1	// SPDX-License-Identifier: GPL-2.0+
2	/*
3	* f_fs.c -- user mode file system API for USB composite function controllers
4	*
5	* Copyright (C) 2010 Samsung Electronics
6	* Author: Michal Nazarewicz <mina86@mina86.com>
7	*
8	* Based on inode.c (GadgetFS) which was:
9	* Copyright (C) 2003-2004 David Brownell
10	* Copyright (C) 2003 Agilent Technologies
11	*/
12
13
14	/* #define DEBUG */
15	/* #define VERBOSE_DEBUG */
16
17	#include <linux/blkdev.h>
18	#include <linux/dma-buf.h>
19	#include <linux/dma-fence.h>
20	#include <linux/dma-resv.h>
21	#include <linux/pagemap.h>
22	#include <linux/export.h>
23	#include <linux/fs_parser.h>
24	#include <linux/hid.h>
25	#include <linux/mm.h>
26	#include <linux/module.h>
27	#include <linux/scatterlist.h>
28	#include <linux/sched/signal.h>
29	#include <linux/uio.h>
30	#include <linux/vmalloc.h>
31	#include <linux/unaligned.h>
32
33	#include <linux/usb/ccid.h>
34	#include <linux/usb/composite.h>
35	#include <linux/usb/functionfs.h>
36	#include <linux/usb/func_utils.h>
37
38	#include <linux/aio.h>
39	#include <linux/kthread.h>
40	#include <linux/poll.h>
41	#include <linux/eventfd.h>
42
43	#include "u_fs.h"
44	#include "u_os_desc.h"
45	#include "configfs.h"
46
47	#define FUNCTIONFS_MAGIC 0xa647361 /* Chosen by a honest dice roll ;) */
48	#define MAX_ALT_SETTINGS 2 /* Allow up to 2 alt settings to be set. */
49
50	#define DMABUF_ENQUEUE_TIMEOUT_MS 5000
51
52	MODULE_IMPORT_NS("DMA_BUF");
53
54	/* Reference counter handling */
55	static void ffs_data_get(struct ffs_data *ffs);
56	static void ffs_data_put(struct ffs_data *ffs);
57	/* Creates new ffs_data object. */
58	static struct ffs_data *__must_check ffs_data_new(const char *dev_name)
59	__attribute__((malloc));
60
61	/* Opened counter handling. */
62	static void ffs_data_closed(struct ffs_data *ffs);
63
64	/* Called with ffs->mutex held; take over ownership of data. */
65	static int __must_check
66	__ffs_data_got_descs(struct ffs_data *ffs, char *data, size_t len);
67	static int __must_check
68	__ffs_data_got_strings(struct ffs_data *ffs, char *data, size_t len);
69
70
71	/* The function structure ***************************************************/
72
73	struct ffs_ep;
74
75	struct ffs_function {
76	struct usb_configuration *conf;
77	struct usb_gadget *gadget;
78	struct ffs_data *ffs;
79
80	struct ffs_ep *eps;
81	u8 eps_revmap[16];
82	short *interfaces_nums;
83
84	struct usb_function function;
85	int cur_alt[MAX_CONFIG_INTERFACES];
86	};
87
88
89	static struct ffs_function *ffs_func_from_usb(struct usb_function *f)
90	{
91	return container_of(f, struct ffs_function, function);
92	}
93
94
95	static inline enum ffs_setup_state
96	ffs_setup_state_clear_cancelled(struct ffs_data *ffs)
97	{
98	return (enum ffs_setup_state)
99	cmpxchg(&ffs->setup_state, FFS_SETUP_CANCELLED, FFS_NO_SETUP);
100	}
101
102
103	static void ffs_func_eps_disable(struct ffs_function *func);
104	static int __must_check ffs_func_eps_enable(struct ffs_function *func);
105
106	static int ffs_func_bind(struct usb_configuration *,
107	struct usb_function *);
108	static int ffs_func_set_alt(struct usb_function *, unsigned, unsigned);
109	static int ffs_func_get_alt(struct usb_function *f, unsigned int intf);
110	static void ffs_func_disable(struct usb_function *);
111	static int ffs_func_setup(struct usb_function *,
112	const struct usb_ctrlrequest *);
113	static bool ffs_func_req_match(struct usb_function *,
114	const struct usb_ctrlrequest *,
115	bool config0);
116	static void ffs_func_suspend(struct usb_function *);
117	static void ffs_func_resume(struct usb_function *);
118
119
120	static int ffs_func_revmap_ep(struct ffs_function *func, u8 num);
121	static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf);
122
123
124	/* The endpoints structures *************************************************/
125
126	struct ffs_ep {
127	struct usb_ep *ep; /* P: ffs->eps_lock */
128	struct usb_request *req; /* P: epfile->mutex */
129
130	/* [0]: full speed, [1]: high speed, [2]: super speed */
131	struct usb_endpoint_descriptor *descs[3];
132
133	u8 num;
134	};
135
136	struct ffs_dmabuf_priv {
137	struct list_head entry;
138	struct kref ref;
139	struct ffs_data *ffs;
140	struct dma_buf_attachment *attach;
141	struct sg_table *sgt;
142	enum dma_data_direction dir;
143	spinlock_t lock;
144	u64 context;
145	struct usb_request *req; /* P: ffs->eps_lock */
146	struct usb_ep *ep; /* P: ffs->eps_lock */
147	};
148
149	struct ffs_dma_fence {
150	struct dma_fence base;
151	struct ffs_dmabuf_priv *priv;
152	struct work_struct work;
153	};
154
155	struct ffs_epfile {
156	/* Protects ep->ep and ep->req. */
157	struct mutex mutex;
158
159	struct ffs_data *ffs;
160	struct ffs_ep *ep; /* P: ffs->eps_lock */
161
162	/*
163	* Buffer for holding data from partial reads which may happen since
164	* we’re rounding user read requests to a multiple of a max packet size.
165	*
166	* The pointer is initialised with NULL value and may be set by
167	* __ffs_epfile_read_data function to point to a temporary buffer.
168	*
169	* In normal operation, calls to __ffs_epfile_read_buffered will consume
170	* data from said buffer and eventually free it. Importantly, while the
171	* function is using the buffer, it sets the pointer to NULL. This is
172	* all right since __ffs_epfile_read_data and __ffs_epfile_read_buffered
173	* can never run concurrently (they are synchronised by epfile->mutex)
174	* so the latter will not assign a new value to the pointer.
175	*
176	* Meanwhile ffs_func_eps_disable frees the buffer (if the pointer is
177	* valid) and sets the pointer to READ_BUFFER_DROP value. This special
178	* value is crux of the synchronisation between ffs_func_eps_disable and
179	* __ffs_epfile_read_data.
180	*
181	* Once __ffs_epfile_read_data is about to finish it will try to set the
182	* pointer back to its old value (as described above), but seeing as the
183	* pointer is not-NULL (namely READ_BUFFER_DROP) it will instead free
184	* the buffer.
185	*
186	* == State transitions ==
187	*
188	* • ptr == NULL: (initial state)
189	* ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP
190	* ◦ __ffs_epfile_read_buffered: nop
191	* ◦ __ffs_epfile_read_data allocates temp buffer: go to ptr == buf
192	* ◦ reading finishes: n/a, not in ‘and reading’ state
193	* • ptr == DROP:
194	* ◦ __ffs_epfile_read_buffer_free: nop
195	* ◦ __ffs_epfile_read_buffered: go to ptr == NULL
196	* ◦ __ffs_epfile_read_data allocates temp buffer: free buf, nop
197	* ◦ reading finishes: n/a, not in ‘and reading’ state
198	* • ptr == buf:
199	* ◦ __ffs_epfile_read_buffer_free: free buf, go to ptr == DROP
200	* ◦ __ffs_epfile_read_buffered: go to ptr == NULL and reading
201	* ◦ __ffs_epfile_read_data: n/a, __ffs_epfile_read_buffered
202	* is always called first
203	* ◦ reading finishes: n/a, not in ‘and reading’ state
204	* • ptr == NULL and reading:
205	* ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP and reading
206	* ◦ __ffs_epfile_read_buffered: n/a, mutex is held
207	* ◦ __ffs_epfile_read_data: n/a, mutex is held
208	* ◦ reading finishes and …
209	* … all data read: free buf, go to ptr == NULL
210	* … otherwise: go to ptr == buf and reading
211	* • ptr == DROP and reading:
212	* ◦ __ffs_epfile_read_buffer_free: nop
213	* ◦ __ffs_epfile_read_buffered: n/a, mutex is held
214	* ◦ __ffs_epfile_read_data: n/a, mutex is held
215	* ◦ reading finishes: free buf, go to ptr == DROP
216	*/
217	struct ffs_buffer *read_buffer;
218	#define READ_BUFFER_DROP ((struct ffs_buffer *)ERR_PTR(-ESHUTDOWN))
219
220	char name[5];
221
222	unsigned char in; /* P: ffs->eps_lock */
223	unsigned char isoc; /* P: ffs->eps_lock */
224
225	unsigned char _pad;
226
227	/* Protects dmabufs */
228	struct mutex dmabufs_mutex;
229	struct list_head dmabufs; /* P: dmabufs_mutex */
230	atomic_t seqno;
231	};
232
233	struct ffs_buffer {
234	size_t length;
235	char *data;
236	char storage[] __counted_by(length);
237	};
238
239	/* ffs_io_data structure ***************************************************/
240
241	struct ffs_io_data {
242	bool aio;
243	bool read;
244
245	struct kiocb *kiocb;
246	struct iov_iter data;
247	const void *to_free;
248	char *buf;
249
250	struct mm_struct *mm;
251	struct work_struct work;
252
253	struct usb_ep *ep;
254	struct usb_request *req;
255	struct sg_table sgt;
256	bool use_sg;
257
258	struct ffs_data *ffs;
259
260	int status;
261	struct completion done;
262	};
263
264	struct ffs_desc_helper {
265	struct ffs_data *ffs;
266	unsigned interfaces_count;
267	unsigned eps_count;
268	};
269
270	static int __must_check ffs_epfiles_create(struct ffs_data *ffs);
271	static void ffs_epfiles_destroy(struct super_block *sb,
272	struct ffs_epfile *epfiles, unsigned count);
273
274	static int ffs_sb_create_file(struct super_block *sb, const char *name,
275	void *data, const struct file_operations *fops);
276
277	/* Devices management *******************************************************/
278
279	DEFINE_MUTEX(ffs_lock);
280	EXPORT_SYMBOL_GPL(ffs_lock);
281
282	static struct ffs_dev *_ffs_find_dev(const char *name);
283	static struct ffs_dev *_ffs_alloc_dev(void);
284	static void _ffs_free_dev(struct ffs_dev *dev);
285	static int ffs_acquire_dev(const char *dev_name, struct ffs_data *ffs_data);
286	static void ffs_release_dev(struct ffs_dev *ffs_dev);
287	static int ffs_ready(struct ffs_data *ffs);
288	static void ffs_closed(struct ffs_data *ffs);
289
290	/* Misc helper functions ****************************************************/
291
292	static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
293	__attribute__((warn_unused_result, nonnull));
294	static char *ffs_prepare_buffer(const char __user *buf, size_t len)
295	__attribute__((warn_unused_result, nonnull));
296
297
298	/* Control file aka ep0 *****************************************************/
299
300	static void ffs_ep0_complete(struct usb_ep *ep, struct usb_request *req)
301	{
302	struct ffs_data *ffs = req->context;
303
304	complete(&ffs->ep0req_completion);
305	}
306
307	static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
308	__releases(&ffs->ev.waitq.lock)
309	{
310	struct usb_request *req = ffs->ep0req;
311	int ret;
312
313	if (!req) {
314	spin_unlock_irq(lock: &ffs->ev.waitq.lock);
315	return -EINVAL;
316	}
317
318	req->zero = len < le16_to_cpu(ffs->ev.setup.wLength);
319
320	spin_unlock_irq(lock: &ffs->ev.waitq.lock);
321
322	req->buf = data;
323	req->length = len;
324
325	/*
326	* UDC layer requires to provide a buffer even for ZLP, but should
327	* not use it at all. Let's provide some poisoned pointer to catch
328	* possible bug in the driver.
329	*/
330	if (req->buf == NULL)
331	req->buf = (void *)0xDEADBABE;
332
333	reinit_completion(x: &ffs->ep0req_completion);
334
335	ret = usb_ep_queue(ep: ffs->gadget->ep0, req, GFP_ATOMIC);
336	if (ret < 0)
337	return ret;
338
339	ret = wait_for_completion_interruptible(x: &ffs->ep0req_completion);
340	if (ret) {
341	usb_ep_dequeue(ep: ffs->gadget->ep0, req);
342	return -EINTR;
343	}
344
345	ffs->setup_state = FFS_NO_SETUP;
346	return req->status ? req->status : req->actual;
347	}
348
349	static int __ffs_ep0_stall(struct ffs_data *ffs)
350	{
351	if (ffs->ev.can_stall) {
352	pr_vdebug("ep0 stall\n");
353	usb_ep_set_halt(ep: ffs->gadget->ep0);
354	ffs->setup_state = FFS_NO_SETUP;
355	return -EL2HLT;
356	} else {
357	pr_debug("bogus ep0 stall!\n");
358	return -ESRCH;
359	}
360	}
361
362	static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
363	size_t len, loff_t *ptr)
364	{
365	struct ffs_data *ffs = file->private_data;
366	ssize_t ret;
367	char *data;
368
369	/* Fast check if setup was canceled */
370	if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
371	return -EIDRM;
372
373	/* Acquire mutex */
374	ret = ffs_mutex_lock(mutex: &ffs->mutex, nonblock: file->f_flags & O_NONBLOCK);
375	if (ret < 0)
376	return ret;
377
378	/* Check state */
379	switch (ffs->state) {
380	case FFS_READ_DESCRIPTORS:
381	case FFS_READ_STRINGS:
382	/* Copy data */
383	if (len < 16) {
384	ret = -EINVAL;
385	break;
386	}
387
388	data = ffs_prepare_buffer(buf, len);
389	if (IS_ERR(ptr: data)) {
390	ret = PTR_ERR(ptr: data);
391	break;
392	}
393
394	/* Handle data */
395	if (ffs->state == FFS_READ_DESCRIPTORS) {
396	pr_info("read descriptors\n");
397	ret = __ffs_data_got_descs(ffs, data, len);
398	if (ret < 0)
399	break;
400
401	ffs->state = FFS_READ_STRINGS;
402	ret = len;
403	} else {
404	pr_info("read strings\n");
405	ret = __ffs_data_got_strings(ffs, data, len);
406	if (ret < 0)
407	break;
408
409	ret = ffs_epfiles_create(ffs);
410	if (ret) {
411	ffs->state = FFS_CLOSING;
412	break;
413	}
414
415	ffs->state = FFS_ACTIVE;
416	mutex_unlock(lock: &ffs->mutex);
417
418	ret = ffs_ready(ffs);
419	if (ret < 0) {
420	ffs->state = FFS_CLOSING;
421	return ret;
422	}
423
424	return len;
425	}
426	break;
427
428	case FFS_ACTIVE:
429	data = NULL;
430	/*
431	* We're called from user space, we can use _irq
432	* rather then _irqsave
433	*/
434	spin_lock_irq(lock: &ffs->ev.waitq.lock);
435	switch (ffs_setup_state_clear_cancelled(ffs)) {
436	case FFS_SETUP_CANCELLED:
437	ret = -EIDRM;
438	goto done_spin;
439
440	case FFS_NO_SETUP:
441	ret = -ESRCH;
442	goto done_spin;
443
444	case FFS_SETUP_PENDING:
445	break;
446	}
447
448	/* FFS_SETUP_PENDING */
449	if (!(ffs->ev.setup.bRequestType & USB_DIR_IN)) {
450	spin_unlock_irq(lock: &ffs->ev.waitq.lock);
451	ret = __ffs_ep0_stall(ffs);
452	break;
453	}
454
455	/* FFS_SETUP_PENDING and not stall */
456	len = min_t(size_t, len, le16_to_cpu(ffs->ev.setup.wLength));
457
458	spin_unlock_irq(lock: &ffs->ev.waitq.lock);
459
460	data = ffs_prepare_buffer(buf, len);
461	if (IS_ERR(ptr: data)) {
462	ret = PTR_ERR(ptr: data);
463	break;
464	}
465
466	spin_lock_irq(lock: &ffs->ev.waitq.lock);
467
468	/*
469	* We are guaranteed to be still in FFS_ACTIVE state
470	* but the state of setup could have changed from
471	* FFS_SETUP_PENDING to FFS_SETUP_CANCELLED so we need
472	* to check for that. If that happened we copied data
473	* from user space in vain but it's unlikely.
474	*
475	* For sure we are not in FFS_NO_SETUP since this is
476	* the only place FFS_SETUP_PENDING -> FFS_NO_SETUP
477	* transition can be performed and it's protected by
478	* mutex.
479	*/
480	if (ffs_setup_state_clear_cancelled(ffs) ==
481	FFS_SETUP_CANCELLED) {
482	ret = -EIDRM;
483	done_spin:
484	spin_unlock_irq(lock: &ffs->ev.waitq.lock);
485	} else {
486	/* unlocks spinlock */
487	ret = __ffs_ep0_queue_wait(ffs, data, len);
488	}
489	kfree(objp: data);
490	break;
491
492	default:
493	ret = -EBADFD;
494	break;
495	}
496
497	mutex_unlock(lock: &ffs->mutex);
498	return ret;
499	}
500
501	/* Called with ffs->ev.waitq.lock and ffs->mutex held, both released on exit. */
502	static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
503	size_t n)
504	__releases(&ffs->ev.waitq.lock)
505	{
506	/*
507	* n cannot be bigger than ffs->ev.count, which cannot be bigger than
508	* size of ffs->ev.types array (which is four) so that's how much space
509	* we reserve.
