drivers/usb/gadget/function/f_fs.c

   1 /*
   2  * f_fs.c -- user mode file system API for USB composite function controllers
   3  *
   4  * Copyright (C) 2010 Samsung Electronics
   5  * Author: Michal Nazarewicz <mina86@mina86.com>
   6  *
   7  * Based on inode.c (GadgetFS) which was:
   8  * Copyright (C) 2003-2004 David Brownell
   9  * Copyright (C) 2003 Agilent Technologies
  10  *
  11  * This program is free software; you can redistribute it and/or modify
  12  * it under the terms of the GNU General Public License as published by
  13  * the Free Software Foundation; either version 2 of the License, or
  14  * (at your option) any later version.
  15  */
  16
  17
  18 /* #define DEBUG */
  19 /* #define VERBOSE_DEBUG */
  20
  21 #include <linux/blkdev.h>
  22 #include <linux/pagemap.h>
  23 #include <linux/export.h>
  24 #include <linux/hid.h>
  25 #include <linux/module.h>
  26 #include <linux/uio.h>
  27 #include <asm/unaligned.h>
  28
  29 #include <linux/usb/composite.h>
  30 #include <linux/usb/functionfs.h>
  31
  32 #include <linux/aio.h>
  33 #include <linux/mmu_context.h>
  34 #include <linux/poll.h>
  35 #include <linux/eventfd.h>
  36
  37 #include "u_fs.h"
  38 #include "u_f.h"
  39 #include "u_os_desc.h"
  40 #include "configfs.h"
  41
  42 #define FUNCTIONFS_MAGIC        0xa647361 /* Chosen by a honest dice roll ;) */
  43
  44 /* Reference counter handling */
  45 static void ffs_data_get(struct ffs_data *ffs);
  46 static void ffs_data_put(struct ffs_data *ffs);
  47 /* Creates new ffs_data object. */
  48 static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc));
  49
  50 /* Opened counter handling. */
  51 static void ffs_data_opened(struct ffs_data *ffs);
  52 static void ffs_data_closed(struct ffs_data *ffs);
  53
  54 /* Called with ffs->mutex held; take over ownership of data. */
  55 static int __must_check
  56 __ffs_data_got_descs(struct ffs_data *ffs, char *data, size_t len);
  57 static int __must_check
  58 __ffs_data_got_strings(struct ffs_data *ffs, char *data, size_t len);
  59
  60
  61 /* The function structure ***************************************************/
  62
  63 struct ffs_ep;
  64
  65 struct ffs_function {
  66         struct usb_configuration        *conf;
  67         struct usb_gadget               *gadget;
  68         struct ffs_data                 *ffs;
  69
  70         struct ffs_ep                   *eps;
  71         u8                              eps_revmap[16];
  72         short                           *interfaces_nums;
  73
  74         struct usb_function             function;
  75 };
  76
  77
  78 static struct ffs_function *ffs_func_from_usb(struct usb_function *f)
  79 {
  80         return container_of(f, struct ffs_function, function);
  81 }
  82
  83
  84 static inline enum ffs_setup_state
  85 ffs_setup_state_clear_cancelled(struct ffs_data *ffs)
  86 {
  87         return (enum ffs_setup_state)
  88                 cmpxchg(&ffs->setup_state, FFS_SETUP_CANCELLED, FFS_NO_SETUP);
  89 }
  90
  91
  92 static void ffs_func_eps_disable(struct ffs_function *func);
  93 static int __must_check ffs_func_eps_enable(struct ffs_function *func);
  94
  95 static int ffs_func_bind(struct usb_configuration *,
  96                          struct usb_function *);
  97 static int ffs_func_set_alt(struct usb_function *, unsigned, unsigned);
  98 static void ffs_func_disable(struct usb_function *);
  99 static int ffs_func_setup(struct usb_function *,
 100                           const struct usb_ctrlrequest *);
 101 static bool ffs_func_req_match(struct usb_function *,
 102                                const struct usb_ctrlrequest *,
 103                                bool config0);
 104 static void ffs_func_suspend(struct usb_function *);
 105 static void ffs_func_resume(struct usb_function *);
 106
 107
 108 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num);
 109 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf);
 110
 111
 112 /* The endpoints structures *************************************************/
 113
 114 struct ffs_ep {
 115         struct usb_ep                   *ep;    /* P: ffs->eps_lock */
 116         struct usb_request              *req;   /* P: epfile->mutex */
 117
 118         /* [0]: full speed, [1]: high speed, [2]: super speed */
 119         struct usb_endpoint_descriptor  *descs[3];
 120
 121         u8                              num;
 122
 123         int                             status; /* P: epfile->mutex */
 124 };
 125
 126 struct ffs_epfile {
 127         /* Protects ep->ep and ep->req. */
 128         struct mutex                    mutex;
 129         wait_queue_head_t               wait;
 130
 131         struct ffs_data                 *ffs;
 132         struct ffs_ep                   *ep;    /* P: ffs->eps_lock */
 133
 134         struct dentry                   *dentry;
 135
 136         /*
 137          * Buffer for holding data from partial reads which may happen since
 138          * we’re rounding user read requests to a multiple of a max packet size.
 139          */
 140         struct ffs_buffer               *read_buffer;   /* P: epfile->mutex */
 141
 142         char                            name[5];
 143
 144         unsigned char                   in;     /* P: ffs->eps_lock */
 145         unsigned char                   isoc;   /* P: ffs->eps_lock */
 146
 147         unsigned char                   _pad;
 148 };
 149
 150 struct ffs_buffer {
 151         size_t length;
 152         char *data;
 153         char storage[];
 154 };
 155
 156 /*  ffs_io_data structure ***************************************************/
 157
 158 struct ffs_io_data {
 159         bool aio;
 160         bool read;
 161
 162         struct kiocb *kiocb;
 163         struct iov_iter data;
 164         const void *to_free;
 165         char *buf;
 166
 167         struct mm_struct *mm;
 168         struct work_struct work;
 169
 170         struct usb_ep *ep;
 171         struct usb_request *req;
 172
 173         struct ffs_data *ffs;
 174 };
 175
 176 struct ffs_desc_helper {
 177         struct ffs_data *ffs;
 178         unsigned interfaces_count;
 179         unsigned eps_count;
 180 };
 181
 182 static int  __must_check ffs_epfiles_create(struct ffs_data *ffs);
 183 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count);
 184
 185 static struct dentry *
 186 ffs_sb_create_file(struct super_block *sb, const char *name, void *data,
 187                    const struct file_operations *fops);
 188
 189 /* Devices management *******************************************************/
 190
 191 DEFINE_MUTEX(ffs_lock);
 192 EXPORT_SYMBOL_GPL(ffs_lock);
 193
 194 static struct ffs_dev *_ffs_find_dev(const char *name);
 195 static struct ffs_dev *_ffs_alloc_dev(void);
 196 static int _ffs_name_dev(struct ffs_dev *dev, const char *name);
 197 static void _ffs_free_dev(struct ffs_dev *dev);
 198 static void *ffs_acquire_dev(const char *dev_name);
 199 static void ffs_release_dev(struct ffs_data *ffs_data);
 200 static int ffs_ready(struct ffs_data *ffs);
 201 static void ffs_closed(struct ffs_data *ffs);
 202
 203 /* Misc helper functions ****************************************************/
 204
 205 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
 206         __attribute__((warn_unused_result, nonnull));
 207 static char *ffs_prepare_buffer(const char __user *buf, size_t len)
 208         __attribute__((warn_unused_result, nonnull));
 209
 210
 211 /* Control file aka ep0 *****************************************************/
 212
 213 static void ffs_ep0_complete(struct usb_ep *ep, struct usb_request *req)
 214 {
 215         struct ffs_data *ffs = req->context;
 216
 217         complete_all(&ffs->ep0req_completion);
 218 }
 219
 220 static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
 221 {
 222         struct usb_request *req = ffs->ep0req;
 223         int ret;
 224
 225         req->zero     = len < le16_to_cpu(ffs->ev.setup.wLength);
 226
 227         spin_unlock_irq(&ffs->ev.waitq.lock);
 228
 229         req->buf      = data;
 230         req->length   = len;
 231
 232         /*
 233          * UDC layer requires to provide a buffer even for ZLP, but should
 234          * not use it at all. Let's provide some poisoned pointer to catch
 235          * possible bug in the driver.
 236          */
 237         if (req->buf == NULL)
 238                 req->buf = (void *)0xDEADBABE;
 239
 240         reinit_completion(&ffs->ep0req_completion);
 241
 242         ret = usb_ep_queue(ffs->gadget->ep0, req, GFP_ATOMIC);
 243         if (unlikely(ret < 0))
 244                 return ret;
 245
 246         ret = wait_for_completion_interruptible(&ffs->ep0req_completion);
 247         if (unlikely(ret)) {
 248                 usb_ep_dequeue(ffs->gadget->ep0, req);
 249                 return -EINTR;
 250         }
 251
 252         ffs->setup_state = FFS_NO_SETUP;
 253         return req->status ? req->status : req->actual;
 254 }
 255
 256 static int __ffs_ep0_stall(struct ffs_data *ffs)
 257 {
 258         if (ffs->ev.can_stall) {
 259                 pr_vdebug("ep0 stall\n");
 260                 usb_ep_set_halt(ffs->gadget->ep0);
 261                 ffs->setup_state = FFS_NO_SETUP;
 262                 return -EL2HLT;
 263         } else {
 264                 pr_debug("bogus ep0 stall!\n");
 265                 return -ESRCH;
 266         }
 267 }
 268
 269 static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
 270                              size_t len, loff_t *ptr)
 271 {
 272         struct ffs_data *ffs = file->private_data;
 273         ssize_t ret;
 274         char *data;
 275
 276         ENTER();
 277
 278         /* Fast check if setup was canceled */
 279         if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
 280                 return -EIDRM;
 281
 282         /* Acquire mutex */
 283         ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
 284         if (unlikely(ret < 0))
 285                 return ret;
 286
 287         /* Check state */
 288         switch (ffs->state) {
 289         case FFS_READ_DESCRIPTORS:
 290         case FFS_READ_STRINGS:
 291                 /* Copy data */
 292                 if (unlikely(len < 16)) {
 293                         ret = -EINVAL;
 294                         break;
 295                 }
 296
 297                 data = ffs_prepare_buffer(buf, len);
 298                 if (IS_ERR(data)) {
 299                         ret = PTR_ERR(data);
 300                         break;
 301                 }
 302
 303                 /* Handle data */
 304                 if (ffs->state == FFS_READ_DESCRIPTORS) {
 305                         pr_info("read descriptors\n");
 306                         ret = __ffs_data_got_descs(ffs, data, len);
 307                         if (unlikely(ret < 0))
 308                                 break;
 309
 310                         ffs->state = FFS_READ_STRINGS;
 311                         ret = len;
 312                 } else {
 313                         pr_info("read strings\n");
 314                         ret = __ffs_data_got_strings(ffs, data, len);
 315                         if (unlikely(ret < 0))
 316                                 break;
 317
 318                         ret = ffs_epfiles_create(ffs);
 319                         if (unlikely(ret)) {
 320                                 ffs->state = FFS_CLOSING;
 321                                 break;
 322                         }
 323
 324                         ffs->state = FFS_ACTIVE;
 325                         mutex_unlock(&ffs->mutex);
 326
 327                         ret = ffs_ready(ffs);
 328                         if (unlikely(ret < 0)) {
 329                                 ffs->state = FFS_CLOSING;
 330                                 return ret;
 331                         }
 332
 333                         return len;
 334                 }
 335                 break;
 336
 337         case FFS_ACTIVE:
 338                 data = NULL;
 339                 /*
 340                  * We're called from user space, we can use _irq
 341                  * rather then _irqsave
 342                  */
 343                 spin_lock_irq(&ffs->ev.waitq.lock);
 344                 switch (ffs_setup_state_clear_cancelled(ffs)) {
 345                 case FFS_SETUP_CANCELLED:
 346                         ret = -EIDRM;
 347                         goto done_spin;
 348
 349                 case FFS_NO_SETUP:
 350                         ret = -ESRCH;
 351                         goto done_spin;
 352
 353                 case FFS_SETUP_PENDING:
 354                         break;
 355                 }
 356
 357                 /* FFS_SETUP_PENDING */
 358                 if (!(ffs->ev.setup.bRequestType & USB_DIR_IN)) {
 359                         spin_unlock_irq(&ffs->ev.waitq.lock);
 360                         ret = __ffs_ep0_stall(ffs);
 361                         break;
 362                 }
 363
 364                 /* FFS_SETUP_PENDING and not stall */
 365                 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength));
 366
 367                 spin_unlock_irq(&ffs->ev.waitq.lock);
 368
 369                 data = ffs_prepare_buffer(buf, len);
 370                 if (IS_ERR(data)) {
 371                         ret = PTR_ERR(data);
 372                         break;
 373                 }
 374
 375                 spin_lock_irq(&ffs->ev.waitq.lock);
 376
 377                 /*
 378                  * We are guaranteed to be still in FFS_ACTIVE state
 379                  * but the state of setup could have changed from
 380                  * FFS_SETUP_PENDING to FFS_SETUP_CANCELLED so we need
 381                  * to check for that.  If that happened we copied data
 382                  * from user space in vain but it's unlikely.
 383                  *
 384                  * For sure we are not in FFS_NO_SETUP since this is
 385                  * the only place FFS_SETUP_PENDING -> FFS_NO_SETUP
 386                  * transition can be performed and it's protected by
 387                  * mutex.
 388                  */
 389                 if (ffs_setup_state_clear_cancelled(ffs) ==
 390                     FFS_SETUP_CANCELLED) {
 391                         ret = -EIDRM;
 392 done_spin:
 393                         spin_unlock_irq(&ffs->ev.waitq.lock);
 394                 } else {
 395                         /* unlocks spinlock */
 396                         ret = __ffs_ep0_queue_wait(ffs, data, len);
 397                 }
 398                 kfree(data);
 399                 break;
 400
 401         default:
 402                 ret = -EBADFD;
 403                 break;
 404         }
 405
 406         mutex_unlock(&ffs->mutex);
 407         return ret;
 408 }
 409
 410 /* Called with ffs->ev.waitq.lock and ffs->mutex held, both released on exit. */
 411 static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
 412                                      size_t n)
 413 {
 414         /*
 415          * n cannot be bigger than ffs->ev.count, which cannot be bigger than
 416          * size of ffs->ev.types array (which is four) so that's how much space
 417          * we reserve.
