usb: misc: legousbtower: Fix NULL pointer deference
[pandora-kernel.git] / drivers / usb / misc / legousbtower.c
1 /*
2  * LEGO USB Tower driver
3  *
4  * Copyright (C) 2003 David Glance <davidgsf@sourceforge.net>
5  *               2001-2004 Juergen Stuber <starblue@users.sourceforge.net>
6  *
7  *      This program is free software; you can redistribute it and/or
8  *      modify it under the terms of the GNU General Public License as
9  *      published by the Free Software Foundation; either version 2 of
10  *      the License, or (at your option) any later version.
11  *
12  * derived from USB Skeleton driver - 0.5
13  * Copyright (C) 2001 Greg Kroah-Hartman (greg@kroah.com)
14  *
15  * History:
16  *
17  * 2001-10-13 - 0.1 js
18  *   - first version
19  * 2001-11-03 - 0.2 js
20  *   - simplified buffering, one-shot URBs for writing
21  * 2001-11-10 - 0.3 js
22  *   - removed IOCTL (setting power/mode is more complicated, postponed)
23  * 2001-11-28 - 0.4 js
24  *   - added vendor commands for mode of operation and power level in open
25  * 2001-12-04 - 0.5 js
26  *   - set IR mode by default (by oversight 0.4 set VLL mode)
27  * 2002-01-11 - 0.5? pcchan
28  *   - make read buffer reusable and work around bytes_to_write issue between
29  *     uhci and legusbtower
30  * 2002-09-23 - 0.52 david (david@csse.uwa.edu.au)
31  *   - imported into lejos project
32  *   - changed wake_up to wake_up_interruptible
33  *   - changed to use lego0 rather than tower0
34  *   - changed dbg() to use __func__ rather than deprecated __func__
35  * 2003-01-12 - 0.53 david (david@csse.uwa.edu.au)
36  *   - changed read and write to write everything or
37  *     timeout (from a patch by Chris Riesen and Brett Thaeler driver)
38  *   - added ioctl functionality to set timeouts
39  * 2003-07-18 - 0.54 davidgsf (david@csse.uwa.edu.au)
40  *   - initial import into LegoUSB project
41  *   - merge of existing LegoUSB.c driver
42  * 2003-07-18 - 0.56 davidgsf (david@csse.uwa.edu.au)
43  *   - port to 2.6 style driver
44  * 2004-02-29 - 0.6 Juergen Stuber <starblue@users.sourceforge.net>
45  *   - fix locking
46  *   - unlink read URBs which are no longer needed
47  *   - allow increased buffer size, eliminates need for timeout on write
48  *   - have read URB running continuously
49  *   - added poll
50  *   - forbid seeking
51  *   - added nonblocking I/O
52  *   - changed back __func__ to __func__
53  *   - read and log tower firmware version
54  *   - reset tower on probe, avoids failure of first write
55  * 2004-03-09 - 0.7 Juergen Stuber <starblue@users.sourceforge.net>
56  *   - timeout read now only after inactivity, shorten default accordingly
57  * 2004-03-11 - 0.8 Juergen Stuber <starblue@users.sourceforge.net>
58  *   - log major, minor instead of possibly confusing device filename
59  *   - whitespace cleanup
60  * 2004-03-12 - 0.9 Juergen Stuber <starblue@users.sourceforge.net>
61  *   - normalize whitespace in debug messages
62  *   - take care about endianness in control message responses
63  * 2004-03-13 - 0.91 Juergen Stuber <starblue@users.sourceforge.net>
64  *   - make default intervals longer to accommodate current EHCI driver
65  * 2004-03-19 - 0.92 Juergen Stuber <starblue@users.sourceforge.net>
66  *   - replaced atomic_t by memory barriers
67  * 2004-04-21 - 0.93 Juergen Stuber <starblue@users.sourceforge.net>
68  *   - wait for completion of write urb in release (needed for remotecontrol)
69  *   - corrected poll for write direction (missing negation)
70  * 2004-04-22 - 0.94 Juergen Stuber <starblue@users.sourceforge.net>
71  *   - make device locking interruptible
72  * 2004-04-30 - 0.95 Juergen Stuber <starblue@users.sourceforge.net>
73  *   - check for valid udev on resubmitting and unlinking urbs
74  * 2004-08-03 - 0.96 Juergen Stuber <starblue@users.sourceforge.net>
75  *   - move reset into open to clean out spurious data
76  */
77
78 #include <linux/kernel.h>
79 #include <linux/errno.h>
80 #include <linux/init.h>
81 #include <linux/slab.h>
82 #include <linux/module.h>
83 #include <linux/completion.h>
84 #include <linux/mutex.h>
85 #include <asm/uaccess.h>
86 #include <linux/usb.h>
87 #include <linux/poll.h>
88
89
90 #ifdef CONFIG_USB_DEBUG
91         static int debug = 4;
92 #else
93         static int debug = 0;
94 #endif
95
96 /* Use our own dbg macro */
97 #undef dbg
98 #define dbg(lvl, format, arg...)                                        \
99 do {                                                                    \
100         if (debug >= lvl)                                               \
101                 printk(KERN_DEBUG "%s: " format "\n", __FILE__, ##arg); \
102 } while (0)
103
104 /* Version Information */
105 #define DRIVER_VERSION "v0.96"
106 #define DRIVER_AUTHOR "Juergen Stuber <starblue@sourceforge.net>"
107 #define DRIVER_DESC "LEGO USB Tower Driver"
108
109 /* Module parameters */
110 module_param(debug, int, S_IRUGO | S_IWUSR);
111 MODULE_PARM_DESC(debug, "Debug enabled or not");
112
113 /* The defaults are chosen to work with the latest versions of leJOS and NQC.