510	*/
511	struct usb_functionfs_event events[ARRAY_SIZE(ffs->ev.types)];
512	const size_t size = n * sizeof *events;
513	unsigned i = 0;
514
515	memset(events, 0, size);
516
517	do {
518	events[i].type = ffs->ev.types[i];
519	if (events[i].type == FUNCTIONFS_SETUP) {
520	events[i].u.setup = ffs->ev.setup;
521	ffs->setup_state = FFS_SETUP_PENDING;
522	}
523	} while (++i < n);
524
525	ffs->ev.count -= n;
526	if (ffs->ev.count)
527	memmove(ffs->ev.types, ffs->ev.types + n,
528	ffs->ev.count * sizeof *ffs->ev.types);
529
530	spin_unlock_irq(lock: &ffs->ev.waitq.lock);
531	mutex_unlock(lock: &ffs->mutex);
532
533	return copy_to_user(to: buf, from: events, n: size) ? -EFAULT : size;
534	}
535
536	static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
537	size_t len, loff_t *ptr)
538	{
539	struct ffs_data *ffs = file->private_data;
540	char *data = NULL;
541	size_t n;
542	int ret;
543
544	/* Fast check if setup was canceled */
545	if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
546	return -EIDRM;
547
548	/* Acquire mutex */
549	ret = ffs_mutex_lock(mutex: &ffs->mutex, nonblock: file->f_flags & O_NONBLOCK);
550	if (ret < 0)
551	return ret;
552
553	/* Check state */
554	if (ffs->state != FFS_ACTIVE) {
555	ret = -EBADFD;
556	goto done_mutex;
557	}
558
559	/*
560	* We're called from user space, we can use _irq rather then
561	* _irqsave
562	*/
563	spin_lock_irq(lock: &ffs->ev.waitq.lock);
564
565	switch (ffs_setup_state_clear_cancelled(ffs)) {
566	case FFS_SETUP_CANCELLED:
567	ret = -EIDRM;
568	break;
569
570	case FFS_NO_SETUP:
571	n = len / sizeof(struct usb_functionfs_event);
572	if (!n) {
573	ret = -EINVAL;
574	break;
575	}
576
577	if ((file->f_flags & O_NONBLOCK) && !ffs->ev.count) {
578	ret = -EAGAIN;
579	break;
580	}
581
582	if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq,
583	ffs->ev.count)) {
584	ret = -EINTR;
585	break;
586	}
587
588	/* unlocks spinlock */
589	return __ffs_ep0_read_events(ffs, buf,
590	min_t(size_t, n, ffs->ev.count));
591
592	case FFS_SETUP_PENDING:
593	if (ffs->ev.setup.bRequestType & USB_DIR_IN) {
594	spin_unlock_irq(lock: &ffs->ev.waitq.lock);
595	ret = __ffs_ep0_stall(ffs);
596	goto done_mutex;
597	}
598
599	len = min_t(size_t, len, le16_to_cpu(ffs->ev.setup.wLength));
600
601	spin_unlock_irq(lock: &ffs->ev.waitq.lock);
602
603	if (len) {
604	data = kmalloc(len, GFP_KERNEL);
605	if (!data) {
606	ret = -ENOMEM;
607	goto done_mutex;
608	}
609	}
610
611	spin_lock_irq(lock: &ffs->ev.waitq.lock);
612
613	/* See ffs_ep0_write() */
614	if (ffs_setup_state_clear_cancelled(ffs) ==
615	FFS_SETUP_CANCELLED) {
616	ret = -EIDRM;
617	break;
618	}
619
620	/* unlocks spinlock */
621	ret = __ffs_ep0_queue_wait(ffs, data, len);
622	if ((ret > 0) && (copy_to_user(to: buf, from: data, n: len)))
623	ret = -EFAULT;
624	goto done_mutex;
625
626	default:
627	ret = -EBADFD;
628	break;
629	}
630
631	spin_unlock_irq(lock: &ffs->ev.waitq.lock);
632	done_mutex:
633	mutex_unlock(lock: &ffs->mutex);
634	kfree(objp: data);
635	return ret;
636	}
637
638
639	static void ffs_data_reset(struct ffs_data *ffs);
640
641	static int ffs_ep0_open(struct inode *inode, struct file *file)
642	{
643	struct ffs_data *ffs = inode->i_sb->s_fs_info;
644
645	spin_lock_irq(lock: &ffs->eps_lock);
646	if (ffs->state == FFS_CLOSING) {
647	spin_unlock_irq(lock: &ffs->eps_lock);
648	return -EBUSY;
649	}
650	if (!ffs->opened++ && ffs->state == FFS_DEACTIVATED) {
651	ffs->state = FFS_CLOSING;
652	spin_unlock_irq(lock: &ffs->eps_lock);
653	ffs_data_reset(ffs);
654	} else {
655	spin_unlock_irq(lock: &ffs->eps_lock);
656	}
657	file->private_data = ffs;
658
659	return stream_open(inode, filp: file);
660	}
661
662	static int ffs_ep0_release(struct inode *inode, struct file *file)
663	{
664	struct ffs_data *ffs = file->private_data;
665
666	ffs_data_closed(ffs);
667
668	return 0;
669	}
670
671	static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
672	{
673	struct ffs_data *ffs = file->private_data;
674	struct usb_gadget *gadget = ffs->gadget;
675	long ret;
676
677	if (code == FUNCTIONFS_INTERFACE_REVMAP) {
678	struct ffs_function *func = ffs->func;
679	ret = func ? ffs_func_revmap_intf(func, intf: value) : -ENODEV;
680	} else if (gadget && gadget->ops->ioctl) {
681	ret = gadget->ops->ioctl(gadget, code, value);
682	} else {
683	ret = -ENOTTY;
684	}
685
686	return ret;
687	}
688
689	static __poll_t ffs_ep0_poll(struct file *file, poll_table *wait)
690	{
691	struct ffs_data *ffs = file->private_data;
692	__poll_t mask = EPOLLWRNORM;
693	int ret;
694
695	poll_wait(filp: file, wait_address: &ffs->ev.waitq, p: wait);
696
697	ret = ffs_mutex_lock(mutex: &ffs->mutex, nonblock: file->f_flags & O_NONBLOCK);
698	if (ret < 0)
699	return mask;
700
701	switch (ffs->state) {
702	case FFS_READ_DESCRIPTORS:
703	case FFS_READ_STRINGS:
704	mask |= EPOLLOUT;
705	break;
706
707	case FFS_ACTIVE:
708	switch (ffs->setup_state) {
709	case FFS_NO_SETUP:
710	if (ffs->ev.count)
711	mask |= EPOLLIN;
712	break;
713
714	case FFS_SETUP_PENDING:
715	case FFS_SETUP_CANCELLED:
716	mask |= (EPOLLIN | EPOLLOUT);
717	break;
718	}
719	break;
720
721	case FFS_CLOSING:
722	break;
723	case FFS_DEACTIVATED:
724	break;
725	}
726
727	mutex_unlock(lock: &ffs->mutex);
728
729	return mask;
730	}
731
732	static const struct file_operations ffs_ep0_operations = {
733
734	.open = ffs_ep0_open,
735	.write = ffs_ep0_write,
736	.read = ffs_ep0_read,
737	.release = ffs_ep0_release,
738	.unlocked_ioctl = ffs_ep0_ioctl,
739	.poll = ffs_ep0_poll,
740	};
741
742
743	/* "Normal" endpoints operations ********************************************/
744
745	static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req)
746	{
747	struct ffs_io_data *io_data = req->context;
748
749	if (req->status)
750	io_data->status = req->status;
751	else
752	io_data->status = req->actual;
753
754	complete(&io_data->done);
755	}
756
757	static ssize_t ffs_copy_to_iter(void *data, int data_len, struct iov_iter *iter)
758	{
759	ssize_t ret = copy_to_iter(addr: data, bytes: data_len, i: iter);
760	if (ret == data_len)
761	return ret;
762
763	if (iov_iter_count(i: iter))
764	return -EFAULT;
765
766	/*
767	* Dear user space developer!
768	*
769	* TL;DR: To stop getting below error message in your kernel log, change
770	* user space code using functionfs to align read buffers to a max
771	* packet size.
772	*
773	* Some UDCs (e.g. dwc3) require request sizes to be a multiple of a max
774	* packet size. When unaligned buffer is passed to functionfs, it
775	* internally uses a larger, aligned buffer so that such UDCs are happy.
776	*
777	* Unfortunately, this means that host may send more data than was
778	* requested in read(2) system call. f_fs doesn’t know what to do with
779	* that excess data so it simply drops it.
780	*
781	* Was the buffer aligned in the first place, no such problem would
782	* happen.
783	*
784	* Data may be dropped only in AIO reads. Synchronous reads are handled
785	* by splitting a request into multiple parts. This splitting may still
786	* be a problem though so it’s likely best to align the buffer
787	* regardless of it being AIO or not..
788	*
789	* This only affects OUT endpoints, i.e. reading data with a read(2),
790	* aio_read(2) etc. system calls. Writing data to an IN endpoint is not
791	* affected.
792	*/
793	pr_err("functionfs read size %d > requested size %zd, dropping excess data. "
794	"Align read buffer size to max packet size to avoid the problem.\n",
795	data_len, ret);
796
797	return ret;
798	}
799
800	/*
801	* allocate a virtually contiguous buffer and create a scatterlist describing it
802	* @sg_table - pointer to a place to be filled with sg_table contents
803	* @size - required buffer size
804	*/
805	static void *ffs_build_sg_list(struct sg_table *sgt, size_t sz)
806	{
807	struct page **pages;
808	void *vaddr, *ptr;
809	unsigned int n_pages;
810	int i;
811
812	vaddr = vmalloc(sz);
813	if (!vaddr)
814	return NULL;
815
816	n_pages = PAGE_ALIGN(sz) >> PAGE_SHIFT;
817	pages = kvmalloc_array(n_pages, sizeof(struct page *), GFP_KERNEL);
818	if (!pages) {
819	vfree(addr: vaddr);
820
821	return NULL;
822	}
823	for (i = 0, ptr = vaddr; i < n_pages; ++i, ptr += PAGE_SIZE)
824	pages[i] = vmalloc_to_page(addr: ptr);
825
826	if (sg_alloc_table_from_pages(sgt, pages, n_pages, offset: 0, size: sz, GFP_KERNEL)) {
827	kvfree(addr: pages);
828	vfree(addr: vaddr);
829
830	return NULL;
831	}
832	kvfree(addr: pages);
833
834	return vaddr;
835	}
836
837	static inline void *ffs_alloc_buffer(struct ffs_io_data *io_data,
838	size_t data_len)
839	{
840	if (io_data->use_sg)
841	return ffs_build_sg_list(sgt: &io_data->sgt, sz: data_len);
842
843	return kmalloc(data_len, GFP_KERNEL);
844	}
845
846	static inline void ffs_free_buffer(struct ffs_io_data *io_data)
847	{
848	if (!io_data->buf)
849	return;
850
851	if (io_data->use_sg) {
852	sg_free_table(&io_data->sgt);
853	vfree(addr: io_data->buf);
854	} else {
855	kfree(objp: io_data->buf);
856	}
857	}
858
859	static void ffs_user_copy_worker(struct work_struct *work)
860	{
861	struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
862	work);
863	int ret = io_data->status;
864	bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD;
865
866	if (io_data->read && ret > 0) {
867	kthread_use_mm(mm: io_data->mm);
868	ret = ffs_copy_to_iter(data: io_data->buf, data_len: ret, iter: &io_data->data);
869	kthread_unuse_mm(mm: io_data->mm);
870	}
871
872	io_data->kiocb->ki_complete(io_data->kiocb, ret);
873
874	if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd)
875	eventfd_signal(ctx: io_data->ffs->ffs_eventfd);
876
877	usb_ep_free_request(ep: io_data->ep, req: io_data->req);
878
879	if (io_data->read)
880	kfree(objp: io_data->to_free);
881	ffs_free_buffer(io_data);
882	kfree(objp: io_data);
883	}
884
885	static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
886	struct usb_request *req)
887	{
888	struct ffs_io_data *io_data = req->context;
889	struct ffs_data *ffs = io_data->ffs;
890
891	io_data->status = req->status ? req->status : req->actual;
892
893	INIT_WORK(&io_data->work, ffs_user_copy_worker);
894	queue_work(wq: ffs->io_completion_wq, work: &io_data->work);
895	}
896
897	static void __ffs_epfile_read_buffer_free(struct ffs_epfile *epfile)
898	{
899	/*
900	* See comment in struct ffs_epfile for full read_buffer pointer
901	* synchronisation story.
902	*/
903	struct ffs_buffer *buf = xchg(&epfile->read_buffer, READ_BUFFER_DROP);
904	if (buf && buf != READ_BUFFER_DROP)
905	kfree(objp: buf);
906	}
907
908	/* Assumes epfile->mutex is held. */
909	static ssize_t __ffs_epfile_read_buffered(struct ffs_epfile *epfile,
910	struct iov_iter *iter)
911	{
912	/*
913	* Null out epfile->read_buffer so ffs_func_eps_disable does not free
914	* the buffer while we are using it. See comment in struct ffs_epfile
915	* for full read_buffer pointer synchronisation story.
916	*/
917	struct ffs_buffer *buf = xchg(&epfile->read_buffer, NULL);
918	ssize_t ret;
919	if (!buf || buf == READ_BUFFER_DROP)
920	return 0;
921
922	ret = copy_to_iter(addr: buf->data, bytes: buf->length, i: iter);
923	if (buf->length == ret) {
924	kfree(objp: buf);
925	return ret;
926	}
927
928	if (iov_iter_count(i: iter)) {
929	ret = -EFAULT;
930	} else {
931	buf->length -= ret;
932	buf->data += ret;
933	}
934
935	if (cmpxchg(&epfile->read_buffer, NULL, buf))
936	kfree(objp: buf);
937
938	return ret;
939	}
940
941	/* Assumes epfile->mutex is held. */
942	static ssize_t __ffs_epfile_read_data(struct ffs_epfile *epfile,
943	void *data, int data_len,
944	struct iov_iter *iter)
945	{
946	struct ffs_buffer *buf;
947
948	ssize_t ret = copy_to_iter(addr: data, bytes: data_len, i: iter);
949	if (data_len == ret)
950	return ret;
951
952	if (iov_iter_count(i: iter))
953	return -EFAULT;
954
955	/* See ffs_copy_to_iter for more context. */
956	pr_warn("functionfs read size %d > requested size %zd, splitting request into multiple reads.",
957	data_len, ret);
958
959	data_len -= ret;
960	buf = kmalloc(struct_size(buf, storage, data_len), GFP_KERNEL);
961	if (!buf)
962	return -ENOMEM;
963	buf->length = data_len;
964	buf->data = buf->storage;
965	memcpy(buf->storage, data + ret, flex_array_size(buf, storage, data_len));
966
967	/*
968	* At this point read_buffer is NULL or READ_BUFFER_DROP (if
969	* ffs_func_eps_disable has been called in the meanwhile). See comment
970	* in struct ffs_epfile for full read_buffer pointer synchronisation
971	* story.
972	*/
973	if (cmpxchg(&epfile->read_buffer, NULL, buf))
974	kfree(objp: buf);
975
976	return ret;
977	}
978
979	static struct ffs_ep *ffs_epfile_wait_ep(struct file *file)
980	{
981	struct ffs_epfile *epfile = file->private_data;
982	struct ffs_ep *ep;
983	int ret;
984
985	/* Wait for endpoint to be enabled */
986	ep = epfile->ep;
987	if (!ep) {
988	if (file->f_flags & O_NONBLOCK)
989	return ERR_PTR(error: -EAGAIN);
990
991	ret = wait_event_interruptible(
992	epfile->ffs->wait, (ep = epfile->ep));
993	if (ret)
994	return ERR_PTR(error: -EINTR);
995	}
996
997	return ep;
998	}
999
1000	static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
1001	{
1002	struct ffs_epfile *epfile = file->private_data;
1003	struct usb_request *req;
1004	struct ffs_ep *ep;
1005	char *data = NULL;
1006	ssize_t ret, data_len = -EINVAL;
1007	int halt;
1008
1009	/* Are we still active? */
1010	if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
1011	return -ENODEV;
1012
1013	ep = ffs_epfile_wait_ep(file);
1014	if (IS_ERR(ptr: ep))
1015	return PTR_ERR(ptr: ep);
1016
1017	/* Do we halt? */
1018	halt = (!io_data->read == !epfile->in);
1019	if (halt && epfile->isoc)
1020	return -EINVAL;
1021
1022	/* We will be using request and read_buffer */
1023	ret = ffs_mutex_lock(mutex: &epfile->mutex, nonblock: file->f_flags & O_NONBLOCK);
1024	if (ret)
1025	goto error;
1026
1027	/* Allocate & copy */
1028	if (!halt) {
1029	struct usb_gadget *gadget;
1030
1031	/*
1032	* Do we have buffered data from previous partial read? Check
1033	* that for synchronous case only because we do not have
1034	* facility to ‘wake up’ a pending asynchronous read and push
1035	* buffered data to it which we would need to make things behave
1036	* consistently.
1037	*/
1038	if (!io_data->aio && io_data->read) {
1039	ret = __ffs_epfile_read_buffered(epfile, iter: &io_data->data);
1040	if (ret)
1041	goto error_mutex;
1042	}
1043
1044	/*
1045	* if we _do_ wait above, the epfile->ffs->gadget might be NULL
1046	* before the waiting completes, so do not assign to 'gadget'
1047	* earlier
1048	*/
1049	gadget = epfile->ffs->gadget;
1050
1051	spin_lock_irq(lock: &epfile->ffs->eps_lock);
1052	/* In the meantime, endpoint got disabled or changed. */
1053	if (epfile->ep != ep) {
1054	ret = -ESHUTDOWN;
1055	goto error_lock;
1056	}
1057	data_len = iov_iter_count(i: &io_data->data);
1058	/*
1059	* Controller may require buffer size to be aligned to
1060	* maxpacketsize of an out endpoint.
1061	*/
1062	if (io_data->read)
1063	data_len = usb_ep_align_maybe(g: gadget, ep: ep->ep, len: data_len);
1064
1065	io_data->use_sg = gadget->sg_supported && data_len > PAGE_SIZE;
1066	spin_unlock_irq(lock: &epfile->ffs->eps_lock);
1067
1068	data = ffs_alloc_buffer(io_data, data_len);
1069	if (!data) {
1070	ret = -ENOMEM;
1071	goto error_mutex;
1072	}
1073	if (!io_data->read &&
1074	!copy_from_iter_full(addr: data, bytes: data_len, i: &io_data->data)) {
1075	ret = -EFAULT;
1076	goto error_mutex;
1077	}
1078	}
1079
1080	spin_lock_irq(lock: &epfile->ffs->eps_lock);
1081
1082	if (epfile->ep != ep) {
1083	/* In the meantime, endpoint got disabled or changed. */
1084	ret = -ESHUTDOWN;
1085	} else if (halt) {
1086	ret = usb_ep_set_halt(ep: ep->ep);
1087	if (!ret)
1088	ret = -EBADMSG;
1089	} else if (data_len == -EINVAL) {
1090	/*
1091	* Sanity Check: even though data_len can't be used
1092	* uninitialized at the time I write this comment, some
1093	* compilers complain about this situation.
1094	* In order to keep the code clean from warnings, data_len is
1095	* being initialized to -EINVAL during its declaration, which
1096	* means we can't rely on compiler anymore to warn no future
1097	* changes won't result in data_len being used uninitialized.
1098	* For such reason, we're adding this redundant sanity check
1099	* here.
1100	*/
1101	WARN(1, "%s: data_len == -EINVAL\n", __func__);
1102	ret = -EINVAL;
1103	} else if (!io_data->aio) {
1104	bool interrupted = false;
1105
1106	req = ep->req;
1107	if (io_data->use_sg) {
1108	req->buf = NULL;
1109	req->sg = io_data->sgt.sgl;
1110	req->num_sgs = io_data->sgt.nents;
1111	} else {
1112	req->buf = data;
1113	req->num_sgs = 0;
1114	}
1115	req->length = data_len;
1116
1117	io_data->buf = data;
1118
1119	init_completion(x: &io_data->done);
1120	req->context = io_data;
1121	req->complete = ffs_epfile_io_complete;
1122
1123	ret = usb_ep_queue(ep: ep->ep, req, GFP_ATOMIC);
1124	if (ret < 0)
1125	goto error_lock;
1126
1127	spin_unlock_irq(lock: &epfile->ffs->eps_lock);
1128
1129	if (wait_for_completion_interruptible(x: &io_data->done)) {
1130	spin_lock_irq(lock: &epfile->ffs->eps_lock);
1131	if (epfile->ep != ep) {
1132	ret = -ESHUTDOWN;
1133	goto error_lock;
1134	}
1135	/*
1136	* To avoid race condition with ffs_epfile_io_complete,
1137	* dequeue the request first then check
1138	* status. usb_ep_dequeue API should guarantee no race
1139	* condition with req->complete callback.