 418          */
 419         struct usb_functionfs_event events[ARRAY_SIZE(ffs->ev.types)];
 420         const size_t size = n * sizeof *events;
 421         unsigned i = 0;
 422
 423         memset(events, 0, size);
 424
 425         do {
 426                 events[i].type = ffs->ev.types[i];
 427                 if (events[i].type == FUNCTIONFS_SETUP) {
 428                         events[i].u.setup = ffs->ev.setup;
 429                         ffs->setup_state = FFS_SETUP_PENDING;
 430                 }
 431         } while (++i < n);
 432
 433         ffs->ev.count -= n;
 434         if (ffs->ev.count)
 435                 memmove(ffs->ev.types, ffs->ev.types + n,
 436                         ffs->ev.count * sizeof *ffs->ev.types);
 437
 438         spin_unlock_irq(&ffs->ev.waitq.lock);
 439         mutex_unlock(&ffs->mutex);
 440
 441         return unlikely(copy_to_user(buf, events, size)) ? -EFAULT : size;
 442 }
 443
 444 static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
 445                             size_t len, loff_t *ptr)
 446 {
 447         struct ffs_data *ffs = file->private_data;
 448         char *data = NULL;
 449         size_t n;
 450         int ret;
 451
 452         ENTER();
 453
 454         /* Fast check if setup was canceled */
 455         if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
 456                 return -EIDRM;
 457
 458         /* Acquire mutex */
 459         ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
 460         if (unlikely(ret < 0))
 461                 return ret;
 462
 463         /* Check state */
 464         if (ffs->state != FFS_ACTIVE) {
 465                 ret = -EBADFD;
 466                 goto done_mutex;
 467         }
 468
 469         /*
 470          * We're called from user space, we can use _irq rather then
 471          * _irqsave
 472          */
 473         spin_lock_irq(&ffs->ev.waitq.lock);
 474
 475         switch (ffs_setup_state_clear_cancelled(ffs)) {
 476         case FFS_SETUP_CANCELLED:
 477                 ret = -EIDRM;
 478                 break;
 479
 480         case FFS_NO_SETUP:
 481                 n = len / sizeof(struct usb_functionfs_event);
 482                 if (unlikely(!n)) {
 483                         ret = -EINVAL;
 484                         break;
 485                 }
 486
 487                 if ((file->f_flags & O_NONBLOCK) && !ffs->ev.count) {
 488                         ret = -EAGAIN;
 489                         break;
 490                 }
 491
 492                 if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq,
 493                                                         ffs->ev.count)) {
 494                         ret = -EINTR;
 495                         break;
 496                 }
 497
 498                 return __ffs_ep0_read_events(ffs, buf,
 499                                              min(n, (size_t)ffs->ev.count));
 500
 501         case FFS_SETUP_PENDING:
 502                 if (ffs->ev.setup.bRequestType & USB_DIR_IN) {
 503                         spin_unlock_irq(&ffs->ev.waitq.lock);
 504                         ret = __ffs_ep0_stall(ffs);
 505                         goto done_mutex;
 506                 }
 507
 508                 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength));
 509
 510                 spin_unlock_irq(&ffs->ev.waitq.lock);
 511
 512                 if (likely(len)) {
 513                         data = kmalloc(len, GFP_KERNEL);
 514                         if (unlikely(!data)) {
 515                                 ret = -ENOMEM;
 516                                 goto done_mutex;
 517                         }
 518                 }
 519
 520                 spin_lock_irq(&ffs->ev.waitq.lock);
 521
 522                 /* See ffs_ep0_write() */
 523                 if (ffs_setup_state_clear_cancelled(ffs) ==
 524                     FFS_SETUP_CANCELLED) {
 525                         ret = -EIDRM;
 526                         break;
 527                 }
 528
 529                 /* unlocks spinlock */
 530                 ret = __ffs_ep0_queue_wait(ffs, data, len);
 531                 if (likely(ret > 0) && unlikely(copy_to_user(buf, data, len)))
 532                         ret = -EFAULT;
 533                 goto done_mutex;
 534
 535         default:
 536                 ret = -EBADFD;
 537                 break;
 538         }
 539
 540         spin_unlock_irq(&ffs->ev.waitq.lock);
 541 done_mutex:
 542         mutex_unlock(&ffs->mutex);
 543         kfree(data);
 544         return ret;
 545 }
 546
 547 static int ffs_ep0_open(struct inode *inode, struct file *file)
 548 {
 549         struct ffs_data *ffs = inode->i_private;
 550
 551         ENTER();
 552
 553         if (unlikely(ffs->state == FFS_CLOSING))
 554                 return -EBUSY;
 555
 556         file->private_data = ffs;
 557         ffs_data_opened(ffs);
 558
 559         return 0;
 560 }
 561
 562 static int ffs_ep0_release(struct inode *inode, struct file *file)
 563 {
 564         struct ffs_data *ffs = file->private_data;
 565
 566         ENTER();
 567
 568         ffs_data_closed(ffs);
 569
 570         return 0;
 571 }
 572
 573 static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
 574 {
 575         struct ffs_data *ffs = file->private_data;
 576         struct usb_gadget *gadget = ffs->gadget;
 577         long ret;
 578
 579         ENTER();
 580
 581         if (code == FUNCTIONFS_INTERFACE_REVMAP) {
 582                 struct ffs_function *func = ffs->func;
 583                 ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
 584         } else if (gadget && gadget->ops->ioctl) {
 585                 ret = gadget->ops->ioctl(gadget, code, value);
 586         } else {
 587                 ret = -ENOTTY;
 588         }
 589
 590         return ret;
 591 }
 592
 593 static unsigned int ffs_ep0_poll(struct file *file, poll_table *wait)
 594 {
 595         struct ffs_data *ffs = file->private_data;
 596         unsigned int mask = POLLWRNORM;
 597         int ret;
 598
 599         poll_wait(file, &ffs->ev.waitq, wait);
 600
 601         ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
 602         if (unlikely(ret < 0))
 603                 return mask;
 604
 605         switch (ffs->state) {
 606         case FFS_READ_DESCRIPTORS:
 607         case FFS_READ_STRINGS:
 608                 mask |= POLLOUT;
 609                 break;
 610
 611         case FFS_ACTIVE:
 612                 switch (ffs->setup_state) {
 613                 case FFS_NO_SETUP:
 614                         if (ffs->ev.count)
 615                                 mask |= POLLIN;
 616                         break;
 617
 618                 case FFS_SETUP_PENDING:
 619                 case FFS_SETUP_CANCELLED:
 620                         mask |= (POLLIN | POLLOUT);
 621                         break;
 622                 }
 623         case FFS_CLOSING:
 624                 break;
 625         case FFS_DEACTIVATED:
 626                 break;
 627         }
 628
 629         mutex_unlock(&ffs->mutex);
 630
 631         return mask;
 632 }
 633
 634 static const struct file_operations ffs_ep0_operations = {
 635         .llseek =       no_llseek,
 636
 637         .open =         ffs_ep0_open,
 638         .write =        ffs_ep0_write,
 639         .read =         ffs_ep0_read,
 640         .release =      ffs_ep0_release,
 641         .unlocked_ioctl =       ffs_ep0_ioctl,
 642         .poll =         ffs_ep0_poll,
 643 };
 644
 645
 646 /* "Normal" endpoints operations ********************************************/
 647
 648 static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req)
 649 {
 650         ENTER();
 651         if (likely(req->context)) {
 652                 struct ffs_ep *ep = _ep->driver_data;
 653                 ep->status = req->status ? req->status : req->actual;
 654                 complete(req->context);
 655         }
 656 }
 657
 658 static ssize_t ffs_copy_to_iter(void *data, int data_len, struct iov_iter *iter)
 659 {
 660         ssize_t ret = copy_to_iter(data, data_len, iter);
 661         if (likely(ret == data_len))
 662                 return ret;
 663
 664         if (unlikely(iov_iter_count(iter)))
 665                 return -EFAULT;
 666
 667         /*
 668          * Dear user space developer!
 669          *
 670          * TL;DR: To stop getting below error message in your kernel log, change
 671          * user space code using functionfs to align read buffers to a max
 672          * packet size.
 673          *
 674          * Some UDCs (e.g. dwc3) require request sizes to be a multiple of a max
 675          * packet size.  When unaligned buffer is passed to functionfs, it
 676          * internally uses a larger, aligned buffer so that such UDCs are happy.
 677          *
 678          * Unfortunately, this means that host may send more data than was
 679          * requested in read(2) system call.  f_fs doesn’t know what to do with
 680          * that excess data so it simply drops it.
 681          *
 682          * Was the buffer aligned in the first place, no such problem would
 683          * happen.
 684          *
 685          * Data may be dropped only in AIO reads.  Synchronous reads are handled
 686          * by splitting a request into multiple parts.  This splitting may still
 687          * be a problem though so it’s likely best to align the buffer
 688          * regardless of it being AIO or not..
 689          *
 690          * This only affects OUT endpoints, i.e. reading data with a read(2),
 691          * aio_read(2) etc. system calls.  Writing data to an IN endpoint is not
 692          * affected.
 693          */
 694         pr_err("functionfs read size %d > requested size %zd, dropping excess data. "
 695                "Align read buffer size to max packet size to avoid the problem.\n",
 696                data_len, ret);
 697
 698         return ret;
 699 }
 700
 701 static void ffs_user_copy_worker(struct work_struct *work)
 702 {
 703         struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
 704                                                    work);
 705         int ret = io_data->req->status ? io_data->req->status :
 706                                          io_data->req->actual;
 707         bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD;
 708
 709         if (io_data->read && ret > 0) {
 710                 use_mm(io_data->mm);
 711                 ret = ffs_copy_to_iter(io_data->buf, ret, &io_data->data);
 712                 unuse_mm(io_data->mm);
 713         }
 714
 715         io_data->kiocb->ki_complete(io_data->kiocb, ret, ret);
 716
 717         if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd)
 718                 eventfd_signal(io_data->ffs->ffs_eventfd, 1);
 719
 720         usb_ep_free_request(io_data->ep, io_data->req);
 721
 722         if (io_data->read)
 723                 kfree(io_data->to_free);
 724         kfree(io_data->buf);
 725         kfree(io_data);
 726 }
 727
 728 static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
 729                                          struct usb_request *req)
 730 {
 731         struct ffs_io_data *io_data = req->context;
 732
 733         ENTER();
 734
 735         INIT_WORK(&io_data->work, ffs_user_copy_worker);
 736         schedule_work(&io_data->work);
 737 }
 738
 739 /* Assumes epfile->mutex is held. */
 740 static ssize_t __ffs_epfile_read_buffered(struct ffs_epfile *epfile,
 741                                           struct iov_iter *iter)
 742 {
 743         struct ffs_buffer *buf = epfile->read_buffer;
 744         ssize_t ret;
 745         if (!buf)
 746                 return 0;
 747
 748         ret = copy_to_iter(buf->data, buf->length, iter);
 749         if (buf->length == ret) {
 750                 kfree(buf);
 751                 epfile->read_buffer = NULL;
 752         } else if (unlikely(iov_iter_count(iter))) {
 753                 ret = -EFAULT;
 754         } else {
 755                 buf->length -= ret;
 756                 buf->data += ret;
 757         }
 758         return ret;
 759 }
 760
 761 /* Assumes epfile->mutex is held. */
 762 static ssize_t __ffs_epfile_read_data(struct ffs_epfile *epfile,
 763                                       void *data, int data_len,
 764                                       struct iov_iter *iter)
 765 {
 766         struct ffs_buffer *buf;
 767
 768         ssize_t ret = copy_to_iter(data, data_len, iter);
 769         if (likely(data_len == ret))
 770                 return ret;
 771
 772         if (unlikely(iov_iter_count(iter)))
 773                 return -EFAULT;
 774
 775         /* See ffs_copy_to_iter for more context. */
 776         pr_warn("functionfs read size %d > requested size %zd, splitting request into multiple reads.",
 777                 data_len, ret);
 778
 779         data_len -= ret;
 780         buf = kmalloc(sizeof(*buf) + data_len, GFP_KERNEL);
 781         if (!buf)
 782                 return -ENOMEM;
 783         buf->length = data_len;
 784         buf->data = buf->storage;
 785         memcpy(buf->storage, data + ret, data_len);
 786         epfile->read_buffer = buf;
 787
 788         return ret;
 789 }
 790
 791 static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
 792 {
 793         struct ffs_epfile *epfile = file->private_data;
 794         struct usb_request *req;
 795         struct ffs_ep *ep;
 796         char *data = NULL;
 797         ssize_t ret, data_len = -EINVAL;
 798         int halt;
 799
 800         /* Are we still active? */
 801         if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
 802                 return -ENODEV;
 803
 804         /* Wait for endpoint to be enabled */
 805         ep = epfile->ep;
 806         if (!ep) {
 807                 if (file->f_flags & O_NONBLOCK)
 808                         return -EAGAIN;
 809
 810                 ret = wait_event_interruptible(epfile->wait, (ep = epfile->ep));
 811                 if (ret)
 812                         return -EINTR;
 813         }
 814
 815         /* Do we halt? */
 816         halt = (!io_data->read == !epfile->in);
 817         if (halt && epfile->isoc)
 818                 return -EINVAL;
 819
 820         /* We will be using request and read_buffer */
 821         ret = ffs_mutex_lock(&epfile->mutex, file->f_flags & O_NONBLOCK);
 822         if (unlikely(ret))
 823                 goto error;
 824
 825         /* Allocate & copy */
 826         if (!halt) {
 827                 struct usb_gadget *gadget;
 828
 829                 /*
 830                  * Do we have buffered data from previous partial read?  Check
 831                  * that for synchronous case only because we do not have
 832                  * facility to ‘wake up’ a pending asynchronous read and push
 833                  * buffered data to it which we would need to make things behave
 834                  * consistently.
 835                  */
 836                 if (!io_data->aio && io_data->read) {
 837                         ret = __ffs_epfile_read_buffered(epfile, &io_data->data);
 838                         if (ret)
 839                                 goto error_mutex;
 840                 }
 841
 842                 /*
 843                  * if we _do_ wait above, the epfile->ffs->gadget might be NULL
 844                  * before the waiting completes, so do not assign to 'gadget'
 845                  * earlier
 846                  */
 847                 gadget = epfile->ffs->gadget;
 848
 849                 spin_lock_irq(&epfile->ffs->eps_lock);
 850                 /* In the meantime, endpoint got disabled or changed. */
 851                 if (epfile->ep != ep) {
 852                         ret = -ESHUTDOWN;
 853                         goto error_lock;
 854                 }
 855                 data_len = iov_iter_count(&io_data->data);
 856                 /*
 857                  * Controller may require buffer size to be aligned to
 858                  * maxpacketsize of an out endpoint.
 859                  */
 860                 if (io_data->read)
 861                         data_len = usb_ep_align_maybe(gadget, ep->ep, data_len);
 862                 spin_unlock_irq(&epfile->ffs->eps_lock);
 863
 864                 data = kmalloc(data_len, GFP_KERNEL);
 865                 if (unlikely(!data)) {
 866                         ret = -ENOMEM;
 867                         goto error_mutex;
 868                 }
 869                 if (!io_data->read &&
 870                     copy_from_iter(data, data_len, &io_data->data) != data_len) {
 871                         ret = -EFAULT;
 872                         goto error_mutex;
 873                 }
 874         }
 875
 876         spin_lock_irq(&epfile->ffs->eps_lock);
 877
 878         if (epfile->ep != ep) {
 879                 /* In the meantime, endpoint got disabled or changed. */
 880                 ret = -ESHUTDOWN;
 881         } else if (halt) {
 882                 /* Halt */
 883                 if (likely(epfile->ep == ep) && !WARN_ON(!ep->ep))
 884                         usb_ep_set_halt(ep->ep);
 885                 ret = -EBADMSG;
 886         } else if (unlikely(data_len == -EINVAL)) {
 887                 /*
 888                  * Sanity Check: even though data_len can't be used
 889                  * uninitialized at the time I write this comment, some
 890                  * compilers complain about this situation.
 891                  * In order to keep the code clean from warnings, data_len is
 892                  * being initialized to -EINVAL during its declaration, which
 893                  * means we can't rely on compiler anymore to warn no future
 894                  * changes won't result in data_len being used uninitialized.
 895                  * For such reason, we're adding this redundant sanity check
 896                  * here.
 897                  */
 898                 WARN(1, "%s: data_len == -EINVAL\n", __func__);
 899                 ret = -EINVAL;
 900         } else if (!io_data->aio) {
 901                 DECLARE_COMPLETION_ONSTACK(done);
 902                 bool interrupted = false;
 903
 904                 req = ep->req;
 905                 req->buf      = data;
 906                 req->length   = data_len;
 907
 908                 req->context  = &done;
 909                 req->complete = ffs_epfile_io_complete;
 910
 911                 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
 912                 if (unlikely(ret < 0))
 913                         goto error_lock;
 914
 915                 spin_unlock_irq(&epfile->ffs->eps_lock);
 916
 917                 if (unlikely(wait_for_completion_interruptible(&done))) {
 918                         /*
 919                          * To avoid race condition with ffs_epfile_io_complete,
 920                          * dequeue the request first then check
 921                          * status. usb_ep_dequeue API should guarantee no race
 922                          * condition with req->complete callback.
