1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * f_printer.c - USB printer function driver
4  *
5  * Copied from drivers/usb/gadget/legacy/printer.c,
6  * which was:
7  *
8  * printer.c -- Printer gadget driver
9  *
10  * Copyright (C) 2003-2005 David Brownell
11  * Copyright (C) 2006 Craig W. Nadler
12  */
13 
14 #include <linux/module.h>
15 #include <linux/kernel.h>
16 #include <linux/delay.h>
17 #include <linux/ioport.h>
18 #include <linux/sched.h>
19 #include <linux/slab.h>
20 #include <linux/mutex.h>
21 #include <linux/errno.h>
22 #include <linux/init.h>
23 #include <linux/idr.h>
24 #include <linux/timer.h>
25 #include <linux/list.h>
26 #include <linux/interrupt.h>
27 #include <linux/device.h>
28 #include <linux/moduleparam.h>
29 #include <linux/fs.h>
30 #include <linux/poll.h>
31 #include <linux/types.h>
32 #include <linux/ctype.h>
33 #include <linux/cdev.h>
34 #include <linux/kref.h>
35 
36 #include <asm/byteorder.h>
37 #include <linux/io.h>
38 #include <linux/irq.h>
39 #include <linux/uaccess.h>
40 #include <asm/unaligned.h>
41 
42 #include <linux/usb/ch9.h>
43 #include <linux/usb/composite.h>
44 #include <linux/usb/gadget.h>
45 #include <linux/usb/g_printer.h>
46 
47 #include "u_printer.h"
48 
49 #define PRINTER_MINORS		4
50 #define GET_DEVICE_ID		0
51 #define GET_PORT_STATUS		1
52 #define SOFT_RESET		2
53 
54 #define DEFAULT_Q_LEN		10 /* same as legacy g_printer gadget */
55 
56 static int major, minors;
57 static const struct class usb_gadget_class = {
58 	.name = "usb_printer_gadget",
59 };
60 
61 static DEFINE_IDA(printer_ida);
62 static DEFINE_MUTEX(printer_ida_lock); /* protects access do printer_ida */
63 
64 /*-------------------------------------------------------------------------*/
65 
66 struct printer_dev {
67 	spinlock_t		lock;		/* lock this structure */
68 	/* lock buffer lists during read/write calls */
69 	struct mutex		lock_printer_io;
70 	struct usb_gadget	*gadget;
71 	s8			interface;
72 	struct usb_ep		*in_ep, *out_ep;
73 	struct kref             kref;
74 	struct list_head	rx_reqs;	/* List of free RX structs */
75 	struct list_head	rx_reqs_active;	/* List of Active RX xfers */
76 	struct list_head	rx_buffers;	/* List of completed xfers */
77 	/* wait until there is data to be read. */
78 	wait_queue_head_t	rx_wait;
79 	struct list_head	tx_reqs;	/* List of free TX structs */
80 	struct list_head	tx_reqs_active; /* List of Active TX xfers */
81 	/* Wait until there are write buffers available to use. */
82 	wait_queue_head_t	tx_wait;
83 	/* Wait until all write buffers have been sent. */
84 	wait_queue_head_t	tx_flush_wait;
85 	struct usb_request	*current_rx_req;
86 	size_t			current_rx_bytes;
87 	u8			*current_rx_buf;
88 	u8			printer_status;
89 	u8			reset_printer;
90 	int			minor;
91 	struct cdev		printer_cdev;
92 	u8			printer_cdev_open;
93 	wait_queue_head_t	wait;
94 	unsigned		q_len;
95 	char			**pnp_string;	/* We don't own memory! */
96 	struct usb_function	function;
97 };
98 
99 static inline struct printer_dev *func_to_printer(struct usb_function *f)
100 {
101 	return container_of(f, struct printer_dev, function);
102 }
103 
104 /*-------------------------------------------------------------------------*/
105 
106 /*
107  * DESCRIPTORS ... most are static, but strings and (full) configuration
108  * descriptors are built on demand.
109  */
110 
111 /* holds our biggest descriptor */
112 #define USB_DESC_BUFSIZE		256
113 #define USB_BUFSIZE			8192
114 
115 static struct usb_interface_descriptor intf_desc = {
116 	.bLength =		sizeof(intf_desc),
117 	.bDescriptorType =	USB_DT_INTERFACE,
118 	.bNumEndpoints =	2,
119 	.bInterfaceClass =	USB_CLASS_PRINTER,
120 	.bInterfaceSubClass =	1,	/* Printer Sub-Class */
121 	.bInterfaceProtocol =	2,	/* Bi-Directional */
122 	.iInterface =		0
123 };
124 
125 static struct usb_endpoint_descriptor fs_ep_in_desc = {
126 	.bLength =		USB_DT_ENDPOINT_SIZE,
127 	.bDescriptorType =	USB_DT_ENDPOINT,
128 	.bEndpointAddress =	USB_DIR_IN,
129 	.bmAttributes =		USB_ENDPOINT_XFER_BULK
130 };
131 
132 static struct usb_endpoint_descriptor fs_ep_out_desc = {
133 	.bLength =		USB_DT_ENDPOINT_SIZE,
134 	.bDescriptorType =	USB_DT_ENDPOINT,
135 	.bEndpointAddress =	USB_DIR_OUT,
136 	.bmAttributes =		USB_ENDPOINT_XFER_BULK
137 };
138 
139 static struct usb_descriptor_header *fs_printer_function[] = {
140 	(struct usb_descriptor_header *) &intf_desc,
141 	(struct usb_descriptor_header *) &fs_ep_in_desc,
142 	(struct usb_descriptor_header *) &fs_ep_out_desc,
143 	NULL
144 };
145 
146 /*
147  * usb 2.0 devices need to expose both high speed and full speed
148  * descriptors, unless they only run at full speed.
