Back to home page

OSCL-LXR

 
 

    


0001 // SPDX-License-Identifier: GPL-2.0+
0002 /*
0003  * composite.c - infrastructure for Composite USB Gadgets
0004  *
0005  * Copyright (C) 2006-2008 David Brownell
0006  */
0007 
0008 /* #define VERBOSE_DEBUG */
0009 
0010 #include <linux/kallsyms.h>
0011 #include <linux/kernel.h>
0012 #include <linux/slab.h>
0013 #include <linux/module.h>
0014 #include <linux/device.h>
0015 #include <linux/utsname.h>
0016 #include <linux/bitfield.h>
0017 
0018 #include <linux/usb/composite.h>
0019 #include <linux/usb/otg.h>
0020 #include <asm/unaligned.h>
0021 
0022 #include "u_os_desc.h"
0023 
0024 /**
0025  * struct usb_os_string - represents OS String to be reported by a gadget
0026  * @bLength: total length of the entire descritor, always 0x12
0027  * @bDescriptorType: USB_DT_STRING
0028  * @qwSignature: the OS String proper
0029  * @bMS_VendorCode: code used by the host for subsequent requests
0030  * @bPad: not used, must be zero
0031  */
0032 struct usb_os_string {
0033     __u8    bLength;
0034     __u8    bDescriptorType;
0035     __u8    qwSignature[OS_STRING_QW_SIGN_LEN];
0036     __u8    bMS_VendorCode;
0037     __u8    bPad;
0038 } __packed;
0039 
0040 /*
0041  * The code in this file is utility code, used to build a gadget driver
0042  * from one or more "function" drivers, one or more "configuration"
0043  * objects, and a "usb_composite_driver" by gluing them together along
0044  * with the relevant device-wide data.
0045  */
0046 
0047 static struct usb_gadget_strings **get_containers_gs(
0048         struct usb_gadget_string_container *uc)
0049 {
0050     return (struct usb_gadget_strings **)uc->stash;
0051 }
0052 
0053 /**
0054  * function_descriptors() - get function descriptors for speed
0055  * @f: the function
0056  * @speed: the speed
0057  *
0058  * Returns the descriptors or NULL if not set.
0059  */
0060 static struct usb_descriptor_header **
0061 function_descriptors(struct usb_function *f,
0062              enum usb_device_speed speed)
0063 {
0064     struct usb_descriptor_header **descriptors;
0065 
0066     /*
0067      * NOTE: we try to help gadget drivers which might not be setting
0068      * max_speed appropriately.
0069      */
0070 
0071     switch (speed) {
0072     case USB_SPEED_SUPER_PLUS:
0073         descriptors = f->ssp_descriptors;
0074         if (descriptors)
0075             break;
0076         fallthrough;
0077     case USB_SPEED_SUPER:
0078         descriptors = f->ss_descriptors;
0079         if (descriptors)
0080             break;
0081         fallthrough;
0082     case USB_SPEED_HIGH:
0083         descriptors = f->hs_descriptors;
0084         if (descriptors)
0085             break;
0086         fallthrough;
0087     default:
0088         descriptors = f->fs_descriptors;
0089     }
0090 
0091     /*
0092      * if we can't find any descriptors at all, then this gadget deserves to
0093      * Oops with a NULL pointer dereference
0094      */
0095 
0096     return descriptors;
0097 }
0098 
0099 /**
0100  * next_desc() - advance to the next desc_type descriptor
0101  * @t: currect pointer within descriptor array
0102  * @desc_type: descriptor type
0103  *
0104  * Return: next desc_type descriptor or NULL
0105  *
0106  * Iterate over @t until either desc_type descriptor found or
0107  * NULL (that indicates end of list) encountered
0108  */
0109 static struct usb_descriptor_header**
0110 next_desc(struct usb_descriptor_header **t, u8 desc_type)
0111 {
0112     for (; *t; t++) {
0113         if ((*t)->bDescriptorType == desc_type)
0114             return t;
0115     }
0116     return NULL;
0117 }
0118 
0119 /*
0120  * for_each_desc() - iterate over desc_type descriptors in the
0121  * descriptors list
0122  * @start: pointer within descriptor array.
0123  * @iter_desc: desc_type descriptor to use as the loop cursor
0124  * @desc_type: wanted descriptr type
0125  */
0126 #define for_each_desc(start, iter_desc, desc_type) \
0127     for (iter_desc = next_desc(start, desc_type); \
0128          iter_desc; iter_desc = next_desc(iter_desc + 1, desc_type))
0129 
0130 /**
0131  * config_ep_by_speed_and_alt() - configures the given endpoint
0132  * according to gadget speed.
0133  * @g: pointer to the gadget
0134  * @f: usb function
0135  * @_ep: the endpoint to configure
0136  * @alt: alternate setting number
0137  *
0138  * Return: error code, 0 on success
0139  *
0140  * This function chooses the right descriptors for a given
0141  * endpoint according to gadget speed and saves it in the
0142  * endpoint desc field. If the endpoint already has a descriptor
0143  * assigned to it - overwrites it with currently corresponding
0144  * descriptor. The endpoint maxpacket field is updated according
0145  * to the chosen descriptor.
0146  * Note: the supplied function should hold all the descriptors
0147  * for supported speeds
0148  */
0149 int config_ep_by_speed_and_alt(struct usb_gadget *g,
0150                 struct usb_function *f,
0151                 struct usb_ep *_ep,
0152                 u8 alt)
0153 {
0154     struct usb_endpoint_descriptor *chosen_desc = NULL;
0155     struct usb_interface_descriptor *int_desc = NULL;
0156     struct usb_descriptor_header **speed_desc = NULL;
0157 
0158     struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
0159     int want_comp_desc = 0;
0160 
0161     struct usb_descriptor_header **d_spd; /* cursor for speed desc */
0162     struct usb_composite_dev *cdev;
0163     bool incomplete_desc = false;
0164 
0165     if (!g || !f || !_ep)
0166         return -EIO;
0167 
0168     /* select desired speed */
0169     switch (g->speed) {
0170     case USB_SPEED_SUPER_PLUS:
0171         if (gadget_is_superspeed_plus(g)) {
0172             if (f->ssp_descriptors) {
0173                 speed_desc = f->ssp_descriptors;
0174                 want_comp_desc = 1;
0175                 break;
0176             }
0177             incomplete_desc = true;
0178         }
0179         fallthrough;
0180     case USB_SPEED_SUPER:
0181         if (gadget_is_superspeed(g)) {
0182             if (f->ss_descriptors) {
0183                 speed_desc = f->ss_descriptors;
0184                 want_comp_desc = 1;
0185                 break;
0186             }
0187             incomplete_desc = true;
0188         }
0189         fallthrough;
0190     case USB_SPEED_HIGH:
0191         if (gadget_is_dualspeed(g)) {
0192             if (f->hs_descriptors) {
0193                 speed_desc = f->hs_descriptors;
0194                 break;
0195             }
0196             incomplete_desc = true;
0197         }
0198         fallthrough;
0199     default:
0200         speed_desc = f->fs_descriptors;
0201     }
0202 
0203     cdev = get_gadget_data(g);
0204     if (incomplete_desc)
0205         WARNING(cdev,
0206             "%s doesn't hold the descriptors for current speed\n",
0207             f->name);
0208 
0209     /* find correct alternate setting descriptor */
0210     for_each_desc(speed_desc, d_spd, USB_DT_INTERFACE) {
0211         int_desc = (struct usb_interface_descriptor *)*d_spd;
0212 
0213         if (int_desc->bAlternateSetting == alt) {
0214             speed_desc = d_spd;
0215             goto intf_found;
0216         }
0217     }
0218     return -EIO;
0219 
0220 intf_found:
0221     /* find descriptors */
0222     for_each_desc(speed_desc, d_spd, USB_DT_ENDPOINT) {
0223         chosen_desc = (struct usb_endpoint_descriptor *)*d_spd;
0224         if (chosen_desc->bEndpointAddress == _ep->address)
0225             goto ep_found;
0226     }
0227     return -EIO;
0228 
0229 ep_found:
0230     /* commit results */
0231     _ep->maxpacket = usb_endpoint_maxp(chosen_desc);
0232     _ep->desc = chosen_desc;
0233     _ep->comp_desc = NULL;
0234     _ep->maxburst = 0;
0235     _ep->mult = 1;
0236 
0237     if (g->speed == USB_SPEED_HIGH && (usb_endpoint_xfer_isoc(_ep->desc) ||
0238                 usb_endpoint_xfer_int(_ep->desc)))
0239         _ep->mult = usb_endpoint_maxp_mult(_ep->desc);
0240 
0241     if (!want_comp_desc)
0242         return 0;
0243 
0244     /*
0245      * Companion descriptor should follow EP descriptor
0246      * USB 3.0 spec, #9.6.7
0247      */
0248     comp_desc = (struct usb_ss_ep_comp_descriptor *)*(++d_spd);
0249     if (!comp_desc ||
0250         (comp_desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP))
0251         return -EIO;
0252     _ep->comp_desc = comp_desc;
0253     if (g->speed >= USB_SPEED_SUPER) {
0254         switch (usb_endpoint_type(_ep->desc)) {
0255         case USB_ENDPOINT_XFER_ISOC:
0256             /* mult: bits 1:0 of bmAttributes */
0257             _ep->mult = (comp_desc->bmAttributes & 0x3) + 1;
0258             fallthrough;
0259         case USB_ENDPOINT_XFER_BULK:
0260         case USB_ENDPOINT_XFER_INT:
0261             _ep->maxburst = comp_desc->bMaxBurst + 1;
0262             break;
0263         default:
0264             if (comp_desc->bMaxBurst != 0)
0265                 ERROR(cdev, "ep0 bMaxBurst must be 0\n");
0266             _ep->maxburst = 1;
0267             break;
0268         }
0269     }
0270     return 0;
0271 }
0272 EXPORT_SYMBOL_GPL(config_ep_by_speed_and_alt);
0273 
0274 /**
0275  * config_ep_by_speed() - configures the given endpoint
0276  * according to gadget speed.
0277  * @g: pointer to the gadget
0278  * @f: usb function
0279  * @_ep: the endpoint to configure
0280  *
0281  * Return: error code, 0 on success
0282  *
0283  * This function chooses the right descriptors for a given
0284  * endpoint according to gadget speed and saves it in the
0285  * endpoint desc field. If the endpoint already has a descriptor
0286  * assigned to it - overwrites it with currently corresponding
0287  * descriptor. The endpoint maxpacket field is updated according
0288  * to the chosen descriptor.
0289  * Note: the supplied function should hold all the descriptors
0290  * for supported speeds
0291  */
0292 int config_ep_by_speed(struct usb_gadget *g,
0293             struct usb_function *f,
0294             struct usb_ep *_ep)
0295 {
0296     return config_ep_by_speed_and_alt(g, f, _ep, 0);
0297 }
0298 EXPORT_SYMBOL_GPL(config_ep_by_speed);
0299 
0300 /**
0301  * usb_add_function() - add a function to a configuration
0302  * @config: the configuration
0303  * @function: the function being added
0304  * Context: single threaded during gadget setup
0305  *
0306  * After initialization, each configuration must have one or more
0307  * functions added to it.  Adding a function involves calling its @bind()
0308  * method to allocate resources such as interface and string identifiers
0309  * and endpoints.
0310  *
0311  * This function returns the value of the function's bind(), which is
0312  * zero for success else a negative errno value.
0313  */
0314 int usb_add_function(struct usb_configuration *config,
0315         struct usb_function *function)
0316 {
0317     int value = -EINVAL;
0318 
0319     DBG(config->cdev, "adding '%s'/%p to config '%s'/%p\n",
0320             function->name, function,
0321             config->label, config);
0322 
0323     if (!function->set_alt || !function->disable)
0324         goto done;
0325 
0326     function->config = config;
0327     list_add_tail(&function->list, &config->functions);
0328 
0329     if (function->bind_deactivated) {
0330         value = usb_function_deactivate(function);
0331         if (value)
0332             goto done;
0333     }
0334 
0335     /* REVISIT *require* function->bind? */
0336     if (function->bind) {
0337         value = function->bind(config, function);
0338         if (value < 0) {
0339             list_del(&function->list);
0340             function->config = NULL;
0341         }
0342     } else
0343         value = 0;
0344 
0345     /* We allow configurations that don't work at both speeds.