 923                          */
 924                         usb_ep_dequeue(ep->ep, req);
 925                         interrupted = ep->status < 0;
 926                 }
 927
 928                 if (interrupted)
 929                         ret = -EINTR;
 930                 else if (io_data->read && ep->status > 0)
 931                         ret = __ffs_epfile_read_data(epfile, data, ep->status,
 932                                                      &io_data->data);
 933                 else
 934                         ret = ep->status;
 935                 goto error_mutex;
 936         } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_KERNEL))) {
 937                 ret = -ENOMEM;
 938         } else {
 939                 req->buf      = data;
 940                 req->length   = data_len;
 941
 942                 io_data->buf = data;
 943                 io_data->ep = ep->ep;
 944                 io_data->req = req;
 945                 io_data->ffs = epfile->ffs;
 946
 947                 req->context  = io_data;
 948                 req->complete = ffs_epfile_async_io_complete;
 949
 950                 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
 951                 if (unlikely(ret)) {
 952                         usb_ep_free_request(ep->ep, req);
 953                         goto error_lock;
 954                 }
 955
 956                 ret = -EIOCBQUEUED;
 957                 /*
 958                  * Do not kfree the buffer in this function.  It will be freed
 959                  * by ffs_user_copy_worker.
 960                  */
 961                 data = NULL;
 962         }
 963
 964 error_lock:
 965         spin_unlock_irq(&epfile->ffs->eps_lock);
 966 error_mutex:
 967         mutex_unlock(&epfile->mutex);
 968 error:
 969         kfree(data);
 970         return ret;
 971 }
 972
 973 static int
 974 ffs_epfile_open(struct inode *inode, struct file *file)
 975 {
 976         struct ffs_epfile *epfile = inode->i_private;
 977
 978         ENTER();
 979
 980         if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
 981                 return -ENODEV;
 982
 983         file->private_data = epfile;
 984         ffs_data_opened(epfile->ffs);
 985
 986         return 0;
 987 }
 988
 989 static int ffs_aio_cancel(struct kiocb *kiocb)
 990 {
 991         struct ffs_io_data *io_data = kiocb->private;
 992         struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
 993         int value;
 994
 995         ENTER();
 996
 997         spin_lock_irq(&epfile->ffs->eps_lock);
 998
 999         if (likely(io_data && io_data->ep && io_data->req))
1000                 value = usb_ep_dequeue(io_data->ep, io_data->req);
1001         else
1002                 value = -EINVAL;
1003
1004         spin_unlock_irq(&epfile->ffs->eps_lock);
1005
1006         return value;
1007 }
1008
1009 static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
1010 {
1011         struct ffs_io_data io_data, *p = &io_data;
1012         ssize_t res;
1013
1014         ENTER();
1015
1016         if (!is_sync_kiocb(kiocb)) {
1017                 p = kmalloc(sizeof(io_data), GFP_KERNEL);
1018                 if (unlikely(!p))
1019                         return -ENOMEM;
1020                 p->aio = true;
1021         } else {
1022                 p->aio = false;
1023         }
1024
1025         p->read = false;
1026         p->kiocb = kiocb;
1027         p->data = *from;
1028         p->mm = current->mm;
1029
1030         kiocb->private = p;
1031
1032         if (p->aio)
1033                 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
1034
1035         res = ffs_epfile_io(kiocb->ki_filp, p);
1036         if (res == -EIOCBQUEUED)
1037                 return res;
1038         if (p->aio)
1039                 kfree(p);
1040         else
1041                 *from = p->data;
1042         return res;
1043 }
1044
1045 static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
1046 {
1047         struct ffs_io_data io_data, *p = &io_data;
1048         ssize_t res;
1049
1050         ENTER();
1051
1052         if (!is_sync_kiocb(kiocb)) {
1053                 p = kmalloc(sizeof(io_data), GFP_KERNEL);
1054                 if (unlikely(!p))
1055                         return -ENOMEM;
1056                 p->aio = true;
1057         } else {
1058                 p->aio = false;
1059         }
1060
1061         p->read = true;
1062         p->kiocb = kiocb;
1063         if (p->aio) {
1064                 p->to_free = dup_iter(&p->data, to, GFP_KERNEL);
1065                 if (!p->to_free) {
1066                         kfree(p);
1067                         return -ENOMEM;
1068                 }
1069         } else {
1070                 p->data = *to;
1071                 p->to_free = NULL;
1072         }
1073         p->mm = current->mm;
1074
1075         kiocb->private = p;
1076
1077         if (p->aio)
1078                 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
1079
1080         res = ffs_epfile_io(kiocb->ki_filp, p);
1081         if (res == -EIOCBQUEUED)
1082                 return res;
1083
1084         if (p->aio) {
1085                 kfree(p->to_free);
1086                 kfree(p);
1087         } else {
1088                 *to = p->data;
1089         }
1090         return res;
1091 }
1092
1093 static int
1094 ffs_epfile_release(struct inode *inode, struct file *file)
1095 {
1096         struct ffs_epfile *epfile = inode->i_private;
1097
1098         ENTER();
1099
1100         kfree(epfile->read_buffer);
1101         epfile->read_buffer = NULL;
1102         ffs_data_closed(epfile->ffs);
1103
1104         return 0;
1105 }
1106
1107 static long ffs_epfile_ioctl(struct file *file, unsigned code,
1108                              unsigned long value)
1109 {
1110         struct ffs_epfile *epfile = file->private_data;
1111         int ret;
1112
1113         ENTER();
1114
1115         if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
1116                 return -ENODEV;
1117
1118         spin_lock_irq(&epfile->ffs->eps_lock);
1119         if (likely(epfile->ep)) {
1120                 switch (code) {
1121                 case FUNCTIONFS_FIFO_STATUS:
1122                         ret = usb_ep_fifo_status(epfile->ep->ep);
1123                         break;
1124                 case FUNCTIONFS_FIFO_FLUSH:
1125                         usb_ep_fifo_flush(epfile->ep->ep);
1126                         ret = 0;
1127                         break;
1128                 case FUNCTIONFS_CLEAR_HALT:
1129                         ret = usb_ep_clear_halt(epfile->ep->ep);
1130                         break;
1131                 case FUNCTIONFS_ENDPOINT_REVMAP:
1132                         ret = epfile->ep->num;
1133                         break;
1134                 case FUNCTIONFS_ENDPOINT_DESC:
1135                 {
1136                         int desc_idx;
1137                         struct usb_endpoint_descriptor *desc;
1138
1139                         switch (epfile->ffs->gadget->speed) {
1140                         case USB_SPEED_SUPER:
1141                                 desc_idx = 2;
1142                                 break;
1143                         case USB_SPEED_HIGH:
1144                                 desc_idx = 1;
1145                                 break;
1146                         default:
1147                                 desc_idx = 0;
1148                         }
1149                         desc = epfile->ep->descs[desc_idx];
1150
1151                         spin_unlock_irq(&epfile->ffs->eps_lock);
1152                         ret = copy_to_user((void *)value, desc, sizeof(*desc));
1153                         if (ret)
1154                                 ret = -EFAULT;
1155                         return ret;
1156                 }
1157                 default:
1158                         ret = -ENOTTY;
1159                 }
1160         } else {
1161                 ret = -ENODEV;
1162         }
1163         spin_unlock_irq(&epfile->ffs->eps_lock);
1164
1165         return ret;
1166 }
1167
1168 static const struct file_operations ffs_epfile_operations = {
1169         .llseek =       no_llseek,
1170
1171         .open =         ffs_epfile_open,
1172         .write_iter =   ffs_epfile_write_iter,
1173         .read_iter =    ffs_epfile_read_iter,
1174         .release =      ffs_epfile_release,
1175         .unlocked_ioctl =       ffs_epfile_ioctl,
1176 };
1177
1178
1179 /* File system and super block operations ***********************************/
1180
1181 /*
1182  * Mounting the file system creates a controller file, used first for
1183  * function configuration then later for event monitoring.
1184  */
1185
1186 static struct inode *__must_check
1187 ffs_sb_make_inode(struct super_block *sb, void *data,
1188                   const struct file_operations *fops,
1189                   const struct inode_operations *iops,
1190                   struct ffs_file_perms *perms)
1191 {
1192         struct inode *inode;
1193
1194         ENTER();
1195
1196         inode = new_inode(sb);
1197
1198         if (likely(inode)) {
1199                 struct timespec ts = current_time(inode);
1200
1201                 inode->i_ino     = get_next_ino();
1202                 inode->i_mode    = perms->mode;
1203                 inode->i_uid     = perms->uid;
1204                 inode->i_gid     = perms->gid;
1205                 inode->i_atime   = ts;
1206                 inode->i_mtime   = ts;
1207                 inode->i_ctime   = ts;
1208                 inode->i_private = data;
1209                 if (fops)
1210                         inode->i_fop = fops;
1211                 if (iops)
1212                         inode->i_op  = iops;
1213         }
1214
1215         return inode;
1216 }
1217
1218 /* Create "regular" file */
1219 static struct dentry *ffs_sb_create_file(struct super_block *sb,
1220                                         const char *name, void *data,
1221                                         const struct file_operations *fops)
1222 {
1223         struct ffs_data *ffs = sb->s_fs_info;
1224         struct dentry   *dentry;
1225         struct inode    *inode;
1226
1227         ENTER();
1228
1229         dentry = d_alloc_name(sb->s_root, name);
1230         if (unlikely(!dentry))
1231                 return NULL;
1232
1233         inode = ffs_sb_make_inode(sb, data, fops, NULL, &ffs->file_perms);
1234         if (unlikely(!inode)) {
1235                 dput(dentry);
1236                 return NULL;
1237         }
1238
1239         d_add(dentry, inode);
1240         return dentry;
1241 }
1242
1243 /* Super block */
1244 static const struct super_operations ffs_sb_operations = {
1245         .statfs =       simple_statfs,
1246         .drop_inode =   generic_delete_inode,
1247 };
1248
1249 struct ffs_sb_fill_data {
1250         struct ffs_file_perms perms;
1251         umode_t root_mode;
1252         const char *dev_name;
1253         bool no_disconnect;
1254         struct ffs_data *ffs_data;
1255 };
1256
1257 static int ffs_sb_fill(struct super_block *sb, void *_data, int silent)
1258 {
1259         struct ffs_sb_fill_data *data = _data;
1260         struct inode    *inode;
1261         struct ffs_data *ffs = data->ffs_data;
1262
1263         ENTER();
1264
1265         ffs->sb              = sb;
1266         data->ffs_data       = NULL;
1267         sb->s_fs_info        = ffs;
1268         sb->s_blocksize      = PAGE_SIZE;
1269         sb->s_blocksize_bits = PAGE_SHIFT;
1270         sb->s_magic          = FUNCTIONFS_MAGIC;
1271         sb->s_op             = &ffs_sb_operations;
1272         sb->s_time_gran      = 1;
1273
1274         /* Root inode */
1275         data->perms.mode = data->root_mode;
1276         inode = ffs_sb_make_inode(sb, NULL,
1277                                   &simple_dir_operations,
1278                                   &simple_dir_inode_operations,
1279                                   &data->perms);
1280         sb->s_root = d_make_root(inode);
1281         if (unlikely(!sb->s_root))
1282                 return -ENOMEM;
1283
1284         /* EP0 file */
1285         if (unlikely(!ffs_sb_create_file(sb, "ep0", ffs,
1286                                          &ffs_ep0_operations)))
1287                 return -ENOMEM;
1288
1289         return 0;
1290 }
1291
1292 static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
1293 {
1294         ENTER();
1295
1296         if (!opts || !*opts)
1297                 return 0;
1298
1299         for (;;) {
1300                 unsigned long value;
1301                 char *eq, *comma;
1302
1303                 /* Option limit */
1304                 comma = strchr(opts, ',');
1305                 if (comma)
1306                         *comma = 0;
1307
1308                 /* Value limit */
1309                 eq = strchr(opts, '=');
1310                 if (unlikely(!eq)) {
1311                         pr_err("'=' missing in %s\n", opts);
1312                         return -EINVAL;
1313                 }
1314                 *eq = 0;
1315
1316                 /* Parse value */
1317                 if (kstrtoul(eq + 1, 0, &value)) {
1318                         pr_err("%s: invalid value: %s\n", opts, eq + 1);
1319                         return -EINVAL;
1320                 }
1321
1322                 /* Interpret option */
1323                 switch (eq - opts) {
1324                 case 13:
1325                         if (!memcmp(opts, "no_disconnect", 13))
1326                                 data->no_disconnect = !!value;
1327                         else
1328                                 goto invalid;
1329                         break;
1330                 case 5:
1331                         if (!memcmp(opts, "rmode", 5))
1332                                 data->root_mode  = (value & 0555) | S_IFDIR;
1333                         else if (!memcmp(opts, "fmode", 5))
1334                                 data->perms.mode = (value & 0666) | S_IFREG;
1335                         else
1336                                 goto invalid;
1337                         break;
1338
1339                 case 4:
1340                         if (!memcmp(opts, "mode", 4)) {
1341                                 data->root_mode  = (value & 0555) | S_IFDIR;
1342                                 data->perms.mode = (value & 0666) | S_IFREG;
1343                         } else {
1344                                 goto invalid;
1345                         }
1346                         break;
1347
1348                 case 3:
1349                         if (!memcmp(opts, "uid", 3)) {
1350                                 data->perms.uid = make_kuid(current_user_ns(), value);
1351                                 if (!uid_valid(data->perms.uid)) {
1352                                         pr_err("%s: unmapped value: %lu\n", opts, value);
1353                                         return -EINVAL;
1354                                 }
1355                         } else if (!memcmp(opts, "gid", 3)) {
