linux - drivers/usb/gadget/function/f

4481 lines · 106.9 KiB

1	// SPDX-License-Identifier: GPL-2.0+
2	/*
3	* f_fs.c -- user mode file system API for USB composite function controllers
4	*
5	* Copyright (C) 2010 Samsung Electronics
6	* Author: Michal Nazarewicz <[email protected]>
7	*
8	* Based on inode.c (GadgetFS) which was:
9	* Copyright (C) 2003-2004 David Brownell
10	* Copyright (C) 2003 Agilent Technologies
11	*/
12
13
14	/* #define DEBUG */
15	/* #define VERBOSE_DEBUG */
16
17	#include <linux/blkdev.h>
18	#include <linux/dma-buf.h>
19	#include <linux/dma-fence.h>
20	#include <linux/dma-resv.h>
21	#include <linux/pagemap.h>
22	#include <linux/export.h>
23	#include <linux/fs_parser.h>
24	#include <linux/hid.h>
25	#include <linux/mm.h>
26	#include <linux/module.h>
27	#include <linux/scatterlist.h>
28	#include <linux/sched/signal.h>
29	#include <linux/uio.h>
30	#include <linux/vmalloc.h>
31	#include <linux/unaligned.h>
32
33	#include <linux/usb/ccid.h>
34	#include <linux/usb/composite.h>
35	#include <linux/usb/functionfs.h>
36	#include <linux/usb/func_utils.h>
37
38	#include <linux/aio.h>
39	#include <linux/kthread.h>
40	#include <linux/poll.h>
41	#include <linux/eventfd.h>
42
43	#include "u_fs.h"
44	#include "u_os_desc.h"
45	#include "configfs.h"
46
47	#define FUNCTIONFS_MAGIC 0xa647361 /* Chosen by a honest dice roll ;) */
48	#define MAX_ALT_SETTINGS 2 /* Allow up to 2 alt settings to be set. */
49
50	#define DMABUF_ENQUEUE_TIMEOUT_MS 5000
51
52	MODULE_IMPORT_NS("DMA_BUF");
53
54	/* Reference counter handling */
55	static void ffs_data_get(struct ffs_data *ffs);
56	static void ffs_data_put(struct ffs_data *ffs);
57	/* Creates new ffs_data object. */
58	static struct ffs_data __must_check ffs_data_new(const char dev_name)
59	__attribute__((malloc));
60
61	/* Opened counter handling. */
62	static void ffs_data_closed(struct ffs_data *ffs);
63
64	/* Called with ffs->mutex held; take over ownership of data. */
65	static int __must_check
66	__ffs_data_got_descs(struct ffs_data ffs, char data, size_t len);
67	static int __must_check
68	__ffs_data_got_strings(struct ffs_data ffs, char data, size_t len);
69
70
71	/* The function structure ***************************************************/
72
73	struct ffs_ep;
74
75	struct ffs_function {
76	struct usb_configuration *conf;
77	struct usb_gadget *gadget;
78	struct ffs_data *ffs;
79
80	struct ffs_ep *eps;
81	u8 eps_revmap[16];
82	short *interfaces_nums;
83
84	struct usb_function function;
85	int cur_alt[MAX_CONFIG_INTERFACES];
86	};
87
88
89	static struct ffs_function ffs_func_from_usb(struct usb_function f)
90	{
91	return container_of(f, struct ffs_function, function);
92	}
93
94
95	static inline enum ffs_setup_state
96	ffs_setup_state_clear_cancelled(struct ffs_data *ffs)
97	{
98	return (enum ffs_setup_state)
99	cmpxchg(&ffs->setup_state, FFS_SETUP_CANCELLED, FFS_NO_SETUP);
100	}
101
102
103	static void ffs_func_eps_disable(struct ffs_function *func);
104	static int __must_check ffs_func_eps_enable(struct ffs_function *func);
105
106	static int ffs_func_bind(struct usb_configuration *,
107	struct usb_function *);
108	static int ffs_func_set_alt(struct usb_function *, unsigned, unsigned);
109	static int ffs_func_get_alt(struct usb_function *f, unsigned int intf);
110	static void ffs_func_disable(struct usb_function *);
111	static int ffs_func_setup(struct usb_function *,
112	const struct usb_ctrlrequest *);
113	static bool ffs_func_req_match(struct usb_function *,
114	const struct usb_ctrlrequest *,
115	bool config0);
116	static void ffs_func_suspend(struct usb_function *);
117	static void ffs_func_resume(struct usb_function *);
118
119
120	static int ffs_func_revmap_ep(struct ffs_function *func, u8 num);
121	static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf);
122
123
124	/* The endpoints structures *************************************************/
125
126	struct ffs_ep {
127	struct usb_ep ep; / P: ffs->eps_lock */
128	struct usb_request req; / P: epfile->mutex */
129
130	/* [0]: full speed, [1]: high speed, [2]: super speed */
131	struct usb_endpoint_descriptor *descs[3];
132
133	u8 num;
134	};
135
136	struct ffs_dmabuf_priv {
137	struct list_head entry;
138	struct kref ref;
139	struct ffs_data *ffs;
140	struct dma_buf_attachment *attach;
141	struct sg_table *sgt;
142	enum dma_data_direction dir;
143	spinlock_t lock;
144	u64 context;
145	struct usb_request req; / P: ffs->eps_lock */
146	struct usb_ep ep; / P: ffs->eps_lock */
147	};
148
149	struct ffs_dma_fence {
150	struct dma_fence base;
151	struct ffs_dmabuf_priv *priv;
152	struct work_struct work;
153	struct usb_ep *ep;
154	struct usb_request *req;
155	};
156
157	struct ffs_epfile {
158	/* Protects ep->ep and ep->req. */
159	struct mutex mutex;
160
161	struct ffs_data *ffs;
162	struct ffs_ep ep; / P: ffs->eps_lock */
163	struct ffs_epfile epfile_in; / P: ffs->eps_lock */
164	struct ffs_epfile epfile_out; / P: ffs->eps_lock */
165
166	/*
167	* Buffer for holding data from partial reads which may happen since
168	* we’re rounding user read requests to a multiple of a max packet size.
169	*
170	* The pointer is initialised with NULL value and may be set by
171	* __ffs_epfile_read_data function to point to a temporary buffer.
172	*
173	* In normal operation, calls to __ffs_epfile_read_buffered will consume
174	* data from said buffer and eventually free it. Importantly, while the
175	* function is using the buffer, it sets the pointer to NULL. This is
176	* all right since __ffs_epfile_read_data and __ffs_epfile_read_buffered
177	* can never run concurrently (they are synchronised by epfile->mutex)
178	* so the latter will not assign a new value to the pointer.
179	*
180	* Meanwhile ffs_func_eps_disable frees the buffer (if the pointer is
181	* valid) and sets the pointer to READ_BUFFER_DROP value. This special
182	* value is crux of the synchronisation between ffs_func_eps_disable and
183	* __ffs_epfile_read_data.
184	*
185	* Once __ffs_epfile_read_data is about to finish it will try to set the
186	* pointer back to its old value (as described above), but seeing as the
187	* pointer is not-NULL (namely READ_BUFFER_DROP) it will instead free
188	* the buffer.
189	*
190	* == State transitions ==
191	*
192	* • ptr == NULL: (initial state)
193	* ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP
194	* ◦ __ffs_epfile_read_buffered: nop
195	* ◦ __ffs_epfile_read_data allocates temp buffer: go to ptr == buf
196	* ◦ reading finishes: n/a, not in ‘and reading’ state
197	* • ptr == DROP:
198	* ◦ __ffs_epfile_read_buffer_free: nop
199	* ◦ __ffs_epfile_read_buffered: go to ptr == NULL
200	* ◦ __ffs_epfile_read_data allocates temp buffer: free buf, nop
201	* ◦ reading finishes: n/a, not in ‘and reading’ state
202	* • ptr == buf:
203	* ◦ __ffs_epfile_read_buffer_free: free buf, go to ptr == DROP
204	* ◦ __ffs_epfile_read_buffered: go to ptr == NULL and reading
205	* ◦ __ffs_epfile_read_data: n/a, __ffs_epfile_read_buffered
206	* is always called first
207	* ◦ reading finishes: n/a, not in ‘and reading’ state
208	* • ptr == NULL and reading:
209	* ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP and reading
210	* ◦ __ffs_epfile_read_buffered: n/a, mutex is held
211	* ◦ __ffs_epfile_read_data: n/a, mutex is held
212	* ◦ reading finishes and …
213	* … all data read: free buf, go to ptr == NULL
214	* … otherwise: go to ptr == buf and reading
215	* • ptr == DROP and reading:
216	* ◦ __ffs_epfile_read_buffer_free: nop
217	* ◦ __ffs_epfile_read_buffered: n/a, mutex is held
218	* ◦ __ffs_epfile_read_data: n/a, mutex is held
219	* ◦ reading finishes: free buf, go to ptr == DROP
220	*/
221	struct ffs_buffer *read_buffer;
222	#define READ_BUFFER_DROP ((struct ffs_buffer *)ERR_PTR(-ESHUTDOWN))
223
224	char name[8];
225
226	unsigned char in; /* P: ffs->eps_lock */
227	unsigned char isoc; /* P: ffs->eps_lock */
228
229	u8 zlp_enabled; /* P: ffs->eps_lock */
230	bool is_rw_proxy;
231
232	/* Protects dmabufs */
233	struct mutex dmabufs_mutex;
234	struct list_head dmabufs; /* P: dmabufs_mutex */
235	atomic_t seqno;
236	};
237
238	struct ffs_buffer {
239	size_t length;
240	char *data;
241	char storage[] __counted_by(length);
242	};
243
244	/* ffs_io_data structure ***************************************************/
245
246	struct ffs_io_data {
247	bool aio;
248	bool read;
249
250	struct kiocb *kiocb;
251	struct iov_iter data;
252	const void *to_free;
253	char *buf;
254
255	struct mm_struct *mm;
256	struct work_struct work;
257
258	struct usb_ep *ep;
259	struct usb_request *req;
260	struct sg_table sgt;
261	bool use_sg;
262
263	struct ffs_data *ffs;
264
265	int status;
266	struct completion done;
267	};
268
269	struct ffs_desc_helper {
270	struct ffs_data *ffs;
271	unsigned interfaces_count;
272	unsigned eps_count;
273	};
274
275	static int __must_check ffs_epfiles_create(struct ffs_data *ffs);
276	static void ffs_epfiles_destroy(struct super_block *sb,
277	struct ffs_epfile *epfiles, unsigned count);
278
279	static int ffs_sb_create_file(struct super_block sb, const char name,
280	void data, const struct file_operations fops);
281
282	/* Devices management *******************************************************/
283
284	DEFINE_MUTEX(ffs_lock);
285	EXPORT_SYMBOL_GPL(ffs_lock);
286
287	static struct ffs_dev _ffs_find_dev(const char name);
288	static struct ffs_dev *_ffs_alloc_dev(void);
289	static void _ffs_free_dev(struct ffs_dev *dev);
290	static int ffs_acquire_dev(const char dev_name, struct ffs_data ffs_data);
291	static void ffs_release_dev(struct ffs_dev *ffs_dev);
292	static int ffs_ready(struct ffs_data *ffs);
293	static void ffs_closed(struct ffs_data *ffs);
294	static void ffs_reset_work(struct work_struct *work);
295
296	/* Misc helper functions ****************************************************/
297
298	static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
299	__attribute__((warn_unused_result, nonnull));
300	static char ffs_prepare_buffer(const char __user buf, size_t len)
301	__attribute__((warn_unused_result, nonnull));
302
303
304	/* Control file aka ep0 *****************************************************/
305
306	static void ffs_ep0_complete(struct usb_ep ep, struct usb_request req)
307	{
308	struct ffs_data *ffs = req->context;
309
310	complete(&ffs->ep0req_completion);
311	}
312
313	static int __ffs_ep0_queue_wait(struct ffs_data ffs, char data, size_t len)
314	__releases(&ffs->ev.waitq.lock)
315	{
316	struct usb_request *req = ffs->ep0req;
317	int ret;
318
319	if (!req) {
320	spin_unlock_irq(&ffs->ev.waitq.lock);
321	return -EINVAL;
322	}
323
324	req->zero = len < le16_to_cpu(ffs->ev.setup.wLength);
325
326	spin_unlock_irq(&ffs->ev.waitq.lock);
327
328	req->buf = data;
329	req->length = len;
330
331	/*
332	* UDC layer requires to provide a buffer even for ZLP, but should
333	* not use it at all. Let's provide some poisoned pointer to catch
334	* possible bug in the driver.
335	*/
336	if (req->buf == NULL)
337	req->buf = (void *)0xDEADBABE;
338
339	reinit_completion(&ffs->ep0req_completion);
340
341	ret = usb_ep_queue(ffs->gadget->ep0, req, GFP_ATOMIC);
342	if (ret < 0)
343	return ret;
344
345	ret = wait_for_completion_interruptible(&ffs->ep0req_completion);
346	if (ret) {
347	usb_ep_dequeue(ffs->gadget->ep0, req);
348	return -EINTR;
349	}
350
351	ffs->setup_state = FFS_NO_SETUP;
352	return req->status ? req->status : req->actual;
353	}
354
355	static int __ffs_ep0_stall(struct ffs_data *ffs)
356	{
357	if (ffs->ev.can_stall) {
358	pr_vdebug("ep0 stall\n");
359	usb_ep_set_halt(ffs->gadget->ep0);
360	ffs->setup_state = FFS_NO_SETUP;
361	return -EL2HLT;
362	} else {
363	pr_debug("bogus ep0 stall!\n");
364	return -ESRCH;
365	}
366	}
367
368	static ssize_t ffs_ep0_write(struct file file, const char __user buf,
369	size_t len, loff_t *ptr)
370	{
371	struct ffs_data *ffs = file->private_data;
372	ssize_t ret;
373	char *data;
374
375	/* Fast check if setup was canceled */
376	if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
377	return -EIDRM;
378
379	/* Acquire mutex */
380	ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
381	if (ret < 0)
382	return ret;
383
384	/* Check state */
385	switch (ffs->state) {
386	case FFS_READ_DESCRIPTORS:
387	case FFS_READ_STRINGS:
388	/* Copy data */
389	if (len < 16) {
390	ret = -EINVAL;
391	break;
392	}
393
394	data = ffs_prepare_buffer(buf, len);
395	if (IS_ERR(data)) {
396	ret = PTR_ERR(data);
397	break;
398	}
399
400	/* Handle data */
401	if (ffs->state == FFS_READ_DESCRIPTORS) {
402	pr_info("read descriptors\n");
403	ret = __ffs_data_got_descs(ffs, data, len);
404	if (ret < 0)
405	break;
406
407	ffs->state = FFS_READ_STRINGS;
408	ret = len;
409	} else {
410	pr_info("read strings\n");
411	ret = __ffs_data_got_strings(ffs, data, len);
412	if (ret < 0)
413	break;
414
415	ret = ffs_epfiles_create(ffs);
416	if (ret) {
417	ffs->state = FFS_CLOSING;
418	break;
419	}
420
421	ffs->state = FFS_ACTIVE;
422	mutex_unlock(&ffs->mutex);
423
424	ret = ffs_ready(ffs);
425	if (ret < 0) {
426	ffs->state = FFS_CLOSING;
427	return ret;
428	}
429
430	return len;
431	}
432	break;
433
434	case FFS_ACTIVE:
435	data = NULL;
436	/*
437	* We're called from user space, we can use _irq
438	* rather then _irqsave
439	*/
440	spin_lock_irq(&ffs->ev.waitq.lock);
441	switch (ffs_setup_state_clear_cancelled(ffs)) {
442	case FFS_SETUP_CANCELLED:
443	ret = -EIDRM;
444	goto done_spin;
445
446	case FFS_NO_SETUP:
447	ret = -ESRCH;
448	goto done_spin;
449
450	case FFS_SETUP_PENDING:
451	break;
452	}
453
454	/* FFS_SETUP_PENDING */
455	if (!(ffs->ev.setup.bRequestType & USB_DIR_IN)) {
456	spin_unlock_irq(&ffs->ev.waitq.lock);
457	ret = __ffs_ep0_stall(ffs);
458	break;
459	}
460
461	/* FFS_SETUP_PENDING and not stall */
462	len = min_t(size_t, len, le16_to_cpu(ffs->ev.setup.wLength));
463
464	spin_unlock_irq(&ffs->ev.waitq.lock);
465
466	data = ffs_prepare_buffer(buf, len);
467	if (IS_ERR(data)) {
468	ret = PTR_ERR(data);
469	break;
470	}
471
472	spin_lock_irq(&ffs->ev.waitq.lock);
473
474	/*
475	* We are guaranteed to be still in FFS_ACTIVE state
476	* but the state of setup could have changed from
477	* FFS_SETUP_PENDING to FFS_SETUP_CANCELLED so we need
478	* to check for that. If that happened we copied data
479	* from user space in vain but it's unlikely.
480	*
481	* For sure we are not in FFS_NO_SETUP since this is
482	* the only place FFS_SETUP_PENDING -> FFS_NO_SETUP
483	* transition can be performed and it's protected by
484	* mutex.
485	*/
486	if (ffs_setup_state_clear_cancelled(ffs) ==
487	FFS_SETUP_CANCELLED) {
488	ret = -EIDRM;
489	done_spin:
490	spin_unlock_irq(&ffs->ev.waitq.lock);
491	} else {
492	/* unlocks spinlock */
493	ret = __ffs_ep0_queue_wait(ffs, data, len);
494	}
495	kfree(data);
496	break;
497
498	default:
499	ret = -EBADFD;
500	break;
501	}
502
503	mutex_unlock(&ffs->mutex);
504	return ret;
505	}
506
507	/* Called with ffs->ev.waitq.lock and ffs->mutex held, both released on exit. */
508	static ssize_t __ffs_ep0_read_events(struct ffs_data ffs, char __user buf,
509	size_t n)
510	__releases(&ffs->ev.waitq.lock)
511	{
512	/*
513	* n cannot be bigger than ffs->ev.count, which cannot be bigger than
514	* size of ffs->ev.types array (which is four) so that's how much space
515	* we reserve.
