drivers/usb/gadget/composite.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * composite.c - infrastructure for Composite USB Gadgets
   4  *
   5  * Copyright (C) 2006-2008 David Brownell
   6  */
   7
   8 /* #define VERBOSE_DEBUG */
   9
  10 #include <linux/kallsyms.h>
  11 #include <linux/kernel.h>
  12 #include <linux/slab.h>
  13 #include <linux/module.h>
  14 #include <linux/device.h>
  15 #include <linux/utsname.h>
  16
  17 #include <linux/usb/composite.h>
  18 #include <linux/usb/otg.h>
  19 #include <asm/unaligned.h>
  20
  21 #include "u_os_desc.h"
  22
  23 /**
  24  * struct usb_os_string - represents OS String to be reported by a gadget
  25  * @bLength: total length of the entire descritor, always 0x12
  26  * @bDescriptorType: USB_DT_STRING
  27  * @qwSignature: the OS String proper
  28  * @bMS_VendorCode: code used by the host for subsequent requests
  29  * @bPad: not used, must be zero
  30  */
  31 struct usb_os_string {
  32         __u8    bLength;
  33         __u8    bDescriptorType;
  34         __u8    qwSignature[OS_STRING_QW_SIGN_LEN];
  35         __u8    bMS_VendorCode;
  36         __u8    bPad;
  37 } __packed;
  38
  39 /*
  40  * The code in this file is utility code, used to build a gadget driver
  41  * from one or more "function" drivers, one or more "configuration"
  42  * objects, and a "usb_composite_driver" by gluing them together along
  43  * with the relevant device-wide data.
  44  */
  45
  46 static struct usb_gadget_strings **get_containers_gs(
  47                 struct usb_gadget_string_container *uc)
  48 {
  49         return (struct usb_gadget_strings **)uc->stash;
  50 }
  51
  52 /**
  53  * function_descriptors() - get function descriptors for speed
  54  * @f: the function
  55  * @speed: the speed
  56  *
  57  * Returns the descriptors or NULL if not set.
  58  */
  59 static struct usb_descriptor_header **
  60 function_descriptors(struct usb_function *f,
  61                      enum usb_device_speed speed)
  62 {
  63         struct usb_descriptor_header **descriptors;
  64
  65         /*
  66          * NOTE: we try to help gadget drivers which might not be setting
  67          * max_speed appropriately.
  68          */
  69
  70         switch (speed) {
  71         case USB_SPEED_SUPER_PLUS:
  72                 descriptors = f->ssp_descriptors;
  73                 if (descriptors)
  74                         break;
  75                 fallthrough;
  76         case USB_SPEED_SUPER:
  77                 descriptors = f->ss_descriptors;
  78                 if (descriptors)
  79                         break;
  80                 fallthrough;
  81         case USB_SPEED_HIGH:
  82                 descriptors = f->hs_descriptors;
  83                 if (descriptors)
  84                         break;
  85                 fallthrough;
  86         default:
  87                 descriptors = f->fs_descriptors;
  88         }
  89
  90         /*
  91          * if we can't find any descriptors at all, then this gadget deserves to
  92          * Oops with a NULL pointer dereference
  93          */
  94
  95         return descriptors;
  96 }
  97
  98 /**
  99  * next_desc() - advance to the next desc_type descriptor
 100  * @t: currect pointer within descriptor array
 101  * @desc_type: descriptor type
 102  *
 103  * Return: next desc_type descriptor or NULL
 104  *
 105  * Iterate over @t until either desc_type descriptor found or
 106  * NULL (that indicates end of list) encountered
 107  */
 108 static struct usb_descriptor_header**
 109 next_desc(struct usb_descriptor_header **t, u8 desc_type)
 110 {
 111         for (; *t; t++) {
 112                 if ((*t)->bDescriptorType == desc_type)
 113                         return t;
 114         }
 115         return NULL;
 116 }
 117
 118 /*
 119  * for_each_desc() - iterate over desc_type descriptors in the
 120  * descriptors list
 121  * @start: pointer within descriptor array.
 122  * @iter_desc: desc_type descriptor to use as the loop cursor
 123  * @desc_type: wanted descriptr type
 124  */
 125 #define for_each_desc(start, iter_desc, desc_type) \
 126         for (iter_desc = next_desc(start, desc_type); \
 127              iter_desc; iter_desc = next_desc(iter_desc + 1, desc_type))
 128
 129 /**
 130  * config_ep_by_speed_and_alt() - configures the given endpoint
 131  * according to gadget speed.
 132  * @g: pointer to the gadget
 133  * @f: usb function
 134  * @_ep: the endpoint to configure
 135  * @alt: alternate setting number
 136  *
 137  * Return: error code, 0 on success
 138  *
 139  * This function chooses the right descriptors for a given
 140  * endpoint according to gadget speed and saves it in the
 141  * endpoint desc field. If the endpoint already has a descriptor
 142  * assigned to it - overwrites it with currently corresponding
 143  * descriptor. The endpoint maxpacket field is updated according
 144  * to the chosen descriptor.
 145  * Note: the supplied function should hold all the descriptors
 146  * for supported speeds
 147  */
 148 int config_ep_by_speed_and_alt(struct usb_gadget *g,
 149                                 struct usb_function *f,
 150                                 struct usb_ep *_ep,
 151                                 u8 alt)
 152 {
 153         struct usb_endpoint_descriptor *chosen_desc = NULL;
 154         struct usb_interface_descriptor *int_desc = NULL;
 155         struct usb_descriptor_header **speed_desc = NULL;
 156
 157         struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
 158         int want_comp_desc = 0;
 159
 160         struct usb_descriptor_header **d_spd; /* cursor for speed desc */
 161
 162         if (!g || !f || !_ep)
 163                 return -EIO;
 164
 165         /* select desired speed */
 166         switch (g->speed) {
 167         case USB_SPEED_SUPER_PLUS:
 168                 if (gadget_is_superspeed_plus(g)) {
 169                         speed_desc = f->ssp_descriptors;
 170                         want_comp_desc = 1;
 171                         break;
 172                 }
 173                 fallthrough;
 174         case USB_SPEED_SUPER:
 175                 if (gadget_is_superspeed(g)) {
 176                         speed_desc = f->ss_descriptors;
 177                         want_comp_desc = 1;
 178                         break;
 179                 }
 180                 fallthrough;
 181         case USB_SPEED_HIGH:
 182                 if (gadget_is_dualspeed(g)) {
 183                         speed_desc = f->hs_descriptors;
 184                         break;
 185                 }
 186                 fallthrough;
 187         default:
 188                 speed_desc = f->fs_descriptors;
 189         }
 190
 191         /* find correct alternate setting descriptor */
 192         for_each_desc(speed_desc, d_spd, USB_DT_INTERFACE) {
 193                 int_desc = (struct usb_interface_descriptor *)*d_spd;
 194
 195                 if (int_desc->bAlternateSetting == alt) {
 196                         speed_desc = d_spd;
 197                         goto intf_found;
 198                 }
 199         }
 200         return -EIO;
 201
 202 intf_found:
 203         /* find descriptors */
 204         for_each_desc(speed_desc, d_spd, USB_DT_ENDPOINT) {
 205                 chosen_desc = (struct usb_endpoint_descriptor *)*d_spd;
 206                 if (chosen_desc->bEndpointAddress == _ep->address)
 207                         goto ep_found;
 208         }
 209         return -EIO;
 210
 211 ep_found:
 212         /* commit results */
 213         _ep->maxpacket = usb_endpoint_maxp(chosen_desc);
 214         _ep->desc = chosen_desc;
 215         _ep->comp_desc = NULL;
 216         _ep->maxburst = 0;
 217         _ep->mult = 1;
 218
 219         if (g->speed == USB_SPEED_HIGH && (usb_endpoint_xfer_isoc(_ep->desc) ||
 220                                 usb_endpoint_xfer_int(_ep->desc)))
 221                 _ep->mult = usb_endpoint_maxp_mult(_ep->desc);
 222
 223         if (!want_comp_desc)
 224                 return 0;
 225
 226         /*
 227          * Companion descriptor should follow EP descriptor
 228          * USB 3.0 spec, #9.6.7
 229          */
 230         comp_desc = (struct usb_ss_ep_comp_descriptor *)*(++d_spd);
 231         if (!comp_desc ||
 232             (comp_desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP))
 233                 return -EIO;
 234         _ep->comp_desc = comp_desc;
 235         if (g->speed >= USB_SPEED_SUPER) {
 236                 switch (usb_endpoint_type(_ep->desc)) {
 237                 case USB_ENDPOINT_XFER_ISOC:
 238                         /* mult: bits 1:0 of bmAttributes */
 239                         _ep->mult = (comp_desc->bmAttributes & 0x3) + 1;
 240                         fallthrough;
 241                 case USB_ENDPOINT_XFER_BULK:
 242                 case USB_ENDPOINT_XFER_INT:
 243                         _ep->maxburst = comp_desc->bMaxBurst + 1;
 244                         break;
 245                 default:
 246                         if (comp_desc->bMaxBurst != 0) {
 247                                 struct usb_composite_dev *cdev;
 248
 249                                 cdev = get_gadget_data(g);
 250                                 ERROR(cdev, "ep0 bMaxBurst must be 0\n");
 251                         }
 252                         _ep->maxburst = 1;
 253                         break;
 254                 }
 255         }
 256         return 0;
 257 }
 258 EXPORT_SYMBOL_GPL(config_ep_by_speed_and_alt);
 259
 260 /**
 261  * config_ep_by_speed() - configures the given endpoint
 262  * according to gadget speed.
 263  * @g: pointer to the gadget
 264  * @f: usb function
 265  * @_ep: the endpoint to configure
 266  *
 267  * Return: error code, 0 on success
 268  *
 269  * This function chooses the right descriptors for a given
 270  * endpoint according to gadget speed and saves it in the
 271  * endpoint desc field. If the endpoint already has a descriptor
 272  * assigned to it - overwrites it with currently corresponding
 273  * descriptor. The endpoint maxpacket field is updated according
 274  * to the chosen descriptor.
 275  * Note: the supplied function should hold all the descriptors
 276  * for supported speeds
 277  */
 278 int config_ep_by_speed(struct usb_gadget *g,
 279                         struct usb_function *f,
 280                         struct usb_ep *_ep)
 281 {
 282         return config_ep_by_speed_and_alt(g, f, _ep, 0);
 283 }
 284 EXPORT_SYMBOL_GPL(config_ep_by_speed);
 285
 286 /**
 287  * usb_add_function() - add a function to a configuration
 288  * @config: the configuration
 289  * @function: the function being added
 290  * Context: single threaded during gadget setup
 291  *
 292  * After initialization, each configuration must have one or more
 293  * functions added to it.  Adding a function involves calling its @bind()
 294  * method to allocate resources such as interface and string identifiers
 295  * and endpoints.
 296  *
 297  * This function returns the value of the function's bind(), which is
 298  * zero for success else a negative errno value.
 299  */
 300 int usb_add_function(struct usb_configuration *config,
 301                 struct usb_function *function)
 302 {
 303         int     value = -EINVAL;
 304
 305         DBG(config->cdev, "adding '%s'/%p to config '%s'/%p\n",
 306                         function->name, function,
 307                         config->label, config);
 308
 309         if (!function->set_alt || !function->disable)
 310                 goto done;
 311
 312         function->config = config;
 313         list_add_tail(&function->list, &config->functions);
 314
 315         if (function->bind_deactivated) {
 316                 value = usb_function_deactivate(function);
 317                 if (value)
 318                         goto done;
 319         }
 320
 321         /* REVISIT *require* function->bind? */
 322         if (function->bind) {
 323                 value = function->bind(config, function);
 324                 if (value < 0) {
 325                         list_del(&function->list);
 326                         function->config = NULL;
 327                 }
 328         } else
 329                 value = 0;
 330
 331         /* We allow configurations that don't work at both speeds.
 332          * If we run into a lowspeed Linux system, treat it the same
 333          * as full speed ... it's the function drivers that will need
 334          * to avoid bulk and ISO transfers.
