1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * f_printer.c - USB printer function driver
4  *
5  * Copied from drivers/usb/gadget/legacy/printer.c,
6  * which was:
7  *
8  * printer.c -- Printer gadget driver
9  *
10  * Copyright (C) 2003-2005 David Brownell
11  * Copyright (C) 2006 Craig W. Nadler
12  */
13 
14 #include <linux/module.h>
15 #include <linux/kernel.h>
16 #include <linux/delay.h>
17 #include <linux/ioport.h>
18 #include <linux/sched.h>
19 #include <linux/slab.h>
20 #include <linux/mutex.h>
21 #include <linux/errno.h>
22 #include <linux/init.h>
23 #include <linux/idr.h>
24 #include <linux/timer.h>
25 #include <linux/list.h>
26 #include <linux/interrupt.h>
27 #include <linux/device.h>
28 #include <linux/moduleparam.h>
29 #include <linux/fs.h>
30 #include <linux/poll.h>
31 #include <linux/types.h>
32 #include <linux/ctype.h>
33 #include <linux/cdev.h>
34 #include <linux/kref.h>
35 
36 #include <asm/byteorder.h>
37 #include <linux/io.h>
38 #include <linux/irq.h>
39 #include <linux/uaccess.h>
40 #include <asm/unaligned.h>
41 
42 #include <linux/usb/ch9.h>
43 #include <linux/usb/composite.h>
44 #include <linux/usb/gadget.h>
45 #include <linux/usb/g_printer.h>
46 
47 #include "u_printer.h"
48 
49 #define PRINTER_MINORS		4
50 #define GET_DEVICE_ID		0
51 #define GET_PORT_STATUS		1
52 #define SOFT_RESET		2
53 
54 #define DEFAULT_Q_LEN		10 /* same as legacy g_printer gadget */
55 
56 static int major, minors;
57 static struct class *usb_gadget_class;
58 static DEFINE_IDA(printer_ida);
59 static DEFINE_MUTEX(printer_ida_lock); /* protects access do printer_ida */
60 
61 /*-------------------------------------------------------------------------*/
62 
63 struct printer_dev {
64 	spinlock_t		lock;		/* lock this structure */
65 	/* lock buffer lists during read/write calls */
66 	struct mutex		lock_printer_io;
67 	struct usb_gadget	*gadget;
68 	s8			interface;
69 	struct usb_ep		*in_ep, *out_ep;
70 	struct kref             kref;
71 	struct list_head	rx_reqs;	/* List of free RX structs */
72 	struct list_head	rx_reqs_active;	/* List of Active RX xfers */
73 	struct list_head	rx_buffers;	/* List of completed xfers */
74 	/* wait until there is data to be read. */
75 	wait_queue_head_t	rx_wait;
76 	struct list_head	tx_reqs;	/* List of free TX structs */
77 	struct list_head	tx_reqs_active; /* List of Active TX xfers */
78 	/* Wait until there are write buffers available to use. */
79 	wait_queue_head_t	tx_wait;
80 	/* Wait until all write buffers have been sent. */
81 	wait_queue_head_t	tx_flush_wait;
82 	struct usb_request	*current_rx_req;
83 	size_t			current_rx_bytes;
84 	u8			*current_rx_buf;
85 	u8			printer_status;
86 	u8			reset_printer;
87 	int			minor;
88 	struct cdev		printer_cdev;
89 	u8			printer_cdev_open;
90 	wait_queue_head_t	wait;
91 	unsigned		q_len;
92 	char			*pnp_string;	/* We don't own memory! */
93 	struct usb_function	function;
94 };
95 
96 static inline struct printer_dev *func_to_printer(struct usb_function *f)
97 {
98 	return container_of(f, struct printer_dev, function);
99 }
100 
101 /*-------------------------------------------------------------------------*/
102 
103 /*
104  * DESCRIPTORS ... most are static, but strings and (full) configuration
105  * descriptors are built on demand.
106  */
107 
108 /* holds our biggest descriptor */
109 #define USB_DESC_BUFSIZE		256
110 #define USB_BUFSIZE			8192
111 
112 static struct usb_interface_descriptor intf_desc = {
113 	.bLength =		sizeof(intf_desc),
114 	.bDescriptorType =	USB_DT_INTERFACE,
115 	.bNumEndpoints =	2,
116 	.bInterfaceClass =	USB_CLASS_PRINTER,
117 	.bInterfaceSubClass =	1,	/* Printer Sub-Class */
118 	.bInterfaceProtocol =	2,	/* Bi-Directional */
119 	.iInterface =		0
120 };
121 
122 static struct usb_endpoint_descriptor fs_ep_in_desc = {
123 	.bLength =		USB_DT_ENDPOINT_SIZE,
124 	.bDescriptorType =	USB_DT_ENDPOINT,
125 	.bEndpointAddress =	USB_DIR_IN,
126 	.bmAttributes =		USB_ENDPOINT_XFER_BULK
127 };
128 
129 static struct usb_endpoint_descriptor fs_ep_out_desc = {
130 	.bLength =		USB_DT_ENDPOINT_SIZE,
131 	.bDescriptorType =	USB_DT_ENDPOINT,
132 	.bEndpointAddress =	USB_DIR_OUT,
133 	.bmAttributes =		USB_ENDPOINT_XFER_BULK
134 };
135 
136 static struct usb_descriptor_header *fs_printer_function[] = {
137 	(struct usb_descriptor_header *) &intf_desc,
138 	(struct usb_descriptor_header *) &fs_ep_in_desc,
139 	(struct usb_descriptor_header *) &fs_ep_out_desc,
140 	NULL
141 };
142 
143 /*
144  * usb 2.0 devices need to expose both high speed and full speed
145  * descriptors, unless they only run at full speed.
