pwJZDuzK

1--- a/drivers/usb/gadget/android.c	1970-01-01 08:00:00.000000000 +0800
2+++ b/drivers/usb/gadget/android.c	2018-01-01 11:47:40.926033796 +0800
3@@ -0,0 +1,4391 @@
4+/*
5+ * Gadget Driver for Android
6+ *
7+ * Copyright (C) 2008 Google, Inc.
8+ * Author: Mike Lockwood <lockwood@android.com>
9+ *         Benoit Goby <benoit@android.com>
10+ *
11+ * This software is licensed under the terms of the GNU General Public
12+ * License version 2, as published by the Free Software Foundation, and
13+ * may be copied, distributed, and modified under those terms.
14+ *
15+ * This program is distributed in the hope that it will be useful,
16+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
17+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18+ * GNU General Public License for more details.
19+ *
20+ */
21+
22+#include <linux/init.h>
23+#include <linux/module.h>
24+#include <linux/fs.h>
25+#include <linux/delay.h>
26+#include <linux/io.h>
27+#include <linux/kernel.h>
28+#include <linux/utsname.h>
29+#include <linux/platform_device.h>
30+#include <linux/pm_qos.h>
31+#include <linux/of.h>
32+
33+#include <linux/usb/ch9.h>
34+#include <linux/usb/composite.h>
35+#include <linux/usb/gadget.h>
36+#include <linux/usb/android.h>
37+
38+#include <linux/qcom/diag_dload.h>
39+
40+#include "gadget_chips.h"
41+
42+#include "u_fs.h"
43+#include "u_ecm.h"
44+#include "u_ncm.h"
45+#ifdef CONFIG_SND_RAWMIDI
46+#include "f_midi.c"
47+#endif
48+#include "f_diag.c"
49+#include "f_qdss.c"
50+#include "f_rmnet.c"
51+#include "f_gps.c"
52+#include "u_smd.c"
53+#include "u_data_bridge.c"
54+#include "u_bam.c"
55+#include "u_rmnet_ctrl_smd.c"
56+#include "u_ctrl_qti.c"
57+#include "u_ctrl_hsic.c"
58+#include "u_data_hsic.c"
59+#include "f_ccid.c"
60+#include "f_mtp.c"
61+#include "f_accessory.c"
62+#include "f_charger.c"
63+#define USB_ETH_RNDIS y
64+#include "f_rndis.c"
65+#include "rndis.c"
66+#include "f_qc_ecm.c"
67+#include "f_mbim.c"
68+#include "f_qc_rndis.c"
69+#include "u_bam_data.c"
70+#include "u_data_ipa.c"
71+#include "u_ether.c"
72+#include "u_qc_ether.c"
73+#include "f_gsi.c"
74+#include "f_mass_storage.h"
75+#include "f_hid.h"
76+#include "f_hid_android_keyboard.c"
77+#include "f_hid_android_mouse.c"
78+
79+USB_ETHERNET_MODULE_PARAMETERS();
80+#include "debug.h"
81+
82+MODULE_AUTHOR("Mike Lockwood");
83+MODULE_DESCRIPTION("Android Composite USB Driver");
84+MODULE_LICENSE("GPL");
85+MODULE_VERSION("1.0");
86+
87+static const char longname[] = "Gadget Android";
88+
89+/* Default vendor and product IDs, overridden by userspace */
90+#define VENDOR_ID		0x18D1
91+#define PRODUCT_ID		0x0001
92+
93+#define ANDROID_DEVICE_NODE_NAME_LENGTH 11
94+/* f_midi configuration */
95+#define MIDI_INPUT_PORTS    1
96+#define MIDI_OUTPUT_PORTS   1
97+#define MIDI_BUFFER_SIZE    1024
98+#define MIDI_QUEUE_LENGTH   32
99+
100+struct android_usb_function {
101+	char *name;
102+	void *config;
103+	/* set only when function's bind_config() is called. */
104+	bool bound;
105+
106+	struct device *dev;
107+	char *dev_name;
108+	struct device_attribute **attributes;
109+
110+	struct android_dev *android_dev;
111+
112+	/* Optional: initialization during gadget bind */
113+	int (*init)(struct android_usb_function *, struct usb_composite_dev *);
114+	/* Optional: cleanup during gadget unbind */
115+	void (*cleanup)(struct android_usb_function *);
116+	/* Optional: called when the function is added the list of
117+	 *		enabled functions */
118+	void (*enable)(struct android_usb_function *);
119+	/* Optional: called when it is removed */
120+	void (*disable)(struct android_usb_function *);
121+
122+	int (*bind_config)(struct android_usb_function *,
123+			   struct usb_configuration *);
124+
125+	/* Optional: called when the configuration is removed */
126+	void (*unbind_config)(struct android_usb_function *,
127+			      struct usb_configuration *);
128+	/* Optional: handle ctrl requests before the device is configured */
129+	int (*ctrlrequest)(struct android_usb_function *,
130+					struct usb_composite_dev *,
131+					const struct usb_ctrlrequest *);
132+};
133+
134+struct android_usb_function_holder {
135+
136+	struct android_usb_function *f;
137+
138+	/* for android_conf.enabled_functions */
139+	struct list_head enabled_list;
140+};
141+
142+/**
143+* struct android_dev - represents android USB gadget device
144+* @name: device name.
145+* @functions: an array of all the supported USB function
146+*    drivers that this gadget support but not necessarily
147+*    added to one of the gadget configurations.
148+* @cdev: The internal composite device. Android gadget device
149+*    is a composite device, such that it can support configurations
150+*    with more than one function driver.
151+* @dev: The kernel device that represents this android device.
152+* @enabled: True if the android gadget is enabled, means all
153+*    the configurations were set and all function drivers were
154+*    bind and ready for USB enumeration.
155+* @disable_depth: Number of times the device was disabled, after
156+*    symmetrical number of enables the device willl be enabled.
157+*    Used for controlling ADB userspace disable/enable requests.
158+* @mutex: Internal mutex for protecting device member fields.
159+* @pdata: Platform data fetched from the kernel device platfrom data.
160+* @last_disconnect : Time of the last disconnect. Used to enforce minimum
161+*    delay before next connect.
162+* @connected: True if got connect notification from the gadget UDC.
163+*    False if got disconnect notification from the gadget UDC.
164+* @sw_connected: Equal to 'connected' only after the connect
165+*    notification was handled by the android gadget work function.
166+* @suspended: True if got suspend notification from the gadget UDC.
167+*    False if got resume notification from the gadget UDC.
168+* @sw_suspended: Equal to 'suspended' only after the susped
169+*    notification was handled by the android gadget work function.
170+* @pm_qos: An attribute string that can be set by user space in order to
171+*    determine pm_qos policy. Set to 'high' for always demand pm_qos
172+*    when USB bus is connected and resumed. Set to 'low' for disable
173+*    any setting of pm_qos by this driver. Default = 'high'.
174+* @work: workqueue used for handling notifications from the gadget UDC.
175+* @configs: List of configurations currently configured into the device.
176+*    The android gadget supports more than one configuration. The host
177+*    may choose one configuration from the suggested.
178+* @configs_num: Number of configurations currently configured and existing
179+*    in the configs list.
180+* @list_item: This driver supports more than one android gadget device (for
181+*    example in order to support multiple USB cores), therefore this is
182+*    a item in a linked list of android devices.
183+*/
184+struct android_dev {
185+	const char *name;
186+	struct android_usb_function **functions;
187+	struct usb_composite_dev *cdev;
188+	struct device *dev;
189+
190+	void (*setup_complete)(struct usb_ep *ep,
191+				struct usb_request *req);
192+
193+	bool enabled;
194+	int disable_depth;
195+	struct mutex mutex;
196+	struct android_usb_platform_data *pdata;
197+
198+	ktime_t last_disconnect;
199+
200+	bool connected;
201+	bool sw_connected;
202+	bool suspended;
203+	bool sw_suspended;
204+	char pm_qos[5];
205+	struct pm_qos_request pm_qos_req_dma;
206+	unsigned up_pm_qos_sample_sec;
207+	unsigned up_pm_qos_threshold;
208+	unsigned down_pm_qos_sample_sec;
209+	unsigned down_pm_qos_threshold;
210+	unsigned idle_pc_rpm_no_int_secs;
211+	struct delayed_work pm_qos_work;
212+	enum android_pm_qos_state curr_pm_qos_state;
213+	struct work_struct work;
214+	char ffs_aliases[256];
215+
216+	/* A list of struct android_configuration */
217+	struct list_head configs;
218+	int configs_num;
219+
220+	/* A list node inside the android_dev_list */
221+	struct list_head list_item;
222+};
223+
224+struct android_configuration {
225+	struct usb_configuration usb_config;
226+
227+	/* A list of the functions supported by this config */
228+	struct list_head enabled_functions;
229+
230+	/* A list node inside the struct android_dev.configs list */
231+	struct list_head list_item;
232+};
233+
234+struct dload_struct __iomem *diag_dload;
235+static struct class *android_class;
236+static struct list_head android_dev_list;
237+static int android_dev_count;
238+static int android_bind_config(struct usb_configuration *c);
239+static void android_unbind_config(struct usb_configuration *c);
240+static int usb_diag_update_pid_and_serial_num(uint32_t pid, const char *snum);
241+static struct android_dev *cdev_to_android_dev(struct usb_composite_dev *cdev);
242+static struct android_configuration *alloc_android_config
243+						(struct android_dev *dev);
244+static void free_android_config(struct android_dev *dev,
245+				struct android_configuration *conf);
246+
247+/* string IDs are assigned dynamically */
248+#define STRING_MANUFACTURER_IDX		0
249+#define STRING_PRODUCT_IDX		1
250+#define STRING_SERIAL_IDX		2
251+
252+static char manufacturer_string[256];
253+static char product_string[256];
254+static char serial_string[256];
255+
256+/* String Table */
257+static struct usb_string strings_dev[] = {
258+	[STRING_MANUFACTURER_IDX].s = manufacturer_string,
259+	[STRING_PRODUCT_IDX].s = product_string,
260+	[STRING_SERIAL_IDX].s = serial_string,
261+	{  }			/* end of list */
262+};
263+
264+static struct usb_gadget_strings stringtab_dev = {
265+	.language	= 0x0409,	/* en-us */
266+	.strings	= strings_dev,
267+};
268+
269+static struct usb_gadget_strings *dev_strings[] = {
270+	&stringtab_dev,
271+	NULL,
272+};
273+
274+static struct usb_device_descriptor device_desc = {
275+	.bLength              = sizeof(device_desc),
276+	.bDescriptorType      = USB_DT_DEVICE,
277+	.bcdUSB               = __constant_cpu_to_le16(0x0200),
278+	.bDeviceClass         = USB_CLASS_PER_INTERFACE,
279+	.idVendor             = __constant_cpu_to_le16(VENDOR_ID),
280+	.idProduct            = __constant_cpu_to_le16(PRODUCT_ID),
281+	.bNumConfigurations   = 1,
282+};
283+
284+enum android_device_state {
285+	USB_DISCONNECTED,
286+	USB_CONNECTED,
287+	USB_CONFIGURED,
288+	USB_SUSPENDED,
289+	USB_RESUMED
290+};
291+
292+static const char *pm_qos_to_string(enum android_pm_qos_state state)
293+{
294+	switch (state) {
295+	case NO_USB_VOTE:	return "NO_USB_VOTE";
296+	case WFI:		return "WFI";
297+	case IDLE_PC:		return "IDLE_PC";
298+	case IDLE_PC_RPM:	return "IDLE_PC_RPM";
299+	default:		return "INVALID_STATE";
300+	}
301+}
302+
303+static void android_pm_qos_update_latency(struct android_dev *dev, s32 latency)
304+{
305+	static int last_vote = -1;
306+
307+	if (latency == last_vote || !latency)
308+		return;
309+
310+	pr_debug("%s: latency updated to: %d\n", __func__, latency);
311+	if (latency == PM_QOS_DEFAULT_VALUE) {
312+		pm_qos_update_request(&dev->pm_qos_req_dma, latency);
313+		last_vote = latency;
314+		pm_qos_remove_request(&dev->pm_qos_req_dma);
315+	} else {
316+		if (!pm_qos_request_active(&dev->pm_qos_req_dma)) {
317+			/*
318+			 * The default request type PM_QOS_REQ_ALL_CORES is
319+			 * applicable to all CPU cores that are online and
320+			 * would have a power impact when there are more
321+			 * number of CPUs. PM_QOS_REQ_AFFINE_IRQ request
322+			 * type shall update/apply the vote only to that CPU to
323+			 * which IRQ's affinity is set to.
324+			 */
325+#ifdef CONFIG_SMP
326+			dev->pm_qos_req_dma.type = PM_QOS_REQ_AFFINE_IRQ;
327+			dev->pm_qos_req_dma.irq =
328+				dev->cdev->gadget->interrupt_num;
329+#endif
330+			pm_qos_add_request(&dev->pm_qos_req_dma,
331+				PM_QOS_CPU_DMA_LATENCY, PM_QOS_DEFAULT_VALUE);
332+		}
333+		pm_qos_update_request(&dev->pm_qos_req_dma, latency);
334+		last_vote = latency;
335+	}
336+}
337+
338+#define DOWN_PM_QOS_SAMPLE_SEC		5
339+#define DOWN_PM_QOS_THRESHOLD		100
340+#define UP_PM_QOS_SAMPLE_SEC		3
341+#define UP_PM_QOS_THRESHOLD		70
342+#define IDLE_PC_RPM_NO_INT_SECS		10
343+
344+static void android_pm_qos_work(struct work_struct *data)
345+{
346+	struct android_dev *dev = container_of(data, struct android_dev,
347+							pm_qos_work.work);
348+	struct usb_gadget *gadget = dev->cdev->gadget;
349+	unsigned next_latency, curr_sample_int_count;
350+	unsigned next_sample_delay_sec;
351+	enum android_pm_qos_state next_state = dev->curr_pm_qos_state;
352+	static unsigned no_int_sample_count;
353+
354+	curr_sample_int_count = gadget->xfer_isr_count;
355+	gadget->xfer_isr_count = 0;
356+
357+	switch (dev->curr_pm_qos_state) {
358+	case WFI:
359+		if (curr_sample_int_count <= dev->down_pm_qos_threshold) {
360+			next_state = IDLE_PC;
361+			next_sample_delay_sec = dev->up_pm_qos_sample_sec;
362+			no_int_sample_count = 0;
363+		} else {
364+			next_sample_delay_sec = dev->down_pm_qos_sample_sec;
365+		}
366+		break;
367+	case IDLE_PC:
368+		if (!curr_sample_int_count)
369+			no_int_sample_count++;
370+		else
371+			no_int_sample_count = 0;
372+
373+		if (curr_sample_int_count >= dev->up_pm_qos_threshold) {
374+			next_state = WFI;
375+			next_sample_delay_sec = dev->down_pm_qos_sample_sec;
376+		} else if (no_int_sample_count >=
377+		      dev->idle_pc_rpm_no_int_secs/dev->up_pm_qos_sample_sec) {
378+			next_state = IDLE_PC_RPM;
379+			next_sample_delay_sec = dev->up_pm_qos_sample_sec;
380+		} else {
381+			next_sample_delay_sec = dev->up_pm_qos_sample_sec;
382+		}
383+		break;
384+	case IDLE_PC_RPM:
385+		if (curr_sample_int_count) {
386+			next_state = WFI;
387+			next_sample_delay_sec = dev->down_pm_qos_sample_sec;
388+			no_int_sample_count = 0;
389+		} else {
390+			next_sample_delay_sec = 2 * dev->up_pm_qos_sample_sec;
391+		}
392+		break;
393+	default:
394+		pr_debug("invalid pm_qos_state (%u)\n", dev->curr_pm_qos_state);
395+		return;
396+	}
397+
398+	if (next_state != dev->curr_pm_qos_state) {
399+		dev->curr_pm_qos_state = next_state;
400+		next_latency = dev->pdata->pm_qos_latency[next_state];
401+		android_pm_qos_update_latency(dev, next_latency);
402+		pr_debug("%s: pm_qos_state:%s, interrupts in last sample:%d\n",
403+				 __func__, pm_qos_to_string(next_state),
404+				curr_sample_int_count);
405+	}
406+
407+	schedule_delayed_work(&dev->pm_qos_work,
408+			msecs_to_jiffies(1000*next_sample_delay_sec));
409+}
410+
411+static void android_work(struct work_struct *data)
412+{
413+	struct android_dev *dev = container_of(data, struct android_dev, work);
414+	struct usb_composite_dev *cdev = dev->cdev;
415+	struct android_usb_platform_data *pdata = dev->pdata;
416+	char *disconnected[2] = { "USB_STATE=DISCONNECTED", NULL };
417+	char *connected[2]    = { "USB_STATE=CONNECTED", NULL };
418+	char *configured[2]   = { "USB_STATE=CONFIGURED", NULL };
419+	char *suspended[2]   = { "USB_STATE=SUSPENDED", NULL };
420+	char *resumed[2]   = { "USB_STATE=RESUMED", NULL };
421+	char **uevent_envp = NULL;
422+	static enum android_device_state last_uevent, next_state;
423+	unsigned long flags;
424+	int pm_qos_vote = -1;
425+
426+	spin_lock_irqsave(&cdev->lock, flags);
427+	if (dev->suspended != dev->sw_suspended && cdev->config) {
428+		if (strncmp(dev->pm_qos, "low", 3))
429+			pm_qos_vote = dev->suspended ? 0 : 1;
430+		next_state = dev->suspended ? USB_SUSPENDED : USB_RESUMED;
431+		uevent_envp = dev->suspended ? suspended : resumed;
432+	} else if (cdev->config) {
433+		uevent_envp = configured;
434+		next_state = USB_CONFIGURED;
435+	} else if (dev->connected != dev->sw_connected) {
436+		uevent_envp = dev->connected ? connected : disconnected;
437+		next_state = dev->connected ? USB_CONNECTED : USB_DISCONNECTED;
438+		if (dev->connected && strncmp(dev->pm_qos, "low", 3))
439+			pm_qos_vote = 1;
440+		else if (!dev->connected || !strncmp(dev->pm_qos, "low", 3))
441+			pm_qos_vote = 0;
442+	}
443+	dev->sw_connected = dev->connected;
444+	dev->sw_suspended = dev->suspended;
445+	spin_unlock_irqrestore(&cdev->lock, flags);
446+
447+	if (pdata->pm_qos_latency[0] && pm_qos_vote == 1) {
448+		cancel_delayed_work_sync(&dev->pm_qos_work);
449+		android_pm_qos_update_latency(dev, pdata->pm_qos_latency[WFI]);
450+		dev->curr_pm_qos_state = WFI;
451+		schedule_delayed_work(&dev->pm_qos_work,
452+			    msecs_to_jiffies(1000*dev->down_pm_qos_sample_sec));
453+	} else if (pdata->pm_qos_latency[0] && pm_qos_vote == 0) {
454+		cancel_delayed_work_sync(&dev->pm_qos_work);
455+		android_pm_qos_update_latency(dev, PM_QOS_DEFAULT_VALUE);
456+		dev->curr_pm_qos_state = NO_USB_VOTE;
457+	}
458+
459+	if (uevent_envp) {
460+		/*
461+		 * Some userspace modules, e.g. MTP, work correctly only if
462+		 * CONFIGURED uevent is preceded by DISCONNECT uevent.
463+		 * Check if we missed sending out a DISCONNECT uevent. This can
464+		 * happen if host PC resets and configures device really quick.
465+		 */
466+		if (((uevent_envp == connected) &&
467+		      (last_uevent != USB_DISCONNECTED)) ||
468+		    ((uevent_envp == configured) &&
469+		      (last_uevent == USB_CONFIGURED))) {
470+			pr_info("%s: sent missed DISCONNECT event\n", __func__);
471+			kobject_uevent_env(&dev->dev->kobj, KOBJ_CHANGE,
472+								disconnected);
473+			msleep(20);
474+		}
475+		/*
476+		 * Before sending out CONFIGURED uevent give function drivers
477+		 * a chance to wakeup userspace threads and notify disconnect
478+		 */
479+		if (uevent_envp == configured)
480+			msleep(50);
481+
482+		/* Do not notify on suspend / resume */
483+		if (next_state != USB_SUSPENDED && next_state != USB_RESUMED) {
484+			kobject_uevent_env(&dev->dev->kobj, KOBJ_CHANGE,
485+					   uevent_envp);
486+			last_uevent = next_state;
487+		}
488+		pr_info("%s: sent uevent %s\n", __func__, uevent_envp[0]);
489+	} else {
490+		pr_info("%s: did not send uevent (%d %d %p)\n", __func__,
491+			 dev->connected, dev->sw_connected, cdev->config);
492+	}
493+}
494+
495+#define MIN_DISCONNECT_DELAY_MS	30
496+
497+static int android_enable(struct android_dev *dev)
498+{
499+	struct usb_composite_dev *cdev = dev->cdev;
500+	struct android_configuration *conf;
501+	ktime_t diff;
502+	int err = 0;
503+
504+	if (WARN_ON(!dev->disable_depth))
505+		return err;
506+
507+	if (--dev->disable_depth == 0) {
508+
509+		list_for_each_entry(conf, &dev->configs, list_item) {
510+			err = usb_add_config(cdev, &conf->usb_config,
511+						android_bind_config);
512+			if (err < 0) {
513+				pr_err("%s: usb_add_config failed : err: %d\n",
514+						__func__, err);
515+				return err;
516+			}
517+		}
518+
519+		/*
520+		 * Some controllers need a minimum delay between removing and
521+		 * re-applying the pullups in order for the host to properly
522+		 * detect a soft disconnect. Check here if enough time has
523+		 * elapsed since the last disconnect.
