Back to home page

OSCL-LXR
 
 

     

0001 // SPDX-License-Identifier: GPL-2.0+
0002 /*
0003  * drivers/usb/class/usbtmc.c - USB Test & Measurement class driver
0004  *
0005  * Copyright (C) 2007 Stefan Kopp, Gechingen, Germany
0006  * Copyright (C) 2008 Novell, Inc.
0007  * Copyright (C) 2008 Greg Kroah-Hartman <gregkh@suse.de>
0008  * Copyright (C) 2018 IVI Foundation, Inc.
0009  */
0010 
0011 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
0012 
0013 #include <linux/module.h>
0014 #include <linux/kernel.h>
0015 #include <linux/fs.h>
0016 #include <linux/uaccess.h>
0017 #include <linux/kref.h>
0018 #include <linux/slab.h>
0019 #include <linux/poll.h>
0020 #include <linux/mutex.h>
0021 #include <linux/usb.h>
0022 #include <linux/compat.h>
0023 #include <linux/usb/tmc.h>
0024 
0025 /* Increment API VERSION when changing tmc.h with new flags or ioctls
0026  * or when changing a significant behavior of the driver.
0027  */
0028 #define USBTMC_API_VERSION (3)
0029 
0030 #define USBTMC_HEADER_SIZE  12
0031 #define USBTMC_MINOR_BASE   176
0032 
0033 /* Minimum USB timeout (in milliseconds) */
0034 #define USBTMC_MIN_TIMEOUT  100
0035 /* Default USB timeout (in milliseconds) */
0036 #define USBTMC_TIMEOUT      5000
0037 
0038 /* Max number of urbs used in write transfers */
0039 #define MAX_URBS_IN_FLIGHT  16
0040 /* I/O buffer size used in generic read/write functions */
0041 #define USBTMC_BUFSIZE      (4096)
0042 
0043 /*
0044  * Maximum number of read cycles to empty bulk in endpoint during CLEAR and
0045  * ABORT_BULK_IN requests. Ends the loop if (for whatever reason) a short
0046  * packet is never read.
0047  */
0048 #define USBTMC_MAX_READS_TO_CLEAR_BULK_IN   100
0049 
0050 static const struct usb_device_id usbtmc_devices[] = {
0051     { USB_INTERFACE_INFO(USB_CLASS_APP_SPEC, 3, 0), },
0052     { USB_INTERFACE_INFO(USB_CLASS_APP_SPEC, 3, 1), },
0053     { 0, } /* terminating entry */
0054 };
0055 MODULE_DEVICE_TABLE(usb, usbtmc_devices);
0056 
0057 /*
0058  * This structure is the capabilities for the device
0059  * See section 4.2.1.8 of the USBTMC specification,
0060  * and section 4.2.2 of the USBTMC usb488 subclass
0061  * specification for details.
0062  */
0063 struct usbtmc_dev_capabilities {
0064     __u8 interface_capabilities;
0065     __u8 device_capabilities;
0066     __u8 usb488_interface_capabilities;
0067     __u8 usb488_device_capabilities;
0068 };
0069 
0070 /* This structure holds private data for each USBTMC device. One copy is
0071  * allocated for each USBTMC device in the driver's probe function.
0072  */
0073 struct usbtmc_device_data {
0074     const struct usb_device_id *id;
0075     struct usb_device *usb_dev;
0076     struct usb_interface *intf;
0077     struct list_head file_list;
0078 
0079     unsigned int bulk_in;
0080     unsigned int bulk_out;
0081 
0082     u8 bTag;
0083     u8 bTag_last_write; /* needed for abort */
0084     u8 bTag_last_read;  /* needed for abort */
0085 
0086     /* packet size of IN bulk */
0087     u16            wMaxPacketSize;
0088 
0089     /* data for interrupt in endpoint handling */
0090     u8             bNotify1;
0091     u8             bNotify2;
0092     u16            ifnum;
0093     u8             iin_bTag;
0094     u8            *iin_buffer;
0095     atomic_t       iin_data_valid;
0096     unsigned int   iin_ep;
0097     int            iin_ep_present;
0098     int            iin_interval;
0099     struct urb    *iin_urb;
0100     u16            iin_wMaxPacketSize;
0101 
0102     /* coalesced usb488_caps from usbtmc_dev_capabilities */
0103     __u8 usb488_caps;
0104 
0105     bool zombie; /* fd of disconnected device */
0106 
0107     struct usbtmc_dev_capabilities  capabilities;
0108     struct kref kref;
0109     struct mutex io_mutex;  /* only one i/o function running at a time */
0110     wait_queue_head_t waitq;
0111     struct fasync_struct *fasync;
0112     spinlock_t dev_lock; /* lock for file_list */
0113 };
0114 #define to_usbtmc_data(d) container_of(d, struct usbtmc_device_data, kref)
0115 
0116 /*
0117  * This structure holds private data for each USBTMC file handle.