146  */
147 
148 static struct usb_endpoint_descriptor hs_ep_in_desc = {
149 	.bLength =		USB_DT_ENDPOINT_SIZE,
150 	.bDescriptorType =	USB_DT_ENDPOINT,
151 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
152 	.wMaxPacketSize =	cpu_to_le16(512)
153 };
154 
155 static struct usb_endpoint_descriptor hs_ep_out_desc = {
156 	.bLength =		USB_DT_ENDPOINT_SIZE,
157 	.bDescriptorType =	USB_DT_ENDPOINT,
158 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
159 	.wMaxPacketSize =	cpu_to_le16(512)
160 };
161 
162 static struct usb_descriptor_header *hs_printer_function[] = {
163 	(struct usb_descriptor_header *) &intf_desc,
164 	(struct usb_descriptor_header *) &hs_ep_in_desc,
165 	(struct usb_descriptor_header *) &hs_ep_out_desc,
166 	NULL
167 };
168 
169 /*
170  * Added endpoint descriptors for 3.0 devices
171  */
172 
173 static struct usb_endpoint_descriptor ss_ep_in_desc = {
174 	.bLength =              USB_DT_ENDPOINT_SIZE,
175 	.bDescriptorType =      USB_DT_ENDPOINT,
176 	.bmAttributes =         USB_ENDPOINT_XFER_BULK,
177 	.wMaxPacketSize =       cpu_to_le16(1024),
178 };
179 
180 static struct usb_ss_ep_comp_descriptor ss_ep_in_comp_desc = {
181 	.bLength =              sizeof(ss_ep_in_comp_desc),
182 	.bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
183 };
184 
185 static struct usb_endpoint_descriptor ss_ep_out_desc = {
186 	.bLength =              USB_DT_ENDPOINT_SIZE,
187 	.bDescriptorType =      USB_DT_ENDPOINT,
188 	.bmAttributes =         USB_ENDPOINT_XFER_BULK,
189 	.wMaxPacketSize =       cpu_to_le16(1024),
190 };
191 
192 static struct usb_ss_ep_comp_descriptor ss_ep_out_comp_desc = {
193 	.bLength =              sizeof(ss_ep_out_comp_desc),
194 	.bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
195 };
196 
197 static struct usb_descriptor_header *ss_printer_function[] = {
198 	(struct usb_descriptor_header *) &intf_desc,
199 	(struct usb_descriptor_header *) &ss_ep_in_desc,
200 	(struct usb_descriptor_header *) &ss_ep_in_comp_desc,
201 	(struct usb_descriptor_header *) &ss_ep_out_desc,
202 	(struct usb_descriptor_header *) &ss_ep_out_comp_desc,
203 	NULL
204 };
205 
206 /* maxpacket and other transfer characteristics vary by speed. */
207 static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget,
208 					struct usb_endpoint_descriptor *fs,
209 					struct usb_endpoint_descriptor *hs,
210 					struct usb_endpoint_descriptor *ss)
211 {
212 	switch (gadget->speed) {
213 	case USB_SPEED_SUPER:
214 		return ss;
215 	case USB_SPEED_HIGH:
216 		return hs;
217 	default:
218 		return fs;
219 	}
220 }
221 
222 /*-------------------------------------------------------------------------*/
223 
224 static void printer_dev_free(struct kref *kref)
225 {
226 	struct printer_dev *dev = container_of(kref, struct printer_dev, kref);
227 
228 	kfree(dev);
229 }
230 
231 static struct usb_request *
232 printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags)
233 {
234 	struct usb_request	*req;
235 
236 	req = usb_ep_alloc_request(ep, gfp_flags);
237 
238 	if (req != NULL) {
239 		req->length = len;
240 		req->buf = kmalloc(len, gfp_flags);
241 		if (req->buf == NULL) {
242 			usb_ep_free_request(ep, req);
243 			return NULL;
244 		}
245 	}
246 
247 	return req;
248 }
249 
250 static void
251 printer_req_free(struct usb_ep *ep, struct usb_request *req)
252 {
253 	if (ep != NULL && req != NULL) {
254 		kfree(req->buf);
255 		usb_ep_free_request(ep, req);
256 	}
257 }
258 
259 /*-------------------------------------------------------------------------*/
260 
261 static void rx_complete(struct usb_ep *ep, struct usb_request *req)
262 {
263 	struct printer_dev	*dev = ep->driver_data;
264 	int			status = req->status;
265 	unsigned long		flags;
266 
267 	spin_lock_irqsave(&dev->lock, flags);
268 
269 	list_del_init(&req->list);	/* Remode from Active List */
270 
271 	switch (status) {
272 
273 	/* normal completion */
274 	case 0:
275 		if (req->actual > 0) {
276 			list_add_tail(&req->list, &dev->rx_buffers);
277 			DBG(dev, "G_Printer : rx length %d\n", req->actual);
278 		} else {
279 			list_add(&req->list, &dev->rx_reqs);
280 		}
281 		break;
282 
283 	/* software-driven interface shutdown */
284 	case -ECONNRESET:		/* unlink */
285 	case -ESHUTDOWN:		/* disconnect etc */
286 		VDBG(dev, "rx shutdown, code %d\n", status);
287 		list_add(&req->list, &dev->rx_reqs);
288 		break;
289 
290 	/* for hardware automagic (such as pxa) */
291 	case -ECONNABORTED:		/* endpoint reset */
292 		DBG(dev, "rx %s reset\n", ep->name);
293 		list_add(&req->list, &dev->rx_reqs);
294 		break;
295 
296 	/* data overrun */
297 	case -EOVERFLOW:
298 		fallthrough;
299 
300 	default:
301 		DBG(dev, "rx status %d\n", status);
302 		list_add(&req->list, &dev->rx_reqs);
303 		break;
304 	}
305 
306 	wake_up_interruptible(&dev->rx_wait);
307 	spin_unlock_irqrestore(&dev->lock, flags);
308 }
309 
310 static void tx_complete(struct usb_ep *ep, struct usb_request *req)
311 {
312 	struct printer_dev	*dev = ep->driver_data;
313 
314 	switch (req->status) {
315 	default:
316 		VDBG(dev, "tx err %d\n", req->status);
317 		fallthrough;
318 	case -ECONNRESET:		/* unlink */
319 	case -ESHUTDOWN:		/* disconnect etc */
320 		break;
321 	case 0:
322 		break;
323 	}
324 
325 	spin_lock(&dev->lock);
326 	/* Take the request struct off the active list and put it on the
327 	 * free list.
328 	 */
329 	list_del_init(&req->list);
330 	list_add(&req->list, &dev->tx_reqs);
331 	wake_up_interruptible(&dev->tx_wait);
332 	if (likely(list_empty(&dev->tx_reqs_active)))
333 		wake_up_interruptible(&dev->tx_flush_wait);
334 
335 	spin_unlock(&dev->lock);
336 }
337 
338 /*-------------------------------------------------------------------------*/
339 
340 static int
341 printer_open(struct inode *inode, struct file *fd)
342 {
343 	struct printer_dev	*dev;
344 	unsigned long		flags;
345 	int			ret = -EBUSY;
346 
347 	dev = container_of(inode->i_cdev, struct printer_dev, printer_cdev);
348 
349 	spin_lock_irqsave(&dev->lock, flags);
350 
351 	if (dev->interface < 0) {
352 		spin_unlock_irqrestore(&dev->lock, flags);
353 		return -ENODEV;
354 	}
355 
356 	if (!dev->printer_cdev_open) {
357 		dev->printer_cdev_open = 1;
358 		fd->private_data = dev;
359 		ret = 0;
360 		/* Change the printer status to show that it's on-line. */
361 		dev->printer_status |= PRINTER_SELECTED;
362 	}
363 
364 	spin_unlock_irqrestore(&dev->lock, flags);
365 
366 	kref_get(&dev->kref);
367 	DBG(dev, "printer_open returned %x\n", ret);
368 	return ret;
369 }
370 
371 static int
372 printer_close(struct inode *inode, struct file *fd)
373 {
374 	struct printer_dev	*dev = fd->private_data;
375 	unsigned long		flags;
376 
377 	spin_lock_irqsave(&dev->lock, flags);
378 	dev->printer_cdev_open = 0;
379 	fd->private_data = NULL;
380 	/* Change printer status to show that the printer is off-line. */
381 	dev->printer_status &= ~PRINTER_SELECTED;
382 	spin_unlock_irqrestore(&dev->lock, flags);
383 
384 	kref_put(&dev->kref, printer_dev_free);
385 	DBG(dev, "printer_close\n");
386 
387 	return 0;
388 }
389 
390 /* This function must be called with interrupts turned off. */
391 static void
392 setup_rx_reqs(struct printer_dev *dev)
393 {
394 	struct usb_request              *req;
395 
396 	while (likely(!list_empty(&dev->rx_reqs))) {
397 		int error;
398 
399 		req = container_of(dev->rx_reqs.next,
400 				struct usb_request, list);
401 		list_del_init(&req->list);
402 
403 		/* The USB Host sends us whatever amount of data it wants to
404 		 * so we always set the length field to the full USB_BUFSIZE.