114  */
115
116 /* Some legacy software likes to receive packets in one piece.
117  * In this case read_buffer_size should exceed the maximal packet length
118  * (417 for datalog uploads), and packet_timeout should be set.
119  */
120 static int read_buffer_size = 480;
121 module_param(read_buffer_size, int, 0);
122 MODULE_PARM_DESC(read_buffer_size, "Read buffer size");
123
124 /* Some legacy software likes to send packets in one piece.
125  * In this case write_buffer_size should exceed the maximal packet length
126  * (417 for firmware and program downloads).
127  * A problem with long writes is that the following read may time out
128  * if the software is not prepared to wait long enough.
129  */
130 static int write_buffer_size = 480;
131 module_param(write_buffer_size, int, 0);
132 MODULE_PARM_DESC(write_buffer_size, "Write buffer size");
133
134 /* Some legacy software expects reads to contain whole LASM packets.
135  * To achieve this, characters which arrive before a packet timeout
136  * occurs will be returned in a single read operation.
137  * A problem with long reads is that the software may time out
138  * if it is not prepared to wait long enough.
139  * The packet timeout should be greater than the time between the
140  * reception of subsequent characters, which should arrive about
141  * every 5ms for the standard 2400 baud.
142  * Set it to 0 to disable.
143  */
144 static int packet_timeout = 50;
145 module_param(packet_timeout, int, 0);
146 MODULE_PARM_DESC(packet_timeout, "Packet timeout in ms");
147
148 /* Some legacy software expects blocking reads to time out.
149  * Timeout occurs after the specified time of read and write inactivity.
150  * Set it to 0 to disable.
151  */
152 static int read_timeout = 200;
153 module_param(read_timeout, int, 0);
154 MODULE_PARM_DESC(read_timeout, "Read timeout in ms");
155
156 /* As of kernel version 2.6.4 ehci-hcd uses an
157  * "only one interrupt transfer per frame" shortcut
158  * to simplify the scheduling of periodic transfers.
159  * This conflicts with our standard 1ms intervals for in and out URBs.
160  * We use default intervals of 2ms for in and 8ms for out transfers,
161  * which is fast enough for 2400 baud and allows a small additional load.
162  * Increase the interval to allow more devices that do interrupt transfers,
163  * or set to 0 to use the standard interval from the endpoint descriptors.
164  */
165 static int interrupt_in_interval = 2;
166 module_param(interrupt_in_interval, int, 0);
167 MODULE_PARM_DESC(interrupt_in_interval, "Interrupt in interval in ms");
168
169 static int interrupt_out_interval = 8;
170 module_param(interrupt_out_interval, int, 0);
171 MODULE_PARM_DESC(interrupt_out_interval, "Interrupt out interval in ms");
172
173 /* Define these values to match your device */
174 #define LEGO_USB_TOWER_VENDOR_ID        0x0694
175 #define LEGO_USB_TOWER_PRODUCT_ID       0x0001
176
177 /* Vendor requests */
178 #define LEGO_USB_TOWER_REQUEST_RESET            0x04
179 #define LEGO_USB_TOWER_REQUEST_GET_VERSION      0xFD
180
181 struct tower_reset_reply {
182         __le16 size;            /* little-endian */
183         __u8 err_code;
184         __u8 spare;
185 } __attribute__ ((packed));
186
187 struct tower_get_version_reply {
188         __le16 size;            /* little-endian */
189         __u8 err_code;
190         __u8 spare;
191         __u8 major;
192         __u8 minor;
193         __le16 build_no;                /* little-endian */
194 } __attribute__ ((packed));
195
196
197 /* table of devices that work with this driver */
198 static const struct usb_device_id tower_table[] = {
199         { USB_DEVICE(LEGO_USB_TOWER_VENDOR_ID, LEGO_USB_TOWER_PRODUCT_ID) },
200         { }                                     /* Terminating entry */
201 };
202
203 MODULE_DEVICE_TABLE (usb, tower_table);
204 static DEFINE_MUTEX(open_disc_mutex);
205
206 #define LEGO_USB_TOWER_MINOR_BASE       160
207
208
209 /* Structure to hold all of our device specific stuff */
210 struct lego_usb_tower {
211         struct mutex            lock;           /* locks this structure */
212         struct usb_device*      udev;           /* save off the usb device pointer */
213         unsigned char           minor;          /* the starting minor number for this device */
214
215         int                     open_count;     /* number of times this port has been opened */
216
217         char*                   read_buffer;
218         size_t                  read_buffer_length; /* this much came in */
219         size_t                  read_packet_length; /* this much will be returned on read */
220         spinlock_t              read_buffer_lock;
221         int                     packet_timeout_jiffies;
222         unsigned long           read_last_arrival;
223
224         wait_queue_head_t       read_wait;
225         wait_queue_head_t       write_wait;
226
227         char*                   interrupt_in_buffer;
228         struct usb_endpoint_descriptor* interrupt_in_endpoint;
229         struct urb*             interrupt_in_urb;
230         int                     interrupt_in_interval;