0118  */
0119 struct usbtmc_file_data {
0120     struct usbtmc_device_data *data;
0121     struct list_head file_elem;
0122 
0123     u32            timeout;
0124     u8             srq_byte;
0125     atomic_t       srq_asserted;
0126     atomic_t       closing;
0127     u8             bmTransferAttributes; /* member of DEV_DEP_MSG_IN */
0128 
0129     u8             eom_val;
0130     u8             term_char;
0131     bool           term_char_enabled;
0132     bool           auto_abort;
0133 
0134     spinlock_t     err_lock; /* lock for errors */
0135 
0136     struct usb_anchor submitted;
0137 
0138     /* data for generic_write */
0139     struct semaphore limit_write_sem;
0140     u32 out_transfer_size;
0141     int out_status;
0142 
0143     /* data for generic_read */
0144     u32 in_transfer_size;
0145     int in_status;
0146     int in_urbs_used;
0147     struct usb_anchor in_anchor;
0148     wait_queue_head_t wait_bulk_in;
0149 };
0150 
0151 /* Forward declarations */
0152 static struct usb_driver usbtmc_driver;
0153 static void usbtmc_draw_down(struct usbtmc_file_data *file_data);
0154 
0155 static void usbtmc_delete(struct kref *kref)
0156 {
0157     struct usbtmc_device_data *data = to_usbtmc_data(kref);
0158 
0159     usb_put_dev(data->usb_dev);
0160     kfree(data);
0161 }
0162 
0163 static int usbtmc_open(struct inode *inode, struct file *filp)
0164 {
0165     struct usb_interface *intf;
0166     struct usbtmc_device_data *data;
0167     struct usbtmc_file_data *file_data;
0168 
0169     intf = usb_find_interface(&usbtmc_driver, iminor(inode));
0170     if (!intf) {
0171         pr_err("can not find device for minor %d", iminor(inode));
0172         return -ENODEV;
0173     }
0174 
0175     file_data = kzalloc(sizeof(*file_data), GFP_KERNEL);
0176     if (!file_data)
0177         return -ENOMEM;
0178 
0179     spin_lock_init(&file_data->err_lock);
0180     sema_init(&file_data->limit_write_sem, MAX_URBS_IN_FLIGHT);
0181     init_usb_anchor(&file_data->submitted);
0182     init_usb_anchor(&file_data->in_anchor);
0183     init_waitqueue_head(&file_data->wait_bulk_in);
0184 
0185     data = usb_get_intfdata(intf);
0186     /* Protect reference to data from file structure until release */
0187     kref_get(&data->kref);
0188 
0189     mutex_lock(&data->io_mutex);
0190     file_data->data = data;
0191 
0192     atomic_set(&file_data->closing, 0);
0193 
0194     file_data->timeout = USBTMC_TIMEOUT;
0195     file_data->term_char = '\n';
0196     file_data->term_char_enabled = 0;
0197     file_data->auto_abort = 0;
0198     file_data->eom_val = 1;
0199 
0200     INIT_LIST_HEAD(&file_data->file_elem);
0201     spin_lock_irq(&data->dev_lock);
0202     list_add_tail(&file_data->file_elem, &data->file_list);
0203     spin_unlock_irq(&data->dev_lock);
0204     mutex_unlock(&data->io_mutex);
0205 
0206     /* Store pointer in file structure's private data field */
0207     filp->private_data = file_data;
0208 
0209     return 0;
0210 }
0211 
0212 /*
0213  * usbtmc_flush - called before file handle is closed
0214  */
0215 static int usbtmc_flush(struct file *file, fl_owner_t id)
0216 {
0217     struct usbtmc_file_data *file_data;
0218     struct usbtmc_device_data *data;
0219 
0220     file_data = file->private_data;
0221     if (file_data == NULL)
0222         return -ENODEV;
0223 
0224     atomic_set(&file_data->closing, 1);
0225     data = file_data->data;
0226 
0227     /* wait for io to stop */
0228     mutex_lock(&data->io_mutex);
0229 
0230     usbtmc_draw_down(file_data);
0231 
0232     spin_lock_irq(&file_data->err_lock);
0233     file_data->in_status = 0;
0234     file_data->in_transfer_size = 0;
0235     file_data->in_urbs_used = 0;
0236     file_data->out_status = 0;
0237     file_data->out_transfer_size = 0;
0238     spin_unlock_irq(&file_data->err_lock);
0239 
0240     wake_up_interruptible_all(&data->waitq);
0241     mutex_unlock(&data->io_mutex);
0242 
0243     return 0;
0244 }
0245 
0246 static int usbtmc_release(struct inode *inode, struct file *file)
0247 {
0248     struct usbtmc_file_data *file_data = file->private_data;
0249 
0250     /* prevent IO _AND_ usbtmc_interrupt */
0251     mutex_lock(&file_data->data->io_mutex);
0252     spin_lock_irq(&file_data->data->dev_lock);
0253 
0254     list_del(&file_data->file_elem);
0255 
0256     spin_unlock_irq(&file_data->data->dev_lock);
0257     mutex_unlock(&file_data->data->io_mutex);
0258 
0259     kref_put(&file_data->data->kref, usbtmc_delete);
0260     file_data->data = NULL;
0261     kfree(file_data);
0262     return 0;
0263 }
0264 
0265 static int usbtmc_ioctl_abort_bulk_in_tag(struct usbtmc_device_data *data,
0266                       u8 tag)
0267 {
0268     u8 *buffer;
0269     struct device *dev;
0270     int rv;
0271     int n;
0272     int actual;
0273 
0274     dev = &data->intf->dev;
0275     buffer = kmalloc(USBTMC_BUFSIZE, GFP_KERNEL);
0276     if (!buffer)
0277         return -ENOMEM;
0278 
0279     rv = usb_control_msg(data->usb_dev,
0280                  usb_rcvctrlpipe(data->usb_dev, 0),
0281                  USBTMC_REQUEST_INITIATE_ABORT_BULK_IN,
0282                  USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT,
0283                  tag, data->bulk_in,
0284                  buffer, 2, USB_CTRL_GET_TIMEOUT);
0285 
0286     if (rv < 0) {
0287         dev_err(dev, "usb_control_msg returned %d\n", rv);
0288         goto exit;
0289     }
0290 
0291     dev_dbg(dev, "INITIATE_ABORT_BULK_IN returned %x with tag %02x\n",
0292         buffer[0], buffer[1]);
0293 
0294     if (buffer[0] == USBTMC_STATUS_FAILED) {
0295         /* No transfer in progress and the Bulk-OUT FIFO is empty. */
0296         rv = 0;
0297         goto exit;
0298     }
0299 
0300     if (buffer[0] == USBTMC_STATUS_TRANSFER_NOT_IN_PROGRESS) {
0301         /* The device returns this status if either:
0302          * - There is a transfer in progress, but the specified bTag
0303          *   does not match.
0304          * - There is no transfer in progress, but the Bulk-OUT FIFO
0305          *   is not empty.
