USB: legousbtower: fix use-after-free on release
[platform/kernel/linux-rpi.git] / drivers / usb / misc / legousbtower.c
1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * LEGO USB Tower driver
4  *
5  * Copyright (C) 2003 David Glance <davidgsf@sourceforge.net>
6  *               2001-2004 Juergen Stuber <starblue@users.sourceforge.net>
7  *
8  * derived from USB Skeleton driver - 0.5
9  * Copyright (C) 2001 Greg Kroah-Hartman (greg@kroah.com)
10  *
11  * History:
12  *
13  * 2001-10-13 - 0.1 js
14  *   - first version
15  * 2001-11-03 - 0.2 js
16  *   - simplified buffering, one-shot URBs for writing
17  * 2001-11-10 - 0.3 js
18  *   - removed IOCTL (setting power/mode is more complicated, postponed)
19  * 2001-11-28 - 0.4 js
20  *   - added vendor commands for mode of operation and power level in open
21  * 2001-12-04 - 0.5 js
22  *   - set IR mode by default (by oversight 0.4 set VLL mode)
23  * 2002-01-11 - 0.5? pcchan
24  *   - make read buffer reusable and work around bytes_to_write issue between
25  *     uhci and legusbtower
26  * 2002-09-23 - 0.52 david (david@csse.uwa.edu.au)
27  *   - imported into lejos project
28  *   - changed wake_up to wake_up_interruptible
29  *   - changed to use lego0 rather than tower0
30  *   - changed dbg() to use __func__ rather than deprecated __func__
31  * 2003-01-12 - 0.53 david (david@csse.uwa.edu.au)
32  *   - changed read and write to write everything or
33  *     timeout (from a patch by Chris Riesen and Brett Thaeler driver)
34  *   - added ioctl functionality to set timeouts
35  * 2003-07-18 - 0.54 davidgsf (david@csse.uwa.edu.au)
36  *   - initial import into LegoUSB project
37  *   - merge of existing LegoUSB.c driver
38  * 2003-07-18 - 0.56 davidgsf (david@csse.uwa.edu.au)
39  *   - port to 2.6 style driver
40  * 2004-02-29 - 0.6 Juergen Stuber <starblue@users.sourceforge.net>
41  *   - fix locking
42  *   - unlink read URBs which are no longer needed
43  *   - allow increased buffer size, eliminates need for timeout on write
44  *   - have read URB running continuously
45  *   - added poll
46  *   - forbid seeking
47  *   - added nonblocking I/O
48  *   - changed back __func__ to __func__
49  *   - read and log tower firmware version
50  *   - reset tower on probe, avoids failure of first write
51  * 2004-03-09 - 0.7 Juergen Stuber <starblue@users.sourceforge.net>
52  *   - timeout read now only after inactivity, shorten default accordingly
53  * 2004-03-11 - 0.8 Juergen Stuber <starblue@users.sourceforge.net>
54  *   - log major, minor instead of possibly confusing device filename
55  *   - whitespace cleanup
56  * 2004-03-12 - 0.9 Juergen Stuber <starblue@users.sourceforge.net>
57  *   - normalize whitespace in debug messages
58  *   - take care about endianness in control message responses
59  * 2004-03-13 - 0.91 Juergen Stuber <starblue@users.sourceforge.net>
60  *   - make default intervals longer to accommodate current EHCI driver
61  * 2004-03-19 - 0.92 Juergen Stuber <starblue@users.sourceforge.net>
62  *   - replaced atomic_t by memory barriers
63  * 2004-04-21 - 0.93 Juergen Stuber <starblue@users.sourceforge.net>
64  *   - wait for completion of write urb in release (needed for remotecontrol)
65  *   - corrected poll for write direction (missing negation)
66  * 2004-04-22 - 0.94 Juergen Stuber <starblue@users.sourceforge.net>
67  *   - make device locking interruptible
68  * 2004-04-30 - 0.95 Juergen Stuber <starblue@users.sourceforge.net>
69  *   - check for valid udev on resubmitting and unlinking urbs
70  * 2004-08-03 - 0.96 Juergen Stuber <starblue@users.sourceforge.net>
71  *   - move reset into open to clean out spurious data
72  */
73
74 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
75
76 #include <linux/kernel.h>
77 #include <linux/errno.h>
78 #include <linux/slab.h>
79 #include <linux/module.h>
80 #include <linux/completion.h>
81 #include <linux/mutex.h>
82 #include <linux/uaccess.h>
83 #include <linux/usb.h>
84 #include <linux/poll.h>
85
86
87 #define DRIVER_AUTHOR "Juergen Stuber <starblue@sourceforge.net>"
88 #define DRIVER_DESC "LEGO USB Tower Driver"
89
90
91 /* The defaults are chosen to work with the latest versions of leJOS and NQC.