149  */
150 
151 static struct usb_endpoint_descriptor hs_ep_in_desc = {
152 	.bLength =		USB_DT_ENDPOINT_SIZE,
153 	.bDescriptorType =	USB_DT_ENDPOINT,
154 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
155 	.wMaxPacketSize =	cpu_to_le16(512)
156 };
157 
158 static struct usb_endpoint_descriptor hs_ep_out_desc = {
159 	.bLength =		USB_DT_ENDPOINT_SIZE,
160 	.bDescriptorType =	USB_DT_ENDPOINT,
161 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
162 	.wMaxPacketSize =	cpu_to_le16(512)
163 };
164 
165 static struct usb_descriptor_header *hs_printer_function[] = {
166 	(struct usb_descriptor_header *) &intf_desc,
167 	(struct usb_descriptor_header *) &hs_ep_in_desc,
168 	(struct usb_descriptor_header *) &hs_ep_out_desc,
169 	NULL
170 };
171 
172 /*
173  * Added endpoint descriptors for 3.0 devices
174  */
175 
176 static struct usb_endpoint_descriptor ss_ep_in_desc = {
177 	.bLength =              USB_DT_ENDPOINT_SIZE,
178 	.bDescriptorType =      USB_DT_ENDPOINT,
179 	.bmAttributes =         USB_ENDPOINT_XFER_BULK,
180 	.wMaxPacketSize =       cpu_to_le16(1024),
181 };
182 
183 static struct usb_ss_ep_comp_descriptor ss_ep_in_comp_desc = {
184 	.bLength =              sizeof(ss_ep_in_comp_desc),
185 	.bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
186 };
187 
188 static struct usb_endpoint_descriptor ss_ep_out_desc = {
189 	.bLength =              USB_DT_ENDPOINT_SIZE,
190 	.bDescriptorType =      USB_DT_ENDPOINT,
191 	.bmAttributes =         USB_ENDPOINT_XFER_BULK,
192 	.wMaxPacketSize =       cpu_to_le16(1024),
193 };
194 
195 static struct usb_ss_ep_comp_descriptor ss_ep_out_comp_desc = {
196 	.bLength =              sizeof(ss_ep_out_comp_desc),
197 	.bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
198 };
199 
200 static struct usb_descriptor_header *ss_printer_function[] = {
201 	(struct usb_descriptor_header *) &intf_desc,
202 	(struct usb_descriptor_header *) &ss_ep_in_desc,
203 	(struct usb_descriptor_header *) &ss_ep_in_comp_desc,
204 	(struct usb_descriptor_header *) &ss_ep_out_desc,
205 	(struct usb_descriptor_header *) &ss_ep_out_comp_desc,
206 	NULL
207 };
208 
209 /* maxpacket and other transfer characteristics vary by speed. */
210 static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget,
211 					struct usb_endpoint_descriptor *fs,
212 					struct usb_endpoint_descriptor *hs,
213 					struct usb_endpoint_descriptor *ss)
214 {
215 	switch (gadget->speed) {
216 	case USB_SPEED_SUPER:
217 		return ss;
218 	case USB_SPEED_HIGH:
219 		return hs;
220 	default:
221 		return fs;
222 	}
223 }
224 
225 /*-------------------------------------------------------------------------*/
226 
227 static void printer_dev_free(struct kref *kref)
228 {
229 	struct printer_dev *dev = container_of(kref, struct printer_dev, kref);
230 
231 	kfree(dev);
232 }
233 
234 static struct usb_request *
235 printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags)
236 {
237 	struct usb_request	*req;
238 
239 	req = usb_ep_alloc_request(ep, gfp_flags);
240 
241 	if (req != NULL) {
242 		req->length = len;
243 		req->buf = kmalloc(len, gfp_flags);
244 		if (req->buf == NULL) {
245 			usb_ep_free_request(ep, req);
246 			return NULL;
247 		}
248 	}
249 
250 	return req;
251 }
252 
253 static void
254 printer_req_free(struct usb_ep *ep, struct usb_request *req)
255 {
256 	if (ep != NULL && req != NULL) {
257 		kfree(req->buf);
258 		usb_ep_free_request(ep, req);
259 	}
260 }
261 
262 /*-------------------------------------------------------------------------*/
263 
264 static void rx_complete(struct usb_ep *ep, struct usb_request *req)
265 {
266 	struct printer_dev	*dev = ep->driver_data;
267 	int			status = req->status;
268 	unsigned long		flags;
269 
270 	spin_lock_irqsave(&dev->lock, flags);
271 
272 	list_del_init(&req->list);	/* Remode from Active List */
273 
274 	switch (status) {
275 
276 	/* normal completion */
277 	case 0:
278 		if (req->actual > 0) {
279 			list_add_tail(&req->list, &dev->rx_buffers);
280 			DBG(dev, "G_Printer : rx length %d\n", req->actual);
281 		} else {
282 			list_add(&req->list, &dev->rx_reqs);
283 		}
284 		break;
285 
286 	/* software-driven interface shutdown */
287 	case -ECONNRESET:		/* unlink */
288 	case -ESHUTDOWN:		/* disconnect etc */
289 		VDBG(dev, "rx shutdown, code %d\n", status);
290 		list_add(&req->list, &dev->rx_reqs);
291 		break;
292 
293 	/* for hardware automagic (such as pxa) */
294 	case -ECONNABORTED:		/* endpoint reset */
295 		DBG(dev, "rx %s reset\n", ep->name);
296 		list_add(&req->list, &dev->rx_reqs);
297 		break;
298 
299 	/* data overrun */
300 	case -EOVERFLOW:
301 		fallthrough;
302 
303 	default:
304 		DBG(dev, "rx status %d\n", status);
305 		list_add(&req->list, &dev->rx_reqs);
306 		break;
307 	}
308 
309 	wake_up_interruptible(&dev->rx_wait);
310 	spin_unlock_irqrestore(&dev->lock, flags);
311 }
312 
313 static void tx_complete(struct usb_ep *ep, struct usb_request *req)
314 {
315 	struct printer_dev	*dev = ep->driver_data;
316 
317 	switch (req->status) {
318 	default:
319 		VDBG(dev, "tx err %d\n", req->status);
320 		fallthrough;
321 	case -ECONNRESET:		/* unlink */
322 	case -ESHUTDOWN:		/* disconnect etc */
323 		break;
324 	case 0:
325 		break;
326 	}
327 
328 	spin_lock(&dev->lock);
329 	/* Take the request struct off the active list and put it on the
330 	 * free list.
331 	 */
332 	list_del_init(&req->list);
333 	list_add(&req->list, &dev->tx_reqs);
334 	wake_up_interruptible(&dev->tx_wait);
335 	if (likely(list_empty(&dev->tx_reqs_active)))
336 		wake_up_interruptible(&dev->tx_flush_wait);
337 
338 	spin_unlock(&dev->lock);
339 }
340 
341 /*-------------------------------------------------------------------------*/
342 
343 static int
344 printer_open(struct inode *inode, struct file *fd)
345 {
346 	struct printer_dev	*dev;
347 	unsigned long		flags;
348 	int			ret = -EBUSY;
349 
350 	dev = container_of(inode->i_cdev, struct printer_dev, printer_cdev);
351 
352 	spin_lock_irqsave(&dev->lock, flags);
353 
354 	if (dev->interface < 0) {
355 		spin_unlock_irqrestore(&dev->lock, flags);
356 		return -ENODEV;
357 	}
358 
359 	if (!dev->printer_cdev_open) {
360 		dev->printer_cdev_open = 1;
361 		fd->private_data = dev;
362 		ret = 0;
363 		/* Change the printer status to show that it's on-line. */
364 		dev->printer_status |= PRINTER_SELECTED;
365 	}
366 
367 	spin_unlock_irqrestore(&dev->lock, flags);
368 
369 	kref_get(&dev->kref);
370 
371 	return ret;
372 }
373 
374 static int
375 printer_close(struct inode *inode, struct file *fd)
376 {
377 	struct printer_dev	*dev = fd->private_data;
378 	unsigned long		flags;
379 
380 	spin_lock_irqsave(&dev->lock, flags);
381 	dev->printer_cdev_open = 0;
382 	fd->private_data = NULL;
383 	/* Change printer status to show that the printer is off-line. */
384 	dev->printer_status &= ~PRINTER_SELECTED;
385 	spin_unlock_irqrestore(&dev->lock, flags);
386 
387 	kref_put(&dev->kref, printer_dev_free);
388 
389 	return 0;
390 }
391 
392 /* This function must be called with interrupts turned off. */
393 static void
394 setup_rx_reqs(struct printer_dev *dev)
395 {
396 	struct usb_request              *req;
397 
398 	while (likely(!list_empty(&dev->rx_reqs))) {
399 		int error;
400 
401 		req = container_of(dev->rx_reqs.next,
402 				struct usb_request, list);
403 		list_del_init(&req->list);
404 
405 		/* The USB Host sends us whatever amount of data it wants to
406 		 * so we always set the length field to the full USB_BUFSIZE.