1140	*/
1141	usb_ep_dequeue(ep: ep->ep, req);
1142	spin_unlock_irq(lock: &epfile->ffs->eps_lock);
1143	wait_for_completion(&io_data->done);
1144	interrupted = io_data->status < 0;
1145	}
1146
1147	if (interrupted)
1148	ret = -EINTR;
1149	else if (io_data->read && io_data->status > 0)
1150	ret = __ffs_epfile_read_data(epfile, data, data_len: io_data->status,
1151	iter: &io_data->data);
1152	else
1153	ret = io_data->status;
1154	goto error_mutex;
1155	} else if (!(req = usb_ep_alloc_request(ep: ep->ep, GFP_ATOMIC))) {
1156	ret = -ENOMEM;
1157	} else {
1158	if (io_data->use_sg) {
1159	req->buf = NULL;
1160	req->sg = io_data->sgt.sgl;
1161	req->num_sgs = io_data->sgt.nents;
1162	} else {
1163	req->buf = data;
1164	req->num_sgs = 0;
1165	}
1166	req->length = data_len;
1167
1168	io_data->buf = data;
1169	io_data->ep = ep->ep;
1170	io_data->req = req;
1171	io_data->ffs = epfile->ffs;
1172
1173	req->context = io_data;
1174	req->complete = ffs_epfile_async_io_complete;
1175
1176	ret = usb_ep_queue(ep: ep->ep, req, GFP_ATOMIC);
1177	if (ret) {
1178	io_data->req = NULL;
1179	usb_ep_free_request(ep: ep->ep, req);
1180	goto error_lock;
1181	}
1182
1183	ret = -EIOCBQUEUED;
1184	/*
1185	* Do not kfree the buffer in this function. It will be freed
1186	* by ffs_user_copy_worker.
1187	*/
1188	data = NULL;
1189	}
1190
1191	error_lock:
1192	spin_unlock_irq(lock: &epfile->ffs->eps_lock);
1193	error_mutex:
1194	mutex_unlock(lock: &epfile->mutex);
1195	error:
1196	if (ret != -EIOCBQUEUED) /* don't free if there is iocb queued */
1197	ffs_free_buffer(io_data);
1198	return ret;
1199	}
1200
1201	static int
1202	ffs_epfile_open(struct inode *inode, struct file *file)
1203	{
1204	struct ffs_data *ffs = inode->i_sb->s_fs_info;
1205	struct ffs_epfile *epfile;
1206
1207	spin_lock_irq(lock: &ffs->eps_lock);
1208	if (!ffs->opened) {
1209	spin_unlock_irq(lock: &ffs->eps_lock);
1210	return -ENODEV;
1211	}
1212	/*
1213	* we want the state to be FFS_ACTIVE; FFS_ACTIVE alone is
1214	* not enough, though - we might have been through FFS_CLOSING
1215	* and back to FFS_ACTIVE, with our file already removed.
1216	*/
1217	epfile = smp_load_acquire(&inode->i_private);
1218	if (unlikely(ffs->state != FFS_ACTIVE || !epfile)) {
1219	spin_unlock_irq(lock: &ffs->eps_lock);
1220	return -ENODEV;
1221	}
1222	ffs->opened++;
1223	spin_unlock_irq(lock: &ffs->eps_lock);
1224
1225	file->private_data = epfile;
1226	return stream_open(inode, filp: file);
1227	}
1228
1229	static int ffs_aio_cancel(struct kiocb *kiocb)
1230	{
1231	struct ffs_io_data *io_data = kiocb->private;
1232	int value;
1233
1234	if (io_data && io_data->ep && io_data->req)
1235	value = usb_ep_dequeue(ep: io_data->ep, req: io_data->req);
1236	else
1237	value = -EINVAL;
1238
1239	return value;
1240	}
1241
1242	static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
1243	{
1244	struct ffs_io_data io_data, *p = &io_data;
1245	ssize_t res;
1246
1247	if (!is_sync_kiocb(kiocb)) {
1248	p = kzalloc(sizeof(io_data), GFP_KERNEL);
1249	if (!p)
1250	return -ENOMEM;
1251	p->aio = true;
1252	} else {
1253	memset(p, 0, sizeof(*p));
1254	p->aio = false;
1255	}
1256
1257	p->read = false;
1258	p->kiocb = kiocb;
1259	p->data = *from;
1260	p->mm = current->mm;
1261
1262	kiocb->private = p;
1263
1264	if (p->aio)
1265	kiocb_set_cancel_fn(req: kiocb, cancel: ffs_aio_cancel);
1266
1267	res = ffs_epfile_io(file: kiocb->ki_filp, io_data: p);
1268	if (res == -EIOCBQUEUED)
1269	return res;
1270	if (p->aio)
1271	kfree(objp: p);
1272	else
1273	*from = p->data;
1274	return res;
1275	}
1276
1277	static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
1278	{
1279	struct ffs_io_data io_data, *p = &io_data;
1280	ssize_t res;
1281
1282	if (!is_sync_kiocb(kiocb)) {
1283	p = kzalloc(sizeof(io_data), GFP_KERNEL);
1284	if (!p)
1285	return -ENOMEM;
1286	p->aio = true;
1287	} else {
1288	memset(p, 0, sizeof(*p));
1289	p->aio = false;
1290	}
1291
1292	p->read = true;
1293	p->kiocb = kiocb;
1294	if (p->aio) {
1295	p->to_free = dup_iter(new: &p->data, old: to, GFP_KERNEL);
1296	if (!iter_is_ubuf(i: &p->data) && !p->to_free) {
1297	kfree(objp: p);
1298	return -ENOMEM;
1299	}
1300	} else {
1301	p->data = *to;
1302	p->to_free = NULL;
1303	}
1304	p->mm = current->mm;
1305
1306	kiocb->private = p;
1307
1308	if (p->aio)
1309	kiocb_set_cancel_fn(req: kiocb, cancel: ffs_aio_cancel);
1310
1311	res = ffs_epfile_io(file: kiocb->ki_filp, io_data: p);
1312	if (res == -EIOCBQUEUED)
1313	return res;
1314
1315	if (p->aio) {
1316	kfree(objp: p->to_free);
1317	kfree(objp: p);
1318	} else {
1319	*to = p->data;
1320	}
1321	return res;
1322	}
1323
1324	static void ffs_dmabuf_release(struct kref *ref)
1325	{
1326	struct ffs_dmabuf_priv *priv = container_of(ref, struct ffs_dmabuf_priv, ref);
1327	struct dma_buf_attachment *attach = priv->attach;
1328	struct dma_buf *dmabuf = attach->dmabuf;
1329
1330	pr_vdebug("FFS DMABUF release\n");
1331	dma_buf_unmap_attachment_unlocked(attach, sg_table: priv->sgt, direction: priv->dir);
1332
1333	dma_buf_detach(dmabuf: attach->dmabuf, attach);
1334	dma_buf_put(dmabuf);
1335	kfree(objp: priv);
1336	}
1337
1338	static void ffs_dmabuf_get(struct dma_buf_attachment *attach)
1339	{
1340	struct ffs_dmabuf_priv *priv = attach->importer_priv;
1341
1342	kref_get(kref: &priv->ref);
1343	}
1344
1345	static void ffs_dmabuf_put(struct dma_buf_attachment *attach)
1346	{
1347	struct ffs_dmabuf_priv *priv = attach->importer_priv;
1348
1349	kref_put(kref: &priv->ref, release: ffs_dmabuf_release);
1350	}
1351
1352	static int
1353	ffs_epfile_release(struct inode *inode, struct file *file)
1354	{
1355	struct ffs_epfile *epfile = file->private_data;
1356	struct ffs_dmabuf_priv *priv, *tmp;
1357	struct ffs_data *ffs = epfile->ffs;
1358
1359	mutex_lock(&epfile->dmabufs_mutex);
1360
1361	/* Close all attached DMABUFs */
1362	list_for_each_entry_safe(priv, tmp, &epfile->dmabufs, entry) {
1363	/* Cancel any pending transfer */
1364	spin_lock_irq(lock: &ffs->eps_lock);
1365	if (priv->ep && priv->req)
1366	usb_ep_dequeue(ep: priv->ep, req: priv->req);
1367	spin_unlock_irq(lock: &ffs->eps_lock);
1368
1369	list_del(entry: &priv->entry);
1370	ffs_dmabuf_put(attach: priv->attach);
1371	}
1372
1373	mutex_unlock(lock: &epfile->dmabufs_mutex);
1374
1375	__ffs_epfile_read_buffer_free(epfile);
1376	ffs_data_closed(ffs: epfile->ffs);
1377
1378	return 0;
1379	}
1380
1381	static void ffs_dmabuf_cleanup(struct work_struct *work)
1382	{
1383	struct ffs_dma_fence *dma_fence =
1384	container_of(work, struct ffs_dma_fence, work);
1385	struct ffs_dmabuf_priv *priv = dma_fence->priv;
1386	struct dma_buf_attachment *attach = priv->attach;
1387	struct dma_fence *fence = &dma_fence->base;
1388
1389	ffs_dmabuf_put(attach);
1390	dma_fence_put(fence);
1391	}
1392
1393	static void ffs_dmabuf_signal_done(struct ffs_dma_fence *dma_fence, int ret)
1394	{
1395	struct ffs_dmabuf_priv *priv = dma_fence->priv;
1396	struct dma_fence *fence = &dma_fence->base;
1397	bool cookie = dma_fence_begin_signalling();
1398
1399	dma_fence_get(fence);
1400	fence->error = ret;
1401	dma_fence_signal(fence);
1402	dma_fence_end_signalling(cookie);
1403
1404	/*
1405	* The fence will be unref'd in ffs_dmabuf_cleanup.
1406	* It can't be done here, as the unref functions might try to lock
1407	* the resv object, which would deadlock.
1408	*/
1409	INIT_WORK(&dma_fence->work, ffs_dmabuf_cleanup);
1410	queue_work(wq: priv->ffs->io_completion_wq, work: &dma_fence->work);
1411	}
1412
1413	static void ffs_epfile_dmabuf_io_complete(struct usb_ep *ep,
1414	struct usb_request *req)
1415	{
1416	pr_vdebug("FFS: DMABUF transfer complete, status=%d\n", req->status);
1417	ffs_dmabuf_signal_done(dma_fence: req->context, ret: req->status);
1418	usb_ep_free_request(ep, req);
1419	}
1420
1421	static const char *ffs_dmabuf_get_driver_name(struct dma_fence *fence)
1422	{
1423	return "functionfs";
1424	}
1425
1426	static const char *ffs_dmabuf_get_timeline_name(struct dma_fence *fence)
1427	{
1428	return "";
1429	}
1430
1431	static void ffs_dmabuf_fence_release(struct dma_fence *fence)
1432	{
1433	struct ffs_dma_fence *dma_fence =
1434	container_of(fence, struct ffs_dma_fence, base);
1435
1436	kfree(objp: dma_fence);
1437	}
1438
1439	static const struct dma_fence_ops ffs_dmabuf_fence_ops = {
1440	.get_driver_name = ffs_dmabuf_get_driver_name,
1441	.get_timeline_name = ffs_dmabuf_get_timeline_name,
1442	.release = ffs_dmabuf_fence_release,
1443	};
1444
1445	static int ffs_dma_resv_lock(struct dma_buf *dmabuf, bool nonblock)
1446	{
1447	if (!nonblock)
1448	return dma_resv_lock_interruptible(obj: dmabuf->resv, NULL);
1449
1450	if (!dma_resv_trylock(obj: dmabuf->resv))
1451	return -EBUSY;
1452
1453	return 0;
1454	}
1455
1456	static struct dma_buf_attachment *
1457	ffs_dmabuf_find_attachment(struct ffs_epfile *epfile, struct dma_buf *dmabuf)
1458	{
1459	struct device *dev = epfile->ffs->gadget->dev.parent;
1460	struct dma_buf_attachment *attach = NULL;
1461	struct ffs_dmabuf_priv *priv;
1462
1463	mutex_lock(&epfile->dmabufs_mutex);
1464
1465	list_for_each_entry(priv, &epfile->dmabufs, entry) {
1466	if (priv->attach->dev == dev
1467	&& priv->attach->dmabuf == dmabuf) {
1468	attach = priv->attach;
1469	break;
1470	}
1471	}
1472
1473	if (attach)
1474	ffs_dmabuf_get(attach);
1475
1476	mutex_unlock(lock: &epfile->dmabufs_mutex);
1477
1478	return attach ?: ERR_PTR(error: -EPERM);
1479	}
1480
1481	static int ffs_dmabuf_attach(struct file *file, int fd)
1482	{
1483	bool nonblock = file->f_flags & O_NONBLOCK;
1484	struct ffs_epfile *epfile = file->private_data;
1485	struct usb_gadget *gadget = epfile->ffs->gadget;
1486	struct dma_buf_attachment *attach;
1487	struct ffs_dmabuf_priv *priv;
1488	enum dma_data_direction dir;
1489	struct sg_table *sg_table;
1490	struct dma_buf *dmabuf;
1491	int err;
1492
1493	if (!gadget || !gadget->sg_supported)
1494	return -EPERM;
1495
1496	dmabuf = dma_buf_get(fd);
1497	if (IS_ERR(ptr: dmabuf))
1498	return PTR_ERR(ptr: dmabuf);
1499
1500	attach = dma_buf_attach(dmabuf, dev: gadget->dev.parent);
1501	if (IS_ERR(ptr: attach)) {
1502	err = PTR_ERR(ptr: attach);
1503	goto err_dmabuf_put;
1504	}
1505
1506	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
1507	if (!priv) {
1508	err = -ENOMEM;
1509	goto err_dmabuf_detach;
1510	}
1511
1512	dir = epfile->in ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
1513
1514	err = ffs_dma_resv_lock(dmabuf, nonblock);
1515	if (err)
1516	goto err_free_priv;
1517
1518	sg_table = dma_buf_map_attachment(attach, dir);
1519	dma_resv_unlock(obj: dmabuf->resv);
1520
1521	if (IS_ERR(ptr: sg_table)) {
1522	err = PTR_ERR(ptr: sg_table);
1523	goto err_free_priv;
1524	}
1525
1526	attach->importer_priv = priv;
1527
1528	priv->sgt = sg_table;
1529	priv->dir = dir;
1530	priv->ffs = epfile->ffs;
1531	priv->attach = attach;
1532	spin_lock_init(&priv->lock);
1533	kref_init(kref: &priv->ref);
1534	priv->context = dma_fence_context_alloc(num: 1);
1535
1536	mutex_lock(&epfile->dmabufs_mutex);
1537	list_add(new: &priv->entry, head: &epfile->dmabufs);
1538	mutex_unlock(lock: &epfile->dmabufs_mutex);
1539
1540	return 0;
1541
1542	err_free_priv:
1543	kfree(objp: priv);
1544	err_dmabuf_detach:
1545	dma_buf_detach(dmabuf, attach);
1546	err_dmabuf_put:
1547	dma_buf_put(dmabuf);
1548
1549	return err;
1550	}
1551
1552	static int ffs_dmabuf_detach(struct file *file, int fd)
1553	{
1554	struct ffs_epfile *epfile = file->private_data;
1555	struct ffs_data *ffs = epfile->ffs;
1556	struct device *dev = ffs->gadget->dev.parent;
1557	struct ffs_dmabuf_priv *priv, *tmp;
1558	struct dma_buf *dmabuf;
1559	int ret = -EPERM;
1560
1561	dmabuf = dma_buf_get(fd);
1562	if (IS_ERR(ptr: dmabuf))
1563	return PTR_ERR(ptr: dmabuf);
1564
1565	mutex_lock(&epfile->dmabufs_mutex);
1566
1567	list_for_each_entry_safe(priv, tmp, &epfile->dmabufs, entry) {
1568	if (priv->attach->dev == dev
1569	&& priv->attach->dmabuf == dmabuf) {
1570	/* Cancel any pending transfer */
1571	spin_lock_irq(lock: &ffs->eps_lock);
1572	if (priv->ep && priv->req)
1573	usb_ep_dequeue(ep: priv->ep, req: priv->req);
1574	spin_unlock_irq(lock: &ffs->eps_lock);
1575
1576	list_del(entry: &priv->entry);
1577
1578	/* Unref the reference from ffs_dmabuf_attach() */
1579	ffs_dmabuf_put(attach: priv->attach);
1580	ret = 0;
1581	break;
1582	}
1583	}
1584
1585	mutex_unlock(lock: &epfile->dmabufs_mutex);
1586	dma_buf_put(dmabuf);
1587
1588	return ret;
1589	}
1590
1591	static int ffs_dmabuf_transfer(struct file *file,
1592	const struct usb_ffs_dmabuf_transfer_req *req)
1593	{
1594	bool nonblock = file->f_flags & O_NONBLOCK;
1595	struct ffs_epfile *epfile = file->private_data;
1596	struct dma_buf_attachment *attach;
1597	struct ffs_dmabuf_priv *priv;
1598	struct ffs_dma_fence *fence;
1599	struct usb_request *usb_req;
1600	enum dma_resv_usage resv_dir;
1601	struct dma_buf *dmabuf;
1602	unsigned long timeout;
1603	struct ffs_ep *ep;
1604	bool cookie;
1605	u32 seqno;
1606	long retl;
1607	int ret;
1608
1609	if (req->flags & ~USB_FFS_DMABUF_TRANSFER_MASK)
1610	return -EINVAL;
1611
1612	dmabuf = dma_buf_get(fd: req->fd);
1613	if (IS_ERR(ptr: dmabuf))
1614	return PTR_ERR(ptr: dmabuf);
1615
1616	if (req->length > dmabuf->size || req->length == 0) {
1617	ret = -EINVAL;
1618	goto err_dmabuf_put;
1619	}
1620
1621	attach = ffs_dmabuf_find_attachment(epfile, dmabuf);
1622	if (IS_ERR(ptr: attach)) {
1623	ret = PTR_ERR(ptr: attach);
1624	goto err_dmabuf_put;
1625	}
1626
1627	priv = attach->importer_priv;
1628
1629	ep = ffs_epfile_wait_ep(file);
1630	if (IS_ERR(ptr: ep)) {
1631	ret = PTR_ERR(ptr: ep);
1632	goto err_attachment_put;
1633	}
1634
1635	ret = ffs_dma_resv_lock(dmabuf, nonblock);
1636	if (ret)
1637	goto err_attachment_put;
1638
1639	/* Make sure we don't have writers */
1640	timeout = nonblock ? 0 : msecs_to_jiffies(DMABUF_ENQUEUE_TIMEOUT_MS);
1641	retl = dma_resv_wait_timeout(obj: dmabuf->resv,
1642	usage: dma_resv_usage_rw(write: epfile->in),
1643	intr: true, timeout);
1644	if (retl == 0)
1645	retl = -EBUSY;
1646	if (retl < 0) {
1647	ret = (int)retl;
1648	goto err_resv_unlock;
1649	}
1650
1651	ret = dma_resv_reserve_fences(obj: dmabuf->resv, num_fences: 1);
1652	if (ret)
1653	goto err_resv_unlock;
1654
1655	fence = kmalloc(sizeof(*fence), GFP_KERNEL);
1656	if (!fence) {
1657	ret = -ENOMEM;
1658	goto err_resv_unlock;
1659	}
1660
1661	fence->priv = priv;
1662
1663	spin_lock_irq(lock: &epfile->ffs->eps_lock);
1664
1665	/* In the meantime, endpoint got disabled or changed. */
1666	if (epfile->ep != ep) {
1667	ret = -ESHUTDOWN;
1668	goto err_fence_put;
1669	}
1670
1671	usb_req = usb_ep_alloc_request(ep: ep->ep, GFP_ATOMIC);
1672	if (!usb_req) {
1673	ret = -ENOMEM;
1674	goto err_fence_put;
1675	}
1676
1677	/*
1678	* usb_ep_queue() guarantees that all transfers are processed in the
1679	* order they are enqueued, so we can use a simple incrementing
1680	* sequence number for the dma_fence.