92  */
93
94 /* Some legacy software likes to receive packets in one piece.
95  * In this case read_buffer_size should exceed the maximal packet length
96  * (417 for datalog uploads), and packet_timeout should be set.
97  */
98 static int read_buffer_size = 480;
99 module_param(read_buffer_size, int, 0);
100 MODULE_PARM_DESC(read_buffer_size, "Read buffer size");
101
102 /* Some legacy software likes to send packets in one piece.
103  * In this case write_buffer_size should exceed the maximal packet length
104  * (417 for firmware and program downloads).
105  * A problem with long writes is that the following read may time out
106  * if the software is not prepared to wait long enough.
107  */
108 static int write_buffer_size = 480;
109 module_param(write_buffer_size, int, 0);
110 MODULE_PARM_DESC(write_buffer_size, "Write buffer size");
111
112 /* Some legacy software expects reads to contain whole LASM packets.
113  * To achieve this, characters which arrive before a packet timeout
114  * occurs will be returned in a single read operation.
115  * A problem with long reads is that the software may time out
116  * if it is not prepared to wait long enough.
117  * The packet timeout should be greater than the time between the
118  * reception of subsequent characters, which should arrive about
119  * every 5ms for the standard 2400 baud.
120  * Set it to 0 to disable.
121  */
122 static int packet_timeout = 50;
123 module_param(packet_timeout, int, 0);
124 MODULE_PARM_DESC(packet_timeout, "Packet timeout in ms");
125
126 /* Some legacy software expects blocking reads to time out.
127  * Timeout occurs after the specified time of read and write inactivity.
128  * Set it to 0 to disable.
129  */
130 static int read_timeout = 200;
131 module_param(read_timeout, int, 0);
132 MODULE_PARM_DESC(read_timeout, "Read timeout in ms");
133
134 /* As of kernel version 2.6.4 ehci-hcd uses an
135  * "only one interrupt transfer per frame" shortcut
136  * to simplify the scheduling of periodic transfers.
137  * This conflicts with our standard 1ms intervals for in and out URBs.
138  * We use default intervals of 2ms for in and 8ms for out transfers,
139  * which is fast enough for 2400 baud and allows a small additional load.
140  * Increase the interval to allow more devices that do interrupt transfers,
141  * or set to 0 to use the standard interval from the endpoint descriptors.
142  */
143 static int interrupt_in_interval = 2;
144 module_param(interrupt_in_interval, int, 0);
145 MODULE_PARM_DESC(interrupt_in_interval, "Interrupt in interval in ms");
146
147 static int interrupt_out_interval = 8;
148 module_param(interrupt_out_interval, int, 0);
149 MODULE_PARM_DESC(interrupt_out_interval, "Interrupt out interval in ms");
150
151 /* Define these values to match your device */
152 #define LEGO_USB_TOWER_VENDOR_ID        0x0694
153 #define LEGO_USB_TOWER_PRODUCT_ID       0x0001
154
155 /* Vendor requests */
156 #define LEGO_USB_TOWER_REQUEST_RESET            0x04
157 #define LEGO_USB_TOWER_REQUEST_GET_VERSION      0xFD
158
159 struct tower_reset_reply {
160         __le16 size;            /* little-endian */
161         __u8 err_code;
162         __u8 spare;
163 } __attribute__ ((packed));
164
165 struct tower_get_version_reply {
166         __le16 size;            /* little-endian */
167         __u8 err_code;
168         __u8 spare;
169         __u8 major;
170         __u8 minor;
171         __le16 build_no;                /* little-endian */
172 } __attribute__ ((packed));
173
174
175 /* table of devices that work with this driver */
176 static const struct usb_device_id tower_table[] = {
177         { USB_DEVICE(LEGO_USB_TOWER_VENDOR_ID, LEGO_USB_TOWER_PRODUCT_ID) },
178         { }                                     /* Terminating entry */
179 };
180
181 MODULE_DEVICE_TABLE (usb, tower_table);
182
183 #define LEGO_USB_TOWER_MINOR_BASE       160
184
185
186 /* Structure to hold all of our device specific stuff */
187 struct lego_usb_tower {
188         struct mutex            lock;           /* locks this structure */
189         struct usb_device*      udev;           /* save off the usb device pointer */
190         unsigned char           minor;          /* the starting minor number for this device */
191
192         int                     open_count;     /* number of times this port has been opened */
193         unsigned long           disconnected:1;
194
195         char*                   read_buffer;
196         size_t                  read_buffer_length; /* this much came in */
197         size_t                  read_packet_length; /* this much will be returned on read */
198         spinlock_t              read_buffer_lock;
199         int                     packet_timeout_jiffies;
200         unsigned long           read_last_arrival;
201
202         wait_queue_head_t       read_wait;
203         wait_queue_head_t       write_wait;