231         int                     interrupt_in_running;
232         int                     interrupt_in_done;
233
234         char*                   interrupt_out_buffer;
235         struct usb_endpoint_descriptor* interrupt_out_endpoint;
236         struct urb*             interrupt_out_urb;
237         int                     interrupt_out_interval;
238         int                     interrupt_out_busy;
239
240 };
241
242
243 /* local function prototypes */
244 static ssize_t tower_read       (struct file *file, char __user *buffer, size_t count, loff_t *ppos);
245 static ssize_t tower_write      (struct file *file, const char __user *buffer, size_t count, loff_t *ppos);
246 static inline void tower_delete (struct lego_usb_tower *dev);
247 static int tower_open           (struct inode *inode, struct file *file);
248 static int tower_release        (struct inode *inode, struct file *file);
249 static unsigned int tower_poll  (struct file *file, poll_table *wait);
250 static loff_t tower_llseek      (struct file *file, loff_t off, int whence);
251
252 static void tower_abort_transfers (struct lego_usb_tower *dev);
253 static void tower_check_for_read_packet (struct lego_usb_tower *dev);
254 static void tower_interrupt_in_callback (struct urb *urb);
255 static void tower_interrupt_out_callback (struct urb *urb);
256
257 static int  tower_probe (struct usb_interface *interface, const struct usb_device_id *id);
258 static void tower_disconnect    (struct usb_interface *interface);
259
260
261 /* file operations needed when we register this driver */
262 static const struct file_operations tower_fops = {
263         .owner =        THIS_MODULE,
264         .read  =        tower_read,
265         .write =        tower_write,
266         .open =         tower_open,
267         .release =      tower_release,
268         .poll =         tower_poll,
269         .llseek =       tower_llseek,
270 };
271
272 static char *legousbtower_devnode(struct device *dev, mode_t *mode)
273 {
274         return kasprintf(GFP_KERNEL, "usb/%s", dev_name(dev));
275 }
276
277 /*
278  * usb class driver info in order to get a minor number from the usb core,
279  * and to have the device registered with the driver core
280  */
281 static struct usb_class_driver tower_class = {
282         .name =         "legousbtower%d",
283         .devnode =      legousbtower_devnode,
284         .fops =         &tower_fops,
285         .minor_base =   LEGO_USB_TOWER_MINOR_BASE,
286 };
287
288
289 /* usb specific object needed to register this driver with the usb subsystem */
290 static struct usb_driver tower_driver = {
291         .name =         "legousbtower",
292         .probe =        tower_probe,
293         .disconnect =   tower_disconnect,
294         .id_table =     tower_table,
295 };
296
297
298 /**
299  *      lego_usb_tower_debug_data
300  */
301 static inline void lego_usb_tower_debug_data (int level, const char *function, int size, const unsigned char *data)
302 {
303         int i;
304
305         if (debug < level)
306                 return;
307
308         printk (KERN_DEBUG "%s: %s - length = %d, data = ", __FILE__, function, size);
309         for (i = 0; i < size; ++i) {
310                 printk ("%.2x ", data[i]);
311         }
312         printk ("\n");
313 }
314
315
316 /**
317  *      tower_delete
318  */
319 static inline void tower_delete (struct lego_usb_tower *dev)
320 {
321         dbg(2, "%s: enter", __func__);
322
323         tower_abort_transfers (dev);
324
325         /* free data structures */
326         usb_free_urb(dev->interrupt_in_urb);
327         usb_free_urb(dev->interrupt_out_urb);
328         kfree (dev->read_buffer);
329         kfree (dev->interrupt_in_buffer);
330         kfree (dev->interrupt_out_buffer);
331         kfree (dev);
332
333         dbg(2, "%s: leave", __func__);
334 }
335
336
337 /**
338  *      tower_open
339  */
340 static int tower_open (struct inode *inode, struct file *file)
341 {
342         struct lego_usb_tower *dev = NULL;
343         int subminor;
344         int retval = 0;
345         struct usb_interface *interface;
346         struct tower_reset_reply reset_reply;
347         int result;
348
349         dbg(2, "%s: enter", __func__);
350
351         nonseekable_open(inode, file);
352         subminor = iminor(inode);
353
354         interface = usb_find_interface (&tower_driver, subminor);
355
356         if (!interface) {
357                 err ("%s - error, can't find device for minor %d",
358                      __func__, subminor);
359                 retval = -ENODEV;
360                 goto exit;
361         }
362
363         mutex_lock(&open_disc_mutex);
364         dev = usb_get_intfdata(interface);
365
366         if (!dev) {
367                 mutex_unlock(&open_disc_mutex);
368                 retval = -ENODEV;
369                 goto exit;
370         }
371
372         /* lock this device */
373         if (mutex_lock_interruptible(&dev->lock)) {
374                 mutex_unlock(&open_disc_mutex);
375                 retval = -ERESTARTSYS;
376                 goto exit;
377         }
378
379
380         /* allow opening only once */
