1 /*
2  * f_acm.c -- USB CDC serial (ACM) function driver
3  *
4  * Copyright (C) 2003 Al Borchers (alborchers@steinerpoint.com)
5  * Copyright (C) 2008 by David Brownell
6  * Copyright (C) 2008 by Nokia Corporation
7  * Copyright (C) 2009 by Samsung Electronics
8  * Author: Michal Nazarewicz (mina86@mina86.com)
9  *
10  * This software is distributed under the terms of the GNU General
11  * Public License ("GPL") as published by the Free Software Foundation,
12  * either version 2 of that License or (at your option) any later version.
13  */
14 
15 /* #define VERBOSE_DEBUG */
16 
17 #include <linux/slab.h>
18 #include <linux/kernel.h>
19 #include <linux/module.h>
20 #include <linux/device.h>
21 #include <linux/err.h>
22 
23 #include "u_serial.h"
24 #include "gadget_chips.h"
25 
26 
27 /*
28  * This CDC ACM function support just wraps control functions and
29  * notifications around the generic serial-over-usb code.
30  *
31  * Because CDC ACM is standardized by the USB-IF, many host operating
32  * systems have drivers for it.  Accordingly, ACM is the preferred
33  * interop solution for serial-port type connections.  The control
34  * models are often not necessary, and in any case don't do much in
35  * this bare-bones implementation.
36  *
37  * Note that even MS-Windows has some support for ACM.  However, that
38  * support is somewhat broken because when you use ACM in a composite
39  * device, having multiple interfaces confuses the poor OS.  It doesn't
40  * seem to understand CDC Union descriptors.  The new "association"
41  * descriptors (roughly equivalent to CDC Unions) may sometimes help.
42  */
43 
44 struct f_acm {
45 	struct gserial			port;
46 	u8				ctrl_id, data_id;
47 	u8				port_num;
48 
49 	u8				pending;
50 
51 	/* lock is mostly for pending and notify_req ... they get accessed
52 	 * by callbacks both from tty (open/close/break) under its spinlock,
53 	 * and notify_req.complete() which can't use that lock.
54 	 */
55 	spinlock_t			lock;
56 
57 	struct usb_ep			*notify;
58 	struct usb_request		*notify_req;
59 
60 	struct usb_cdc_line_coding	port_line_coding;	/* 8-N-1 etc */
61 
62 	/* SetControlLineState request -- CDC 1.1 section 6.2.14 (INPUT) */
63 	u16				port_handshake_bits;
64 #define ACM_CTRL_RTS	(1 << 1)	/* unused with full duplex */
65 #define ACM_CTRL_DTR	(1 << 0)	/* host is ready for data r/w */
66 
67 	/* SerialState notification -- CDC 1.1 section 6.3.5 (OUTPUT) */
68 	u16				serial_state;
69 #define ACM_CTRL_OVERRUN	(1 << 6)
70 #define ACM_CTRL_PARITY		(1 << 5)
71 #define ACM_CTRL_FRAMING	(1 << 4)
72 #define ACM_CTRL_RI		(1 << 3)
73 #define ACM_CTRL_BRK		(1 << 2)
74 #define ACM_CTRL_DSR		(1 << 1)
75 #define ACM_CTRL_DCD		(1 << 0)
76 };
77 
78 static inline struct f_acm *func_to_acm(struct usb_function *f)
79 {
80 	return container_of(f, struct f_acm, port.func);
81 }
82 
83 static inline struct f_acm *port_to_acm(struct gserial *p)
84 {
85 	return container_of(p, struct f_acm, port);
86 }
87 
88 /*-------------------------------------------------------------------------*/
89 
90 /* notification endpoint uses smallish and infrequent fixed-size messages */
91 
92 #define GS_NOTIFY_INTERVAL_MS		32
93 #define GS_NOTIFY_MAXPACKET		10	/* notification + 2 bytes */
94 
95 /* interface and class descriptors: */
96 
97 static struct usb_interface_assoc_descriptor
98 acm_iad_descriptor = {
99 	.bLength =		sizeof acm_iad_descriptor,
100 	.bDescriptorType =	USB_DT_INTERFACE_ASSOCIATION,
101 
102 	/* .bFirstInterface =	DYNAMIC, */
103 	.bInterfaceCount = 	2,	// control + data
104 	.bFunctionClass =	USB_CLASS_COMM,
105 	.bFunctionSubClass =	USB_CDC_SUBCLASS_ACM,
106 	.bFunctionProtocol =	USB_CDC_ACM_PROTO_AT_V25TER,