405 		 * If the amount of data is more than the read() caller asked
406 		 * for it will be stored in the request buffer until it is
407 		 * asked for by read().
408 		 */
409 		req->length = USB_BUFSIZE;
410 		req->complete = rx_complete;
411 
412 		/* here, we unlock, and only unlock, to avoid deadlock. */
413 		spin_unlock(&dev->lock);
414 		error = usb_ep_queue(dev->out_ep, req, GFP_ATOMIC);
415 		spin_lock(&dev->lock);
416 		if (error) {
417 			DBG(dev, "rx submit --> %d\n", error);
418 			list_add(&req->list, &dev->rx_reqs);
419 			break;
420 		}
421 		/* if the req is empty, then add it into dev->rx_reqs_active. */
422 		else if (list_empty(&req->list))
423 			list_add(&req->list, &dev->rx_reqs_active);
424 	}
425 }
426 
427 static ssize_t
428 printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
429 {
430 	struct printer_dev		*dev = fd->private_data;
431 	unsigned long			flags;
432 	size_t				size;
433 	size_t				bytes_copied;
434 	struct usb_request		*req;
435 	/* This is a pointer to the current USB rx request. */
436 	struct usb_request		*current_rx_req;
437 	/* This is the number of bytes in the current rx buffer. */
438 	size_t				current_rx_bytes;
439 	/* This is a pointer to the current rx buffer. */
440 	u8				*current_rx_buf;
441 
442 	if (len == 0)
443 		return -EINVAL;
444 
445 	DBG(dev, "printer_read trying to read %d bytes\n", (int)len);
446 
447 	mutex_lock(&dev->lock_printer_io);
448 	spin_lock_irqsave(&dev->lock, flags);
449 
450 	if (dev->interface < 0) {
451 		spin_unlock_irqrestore(&dev->lock, flags);
452 		mutex_unlock(&dev->lock_printer_io);
453 		return -ENODEV;
454 	}
455 
456 	/* We will use this flag later to check if a printer reset happened
457 	 * after we turn interrupts back on.
458 	 */
459 	dev->reset_printer = 0;
460 
461 	setup_rx_reqs(dev);
462 
463 	bytes_copied = 0;
464 	current_rx_req = dev->current_rx_req;
465 	current_rx_bytes = dev->current_rx_bytes;
466 	current_rx_buf = dev->current_rx_buf;
467 	dev->current_rx_req = NULL;
468 	dev->current_rx_bytes = 0;
469 	dev->current_rx_buf = NULL;
470 
471 	/* Check if there is any data in the read buffers. Please note that
472 	 * current_rx_bytes is the number of bytes in the current rx buffer.
473 	 * If it is zero then check if there are any other rx_buffers that
474 	 * are on the completed list. We are only out of data if all rx
475 	 * buffers are empty.
476 	 */
477 	if ((current_rx_bytes == 0) &&
478 			(likely(list_empty(&dev->rx_buffers)))) {
479 		/* Turn interrupts back on before sleeping. */
480 		spin_unlock_irqrestore(&dev->lock, flags);
481 
482 		/*
483 		 * If no data is available check if this is a NON-Blocking
484 		 * call or not.
485 		 */
486 		if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
487 			mutex_unlock(&dev->lock_printer_io);
488 			return -EAGAIN;
489 		}
490 
491 		/* Sleep until data is available */
492 		wait_event_interruptible(dev->rx_wait,
493 				(likely(!list_empty(&dev->rx_buffers))));
494 		spin_lock_irqsave(&dev->lock, flags);
495 	}
496 
497 	/* We have data to return then copy it to the caller's buffer.*/
498 	while ((current_rx_bytes || likely(!list_empty(&dev->rx_buffers)))
499 			&& len) {
500 		if (current_rx_bytes == 0) {
501 			req = container_of(dev->rx_buffers.next,
502 					struct usb_request, list);
503 			list_del_init(&req->list);
504 
505 			if (req->actual && req->buf) {
506 				current_rx_req = req;
507 				current_rx_bytes = req->actual;
508 				current_rx_buf = req->buf;
509 			} else {
510 				list_add(&req->list, &dev->rx_reqs);
511 				continue;
512 			}
513 		}
514 
515 		/* Don't leave irqs off while doing memory copies */
516 		spin_unlock_irqrestore(&dev->lock, flags);
517 
518 		if (len > current_rx_bytes)
519 			size = current_rx_bytes;
520 		else
521 			size = len;
522 
523 		size -= copy_to_user(buf, current_rx_buf, size);
524 		bytes_copied += size;
525 		len -= size;
526 		buf += size;
527 
528 		spin_lock_irqsave(&dev->lock, flags);
529 
530 		/* We've disconnected or reset so return. */
531 		if (dev->reset_printer) {
532 			list_add(&current_rx_req->list, &dev->rx_reqs);
533 			spin_unlock_irqrestore(&dev->lock, flags);
534 			mutex_unlock(&dev->lock_printer_io);
535 			return -EAGAIN;
536 		}
537 
538 		/* If we not returning all the data left in this RX request
539 		 * buffer then adjust the amount of data left in the buffer.
540 		 * Othewise if we are done with this RX request buffer then
541 		 * requeue it to get any incoming data from the USB host.
542 		 */
543 		if (size < current_rx_bytes) {
544 			current_rx_bytes -= size;
545 			current_rx_buf += size;
546 		} else {
547 			list_add(&current_rx_req->list, &dev->rx_reqs);
548 			current_rx_bytes = 0;
549 			current_rx_buf = NULL;
550 			current_rx_req = NULL;
551 		}
552 	}
553 
554 	dev->current_rx_req = current_rx_req;
555 	dev->current_rx_bytes = current_rx_bytes;
556 	dev->current_rx_buf = current_rx_buf;
557 
558 	spin_unlock_irqrestore(&dev->lock, flags);
559 	mutex_unlock(&dev->lock_printer_io);
560 
561 	DBG(dev, "printer_read returned %d bytes\n", (int)bytes_copied);
562 
563 	if (bytes_copied)
564 		return bytes_copied;
565 	else
566 		return -EAGAIN;
567 }
568 
569 static ssize_t
570 printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
571 {
572 	struct printer_dev	*dev = fd->private_data;
573 	unsigned long		flags;
574 	size_t			size;	/* Amount of data in a TX request. */
575 	size_t			bytes_copied = 0;
576 	struct usb_request	*req;
577 	int			value;
578 
579 	DBG(dev, "printer_write trying to send %d bytes\n", (int)len);
580 
581 	if (len == 0)
582 		return -EINVAL;
583 
584 	mutex_lock(&dev->lock_printer_io);
585 	spin_lock_irqsave(&dev->lock, flags);
586 
587 	if (dev->interface < 0) {
588 		spin_unlock_irqrestore(&dev->lock, flags);
589 		mutex_unlock(&dev->lock_printer_io);
590 		return -ENODEV;
591 	}
592 
593 	/* Check if a printer reset happens while we have interrupts on */
594 	dev->reset_printer = 0;
595 
596 	/* Check if there is any available write buffers */
597 	if (likely(list_empty(&dev->tx_reqs))) {
598 		/* Turn interrupts back on before sleeping. */
599 		spin_unlock_irqrestore(&dev->lock, flags);
600 
601 		/*
602 		 * If write buffers are available check if this is
603 		 * a NON-Blocking call or not.