1356                                 data->perms.gid = make_kgid(current_user_ns(), value);
1357                                 if (!gid_valid(data->perms.gid)) {
1358                                         pr_err("%s: unmapped value: %lu\n", opts, value);
1359                                         return -EINVAL;
1360                                 }
1361                         } else {
1362                                 goto invalid;
1363                         }
1364                         break;
1365
1366                 default:
1367 invalid:
1368                         pr_err("%s: invalid option\n", opts);
1369                         return -EINVAL;
1370                 }
1371
1372                 /* Next iteration */
1373                 if (!comma)
1374                         break;
1375                 opts = comma + 1;
1376         }
1377
1378         return 0;
1379 }
1380
1381 /* "mount -t functionfs dev_name /dev/function" ends up here */
1382
1383 static struct dentry *
1384 ffs_fs_mount(struct file_system_type *t, int flags,
1385               const char *dev_name, void *opts)
1386 {
1387         struct ffs_sb_fill_data data = {
1388                 .perms = {
1389                         .mode = S_IFREG | 0600,
1390                         .uid = GLOBAL_ROOT_UID,
1391                         .gid = GLOBAL_ROOT_GID,
1392                 },
1393                 .root_mode = S_IFDIR | 0500,
1394                 .no_disconnect = false,
1395         };
1396         struct dentry *rv;
1397         int ret;
1398         void *ffs_dev;
1399         struct ffs_data *ffs;
1400
1401         ENTER();
1402
1403         ret = ffs_fs_parse_opts(&data, opts);
1404         if (unlikely(ret < 0))
1405                 return ERR_PTR(ret);
1406
1407         ffs = ffs_data_new();
1408         if (unlikely(!ffs))
1409                 return ERR_PTR(-ENOMEM);
1410         ffs->file_perms = data.perms;
1411         ffs->no_disconnect = data.no_disconnect;
1412
1413         ffs->dev_name = kstrdup(dev_name, GFP_KERNEL);
1414         if (unlikely(!ffs->dev_name)) {
1415                 ffs_data_put(ffs);
1416                 return ERR_PTR(-ENOMEM);
1417         }
1418
1419         ffs_dev = ffs_acquire_dev(dev_name);
1420         if (IS_ERR(ffs_dev)) {
1421                 ffs_data_put(ffs);
1422                 return ERR_CAST(ffs_dev);
1423         }
1424         ffs->private_data = ffs_dev;
1425         data.ffs_data = ffs;
1426
1427         rv = mount_nodev(t, flags, &data, ffs_sb_fill);
1428         if (IS_ERR(rv) && data.ffs_data) {
1429                 ffs_release_dev(data.ffs_data);
1430                 ffs_data_put(data.ffs_data);
1431         }
1432         return rv;
1433 }
1434
1435 static void
1436 ffs_fs_kill_sb(struct super_block *sb)
1437 {
1438         ENTER();
1439
1440         kill_litter_super(sb);
1441         if (sb->s_fs_info) {
1442                 ffs_release_dev(sb->s_fs_info);
1443                 ffs_data_closed(sb->s_fs_info);
1444                 ffs_data_put(sb->s_fs_info);
1445         }
1446 }
1447
1448 static struct file_system_type ffs_fs_type = {
1449         .owner          = THIS_MODULE,
1450         .name           = "functionfs",
1451         .mount          = ffs_fs_mount,
1452         .kill_sb        = ffs_fs_kill_sb,
1453 };
1454 MODULE_ALIAS_FS("functionfs");
1455
1456
1457 /* Driver's main init/cleanup functions *************************************/
1458
1459 static int functionfs_init(void)
1460 {
1461         int ret;
1462
1463         ENTER();
1464
1465         ret = register_filesystem(&ffs_fs_type);
1466         if (likely(!ret))
1467                 pr_info("file system registered\n");
1468         else
1469                 pr_err("failed registering file system (%d)\n", ret);
1470
1471         return ret;
1472 }
1473
1474 static void functionfs_cleanup(void)
1475 {
1476         ENTER();
1477
1478         pr_info("unloading\n");
1479         unregister_filesystem(&ffs_fs_type);
1480 }
1481
1482
1483 /* ffs_data and ffs_function construction and destruction code **************/
1484
1485 static void ffs_data_clear(struct ffs_data *ffs);
1486 static void ffs_data_reset(struct ffs_data *ffs);
1487
1488 static void ffs_data_get(struct ffs_data *ffs)
1489 {
1490         ENTER();
1491
1492         atomic_inc(&ffs->ref);
1493 }
1494
1495 static void ffs_data_opened(struct ffs_data *ffs)
1496 {
1497         ENTER();
1498
1499         atomic_inc(&ffs->ref);
1500         if (atomic_add_return(1, &ffs->opened) == 1 &&
1501                         ffs->state == FFS_DEACTIVATED) {
1502                 ffs->state = FFS_CLOSING;
1503                 ffs_data_reset(ffs);
1504         }
1505 }
1506
1507 static void ffs_data_put(struct ffs_data *ffs)
1508 {
1509         ENTER();
1510
1511         if (unlikely(atomic_dec_and_test(&ffs->ref))) {
1512                 pr_info("%s(): freeing\n", __func__);
1513                 ffs_data_clear(ffs);
1514                 BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
1515                        waitqueue_active(&ffs->ep0req_completion.wait));
1516                 kfree(ffs->dev_name);
1517                 kfree(ffs);
1518         }
1519 }
1520
1521 static void ffs_data_closed(struct ffs_data *ffs)
1522 {
1523         ENTER();
1524
1525         if (atomic_dec_and_test(&ffs->opened)) {
1526                 if (ffs->no_disconnect) {
1527                         ffs->state = FFS_DEACTIVATED;
1528                         if (ffs->epfiles) {
1529                                 ffs_epfiles_destroy(ffs->epfiles,
1530                                                    ffs->eps_count);
1531                                 ffs->epfiles = NULL;
1532                         }
1533                         if (ffs->setup_state == FFS_SETUP_PENDING)
1534                                 __ffs_ep0_stall(ffs);
1535                 } else {
1536                         ffs->state = FFS_CLOSING;
1537                         ffs_data_reset(ffs);
1538                 }
1539         }
1540         if (atomic_read(&ffs->opened) < 0) {
1541                 ffs->state = FFS_CLOSING;
1542                 ffs_data_reset(ffs);
1543         }
1544
1545         ffs_data_put(ffs);
1546 }
1547
1548 static struct ffs_data *ffs_data_new(void)
1549 {
1550         struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
1551         if (unlikely(!ffs))
1552                 return NULL;
1553
1554         ENTER();
1555
1556         atomic_set(&ffs->ref, 1);
1557         atomic_set(&ffs->opened, 0);
1558         ffs->state = FFS_READ_DESCRIPTORS;
1559         mutex_init(&ffs->mutex);
1560         spin_lock_init(&ffs->eps_lock);
1561         init_waitqueue_head(&ffs->ev.waitq);
1562         init_completion(&ffs->ep0req_completion);
1563
1564         /* XXX REVISIT need to update it in some places, or do we? */
1565         ffs->ev.can_stall = 1;
1566
1567         return ffs;
1568 }
1569
1570 static void ffs_data_clear(struct ffs_data *ffs)
1571 {
1572         ENTER();
1573
1574         ffs_closed(ffs);
1575
1576         BUG_ON(ffs->gadget);
1577
1578         if (ffs->epfiles)
1579                 ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count);
1580
1581         if (ffs->ffs_eventfd)
1582                 eventfd_ctx_put(ffs->ffs_eventfd);
1583
1584         kfree(ffs->raw_descs_data);
1585         kfree(ffs->raw_strings);
1586         kfree(ffs->stringtabs);
1587 }
1588
1589 static void ffs_data_reset(struct ffs_data *ffs)
1590 {
1591         ENTER();
1592
1593         ffs_data_clear(ffs);
1594
1595         ffs->epfiles = NULL;
1596         ffs->raw_descs_data = NULL;
1597         ffs->raw_descs = NULL;
1598         ffs->raw_strings = NULL;
1599         ffs->stringtabs = NULL;
1600
1601         ffs->raw_descs_length = 0;
1602         ffs->fs_descs_count = 0;
1603         ffs->hs_descs_count = 0;
1604         ffs->ss_descs_count = 0;
1605
1606         ffs->strings_count = 0;
1607         ffs->interfaces_count = 0;
1608         ffs->eps_count = 0;
1609
1610         ffs->ev.count = 0;
1611
1612         ffs->state = FFS_READ_DESCRIPTORS;
1613         ffs->setup_state = FFS_NO_SETUP;
1614         ffs->flags = 0;
1615 }
1616
1617
1618 static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
1619 {
1620         struct usb_gadget_strings **lang;
1621         int first_id;
1622
1623         ENTER();
1624
1625         if (WARN_ON(ffs->state != FFS_ACTIVE
1626                  || test_and_set_bit(FFS_FL_BOUND, &ffs->flags)))
1627                 return -EBADFD;
1628
1629         first_id = usb_string_ids_n(cdev, ffs->strings_count);
1630         if (unlikely(first_id < 0))
1631                 return first_id;
1632
1633         ffs->ep0req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL);
1634         if (unlikely(!ffs->ep0req))
1635                 return -ENOMEM;
1636         ffs->ep0req->complete = ffs_ep0_complete;
1637         ffs->ep0req->context = ffs;
1638
1639         lang = ffs->stringtabs;
1640         if (lang) {
1641                 for (; *lang; ++lang) {
1642                         struct usb_string *str = (*lang)->strings;
1643                         int id = first_id;
1644                         for (; str->s; ++id, ++str)
1645                                 str->id = id;
1646                 }
1647         }
1648
1649         ffs->gadget = cdev->gadget;
1650         ffs_data_get(ffs);
1651         return 0;
1652 }
1653
1654 static void functionfs_unbind(struct ffs_data *ffs)
1655 {
1656         ENTER();
1657
1658         if (!WARN_ON(!ffs->gadget)) {
1659                 usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req);
1660                 ffs->ep0req = NULL;
1661                 ffs->gadget = NULL;
1662                 clear_bit(FFS_FL_BOUND, &ffs->flags);
1663                 ffs_data_put(ffs);
1664         }
1665 }
1666
1667 static int ffs_epfiles_create(struct ffs_data *ffs)
1668 {
1669         struct ffs_epfile *epfile, *epfiles;
1670         unsigned i, count;
1671
1672         ENTER();
1673
1674         count = ffs->eps_count;
1675         epfiles = kcalloc(count, sizeof(*epfiles), GFP_KERNEL);
1676         if (!epfiles)
1677                 return -ENOMEM;
1678
1679         epfile = epfiles;
1680         for (i = 1; i <= count; ++i, ++epfile) {
1681                 epfile->ffs = ffs;
1682                 mutex_init(&epfile->mutex);
1683                 init_waitqueue_head(&epfile->wait);
1684                 if (ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
1685                         sprintf(epfile->name, "ep%02x", ffs->eps_addrmap[i]);
1686                 else
1687                         sprintf(epfile->name, "ep%u", i);
1688                 epfile->dentry = ffs_sb_create_file(ffs->sb, epfile->name,
1689                                                  epfile,
1690                                                  &ffs_epfile_operations);
1691                 if (unlikely(!epfile->dentry)) {
1692                         ffs_epfiles_destroy(epfiles, i - 1);
1693                         return -ENOMEM;
1694                 }
1695         }
1696
1697         ffs->epfiles = epfiles;
1698         return 0;
1699 }
1700
1701 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count)
1702 {
1703         struct ffs_epfile *epfile = epfiles;
1704
1705         ENTER();
1706
1707         for (; count; --count, ++epfile) {
1708                 BUG_ON(mutex_is_locked(&epfile->mutex) ||
1709                        waitqueue_active(&epfile->wait));
1710                 if (epfile->dentry) {
1711                         d_delete(epfile->dentry);
1712                         dput(epfile->dentry);
1713                         epfile->dentry = NULL;
1714                 }
1715         }
1716
1717         kfree(epfiles);
1718 }
1719
1720 static void ffs_func_eps_disable(struct ffs_function *func)
1721 {
1722         struct ffs_ep *ep         = func->eps;
1723         struct ffs_epfile *epfile = func->ffs->epfiles;
1724         unsigned count            = func->ffs->eps_count;
1725         unsigned long flags;
1726
1727         do {
1728                 if (epfile)
1729                         mutex_lock(&epfile->mutex);
1730                 spin_lock_irqsave(&func->ffs->eps_lock, flags);
1731                 /* pending requests get nuked */
1732                 if (likely(ep->ep))
1733                         usb_ep_disable(ep->ep);
1734                 ++ep;
1735                 spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
1736
1737                 if (epfile) {
1738                         epfile->ep = NULL;
1739                         kfree(epfile->read_buffer);
1740                         epfile->read_buffer = NULL;
1741                         mutex_unlock(&epfile->mutex);
1742                         ++epfile;
1743                 }
1744         } while (--count);
1745 }
1746
1747 static int ffs_func_eps_enable(struct ffs_function *func)
1748 {
1749         struct ffs_data *ffs      = func->ffs;
1750         struct ffs_ep *ep         = func->eps;
1751         struct ffs_epfile *epfile = ffs->epfiles;
1752         unsigned count            = ffs->eps_count;
1753         unsigned long flags;
1754         int ret = 0;
1755
1756         spin_lock_irqsave(&func->ffs->eps_lock, flags);
1757         do {
1758                 struct usb_endpoint_descriptor *ds;
1759                 int desc_idx;
1760
1761                 if (ffs->gadget->speed == USB_SPEED_SUPER)
1762                         desc_idx = 2;
1763                 else if (ffs->gadget->speed == USB_SPEED_HIGH)
1764                         desc_idx = 1;
1765                 else
1766                         desc_idx = 0;
1767
1768                 /* fall-back to lower speed if desc missing for current speed */
1769                 do {
1770                         ds = ep->descs[desc_idx];
1771                 } while (!ds && --desc_idx >= 0);
1772
1773                 if (!ds) {
1774                         ret = -EINVAL;
1775                         break;
1776                 }
1777
1778                 ep->ep->driver_data = ep;
1779                 ep->ep->desc = ds;
1780                 ret = usb_ep_enable(ep->ep);
1781                 if (likely(!ret)) {
1782                         epfile->ep = ep;
1783                         epfile->in = usb_endpoint_dir_in(ds);
1784                         epfile->isoc = usb_endpoint_xfer_isoc(ds);
1785                 } else {
1786                         break;
1787                 }
1788
1789                 wake_up(&epfile->wait);
1790
1791                 ++ep;
1792                 ++epfile;
1793         } while (--count);
1794         spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
1795
1796         return ret;
1797 }
1798
1799
1800 /* Parsing and building descriptors and strings *****************************/
1801
1802 /*
1803  * This validates if data pointed by data is a valid USB descriptor as
1804  * well as record how many interfaces, endpoints and strings are
1805  * required by given configuration.  Returns address after the
1806  * descriptor or NULL if data is invalid.