516	*/
517	struct usb_functionfs_event events[ARRAY_SIZE(ffs->ev.types)];
518	const size_t size = n * sizeof *events;
519	unsigned i = 0;
520
521	memset(events, 0, size);
522
523	do {
524	events[i].type = ffs->ev.types[i];
525	if (events[i].type == FUNCTIONFS_SETUP) {
526	events[i].u.setup = ffs->ev.setup;
527	ffs->setup_state = FFS_SETUP_PENDING;
528	}
529	} while (++i < n);
530
531	ffs->ev.count -= n;
532	if (ffs->ev.count)
533	memmove(ffs->ev.types, ffs->ev.types + n,
534	ffs->ev.count * sizeof *ffs->ev.types);
535
536	spin_unlock_irq(&ffs->ev.waitq.lock);
537	mutex_unlock(&ffs->mutex);
538
539	return copy_to_user(buf, events, size) ? -EFAULT : size;
540	}
541
542	static ssize_t ffs_ep0_read(struct file file, char __user buf,
543	size_t len, loff_t *ptr)
544	{
545	struct ffs_data *ffs = file->private_data;
546	char *data = NULL;
547	size_t n;
548	int ret;
549
550	/* Fast check if setup was canceled */
551	if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
552	return -EIDRM;
553
554	retry:
555	/* Acquire mutex */
556	ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
557	if (ret < 0)
558	return ret;
559
560	/* Check state */
561	if (ffs->state != FFS_ACTIVE) {
562	ret = -EBADFD;
563	goto done_mutex;
564	}
565
566	/*
567	* We're called from user space, we can use _irq rather then
568	* _irqsave
569	*/
570	spin_lock_irq(&ffs->ev.waitq.lock);
571
572	switch (ffs_setup_state_clear_cancelled(ffs)) {
573	case FFS_SETUP_CANCELLED:
574	ret = -EIDRM;
575	break;
576
577	case FFS_NO_SETUP:
578	n = len / sizeof(struct usb_functionfs_event);
579	if (!n) {
580	ret = -EINVAL;
581	break;
582	}
583
584	if ((file->f_flags & O_NONBLOCK) && !ffs->ev.count) {
585	ret = -EAGAIN;
586	break;
587	}
588
589	if (!ffs->ev.count) {
590	spin_unlock_irq(&ffs->ev.waitq.lock);
591	mutex_unlock(&ffs->mutex);
592
593	if (wait_event_interruptible_exclusive(ffs->ev.waitq,
594	ffs->ev.count))
595	return -EINTR;
596
597	goto retry;
598	}
599
600	/* unlocks spinlock */
601	return __ffs_ep0_read_events(ffs, buf,
602	min_t(size_t, n, ffs->ev.count));
603
604	case FFS_SETUP_PENDING:
605	if (ffs->ev.setup.bRequestType & USB_DIR_IN) {
606	spin_unlock_irq(&ffs->ev.waitq.lock);
607	ret = __ffs_ep0_stall(ffs);
608	goto done_mutex;
609	}
610
611	len = min_t(size_t, len, le16_to_cpu(ffs->ev.setup.wLength));
612
613	spin_unlock_irq(&ffs->ev.waitq.lock);
614
615	if (len) {
616	data = kmalloc(len, GFP_KERNEL);
617	if (!data) {
618	ret = -ENOMEM;
619	goto done_mutex;
620	}
621	}
622
623	spin_lock_irq(&ffs->ev.waitq.lock);
624
625	/* See ffs_ep0_write() */
626	if (ffs_setup_state_clear_cancelled(ffs) ==
627	FFS_SETUP_CANCELLED) {
628	ret = -EIDRM;
629	break;
630	}
631
632	/* unlocks spinlock */
633	ret = __ffs_ep0_queue_wait(ffs, data, len);
634	if ((ret > 0) && (copy_to_user(buf, data, ret)))
635	ret = -EFAULT;
636	goto done_mutex;
637
638	default:
639	ret = -EBADFD;
640	break;
641	}
642
643	spin_unlock_irq(&ffs->ev.waitq.lock);
644	done_mutex:
645	mutex_unlock(&ffs->mutex);
646	kfree(data);
647	return ret;
648	}
649
650
651	static void ffs_data_reset(struct ffs_data *ffs);
652
653	static int ffs_ep0_open(struct inode inode, struct file file)
654	{
655	struct ffs_data *ffs = inode->i_sb->s_fs_info;
656
657	spin_lock_irq(&ffs->eps_lock);
658	if (ffs->state == FFS_CLOSING) {
659	spin_unlock_irq(&ffs->eps_lock);
660	return -EBUSY;
661	}
662	if (!ffs->opened++ && ffs->state == FFS_DEACTIVATED) {
663	ffs->state = FFS_CLOSING;
664	spin_unlock_irq(&ffs->eps_lock);
665	ffs_data_reset(ffs);
666	} else {
667	spin_unlock_irq(&ffs->eps_lock);
668	}
669	file->private_data = ffs;
670
671	return stream_open(inode, file);
672	}
673
674	static int ffs_ep0_release(struct inode inode, struct file file)
675	{
676	struct ffs_data *ffs = file->private_data;
677
678	ffs_data_closed(ffs);
679
680	return 0;
681	}
682
683	static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
684	{
685	struct ffs_data *ffs = file->private_data;
686	struct usb_gadget *gadget = ffs->gadget;
687	long ret;
688
689	if (code == FUNCTIONFS_INTERFACE_REVMAP) {
690	struct ffs_function *func = ffs->func;
691	ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
692	} else if (gadget && gadget->ops->ioctl) {
693	ret = gadget->ops->ioctl(gadget, code, value);
694	} else {
695	ret = -ENOTTY;
696	}
697
698	return ret;
699	}
700
701	static __poll_t ffs_ep0_poll(struct file file, poll_table wait)
702	{
703	struct ffs_data *ffs = file->private_data;
704	__poll_t mask = EPOLLWRNORM;
705	int ret;
706
707	poll_wait(file, &ffs->ev.waitq, wait);
708
709	ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
710	if (ret < 0)
711	return mask;
712
713	switch (ffs->state) {
714	case FFS_READ_DESCRIPTORS:
715	case FFS_READ_STRINGS:
716	mask \|= EPOLLOUT;
717	break;
718
719	case FFS_ACTIVE:
720	switch (ffs->setup_state) {
721	case FFS_NO_SETUP:
722	if (ffs->ev.count)
723	mask \|= EPOLLIN;
724	break;
725
726	case FFS_SETUP_PENDING:
727	case FFS_SETUP_CANCELLED:
728	mask \|= (EPOLLIN \| EPOLLOUT);
729	break;
730	}
731	break;
732
733	case FFS_CLOSING:
734	break;
735	case FFS_DEACTIVATED:
736	break;
737	}
738
739	mutex_unlock(&ffs->mutex);
740
741	return mask;
742	}
743
744	static const struct file_operations ffs_ep0_operations = {
745
746	.open = ffs_ep0_open,
747	.write = ffs_ep0_write,
748	.read = ffs_ep0_read,
749	.release = ffs_ep0_release,
750	.unlocked_ioctl = ffs_ep0_ioctl,
751	.poll = ffs_ep0_poll,
752	};
753
754
755	/* "Normal" endpoints operations ********************************************/
756
757	static void ffs_epfile_io_complete(struct usb_ep _ep, struct usb_request req)
758	{
759	struct ffs_io_data *io_data = req->context;
760
761	if (req->status)
762	io_data->status = req->status;
763	else
764	io_data->status = req->actual;
765
766	complete(&io_data->done);
767	}
768
769	static ssize_t ffs_copy_to_iter(void data, int data_len, struct iov_iter iter)
770	{
771	ssize_t ret = copy_to_iter(data, data_len, iter);
772	if (ret == data_len)
773	return ret;
774
775	if (iov_iter_count(iter))
776	return -EFAULT;
777
778	/*
779	* Dear user space developer!
780	*
781	* TL;DR: To stop getting below error message in your kernel log, change
782	* user space code using functionfs to align read buffers to a max
783	* packet size.
784	*
785	* Some UDCs (e.g. dwc3) require request sizes to be a multiple of a max
786	* packet size. When unaligned buffer is passed to functionfs, it
787	* internally uses a larger, aligned buffer so that such UDCs are happy.
788	*
789	* Unfortunately, this means that host may send more data than was
790	* requested in read(2) system call. f_fs doesn’t know what to do with
791	* that excess data so it simply drops it.
792	*
793	* Was the buffer aligned in the first place, no such problem would
794	* happen.
795	*
796	* Data may be dropped only in AIO reads. Synchronous reads are handled
797	* by splitting a request into multiple parts. This splitting may still
798	* be a problem though so it’s likely best to align the buffer
799	* regardless of it being AIO or not..
800	*
801	* This only affects OUT endpoints, i.e. reading data with a read(2),
802	* aio_read(2) etc. system calls. Writing data to an IN endpoint is not
803	* affected.
804	*/
805	pr_err("functionfs read size %d > requested size %zd, dropping excess data. "
806	"Align read buffer size to max packet size to avoid the problem.\n",
807	data_len, ret);
808
809	return ret;
810	}
811
812	/*
813	* allocate a virtually contiguous buffer and create a scatterlist describing it
814	* @sg_table - pointer to a place to be filled with sg_table contents
815	* @size - required buffer size
816	*/
817	static void ffs_build_sg_list(struct sg_table sgt, size_t sz)
818	{
819	struct page **pages;
820	void vaddr, ptr;
821	unsigned int n_pages;
822	int i;
823
824	vaddr = vmalloc(sz);
825	if (!vaddr)
826	return NULL;
827
828	n_pages = PAGE_ALIGN(sz) >> PAGE_SHIFT;
829	pages = kvmalloc_objs(struct page *, n_pages);
830	if (!pages) {
831	vfree(vaddr);
832
833	return NULL;
834	}
835	for (i = 0, ptr = vaddr; i < n_pages; ++i, ptr += PAGE_SIZE)
836	pages[i] = vmalloc_to_page(ptr);
837
838	if (sg_alloc_table_from_pages(sgt, pages, n_pages, 0, sz, GFP_KERNEL)) {
839	kvfree(pages);
840	vfree(vaddr);
841
842	return NULL;
843	}
844	kvfree(pages);
845
846	return vaddr;
847	}
848
849	static inline void ffs_alloc_buffer(struct ffs_io_data io_data,
850	size_t data_len)
851	{
852	if (io_data->use_sg)
853	return ffs_build_sg_list(&io_data->sgt, data_len);
854
855	return kmalloc(data_len, GFP_KERNEL);
856	}
857
858	static inline void ffs_free_buffer(struct ffs_io_data *io_data)
859	{
860	if (!io_data->buf)
861	return;
862
863	if (io_data->use_sg) {
864	sg_free_table(&io_data->sgt);
865	vfree(io_data->buf);
866	} else {
867	kfree(io_data->buf);
868	}
869	}
870
871	static void ffs_user_copy_worker(struct work_struct *work)
872	{
873	struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
874	work);
875	int ret = io_data->status;
876	bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD;
877
878	if (io_data->read && ret > 0) {
879	if (mmget_not_zero(io_data->mm)) {
880	kthread_use_mm(io_data->mm);
881	ret = ffs_copy_to_iter(io_data->buf, ret, &io_data->data);
882	kthread_unuse_mm(io_data->mm);
883	mmput(io_data->mm);
884	} else {
885	ret = -EFAULT;
886	}
887	mmdrop(io_data->mm);
888	}
889
890	io_data->kiocb->ki_complete(io_data->kiocb, ret);
891
892	if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd)
893	eventfd_signal(io_data->ffs->ffs_eventfd);
894
895	usb_ep_free_request(io_data->ep, io_data->req);
896
897	if (io_data->read)
898	kfree(io_data->to_free);
899	ffs_free_buffer(io_data);
900	kfree(io_data);
901	}
902
903	static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
904	struct usb_request *req)
905	{
906	struct ffs_io_data *io_data = req->context;
907	struct ffs_data *ffs = io_data->ffs;
908
909	io_data->status = req->status ? req->status : req->actual;
910
911	INIT_WORK(&io_data->work, ffs_user_copy_worker);
912	queue_work(ffs->io_completion_wq, &io_data->work);
913	}
914
915	static void __ffs_epfile_read_buffer_free(struct ffs_epfile *epfile)
916	{
917	/*
918	* See comment in struct ffs_epfile for full read_buffer pointer
919	* synchronisation story.
920	*/
921	struct ffs_buffer *buf = xchg(&epfile->read_buffer, READ_BUFFER_DROP);
922	if (buf && buf != READ_BUFFER_DROP)
923	kfree(buf);
924	}
925
926	/* Assumes epfile->mutex is held. */
927	static ssize_t __ffs_epfile_read_buffered(struct ffs_epfile *epfile,
928	struct iov_iter *iter)
929	{
930	/*
931	* Null out epfile->read_buffer so ffs_func_eps_disable does not free
932	* the buffer while we are using it. See comment in struct ffs_epfile
933	* for full read_buffer pointer synchronisation story.
934	*/
935	struct ffs_buffer *buf = xchg(&epfile->read_buffer, NULL);
936	ssize_t ret;
937	if (!buf \|\| buf == READ_BUFFER_DROP)
938	return 0;
939
940	ret = copy_to_iter(buf->data, buf->length, iter);
941	if (buf->length == ret) {
942	kfree(buf);
943	return ret;
944	}
945
946	if (iov_iter_count(iter)) {
947	ret = -EFAULT;
948	} else {
949	buf->length -= ret;
950	buf->data += ret;
951	}
952
953	if (cmpxchg(&epfile->read_buffer, NULL, buf))
954	kfree(buf);
955
956	return ret;
957	}
958
959	/* Assumes epfile->mutex is held. */
960	static ssize_t __ffs_epfile_read_data(struct ffs_epfile *epfile,
961	void *data, int data_len,
962	struct iov_iter *iter)
963	{
964	struct ffs_buffer *buf;
965
966	ssize_t ret = copy_to_iter(data, data_len, iter);
967	if (data_len == ret)
968	return ret;
969
970	if (iov_iter_count(iter))
971	return -EFAULT;
972
973	/* See ffs_copy_to_iter for more context. */
974	pr_warn("functionfs read size %d > requested size %zd, splitting request into multiple reads.",
975	data_len, ret);
976
977	data_len -= ret;
978	buf = kmalloc_flex(*buf, storage, data_len);
979	if (!buf)
980	return -ENOMEM;
981	buf->length = data_len;
982	buf->data = buf->storage;
983	memcpy(buf->storage, data + ret, flex_array_size(buf, storage, data_len));
984
985	/*
986	* At this point read_buffer is NULL or READ_BUFFER_DROP (if
987	* ffs_func_eps_disable has been called in the meanwhile). See comment
988	* in struct ffs_epfile for full read_buffer pointer synchronisation
989	* story.
990	*/
991	if (cmpxchg(&epfile->read_buffer, NULL, buf))
992	kfree(buf);
993
994	return ret;
995	}
996
997	static struct ffs_ep ffs_epfile_wait_ep(struct ffs_epfile epfile, struct file *file)
998	{
999	struct ffs_ep *ep;
1000	int ret;
1001
1002	/* Wait for endpoint to be enabled */
1003	ep = epfile->ep;
1004	if (!ep) {
1005	if (file->f_flags & O_NONBLOCK)
1006	return ERR_PTR(-EAGAIN);
1007
1008	ret = wait_event_interruptible(
1009	epfile->ffs->wait, (ep = epfile->ep));
1010	if (ret)
1011	return ERR_PTR(-EINTR);
1012	}
1013
1014	return ep;
1015	}
1016
1017	static ssize_t ffs_epfile_io(struct file file, struct ffs_io_data io_data)
1018	{
1019	struct ffs_epfile *epfile = file->private_data;
1020	struct usb_request *req;
1021	struct ffs_ep *ep;
1022	char *data = NULL;
1023	ssize_t ret, data_len = -EINVAL;
1024	int halt;
1025	bool is_rw_proxy = epfile->is_rw_proxy;
1026
1027	/* Are we still active? */
1028	if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
1029	return -ENODEV;
1030
1031	/* Proxy to base endpoint if rw_proxy */
1032	if (is_rw_proxy)
1033	epfile = io_data->read ? epfile->epfile_out : epfile->epfile_in;
1034
1035	ep = ffs_epfile_wait_ep(epfile, file);
1036	if (IS_ERR(ep))
1037	return PTR_ERR(ep);
1038
1039	/* Do we halt? */
1040	halt = is_rw_proxy ? 0 : (!io_data->read == !epfile->in);
1041	if (halt && epfile->isoc)
1042	return -EINVAL;
1043
1044	/* We will be using request and read_buffer */
1045	ret = ffs_mutex_lock(&epfile->mutex, file->f_flags & O_NONBLOCK);
1046	if (ret)
1047	goto error;
1048
1049	/* Allocate & copy */
1050	if (!halt) {
1051	struct usb_gadget *gadget;
1052
1053	/*
1054	* Do we have buffered data from previous partial read? Check
1055	* that for synchronous case only because we do not have
1056	* facility to ‘wake up’ a pending asynchronous read and push
1057	* buffered data to it which we would need to make things behave
1058	* consistently.
1059	*/
1060	if (!io_data->aio && io_data->read) {
1061	ret = __ffs_epfile_read_buffered(epfile, &io_data->data);
1062	if (ret)
1063	goto error_mutex;
1064	}
1065
1066	/*
1067	* if we _do_ wait above, the epfile->ffs->gadget might be NULL
1068	* before the waiting completes, so do not assign to 'gadget'
1069	* earlier
1070	*/
1071	gadget = epfile->ffs->gadget;
1072
1073	spin_lock_irq(&epfile->ffs->eps_lock);
1074	/* In the meantime, endpoint got disabled or changed. */
1075	if (epfile->ep != ep) {
1076	ret = -ESHUTDOWN;
1077	goto error_lock;
1078	}
1079	data_len = iov_iter_count(&io_data->data);
1080	/*
1081	* Controller may require buffer size to be aligned to
1082	* maxpacketsize of an out endpoint.
1083	*/
1084	if (io_data->read)
1085	data_len = usb_ep_align_maybe(gadget, ep->ep, data_len);
1086
1087	io_data->use_sg = gadget->sg_supported && data_len > PAGE_SIZE;
1088	spin_unlock_irq(&epfile->ffs->eps_lock);
1089
1090	data = ffs_alloc_buffer(io_data, data_len);
1091	if (!data) {
1092	ret = -ENOMEM;
1093	goto error_mutex;
1094	}
1095	if (!io_data->read &&
1096	!copy_from_iter_full(data, data_len, &io_data->data)) {
1097	ret = -EFAULT;
1098	goto error_mutex;
1099	}
1100	}
1101
1102	spin_lock_irq(&epfile->ffs->eps_lock);
1103
1104	if (epfile->ep != ep) {
1105	/* In the meantime, endpoint got disabled or changed. */
1106	ret = -ESHUTDOWN;
1107	} else if (halt) {
1108	ret = usb_ep_set_halt(ep->ep);
1109	if (!ret)
1110	ret = -EBADMSG;
1111	} else if (data_len == -EINVAL) {
1112	/*
1113	* Sanity Check: even though data_len can't be used
1114	* uninitialized at the time I write this comment, some
1115	* compilers complain about this situation.
1116	* In order to keep the code clean from warnings, data_len is
1117	* being initialized to -EINVAL during its declaration, which
1118	* means we can't rely on compiler anymore to warn no future
1119	* changes won't result in data_len being used uninitialized.
1120	* For such reason, we're adding this redundant sanity check
1121	* here.
1122	*/
1123	WARN(1, "%s: data_len == -EINVAL\n", __func__);
1124	ret = -EINVAL;
1125	} else if (!io_data->aio) {
1126	bool interrupted = false;
1127
1128	req = ep->req;
1129	if (io_data->use_sg) {
1130	req->buf = NULL;
1131	req->sg = io_data->sgt.sgl;
1132	req->num_sgs = io_data->sgt.nents;
1133	} else {
1134	req->buf = data;
1135	req->num_sgs = 0;
1136	}
1137
1138	req->zero = !io_data->read ? epfile->zlp_enabled : 0;
1139	req->length = data_len;
1140
1141	io_data->buf = data;
1142
1143	init_completion(&io_data->done);
1144	req->context = io_data;
1145	req->complete = ffs_epfile_io_complete;
1146
1147	ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
1148	if (ret < 0)
1149	goto error_lock;
1150
1151	spin_unlock_irq(&epfile->ffs->eps_lock);
1152
1153	if (wait_for_completion_interruptible(&io_data->done)) {
1154	spin_lock_irq(&epfile->ffs->eps_lock);
1155	if (epfile->ep != ep) {
1156	ret = -ESHUTDOWN;
1157	goto error_lock;
1158	}
1159	/*
1160	* To avoid race condition with ffs_epfile_io_complete,
1161	* dequeue the request first then check
1162	* status. usb_ep_dequeue API should guarantee no race
1163	* condition with req->complete callback.