604 		 */
605 		if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
606 			mutex_unlock(&dev->lock_printer_io);
607 			return -EAGAIN;
608 		}
609 
610 		/* Sleep until a write buffer is available */
611 		wait_event_interruptible(dev->tx_wait,
612 				(likely(!list_empty(&dev->tx_reqs))));
613 		spin_lock_irqsave(&dev->lock, flags);
614 	}
615 
616 	while (likely(!list_empty(&dev->tx_reqs)) && len) {
617 
618 		if (len > USB_BUFSIZE)
619 			size = USB_BUFSIZE;
620 		else
621 			size = len;
622 
623 		req = container_of(dev->tx_reqs.next, struct usb_request,
624 				list);
625 		list_del_init(&req->list);
626 
627 		req->complete = tx_complete;
628 		req->length = size;
629 
630 		/* Check if we need to send a zero length packet. */
631 		if (len > size)
632 			/* They will be more TX requests so no yet. */
633 			req->zero = 0;
634 		else
635 			/* If the data amount is not a multiple of the
636 			 * maxpacket size then send a zero length packet.
637 			 */
638 			req->zero = ((len % dev->in_ep->maxpacket) == 0);
639 
640 		/* Don't leave irqs off while doing memory copies */
641 		spin_unlock_irqrestore(&dev->lock, flags);
642 
643 		if (copy_from_user(req->buf, buf, size)) {
644 			list_add(&req->list, &dev->tx_reqs);
645 			mutex_unlock(&dev->lock_printer_io);
646 			return bytes_copied;
647 		}
648 
649 		bytes_copied += size;
650 		len -= size;
651 		buf += size;
652 
653 		spin_lock_irqsave(&dev->lock, flags);
654 
655 		/* We've disconnected or reset so free the req and buffer */
656 		if (dev->reset_printer) {
657 			list_add(&req->list, &dev->tx_reqs);
658 			spin_unlock_irqrestore(&dev->lock, flags);
659 			mutex_unlock(&dev->lock_printer_io);
660 			return -EAGAIN;
661 		}
662 
663 		list_add(&req->list, &dev->tx_reqs_active);
664 
665 		/* here, we unlock, and only unlock, to avoid deadlock. */
666 		spin_unlock(&dev->lock);
667 		value = usb_ep_queue(dev->in_ep, req, GFP_ATOMIC);
668 		spin_lock(&dev->lock);
669 		if (value) {
670 			list_del(&req->list);
671 			list_add(&req->list, &dev->tx_reqs);
672 			spin_unlock_irqrestore(&dev->lock, flags);
673 			mutex_unlock(&dev->lock_printer_io);
674 			return -EAGAIN;
675 		}
676 	}
677 
678 	spin_unlock_irqrestore(&dev->lock, flags);
679 	mutex_unlock(&dev->lock_printer_io);
680 
681 	DBG(dev, "printer_write sent %d bytes\n", (int)bytes_copied);
682 
683 	if (bytes_copied)
684 		return bytes_copied;
685 	else
686 		return -EAGAIN;
687 }
688 
689 static int
690 printer_fsync(struct file *fd, loff_t start, loff_t end, int datasync)
691 {
692 	struct printer_dev	*dev = fd->private_data;
693 	struct inode *inode = file_inode(fd);
694 	unsigned long		flags;
695 	int			tx_list_empty;
696 
697 	inode_lock(inode);
698 	spin_lock_irqsave(&dev->lock, flags);
699 
700 	if (dev->interface < 0) {
701 		spin_unlock_irqrestore(&dev->lock, flags);
702 		inode_unlock(inode);
703 		return -ENODEV;
704 	}
705 
706 	tx_list_empty = (likely(list_empty(&dev->tx_reqs)));
707 	spin_unlock_irqrestore(&dev->lock, flags);
708 
709 	if (!tx_list_empty) {
710 		/* Sleep until all data has been sent */
711 		wait_event_interruptible(dev->tx_flush_wait,
712 				(likely(list_empty(&dev->tx_reqs_active))));
713 	}
714 	inode_unlock(inode);
715 
716 	return 0;
717 }
718 
719 static __poll_t
720 printer_poll(struct file *fd, poll_table *wait)
721 {
722 	struct printer_dev	*dev = fd->private_data;
723 	unsigned long		flags;
724 	__poll_t		status = 0;
725 
726 	mutex_lock(&dev->lock_printer_io);
727 	spin_lock_irqsave(&dev->lock, flags);
728 
729 	if (dev->interface < 0) {
730 		spin_unlock_irqrestore(&dev->lock, flags);
731 		mutex_unlock(&dev->lock_printer_io);
732 		return EPOLLERR | EPOLLHUP;
733 	}
734 
735 	setup_rx_reqs(dev);
736 	spin_unlock_irqrestore(&dev->lock, flags);
737 	mutex_unlock(&dev->lock_printer_io);
738 
739 	poll_wait(fd, &dev->rx_wait, wait);
740 	poll_wait(fd, &dev->tx_wait, wait);
741 
742 	spin_lock_irqsave(&dev->lock, flags);
743 	if (likely(!list_empty(&dev->tx_reqs)))
744 		status |= EPOLLOUT | EPOLLWRNORM;
745 
746 	if (likely(dev->current_rx_bytes) ||
747 			likely(!list_empty(&dev->rx_buffers)))
748 		status |= EPOLLIN | EPOLLRDNORM;
749 
750 	spin_unlock_irqrestore(&dev->lock, flags);
751 
752 	return status;
753 }
754 
755 static long
756 printer_ioctl(struct file *fd, unsigned int code, unsigned long arg)
757 {
758 	struct printer_dev	*dev = fd->private_data;
759 	unsigned long		flags;
760 	int			status = 0;
761 
762 	DBG(dev, "printer_ioctl: cmd=0x%4.4x, arg=%lu\n", code, arg);
763 
764 	/* handle ioctls */
765 
766 	spin_lock_irqsave(&dev->lock, flags);
767 
768 	if (dev->interface < 0) {
769 		spin_unlock_irqrestore(&dev->lock, flags);
770 		return -ENODEV;
771 	}
772 
773 	switch (code) {
774 	case GADGET_GET_PRINTER_STATUS:
775 		status = (int)dev->printer_status;
776 		break;
777 	case GADGET_SET_PRINTER_STATUS:
778 		dev->printer_status = (u8)arg;
779 		break;
780 	default:
781 		/* could not handle ioctl */
782 		DBG(dev, "printer_ioctl: ERROR cmd=0x%4.4xis not supported\n",
783 				code);
784 		status = -ENOTTY;
785 	}
786 
787 	spin_unlock_irqrestore(&dev->lock, flags);
788 
789 	return status;
790 }
791 
792 /* used after endpoint configuration */
793 static const struct file_operations printer_io_operations = {