1807  */
1808
1809 enum ffs_entity_type {
1810         FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT
1811 };
1812
1813 enum ffs_os_desc_type {
1814         FFS_OS_DESC, FFS_OS_DESC_EXT_COMPAT, FFS_OS_DESC_EXT_PROP
1815 };
1816
1817 typedef int (*ffs_entity_callback)(enum ffs_entity_type entity,
1818                                    u8 *valuep,
1819                                    struct usb_descriptor_header *desc,
1820                                    void *priv);
1821
1822 typedef int (*ffs_os_desc_callback)(enum ffs_os_desc_type entity,
1823                                     struct usb_os_desc_header *h, void *data,
1824                                     unsigned len, void *priv);
1825
1826 static int __must_check ffs_do_single_desc(char *data, unsigned len,
1827                                            ffs_entity_callback entity,
1828                                            void *priv)
1829 {
1830         struct usb_descriptor_header *_ds = (void *)data;
1831         u8 length;
1832         int ret;
1833
1834         ENTER();
1835
1836         /* At least two bytes are required: length and type */
1837         if (len < 2) {
1838                 pr_vdebug("descriptor too short\n");
1839                 return -EINVAL;
1840         }
1841
1842         /* If we have at least as many bytes as the descriptor takes? */
1843         length = _ds->bLength;
1844         if (len < length) {
1845                 pr_vdebug("descriptor longer then available data\n");
1846                 return -EINVAL;
1847         }
1848
1849 #define __entity_check_INTERFACE(val)  1
1850 #define __entity_check_STRING(val)     (val)
1851 #define __entity_check_ENDPOINT(val)   ((val) & USB_ENDPOINT_NUMBER_MASK)
1852 #define __entity(type, val) do {                                        \
1853                 pr_vdebug("entity " #type "(%02x)\n", (val));           \
1854                 if (unlikely(!__entity_check_ ##type(val))) {           \
1855                         pr_vdebug("invalid entity's value\n");          \
1856                         return -EINVAL;                                 \
1857                 }                                                       \
1858                 ret = entity(FFS_ ##type, &val, _ds, priv);             \
1859                 if (unlikely(ret < 0)) {                                \
1860                         pr_debug("entity " #type "(%02x); ret = %d\n",  \
1861                                  (val), ret);                           \
1862                         return ret;                                     \
1863                 }                                                       \
1864         } while (0)
1865
1866         /* Parse descriptor depending on type. */
1867         switch (_ds->bDescriptorType) {
1868         case USB_DT_DEVICE:
1869         case USB_DT_CONFIG:
1870         case USB_DT_STRING:
1871         case USB_DT_DEVICE_QUALIFIER:
1872                 /* function can't have any of those */
1873                 pr_vdebug("descriptor reserved for gadget: %d\n",
1874                       _ds->bDescriptorType);
1875                 return -EINVAL;
1876
1877         case USB_DT_INTERFACE: {
1878                 struct usb_interface_descriptor *ds = (void *)_ds;
1879                 pr_vdebug("interface descriptor\n");
1880                 if (length != sizeof *ds)
1881                         goto inv_length;
1882
1883                 __entity(INTERFACE, ds->bInterfaceNumber);
1884                 if (ds->iInterface)
1885                         __entity(STRING, ds->iInterface);
1886         }
1887                 break;
1888
1889         case USB_DT_ENDPOINT: {
1890                 struct usb_endpoint_descriptor *ds = (void *)_ds;
1891                 pr_vdebug("endpoint descriptor\n");
1892                 if (length != USB_DT_ENDPOINT_SIZE &&
1893                     length != USB_DT_ENDPOINT_AUDIO_SIZE)
1894                         goto inv_length;
1895                 __entity(ENDPOINT, ds->bEndpointAddress);
1896         }
1897                 break;
1898
1899         case HID_DT_HID:
1900                 pr_vdebug("hid descriptor\n");
1901                 if (length != sizeof(struct hid_descriptor))
1902                         goto inv_length;
1903                 break;
1904
1905         case USB_DT_OTG:
1906                 if (length != sizeof(struct usb_otg_descriptor))
1907                         goto inv_length;
1908                 break;
1909
1910         case USB_DT_INTERFACE_ASSOCIATION: {
1911                 struct usb_interface_assoc_descriptor *ds = (void *)_ds;
1912                 pr_vdebug("interface association descriptor\n");
1913                 if (length != sizeof *ds)
1914                         goto inv_length;
1915                 if (ds->iFunction)
1916                         __entity(STRING, ds->iFunction);
1917         }
1918                 break;
1919
1920         case USB_DT_SS_ENDPOINT_COMP:
1921                 pr_vdebug("EP SS companion descriptor\n");
1922                 if (length != sizeof(struct usb_ss_ep_comp_descriptor))
1923                         goto inv_length;
1924                 break;
1925
1926         case USB_DT_OTHER_SPEED_CONFIG:
1927         case USB_DT_INTERFACE_POWER:
1928         case USB_DT_DEBUG:
1929         case USB_DT_SECURITY:
1930         case USB_DT_CS_RADIO_CONTROL:
1931                 /* TODO */
1932                 pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType);
1933                 return -EINVAL;
1934
1935         default:
1936                 /* We should never be here */
1937                 pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType);
1938                 return -EINVAL;
1939
1940 inv_length:
1941                 pr_vdebug("invalid length: %d (descriptor %d)\n",
1942                           _ds->bLength, _ds->bDescriptorType);
1943                 return -EINVAL;
1944         }
1945
1946 #undef __entity
1947 #undef __entity_check_DESCRIPTOR
1948 #undef __entity_check_INTERFACE
1949 #undef __entity_check_STRING
1950 #undef __entity_check_ENDPOINT
1951
1952         return length;
1953 }
1954
1955 static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len,
1956                                      ffs_entity_callback entity, void *priv)
1957 {
1958         const unsigned _len = len;
1959         unsigned long num = 0;
1960
1961         ENTER();
1962
1963         for (;;) {
1964                 int ret;
1965
1966                 if (num == count)
1967                         data = NULL;
1968
1969                 /* Record "descriptor" entity */
1970                 ret = entity(FFS_DESCRIPTOR, (u8 *)num, (void *)data, priv);
1971                 if (unlikely(ret < 0)) {
1972                         pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n",
1973                                  num, ret);
1974                         return ret;
1975                 }
1976
1977                 if (!data)
1978                         return _len - len;
1979
1980                 ret = ffs_do_single_desc(data, len, entity, priv);
1981                 if (unlikely(ret < 0)) {
1982                         pr_debug("%s returns %d\n", __func__, ret);
1983                         return ret;
1984                 }
1985
1986                 len -= ret;
1987                 data += ret;
1988                 ++num;
1989         }
1990 }
1991
1992 static int __ffs_data_do_entity(enum ffs_entity_type type,
1993                                 u8 *valuep, struct usb_descriptor_header *desc,
1994                                 void *priv)
1995 {
1996         struct ffs_desc_helper *helper = priv;
1997         struct usb_endpoint_descriptor *d;
1998
1999         ENTER();
2000
2001         switch (type) {
2002         case FFS_DESCRIPTOR:
2003                 break;
2004
2005         case FFS_INTERFACE:
2006                 /*
2007                  * Interfaces are indexed from zero so if we
2008                  * encountered interface "n" then there are at least
2009                  * "n+1" interfaces.
2010                  */
2011                 if (*valuep >= helper->interfaces_count)
2012                         helper->interfaces_count = *valuep + 1;
2013                 break;
2014
2015         case FFS_STRING:
2016                 /*
2017                  * Strings are indexed from 1 (0 is magic ;) reserved
2018                  * for languages list or some such)
2019                  */
2020                 if (*valuep > helper->ffs->strings_count)
2021                         helper->ffs->strings_count = *valuep;
2022                 break;
2023
2024         case FFS_ENDPOINT:
2025                 d = (void *)desc;
2026                 helper->eps_count++;
2027                 if (helper->eps_count >= 15)
2028                         return -EINVAL;
2029                 /* Check if descriptors for any speed were already parsed */
2030                 if (!helper->ffs->eps_count && !helper->ffs->interfaces_count)
2031                         helper->ffs->eps_addrmap[helper->eps_count] =
2032                                 d->bEndpointAddress;
2033                 else if (helper->ffs->eps_addrmap[helper->eps_count] !=
2034                                 d->bEndpointAddress)
2035                         return -EINVAL;
2036                 break;
2037         }
2038
2039         return 0;
2040 }
2041
2042 static int __ffs_do_os_desc_header(enum ffs_os_desc_type *next_type,
2043                                    struct usb_os_desc_header *desc)
2044 {
2045         u16 bcd_version = le16_to_cpu(desc->bcdVersion);
2046         u16 w_index = le16_to_cpu(desc->wIndex);
2047
2048         if (bcd_version != 1) {
2049                 pr_vdebug("unsupported os descriptors version: %d",
2050                           bcd_version);
2051                 return -EINVAL;
2052         }
2053         switch (w_index) {
2054         case 0x4:
2055                 *next_type = FFS_OS_DESC_EXT_COMPAT;
2056                 break;
2057         case 0x5:
2058                 *next_type = FFS_OS_DESC_EXT_PROP;
2059                 break;
2060         default:
2061                 pr_vdebug("unsupported os descriptor type: %d", w_index);
2062                 return -EINVAL;
2063         }
2064
2065         return sizeof(*desc);
2066 }
2067
2068 /*
2069  * Process all extended compatibility/extended property descriptors
2070  * of a feature descriptor
2071  */
2072 static int __must_check ffs_do_single_os_desc(char *data, unsigned len,
2073                                               enum ffs_os_desc_type type,
2074                                               u16 feature_count,
2075                                               ffs_os_desc_callback entity,
2076                                               void *priv,
2077                                               struct usb_os_desc_header *h)
2078 {
2079         int ret;
2080         const unsigned _len = len;
2081
2082         ENTER();
2083
2084         /* loop over all ext compat/ext prop descriptors */
2085         while (feature_count--) {
2086                 ret = entity(type, h, data, len, priv);
2087                 if (unlikely(ret < 0)) {
2088                         pr_debug("bad OS descriptor, type: %d\n", type);
2089                         return ret;
2090                 }
2091                 data += ret;
2092                 len -= ret;
2093         }
2094         return _len - len;
2095 }
2096
2097 /* Process a number of complete Feature Descriptors (Ext Compat or Ext Prop) */
2098 static int __must_check ffs_do_os_descs(unsigned count,
2099                                         char *data, unsigned len,
2100                                         ffs_os_desc_callback entity, void *priv)
2101 {
2102         const unsigned _len = len;
2103         unsigned long num = 0;
2104
2105         ENTER();
2106
2107         for (num = 0; num < count; ++num) {
2108                 int ret;
2109                 enum ffs_os_desc_type type;
2110                 u16 feature_count;
2111                 struct usb_os_desc_header *desc = (void *)data;
2112
2113                 if (len < sizeof(*desc))
2114                         return -EINVAL;
2115
2116                 /*
2117                  * Record "descriptor" entity.
2118                  * Process dwLength, bcdVersion, wIndex, get b/wCount.
2119                  * Move the data pointer to the beginning of extended
2120                  * compatibilities proper or extended properties proper
2121                  * portions of the data
2122                  */
2123                 if (le32_to_cpu(desc->dwLength) > len)
2124                         return -EINVAL;
2125
2126                 ret = __ffs_do_os_desc_header(&type, desc);
2127                 if (unlikely(ret < 0)) {
2128                         pr_debug("entity OS_DESCRIPTOR(%02lx); ret = %d\n",
2129                                  num, ret);
2130                         return ret;
2131                 }
2132                 /*
2133                  * 16-bit hex "?? 00" Little Endian looks like 8-bit hex "??"
2134                  */
2135                 feature_count = le16_to_cpu(desc->wCount);
2136                 if (type == FFS_OS_DESC_EXT_COMPAT &&
2137                     (feature_count > 255 || desc->Reserved))
2138                                 return -EINVAL;
2139                 len -= ret;
2140                 data += ret;
2141
2142                 /*
2143                  * Process all function/property descriptors
2144                  * of this Feature Descriptor
2145                  */
2146                 ret = ffs_do_single_os_desc(data, len, type,
2147                                             feature_count, entity, priv, desc);
2148                 if (unlikely(ret < 0)) {
2149                         pr_debug("%s returns %d\n", __func__, ret);
2150                         return ret;
2151                 }
2152
2153                 len -= ret;
2154                 data += ret;
2155         }
2156         return _len - len;
2157 }
2158
2159 /**
2160  * Validate contents of the buffer from userspace related to OS descriptors.
2161  */
2162 static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
2163                                  struct usb_os_desc_header *h, void *data,
2164                                  unsigned len, void *priv)
2165 {
2166         struct ffs_data *ffs = priv;
2167         u8 length;
2168
2169         ENTER();
2170
2171         switch (type) {
2172         case FFS_OS_DESC_EXT_COMPAT: {
2173                 struct usb_ext_compat_desc *d = data;
2174                 int i;
2175
2176                 if (len < sizeof(*d) ||
2177                     d->bFirstInterfaceNumber >= ffs->interfaces_count ||
2178                     !d->Reserved1)
2179                         return -EINVAL;
2180                 for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
2181                         if (d->Reserved2[i])
2182                                 return -EINVAL;
2183
2184                 length = sizeof(struct usb_ext_compat_desc);
2185         }
2186                 break;
2187         case FFS_OS_DESC_EXT_PROP: {
2188                 struct usb_ext_prop_desc *d = data;
2189                 u32 type, pdl;
2190                 u16 pnl;
2191
2192                 if (len < sizeof(*d) || h->interface >= ffs->interfaces_count)
2193                         return -EINVAL;
2194                 length = le32_to_cpu(d->dwSize);
2195                 type = le32_to_cpu(d->dwPropertyDataType);
2196                 if (type < USB_EXT_PROP_UNICODE ||
2197                     type > USB_EXT_PROP_UNICODE_MULTI) {
2198                         pr_vdebug("unsupported os descriptor property type: %d",
2199                                   type);
2200                         return -EINVAL;
2201                 }
2202                 pnl = le16_to_cpu(d->wPropertyNameLength);
2203                 pdl = le32_to_cpu(*(u32 *)((u8 *)data + 10 + pnl));
2204                 if (length != 14 + pnl + pdl) {
2205                         pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n",
2206                                   length, pnl, pdl, type);
2207                         return -EINVAL;
2208                 }
2209                 ++ffs->ms_os_descs_ext_prop_count;
2210                 /* property name reported to the host as "WCHAR"s */
2211                 ffs->ms_os_descs_ext_prop_name_len += pnl * 2;
2212                 ffs->ms_os_descs_ext_prop_data_len += pdl;
2213         }
2214                 break;
2215         default:
2216                 pr_vdebug("unknown descriptor: %d\n", type);
2217                 return -EINVAL;
2218         }
2219         return length;
2220 }
2221
2222 static int __ffs_data_got_descs(struct ffs_data *ffs,
2223                                 char *const _data, size_t len)
2224 {
2225         char *data = _data, *raw_descs;
2226         unsigned os_descs_count = 0, counts[3], flags;
2227         int ret = -EINVAL, i;
2228         struct ffs_desc_helper helper;
2229
2230         ENTER();
2231
2232         if (get_unaligned_le32(data + 4) != len)
2233                 goto error;
2234
2235         switch (get_unaligned_le32(data)) {
2236         case FUNCTIONFS_DESCRIPTORS_MAGIC:
2237                 flags = FUNCTIONFS_HAS_FS_DESC | FUNCTIONFS_HAS_HS_DESC;
2238                 data += 8;
2239                 len  -= 8;
2240                 break;
2241         case FUNCTIONFS_DESCRIPTORS_MAGIC_V2:
2242                 flags = get_unaligned_le32(data + 8);
2243                 ffs->user_flags = flags;
2244                 if (flags & ~(FUNCTIONFS_HAS_FS_DESC |
2245                               FUNCTIONFS_HAS_HS_DESC |
2246                               FUNCTIONFS_HAS_SS_DESC |
2247                               FUNCTIONFS_HAS_MS_OS_DESC |
2248                               FUNCTIONFS_VIRTUAL_ADDR |
2249                               FUNCTIONFS_EVENTFD |
2250                               FUNCTIONFS_ALL_CTRL_RECIP |
2251                               FUNCTIONFS_CONFIG0_SETUP)) {
2252                         ret = -ENOSYS;
2253                         goto error;
2254                 }
2255                 data += 12;
2256                 len  -= 12;
2257                 break;
2258         default:
2259                 goto error;
2260         }
2261
2262         if (flags & FUNCTIONFS_EVENTFD) {
2263                 if (len < 4)
2264                         goto error;
2265                 ffs->ffs_eventfd =
2266                         eventfd_ctx_fdget((int)get_unaligned_le32(data));
2267                 if (IS_ERR(ffs->ffs_eventfd)) {
2268                         ret = PTR_ERR(ffs->ffs_eventfd);
2269                         ffs->ffs_eventfd = NULL;
2270                         goto error;
2271                 }
2272                 data += 4;
2273                 len  -= 4;
2274         }
2275
2276         /* Read fs_count, hs_count and ss_count (if present) */
2277         for (i = 0; i < 3; ++i) {
2278                 if (!(flags & (1 << i))) {
2279                         counts[i] = 0;
2280                 } else if (len < 4) {
2281                         goto error;
2282                 } else {
2283                         counts[i] = get_unaligned_le32(data);
2284                         data += 4;
2285                         len  -= 4;
2286                 }
2287         }
2288         if (flags & (1 << i)) {
2289                 os_descs_count = get_unaligned_le32(data);
2290                 data += 4;
2291                 len -= 4;
2292         };
2293
2294         /* Read descriptors */
2295         raw_descs = data;
2296         helper.ffs = ffs;
2297         for (i = 0; i < 3; ++i) {
2298                 if (!counts[i])
2299                         continue;
2300                 helper.interfaces_count = 0;
2301                 helper.eps_count = 0;
2302                 ret = ffs_do_descs(counts[i], data, len,
2303                                    __ffs_data_do_entity, &helper);
2304                 if (ret < 0)
2305                         goto error;
2306                 if (!ffs->eps_count && !ffs->interfaces_count) {
2307                         ffs->eps_count = helper.eps_count;
2308                         ffs->interfaces_count = helper.interfaces_count;
2309                 } else {
2310                         if (ffs->eps_count != helper.eps_count) {
2311                                 ret = -EINVAL;
2312                                 goto error;
2313                         }
2314                         if (ffs->interfaces_count != helper.interfaces_count) {
2315                                 ret = -EINVAL;
2316                                 goto error;
2317                         }
2318                 }
2319                 data += ret;
2320                 len  -= ret;
2321         }
2322         if (os_descs_count) {
2323                 ret = ffs_do_os_descs(os_descs_count, data, len,
2324                                       __ffs_data_do_os_desc, ffs);
2325                 if (ret < 0)
2326                         goto error;
2327                 data += ret;
2328                 len -= ret;
2329         }
2330
2331         if (raw_descs == data || len) {
2332                 ret = -EINVAL;
2333                 goto error;
2334         }
2335
2336         ffs->raw_descs_data     = _data;
2337         ffs->raw_descs          = raw_descs;
2338         ffs->raw_descs_length   = data - raw_descs;
2339         ffs->fs_descs_count     = counts[0];
2340         ffs->hs_descs_count     = counts[1];
2341         ffs->ss_descs_count     = counts[2];
2342         ffs->ms_os_descs_count  = os_descs_count;
2343
2344         return 0;
2345
2346 error:
2347         kfree(_data);
2348         return ret;
2349 }
2350
2351 static int __ffs_data_got_strings(struct ffs_data *ffs,
2352                                   char *const _data, size_t len)
2353 {
2354         u32 str_count, needed_count, lang_count;
2355         struct usb_gadget_strings **stringtabs, *t;
2356         const char *data = _data;
2357         struct usb_string *s;
2358
2359         ENTER();
2360
2361         if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
2362                      get_unaligned_le32(data + 4) != len))
2363                 goto error;
2364         str_count  = get_unaligned_le32(data + 8);
2365         lang_count = get_unaligned_le32(data + 12);
2366
2367         /* if one is zero the other must be zero */
2368         if (unlikely(!str_count != !lang_count))
2369                 goto error;
2370
2371         /* Do we have at least as many strings as descriptors need? */
2372         needed_count = ffs->strings_count;
2373         if (unlikely(str_count < needed_count))
2374                 goto error;
2375
2376         /*
2377          * If we don't need any strings just return and free all
2378          * memory.