407 		 * If the amount of data is more than the read() caller asked
408 		 * for it will be stored in the request buffer until it is
409 		 * asked for by read().
410 		 */
411 		req->length = USB_BUFSIZE;
412 		req->complete = rx_complete;
413 
414 		/* here, we unlock, and only unlock, to avoid deadlock. */
415 		spin_unlock(&dev->lock);
416 		error = usb_ep_queue(dev->out_ep, req, GFP_ATOMIC);
417 		spin_lock(&dev->lock);
418 		if (error) {
419 			DBG(dev, "rx submit --> %d\n", error);
420 			list_add(&req->list, &dev->rx_reqs);
421 			break;
422 		}
423 		/* if the req is empty, then add it into dev->rx_reqs_active. */
424 		else if (list_empty(&req->list))
425 			list_add(&req->list, &dev->rx_reqs_active);
426 	}
427 }
428 
429 static ssize_t
430 printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
431 {
432 	struct printer_dev		*dev = fd->private_data;
433 	unsigned long			flags;
434 	size_t				size;
435 	size_t				bytes_copied;
436 	struct usb_request		*req;
437 	/* This is a pointer to the current USB rx request. */
438 	struct usb_request		*current_rx_req;
439 	/* This is the number of bytes in the current rx buffer. */
440 	size_t				current_rx_bytes;
441 	/* This is a pointer to the current rx buffer. */
442 	u8				*current_rx_buf;
443 
444 	if (len == 0)
445 		return -EINVAL;
446 
447 	DBG(dev, "printer_read trying to read %d bytes\n", (int)len);
448 
449 	mutex_lock(&dev->lock_printer_io);
450 	spin_lock_irqsave(&dev->lock, flags);
451 
452 	if (dev->interface < 0) {
453 		spin_unlock_irqrestore(&dev->lock, flags);
454 		mutex_unlock(&dev->lock_printer_io);
455 		return -ENODEV;
456 	}
457 
458 	/* We will use this flag later to check if a printer reset happened
459 	 * after we turn interrupts back on.
460 	 */
461 	dev->reset_printer = 0;
462 
463 	setup_rx_reqs(dev);
464 
465 	bytes_copied = 0;
466 	current_rx_req = dev->current_rx_req;
467 	current_rx_bytes = dev->current_rx_bytes;
468 	current_rx_buf = dev->current_rx_buf;
469 	dev->current_rx_req = NULL;
470 	dev->current_rx_bytes = 0;
471 	dev->current_rx_buf = NULL;
472 
473 	/* Check if there is any data in the read buffers. Please note that
474 	 * current_rx_bytes is the number of bytes in the current rx buffer.
475 	 * If it is zero then check if there are any other rx_buffers that
476 	 * are on the completed list. We are only out of data if all rx
477 	 * buffers are empty.
478 	 */
479 	if ((current_rx_bytes == 0) &&
480 			(likely(list_empty(&dev->rx_buffers)))) {
481 		/* Turn interrupts back on before sleeping. */
482 		spin_unlock_irqrestore(&dev->lock, flags);
483 
484 		/*
485 		 * If no data is available check if this is a NON-Blocking
486 		 * call or not.
487 		 */
488 		if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
489 			mutex_unlock(&dev->lock_printer_io);
490 			return -EAGAIN;
491 		}
492 
493 		/* Sleep until data is available */
494 		wait_event_interruptible(dev->rx_wait,
495 				(likely(!list_empty(&dev->rx_buffers))));
496 		spin_lock_irqsave(&dev->lock, flags);
497 	}
498 
499 	/* We have data to return then copy it to the caller's buffer.*/
500 	while ((current_rx_bytes || likely(!list_empty(&dev->rx_buffers)))
501 			&& len) {
502 		if (current_rx_bytes == 0) {
503 			req = container_of(dev->rx_buffers.next,
504 					struct usb_request, list);
505 			list_del_init(&req->list);
506 
507 			if (req->actual && req->buf) {
508 				current_rx_req = req;
509 				current_rx_bytes = req->actual;
510 				current_rx_buf = req->buf;
511 			} else {
512 				list_add(&req->list, &dev->rx_reqs);
513 				continue;
514 			}
515 		}
516 
517 		/* Don't leave irqs off while doing memory copies */
518 		spin_unlock_irqrestore(&dev->lock, flags);
519 
520 		if (len > current_rx_bytes)
521 			size = current_rx_bytes;
522 		else
523 			size = len;
524 
525 		size -= copy_to_user(buf, current_rx_buf, size);
526 		bytes_copied += size;
527 		len -= size;
528 		buf += size;
529 
530 		spin_lock_irqsave(&dev->lock, flags);
531 
532 		/* We've disconnected or reset so return. */
533 		if (dev->reset_printer) {
534 			list_add(&current_rx_req->list, &dev->rx_reqs);
535 			spin_unlock_irqrestore(&dev->lock, flags);
536 			mutex_unlock(&dev->lock_printer_io);
537 			return -EAGAIN;
538 		}
539 
540 		/* If we not returning all the data left in this RX request
541 		 * buffer then adjust the amount of data left in the buffer.
542 		 * Othewise if we are done with this RX request buffer then
543 		 * requeue it to get any incoming data from the USB host.
544 		 */
545 		if (size < current_rx_bytes) {
546 			current_rx_bytes -= size;
547 			current_rx_buf += size;
548 		} else {
549 			list_add(&current_rx_req->list, &dev->rx_reqs);
550 			current_rx_bytes = 0;
551 			current_rx_buf = NULL;
552 			current_rx_req = NULL;
553 		}
554 	}
555 
556 	dev->current_rx_req = current_rx_req;
557 	dev->current_rx_bytes = current_rx_bytes;
558 	dev->current_rx_buf = current_rx_buf;
559 
560 	spin_unlock_irqrestore(&dev->lock, flags);
561 	mutex_unlock(&dev->lock_printer_io);
562 
563 	DBG(dev, "printer_read returned %d bytes\n", (int)bytes_copied);
564 
565 	if (bytes_copied)
566 		return bytes_copied;
567 	else
568 		return -EAGAIN;
569 }
570 
571 static ssize_t
572 printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
573 {
574 	struct printer_dev	*dev = fd->private_data;
575 	unsigned long		flags;
576 	size_t			size;	/* Amount of data in a TX request. */
577 	size_t			bytes_copied = 0;
578 	struct usb_request	*req;
579 	int			value;
580 
581 	DBG(dev, "printer_write trying to send %d bytes\n", (int)len);
582 
583 	if (len == 0)
584 		return -EINVAL;
585 
586 	mutex_lock(&dev->lock_printer_io);
587 	spin_lock_irqsave(&dev->lock, flags);
588 
589 	if (dev->interface < 0) {
590 		spin_unlock_irqrestore(&dev->lock, flags);
591 		mutex_unlock(&dev->lock_printer_io);
592 		return -ENODEV;
593 	}
594 
595 	/* Check if a printer reset happens while we have interrupts on */
596 	dev->reset_printer = 0;
597 
598 	/* Check if there is any available write buffers */
599 	if (likely(list_empty(&dev->tx_reqs))) {
600 		/* Turn interrupts back on before sleeping. */
601 		spin_unlock_irqrestore(&dev->lock, flags);
602 
603 		/*
604 		 * If write buffers are available check if this is
605 		 * a NON-Blocking call or not.