107 	/* .iFunction =		DYNAMIC */
108 };
109 
110 
111 static struct usb_interface_descriptor acm_control_interface_desc = {
112 	.bLength =		USB_DT_INTERFACE_SIZE,
113 	.bDescriptorType =	USB_DT_INTERFACE,
114 	/* .bInterfaceNumber = DYNAMIC */
115 	.bNumEndpoints =	1,
116 	.bInterfaceClass =	USB_CLASS_COMM,
117 	.bInterfaceSubClass =	USB_CDC_SUBCLASS_ACM,
118 	.bInterfaceProtocol =	USB_CDC_ACM_PROTO_AT_V25TER,
119 	/* .iInterface = DYNAMIC */
120 };
121 
122 static struct usb_interface_descriptor acm_data_interface_desc = {
123 	.bLength =		USB_DT_INTERFACE_SIZE,
124 	.bDescriptorType =	USB_DT_INTERFACE,
125 	/* .bInterfaceNumber = DYNAMIC */
126 	.bNumEndpoints =	2,
127 	.bInterfaceClass =	USB_CLASS_CDC_DATA,
128 	.bInterfaceSubClass =	0,
129 	.bInterfaceProtocol =	0,
130 	/* .iInterface = DYNAMIC */
131 };
132 
133 static struct usb_cdc_header_desc acm_header_desc = {
134 	.bLength =		sizeof(acm_header_desc),
135 	.bDescriptorType =	USB_DT_CS_INTERFACE,
136 	.bDescriptorSubType =	USB_CDC_HEADER_TYPE,
137 	.bcdCDC =		cpu_to_le16(0x0110),
138 };
139 
140 static struct usb_cdc_call_mgmt_descriptor
141 acm_call_mgmt_descriptor = {
142 	.bLength =		sizeof(acm_call_mgmt_descriptor),
143 	.bDescriptorType =	USB_DT_CS_INTERFACE,
144 	.bDescriptorSubType =	USB_CDC_CALL_MANAGEMENT_TYPE,
145 	.bmCapabilities =	0,
146 	/* .bDataInterface = DYNAMIC */
147 };
148 
149 static struct usb_cdc_acm_descriptor acm_descriptor = {
150 	.bLength =		sizeof(acm_descriptor),
151 	.bDescriptorType =	USB_DT_CS_INTERFACE,
152 	.bDescriptorSubType =	USB_CDC_ACM_TYPE,
153 	.bmCapabilities =	USB_CDC_CAP_LINE,
154 };
155 
156 static struct usb_cdc_union_desc acm_union_desc = {
157 	.bLength =		sizeof(acm_union_desc),
158 	.bDescriptorType =	USB_DT_CS_INTERFACE,
159 	.bDescriptorSubType =	USB_CDC_UNION_TYPE,
160 	/* .bMasterInterface0 =	DYNAMIC */
161 	/* .bSlaveInterface0 =	DYNAMIC */
162 };
163 
164 /* full speed support: */
165 
166 static struct usb_endpoint_descriptor acm_fs_notify_desc = {
167 	.bLength =		USB_DT_ENDPOINT_SIZE,
168 	.bDescriptorType =	USB_DT_ENDPOINT,
169 	.bEndpointAddress =	USB_DIR_IN,
170 	.bmAttributes =		USB_ENDPOINT_XFER_INT,
171 	.wMaxPacketSize =	cpu_to_le16(GS_NOTIFY_MAXPACKET),
172 	.bInterval =		GS_NOTIFY_INTERVAL_MS,
173 };
174 
175 static struct usb_endpoint_descriptor acm_fs_in_desc = {
176 	.bLength =		USB_DT_ENDPOINT_SIZE,
177 	.bDescriptorType =	USB_DT_ENDPOINT,
178 	.bEndpointAddress =	USB_DIR_IN,
179 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
180 };
181 
182 static struct usb_endpoint_descriptor acm_fs_out_desc = {
183 	.bLength =		USB_DT_ENDPOINT_SIZE,
184 	.bDescriptorType =	USB_DT_ENDPOINT,
185 	.bEndpointAddress =	USB_DIR_OUT,
186 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
187 };
188 
189 static struct usb_descriptor_header *acm_fs_function[] = {
190 	(struct usb_descriptor_header *) &acm_iad_descriptor,
191 	(struct usb_descriptor_header *) &acm_control_interface_desc,
192 	(struct usb_descriptor_header *) &acm_header_desc,
193 	(struct usb_descriptor_header *) &acm_call_mgmt_descriptor,
194 	(struct usb_descriptor_header *) &acm_descriptor,
195 	(struct usb_descriptor_header *) &acm_union_desc,
196 	(struct usb_descriptor_header *) &acm_fs_notify_desc,
197 	(struct usb_descriptor_header *) &acm_data_interface_desc,
198 	(struct usb_descriptor_header *) &acm_fs_in_desc,
199 	(struct usb_descriptor_header *) &acm_fs_out_desc,
200 	NULL,
201 };
202 
203 /* high speed support: */
204 static struct usb_endpoint_descriptor acm_hs_notify_desc = {
205 	.bLength =		USB_DT_ENDPOINT_SIZE,
206 	.bDescriptorType =	USB_DT_ENDPOINT,
207 	.bEndpointAddress =	USB_DIR_IN,
208 	.bmAttributes =		USB_ENDPOINT_XFER_INT,
