1 /*
2  * f_hid.c -- USB HID function driver
3  *
4  * Copyright (C) 2010 Fabien Chouteau <fabien.chouteau@barco.com>
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 2 of the License, or
9  * (at your option) any later version.
10  */
11 
12 #include <linux/kernel.h>
13 #include <linux/module.h>
14 #include <linux/hid.h>
15 #include <linux/cdev.h>
16 #include <linux/mutex.h>
17 #include <linux/poll.h>
18 #include <linux/uaccess.h>
19 #include <linux/wait.h>
20 #include <linux/sched.h>
21 #include <linux/usb/g_hid.h>
22 
23 #include "u_f.h"
24 
25 static int major, minors;
26 static struct class *hidg_class;
27 
28 /*-------------------------------------------------------------------------*/
29 /*                            HID gadget struct                            */
30 
31 struct f_hidg_req_list {
32 	struct usb_request	*req;
33 	unsigned int		pos;
34 	struct list_head 	list;
35 };
36 
37 struct f_hidg {
38 	/* configuration */
39 	unsigned char			bInterfaceSubClass;
40 	unsigned char			bInterfaceProtocol;
41 	unsigned short			report_desc_length;
42 	char				*report_desc;
43 	unsigned short			report_length;
44 
45 	/* recv report */
46 	struct list_head		completed_out_req;
47 	spinlock_t			spinlock;
48 	wait_queue_head_t		read_queue;
49 	unsigned int			qlen;
50 
51 	/* send report */
52 	struct mutex			lock;
53 	bool				write_pending;
54 	wait_queue_head_t		write_queue;
55 	struct usb_request		*req;
56 
57 	int				minor;
58 	struct cdev			cdev;
59 	struct usb_function		func;
60 
61 	struct usb_ep			*in_ep;
62 	struct usb_ep			*out_ep;
63 };
64 
65 static inline struct f_hidg *func_to_hidg(struct usb_function *f)
66 {
67 	return container_of(f, struct f_hidg, func);
68 }
69 
70 /*-------------------------------------------------------------------------*/
71 /*                           Static descriptors                            */
72 
73 static struct usb_interface_descriptor hidg_interface_desc = {
74 	.bLength		= sizeof hidg_interface_desc,
75 	.bDescriptorType	= USB_DT_INTERFACE,
76 	/* .bInterfaceNumber	= DYNAMIC */
77 	.bAlternateSetting	= 0,
78 	.bNumEndpoints		= 2,
79 	.bInterfaceClass	= USB_CLASS_HID,
80 	/* .bInterfaceSubClass	= DYNAMIC */
81 	/* .bInterfaceProtocol	= DYNAMIC */
82 	/* .iInterface		= DYNAMIC */
83 };
84 
85 static struct hid_descriptor hidg_desc = {
86 	.bLength			= sizeof hidg_desc,
87 	.bDescriptorType		= HID_DT_HID,
88 	.bcdHID				= 0x0101,
89 	.bCountryCode			= 0x00,
90 	.bNumDescriptors		= 0x1,
91 	/*.desc[0].bDescriptorType	= DYNAMIC */
92 	/*.desc[0].wDescriptorLenght	= DYNAMIC */
93 };
94 
95 /* High-Speed Support */
96 
97 static struct usb_endpoint_descriptor hidg_hs_in_ep_desc = {
98 	.bLength		= USB_DT_ENDPOINT_SIZE,
99 	.bDescriptorType	= USB_DT_ENDPOINT,
100 	.bEndpointAddress	= USB_DIR_IN,
101 	.bmAttributes		= USB_ENDPOINT_XFER_INT,
102 	/*.wMaxPacketSize	= DYNAMIC */
103 	.bInterval		= 4, /* FIXME: Add this field in the
104 				      * HID gadget configuration?