 335          */
 336         if (!config->fullspeed && function->fs_descriptors)
 337                 config->fullspeed = true;
 338         if (!config->highspeed && function->hs_descriptors)
 339                 config->highspeed = true;
 340         if (!config->superspeed && function->ss_descriptors)
 341                 config->superspeed = true;
 342         if (!config->superspeed_plus && function->ssp_descriptors)
 343                 config->superspeed_plus = true;
 344
 345 done:
 346         if (value)
 347                 DBG(config->cdev, "adding '%s'/%p --> %d\n",
 348                                 function->name, function, value);
 349         return value;
 350 }
 351 EXPORT_SYMBOL_GPL(usb_add_function);
 352
 353 void usb_remove_function(struct usb_configuration *c, struct usb_function *f)
 354 {
 355         if (f->disable)
 356                 f->disable(f);
 357
 358         bitmap_zero(f->endpoints, 32);
 359         list_del(&f->list);
 360         if (f->unbind)
 361                 f->unbind(c, f);
 362
 363         if (f->bind_deactivated)
 364                 usb_function_activate(f);
 365 }
 366 EXPORT_SYMBOL_GPL(usb_remove_function);
 367
 368 /**
 369  * usb_function_deactivate - prevent function and gadget enumeration
 370  * @function: the function that isn't yet ready to respond
 371  *
 372  * Blocks response of the gadget driver to host enumeration by
 373  * preventing the data line pullup from being activated.  This is
 374  * normally called during @bind() processing to change from the
 375  * initial "ready to respond" state, or when a required resource
 376  * becomes available.
 377  *
 378  * For example, drivers that serve as a passthrough to a userspace
 379  * daemon can block enumeration unless that daemon (such as an OBEX,
 380  * MTP, or print server) is ready to handle host requests.
 381  *
 382  * Not all systems support software control of their USB peripheral
 383  * data pullups.
 384  *
 385  * Returns zero on success, else negative errno.
 386  */
 387 int usb_function_deactivate(struct usb_function *function)
 388 {
 389         struct usb_composite_dev        *cdev = function->config->cdev;
 390         unsigned long                   flags;
 391         int                             status = 0;
 392
 393         spin_lock_irqsave(&cdev->lock, flags);
 394
 395         if (cdev->deactivations == 0)
 396                 status = usb_gadget_deactivate(cdev->gadget);
 397         if (status == 0)
 398                 cdev->deactivations++;
 399
 400         spin_unlock_irqrestore(&cdev->lock, flags);
 401         return status;
 402 }
 403 EXPORT_SYMBOL_GPL(usb_function_deactivate);
 404
 405 /**
 406  * usb_function_activate - allow function and gadget enumeration
 407  * @function: function on which usb_function_activate() was called
 408  *
 409  * Reverses effect of usb_function_deactivate().  If no more functions
 410  * are delaying their activation, the gadget driver will respond to
 411  * host enumeration procedures.
 412  *
 413  * Returns zero on success, else negative errno.
 414  */
 415 int usb_function_activate(struct usb_function *function)
 416 {
 417         struct usb_composite_dev        *cdev = function->config->cdev;
 418         unsigned long                   flags;
 419         int                             status = 0;
 420
 421         spin_lock_irqsave(&cdev->lock, flags);
 422
 423         if (WARN_ON(cdev->deactivations == 0))
 424                 status = -EINVAL;
 425         else {
 426                 cdev->deactivations--;
 427                 if (cdev->deactivations == 0)
 428                         status = usb_gadget_activate(cdev->gadget);
 429         }
 430
 431         spin_unlock_irqrestore(&cdev->lock, flags);
 432         return status;
 433 }
 434 EXPORT_SYMBOL_GPL(usb_function_activate);
 435
 436 /**
 437  * usb_interface_id() - allocate an unused interface ID
 438  * @config: configuration associated with the interface
 439  * @function: function handling the interface
 440  * Context: single threaded during gadget setup
 441  *
 442  * usb_interface_id() is called from usb_function.bind() callbacks to
 443  * allocate new interface IDs.  The function driver will then store that
 444  * ID in interface, association, CDC union, and other descriptors.  It
 445  * will also handle any control requests targeted at that interface,
 446  * particularly changing its altsetting via set_alt().  There may
 447  * also be class-specific or vendor-specific requests to handle.
 448  *
 449  * All interface identifier should be allocated using this routine, to
 450  * ensure that for example different functions don't wrongly assign
 451  * different meanings to the same identifier.  Note that since interface
 452  * identifiers are configuration-specific, functions used in more than
 453  * one configuration (or more than once in a given configuration) need
 454  * multiple versions of the relevant descriptors.
 455  *
 456  * Returns the interface ID which was allocated; or -ENODEV if no
 457  * more interface IDs can be allocated.
 458  */
 459 int usb_interface_id(struct usb_configuration *config,
 460                 struct usb_function *function)
 461 {
 462         unsigned id = config->next_interface_id;
 463
 464         if (id < MAX_CONFIG_INTERFACES) {
 465                 config->interface[id] = function;
 466                 config->next_interface_id = id + 1;
 467                 return id;
 468         }
 469         return -ENODEV;
 470 }
 471 EXPORT_SYMBOL_GPL(usb_interface_id);
 472
 473 static u8 encode_bMaxPower(enum usb_device_speed speed,
 474                 struct usb_configuration *c)
 475 {
 476         unsigned val;
 477
 478         if (c->MaxPower)
 479                 val = c->MaxPower;
 480         else
 481                 val = CONFIG_USB_GADGET_VBUS_DRAW;
 482         if (!val)
 483                 return 0;
 484         if (speed < USB_SPEED_SUPER)
 485                 return min(val, 500U) / 2;
 486         else
 487                 /*
 488                  * USB 3.x supports up to 900mA, but since 900 isn't divisible
 489                  * by 8 the integral division will effectively cap to 896mA.
 490                  */
 491                 return min(val, 900U) / 8;
 492 }
 493
 494 static int config_buf(struct usb_configuration *config,
 495                 enum usb_device_speed speed, void *buf, u8 type)
 496 {
 497         struct usb_config_descriptor    *c = buf;
 498         void                            *next = buf + USB_DT_CONFIG_SIZE;
 499         int                             len;
 500         struct usb_function             *f;
 501         int                             status;
 502
 503         len = USB_COMP_EP0_BUFSIZ - USB_DT_CONFIG_SIZE;
 504         /* write the config descriptor */
 505         c = buf;
 506         c->bLength = USB_DT_CONFIG_SIZE;
 507         c->bDescriptorType = type;
 508         /* wTotalLength is written later */
 509         c->bNumInterfaces = config->next_interface_id;
 510         c->bConfigurationValue = config->bConfigurationValue;
 511         c->iConfiguration = config->iConfiguration;
 512         c->bmAttributes = USB_CONFIG_ATT_ONE | config->bmAttributes;
 513         c->bMaxPower = encode_bMaxPower(speed, config);
 514
 515         /* There may be e.g. OTG descriptors */
 516         if (config->descriptors) {
 517                 status = usb_descriptor_fillbuf(next, len,
 518                                 config->descriptors);
 519                 if (status < 0)
 520                         return status;
 521                 len -= status;
 522                 next += status;
 523         }
 524
 525         /* add each function's descriptors */
 526         list_for_each_entry(f, &config->functions, list) {
 527                 struct usb_descriptor_header **descriptors;
 528
 529                 descriptors = function_descriptors(f, speed);
 530                 if (!descriptors)
 531                         continue;
 532                 status = usb_descriptor_fillbuf(next, len,
 533                         (const struct usb_descriptor_header **) descriptors);
 534                 if (status < 0)
 535                         return status;
 536                 len -= status;
 537                 next += status;
 538         }
 539
 540         len = next - buf;
 541         c->wTotalLength = cpu_to_le16(len);
 542         return len;
 543 }
 544
 545 static int config_desc(struct usb_composite_dev *cdev, unsigned w_value)
 546 {
 547         struct usb_gadget               *gadget = cdev->gadget;
 548         struct usb_configuration        *c;
 549         struct list_head                *pos;
 550         u8                              type = w_value >> 8;
 551         enum usb_device_speed           speed = USB_SPEED_UNKNOWN;
 552
 553         if (gadget->speed >= USB_SPEED_SUPER)
 554                 speed = gadget->speed;
 555         else if (gadget_is_dualspeed(gadget)) {
 556                 int     hs = 0;
 557                 if (gadget->speed == USB_SPEED_HIGH)
 558                         hs = 1;
 559                 if (type == USB_DT_OTHER_SPEED_CONFIG)
 560                         hs = !hs;
 561                 if (hs)
 562                         speed = USB_SPEED_HIGH;
 563
 564         }
 565
 566         /* This is a lookup by config *INDEX* */
 567         w_value &= 0xff;
 568
 569         pos = &cdev->configs;
 570         c = cdev->os_desc_config;
 571         if (c)
 572                 goto check_config;
 573
 574         while ((pos = pos->next) !=  &cdev->configs) {
 575                 c = list_entry(pos, typeof(*c), list);
 576
 577                 /* skip OS Descriptors config which is handled separately */
 578                 if (c == cdev->os_desc_config)
 579                         continue;
 580
 581 check_config:
 582                 /* ignore configs that won't work at this speed */
 583                 switch (speed) {
 584                 case USB_SPEED_SUPER_PLUS:
 585                         if (!c->superspeed_plus)
 586                                 continue;
 587                         break;
 588                 case USB_SPEED_SUPER:
 589                         if (!c->superspeed)
 590                                 continue;
 591                         break;
 592                 case USB_SPEED_HIGH:
 593                         if (!c->highspeed)
 594                                 continue;
 595                         break;
 596                 default:
 597                         if (!c->fullspeed)
 598                                 continue;
 599                 }
 600
 601                 if (w_value == 0)
 602                         return config_buf(c, speed, cdev->req->buf, type);
 603                 w_value--;
 604         }
 605         return -EINVAL;
 606 }
 607
 608 static int count_configs(struct usb_composite_dev *cdev, unsigned type)
 609 {
 610         struct usb_gadget               *gadget = cdev->gadget;
 611         struct usb_configuration        *c;
 612         unsigned                        count = 0;
 613         int                             hs = 0;
 614         int                             ss = 0;
 615         int                             ssp = 0;
 616
 617         if (gadget_is_dualspeed(gadget)) {
 618                 if (gadget->speed == USB_SPEED_HIGH)
 619                         hs = 1;
 620                 if (gadget->speed == USB_SPEED_SUPER)
 621                         ss = 1;
 622                 if (gadget->speed == USB_SPEED_SUPER_PLUS)
 623                         ssp = 1;
 624                 if (type == USB_DT_DEVICE_QUALIFIER)
 625                         hs = !hs;
 626         }
 627         list_for_each_entry(c, &cdev->configs, list) {
 628                 /* ignore configs that won't work at this speed */
 629                 if (ssp) {
 630                         if (!c->superspeed_plus)
 631                                 continue;
 632                 } else if (ss) {
 633                         if (!c->superspeed)
 634                                 continue;
 635                 } else if (hs) {
 636                         if (!c->highspeed)
 637                                 continue;
 638                 } else {
 639                         if (!c->fullspeed)
 640                                 continue;
 641                 }
 642                 count++;
 643         }
 644         return count;
 645 }
 646
 647 /**
 648  * bos_desc() - prepares the BOS descriptor.
 649  * @cdev: pointer to usb_composite device to generate the bos
 650  *      descriptor for
 651  *
 652  * This function generates the BOS (Binary Device Object)
 653  * descriptor and its device capabilities descriptors. The BOS
 654  * descriptor should be supported by a SuperSpeed device.