209 	.wMaxPacketSize =	cpu_to_le16(GS_NOTIFY_MAXPACKET),
210 	.bInterval =		USB_MS_TO_HS_INTERVAL(GS_NOTIFY_INTERVAL_MS),
211 };
212 
213 static struct usb_endpoint_descriptor acm_hs_in_desc = {
214 	.bLength =		USB_DT_ENDPOINT_SIZE,
215 	.bDescriptorType =	USB_DT_ENDPOINT,
216 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
217 	.wMaxPacketSize =	cpu_to_le16(512),
218 };
219 
220 static struct usb_endpoint_descriptor acm_hs_out_desc = {
221 	.bLength =		USB_DT_ENDPOINT_SIZE,
222 	.bDescriptorType =	USB_DT_ENDPOINT,
223 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
224 	.wMaxPacketSize =	cpu_to_le16(512),
225 };
226 
227 static struct usb_descriptor_header *acm_hs_function[] = {
228 	(struct usb_descriptor_header *) &acm_iad_descriptor,
229 	(struct usb_descriptor_header *) &acm_control_interface_desc,
230 	(struct usb_descriptor_header *) &acm_header_desc,
231 	(struct usb_descriptor_header *) &acm_call_mgmt_descriptor,
232 	(struct usb_descriptor_header *) &acm_descriptor,
233 	(struct usb_descriptor_header *) &acm_union_desc,
234 	(struct usb_descriptor_header *) &acm_hs_notify_desc,
235 	(struct usb_descriptor_header *) &acm_data_interface_desc,
236 	(struct usb_descriptor_header *) &acm_hs_in_desc,
237 	(struct usb_descriptor_header *) &acm_hs_out_desc,
238 	NULL,
239 };
240 
241 static struct usb_endpoint_descriptor acm_ss_in_desc = {
242 	.bLength =		USB_DT_ENDPOINT_SIZE,
243 	.bDescriptorType =	USB_DT_ENDPOINT,
244 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
245 	.wMaxPacketSize =	cpu_to_le16(1024),
246 };
247 
248 static struct usb_endpoint_descriptor acm_ss_out_desc = {
249 	.bLength =		USB_DT_ENDPOINT_SIZE,
250 	.bDescriptorType =	USB_DT_ENDPOINT,
251 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
252 	.wMaxPacketSize =	cpu_to_le16(1024),
253 };
254 
255 static struct usb_ss_ep_comp_descriptor acm_ss_bulk_comp_desc = {
256 	.bLength =              sizeof acm_ss_bulk_comp_desc,
257 	.bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
258 };
259 
260 static struct usb_descriptor_header *acm_ss_function[] = {
261 	(struct usb_descriptor_header *) &acm_iad_descriptor,
262 	(struct usb_descriptor_header *) &acm_control_interface_desc,
263 	(struct usb_descriptor_header *) &acm_header_desc,
264 	(struct usb_descriptor_header *) &acm_call_mgmt_descriptor,
265 	(struct usb_descriptor_header *) &acm_descriptor,
266 	(struct usb_descriptor_header *) &acm_union_desc,
267 	(struct usb_descriptor_header *) &acm_hs_notify_desc,
268 	(struct usb_descriptor_header *) &acm_ss_bulk_comp_desc,
269 	(struct usb_descriptor_header *) &acm_data_interface_desc,
270 	(struct usb_descriptor_header *) &acm_ss_in_desc,
271 	(struct usb_descriptor_header *) &acm_ss_bulk_comp_desc,
272 	(struct usb_descriptor_header *) &acm_ss_out_desc,
273 	(struct usb_descriptor_header *) &acm_ss_bulk_comp_desc,
274 	NULL,
275 };
276 
277 /* string descriptors: */
278 
279 #define ACM_CTRL_IDX	0
280 #define ACM_DATA_IDX	1
281 #define ACM_IAD_IDX	2
282 
283 /* static strings, in UTF-8 */
284 static struct usb_string acm_string_defs[] = {
285 	[ACM_CTRL_IDX].s = "CDC Abstract Control Model (ACM)",
286 	[ACM_DATA_IDX].s = "CDC ACM Data",
287 	[ACM_IAD_IDX ].s = "CDC Serial",
288 	{  } /* end of list */
289 };
290 
291 static struct usb_gadget_strings acm_string_table = {
292 	.language =		0x0409,	/* en-us */
293 	.strings =		acm_string_defs,
294 };
295 
296 static struct usb_gadget_strings *acm_strings[] = {
297 	&acm_string_table,
298 	NULL,
299 };
300 
301 /*-------------------------------------------------------------------------*/
302 
303 /* ACM control ... data handling is delegated to tty library code.