1164	*/
1165	usb_ep_dequeue(ep->ep, req);
1166	spin_unlock_irq(&epfile->ffs->eps_lock);
1167	wait_for_completion(&io_data->done);
1168	interrupted = io_data->status < 0;
1169	}
1170
1171	if (interrupted)
1172	ret = -EINTR;
1173	else if (io_data->read && io_data->status > 0)
1174	ret = __ffs_epfile_read_data(epfile, data, io_data->status,
1175	&io_data->data);
1176	else
1177	ret = io_data->status;
1178	goto error_mutex;
1179	} else if (!(req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC))) {
1180	ret = -ENOMEM;
1181	} else {
1182	if (io_data->use_sg) {
1183	req->buf = NULL;
1184	req->sg = io_data->sgt.sgl;
1185	req->num_sgs = io_data->sgt.nents;
1186	} else {
1187	req->buf = data;
1188	req->num_sgs = 0;
1189	}
1190
1191	req->zero = !io_data->read ? epfile->zlp_enabled : 0;
1192	req->length = data_len;
1193
1194	io_data->buf = data;
1195	io_data->ep = ep->ep;
1196	io_data->req = req;
1197	io_data->ffs = epfile->ffs;
1198
1199	req->context = io_data;
1200	req->complete = ffs_epfile_async_io_complete;
1201
1202	ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
1203	if (ret) {
1204	io_data->req = NULL;
1205	usb_ep_free_request(ep->ep, req);
1206	goto error_lock;
1207	}
1208
1209	ret = -EIOCBQUEUED;
1210	/*
1211	* Do not kfree the buffer in this function. It will be freed
1212	* by ffs_user_copy_worker.
1213	*/
1214	data = NULL;
1215	}
1216
1217	error_lock:
1218	spin_unlock_irq(&epfile->ffs->eps_lock);
1219	error_mutex:
1220	mutex_unlock(&epfile->mutex);
1221	error:
1222	if (ret != -EIOCBQUEUED) /* don't free if there is iocb queued */
1223	ffs_free_buffer(io_data);
1224	return ret;
1225	}
1226
1227	static int
1228	ffs_epfile_open(struct inode inode, struct file file)
1229	{
1230	struct ffs_data *ffs = inode->i_sb->s_fs_info;
1231	struct ffs_epfile *epfile;
1232
1233	spin_lock_irq(&ffs->eps_lock);
1234	if (!ffs->opened) {
1235	spin_unlock_irq(&ffs->eps_lock);
1236	return -ENODEV;
1237	}
1238	/*
1239	* we want the state to be FFS_ACTIVE; FFS_ACTIVE alone is
1240	* not enough, though - we might have been through FFS_CLOSING
1241	* and back to FFS_ACTIVE, with our file already removed.
1242	*/
1243	epfile = smp_load_acquire(&inode->i_private);
1244	if (unlikely(ffs->state != FFS_ACTIVE \|\| !epfile)) {
1245	spin_unlock_irq(&ffs->eps_lock);
1246	return -ENODEV;
1247	}
1248	ffs->opened++;
1249	spin_unlock_irq(&ffs->eps_lock);
1250
1251	file->private_data = epfile;
1252	return stream_open(inode, file);
1253	}
1254
1255	static int ffs_aio_cancel(struct kiocb *kiocb)
1256	{
1257	struct ffs_io_data *io_data = kiocb->private;
1258	int value;
1259
1260	if (io_data && io_data->ep && io_data->req)
1261	value = usb_ep_dequeue(io_data->ep, io_data->req);
1262	else
1263	value = -EINVAL;
1264
1265	return value;
1266	}
1267
1268	static ssize_t ffs_epfile_write_iter(struct kiocb kiocb, struct iov_iter from)
1269	{
1270	struct ffs_io_data io_data, *p = &io_data;
1271	ssize_t res;
1272
1273	if (!is_sync_kiocb(kiocb)) {
1274	p = kzalloc_obj(io_data);
1275	if (!p)
1276	return -ENOMEM;
1277	p->aio = true;
1278	} else {
1279	memset(p, 0, sizeof(*p));
1280	p->aio = false;
1281	}
1282
1283	p->read = false;
1284	p->kiocb = kiocb;
1285	p->data = *from;
1286	p->mm = current->mm;
1287
1288	kiocb->private = p;
1289
1290	if (p->aio) {
1291	mmgrab(p->mm);
1292	kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
1293	}
1294
1295	res = ffs_epfile_io(kiocb->ki_filp, p);
1296	if (res == -EIOCBQUEUED)
1297	return res;
1298	if (p->aio) {
1299	kiocb->ki_complete(kiocb, res);
1300	mmdrop(p->mm);
1301	kfree(p);
1302	return -EIOCBQUEUED;
1303	} else {
1304	*from = p->data;
1305	}
1306	return res;
1307	}
1308
1309	static ssize_t ffs_epfile_read_iter(struct kiocb kiocb, struct iov_iter to)
1310	{
1311	struct ffs_io_data io_data, *p = &io_data;
1312	ssize_t res;
1313
1314	if (!is_sync_kiocb(kiocb)) {
1315	p = kzalloc_obj(io_data);
1316	if (!p)
1317	return -ENOMEM;
1318	p->aio = true;
1319	} else {
1320	memset(p, 0, sizeof(*p));
1321	p->aio = false;
1322	}
1323
1324	p->read = true;
1325	p->kiocb = kiocb;
1326	if (p->aio) {
1327	p->to_free = dup_iter(&p->data, to, GFP_KERNEL);
1328	if (!iter_is_ubuf(&p->data) && !p->to_free) {
1329	kfree(p);
1330	return -ENOMEM;
1331	}
1332	} else {
1333	p->data = *to;
1334	p->to_free = NULL;
1335	}
1336	p->mm = current->mm;
1337
1338	kiocb->private = p;
1339
1340	if (p->aio) {
1341	mmgrab(p->mm);
1342	kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
1343	}
1344
1345	res = ffs_epfile_io(kiocb->ki_filp, p);
1346	if (res == -EIOCBQUEUED)
1347	return res;
1348
1349	if (p->aio) {
1350	kiocb->ki_complete(kiocb, res);
1351	mmdrop(p->mm);
1352	kfree(p->to_free);
1353	kfree(p);
1354	return -EIOCBQUEUED;
1355	} else {
1356	*to = p->data;
1357	}
1358	return res;
1359	}
1360
1361	static void ffs_dmabuf_release(struct kref *ref)
1362	{
1363	struct ffs_dmabuf_priv *priv = container_of(ref, struct ffs_dmabuf_priv, ref);
1364	struct dma_buf_attachment *attach = priv->attach;
1365	struct dma_buf *dmabuf = attach->dmabuf;
1366
1367	pr_vdebug("FFS DMABUF release\n");
1368	dma_buf_unmap_attachment_unlocked(attach, priv->sgt, priv->dir);
1369
1370	dma_buf_detach(attach->dmabuf, attach);
1371	dma_buf_put(dmabuf);
1372	kfree(priv);
1373	}
1374
1375	static void ffs_dmabuf_get(struct dma_buf_attachment *attach)
1376	{
1377	struct ffs_dmabuf_priv *priv = attach->importer_priv;
1378
1379	kref_get(&priv->ref);
1380	}
1381
1382	static void ffs_dmabuf_put(struct dma_buf_attachment *attach)
1383	{
1384	struct ffs_dmabuf_priv *priv = attach->importer_priv;
1385
1386	kref_put(&priv->ref, ffs_dmabuf_release);
1387	}
1388
1389	static int
1390	ffs_epfile_release(struct inode inode, struct file file)
1391	{
1392	struct ffs_epfile *epfile = file->private_data;
1393	struct ffs_dmabuf_priv priv, tmp;
1394	struct ffs_data *ffs = epfile->ffs;
1395
1396	mutex_lock(&epfile->dmabufs_mutex);
1397
1398	/* Close all attached DMABUFs */
1399	list_for_each_entry_safe(priv, tmp, &epfile->dmabufs, entry) {
1400	/* Cancel any pending transfer */
1401	spin_lock_irq(&ffs->eps_lock);
1402	if (priv->ep && priv->req)
1403	usb_ep_dequeue(priv->ep, priv->req);
1404	spin_unlock_irq(&ffs->eps_lock);
1405
1406	list_del(&priv->entry);
1407	ffs_dmabuf_put(priv->attach);
1408	}
1409
1410	mutex_unlock(&epfile->dmabufs_mutex);
1411
1412	ffs_data_closed(epfile->ffs);
1413
1414	return 0;
1415	}
1416
1417	static void ffs_dmabuf_cleanup(struct work_struct *work)
1418	{
1419	struct ffs_dma_fence *dma_fence =
1420	container_of(work, struct ffs_dma_fence, work);
1421	struct ffs_dmabuf_priv *priv = dma_fence->priv;
1422	struct dma_buf_attachment *attach = priv->attach;
1423	struct dma_fence *fence = &dma_fence->base;
1424	struct usb_request *req = dma_fence->req;
1425	struct usb_ep *ep = dma_fence->ep;
1426
1427	/*
1428	* eps_lock pairs with the cancel paths so they cannot pass a freed
1429	* req to usb_ep_dequeue(). Only clear if priv->req still names ours;
1430	* a re-queue on the same attachment may have taken that slot.
1431	*/
1432	spin_lock_irq(&priv->ffs->eps_lock);
1433	if (priv->req == req)
1434	priv->req = NULL;
1435	spin_unlock_irq(&priv->ffs->eps_lock);
1436
1437	if (ep && req)
1438	usb_ep_free_request(ep, req);
1439
1440	ffs_dmabuf_put(attach);
1441	dma_fence_put(fence);
1442	}
1443
1444	static void ffs_dmabuf_signal_done(struct ffs_dma_fence *dma_fence, int ret)
1445	{
1446	struct ffs_dmabuf_priv *priv = dma_fence->priv;
1447	struct dma_fence *fence = &dma_fence->base;
1448	bool cookie = dma_fence_begin_signalling();
1449
1450	dma_fence_get(fence);
1451	fence->error = ret;
1452	dma_fence_signal(fence);
1453	dma_fence_end_signalling(cookie);
1454
1455	/*
1456	* The fence will be unref'd in ffs_dmabuf_cleanup.
1457	* It can't be done here, as the unref functions might try to lock
1458	* the resv object, which would deadlock.
1459	*/
1460	INIT_WORK(&dma_fence->work, ffs_dmabuf_cleanup);
1461	queue_work(priv->ffs->io_completion_wq, &dma_fence->work);
1462	}
1463
1464	static void ffs_epfile_dmabuf_io_complete(struct usb_ep *ep,
1465	struct usb_request *req)
1466	{
1467	pr_vdebug("FFS: DMABUF transfer complete, status=%d\n", req->status);
1468	/* req is freed by ffs_dmabuf_cleanup() under eps_lock. */
1469	ffs_dmabuf_signal_done(req->context, req->status);
1470	}
1471
1472	static const char ffs_dmabuf_get_driver_name(struct dma_fence fence)
1473	{
1474	return "functionfs";
1475	}
1476
1477	static const char ffs_dmabuf_get_timeline_name(struct dma_fence fence)
1478	{
1479	return "";
1480	}
1481
1482	static void ffs_dmabuf_fence_release(struct dma_fence *fence)
1483	{
1484	struct ffs_dma_fence *dma_fence =
1485	container_of(fence, struct ffs_dma_fence, base);
1486
1487	kfree(dma_fence);
1488	}
1489
1490	static const struct dma_fence_ops ffs_dmabuf_fence_ops = {
1491	.get_driver_name = ffs_dmabuf_get_driver_name,
1492	.get_timeline_name = ffs_dmabuf_get_timeline_name,
1493	.release = ffs_dmabuf_fence_release,
1494	};
1495
1496	static int ffs_dma_resv_lock(struct dma_buf *dmabuf, bool nonblock)
1497	{
1498	if (!nonblock)
1499	return dma_resv_lock_interruptible(dmabuf->resv, NULL);
1500
1501	if (!dma_resv_trylock(dmabuf->resv))
1502	return -EBUSY;
1503
1504	return 0;
1505	}
1506
1507	static struct dma_buf_attachment *
1508	ffs_dmabuf_find_attachment(struct ffs_epfile epfile, struct dma_buf dmabuf)
1509	{
1510	struct device *dev = epfile->ffs->gadget->dev.parent;
1511	struct dma_buf_attachment *attach = NULL;
1512	struct ffs_dmabuf_priv *priv;
1513
1514	mutex_lock(&epfile->dmabufs_mutex);
1515
1516	list_for_each_entry(priv, &epfile->dmabufs, entry) {
1517	if (priv->attach->dev == dev
1518	&& priv->attach->dmabuf == dmabuf) {
1519	attach = priv->attach;
1520	break;
1521	}
1522	}
1523
1524	if (attach)
1525	ffs_dmabuf_get(attach);
1526
1527	mutex_unlock(&epfile->dmabufs_mutex);
1528
1529	return attach ?: ERR_PTR(-EPERM);
1530	}
1531
1532	static int ffs_dmabuf_attach(struct file *file, int fd)
1533	{
1534	bool nonblock = file->f_flags & O_NONBLOCK;
1535	struct ffs_epfile *epfile = file->private_data;
1536	struct usb_gadget *gadget = epfile->ffs->gadget;
1537	struct dma_buf_attachment *attach;
1538	struct ffs_dmabuf_priv *priv;
1539	enum dma_data_direction dir;
1540	struct sg_table *sg_table;
1541	struct dma_buf *dmabuf;
1542	int err;
1543
1544	if (!gadget \|\| !gadget->sg_supported)
1545	return -EPERM;
1546
1547	dmabuf = dma_buf_get(fd);
1548	if (IS_ERR(dmabuf))
1549	return PTR_ERR(dmabuf);
1550
1551	attach = dma_buf_attach(dmabuf, gadget->dev.parent);
1552	if (IS_ERR(attach)) {
1553	err = PTR_ERR(attach);
1554	goto err_dmabuf_put;
1555	}
1556
1557	priv = kzalloc_obj(*priv);
1558	if (!priv) {
1559	err = -ENOMEM;
1560	goto err_dmabuf_detach;
1561	}
1562
1563	dir = epfile->in ? DMA_TO_DEVICE : DMA_FROM_DEVICE;
1564
1565	err = ffs_dma_resv_lock(dmabuf, nonblock);
1566	if (err)
1567	goto err_free_priv;
1568
1569	sg_table = dma_buf_map_attachment(attach, dir);
1570	dma_resv_unlock(dmabuf->resv);
1571
1572	if (IS_ERR(sg_table)) {
1573	err = PTR_ERR(sg_table);
1574	goto err_free_priv;
1575	}
1576
1577	attach->importer_priv = priv;
1578
1579	priv->sgt = sg_table;
1580	priv->dir = dir;
1581	priv->ffs = epfile->ffs;
1582	priv->attach = attach;
1583	spin_lock_init(&priv->lock);
1584	kref_init(&priv->ref);
1585	priv->context = dma_fence_context_alloc(1);
1586
1587	mutex_lock(&epfile->dmabufs_mutex);
1588	list_add(&priv->entry, &epfile->dmabufs);
1589	mutex_unlock(&epfile->dmabufs_mutex);
1590
1591	return 0;
1592
1593	err_free_priv:
1594	kfree(priv);
1595	err_dmabuf_detach:
1596	dma_buf_detach(dmabuf, attach);
1597	err_dmabuf_put:
1598	dma_buf_put(dmabuf);
1599
1600	return err;
1601	}
1602
1603	static int ffs_dmabuf_detach(struct file *file, int fd)
1604	{
1605	struct ffs_epfile *epfile = file->private_data;
1606	struct ffs_data *ffs = epfile->ffs;
1607	struct device *dev = ffs->gadget->dev.parent;
1608	struct ffs_dmabuf_priv priv, tmp;
1609	struct dma_buf *dmabuf;
1610	int ret = -EPERM;
1611
1612	dmabuf = dma_buf_get(fd);
1613	if (IS_ERR(dmabuf))
1614	return PTR_ERR(dmabuf);
1615
1616	mutex_lock(&epfile->dmabufs_mutex);
1617
1618	list_for_each_entry_safe(priv, tmp, &epfile->dmabufs, entry) {
1619	if (priv->attach->dev == dev
1620	&& priv->attach->dmabuf == dmabuf) {
1621	/* Cancel any pending transfer */
1622	spin_lock_irq(&ffs->eps_lock);
1623	if (priv->ep && priv->req)
1624	usb_ep_dequeue(priv->ep, priv->req);
1625	spin_unlock_irq(&ffs->eps_lock);
1626
1627	list_del(&priv->entry);
1628
1629	/* Unref the reference from ffs_dmabuf_attach() */
1630	ffs_dmabuf_put(priv->attach);
1631	ret = 0;
1632	break;
1633	}
1634	}
1635
1636	mutex_unlock(&epfile->dmabufs_mutex);
1637	dma_buf_put(dmabuf);
1638
1639	return ret;
1640	}
1641
1642	static int ffs_dmabuf_transfer(struct file *file,
1643	const struct usb_ffs_dmabuf_transfer_req *req)
1644	{
1645	bool nonblock = file->f_flags & O_NONBLOCK;
1646	struct ffs_epfile *epfile = file->private_data;
1647	struct dma_buf_attachment *attach;
1648	struct ffs_dmabuf_priv *priv;
1649	struct ffs_dma_fence *fence;
1650	struct usb_request *usb_req;
1651	enum dma_resv_usage resv_dir;
1652	struct dma_buf *dmabuf;
1653	unsigned long timeout;
1654	struct ffs_ep *ep;
1655	bool cookie;
1656	u32 seqno;
1657	long retl;
1658	int ret;
1659
1660	if (req->flags & ~USB_FFS_DMABUF_TRANSFER_MASK)
1661	return -EINVAL;
1662
1663	dmabuf = dma_buf_get(req->fd);
1664	if (IS_ERR(dmabuf))
1665	return PTR_ERR(dmabuf);
1666
1667	if (req->length > dmabuf->size \|\| req->length == 0) {
1668	ret = -EINVAL;
1669	goto err_dmabuf_put;
1670	}
1671
1672	attach = ffs_dmabuf_find_attachment(epfile, dmabuf);
1673	if (IS_ERR(attach)) {
1674	ret = PTR_ERR(attach);
1675	goto err_dmabuf_put;
1676	}
1677
1678	priv = attach->importer_priv;
1679
1680	ep = ffs_epfile_wait_ep(epfile, file);
1681	if (IS_ERR(ep)) {
1682	ret = PTR_ERR(ep);
1683	goto err_attachment_put;
1684	}
1685
1686	ret = ffs_dma_resv_lock(dmabuf, nonblock);
1687	if (ret)
1688	goto err_attachment_put;
1689
1690	/* Make sure we don't have writers */
1691	timeout = nonblock ? 0 : msecs_to_jiffies(DMABUF_ENQUEUE_TIMEOUT_MS);
1692	retl = dma_resv_wait_timeout(dmabuf->resv,
1693	dma_resv_usage_rw(!epfile->in),
1694	true, timeout);
1695	if (retl == 0)
1696	retl = -EBUSY;
1697	if (retl < 0) {
1698	ret = (int)retl;
1699	goto err_resv_unlock;
1700	}
1701
1702	ret = dma_resv_reserve_fences(dmabuf->resv, 1);
1703	if (ret)
1704	goto err_resv_unlock;
1705
1706	fence = kmalloc_obj(*fence);
1707	if (!fence) {
1708	ret = -ENOMEM;
1709	goto err_resv_unlock;
1710	}
1711
1712	fence->priv = priv;
1713
1714	spin_lock_irq(&epfile->ffs->eps_lock);
1715
1716	/* In the meantime, endpoint got disabled or changed. */
1717	if (epfile->ep != ep) {
1718	ret = -ESHUTDOWN;
1719	goto err_fence_free;
1720	}
1721
1722	usb_req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC);
1723	if (!usb_req) {
1724	ret = -ENOMEM;
1725	goto err_fence_free;
1726	}
1727
1728	/*
1729	* usb_ep_queue() guarantees that all transfers are processed in the
1730	* order they are enqueued, so we can use a simple incrementing
1731	* sequence number for the dma_fence.
