OSDN Git Service

USB: ldusb: fix NULL-derefs on driver unbind
[sagit-ice-cold/kernel_xiaomi_msm8998.git] / drivers / usb / misc / ldusb.c
1 /**
2  * Generic USB driver for report based interrupt in/out devices
3  * like LD Didactic's USB devices. LD Didactic's USB devices are
4  * HID devices which do not use HID report definitons (they use
5  * raw interrupt in and our reports only for communication).
6  *
7  * This driver uses a ring buffer for time critical reading of
8  * interrupt in reports and provides read and write methods for
9  * raw interrupt reports (similar to the Windows HID driver).
10  * Devices based on the book USB COMPLETE by Jan Axelson may need
11  * such a compatibility to the Windows HID driver.
12  *
13  * Copyright (C) 2005 Michael Hund <mhund@ld-didactic.de>
14  *
15  *      This program is free software; you can redistribute it and/or
16  *      modify it under the terms of the GNU General Public License as
17  *      published by the Free Software Foundation; either version 2 of
18  *      the License, or (at your option) any later version.
19  *
20  * Derived from Lego USB Tower driver
21  * Copyright (C) 2003 David Glance <advidgsf@sourceforge.net>
22  *               2001-2004 Juergen Stuber <starblue@users.sourceforge.net>
23  */
24
25 #include <linux/kernel.h>
26 #include <linux/errno.h>
27 #include <linux/slab.h>
28 #include <linux/module.h>
29 #include <linux/mutex.h>
30
31 #include <asm/uaccess.h>
32 #include <linux/input.h>
33 #include <linux/usb.h>
34 #include <linux/poll.h>
35
36 /* Define these values to match your devices */
37 #define USB_VENDOR_ID_LD                0x0f11  /* USB Vendor ID of LD Didactic GmbH */
38 #define USB_DEVICE_ID_LD_CASSY          0x1000  /* USB Product ID of CASSY-S modules with 8 bytes endpoint size */
39 #define USB_DEVICE_ID_LD_CASSY2         0x1001  /* USB Product ID of CASSY-S modules with 64 bytes endpoint size */
40 #define USB_DEVICE_ID_LD_POCKETCASSY    0x1010  /* USB Product ID of Pocket-CASSY */
41 #define USB_DEVICE_ID_LD_POCKETCASSY2   0x1011  /* USB Product ID of Pocket-CASSY 2 (reserved) */
42 #define USB_DEVICE_ID_LD_MOBILECASSY    0x1020  /* USB Product ID of Mobile-CASSY */
43 #define USB_DEVICE_ID_LD_MOBILECASSY2   0x1021  /* USB Product ID of Mobile-CASSY 2 (reserved) */
44 #define USB_DEVICE_ID_LD_MICROCASSYVOLTAGE      0x1031  /* USB Product ID of Micro-CASSY Voltage */
45 #define USB_DEVICE_ID_LD_MICROCASSYCURRENT      0x1032  /* USB Product ID of Micro-CASSY Current */
46 #define USB_DEVICE_ID_LD_MICROCASSYTIME         0x1033  /* USB Product ID of Micro-CASSY Time (reserved) */
47 #define USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE  0x1035  /* USB Product ID of Micro-CASSY Temperature */
48 #define USB_DEVICE_ID_LD_MICROCASSYPH           0x1038  /* USB Product ID of Micro-CASSY pH */
49 #define USB_DEVICE_ID_LD_POWERANALYSERCASSY     0x1040  /* USB Product ID of Power Analyser CASSY */
50 #define USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY       0x1042  /* USB Product ID of Converter Controller CASSY */
51 #define USB_DEVICE_ID_LD_MACHINETESTCASSY       0x1043  /* USB Product ID of Machine Test CASSY */
52 #define USB_DEVICE_ID_LD_JWM            0x1080  /* USB Product ID of Joule and Wattmeter */
53 #define USB_DEVICE_ID_LD_DMMP           0x1081  /* USB Product ID of Digital Multimeter P (reserved) */
54 #define USB_DEVICE_ID_LD_UMIP           0x1090  /* USB Product ID of UMI P */
55 #define USB_DEVICE_ID_LD_UMIC           0x10A0  /* USB Product ID of UMI C */
56 #define USB_DEVICE_ID_LD_UMIB           0x10B0  /* USB Product ID of UMI B */
57 #define USB_DEVICE_ID_LD_XRAY           0x1100  /* USB Product ID of X-Ray Apparatus 55481 */
58 #define USB_DEVICE_ID_LD_XRAY2          0x1101  /* USB Product ID of X-Ray Apparatus 554800 */
59 #define USB_DEVICE_ID_LD_XRAYCT         0x1110  /* USB Product ID of X-Ray Apparatus CT 554821*/
60 #define USB_DEVICE_ID_LD_VIDEOCOM       0x1200  /* USB Product ID of VideoCom */
61 #define USB_DEVICE_ID_LD_MOTOR          0x1210  /* USB Product ID of Motor (reserved) */
62 #define USB_DEVICE_ID_LD_COM3LAB        0x2000  /* USB Product ID of COM3LAB */
63 #define USB_DEVICE_ID_LD_TELEPORT       0x2010  /* USB Product ID of Terminal Adapter */
