drivers/usb/gadget/function/f_printer.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * f_printer.c - USB printer function driver
   4  *
   5  * Copied from drivers/usb/gadget/legacy/printer.c,
   6  * which was:
   7  *
   8  * printer.c -- Printer gadget driver
   9  *
  10  * Copyright (C) 2003-2005 David Brownell
  11  * Copyright (C) 2006 Craig W. Nadler
  12  */
  13
  14 #include <linux/module.h>
  15 #include <linux/kernel.h>
  16 #include <linux/delay.h>
  17 #include <linux/ioport.h>
  18 #include <linux/sched.h>
  19 #include <linux/slab.h>
  20 #include <linux/mutex.h>
  21 #include <linux/errno.h>
  22 #include <linux/init.h>
  23 #include <linux/idr.h>
  24 #include <linux/timer.h>
  25 #include <linux/list.h>
  26 #include <linux/interrupt.h>
  27 #include <linux/device.h>
  28 #include <linux/moduleparam.h>
  29 #include <linux/fs.h>
  30 #include <linux/poll.h>
  31 #include <linux/types.h>
  32 #include <linux/ctype.h>
  33 #include <linux/cdev.h>
  34 #include <linux/kref.h>
  35
  36 #include <asm/byteorder.h>
  37 #include <linux/io.h>
  38 #include <linux/irq.h>
  39 #include <linux/uaccess.h>
  40 #include <asm/unaligned.h>
  41
  42 #include <linux/usb/ch9.h>
  43 #include <linux/usb/composite.h>
  44 #include <linux/usb/gadget.h>
  45 #include <linux/usb/g_printer.h>
  46
  47 #include "u_printer.h"
  48
  49 #define PRINTER_MINORS          4
  50 #define GET_DEVICE_ID           0
  51 #define GET_PORT_STATUS         1
  52 #define SOFT_RESET              2
  53
  54 #define DEFAULT_Q_LEN           10 /* same as legacy g_printer gadget */
  55
  56 static int major, minors;
  57 static const struct class usb_gadget_class = {
  58         .name = "usb_printer_gadget",
  59 };
  60
  61 static DEFINE_IDA(printer_ida);
  62 static DEFINE_MUTEX(printer_ida_lock); /* protects access do printer_ida */
  63
  64 /*-------------------------------------------------------------------------*/
  65
  66 struct printer_dev {
  67         spinlock_t              lock;           /* lock this structure */
  68         /* lock buffer lists during read/write calls */
  69         struct mutex            lock_printer_io;
  70         struct usb_gadget       *gadget;
  71         s8                      interface;
  72         struct usb_ep           *in_ep, *out_ep;
  73         struct kref             kref;
  74         struct list_head        rx_reqs;        /* List of free RX structs */
  75         struct list_head        rx_reqs_active; /* List of Active RX xfers */
  76         struct list_head        rx_buffers;     /* List of completed xfers */
  77         /* wait until there is data to be read. */
  78         wait_queue_head_t       rx_wait;
  79         struct list_head        tx_reqs;        /* List of free TX structs */
  80         struct list_head        tx_reqs_active; /* List of Active TX xfers */
  81         /* Wait until there are write buffers available to use. */
  82         wait_queue_head_t       tx_wait;
  83         /* Wait until all write buffers have been sent. */
  84         wait_queue_head_t       tx_flush_wait;
  85         struct usb_request      *current_rx_req;
  86         size_t                  current_rx_bytes;
  87         u8                      *current_rx_buf;
  88         u8                      printer_status;
  89         u8                      reset_printer;
  90         int                     minor;
  91         struct cdev             printer_cdev;
  92         u8                      printer_cdev_open;
  93         wait_queue_head_t       wait;
  94         unsigned                q_len;
  95         char                    **pnp_string;   /* We don't own memory! */
  96         struct usb_function     function;
  97 };
  98
  99 static inline struct printer_dev *func_to_printer(struct usb_function *f)
 100 {
 101         return container_of(f, struct printer_dev, function);
 102 }
 103
 104 /*-------------------------------------------------------------------------*/
 105
 106 /*
 107  * DESCRIPTORS ... most are static, but strings and (full) configuration
 108  * descriptors are built on demand.
 109  */
 110
 111 /* holds our biggest descriptor */
 112 #define USB_DESC_BUFSIZE                256
 113 #define USB_BUFSIZE                     8192
 114
 115 static struct usb_interface_descriptor intf_desc = {
 116         .bLength =              sizeof(intf_desc),
 117         .bDescriptorType =      USB_DT_INTERFACE,
 118         .bNumEndpoints =        2,
 119         .bInterfaceClass =      USB_CLASS_PRINTER,
 120         .bInterfaceSubClass =   1,      /* Printer Sub-Class */
 121         .bInterfaceProtocol =   2,      /* Bi-Directional */
 122         .iInterface =           0
 123 };
 124
 125 static struct usb_endpoint_descriptor fs_ep_in_desc = {
 126         .bLength =              USB_DT_ENDPOINT_SIZE,
 127         .bDescriptorType =      USB_DT_ENDPOINT,
 128         .bEndpointAddress =     USB_DIR_IN,
 129         .bmAttributes =         USB_ENDPOINT_XFER_BULK
 130 };
 131
 132 static struct usb_endpoint_descriptor fs_ep_out_desc = {
 133         .bLength =              USB_DT_ENDPOINT_SIZE,
 134         .bDescriptorType =      USB_DT_ENDPOINT,
 135         .bEndpointAddress =     USB_DIR_OUT,
 136         .bmAttributes =         USB_ENDPOINT_XFER_BULK
 137 };
 138
 139 static struct usb_descriptor_header *fs_printer_function[] = {
 140         (struct usb_descriptor_header *) &intf_desc,
 141         (struct usb_descriptor_header *) &fs_ep_in_desc,
 142         (struct usb_descriptor_header *) &fs_ep_out_desc,
 143         NULL
 144 };
 145
 146 /*
 147  * usb 2.0 devices need to expose both high speed and full speed
 148  * descriptors, unless they only run at full speed.