0306          */
0307         rv = -ENOMSG;
0308         goto exit;
0309     }
0310 
0311     if (buffer[0] != USBTMC_STATUS_SUCCESS) {
0312         dev_err(dev, "INITIATE_ABORT_BULK_IN returned %x\n",
0313             buffer[0]);
0314         rv = -EPERM;
0315         goto exit;
0316     }
0317 
0318     n = 0;
0319 
0320 usbtmc_abort_bulk_in_status:
0321     dev_dbg(dev, "Reading from bulk in EP\n");
0322 
0323     /* Data must be present. So use low timeout 300 ms */
0324     actual = 0;
0325     rv = usb_bulk_msg(data->usb_dev,
0326               usb_rcvbulkpipe(data->usb_dev,
0327                       data->bulk_in),
0328               buffer, USBTMC_BUFSIZE,
0329               &actual, 300);
0330 
0331     print_hex_dump_debug("usbtmc ", DUMP_PREFIX_NONE, 16, 1,
0332                  buffer, actual, true);
0333 
0334     n++;
0335 
0336     if (rv < 0) {
0337         dev_err(dev, "usb_bulk_msg returned %d\n", rv);
0338         if (rv != -ETIMEDOUT)
0339             goto exit;
0340     }
0341 
0342     if (actual == USBTMC_BUFSIZE)
0343         goto usbtmc_abort_bulk_in_status;
0344 
0345     if (n >= USBTMC_MAX_READS_TO_CLEAR_BULK_IN) {
0346         dev_err(dev, "Couldn't clear device buffer within %d cycles\n",
0347             USBTMC_MAX_READS_TO_CLEAR_BULK_IN);
0348         rv = -EPERM;
0349         goto exit;
0350     }
0351 
0352     rv = usb_control_msg(data->usb_dev,
0353                  usb_rcvctrlpipe(data->usb_dev, 0),
0354                  USBTMC_REQUEST_CHECK_ABORT_BULK_IN_STATUS,
0355                  USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT,
0356                  0, data->bulk_in, buffer, 0x08,
0357                  USB_CTRL_GET_TIMEOUT);
0358 
0359     if (rv < 0) {
0360         dev_err(dev, "usb_control_msg returned %d\n", rv);
0361         goto exit;
0362     }
0363 
0364     dev_dbg(dev, "CHECK_ABORT_BULK_IN returned %x\n", buffer[0]);
0365 
0366     if (buffer[0] == USBTMC_STATUS_SUCCESS) {
0367         rv = 0;
0368         goto exit;
0369     }
0370 
0371     if (buffer[0] != USBTMC_STATUS_PENDING) {
0372         dev_err(dev, "CHECK_ABORT_BULK_IN returned %x\n", buffer[0]);
0373         rv = -EPERM;
0374         goto exit;
0375     }
0376 
0377     if ((buffer[1] & 1) > 0) {
0378         /* The device has 1 or more queued packets the Host can read */
0379         goto usbtmc_abort_bulk_in_status;
0380     }
0381 
0382     /* The Host must send CHECK_ABORT_BULK_IN_STATUS at a later time. */
0383     rv = -EAGAIN;
0384 exit:
0385     kfree(buffer);
0386     return rv;
0387 }
0388 
0389 static int usbtmc_ioctl_abort_bulk_in(struct usbtmc_device_data *data)
0390 {
0391     return usbtmc_ioctl_abort_bulk_in_tag(data, data->bTag_last_read);
0392 }
0393 
0394 static int usbtmc_ioctl_abort_bulk_out_tag(struct usbtmc_device_data *data,
0395                        u8 tag)
0396 {
0397     struct device *dev;
0398     u8 *buffer;
0399     int rv;
0400     int n;
0401 
0402     dev = &data->intf->dev;
0403 
0404     buffer = kmalloc(8, GFP_KERNEL);
0405     if (!buffer)
0406         return -ENOMEM;
0407 
0408     rv = usb_control_msg(data->usb_dev,
0409                  usb_rcvctrlpipe(data->usb_dev, 0),
0410                  USBTMC_REQUEST_INITIATE_ABORT_BULK_OUT,
0411                  USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT,
0412                  tag, data->bulk_out,
0413                  buffer, 2, USB_CTRL_GET_TIMEOUT);
0414 
0415     if (rv < 0) {
0416         dev_err(dev, "usb_control_msg returned %d\n", rv);
0417         goto exit;
0418     }
0419 
0420     dev_dbg(dev, "INITIATE_ABORT_BULK_OUT returned %x\n", buffer[0]);
0421 
0422     if (buffer[0] != USBTMC_STATUS_SUCCESS) {
0423         dev_err(dev, "INITIATE_ABORT_BULK_OUT returned %x\n",
0424             buffer[0]);
0425         rv = -EPERM;
0426         goto exit;
0427     }
0428 
0429     n = 0;
0430 
0431 usbtmc_abort_bulk_out_check_status:
0432     /* do not stress device with subsequent requests */
0433     msleep(50);
0434     rv = usb_control_msg(data->usb_dev,
0435                  usb_rcvctrlpipe(data->usb_dev, 0),
0436                  USBTMC_REQUEST_CHECK_ABORT_BULK_OUT_STATUS,
0437                  USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT,
0438                  0, data->bulk_out, buffer, 0x08,
0439                  USB_CTRL_GET_TIMEOUT);
0440     n++;
0441     if (rv < 0) {
0442         dev_err(dev, "usb_control_msg returned %d\n", rv);
0443         goto exit;
0444     }
0445 
0446     dev_dbg(dev, "CHECK_ABORT_BULK_OUT returned %x\n", buffer[0]);
0447 
0448     if (buffer[0] == USBTMC_STATUS_SUCCESS)
0449         goto usbtmc_abort_bulk_out_clear_halt;
0450 
0451     if ((buffer[0] == USBTMC_STATUS_PENDING) &&
0452         (n < USBTMC_MAX_READS_TO_CLEAR_BULK_IN))
0453         goto usbtmc_abort_bulk_out_check_status;
0454 
0455     rv = -EPERM;
0456     goto exit;
0457 
0458 usbtmc_abort_bulk_out_clear_halt:
0459     rv = usb_clear_halt(data->usb_dev,
0460                 usb_sndbulkpipe(data->usb_dev, data->bulk_out));
0461 
0462     if (rv < 0) {
0463         dev_err(dev, "usb_control_msg returned %d\n", rv);
0464         goto exit;
0465     }
0466     rv = 0;
0467 
0468 exit:
0469     kfree(buffer);
0470     return rv;
0471 }
0472 
0473 static int usbtmc_ioctl_abort_bulk_out(struct usbtmc_device_data *data)
0474 {
0475     return usbtmc_ioctl_abort_bulk_out_tag(data, data->bTag_last_write);
0476 }
0477 
0478 static int usbtmc_get_stb(struct usbtmc_file_data *file_data, __u8 *stb)
0479 {
