1	// SPDX-License-Identifier: GPL-2.0+
2	/*
3	* f_printer.c - USB printer function driver
4	*
5	* Copied from drivers/usb/gadget/legacy/printer.c,
6	* which was:
7	*
8	* printer.c -- Printer gadget driver
9	*
10	* Copyright (C) 2003-2005 David Brownell
11	* Copyright (C) 2006 Craig W. Nadler
12	*/
13
14	#include <linux/module.h>
15	#include <linux/kernel.h>
16	#include <linux/delay.h>
17	#include <linux/ioport.h>
18	#include <linux/sched.h>
19	#include <linux/slab.h>
20	#include <linux/mutex.h>
21	#include <linux/errno.h>
22	#include <linux/init.h>
23	#include <linux/idr.h>
24	#include <linux/timer.h>
25	#include <linux/list.h>
26	#include <linux/interrupt.h>
27	#include <linux/device.h>
28	#include <linux/moduleparam.h>
29	#include <linux/fs.h>
30	#include <linux/poll.h>
31	#include <linux/types.h>
32	#include <linux/ctype.h>
33	#include <linux/cdev.h>
34	#include <linux/kref.h>
35
36	#include <asm/byteorder.h>
37	#include <linux/io.h>
38	#include <linux/irq.h>
39	#include <linux/uaccess.h>
40	#include <asm/unaligned.h>
41
42	#include <linux/usb/ch9.h>
43	#include <linux/usb/composite.h>
44	#include <linux/usb/gadget.h>
45	#include <linux/usb/g_printer.h>
46
47	#include "u_printer.h"
48
49	#define PRINTER_MINORS 4
50	#define GET_DEVICE_ID 0
51	#define GET_PORT_STATUS 1
52	#define SOFT_RESET 2
53
54	#define DEFAULT_Q_LEN 10 /* same as legacy g_printer gadget */
55
56	static int major, minors;
57	static const struct class usb_gadget_class = {
58	.name = "usb_printer_gadget",
59	};
60
61	static DEFINE_IDA(printer_ida);
62	static DEFINE_MUTEX(printer_ida_lock); /* protects access do printer_ida */
63
64	/*-------------------------------------------------------------------------*/
65
66	struct printer_dev {
67	spinlock_t lock; /* lock this structure */
68	/* lock buffer lists during read/write calls */
69	struct mutex lock_printer_io;
70	struct usb_gadget *gadget;
71	s8 interface;
72	struct usb_ep *in_ep, *out_ep;
73	struct kref kref;
74	struct list_head rx_reqs; /* List of free RX structs */
75	struct list_head rx_reqs_active; /* List of Active RX xfers */
76	struct list_head rx_buffers; /* List of completed xfers */
77	/* wait until there is data to be read. */
78	wait_queue_head_t rx_wait;
79	struct list_head tx_reqs; /* List of free TX structs */
80	struct list_head tx_reqs_active; /* List of Active TX xfers */
81	/* Wait until there are write buffers available to use. */
82	wait_queue_head_t tx_wait;
83	/* Wait until all write buffers have been sent. */
84	wait_queue_head_t tx_flush_wait;
85	struct usb_request *current_rx_req;
86	size_t current_rx_bytes;
87	u8 *current_rx_buf;
88	u8 printer_status;
89	u8 reset_printer;
90	int minor;
91	struct cdev printer_cdev;
92	u8 printer_cdev_open;
93	wait_queue_head_t wait;
94	unsigned q_len;
95	char **pnp_string; /* We don't own memory! */
96	struct usb_function function;
97	};
98
99	static inline struct printer_dev *func_to_printer(struct usb_function *f)
100	{
101	return container_of(f, struct printer_dev, function);
102	}
103
104	/*-------------------------------------------------------------------------*/
105
106	/*
107	* DESCRIPTORS ... most are static, but strings and (full) configuration
108	* descriptors are built on demand.
109	*/
110
111	/* holds our biggest descriptor */
112	#define USB_DESC_BUFSIZE 256
113	#define USB_BUFSIZE 8192
114
115	static struct usb_interface_descriptor intf_desc = {
116	.bLength = sizeof(intf_desc),
117	.bDescriptorType = USB_DT_INTERFACE,
118	.bNumEndpoints = 2,
119	.bInterfaceClass = USB_CLASS_PRINTER,
120	.bInterfaceSubClass = 1, /* Printer Sub-Class */
121	.bInterfaceProtocol = 2, /* Bi-Directional */
122	.iInterface = 0
123	};
124
125	static struct usb_endpoint_descriptor fs_ep_in_desc = {
126	.bLength = USB_DT_ENDPOINT_SIZE,
127	.bDescriptorType = USB_DT_ENDPOINT,
128	.bEndpointAddress = USB_DIR_IN,
129	.bmAttributes = USB_ENDPOINT_XFER_BULK
130	};
131
132	static struct usb_endpoint_descriptor fs_ep_out_desc = {
133	.bLength = USB_DT_ENDPOINT_SIZE,
134	.bDescriptorType = USB_DT_ENDPOINT,
135	.bEndpointAddress = USB_DIR_OUT,
136	.bmAttributes = USB_ENDPOINT_XFER_BULK
137	};
138
139	static struct usb_descriptor_header *fs_printer_function[] = {
140	(struct usb_descriptor_header *) &intf_desc,
141	(struct usb_descriptor_header *) &fs_ep_in_desc,
142	(struct usb_descriptor_header *) &fs_ep_out_desc,
143	NULL
144	};
145
146	/*
147	* usb 2.0 devices need to expose both high speed and full speed
148	* descriptors, unless they only run at full speed.