304  * The main task of this function is to activate and deactivate
305  * that code based on device state; track parameters like line
306  * speed, handshake state, and so on; and issue notifications.
307  */
308 
309 static void acm_complete_set_line_coding(struct usb_ep *ep,
310 		struct usb_request *req)
311 {
312 	struct f_acm	*acm = ep->driver_data;
313 	struct usb_composite_dev *cdev = acm->port.func.config->cdev;
314 
315 	if (req->status != 0) {
316 		dev_dbg(&cdev->gadget->dev, "acm ttyGS%d completion, err %d\n",
317 			acm->port_num, req->status);
318 		return;
319 	}
320 
321 	/* normal completion */
322 	if (req->actual != sizeof(acm->port_line_coding)) {
323 		dev_dbg(&cdev->gadget->dev, "acm ttyGS%d short resp, len %d\n",
324 			acm->port_num, req->actual);
325 		usb_ep_set_halt(ep);
326 	} else {
327 		struct usb_cdc_line_coding	*value = req->buf;
328 
329 		/* REVISIT:  we currently just remember this data.
330 		 * If we change that, (a) validate it first, then
331 		 * (b) update whatever hardware needs updating,
332 		 * (c) worry about locking.  This is information on
333 		 * the order of 9600-8-N-1 ... most of which means
334 		 * nothing unless we control a real RS232 line.
335 		 */
336 		acm->port_line_coding = *value;
337 	}
338 }
339 
340 static int acm_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
341 {
342 	struct f_acm		*acm = func_to_acm(f);
343 	struct usb_composite_dev *cdev = f->config->cdev;
344 	struct usb_request	*req = cdev->req;
345 	int			value = -EOPNOTSUPP;
346 	u16			w_index = le16_to_cpu(ctrl->wIndex);
347 	u16			w_value = le16_to_cpu(ctrl->wValue);
348 	u16			w_length = le16_to_cpu(ctrl->wLength);
349 
350 	/* composite driver infrastructure handles everything except
351 	 * CDC class messages; interface activation uses set_alt().
352 	 *
353 	 * Note CDC spec table 4 lists the ACM request profile.  It requires
354 	 * encapsulated command support ... we don't handle any, and respond
355 	 * to them by stalling.  Options include get/set/clear comm features
356 	 * (not that useful) and SEND_BREAK.
357 	 */
358 	switch ((ctrl->bRequestType << 8) | ctrl->bRequest) {
359 
360 	/* SET_LINE_CODING ... just read and save what the host sends */
361 	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
362 			| USB_CDC_REQ_SET_LINE_CODING:
363 		if (w_length != sizeof(struct usb_cdc_line_coding)
364 				|| w_index != acm->ctrl_id)
365 			goto invalid;
366 
367 		value = w_length;
368 		cdev->gadget->ep0->driver_data = acm;
369 		req->complete = acm_complete_set_line_coding;
370 		break;
371 
372 	/* GET_LINE_CODING ... return what host sent, or initial value */
373 	case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
374 			| USB_CDC_REQ_GET_LINE_CODING:
375 		if (w_index != acm->ctrl_id)
376 			goto invalid;
377 
378 		value = min_t(unsigned, w_length,
379 				sizeof(struct usb_cdc_line_coding));
380 		memcpy(req->buf, &acm->port_line_coding, value);
381 		break;
382 
383 	/* SET_CONTROL_LINE_STATE ... save what the host sent */
384 	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
385 			| USB_CDC_REQ_SET_CONTROL_LINE_STATE:
386 		if (w_index != acm->ctrl_id)
387 			goto invalid;
388 
389 		value = 0;
390 
391 		/* FIXME we should not allow data to flow until the
392 		 * host sets the ACM_CTRL_DTR bit; and when it clears
393 		 * that bit, we should return to that no-flow state.