 655  */
 656 static int bos_desc(struct usb_composite_dev *cdev)
 657 {
 658         struct usb_ext_cap_descriptor   *usb_ext;
 659         struct usb_dcd_config_params    dcd_config_params;
 660         struct usb_bos_descriptor       *bos = cdev->req->buf;
 661         unsigned int                    besl = 0;
 662
 663         bos->bLength = USB_DT_BOS_SIZE;
 664         bos->bDescriptorType = USB_DT_BOS;
 665
 666         bos->wTotalLength = cpu_to_le16(USB_DT_BOS_SIZE);
 667         bos->bNumDeviceCaps = 0;
 668
 669         /* Get Controller configuration */
 670         if (cdev->gadget->ops->get_config_params) {
 671                 cdev->gadget->ops->get_config_params(cdev->gadget,
 672                                                      &dcd_config_params);
 673         } else {
 674                 dcd_config_params.besl_baseline =
 675                         USB_DEFAULT_BESL_UNSPECIFIED;
 676                 dcd_config_params.besl_deep =
 677                         USB_DEFAULT_BESL_UNSPECIFIED;
 678                 dcd_config_params.bU1devExitLat =
 679                         USB_DEFAULT_U1_DEV_EXIT_LAT;
 680                 dcd_config_params.bU2DevExitLat =
 681                         cpu_to_le16(USB_DEFAULT_U2_DEV_EXIT_LAT);
 682         }
 683
 684         if (dcd_config_params.besl_baseline != USB_DEFAULT_BESL_UNSPECIFIED)
 685                 besl = USB_BESL_BASELINE_VALID |
 686                         USB_SET_BESL_BASELINE(dcd_config_params.besl_baseline);
 687
 688         if (dcd_config_params.besl_deep != USB_DEFAULT_BESL_UNSPECIFIED)
 689                 besl |= USB_BESL_DEEP_VALID |
 690                         USB_SET_BESL_DEEP(dcd_config_params.besl_deep);
 691
 692         /*
 693          * A SuperSpeed device shall include the USB2.0 extension descriptor
 694          * and shall support LPM when operating in USB2.0 HS mode.
 695          */
 696         usb_ext = cdev->req->buf + le16_to_cpu(bos->wTotalLength);
 697         bos->bNumDeviceCaps++;
 698         le16_add_cpu(&bos->wTotalLength, USB_DT_USB_EXT_CAP_SIZE);
 699         usb_ext->bLength = USB_DT_USB_EXT_CAP_SIZE;
 700         usb_ext->bDescriptorType = USB_DT_DEVICE_CAPABILITY;
 701         usb_ext->bDevCapabilityType = USB_CAP_TYPE_EXT;
 702         usb_ext->bmAttributes = cpu_to_le32(USB_LPM_SUPPORT |
 703                                             USB_BESL_SUPPORT | besl);
 704
 705         /*
 706          * The Superspeed USB Capability descriptor shall be implemented by all
 707          * SuperSpeed devices.
 708          */
 709         if (gadget_is_superspeed(cdev->gadget)) {
 710                 struct usb_ss_cap_descriptor *ss_cap;
 711
 712                 ss_cap = cdev->req->buf + le16_to_cpu(bos->wTotalLength);
 713                 bos->bNumDeviceCaps++;
 714                 le16_add_cpu(&bos->wTotalLength, USB_DT_USB_SS_CAP_SIZE);
 715                 ss_cap->bLength = USB_DT_USB_SS_CAP_SIZE;
 716                 ss_cap->bDescriptorType = USB_DT_DEVICE_CAPABILITY;
 717                 ss_cap->bDevCapabilityType = USB_SS_CAP_TYPE;
 718                 ss_cap->bmAttributes = 0; /* LTM is not supported yet */
 719                 ss_cap->wSpeedSupported = cpu_to_le16(USB_LOW_SPEED_OPERATION |
 720                                                       USB_FULL_SPEED_OPERATION |
 721                                                       USB_HIGH_SPEED_OPERATION |
 722                                                       USB_5GBPS_OPERATION);
 723                 ss_cap->bFunctionalitySupport = USB_LOW_SPEED_OPERATION;
 724                 ss_cap->bU1devExitLat = dcd_config_params.bU1devExitLat;
 725                 ss_cap->bU2DevExitLat = dcd_config_params.bU2DevExitLat;
 726         }
 727
 728         /* The SuperSpeedPlus USB Device Capability descriptor */
 729         if (gadget_is_superspeed_plus(cdev->gadget)) {
 730                 struct usb_ssp_cap_descriptor *ssp_cap;
 731
 732                 ssp_cap = cdev->req->buf + le16_to_cpu(bos->wTotalLength);
 733                 bos->bNumDeviceCaps++;
 734
 735                 /*
 736                  * Report typical values.
 737                  */
 738
 739                 le16_add_cpu(&bos->wTotalLength, USB_DT_USB_SSP_CAP_SIZE(1));
 740                 ssp_cap->bLength = USB_DT_USB_SSP_CAP_SIZE(1);
 741                 ssp_cap->bDescriptorType = USB_DT_DEVICE_CAPABILITY;
 742                 ssp_cap->bDevCapabilityType = USB_SSP_CAP_TYPE;
 743                 ssp_cap->bReserved = 0;
 744                 ssp_cap->wReserved = 0;
 745
 746                 /* SSAC = 1 (2 attributes) */
 747                 ssp_cap->bmAttributes = cpu_to_le32(1);
 748
 749                 /* Min RX/TX Lane Count = 1 */
 750                 ssp_cap->wFunctionalitySupport =
 751                         cpu_to_le16((1 << 8) | (1 << 12));
 752
 753                 /*
 754                  * bmSublinkSpeedAttr[0]:
 755                  *   ST  = Symmetric, RX
 756                  *   LSE =  3 (Gbps)
 757                  *   LP  =  1 (SuperSpeedPlus)
 758                  *   LSM = 10 (10 Gbps)
 759                  */
 760                 ssp_cap->bmSublinkSpeedAttr[0] =
 761                         cpu_to_le32((3 << 4) | (1 << 14) | (0xa << 16));
 762                 /*
 763                  * bmSublinkSpeedAttr[1] =
 764                  *   ST  = Symmetric, TX
 765                  *   LSE =  3 (Gbps)
 766                  *   LP  =  1 (SuperSpeedPlus)
 767                  *   LSM = 10 (10 Gbps)
 768                  */
 769                 ssp_cap->bmSublinkSpeedAttr[1] =
 770                         cpu_to_le32((3 << 4) | (1 << 14) |
 771                                     (0xa << 16) | (1 << 7));
 772         }
 773
 774         return le16_to_cpu(bos->wTotalLength);
 775 }
 776
 777 static void device_qual(struct usb_composite_dev *cdev)
 778 {
 779         struct usb_qualifier_descriptor *qual = cdev->req->buf;
 780
 781         qual->bLength = sizeof(*qual);
 782         qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
 783         /* POLICY: same bcdUSB and device type info at both speeds */
 784         qual->bcdUSB = cdev->desc.bcdUSB;
 785         qual->bDeviceClass = cdev->desc.bDeviceClass;
 786         qual->bDeviceSubClass = cdev->desc.bDeviceSubClass;
 787         qual->bDeviceProtocol = cdev->desc.bDeviceProtocol;
 788         /* ASSUME same EP0 fifo size at both speeds */
 789         qual->bMaxPacketSize0 = cdev->gadget->ep0->maxpacket;
 790         qual->bNumConfigurations = count_configs(cdev, USB_DT_DEVICE_QUALIFIER);
 791         qual->bRESERVED = 0;
 792 }
 793
 794 /*-------------------------------------------------------------------------*/
 795
 796 static void reset_config(struct usb_composite_dev *cdev)
 797 {
 798         struct usb_function             *f;
 799
 800         DBG(cdev, "reset config\n");
 801
 802         list_for_each_entry(f, &cdev->config->functions, list) {
 803                 if (f->disable)
 804                         f->disable(f);
 805
 806                 bitmap_zero(f->endpoints, 32);
 807         }
 808         cdev->config = NULL;
 809         cdev->delayed_status = 0;
 810 }
 811
 812 static int set_config(struct usb_composite_dev *cdev,
 813                 const struct usb_ctrlrequest *ctrl, unsigned number)
 814 {
 815         struct usb_gadget       *gadget = cdev->gadget;
 816         struct usb_configuration *c = NULL;
 817         int                     result = -EINVAL;
 818         unsigned                power = gadget_is_otg(gadget) ? 8 : 100;
 819         int                     tmp;
 820
 821         if (number) {
 822                 list_for_each_entry(c, &cdev->configs, list) {
 823                         if (c->bConfigurationValue == number) {
 824                                 /*
 825                                  * We disable the FDs of the previous
 826                                  * configuration only if the new configuration
 827                                  * is a valid one
 828                                  */
 829                                 if (cdev->config)
 830                                         reset_config(cdev);
 831                                 result = 0;
 832                                 break;
 833                         }
 834                 }
 835                 if (result < 0)
 836                         goto done;
 837         } else { /* Zero configuration value - need to reset the config */
 838                 if (cdev->config)
 839                         reset_config(cdev);
 840                 result = 0;
 841         }
 842
 843         DBG(cdev, "%s config #%d: %s\n",
 844             usb_speed_string(gadget->speed),
 845             number, c ? c->label : "unconfigured");
 846
 847         if (!c)
 848                 goto done;
 849
 850         usb_gadget_set_state(gadget, USB_STATE_CONFIGURED);
 851         cdev->config = c;
 852
 853         /* Initialize all interfaces by setting them to altsetting zero. */
 854         for (tmp = 0; tmp < MAX_CONFIG_INTERFACES; tmp++) {
 855                 struct usb_function     *f = c->interface[tmp];
 856                 struct usb_descriptor_header **descriptors;
 857
 858                 if (!f)
 859                         break;
 860
 861                 /*
 862                  * Record which endpoints are used by the function. This is used
 863                  * to dispatch control requests targeted at that endpoint to the
 864                  * function's setup callback instead of the current
 865                  * configuration's setup callback.
 866                  */
 867                 descriptors = function_descriptors(f, gadget->speed);
 868
 869                 for (; *descriptors; ++descriptors) {
 870                         struct usb_endpoint_descriptor *ep;
 871                         int addr;
 872
 873                         if ((*descriptors)->bDescriptorType != USB_DT_ENDPOINT)
 874                                 continue;
 875
 876                         ep = (struct usb_endpoint_descriptor *)*descriptors;
 877                         addr = ((ep->bEndpointAddress & 0x80) >> 3)
 878                              |  (ep->bEndpointAddress & 0x0f);
 879                         set_bit(addr, f->endpoints);
 880                 }
 881
 882                 result = f->set_alt(f, tmp, 0);
 883                 if (result < 0) {
 884                         DBG(cdev, "interface %d (%s/%p) alt 0 --> %d\n",
 885                                         tmp, f->name, f, result);
 886
 887                         reset_config(cdev);
 888                         goto done;
 889                 }
 890
 891                 if (result == USB_GADGET_DELAYED_STATUS) {
 892                         DBG(cdev,
 893                          "%s: interface %d (%s) requested delayed status\n",
 894                                         __func__, tmp, f->name);
 895                         cdev->delayed_status++;
 896                         DBG(cdev, "delayed_status count %d\n",
 897                                         cdev->delayed_status);
 898                 }
 899         }
 900
 901         /* when we return, be sure our power usage is valid */
 902         power = c->MaxPower ? c->MaxPower : CONFIG_USB_GADGET_VBUS_DRAW;
 903         if (gadget->speed < USB_SPEED_SUPER)
 904                 power = min(power, 500U);
 905         else
 906                 power = min(power, 900U);
 907 done:
 908         if (power <= USB_SELF_POWER_VBUS_MAX_DRAW)
 909                 usb_gadget_set_selfpowered(gadget);
 910         else
 911                 usb_gadget_clear_selfpowered(gadget);
 912
 913         usb_gadget_vbus_draw(gadget, power);
 914         if (result >= 0 && cdev->delayed_status)
 915                 result = USB_GADGET_DELAYED_STATUS;
 916         return result;
 917 }
 918
 919 int usb_add_config_only(struct usb_composite_dev *cdev,
 920                 struct usb_configuration *config)
 921 {
 922         struct usb_configuration *c;
 923
 924         if (!config->bConfigurationValue)
 925                 return -EINVAL;
 926
 927         /* Prevent duplicate configuration identifiers */
 928         list_for_each_entry(c, &cdev->configs, list) {
 929                 if (c->bConfigurationValue == config->bConfigurationValue)
 930                         return -EBUSY;
 931         }
 932
 933         config->cdev = cdev;
 934         list_add_tail(&config->list, &cdev->configs);
 935
 936         INIT_LIST_HEAD(&config->functions);
 937         config->next_interface_id = 0;
 938         memset(config->interface, 0, sizeof(config->interface));
 939
 940         return 0;
 941 }
 942 EXPORT_SYMBOL_GPL(usb_add_config_only);
 943
 944 /**
 945  * usb_add_config() - add a configuration to a device.