0346      * If we run into a lowspeed Linux system, treat it the same
0347      * as full speed ... it's the function drivers that will need
0348      * to avoid bulk and ISO transfers.
0349      */
0350     if (!config->fullspeed && function->fs_descriptors)
0351         config->fullspeed = true;
0352     if (!config->highspeed && function->hs_descriptors)
0353         config->highspeed = true;
0354     if (!config->superspeed && function->ss_descriptors)
0355         config->superspeed = true;
0356     if (!config->superspeed_plus && function->ssp_descriptors)
0357         config->superspeed_plus = true;
0358 
0359 done:
0360     if (value)
0361         DBG(config->cdev, "adding '%s'/%p --> %d\n",
0362                 function->name, function, value);
0363     return value;
0364 }
0365 EXPORT_SYMBOL_GPL(usb_add_function);
0366 
0367 void usb_remove_function(struct usb_configuration *c, struct usb_function *f)
0368 {
0369     if (f->disable)
0370         f->disable(f);
0371 
0372     bitmap_zero(f->endpoints, 32);
0373     list_del(&f->list);
0374     if (f->unbind)
0375         f->unbind(c, f);
0376 
0377     if (f->bind_deactivated)
0378         usb_function_activate(f);
0379 }
0380 EXPORT_SYMBOL_GPL(usb_remove_function);
0381 
0382 /**
0383  * usb_function_deactivate - prevent function and gadget enumeration
0384  * @function: the function that isn't yet ready to respond
0385  *
0386  * Blocks response of the gadget driver to host enumeration by
0387  * preventing the data line pullup from being activated.  This is
0388  * normally called during @bind() processing to change from the
0389  * initial "ready to respond" state, or when a required resource
0390  * becomes available.
0391  *
0392  * For example, drivers that serve as a passthrough to a userspace
0393  * daemon can block enumeration unless that daemon (such as an OBEX,
0394  * MTP, or print server) is ready to handle host requests.
0395  *
0396  * Not all systems support software control of their USB peripheral
0397  * data pullups.
0398  *
0399  * Returns zero on success, else negative errno.
0400  */
0401 int usb_function_deactivate(struct usb_function *function)
0402 {
0403     struct usb_composite_dev    *cdev = function->config->cdev;
0404     unsigned long           flags;
0405     int             status = 0;
0406 
0407     spin_lock_irqsave(&cdev->lock, flags);
0408 
0409     if (cdev->deactivations == 0) {
0410         spin_unlock_irqrestore(&cdev->lock, flags);
0411         status = usb_gadget_deactivate(cdev->gadget);
0412         spin_lock_irqsave(&cdev->lock, flags);
0413     }
0414     if (status == 0)
0415         cdev->deactivations++;
0416 
0417     spin_unlock_irqrestore(&cdev->lock, flags);
0418     return status;
0419 }
0420 EXPORT_SYMBOL_GPL(usb_function_deactivate);
0421 
0422 /**
0423  * usb_function_activate - allow function and gadget enumeration
0424  * @function: function on which usb_function_activate() was called
0425  *
0426  * Reverses effect of usb_function_deactivate().  If no more functions
0427  * are delaying their activation, the gadget driver will respond to
0428  * host enumeration procedures.
0429  *
0430  * Returns zero on success, else negative errno.
0431  */
0432 int usb_function_activate(struct usb_function *function)
0433 {
0434     struct usb_composite_dev    *cdev = function->config->cdev;
0435     unsigned long           flags;
0436     int             status = 0;
0437 
0438     spin_lock_irqsave(&cdev->lock, flags);
0439 
0440     if (WARN_ON(cdev->deactivations == 0))
0441         status = -EINVAL;
0442     else {
0443         cdev->deactivations--;
0444         if (cdev->deactivations == 0) {
0445             spin_unlock_irqrestore(&cdev->lock, flags);
0446             status = usb_gadget_activate(cdev->gadget);
0447             spin_lock_irqsave(&cdev->lock, flags);
0448         }
0449     }
0450 
0451     spin_unlock_irqrestore(&cdev->lock, flags);
0452     return status;
0453 }
0454 EXPORT_SYMBOL_GPL(usb_function_activate);
0455 
0456 /**
0457  * usb_interface_id() - allocate an unused interface ID
0458  * @config: configuration associated with the interface
0459  * @function: function handling the interface
0460  * Context: single threaded during gadget setup
0461  *
0462  * usb_interface_id() is called from usb_function.bind() callbacks to
0463  * allocate new interface IDs.  The function driver will then store that
0464  * ID in interface, association, CDC union, and other descriptors.  It
0465  * will also handle any control requests targeted at that interface,
0466  * particularly changing its altsetting via set_alt().  There may
0467  * also be class-specific or vendor-specific requests to handle.
0468  *
0469  * All interface identifier should be allocated using this routine, to
0470  * ensure that for example different functions don't wrongly assign
0471  * different meanings to the same identifier.  Note that since interface
0472  * identifiers are configuration-specific, functions used in more than
0473  * one configuration (or more than once in a given configuration) need
0474  * multiple versions of the relevant descriptors.
0475  *
0476  * Returns the interface ID which was allocated; or -ENODEV if no
0477  * more interface IDs can be allocated.
0478  */
0479 int usb_interface_id(struct usb_configuration *config,
0480         struct usb_function *function)
0481 {
0482     unsigned id = config->next_interface_id;
0483 
0484     if (id < MAX_CONFIG_INTERFACES) {
0485         config->interface[id] = function;
0486         config->next_interface_id = id + 1;
0487         return id;
0488     }
0489     return -ENODEV;
0490 }
0491 EXPORT_SYMBOL_GPL(usb_interface_id);
0492 
0493 static u8 encode_bMaxPower(enum usb_device_speed speed,
0494         struct usb_configuration *c)
0495 {
0496     unsigned val;
0497 
0498     if (c->MaxPower || (c->bmAttributes & USB_CONFIG_ATT_SELFPOWER))
0499         val = c->MaxPower;
0500     else
0501         val = CONFIG_USB_GADGET_VBUS_DRAW;
0502     if (!val)
0503         return 0;
0504     if (speed < USB_SPEED_SUPER)
0505         return min(val, 500U) / 2;
0506     else
0507         /*
0508          * USB 3.x supports up to 900mA, but since 900 isn't divisible
0509          * by 8 the integral division will effectively cap to 896mA.
0510          */
0511         return min(val, 900U) / 8;
0512 }
0513 
0514 static int config_buf(struct usb_configuration *config,
0515         enum usb_device_speed speed, void *buf, u8 type)
0516 {
0517     struct usb_config_descriptor    *c = buf;
0518     void                *next = buf + USB_DT_CONFIG_SIZE;
0519     int             len;
0520     struct usb_function     *f;
0521     int             status;
0522 
0523     len = USB_COMP_EP0_BUFSIZ - USB_DT_CONFIG_SIZE;
0524     /* write the config descriptor */
0525     c = buf;
0526     c->bLength = USB_DT_CONFIG_SIZE;
0527     c->bDescriptorType = type;
0528     /* wTotalLength is written later */
0529     c->bNumInterfaces = config->next_interface_id;
0530     c->bConfigurationValue = config->bConfigurationValue;
0531     c->iConfiguration = config->iConfiguration;
0532     c->bmAttributes = USB_CONFIG_ATT_ONE | config->bmAttributes;
0533     c->bMaxPower = encode_bMaxPower(speed, config);
0534 
0535     /* There may be e.g. OTG descriptors */
0536     if (config->descriptors) {
0537         status = usb_descriptor_fillbuf(next, len,
0538                 config->descriptors);
0539         if (status < 0)
0540             return status;
0541         len -= status;
0542         next += status;
0543     }
0544 
0545     /* add each function's descriptors */
0546     list_for_each_entry(f, &config->functions, list) {
0547         struct usb_descriptor_header **descriptors;
0548 
0549         descriptors = function_descriptors(f, speed);
0550         if (!descriptors)
0551             continue;
0552         status = usb_descriptor_fillbuf(next, len,
0553             (const struct usb_descriptor_header **) descriptors);
0554         if (status < 0)
0555             return status;
0556         len -= status;
0557         next += status;
0558     }
0559 
0560     len = next - buf;
0561     c->wTotalLength = cpu_to_le16(len);
0562     return len;
0563 }
0564 
0565 static int config_desc(struct usb_composite_dev *cdev, unsigned w_value)
0566 {
0567     struct usb_gadget       *gadget = cdev->gadget;
0568     struct usb_configuration    *c;
0569     struct list_head        *pos;
0570     u8              type = w_value >> 8;
0571     enum usb_device_speed       speed = USB_SPEED_UNKNOWN;
0572 
0573     if (gadget->speed >= USB_SPEED_SUPER)
0574         speed = gadget->speed;
0575     else if (gadget_is_dualspeed(gadget)) {
0576         int hs = 0;
0577         if (gadget->speed == USB_SPEED_HIGH)
0578             hs = 1;
0579         if (type == USB_DT_OTHER_SPEED_CONFIG)
0580             hs = !hs;
0581         if (hs)
0582             speed = USB_SPEED_HIGH;
0583 
0584     }
0585 
0586     /* This is a lookup by config *INDEX* */
0587     w_value &= 0xff;
0588 
0589     pos = &cdev->configs;
0590     c = cdev->os_desc_config;
0591     if (c)
0592         goto check_config;
0593 
0594     while ((pos = pos->next) !=  &cdev->configs) {
0595         c = list_entry(pos, typeof(*c), list);
0596 
0597         /* skip OS Descriptors config which is handled separately */
0598         if (c == cdev->os_desc_config)
0599             continue;
0600 
0601 check_config:
0602         /* ignore configs that won't work at this speed */
0603         switch (speed) {
0604         case USB_SPEED_SUPER_PLUS:
0605             if (!c->superspeed_plus)
0606                 continue;
0607             break;
0608         case USB_SPEED_SUPER:
0609             if (!c->superspeed)
0610                 continue;
0611             break;
0612         case USB_SPEED_HIGH:
0613             if (!c->highspeed)
0614                 continue;
0615             break;
0616         default:
0617             if (!c->fullspeed)
0618                 continue;
0619         }
0620 
0621         if (w_value == 0)
0622             return config_buf(c, speed, cdev->req->buf, type);
0623         w_value--;
0624     }
0625     return -EINVAL;
0626 }
0627 
0628 static int count_configs(struct usb_composite_dev *cdev, unsigned type)
0629 {
0630     struct usb_gadget       *gadget = cdev->gadget;
0631     struct usb_configuration    *c;
0632     unsigned            count = 0;
0633     int             hs = 0;
0634     int             ss = 0;
0635     int             ssp = 0;
0636 
0637     if (gadget_is_dualspeed(gadget)) {
0638         if (gadget->speed == USB_SPEED_HIGH)
0639             hs = 1;
0640         if (gadget->speed == USB_SPEED_SUPER)
0641             ss = 1;
0642         if (gadget->speed == USB_SPEED_SUPER_PLUS)
0643             ssp = 1;
0644         if (type == USB_DT_DEVICE_QUALIFIER)
0645             hs = !hs;
0646     }
0647     list_for_each_entry(c, &cdev->configs, list) {
0648         /* ignore configs that won't work at this speed */
0649         if (ssp) {
0650             if (!c->superspeed_plus)
0651                 continue;
0652         } else if (ss) {
0653             if (!c->superspeed)
0654                 continue;
0655         } else if (hs) {
0656             if (!c->highspeed)
0657                 continue;
0658         } else {
0659             if (!c->fullspeed)
0660                 continue;
0661         }
0662         count++;
0663     }
0664     return count;
0665 }
0666 
0667 /**
0668  * bos_desc() - prepares the BOS descriptor.
0669  * @cdev: pointer to usb_composite device to generate the bos
0670  *  descriptor for
0671  *
0672  * This function generates the BOS (Binary Device Object)
0673  * descriptor and its device capabilities descriptors. The BOS
0674  * descriptor should be supported by a SuperSpeed device.