204
205         char*                   interrupt_in_buffer;
206         struct usb_endpoint_descriptor* interrupt_in_endpoint;
207         struct urb*             interrupt_in_urb;
208         int                     interrupt_in_interval;
209         int                     interrupt_in_running;
210         int                     interrupt_in_done;
211
212         char*                   interrupt_out_buffer;
213         struct usb_endpoint_descriptor* interrupt_out_endpoint;
214         struct urb*             interrupt_out_urb;
215         int                     interrupt_out_interval;
216         int                     interrupt_out_busy;
217
218 };
219
220
221 /* local function prototypes */
222 static ssize_t tower_read       (struct file *file, char __user *buffer, size_t count, loff_t *ppos);
223 static ssize_t tower_write      (struct file *file, const char __user *buffer, size_t count, loff_t *ppos);
224 static inline void tower_delete (struct lego_usb_tower *dev);
225 static int tower_open           (struct inode *inode, struct file *file);
226 static int tower_release        (struct inode *inode, struct file *file);
227 static __poll_t tower_poll      (struct file *file, poll_table *wait);
228 static loff_t tower_llseek      (struct file *file, loff_t off, int whence);
229
230 static void tower_abort_transfers (struct lego_usb_tower *dev);
231 static void tower_check_for_read_packet (struct lego_usb_tower *dev);
232 static void tower_interrupt_in_callback (struct urb *urb);
233 static void tower_interrupt_out_callback (struct urb *urb);
234
235 static int  tower_probe (struct usb_interface *interface, const struct usb_device_id *id);
236 static void tower_disconnect    (struct usb_interface *interface);
237
238
239 /* file operations needed when we register this driver */
240 static const struct file_operations tower_fops = {
241         .owner =        THIS_MODULE,
242         .read  =        tower_read,
243         .write =        tower_write,
244         .open =         tower_open,
245         .release =      tower_release,
246         .poll =         tower_poll,
247         .llseek =       tower_llseek,
248 };
249
250 static char *legousbtower_devnode(struct device *dev, umode_t *mode)
251 {
252         return kasprintf(GFP_KERNEL, "usb/%s", dev_name(dev));
253 }
254
255 /*
256  * usb class driver info in order to get a minor number from the usb core,
257  * and to have the device registered with the driver core
258  */
259 static struct usb_class_driver tower_class = {
260         .name =         "legousbtower%d",
261         .devnode =      legousbtower_devnode,
262         .fops =         &tower_fops,
263         .minor_base =   LEGO_USB_TOWER_MINOR_BASE,
264 };
265
266
267 /* usb specific object needed to register this driver with the usb subsystem */
268 static struct usb_driver tower_driver = {
269         .name =         "legousbtower",
270         .probe =        tower_probe,
271         .disconnect =   tower_disconnect,
272         .id_table =     tower_table,
273 };
274
275
276 /**
277  *      lego_usb_tower_debug_data
278  */
279 static inline void lego_usb_tower_debug_data(struct device *dev,
280                                              const char *function, int size,
281                                              const unsigned char *data)
282 {
283         dev_dbg(dev, "%s - length = %d, data = %*ph\n",
284                 function, size, size, data);
285 }
286
287
288 /**
289  *      tower_delete
290  */
291 static inline void tower_delete (struct lego_usb_tower *dev)
292 {
293         /* free data structures */
294         usb_free_urb(dev->interrupt_in_urb);
295         usb_free_urb(dev->interrupt_out_urb);
296         kfree (dev->read_buffer);
297         kfree (dev->interrupt_in_buffer);
298         kfree (dev->interrupt_out_buffer);
299         usb_put_dev(dev->udev);
300         kfree (dev);
301 }
302
303
304 /**
305  *      tower_open
306  */
307 static int tower_open (struct inode *inode, struct file *file)
308 {
309         struct lego_usb_tower *dev = NULL;
310         int subminor;
311         int retval = 0;
312         struct usb_interface *interface;
313         struct tower_reset_reply *reset_reply;
314         int result;
315
316         reset_reply = kmalloc(sizeof(*reset_reply), GFP_KERNEL);
317
318         if (!reset_reply) {
319                 retval = -ENOMEM;
320                 goto exit;
321         }
322
323         nonseekable_open(inode, file);
324         subminor = iminor(inode);
325
326         interface = usb_find_interface (&tower_driver, subminor);
327
328         if (!interface) {
329                 pr_err("error, can't find device for minor %d\n", subminor);
330                 retval = -ENODEV;
331                 goto exit;
332         }
333
334         dev = usb_get_intfdata(interface);
335         if (!dev) {
336                 retval = -ENODEV;