606 		 */
607 		if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
608 			mutex_unlock(&dev->lock_printer_io);
609 			return -EAGAIN;
610 		}
611 
612 		/* Sleep until a write buffer is available */
613 		wait_event_interruptible(dev->tx_wait,
614 				(likely(!list_empty(&dev->tx_reqs))));
615 		spin_lock_irqsave(&dev->lock, flags);
616 	}
617 
618 	while (likely(!list_empty(&dev->tx_reqs)) && len) {
619 
620 		if (len > USB_BUFSIZE)
621 			size = USB_BUFSIZE;
622 		else
623 			size = len;
624 
625 		req = container_of(dev->tx_reqs.next, struct usb_request,
626 				list);
627 		list_del_init(&req->list);
628 
629 		req->complete = tx_complete;
630 		req->length = size;
631 
632 		/* Check if we need to send a zero length packet. */
633 		if (len > size)
634 			/* They will be more TX requests so no yet. */
635 			req->zero = 0;
636 		else
637 			/* If the data amount is not a multiple of the
638 			 * maxpacket size then send a zero length packet.
639 			 */
640 			req->zero = ((len % dev->in_ep->maxpacket) == 0);
641 
642 		/* Don't leave irqs off while doing memory copies */
643 		spin_unlock_irqrestore(&dev->lock, flags);
644 
645 		if (copy_from_user(req->buf, buf, size)) {
646 			list_add(&req->list, &dev->tx_reqs);
647 			mutex_unlock(&dev->lock_printer_io);
648 			return bytes_copied;
649 		}
650 
651 		bytes_copied += size;
652 		len -= size;
653 		buf += size;
654 
655 		spin_lock_irqsave(&dev->lock, flags);
656 
657 		/* We've disconnected or reset so free the req and buffer */
658 		if (dev->reset_printer) {
659 			list_add(&req->list, &dev->tx_reqs);
660 			spin_unlock_irqrestore(&dev->lock, flags);
661 			mutex_unlock(&dev->lock_printer_io);
662 			return -EAGAIN;
663 		}
664 
665 		list_add(&req->list, &dev->tx_reqs_active);
666 
667 		/* here, we unlock, and only unlock, to avoid deadlock. */
668 		spin_unlock(&dev->lock);
669 		value = usb_ep_queue(dev->in_ep, req, GFP_ATOMIC);
670 		spin_lock(&dev->lock);
671 		if (value) {
672 			list_move(&req->list, &dev->tx_reqs);
673 			spin_unlock_irqrestore(&dev->lock, flags);
674 			mutex_unlock(&dev->lock_printer_io);
675 			return -EAGAIN;
676 		}
677 	}
678 
679 	spin_unlock_irqrestore(&dev->lock, flags);
680 	mutex_unlock(&dev->lock_printer_io);
681 
682 	DBG(dev, "printer_write sent %d bytes\n", (int)bytes_copied);
683 
684 	if (bytes_copied)
685 		return bytes_copied;
686 	else
687 		return -EAGAIN;
688 }
689 
690 static int
691 printer_fsync(struct file *fd, loff_t start, loff_t end, int datasync)
692 {
693 	struct printer_dev	*dev = fd->private_data;
694 	struct inode *inode = file_inode(fd);
695 	unsigned long		flags;
696 	int			tx_list_empty;
697 
698 	inode_lock(inode);
699 	spin_lock_irqsave(&dev->lock, flags);
700 
701 	if (dev->interface < 0) {
702 		spin_unlock_irqrestore(&dev->lock, flags);
703 		inode_unlock(inode);
704 		return -ENODEV;
705 	}
706 
707 	tx_list_empty = (likely(list_empty(&dev->tx_reqs)));
708 	spin_unlock_irqrestore(&dev->lock, flags);
709 
710 	if (!tx_list_empty) {
711 		/* Sleep until all data has been sent */
712 		wait_event_interruptible(dev->tx_flush_wait,
713 				(likely(list_empty(&dev->tx_reqs_active))));
714 	}
715 	inode_unlock(inode);
716 
717 	return 0;
718 }
719 
720 static __poll_t
721 printer_poll(struct file *fd, poll_table *wait)
722 {
723 	struct printer_dev	*dev = fd->private_data;
724 	unsigned long		flags;
725 	__poll_t		status = 0;
726 
727 	mutex_lock(&dev->lock_printer_io);
728 	spin_lock_irqsave(&dev->lock, flags);
729 
730 	if (dev->interface < 0) {
731 		spin_unlock_irqrestore(&dev->lock, flags);
732 		mutex_unlock(&dev->lock_printer_io);
733 		return EPOLLERR | EPOLLHUP;
734 	}
735 
736 	setup_rx_reqs(dev);
737 	spin_unlock_irqrestore(&dev->lock, flags);
738 	mutex_unlock(&dev->lock_printer_io);
739 
740 	poll_wait(fd, &dev->rx_wait, wait);
741 	poll_wait(fd, &dev->tx_wait, wait);
742 
743 	spin_lock_irqsave(&dev->lock, flags);
744 	if (likely(!list_empty(&dev->tx_reqs)))
745 		status |= EPOLLOUT | EPOLLWRNORM;
746 
747 	if (likely(dev->current_rx_bytes) ||
748 			likely(!list_empty(&dev->rx_buffers)))
749 		status |= EPOLLIN | EPOLLRDNORM;
750 
751 	spin_unlock_irqrestore(&dev->lock, flags);
752 
753 	return status;
754 }
755 
756 static long
757 printer_ioctl(struct file *fd, unsigned int code, unsigned long arg)
758 {
759 	struct printer_dev	*dev = fd->private_data;
760 	unsigned long		flags;
761 	int			status = 0;
762 
763 	DBG(dev, "printer_ioctl: cmd=0x%4.4x, arg=%lu\n", code, arg);
764 
765 	/* handle ioctls */
766 
767 	spin_lock_irqsave(&dev->lock, flags);
768 
769 	if (dev->interface < 0) {
770 		spin_unlock_irqrestore(&dev->lock, flags);
771 		return -ENODEV;
772 	}
773 
774 	switch (code) {
775 	case GADGET_GET_PRINTER_STATUS:
776 		status = (int)dev->printer_status;
777 		break;
778 	case GADGET_SET_PRINTER_STATUS:
779 		dev->printer_status = (u8)arg;
780 		break;
781 	default:
782 		/* could not handle ioctl */
783 		DBG(dev, "printer_ioctl: ERROR cmd=0x%4.4xis not supported\n",
784 				code);
785 		status = -ENOTTY;
786 	}
787 
788 	spin_unlock_irqrestore(&dev->lock, flags);
789 
790 	return status;
791 }
792 
793 /* used after endpoint configuration */