0675  */
0676 static int bos_desc(struct usb_composite_dev *cdev)
0677 {
0678     struct usb_ext_cap_descriptor   *usb_ext;
0679     struct usb_dcd_config_params    dcd_config_params;
0680     struct usb_bos_descriptor   *bos = cdev->req->buf;
0681     unsigned int            besl = 0;
0682 
0683     bos->bLength = USB_DT_BOS_SIZE;
0684     bos->bDescriptorType = USB_DT_BOS;
0685 
0686     bos->wTotalLength = cpu_to_le16(USB_DT_BOS_SIZE);
0687     bos->bNumDeviceCaps = 0;
0688 
0689     /* Get Controller configuration */
0690     if (cdev->gadget->ops->get_config_params) {
0691         cdev->gadget->ops->get_config_params(cdev->gadget,
0692                              &dcd_config_params);
0693     } else {
0694         dcd_config_params.besl_baseline =
0695             USB_DEFAULT_BESL_UNSPECIFIED;
0696         dcd_config_params.besl_deep =
0697             USB_DEFAULT_BESL_UNSPECIFIED;
0698         dcd_config_params.bU1devExitLat =
0699             USB_DEFAULT_U1_DEV_EXIT_LAT;
0700         dcd_config_params.bU2DevExitLat =
0701             cpu_to_le16(USB_DEFAULT_U2_DEV_EXIT_LAT);
0702     }
0703 
0704     if (dcd_config_params.besl_baseline != USB_DEFAULT_BESL_UNSPECIFIED)
0705         besl = USB_BESL_BASELINE_VALID |
0706             USB_SET_BESL_BASELINE(dcd_config_params.besl_baseline);
0707 
0708     if (dcd_config_params.besl_deep != USB_DEFAULT_BESL_UNSPECIFIED)
0709         besl |= USB_BESL_DEEP_VALID |
0710             USB_SET_BESL_DEEP(dcd_config_params.besl_deep);
0711 
0712     /*
0713      * A SuperSpeed device shall include the USB2.0 extension descriptor
0714      * and shall support LPM when operating in USB2.0 HS mode.
0715      */
0716     usb_ext = cdev->req->buf + le16_to_cpu(bos->wTotalLength);
0717     bos->bNumDeviceCaps++;
0718     le16_add_cpu(&bos->wTotalLength, USB_DT_USB_EXT_CAP_SIZE);
0719     usb_ext->bLength = USB_DT_USB_EXT_CAP_SIZE;
0720     usb_ext->bDescriptorType = USB_DT_DEVICE_CAPABILITY;
0721     usb_ext->bDevCapabilityType = USB_CAP_TYPE_EXT;
0722     usb_ext->bmAttributes = cpu_to_le32(USB_LPM_SUPPORT |
0723                         USB_BESL_SUPPORT | besl);
0724 
0725     /*
0726      * The Superspeed USB Capability descriptor shall be implemented by all
0727      * SuperSpeed devices.
0728      */
0729     if (gadget_is_superspeed(cdev->gadget)) {
0730         struct usb_ss_cap_descriptor *ss_cap;
0731 
0732         ss_cap = cdev->req->buf + le16_to_cpu(bos->wTotalLength);
0733         bos->bNumDeviceCaps++;
0734         le16_add_cpu(&bos->wTotalLength, USB_DT_USB_SS_CAP_SIZE);
0735         ss_cap->bLength = USB_DT_USB_SS_CAP_SIZE;
0736         ss_cap->bDescriptorType = USB_DT_DEVICE_CAPABILITY;
0737         ss_cap->bDevCapabilityType = USB_SS_CAP_TYPE;
0738         ss_cap->bmAttributes = 0; /* LTM is not supported yet */
0739         ss_cap->wSpeedSupported = cpu_to_le16(USB_LOW_SPEED_OPERATION |
0740                               USB_FULL_SPEED_OPERATION |
0741                               USB_HIGH_SPEED_OPERATION |
0742                               USB_5GBPS_OPERATION);
0743         ss_cap->bFunctionalitySupport = USB_LOW_SPEED_OPERATION;
0744         ss_cap->bU1devExitLat = dcd_config_params.bU1devExitLat;
0745         ss_cap->bU2DevExitLat = dcd_config_params.bU2DevExitLat;
0746     }
0747 
0748     /* The SuperSpeedPlus USB Device Capability descriptor */
0749     if (gadget_is_superspeed_plus(cdev->gadget)) {
0750         struct usb_ssp_cap_descriptor *ssp_cap;
0751         u8 ssac = 1;
0752         u8 ssic;
0753         int i;
0754 
0755         if (cdev->gadget->max_ssp_rate == USB_SSP_GEN_2x2)
0756             ssac = 3;
0757 
0758         /*
0759          * Paired RX and TX sublink speed attributes share
0760          * the same SSID.
0761          */
0762         ssic = (ssac + 1) / 2 - 1;
0763 
0764         ssp_cap = cdev->req->buf + le16_to_cpu(bos->wTotalLength);
0765         bos->bNumDeviceCaps++;
0766 
0767         le16_add_cpu(&bos->wTotalLength, USB_DT_USB_SSP_CAP_SIZE(ssac));
0768         ssp_cap->bLength = USB_DT_USB_SSP_CAP_SIZE(ssac);
0769         ssp_cap->bDescriptorType = USB_DT_DEVICE_CAPABILITY;
0770         ssp_cap->bDevCapabilityType = USB_SSP_CAP_TYPE;
0771         ssp_cap->bReserved = 0;
0772         ssp_cap->wReserved = 0;
0773 
0774         ssp_cap->bmAttributes =
0775             cpu_to_le32(FIELD_PREP(USB_SSP_SUBLINK_SPEED_ATTRIBS, ssac) |
0776                     FIELD_PREP(USB_SSP_SUBLINK_SPEED_IDS, ssic));
0777 
0778         ssp_cap->wFunctionalitySupport =
0779             cpu_to_le16(FIELD_PREP(USB_SSP_MIN_SUBLINK_SPEED_ATTRIBUTE_ID, 0) |
0780                     FIELD_PREP(USB_SSP_MIN_RX_LANE_COUNT, 1) |
0781                     FIELD_PREP(USB_SSP_MIN_TX_LANE_COUNT, 1));
0782 
0783         /*
0784          * Use 1 SSID if the gadget supports up to gen2x1 or not
0785          * specified:
0786          * - SSID 0 for symmetric RX/TX sublink speed of 10 Gbps.
0787          *
0788          * Use 1 SSID if the gadget supports up to gen1x2:
0789          * - SSID 0 for symmetric RX/TX sublink speed of 5 Gbps.
0790          *
0791          * Use 2 SSIDs if the gadget supports up to gen2x2:
0792          * - SSID 0 for symmetric RX/TX sublink speed of 5 Gbps.
0793          * - SSID 1 for symmetric RX/TX sublink speed of 10 Gbps.
0794          */
0795         for (i = 0; i < ssac + 1; i++) {
0796             u8 ssid;
0797             u8 mantissa;
0798             u8 type;
0799 
0800             ssid = i >> 1;
0801 
0802             if (cdev->gadget->max_ssp_rate == USB_SSP_GEN_2x1 ||
0803                 cdev->gadget->max_ssp_rate == USB_SSP_GEN_UNKNOWN)
0804                 mantissa = 10;
0805             else
0806                 mantissa = 5 << ssid;
0807 
0808             if (i % 2)
0809                 type = USB_SSP_SUBLINK_SPEED_ST_SYM_TX;
0810             else
0811                 type = USB_SSP_SUBLINK_SPEED_ST_SYM_RX;
0812 
0813             ssp_cap->bmSublinkSpeedAttr[i] =
0814                 cpu_to_le32(FIELD_PREP(USB_SSP_SUBLINK_SPEED_SSID, ssid) |
0815                         FIELD_PREP(USB_SSP_SUBLINK_SPEED_LSE,
0816                                USB_SSP_SUBLINK_SPEED_LSE_GBPS) |
0817                         FIELD_PREP(USB_SSP_SUBLINK_SPEED_ST, type) |
0818                         FIELD_PREP(USB_SSP_SUBLINK_SPEED_LP,
0819                                USB_SSP_SUBLINK_SPEED_LP_SSP) |
0820                         FIELD_PREP(USB_SSP_SUBLINK_SPEED_LSM, mantissa));
0821         }
0822     }
0823 
0824     return le16_to_cpu(bos->wTotalLength);
0825 }
0826 
0827 static void device_qual(struct usb_composite_dev *cdev)
0828 {
0829     struct usb_qualifier_descriptor *qual = cdev->req->buf;
0830 
0831     qual->bLength = sizeof(*qual);
0832     qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
0833     /* POLICY: same bcdUSB and device type info at both speeds */
0834     qual->bcdUSB = cdev->desc.bcdUSB;
0835     qual->bDeviceClass = cdev->desc.bDeviceClass;
0836     qual->bDeviceSubClass = cdev->desc.bDeviceSubClass;
0837     qual->bDeviceProtocol = cdev->desc.bDeviceProtocol;
0838     /* ASSUME same EP0 fifo size at both speeds */
0839     qual->bMaxPacketSize0 = cdev->gadget->ep0->maxpacket;
0840     qual->bNumConfigurations = count_configs(cdev, USB_DT_DEVICE_QUALIFIER);
0841     qual->bRESERVED = 0;
0842 }
0843 
0844 /*-------------------------------------------------------------------------*/
0845 
0846 static void reset_config(struct usb_composite_dev *cdev)
0847 {
0848     struct usb_function     *f;
0849 
0850     DBG(cdev, "reset config\n");
0851 
0852     list_for_each_entry(f, &cdev->config->functions, list) {
0853         if (f->disable)
0854             f->disable(f);
0855 
0856         bitmap_zero(f->endpoints, 32);
0857     }
0858     cdev->config = NULL;
0859     cdev->delayed_status = 0;
0860 }
0861 
0862 static int set_config(struct usb_composite_dev *cdev,
0863         const struct usb_ctrlrequest *ctrl, unsigned number)
0864 {
0865     struct usb_gadget   *gadget = cdev->gadget;
0866     struct usb_configuration *c = NULL, *iter;
0867     int         result = -EINVAL;
0868     unsigned        power = gadget_is_otg(gadget) ? 8 : 100;
0869     int         tmp;
0870 
0871     if (number) {
0872         list_for_each_entry(iter, &cdev->configs, list) {
0873             if (iter->bConfigurationValue != number)
0874                 continue;
0875             /*
0876              * We disable the FDs of the previous
0877              * configuration only if the new configuration
0878              * is a valid one
0879              */
0880             if (cdev->config)
0881                 reset_config(cdev);
0882             c = iter;
0883             result = 0;
0884             break;
0885         }
0886         if (result < 0)
0887             goto done;
0888     } else { /* Zero configuration value - need to reset the config */
0889         if (cdev->config)
0890             reset_config(cdev);
0891         result = 0;
0892     }
0893 
0894     DBG(cdev, "%s config #%d: %s\n",
0895         usb_speed_string(gadget->speed),
0896         number, c ? c->label : "unconfigured");
0897 
0898     if (!c)
0899         goto done;
0900 
0901     usb_gadget_set_state(gadget, USB_STATE_CONFIGURED);
0902     cdev->config = c;
0903 
0904     /* Initialize all interfaces by setting them to altsetting zero. */
0905     for (tmp = 0; tmp < MAX_CONFIG_INTERFACES; tmp++) {
0906         struct usb_function *f = c->interface[tmp];
0907         struct usb_descriptor_header **descriptors;
0908 
0909         if (!f)
0910             break;
0911 
0912         /*
0913          * Record which endpoints are used by the function. This is used
0914          * to dispatch control requests targeted at that endpoint to the
0915          * function's setup callback instead of the current
0916          * configuration's setup callback.