149	*/
150
151	static struct usb_endpoint_descriptor hs_ep_in_desc = {
152	.bLength = USB_DT_ENDPOINT_SIZE,
153	.bDescriptorType = USB_DT_ENDPOINT,
154	.bmAttributes = USB_ENDPOINT_XFER_BULK,
155	.wMaxPacketSize = cpu_to_le16(512)
156	};
157
158	static struct usb_endpoint_descriptor hs_ep_out_desc = {
159	.bLength = USB_DT_ENDPOINT_SIZE,
160	.bDescriptorType = USB_DT_ENDPOINT,
161	.bmAttributes = USB_ENDPOINT_XFER_BULK,
162	.wMaxPacketSize = cpu_to_le16(512)
163	};
164
165	static struct usb_descriptor_header *hs_printer_function[] = {
166	(struct usb_descriptor_header *) &intf_desc,
167	(struct usb_descriptor_header *) &hs_ep_in_desc,
168	(struct usb_descriptor_header *) &hs_ep_out_desc,
169	NULL
170	};
171
172	/*
173	* Added endpoint descriptors for 3.0 devices
174	*/
175
176	static struct usb_endpoint_descriptor ss_ep_in_desc = {
177	.bLength = USB_DT_ENDPOINT_SIZE,
178	.bDescriptorType = USB_DT_ENDPOINT,
179	.bmAttributes = USB_ENDPOINT_XFER_BULK,
180	.wMaxPacketSize = cpu_to_le16(1024),
181	};
182
183	static struct usb_ss_ep_comp_descriptor ss_ep_in_comp_desc = {
184	.bLength = sizeof(ss_ep_in_comp_desc),
185	.bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
186	};
187
188	static struct usb_endpoint_descriptor ss_ep_out_desc = {
189	.bLength = USB_DT_ENDPOINT_SIZE,
190	.bDescriptorType = USB_DT_ENDPOINT,
191	.bmAttributes = USB_ENDPOINT_XFER_BULK,
192	.wMaxPacketSize = cpu_to_le16(1024),
193	};
194
195	static struct usb_ss_ep_comp_descriptor ss_ep_out_comp_desc = {
196	.bLength = sizeof(ss_ep_out_comp_desc),
197	.bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
198	};
199
200	static struct usb_descriptor_header *ss_printer_function[] = {
201	(struct usb_descriptor_header *) &intf_desc,
202	(struct usb_descriptor_header *) &ss_ep_in_desc,
203	(struct usb_descriptor_header *) &ss_ep_in_comp_desc,
204	(struct usb_descriptor_header *) &ss_ep_out_desc,
205	(struct usb_descriptor_header *) &ss_ep_out_comp_desc,
206	NULL
207	};
208
209	/* maxpacket and other transfer characteristics vary by speed. */
210	static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget,
211	struct usb_endpoint_descriptor *fs,
212	struct usb_endpoint_descriptor *hs,
213	struct usb_endpoint_descriptor *ss)
214	{
215	switch (gadget->speed) {
216	case USB_SPEED_SUPER:
217	return ss;
218	case USB_SPEED_HIGH:
219	return hs;
220	default:
221	return fs;
222	}
223	}
224
225	/*-------------------------------------------------------------------------*/
226
227	static void printer_dev_free(struct kref *kref)
228	{
229	struct printer_dev *dev = container_of(kref, struct printer_dev, kref);
230
231	kfree(objp: dev);
232	}
233
234	static struct usb_request *
235	printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags)
236	{
237	struct usb_request *req;
238
239	req = usb_ep_alloc_request(ep, gfp_flags);
240
241	if (req != NULL) {
242	req->length = len;
243	req->buf = kmalloc(size: len, flags: gfp_flags);
244	if (req->buf == NULL) {
245	usb_ep_free_request(ep, req);
246	return NULL;
247	}
248	}
249
250	return req;
251	}
252
253	static void
254	printer_req_free(struct usb_ep *ep, struct usb_request *req)
255	{
256	if (ep != NULL && req != NULL) {
257	kfree(objp: req->buf);
258	usb_ep_free_request(ep, req);
259	}
260	}
261
262	/*-------------------------------------------------------------------------*/
263
264	static void rx_complete(struct usb_ep *ep, struct usb_request *req)
265	{
266	struct printer_dev *dev = ep->driver_data;
267	int status = req->status;
268	unsigned long flags;
269
270	spin_lock_irqsave(&dev->lock, flags);
271
272	list_del_init(entry: &req->list); /* Remode from Active List */
273
274	switch (status) {
275
276	/* normal completion */
277	case 0:
278	if (req->actual > 0) {
279	list_add_tail(new: &req->list, head: &dev->rx_buffers);
280	DBG(dev, "G_Printer : rx length %d\n", req->actual);
281	} else {
282	list_add(new: &req->list, head: &dev->rx_reqs);
283	}
284	break;
285
286	/* software-driven interface shutdown */
287	case -ECONNRESET: /* unlink */
288	case -ESHUTDOWN: /* disconnect etc */
289	VDBG(dev, "rx shutdown, code %d\n", status);
290	list_add(new: &req->list, head: &dev->rx_reqs);
291	break;
292
293	/* for hardware automagic (such as pxa) */
294	case -ECONNABORTED: /* endpoint reset */
295	DBG(dev, "rx %s reset\n", ep->name);
296	list_add(new: &req->list, head: &dev->rx_reqs);
297	break;
298
299	/* data overrun */
300	case -EOVERFLOW:
301	fallthrough;
302
303	default:
304	DBG(dev, "rx status %d\n", status);
305	list_add(new: &req->list, head: &dev->rx_reqs);
306	break;
307	}
308
309	wake_up_interruptible(&dev->rx_wait);
310	spin_unlock_irqrestore(lock: &dev->lock, flags);
311	}
312
313	static void tx_complete(struct usb_ep *ep, struct usb_request *req)
314	{
315	struct printer_dev *dev = ep->driver_data;
316
317	switch (req->status) {
318	default:
319	VDBG(dev, "tx err %d\n", req->status);
320	fallthrough;
321	case -ECONNRESET: /* unlink */
322	case -ESHUTDOWN: /* disconnect etc */
323	break;
324	case 0:
325	break;
326	}
327
328	spin_lock(lock: &dev->lock);
329	/* Take the request struct off the active list and put it on the
330	* free list.
331	*/
332	list_del_init(entry: &req->list);
333	list_add(new: &req->list, head: &dev->tx_reqs);
334	wake_up_interruptible(&dev->tx_wait);
335	if (likely(list_empty(&dev->tx_reqs_active)))
336	wake_up_interruptible(&dev->tx_flush_wait);
337
338	spin_unlock(lock: &dev->lock);
339	}
340
341	/*-------------------------------------------------------------------------*/
342
343	static int
344	printer_open(struct inode *inode, struct file *fd)
345	{
346	struct printer_dev *dev;
347	unsigned long flags;
348	int ret = -EBUSY;
349
350	dev = container_of(inode->i_cdev, struct printer_dev, printer_cdev);
351
352	spin_lock_irqsave(&dev->lock, flags);
353
354	if (dev->interface < 0) {
355	spin_unlock_irqrestore(lock: &dev->lock, flags);
356	return -ENODEV;
357	}
358
359	if (!dev->printer_cdev_open) {
360	dev->printer_cdev_open = 1;
361	fd->private_data = dev;
362	ret = 0;
363	/* Change the printer status to show that it's on-line. */
364	dev->printer_status |= PRINTER_SELECTED;
365	}
366
367	spin_unlock_irqrestore(lock: &dev->lock, flags);
368
369	kref_get(kref: &dev->kref);
370
371	return ret;
372	}
373
374	static int
375	printer_close(struct inode *inode, struct file *fd)
376	{
377	struct printer_dev *dev = fd->private_data;
378	unsigned long flags;
379
380	spin_lock_irqsave(&dev->lock, flags);
381	dev->printer_cdev_open = 0;
382	fd->private_data = NULL;
383	/* Change printer status to show that the printer is off-line. */
384	dev->printer_status &= ~PRINTER_SELECTED;
385	spin_unlock_irqrestore(lock: &dev->lock, flags);
386
387	kref_put(kref: &dev->kref, release: printer_dev_free);
388
389	return 0;
390	}
391
392	/* This function must be called with interrupts turned off. */
393	static void
394	setup_rx_reqs(struct printer_dev *dev)
395	{
396	struct usb_request *req;
397
398	while (likely(!list_empty(&dev->rx_reqs))) {
399	int error;
400
401	req = container_of(dev->rx_reqs.next,
402	struct usb_request, list);
403	list_del_init(entry: &req->list);
404
405	/* The USB Host sends us whatever amount of data it wants to
406	* so we always set the length field to the full USB_BUFSIZE.
