 {
 756         ENTER();
 757
 758         return ffs_epfile_io(file, (char __user *)buf, len, 0);
 759 }
 760
 761 static ssize_t
 762 ffs_epfile_read(struct file *file, char __user *buf, size_t len, loff_t *ptr)
 763 {
 764         ENTER();
 765
 766         return ffs_epfile_io(file, buf, len, 1);
 767 }
 768
 769 static int
 770 ffs_epfile_open(struct inode *inode, struct file *file)
 771 {
 772         struct ffs_epfile *epfile = inode->i_private;
 773
 774         ENTER();
 775
 776         if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
 777                 return -ENODEV;
 778
 779         file->private_data = epfile;
 780         ffs_data_opened(epfile->ffs);
 781
 782         return 0;
 783 }
 784
 785 static int
 786 ffs_epfile_release(struct inode *inode, struct file *file)
 787 {
 788         struct ffs_epfile *epfile = inode->i_private;
 789
 790         ENTER();
 791
 792         ffs_data_closed(epfile->ffs);
 793
 794         return 0;
 795 }
 796
 797 static long ffs_epfile_ioctl(struct file *file, unsigned code,
 798                              unsigned long value)
 799 {
 800         struct ffs_epfile *epfile = file->private_data;
 801         int ret;
 802
 803         ENTER();
 804
 805         if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
 806                 return -ENODEV;
 807
 808         spin_lock_irq(&epfile->ffs->eps_lock);
 809         if (likely(epfile->ep)) {
 810                 switch (code) {
 811                 case FUNCTIONFS_FIFO_STATUS:
 812                         ret = usb_ep_fifo_status(epfile->ep->ep);
 813                         break;
 814                 case FUNCTIONFS_FIFO_FLUSH:
 815                         usb_ep_fifo_flush(epfile->ep->ep);
 816                         ret = 0;
 817                         break;
 818                 case FUNCTIONFS_CLEAR_HALT:
 819                         ret = usb_ep_clear_halt(epfile->ep->ep);
 820                         break;
 821                 case FUNCTIONFS_ENDPOINT_REVMAP:
 822                         ret = epfile->ep->num;
 823                         break;
 824                 default:
 825                         ret = -ENOTTY;
 826                 }
 827         } else {
 828                 ret = -ENODEV;
 829         }
 830         spin_unlock_irq(&epfile->ffs->eps_lock);
 831
 832         return ret;
 833 }
 834
 835 static const struct file_operations ffs_epfile_operations = {
 836         .llseek =       no_llseek,
 837
 838         .open =         ffs_epfile_open,
 839         .write =        ffs_epfile_write,
 840         .read =         ffs_epfile_read,
 841         .release =      ffs_epfile_release,
 842         .unlocked_ioctl =       ffs_epfile_ioctl,
 843 };
 844
 845
 846 /* File system and super block operations ***********************************/
 847
 848 /*
 849  * Mounting the file system creates a controller file, used first for
 850  * function configuration then later for event monitoring.
 851  */
 852
 853 static struct inode *__must_check
 854 ffs_sb_make_inode(struct super_block *sb, void *data,
 855                   const struct file_operations *fops,
 856                   const struct inode_operations *iops,
 857                   struct ffs_file_perms *perms)
 858 {
 859         struct inode *inode;
 860
 861         ENTER();
 862
 863         inode = new_inode(sb);
 864
 865         if (likely(inode)) {
 866                 struct timespec current_time = CURRENT_TIME;
 867
 868                 inode->i_ino     = get_next_ino();
 869                 inode->i_mode    = perms->mode;
 870                 inode->i_uid     = perms->uid;
 871                 inode->i_gid     = perms->gid;
 872                 inode->i_atime   = current_time;
 873                 inode->i_mtime   = current_time;
 874                 inode->i_ctime   = current_time;
 875                 inode->i_private = data;
 876                 if (fops)
 877                         inode->i_fop = fops;
 878                 if (iops)
 879                         inode->i_op  = iops;
 880         }
 881
 882         return inode;
 883 }
 884
 885 /* Create "regular" file */
 886 static struct inode *ffs_sb_create_file(struct super_block *sb,
 887                                         const char *name, void *data,
 888                                         const struct file_operations *fops,
 889                                         struct dentry **dentry_p)
 890 {
 891         struct ffs_data *ffs = sb->s_fs_info;
 892         struct dentry   *dentry;
 893         struct inode    *inode;
 894
 895         ENTER();
 896
 897         dentry = d_alloc_name(sb->s_root, name);
 898         if (unlikely(!dentry))
 899                 return NULL;
 900
 901         inode = ffs_sb_make_inode(sb, data, fops, NULL, &ffs->file_perms);
 902         if (unlikely(!inode)) {
 903                 dput(dentry);
 904                 return NULL;
 905         }
 906
 907         d_add(dentry, inode);
 908         if (dentry_p)
 909                 *dentry_p = dentry;
 910
 911         return inode;
 912 }
 913
 914 /* Super block */
 915 static const struct super_operations ffs_sb_operations = {
 916         .statfs =       simple_statfs,
 917         .drop_inode =   generic_delete_inode,
 918 };
 919
 920 struct ffs_sb_fill_data {
 921         struct ffs_file_perms perms;
 922         umode_t root_mode;
 923         const char *dev_name;
 924         struct ffs_data *ffs_data;
 925 };
 926
 927 static int ffs_sb_fill(struct super_block *sb, void *_data, int silent)
 928 {
 929         struct ffs_sb_fill_data *data = _data;
 930         struct inode    *inode;
 931         struct ffs_data *ffs = data->ffs_data;
 932
 933         ENTER();
 934
 935         ffs->sb              = sb;
 936         data->ffs_data       = NULL;
 937         sb->s_fs_info        = ffs;
 938         sb->s_blocksize      = PAGE_CACHE_SIZE;
 939         sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
 940         sb->s_magic          = FUNCTIONFS_MAGIC;
 941         sb->s_op             = &ffs_sb_operations;
 942         sb->s_time_gran      = 1;
 943
 944         /* Root inode */
 945         data->perms.mode = data->root_mode;
 946         inode = ffs_sb_make_inode(sb, NULL,
 947                                   &simple_dir_operations,
 948                                   &simple_dir_inode_operations,
 949                                   &data->perms);
 950         sb->s_root = d_make_root(inode);
 951         if (unlikely(!sb->s_root))
 952                 return -ENOMEM;
 953
 954         /* EP0 file */
 955         if (unlikely(!ffs_sb_create_file(sb, "ep0", ffs,
 956                                          &ffs_ep0_operations, NULL)))
 957                 return -ENOMEM;
 958
 959         return 0;
 960 }
 961
 962 static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
 963 {
 964         ENTER();
 965
 966         if (!opts || !*opts)
 967                 return 0;
 968
 969         for (;;) {
 970                 unsigned long value;
 971                 char *eq, *comma;
 972
 973                 /* Option limit */
 974                 comma = strchr(opts, ',');
 975                 if (comma)
 976                         *comma = 0;
 977
 978                 /* Value limit */
 979                 eq = strchr(opts, '=');
 980                 if (unlikely(!eq)) {
 981                         pr_err("'=' missing in %s\n", opts);
 982                         return -EINVAL;
 983                 }
 984                 *eq = 0;
 985
 986                 /* Parse value */
 987                 if (kstrtoul(eq + 1, 0, &value)) {
 988                         pr_err("%s: invalid value: %s\n", opts, eq + 1);
 989                         return -EINVAL;
 990                 }
 991
 992                 /* Interpret option */
 993                 switch (eq - opts) {
 994                 case 5:
 995                         if (!memcmp(opts, "rmode", 5))
 996                                 data->root_mode  = (value & 0555) | S_IFDIR;
 997                         else if (!memcmp(opts, "fmode", 5))
 998                                 data->perms.mode = (value & 0666) | S_IFREG;
 999                         else
1000                                 goto invalid;
1001                         break;
1002
1003                 case 4:
1004                         if (!memcmp(opts, "mode", 4)) {
1005                                 data->root_mode  = (value & 0555) | S_IFDIR;
1006                                 data->perms.mode = (value & 0666) | S_IFREG;
1007                         } else {
1008                                 goto invalid;
1009                         }
1010                         break;
1011
1012                 case 3:
1013                         if (!memcmp(opts, "uid", 3)) {
1014                                 data->perms.uid = make_kuid(current_user_ns(), value);
1015                                 if (!uid_valid(data->perms.uid)) {
1016                                         pr_err("%s: unmapped value: %lu\n", opts, value);