1732	*/
1733	seqno = atomic_add_return(1, &epfile->seqno);
1734
1735	dma_fence_init(&fence->base, &ffs_dmabuf_fence_ops,
1736	&priv->lock, priv->context, seqno);
1737
1738	resv_dir = epfile->in ? DMA_RESV_USAGE_READ : DMA_RESV_USAGE_WRITE;
1739
1740	dma_resv_add_fence(dmabuf->resv, &fence->base, resv_dir);
1741	dma_fence_put(&fence->base);
1742	dma_resv_unlock(dmabuf->resv);
1743
1744	/* Now that the dma_fence is in place, queue the transfer. */
1745
1746	usb_req->zero = epfile->zlp_enabled;
1747	usb_req->length = req->length;
1748	usb_req->buf = NULL;
1749	usb_req->sg = priv->sgt->sgl;
1750	usb_req->num_sgs = sg_nents_for_len(priv->sgt->sgl, req->length);
1751	usb_req->sg_was_mapped = true;
1752	usb_req->context = fence;
1753	usb_req->complete = ffs_epfile_dmabuf_io_complete;
1754
1755	/* ffs_dmabuf_cleanup() frees usb_req via these two fields. */
1756	fence->req = usb_req;
1757	fence->ep = ep->ep;
1758
1759	cookie = dma_fence_begin_signalling();
1760	ret = usb_ep_queue(ep->ep, usb_req, GFP_ATOMIC);
1761	dma_fence_end_signalling(cookie);
1762	if (!ret) {
1763	priv->req = usb_req;
1764	priv->ep = ep->ep;
1765	} else {
1766	pr_warn("FFS: Failed to queue DMABUF: %d\n", ret);
1767	ffs_dmabuf_signal_done(fence, ret);
1768	}
1769
1770	spin_unlock_irq(&epfile->ffs->eps_lock);
1771	dma_buf_put(dmabuf);
1772
1773	return ret;
1774
1775	err_fence_free:
1776	spin_unlock_irq(&epfile->ffs->eps_lock);
1777	kfree(fence);
1778	err_resv_unlock:
1779	dma_resv_unlock(dmabuf->resv);
1780	err_attachment_put:
1781	ffs_dmabuf_put(attach);
1782	err_dmabuf_put:
1783	dma_buf_put(dmabuf);
1784
1785	return ret;
1786	}
1787
1788	static long ffs_epfile_ioctl(struct file *file, unsigned code,
1789	unsigned long value)
1790	{
1791	struct ffs_epfile *epfile = file->private_data;
1792	struct ffs_ep *ep;
1793	int ret;
1794	__u32 enable_zlp = 0;
1795
1796	if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
1797	return -ENODEV;
1798
1799	if (epfile->is_rw_proxy)
1800	return -ENOTTY;
1801
1802	switch (code) {
1803	case FUNCTIONFS_DMABUF_ATTACH:
1804	{
1805	int fd;
1806
1807	if (copy_from_user(&fd, (void __user *)value, sizeof(fd)))
1808	return -EFAULT;
1809
1810	return ffs_dmabuf_attach(file, fd);
1811	}
1812	case FUNCTIONFS_DMABUF_DETACH:
1813	{
1814	int fd;
1815
1816	if (copy_from_user(&fd, (void __user *)value, sizeof(fd)))
1817	return -EFAULT;
1818
1819	return ffs_dmabuf_detach(file, fd);
1820	}
1821	case FUNCTIONFS_DMABUF_TRANSFER:
1822	{
1823	struct usb_ffs_dmabuf_transfer_req req;
1824
1825	if (copy_from_user(&req, (void __user *)value, sizeof(req)))
1826	return -EFAULT;
1827
1828	return ffs_dmabuf_transfer(file, &req);
1829	}
1830	/*
1831	* We handle this IOCTL before ffs_epfile_wait_ep() to allow userspace
1832	* to configure ZLP behavior immediately without blocking indefinitely
1833	* while waiting for the USB host to connect and enable the endpoint.
1834	*/
1835	case FUNCTIONFS_ENDPOINT_ENABLE_ZLP:
1836	if (!epfile->in)
1837	return -EINVAL;
1838
1839	if (copy_from_user(&enable_zlp, (void __user *)value, sizeof(enable_zlp)))
1840	return -EFAULT;
1841
1842	spin_lock_irq(&epfile->ffs->eps_lock);
1843	epfile->zlp_enabled = !!enable_zlp;
1844	spin_unlock_irq(&epfile->ffs->eps_lock);
1845
1846	return 0;
1847	default:
1848	break;
1849	}
1850
1851	/* Wait for endpoint to be enabled */
1852	ep = ffs_epfile_wait_ep(epfile, file);
1853	if (IS_ERR(ep))
1854	return PTR_ERR(ep);
1855
1856	spin_lock_irq(&epfile->ffs->eps_lock);
1857
1858	/* In the meantime, endpoint got disabled or changed. */
1859	if (epfile->ep != ep) {
1860	spin_unlock_irq(&epfile->ffs->eps_lock);
1861	return -ESHUTDOWN;
1862	}
1863
1864	switch (code) {
1865	case FUNCTIONFS_FIFO_STATUS:
1866	ret = usb_ep_fifo_status(epfile->ep->ep);
1867	break;
1868	case FUNCTIONFS_FIFO_FLUSH:
1869	usb_ep_fifo_flush(epfile->ep->ep);
1870	ret = 0;
1871	break;
1872	case FUNCTIONFS_CLEAR_HALT:
1873	ret = usb_ep_clear_halt(epfile->ep->ep);
1874	break;
1875	case FUNCTIONFS_ENDPOINT_REVMAP:
1876	ret = epfile->ep->num;
1877	break;
1878	case FUNCTIONFS_ENDPOINT_DESC:
1879	{
1880	const struct usb_endpoint_descriptor *desc;
1881	struct usb_endpoint_descriptor desc1;
1882	int desc_idx;
1883
1884	switch (epfile->ffs->gadget->speed) {
1885	case USB_SPEED_SUPER:
1886	case USB_SPEED_SUPER_PLUS:
1887	desc_idx = 2;
1888	break;
1889	case USB_SPEED_HIGH:
1890	desc_idx = 1;
1891	break;
1892	default:
1893	desc_idx = 0;
1894	}
1895
1896	do {
1897	desc = epfile->ep->descs[desc_idx];
1898	} while (!desc && --desc_idx >= 0);
1899
1900	if (!desc)
1901	desc = epfile->ep->ep->desc;
1902	if (!desc) {
1903	ret = -EINVAL;
1904	break;
1905	}
1906
1907	memcpy(&desc1, desc, desc->bLength);
1908
1909	spin_unlock_irq(&epfile->ffs->eps_lock);
1910	ret = copy_to_user((void __user *)value, &desc1, desc1.bLength);
1911	if (ret)
1912	ret = -EFAULT;
1913	return ret;
1914	}
1915	default:
1916	ret = -ENOTTY;
1917	}
1918	spin_unlock_irq(&epfile->ffs->eps_lock);
1919
1920	return ret;
1921	}
1922
1923	static const struct file_operations ffs_epfile_operations = {
1924
1925	.open = ffs_epfile_open,
1926	.write_iter = ffs_epfile_write_iter,
1927	.read_iter = ffs_epfile_read_iter,
1928	.release = ffs_epfile_release,
1929	.unlocked_ioctl = ffs_epfile_ioctl,
1930	.compat_ioctl = compat_ptr_ioctl,
1931	};
1932
1933
1934	/* File system and super block operations ***********************************/
1935
1936	/*
1937	* Mounting the file system creates a controller file, used first for
1938	* function configuration then later for event monitoring.
1939	*/
1940
1941	static struct inode *__must_check
1942	ffs_sb_make_inode(struct super_block sb, void data,
1943	const struct file_operations *fops,
1944	const struct inode_operations *iops,
1945	struct ffs_file_perms *perms)
1946	{
1947	struct inode *inode;
1948
1949	inode = new_inode(sb);
1950
1951	if (inode) {
1952	struct timespec64 ts = inode_set_ctime_current(inode);
1953
1954	inode->i_ino = get_next_ino();
1955	inode->i_mode = perms->mode;
1956	inode->i_uid = perms->uid;
1957	inode->i_gid = perms->gid;
1958	inode_set_atime_to_ts(inode, ts);
1959	inode_set_mtime_to_ts(inode, ts);
1960	inode->i_private = data;
1961	if (fops)
1962	inode->i_fop = fops;
1963	if (iops)
1964	inode->i_op = iops;
1965	}
1966
1967	return inode;
1968	}
1969
1970	/* Create "regular" file */
1971	static int ffs_sb_create_file(struct super_block sb, const char name,
1972	void data, const struct file_operations fops)
1973	{
1974	struct ffs_data *ffs = sb->s_fs_info;
1975	struct dentry *dentry;
1976	struct inode *inode;
1977
1978	inode = ffs_sb_make_inode(sb, data, fops, NULL, &ffs->file_perms);
1979	if (!inode)
1980	return -ENOMEM;
1981	dentry = simple_start_creating(sb->s_root, name);
1982	if (IS_ERR(dentry)) {
1983	iput(inode);
1984	return PTR_ERR(dentry);
1985	}
1986
1987	d_make_persistent(dentry, inode);
1988
1989	simple_done_creating(dentry);
1990	return 0;
1991	}
1992
1993	/* Super block */
1994	static const struct super_operations ffs_sb_operations = {
1995	.statfs = simple_statfs,
1996	.drop_inode = inode_just_drop,
1997	};
1998
1999	struct ffs_sb_fill_data {
2000	struct ffs_file_perms perms;
2001	umode_t root_mode;
2002	const char *dev_name;
2003	bool no_disconnect;
2004	struct ffs_data *ffs_data;
2005	};
2006
2007	static int ffs_sb_fill(struct super_block sb, struct fs_context fc)
2008	{
2009	struct ffs_sb_fill_data *data = fc->fs_private;
2010	struct inode *inode;
2011	struct ffs_data *ffs = data->ffs_data;
2012
2013	ffs->sb = sb;
2014	data->ffs_data = NULL;
2015	sb->s_fs_info = ffs;
2016	sb->s_blocksize = PAGE_SIZE;
2017	sb->s_blocksize_bits = PAGE_SHIFT;
2018	sb->s_magic = FUNCTIONFS_MAGIC;
2019	sb->s_op = &ffs_sb_operations;
2020	sb->s_time_gran = 1;
2021
2022	/* Root inode */
2023	data->perms.mode = data->root_mode;
2024	inode = ffs_sb_make_inode(sb, NULL,
2025	&simple_dir_operations,
2026	&simple_dir_inode_operations,
2027	&data->perms);
2028	sb->s_root = d_make_root(inode);
2029	if (!sb->s_root)
2030	return -ENOMEM;
2031
2032	/* EP0 file */
2033	return ffs_sb_create_file(sb, "ep0", ffs, &ffs_ep0_operations);
2034	}
2035
2036	enum {
2037	Opt_no_disconnect,
2038	Opt_rmode,
2039	Opt_fmode,
2040	Opt_mode,
2041	Opt_uid,
2042	Opt_gid,
2043	};
2044
2045	static const struct fs_parameter_spec ffs_fs_fs_parameters[] = {
2046	fsparam_bool ("no_disconnect", Opt_no_disconnect),
2047	fsparam_u32 ("rmode", Opt_rmode),
2048	fsparam_u32 ("fmode", Opt_fmode),
2049	fsparam_u32 ("mode", Opt_mode),
2050	fsparam_u32 ("uid", Opt_uid),
2051	fsparam_u32 ("gid", Opt_gid),
2052	{}
2053	};
2054
2055	static int ffs_fs_parse_param(struct fs_context fc, struct fs_parameter param)
2056	{
2057	struct ffs_sb_fill_data *data = fc->fs_private;
2058	struct fs_parse_result result;
2059	int opt;
2060
2061	opt = fs_parse(fc, ffs_fs_fs_parameters, param, &result);
2062	if (opt < 0)
2063	return opt;
2064
2065	switch (opt) {
2066	case Opt_no_disconnect:
2067	data->no_disconnect = result.boolean;
2068	break;
2069	case Opt_rmode:
2070	data->root_mode = (result.uint_32 & 0555) \| S_IFDIR;
2071	break;
2072	case Opt_fmode:
2073	data->perms.mode = (result.uint_32 & 0666) \| S_IFREG;
2074	break;
2075	case Opt_mode:
2076	data->root_mode = (result.uint_32 & 0555) \| S_IFDIR;
2077	data->perms.mode = (result.uint_32 & 0666) \| S_IFREG;
2078	break;
2079
2080	case Opt_uid:
2081	data->perms.uid = make_kuid(current_user_ns(), result.uint_32);
2082	if (!uid_valid(data->perms.uid))
2083	goto unmapped_value;
2084	break;
2085	case Opt_gid:
2086	data->perms.gid = make_kgid(current_user_ns(), result.uint_32);
2087	if (!gid_valid(data->perms.gid))
2088	goto unmapped_value;
2089	break;
2090
2091	default:
2092	return -ENOPARAM;
2093	}
2094
2095	return 0;
2096
2097	unmapped_value:
2098	return invalf(fc, "%s: unmapped value: %u", param->key, result.uint_32);
2099	}
2100
2101	/*
2102	* Set up the superblock for a mount.
2103	*/
2104	static int ffs_fs_get_tree(struct fs_context *fc)
2105	{
2106	struct ffs_sb_fill_data *ctx = fc->fs_private;
2107	struct ffs_data *ffs;
2108	int ret;
2109
2110	if (!fc->source)
2111	return invalf(fc, "No source specified");
2112
2113	ffs = ffs_data_new(fc->source);
2114	if (!ffs)
2115	return -ENOMEM;
2116	ffs->file_perms = ctx->perms;
2117	ffs->no_disconnect = ctx->no_disconnect;
2118
2119	ffs->dev_name = kstrdup(fc->source, GFP_KERNEL);
2120	if (!ffs->dev_name) {
2121	ffs_data_put(ffs);
2122	return -ENOMEM;
2123	}
2124
2125	ret = ffs_acquire_dev(ffs->dev_name, ffs);
2126	if (ret) {
2127	ffs_data_put(ffs);
2128	return ret;
2129	}
2130
2131	ctx->ffs_data = ffs;
2132	return get_tree_nodev(fc, ffs_sb_fill);
2133	}
2134
2135	static void ffs_fs_free_fc(struct fs_context *fc)
2136	{
2137	struct ffs_sb_fill_data *ctx = fc->fs_private;
2138
2139	if (ctx) {
2140	if (ctx->ffs_data) {
2141	ffs_data_put(ctx->ffs_data);
2142	}
2143
2144	kfree(ctx);
2145	}
2146	}
2147
2148	static const struct fs_context_operations ffs_fs_context_ops = {
2149	.free = ffs_fs_free_fc,
2150	.parse_param = ffs_fs_parse_param,
2151	.get_tree = ffs_fs_get_tree,
2152	};
2153
2154	static int ffs_fs_init_fs_context(struct fs_context *fc)
2155	{
2156	struct ffs_sb_fill_data *ctx;
2157
2158	ctx = kzalloc_obj(struct ffs_sb_fill_data);
2159	if (!ctx)
2160	return -ENOMEM;
2161
2162	ctx->perms.mode = S_IFREG \| 0600;
2163	ctx->perms.uid = GLOBAL_ROOT_UID;
2164	ctx->perms.gid = GLOBAL_ROOT_GID;
2165	ctx->root_mode = S_IFDIR \| 0500;
2166	ctx->no_disconnect = false;
2167
2168	fc->fs_private = ctx;
2169	fc->ops = &ffs_fs_context_ops;
2170	return 0;
2171	}
2172
2173	static void
2174	ffs_fs_kill_sb(struct super_block *sb)
2175	{
2176	kill_anon_super(sb);
2177	if (sb->s_fs_info) {
2178	struct ffs_data *ffs = sb->s_fs_info;
2179	ffs->state = FFS_CLOSING;
2180	ffs_data_reset(ffs);
2181	// no configfs accesses from that point on,
2182	// so no further schedule_work() is possible
2183	cancel_work_sync(&ffs->reset_work);
2184	ffs_data_put(ffs);
2185	}
2186	}
2187
2188	static struct file_system_type ffs_fs_type = {
2189	.owner = THIS_MODULE,
2190	.name = "functionfs",
2191	.init_fs_context = ffs_fs_init_fs_context,
2192	.parameters = ffs_fs_fs_parameters,
2193	.kill_sb = ffs_fs_kill_sb,
2194	};
2195	MODULE_ALIAS_FS("functionfs");
2196
2197
2198	/* Driver's main init/cleanup functions *************************************/
2199
2200	static int functionfs_init(void)
2201	{
2202	int ret;
2203
2204	ret = register_filesystem(&ffs_fs_type);
2205	if (!ret)
2206	pr_info("file system registered\n");
2207	else
2208	pr_err("failed registering file system (%d)\n", ret);
2209
2210	return ret;
2211	}
2212
2213	static void functionfs_cleanup(void)
2214	{
2215	pr_info("unloading\n");
2216	unregister_filesystem(&ffs_fs_type);
2217	}
2218
2219
2220	/* ffs_data and ffs_function construction and destruction code **************/
2221
2222	static void ffs_data_clear(struct ffs_data *ffs);
2223
2224	static void ffs_data_get(struct ffs_data *ffs)
2225	{
2226	refcount_inc(&ffs->ref);
2227	}
2228
2229	static void ffs_data_put(struct ffs_data *ffs)
2230	{
2231	if (refcount_dec_and_test(&ffs->ref)) {
2232	pr_info("%s(): freeing\n", __func__);
2233	ffs_data_clear(ffs);
2234	ffs_release_dev(ffs->private_data);
2235	BUG_ON(waitqueue_active(&ffs->ev.waitq) \|\|
2236	swait_active(&ffs->ep0req_completion.wait) \|\|
2237	waitqueue_active(&ffs->wait));
2238	destroy_workqueue(ffs->io_completion_wq);
2239	kfree(ffs->dev_name);
2240	kfree(ffs);
2241	}
2242	}
2243
2244	static void ffs_data_closed(struct ffs_data *ffs)
2245	{
2246	spin_lock_irq(&ffs->eps_lock);
2247	if (--ffs->opened) { // not the last opener?
2248	spin_unlock_irq(&ffs->eps_lock);
2249	return;
2250	}
2251	if (ffs->no_disconnect) {
2252	struct ffs_epfile *epfiles;
2253
2254	ffs->state = FFS_DEACTIVATED;
2255	epfiles = ffs->epfiles;
2256	ffs->epfiles = NULL;
2257	spin_unlock_irq(&ffs->eps_lock);
2258
2259	if (epfiles)
2260	ffs_epfiles_destroy(ffs->sb, epfiles,
2261	ffs->epfiles_count);
2262
2263	if (ffs->setup_state == FFS_SETUP_PENDING)
2264	__ffs_ep0_stall(ffs);
2265	} else {
2266	ffs->state = FFS_CLOSING;
2267	spin_unlock_irq(&ffs->eps_lock);
2268	ffs_data_reset(ffs);
2269	}
2270	}
2271
2272	static struct ffs_data ffs_data_new(const char dev_name)
2273	{
2274	struct ffs_data ffs = kzalloc_obj(ffs);
2275	if (!ffs)
2276	return NULL;
2277
2278	ffs->io_completion_wq = alloc_ordered_workqueue("%s", 0, dev_name);
2279	if (!ffs->io_completion_wq) {
2280	kfree(ffs);
2281	return NULL;
2282	}
2283
2284	refcount_set(&ffs->ref, 1);
2285	ffs->opened = 0;
2286	ffs->state = FFS_READ_DESCRIPTORS;
2287	mutex_init(&ffs->mutex);
2288	spin_lock_init(&ffs->eps_lock);
2289	init_waitqueue_head(&ffs->ev.waitq);
2290	init_waitqueue_head(&ffs->wait);
2291	init_completion(&ffs->ep0req_completion);
2292	INIT_WORK(&ffs->reset_work, ffs_reset_work);
2293
2294	/* XXX REVISIT need to update it in some places, or do we? */
2295	ffs->ev.can_stall = 1;
2296
2297	return ffs;
2298	}
2299
2300	static void ffs_data_clear(struct ffs_data *ffs)
2301	{
2302	struct ffs_epfile *epfiles;
2303	unsigned long flags;
2304
2305	ffs_closed(ffs);
2306
2307	BUG_ON(ffs->gadget);
2308
2309	spin_lock_irqsave(&ffs->eps_lock, flags);
2310	epfiles = ffs->epfiles;
2311	ffs->epfiles = NULL;
2312	spin_unlock_irqrestore(&ffs->eps_lock, flags);
2313
2314	/*
2315	* potential race possible between ffs_func_eps_disable
2316	* & ffs_epfile_release therefore maintaining a local
2317	* copy of epfile will save us from use-after-free.