0480     struct usbtmc_device_data *data = file_data->data;
0481     struct device *dev = &data->intf->dev;
0482     u8 *buffer;
0483     u8 tag;
0484     int rv;
0485 
0486     dev_dbg(dev, "Enter ioctl_read_stb iin_ep_present: %d\n",
0487         data->iin_ep_present);
0488 
0489     buffer = kmalloc(8, GFP_KERNEL);
0490     if (!buffer)
0491         return -ENOMEM;
0492 
0493     atomic_set(&data->iin_data_valid, 0);
0494 
0495     rv = usb_control_msg(data->usb_dev,
0496             usb_rcvctrlpipe(data->usb_dev, 0),
0497             USBTMC488_REQUEST_READ_STATUS_BYTE,
0498             USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
0499             data->iin_bTag,
0500             data->ifnum,
0501             buffer, 0x03, USB_CTRL_GET_TIMEOUT);
0502     if (rv < 0) {
0503         dev_err(dev, "stb usb_control_msg returned %d\n", rv);
0504         goto exit;
0505     }
0506 
0507     if (buffer[0] != USBTMC_STATUS_SUCCESS) {
0508         dev_err(dev, "control status returned %x\n", buffer[0]);
0509         rv = -EIO;
0510         goto exit;
0511     }
0512 
0513     if (data->iin_ep_present) {
0514         rv = wait_event_interruptible_timeout(
0515             data->waitq,
0516             atomic_read(&data->iin_data_valid) != 0,
0517             file_data->timeout);
0518         if (rv < 0) {
0519             dev_dbg(dev, "wait interrupted %d\n", rv);
0520             goto exit;
0521         }
0522 
0523         if (rv == 0) {
0524             dev_dbg(dev, "wait timed out\n");
0525             rv = -ETIMEDOUT;
0526             goto exit;
0527         }
0528 
0529         tag = data->bNotify1 & 0x7f;
0530         if (tag != data->iin_bTag) {
0531             dev_err(dev, "expected bTag %x got %x\n",
0532                 data->iin_bTag, tag);
0533         }
0534 
0535         *stb = data->bNotify2;
0536     } else {
0537         *stb = buffer[2];
0538     }
0539 
0540     dev_dbg(dev, "stb:0x%02x received %d\n", (unsigned int)*stb, rv);
0541 
0542  exit:
0543     /* bump interrupt bTag */
0544     data->iin_bTag += 1;
0545     if (data->iin_bTag > 127)
0546         /* 1 is for SRQ see USBTMC-USB488 subclass spec section 4.3.1 */
0547         data->iin_bTag = 2;
0548 
0549     kfree(buffer);
0550     return rv;
0551 }
0552 
0553 static int usbtmc488_ioctl_read_stb(struct usbtmc_file_data *file_data,
0554                 void __user *arg)
0555 {
0556     int srq_asserted = 0;
0557     __u8 stb;
0558     int rv;
0559 
0560     rv = usbtmc_get_stb(file_data, &stb);
0561 
0562     if (rv > 0) {
0563         srq_asserted = atomic_xchg(&file_data->srq_asserted,
0564                     srq_asserted);
0565         if (srq_asserted)
0566             stb |= 0x40; /* Set RQS bit */
0567 
0568         rv = put_user(stb, (__u8 __user *)arg);
0569     }
0570     return rv;
0571 
0572 }
0573 
0574 static int usbtmc_ioctl_get_srq_stb(struct usbtmc_file_data *file_data,
0575                 void __user *arg)
0576 {
0577     struct usbtmc_device_data *data = file_data->data;
0578     struct device *dev = &data->intf->dev;
0579     int srq_asserted = 0;
0580     __u8 stb = 0;
0581     int rv;
0582 
0583     spin_lock_irq(&data->dev_lock);
0584     srq_asserted  = atomic_xchg(&file_data->srq_asserted, srq_asserted);
0585 
0586     if (srq_asserted) {
0587         stb = file_data->srq_byte;
0588         spin_unlock_irq(&data->dev_lock);
0589         rv = put_user(stb, (__u8 __user *)arg);
0590     } else {
0591         spin_unlock_irq(&data->dev_lock);
0592         rv = -ENOMSG;
0593     }
0594 
0595     dev_dbg(dev, "stb:0x%02x with srq received %d\n", (unsigned int)stb, rv);
0596 
0597     return rv;
0598 }
0599 
0600 static int usbtmc488_ioctl_wait_srq(struct usbtmc_file_data *file_data,
0601                     __u32 __user *arg)
0602 {
0603     struct usbtmc_device_data *data = file_data->data;
0604     struct device *dev = &data->intf->dev;
0605     int rv;
0606     u32 timeout;
0607     unsigned long expire;
0608 
0609     if (!data->iin_ep_present) {
0610         dev_dbg(dev, "no interrupt endpoint present\n");
0611         return -EFAULT;
0612     }
0613 
0614     if (get_user(timeout, arg))
0615         return -EFAULT;
0616 
0617     expire = msecs_to_jiffies(timeout);
0618 
0619     mutex_unlock(&data->io_mutex);
0620 
0621     rv = wait_event_interruptible_timeout(
0622             data->waitq,
0623             atomic_read(&file_data->srq_asserted) != 0 ||
0624             atomic_read(&file_data->closing),
0625             expire);
0626 
0627     mutex_lock(&data->io_mutex);
0628 
0629     /* Note! disconnect or close could be called in the meantime */
0630     if (atomic_read(&file_data->closing) || data->zombie)
0631         rv = -ENODEV;
0632 
0633     if (rv < 0) {
0634         /* dev can be invalid now! */
0635         pr_debug("%s - wait interrupted %d\n", __func__, rv);
0636         return rv;
0637     }
0638 
0639     if (rv == 0) {
0640         dev_dbg(dev, "%s - wait timed out\n", __func__);
0641         return -ETIMEDOUT;
0642     }
0643 
0644     dev_dbg(dev, "%s - srq asserted\n", __func__);
0645     return 0;
0646 }
0647 
0648 static int usbtmc488_ioctl_simple(struct usbtmc_device_data *data,
0649                 void __user *arg, unsigned int cmd)
0650 {
0651     struct device *dev = &data->intf->dev;
0652     __u8 val;
0653     u8 *buffer;
0654     u16 wValue;
0655     int rv;
0656 
0657     if (!(data->usb488_caps & USBTMC488_CAPABILITY_SIMPLE))
0658         return -EINVAL;
0659 
0660     buffer = kmalloc(8, GFP_KERNEL);
0661     if (!buffer)