1017                                         return -EINVAL;
1018                                 }
1019                         } else if (!memcmp(opts, "gid", 3)) {
1020                                 data->perms.gid = make_kgid(current_user_ns(), value);
1021                                 if (!gid_valid(data->perms.gid)) {
1022                                         pr_err("%s: unmapped value: %lu\n", opts, value);
1023                                         return -EINVAL;
1024                                 }
1025                         } else {
1026                                 goto invalid;
1027                         }
1028                         break;
1029
1030                 default:
1031 invalid:
1032                         pr_err("%s: invalid option\n", opts);
1033                         return -EINVAL;
1034                 }
1035
1036                 /* Next iteration */
1037                 if (!comma)
1038                         break;
1039                 opts = comma + 1;
1040         }
1041
1042         return 0;
1043 }
1044
1045 /* "mount -t functionfs dev_name /dev/function" ends up here */
1046
1047 static struct dentry *
1048 ffs_fs_mount(struct file_system_type *t, int flags,
1049               const char *dev_name, void *opts)
1050 {
1051         struct ffs_sb_fill_data data = {
1052                 .perms = {
1053                         .mode = S_IFREG | 0600,
1054                         .uid = GLOBAL_ROOT_UID,
1055                         .gid = GLOBAL_ROOT_GID,
1056                 },
1057                 .root_mode = S_IFDIR | 0500,
1058         };
1059         struct dentry *rv;
1060         int ret;
1061         void *ffs_dev;
1062         struct ffs_data *ffs;
1063
1064         ENTER();
1065
1066         ret = ffs_fs_parse_opts(&data, opts);
1067         if (unlikely(ret < 0))
1068                 return ERR_PTR(ret);
1069
1070         ffs = ffs_data_new();
1071         if (unlikely(!ffs))
1072                 return ERR_PTR(-ENOMEM);
1073         ffs->file_perms = data.perms;
1074
1075         ffs->dev_name = kstrdup(dev_name, GFP_KERNEL);
1076         if (unlikely(!ffs->dev_name)) {
1077                 ffs_data_put(ffs);
1078                 return ERR_PTR(-ENOMEM);
1079         }
1080
1081         ffs_dev = ffs_acquire_dev(dev_name);
1082         if (IS_ERR(ffs_dev)) {
1083                 ffs_data_put(ffs);
1084                 return ERR_CAST(ffs_dev);
1085         }
1086         ffs->private_data = ffs_dev;
1087         data.ffs_data = ffs;
1088
1089         rv = mount_nodev(t, flags, &data, ffs_sb_fill);
1090         if (IS_ERR(rv) && data.ffs_data) {
1091                 ffs_release_dev(data.ffs_data);
1092                 ffs_data_put(data.ffs_data);
1093         }
1094         return rv;
1095 }
1096
1097 static void
1098 ffs_fs_kill_sb(struct super_block *sb)
1099 {
1100         ENTER();
1101
1102         kill_litter_super(sb);
1103         if (sb->s_fs_info) {
1104                 ffs_release_dev(sb->s_fs_info);
1105                 ffs_data_put(sb->s_fs_info);
1106         }
1107 }
1108
1109 static struct file_system_type ffs_fs_type = {
1110         .owner          = THIS_MODULE,
1111         .name           = "functionfs",
1112         .mount          = ffs_fs_mount,
1113         .kill_sb        = ffs_fs_kill_sb,
1114 };
1115 MODULE_ALIAS_FS("functionfs");
1116
1117
1118 /* Driver's main init/cleanup functions *************************************/
1119
1120 static int functionfs_init(void)
1121 {
1122         int ret;
1123
1124         ENTER();
1125
1126         ret = register_filesystem(&ffs_fs_type);
1127         if (likely(!ret))
1128                 pr_info("file system registered\n");
1129         else
1130                 pr_err("failed registering file system (%d)\n", ret);
1131
1132         return ret;
1133 }
1134
1135 static void functionfs_cleanup(void)
1136 {
1137         ENTER();
1138
1139         pr_info("unloading\n");
1140         unregister_filesystem(&ffs_fs_type);
1141 }
1142
1143
1144 /* ffs_data and ffs_function construction and destruction code **************/
1145
1146 static void ffs_data_clear(struct ffs_data *ffs);
1147 static void ffs_data_reset(struct ffs_data *ffs);
1148
1149 static void ffs_data_get(struct ffs_data *ffs)
1150 {
1151         ENTER();
1152
1153         atomic_inc(&ffs->ref);
1154 }
1155
1156 static void ffs_data_opened(struct ffs_data *ffs)
1157 {
1158         ENTER();
1159
1160         atomic_inc(&ffs->ref);
1161         atomic_inc(&ffs->opened);
1162 }
1163
1164 static void ffs_data_put(struct ffs_data *ffs)
1165 {
1166         ENTER();
1167
1168         if (unlikely(atomic_dec_and_test(&ffs->ref))) {
1169                 pr_info("%s(): freeing\n", __func__);
1170                 ffs_data_clear(ffs);
1171                 BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
1172                        waitqueue_active(&ffs->ep0req_completion.wait));
1173                 kfree(ffs->dev_name);
1174                 kfree(ffs);
1175         }
1176 }
1177
1178 static void ffs_data_closed(struct ffs_data *ffs)
1179 {
1180         ENTER();
1181
1182         if (atomic_dec_and_test(&ffs->opened)) {
1183                 ffs->state = FFS_CLOSING;
1184                 ffs_data_reset(ffs);
1185         }
1186
1187         ffs_data_put(ffs);
1188 }
1189
1190 static struct ffs_data *ffs_data_new(void)
1191 {
1192         struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
1193         if (unlikely(!ffs))
1194                 return NULL;
1195
1196         ENTER();
1197
1198         atomic_set(&ffs->ref, 1);
1199         atomic_set(&ffs->opened, 0);
1200         ffs->state = FFS_READ_DESCRIPTORS;
1201         mutex_init(&ffs->mutex);
1202         spin_lock_init(&ffs->eps_lock);
1203         init_waitqueue_head(&ffs->ev.waitq);
1204         init_completion(&ffs->ep0req_completion);
1205
1206         /* XXX REVISIT need to update it in some places, or do we? */
1207         ffs->ev.can_stall = 1;
1208
1209         return ffs;
1210 }
1211
1212 static void ffs_data_clear(struct ffs_data *ffs)
1213 {
1214         ENTER();
1215
1216         if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags))
1217                 ffs_closed(ffs);
1218
1219         BUG_ON(ffs->gadget);
1220
1221         if (ffs->epfiles)
1222                 ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count);
1223
1224         kfree(ffs->raw_descs);
1225         kfree(ffs->raw_strings);
1226         kfree(ffs->stringtabs);
1227 }
1228
1229 static void ffs_data_reset(struct ffs_data *ffs)
1230 {
1231         ENTER();
1232
1233         ffs_data_clear(ffs);
1234
1235         ffs->epfiles = NULL;
1236         ffs->raw_descs = NULL;
1237         ffs->raw_strings = NULL;
1238         ffs->stringtabs = NULL;
1239
1240         ffs->raw_descs_length = 0;
1241         ffs->raw_fs_descs_length = 0;
1242         ffs->fs_descs_count = 0;
1243         ffs->hs_descs_count = 0;
1244
1245         ffs->strings_count = 0;
1246         ffs->interfaces_count = 0;
1247         ffs->eps_count = 0;
1248
1249         ffs->ev.count = 0;
1250
1251         ffs->state = FFS_READ_DESCRIPTORS;
1252         ffs->setup_state = FFS_NO_SETUP;
1253         ffs->flags = 0;
1254 }
1255
1256
1257 static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
1258 {
1259         struct usb_gadget_strings **lang;
1260         int first_id;
1261
1262         ENTER();
1263
1264         if (WARN_ON(ffs->state != FFS_ACTIVE
1265                  || test_and_set_bit(FFS_FL_BOUND, &ffs->flags)))
1266                 return -EBADFD;
1267
1268         first_id = usb_string_ids_n(cdev, ffs->strings_count);
1269         if (unlikely(first_id < 0))
1270                 return first_id;
1271
1272         ffs->ep0req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL);
1273         if (unlikely(!ffs->ep0req))
1274                 return -ENOMEM;
1275         ffs->ep0req->complete = ffs_ep0_complete;
1276         ffs->ep0req->context = ffs;
1277
1278         lang = ffs->stringtabs;
1279         for (lang = ffs->stringtabs; *lang; ++lang) {
1280                 struct usb_string *str = (*lang)->strings;
1281                 int id = first_id;
1282                 for (; str->s; ++id, ++str)
1283                         str->id = id;
1284         }
1285
1286         ffs->gadget = cdev->gadget;
1287         ffs_data_get(ffs);
1288         return 0;
1289 }
1290
1291 static void functionfs_unbind(struct ffs_data *ffs)
1292 {
1293         ENTER();
1294
1295         if (!WARN_ON(!ffs->gadget)) {
1296                 usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req);
1297                 ffs->ep0req = NULL;
1298                 ffs->gadget = NULL;
1299                 clear_bit(FFS_FL_BOUND, &ffs->flags);
1300                 ffs_data_put(ffs);
1301         }
1302 }
1303
1304 static int ffs_epfiles_create(struct ffs_data *ffs)
1305 {
1306         struct ffs_epfile *epfile, *epfiles;
1307         unsigned i, count;
1308
1309         ENTER();
1310
1311         count = ffs->eps_count;