 946  * @cdev: wraps the USB gadget
 947  * @config: the configuration, with bConfigurationValue assigned
 948  * @bind: the configuration's bind function
 949  * Context: single threaded during gadget setup
 950  *
 951  * One of the main tasks of a composite @bind() routine is to
 952  * add each of the configurations it supports, using this routine.
 953  *
 954  * This function returns the value of the configuration's @bind(), which
 955  * is zero for success else a negative errno value.  Binding configurations
 956  * assigns global resources including string IDs, and per-configuration
 957  * resources such as interface IDs and endpoints.
 958  */
 959 int usb_add_config(struct usb_composite_dev *cdev,
 960                 struct usb_configuration *config,
 961                 int (*bind)(struct usb_configuration *))
 962 {
 963         int                             status = -EINVAL;
 964
 965         if (!bind)
 966                 goto done;
 967
 968         DBG(cdev, "adding config #%u '%s'/%p\n",
 969                         config->bConfigurationValue,
 970                         config->label, config);
 971
 972         status = usb_add_config_only(cdev, config);
 973         if (status)
 974                 goto done;
 975
 976         status = bind(config);
 977         if (status < 0) {
 978                 while (!list_empty(&config->functions)) {
 979                         struct usb_function             *f;
 980
 981                         f = list_first_entry(&config->functions,
 982                                         struct usb_function, list);
 983                         list_del(&f->list);
 984                         if (f->unbind) {
 985                                 DBG(cdev, "unbind function '%s'/%p\n",
 986                                         f->name, f);
 987                                 f->unbind(config, f);
 988                                 /* may free memory for "f" */
 989                         }
 990                 }
 991                 list_del(&config->list);
 992                 config->cdev = NULL;
 993         } else {
 994                 unsigned        i;
 995
 996                 DBG(cdev, "cfg %d/%p speeds:%s%s%s%s\n",
 997                         config->bConfigurationValue, config,
 998                         config->superspeed_plus ? " superplus" : "",
 999                         config->superspeed ? " super" : "",
1000                         config->highspeed ? " high" : "",
1001                         config->fullspeed
1002                                 ? (gadget_is_dualspeed(cdev->gadget)
1003                                         ? " full"
1004                                         : " full/low")
1005                                 : "");
1006
1007                 for (i = 0; i < MAX_CONFIG_INTERFACES; i++) {
1008                         struct usb_function     *f = config->interface[i];
1009
1010                         if (!f)
1011                                 continue;
1012                         DBG(cdev, "  interface %d = %s/%p\n",
1013                                 i, f->name, f);
1014                 }
1015         }
1016
1017         /* set_alt(), or next bind(), sets up ep->claimed as needed */
1018         usb_ep_autoconfig_reset(cdev->gadget);
1019
1020 done:
1021         if (status)
1022                 DBG(cdev, "added config '%s'/%u --> %d\n", config->label,
1023                                 config->bConfigurationValue, status);
1024         return status;
1025 }
1026 EXPORT_SYMBOL_GPL(usb_add_config);
1027
1028 static void remove_config(struct usb_composite_dev *cdev,
1029                               struct usb_configuration *config)
1030 {
1031         while (!list_empty(&config->functions)) {
1032                 struct usb_function             *f;
1033
1034                 f = list_first_entry(&config->functions,
1035                                 struct usb_function, list);
1036
1037                 usb_remove_function(config, f);
1038         }
1039         list_del(&config->list);
1040         if (config->unbind) {
1041                 DBG(cdev, "unbind config '%s'/%p\n", config->label, config);
1042                 config->unbind(config);
1043                         /* may free memory for "c" */
1044         }
1045 }
1046
1047 /**
1048  * usb_remove_config() - remove a configuration from a device.
1049  * @cdev: wraps the USB gadget
1050  * @config: the configuration
1051  *
1052  * Drivers must call usb_gadget_disconnect before calling this function
1053  * to disconnect the device from the host and make sure the host will not
1054  * try to enumerate the device while we are changing the config list.
1055  */
1056 void usb_remove_config(struct usb_composite_dev *cdev,
1057                       struct usb_configuration *config)
1058 {
1059         unsigned long flags;
1060
1061         spin_lock_irqsave(&cdev->lock, flags);
1062
1063         if (cdev->config == config)
1064                 reset_config(cdev);
1065
1066         spin_unlock_irqrestore(&cdev->lock, flags);
1067
1068         remove_config(cdev, config);
1069 }
1070
1071 /*-------------------------------------------------------------------------*/
1072
1073 /* We support strings in multiple languages ... string descriptor zero
1074  * says which languages are supported.  The typical case will be that
1075  * only one language (probably English) is used, with i18n handled on
1076  * the host side.
1077  */
1078
1079 static void collect_langs(struct usb_gadget_strings **sp, __le16 *buf)
1080 {
1081         const struct usb_gadget_strings *s;
1082         __le16                          language;
1083         __le16                          *tmp;
1084
1085         while (*sp) {
1086                 s = *sp;
1087                 language = cpu_to_le16(s->language);
1088                 for (tmp = buf; *tmp && tmp < &buf[USB_MAX_STRING_LEN]; tmp++) {
1089                         if (*tmp == language)
1090                                 goto repeat;
1091                 }
1092                 *tmp++ = language;
1093 repeat:
1094                 sp++;
1095         }
1096 }
1097
1098 static int lookup_string(
1099         struct usb_gadget_strings       **sp,
1100         void                            *buf,
1101         u16                             language,
1102         int                             id
1103 )
1104 {
1105         struct usb_gadget_strings       *s;
1106         int                             value;
1107
1108         while (*sp) {
1109                 s = *sp++;
1110                 if (s->language != language)
1111                         continue;
1112                 value = usb_gadget_get_string(s, id, buf);
1113                 if (value > 0)
1114                         return value;
1115         }
1116         return -EINVAL;
1117 }
1118
1119 static int get_string(struct usb_composite_dev *cdev,
1120                 void *buf, u16 language, int id)
1121 {
1122         struct usb_composite_driver     *composite = cdev->driver;
1123         struct usb_gadget_string_container *uc;
1124         struct usb_configuration        *c;
1125         struct usb_function             *f;
1126         int                             len;
1127
1128         /* Yes, not only is USB's i18n support probably more than most
1129          * folk will ever care about ... also, it's all supported here.
1130          * (Except for UTF8 support for Unicode's "Astral Planes".)
1131          */
1132
1133         /* 0 == report all available language codes */
1134         if (id == 0) {
1135                 struct usb_string_descriptor    *s = buf;
1136                 struct usb_gadget_strings       **sp;
1137
1138                 memset(s, 0, 256);
1139                 s->bDescriptorType = USB_DT_STRING;
1140
1141                 sp = composite->strings;
1142                 if (sp)
1143                         collect_langs(sp, s->wData);
1144
1145                 list_for_each_entry(c, &cdev->configs, list) {
1146                         sp = c->strings;
1147                         if (sp)
1148                                 collect_langs(sp, s->wData);
1149
1150                         list_for_each_entry(f, &c->functions, list) {
1151                                 sp = f->strings;
1152                                 if (sp)
1153                                         collect_langs(sp, s->wData);
1154                         }
1155                 }
1156                 list_for_each_entry(uc, &cdev->gstrings, list) {
1157                         struct usb_gadget_strings **sp;
1158
1159                         sp = get_containers_gs(uc);
1160                         collect_langs(sp, s->wData);
1161                 }
1162
1163                 for (len = 0; len <= USB_MAX_STRING_LEN && s->wData[len]; len++)
1164                         continue;
1165                 if (!len)
1166                         return -EINVAL;
1167
1168                 s->bLength = 2 * (len + 1);
1169                 return s->bLength;
1170         }
1171
1172         if (cdev->use_os_string && language == 0 && id == OS_STRING_IDX) {
1173                 struct usb_os_string *b = buf;
1174                 b->bLength = sizeof(*b);
1175                 b->bDescriptorType = USB_DT_STRING;
1176                 compiletime_assert(
1177                         sizeof(b->qwSignature) == sizeof(cdev->qw_sign),
1178                         "qwSignature size must be equal to qw_sign");
1179                 memcpy(&b->qwSignature, cdev->qw_sign, sizeof(b->qwSignature));
1180                 b->bMS_VendorCode = cdev->b_vendor_code;
1181                 b->bPad = 0;
1182                 return sizeof(*b);
1183         }
1184
1185         list_for_each_entry(uc, &cdev->gstrings, list) {
1186                 struct usb_gadget_strings **sp;
1187
1188                 sp = get_containers_gs(uc);
1189                 len = lookup_string(sp, buf, language, id);
1190                 if (len > 0)
1191                         return len;
1192         }
1193
1194         /* String IDs are device-scoped, so we look up each string
1195          * table we're told about.  These lookups are infrequent;
1196          * simpler-is-better here.
1197          */
1198         if (composite->strings) {
1199                 len = lookup_string(composite->strings, buf, language, id);
1200                 if (len > 0)
1201                         return len;
1202         }
1203         list_for_each_entry(c, &cdev->configs, list) {
1204                 if (c->strings) {
1205                         len = lookup_string(c->strings, buf, language, id);
1206                         if (len > 0)
1207                                 return len;
1208                 }
1209                 list_for_each_entry(f, &c->functions, list) {
1210                         if (!f->strings)
1211                                 continue;
1212                         len = lookup_string(f->strings, buf, language, id);
1213                         if (len > 0)
1214                                 return len;
1215                 }
1216         }
1217         return -EINVAL;
1218 }
1219
1220 /**
1221  * usb_string_id() - allocate an unused string ID
1222  * @cdev: the device whose string descriptor IDs are being allocated
1223  * Context: single threaded during gadget setup
1224  *
1225  * @usb_string_id() is called from bind() callbacks to allocate
1226  * string IDs.  Drivers for functions, configurations, or gadgets will
1227  * then store that ID in the appropriate descriptors and string table.
1228  *
1229  * All string identifier should be allocated using this,
1230  * @usb_string_ids_tab() or @usb_string_ids_n() routine, to ensure
1231  * that for example different functions don't wrongly assign different
1232  * meanings to the same identifier.
1233  */
1234 int usb_string_id(struct usb_composite_dev *cdev)
1235 {
1236         if (cdev->next_string_id < 254) {
1237                 /* string id 0 is reserved by USB spec for list of
1238                  * supported languages */
1239                 /* 255 reserved as well? -- mina86 */
1240                 cdev->next_string_id++;
1241                 return cdev->next_string_id;
1242         }
1243         return -ENODEV;
1244 }
1245 EXPORT_SYMBOL_GPL(usb_string_id);
1246
1247 /**
1248  * usb_string_ids_tab() - allocate unused string IDs in batch
1249  * @cdev: the device whose string descriptor IDs are being allocated
1250  * @str: an array of usb_string objects to assign numbers to
1251  * Context: single threaded during gadget setup
1252  *
1253  * @usb_string_ids() is called from bind() callbacks to allocate
1254  * string IDs.  Drivers for functions, configurations, or gadgets will
1255  * then copy IDs from the string table to the appropriate descriptors
1256  * and string table for other languages.
1257  *
1258  * All string identifier should be allocated using this,
1259  * @usb_string_id() or @usb_string_ids_n() routine, to ensure that for
1260  * example different functions don't wrongly assign different meanings
1261  * to the same identifier.