407	* If the amount of data is more than the read() caller asked
408	* for it will be stored in the request buffer until it is
409	* asked for by read().
410	*/
411	req->length = USB_BUFSIZE;
412	req->complete = rx_complete;
413
414	/* here, we unlock, and only unlock, to avoid deadlock. */
415	spin_unlock(lock: &dev->lock);
416	error = usb_ep_queue(ep: dev->out_ep, req, GFP_ATOMIC);
417	spin_lock(lock: &dev->lock);
418	if (error) {
419	DBG(dev, "rx submit --> %d\n", error);
420	list_add(new: &req->list, head: &dev->rx_reqs);
421	break;
422	}
423	/* if the req is empty, then add it into dev->rx_reqs_active. */
424	else if (list_empty(head: &req->list))
425	list_add(new: &req->list, head: &dev->rx_reqs_active);
426	}
427	}
428
429	static ssize_t
430	printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
431	{
432	struct printer_dev *dev = fd->private_data;
433	unsigned long flags;
434	size_t size;
435	size_t bytes_copied;
436	struct usb_request *req;
437	/* This is a pointer to the current USB rx request. */
438	struct usb_request *current_rx_req;
439	/* This is the number of bytes in the current rx buffer. */
440	size_t current_rx_bytes;
441	/* This is a pointer to the current rx buffer. */
442	u8 *current_rx_buf;
443
444	if (len == 0)
445	return -EINVAL;
446
447	DBG(dev, "printer_read trying to read %d bytes\n", (int)len);
448
449	mutex_lock(&dev->lock_printer_io);
450	spin_lock_irqsave(&dev->lock, flags);
451
452	if (dev->interface < 0) {
453	spin_unlock_irqrestore(lock: &dev->lock, flags);
454	mutex_unlock(lock: &dev->lock_printer_io);
455	return -ENODEV;
456	}
457
458	/* We will use this flag later to check if a printer reset happened
459	* after we turn interrupts back on.
460	*/
461	dev->reset_printer = 0;
462
463	setup_rx_reqs(dev);
464
465	bytes_copied = 0;
466	current_rx_req = dev->current_rx_req;
467	current_rx_bytes = dev->current_rx_bytes;
468	current_rx_buf = dev->current_rx_buf;
469	dev->current_rx_req = NULL;
470	dev->current_rx_bytes = 0;
471	dev->current_rx_buf = NULL;
472
473	/* Check if there is any data in the read buffers. Please note that
474	* current_rx_bytes is the number of bytes in the current rx buffer.
475	* If it is zero then check if there are any other rx_buffers that
476	* are on the completed list. We are only out of data if all rx
477	* buffers are empty.
478	*/
479	if ((current_rx_bytes == 0) &&
480	(likely(list_empty(&dev->rx_buffers)))) {
481	/* Turn interrupts back on before sleeping. */
482	spin_unlock_irqrestore(lock: &dev->lock, flags);
483
484	/*
485	* If no data is available check if this is a NON-Blocking
486	* call or not.
487	*/
488	if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
489	mutex_unlock(lock: &dev->lock_printer_io);
490	return -EAGAIN;
491	}
492
493	/* Sleep until data is available */
494	wait_event_interruptible(dev->rx_wait,
495	(likely(!list_empty(&dev->rx_buffers))));
496	spin_lock_irqsave(&dev->lock, flags);
497	}
498
499	/* We have data to return then copy it to the caller's buffer.*/
500	while ((current_rx_bytes || likely(!list_empty(&dev->rx_buffers)))
501	&& len) {
502	if (current_rx_bytes == 0) {
503	req = container_of(dev->rx_buffers.next,
504	struct usb_request, list);
505	list_del_init(entry: &req->list);
506
507	if (req->actual && req->buf) {
508	current_rx_req = req;
509	current_rx_bytes = req->actual;
510	current_rx_buf = req->buf;
511	} else {
512	list_add(new: &req->list, head: &dev->rx_reqs);
513	continue;
514	}
515	}
516
517	/* Don't leave irqs off while doing memory copies */
518	spin_unlock_irqrestore(lock: &dev->lock, flags);
519
520	if (len > current_rx_bytes)
521	size = current_rx_bytes;
522	else
523	size = len;
524
525	size -= copy_to_user(to: buf, from: current_rx_buf, n: size);
526	bytes_copied += size;
527	len -= size;
528	buf += size;
529
530	spin_lock_irqsave(&dev->lock, flags);
531
532	/* We've disconnected or reset so return. */
533	if (dev->reset_printer) {
534	list_add(new: &current_rx_req->list, head: &dev->rx_reqs);
535	spin_unlock_irqrestore(lock: &dev->lock, flags);
536	mutex_unlock(lock: &dev->lock_printer_io);
537	return -EAGAIN;
538	}
539
540	/* If we not returning all the data left in this RX request
541	* buffer then adjust the amount of data left in the buffer.
542	* Othewise if we are done with this RX request buffer then
543	* requeue it to get any incoming data from the USB host.
544	*/
545	if (size < current_rx_bytes) {
546	current_rx_bytes -= size;
547	current_rx_buf += size;
548	} else {
549	list_add(new: &current_rx_req->list, head: &dev->rx_reqs);
550	current_rx_bytes = 0;
551	current_rx_buf = NULL;
552	current_rx_req = NULL;
553	}
554	}
555
556	dev->current_rx_req = current_rx_req;
557	dev->current_rx_bytes = current_rx_bytes;
558	dev->current_rx_buf = current_rx_buf;
559
560	spin_unlock_irqrestore(lock: &dev->lock, flags);
561	mutex_unlock(lock: &dev->lock_printer_io);
562
563	DBG(dev, "printer_read returned %d bytes\n", (int)bytes_copied);
564
565	if (bytes_copied)
566	return bytes_copied;
567	else
568	return -EAGAIN;
569	}
570
571	static ssize_t
572	printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
573	{
574	struct printer_dev *dev = fd->private_data;
575	unsigned long flags;
576	size_t size; /* Amount of data in a TX request. */
577	size_t bytes_copied = 0;
578	struct usb_request *req;
579	int value;
580
581	DBG(dev, "printer_write trying to send %d bytes\n", (int)len);
582
583	if (len == 0)
584	return -EINVAL;
585
586	mutex_lock(&dev->lock_printer_io);
587	spin_lock_irqsave(&dev->lock, flags);
588
589	if (dev->interface < 0) {
590	spin_unlock_irqrestore(lock: &dev->lock, flags);
591	mutex_unlock(lock: &dev->lock_printer_io);
592	return -ENODEV;
593	}
594
595	/* Check if a printer reset happens while we have interrupts on */
596	dev->reset_printer = 0;
597
598	/* Check if there is any available write buffers */
599	if (likely(list_empty(&dev->tx_reqs))) {
600	/* Turn interrupts back on before sleeping. */
601	spin_unlock_irqrestore(lock: &dev->lock, flags);
602
603	/*
604	* If write buffers are available check if this is
605	* a NON-Blocking call or not.