105 				      * (struct hidg_func_descriptor)
106 				      */
107 };
108 
109 static struct usb_endpoint_descriptor hidg_hs_out_ep_desc = {
110 	.bLength		= USB_DT_ENDPOINT_SIZE,
111 	.bDescriptorType	= USB_DT_ENDPOINT,
112 	.bEndpointAddress	= USB_DIR_OUT,
113 	.bmAttributes		= USB_ENDPOINT_XFER_INT,
114 	/*.wMaxPacketSize	= DYNAMIC */
115 	.bInterval		= 4, /* FIXME: Add this field in the
116 				      * HID gadget configuration?
117 				      * (struct hidg_func_descriptor)
118 				      */
119 };
120 
121 static struct usb_descriptor_header *hidg_hs_descriptors[] = {
122 	(struct usb_descriptor_header *)&hidg_interface_desc,
123 	(struct usb_descriptor_header *)&hidg_desc,
124 	(struct usb_descriptor_header *)&hidg_hs_in_ep_desc,
125 	(struct usb_descriptor_header *)&hidg_hs_out_ep_desc,
126 	NULL,
127 };
128 
129 /* Full-Speed Support */
130 
131 static struct usb_endpoint_descriptor hidg_fs_in_ep_desc = {
132 	.bLength		= USB_DT_ENDPOINT_SIZE,
133 	.bDescriptorType	= USB_DT_ENDPOINT,
134 	.bEndpointAddress	= USB_DIR_IN,
135 	.bmAttributes		= USB_ENDPOINT_XFER_INT,
136 	/*.wMaxPacketSize	= DYNAMIC */
137 	.bInterval		= 10, /* FIXME: Add this field in the
138 				       * HID gadget configuration?
139 				       * (struct hidg_func_descriptor)
140 				       */
141 };
142 
143 static struct usb_endpoint_descriptor hidg_fs_out_ep_desc = {
144 	.bLength		= USB_DT_ENDPOINT_SIZE,
145 	.bDescriptorType	= USB_DT_ENDPOINT,
146 	.bEndpointAddress	= USB_DIR_OUT,
147 	.bmAttributes		= USB_ENDPOINT_XFER_INT,
148 	/*.wMaxPacketSize	= DYNAMIC */
149 	.bInterval		= 10, /* FIXME: Add this field in the
150 				       * HID gadget configuration?
151 				       * (struct hidg_func_descriptor)
152 				       */
153 };
154 
155 static struct usb_descriptor_header *hidg_fs_descriptors[] = {
156 	(struct usb_descriptor_header *)&hidg_interface_desc,
157 	(struct usb_descriptor_header *)&hidg_desc,
158 	(struct usb_descriptor_header *)&hidg_fs_in_ep_desc,
159 	(struct usb_descriptor_header *)&hidg_fs_out_ep_desc,
160 	NULL,
161 };
162 
163 /*-------------------------------------------------------------------------*/
164 /*                              Char Device                                */
165 
166 static ssize_t f_hidg_read(struct file *file, char __user *buffer,
167 			size_t count, loff_t *ptr)
168 {
169 	struct f_hidg *hidg = file->private_data;
170 	struct f_hidg_req_list *list;
171 	struct usb_request *req;
172 	unsigned long flags;
173 	int ret;
174 
175 	if (!count)
176 		return 0;
177 
178 	if (!access_ok(VERIFY_WRITE, buffer, count))
179 		return -EFAULT;
180 
181 	spin_lock_irqsave(&hidg->spinlock, flags);
182 
183 #define READ_COND (!list_empty(&hidg->completed_out_req))
184 
185 	/* wait for at least one buffer to complete */
186 	while (!READ_COND) {
187 		spin_unlock_irqrestore(&hidg->spinlock, flags);
188 		if (file->f_flags & O_NONBLOCK)
189 			return -EAGAIN;
190 
191 		if (wait_event_interruptible(hidg->read_queue, READ_COND))
192 			return -ERESTARTSYS;
193 
194 		spin_lock_irqsave(&hidg->spinlock, flags);
195 	}
196 
197 	/* pick the first one */
198 	list = list_first_entry(&hidg->completed_out_req,
199 				struct f_hidg_req_list, list);
200 	req = list->req;
201 	count = min_t(unsigned int, count, req->actual - list->pos);
202 	spin_unlock_irqrestore(&hidg->spinlock, flags);
203 
204 	/* copy to user outside spinlock */
205 	count -= copy_to_user(buffer, req->buf + list->pos, count);
206 	list->pos += count;
207 
208 	/*
209 	 * if this request is completely handled and transfered to
210 	 * userspace, remove its entry from the list and requeue it
211 	 * again. Otherwise, we will revisit it again upon the next
212 	 * call, taking into account its current read position.