0917          */
0918         descriptors = function_descriptors(f, gadget->speed);
0919 
0920         for (; *descriptors; ++descriptors) {
0921             struct usb_endpoint_descriptor *ep;
0922             int addr;
0923 
0924             if ((*descriptors)->bDescriptorType != USB_DT_ENDPOINT)
0925                 continue;
0926 
0927             ep = (struct usb_endpoint_descriptor *)*descriptors;
0928             addr = ((ep->bEndpointAddress & 0x80) >> 3)
0929                  |  (ep->bEndpointAddress & 0x0f);
0930             set_bit(addr, f->endpoints);
0931         }
0932 
0933         result = f->set_alt(f, tmp, 0);
0934         if (result < 0) {
0935             DBG(cdev, "interface %d (%s/%p) alt 0 --> %d\n",
0936                     tmp, f->name, f, result);
0937 
0938             reset_config(cdev);
0939             goto done;
0940         }
0941 
0942         if (result == USB_GADGET_DELAYED_STATUS) {
0943             DBG(cdev,
0944              "%s: interface %d (%s) requested delayed status\n",
0945                     __func__, tmp, f->name);
0946             cdev->delayed_status++;
0947             DBG(cdev, "delayed_status count %d\n",
0948                     cdev->delayed_status);
0949         }
0950     }
0951 
0952     /* when we return, be sure our power usage is valid */
0953     if (c->MaxPower || (c->bmAttributes & USB_CONFIG_ATT_SELFPOWER))
0954         power = c->MaxPower;
0955     else
0956         power = CONFIG_USB_GADGET_VBUS_DRAW;
0957 
0958     if (gadget->speed < USB_SPEED_SUPER)
0959         power = min(power, 500U);
0960     else
0961         power = min(power, 900U);
0962 done:
0963     if (power <= USB_SELF_POWER_VBUS_MAX_DRAW)
0964         usb_gadget_set_selfpowered(gadget);
0965     else
0966         usb_gadget_clear_selfpowered(gadget);
0967 
0968     usb_gadget_vbus_draw(gadget, power);
0969     if (result >= 0 && cdev->delayed_status)
0970         result = USB_GADGET_DELAYED_STATUS;
0971     return result;
0972 }
0973 
0974 int usb_add_config_only(struct usb_composite_dev *cdev,
0975         struct usb_configuration *config)
0976 {
0977     struct usb_configuration *c;
0978 
0979     if (!config->bConfigurationValue)
0980         return -EINVAL;
0981 
0982     /* Prevent duplicate configuration identifiers */
0983     list_for_each_entry(c, &cdev->configs, list) {
0984         if (c->bConfigurationValue == config->bConfigurationValue)
0985             return -EBUSY;
0986     }
0987 
0988     config->cdev = cdev;
0989     list_add_tail(&config->list, &cdev->configs);
0990 
0991     INIT_LIST_HEAD(&config->functions);
0992     config->next_interface_id = 0;
0993     memset(config->interface, 0, sizeof(config->interface));
0994 
0995     return 0;
0996 }
0997 EXPORT_SYMBOL_GPL(usb_add_config_only);
0998 
0999 /**
1000  * usb_add_config() - add a configuration to a device.
1001  * @cdev: wraps the USB gadget
1002  * @config: the configuration, with bConfigurationValue assigned
1003  * @bind: the configuration's bind function
1004  * Context: single threaded during gadget setup
1005  *
1006  * One of the main tasks of a composite @bind() routine is to
1007  * add each of the configurations it supports, using this routine.
1008  *
1009  * This function returns the value of the configuration's @bind(), which
1010  * is zero for success else a negative errno value.  Binding configurations
1011  * assigns global resources including string IDs, and per-configuration
1012  * resources such as interface IDs and endpoints.
1013  */
1014 int usb_add_config(struct usb_composite_dev *cdev,
1015         struct usb_configuration *config,
1016         int (*bind)(struct usb_configuration *))
1017 {
1018     int             status = -EINVAL;
1019 
1020     if (!bind)
1021         goto done;
1022 
1023     DBG(cdev, "adding config #%u '%s'/%p\n",
1024             config->bConfigurationValue,
1025             config->label, config);
1026 
1027     status = usb_add_config_only(cdev, config);
1028     if (status)
1029         goto done;
1030 
1031     status = bind(config);
1032     if (status < 0) {
1033         while (!list_empty(&config->functions)) {
1034             struct usb_function     *f;
1035 
1036             f = list_first_entry(&config->functions,
1037                     struct usb_function, list);
1038             list_del(&f->list);
1039             if (f->unbind) {
1040                 DBG(cdev, "unbind function '%s'/%p\n",
1041                     f->name, f);
1042                 f->unbind(config, f);
1043                 /* may free memory for "f" */
1044             }
1045         }
1046         list_del(&config->list);
1047         config->cdev = NULL;
1048     } else {
1049         unsigned    i;
1050 
1051         DBG(cdev, "cfg %d/%p speeds:%s%s%s%s\n",
1052             config->bConfigurationValue, config,
1053             config->superspeed_plus ? " superplus" : "",
1054             config->superspeed ? " super" : "",
1055             config->highspeed ? " high" : "",
1056             config->fullspeed
1057                 ? (gadget_is_dualspeed(cdev->gadget)
1058                     ? " full"
1059                     : " full/low")
1060                 : "");
1061 
1062         for (i = 0; i < MAX_CONFIG_INTERFACES; i++) {
1063             struct usb_function *f = config->interface[i];
1064 
1065             if (!f)
1066                 continue;
1067             DBG(cdev, "  interface %d = %s/%p\n",
1068                 i, f->name, f);
1069         }
1070     }
1071 
1072     /* set_alt(), or next bind(), sets up ep->claimed as needed */
1073     usb_ep_autoconfig_reset(cdev->gadget);
1074 
1075 done:
1076     if (status)
1077         DBG(cdev, "added config '%s'/%u --> %d\n", config->label,
1078                 config->bConfigurationValue, status);
1079     return status;
1080 }
1081 EXPORT_SYMBOL_GPL(usb_add_config);
1082 
1083 static void remove_config(struct usb_composite_dev *cdev,
1084                   struct usb_configuration *config)
1085 {
1086     while (!list_empty(&config->functions)) {
1087         struct usb_function     *f;
1088 
1089         f = list_first_entry(&config->functions,
1090                 struct usb_function, list);
1091 
1092         usb_remove_function(config, f);
1093     }
1094     list_del(&config->list);
1095     if (config->unbind) {
1096         DBG(cdev, "unbind config '%s'/%p\n", config->label, config);
1097         config->unbind(config);
1098             /* may free memory for "c" */
1099     }
1100 }
1101 
1102 /**
1103  * usb_remove_config() - remove a configuration from a device.
1104  * @cdev: wraps the USB gadget
1105  * @config: the configuration
1106  *
1107  * Drivers must call usb_gadget_disconnect before calling this function
1108  * to disconnect the device from the host and make sure the host will not
1109  * try to enumerate the device while we are changing the config list.
1110  */
1111 void usb_remove_config(struct usb_composite_dev *cdev,
1112               struct usb_configuration *config)
1113 {
1114     unsigned long flags;
1115 
1116     spin_lock_irqsave(&cdev->lock, flags);
1117 
1118     if (cdev->config == config)
1119         reset_config(cdev);
1120 
1121     spin_unlock_irqrestore(&cdev->lock, flags);
1122 
1123     remove_config(cdev, config);
1124 }
1125 
1126 /*-------------------------------------------------------------------------*/
1127 
1128 /* We support strings in multiple languages ... string descriptor zero
1129  * says which languages are supported.  The typical case will be that
1130  * only one language (probably English) is used, with i18n handled on
1131  * the host side.
1132  */
1133 
1134 static void collect_langs(struct usb_gadget_strings **sp, __le16 *buf)
1135 {
1136     const struct usb_gadget_strings *s;
1137     __le16              language;
1138     __le16              *tmp;
1139 
1140     while (*sp) {
1141         s = *sp;
1142         language = cpu_to_le16(s->language);
1143         for (tmp = buf; *tmp && tmp < &buf[USB_MAX_STRING_LEN]; tmp++) {
1144             if (*tmp == language)
1145                 goto repeat;
1146         }
1147         *tmp++ = language;
1148 repeat:
1149         sp++;
1150     }
1151 }
1152 
1153 static int lookup_string(
1154     struct usb_gadget_strings   **sp,
1155     void                *buf,
1156     u16             language,
1157     int             id
1158 )
1159 {
1160     struct usb_gadget_strings   *s;
1161     int             value;
1162 
1163     while (*sp) {
1164         s = *sp++;
1165         if (s->language != language)
1166             continue;
1167         value = usb_gadget_get_string(s, id, buf);
1168         if (value > 0)
1169             return value;
1170     }
1171     return -EINVAL;
1172 }
1173 
1174 static int get_string(struct usb_composite_dev *cdev,
1175         void *buf, u16 language, int id)
1176 {
1177     struct usb_composite_driver *composite = cdev->driver;
1178     struct usb_gadget_string_container *uc;
1179     struct usb_configuration    *c;
1180     struct usb_function     *f;
1181     int             len;
1182 
1183     /* Yes, not only is USB's i18n support probably more than most
1184      * folk will ever care about ... also, it's all supported here.
1185      * (Except for UTF8 support for Unicode's "Astral Planes".)
1186      */
1187 
1188     /* 0 == report all available language codes */
1189     if (id == 0) {
1190         struct usb_string_descriptor    *s = buf;
1191         struct usb_gadget_strings   **sp;
1192 
1193         memset(s, 0, 256);
1194         s->bDescriptorType = USB_DT_STRING;
1195 
1196         sp = composite->strings;
1197         if (sp)
1198             collect_langs(sp, s->wData);
1199 
1200         list_for_each_entry(c, &cdev->configs, list) {
1201             sp = c->strings;
1202             if (sp)
1203                 collect_langs(sp, s->wData);
1204 
1205             list_for_each_entry(f, &c->functions, list) {
1206                 sp = f->strings;
1207                 if (sp)
1208                     collect_langs(sp, s->wData);
1209             }
1210         }
1211         list_for_each_entry(uc, &cdev->gstrings, list) {
1212             struct usb_gadget_strings **sp;
1213 
1214             sp = get_containers_gs(uc);
1215             collect_langs(sp, s->wData);
1216         }
1217 
1218         for (len = 0; len <= USB_MAX_STRING_LEN && s->wData[len]; len++)
1219             continue;
1220         if (!len)
1221             return -EINVAL;
1222 
1223         s->bLength = 2 * (len + 1);
1224         return s->bLength;
1225     }
1226 
1227     if (cdev->use_os_string && language == 0 && id == OS_STRING_IDX) {
1228         struct usb_os_string *b = buf;
1229         b->bLength = sizeof(*b);
1230         b->bDescriptorType = USB_DT_STRING;
1231         compiletime_assert(
1232             sizeof(b->qwSignature) == sizeof(cdev->qw_sign),
1233             "qwSignature size must be equal to qw_sign");
1234         memcpy(&b->qwSignature, cdev->qw_sign, sizeof(b->qwSignature));
1235         b->bMS_VendorCode = cdev->b_vendor_code;
1236         b->bPad = 0;
1237         return sizeof(*b);
1238     }
1239 
1240     list_for_each_entry(uc, &cdev->gstrings, list) {
1241         struct usb_gadget_strings **sp;
1242 
1243         sp = get_containers_gs(uc);
1244         len = lookup_string(sp, buf, language, id);
1245         if (len > 0)
1246             return len;
1247     }
1248 
1249     /* String IDs are device-scoped, so we look up each string
1250      * table we're told about.  These lookups are infrequent;
1251      * simpler-is-better here.
1252      */
1253     if (composite->strings) {
1254         len = lookup_string(composite->strings, buf, language, id);
1255         if (len > 0)
1256             return len;
1257     }
1258     list_for_each_entry(c, &cdev->configs, list) {
1259         if (c->strings) {
1260             len = lookup_string(c->strings, buf, language, id);
1261             if (len > 0)
1262                 return len;
1263         }
1264         list_for_each_entry(f, &c->functions, list) {
1265             if (!f->strings)
1266                 continue;
1267             len = lookup_string(f->strings, buf, language, id);
1268             if (len > 0)
1269                 return len;
1270         }
1271     }
1272     return -EINVAL;
1273 }
1274 
1275 /**
1276  * usb_string_id() - allocate an unused string ID
1277  * @cdev: the device whose string descriptor IDs are being allocated
1278  * Context: single threaded during gadget setup
1279  *
1280  * @usb_string_id() is called from bind() callbacks to allocate
1281  * string IDs.  Drivers for functions, configurations, or gadgets will
1282  * then store that ID in the appropriate descriptors and string table.
1283  *
1284  * All string identifier should be allocated using this,
1285  * @usb_string_ids_tab() or @usb_string_ids_n() routine, to ensure
1286  * that for example different functions don't wrongly assign different
1287  * meanings to the same identifier.