606	*/
607	if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
608	mutex_unlock(lock: &dev->lock_printer_io);
609	return -EAGAIN;
610	}
611
612	/* Sleep until a write buffer is available */
613	wait_event_interruptible(dev->tx_wait,
614	(likely(!list_empty(&dev->tx_reqs))));
615	spin_lock_irqsave(&dev->lock, flags);
616	}
617
618	while (likely(!list_empty(&dev->tx_reqs)) && len) {
619
620	if (len > USB_BUFSIZE)
621	size = USB_BUFSIZE;
622	else
623	size = len;
624
625	req = container_of(dev->tx_reqs.next, struct usb_request,
626	list);
627	list_del_init(entry: &req->list);
628
629	req->complete = tx_complete;
630	req->length = size;
631
632	/* Check if we need to send a zero length packet. */
633	if (len > size)
634	/* They will be more TX requests so no yet. */
635	req->zero = 0;
636	else
637	/* If the data amount is not a multiple of the
638	* maxpacket size then send a zero length packet.
639	*/
640	req->zero = ((len % dev->in_ep->maxpacket) == 0);
641
642	/* Don't leave irqs off while doing memory copies */
643	spin_unlock_irqrestore(lock: &dev->lock, flags);
644
645	if (copy_from_user(to: req->buf, from: buf, n: size)) {
646	list_add(new: &req->list, head: &dev->tx_reqs);
647	mutex_unlock(lock: &dev->lock_printer_io);
648	return bytes_copied;
649	}
650
651	bytes_copied += size;
652	len -= size;
653	buf += size;
654
655	spin_lock_irqsave(&dev->lock, flags);
656
657	/* We've disconnected or reset so free the req and buffer */
658	if (dev->reset_printer) {
659	list_add(new: &req->list, head: &dev->tx_reqs);
660	spin_unlock_irqrestore(lock: &dev->lock, flags);
661	mutex_unlock(lock: &dev->lock_printer_io);
662	return -EAGAIN;
663	}
664
665	list_add(new: &req->list, head: &dev->tx_reqs_active);
666
667	/* here, we unlock, and only unlock, to avoid deadlock. */
668	spin_unlock(lock: &dev->lock);
669	value = usb_ep_queue(ep: dev->in_ep, req, GFP_ATOMIC);
670	spin_lock(lock: &dev->lock);
671	if (value) {
672	list_move(list: &req->list, head: &dev->tx_reqs);
673	spin_unlock_irqrestore(lock: &dev->lock, flags);
674	mutex_unlock(lock: &dev->lock_printer_io);
675	return -EAGAIN;
676	}
677	}
678
679	spin_unlock_irqrestore(lock: &dev->lock, flags);
680	mutex_unlock(lock: &dev->lock_printer_io);
681
682	DBG(dev, "printer_write sent %d bytes\n", (int)bytes_copied);
683
684	if (bytes_copied)
685	return bytes_copied;
686	else
687	return -EAGAIN;
688	}
689
690	static int
691	printer_fsync(struct file *fd, loff_t start, loff_t end, int datasync)
692	{
693	struct printer_dev *dev = fd->private_data;
694	struct inode *inode = file_inode(f: fd);
695	unsigned long flags;
696	int tx_list_empty;
697
698	inode_lock(inode);
699	spin_lock_irqsave(&dev->lock, flags);
700
701	if (dev->interface < 0) {
702	spin_unlock_irqrestore(lock: &dev->lock, flags);
703	inode_unlock(inode);
704	return -ENODEV;
705	}
706
707	tx_list_empty = (likely(list_empty(&dev->tx_reqs)));
708	spin_unlock_irqrestore(lock: &dev->lock, flags);
709
710	if (!tx_list_empty) {
711	/* Sleep until all data has been sent */
712	wait_event_interruptible(dev->tx_flush_wait,
713	(likely(list_empty(&dev->tx_reqs_active))));
714	}
715	inode_unlock(inode);
716
717	return 0;
718	}
719
720	static __poll_t
721	printer_poll(struct file *fd, poll_table *wait)
722	{
723	struct printer_dev *dev = fd->private_data;
724	unsigned long flags;
725	__poll_t status = 0;
726
727	mutex_lock(&dev->lock_printer_io);
728	spin_lock_irqsave(&dev->lock, flags);
729
730	if (dev->interface < 0) {
731	spin_unlock_irqrestore(lock: &dev->lock, flags);
732	mutex_unlock(lock: &dev->lock_printer_io);
733	return EPOLLERR | EPOLLHUP;
734	}
735
736	setup_rx_reqs(dev);
737	spin_unlock_irqrestore(lock: &dev->lock, flags);
738	mutex_unlock(lock: &dev->lock_printer_io);
739
740	poll_wait(filp: fd, wait_address: &dev->rx_wait, p: wait);
741	poll_wait(filp: fd, wait_address: &dev->tx_wait, p: wait);
742
743	spin_lock_irqsave(&dev->lock, flags);
744	if (likely(!list_empty(&dev->tx_reqs)))
745	status |= EPOLLOUT | EPOLLWRNORM;
746
747	if (likely(dev->current_rx_bytes) ||
748	likely(!list_empty(&dev->rx_buffers)))
749	status |= EPOLLIN | EPOLLRDNORM;
750
751	spin_unlock_irqrestore(lock: &dev->lock, flags);
752
753	return status;
754	}
755
756	static long
757	printer_ioctl(struct file *fd, unsigned int code, unsigned long arg)
758	{
759	struct printer_dev *dev = fd->private_data;
760	unsigned long flags;
761	int status = 0;
762
763	DBG(dev, "printer_ioctl: cmd=0x%4.4x, arg=%lu\n", code, arg);
764
765	/* handle ioctls */
766
767	spin_lock_irqsave(&dev->lock, flags);
768
769	if (dev->interface < 0) {
770	spin_unlock_irqrestore(lock: &dev->lock, flags);
771	return -ENODEV;
772	}
773
774	switch (code) {
775	case GADGET_GET_PRINTER_STATUS:
776	status = (int)dev->printer_status;
777	break;
778	case GADGET_SET_PRINTER_STATUS:
779	dev->printer_status = (u8)arg;
780	break;
781	default:
782	/* could not handle ioctl */
783	DBG(dev, "printer_ioctl: ERROR cmd=0x%4.4xis not supported\n",
784	code);
785	status = -ENOTTY;
786	}
787
788	spin_unlock_irqrestore(lock: &dev->lock, flags);
789
790	return status;
791	}
792