64 #define USB_DEVICE_ID_LD_NETWORKANALYSER 0x2020 /* USB Product ID of Network Analyser */
65 #define USB_DEVICE_ID_LD_POWERCONTROL   0x2030  /* USB Product ID of Converter Control Unit */
66 #define USB_DEVICE_ID_LD_MACHINETEST    0x2040  /* USB Product ID of Machine Test System */
67 #define USB_DEVICE_ID_LD_MOSTANALYSER   0x2050  /* USB Product ID of MOST Protocol Analyser */
68 #define USB_DEVICE_ID_LD_MOSTANALYSER2  0x2051  /* USB Product ID of MOST Protocol Analyser 2 */
69 #define USB_DEVICE_ID_LD_ABSESP         0x2060  /* USB Product ID of ABS ESP */
70 #define USB_DEVICE_ID_LD_AUTODATABUS    0x2070  /* USB Product ID of Automotive Data Buses */
71 #define USB_DEVICE_ID_LD_MCT            0x2080  /* USB Product ID of Microcontroller technique */
72 #define USB_DEVICE_ID_LD_HYBRID         0x2090  /* USB Product ID of Automotive Hybrid */
73 #define USB_DEVICE_ID_LD_HEATCONTROL    0x20A0  /* USB Product ID of Heat control */
74
75 #ifdef CONFIG_USB_DYNAMIC_MINORS
76 #define USB_LD_MINOR_BASE       0
77 #else
78 #define USB_LD_MINOR_BASE       176
79 #endif
80
81 /* table of devices that work with this driver */
82 static const struct usb_device_id ld_usb_table[] = {
83         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CASSY) },
84         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CASSY2) },
85         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POCKETCASSY) },
86         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POCKETCASSY2) },
87         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MOBILECASSY) },
88         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MOBILECASSY2) },
89         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYVOLTAGE) },
90         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYCURRENT) },
91         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTIME) },
92         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE) },
93         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYPH) },
94         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERANALYSERCASSY) },
95         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY) },
96         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETESTCASSY) },
97         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_JWM) },
98         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_DMMP) },
99         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIP) },
100         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIC) },
101         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIB) },
102         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_XRAY) },
103         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_XRAY2) },
104         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_VIDEOCOM) },
105         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MOTOR) },
106         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_COM3LAB) },
107         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_TELEPORT) },
108         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_NETWORKANALYSER) },
109         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERCONTROL) },
110         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETEST) },
111         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MOSTANALYSER) },
112         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MOSTANALYSER2) },
113         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_ABSESP) },
114         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_AUTODATABUS) },
115         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MCT) },
116         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_HYBRID) },
117         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_HEATCONTROL) },
118         { }                                     /* Terminating entry */
119 };
120 MODULE_DEVICE_TABLE(usb, ld_usb_table);
121 MODULE_VERSION("V0.14");
122 MODULE_AUTHOR("Michael Hund <mhund@ld-didactic.de>");
123 MODULE_DESCRIPTION("LD USB Driver");
124 MODULE_LICENSE("GPL");
125 MODULE_SUPPORTED_DEVICE("LD USB Devices");
126
127 /* All interrupt in transfers are collected in a ring buffer to
128  * avoid racing conditions and get better performance of the driver.