2379          */
2380         if (!needed_count) {
2381                 kfree(_data);
2382                 return 0;
2383         }
2384
2385         /* Allocate everything in one chunk so there's less maintenance. */
2386         {
2387                 unsigned i = 0;
2388                 vla_group(d);
2389                 vla_item(d, struct usb_gadget_strings *, stringtabs,
2390                         lang_count + 1);
2391                 vla_item(d, struct usb_gadget_strings, stringtab, lang_count);
2392                 vla_item(d, struct usb_string, strings,
2393                         lang_count*(needed_count+1));
2394
2395                 char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL);
2396
2397                 if (unlikely(!vlabuf)) {
2398                         kfree(_data);
2399                         return -ENOMEM;
2400                 }
2401
2402                 /* Initialize the VLA pointers */
2403                 stringtabs = vla_ptr(vlabuf, d, stringtabs);
2404                 t = vla_ptr(vlabuf, d, stringtab);
2405                 i = lang_count;
2406                 do {
2407                         *stringtabs++ = t++;
2408                 } while (--i);
2409                 *stringtabs = NULL;
2410
2411                 /* stringtabs = vlabuf = d_stringtabs for later kfree */
2412                 stringtabs = vla_ptr(vlabuf, d, stringtabs);
2413                 t = vla_ptr(vlabuf, d, stringtab);
2414                 s = vla_ptr(vlabuf, d, strings);
2415         }
2416
2417         /* For each language */
2418         data += 16;
2419         len -= 16;
2420
2421         do { /* lang_count > 0 so we can use do-while */
2422                 unsigned needed = needed_count;
2423
2424                 if (unlikely(len < 3))
2425                         goto error_free;
2426                 t->language = get_unaligned_le16(data);
2427                 t->strings  = s;
2428                 ++t;
2429
2430                 data += 2;
2431                 len -= 2;
2432
2433                 /* For each string */
2434                 do { /* str_count > 0 so we can use do-while */
2435                         size_t length = strnlen(data, len);
2436
2437                         if (unlikely(length == len))
2438                                 goto error_free;
2439
2440                         /*
2441                          * User may provide more strings then we need,
2442                          * if that's the case we simply ignore the
2443                          * rest
2444                          */
2445                         if (likely(needed)) {
2446                                 /*
2447                                  * s->id will be set while adding
2448                                  * function to configuration so for
2449                                  * now just leave garbage here.
2450                                  */
2451                                 s->s = data;
2452                                 --needed;
2453                                 ++s;
2454                         }
2455
2456                         data += length + 1;
2457                         len -= length + 1;
2458                 } while (--str_count);
2459
2460                 s->id = 0;   /* terminator */
2461                 s->s = NULL;
2462                 ++s;
2463
2464         } while (--lang_count);
2465
2466         /* Some garbage left? */
2467         if (unlikely(len))
2468                 goto error_free;
2469
2470         /* Done! */
2471         ffs->stringtabs = stringtabs;
2472         ffs->raw_strings = _data;
2473
2474         return 0;
2475
2476 error_free:
2477         kfree(stringtabs);
2478 error:
2479         kfree(_data);
2480         return -EINVAL;
2481 }
2482
2483
2484 /* Events handling and management *******************************************/
2485
2486 static void __ffs_event_add(struct ffs_data *ffs,
2487                             enum usb_functionfs_event_type type)
2488 {
2489         enum usb_functionfs_event_type rem_type1, rem_type2 = type;
2490         int neg = 0;
2491
2492         /*
2493          * Abort any unhandled setup
2494          *
2495          * We do not need to worry about some cmpxchg() changing value
2496          * of ffs->setup_state without holding the lock because when
2497          * state is FFS_SETUP_PENDING cmpxchg() in several places in
2498          * the source does nothing.
2499          */
2500         if (ffs->setup_state == FFS_SETUP_PENDING)
2501                 ffs->setup_state = FFS_SETUP_CANCELLED;
2502
2503         /*
2504          * Logic of this function guarantees that there are at most four pending
2505          * evens on ffs->ev.types queue.  This is important because the queue
2506          * has space for four elements only and __ffs_ep0_read_events function
2507          * depends on that limit as well.  If more event types are added, those
2508          * limits have to be revisited or guaranteed to still hold.
2509          */
2510         switch (type) {
2511         case FUNCTIONFS_RESUME:
2512                 rem_type2 = FUNCTIONFS_SUSPEND;
2513                 /* FALL THROUGH */
2514         case FUNCTIONFS_SUSPEND:
2515         case FUNCTIONFS_SETUP:
2516                 rem_type1 = type;
2517                 /* Discard all similar events */
2518                 break;
2519
2520         case FUNCTIONFS_BIND:
2521         case FUNCTIONFS_UNBIND:
2522         case FUNCTIONFS_DISABLE:
2523         case FUNCTIONFS_ENABLE:
2524                 /* Discard everything other then power management. */
2525                 rem_type1 = FUNCTIONFS_SUSPEND;
2526                 rem_type2 = FUNCTIONFS_RESUME;
2527                 neg = 1;
2528                 break;
2529
2530         default:
2531                 WARN(1, "%d: unknown event, this should not happen\n", type);
2532                 return;
2533         }
2534
2535         {
2536                 u8 *ev  = ffs->ev.types, *out = ev;
2537                 unsigned n = ffs->ev.count;
2538                 for (; n; --n, ++ev)
2539                         if ((*ev == rem_type1 || *ev == rem_type2) == neg)
2540                                 *out++ = *ev;
2541                         else
2542                                 pr_vdebug("purging event %d\n", *ev);
2543                 ffs->ev.count = out - ffs->ev.types;
2544         }
2545
2546         pr_vdebug("adding event %d\n", type);
2547         ffs->ev.types[ffs->ev.count++] = type;
2548         wake_up_locked(&ffs->ev.waitq);
2549         if (ffs->ffs_eventfd)
2550                 eventfd_signal(ffs->ffs_eventfd, 1);
2551 }
2552
2553 static void ffs_event_add(struct ffs_data *ffs,
2554                           enum usb_functionfs_event_type type)
2555 {
2556         unsigned long flags;
2557         spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
2558         __ffs_event_add(ffs, type);
2559         spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
2560 }
2561
2562 /* Bind/unbind USB function hooks *******************************************/
2563
2564 static int ffs_ep_addr2idx(struct ffs_data *ffs, u8 endpoint_address)
2565 {
2566         int i;
2567
2568         for (i = 1; i < ARRAY_SIZE(ffs->eps_addrmap); ++i)
2569                 if (ffs->eps_addrmap[i] == endpoint_address)
2570                         return i;
2571         return -ENOENT;
2572 }
2573
2574 static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
2575                                     struct usb_descriptor_header *desc,
2576                                     void *priv)
2577 {
2578         struct usb_endpoint_descriptor *ds = (void *)desc;
2579         struct ffs_function *func = priv;
2580         struct ffs_ep *ffs_ep;
2581         unsigned ep_desc_id;
2582         int idx;
2583         static const char *speed_names[] = { "full", "high", "super" };
2584
2585         if (type != FFS_DESCRIPTOR)
2586                 return 0;
2587
2588         /*
2589          * If ss_descriptors is not NULL, we are reading super speed
2590          * descriptors; if hs_descriptors is not NULL, we are reading high
2591          * speed descriptors; otherwise, we are reading full speed
2592          * descriptors.
2593          */
2594         if (func->function.ss_descriptors) {
2595                 ep_desc_id = 2;
2596                 func->function.ss_descriptors[(long)valuep] = desc;
2597         } else if (func->function.hs_descriptors) {
2598                 ep_desc_id = 1;
2599                 func->function.hs_descriptors[(long)valuep] = desc;
2600         } else {
2601                 ep_desc_id = 0;
2602                 func->function.fs_descriptors[(long)valuep]    = desc;
2603         }
2604
2605         if (!desc || desc->bDescriptorType != USB_DT_ENDPOINT)
2606                 return 0;
2607
2608         idx = ffs_ep_addr2idx(func->ffs, ds->bEndpointAddress) - 1;
2609         if (idx < 0)
2610                 return idx;
2611
2612         ffs_ep = func->eps + idx;
2613
2614         if (unlikely(ffs_ep->descs[ep_desc_id])) {
2615                 pr_err("two %sspeed descriptors for EP %d\n",
2616                           speed_names[ep_desc_id],
2617                           ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
2618                 return -EINVAL;
2619         }
2620         ffs_ep->descs[ep_desc_id] = ds;
2621
2622         ffs_dump_mem(": Original  ep desc", ds, ds->bLength);
2623         if (ffs_ep->ep) {
2624                 ds->bEndpointAddress = ffs_ep->descs[0]->bEndpointAddress;
2625                 if (!ds->wMaxPacketSize)
2626                         ds->wMaxPacketSize = ffs_ep->descs[0]->wMaxPacketSize;
2627         } else {
2628                 struct usb_request *req;
2629                 struct usb_ep *ep;
2630                 u8 bEndpointAddress;
2631
2632                 /*
2633                  * We back up bEndpointAddress because autoconfig overwrites
2634                  * it with physical endpoint address.
2635                  */
2636                 bEndpointAddress = ds->bEndpointAddress;
2637                 pr_vdebug("autoconfig\n");
2638                 ep = usb_ep_autoconfig(func->gadget, ds);
2639                 if (unlikely(!ep))
2640                         return -ENOTSUPP;
2641                 ep->driver_data = func->eps + idx;
2642
2643                 req = usb_ep_alloc_request(ep, GFP_KERNEL);
2644                 if (unlikely(!req))
2645                         return -ENOMEM;
2646
2647                 ffs_ep->ep  = ep;
2648                 ffs_ep->req = req;
2649                 func->eps_revmap[ds->bEndpointAddress &
2650                                  USB_ENDPOINT_NUMBER_MASK] = idx + 1;
2651                 /*
2652                  * If we use virtual address mapping, we restore
2653                  * original bEndpointAddress value.
2654                  */
2655                 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
2656                         ds->bEndpointAddress = bEndpointAddress;
2657         }
2658         ffs_dump_mem(": Rewritten ep desc", ds, ds->bLength);
2659
2660         return 0;
2661 }
2662
2663 static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep,
2664                                    struct usb_descriptor_header *desc,
2665                                    void *priv)
2666 {
2667         struct ffs_function *func = priv;
2668         unsigned idx;
2669         u8 newValue;
2670
2671         switch (type) {
2672         default:
2673         case FFS_DESCRIPTOR:
2674                 /* Handled in previous pass by __ffs_func_bind_do_descs() */
2675                 return 0;
2676
2677         case FFS_INTERFACE:
2678                 idx = *valuep;
2679                 if (func->interfaces_nums[idx] < 0) {
2680                         int id = usb_interface_id(func->conf, &func->function);
2681                         if (unlikely(id < 0))
2682                                 return id;
2683                         func->interfaces_nums[idx] = id;
2684                 }
2685                 newValue = func->interfaces_nums[idx];
2686                 break;
2687
2688         case FFS_STRING:
2689                 /* String' IDs are allocated when fsf_data is bound to cdev */
2690                 newValue = func->ffs->stringtabs[0]->strings[*valuep - 1].id;
2691                 break;
2692
2693         case FFS_ENDPOINT:
2694                 /*
2695                  * USB_DT_ENDPOINT are handled in
2696                  * __ffs_func_bind_do_descs().
2697                  */
2698                 if (desc->bDescriptorType == USB_DT_ENDPOINT)
2699                         return 0;
2700
2701                 idx = (*valuep & USB_ENDPOINT_NUMBER_MASK) - 1;
2702                 if (unlikely(!func->eps[idx].ep))
2703                         return -EINVAL;
2704
2705                 {
2706                         struct usb_endpoint_descriptor **descs;
2707                         descs = func->eps[idx].descs;
2708                         newValue = descs[descs[0] ? 0 : 1]->bEndpointAddress;
2709                 }
2710                 break;
2711         }
2712
2713         pr_vdebug("%02x -> %02x\n", *valuep, newValue);
2714         *valuep = newValue;
2715         return 0;
2716 }
2717
2718 static int __ffs_func_bind_do_os_desc(enum ffs_os_desc_type type,
2719                                       struct usb_os_desc_header *h, void *data,
2720                                       unsigned len, void *priv)
2721 {
2722         struct ffs_function *func = priv;
2723         u8 length = 0;
2724
2725         switch (type) {
2726         case FFS_OS_DESC_EXT_COMPAT: {
2727                 struct usb_ext_compat_desc *desc = data;
2728                 struct usb_os_desc_table *t;
2729
2730                 t = &func->function.os_desc_table[desc->bFirstInterfaceNumber];
2731                 t->if_id = func->interfaces_nums[desc->bFirstInterfaceNumber];
2732                 memcpy(t->os_desc->ext_compat_id, &desc->CompatibleID,
2733                        ARRAY_SIZE(desc->CompatibleID) +
2734                        ARRAY_SIZE(desc->SubCompatibleID));
2735                 length = sizeof(*desc);
2736         }
2737                 break;
2738         case FFS_OS_DESC_EXT_PROP: {
2739                 struct usb_ext_prop_desc *desc = data;
2740                 struct usb_os_desc_table *t;
2741                 struct usb_os_desc_ext_prop *ext_prop;
2742                 char *ext_prop_name;
2743                 char *ext_prop_data;
2744
2745                 t = &func->function.os_desc_table[h->interface];
2746                 t->if_id = func->interfaces_nums[h->interface];
2747
2748                 ext_prop = func->ffs->ms_os_descs_ext_prop_avail;
2749                 func->ffs->ms_os_descs_ext_prop_avail += sizeof(*ext_prop);
2750
2751                 ext_prop->type = le32_to_cpu(desc->dwPropertyDataType);
2752                 ext_prop->name_len = le16_to_cpu(desc->wPropertyNameLength);
2753                 ext_prop->data_len = le32_to_cpu(*(u32 *)
2754                         usb_ext_prop_data_len_ptr(data, ext_prop->name_len));
2755                 length = ext_prop->name_len + ext_prop->data_len + 14;
2756
2757                 ext_prop_name = func->ffs->ms_os_descs_ext_prop_name_avail;
2758                 func->ffs->ms_os_descs_ext_prop_name_avail +=
2759                         ext_prop->name_len;
2760
2761                 ext_prop_data = func->ffs->ms_os_descs_ext_prop_data_avail;
2762                 func->ffs->ms_os_descs_ext_prop_data_avail +=
2763                         ext_prop->data_len;
2764                 memcpy(ext_prop_data,
2765                        usb_ext_prop_data_ptr(data, ext_prop->name_len),
2766                        ext_prop->data_len);
2767                 /* unicode data reported to the host as "WCHAR"s */
2768                 switch (ext_prop->type) {
2769                 case USB_EXT_PROP_UNICODE:
2770                 case USB_EXT_PROP_UNICODE_ENV:
2771                 case USB_EXT_PROP_UNICODE_LINK:
2772                 case USB_EXT_PROP_UNICODE_MULTI:
2773                         ext_prop->data_len *= 2;
2774                         break;
2775                 }
2776                 ext_prop->data = ext_prop_data;
2777
2778                 memcpy(ext_prop_name, usb_ext_prop_name_ptr(data),
2779                        ext_prop->name_len);
2780                 /* property name reported to the host as "WCHAR"s */
2781                 ext_prop->name_len *= 2;
2782                 ext_prop->name = ext_prop_name;
2783
2784                 t->os_desc->ext_prop_len +=
2785                         ext_prop->name_len + ext_prop->data_len + 14;
2786                 ++t->os_desc->ext_prop_count;
2787                 list_add_tail(&ext_prop->entry, &t->os_desc->ext_prop);
2788         }
2789                 break;
2790         default:
2791                 pr_vdebug("unknown descriptor: %d\n", type);
2792         }
2793
2794         return length;
2795 }
2796
2797 static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f,
2798                                                 struct usb_configuration *c)
2799 {
2800         struct ffs_function *func = ffs_func_from_usb(f);
2801         struct f_fs_opts *ffs_opts =
2802                 container_of(f->fi, struct f_fs_opts, func_inst);
2803         int ret;
2804
2805         ENTER();
2806
2807         /*
2808          * Legacy gadget triggers binding in functionfs_ready_callback,
2809          * which already uses locking; taking the same lock here would
2810          * cause a deadlock.