1681	*/
1682	seqno = atomic_add_return(i: 1, v: &epfile->seqno);
1683
1684	dma_fence_init(fence: &fence->base, ops: &ffs_dmabuf_fence_ops,
1685	lock: &priv->lock, context: priv->context, seqno);
1686
1687	resv_dir = epfile->in ? DMA_RESV_USAGE_WRITE : DMA_RESV_USAGE_READ;
1688
1689	dma_resv_add_fence(obj: dmabuf->resv, fence: &fence->base, usage: resv_dir);
1690	dma_resv_unlock(obj: dmabuf->resv);
1691
1692	/* Now that the dma_fence is in place, queue the transfer. */
1693
1694	usb_req->length = req->length;
1695	usb_req->buf = NULL;
1696	usb_req->sg = priv->sgt->sgl;
1697	usb_req->num_sgs = sg_nents_for_len(sg: priv->sgt->sgl, len: req->length);
1698	usb_req->sg_was_mapped = true;
1699	usb_req->context = fence;
1700	usb_req->complete = ffs_epfile_dmabuf_io_complete;
1701
1702	cookie = dma_fence_begin_signalling();
1703	ret = usb_ep_queue(ep: ep->ep, req: usb_req, GFP_ATOMIC);
1704	dma_fence_end_signalling(cookie);
1705	if (!ret) {
1706	priv->req = usb_req;
1707	priv->ep = ep->ep;
1708	} else {
1709	pr_warn("FFS: Failed to queue DMABUF: %d\n", ret);
1710	ffs_dmabuf_signal_done(dma_fence: fence, ret);
1711	usb_ep_free_request(ep: ep->ep, req: usb_req);
1712	}
1713
1714	spin_unlock_irq(lock: &epfile->ffs->eps_lock);
1715	dma_buf_put(dmabuf);
1716
1717	return ret;
1718
1719	err_fence_put:
1720	spin_unlock_irq(lock: &epfile->ffs->eps_lock);
1721	dma_fence_put(fence: &fence->base);
1722	err_resv_unlock:
1723	dma_resv_unlock(obj: dmabuf->resv);
1724	err_attachment_put:
1725	ffs_dmabuf_put(attach);
1726	err_dmabuf_put:
1727	dma_buf_put(dmabuf);
1728
1729	return ret;
1730	}
1731
1732	static long ffs_epfile_ioctl(struct file *file, unsigned code,
1733	unsigned long value)
1734	{
1735	struct ffs_epfile *epfile = file->private_data;
1736	struct ffs_ep *ep;
1737	int ret;
1738
1739	if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
1740	return -ENODEV;
1741
1742	switch (code) {
1743	case FUNCTIONFS_DMABUF_ATTACH:
1744	{
1745	int fd;
1746
1747	if (copy_from_user(to: &fd, from: (void __user *)value, n: sizeof(fd))) {
1748	ret = -EFAULT;
1749	break;
1750	}
1751
1752	return ffs_dmabuf_attach(file, fd);
1753	}
1754	case FUNCTIONFS_DMABUF_DETACH:
1755	{
1756	int fd;
1757
1758	if (copy_from_user(to: &fd, from: (void __user *)value, n: sizeof(fd))) {
1759	ret = -EFAULT;
1760	break;
1761	}
1762
1763	return ffs_dmabuf_detach(file, fd);
1764	}
1765	case FUNCTIONFS_DMABUF_TRANSFER:
1766	{
1767	struct usb_ffs_dmabuf_transfer_req req;
1768
1769	if (copy_from_user(to: &req, from: (void __user *)value, n: sizeof(req))) {
1770	ret = -EFAULT;
1771	break;
1772	}
1773
1774	return ffs_dmabuf_transfer(file, req: &req);
1775	}
1776	default:
1777	break;
1778	}
1779
1780	/* Wait for endpoint to be enabled */
1781	ep = ffs_epfile_wait_ep(file);
1782	if (IS_ERR(ptr: ep))
1783	return PTR_ERR(ptr: ep);
1784
1785	spin_lock_irq(lock: &epfile->ffs->eps_lock);
1786
1787	/* In the meantime, endpoint got disabled or changed. */
1788	if (epfile->ep != ep) {
1789	spin_unlock_irq(lock: &epfile->ffs->eps_lock);
1790	return -ESHUTDOWN;
1791	}
1792
1793	switch (code) {
1794	case FUNCTIONFS_FIFO_STATUS:
1795	ret = usb_ep_fifo_status(ep: epfile->ep->ep);
1796	break;
1797	case FUNCTIONFS_FIFO_FLUSH:
1798	usb_ep_fifo_flush(ep: epfile->ep->ep);
1799	ret = 0;
1800	break;
1801	case FUNCTIONFS_CLEAR_HALT:
1802	ret = usb_ep_clear_halt(ep: epfile->ep->ep);
1803	break;
1804	case FUNCTIONFS_ENDPOINT_REVMAP:
1805	ret = epfile->ep->num;
1806	break;
1807	case FUNCTIONFS_ENDPOINT_DESC:
1808	{
1809	int desc_idx;
1810	struct usb_endpoint_descriptor desc1, *desc;
1811
1812	switch (epfile->ffs->gadget->speed) {
1813	case USB_SPEED_SUPER:
1814	case USB_SPEED_SUPER_PLUS:
1815	desc_idx = 2;
1816	break;
1817	case USB_SPEED_HIGH:
1818	desc_idx = 1;
1819	break;
1820	default:
1821	desc_idx = 0;
1822	}
1823
1824	desc = epfile->ep->descs[desc_idx];
1825	memcpy(&desc1, desc, desc->bLength);
1826
1827	spin_unlock_irq(lock: &epfile->ffs->eps_lock);
1828	ret = copy_to_user(to: (void __user *)value, from: &desc1, n: desc1.bLength);
1829	if (ret)
1830	ret = -EFAULT;
1831	return ret;
1832	}
1833	default:
1834	ret = -ENOTTY;
1835	}
1836	spin_unlock_irq(lock: &epfile->ffs->eps_lock);
1837
1838	return ret;
1839	}
1840
1841	static const struct file_operations ffs_epfile_operations = {
1842
1843	.open = ffs_epfile_open,
1844	.write_iter = ffs_epfile_write_iter,
1845	.read_iter = ffs_epfile_read_iter,
1846	.release = ffs_epfile_release,
1847	.unlocked_ioctl = ffs_epfile_ioctl,
1848	.compat_ioctl = compat_ptr_ioctl,
1849	};
1850
1851
1852	/* File system and super block operations ***********************************/
1853
1854	/*
1855	* Mounting the file system creates a controller file, used first for
1856	* function configuration then later for event monitoring.
1857	*/
1858
1859	static struct inode *__must_check
1860	ffs_sb_make_inode(struct super_block *sb, void *data,
1861	const struct file_operations *fops,
1862	const struct inode_operations *iops,
1863	struct ffs_file_perms *perms)
1864	{
1865	struct inode *inode;
1866
1867	inode = new_inode(sb);
1868
1869	if (inode) {
1870	struct timespec64 ts = inode_set_ctime_current(inode);
1871
1872	inode->i_ino = get_next_ino();
1873	inode->i_mode = perms->mode;
1874	inode->i_uid = perms->uid;
1875	inode->i_gid = perms->gid;
1876	inode_set_atime_to_ts(inode, ts);
1877	inode_set_mtime_to_ts(inode, ts);
1878	inode->i_private = data;
1879	if (fops)
1880	inode->i_fop = fops;
1881	if (iops)
1882	inode->i_op = iops;
1883	}
1884
1885	return inode;
1886	}
1887
1888	/* Create "regular" file */
1889	static int ffs_sb_create_file(struct super_block *sb, const char *name,
1890	void *data, const struct file_operations *fops)
1891	{
1892	struct ffs_data *ffs = sb->s_fs_info;
1893	struct dentry *dentry;
1894	struct inode *inode;
1895
1896	inode = ffs_sb_make_inode(sb, data, fops, NULL, perms: &ffs->file_perms);
1897	if (!inode)
1898	return -ENOMEM;
1899	dentry = simple_start_creating(sb->s_root, name);
1900	if (IS_ERR(ptr: dentry)) {
1901	iput(inode);
1902	return PTR_ERR(ptr: dentry);
1903	}
1904
1905	d_make_persistent(dentry, inode);
1906
1907	simple_done_creating(dentry);
1908	return 0;
1909	}
1910
1911	/* Super block */
1912	static const struct super_operations ffs_sb_operations = {
1913	.statfs = simple_statfs,
1914	.drop_inode = inode_just_drop,
1915	};
1916
1917	struct ffs_sb_fill_data {
1918	struct ffs_file_perms perms;
1919	umode_t root_mode;
1920	const char *dev_name;
1921	bool no_disconnect;
1922	struct ffs_data *ffs_data;
1923	};
1924
1925	static int ffs_sb_fill(struct super_block *sb, struct fs_context *fc)
1926	{
1927	struct ffs_sb_fill_data *data = fc->fs_private;
1928	struct inode *inode;
1929	struct ffs_data *ffs = data->ffs_data;
1930
1931	ffs->sb = sb;
1932	data->ffs_data = NULL;
1933	sb->s_fs_info = ffs;
1934	sb->s_blocksize = PAGE_SIZE;
1935	sb->s_blocksize_bits = PAGE_SHIFT;
1936	sb->s_magic = FUNCTIONFS_MAGIC;
1937	sb->s_op = &ffs_sb_operations;
1938	sb->s_time_gran = 1;
1939
1940	/* Root inode */
1941	data->perms.mode = data->root_mode;
1942	inode = ffs_sb_make_inode(sb, NULL,
1943	fops: &simple_dir_operations,
1944	iops: &simple_dir_inode_operations,
1945	perms: &data->perms);
1946	sb->s_root = d_make_root(inode);
1947	if (!sb->s_root)
1948	return -ENOMEM;
1949
1950	/* EP0 file */
1951	return ffs_sb_create_file(sb, name: "ep0", data: ffs, fops: &ffs_ep0_operations);
1952	}
1953
1954	enum {
1955	Opt_no_disconnect,
1956	Opt_rmode,
1957	Opt_fmode,
1958	Opt_mode,
1959	Opt_uid,
1960	Opt_gid,
1961	};
1962
1963	static const struct fs_parameter_spec ffs_fs_fs_parameters[] = {
1964	fsparam_bool ("no_disconnect", Opt_no_disconnect),
1965	fsparam_u32 ("rmode", Opt_rmode),
1966	fsparam_u32 ("fmode", Opt_fmode),
1967	fsparam_u32 ("mode", Opt_mode),
1968	fsparam_u32 ("uid", Opt_uid),
1969	fsparam_u32 ("gid", Opt_gid),
1970	{}
1971	};
1972
1973	static int ffs_fs_parse_param(struct fs_context *fc, struct fs_parameter *param)
1974	{
1975	struct ffs_sb_fill_data *data = fc->fs_private;
1976	struct fs_parse_result result;
1977	int opt;
1978
1979	opt = fs_parse(fc, desc: ffs_fs_fs_parameters, param, result: &result);
1980	if (opt < 0)
1981	return opt;
1982
1983	switch (opt) {
1984	case Opt_no_disconnect:
1985	data->no_disconnect = result.boolean;
1986	break;
1987	case Opt_rmode:
1988	data->root_mode = (result.uint_32 & 0555) | S_IFDIR;
1989	break;
1990	case Opt_fmode:
1991	data->perms.mode = (result.uint_32 & 0666) | S_IFREG;
1992	break;
1993	case Opt_mode:
1994	data->root_mode = (result.uint_32 & 0555) | S_IFDIR;
1995	data->perms.mode = (result.uint_32 & 0666) | S_IFREG;
1996	break;
1997
1998	case Opt_uid:
1999	data->perms.uid = make_kuid(current_user_ns(), uid: result.uint_32);
2000	if (!uid_valid(uid: data->perms.uid))
2001	goto unmapped_value;
2002	break;
2003	case Opt_gid:
2004	data->perms.gid = make_kgid(current_user_ns(), gid: result.uint_32);
2005	if (!gid_valid(gid: data->perms.gid))
2006	goto unmapped_value;
2007	break;
2008
2009	default:
2010	return -ENOPARAM;
2011	}
2012
2013	return 0;
2014
2015	unmapped_value:
2016	return invalf(fc, "%s: unmapped value: %u", param->key, result.uint_32);
2017	}
2018
2019	/*
2020	* Set up the superblock for a mount.
2021	*/
2022	static int ffs_fs_get_tree(struct fs_context *fc)
2023	{
2024	struct ffs_sb_fill_data *ctx = fc->fs_private;
2025	struct ffs_data *ffs;
2026	int ret;
2027
2028	if (!fc->source)
2029	return invalf(fc, "No source specified");
2030
2031	ffs = ffs_data_new(dev_name: fc->source);
2032	if (!ffs)
2033	return -ENOMEM;
2034	ffs->file_perms = ctx->perms;
2035	ffs->no_disconnect = ctx->no_disconnect;
2036
2037	ffs->dev_name = kstrdup(s: fc->source, GFP_KERNEL);
2038	if (!ffs->dev_name) {
2039	ffs_data_put(ffs);
2040	return -ENOMEM;
2041	}
2042
2043	ret = ffs_acquire_dev(dev_name: ffs->dev_name, ffs_data: ffs);
2044	if (ret) {
2045	ffs_data_put(ffs);
2046	return ret;
2047	}
2048
2049	ctx->ffs_data = ffs;
2050	return get_tree_nodev(fc, fill_super: ffs_sb_fill);
2051	}
2052
2053	static void ffs_fs_free_fc(struct fs_context *fc)
2054	{
2055	struct ffs_sb_fill_data *ctx = fc->fs_private;
2056
2057	if (ctx) {
2058	if (ctx->ffs_data) {
2059	ffs_data_put(ffs: ctx->ffs_data);
2060	}
2061
2062	kfree(objp: ctx);
2063	}
2064	}
2065
2066	static const struct fs_context_operations ffs_fs_context_ops = {
2067	.free = ffs_fs_free_fc,
2068	.parse_param = ffs_fs_parse_param,
2069	.get_tree = ffs_fs_get_tree,
2070	};
2071
2072	static int ffs_fs_init_fs_context(struct fs_context *fc)
2073	{
2074	struct ffs_sb_fill_data *ctx;
2075
2076	ctx = kzalloc(sizeof(struct ffs_sb_fill_data), GFP_KERNEL);
2077	if (!ctx)
2078	return -ENOMEM;
2079
2080	ctx->perms.mode = S_IFREG | 0600;
2081	ctx->perms.uid = GLOBAL_ROOT_UID;
2082	ctx->perms.gid = GLOBAL_ROOT_GID;
2083	ctx->root_mode = S_IFDIR | 0500;
2084	ctx->no_disconnect = false;
2085
2086	fc->fs_private = ctx;
2087	fc->ops = &ffs_fs_context_ops;
2088	return 0;
2089	}
2090
2091	static void
2092	ffs_fs_kill_sb(struct super_block *sb)
2093	{
2094	kill_anon_super(sb);
2095	if (sb->s_fs_info) {
2096	struct ffs_data *ffs = sb->s_fs_info;
2097	ffs->state = FFS_CLOSING;
2098	ffs_data_reset(ffs);
2099	// no configfs accesses from that point on,
2100	// so no further schedule_work() is possible
2101	cancel_work_sync(work: &ffs->reset_work);
2102	ffs_data_put(ffs);
2103	}
2104	}
2105
2106	static struct file_system_type ffs_fs_type = {
2107	.owner = THIS_MODULE,
2108	.name = "functionfs",
2109	.init_fs_context = ffs_fs_init_fs_context,
2110	.parameters = ffs_fs_fs_parameters,
2111	.kill_sb = ffs_fs_kill_sb,
2112	};
2113	MODULE_ALIAS_FS("functionfs");
2114
2115
2116	/* Driver's main init/cleanup functions *************************************/
2117
2118	static int functionfs_init(void)
2119	{
2120	int ret;
2121
2122	ret = register_filesystem(&ffs_fs_type);
2123	if (!ret)
2124	pr_info("file system registered\n");
2125	else
2126	pr_err("failed registering file system (%d)\n", ret);
2127
2128	return ret;
2129	}
2130
2131	static void functionfs_cleanup(void)
2132	{
2133	pr_info("unloading\n");
2134	unregister_filesystem(&ffs_fs_type);
2135	}
2136
2137
2138	/* ffs_data and ffs_function construction and destruction code **************/
2139
2140	static void ffs_data_clear(struct ffs_data *ffs);
2141
2142	static void ffs_data_get(struct ffs_data *ffs)
2143	{
2144	refcount_inc(r: &ffs->ref);
2145	}
2146
2147	static void ffs_data_put(struct ffs_data *ffs)
2148	{
2149	if (refcount_dec_and_test(r: &ffs->ref)) {
2150	pr_info("%s(): freeing\n", __func__);
2151	ffs_data_clear(ffs);
2152	ffs_release_dev(ffs_dev: ffs->private_data);
2153	BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
2154	swait_active(&ffs->ep0req_completion.wait) ||
2155	waitqueue_active(&ffs->wait));
2156	destroy_workqueue(wq: ffs->io_completion_wq);
2157	kfree(objp: ffs->dev_name);
2158	kfree(objp: ffs);
2159	}
2160	}
2161
2162	static void ffs_data_closed(struct ffs_data *ffs)
2163	{
2164	spin_lock_irq(lock: &ffs->eps_lock);
2165	if (--ffs->opened) { // not the last opener?
2166	spin_unlock_irq(lock: &ffs->eps_lock);
2167	return;
2168	}
2169	if (ffs->no_disconnect) {
2170	struct ffs_epfile *epfiles;
2171
2172	ffs->state = FFS_DEACTIVATED;
2173	epfiles = ffs->epfiles;
2174	ffs->epfiles = NULL;
2175	spin_unlock_irq(lock: &ffs->eps_lock);
2176
2177	if (epfiles)
2178	ffs_epfiles_destroy(sb: ffs->sb, epfiles,
2179	count: ffs->eps_count);
2180
2181	if (ffs->setup_state == FFS_SETUP_PENDING)
2182	__ffs_ep0_stall(ffs);
2183	} else {
2184	ffs->state = FFS_CLOSING;
2185	spin_unlock_irq(lock: &ffs->eps_lock);
2186	ffs_data_reset(ffs);
2187	}
2188	}
2189
2190	static struct ffs_data *ffs_data_new(const char *dev_name)
2191	{
2192	struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
2193	if (!ffs)
2194	return NULL;
2195
2196	ffs->io_completion_wq = alloc_ordered_workqueue("%s", 0, dev_name);
2197	if (!ffs->io_completion_wq) {
2198	kfree(objp: ffs);
2199	return NULL;
2200	}
2201
2202	refcount_set(r: &ffs->ref, n: 1);
2203	ffs->opened = 0;
2204	ffs->state = FFS_READ_DESCRIPTORS;
2205	mutex_init(&ffs->mutex);
2206	spin_lock_init(&ffs->eps_lock);
2207	init_waitqueue_head(&ffs->ev.waitq);
2208	init_waitqueue_head(&ffs->wait);
2209	init_completion(x: &ffs->ep0req_completion);
2210
2211	/* XXX REVISIT need to update it in some places, or do we? */
2212	ffs->ev.can_stall = 1;
2213
2214	return ffs;
2215	}
2216
2217	static void ffs_data_clear(struct ffs_data *ffs)
2218	{
2219	struct ffs_epfile *epfiles;
2220	unsigned long flags;
2221
2222	ffs_closed(ffs);
2223
2224	BUG_ON(ffs->gadget);
2225
2226	spin_lock_irqsave(&ffs->eps_lock, flags);
2227	epfiles = ffs->epfiles;
2228	ffs->epfiles = NULL;
2229	spin_unlock_irqrestore(lock: &ffs->eps_lock, flags);
2230
2231	/*
2232	* potential race possible between ffs_func_eps_disable
2233	* & ffs_epfile_release therefore maintaining a local
2234	* copy of epfile will save us from use-after-free.