129  */
130 static int ring_buffer_size = 128;
131 module_param(ring_buffer_size, int, 0);
132 MODULE_PARM_DESC(ring_buffer_size, "Read ring buffer size in reports");
133
134 /* The write_buffer can contain more than one interrupt out transfer.
135  */
136 static int write_buffer_size = 10;
137 module_param(write_buffer_size, int, 0);
138 MODULE_PARM_DESC(write_buffer_size, "Write buffer size in reports");
139
140 /* As of kernel version 2.6.4 ehci-hcd uses an
141  * "only one interrupt transfer per frame" shortcut
142  * to simplify the scheduling of periodic transfers.
143  * This conflicts with our standard 1ms intervals for in and out URBs.
144  * We use default intervals of 2ms for in and 2ms for out transfers,
145  * which should be fast enough.
146  * Increase the interval to allow more devices that do interrupt transfers,
147  * or set to 1 to use the standard interval from the endpoint descriptors.
148  */
149 static int min_interrupt_in_interval = 2;
150 module_param(min_interrupt_in_interval, int, 0);
151 MODULE_PARM_DESC(min_interrupt_in_interval, "Minimum interrupt in interval in ms");
152
153 static int min_interrupt_out_interval = 2;
154 module_param(min_interrupt_out_interval, int, 0);
155 MODULE_PARM_DESC(min_interrupt_out_interval, "Minimum interrupt out interval in ms");
156
157 /* Structure to hold all of our device specific stuff */
158 struct ld_usb {
159         struct mutex            mutex;          /* locks this structure */
160         struct usb_interface*   intf;           /* save off the usb interface pointer */
161         unsigned long           disconnected:1;
162
163         int                     open_count;     /* number of times this port has been opened */
164
165         char*                   ring_buffer;
166         unsigned int            ring_head;
167         unsigned int            ring_tail;
168
169         wait_queue_head_t       read_wait;
170         wait_queue_head_t       write_wait;
171
172         char*                   interrupt_in_buffer;
173         struct usb_endpoint_descriptor* interrupt_in_endpoint;
174         struct urb*             interrupt_in_urb;
175         int                     interrupt_in_interval;
176         size_t                  interrupt_in_endpoint_size;
177         int                     interrupt_in_running;
178         int                     interrupt_in_done;
179         int                     buffer_overflow;
180         spinlock_t              rbsl;
181
182         char*                   interrupt_out_buffer;
183         struct usb_endpoint_descriptor* interrupt_out_endpoint;
184         struct urb*             interrupt_out_urb;
185         int                     interrupt_out_interval;
186         size_t                  interrupt_out_endpoint_size;
187         int                     interrupt_out_busy;
188 };
189
190 static struct usb_driver ld_usb_driver;
191
192 /**
193  *      ld_usb_abort_transfers
194  *      aborts transfers and frees associated data structures
195  */
196 static void ld_usb_abort_transfers(struct ld_usb *dev)
197 {
198         /* shutdown transfer */
199         if (dev->interrupt_in_running) {
200                 dev->interrupt_in_running = 0;
201                 usb_kill_urb(dev->interrupt_in_urb);
202         }
203         if (dev->interrupt_out_busy)
204                 usb_kill_urb(dev->interrupt_out_urb);
205 }
206
207 /**
208  *      ld_usb_delete
209  */
210 static void ld_usb_delete(struct ld_usb *dev)
211 {
212         /* free data structures */
213         usb_free_urb(dev->interrupt_in_urb);
214         usb_free_urb(dev->interrupt_out_urb);
215         kfree(dev->ring_buffer);
216         kfree(dev->interrupt_in_buffer);
217         kfree(dev->interrupt_out_buffer);
218         kfree(dev);
219 }
220
221 /**
222  *      ld_usb_interrupt_in_callback
223  */
224 static void ld_usb_interrupt_in_callback(struct urb *urb)
225 {
226         struct ld_usb *dev = urb->context;
227         size_t *actual_buffer;
228         unsigned int next_ring_head;
229         int status = urb->status;
230         int retval;
231
232         if (status) {
233                 if (status == -ENOENT ||
234                     status == -ECONNRESET ||
235                     status == -ESHUTDOWN) {
236                         goto exit;
237                 } else {
238                         dev_dbg(&dev->intf->dev,
239                                 "%s: nonzero status received: %d\n", __func__,