2811          *
2812          * Configfs-enabled gadgets however do need ffs_dev_lock.
2813          */
2814         if (!ffs_opts->no_configfs)
2815                 ffs_dev_lock();
2816         ret = ffs_opts->dev->desc_ready ? 0 : -ENODEV;
2817         func->ffs = ffs_opts->dev->ffs_data;
2818         if (!ffs_opts->no_configfs)
2819                 ffs_dev_unlock();
2820         if (ret)
2821                 return ERR_PTR(ret);
2822
2823         func->conf = c;
2824         func->gadget = c->cdev->gadget;
2825
2826         /*
2827          * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
2828          * configurations are bound in sequence with list_for_each_entry,
2829          * in each configuration its functions are bound in sequence
2830          * with list_for_each_entry, so we assume no race condition
2831          * with regard to ffs_opts->bound access
2832          */
2833         if (!ffs_opts->refcnt) {
2834                 ret = functionfs_bind(func->ffs, c->cdev);
2835                 if (ret)
2836                         return ERR_PTR(ret);
2837         }
2838         ffs_opts->refcnt++;
2839         func->function.strings = func->ffs->stringtabs;
2840
2841         return ffs_opts;
2842 }
2843
2844 static int _ffs_func_bind(struct usb_configuration *c,
2845                           struct usb_function *f)
2846 {
2847         struct ffs_function *func = ffs_func_from_usb(f);
2848         struct ffs_data *ffs = func->ffs;
2849
2850         const int full = !!func->ffs->fs_descs_count;
2851         const int high = gadget_is_dualspeed(func->gadget) &&
2852                 func->ffs->hs_descs_count;
2853         const int super = gadget_is_superspeed(func->gadget) &&
2854                 func->ffs->ss_descs_count;
2855
2856         int fs_len, hs_len, ss_len, ret, i;
2857         struct ffs_ep *eps_ptr;
2858
2859         /* Make it a single chunk, less management later on */
2860         vla_group(d);
2861         vla_item_with_sz(d, struct ffs_ep, eps, ffs->eps_count);
2862         vla_item_with_sz(d, struct usb_descriptor_header *, fs_descs,
2863                 full ? ffs->fs_descs_count + 1 : 0);
2864         vla_item_with_sz(d, struct usb_descriptor_header *, hs_descs,
2865                 high ? ffs->hs_descs_count + 1 : 0);
2866         vla_item_with_sz(d, struct usb_descriptor_header *, ss_descs,
2867                 super ? ffs->ss_descs_count + 1 : 0);
2868         vla_item_with_sz(d, short, inums, ffs->interfaces_count);
2869         vla_item_with_sz(d, struct usb_os_desc_table, os_desc_table,
2870                          c->cdev->use_os_string ? ffs->interfaces_count : 0);
2871         vla_item_with_sz(d, char[16], ext_compat,
2872                          c->cdev->use_os_string ? ffs->interfaces_count : 0);
2873         vla_item_with_sz(d, struct usb_os_desc, os_desc,
2874                          c->cdev->use_os_string ? ffs->interfaces_count : 0);
2875         vla_item_with_sz(d, struct usb_os_desc_ext_prop, ext_prop,
2876                          ffs->ms_os_descs_ext_prop_count);
2877         vla_item_with_sz(d, char, ext_prop_name,
2878                          ffs->ms_os_descs_ext_prop_name_len);
2879         vla_item_with_sz(d, char, ext_prop_data,
2880                          ffs->ms_os_descs_ext_prop_data_len);
2881         vla_item_with_sz(d, char, raw_descs, ffs->raw_descs_length);
2882         char *vlabuf;
2883
2884         ENTER();
2885
2886         /* Has descriptors only for speeds gadget does not support */
2887         if (unlikely(!(full | high | super)))
2888                 return -ENOTSUPP;
2889
2890         /* Allocate a single chunk, less management later on */
2891         vlabuf = kzalloc(vla_group_size(d), GFP_KERNEL);
2892         if (unlikely(!vlabuf))
2893                 return -ENOMEM;
2894
2895         ffs->ms_os_descs_ext_prop_avail = vla_ptr(vlabuf, d, ext_prop);
2896         ffs->ms_os_descs_ext_prop_name_avail =
2897                 vla_ptr(vlabuf, d, ext_prop_name);
2898         ffs->ms_os_descs_ext_prop_data_avail =
2899                 vla_ptr(vlabuf, d, ext_prop_data);
2900
2901         /* Copy descriptors  */
2902         memcpy(vla_ptr(vlabuf, d, raw_descs), ffs->raw_descs,
2903                ffs->raw_descs_length);
2904
2905         memset(vla_ptr(vlabuf, d, inums), 0xff, d_inums__sz);
2906         eps_ptr = vla_ptr(vlabuf, d, eps);
2907         for (i = 0; i < ffs->eps_count; i++)
2908                 eps_ptr[i].num = -1;
2909
2910         /* Save pointers
2911          * d_eps == vlabuf, func->eps used to kfree vlabuf later
2912         */
2913         func->eps             = vla_ptr(vlabuf, d, eps);
2914         func->interfaces_nums = vla_ptr(vlabuf, d, inums);
2915
2916         /*
2917          * Go through all the endpoint descriptors and allocate
2918          * endpoints first, so that later we can rewrite the endpoint
2919          * numbers without worrying that it may be described later on.
2920          */
2921         if (likely(full)) {
2922                 func->function.fs_descriptors = vla_ptr(vlabuf, d, fs_descs);
2923                 fs_len = ffs_do_descs(ffs->fs_descs_count,
2924                                       vla_ptr(vlabuf, d, raw_descs),
2925                                       d_raw_descs__sz,
2926                                       __ffs_func_bind_do_descs, func);
2927                 if (unlikely(fs_len < 0)) {
2928                         ret = fs_len;
2929                         goto error;
2930                 }
2931         } else {
2932                 fs_len = 0;
2933         }
2934
2935         if (likely(high)) {
2936                 func->function.hs_descriptors = vla_ptr(vlabuf, d, hs_descs);
2937                 hs_len = ffs_do_descs(ffs->hs_descs_count,
2938                                       vla_ptr(vlabuf, d, raw_descs) + fs_len,
2939                                       d_raw_descs__sz - fs_len,
2940                                       __ffs_func_bind_do_descs, func);
2941                 if (unlikely(hs_len < 0)) {
2942                         ret = hs_len;
2943                         goto error;
2944                 }
2945         } else {
2946                 hs_len = 0;
2947         }
2948
2949         if (likely(super)) {
2950                 func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs);
2951                 ss_len = ffs_do_descs(ffs->ss_descs_count,
2952                                 vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len,
2953                                 d_raw_descs__sz - fs_len - hs_len,
2954                                 __ffs_func_bind_do_descs, func);
2955                 if (unlikely(ss_len < 0)) {
2956                         ret = ss_len;
2957                         goto error;
2958                 }
2959         } else {
2960                 ss_len = 0;
2961         }
2962
2963         /*
2964          * Now handle interface numbers allocation and interface and
2965          * endpoint numbers rewriting.  We can do that in one go
2966          * now.
2967          */
2968         ret = ffs_do_descs(ffs->fs_descs_count +
2969                            (high ? ffs->hs_descs_count : 0) +
2970                            (super ? ffs->ss_descs_count : 0),
2971                            vla_ptr(vlabuf, d, raw_descs), d_raw_descs__sz,
2972                            __ffs_func_bind_do_nums, func);
2973         if (unlikely(ret < 0))
2974                 goto error;
2975
2976         func->function.os_desc_table = vla_ptr(vlabuf, d, os_desc_table);
2977         if (c->cdev->use_os_string) {
2978                 for (i = 0; i < ffs->interfaces_count; ++i) {
2979                         struct usb_os_desc *desc;
2980
2981                         desc = func->function.os_desc_table[i].os_desc =
2982                                 vla_ptr(vlabuf, d, os_desc) +
2983                                 i * sizeof(struct usb_os_desc);
2984                         desc->ext_compat_id =
2985                                 vla_ptr(vlabuf, d, ext_compat) + i * 16;
2986                         INIT_LIST_HEAD(&desc->ext_prop);
2987                 }
2988                 ret = ffs_do_os_descs(ffs->ms_os_descs_count,
2989                                       vla_ptr(vlabuf, d, raw_descs) +
2990                                       fs_len + hs_len + ss_len,
2991                                       d_raw_descs__sz - fs_len - hs_len -
2992                                       ss_len,
2993                                       __ffs_func_bind_do_os_desc, func);
2994                 if (unlikely(ret < 0))
2995                         goto error;
2996         }
2997         func->function.os_desc_n =
2998                 c->cdev->use_os_string ? ffs->interfaces_count : 0;
2999
3000         /* And we're done */
3001         ffs_event_add(ffs, FUNCTIONFS_BIND);
3002         return 0;
3003
3004 error:
3005         /* XXX Do we need to release all claimed endpoints here? */
3006         return ret;
3007 }
3008
3009 static int ffs_func_bind(struct usb_configuration *c,
3010                          struct usb_function *f)
3011 {
3012         struct f_fs_opts *ffs_opts = ffs_do_functionfs_bind(f, c);
3013         struct ffs_function *func = ffs_func_from_usb(f);
3014         int ret;
3015
3016         if (IS_ERR(ffs_opts))
3017                 return PTR_ERR(ffs_opts);
3018
3019         ret = _ffs_func_bind(c, f);
3020         if (ret && !--ffs_opts->refcnt)
3021                 functionfs_unbind(func->ffs);
3022
3023         return ret;
3024 }
3025
3026
3027 /* Other USB function hooks *************************************************/
3028
3029 static void ffs_reset_work(struct work_struct *work)
3030 {
3031         struct ffs_data *ffs = container_of(work,
3032                 struct ffs_data, reset_work);
3033         ffs_data_reset(ffs);
3034 }
3035
3036 static int ffs_func_set_alt(struct usb_function *f,
3037                             unsigned interface, unsigned alt)
3038 {
3039         struct ffs_function *func = ffs_func_from_usb(f);
3040         struct ffs_data *ffs = func->ffs;
3041         int ret = 0, intf;
3042
3043         if (alt != (unsigned)-1) {
3044                 intf = ffs_func_revmap_intf(func, interface);
3045                 if (unlikely(intf < 0))
3046                         return intf;
3047         }
3048
3049         if (ffs->func)
3050                 ffs_func_eps_disable(ffs->func);
3051
3052         if (ffs->state == FFS_DEACTIVATED) {
3053                 ffs->state = FFS_CLOSING;
3054                 INIT_WORK(&ffs->reset_work, ffs_reset_work);
3055                 schedule_work(&ffs->reset_work);
3056                 return -ENODEV;
3057         }
3058
3059         if (ffs->state != FFS_ACTIVE)
3060                 return -ENODEV;
3061
3062         if (alt == (unsigned)-1) {
3063                 ffs->func = NULL;
3064                 ffs_event_add(ffs, FUNCTIONFS_DISABLE);
3065                 return 0;
3066         }
3067
3068         ffs->func = func;
3069         ret = ffs_func_eps_enable(func);
3070         if (likely(ret >= 0))
3071                 ffs_event_add(ffs, FUNCTIONFS_ENABLE);
3072         return ret;
3073 }
3074
3075 static void ffs_func_disable(struct usb_function *f)
3076 {
3077         ffs_func_set_alt(f, 0, (unsigned)-1);
3078 }
3079
3080 static int ffs_func_setup(struct usb_function *f,
3081                           const struct usb_ctrlrequest *creq)
3082 {
3083         struct ffs_function *func = ffs_func_from_usb(f);
3084         struct ffs_data *ffs = func->ffs;
3085         unsigned long flags;
3086         int ret;
3087
3088         ENTER();
3089
3090         pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType);
3091         pr_vdebug("creq->bRequest     = %02x\n", creq->bRequest);
3092         pr_vdebug("creq->wValue       = %04x\n", le16_to_cpu(creq->wValue));
3093         pr_vdebug("creq->wIndex       = %04x\n", le16_to_cpu(creq->wIndex));
3094         pr_vdebug("creq->wLength      = %04x\n", le16_to_cpu(creq->wLength));
3095
3096         /*
3097          * Most requests directed to interface go through here
3098          * (notable exceptions are set/get interface) so we need to
3099          * handle them.  All other either handled by composite or
3100          * passed to usb_configuration->setup() (if one is set).  No
3101          * matter, we will handle requests directed to endpoint here
3102          * as well (as it's straightforward).  Other request recipient
3103          * types are only handled when the user flag FUNCTIONFS_ALL_CTRL_RECIP
3104          * is being used.
