1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * f_printer.c - USB printer function driver
4  *
5  * Copied from drivers/usb/gadget/legacy/printer.c,
6  * which was:
7  *
8  * printer.c -- Printer gadget driver
9  *
10  * Copyright (C) 2003-2005 David Brownell
11  * Copyright (C) 2006 Craig W. Nadler
12  */
13 
14 #include <linux/module.h>
15 #include <linux/kernel.h>
16 #include <linux/delay.h>
17 #include <linux/ioport.h>
18 #include <linux/sched.h>
19 #include <linux/slab.h>
20 #include <linux/mutex.h>
21 #include <linux/errno.h>
22 #include <linux/init.h>
23 #include <linux/idr.h>
24 #include <linux/timer.h>
25 #include <linux/list.h>
26 #include <linux/interrupt.h>
27 #include <linux/device.h>
28 #include <linux/moduleparam.h>
29 #include <linux/fs.h>
30 #include <linux/poll.h>
31 #include <linux/types.h>
32 #include <linux/ctype.h>
33 #include <linux/cdev.h>
34 
35 #include <asm/byteorder.h>
36 #include <linux/io.h>
37 #include <linux/irq.h>
38 #include <linux/uaccess.h>
39 #include <asm/unaligned.h>
40 
41 #include <linux/usb/ch9.h>
42 #include <linux/usb/composite.h>
43 #include <linux/usb/gadget.h>
44 #include <linux/usb/g_printer.h>
45 
46 #include "u_printer.h"
47 
48 #define PRINTER_MINORS		4
49 #define GET_DEVICE_ID		0
50 #define GET_PORT_STATUS		1
51 #define SOFT_RESET		2
52 
53 static int major, minors;
54 static struct class *usb_gadget_class;
55 static DEFINE_IDA(printer_ida);
56 static DEFINE_MUTEX(printer_ida_lock); /* protects access do printer_ida */
57 
58 /*-------------------------------------------------------------------------*/
59 
60 struct printer_dev {
61 	spinlock_t		lock;		/* lock this structure */
62 	/* lock buffer lists during read/write calls */
63 	struct mutex		lock_printer_io;
64 	struct usb_gadget	*gadget;
65 	s8			interface;
66 	struct usb_ep		*in_ep, *out_ep;
67 
68 	struct list_head	rx_reqs;	/* List of free RX structs */
69 	struct list_head	rx_reqs_active;	/* List of Active RX xfers */
70 	struct list_head	rx_buffers;	/* List of completed xfers */
71 	/* wait until there is data to be read. */
72 	wait_queue_head_t	rx_wait;
73 	struct list_head	tx_reqs;	/* List of free TX structs */
74 	struct list_head	tx_reqs_active; /* List of Active TX xfers */
75 	/* Wait until there are write buffers available to use. */
76 	wait_queue_head_t	tx_wait;
77 	/* Wait until all write buffers have been sent. */
78 	wait_queue_head_t	tx_flush_wait;
79 	struct usb_request	*current_rx_req;
80 	size_t			current_rx_bytes;
81 	u8			*current_rx_buf;
82 	u8			printer_status;
83 	u8			reset_printer;
84 	int			minor;
85 	struct cdev		printer_cdev;
86 	u8			printer_cdev_open;
87 	wait_queue_head_t	wait;
88 	unsigned		q_len;
89 	char			*pnp_string;	/* We don't own memory! */
90 	struct usb_function	function;
91 };
92 
93 static inline struct printer_dev *func_to_printer(struct usb_function *f)
94 {
95 	return container_of(f, struct printer_dev, function);
96 }
97 
98 /*-------------------------------------------------------------------------*/
99 
100 /*
101  * DESCRIPTORS ... most are static, but strings and (full) configuration
102  * descriptors are built on demand.
103  */
104 
105 /* holds our biggest descriptor */
106 #define USB_DESC_BUFSIZE		256
107 #define USB_BUFSIZE			8192
108 
109 static struct usb_interface_descriptor intf_desc = {
110 	.bLength =		sizeof(intf_desc),
111 	.bDescriptorType =	USB_DT_INTERFACE,
112 	.bNumEndpoints =	2,
113 	.bInterfaceClass =	USB_CLASS_PRINTER,
114 	.bInterfaceSubClass =	1,	/* Printer Sub-Class */
115 	.bInterfaceProtocol =	2,	/* Bi-Directional */
116 	.iInterface =		0
117 };
118 
119 static struct usb_endpoint_descriptor fs_ep_in_desc = {
120 	.bLength =		USB_DT_ENDPOINT_SIZE,
121 	.bDescriptorType =	USB_DT_ENDPOINT,
122 	.bEndpointAddress =	USB_DIR_IN,
123 	.bmAttributes =		USB_ENDPOINT_XFER_BULK
124 };
125 
126 static struct usb_endpoint_descriptor fs_ep_out_desc = {
127 	.bLength =		USB_DT_ENDPOINT_SIZE,
128 	.bDescriptorType =	USB_DT_ENDPOINT,
129 	.bEndpointAddress =	USB_DIR_OUT,
130 	.bmAttributes =		USB_ENDPOINT_XFER_BULK
131 };
132 
133 static struct usb_descriptor_header *fs_printer_function[] = {
134 	(struct usb_descriptor_header *) &intf_desc,
135 	(struct usb_descriptor_header *) &fs_ep_in_desc,
136 	(struct usb_descriptor_header *) &fs_ep_out_desc,
137 	NULL
138 };
139 
140 /*
141  * usb 2.0 devices need to expose both high speed and full speed
142  * descriptors, unless they only run at full speed.