240                                 status);
241                         spin_lock(&dev->rbsl);
242                         goto resubmit; /* maybe we can recover */
243                 }
244         }
245
246         spin_lock(&dev->rbsl);
247         if (urb->actual_length > 0) {
248                 next_ring_head = (dev->ring_head+1) % ring_buffer_size;
249                 if (next_ring_head != dev->ring_tail) {
250                         actual_buffer = (size_t*)(dev->ring_buffer + dev->ring_head*(sizeof(size_t)+dev->interrupt_in_endpoint_size));
251                         /* actual_buffer gets urb->actual_length + interrupt_in_buffer */
252                         *actual_buffer = urb->actual_length;
253                         memcpy(actual_buffer+1, dev->interrupt_in_buffer, urb->actual_length);
254                         dev->ring_head = next_ring_head;
255                         dev_dbg(&dev->intf->dev, "%s: received %d bytes\n",
256                                 __func__, urb->actual_length);
257                 } else {
258                         dev_warn(&dev->intf->dev,
259                                  "Ring buffer overflow, %d bytes dropped\n",
260                                  urb->actual_length);
261                         dev->buffer_overflow = 1;
262                 }
263         }
264
265 resubmit:
266         /* resubmit if we're still running */
267         if (dev->interrupt_in_running && !dev->buffer_overflow) {
268                 retval = usb_submit_urb(dev->interrupt_in_urb, GFP_ATOMIC);
269                 if (retval) {
270                         dev_err(&dev->intf->dev,
271                                 "usb_submit_urb failed (%d)\n", retval);
272                         dev->buffer_overflow = 1;
273                 }
274         }
275         spin_unlock(&dev->rbsl);
276 exit:
277         dev->interrupt_in_done = 1;
278         wake_up_interruptible(&dev->read_wait);
279 }
280
281 /**
282  *      ld_usb_interrupt_out_callback
283  */
284 static void ld_usb_interrupt_out_callback(struct urb *urb)
285 {
286         struct ld_usb *dev = urb->context;
287         int status = urb->status;
288
289         /* sync/async unlink faults aren't errors */
290         if (status && !(status == -ENOENT ||
291                         status == -ECONNRESET ||
292                         status == -ESHUTDOWN))
293                 dev_dbg(&dev->intf->dev,
294                         "%s - nonzero write interrupt status received: %d\n",
295                         __func__, status);
296
297         dev->interrupt_out_busy = 0;
298         wake_up_interruptible(&dev->write_wait);
299 }
300
301 /**
302  *      ld_usb_open
303  */
304 static int ld_usb_open(struct inode *inode, struct file *file)
305 {
306         struct ld_usb *dev;
307         int subminor;
308         int retval;
309         struct usb_interface *interface;
310
311         nonseekable_open(inode, file);
312         subminor = iminor(inode);
313
314         interface = usb_find_interface(&ld_usb_driver, subminor);
315
316         if (!interface) {
317                 printk(KERN_ERR "%s - error, can't find device for minor %d\n",
318                        __func__, subminor);
319                 return -ENODEV;
320         }
321
322         dev = usb_get_intfdata(interface);
323
324         if (!dev)
325                 return -ENODEV;
326
327         /* lock this device */
328         if (mutex_lock_interruptible(&dev->mutex))
329                 return -ERESTARTSYS;
330
331         /* allow opening only once */
332         if (dev->open_count) {
333                 retval = -EBUSY;
334                 goto unlock_exit;
335         }
336         dev->open_count = 1;
337
338         /* initialize in direction */
339         dev->ring_head = 0;
340         dev->ring_tail = 0;
341         dev->buffer_overflow = 0;
342         usb_fill_int_urb(dev->interrupt_in_urb,
343                          interface_to_usbdev(interface),
344                          usb_rcvintpipe(interface_to_usbdev(interface),
345                                         dev->interrupt_in_endpoint->bEndpointAddress),
346                          dev->interrupt_in_buffer,
347                          dev->interrupt_in_endpoint_size,
348                          ld_usb_interrupt_in_callback,
349                          dev,
350                          dev->interrupt_in_interval);