1312         epfiles = kcalloc(count, sizeof(*epfiles), GFP_KERNEL);
1313         if (!epfiles)
1314                 return -ENOMEM;
1315
1316         epfile = epfiles;
1317         for (i = 1; i <= count; ++i, ++epfile) {
1318                 epfile->ffs = ffs;
1319                 mutex_init(&epfile->mutex);
1320                 init_waitqueue_head(&epfile->wait);
1321                 sprintf(epfiles->name, "ep%u",  i);
1322                 if (!unlikely(ffs_sb_create_file(ffs->sb, epfiles->name, epfile,
1323                                                  &ffs_epfile_operations,
1324                                                  &epfile->dentry))) {
1325                         ffs_epfiles_destroy(epfiles, i - 1);
1326                         return -ENOMEM;
1327                 }
1328         }
1329
1330         ffs->epfiles = epfiles;
1331         return 0;
1332 }
1333
1334 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count)
1335 {
1336         struct ffs_epfile *epfile = epfiles;
1337
1338         ENTER();
1339
1340         for (; count; --count, ++epfile) {
1341                 BUG_ON(mutex_is_locked(&epfile->mutex) ||
1342                        waitqueue_active(&epfile->wait));
1343                 if (epfile->dentry) {
1344                         d_delete(epfile->dentry);
1345                         dput(epfile->dentry);
1346                         epfile->dentry = NULL;
1347                 }
1348         }
1349
1350         kfree(epfiles);
1351 }
1352
1353
1354 static void ffs_func_eps_disable(struct ffs_function *func)
1355 {
1356         struct ffs_ep *ep         = func->eps;
1357         struct ffs_epfile *epfile = func->ffs->epfiles;
1358         unsigned count            = func->ffs->eps_count;
1359         unsigned long flags;
1360
1361         spin_lock_irqsave(&func->ffs->eps_lock, flags);
1362         do {
1363                 /* pending requests get nuked */
1364                 if (likely(ep->ep))
1365                         usb_ep_disable(ep->ep);
1366                 epfile->ep = NULL;
1367
1368                 ++ep;
1369                 ++epfile;
1370         } while (--count);
1371         spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
1372 }
1373
1374 static int ffs_func_eps_enable(struct ffs_function *func)
1375 {
1376         struct ffs_data *ffs      = func->ffs;
1377         struct ffs_ep *ep         = func->eps;
1378         struct ffs_epfile *epfile = ffs->epfiles;
1379         unsigned count            = ffs->eps_count;
1380         unsigned long flags;
1381         int ret = 0;
1382
1383         spin_lock_irqsave(&func->ffs->eps_lock, flags);
1384         do {
1385                 struct usb_endpoint_descriptor *ds;
1386                 ds = ep->descs[ep->descs[1] ? 1 : 0];
1387
1388                 ep->ep->driver_data = ep;
1389                 ep->ep->desc = ds;
1390                 ret = usb_ep_enable(ep->ep);
1391                 if (likely(!ret)) {
1392                         epfile->ep = ep;
1393                         epfile->in = usb_endpoint_dir_in(ds);
1394                         epfile->isoc = usb_endpoint_xfer_isoc(ds);
1395                 } else {
1396                         break;
1397                 }
1398
1399                 wake_up(&epfile->wait);
1400
1401                 ++ep;
1402                 ++epfile;
1403         } while (--count);
1404         spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
1405
1406         return ret;
1407 }
1408
1409
1410 /* Parsing and building descriptors and strings *****************************/
1411
1412 /*
1413  * This validates if data pointed by data is a valid USB descriptor as
1414  * well as record how many interfaces, endpoints and strings are
1415  * required by given configuration.  Returns address after the
1416  * descriptor or NULL if data is invalid.
1417  */
1418
1419 enum ffs_entity_type {
1420         FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT
1421 };
1422
1423 typedef int (*ffs_entity_callback)(enum ffs_entity_type entity,
1424                                    u8 *valuep,
1425                                    struct usb_descriptor_header *desc,
1426                                    void *priv);
1427
1428 static int __must_check ffs_do_desc(char *data, unsigned len,
1429                                     ffs_entity_callback entity, void *priv)
1430 {
1431         struct usb_descriptor_header *_ds = (void *)data;
1432         u8 length;
1433         int ret;
1434
1435         ENTER();
1436
1437         /* At least two bytes are required: length and type */
1438         if (len < 2) {
1439                 pr_vdebug("descriptor too short\n");
1440                 return -EINVAL;
1441         }
1442
1443         /* If we have at least as many bytes as the descriptor takes? */
1444         length = _ds->bLength;
1445         if (len < length) {
1446                 pr_vdebug("descriptor longer then available data\n");
1447                 return -EINVAL;
1448         }
1449
1450 #define __entity_check_INTERFACE(val)  1
1451 #define __entity_check_STRING(val)     (val)
1452 #define __entity_check_ENDPOINT(val)   ((val) & USB_ENDPOINT_NUMBER_MASK)
1453 #define __entity(type, val) do {                                        \
1454                 pr_vdebug("entity " #type "(%02x)\n", (val));           \
1455                 if (unlikely(!__entity_check_ ##type(val))) {           \
1456                         pr_vdebug("invalid entity's value\n");          \
1457                         return -EINVAL;                                 \
1458                 }                                                       \
1459                 ret = entity(FFS_ ##type, &val, _ds, priv);             \
1460                 if (unlikely(ret < 0)) {                                \
1461                         pr_debug("entity " #type "(%02x); ret = %d\n",  \
1462                                  (val), ret);                           \
1463                         return ret;                                     \
1464                 }                                                       \
1465         } while (0)
1466
1467         /* Parse descriptor depending on type. */
1468         switch (_ds->bDescriptorType) {
1469         case USB_DT_DEVICE:
1470         case USB_DT_CONFIG:
1471         case USB_DT_STRING:
1472         case USB_DT_DEVICE_QUALIFIER:
1473                 /* function can't have any of those */
1474                 pr_vdebug("descriptor reserved for gadget: %d\n",
1475                       _ds->bDescriptorType);
1476                 return -EINVAL;
1477
1478         case USB_DT_INTERFACE: {
1479                 struct usb_interface_descriptor *ds = (void *)_ds;
1480                 pr_vdebug("interface descriptor\n");
1481                 if (length != sizeof *ds)
1482                         goto inv_length;
1483
1484                 __entity(INTERFACE, ds->bInterfaceNumber);
1485                 if (ds->iInterface)
1486                         __entity(STRING, ds->iInterface);
1487         }
1488                 break;
1489
1490         case USB_DT_ENDPOINT: {
1491                 struct usb_endpoint_descriptor *ds = (void *)_ds;
1492                 pr_vdebug("endpoint descriptor\n");
1493                 if (length != USB_DT_ENDPOINT_SIZE &&
1494                     length != USB_DT_ENDPOINT_AUDIO_SIZE)
1495                         goto inv_length;
1496                 __entity(ENDPOINT, ds->bEndpointAddress);
1497         }
1498                 break;
1499
1500         case HID_DT_HID:
1501                 pr_vdebug("hid descriptor\n");
1502                 if (length != sizeof(struct hid_descriptor))
1503                         goto inv_length;
1504                 break;
1505
1506         case USB_DT_OTG:
1507                 if (length != sizeof(struct usb_otg_descriptor))
1508                         goto inv_length;
1509                 break;
1510
1511         case USB_DT_INTERFACE_ASSOCIATION: {
1512                 struct usb_interface_assoc_descriptor *ds = (void *)_ds;
1513                 pr_vdebug("interface association descriptor\n");
1514                 if (length != sizeof *ds)
1515                         goto inv_length;
1516                 if (ds->iFunction)
1517                         __entity(STRING, ds->iFunction);
1518         }
1519                 break;
1520
1521         case USB_DT_OTHER_SPEED_CONFIG:
1522         case USB_DT_INTERFACE_POWER:
1523         case USB_DT_DEBUG:
1524         case USB_DT_SECURITY:
1525         case USB_DT_CS_RADIO_CONTROL:
1526                 /* TODO */
1527                 pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType);
1528                 return -EINVAL;
1529
1530         default:
1531                 /* We should never be here */
1532                 pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType);
1533                 return -EINVAL;
1534
1535 inv_length:
1536                 pr_vdebug("invalid length: %d (descriptor %d)\n",
1537                           _ds->bLength, _ds->bDescriptorType);