1262  */
1263 int usb_string_ids_tab(struct usb_composite_dev *cdev, struct usb_string *str)
1264 {
1265         int next = cdev->next_string_id;
1266
1267         for (; str->s; ++str) {
1268                 if (unlikely(next >= 254))
1269                         return -ENODEV;
1270                 str->id = ++next;
1271         }
1272
1273         cdev->next_string_id = next;
1274
1275         return 0;
1276 }
1277 EXPORT_SYMBOL_GPL(usb_string_ids_tab);
1278
1279 static struct usb_gadget_string_container *copy_gadget_strings(
1280                 struct usb_gadget_strings **sp, unsigned n_gstrings,
1281                 unsigned n_strings)
1282 {
1283         struct usb_gadget_string_container *uc;
1284         struct usb_gadget_strings **gs_array;
1285         struct usb_gadget_strings *gs;
1286         struct usb_string *s;
1287         unsigned mem;
1288         unsigned n_gs;
1289         unsigned n_s;
1290         void *stash;
1291
1292         mem = sizeof(*uc);
1293         mem += sizeof(void *) * (n_gstrings + 1);
1294         mem += sizeof(struct usb_gadget_strings) * n_gstrings;
1295         mem += sizeof(struct usb_string) * (n_strings + 1) * (n_gstrings);
1296         uc = kmalloc(mem, GFP_KERNEL);
1297         if (!uc)
1298                 return ERR_PTR(-ENOMEM);
1299         gs_array = get_containers_gs(uc);
1300         stash = uc->stash;
1301         stash += sizeof(void *) * (n_gstrings + 1);
1302         for (n_gs = 0; n_gs < n_gstrings; n_gs++) {
1303                 struct usb_string *org_s;
1304
1305                 gs_array[n_gs] = stash;
1306                 gs = gs_array[n_gs];
1307                 stash += sizeof(struct usb_gadget_strings);
1308                 gs->language = sp[n_gs]->language;
1309                 gs->strings = stash;
1310                 org_s = sp[n_gs]->strings;
1311
1312                 for (n_s = 0; n_s < n_strings; n_s++) {
1313                         s = stash;
1314                         stash += sizeof(struct usb_string);
1315                         if (org_s->s)
1316                                 s->s = org_s->s;
1317                         else
1318                                 s->s = "";
1319                         org_s++;
1320                 }
1321                 s = stash;
1322                 s->s = NULL;
1323                 stash += sizeof(struct usb_string);
1324
1325         }
1326         gs_array[n_gs] = NULL;
1327         return uc;
1328 }
1329
1330 /**
1331  * usb_gstrings_attach() - attach gadget strings to a cdev and assign ids
1332  * @cdev: the device whose string descriptor IDs are being allocated
1333  * and attached.
1334  * @sp: an array of usb_gadget_strings to attach.
1335  * @n_strings: number of entries in each usb_strings array (sp[]->strings)
1336  *
1337  * This function will create a deep copy of usb_gadget_strings and usb_string
1338  * and attach it to the cdev. The actual string (usb_string.s) will not be
1339  * copied but only a referenced will be made. The struct usb_gadget_strings
1340  * array may contain multiple languages and should be NULL terminated.
1341  * The ->language pointer of each struct usb_gadget_strings has to contain the
1342  * same amount of entries.
1343  * For instance: sp[0] is en-US, sp[1] is es-ES. It is expected that the first
1344  * usb_string entry of es-ES contains the translation of the first usb_string
1345  * entry of en-US. Therefore both entries become the same id assign.
1346  */
1347 struct usb_string *usb_gstrings_attach(struct usb_composite_dev *cdev,
1348                 struct usb_gadget_strings **sp, unsigned n_strings)
1349 {
1350         struct usb_gadget_string_container *uc;
1351         struct usb_gadget_strings **n_gs;
1352         unsigned n_gstrings = 0;
1353         unsigned i;
1354         int ret;
1355
1356         for (i = 0; sp[i]; i++)
1357                 n_gstrings++;
1358
1359         if (!n_gstrings)
1360                 return ERR_PTR(-EINVAL);
1361
1362         uc = copy_gadget_strings(sp, n_gstrings, n_strings);
1363         if (IS_ERR(uc))
1364                 return ERR_CAST(uc);
1365
1366         n_gs = get_containers_gs(uc);
1367         ret = usb_string_ids_tab(cdev, n_gs[0]->strings);
1368         if (ret)
1369                 goto err;
1370
1371         for (i = 1; i < n_gstrings; i++) {
1372                 struct usb_string *m_s;
1373                 struct usb_string *s;
1374                 unsigned n;
1375
1376                 m_s = n_gs[0]->strings;
1377                 s = n_gs[i]->strings;
1378                 for (n = 0; n < n_strings; n++) {
1379                         s->id = m_s->id;
1380                         s++;
1381                         m_s++;
1382                 }
1383         }
1384         list_add_tail(&uc->list, &cdev->gstrings);
1385         return n_gs[0]->strings;
1386 err:
1387         kfree(uc);
1388         return ERR_PTR(ret);
1389 }
1390 EXPORT_SYMBOL_GPL(usb_gstrings_attach);
1391
1392 /**
1393  * usb_string_ids_n() - allocate unused string IDs in batch
1394  * @c: the device whose string descriptor IDs are being allocated
1395  * @n: number of string IDs to allocate
1396  * Context: single threaded during gadget setup
1397  *
1398  * Returns the first requested ID.  This ID and next @n-1 IDs are now
1399  * valid IDs.  At least provided that @n is non-zero because if it
1400  * is, returns last requested ID which is now very useful information.
1401  *
1402  * @usb_string_ids_n() is called from bind() callbacks to allocate
1403  * string IDs.  Drivers for functions, configurations, or gadgets will
1404  * then store that ID in the appropriate descriptors and string table.
1405  *
1406  * All string identifier should be allocated using this,
1407  * @usb_string_id() or @usb_string_ids_n() routine, to ensure that for
1408  * example different functions don't wrongly assign different meanings
1409  * to the same identifier.
1410  */
1411 int usb_string_ids_n(struct usb_composite_dev *c, unsigned n)
1412 {
1413         unsigned next = c->next_string_id;
1414         if (unlikely(n > 254 || (unsigned)next + n > 254))
1415                 return -ENODEV;
1416         c->next_string_id += n;
1417         return next + 1;
1418 }
1419 EXPORT_SYMBOL_GPL(usb_string_ids_n);
1420
1421 /*-------------------------------------------------------------------------*/
1422
1423 static void composite_setup_complete(struct usb_ep *ep, struct usb_request *req)
1424 {
1425         struct usb_composite_dev *cdev;
1426
1427         if (req->status || req->actual != req->length)
1428                 DBG((struct usb_composite_dev *) ep->driver_data,
1429                                 "setup complete --> %d, %d/%d\n",
1430                                 req->status, req->actual, req->length);
1431
1432         /*
1433          * REVIST The same ep0 requests are shared with function drivers
1434          * so they don't have to maintain the same ->complete() stubs.
1435          *
1436          * Because of that, we need to check for the validity of ->context
1437          * here, even though we know we've set it to something useful.
1438          */
1439         if (!req->context)
1440                 return;
1441
1442         cdev = req->context;
1443
1444         if (cdev->req == req)
1445                 cdev->setup_pending = false;
1446         else if (cdev->os_desc_req == req)
1447                 cdev->os_desc_pending = false;
1448         else
1449                 WARN(1, "unknown request %p\n", req);
1450 }
1451
1452 static int composite_ep0_queue(struct usb_composite_dev *cdev,
1453                 struct usb_request *req, gfp_t gfp_flags)
1454 {
1455         int ret;
1456
1457         ret = usb_ep_queue(cdev->gadget->ep0, req, gfp_flags);
1458         if (ret == 0) {
1459                 if (cdev->req == req)
1460                         cdev->setup_pending = true;
1461                 else if (cdev->os_desc_req == req)
1462                         cdev->os_desc_pending = true;
1463                 else
1464                         WARN(1, "unknown request %p\n", req);
1465         }
1466
1467         return ret;
1468 }
1469
1470 static int count_ext_compat(struct usb_configuration *c)
1471 {
1472         int i, res;
1473
1474         res = 0;
1475         for (i = 0; i < c->next_interface_id; ++i) {
1476                 struct usb_function *f;
1477                 int j;
1478
1479                 f = c->interface[i];
1480                 for (j = 0; j < f->os_desc_n; ++j) {
1481                         struct usb_os_desc *d;
1482
1483                         if (i != f->os_desc_table[j].if_id)
1484                                 continue;
1485                         d = f->os_desc_table[j].os_desc;
1486                         if (d && d->ext_compat_id)
1487                                 ++res;
1488                 }
1489         }
1490         BUG_ON(res > 255);
1491         return res;
1492 }
1493
1494 static int fill_ext_compat(struct usb_configuration *c, u8 *buf)
1495 {
1496         int i, count;
1497
1498         count = 16;
1499         buf += 16;
1500         for (i = 0; i < c->next_interface_id; ++i) {
1501                 struct usb_function *f;
1502                 int j;
1503
1504                 f = c->interface[i];
1505                 for (j = 0; j < f->os_desc_n; ++j) {
1506                         struct usb_os_desc *d;
1507
1508                         if (i != f->os_desc_table[j].if_id)
1509                                 continue;
1510                         d = f->os_desc_table[j].os_desc;
1511                         if (d && d->ext_compat_id) {
1512                                 *buf++ = i;
1513                                 *buf++ = 0x01;
1514                                 memcpy(buf, d->ext_compat_id, 16);
1515                                 buf += 22;
1516                         } else {
1517                                 ++buf;
1518                                 *buf = 0x01;
1519                                 buf += 23;
1520                         }
1521                         count += 24;
1522                         if (count + 24 >= USB_COMP_EP0_OS_DESC_BUFSIZ)
1523                                 return count;
1524                 }
1525         }
1526
1527         return count;
1528 }
1529
1530 static int count_ext_prop(struct usb_configuration *c, int interface)
1531 {
1532         struct usb_function *f;
1533         int j;
1534
1535         f = c->interface[interface];
1536         for (j = 0; j < f->os_desc_n; ++j) {
1537                 struct usb_os_desc *d;
1538
1539                 if (interface != f->os_desc_table[j].if_id)
1540                         continue;
1541                 d = f->os_desc_table[j].os_desc;
1542                 if (d && d->ext_compat_id)
1543                         return d->ext_prop_count;
1544         }
1545         return 0;
1546 }
1547
1548 static int len_ext_prop(struct usb_configuration *c, int interface)
1549 {
1550         struct usb_function *f;
1551         struct usb_os_desc *d;
1552         int j, res;
1553
1554         res = 10; /* header length */
1555         f = c->interface[interface];
1556         for (j = 0; j < f->os_desc_n; ++j) {
1557                 if (interface != f->os_desc_table[j].if_id)
1558                         continue;
1559                 d = f->os_desc_table[j].os_desc;
1560                 if (d)
1561                         return min(res + d->ext_prop_len, 4096);
1562         }
1563         return res;
1564 }
1565
1566 static int fill_ext_prop(struct usb_configuration *c, int interface, u8 *buf)
1567 {
1568         struct usb_function *f;
1569         struct usb_os_desc *d;
1570         struct usb_os_desc_ext_prop *ext_prop;
1571         int j, count, n, ret;
1572
1573         f = c->interface[interface];
1574         count = 10; /* header length */
1575         buf += 10;
1576         for (j = 0; j < f->os_desc_n; ++j) {
1577                 if (interface != f->os_desc_table[j].if_id)
1578                         continue;
1579                 d = f->os_desc_table[j].os_desc;
1580                 if (d)
1581                         list_for_each_entry(ext_prop, &d->ext_prop, entry) {
1582                                 n = ext_prop->data_len +
1583                                         ext_prop->name_len + 14;
1584                                 if (count + n >= USB_COMP_EP0_OS_DESC_BUFSIZ)
1585                                         return count;
1586                                 usb_ext_prop_put_size(buf, n);
1587                                 usb_ext_prop_put_type(buf, ext_prop->type);
1588                                 ret = usb_ext_prop_put_name(buf, ext_prop->name,
1589                                                             ext_prop->name_len);
1590                                 if (ret < 0)
1591                                         return ret;
1592                                 switch (ext_prop->type) {
1593                                 case USB_EXT_PROP_UNICODE:
1594                                 case USB_EXT_PROP_UNICODE_ENV:
1595                                 case USB_EXT_PROP_UNICODE_LINK:
1596                                         usb_ext_prop_put_unicode(buf, ret,
1597                                                          ext_prop->data,
1598                                                          ext_prop->data_len);
1599                                         break;
1600                                 case USB_EXT_PROP_BINARY:
1601                                         usb_ext_prop_put_binary(buf, ret,
1602                                                         ext_prop->data,
1603                                                         ext_prop->data_len);
1604                                         break;
1605                                 case USB_EXT_PROP_LE32:
1606                                         /* not implemented */
1607                                 case USB_EXT_PROP_BE32:
1608                                         /* not implemented */
1609                                 default:
1610                                         return -EINVAL;
1611                                 }
1612                                 buf += n;
1613                                 count += n;
1614                         }
1615         }
1616
1617         return count;
1618 }
1619
1620 /*
1621  * The setup() callback implements all the ep0 functionality that's
1622  * not handled lower down, in hardware or the hardware driver(like
1623  * device and endpoint feature flags, and their status).  It's all
1624  * housekeeping for the gadget function we're implementing.  Most of
1625  * the work is in config and function specific setup.