351
352         dev->interrupt_in_running = 1;
353         dev->interrupt_in_done = 0;
354
355         retval = usb_submit_urb(dev->interrupt_in_urb, GFP_KERNEL);
356         if (retval) {
357                 dev_err(&interface->dev, "Couldn't submit interrupt_in_urb %d\n", retval);
358                 dev->interrupt_in_running = 0;
359                 dev->open_count = 0;
360                 goto unlock_exit;
361         }
362
363         /* save device in the file's private structure */
364         file->private_data = dev;
365
366 unlock_exit:
367         mutex_unlock(&dev->mutex);
368
369         return retval;
370 }
371
372 /**
373  *      ld_usb_release
374  */
375 static int ld_usb_release(struct inode *inode, struct file *file)
376 {
377         struct ld_usb *dev;
378         int retval = 0;
379
380         dev = file->private_data;
381
382         if (dev == NULL) {
383                 retval = -ENODEV;
384                 goto exit;
385         }
386
387         if (mutex_lock_interruptible(&dev->mutex)) {
388                 retval = -ERESTARTSYS;
389                 goto exit;
390         }
391
392         if (dev->open_count != 1) {
393                 retval = -ENODEV;
394                 goto unlock_exit;
395         }
396         if (dev->disconnected) {
397                 /* the device was unplugged before the file was released */
398                 mutex_unlock(&dev->mutex);
399                 /* unlock here as ld_usb_delete frees dev */
400                 ld_usb_delete(dev);
401                 goto exit;
402         }
403
404         /* wait until write transfer is finished */
405         if (dev->interrupt_out_busy)
406                 wait_event_interruptible_timeout(dev->write_wait, !dev->interrupt_out_busy, 2 * HZ);
407         ld_usb_abort_transfers(dev);
408         dev->open_count = 0;
409
410 unlock_exit:
411         mutex_unlock(&dev->mutex);
412
413 exit:
414         return retval;
415 }
416
417 /**
418  *      ld_usb_poll
419  */
420 static unsigned int ld_usb_poll(struct file *file, poll_table *wait)
421 {
422         struct ld_usb *dev;
423         unsigned int mask = 0;
424
425         dev = file->private_data;
426
427         if (dev->disconnected)
428                 return POLLERR | POLLHUP;
429
430         poll_wait(file, &dev->read_wait, wait);
431         poll_wait(file, &dev->write_wait, wait);
432
433         if (dev->ring_head != dev->ring_tail)
434                 mask |= POLLIN | POLLRDNORM;
435         if (!dev->interrupt_out_busy)
436                 mask |= POLLOUT | POLLWRNORM;
437
438         return mask;
439 }
440
441 /**
442  *      ld_usb_read
443  */
444 static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
445                            loff_t *ppos)
446 {
447         struct ld_usb *dev;
448         size_t *actual_buffer;
449         size_t bytes_to_read;
450         int retval = 0;
451         int rv;
452
453         dev = file->private_data;
454
455         /* verify that we actually have some data to read */
456         if (count == 0)
457                 goto exit;
458
459         /* lock this object */
460         if (mutex_lock_interruptible(&dev->mutex)) {
461                 retval = -ERESTARTSYS;
462                 goto exit;
463         }
464
465         /* verify that the device wasn't unplugged */
466         if (dev->disconnected) {
467                 retval = -ENODEV;
468                 printk(KERN_ERR "ldusb: No device or device unplugged %d\n", retval);
469                 goto unlock_exit;
470         }
471
472         /* wait for data */
473         spin_lock_irq(&dev->rbsl);
474         if (dev->ring_head == dev->ring_tail) {
475                 dev->interrupt_in_done = 0;
476                 spin_unlock_irq(&dev->rbsl);
477                 if (file->f_flags & O_NONBLOCK) {
478                         retval = -EAGAIN;
479                         goto unlock_exit;
480                 }
481                 retval = wait_event_interruptible(dev->read_wait, dev->interrupt_in_done);
482                 if (retval < 0)
483                         goto unlock_exit;
484         } else {
485                 spin_unlock_irq(&dev->rbsl);
486         }
487
488         /* actual_buffer contains actual_length + interrupt_in_buffer */
489         actual_buffer = (size_t*)(dev->ring_buffer + dev->ring_tail*(sizeof(size_t)+dev->interrupt_in_endpoint_size));
490         bytes_to_read = min(count, *actual_buffer);