213 	 */
214 	if (list->pos == req->actual) {
215 		spin_lock_irqsave(&hidg->spinlock, flags);
216 		list_del(&list->list);
217 		kfree(list);
218 		spin_unlock_irqrestore(&hidg->spinlock, flags);
219 
220 		req->length = hidg->report_length;
221 		ret = usb_ep_queue(hidg->out_ep, req, GFP_KERNEL);
222 		if (ret < 0)
223 			return ret;
224 	}
225 
226 	return count;
227 }
228 
229 static void f_hidg_req_complete(struct usb_ep *ep, struct usb_request *req)
230 {
231 	struct f_hidg *hidg = (struct f_hidg *)ep->driver_data;
232 
233 	if (req->status != 0) {
234 		ERROR(hidg->func.config->cdev,
235 			"End Point Request ERROR: %d\n", req->status);
236 	}
237 
238 	hidg->write_pending = 0;
239 	wake_up(&hidg->write_queue);
240 }
241 
242 static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
243 			    size_t count, loff_t *offp)
244 {
245 	struct f_hidg *hidg  = file->private_data;
246 	ssize_t status = -ENOMEM;
247 
248 	if (!access_ok(VERIFY_READ, buffer, count))
249 		return -EFAULT;
250 
251 	mutex_lock(&hidg->lock);
252 
253 #define WRITE_COND (!hidg->write_pending)
254 
255 	/* write queue */
256 	while (!WRITE_COND) {
257 		mutex_unlock(&hidg->lock);
258 		if (file->f_flags & O_NONBLOCK)
259 			return -EAGAIN;
260 
261 		if (wait_event_interruptible_exclusive(
262 				hidg->write_queue, WRITE_COND))
263 			return -ERESTARTSYS;
264 
265 		mutex_lock(&hidg->lock);
266 	}
267 
268 	count  = min_t(unsigned, count, hidg->report_length);
269 	status = copy_from_user(hidg->req->buf, buffer, count);
270 
271 	if (status != 0) {
272 		ERROR(hidg->func.config->cdev,
273 			"copy_from_user error\n");
274 		mutex_unlock(&hidg->lock);
275 		return -EINVAL;
276 	}
277 
278 	hidg->req->status   = 0;
279 	hidg->req->zero     = 0;
280 	hidg->req->length   = count;
281 	hidg->req->complete = f_hidg_req_complete;
282 	hidg->req->context  = hidg;
283 	hidg->write_pending = 1;
284 
285 	status = usb_ep_queue(hidg->in_ep, hidg->req, GFP_ATOMIC);
286 	if (status < 0) {
287 		ERROR(hidg->func.config->cdev,
288 			"usb_ep_queue error on int endpoint %zd\n", status);
289 		hidg->write_pending = 0;
290 		wake_up(&hidg->write_queue);
291 	} else {
292 		status = count;
293 	}
294 
295 	mutex_unlock(&hidg->lock);
296 
297 	return status;
298 }
299 
300 static unsigned int f_hidg_poll(struct file *file, poll_table *wait)
301 {
302 	struct f_hidg	*hidg  = file->private_data;
303 	unsigned int	ret = 0;
304 
305 	poll_wait(file, &hidg->read_queue, wait);
306 	poll_wait(file, &hidg->write_queue, wait);
307 
308 	if (WRITE_COND)
309 		ret |= POLLOUT | POLLWRNORM;
310 
311 	if (READ_COND)
312 		ret |= POLLIN | POLLRDNORM;
313 
314 	return ret;
315 }
316 
317 #undef WRITE_COND
318 #undef READ_COND
319 
320 static int f_hidg_release(struct inode *inode, struct file *fd)
321 {
322 	fd->private_data = NULL;