2318	*/
2319	if (epfiles) {
2320	ffs_epfiles_destroy(ffs->sb, epfiles, ffs->epfiles_count);
2321	ffs->epfiles = NULL;
2322	}
2323
2324	if (ffs->ffs_eventfd) {
2325	eventfd_ctx_put(ffs->ffs_eventfd);
2326	ffs->ffs_eventfd = NULL;
2327	}
2328
2329	kfree(ffs->raw_descs_data);
2330	kfree(ffs->raw_strings);
2331	kfree(ffs->stringtabs);
2332	}
2333
2334	static void ffs_data_reset(struct ffs_data *ffs)
2335	{
2336	ffs_data_clear(ffs);
2337
2338	spin_lock_irq(&ffs->eps_lock);
2339	ffs->raw_descs_data = NULL;
2340	ffs->raw_descs = NULL;
2341	ffs->raw_strings = NULL;
2342	ffs->stringtabs = NULL;
2343
2344	ffs->raw_descs_length = 0;
2345	ffs->fs_descs_count = 0;
2346	ffs->hs_descs_count = 0;
2347	ffs->ss_descs_count = 0;
2348
2349	ffs->strings_count = 0;
2350	ffs->interfaces_count = 0;
2351	ffs->eps_count = 0;
2352
2353	ffs->ev.count = 0;
2354
2355	ffs->state = FFS_READ_DESCRIPTORS;
2356	ffs->setup_state = FFS_NO_SETUP;
2357	ffs->flags = 0;
2358
2359	ffs->ms_os_descs_ext_prop_count = 0;
2360	ffs->ms_os_descs_ext_prop_name_len = 0;
2361	ffs->ms_os_descs_ext_prop_data_len = 0;
2362	spin_unlock_irq(&ffs->eps_lock);
2363	}
2364
2365
2366	static int functionfs_bind(struct ffs_data ffs, struct usb_composite_dev cdev)
2367	{
2368	struct usb_gadget_strings **lang;
2369	int first_id;
2370
2371	if ((ffs->state != FFS_ACTIVE
2372	\|\| test_and_set_bit(FFS_FL_BOUND, &ffs->flags)))
2373	return -EBADFD;
2374
2375	first_id = usb_string_ids_n(cdev, ffs->strings_count);
2376	if (first_id < 0)
2377	return first_id;
2378
2379	ffs->ep0req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL);
2380	if (!ffs->ep0req)
2381	return -ENOMEM;
2382	ffs->ep0req->complete = ffs_ep0_complete;
2383	ffs->ep0req->context = ffs;
2384
2385	lang = ffs->stringtabs;
2386	if (lang) {
2387	for (; *lang; ++lang) {
2388	struct usb_string str = (lang)->strings;
2389	int id = first_id;
2390	for (; str->s; ++id, ++str)
2391	str->id = id;
2392	}
2393	}
2394
2395	ffs->gadget = cdev->gadget;
2396	ffs_data_get(ffs);
2397	return 0;
2398	}
2399
2400	static void functionfs_unbind(struct ffs_data *ffs)
2401	{
2402	if (!WARN_ON(!ffs->gadget)) {
2403	/* dequeue before freeing ep0req */
2404	usb_ep_dequeue(ffs->gadget->ep0, ffs->ep0req);
2405	mutex_lock(&ffs->mutex);
2406	usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req);
2407	ffs->ep0req = NULL;
2408	ffs->gadget = NULL;
2409	clear_bit(FFS_FL_BOUND, &ffs->flags);
2410	mutex_unlock(&ffs->mutex);
2411	ffs_data_put(ffs);
2412	}
2413	}
2414
2415	static int ffs_epfiles_create(struct ffs_data *ffs)
2416	{
2417	struct ffs_epfile epfile, epfiles;
2418	unsigned int i, count, epfiles_count;
2419	int err;
2420
2421	count = ffs->eps_count;
2422	epfiles_count = count;
2423	if (ffs->user_flags & FUNCTIONFS_RW_PROXY_EPS)
2424	epfiles_count += count / 2;
2425	ffs->epfiles_count = epfiles_count;
2426
2427	epfiles = kzalloc_objs(*epfiles, epfiles_count);
2428	if (!epfiles)
2429	return -ENOMEM;
2430
2431	epfile = epfiles;
2432	for (i = 1; i <= count; ++i, ++epfile) {
2433	epfile->ffs = ffs;
2434	mutex_init(&epfile->mutex);
2435	mutex_init(&epfile->dmabufs_mutex);
2436	INIT_LIST_HEAD(&epfile->dmabufs);
2437	if (ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
2438	sprintf(epfile->name, "ep%02x", ffs->eps_addrmap[i]);
2439	else
2440	sprintf(epfile->name, "ep%u", i);
2441	epfile->in = (ffs->eps_addrmap[i] & USB_ENDPOINT_DIR_MASK) ? 1 : 0;
2442	err = ffs_sb_create_file(ffs->sb, epfile->name,
2443	epfile, &ffs_epfile_operations);
2444	if (err) {
2445	ffs_epfiles_destroy(ffs->sb, epfiles, i - 1);
2446	return err;
2447	}
2448	}
2449
2450	if (ffs->user_flags & FUNCTIONFS_RW_PROXY_EPS) {
2451	struct ffs_epfile *comp = epfiles + count;
2452
2453	for (i = 0; i < count; i += 2, ++comp) {
2454	struct ffs_epfile *ep1 = &epfiles[i];
2455	struct ffs_epfile *ep2 = &epfiles[i + 1];
2456	bool ep1_in = ffs->eps_addrmap[i + 1] & USB_ENDPOINT_DIR_MASK;
2457
2458	comp->ffs = ffs;
2459	comp->is_rw_proxy = true;
2460	comp->epfile_in = ep1_in ? ep1 : ep2;
2461	comp->epfile_out = ep1_in ? ep2 : ep1;
2462	mutex_init(&comp->mutex);
2463	mutex_init(&comp->dmabufs_mutex);
2464	INIT_LIST_HEAD(&comp->dmabufs);
2465	snprintf(comp->name, sizeof(comp->name), "%s_rw",
2466	epfiles[i].name);
2467	err = ffs_sb_create_file(ffs->sb, comp->name,
2468	comp, &ffs_epfile_operations);
2469	if (err) {
2470	ffs_epfiles_destroy(ffs->sb, epfiles, count + (i / 2));
2471	return err;
2472	}
2473	}
2474	}
2475
2476	ffs->epfiles = epfiles;
2477	return 0;
2478	}
2479
2480	static void clear_one(struct dentry *dentry)
2481	{
2482	smp_store_release(&dentry->d_inode->i_private, NULL);
2483	}
2484
2485	static void ffs_epfiles_destroy(struct super_block *sb,
2486	struct ffs_epfile *epfiles, unsigned count)
2487	{
2488	struct ffs_epfile *epfile = epfiles;
2489	struct dentry *root = sb->s_root;
2490
2491	for (; count; --count, ++epfile) {
2492	BUG_ON(mutex_is_locked(&epfile->mutex));
2493	__ffs_epfile_read_buffer_free(epfile);
2494	simple_remove_by_name(root, epfile->name, clear_one);
2495	}
2496
2497	kfree(epfiles);
2498	}
2499
2500	static void ffs_func_eps_disable(struct ffs_function *func)
2501	{
2502	struct ffs_ep *ep;
2503	struct ffs_epfile *epfile;
2504	unsigned short count;
2505	unsigned long flags;
2506
2507	spin_lock_irqsave(&func->ffs->eps_lock, flags);
2508	count = func->ffs->eps_count;
2509	epfile = func->ffs->epfiles;
2510	ep = func->eps;
2511	while (count--) {
2512	/* pending requests get nuked */
2513	if (ep->ep)
2514	usb_ep_disable(ep->ep);
2515	++ep;
2516
2517	if (epfile) {
2518	epfile->ep = NULL;
2519	__ffs_epfile_read_buffer_free(epfile);
2520	++epfile;
2521	}
2522	}
2523	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
2524	}
2525
2526	static int ffs_func_eps_enable(struct ffs_function *func)
2527	{
2528	struct ffs_data *ffs;
2529	struct ffs_ep *ep;
2530	struct ffs_epfile *epfile;
2531	unsigned short count;
2532	unsigned long flags;
2533	int ret = 0;
2534
2535	spin_lock_irqsave(&func->ffs->eps_lock, flags);
2536	ffs = func->ffs;
2537	ep = func->eps;
2538	epfile = ffs->epfiles;
2539	count = ffs->eps_count;
2540	if (!epfile) {
2541	ret = -ENOMEM;
2542	goto done;
2543	}
2544
2545	while (count--) {
2546	ep->ep->driver_data = ep;
2547
2548	ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
2549	if (ret) {
2550	pr_err("%s: config_ep_by_speed(%s) returned %d\n",
2551	__func__, ep->ep->name, ret);
2552	break;
2553	}
2554
2555	ret = usb_ep_enable(ep->ep);
2556	if (!ret) {
2557	epfile->ep = ep;
2558	epfile->isoc = usb_endpoint_xfer_isoc(ep->ep->desc);
2559	} else {
2560	break;
2561	}
2562
2563	++ep;
2564	++epfile;
2565	}
2566
2567	wake_up_interruptible(&ffs->wait);
2568	done:
2569	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
2570
2571	return ret;
2572	}
2573
2574
2575	/* Parsing and building descriptors and strings *****************************/
2576
2577	/*
2578	* This validates if data pointed by data is a valid USB descriptor as
2579	* well as record how many interfaces, endpoints and strings are
2580	* required by given configuration. Returns address after the
2581	* descriptor or NULL if data is invalid.
2582	*/
2583
2584	enum ffs_entity_type {
2585	FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT
2586	};
2587
2588	enum ffs_os_desc_type {
2589	FFS_OS_DESC, FFS_OS_DESC_EXT_COMPAT, FFS_OS_DESC_EXT_PROP
2590	};
2591
2592	typedef int (*ffs_entity_callback)(enum ffs_entity_type entity,
2593	u8 *valuep,
2594	struct usb_descriptor_header *desc,
2595	void *priv);
2596
2597	typedef int (*ffs_os_desc_callback)(enum ffs_os_desc_type entity,
2598	struct usb_os_desc_header h, void data,
2599	unsigned len, void *priv);
2600
2601	static int __must_check ffs_do_single_desc(char *data, unsigned len,
2602	ffs_entity_callback entity,
2603	void priv, int current_class, int *current_subclass)
2604	{
2605	struct usb_descriptor_header _ds = (void )data;
2606	u8 length;
2607	int ret;
2608
2609	/* At least two bytes are required: length and type */
2610	if (len < 2) {
2611	pr_vdebug("descriptor too short\n");
2612	return -EINVAL;
2613	}
2614
2615	/* If we have at least as many bytes as the descriptor takes? */
2616	length = _ds->bLength;
2617	if (len < length) {
2618	pr_vdebug("descriptor longer then available data\n");
2619	return -EINVAL;
2620	}
2621
2622	#define __entity_check_INTERFACE(val) 1
2623	#define __entity_check_STRING(val) (val)
2624	#define __entity_check_ENDPOINT(val) ((val) & USB_ENDPOINT_NUMBER_MASK)
2625	#define __entity(type, val) do { \
2626	pr_vdebug("entity " #type "(%02x)\n", (val)); \
2627	if (!__entity_check_ ##type(val)) { \
2628	pr_vdebug("invalid entity's value\n"); \
2629	return -EINVAL; \
2630	} \
2631	ret = entity(FFS_ ##type, &val, _ds, priv); \
2632	if (ret < 0) { \
2633	pr_debug("entity " #type "(%02x); ret = %d\n", \
2634	(val), ret); \
2635	return ret; \
2636	} \
2637	} while (0)
2638
2639	/* Parse descriptor depending on type. */
2640	switch (_ds->bDescriptorType) {
2641	case USB_DT_DEVICE:
2642	case USB_DT_CONFIG:
2643	case USB_DT_STRING:
2644	case USB_DT_DEVICE_QUALIFIER:
2645	/* function can't have any of those */
2646	pr_vdebug("descriptor reserved for gadget: %d\n",
2647	_ds->bDescriptorType);
2648	return -EINVAL;
2649
2650	case USB_DT_INTERFACE: {
2651	struct usb_interface_descriptor ds = (void )_ds;
2652	pr_vdebug("interface descriptor\n");
2653	if (length != sizeof *ds)
2654	goto inv_length;
2655
2656	__entity(INTERFACE, ds->bInterfaceNumber);
2657	if (ds->iInterface)
2658	__entity(STRING, ds->iInterface);
2659	*current_class = ds->bInterfaceClass;
2660	*current_subclass = ds->bInterfaceSubClass;
2661	}
2662	break;
2663
2664	case USB_DT_ENDPOINT: {
2665	struct usb_endpoint_descriptor ds = (void )_ds;
2666	pr_vdebug("endpoint descriptor\n");
2667	if (length != USB_DT_ENDPOINT_SIZE &&
2668	length != USB_DT_ENDPOINT_AUDIO_SIZE)
2669	goto inv_length;
2670	__entity(ENDPOINT, ds->bEndpointAddress);
2671	}
2672	break;
2673
2674	case USB_TYPE_CLASS \| 0x01:
2675	if (*current_class == USB_INTERFACE_CLASS_HID) {
2676	pr_vdebug("hid descriptor\n");
2677	if (length != sizeof(struct hid_descriptor))
2678	goto inv_length;
2679	break;
2680	} else if (*current_class == USB_INTERFACE_CLASS_CCID) {
2681	pr_vdebug("ccid descriptor\n");
2682	if (length != sizeof(struct ccid_descriptor))
2683	goto inv_length;
2684	break;
2685	} else if (*current_class == USB_CLASS_APP_SPEC &&
2686	*current_subclass == USB_SUBCLASS_DFU) {
2687	pr_vdebug("dfu functional descriptor\n");
2688	if (length != sizeof(struct usb_dfu_functional_descriptor))
2689	goto inv_length;
2690	break;
2691	} else {
2692	pr_vdebug("unknown descriptor: %d for class %d\n",
2693	_ds->bDescriptorType, *current_class);
2694	return -EINVAL;
2695	}
2696
2697	case USB_DT_OTG:
2698	if (length != sizeof(struct usb_otg_descriptor))
2699	goto inv_length;
2700	break;
2701
2702	case USB_DT_INTERFACE_ASSOCIATION: {
2703	struct usb_interface_assoc_descriptor ds = (void )_ds;
2704	pr_vdebug("interface association descriptor\n");
2705	if (length != sizeof *ds)
2706	goto inv_length;
2707	if (ds->iFunction)
2708	__entity(STRING, ds->iFunction);
2709	}
2710	break;
2711
2712	case USB_DT_SS_ENDPOINT_COMP:
2713	pr_vdebug("EP SS companion descriptor\n");
2714	if (length != sizeof(struct usb_ss_ep_comp_descriptor))
2715	goto inv_length;
2716	break;
2717
2718	case USB_DT_OTHER_SPEED_CONFIG:
2719	case USB_DT_INTERFACE_POWER:
2720	case USB_DT_DEBUG:
2721	case USB_DT_SECURITY:
2722	case USB_DT_CS_RADIO_CONTROL:
2723	/* TODO */
2724	pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType);
2725	return -EINVAL;
2726
2727	default:
2728	/* We should never be here */
2729	pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType);
2730	return -EINVAL;
2731
2732	inv_length:
2733	pr_vdebug("invalid length: %d (descriptor %d)\n",
2734	_ds->bLength, _ds->bDescriptorType);
2735	return -EINVAL;
2736	}
2737
2738	#undef __entity
2739	#undef __entity_check_DESCRIPTOR
2740	#undef __entity_check_INTERFACE
2741	#undef __entity_check_STRING
2742	#undef __entity_check_ENDPOINT
2743
2744	return length;
2745	}
2746
2747	static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len,
2748	ffs_entity_callback entity, void *priv)
2749	{
2750	const unsigned _len = len;
2751	unsigned long num = 0;
2752	int current_class = -1;
2753	int current_subclass = -1;
2754
2755	for (;;) {
2756	int ret;
2757
2758	if (num == count)
2759	data = NULL;
2760
2761	/* Record "descriptor" entity */
2762	ret = entity(FFS_DESCRIPTOR, (u8 )num, (void )data, priv);
2763	if (ret < 0) {
2764	pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n",
2765	num, ret);
2766	return ret;
2767	}
2768
2769	if (!data)
2770	return _len - len;
2771
2772	ret = ffs_do_single_desc(data, len, entity, priv,
2773	&current_class, &current_subclass);
2774	if (ret < 0) {
2775	pr_debug("%s returns %d\n", __func__, ret);
2776	return ret;
2777	}
2778
2779	len -= ret;
2780	data += ret;
2781	++num;
2782	}
2783	}
2784
2785	static int __ffs_data_do_entity(enum ffs_entity_type type,
2786	u8 valuep, struct usb_descriptor_header desc,
2787	void *priv)
2788	{
2789	struct ffs_desc_helper *helper = priv;
2790	struct usb_endpoint_descriptor *d;
2791
2792	switch (type) {
2793	case FFS_DESCRIPTOR:
2794	break;
2795
2796	case FFS_INTERFACE:
2797	/*
2798	* Interfaces are indexed from zero so if we
2799	* encountered interface "n" then there are at least
2800	* "n+1" interfaces.