491         if (bytes_to_read < *actual_buffer)
492                 dev_warn(&dev->intf->dev, "Read buffer overflow, %zd bytes dropped\n",
493                          *actual_buffer-bytes_to_read);
494
495         /* copy one interrupt_in_buffer from ring_buffer into userspace */
496         if (copy_to_user(buffer, actual_buffer+1, bytes_to_read)) {
497                 retval = -EFAULT;
498                 goto unlock_exit;
499         }
500         dev->ring_tail = (dev->ring_tail+1) % ring_buffer_size;
501
502         retval = bytes_to_read;
503
504         spin_lock_irq(&dev->rbsl);
505         if (dev->buffer_overflow) {
506                 dev->buffer_overflow = 0;
507                 spin_unlock_irq(&dev->rbsl);
508                 rv = usb_submit_urb(dev->interrupt_in_urb, GFP_KERNEL);
509                 if (rv < 0)
510                         dev->buffer_overflow = 1;
511         } else {
512                 spin_unlock_irq(&dev->rbsl);
513         }
514
515 unlock_exit:
516         /* unlock the device */
517         mutex_unlock(&dev->mutex);
518
519 exit:
520         return retval;
521 }
522
523 /**
524  *      ld_usb_write
525  */
526 static ssize_t ld_usb_write(struct file *file, const char __user *buffer,
527                             size_t count, loff_t *ppos)
528 {
529         struct ld_usb *dev;
530         size_t bytes_to_write;
531         int retval = 0;
532
533         dev = file->private_data;
534
535         /* verify that we actually have some data to write */
536         if (count == 0)
537                 goto exit;
538
539         /* lock this object */
540         if (mutex_lock_interruptible(&dev->mutex)) {
541                 retval = -ERESTARTSYS;
542                 goto exit;
543         }
544
545         /* verify that the device wasn't unplugged */
546         if (dev->disconnected) {
547                 retval = -ENODEV;
548                 printk(KERN_ERR "ldusb: No device or device unplugged %d\n", retval);
549                 goto unlock_exit;
550         }
551
552         /* wait until previous transfer is finished */
553         if (dev->interrupt_out_busy) {
554                 if (file->f_flags & O_NONBLOCK) {
555                         retval = -EAGAIN;
556                         goto unlock_exit;
557                 }
558                 retval = wait_event_interruptible(dev->write_wait, !dev->interrupt_out_busy);
559                 if (retval < 0) {
560                         goto unlock_exit;
561                 }
562         }
563
564         /* write the data into interrupt_out_buffer from userspace */
565         bytes_to_write = min(count, write_buffer_size*dev->interrupt_out_endpoint_size);
566         if (bytes_to_write < count)
567                 dev_warn(&dev->intf->dev, "Write buffer overflow, %zd bytes dropped\n",count-bytes_to_write);
568         dev_dbg(&dev->intf->dev, "%s: count = %zd, bytes_to_write = %zd\n",
569                 __func__, count, bytes_to_write);
570
571         if (copy_from_user(dev->interrupt_out_buffer, buffer, bytes_to_write)) {
572                 retval = -EFAULT;
573                 goto unlock_exit;
574         }
575
576         if (dev->interrupt_out_endpoint == NULL) {
577                 /* try HID_REQ_SET_REPORT=9 on control_endpoint instead of interrupt_out_endpoint */
578                 retval = usb_control_msg(interface_to_usbdev(dev->intf),
579                                          usb_sndctrlpipe(interface_to_usbdev(dev->intf), 0),
580                                          9,
581                                          USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_OUT,
582                                          1 << 8, 0,
583                                          dev->interrupt_out_buffer,
584                                          bytes_to_write,
585                                          USB_CTRL_SET_TIMEOUT * HZ);
586                 if (retval < 0)
587                         dev_err(&dev->intf->dev,
588                                 "Couldn't submit HID_REQ_SET_REPORT %d\n",
589                                 retval);
590                 goto unlock_exit;
591         }
592
593         /* send off the urb */
594         usb_fill_int_urb(dev->interrupt_out_urb,
595                          interface_to_usbdev(dev->intf),
596                          usb_sndintpipe(interface_to_usbdev(dev->intf),