143  */
144 
145 static struct usb_endpoint_descriptor hs_ep_in_desc = {
146 	.bLength =		USB_DT_ENDPOINT_SIZE,
147 	.bDescriptorType =	USB_DT_ENDPOINT,
148 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
149 	.wMaxPacketSize =	cpu_to_le16(512)
150 };
151 
152 static struct usb_endpoint_descriptor hs_ep_out_desc = {
153 	.bLength =		USB_DT_ENDPOINT_SIZE,
154 	.bDescriptorType =	USB_DT_ENDPOINT,
155 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
156 	.wMaxPacketSize =	cpu_to_le16(512)
157 };
158 
159 static struct usb_descriptor_header *hs_printer_function[] = {
160 	(struct usb_descriptor_header *) &intf_desc,
161 	(struct usb_descriptor_header *) &hs_ep_in_desc,
162 	(struct usb_descriptor_header *) &hs_ep_out_desc,
163 	NULL
164 };
165 
166 /*
167  * Added endpoint descriptors for 3.0 devices
168  */
169 
170 static struct usb_endpoint_descriptor ss_ep_in_desc = {
171 	.bLength =              USB_DT_ENDPOINT_SIZE,
172 	.bDescriptorType =      USB_DT_ENDPOINT,
173 	.bmAttributes =         USB_ENDPOINT_XFER_BULK,
174 	.wMaxPacketSize =       cpu_to_le16(1024),
175 };
176 
177 static struct usb_ss_ep_comp_descriptor ss_ep_in_comp_desc = {
178 	.bLength =              sizeof(ss_ep_in_comp_desc),
179 	.bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
180 };
181 
182 static struct usb_endpoint_descriptor ss_ep_out_desc = {
183 	.bLength =              USB_DT_ENDPOINT_SIZE,
184 	.bDescriptorType =      USB_DT_ENDPOINT,
185 	.bmAttributes =         USB_ENDPOINT_XFER_BULK,
186 	.wMaxPacketSize =       cpu_to_le16(1024),
187 };
188 
189 static struct usb_ss_ep_comp_descriptor ss_ep_out_comp_desc = {
190 	.bLength =              sizeof(ss_ep_out_comp_desc),
191 	.bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
192 };
193 
194 static struct usb_descriptor_header *ss_printer_function[] = {
195 	(struct usb_descriptor_header *) &intf_desc,
196 	(struct usb_descriptor_header *) &ss_ep_in_desc,
197 	(struct usb_descriptor_header *) &ss_ep_in_comp_desc,
198 	(struct usb_descriptor_header *) &ss_ep_out_desc,
199 	(struct usb_descriptor_header *) &ss_ep_out_comp_desc,
200 	NULL
201 };
202 
203 /* maxpacket and other transfer characteristics vary by speed. */
204 static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget,
205 					struct usb_endpoint_descriptor *fs,
206 					struct usb_endpoint_descriptor *hs,
207 					struct usb_endpoint_descriptor *ss)
208 {
209 	switch (gadget->speed) {
210 	case USB_SPEED_SUPER:
211 		return ss;
212 	case USB_SPEED_HIGH:
213 		return hs;
214 	default:
215 		return fs;
216 	}
217 }
218 
219 /*-------------------------------------------------------------------------*/
220 
221 static struct usb_request *
222 printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags)
223 {
224 	struct usb_request	*req;
225 
226 	req = usb_ep_alloc_request(ep, gfp_flags);
227 
228 	if (req != NULL) {
229 		req->length = len;
230 		req->buf = kmalloc(len, gfp_flags);
231 		if (req->buf == NULL) {
232 			usb_ep_free_request(ep, req);
233 			return NULL;
234 		}
235 	}
236 
237 	return req;
238 }
239 
240 static void
241 printer_req_free(struct usb_ep *ep, struct usb_request *req)
242 {
243 	if (ep != NULL && req != NULL) {
244 		kfree(req->buf);
245 		usb_ep_free_request(ep, req);
246 	}
247 }
248 
249 /*-------------------------------------------------------------------------*/
250 
251 static void rx_complete(struct usb_ep *ep, struct usb_request *req)
252 {
253 	struct printer_dev	*dev = ep->driver_data;
254 	int			status = req->status;
255 	unsigned long		flags;
256 
257 	spin_lock_irqsave(&dev->lock, flags);
258 
259 	list_del_init(&req->list);	/* Remode from Active List */
260 
261 	switch (status) {
262 
263 	/* normal completion */
264 	case 0:
265 		if (req->actual > 0) {
266 			list_add_tail(&req->list, &dev->rx_buffers);
267 			DBG(dev, "G_Printer : rx length %d\n", req->actual);
268 		} else {
269 			list_add(&req->list, &dev->rx_reqs);
270 		}
271 		break;
272 
273 	/* software-driven interface shutdown */
274 	case -ECONNRESET:		/* unlink */
275 	case -ESHUTDOWN:		/* disconnect etc */
276 		VDBG(dev, "rx shutdown, code %d\n", status);
277 		list_add(&req->list, &dev->rx_reqs);
278 		break;
279 
280 	/* for hardware automagic (such as pxa) */
281 	case -ECONNABORTED:		/* endpoint reset */
282 		DBG(dev, "rx %s reset\n", ep->name);
283 		list_add(&req->list, &dev->rx_reqs);
284 		break;
285 
286 	/* data overrun */
287 	case -EOVERFLOW:
288 		fallthrough;
289 
290 	default:
291 		DBG(dev, "rx status %d\n", status);
292 		list_add(&req->list, &dev->rx_reqs);
293 		break;
294 	}
295 
296 	wake_up_interruptible(&dev->rx_wait);
297 	spin_unlock_irqrestore(&dev->lock, flags);
298 }
299 
300 static void tx_complete(struct usb_ep *ep, struct usb_request *req)
301 {
302 	struct printer_dev	*dev = ep->driver_data;
303 
304 	switch (req->status) {
305 	default:
306 		VDBG(dev, "tx err %d\n", req->status);
307 		fallthrough;
308 	case -ECONNRESET:		/* unlink */
309 	case -ESHUTDOWN:		/* disconnect etc */
310 		break;
311 	case 0:
312 		break;
313 	}
314 
315 	spin_lock(&dev->lock);
316 	/* Take the request struct off the active list and put it on the
317 	 * free list.
318 	 */
319 	list_del_init(&req->list);
320 	list_add(&req->list, &dev->tx_reqs);
321 	wake_up_interruptible(&dev->tx_wait);
322 	if (likely(list_empty(&dev->tx_reqs_active)))
323 		wake_up_interruptible(&dev->tx_flush_wait);
324 
325 	spin_unlock(&dev->lock);
326 }
327 
328 /*-------------------------------------------------------------------------*/
329 
330 static int
331 printer_open(struct inode *inode, struct file *fd)
332 {
333 	struct printer_dev	*dev;
334 	unsigned long		flags;
335 	int			ret = -EBUSY;
336 
337 	dev = container_of(inode->i_cdev, struct printer_dev, printer_cdev);
338 
339 	spin_lock_irqsave(&dev->lock, flags);
340 
341 	if (dev->interface < 0) {
342 		spin_unlock_irqrestore(&dev->lock, flags);
343 		return -ENODEV;
344 	}
345 
346 	if (!dev->printer_cdev_open) {
347 		dev->printer_cdev_open = 1;
348 		fd->private_data = dev;
349 		ret = 0;
350 		/* Change the printer status to show that it's on-line. */
351 		dev->printer_status |= PRINTER_SELECTED;
352 	}
353 
354 	spin_unlock_irqrestore(&dev->lock, flags);
355 
356 	DBG(dev, "printer_open returned %x\n", ret);
357 	return ret;
358 }
359 
360 static int
361 printer_close(struct inode *inode, struct file *fd)
362 {
363 	struct printer_dev	*dev = fd->private_data;
364 	unsigned long		flags;
365 
366 	spin_lock_irqsave(&dev->lock, flags);
367 	dev->printer_cdev_open = 0;
368 	fd->private_data = NULL;
369 	/* Change printer status to show that the printer is off-line. */
370 	dev->printer_status &= ~PRINTER_SELECTED;
371 	spin_unlock_irqrestore(&dev->lock, flags);
372 
373 	DBG(dev, "printer_close\n");
374 
375 	return 0;
376 }
377 
378 /* This function must be called with interrupts turned off. */
379 static void
380 setup_rx_reqs(struct printer_dev *dev)
381 {
382 	struct usb_request              *req;
383 
384 	while (likely(!list_empty(&dev->rx_reqs))) {
385 		int error;
386 
387 		req = container_of(dev->rx_reqs.next,
388 				struct usb_request, list);
389 		list_del_init(&req->list);
390 
391 		/* The USB Host sends us whatever amount of data it wants to
392 		 * so we always set the length field to the full USB_BUFSIZE.