794 static const struct file_operations printer_io_operations = {
795 	.owner =	THIS_MODULE,
796 	.open =		printer_open,
797 	.read =		printer_read,
798 	.write =	printer_write,
799 	.fsync =	printer_fsync,
800 	.poll =		printer_poll,
801 	.unlocked_ioctl = printer_ioctl,
802 	.release =	printer_close,
803 	.llseek =	noop_llseek,
804 };
805 
806 /*-------------------------------------------------------------------------*/
807 
808 static int
809 set_printer_interface(struct printer_dev *dev)
810 {
811 	int			result = 0;
812 
813 	dev->in_ep->desc = ep_desc(dev->gadget, &fs_ep_in_desc, &hs_ep_in_desc,
814 				&ss_ep_in_desc);
815 	dev->in_ep->driver_data = dev;
816 
817 	dev->out_ep->desc = ep_desc(dev->gadget, &fs_ep_out_desc,
818 				    &hs_ep_out_desc, &ss_ep_out_desc);
819 	dev->out_ep->driver_data = dev;
820 
821 	result = usb_ep_enable(dev->in_ep);
822 	if (result != 0) {
823 		DBG(dev, "enable %s --> %d\n", dev->in_ep->name, result);
824 		goto done;
825 	}
826 
827 	result = usb_ep_enable(dev->out_ep);
828 	if (result != 0) {
829 		DBG(dev, "enable %s --> %d\n", dev->out_ep->name, result);
830 		goto done;
831 	}
832 
833 done:
834 	/* on error, disable any endpoints  */
835 	if (result != 0) {
836 		(void) usb_ep_disable(dev->in_ep);
837 		(void) usb_ep_disable(dev->out_ep);
838 		dev->in_ep->desc = NULL;
839 		dev->out_ep->desc = NULL;
840 	}
841 
842 	/* caller is responsible for cleanup on error */
843 	return result;
844 }
845 
846 static void printer_reset_interface(struct printer_dev *dev)
847 {
848 	unsigned long	flags;
849 
850 	if (dev->interface < 0)
851 		return;
852 
853 	if (dev->in_ep->desc)
854 		usb_ep_disable(dev->in_ep);
855 
856 	if (dev->out_ep->desc)
857 		usb_ep_disable(dev->out_ep);
858 
859 	spin_lock_irqsave(&dev->lock, flags);
860 	dev->in_ep->desc = NULL;
861 	dev->out_ep->desc = NULL;
862 	dev->interface = -1;
863 	spin_unlock_irqrestore(&dev->lock, flags);
864 }
865 
866 /* Change our operational Interface. */
867 static int set_interface(struct printer_dev *dev, unsigned number)
868 {
869 	int			result = 0;
870 
871 	/* Free the current interface */
872 	printer_reset_interface(dev);
873 
874 	result = set_printer_interface(dev);
875 	if (result)
876 		printer_reset_interface(dev);
877 	else
878 		dev->interface = number;
879 
880 	if (!result)
881 		INFO(dev, "Using interface %x\n", number);
882 
883 	return result;
884 }
885 
886 static void printer_soft_reset(struct printer_dev *dev)
887 {
888 	struct usb_request	*req;
889 
890 	if (usb_ep_disable(dev->in_ep))
891 		DBG(dev, "Failed to disable USB in_ep\n");
892 	if (usb_ep_disable(dev->out_ep))
893 		DBG(dev, "Failed to disable USB out_ep\n");
894 
895 	if (dev->current_rx_req != NULL) {
896 		list_add(&dev->current_rx_req->list, &dev->rx_reqs);
897 		dev->current_rx_req = NULL;
898 	}
899 	dev->current_rx_bytes = 0;
900 	dev->current_rx_buf = NULL;
901 	dev->reset_printer = 1;
902 
903 	while (likely(!(list_empty(&dev->rx_buffers)))) {
904 		req = container_of(dev->rx_buffers.next, struct usb_request,
905 				list);
906 		list_del_init(&req->list);
907 		list_add(&req->list, &dev->rx_reqs);
908 	}
909 
910 	while (likely(!(list_empty(&dev->rx_reqs_active)))) {
911 		req = container_of(dev->rx_buffers.next, struct usb_request,
912 				list);
913 		list_del_init(&req->list);
914 		list_add(&req->list, &dev->rx_reqs);
915 	}
916 
917 	while (likely(!(list_empty(&dev->tx_reqs_active)))) {
918 		req = container_of(dev->tx_reqs_active.next,
919 				struct usb_request, list);
920 		list_del_init(&req->list);
921 		list_add(&req->list, &dev->tx_reqs);
922 	}
923 
924 	if (usb_ep_enable(dev->in_ep))
925 		DBG(dev, "Failed to enable USB in_ep\n");
926 	if (usb_ep_enable(dev->out_ep))
927 		DBG(dev, "Failed to enable USB out_ep\n");
928 
929 	wake_up_interruptible(&dev->rx_wait);
930 	wake_up_interruptible(&dev->tx_wait);
931 	wake_up_interruptible(&dev->tx_flush_wait);
932 }
933 
934 /*-------------------------------------------------------------------------*/
935 
936 static bool gprinter_req_match(struct usb_function *f,
937 			       const struct usb_ctrlrequest *ctrl,
938 			       bool config0)
939 {
940 	struct printer_dev	*dev = func_to_printer(f);
941 	u16			w_index = le16_to_cpu(ctrl->wIndex);
942 	u16			w_value = le16_to_cpu(ctrl->wValue);
943 	u16			w_length = le16_to_cpu(ctrl->wLength);
944 
945 	if (config0)
946 		return false;
947 
948 	if ((ctrl->bRequestType & USB_RECIP_MASK) != USB_RECIP_INTERFACE ||
949 	    (ctrl->bRequestType & USB_TYPE_MASK) != USB_TYPE_CLASS)
950 		return false;
951 
952 	switch (ctrl->bRequest) {
953 	case GET_DEVICE_ID:
954 		w_index >>= 8;
955 		if (USB_DIR_IN & ctrl->bRequestType)
956 			break;
957 		return false;
958 	case GET_PORT_STATUS:
959 		if (!w_value && w_length == 1 &&
960 		    (USB_DIR_IN & ctrl->bRequestType))
961 			break;
962 		return false;
963 	case SOFT_RESET:
964 		if (!w_value && !w_length &&
965 		   !(USB_DIR_IN & ctrl->bRequestType))
966 			break;
967 		fallthrough;
968 	default:
969 		return false;
970 	}
971 	return w_index == dev->interface;
972 }
973 
974 /*
975  * The setup() callback implements all the ep0 functionality that's not
976  * handled lower down.
