drivers/usb/gadget/f_fs.c

   1 /*
   2  * f_fs.c -- user mode file system API for USB composite function controllers
   3  *
   4  * Copyright (C) 2010 Samsung Electronics
   5  * Author: Michal Nazarewicz <mina86@mina86.com>
   6  *
   7  * Based on inode.c (GadgetFS) which was:
   8  * Copyright (C) 2003-2004 David Brownell
   9  * Copyright (C) 2003 Agilent Technologies
  10  *
  11  * This program is free software; you can redistribute it and/or modify
  12  * it under the terms of the GNU General Public License as published by
  13  * the Free Software Foundation; either version 2 of the License, or
  14  * (at your option) any later version.
  15  */
  16
  17
  18 /* #define DEBUG */
  19 /* #define VERBOSE_DEBUG */
  20
  21 #include <linux/blkdev.h>
  22 #include <linux/pagemap.h>
  23 #include <linux/export.h>
  24 #include <linux/hid.h>
  25 #include <asm/unaligned.h>
  26
  27 #include <linux/usb/composite.h>
  28 #include <linux/usb/functionfs.h>
  29
  30
  31 #define FUNCTIONFS_MAGIC        0xa647361 /* Chosen by a honest dice roll ;) */
  32
  33
  34 /* Debugging ****************************************************************/
  35
  36 #ifdef VERBOSE_DEBUG
  37 #ifndef pr_vdebug
  38 #  define pr_vdebug pr_debug
  39 #endif /* pr_vdebug */
  40 #  define ffs_dump_mem(prefix, ptr, len) \
  41         print_hex_dump_bytes(pr_fmt(prefix ": "), DUMP_PREFIX_NONE, ptr, len)
  42 #else
  43 #ifndef pr_vdebug
  44 #  define pr_vdebug(...)                 do { } while (0)
  45 #endif /* pr_vdebug */
  46 #  define ffs_dump_mem(prefix, ptr, len) do { } while (0)
  47 #endif /* VERBOSE_DEBUG */
  48
  49 #define ENTER()    pr_vdebug("%s()\n", __func__)
  50
  51
  52 /* The data structure and setup file ****************************************/
  53
  54 enum ffs_state {
  55         /*
  56          * Waiting for descriptors and strings.
  57          *
  58          * In this state no open(2), read(2) or write(2) on epfiles
  59          * may succeed (which should not be the problem as there
  60          * should be no such files opened in the first place).
  61          */
  62         FFS_READ_DESCRIPTORS,
  63         FFS_READ_STRINGS,
  64
  65         /*
  66          * We've got descriptors and strings.  We are or have called
  67          * functionfs_ready_callback().  functionfs_bind() may have
  68          * been called but we don't know.
  69          *
  70          * This is the only state in which operations on epfiles may
  71          * succeed.
  72          */
  73         FFS_ACTIVE,
  74
  75         /*
  76          * All endpoints have been closed.  This state is also set if
  77          * we encounter an unrecoverable error.  The only
  78          * unrecoverable error is situation when after reading strings
  79          * from user space we fail to initialise epfiles or
  80          * functionfs_ready_callback() returns with error (<0).
  81          *
  82          * In this state no open(2), read(2) or write(2) (both on ep0
  83          * as well as epfile) may succeed (at this point epfiles are
  84          * unlinked and all closed so this is not a problem; ep0 is
  85          * also closed but ep0 file exists and so open(2) on ep0 must
  86          * fail).
  87          */
  88          /*add by chunhou.wang for kernel crash bug 378800*/
  89         FFS_DEACTIVATED,
  90         /*end add by chunhou.wang*/
  91         FFS_CLOSING
  92 };
  93
  94
  95 enum ffs_setup_state {
  96         /* There is no setup request pending. */
  97         FFS_NO_SETUP,
  98         /*
  99          * User has read events and there was a setup request event
 100          * there.  The next read/write on ep0 will handle the
 101          * request.
 102          */
 103         FFS_SETUP_PENDING,
 104         /*
 105          * There was event pending but before user space handled it
 106          * some other event was introduced which canceled existing
 107          * setup.  If this state is set read/write on ep0 return
 108          * -EIDRM.  This state is only set when adding event.
 109          */
 110         FFS_SETUP_CANCELED
 111 };
 112
 113
 114
 115 struct ffs_epfile;
 116 struct ffs_function;
 117
 118 struct ffs_data {
 119         struct usb_gadget               *gadget;
 120
 121         /*
 122          * Protect access read/write operations, only one read/write
 123          * at a time.  As a consequence protects ep0req and company.
 124          * While setup request is being processed (queued) this is
 125          * held.
 126          */
 127         struct mutex                    mutex;
 128
 129         /*
 130          * Protect access to endpoint related structures (basically
 131          * usb_ep_queue(), usb_ep_dequeue(), etc. calls) except for
 132          * endpoint zero.
 133          */
 134         spinlock_t                      eps_lock;
 135
 136         /*
 137          * XXX REVISIT do we need our own request? Since we are not
 138          * handling setup requests immediately user space may be so
 139          * slow that another setup will be sent to the gadget but this
 140          * time not to us but another function and then there could be
 141          * a race.  Is that the case? Or maybe we can use cdev->req
 142          * after all, maybe we just need some spinlock for that?
 143          */
 144         struct usb_request              *ep0req;                /* P: mutex */
 145         struct completion               ep0req_completion;      /* P: mutex */
 146         int                             ep0req_status;          /* P: mutex */
 147         struct completion               epin_completion;           /* P: mutex */
 148         struct completion               epout_completion;               /* P: mutex */
 149
 150         /* reference counter */
 151         atomic_t                        ref;
 152         /* how many files are opened (EP0 and others) */
 153         atomic_t                        opened;
 154
 155         /* EP0 state */
 156         enum ffs_state                  state;
 157
 158         /*
 159          * Possible transitions:
 160          * + FFS_NO_SETUP       -> FFS_SETUP_PENDING  -- P: ev.waitq.lock
 161          *               happens only in ep0 read which is P: mutex
 162          * + FFS_SETUP_PENDING  -> FFS_NO_SETUP       -- P: ev.waitq.lock
 163          *               happens only in ep0 i/o  which is P: mutex
 164          * + FFS_SETUP_PENDING  -> FFS_SETUP_CANCELED -- P: ev.waitq.lock
 165          * + FFS_SETUP_CANCELED -> FFS_NO_SETUP       -- cmpxchg
 166          */
 167         enum ffs_setup_state            setup_state;
 168
 169 #define FFS_SETUP_STATE(ffs)                                    \
 170         ((enum ffs_setup_state)cmpxchg(&(ffs)->setup_state,     \
 171                                        FFS_SETUP_CANCELED, FFS_NO_SETUP))
 172
 173         /* Events & such. */
 174         struct {
 175                 u8                              types[4];
 176                 unsigned short                  count;
 177                 /* XXX REVISIT need to update it in some places, or do we? */
 178                 unsigned short                  can_stall;
 179                 struct usb_ctrlrequest          setup;
 180
 181                 wait_queue_head_t               waitq;
 182         } ev; /* the whole structure, P: ev.waitq.lock */
 183
 184         /* Flags */
 185         unsigned long                   flags;
 186 #define FFS_FL_CALL_CLOSED_CALLBACK 0
 187 #define FFS_FL_BOUND                1
 188
 189         /* Active function */
 190         struct ffs_function             *func;
 191
 192         /*
 193          * Device name, write once when file system is mounted.
 194          * Intended for user to read if she wants.
 195          */
 196         const char                      *dev_name;
 197         /* Private data for our user (ie. gadget).  Managed by user. */
 198         void                            *private_data;
 199
 200         /* filled by __ffs_data_got_descs() */
 201         /*
 202          * Real descriptors are 16 bytes after raw_descs (so you need
 203          * to skip 16 bytes (ie. ffs->raw_descs + 16) to get to the
 204          * first full speed descriptor).  raw_descs_length and
 205          * raw_fs_descs_length do not have those 16 bytes added.
 206          */
 207         const void                      *raw_descs;
 208         unsigned                        raw_descs_length;
 209         unsigned                        raw_fs_descs_length;
 210         unsigned                        fs_descs_count;
 211         unsigned                        hs_descs_count;
 212
 213         unsigned short                  strings_count;
 214         unsigned short                  interfaces_count;
 215         unsigned short                  eps_count;
 216         unsigned short                  _pad1;
 217
 218         /* filled by __ffs_data_got_strings() */
 219         /* ids in stringtabs are set in functionfs_bind() */
 220         const void                      *raw_strings;
 221         struct usb_gadget_strings       **stringtabs;
 222
 223         /*
 224          * File system's super block, write once when file system is
 225          * mounted.
 226          */
 227         struct super_block              *sb;
 228
 229         /* File permissions, written once when fs is mounted */
 230         struct ffs_file_perms {
 231                 umode_t                         mode;
 232                 kuid_t                          uid;
 233                 kgid_t                          gid;
 234         }                               file_perms;
 235
 236         /*
 237          * The endpoint files, filled by ffs_epfiles_create(),
 238          * destroyed by ffs_epfiles_destroy().