323 	return 0;
324 }
325 
326 static int f_hidg_open(struct inode *inode, struct file *fd)
327 {
328 	struct f_hidg *hidg =
329 		container_of(inode->i_cdev, struct f_hidg, cdev);
330 
331 	fd->private_data = hidg;
332 
333 	return 0;
334 }
335 
336 /*-------------------------------------------------------------------------*/
337 /*                                usb_function                             */
338 
339 static inline struct usb_request *hidg_alloc_ep_req(struct usb_ep *ep,
340 						    unsigned length)
341 {
342 	return alloc_ep_req(ep, length, length);
343 }
344 
345 static void hidg_set_report_complete(struct usb_ep *ep, struct usb_request *req)
346 {
347 	struct f_hidg *hidg = (struct f_hidg *) req->context;
348 	struct f_hidg_req_list *req_list;
349 	unsigned long flags;
350 
351 	req_list = kzalloc(sizeof(*req_list), GFP_ATOMIC);
352 	if (!req_list)
353 		return;
354 
355 	req_list->req = req;
356 
357 	spin_lock_irqsave(&hidg->spinlock, flags);
358 	list_add_tail(&req_list->list, &hidg->completed_out_req);
359 	spin_unlock_irqrestore(&hidg->spinlock, flags);
360 
361 	wake_up(&hidg->read_queue);
362 }
363 
364 static int hidg_setup(struct usb_function *f,
365 		const struct usb_ctrlrequest *ctrl)
366 {
367 	struct f_hidg			*hidg = func_to_hidg(f);
368 	struct usb_composite_dev	*cdev = f->config->cdev;
369 	struct usb_request		*req  = cdev->req;
370 	int status = 0;
371 	__u16 value, length;
372 
373 	value	= __le16_to_cpu(ctrl->wValue);
374 	length	= __le16_to_cpu(ctrl->wLength);
375 
376 	VDBG(cdev, "hid_setup crtl_request : bRequestType:0x%x bRequest:0x%x "
377 		"Value:0x%x\n", ctrl->bRequestType, ctrl->bRequest, value);
378 
379 	switch ((ctrl->bRequestType << 8) | ctrl->bRequest) {
380 	case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
381 		  | HID_REQ_GET_REPORT):
382 		VDBG(cdev, "get_report\n");
383 
384 		/* send an empty report */
385 		length = min_t(unsigned, length, hidg->report_length);
386 		memset(req->buf, 0x0, length);
387 
388 		goto respond;
389 		break;
390 
391 	case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
392 		  | HID_REQ_GET_PROTOCOL):
393 		VDBG(cdev, "get_protocol\n");
394 		goto stall;
395 		break;
396 
397 	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
398 		  | HID_REQ_SET_REPORT):
399 		VDBG(cdev, "set_report | wLength=%d\n", ctrl->wLength);
400 		goto stall;
401 		break;
402 
403 	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
404 		  | HID_REQ_SET_PROTOCOL):
405 		VDBG(cdev, "set_protocol\n");
406 		goto stall;
407 		break;
408 
409 	case ((USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_INTERFACE) << 8
410 		  | USB_REQ_GET_DESCRIPTOR):
411 		switch (value >> 8) {
412 		case HID_DT_HID:
413 			VDBG(cdev, "USB_REQ_GET_DESCRIPTOR: HID\n");