2235	*/
2236	if (epfiles) {
2237	ffs_epfiles_destroy(sb: ffs->sb, epfiles, count: ffs->eps_count);
2238	ffs->epfiles = NULL;
2239	}
2240
2241	if (ffs->ffs_eventfd) {
2242	eventfd_ctx_put(ctx: ffs->ffs_eventfd);
2243	ffs->ffs_eventfd = NULL;
2244	}
2245
2246	kfree(objp: ffs->raw_descs_data);
2247	kfree(objp: ffs->raw_strings);
2248	kfree(objp: ffs->stringtabs);
2249	}
2250
2251	static void ffs_data_reset(struct ffs_data *ffs)
2252	{
2253	ffs_data_clear(ffs);
2254
2255	spin_lock_irq(lock: &ffs->eps_lock);
2256	ffs->raw_descs_data = NULL;
2257	ffs->raw_descs = NULL;
2258	ffs->raw_strings = NULL;
2259	ffs->stringtabs = NULL;
2260
2261	ffs->raw_descs_length = 0;
2262	ffs->fs_descs_count = 0;
2263	ffs->hs_descs_count = 0;
2264	ffs->ss_descs_count = 0;
2265
2266	ffs->strings_count = 0;
2267	ffs->interfaces_count = 0;
2268	ffs->eps_count = 0;
2269
2270	ffs->ev.count = 0;
2271
2272	ffs->state = FFS_READ_DESCRIPTORS;
2273	ffs->setup_state = FFS_NO_SETUP;
2274	ffs->flags = 0;
2275
2276	ffs->ms_os_descs_ext_prop_count = 0;
2277	ffs->ms_os_descs_ext_prop_name_len = 0;
2278	ffs->ms_os_descs_ext_prop_data_len = 0;
2279	spin_unlock_irq(lock: &ffs->eps_lock);
2280	}
2281
2282
2283	static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
2284	{
2285	struct usb_gadget_strings **lang;
2286	int first_id;
2287
2288	if ((ffs->state != FFS_ACTIVE
2289	|| test_and_set_bit(FFS_FL_BOUND, addr: &ffs->flags)))
2290	return -EBADFD;
2291
2292	first_id = usb_string_ids_n(c: cdev, n: ffs->strings_count);
2293	if (first_id < 0)
2294	return first_id;
2295
2296	ffs->ep0req = usb_ep_alloc_request(ep: cdev->gadget->ep0, GFP_KERNEL);
2297	if (!ffs->ep0req)
2298	return -ENOMEM;
2299	ffs->ep0req->complete = ffs_ep0_complete;
2300	ffs->ep0req->context = ffs;
2301
2302	lang = ffs->stringtabs;
2303	if (lang) {
2304	for (; *lang; ++lang) {
2305	struct usb_string *str = (*lang)->strings;
2306	int id = first_id;
2307	for (; str->s; ++id, ++str)
2308	str->id = id;
2309	}
2310	}
2311
2312	ffs->gadget = cdev->gadget;
2313	ffs_data_get(ffs);
2314	return 0;
2315	}
2316
2317	static void functionfs_unbind(struct ffs_data *ffs)
2318	{
2319	if (!WARN_ON(!ffs->gadget)) {
2320	/* dequeue before freeing ep0req */
2321	usb_ep_dequeue(ep: ffs->gadget->ep0, req: ffs->ep0req);
2322	mutex_lock(&ffs->mutex);
2323	usb_ep_free_request(ep: ffs->gadget->ep0, req: ffs->ep0req);
2324	ffs->ep0req = NULL;
2325	ffs->gadget = NULL;
2326	clear_bit(FFS_FL_BOUND, addr: &ffs->flags);
2327	mutex_unlock(lock: &ffs->mutex);
2328	ffs_data_put(ffs);
2329	}
2330	}
2331
2332	static int ffs_epfiles_create(struct ffs_data *ffs)
2333	{
2334	struct ffs_epfile *epfile, *epfiles;
2335	unsigned i, count;
2336	int err;
2337
2338	count = ffs->eps_count;
2339	epfiles = kcalloc(count, sizeof(*epfiles), GFP_KERNEL);
2340	if (!epfiles)
2341	return -ENOMEM;
2342
2343	epfile = epfiles;
2344	for (i = 1; i <= count; ++i, ++epfile) {
2345	epfile->ffs = ffs;
2346	mutex_init(&epfile->mutex);
2347	mutex_init(&epfile->dmabufs_mutex);
2348	INIT_LIST_HEAD(list: &epfile->dmabufs);
2349	if (ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
2350	sprintf(buf: epfile->name, fmt: "ep%02x", ffs->eps_addrmap[i]);
2351	else
2352	sprintf(buf: epfile->name, fmt: "ep%u", i);
2353	err = ffs_sb_create_file(sb: ffs->sb, name: epfile->name,
2354	data: epfile, fops: &ffs_epfile_operations);
2355	if (err) {
2356	ffs_epfiles_destroy(sb: ffs->sb, epfiles, count: i - 1);
2357	return err;
2358	}
2359	}
2360
2361	ffs->epfiles = epfiles;
2362	return 0;
2363	}
2364
2365	static void clear_one(struct dentry *dentry)
2366	{
2367	smp_store_release(&dentry->d_inode->i_private, NULL);
2368	}
2369
2370	static void ffs_epfiles_destroy(struct super_block *sb,
2371	struct ffs_epfile *epfiles, unsigned count)
2372	{
2373	struct ffs_epfile *epfile = epfiles;
2374	struct dentry *root = sb->s_root;
2375
2376	for (; count; --count, ++epfile) {
2377	BUG_ON(mutex_is_locked(&epfile->mutex));
2378	simple_remove_by_name(root, epfile->name, callback: clear_one);
2379	}
2380
2381	kfree(objp: epfiles);
2382	}
2383
2384	static void ffs_func_eps_disable(struct ffs_function *func)
2385	{
2386	struct ffs_ep *ep;
2387	struct ffs_epfile *epfile;
2388	unsigned short count;
2389	unsigned long flags;
2390
2391	spin_lock_irqsave(&func->ffs->eps_lock, flags);
2392	count = func->ffs->eps_count;
2393	epfile = func->ffs->epfiles;
2394	ep = func->eps;
2395	while (count--) {
2396	/* pending requests get nuked */
2397	if (ep->ep)
2398	usb_ep_disable(ep: ep->ep);
2399	++ep;
2400
2401	if (epfile) {
2402	epfile->ep = NULL;
2403	__ffs_epfile_read_buffer_free(epfile);
2404	++epfile;
2405	}
2406	}
2407	spin_unlock_irqrestore(lock: &func->ffs->eps_lock, flags);
2408	}
2409
2410	static int ffs_func_eps_enable(struct ffs_function *func)
2411	{
2412	struct ffs_data *ffs;
2413	struct ffs_ep *ep;
2414	struct ffs_epfile *epfile;
2415	unsigned short count;
2416	unsigned long flags;
2417	int ret = 0;
2418
2419	spin_lock_irqsave(&func->ffs->eps_lock, flags);
2420	ffs = func->ffs;
2421	ep = func->eps;
2422	epfile = ffs->epfiles;
2423	count = ffs->eps_count;
2424	if (!epfile) {
2425	ret = -ENOMEM;
2426	goto done;
2427	}
2428
2429	while (count--) {
2430	ep->ep->driver_data = ep;
2431
2432	ret = config_ep_by_speed(g: func->gadget, f: &func->function, ep: ep->ep);
2433	if (ret) {
2434	pr_err("%s: config_ep_by_speed(%s) returned %d\n",
2435	__func__, ep->ep->name, ret);
2436	break;
2437	}
2438
2439	ret = usb_ep_enable(ep: ep->ep);
2440	if (!ret) {
2441	epfile->ep = ep;
2442	epfile->in = usb_endpoint_dir_in(epd: ep->ep->desc);
2443	epfile->isoc = usb_endpoint_xfer_isoc(epd: ep->ep->desc);
2444	} else {
2445	break;
2446	}
2447
2448	++ep;
2449	++epfile;
2450	}
2451
2452	wake_up_interruptible(&ffs->wait);
2453	done:
2454	spin_unlock_irqrestore(lock: &func->ffs->eps_lock, flags);
2455
2456	return ret;
2457	}
2458
2459
2460	/* Parsing and building descriptors and strings *****************************/
2461
2462	/*
2463	* This validates if data pointed by data is a valid USB descriptor as
2464	* well as record how many interfaces, endpoints and strings are
2465	* required by given configuration. Returns address after the
2466	* descriptor or NULL if data is invalid.
2467	*/
2468
2469	enum ffs_entity_type {
2470	FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT
2471	};
2472
2473	enum ffs_os_desc_type {
2474	FFS_OS_DESC, FFS_OS_DESC_EXT_COMPAT, FFS_OS_DESC_EXT_PROP
2475	};
2476
2477	typedef int (*ffs_entity_callback)(enum ffs_entity_type entity,
2478	u8 *valuep,
2479	struct usb_descriptor_header *desc,
2480	void *priv);
2481
2482	typedef int (*ffs_os_desc_callback)(enum ffs_os_desc_type entity,
2483	struct usb_os_desc_header *h, void *data,
2484	unsigned len, void *priv);
2485
2486	static int __must_check ffs_do_single_desc(char *data, unsigned len,
2487	ffs_entity_callback entity,
2488	void *priv, int *current_class, int *current_subclass)
2489	{
2490	struct usb_descriptor_header *_ds = (void *)data;
2491	u8 length;
2492	int ret;
2493
2494	/* At least two bytes are required: length and type */
2495	if (len < 2) {
2496	pr_vdebug("descriptor too short\n");
2497	return -EINVAL;
2498	}
2499
2500	/* If we have at least as many bytes as the descriptor takes? */
2501	length = _ds->bLength;
2502	if (len < length) {
2503	pr_vdebug("descriptor longer then available data\n");
2504	return -EINVAL;
2505	}
2506
2507	#define __entity_check_INTERFACE(val) 1
2508	#define __entity_check_STRING(val) (val)
2509	#define __entity_check_ENDPOINT(val) ((val) & USB_ENDPOINT_NUMBER_MASK)
2510	#define __entity(type, val) do { \
2511	pr_vdebug("entity " #type "(%02x)\n", (val)); \
2512	if (!__entity_check_ ##type(val)) { \
2513	pr_vdebug("invalid entity's value\n"); \
2514	return -EINVAL; \
2515	} \
2516	ret = entity(FFS_ ##type, &val, _ds, priv); \
2517	if (ret < 0) { \
2518	pr_debug("entity " #type "(%02x); ret = %d\n", \
2519	(val), ret); \
2520	return ret; \
2521	} \
2522	} while (0)
2523
2524	/* Parse descriptor depending on type. */
2525	switch (_ds->bDescriptorType) {
2526	case USB_DT_DEVICE:
2527	case USB_DT_CONFIG:
2528	case USB_DT_STRING:
2529	case USB_DT_DEVICE_QUALIFIER:
2530	/* function can't have any of those */
2531	pr_vdebug("descriptor reserved for gadget: %d\n",
2532	_ds->bDescriptorType);
2533	return -EINVAL;
2534
2535	case USB_DT_INTERFACE: {
2536	struct usb_interface_descriptor *ds = (void *)_ds;
2537	pr_vdebug("interface descriptor\n");
2538	if (length != sizeof *ds)
2539	goto inv_length;
2540
2541	__entity(INTERFACE, ds->bInterfaceNumber);
2542	if (ds->iInterface)
2543	__entity(STRING, ds->iInterface);
2544	*current_class = ds->bInterfaceClass;
2545	*current_subclass = ds->bInterfaceSubClass;
2546	}
2547	break;
2548
2549	case USB_DT_ENDPOINT: {
2550	struct usb_endpoint_descriptor *ds = (void *)_ds;
2551	pr_vdebug("endpoint descriptor\n");
2552	if (length != USB_DT_ENDPOINT_SIZE &&
2553	length != USB_DT_ENDPOINT_AUDIO_SIZE)
2554	goto inv_length;
2555	__entity(ENDPOINT, ds->bEndpointAddress);
2556	}
2557	break;
2558
2559	case USB_TYPE_CLASS | 0x01:
2560	if (*current_class == USB_INTERFACE_CLASS_HID) {
2561	pr_vdebug("hid descriptor\n");
2562	if (length != sizeof(struct hid_descriptor))
2563	goto inv_length;
2564	break;
2565	} else if (*current_class == USB_INTERFACE_CLASS_CCID) {
2566	pr_vdebug("ccid descriptor\n");
2567	if (length != sizeof(struct ccid_descriptor))
2568	goto inv_length;
2569	break;
2570	} else if (*current_class == USB_CLASS_APP_SPEC &&
2571	*current_subclass == USB_SUBCLASS_DFU) {
2572	pr_vdebug("dfu functional descriptor\n");
2573	if (length != sizeof(struct usb_dfu_functional_descriptor))
2574	goto inv_length;
2575	break;
2576	} else {
2577	pr_vdebug("unknown descriptor: %d for class %d\n",
2578	_ds->bDescriptorType, *current_class);
2579	return -EINVAL;
2580	}
2581
2582	case USB_DT_OTG:
2583	if (length != sizeof(struct usb_otg_descriptor))
2584	goto inv_length;
2585	break;
2586
2587	case USB_DT_INTERFACE_ASSOCIATION: {
2588	struct usb_interface_assoc_descriptor *ds = (void *)_ds;
2589	pr_vdebug("interface association descriptor\n");
2590	if (length != sizeof *ds)
2591	goto inv_length;
2592	if (ds->iFunction)
2593	__entity(STRING, ds->iFunction);
2594	}
2595	break;
2596
2597	case USB_DT_SS_ENDPOINT_COMP:
2598	pr_vdebug("EP SS companion descriptor\n");
2599	if (length != sizeof(struct usb_ss_ep_comp_descriptor))
2600	goto inv_length;
2601	break;
2602
2603	case USB_DT_OTHER_SPEED_CONFIG:
2604	case USB_DT_INTERFACE_POWER:
2605	case USB_DT_DEBUG:
2606	case USB_DT_SECURITY:
2607	case USB_DT_CS_RADIO_CONTROL:
2608	/* TODO */
2609	pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType);
2610	return -EINVAL;
2611
2612	default:
2613	/* We should never be here */
2614	pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType);
2615	return -EINVAL;
2616
2617	inv_length:
2618	pr_vdebug("invalid length: %d (descriptor %d)\n",
2619	_ds->bLength, _ds->bDescriptorType);
2620	return -EINVAL;
2621	}
2622
2623	#undef __entity
2624	#undef __entity_check_DESCRIPTOR
2625	#undef __entity_check_INTERFACE
2626	#undef __entity_check_STRING
2627	#undef __entity_check_ENDPOINT
2628
2629	return length;
2630	}
2631
2632	static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len,
2633	ffs_entity_callback entity, void *priv)
2634	{
2635	const unsigned _len = len;
2636	unsigned long num = 0;
2637	int current_class = -1;
2638	int current_subclass = -1;
2639
2640	for (;;) {
2641	int ret;
2642
2643	if (num == count)
2644	data = NULL;
2645
2646	/* Record "descriptor" entity */
2647	ret = entity(FFS_DESCRIPTOR, (u8 *)num, (void *)data, priv);
2648	if (ret < 0) {
2649	pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n",
2650	num, ret);
2651	return ret;
2652	}
2653
2654	if (!data)
2655	return _len - len;
2656
2657	ret = ffs_do_single_desc(data, len, entity, priv,
2658	current_class: &current_class, current_subclass: &current_subclass);
2659	if (ret < 0) {
2660	pr_debug("%s returns %d\n", __func__, ret);
2661	return ret;
2662	}
2663
2664	len -= ret;
2665	data += ret;
2666	++num;
2667	}
2668	}
2669
2670	static int __ffs_data_do_entity(enum ffs_entity_type type,
2671	u8 *valuep, struct usb_descriptor_header *desc,
2672	void *priv)
2673	{
2674	struct ffs_desc_helper *helper = priv;
2675	struct usb_endpoint_descriptor *d;
2676
2677	switch (type) {
2678	case FFS_DESCRIPTOR:
2679	break;
2680
2681	case FFS_INTERFACE:
2682	/*
2683	* Interfaces are indexed from zero so if we
2684	* encountered interface "n" then there are at least
2685	* "n+1" interfaces.
2686	*/
2687	if (*valuep >= helper->interfaces_count)
2688	helper->interfaces_count = *valuep + 1;
2689	break;
2690
2691	case FFS_STRING:
2692	/*
2693	* Strings are indexed from 1 (0 is reserved
2694	* for languages list)
2695	*/
2696	if (*valuep > helper->ffs->strings_count)
2697	helper->ffs->strings_count = *valuep;
2698	break;
2699
2700	case FFS_ENDPOINT:
2701	d = (void *)desc;
2702	helper->eps_count++;
2703	if (helper->eps_count >= FFS_MAX_EPS_COUNT)
2704	return -EINVAL;
2705	/* Check if descriptors for any speed were already parsed */
2706	if (!helper->ffs->eps_count && !helper->ffs->interfaces_count)
2707	helper->ffs->eps_addrmap[helper->eps_count] =
2708	d->bEndpointAddress;
2709	else if (helper->ffs->eps_addrmap[helper->eps_count] !=
2710	d->bEndpointAddress)
2711	return -EINVAL;
2712	break;
2713	}
2714
2715	return 0;
2716	}
2717
2718	static int __ffs_do_os_desc_header(enum ffs_os_desc_type *next_type,
2719	struct usb_os_desc_header *desc)
2720	{
2721	u16 bcd_version = le16_to_cpu(desc->bcdVersion);
2722	u16 w_index = le16_to_cpu(desc->wIndex);
2723
2724	if (bcd_version == 0x1) {
2725	pr_warn("bcdVersion must be 0x0100, stored in Little Endian order. "
2726	"Userspace driver should be fixed, accepting 0x0001 for compatibility.\n");
2727	} else if (bcd_version != 0x100) {
2728	pr_vdebug("unsupported os descriptors version: 0x%x\n",
2729	bcd_version);
2730	return -EINVAL;
2731	}
2732	switch (w_index) {
2733	case 0x4:
2734	*next_type = FFS_OS_DESC_EXT_COMPAT;
2735	break;
2736	case 0x5:
2737	*next_type = FFS_OS_DESC_EXT_PROP;
2738	break;
2739	default:
2740	pr_vdebug("unsupported os descriptor type: %d", w_index);
2741	return -EINVAL;
2742	}
2743
2744	return sizeof(*desc);
2745	}
2746
2747	/*
2748	* Process all extended compatibility/extended property descriptors
2749	* of a feature descriptor
2750	*/
2751	static int __must_check ffs_do_single_os_desc(char *data, unsigned len,
2752	enum ffs_os_desc_type type,
2753	u16 feature_count,
2754	ffs_os_desc_callback entity,
2755	void *priv,
2756	struct usb_os_desc_header *h)
2757	{
2758	int ret;
2759	const unsigned _len = len;
2760
2761	/* loop over all ext compat/ext prop descriptors */
2762	while (feature_count--) {
2763	ret = entity(type, h, data, len, priv);
2764	if (ret < 0) {
2765	pr_debug("bad OS descriptor, type: %d\n", type);
2766	return ret;
2767	}
2768	data += ret;
2769	len -= ret;
2770	}
2771	return _len - len;
2772	}
2773
2774	/* Process a number of complete Feature Descriptors (Ext Compat or Ext Prop) */
2775	static int __must_check ffs_do_os_descs(unsigned count,
2776	char *data, unsigned len,
2777	ffs_os_desc_callback entity, void *priv)
2778	{
2779	const unsigned _len = len;
2780	unsigned long num = 0;
2781
2782	for (num = 0; num < count; ++num) {
2783	int ret;
2784	enum ffs_os_desc_type type;
2785	u16 feature_count;
2786	struct usb_os_desc_header *desc = (void *)data;
2787
2788	if (len < sizeof(*desc))
2789	return -EINVAL;
2790
2791	/*
2792	* Record "descriptor" entity.