 149  */
 150
 151 static struct usb_endpoint_descriptor hs_ep_in_desc = {
 152         .bLength =              USB_DT_ENDPOINT_SIZE,
 153         .bDescriptorType =      USB_DT_ENDPOINT,
 154         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
 155         .wMaxPacketSize =       cpu_to_le16(512)
 156 };
 157
 158 static struct usb_endpoint_descriptor hs_ep_out_desc = {
 159         .bLength =              USB_DT_ENDPOINT_SIZE,
 160         .bDescriptorType =      USB_DT_ENDPOINT,
 161         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
 162         .wMaxPacketSize =       cpu_to_le16(512)
 163 };
 164
 165 static struct usb_descriptor_header *hs_printer_function[] = {
 166         (struct usb_descriptor_header *) &intf_desc,
 167         (struct usb_descriptor_header *) &hs_ep_in_desc,
 168         (struct usb_descriptor_header *) &hs_ep_out_desc,
 169         NULL
 170 };
 171
 172 /*
 173  * Added endpoint descriptors for 3.0 devices
 174  */
 175
 176 static struct usb_endpoint_descriptor ss_ep_in_desc = {
 177         .bLength =              USB_DT_ENDPOINT_SIZE,
 178         .bDescriptorType =      USB_DT_ENDPOINT,
 179         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
 180         .wMaxPacketSize =       cpu_to_le16(1024),
 181 };
 182
 183 static struct usb_ss_ep_comp_descriptor ss_ep_in_comp_desc = {
 184         .bLength =              sizeof(ss_ep_in_comp_desc),
 185         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
 186 };
 187
 188 static struct usb_endpoint_descriptor ss_ep_out_desc = {
 189         .bLength =              USB_DT_ENDPOINT_SIZE,
 190         .bDescriptorType =      USB_DT_ENDPOINT,
 191         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
 192         .wMaxPacketSize =       cpu_to_le16(1024),
 193 };
 194
 195 static struct usb_ss_ep_comp_descriptor ss_ep_out_comp_desc = {
 196         .bLength =              sizeof(ss_ep_out_comp_desc),
 197         .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
 198 };
 199
 200 static struct usb_descriptor_header *ss_printer_function[] = {
 201         (struct usb_descriptor_header *) &intf_desc,
 202         (struct usb_descriptor_header *) &ss_ep_in_desc,
 203         (struct usb_descriptor_header *) &ss_ep_in_comp_desc,
 204         (struct usb_descriptor_header *) &ss_ep_out_desc,
 205         (struct usb_descriptor_header *) &ss_ep_out_comp_desc,
 206         NULL
 207 };
 208
 209 /* maxpacket and other transfer characteristics vary by speed. */
 210 static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget,
 211                                         struct usb_endpoint_descriptor *fs,
 212                                         struct usb_endpoint_descriptor *hs,
 213                                         struct usb_endpoint_descriptor *ss)
 214 {
 215         switch (gadget->speed) {
 216         case USB_SPEED_SUPER:
 217                 return ss;
 218         case USB_SPEED_HIGH:
 219                 return hs;
 220         default:
 221                 return fs;
 222         }
 223 }
 224
 225 /*-------------------------------------------------------------------------*/
 226
 227 static void printer_dev_free(struct kref *kref)
 228 {
 229         struct printer_dev *dev = container_of(kref, struct printer_dev, kref);
 230
 231         kfree(dev);
 232 }
 233
 234 static struct usb_request *
 235 printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags)
 236 {
 237         struct usb_request      *req;
 238
 239         req = usb_ep_alloc_request(ep, gfp_flags);
 240
 241         if (req != NULL) {
 242                 req->length = len;
 243                 req->buf = kmalloc(len, gfp_flags);
 244                 if (req->buf == NULL) {
 245                         usb_ep_free_request(ep, req);
 246                         return NULL;
 247                 }
 248         }
 249
 250         return req;
 251 }
 252
 253 static void
 254 printer_req_free(struct usb_ep *ep, struct usb_request *req)
 255 {
 256         if (ep != NULL && req != NULL) {
 257                 kfree(req->buf);
 258                 usb_ep_free_request(ep, req);
 259         }
 260 }
 261
 262 /*-------------------------------------------------------------------------*/
 263
 264 static void rx_complete(struct usb_ep *ep, struct usb_request *req)
 265 {
 266         struct printer_dev      *dev = ep->driver_data;
 267         int                     status = req->status;
 268         unsigned long           flags;
 269
 270         spin_lock_irqsave(&dev->lock, flags);
 271
 272         list_del_init(&req->list);      /* Remode from Active List */
 273
 274         switch (status) {
 275
 276         /* normal completion */
 277         case 0:
 278                 if (req->actual > 0) {
 279                         list_add_tail(&req->list, &dev->rx_buffers);
 280                         DBG(dev, "G_Printer : rx length %d\n", req->actual);
 281                 } else {
 282                         list_add(&req->list, &dev->rx_reqs);
 283                 }
 284                 break;
 285
 286         /* software-driven interface shutdown */
 287         case -ECONNRESET:               /* unlink */
 288         case -ESHUTDOWN:                /* disconnect etc */
 289                 VDBG(dev, "rx shutdown, code %d\n", status);
 290                 list_add(&req->list, &dev->rx_reqs);
 291                 break;
 292
 293         /* for hardware automagic (such as pxa) */
 294         case -ECONNABORTED:             /* endpoint reset */
 295                 DBG(dev, "rx %s reset\n", ep->name);
 296                 list_add(&req->list, &dev->rx_reqs);
 297                 break;
 298
 299         /* data overrun */
 300         case -EOVERFLOW:
 301                 fallthrough;
 302
 303         default:
 304                 DBG(dev, "rx status %d\n", status);
 305                 list_add(&req->list, &dev->rx_reqs);
 306                 break;
 307         }
 308
 309         wake_up_interruptible(&dev->rx_wait);
 310         spin_unlock_irqrestore(&dev->lock, flags);
 311 }
 312
 313 static void tx_complete(struct usb_ep *ep, struct usb_request *req)
 314 {
 315         struct printer_dev      *dev = ep->driver_data;
 316
 317         switch (req->status) {
 318         default:
 319                 VDBG(dev, "tx err %d\n", req->status);
 320                 fallthrough;
 321         case -ECONNRESET:               /* unlink */
 322         case -ESHUTDOWN:                /* disconnect etc */
 323                 break;
 324         case 0:
 325                 break;
 326         }
 327
 328         spin_lock(&dev->lock);
 329         /* Take the request struct off the active list and put it on the
 330          * free list.
 331          */
 332         list_del_init(&req->list);
 333         list_add(&req->list, &dev->tx_reqs);
 334         wake_up_interruptible(&dev->tx_wait);
 335         if (likely(list_empty(&dev->tx_reqs_active)))
 336                 wake_up_interruptible(&dev->tx_flush_wait);
 337
 338         spin_unlock(&dev->lock);
 339 }
 340
 341 /*-------------------------------------------------------------------------*/
 342
 343 static int
 344 printer_open(struct inode *inode, struct file *fd)
 345 {
 346         struct printer_dev      *dev;
 347         unsigned long           flags;
 348         int                     ret = -EBUSY;
 349
 350         dev = container_of(inode->i_cdev, struct printer_dev, printer_cdev);
 351
 352         spin_lock_irqsave(&dev->lock, flags);
 353
 354         if (dev->interface < 0) {
 355                 spin_unlock_irqrestore(&dev->lock, flags);
 356                 return -ENODEV;
 357         }
 358
 359         if (!dev->printer_cdev_open) {
 360                 dev->printer_cdev_open = 1;
 361                 fd->private_data = dev;
 362                 ret = 0;
 363                 /* Change the printer status to show that it's on-line. */
 364                 dev->printer_status |= PRINTER_SELECTED;
 365         }
 366
 367         spin_unlock_irqrestore(&dev->lock, flags);
 368
 369         kref_get(&dev->kref);
 370
 371         return ret;
 372 }
 373
 374 static int
 375 printer_close(struct inode *inode, struct file *fd)
 376 {
 377         struct printer_dev      *dev = fd->private_data;
 378         unsigned long           flags;
 379
 380         spin_lock_irqsave(&dev->lock, flags);
 381         dev->printer_cdev_open = 0;
 382         fd->private_data = NULL;
 383         /* Change printer status to show that the printer is off-line. */
 384         dev->printer_status &= ~PRINTER_SELECTED;
 385         spin_unlock_irqrestore(&dev->lock, flags);
 386
 387         kref_put(&dev->kref, printer_dev_free);
 388
 389         return 0;
 390 }
 391
 392 /* This function must be called with interrupts turned off. */
 393 static void
 394 setup_rx_reqs(struct printer_dev *dev)
 395 {
 396         struct usb_request              *req;
 397
 398         while (likely(!list_empty(&dev->rx_reqs))) {
 399                 int error;
 400
 401                 req = container_of(dev->rx_reqs.next,
 402                                 struct usb_request, list);
 403                 list_del_init(&req->list);
 404
 405                 /* The USB Host sends us whatever amount of data it wants to
 406                  * so we always set the length field to the full USB_BUFSIZE.