394 		 */
395 		acm->port_handshake_bits = w_value;
396 		break;
397 
398 	default:
399 invalid:
400 		dev_vdbg(&cdev->gadget->dev,
401 			 "invalid control req%02x.%02x v%04x i%04x l%d\n",
402 			 ctrl->bRequestType, ctrl->bRequest,
403 			 w_value, w_index, w_length);
404 	}
405 
406 	/* respond with data transfer or status phase? */
407 	if (value >= 0) {
408 		dev_dbg(&cdev->gadget->dev,
409 			"acm ttyGS%d req%02x.%02x v%04x i%04x l%d\n",
410 			acm->port_num, ctrl->bRequestType, ctrl->bRequest,
411 			w_value, w_index, w_length);
412 		req->zero = 0;
413 		req->length = value;
414 		value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
415 		if (value < 0)
416 			ERROR(cdev, "acm response on ttyGS%d, err %d\n",
417 					acm->port_num, value);
418 	}
419 
420 	/* device either stalls (value < 0) or reports success */
421 	return value;
422 }
423 
424 static int acm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
425 {
426 	struct f_acm		*acm = func_to_acm(f);
427 	struct usb_composite_dev *cdev = f->config->cdev;
428 
429 	/* we know alt == 0, so this is an activation or a reset */
430 
431 	if (intf == acm->ctrl_id) {
432 		if (acm->notify->driver_data) {
433 			dev_vdbg(&cdev->gadget->dev,
434 				 "reset acm control interface %d\n", intf);
435 			usb_ep_disable(acm->notify);
436 		}
437 
438 		if (!acm->notify->desc)
439 			if (config_ep_by_speed(cdev->gadget, f, acm->notify))
440 				return -EINVAL;
441 
442 		usb_ep_enable(acm->notify);
443 		acm->notify->driver_data = acm;
444 
445 	} else if (intf == acm->data_id) {
446 		if (acm->port.in->driver_data) {
447 			dev_dbg(&cdev->gadget->dev,
448 				"reset acm ttyGS%d\n", acm->port_num);
449 			gserial_disconnect(&acm->port);
450 		}
451 		if (!acm->port.in->desc || !acm->port.out->desc) {
452 			dev_dbg(&cdev->gadget->dev,
453 				"activate acm ttyGS%d\n", acm->port_num);
454 			if (config_ep_by_speed(cdev->gadget, f,
455 					       acm->port.in) ||
456 			    config_ep_by_speed(cdev->gadget, f,
457 					       acm->port.out)) {
458 				acm->port.in->desc = NULL;
459 				acm->port.out->desc = NULL;
460 				return -EINVAL;
461 			}
462 		}
463 		gserial_connect(&acm->port, acm->port_num);
464 
465 	} else
466 		return -EINVAL;
467 
468 	return 0;
469 }
470 
471 static void acm_disable(struct usb_function *f)
472 {
473 	struct f_acm	*acm = func_to_acm(f);
474 	struct usb_composite_dev *cdev = f->config->cdev;
475 
476 	dev_dbg(&cdev->gadget->dev, "acm ttyGS%d deactivated\n", acm->port_num);
477 	gserial_disconnect(&acm->port);
478 	usb_ep_disable(acm->notify);
479 	acm->notify->driver_data = NULL;
480 }
481 
482 /*-------------------------------------------------------------------------*/
483 
484 /**
485  * acm_cdc_notify - issue CDC notification to host
486  * @acm: wraps host to be notified
487  * @type: notification type
488  * @value: Refer to cdc specs, wValue field.
489  * @data: data to be sent
490  * @length: size of data
491  * Context: irqs blocked, acm->lock held, acm_notify_req non-null
492  *
493  * Returns zero on success or a negative errno.
494  *
495  * See section 6.3.5 of the CDC 1.1 specification for information
496  * about the only notification we issue:  SerialState change.