977  */
978 static int printer_func_setup(struct usb_function *f,
979 		const struct usb_ctrlrequest *ctrl)
980 {
981 	struct printer_dev *dev = func_to_printer(f);
982 	struct usb_composite_dev *cdev = f->config->cdev;
983 	struct usb_request	*req = cdev->req;
984 	u8			*buf = req->buf;
985 	int			value = -EOPNOTSUPP;
986 	u16			wIndex = le16_to_cpu(ctrl->wIndex);
987 	u16			wValue = le16_to_cpu(ctrl->wValue);
988 	u16			wLength = le16_to_cpu(ctrl->wLength);
989 
990 	DBG(dev, "ctrl req%02x.%02x v%04x i%04x l%d\n",
991 		ctrl->bRequestType, ctrl->bRequest, wValue, wIndex, wLength);
992 
993 	switch (ctrl->bRequestType&USB_TYPE_MASK) {
994 	case USB_TYPE_CLASS:
995 		switch (ctrl->bRequest) {
996 		case GET_DEVICE_ID: /* Get the IEEE-1284 PNP String */
997 			/* Only one printer interface is supported. */
998 			if ((wIndex>>8) != dev->interface)
999 				break;
1000 
1001 			if (!*dev->pnp_string) {
1002 				value = 0;
1003 				break;
1004 			}
1005 			value = strlen(*dev->pnp_string);
1006 			buf[0] = (value >> 8) & 0xFF;
1007 			buf[1] = value & 0xFF;
1008 			memcpy(buf + 2, *dev->pnp_string, value);
1009 			DBG(dev, "1284 PNP String: %x %s\n", value,
1010 			    *dev->pnp_string);
1011 			break;
1012 
1013 		case GET_PORT_STATUS: /* Get Port Status */
1014 			/* Only one printer interface is supported. */
1015 			if (wIndex != dev->interface)
1016 				break;
1017 
1018 			buf[0] = dev->printer_status;
1019 			value = min_t(u16, wLength, 1);
1020 			break;
1021 
1022 		case SOFT_RESET: /* Soft Reset */
1023 			/* Only one printer interface is supported. */
1024 			if (wIndex != dev->interface)
1025 				break;
1026 
1027 			printer_soft_reset(dev);
1028 
1029 			value = 0;
1030 			break;
1031 
1032 		default:
1033 			goto unknown;
1034 		}
1035 		break;
1036 
1037 	default:
1038 unknown:
1039 		VDBG(dev,
1040 			"unknown ctrl req%02x.%02x v%04x i%04x l%d\n",
1041 			ctrl->bRequestType, ctrl->bRequest,
1042 			wValue, wIndex, wLength);
1043 		break;
1044 	}
1045 	/* host either stalls (value < 0) or reports success */
1046 	if (value >= 0) {
1047 		req->length = value;
1048 		req->zero = value < wLength;
1049 		value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
1050 		if (value < 0) {
1051 			ERROR(dev, "%s:%d Error!\n", __func__, __LINE__);
1052 			req->status = 0;
1053 		}
1054 	}
1055 	return value;
1056 }
1057 
1058 static int printer_func_bind(struct usb_configuration *c,
1059 		struct usb_function *f)
1060 {
1061 	struct usb_gadget *gadget = c->cdev->gadget;
1062 	struct printer_dev *dev = func_to_printer(f);
1063 	struct device *pdev;
1064 	struct usb_composite_dev *cdev = c->cdev;
1065 	struct usb_ep *in_ep;
1066 	struct usb_ep *out_ep = NULL;
1067 	struct usb_request *req;
1068 	dev_t devt;
1069 	int id;
1070 	int ret;
1071 	u32 i;
1072 
1073 	id = usb_interface_id(c, f);
1074 	if (id < 0)
1075 		return id;
1076 	intf_desc.bInterfaceNumber = id;
1077 
1078 	/* finish hookup to lower layer ... */
1079 	dev->gadget = gadget;
1080 
1081 	/* all we really need is bulk IN/OUT */
1082 	in_ep = usb_ep_autoconfig(cdev->gadget, &fs_ep_in_desc);
1083 	if (!in_ep) {
1084 autoconf_fail:
1085 		dev_err(&cdev->gadget->dev, "can't autoconfigure on %s\n",
1086 			cdev->gadget->name);
1087 		return -ENODEV;
1088 	}
1089 
1090 	out_ep = usb_ep_autoconfig(cdev->gadget, &fs_ep_out_desc);
1091 	if (!out_ep)
1092 		goto autoconf_fail;
1093 
1094 	/* assumes that all endpoints are dual-speed */
1095 	hs_ep_in_desc.bEndpointAddress = fs_ep_in_desc.bEndpointAddress;
1096 	hs_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress;
1097 	ss_ep_in_desc.bEndpointAddress = fs_ep_in_desc.bEndpointAddress;
1098 	ss_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress;
1099 
1100 	ret = usb_assign_descriptors(f, fs_printer_function,
1101 			hs_printer_function, ss_printer_function,
1102 			ss_printer_function);
1103 	if (ret)
1104 		return ret;
1105 
1106 	dev->in_ep = in_ep;
1107 	dev->out_ep = out_ep;
1108 
1109 	ret = -ENOMEM;
1110 	for (i = 0; i < dev->q_len; i++) {
1111 		req = printer_req_alloc(dev->in_ep, USB_BUFSIZE, GFP_KERNEL);
1112 		if (!req)
1113 			goto fail_tx_reqs;
1114 		list_add(&req->list, &dev->tx_reqs);
1115 	}
1116 
1117 	for (i = 0; i < dev->q_len; i++) {
1118 		req = printer_req_alloc(dev->out_ep, USB_BUFSIZE, GFP_KERNEL);
1119 		if (!req)
1120 			goto fail_rx_reqs;
1121 		list_add(&req->list, &dev->rx_reqs);
1122 	}
1123 
1124 	/* Setup the sysfs files for the printer gadget. */
1125 	devt = MKDEV(major, dev->minor);
1126 	pdev = device_create(&usb_gadget_class, NULL, devt,
1127 				  NULL, "g_printer%d", dev->minor);
1128 	if (IS_ERR(pdev)) {
1129 		ERROR(dev, "Failed to create device: g_printer\n");
1130 		ret = PTR_ERR(pdev);
1131 		goto fail_rx_reqs;
1132 	}
1133 
1134 	/*
1135 	 * Register a character device as an interface to a user mode
1136 	 * program that handles the printer specific functionality.