 407                  * If the amount of data is more than the read() caller asked
 408                  * for it will be stored in the request buffer until it is
 409                  * asked for by read().
 410                  */
 411                 req->length = USB_BUFSIZE;
 412                 req->complete = rx_complete;
 413
 414                 /* here, we unlock, and only unlock, to avoid deadlock. */
 415                 spin_unlock(&dev->lock);
 416                 error = usb_ep_queue(dev->out_ep, req, GFP_ATOMIC);
 417                 spin_lock(&dev->lock);
 418                 if (error) {
 419                         DBG(dev, "rx submit --> %d\n", error);
 420                         list_add(&req->list, &dev->rx_reqs);
 421                         break;
 422                 }
 423                 /* if the req is empty, then add it into dev->rx_reqs_active. */
 424                 else if (list_empty(&req->list))
 425                         list_add(&req->list, &dev->rx_reqs_active);
 426         }
 427 }
 428
 429 static ssize_t
 430 printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
 431 {
 432         struct printer_dev              *dev = fd->private_data;
 433         unsigned long                   flags;
 434         size_t                          size;
 435         size_t                          bytes_copied;
 436         struct usb_request              *req;
 437         /* This is a pointer to the current USB rx request. */
 438         struct usb_request              *current_rx_req;
 439         /* This is the number of bytes in the current rx buffer. */
 440         size_t                          current_rx_bytes;
 441         /* This is a pointer to the current rx buffer. */
 442         u8                              *current_rx_buf;
 443
 444         if (len == 0)
 445                 return -EINVAL;
 446
 447         DBG(dev, "printer_read trying to read %d bytes\n", (int)len);
 448
 449         mutex_lock(&dev->lock_printer_io);
 450         spin_lock_irqsave(&dev->lock, flags);
 451
 452         if (dev->interface < 0) {
 453                 spin_unlock_irqrestore(&dev->lock, flags);
 454                 mutex_unlock(&dev->lock_printer_io);
 455                 return -ENODEV;
 456         }
 457
 458         /* We will use this flag later to check if a printer reset happened
 459          * after we turn interrupts back on.
 460          */
 461         dev->reset_printer = 0;
 462
 463         setup_rx_reqs(dev);
 464
 465         bytes_copied = 0;
 466         current_rx_req = dev->current_rx_req;
 467         current_rx_bytes = dev->current_rx_bytes;
 468         current_rx_buf = dev->current_rx_buf;
 469         dev->current_rx_req = NULL;
 470         dev->current_rx_bytes = 0;
 471         dev->current_rx_buf = NULL;
 472
 473         /* Check if there is any data in the read buffers. Please note that
 474          * current_rx_bytes is the number of bytes in the current rx buffer.
 475          * If it is zero then check if there are any other rx_buffers that
 476          * are on the completed list. We are only out of data if all rx
 477          * buffers are empty.
 478          */
 479         if ((current_rx_bytes == 0) &&
 480                         (likely(list_empty(&dev->rx_buffers)))) {
 481                 /* Turn interrupts back on before sleeping. */
 482                 spin_unlock_irqrestore(&dev->lock, flags);
 483
 484                 /*
 485                  * If no data is available check if this is a NON-Blocking
 486                  * call or not.
 487                  */
 488                 if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
 489                         mutex_unlock(&dev->lock_printer_io);
 490                         return -EAGAIN;
 491                 }
 492
 493                 /* Sleep until data is available */
 494                 wait_event_interruptible(dev->rx_wait,
 495                                 (likely(!list_empty(&dev->rx_buffers))));
 496                 spin_lock_irqsave(&dev->lock, flags);
 497         }
 498
 499         /* We have data to return then copy it to the caller's buffer.*/
 500         while ((current_rx_bytes || likely(!list_empty(&dev->rx_buffers)))
 501                         && len) {
 502                 if (current_rx_bytes == 0) {
 503                         req = container_of(dev->rx_buffers.next,
 504                                         struct usb_request, list);
 505                         list_del_init(&req->list);
 506
 507                         if (req->actual && req->buf) {
 508                                 current_rx_req = req;
 509                                 current_rx_bytes = req->actual;
 510                                 current_rx_buf = req->buf;
 511                         } else {
 512                                 list_add(&req->list, &dev->rx_reqs);
 513                                 continue;
 514                         }
 515                 }
 516
 517                 /* Don't leave irqs off while doing memory copies */
 518                 spin_unlock_irqrestore(&dev->lock, flags);
 519
 520                 if (len > current_rx_bytes)
 521                         size = current_rx_bytes;
 522                 else
 523                         size = len;
 524
 525                 size -= copy_to_user(buf, current_rx_buf, size);
 526                 bytes_copied += size;
 527                 len -= size;
 528                 buf += size;
 529
 530                 spin_lock_irqsave(&dev->lock, flags);
 531
 532                 /* We've disconnected or reset so return. */
 533                 if (dev->reset_printer) {
 534                         list_add(&current_rx_req->list, &dev->rx_reqs);
 535                         spin_unlock_irqrestore(&dev->lock, flags);
 536                         mutex_unlock(&dev->lock_printer_io);
 537                         return -EAGAIN;
 538                 }
 539
 540                 /* If we not returning all the data left in this RX request
 541                  * buffer then adjust the amount of data left in the buffer.
 542                  * Othewise if we are done with this RX request buffer then
 543                  * requeue it to get any incoming data from the USB host.