337                 goto exit;
338         }
339
340         /* lock this device */
341         if (mutex_lock_interruptible(&dev->lock)) {
342                 retval = -ERESTARTSYS;
343                 goto exit;
344         }
345
346
347         /* allow opening only once */
348         if (dev->open_count) {
349                 retval = -EBUSY;
350                 goto unlock_exit;
351         }
352
353         /* reset the tower */
354         result = usb_control_msg (dev->udev,
355                                   usb_rcvctrlpipe(dev->udev, 0),
356                                   LEGO_USB_TOWER_REQUEST_RESET,
357                                   USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE,
358                                   0,
359                                   0,
360                                   reset_reply,
361                                   sizeof(*reset_reply),
362                                   1000);
363         if (result < 0) {
364                 dev_err(&dev->udev->dev,
365                         "LEGO USB Tower reset control request failed\n");
366                 retval = result;
367                 goto unlock_exit;
368         }
369
370         /* initialize in direction */
371         dev->read_buffer_length = 0;
372         dev->read_packet_length = 0;
373         usb_fill_int_urb (dev->interrupt_in_urb,
374                           dev->udev,
375                           usb_rcvintpipe(dev->udev, dev->interrupt_in_endpoint->bEndpointAddress),
376                           dev->interrupt_in_buffer,
377                           usb_endpoint_maxp(dev->interrupt_in_endpoint),
378                           tower_interrupt_in_callback,
379                           dev,
380                           dev->interrupt_in_interval);
381
382         dev->interrupt_in_running = 1;
383         dev->interrupt_in_done = 0;
384         mb();
385
386         retval = usb_submit_urb (dev->interrupt_in_urb, GFP_KERNEL);
387         if (retval) {
388                 dev_err(&dev->udev->dev,
389                         "Couldn't submit interrupt_in_urb %d\n", retval);
390                 dev->interrupt_in_running = 0;
391                 goto unlock_exit;
392         }
393
394         /* save device in the file's private structure */
395         file->private_data = dev;
396
397         dev->open_count = 1;
398
399 unlock_exit:
400         mutex_unlock(&dev->lock);
401
402 exit:
403         kfree(reset_reply);
404         return retval;
405 }
406
407 /**
408  *      tower_release
409  */
410 static int tower_release (struct inode *inode, struct file *file)
411 {
412         struct lego_usb_tower *dev;
413         int retval = 0;
414
415         dev = file->private_data;
416
417         if (dev == NULL) {
418                 retval = -ENODEV;
419                 goto exit;
420         }
421
422         if (mutex_lock_interruptible(&dev->lock)) {
423                 retval = -ERESTARTSYS;
424                 goto exit;
425         }
426
427         if (dev->open_count != 1) {
428                 dev_dbg(&dev->udev->dev, "%s: device not opened exactly once\n",
429                         __func__);
430                 retval = -ENODEV;
431                 goto unlock_exit;
432         }
433
434         if (dev->disconnected) {
435                 /* the device was unplugged before the file was released */
436
437                 /* unlock here as tower_delete frees dev */
438                 mutex_unlock(&dev->lock);
439                 tower_delete (dev);
440                 goto exit;
441         }
442
443         /* wait until write transfer is finished */
444         if (dev->interrupt_out_busy) {
445                 wait_event_interruptible_timeout (dev->write_wait, !dev->interrupt_out_busy, 2 * HZ);
446         }
447         tower_abort_transfers (dev);
448         dev->open_count = 0;
449
450 unlock_exit:
451         mutex_unlock(&dev->lock);
452 exit:
453         return retval;
454 }
455
456
457 /**
458  *      tower_abort_transfers
459  *      aborts transfers and frees associated data structures
460  */
461 static void tower_abort_transfers (struct lego_usb_tower *dev)
462 {
463         if (dev == NULL)
464                 return;
465
466         /* shutdown transfer */
467         if (dev->interrupt_in_running) {
468                 dev->interrupt_in_running = 0;
469                 mb();
470                 usb_kill_urb(dev->interrupt_in_urb);
471         }
472         if (dev->interrupt_out_busy)
473                 usb_kill_urb(dev->interrupt_out_urb);
474 }
475
476
477 /**
478  *      tower_check_for_read_packet
479  *
480  *      To get correct semantics for signals and non-blocking I/O
481  *      with packetizing we pretend not to see any data in the read buffer
482  *      until it has been there unchanged for at least
483  *      dev->packet_timeout_jiffies, or until the buffer is full.