1538                 return -EINVAL;
1539         }
1540
1541 #undef __entity
1542 #undef __entity_check_DESCRIPTOR
1543 #undef __entity_check_INTERFACE
1544 #undef __entity_check_STRING
1545 #undef __entity_check_ENDPOINT
1546
1547         return length;
1548 }
1549
1550 static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len,
1551                                      ffs_entity_callback entity, void *priv)
1552 {
1553         const unsigned _len = len;
1554         unsigned long num = 0;
1555
1556         ENTER();
1557
1558         for (;;) {
1559                 int ret;
1560
1561                 if (num == count)
1562                         data = NULL;
1563
1564                 /* Record "descriptor" entity */
1565                 ret = entity(FFS_DESCRIPTOR, (u8 *)num, (void *)data, priv);
1566                 if (unlikely(ret < 0)) {
1567                         pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n",
1568                                  num, ret);
1569                         return ret;
1570                 }
1571
1572                 if (!data)
1573                         return _len - len;
1574
1575                 ret = ffs_do_desc(data, len, entity, priv);
1576                 if (unlikely(ret < 0)) {
1577                         pr_debug("%s returns %d\n", __func__, ret);
1578                         return ret;
1579                 }
1580
1581                 len -= ret;
1582                 data += ret;
1583                 ++num;
1584         }
1585 }
1586
1587 static int __ffs_data_do_entity(enum ffs_entity_type type,
1588                                 u8 *valuep, struct usb_descriptor_header *desc,
1589                                 void *priv)
1590 {
1591         struct ffs_data *ffs = priv;
1592
1593         ENTER();
1594
1595         switch (type) {
1596         case FFS_DESCRIPTOR:
1597                 break;
1598
1599         case FFS_INTERFACE:
1600                 /*
1601                  * Interfaces are indexed from zero so if we
1602                  * encountered interface "n" then there are at least
1603                  * "n+1" interfaces.
1604                  */
1605                 if (*valuep >= ffs->interfaces_count)
1606                         ffs->interfaces_count = *valuep + 1;
1607                 break;
1608
1609         case FFS_STRING:
1610                 /*
1611                  * Strings are indexed from 1 (0 is magic ;) reserved
1612                  * for languages list or some such)
1613                  */
1614                 if (*valuep > ffs->strings_count)
1615                         ffs->strings_count = *valuep;
1616                 break;
1617
1618         case FFS_ENDPOINT:
1619                 /* Endpoints are indexed from 1 as well. */
1620                 if ((*valuep & USB_ENDPOINT_NUMBER_MASK) > ffs->eps_count)
1621                         ffs->eps_count = (*valuep & USB_ENDPOINT_NUMBER_MASK);
1622                 break;
1623         }
1624
1625         return 0;
1626 }
1627
1628 static int __ffs_data_got_descs(struct ffs_data *ffs,
1629                                 char *const _data, size_t len)
1630 {
1631         unsigned fs_count, hs_count;
1632         int fs_len, ret = -EINVAL;
1633         char *data = _data;
1634
1635         ENTER();
1636
1637         if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_DESCRIPTORS_MAGIC ||
1638                      get_unaligned_le32(data + 4) != len))
1639                 goto error;
1640         fs_count = get_unaligned_le32(data +  8);
1641         hs_count = get_unaligned_le32(data + 12);
1642
1643         if (!fs_count && !hs_count)
1644                 goto einval;
1645
1646         data += 16;
1647         len  -= 16;
1648
1649         if (likely(fs_count)) {
1650                 fs_len = ffs_do_descs(fs_count, data, len,
1651                                       __ffs_data_do_entity, ffs);
1652                 if (unlikely(fs_len < 0)) {
1653                         ret = fs_len;
1654                         goto error;
1655                 }
1656
1657                 data += fs_len;
1658                 len  -= fs_len;
1659         } else {
1660                 fs_len = 0;
1661         }
1662
1663         if (likely(hs_count)) {
1664                 ret = ffs_do_descs(hs_count, data, len,
1665                                    __ffs_data_do_entity, ffs);
1666                 if (unlikely(ret < 0))
1667                         goto error;
1668         } else {
1669                 ret = 0;
1670         }
1671
1672         if (unlikely(len != ret))
1673                 goto einval;
1674
1675         ffs->raw_fs_descs_length = fs_len;
1676         ffs->raw_descs_length    = fs_len + ret;
1677         ffs->raw_descs           = _data;
1678         ffs->fs_descs_count      = fs_count;
1679         ffs->hs_descs_count      = hs_count;
1680
1681         return 0;
1682
1683 einval:
1684         ret = -EINVAL;
1685 error:
1686         kfree(_data);
1687         return ret;
1688 }
1689
1690 static int __ffs_data_got_strings(struct ffs_data *ffs,
1691                                   char *const _data, size_t len)
1692 {
1693         u32 str_count, needed_count, lang_count;
1694         struct usb_gadget_strings **stringtabs, *t;
1695         struct usb_string *strings, *s;
1696         const char *data = _data;
1697
1698         ENTER();
1699
1700         if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
1701                      get_unaligned_le32(data + 4) != len))
1702                 goto error;
1703         str_count  = get_unaligned_le32(data + 8);
1704         lang_count = get_unaligned_le32(data + 12);
1705
1706         /* if one is zero the other must be zero */
1707         if (unlikely(!str_count != !lang_count))
1708                 goto error;
1709
1710         /* Do we have at least as many strings as descriptors need? */
1711         needed_count = ffs->strings_count;
1712         if (unlikely(str_count < needed_count))
1713                 goto error;
1714
1715         /*
1716          * If we don't need any strings just return and free all
1717          * memory.
1718          */
1719         if (!needed_count) {
1720                 kfree(_data);
1721                 return 0;
1722         }
1723
1724         /* Allocate everything in one chunk so there's less maintenance. */
1725         {
1726                 unsigned i = 0;
1727                 vla_group(d);
1728                 vla_item(d, struct usb_gadget_strings *, stringtabs,
1729                         lang_count + 1);
1730                 vla_item(d, struct usb_gadget_strings, stringtab, lang_count);
1731                 vla_item(d, struct usb_string, strings,
1732                         lang_count*(needed_count+1));
1733
1734                 char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL);
1735
1736                 if (unlikely(!vlabuf)) {
1737                         kfree(_data);
1738                         return -ENOMEM;
1739                 }
1740
1741                 /* Initialize the VLA pointers */
1742                 stringtabs = vla_ptr(vlabuf, d, stringtabs);
1743                 t = vla_ptr(vlabuf, d, stringtab);
1744                 i = lang_count;
1745                 do {
1746                         *stringtabs++ = t++;
1747                 } while (--i);
1748                 *stringtabs = NULL;
1749
1750                 /* stringtabs = vlabuf = d_stringtabs for later kfree */
1751                 stringtabs = vla_ptr(vlabuf, d, stringtabs);
1752                 t = vla_ptr(vlabuf, d, stringtab);
1753                 s = vla_ptr(vlabuf, d, strings);
1754                 strings = s;
1755         }
1756
1757         /* For each language */
1758         data += 16;
1759         len -= 16;
1760
1761         do { /* lang_count > 0 so we can use do-while */
1762                 unsigned needed = needed_count;
1763
1764                 if (unlikely(len < 3))
1765                         goto error_free;
1766                 t->language = get_unaligned_le16(data);
1767                 t->strings  = s;
1768                 ++t;
1769
1770                 data += 2;
1771                 len -= 2;
1772
1773                 /* For each string */
1774                 do { /* str_count > 0 so we can use do-while */
1775                         size_t length = strnlen(data, len);
1776
1777                         if (unlikely(length == len))
1778                                 goto error_free;
1779
1780                         /*
1781                          * User may provide more strings then we need,
1782                          * if that's the case we simply ignore the
1783                          * rest
1784                          */
1785                         if (likely(needed)) {
1786                                 /*
1787                                  * s->id will be set while adding
1788                                  * function to configuration so for
1789                                  * now just leave garbage here.