1137 	 */
1138 	cdev_init(&dev->printer_cdev, &printer_io_operations);
1139 	dev->printer_cdev.owner = THIS_MODULE;
1140 	ret = cdev_add(&dev->printer_cdev, devt, 1);
1141 	if (ret) {
1142 		ERROR(dev, "Failed to open char device\n");
1143 		goto fail_cdev_add;
1144 	}
1145 
1146 	return 0;
1147 
1148 fail_cdev_add:
1149 	device_destroy(&usb_gadget_class, devt);
1150 
1151 fail_rx_reqs:
1152 	while (!list_empty(&dev->rx_reqs)) {
1153 		req = container_of(dev->rx_reqs.next, struct usb_request, list);
1154 		list_del(&req->list);
1155 		printer_req_free(dev->out_ep, req);
1156 	}
1157 
1158 fail_tx_reqs:
1159 	while (!list_empty(&dev->tx_reqs)) {
1160 		req = container_of(dev->tx_reqs.next, struct usb_request, list);
1161 		list_del(&req->list);
1162 		printer_req_free(dev->in_ep, req);
1163 	}
1164 
1165 	usb_free_all_descriptors(f);
1166 	return ret;
1167 
1168 }
1169 
1170 static int printer_func_set_alt(struct usb_function *f,
1171 		unsigned intf, unsigned alt)
1172 {
1173 	struct printer_dev *dev = func_to_printer(f);
1174 	int ret = -ENOTSUPP;
1175 
1176 	if (!alt)
1177 		ret = set_interface(dev, intf);
1178 
1179 	return ret;
1180 }
1181 
1182 static void printer_func_disable(struct usb_function *f)
1183 {
1184 	struct printer_dev *dev = func_to_printer(f);
1185 
1186 	printer_reset_interface(dev);
1187 }
1188 
1189 static inline struct f_printer_opts
1190 *to_f_printer_opts(struct config_item *item)
1191 {
1192 	return container_of(to_config_group(item), struct f_printer_opts,
1193 			    func_inst.group);
1194 }
1195 
1196 static void printer_attr_release(struct config_item *item)
1197 {
1198 	struct f_printer_opts *opts = to_f_printer_opts(item);
1199 
1200 	usb_put_function_instance(&opts->func_inst);
1201 }
1202 
1203 static struct configfs_item_operations printer_item_ops = {
1204 	.release	= printer_attr_release,
1205 };
1206 
1207 static ssize_t f_printer_opts_pnp_string_show(struct config_item *item,
1208 					      char *page)
1209 {
1210 	struct f_printer_opts *opts = to_f_printer_opts(item);
1211 	int result = 0;
1212 
1213 	mutex_lock(&opts->lock);
1214 	if (!opts->pnp_string)
1215 		goto unlock;
1216 
1217 	result = strscpy(page, opts->pnp_string, PAGE_SIZE);
1218 	if (result < 1) {
1219 		result = PAGE_SIZE;
1220 	} else if (page[result - 1] != '\n' && result + 1 < PAGE_SIZE) {
1221 		page[result++] = '\n';
1222 		page[result] = '\0';
1223 	}
1224 
1225 unlock:
1226 	mutex_unlock(&opts->lock);
1227 
1228 	return result;
1229 }
1230 
1231 static ssize_t f_printer_opts_pnp_string_store(struct config_item *item,
1232 					       const char *page, size_t len)
1233 {
1234 	struct f_printer_opts *opts = to_f_printer_opts(item);
1235 	char *new_pnp;
1236 	int result;
1237 
1238 	mutex_lock(&opts->lock);
1239 
1240 	new_pnp = kstrndup(page, len, GFP_KERNEL);
1241 	if (!new_pnp) {
1242 		result = -ENOMEM;
1243 		goto unlock;
1244 	}
1245 
1246 	if (opts->pnp_string_allocated)
1247 		kfree(opts->pnp_string);
1248 
1249 	opts->pnp_string_allocated = true;
1250 	opts->pnp_string = new_pnp;
1251 	result = len;
1252 unlock:
1253 	mutex_unlock(&opts->lock);
1254 
1255 	return result;
1256 }
1257 
1258 CONFIGFS_ATTR(f_printer_opts_, pnp_string);
1259 
1260 static ssize_t f_printer_opts_q_len_show(struct config_item *item,
1261 					 char *page)
1262 {
1263 	struct f_printer_opts *opts = to_f_printer_opts(item);
1264 	int result;
1265 
1266 	mutex_lock(&opts->lock);
1267 	result = sprintf(page, "%d\n", opts->q_len);
1268 	mutex_unlock(&opts->lock);
1269 
1270 	return result;
1271 }
1272 
1273 static ssize_t f_printer_opts_q_len_store(struct config_item *item,
1274 					  const char *page, size_t len)
1275 {
1276 	struct f_printer_opts *opts = to_f_printer_opts(item);
1277 	int ret;
1278 	u16 num;
1279 
1280 	mutex_lock(&opts->lock);
1281 	if (opts->refcnt) {
1282 		ret = -EBUSY;
1283 		goto end;
1284 	}
1285 
1286 	ret = kstrtou16(page, 0, &num);
1287 	if (ret)
1288 		goto end;
1289 
1290 	opts->q_len = (unsigned)num;
1291 	ret = len;
1292 end:
1293 	mutex_unlock(&opts->lock);
1294 	return ret;
1295 }
1296 
1297 CONFIGFS_ATTR(f_printer_opts_, q_len);
1298 
1299 static struct configfs_attribute *printer_attrs[] = {
1300 	&f_printer_opts_attr_pnp_string,
1301 	&f_printer_opts_attr_q_len,
1302 	NULL,
1303 };
1304 
1305 static const struct config_item_type printer_func_type = {
1306 	.ct_item_ops	= &printer_item_ops,
1307 	.ct_attrs	= printer_attrs,
1308 	.ct_owner	= THIS_MODULE,
1309 };
1310 
1311 static inline int gprinter_get_minor(void)
1312 {
1313 	int ret;
1314 
1315 	ret = ida_simple_get(&printer_ida, 0, 0, GFP_KERNEL);
1316 	if (ret >= PRINTER_MINORS) {
1317 		ida_simple_remove(&printer_ida, ret);
1318 		ret = -ENODEV;
1319 	}
1320 
1321 	return ret;
1322 }
1323 
1324 static inline void gprinter_put_minor(int minor)
1325 {
1326 	ida_simple_remove(&printer_ida, minor);
1327 }
1328 
1329 static int gprinter_setup(int);
1330 static void gprinter_cleanup(void);
1331 
1332 static void gprinter_free_inst(struct usb_function_instance *f)
1333 {
1334 	struct f_printer_opts *opts;
1335 
1336 	opts = container_of(f, struct f_printer_opts, func_inst);
1337 
1338 	mutex_lock(&printer_ida_lock);
1339 
1340 	gprinter_put_minor(opts->minor);
1341 	if (ida_is_empty(&printer_ida))
1342 		gprinter_cleanup();
1343 
1344 	mutex_unlock(&printer_ida_lock);
1345 
1346 	if (opts->pnp_string_allocated)
1347 		kfree(opts->pnp_string);
1348 	kfree(opts);
1349 }
1350 
1351 static struct usb_function_instance *gprinter_alloc_inst(void)
1352 {