1626  */
1627 int
1628 composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
1629 {
1630         struct usb_composite_dev        *cdev = get_gadget_data(gadget);
1631         struct usb_request              *req = cdev->req;
1632         int                             value = -EOPNOTSUPP;
1633         int                             status = 0;
1634         u16                             w_index = le16_to_cpu(ctrl->wIndex);
1635         u8                              intf = w_index & 0xFF;
1636         u16                             w_value = le16_to_cpu(ctrl->wValue);
1637         u16                             w_length = le16_to_cpu(ctrl->wLength);
1638         struct usb_function             *f = NULL;
1639         u8                              endp;
1640
1641         /* partial re-init of the response message; the function or the
1642          * gadget might need to intercept e.g. a control-OUT completion
1643          * when we delegate to it.
1644          */
1645         req->zero = 0;
1646         req->context = cdev;
1647         req->complete = composite_setup_complete;
1648         req->length = 0;
1649         gadget->ep0->driver_data = cdev;
1650
1651         /*
1652          * Don't let non-standard requests match any of the cases below
1653          * by accident.
1654          */
1655         if ((ctrl->bRequestType & USB_TYPE_MASK) != USB_TYPE_STANDARD)
1656                 goto unknown;
1657
1658         switch (ctrl->bRequest) {
1659
1660         /* we handle all standard USB descriptors */
1661         case USB_REQ_GET_DESCRIPTOR:
1662                 if (ctrl->bRequestType != USB_DIR_IN)
1663                         goto unknown;
1664                 switch (w_value >> 8) {
1665
1666                 case USB_DT_DEVICE:
1667                         cdev->desc.bNumConfigurations =
1668                                 count_configs(cdev, USB_DT_DEVICE);
1669                         cdev->desc.bMaxPacketSize0 =
1670                                 cdev->gadget->ep0->maxpacket;
1671                         if (gadget_is_superspeed(gadget)) {
1672                                 if (gadget->speed >= USB_SPEED_SUPER) {
1673                                         cdev->desc.bcdUSB = cpu_to_le16(0x0320);
1674                                         cdev->desc.bMaxPacketSize0 = 9;
1675                                 } else {
1676                                         cdev->desc.bcdUSB = cpu_to_le16(0x0210);
1677                                 }
1678                         } else {
1679                                 if (gadget->lpm_capable)
1680                                         cdev->desc.bcdUSB = cpu_to_le16(0x0201);
1681                                 else
1682                                         cdev->desc.bcdUSB = cpu_to_le16(0x0200);
1683                         }
1684
1685                         value = min(w_length, (u16) sizeof cdev->desc);
1686                         memcpy(req->buf, &cdev->desc, value);
1687                         break;
1688                 case USB_DT_DEVICE_QUALIFIER:
1689                         if (!gadget_is_dualspeed(gadget) ||
1690                             gadget->speed >= USB_SPEED_SUPER)
1691                                 break;
1692                         device_qual(cdev);
1693                         value = min_t(int, w_length,
1694                                 sizeof(struct usb_qualifier_descriptor));
1695                         break;
1696                 case USB_DT_OTHER_SPEED_CONFIG:
1697                         if (!gadget_is_dualspeed(gadget) ||
1698                             gadget->speed >= USB_SPEED_SUPER)
1699                                 break;
1700                         fallthrough;
1701                 case USB_DT_CONFIG:
1702                         value = config_desc(cdev, w_value);
1703                         if (value >= 0)
1704                                 value = min(w_length, (u16) value);
1705                         break;
1706                 case USB_DT_STRING:
1707                         value = get_string(cdev, req->buf,
1708                                         w_index, w_value & 0xff);
1709                         if (value >= 0)
1710                                 value = min(w_length, (u16) value);
1711                         break;
1712                 case USB_DT_BOS:
1713                         if (gadget_is_superspeed(gadget) ||
1714                             gadget->lpm_capable) {
1715                                 value = bos_desc(cdev);
1716                                 value = min(w_length, (u16) value);
1717                         }
1718                         break;
1719                 case USB_DT_OTG:
1720                         if (gadget_is_otg(gadget)) {
1721                                 struct usb_configuration *config;
1722                                 int otg_desc_len = 0;
1723
1724                                 if (cdev->config)
1725                                         config = cdev->config;
1726                                 else
1727                                         config = list_first_entry(
1728                                                         &cdev->configs,
1729                                                 struct usb_configuration, list);
1730                                 if (!config)
1731                                         goto done;
1732
1733                                 if (gadget->otg_caps &&
1734                                         (gadget->otg_caps->otg_rev >= 0x0200))
1735                                         otg_desc_len += sizeof(
1736                                                 struct usb_otg20_descriptor);
1737                                 else
1738                                         otg_desc_len += sizeof(
1739                                                 struct usb_otg_descriptor);
1740
1741                                 value = min_t(int, w_length, otg_desc_len);
1742                                 memcpy(req->buf, config->descriptors[0], value);
1743                         }
1744                         break;
1745                 }
1746                 break;
1747
1748         /* any number of configs can work */
1749         case USB_REQ_SET_CONFIGURATION:
1750                 if (ctrl->bRequestType != 0)
1751                         goto unknown;
1752                 if (gadget_is_otg(gadget)) {
1753                         if (gadget->a_hnp_support)
1754                                 DBG(cdev, "HNP available\n");
1755                         else if (gadget->a_alt_hnp_support)
1756                                 DBG(cdev, "HNP on another port\n");
1757                         else
1758                                 VDBG(cdev, "HNP inactive\n");
1759                 }
1760                 spin_lock(&cdev->lock);
1761                 value = set_config(cdev, ctrl, w_value);
1762                 spin_unlock(&cdev->lock);
1763                 break;
1764         case USB_REQ_GET_CONFIGURATION:
1765                 if (ctrl->bRequestType != USB_DIR_IN)
1766                         goto unknown;
1767                 if (cdev->config)
1768                         *(u8 *)req->buf = cdev->config->bConfigurationValue;
1769                 else
1770                         *(u8 *)req->buf = 0;
1771                 value = min(w_length, (u16) 1);
1772                 break;
1773
1774         /* function drivers must handle get/set altsetting */
1775         case USB_REQ_SET_INTERFACE:
1776                 if (ctrl->bRequestType != USB_RECIP_INTERFACE)
1777                         goto unknown;
1778                 if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
1779                         break;
1780                 f = cdev->config->interface[intf];
1781                 if (!f)
1782                         break;
1783
1784                 /*
1785                  * If there's no get_alt() method, we know only altsetting zero
1786                  * works. There is no need to check if set_alt() is not NULL
1787                  * as we check this in usb_add_function().
1788                  */
1789                 if (w_value && !f->get_alt)
1790                         break;
1791
1792                 spin_lock(&cdev->lock);
1793                 value = f->set_alt(f, w_index, w_value);
1794                 if (value == USB_GADGET_DELAYED_STATUS) {
1795                         DBG(cdev,
1796                          "%s: interface %d (%s) requested delayed status\n",
1797                                         __func__, intf, f->name);
1798                         cdev->delayed_status++;
1799                         DBG(cdev, "delayed_status count %d\n",
1800                                         cdev->delayed_status);
1801                 }
1802                 spin_unlock(&cdev->lock);
1803                 break;
1804         case USB_REQ_GET_INTERFACE:
1805                 if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
1806                         goto unknown;
1807                 if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
1808                         break;
1809                 f = cdev->config->interface[intf];
1810                 if (!f)
1811                         break;
1812                 /* lots of interfaces only need altsetting zero... */
1813                 value = f->get_alt ? f->get_alt(f, w_index) : 0;
1814                 if (value < 0)
1815                         break;
1816                 *((u8 *)req->buf) = value;
1817                 value = min(w_length, (u16) 1);
1818                 break;
1819         case USB_REQ_GET_STATUS:
1820                 if (gadget_is_otg(gadget) && gadget->hnp_polling_support &&
1821                                                 (w_index == OTG_STS_SELECTOR)) {
1822                         if (ctrl->bRequestType != (USB_DIR_IN |
1823                                                         USB_RECIP_DEVICE))
1824                                 goto unknown;
1825                         *((u8 *)req->buf) = gadget->host_request_flag;
1826                         value = 1;
1827                         break;
1828                 }
1829
1830                 /*
1831                  * USB 3.0 additions:
1832                  * Function driver should handle get_status request. If such cb
1833                  * wasn't supplied we respond with default value = 0
1834                  * Note: function driver should supply such cb only for the
1835                  * first interface of the function
1836                  */
1837                 if (!gadget_is_superspeed(gadget))
1838                         goto unknown;
1839                 if (ctrl->bRequestType != (USB_DIR_IN | USB_RECIP_INTERFACE))
1840                         goto unknown;
1841                 value = 2;      /* This is the length of the get_status reply */
1842                 put_unaligned_le16(0, req->buf);
1843                 if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
1844                         break;
1845                 f = cdev->config->interface[intf];
1846                 if (!f)
1847                         break;
1848                 status = f->get_status ? f->get_status(f) : 0;
1849                 if (status < 0)
1850                         break;
1851                 put_unaligned_le16(status & 0x0000ffff, req->buf);
1852                 break;
1853         /*
1854          * Function drivers should handle SetFeature/ClearFeature
1855          * (FUNCTION_SUSPEND) request. function_suspend cb should be supplied
1856          * only for the first interface of the function
1857          */
1858         case USB_REQ_CLEAR_FEATURE:
1859         case USB_REQ_SET_FEATURE:
1860                 if (!gadget_is_superspeed(gadget))
1861                         goto unknown;
1862                 if (ctrl->bRequestType != (USB_DIR_OUT | USB_RECIP_INTERFACE))
1863                         goto unknown;
1864                 switch (w_value) {
1865                 case USB_INTRF_FUNC_SUSPEND:
1866                         if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
1867                                 break;
1868                         f = cdev->config->interface[intf];
1869                         if (!f)
1870                                 break;
1871                         value = 0;
1872                         if (f->func_suspend)
1873                                 value = f->func_suspend(f, w_index >> 8);
1874                         if (value < 0) {
1875                                 ERROR(cdev,
1876                                       "func_suspend() returned error %d\n",
1877                                       value);
1878                                 value = 0;
1879                         }
1880                         break;
1881                 }
1882                 break;
1883         default:
1884 unknown:
1885                 /*
1886                  * OS descriptors handling
1887                  */
1888                 if (cdev->use_os_string && cdev->os_desc_config &&
1889                     (ctrl->bRequestType & USB_TYPE_VENDOR) &&
1890                     ctrl->bRequest == cdev->b_vendor_code) {
1891                         struct usb_configuration        *os_desc_cfg;
1892                         u8                              *buf;
1893                         int                             interface;
1894                         int                             count = 0;
1895
1896                         req = cdev->os_desc_req;
1897                         req->context = cdev;
1898                         req->complete = composite_setup_complete;
1899                         buf = req->buf;
1900                         os_desc_cfg = cdev->os_desc_config;
1901                         w_length = min_t(u16, w_length, USB_COMP_EP0_OS_DESC_BUFSIZ);
1902                         memset(buf, 0, w_length);
1903                         buf[5] = 0x01;
1904                         switch (ctrl->bRequestType & USB_RECIP_MASK) {
1905                         case USB_RECIP_DEVICE:
1906                                 if (w_index != 0x4 || (w_value >> 8))
1907                                         break;
1908                                 buf[6] = w_index;
1909                                 /* Number of ext compat interfaces */
1910                                 count = count_ext_compat(os_desc_cfg);
1911                                 buf[8] = count;
1912                                 count *= 24; /* 24 B/ext compat desc */
1913                                 count += 16; /* header */
1914                                 put_unaligned_le32(count, buf);
1915                                 value = w_length;
1916                                 if (w_length > 0x10) {
1917                                         value = fill_ext_compat(os_desc_cfg, buf);
1918                                         value = min_t(u16, w_length, value);
1919                                 }
1920                                 break;
1921                         case USB_RECIP_INTERFACE:
1922                                 if (w_index != 0x5 || (w_value >> 8))
1923                                         break;
1924                                 interface = w_value & 0xFF;
1925                                 buf[6] = w_index;
1926                                 count = count_ext_prop(os_desc_cfg,
1927                                         interface);
1928                                 put_unaligned_le16(count, buf + 8);
1929                                 count = len_ext_prop(os_desc_cfg,
1930                                         interface);
1931                                 put_unaligned_le32(count, buf);
1932                                 value = w_length;
1933                                 if (w_length > 0x0A) {
1934                                         value = fill_ext_prop(os_desc_cfg,
1935                                                               interface, buf);
1936                                         if (value >= 0)
1937                                                 value = min_t(u16, w_length, value);
1938                                 }
1939                                 break;
1940                         }
1941
1942                         goto check_value;
1943                 }
1944
1945                 VDBG(cdev,
1946                         "non-core control req%02x.%02x v%04x i%04x l%d\n",
1947                         ctrl->bRequestType, ctrl->bRequest,
1948                         w_value, w_index, w_length);
1949
1950                 /* functions always handle their interfaces and endpoints...