524+		 */
525+		diff = ktime_sub(ktime_get(), dev->last_disconnect);
526+		if (ktime_to_ms(diff) < MIN_DISCONNECT_DELAY_MS)
527+			msleep(MIN_DISCONNECT_DELAY_MS - ktime_to_ms(diff));
528+
529+		usb_gadget_connect(cdev->gadget);
530+	}
531+
532+	return err;
533+}
534+
535+static void android_disable(struct android_dev *dev)
536+{
537+	struct usb_composite_dev *cdev = dev->cdev;
538+	struct android_configuration *conf;
539+	bool do_put = false;
540+
541+	if (dev->disable_depth++ == 0) {
542+		if (cdev->suspended && cdev->config) {
543+			usb_gadget_autopm_get(cdev->gadget);
544+			do_put = true;
545+		}
546+		if (gadget_is_dwc3(cdev->gadget)) {
547+			/* Cancel pending control requests */
548+			usb_ep_dequeue(cdev->gadget->ep0, cdev->req);
549+
550+			list_for_each_entry(conf, &dev->configs, list_item)
551+				usb_remove_config(cdev, &conf->usb_config);
552+			usb_gadget_disconnect(cdev->gadget);
553+			dev->last_disconnect = ktime_get();
554+		} else {
555+			usb_gadget_disconnect(cdev->gadget);
556+			dev->last_disconnect = ktime_get();
557+
558+			/* Cancel pnding control requests */
559+			usb_ep_dequeue(cdev->gadget->ep0, cdev->req);
560+
561+			list_for_each_entry(conf, &dev->configs, list_item)
562+				usb_remove_config(cdev, &conf->usb_config);
563+		}
564+		if (do_put)
565+			usb_gadget_autopm_put_async(cdev->gadget);
566+	}
567+}
568+
569+/*-------------------------------------------------------------------------*/
570+/* Supported functions initialization */
571+
572+struct functionfs_config {
573+	bool opened;
574+	bool enabled;
575+	struct usb_function *func;
576+	struct usb_function_instance *fi;
577+	struct ffs_data *data;
578+};
579+
580+static int functionfs_ready_callback(struct ffs_data *ffs);
581+static void functionfs_closed_callback(struct ffs_data *ffs);
582+
583+static int ffs_function_init(struct android_usb_function *f,
584+			     struct usb_composite_dev *cdev)
585+{
586+	struct functionfs_config *config;
587+	struct f_fs_opts *opts;
588+
589+	f->config = kzalloc(sizeof(struct functionfs_config), GFP_KERNEL);
590+	if (!f->config)
591+		return -ENOMEM;
592+
593+	config = f->config;
594+
595+	config->fi = usb_get_function_instance("ffs");
596+	if (IS_ERR(config->fi))
597+		return PTR_ERR(config->fi);
598+
599+	opts = to_f_fs_opts(config->fi);
600+	opts->dev->ffs_ready_callback = functionfs_ready_callback;
601+	opts->dev->ffs_closed_callback = functionfs_closed_callback;
602+	opts->no_configfs = true;
603+
604+	return ffs_single_dev(opts->dev);
605+}
606+
607+static void ffs_function_cleanup(struct android_usb_function *f)
608+{
609+	struct functionfs_config *config = f->config;
610+	if (config)
611+		usb_put_function_instance(config->fi);
612+
613+	kfree(f->config);
614+}
615+
616+static void ffs_function_enable(struct android_usb_function *f)
617+{
618+	struct android_dev *dev = f->android_dev;
619+	struct functionfs_config *config = f->config;
620+
621+	config->enabled = true;
622+
623+	/* Disable the gadget until the function is ready */
624+	if (!config->opened)
625+		android_disable(dev);
626+}
627+
628+static void ffs_function_disable(struct android_usb_function *f)
629+{
630+	struct android_dev *dev = f->android_dev;
631+	struct functionfs_config *config = f->config;
632+
633+	config->enabled = false;
634+
635+	/* Balance the disable that was called in closed_callback */
636+	if (!config->opened)
637+		android_enable(dev);
638+}
639+
640+static int ffs_function_bind_config(struct android_usb_function *f,
641+				    struct usb_configuration *c)
642+{
643+	struct functionfs_config *config = f->config;
644+	int ret;
645+
646+	config->func = usb_get_function(config->fi);
647+	if (IS_ERR(config->func))
648+		return PTR_ERR(config->func);
649+
650+	ret = usb_add_function(c, config->func);
651+	if (ret) {
652+		pr_err("%s(): usb_add_function() fails (err:%d) for ffs\n",
653+							__func__, ret);
654+
655+		usb_put_function(config->func);
656+		config->func = NULL;
657+	}
658+
659+	return ret;
660+}
661+
662+static ssize_t
663+ffs_aliases_show(struct device *pdev, struct device_attribute *attr, char *buf)
664+{
665+	struct android_dev *dev;
666+	int ret;
667+
668+	dev = list_first_entry(&android_dev_list, struct android_dev,
669+					list_item);
670+
671+	mutex_lock(&dev->mutex);
672+	ret = sprintf(buf, "%s\n", dev->ffs_aliases);
673+	mutex_unlock(&dev->mutex);
674+
675+	return ret;
676+}
677+
678+static ssize_t
679+ffs_aliases_store(struct device *pdev, struct device_attribute *attr,
680+					const char *buf, size_t size)
681+{
682+	struct android_dev *dev;
683+	char buff[256];
684+
685+	dev = list_first_entry(&android_dev_list, struct android_dev,
686+					list_item);
687+	mutex_lock(&dev->mutex);
688+
689+	if (dev->enabled) {
690+		mutex_unlock(&dev->mutex);
691+		return -EBUSY;
692+	}
693+
694+	strlcpy(buff, buf, sizeof(buff));
695+	strlcpy(dev->ffs_aliases, strim(buff), sizeof(dev->ffs_aliases));
696+
697+	mutex_unlock(&dev->mutex);
698+
699+	return size;
700+}
701+
702+static DEVICE_ATTR(aliases, S_IRUGO | S_IWUSR, ffs_aliases_show,
703+					       ffs_aliases_store);
704+static struct device_attribute *ffs_function_attributes[] = {
705+	&dev_attr_aliases,
706+	NULL
707+};
708+
709+static struct android_usb_function ffs_function = {
710+	.name		= "ffs",
711+	.init		= ffs_function_init,
712+	.enable		= ffs_function_enable,
713+	.disable	= ffs_function_disable,
714+	.cleanup	= ffs_function_cleanup,
715+	.bind_config	= ffs_function_bind_config,
716+	.attributes	= ffs_function_attributes,
717+};
718+
719+static int functionfs_ready_callback(struct ffs_data *ffs)
720+{
721+	struct android_dev *dev = ffs_function.android_dev;
722+	struct functionfs_config *config = ffs_function.config;
723+
724+	if (!dev)
725+		return -ENODEV;
726+
727+	mutex_lock(&dev->mutex);
728+	config->data = ffs;
729+	config->opened = true;
730+
731+	if (config->enabled && dev)
732+		android_enable(dev);
733+
734+	mutex_unlock(&dev->mutex);
735+	return 0;
736+}
737+
738+static void functionfs_closed_callback(struct ffs_data *ffs)
739+{
740+	struct android_dev *dev = ffs_function.android_dev;
741+	struct functionfs_config *config = ffs_function.config;
742+
743+	if (dev)
744+		mutex_lock(&dev->mutex);
745+
746+	if (config->enabled && dev)
747+		android_disable(dev);
748+
749+	config->opened = false;
750+	config->data = NULL;
751+
752+	if (config->func) {
753+		usb_put_function(config->func);
754+		config->func = NULL;
755+	}
756+
757+	if (dev)
758+		mutex_unlock(&dev->mutex);
759+
760+}
761+
762+/* ACM */
763+static char acm_transports[32];	/*enabled ACM ports - "tty[,sdio]"*/
764+#define MAX_ACM_INSTANCES 4
765+struct acm_function_config {
766+	int instances;
767+	int instances_on;
768+	struct usb_function *f_acm[MAX_ACM_INSTANCES];
769+	struct usb_function_instance *f_acm_inst[MAX_ACM_INSTANCES];
770+};
771+
772+static int
773+acm_function_init(struct android_usb_function *f,
774+		struct usb_composite_dev *cdev)
775+{
776+	struct acm_function_config *config;
777+
778+	config = kzalloc(sizeof(struct acm_function_config), GFP_KERNEL);
779+	if (!config)
780+		return -ENOMEM;
781+	f->config = config;
782+
783+	return 0;
784+}
785+
786+static void acm_function_cleanup(struct android_usb_function *f)
787+{
788+	int i;
789+	struct acm_function_config *config = f->config;
790+
791+	acm_port_cleanup();
792+	for (i = 0; i < config->instances_on; i++) {
793+		usb_put_function(config->f_acm[i]);
794+		usb_put_function_instance(config->f_acm_inst[i]);
795+	}
796+	kfree(f->config);
797+	f->config = NULL;
798+}
799+
800+static int
801+acm_function_bind_config(struct android_usb_function *f,
802+		struct usb_configuration *c)
803+{
804+	char *name;
805+	char buf[32], *b;
806+	int err = -1, i;
807+	static int acm_initialized, ports;
808+	struct acm_function_config *config = f->config;
809+
810+	if (acm_initialized)
811+		goto bind_config;
812+
813+	acm_initialized = 1;
814+	strlcpy(buf, acm_transports, sizeof(buf));
815+	b = strim(buf);
816+
817+	while (b) {
818+		name = strsep(&b, ",");
819+
820+		if (name) {
821+			err = acm_init_port(ports, name);
822+			if (err) {
823+				pr_err("acm: Cannot open port '%s'", name);
824+				goto out;
825+			}
826+			ports++;
827+			if (ports >= MAX_ACM_INSTANCES) {
828+				pr_err("acm: max ports reached '%s'", name);
829+				goto out;
830+			}
831+		}
832+	}
833+	err = acm_port_setup(c);
834+	if (err) {
835+		pr_err("acm: Cannot setup transports");
836+		goto out;
837+	}
838+
839+	for (i = 0; i < ports; i++) {
840+		config->f_acm_inst[i] = usb_get_function_instance("acm");
841+		if (IS_ERR(config->f_acm_inst[i])) {
842+			err = PTR_ERR(config->f_acm_inst[i]);
843+			goto err_usb_get_function_instance;
844+		}
845+		config->f_acm[i] = usb_get_function(config->f_acm_inst[i]);
846+		if (IS_ERR(config->f_acm[i])) {
847+			err = PTR_ERR(config->f_acm[i]);
848+			goto err_usb_get_function;
849+		}
850+	}
851+	config->instances_on = ports;
852+
853+bind_config:
854+	for (i = 0; i < ports; i++) {
855+		err = usb_add_function(c, config->f_acm[i]);
856+		if (err) {
857+			pr_err("Could not bind acm%u config\n", i);
858+			goto err_usb_add_function;
859+		}
860+	}
861+
862+	return 0;
863+
864+err_usb_add_function:
865+	while (i-- > 0)
866+		usb_remove_function(c, config->f_acm[i]);
867+
868+	config->instances_on = 0;
869+	return err;
870+
871+err_usb_get_function_instance:
872+	while (i-- > 0) {
873+		usb_put_function(config->f_acm[i]);
874+err_usb_get_function:
875+		usb_put_function_instance(config->f_acm_inst[i]);
876+	}
877+
878+out:
879+	config->instances_on = 0;
880+	return err;
881+}
882+
883+static void acm_function_unbind_config(struct android_usb_function *f,
884+				       struct usb_configuration *c)
885+{
886+	struct acm_function_config *config = f->config;
887+	config->instances_on = 0;
888+}
889+
890+static ssize_t acm_transports_store(
891+		struct device *device, struct device_attribute *attr,
892+		const char *buff, size_t size)
893+{
894+	strlcpy(acm_transports, buff, sizeof(acm_transports));
895+
896+	return size;
897+}
898+
899+static DEVICE_ATTR(acm_transports, S_IWUSR, NULL, acm_transports_store);
900+static struct device_attribute *acm_function_attributes[] = {
901+	&dev_attr_acm_transports,
902+	NULL
903+};
904+
905+static struct android_usb_function acm_function = {
906+	.name		= "acm",
907+	.init		= acm_function_init,
908+	.cleanup	= acm_function_cleanup,
909+	.bind_config	= acm_function_bind_config,
910+	.unbind_config	= acm_function_unbind_config,
911+	.attributes	= acm_function_attributes,
912+};
913+
914+/*rmnet transport string format(per port):"ctrl0,data0,ctrl1,data1..." */
915+#define MAX_XPORT_STR_LEN 50
916+static char rmnet_transports[MAX_XPORT_STR_LEN];
917+
918+/*rmnet transport name string - "rmnet_hsic[,rmnet_hsusb]" */
919+static char rmnet_xport_names[MAX_XPORT_STR_LEN];
920+
921+/*qdss transport string format(per port):"bam [, hsic]" */
922+static char qdss_transports[MAX_XPORT_STR_LEN];
923+
924+/*qdss transport name string - "qdss_bam [, qdss_hsic]" */
925+static char qdss_xport_names[MAX_XPORT_STR_LEN];
926+
927+/*qdss debug interface setting 0: disable   1:enable */
928+static bool qdss_debug_intf;
929+
930+static int rmnet_function_init(struct android_usb_function *f,
931+		struct usb_composite_dev *cdev)
932+{
933+	return rmnet_init();
934+}
935+
936+static void rmnet_function_cleanup(struct android_usb_function *f)
937+{
938+	frmnet_cleanup();
939+}
940+
941+static int rmnet_function_bind_config(struct android_usb_function *f,
942+					 struct usb_configuration *c)
943+{
944+	int i;
945+	int err = 0;
946+	char *ctrl_name;
947+	char *data_name;
948+	char *tname = NULL;
949+	char buf[MAX_XPORT_STR_LEN], *b;
950+	char xport_name_buf[MAX_XPORT_STR_LEN], *tb;
951+	static int rmnet_initialized, ports;
952+
953+	if (!rmnet_initialized) {
954+		strlcpy(buf, rmnet_transports, sizeof(buf));
955+		b = strim(buf);
956+
957+		strlcpy(xport_name_buf, rmnet_xport_names,
958+				sizeof(xport_name_buf));
959+		tb = strim(xport_name_buf);
960+
961+		while (b) {
962+			ctrl_name = strsep(&b, ",");
963+			data_name = strsep(&b, ",");
964+			if (ctrl_name && data_name) {
965+				if (tb)
966+					tname = strsep(&tb, ",");
967+				err = frmnet_init_port(ctrl_name, data_name,
968+						tname);
969+				if (err) {
970+					pr_err("rmnet: Cannot open ctrl port:"
971+						"'%s' data port:'%s'\n",
972+						ctrl_name, data_name);
973+					goto out;
974+				}
975+				ports++;
976+			}
977+		}
978+
979+		err = rmnet_gport_setup();
980+		if (err) {
981+			pr_err("rmnet: Cannot setup transports");
982+			frmnet_deinit_port();
983+			ports = 0;
984+			goto out;
985+		}
986+		rmnet_initialized = 1;
987+	}
988+
989+	for (i = 0; i < ports; i++) {
990+		err = frmnet_bind_config(c, i);
991+		if (err) {
992+			pr_err("Could not bind rmnet%u config\n", i);
993+			break;
994+		}
995+	}
996+out:
997+	return err;
998+}
999+
1000+static void rmnet_function_unbind_config(struct android_usb_function *f,
1001+						struct usb_configuration *c)
1002+{
1003+	frmnet_unbind_config();
1004+}
1005+
1006+static ssize_t rmnet_transports_show(struct device *dev,
1007+		struct device_attribute *attr, char *buf)
1008+{
1009+	return snprintf(buf, PAGE_SIZE, "%s\n", rmnet_transports);
1010+}
1011+
1012+static ssize_t rmnet_transports_store(
1013+		struct device *device, struct device_attribute *attr,
1014+		const char *buff, size_t size)
1015+{
1016+	strlcpy(rmnet_transports, buff, sizeof(rmnet_transports));
1017+
1018+	return size;
1019+}
1020+
1021+static ssize_t rmnet_xport_names_show(struct device *dev,
1022+		struct device_attribute *attr, char *buf)
1023+{
1024+	return snprintf(buf, PAGE_SIZE, "%s\n", rmnet_xport_names);
1025+}
1026+
1027+static ssize_t rmnet_xport_names_store(
1028+		struct device *device, struct device_attribute *attr,
1029+		const char *buff, size_t size)
1030+{
1031+	strlcpy(rmnet_xport_names, buff, sizeof(rmnet_xport_names));
1032+
1033+	return size;
1034+}
1035+
1036+static struct device_attribute dev_attr_rmnet_transports =
1037+					__ATTR(transports, S_IRUGO | S_IWUSR,
1038+						rmnet_transports_show,
1039+						rmnet_transports_store);
1040+
1041+static struct device_attribute dev_attr_rmnet_xport_names =
1042+				__ATTR(transport_names, S_IRUGO | S_IWUSR,
1043+				rmnet_xport_names_show,
1044+				rmnet_xport_names_store);
1045+
1046+static struct device_attribute *rmnet_function_attributes[] = {
1047+					&dev_attr_rmnet_transports,
1048+					&dev_attr_rmnet_xport_names,
1049+					NULL };
1050+
1051+static struct android_usb_function rmnet_function = {
1052+	.name		= "rmnet",
1053+	.init		= rmnet_function_init,
1054+	.cleanup	= rmnet_function_cleanup,
1055+	.bind_config	= rmnet_function_bind_config,
1056+	.unbind_config	= rmnet_function_unbind_config,
1057+	.attributes	= rmnet_function_attributes,
1058+};
1059+
1060+static void gps_function_cleanup(struct android_usb_function *f)
1061+{
1062+	gps_cleanup();
1063+}
1064+
1065+static int gps_function_bind_config(struct android_usb_function *f,
1066+					 struct usb_configuration *c)
1067+{
1068+	int err;
1069+	static int gps_initialized;
1070+
1071+	if (!gps_initialized) {
1072+		gps_initialized = 1;
1073+		err = gps_init_port();
1074+		if (err) {
1075+			pr_err("gps: Cannot init gps port");
1076+			return err;
1077+		}
1078+	}
1079+
1080+	err = gps_gport_setup();
1081+	if (err) {
1082+		pr_err("gps: Cannot setup transports");
1083+		return err;
1084+	}
1085+	err = gps_bind_config(c);
1086+	if (err) {
1087+		pr_err("Could not bind gps config\n");
1088+		return err;
1089+	}
1090+
1091+	return 0;
1092+}
1093+
1094+static struct android_usb_function gps_function = {
1095+	.name		= "gps",
1096+	.cleanup	= gps_function_cleanup,
1097+	.bind_config	= gps_function_bind_config,
1098+};
1099+
1100+/* ncm */
1101+struct ncm_function_config {
1102+	u8      ethaddr[ETH_ALEN];
1103+	struct usb_function *func;
1104+	struct usb_function_instance *fi;
1105+};
1106+
1107+static int
1108+ncm_function_init(struct android_usb_function *f, struct usb_composite_dev *c)
1109+{
1110+	struct ncm_function_config *config;
1111+	config = kzalloc(sizeof(struct ncm_function_config), GFP_KERNEL);
1112+	if (!config)
1113+		return -ENOMEM;
1114+
1115+	f->config = config;
1116+
1117+	return 0;
1118+}
1119+
1120+static void ncm_function_cleanup(struct android_usb_function *f)
1121+{
1122+	struct ncm_function_config *config = f->config;
1123+	if (config) {
1124+		usb_put_function(config->func);
1125+		usb_put_function_instance(config->fi);
1126+	}
1127+
1128+	kfree(f->config);
1129+	f->config = NULL;
1130+}
1131+
1132+static int
1133+ncm_function_bind_config(struct android_usb_function *f,
1134+				struct usb_configuration *c)
1135+{
1136+	struct ncm_function_config *ncm = f->config;
1137+	int ret;
1138+	struct f_ncm_opts *ncm_opts = NULL;
1139+
1140+	if (!ncm) {
1141+		pr_err("%s: ncm config is null\n", __func__);
1142+		return -EINVAL;
1143+	}
1144+
1145+	pr_info("%s MAC: %02X:%02X:%02X:%02X:%02X:%02X\n", __func__,
1146+		ncm->ethaddr[0], ncm->ethaddr[1], ncm->ethaddr[2],
1147+		ncm->ethaddr[3], ncm->ethaddr[4], ncm->ethaddr[5]);
1148+
1149+	ncm->fi = usb_get_function_instance("ncm");
1150+	if (IS_ERR(ncm->fi))
1151+		return PTR_ERR(ncm->fi);
1152+
1153+	ncm_opts = container_of(ncm->fi, struct f_ncm_opts, func_inst);
1154+	strlcpy(ncm_opts->net->name, "ncm%d", sizeof(ncm_opts->net->name));
1155+
1156+	gether_set_qmult(ncm_opts->net, qmult);
1157+	if (!gether_set_host_addr(ncm_opts->net, host_addr))
1158+		pr_info("using host ethernet address: %s", host_addr);
1159+	if (!gether_set_dev_addr(ncm_opts->net, dev_addr))
1160+		pr_info("using self ethernet address: %s", dev_addr);
1161+
1162+	gether_set_gadget(ncm_opts->net, c->cdev->gadget);
1163+	ret = gether_register_netdev(ncm_opts->net);
1164+	if (ret) {
1165+		pr_err("%s: register_netdev failed\n", __func__);
1166+		return ret;
1167+	}
1168+
1169+	ncm_opts->bound = true;
1170+	gether_get_host_addr_u8(ncm_opts->net, ncm->ethaddr);
1171+
1172+	ncm->func = usb_get_function(ncm->fi);
1173+	if (IS_ERR(ncm->func)) {
1174+		pr_err("%s: usb_get_function failed\n", __func__);
1175+		return PTR_ERR(ncm->func);
1176+	}
1177+
1178+	return usb_add_function(c, ncm->func);
1179+}
1180+
1181+static void ncm_function_unbind_config(struct android_usb_function *f,
1182+						struct usb_configuration *c)
1183+{
1184+	struct ncm_function_config *ncm = f->config;
1185+
1186+	usb_put_function_instance(ncm->fi);
1187+}
1188+
1189+static ssize_t ncm_ethaddr_show(struct device *dev,
1190+		struct device_attribute *attr, char *buf)
1191+{
1192+	struct android_usb_function *f = dev_get_drvdata(dev);
1193+	struct ncm_function_config *ncm = f->config;
1194+	return snprintf(buf, PAGE_SIZE, "%02x:%02x:%02x:%02x:%02x:%02x\n",
1195+		ncm->ethaddr[0], ncm->ethaddr[1], ncm->ethaddr[2],
1196+		ncm->ethaddr[3], ncm->ethaddr[4], ncm->ethaddr[5]);
1197+}
1198+
1199+static ssize_t ncm_ethaddr_store(struct device *dev,
1200+		struct device_attribute *attr, const char *buf, size_t size)
1201+{
1202+	struct android_usb_function *f = dev_get_drvdata(dev);
1203+	struct ncm_function_config *ncm = f->config;
1204+
1205+	if (sscanf(buf, "%02x:%02x:%02x:%02x:%02x:%02x\n",
1206+		    (int *)&ncm->ethaddr[0], (int *)&ncm->ethaddr[1],
1207+		    (int *)&ncm->ethaddr[2], (int *)&ncm->ethaddr[3],
1208+		    (int *)&ncm->ethaddr[4], (int *)&ncm->ethaddr[5]) == 6)
1209+		return size;
1210+	return -EINVAL;
1211+}
1212+
1213+static DEVICE_ATTR(ncm_ethaddr, S_IRUGO | S_IWUSR, ncm_ethaddr_show,
1214+					       ncm_ethaddr_store);
1215+static struct device_attribute *ncm_function_attributes[] = {
1216+	&dev_attr_ncm_ethaddr,
1217+	NULL
1218+};
1219+
1220+static struct android_usb_function ncm_function = {
1221+	.name		= "ncm",
1222+	.init		= ncm_function_init,
1223+	.cleanup	= ncm_function_cleanup,
1224+	.bind_config	= ncm_function_bind_config,
1225+	.unbind_config	= ncm_function_unbind_config,
1226+	.attributes	= ncm_function_attributes,
1227+};
1228+
1229+/* ecm transport string */
1230+static char ecm_transports[MAX_XPORT_STR_LEN];
1231+
1232+struct ecm_function_config {
1233+	u8      ethaddr[ETH_ALEN];
1234+	struct usb_function *func;
1235+	struct usb_function_instance *fi;
1236+	char	new_host_addr[20];
1237+};
1238+
1239+static int ecm_qc_function_init(struct android_usb_function *f,
1240+				struct usb_composite_dev *cdev)
1241+{
1242+	f->config = kzalloc(sizeof(struct ecm_function_config), GFP_KERNEL);