793	/* used after endpoint configuration */
794	static const struct file_operations printer_io_operations = {
795	.owner = THIS_MODULE,
796	.open = printer_open,
797	.read = printer_read,
798	.write = printer_write,
799	.fsync = printer_fsync,
800	.poll = printer_poll,
801	.unlocked_ioctl = printer_ioctl,
802	.release = printer_close,
803	.llseek = noop_llseek,
804	};
805
806	/*-------------------------------------------------------------------------*/
807
808	static int
809	set_printer_interface(struct printer_dev *dev)
810	{
811	int result = 0;
812
813	dev->in_ep->desc = ep_desc(gadget: dev->gadget, fs: &fs_ep_in_desc, hs: &hs_ep_in_desc,
814	ss: &ss_ep_in_desc);
815	dev->in_ep->driver_data = dev;
816
817	dev->out_ep->desc = ep_desc(gadget: dev->gadget, fs: &fs_ep_out_desc,
818	hs: &hs_ep_out_desc, ss: &ss_ep_out_desc);
819	dev->out_ep->driver_data = dev;
820
821	result = usb_ep_enable(ep: dev->in_ep);
822	if (result != 0) {
823	DBG(dev, "enable %s --> %d\n", dev->in_ep->name, result);
824	goto done;
825	}
826
827	result = usb_ep_enable(ep: dev->out_ep);
828	if (result != 0) {
829	DBG(dev, "enable %s --> %d\n", dev->out_ep->name, result);
830	goto done;
831	}
832
833	done:
834	/* on error, disable any endpoints */
835	if (result != 0) {
836	(void) usb_ep_disable(ep: dev->in_ep);
837	(void) usb_ep_disable(ep: dev->out_ep);
838	dev->in_ep->desc = NULL;
839	dev->out_ep->desc = NULL;
840	}
841
842	/* caller is responsible for cleanup on error */
843	return result;
844	}
845
846	static void printer_reset_interface(struct printer_dev *dev)
847	{
848	unsigned long flags;
849
850	if (dev->interface < 0)
851	return;
852
853	if (dev->in_ep->desc)
854	usb_ep_disable(ep: dev->in_ep);
855
856	if (dev->out_ep->desc)
857	usb_ep_disable(ep: dev->out_ep);
858
859	spin_lock_irqsave(&dev->lock, flags);
860	dev->in_ep->desc = NULL;
861	dev->out_ep->desc = NULL;
862	dev->interface = -1;
863	spin_unlock_irqrestore(lock: &dev->lock, flags);
864	}
865
866	/* Change our operational Interface. */
867	static int set_interface(struct printer_dev *dev, unsigned number)
868	{
869	int result = 0;
870
871	/* Free the current interface */
872	printer_reset_interface(dev);
873
874	result = set_printer_interface(dev);
875	if (result)
876	printer_reset_interface(dev);
877	else
878	dev->interface = number;
879
880	if (!result)
881	INFO(dev, "Using interface %x\n", number);
882
883	return result;
884	}
885
886	static void printer_soft_reset(struct printer_dev *dev)
887	{
888	struct usb_request *req;
889
890	if (usb_ep_disable(ep: dev->in_ep))
891	DBG(dev, "Failed to disable USB in_ep\n");
892	if (usb_ep_disable(ep: dev->out_ep))
893	DBG(dev, "Failed to disable USB out_ep\n");
894
895	if (dev->current_rx_req != NULL) {
896	list_add(new: &dev->current_rx_req->list, head: &dev->rx_reqs);
897	dev->current_rx_req = NULL;
898	}
899	dev->current_rx_bytes = 0;
900	dev->current_rx_buf = NULL;
901	dev->reset_printer = 1;
902
903	while (likely(!(list_empty(&dev->rx_buffers)))) {
904	req = container_of(dev->rx_buffers.next, struct usb_request,
905	list);
906	list_del_init(entry: &req->list);
907	list_add(new: &req->list, head: &dev->rx_reqs);
908	}
909
910	while (likely(!(list_empty(&dev->rx_reqs_active)))) {
911	req = container_of(dev->rx_buffers.next, struct usb_request,
912	list);
913	list_del_init(entry: &req->list);
914	list_add(new: &req->list, head: &dev->rx_reqs);
915	}
916
917	while (likely(!(list_empty(&dev->tx_reqs_active)))) {
918	req = container_of(dev->tx_reqs_active.next,
919	struct usb_request, list);
920	list_del_init(entry: &req->list);
921	list_add(new: &req->list, head: &dev->tx_reqs);
922	}
923
924	if (usb_ep_enable(ep: dev->in_ep))
925	DBG(dev, "Failed to enable USB in_ep\n");
926	if (usb_ep_enable(ep: dev->out_ep))
927	DBG(dev, "Failed to enable USB out_ep\n");
928
929	wake_up_interruptible(&dev->rx_wait);
930	wake_up_interruptible(&dev->tx_wait);
931	wake_up_interruptible(&dev->tx_flush_wait);
932	}
933
934	/*-------------------------------------------------------------------------*/
935
936	static bool gprinter_req_match(struct usb_function *f,
937	const struct usb_ctrlrequest *ctrl,
938	bool config0)
939	{
940	struct printer_dev *dev = func_to_printer(f);
941	u16 w_index = le16_to_cpu(ctrl->wIndex);
942	u16 w_value = le16_to_cpu(ctrl->wValue);
943	u16 w_length = le16_to_cpu(ctrl->wLength);
944
945	if (config0)
946	return false;
947
948	if ((ctrl->bRequestType & USB_RECIP_MASK) != USB_RECIP_INTERFACE ||
949	(ctrl->bRequestType & USB_TYPE_MASK) != USB_TYPE_CLASS)
950	return false;
951
952	switch (ctrl->bRequest) {
953	case GET_DEVICE_ID:
954	w_index >>= 8;
955	if (USB_DIR_IN & ctrl->bRequestType)
956	break;
957	return false;
958	case GET_PORT_STATUS:
959	if (!w_value && w_length == 1 &&
960	(USB_DIR_IN & ctrl->bRequestType))
961	break;
962	return false;
963	case SOFT_RESET:
964	if (!w_value && !w_length &&
965	!(USB_DIR_IN & ctrl->bRequestType))
966	break;
967	fallthrough;
968	default:
969	return false;
970	}
971	return w_index == dev->interface;
972	}
973
974	/*
975	* The setup() callback implements all the ep0 functionality that's not
976	* handled lower down.