0662         return -ENOMEM;
0663 
0664     if (cmd == USBTMC488_REQUEST_REN_CONTROL) {
0665         rv = copy_from_user(&val, arg, sizeof(val));
0666         if (rv) {
0667             rv = -EFAULT;
0668             goto exit;
0669         }
0670         wValue = val ? 1 : 0;
0671     } else {
0672         wValue = 0;
0673     }
0674 
0675     rv = usb_control_msg(data->usb_dev,
0676             usb_rcvctrlpipe(data->usb_dev, 0),
0677             cmd,
0678             USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
0679             wValue,
0680             data->ifnum,
0681             buffer, 0x01, USB_CTRL_GET_TIMEOUT);
0682     if (rv < 0) {
0683         dev_err(dev, "simple usb_control_msg failed %d\n", rv);
0684         goto exit;
0685     } else if (rv != 1) {
0686         dev_warn(dev, "simple usb_control_msg returned %d\n", rv);
0687         rv = -EIO;
0688         goto exit;
0689     }
0690 
0691     if (buffer[0] != USBTMC_STATUS_SUCCESS) {
0692         dev_err(dev, "simple control status returned %x\n", buffer[0]);
0693         rv = -EIO;
0694         goto exit;
0695     }
0696     rv = 0;
0697 
0698  exit:
0699     kfree(buffer);
0700     return rv;
0701 }
0702 
0703 /*
0704  * Sends a TRIGGER Bulk-OUT command message
0705  * See the USBTMC-USB488 specification, Table 2.
0706  *
0707  * Also updates bTag_last_write.
0708  */
0709 static int usbtmc488_ioctl_trigger(struct usbtmc_file_data *file_data)
0710 {
0711     struct usbtmc_device_data *data = file_data->data;
0712     int retval;
0713     u8 *buffer;
0714     int actual;
0715 
0716     buffer = kzalloc(USBTMC_HEADER_SIZE, GFP_KERNEL);
0717     if (!buffer)
0718         return -ENOMEM;
0719 
0720     buffer[0] = 128;
0721     buffer[1] = data->bTag;
0722     buffer[2] = ~data->bTag;
0723 
0724     retval = usb_bulk_msg(data->usb_dev,
0725                   usb_sndbulkpipe(data->usb_dev,
0726                           data->bulk_out),
0727                   buffer, USBTMC_HEADER_SIZE,
0728                   &actual, file_data->timeout);
0729 
0730     /* Store bTag (in case we need to abort) */
0731     data->bTag_last_write = data->bTag;
0732 
0733     /* Increment bTag -- and increment again if zero */
0734     data->bTag++;
0735     if (!data->bTag)
0736         data->bTag++;
0737 
0738     kfree(buffer);
0739     if (retval < 0) {
0740         dev_err(&data->intf->dev, "%s returned %d\n",
0741             __func__, retval);
0742         return retval;
0743     }
0744 
0745     return 0;
0746 }
0747 
0748 static struct urb *usbtmc_create_urb(void)
0749 {
0750     const size_t bufsize = USBTMC_BUFSIZE;
0751     u8 *dmabuf = NULL;
0752     struct urb *urb = usb_alloc_urb(0, GFP_KERNEL);
0753 
0754     if (!urb)
0755         return NULL;
0756 
0757     dmabuf = kmalloc(bufsize, GFP_KERNEL);
0758     if (!dmabuf) {
0759         usb_free_urb(urb);
0760         return NULL;
0761     }
0762 
0763     urb->transfer_buffer = dmabuf;
0764     urb->transfer_buffer_length = bufsize;
0765     urb->transfer_flags |= URB_FREE_BUFFER;
0766     return urb;
0767 }
0768 
0769 static void usbtmc_read_bulk_cb(struct urb *urb)
0770 {
0771     struct usbtmc_file_data *file_data = urb->context;
0772     int status = urb->status;
0773     unsigned long flags;
0774 
0775     /* sync/async unlink faults aren't errors */
0776     if (status) {
0777         if (!(/* status == -ENOENT || */
0778             status == -ECONNRESET ||
0779             status == -EREMOTEIO || /* Short packet */
0780             status == -ESHUTDOWN))
0781             dev_err(&file_data->data->intf->dev,
0782             "%s - nonzero read bulk status received: %d\n",
0783             __func__, status);
0784 
0785         spin_lock_irqsave(&file_data->err_lock, flags);
0786         if (!file_data->in_status)
0787             file_data->in_status = status;
0788         spin_unlock_irqrestore(&file_data->err_lock, flags);
0789     }
0790 
0791     spin_lock_irqsave(&file_data->err_lock, flags);
0792     file_data->in_transfer_size += urb->actual_length;
0793     dev_dbg(&file_data->data->intf->dev,
0794         "%s - total size: %u current: %d status: %d\n",
0795         __func__, file_data->in_transfer_size,
0796         urb->actual_length, status);
0797     spin_unlock_irqrestore(&file_data->err_lock, flags);
0798     usb_anchor_urb(urb, &file_data->in_anchor);
0799 
0800     wake_up_interruptible(&file_data->wait_bulk_in);
0801     wake_up_interruptible(&file_data->data->waitq);
0802 }
0803 
0804 static inline bool usbtmc_do_transfer(struct usbtmc_file_data *file_data)
0805 {
0806     bool data_or_error;
0807 
0808     spin_lock_irq(&file_data->err_lock);
0809     data_or_error = !usb_anchor_empty(&file_data->in_anchor)
0810             || file_data->in_status;
0811     spin_unlock_irq(&file_data->err_lock);
0812     dev_dbg(&file_data->data->intf->dev, "%s: returns %d\n", __func__,
0813         data_or_error);
0814     return data_or_error;
0815 }
0816 
0817 static ssize_t usbtmc_generic_read(struct usbtmc_file_data *file_data,
0818                    void __user *user_buffer,
0819                    u32 transfer_size,
0820                    u32 *transferred,
0821                    u32 flags)
0822 {
0823     struct usbtmc_device_data *data = file_data->data;
0824     struct device *dev = &data->intf->dev;
0825     u32 done = 0;
0826     u32 remaining;
0827     const u32 bufsize = USBTMC_BUFSIZE;
0828     int retval = 0;
0829     u32 max_transfer_size;
0830     unsigned long expire;
0831     int bufcount = 1;