 239          */
 240         struct ffs_epfile               *epfiles;
 241         /*add by chunhou.wang for kernel crash bug 378800*/
 242         bool no_disconnect;
 243         /*end add by chunhou.wang*/
 244 };
 245
 246 /* Reference counter handling */
 247 static void ffs_data_get(struct ffs_data *ffs);
 248 static void ffs_data_put(struct ffs_data *ffs);
 249 /* Creates new ffs_data object. */
 250 static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc));
 251
 252 /* Opened counter handling. */
 253 static void ffs_data_opened(struct ffs_data *ffs);
 254 static void ffs_data_closed(struct ffs_data *ffs);
 255
 256 /* Called with ffs->mutex held; take over ownership of data. */
 257 static int __must_check
 258 __ffs_data_got_descs(struct ffs_data *ffs, char *data, size_t len);
 259 static int __must_check
 260 __ffs_data_got_strings(struct ffs_data *ffs, char *data, size_t len);
 261
 262
 263 /* The function structure ***************************************************/
 264
 265 struct ffs_ep;
 266
 267 struct ffs_function {
 268         struct usb_configuration        *conf;
 269         struct usb_gadget               *gadget;
 270         struct ffs_data                 *ffs;
 271
 272         struct ffs_ep                   *eps;
 273         u8                              eps_revmap[16];
 274         short                           *interfaces_nums;
 275
 276         struct usb_function             function;
 277 };
 278
 279
 280 static struct ffs_function *ffs_func_from_usb(struct usb_function *f)
 281 {
 282         return container_of(f, struct ffs_function, function);
 283 }
 284
 285 static void ffs_func_free(struct ffs_function *func);
 286
 287 static void ffs_func_eps_disable(struct ffs_function *func);
 288 static int __must_check ffs_func_eps_enable(struct ffs_function *func);
 289
 290 static int ffs_func_bind(struct usb_configuration *,
 291                          struct usb_function *);
 292 static void ffs_func_unbind(struct usb_configuration *,
 293                             struct usb_function *);
 294 static int ffs_func_set_alt(struct usb_function *, unsigned, unsigned);
 295 static void ffs_func_disable(struct usb_function *);
 296 static int ffs_func_setup(struct usb_function *,
 297                           const struct usb_ctrlrequest *);
 298 static void ffs_func_suspend(struct usb_function *);
 299 static void ffs_func_resume(struct usb_function *);
 300
 301
 302 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num);
 303 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf);
 304
 305
 306 /* The endpoints structures *************************************************/
 307
 308 static unsigned int send_buffer[160+2048];
 309 static unsigned int recv_buffer[160+2048];
 310 struct ffs_ep {
 311         struct usb_ep                   *ep;    /* P: ffs->eps_lock */
 312         struct usb_request              *req;   /* P: epfile->mutex */
 313
 314         /* [0]: full speed, [1]: high speed */
 315         struct usb_endpoint_descriptor  *descs[2];
 316
 317         u8                              num;
 318
 319         int                             status; /* P: epfile->mutex */
 320 };
 321
 322 struct ffs_epfile {
 323         /* Protects ep->ep and ep->req. */
 324         struct mutex                    mutex;
 325         wait_queue_head_t               wait;
 326
 327         struct ffs_data                 *ffs;
 328         struct ffs_ep                   *ep;    /* P: ffs->eps_lock */
 329
 330         struct dentry                   *dentry;
 331
 332         char                            name[5];
 333
 334         unsigned char                   in;     /* P: ffs->eps_lock */
 335         unsigned char                   isoc;   /* P: ffs->eps_lock */
 336
 337         unsigned char                   _pad;
 338 };
 339
 340 static int  __must_check ffs_epfiles_create(struct ffs_data *ffs);
 341 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count);
 342
 343 static struct inode *__must_check
 344 ffs_sb_create_file(struct super_block *sb, const char *name, void *data,
 345                    const struct file_operations *fops,
 346                    struct dentry **dentry_p);
 347
 348
 349 /* Misc helper functions ****************************************************/
 350
 351 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
 352         __attribute__((warn_unused_result, nonnull));
 353 static char *ffs_prepare_buffer(const char __user *buf, size_t len)
 354         __attribute__((warn_unused_result, nonnull));
 355
 356
 357 /* Control file aka ep0 *****************************************************/
 358
 359 static void ffs_ep0_complete(struct usb_ep *ep, struct usb_request *req)
 360 {
 361         struct ffs_data *ffs = req->context;
 362
 363         complete_all(&ffs->ep0req_completion);
 364 }
 365
 366 static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
 367 {
 368         struct usb_request *req = ffs->ep0req;
 369         int ret;
 370
 371         req->zero     = len < le16_to_cpu(ffs->ev.setup.wLength);
 372
 373         spin_unlock_irq(&ffs->ev.waitq.lock);
 374
 375         req->buf      = data;
 376         req->length   = len;
 377
 378         /*
 379          * UDC layer requires to provide a buffer even for ZLP, but should
 380          * not use it at all. Let's provide some poisoned pointer to catch
 381          * possible bug in the driver.
 382          */
 383         if (req->buf == NULL)
 384                 req->buf = (void *)0xDEADBABE;
 385
 386         INIT_COMPLETION(ffs->ep0req_completion);
 387
 388         ret = usb_ep_queue(ffs->gadget->ep0, req, GFP_ATOMIC);
 389         if (unlikely(ret < 0))
 390                 return ret;
 391
 392         ret = wait_for_completion_interruptible(&ffs->ep0req_completion);
 393         if (unlikely(ret)) {
 394                 usb_ep_dequeue(ffs->gadget->ep0, req);
 395                 return -EINTR;
 396         }
 397
 398         ffs->setup_state = FFS_NO_SETUP;
 399         return ffs->ep0req_status;
 400 }
 401
 402 static int __ffs_ep0_stall(struct ffs_data *ffs)
 403 {
 404         if (ffs->ev.can_stall) {
 405                 pr_vdebug("ep0 stall\n");
 406                 usb_ep_set_halt(ffs->gadget->ep0);
 407                 ffs->setup_state = FFS_NO_SETUP;
 408                 return -EL2HLT;
 409         } else {
 410                 pr_debug("bogus ep0 stall!\n");
 411                 return -ESRCH;
 412         }
 413 }
 414
 415 static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
 416                              size_t len, loff_t *ptr)
 417 {
 418         struct ffs_data *ffs = file->private_data;
 419         ssize_t ret;
 420         char *data;
 421
 422         ENTER();
 423
 424         /* Fast check if setup was canceled */
 425         if (FFS_SETUP_STATE(ffs) == FFS_SETUP_CANCELED)
 426                 return -EIDRM;
 427
 428         /* Acquire mutex */
 429         ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
 430         if (unlikely(ret < 0))
 431                 return ret;
 432
 433         /* Check state */
 434         switch (ffs->state) {
 435         case FFS_READ_DESCRIPTORS:
 436         case FFS_READ_STRINGS:
 437                 /* Copy data */
 438                 if (unlikely(len < 16)) {
 439                         ret = -EINVAL;
 440                         break;
 441                 }
 442
 443                 data = ffs_prepare_buffer(buf, len);
 444                 if (IS_ERR(data)) {
 445                         ret = PTR_ERR(data);
 446                         break;
 447                 }
 448
 449                 /* Handle data */
 450                 if (ffs->state == FFS_READ_DESCRIPTORS) {
 451                         pr_info("read descriptors\n");
 452                         ret = __ffs_data_got_descs(ffs, data, len);
 453                         if (unlikely(ret < 0))
 454                                 break;
 455
 456                         ffs->state = FFS_READ_STRINGS;
 457                         ret = len;
 458                 } else {
 459                         pr_info("read strings\n");
 460                         ret = __ffs_data_got_strings(ffs, data, len);
 461                         if (unlikely(ret < 0))
 462                                 break;
 463
 464                         ret = ffs_epfiles_create(ffs);
 465                         if (unlikely(ret)) {
 466                                 ffs->state = FFS_CLOSING;
 467                                 break;
 468                         }
 469
 470                         ffs->state = FFS_ACTIVE;
 471                         mutex_unlock(&ffs->mutex);
 472
 473                         ret = functionfs_ready_callback(ffs);
 474                         if (unlikely(ret < 0)) {
 475                                 ffs->state = FFS_CLOSING;
 476                                 return ret;
 477                         }
 478
 479                         set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags);
 480                         return len;
 481                 }
 482                 break;
 483
 484         case FFS_ACTIVE:
 485                 data = NULL;
 486                 /*
 487                  * We're called from user space, we can use _irq
 488                  * rather then _irqsave
 489                  */
 490                 spin_lock_irq(&ffs->ev.waitq.lock);
 491                 switch (FFS_SETUP_STATE(ffs)) {
 492                 case FFS_SETUP_CANCELED:
 493                         ret = -EIDRM;
 494                         goto done_spin;
 495
 496                 case FFS_NO_SETUP:
 497                         ret = -ESRCH;
 498                         goto done_spin;
 499
 500                 case FFS_SETUP_PENDING:
 501                         break;
 502                 }
 503
 504                 /* FFS_SETUP_PENDING */
 505                 if (!(ffs->ev.setup.bRequestType & USB_DIR_IN)) {
 506                         spin_unlock_irq(&ffs->ev.waitq.lock);
 507                         ret = __ffs_ep0_stall(ffs);
 508                         break;
 509                 }
 510
 511                 /* FFS_SETUP_PENDING and not stall */
 512                 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength));
 513
 514                 spin_unlock_irq(&ffs->ev.waitq.lock);
 515
 516                 data = ffs_prepare_buffer(buf, len);
 517                 if (IS_ERR(data)) {
 518                         ret = PTR_ERR(data);
 519                         break;
 520                 }
 521
 522                 spin_lock_irq(&ffs->ev.waitq.lock);
 523
 524                 /*
 525                  * We are guaranteed to be still in FFS_ACTIVE state
 526                  * but the state of setup could have changed from
 527                  * FFS_SETUP_PENDING to FFS_SETUP_CANCELED so we need
 528                  * to check for that.  If that happened we copied data
 529                  * from user space in vain but it's unlikely.
 530                  *
 531                  * For sure we are not in FFS_NO_SETUP since this is
 532                  * the only place FFS_SETUP_PENDING -> FFS_NO_SETUP
 533                  * transition can be performed and it's protected by
 534                  * mutex.
 535                  */
 536                 if (FFS_SETUP_STATE(ffs) == FFS_SETUP_CANCELED) {
 537                         ret = -EIDRM;
 538 done_spin:
 539                         spin_unlock_irq(&ffs->ev.waitq.lock);
 540                 } else {
 541                         /* unlocks spinlock */
 542                         ret = __ffs_ep0_queue_wait(ffs, data, len);
 543                 }
 544                 kfree(data);
 545                 break;
 546
 547         default:
 548                 ret = -EBADFD;
 549                 break;
 550         }
 551
 552         mutex_unlock(&ffs->mutex);
 553         return ret;
 554 }
 555
 556 static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
 557                                      size_t n)
 558 {
 559         /*
 560          * We are holding ffs->ev.waitq.lock and ffs->mutex and we need
 561          * to release them.