1243+	if (!f->config)
1244+		return -ENOMEM;
1245+	return ecm_qc_init();
1246+}
1247+
1248+static void ecm_qc_function_cleanup(struct android_usb_function *f)
1249+{
1250+	kfree(f->config);
1251+	f->config = NULL;
1252+}
1253+
1254+static int ecm_qc_function_bind_config(struct android_usb_function *f,
1255+					struct usb_configuration *c)
1256+{
1257+	int ret;
1258+	char *trans;
1259+	struct ecm_function_config *ecm = f->config;
1260+
1261+	if (!ecm) {
1262+		pr_err("%s: ecm_pdata\n", __func__);
1263+		return -EINVAL;
1264+	}
1265+
1266+	pr_info("%s MAC: %02X:%02X:%02X:%02X:%02X:%02X\n", __func__,
1267+		ecm->ethaddr[0], ecm->ethaddr[1], ecm->ethaddr[2],
1268+		ecm->ethaddr[3], ecm->ethaddr[4], ecm->ethaddr[5]);
1269+
1270+	pr_debug("%s: ecm_transport is %s", __func__, ecm_transports);
1271+
1272+	trans = strim(ecm_transports);
1273+	if (strcmp("BAM2BAM_IPA", trans)) {
1274+		ret = gether_qc_setup_name(c->cdev->gadget,
1275+						ecm->ethaddr, "ecm");
1276+		if (ret) {
1277+			pr_err("%s: gether_setup failed\n", __func__);
1278+			return ret;
1279+		}
1280+	}
1281+
1282+	return ecm_qc_bind_config(c, ecm->ethaddr, trans);
1283+}
1284+
1285+static void ecm_qc_function_unbind_config(struct android_usb_function *f,
1286+						struct usb_configuration *c)
1287+{
1288+	char *trans = strim(ecm_transports);
1289+
1290+	if (strcmp("BAM2BAM_IPA", trans)) {
1291+		bam_data_flush_workqueue();
1292+		gether_qc_cleanup_name("ecm0");
1293+	}
1294+}
1295+
1296+static ssize_t ecm_ethaddr_show(struct device *dev,
1297+		struct device_attribute *attr, char *buf)
1298+{
1299+	struct android_usb_function *f = dev_get_drvdata(dev);
1300+	struct ecm_function_config *ecm = f->config;
1301+	return snprintf(buf, PAGE_SIZE, "%02x:%02x:%02x:%02x:%02x:%02x\n",
1302+		ecm->ethaddr[0], ecm->ethaddr[1], ecm->ethaddr[2],
1303+		ecm->ethaddr[3], ecm->ethaddr[4], ecm->ethaddr[5]);
1304+}
1305+
1306+static ssize_t ecm_ethaddr_store(struct device *dev,
1307+		struct device_attribute *attr, const char *buf, size_t size)
1308+{
1309+	struct android_usb_function *f = dev_get_drvdata(dev);
1310+	struct ecm_function_config *ecm = f->config;
1311+
1312+	if (sscanf(buf, "%02x:%02x:%02x:%02x:%02x:%02x\n",
1313+		    (int *)&ecm->ethaddr[0], (int *)&ecm->ethaddr[1],
1314+		    (int *)&ecm->ethaddr[2], (int *)&ecm->ethaddr[3],
1315+		    (int *)&ecm->ethaddr[4], (int *)&ecm->ethaddr[5]) == 6)
1316+		return size;
1317+	return -EINVAL;
1318+}
1319+
1320+static DEVICE_ATTR(ecm_ethaddr, S_IRUGO | S_IWUSR, ecm_ethaddr_show,
1321+					       ecm_ethaddr_store);
1322+
1323+static ssize_t ecm_transports_show(struct device *dev,
1324+		struct device_attribute *attr, char *buf)
1325+{
1326+	return snprintf(buf, PAGE_SIZE, "%s\n", ecm_transports);
1327+}
1328+
1329+static ssize_t ecm_transports_store(struct device *dev,
1330+		struct device_attribute *attr, const char *buf, size_t size)
1331+{
1332+	strlcpy(ecm_transports, buf, sizeof(ecm_transports));
1333+	return size;
1334+}
1335+
1336+static DEVICE_ATTR(ecm_transports, S_IRUGO | S_IWUSR, ecm_transports_show,
1337+					       ecm_transports_store);
1338+
1339+static struct device_attribute *ecm_function_attributes[] = {
1340+	&dev_attr_ecm_transports,
1341+	&dev_attr_ecm_ethaddr,
1342+	NULL
1343+};
1344+
1345+static struct android_usb_function ecm_qc_function = {
1346+	.name		= "ecm_qc",
1347+	.init		= ecm_qc_function_init,
1348+	.cleanup	= ecm_qc_function_cleanup,
1349+	.bind_config	= ecm_qc_function_bind_config,
1350+	.unbind_config	= ecm_qc_function_unbind_config,
1351+	.attributes	= ecm_function_attributes,
1352+};
1353+
1354+/* MBIM - used with BAM */
1355+#define MAX_MBIM_INSTANCES 1
1356+
1357+static int mbim_function_init(struct android_usb_function *f,
1358+					 struct usb_composite_dev *cdev)
1359+{
1360+	return mbim_init(MAX_MBIM_INSTANCES);
1361+}
1362+
1363+static void mbim_function_cleanup(struct android_usb_function *f)
1364+{
1365+	fmbim_cleanup();
1366+}
1367+
1368+
1369+/* mbim transport string */
1370+static char mbim_transports[MAX_XPORT_STR_LEN];
1371+
1372+static int mbim_function_bind_config(struct android_usb_function *f,
1373+					  struct usb_configuration *c)
1374+{
1375+	char *trans;
1376+
1377+	pr_debug("%s: mbim transport is %s", __func__, mbim_transports);
1378+	trans = strim(mbim_transports);
1379+	return mbim_bind_config(c, 0, trans);
1380+}
1381+
1382+static void mbim_function_unbind_config(struct android_usb_function *f,
1383+						struct usb_configuration *c)
1384+{
1385+	char *trans = strim(mbim_transports);
1386+
1387+	if (strcmp("BAM2BAM_IPA", trans))
1388+		bam_data_flush_workqueue();
1389+}
1390+
1391+static int mbim_function_ctrlrequest(struct android_usb_function *f,
1392+					struct usb_composite_dev *cdev,
1393+					const struct usb_ctrlrequest *c)
1394+{
1395+	return mbim_ctrlrequest(cdev, c);
1396+}
1397+
1398+static ssize_t mbim_transports_show(struct device *dev,
1399+		struct device_attribute *attr, char *buf)
1400+{
1401+	return snprintf(buf, PAGE_SIZE, "%s\n", mbim_transports);
1402+}
1403+
1404+static ssize_t mbim_transports_store(struct device *dev,
1405+		struct device_attribute *attr, const char *buf, size_t size)
1406+{
1407+	strlcpy(mbim_transports, buf, sizeof(mbim_transports));
1408+	return size;
1409+}
1410+
1411+static DEVICE_ATTR(mbim_transports, S_IRUGO | S_IWUSR, mbim_transports_show,
1412+				mbim_transports_store);
1413+
1414+static ssize_t wMTU_show(struct device *dev,
1415+		struct device_attribute *attr, char *buf)
1416+{
1417+	return snprintf(buf, PAGE_SIZE, "%d\n", ext_mbb_desc.wMTU);
1418+}
1419+
1420+static ssize_t wMTU_store(struct device *dev,
1421+		struct device_attribute *attr, const char *buf, size_t size)
1422+{
1423+	int value;
1424+	if (sscanf(buf, "%d", &value) == 1) {
1425+		if (value < 0 || value > USHRT_MAX)
1426+			pr_err("illegal MTU %d, enter unsigned 16 bits\n",
1427+				value);
1428+		else
1429+			ext_mbb_desc.wMTU = cpu_to_le16(value);
1430+		return size;
1431+	}
1432+	return -EINVAL;
1433+}
1434+
1435+static DEVICE_ATTR(wMTU, S_IRUGO | S_IWUSR, wMTU_show,
1436+				wMTU_store);
1437+
1438+static struct device_attribute *mbim_function_attributes[] = {
1439+	&dev_attr_mbim_transports,
1440+	&dev_attr_wMTU,
1441+	NULL
1442+};
1443+
1444+static struct android_usb_function mbim_function = {
1445+	.name		= "usb_mbim",
1446+	.cleanup	= mbim_function_cleanup,
1447+	.bind_config	= mbim_function_bind_config,
1448+	.unbind_config	= mbim_function_unbind_config,
1449+	.init		= mbim_function_init,
1450+	.ctrlrequest	= mbim_function_ctrlrequest,
1451+	.attributes	= mbim_function_attributes,
1452+};
1453+
1454+#ifdef CONFIG_SND_PCM
1455+/* PERIPHERAL AUDIO */
1456+struct audio_function_config {
1457+	struct usb_function *func;
1458+	struct usb_function_instance *fi;
1459+};
1460+
1461+static int audio_function_init(struct android_usb_function *f,
1462+			       struct usb_composite_dev *cdev)
1463+{
1464+	struct audio_function_config *config;
1465+	f->config = kzalloc(sizeof(*config), GFP_KERNEL);
1466+	if (!f->config)
1467+		return -ENOMEM;
1468+
1469+	config = f->config;
1470+	config->fi = usb_get_function_instance("uac1");
1471+	if (IS_ERR(config->fi))
1472+		return PTR_ERR(config->fi);
1473+
1474+	config->func = usb_get_function(config->fi);
1475+	if (IS_ERR(config->func)) {
1476+		usb_put_function_instance(config->fi);
1477+		return PTR_ERR(config->func);
1478+	}
1479+
1480+	return 0;
1481+}
1482+
1483+static void audio_function_cleanup(struct android_usb_function *f)
1484+{
1485+	struct audio_function_config *config = f->config;
1486+	if (config) {
1487+		usb_put_function(config->func);
1488+		usb_put_function_instance(config->fi);
1489+	}
1490+
1491+	kfree(f->config);
1492+	f->config = NULL;
1493+}
1494+
1495+static int audio_function_bind_config(struct android_usb_function *f,
1496+					  struct usb_configuration *c)
1497+{
1498+	struct audio_function_config *config = f->config;
1499+	return usb_add_function(c, config->func);
1500+}
1501+
1502+static struct android_usb_function audio_function = {
1503+	.name		= "audio",
1504+	.init		= audio_function_init,
1505+	.cleanup	= audio_function_cleanup,
1506+	.bind_config	= audio_function_bind_config,
1507+};
1508+#endif
1509+
1510+
1511+/* DIAG */
1512+static char diag_clients[32];	    /*enabled DIAG clients- "diag[,diag_mdm]" */
1513+static ssize_t clients_store(
1514+		struct device *device, struct device_attribute *attr,
1515+		const char *buff, size_t size)
1516+{
1517+	strlcpy(diag_clients, buff, sizeof(diag_clients));
1518+
1519+	return size;
1520+}
1521+
1522+static DEVICE_ATTR(clients, S_IWUSR, NULL, clients_store);
1523+static struct device_attribute *diag_function_attributes[] =
1524+					 { &dev_attr_clients, NULL };
1525+
1526+static int diag_function_init(struct android_usb_function *f,
1527+				 struct usb_composite_dev *cdev)
1528+{
1529+	return diag_setup();
1530+}
1531+
1532+static void diag_function_cleanup(struct android_usb_function *f)
1533+{
1534+	diag_cleanup();
1535+}
1536+
1537+static int diag_function_bind_config(struct android_usb_function *f,
1538+					struct usb_configuration *c)
1539+{
1540+	char *name;
1541+	char buf[32], *b;
1542+	int once = 0, err = -1;
1543+	int (*notify)(uint32_t, const char *);
1544+
1545+	strlcpy(buf, diag_clients, sizeof(buf));
1546+	b = strim(buf);
1547+
1548+	while (b) {
1549+		notify = NULL;
1550+		name = strsep(&b, ",");
1551+		/* Allow only first diag channel to update pid and serial no */
1552+		if (!once++)
1553+			notify = usb_diag_update_pid_and_serial_num;
1554+
1555+		if (name) {
1556+			err = diag_function_add(c, name, notify);
1557+			if (err)
1558+				pr_err("diag: Cannot open channel '%s'", name);
1559+		}
1560+	}
1561+
1562+	return err;
1563+}
1564+
1565+static struct android_usb_function diag_function = {
1566+	.name		= "diag",
1567+	.init		= diag_function_init,
1568+	.cleanup	= diag_function_cleanup,
1569+	.bind_config	= diag_function_bind_config,
1570+	.attributes	= diag_function_attributes,
1571+};
1572+
1573+/* DEBUG */
1574+static int qdss_function_init(struct android_usb_function *f,
1575+	struct usb_composite_dev *cdev)
1576+{
1577+	return qdss_setup();
1578+}
1579+
1580+static void qdss_function_cleanup(struct android_usb_function *f)
1581+{
1582+	qdss_cleanup();
1583+}
1584+
1585+static int qdss_init_transports(int *portnum)
1586+{
1587+	char *ts_port;
1588+	char *tname = NULL;
1589+	char *ctrl_name = NULL;
1590+	char buf[MAX_XPORT_STR_LEN], *type;
1591+	char xport_name_buf[MAX_XPORT_STR_LEN], *tn;
1592+	int err = 0;
1593+
1594+	strlcpy(buf, qdss_transports, sizeof(buf));
1595+	type = strim(buf);
1596+
1597+	strlcpy(xport_name_buf, qdss_xport_names,
1598+			sizeof(xport_name_buf));
1599+	tn = strim(xport_name_buf);
1600+
1601+	pr_debug("%s: qdss_debug_intf = %d\n",
1602+		__func__, qdss_debug_intf);
1603+
1604+	/*
1605+	 * QDSS function driver is being used for QDSS and DPL
1606+	 * functionality. ctrl_name (i.e. ctrl xport) is optional
1607+	 * whereas data transport name is mandatory to provide
1608+	 * while using QDSS/DPL as part of USB composition.
1609+	 */
1610+	while (type) {
1611+		ctrl_name = strsep(&type, ",");
1612+		ts_port = strsep(&type, ",");
1613+		if (!ts_port) {
1614+			pr_debug("%s:ctrl transport is not provided.\n",
1615+								__func__);
1616+			ts_port = ctrl_name;
1617+			ctrl_name = NULL;
1618+		}
1619+
1620+		if (ts_port) {
1621+			if (tn)
1622+				tname = strsep(&tn, ",");
1623+
1624+			err = qdss_init_port(
1625+				ctrl_name,
1626+				ts_port,
1627+				tname,
1628+				qdss_debug_intf);
1629+
1630+			if (err) {
1631+				pr_err("%s: Cannot open transport port:'%s'\n",
1632+					__func__, ts_port);
1633+				return err;
1634+			}
1635+			(*portnum)++;
1636+		} else {
1637+			pr_err("%s: No data transport name for QDSS port.\n",
1638+								__func__);
1639+			err = -ENODEV;
1640+		}
1641+	}
1642+	return err;
1643+}
1644+
1645+static int qdss_function_bind_config(struct android_usb_function *f,
1646+					struct usb_configuration *c)
1647+{
1648+	int i;
1649+	int err = 0;
1650+	static int qdss_initialized = 0, portsnum;
1651+
1652+	if (!qdss_initialized) {
1653+		qdss_initialized = 1;
1654+
1655+		err = qdss_init_transports(&portsnum);
1656+		if (err) {
1657+			pr_err("qdss: Cannot init transports");
1658+			goto out;
1659+		}
1660+
1661+		err = qdss_gport_setup();
1662+		if (err) {
1663+			pr_err("qdss: Cannot setup transports");
1664+			goto out;
1665+		}
1666+	}
1667+
1668+	pr_debug("%s: port number is %d\n", __func__, portsnum);
1669+
1670+	for (i = 0; i < portsnum; i++) {
1671+		err = qdss_bind_config(c, i);
1672+		if (err) {
1673+			pr_err("Could not bind qdss%u config\n", i);
1674+			break;
1675+		}
1676+	}
1677+out:
1678+	return err;
1679+}
1680+
1681+static ssize_t qdss_transports_show(struct device *dev,
1682+		struct device_attribute *attr, char *buf)
1683+{
1684+	return snprintf(buf, PAGE_SIZE, "%s\n", qdss_transports);
1685+}
1686+
1687+static ssize_t qdss_transports_store(
1688+		struct device *device, struct device_attribute *attr,
1689+		const char *buff, size_t size)
1690+{
1691+	strlcpy(qdss_transports, buff, sizeof(qdss_transports));
1692+
1693+	return size;
1694+}
1695+
1696+static ssize_t qdss_xport_names_show(struct device *dev,
1697+		struct device_attribute *attr, char *buf)
1698+{
1699+	return snprintf(buf, PAGE_SIZE, "%s\n", qdss_xport_names);
1700+}
1701+
1702+static ssize_t qdss_xport_names_store(
1703+		struct device *device, struct device_attribute *attr,
1704+		const char *buff, size_t size)
1705+{
1706+	strlcpy(qdss_xport_names, buff, sizeof(qdss_xport_names));
1707+	return size;
1708+}
1709+
1710+static ssize_t qdss_debug_intf_store(
1711+		struct device *device, struct device_attribute *attr,
1712+		const char *buff, size_t size)
1713+{
1714+	strtobool(buff, &qdss_debug_intf);
1715+	return size;
1716+}
1717+
1718+static ssize_t qdss_debug_intf_show(struct device *dev,
1719+		struct device_attribute *attr, char *buf)
1720+{
1721+	return snprintf(buf, PAGE_SIZE, "%d\n", qdss_debug_intf);
1722+}
1723+
1724+static struct device_attribute dev_attr_qdss_transports =
1725+					__ATTR(transports, S_IRUGO | S_IWUSR,
1726+						qdss_transports_show,
1727+						qdss_transports_store);
1728+
1729+static struct device_attribute dev_attr_qdss_xport_names =
1730+				__ATTR(transport_names, S_IRUGO | S_IWUSR,
1731+				qdss_xport_names_show,
1732+				qdss_xport_names_store);
1733+
1734+/* 1(enable)/0(disable) the qdss debug interface */
1735+static struct device_attribute dev_attr_qdss_debug_intf =
1736+				__ATTR(debug_intf, S_IRUGO | S_IWUSR,
1737+				qdss_debug_intf_show,
1738+				qdss_debug_intf_store);
1739+
1740+static struct device_attribute *qdss_function_attributes[] = {
1741+					&dev_attr_qdss_transports,
1742+					&dev_attr_qdss_xport_names,
1743+					&dev_attr_qdss_debug_intf,
1744+					NULL };
1745+
1746+static struct android_usb_function qdss_function = {
1747+	.name		= "qdss",
1748+	.init		= qdss_function_init,
1749+	.cleanup	= qdss_function_cleanup,
1750+	.bind_config	= qdss_function_bind_config,
1751+	.attributes	= qdss_function_attributes,
1752+};
1753+
1754+/* SERIAL */
1755+#define MAX_SERIAL_INSTANCES 4
1756+struct serial_function_config {
1757+	int instances_on;
1758+	struct usb_function *f_serial[MAX_SERIAL_INSTANCES];
1759+	struct usb_function_instance *f_serial_inst[MAX_SERIAL_INSTANCES];
1760+};
1761+
1762+static char serial_transports[32];	/*enabled FSERIAL ports - "tty[,sdio]"*/
1763+static ssize_t serial_transports_store(
1764+		struct device *device, struct device_attribute *attr,
1765+		const char *buff, size_t size)
1766+{
1767+	strlcpy(serial_transports, buff, sizeof(serial_transports));
1768+
1769+	return size;
1770+}
1771+
1772+/*enabled FSERIAL transport names - "serial_hsic[,serial_hsusb]"*/
1773+static char serial_xport_names[32];
1774+static ssize_t serial_xport_names_store(
1775+		struct device *device, struct device_attribute *attr,
1776+		const char *buff, size_t size)
1777+{
1778+	strlcpy(serial_xport_names, buff, sizeof(serial_xport_names));
1779+
1780+	return size;
1781+}
1782+
1783+static ssize_t serial_xport_names_show(struct device *dev,
1784+		struct device_attribute *attr, char *buf)
1785+{
1786+	return snprintf(buf, PAGE_SIZE, "%s\n", serial_xport_names);
1787+}
1788+static ssize_t serial_modem_is_connected_show(
1789+		struct device *device, struct device_attribute *attr,
1790+		char *buff)
1791+{
1792+	unsigned int is_connected = gserial_is_connected();
1793+
1794+	return snprintf(buff, PAGE_SIZE, "%u\n", is_connected);
1795+}
1796+
1797+static ssize_t dun_w_softap_enable_show(
1798+		struct device *device, struct device_attribute *attr,
1799+		char *buff)
1800+{
1801+	unsigned int dun_w_softap_enable = gserial_is_dun_w_softap_enabled();
1802+
1803+	return snprintf(buff, PAGE_SIZE, "%u\n", dun_w_softap_enable);
1804+}
1805+
1806+static ssize_t dun_w_softap_enable_store(
1807+		struct device *device, struct device_attribute *attr,
1808+		const char *buff, size_t size)
1809+{
1810+	unsigned int dun_w_softap_enable;
1811+
1812+	sscanf(buff, "%u", &dun_w_softap_enable);
1813+
1814+	gserial_dun_w_softap_enable(dun_w_softap_enable);
1815+
1816+	return size;
1817+}
1818+
1819+static ssize_t dun_w_softap_active_show(
1820+		struct device *device, struct device_attribute *attr,
1821+		char *buff)
1822+{
1823+	unsigned int dun_w_softap_active = gserial_is_dun_w_softap_active();
1824+
1825+	return snprintf(buff, PAGE_SIZE, "%u\n", dun_w_softap_active);
1826+}
1827+
1828+static DEVICE_ATTR(is_connected_flag, S_IRUGO, serial_modem_is_connected_show,
1829+		NULL);
1830+static DEVICE_ATTR(dun_w_softap_enable, S_IRUGO | S_IWUSR,
1831+	dun_w_softap_enable_show, dun_w_softap_enable_store);
1832+static DEVICE_ATTR(dun_w_softap_active, S_IRUGO, dun_w_softap_active_show,
1833+		NULL);
1834+
1835+
1836+static DEVICE_ATTR(transports, S_IWUSR, NULL, serial_transports_store);
1837+static struct device_attribute dev_attr_serial_xport_names =
1838+				__ATTR(transport_names, S_IRUGO | S_IWUSR,
1839+				serial_xport_names_show,
1840+				serial_xport_names_store);
1841+
1842+static struct device_attribute *serial_function_attributes[] = {
1843+					&dev_attr_transports,
1844+					&dev_attr_serial_xport_names,
1845+					&dev_attr_is_connected_flag,
1846+					&dev_attr_dun_w_softap_enable,
1847+					&dev_attr_dun_w_softap_active,
1848+					NULL };
1849+
1850+static int serial_function_init(struct android_usb_function *f,
1851+					struct usb_composite_dev *cdev)
1852+{
1853+	struct serial_function_config *config;
1854+
1855+	config = kzalloc(sizeof(struct serial_function_config), GFP_KERNEL);
1856+	if (!config)
1857+		return -ENOMEM;
1858+
1859+	f->config = config;
1860+
1861+	return 0;
1862+}
1863+
1864+static void serial_function_cleanup(struct android_usb_function *f)
1865+{
1866+	int i;
1867+	struct serial_function_config *config = f->config;
1868+
1869+	gport_cleanup();
1870+	for (i = 0; i < config->instances_on; i++) {
1871+		usb_put_function(config->f_serial[i]);
1872+		usb_put_function_instance(config->f_serial_inst[i]);
1873+	}
1874+	kfree(f->config);
1875+	f->config = NULL;
1876+}
1877+
1878+static int serial_function_bind_config(struct android_usb_function *f,
1879+					struct usb_configuration *c)
1880+{
1881+	char *name, *xport_name = NULL;
1882+	char buf[32], *b, xport_name_buf[32], *tb;
1883+	int err = -1, i, ports = 0;
1884+	static int serial_initialized;
1885+	struct serial_function_config *config = f->config;
1886+	strlcpy(buf, serial_transports, sizeof(buf));
1887+	b = strim(buf);
1888+
1889+	strlcpy(xport_name_buf, serial_xport_names, sizeof(xport_name_buf));
1890+	tb = strim(xport_name_buf);
1891+
1892+	while (b) {
1893+		name = strsep(&b, ",");
1894+
1895+		if (name) {
1896+			if (tb)
1897+				xport_name = strsep(&tb, ",");
1898+			if (!serial_initialized) {
1899+				err = gserial_init_port(ports, name,
1900+						xport_name);
1901+				if (err) {
1902+					pr_err("serial: Cannot open port '%s'",
1903+							name);
1904+					goto out;
1905+				}
1906+				config->instances_on++;
1907+			}
1908+			ports++;
1909+			if (ports >= MAX_SERIAL_INSTANCES) {
1910+				pr_err("serial: max ports reached '%s'", name);
1911+				goto out;
1912+			}
1913+		}
1914+	}
1915+	/*
1916+	 * Make sure we always have two serials ports initialized to allow
1917+	 * switching composition from 1 serial function to 2 serial functions.
1918+	 * Mark 2nd port to use tty if user didn't specify transport.