1951                  * punt other recipients (other, WUSB, ...) to the current
1952                  * configuration code.
1953                  */
1954                 if (cdev->config) {
1955                         list_for_each_entry(f, &cdev->config->functions, list)
1956                                 if (f->req_match &&
1957                                     f->req_match(f, ctrl, false))
1958                                         goto try_fun_setup;
1959                 } else {
1960                         struct usb_configuration *c;
1961                         list_for_each_entry(c, &cdev->configs, list)
1962                                 list_for_each_entry(f, &c->functions, list)
1963                                         if (f->req_match &&
1964                                             f->req_match(f, ctrl, true))
1965                                                 goto try_fun_setup;
1966                 }
1967                 f = NULL;
1968
1969                 switch (ctrl->bRequestType & USB_RECIP_MASK) {
1970                 case USB_RECIP_INTERFACE:
1971                         if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
1972                                 break;
1973                         f = cdev->config->interface[intf];
1974                         break;
1975
1976                 case USB_RECIP_ENDPOINT:
1977                         if (!cdev->config)
1978                                 break;
1979                         endp = ((w_index & 0x80) >> 3) | (w_index & 0x0f);
1980                         list_for_each_entry(f, &cdev->config->functions, list) {
1981                                 if (test_bit(endp, f->endpoints))
1982                                         break;
1983                         }
1984                         if (&f->list == &cdev->config->functions)
1985                                 f = NULL;
1986                         break;
1987                 }
1988 try_fun_setup:
1989                 if (f && f->setup)
1990                         value = f->setup(f, ctrl);
1991                 else {
1992                         struct usb_configuration        *c;
1993
1994                         c = cdev->config;
1995                         if (!c)
1996                                 goto done;
1997
1998                         /* try current config's setup */
1999                         if (c->setup) {
2000                                 value = c->setup(c, ctrl);
2001                                 goto done;
2002                         }
2003
2004                         /* try the only function in the current config */
2005                         if (!list_is_singular(&c->functions))
2006                                 goto done;
2007                         f = list_first_entry(&c->functions, struct usb_function,
2008                                              list);
2009                         if (f->setup)
2010                                 value = f->setup(f, ctrl);
2011                 }
2012
2013                 goto done;
2014         }
2015
2016 check_value:
2017         /* respond with data transfer before status phase? */
2018         if (value >= 0 && value != USB_GADGET_DELAYED_STATUS) {
2019                 req->length = value;
2020                 req->context = cdev;
2021                 req->zero = value < w_length;
2022                 value = composite_ep0_queue(cdev, req, GFP_ATOMIC);
2023                 if (value < 0) {
2024                         DBG(cdev, "ep_queue --> %d\n", value);
2025                         req->status = 0;
2026                         composite_setup_complete(gadget->ep0, req);
2027                 }
2028         } else if (value == USB_GADGET_DELAYED_STATUS && w_length != 0) {
2029                 WARN(cdev,
2030                         "%s: Delayed status not supported for w_length != 0",
2031                         __func__);
2032         }
2033
2034 done:
2035         /* device either stalls (value < 0) or reports success */
2036         return value;
2037 }
2038
2039 void composite_disconnect(struct usb_gadget *gadget)
2040 {
2041         struct usb_composite_dev        *cdev = get_gadget_data(gadget);
2042         unsigned long                   flags;
2043
2044         /* REVISIT:  should we have config and device level
2045          * disconnect callbacks?
2046          */
2047         spin_lock_irqsave(&cdev->lock, flags);
2048         cdev->suspended = 0;
2049         if (cdev->config)
2050                 reset_config(cdev);
2051         if (cdev->driver->disconnect)
2052                 cdev->driver->disconnect(cdev);
2053         spin_unlock_irqrestore(&cdev->lock, flags);
2054 }
2055
2056 /*-------------------------------------------------------------------------*/
2057
2058 static ssize_t suspended_show(struct device *dev, struct device_attribute *attr,
2059                               char *buf)
2060 {
2061         struct usb_gadget *gadget = dev_to_usb_gadget(dev);
2062         struct usb_composite_dev *cdev = get_gadget_data(gadget);
2063
2064         return sprintf(buf, "%d\n", cdev->suspended);
2065 }
2066 static DEVICE_ATTR_RO(suspended);
2067
2068 static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver)
2069 {
2070         struct usb_composite_dev        *cdev = get_gadget_data(gadget);
2071         struct usb_gadget_strings       *gstr = cdev->driver->strings[0];
2072         struct usb_string               *dev_str = gstr->strings;
2073
2074         /* composite_disconnect() must already have been called
2075          * by the underlying peripheral controller driver!
2076          * so there's no i/o concurrency that could affect the
2077          * state protected by cdev->lock.
2078          */
2079         WARN_ON(cdev->config);
2080
2081         while (!list_empty(&cdev->configs)) {
2082                 struct usb_configuration        *c;
2083                 c = list_first_entry(&cdev->configs,
2084                                 struct usb_configuration, list);
2085                 remove_config(cdev, c);
2086         }
2087         if (cdev->driver->unbind && unbind_driver)
2088                 cdev->driver->unbind(cdev);
2089
2090         composite_dev_cleanup(cdev);
2091
2092         if (dev_str[USB_GADGET_MANUFACTURER_IDX].s == cdev->def_manufacturer)
2093                 dev_str[USB_GADGET_MANUFACTURER_IDX].s = "";
2094
2095         kfree(cdev->def_manufacturer);
2096         kfree(cdev);
2097         set_gadget_data(gadget, NULL);
2098 }
2099
2100 static void composite_unbind(struct usb_gadget *gadget)
2101 {
2102         __composite_unbind(gadget, true);
2103 }
2104
2105 static void update_unchanged_dev_desc(struct usb_device_descriptor *new,
2106                 const struct usb_device_descriptor *old)
2107 {
2108         __le16 idVendor;
2109         __le16 idProduct;
2110         __le16 bcdDevice;
2111         u8 iSerialNumber;
2112         u8 iManufacturer;
2113         u8 iProduct;
2114
2115         /*
2116          * these variables may have been set in
2117          * usb_composite_overwrite_options()
2118          */
2119         idVendor = new->idVendor;
2120         idProduct = new->idProduct;
2121         bcdDevice = new->bcdDevice;
2122         iSerialNumber = new->iSerialNumber;
2123         iManufacturer = new->iManufacturer;
2124         iProduct = new->iProduct;
2125
2126         *new = *old;
2127         if (idVendor)
2128                 new->idVendor = idVendor;
2129         if (idProduct)
2130                 new->idProduct = idProduct;
2131         if (bcdDevice)
2132                 new->bcdDevice = bcdDevice;
2133         else
2134                 new->bcdDevice = cpu_to_le16(get_default_bcdDevice());
2135         if (iSerialNumber)
2136                 new->iSerialNumber = iSerialNumber;
2137         if (iManufacturer)
2138                 new->iManufacturer = iManufacturer;
2139         if (iProduct)
2140                 new->iProduct = iProduct;
2141 }
2142
2143 int composite_dev_prepare(struct usb_composite_driver *composite,
2144                 struct usb_composite_dev *cdev)
2145 {
2146         struct usb_gadget *gadget = cdev->gadget;
2147         int ret = -ENOMEM;
2148
2149         /* preallocate control response and buffer */
2150         cdev->req = usb_ep_alloc_request(gadget->ep0, GFP_KERNEL);
2151         if (!cdev->req)
2152                 return -ENOMEM;
2153
2154         cdev->req->buf = kmalloc(USB_COMP_EP0_BUFSIZ, GFP_KERNEL);
2155         if (!cdev->req->buf)
2156                 goto fail;
2157
2158         ret = device_create_file(&gadget->dev, &dev_attr_suspended);
2159         if (ret)
2160                 goto fail_dev;
2161
2162         cdev->req->complete = composite_setup_complete;
2163         cdev->req->context = cdev;
2164         gadget->ep0->driver_data = cdev;
2165
2166         cdev->driver = composite;
2167
2168         /*
2169          * As per USB compliance update, a device that is actively drawing
2170          * more than 100mA from USB must report itself as bus-powered in
2171          * the GetStatus(DEVICE) call.
2172          */
2173         if (CONFIG_USB_GADGET_VBUS_DRAW <= USB_SELF_POWER_VBUS_MAX_DRAW)
2174                 usb_gadget_set_selfpowered(gadget);
2175
2176         /* interface and string IDs start at zero via kzalloc.
2177          * we force endpoints to start unassigned; few controller
2178          * drivers will zero ep->driver_data.
2179          */
2180         usb_ep_autoconfig_reset(gadget);
2181         return 0;
2182 fail_dev:
2183         kfree(cdev->req->buf);
2184 fail:
2185         usb_ep_free_request(gadget->ep0, cdev->req);
2186         cdev->req = NULL;
2187         return ret;
2188 }
2189
2190 int composite_os_desc_req_prepare(struct usb_composite_dev *cdev,
2191                                   struct usb_ep *ep0)
2192 {
2193         int ret = 0;
2194
2195         cdev->os_desc_req = usb_ep_alloc_request(ep0, GFP_KERNEL);
2196         if (!cdev->os_desc_req) {
2197                 ret = -ENOMEM;
2198                 goto end;
2199         }
2200
2201         cdev->os_desc_req->buf = kmalloc(USB_COMP_EP0_OS_DESC_BUFSIZ,
2202                                          GFP_KERNEL);
2203         if (!cdev->os_desc_req->buf) {
2204                 ret = -ENOMEM;
2205                 usb_ep_free_request(ep0, cdev->os_desc_req);
2206                 goto end;
2207         }
2208         cdev->os_desc_req->context = cdev;
2209         cdev->os_desc_req->complete = composite_setup_complete;
2210 end:
2211         return ret;
2212 }
2213
2214 void composite_dev_cleanup(struct usb_composite_dev *cdev)
2215 {
2216         struct usb_gadget_string_container *uc, *tmp;
2217         struct usb_ep                      *ep, *tmp_ep;
2218
2219         list_for_each_entry_safe(uc, tmp, &cdev->gstrings, list) {
2220                 list_del(&uc->list);
2221                 kfree(uc);
2222         }
2223         if (cdev->os_desc_req) {
2224                 if (cdev->os_desc_pending)
2225                         usb_ep_dequeue(cdev->gadget->ep0, cdev->os_desc_req);
2226
2227                 kfree(cdev->os_desc_req->buf);
2228                 cdev->os_desc_req->buf = NULL;
2229                 usb_ep_free_request(cdev->gadget->ep0, cdev->os_desc_req);
2230                 cdev->os_desc_req = NULL;
2231         }
2232         if (cdev->req) {
2233                 if (cdev->setup_pending)
2234                         usb_ep_dequeue(cdev->gadget->ep0, cdev->req);
2235
2236                 kfree(cdev->req->buf);
2237                 cdev->req->buf = NULL;
2238                 usb_ep_free_request(cdev->gadget->ep0, cdev->req);
2239                 cdev->req = NULL;
2240         }
2241         cdev->next_string_id = 0;
2242         device_remove_file(&cdev->gadget->dev, &dev_attr_suspended);
2243
2244         /*
2245          * Some UDC backends have a dynamic EP allocation scheme.