794 	.owner =	THIS_MODULE,
795 	.open =		printer_open,
796 	.read =		printer_read,
797 	.write =	printer_write,
798 	.fsync =	printer_fsync,
799 	.poll =		printer_poll,
800 	.unlocked_ioctl = printer_ioctl,
801 	.release =	printer_close,
802 	.llseek =	noop_llseek,
803 };
804 
805 /*-------------------------------------------------------------------------*/
806 
807 static int
808 set_printer_interface(struct printer_dev *dev)
809 {
810 	int			result = 0;
811 
812 	dev->in_ep->desc = ep_desc(dev->gadget, &fs_ep_in_desc, &hs_ep_in_desc,
813 				&ss_ep_in_desc);
814 	dev->in_ep->driver_data = dev;
815 
816 	dev->out_ep->desc = ep_desc(dev->gadget, &fs_ep_out_desc,
817 				    &hs_ep_out_desc, &ss_ep_out_desc);
818 	dev->out_ep->driver_data = dev;
819 
820 	result = usb_ep_enable(dev->in_ep);
821 	if (result != 0) {
822 		DBG(dev, "enable %s --> %d\n", dev->in_ep->name, result);
823 		goto done;
824 	}
825 
826 	result = usb_ep_enable(dev->out_ep);
827 	if (result != 0) {
828 		DBG(dev, "enable %s --> %d\n", dev->in_ep->name, result);
829 		goto done;
830 	}
831 
832 done:
833 	/* on error, disable any endpoints  */
834 	if (result != 0) {
835 		(void) usb_ep_disable(dev->in_ep);
836 		(void) usb_ep_disable(dev->out_ep);
837 		dev->in_ep->desc = NULL;
838 		dev->out_ep->desc = NULL;
839 	}
840 
841 	/* caller is responsible for cleanup on error */
842 	return result;
843 }
844 
845 static void printer_reset_interface(struct printer_dev *dev)
846 {
847 	unsigned long	flags;
848 
849 	if (dev->interface < 0)
850 		return;
851 
852 	DBG(dev, "%s\n", __func__);
853 
854 	if (dev->in_ep->desc)
855 		usb_ep_disable(dev->in_ep);
856 
857 	if (dev->out_ep->desc)
858 		usb_ep_disable(dev->out_ep);
859 
860 	spin_lock_irqsave(&dev->lock, flags);
861 	dev->in_ep->desc = NULL;
862 	dev->out_ep->desc = NULL;
863 	dev->interface = -1;
864 	spin_unlock_irqrestore(&dev->lock, flags);
865 }
866 
867 /* Change our operational Interface. */
868 static int set_interface(struct printer_dev *dev, unsigned number)
869 {
870 	int			result = 0;
871 
872 	/* Free the current interface */
873 	printer_reset_interface(dev);
874 
875 	result = set_printer_interface(dev);
876 	if (result)
877 		printer_reset_interface(dev);
878 	else
879 		dev->interface = number;
880 
881 	if (!result)
882 		INFO(dev, "Using interface %x\n", number);
883 
884 	return result;
885 }
886 
887 static void printer_soft_reset(struct printer_dev *dev)
888 {
889 	struct usb_request	*req;
890 
891 	INFO(dev, "Received Printer Reset Request\n");
892 
893 	if (usb_ep_disable(dev->in_ep))
894 		DBG(dev, "Failed to disable USB in_ep\n");
895 	if (usb_ep_disable(dev->out_ep))
896 		DBG(dev, "Failed to disable USB out_ep\n");
897 
898 	if (dev->current_rx_req != NULL) {
899 		list_add(&dev->current_rx_req->list, &dev->rx_reqs);
900 		dev->current_rx_req = NULL;
901 	}
902 	dev->current_rx_bytes = 0;
903 	dev->current_rx_buf = NULL;
904 	dev->reset_printer = 1;
905 
906 	while (likely(!(list_empty(&dev->rx_buffers)))) {
907 		req = container_of(dev->rx_buffers.next, struct usb_request,
908 				list);
909 		list_del_init(&req->list);
910 		list_add(&req->list, &dev->rx_reqs);
911 	}
912 
913 	while (likely(!(list_empty(&dev->rx_reqs_active)))) {
914 		req = container_of(dev->rx_buffers.next, struct usb_request,
915 				list);
916 		list_del_init(&req->list);
917 		list_add(&req->list, &dev->rx_reqs);
918 	}
919 
920 	while (likely(!(list_empty(&dev->tx_reqs_active)))) {
921 		req = container_of(dev->tx_reqs_active.next,
922 				struct usb_request, list);
923 		list_del_init(&req->list);
924 		list_add(&req->list, &dev->tx_reqs);
925 	}
926 
927 	if (usb_ep_enable(dev->in_ep))
928 		DBG(dev, "Failed to enable USB in_ep\n");
929 	if (usb_ep_enable(dev->out_ep))
930 		DBG(dev, "Failed to enable USB out_ep\n");
931 
932 	wake_up_interruptible(&dev->rx_wait);
933 	wake_up_interruptible(&dev->tx_wait);
934 	wake_up_interruptible(&dev->tx_flush_wait);
935 }
936 
937 /*-------------------------------------------------------------------------*/
938 
939 static bool gprinter_req_match(struct usb_function *f,
940 			       const struct usb_ctrlrequest *ctrl,
941 			       bool config0)
942 {
943 	struct printer_dev	*dev = func_to_printer(f);
944 	u16			w_index = le16_to_cpu(ctrl->wIndex);
945 	u16			w_value = le16_to_cpu(ctrl->wValue);
946 	u16			w_length = le16_to_cpu(ctrl->wLength);
947 
948 	if (config0)
949 		return false;
950 
951 	if ((ctrl->bRequestType & USB_RECIP_MASK) != USB_RECIP_INTERFACE ||
952 	    (ctrl->bRequestType & USB_TYPE_MASK) != USB_TYPE_CLASS)
953 		return false;
954 
955 	switch (ctrl->bRequest) {
956 	case GET_DEVICE_ID:
957 		w_index >>= 8;
958 		if (USB_DIR_IN & ctrl->bRequestType)
959 			break;
960 		return false;
961 	case GET_PORT_STATUS:
962 		if (!w_value && w_length == 1 &&
963 		    (USB_DIR_IN & ctrl->bRequestType))
964 			break;
965 		return false;
966 	case SOFT_RESET:
967 		if (!w_value && !w_length &&
968 		   !(USB_DIR_IN & ctrl->bRequestType))
969 			break;
970 		fallthrough;
971 	default:
972 		return false;
973 	}
974 	return w_index == dev->interface;
975 }
976 
977 /*
978  * The setup() callback implements all the ep0 functionality that's not
979  * handled lower down.