1288  */
1289 int usb_string_id(struct usb_composite_dev *cdev)
1290 {
1291     if (cdev->next_string_id < 254) {
1292         /* string id 0 is reserved by USB spec for list of
1293          * supported languages */
1294         /* 255 reserved as well? -- mina86 */
1295         cdev->next_string_id++;
1296         return cdev->next_string_id;
1297     }
1298     return -ENODEV;
1299 }
1300 EXPORT_SYMBOL_GPL(usb_string_id);
1301 
1302 /**
1303  * usb_string_ids_tab() - allocate unused string IDs in batch
1304  * @cdev: the device whose string descriptor IDs are being allocated
1305  * @str: an array of usb_string objects to assign numbers to
1306  * Context: single threaded during gadget setup
1307  *
1308  * @usb_string_ids() is called from bind() callbacks to allocate
1309  * string IDs.  Drivers for functions, configurations, or gadgets will
1310  * then copy IDs from the string table to the appropriate descriptors
1311  * and string table for other languages.
1312  *
1313  * All string identifier should be allocated using this,
1314  * @usb_string_id() or @usb_string_ids_n() routine, to ensure that for
1315  * example different functions don't wrongly assign different meanings
1316  * to the same identifier.
1317  */
1318 int usb_string_ids_tab(struct usb_composite_dev *cdev, struct usb_string *str)
1319 {
1320     int next = cdev->next_string_id;
1321 
1322     for (; str->s; ++str) {
1323         if (unlikely(next >= 254))
1324             return -ENODEV;
1325         str->id = ++next;
1326     }
1327 
1328     cdev->next_string_id = next;
1329 
1330     return 0;
1331 }
1332 EXPORT_SYMBOL_GPL(usb_string_ids_tab);
1333 
1334 static struct usb_gadget_string_container *copy_gadget_strings(
1335         struct usb_gadget_strings **sp, unsigned n_gstrings,
1336         unsigned n_strings)
1337 {
1338     struct usb_gadget_string_container *uc;
1339     struct usb_gadget_strings **gs_array;
1340     struct usb_gadget_strings *gs;
1341     struct usb_string *s;
1342     unsigned mem;
1343     unsigned n_gs;
1344     unsigned n_s;
1345     void *stash;
1346 
1347     mem = sizeof(*uc);
1348     mem += sizeof(void *) * (n_gstrings + 1);
1349     mem += sizeof(struct usb_gadget_strings) * n_gstrings;
1350     mem += sizeof(struct usb_string) * (n_strings + 1) * (n_gstrings);
1351     uc = kmalloc(mem, GFP_KERNEL);
1352     if (!uc)
1353         return ERR_PTR(-ENOMEM);
1354     gs_array = get_containers_gs(uc);
1355     stash = uc->stash;
1356     stash += sizeof(void *) * (n_gstrings + 1);
1357     for (n_gs = 0; n_gs < n_gstrings; n_gs++) {
1358         struct usb_string *org_s;
1359 
1360         gs_array[n_gs] = stash;
1361         gs = gs_array[n_gs];
1362         stash += sizeof(struct usb_gadget_strings);
1363         gs->language = sp[n_gs]->language;
1364         gs->strings = stash;
1365         org_s = sp[n_gs]->strings;
1366 
1367         for (n_s = 0; n_s < n_strings; n_s++) {
1368             s = stash;
1369             stash += sizeof(struct usb_string);
1370             if (org_s->s)
1371                 s->s = org_s->s;
1372             else
1373                 s->s = "";
1374             org_s++;
1375         }
1376         s = stash;
1377         s->s = NULL;
1378         stash += sizeof(struct usb_string);
1379 
1380     }
1381     gs_array[n_gs] = NULL;
1382     return uc;
1383 }
1384 
1385 /**
1386  * usb_gstrings_attach() - attach gadget strings to a cdev and assign ids
1387  * @cdev: the device whose string descriptor IDs are being allocated
1388  * and attached.
1389  * @sp: an array of usb_gadget_strings to attach.
1390  * @n_strings: number of entries in each usb_strings array (sp[]->strings)
1391  *
1392  * This function will create a deep copy of usb_gadget_strings and usb_string
1393  * and attach it to the cdev. The actual string (usb_string.s) will not be
1394  * copied but only a referenced will be made. The struct usb_gadget_strings
1395  * array may contain multiple languages and should be NULL terminated.
1396  * The ->language pointer of each struct usb_gadget_strings has to contain the
1397  * same amount of entries.
1398  * For instance: sp[0] is en-US, sp[1] is es-ES. It is expected that the first
1399  * usb_string entry of es-ES contains the translation of the first usb_string
1400  * entry of en-US. Therefore both entries become the same id assign.
1401  */
1402 struct usb_string *usb_gstrings_attach(struct usb_composite_dev *cdev,
1403         struct usb_gadget_strings **sp, unsigned n_strings)
1404 {
1405     struct usb_gadget_string_container *uc;
1406     struct usb_gadget_strings **n_gs;
1407     unsigned n_gstrings = 0;
1408     unsigned i;
1409     int ret;
1410 
1411     for (i = 0; sp[i]; i++)
1412         n_gstrings++;
1413 
1414     if (!n_gstrings)
1415         return ERR_PTR(-EINVAL);
1416 
1417     uc = copy_gadget_strings(sp, n_gstrings, n_strings);
1418     if (IS_ERR(uc))
1419         return ERR_CAST(uc);
1420 
1421     n_gs = get_containers_gs(uc);
1422     ret = usb_string_ids_tab(cdev, n_gs[0]->strings);
1423     if (ret)
1424         goto err;
1425 
1426     for (i = 1; i < n_gstrings; i++) {
1427         struct usb_string *m_s;
1428         struct usb_string *s;
1429         unsigned n;
1430 
1431         m_s = n_gs[0]->strings;
1432         s = n_gs[i]->strings;
1433         for (n = 0; n < n_strings; n++) {
1434             s->id = m_s->id;
1435             s++;
1436             m_s++;
1437         }
1438     }
1439     list_add_tail(&uc->list, &cdev->gstrings);
1440     return n_gs[0]->strings;
1441 err:
1442     kfree(uc);
1443     return ERR_PTR(ret);
1444 }
1445 EXPORT_SYMBOL_GPL(usb_gstrings_attach);
1446 
1447 /**
1448  * usb_string_ids_n() - allocate unused string IDs in batch
1449  * @c: the device whose string descriptor IDs are being allocated
1450  * @n: number of string IDs to allocate
1451  * Context: single threaded during gadget setup
1452  *
1453  * Returns the first requested ID.  This ID and next @n-1 IDs are now
1454  * valid IDs.  At least provided that @n is non-zero because if it
1455  * is, returns last requested ID which is now very useful information.
1456  *
1457  * @usb_string_ids_n() is called from bind() callbacks to allocate
1458  * string IDs.  Drivers for functions, configurations, or gadgets will
1459  * then store that ID in the appropriate descriptors and string table.
1460  *
1461  * All string identifier should be allocated using this,
1462  * @usb_string_id() or @usb_string_ids_n() routine, to ensure that for
1463  * example different functions don't wrongly assign different meanings
1464  * to the same identifier.
1465  */
1466 int usb_string_ids_n(struct usb_composite_dev *c, unsigned n)
1467 {
1468     unsigned next = c->next_string_id;
1469     if (unlikely(n > 254 || (unsigned)next + n > 254))
1470         return -ENODEV;
1471     c->next_string_id += n;
1472     return next + 1;
1473 }
1474 EXPORT_SYMBOL_GPL(usb_string_ids_n);
1475 
1476 /*-------------------------------------------------------------------------*/
1477 
1478 static void composite_setup_complete(struct usb_ep *ep, struct usb_request *req)
1479 {
1480     struct usb_composite_dev *cdev;
1481 
1482     if (req->status || req->actual != req->length)
1483         DBG((struct usb_composite_dev *) ep->driver_data,
1484                 "setup complete --> %d, %d/%d\n",
1485                 req->status, req->actual, req->length);
1486 
1487     /*
1488      * REVIST The same ep0 requests are shared with function drivers
1489      * so they don't have to maintain the same ->complete() stubs.
1490      *
1491      * Because of that, we need to check for the validity of ->context
1492      * here, even though we know we've set it to something useful.
1493      */
1494     if (!req->context)
1495         return;
1496 
1497     cdev = req->context;
1498 
1499     if (cdev->req == req)
1500         cdev->setup_pending = false;
1501     else if (cdev->os_desc_req == req)
1502         cdev->os_desc_pending = false;
1503     else
1504         WARN(1, "unknown request %p\n", req);
1505 }
1506 
1507 static int composite_ep0_queue(struct usb_composite_dev *cdev,
1508         struct usb_request *req, gfp_t gfp_flags)
1509 {
1510     int ret;
1511 
1512     ret = usb_ep_queue(cdev->gadget->ep0, req, gfp_flags);
1513     if (ret == 0) {
1514         if (cdev->req == req)
1515             cdev->setup_pending = true;
1516         else if (cdev->os_desc_req == req)
1517             cdev->os_desc_pending = true;
1518         else
1519             WARN(1, "unknown request %p\n", req);
1520     }
1521 
1522     return ret;
1523 }
1524 
1525 static int count_ext_compat(struct usb_configuration *c)
1526 {
1527     int i, res;
1528 
1529     res = 0;
1530     for (i = 0; i < c->next_interface_id; ++i) {
1531         struct usb_function *f;
1532         int j;
1533 
1534         f = c->interface[i];
1535         for (j = 0; j < f->os_desc_n; ++j) {
1536             struct usb_os_desc *d;
1537 
1538             if (i != f->os_desc_table[j].if_id)
1539                 continue;
1540             d = f->os_desc_table[j].os_desc;
1541             if (d && d->ext_compat_id)
1542                 ++res;
1543         }
1544     }
1545     BUG_ON(res > 255);
1546     return res;
1547 }
1548 
1549 static int fill_ext_compat(struct usb_configuration *c, u8 *buf)
1550 {
1551     int i, count;
1552 
1553     count = 16;
1554     buf += 16;
1555     for (i = 0; i < c->next_interface_id; ++i) {
1556         struct usb_function *f;
1557         int j;
1558 
1559         f = c->interface[i];
1560         for (j = 0; j < f->os_desc_n; ++j) {
1561             struct usb_os_desc *d;
1562 
1563             if (i != f->os_desc_table[j].if_id)
1564                 continue;
1565             d = f->os_desc_table[j].os_desc;
1566             if (d && d->ext_compat_id) {
1567                 *buf++ = i;
1568                 *buf++ = 0x01;
1569                 memcpy(buf, d->ext_compat_id, 16);
1570                 buf += 22;
1571             } else {
1572                 ++buf;
1573                 *buf = 0x01;
1574                 buf += 23;
1575             }
1576             count += 24;
1577             if (count + 24 >= USB_COMP_EP0_OS_DESC_BUFSIZ)
1578                 return count;
1579         }
1580     }
1581 
1582     return count;
1583 }
1584 
1585 static int count_ext_prop(struct usb_configuration *c, int interface)
1586 {
1587     struct usb_function *f;
1588     int j;
1589 
1590     f = c->interface[interface];
1591     for (j = 0; j < f->os_desc_n; ++j) {
1592         struct usb_os_desc *d;
1593 
1594         if (interface != f->os_desc_table[j].if_id)
1595             continue;
1596         d = f->os_desc_table[j].os_desc;
1597         if (d && d->ext_compat_id)
1598             return d->ext_prop_count;
1599     }
1600     return 0;
1601 }
1602 
1603 static int len_ext_prop(struct usb_configuration *c, int interface)
1604 {
1605     struct usb_function *f;
1606     struct usb_os_desc *d;
1607     int j, res;
1608 
1609     res = 10; /* header length */
1610     f = c->interface[interface];
1611     for (j = 0; j < f->os_desc_n; ++j) {
1612         if (interface != f->os_desc_table[j].if_id)
1613             continue;
1614         d = f->os_desc_table[j].os_desc;
1615         if (d)
1616             return min(res + d->ext_prop_len, 4096);
1617     }
1618     return res;
1619 }
1620 
1621 static int fill_ext_prop(struct usb_configuration *c, int interface, u8 *buf)
1622 {
1623     struct usb_function *f;
1624     struct usb_os_desc *d;
1625     struct usb_os_desc_ext_prop *ext_prop;
1626     int j, count, n, ret;
1627 
1628     f = c->interface[interface];
1629     count = 10; /* header length */
1630     buf += 10;
1631     for (j = 0; j < f->os_desc_n; ++j) {
1632         if (interface != f->os_desc_table[j].if_id)
1633             continue;
1634         d = f->os_desc_table[j].os_desc;
1635         if (d)
1636             list_for_each_entry(ext_prop, &d->ext_prop, entry) {
1637                 n = ext_prop->data_len +
1638                     ext_prop->name_len + 14;
1639                 if (count + n >= USB_COMP_EP0_OS_DESC_BUFSIZ)
1640                     return count;
1641                 usb_ext_prop_put_size(buf, n);
1642                 usb_ext_prop_put_type(buf, ext_prop->type);
1643                 ret = usb_ext_prop_put_name(buf, ext_prop->name,
1644                                 ext_prop->name_len);
1645                 if (ret < 0)
1646                     return ret;
1647                 switch (ext_prop->type) {
1648                 case USB_EXT_PROP_UNICODE:
1649                 case USB_EXT_PROP_UNICODE_ENV:
1650                 case USB_EXT_PROP_UNICODE_LINK:
1651                     usb_ext_prop_put_unicode(buf, ret,
1652                              ext_prop->data,
1653                              ext_prop->data_len);
1654                     break;
1655                 case USB_EXT_PROP_BINARY:
1656                     usb_ext_prop_put_binary(buf, ret,
1657                             ext_prop->data,
1658                             ext_prop->data_len);
1659                     break;
1660                 case USB_EXT_PROP_LE32:
1661                     /* not implemented */
1662                 case USB_EXT_PROP_BE32:
1663                     /* not implemented */
1664                 default:
1665                     return -EINVAL;
1666                 }
1667                 buf += n;
1668                 count += n;
1669             }
1670     }
1671 
1672     return count;
1673 }
1674 
1675 /*
1676  * The setup() callback implements all the ep0 functionality that's
1677  * not handled lower down, in hardware or the hardware driver(like
1678  * device and endpoint feature flags, and their status).  It's all
1679  * housekeeping for the gadget function we're implementing.  Most of
1680  * the work is in config and function specific setup.