 562          */
 563         struct usb_functionfs_event events[n];
 564         unsigned i = 0;
 565
 566         memset(events, 0, sizeof events);
 567
 568         do {
 569                 events[i].type = ffs->ev.types[i];
 570                 if (events[i].type == FUNCTIONFS_SETUP) {
 571                         events[i].u.setup = ffs->ev.setup;
 572                         ffs->setup_state = FFS_SETUP_PENDING;
 573                 }
 574         } while (++i < n);
 575
 576         if (n < ffs->ev.count) {
 577                 ffs->ev.count -= n;
 578                 memmove(ffs->ev.types, ffs->ev.types + n,
 579                         ffs->ev.count * sizeof *ffs->ev.types);
 580         } else {
 581                 ffs->ev.count = 0;
 582         }
 583
 584         spin_unlock_irq(&ffs->ev.waitq.lock);
 585         mutex_unlock(&ffs->mutex);
 586
 587         return unlikely(__copy_to_user(buf, events, sizeof events))
 588                 ? -EFAULT : sizeof events;
 589 }
 590
 591 static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
 592                             size_t len, loff_t *ptr)
 593 {
 594         struct ffs_data *ffs = file->private_data;
 595         char *data = NULL;
 596         size_t n;
 597         int ret;
 598
 599         ENTER();
 600
 601         /* Fast check if setup was canceled */
 602         if (FFS_SETUP_STATE(ffs) == FFS_SETUP_CANCELED)
 603                 return -EIDRM;
 604
 605         /* Acquire mutex */
 606         ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
 607         if (unlikely(ret < 0))
 608                 return ret;
 609
 610         /* Check state */
 611         if (ffs->state != FFS_ACTIVE) {
 612                 ret = -EBADFD;
 613                 goto done_mutex;
 614         }
 615
 616         /*
 617          * We're called from user space, we can use _irq rather then
 618          * _irqsave
 619          */
 620         spin_lock_irq(&ffs->ev.waitq.lock);
 621
 622         switch (FFS_SETUP_STATE(ffs)) {
 623         case FFS_SETUP_CANCELED:
 624                 ret = -EIDRM;
 625                 break;
 626
 627         case FFS_NO_SETUP:
 628                 n = len / sizeof(struct usb_functionfs_event);
 629                 if (unlikely(!n)) {
 630                         ret = -EINVAL;
 631                         break;
 632                 }
 633
 634                 if ((file->f_flags & O_NONBLOCK) && !ffs->ev.count) {
 635                         ret = -EAGAIN;
 636                         break;
 637                 }
 638
 639                 if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq,
 640                                                         ffs->ev.count)) {
 641                         ret = -EINTR;
 642                         break;
 643                 }
 644
 645                 return __ffs_ep0_read_events(ffs, buf,
 646                                              min(n, (size_t)ffs->ev.count));
 647
 648         case FFS_SETUP_PENDING:
 649                 if (ffs->ev.setup.bRequestType & USB_DIR_IN) {
 650                         spin_unlock_irq(&ffs->ev.waitq.lock);
 651                         ret = __ffs_ep0_stall(ffs);
 652                         goto done_mutex;
 653                 }
 654
 655                 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength));
 656
 657                 spin_unlock_irq(&ffs->ev.waitq.lock);
 658
 659                 if (likely(len)) {
 660                         data = kmalloc(len, GFP_KERNEL);
 661                         if (unlikely(!data)) {
 662                                 ret = -ENOMEM;
 663                                 goto done_mutex;
 664                         }
 665                 }
 666
 667                 spin_lock_irq(&ffs->ev.waitq.lock);
 668
 669                 /* See ffs_ep0_write() */
 670                 if (FFS_SETUP_STATE(ffs) == FFS_SETUP_CANCELED) {
 671                         ret = -EIDRM;
 672                         break;
 673                 }
 674
 675                 /* unlocks spinlock */
 676                 ret = __ffs_ep0_queue_wait(ffs, data, len);
 677                 if (likely(ret > 0) && unlikely(__copy_to_user(buf, data, len)))
 678                         ret = -EFAULT;
 679                 goto done_mutex;
 680
 681         default:
 682                 ret = -EBADFD;
 683                 break;
 684         }
 685
 686         spin_unlock_irq(&ffs->ev.waitq.lock);
 687 done_mutex:
 688         mutex_unlock(&ffs->mutex);
 689         kfree(data);
 690         return ret;
 691 }
 692
 693 static int ffs_ep0_open(struct inode *inode, struct file *file)
 694 {
 695         struct ffs_data *ffs = inode->i_private;
 696
 697         ENTER();
 698
 699         if (unlikely(ffs->state == FFS_CLOSING))
 700                 return -EBUSY;
 701
 702         file->private_data = ffs;
 703         ffs_data_opened(ffs);
 704
 705         return 0;
 706 }
 707
 708 static int ffs_ep0_release(struct inode *inode, struct file *file)
 709 {
 710         struct ffs_data *ffs = file->private_data;
 711
 712         ENTER();
 713
 714         ffs_data_closed(ffs);
 715
 716         return 0;
 717 }
 718
 719 static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
 720 {
 721         struct ffs_data *ffs = file->private_data;
 722         struct usb_gadget *gadget = ffs->gadget;
 723         long ret;
 724
 725         ENTER();
 726
 727         if (code == FUNCTIONFS_INTERFACE_REVMAP) {
 728                 struct ffs_function *func = ffs->func;
 729                 ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
 730         } else if (gadget && gadget->ops->ioctl) {
 731                 ret = gadget->ops->ioctl(gadget, code, value);
 732         } else {
 733                 ret = -ENOTTY;
 734         }
 735
 736         return ret;
 737 }
 738
 739 static const struct file_operations ffs_ep0_operations = {
 740         .llseek =       no_llseek,
 741
 742         .open =         ffs_ep0_open,
 743         .write =        ffs_ep0_write,
 744         .read =         ffs_ep0_read,
 745         .release =      ffs_ep0_release,
 746         .unlocked_ioctl =       ffs_ep0_ioctl,
 747 };
 748
 749
 750 /* "Normal" endpoints operations ********************************************/
 751
 752 static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req)
 753 {
 754         struct  ffs_ep *ep = _ep->driver_data;
 755         ENTER();
 756         /* req may be freed during unbind */
 757         if (ep && ep->req && likely(req->context)) {
 758                 struct ffs_ep *ep = _ep->driver_data;
 759                 ep->status = req->status ? req->status : req->actual;
 760                 complete(req->context);
 761         }
 762 }
 763
 764 static ssize_t ffs_epfile_io(struct file *file,
 765                              char __user *buf, size_t len, int read)
 766 {
 767         struct ffs_epfile *epfile = file->private_data;
 768         struct ffs_data         *ffs = epfile->ffs;
 769         struct ffs_ep *ep;
 770         char *data = NULL;
 771         ssize_t ret, data_len;
 772         int halt;
 773
 774         if(read)
 775                 data = (char *)&recv_buffer[8];
 776         else
 777                 data = (char *)&send_buffer[8];
 778         goto first_try;
 779         do {
 780                 spin_unlock_irq(&epfile->ffs->eps_lock);
 781                 mutex_unlock(&epfile->mutex);
 782
 783 first_try:
 784                 /* Are we still active? */
 785                 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) {
 786                         ret = -ENODEV;
 787                         goto error;
 788                 }
 789
 790                 /* Wait for endpoint to be enabled */
 791                 ep = epfile->ep;
 792                 if (!ep) {
 793                         if (file->f_flags & O_NONBLOCK) {
 794                                 ret = -EAGAIN;
 795                                 goto error;
 796                         }
 797
 798                         if (wait_event_interruptible(epfile->wait,
 799                                                      (ep = epfile->ep))) {
 800                                 ret = -EINTR;
 801                                 goto error;
 802                         }
 803                 }
 804
 805                 /* Do we halt? */
 806                 halt = !read == !epfile->in;
 807                 if (halt && epfile->isoc) {
 808                         ret = -EINVAL;
 809                         goto error;
 810                 }
 811
 812                 /* Allocate & copy */
 813                 if (!halt) {
 814                         if(len < 8192)
 815                                 data_len = len;
 816                         else
 817                                 data_len = 8192;
 818
 819                         if (!read &&
 820                             unlikely(__copy_from_user(data, buf, data_len))) {
 821                                 ret = -EFAULT;
 822                                 goto error;
 823                         }
 824                 }
 825
 826                 /* We will be using request */
 827                 ret = ffs_mutex_lock(&epfile->mutex,
 828                                      file->f_flags & O_NONBLOCK);
 829                 if (unlikely(ret))
 830                         goto error;
 831
 832                 /*
 833                  * We're called from user space, we can use _irq rather then
 834                  * _irqsave
 835                  */
 836                 spin_lock_irq(&epfile->ffs->eps_lock);
 837
 838                 /*
 839                  * While we were acquiring mutex endpoint got disabled
 840                  * or changed?
 841                  */
 842         } while (unlikely(epfile->ep != ep));
 843
 844         /* Halt */
 845         if (unlikely(halt)) {
 846                 if (likely(epfile->ep == ep) && !WARN_ON(!ep->ep))
 847                         usb_ep_set_halt(ep->ep);
 848                 spin_unlock_irq(&epfile->ffs->eps_lock);
 849                 ret = -EBADMSG;
 850         } else {
 851                 /* Fire the request */
 852                 struct completion               *done;
 853
 854                 struct usb_request *req = ep->req;
 855                 req->complete = ffs_epfile_io_complete;
 856                 req->buf      = data;
 857                 req->length   = data_len;
 858
 859                 if (read) {
 860                                 INIT_COMPLETION(ffs->epout_completion);
 861                                 req->context = done = &ffs->epout_completion;
 862                 } else {
 863                                 INIT_COMPLETION(ffs->epin_completion);
 864                                 req->context = done = &ffs->epin_completion;
 865                 }
 866
 867                 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
 868
 869                 spin_unlock_irq(&epfile->ffs->eps_lock);
 870
 871                 if (unlikely(ret < 0)) {
 872                         /* nop */
 873                 } else  if (unlikely(wait_for_completion_interruptible(done))) {
 874                                 ret = -EINTR;
 875                                 usb_ep_dequeue(ep->ep, req);
 876                 } else {
 877                                 ret = ep->status;
 878                                 if (read && ret > 0){
 879                                         ret = min_t(size_t, ret, len);
 880                                         if(unlikely(copy_to_user(buf, data, ret)))
 881                                                 ret = -EFAULT;
 882                         }
 883                 }
 884         }
 885
 886         mutex_unlock(&epfile->mutex);
 887 error:
 888         return ret;
 889 }
 890
 891 static ssize_t
 892 ffs_epfile_write(struct file *file, const char __user *buf, size_t len, loff_t *ptr)
 893 {
 894         int sent_len;
 895         int temp_len=len;
 896
 897         ENTER();
 898
 899         do{
 900                 sent_len =  ffs_epfile_io(file, (char __user *)buf, temp_len,0);
 901                 if(sent_len > 0){
 902                         buf += sent_len;
 903                         temp_len -= sent_len;
 904                 } else return sent_len;
 905         }while(temp_len>0);
 906
 907         return len;
 908 }
 909
 910 static ssize_t
 911 ffs_epfile_read(struct file *file, char __user *buf, size_t len, loff_t *ptr)
 912 {
 913         ENTER();
 914
 915         return ffs_epfile_io(file, buf, len, 1);
 916 }
 917
 918 static int
 919 ffs_epfile_open(struct inode *inode, struct file *file)
 920 {
 921         struct ffs_epfile *epfile = inode->i_private;
 922
 923         ENTER();
 924
 925         if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
 926                 return -ENODEV;
 927
 928         file->private_data = epfile;
 929         ffs_data_opened(epfile->ffs);
 930
 931         return 0;
 932 }
 933
 934 static int
 935 ffs_epfile_release(struct inode *inode, struct file *file)
 936 {
 937         struct ffs_epfile *epfile = inode->i_private;
 938
 939         ENTER();
 940
 941         ffs_data_closed(epfile->ffs);
 942
 943         return 0;
 944 }
 945
 946 static long ffs_epfile_ioctl(struct file *file, unsigned code,
 947                              unsigned long value)
 948 {
 949         struct ffs_epfile *epfile = file->private_data;
 950         int ret;
 951
 952         ENTER();
 953
 954         if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
 955                 return -ENODEV;
 956
 957         spin_lock_irq(&epfile->ffs->eps_lock);
 958         if (likely(epfile->ep)) {
 959                 switch (code) {
 960                 case FUNCTIONFS_FIFO_STATUS:
 961                         ret = usb_ep_fifo_status(epfile->ep->ep);
 962                         break;
 963                 case FUNCTIONFS_FIFO_FLUSH:
 964                         usb_ep_fifo_flush(epfile->ep->ep);
 965                         ret = 0;
 966                         break;
 967                 case FUNCTIONFS_CLEAR_HALT:
 968                         ret = usb_ep_clear_halt(epfile->ep->ep);
 969                         break;
 970                 case FUNCTIONFS_ENDPOINT_REVMAP:
 971                         ret = epfile->ep->num;
 972                         break;
 973                 default:
 974                         ret = -ENOTTY;
 975                 }
 976         } else {
 977                 ret = -ENODEV;
 978         }
 979         spin_unlock_irq(&epfile->ffs->eps_lock);
 980
 981         return ret;
 982 }
 983
 984 static const struct file_operations ffs_epfile_operations = {
 985         .llseek =       no_llseek,
 986
 987         .open =         ffs_epfile_open,
 988         .write =        ffs_epfile_write,
 989         .read =         ffs_epfile_read,
 990         .release =      ffs_epfile_release,
 991         .unlocked_ioctl =       ffs_epfile_ioctl,
 992 };
 993
 994
 995 /* File system and super block operations ***********************************/
 996
 997 /*
 998  * Mounting the file system creates a controller file, used first for
 999  * function configuration then later for event monitoring.