980  */
981 static int printer_func_setup(struct usb_function *f,
982 		const struct usb_ctrlrequest *ctrl)
983 {
984 	struct printer_dev *dev = func_to_printer(f);
985 	struct usb_composite_dev *cdev = f->config->cdev;
986 	struct usb_request	*req = cdev->req;
987 	u8			*buf = req->buf;
988 	int			value = -EOPNOTSUPP;
989 	u16			wIndex = le16_to_cpu(ctrl->wIndex);
990 	u16			wValue = le16_to_cpu(ctrl->wValue);
991 	u16			wLength = le16_to_cpu(ctrl->wLength);
992 
993 	DBG(dev, "ctrl req%02x.%02x v%04x i%04x l%d\n",
994 		ctrl->bRequestType, ctrl->bRequest, wValue, wIndex, wLength);
995 
996 	switch (ctrl->bRequestType&USB_TYPE_MASK) {
997 	case USB_TYPE_CLASS:
998 		switch (ctrl->bRequest) {
999 		case GET_DEVICE_ID: /* Get the IEEE-1284 PNP String */
1000 			/* Only one printer interface is supported. */
1001 			if ((wIndex>>8) != dev->interface)
1002 				break;
1003 
1004 			if (!dev->pnp_string) {
1005 				value = 0;
1006 				break;
1007 			}
1008 			value = strlen(dev->pnp_string);
1009 			buf[0] = (value >> 8) & 0xFF;
1010 			buf[1] = value & 0xFF;
1011 			memcpy(buf + 2, dev->pnp_string, value);
1012 			DBG(dev, "1284 PNP String: %x %s\n", value,
1013 			    dev->pnp_string);
1014 			break;
1015 
1016 		case GET_PORT_STATUS: /* Get Port Status */
1017 			/* Only one printer interface is supported. */
1018 			if (wIndex != dev->interface)
1019 				break;
1020 
1021 			buf[0] = dev->printer_status;
1022 			value = min_t(u16, wLength, 1);
1023 			break;
1024 
1025 		case SOFT_RESET: /* Soft Reset */
1026 			/* Only one printer interface is supported. */
1027 			if (wIndex != dev->interface)
1028 				break;
1029 
1030 			printer_soft_reset(dev);
1031 
1032 			value = 0;
1033 			break;
1034 
1035 		default:
1036 			goto unknown;
1037 		}
1038 		break;
1039 
1040 	default:
1041 unknown:
1042 		VDBG(dev,
1043 			"unknown ctrl req%02x.%02x v%04x i%04x l%d\n",
1044 			ctrl->bRequestType, ctrl->bRequest,
1045 			wValue, wIndex, wLength);
1046 		break;
1047 	}
1048 	/* host either stalls (value < 0) or reports success */
1049 	if (value >= 0) {
1050 		req->length = value;
1051 		req->zero = value < wLength;
1052 		value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
1053 		if (value < 0) {
1054 			ERROR(dev, "%s:%d Error!\n", __func__, __LINE__);
1055 			req->status = 0;
1056 		}
1057 	}
1058 	return value;
1059 }
1060 
1061 static int printer_func_bind(struct usb_configuration *c,
1062 		struct usb_function *f)
1063 {
1064 	struct usb_gadget *gadget = c->cdev->gadget;
1065 	struct printer_dev *dev = func_to_printer(f);
1066 	struct device *pdev;
1067 	struct usb_composite_dev *cdev = c->cdev;
1068 	struct usb_ep *in_ep;
1069 	struct usb_ep *out_ep = NULL;
1070 	struct usb_request *req;
1071 	dev_t devt;
1072 	int id;
1073 	int ret;
1074 	u32 i;
1075 
1076 	id = usb_interface_id(c, f);
1077 	if (id < 0)
1078 		return id;
1079 	intf_desc.bInterfaceNumber = id;
1080 
1081 	/* finish hookup to lower layer ... */
1082 	dev->gadget = gadget;
1083 
1084 	/* all we really need is bulk IN/OUT */
1085 	in_ep = usb_ep_autoconfig(cdev->gadget, &fs_ep_in_desc);
1086 	if (!in_ep) {
1087 autoconf_fail:
1088 		dev_err(&cdev->gadget->dev, "can't autoconfigure on %s\n",
1089 			cdev->gadget->name);
1090 		return -ENODEV;
1091 	}
1092 
1093 	out_ep = usb_ep_autoconfig(cdev->gadget, &fs_ep_out_desc);
1094 	if (!out_ep)
1095 		goto autoconf_fail;
1096 
1097 	/* assumes that all endpoints are dual-speed */
1098 	hs_ep_in_desc.bEndpointAddress = fs_ep_in_desc.bEndpointAddress;
1099 	hs_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress;
1100 	ss_ep_in_desc.bEndpointAddress = fs_ep_in_desc.bEndpointAddress;
1101 	ss_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress;
1102 
1103 	ret = usb_assign_descriptors(f, fs_printer_function,
1104 			hs_printer_function, ss_printer_function, NULL);
1105 	if (ret)
1106 		return ret;
1107 
1108 	dev->in_ep = in_ep;
1109 	dev->out_ep = out_ep;
1110 
1111 	ret = -ENOMEM;
1112 	for (i = 0; i < dev->q_len; i++) {
1113 		req = printer_req_alloc(dev->in_ep, USB_BUFSIZE, GFP_KERNEL);
1114 		if (!req)
1115 			goto fail_tx_reqs;
1116 		list_add(&req->list, &dev->tx_reqs);
1117 	}
1118 
1119 	for (i = 0; i < dev->q_len; i++) {
1120 		req = printer_req_alloc(dev->out_ep, USB_BUFSIZE, GFP_KERNEL);
1121 		if (!req)
1122 			goto fail_rx_reqs;
1123 		list_add(&req->list, &dev->rx_reqs);
1124 	}
1125 
1126 	/* Setup the sysfs files for the printer gadget. */
1127 	devt = MKDEV(major, dev->minor);
1128 	pdev = device_create(usb_gadget_class, NULL, devt,
1129 				  NULL, "g_printer%d", dev->minor);
1130 	if (IS_ERR(pdev)) {
1131 		ERROR(dev, "Failed to create device: g_printer\n");
1132 		ret = PTR_ERR(pdev);
1133 		goto fail_rx_reqs;
1134 	}
1135 
1136 	/*
1137 	 * Register a character device as an interface to a user mode
1138 	 * program that handles the printer specific functionality.