381         if (dev->open_count) {
382                 mutex_unlock(&open_disc_mutex);
383                 retval = -EBUSY;
384                 goto unlock_exit;
385         }
386         dev->open_count = 1;
387         mutex_unlock(&open_disc_mutex);
388
389         /* reset the tower */
390         result = usb_control_msg (dev->udev,
391                                   usb_rcvctrlpipe(dev->udev, 0),
392                                   LEGO_USB_TOWER_REQUEST_RESET,
393                                   USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE,
394                                   0,
395                                   0,
396                                   &reset_reply,
397                                   sizeof(reset_reply),
398                                   1000);
399         if (result < 0) {
400                 err("LEGO USB Tower reset control request failed");
401                 retval = result;
402                 goto unlock_exit;
403         }
404
405         /* initialize in direction */
406         dev->read_buffer_length = 0;
407         dev->read_packet_length = 0;
408         usb_fill_int_urb (dev->interrupt_in_urb,
409                           dev->udev,
410                           usb_rcvintpipe(dev->udev, dev->interrupt_in_endpoint->bEndpointAddress),
411                           dev->interrupt_in_buffer,
412                           usb_endpoint_maxp(dev->interrupt_in_endpoint),
413                           tower_interrupt_in_callback,
414                           dev,
415                           dev->interrupt_in_interval);
416
417         dev->interrupt_in_running = 1;
418         dev->interrupt_in_done = 0;
419         mb();
420
421         retval = usb_submit_urb (dev->interrupt_in_urb, GFP_KERNEL);
422         if (retval) {
423                 err("Couldn't submit interrupt_in_urb %d", retval);
424                 dev->interrupt_in_running = 0;
425                 dev->open_count = 0;
426                 goto unlock_exit;
427         }
428
429         /* save device in the file's private structure */
430         file->private_data = dev;
431
432 unlock_exit:
433         mutex_unlock(&dev->lock);
434
435 exit:
436         dbg(2, "%s: leave, return value %d ", __func__, retval);
437
438         return retval;
439 }
440
441 /**
442  *      tower_release
443  */
444 static int tower_release (struct inode *inode, struct file *file)
445 {
446         struct lego_usb_tower *dev;
447         int retval = 0;
448
449         dbg(2, "%s: enter", __func__);
450
451         dev = file->private_data;
452
453         if (dev == NULL) {
454                 dbg(1, "%s: object is NULL", __func__);
455                 retval = -ENODEV;
456                 goto exit_nolock;
457         }
458
459         mutex_lock(&open_disc_mutex);
460         if (mutex_lock_interruptible(&dev->lock)) {
461                 retval = -ERESTARTSYS;
462                 goto exit;
463         }
464
465         if (dev->open_count != 1) {
466                 dbg(1, "%s: device not opened exactly once", __func__);
467                 retval = -ENODEV;
468                 goto unlock_exit;
469         }
470         if (dev->udev == NULL) {
471                 /* the device was unplugged before the file was released */
472
473                 /* unlock here as tower_delete frees dev */
474                 mutex_unlock(&dev->lock);
475                 tower_delete (dev);
476                 goto exit;
477         }
478
479         /* wait until write transfer is finished */
480         if (dev->interrupt_out_busy) {
481                 wait_event_interruptible_timeout (dev->write_wait, !dev->interrupt_out_busy, 2 * HZ);
482         }
483         tower_abort_transfers (dev);
484         dev->open_count = 0;
485
486 unlock_exit:
487         mutex_unlock(&dev->lock);
488
489 exit:
490         mutex_unlock(&open_disc_mutex);
491 exit_nolock:
492         dbg(2, "%s: leave, return value %d", __func__, retval);
493         return retval;
494 }
495
496
497 /**
498  *      tower_abort_transfers
499  *      aborts transfers and frees associated data structures
500  */
501 static void tower_abort_transfers (struct lego_usb_tower *dev)
502 {
503         dbg(2, "%s: enter", __func__);
504
505         if (dev == NULL) {
506                 dbg(1, "%s: dev is null", __func__);
507                 goto exit;
508         }
509
510         /* shutdown transfer */
511         if (dev->interrupt_in_running) {
512                 dev->interrupt_in_running = 0;
513                 mb();
514                 if (dev->udev)
515                         usb_kill_urb (dev->interrupt_in_urb);
516         }
517         if (dev->interrupt_out_busy && dev->udev)
518                 usb_kill_urb(dev->interrupt_out_urb);
519
520 exit:
521         dbg(2, "%s: leave", __func__);
522 }
523
524
525 /**
526  *      tower_check_for_read_packet
527  *
528  *      To get correct semantics for signals and non-blocking I/O
529  *      with packetizing we pretend not to see any data in the read buffer
530  *      until it has been there unchanged for at least
531  *      dev->packet_timeout_jiffies, or until the buffer is full.