484  */
485 static void tower_check_for_read_packet (struct lego_usb_tower *dev)
486 {
487         spin_lock_irq (&dev->read_buffer_lock);
488         if (!packet_timeout
489             || time_after(jiffies, dev->read_last_arrival + dev->packet_timeout_jiffies)
490             || dev->read_buffer_length == read_buffer_size) {
491                 dev->read_packet_length = dev->read_buffer_length;
492         }
493         dev->interrupt_in_done = 0;
494         spin_unlock_irq (&dev->read_buffer_lock);
495 }
496
497
498 /**
499  *      tower_poll
500  */
501 static __poll_t tower_poll (struct file *file, poll_table *wait)
502 {
503         struct lego_usb_tower *dev;
504         __poll_t mask = 0;
505
506         dev = file->private_data;
507
508         if (dev->disconnected)
509                 return EPOLLERR | EPOLLHUP;
510
511         poll_wait(file, &dev->read_wait, wait);
512         poll_wait(file, &dev->write_wait, wait);
513
514         tower_check_for_read_packet(dev);
515         if (dev->read_packet_length > 0) {
516                 mask |= EPOLLIN | EPOLLRDNORM;
517         }
518         if (!dev->interrupt_out_busy) {
519                 mask |= EPOLLOUT | EPOLLWRNORM;
520         }
521
522         return mask;
523 }
524
525
526 /**
527  *      tower_llseek
528  */
529 static loff_t tower_llseek (struct file *file, loff_t off, int whence)
530 {
531         return -ESPIPE;         /* unseekable */
532 }
533
534
535 /**
536  *      tower_read
537  */
538 static ssize_t tower_read (struct file *file, char __user *buffer, size_t count, loff_t *ppos)
539 {
540         struct lego_usb_tower *dev;
541         size_t bytes_to_read;
542         int i;
543         int retval = 0;
544         unsigned long timeout = 0;
545
546         dev = file->private_data;
547
548         /* lock this object */
549         if (mutex_lock_interruptible(&dev->lock)) {
550                 retval = -ERESTARTSYS;
551                 goto exit;
552         }
553
554         /* verify that the device wasn't unplugged */
555         if (dev->disconnected) {
556                 retval = -ENODEV;
557                 pr_err("No device or device unplugged %d\n", retval);
558                 goto unlock_exit;
559         }
560
561         /* verify that we actually have some data to read */
562         if (count == 0) {
563                 dev_dbg(&dev->udev->dev, "read request of 0 bytes\n");
564                 goto unlock_exit;
565         }
566
567         if (read_timeout) {
568                 timeout = jiffies + msecs_to_jiffies(read_timeout);
569         }
570
571         /* wait for data */
572         tower_check_for_read_packet (dev);
573         while (dev->read_packet_length == 0) {
574                 if (file->f_flags & O_NONBLOCK) {
575                         retval = -EAGAIN;
576                         goto unlock_exit;
577                 }
578                 retval = wait_event_interruptible_timeout(dev->read_wait, dev->interrupt_in_done, dev->packet_timeout_jiffies);
579                 if (retval < 0) {
580                         goto unlock_exit;
581                 }
582
583                 /* reset read timeout during read or write activity */
584                 if (read_timeout
585                     && (dev->read_buffer_length || dev->interrupt_out_busy)) {
586                         timeout = jiffies + msecs_to_jiffies(read_timeout);
587                 }
588                 /* check for read timeout */
589                 if (read_timeout && time_after (jiffies, timeout)) {
590                         retval = -ETIMEDOUT;
591                         goto unlock_exit;
592                 }
593                 tower_check_for_read_packet (dev);
594         }
595
596         /* copy the data from read_buffer into userspace */
597         bytes_to_read = min(count, dev->read_packet_length);
598
599         if (copy_to_user (buffer, dev->read_buffer, bytes_to_read)) {
600                 retval = -EFAULT;
601                 goto unlock_exit;
602         }
603
604         spin_lock_irq (&dev->read_buffer_lock);
605         dev->read_buffer_length -= bytes_to_read;
606         dev->read_packet_length -= bytes_to_read;
607         for (i=0; i<dev->read_buffer_length; i++) {
608                 dev->read_buffer[i] = dev->read_buffer[i+bytes_to_read];
609         }
610         spin_unlock_irq (&dev->read_buffer_lock);
611
612         retval = bytes_to_read;