393 		 * If the amount of data is more than the read() caller asked
394 		 * for it will be stored in the request buffer until it is
395 		 * asked for by read().
396 		 */
397 		req->length = USB_BUFSIZE;
398 		req->complete = rx_complete;
399 
400 		/* here, we unlock, and only unlock, to avoid deadlock. */
401 		spin_unlock(&dev->lock);
402 		error = usb_ep_queue(dev->out_ep, req, GFP_ATOMIC);
403 		spin_lock(&dev->lock);
404 		if (error) {
405 			DBG(dev, "rx submit --> %d\n", error);
406 			list_add(&req->list, &dev->rx_reqs);
407 			break;
408 		}
409 		/* if the req is empty, then add it into dev->rx_reqs_active. */
410 		else if (list_empty(&req->list))
411 			list_add(&req->list, &dev->rx_reqs_active);
412 	}
413 }
414 
415 static ssize_t
416 printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
417 {
418 	struct printer_dev		*dev = fd->private_data;
419 	unsigned long			flags;
420 	size_t				size;
421 	size_t				bytes_copied;
422 	struct usb_request		*req;
423 	/* This is a pointer to the current USB rx request. */
424 	struct usb_request		*current_rx_req;
425 	/* This is the number of bytes in the current rx buffer. */
426 	size_t				current_rx_bytes;
427 	/* This is a pointer to the current rx buffer. */
428 	u8				*current_rx_buf;
429 
430 	if (len == 0)
431 		return -EINVAL;
432 
433 	DBG(dev, "printer_read trying to read %d bytes\n", (int)len);
434 
435 	mutex_lock(&dev->lock_printer_io);
436 	spin_lock_irqsave(&dev->lock, flags);
437 
438 	if (dev->interface < 0) {
439 		spin_unlock_irqrestore(&dev->lock, flags);
440 		mutex_unlock(&dev->lock_printer_io);
441 		return -ENODEV;
442 	}
443 
444 	/* We will use this flag later to check if a printer reset happened
445 	 * after we turn interrupts back on.
446 	 */
447 	dev->reset_printer = 0;
448 
449 	setup_rx_reqs(dev);
450 
451 	bytes_copied = 0;
452 	current_rx_req = dev->current_rx_req;
453 	current_rx_bytes = dev->current_rx_bytes;
454 	current_rx_buf = dev->current_rx_buf;
455 	dev->current_rx_req = NULL;
456 	dev->current_rx_bytes = 0;
457 	dev->current_rx_buf = NULL;
458 
459 	/* Check if there is any data in the read buffers. Please note that
460 	 * current_rx_bytes is the number of bytes in the current rx buffer.
461 	 * If it is zero then check if there are any other rx_buffers that
462 	 * are on the completed list. We are only out of data if all rx
463 	 * buffers are empty.
464 	 */
465 	if ((current_rx_bytes == 0) &&
466 			(likely(list_empty(&dev->rx_buffers)))) {
467 		/* Turn interrupts back on before sleeping. */
468 		spin_unlock_irqrestore(&dev->lock, flags);
469 
470 		/*
471 		 * If no data is available check if this is a NON-Blocking
472 		 * call or not.
473 		 */
474 		if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
475 			mutex_unlock(&dev->lock_printer_io);
476 			return -EAGAIN;
477 		}
478 
479 		/* Sleep until data is available */
480 		wait_event_interruptible(dev->rx_wait,
481 				(likely(!list_empty(&dev->rx_buffers))));
482 		spin_lock_irqsave(&dev->lock, flags);
483 	}
484 
485 	/* We have data to return then copy it to the caller's buffer.*/
486 	while ((current_rx_bytes || likely(!list_empty(&dev->rx_buffers)))
487 			&& len) {
488 		if (current_rx_bytes == 0) {
489 			req = container_of(dev->rx_buffers.next,
490 					struct usb_request, list);
491 			list_del_init(&req->list);
492 
493 			if (req->actual && req->buf) {
494 				current_rx_req = req;
495 				current_rx_bytes = req->actual;
496 				current_rx_buf = req->buf;
497 			} else {
498 				list_add(&req->list, &dev->rx_reqs);
499 				continue;
500 			}
501 		}
502 
503 		/* Don't leave irqs off while doing memory copies */
504 		spin_unlock_irqrestore(&dev->lock, flags);
505 
506 		if (len > current_rx_bytes)
507 			size = current_rx_bytes;
508 		else
509 			size = len;
510 
511 		size -= copy_to_user(buf, current_rx_buf, size);
512 		bytes_copied += size;
513 		len -= size;
514 		buf += size;
515 
516 		spin_lock_irqsave(&dev->lock, flags);
517 
518 		/* We've disconnected or reset so return. */
519 		if (dev->reset_printer) {
520 			list_add(&current_rx_req->list, &dev->rx_reqs);
521 			spin_unlock_irqrestore(&dev->lock, flags);
522 			mutex_unlock(&dev->lock_printer_io);
523 			return -EAGAIN;
524 		}
525 
526 		/* If we not returning all the data left in this RX request
527 		 * buffer then adjust the amount of data left in the buffer.
528 		 * Othewise if we are done with this RX request buffer then
529 		 * requeue it to get any incoming data from the USB host.
530 		 */
531 		if (size < current_rx_bytes) {
532 			current_rx_bytes -= size;
533 			current_rx_buf += size;
534 		} else {
535 			list_add(&current_rx_req->list, &dev->rx_reqs);
536 			current_rx_bytes = 0;
537 			current_rx_buf = NULL;
538 			current_rx_req = NULL;
539 		}
540 	}
541 
542 	dev->current_rx_req = current_rx_req;
543 	dev->current_rx_bytes = current_rx_bytes;
544 	dev->current_rx_buf = current_rx_buf;
545 
546 	spin_unlock_irqrestore(&dev->lock, flags);
547 	mutex_unlock(&dev->lock_printer_io);
548 
549 	DBG(dev, "printer_read returned %d bytes\n", (int)bytes_copied);
550 
551 	if (bytes_copied)
552 		return bytes_copied;
553 	else
554 		return -EAGAIN;
555 }
556 
557 static ssize_t
558 printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
559 {
560 	struct printer_dev	*dev = fd->private_data;
561 	unsigned long		flags;
562 	size_t			size;	/* Amount of data in a TX request. */
563 	size_t			bytes_copied = 0;
564 	struct usb_request	*req;
565 	int			value;
566 
567 	DBG(dev, "printer_write trying to send %d bytes\n", (int)len);
568 
569 	if (len == 0)
570 		return -EINVAL;
571 
572 	mutex_lock(&dev->lock_printer_io);
573 	spin_lock_irqsave(&dev->lock, flags);
574 
575 	if (dev->interface < 0) {
576 		spin_unlock_irqrestore(&dev->lock, flags);
577 		mutex_unlock(&dev->lock_printer_io);
578 		return -ENODEV;
579 	}
580 
581 	/* Check if a printer reset happens while we have interrupts on */
582 	dev->reset_printer = 0;
583 
584 	/* Check if there is any available write buffers */
585 	if (likely(list_empty(&dev->tx_reqs))) {
586 		/* Turn interrupts back on before sleeping. */
587 		spin_unlock_irqrestore(&dev->lock, flags);
588 
589 		/*
590 		 * If write buffers are available check if this is
591 		 * a NON-Blocking call or not.