1353 	struct f_printer_opts *opts;
1354 	struct usb_function_instance *ret;
1355 	int status = 0;
1356 
1357 	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
1358 	if (!opts)
1359 		return ERR_PTR(-ENOMEM);
1360 
1361 	mutex_init(&opts->lock);
1362 	opts->func_inst.free_func_inst = gprinter_free_inst;
1363 	ret = &opts->func_inst;
1364 
1365 	/* Make sure q_len is initialized, otherwise the bound device can't support read/write! */
1366 	opts->q_len = DEFAULT_Q_LEN;
1367 
1368 	mutex_lock(&printer_ida_lock);
1369 
1370 	if (ida_is_empty(&printer_ida)) {
1371 		status = gprinter_setup(PRINTER_MINORS);
1372 		if (status) {
1373 			ret = ERR_PTR(status);
1374 			kfree(opts);
1375 			goto unlock;
1376 		}
1377 	}
1378 
1379 	opts->minor = gprinter_get_minor();
1380 	if (opts->minor < 0) {
1381 		ret = ERR_PTR(opts->minor);
1382 		kfree(opts);
1383 		if (ida_is_empty(&printer_ida))
1384 			gprinter_cleanup();
1385 		goto unlock;
1386 	}
1387 	config_group_init_type_name(&opts->func_inst.group, "",
1388 				    &printer_func_type);
1389 
1390 unlock:
1391 	mutex_unlock(&printer_ida_lock);
1392 	return ret;
1393 }
1394 
1395 static void gprinter_free(struct usb_function *f)
1396 {
1397 	struct printer_dev *dev = func_to_printer(f);
1398 	struct f_printer_opts *opts;
1399 
1400 	opts = container_of(f->fi, struct f_printer_opts, func_inst);
1401 
1402 	kref_put(&dev->kref, printer_dev_free);
1403 	mutex_lock(&opts->lock);
1404 	--opts->refcnt;
1405 	mutex_unlock(&opts->lock);
1406 }
1407 
1408 static void printer_func_unbind(struct usb_configuration *c,
1409 		struct usb_function *f)
1410 {
1411 	struct printer_dev	*dev;
1412 	struct usb_request	*req;
1413 
1414 	dev = func_to_printer(f);
1415 
1416 	device_destroy(&usb_gadget_class, MKDEV(major, dev->minor));
1417 
1418 	/* Remove Character Device */
1419 	cdev_del(&dev->printer_cdev);
1420 
1421 	/* we must already have been disconnected ... no i/o may be active */
1422 	WARN_ON(!list_empty(&dev->tx_reqs_active));
1423 	WARN_ON(!list_empty(&dev->rx_reqs_active));
1424 
1425 	/* Free all memory for this driver. */
1426 	while (!list_empty(&dev->tx_reqs)) {
1427 		req = container_of(dev->tx_reqs.next, struct usb_request,
1428 				list);
1429 		list_del(&req->list);
1430 		printer_req_free(dev->in_ep, req);
1431 	}
1432 
1433 	if (dev->current_rx_req != NULL)
1434 		printer_req_free(dev->out_ep, dev->current_rx_req);
1435 
1436 	while (!list_empty(&dev->rx_reqs)) {
1437 		req = container_of(dev->rx_reqs.next,
1438 				struct usb_request, list);
1439 		list_del(&req->list);
1440 		printer_req_free(dev->out_ep, req);
1441 	}
1442 
1443 	while (!list_empty(&dev->rx_buffers)) {
1444 		req = container_of(dev->rx_buffers.next,
1445 				struct usb_request, list);
1446 		list_del(&req->list);
1447 		printer_req_free(dev->out_ep, req);
1448 	}
1449 	usb_free_all_descriptors(f);
1450 }
1451 
1452 static struct usb_function *gprinter_alloc(struct usb_function_instance *fi)
1453 {
1454 	struct printer_dev	*dev;
1455 	struct f_printer_opts	*opts;
1456 
1457 	opts = container_of(fi, struct f_printer_opts, func_inst);
1458 
1459 	mutex_lock(&opts->lock);
1460 	if (opts->minor >= minors) {
1461 		mutex_unlock(&opts->lock);
1462 		return ERR_PTR(-ENOENT);
1463 	}
1464 
1465 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
1466 	if (!dev) {
1467 		mutex_unlock(&opts->lock);
1468 		return ERR_PTR(-ENOMEM);
1469 	}
1470 
1471 	kref_init(&dev->kref);
1472 	++opts->refcnt;
1473 	dev->minor = opts->minor;
1474 	dev->pnp_string = &opts->pnp_string;
1475 	dev->q_len = opts->q_len;
1476 	mutex_unlock(&opts->lock);
1477 
1478 	dev->function.name = "printer";
1479 	dev->function.bind = printer_func_bind;
1480 	dev->function.setup = printer_func_setup;
1481 	dev->function.unbind = printer_func_unbind;
1482 	dev->function.set_alt = printer_func_set_alt;
1483 	dev->function.disable = printer_func_disable;
1484 	dev->function.req_match = gprinter_req_match;
1485 	dev->function.free_func = gprinter_free;
1486 
1487 	INIT_LIST_HEAD(&dev->tx_reqs);
1488 	INIT_LIST_HEAD(&dev->rx_reqs);
1489 	INIT_LIST_HEAD(&dev->rx_buffers);
1490 	INIT_LIST_HEAD(&dev->tx_reqs_active);
1491 	INIT_LIST_HEAD(&dev->rx_reqs_active);
1492 
1493 	spin_lock_init(&dev->lock);
1494 	mutex_init(&dev->lock_printer_io);
1495 	init_waitqueue_head(&dev->rx_wait);
1496 	init_waitqueue_head(&dev->tx_wait);
1497 	init_waitqueue_head(&dev->tx_flush_wait);
1498 
1499 	dev->interface = -1;
1500 	dev->printer_cdev_open = 0;
1501 	dev->printer_status = PRINTER_NOT_ERROR;
1502 	dev->current_rx_req = NULL;
1503 	dev->current_rx_bytes = 0;
1504 	dev->current_rx_buf = NULL;
1505 
1506 	return &dev->function;
1507 }
1508 
1509 DECLARE_USB_FUNCTION_INIT(printer, gprinter_alloc_inst, gprinter_alloc);
1510 MODULE_LICENSE("GPL");
1511 MODULE_AUTHOR("Craig Nadler");
1512 
1513 static int gprinter_setup(int count)
1514 {
1515 	int status;
1516 	dev_t devt;
1517 
1518 	status = class_register(&usb_gadget_class);
1519 	if (status)
1520 		return status;
1521 
1522 	status = alloc_chrdev_region(&devt, 0, count, "USB printer gadget");
1523 	if (status) {
1524 		pr_err("alloc_chrdev_region %d\n", status);
1525 		class_unregister(&usb_gadget_class);
1526 		return status;
1527 	}
1528 
1529 	major = MAJOR(devt);
1530 	minors = count;
1531 
1532 	return status;
1533 }
1534 
1535 static void gprinter_cleanup(void)
1536 {
1537 	if (major) {
1538 		unregister_chrdev_region(MKDEV(major, 0), minors);
1539 		major = minors = 0;
1540 	}
1541 	class_unregister(&usb_gadget_class);
1542 }
1543