1000  */
1001
1002 static struct inode *__must_check
1003 ffs_sb_make_inode(struct super_block *sb, void *data,
1004                   const struct file_operations *fops,
1005                   const struct inode_operations *iops,
1006                   struct ffs_file_perms *perms)
1007 {
1008         struct inode *inode;
1009
1010         ENTER();
1011
1012         inode = new_inode(sb);
1013
1014         if (likely(inode)) {
1015                 struct timespec current_time = CURRENT_TIME;
1016
1017                 inode->i_ino     = get_next_ino();
1018                 inode->i_mode    = perms->mode;
1019                 inode->i_uid     = perms->uid;
1020                 inode->i_gid     = perms->gid;
1021                 inode->i_atime   = current_time;
1022                 inode->i_mtime   = current_time;
1023                 inode->i_ctime   = current_time;
1024                 inode->i_private = data;
1025                 if (fops)
1026                         inode->i_fop = fops;
1027                 if (iops)
1028                         inode->i_op  = iops;
1029         }
1030
1031         return inode;
1032 }
1033
1034 /* Create "regular" file */
1035 static struct inode *ffs_sb_create_file(struct super_block *sb,
1036                                         const char *name, void *data,
1037                                         const struct file_operations *fops,
1038                                         struct dentry **dentry_p)
1039 {
1040         struct ffs_data *ffs = sb->s_fs_info;
1041         struct dentry   *dentry;
1042         struct inode    *inode;
1043
1044         ENTER();
1045
1046         dentry = d_alloc_name(sb->s_root, name);
1047         if (unlikely(!dentry))
1048                 return NULL;
1049
1050         inode = ffs_sb_make_inode(sb, data, fops, NULL, &ffs->file_perms);
1051         if (unlikely(!inode)) {
1052                 dput(dentry);
1053                 return NULL;
1054         }
1055
1056         d_add(dentry, inode);
1057         if (dentry_p)
1058                 *dentry_p = dentry;
1059
1060         return inode;
1061 }
1062
1063 /* Super block */
1064 static const struct super_operations ffs_sb_operations = {
1065         .statfs =       simple_statfs,
1066         .drop_inode =   generic_delete_inode,
1067 };
1068
1069 struct ffs_sb_fill_data {
1070         struct ffs_file_perms perms;
1071         umode_t root_mode;
1072         const char *dev_name;
1073         /*add by chunhou.wang for kernel crash bug 378800*/
1074         bool no_disconnect;
1075         /*end add by chunhou.wang*/
1076         struct ffs_data *ffs_data;
1077 };
1078
1079 static int ffs_sb_fill(struct super_block *sb, void *_data, int silent)
1080 {
1081         struct ffs_sb_fill_data *data = _data;
1082         struct inode    *inode;
1083         struct ffs_data *ffs = data->ffs_data;
1084
1085         ENTER();
1086
1087         ffs->sb              = sb;
1088         data->ffs_data       = NULL;
1089         sb->s_fs_info        = ffs;
1090         sb->s_blocksize      = PAGE_CACHE_SIZE;
1091         sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
1092         sb->s_magic          = FUNCTIONFS_MAGIC;
1093         sb->s_op             = &ffs_sb_operations;
1094         sb->s_time_gran      = 1;
1095
1096         /* Root inode */
1097         data->perms.mode = data->root_mode;
1098         inode = ffs_sb_make_inode(sb, NULL,
1099                                   &simple_dir_operations,
1100                                   &simple_dir_inode_operations,
1101                                   &data->perms);
1102         sb->s_root = d_make_root(inode);
1103         if (unlikely(!sb->s_root))
1104                 return -ENOMEM;
1105
1106         /* EP0 file */
1107         if (unlikely(!ffs_sb_create_file(sb, "ep0", ffs,
1108                                          &ffs_ep0_operations, NULL)))
1109                 return -ENOMEM;
1110
1111         return 0;
1112 }
1113
1114 static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
1115 {
1116         ENTER();
1117
1118         if (!opts || !*opts)
1119                 return 0;
1120
1121         for (;;) {
1122                 unsigned long value;
1123                 char *eq, *comma;
1124
1125                 /* Option limit */
1126                 comma = strchr(opts, ',');
1127                 if (comma)
1128                         *comma = 0;
1129
1130                 /* Value limit */
1131                 eq = strchr(opts, '=');
1132                 if (unlikely(!eq)) {
1133                         pr_err("'=' missing in %s\n", opts);
1134                         return -EINVAL;
1135                 }
1136                 *eq = 0;
1137
1138                 /* Parse value */
1139                 if (kstrtoul(eq + 1, 0, &value)) {
1140                         pr_err("%s: invalid value: %s\n", opts, eq + 1);
1141                         return -EINVAL;
1142                 }
1143
1144                 /* Interpret option */
1145                 switch (eq - opts) {
1146                 /*add by chunhou.wang for kernel crash bug 378800*/
1147                 case 13:
1148                         if (!memcmp(opts, "no_disconnect", 13))
1149                                 data->no_disconnect = !!value;
1150                         else
1151                                 goto invalid;
1152                         break;
1153                 /*end add by chunhou.wang*/
1154                 case 5:
1155                         if (!memcmp(opts, "rmode", 5))
1156                                 data->root_mode  = (value & 0555) | S_IFDIR;
1157                         else if (!memcmp(opts, "fmode", 5))
1158                                 data->perms.mode = (value & 0666) | S_IFREG;
1159                         else
1160                                 goto invalid;
1161                         break;
1162
1163                 case 4:
1164                         if (!memcmp(opts, "mode", 4)) {
1165                                 data->root_mode  = (value & 0555) | S_IFDIR;
1166                                 data->perms.mode = (value & 0666) | S_IFREG;
1167                         } else {
1168                                 goto invalid;
1169                         }
1170                         break;
1171
1172                 case 3:
1173                         if (!memcmp(opts, "uid", 3)) {
1174                                 data->perms.uid = make_kuid(current_user_ns(), value);
1175                                 if (!uid_valid(data->perms.uid)) {
1176                                         pr_err("%s: unmapped value: %lu\n", opts, value);
1177                                         return -EINVAL;
1178                                 }
1179                         } else if (!memcmp(opts, "gid", 3)) {
1180                                 data->perms.gid = make_kgid(current_user_ns(), value);
1181                                 if (!gid_valid(data->perms.gid)) {
1182                                         pr_err("%s: unmapped value: %lu\n", opts, value);
1183                                         return -EINVAL;
1184                                 }
1185                         } else {
1186                                 goto invalid;
1187                         }
1188                         break;
1189
1190                 default:
1191 invalid:
1192                         pr_err("%s: invalid option\n", opts);
1193                         return -EINVAL;
1194                 }
1195
1196                 /* Next iteration */
1197                 if (!comma)
1198                         break;
1199                 opts = comma + 1;
1200         }
1201
1202         return 0;
1203 }
1204
1205 /* "mount -t functionfs dev_name /dev/function" ends up here */
1206
1207 static struct dentry *
1208 ffs_fs_mount(struct file_system_type *t, int flags,
1209               const char *dev_name, void *opts)
1210 {
1211         struct ffs_sb_fill_data data = {
1212                 .perms = {
1213                         .mode = S_IFREG | 0600,
1214                         .uid = GLOBAL_ROOT_UID,
1215                         .gid = GLOBAL_ROOT_GID,
1216                 },
1217                 .root_mode = S_IFDIR | 0500,
1218                 /*add by chunhou.wang for kernel crash bug 378800*/
1219                 .no_disconnect = false,
1220                 /*end add by chunhou.wang*/
1221         };
1222         struct dentry *rv;
1223         int ret;
1224         void *ffs_dev;
1225         struct ffs_data *ffs;
1226
1227         ENTER();
1228
1229         ret = ffs_fs_parse_opts(&data, opts);
1230         if (unlikely(ret < 0))
1231                 return ERR_PTR(ret);
1232
1233         ffs = ffs_data_new();
1234         if (unlikely(!ffs))
1235                 return ERR_PTR(-ENOMEM);
1236         ffs->file_perms = data.perms;
1237         /*add by chunhou.wang for kernel crash bug 378800*/
1238         ffs->no_disconnect = data.no_disconnect;
1239         /*end add by chunhou.wang*/
1240
1241         ffs->dev_name = kstrdup(dev_name, GFP_KERNEL);
1242         if (unlikely(!ffs->dev_name)) {
1243                 ffs_data_put(ffs);
1244                 return ERR_PTR(-ENOMEM);
1245         }
1246
1247         ffs_dev = functionfs_acquire_dev_callback(dev_name);
1248         if (IS_ERR(ffs_dev)) {
1249                 ffs_data_put(ffs);
1250                 return ERR_CAST(ffs_dev);
1251         }
1252         ffs->private_data = ffs_dev;
1253         data.ffs_data = ffs;
1254
1255         rv = mount_nodev(t, flags, &data, ffs_sb_fill);
1256         if (IS_ERR(rv) && data.ffs_data) {
1257                 functionfs_release_dev_callback(data.ffs_data);
1258                 ffs_data_put(data.ffs_data);
1259         }
1260         return rv;
1261 }
1262
1263 static void
1264 ffs_fs_kill_sb(struct super_block *sb)
1265 {
1266         ENTER();
1267
1268         kill_litter_super(sb);
1269         if (sb->s_fs_info) {
1270                 functionfs_release_dev_callback(sb->s_fs_info);
1271                 /*add by chunhou.wang for kernel crash bug 378800*/
1272                 ffs_data_closed(sb->s_fs_info);
1273                 /*end add by chunhou.wang*/
1274                 ffs_data_put(sb->s_fs_info);
1275         }
1276 }
1277
1278 static struct file_system_type ffs_fs_type = {
1279         .owner          = THIS_MODULE,
1280         .name           = "functionfs",
1281         .mount          = ffs_fs_mount,
1282         .kill_sb        = ffs_fs_kill_sb,
1283 };