414 			length = min_t(unsigned short, length,
415 						   hidg_desc.bLength);
416 			memcpy(req->buf, &hidg_desc, length);
417 			goto respond;
418 			break;
419 		case HID_DT_REPORT:
420 			VDBG(cdev, "USB_REQ_GET_DESCRIPTOR: REPORT\n");
421 			length = min_t(unsigned short, length,
422 						   hidg->report_desc_length);
423 			memcpy(req->buf, hidg->report_desc, length);
424 			goto respond;
425 			break;
426 
427 		default:
428 			VDBG(cdev, "Unknown descriptor request 0x%x\n",
429 				 value >> 8);
430 			goto stall;
431 			break;
432 		}
433 		break;
434 
435 	default:
436 		VDBG(cdev, "Unknown request 0x%x\n",
437 			 ctrl->bRequest);
438 		goto stall;
439 		break;
440 	}
441 
442 stall:
443 	return -EOPNOTSUPP;
444 
445 respond:
446 	req->zero = 0;
447 	req->length = length;
448 	status = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
449 	if (status < 0)
450 		ERROR(cdev, "usb_ep_queue error on ep0 %d\n", value);
451 	return status;
452 }
453 
454 static void hidg_disable(struct usb_function *f)
455 {
456 	struct f_hidg *hidg = func_to_hidg(f);
457 	struct f_hidg_req_list *list, *next;
458 
459 	usb_ep_disable(hidg->in_ep);
460 	hidg->in_ep->driver_data = NULL;
461 
462 	usb_ep_disable(hidg->out_ep);
463 	hidg->out_ep->driver_data = NULL;
464 
465 	list_for_each_entry_safe(list, next, &hidg->completed_out_req, list) {
466 		list_del(&list->list);
467 		kfree(list);
468 	}
469 }
470 
471 static int hidg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
472 {
473 	struct usb_composite_dev		*cdev = f->config->cdev;
474 	struct f_hidg				*hidg = func_to_hidg(f);
475 	int i, status = 0;
476 
477 	VDBG(cdev, "hidg_set_alt intf:%d alt:%d\n", intf, alt);
478 
479 	if (hidg->in_ep != NULL) {
480 		/* restart endpoint */
481 		if (hidg->in_ep->driver_data != NULL)
482 			usb_ep_disable(hidg->in_ep);
483 
484 		status = config_ep_by_speed(f->config->cdev->gadget, f,
485 					    hidg->in_ep);
486 		if (status) {
487 			ERROR(cdev, "config_ep_by_speed FAILED!\n");
488 			goto fail;
489 		}
490 		status = usb_ep_enable(hidg->in_ep);
491 		if (status < 0) {
492 			ERROR(cdev, "Enable IN endpoint FAILED!\n");
493 			goto fail;
494 		}
495 		hidg->in_ep->driver_data = hidg;
496 	}
497 
498 
499 	if (hidg->out_ep != NULL) {
500 		/* restart endpoint */
501 		if (hidg->out_ep->driver_data != NULL)
502 			usb_ep_disable(hidg->out_ep);
503 
504 		status = config_ep_by_speed(f->config->cdev->gadget, f,
505 					    hidg->out_ep);
506 		if (status) {
507 			ERROR(cdev, "config_ep_by_speed FAILED!\n");
508 			goto fail;
509 		}
510 		status = usb_ep_enable(hidg->out_ep);
511 		if (status < 0) {
512 			ERROR(cdev, "Enable IN endpoint FAILED!\n");
513 			goto fail;
514 		}
515 		hidg->out_ep->driver_data = hidg;
516 
517 		/*
518 		 * allocate a bunch of read buffers and queue them all at once.