1919+	 */
1920+	if ((config->instances_on == 1) && !serial_initialized) {
1921+		err = gserial_init_port(ports, "tty", "serial_tty");
1922+		if (err) {
1923+			pr_err("serial: Cannot open port '%s'", "tty");
1924+			goto out;
1925+		}
1926+		config->instances_on++;
1927+	}
1928+
1929+	/* limit the serial ports init only for boot ports */
1930+	if (ports > config->instances_on)
1931+		ports = config->instances_on;
1932+
1933+	if (serial_initialized)
1934+		goto bind_config;
1935+
1936+	err = gport_setup(c);
1937+	if (err) {
1938+		pr_err("serial: Cannot setup transports");
1939+		goto out;
1940+	}
1941+
1942+	for (i = 0; i < config->instances_on; i++) {
1943+		config->f_serial_inst[i] = usb_get_function_instance("gser");
1944+		if (IS_ERR(config->f_serial_inst[i])) {
1945+			err = PTR_ERR(config->f_serial_inst[i]);
1946+			goto err_gser_usb_get_function_instance;
1947+		}
1948+		config->f_serial[i] = usb_get_function(config->f_serial_inst[i]);
1949+		if (IS_ERR(config->f_serial[i])) {
1950+			err = PTR_ERR(config->f_serial[i]);
1951+			goto err_gser_usb_get_function;
1952+		}
1953+	}
1954+
1955+	serial_initialized = 1;
1956+
1957+bind_config:
1958+	for (i = 0; i < ports; i++) {
1959+		err = usb_add_function(c, config->f_serial[i]);
1960+		if (err) {
1961+			pr_err("Could not bind gser%u config\n", i);
1962+			goto err_gser_usb_add_function;
1963+		}
1964+	}
1965+	return 0;
1966+
1967+err_gser_usb_add_function:
1968+	while (i-- > 0)
1969+		usb_remove_function(c, config->f_serial[i]);
1970+
1971+	return err;
1972+
1973+err_gser_usb_get_function_instance:
1974+	while (i-- > 0) {
1975+		usb_put_function(config->f_serial[i]);
1976+err_gser_usb_get_function:
1977+		usb_put_function_instance(config->f_serial_inst[i]);
1978+	}
1979+
1980+out:
1981+	return err;
1982+}
1983+
1984+static struct android_usb_function serial_function = {
1985+	.name		= "serial",
1986+	.init		= serial_function_init,
1987+	.cleanup	= serial_function_cleanup,
1988+	.bind_config	= serial_function_bind_config,
1989+	.attributes	= serial_function_attributes,
1990+};
1991+
1992+/* CCID */
1993+static int ccid_function_init(struct android_usb_function *f,
1994+					struct usb_composite_dev *cdev)
1995+{
1996+	return ccid_setup();
1997+}
1998+
1999+static void ccid_function_cleanup(struct android_usb_function *f)
2000+{
2001+	ccid_cleanup();
2002+}
2003+
2004+static int ccid_function_bind_config(struct android_usb_function *f,
2005+					struct usb_configuration *c)
2006+{
2007+	return ccid_bind_config(c);
2008+}
2009+
2010+static struct android_usb_function ccid_function = {
2011+	.name		= "ccid",
2012+	.init		= ccid_function_init,
2013+	.cleanup	= ccid_function_cleanup,
2014+	.bind_config	= ccid_function_bind_config,
2015+};
2016+
2017+/* Charger */
2018+static int charger_function_bind_config(struct android_usb_function *f,
2019+						struct usb_configuration *c)
2020+{
2021+	return charger_bind_config(c);
2022+}
2023+
2024+static struct android_usb_function charger_function = {
2025+	.name		= "charging",
2026+	.bind_config	= charger_function_bind_config,
2027+};
2028+
2029+
2030+static int
2031+mtp_function_init(struct android_usb_function *f,
2032+		struct usb_composite_dev *cdev)
2033+{
2034+	return mtp_setup();
2035+}
2036+
2037+static void mtp_function_cleanup(struct android_usb_function *f)
2038+{
2039+	mtp_cleanup();
2040+}
2041+
2042+static int
2043+mtp_function_bind_config(struct android_usb_function *f,
2044+		struct usb_configuration *c)
2045+{
2046+	return mtp_bind_config(c, false);
2047+}
2048+
2049+static int
2050+ptp_function_init(struct android_usb_function *f,
2051+		struct usb_composite_dev *cdev)
2052+{
2053+	/* nothing to do - initialization is handled by mtp_function_init */
2054+	return 0;
2055+}
2056+
2057+static void ptp_function_cleanup(struct android_usb_function *f)
2058+{
2059+	/* nothing to do - cleanup is handled by mtp_function_cleanup */
2060+}
2061+
2062+static int
2063+ptp_function_bind_config(struct android_usb_function *f,
2064+		struct usb_configuration *c)
2065+{
2066+	return mtp_bind_config(c, true);
2067+}
2068+
2069+static int mtp_function_ctrlrequest(struct android_usb_function *f,
2070+					struct usb_composite_dev *cdev,
2071+					const struct usb_ctrlrequest *c)
2072+{
2073+	return mtp_ctrlrequest(cdev, c);
2074+}
2075+
2076+static int ptp_function_ctrlrequest(struct android_usb_function *f,
2077+					struct usb_composite_dev *cdev,
2078+					const struct usb_ctrlrequest *c)
2079+{
2080+	return mtp_ctrlrequest(cdev, c);
2081+}
2082+
2083+
2084+static struct android_usb_function mtp_function = {
2085+	.name		= "mtp",
2086+	.init		= mtp_function_init,
2087+	.cleanup	= mtp_function_cleanup,
2088+	.bind_config	= mtp_function_bind_config,
2089+	.ctrlrequest	= mtp_function_ctrlrequest,
2090+};
2091+
2092+/* PTP function is same as MTP with slightly different interface descriptor */
2093+static struct android_usb_function ptp_function = {
2094+	.name		= "ptp",
2095+	.init		= ptp_function_init,
2096+	.cleanup	= ptp_function_cleanup,
2097+	.bind_config	= ptp_function_bind_config,
2098+	.ctrlrequest	= ptp_function_ctrlrequest,
2099+};
2100+
2101+/* rndis transport string */
2102+static char rndis_transports[MAX_XPORT_STR_LEN];
2103+
2104+struct rndis_function_config {
2105+	u8      ethaddr[ETH_ALEN];
2106+	u32     vendorID;
2107+	u8	max_pkt_per_xfer;
2108+	u8	pkt_alignment_factor;
2109+	char	manufacturer[256];
2110+	/* "Wireless" RNDIS; auto-detected by Windows */
2111+	bool	wceis;
2112+	struct eth_dev *dev;
2113+};
2114+
2115+static int
2116+rndis_function_init(struct android_usb_function *f,
2117+		struct usb_composite_dev *cdev)
2118+{
2119+	f->config = kzalloc(sizeof(struct rndis_function_config), GFP_KERNEL);
2120+	if (!f->config)
2121+		return -ENOMEM;
2122+	return 0;
2123+}
2124+
2125+static void rndis_function_cleanup(struct android_usb_function *f)
2126+{
2127+	kfree(f->config);
2128+	f->config = NULL;
2129+}
2130+
2131+static int rndis_qc_function_init(struct android_usb_function *f,
2132+					struct usb_composite_dev *cdev)
2133+{
2134+	struct rndis_function_config *rndis;
2135+
2136+	rndis = kzalloc(sizeof(struct rndis_function_config), GFP_KERNEL);
2137+	if (!rndis)
2138+		return -ENOMEM;
2139+
2140+	rndis->wceis = true;
2141+
2142+	f->config = rndis;
2143+	return rndis_qc_init();
2144+}
2145+
2146+static void rndis_qc_function_cleanup(struct android_usb_function *f)
2147+{
2148+	rndis_qc_cleanup();
2149+	kfree(f->config);
2150+}
2151+
2152+static int
2153+rndis_function_bind_config(struct android_usb_function *f,
2154+		struct usb_configuration *c)
2155+{
2156+	int ret;
2157+	struct eth_dev *dev;
2158+	struct rndis_function_config *rndis = f->config;
2159+
2160+	if (!rndis) {
2161+		pr_err("%s: rndis_pdata\n", __func__);
2162+		return -1;
2163+	}
2164+
2165+	pr_info("%s MAC: %02X:%02X:%02X:%02X:%02X:%02X\n", __func__,
2166+		rndis->ethaddr[0], rndis->ethaddr[1], rndis->ethaddr[2],
2167+		rndis->ethaddr[3], rndis->ethaddr[4], rndis->ethaddr[5]);
2168+
2169+	if (rndis->ethaddr[0])
2170+		dev = gether_setup_name(c->cdev->gadget, dev_addr, host_addr,
2171+					NULL, qmult, "rndis");
2172+	else
2173+		dev = gether_setup_name(c->cdev->gadget, dev_addr, host_addr,
2174+					rndis->ethaddr, qmult, "rndis");
2175+	if (IS_ERR(dev)) {
2176+		ret = PTR_ERR(dev);
2177+		pr_err("%s: gether_setup failed\n", __func__);
2178+		return ret;
2179+	}
2180+	rndis->dev = dev;
2181+
2182+	if (rndis->wceis) {
2183+		/* "Wireless" RNDIS; auto-detected by Windows */
2184+		rndis_iad_descriptor.bFunctionClass =
2185+						USB_CLASS_WIRELESS_CONTROLLER;
2186+		rndis_iad_descriptor.bFunctionSubClass = 0x01;
2187+		rndis_iad_descriptor.bFunctionProtocol = 0x03;
2188+		rndis_control_intf.bInterfaceClass =
2189+						USB_CLASS_WIRELESS_CONTROLLER;
2190+		rndis_control_intf.bInterfaceSubClass =	 0x01;
2191+		rndis_control_intf.bInterfaceProtocol =	 0x03;
2192+	}
2193+
2194+	return rndis_bind_config_vendor(c, rndis->ethaddr, rndis->vendorID,
2195+					   rndis->manufacturer, rndis->dev);
2196+}
2197+
2198+static int rndis_qc_function_bind_config(struct android_usb_function *f,
2199+					struct usb_configuration *c)
2200+{
2201+	int ret;
2202+	char *trans;
2203+	struct rndis_function_config *rndis = f->config;
2204+
2205+	if (!rndis) {
2206+		pr_err("%s: rndis_pdata\n", __func__);
2207+		return -EINVAL;
2208+	}
2209+
2210+	pr_info("%s MAC: %02X:%02X:%02X:%02X:%02X:%02X\n", __func__,
2211+		rndis->ethaddr[0], rndis->ethaddr[1], rndis->ethaddr[2],
2212+		rndis->ethaddr[3], rndis->ethaddr[4], rndis->ethaddr[5]);
2213+
2214+	pr_debug("%s: rndis_transport is %s", __func__, rndis_transports);
2215+
2216+	trans = strim(rndis_transports);
2217+	if (strcmp("BAM2BAM_IPA", trans)) {
2218+		ret = gether_qc_setup_name(c->cdev->gadget,
2219+					rndis->ethaddr, "rndis");
2220+		if (ret) {
2221+			pr_err("%s: gether_setup failed\n", __func__);
2222+			return ret;
2223+		}
2224+	}
2225+
2226+	if (rndis->wceis) {
2227+		/* "Wireless" RNDIS; auto-detected by Windows */
2228+		rndis_qc_iad_descriptor.bFunctionClass =
2229+						USB_CLASS_WIRELESS_CONTROLLER;
2230+		rndis_qc_iad_descriptor.bFunctionSubClass = 0x01;
2231+		rndis_qc_iad_descriptor.bFunctionProtocol = 0x03;
2232+		rndis_qc_control_intf.bInterfaceClass =
2233+						USB_CLASS_WIRELESS_CONTROLLER;
2234+		rndis_qc_control_intf.bInterfaceSubClass =	 0x01;
2235+		rndis_qc_control_intf.bInterfaceProtocol =	 0x03;
2236+	}
2237+
2238+	return rndis_qc_bind_config_vendor(c, rndis->ethaddr, rndis->vendorID,
2239+			rndis->manufacturer, rndis->max_pkt_per_xfer,
2240+			rndis->pkt_alignment_factor, trans);
2241+}
2242+
2243+static void rndis_function_unbind_config(struct android_usb_function *f,
2244+						struct usb_configuration *c)
2245+{
2246+	struct rndis_function_config *rndis = f->config;
2247+	gether_cleanup(rndis->dev);
2248+}
2249+
2250+static void rndis_qc_function_unbind_config(struct android_usb_function *f,
2251+						struct usb_configuration *c)
2252+{
2253+	char *trans = strim(rndis_transports);
2254+
2255+	if (strcmp("BAM2BAM_IPA", trans)) {
2256+		bam_data_flush_workqueue();
2257+		gether_qc_cleanup_name("rndis0");
2258+	}
2259+}
2260+
2261+static ssize_t rndis_manufacturer_show(struct device *dev,
2262+		struct device_attribute *attr, char *buf)
2263+{
2264+	struct android_usb_function *f = dev_get_drvdata(dev);
2265+	struct rndis_function_config *config = f->config;
2266+
2267+	return snprintf(buf, PAGE_SIZE, "%s\n", config->manufacturer);
2268+}
2269+
2270+static ssize_t rndis_manufacturer_store(struct device *dev,
2271+		struct device_attribute *attr, const char *buf, size_t size)
2272+{
2273+	struct android_usb_function *f = dev_get_drvdata(dev);
2274+	struct rndis_function_config *config = f->config;
2275+
2276+	if (size >= sizeof(config->manufacturer))
2277+		return -EINVAL;
2278+
2279+	if (sscanf(buf, "%255s", config->manufacturer) == 1)
2280+		return size;
2281+	return -1;
2282+}
2283+
2284+static DEVICE_ATTR(manufacturer, S_IRUGO | S_IWUSR, rndis_manufacturer_show,
2285+						    rndis_manufacturer_store);
2286+
2287+static ssize_t rndis_wceis_show(struct device *dev,
2288+		struct device_attribute *attr, char *buf)
2289+{
2290+	struct android_usb_function *f = dev_get_drvdata(dev);
2291+	struct rndis_function_config *config = f->config;
2292+
2293+	return snprintf(buf, PAGE_SIZE, "%d\n", config->wceis);
2294+}
2295+
2296+static ssize_t rndis_wceis_store(struct device *dev,
2297+		struct device_attribute *attr, const char *buf, size_t size)
2298+{
2299+	struct android_usb_function *f = dev_get_drvdata(dev);
2300+	struct rndis_function_config *config = f->config;
2301+	int value;
2302+
2303+	if (sscanf(buf, "%d", &value) == 1) {
2304+		config->wceis = value;
2305+		return size;
2306+	}
2307+	return -EINVAL;
2308+}
2309+
2310+static DEVICE_ATTR(wceis, S_IRUGO | S_IWUSR, rndis_wceis_show,
2311+					     rndis_wceis_store);
2312+
2313+static ssize_t rndis_ethaddr_show(struct device *dev,
2314+		struct device_attribute *attr, char *buf)
2315+{
2316+	struct android_usb_function *f = dev_get_drvdata(dev);
2317+	struct rndis_function_config *rndis = f->config;
2318+
2319+	return snprintf(buf, PAGE_SIZE, "%02x:%02x:%02x:%02x:%02x:%02x\n",
2320+		rndis->ethaddr[0], rndis->ethaddr[1], rndis->ethaddr[2],
2321+		rndis->ethaddr[3], rndis->ethaddr[4], rndis->ethaddr[5]);
2322+}
2323+
2324+static ssize_t rndis_ethaddr_store(struct device *dev,
2325+		struct device_attribute *attr, const char *buf, size_t size)
2326+{
2327+	struct android_usb_function *f = dev_get_drvdata(dev);
2328+	struct rndis_function_config *rndis = f->config;
2329+
2330+	if (sscanf(buf, "%02x:%02x:%02x:%02x:%02x:%02x\n",
2331+		    (int *)&rndis->ethaddr[0], (int *)&rndis->ethaddr[1],
2332+		    (int *)&rndis->ethaddr[2], (int *)&rndis->ethaddr[3],
2333+		    (int *)&rndis->ethaddr[4], (int *)&rndis->ethaddr[5]) == 6)
2334+		return size;
2335+	return -EINVAL;
2336+}
2337+
2338+static DEVICE_ATTR(ethaddr, S_IRUGO | S_IWUSR, rndis_ethaddr_show,
2339+					       rndis_ethaddr_store);
2340+
2341+static ssize_t rndis_vendorID_show(struct device *dev,
2342+		struct device_attribute *attr, char *buf)
2343+{
2344+	struct android_usb_function *f = dev_get_drvdata(dev);
2345+	struct rndis_function_config *config = f->config;
2346+
2347+	return snprintf(buf, PAGE_SIZE, "%04x\n", config->vendorID);
2348+}
2349+
2350+static ssize_t rndis_vendorID_store(struct device *dev,
2351+		struct device_attribute *attr, const char *buf, size_t size)
2352+{
2353+	struct android_usb_function *f = dev_get_drvdata(dev);
2354+	struct rndis_function_config *config = f->config;
2355+	int value;
2356+
2357+	if (sscanf(buf, "%04x", &value) == 1) {
2358+		config->vendorID = value;
2359+		return size;
2360+	}
2361+	return -EINVAL;
2362+}
2363+
2364+static DEVICE_ATTR(vendorID, S_IRUGO | S_IWUSR, rndis_vendorID_show,
2365+						rndis_vendorID_store);
2366+
2367+static ssize_t rndis_max_pkt_per_xfer_show(struct device *dev,
2368+		struct device_attribute *attr, char *buf)
2369+{
2370+	struct android_usb_function *f = dev_get_drvdata(dev);
2371+	struct rndis_function_config *config = f->config;
2372+	return snprintf(buf, PAGE_SIZE, "%d\n", config->max_pkt_per_xfer);
2373+}
2374+
2375+static ssize_t rndis_max_pkt_per_xfer_store(struct device *dev,
2376+		struct device_attribute *attr, const char *buf, size_t size)
2377+{
2378+	struct android_usb_function *f = dev_get_drvdata(dev);
2379+	struct rndis_function_config *config = f->config;
2380+	int value;
2381+
2382+	if (sscanf(buf, "%d", &value) == 1) {
2383+		config->max_pkt_per_xfer = value;
2384+		return size;
2385+	}
2386+	return -EINVAL;
2387+}
2388+
2389+static DEVICE_ATTR(max_pkt_per_xfer, S_IRUGO | S_IWUSR,
2390+				   rndis_max_pkt_per_xfer_show,
2391+				   rndis_max_pkt_per_xfer_store);
2392+static ssize_t rndis_transports_show(struct device *dev,
2393+		struct device_attribute *attr, char *buf)
2394+{
2395+	return snprintf(buf, PAGE_SIZE, "%s\n", rndis_transports);
2396+}
2397+
2398+static ssize_t rndis_transports_store(struct device *dev,
2399+		struct device_attribute *attr, const char *buf, size_t size)
2400+{
2401+	strlcpy(rndis_transports, buf, sizeof(rndis_transports));
2402+	return size;
2403+}
2404+
2405+static DEVICE_ATTR(rndis_transports, S_IRUGO | S_IWUSR, rndis_transports_show,
2406+					       rndis_transports_store);
2407+
2408+static ssize_t rndis_pkt_alignment_factor_show(struct device *dev,
2409+		struct device_attribute *attr, char *buf)
2410+{
2411+	struct android_usb_function *f = dev_get_drvdata(dev);
2412+	struct rndis_function_config *config = f->config;
2413+
2414+	return snprintf(buf, PAGE_SIZE, "%d\n", config->pkt_alignment_factor);
2415+}
2416+
2417+static ssize_t rndis_pkt_alignment_factor_store(struct device *dev,
2418+		struct device_attribute *attr, const char *buf, size_t size)
2419+{
2420+	struct android_usb_function *f = dev_get_drvdata(dev);
2421+	struct rndis_function_config *config = f->config;
2422+	int value;
2423+
2424+	if (sscanf(buf, "%d", &value) == 1) {
2425+		config->pkt_alignment_factor = value;
2426+		return size;
2427+	}
2428+
2429+	return -EINVAL;
2430+}
2431+
2432+static DEVICE_ATTR(pkt_alignment_factor, S_IRUGO | S_IWUSR,
2433+					rndis_pkt_alignment_factor_show,
2434+					rndis_pkt_alignment_factor_store);
2435+
2436+static ssize_t rndis_rx_trigger_show(struct device *dev,
2437+		struct device_attribute *attr, char *buf)
2438+{
2439+	bool write = false;
2440+	int rx_trigger = rndis_rx_trigger(write);
2441+
2442+	return snprintf(buf, PAGE_SIZE, "%d\n", rx_trigger);
2443+}
2444+
2445+static ssize_t rndis_rx_trigger_store(struct device *dev,
2446+		struct device_attribute *attr, const char *buf, size_t size)
2447+{
2448+	int value;
2449+	bool write = true;
2450+
2451+	if (kstrtoint(buf, 10, &value)) {
2452+		rndis_rx_trigger(write);
2453+		return size;
2454+	}
2455+	return -EINVAL;
2456+}
2457+
2458+static DEVICE_ATTR(rx_trigger, S_IRUGO | S_IWUSR,
2459+					 rndis_rx_trigger_show,
2460+					 rndis_rx_trigger_store);
2461+
2462+static struct device_attribute *rndis_function_attributes[] = {
2463+	&dev_attr_manufacturer,
2464+	&dev_attr_wceis,
2465+	&dev_attr_ethaddr,
2466+	&dev_attr_vendorID,
2467+	&dev_attr_max_pkt_per_xfer,
2468+	&dev_attr_rndis_transports,
2469+	&dev_attr_pkt_alignment_factor,
2470+	&dev_attr_rx_trigger,
2471+	NULL
2472+};
2473+
2474+static struct android_usb_function rndis_function = {
2475+	.name		= "rndis",
2476+	.init		= rndis_function_init,
2477+	.cleanup	= rndis_function_cleanup,
2478+	.bind_config	= rndis_function_bind_config,
2479+	.unbind_config	= rndis_function_unbind_config,
2480+	.attributes	= rndis_function_attributes,
2481+};
2482+
2483+static struct android_usb_function rndis_qc_function = {
2484+	.name		= "rndis_qc",
2485+	.init		= rndis_qc_function_init,
2486+	.cleanup	= rndis_qc_function_cleanup,
2487+	.bind_config	= rndis_qc_function_bind_config,
2488+	.unbind_config	= rndis_qc_function_unbind_config,
2489+	.attributes	= rndis_function_attributes,
2490+};
2491+
2492+static int ecm_function_init(struct android_usb_function *f,
2493+				struct usb_composite_dev *cdev)
2494+{
2495+	struct ecm_function_config *config;
2496+	config = kzalloc(sizeof(struct ecm_function_config), GFP_KERNEL);
2497+	if (!config)
2498+		return -ENOMEM;
2499+
2500+	f->config = config;
2501+
2502+	return 0;
2503+}
2504+
2505+static void ecm_function_cleanup(struct android_usb_function *f)
2506+{
2507+	struct ecm_function_config *config = f->config;
2508+	if (config) {
2509+		usb_put_function(config->func);
2510+		usb_put_function_instance(config->fi);
2511+	}
2512+
2513+	kfree(f->config);
2514+}
2515+
2516+static int ecm_function_bind_config(struct android_usb_function *f,
2517+					struct usb_configuration *c)
2518+{
2519+	int ret;
2520+	struct ecm_function_config *ecm = f->config;
2521+	struct f_ecm_opts *ecm_opts = NULL;
2522+
2523+	if (!ecm) {
2524+		pr_err("%s: ecm config is null\n", __func__);
2525+		return -EINVAL;
2526+	}
2527+
2528+	pr_info("%s MAC: %s\n", __func__, ecm->new_host_addr);
2529+
2530+	ecm->fi = usb_get_function_instance("ecm");
2531+	if (IS_ERR(ecm->fi))
2532+		return PTR_ERR(ecm->fi);
2533+
2534+	ecm_opts = container_of(ecm->fi, struct f_ecm_opts, func_inst);
2535+	strlcpy(ecm_opts->net->name, "ecm%d", sizeof(ecm_opts->net->name));
2536+	gether_set_qmult(ecm_opts->net, qmult);
2537+	/* Reuse previous host_addr if already assigned */
2538+	if (ecm->ethaddr[0]) {
2539+		gether_set_host_addr(ecm_opts->net, ecm->new_host_addr);
2540+		pr_debug("reusing host ethernet address\n");
2541+	} else {
2542+		/* first time, use one specified by user else random mac */
2543+		if (!gether_set_host_addr(ecm_opts->net, host_addr))
2544+			pr_info("using host ethernet address: %s", host_addr);
2545+	}
2546+	if (!gether_set_dev_addr(ecm_opts->net, dev_addr))
2547+		pr_info("using self ethernet address: %s", dev_addr);
2548+
2549+	gether_set_gadget(ecm_opts->net, c->cdev->gadget);
2550+	ret = gether_register_netdev(ecm_opts->net);
2551+	if (ret) {
2552+		pr_err("%s: register_netdev failed\n", __func__);