1681  */
1682 int
1683 composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
1684 {
1685     struct usb_composite_dev    *cdev = get_gadget_data(gadget);
1686     struct usb_request      *req = cdev->req;
1687     int             value = -EOPNOTSUPP;
1688     int             status = 0;
1689     u16             w_index = le16_to_cpu(ctrl->wIndex);
1690     u8              intf = w_index & 0xFF;
1691     u16             w_value = le16_to_cpu(ctrl->wValue);
1692     u16             w_length = le16_to_cpu(ctrl->wLength);
1693     struct usb_function     *f = NULL;
1694     struct usb_function     *iter;
1695     u8              endp;
1696 
1697     if (w_length > USB_COMP_EP0_BUFSIZ) {
1698         if (ctrl->bRequestType & USB_DIR_IN) {
1699             /* Cast away the const, we are going to overwrite on purpose. */
1700             __le16 *temp = (__le16 *)&ctrl->wLength;
1701 
1702             *temp = cpu_to_le16(USB_COMP_EP0_BUFSIZ);
1703             w_length = USB_COMP_EP0_BUFSIZ;
1704         } else {
1705             goto done;
1706         }
1707     }
1708 
1709     /* partial re-init of the response message; the function or the
1710      * gadget might need to intercept e.g. a control-OUT completion
1711      * when we delegate to it.
1712      */
1713     req->zero = 0;
1714     req->context = cdev;
1715     req->complete = composite_setup_complete;
1716     req->length = 0;
1717     gadget->ep0->driver_data = cdev;
1718 
1719     /*
1720      * Don't let non-standard requests match any of the cases below
1721      * by accident.
1722      */
1723     if ((ctrl->bRequestType & USB_TYPE_MASK) != USB_TYPE_STANDARD)
1724         goto unknown;
1725 
1726     switch (ctrl->bRequest) {
1727 
1728     /* we handle all standard USB descriptors */
1729     case USB_REQ_GET_DESCRIPTOR:
1730         if (ctrl->bRequestType != USB_DIR_IN)
1731             goto unknown;
1732         switch (w_value >> 8) {
1733 
1734         case USB_DT_DEVICE:
1735             cdev->desc.bNumConfigurations =
1736                 count_configs(cdev, USB_DT_DEVICE);
1737             cdev->desc.bMaxPacketSize0 =
1738                 cdev->gadget->ep0->maxpacket;
1739             if (gadget_is_superspeed(gadget)) {
1740                 if (gadget->speed >= USB_SPEED_SUPER) {
1741                     cdev->desc.bcdUSB = cpu_to_le16(0x0320);
1742                     cdev->desc.bMaxPacketSize0 = 9;
1743                 } else {
1744                     cdev->desc.bcdUSB = cpu_to_le16(0x0210);
1745                 }
1746             } else {
1747                 if (gadget->lpm_capable)
1748                     cdev->desc.bcdUSB = cpu_to_le16(0x0201);
1749                 else
1750                     cdev->desc.bcdUSB = cpu_to_le16(0x0200);
1751             }
1752 
1753             value = min(w_length, (u16) sizeof cdev->desc);
1754             memcpy(req->buf, &cdev->desc, value);
1755             break;
1756         case USB_DT_DEVICE_QUALIFIER:
1757             if (!gadget_is_dualspeed(gadget) ||
1758                 gadget->speed >= USB_SPEED_SUPER)
1759                 break;
1760             device_qual(cdev);
1761             value = min_t(int, w_length,
1762                 sizeof(struct usb_qualifier_descriptor));
1763             break;
1764         case USB_DT_OTHER_SPEED_CONFIG:
1765             if (!gadget_is_dualspeed(gadget) ||
1766                 gadget->speed >= USB_SPEED_SUPER)
1767                 break;
1768             fallthrough;
1769         case USB_DT_CONFIG:
1770             value = config_desc(cdev, w_value);
1771             if (value >= 0)
1772                 value = min(w_length, (u16) value);
1773             break;
1774         case USB_DT_STRING:
1775             value = get_string(cdev, req->buf,
1776                     w_index, w_value & 0xff);
1777             if (value >= 0)
1778                 value = min(w_length, (u16) value);
1779             break;
1780         case USB_DT_BOS:
1781             if (gadget_is_superspeed(gadget) ||
1782                 gadget->lpm_capable) {
1783                 value = bos_desc(cdev);
1784                 value = min(w_length, (u16) value);
1785             }
1786             break;
1787         case USB_DT_OTG:
1788             if (gadget_is_otg(gadget)) {
1789                 struct usb_configuration *config;
1790                 int otg_desc_len = 0;
1791 
1792                 if (cdev->config)
1793                     config = cdev->config;
1794                 else
1795                     config = list_first_entry(
1796                             &cdev->configs,
1797                         struct usb_configuration, list);
1798                 if (!config)
1799                     goto done;
1800 
1801                 if (gadget->otg_caps &&
1802                     (gadget->otg_caps->otg_rev >= 0x0200))
1803                     otg_desc_len += sizeof(
1804                         struct usb_otg20_descriptor);
1805                 else
1806                     otg_desc_len += sizeof(
1807                         struct usb_otg_descriptor);
1808 
1809                 value = min_t(int, w_length, otg_desc_len);
1810                 memcpy(req->buf, config->descriptors[0], value);
1811             }
1812             break;
1813         }
1814         break;
1815 
1816     /* any number of configs can work */
1817     case USB_REQ_SET_CONFIGURATION:
1818         if (ctrl->bRequestType != 0)
1819             goto unknown;
1820         if (gadget_is_otg(gadget)) {
1821             if (gadget->a_hnp_support)
1822                 DBG(cdev, "HNP available\n");
1823             else if (gadget->a_alt_hnp_support)
1824                 DBG(cdev, "HNP on another port\n");
1825             else
1826                 VDBG(cdev, "HNP inactive\n");
1827         }
1828         spin_lock(&cdev->lock);
1829         value = set_config(cdev, ctrl, w_value);
1830         spin_unlock(&cdev->lock);
1831         break;
1832     case USB_REQ_GET_CONFIGURATION:
1833         if (ctrl->bRequestType != USB_DIR_IN)
1834             goto unknown;
1835         if (cdev->config)
1836             *(u8 *)req->buf = cdev->config->bConfigurationValue;
1837         else
1838             *(u8 *)req->buf = 0;
1839         value = min(w_length, (u16) 1);
1840         break;
1841 
1842     /* function drivers must handle get/set altsetting */
1843     case USB_REQ_SET_INTERFACE:
1844         if (ctrl->bRequestType != USB_RECIP_INTERFACE)
1845             goto unknown;
1846         if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
1847             break;
1848         f = cdev->config->interface[intf];
1849         if (!f)
1850             break;
1851 
1852         /*
1853          * If there's no get_alt() method, we know only altsetting zero
1854          * works. There is no need to check if set_alt() is not NULL
1855          * as we check this in usb_add_function().
1856          */
1857         if (w_value && !f->get_alt)
1858             break;
1859 
1860         spin_lock(&cdev->lock);
1861         value = f->set_alt(f, w_index, w_value);
1862         if (value == USB_GADGET_DELAYED_STATUS) {
1863             DBG(cdev,
1864              "%s: interface %d (%s) requested delayed status\n",
1865                     __func__, intf, f->name);
1866             cdev->delayed_status++;
1867             DBG(cdev, "delayed_status count %d\n",
1868                     cdev->delayed_status);
1869         }
1870         spin_unlock(&cdev->lock);
1871         break;
1872     case USB_REQ_GET_INTERFACE:
1873         if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
1874             goto unknown;
1875         if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
1876             break;
1877         f = cdev->config->interface[intf];
1878         if (!f)
1879             break;
1880         /* lots of interfaces only need altsetting zero... */
1881         value = f->get_alt ? f->get_alt(f, w_index) : 0;
1882         if (value < 0)
1883             break;
1884         *((u8 *)req->buf) = value;
1885         value = min(w_length, (u16) 1);
1886         break;
1887     case USB_REQ_GET_STATUS:
1888         if (gadget_is_otg(gadget) && gadget->hnp_polling_support &&
1889                         (w_index == OTG_STS_SELECTOR)) {
1890             if (ctrl->bRequestType != (USB_DIR_IN |
1891                             USB_RECIP_DEVICE))
1892                 goto unknown;
1893             *((u8 *)req->buf) = gadget->host_request_flag;
1894             value = 1;
1895             break;
1896         }
1897 
1898         /*
1899          * USB 3.0 additions:
1900          * Function driver should handle get_status request. If such cb
1901          * wasn't supplied we respond with default value = 0
1902          * Note: function driver should supply such cb only for the
1903          * first interface of the function
1904          */
1905         if (!gadget_is_superspeed(gadget))
1906             goto unknown;
1907         if (ctrl->bRequestType != (USB_DIR_IN | USB_RECIP_INTERFACE))
1908             goto unknown;
1909         value = 2;  /* This is the length of the get_status reply */
1910         put_unaligned_le16(0, req->buf);
1911         if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
1912             break;
1913         f = cdev->config->interface[intf];
1914         if (!f)
1915             break;
1916         status = f->get_status ? f->get_status(f) : 0;
1917         if (status < 0)
1918             break;
1919         put_unaligned_le16(status & 0x0000ffff, req->buf);
1920         break;
1921     /*
1922      * Function drivers should handle SetFeature/ClearFeature
1923      * (FUNCTION_SUSPEND) request. function_suspend cb should be supplied
1924      * only for the first interface of the function
1925      */
1926     case USB_REQ_CLEAR_FEATURE:
1927     case USB_REQ_SET_FEATURE:
1928         if (!gadget_is_superspeed(gadget))
1929             goto unknown;
1930         if (ctrl->bRequestType != (USB_DIR_OUT | USB_RECIP_INTERFACE))
1931             goto unknown;
1932         switch (w_value) {
1933         case USB_INTRF_FUNC_SUSPEND:
1934             if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
1935                 break;
1936             f = cdev->config->interface[intf];
1937             if (!f)
1938                 break;
1939             value = 0;
1940             if (f->func_suspend)
1941                 value = f->func_suspend(f, w_index >> 8);
1942             if (value < 0) {
1943                 ERROR(cdev,
1944                       "func_suspend() returned error %d\n",
1945                       value);
1946                 value = 0;
1947             }
1948             break;
1949         }
1950         break;
1951     default:
1952 unknown:
1953         /*
1954          * OS descriptors handling
1955          */
1956         if (cdev->use_os_string && cdev->os_desc_config &&
1957             (ctrl->bRequestType & USB_TYPE_VENDOR) &&
1958             ctrl->bRequest == cdev->b_vendor_code) {
1959             struct usb_configuration    *os_desc_cfg;
1960             u8              *buf;
1961             int             interface;
1962             int             count = 0;
1963 
1964             req = cdev->os_desc_req;
1965             req->context = cdev;
1966             req->complete = composite_setup_complete;
1967             buf = req->buf;
1968             os_desc_cfg = cdev->os_desc_config;
1969             w_length = min_t(u16, w_length, USB_COMP_EP0_OS_DESC_BUFSIZ);
1970             memset(buf, 0, w_length);
1971             buf[5] = 0x01;
1972             switch (ctrl->bRequestType & USB_RECIP_MASK) {
1973             case USB_RECIP_DEVICE:
1974                 if (w_index != 0x4 || (w_value >> 8))
1975                     break;
1976                 buf[6] = w_index;
1977                 /* Number of ext compat interfaces */
1978                 count = count_ext_compat(os_desc_cfg);
1979                 buf[8] = count;
1980                 count *= 24; /* 24 B/ext compat desc */
1981                 count += 16; /* header */
1982                 put_unaligned_le32(count, buf);
1983                 value = w_length;
1984                 if (w_length > 0x10) {
1985                     value = fill_ext_compat(os_desc_cfg, buf);
1986                     value = min_t(u16, w_length, value);
1987                 }
1988                 break;
1989             case USB_RECIP_INTERFACE:
1990                 if (w_index != 0x5 || (w_value >> 8))
1991                     break;
1992                 interface = w_value & 0xFF;
1993                 if (interface >= MAX_CONFIG_INTERFACES ||
1994                     !os_desc_cfg->interface[interface])
1995                     break;
1996                 buf[6] = w_index;
1997                 count = count_ext_prop(os_desc_cfg,
1998                     interface);
1999                 put_unaligned_le16(count, buf + 8);
2000                 count = len_ext_prop(os_desc_cfg,
2001                     interface);
2002                 put_unaligned_le32(count, buf);
2003                 value = w_length;
2004                 if (w_length > 0x0A) {
2005                     value = fill_ext_prop(os_desc_cfg,
2006                                   interface, buf);
2007                     if (value >= 0)
2008                         value = min_t(u16, w_length, value);
2009                 }
2010                 break;
2011             }
2012 
2013             goto check_value;
2014         }
2015 
2016         VDBG(cdev,
2017             "non-core control req%02x.%02x v%04x i%04x l%d\n",
2018             ctrl->bRequestType, ctrl->bRequest,
2019             w_value, w_index, w_length);
2020 
2021         /* functions always handle their interfaces and endpoints...