519 		 */
520 		for (i = 0; i < hidg->qlen && status == 0; i++) {
521 			struct usb_request *req =
522 					hidg_alloc_ep_req(hidg->out_ep,
523 							  hidg->report_length);
524 			if (req) {
525 				req->complete = hidg_set_report_complete;
526 				req->context  = hidg;
527 				status = usb_ep_queue(hidg->out_ep, req,
528 						      GFP_ATOMIC);
529 				if (status)
530 					ERROR(cdev, "%s queue req --> %d\n",
531 						hidg->out_ep->name, status);
532 			} else {
533 				usb_ep_disable(hidg->out_ep);
534 				hidg->out_ep->driver_data = NULL;
535 				status = -ENOMEM;
536 				goto fail;
537 			}
538 		}
539 	}
540 
541 fail:
542 	return status;
543 }
544 
545 const struct file_operations f_hidg_fops = {
546 	.owner		= THIS_MODULE,
547 	.open		= f_hidg_open,
548 	.release	= f_hidg_release,
549 	.write		= f_hidg_write,
550 	.read		= f_hidg_read,
551 	.poll		= f_hidg_poll,
552 	.llseek		= noop_llseek,
553 };
554 
555 static int __init hidg_bind(struct usb_configuration *c, struct usb_function *f)
556 {
557 	struct usb_ep		*ep;
558 	struct f_hidg		*hidg = func_to_hidg(f);
559 	int			status;
560 	dev_t			dev;
561 
562 	/* allocate instance-specific interface IDs, and patch descriptors */
563 	status = usb_interface_id(c, f);
564 	if (status < 0)
565 		goto fail;
566 	hidg_interface_desc.bInterfaceNumber = status;
567 
568 	/* allocate instance-specific endpoints */
569 	status = -ENODEV;
570 	ep = usb_ep_autoconfig(c->cdev->gadget, &hidg_fs_in_ep_desc);
571 	if (!ep)
572 		goto fail;
573 	ep->driver_data = c->cdev;	/* claim */
574 	hidg->in_ep = ep;
575 
576 	ep = usb_ep_autoconfig(c->cdev->gadget, &hidg_fs_out_ep_desc);
577 	if (!ep)
578 		goto fail;
579 	ep->driver_data = c->cdev;	/* claim */
580 	hidg->out_ep = ep;
581 
582 	/* preallocate request and buffer */
583 	status = -ENOMEM;
584 	hidg->req = usb_ep_alloc_request(hidg->in_ep, GFP_KERNEL);
585 	if (!hidg->req)
586 		goto fail;
587 
588 	hidg->req->buf = kmalloc(hidg->report_length, GFP_KERNEL);
589 	if (!hidg->req->buf)
590 		goto fail;
591 
592 	/* set descriptor dynamic values */
593 	hidg_interface_desc.bInterfaceSubClass = hidg->bInterfaceSubClass;
594 	hidg_interface_desc.bInterfaceProtocol = hidg->bInterfaceProtocol;
595 	hidg_hs_in_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length);
596 	hidg_fs_in_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length);
597 	hidg_hs_out_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length);
598 	hidg_fs_out_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length);
599 	hidg_desc.desc[0].bDescriptorType = HID_DT_REPORT;
600 	hidg_desc.desc[0].wDescriptorLength =
601 		cpu_to_le16(hidg->report_desc_length);
602 
603 	hidg_hs_in_ep_desc.bEndpointAddress =
604 		hidg_fs_in_ep_desc.bEndpointAddress;
605 	hidg_hs_out_ep_desc.bEndpointAddress =
606 		hidg_fs_out_ep_desc.bEndpointAddress;
607 
608 	status = usb_assign_descriptors(f, hidg_fs_descriptors,
609 			hidg_hs_descriptors, NULL);
610 	if (status)
611 		goto fail;
612 
613 	mutex_init(&hidg->lock);
614 	spin_lock_init(&hidg->spinlock);
615 	init_waitqueue_head(&hidg->write_queue);
616 	init_waitqueue_head(&hidg->read_queue);
617 	INIT_LIST_HEAD(&hidg->completed_out_req);
618 
619 	/* create char device */
620 	cdev_init(&hidg->cdev, &f_hidg_fops);
621 	dev = MKDEV(major, hidg->minor);
622 	status = cdev_add(&hidg->cdev, dev, 1);
623 	if (status)
624 		goto fail_free_descs;
625 
626 	device_create(hidg_class, NULL, dev, NULL, "%s%d", "hidg", hidg->minor);
627 
628 	return 0;
629 
630 fail_free_descs:
631 	usb_free_all_descriptors(f);
632 fail:
633 	ERROR(f->config->cdev, "hidg_bind FAILED\n");