3105          */
3106         if (ffs->state != FFS_ACTIVE)
3107                 return -ENODEV;
3108
3109         switch (creq->bRequestType & USB_RECIP_MASK) {
3110         case USB_RECIP_INTERFACE:
3111                 ret = ffs_func_revmap_intf(func, le16_to_cpu(creq->wIndex));
3112                 if (unlikely(ret < 0))
3113                         return ret;
3114                 break;
3115
3116         case USB_RECIP_ENDPOINT:
3117                 ret = ffs_func_revmap_ep(func, le16_to_cpu(creq->wIndex));
3118                 if (unlikely(ret < 0))
3119                         return ret;
3120                 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
3121                         ret = func->ffs->eps_addrmap[ret];
3122                 break;
3123
3124         default:
3125                 if (func->ffs->user_flags & FUNCTIONFS_ALL_CTRL_RECIP)
3126                         ret = le16_to_cpu(creq->wIndex);
3127                 else
3128                         return -EOPNOTSUPP;
3129         }
3130
3131         spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
3132         ffs->ev.setup = *creq;
3133         ffs->ev.setup.wIndex = cpu_to_le16(ret);
3134         __ffs_event_add(ffs, FUNCTIONFS_SETUP);
3135         spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
3136
3137         return 0;
3138 }
3139
3140 static bool ffs_func_req_match(struct usb_function *f,
3141                                const struct usb_ctrlrequest *creq,
3142                                bool config0)
3143 {
3144         struct ffs_function *func = ffs_func_from_usb(f);
3145
3146         if (config0 && !(func->ffs->user_flags & FUNCTIONFS_CONFIG0_SETUP))
3147                 return false;
3148
3149         switch (creq->bRequestType & USB_RECIP_MASK) {
3150         case USB_RECIP_INTERFACE:
3151                 return ffs_func_revmap_intf(func,
3152                                             le16_to_cpu(creq->wIndex) >= 0);
3153         case USB_RECIP_ENDPOINT:
3154                 return ffs_func_revmap_ep(func,
3155                                           le16_to_cpu(creq->wIndex) >= 0);
3156         default:
3157                 return (bool) (func->ffs->user_flags &
3158                                FUNCTIONFS_ALL_CTRL_RECIP);
3159         }
3160 }
3161
3162 static void ffs_func_suspend(struct usb_function *f)
3163 {
3164         ENTER();
3165         ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_SUSPEND);
3166 }
3167
3168 static void ffs_func_resume(struct usb_function *f)
3169 {
3170         ENTER();
3171         ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_RESUME);
3172 }
3173
3174
3175 /* Endpoint and interface numbers reverse mapping ***************************/
3176
3177 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num)
3178 {
3179         num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK];
3180         return num ? num : -EDOM;
3181 }
3182
3183 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf)
3184 {
3185         short *nums = func->interfaces_nums;
3186         unsigned count = func->ffs->interfaces_count;
3187
3188         for (; count; --count, ++nums) {
3189                 if (*nums >= 0 && *nums == intf)
3190                         return nums - func->interfaces_nums;
3191         }
3192
3193         return -EDOM;
3194 }
3195
3196
3197 /* Devices management *******************************************************/
3198
3199 static LIST_HEAD(ffs_devices);
3200
3201 static struct ffs_dev *_ffs_do_find_dev(const char *name)
3202 {
3203         struct ffs_dev *dev;
3204
3205         list_for_each_entry(dev, &ffs_devices, entry) {
3206                 if (!dev->name || !name)
3207                         continue;
3208                 if (strcmp(dev->name, name) == 0)
3209                         return dev;
3210         }
3211
3212         return NULL;
3213 }
3214
3215 /*
3216  * ffs_lock must be taken by the caller of this function
3217  */
3218 static struct ffs_dev *_ffs_get_single_dev(void)
3219 {
3220         struct ffs_dev *dev;
3221
3222         if (list_is_singular(&ffs_devices)) {
3223                 dev = list_first_entry(&ffs_devices, struct ffs_dev, entry);
3224                 if (dev->single)
3225                         return dev;
3226         }
3227
3228         return NULL;
3229 }
3230
3231 /*
3232  * ffs_lock must be taken by the caller of this function
3233  */
3234 static struct ffs_dev *_ffs_find_dev(const char *name)
3235 {
3236         struct ffs_dev *dev;
3237
3238         dev = _ffs_get_single_dev();
3239         if (dev)
3240                 return dev;
3241
3242         return _ffs_do_find_dev(name);
3243 }
3244
3245 /* Configfs support *********************************************************/
3246
3247 static inline struct f_fs_opts *to_ffs_opts(struct config_item *item)
3248 {
3249         return container_of(to_config_group(item), struct f_fs_opts,
3250                             func_inst.group);
3251 }
3252
3253 static void ffs_attr_release(struct config_item *item)
3254 {
3255         struct f_fs_opts *opts = to_ffs_opts(item);
3256
3257         usb_put_function_instance(&opts->func_inst);
3258 }
3259
3260 static struct configfs_item_operations ffs_item_ops = {
3261         .release        = ffs_attr_release,
3262 };
3263
3264 static struct config_item_type ffs_func_type = {
3265         .ct_item_ops    = &ffs_item_ops,
3266         .ct_owner       = THIS_MODULE,
3267 };
3268
3269
3270 /* Function registration interface ******************************************/
3271
3272 static void ffs_free_inst(struct usb_function_instance *f)
3273 {
3274         struct f_fs_opts *opts;
3275
3276         opts = to_f_fs_opts(f);
3277         ffs_dev_lock();
3278         _ffs_free_dev(opts->dev);
3279         ffs_dev_unlock();
3280         kfree(opts);
3281 }
3282
3283 #define MAX_INST_NAME_LEN       40
3284
3285 static int ffs_set_inst_name(struct usb_function_instance *fi, const char *name)
3286 {
3287         struct f_fs_opts *opts;
3288         char *ptr;
3289         const char *tmp;
3290         int name_len, ret;
3291
3292         name_len = strlen(name) + 1;
3293         if (name_len > MAX_INST_NAME_LEN)
3294                 return -ENAMETOOLONG;
3295
3296         ptr = kstrndup(name, name_len, GFP_KERNEL);
3297         if (!ptr)
3298                 return -ENOMEM;
3299
3300         opts = to_f_fs_opts(fi);
3301         tmp = NULL;
3302
3303         ffs_dev_lock();
3304
3305         tmp = opts->dev->name_allocated ? opts->dev->name : NULL;
3306         ret = _ffs_name_dev(opts->dev, ptr);
3307         if (ret) {
3308                 kfree(ptr);
3309                 ffs_dev_unlock();
3310                 return ret;
3311         }
3312         opts->dev->name_allocated = true;
3313
3314         ffs_dev_unlock();
3315
3316         kfree(tmp);
3317
3318         return 0;
3319 }
3320
3321 static struct usb_function_instance *ffs_alloc_inst(void)
3322 {
3323         struct f_fs_opts *opts;
3324         struct ffs_dev *dev;
3325
3326         opts = kzalloc(sizeof(*opts), GFP_KERNEL);
3327         if (!opts)
3328                 return ERR_PTR(-ENOMEM);
3329
3330         opts->func_inst.set_inst_name = ffs_set_inst_name;
3331         opts->func_inst.free_func_inst = ffs_free_inst;
3332         ffs_dev_lock();
3333         dev = _ffs_alloc_dev();
3334         ffs_dev_unlock();
3335         if (IS_ERR(dev)) {
3336                 kfree(opts);
3337                 return ERR_CAST(dev);
3338         }
3339         opts->dev = dev;
3340         dev->opts = opts;
3341
3342         config_group_init_type_name(&opts->func_inst.group, "",
3343                                     &ffs_func_type);
3344         return &opts->func_inst;
3345 }
3346
3347 static void ffs_free(struct usb_function *f)
3348 {
3349         kfree(ffs_func_from_usb(f));
3350 }
3351
3352 static void ffs_func_unbind(struct usb_configuration *c,
3353                             struct usb_function *f)
3354 {
3355         struct ffs_function *func = ffs_func_from_usb(f);
3356         struct ffs_data *ffs = func->ffs;
3357         struct f_fs_opts *opts =
3358                 container_of(f->fi, struct f_fs_opts, func_inst);
3359         struct ffs_ep *ep = func->eps;
3360         unsigned count = ffs->eps_count;
3361         unsigned long flags;
3362
3363         ENTER();
3364         if (ffs->func == func) {
3365                 ffs_func_eps_disable(func);
3366                 ffs->func = NULL;
3367         }
3368
3369         if (!--opts->refcnt)
3370                 functionfs_unbind(ffs);
3371
3372         /* cleanup after autoconfig */
3373         spin_lock_irqsave(&func->ffs->eps_lock, flags);
3374         do {
3375                 if (ep->ep && ep->req)
3376                         usb_ep_free_request(ep->ep, ep->req);
3377                 ep->req = NULL;
3378                 ++ep;
3379         } while (--count);
3380         spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
3381         kfree(func->eps);
3382         func->eps = NULL;
3383         /*
3384          * eps, descriptors and interfaces_nums are allocated in the
3385          * same chunk so only one free is required.
3386          */
3387         func->function.fs_descriptors = NULL;
3388         func->function.hs_descriptors = NULL;
3389         func->function.ss_descriptors = NULL;
3390         func->interfaces_nums = NULL;
3391
3392         ffs_event_add(ffs, FUNCTIONFS_UNBIND);
3393 }
3394
3395 static struct usb_function *ffs_alloc(struct usb_function_instance *fi)
3396 {
3397         struct ffs_function *func;
3398
3399         ENTER();
3400
3401         func = kzalloc(sizeof(*func), GFP_KERNEL);
3402         if (unlikely(!func))
3403                 return ERR_PTR(-ENOMEM);
3404
3405         func->function.name    = "Function FS Gadget";
3406
3407         func->function.bind    = ffs_func_bind;
3408         func->function.unbind  = ffs_func_unbind;
3409         func->function.set_alt = ffs_func_set_alt;
3410         func->function.disable = ffs_func_disable;
3411         func->function.setup   = ffs_func_setup;
3412         func->function.req_match = ffs_func_req_match;
3413         func->function.suspend = ffs_func_suspend;
3414         func->function.resume  = ffs_func_resume;
3415         func->function.free_func = ffs_free;
3416
3417         return &func->function;
3418 }
3419
3420 /*
3421  * ffs_lock must be taken by the caller of this function
3422  */
3423 static struct ffs_dev *_ffs_alloc_dev(void)
3424 {
3425         struct ffs_dev *dev;
3426         int ret;
3427
3428         if (_ffs_get_single_dev())
3429                         return ERR_PTR(-EBUSY);
3430
3431         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3432         if (!dev)
3433                 return ERR_PTR(-ENOMEM);
3434
3435         if (list_empty(&ffs_devices)) {
3436                 ret = functionfs_init();
3437                 if (ret) {
3438                         kfree(dev);
3439                         return ERR_PTR(ret);
3440                 }
3441         }
3442
3443         list_add(&dev->entry, &ffs_devices);
3444
3445         return dev;
3446 }
3447
3448 /*
3449  * ffs_lock must be taken by the caller of this function
3450  * The caller is responsible for "name" being available whenever f_fs needs it
3451  */
3452 static int _ffs_name_dev(struct ffs_dev *dev, const char *name)
3453 {
3454         struct ffs_dev *existing;
3455
3456         existing = _ffs_do_find_dev(name);
3457         if (existing)
3458                 return -EBUSY;
3459
3460         dev->name = name;
3461
3462         return 0;
3463 }
3464
3465 /*
3466  * The caller is responsible for "name" being available whenever f_fs needs it
3467  */
3468 int ffs_name_dev(struct ffs_dev *dev, const char *name)
3469 {
3470         int ret;
3471
3472         ffs_dev_lock();
3473         ret = _ffs_name_dev(dev, name);
3474         ffs_dev_unlock();
3475
3476         return ret;
3477 }
3478 EXPORT_SYMBOL_GPL(ffs_name_dev);
3479
3480 int ffs_single_dev(struct ffs_dev *dev)
3481 {
3482         int ret;
3483
3484         ret = 0;
3485         ffs_dev_lock();
3486
3487         if (!list_is_singular(&ffs_devices))
3488                 ret = -EBUSY;
3489         else
3490                 dev->single = true;
3491
3492         ffs_dev_unlock();
3493         return ret;
3494 }
3495 EXPORT_SYMBOL_GPL(ffs_single_dev);
3496
3497 /*
3498  * ffs_lock must be taken by the caller of this function
3499  */
3500 static void _ffs_free_dev(struct ffs_dev *dev)
3501 {
3502         list_del(&dev->entry);
3503         if (dev->name_allocated)
3504                 kfree(dev->name);
3505
3506         /* Clear the private_data pointer to stop incorrect dev access */
3507         if (dev->ffs_data)
3508                 dev->ffs_data->private_data = NULL;
3509
3510         kfree(dev);
3511         if (list_empty(&ffs_devices))
3512                 functionfs_cleanup();
3513 }
3514
3515 static void *ffs_acquire_dev(const char *dev_name)
3516 {
3517         struct ffs_dev *ffs_dev;
3518
3519         ENTER();
3520         ffs_dev_lock();
3521
3522         ffs_dev = _ffs_find_dev(dev_name);
3523         if (!ffs_dev)
3524                 ffs_dev = ERR_PTR(-ENOENT);
3525         else if (ffs_dev->mounted)
3526                 ffs_dev = ERR_PTR(-EBUSY);
3527         else if (ffs_dev->ffs_acquire_dev_callback &&
3528             ffs_dev->ffs_acquire_dev_callback(ffs_dev))
3529                 ffs_dev = ERR_PTR(-ENOENT);
3530         else
3531                 ffs_dev->mounted = true;
3532
3533         ffs_dev_unlock();
3534         return ffs_dev;
3535 }
3536
3537 static void ffs_release_dev(struct ffs_data *ffs_data)
3538 {
3539         struct ffs_dev *ffs_dev;
3540
3541         ENTER();
3542         ffs_dev_lock();
3543
3544         ffs_dev = ffs_data->private_data;
3545         if (ffs_dev) {
3546                 ffs_dev->mounted = false;
3547
3548                 if (ffs_dev->ffs_release_dev_callback)
3549                         ffs_dev->ffs_release_dev_callback(ffs_dev);
3550         }
3551
3552         ffs_dev_unlock();
3553 }
3554
3555 static int ffs_ready(struct ffs_data *ffs)
3556 {
3557         struct ffs_dev *ffs_obj;
3558         int ret = 0;
3559
3560         ENTER();
3561         ffs_dev_lock();
3562
3563         ffs_obj = ffs->private_data;
3564         if (!ffs_obj) {
3565                 ret = -EINVAL;
3566                 goto done;
3567         }
3568         if (WARN_ON(ffs_obj->desc_ready)) {
3569                 ret = -EBUSY;
3570                 goto done;
3571         }
3572
3573         ffs_obj->desc_ready = true;
3574         ffs_obj->ffs_data = ffs;
3575
3576         if (ffs_obj->ffs_ready_callback) {
3577                 ret = ffs_obj->ffs_ready_callback(ffs);
3578                 if (ret)
3579                         goto done;
3580         }
3581
3582         set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags);
3583 done:
3584         ffs_dev_unlock();
3585         return ret;
3586 }
3587
3588 static void ffs_closed(struct ffs_data *ffs)
3589 {
3590         struct ffs_dev *ffs_obj;
3591         struct f_fs_opts *opts;
3592
3593         ENTER();
3594         ffs_dev_lock();
3595
3596         ffs_obj = ffs->private_data;
3597         if (!ffs_obj)
3598                 goto done;
3599
3600         ffs_obj->desc_ready = false;
3601
3602         if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
3603             ffs_obj->ffs_closed_callback)
3604                 ffs_obj->ffs_closed_callback(ffs);
3605
3606         if (ffs_obj->opts)
3607                 opts = ffs_obj->opts;
3608         else
3609                 goto done;
3610
3611         if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent
3612             || !atomic_read(&opts->func_inst.group.cg_item.ci_kref.refcount))
3613                 goto done;
3614
3615         unregister_gadget_item(ffs_obj->opts->
3616                                func_inst.group.cg_item.ci_parent->ci_parent);
3617 done:
3618         ffs_dev_unlock();
3619 }
3620
3621 /* Misc helper functions ****************************************************/
3622
3623 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
3624 {
3625         return nonblock
3626                 ? likely(mutex_trylock(mutex)) ? 0 : -EAGAIN
3627                 : mutex_lock_interruptible(mutex);
3628 }
3629
3630 static char *ffs_prepare_buffer(const char __user *buf, size_t len)
3631 {
3632         char *data;
3633
3634         if (unlikely(!len))
3635                 return NULL;
3636
3637         data = kmalloc(len, GFP_KERNEL);
3638         if (unlikely(!data))
3639                 return ERR_PTR(-ENOMEM);
3640
3641         if (unlikely(copy_from_user(data, buf, len))) {
3642                 kfree(data);
3643                 return ERR_PTR(-EFAULT);
3644         }
3645
3646         pr_vdebug("Buffer from user space:\n");
3647         ffs_dump_mem("", data, len);
3648
3649         return data;
3650 }
3651
3652 DECLARE_USB_FUNCTION_INIT(ffs, ffs_alloc_inst, ffs_alloc);
3653 MODULE_LICENSE("GPL");
3654 MODULE_AUTHOR("Michal Nazarewicz");