592 		 */
593 		if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
594 			mutex_unlock(&dev->lock_printer_io);
595 			return -EAGAIN;
596 		}
597 
598 		/* Sleep until a write buffer is available */
599 		wait_event_interruptible(dev->tx_wait,
600 				(likely(!list_empty(&dev->tx_reqs))));
601 		spin_lock_irqsave(&dev->lock, flags);
602 	}
603 
604 	while (likely(!list_empty(&dev->tx_reqs)) && len) {
605 
606 		if (len > USB_BUFSIZE)
607 			size = USB_BUFSIZE;
608 		else
609 			size = len;
610 
611 		req = container_of(dev->tx_reqs.next, struct usb_request,
612 				list);
613 		list_del_init(&req->list);
614 
615 		req->complete = tx_complete;
616 		req->length = size;
617 
618 		/* Check if we need to send a zero length packet. */
619 		if (len > size)
620 			/* They will be more TX requests so no yet. */
621 			req->zero = 0;
622 		else
623 			/* If the data amount is not a multiple of the
624 			 * maxpacket size then send a zero length packet.
625 			 */
626 			req->zero = ((len % dev->in_ep->maxpacket) == 0);
627 
628 		/* Don't leave irqs off while doing memory copies */
629 		spin_unlock_irqrestore(&dev->lock, flags);
630 
631 		if (copy_from_user(req->buf, buf, size)) {
632 			list_add(&req->list, &dev->tx_reqs);
633 			mutex_unlock(&dev->lock_printer_io);
634 			return bytes_copied;
635 		}
636 
637 		bytes_copied += size;
638 		len -= size;
639 		buf += size;
640 
641 		spin_lock_irqsave(&dev->lock, flags);
642 
643 		/* We've disconnected or reset so free the req and buffer */
644 		if (dev->reset_printer) {
645 			list_add(&req->list, &dev->tx_reqs);
646 			spin_unlock_irqrestore(&dev->lock, flags);
647 			mutex_unlock(&dev->lock_printer_io);
648 			return -EAGAIN;
649 		}
650 
651 		list_add(&req->list, &dev->tx_reqs_active);
652 
653 		/* here, we unlock, and only unlock, to avoid deadlock. */
654 		spin_unlock(&dev->lock);
655 		value = usb_ep_queue(dev->in_ep, req, GFP_ATOMIC);
656 		spin_lock(&dev->lock);
657 		if (value) {
658 			list_del(&req->list);
659 			list_add(&req->list, &dev->tx_reqs);
660 			spin_unlock_irqrestore(&dev->lock, flags);
661 			mutex_unlock(&dev->lock_printer_io);
662 			return -EAGAIN;
663 		}
664 	}
665 
666 	spin_unlock_irqrestore(&dev->lock, flags);
667 	mutex_unlock(&dev->lock_printer_io);
668 
669 	DBG(dev, "printer_write sent %d bytes\n", (int)bytes_copied);
670 
671 	if (bytes_copied)
672 		return bytes_copied;
673 	else
674 		return -EAGAIN;
675 }
676 
677 static int
678 printer_fsync(struct file *fd, loff_t start, loff_t end, int datasync)
679 {
680 	struct printer_dev	*dev = fd->private_data;
681 	struct inode *inode = file_inode(fd);
682 	unsigned long		flags;
683 	int			tx_list_empty;
684 
685 	inode_lock(inode);
686 	spin_lock_irqsave(&dev->lock, flags);
687 
688 	if (dev->interface < 0) {
689 		spin_unlock_irqrestore(&dev->lock, flags);
690 		inode_unlock(inode);
691 		return -ENODEV;
692 	}
693 
694 	tx_list_empty = (likely(list_empty(&dev->tx_reqs)));
695 	spin_unlock_irqrestore(&dev->lock, flags);
696 
697 	if (!tx_list_empty) {
698 		/* Sleep until all data has been sent */
699 		wait_event_interruptible(dev->tx_flush_wait,
700 				(likely(list_empty(&dev->tx_reqs_active))));
701 	}
702 	inode_unlock(inode);
703 
704 	return 0;
705 }
706 
707 static __poll_t
708 printer_poll(struct file *fd, poll_table *wait)
709 {
710 	struct printer_dev	*dev = fd->private_data;
711 	unsigned long		flags;
712 	__poll_t		status = 0;
713 
714 	mutex_lock(&dev->lock_printer_io);
715 	spin_lock_irqsave(&dev->lock, flags);
716 
717 	if (dev->interface < 0) {
718 		spin_unlock_irqrestore(&dev->lock, flags);
719 		mutex_unlock(&dev->lock_printer_io);
720 		return EPOLLERR | EPOLLHUP;
721 	}
722 
723 	setup_rx_reqs(dev);
724 	spin_unlock_irqrestore(&dev->lock, flags);
725 	mutex_unlock(&dev->lock_printer_io);
726 
727 	poll_wait(fd, &dev->rx_wait, wait);
728 	poll_wait(fd, &dev->tx_wait, wait);
729 
730 	spin_lock_irqsave(&dev->lock, flags);
731 	if (likely(!list_empty(&dev->tx_reqs)))
732 		status |= EPOLLOUT | EPOLLWRNORM;
733 
734 	if (likely(dev->current_rx_bytes) ||
735 			likely(!list_empty(&dev->rx_buffers)))
736 		status |= EPOLLIN | EPOLLRDNORM;
737 
738 	spin_unlock_irqrestore(&dev->lock, flags);
739 
740 	return status;
741 }
742 
743 static long
744 printer_ioctl(struct file *fd, unsigned int code, unsigned long arg)
745 {
746 	struct printer_dev	*dev = fd->private_data;
747 	unsigned long		flags;
748 	int			status = 0;
749 
750 	DBG(dev, "printer_ioctl: cmd=0x%4.4x, arg=%lu\n", code, arg);
751 
752 	/* handle ioctls */
753 
754 	spin_lock_irqsave(&dev->lock, flags);
755 
756 	if (dev->interface < 0) {
757 		spin_unlock_irqrestore(&dev->lock, flags);
758 		return -ENODEV;
759 	}
760 
761 	switch (code) {
762 	case GADGET_GET_PRINTER_STATUS:
763 		status = (int)dev->printer_status;
764 		break;
765 	case GADGET_SET_PRINTER_STATUS:
766 		dev->printer_status = (u8)arg;
767 		break;
768 	default:
769 		/* could not handle ioctl */
770 		DBG(dev, "printer_ioctl: ERROR cmd=0x%4.4xis not supported\n",
771 				code);
772 		status = -ENOTTY;
773 	}
774 
775 	spin_unlock_irqrestore(&dev->lock, flags);
776 
777 	return status;
778 }
779 
780 /* used after endpoint configuration */
781 static const struct file_operations printer_io_operations = {