1284 MODULE_ALIAS_FS("functionfs");
1285
1286
1287 /* Driver's main init/cleanup functions *************************************/
1288
1289 static int functionfs_init(void)
1290 {
1291         int ret;
1292
1293         ENTER();
1294
1295         ret = register_filesystem(&ffs_fs_type);
1296         if (likely(!ret))
1297                 pr_info("file system registered\n");
1298         else
1299                 pr_err("failed registering file system (%d)\n", ret);
1300
1301         return ret;
1302 }
1303
1304 static void functionfs_cleanup(void)
1305 {
1306         ENTER();
1307
1308         pr_info("unloading\n");
1309         unregister_filesystem(&ffs_fs_type);
1310 }
1311
1312
1313 /* ffs_data and ffs_function construction and destruction code **************/
1314
1315 static void ffs_data_clear(struct ffs_data *ffs);
1316 static void ffs_data_reset(struct ffs_data *ffs);
1317
1318 static void ffs_data_get(struct ffs_data *ffs)
1319 {
1320         ENTER();
1321
1322         atomic_inc(&ffs->ref);
1323 }
1324
1325 static void ffs_data_opened(struct ffs_data *ffs)
1326 {
1327         ENTER();
1328
1329         atomic_inc(&ffs->ref);
1330         /*add by chunhou.wang for kernel crash bug 378800*/
1331         //atomic_inc(&ffs->opened);
1332         if (atomic_add_return(1, &ffs->opened) == 1)
1333                 if (ffs->state == FFS_DEACTIVATED)
1334                         ffs_data_reset(ffs);
1335         /*end add by chunhou.wang*/
1336 }
1337
1338 static void ffs_data_put(struct ffs_data *ffs)
1339 {
1340         ENTER();
1341
1342         if (unlikely(atomic_dec_and_test(&ffs->ref))) {
1343                 pr_info("%s(): freeing\n", __func__);
1344                 ffs_data_clear(ffs);
1345                 BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
1346                        waitqueue_active(&ffs->ep0req_completion.wait));
1347                 kfree(ffs->dev_name);
1348                 kfree(ffs);
1349         }
1350 }
1351
1352 static void ffs_data_closed(struct ffs_data *ffs)
1353 {
1354         ENTER();
1355
1356         if (atomic_dec_and_test(&ffs->opened)) {
1357                 /*add by chunhou.wang for kernel crash bug 378800*/
1358                 if (ffs->no_disconnect) {
1359                         ffs->state = FFS_DEACTIVATED;
1360                         if (ffs->epfiles) {
1361                                 ffs_epfiles_destroy(ffs->epfiles,ffs->eps_count);
1362                                 ffs->epfiles = NULL;
1363                         }
1364                         if (ffs->setup_state == FFS_SETUP_PENDING)
1365                                 __ffs_ep0_stall(ffs);
1366                 }else{
1367                          ffs->state = FFS_CLOSING;
1368                          ffs_data_reset(ffs);
1369                 }
1370         }
1371         if (atomic_read(&ffs->opened) < 0)
1372                 ffs_data_clear(ffs);
1373         /*end add by chunhou.wang*/
1374         ffs_data_put(ffs);
1375 }
1376
1377 static struct ffs_data *ffs_data_new(void)
1378 {
1379         struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
1380         if (unlikely(!ffs))
1381                 return 0;
1382
1383         ENTER();
1384
1385         atomic_set(&ffs->ref, 1);
1386         atomic_set(&ffs->opened, 0);
1387         ffs->state = FFS_READ_DESCRIPTORS;
1388         mutex_init(&ffs->mutex);
1389         spin_lock_init(&ffs->eps_lock);
1390         init_waitqueue_head(&ffs->ev.waitq);
1391         init_completion(&ffs->ep0req_completion);
1392         init_completion(&ffs->epin_completion);
1393         init_completion(&ffs->epout_completion);
1394
1395         /* XXX REVISIT need to update it in some places, or do we? */
1396         ffs->ev.can_stall = 1;
1397
1398         return ffs;
1399 }
1400
1401 static void ffs_data_clear(struct ffs_data *ffs)
1402 {
1403         ENTER();
1404
1405         if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags))
1406                 functionfs_closed_callback(ffs);
1407
1408         BUG_ON(ffs->gadget);
1409
1410         if (ffs->epfiles)
1411                 ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count);
1412
1413         kfree(ffs->raw_descs);
1414         kfree(ffs->raw_strings);
1415         kfree(ffs->stringtabs);
1416 }
1417
1418 static void ffs_data_reset(struct ffs_data *ffs)
1419 {
1420         ENTER();
1421
1422         ffs_data_clear(ffs);
1423
1424         ffs->epfiles = NULL;
1425         ffs->raw_descs = NULL;
1426         ffs->raw_strings = NULL;
1427         ffs->stringtabs = NULL;
1428
1429         ffs->raw_descs_length = 0;
1430         ffs->raw_fs_descs_length = 0;
1431         ffs->fs_descs_count = 0;
1432         ffs->hs_descs_count = 0;
1433
1434         ffs->strings_count = 0;
1435         ffs->interfaces_count = 0;
1436         ffs->eps_count = 0;
1437
1438         ffs->ev.count = 0;
1439
1440         ffs->state = FFS_READ_DESCRIPTORS;
1441         ffs->setup_state = FFS_NO_SETUP;
1442         ffs->flags = 0;
1443 }
1444
1445
1446 static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
1447 {
1448         struct usb_gadget_strings **lang;
1449         int first_id;
1450
1451         ENTER();
1452
1453         if (WARN_ON(ffs->state != FFS_ACTIVE
1454                  || test_and_set_bit(FFS_FL_BOUND, &ffs->flags)))
1455                 return -EBADFD;
1456
1457         first_id = usb_string_ids_n(cdev, ffs->strings_count);
1458         if (unlikely(first_id < 0))
1459                 return first_id;
1460
1461         ffs->ep0req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL);
1462         if (unlikely(!ffs->ep0req))
1463                 return -ENOMEM;
1464         ffs->ep0req->complete = ffs_ep0_complete;
1465         ffs->ep0req->context = ffs;
1466
1467         lang = ffs->stringtabs;
1468         if (lang) {
1469                 for (; *lang; ++lang) {
1470                         struct usb_string *str = (*lang)->strings;
1471                         int id = first_id;
1472                         for (; str->s; ++id, ++str)
1473                                 str->id = id;
1474                 }
1475         }
1476
1477         ffs->gadget = cdev->gadget;
1478         ffs_data_get(ffs);
1479         return 0;
1480 }
1481
1482 static void functionfs_unbind(struct ffs_data *ffs)
1483 {
1484         ENTER();
1485
1486         if (!WARN_ON(!ffs->gadget)) {
1487                 usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req);
1488                 ffs->ep0req = NULL;
1489                 ffs->gadget = NULL;
1490                 ffs_data_put(ffs);
1491                 clear_bit(FFS_FL_BOUND, &ffs->flags);
1492         }
1493 }
1494
1495 static int ffs_epfiles_create(struct ffs_data *ffs)
1496 {
1497         struct ffs_epfile *epfile, *epfiles;
1498         unsigned i, count;
1499
1500         ENTER();
1501
1502         count = ffs->eps_count;
1503         epfiles = kcalloc(count, sizeof(*epfiles), GFP_KERNEL);
1504         if (!epfiles)
1505                 return -ENOMEM;
1506
1507         epfile = epfiles;
1508         for (i = 1; i <= count; ++i, ++epfile) {
1509                 epfile->ffs = ffs;
1510                 mutex_init(&epfile->mutex);
1511                 init_waitqueue_head(&epfile->wait);
1512                 sprintf(epfiles->name, "ep%u",  i);
1513                 if (!unlikely(ffs_sb_create_file(ffs->sb, epfiles->name, epfile,
1514                                                  &ffs_epfile_operations,
1515                                                  &epfile->dentry))) {
1516                         ffs_epfiles_destroy(epfiles, i - 1);
1517                         return -ENOMEM;
1518                 }
1519         }
1520
1521         ffs->epfiles = epfiles;
1522         return 0;
1523 }
1524
1525 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count)
1526 {
1527         struct ffs_epfile *epfile = epfiles;
1528
1529         ENTER();
1530
1531         for (; count; --count, ++epfile) {
1532                 BUG_ON(mutex_is_locked(&epfile->mutex) ||
1533                        waitqueue_active(&epfile->wait));
1534                 if (epfile->dentry) {
1535                         d_delete(epfile->dentry);
1536                         dput(epfile->dentry);
1537                         epfile->dentry = NULL;
1538                 }
1539         }
1540
1541         kfree(epfiles);
1542 }
1543
1544 static int functionfs_bind_config(struct usb_composite_dev *cdev,
1545                                   struct usb_configuration *c,
1546                                   struct ffs_data *ffs)
1547 {
1548         struct ffs_function *func;
1549         int ret;
1550
1551         ENTER();
1552
1553         func = kzalloc(sizeof *func, GFP_KERNEL);
1554         if (unlikely(!func))
1555                 return -ENOMEM;
1556
1557         func->function.name    = "Function FS Gadget";
1558         func->function.strings = ffs->stringtabs;
1559
1560         func->function.bind    = ffs_func_bind;
1561         func->function.unbind  = ffs_func_unbind;
1562         func->function.set_alt = ffs_func_set_alt;
1563         func->function.disable = ffs_func_disable;
1564         func->function.setup   = ffs_func_setup;
1565         func->function.suspend = ffs_func_suspend;
1566         func->function.resume  = ffs_func_resume;
1567
1568         func->conf   = c;
1569         func->gadget = cdev->gadget;
1570         func->ffs = ffs;
1571         ffs_data_get(ffs);
1572
1573         ret = usb_add_function(c, &func->function);
1574         if (unlikely(ret))
1575                 ffs_func_free(func);
1576
1577         return ret;
1578 }
1579
1580 static void ffs_func_free(struct ffs_function *func)
1581 {
1582         struct ffs_ep *ep         = func->eps;
1583         unsigned count            = func->ffs->eps_count;
1584         unsigned long flags;
1585
1586         ENTER();
1587
1588         /* cleanup after autoconfig */
1589         spin_lock_irqsave(&func->ffs->eps_lock, flags);
1590         do {
1591                 if (ep->ep && ep->req)
1592                         usb_ep_free_request(ep->ep, ep->req);
1593                 ep->req = NULL;
1594                 ++ep;
1595         } while (--count);
1596         spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
1597
1598         ffs_data_put(func->ffs);
1599
1600         kfree(func->eps);
1601         /*
1602          * eps and interfaces_nums are allocated in the same chunk so
1603          * only one free is required.  Descriptors are also allocated
1604          * in the same chunk.