532  */
533 static void tower_check_for_read_packet (struct lego_usb_tower *dev)
534 {
535         spin_lock_irq (&dev->read_buffer_lock);
536         if (!packet_timeout
537             || time_after(jiffies, dev->read_last_arrival + dev->packet_timeout_jiffies)
538             || dev->read_buffer_length == read_buffer_size) {
539                 dev->read_packet_length = dev->read_buffer_length;
540         }
541         dev->interrupt_in_done = 0;
542         spin_unlock_irq (&dev->read_buffer_lock);
543 }
544
545
546 /**
547  *      tower_poll
548  */
549 static unsigned int tower_poll (struct file *file, poll_table *wait)
550 {
551         struct lego_usb_tower *dev;
552         unsigned int mask = 0;
553
554         dbg(2, "%s: enter", __func__);
555
556         dev = file->private_data;
557
558         if (!dev->udev)
559                 return POLLERR | POLLHUP;
560
561         poll_wait(file, &dev->read_wait, wait);
562         poll_wait(file, &dev->write_wait, wait);
563
564         tower_check_for_read_packet(dev);
565         if (dev->read_packet_length > 0) {
566                 mask |= POLLIN | POLLRDNORM;
567         }
568         if (!dev->interrupt_out_busy) {
569                 mask |= POLLOUT | POLLWRNORM;
570         }
571
572         dbg(2, "%s: leave, mask = %d", __func__, mask);
573
574         return mask;
575 }
576
577
578 /**
579  *      tower_llseek
580  */
581 static loff_t tower_llseek (struct file *file, loff_t off, int whence)
582 {
583         return -ESPIPE;         /* unseekable */
584 }
585
586
587 /**
588  *      tower_read
589  */
590 static ssize_t tower_read (struct file *file, char __user *buffer, size_t count, loff_t *ppos)
591 {
592         struct lego_usb_tower *dev;
593         size_t bytes_to_read;
594         int i;
595         int retval = 0;
596         unsigned long timeout = 0;
597
598         dbg(2, "%s: enter, count = %Zd", __func__, count);
599
600         dev = file->private_data;
601
602         /* lock this object */
603         if (mutex_lock_interruptible(&dev->lock)) {
604                 retval = -ERESTARTSYS;
605                 goto exit;
606         }
607
608         /* verify that the device wasn't unplugged */
609         if (dev->udev == NULL) {
610                 retval = -ENODEV;
611                 err("No device or device unplugged %d", retval);
612                 goto unlock_exit;
613         }
614
615         /* verify that we actually have some data to read */
616         if (count == 0) {
617                 dbg(1, "%s: read request of 0 bytes", __func__);
618                 goto unlock_exit;
619         }
620
621         if (read_timeout) {
622                 timeout = jiffies + read_timeout * HZ / 1000;
623         }
624
625         /* wait for data */
626         tower_check_for_read_packet (dev);
627         while (dev->read_packet_length == 0) {
628                 if (file->f_flags & O_NONBLOCK) {
629                         retval = -EAGAIN;
630                         goto unlock_exit;
631                 }
632                 retval = wait_event_interruptible_timeout(dev->read_wait, dev->interrupt_in_done, dev->packet_timeout_jiffies);
633                 if (retval < 0) {
634                         goto unlock_exit;
635                 }
636
637                 /* reset read timeout during read or write activity */
638                 if (read_timeout
639                     && (dev->read_buffer_length || dev->interrupt_out_busy)) {
640                         timeout = jiffies + read_timeout * HZ / 1000;
641                 }
642                 /* check for read timeout */
643                 if (read_timeout && time_after (jiffies, timeout)) {
644                         retval = -ETIMEDOUT;
645                         goto unlock_exit;
646                 }
647                 tower_check_for_read_packet (dev);
648         }
649
650         /* copy the data from read_buffer into userspace */
651         bytes_to_read = min(count, dev->read_packet_length);
652
653         if (copy_to_user (buffer, dev->read_buffer, bytes_to_read)) {
654                 retval = -EFAULT;
655                 goto unlock_exit;
656         }
657
658         spin_lock_irq (&dev->read_buffer_lock);
659         dev->read_buffer_length -= bytes_to_read;
660         dev->read_packet_length -= bytes_to_read;
661         for (i=0; i<dev->read_buffer_length; i++) {
662                 dev->read_buffer[i] = dev->read_buffer[i+bytes_to_read];
663         }
664         spin_unlock_irq (&dev->read_buffer_lock);
665
666         retval = bytes_to_read;
667
668 unlock_exit:
669         /* unlock the device */
670         mutex_unlock(&dev->lock);
671
672 exit:
673         dbg(2, "%s: leave, return value %d", __func__, retval);
674         return retval;
675 }
676
677
678 /**
679  *      tower_write
680  */
681 static ssize_t tower_write (struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
682 {
683         struct lego_usb_tower *dev;
684         size_t bytes_to_write;