1790                                  */
1791                                 s->s = data;
1792                                 --needed;
1793                                 ++s;
1794                         }
1795
1796                         data += length + 1;
1797                         len -= length + 1;
1798                 } while (--str_count);
1799
1800                 s->id = 0;   /* terminator */
1801                 s->s = NULL;
1802                 ++s;
1803
1804         } while (--lang_count);
1805
1806         /* Some garbage left? */
1807         if (unlikely(len))
1808                 goto error_free;
1809
1810         /* Done! */
1811         ffs->stringtabs = stringtabs;
1812         ffs->raw_strings = _data;
1813
1814         return 0;
1815
1816 error_free:
1817         kfree(stringtabs);
1818 error:
1819         kfree(_data);
1820         return -EINVAL;
1821 }
1822
1823
1824 /* Events handling and management *******************************************/
1825
1826 static void __ffs_event_add(struct ffs_data *ffs,
1827                             enum usb_functionfs_event_type type)
1828 {
1829         enum usb_functionfs_event_type rem_type1, rem_type2 = type;
1830         int neg = 0;
1831
1832         /*
1833          * Abort any unhandled setup
1834          *
1835          * We do not need to worry about some cmpxchg() changing value
1836          * of ffs->setup_state without holding the lock because when
1837          * state is FFS_SETUP_PENDING cmpxchg() in several places in
1838          * the source does nothing.
1839          */
1840         if (ffs->setup_state == FFS_SETUP_PENDING)
1841                 ffs->setup_state = FFS_SETUP_CANCELLED;
1842
1843         switch (type) {
1844         case FUNCTIONFS_RESUME:
1845                 rem_type2 = FUNCTIONFS_SUSPEND;
1846                 /* FALL THROUGH */
1847         case FUNCTIONFS_SUSPEND:
1848         case FUNCTIONFS_SETUP:
1849                 rem_type1 = type;
1850                 /* Discard all similar events */
1851                 break;
1852
1853         case FUNCTIONFS_BIND:
1854         case FUNCTIONFS_UNBIND:
1855         case FUNCTIONFS_DISABLE:
1856         case FUNCTIONFS_ENABLE:
1857                 /* Discard everything other then power management. */
1858                 rem_type1 = FUNCTIONFS_SUSPEND;
1859                 rem_type2 = FUNCTIONFS_RESUME;
1860                 neg = 1;
1861                 break;
1862
1863         default:
1864                 BUG();
1865         }
1866
1867         {
1868                 u8 *ev  = ffs->ev.types, *out = ev;
1869                 unsigned n = ffs->ev.count;
1870                 for (; n; --n, ++ev)
1871                         if ((*ev == rem_type1 || *ev == rem_type2) == neg)
1872                                 *out++ = *ev;
1873                         else
1874                                 pr_vdebug("purging event %d\n", *ev);
1875                 ffs->ev.count = out - ffs->ev.types;
1876         }
1877
1878         pr_vdebug("adding event %d\n", type);
1879         ffs->ev.types[ffs->ev.count++] = type;
1880         wake_up_locked(&ffs->ev.waitq);
1881 }
1882
1883 static void ffs_event_add(struct ffs_data *ffs,
1884                           enum usb_functionfs_event_type type)
1885 {
1886         unsigned long flags;
1887         spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
1888         __ffs_event_add(ffs, type);
1889         spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
1890 }
1891
1892
1893 /* Bind/unbind USB function hooks *******************************************/
1894
1895 static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
1896                                     struct usb_descriptor_header *desc,
1897                                     void *priv)
1898 {
1899         struct usb_endpoint_descriptor *ds = (void *)desc;
1900         struct ffs_function *func = priv;
1901         struct ffs_ep *ffs_ep;
1902
1903         /*
1904          * If hs_descriptors is not NULL then we are reading hs
1905          * descriptors now
1906          */
1907         const int isHS = func->function.hs_descriptors != NULL;
1908         unsigned idx;
1909
1910         if (type != FFS_DESCRIPTOR)
1911                 return 0;
1912
1913         if (isHS)
1914                 func->function.hs_descriptors[(long)valuep] = desc;
1915         else
1916                 func->function.fs_descriptors[(long)valuep]    = desc;
1917
1918         if (!desc || desc->bDescriptorType != USB_DT_ENDPOINT)
1919                 return 0;
1920
1921         idx = (ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK) - 1;
1922         ffs_ep = func->eps + idx;
1923
1924         if (unlikely(ffs_ep->descs[isHS])) {
1925                 pr_vdebug("two %sspeed descriptors for EP %d\n",
1926                           isHS ? "high" : "full",
1927                           ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
1928                 return -EINVAL;
1929         }
1930         ffs_ep->descs[isHS] = ds;
1931
1932         ffs_dump_mem(": Original  ep desc", ds, ds->bLength);
1933         if (ffs_ep->ep) {
1934                 ds->bEndpointAddress = ffs_ep->descs[0]->bEndpointAddress;
1935                 if (!ds->wMaxPacketSize)
1936                         ds->wMaxPacketSize = ffs_ep->descs[0]->wMaxPacketSize;
1937         } else {
1938                 struct usb_request *req;
1939                 struct usb_ep *ep;
1940
1941                 pr_vdebug("autoconfig\n");
1942                 ep = usb_ep_autoconfig(func->gadget, ds);
1943                 if (unlikely(!ep))
1944                         return -ENOTSUPP;
1945                 ep->driver_data = func->eps + idx;
1946
1947                 req = usb_ep_alloc_request(ep, GFP_KERNEL);
1948                 if (unlikely(!req))
1949                         return -ENOMEM;
1950
1951                 ffs_ep->ep  = ep;
1952                 ffs_ep->req = req;
1953                 func->eps_revmap[ds->bEndpointAddress &
1954                                  USB_ENDPOINT_NUMBER_MASK] = idx + 1;
1955         }
1956         ffs_dump_mem(": Rewritten ep desc", ds, ds->bLength);
1957
1958         return 0;
1959 }
1960
1961 static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep,
1962                                    struct usb_descriptor_header *desc,
1963                                    void *priv)
1964 {
1965         struct ffs_function *func = priv;
1966         unsigned idx;
1967         u8 newValue;
1968
1969         switch (type) {
1970         default:
1971         case FFS_DESCRIPTOR:
1972                 /* Handled in previous pass by __ffs_func_bind_do_descs() */
1973                 return 0;
1974
1975         case FFS_INTERFACE:
1976                 idx = *valuep;
1977                 if (func->interfaces_nums[idx] < 0) {
1978                         int id = usb_interface_id(func->conf, &func->function);
1979                         if (unlikely(id < 0))
1980                                 return id;
1981                         func->interfaces_nums[idx] = id;
1982                 }
1983                 newValue = func->interfaces_nums[idx];
1984                 break;
1985
1986         case FFS_STRING:
1987                 /* String' IDs are allocated when fsf_data is bound to cdev */
1988                 newValue = func->ffs->stringtabs[0]->strings[*valuep - 1].id;
1989                 break;
1990
1991         case FFS_ENDPOINT:
1992                 /*
1993                  * USB_DT_ENDPOINT are handled in
1994                  * __ffs_func_bind_do_descs().