1605          */
1606
1607         kfree(func);
1608 }
1609
1610 static void ffs_func_eps_disable(struct ffs_function *func)
1611 {
1612         struct ffs_ep *ep         = func->eps;
1613         struct ffs_epfile *epfile = func->ffs->epfiles;
1614         unsigned count            = func->ffs->eps_count;
1615         unsigned long flags;
1616
1617         spin_lock_irqsave(&func->ffs->eps_lock, flags);
1618         do {
1619                 /* pending requests get nuked */
1620                 if (likely(ep->ep))
1621                         usb_ep_disable(ep->ep);
1622                 epfile->ep = NULL;
1623
1624                 /*add by chunhou.wang for kernel crash bug 378800*/
1625                 ++ep;
1626                 if(epfile){
1627                         epfile->ep = NULL;
1628                         ++epfile;
1629                 }
1630                 /*end add by chunhou.wang*/
1631         } while (--count);
1632         spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
1633 }
1634
1635 static int ffs_func_eps_enable(struct ffs_function *func)
1636 {
1637         struct ffs_data *ffs      = func->ffs;
1638         struct ffs_ep *ep         = func->eps;
1639         struct ffs_epfile *epfile = ffs->epfiles;
1640         unsigned count            = ffs->eps_count;
1641         unsigned long flags;
1642         int ret = 0;
1643
1644         spin_lock_irqsave(&func->ffs->eps_lock, flags);
1645         do {
1646                 struct usb_endpoint_descriptor *ds;
1647                 int desc_idx = ffs->gadget->speed == USB_SPEED_HIGH ? 1 : 0;
1648                 ds = ep->descs[desc_idx];
1649                 if (!ds) {
1650                         ret = -EINVAL;
1651                         break;
1652                 }
1653
1654                 ep->ep->driver_data = ep;
1655                 ep->ep->desc = ds;
1656                 ret = usb_ep_enable(ep->ep);
1657                 if (likely(!ret)) {
1658                         epfile->ep = ep;
1659                         epfile->in = usb_endpoint_dir_in(ds);
1660                         epfile->isoc = usb_endpoint_xfer_isoc(ds);
1661                 } else {
1662                         break;
1663                 }
1664
1665                 wake_up(&epfile->wait);
1666
1667                 ++ep;
1668                 ++epfile;
1669         } while (--count);
1670         spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
1671
1672         return ret;
1673 }
1674
1675
1676 /* Parsing and building descriptors and strings *****************************/
1677
1678 /*
1679  * This validates if data pointed by data is a valid USB descriptor as
1680  * well as record how many interfaces, endpoints and strings are
1681  * required by given configuration.  Returns address after the
1682  * descriptor or NULL if data is invalid.
1683  */
1684
1685 enum ffs_entity_type {
1686         FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT
1687 };
1688
1689 typedef int (*ffs_entity_callback)(enum ffs_entity_type entity,
1690                                    u8 *valuep,
1691                                    struct usb_descriptor_header *desc,
1692                                    void *priv);
1693
1694 static int __must_check ffs_do_desc(char *data, unsigned len,
1695                                     ffs_entity_callback entity, void *priv)
1696 {
1697         struct usb_descriptor_header *_ds = (void *)data;
1698         u8 length;
1699         int ret;
1700
1701         ENTER();
1702
1703         /* At least two bytes are required: length and type */
1704         if (len < 2) {
1705                 pr_vdebug("descriptor too short\n");
1706                 return -EINVAL;
1707         }
1708
1709         /* If we have at least as many bytes as the descriptor takes? */
1710         length = _ds->bLength;
1711         if (len < length) {
1712                 pr_vdebug("descriptor longer then available data\n");
1713                 return -EINVAL;
1714         }
1715
1716 #define __entity_check_INTERFACE(val)  1
1717 #define __entity_check_STRING(val)     (val)
1718 #define __entity_check_ENDPOINT(val)   ((val) & USB_ENDPOINT_NUMBER_MASK)
1719 #define __entity(type, val) do {                                        \
1720                 pr_vdebug("entity " #type "(%02x)\n", (val));           \
1721                 if (unlikely(!__entity_check_ ##type(val))) {           \
1722                         pr_vdebug("invalid entity's value\n");          \
1723                         return -EINVAL;                                 \
1724                 }                                                       \
1725                 ret = entity(FFS_ ##type, &val, _ds, priv);             \
1726                 if (unlikely(ret < 0)) {                                \
1727                         pr_debug("entity " #type "(%02x); ret = %d\n",  \
1728                                  (val), ret);                           \
1729                         return ret;                                     \
1730                 }                                                       \
1731         } while (0)
1732
1733         /* Parse descriptor depending on type. */
1734         switch (_ds->bDescriptorType) {
1735         case USB_DT_DEVICE:
1736         case USB_DT_CONFIG:
1737         case USB_DT_STRING:
1738         case USB_DT_DEVICE_QUALIFIER:
1739                 /* function can't have any of those */
1740                 pr_vdebug("descriptor reserved for gadget: %d\n",
1741                       _ds->bDescriptorType);
1742                 return -EINVAL;
1743
1744         case USB_DT_INTERFACE: {
1745                 struct usb_interface_descriptor *ds = (void *)_ds;
1746                 pr_vdebug("interface descriptor\n");
1747                 if (length != sizeof *ds)
1748                         goto inv_length;
1749
1750                 __entity(INTERFACE, ds->bInterfaceNumber);
1751                 if (ds->iInterface)
1752                         __entity(STRING, ds->iInterface);
1753         }
1754                 break;
1755
1756         case USB_DT_ENDPOINT: {
1757                 struct usb_endpoint_descriptor *ds = (void *)_ds;
1758                 pr_vdebug("endpoint descriptor\n");
1759                 if (length != USB_DT_ENDPOINT_SIZE &&
1760                     length != USB_DT_ENDPOINT_AUDIO_SIZE)
1761                         goto inv_length;
1762                 __entity(ENDPOINT, ds->bEndpointAddress);
1763         }
1764                 break;
1765
1766         case HID_DT_HID:
1767                 pr_vdebug("hid descriptor\n");
1768                 if (length != sizeof(struct hid_descriptor))
1769                         goto inv_length;
1770                 break;
1771
1772         case USB_DT_OTG:
1773                 if (length != sizeof(struct usb_otg_descriptor))
1774                         goto inv_length;
1775                 break;
1776
1777         case USB_DT_INTERFACE_ASSOCIATION: {
1778                 struct usb_interface_assoc_descriptor *ds = (void *)_ds;
1779                 pr_vdebug("interface association descriptor\n");
1780                 if (length != sizeof *ds)
1781                         goto inv_length;
1782                 if (ds->iFunction)
1783                         __entity(STRING, ds->iFunction);
1784         }
1785                 break;
1786
1787         case USB_DT_OTHER_SPEED_CONFIG:
1788         case USB_DT_INTERFACE_POWER:
1789         case USB_DT_DEBUG:
1790         case USB_DT_SECURITY:
1791         case USB_DT_CS_RADIO_CONTROL:
1792                 /* TODO */
1793                 pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType);
1794                 return -EINVAL;
1795
1796         default:
1797                 /* We should never be here */
1798                 pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType);
1799                 return -EINVAL;
1800
1801 inv_length:
1802                 pr_vdebug("invalid length: %d (descriptor %d)\n",
1803                           _ds->bLength, _ds->bDescriptorType);
1804                 return -EINVAL;
1805         }
1806
1807 #undef __entity
1808 #undef __entity_check_DESCRIPTOR
1809 #undef __entity_check_INTERFACE
1810 #undef __entity_check_STRING
1811 #undef __entity_check_ENDPOINT
1812
1813         return length;
1814 }
1815
1816 static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len,
1817                                      ffs_entity_callback entity, void *priv)
1818 {
1819         const unsigned _len = len;
1820         unsigned long num = 0;
1821
1822         ENTER();
1823
1824         for (;;) {
1825                 int ret;
1826
1827                 if (num == count)
1828                         data = NULL;
1829
1830                 /* Record "descriptor" entity */
1831                 ret = entity(FFS_DESCRIPTOR, (u8 *)num, (void *)data, priv);
1832                 if (unlikely(ret < 0)) {
1833                         pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n",
1834                                  num, ret);
1835                         return ret;
1836                 }
1837
1838                 if (!data)
1839                         return _len - len;
1840
1841                 ret = ffs_do_desc(data, len, entity, priv);
1842                 if (unlikely(ret < 0)) {
1843                         pr_debug("%s returns %d\n", __func__, ret);
1844                         return ret;
1845                 }
1846
1847                 len -= ret;
1848                 data += ret;
1849                 ++num;
1850         }
1851 }
1852
1853 static int __ffs_data_do_entity(enum ffs_entity_type type,
1854                                 u8 *valuep, struct usb_descriptor_header *desc,
1855                                 void *priv)
1856 {
1857         struct ffs_data *ffs = priv;
1858
1859         ENTER();
1860
1861         switch (type) {
1862         case FFS_DESCRIPTOR:
1863                 break;
1864
1865         case FFS_INTERFACE:
1866                 /*
1867                  * Interfaces are indexed from zero so if we
1868                  * encountered interface "n" then there are at least
1869                  * "n+1" interfaces.