613
614 unlock_exit:
615         /* unlock the device */
616         mutex_unlock(&dev->lock);
617
618 exit:
619         return retval;
620 }
621
622
623 /**
624  *      tower_write
625  */
626 static ssize_t tower_write (struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
627 {
628         struct lego_usb_tower *dev;
629         size_t bytes_to_write;
630         int retval = 0;
631
632         dev = file->private_data;
633
634         /* lock this object */
635         if (mutex_lock_interruptible(&dev->lock)) {
636                 retval = -ERESTARTSYS;
637                 goto exit;
638         }
639
640         /* verify that the device wasn't unplugged */
641         if (dev->disconnected) {
642                 retval = -ENODEV;
643                 pr_err("No device or device unplugged %d\n", retval);
644                 goto unlock_exit;
645         }
646
647         /* verify that we actually have some data to write */
648         if (count == 0) {
649                 dev_dbg(&dev->udev->dev, "write request of 0 bytes\n");
650                 goto unlock_exit;
651         }
652
653         /* wait until previous transfer is finished */
654         while (dev->interrupt_out_busy) {
655                 if (file->f_flags & O_NONBLOCK) {
656                         retval = -EAGAIN;
657                         goto unlock_exit;
658                 }
659                 retval = wait_event_interruptible (dev->write_wait, !dev->interrupt_out_busy);
660                 if (retval) {
661                         goto unlock_exit;
662                 }
663         }
664
665         /* write the data into interrupt_out_buffer from userspace */
666         bytes_to_write = min_t(int, count, write_buffer_size);
667         dev_dbg(&dev->udev->dev, "%s: count = %zd, bytes_to_write = %zd\n",
668                 __func__, count, bytes_to_write);
669
670         if (copy_from_user (dev->interrupt_out_buffer, buffer, bytes_to_write)) {
671                 retval = -EFAULT;
672                 goto unlock_exit;
673         }
674
675         /* send off the urb */
676         usb_fill_int_urb(dev->interrupt_out_urb,
677                          dev->udev,
678                          usb_sndintpipe(dev->udev, dev->interrupt_out_endpoint->bEndpointAddress),
679                          dev->interrupt_out_buffer,
680                          bytes_to_write,
681                          tower_interrupt_out_callback,
682                          dev,
683                          dev->interrupt_out_interval);
684
685         dev->interrupt_out_busy = 1;
686         wmb();
687
688         retval = usb_submit_urb (dev->interrupt_out_urb, GFP_KERNEL);
689         if (retval) {
690                 dev->interrupt_out_busy = 0;
691                 dev_err(&dev->udev->dev,
692                         "Couldn't submit interrupt_out_urb %d\n", retval);
693                 goto unlock_exit;
694         }
695         retval = bytes_to_write;
696
697 unlock_exit:
698         /* unlock the device */
699         mutex_unlock(&dev->lock);
700
701 exit:
702         return retval;
703 }
704
705
706 /**
707  *      tower_interrupt_in_callback
708  */
709 static void tower_interrupt_in_callback (struct urb *urb)
710 {
711         struct lego_usb_tower *dev = urb->context;
712         int status = urb->status;
713         int retval;
714         unsigned long flags;
715
716         lego_usb_tower_debug_data(&dev->udev->dev, __func__,
717                                   urb->actual_length, urb->transfer_buffer);
718
719         if (status) {
720                 if (status == -ENOENT ||
721                     status == -ECONNRESET ||
722                     status == -ESHUTDOWN) {
723                         goto exit;
724                 } else {
725                         dev_dbg(&dev->udev->dev,
726                                 "%s: nonzero status received: %d\n", __func__,
727                                 status);
728                         goto resubmit; /* maybe we can recover */
729                 }
730         }
731
732         if (urb->actual_length > 0) {
733                 spin_lock_irqsave(&dev->read_buffer_lock, flags);
734                 if (dev->read_buffer_length + urb->actual_length < read_buffer_size) {
735                         memcpy (dev->read_buffer + dev->read_buffer_length,
736                                 dev->interrupt_in_buffer,