977	*/
978	static int printer_func_setup(struct usb_function *f,
979	const struct usb_ctrlrequest *ctrl)
980	{
981	struct printer_dev *dev = func_to_printer(f);
982	struct usb_composite_dev *cdev = f->config->cdev;
983	struct usb_request *req = cdev->req;
984	u8 *buf = req->buf;
985	int value = -EOPNOTSUPP;
986	u16 wIndex = le16_to_cpu(ctrl->wIndex);
987	u16 wValue = le16_to_cpu(ctrl->wValue);
988	u16 wLength = le16_to_cpu(ctrl->wLength);
989
990	DBG(dev, "ctrl req%02x.%02x v%04x i%04x l%d\n",
991	ctrl->bRequestType, ctrl->bRequest, wValue, wIndex, wLength);
992
993	switch (ctrl->bRequestType&USB_TYPE_MASK) {
994	case USB_TYPE_CLASS:
995	switch (ctrl->bRequest) {
996	case GET_DEVICE_ID: /* Get the IEEE-1284 PNP String */
997	/* Only one printer interface is supported. */
998	if ((wIndex>>8) != dev->interface)
999	break;
1000
1001	if (!*dev->pnp_string) {
1002	value = 0;
1003	break;
1004	}
1005	value = strlen(*dev->pnp_string);
1006	buf[0] = (value >> 8) & 0xFF;
1007	buf[1] = value & 0xFF;
1008	memcpy(buf + 2, *dev->pnp_string, value);
1009	DBG(dev, "1284 PNP String: %x %s\n", value,
1010	*dev->pnp_string);
1011	break;
1012
1013	case GET_PORT_STATUS: /* Get Port Status */
1014	/* Only one printer interface is supported. */
1015	if (wIndex != dev->interface)
1016	break;
1017
1018	buf[0] = dev->printer_status;
1019	value = min_t(u16, wLength, 1);
1020	break;
1021
1022	case SOFT_RESET: /* Soft Reset */
1023	/* Only one printer interface is supported. */
1024	if (wIndex != dev->interface)
1025	break;
1026
1027	printer_soft_reset(dev);
1028
1029	value = 0;
1030	break;
1031
1032	default:
1033	goto unknown;
1034	}
1035	break;
1036
1037	default:
1038	unknown:
1039	VDBG(dev,
1040	"unknown ctrl req%02x.%02x v%04x i%04x l%d\n",
1041	ctrl->bRequestType, ctrl->bRequest,
1042	wValue, wIndex, wLength);
1043	break;
1044	}
1045	/* host either stalls (value < 0) or reports success */
1046	if (value >= 0) {
1047	req->length = value;
1048	req->zero = value < wLength;
1049	value = usb_ep_queue(ep: cdev->gadget->ep0, req, GFP_ATOMIC);
1050	if (value < 0) {
1051	ERROR(dev, "%s:%d Error!\n", __func__, __LINE__);
1052	req->status = 0;
1053	}
1054	}
1055	return value;
1056	}
1057
1058	static int printer_func_bind(struct usb_configuration *c,
1059	struct usb_function *f)
1060	{
1061	struct usb_gadget *gadget = c->cdev->gadget;
1062	struct printer_dev *dev = func_to_printer(f);
1063	struct device *pdev;
1064	struct usb_composite_dev *cdev = c->cdev;
1065	struct usb_ep *in_ep;
1066	struct usb_ep *out_ep = NULL;
1067	struct usb_request *req;
1068	dev_t devt;
1069	int id;
1070	int ret;
1071	u32 i;
1072
1073	id = usb_interface_id(c, f);
1074	if (id < 0)
1075	return id;
1076	intf_desc.bInterfaceNumber = id;
1077
1078	/* finish hookup to lower layer ... */
1079	dev->gadget = gadget;
1080
1081	/* all we really need is bulk IN/OUT */
1082	in_ep = usb_ep_autoconfig(cdev->gadget, &fs_ep_in_desc);
1083	if (!in_ep) {
1084	autoconf_fail:
1085	dev_err(&cdev->gadget->dev, "can't autoconfigure on %s\n",
1086	cdev->gadget->name);
1087	return -ENODEV;
1088	}
1089
1090	out_ep = usb_ep_autoconfig(cdev->gadget, &fs_ep_out_desc);
1091	if (!out_ep)
1092	goto autoconf_fail;
1093
1094	/* assumes that all endpoints are dual-speed */
1095	hs_ep_in_desc.bEndpointAddress = fs_ep_in_desc.bEndpointAddress;
1096	hs_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress;
1097	ss_ep_in_desc.bEndpointAddress = fs_ep_in_desc.bEndpointAddress;
1098	ss_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress;
1099
1100	ret = usb_assign_descriptors(f, fs: fs_printer_function,
1101	hs: hs_printer_function, ss: ss_printer_function,
1102	ssp: ss_printer_function);
1103	if (ret)
1104	return ret;
1105
1106	dev->in_ep = in_ep;
1107	dev->out_ep = out_ep;
1108
1109	ret = -ENOMEM;
1110	for (i = 0; i < dev->q_len; i++) {
1111	req = printer_req_alloc(ep: dev->in_ep, USB_BUFSIZE, GFP_KERNEL);
1112	if (!req)
1113	goto fail_tx_reqs;
1114	list_add(new: &req->list, head: &dev->tx_reqs);
1115	}
1116
1117	for (i = 0; i < dev->q_len; i++) {
1118	req = printer_req_alloc(ep: dev->out_ep, USB_BUFSIZE, GFP_KERNEL);
1119	if (!req)
1120	goto fail_rx_reqs;
1121	list_add(new: &req->list, head: &dev->rx_reqs);
1122	}
1123
1124	/* Setup the sysfs files for the printer gadget. */
1125	devt = MKDEV(major, dev->minor);
1126	pdev = device_create(cls: &usb_gadget_class, NULL, devt,
1127	NULL, fmt: "g_printer%d", dev->minor);
1128	if (IS_ERR(ptr: pdev)) {
1129	ERROR(dev, "Failed to create device: g_printer\n");
1130	ret = PTR_ERR(ptr: pdev);
1131	goto fail_rx_reqs;
1132	}
1133
1134	/*
1135	* Register a character device as an interface to a user mode
1136	* program that handles the printer specific functionality.