497  */
498 static int acm_cdc_notify(struct f_acm *acm, u8 type, u16 value,
499 		void *data, unsigned length)
500 {
501 	struct usb_ep			*ep = acm->notify;
502 	struct usb_request		*req;
503 	struct usb_cdc_notification	*notify;
504 	const unsigned			len = sizeof(*notify) + length;
505 	void				*buf;
506 	int				status;
507 
508 	req = acm->notify_req;
509 	acm->notify_req = NULL;
510 	acm->pending = false;
511 
512 	req->length = len;
513 	notify = req->buf;
514 	buf = notify + 1;
515 
516 	notify->bmRequestType = USB_DIR_IN | USB_TYPE_CLASS
517 			| USB_RECIP_INTERFACE;
518 	notify->bNotificationType = type;
519 	notify->wValue = cpu_to_le16(value);
520 	notify->wIndex = cpu_to_le16(acm->ctrl_id);
521 	notify->wLength = cpu_to_le16(length);
522 	memcpy(buf, data, length);
523 
524 	/* ep_queue() can complete immediately if it fills the fifo... */
525 	spin_unlock(&acm->lock);
526 	status = usb_ep_queue(ep, req, GFP_ATOMIC);
527 	spin_lock(&acm->lock);
528 
529 	if (status < 0) {
530 		ERROR(acm->port.func.config->cdev,
531 				"acm ttyGS%d can't notify serial state, %d\n",
532 				acm->port_num, status);
533 		acm->notify_req = req;
534 	}
535 
536 	return status;
537 }
538 
539 static int acm_notify_serial_state(struct f_acm *acm)
540 {
541 	struct usb_composite_dev *cdev = acm->port.func.config->cdev;
542 	int			status;
543 
544 	spin_lock(&acm->lock);
545 	if (acm->notify_req) {
546 		dev_dbg(&cdev->gadget->dev, "acm ttyGS%d serial state %04x\n",
547 			acm->port_num, acm->serial_state);
548 		status = acm_cdc_notify(acm, USB_CDC_NOTIFY_SERIAL_STATE,
549 				0, &acm->serial_state, sizeof(acm->serial_state));
550 	} else {
551 		acm->pending = true;
552 		status = 0;
553 	}
554 	spin_unlock(&acm->lock);
555 	return status;
556 }
557 
558 static void acm_cdc_notify_complete(struct usb_ep *ep, struct usb_request *req)
559 {
560 	struct f_acm		*acm = req->context;
561 	u8			doit = false;
562 
563 	/* on this call path we do NOT hold the port spinlock,
564 	 * which is why ACM needs its own spinlock
565 	 */
566 	spin_lock(&acm->lock);
567 	if (req->status != -ESHUTDOWN)
568 		doit = acm->pending;
569 	acm->notify_req = req;
570 	spin_unlock(&acm->lock);
571 
572 	if (doit)
573 		acm_notify_serial_state(acm);
574 }
575 
576 /* connect == the TTY link is open */
577 
578 static void acm_connect(struct gserial *port)
579 {
580 	struct f_acm		*acm = port_to_acm(port);
581 
582 	acm->serial_state |= ACM_CTRL_DSR | ACM_CTRL_DCD;
583 	acm_notify_serial_state(acm);
584 }
585 
586 static void acm_disconnect(struct gserial *port)
587 {
588 	struct f_acm		*acm = port_to_acm(port);
589 
590 	acm->serial_state &= ~(ACM_CTRL_DSR | ACM_CTRL_DCD);
591 	acm_notify_serial_state(acm);
592 }
593 
594 static int acm_send_break(struct gserial *port, int duration)
595 {
596 	struct f_acm		*acm = port_to_acm(port);
597 	u16			state;
598 
599 	state = acm->serial_state;
600 	state &= ~ACM_CTRL_BRK;
601 	if (duration)
602 		state |= ACM_CTRL_BRK;
603 
604 	acm->serial_state = state;
605 	return acm_notify_serial_state(acm);
606 }
607 
608 /*-------------------------------------------------------------------------*/
609 
610 /* ACM function driver setup/binding */
611 static int
612 acm_bind(struct usb_configuration *c, struct usb_function *f)
613 {
614 	struct usb_composite_dev *cdev = c->cdev;
615 	struct f_acm		*acm = func_to_acm(f);
616 	struct usb_string	*us;
617 	int			status;
618 	struct usb_ep		*ep;
619 
620 	/* REVISIT might want instance-specific strings to help
621 	 * distinguish instances ...