737                                 urb->actual_length);
738                         dev->read_buffer_length += urb->actual_length;
739                         dev->read_last_arrival = jiffies;
740                         dev_dbg(&dev->udev->dev, "%s: received %d bytes\n",
741                                 __func__, urb->actual_length);
742                 } else {
743                         pr_warn("read_buffer overflow, %d bytes dropped\n",
744                                 urb->actual_length);
745                 }
746                 spin_unlock_irqrestore(&dev->read_buffer_lock, flags);
747         }
748
749 resubmit:
750         /* resubmit if we're still running */
751         if (dev->interrupt_in_running) {
752                 retval = usb_submit_urb (dev->interrupt_in_urb, GFP_ATOMIC);
753                 if (retval)
754                         dev_err(&dev->udev->dev,
755                                 "%s: usb_submit_urb failed (%d)\n",
756                                 __func__, retval);
757         }
758
759 exit:
760         dev->interrupt_in_done = 1;
761         wake_up_interruptible (&dev->read_wait);
762 }
763
764
765 /**
766  *      tower_interrupt_out_callback
767  */
768 static void tower_interrupt_out_callback (struct urb *urb)
769 {
770         struct lego_usb_tower *dev = urb->context;
771         int status = urb->status;
772
773         lego_usb_tower_debug_data(&dev->udev->dev, __func__,
774                                   urb->actual_length, urb->transfer_buffer);
775
776         /* sync/async unlink faults aren't errors */
777         if (status && !(status == -ENOENT ||
778                         status == -ECONNRESET ||
779                         status == -ESHUTDOWN)) {
780                 dev_dbg(&dev->udev->dev,
781                         "%s: nonzero write bulk status received: %d\n", __func__,
782                         status);
783         }
784
785         dev->interrupt_out_busy = 0;
786         wake_up_interruptible(&dev->write_wait);
787 }
788
789
790 /**
791  *      tower_probe
792  *
793  *      Called by the usb core when a new device is connected that it thinks
794  *      this driver might be interested in.
795  */
796 static int tower_probe (struct usb_interface *interface, const struct usb_device_id *id)
797 {
798         struct device *idev = &interface->dev;
799         struct usb_device *udev = interface_to_usbdev(interface);
800         struct lego_usb_tower *dev = NULL;
801         struct tower_get_version_reply *get_version_reply = NULL;
802         int retval = -ENOMEM;
803         int result;
804
805         /* allocate memory for our device state and initialize it */
806
807         dev = kmalloc (sizeof(struct lego_usb_tower), GFP_KERNEL);
808
809         if (!dev)
810                 goto exit;
811
812         mutex_init(&dev->lock);
813
814         dev->udev = usb_get_dev(udev);
815         dev->open_count = 0;
816         dev->disconnected = 0;
817
818         dev->read_buffer = NULL;
819         dev->read_buffer_length = 0;
820         dev->read_packet_length = 0;
821         spin_lock_init (&dev->read_buffer_lock);
822         dev->packet_timeout_jiffies = msecs_to_jiffies(packet_timeout);
823         dev->read_last_arrival = jiffies;
824
825         init_waitqueue_head (&dev->read_wait);
826         init_waitqueue_head (&dev->write_wait);
827
828         dev->interrupt_in_buffer = NULL;
829         dev->interrupt_in_endpoint = NULL;
830         dev->interrupt_in_urb = NULL;
831         dev->interrupt_in_running = 0;
832         dev->interrupt_in_done = 0;
833
834         dev->interrupt_out_buffer = NULL;
835         dev->interrupt_out_endpoint = NULL;
836         dev->interrupt_out_urb = NULL;
837         dev->interrupt_out_busy = 0;
838
839         result = usb_find_common_endpoints_reverse(interface->cur_altsetting,
840                         NULL, NULL,
841                         &dev->interrupt_in_endpoint,
842                         &dev->interrupt_out_endpoint);
843         if (result) {
844                 dev_err(idev, "interrupt endpoints not found\n");
845                 retval = result;
846                 goto error;
847         }
848
849         dev->read_buffer = kmalloc (read_buffer_size, GFP_KERNEL);
850         if (!dev->read_buffer)
851                 goto error;
852         dev->interrupt_in_buffer = kmalloc (usb_endpoint_maxp(dev->interrupt_in_endpoint), GFP_KERNEL);