1139 	 */
1140 	cdev_init(&dev->printer_cdev, &printer_io_operations);
1141 	dev->printer_cdev.owner = THIS_MODULE;
1142 	ret = cdev_add(&dev->printer_cdev, devt, 1);
1143 	if (ret) {
1144 		ERROR(dev, "Failed to open char device\n");
1145 		goto fail_cdev_add;
1146 	}
1147 
1148 	return 0;
1149 
1150 fail_cdev_add:
1151 	device_destroy(usb_gadget_class, devt);
1152 
1153 fail_rx_reqs:
1154 	while (!list_empty(&dev->rx_reqs)) {
1155 		req = container_of(dev->rx_reqs.next, struct usb_request, list);
1156 		list_del(&req->list);
1157 		printer_req_free(dev->out_ep, req);
1158 	}
1159 
1160 fail_tx_reqs:
1161 	while (!list_empty(&dev->tx_reqs)) {
1162 		req = container_of(dev->tx_reqs.next, struct usb_request, list);
1163 		list_del(&req->list);
1164 		printer_req_free(dev->in_ep, req);
1165 	}
1166 
1167 	usb_free_all_descriptors(f);
1168 	return ret;
1169 
1170 }
1171 
1172 static int printer_func_set_alt(struct usb_function *f,
1173 		unsigned intf, unsigned alt)
1174 {
1175 	struct printer_dev *dev = func_to_printer(f);
1176 	int ret = -ENOTSUPP;
1177 
1178 	if (!alt)
1179 		ret = set_interface(dev, intf);
1180 
1181 	return ret;
1182 }
1183 
1184 static void printer_func_disable(struct usb_function *f)
1185 {
1186 	struct printer_dev *dev = func_to_printer(f);
1187 
1188 	DBG(dev, "%s\n", __func__);
1189 
1190 	printer_reset_interface(dev);
1191 }
1192 
1193 static inline struct f_printer_opts
1194 *to_f_printer_opts(struct config_item *item)
1195 {
1196 	return container_of(to_config_group(item), struct f_printer_opts,
1197 			    func_inst.group);
1198 }
1199 
1200 static void printer_attr_release(struct config_item *item)
1201 {
1202 	struct f_printer_opts *opts = to_f_printer_opts(item);
1203 
1204 	usb_put_function_instance(&opts->func_inst);
1205 }
1206 
1207 static struct configfs_item_operations printer_item_ops = {
1208 	.release	= printer_attr_release,
1209 };
1210 
1211 static ssize_t f_printer_opts_pnp_string_show(struct config_item *item,
1212 					      char *page)
1213 {
1214 	struct f_printer_opts *opts = to_f_printer_opts(item);
1215 	int result = 0;
1216 
1217 	mutex_lock(&opts->lock);
1218 	if (!opts->pnp_string)
1219 		goto unlock;
1220 
1221 	result = strlcpy(page, opts->pnp_string, PAGE_SIZE);
1222 	if (result >= PAGE_SIZE) {
1223 		result = PAGE_SIZE;
1224 	} else if (page[result - 1] != '\n' && result + 1 < PAGE_SIZE) {
1225 		page[result++] = '\n';
1226 		page[result] = '\0';
1227 	}
1228 
1229 unlock:
1230 	mutex_unlock(&opts->lock);
1231 
1232 	return result;
1233 }
1234 
1235 static ssize_t f_printer_opts_pnp_string_store(struct config_item *item,
1236 					       const char *page, size_t len)
1237 {
1238 	struct f_printer_opts *opts = to_f_printer_opts(item);
1239 	char *new_pnp;
1240 	int result;
1241 
1242 	mutex_lock(&opts->lock);
1243 
1244 	new_pnp = kstrndup(page, len, GFP_KERNEL);
1245 	if (!new_pnp) {
1246 		result = -ENOMEM;
1247 		goto unlock;
1248 	}
1249 
1250 	if (opts->pnp_string_allocated)
1251 		kfree(opts->pnp_string);
1252 
1253 	opts->pnp_string_allocated = true;
1254 	opts->pnp_string = new_pnp;
1255 	result = len;
1256 unlock:
1257 	mutex_unlock(&opts->lock);
1258 
1259 	return result;
1260 }
1261 
1262 CONFIGFS_ATTR(f_printer_opts_, pnp_string);
1263 
1264 static ssize_t f_printer_opts_q_len_show(struct config_item *item,
1265 					 char *page)
1266 {
1267 	struct f_printer_opts *opts = to_f_printer_opts(item);
1268 	int result;
1269 
1270 	mutex_lock(&opts->lock);
1271 	result = sprintf(page, "%d\n", opts->q_len);
1272 	mutex_unlock(&opts->lock);
1273 
1274 	return result;
1275 }
1276 
1277 static ssize_t f_printer_opts_q_len_store(struct config_item *item,
1278 					  const char *page, size_t len)
1279 {
1280 	struct f_printer_opts *opts = to_f_printer_opts(item);
1281 	int ret;
1282 	u16 num;
1283 
1284 	mutex_lock(&opts->lock);
1285 	if (opts->refcnt) {
1286 		ret = -EBUSY;
1287 		goto end;
1288 	}
1289 
1290 	ret = kstrtou16(page, 0, &num);
1291 	if (ret)
1292 		goto end;
1293 
1294 	opts->q_len = (unsigned)num;
1295 	ret = len;
1296 end:
1297 	mutex_unlock(&opts->lock);
1298 	return ret;
1299 }
1300 
1301 CONFIGFS_ATTR(f_printer_opts_, q_len);
1302 
1303 static struct configfs_attribute *printer_attrs[] = {
1304 	&f_printer_opts_attr_pnp_string,
1305 	&f_printer_opts_attr_q_len,
1306 	NULL,
1307 };
1308 
1309 static const struct config_item_type printer_func_type = {
1310 	.ct_item_ops	= &printer_item_ops,
1311 	.ct_attrs	= printer_attrs,
1312 	.ct_owner	= THIS_MODULE,
1313 };
1314 
1315 static inline int gprinter_get_minor(void)
1316 {
1317 	int ret;
1318 
1319 	ret = ida_simple_get(&printer_ida, 0, 0, GFP_KERNEL);
1320 	if (ret >= PRINTER_MINORS) {
1321 		ida_simple_remove(&printer_ida, ret);
1322 		ret = -ENODEV;
1323 	}
1324 
1325 	return ret;
1326 }
1327 
1328 static inline void gprinter_put_minor(int minor)
1329 {
1330 	ida_simple_remove(&printer_ida, minor);
1331 }
1332 
1333 static int gprinter_setup(int);
1334 static void gprinter_cleanup(void);
1335 
1336 static void gprinter_free_inst(struct usb_function_instance *f)
1337 {
1338 	struct f_printer_opts *opts;
1339 
1340 	opts = container_of(f, struct f_printer_opts, func_inst);
1341 
1342 	mutex_lock(&printer_ida_lock);
1343 
1344 	gprinter_put_minor(opts->minor);
1345 	if (ida_is_empty(&printer_ida))
1346 		gprinter_cleanup();
1347 
1348 	mutex_unlock(&printer_ida_lock);
1349 
1350 	if (opts->pnp_string_allocated)
1351 		kfree(opts->pnp_string);
1352 	kfree(opts);
1353 }
1354 
1355 static struct usb_function_instance *gprinter_alloc_inst(void)
1356 {
1357 	struct f_printer_opts *opts;
1358 	struct usb_function_instance *ret;
1359 	int status = 0;
1360 