2553+		return ret;
2554+	}
2555+
2556+	ecm_opts->bound = true;
2557+	gether_get_host_addr_u8(ecm_opts->net, ecm->ethaddr);
2558+	gether_get_host_addr(ecm_opts->net, ecm->new_host_addr,
2559+					sizeof(ecm->new_host_addr));
2560+
2561+	ecm->func = usb_get_function(ecm->fi);
2562+	if (IS_ERR(ecm->func)) {
2563+		pr_err("%s: usb_get_function failed\n", __func__);
2564+		return PTR_ERR(ecm->func);
2565+	}
2566+
2567+	return usb_add_function(c, ecm->func);
2568+}
2569+
2570+static void ecm_function_unbind_config(struct android_usb_function *f,
2571+						struct usb_configuration *c)
2572+{
2573+	struct ecm_function_config *ecm = f->config;
2574+
2575+	usb_put_function_instance(ecm->fi);
2576+}
2577+
2578+static struct android_usb_function ecm_function = {
2579+	.name		= "ecm",
2580+	.init		= ecm_function_init,
2581+	.cleanup	= ecm_function_cleanup,
2582+	.bind_config	= ecm_function_bind_config,
2583+	.unbind_config	= ecm_function_unbind_config,
2584+	.attributes	= ecm_function_attributes,
2585+};
2586+
2587+struct mass_storage_function_config {
2588+	struct usb_function *f_ms;
2589+	struct usb_function_instance *f_ms_inst;
2590+	char inquiry_string[INQUIRY_MAX_LEN];
2591+};
2592+
2593+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
2594+static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS;
2595+#else
2596+#define fsg_num_buffers	CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS
2597+#endif /* CONFIG_USB_GADGET_DEBUG_FILES */
2598+static struct fsg_module_parameters fsg_mod_data={
2599+      .ro[0]  = true,
2600+      .removable[0] = false,
2601+      .cdrom[0] = true,
2602+      .luns   = 1,
2603+};
2604+FSG_MODULE_PARAMETERS(/* no prefix */, fsg_mod_data);
2605+
2606+static int mass_storage_function_init(struct android_usb_function *f,
2607+					struct usb_composite_dev *cdev)
2608+{
2609+	struct mass_storage_function_config *config;
2610+	struct fsg_opts *fsg_opts;
2611+	struct fsg_config m_config;
2612+	int ret;
2613+
2614+	pr_debug("%s(): Inside\n", __func__);
2615+	config = kzalloc(sizeof(struct mass_storage_function_config),
2616+								GFP_KERNEL);
2617+	if (!config)
2618+		return -ENOMEM;
2619+	f->config = config;
2620+
2621+	config->f_ms_inst = usb_get_function_instance("mass_storage");
2622+	if (IS_ERR(config->f_ms_inst)) {
2623+		ret = PTR_ERR(config->f_ms_inst);
2624+		goto err_usb_get_function_instance;
2625+	}
2626+
2627+	fsg_mod_data.removable[0] = true;
2628+	fsg_config_from_params(&m_config, &fsg_mod_data, fsg_num_buffers);
2629+	fsg_opts = fsg_opts_from_func_inst(config->f_ms_inst);
2630+	ret = fsg_common_set_num_buffers(fsg_opts->common, fsg_num_buffers);
2631+	if (ret) {
2632+		pr_err("%s(): error(%d) for fsg_common_set_num_buffers\n",
2633+						__func__, ret);
2634+		goto err_set_num_buffers;
2635+	}
2636+
2637+	ret = fsg_common_set_nluns(fsg_opts->common, m_config.nluns);
2638+	if (ret) {
2639+		pr_err("%s(): error(%d) for fsg_common_set_nluns\n",
2640+						__func__, ret);
2641+		goto err_set_nluns;
2642+	}
2643+
2644+	ret = fsg_common_set_cdev(fsg_opts->common, cdev,
2645+						m_config.can_stall);
2646+	if (ret) {
2647+		pr_err("%s(): error(%d) for fsg_common_set_cdev\n",
2648+						__func__, ret);
2649+		goto err_set_cdev;
2650+	}
2651+
2652+	fsg_common_set_sysfs(fsg_opts->common, true);
2653+	ret = fsg_common_create_luns(fsg_opts->common, &m_config);
2654+	if (ret) {
2655+		pr_err("%s(): error(%d) for fsg_common_create_luns\n",
2656+						__func__, ret);
2657+		goto err_create_luns;
2658+	}
2659+
2660+	/* use default one currently */
2661+	fsg_common_set_inquiry_string(fsg_opts->common, m_config.vendor_name,
2662+							m_config.product_name);
2663+
2664+	ret = fsg_sysfs_update(fsg_opts->common, f->dev, true);
2665+	if (ret)
2666+		pr_err("%s(): error(%d) for creating sysfs\n", __func__, ret);
2667+
2668+	return 0;
2669+
2670+err_create_luns:
2671+err_set_cdev:
2672+	fsg_common_free_luns(fsg_opts->common);
2673+err_set_nluns:
2674+	fsg_common_free_buffers(fsg_opts->common);
2675+err_set_num_buffers:
2676+	usb_put_function_instance(config->f_ms_inst);
2677+err_usb_get_function_instance:
2678+	return ret;
2679+}
2680+
2681+static void mass_storage_function_cleanup(struct android_usb_function *f)
2682+{
2683+	struct fsg_opts *fsg_opts;
2684+	struct mass_storage_function_config *config = f->config;
2685+
2686+	pr_debug("%s(): Inside\n", __func__);
2687+	fsg_opts = fsg_opts_from_func_inst(config->f_ms_inst);
2688+	fsg_sysfs_update(fsg_opts->common, f->dev, false);
2689+	fsg_common_free_luns(fsg_opts->common);
2690+
2691+	usb_put_function_instance(config->f_ms_inst);
2692+	kfree(f->config);
2693+	f->config = NULL;
2694+}
2695+
2696+static int mass_storage_function_bind_config(struct android_usb_function *f,
2697+						struct usb_configuration *c)
2698+{
2699+	struct mass_storage_function_config *config = f->config;
2700+	int ret = 0;
2701+	int i;
2702+	struct fsg_opts *fsg_opts;
2703+
2704+	config->f_ms = usb_get_function(config->f_ms_inst);
2705+	if (IS_ERR(config->f_ms)) {
2706+		ret = PTR_ERR(config->f_ms);
2707+		return ret;
2708+	}
2709+
2710+	ret = usb_add_function(c, config->f_ms);
2711+	if (ret) {
2712+		pr_err("Could not bind ms%u config\n", i);
2713+		goto err_usb_add_function;
2714+	}
2715+
2716+	fsg_opts = fsg_opts_from_func_inst(config->f_ms_inst);
2717+	fsg_opts->no_configfs = true;
2718+
2719+	return 0;
2720+
2721+err_usb_add_function:
2722+	usb_put_function(config->f_ms);
2723+
2724+	return ret;
2725+}
2726+
2727+static void mass_storage_function_unbind_config(struct android_usb_function *f,
2728+					       struct usb_configuration *c)
2729+{
2730+	struct mass_storage_function_config *config = f->config;
2731+
2732+	usb_put_function(config->f_ms);
2733+}
2734+
2735+static ssize_t mass_storage_inquiry_show(struct device *dev,
2736+				struct device_attribute *attr, char *buf)
2737+{
2738+	struct android_usb_function *f = dev_get_drvdata(dev);
2739+	struct mass_storage_function_config *config = f->config;
2740+
2741+	return snprintf(buf, PAGE_SIZE, "%s\n", config->inquiry_string);
2742+}
2743+
2744+static ssize_t mass_storage_inquiry_store(struct device *dev,
2745+		struct device_attribute *attr, const char *buf, size_t size)
2746+{
2747+	struct android_usb_function *f = dev_get_drvdata(dev);
2748+	struct mass_storage_function_config *config = f->config;
2749+
2750+	if (size >= sizeof(config->inquiry_string))
2751+		return -EINVAL;
2752+
2753+	if (sscanf(buf, "%28s", config->inquiry_string) != 1)
2754+		return -EINVAL;
2755+
2756+	return size;
2757+}
2758+
2759+static DEVICE_ATTR(inquiry_string, S_IRUGO | S_IWUSR,
2760+					mass_storage_inquiry_show,
2761+					mass_storage_inquiry_store);
2762+
2763+static struct device_attribute *mass_storage_function_attributes[] = {
2764+	&dev_attr_inquiry_string,
2765+	NULL
2766+};
2767+
2768+static struct android_usb_function mass_storage_function = {
2769+	.name		= "mass_storage",
2770+	.init		= mass_storage_function_init,
2771+	.cleanup	= mass_storage_function_cleanup,
2772+	.bind_config	= mass_storage_function_bind_config,
2773+	.unbind_config	= mass_storage_function_unbind_config,
2774+	.attributes	= mass_storage_function_attributes,
2775+};
2776+
2777+
2778+static int accessory_function_init(struct android_usb_function *f,
2779+					struct usb_composite_dev *cdev)
2780+{
2781+	return acc_setup();
2782+}
2783+
2784+static void accessory_function_cleanup(struct android_usb_function *f)
2785+{
2786+	acc_cleanup();
2787+}
2788+
2789+static int accessory_function_bind_config(struct android_usb_function *f,
2790+						struct usb_configuration *c)
2791+{
2792+	return acc_bind_config(c);
2793+}
2794+
2795+static int accessory_function_ctrlrequest(struct android_usb_function *f,
2796+						struct usb_composite_dev *cdev,
2797+						const struct usb_ctrlrequest *c)
2798+{
2799+	return acc_ctrlrequest(cdev, c);
2800+}
2801+
2802+static struct android_usb_function accessory_function = {
2803+	.name		= "accessory",
2804+	.init		= accessory_function_init,
2805+	.cleanup	= accessory_function_cleanup,
2806+	.bind_config	= accessory_function_bind_config,
2807+	.ctrlrequest	= accessory_function_ctrlrequest,
2808+};
2809+
2810+struct audio_source_function_config {
2811+	struct usb_function *f_aud;
2812+	struct usb_function_instance *f_aud_inst;
2813+};
2814+
2815+static int audio_source_function_init(struct android_usb_function *f,
2816+			struct usb_composite_dev *cdev)
2817+{
2818+	struct audio_source_function_config *config;
2819+
2820+	config = kzalloc(sizeof(*config), GFP_KERNEL);
2821+	if (!config)
2822+		return -ENOMEM;
2823+
2824+	config->f_aud_inst = usb_get_function_instance("audio_source");
2825+	if (IS_ERR(config->f_aud_inst))
2826+		return PTR_ERR(config->f_aud_inst);
2827+
2828+	config->f_aud = usb_get_function(config->f_aud_inst);
2829+	if (IS_ERR(config->f_aud)) {
2830+		usb_put_function_instance(config->f_aud_inst);
2831+		return PTR_ERR(config->f_aud);
2832+	}
2833+
2834+	f->config = config;
2835+	return 0;
2836+}
2837+
2838+static void audio_source_function_cleanup(struct android_usb_function *f)
2839+{
2840+	struct audio_source_function_config *config = f->config;
2841+
2842+	usb_put_function(config->f_aud);
2843+	usb_put_function_instance(config->f_aud_inst);
2844+
2845+	kfree(f->config);
2846+	f->config = NULL;
2847+}
2848+
2849+static int audio_source_function_bind_config(struct android_usb_function *f,
2850+						struct usb_configuration *c)
2851+{
2852+	struct audio_source_function_config *config = f->config;
2853+
2854+	return usb_add_function(c, config->f_aud);
2855+}
2856+
2857+static struct android_usb_function audio_source_function = {
2858+	.name		= "audio_source",
2859+	.init		= audio_source_function_init,
2860+	.cleanup	= audio_source_function_cleanup,
2861+	.bind_config	= audio_source_function_bind_config,
2862+};
2863+
2864+#ifdef CONFIG_SND_RAWMIDI
2865+static int midi_function_init(struct android_usb_function *f,
2866+					struct usb_composite_dev *cdev)
2867+{
2868+	struct midi_alsa_config *config;
2869+
2870+	config = kzalloc(sizeof(struct midi_alsa_config), GFP_KERNEL);
2871+	f->config = config;
2872+	if (!config)
2873+		return -ENOMEM;
2874+	config->card = -1;
2875+	config->device = -1;
2876+	return 0;
2877+}
2878+
2879+static void midi_function_cleanup(struct android_usb_function *f)
2880+{
2881+	kfree(f->config);
2882+}
2883+
2884+static int midi_function_bind_config(struct android_usb_function *f,
2885+						struct usb_configuration *c)
2886+{
2887+	struct midi_alsa_config *config = f->config;
2888+
2889+	return f_midi_bind_config(c, SNDRV_DEFAULT_IDX1, SNDRV_DEFAULT_STR1,
2890+			MIDI_INPUT_PORTS, MIDI_OUTPUT_PORTS, MIDI_BUFFER_SIZE,
2891+			MIDI_QUEUE_LENGTH, config);
2892+}
2893+
2894+static ssize_t midi_alsa_show(struct device *dev,
2895+		struct device_attribute *attr, char *buf)
2896+{
2897+	struct android_usb_function *f = dev_get_drvdata(dev);
2898+	struct midi_alsa_config *config = f->config;
2899+
2900+	/* print ALSA card and device numbers */
2901+	return sprintf(buf, "%d %d\n", config->card, config->device);
2902+}
2903+
2904+static DEVICE_ATTR(alsa, S_IRUGO, midi_alsa_show, NULL);
2905+
2906+static struct device_attribute *midi_function_attributes[] = {
2907+	&dev_attr_alsa,
2908+	NULL
2909+};
2910+
2911+static struct android_usb_function midi_function = {
2912+	.name		= "midi",
2913+	.init		= midi_function_init,
2914+	.cleanup	= midi_function_cleanup,
2915+	.bind_config	= midi_function_bind_config,
2916+	.attributes	= midi_function_attributes,
2917+};
2918+#endif
2919+
2920+static int hid_function_init(struct android_usb_function *f, struct usb_composite_dev *cdev)
2921+{
2922+	return ghid_setup(cdev->gadget, 2);
2923+}
2924+
2925+static void hid_function_cleanup(struct android_usb_function *f)
2926+{
2927+	ghid_cleanup();
2928+}
2929+
2930+static int hid_function_bind_config(struct android_usb_function *f, struct usb_configuration *c)
2931+{
2932+	int ret;
2933+	printk(KERN_INFO "hid keyboard\n");
2934+	ret = hidg_bind_config(c, &ghid_device_android_keyboard, 0);
2935+	if (ret) {
2936+		pr_info("%s: hid_function_bind_config keyboard failed: %d\n", __func__, ret);
2937+		return ret;
2938+	}
2939+	printk(KERN_INFO "hid mouse\n");
2940+	ret = hidg_bind_config(c, &ghid_device_android_mouse, 1);
2941+	if (ret) {
2942+		pr_info("%s: hid_function_bind_config mouse failed: %d\n", __func__, ret);
2943+		return ret;
2944+	}
2945+	return 0;
2946+}
2947+
2948+static struct android_usb_function hid_function = {
2949+	.name		= "hid",
2950+	.init		= hid_function_init,
2951+	.cleanup	= hid_function_cleanup,
2952+	.bind_config	= hid_function_bind_config,
2953+};
2954+
2955+static int rndis_gsi_function_init(struct android_usb_function *f,
2956+					struct usb_composite_dev *cdev)
2957+{
2958+
2959+	/* "Wireless" RNDIS; auto-detected by Windows */
2960+	rndis_gsi_iad_descriptor.bFunctionClass =
2961+					USB_CLASS_WIRELESS_CONTROLLER;
2962+	rndis_gsi_iad_descriptor.bFunctionSubClass = 0x01;
2963+	rndis_gsi_iad_descriptor.bFunctionProtocol = 0x03;
2964+	rndis_gsi_control_intf.bInterfaceClass =
2965+					USB_CLASS_WIRELESS_CONTROLLER;
2966+	rndis_gsi_control_intf.bInterfaceSubClass =	 0x01;
2967+	rndis_gsi_control_intf.bInterfaceProtocol =	 0x03;
2968+
2969+	return gsi_function_init(IPA_USB_RNDIS);
2970+}
2971+
2972+static void rndis_gsi_function_cleanup(struct android_usb_function *f)
2973+{
2974+	gsi_function_cleanup(IPA_USB_RNDIS);
2975+}
2976+
2977+static int rndis_gsi_function_bind_config(struct android_usb_function *f,
2978+					struct usb_configuration *c)
2979+{
2980+
2981+	return gsi_bind_config(c, IPA_USB_RNDIS);
2982+}
2983+
2984+static struct android_usb_function rndis_gsi_function = {
2985+	.name		= "rndis_gsi",
2986+	.init		= rndis_gsi_function_init,
2987+	.cleanup	= rndis_gsi_function_cleanup,
2988+	.bind_config	= rndis_gsi_function_bind_config,
2989+};
2990+
2991+static int rmnet_gsi_function_init(struct android_usb_function *f,
2992+					struct usb_composite_dev *cdev)
2993+{
2994+	return gsi_function_init(IPA_USB_RMNET);
2995+}
2996+
2997+static void rmnet_gsi_function_cleanup(struct android_usb_function *f)
2998+{
2999+	gsi_function_cleanup(IPA_USB_RMNET);
3000+}
3001+
3002+static int rmnet_gsi_function_bind_config(struct android_usb_function *f,
3003+					 struct usb_configuration *c)
3004+{
3005+	return gsi_bind_config(c, IPA_USB_RMNET);
3006+}
3007+
3008+static struct android_usb_function rmnet_gsi_function = {
3009+	.name		= "rmnet_gsi",
3010+	.init		= rmnet_gsi_function_init,
3011+	.cleanup	= rmnet_gsi_function_cleanup,
3012+	.bind_config	= rmnet_gsi_function_bind_config,
3013+};
3014+
3015+static int ecm_gsi_function_init(struct android_usb_function *f,
3016+				struct usb_composite_dev *cdev)
3017+{
3018+	return gsi_function_init(IPA_USB_ECM);
3019+}
3020+
3021+static void ecm_gsi_function_cleanup(struct android_usb_function *f)
3022+{
3023+	return gsi_function_cleanup(IPA_USB_ECM);
3024+}
3025+
3026+static int ecm_gsi_function_bind_config(struct android_usb_function *f,
3027+					struct usb_configuration *c)
3028+{
3029+	return gsi_bind_config(c, IPA_USB_ECM);
3030+}
3031+
3032+static struct android_usb_function ecm_gsi_function = {
3033+	.name		= "ecm_gsi",
3034+	.init		= ecm_gsi_function_init,
3035+	.cleanup	= ecm_gsi_function_cleanup,
3036+	.bind_config	= ecm_gsi_function_bind_config,
3037+};
3038+
3039+static int mbim_gsi_function_init(struct android_usb_function *f,
3040+					 struct usb_composite_dev *cdev)
3041+{
3042+	return gsi_function_init(IPA_USB_MBIM);
3043+}
3044+
3045+static void mbim_gsi_function_cleanup(struct android_usb_function *f)
3046+{
3047+	gsi_function_cleanup(IPA_USB_MBIM);
3048+}
3049+
3050+static int mbim_gsi_function_bind_config(struct android_usb_function *f,
3051+					  struct usb_configuration *c)
3052+{
3053+	return gsi_bind_config(c, IPA_USB_MBIM);
3054+}
3055+
3056+static int mbim_gsi_function_ctrlrequest(struct android_usb_function *f,
3057+					struct usb_composite_dev *cdev,
3058+					const struct usb_ctrlrequest *c)
3059+{
3060+	return gsi_os_desc_ctrlrequest(cdev, c);
3061+}
3062+
3063+static struct android_usb_function mbim_gsi_function = {
3064+	.name		= "mbim_gsi",
3065+	.cleanup	= mbim_gsi_function_cleanup,
3066+	.bind_config	= mbim_gsi_function_bind_config,
3067+	.init		= mbim_gsi_function_init,
3068+	.ctrlrequest	= mbim_gsi_function_ctrlrequest,
3069+};
3070+
3071+static int dpl_gsi_function_init(struct android_usb_function *f,
3072+	struct usb_composite_dev *cdev)
3073+{
3074+	return gsi_function_init(IPA_USB_DIAG);
3075+}
3076+
3077+static void dpl_gsi_function_cleanup(struct android_usb_function *f)
3078+{
3079+	gsi_function_cleanup(IPA_USB_DIAG);
3080+}
3081+
3082+static int dpl_gsi_function_bind_config(struct android_usb_function *f,
3083+					struct usb_configuration *c)
3084+{
3085+	return gsi_bind_config(c, IPA_USB_DIAG);
3086+
3087+}
3088+
3089+static struct android_usb_function dpl_gsi_function = {
3090+	.name		= "dpl_gsi",
3091+	.init		= dpl_gsi_function_init,
3092+	.cleanup	= dpl_gsi_function_cleanup,
3093+	.bind_config	= dpl_gsi_function_bind_config,
3094+};
3095+
3096+static struct android_usb_function *supported_functions[] = {
3097+	[ANDROID_FFS] = &ffs_function,
3098+	[ANDROID_MBIM_BAM] = &mbim_function,
3099+	[ANDROID_ECM_BAM] = &ecm_qc_function,
3100+#ifdef CONFIG_SND_PCM
3101+	[ANDROID_AUDIO] = &audio_function,
3102+#endif
3103+	[ANDROID_RMNET] = &rmnet_function,
3104+	[ANDROID_GPS] = &gps_function,
3105+	[ANDROID_DIAG] = &diag_function,
3106+	[ANDROID_QDSS_BAM] = &qdss_function,
3107+	[ANDROID_SERIAL] = &serial_function,
3108+	[ANDROID_CCID] = &ccid_function,
3109+	[ANDROID_ACM] = &acm_function,
3110+	[ANDROID_MTP] = &mtp_function,
3111+	[ANDROID_PTP] = &ptp_function,
3112+	[ANDROID_RNDIS] = &rndis_function,
3113+	[ANDROID_RNDIS_BAM] = &rndis_qc_function,
3114+	[ANDROID_ECM] = &ecm_function,
3115+	[ANDROID_NCM] = &ncm_function,
3116+	[ANDROID_UMS] = &mass_storage_function,
3117+	[ANDROID_ACCESSORY] = &accessory_function,
3118+	[ANDROID_AUDIO_SRC] = &audio_source_function,
3119+	[ANDROID_CHARGER] = &charger_function,
3120+#ifdef CONFIG_SND_RAWMIDI
3121+	[ANDROID_MIDI] = &midi_function,
3122+#endif
3123+	[ANDROID_HID] = &hid_function,
3124+	[ANDROID_RNDIS_GSI] = &rndis_gsi_function,
3125+	[ANDROID_ECM_GSI] = &ecm_gsi_function,
3126+	[ANDROID_RMNET_GSI] = &rmnet_gsi_function,
3127+	[ANDROID_MBIM_GSI] = &mbim_gsi_function,
3128+	[ANDROID_DPL_GSI] = &dpl_gsi_function,
3129+	NULL
3130+};
3131+
3132+static struct android_usb_function *default_functions[] = {
3133+	&ffs_function,
3134+	&mbim_function,
3135+	&ecm_qc_function,
3136+#ifdef CONFIG_SND_PCM
3137+	&audio_function,
3138+#endif
3139+	&rmnet_function,
3140+	&gps_function,
3141+	&diag_function,
3142+	&qdss_function,
3143+	&serial_function,
3144+	&ccid_function,
3145+	&acm_function,
3146+	&mtp_function,
3147+	&ptp_function,
3148+	&rndis_function,
3149+	&rndis_qc_function,
3150+	&ecm_function,
3151+	&ncm_function,
3152+	&mass_storage_function,
3153+	&accessory_function,
3154+	&audio_source_function,
3155+	&charger_function,
3156+#ifdef CONFIG_SND_RAWMIDI
3157+	&midi_function,
3158+#endif
3159+	&hid_function,
3160+	NULL
3161+};
3162+
3163+static void android_cleanup_functions(struct android_usb_function **functions)
3164+{
3165+	struct android_usb_function *f;
3166+	struct device_attribute **attrs;
3167+	struct device_attribute *attr;
3168+
3169+	while (*functions) {
3170+		f = *functions++;
3171+
3172+		if (f->dev) {
3173+			device_destroy(android_class, f->dev->devt);
3174+			kfree(f->dev_name);
3175+		} else
3176+			continue;
3177+
3178+		if (f->cleanup)
3179+			f->cleanup(f);
3180+
3181+		attrs = f->attributes;
3182+		if (attrs) {
3183+			while ((attr = *attrs++))
3184+				device_remove_file(f->dev, attr);
3185+		}
3186+	}
3187+}
3188+
3189+/*
3190+ * HACK: this is an override for the same named function in configfs.c
3191+ * which is only available if CONFIGFS_UEVENT is defined, apparently when
3192+ * the Android gadget is implemented with ConfigFS instead of this file.