0832     int again = 0;
0833 
0834     /* mutex already locked */
0835 
0836     *transferred = done;
0837 
0838     max_transfer_size = transfer_size;
0839 
0840     if (flags & USBTMC_FLAG_IGNORE_TRAILER) {
0841         /* The device may send extra alignment bytes (up to
0842          * wMaxPacketSize – 1) to avoid sending a zero-length
0843          * packet
0844          */
0845         remaining = transfer_size;
0846         if ((max_transfer_size % data->wMaxPacketSize) == 0)
0847             max_transfer_size += (data->wMaxPacketSize - 1);
0848     } else {
0849         /* round down to bufsize to avoid truncated data left */
0850         if (max_transfer_size > bufsize) {
0851             max_transfer_size =
0852                 roundup(max_transfer_size + 1 - bufsize,
0853                     bufsize);
0854         }
0855         remaining = max_transfer_size;
0856     }
0857 
0858     spin_lock_irq(&file_data->err_lock);
0859 
0860     if (file_data->in_status) {
0861         /* return the very first error */
0862         retval = file_data->in_status;
0863         spin_unlock_irq(&file_data->err_lock);
0864         goto error;
0865     }
0866 
0867     if (flags & USBTMC_FLAG_ASYNC) {
0868         if (usb_anchor_empty(&file_data->in_anchor))
0869             again = 1;
0870 
0871         if (file_data->in_urbs_used == 0) {
0872             file_data->in_transfer_size = 0;
0873             file_data->in_status = 0;
0874         }
0875     } else {
0876         file_data->in_transfer_size = 0;
0877         file_data->in_status = 0;
0878     }
0879 
0880     if (max_transfer_size == 0) {
0881         bufcount = 0;
0882     } else {
0883         bufcount = roundup(max_transfer_size, bufsize) / bufsize;
0884         if (bufcount > file_data->in_urbs_used)
0885             bufcount -= file_data->in_urbs_used;
0886         else
0887             bufcount = 0;
0888 
0889         if (bufcount + file_data->in_urbs_used > MAX_URBS_IN_FLIGHT) {
0890             bufcount = MAX_URBS_IN_FLIGHT -
0891                     file_data->in_urbs_used;
0892         }
0893     }
0894     spin_unlock_irq(&file_data->err_lock);
0895 
0896     dev_dbg(dev, "%s: requested=%u flags=0x%X size=%u bufs=%d used=%d\n",
0897         __func__, transfer_size, flags,
0898         max_transfer_size, bufcount, file_data->in_urbs_used);
0899 
0900     while (bufcount > 0) {
0901         u8 *dmabuf = NULL;
0902         struct urb *urb = usbtmc_create_urb();
0903 
0904         if (!urb) {
0905             retval = -ENOMEM;
0906             goto error;
0907         }
0908 
0909         dmabuf = urb->transfer_buffer;
0910 
0911         usb_fill_bulk_urb(urb, data->usb_dev,
0912             usb_rcvbulkpipe(data->usb_dev, data->bulk_in),
0913             dmabuf, bufsize,
0914             usbtmc_read_bulk_cb, file_data);
0915 
0916         usb_anchor_urb(urb, &file_data->submitted);
0917         retval = usb_submit_urb(urb, GFP_KERNEL);
0918         /* urb is anchored. We can release our reference. */
0919         usb_free_urb(urb);
0920         if (unlikely(retval)) {
0921             usb_unanchor_urb(urb);
0922             goto error;
0923         }
0924         file_data->in_urbs_used++;
0925         bufcount--;
0926     }
0927 
0928     if (again) {
0929         dev_dbg(dev, "%s: ret=again\n", __func__);
0930         return -EAGAIN;
0931     }
0932 
0933     if (user_buffer == NULL)
0934         return -EINVAL;
0935 
0936     expire = msecs_to_jiffies(file_data->timeout);
0937 
0938     while (max_transfer_size > 0) {
0939         u32 this_part;
0940         struct urb *urb = NULL;
0941 
0942         if (!(flags & USBTMC_FLAG_ASYNC)) {
0943             dev_dbg(dev, "%s: before wait time %lu\n",
0944                 __func__, expire);
0945             retval = wait_event_interruptible_timeout(
0946                 file_data->wait_bulk_in,
0947                 usbtmc_do_transfer(file_data),
0948                 expire);
0949 
0950             dev_dbg(dev, "%s: wait returned %d\n",
0951                 __func__, retval);
0952 
0953             if (retval <= 0) {
0954                 if (retval == 0)
0955                     retval = -ETIMEDOUT;
0956                 goto error;
0957             }
0958         }
0959 
0960         urb = usb_get_from_anchor(&file_data->in_anchor);
0961         if (!urb) {
0962             if (!(flags & USBTMC_FLAG_ASYNC)) {
0963                 /* synchronous case: must not happen */
0964                 retval = -EFAULT;
0965                 goto error;
0966             }
0967 
0968             /* asynchronous case: ready, do not block or wait */
0969             *transferred = done;
0970             dev_dbg(dev, "%s: (async) done=%u ret=0\n",
0971                 __func__, done);
0972             return 0;
0973         }
0974 
0975         file_data->in_urbs_used--;
0976 
0977         if (max_transfer_size > urb->actual_length)
0978             max_transfer_size -= urb->actual_length;
0979         else
0980             max_transfer_size = 0;
0981 
0982         if (remaining > urb->actual_length)
0983             this_part = urb->actual_length;
0984         else
0985             this_part = remaining;
0986 
0987         print_hex_dump_debug("usbtmc ", DUMP_PREFIX_NONE, 16, 1,
0988             urb->transfer_buffer, urb->actual_length, true);
0989 
0990         if (copy_to_user(user_buffer + done,
0991                  urb->transfer_buffer, this_part)) {
0992             usb_free_urb(urb);
0993             retval = -EFAULT;
0994             goto error;
0995         }