 544                  */
 545                 if (size < current_rx_bytes) {
 546                         current_rx_bytes -= size;
 547                         current_rx_buf += size;
 548                 } else {
 549                         list_add(&current_rx_req->list, &dev->rx_reqs);
 550                         current_rx_bytes = 0;
 551                         current_rx_buf = NULL;
 552                         current_rx_req = NULL;
 553                 }
 554         }
 555
 556         dev->current_rx_req = current_rx_req;
 557         dev->current_rx_bytes = current_rx_bytes;
 558         dev->current_rx_buf = current_rx_buf;
 559
 560         spin_unlock_irqrestore(&dev->lock, flags);
 561         mutex_unlock(&dev->lock_printer_io);
 562
 563         DBG(dev, "printer_read returned %d bytes\n", (int)bytes_copied);
 564
 565         if (bytes_copied)
 566                 return bytes_copied;
 567         else
 568                 return -EAGAIN;
 569 }
 570
 571 static ssize_t
 572 printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 573 {
 574         struct printer_dev      *dev = fd->private_data;
 575         unsigned long           flags;
 576         size_t                  size;   /* Amount of data in a TX request. */
 577         size_t                  bytes_copied = 0;
 578         struct usb_request      *req;
 579         int                     value;
 580
 581         DBG(dev, "printer_write trying to send %d bytes\n", (int)len);
 582
 583         if (len == 0)
 584                 return -EINVAL;
 585
 586         mutex_lock(&dev->lock_printer_io);
 587         spin_lock_irqsave(&dev->lock, flags);
 588
 589         if (dev->interface < 0) {
 590                 spin_unlock_irqrestore(&dev->lock, flags);
 591                 mutex_unlock(&dev->lock_printer_io);
 592                 return -ENODEV;
 593         }
 594
 595         /* Check if a printer reset happens while we have interrupts on */
 596         dev->reset_printer = 0;
 597
 598         /* Check if there is any available write buffers */
 599         if (likely(list_empty(&dev->tx_reqs))) {
 600                 /* Turn interrupts back on before sleeping. */
 601                 spin_unlock_irqrestore(&dev->lock, flags);
 602
 603                 /*
 604                  * If write buffers are available check if this is
 605                  * a NON-Blocking call or not.
 606                  */
 607                 if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
 608                         mutex_unlock(&dev->lock_printer_io);
 609                         return -EAGAIN;
 610                 }
 611
 612                 /* Sleep until a write buffer is available */
 613                 wait_event_interruptible(dev->tx_wait,
 614                                 (likely(!list_empty(&dev->tx_reqs))));
 615                 spin_lock_irqsave(&dev->lock, flags);
 616         }
 617
 618         while (likely(!list_empty(&dev->tx_reqs)) && len) {
 619
 620                 if (len > USB_BUFSIZE)
 621                         size = USB_BUFSIZE;
 622                 else
 623                         size = len;
 624
 625                 req = container_of(dev->tx_reqs.next, struct usb_request,
 626                                 list);
 627                 list_del_init(&req->list);
 628
 629                 req->complete = tx_complete;
 630                 req->length = size;
 631
 632                 /* Check if we need to send a zero length packet. */
 633                 if (len > size)
 634                         /* They will be more TX requests so no yet. */
 635                         req->zero = 0;
 636                 else
 637                         /* If the data amount is not a multiple of the
 638                          * maxpacket size then send a zero length packet.
 639                          */
 640                         req->zero = ((len % dev->in_ep->maxpacket) == 0);
 641
 642                 /* Don't leave irqs off while doing memory copies */
 643                 spin_unlock_irqrestore(&dev->lock, flags);
 644
 645                 if (copy_from_user(req->buf, buf, size)) {
 646                         list_add(&req->list, &dev->tx_reqs);
 647                         mutex_unlock(&dev->lock_printer_io);
 648                         return bytes_copied;
 649                 }
 650
 651                 bytes_copied += size;
 652                 len -= size;
 653                 buf += size;
 654
 655                 spin_lock_irqsave(&dev->lock, flags);
 656
 657                 /* We've disconnected or reset so free the req and buffer */
 658                 if (dev->reset_printer) {
 659                         list_add(&req->list, &dev->tx_reqs);
 660                         spin_unlock_irqrestore(&dev->lock, flags);
 661                         mutex_unlock(&dev->lock_printer_io);
 662                         return -EAGAIN;
 663                 }
 664
 665                 list_add(&req->list, &dev->tx_reqs_active);
 666
 667                 /* here, we unlock, and only unlock, to avoid deadlock. */
 668                 spin_unlock(&dev->lock);
 669                 value = usb_ep_queue(dev->in_ep, req, GFP_ATOMIC);
 670                 spin_lock(&dev->lock);
 671                 if (value) {
 672                         list_move(&req->list, &dev->tx_reqs);
 673                         spin_unlock_irqrestore(&dev->lock, flags);
 674                         mutex_unlock(&dev->lock_printer_io);
 675                         return -EAGAIN;
 676                 }
 677         }
 678
 679         spin_unlock_irqrestore(&dev->lock, flags);
 680         mutex_unlock(&dev->lock_printer_io);
 681
 682         DBG(dev, "printer_write sent %d bytes\n", (int)bytes_copied);
 683
 684         if (bytes_copied)
 685                 return bytes_copied;
 686         else
 687                 return -EAGAIN;
 688 }
 689
 690 static int
 691 printer_fsync(struct file *fd, loff_t start, loff_t end, int datasync)
 692 {
 693         struct printer_dev      *dev = fd->private_data;
 694         struct inode *inode = file_inode(fd);
 695         unsigned long           flags;
 696         int                     tx_list_empty;
 697
 698         inode_lock(inode);
 699         spin_lock_irqsave(&dev->lock, flags);
 700
 701         if (dev->interface < 0) {
 702                 spin_unlock_irqrestore(&dev->lock, flags);
 703                 inode_unlock(inode);
 704                 return -ENODEV;
 705         }
 706
 707         tx_list_empty = (likely(list_empty(&dev->tx_reqs)));
 708         spin_unlock_irqrestore(&dev->lock, flags);
 709
 710         if (!tx_list_empty) {
 711                 /* Sleep until all data has been sent */
 712                 wait_event_interruptible(dev->tx_flush_wait,
 713                                 (likely(list_empty(&dev->tx_reqs_active))));
 714         }
 715         inode_unlock(inode);
 716
 717         return 0;
 718 }
 719
 720 static __poll_t
 721 printer_poll(struct file *fd, poll_table *wait)
 722 {
 723         struct printer_dev      *dev = fd->private_data;
 724         unsigned long           flags;
 725         __poll_t                status = 0;
 726
 727         mutex_lock(&dev->lock_printer_io);
 728         spin_lock_irqsave(&dev->lock, flags);
 729
 730         if (dev->interface < 0) {
 731                 spin_unlock_irqrestore(&dev->lock, flags);
 732                 mutex_unlock(&dev->lock_printer_io);
 733                 return EPOLLERR | EPOLLHUP;
 734         }
 735
 736         setup_rx_reqs(dev);
 737         spin_unlock_irqrestore(&dev->lock, flags);
 738         mutex_unlock(&dev->lock_printer_io);
 739
 740         poll_wait(fd, &dev->rx_wait, wait);
 741         poll_wait(fd, &dev->tx_wait, wait);
 742
 743         spin_lock_irqsave(&dev->lock, flags);
 744         if (likely(!list_empty(&dev->tx_reqs)))
 745                 status |= EPOLLOUT | EPOLLWRNORM;
 746
 747         if (likely(dev->current_rx_bytes) ||
 748                         likely(!list_empty(&dev->rx_buffers)))
 749                 status |= EPOLLIN | EPOLLRDNORM;
 750
 751         spin_unlock_irqrestore(&dev->lock, flags);