685         int retval = 0;
686
687         dbg(2, "%s: enter, count = %Zd", __func__, count);
688
689         dev = file->private_data;
690
691         /* lock this object */
692         if (mutex_lock_interruptible(&dev->lock)) {
693                 retval = -ERESTARTSYS;
694                 goto exit;
695         }
696
697         /* verify that the device wasn't unplugged */
698         if (dev->udev == NULL) {
699                 retval = -ENODEV;
700                 err("No device or device unplugged %d", retval);
701                 goto unlock_exit;
702         }
703
704         /* verify that we actually have some data to write */
705         if (count == 0) {
706                 dbg(1, "%s: write request of 0 bytes", __func__);
707                 goto unlock_exit;
708         }
709
710         /* wait until previous transfer is finished */
711         while (dev->interrupt_out_busy) {
712                 if (file->f_flags & O_NONBLOCK) {
713                         retval = -EAGAIN;
714                         goto unlock_exit;
715                 }
716                 retval = wait_event_interruptible (dev->write_wait, !dev->interrupt_out_busy);
717                 if (retval) {
718                         goto unlock_exit;
719                 }
720         }
721
722         /* write the data into interrupt_out_buffer from userspace */
723         bytes_to_write = min_t(int, count, write_buffer_size);
724         dbg(4, "%s: count = %Zd, bytes_to_write = %Zd", __func__, count, bytes_to_write);
725
726         if (copy_from_user (dev->interrupt_out_buffer, buffer, bytes_to_write)) {
727                 retval = -EFAULT;
728                 goto unlock_exit;
729         }
730
731         /* send off the urb */
732         usb_fill_int_urb(dev->interrupt_out_urb,
733                          dev->udev,
734                          usb_sndintpipe(dev->udev, dev->interrupt_out_endpoint->bEndpointAddress),
735                          dev->interrupt_out_buffer,
736                          bytes_to_write,
737                          tower_interrupt_out_callback,
738                          dev,
739                          dev->interrupt_out_interval);
740
741         dev->interrupt_out_busy = 1;
742         wmb();
743
744         retval = usb_submit_urb (dev->interrupt_out_urb, GFP_KERNEL);
745         if (retval) {
746                 dev->interrupt_out_busy = 0;
747                 err("Couldn't submit interrupt_out_urb %d", retval);
748                 goto unlock_exit;
749         }
750         retval = bytes_to_write;
751
752 unlock_exit:
753         /* unlock the device */
754         mutex_unlock(&dev->lock);
755
756 exit:
757         dbg(2, "%s: leave, return value %d", __func__, retval);
758
759         return retval;
760 }
761
762
763 /**
764  *      tower_interrupt_in_callback
765  */
766 static void tower_interrupt_in_callback (struct urb *urb)
767 {
768         struct lego_usb_tower *dev = urb->context;
769         int status = urb->status;
770         int retval;
771
772         dbg(4, "%s: enter, status %d", __func__, status);
773
774         lego_usb_tower_debug_data(5, __func__, urb->actual_length, urb->transfer_buffer);
775
776         if (status) {
777                 if (status == -ENOENT ||
778                     status == -ECONNRESET ||
779                     status == -ESHUTDOWN) {
780                         goto exit;
781                 } else {
782                         dbg(1, "%s: nonzero status received: %d", __func__, status);
783                         goto resubmit; /* maybe we can recover */
784                 }
785         }
786
787         if (urb->actual_length > 0) {
788                 spin_lock (&dev->read_buffer_lock);
789                 if (dev->read_buffer_length + urb->actual_length < read_buffer_size) {
790                         memcpy (dev->read_buffer + dev->read_buffer_length,
791                                 dev->interrupt_in_buffer,
792                                 urb->actual_length);
793                         dev->read_buffer_length += urb->actual_length;
794                         dev->read_last_arrival = jiffies;
795                         dbg(3, "%s: received %d bytes", __func__, urb->actual_length);
796                 } else {
797                         printk(KERN_WARNING "%s: read_buffer overflow, %d bytes dropped", __func__, urb->actual_length);
798                 }
799                 spin_unlock (&dev->read_buffer_lock);
800         }
801
802 resubmit:
803         /* resubmit if we're still running */
804         if (dev->interrupt_in_running && dev->udev) {
805                 retval = usb_submit_urb (dev->interrupt_in_urb, GFP_ATOMIC);
806                 if (retval) {
807                         err("%s: usb_submit_urb failed (%d)", __func__, retval);
808                 }
809         }
810
811 exit:
812         dev->interrupt_in_done = 1;
813         wake_up_interruptible (&dev->read_wait);
814
815         lego_usb_tower_debug_data(5, __func__, urb->actual_length, urb->transfer_buffer);