1995                  */
1996                 if (desc->bDescriptorType == USB_DT_ENDPOINT)
1997                         return 0;
1998
1999                 idx = (*valuep & USB_ENDPOINT_NUMBER_MASK) - 1;
2000                 if (unlikely(!func->eps[idx].ep))
2001                         return -EINVAL;
2002
2003                 {
2004                         struct usb_endpoint_descriptor **descs;
2005                         descs = func->eps[idx].descs;
2006                         newValue = descs[descs[0] ? 0 : 1]->bEndpointAddress;
2007                 }
2008                 break;
2009         }
2010
2011         pr_vdebug("%02x -> %02x\n", *valuep, newValue);
2012         *valuep = newValue;
2013         return 0;
2014 }
2015
2016 static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f,
2017                                                 struct usb_configuration *c)
2018 {
2019         struct ffs_function *func = ffs_func_from_usb(f);
2020         struct f_fs_opts *ffs_opts =
2021                 container_of(f->fi, struct f_fs_opts, func_inst);
2022         int ret;
2023
2024         ENTER();
2025
2026         /*
2027          * Legacy gadget triggers binding in functionfs_ready_callback,
2028          * which already uses locking; taking the same lock here would
2029          * cause a deadlock.
2030          *
2031          * Configfs-enabled gadgets however do need ffs_dev_lock.
2032          */
2033         if (!ffs_opts->no_configfs)
2034                 ffs_dev_lock();
2035         ret = ffs_opts->dev->desc_ready ? 0 : -ENODEV;
2036         func->ffs = ffs_opts->dev->ffs_data;
2037         if (!ffs_opts->no_configfs)
2038                 ffs_dev_unlock();
2039         if (ret)
2040                 return ERR_PTR(ret);
2041
2042         func->conf = c;
2043         func->gadget = c->cdev->gadget;
2044
2045         ffs_data_get(func->ffs);
2046
2047         /*
2048          * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
2049          * configurations are bound in sequence with list_for_each_entry,
2050          * in each configuration its functions are bound in sequence
2051          * with list_for_each_entry, so we assume no race condition
2052          * with regard to ffs_opts->bound access
2053          */
2054         if (!ffs_opts->refcnt) {
2055                 ret = functionfs_bind(func->ffs, c->cdev);
2056                 if (ret)
2057                         return ERR_PTR(ret);
2058         }
2059         ffs_opts->refcnt++;
2060         func->function.strings = func->ffs->stringtabs;
2061
2062         return ffs_opts;
2063 }
2064
2065 static int _ffs_func_bind(struct usb_configuration *c,
2066                           struct usb_function *f)
2067 {
2068         struct ffs_function *func = ffs_func_from_usb(f);
2069         struct ffs_data *ffs = func->ffs;
2070
2071         const int full = !!func->ffs->fs_descs_count;
2072         const int high = gadget_is_dualspeed(func->gadget) &&
2073                 func->ffs->hs_descs_count;
2074
2075         int ret;
2076
2077         /* Make it a single chunk, less management later on */
2078         vla_group(d);
2079         vla_item_with_sz(d, struct ffs_ep, eps, ffs->eps_count);
2080         vla_item_with_sz(d, struct usb_descriptor_header *, fs_descs,
2081                 full ? ffs->fs_descs_count + 1 : 0);
2082         vla_item_with_sz(d, struct usb_descriptor_header *, hs_descs,
2083                 high ? ffs->hs_descs_count + 1 : 0);
2084         vla_item_with_sz(d, short, inums, ffs->interfaces_count);
2085         vla_item_with_sz(d, char, raw_descs,
2086                 high ? ffs->raw_descs_length : ffs->raw_fs_descs_length);
2087         char *vlabuf;
2088
2089         ENTER();
2090
2091         /* Only high speed but not supported by gadget? */
2092         if (unlikely(!(full | high)))
2093                 return -ENOTSUPP;
2094
2095         /* Allocate a single chunk, less management later on */
2096         vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL);
2097         if (unlikely(!vlabuf))
2098                 return -ENOMEM;
2099
2100         /* Zero */
2101         memset(vla_ptr(vlabuf, d, eps), 0, d_eps__sz);
2102         memcpy(vla_ptr(vlabuf, d, raw_descs), ffs->raw_descs + 16,
2103                d_raw_descs__sz);
2104         memset(vla_ptr(vlabuf, d, inums), 0xff, d_inums__sz);
2105         for (ret = ffs->eps_count; ret; --ret) {
2106                 struct ffs_ep *ptr;
2107
2108                 ptr = vla_ptr(vlabuf, d, eps);
2109                 ptr[ret].num = -1;
2110         }
2111
2112         /* Save pointers
2113          * d_eps == vlabuf, func->eps used to kfree vlabuf later
2114         */
2115         func->eps             = vla_ptr(vlabuf, d, eps);
2116         func->interfaces_nums = vla_ptr(vlabuf, d, inums);
2117
2118         /*
2119          * Go through all the endpoint descriptors and allocate
2120          * endpoints first, so that later we can rewrite the endpoint
2121          * numbers without worrying that it may be described later on.
2122          */
2123         if (likely(full)) {
2124                 func->function.fs_descriptors = vla_ptr(vlabuf, d, fs_descs);
2125                 ret = ffs_do_descs(ffs->fs_descs_count,
2126                                    vla_ptr(vlabuf, d, raw_descs),
2127                                    d_raw_descs__sz,
2128                                    __ffs_func_bind_do_descs, func);
2129                 if (unlikely(ret < 0))
2130                         goto error;
2131         } else {
2132                 ret = 0;
2133         }
2134
2135         if (likely(high)) {
2136                 func->function.hs_descriptors = vla_ptr(vlabuf, d, hs_descs);
2137                 ret = ffs_do_descs(ffs->hs_descs_count,
2138                                    vla_ptr(vlabuf, d, raw_descs) + ret,
2139                                    d_raw_descs__sz - ret,
2140                                    __ffs_func_bind_do_descs, func);
2141                 if (unlikely(ret < 0))
2142                         goto error;
2143         }
2144
2145         /*
2146          * Now handle interface numbers allocation and interface and
2147          * endpoint numbers rewriting.  We can do that in one go
2148          * now.
2149          */
2150         ret = ffs_do_descs(ffs->fs_descs_count +
2151                            (high ? ffs->hs_descs_count : 0),
2152                            vla_ptr(vlabuf, d, raw_descs), d_raw_descs__sz,
2153                            __ffs_func_bind_do_nums, func);
2154         if (unlikely(ret < 0))
2155                 goto error;
2156
2157         /* And we're done */
2158         ffs_event_add(ffs, FUNCTIONFS_BIND);
2159         return 0;
2160
2161 error:
2162         /* XXX Do we need to release all claimed endpoints here? */
2163         return ret;
2164 }
2165
2166 static int ffs_func_bind(struct usb_configuration *c,
2167                          struct usb_function *f)
2168 {
2169         struct f_fs_opts *ffs_opts = ffs_do_functionfs_bind(f, c);
2170
2171         if (IS_ERR(ffs_opts))
2172                 return PTR_ERR(ffs_opts);
2173
2174         return _ffs_func_bind(c, f);
2175 }
2176
2177
2178 /* Other USB function hooks *************************************************/
2179
2180 static int ffs_func_set_alt(struct usb_function *f,
2181                             unsigned interface, unsigned alt)
2182 {
2183         struct ffs_function *func = ffs_func_from_usb(f);
2184         struct ffs_data *ffs = func->ffs;
2185         int ret = 0, intf;
2186
2187         if (alt != (unsigned)-1) {
2188                 intf = ffs_func_revmap_intf(func, interface);
2189                 if (unlikely(intf < 0))
2190                         return intf;
2191         }
2192
2193         if (ffs->func)
2194                 ffs_func_eps_disable(ffs->func);
2195
2196         if (ffs->state != FFS_ACTIVE)
2197                 return -ENODEV;
2198
2199         if (alt == (unsigned)-1) {
2200                 ffs->func = NULL;
2201                 ffs_event_add(ffs, FUNCTIONFS_DISABLE);
2202                 return 0;
2203         }
2204
2205         ffs->func = func;
2206         ret = ffs_func_eps_enable(func);
2207         if (likely(ret >= 0))
2208                 ffs_event_add(ffs, FUNCTIONFS_ENABLE);
2209         return ret;
2210 }
2211
2212 static void ffs_func_disable(struct usb_function *f)
2213 {
2214         ffs_func_set_alt(f, 0, (unsigned)-1);
2215 }
2216
2217 static int ffs_func_setup(struct usb_function *f,
2218                           const struct usb_ctrlrequest *creq)
2219 {
2220         struct ffs_function *func = ffs_func_from_usb(f);
2221         struct ffs_data *ffs = func->ffs;
2222         unsigned long flags;
2223         int ret;
2224
2225         ENTER();
2226
2227         pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType);
2228         pr_vdebug("creq->bRequest     = %02x\n", creq->bRequest);
2229         pr_vdebug("creq->wValue       = %04x\n", le16_to_cpu(creq->wValue));
2230         pr_vdebug("creq->wIndex       = %04x\n", le16_to_cpu(creq->wIndex));
2231         pr_vdebug("creq->wLength      = %04x\n", le16_to_cpu(creq->wLength));
2232
2233         /*
2234          * Most requests directed to interface go through here
2235          * (notable exceptions are set/get interface) so we need to
2236          * handle them.  All other either handled by composite or
2237          * passed to usb_configuration->setup() (if one is set).  No
2238          * matter, we will handle requests directed to endpoint here
2239          * as well (as it's straightforward) but what to do with any
2240          * other request?