2801	*/
2802	if (*valuep >= helper->interfaces_count)
2803	helper->interfaces_count = *valuep + 1;
2804	break;
2805
2806	case FFS_STRING:
2807	/*
2808	* Strings are indexed from 1 (0 is reserved
2809	* for languages list)
2810	*/
2811	if (*valuep > helper->ffs->strings_count)
2812	helper->ffs->strings_count = *valuep;
2813	break;
2814
2815	case FFS_ENDPOINT:
2816	d = (void *)desc;
2817	helper->eps_count++;
2818	if (helper->eps_count >= FFS_MAX_EPS_COUNT)
2819	return -EINVAL;
2820	/* Check if descriptors for any speed were already parsed */
2821	if (!helper->ffs->eps_count && !helper->ffs->interfaces_count)
2822	helper->ffs->eps_addrmap[helper->eps_count] =
2823	d->bEndpointAddress;
2824	else if (helper->ffs->eps_addrmap[helper->eps_count] !=
2825	d->bEndpointAddress)
2826	return -EINVAL;
2827	break;
2828	}
2829
2830	return 0;
2831	}
2832
2833	static int __ffs_do_os_desc_header(enum ffs_os_desc_type *next_type,
2834	struct usb_os_desc_header *desc)
2835	{
2836	u16 bcd_version = le16_to_cpu(desc->bcdVersion);
2837	u16 w_index = le16_to_cpu(desc->wIndex);
2838
2839	if (bcd_version == 0x1) {
2840	pr_warn("bcdVersion must be 0x0100, stored in Little Endian order. "
2841	"Userspace driver should be fixed, accepting 0x0001 for compatibility.\n");
2842	} else if (bcd_version != 0x100) {
2843	pr_vdebug("unsupported os descriptors version: 0x%x\n",
2844	bcd_version);
2845	return -EINVAL;
2846	}
2847	switch (w_index) {
2848	case 0x4:
2849	*next_type = FFS_OS_DESC_EXT_COMPAT;
2850	break;
2851	case 0x5:
2852	*next_type = FFS_OS_DESC_EXT_PROP;
2853	break;
2854	default:
2855	pr_vdebug("unsupported os descriptor type: %d", w_index);
2856	return -EINVAL;
2857	}
2858
2859	return sizeof(*desc);
2860	}
2861
2862	/*
2863	* Process all extended compatibility/extended property descriptors
2864	* of a feature descriptor
2865	*/
2866	static int __must_check ffs_do_single_os_desc(char *data, unsigned len,
2867	enum ffs_os_desc_type type,
2868	u16 feature_count,
2869	ffs_os_desc_callback entity,
2870	void *priv,
2871	struct usb_os_desc_header *h)
2872	{
2873	int ret;
2874	const unsigned _len = len;
2875
2876	/* loop over all ext compat/ext prop descriptors */
2877	while (feature_count--) {
2878	ret = entity(type, h, data, len, priv);
2879	if (ret < 0) {
2880	pr_debug("bad OS descriptor, type: %d\n", type);
2881	return ret;
2882	}
2883	data += ret;
2884	len -= ret;
2885	}
2886	return _len - len;
2887	}
2888
2889	/* Process a number of complete Feature Descriptors (Ext Compat or Ext Prop) */
2890	static int __must_check ffs_do_os_descs(unsigned count,
2891	char *data, unsigned len,
2892	ffs_os_desc_callback entity, void *priv)
2893	{
2894	const unsigned _len = len;
2895	unsigned long num = 0;
2896
2897	for (num = 0; num < count; ++num) {
2898	int ret;
2899	enum ffs_os_desc_type type;
2900	u16 feature_count;
2901	struct usb_os_desc_header desc = (void )data;
2902
2903	if (len < sizeof(*desc))
2904	return -EINVAL;
2905
2906	/*
2907	* Record "descriptor" entity.
2908	* Process dwLength, bcdVersion, wIndex, get b/wCount.
2909	* Move the data pointer to the beginning of extended
2910	* compatibilities proper or extended properties proper
2911	* portions of the data
2912	*/
2913	if (le32_to_cpu(desc->dwLength) > len)
2914	return -EINVAL;
2915
2916	ret = __ffs_do_os_desc_header(&type, desc);
2917	if (ret < 0) {
2918	pr_debug("entity OS_DESCRIPTOR(%02lx); ret = %d\n",
2919	num, ret);
2920	return ret;
2921	}
2922	/*
2923	* 16-bit hex "?? 00" Little Endian looks like 8-bit hex "??"
2924	*/
2925	feature_count = le16_to_cpu(desc->wCount);
2926	if (type == FFS_OS_DESC_EXT_COMPAT &&
2927	(feature_count > 255 \|\| desc->Reserved))
2928	return -EINVAL;
2929	len -= ret;
2930	data += ret;
2931
2932	/*
2933	* Process all function/property descriptors
2934	* of this Feature Descriptor
2935	*/
2936	ret = ffs_do_single_os_desc(data, len, type,
2937	feature_count, entity, priv, desc);
2938	if (ret < 0) {
2939	pr_debug("%s returns %d\n", __func__, ret);
2940	return ret;
2941	}
2942
2943	len -= ret;
2944	data += ret;
2945	}
2946	return _len - len;
2947	}
2948
2949	/*
2950	* Validate contents of the buffer from userspace related to OS descriptors.
2951	*/
2952	static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
2953	struct usb_os_desc_header h, void data,
2954	unsigned len, void *priv)
2955	{
2956	struct ffs_data *ffs = priv;
2957	u8 length;
2958
2959	switch (type) {
2960	case FFS_OS_DESC_EXT_COMPAT: {
2961	struct usb_ext_compat_desc *d = data;
2962	int i;
2963
2964	if (len < sizeof(*d) \|\|
2965	d->bFirstInterfaceNumber >= ffs->interfaces_count)
2966	return -EINVAL;
2967	if (d->Reserved1 != 1) {
2968	/*
2969	* According to the spec, Reserved1 must be set to 1
2970	* but older kernels incorrectly rejected non-zero
2971	* values. We fix it here to avoid returning EINVAL
2972	* in response to values we used to accept.
2973	*/
2974	pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n");
2975	d->Reserved1 = 1;
2976	}
2977	for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
2978	if (d->Reserved2[i])
2979	return -EINVAL;
2980
2981	length = sizeof(struct usb_ext_compat_desc);
2982	}
2983	break;
2984	case FFS_OS_DESC_EXT_PROP: {
2985	struct usb_ext_prop_desc *d = data;
2986	u32 type, pdl;
2987	u16 pnl;
2988
2989	if (len < sizeof(*d) \|\| h->interface >= ffs->interfaces_count)
2990	return -EINVAL;
2991	length = le32_to_cpu(d->dwSize);
2992	if (len < length)
2993	return -EINVAL;
2994	type = le32_to_cpu(d->dwPropertyDataType);
2995	if (type < USB_EXT_PROP_UNICODE \|\|
2996	type > USB_EXT_PROP_UNICODE_MULTI) {
2997	pr_vdebug("unsupported os descriptor property type: %d",
2998	type);
2999	return -EINVAL;
3000	}
3001	pnl = le16_to_cpu(d->wPropertyNameLength);
3002	if (length < 14 + pnl) {
3003	pr_vdebug("invalid os descriptor length: %d pnl:%d (descriptor %d)\n",
3004	length, pnl, type);
3005	return -EINVAL;
3006	}
3007	pdl = le32_to_cpu((__le32 )((u8 *)data + 10 + pnl));
3008	if (length != 14 + pnl + pdl) {
3009	pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n",
3010	length, pnl, pdl, type);
3011	return -EINVAL;
3012	}
3013	++ffs->ms_os_descs_ext_prop_count;
3014	/* property name reported to the host as "WCHAR"s */
3015	ffs->ms_os_descs_ext_prop_name_len += pnl * 2;
3016	ffs->ms_os_descs_ext_prop_data_len += pdl;
3017	}
3018	break;
3019	default:
3020	pr_vdebug("unknown descriptor: %d\n", type);
3021	return -EINVAL;
3022	}
3023	return length;
3024	}
3025
3026	static int __ffs_data_got_descs(struct ffs_data *ffs,
3027	char *const _data, size_t len)
3028	{
3029	char data = _data, raw_descs;
3030	unsigned os_descs_count = 0, counts[3], flags;
3031	int ret = -EINVAL, i;
3032	struct ffs_desc_helper helper;
3033
3034	if (get_unaligned_le32(data + 4) != len)
3035	goto error;
3036
3037	switch (get_unaligned_le32(data)) {
3038	case FUNCTIONFS_DESCRIPTORS_MAGIC:
3039	flags = FUNCTIONFS_HAS_FS_DESC \| FUNCTIONFS_HAS_HS_DESC;
3040	data += 8;
3041	len -= 8;
3042	break;
3043	case FUNCTIONFS_DESCRIPTORS_MAGIC_V2:
3044	flags = get_unaligned_le32(data + 8);
3045	ffs->user_flags = flags;
3046	if (flags & ~(FUNCTIONFS_HAS_FS_DESC \|
3047	FUNCTIONFS_HAS_HS_DESC \|
3048	FUNCTIONFS_HAS_SS_DESC \|
3049	FUNCTIONFS_HAS_MS_OS_DESC \|
3050	FUNCTIONFS_VIRTUAL_ADDR \|
3051	FUNCTIONFS_EVENTFD \|
3052	FUNCTIONFS_ALL_CTRL_RECIP \|
3053	FUNCTIONFS_CONFIG0_SETUP \|
3054	FUNCTIONFS_RW_PROXY_EPS)) {
3055	ret = -ENOSYS;
3056	goto error;
3057	}
3058	data += 12;
3059	len -= 12;
3060	break;
3061	default:
3062	goto error;
3063	}
3064
3065	if (flags & FUNCTIONFS_EVENTFD) {
3066	if (len < 4)
3067	goto error;
3068	ffs->ffs_eventfd =
3069	eventfd_ctx_fdget((int)get_unaligned_le32(data));
3070	if (IS_ERR(ffs->ffs_eventfd)) {
3071	ret = PTR_ERR(ffs->ffs_eventfd);
3072	ffs->ffs_eventfd = NULL;
3073	goto error;
3074	}
3075	data += 4;
3076	len -= 4;
3077	}
3078
3079	/* Read fs_count, hs_count and ss_count (if present) */
3080	for (i = 0; i < 3; ++i) {
3081	if (!(flags & (1 << i))) {
3082	counts[i] = 0;
3083	} else if (len < 4) {
3084	goto error;
3085	} else {
3086	counts[i] = get_unaligned_le32(data);
3087	data += 4;
3088	len -= 4;
3089	}
3090	}
3091	if (flags & (1 << i)) {
3092	if (len < 4) {
3093	goto error;
3094	}
3095	os_descs_count = get_unaligned_le32(data);
3096	data += 4;
3097	len -= 4;
3098	}
3099
3100	/* Read descriptors */
3101	raw_descs = data;
3102	helper.ffs = ffs;
3103	for (i = 0; i < 3; ++i) {
3104	if (!counts[i])
3105	continue;
3106	helper.interfaces_count = 0;
3107	helper.eps_count = 0;
3108	ret = ffs_do_descs(counts[i], data, len,
3109	__ffs_data_do_entity, &helper);
3110	if (ret < 0)
3111	goto error;
3112	if (!ffs->eps_count && !ffs->interfaces_count) {
3113	ffs->eps_count = helper.eps_count;
3114	ffs->interfaces_count = helper.interfaces_count;
3115	} else {
3116	if (ffs->eps_count != helper.eps_count) {
3117	ret = -EINVAL;
3118	goto error;
3119	}
3120	if (ffs->interfaces_count != helper.interfaces_count) {
3121	ret = -EINVAL;
3122	goto error;
3123	}
3124	}
3125	data += ret;
3126	len -= ret;
3127	}
3128	if (os_descs_count) {
3129	ret = ffs_do_os_descs(os_descs_count, data, len,
3130	__ffs_data_do_os_desc, ffs);
3131	if (ret < 0)
3132	goto error;
3133	data += ret;
3134	len -= ret;
3135	}
3136
3137	if (raw_descs == data \|\| len) {
3138	ret = -EINVAL;
3139	goto error;
3140	}
3141
3142	if (ffs->user_flags & FUNCTIONFS_RW_PROXY_EPS) {
3143	if (ffs->eps_count % 2) {
3144	ret = -EINVAL;
3145	goto error;
3146	}
3147
3148	for (i = 1; i < ffs->eps_count; i += 2) {
3149	if ((ffs->eps_addrmap[i] & USB_ENDPOINT_DIR_MASK) ==
3150	(ffs->eps_addrmap[i + 1] & USB_ENDPOINT_DIR_MASK)) {
3151	ret = -EINVAL;
3152	goto error;
3153	}
3154	}
3155	}
3156
3157	ffs->raw_descs_data = _data;
3158	ffs->raw_descs = raw_descs;
3159	ffs->raw_descs_length = data - raw_descs;
3160	ffs->fs_descs_count = counts[0];
3161	ffs->hs_descs_count = counts[1];
3162	ffs->ss_descs_count = counts[2];
3163	ffs->ms_os_descs_count = os_descs_count;
3164
3165	return 0;
3166
3167	error:
3168	kfree(_data);
3169	return ret;
3170	}
3171
3172	static int __ffs_data_got_strings(struct ffs_data *ffs,
3173	char *const _data, size_t len)
3174	{
3175	u32 str_count, needed_count, lang_count;
3176	struct usb_gadget_strings *stringtabs, t;
3177	const char *data = _data;
3178	struct usb_string *s;
3179
3180	if (len < 16 \|\|
3181	get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC \|\|
3182	get_unaligned_le32(data + 4) != len)
3183	goto error;
3184	str_count = get_unaligned_le32(data + 8);
3185	lang_count = get_unaligned_le32(data + 12);
3186
3187	/* if one is zero the other must be zero */
3188	if (!str_count != !lang_count)
3189	goto error;
3190
3191	/* Do we have at least as many strings as descriptors need? */
3192	needed_count = ffs->strings_count;
3193	if (str_count < needed_count)
3194	goto error;
3195
3196	/*
3197	* If we don't need any strings just return and free all
3198	* memory.
3199	*/
3200	if (!needed_count) {
3201	kfree(_data);
3202	return 0;
3203	}
3204
3205	/* Allocate everything in one chunk so there's less maintenance. */
3206	{
3207	unsigned i = 0;
3208	vla_group(d);
3209	vla_item(d, struct usb_gadget_strings *, stringtabs,
3210	size_add(lang_count, 1));
3211	vla_item(d, struct usb_gadget_strings, stringtab, lang_count);
3212	vla_item(d, struct usb_string, strings,
3213	size_mul(lang_count, (needed_count + 1)));
3214
3215	char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL);
3216
3217	if (!vlabuf) {
3218	kfree(_data);
3219	return -ENOMEM;
3220	}
3221
3222	/* Initialize the VLA pointers */
3223	stringtabs = vla_ptr(vlabuf, d, stringtabs);
3224	t = vla_ptr(vlabuf, d, stringtab);
3225	i = lang_count;
3226	do {
3227	*stringtabs++ = t++;
3228	} while (--i);
3229	*stringtabs = NULL;
3230
3231	/* stringtabs = vlabuf = d_stringtabs for later kfree */
3232	stringtabs = vla_ptr(vlabuf, d, stringtabs);
3233	t = vla_ptr(vlabuf, d, stringtab);
3234	s = vla_ptr(vlabuf, d, strings);
3235	}
3236
3237	/* For each language */
3238	data += 16;
3239	len -= 16;
3240
3241	do { /* lang_count > 0 so we can use do-while */
3242	unsigned needed = needed_count;
3243	u32 str_per_lang = str_count;
3244
3245	if (len < 3)
3246	goto error_free;
3247	t->language = get_unaligned_le16(data);
3248	t->strings = s;
3249	++t;
3250
3251	data += 2;
3252	len -= 2;
3253
3254	/* For each string */
3255	do { /* str_count > 0 so we can use do-while */
3256	size_t length = strnlen(data, len);
3257
3258	if (length == len)
3259	goto error_free;
3260
3261	/*
3262	* User may provide more strings then we need,
3263	* if that's the case we simply ignore the
3264	* rest
3265	*/
3266	if (needed) {
3267	/*
3268	* s->id will be set while adding
3269	* function to configuration so for
3270	* now just leave garbage here.
3271	*/
3272	s->s = data;
3273	--needed;
3274	++s;
3275	}
3276
3277	data += length + 1;
3278	len -= length + 1;
3279	} while (--str_per_lang);
3280
3281	s->id = 0; /* terminator */
3282	s->s = NULL;
3283	++s;
3284
3285	} while (--lang_count);
3286
3287	/* Some garbage left? */
3288	if (len)
3289	goto error_free;
3290
3291	/* Done! */
3292	ffs->stringtabs = stringtabs;
3293	ffs->raw_strings = _data;
3294
3295	return 0;
3296
3297	error_free:
3298	kfree(stringtabs);
3299	error:
3300	kfree(_data);
3301	return -EINVAL;
3302	}
3303
3304
3305	/* Events handling and management *******************************************/
3306
3307	static void __ffs_event_add(struct ffs_data *ffs,
3308	enum usb_functionfs_event_type type)
3309	{
3310	enum usb_functionfs_event_type rem_type1, rem_type2 = type;
3311	int neg = 0;
3312
3313	/*
3314	* Abort any unhandled setup
3315	*
3316	* We do not need to worry about some cmpxchg() changing value
3317	* of ffs->setup_state without holding the lock because when
3318	* state is FFS_SETUP_PENDING cmpxchg() in several places in
3319	* the source does nothing.
3320	*/
3321	if (ffs->setup_state == FFS_SETUP_PENDING)
3322	ffs->setup_state = FFS_SETUP_CANCELLED;
3323
3324	/*
3325	* Logic of this function guarantees that there are at most four pending
3326	* evens on ffs->ev.types queue. This is important because the queue
3327	* has space for four elements only and __ffs_ep0_read_events function
3328	* depends on that limit as well. If more event types are added, those
3329	* limits have to be revisited or guaranteed to still hold.
3330	*/
3331	switch (type) {
3332	case FUNCTIONFS_RESUME:
3333	rem_type2 = FUNCTIONFS_SUSPEND;
3334	fallthrough;
3335	case FUNCTIONFS_SUSPEND:
3336	case FUNCTIONFS_SETUP:
3337	rem_type1 = type;
3338	/* Discard all similar events */
3339	break;
3340
3341	case FUNCTIONFS_BIND:
3342	case FUNCTIONFS_UNBIND:
3343	case FUNCTIONFS_DISABLE:
3344	case FUNCTIONFS_ENABLE:
3345	/* Discard everything other then power management. */
3346	rem_type1 = FUNCTIONFS_SUSPEND;
3347	rem_type2 = FUNCTIONFS_RESUME;
3348	neg = 1;
3349	break;
3350
3351	default:
3352	WARN(1, "%d: unknown event, this should not happen\n", type);
3353	return;
3354	}
3355
3356	{
3357	u8 ev = ffs->ev.types, out = ev;
3358	unsigned n = ffs->ev.count;
3359	for (; n; --n, ++ev)
3360	if ((ev == rem_type1 \|\| ev == rem_type2) == neg)
3361	out++ = ev;
3362	else
3363	pr_vdebug("purging event %d\n", *ev);
3364	ffs->ev.count = out - ffs->ev.types;
3365	}
3366
3367	pr_vdebug("adding event %d\n", type);
3368	ffs->ev.types[ffs->ev.count++] = type;
3369	wake_up_locked(&ffs->ev.waitq);
3370	if (ffs->ffs_eventfd)
3371	eventfd_signal(ffs->ffs_eventfd);
3372	}
3373
3374	static void ffs_event_add(struct ffs_data *ffs,
3375	enum usb_functionfs_event_type type)
3376	{
3377	unsigned long flags;
3378	spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
3379	__ffs_event_add(ffs, type);
3380	spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
3381	}
3382
3383	/* Bind/unbind USB function hooks *******************************************/
3384
3385	static int ffs_ep_addr2idx(struct ffs_data *ffs, u8 endpoint_address)
3386	{
3387	int i;
3388
3389	for (i = 1; i < ARRAY_SIZE(ffs->eps_addrmap); ++i)
3390	if (ffs->eps_addrmap[i] == endpoint_address)
3391	return i;
3392	return -ENOENT;
3393	}
3394
3395	static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
3396	struct usb_descriptor_header *desc,
3397	void *priv)
3398	{
3399	struct usb_endpoint_descriptor ds = (void )desc;
3400	struct ffs_function *func = priv;
3401	struct ffs_ep *ffs_ep;
3402	unsigned ep_desc_id;
3403	int idx;
3404	static const char *speed_names[] = { "full", "high", "super" };
3405
3406	if (type != FFS_DESCRIPTOR)
3407	return 0;
3408
3409	/*
3410	* If ss_descriptors is not NULL, we are reading super speed
3411	* descriptors; if hs_descriptors is not NULL, we are reading high
3412	* speed descriptors; otherwise, we are reading full speed
3413	* descriptors.