853         if (!dev->interrupt_in_buffer)
854                 goto error;
855         dev->interrupt_in_urb = usb_alloc_urb(0, GFP_KERNEL);
856         if (!dev->interrupt_in_urb)
857                 goto error;
858         dev->interrupt_out_buffer = kmalloc (write_buffer_size, GFP_KERNEL);
859         if (!dev->interrupt_out_buffer)
860                 goto error;
861         dev->interrupt_out_urb = usb_alloc_urb(0, GFP_KERNEL);
862         if (!dev->interrupt_out_urb)
863                 goto error;
864         dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval;
865         dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval;
866
867         get_version_reply = kmalloc(sizeof(*get_version_reply), GFP_KERNEL);
868
869         if (!get_version_reply) {
870                 retval = -ENOMEM;
871                 goto error;
872         }
873
874         /* get the firmware version and log it */
875         result = usb_control_msg (udev,
876                                   usb_rcvctrlpipe(udev, 0),
877                                   LEGO_USB_TOWER_REQUEST_GET_VERSION,
878                                   USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE,
879                                   0,
880                                   0,
881                                   get_version_reply,
882                                   sizeof(*get_version_reply),
883                                   1000);
884         if (result < sizeof(*get_version_reply)) {
885                 if (result >= 0)
886                         result = -EIO;
887                 dev_err(idev, "get version request failed: %d\n", result);
888                 retval = result;
889                 goto error;
890         }
891         dev_info(&interface->dev,
892                  "LEGO USB Tower firmware version is %d.%d build %d\n",
893                  get_version_reply->major,
894                  get_version_reply->minor,
895                  le16_to_cpu(get_version_reply->build_no));
896
897         /* we can register the device now, as it is ready */
898         usb_set_intfdata (interface, dev);
899
900         retval = usb_register_dev (interface, &tower_class);
901
902         if (retval) {
903                 /* something prevented us from registering this driver */
904                 dev_err(idev, "Not able to get a minor for this device.\n");
905                 goto error;
906         }
907         dev->minor = interface->minor;
908
909         /* let the user know what node this device is now attached to */
910         dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
911                  "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
912                  USB_MAJOR, dev->minor);
913
914 exit:
915         kfree(get_version_reply);
916         return retval;
917
918 error:
919         kfree(get_version_reply);
920         tower_delete(dev);
921         return retval;
922 }
923
924
925 /**
926  *      tower_disconnect
927  *
928  *      Called by the usb core when the device is removed from the system.
929  */
930 static void tower_disconnect (struct usb_interface *interface)
931 {
932         struct lego_usb_tower *dev;
933         int minor;
934
935         dev = usb_get_intfdata (interface);
936
937         minor = dev->minor;
938
939         /* give back our minor and prevent further open() */
940         usb_deregister_dev (interface, &tower_class);
941
942         /* stop I/O */
943         usb_poison_urb(dev->interrupt_in_urb);
944         usb_poison_urb(dev->interrupt_out_urb);
945
946         mutex_lock(&dev->lock);
947
948         /* if the device is not opened, then we clean up right now */
949         if (!dev->open_count) {
950                 mutex_unlock(&dev->lock);
951                 tower_delete (dev);
952         } else {
953                 dev->disconnected = 1;
954                 /* wake up pollers */
955                 wake_up_interruptible_all(&dev->read_wait);
956                 wake_up_interruptible_all(&dev->write_wait);
957                 mutex_unlock(&dev->lock);
958         }
959
960         dev_info(&interface->dev, "LEGO USB Tower #%d now disconnected\n",
961                  (minor - LEGO_USB_TOWER_MINOR_BASE));
962 }
963
964 module_usb_driver(tower_driver);
965
966 MODULE_AUTHOR(DRIVER_AUTHOR);
967 MODULE_DESCRIPTION(DRIVER_DESC);
968 #ifdef MODULE_LICENSE
969 MODULE_LICENSE("GPL");
970 #endif