 752
 753         return status;
 754 }
 755
 756 static long
 757 printer_ioctl(struct file *fd, unsigned int code, unsigned long arg)
 758 {
 759         struct printer_dev      *dev = fd->private_data;
 760         unsigned long           flags;
 761         int                     status = 0;
 762
 763         DBG(dev, "printer_ioctl: cmd=0x%4.4x, arg=%lu\n", code, arg);
 764
 765         /* handle ioctls */
 766
 767         spin_lock_irqsave(&dev->lock, flags);
 768
 769         if (dev->interface < 0) {
 770                 spin_unlock_irqrestore(&dev->lock, flags);
 771                 return -ENODEV;
 772         }
 773
 774         switch (code) {
 775         case GADGET_GET_PRINTER_STATUS:
 776                 status = (int)dev->printer_status;
 777                 break;
 778         case GADGET_SET_PRINTER_STATUS:
 779                 dev->printer_status = (u8)arg;
 780                 break;
 781         default:
 782                 /* could not handle ioctl */
 783                 DBG(dev, "printer_ioctl: ERROR cmd=0x%4.4xis not supported\n",
 784                                 code);
 785                 status = -ENOTTY;
 786         }
 787
 788         spin_unlock_irqrestore(&dev->lock, flags);
 789
 790         return status;
 791 }
 792
 793 /* used after endpoint configuration */
 794 static const struct file_operations printer_io_operations = {
 795         .owner =        THIS_MODULE,
 796         .open =         printer_open,
 797         .read =         printer_read,
 798         .write =        printer_write,
 799         .fsync =        printer_fsync,
 800         .poll =         printer_poll,
 801         .unlocked_ioctl = printer_ioctl,
 802         .release =      printer_close,
 803         .llseek =       noop_llseek,
 804 };
 805
 806 /*-------------------------------------------------------------------------*/
 807
 808 static int
 809 set_printer_interface(struct printer_dev *dev)
 810 {
 811         int                     result = 0;
 812
 813         dev->in_ep->desc = ep_desc(dev->gadget, &fs_ep_in_desc, &hs_ep_in_desc,
 814                                 &ss_ep_in_desc);
 815         dev->in_ep->driver_data = dev;
 816
 817         dev->out_ep->desc = ep_desc(dev->gadget, &fs_ep_out_desc,
 818                                     &hs_ep_out_desc, &ss_ep_out_desc);
 819         dev->out_ep->driver_data = dev;
 820
 821         result = usb_ep_enable(dev->in_ep);
 822         if (result != 0) {
 823                 DBG(dev, "enable %s --> %d\n", dev->in_ep->name, result);
 824                 goto done;
 825         }
 826
 827         result = usb_ep_enable(dev->out_ep);
 828         if (result != 0) {
 829                 DBG(dev, "enable %s --> %d\n", dev->out_ep->name, result);
 830                 goto done;
 831         }
 832
 833 done:
 834         /* on error, disable any endpoints  */
 835         if (result != 0) {
 836                 (void) usb_ep_disable(dev->in_ep);
 837                 (void) usb_ep_disable(dev->out_ep);
 838                 dev->in_ep->desc = NULL;
 839                 dev->out_ep->desc = NULL;
 840         }
 841
 842         /* caller is responsible for cleanup on error */
 843         return result;
 844 }
 845
 846 static void printer_reset_interface(struct printer_dev *dev)
 847 {
 848         unsigned long   flags;
 849
 850         if (dev->interface < 0)
 851                 return;
 852
 853         if (dev->in_ep->desc)
 854                 usb_ep_disable(dev->in_ep);
 855
 856         if (dev->out_ep->desc)
 857                 usb_ep_disable(dev->out_ep);
 858
 859         spin_lock_irqsave(&dev->lock, flags);
 860         dev->in_ep->desc = NULL;
 861         dev->out_ep->desc = NULL;
 862         dev->interface = -1;
 863         spin_unlock_irqrestore(&dev->lock, flags);
 864 }
 865
 866 /* Change our operational Interface. */
 867 static int set_interface(struct printer_dev *dev, unsigned number)
 868 {
 869         int                     result = 0;
 870
 871         /* Free the current interface */
 872         printer_reset_interface(dev);
 873
 874         result = set_printer_interface(dev);
 875         if (result)
 876                 printer_reset_interface(dev);
 877         else
 878                 dev->interface = number;
 879
 880         if (!result)
 881                 INFO(dev, "Using interface %x\n", number);
 882
 883         return result;
 884 }
 885
 886 static void printer_soft_reset(struct printer_dev *dev)
 887 {
 888         struct usb_request      *req;
 889
 890         if (usb_ep_disable(dev->in_ep))
 891                 DBG(dev, "Failed to disable USB in_ep\n");
 892         if (usb_ep_disable(dev->out_ep))
 893                 DBG(dev, "Failed to disable USB out_ep\n");
 894
 895         if (dev->current_rx_req != NULL) {
 896                 list_add(&dev->current_rx_req->list, &dev->rx_reqs);
 897                 dev->current_rx_req = NULL;
 898         }
 899         dev->current_rx_bytes = 0;
 900         dev->current_rx_buf = NULL;
 901         dev->reset_printer = 1;
 902
 903         while (likely(!(list_empty(&dev->rx_buffers)))) {
 904                 req = container_of(dev->rx_buffers.next, struct usb_request,
 905                                 list);
 906                 list_del_init(&req->list);
 907                 list_add(&req->list, &dev->rx_reqs);
 908         }
 909
 910         while (likely(!(list_empty(&dev->rx_reqs_active)))) {
 911                 req = container_of(dev->rx_buffers.next, struct usb_request,
 912                                 list);
 913                 list_del_init(&req->list);
 914                 list_add(&req->list, &dev->rx_reqs);
 915         }
 916
 917         while (likely(!(list_empty(&dev->tx_reqs_active)))) {
 918                 req = container_of(dev->tx_reqs_active.next,
 919                                 struct usb_request, list);
 920                 list_del_init(&req->list);
 921                 list_add(&req->list, &dev->tx_reqs);
 922         }
 923
 924         if (usb_ep_enable(dev->in_ep))
 925                 DBG(dev, "Failed to enable USB in_ep\n");
 926         if (usb_ep_enable(dev->out_ep))
 927                 DBG(dev, "Failed to enable USB out_ep\n");
 928
 929         wake_up_interruptible(&dev->rx_wait);
 930         wake_up_interruptible(&dev->tx_wait);
 931         wake_up_interruptible(&dev->tx_flush_wait);
 932 }
 933
 934 /*-------------------------------------------------------------------------*/
 935
 936 static bool gprinter_req_match(struct usb_function *f,
 937                                const struct usb_ctrlrequest *ctrl,
 938                                bool config0)
 939 {
 940         struct printer_dev      *dev = func_to_printer(f);
 941         u16                     w_index = le16_to_cpu(ctrl->wIndex);
 942         u16                     w_value = le16_to_cpu(ctrl->wValue);
 943         u16                     w_length = le16_to_cpu(ctrl->wLength);
 944
 945         if (config0)
 946                 return false;
 947
 948         if ((ctrl->bRequestType & USB_RECIP_MASK) != USB_RECIP_INTERFACE ||
 949             (ctrl->bRequestType & USB_TYPE_MASK) != USB_TYPE_CLASS)
 950                 return false;
 951
 952         switch (ctrl->bRequest) {
 953         case GET_DEVICE_ID:
 954                 w_index >>= 8;
 955                 if (USB_DIR_IN & ctrl->bRequestType)
 956                         break;
 957                 return false;
 958         case GET_PORT_STATUS:
 959                 if (!w_value && w_length == 1 &&
 960                     (USB_DIR_IN & ctrl->bRequestType))
 961                         break;
 962                 return false;
 963         case SOFT_RESET:
 964                 if (!w_value && !w_length &&
 965                    !(USB_DIR_IN & ctrl->bRequestType))
 966                         break;
 967                 fallthrough;
 968         default:
 969                 return false;
 970         }
 971         return w_index == dev->interface;
 972 }
 973
 974 /*
 975  * The setup() callback implements all the ep0 functionality that's not
 976  * handled lower down.