782 	.owner =	THIS_MODULE,
783 	.open =		printer_open,
784 	.read =		printer_read,
785 	.write =	printer_write,
786 	.fsync =	printer_fsync,
787 	.poll =		printer_poll,
788 	.unlocked_ioctl = printer_ioctl,
789 	.release =	printer_close,
790 	.llseek =	noop_llseek,
791 };
792 
793 /*-------------------------------------------------------------------------*/
794 
795 static int
796 set_printer_interface(struct printer_dev *dev)
797 {
798 	int			result = 0;
799 
800 	dev->in_ep->desc = ep_desc(dev->gadget, &fs_ep_in_desc, &hs_ep_in_desc,
801 				&ss_ep_in_desc);
802 	dev->in_ep->driver_data = dev;
803 
804 	dev->out_ep->desc = ep_desc(dev->gadget, &fs_ep_out_desc,
805 				    &hs_ep_out_desc, &ss_ep_out_desc);
806 	dev->out_ep->driver_data = dev;
807 
808 	result = usb_ep_enable(dev->in_ep);
809 	if (result != 0) {
810 		DBG(dev, "enable %s --> %d\n", dev->in_ep->name, result);
811 		goto done;
812 	}
813 
814 	result = usb_ep_enable(dev->out_ep);
815 	if (result != 0) {
816 		DBG(dev, "enable %s --> %d\n", dev->in_ep->name, result);
817 		goto done;
818 	}
819 
820 done:
821 	/* on error, disable any endpoints  */
822 	if (result != 0) {
823 		(void) usb_ep_disable(dev->in_ep);
824 		(void) usb_ep_disable(dev->out_ep);
825 		dev->in_ep->desc = NULL;
826 		dev->out_ep->desc = NULL;
827 	}
828 
829 	/* caller is responsible for cleanup on error */
830 	return result;
831 }
832 
833 static void printer_reset_interface(struct printer_dev *dev)
834 {
835 	unsigned long	flags;
836 
837 	if (dev->interface < 0)
838 		return;
839 
840 	DBG(dev, "%s\n", __func__);
841 
842 	if (dev->in_ep->desc)
843 		usb_ep_disable(dev->in_ep);
844 
845 	if (dev->out_ep->desc)
846 		usb_ep_disable(dev->out_ep);
847 
848 	spin_lock_irqsave(&dev->lock, flags);
849 	dev->in_ep->desc = NULL;
850 	dev->out_ep->desc = NULL;
851 	dev->interface = -1;
852 	spin_unlock_irqrestore(&dev->lock, flags);
853 }
854 
855 /* Change our operational Interface. */
856 static int set_interface(struct printer_dev *dev, unsigned number)
857 {
858 	int			result = 0;
859 
860 	/* Free the current interface */
861 	printer_reset_interface(dev);
862 
863 	result = set_printer_interface(dev);
864 	if (result)
865 		printer_reset_interface(dev);
866 	else
867 		dev->interface = number;
868 
869 	if (!result)
870 		INFO(dev, "Using interface %x\n", number);
871 
872 	return result;
873 }
874 
875 static void printer_soft_reset(struct printer_dev *dev)
876 {
877 	struct usb_request	*req;
878 
879 	INFO(dev, "Received Printer Reset Request\n");
880 
881 	if (usb_ep_disable(dev->in_ep))
882 		DBG(dev, "Failed to disable USB in_ep\n");
883 	if (usb_ep_disable(dev->out_ep))
884 		DBG(dev, "Failed to disable USB out_ep\n");
885 
886 	if (dev->current_rx_req != NULL) {
887 		list_add(&dev->current_rx_req->list, &dev->rx_reqs);
888 		dev->current_rx_req = NULL;
889 	}
890 	dev->current_rx_bytes = 0;
891 	dev->current_rx_buf = NULL;
892 	dev->reset_printer = 1;
893 
894 	while (likely(!(list_empty(&dev->rx_buffers)))) {
895 		req = container_of(dev->rx_buffers.next, struct usb_request,
896 				list);
897 		list_del_init(&req->list);
898 		list_add(&req->list, &dev->rx_reqs);
899 	}
900 
901 	while (likely(!(list_empty(&dev->rx_reqs_active)))) {
902 		req = container_of(dev->rx_buffers.next, struct usb_request,
903 				list);
904 		list_del_init(&req->list);
905 		list_add(&req->list, &dev->rx_reqs);
906 	}
907 
908 	while (likely(!(list_empty(&dev->tx_reqs_active)))) {
909 		req = container_of(dev->tx_reqs_active.next,
910 				struct usb_request, list);
911 		list_del_init(&req->list);
912 		list_add(&req->list, &dev->tx_reqs);
913 	}
914 
915 	if (usb_ep_enable(dev->in_ep))
916 		DBG(dev, "Failed to enable USB in_ep\n");
917 	if (usb_ep_enable(dev->out_ep))
918 		DBG(dev, "Failed to enable USB out_ep\n");
919 
920 	wake_up_interruptible(&dev->rx_wait);
921 	wake_up_interruptible(&dev->tx_wait);
922 	wake_up_interruptible(&dev->tx_flush_wait);
923 }
924 
925 /*-------------------------------------------------------------------------*/
926 
927 static bool gprinter_req_match(struct usb_function *f,
928 			       const struct usb_ctrlrequest *ctrl,
929 			       bool config0)
930 {
931 	struct printer_dev	*dev = func_to_printer(f);
932 	u16			w_index = le16_to_cpu(ctrl->wIndex);
933 	u16			w_value = le16_to_cpu(ctrl->wValue);
934 	u16			w_length = le16_to_cpu(ctrl->wLength);
935 
936 	if (config0)
937 		return false;
938 
939 	if ((ctrl->bRequestType & USB_RECIP_MASK) != USB_RECIP_INTERFACE ||
940 	    (ctrl->bRequestType & USB_TYPE_MASK) != USB_TYPE_CLASS)
941 		return false;
942 
943 	switch (ctrl->bRequest) {
944 	case GET_DEVICE_ID:
945 		w_index >>= 8;
946 		if (USB_DIR_IN & ctrl->bRequestType)
947 			break;
948 		return false;
949 	case GET_PORT_STATUS:
950 		if (!w_value && w_length == 1 &&
951 		    (USB_DIR_IN & ctrl->bRequestType))
952 			break;
953 		return false;
954 	case SOFT_RESET:
955 		if (!w_value && !w_length &&
956 		   !(USB_DIR_IN & ctrl->bRequestType))
957 			break;
958 		fallthrough;
959 	default:
960 		return false;
961 	}
962 	return w_index == dev->interface;
963 }
964 
965 /*
966  * The setup() callback implements all the ep0 functionality that's not
967  * handled lower down.