816         dbg(4, "%s: leave, status %d", __func__, status);
817 }
818
819
820 /**
821  *      tower_interrupt_out_callback
822  */
823 static void tower_interrupt_out_callback (struct urb *urb)
824 {
825         struct lego_usb_tower *dev = urb->context;
826         int status = urb->status;
827
828         dbg(4, "%s: enter, status %d", __func__, status);
829         lego_usb_tower_debug_data(5, __func__, urb->actual_length, urb->transfer_buffer);
830
831         /* sync/async unlink faults aren't errors */
832         if (status && !(status == -ENOENT ||
833                         status == -ECONNRESET ||
834                         status == -ESHUTDOWN)) {
835                 dbg(1, "%s - nonzero write bulk status received: %d",
836                     __func__, status);
837         }
838
839         dev->interrupt_out_busy = 0;
840         wake_up_interruptible(&dev->write_wait);
841
842         lego_usb_tower_debug_data(5, __func__, urb->actual_length, urb->transfer_buffer);
843         dbg(4, "%s: leave, status %d", __func__, status);
844 }
845
846
847 /**
848  *      tower_probe
849  *
850  *      Called by the usb core when a new device is connected that it thinks
851  *      this driver might be interested in.
852  */
853 static int tower_probe (struct usb_interface *interface, const struct usb_device_id *id)
854 {
855         struct usb_device *udev = interface_to_usbdev(interface);
856         struct lego_usb_tower *dev = NULL;
857         struct usb_host_interface *iface_desc;
858         struct usb_endpoint_descriptor* endpoint;
859         struct tower_get_version_reply get_version_reply;
860         int i;
861         int retval = -ENOMEM;
862         int result;
863
864         dbg(2, "%s: enter", __func__);
865
866         if (udev == NULL)
867                 dev_info(&interface->dev, "udev is NULL.\n");
868
869         /* allocate memory for our device state and initialize it */
870
871         dev = kmalloc (sizeof(struct lego_usb_tower), GFP_KERNEL);
872
873         if (dev == NULL) {
874                 err ("Out of memory");
875                 goto exit;
876         }
877
878         mutex_init(&dev->lock);
879
880         dev->udev = udev;
881         dev->open_count = 0;
882
883         dev->read_buffer = NULL;
884         dev->read_buffer_length = 0;
885         dev->read_packet_length = 0;
886         spin_lock_init (&dev->read_buffer_lock);
887         dev->packet_timeout_jiffies = packet_timeout * HZ / 1000;
888         dev->read_last_arrival = jiffies;
889
890         init_waitqueue_head (&dev->read_wait);
891         init_waitqueue_head (&dev->write_wait);
892
893         dev->interrupt_in_buffer = NULL;
894         dev->interrupt_in_endpoint = NULL;
895         dev->interrupt_in_urb = NULL;
896         dev->interrupt_in_running = 0;
897         dev->interrupt_in_done = 0;
898
899         dev->interrupt_out_buffer = NULL;
900         dev->interrupt_out_endpoint = NULL;
901         dev->interrupt_out_urb = NULL;
902         dev->interrupt_out_busy = 0;
903
904         iface_desc = interface->cur_altsetting;
905
906         /* set up the endpoint information */
907         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
908                 endpoint = &iface_desc->endpoint[i].desc;
909
910                 if (usb_endpoint_xfer_int(endpoint)) {
911                         if (usb_endpoint_dir_in(endpoint))
912                                 dev->interrupt_in_endpoint = endpoint;
913                         else
914                                 dev->interrupt_out_endpoint = endpoint;
915                 }
916         }
917         if(dev->interrupt_in_endpoint == NULL) {
918                 err("interrupt in endpoint not found");
919                 goto error;
920         }
921         if (dev->interrupt_out_endpoint == NULL) {
922                 err("interrupt out endpoint not found");
923                 goto error;
924         }
925
926         dev->read_buffer = kmalloc (read_buffer_size, GFP_KERNEL);
927         if (!dev->read_buffer) {
928                 err("Couldn't allocate read_buffer");
929                 goto error;
930         }
931         dev->interrupt_in_buffer = kmalloc (usb_endpoint_maxp(dev->interrupt_in_endpoint), GFP_KERNEL);
932         if (!dev->interrupt_in_buffer) {
933                 err("Couldn't allocate interrupt_in_buffer");
934                 goto error;
935         }
936         dev->interrupt_in_urb = usb_alloc_urb(0, GFP_KERNEL);
937         if (!dev->interrupt_in_urb) {
938                 err("Couldn't allocate interrupt_in_urb");
939                 goto error;
940         }
941         dev->interrupt_out_buffer = kmalloc (write_buffer_size, GFP_KERNEL);
942         if (!dev->interrupt_out_buffer) {
943                 err("Couldn't allocate interrupt_out_buffer");
944                 goto error;
945         }
946         dev->interrupt_out_urb = usb_alloc_urb(0, GFP_KERNEL);
947         if (!dev->interrupt_out_urb) {