1870                  */
1871                 if (*valuep >= ffs->interfaces_count)
1872                         ffs->interfaces_count = *valuep + 1;
1873                 break;
1874
1875         case FFS_STRING:
1876                 /*
1877                  * Strings are indexed from 1 (0 is magic ;) reserved
1878                  * for languages list or some such)
1879                  */
1880                 if (*valuep > ffs->strings_count)
1881                         ffs->strings_count = *valuep;
1882                 break;
1883
1884         case FFS_ENDPOINT:
1885                 /* Endpoints are indexed from 1 as well. */
1886                 if ((*valuep & USB_ENDPOINT_NUMBER_MASK) > ffs->eps_count)
1887                         ffs->eps_count = (*valuep & USB_ENDPOINT_NUMBER_MASK);
1888                 break;
1889         }
1890
1891         return 0;
1892 }
1893
1894 static int __ffs_data_got_descs(struct ffs_data *ffs,
1895                                 char *const _data, size_t len)
1896 {
1897         unsigned fs_count, hs_count;
1898         int fs_len, ret = -EINVAL;
1899         char *data = _data;
1900
1901         ENTER();
1902
1903         if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_DESCRIPTORS_MAGIC ||
1904                      get_unaligned_le32(data + 4) != len))
1905                 goto error;
1906         fs_count = get_unaligned_le32(data +  8);
1907         hs_count = get_unaligned_le32(data + 12);
1908
1909         if (!fs_count && !hs_count)
1910                 goto einval;
1911
1912         data += 16;
1913         len  -= 16;
1914
1915         if (likely(fs_count)) {
1916                 fs_len = ffs_do_descs(fs_count, data, len,
1917                                       __ffs_data_do_entity, ffs);
1918                 if (unlikely(fs_len < 0)) {
1919                         ret = fs_len;
1920                         goto error;
1921                 }
1922
1923                 data += fs_len;
1924                 len  -= fs_len;
1925         } else {
1926                 fs_len = 0;
1927         }
1928
1929         if (likely(hs_count)) {
1930                 ret = ffs_do_descs(hs_count, data, len,
1931                                    __ffs_data_do_entity, ffs);
1932                 if (unlikely(ret < 0))
1933                         goto error;
1934         } else {
1935                 ret = 0;
1936         }
1937
1938         if (unlikely(len != ret))
1939                 goto einval;
1940
1941         ffs->raw_fs_descs_length = fs_len;
1942         ffs->raw_descs_length    = fs_len + ret;
1943         ffs->raw_descs           = _data;
1944         ffs->fs_descs_count      = fs_count;
1945         ffs->hs_descs_count      = hs_count;
1946
1947         return 0;
1948
1949 einval:
1950         ret = -EINVAL;
1951 error:
1952         kfree(_data);
1953         return ret;
1954 }
1955
1956 static int __ffs_data_got_strings(struct ffs_data *ffs,
1957                                   char *const _data, size_t len)
1958 {
1959         u32 str_count, needed_count, lang_count;
1960         struct usb_gadget_strings **stringtabs, *t;
1961         struct usb_string *strings, *s;
1962         const char *data = _data;
1963
1964         ENTER();
1965
1966         if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
1967                      get_unaligned_le32(data + 4) != len))
1968                 goto error;
1969         str_count  = get_unaligned_le32(data + 8);
1970         lang_count = get_unaligned_le32(data + 12);
1971
1972         /* if one is zero the other must be zero */
1973         if (unlikely(!str_count != !lang_count))
1974                 goto error;
1975
1976         /* Do we have at least as many strings as descriptors need? */
1977         needed_count = ffs->strings_count;
1978         if (unlikely(str_count < needed_count))
1979                 goto error;
1980
1981         /*
1982          * If we don't need any strings just return and free all
1983          * memory.
1984          */
1985         if (!needed_count) {
1986                 kfree(_data);
1987                 return 0;
1988         }
1989
1990         /* Allocate everything in one chunk so there's less maintenance. */
1991         {
1992                 struct {
1993                         struct usb_gadget_strings *stringtabs[lang_count + 1];
1994                         struct usb_gadget_strings stringtab[lang_count];
1995                         struct usb_string strings[lang_count*(needed_count+1)];
1996                 } *d;
1997                 unsigned i = 0;
1998
1999                 d = kmalloc(sizeof *d, GFP_KERNEL);
2000                 if (unlikely(!d)) {
2001                         kfree(_data);
2002                         return -ENOMEM;
2003                 }
2004
2005                 stringtabs = d->stringtabs;
2006                 t = d->stringtab;
2007                 i = lang_count;
2008                 do {
2009                         *stringtabs++ = t++;
2010                 } while (--i);
2011                 *stringtabs = NULL;
2012
2013                 stringtabs = d->stringtabs;
2014                 t = d->stringtab;
2015                 s = d->strings;
2016                 strings = s;
2017         }
2018
2019         /* For each language */
2020         data += 16;
2021         len -= 16;
2022
2023         do { /* lang_count > 0 so we can use do-while */
2024                 unsigned needed = needed_count;
2025
2026                 if (unlikely(len < 3))
2027                         goto error_free;
2028                 t->language = get_unaligned_le16(data);
2029                 t->strings  = s;
2030                 ++t;
2031
2032                 data += 2;
2033                 len -= 2;
2034
2035                 /* For each string */
2036                 do { /* str_count > 0 so we can use do-while */
2037                         size_t length = strnlen(data, len);
2038
2039                         if (unlikely(length == len))
2040                                 goto error_free;
2041
2042                         /*
2043                          * User may provide more strings then we need,
2044                          * if that's the case we simply ignore the
2045                          * rest
2046                          */
2047                         if (likely(needed)) {
2048                                 /*
2049                                  * s->id will be set while adding
2050                                  * function to configuration so for
2051                                  * now just leave garbage here.
2052                                  */
2053                                 s->s = data;
2054                                 --needed;
2055                                 ++s;
2056                         }
2057
2058                         data += length + 1;
2059                         len -= length + 1;
2060                 } while (--str_count);
2061
2062                 s->id = 0;   /* terminator */
2063                 s->s = NULL;
2064                 ++s;
2065
2066         } while (--lang_count);
2067
2068         /* Some garbage left? */
2069         if (unlikely(len))
2070                 goto error_free;
2071
2072         /* Done! */
2073         ffs->stringtabs = stringtabs;
2074         ffs->raw_strings = _data;
2075
2076         return 0;
2077
2078 error_free:
2079         kfree(stringtabs);
2080 error:
2081         kfree(_data);
2082         return -EINVAL;
2083 }
2084
2085
2086 /* Events handling and management *******************************************/
2087
2088 static void __ffs_event_add(struct ffs_data *ffs,
2089                             enum usb_functionfs_event_type type)
2090 {
2091         enum usb_functionfs_event_type rem_type1, rem_type2 = type;
2092         int neg = 0;
2093
2094         /*
2095          * Abort any unhandled setup
2096          *
2097          * We do not need to worry about some cmpxchg() changing value
2098          * of ffs->setup_state without holding the lock because when
2099          * state is FFS_SETUP_PENDING cmpxchg() in several places in
2100          * the source does nothing.
2101          */
2102         if (ffs->setup_state == FFS_SETUP_PENDING)
2103                 ffs->setup_state = FFS_SETUP_CANCELED;
2104
2105         switch (type) {
2106         case FUNCTIONFS_RESUME:
2107                 rem_type2 = FUNCTIONFS_SUSPEND;
2108                 /* FALL THROUGH */
2109         case FUNCTIONFS_SUSPEND:
2110         case FUNCTIONFS_SETUP:
2111                 rem_type1 = type;
2112                 /* Discard all similar events */
2113                 break;
2114
2115         case FUNCTIONFS_BIND:
2116         case FUNCTIONFS_UNBIND:
2117         case FUNCTIONFS_DISABLE:
2118         case FUNCTIONFS_ENABLE:
2119                 /* Discard everything other then power management. */
2120                 rem_type1 = FUNCTIONFS_SUSPEND;
2121                 rem_type2 = FUNCTIONFS_RESUME;
2122                 neg = 1;
2123                 break;
2124
2125         default:
2126                 BUG();
2127         }
2128
2129         {
2130                 u8 *ev  = ffs->ev.types, *out = ev;
2131                 unsigned n = ffs->ev.count;
2132                 for (; n; --n, ++ev)
2133                         if ((*ev == rem_type1 || *ev == rem_type2) == neg)
2134                                 *out++ = *ev;
2135                         else
2136                                 pr_vdebug("purging event %d\n", *ev);
2137                 ffs->ev.count = out - ffs->ev.types;
2138         }
2139
2140         pr_vdebug("adding event %d\n", type);
2141         ffs->ev.types[ffs->ev.count++] = type;
2142         wake_up_locked(&ffs->ev.waitq);
2143 }
2144
2145 static void ffs_event_add(struct ffs_data *ffs,
2146                           enum usb_functionfs_event_type type)
2147 {
2148         unsigned long flags;
2149         spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
2150         __ffs_event_add(ffs, type);
2151         spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
2152 }
2153
2154
2155 /* Bind/unbind USB function hooks *******************************************/
2156
2157 static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
2158                                     struct usb_descriptor_header *desc,
2159                                     void *priv)
2160 {
2161         struct usb_endpoint_descriptor *ds = (void *)desc;
2162         struct ffs_function *func = priv;
2163         struct ffs_ep *ffs_ep;
2164
2165         /*
2166          * If hs_descriptors is not NULL then we are reading hs
2167          * descriptors now
2168          */
2169         const int isHS = func->function.hs_descriptors != NULL;
2170         unsigned idx;
2171
2172         if (type != FFS_DESCRIPTOR)
2173                 return 0;
2174
2175         if (isHS)
2176                 func->function.hs_descriptors[(long)valuep] = desc;
2177         else
2178                 func->function.fs_descriptors[(long)valuep]    = desc;
2179
2180         if (!desc || desc->bDescriptorType != USB_DT_ENDPOINT)
2181                 return 0;
2182
2183         idx = (ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK) - 1;
2184         ffs_ep = func->eps + idx;
2185
2186         if (unlikely(ffs_ep->descs[isHS])) {
2187                 pr_vdebug("two %sspeed descriptors for EP %d\n",
2188                           isHS ? "high" : "full",
2189                           ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
2190                 return -EINVAL;
2191         }
2192         ffs_ep->descs[isHS] = ds;
2193
2194         ffs_dump_mem(": Original  ep desc", ds, ds->bLength);
2195         if (ffs_ep->ep) {
2196                 ds->bEndpointAddress = ffs_ep->descs[0]->bEndpointAddress;
2197                 if (!ds->wMaxPacketSize)
2198                         ds->wMaxPacketSize = ffs_ep->descs[0]->wMaxPacketSize;
2199         } else {
2200                 struct usb_request *req;
2201                 struct usb_ep *ep;
2202
2203                 pr_vdebug("autoconfig\n");
2204                 ep = usb_ep_autoconfig(func->gadget, ds);
2205                 if (unlikely(!ep))
2206                         return -ENOTSUPP;
2207                 ep->driver_data = func->eps + idx;
2208
2209                 req = usb_ep_alloc_request(ep, GFP_KERNEL);
2210                 if (unlikely(!req))
2211                         return -ENOMEM;
2212
2213                 ffs_ep->ep  = ep;
2214                 ffs_ep->req = req;
2215                 func->eps_revmap[ds->bEndpointAddress &
2216                                  USB_ENDPOINT_NUMBER_MASK] = idx + 1;
2217         }
2218         ffs_dump_mem(": Rewritten ep desc", ds, ds->bLength);
2219
2220         return 0;
2221 }
2222
2223 static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep,
2224                                    struct usb_descriptor_header *desc,
2225                                    void *priv)
2226 {
2227         struct ffs_function *func = priv;
2228         unsigned idx;
2229         u8 newValue;
2230
2231         switch (type) {
2232         default:
2233         case FFS_DESCRIPTOR:
2234                 /* Handled in previous pass by __ffs_func_bind_do_descs() */
2235                 return 0;
2236
2237         case FFS_INTERFACE:
2238                 idx = *valuep;
2239                 if (func->interfaces_nums[idx] < 0) {
2240                         int id = usb_interface_id(func->conf, &func->function);
2241                         if (unlikely(id < 0))
2242                                 return id;
2243                         func->interfaces_nums[idx] = id;
2244                 }
2245                 newValue = func->interfaces_nums[idx];
2246                 break;
2247
2248         case FFS_STRING:
2249                 /* String' IDs are allocated when fsf_data is bound to cdev */
2250                 newValue = func->ffs->stringtabs[0]->strings[*valuep - 1].id;
2251                 break;
2252
2253         case FFS_ENDPOINT:
2254                 /*
2255                  * USB_DT_ENDPOINT are handled in
2256                  * __ffs_func_bind_do_descs().