2241          */
2242         if (ffs->state != FFS_ACTIVE)
2243                 return -ENODEV;
2244
2245         switch (creq->bRequestType & USB_RECIP_MASK) {
2246         case USB_RECIP_INTERFACE:
2247                 ret = ffs_func_revmap_intf(func, le16_to_cpu(creq->wIndex));
2248                 if (unlikely(ret < 0))
2249                         return ret;
2250                 break;
2251
2252         case USB_RECIP_ENDPOINT:
2253                 ret = ffs_func_revmap_ep(func, le16_to_cpu(creq->wIndex));
2254                 if (unlikely(ret < 0))
2255                         return ret;
2256                 break;
2257
2258         default:
2259                 return -EOPNOTSUPP;
2260         }
2261
2262         spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
2263         ffs->ev.setup = *creq;
2264         ffs->ev.setup.wIndex = cpu_to_le16(ret);
2265         __ffs_event_add(ffs, FUNCTIONFS_SETUP);
2266         spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
2267
2268         return 0;
2269 }
2270
2271 static void ffs_func_suspend(struct usb_function *f)
2272 {
2273         ENTER();
2274         ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_SUSPEND);
2275 }
2276
2277 static void ffs_func_resume(struct usb_function *f)
2278 {
2279         ENTER();
2280         ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_RESUME);
2281 }
2282
2283
2284 /* Endpoint and interface numbers reverse mapping ***************************/
2285
2286 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num)
2287 {
2288         num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK];
2289         return num ? num : -EDOM;
2290 }
2291
2292 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf)
2293 {
2294         short *nums = func->interfaces_nums;
2295         unsigned count = func->ffs->interfaces_count;
2296
2297         for (; count; --count, ++nums) {
2298                 if (*nums >= 0 && *nums == intf)
2299                         return nums - func->interfaces_nums;
2300         }
2301
2302         return -EDOM;
2303 }
2304
2305
2306 /* Devices management *******************************************************/
2307
2308 static LIST_HEAD(ffs_devices);
2309
2310 static struct ffs_dev *_ffs_do_find_dev(const char *name)
2311 {
2312         struct ffs_dev *dev;
2313
2314         list_for_each_entry(dev, &ffs_devices, entry) {
2315                 if (!dev->name || !name)
2316                         continue;
2317                 if (strcmp(dev->name, name) == 0)
2318                         return dev;
2319         }
2320
2321         return NULL;
2322 }
2323
2324 /*
2325  * ffs_lock must be taken by the caller of this function
2326  */
2327 static struct ffs_dev *_ffs_get_single_dev(void)
2328 {
2329         struct ffs_dev *dev;
2330
2331         if (list_is_singular(&ffs_devices)) {
2332                 dev = list_first_entry(&ffs_devices, struct ffs_dev, entry);
2333                 if (dev->single)
2334                         return dev;
2335         }
2336
2337         return NULL;
2338 }
2339
2340 /*
2341  * ffs_lock must be taken by the caller of this function
2342  */
2343 static struct ffs_dev *_ffs_find_dev(const char *name)
2344 {
2345         struct ffs_dev *dev;
2346
2347         dev = _ffs_get_single_dev();
2348         if (dev)
2349                 return dev;
2350
2351         return _ffs_do_find_dev(name);
2352 }
2353
2354 /* Configfs support *********************************************************/
2355
2356 static inline struct f_fs_opts *to_ffs_opts(struct config_item *item)
2357 {
2358         return container_of(to_config_group(item), struct f_fs_opts,
2359                             func_inst.group);
2360 }
2361
2362 static void ffs_attr_release(struct config_item *item)
2363 {
2364         struct f_fs_opts *opts = to_ffs_opts(item);
2365
2366         usb_put_function_instance(&opts->func_inst);
2367 }
2368
2369 static struct configfs_item_operations ffs_item_ops = {
2370         .release        = ffs_attr_release,
2371 };
2372
2373 static struct config_item_type ffs_func_type = {
2374         .ct_item_ops    = &ffs_item_ops,
2375         .ct_owner       = THIS_MODULE,
2376 };
2377
2378
2379 /* Function registration interface ******************************************/
2380
2381 static void ffs_free_inst(struct usb_function_instance *f)
2382 {
2383         struct f_fs_opts *opts;
2384
2385         opts = to_f_fs_opts(f);
2386         ffs_dev_lock();
2387         _ffs_free_dev(opts->dev);
2388         ffs_dev_unlock();
2389         kfree(opts);
2390 }
2391
2392 #define MAX_INST_NAME_LEN       40
2393
2394 static int ffs_set_inst_name(struct usb_function_instance *fi, const char *name)
2395 {
2396         struct f_fs_opts *opts;
2397         char *ptr;
2398         const char *tmp;
2399         int name_len, ret;
2400
2401         name_len = strlen(name) + 1;
2402         if (name_len > MAX_INST_NAME_LEN)
2403                 return -ENAMETOOLONG;
2404
2405         ptr = kstrndup(name, name_len, GFP_KERNEL);
2406         if (!ptr)
2407                 return -ENOMEM;
2408
2409         opts = to_f_fs_opts(fi);
2410         tmp = NULL;
2411
2412         ffs_dev_lock();
2413
2414         tmp = opts->dev->name_allocated ? opts->dev->name : NULL;
2415         ret = _ffs_name_dev(opts->dev, ptr);
2416         if (ret) {
2417                 kfree(ptr);
2418                 ffs_dev_unlock();
2419                 return ret;
2420         }
2421         opts->dev->name_allocated = true;
2422
2423         ffs_dev_unlock();
2424
2425         kfree(tmp);
2426
2427         return 0;
2428 }
2429
2430 static struct usb_function_instance *ffs_alloc_inst(void)
2431 {
2432         struct f_fs_opts *opts;
2433         struct ffs_dev *dev;
2434
2435         opts = kzalloc(sizeof(*opts), GFP_KERNEL);
2436         if (!opts)
2437                 return ERR_PTR(-ENOMEM);
2438
2439         opts->func_inst.set_inst_name = ffs_set_inst_name;
2440         opts->func_inst.free_func_inst = ffs_free_inst;
2441         ffs_dev_lock();
2442         dev = _ffs_alloc_dev();
2443         ffs_dev_unlock();
2444         if (IS_ERR(dev)) {
2445                 kfree(opts);
2446                 return ERR_CAST(dev);
2447         }
2448         opts->dev = dev;
2449         dev->opts = opts;
2450
2451         config_group_init_type_name(&opts->func_inst.group, "",
2452                                     &ffs_func_type);
2453         return &opts->func_inst;
2454 }
2455
2456 static void ffs_free(struct usb_function *f)
2457 {
2458         kfree(ffs_func_from_usb(f));
2459 }
2460
2461 static void ffs_func_unbind(struct usb_configuration *c,
2462                             struct usb_function *f)
2463 {
2464         struct ffs_function *func = ffs_func_from_usb(f);
2465         struct ffs_data *ffs = func->ffs;
2466         struct f_fs_opts *opts =
2467                 container_of(f->fi, struct f_fs_opts, func_inst);
2468         struct ffs_ep *ep = func->eps;
2469         unsigned count = ffs->eps_count;
2470         unsigned long flags;
2471
2472         ENTER();
2473         if (ffs->func == func) {
2474                 ffs_func_eps_disable(func);
2475                 ffs->func = NULL;
2476         }
2477
2478         if (!--opts->refcnt)
2479                 functionfs_unbind(ffs);
2480
2481         /* cleanup after autoconfig */
2482         spin_lock_irqsave(&func->ffs->eps_lock, flags);
2483         do {
2484                 if (ep->ep && ep->req)
2485                         usb_ep_free_request(ep->ep, ep->req);
2486                 ep->req = NULL;
2487                 ++ep;
2488         } while (--count);
2489         spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
2490         kfree(func->eps);
2491         func->eps = NULL;
2492         /*
2493          * eps, descriptors and interfaces_nums are allocated in the
2494          * same chunk so only one free is required.