3193+ *
3194+ * The audio_source function driver seems to need this routine in order to
3195+ * retrieve a pointer to the function device instance under the android_device
3196+ * parent which we can retrieve from the android_usb_function structure here.
3197+ */
3198+struct device *create_function_device(char *name)
3199+{
3200+	struct android_dev *dev;
3201+	struct android_usb_function **functions;
3202+	struct android_usb_function *f;
3203+
3204+	dev = list_entry(android_dev_list.prev, struct android_dev, list_item);
3205+	functions = dev->functions;
3206+
3207+	while ((f = *functions++))
3208+		if (!strcmp(name, f->dev_name))
3209+			return f->dev;
3210+
3211+	return ERR_PTR(-EINVAL);
3212+}
3213+
3214+static int android_init_functions(struct android_usb_function **functions,
3215+				  struct usb_composite_dev *cdev)
3216+{
3217+	struct android_dev *dev = cdev_to_android_dev(cdev);
3218+	struct android_usb_function *f;
3219+	struct device_attribute **attrs;
3220+	struct device_attribute *attr;
3221+	int err = 0;
3222+	int index = 2; /* index 0 is for android0 device
3223+			* index 1 is for android1 device
3224+			*/
3225+
3226+	cdev->use_os_string = true;
3227+	for (; (f = *functions++); index++) {
3228+		f->dev_name = kasprintf(GFP_KERNEL, "f_%s", f->name);
3229+		f->android_dev = NULL;
3230+		if (!f->dev_name) {
3231+			err = -ENOMEM;
3232+			goto err_out;
3233+		}
3234+		f->dev = device_create(android_class, dev->dev,
3235+				MKDEV(0, index), f, f->dev_name);
3236+		if (IS_ERR(f->dev)) {
3237+			pr_err("%s: Failed to create dev %s", __func__,
3238+							f->dev_name);
3239+			err = PTR_ERR(f->dev);
3240+			f->dev = NULL;
3241+			goto err_create;
3242+		}
3243+
3244+		if (f->init) {
3245+			err = f->init(f, cdev);
3246+			if (err) {
3247+				pr_err("%s: Failed to init %s", __func__,
3248+								f->name);
3249+				goto err_init;
3250+			}
3251+		}
3252+
3253+		attrs = f->attributes;
3254+		if (attrs) {
3255+			while ((attr = *attrs++) && !err)
3256+				err = device_create_file(f->dev, attr);
3257+		}
3258+		if (err) {
3259+			pr_err("%s: Failed to create function %s attributes",
3260+					__func__, f->name);
3261+			goto err_attrs;
3262+		}
3263+	}
3264+	return 0;
3265+
3266+err_attrs:
3267+	for (attr = *(attrs -= 2); attrs != f->attributes; attr = *(attrs--))
3268+		device_remove_file(f->dev, attr);
3269+	if (f->cleanup)
3270+		f->cleanup(f);
3271+err_init:
3272+	device_destroy(android_class, f->dev->devt);
3273+err_create:
3274+	f->dev = NULL;
3275+	kfree(f->dev_name);
3276+err_out:
3277+	android_cleanup_functions(dev->functions);
3278+	return err;
3279+}
3280+
3281+static int
3282+android_bind_enabled_functions(struct android_dev *dev,
3283+			       struct usb_configuration *c)
3284+{
3285+	struct android_usb_function_holder *f_holder;
3286+	struct android_configuration *conf =
3287+		container_of(c, struct android_configuration, usb_config);
3288+	int ret;
3289+
3290+	list_for_each_entry(f_holder, &conf->enabled_functions, enabled_list) {
3291+		ret = f_holder->f->bind_config(f_holder->f, c);
3292+		if (ret) {
3293+			pr_err("%s: %s failed\n", __func__, f_holder->f->name);
3294+			while (!list_empty(&c->functions)) {
3295+				struct usb_function		*f;
3296+
3297+				f = list_first_entry(&c->functions,
3298+					struct usb_function, list);
3299+				if (f->config) {
3300+					list_del(&f->list);
3301+					if (f->unbind)
3302+						f->unbind(c, f);
3303+				}
3304+			}
3305+			if (c->unbind)
3306+				c->unbind(c);
3307+			return ret;
3308+		}
3309+		f_holder->f->bound = true;
3310+	}
3311+	return 0;
3312+}
3313+
3314+static void
3315+android_unbind_enabled_functions(struct android_dev *dev,
3316+			       struct usb_configuration *c)
3317+{
3318+	struct android_usb_function_holder *f_holder;
3319+	struct android_configuration *conf =
3320+		container_of(c, struct android_configuration, usb_config);
3321+
3322+	list_for_each_entry(f_holder, &conf->enabled_functions, enabled_list) {
3323+		if (f_holder->f->bound && f_holder->f->unbind_config)
3324+			f_holder->f->unbind_config(f_holder->f, c);
3325+		f_holder->f->bound = false;
3326+	}
3327+}
3328+static int android_enable_function(struct android_dev *dev,
3329+				   struct android_configuration *conf,
3330+				   char *name)
3331+{
3332+	struct android_usb_function **functions = dev->functions;
3333+	struct android_usb_function *f;
3334+	struct android_usb_function_holder *f_holder;
3335+
3336+	while ((f = *functions++)) {
3337+		if (!strcmp(name, f->name)) {
3338+			if (f->android_dev && f->android_dev != dev)
3339+				pr_err("%s is enabled in other device\n",
3340+					f->name);
3341+			else {
3342+				f_holder = kzalloc(sizeof(*f_holder),
3343+						GFP_KERNEL);
3344+				if (!f_holder) {
3345+					pr_err("Failed to alloc f_holder\n");
3346+					return -ENOMEM;
3347+				}
3348+
3349+				f->android_dev = dev;
3350+				f_holder->f = f;
3351+				list_add_tail(&f_holder->enabled_list,
3352+					      &conf->enabled_functions);
3353+				pr_debug("func:%s is enabled.\n", f->name);
3354+
3355+				return 0;
3356+			}
3357+		}
3358+	}
3359+	return -EINVAL;
3360+}
3361+
3362+/*-------------------------------------------------------------------------*/
3363+/* /sys/class/android_usb/android%d/ interface */
3364+
3365+static ssize_t remote_wakeup_show(struct device *pdev,
3366+		struct device_attribute *attr, char *buf)
3367+{
3368+	struct android_dev *dev = dev_get_drvdata(pdev);
3369+	struct android_configuration *conf;
3370+
3371+	/*
3372+	 * Show the wakeup attribute of the first configuration,
3373+	 * since all configurations have the same wakeup attribute
3374+	 */
3375+	if (dev->configs_num == 0)
3376+		return 0;
3377+	conf = list_entry(dev->configs.next,
3378+			  struct android_configuration,
3379+			  list_item);
3380+
3381+	return snprintf(buf, PAGE_SIZE, "%d\n",
3382+			!!(conf->usb_config.bmAttributes &
3383+				USB_CONFIG_ATT_WAKEUP));
3384+}
3385+
3386+static ssize_t remote_wakeup_store(struct device *pdev,
3387+		struct device_attribute *attr, const char *buff, size_t size)
3388+{
3389+	struct android_dev *dev = dev_get_drvdata(pdev);
3390+	struct android_configuration *conf;
3391+	int enable = 0;
3392+
3393+	sscanf(buff, "%d", &enable);
3394+
3395+	pr_debug("android_usb: %s remote wakeup\n",
3396+			enable ? "enabling" : "disabling");
3397+
3398+	list_for_each_entry(conf, &dev->configs, list_item)
3399+		if (enable)
3400+			conf->usb_config.bmAttributes |=
3401+					USB_CONFIG_ATT_WAKEUP;
3402+		else
3403+			conf->usb_config.bmAttributes &=
3404+					~USB_CONFIG_ATT_WAKEUP;
3405+
3406+	return size;
3407+}
3408+
3409+static ssize_t
3410+functions_show(struct device *pdev, struct device_attribute *attr, char *buf)
3411+{
3412+	struct android_dev *dev = dev_get_drvdata(pdev);
3413+	struct android_configuration *conf;
3414+	struct android_usb_function_holder *f_holder;
3415+	char *buff = buf;
3416+
3417+	mutex_lock(&dev->mutex);
3418+
3419+	list_for_each_entry(conf, &dev->configs, list_item) {
3420+		if (buff != buf)
3421+			*(buff-1) = ':';
3422+		list_for_each_entry(f_holder, &conf->enabled_functions,
3423+					enabled_list)
3424+			buff += snprintf(buff, PAGE_SIZE, "%s,",
3425+					f_holder->f->name);
3426+	}
3427+
3428+	mutex_unlock(&dev->mutex);
3429+
3430+	if (buff != buf)
3431+		*(buff-1) = '\n';
3432+	return buff - buf;
3433+}
3434+
3435+static ssize_t
3436+functions_store(struct device *pdev, struct device_attribute *attr,
3437+			       const char *buff, size_t size)
3438+{
3439+	struct android_dev *dev = dev_get_drvdata(pdev);
3440+	struct list_head *curr_conf = &dev->configs;
3441+	struct android_configuration *conf;
3442+	char *conf_str;
3443+	struct android_usb_function_holder *f_holder;
3444+	char *name;
3445+	char buf[256], *b;
3446+	char aliases[256], *a;
3447+	int err;
3448+	int ffs_enabled = 0;
3449+	int hid_enabled = 0;
3450+
3451+	mutex_lock(&dev->mutex);
3452+
3453+	if (dev->enabled) {
3454+		mutex_unlock(&dev->mutex);
3455+		return -EBUSY;
3456+	}
3457+
3458+	/* Clear previous enabled list */
3459+	list_for_each_entry(conf, &dev->configs, list_item) {
3460+		while (conf->enabled_functions.next !=
3461+				&conf->enabled_functions) {
3462+			f_holder = list_entry(conf->enabled_functions.next,
3463+					typeof(*f_holder),
3464+					enabled_list);
3465+			f_holder->f->android_dev = NULL;
3466+			list_del(&f_holder->enabled_list);
3467+			kfree(f_holder);
3468+		}
3469+		INIT_LIST_HEAD(&conf->enabled_functions);
3470+	}
3471+    pr_err("android_usb: functions_store'%s'\n",buff);
3472+	strlcpy(buf, buff, sizeof(buf));
3473+	b = strim(buf);
3474+
3475+	while (b) {
3476+		conf_str = strsep(&b, ":");
3477+		if (!conf_str)
3478+			continue;
3479+
3480+		/* If the next not equal to the head, take it */
3481+		if (curr_conf->next != &dev->configs)
3482+			conf = list_entry(curr_conf->next,
3483+					  struct android_configuration,
3484+					  list_item);
3485+		else
3486+			conf = alloc_android_config(dev);
3487+
3488+		curr_conf = curr_conf->next;
3489+		while (conf_str) {
3490+			name = strsep(&conf_str, ",");
3491+			strlcpy(aliases, dev->ffs_aliases, sizeof(aliases));
3492+			a = aliases;
3493+
3494+			while (a) {
3495+				char *alias = strsep(&a, ",");
3496+				if (alias && !strcmp(name, alias)) {
3497+					name = "ffs";
3498+					break;
3499+				}
3500+			}
3501+
3502+			if (ffs_enabled && !strcmp(name, "ffs"))
3503+				continue;
3504+
3505+			if (!strcmp(name, "hid"))
3506+				continue; /* enable HID gadgets last */
3507+
3508+			if (!strcmp(name, "rndis") &&
3509+				!strcmp(strim(rndis_transports), "BAM2BAM_IPA"))
3510+				name = "rndis_qc";
3511+
3512+			err = android_enable_function(dev, conf, name);
3513+			if (err) {
3514+				pr_err("android_usb: Cannot enable '%s' (%d)",
3515+							name, err);
3516+				continue;
3517+			}
3518+
3519+			if (!strcmp(name, "ffs"))
3520+				ffs_enabled = 1;
3521+		}
3522+	//
3523+	//	/* always enable HID gadgets */
3524+	//	if (!hid_enabled) {
3525+	//		name = "hid";
3526+	//		err = android_enable_function(dev, conf, name);
3527+	//		if (err)
3528+	//			pr_err("android_usb: Cannot enable '%s' (%d)",
3529+	//						name, err);
3530+	//		else
3531+	//			hid_enabled = 1;
3532+	//	}
3533+	}
3534+
3535+	/* Free uneeded configurations if exists */
3536+	while (curr_conf->next != &dev->configs) {
3537+		conf = list_entry(curr_conf->next,
3538+				  struct android_configuration, list_item);
3539+		free_android_config(dev, conf);
3540+	}
3541+
3542+	mutex_unlock(&dev->mutex);
3543+
3544+	return size;
3545+}
3546+
3547+static ssize_t enable_show(struct device *pdev, struct device_attribute *attr,
3548+			   char *buf)
3549+{
3550+	struct android_dev *dev = dev_get_drvdata(pdev);
3551+
3552+	return snprintf(buf, PAGE_SIZE, "%d\n", dev->enabled);
3553+}
3554+
3555+static ssize_t enable_store(struct device *pdev, struct device_attribute *attr,
3556+			    const char *buff, size_t size)
3557+{
3558+	struct android_dev *dev = dev_get_drvdata(pdev);
3559+	struct usb_composite_dev *cdev = dev->cdev;
3560+	struct android_usb_function_holder *f_holder;
3561+	struct android_configuration *conf;
3562+	int enabled = 0;
3563+	bool audio_enabled = false;
3564+	static DEFINE_RATELIMIT_STATE(rl, 10*HZ, 1);
3565+	int err = 0;
3566+
3567+	if (!cdev)
3568+		return -ENODEV;
3569+
3570+	mutex_lock(&dev->mutex);
3571+
3572+	sscanf(buff, "%d", &enabled);
3573+	if (enabled && !dev->enabled) {
3574+		/*
3575+		 * Update values in composite driver's copy of
3576+		 * device descriptor.
3577+		 */
3578+		cdev->desc.idVendor = device_desc.idVendor;
3579+		cdev->desc.idProduct = device_desc.idProduct;
3580+		if (device_desc.bcdDevice)
3581+			cdev->desc.bcdDevice = device_desc.bcdDevice;
3582+		cdev->desc.bDeviceClass = device_desc.bDeviceClass;
3583+		cdev->desc.bDeviceSubClass = device_desc.bDeviceSubClass;
3584+		cdev->desc.bDeviceProtocol = device_desc.bDeviceProtocol;
3585+
3586+		/* Audio dock accessory is unable to enumerate device if
3587+		 * pull-up is enabled immediately. The enumeration is
3588+		 * reliable with 100 msec delay.
3589+		 */
3590+		list_for_each_entry(conf, &dev->configs, list_item)
3591+			list_for_each_entry(f_holder, &conf->enabled_functions,
3592+						enabled_list) {
3593+				if (f_holder->f->enable)
3594+					f_holder->f->enable(f_holder->f);
3595+				if (!strncmp(f_holder->f->name,
3596+						"audio_source", 12))
3597+					audio_enabled = true;
3598+			}
3599+		if (audio_enabled)
3600+			msleep(100);
3601+		err = android_enable(dev);
3602+		if (err < 0) {
3603+			pr_err("%s: android_enable failed\n", __func__);
3604+			dev->connected = 0;
3605+			dev->enabled = true;
3606+			mutex_unlock(&dev->mutex);
3607+			return size;
3608+		}
3609+		dev->enabled = true;
3610+	} else if (!enabled && dev->enabled) {
3611+		android_disable(dev);
3612+		list_for_each_entry(conf, &dev->configs, list_item)
3613+			list_for_each_entry(f_holder, &conf->enabled_functions,
3614+						enabled_list) {
3615+				if (f_holder->f->disable)
3616+					f_holder->f->disable(f_holder->f);
3617+			}
3618+		dev->enabled = false;
3619+	} else if (__ratelimit(&rl)) {
3620+		pr_err("android_usb: already %s\n",
3621+				dev->enabled ? "enabled" : "disabled");
3622+	}
3623+
3624+	mutex_unlock(&dev->mutex);
3625+
3626+	return size;
3627+}
3628+
3629+static ssize_t pm_qos_show(struct device *pdev,
3630+			   struct device_attribute *attr, char *buf)
3631+{
3632+	struct android_dev *dev = dev_get_drvdata(pdev);
3633+
3634+	return snprintf(buf, PAGE_SIZE, "%s\n", dev->pm_qos);
3635+}
3636+
3637+static ssize_t pm_qos_store(struct device *pdev,
3638+			   struct device_attribute *attr,
3639+			   const char *buff, size_t size)
3640+{
3641+	struct android_dev *dev = dev_get_drvdata(pdev);
3642+
3643+	strlcpy(dev->pm_qos, buff, sizeof(dev->pm_qos));
3644+
3645+	return size;
3646+}
3647+
3648+static ssize_t pm_qos_state_show(struct device *pdev,
3649+			struct device_attribute *attr, char *buf)
3650+{
3651+	struct android_dev *dev = dev_get_drvdata(pdev);
3652+
3653+	return snprintf(buf, PAGE_SIZE, "%s\n",
3654+				pm_qos_to_string(dev->curr_pm_qos_state));
3655+}
3656+
3657+static ssize_t state_show(struct device *pdev, struct device_attribute *attr,
3658+			   char *buf)
3659+{
3660+	struct android_dev *dev = dev_get_drvdata(pdev);
3661+	struct usb_composite_dev *cdev = dev->cdev;
3662+	char *state = "DISCONNECTED";
3663+	unsigned long flags;
3664+
3665+	if (!cdev)
3666+		goto out;
3667+
3668+	spin_lock_irqsave(&cdev->lock, flags);
3669+	if (cdev->config)
3670+		state = "CONFIGURED";
3671+	else if (dev->connected)
3672+		state = "CONNECTED";
3673+	spin_unlock_irqrestore(&cdev->lock, flags);
3674+out:
3675+	return snprintf(buf, PAGE_SIZE, "%s\n", state);
3676+}
3677+
3678+#define ANDROID_DEV_ATTR(field, format_string)				\
3679+static ssize_t								\
3680+field ## _show(struct device *pdev, struct device_attribute *attr,	\
3681+		char *buf)						\
3682+{									\
3683+	struct android_dev *dev = dev_get_drvdata(pdev);		\
3684+									\
3685+	return snprintf(buf, PAGE_SIZE,					\
3686+			format_string, dev->field);			\
3687+}									\
3688+static ssize_t								\
3689+field ## _store(struct device *pdev, struct device_attribute *attr,	\
3690+		const char *buf, size_t size)				\
3691+{									\
3692+	unsigned value;							\
3693+	struct android_dev *dev = dev_get_drvdata(pdev);		\
3694+									\
3695+	if (sscanf(buf, format_string, &value) == 1) {			\
3696+		dev->field = value;					\
3697+		return size;						\
3698+	}								\
3699+	return -EINVAL;							\
3700+}									\
3701+static DEVICE_ATTR(field, S_IRUGO | S_IWUSR, field ## _show, field ## _store);
3702+
3703+#define DESCRIPTOR_ATTR(field, format_string)				\
3704+static ssize_t								\
3705+field ## _show(struct device *dev, struct device_attribute *attr,	\
3706+		char *buf)						\
3707+{									\
3708+	return snprintf(buf, PAGE_SIZE,					\
3709+			format_string, device_desc.field);		\
3710+}									\
3711+static ssize_t								\
3712+field ## _store(struct device *dev, struct device_attribute *attr,	\
3713+		const char *buf, size_t size)				\
3714+{									\
3715+	int value;							\
3716+	if (sscanf(buf, format_string, &value) == 1) {			\
3717+		device_desc.field = value;				\
3718+		return size;						\
3719+	}								\
3720+	return -1;							\
3721+}									\
3722+static DEVICE_ATTR(field, S_IRUGO | S_IWUSR, field ## _show, field ## _store);
3723+
3724+#define DESCRIPTOR_STRING_ATTR(field, buffer)				\
3725+static ssize_t								\
3726+field ## _show(struct device *dev, struct device_attribute *attr,	\
3727+		char *buf)						\
3728+{									\
3729+	return snprintf(buf, PAGE_SIZE, "%s", buffer);			\
3730+}									\
3731+static ssize_t								\
3732+field ## _store(struct device *dev, struct device_attribute *attr,	\
3733+		const char *buf, size_t size)				\
3734+{									\
3735+	if (size >= sizeof(buffer))					\
3736+		return -EINVAL;						\
3737+	strlcpy(buffer, buf, sizeof(buffer));				\
3738+	strim(buffer);							\
3739+	return size;							\
3740+}									\
3741+static DEVICE_ATTR(field, S_IRUGO | S_IWUSR, field ## _show, field ## _store);
3742+
3743+
3744+DESCRIPTOR_ATTR(idVendor, "%04x\n")
3745+DESCRIPTOR_ATTR(idProduct, "%04x\n")
3746+DESCRIPTOR_ATTR(bcdDevice, "%04x\n")
3747+DESCRIPTOR_ATTR(bDeviceClass, "%d\n")
3748+DESCRIPTOR_ATTR(bDeviceSubClass, "%d\n")
3749+DESCRIPTOR_ATTR(bDeviceProtocol, "%d\n")
3750+DESCRIPTOR_STRING_ATTR(iManufacturer, manufacturer_string)
3751+DESCRIPTOR_STRING_ATTR(iProduct, product_string)
3752+DESCRIPTOR_STRING_ATTR(iSerial, serial_string)
3753+
3754+static DEVICE_ATTR(functions, S_IRUGO | S_IWUSR, functions_show,
3755+						 functions_store);
3756+static DEVICE_ATTR(enable, S_IRUGO | S_IWUSR, enable_show, enable_store);
3757+
3758+static DEVICE_ATTR(pm_qos, S_IRUGO | S_IWUSR, pm_qos_show, pm_qos_store);
3759+static DEVICE_ATTR(pm_qos_state, S_IRUGO, pm_qos_state_show, NULL);
3760+ANDROID_DEV_ATTR(up_pm_qos_sample_sec, "%u\n");
3761+ANDROID_DEV_ATTR(down_pm_qos_sample_sec, "%u\n");
3762+ANDROID_DEV_ATTR(up_pm_qos_threshold, "%u\n");
3763+ANDROID_DEV_ATTR(down_pm_qos_threshold, "%u\n");
3764+ANDROID_DEV_ATTR(idle_pc_rpm_no_int_secs, "%u\n");
3765+
3766+static DEVICE_ATTR(state, S_IRUGO, state_show, NULL);
3767+static DEVICE_ATTR(remote_wakeup, S_IRUGO | S_IWUSR,
3768+		remote_wakeup_show, remote_wakeup_store);
3769+
3770+static struct device_attribute *android_usb_attributes[] = {
3771+	&dev_attr_idVendor,
3772+	&dev_attr_idProduct,
3773+	&dev_attr_bcdDevice,
3774+	&dev_attr_bDeviceClass,
3775+	&dev_attr_bDeviceSubClass,
3776+	&dev_attr_bDeviceProtocol,
3777+	&dev_attr_iManufacturer,
3778+	&dev_attr_iProduct,
3779+	&dev_attr_iSerial,
3780+	&dev_attr_functions,
3781+	&dev_attr_enable,
3782+	&dev_attr_pm_qos,
3783+	&dev_attr_up_pm_qos_sample_sec,
3784+	&dev_attr_down_pm_qos_sample_sec,
3785+	&dev_attr_up_pm_qos_threshold,
3786+	&dev_attr_down_pm_qos_threshold,
3787+	&dev_attr_idle_pc_rpm_no_int_secs,
3788+	&dev_attr_pm_qos_state,
3789+	&dev_attr_state,
3790+	&dev_attr_remote_wakeup,
3791+	NULL
3792+};
3793+
3794+/*-------------------------------------------------------------------------*/
3795+/* Composite driver */
3796+
3797+static int android_bind_config(struct usb_configuration *c)
3798+{
3799+	struct android_dev *dev = cdev_to_android_dev(c->cdev);
3800+	int ret = 0;
3801+
3802+	ret = android_bind_enabled_functions(dev, c);
3803+	if (ret)
3804+		return ret;
3805+
3806+	return 0;
3807+}
3808+
3809+static void android_unbind_config(struct usb_configuration *c)
3810+{
3811+	struct android_dev *dev = cdev_to_android_dev(c->cdev);
3812+
3813+	android_unbind_enabled_functions(dev, c);
3814+}
3815+
3816+static int android_bind(struct usb_composite_dev *cdev)
3817+{
3818+	struct android_dev *dev;
3819+	struct usb_gadget	*gadget = cdev->gadget;
3820+	int			id, ret;
3821+
3822+	/* Bind to the last android_dev that was probed */
3823+	dev = list_entry(android_dev_list.prev, struct android_dev, list_item);
3824+
3825+	dev->cdev = cdev;
3826+
3827+	/* Save the default handler */
3828+	dev->setup_complete = cdev->req->complete;
3829+
3830+	/*
3831+	 * Start disconnected. Userspace will connect the gadget once
3832+	 * it is done configuring the functions.