2793	* Process dwLength, bcdVersion, wIndex, get b/wCount.
2794	* Move the data pointer to the beginning of extended
2795	* compatibilities proper or extended properties proper
2796	* portions of the data
2797	*/
2798	if (le32_to_cpu(desc->dwLength) > len)
2799	return -EINVAL;
2800
2801	ret = __ffs_do_os_desc_header(next_type: &type, desc);
2802	if (ret < 0) {
2803	pr_debug("entity OS_DESCRIPTOR(%02lx); ret = %d\n",
2804	num, ret);
2805	return ret;
2806	}
2807	/*
2808	* 16-bit hex "?? 00" Little Endian looks like 8-bit hex "??"
2809	*/
2810	feature_count = le16_to_cpu(desc->wCount);
2811	if (type == FFS_OS_DESC_EXT_COMPAT &&
2812	(feature_count > 255 || desc->Reserved))
2813	return -EINVAL;
2814	len -= ret;
2815	data += ret;
2816
2817	/*
2818	* Process all function/property descriptors
2819	* of this Feature Descriptor
2820	*/
2821	ret = ffs_do_single_os_desc(data, len, type,
2822	feature_count, entity, priv, h: desc);
2823	if (ret < 0) {
2824	pr_debug("%s returns %d\n", __func__, ret);
2825	return ret;
2826	}
2827
2828	len -= ret;
2829	data += ret;
2830	}
2831	return _len - len;
2832	}
2833
2834	/*
2835	* Validate contents of the buffer from userspace related to OS descriptors.
2836	*/
2837	static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
2838	struct usb_os_desc_header *h, void *data,
2839	unsigned len, void *priv)
2840	{
2841	struct ffs_data *ffs = priv;
2842	u8 length;
2843
2844	switch (type) {
2845	case FFS_OS_DESC_EXT_COMPAT: {
2846	struct usb_ext_compat_desc *d = data;
2847	int i;
2848
2849	if (len < sizeof(*d) ||
2850	d->bFirstInterfaceNumber >= ffs->interfaces_count)
2851	return -EINVAL;
2852	if (d->Reserved1 != 1) {
2853	/*
2854	* According to the spec, Reserved1 must be set to 1
2855	* but older kernels incorrectly rejected non-zero
2856	* values. We fix it here to avoid returning EINVAL
2857	* in response to values we used to accept.
2858	*/
2859	pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n");
2860	d->Reserved1 = 1;
2861	}
2862	for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
2863	if (d->Reserved2[i])
2864	return -EINVAL;
2865
2866	length = sizeof(struct usb_ext_compat_desc);
2867	}
2868	break;
2869	case FFS_OS_DESC_EXT_PROP: {
2870	struct usb_ext_prop_desc *d = data;
2871	u32 type, pdl;
2872	u16 pnl;
2873
2874	if (len < sizeof(*d) || h->interface >= ffs->interfaces_count)
2875	return -EINVAL;
2876	length = le32_to_cpu(d->dwSize);
2877	if (len < length)
2878	return -EINVAL;
2879	type = le32_to_cpu(d->dwPropertyDataType);
2880	if (type < USB_EXT_PROP_UNICODE ||
2881	type > USB_EXT_PROP_UNICODE_MULTI) {
2882	pr_vdebug("unsupported os descriptor property type: %d",
2883	type);
2884	return -EINVAL;
2885	}
2886	pnl = le16_to_cpu(d->wPropertyNameLength);
2887	if (length < 14 + pnl) {
2888	pr_vdebug("invalid os descriptor length: %d pnl:%d (descriptor %d)\n",
2889	length, pnl, type);
2890	return -EINVAL;
2891	}
2892	pdl = le32_to_cpu(*(__le32 *)((u8 *)data + 10 + pnl));
2893	if (length != 14 + pnl + pdl) {
2894	pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n",
2895	length, pnl, pdl, type);
2896	return -EINVAL;
2897	}
2898	++ffs->ms_os_descs_ext_prop_count;
2899	/* property name reported to the host as "WCHAR"s */
2900	ffs->ms_os_descs_ext_prop_name_len += pnl * 2;
2901	ffs->ms_os_descs_ext_prop_data_len += pdl;
2902	}
2903	break;
2904	default:
2905	pr_vdebug("unknown descriptor: %d\n", type);
2906	return -EINVAL;
2907	}
2908	return length;
2909	}
2910
2911	static int __ffs_data_got_descs(struct ffs_data *ffs,
2912	char *const _data, size_t len)
2913	{
2914	char *data = _data, *raw_descs;
2915	unsigned os_descs_count = 0, counts[3], flags;
2916	int ret = -EINVAL, i;
2917	struct ffs_desc_helper helper;
2918
2919	if (get_unaligned_le32(p: data + 4) != len)
2920	goto error;
2921
2922	switch (get_unaligned_le32(p: data)) {
2923	case FUNCTIONFS_DESCRIPTORS_MAGIC:
2924	flags = FUNCTIONFS_HAS_FS_DESC | FUNCTIONFS_HAS_HS_DESC;
2925	data += 8;
2926	len -= 8;
2927	break;
2928	case FUNCTIONFS_DESCRIPTORS_MAGIC_V2:
2929	flags = get_unaligned_le32(p: data + 8);
2930	ffs->user_flags = flags;
2931	if (flags & ~(FUNCTIONFS_HAS_FS_DESC |
2932	FUNCTIONFS_HAS_HS_DESC |
2933	FUNCTIONFS_HAS_SS_DESC |
2934	FUNCTIONFS_HAS_MS_OS_DESC |
2935	FUNCTIONFS_VIRTUAL_ADDR |
2936	FUNCTIONFS_EVENTFD |
2937	FUNCTIONFS_ALL_CTRL_RECIP |
2938	FUNCTIONFS_CONFIG0_SETUP)) {
2939	ret = -ENOSYS;
2940	goto error;
2941	}
2942	data += 12;
2943	len -= 12;
2944	break;
2945	default:
2946	goto error;
2947	}
2948
2949	if (flags & FUNCTIONFS_EVENTFD) {
2950	if (len < 4)
2951	goto error;
2952	ffs->ffs_eventfd =
2953	eventfd_ctx_fdget(fd: (int)get_unaligned_le32(p: data));
2954	if (IS_ERR(ptr: ffs->ffs_eventfd)) {
2955	ret = PTR_ERR(ptr: ffs->ffs_eventfd);
2956	ffs->ffs_eventfd = NULL;
2957	goto error;
2958	}
2959	data += 4;
2960	len -= 4;
2961	}
2962
2963	/* Read fs_count, hs_count and ss_count (if present) */
2964	for (i = 0; i < 3; ++i) {
2965	if (!(flags & (1 << i))) {
2966	counts[i] = 0;
2967	} else if (len < 4) {
2968	goto error;
2969	} else {
2970	counts[i] = get_unaligned_le32(p: data);
2971	data += 4;
2972	len -= 4;
2973	}
2974	}
2975	if (flags & (1 << i)) {
2976	if (len < 4) {
2977	goto error;
2978	}
2979	os_descs_count = get_unaligned_le32(p: data);
2980	data += 4;
2981	len -= 4;
2982	}
2983
2984	/* Read descriptors */
2985	raw_descs = data;
2986	helper.ffs = ffs;
2987	for (i = 0; i < 3; ++i) {
2988	if (!counts[i])
2989	continue;
2990	helper.interfaces_count = 0;
2991	helper.eps_count = 0;
2992	ret = ffs_do_descs(count: counts[i], data, len,
2993	entity: __ffs_data_do_entity, priv: &helper);
2994	if (ret < 0)
2995	goto error;
2996	if (!ffs->eps_count && !ffs->interfaces_count) {
2997	ffs->eps_count = helper.eps_count;
2998	ffs->interfaces_count = helper.interfaces_count;
2999	} else {
3000	if (ffs->eps_count != helper.eps_count) {
3001	ret = -EINVAL;
3002	goto error;
3003	}
3004	if (ffs->interfaces_count != helper.interfaces_count) {
3005	ret = -EINVAL;
3006	goto error;
3007	}
3008	}
3009	data += ret;
3010	len -= ret;
3011	}
3012	if (os_descs_count) {
3013	ret = ffs_do_os_descs(count: os_descs_count, data, len,
3014	entity: __ffs_data_do_os_desc, priv: ffs);
3015	if (ret < 0)
3016	goto error;
3017	data += ret;
3018	len -= ret;
3019	}
3020
3021	if (raw_descs == data || len) {
3022	ret = -EINVAL;
3023	goto error;
3024	}
3025
3026	ffs->raw_descs_data = _data;
3027	ffs->raw_descs = raw_descs;
3028	ffs->raw_descs_length = data - raw_descs;
3029	ffs->fs_descs_count = counts[0];
3030	ffs->hs_descs_count = counts[1];
3031	ffs->ss_descs_count = counts[2];
3032	ffs->ms_os_descs_count = os_descs_count;
3033
3034	return 0;
3035
3036	error:
3037	kfree(objp: _data);
3038	return ret;
3039	}
3040
3041	static int __ffs_data_got_strings(struct ffs_data *ffs,
3042	char *const _data, size_t len)
3043	{
3044	u32 str_count, needed_count, lang_count;
3045	struct usb_gadget_strings **stringtabs, *t;
3046	const char *data = _data;
3047	struct usb_string *s;
3048
3049	if (len < 16 ||
3050	get_unaligned_le32(p: data) != FUNCTIONFS_STRINGS_MAGIC ||
3051	get_unaligned_le32(p: data + 4) != len)
3052	goto error;
3053	str_count = get_unaligned_le32(p: data + 8);
3054	lang_count = get_unaligned_le32(p: data + 12);
3055
3056	/* if one is zero the other must be zero */
3057	if (!str_count != !lang_count)
3058	goto error;
3059
3060	/* Do we have at least as many strings as descriptors need? */
3061	needed_count = ffs->strings_count;
3062	if (str_count < needed_count)
3063	goto error;
3064
3065	/*
3066	* If we don't need any strings just return and free all
3067	* memory.
3068	*/
3069	if (!needed_count) {
3070	kfree(objp: _data);
3071	return 0;
3072	}
3073
3074	/* Allocate everything in one chunk so there's less maintenance. */
3075	{
3076	unsigned i = 0;
3077	vla_group(d);
3078	vla_item(d, struct usb_gadget_strings *, stringtabs,
3079	size_add(lang_count, 1));
3080	vla_item(d, struct usb_gadget_strings, stringtab, lang_count);
3081	vla_item(d, struct usb_string, strings,
3082	size_mul(lang_count, (needed_count + 1)));
3083
3084	char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL);
3085
3086	if (!vlabuf) {
3087	kfree(objp: _data);
3088	return -ENOMEM;
3089	}
3090
3091	/* Initialize the VLA pointers */
3092	stringtabs = vla_ptr(vlabuf, d, stringtabs);
3093	t = vla_ptr(vlabuf, d, stringtab);
3094	i = lang_count;
3095	do {
3096	*stringtabs++ = t++;
3097	} while (--i);
3098	*stringtabs = NULL;
3099
3100	/* stringtabs = vlabuf = d_stringtabs for later kfree */
3101	stringtabs = vla_ptr(vlabuf, d, stringtabs);
3102	t = vla_ptr(vlabuf, d, stringtab);
3103	s = vla_ptr(vlabuf, d, strings);
3104	}
3105
3106	/* For each language */
3107	data += 16;
3108	len -= 16;
3109
3110	do { /* lang_count > 0 so we can use do-while */
3111	unsigned needed = needed_count;
3112	u32 str_per_lang = str_count;
3113
3114	if (len < 3)
3115	goto error_free;
3116	t->language = get_unaligned_le16(p: data);
3117	t->strings = s;
3118	++t;
3119
3120	data += 2;
3121	len -= 2;
3122
3123	/* For each string */
3124	do { /* str_count > 0 so we can use do-while */
3125	size_t length = strnlen(p: data, maxlen: len);
3126
3127	if (length == len)
3128	goto error_free;
3129
3130	/*
3131	* User may provide more strings then we need,
3132	* if that's the case we simply ignore the
3133	* rest
3134	*/
3135	if (needed) {
3136	/*
3137	* s->id will be set while adding
3138	* function to configuration so for
3139	* now just leave garbage here.
3140	*/
3141	s->s = data;
3142	--needed;
3143	++s;
3144	}
3145
3146	data += length + 1;
3147	len -= length + 1;
3148	} while (--str_per_lang);
3149
3150	s->id = 0; /* terminator */
3151	s->s = NULL;
3152	++s;
3153
3154	} while (--lang_count);
3155
3156	/* Some garbage left? */
3157	if (len)
3158	goto error_free;
3159
3160	/* Done! */
3161	ffs->stringtabs = stringtabs;
3162	ffs->raw_strings = _data;
3163
3164	return 0;
3165
3166	error_free:
3167	kfree(objp: stringtabs);
3168	error:
3169	kfree(objp: _data);
3170	return -EINVAL;
3171	}
3172
3173
3174	/* Events handling and management *******************************************/
3175
3176	static void __ffs_event_add(struct ffs_data *ffs,
3177	enum usb_functionfs_event_type type)
3178	{
3179	enum usb_functionfs_event_type rem_type1, rem_type2 = type;
3180	int neg = 0;
3181
3182	/*
3183	* Abort any unhandled setup
3184	*
3185	* We do not need to worry about some cmpxchg() changing value
3186	* of ffs->setup_state without holding the lock because when
3187	* state is FFS_SETUP_PENDING cmpxchg() in several places in
3188	* the source does nothing.
3189	*/
3190	if (ffs->setup_state == FFS_SETUP_PENDING)
3191	ffs->setup_state = FFS_SETUP_CANCELLED;
3192
3193	/*
3194	* Logic of this function guarantees that there are at most four pending
3195	* evens on ffs->ev.types queue. This is important because the queue
3196	* has space for four elements only and __ffs_ep0_read_events function
3197	* depends on that limit as well. If more event types are added, those
3198	* limits have to be revisited or guaranteed to still hold.
3199	*/
3200	switch (type) {
3201	case FUNCTIONFS_RESUME:
3202	rem_type2 = FUNCTIONFS_SUSPEND;
3203	fallthrough;
3204	case FUNCTIONFS_SUSPEND:
3205	case FUNCTIONFS_SETUP:
3206	rem_type1 = type;
3207	/* Discard all similar events */
3208	break;
3209
3210	case FUNCTIONFS_BIND:
3211	case FUNCTIONFS_UNBIND:
3212	case FUNCTIONFS_DISABLE:
3213	case FUNCTIONFS_ENABLE:
3214	/* Discard everything other then power management. */
3215	rem_type1 = FUNCTIONFS_SUSPEND;
3216	rem_type2 = FUNCTIONFS_RESUME;
3217	neg = 1;
3218	break;
3219
3220	default:
3221	WARN(1, "%d: unknown event, this should not happen\n", type);
3222	return;
3223	}
3224
3225	{
3226	u8 *ev = ffs->ev.types, *out = ev;
3227	unsigned n = ffs->ev.count;
3228	for (; n; --n, ++ev)
3229	if ((*ev == rem_type1 || *ev == rem_type2) == neg)
3230	*out++ = *ev;
3231	else
3232	pr_vdebug("purging event %d\n", *ev);
3233	ffs->ev.count = out - ffs->ev.types;
3234	}
3235
3236	pr_vdebug("adding event %d\n", type);
3237	ffs->ev.types[ffs->ev.count++] = type;
3238	wake_up_locked(&ffs->ev.waitq);
3239	if (ffs->ffs_eventfd)
3240	eventfd_signal(ctx: ffs->ffs_eventfd);
3241	}
3242
3243	static void ffs_event_add(struct ffs_data *ffs,
3244	enum usb_functionfs_event_type type)
3245	{
3246	unsigned long flags;
3247	spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
3248	__ffs_event_add(ffs, type);
3249	spin_unlock_irqrestore(lock: &ffs->ev.waitq.lock, flags);
3250	}
3251
3252	/* Bind/unbind USB function hooks *******************************************/
3253
3254	static int ffs_ep_addr2idx(struct ffs_data *ffs, u8 endpoint_address)
3255	{
3256	int i;
3257
3258	for (i = 1; i < ARRAY_SIZE(ffs->eps_addrmap); ++i)
3259	if (ffs->eps_addrmap[i] == endpoint_address)
3260	return i;
3261	return -ENOENT;
3262	}
3263
3264	static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
3265	struct usb_descriptor_header *desc,
3266	void *priv)
3267	{
3268	struct usb_endpoint_descriptor *ds = (void *)desc;
3269	struct ffs_function *func = priv;
3270	struct ffs_ep *ffs_ep;
3271	unsigned ep_desc_id;
3272	int idx;
3273	static const char *speed_names[] = { "full", "high", "super" };
3274
3275	if (type != FFS_DESCRIPTOR)
3276	return 0;
3277
3278	/*
3279	* If ss_descriptors is not NULL, we are reading super speed
3280	* descriptors; if hs_descriptors is not NULL, we are reading high
3281	* speed descriptors; otherwise, we are reading full speed
3282	* descriptors.
3283	*/
3284	if (func->function.ss_descriptors) {
3285	ep_desc_id = 2;
3286	func->function.ss_descriptors[(long)valuep] = desc;
3287	} else if (func->function.hs_descriptors) {
3288	ep_desc_id = 1;
3289	func->function.hs_descriptors[(long)valuep] = desc;
3290	} else {
3291	ep_desc_id = 0;
3292	func->function.fs_descriptors[(long)valuep] = desc;
3293	}
3294
3295	if (!desc || desc->bDescriptorType != USB_DT_ENDPOINT)
3296	return 0;
3297
3298	idx = ffs_ep_addr2idx(ffs: func->ffs, endpoint_address: ds->bEndpointAddress) - 1;
3299	if (idx < 0)
3300	return idx;
3301
3302	ffs_ep = func->eps + idx;
3303
3304	if (ffs_ep->descs[ep_desc_id]) {
3305	pr_err("two %sspeed descriptors for EP %d\n",
3306	speed_names[ep_desc_id],
3307	usb_endpoint_num(ds));
3308	return -EINVAL;
3309	}
3310	ffs_ep->descs[ep_desc_id] = ds;
3311
3312	ffs_dump_mem(": Original ep desc", ds, ds->bLength);
3313	if (ffs_ep->ep) {
3314	ds->bEndpointAddress = ffs_ep->descs[0]->bEndpointAddress;
3315	if (!ds->wMaxPacketSize)
3316	ds->wMaxPacketSize = ffs_ep->descs[0]->wMaxPacketSize;
3317	} else {
3318	struct usb_request *req;
3319	struct usb_ep *ep;
3320	u8 bEndpointAddress;
3321	u16 wMaxPacketSize;
3322
3323	/*
3324	* We back up bEndpointAddress because autoconfig overwrites
3325	* it with physical endpoint address.