 977  */
 978 static int printer_func_setup(struct usb_function *f,
 979                 const struct usb_ctrlrequest *ctrl)
 980 {
 981         struct printer_dev *dev = func_to_printer(f);
 982         struct usb_composite_dev *cdev = f->config->cdev;
 983         struct usb_request      *req = cdev->req;
 984         u8                      *buf = req->buf;
 985         int                     value = -EOPNOTSUPP;
 986         u16                     wIndex = le16_to_cpu(ctrl->wIndex);
 987         u16                     wValue = le16_to_cpu(ctrl->wValue);
 988         u16                     wLength = le16_to_cpu(ctrl->wLength);
 989
 990         DBG(dev, "ctrl req%02x.%02x v%04x i%04x l%d\n",
 991                 ctrl->bRequestType, ctrl->bRequest, wValue, wIndex, wLength);
 992
 993         switch (ctrl->bRequestType&USB_TYPE_MASK) {
 994         case USB_TYPE_CLASS:
 995                 switch (ctrl->bRequest) {
 996                 case GET_DEVICE_ID: /* Get the IEEE-1284 PNP String */
 997                         /* Only one printer interface is supported. */
 998                         if ((wIndex>>8) != dev->interface)
 999                                 break;
1000
1001                         if (!*dev->pnp_string) {
1002                                 value = 0;
1003                                 break;
1004                         }
1005                         value = strlen(*dev->pnp_string);
1006                         buf[0] = (value >> 8) & 0xFF;
1007                         buf[1] = value & 0xFF;
1008                         memcpy(buf + 2, *dev->pnp_string, value);
1009                         DBG(dev, "1284 PNP String: %x %s\n", value,
1010                             *dev->pnp_string);
1011                         break;
1012
1013                 case GET_PORT_STATUS: /* Get Port Status */
1014                         /* Only one printer interface is supported. */
1015                         if (wIndex != dev->interface)
1016                                 break;
1017
1018                         buf[0] = dev->printer_status;
1019                         value = min_t(u16, wLength, 1);
1020                         break;
1021
1022                 case SOFT_RESET: /* Soft Reset */
1023                         /* Only one printer interface is supported. */
1024                         if (wIndex != dev->interface)
1025                                 break;
1026
1027                         printer_soft_reset(dev);
1028
1029                         value = 0;
1030                         break;
1031
1032                 default:
1033                         goto unknown;
1034                 }
1035                 break;
1036
1037         default:
1038 unknown:
1039                 VDBG(dev,
1040                         "unknown ctrl req%02x.%02x v%04x i%04x l%d\n",
1041                         ctrl->bRequestType, ctrl->bRequest,
1042                         wValue, wIndex, wLength);
1043                 break;
1044         }
1045         /* host either stalls (value < 0) or reports success */
1046         if (value >= 0) {
1047                 req->length = value;
1048                 req->zero = value < wLength;
1049                 value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
1050                 if (value < 0) {
1051                         ERROR(dev, "%s:%d Error!\n", __func__, __LINE__);
1052                         req->status = 0;
1053                 }
1054         }
1055         return value;
1056 }
1057
1058 static int printer_func_bind(struct usb_configuration *c,
1059                 struct usb_function *f)
1060 {
1061         struct usb_gadget *gadget = c->cdev->gadget;
1062         struct printer_dev *dev = func_to_printer(f);
1063         struct device *pdev;
1064         struct usb_composite_dev *cdev = c->cdev;
1065         struct usb_ep *in_ep;
1066         struct usb_ep *out_ep = NULL;
1067         struct usb_request *req;
1068         dev_t devt;
1069         int id;
1070         int ret;
1071         u32 i;
1072
1073         id = usb_interface_id(c, f);
1074         if (id < 0)
1075                 return id;
1076         intf_desc.bInterfaceNumber = id;
1077
1078         /* finish hookup to lower layer ... */
1079         dev->gadget = gadget;
1080
1081         /* all we really need is bulk IN/OUT */
1082         in_ep = usb_ep_autoconfig(cdev->gadget, &fs_ep_in_desc);
1083         if (!in_ep) {
1084 autoconf_fail:
1085                 dev_err(&cdev->gadget->dev, "can't autoconfigure on %s\n",
1086                         cdev->gadget->name);
1087                 return -ENODEV;
1088         }
1089
1090         out_ep = usb_ep_autoconfig(cdev->gadget, &fs_ep_out_desc);
1091         if (!out_ep)
1092                 goto autoconf_fail;
1093
1094         /* assumes that all endpoints are dual-speed */
1095         hs_ep_in_desc.bEndpointAddress = fs_ep_in_desc.bEndpointAddress;
1096         hs_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress;
1097         ss_ep_in_desc.bEndpointAddress = fs_ep_in_desc.bEndpointAddress;
1098         ss_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress;
1099
1100         ret = usb_assign_descriptors(f, fs_printer_function,
1101                         hs_printer_function, ss_printer_function,
1102                         ss_printer_function);
1103         if (ret)
1104                 return ret;
1105
1106         dev->in_ep = in_ep;
1107         dev->out_ep = out_ep;
1108
1109         ret = -ENOMEM;
1110         for (i = 0; i < dev->q_len; i++) {
1111                 req = printer_req_alloc(dev->in_ep, USB_BUFSIZE, GFP_KERNEL);
1112                 if (!req)
1113                         goto fail_tx_reqs;
1114                 list_add(&req->list, &dev->tx_reqs);
1115         }
1116
1117         for (i = 0; i < dev->q_len; i++) {
1118                 req = printer_req_alloc(dev->out_ep, USB_BUFSIZE, GFP_KERNEL);
1119                 if (!req)
1120                         goto fail_rx_reqs;
1121                 list_add(&req->list, &dev->rx_reqs);
1122         }
1123
1124         /* Setup the sysfs files for the printer gadget. */
1125         devt = MKDEV(major, dev->minor);
1126         pdev = device_create(&usb_gadget_class, NULL, devt,
1127                                   NULL, "g_printer%d", dev->minor);
1128         if (IS_ERR(pdev)) {
1129                 ERROR(dev, "Failed to create device: g_printer\n");
1130                 ret = PTR_ERR(pdev);
1131                 goto fail_rx_reqs;
1132         }
1133
1134         /*
1135          * Register a character device as an interface to a user mode
1136          * program that handles the printer specific functionality.