597                                         dev->interrupt_out_endpoint->bEndpointAddress),
598                          dev->interrupt_out_buffer,
599                          bytes_to_write,
600                          ld_usb_interrupt_out_callback,
601                          dev,
602                          dev->interrupt_out_interval);
603
604         dev->interrupt_out_busy = 1;
605         wmb();
606
607         retval = usb_submit_urb(dev->interrupt_out_urb, GFP_KERNEL);
608         if (retval) {
609                 dev->interrupt_out_busy = 0;
610                 dev_err(&dev->intf->dev,
611                         "Couldn't submit interrupt_out_urb %d\n", retval);
612                 goto unlock_exit;
613         }
614         retval = bytes_to_write;
615
616 unlock_exit:
617         /* unlock the device */
618         mutex_unlock(&dev->mutex);
619
620 exit:
621         return retval;
622 }
623
624 /* file operations needed when we register this driver */
625 static const struct file_operations ld_usb_fops = {
626         .owner =        THIS_MODULE,
627         .read  =        ld_usb_read,
628         .write =        ld_usb_write,
629         .open =         ld_usb_open,
630         .release =      ld_usb_release,
631         .poll =         ld_usb_poll,
632         .llseek =       no_llseek,
633 };
634
635 /*
636  * usb class driver info in order to get a minor number from the usb core,
637  * and to have the device registered with the driver core
638  */
639 static struct usb_class_driver ld_usb_class = {
640         .name =         "ldusb%d",
641         .fops =         &ld_usb_fops,
642         .minor_base =   USB_LD_MINOR_BASE,
643 };
644
645 /**
646  *      ld_usb_probe
647  *
648  *      Called by the usb core when a new device is connected that it thinks
649  *      this driver might be interested in.
650  */
651 static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
652 {
653         struct usb_device *udev = interface_to_usbdev(intf);
654         struct ld_usb *dev = NULL;
655         struct usb_host_interface *iface_desc;
656         struct usb_endpoint_descriptor *endpoint;
657         char *buffer;
658         int i;
659         int retval = -ENOMEM;
660
661         /* allocate memory for our device state and initialize it */
662
663         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
664         if (dev == NULL) {
665                 dev_err(&intf->dev, "Out of memory\n");
666                 goto exit;
667         }
668         mutex_init(&dev->mutex);
669         spin_lock_init(&dev->rbsl);
670         dev->intf = intf;
671         init_waitqueue_head(&dev->read_wait);
672         init_waitqueue_head(&dev->write_wait);
673
674         /* workaround for early firmware versions on fast computers */
675         if ((le16_to_cpu(udev->descriptor.idVendor) == USB_VENDOR_ID_LD) &&
676             ((le16_to_cpu(udev->descriptor.idProduct) == USB_DEVICE_ID_LD_CASSY) ||
677              (le16_to_cpu(udev->descriptor.idProduct) == USB_DEVICE_ID_LD_COM3LAB)) &&
678             (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x103)) {
679                 buffer = kmalloc(256, GFP_KERNEL);
680                 if (buffer == NULL) {
681                         dev_err(&intf->dev, "Couldn't allocate string buffer\n");
682                         goto error;
683                 }
684                 /* usb_string makes SETUP+STALL to leave always ControlReadLoop */
685                 usb_string(udev, 255, buffer, 256);
686                 kfree(buffer);
687         }
688
689         iface_desc = intf->cur_altsetting;
690
691         /* set up the endpoint information */
692         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
693                 endpoint = &iface_desc->endpoint[i].desc;
694
695                 if (usb_endpoint_is_int_in(endpoint))
696                         dev->interrupt_in_endpoint = endpoint;
697
698                 if (usb_endpoint_is_int_out(endpoint))
699                         dev->interrupt_out_endpoint = endpoint;
700         }
701         if (dev->interrupt_in_endpoint == NULL) {
702                 dev_err(&intf->dev, "Interrupt in endpoint not found\n");
703                 goto error;
704         }
705         if (dev->interrupt_out_endpoint == NULL)
706                 dev_warn(&intf->dev, "Interrupt out endpoint not found (using control endpoint instead)\n");
707