3833+	 */
3834+	usb_gadget_disconnect(gadget);
3835+
3836+	/* Allocate string descriptor numbers ... note that string
3837+	 * contents can be overridden by the composite_dev glue.
3838+	 */
3839+	id = usb_string_id(cdev);
3840+	if (id < 0)
3841+		return id;
3842+	strings_dev[STRING_MANUFACTURER_IDX].id = id;
3843+	device_desc.iManufacturer = id;
3844+
3845+	id = usb_string_id(cdev);
3846+	if (id < 0)
3847+		return id;
3848+	strings_dev[STRING_PRODUCT_IDX].id = id;
3849+	device_desc.iProduct = id;
3850+
3851+	/* Default strings - should be updated by userspace */
3852+	strlcpy(manufacturer_string, "Android",
3853+		sizeof(manufacturer_string) - 1);
3854+	strlcpy(product_string, "Android", sizeof(product_string) - 1);
3855+	strlcpy(serial_string, "0123456789ABCDEF", sizeof(serial_string) - 1);
3856+
3857+	id = usb_string_id(cdev);
3858+	if (id < 0)
3859+		return id;
3860+	strings_dev[STRING_SERIAL_IDX].id = id;
3861+	device_desc.iSerialNumber = id;
3862+
3863+	dev->cdev = cdev;
3864+
3865+	/* Init the supported functions only once, on the first android_dev */
3866+	if (android_dev_count == 1) {
3867+		ret = android_init_functions(dev->functions, cdev);
3868+		if (ret)
3869+			return ret;
3870+	}
3871+
3872+	return 0;
3873+}
3874+
3875+static int android_usb_unbind(struct usb_composite_dev *cdev)
3876+{
3877+	struct android_dev *dev = cdev_to_android_dev(cdev);
3878+
3879+	manufacturer_string[0] = '\0';
3880+	product_string[0] = '\0';
3881+	serial_string[0] = '0';
3882+	cancel_work_sync(&dev->work);
3883+	cancel_delayed_work_sync(&dev->pm_qos_work);
3884+	android_cleanup_functions(dev->functions);
3885+	return 0;
3886+}
3887+
3888+/* HACK: android needs to override setup for accessory to work */
3889+static int (*composite_setup_func)(struct usb_gadget *gadget, const struct usb_ctrlrequest *c);
3890+static void (*composite_suspend_func)(struct usb_gadget *gadget);
3891+static void (*composite_resume_func)(struct usb_gadget *gadget);
3892+
3893+static int
3894+android_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *c)
3895+{
3896+	struct usb_composite_dev	*cdev = get_gadget_data(gadget);
3897+	struct android_dev		*dev = cdev_to_android_dev(cdev);
3898+	struct usb_request		*req = cdev->req;
3899+	struct android_usb_function	*f;
3900+	struct android_usb_function_holder *f_holder;
3901+	struct android_configuration	*conf;
3902+	int value = -EOPNOTSUPP;
3903+	unsigned long flags;
3904+	bool do_work = false;
3905+	bool prev_configured = false;
3906+
3907+	req->zero = 0;
3908+	req->length = 0;
3909+	req->complete = dev->setup_complete;
3910+	gadget->ep0->driver_data = cdev;
3911+
3912+	list_for_each_entry(conf, &dev->configs, list_item)
3913+		list_for_each_entry(f_holder,
3914+				    &conf->enabled_functions,
3915+				    enabled_list) {
3916+			f = f_holder->f;
3917+			if (f->ctrlrequest) {
3918+				value = f->ctrlrequest(f, cdev, c);
3919+				if (value >= 0)
3920+					break;
3921+			}
3922+		}
3923+
3924+	/*
3925+	 * skip the  work when 2nd set config arrives
3926+	 * with same value from the host.
3927+	 */
3928+	if (cdev->config)
3929+		prev_configured = true;
3930+	/* Special case the accessory function.
3931+	 * It needs to handle control requests before it is enabled.
3932+	 */
3933+	if (value < 0)
3934+		value = acc_ctrlrequest(cdev, c);
3935+
3936+	if (value < 0)
3937+		value = composite_setup_func(gadget, c);
3938+
3939+	spin_lock_irqsave(&cdev->lock, flags);
3940+	if (!dev->connected) {
3941+		dev->connected = 1;
3942+		do_work = true;
3943+	} else if (c->bRequest == USB_REQ_SET_CONFIGURATION &&
3944+						cdev->config) {
3945+		if (!prev_configured)
3946+			do_work = true;
3947+	}
3948+	spin_unlock_irqrestore(&cdev->lock, flags);
3949+	if (do_work)
3950+		schedule_work(&dev->work);
3951+
3952+	return value;
3953+}
3954+
3955+static void android_disconnect(struct usb_composite_dev *cdev)
3956+{
3957+	struct android_dev *dev = cdev_to_android_dev(cdev);
3958+
3959+	/* accessory HID support can be active while the
3960+	   accessory function is not actually enabled,
3961+	   so we need to inform it when we are disconnected.
3962+	 */
3963+	acc_disconnect();
3964+
3965+	dev->connected = 0;
3966+	schedule_work(&dev->work);
3967+}
3968+
3969+static struct usb_composite_driver android_usb_driver = {
3970+	.name		= "android_usb",
3971+	.dev		= &device_desc,
3972+	.strings	= dev_strings,
3973+	.bind		= android_bind,
3974+	.unbind		= android_usb_unbind,
3975+	.disconnect	= android_disconnect,
3976+	.max_speed	= USB_SPEED_SUPER
3977+};
3978+
3979+static void android_suspend(struct usb_gadget *gadget)
3980+{
3981+	struct usb_composite_dev *cdev = get_gadget_data(gadget);
3982+	struct android_dev *dev = cdev_to_android_dev(cdev);
3983+	unsigned long flags;
3984+
3985+	spin_lock_irqsave(&cdev->lock, flags);
3986+	if (!dev->suspended) {
3987+		dev->suspended = 1;
3988+		schedule_work(&dev->work);
3989+	}
3990+	spin_unlock_irqrestore(&cdev->lock, flags);
3991+
3992+	composite_suspend_func(gadget);
3993+}
3994+
3995+static void android_resume(struct usb_gadget *gadget)
3996+{
3997+	struct usb_composite_dev *cdev = get_gadget_data(gadget);
3998+	struct android_dev *dev = cdev_to_android_dev(cdev);
3999+	unsigned long flags;
4000+
4001+	spin_lock_irqsave(&cdev->lock, flags);
4002+	if (dev->suspended) {
4003+		dev->suspended = 0;
4004+		schedule_work(&dev->work);
4005+	}
4006+	spin_unlock_irqrestore(&cdev->lock, flags);
4007+
4008+	composite_resume_func(gadget);
4009+}
4010+
4011+static int android_create_device(struct android_dev *dev, u8 usb_core_id)
4012+{
4013+	struct device_attribute **attrs = android_usb_attributes;
4014+	struct device_attribute *attr;
4015+	char device_node_name[ANDROID_DEVICE_NODE_NAME_LENGTH];
4016+	int err;
4017+
4018+	/*
4019+	 * The primary usb core should always have usb_core_id=0, since
4020+	 * Android user space is currently interested in android0 events.
4021+	 */
4022+	snprintf(device_node_name, ANDROID_DEVICE_NODE_NAME_LENGTH,
4023+		 "android%d", usb_core_id);
4024+	pr_debug("%s(): creating android%d device\n", __func__, usb_core_id);
4025+	dev->dev = device_create(android_class, NULL, MKDEV(0, usb_core_id),
4026+		NULL, device_node_name);
4027+	if (IS_ERR(dev->dev))
4028+		return PTR_ERR(dev->dev);
4029+
4030+	dev_set_drvdata(dev->dev, dev);
4031+
4032+	while ((attr = *attrs++)) {
4033+		err = device_create_file(dev->dev, attr);
4034+		if (err) {
4035+			device_destroy(android_class, dev->dev->devt);
4036+			return err;
4037+		}
4038+	}
4039+	return 0;
4040+}
4041+
4042+static void android_destroy_device(struct android_dev *dev)
4043+{
4044+	struct device_attribute **attrs = android_usb_attributes;
4045+	struct device_attribute *attr;
4046+
4047+	while ((attr = *attrs++))
4048+		device_remove_file(dev->dev, attr);
4049+	device_destroy(android_class, dev->dev->devt);
4050+}
4051+
4052+static struct android_dev *cdev_to_android_dev(struct usb_composite_dev *cdev)
4053+{
4054+	struct android_dev *dev = NULL;
4055+
4056+	/* Find the android dev from the list */
4057+	list_for_each_entry(dev, &android_dev_list, list_item) {
4058+		if (dev->cdev == cdev)
4059+			break;
4060+	}
4061+
4062+	return dev;
4063+}
4064+
4065+static struct android_configuration *alloc_android_config
4066+						(struct android_dev *dev)
4067+{
4068+	struct android_configuration *conf;
4069+
4070+	conf = kzalloc(sizeof(*conf), GFP_KERNEL);
4071+	if (!conf) {
4072+		pr_err("%s(): Failed to alloc memory for android conf\n",
4073+			__func__);
4074+		return ERR_PTR(-ENOMEM);
4075+	}
4076+
4077+	dev->configs_num++;
4078+	conf->usb_config.label = dev->name;
4079+	conf->usb_config.unbind = android_unbind_config;
4080+	conf->usb_config.bConfigurationValue = dev->configs_num;
4081+
4082+	INIT_LIST_HEAD(&conf->enabled_functions);
4083+
4084+	list_add_tail(&conf->list_item, &dev->configs);
4085+
4086+	return conf;
4087+}
4088+
4089+static void free_android_config(struct android_dev *dev,
4090+			     struct android_configuration *conf)
4091+{
4092+	list_del(&conf->list_item);
4093+	dev->configs_num--;
4094+	kfree(conf);
4095+}
4096+
4097+static int usb_diag_update_pid_and_serial_num(u32 pid, const char *snum)
4098+{
4099+	struct dload_struct local_diag_dload = { 0 };
4100+	int *src, *dst, i;
4101+
4102+	if (!diag_dload) {
4103+		pr_debug("%s: unable to update PID and serial_no\n", __func__);
4104+		return -ENODEV;
4105+	}
4106+
4107+	pr_debug("%s: dload:%p pid:%x serial_num:%s\n",
4108+				__func__, diag_dload, pid, snum);
4109+
4110+	/* update pid */
4111+	local_diag_dload.magic_struct.pid = PID_MAGIC_ID;
4112+	local_diag_dload.pid = pid;
4113+
4114+	/* update serial number */
4115+	if (!snum) {
4116+		local_diag_dload.magic_struct.serial_num = 0;
4117+		memset(&local_diag_dload.serial_number, 0,
4118+				SERIAL_NUMBER_LENGTH);
4119+	} else {
4120+		local_diag_dload.magic_struct.serial_num = SERIAL_NUM_MAGIC_ID;
4121+		strlcpy((char *)&local_diag_dload.serial_number, snum,
4122+				SERIAL_NUMBER_LENGTH);
4123+	}
4124+
4125+	/* Copy to shared struct (accesses need to be 32 bit aligned) */
4126+	src = (int *)&local_diag_dload;
4127+	dst = (int *)diag_dload;
4128+
4129+	for (i = 0; i < sizeof(*diag_dload) / 4; i++)
4130+		*dst++ = *src++;
4131+
4132+	return 0;
4133+}
4134+
4135+static int android_probe(struct platform_device *pdev)
4136+{
4137+	struct android_usb_platform_data *pdata;
4138+	struct android_dev *android_dev;
4139+	struct android_usb_function **supported_list = NULL;
4140+	struct resource *res;
4141+	int ret = 0, i, len = 0, prop_len = 0;
4142+	u32 usb_core_id = 0;
4143+
4144+	if (pdev->dev.of_node) {
4145+		dev_dbg(&pdev->dev, "device tree enabled\n");
4146+		pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
4147+		if (!pdata) {
4148+			pr_err("unable to allocate platform data\n");
4149+			return -ENOMEM;
4150+		}
4151+
4152+		of_get_property(pdev->dev.of_node, "qcom,pm-qos-latency",
4153+								&prop_len);
4154+		if (prop_len == sizeof(pdata->pm_qos_latency)) {
4155+			of_property_read_u32_array(pdev->dev.of_node,
4156+				"qcom,pm-qos-latency", pdata->pm_qos_latency,
4157+				 prop_len/sizeof(*pdata->pm_qos_latency));
4158+		} else {
4159+			pr_info("pm_qos latency not specified %d\n", prop_len);
4160+		}
4161+
4162+		ret = of_property_read_u32(pdev->dev.of_node,
4163+					"qcom,usb-core-id",
4164+					&usb_core_id);
4165+		if (!ret)
4166+			pdata->usb_core_id = usb_core_id;
4167+
4168+	} else {
4169+		pdata = pdev->dev.platform_data;
4170+	}
4171+
4172+	len = of_property_count_strings(pdev->dev.of_node,
4173+			"qcom,supported-func");
4174+	if (len > ANDROID_MAX_FUNC_CNT) {
4175+		pr_err("Invalid number of functions used.\n");
4176+		return -EINVAL;
4177+	} else if (len > 0) {
4178+		/* one extra for NULL termination */
4179+		supported_list = devm_kzalloc(
4180+				&pdev->dev, sizeof(supported_list) * (len + 1),
4181+				GFP_KERNEL);
4182+		if (!supported_list)
4183+			return -ENOMEM;
4184+
4185+		for (i = 0; i < len; i++) {
4186+			const char *name = NULL;
4187+
4188+			of_property_read_string_index(pdev->dev.of_node,
4189+				"qcom,supported-func", i, &name);
4190+
4191+			if (!name || sizeof(name) > FUNC_NAME_LEN ||
4192+			name_to_func_idx(name) == ANDROID_INVALID_FUNC) {
4193+				pr_err("Invalid Function name %s\n", name);
4194+				ret = -EINVAL;
4195+				goto err;
4196+			}
4197+
4198+			supported_list[i] =
4199+				supported_functions[name_to_func_idx(name)];
4200+			pr_debug("name of supported function:%s\n",
4201+				supported_list[i]->name);
4202+		}
4203+	}
4204+
4205+	if (!android_class) {
4206+		android_class = class_create(THIS_MODULE, "android_usb");
4207+		if (IS_ERR(android_class)) {
4208+			ret = PTR_ERR(android_class);
4209+			goto err;
4210+		}
4211+	}
4212+
4213+	android_dev = kzalloc(sizeof(*android_dev), GFP_KERNEL);
4214+	if (!android_dev) {
4215+		pr_err("%s(): Failed to alloc memory for android_dev\n",
4216+			__func__);
4217+		ret = -ENOMEM;
4218+		goto err_alloc;
4219+	}
4220+
4221+	android_dev->name = pdev->name;
4222+	android_dev->disable_depth = 1;
4223+	android_dev->functions =
4224+		supported_list ? supported_list : default_functions;
4225+	android_dev->configs_num = 0;
4226+	INIT_LIST_HEAD(&android_dev->configs);
4227+	INIT_WORK(&android_dev->work, android_work);
4228+	INIT_DELAYED_WORK(&android_dev->pm_qos_work, android_pm_qos_work);
4229+	mutex_init(&android_dev->mutex);
4230+
4231+	android_dev->pdata = pdata;
4232+
4233+	list_add_tail(&android_dev->list_item, &android_dev_list);
4234+	android_dev_count++;
4235+
4236+	debug_debugfs_init();
4237+
4238+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
4239+	if (res) {
4240+		diag_dload = devm_ioremap(&pdev->dev, res->start,
4241+							resource_size(res));
4242+		if (!diag_dload) {
4243+			dev_err(&pdev->dev, "ioremap failed\n");
4244+			ret = -ENOMEM;
4245+			goto err_dev;
4246+		}
4247+	} else {
4248+		dev_dbg(&pdev->dev, "failed to get mem resource\n");
4249+	}
4250+
4251+	if (pdata)
4252+		android_usb_driver.gadget_driver.usb_core_id =
4253+						pdata->usb_core_id;
4254+	ret = android_create_device(android_dev,
4255+			android_usb_driver.gadget_driver.usb_core_id);
4256+	if (ret) {
4257+		pr_err("%s(): android_create_device failed\n", __func__);
4258+		goto err_dev;
4259+	}
4260+
4261+	pr_debug("%s(): registering android_usb_driver with core id:%d\n",
4262+		__func__, android_usb_driver.gadget_driver.usb_core_id);
4263+	ret = usb_composite_probe(&android_usb_driver);
4264+	if (ret) {
4265+		/* Perhaps UDC hasn't probed yet, try again later */
4266+		if (ret == -ENODEV)
4267+			ret = -EPROBE_DEFER;
4268+		else
4269+			pr_err("%s(): Failed to register android composite driver\n",
4270+				__func__);
4271+		goto err_probe;
4272+	}
4273+
4274+	/* pm qos request to prevent apps idle power collapse */
4275+	android_dev->curr_pm_qos_state = NO_USB_VOTE;
4276+	if (pdata && pdata->pm_qos_latency[0]) {
4277+		android_dev->down_pm_qos_sample_sec = DOWN_PM_QOS_SAMPLE_SEC;
4278+		android_dev->down_pm_qos_threshold = DOWN_PM_QOS_THRESHOLD;
4279+		android_dev->up_pm_qos_sample_sec = UP_PM_QOS_SAMPLE_SEC;
4280+		android_dev->up_pm_qos_threshold = UP_PM_QOS_THRESHOLD;
4281+		android_dev->idle_pc_rpm_no_int_secs = IDLE_PC_RPM_NO_INT_SECS;
4282+	}
4283+	strlcpy(android_dev->pm_qos, "high", sizeof(android_dev->pm_qos));
4284+
4285+	return ret;
4286+err_probe:
4287+	android_destroy_device(android_dev);
4288+err_dev:
4289+	list_del(&android_dev->list_item);
4290+	android_dev_count--;
4291+	kfree(android_dev);
4292+err_alloc:
4293+	if (list_empty(&android_dev_list)) {
4294+		class_destroy(android_class);
4295+		android_class = NULL;
4296+	}
4297+	debug_debugfs_exit();
4298+err:
4299+	return ret;
4300+}
4301+
4302+static int android_remove(struct platform_device *pdev)
4303+{
4304+	struct android_dev *dev = NULL;
4305+	struct android_usb_platform_data *pdata = pdev->dev.platform_data;
4306+	int usb_core_id = 0;
4307+
4308+	if (pdata)
4309+		usb_core_id = pdata->usb_core_id;
4310+
4311+	/* Find the android dev from the list */
4312+	list_for_each_entry(dev, &android_dev_list, list_item) {
4313+		if (!dev->pdata)
4314+			break; /*To backward compatibility*/
4315+		if (dev->pdata->usb_core_id == usb_core_id)
4316+			break;
4317+	}
4318+
4319+	debug_debugfs_exit();
4320+
4321+	if (dev) {
4322+		android_destroy_device(dev);
4323+		if (pdata && pdata->pm_qos_latency[0])
4324+			pm_qos_remove_request(&dev->pm_qos_req_dma);
4325+		list_del(&dev->list_item);
4326+		android_dev_count--;
4327+		kfree(dev);
4328+	}
4329+
4330+	if (list_empty(&android_dev_list)) {
4331+		class_destroy(android_class);
4332+		android_class = NULL;
4333+		usb_composite_unregister(&android_usb_driver);
4334+	}
4335+
4336+	return 0;
4337+}
4338+
4339+static const struct platform_device_id android_id_table[] = {
4340+	{
4341+		.name = "android_usb",
4342+	},
4343+	{
4344+		.name = "android_usb_hsic",
4345+	},
4346+	{}
4347+};
4348+
4349+static struct of_device_id usb_android_dt_match[] = {
4350+	{	.compatible = "qcom,android-usb",
4351+	},
4352+	{}
4353+};
4354+
4355+static struct platform_driver android_platform_driver = {
4356+	.driver = {
4357+		.name = "android_usb",
4358+		.of_match_table = usb_android_dt_match,
4359+	},
4360+	.probe = android_probe,
4361+	.remove = android_remove,
4362+	.id_table = android_id_table,
4363+};
4364+
4365+static int __init init(void)
4366+{
4367+	int ret;
4368+
4369+	INIT_LIST_HEAD(&android_dev_list);
4370+	android_dev_count = 0;
4371+
4372+	ret = platform_driver_register(&android_platform_driver);
4373+	if (ret) {
4374+		pr_err("%s(): Failed to register android"
4375+				 "platform driver\n", __func__);
4376+	}
4377+
4378+	/* HACK: exchange composite's setup with ours */
4379+	composite_setup_func = android_usb_driver.gadget_driver.setup;
4380+	android_usb_driver.gadget_driver.setup = android_setup;
4381+	composite_suspend_func = android_usb_driver.gadget_driver.suspend;
4382+	android_usb_driver.gadget_driver.suspend = android_suspend;
4383+	composite_resume_func = android_usb_driver.gadget_driver.resume;
4384+	android_usb_driver.gadget_driver.resume = android_resume;
4385+
4386+	return ret;
4387+}
4388+late_initcall(init);
4389+
4390+static void __exit cleanup(void)
4391+{
4392+	platform_driver_unregister(&android_platform_driver);
4393+}
4394+module_exit(cleanup);
4395--- a/drivers/usb/gadget/function/Makefile	2017-12-31 12:38:53.777048393 +0800
4396+++ b/drivers/usb/gadget/function/Makefile	2018-01-01 11:47:40.926033796 +0800
4397@@ -66,3 +66,5 @@
4398 obj-$(CONFIG_USB_F_RMNET_BAM)   += usb_f_rmnet_bam.o
4399 usb_f_ccid-y			:= f_ccid.o
4400 obj-$(CONFIG_USB_F_CCID)   	+= usb_f_ccid.o
4401+usb_f_hid-y                     := f_hid.o
4402+obj-$(CONFIG_USB_G_ANDROID)     += usb_f_hid.o
4403--- a/drivers/usb/gadget/function/f_hid.c	2017-12-31 12:38:53.793048941 +0800
4404+++ b/drivers/usb/gadget/function/f_hid.c	2018-01-01 11:47:40.930033909 +0800
4405@@ -20,9 +20,13 @@
4406 #include <linux/wait.h>
4407 #include <linux/sched.h>
4408 #include <linux/usb/g_hid.h>
4409+#include <linux/delay.h>
4410 
4411+#include "f_hid.h"
4412 #include "u_f.h"
4413 #include "u_hid.h"
4414+#include "f_hid_android_keyboard.c"
4415+#include "f_hid_android_mouse.c"
4416 
4417 #define HIDG_MINORS	4
4418 
4419@@ -68,6 +72,43 @@
4420 	struct usb_ep			*out_ep;
4421 };
4422 
4423+/* Hacky device list to fix f_hidg_write being called after device destroyed.