1137          */
1138         cdev_init(&dev->printer_cdev, &printer_io_operations);
1139         dev->printer_cdev.owner = THIS_MODULE;
1140         ret = cdev_add(&dev->printer_cdev, devt, 1);
1141         if (ret) {
1142                 ERROR(dev, "Failed to open char device\n");
1143                 goto fail_cdev_add;
1144         }
1145
1146         return 0;
1147
1148 fail_cdev_add:
1149         device_destroy(&usb_gadget_class, devt);
1150
1151 fail_rx_reqs:
1152         while (!list_empty(&dev->rx_reqs)) {
1153                 req = container_of(dev->rx_reqs.next, struct usb_request, list);
1154                 list_del(&req->list);
1155                 printer_req_free(dev->out_ep, req);
1156         }
1157
1158 fail_tx_reqs:
1159         while (!list_empty(&dev->tx_reqs)) {
1160                 req = container_of(dev->tx_reqs.next, struct usb_request, list);
1161                 list_del(&req->list);
1162                 printer_req_free(dev->in_ep, req);
1163         }
1164
1165         usb_free_all_descriptors(f);
1166         return ret;
1167
1168 }
1169
1170 static int printer_func_set_alt(struct usb_function *f,
1171                 unsigned intf, unsigned alt)
1172 {
1173         struct printer_dev *dev = func_to_printer(f);
1174         int ret = -ENOTSUPP;
1175
1176         if (!alt)
1177                 ret = set_interface(dev, intf);
1178
1179         return ret;
1180 }
1181
1182 static void printer_func_disable(struct usb_function *f)
1183 {
1184         struct printer_dev *dev = func_to_printer(f);
1185
1186         printer_reset_interface(dev);
1187 }
1188
1189 static inline struct f_printer_opts
1190 *to_f_printer_opts(struct config_item *item)
1191 {
1192         return container_of(to_config_group(item), struct f_printer_opts,
1193                             func_inst.group);
1194 }
1195
1196 static void printer_attr_release(struct config_item *item)
1197 {
1198         struct f_printer_opts *opts = to_f_printer_opts(item);
1199
1200         usb_put_function_instance(&opts->func_inst);
1201 }
1202
1203 static struct configfs_item_operations printer_item_ops = {
1204         .release        = printer_attr_release,
1205 };
1206
1207 static ssize_t f_printer_opts_pnp_string_show(struct config_item *item,
1208                                               char *page)
1209 {
1210         struct f_printer_opts *opts = to_f_printer_opts(item);
1211         int result = 0;
1212
1213         mutex_lock(&opts->lock);
1214         if (!opts->pnp_string)
1215                 goto unlock;
1216
1217         result = strscpy(page, opts->pnp_string, PAGE_SIZE);
1218         if (result < 1) {
1219                 result = PAGE_SIZE;
1220         } else if (page[result - 1] != '\n' && result + 1 < PAGE_SIZE) {
1221                 page[result++] = '\n';
1222                 page[result] = '\0';
1223         }
1224
1225 unlock:
1226         mutex_unlock(&opts->lock);
1227
1228         return result;
1229 }
1230
1231 static ssize_t f_printer_opts_pnp_string_store(struct config_item *item,
1232                                                const char *page, size_t len)
1233 {
1234         struct f_printer_opts *opts = to_f_printer_opts(item);
1235         char *new_pnp;
1236         int result;
1237
1238         mutex_lock(&opts->lock);
1239
1240         new_pnp = kstrndup(page, len, GFP_KERNEL);
1241         if (!new_pnp) {
1242                 result = -ENOMEM;
1243                 goto unlock;
1244         }
1245
1246         if (opts->pnp_string_allocated)
1247                 kfree(opts->pnp_string);
1248
1249         opts->pnp_string_allocated = true;
1250         opts->pnp_string = new_pnp;
1251         result = len;
1252 unlock:
1253         mutex_unlock(&opts->lock);
1254
1255         return result;
1256 }
1257
1258 CONFIGFS_ATTR(f_printer_opts_, pnp_string);
1259
1260 static ssize_t f_printer_opts_q_len_show(struct config_item *item,
1261                                          char *page)
1262 {
1263         struct f_printer_opts *opts = to_f_printer_opts(item);
1264         int result;
1265
1266         mutex_lock(&opts->lock);
1267         result = sprintf(page, "%d\n", opts->q_len);
1268         mutex_unlock(&opts->lock);
1269
1270         return result;
1271 }
1272
1273 static ssize_t f_printer_opts_q_len_store(struct config_item *item,
1274                                           const char *page, size_t len)
1275 {
1276         struct f_printer_opts *opts = to_f_printer_opts(item);
1277         int ret;
1278         u16 num;
1279
1280         mutex_lock(&opts->lock);
1281         if (opts->refcnt) {
1282                 ret = -EBUSY;
1283                 goto end;
1284         }
1285
1286         ret = kstrtou16(page, 0, &num);
1287         if (ret)
1288                 goto end;
1289
1290         opts->q_len = (unsigned)num;
1291         ret = len;
1292 end:
1293         mutex_unlock(&opts->lock);
1294         return ret;
1295 }
1296
1297 CONFIGFS_ATTR(f_printer_opts_, q_len);
1298
1299 static struct configfs_attribute *printer_attrs[] = {
1300         &f_printer_opts_attr_pnp_string,
1301         &f_printer_opts_attr_q_len,
1302         NULL,
1303 };
1304
1305 static const struct config_item_type printer_func_type = {
1306         .ct_item_ops    = &printer_item_ops,
1307         .ct_attrs       = printer_attrs,
1308         .ct_owner       = THIS_MODULE,
1309 };
1310
1311 static inline int gprinter_get_minor(void)
1312 {
1313         int ret;
1314
1315         ret = ida_simple_get(&printer_ida, 0, 0, GFP_KERNEL);
1316         if (ret >= PRINTER_MINORS) {
1317                 ida_simple_remove(&printer_ida, ret);
1318                 ret = -ENODEV;
1319         }
1320
1321         return ret;
1322 }
1323
1324 static inline void gprinter_put_minor(int minor)
1325 {
1326         ida_simple_remove(&printer_ida, minor);
1327 }
1328
1329 static int gprinter_setup(int);
1330 static void gprinter_cleanup(void);
1331
1332 static void gprinter_free_inst(struct usb_function_instance *f)
1333 {
1334         struct f_printer_opts *opts;
1335
1336         opts = container_of(f, struct f_printer_opts, func_inst);
1337
1338         mutex_lock(&printer_ida_lock);
1339
1340         gprinter_put_minor(opts->minor);
1341         if (ida_is_empty(&printer_ida))
1342                 gprinter_cleanup();
1343
1344         mutex_unlock(&printer_ida_lock);
1345
1346         if (opts->pnp_string_allocated)
1347                 kfree(opts->pnp_string);
1348         kfree(opts);
1349 }
1350
1351 static struct usb_function_instance *gprinter_alloc_inst(void)
1352 {
1353         struct f_printer_opts *opts;
1354         struct usb_function_instance *ret;