634 	if (hidg->req != NULL) {
635 		kfree(hidg->req->buf);
636 		if (hidg->in_ep != NULL)
637 			usb_ep_free_request(hidg->in_ep, hidg->req);
638 	}
639 
640 	return status;
641 }
642 
643 static void hidg_unbind(struct usb_configuration *c, struct usb_function *f)
644 {
645 	struct f_hidg *hidg = func_to_hidg(f);
646 
647 	device_destroy(hidg_class, MKDEV(major, hidg->minor));
648 	cdev_del(&hidg->cdev);
649 
650 	/* disable/free request and end point */
651 	usb_ep_disable(hidg->in_ep);
652 	usb_ep_dequeue(hidg->in_ep, hidg->req);
653 	kfree(hidg->req->buf);
654 	usb_ep_free_request(hidg->in_ep, hidg->req);
655 
656 	usb_free_all_descriptors(f);
657 
658 	kfree(hidg->report_desc);
659 	kfree(hidg);
660 }
661 
662 /*-------------------------------------------------------------------------*/
663 /*                                 Strings                                 */
664 
665 #define CT_FUNC_HID_IDX	0
666 
667 static struct usb_string ct_func_string_defs[] = {
668 	[CT_FUNC_HID_IDX].s	= "HID Interface",
669 	{},			/* end of list */
670 };
671 
672 static struct usb_gadget_strings ct_func_string_table = {
673 	.language	= 0x0409,	/* en-US */
674 	.strings	= ct_func_string_defs,
675 };
676 
677 static struct usb_gadget_strings *ct_func_strings[] = {
678 	&ct_func_string_table,
679 	NULL,
680 };
681 
682 /*-------------------------------------------------------------------------*/
683 /*                             usb_configuration                           */
684 
685 int __init hidg_bind_config(struct usb_configuration *c,
686 			    struct hidg_func_descriptor *fdesc, int index)
687 {
688 	struct f_hidg *hidg;
689 	int status;
690 
691 	if (index >= minors)
692 		return -ENOENT;
693 
694 	/* maybe allocate device-global string IDs, and patch descriptors */
695 	if (ct_func_string_defs[CT_FUNC_HID_IDX].id == 0) {
696 		status = usb_string_id(c->cdev);
697 		if (status < 0)
698 			return status;
699 		ct_func_string_defs[CT_FUNC_HID_IDX].id = status;
700 		hidg_interface_desc.iInterface = status;
701 	}
702 
703 	/* allocate and initialize one new instance */
704 	hidg = kzalloc(sizeof *hidg, GFP_KERNEL);
705 	if (!hidg)
706 		return -ENOMEM;
707 
708 	hidg->minor = index;
709 	hidg->bInterfaceSubClass = fdesc->subclass;
710 	hidg->bInterfaceProtocol = fdesc->protocol;
711 	hidg->report_length = fdesc->report_length;
712 	hidg->report_desc_length = fdesc->report_desc_length;
713 	hidg->report_desc = kmemdup(fdesc->report_desc,
714 				    fdesc->report_desc_length,
715 				    GFP_KERNEL);
716 	if (!hidg->report_desc) {
717 		kfree(hidg);
718 		return -ENOMEM;
719 	}
720 
721 	hidg->func.name    = "hid";
722 	hidg->func.strings = ct_func_strings;
723 	hidg->func.bind    = hidg_bind;
724 	hidg->func.unbind  = hidg_unbind;
725 	hidg->func.set_alt = hidg_set_alt;
726 	hidg->func.disable = hidg_disable;
727 	hidg->func.setup   = hidg_setup;
728 
729 	/* this could me made configurable at some point */
730 	hidg->qlen	   = 4;
731 
732 	status = usb_add_function(c, &hidg->func);
733 	if (status)
734 		kfree(hidg);
735 
736 	return status;
737 }
738 
739 int __init ghid_setup(struct usb_gadget *g, int count)
740 {
741 	int status;
742 	dev_t dev;
743 
744 	hidg_class = class_create(THIS_MODULE, "hidg");
745 
746 	status = alloc_chrdev_region(&dev, 0, count, "hidg");
747 	if (!status) {
748 		major = MAJOR(dev);
749 		minors = count;
750 	}
751 
752 	return status;
753 }
754 
755 void ghid_cleanup(void)
756 {
757 	if (major) {
758 		unregister_chrdev_region(MKDEV(major, 0), minors);
759 		major = minors = 0;
760 	}
761 
762 	class_destroy(hidg_class);
763 	hidg_class = NULL;
764 }
765