1361 	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
1362 	if (!opts)
1363 		return ERR_PTR(-ENOMEM);
1364 
1365 	mutex_init(&opts->lock);
1366 	opts->func_inst.free_func_inst = gprinter_free_inst;
1367 	ret = &opts->func_inst;
1368 
1369 	/* Make sure q_len is initialized, otherwise the bound device can't support read/write! */
1370 	opts->q_len = DEFAULT_Q_LEN;
1371 
1372 	mutex_lock(&printer_ida_lock);
1373 
1374 	if (ida_is_empty(&printer_ida)) {
1375 		status = gprinter_setup(PRINTER_MINORS);
1376 		if (status) {
1377 			ret = ERR_PTR(status);
1378 			kfree(opts);
1379 			goto unlock;
1380 		}
1381 	}
1382 
1383 	opts->minor = gprinter_get_minor();
1384 	if (opts->minor < 0) {
1385 		ret = ERR_PTR(opts->minor);
1386 		kfree(opts);
1387 		if (ida_is_empty(&printer_ida))
1388 			gprinter_cleanup();
1389 		goto unlock;
1390 	}
1391 	config_group_init_type_name(&opts->func_inst.group, "",
1392 				    &printer_func_type);
1393 
1394 unlock:
1395 	mutex_unlock(&printer_ida_lock);
1396 	return ret;
1397 }
1398 
1399 static void gprinter_free(struct usb_function *f)
1400 {
1401 	struct printer_dev *dev = func_to_printer(f);
1402 	struct f_printer_opts *opts;
1403 
1404 	opts = container_of(f->fi, struct f_printer_opts, func_inst);
1405 
1406 	kref_put(&dev->kref, printer_dev_free);
1407 	mutex_lock(&opts->lock);
1408 	--opts->refcnt;
1409 	mutex_unlock(&opts->lock);
1410 }
1411 
1412 static void printer_func_unbind(struct usb_configuration *c,
1413 		struct usb_function *f)
1414 {
1415 	struct printer_dev	*dev;
1416 	struct usb_request	*req;
1417 
1418 	dev = func_to_printer(f);
1419 
1420 	device_destroy(usb_gadget_class, MKDEV(major, dev->minor));
1421 
1422 	/* Remove Character Device */
1423 	cdev_del(&dev->printer_cdev);
1424 
1425 	/* we must already have been disconnected ... no i/o may be active */
1426 	WARN_ON(!list_empty(&dev->tx_reqs_active));
1427 	WARN_ON(!list_empty(&dev->rx_reqs_active));
1428 
1429 	/* Free all memory for this driver. */
1430 	while (!list_empty(&dev->tx_reqs)) {
1431 		req = container_of(dev->tx_reqs.next, struct usb_request,
1432 				list);
1433 		list_del(&req->list);
1434 		printer_req_free(dev->in_ep, req);
1435 	}
1436 
1437 	if (dev->current_rx_req != NULL)
1438 		printer_req_free(dev->out_ep, dev->current_rx_req);
1439 
1440 	while (!list_empty(&dev->rx_reqs)) {
1441 		req = container_of(dev->rx_reqs.next,
1442 				struct usb_request, list);
1443 		list_del(&req->list);
1444 		printer_req_free(dev->out_ep, req);
1445 	}
1446 
1447 	while (!list_empty(&dev->rx_buffers)) {
1448 		req = container_of(dev->rx_buffers.next,
1449 				struct usb_request, list);
1450 		list_del(&req->list);
1451 		printer_req_free(dev->out_ep, req);
1452 	}
1453 	usb_free_all_descriptors(f);
1454 }
1455 
1456 static struct usb_function *gprinter_alloc(struct usb_function_instance *fi)
1457 {
1458 	struct printer_dev	*dev;
1459 	struct f_printer_opts	*opts;
1460 
1461 	opts = container_of(fi, struct f_printer_opts, func_inst);
1462 
1463 	mutex_lock(&opts->lock);
1464 	if (opts->minor >= minors) {
1465 		mutex_unlock(&opts->lock);
1466 		return ERR_PTR(-ENOENT);
1467 	}
1468 
1469 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
1470 	if (!dev) {
1471 		mutex_unlock(&opts->lock);
1472 		return ERR_PTR(-ENOMEM);
1473 	}
1474 
1475 	kref_init(&dev->kref);
1476 	++opts->refcnt;
1477 	dev->minor = opts->minor;
1478 	dev->pnp_string = opts->pnp_string;
1479 	dev->q_len = opts->q_len;
1480 	mutex_unlock(&opts->lock);
1481 
1482 	dev->function.name = "printer";
1483 	dev->function.bind = printer_func_bind;
1484 	dev->function.setup = printer_func_setup;
1485 	dev->function.unbind = printer_func_unbind;
1486 	dev->function.set_alt = printer_func_set_alt;
1487 	dev->function.disable = printer_func_disable;
1488 	dev->function.req_match = gprinter_req_match;
1489 	dev->function.free_func = gprinter_free;
1490 
1491 	INIT_LIST_HEAD(&dev->tx_reqs);
1492 	INIT_LIST_HEAD(&dev->rx_reqs);
1493 	INIT_LIST_HEAD(&dev->rx_buffers);
1494 	INIT_LIST_HEAD(&dev->tx_reqs_active);
1495 	INIT_LIST_HEAD(&dev->rx_reqs_active);
1496 
1497 	spin_lock_init(&dev->lock);
1498 	mutex_init(&dev->lock_printer_io);
1499 	init_waitqueue_head(&dev->rx_wait);
1500 	init_waitqueue_head(&dev->tx_wait);
1501 	init_waitqueue_head(&dev->tx_flush_wait);
1502 
1503 	dev->interface = -1;
1504 	dev->printer_cdev_open = 0;
1505 	dev->printer_status = PRINTER_NOT_ERROR;
1506 	dev->current_rx_req = NULL;
1507 	dev->current_rx_bytes = 0;
1508 	dev->current_rx_buf = NULL;
1509 
1510 	return &dev->function;
1511 }
1512 
1513 DECLARE_USB_FUNCTION_INIT(printer, gprinter_alloc_inst, gprinter_alloc);
1514 MODULE_LICENSE("GPL");
1515 MODULE_AUTHOR("Craig Nadler");
1516 
1517 static int gprinter_setup(int count)
1518 {
1519 	int status;
1520 	dev_t devt;
1521 
1522 	usb_gadget_class = class_create(THIS_MODULE, "usb_printer_gadget");
1523 	if (IS_ERR(usb_gadget_class)) {
1524 		status = PTR_ERR(usb_gadget_class);
1525 		usb_gadget_class = NULL;
1526 		pr_err("unable to create usb_gadget class %d\n", status);
1527 		return status;
1528 	}
1529 
1530 	status = alloc_chrdev_region(&devt, 0, count, "USB printer gadget");
1531 	if (status) {
1532 		pr_err("alloc_chrdev_region %d\n", status);
1533 		class_destroy(usb_gadget_class);
1534 		usb_gadget_class = NULL;
1535 		return status;
1536 	}
1537 
1538 	major = MAJOR(devt);
1539 	minors = count;
1540 
1541 	return status;
1542 }
1543 
1544 static void gprinter_cleanup(void)
1545 {
1546 	if (major) {
1547 		unregister_chrdev_region(MKDEV(major, 0), minors);
1548 		major = minors = 0;
1549 	}
1550 	class_destroy(usb_gadget_class);
1551 	usb_gadget_class = NULL;
1552 }
1553