948                 err("Couldn't allocate interrupt_out_urb");
949                 goto error;
950         }
951         dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval;
952         dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval;
953
954         /* get the firmware version and log it */
955         result = usb_control_msg (udev,
956                                   usb_rcvctrlpipe(udev, 0),
957                                   LEGO_USB_TOWER_REQUEST_GET_VERSION,
958                                   USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE,
959                                   0,
960                                   0,
961                                   &get_version_reply,
962                                   sizeof(get_version_reply),
963                                   1000);
964         if (result < 0) {
965                 err("LEGO USB Tower get version control request failed");
966                 retval = result;
967                 goto error;
968         }
969         dev_info(&interface->dev, "LEGO USB Tower firmware version is %d.%d "
970                  "build %d\n", get_version_reply.major,
971                  get_version_reply.minor,
972                  le16_to_cpu(get_version_reply.build_no));
973
974         /* we can register the device now, as it is ready */
975         usb_set_intfdata (interface, dev);
976
977         retval = usb_register_dev (interface, &tower_class);
978
979         if (retval) {
980                 /* something prevented us from registering this driver */
981                 err ("Not able to get a minor for this device.");
982                 usb_set_intfdata (interface, NULL);
983                 goto error;
984         }
985         dev->minor = interface->minor;
986
987         /* let the user know what node this device is now attached to */
988         dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
989                  "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
990                  USB_MAJOR, dev->minor);
991
992 exit:
993         dbg(2, "%s: leave, return value 0x%.8lx (dev)", __func__, (long) dev);
994
995         return retval;
996
997 error:
998         tower_delete(dev);
999         return retval;
1000 }
1001
1002
1003 /**
1004  *      tower_disconnect
1005  *
1006  *      Called by the usb core when the device is removed from the system.
1007  */
1008 static void tower_disconnect (struct usb_interface *interface)
1009 {
1010         struct lego_usb_tower *dev;
1011         int minor;
1012
1013         dbg(2, "%s: enter", __func__);
1014
1015         dev = usb_get_intfdata (interface);
1016         mutex_lock(&open_disc_mutex);
1017         usb_set_intfdata (interface, NULL);
1018
1019         minor = dev->minor;
1020
1021         /* give back our minor */
1022         usb_deregister_dev (interface, &tower_class);
1023
1024         mutex_lock(&dev->lock);
1025         mutex_unlock(&open_disc_mutex);
1026
1027         /* if the device is not opened, then we clean up right now */
1028         if (!dev->open_count) {
1029                 mutex_unlock(&dev->lock);
1030                 tower_delete (dev);
1031         } else {
1032                 dev->udev = NULL;
1033                 /* wake up pollers */
1034                 wake_up_interruptible_all(&dev->read_wait);
1035                 wake_up_interruptible_all(&dev->write_wait);
1036                 mutex_unlock(&dev->lock);
1037         }
1038
1039         dev_info(&interface->dev, "LEGO USB Tower #%d now disconnected\n",
1040                  (minor - LEGO_USB_TOWER_MINOR_BASE));
1041
1042         dbg(2, "%s: leave", __func__);
1043 }
1044
1045
1046
1047 /**
1048  *      lego_usb_tower_init
1049  */
1050 static int __init lego_usb_tower_init(void)
1051 {
1052         int result;
1053         int retval = 0;
1054
1055         dbg(2, "%s: enter", __func__);
1056
1057         /* register this driver with the USB subsystem */
1058         result = usb_register(&tower_driver);
1059         if (result < 0) {
1060                 err("usb_register failed for the %s driver. Error number %d", __FILE__, result);
1061                 retval = -1;
1062                 goto exit;
1063         }
1064
1065         printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_VERSION ":"
1066                DRIVER_DESC "\n");
1067
1068 exit:
1069         dbg(2, "%s: leave, return value %d", __func__, retval);
1070
1071         return retval;
1072 }
1073
1074
1075 /**
1076  *      lego_usb_tower_exit
1077  */
1078 static void __exit lego_usb_tower_exit(void)
1079 {
1080         dbg(2, "%s: enter", __func__);
1081
1082         /* deregister this driver with the USB subsystem */
1083         usb_deregister (&tower_driver);
1084
1085         dbg(2, "%s: leave", __func__);
1086 }
1087
1088 module_init (lego_usb_tower_init);
1089 module_exit (lego_usb_tower_exit);
1090
1091 MODULE_AUTHOR(DRIVER_AUTHOR);
1092 MODULE_DESCRIPTION(DRIVER_DESC);
1093 #ifdef MODULE_LICENSE
1094 MODULE_LICENSE("GPL");
1095 #endif