2257                  */
2258                 if (desc->bDescriptorType == USB_DT_ENDPOINT)
2259                         return 0;
2260
2261                 idx = (*valuep & USB_ENDPOINT_NUMBER_MASK) - 1;
2262                 if (unlikely(!func->eps[idx].ep))
2263                         return -EINVAL;
2264
2265                 {
2266                         struct usb_endpoint_descriptor **descs;
2267                         descs = func->eps[idx].descs;
2268                         newValue = descs[descs[0] ? 0 : 1]->bEndpointAddress;
2269                 }
2270                 break;
2271         }
2272
2273         pr_vdebug("%02x -> %02x\n", *valuep, newValue);
2274         *valuep = newValue;
2275         return 0;
2276 }
2277
2278 static int ffs_func_bind(struct usb_configuration *c,
2279                          struct usb_function *f)
2280 {
2281         struct ffs_function *func = ffs_func_from_usb(f);
2282         struct ffs_data *ffs = func->ffs;
2283
2284         const int full = !!func->ffs->fs_descs_count;
2285         const int high = gadget_is_dualspeed(func->gadget) &&
2286                 func->ffs->hs_descs_count;
2287
2288         int ret;
2289
2290         /* Make it a single chunk, less management later on */
2291         struct {
2292                 struct ffs_ep eps[ffs->eps_count];
2293                 struct usb_descriptor_header
2294                         *fs_descs[full ? ffs->fs_descs_count + 1 : 0];
2295                 struct usb_descriptor_header
2296                         *hs_descs[high ? ffs->hs_descs_count + 1 : 0];
2297                 short inums[ffs->interfaces_count];
2298                 char raw_descs[high ? ffs->raw_descs_length
2299                                     : ffs->raw_fs_descs_length];
2300         } *data;
2301
2302         ENTER();
2303
2304         /* Only high speed but not supported by gadget? */
2305         if (unlikely(!(full | high)))
2306                 return -ENOTSUPP;
2307
2308         /* Allocate */
2309         data = kmalloc(sizeof *data, GFP_KERNEL);
2310         if (unlikely(!data))
2311                 return -ENOMEM;
2312
2313         /* Zero */
2314         memset(data->eps, 0, sizeof data->eps);
2315         memcpy(data->raw_descs, ffs->raw_descs + 16, sizeof data->raw_descs);
2316     if(data->inums)
2317             memset(data->inums, 0xff, sizeof data->inums);
2318         for (ret = ffs->eps_count; ret; --ret)
2319                 data->eps[ret].num = -1;
2320
2321         /* Save pointers */
2322         func->eps             = data->eps;
2323         func->interfaces_nums = data->inums;
2324
2325         /*
2326          * Go through all the endpoint descriptors and allocate
2327          * endpoints first, so that later we can rewrite the endpoint
2328          * numbers without worrying that it may be described later on.
2329          */
2330         if (likely(full)) {
2331                 func->function.fs_descriptors = data->fs_descs;
2332                 ret = ffs_do_descs(ffs->fs_descs_count,
2333                                    data->raw_descs,
2334                                    sizeof data->raw_descs,
2335                                    __ffs_func_bind_do_descs, func);
2336                 if (unlikely(ret < 0))
2337                         goto error;
2338         } else {
2339                 ret = 0;
2340         }
2341
2342         if (likely(high)) {
2343                 func->function.hs_descriptors = data->hs_descs;
2344                 ret = ffs_do_descs(ffs->hs_descs_count,
2345                                    data->raw_descs + ret,
2346                                    (sizeof data->raw_descs) - ret,
2347                                    __ffs_func_bind_do_descs, func);
2348         }
2349
2350         /*
2351          * Now handle interface numbers allocation and interface and
2352          * endpoint numbers rewriting.  We can do that in one go
2353          * now.
2354          */
2355         ret = ffs_do_descs(ffs->fs_descs_count +
2356                            (high ? ffs->hs_descs_count : 0),
2357                            data->raw_descs, sizeof data->raw_descs,
2358                            __ffs_func_bind_do_nums, func);
2359         if (unlikely(ret < 0))
2360                 goto error;
2361
2362         /* And we're done */
2363         ffs_event_add(ffs, FUNCTIONFS_BIND);
2364         return 0;
2365
2366 error:
2367         /* XXX Do we need to release all claimed endpoints here? */
2368     kfree(data);
2369         return ret;
2370 }
2371
2372
2373 /* Other USB function hooks *************************************************/
2374
2375 static void ffs_func_unbind(struct usb_configuration *c,
2376                             struct usb_function *f)
2377 {
2378         struct ffs_function *func = ffs_func_from_usb(f);
2379         struct ffs_data *ffs = func->ffs;
2380
2381         ENTER();
2382
2383         if (ffs->func == func) {
2384                 ffs_func_eps_disable(func);
2385                 ffs->func = NULL;
2386         }
2387
2388         ffs_event_add(ffs, FUNCTIONFS_UNBIND);
2389
2390         ffs_func_free(func);
2391 }
2392
2393 static int ffs_func_set_alt(struct usb_function *f,
2394                             unsigned interface, unsigned alt)
2395 {
2396         struct ffs_function *func = ffs_func_from_usb(f);
2397         struct ffs_data *ffs = func->ffs;
2398         int ret = 0, intf;
2399
2400         if (alt != (unsigned)-1) {
2401                 intf = ffs_func_revmap_intf(func, interface);
2402                 if (unlikely(intf < 0))
2403                         return intf;
2404         }
2405
2406         if (ffs->func)
2407                 ffs_func_eps_disable(ffs->func);
2408
2409         if (ffs->state != FFS_ACTIVE)
2410                 return -ENODEV;
2411
2412         if (alt == (unsigned)-1) {
2413                 ffs->func = NULL;
2414                 ffs_event_add(ffs, FUNCTIONFS_DISABLE);
2415                 return 0;
2416         }
2417
2418         ffs->func = func;
2419         ret = ffs_func_eps_enable(func);
2420         if (likely(ret >= 0))
2421                 ffs_event_add(ffs, FUNCTIONFS_ENABLE);
2422         return ret;
2423 }
2424
2425 static void ffs_func_disable(struct usb_function *f)
2426 {
2427         ffs_func_set_alt(f, 0, (unsigned)-1);
2428 }
2429
2430 static int ffs_func_setup(struct usb_function *f,
2431                           const struct usb_ctrlrequest *creq)
2432 {
2433         struct ffs_function *func = ffs_func_from_usb(f);
2434         struct ffs_data *ffs = func->ffs;
2435         unsigned long flags;
2436         int ret;
2437
2438         ENTER();
2439
2440         pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType);
2441         pr_vdebug("creq->bRequest     = %02x\n", creq->bRequest);
2442         pr_vdebug("creq->wValue       = %04x\n", le16_to_cpu(creq->wValue));
2443         pr_vdebug("creq->wIndex       = %04x\n", le16_to_cpu(creq->wIndex));
2444         pr_vdebug("creq->wLength      = %04x\n", le16_to_cpu(creq->wLength));
2445
2446         /*
2447          * Most requests directed to interface go through here
2448          * (notable exceptions are set/get interface) so we need to
2449          * handle them.  All other either handled by composite or
2450          * passed to usb_configuration->setup() (if one is set).  No
2451          * matter, we will handle requests directed to endpoint here
2452          * as well (as it's straightforward) but what to do with any
2453          * other request?
2454          */
2455         if (ffs->state != FFS_ACTIVE)
2456                 return -ENODEV;
2457
2458         switch (creq->bRequestType & USB_RECIP_MASK) {
2459         case USB_RECIP_INTERFACE:
2460                 ret = ffs_func_revmap_intf(func, le16_to_cpu(creq->wIndex));
2461                 if (unlikely(ret < 0))
2462                         return ret;
2463                 break;
2464
2465         case USB_RECIP_ENDPOINT:
2466                 ret = ffs_func_revmap_ep(func, le16_to_cpu(creq->wIndex));
2467                 if (unlikely(ret < 0))
2468                         return ret;
2469                 break;
2470
2471         default:
2472                 return -EOPNOTSUPP;
2473         }
2474
2475         spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
2476         ffs->ev.setup = *creq;
2477         ffs->ev.setup.wIndex = cpu_to_le16(ret);
2478         __ffs_event_add(ffs, FUNCTIONFS_SETUP);
2479         spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
2480
2481         return 0;
2482 }
2483
2484 static void ffs_func_suspend(struct usb_function *f)
2485 {
2486         ENTER();
2487         ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_SUSPEND);
2488 }
2489
2490 static void ffs_func_resume(struct usb_function *f)
2491 {
2492         ENTER();
2493         ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_RESUME);
2494 }
2495
2496
2497 /* Endpoint and interface numbers reverse mapping ***************************/
2498
2499 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num)
2500 {
2501         num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK];
2502         return num ? num : -EDOM;
2503 }
2504
2505 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf)
2506 {
2507         short *nums = func->interfaces_nums;
2508         unsigned count = func->ffs->interfaces_count;
2509
2510         for (; count; --count, ++nums) {
2511                 if (*nums >= 0 && *nums == intf)
2512                         return nums - func->interfaces_nums;
2513         }
2514
2515         return -EDOM;
2516 }
2517
2518
2519 /* Misc helper functions ****************************************************/
2520
2521 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
2522 {
2523         return nonblock
2524                 ? likely(mutex_trylock(mutex)) ? 0 : -EAGAIN
2525                 : mutex_lock_interruptible(mutex);
2526 }
2527
2528 static char *ffs_prepare_buffer(const char __user *buf, size_t len)
2529 {
2530         char *data;
2531
2532         if (unlikely(!len))
2533                 return NULL;
2534
2535         data = kmalloc(len, GFP_KERNEL);
2536         if (unlikely(!data))
2537                 return ERR_PTR(-ENOMEM);
2538
2539         if (unlikely(__copy_from_user(data, buf, len))) {
2540                 kfree(data);
2541                 return ERR_PTR(-EFAULT);
2542         }
2543
2544         pr_vdebug("Buffer from user space:\n");
2545         ffs_dump_mem("", data, len);
2546
2547         return data;
2548 }