968  */
969 static int printer_func_setup(struct usb_function *f,
970 		const struct usb_ctrlrequest *ctrl)
971 {
972 	struct printer_dev *dev = func_to_printer(f);
973 	struct usb_composite_dev *cdev = f->config->cdev;
974 	struct usb_request	*req = cdev->req;
975 	u8			*buf = req->buf;
976 	int			value = -EOPNOTSUPP;
977 	u16			wIndex = le16_to_cpu(ctrl->wIndex);
978 	u16			wValue = le16_to_cpu(ctrl->wValue);
979 	u16			wLength = le16_to_cpu(ctrl->wLength);
980 
981 	DBG(dev, "ctrl req%02x.%02x v%04x i%04x l%d\n",
982 		ctrl->bRequestType, ctrl->bRequest, wValue, wIndex, wLength);
983 
984 	switch (ctrl->bRequestType&USB_TYPE_MASK) {
985 	case USB_TYPE_CLASS:
986 		switch (ctrl->bRequest) {
987 		case GET_DEVICE_ID: /* Get the IEEE-1284 PNP String */
988 			/* Only one printer interface is supported. */
989 			if ((wIndex>>8) != dev->interface)
990 				break;
991 
992 			if (!dev->pnp_string) {
993 				value = 0;
994 				break;
995 			}
996 			value = strlen(dev->pnp_string);
997 			buf[0] = (value >> 8) & 0xFF;
998 			buf[1] = value & 0xFF;
999 			memcpy(buf + 2, dev->pnp_string, value);
1000 			DBG(dev, "1284 PNP String: %x %s\n", value,
1001 			    dev->pnp_string);
1002 			break;
1003 
1004 		case GET_PORT_STATUS: /* Get Port Status */
1005 			/* Only one printer interface is supported. */
1006 			if (wIndex != dev->interface)
1007 				break;
1008 
1009 			buf[0] = dev->printer_status;
1010 			value = min_t(u16, wLength, 1);
1011 			break;
1012 
1013 		case SOFT_RESET: /* Soft Reset */
1014 			/* Only one printer interface is supported. */
1015 			if (wIndex != dev->interface)
1016 				break;
1017 
1018 			printer_soft_reset(dev);
1019 
1020 			value = 0;
1021 			break;
1022 
1023 		default:
1024 			goto unknown;
1025 		}
1026 		break;
1027 
1028 	default:
1029 unknown:
1030 		VDBG(dev,
1031 			"unknown ctrl req%02x.%02x v%04x i%04x l%d\n",
1032 			ctrl->bRequestType, ctrl->bRequest,
1033 			wValue, wIndex, wLength);
1034 		break;
1035 	}
1036 	/* host either stalls (value < 0) or reports success */
1037 	if (value >= 0) {
1038 		req->length = value;
1039 		req->zero = value < wLength;
1040 		value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
1041 		if (value < 0) {
1042 			ERROR(dev, "%s:%d Error!\n", __func__, __LINE__);
1043 			req->status = 0;
1044 		}
1045 	}
1046 	return value;
1047 }
1048 
1049 static int printer_func_bind(struct usb_configuration *c,
1050 		struct usb_function *f)
1051 {
1052 	struct usb_gadget *gadget = c->cdev->gadget;
1053 	struct printer_dev *dev = func_to_printer(f);
1054 	struct device *pdev;
1055 	struct usb_composite_dev *cdev = c->cdev;
1056 	struct usb_ep *in_ep;
1057 	struct usb_ep *out_ep = NULL;
1058 	struct usb_request *req;
1059 	dev_t devt;
1060 	int id;
1061 	int ret;
1062 	u32 i;
1063 
1064 	id = usb_interface_id(c, f);
1065 	if (id < 0)
1066 		return id;
1067 	intf_desc.bInterfaceNumber = id;
1068 
1069 	/* finish hookup to lower layer ... */
1070 	dev->gadget = gadget;
1071 
1072 	/* all we really need is bulk IN/OUT */
1073 	in_ep = usb_ep_autoconfig(cdev->gadget, &fs_ep_in_desc);
1074 	if (!in_ep) {
1075 autoconf_fail:
1076 		dev_err(&cdev->gadget->dev, "can't autoconfigure on %s\n",
1077 			cdev->gadget->name);
1078 		return -ENODEV;
1079 	}
1080 
1081 	out_ep = usb_ep_autoconfig(cdev->gadget, &fs_ep_out_desc);
1082 	if (!out_ep)
1083 		goto autoconf_fail;
1084 
1085 	/* assumes that all endpoints are dual-speed */
1086 	hs_ep_in_desc.bEndpointAddress = fs_ep_in_desc.bEndpointAddress;
1087 	hs_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress;
1088 	ss_ep_in_desc.bEndpointAddress = fs_ep_in_desc.bEndpointAddress;
1089 	ss_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress;
1090 
1091 	ret = usb_assign_descriptors(f, fs_printer_function,
1092 			hs_printer_function, ss_printer_function, NULL);
1093 	if (ret)
1094 		return ret;
1095 
1096 	dev->in_ep = in_ep;
1097 	dev->out_ep = out_ep;
1098 
1099 	ret = -ENOMEM;
1100 	for (i = 0; i < dev->q_len; i++) {
1101 		req = printer_req_alloc(dev->in_ep, USB_BUFSIZE, GFP_KERNEL);
1102 		if (!req)
1103 			goto fail_tx_reqs;
1104 		list_add(&req->list, &dev->tx_reqs);
1105 	}
1106 
1107 	for (i = 0; i < dev->q_len; i++) {
1108 		req = printer_req_alloc(dev->out_ep, USB_BUFSIZE, GFP_KERNEL);
1109 		if (!req)
1110 			goto fail_rx_reqs;
1111 		list_add(&req->list, &dev->rx_reqs);
1112 	}
1113 
1114 	/* Setup the sysfs files for the printer gadget. */
1115 	devt = MKDEV(major, dev->minor);
1116 	pdev = device_create(usb_gadget_class, NULL, devt,
1117 				  NULL, "g_printer%d", dev->minor);
1118 	if (IS_ERR(pdev)) {
1119 		ERROR(dev, "Failed to create device: g_printer\n");
1120 		ret = PTR_ERR(pdev);
1121 		goto fail_rx_reqs;
1122 	}
1123 
1124 	/*
1125 	 * Register a character device as an interface to a user mode
1126 	 * program that handles the printer specific functionality.