4424+   It covers only most common race conditions, there will be rare crashes anyway. */
4425+enum { HACKY_DEVICE_LIST_SIZE = 4 };
4426+static struct f_hidg *hacky_device_list[HACKY_DEVICE_LIST_SIZE];
4427+static void hacky_device_list_add(struct f_hidg *hidg)
4428+{
4429+	int i;
4430+	for (i = 0; i < HACKY_DEVICE_LIST_SIZE; i++) {
4431+		if (!hacky_device_list[i]) {
4432+			hacky_device_list[i] = hidg;
4433+			return;
4434+		}
4435+	}
4436+	pr_err("%s: too many devices, not adding device %p\n", __func__, hidg);
4437+}
4438+static void hacky_device_list_remove(struct f_hidg *hidg)
4439+{
4440+	int i;
4441+	for (i = 0; i < HACKY_DEVICE_LIST_SIZE; i++) {
4442+		if (hacky_device_list[i] == hidg) {
4443+			hacky_device_list[i] = NULL;
4444+			return;
4445+		}
4446+	}
4447+	pr_err("%s: cannot find device %p\n", __func__, hidg);
4448+}
4449+static int hacky_device_list_check(struct f_hidg *hidg)
4450+{
4451+	int i;
4452+	for (i = 0; i < HACKY_DEVICE_LIST_SIZE; i++) {
4453+		if (hacky_device_list[i] == hidg) {
4454+			return 0;
4455+		}
4456+	}
4457+	return 1;
4458+}
4459+
4460 static inline struct f_hidg *func_to_hidg(struct usb_function *f)
4461 {
4462 	return container_of(f, struct f_hidg, func);
4463@@ -186,6 +227,8 @@
4464 	NULL,
4465 };
4466 
4467+
4468+
4469 /*-------------------------------------------------------------------------*/
4470 /*                              Char Device                                */
4471 
4472@@ -204,6 +247,12 @@
4473 	if (!access_ok(VERIFY_WRITE, buffer, count))
4474 		return -EFAULT;
4475 
4476+	if (hacky_device_list_check(hidg)) {
4477+		pr_err("%s: trying to read from device %p that was destroyed\n", __func__, hidg);
4478+		return -EIO;
4479+	}
4480+
4481+
4482 	spin_lock_irqsave(&hidg->spinlock, flags);
4483 
4484 #define READ_COND (!list_empty(&hidg->completed_out_req))
4485@@ -274,6 +323,12 @@
4486 	if (!access_ok(VERIFY_READ, buffer, count))
4487 		return -EFAULT;
4488 
4489+	if (hacky_device_list_check(hidg)) {
4490+		pr_err("%s: trying to write to device %p that was destroyed\n", __func__, hidg);
4491+		return -EIO;
4492+	}
4493+
4494+
4495 	mutex_lock(&hidg->lock);
4496 
4497 #define WRITE_COND (!hidg->write_pending)
4498@@ -288,6 +343,12 @@
4499 				hidg->write_queue, WRITE_COND))
4500 			return -ERESTARTSYS;
4501 
4502+		if (hacky_device_list_check(hidg)) {
4503+			pr_err("%s: trying to write to device %p that was destroyed\n", __func__, hidg);
4504+			return -EIO;
4505+		}
4506+
4507+
4508 		mutex_lock(&hidg->lock);
4509 	}
4510 
4511@@ -328,7 +389,18 @@
4512 	struct f_hidg	*hidg  = file->private_data;
4513 	unsigned int	ret = 0;
4514 
4515+	if (hacky_device_list_check(hidg)) {
4516+		pr_err("%s: trying to poll device %p that was destroyed\n", __func__, hidg);
4517+		return -EIO;
4518+	}
4519+
4520 	poll_wait(file, &hidg->read_queue, wait);
4521+
4522+	if (hacky_device_list_check(hidg)) {
4523+		pr_err("%s: trying to poll device %p that was destroyed\n", __func__, hidg);
4524+		return -EIO;
4525+	}
4526+
4527 	poll_wait(file, &hidg->write_queue, wait);
4528 
4529 	if (WRITE_COND)
4530@@ -418,7 +490,12 @@
4531 	case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
4532 		  | HID_REQ_GET_PROTOCOL):
4533 		VDBG(cdev, "get_protocol\n");
4534-		goto stall;
4535+		length = min_t(unsigned, length, 1);
4536+		if (hidg->bInterfaceSubClass == USB_INTERFACE_SUBCLASS_BOOT)
4537+			((u8 *) req->buf)[0] = 0;	/* Boot protocol */
4538+		else
4539+			((u8 *) req->buf)[0] = 1;	/* Report protocol */
4540+		goto respond;
4541 		break;
4542 
4543 	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
4544@@ -430,6 +507,14 @@
4545 	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
4546 		  | HID_REQ_SET_PROTOCOL):
4547 		VDBG(cdev, "set_protocol\n");
4548+		length = 0;
4549+		if (hidg->bInterfaceSubClass == USB_INTERFACE_SUBCLASS_BOOT) {
4550+			if (value == 0)		/* Boot protocol */
4551+				goto respond;
4552+		} else {
4553+			if (value == 1)		/* Report protocol */
4554+				goto respond;
4555+		}
4556 		goto stall;
4557 		break;
4558 
4559@@ -590,6 +675,8 @@
4560 	int			status;
4561 	dev_t			dev;
4562 
4563+	pr_info("%s: creating device %p\n", __func__, hidg);
4564+
4565 	/* maybe allocate device-global string IDs, and patch descriptors */
4566 	us = usb_gstrings_attach(c->cdev, ct_func_strings,
4567 				 ARRAY_SIZE(ct_func_string_defs));
4568@@ -665,6 +752,9 @@
4569 
4570 	device = device_create(hidg_class, NULL, dev, NULL,
4571 			       "%s%d", "hidg", hidg->minor);
4572+
4573+	hacky_device_list_add(hidg);
4574+
4575 	if (IS_ERR(device)) {
4576 		status = PTR_ERR(device);
4577 		goto del;
4578@@ -880,6 +970,20 @@
4579 			ghid_cleanup();
4580 		goto unlock;
4581 	}
4582+	if (opts->minor == 0) {
4583+		opts->subclass = ghid_device_android_keyboard.subclass;
4584+		opts->protocol = ghid_device_android_keyboard.protocol;
4585+		opts->report_length = ghid_device_android_keyboard.report_length;
4586+		opts->report_desc_length = ghid_device_android_keyboard.report_desc_length;
4587+		opts->report_desc = ghid_device_android_keyboard.report_desc;
4588+	}
4589+	if (opts->minor == 1) {
4590+		opts->subclass = ghid_device_android_mouse.subclass;
4591+		opts->protocol = ghid_device_android_mouse.protocol;
4592+		opts->report_length = ghid_device_android_mouse.report_length;
4593+		opts->report_desc_length = ghid_device_android_mouse.report_desc_length;
4594+		opts->report_desc = ghid_device_android_mouse.report_desc;
4595+	}
4596 	config_group_init_type_name(&opts->func_inst.group, "", &hid_func_type);
4597 
4598 unlock:
4599@@ -905,6 +1009,12 @@
4600 {
4601 	struct f_hidg *hidg = func_to_hidg(f);
4602 
4603+	pr_info("%s: destroying device %p\n", __func__, hidg);
4604+	/* This does not cover all race conditions, only most common one */
4605+	mutex_lock(&hidg->lock);
4606+	hacky_device_list_remove(hidg);
4607+	mutex_unlock(&hidg->lock);
4608+
4609 	device_destroy(hidg_class, MKDEV(major, hidg->minor));
4610 	cdev_del(&hidg->cdev);
4611 
4612@@ -930,7 +1040,7 @@
4613 
4614 	mutex_lock(&opts->lock);
4615 	++opts->refcnt;
4616-
4617+        
4618 	hidg->minor = opts->minor;
4619 	hidg->bInterfaceSubClass = opts->subclass;
4620 	hidg->bInterfaceProtocol = opts->protocol;
4621@@ -967,6 +1077,60 @@
4622 MODULE_LICENSE("GPL");
4623 MODULE_AUTHOR("Fabien Chouteau");
4624 
4625+int hidg_bind_config(struct usb_configuration *c,
4626+			    struct hidg_func_descriptor *fdesc, int index)
4627+{
4628+	struct f_hidg *hidg;
4629+	int status;
4630+
4631+	if (index >= minors)
4632+		return -ENOENT;
4633+
4634+	/* maybe allocate device-global string IDs, and patch descriptors */
4635+	if (ct_func_string_defs[CT_FUNC_HID_IDX].id == 0) {
4636+		status = usb_string_id(c->cdev);
4637+		if (status < 0)
4638+			return status;
4639+		ct_func_string_defs[CT_FUNC_HID_IDX].id = status;
4640+		hidg_interface_desc.iInterface = status;
4641+	}
4642+
4643+	/* allocate and initialize one new instance */
4644+	hidg = kzalloc(sizeof *hidg, GFP_KERNEL);
4645+	if (!hidg)
4646+		return -ENOMEM;
4647+
4648+	hidg->minor = index;
4649+	hidg->bInterfaceSubClass = fdesc->subclass;
4650+	hidg->bInterfaceProtocol = fdesc->protocol;
4651+	hidg->report_length = fdesc->report_length;
4652+	hidg->report_desc_length = fdesc->report_desc_length;
4653+	hidg->report_desc = kmemdup(fdesc->report_desc,
4654+				    fdesc->report_desc_length,
4655+				    GFP_KERNEL);
4656+	if (!hidg->report_desc) {
4657+		kfree(hidg);
4658+		return -ENOMEM;
4659+	}
4660+
4661+	hidg->func.name    = "hid";
4662+	hidg->func.strings = ct_func_strings;
4663+	hidg->func.bind    = hidg_bind;
4664+	hidg->func.unbind  = hidg_unbind;
4665+	hidg->func.set_alt = hidg_set_alt;
4666+	hidg->func.disable = hidg_disable;
4667+	hidg->func.setup   = hidg_setup;
4668+
4669+	/* this could me made configurable at some point */
4670+	hidg->qlen	   = 4;
4671+
4672+	status = usb_add_function(c, &hidg->func);
4673+	if (status)
4674+		kfree(hidg);
4675+
4676+	return status;
4677+}
4678+
4679 int ghid_setup(struct usb_gadget *g, int count)
4680 {
4681 	int status;
4682@@ -1002,3 +1166,4 @@
4683 	class_destroy(hidg_class);
4684 	hidg_class = NULL;
4685 }
4686+
4687--- a/drivers/usb/gadget/function/f_hid.h	1970-01-01 08:00:00.000000000 +0800
4688+++ b/drivers/usb/gadget/function/f_hid.h	2018-01-01 11:47:40.930033909 +0800
4689@@ -0,0 +1,16 @@
4690+#ifndef _GADGET_F_HID_H
4691+#define _GADGET_F_HID_H
4692+
4693+#include <linux/hid.h>
4694+#include <linux/usb/composite.h>
4695+#include <linux/usb/gadget.h>
4696+#include <linux/usb/g_hid.h>
4697+
4698+int hidg_bind_config(struct usb_configuration *c,
4699+			    struct hidg_func_descriptor *fdesc, int index);
4700+
4701+int ghid_setup(struct usb_gadget *g, int count);
4702+
4703+void ghid_cleanup(void);
4704+
4705+#endif
4706--- a/drivers/usb/gadget/function/f_hid_android_keyboard.c	1970-01-01 08:00:00.000000000 +0800
4707+++ b/drivers/usb/gadget/function/f_hid_android_keyboard.c	2018-01-01 11:47:40.930033909 +0800
4708@@ -0,0 +1,44 @@
4709+#include <linux/platform_device.h>
4710+#include <linux/usb/g_hid.h>
4711+
4712+/* hid descriptor for a keyboard */
4713+static struct hidg_func_descriptor ghid_device_android_keyboard = {
4714+	.subclass		= 1, /* Boot Interface Subclass */
4715+	.protocol		= 1, /* Keyboard */
4716+	.report_length		= 8,
4717+	.report_desc_length	= 63,
4718+	.report_desc		= {
4719+		0x05, 0x01,	/* USAGE_PAGE (Generic Desktop)	          */
4720+		0x09, 0x06,	/* USAGE (Keyboard)                       */
4721+		0xa1, 0x01,	/* COLLECTION (Application)               */
4722+		0x05, 0x07,	/*   USAGE_PAGE (Keyboard)                */
4723+		0x19, 0xe0,	/*   USAGE_MINIMUM (Keyboard LeftControl) */
4724+		0x29, 0xe7,	/*   USAGE_MAXIMUM (Keyboard Right GUI)   */
4725+		0x15, 0x00,	/*   LOGICAL_MINIMUM (0)                  */
4726+		0x25, 0x01,	/*   LOGICAL_MAXIMUM (1)                  */
4727+		0x75, 0x01,	/*   REPORT_SIZE (1)                      */
4728+		0x95, 0x08,	/*   REPORT_COUNT (8)                     */
4729+		0x81, 0x02,	/*   INPUT (Data,Var,Abs)                 */
4730+		0x95, 0x01,	/*   REPORT_COUNT (1)                     */
4731+		0x75, 0x08,	/*   REPORT_SIZE (8)                      */
4732+		0x81, 0x03,	/*   INPUT (Cnst,Var,Abs)                 */
4733+		0x95, 0x05,	/*   REPORT_COUNT (5)                     */
4734+		0x75, 0x01,	/*   REPORT_SIZE (1)                      */
4735+		0x05, 0x08,	/*   USAGE_PAGE (LEDs)                    */
4736+		0x19, 0x01,	/*   USAGE_MINIMUM (Num Lock)             */
4737+		0x29, 0x05,	/*   USAGE_MAXIMUM (Kana)                 */
4738+		0x91, 0x02,	/*   OUTPUT (Data,Var,Abs)                */
4739+		0x95, 0x01,	/*   REPORT_COUNT (1)                     */
4740+		0x75, 0x03,	/*   REPORT_SIZE (3)                      */
4741+		0x91, 0x03,	/*   OUTPUT (Cnst,Var,Abs)                */
4742+		0x95, 0x06,	/*   REPORT_COUNT (6)                     */
4743+		0x75, 0x08,	/*   REPORT_SIZE (8)                      */
4744+		0x15, 0x00,	/*   LOGICAL_MINIMUM (0)                  */
4745+		0x25, 0x65,	/*   LOGICAL_MAXIMUM (101)                */
4746+		0x05, 0x07,	/*   USAGE_PAGE (Keyboard)                */
4747+		0x19, 0x00,	/*   USAGE_MINIMUM (Reserved)             */
4748+		0x29, 0x65,	/*   USAGE_MAXIMUM (Keyboard Application) */
4749+		0x81, 0x00,	/*   INPUT (Data,Ary,Abs)                 */
4750+		0xc0		/* END_COLLECTION                         */
4751+	}
4752+};
4753--- a/drivers/usb/gadget/function/f_hid_android_mouse.c	1970-01-01 08:00:00.000000000 +0800
4754+++ b/drivers/usb/gadget/function/f_hid_android_mouse.c	2018-01-01 11:47:40.930033909 +0800
4755@@ -0,0 +1,39 @@
4756+#include <linux/platform_device.h>
4757+#include <linux/usb/g_hid.h>
4758+
4759+/* HID descriptor for a mouse */
4760+static struct hidg_func_descriptor ghid_device_android_mouse = {
4761+	.subclass      = 1, /* Boot Interface Subclass */
4762+	.protocol      = 2, /* Mouse */
4763+	.report_length = 4,
4764+	.report_desc_length	= 52,
4765+	.report_desc = {
4766+		0x05, 0x01,  //Usage Page(Generic Desktop Controls)
4767+		0x09, 0x02,  //Usage (Mouse)
4768+		0xa1, 0x01,  //Collection (Application)
4769+		0x09, 0x01,  //Usage (pointer)
4770+		0xa1, 0x00,  //Collection (Physical)
4771+		0x05, 0x09,  //Usage Page (Button)
4772+		0x19, 0x01,  //Usage Minimum(1)
4773+		0x29, 0x05,  //Usage Maximum(5)
4774+		0x15, 0x00,  //Logical Minimum(1)
4775+		0x25, 0x01,  //Logical Maximum(1)
4776+		0x95, 0x05,  //Report Count(5)
4777+		0x75, 0x01,  //Report Size(1)
4778+		0x81, 0x02,  //Input(Data,Variable,Absolute,BitField)
4779+		0x95, 0x01,  //Report Count(1)
4780+		0x75, 0x03,  //Report Size(3)
4781+		0x81, 0x01,  //Input(Constant,Array,Absolute,BitField)
4782+		0x05, 0x01,  //Usage Page(Generic Desktop Controls)
4783+		0x09, 0x30,  //Usage(x)
4784+		0x09, 0x31,  //Usage(y)
4785+		0x09, 0x38,  //Usage(Wheel)
4786+		0x15, 0x81,  //Logical Minimum(-127)
4787+		0x25, 0x7F,  //Logical Maximum(127)
4788+		0x75, 0x08,  //Report Size(8)
4789+		0x95, 0x03,  //Report Count(3)
4790+		0x81, 0x06,  //Input(Data,Variable,Relative,BitField)
4791+		0xc0,  //End Collection
4792+		0xc0  //End Collection
4793+	}
4794+};
4795--- a/include/linux/usb/android.h	1970-01-01 08:00:00.000000000 +0800
4796+++ b/include/linux/usb/android.h	2018-01-01 11:47:41.866060365 +0800
4797@@ -0,0 +1,148 @@
4798+/*
4799+ * Platform data for Android USB
4800+ *
4801+ * Copyright (C) 2008 Google, Inc.
4802+ * Author: Mike Lockwood <lockwood@android.com>
4803+ *
4804+ * This software is licensed under the terms of the GNU General Public
4805+ * License version 2, as published by the Free Software Foundation, and
4806+ * may be copied, distributed, and modified under those terms.
4807+ *
4808+ * This program is distributed in the hope that it will be useful,
4809+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
4810+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
4811+ * GNU General Public License for more details.
4812+ *
4813+ */
4814+#ifndef	__LINUX_USB_ANDROID_H
4815+#define	__LINUX_USB_ANDROID_H
4816+
4817+#define FUNC_NAME_LEN 15
4818+
4819+enum android_function_index {
4820+	ANDROID_FFS,
4821+	ANDROID_MBIM_BAM,
4822+	ANDROID_ECM_BAM,
4823+	ANDROID_AUDIO,
4824+	ANDROID_RMNET,
4825+	ANDROID_GPS,
4826+	ANDROID_DIAG,
4827+	ANDROID_QDSS_BAM,
4828+	ANDROID_SERIAL,
4829+	ANDROID_CCID,
4830+	ANDROID_ACM,
4831+	ANDROID_MTP,
4832+	ANDROID_PTP,
4833+	ANDROID_RNDIS,
4834+	ANDROID_RNDIS_BAM,
4835+	ANDROID_ECM,
4836+	ANDROID_NCM,
4837+	ANDROID_UMS,
4838+	ANDROID_ACCESSORY,
4839+	ANDROID_AUDIO_SRC,
4840+	ANDROID_CHARGER,
4841+	ANDROID_MIDI,
4842+	ANDROID_HID,
4843+	ANDROID_RNDIS_GSI,
4844+	ANDROID_ECM_GSI,
4845+	ANDROID_RMNET_GSI,
4846+	ANDROID_MBIM_GSI,
4847+	ANDROID_DPL_GSI,
4848+	ANDROID_MAX_FUNC_CNT,
4849+	ANDROID_INVALID_FUNC,
4850+};
4851+
4852+static enum android_function_index name_to_func_idx(const char *name)
4853+{
4854+	if (!name)
4855+		return ANDROID_INVALID_FUNC;
4856+
4857+	if (!strncasecmp("FFS", name, FUNC_NAME_LEN))
4858+		return ANDROID_FFS;
4859+	if (!strncasecmp("USB_MBIM", name, FUNC_NAME_LEN))
4860+		return ANDROID_MBIM_BAM;
4861+	if (!strncasecmp("ECM_QC", name, FUNC_NAME_LEN))
4862+		return ANDROID_ECM_BAM;
4863+	if (!strncasecmp("AUDIO", name, FUNC_NAME_LEN))
4864+		return ANDROID_AUDIO;
4865+	if (!strncasecmp("RMNET", name, FUNC_NAME_LEN))
4866+		return ANDROID_RMNET;
4867+	if (!strncasecmp("GPS", name, FUNC_NAME_LEN))
4868+		return ANDROID_GPS;
4869+	if (!strncasecmp("DIAG", name, FUNC_NAME_LEN))
4870+		return ANDROID_DIAG;
4871+	if (!strncasecmp("QDSS", name, FUNC_NAME_LEN))
4872+		return ANDROID_QDSS_BAM;
4873+	if (!strncasecmp("SERIAL", name, FUNC_NAME_LEN))
4874+		return ANDROID_SERIAL;
4875+	if (!strncasecmp("CCID", name, FUNC_NAME_LEN))
4876+		return ANDROID_CCID;
4877+	if (!strncasecmp("ACM", name, FUNC_NAME_LEN))
4878+		return ANDROID_ACM;
4879+	if (!strncasecmp("MTP", name, FUNC_NAME_LEN))
4880+		return ANDROID_MTP;
4881+	if (!strncasecmp("PTP", name, FUNC_NAME_LEN))
4882+		return ANDROID_PTP;
4883+	if (!strncasecmp("RNDIS", name, FUNC_NAME_LEN))
4884+		return ANDROID_RNDIS;
4885+	if (!strncasecmp("RNDIS_QC", name, FUNC_NAME_LEN))
4886+		return ANDROID_RNDIS_BAM;
4887+	if (!strncasecmp("ECM", name, FUNC_NAME_LEN))
4888+		return ANDROID_ECM;
4889+	if (!strncasecmp("NCM", name, FUNC_NAME_LEN))
4890+		return ANDROID_NCM;
4891+	if (!strncasecmp("MASS_STORAGE", name, FUNC_NAME_LEN))
4892+		return ANDROID_UMS;
4893+	if (!strncasecmp("ACCESSORY", name, FUNC_NAME_LEN))
4894+		return ANDROID_ACCESSORY;
4895+	if (!strncasecmp("AUDIO_SOURCE", name, FUNC_NAME_LEN))
4896+		return ANDROID_AUDIO_SRC;
4897+	if (!strncasecmp("CHARGING", name, FUNC_NAME_LEN))
4898+		return ANDROID_AUDIO_SRC;
4899+	if (!strncasecmp("MIDI", name, FUNC_NAME_LEN))
4900+		return ANDROID_MIDI;
4901+	if (!strncasecmp("HID", name, FUNC_NAME_LEN))
4902+		return ANDROID_HID;
4903+	if (!strncasecmp("RNDIS_GSI", name, FUNC_NAME_LEN))
4904+		return ANDROID_RNDIS_GSI;
4905+	if (!strncasecmp("ECM_GSI", name, FUNC_NAME_LEN))
4906+		return ANDROID_ECM_GSI;
4907+	if (!strncasecmp("RMNET_GSI", name, FUNC_NAME_LEN))
4908+		return ANDROID_RMNET_GSI;
4909+	if (!strncasecmp("MBIM_GSI", name, FUNC_NAME_LEN))
4910+		return ANDROID_MBIM_GSI;
4911+	if (!strncasecmp("DPL_GSI", name, FUNC_NAME_LEN))
4912+		return ANDROID_DPL_GSI;
4913+
4914+	return ANDROID_INVALID_FUNC;
4915+}
4916+
4917+enum android_pm_qos_state {
4918+	WFI,
4919+	IDLE_PC,
4920+	IDLE_PC_RPM,
4921+	NO_USB_VOTE,
4922+	MAX_VOTES = NO_USB_VOTE,
4923+};
4924+
4925+struct android_usb_platform_data {
4926+	int (*update_pid_and_serial_num)(uint32_t, const char *);
4927+	u32 pm_qos_latency[MAX_VOTES];
4928+	u8 usb_core_id;
4929+};
4930+
4931+extern int gport_setup(struct usb_configuration *c);
4932+extern void gport_cleanup(void);
4933+extern int gserial_init_port(int port_num, const char *name,
4934+					const char *port_name);
4935+extern bool gserial_is_connected(void);
4936+extern bool gserial_is_dun_w_softap_enabled(void);
4937+extern void gserial_dun_w_softap_enable(bool enable);
4938+extern bool gserial_is_dun_w_softap_active(void);
4939+
4940+
4941+int acm_port_setup(struct usb_configuration *c);
4942+void acm_port_cleanup(void);
4943+int acm_init_port(int port_num, const char *name);
4944+
4945+#endif	/* __LINUX_USB_ANDROID_H */