1137	*/
1138	cdev_init(&dev->printer_cdev, &printer_io_operations);
1139	dev->printer_cdev.owner = THIS_MODULE;
1140	ret = cdev_add(&dev->printer_cdev, devt, 1);
1141	if (ret) {
1142	ERROR(dev, "Failed to open char device\n");
1143	goto fail_cdev_add;
1144	}
1145
1146	return 0;
1147
1148	fail_cdev_add:
1149	device_destroy(cls: &usb_gadget_class, devt);
1150
1151	fail_rx_reqs:
1152	while (!list_empty(head: &dev->rx_reqs)) {
1153	req = container_of(dev->rx_reqs.next, struct usb_request, list);
1154	list_del(entry: &req->list);
1155	printer_req_free(ep: dev->out_ep, req);
1156	}
1157
1158	fail_tx_reqs:
1159	while (!list_empty(head: &dev->tx_reqs)) {
1160	req = container_of(dev->tx_reqs.next, struct usb_request, list);
1161	list_del(entry: &req->list);
1162	printer_req_free(ep: dev->in_ep, req);
1163	}
1164
1165	usb_free_all_descriptors(f);
1166	return ret;
1167
1168	}
1169
1170	static int printer_func_set_alt(struct usb_function *f,
1171	unsigned intf, unsigned alt)
1172	{
1173	struct printer_dev *dev = func_to_printer(f);
1174	int ret = -ENOTSUPP;
1175
1176	if (!alt)
1177	ret = set_interface(dev, number: intf);
1178
1179	return ret;
1180	}
1181
1182	static void printer_func_disable(struct usb_function *f)
1183	{
1184	struct printer_dev *dev = func_to_printer(f);
1185
1186	printer_reset_interface(dev);
1187	}
1188
1189	static inline struct f_printer_opts
1190	*to_f_printer_opts(struct config_item *item)
1191	{
1192	return container_of(to_config_group(item), struct f_printer_opts,
1193	func_inst.group);
1194	}
1195
1196	static void printer_attr_release(struct config_item *item)
1197	{
1198	struct f_printer_opts *opts = to_f_printer_opts(item);
1199
1200	usb_put_function_instance(fi: &opts->func_inst);
1201	}
1202
1203	static struct configfs_item_operations printer_item_ops = {
1204	.release = printer_attr_release,
1205	};
1206
1207	static ssize_t f_printer_opts_pnp_string_show(struct config_item *item,
1208	char *page)
1209	{
1210	struct f_printer_opts *opts = to_f_printer_opts(item);
1211	int result = 0;
1212
1213	mutex_lock(&opts->lock);
1214	if (!opts->pnp_string)
1215	goto unlock;
1216
1217	result = strscpy(page, opts->pnp_string, PAGE_SIZE);
1218	if (result < 1) {
1219	result = PAGE_SIZE;
1220	} else if (page[result - 1] != '\n' && result + 1 < PAGE_SIZE) {
1221	page[result++] = '\n';
1222	page[result] = '\0';
1223	}
1224
1225	unlock:
1226	mutex_unlock(lock: &opts->lock);
1227
1228	return result;
1229	}
1230
1231	static ssize_t f_printer_opts_pnp_string_store(struct config_item *item,
1232	const char *page, size_t len)
1233	{
1234	struct f_printer_opts *opts = to_f_printer_opts(item);
1235	char *new_pnp;
1236	int result;
1237
1238	mutex_lock(&opts->lock);
1239
1240	new_pnp = kstrndup(s: page, len, GFP_KERNEL);
1241	if (!new_pnp) {
1242	result = -ENOMEM;
1243	goto unlock;
1244	}
1245
1246	if (opts->pnp_string_allocated)
1247	kfree(objp: opts->pnp_string);
1248
1249	opts->pnp_string_allocated = true;
1250	opts->pnp_string = new_pnp;
1251	result = len;
1252	unlock:
1253	mutex_unlock(lock: &opts->lock);
1254
1255	return result;
1256	}
1257
1258	CONFIGFS_ATTR(f_printer_opts_, pnp_string);
1259
1260	static ssize_t f_printer_opts_q_len_show(struct config_item *item,
1261	char *page)
1262	{
1263	struct f_printer_opts *opts = to_f_printer_opts(item);
1264	int result;
1265
1266	mutex_lock(&opts->lock);
1267	result = sprintf(buf: page, fmt: "%d\n", opts->q_len);
1268	mutex_unlock(lock: &opts->lock);
1269
1270	return result;
1271	}
1272
1273	static ssize_t f_printer_opts_q_len_store(struct config_item *item,
1274	const char *page, size_t len)
1275	{
1276	struct f_printer_opts *opts = to_f_printer_opts(item);
1277	int ret;
1278	u16 num;
1279
1280	mutex_lock(&opts->lock);
1281	if (opts->refcnt) {
1282	ret = -EBUSY;
1283	goto end;
1284	}
1285
1286	ret = kstrtou16(s: page, base: 0, res: &num);
1287	if (ret)
1288	goto end;
1289
1290	opts->q_len = (unsigned)num;
1291	ret = len;
1292	end:
1293	mutex_unlock(lock: &opts->lock);
1294	return ret;
1295	}
1296
1297	CONFIGFS_ATTR(f_printer_opts_, q_len);
1298
1299	static struct configfs_attribute *printer_attrs[] = {
1300	&f_printer_opts_attr_pnp_string,
1301	&f_printer_opts_attr_q_len,
1302	NULL,
1303	};
1304
1305	static const struct config_item_type printer_func_type = {
1306	.ct_item_ops = &printer_item_ops,
1307	.ct_attrs = printer_attrs,
1308	.ct_owner = THIS_MODULE,
1309	};
1310
1311	static inline int gprinter_get_minor(void)
1312	{
1313	int ret;
1314
1315	ret = ida_simple_get(&printer_ida, 0, 0, GFP_KERNEL);
1316	if (ret >= PRINTER_MINORS) {
1317	ida_simple_remove(&printer_ida, ret);
1318	ret = -ENODEV;
1319	}
1320
1321	return ret;
1322	}
1323
1324	static inline void gprinter_put_minor(int minor)
1325	{
1326	ida_simple_remove(&printer_ida, minor);
1327	}
1328
1329	static int gprinter_setup(int);
1330	static void gprinter_cleanup(void);
1331
1332	static void gprinter_free_inst(struct usb_function_instance *f)
1333	{
1334	struct f_printer_opts *opts;
1335
1336	opts = container_of(f, struct f_printer_opts, func_inst);
1337
1338	mutex_lock(&printer_ida_lock);
1339
1340	gprinter_put_minor(minor: opts->minor);
1341	if (ida_is_empty(ida: &printer_ida))
1342	gprinter_cleanup();
1343
1344	mutex_unlock(lock: &printer_ida_lock);
1345
1346	if (opts->pnp_string_allocated)
1347	kfree(objp: opts->pnp_string);
1348	kfree(objp: opts);
1349	}
1350
1351	static struct usb_function_instance *gprinter_alloc_inst(void)
1352	{
1353	struct f_printer_opts *opts;
1354	struct usb_function_instance *ret;