3414	*/
3415	if (func->function.ss_descriptors) {
3416	ep_desc_id = 2;
3417	func->function.ss_descriptors[(long)valuep] = desc;
3418	} else if (func->function.hs_descriptors) {
3419	ep_desc_id = 1;
3420	func->function.hs_descriptors[(long)valuep] = desc;
3421	} else {
3422	ep_desc_id = 0;
3423	func->function.fs_descriptors[(long)valuep] = desc;
3424	}
3425
3426	if (!desc \|\| desc->bDescriptorType != USB_DT_ENDPOINT)
3427	return 0;
3428
3429	idx = ffs_ep_addr2idx(func->ffs, ds->bEndpointAddress) - 1;
3430	if (idx < 0)
3431	return idx;
3432
3433	ffs_ep = func->eps + idx;
3434
3435	if (ffs_ep->descs[ep_desc_id]) {
3436	pr_err("two %sspeed descriptors for EP %d\n",
3437	speed_names[ep_desc_id],
3438	usb_endpoint_num(ds));
3439	return -EINVAL;
3440	}
3441	ffs_ep->descs[ep_desc_id] = ds;
3442
3443	ffs_dump_mem(": Original ep desc", ds, ds->bLength);
3444	if (ffs_ep->ep) {
3445	ds->bEndpointAddress = ffs_ep->descs[0]->bEndpointAddress;
3446	if (!ds->wMaxPacketSize)
3447	ds->wMaxPacketSize = ffs_ep->descs[0]->wMaxPacketSize;
3448	} else {
3449	struct usb_request *req;
3450	struct usb_ep *ep;
3451	u8 bEndpointAddress;
3452	__le16 wMaxPacketSize;
3453
3454	/*
3455	* We back up bEndpointAddress because autoconfig overwrites
3456	* it with physical endpoint address.
3457	*/
3458	bEndpointAddress = ds->bEndpointAddress;
3459	/*
3460	* We back up wMaxPacketSize because autoconfig treats
3461	* endpoint descriptors as if they were full speed.
3462	*/
3463	wMaxPacketSize = ds->wMaxPacketSize;
3464	pr_vdebug("autoconfig\n");
3465	ep = usb_ep_autoconfig(func->gadget, ds);
3466	if (!ep)
3467	return -ENOTSUPP;
3468	ep->driver_data = func->eps + idx;
3469
3470	req = usb_ep_alloc_request(ep, GFP_KERNEL);
3471	if (!req)
3472	return -ENOMEM;
3473
3474	ffs_ep->ep = ep;
3475	ffs_ep->req = req;
3476	func->eps_revmap[ds->bEndpointAddress &
3477	USB_ENDPOINT_NUMBER_MASK] = idx + 1;
3478	/*
3479	* If we use virtual address mapping, we restore
3480	* original bEndpointAddress value.
3481	*/
3482	if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
3483	ds->bEndpointAddress = bEndpointAddress;
3484	/*
3485	* Restore wMaxPacketSize which was potentially
3486	* overwritten by autoconfig.
3487	*/
3488	ds->wMaxPacketSize = wMaxPacketSize;
3489	}
3490	ffs_dump_mem(": Rewritten ep desc", ds, ds->bLength);
3491
3492	return 0;
3493	}
3494
3495	static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep,
3496	struct usb_descriptor_header *desc,
3497	void *priv)
3498	{
3499	struct ffs_function *func = priv;
3500	unsigned idx;
3501	u8 newValue;
3502
3503	switch (type) {
3504	default:
3505	case FFS_DESCRIPTOR:
3506	/* Handled in previous pass by __ffs_func_bind_do_descs() */
3507	return 0;
3508
3509	case FFS_INTERFACE:
3510	idx = *valuep;
3511	if (func->interfaces_nums[idx] < 0) {
3512	int id = usb_interface_id(func->conf, &func->function);
3513	if (id < 0)
3514	return id;
3515	func->interfaces_nums[idx] = id;
3516	}
3517	newValue = func->interfaces_nums[idx];
3518	break;
3519
3520	case FFS_STRING:
3521	/* String' IDs are allocated when fsf_data is bound to cdev */
3522	newValue = func->ffs->stringtabs[0]->strings[*valuep - 1].id;
3523	break;
3524
3525	case FFS_ENDPOINT:
3526	/*
3527	* USB_DT_ENDPOINT are handled in
3528	* __ffs_func_bind_do_descs().
3529	*/
3530	if (desc->bDescriptorType == USB_DT_ENDPOINT)
3531	return 0;
3532
3533	idx = (*valuep & USB_ENDPOINT_NUMBER_MASK) - 1;
3534	if (!func->eps[idx].ep)
3535	return -EINVAL;
3536
3537	{
3538	struct usb_endpoint_descriptor **descs;
3539	descs = func->eps[idx].descs;
3540	newValue = descs[descs[0] ? 0 : 1]->bEndpointAddress;
3541	}
3542	break;
3543	}
3544
3545	pr_vdebug("%02x -> %02x\n", *valuep, newValue);
3546	*valuep = newValue;
3547	return 0;
3548	}
3549
3550	static int __ffs_func_bind_do_os_desc(enum ffs_os_desc_type type,
3551	struct usb_os_desc_header h, void data,
3552	unsigned len, void *priv)
3553	{
3554	struct ffs_function *func = priv;
3555	u8 length = 0;
3556
3557	switch (type) {
3558	case FFS_OS_DESC_EXT_COMPAT: {
3559	struct usb_ext_compat_desc *desc = data;
3560	struct usb_os_desc_table *t;
3561
3562	t = &func->function.os_desc_table[desc->bFirstInterfaceNumber];
3563	t->if_id = func->interfaces_nums[desc->bFirstInterfaceNumber];
3564	memcpy(t->os_desc->ext_compat_id, &desc->IDs,
3565	sizeof_field(struct usb_ext_compat_desc, IDs));
3566	length = sizeof(*desc);
3567	}
3568	break;
3569	case FFS_OS_DESC_EXT_PROP: {
3570	struct usb_ext_prop_desc *desc = data;
3571	struct usb_os_desc_table *t;
3572	struct usb_os_desc_ext_prop *ext_prop;
3573	char *ext_prop_name;
3574	char *ext_prop_data;
3575
3576	t = &func->function.os_desc_table[h->interface];
3577	t->if_id = func->interfaces_nums[h->interface];
3578
3579	ext_prop = func->ffs->ms_os_descs_ext_prop_avail;
3580	func->ffs->ms_os_descs_ext_prop_avail += sizeof(*ext_prop);
3581
3582	ext_prop->type = le32_to_cpu(desc->dwPropertyDataType);
3583	ext_prop->name_len = le16_to_cpu(desc->wPropertyNameLength);
3584	ext_prop->data_len = le32_to_cpu((__le32 )
3585	usb_ext_prop_data_len_ptr(data, ext_prop->name_len));
3586	length = ext_prop->name_len + ext_prop->data_len + 14;
3587
3588	ext_prop_name = func->ffs->ms_os_descs_ext_prop_name_avail;
3589	func->ffs->ms_os_descs_ext_prop_name_avail +=
3590	ext_prop->name_len;
3591
3592	ext_prop_data = func->ffs->ms_os_descs_ext_prop_data_avail;
3593	func->ffs->ms_os_descs_ext_prop_data_avail +=
3594	ext_prop->data_len;
3595	memcpy(ext_prop_data,
3596	usb_ext_prop_data_ptr(data, ext_prop->name_len),
3597	ext_prop->data_len);
3598	/* unicode data reported to the host as "WCHAR"s */
3599	switch (ext_prop->type) {
3600	case USB_EXT_PROP_UNICODE:
3601	case USB_EXT_PROP_UNICODE_ENV:
3602	case USB_EXT_PROP_UNICODE_LINK:
3603	case USB_EXT_PROP_UNICODE_MULTI:
3604	ext_prop->data_len *= 2;
3605	break;
3606	}
3607	ext_prop->data = ext_prop_data;
3608
3609	memcpy(ext_prop_name, usb_ext_prop_name_ptr(data),
3610	ext_prop->name_len);
3611	/* property name reported to the host as "WCHAR"s */
3612	ext_prop->name_len *= 2;
3613	ext_prop->name = ext_prop_name;
3614
3615	t->os_desc->ext_prop_len +=
3616	ext_prop->name_len + ext_prop->data_len + 14;
3617	++t->os_desc->ext_prop_count;
3618	list_add_tail(&ext_prop->entry, &t->os_desc->ext_prop);
3619	}
3620	break;
3621	default:
3622	pr_vdebug("unknown descriptor: %d\n", type);
3623	}
3624
3625	return length;
3626	}
3627
3628	static inline struct f_fs_opts ffs_do_functionfs_bind(struct usb_function f,
3629	struct usb_configuration *c)
3630	{
3631	struct ffs_function *func = ffs_func_from_usb(f);
3632	struct f_fs_opts *ffs_opts =
3633	container_of(f->fi, struct f_fs_opts, func_inst);
3634	struct ffs_data *ffs_data;
3635	int ret;
3636
3637	/*
3638	* Legacy gadget triggers binding in functionfs_ready_callback,
3639	* which already uses locking; taking the same lock here would
3640	* cause a deadlock.
3641	*
3642	* Configfs-enabled gadgets however do need ffs_dev_lock.
3643	*/
3644	if (!ffs_opts->no_configfs)
3645	ffs_dev_lock();
3646	ret = ffs_opts->dev->desc_ready ? 0 : -ENODEV;
3647	ffs_data = ffs_opts->dev->ffs_data;
3648	if (!ffs_opts->no_configfs)
3649	ffs_dev_unlock();
3650	if (ret)
3651	return ERR_PTR(ret);
3652
3653	func->ffs = ffs_data;
3654	func->conf = c;
3655	func->gadget = c->cdev->gadget;
3656
3657	/*
3658	* in drivers/usb/gadget/configfs.c:configfs_composite_bind()
3659	* configurations are bound in sequence with list_for_each_entry,
3660	* in each configuration its functions are bound in sequence
3661	* with list_for_each_entry, so we assume no race condition
3662	* with regard to ffs_opts->bound access
3663	*/
3664	if (!ffs_opts->refcnt) {
3665	ret = functionfs_bind(func->ffs, c->cdev);
3666	if (ret)
3667	return ERR_PTR(ret);
3668	}
3669	ffs_opts->refcnt++;
3670	func->function.strings = func->ffs->stringtabs;
3671
3672	return ffs_opts;
3673	}
3674
3675	static int _ffs_func_bind(struct usb_configuration *c,
3676	struct usb_function *f)
3677	{
3678	struct ffs_function *func = ffs_func_from_usb(f);
3679	struct ffs_data *ffs = func->ffs;
3680
3681	const int full = !!func->ffs->fs_descs_count;
3682	const int high = !!func->ffs->hs_descs_count;
3683	const int super = !!func->ffs->ss_descs_count;
3684
3685	int fs_len, hs_len, ss_len, ret, i;
3686	struct ffs_ep *eps_ptr;
3687
3688	/* Make it a single chunk, less management later on */
3689	vla_group(d);
3690	vla_item_with_sz(d, struct ffs_ep, eps, ffs->eps_count);
3691	vla_item_with_sz(d, struct usb_descriptor_header *, fs_descs,
3692	full ? ffs->fs_descs_count + 1 : 0);
3693	vla_item_with_sz(d, struct usb_descriptor_header *, hs_descs,
3694	high ? ffs->hs_descs_count + 1 : 0);
3695	vla_item_with_sz(d, struct usb_descriptor_header *, ss_descs,
3696	super ? ffs->ss_descs_count + 1 : 0);
3697	vla_item_with_sz(d, short, inums, ffs->interfaces_count);
3698	vla_item_with_sz(d, struct usb_os_desc_table, os_desc_table,
3699	c->cdev->use_os_string ? ffs->interfaces_count : 0);
3700	vla_item_with_sz(d, char[16], ext_compat,
3701	c->cdev->use_os_string ? ffs->interfaces_count : 0);
3702	vla_item_with_sz(d, struct usb_os_desc, os_desc,
3703	c->cdev->use_os_string ? ffs->interfaces_count : 0);
3704	vla_item_with_sz(d, struct usb_os_desc_ext_prop, ext_prop,
3705	ffs->ms_os_descs_ext_prop_count);
3706	vla_item_with_sz(d, char, ext_prop_name,
3707	ffs->ms_os_descs_ext_prop_name_len);
3708	vla_item_with_sz(d, char, ext_prop_data,
3709	ffs->ms_os_descs_ext_prop_data_len);
3710	vla_item_with_sz(d, char, raw_descs, ffs->raw_descs_length);
3711	char *vlabuf;
3712
3713	/* Has descriptors only for speeds gadget does not support */
3714	if (!(full \| high \| super))
3715	return -ENOTSUPP;
3716
3717	/* Allocate a single chunk, less management later on */
3718	vlabuf = kzalloc(vla_group_size(d), GFP_KERNEL);
3719	if (!vlabuf)
3720	return -ENOMEM;
3721
3722	ffs->ms_os_descs_ext_prop_avail = vla_ptr(vlabuf, d, ext_prop);
3723	ffs->ms_os_descs_ext_prop_name_avail =
3724	vla_ptr(vlabuf, d, ext_prop_name);
3725	ffs->ms_os_descs_ext_prop_data_avail =
3726	vla_ptr(vlabuf, d, ext_prop_data);
3727
3728	/* Copy descriptors */
3729	memcpy(vla_ptr(vlabuf, d, raw_descs), ffs->raw_descs,
3730	ffs->raw_descs_length);
3731
3732	memset(vla_ptr(vlabuf, d, inums), 0xff, d_inums__sz);
3733	eps_ptr = vla_ptr(vlabuf, d, eps);
3734	for (i = 0; i < ffs->eps_count; i++)
3735	eps_ptr[i].num = -1;
3736
3737	/* Save pointers
3738	* d_eps == vlabuf, func->eps used to kfree vlabuf later
3739	*/
3740	func->eps = vla_ptr(vlabuf, d, eps);
3741	func->interfaces_nums = vla_ptr(vlabuf, d, inums);
3742
3743	/*
3744	* Go through all the endpoint descriptors and allocate
3745	* endpoints first, so that later we can rewrite the endpoint
3746	* numbers without worrying that it may be described later on.
3747	*/
3748	if (full) {
3749	func->function.fs_descriptors = vla_ptr(vlabuf, d, fs_descs);
3750	fs_len = ffs_do_descs(ffs->fs_descs_count,
3751	vla_ptr(vlabuf, d, raw_descs),
3752	d_raw_descs__sz,
3753	__ffs_func_bind_do_descs, func);
3754	if (fs_len < 0) {
3755	ret = fs_len;
3756	goto error;
3757	}
3758	} else {
3759	fs_len = 0;
3760	}
3761
3762	if (high) {
3763	func->function.hs_descriptors = vla_ptr(vlabuf, d, hs_descs);
3764	hs_len = ffs_do_descs(ffs->hs_descs_count,
3765	vla_ptr(vlabuf, d, raw_descs) + fs_len,
3766	d_raw_descs__sz - fs_len,
3767	__ffs_func_bind_do_descs, func);
3768	if (hs_len < 0) {
3769	ret = hs_len;
3770	goto error;
3771	}
3772	} else {
3773	hs_len = 0;
3774	}
3775
3776	if (super) {
3777	func->function.ss_descriptors = func->function.ssp_descriptors =
3778	vla_ptr(vlabuf, d, ss_descs);
3779	ss_len = ffs_do_descs(ffs->ss_descs_count,
3780	vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len,
3781	d_raw_descs__sz - fs_len - hs_len,
3782	__ffs_func_bind_do_descs, func);
3783	if (ss_len < 0) {
3784	ret = ss_len;
3785	goto error;
3786	}
3787	} else {
3788	ss_len = 0;
3789	}
3790
3791	/*
3792	* Now handle interface numbers allocation and interface and
3793	* endpoint numbers rewriting. We can do that in one go
3794	* now.
3795	*/
3796	ret = ffs_do_descs(ffs->fs_descs_count +
3797	(high ? ffs->hs_descs_count : 0) +
3798	(super ? ffs->ss_descs_count : 0),
3799	vla_ptr(vlabuf, d, raw_descs), d_raw_descs__sz,
3800	__ffs_func_bind_do_nums, func);
3801	if (ret < 0)
3802	goto error;
3803
3804	func->function.os_desc_table = vla_ptr(vlabuf, d, os_desc_table);
3805	if (c->cdev->use_os_string) {
3806	for (i = 0; i < ffs->interfaces_count; ++i) {
3807	struct usb_os_desc *desc;
3808
3809	desc = func->function.os_desc_table[i].os_desc =
3810	vla_ptr(vlabuf, d, os_desc) +
3811	i * sizeof(struct usb_os_desc);
3812	desc->ext_compat_id =
3813	vla_ptr(vlabuf, d, ext_compat) + i * 16;
3814	INIT_LIST_HEAD(&desc->ext_prop);
3815	}
3816	ret = ffs_do_os_descs(ffs->ms_os_descs_count,
3817	vla_ptr(vlabuf, d, raw_descs) +
3818	fs_len + hs_len + ss_len,
3819	d_raw_descs__sz - fs_len - hs_len -
3820	ss_len,
3821	__ffs_func_bind_do_os_desc, func);
3822	if (ret < 0)
3823	goto error;
3824	}
3825	func->function.os_desc_n =
3826	c->cdev->use_os_string ? ffs->interfaces_count : 0;
3827
3828	/* And we're done */
3829	ffs_event_add(ffs, FUNCTIONFS_BIND);
3830	return 0;
3831
3832	error:
3833	/* XXX Do we need to release all claimed endpoints here? */
3834	return ret;
3835	}
3836
3837	static int ffs_func_bind(struct usb_configuration *c,
3838	struct usb_function *f)
3839	{
3840	struct f_fs_opts *ffs_opts = ffs_do_functionfs_bind(f, c);
3841	struct ffs_function *func = ffs_func_from_usb(f);
3842	int ret;
3843
3844	if (IS_ERR(ffs_opts))
3845	return PTR_ERR(ffs_opts);
3846
3847	ret = _ffs_func_bind(c, f);
3848	if (ret && !--ffs_opts->refcnt)
3849	functionfs_unbind(func->ffs);
3850
3851	return ret;
3852	}
3853
3854
3855	/* Other USB function hooks *************************************************/
3856
3857	static void ffs_reset_work(struct work_struct *work)
3858	{
3859	struct ffs_data *ffs = container_of(work,
3860	struct ffs_data, reset_work);
3861	ffs_data_reset(ffs);
3862	}
3863
3864	static int ffs_func_get_alt(struct usb_function *f,
3865	unsigned int interface)
3866	{
3867	struct ffs_function *func = ffs_func_from_usb(f);
3868	int intf = ffs_func_revmap_intf(func, interface);
3869
3870	return (intf < 0) ? intf : func->cur_alt[interface];
3871	}
3872
3873	static int ffs_func_set_alt(struct usb_function *f,
3874	unsigned interface, unsigned alt)
3875	{
3876	struct ffs_function *func = ffs_func_from_usb(f);
3877	struct ffs_data *ffs = func->ffs;
3878	unsigned long flags;
3879	int ret = 0, intf;
3880
3881	if (alt > MAX_ALT_SETTINGS)
3882	return -EINVAL;
3883
3884	intf = ffs_func_revmap_intf(func, interface);
3885	if (intf < 0)
3886	return intf;
3887
3888	if (ffs->func)
3889	ffs_func_eps_disable(ffs->func);
3890
3891	spin_lock_irqsave(&ffs->eps_lock, flags);
3892	if (ffs->state == FFS_DEACTIVATED) {
3893	ffs->state = FFS_CLOSING;
3894	spin_unlock_irqrestore(&ffs->eps_lock, flags);
3895	schedule_work(&ffs->reset_work);
3896	return -ENODEV;
3897	}
3898	spin_unlock_irqrestore(&ffs->eps_lock, flags);
3899
3900	if (ffs->state != FFS_ACTIVE)
3901	return -ENODEV;
3902
3903	ffs->func = func;
3904	ret = ffs_func_eps_enable(func);
3905	if (ret >= 0) {
3906	ffs_event_add(ffs, FUNCTIONFS_ENABLE);
3907	func->cur_alt[interface] = alt;
3908	}
3909	return ret;
3910	}
3911
3912	static void ffs_func_disable(struct usb_function *f)
3913	{
3914	struct ffs_function *func = ffs_func_from_usb(f);
3915	struct ffs_data *ffs = func->ffs;
3916	unsigned long flags;
3917
3918	if (ffs->func)
3919	ffs_func_eps_disable(ffs->func);
3920
3921	spin_lock_irqsave(&ffs->eps_lock, flags);
3922	if (ffs->state == FFS_DEACTIVATED) {
3923	ffs->state = FFS_CLOSING;
3924	spin_unlock_irqrestore(&ffs->eps_lock, flags);
3925	schedule_work(&ffs->reset_work);
3926	return;
3927	}
3928	spin_unlock_irqrestore(&ffs->eps_lock, flags);
3929
3930	if (ffs->state == FFS_ACTIVE) {
3931	ffs->func = NULL;
3932	ffs_event_add(ffs, FUNCTIONFS_DISABLE);
3933	}
3934	}
3935
3936	static int ffs_func_setup(struct usb_function *f,
3937	const struct usb_ctrlrequest *creq)
3938	{
3939	struct ffs_function *func = ffs_func_from_usb(f);
3940	struct ffs_data *ffs = func->ffs;
3941	unsigned long flags;
3942	int ret;
3943
3944	pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType);
3945	pr_vdebug("creq->bRequest = %02x\n", creq->bRequest);
3946	pr_vdebug("creq->wValue = %04x\n", le16_to_cpu(creq->wValue));
3947	pr_vdebug("creq->wIndex = %04x\n", le16_to_cpu(creq->wIndex));
3948	pr_vdebug("creq->wLength = %04x\n", le16_to_cpu(creq->wLength));
3949
3950	/*
3951	* Most requests directed to interface go through here
3952	* (notable exceptions are set/get interface) so we need to
3953	* handle them. All other either handled by composite or
3954	* passed to usb_configuration->setup() (if one is set). No
3955	* matter, we will handle requests directed to endpoint here
3956	* as well (as it's straightforward). Other request recipient
3957	* types are only handled when the user flag FUNCTIONFS_ALL_CTRL_RECIP
3958	* is being used.