2022          * punt other recipients (other, WUSB, ...) to the current
2023          * configuration code.
2024          */
2025         if (cdev->config) {
2026             list_for_each_entry(f, &cdev->config->functions, list)
2027                 if (f->req_match &&
2028                     f->req_match(f, ctrl, false))
2029                     goto try_fun_setup;
2030         } else {
2031             struct usb_configuration *c;
2032             list_for_each_entry(c, &cdev->configs, list)
2033                 list_for_each_entry(f, &c->functions, list)
2034                     if (f->req_match &&
2035                         f->req_match(f, ctrl, true))
2036                         goto try_fun_setup;
2037         }
2038         f = NULL;
2039 
2040         switch (ctrl->bRequestType & USB_RECIP_MASK) {
2041         case USB_RECIP_INTERFACE:
2042             if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
2043                 break;
2044             f = cdev->config->interface[intf];
2045             break;
2046 
2047         case USB_RECIP_ENDPOINT:
2048             if (!cdev->config)
2049                 break;
2050             endp = ((w_index & 0x80) >> 3) | (w_index & 0x0f);
2051             list_for_each_entry(iter, &cdev->config->functions, list) {
2052                 if (test_bit(endp, iter->endpoints)) {
2053                     f = iter;
2054                     break;
2055                 }
2056             }
2057             break;
2058         }
2059 try_fun_setup:
2060         if (f && f->setup)
2061             value = f->setup(f, ctrl);
2062         else {
2063             struct usb_configuration    *c;
2064 
2065             c = cdev->config;
2066             if (!c)
2067                 goto done;
2068 
2069             /* try current config's setup */
2070             if (c->setup) {
2071                 value = c->setup(c, ctrl);
2072                 goto done;
2073             }
2074 
2075             /* try the only function in the current config */
2076             if (!list_is_singular(&c->functions))
2077                 goto done;
2078             f = list_first_entry(&c->functions, struct usb_function,
2079                          list);
2080             if (f->setup)
2081                 value = f->setup(f, ctrl);
2082         }
2083 
2084         goto done;
2085     }
2086 
2087 check_value:
2088     /* respond with data transfer before status phase? */
2089     if (value >= 0 && value != USB_GADGET_DELAYED_STATUS) {
2090         req->length = value;
2091         req->context = cdev;
2092         req->zero = value < w_length;
2093         value = composite_ep0_queue(cdev, req, GFP_ATOMIC);
2094         if (value < 0) {
2095             DBG(cdev, "ep_queue --> %d\n", value);
2096             req->status = 0;
2097             composite_setup_complete(gadget->ep0, req);
2098         }
2099     } else if (value == USB_GADGET_DELAYED_STATUS && w_length != 0) {
2100         WARN(cdev,
2101             "%s: Delayed status not supported for w_length != 0",
2102             __func__);
2103     }
2104 
2105 done:
2106     /* device either stalls (value < 0) or reports success */
2107     return value;
2108 }
2109 
2110 static void __composite_disconnect(struct usb_gadget *gadget)
2111 {
2112     struct usb_composite_dev    *cdev = get_gadget_data(gadget);
2113     unsigned long           flags;
2114 
2115     /* REVISIT:  should we have config and device level
2116      * disconnect callbacks?
2117      */
2118     spin_lock_irqsave(&cdev->lock, flags);
2119     cdev->suspended = 0;
2120     if (cdev->config)
2121         reset_config(cdev);
2122     if (cdev->driver->disconnect)
2123         cdev->driver->disconnect(cdev);
2124     spin_unlock_irqrestore(&cdev->lock, flags);
2125 }
2126 
2127 void composite_disconnect(struct usb_gadget *gadget)
2128 {
2129     usb_gadget_vbus_draw(gadget, 0);
2130     __composite_disconnect(gadget);
2131 }
2132 
2133 void composite_reset(struct usb_gadget *gadget)
2134 {
2135     /*
2136      * Section 1.4.13 Standard Downstream Port of the USB battery charging
2137      * specification v1.2 states that a device connected on a SDP shall only
2138      * draw at max 100mA while in a connected, but unconfigured state.
2139      */
2140     usb_gadget_vbus_draw(gadget, 100);
2141     __composite_disconnect(gadget);
2142 }
2143 
2144 /*-------------------------------------------------------------------------*/
2145 
2146 static ssize_t suspended_show(struct device *dev, struct device_attribute *attr,
2147                   char *buf)
2148 {
2149     struct usb_gadget *gadget = dev_to_usb_gadget(dev);
2150     struct usb_composite_dev *cdev = get_gadget_data(gadget);
2151 
2152     return sprintf(buf, "%d\n", cdev->suspended);
2153 }
2154 static DEVICE_ATTR_RO(suspended);
2155 
2156 static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver)
2157 {
2158     struct usb_composite_dev    *cdev = get_gadget_data(gadget);
2159     struct usb_gadget_strings   *gstr = cdev->driver->strings[0];
2160     struct usb_string       *dev_str = gstr->strings;
2161 
2162     /* composite_disconnect() must already have been called
2163      * by the underlying peripheral controller driver!
2164      * so there's no i/o concurrency that could affect the
2165      * state protected by cdev->lock.
2166      */
2167     WARN_ON(cdev->config);
2168 
2169     while (!list_empty(&cdev->configs)) {
2170         struct usb_configuration    *c;
2171         c = list_first_entry(&cdev->configs,
2172                 struct usb_configuration, list);
2173         remove_config(cdev, c);
2174     }
2175     if (cdev->driver->unbind && unbind_driver)
2176         cdev->driver->unbind(cdev);
2177 
2178     composite_dev_cleanup(cdev);
2179 
2180     if (dev_str[USB_GADGET_MANUFACTURER_IDX].s == cdev->def_manufacturer)
2181         dev_str[USB_GADGET_MANUFACTURER_IDX].s = "";
2182 
2183     kfree(cdev->def_manufacturer);
2184     kfree(cdev);
2185     set_gadget_data(gadget, NULL);
2186 }
2187 
2188 static void composite_unbind(struct usb_gadget *gadget)
2189 {
2190     __composite_unbind(gadget, true);
2191 }
2192 
2193 static void update_unchanged_dev_desc(struct usb_device_descriptor *new,
2194         const struct usb_device_descriptor *old)
2195 {
2196     __le16 idVendor;
2197     __le16 idProduct;
2198     __le16 bcdDevice;
2199     u8 iSerialNumber;
2200     u8 iManufacturer;
2201     u8 iProduct;
2202 
2203     /*
2204      * these variables may have been set in
2205      * usb_composite_overwrite_options()
2206      */
2207     idVendor = new->idVendor;
2208     idProduct = new->idProduct;
2209     bcdDevice = new->bcdDevice;
2210     iSerialNumber = new->iSerialNumber;
2211     iManufacturer = new->iManufacturer;
2212     iProduct = new->iProduct;
2213 
2214     *new = *old;
2215     if (idVendor)
2216         new->idVendor = idVendor;
2217     if (idProduct)
2218         new->idProduct = idProduct;
2219     if (bcdDevice)
2220         new->bcdDevice = bcdDevice;
2221     else
2222         new->bcdDevice = cpu_to_le16(get_default_bcdDevice());
2223     if (iSerialNumber)
2224         new->iSerialNumber = iSerialNumber;
2225     if (iManufacturer)
2226         new->iManufacturer = iManufacturer;
2227     if (iProduct)
2228         new->iProduct = iProduct;
2229 }
2230 
2231 int composite_dev_prepare(struct usb_composite_driver *composite,
2232         struct usb_composite_dev *cdev)
2233 {
2234     struct usb_gadget *gadget = cdev->gadget;
2235     int ret = -ENOMEM;
2236 
2237     /* preallocate control response and buffer */
2238     cdev->req = usb_ep_alloc_request(gadget->ep0, GFP_KERNEL);
2239     if (!cdev->req)
2240         return -ENOMEM;
2241 
2242     cdev->req->buf = kzalloc(USB_COMP_EP0_BUFSIZ, GFP_KERNEL);
2243     if (!cdev->req->buf)
2244         goto fail;
2245 
2246     ret = device_create_file(&gadget->dev, &dev_attr_suspended);
2247     if (ret)
2248         goto fail_dev;
2249 
2250     cdev->req->complete = composite_setup_complete;
2251     cdev->req->context = cdev;
2252     gadget->ep0->driver_data = cdev;
2253 
2254     cdev->driver = composite;
2255 
2256     /*
2257      * As per USB compliance update, a device that is actively drawing
2258      * more than 100mA from USB must report itself as bus-powered in
2259      * the GetStatus(DEVICE) call.
2260      */
2261     if (CONFIG_USB_GADGET_VBUS_DRAW <= USB_SELF_POWER_VBUS_MAX_DRAW)
2262         usb_gadget_set_selfpowered(gadget);
2263 
2264     /* interface and string IDs start at zero via kzalloc.
2265      * we force endpoints to start unassigned; few controller
2266      * drivers will zero ep->driver_data.