3326	*/
3327	bEndpointAddress = ds->bEndpointAddress;
3328	/*
3329	* We back up wMaxPacketSize because autoconfig treats
3330	* endpoint descriptors as if they were full speed.
3331	*/
3332	wMaxPacketSize = ds->wMaxPacketSize;
3333	pr_vdebug("autoconfig\n");
3334	ep = usb_ep_autoconfig(func->gadget, ds);
3335	if (!ep)
3336	return -ENOTSUPP;
3337	ep->driver_data = func->eps + idx;
3338
3339	req = usb_ep_alloc_request(ep, GFP_KERNEL);
3340	if (!req)
3341	return -ENOMEM;
3342
3343	ffs_ep->ep = ep;
3344	ffs_ep->req = req;
3345	func->eps_revmap[ds->bEndpointAddress &
3346	USB_ENDPOINT_NUMBER_MASK] = idx + 1;
3347	/*
3348	* If we use virtual address mapping, we restore
3349	* original bEndpointAddress value.
3350	*/
3351	if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
3352	ds->bEndpointAddress = bEndpointAddress;
3353	/*
3354	* Restore wMaxPacketSize which was potentially
3355	* overwritten by autoconfig.
3356	*/
3357	ds->wMaxPacketSize = wMaxPacketSize;
3358	}
3359	ffs_dump_mem(": Rewritten ep desc", ds, ds->bLength);
3360
3361	return 0;
3362	}
3363
3364	static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep,
3365	struct usb_descriptor_header *desc,
3366	void *priv)
3367	{
3368	struct ffs_function *func = priv;
3369	unsigned idx;
3370	u8 newValue;
3371
3372	switch (type) {
3373	default:
3374	case FFS_DESCRIPTOR:
3375	/* Handled in previous pass by __ffs_func_bind_do_descs() */
3376	return 0;
3377
3378	case FFS_INTERFACE:
3379	idx = *valuep;
3380	if (func->interfaces_nums[idx] < 0) {
3381	int id = usb_interface_id(func->conf, &func->function);
3382	if (id < 0)
3383	return id;
3384	func->interfaces_nums[idx] = id;
3385	}
3386	newValue = func->interfaces_nums[idx];
3387	break;
3388
3389	case FFS_STRING:
3390	/* String' IDs are allocated when fsf_data is bound to cdev */
3391	newValue = func->ffs->stringtabs[0]->strings[*valuep - 1].id;
3392	break;
3393
3394	case FFS_ENDPOINT:
3395	/*
3396	* USB_DT_ENDPOINT are handled in
3397	* __ffs_func_bind_do_descs().
3398	*/
3399	if (desc->bDescriptorType == USB_DT_ENDPOINT)
3400	return 0;
3401
3402	idx = (*valuep & USB_ENDPOINT_NUMBER_MASK) - 1;
3403	if (!func->eps[idx].ep)
3404	return -EINVAL;
3405
3406	{
3407	struct usb_endpoint_descriptor **descs;
3408	descs = func->eps[idx].descs;
3409	newValue = descs[descs[0] ? 0 : 1]->bEndpointAddress;
3410	}
3411	break;
3412	}
3413
3414	pr_vdebug("%02x -> %02x\n", *valuep, newValue);
3415	*valuep = newValue;
3416	return 0;
3417	}
3418
3419	static int __ffs_func_bind_do_os_desc(enum ffs_os_desc_type type,
3420	struct usb_os_desc_header *h, void *data,
3421	unsigned len, void *priv)
3422	{
3423	struct ffs_function *func = priv;
3424	u8 length = 0;
3425
3426	switch (type) {
3427	case FFS_OS_DESC_EXT_COMPAT: {
3428	struct usb_ext_compat_desc *desc = data;
3429	struct usb_os_desc_table *t;
3430
3431	t = &func->function.os_desc_table[desc->bFirstInterfaceNumber];
3432	t->if_id = func->interfaces_nums[desc->bFirstInterfaceNumber];
3433	memcpy(t->os_desc->ext_compat_id, &desc->IDs,
3434	sizeof_field(struct usb_ext_compat_desc, IDs));
3435	length = sizeof(*desc);
3436	}
3437	break;
3438	case FFS_OS_DESC_EXT_PROP: {
3439	struct usb_ext_prop_desc *desc = data;
3440	struct usb_os_desc_table *t;
3441	struct usb_os_desc_ext_prop *ext_prop;
3442	char *ext_prop_name;
3443	char *ext_prop_data;
3444
3445	t = &func->function.os_desc_table[h->interface];
3446	t->if_id = func->interfaces_nums[h->interface];
3447
3448	ext_prop = func->ffs->ms_os_descs_ext_prop_avail;
3449	func->ffs->ms_os_descs_ext_prop_avail += sizeof(*ext_prop);
3450
3451	ext_prop->type = le32_to_cpu(desc->dwPropertyDataType);
3452	ext_prop->name_len = le16_to_cpu(desc->wPropertyNameLength);
3453	ext_prop->data_len = le32_to_cpu(*(__le32 *)
3454	usb_ext_prop_data_len_ptr(data, ext_prop->name_len));
3455	length = ext_prop->name_len + ext_prop->data_len + 14;
3456
3457	ext_prop_name = func->ffs->ms_os_descs_ext_prop_name_avail;
3458	func->ffs->ms_os_descs_ext_prop_name_avail +=
3459	ext_prop->name_len;
3460
3461	ext_prop_data = func->ffs->ms_os_descs_ext_prop_data_avail;
3462	func->ffs->ms_os_descs_ext_prop_data_avail +=
3463	ext_prop->data_len;
3464	memcpy(ext_prop_data,
3465	usb_ext_prop_data_ptr(data, ext_prop->name_len),
3466	ext_prop->data_len);
3467	/* unicode data reported to the host as "WCHAR"s */
3468	switch (ext_prop->type) {
3469	case USB_EXT_PROP_UNICODE:
3470	case USB_EXT_PROP_UNICODE_ENV:
3471	case USB_EXT_PROP_UNICODE_LINK:
3472	case USB_EXT_PROP_UNICODE_MULTI:
3473	ext_prop->data_len *= 2;
3474	break;
3475	}
3476	ext_prop->data = ext_prop_data;
3477
3478	memcpy(ext_prop_name, usb_ext_prop_name_ptr(data),
3479	ext_prop->name_len);
3480	/* property name reported to the host as "WCHAR"s */
3481	ext_prop->name_len *= 2;
3482	ext_prop->name = ext_prop_name;
3483
3484	t->os_desc->ext_prop_len +=
3485	ext_prop->name_len + ext_prop->data_len + 14;
3486	++t->os_desc->ext_prop_count;
3487	list_add_tail(new: &ext_prop->entry, head: &t->os_desc->ext_prop);
3488	}
3489	break;
3490	default:
3491	pr_vdebug("unknown descriptor: %d\n", type);
3492	}
3493
3494	return length;
3495	}
3496
3497	static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f,
3498	struct usb_configuration *c)
3499	{
3500	struct ffs_function *func = ffs_func_from_usb(f);
3501	struct f_fs_opts *ffs_opts =
3502	container_of(f->fi, struct f_fs_opts, func_inst);
3503	struct ffs_data *ffs_data;
3504	int ret;
3505
3506	/*
3507	* Legacy gadget triggers binding in functionfs_ready_callback,
3508	* which already uses locking; taking the same lock here would
3509	* cause a deadlock.
3510	*
3511	* Configfs-enabled gadgets however do need ffs_dev_lock.
3512	*/
3513	if (!ffs_opts->no_configfs)
3514	ffs_dev_lock();
3515	ret = ffs_opts->dev->desc_ready ? 0 : -ENODEV;
3516	ffs_data = ffs_opts->dev->ffs_data;
3517	if (!ffs_opts->no_configfs)
3518	ffs_dev_unlock();
3519	if (ret)
3520	return ERR_PTR(error: ret);
3521
3522	func->ffs = ffs_data;
3523	func->conf = c;
3524	func->gadget = c->cdev->gadget;
3525
3526	/*
3527	* in drivers/usb/gadget/configfs.c:configfs_composite_bind()
3528	* configurations are bound in sequence with list_for_each_entry,
3529	* in each configuration its functions are bound in sequence
3530	* with list_for_each_entry, so we assume no race condition
3531	* with regard to ffs_opts->bound access
3532	*/
3533	if (!ffs_opts->refcnt) {
3534	ret = functionfs_bind(ffs: func->ffs, cdev: c->cdev);
3535	if (ret)
3536	return ERR_PTR(error: ret);
3537	}
3538	ffs_opts->refcnt++;
3539	func->function.strings = func->ffs->stringtabs;
3540
3541	return ffs_opts;
3542	}
3543
3544	static int _ffs_func_bind(struct usb_configuration *c,
3545	struct usb_function *f)
3546	{
3547	struct ffs_function *func = ffs_func_from_usb(f);
3548	struct ffs_data *ffs = func->ffs;
3549
3550	const int full = !!func->ffs->fs_descs_count;
3551	const int high = !!func->ffs->hs_descs_count;
3552	const int super = !!func->ffs->ss_descs_count;
3553
3554	int fs_len, hs_len, ss_len, ret, i;
3555	struct ffs_ep *eps_ptr;
3556
3557	/* Make it a single chunk, less management later on */
3558	vla_group(d);
3559	vla_item_with_sz(d, struct ffs_ep, eps, ffs->eps_count);
3560	vla_item_with_sz(d, struct usb_descriptor_header *, fs_descs,
3561	full ? ffs->fs_descs_count + 1 : 0);
3562	vla_item_with_sz(d, struct usb_descriptor_header *, hs_descs,
3563	high ? ffs->hs_descs_count + 1 : 0);
3564	vla_item_with_sz(d, struct usb_descriptor_header *, ss_descs,
3565	super ? ffs->ss_descs_count + 1 : 0);
3566	vla_item_with_sz(d, short, inums, ffs->interfaces_count);
3567	vla_item_with_sz(d, struct usb_os_desc_table, os_desc_table,
3568	c->cdev->use_os_string ? ffs->interfaces_count : 0);
3569	vla_item_with_sz(d, char[16], ext_compat,
3570	c->cdev->use_os_string ? ffs->interfaces_count : 0);
3571	vla_item_with_sz(d, struct usb_os_desc, os_desc,
3572	c->cdev->use_os_string ? ffs->interfaces_count : 0);
3573	vla_item_with_sz(d, struct usb_os_desc_ext_prop, ext_prop,
3574	ffs->ms_os_descs_ext_prop_count);
3575	vla_item_with_sz(d, char, ext_prop_name,
3576	ffs->ms_os_descs_ext_prop_name_len);
3577	vla_item_with_sz(d, char, ext_prop_data,
3578	ffs->ms_os_descs_ext_prop_data_len);
3579	vla_item_with_sz(d, char, raw_descs, ffs->raw_descs_length);
3580	char *vlabuf;
3581
3582	/* Has descriptors only for speeds gadget does not support */
3583	if (!(full | high | super))
3584	return -ENOTSUPP;
3585
3586	/* Allocate a single chunk, less management later on */
3587	vlabuf = kzalloc(vla_group_size(d), GFP_KERNEL);
3588	if (!vlabuf)
3589	return -ENOMEM;
3590
3591	ffs->ms_os_descs_ext_prop_avail = vla_ptr(vlabuf, d, ext_prop);
3592	ffs->ms_os_descs_ext_prop_name_avail =
3593	vla_ptr(vlabuf, d, ext_prop_name);
3594	ffs->ms_os_descs_ext_prop_data_avail =
3595	vla_ptr(vlabuf, d, ext_prop_data);
3596
3597	/* Copy descriptors */
3598	memcpy(vla_ptr(vlabuf, d, raw_descs), ffs->raw_descs,
3599	ffs->raw_descs_length);
3600
3601	memset(vla_ptr(vlabuf, d, inums), 0xff, d_inums__sz);
3602	eps_ptr = vla_ptr(vlabuf, d, eps);
3603	for (i = 0; i < ffs->eps_count; i++)
3604	eps_ptr[i].num = -1;
3605
3606	/* Save pointers
3607	* d_eps == vlabuf, func->eps used to kfree vlabuf later
3608	*/
3609	func->eps = vla_ptr(vlabuf, d, eps);
3610	func->interfaces_nums = vla_ptr(vlabuf, d, inums);
3611
3612	/*
3613	* Go through all the endpoint descriptors and allocate
3614	* endpoints first, so that later we can rewrite the endpoint
3615	* numbers without worrying that it may be described later on.
3616	*/
3617	if (full) {
3618	func->function.fs_descriptors = vla_ptr(vlabuf, d, fs_descs);
3619	fs_len = ffs_do_descs(count: ffs->fs_descs_count,
3620	vla_ptr(vlabuf, d, raw_descs),
3621	len: d_raw_descs__sz,
3622	entity: __ffs_func_bind_do_descs, priv: func);
3623	if (fs_len < 0) {
3624	ret = fs_len;
3625	goto error;
3626	}
3627	} else {
3628	fs_len = 0;
3629	}
3630
3631	if (high) {
3632	func->function.hs_descriptors = vla_ptr(vlabuf, d, hs_descs);
3633	hs_len = ffs_do_descs(count: ffs->hs_descs_count,
3634	vla_ptr(vlabuf, d, raw_descs) + fs_len,
3635	len: d_raw_descs__sz - fs_len,
3636	entity: __ffs_func_bind_do_descs, priv: func);
3637	if (hs_len < 0) {
3638	ret = hs_len;
3639	goto error;
3640	}
3641	} else {
3642	hs_len = 0;
3643	}
3644
3645	if (super) {
3646	func->function.ss_descriptors = func->function.ssp_descriptors =
3647	vla_ptr(vlabuf, d, ss_descs);
3648	ss_len = ffs_do_descs(count: ffs->ss_descs_count,
3649	vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len,
3650	len: d_raw_descs__sz - fs_len - hs_len,
3651	entity: __ffs_func_bind_do_descs, priv: func);
3652	if (ss_len < 0) {
3653	ret = ss_len;
3654	goto error;
3655	}
3656	} else {
3657	ss_len = 0;
3658	}
3659
3660	/*
3661	* Now handle interface numbers allocation and interface and
3662	* endpoint numbers rewriting. We can do that in one go
3663	* now.
3664	*/
3665	ret = ffs_do_descs(count: ffs->fs_descs_count +
3666	(high ? ffs->hs_descs_count : 0) +
3667	(super ? ffs->ss_descs_count : 0),
3668	vla_ptr(vlabuf, d, raw_descs), len: d_raw_descs__sz,
3669	entity: __ffs_func_bind_do_nums, priv: func);
3670	if (ret < 0)
3671	goto error;
3672
3673	func->function.os_desc_table = vla_ptr(vlabuf, d, os_desc_table);
3674	if (c->cdev->use_os_string) {
3675	for (i = 0; i < ffs->interfaces_count; ++i) {
3676	struct usb_os_desc *desc;
3677
3678	desc = func->function.os_desc_table[i].os_desc =
3679	vla_ptr(vlabuf, d, os_desc) +
3680	i * sizeof(struct usb_os_desc);
3681	desc->ext_compat_id =
3682	vla_ptr(vlabuf, d, ext_compat) + i * 16;
3683	INIT_LIST_HEAD(list: &desc->ext_prop);
3684	}
3685	ret = ffs_do_os_descs(count: ffs->ms_os_descs_count,
3686	vla_ptr(vlabuf, d, raw_descs) +
3687	fs_len + hs_len + ss_len,
3688	len: d_raw_descs__sz - fs_len - hs_len -
3689	ss_len,
3690	entity: __ffs_func_bind_do_os_desc, priv: func);
3691	if (ret < 0)
3692	goto error;
3693	}
3694	func->function.os_desc_n =
3695	c->cdev->use_os_string ? ffs->interfaces_count : 0;
3696
3697	/* And we're done */
3698	ffs_event_add(ffs, type: FUNCTIONFS_BIND);
3699	return 0;
3700
3701	error:
3702	/* XXX Do we need to release all claimed endpoints here? */
3703	return ret;
3704	}
3705
3706	static int ffs_func_bind(struct usb_configuration *c,
3707	struct usb_function *f)
3708	{
3709	struct f_fs_opts *ffs_opts = ffs_do_functionfs_bind(f, c);
3710	struct ffs_function *func = ffs_func_from_usb(f);
3711	int ret;
3712
3713	if (IS_ERR(ptr: ffs_opts))
3714	return PTR_ERR(ptr: ffs_opts);
3715
3716	ret = _ffs_func_bind(c, f);
3717	if (ret && !--ffs_opts->refcnt)
3718	functionfs_unbind(ffs: func->ffs);
3719
3720	return ret;
3721	}
3722
3723
3724	/* Other USB function hooks *************************************************/
3725
3726	static void ffs_reset_work(struct work_struct *work)
3727	{
3728	struct ffs_data *ffs = container_of(work,
3729	struct ffs_data, reset_work);
3730	ffs_data_reset(ffs);
3731	}
3732
3733	static int ffs_func_get_alt(struct usb_function *f,
3734	unsigned int interface)
3735	{
3736	struct ffs_function *func = ffs_func_from_usb(f);
3737	int intf = ffs_func_revmap_intf(func, intf: interface);
3738
3739	return (intf < 0) ? intf : func->cur_alt[interface];
3740	}
3741
3742	static int ffs_func_set_alt(struct usb_function *f,
3743	unsigned interface, unsigned alt)
3744	{
3745	struct ffs_function *func = ffs_func_from_usb(f);
3746	struct ffs_data *ffs = func->ffs;
3747	unsigned long flags;
3748	int ret = 0, intf;
3749
3750	if (alt > MAX_ALT_SETTINGS)
3751	return -EINVAL;
3752
3753	intf = ffs_func_revmap_intf(func, intf: interface);
3754	if (intf < 0)
3755	return intf;
3756
3757	if (ffs->func)
3758	ffs_func_eps_disable(func: ffs->func);
3759
3760	spin_lock_irqsave(&ffs->eps_lock, flags);
3761	if (ffs->state == FFS_DEACTIVATED) {
3762	ffs->state = FFS_CLOSING;
3763	spin_unlock_irqrestore(lock: &ffs->eps_lock, flags);
3764	INIT_WORK(&ffs->reset_work, ffs_reset_work);
3765	schedule_work(work: &ffs->reset_work);
3766	return -ENODEV;
3767	}
3768	spin_unlock_irqrestore(lock: &ffs->eps_lock, flags);
3769
3770	if (ffs->state != FFS_ACTIVE)
3771	return -ENODEV;
3772
3773	ffs->func = func;
3774	ret = ffs_func_eps_enable(func);
3775	if (ret >= 0) {
3776	ffs_event_add(ffs, type: FUNCTIONFS_ENABLE);
3777	func->cur_alt[interface] = alt;
3778	}
3779	return ret;
3780	}
3781
3782	static void ffs_func_disable(struct usb_function *f)
3783	{
3784	struct ffs_function *func = ffs_func_from_usb(f);
3785	struct ffs_data *ffs = func->ffs;
3786	unsigned long flags;
3787
3788	if (ffs->func)
3789	ffs_func_eps_disable(func: ffs->func);
3790
3791	spin_lock_irqsave(&ffs->eps_lock, flags);
3792	if (ffs->state == FFS_DEACTIVATED) {
3793	ffs->state = FFS_CLOSING;
3794	spin_unlock_irqrestore(lock: &ffs->eps_lock, flags);
3795	INIT_WORK(&ffs->reset_work, ffs_reset_work);
3796	schedule_work(work: &ffs->reset_work);
3797	return;
3798	}
3799	spin_unlock_irqrestore(lock: &ffs->eps_lock, flags);
3800
3801	if (ffs->state == FFS_ACTIVE) {
3802	ffs->func = NULL;
3803	ffs_event_add(ffs, type: FUNCTIONFS_DISABLE);
3804	}
3805	}
3806
3807	static int ffs_func_setup(struct usb_function *f,
3808	const struct usb_ctrlrequest *creq)
3809	{
3810	struct ffs_function *func = ffs_func_from_usb(f);
3811	struct ffs_data *ffs = func->ffs;
3812	unsigned long flags;
3813	int ret;
3814
3815	pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType);
3816	pr_vdebug("creq->bRequest = %02x\n", creq->bRequest);
3817	pr_vdebug("creq->wValue = %04x\n", le16_to_cpu(creq->wValue));
3818	pr_vdebug("creq->wIndex = %04x\n", le16_to_cpu(creq->wIndex));
3819	pr_vdebug("creq->wLength = %04x\n", le16_to_cpu(creq->wLength));
3820
3821	/*
3822	* Most requests directed to interface go through here
3823	* (notable exceptions are set/get interface) so we need to
3824	* handle them. All other either handled by composite or
3825	* passed to usb_configuration->setup() (if one is set). No
3826	* matter, we will handle requests directed to endpoint here
3827	* as well (as it's straightforward). Other request recipient
3828	* types are only handled when the user flag FUNCTIONFS_ALL_CTRL_RECIP
3829	* is being used.