1127 	 */
1128 	cdev_init(&dev->printer_cdev, &printer_io_operations);
1129 	dev->printer_cdev.owner = THIS_MODULE;
1130 	ret = cdev_add(&dev->printer_cdev, devt, 1);
1131 	if (ret) {
1132 		ERROR(dev, "Failed to open char device\n");
1133 		goto fail_cdev_add;
1134 	}
1135 
1136 	return 0;
1137 
1138 fail_cdev_add:
1139 	device_destroy(usb_gadget_class, devt);
1140 
1141 fail_rx_reqs:
1142 	while (!list_empty(&dev->rx_reqs)) {
1143 		req = container_of(dev->rx_reqs.next, struct usb_request, list);
1144 		list_del(&req->list);
1145 		printer_req_free(dev->out_ep, req);
1146 	}
1147 
1148 fail_tx_reqs:
1149 	while (!list_empty(&dev->tx_reqs)) {
1150 		req = container_of(dev->tx_reqs.next, struct usb_request, list);
1151 		list_del(&req->list);
1152 		printer_req_free(dev->in_ep, req);
1153 	}
1154 
1155 	return ret;
1156 
1157 }
1158 
1159 static int printer_func_set_alt(struct usb_function *f,
1160 		unsigned intf, unsigned alt)
1161 {
1162 	struct printer_dev *dev = func_to_printer(f);
1163 	int ret = -ENOTSUPP;
1164 
1165 	if (!alt)
1166 		ret = set_interface(dev, intf);
1167 
1168 	return ret;
1169 }
1170 
1171 static void printer_func_disable(struct usb_function *f)
1172 {
1173 	struct printer_dev *dev = func_to_printer(f);
1174 
1175 	DBG(dev, "%s\n", __func__);
1176 
1177 	printer_reset_interface(dev);
1178 }
1179 
1180 static inline struct f_printer_opts
1181 *to_f_printer_opts(struct config_item *item)
1182 {
1183 	return container_of(to_config_group(item), struct f_printer_opts,
1184 			    func_inst.group);
1185 }
1186 
1187 static void printer_attr_release(struct config_item *item)
1188 {
1189 	struct f_printer_opts *opts = to_f_printer_opts(item);
1190 
1191 	usb_put_function_instance(&opts->func_inst);
1192 }
1193 
1194 static struct configfs_item_operations printer_item_ops = {
1195 	.release	= printer_attr_release,
1196 };
1197 
1198 static ssize_t f_printer_opts_pnp_string_show(struct config_item *item,
1199 					      char *page)
1200 {
1201 	struct f_printer_opts *opts = to_f_printer_opts(item);
1202 	int result = 0;
1203 
1204 	mutex_lock(&opts->lock);
1205 	if (!opts->pnp_string)
1206 		goto unlock;
1207 
1208 	result = strlcpy(page, opts->pnp_string, PAGE_SIZE);
1209 	if (result >= PAGE_SIZE) {
1210 		result = PAGE_SIZE;
1211 	} else if (page[result - 1] != '\n' && result + 1 < PAGE_SIZE) {
1212 		page[result++] = '\n';
1213 		page[result] = '\0';
1214 	}
1215 
1216 unlock:
1217 	mutex_unlock(&opts->lock);
1218 
1219 	return result;
1220 }
1221 
1222 static ssize_t f_printer_opts_pnp_string_store(struct config_item *item,
1223 					       const char *page, size_t len)
1224 {
1225 	struct f_printer_opts *opts = to_f_printer_opts(item);
1226 	char *new_pnp;
1227 	int result;
1228 
1229 	mutex_lock(&opts->lock);
1230 
1231 	new_pnp = kstrndup(page, len, GFP_KERNEL);
1232 	if (!new_pnp) {
1233 		result = -ENOMEM;
1234 		goto unlock;
1235 	}
1236 
1237 	if (opts->pnp_string_allocated)
1238 		kfree(opts->pnp_string);
1239 
1240 	opts->pnp_string_allocated = true;
1241 	opts->pnp_string = new_pnp;
1242 	result = len;
1243 unlock:
1244 	mutex_unlock(&opts->lock);
1245 
1246 	return result;
1247 }
1248 
1249 CONFIGFS_ATTR(f_printer_opts_, pnp_string);
1250 
1251 static ssize_t f_printer_opts_q_len_show(struct config_item *item,
1252 					 char *page)
1253 {
1254 	struct f_printer_opts *opts = to_f_printer_opts(item);
1255 	int result;
1256 
1257 	mutex_lock(&opts->lock);
1258 	result = sprintf(page, "%d\n", opts->q_len);
1259 	mutex_unlock(&opts->lock);
1260 
1261 	return result;
1262 }
1263 
1264 static ssize_t f_printer_opts_q_len_store(struct config_item *item,
1265 					  const char *page, size_t len)
1266 {
1267 	struct f_printer_opts *opts = to_f_printer_opts(item);
1268 	int ret;
1269 	u16 num;
1270 
1271 	mutex_lock(&opts->lock);
1272 	if (opts->refcnt) {
1273 		ret = -EBUSY;
1274 		goto end;
1275 	}
1276 
1277 	ret = kstrtou16(page, 0, &num);
1278 	if (ret)
1279 		goto end;
1280 
1281 	opts->q_len = (unsigned)num;
1282 	ret = len;
1283 end:
1284 	mutex_unlock(&opts->lock);
1285 	return ret;
1286 }
1287 
1288 CONFIGFS_ATTR(f_printer_opts_, q_len);
1289 
1290 static struct configfs_attribute *printer_attrs[] = {
1291 	&f_printer_opts_attr_pnp_string,
1292 	&f_printer_opts_attr_q_len,
1293 	NULL,
1294 };
1295 
1296 static const struct config_item_type printer_func_type = {
1297 	.ct_item_ops	= &printer_item_ops,
1298 	.ct_attrs	= printer_attrs,
1299 	.ct_owner	= THIS_MODULE,
1300 };
1301 
1302 static inline int gprinter_get_minor(void)
1303 {
1304 	int ret;
1305 
1306 	ret = ida_simple_get(&printer_ida, 0, 0, GFP_KERNEL);
1307 	if (ret >= PRINTER_MINORS) {
1308 		ida_simple_remove(&printer_ida, ret);
1309 		ret = -ENODEV;
1310 	}
1311 
1312 	return ret;
1313 }
1314 
1315 static inline void gprinter_put_minor(int minor)
1316 {
1317 	ida_simple_remove(&printer_ida, minor);
1318 }
1319 
1320 static int gprinter_setup(int);
1321 static void gprinter_cleanup(void);
1322 
1323 static void gprinter_free_inst(struct usb_function_instance *f)
1324 {
1325 	struct f_printer_opts *opts;
1326 
1327 	opts = container_of(f, struct f_printer_opts, func_inst);
1328 
1329 	mutex_lock(&printer_ida_lock);
1330 
1331 	gprinter_put_minor(opts->minor);
1332 	if (ida_is_empty(&printer_ida))
1333 		gprinter_cleanup();
1334 
1335 	mutex_unlock(&printer_ida_lock);
1336 
1337 	if (opts->pnp_string_allocated)
1338 		kfree(opts->pnp_string);
1339 	kfree(opts);
1340 }
1341 
1342 static struct usb_function_instance *gprinter_alloc_inst(void)
1343 {
1344 	struct f_printer_opts *opts;