0996 
0997         remaining -= this_part;
0998         done += this_part;
0999 
1000         spin_lock_irq(&file_data->err_lock);
1001         if (urb->status) {
1002             /* return the very first error */
1003             retval = file_data->in_status;
1004             spin_unlock_irq(&file_data->err_lock);
1005             usb_free_urb(urb);
1006             goto error;
1007         }
1008         spin_unlock_irq(&file_data->err_lock);
1009 
1010         if (urb->actual_length < bufsize) {
1011             /* short packet or ZLP received => ready */
1012             usb_free_urb(urb);
1013             retval = 1;
1014             break;
1015         }
1016 
1017         if (!(flags & USBTMC_FLAG_ASYNC) &&
1018             max_transfer_size > (bufsize * file_data->in_urbs_used)) {
1019             /* resubmit, since other buffers still not enough */
1020             usb_anchor_urb(urb, &file_data->submitted);
1021             retval = usb_submit_urb(urb, GFP_KERNEL);
1022             if (unlikely(retval)) {
1023                 usb_unanchor_urb(urb);
1024                 usb_free_urb(urb);
1025                 goto error;
1026             }
1027             file_data->in_urbs_used++;
1028         }
1029         usb_free_urb(urb);
1030         retval = 0;
1031     }
1032 
1033 error:
1034     *transferred = done;
1035 
1036     dev_dbg(dev, "%s: before kill\n", __func__);
1037     /* Attention: killing urbs can take long time (2 ms) */
1038     usb_kill_anchored_urbs(&file_data->submitted);
1039     dev_dbg(dev, "%s: after kill\n", __func__);
1040     usb_scuttle_anchored_urbs(&file_data->in_anchor);
1041     file_data->in_urbs_used = 0;
1042     file_data->in_status = 0; /* no spinlock needed here */
1043     dev_dbg(dev, "%s: done=%u ret=%d\n", __func__, done, retval);
1044 
1045     return retval;
1046 }
1047 
1048 static ssize_t usbtmc_ioctl_generic_read(struct usbtmc_file_data *file_data,
1049                      void __user *arg)
1050 {
1051     struct usbtmc_message msg;
1052     ssize_t retval = 0;
1053 
1054     /* mutex already locked */
1055 
1056     if (copy_from_user(&msg, arg, sizeof(struct usbtmc_message)))
1057         return -EFAULT;
1058 
1059     retval = usbtmc_generic_read(file_data, msg.message,
1060                      msg.transfer_size, &msg.transferred,
1061                      msg.flags);
1062 
1063     if (put_user(msg.transferred,
1064              &((struct usbtmc_message __user *)arg)->transferred))
1065         return -EFAULT;
1066 
1067     return retval;
1068 }
1069 
1070 static void usbtmc_write_bulk_cb(struct urb *urb)
1071 {
1072     struct usbtmc_file_data *file_data = urb->context;
1073     int wakeup = 0;
1074     unsigned long flags;
1075 
1076     spin_lock_irqsave(&file_data->err_lock, flags);
1077     file_data->out_transfer_size += urb->actual_length;
1078 
1079     /* sync/async unlink faults aren't errors */
1080     if (urb->status) {
1081         if (!(urb->status == -ENOENT ||
1082             urb->status == -ECONNRESET ||
1083             urb->status == -ESHUTDOWN))
1084             dev_err(&file_data->data->intf->dev,
1085                 "%s - nonzero write bulk status received: %d\n",
1086                 __func__, urb->status);
1087 
1088         if (!file_data->out_status) {
1089             file_data->out_status = urb->status;
1090             wakeup = 1;
1091         }
1092     }
1093     spin_unlock_irqrestore(&file_data->err_lock, flags);
1094 
1095     dev_dbg(&file_data->data->intf->dev,
1096         "%s - write bulk total size: %u\n",
1097         __func__, file_data->out_transfer_size);
1098 
1099     up(&file_data->limit_write_sem);
1100     if (usb_anchor_empty(&file_data->submitted) || wakeup)
1101         wake_up_interruptible(&file_data->data->waitq);
1102 }
1103 
1104 static ssize_t usbtmc_generic_write(struct usbtmc_file_data *file_data,
1105                     const void __user *user_buffer,
1106                     u32 transfer_size,
1107                     u32 *transferred,
1108                     u32 flags)
1109 {
1110     struct usbtmc_device_data *data = file_data->data;
1111     struct device *dev;
1112     u32 done = 0;
1113     u32 remaining;
1114     unsigned long expire;
1115     const u32 bufsize = USBTMC_BUFSIZE;
1116     struct urb *urb = NULL;
1117     int retval = 0;
1118     u32 timeout;
1119 
1120     *transferred = 0;
1121 
1122     /* Get pointer to private data structure */
1123     dev = &data->intf->dev;
1124 
1125     dev_dbg(dev, "%s: size=%u flags=0x%X sema=%u\n",
1126         __func__, transfer_size, flags,
1127         file_data->limit_write_sem.count);
1128 
1129     if (flags & USBTMC_FLAG_APPEND) {
1130         spin_lock_irq(&file_data->err_lock);
1131         retval = file_data->out_status;
1132         spin_unlock_irq(&file_data->err_lock);
1133         if (retval < 0)
1134             return retval;
1135     } else {
1136         spin_lock_irq(&file_data->err_lock);
1137         file_data->out_transfer_size = 0;
1138         file_data->out_status = 0;
1139         spin_unlock_irq(&file_data->err_lock);
1140     }
1141 
1142     remaining = transfer_size;
1143     if (remaining > INT_MAX)
1144         remaining = INT_MAX;
1145 
1146     timeout = file_data->timeout;
1147     expire = msecs_to_jiffies(timeout);
1148 
1149     while (remaining > 0) {
1150         u32 this_part, aligned;
1151         u8 *buffer = NULL;
1152 
1153         if (flags & USBTMC_FLAG_ASYNC) {
1154             if (down_trylock(&file_data->limit_write_sem)) {