622 	 */
623 
624 	/* maybe allocate device-global string IDs, and patch descriptors */
625 	us = usb_gstrings_attach(cdev, acm_strings,
626 			ARRAY_SIZE(acm_string_defs));
627 	if (IS_ERR(us))
628 		return PTR_ERR(us);
629 	acm_control_interface_desc.iInterface = us[ACM_CTRL_IDX].id;
630 	acm_data_interface_desc.iInterface = us[ACM_DATA_IDX].id;
631 	acm_iad_descriptor.iFunction = us[ACM_IAD_IDX].id;
632 
633 	/* allocate instance-specific interface IDs, and patch descriptors */
634 	status = usb_interface_id(c, f);
635 	if (status < 0)
636 		goto fail;
637 	acm->ctrl_id = status;
638 	acm_iad_descriptor.bFirstInterface = status;
639 
640 	acm_control_interface_desc.bInterfaceNumber = status;
641 	acm_union_desc .bMasterInterface0 = status;
642 
643 	status = usb_interface_id(c, f);
644 	if (status < 0)
645 		goto fail;
646 	acm->data_id = status;
647 
648 	acm_data_interface_desc.bInterfaceNumber = status;
649 	acm_union_desc.bSlaveInterface0 = status;
650 	acm_call_mgmt_descriptor.bDataInterface = status;
651 
652 	status = -ENODEV;
653 
654 	/* allocate instance-specific endpoints */
655 	ep = usb_ep_autoconfig(cdev->gadget, &acm_fs_in_desc);
656 	if (!ep)
657 		goto fail;
658 	acm->port.in = ep;
659 	ep->driver_data = cdev;	/* claim */
660 
661 	ep = usb_ep_autoconfig(cdev->gadget, &acm_fs_out_desc);
662 	if (!ep)
663 		goto fail;
664 	acm->port.out = ep;
665 	ep->driver_data = cdev;	/* claim */
666 
667 	ep = usb_ep_autoconfig(cdev->gadget, &acm_fs_notify_desc);
668 	if (!ep)
669 		goto fail;
670 	acm->notify = ep;
671 	ep->driver_data = cdev;	/* claim */
672 
673 	/* allocate notification */
674 	acm->notify_req = gs_alloc_req(ep,
675 			sizeof(struct usb_cdc_notification) + 2,
676 			GFP_KERNEL);
677 	if (!acm->notify_req)
678 		goto fail;
679 
680 	acm->notify_req->complete = acm_cdc_notify_complete;
681 	acm->notify_req->context = acm;
682 
683 	/* support all relevant hardware speeds... we expect that when
684 	 * hardware is dual speed, all bulk-capable endpoints work at
685 	 * both speeds
686 	 */
687 	acm_hs_in_desc.bEndpointAddress = acm_fs_in_desc.bEndpointAddress;
688 	acm_hs_out_desc.bEndpointAddress = acm_fs_out_desc.bEndpointAddress;
689 	acm_hs_notify_desc.bEndpointAddress =
690 		acm_fs_notify_desc.bEndpointAddress;
691 
692 	acm_ss_in_desc.bEndpointAddress = acm_fs_in_desc.bEndpointAddress;
693 	acm_ss_out_desc.bEndpointAddress = acm_fs_out_desc.bEndpointAddress;
694 
695 	status = usb_assign_descriptors(f, acm_fs_function, acm_hs_function,
696 			acm_ss_function);
697 	if (status)
698 		goto fail;
699 
700 	dev_dbg(&cdev->gadget->dev,
701 		"acm ttyGS%d: %s speed IN/%s OUT/%s NOTIFY/%s\n",
702 		acm->port_num,
703 		gadget_is_superspeed(c->cdev->gadget) ? "super" :
704 		gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
705 		acm->port.in->name, acm->port.out->name,
706 		acm->notify->name);
707 	return 0;
708 
709 fail:
710 	if (acm->notify_req)
711 		gs_free_req(acm->notify, acm->notify_req);
712 
713 	/* we might as well release our claims on endpoints */
714 	if (acm->notify)
715 		acm->notify->driver_data = NULL;
716 	if (acm->port.out)
717 		acm->port.out->driver_data = NULL;
718 	if (acm->port.in)
719 		acm->port.in->driver_data = NULL;
720 
721 	ERROR(cdev, "%s/%p: can't bind, err %d\n", f->name, f, status);
722 
723 	return status;
724 }
725 
726 static void acm_unbind(struct usb_configuration *c, struct usb_function *f)
727 {
728 	struct f_acm		*acm = func_to_acm(f);
729 
730 	acm_string_defs[0].id = 0;
731 	usb_free_all_descriptors(f);
732 	if (acm->notify_req)