3959	*/
3960	if (ffs->state != FFS_ACTIVE)
3961	return -ENODEV;
3962
3963	switch (creq->bRequestType & USB_RECIP_MASK) {
3964	case USB_RECIP_INTERFACE:
3965	ret = ffs_func_revmap_intf(func, le16_to_cpu(creq->wIndex));
3966	if (ret < 0)
3967	return ret;
3968	break;
3969
3970	case USB_RECIP_ENDPOINT:
3971	ret = ffs_func_revmap_ep(func, le16_to_cpu(creq->wIndex));
3972	if (ret < 0)
3973	return ret;
3974	if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
3975	ret = func->ffs->eps_addrmap[ret];
3976	break;
3977
3978	default:
3979	if (func->ffs->user_flags & FUNCTIONFS_ALL_CTRL_RECIP)
3980	ret = le16_to_cpu(creq->wIndex);
3981	else
3982	return -EOPNOTSUPP;
3983	}
3984
3985	spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
3986	ffs->ev.setup = *creq;
3987	ffs->ev.setup.wIndex = cpu_to_le16(ret);
3988	__ffs_event_add(ffs, FUNCTIONFS_SETUP);
3989	spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
3990
3991	return ffs->ev.setup.wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0;
3992	}
3993
3994	static bool ffs_func_req_match(struct usb_function *f,
3995	const struct usb_ctrlrequest *creq,
3996	bool config0)
3997	{
3998	struct ffs_function *func = ffs_func_from_usb(f);
3999
4000	if (config0 && !(func->ffs->user_flags & FUNCTIONFS_CONFIG0_SETUP))
4001	return false;
4002
4003	switch (creq->bRequestType & USB_RECIP_MASK) {
4004	case USB_RECIP_INTERFACE:
4005	return (ffs_func_revmap_intf(func,
4006	le16_to_cpu(creq->wIndex)) >= 0);
4007	case USB_RECIP_ENDPOINT:
4008	return (ffs_func_revmap_ep(func,
4009	le16_to_cpu(creq->wIndex)) >= 0);
4010	default:
4011	return (bool) (func->ffs->user_flags &
4012	FUNCTIONFS_ALL_CTRL_RECIP);
4013	}
4014	}
4015
4016	static void ffs_func_suspend(struct usb_function *f)
4017	{
4018	ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_SUSPEND);
4019	}
4020
4021	static void ffs_func_resume(struct usb_function *f)
4022	{
4023	ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_RESUME);
4024	}
4025
4026
4027	/* Endpoint and interface numbers reverse mapping ***************************/
4028
4029	static int ffs_func_revmap_ep(struct ffs_function *func, u8 num)
4030	{
4031	num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK];
4032	return num ? num : -EDOM;
4033	}
4034
4035	static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf)
4036	{
4037	short *nums = func->interfaces_nums;
4038	unsigned count = func->ffs->interfaces_count;
4039
4040	for (; count; --count, ++nums) {
4041	if (nums >= 0 && nums == intf)
4042	return nums - func->interfaces_nums;
4043	}
4044
4045	return -EDOM;
4046	}
4047
4048
4049	/* Devices management *******************************************************/
4050
4051	static LIST_HEAD(ffs_devices);
4052
4053	static struct ffs_dev _ffs_do_find_dev(const char name)
4054	{
4055	struct ffs_dev *dev;
4056
4057	if (!name)
4058	return NULL;
4059
4060	list_for_each_entry(dev, &ffs_devices, entry) {
4061	if (strcmp(dev->name, name) == 0)
4062	return dev;
4063	}
4064
4065	return NULL;
4066	}
4067
4068	/*
4069	* ffs_lock must be taken by the caller of this function
4070	*/
4071	static struct ffs_dev *_ffs_get_single_dev(void)
4072	{
4073	struct ffs_dev *dev;
4074
4075	if (list_is_singular(&ffs_devices)) {
4076	dev = list_first_entry(&ffs_devices, struct ffs_dev, entry);
4077	if (dev->single)
4078	return dev;
4079	}
4080
4081	return NULL;
4082	}
4083
4084	/*
4085	* ffs_lock must be taken by the caller of this function
4086	*/
4087	static struct ffs_dev _ffs_find_dev(const char name)
4088	{
4089	struct ffs_dev *dev;
4090
4091	dev = _ffs_get_single_dev();
4092	if (dev)
4093	return dev;
4094
4095	return _ffs_do_find_dev(name);
4096	}
4097
4098	/* Configfs support *********************************************************/
4099
4100	static inline struct f_fs_opts to_ffs_opts(struct config_item item)
4101	{
4102	return container_of(to_config_group(item), struct f_fs_opts,
4103	func_inst.group);
4104	}
4105
4106	static ssize_t f_fs_opts_ready_show(struct config_item item, char page)
4107	{
4108	struct f_fs_opts *opts = to_ffs_opts(item);
4109	int ready;
4110
4111	ffs_dev_lock();
4112	ready = opts->dev->desc_ready;
4113	ffs_dev_unlock();
4114
4115	return sprintf(page, "%d\n", ready);
4116	}
4117
4118	CONFIGFS_ATTR_RO(f_fs_opts_, ready);
4119
4120	static struct configfs_attribute *ffs_attrs[] = {
4121	&f_fs_opts_attr_ready,
4122	NULL,
4123	};
4124
4125	static void ffs_attr_release(struct config_item *item)
4126	{
4127	struct f_fs_opts *opts = to_ffs_opts(item);
4128
4129	usb_put_function_instance(&opts->func_inst);
4130	}
4131
4132	static const struct configfs_item_operations ffs_item_ops = {
4133	.release = ffs_attr_release,
4134	};
4135
4136	static const struct config_item_type ffs_func_type = {
4137	.ct_item_ops = &ffs_item_ops,
4138	.ct_attrs = ffs_attrs,
4139	.ct_owner = THIS_MODULE,
4140	};
4141
4142
4143	/* Function registration interface ******************************************/
4144
4145	static void ffs_free_inst(struct usb_function_instance *f)
4146	{
4147	struct f_fs_opts *opts;
4148
4149	opts = to_f_fs_opts(f);
4150	ffs_release_dev(opts->dev);
4151	ffs_dev_lock();
4152	_ffs_free_dev(opts->dev);
4153	ffs_dev_unlock();
4154	kfree(opts);
4155	}
4156
4157	static int ffs_set_inst_name(struct usb_function_instance fi, const char name)
4158	{
4159	if (strlen(name) >= sizeof_field(struct ffs_dev, name))
4160	return -ENAMETOOLONG;
4161	return ffs_name_dev(to_f_fs_opts(fi)->dev, name);
4162	}
4163
4164	static struct usb_function_instance *ffs_alloc_inst(void)
4165	{
4166	struct f_fs_opts *opts;
4167	struct ffs_dev *dev;
4168
4169	opts = kzalloc_obj(*opts);
4170	if (!opts)
4171	return ERR_PTR(-ENOMEM);
4172
4173	opts->func_inst.set_inst_name = ffs_set_inst_name;
4174	opts->func_inst.free_func_inst = ffs_free_inst;
4175	ffs_dev_lock();
4176	dev = _ffs_alloc_dev();
4177	ffs_dev_unlock();
4178	if (IS_ERR(dev)) {
4179	kfree(opts);
4180	return ERR_CAST(dev);
4181	}
4182	opts->dev = dev;
4183	dev->opts = opts;
4184
4185	config_group_init_type_name(&opts->func_inst.group, "",
4186	&ffs_func_type);
4187	return &opts->func_inst;
4188	}
4189
4190	static void ffs_free(struct usb_function *f)
4191	{
4192	kfree(ffs_func_from_usb(f));
4193	}
4194
4195	static void ffs_func_unbind(struct usb_configuration *c,
4196	struct usb_function *f)
4197	{
4198	struct ffs_function *func = ffs_func_from_usb(f);
4199	struct ffs_data *ffs = func->ffs;
4200	struct f_fs_opts *opts =
4201	container_of(f->fi, struct f_fs_opts, func_inst);
4202	struct ffs_ep *ep = func->eps;
4203	unsigned count = ffs->eps_count;
4204	unsigned long flags;
4205
4206	if (ffs->func == func) {
4207	ffs_func_eps_disable(func);
4208	ffs->func = NULL;
4209	}
4210
4211	/* Drain any pending AIO completions */
4212	drain_workqueue(ffs->io_completion_wq);
4213
4214	ffs_event_add(ffs, FUNCTIONFS_UNBIND);
4215	if (!--opts->refcnt)
4216	functionfs_unbind(ffs);
4217
4218	/* cleanup after autoconfig */
4219	spin_lock_irqsave(&func->ffs->eps_lock, flags);
4220	while (count--) {
4221	if (ep->ep && ep->req)
4222	usb_ep_free_request(ep->ep, ep->req);
4223	ep->req = NULL;
4224	++ep;
4225	}
4226	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
4227	kfree(func->eps);
4228	func->eps = NULL;
4229	/*
4230	* eps, descriptors and interfaces_nums are allocated in the
4231	* same chunk so only one free is required.
4232	*/
4233	func->function.fs_descriptors = NULL;
4234	func->function.hs_descriptors = NULL;
4235	func->function.ss_descriptors = NULL;
4236	func->function.ssp_descriptors = NULL;
4237	func->interfaces_nums = NULL;
4238
4239	}
4240
4241	static struct usb_function ffs_alloc(struct usb_function_instance fi)
4242	{
4243	struct ffs_function *func;
4244
4245	func = kzalloc_obj(*func);
4246	if (!func)
4247	return ERR_PTR(-ENOMEM);
4248
4249	func->function.name = "Function FS Gadget";
4250
4251	func->function.bind = ffs_func_bind;
4252	func->function.unbind = ffs_func_unbind;
4253	func->function.set_alt = ffs_func_set_alt;
4254	func->function.get_alt = ffs_func_get_alt;
4255	func->function.disable = ffs_func_disable;
4256	func->function.setup = ffs_func_setup;
4257	func->function.req_match = ffs_func_req_match;
4258	func->function.suspend = ffs_func_suspend;
4259	func->function.resume = ffs_func_resume;
4260	func->function.free_func = ffs_free;
4261
4262	return &func->function;
4263	}
4264
4265	/*
4266	* ffs_lock must be taken by the caller of this function
4267	*/
4268	static struct ffs_dev *_ffs_alloc_dev(void)
4269	{
4270	struct ffs_dev *dev;
4271	int ret;
4272
4273	if (_ffs_get_single_dev())
4274	return ERR_PTR(-EBUSY);
4275
4276	dev = kzalloc_obj(*dev);
4277	if (!dev)
4278	return ERR_PTR(-ENOMEM);
4279
4280	if (list_empty(&ffs_devices)) {
4281	ret = functionfs_init();
4282	if (ret) {
4283	kfree(dev);
4284	return ERR_PTR(ret);
4285	}
4286	}
4287
4288	list_add(&dev->entry, &ffs_devices);
4289
4290	return dev;
4291	}
4292
4293	int ffs_name_dev(struct ffs_dev dev, const char name)
4294	{
4295	struct ffs_dev *existing;
4296	int ret = 0;
4297
4298	ffs_dev_lock();
4299
4300	existing = _ffs_do_find_dev(name);
4301	if (!existing)
4302	strscpy(dev->name, name, ARRAY_SIZE(dev->name));
4303	else if (existing != dev)
4304	ret = -EBUSY;
4305
4306	ffs_dev_unlock();
4307
4308	return ret;
4309	}
4310	EXPORT_SYMBOL_GPL(ffs_name_dev);
4311
4312	int ffs_single_dev(struct ffs_dev *dev)
4313	{
4314	int ret;
4315
4316	ret = 0;
4317	ffs_dev_lock();
4318
4319	if (!list_is_singular(&ffs_devices))
4320	ret = -EBUSY;
4321	else
4322	dev->single = true;
4323
4324	ffs_dev_unlock();
4325	return ret;
4326	}
4327	EXPORT_SYMBOL_GPL(ffs_single_dev);
4328
4329	/*
4330	* ffs_lock must be taken by the caller of this function
4331	*/
4332	static void _ffs_free_dev(struct ffs_dev *dev)
4333	{
4334	list_del(&dev->entry);
4335
4336	kfree(dev);
4337	if (list_empty(&ffs_devices))
4338	functionfs_cleanup();
4339	}
4340
4341	static int ffs_acquire_dev(const char dev_name, struct ffs_data ffs_data)
4342	{
4343	int ret = 0;
4344	struct ffs_dev *ffs_dev;
4345
4346	ffs_dev_lock();
4347
4348	ffs_dev = _ffs_find_dev(dev_name);
4349	if (!ffs_dev) {
4350	ret = -ENOENT;
4351	} else if (ffs_dev->mounted) {
4352	ret = -EBUSY;
4353	} else if (ffs_dev->ffs_acquire_dev_callback &&
4354	ffs_dev->ffs_acquire_dev_callback(ffs_dev)) {
4355	ret = -ENOENT;
4356	} else {
4357	ffs_dev->mounted = true;
4358	ffs_dev->ffs_data = ffs_data;
4359	ffs_data->private_data = ffs_dev;
4360	}
4361
4362	ffs_dev_unlock();
4363	return ret;
4364	}
4365
4366	static void ffs_release_dev(struct ffs_dev *ffs_dev)
4367	{
4368	ffs_dev_lock();
4369
4370	if (ffs_dev && ffs_dev->mounted) {
4371	ffs_dev->mounted = false;
4372	if (ffs_dev->ffs_data) {
4373	ffs_dev->ffs_data->private_data = NULL;
4374	ffs_dev->ffs_data = NULL;
4375	}
4376
4377	if (ffs_dev->ffs_release_dev_callback)
4378	ffs_dev->ffs_release_dev_callback(ffs_dev);
4379	}
4380
4381	ffs_dev_unlock();
4382	}
4383
4384	static int ffs_ready(struct ffs_data *ffs)
4385	{
4386	struct ffs_dev *ffs_obj;
4387	int ret = 0;
4388
4389	ffs_dev_lock();
4390
4391	ffs_obj = ffs->private_data;
4392	if (!ffs_obj) {
4393	ret = -EINVAL;
4394	goto done;
4395	}
4396	if (WARN_ON(ffs_obj->desc_ready)) {
4397	ret = -EBUSY;
4398	goto done;
4399	}
4400
4401	ffs_obj->desc_ready = true;
4402
4403	if (ffs_obj->ffs_ready_callback) {
4404	ret = ffs_obj->ffs_ready_callback(ffs);
4405	if (ret)
4406	goto done;
4407	}
4408
4409	set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags);
4410	done:
4411	ffs_dev_unlock();
4412	return ret;
4413	}
4414
4415	static void ffs_closed(struct ffs_data *ffs)
4416	{
4417	struct ffs_dev *ffs_obj;
4418	struct f_fs_opts *opts;
4419	struct config_item *ci;
4420
4421	ffs_dev_lock();
4422
4423	ffs_obj = ffs->private_data;
4424	if (!ffs_obj)
4425	goto done;
4426
4427	ffs_obj->desc_ready = false;
4428
4429	if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
4430	ffs_obj->ffs_closed_callback)
4431	ffs_obj->ffs_closed_callback(ffs);
4432
4433	if (ffs_obj->opts)
4434	opts = ffs_obj->opts;
4435	else
4436	goto done;
4437
4438	if (opts->no_configfs \|\| !opts->func_inst.group.cg_item.ci_parent
4439	\|\| !kref_read(&opts->func_inst.group.cg_item.ci_kref))
4440	goto done;
4441
4442	ci = opts->func_inst.group.cg_item.ci_parent->ci_parent;
4443	ffs_dev_unlock();
4444
4445	if (test_bit(FFS_FL_BOUND, &ffs->flags))
4446	unregister_gadget_item(ci);
4447	return;
4448	done:
4449	ffs_dev_unlock();
4450	}
4451
4452	/* Misc helper functions ****************************************************/
4453
4454	static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
4455	{
4456	return nonblock
4457	? mutex_trylock(mutex) ? 0 : -EAGAIN
4458	: mutex_lock_interruptible(mutex);
4459	}
4460
4461	static char ffs_prepare_buffer(const char __user buf, size_t len)
4462	{
4463	char *data;
4464
4465	if (!len)
4466	return NULL;
4467
4468	data = memdup_user(buf, len);
4469	if (IS_ERR(data))
4470	return data;
4471
4472	pr_vdebug("Buffer from user space:\n");
4473	ffs_dump_mem("", data, len);
4474
4475	return data;
4476	}
4477
4478	DECLARE_USB_FUNCTION_INIT(ffs, ffs_alloc_inst, ffs_alloc);
4479	MODULE_DESCRIPTION("user mode file system API for USB composite function controllers");
4480	MODULE_LICENSE("GPL");
4481	MODULE_AUTHOR("Michal Nazarewicz");