1345 	struct usb_function_instance *ret;
1346 	int status = 0;
1347 
1348 	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
1349 	if (!opts)
1350 		return ERR_PTR(-ENOMEM);
1351 
1352 	mutex_init(&opts->lock);
1353 	opts->func_inst.free_func_inst = gprinter_free_inst;
1354 	ret = &opts->func_inst;
1355 
1356 	mutex_lock(&printer_ida_lock);
1357 
1358 	if (ida_is_empty(&printer_ida)) {
1359 		status = gprinter_setup(PRINTER_MINORS);
1360 		if (status) {
1361 			ret = ERR_PTR(status);
1362 			kfree(opts);
1363 			goto unlock;
1364 		}
1365 	}
1366 
1367 	opts->minor = gprinter_get_minor();
1368 	if (opts->minor < 0) {
1369 		ret = ERR_PTR(opts->minor);
1370 		kfree(opts);
1371 		if (ida_is_empty(&printer_ida))
1372 			gprinter_cleanup();
1373 		goto unlock;
1374 	}
1375 	config_group_init_type_name(&opts->func_inst.group, "",
1376 				    &printer_func_type);
1377 
1378 unlock:
1379 	mutex_unlock(&printer_ida_lock);
1380 	return ret;
1381 }
1382 
1383 static void gprinter_free(struct usb_function *f)
1384 {
1385 	struct printer_dev *dev = func_to_printer(f);
1386 	struct f_printer_opts *opts;
1387 
1388 	opts = container_of(f->fi, struct f_printer_opts, func_inst);
1389 	kfree(dev);
1390 	mutex_lock(&opts->lock);
1391 	--opts->refcnt;
1392 	mutex_unlock(&opts->lock);
1393 }
1394 
1395 static void printer_func_unbind(struct usb_configuration *c,
1396 		struct usb_function *f)
1397 {
1398 	struct printer_dev	*dev;
1399 	struct usb_request	*req;
1400 
1401 	dev = func_to_printer(f);
1402 
1403 	device_destroy(usb_gadget_class, MKDEV(major, dev->minor));
1404 
1405 	/* Remove Character Device */
1406 	cdev_del(&dev->printer_cdev);
1407 
1408 	/* we must already have been disconnected ... no i/o may be active */
1409 	WARN_ON(!list_empty(&dev->tx_reqs_active));
1410 	WARN_ON(!list_empty(&dev->rx_reqs_active));
1411 
1412 	/* Free all memory for this driver. */
1413 	while (!list_empty(&dev->tx_reqs)) {
1414 		req = container_of(dev->tx_reqs.next, struct usb_request,
1415 				list);
1416 		list_del(&req->list);
1417 		printer_req_free(dev->in_ep, req);
1418 	}
1419 
1420 	if (dev->current_rx_req != NULL)
1421 		printer_req_free(dev->out_ep, dev->current_rx_req);
1422 
1423 	while (!list_empty(&dev->rx_reqs)) {
1424 		req = container_of(dev->rx_reqs.next,
1425 				struct usb_request, list);
1426 		list_del(&req->list);
1427 		printer_req_free(dev->out_ep, req);
1428 	}
1429 
1430 	while (!list_empty(&dev->rx_buffers)) {
1431 		req = container_of(dev->rx_buffers.next,
1432 				struct usb_request, list);
1433 		list_del(&req->list);
1434 		printer_req_free(dev->out_ep, req);
1435 	}
1436 	usb_free_all_descriptors(f);
1437 }
1438 
1439 static struct usb_function *gprinter_alloc(struct usb_function_instance *fi)
1440 {
1441 	struct printer_dev	*dev;
1442 	struct f_printer_opts	*opts;
1443 
1444 	opts = container_of(fi, struct f_printer_opts, func_inst);
1445 
1446 	mutex_lock(&opts->lock);
1447 	if (opts->minor >= minors) {
1448 		mutex_unlock(&opts->lock);
1449 		return ERR_PTR(-ENOENT);
1450 	}
1451 
1452 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
1453 	if (!dev) {
1454 		mutex_unlock(&opts->lock);
1455 		return ERR_PTR(-ENOMEM);
1456 	}
1457 
1458 	++opts->refcnt;
1459 	dev->minor = opts->minor;
1460 	dev->pnp_string = opts->pnp_string;
1461 	dev->q_len = opts->q_len;
1462 	mutex_unlock(&opts->lock);
1463 
1464 	dev->function.name = "printer";
1465 	dev->function.bind = printer_func_bind;
1466 	dev->function.setup = printer_func_setup;
1467 	dev->function.unbind = printer_func_unbind;
1468 	dev->function.set_alt = printer_func_set_alt;
1469 	dev->function.disable = printer_func_disable;
1470 	dev->function.req_match = gprinter_req_match;
1471 	dev->function.free_func = gprinter_free;
1472 
1473 	INIT_LIST_HEAD(&dev->tx_reqs);
1474 	INIT_LIST_HEAD(&dev->rx_reqs);
1475 	INIT_LIST_HEAD(&dev->rx_buffers);
1476 	INIT_LIST_HEAD(&dev->tx_reqs_active);
1477 	INIT_LIST_HEAD(&dev->rx_reqs_active);
1478 
1479 	spin_lock_init(&dev->lock);
1480 	mutex_init(&dev->lock_printer_io);
1481 	init_waitqueue_head(&dev->rx_wait);
1482 	init_waitqueue_head(&dev->tx_wait);
1483 	init_waitqueue_head(&dev->tx_flush_wait);
1484 
1485 	dev->interface = -1;
1486 	dev->printer_cdev_open = 0;
1487 	dev->printer_status = PRINTER_NOT_ERROR;
1488 	dev->current_rx_req = NULL;
1489 	dev->current_rx_bytes = 0;
1490 	dev->current_rx_buf = NULL;
1491 
1492 	return &dev->function;
1493 }
1494 
1495 DECLARE_USB_FUNCTION_INIT(printer, gprinter_alloc_inst, gprinter_alloc);
1496 MODULE_LICENSE("GPL");
1497 MODULE_AUTHOR("Craig Nadler");
1498 
1499 static int gprinter_setup(int count)
1500 {
1501 	int status;
1502 	dev_t devt;
1503 
1504 	usb_gadget_class = class_create(THIS_MODULE, "usb_printer_gadget");
1505 	if (IS_ERR(usb_gadget_class)) {
1506 		status = PTR_ERR(usb_gadget_class);
1507 		usb_gadget_class = NULL;
1508 		pr_err("unable to create usb_gadget class %d\n", status);
1509 		return status;
1510 	}
1511 
1512 	status = alloc_chrdev_region(&devt, 0, count, "USB printer gadget");
1513 	if (status) {
1514 		pr_err("alloc_chrdev_region %d\n", status);
1515 		class_destroy(usb_gadget_class);
1516 		usb_gadget_class = NULL;
1517 		return status;
1518 	}
1519 
1520 	major = MAJOR(devt);
1521 	minors = count;
1522 
1523 	return status;
1524 }
1525 
1526 static void gprinter_cleanup(void)
1527 {
1528 	if (major) {
1529 		unregister_chrdev_region(MKDEV(major, 0), minors);
1530 		major = minors = 0;
1531 	}
1532 	class_destroy(usb_gadget_class);
1533 	usb_gadget_class = NULL;
1534 }
1535