733 		gs_free_req(acm->notify, acm->notify_req);
734 }
735 
736 static void acm_free_func(struct usb_function *f)
737 {
738 	struct f_acm		*acm = func_to_acm(f);
739 
740 	kfree(acm);
741 }
742 
743 static struct usb_function *acm_alloc_func(struct usb_function_instance *fi)
744 {
745 	struct f_serial_opts *opts;
746 	struct f_acm *acm;
747 
748 	acm = kzalloc(sizeof(*acm), GFP_KERNEL);
749 	if (!acm)
750 		return ERR_PTR(-ENOMEM);
751 
752 	spin_lock_init(&acm->lock);
753 
754 	acm->port.connect = acm_connect;
755 	acm->port.disconnect = acm_disconnect;
756 	acm->port.send_break = acm_send_break;
757 
758 	acm->port.func.name = "acm";
759 	acm->port.func.strings = acm_strings;
760 	/* descriptors are per-instance copies */
761 	acm->port.func.bind = acm_bind;
762 	acm->port.func.set_alt = acm_set_alt;
763 	acm->port.func.setup = acm_setup;
764 	acm->port.func.disable = acm_disable;
765 
766 	opts = container_of(fi, struct f_serial_opts, func_inst);
767 	acm->port_num = opts->port_num;
768 	acm->port.func.unbind = acm_unbind;
769 	acm->port.func.free_func = acm_free_func;
770 
771 	return &acm->port.func;
772 }
773 
774 static inline struct f_serial_opts *to_f_serial_opts(struct config_item *item)
775 {
776 	return container_of(to_config_group(item), struct f_serial_opts,
777 			func_inst.group);
778 }
779 
780 CONFIGFS_ATTR_STRUCT(f_serial_opts);
781 static ssize_t f_acm_attr_show(struct config_item *item,
782 				 struct configfs_attribute *attr,
783 				 char *page)
784 {
785 	struct f_serial_opts *opts = to_f_serial_opts(item);
786 	struct f_serial_opts_attribute *f_serial_opts_attr =
787 		container_of(attr, struct f_serial_opts_attribute, attr);
788 	ssize_t ret = 0;
789 
790 	if (f_serial_opts_attr->show)
791 		ret = f_serial_opts_attr->show(opts, page);
792 	return ret;
793 }
794 
795 static void acm_attr_release(struct config_item *item)
796 {
797 	struct f_serial_opts *opts = to_f_serial_opts(item);
798 
799 	usb_put_function_instance(&opts->func_inst);
800 }
801 
802 static struct configfs_item_operations acm_item_ops = {
803 	.release                = acm_attr_release,
804 	.show_attribute		= f_acm_attr_show,
805 };
806 
807 static ssize_t f_acm_port_num_show(struct f_serial_opts *opts, char *page)
808 {
809 	return sprintf(page, "%u\n", opts->port_num);
810 }
811 
812 static struct f_serial_opts_attribute f_acm_port_num =
813 	__CONFIGFS_ATTR_RO(port_num, f_acm_port_num_show);
814 
815 
816 static struct configfs_attribute *acm_attrs[] = {
817 	&f_acm_port_num.attr,
818 	NULL,
819 };
820 
821 static struct config_item_type acm_func_type = {
822 	.ct_item_ops    = &acm_item_ops,
823 	.ct_attrs	= acm_attrs,
824 	.ct_owner       = THIS_MODULE,
825 };
826 
827 static void acm_free_instance(struct usb_function_instance *fi)
828 {
829 	struct f_serial_opts *opts;
830 
831 	opts = container_of(fi, struct f_serial_opts, func_inst);
832 	gserial_free_line(opts->port_num);
833 	kfree(opts);
834 }
835 
836 static struct usb_function_instance *acm_alloc_instance(void)
837 {
838 	struct f_serial_opts *opts;
839 	int ret;
840 
841 	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
842 	if (!opts)
843 		return ERR_PTR(-ENOMEM);
844 	opts->func_inst.free_func_inst = acm_free_instance;
845 	ret = gserial_alloc_line(&opts->port_num);
846 	if (ret) {
847 		kfree(opts);
848 		return ERR_PTR(ret);
849 	}
850 	config_group_init_type_name(&opts->func_inst.group, "",
851 			&acm_func_type);
852 	return &opts->func_inst;
853 }
854 DECLARE_USB_FUNCTION_INIT(acm, acm_alloc_instance, acm_alloc_func);
855 MODULE_LICENSE("GPL");
856