1355         int status = 0;
1356
1357         opts = kzalloc(sizeof(*opts), GFP_KERNEL);
1358         if (!opts)
1359                 return ERR_PTR(-ENOMEM);
1360
1361         mutex_init(&opts->lock);
1362         opts->func_inst.free_func_inst = gprinter_free_inst;
1363         ret = &opts->func_inst;
1364
1365         /* Make sure q_len is initialized, otherwise the bound device can't support read/write! */
1366         opts->q_len = DEFAULT_Q_LEN;
1367
1368         mutex_lock(&printer_ida_lock);
1369
1370         if (ida_is_empty(&printer_ida)) {
1371                 status = gprinter_setup(PRINTER_MINORS);
1372                 if (status) {
1373                         ret = ERR_PTR(status);
1374                         kfree(opts);
1375                         goto unlock;
1376                 }
1377         }
1378
1379         opts->minor = gprinter_get_minor();
1380         if (opts->minor < 0) {
1381                 ret = ERR_PTR(opts->minor);
1382                 kfree(opts);
1383                 if (ida_is_empty(&printer_ida))
1384                         gprinter_cleanup();
1385                 goto unlock;
1386         }
1387         config_group_init_type_name(&opts->func_inst.group, "",
1388                                     &printer_func_type);
1389
1390 unlock:
1391         mutex_unlock(&printer_ida_lock);
1392         return ret;
1393 }
1394
1395 static void gprinter_free(struct usb_function *f)
1396 {
1397         struct printer_dev *dev = func_to_printer(f);
1398         struct f_printer_opts *opts;
1399
1400         opts = container_of(f->fi, struct f_printer_opts, func_inst);
1401
1402         kref_put(&dev->kref, printer_dev_free);
1403         mutex_lock(&opts->lock);
1404         --opts->refcnt;
1405         mutex_unlock(&opts->lock);
1406 }
1407
1408 static void printer_func_unbind(struct usb_configuration *c,
1409                 struct usb_function *f)
1410 {
1411         struct printer_dev      *dev;
1412         struct usb_request      *req;
1413
1414         dev = func_to_printer(f);
1415
1416         device_destroy(&usb_gadget_class, MKDEV(major, dev->minor));
1417
1418         /* Remove Character Device */
1419         cdev_del(&dev->printer_cdev);
1420
1421         /* we must already have been disconnected ... no i/o may be active */
1422         WARN_ON(!list_empty(&dev->tx_reqs_active));
1423         WARN_ON(!list_empty(&dev->rx_reqs_active));
1424
1425         /* Free all memory for this driver. */
1426         while (!list_empty(&dev->tx_reqs)) {
1427                 req = container_of(dev->tx_reqs.next, struct usb_request,
1428                                 list);
1429                 list_del(&req->list);
1430                 printer_req_free(dev->in_ep, req);
1431         }
1432
1433         if (dev->current_rx_req != NULL)
1434                 printer_req_free(dev->out_ep, dev->current_rx_req);
1435
1436         while (!list_empty(&dev->rx_reqs)) {
1437                 req = container_of(dev->rx_reqs.next,
1438                                 struct usb_request, list);
1439                 list_del(&req->list);
1440                 printer_req_free(dev->out_ep, req);
1441         }
1442
1443         while (!list_empty(&dev->rx_buffers)) {
1444                 req = container_of(dev->rx_buffers.next,
1445                                 struct usb_request, list);
1446                 list_del(&req->list);
1447                 printer_req_free(dev->out_ep, req);
1448         }
1449         usb_free_all_descriptors(f);
1450 }
1451
1452 static struct usb_function *gprinter_alloc(struct usb_function_instance *fi)
1453 {
1454         struct printer_dev      *dev;
1455         struct f_printer_opts   *opts;
1456
1457         opts = container_of(fi, struct f_printer_opts, func_inst);
1458
1459         mutex_lock(&opts->lock);
1460         if (opts->minor >= minors) {
1461                 mutex_unlock(&opts->lock);
1462                 return ERR_PTR(-ENOENT);
1463         }
1464
1465         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
1466         if (!dev) {
1467                 mutex_unlock(&opts->lock);
1468                 return ERR_PTR(-ENOMEM);
1469         }
1470
1471         kref_init(&dev->kref);
1472         ++opts->refcnt;
1473         dev->minor = opts->minor;
1474         dev->pnp_string = &opts->pnp_string;
1475         dev->q_len = opts->q_len;
1476         mutex_unlock(&opts->lock);
1477
1478         dev->function.name = "printer";
1479         dev->function.bind = printer_func_bind;
1480         dev->function.setup = printer_func_setup;
1481         dev->function.unbind = printer_func_unbind;
1482         dev->function.set_alt = printer_func_set_alt;
1483         dev->function.disable = printer_func_disable;
1484         dev->function.req_match = gprinter_req_match;
1485         dev->function.free_func = gprinter_free;
1486
1487         INIT_LIST_HEAD(&dev->tx_reqs);
1488         INIT_LIST_HEAD(&dev->rx_reqs);
1489         INIT_LIST_HEAD(&dev->rx_buffers);
1490         INIT_LIST_HEAD(&dev->tx_reqs_active);
1491         INIT_LIST_HEAD(&dev->rx_reqs_active);
1492
1493         spin_lock_init(&dev->lock);
1494         mutex_init(&dev->lock_printer_io);
1495         init_waitqueue_head(&dev->rx_wait);
1496         init_waitqueue_head(&dev->tx_wait);
1497         init_waitqueue_head(&dev->tx_flush_wait);
1498
1499         dev->interface = -1;
1500         dev->printer_cdev_open = 0;
1501         dev->printer_status = PRINTER_NOT_ERROR;
1502         dev->current_rx_req = NULL;
1503         dev->current_rx_bytes = 0;
1504         dev->current_rx_buf = NULL;
1505
1506         return &dev->function;
1507 }
1508
1509 DECLARE_USB_FUNCTION_INIT(printer, gprinter_alloc_inst, gprinter_alloc);
1510 MODULE_LICENSE("GPL");
1511 MODULE_AUTHOR("Craig Nadler");
1512
1513 static int gprinter_setup(int count)
1514 {
1515         int status;
1516         dev_t devt;
1517
1518         status = class_register(&usb_gadget_class);
1519         if (status)
1520                 return status;
1521
1522         status = alloc_chrdev_region(&devt, 0, count, "USB printer gadget");
1523         if (status) {
1524                 pr_err("alloc_chrdev_region %d\n", status);
1525                 class_unregister(&usb_gadget_class);
1526                 return status;
1527         }
1528
1529         major = MAJOR(devt);
1530         minors = count;
1531
1532         return status;
1533 }
1534
1535 static void gprinter_cleanup(void)
1536 {
1537         if (major) {
1538                 unregister_chrdev_region(MKDEV(major, 0), minors);
1539                 major = minors = 0;
1540         }
1541         class_unregister(&usb_gadget_class);
1542 }