2267      */
2268     usb_ep_autoconfig_reset(gadget);
2269     return 0;
2270 fail_dev:
2271     kfree(cdev->req->buf);
2272 fail:
2273     usb_ep_free_request(gadget->ep0, cdev->req);
2274     cdev->req = NULL;
2275     return ret;
2276 }
2277 
2278 int composite_os_desc_req_prepare(struct usb_composite_dev *cdev,
2279                   struct usb_ep *ep0)
2280 {
2281     int ret = 0;
2282 
2283     cdev->os_desc_req = usb_ep_alloc_request(ep0, GFP_KERNEL);
2284     if (!cdev->os_desc_req) {
2285         ret = -ENOMEM;
2286         goto end;
2287     }
2288 
2289     cdev->os_desc_req->buf = kmalloc(USB_COMP_EP0_OS_DESC_BUFSIZ,
2290                      GFP_KERNEL);
2291     if (!cdev->os_desc_req->buf) {
2292         ret = -ENOMEM;
2293         usb_ep_free_request(ep0, cdev->os_desc_req);
2294         goto end;
2295     }
2296     cdev->os_desc_req->context = cdev;
2297     cdev->os_desc_req->complete = composite_setup_complete;
2298 end:
2299     return ret;
2300 }
2301 
2302 void composite_dev_cleanup(struct usb_composite_dev *cdev)
2303 {
2304     struct usb_gadget_string_container *uc, *tmp;
2305     struct usb_ep              *ep, *tmp_ep;
2306 
2307     list_for_each_entry_safe(uc, tmp, &cdev->gstrings, list) {
2308         list_del(&uc->list);
2309         kfree(uc);
2310     }
2311     if (cdev->os_desc_req) {
2312         if (cdev->os_desc_pending)
2313             usb_ep_dequeue(cdev->gadget->ep0, cdev->os_desc_req);
2314 
2315         kfree(cdev->os_desc_req->buf);
2316         cdev->os_desc_req->buf = NULL;
2317         usb_ep_free_request(cdev->gadget->ep0, cdev->os_desc_req);
2318         cdev->os_desc_req = NULL;
2319     }
2320     if (cdev->req) {
2321         if (cdev->setup_pending)
2322             usb_ep_dequeue(cdev->gadget->ep0, cdev->req);
2323 
2324         kfree(cdev->req->buf);
2325         cdev->req->buf = NULL;
2326         usb_ep_free_request(cdev->gadget->ep0, cdev->req);
2327         cdev->req = NULL;
2328     }
2329     cdev->next_string_id = 0;
2330     device_remove_file(&cdev->gadget->dev, &dev_attr_suspended);
2331 
2332     /*
2333      * Some UDC backends have a dynamic EP allocation scheme.
2334      *
2335      * In that case, the dispose() callback is used to notify the
2336      * backend that the EPs are no longer in use.
2337      *
2338      * Note: The UDC backend can remove the EP from the ep_list as
2339      *   a result, so we need to use the _safe list iterator.
2340      */
2341     list_for_each_entry_safe(ep, tmp_ep,
2342                  &cdev->gadget->ep_list, ep_list) {
2343         if (ep->ops->dispose)
2344             ep->ops->dispose(ep);
2345     }
2346 }
2347 
2348 static int composite_bind(struct usb_gadget *gadget,
2349         struct usb_gadget_driver *gdriver)
2350 {
2351     struct usb_composite_dev    *cdev;
2352     struct usb_composite_driver *composite = to_cdriver(gdriver);
2353     int             status = -ENOMEM;
2354 
2355     cdev = kzalloc(sizeof *cdev, GFP_KERNEL);
2356     if (!cdev)
2357         return status;
2358 
2359     spin_lock_init(&cdev->lock);
2360     cdev->gadget = gadget;
2361     set_gadget_data(gadget, cdev);
2362     INIT_LIST_HEAD(&cdev->configs);
2363     INIT_LIST_HEAD(&cdev->gstrings);
2364 
2365     status = composite_dev_prepare(composite, cdev);
2366     if (status)
2367         goto fail;
2368 
2369     /* composite gadget needs to assign strings for whole device (like
2370      * serial number), register function drivers, potentially update
2371      * power state and consumption, etc
2372      */
2373     status = composite->bind(cdev);
2374     if (status < 0)
2375         goto fail;
2376 
2377     if (cdev->use_os_string) {
2378         status = composite_os_desc_req_prepare(cdev, gadget->ep0);
2379         if (status)
2380             goto fail;
2381     }
2382 
2383     update_unchanged_dev_desc(&cdev->desc, composite->dev);
2384 
2385     /* has userspace failed to provide a serial number? */
2386     if (composite->needs_serial && !cdev->desc.iSerialNumber)
2387         WARNING(cdev, "userspace failed to provide iSerialNumber\n");
2388 
2389     INFO(cdev, "%s ready\n", composite->name);
2390     return 0;
2391 
2392 fail:
2393     __composite_unbind(gadget, false);
2394     return status;
2395 }
2396 
2397 /*-------------------------------------------------------------------------*/
2398 
2399 void composite_suspend(struct usb_gadget *gadget)
2400 {
2401     struct usb_composite_dev    *cdev = get_gadget_data(gadget);
2402     struct usb_function     *f;
2403 
2404     /* REVISIT:  should we have config level
2405      * suspend/resume callbacks?
2406      */
2407     DBG(cdev, "suspend\n");
2408     if (cdev->config) {
2409         list_for_each_entry(f, &cdev->config->functions, list) {
2410             if (f->suspend)
2411                 f->suspend(f);
2412         }
2413     }
2414     if (cdev->driver->suspend)
2415         cdev->driver->suspend(cdev);
2416 
2417     cdev->suspended = 1;
2418 
2419     usb_gadget_set_selfpowered(gadget);
2420     usb_gadget_vbus_draw(gadget, 2);
2421 }
2422 
2423 void composite_resume(struct usb_gadget *gadget)
2424 {
2425     struct usb_composite_dev    *cdev = get_gadget_data(gadget);
2426     struct usb_function     *f;
2427     unsigned            maxpower;
2428 
2429     /* REVISIT:  should we have config level
2430      * suspend/resume callbacks?
2431      */
2432     DBG(cdev, "resume\n");
2433     if (cdev->driver->resume)
2434         cdev->driver->resume(cdev);
2435     if (cdev->config) {
2436         list_for_each_entry(f, &cdev->config->functions, list) {
2437             if (f->resume)
2438                 f->resume(f);
2439         }
2440 
2441         maxpower = cdev->config->MaxPower ?
2442             cdev->config->MaxPower : CONFIG_USB_GADGET_VBUS_DRAW;
2443         if (gadget->speed < USB_SPEED_SUPER)
2444             maxpower = min(maxpower, 500U);
2445         else
2446             maxpower = min(maxpower, 900U);
2447 
2448         if (maxpower > USB_SELF_POWER_VBUS_MAX_DRAW)
2449             usb_gadget_clear_selfpowered(gadget);
2450 
2451         usb_gadget_vbus_draw(gadget, maxpower);
2452     }
2453 
2454     cdev->suspended = 0;
2455 }
2456 
2457 /*-------------------------------------------------------------------------*/
2458 
2459 static const struct usb_gadget_driver composite_driver_template = {
2460     .bind       = composite_bind,
2461     .unbind     = composite_unbind,
2462 
2463     .setup      = composite_setup,
2464     .reset      = composite_reset,
2465     .disconnect = composite_disconnect,
2466 
2467     .suspend    = composite_suspend,
2468     .resume     = composite_resume,
2469 
2470     .driver = {
2471         .owner      = THIS_MODULE,
2472     },
2473 };
2474 
2475 /**
2476  * usb_composite_probe() - register a composite driver
2477  * @driver: the driver to register
2478  *
2479  * Context: single threaded during gadget setup
2480  *
2481  * This function is used to register drivers using the composite driver
2482  * framework.  The return value is zero, or a negative errno value.
2483  * Those values normally come from the driver's @bind method, which does
2484  * all the work of setting up the driver to match the hardware.
2485  *
2486  * On successful return, the gadget is ready to respond to requests from
2487  * the host, unless one of its components invokes usb_gadget_disconnect()
2488  * while it was binding.  That would usually be done in order to wait for
2489  * some userspace participation.
2490  */
2491 int usb_composite_probe(struct usb_composite_driver *driver)
2492 {
2493     struct usb_gadget_driver *gadget_driver;
2494 
2495     if (!driver || !driver->dev || !driver->bind)
2496         return -EINVAL;
2497 
2498     if (!driver->name)
2499         driver->name = "composite";
2500 
2501     driver->gadget_driver = composite_driver_template;
2502     gadget_driver = &driver->gadget_driver;
2503 
2504     gadget_driver->function =  (char *) driver->name;
2505     gadget_driver->driver.name = driver->name;
2506     gadget_driver->max_speed = driver->max_speed;
2507 
2508     return usb_gadget_register_driver(gadget_driver);
2509 }
2510 EXPORT_SYMBOL_GPL(usb_composite_probe);
2511 
2512 /**
2513  * usb_composite_unregister() - unregister a composite driver
2514  * @driver: the driver to unregister
2515  *
2516  * This function is used to unregister drivers using the composite
2517  * driver framework.
2518  */
2519 void usb_composite_unregister(struct usb_composite_driver *driver)
2520 {
2521     usb_gadget_unregister_driver(&driver->gadget_driver);
2522 }
2523 EXPORT_SYMBOL_GPL(usb_composite_unregister);
2524 
2525 /**
2526  * usb_composite_setup_continue() - Continue with the control transfer
2527  * @cdev: the composite device who's control transfer was kept waiting
2528  *
2529  * This function must be called by the USB function driver to continue
2530  * with the control transfer's data/status stage in case it had requested to
2531  * delay the data/status stages. A USB function's setup handler (e.g. set_alt())
2532  * can request the composite framework to delay the setup request's data/status
2533  * stages by returning USB_GADGET_DELAYED_STATUS.
2534  */
2535 void usb_composite_setup_continue(struct usb_composite_dev *cdev)
2536 {
2537     int         value;
2538     struct usb_request  *req = cdev->req;
2539     unsigned long       flags;
2540 
2541     DBG(cdev, "%s\n", __func__);
2542     spin_lock_irqsave(&cdev->lock, flags);
2543 
2544     if (cdev->delayed_status == 0) {
2545         WARN(cdev, "%s: Unexpected call\n", __func__);
2546 
2547     } else if (--cdev->delayed_status == 0) {
2548         DBG(cdev, "%s: Completing delayed status\n", __func__);
2549         req->length = 0;
2550         req->context = cdev;
2551         value = composite_ep0_queue(cdev, req, GFP_ATOMIC);
2552         if (value < 0) {
2553             DBG(cdev, "ep_queue --> %d\n", value);
2554             req->status = 0;
2555             composite_setup_complete(cdev->gadget->ep0, req);
2556         }
2557     }
2558 
2559     spin_unlock_irqrestore(&cdev->lock, flags);
2560 }
2561 EXPORT_SYMBOL_GPL(usb_composite_setup_continue);
2562 
2563 static char *composite_default_mfr(struct usb_gadget *gadget)
2564 {
2565     return kasprintf(GFP_KERNEL, "%s %s with %s", init_utsname()->sysname,
2566              init_utsname()->release, gadget->name);
2567 }
2568 
2569 void usb_composite_overwrite_options(struct usb_composite_dev *cdev,
2570         struct usb_composite_overwrite *covr)
2571 {
2572     struct usb_device_descriptor    *desc = &cdev->desc;
2573     struct usb_gadget_strings   *gstr = cdev->driver->strings[0];
2574     struct usb_string       *dev_str = gstr->strings;
2575 
2576     if (covr->idVendor)
2577         desc->idVendor = cpu_to_le16(covr->idVendor);
2578 
2579     if (covr->idProduct)
2580         desc->idProduct = cpu_to_le16(covr->idProduct);
2581 
2582     if (covr->bcdDevice)
2583         desc->bcdDevice = cpu_to_le16(covr->bcdDevice);
2584 
2585     if (covr->serial_number) {
2586         desc->iSerialNumber = dev_str[USB_GADGET_SERIAL_IDX].id;
2587         dev_str[USB_GADGET_SERIAL_IDX].s = covr->serial_number;
2588     }
2589     if (covr->manufacturer) {
2590         desc->iManufacturer = dev_str[USB_GADGET_MANUFACTURER_IDX].id;
2591         dev_str[USB_GADGET_MANUFACTURER_IDX].s = covr->manufacturer;
2592 
2593     } else if (!strlen(dev_str[USB_GADGET_MANUFACTURER_IDX].s)) {
2594         desc->iManufacturer = dev_str[USB_GADGET_MANUFACTURER_IDX].id;
2595         cdev->def_manufacturer = composite_default_mfr(cdev->gadget);
2596         dev_str[USB_GADGET_MANUFACTURER_IDX].s = cdev->def_manufacturer;
2597     }
2598 
2599     if (covr->product) {
2600         desc->iProduct = dev_str[USB_GADGET_PRODUCT_IDX].id;
2601         dev_str[USB_GADGET_PRODUCT_IDX].s = covr->product;
2602     }
2603 }
2604 EXPORT_SYMBOL_GPL(usb_composite_overwrite_options);
2605 
2606 MODULE_LICENSE("GPL");
2607 MODULE_AUTHOR("David Brownell");