1355	int status = 0;
1356
1357	opts = kzalloc(size: sizeof(*opts), GFP_KERNEL);
1358	if (!opts)
1359	return ERR_PTR(error: -ENOMEM);
1360
1361	mutex_init(&opts->lock);
1362	opts->func_inst.free_func_inst = gprinter_free_inst;
1363	ret = &opts->func_inst;
1364
1365	/* Make sure q_len is initialized, otherwise the bound device can't support read/write! */
1366	opts->q_len = DEFAULT_Q_LEN;
1367
1368	mutex_lock(&printer_ida_lock);
1369
1370	if (ida_is_empty(ida: &printer_ida)) {
1371	status = gprinter_setup(PRINTER_MINORS);
1372	if (status) {
1373	ret = ERR_PTR(error: status);
1374	kfree(objp: opts);
1375	goto unlock;
1376	}
1377	}
1378
1379	opts->minor = gprinter_get_minor();
1380	if (opts->minor < 0) {
1381	ret = ERR_PTR(error: opts->minor);
1382	kfree(objp: opts);
1383	if (ida_is_empty(ida: &printer_ida))
1384	gprinter_cleanup();
1385	goto unlock;
1386	}
1387	config_group_init_type_name(group: &opts->func_inst.group, name: "",
1388	type: &printer_func_type);
1389
1390	unlock:
1391	mutex_unlock(lock: &printer_ida_lock);
1392	return ret;
1393	}
1394
1395	static void gprinter_free(struct usb_function *f)
1396	{
1397	struct printer_dev *dev = func_to_printer(f);
1398	struct f_printer_opts *opts;
1399
1400	opts = container_of(f->fi, struct f_printer_opts, func_inst);
1401
1402	kref_put(kref: &dev->kref, release: printer_dev_free);
1403	mutex_lock(&opts->lock);
1404	--opts->refcnt;
1405	mutex_unlock(lock: &opts->lock);
1406	}
1407
1408	static void printer_func_unbind(struct usb_configuration *c,
1409	struct usb_function *f)
1410	{
1411	struct printer_dev *dev;
1412	struct usb_request *req;
1413
1414	dev = func_to_printer(f);
1415
1416	device_destroy(cls: &usb_gadget_class, MKDEV(major, dev->minor));
1417
1418	/* Remove Character Device */
1419	cdev_del(&dev->printer_cdev);
1420
1421	/* we must already have been disconnected ... no i/o may be active */
1422	WARN_ON(!list_empty(&dev->tx_reqs_active));
1423	WARN_ON(!list_empty(&dev->rx_reqs_active));
1424
1425	/* Free all memory for this driver. */
1426	while (!list_empty(head: &dev->tx_reqs)) {
1427	req = container_of(dev->tx_reqs.next, struct usb_request,
1428	list);
1429	list_del(entry: &req->list);
1430	printer_req_free(ep: dev->in_ep, req);
1431	}
1432
1433	if (dev->current_rx_req != NULL)
1434	printer_req_free(ep: dev->out_ep, req: dev->current_rx_req);
1435
1436	while (!list_empty(head: &dev->rx_reqs)) {
1437	req = container_of(dev->rx_reqs.next,
1438	struct usb_request, list);
1439	list_del(entry: &req->list);
1440	printer_req_free(ep: dev->out_ep, req);
1441	}
1442
1443	while (!list_empty(head: &dev->rx_buffers)) {
1444	req = container_of(dev->rx_buffers.next,
1445	struct usb_request, list);
1446	list_del(entry: &req->list);
1447	printer_req_free(ep: dev->out_ep, req);
1448	}
1449	usb_free_all_descriptors(f);
1450	}
1451
1452	static struct usb_function *gprinter_alloc(struct usb_function_instance *fi)
1453	{
1454	struct printer_dev *dev;
1455	struct f_printer_opts *opts;
1456
1457	opts = container_of(fi, struct f_printer_opts, func_inst);
1458
1459	mutex_lock(&opts->lock);
1460	if (opts->minor >= minors) {
1461	mutex_unlock(lock: &opts->lock);
1462	return ERR_PTR(error: -ENOENT);
1463	}
1464
1465	dev = kzalloc(size: sizeof(*dev), GFP_KERNEL);
1466	if (!dev) {
1467	mutex_unlock(lock: &opts->lock);
1468	return ERR_PTR(error: -ENOMEM);
1469	}
1470
1471	kref_init(kref: &dev->kref);
1472	++opts->refcnt;
1473	dev->minor = opts->minor;
1474	dev->pnp_string = &opts->pnp_string;
1475	dev->q_len = opts->q_len;
1476	mutex_unlock(lock: &opts->lock);
1477
1478	dev->function.name = "printer";
1479	dev->function.bind = printer_func_bind;
1480	dev->function.setup = printer_func_setup;
1481	dev->function.unbind = printer_func_unbind;
1482	dev->function.set_alt = printer_func_set_alt;
1483	dev->function.disable = printer_func_disable;
1484	dev->function.req_match = gprinter_req_match;
1485	dev->function.free_func = gprinter_free;
1486
1487	INIT_LIST_HEAD(list: &dev->tx_reqs);
1488	INIT_LIST_HEAD(list: &dev->rx_reqs);
1489	INIT_LIST_HEAD(list: &dev->rx_buffers);
1490	INIT_LIST_HEAD(list: &dev->tx_reqs_active);
1491	INIT_LIST_HEAD(list: &dev->rx_reqs_active);
1492
1493	spin_lock_init(&dev->lock);
1494	mutex_init(&dev->lock_printer_io);
1495	init_waitqueue_head(&dev->rx_wait);
1496	init_waitqueue_head(&dev->tx_wait);
1497	init_waitqueue_head(&dev->tx_flush_wait);
1498
1499	dev->interface = -1;
1500	dev->printer_cdev_open = 0;
1501	dev->printer_status = PRINTER_NOT_ERROR;
1502	dev->current_rx_req = NULL;
1503	dev->current_rx_bytes = 0;
1504	dev->current_rx_buf = NULL;
1505
1506	return &dev->function;
1507	}
1508
1509	DECLARE_USB_FUNCTION_INIT(printer, gprinter_alloc_inst, gprinter_alloc);
1510	MODULE_LICENSE("GPL");
1511	MODULE_AUTHOR("Craig Nadler");
1512
1513	static int gprinter_setup(int count)
1514	{
1515	int status;
1516	dev_t devt;
1517
1518	status = class_register(class: &usb_gadget_class);
1519	if (status)
1520	return status;
1521
1522	status = alloc_chrdev_region(&devt, 0, count, "USB printer gadget");
1523	if (status) {
1524	pr_err("alloc_chrdev_region %d\n", status);
1525	class_unregister(class: &usb_gadget_class);
1526	return status;
1527	}
1528
1529	major = MAJOR(devt);
1530	minors = count;
1531
1532	return status;
1533	}
1534
1535	static void gprinter_cleanup(void)
1536	{
1537	if (major) {
1538	unregister_chrdev_region(MKDEV(major, 0), minors);
1539	major = minors = 0;
1540	}
1541	class_unregister(class: &usb_gadget_class);
1542	}
1543