2495          */
2496         func->function.fs_descriptors = NULL;
2497         func->function.hs_descriptors = NULL;
2498         func->interfaces_nums = NULL;
2499
2500         ffs_event_add(ffs, FUNCTIONFS_UNBIND);
2501 }
2502
2503 static struct usb_function *ffs_alloc(struct usb_function_instance *fi)
2504 {
2505         struct ffs_function *func;
2506
2507         ENTER();
2508
2509         func = kzalloc(sizeof(*func), GFP_KERNEL);
2510         if (unlikely(!func))
2511                 return ERR_PTR(-ENOMEM);
2512
2513         func->function.name    = "Function FS Gadget";
2514
2515         func->function.bind    = ffs_func_bind;
2516         func->function.unbind  = ffs_func_unbind;
2517         func->function.set_alt = ffs_func_set_alt;
2518         func->function.disable = ffs_func_disable;
2519         func->function.setup   = ffs_func_setup;
2520         func->function.suspend = ffs_func_suspend;
2521         func->function.resume  = ffs_func_resume;
2522         func->function.free_func = ffs_free;
2523
2524         return &func->function;
2525 }
2526
2527 /*
2528  * ffs_lock must be taken by the caller of this function
2529  */
2530 static struct ffs_dev *_ffs_alloc_dev(void)
2531 {
2532         struct ffs_dev *dev;
2533         int ret;
2534
2535         if (_ffs_get_single_dev())
2536                         return ERR_PTR(-EBUSY);
2537
2538         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2539         if (!dev)
2540                 return ERR_PTR(-ENOMEM);
2541
2542         if (list_empty(&ffs_devices)) {
2543                 ret = functionfs_init();
2544                 if (ret) {
2545                         kfree(dev);
2546                         return ERR_PTR(ret);
2547                 }
2548         }
2549
2550         list_add(&dev->entry, &ffs_devices);
2551
2552         return dev;
2553 }
2554
2555 /*
2556  * ffs_lock must be taken by the caller of this function
2557  * The caller is responsible for "name" being available whenever f_fs needs it
2558  */
2559 static int _ffs_name_dev(struct ffs_dev *dev, const char *name)
2560 {
2561         struct ffs_dev *existing;
2562
2563         existing = _ffs_do_find_dev(name);
2564         if (existing)
2565                 return -EBUSY;
2566
2567         dev->name = name;
2568
2569         return 0;
2570 }
2571
2572 /*
2573  * The caller is responsible for "name" being available whenever f_fs needs it
2574  */
2575 int ffs_name_dev(struct ffs_dev *dev, const char *name)
2576 {
2577         int ret;
2578
2579         ffs_dev_lock();
2580         ret = _ffs_name_dev(dev, name);
2581         ffs_dev_unlock();
2582
2583         return ret;
2584 }
2585 EXPORT_SYMBOL(ffs_name_dev);
2586
2587 int ffs_single_dev(struct ffs_dev *dev)
2588 {
2589         int ret;
2590
2591         ret = 0;
2592         ffs_dev_lock();
2593
2594         if (!list_is_singular(&ffs_devices))
2595                 ret = -EBUSY;
2596         else
2597                 dev->single = true;
2598
2599         ffs_dev_unlock();
2600         return ret;
2601 }
2602 EXPORT_SYMBOL(ffs_single_dev);
2603
2604 /*
2605  * ffs_lock must be taken by the caller of this function
2606  */
2607 static void _ffs_free_dev(struct ffs_dev *dev)
2608 {
2609         list_del(&dev->entry);
2610         if (dev->name_allocated)
2611                 kfree(dev->name);
2612         kfree(dev);
2613         if (list_empty(&ffs_devices))
2614                 functionfs_cleanup();
2615 }
2616
2617 static void *ffs_acquire_dev(const char *dev_name)
2618 {
2619         struct ffs_dev *ffs_dev;
2620
2621         ENTER();
2622         ffs_dev_lock();
2623
2624         ffs_dev = _ffs_find_dev(dev_name);
2625         if (!ffs_dev)
2626                 ffs_dev = ERR_PTR(-ENODEV);
2627         else if (ffs_dev->mounted)
2628                 ffs_dev = ERR_PTR(-EBUSY);
2629         else if (ffs_dev->ffs_acquire_dev_callback &&
2630             ffs_dev->ffs_acquire_dev_callback(ffs_dev))
2631                 ffs_dev = ERR_PTR(-ENODEV);
2632         else
2633                 ffs_dev->mounted = true;
2634
2635         ffs_dev_unlock();
2636         return ffs_dev;
2637 }
2638
2639 static void ffs_release_dev(struct ffs_data *ffs_data)
2640 {
2641         struct ffs_dev *ffs_dev;
2642
2643         ENTER();
2644         ffs_dev_lock();
2645
2646         ffs_dev = ffs_data->private_data;
2647         if (ffs_dev) {
2648                 ffs_dev->mounted = false;
2649
2650                 if (ffs_dev->ffs_release_dev_callback)
2651                         ffs_dev->ffs_release_dev_callback(ffs_dev);
2652         }
2653
2654         ffs_dev_unlock();
2655 }
2656
2657 static int ffs_ready(struct ffs_data *ffs)
2658 {
2659         struct ffs_dev *ffs_obj;
2660         int ret = 0;
2661
2662         ENTER();
2663         ffs_dev_lock();
2664
2665         ffs_obj = ffs->private_data;
2666         if (!ffs_obj) {
2667                 ret = -EINVAL;
2668                 goto done;
2669         }
2670         if (WARN_ON(ffs_obj->desc_ready)) {
2671                 ret = -EBUSY;
2672                 goto done;
2673         }
2674
2675         ffs_obj->desc_ready = true;
2676         ffs_obj->ffs_data = ffs;
2677
2678         if (ffs_obj->ffs_ready_callback)
2679                 ret = ffs_obj->ffs_ready_callback(ffs);
2680
2681 done:
2682         ffs_dev_unlock();
2683         return ret;
2684 }
2685
2686 static void ffs_closed(struct ffs_data *ffs)
2687 {
2688         struct ffs_dev *ffs_obj;
2689
2690         ENTER();
2691         ffs_dev_lock();
2692
2693         ffs_obj = ffs->private_data;
2694         if (!ffs_obj)
2695                 goto done;
2696
2697         ffs_obj->desc_ready = false;
2698
2699         if (ffs_obj->ffs_closed_callback)
2700                 ffs_obj->ffs_closed_callback(ffs);
2701
2702         if (!ffs_obj->opts || ffs_obj->opts->no_configfs
2703             || !ffs_obj->opts->func_inst.group.cg_item.ci_parent)
2704                 goto done;
2705
2706         unregister_gadget_item(ffs_obj->opts->
2707                                func_inst.group.cg_item.ci_parent->ci_parent);
2708 done:
2709         ffs_dev_unlock();
2710 }
2711
2712 /* Misc helper functions ****************************************************/
2713
2714 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
2715 {
2716         return nonblock
2717                 ? likely(mutex_trylock(mutex)) ? 0 : -EAGAIN
2718                 : mutex_lock_interruptible(mutex);
2719 }
2720
2721 static char *ffs_prepare_buffer(const char __user *buf, size_t len)
2722 {
2723         char *data;
2724
2725         if (unlikely(!len))
2726                 return NULL;
2727
2728         data = kmalloc(len, GFP_KERNEL);
2729         if (unlikely(!data))
2730                 return ERR_PTR(-ENOMEM);
2731
2732         if (unlikely(__copy_from_user(data, buf, len))) {
2733                 kfree(data);
2734                 return ERR_PTR(-EFAULT);
2735         }
2736
2737         pr_vdebug("Buffer from user space:\n");
2738         ffs_dump_mem("", data, len);
2739
2740         return data;
2741 }
2742
2743 DECLARE_USB_FUNCTION_INIT(ffs, ffs_alloc_inst, ffs_alloc);
2744 MODULE_LICENSE("GPL");
2745 MODULE_AUTHOR("Michal Nazarewicz");