708         dev->interrupt_in_endpoint_size = usb_endpoint_maxp(dev->interrupt_in_endpoint);
709         dev->ring_buffer = kmalloc(ring_buffer_size*(sizeof(size_t)+dev->interrupt_in_endpoint_size), GFP_KERNEL);
710         if (!dev->ring_buffer) {
711                 dev_err(&intf->dev, "Couldn't allocate ring_buffer\n");
712                 goto error;
713         }
714         dev->interrupt_in_buffer = kmalloc(dev->interrupt_in_endpoint_size, GFP_KERNEL);
715         if (!dev->interrupt_in_buffer) {
716                 dev_err(&intf->dev, "Couldn't allocate interrupt_in_buffer\n");
717                 goto error;
718         }
719         dev->interrupt_in_urb = usb_alloc_urb(0, GFP_KERNEL);
720         if (!dev->interrupt_in_urb) {
721                 dev_err(&intf->dev, "Couldn't allocate interrupt_in_urb\n");
722                 goto error;
723         }
724         dev->interrupt_out_endpoint_size = dev->interrupt_out_endpoint ? usb_endpoint_maxp(dev->interrupt_out_endpoint) :
725                                                                          udev->descriptor.bMaxPacketSize0;
726         dev->interrupt_out_buffer = kmalloc(write_buffer_size*dev->interrupt_out_endpoint_size, GFP_KERNEL);
727         if (!dev->interrupt_out_buffer) {
728                 dev_err(&intf->dev, "Couldn't allocate interrupt_out_buffer\n");
729                 goto error;
730         }
731         dev->interrupt_out_urb = usb_alloc_urb(0, GFP_KERNEL);
732         if (!dev->interrupt_out_urb) {
733                 dev_err(&intf->dev, "Couldn't allocate interrupt_out_urb\n");
734                 goto error;
735         }
736         dev->interrupt_in_interval = min_interrupt_in_interval > dev->interrupt_in_endpoint->bInterval ? min_interrupt_in_interval : dev->interrupt_in_endpoint->bInterval;
737         if (dev->interrupt_out_endpoint)
738                 dev->interrupt_out_interval = min_interrupt_out_interval > dev->interrupt_out_endpoint->bInterval ? min_interrupt_out_interval : dev->interrupt_out_endpoint->bInterval;
739
740         /* we can register the device now, as it is ready */
741         usb_set_intfdata(intf, dev);
742
743         retval = usb_register_dev(intf, &ld_usb_class);
744         if (retval) {
745                 /* something prevented us from registering this driver */
746                 dev_err(&intf->dev, "Not able to get a minor for this device.\n");
747                 usb_set_intfdata(intf, NULL);
748                 goto error;
749         }
750
751         /* let the user know what node this device is now attached to */
752         dev_info(&intf->dev, "LD USB Device #%d now attached to major %d minor %d\n",
753                 (intf->minor - USB_LD_MINOR_BASE), USB_MAJOR, intf->minor);
754
755 exit:
756         return retval;
757
758 error:
759         ld_usb_delete(dev);
760
761         return retval;
762 }
763
764 /**
765  *      ld_usb_disconnect
766  *
767  *      Called by the usb core when the device is removed from the system.
768  */
769 static void ld_usb_disconnect(struct usb_interface *intf)
770 {
771         struct ld_usb *dev;
772         int minor;
773
774         dev = usb_get_intfdata(intf);
775         usb_set_intfdata(intf, NULL);
776
777         minor = intf->minor;
778
779         /* give back our minor */
780         usb_deregister_dev(intf, &ld_usb_class);
781
782         usb_poison_urb(dev->interrupt_in_urb);
783         usb_poison_urb(dev->interrupt_out_urb);
784
785         mutex_lock(&dev->mutex);
786
787         /* if the device is not opened, then we clean up right now */
788         if (!dev->open_count) {
789                 mutex_unlock(&dev->mutex);
790                 ld_usb_delete(dev);
791         } else {
792                 dev->disconnected = 1;
793                 /* wake up pollers */
794                 wake_up_interruptible_all(&dev->read_wait);
795                 wake_up_interruptible_all(&dev->write_wait);
796                 mutex_unlock(&dev->mutex);
797         }
798
799         dev_info(&intf->dev, "LD USB Device #%d now disconnected\n",
800                  (minor - USB_LD_MINOR_BASE));
801 }
802
803 /* usb specific object needed to register this driver with the usb subsystem */
804 static struct usb_driver ld_usb_driver = {
805         .name =         "ldusb",
806         .probe =        ld_usb_probe,
807         .disconnect =   ld_usb_disconnect,
808         .id_table =     ld_usb_table,
809 };
810
811 module_usb_driver(ld_usb_driver);
812