2246          *
2247          * In that case, the dispose() callback is used to notify the
2248          * backend that the EPs are no longer in use.
2249          *
2250          * Note: The UDC backend can remove the EP from the ep_list as
2251          *       a result, so we need to use the _safe list iterator.
2252          */
2253         list_for_each_entry_safe(ep, tmp_ep,
2254                                  &cdev->gadget->ep_list, ep_list) {
2255                 if (ep->ops->dispose)
2256                         ep->ops->dispose(ep);
2257         }
2258 }
2259
2260 static int composite_bind(struct usb_gadget *gadget,
2261                 struct usb_gadget_driver *gdriver)
2262 {
2263         struct usb_composite_dev        *cdev;
2264         struct usb_composite_driver     *composite = to_cdriver(gdriver);
2265         int                             status = -ENOMEM;
2266
2267         cdev = kzalloc(sizeof *cdev, GFP_KERNEL);
2268         if (!cdev)
2269                 return status;
2270
2271         spin_lock_init(&cdev->lock);
2272         cdev->gadget = gadget;
2273         set_gadget_data(gadget, cdev);
2274         INIT_LIST_HEAD(&cdev->configs);
2275         INIT_LIST_HEAD(&cdev->gstrings);
2276
2277         status = composite_dev_prepare(composite, cdev);
2278         if (status)
2279                 goto fail;
2280
2281         /* composite gadget needs to assign strings for whole device (like
2282          * serial number), register function drivers, potentially update
2283          * power state and consumption, etc
2284          */
2285         status = composite->bind(cdev);
2286         if (status < 0)
2287                 goto fail;
2288
2289         if (cdev->use_os_string) {
2290                 status = composite_os_desc_req_prepare(cdev, gadget->ep0);
2291                 if (status)
2292                         goto fail;
2293         }
2294
2295         update_unchanged_dev_desc(&cdev->desc, composite->dev);
2296
2297         /* has userspace failed to provide a serial number? */
2298         if (composite->needs_serial && !cdev->desc.iSerialNumber)
2299                 WARNING(cdev, "userspace failed to provide iSerialNumber\n");
2300
2301         INFO(cdev, "%s ready\n", composite->name);
2302         return 0;
2303
2304 fail:
2305         __composite_unbind(gadget, false);
2306         return status;
2307 }
2308
2309 /*-------------------------------------------------------------------------*/
2310
2311 void composite_suspend(struct usb_gadget *gadget)
2312 {
2313         struct usb_composite_dev        *cdev = get_gadget_data(gadget);
2314         struct usb_function             *f;
2315
2316         /* REVISIT:  should we have config level
2317          * suspend/resume callbacks?
2318          */
2319         DBG(cdev, "suspend\n");
2320         if (cdev->config) {
2321                 list_for_each_entry(f, &cdev->config->functions, list) {
2322                         if (f->suspend)
2323                                 f->suspend(f);
2324                 }
2325         }
2326         if (cdev->driver->suspend)
2327                 cdev->driver->suspend(cdev);
2328
2329         cdev->suspended = 1;
2330
2331         usb_gadget_set_selfpowered(gadget);
2332         usb_gadget_vbus_draw(gadget, 2);
2333 }
2334
2335 void composite_resume(struct usb_gadget *gadget)
2336 {
2337         struct usb_composite_dev        *cdev = get_gadget_data(gadget);
2338         struct usb_function             *f;
2339         unsigned                        maxpower;
2340
2341         /* REVISIT:  should we have config level
2342          * suspend/resume callbacks?
2343          */
2344         DBG(cdev, "resume\n");
2345         if (cdev->driver->resume)
2346                 cdev->driver->resume(cdev);
2347         if (cdev->config) {
2348                 list_for_each_entry(f, &cdev->config->functions, list) {
2349                         if (f->resume)
2350                                 f->resume(f);
2351                 }
2352
2353                 maxpower = cdev->config->MaxPower ?
2354                         cdev->config->MaxPower : CONFIG_USB_GADGET_VBUS_DRAW;
2355                 if (gadget->speed < USB_SPEED_SUPER)
2356                         maxpower = min(maxpower, 500U);
2357                 else
2358                         maxpower = min(maxpower, 900U);
2359
2360                 if (maxpower > USB_SELF_POWER_VBUS_MAX_DRAW)
2361                         usb_gadget_clear_selfpowered(gadget);
2362
2363                 usb_gadget_vbus_draw(gadget, maxpower);
2364         }
2365
2366         cdev->suspended = 0;
2367 }
2368
2369 /*-------------------------------------------------------------------------*/
2370
2371 static const struct usb_gadget_driver composite_driver_template = {
2372         .bind           = composite_bind,
2373         .unbind         = composite_unbind,
2374
2375         .setup          = composite_setup,
2376         .reset          = composite_disconnect,
2377         .disconnect     = composite_disconnect,
2378
2379         .suspend        = composite_suspend,
2380         .resume         = composite_resume,
2381
2382         .driver = {
2383                 .owner          = THIS_MODULE,
2384         },
2385 };
2386
2387 /**
2388  * usb_composite_probe() - register a composite driver
2389  * @driver: the driver to register
2390  *
2391  * Context: single threaded during gadget setup
2392  *
2393  * This function is used to register drivers using the composite driver
2394  * framework.  The return value is zero, or a negative errno value.
2395  * Those values normally come from the driver's @bind method, which does
2396  * all the work of setting up the driver to match the hardware.
2397  *
2398  * On successful return, the gadget is ready to respond to requests from
2399  * the host, unless one of its components invokes usb_gadget_disconnect()
2400  * while it was binding.  That would usually be done in order to wait for
2401  * some userspace participation.
2402  */
2403 int usb_composite_probe(struct usb_composite_driver *driver)
2404 {
2405         struct usb_gadget_driver *gadget_driver;
2406
2407         if (!driver || !driver->dev || !driver->bind)
2408                 return -EINVAL;
2409
2410         if (!driver->name)
2411                 driver->name = "composite";
2412
2413         driver->gadget_driver = composite_driver_template;
2414         gadget_driver = &driver->gadget_driver;
2415
2416         gadget_driver->function =  (char *) driver->name;
2417         gadget_driver->driver.name = driver->name;
2418         gadget_driver->max_speed = driver->max_speed;
2419
2420         return usb_gadget_probe_driver(gadget_driver);
2421 }
2422 EXPORT_SYMBOL_GPL(usb_composite_probe);
2423
2424 /**
2425  * usb_composite_unregister() - unregister a composite driver
2426  * @driver: the driver to unregister
2427  *
2428  * This function is used to unregister drivers using the composite
2429  * driver framework.
2430  */
2431 void usb_composite_unregister(struct usb_composite_driver *driver)
2432 {
2433         usb_gadget_unregister_driver(&driver->gadget_driver);
2434 }
2435 EXPORT_SYMBOL_GPL(usb_composite_unregister);
2436
2437 /**
2438  * usb_composite_setup_continue() - Continue with the control transfer
2439  * @cdev: the composite device who's control transfer was kept waiting
2440  *
2441  * This function must be called by the USB function driver to continue
2442  * with the control transfer's data/status stage in case it had requested to
2443  * delay the data/status stages. A USB function's setup handler (e.g. set_alt())
2444  * can request the composite framework to delay the setup request's data/status
2445  * stages by returning USB_GADGET_DELAYED_STATUS.
2446  */
2447 void usb_composite_setup_continue(struct usb_composite_dev *cdev)
2448 {
2449         int                     value;
2450         struct usb_request      *req = cdev->req;
2451         unsigned long           flags;
2452
2453         DBG(cdev, "%s\n", __func__);
2454         spin_lock_irqsave(&cdev->lock, flags);
2455
2456         if (cdev->delayed_status == 0) {
2457                 WARN(cdev, "%s: Unexpected call\n", __func__);
2458
2459         } else if (--cdev->delayed_status == 0) {
2460                 DBG(cdev, "%s: Completing delayed status\n", __func__);
2461                 req->length = 0;
2462                 req->context = cdev;
2463                 value = composite_ep0_queue(cdev, req, GFP_ATOMIC);
2464                 if (value < 0) {
2465                         DBG(cdev, "ep_queue --> %d\n", value);
2466                         req->status = 0;
2467                         composite_setup_complete(cdev->gadget->ep0, req);
2468                 }
2469         }
2470
2471         spin_unlock_irqrestore(&cdev->lock, flags);
2472 }
2473 EXPORT_SYMBOL_GPL(usb_composite_setup_continue);
2474
2475 static char *composite_default_mfr(struct usb_gadget *gadget)
2476 {
2477         return kasprintf(GFP_KERNEL, "%s %s with %s", init_utsname()->sysname,
2478                          init_utsname()->release, gadget->name);
2479 }
2480
2481 void usb_composite_overwrite_options(struct usb_composite_dev *cdev,
2482                 struct usb_composite_overwrite *covr)
2483 {
2484         struct usb_device_descriptor    *desc = &cdev->desc;
2485         struct usb_gadget_strings       *gstr = cdev->driver->strings[0];
2486         struct usb_string               *dev_str = gstr->strings;
2487
2488         if (covr->idVendor)
2489                 desc->idVendor = cpu_to_le16(covr->idVendor);
2490
2491         if (covr->idProduct)
2492                 desc->idProduct = cpu_to_le16(covr->idProduct);
2493
2494         if (covr->bcdDevice)
2495                 desc->bcdDevice = cpu_to_le16(covr->bcdDevice);
2496
2497         if (covr->serial_number) {
2498                 desc->iSerialNumber = dev_str[USB_GADGET_SERIAL_IDX].id;
2499                 dev_str[USB_GADGET_SERIAL_IDX].s = covr->serial_number;
2500         }
2501         if (covr->manufacturer) {
2502                 desc->iManufacturer = dev_str[USB_GADGET_MANUFACTURER_IDX].id;
2503                 dev_str[USB_GADGET_MANUFACTURER_IDX].s = covr->manufacturer;
2504
2505         } else if (!strlen(dev_str[USB_GADGET_MANUFACTURER_IDX].s)) {
2506                 desc->iManufacturer = dev_str[USB_GADGET_MANUFACTURER_IDX].id;
2507                 cdev->def_manufacturer = composite_default_mfr(cdev->gadget);
2508                 dev_str[USB_GADGET_MANUFACTURER_IDX].s = cdev->def_manufacturer;
2509         }
2510
2511         if (covr->product) {
2512                 desc->iProduct = dev_str[USB_GADGET_PRODUCT_IDX].id;
2513                 dev_str[USB_GADGET_PRODUCT_IDX].s = covr->product;
2514         }
2515 }
2516 EXPORT_SYMBOL_GPL(usb_composite_overwrite_options);
2517
2518 MODULE_LICENSE("GPL");
2519 MODULE_AUTHOR("David Brownell");