3830	*/
3831	if (ffs->state != FFS_ACTIVE)
3832	return -ENODEV;
3833
3834	switch (creq->bRequestType & USB_RECIP_MASK) {
3835	case USB_RECIP_INTERFACE:
3836	ret = ffs_func_revmap_intf(func, le16_to_cpu(creq->wIndex));
3837	if (ret < 0)
3838	return ret;
3839	break;
3840
3841	case USB_RECIP_ENDPOINT:
3842	ret = ffs_func_revmap_ep(func, le16_to_cpu(creq->wIndex));
3843	if (ret < 0)
3844	return ret;
3845	if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
3846	ret = func->ffs->eps_addrmap[ret];
3847	break;
3848
3849	default:
3850	if (func->ffs->user_flags & FUNCTIONFS_ALL_CTRL_RECIP)
3851	ret = le16_to_cpu(creq->wIndex);
3852	else
3853	return -EOPNOTSUPP;
3854	}
3855
3856	spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
3857	ffs->ev.setup = *creq;
3858	ffs->ev.setup.wIndex = cpu_to_le16(ret);
3859	__ffs_event_add(ffs, type: FUNCTIONFS_SETUP);
3860	spin_unlock_irqrestore(lock: &ffs->ev.waitq.lock, flags);
3861
3862	return ffs->ev.setup.wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0;
3863	}
3864
3865	static bool ffs_func_req_match(struct usb_function *f,
3866	const struct usb_ctrlrequest *creq,
3867	bool config0)
3868	{
3869	struct ffs_function *func = ffs_func_from_usb(f);
3870
3871	if (config0 && !(func->ffs->user_flags & FUNCTIONFS_CONFIG0_SETUP))
3872	return false;
3873
3874	switch (creq->bRequestType & USB_RECIP_MASK) {
3875	case USB_RECIP_INTERFACE:
3876	return (ffs_func_revmap_intf(func,
3877	le16_to_cpu(creq->wIndex)) >= 0);
3878	case USB_RECIP_ENDPOINT:
3879	return (ffs_func_revmap_ep(func,
3880	le16_to_cpu(creq->wIndex)) >= 0);
3881	default:
3882	return (bool) (func->ffs->user_flags &
3883	FUNCTIONFS_ALL_CTRL_RECIP);
3884	}
3885	}
3886
3887	static void ffs_func_suspend(struct usb_function *f)
3888	{
3889	ffs_event_add(ffs: ffs_func_from_usb(f)->ffs, type: FUNCTIONFS_SUSPEND);
3890	}
3891
3892	static void ffs_func_resume(struct usb_function *f)
3893	{
3894	ffs_event_add(ffs: ffs_func_from_usb(f)->ffs, type: FUNCTIONFS_RESUME);
3895	}
3896
3897
3898	/* Endpoint and interface numbers reverse mapping ***************************/
3899
3900	static int ffs_func_revmap_ep(struct ffs_function *func, u8 num)
3901	{
3902	num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK];
3903	return num ? num : -EDOM;
3904	}
3905
3906	static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf)
3907	{
3908	short *nums = func->interfaces_nums;
3909	unsigned count = func->ffs->interfaces_count;
3910
3911	for (; count; --count, ++nums) {
3912	if (*nums >= 0 && *nums == intf)
3913	return nums - func->interfaces_nums;
3914	}
3915
3916	return -EDOM;
3917	}
3918
3919
3920	/* Devices management *******************************************************/
3921
3922	static LIST_HEAD(ffs_devices);
3923
3924	static struct ffs_dev *_ffs_do_find_dev(const char *name)
3925	{
3926	struct ffs_dev *dev;
3927
3928	if (!name)
3929	return NULL;
3930
3931	list_for_each_entry(dev, &ffs_devices, entry) {
3932	if (strcmp(dev->name, name) == 0)
3933	return dev;
3934	}
3935
3936	return NULL;
3937	}
3938
3939	/*
3940	* ffs_lock must be taken by the caller of this function
3941	*/
3942	static struct ffs_dev *_ffs_get_single_dev(void)
3943	{
3944	struct ffs_dev *dev;
3945
3946	if (list_is_singular(head: &ffs_devices)) {
3947	dev = list_first_entry(&ffs_devices, struct ffs_dev, entry);
3948	if (dev->single)
3949	return dev;
3950	}
3951
3952	return NULL;
3953	}
3954
3955	/*
3956	* ffs_lock must be taken by the caller of this function
3957	*/
3958	static struct ffs_dev *_ffs_find_dev(const char *name)
3959	{
3960	struct ffs_dev *dev;
3961
3962	dev = _ffs_get_single_dev();
3963	if (dev)
3964	return dev;
3965
3966	return _ffs_do_find_dev(name);
3967	}
3968
3969	/* Configfs support *********************************************************/
3970
3971	static inline struct f_fs_opts *to_ffs_opts(struct config_item *item)
3972	{
3973	return container_of(to_config_group(item), struct f_fs_opts,
3974	func_inst.group);
3975	}
3976
3977	static ssize_t f_fs_opts_ready_show(struct config_item *item, char *page)
3978	{
3979	struct f_fs_opts *opts = to_ffs_opts(item);
3980	int ready;
3981
3982	ffs_dev_lock();
3983	ready = opts->dev->desc_ready;
3984	ffs_dev_unlock();
3985
3986	return sprintf(buf: page, fmt: "%d\n", ready);
3987	}
3988
3989	CONFIGFS_ATTR_RO(f_fs_opts_, ready);
3990
3991	static struct configfs_attribute *ffs_attrs[] = {
3992	&f_fs_opts_attr_ready,
3993	NULL,
3994	};
3995
3996	static void ffs_attr_release(struct config_item *item)
3997	{
3998	struct f_fs_opts *opts = to_ffs_opts(item);
3999
4000	usb_put_function_instance(fi: &opts->func_inst);
4001	}
4002
4003	static struct configfs_item_operations ffs_item_ops = {
4004	.release = ffs_attr_release,
4005	};
4006
4007	static const struct config_item_type ffs_func_type = {
4008	.ct_item_ops = &ffs_item_ops,
4009	.ct_attrs = ffs_attrs,
4010	.ct_owner = THIS_MODULE,
4011	};
4012
4013
4014	/* Function registration interface ******************************************/
4015
4016	static void ffs_free_inst(struct usb_function_instance *f)
4017	{
4018	struct f_fs_opts *opts;
4019
4020	opts = to_f_fs_opts(fi: f);
4021	ffs_release_dev(ffs_dev: opts->dev);
4022	ffs_dev_lock();
4023	_ffs_free_dev(dev: opts->dev);
4024	ffs_dev_unlock();
4025	kfree(objp: opts);
4026	}
4027
4028	static int ffs_set_inst_name(struct usb_function_instance *fi, const char *name)
4029	{
4030	if (strlen(name) >= sizeof_field(struct ffs_dev, name))
4031	return -ENAMETOOLONG;
4032	return ffs_name_dev(dev: to_f_fs_opts(fi)->dev, name);
4033	}
4034
4035	static struct usb_function_instance *ffs_alloc_inst(void)
4036	{
4037	struct f_fs_opts *opts;
4038	struct ffs_dev *dev;
4039
4040	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
4041	if (!opts)
4042	return ERR_PTR(error: -ENOMEM);
4043
4044	opts->func_inst.set_inst_name = ffs_set_inst_name;
4045	opts->func_inst.free_func_inst = ffs_free_inst;
4046	ffs_dev_lock();
4047	dev = _ffs_alloc_dev();
4048	ffs_dev_unlock();
4049	if (IS_ERR(ptr: dev)) {
4050	kfree(objp: opts);
4051	return ERR_CAST(ptr: dev);
4052	}
4053	opts->dev = dev;
4054	dev->opts = opts;
4055
4056	config_group_init_type_name(group: &opts->func_inst.group, name: "",
4057	type: &ffs_func_type);
4058	return &opts->func_inst;
4059	}
4060
4061	static void ffs_free(struct usb_function *f)
4062	{
4063	kfree(objp: ffs_func_from_usb(f));
4064	}
4065
4066	static void ffs_func_unbind(struct usb_configuration *c,
4067	struct usb_function *f)
4068	{
4069	struct ffs_function *func = ffs_func_from_usb(f);
4070	struct ffs_data *ffs = func->ffs;
4071	struct f_fs_opts *opts =
4072	container_of(f->fi, struct f_fs_opts, func_inst);
4073	struct ffs_ep *ep = func->eps;
4074	unsigned count = ffs->eps_count;
4075	unsigned long flags;
4076
4077	if (ffs->func == func) {
4078	ffs_func_eps_disable(func);
4079	ffs->func = NULL;
4080	}
4081
4082	/* Drain any pending AIO completions */
4083	drain_workqueue(wq: ffs->io_completion_wq);
4084
4085	ffs_event_add(ffs, type: FUNCTIONFS_UNBIND);
4086	if (!--opts->refcnt)
4087	functionfs_unbind(ffs);
4088
4089	/* cleanup after autoconfig */
4090	spin_lock_irqsave(&func->ffs->eps_lock, flags);
4091	while (count--) {
4092	if (ep->ep && ep->req)
4093	usb_ep_free_request(ep: ep->ep, req: ep->req);
4094	ep->req = NULL;
4095	++ep;
4096	}
4097	spin_unlock_irqrestore(lock: &func->ffs->eps_lock, flags);
4098	kfree(objp: func->eps);
4099	func->eps = NULL;
4100	/*
4101	* eps, descriptors and interfaces_nums are allocated in the
4102	* same chunk so only one free is required.
4103	*/
4104	func->function.fs_descriptors = NULL;
4105	func->function.hs_descriptors = NULL;
4106	func->function.ss_descriptors = NULL;
4107	func->function.ssp_descriptors = NULL;
4108	func->interfaces_nums = NULL;
4109
4110	}
4111
4112	static struct usb_function *ffs_alloc(struct usb_function_instance *fi)
4113	{
4114	struct ffs_function *func;
4115
4116	func = kzalloc(sizeof(*func), GFP_KERNEL);
4117	if (!func)
4118	return ERR_PTR(error: -ENOMEM);
4119
4120	func->function.name = "Function FS Gadget";
4121
4122	func->function.bind = ffs_func_bind;
4123	func->function.unbind = ffs_func_unbind;
4124	func->function.set_alt = ffs_func_set_alt;
4125	func->function.get_alt = ffs_func_get_alt;
4126	func->function.disable = ffs_func_disable;
4127	func->function.setup = ffs_func_setup;
4128	func->function.req_match = ffs_func_req_match;
4129	func->function.suspend = ffs_func_suspend;
4130	func->function.resume = ffs_func_resume;
4131	func->function.free_func = ffs_free;
4132
4133	return &func->function;
4134	}
4135
4136	/*
4137	* ffs_lock must be taken by the caller of this function
4138	*/
4139	static struct ffs_dev *_ffs_alloc_dev(void)
4140	{
4141	struct ffs_dev *dev;
4142	int ret;
4143
4144	if (_ffs_get_single_dev())
4145	return ERR_PTR(error: -EBUSY);
4146
4147	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
4148	if (!dev)
4149	return ERR_PTR(error: -ENOMEM);
4150
4151	if (list_empty(head: &ffs_devices)) {
4152	ret = functionfs_init();
4153	if (ret) {
4154	kfree(objp: dev);
4155	return ERR_PTR(error: ret);
4156	}
4157	}
4158
4159	list_add(new: &dev->entry, head: &ffs_devices);
4160
4161	return dev;
4162	}
4163
4164	int ffs_name_dev(struct ffs_dev *dev, const char *name)
4165	{
4166	struct ffs_dev *existing;
4167	int ret = 0;
4168
4169	ffs_dev_lock();
4170
4171	existing = _ffs_do_find_dev(name);
4172	if (!existing)
4173	strscpy(dev->name, name, ARRAY_SIZE(dev->name));
4174	else if (existing != dev)
4175	ret = -EBUSY;
4176
4177	ffs_dev_unlock();
4178
4179	return ret;
4180	}
4181	EXPORT_SYMBOL_GPL(ffs_name_dev);
4182
4183	int ffs_single_dev(struct ffs_dev *dev)
4184	{
4185	int ret;
4186
4187	ret = 0;
4188	ffs_dev_lock();
4189
4190	if (!list_is_singular(head: &ffs_devices))
4191	ret = -EBUSY;
4192	else
4193	dev->single = true;
4194
4195	ffs_dev_unlock();
4196	return ret;
4197	}
4198	EXPORT_SYMBOL_GPL(ffs_single_dev);
4199
4200	/*
4201	* ffs_lock must be taken by the caller of this function
4202	*/
4203	static void _ffs_free_dev(struct ffs_dev *dev)
4204	{
4205	list_del(entry: &dev->entry);
4206
4207	kfree(objp: dev);
4208	if (list_empty(head: &ffs_devices))
4209	functionfs_cleanup();
4210	}
4211
4212	static int ffs_acquire_dev(const char *dev_name, struct ffs_data *ffs_data)
4213	{
4214	int ret = 0;
4215	struct ffs_dev *ffs_dev;
4216
4217	ffs_dev_lock();
4218
4219	ffs_dev = _ffs_find_dev(name: dev_name);
4220	if (!ffs_dev) {
4221	ret = -ENOENT;
4222	} else if (ffs_dev->mounted) {
4223	ret = -EBUSY;
4224	} else if (ffs_dev->ffs_acquire_dev_callback &&
4225	ffs_dev->ffs_acquire_dev_callback(ffs_dev)) {
4226	ret = -ENOENT;
4227	} else {
4228	ffs_dev->mounted = true;
4229	ffs_dev->ffs_data = ffs_data;
4230	ffs_data->private_data = ffs_dev;
4231	}
4232
4233	ffs_dev_unlock();
4234	return ret;
4235	}
4236
4237	static void ffs_release_dev(struct ffs_dev *ffs_dev)
4238	{
4239	ffs_dev_lock();
4240
4241	if (ffs_dev && ffs_dev->mounted) {
4242	ffs_dev->mounted = false;
4243	if (ffs_dev->ffs_data) {
4244	ffs_dev->ffs_data->private_data = NULL;
4245	ffs_dev->ffs_data = NULL;
4246	}
4247
4248	if (ffs_dev->ffs_release_dev_callback)
4249	ffs_dev->ffs_release_dev_callback(ffs_dev);
4250	}
4251
4252	ffs_dev_unlock();
4253	}
4254
4255	static int ffs_ready(struct ffs_data *ffs)
4256	{
4257	struct ffs_dev *ffs_obj;
4258	int ret = 0;
4259
4260	ffs_dev_lock();
4261
4262	ffs_obj = ffs->private_data;
4263	if (!ffs_obj) {
4264	ret = -EINVAL;
4265	goto done;
4266	}
4267	if (WARN_ON(ffs_obj->desc_ready)) {
4268	ret = -EBUSY;
4269	goto done;
4270	}
4271
4272	ffs_obj->desc_ready = true;
4273
4274	if (ffs_obj->ffs_ready_callback) {
4275	ret = ffs_obj->ffs_ready_callback(ffs);
4276	if (ret)
4277	goto done;
4278	}
4279
4280	set_bit(FFS_FL_CALL_CLOSED_CALLBACK, addr: &ffs->flags);
4281	done:
4282	ffs_dev_unlock();
4283	return ret;
4284	}
4285
4286	static void ffs_closed(struct ffs_data *ffs)
4287	{
4288	struct ffs_dev *ffs_obj;
4289	struct f_fs_opts *opts;
4290	struct config_item *ci;
4291
4292	ffs_dev_lock();
4293
4294	ffs_obj = ffs->private_data;
4295	if (!ffs_obj)
4296	goto done;
4297
4298	ffs_obj->desc_ready = false;
4299
4300	if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, addr: &ffs->flags) &&
4301	ffs_obj->ffs_closed_callback)
4302	ffs_obj->ffs_closed_callback(ffs);
4303
4304	if (ffs_obj->opts)
4305	opts = ffs_obj->opts;
4306	else
4307	goto done;
4308
4309	if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent
4310	|| !kref_read(kref: &opts->func_inst.group.cg_item.ci_kref))
4311	goto done;
4312
4313	ci = opts->func_inst.group.cg_item.ci_parent->ci_parent;
4314	ffs_dev_unlock();
4315
4316	if (test_bit(FFS_FL_BOUND, &ffs->flags))
4317	unregister_gadget_item(item: ci);
4318	return;
4319	done:
4320	ffs_dev_unlock();
4321	}
4322
4323	/* Misc helper functions ****************************************************/
4324
4325	static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
4326	{
4327	return nonblock
4328	? mutex_trylock(mutex) ? 0 : -EAGAIN
4329	: mutex_lock_interruptible(mutex);
4330	}
4331
4332	static char *ffs_prepare_buffer(const char __user *buf, size_t len)
4333	{
4334	char *data;
4335
4336	if (!len)
4337	return NULL;
4338
4339	data = memdup_user(buf, len);
4340	if (IS_ERR(ptr: data))
4341	return data;
4342
4343	pr_vdebug("Buffer from user space:\n");
4344	ffs_dump_mem("", data, len);
4345
4346	return data;
4347	}
4348
4349	DECLARE_USB_FUNCTION_INIT(ffs, ffs_alloc_inst, ffs_alloc);
4350	MODULE_DESCRIPTION("user mode file system API for USB composite function controllers");
4351	MODULE_LICENSE("GPL");
4352	MODULE_AUTHOR("Michal Nazarewicz");
4353