1155                 retval = (done)?(0):(-EAGAIN);
1156                 goto exit;
1157             }
1158         } else {
1159             retval = down_timeout(&file_data->limit_write_sem,
1160                           expire);
1161             if (retval < 0) {
1162                 retval = -ETIMEDOUT;
1163                 goto error;
1164             }
1165         }
1166 
1167         spin_lock_irq(&file_data->err_lock);
1168         retval = file_data->out_status;
1169         spin_unlock_irq(&file_data->err_lock);
1170         if (retval < 0) {
1171             up(&file_data->limit_write_sem);
1172             goto error;
1173         }
1174 
1175         /* prepare next urb to send */
1176         urb = usbtmc_create_urb();
1177         if (!urb) {
1178             retval = -ENOMEM;
1179             up(&file_data->limit_write_sem);
1180             goto error;
1181         }
1182         buffer = urb->transfer_buffer;
1183 
1184         if (remaining > bufsize)
1185             this_part = bufsize;
1186         else
1187             this_part = remaining;
1188 
1189         if (copy_from_user(buffer, user_buffer + done, this_part)) {
1190             retval = -EFAULT;
1191             up(&file_data->limit_write_sem);
1192             goto error;
1193         }
1194 
1195         print_hex_dump_debug("usbtmc ", DUMP_PREFIX_NONE,
1196             16, 1, buffer, this_part, true);
1197 
1198         /* fill bulk with 32 bit alignment to meet USBTMC specification
1199          * (size + 3 & ~3) rounds up and simplifies user code
1200          */
1201         aligned = (this_part + 3) & ~3;
1202         dev_dbg(dev, "write(size:%u align:%u done:%u)\n",
1203             (unsigned int)this_part,
1204             (unsigned int)aligned,
1205             (unsigned int)done);
1206 
1207         usb_fill_bulk_urb(urb, data->usb_dev,
1208             usb_sndbulkpipe(data->usb_dev, data->bulk_out),
1209             urb->transfer_buffer, aligned,
1210             usbtmc_write_bulk_cb, file_data);
1211 
1212         usb_anchor_urb(urb, &file_data->submitted);
1213         retval = usb_submit_urb(urb, GFP_KERNEL);
1214         if (unlikely(retval)) {
1215             usb_unanchor_urb(urb);
1216             up(&file_data->limit_write_sem);
1217             goto error;
1218         }
1219 
1220         usb_free_urb(urb);
1221         urb = NULL; /* urb will be finally released by usb driver */
1222 
1223         remaining -= this_part;
1224         done += this_part;
1225     }
1226 
1227     /* All urbs are on the fly */
1228     if (!(flags & USBTMC_FLAG_ASYNC)) {
1229         if (!usb_wait_anchor_empty_timeout(&file_data->submitted,
1230                            timeout)) {
1231             retval = -ETIMEDOUT;
1232             goto error;
1233         }
1234     }
1235 
1236     retval = 0;
1237     goto exit;
1238 
1239 error:
1240     usb_kill_anchored_urbs(&file_data->submitted);
1241 exit:
1242     usb_free_urb(urb);
1243 
1244     spin_lock_irq(&file_data->err_lock);
1245     if (!(flags & USBTMC_FLAG_ASYNC))
1246         done = file_data->out_transfer_size;
1247     if (!retval && file_data->out_status)
1248         retval = file_data->out_status;
1249     spin_unlock_irq(&file_data->err_lock);
1250 
1251     *transferred = done;
1252 
1253     dev_dbg(dev, "%s: done=%u, retval=%d, urbstat=%d\n",
1254         __func__, done, retval, file_data->out_status);
1255 
1256     return retval;
1257 }
1258 
1259 static ssize_t usbtmc_ioctl_generic_write(struct usbtmc_file_data *file_data,
1260                       void __user *arg)
1261 {
1262     struct usbtmc_message msg;
1263     ssize_t retval = 0;
1264 
1265     /* mutex already locked */
1266 
1267     if (copy_from_user(&msg, arg, sizeof(struct usbtmc_message)))
1268         return -EFAULT;
1269 
1270     retval = usbtmc_generic_write(file_data, msg.message,
1271                       msg.transfer_size, &msg.transferred,
1272                       msg.flags);
1273 
1274     if (put_user(msg.transferred,
1275              &((struct usbtmc_message __user *)arg)->transferred))
1276         return -EFAULT;
1277 
1278     return retval;
1279 }
1280 
1281 /*
1282  * Get the generic write result
1283  */
1284 static ssize_t usbtmc_ioctl_write_result(struct usbtmc_file_data *file_data,
1285                 void __user *arg)
1286 {
1287     u32 transferred;
1288     int retval;
1289 
1290     spin_lock_irq(&file_data->err_lock);
1291     transferred = file_data->out_transfer_size;
1292     retval = file_data->out_status;
1293     spin_unlock_irq(&file_data->err_lock);
1294 
1295     if (put_user(transferred, (__u32 __user *)arg))
1296         return -EFAULT;
1297 
1298     return retval;
1299 }
1300 
1301 /*
1302  * Sends a REQUEST_DEV_DEP_MSG_IN message on the Bulk-OUT endpoint.
1303  * @transfer_size: number of bytes to request from the device.
1304  *
1305  * See the USBTMC specification, Table 4.
1306  *
1307  * Also updates bTag_last_write.
1308  */
1309 static int send_request_dev_dep_msg_in(struct usbtmc_file_data *file_data,
1310                        u32 transfer_size)
1311 {
1312     struct usbtmc_device_data *data = file_data->data;
1313     int retval;
1314     u8 *buffer;
1315     int actual;
1316 
1317     buffer = kmalloc(USBTMC_HEADER_SIZE, GFP_KERNEL);
1318     if (!buffer)
1319         return -ENOMEM;
1320     /* Setup IO buffer for REQUEST_DEV_DEP_MSG_IN message
1321      * Refer to class specs for details
1322      */
1323     buffer[0] = 2;
1324     buffer[1] = data->bTag;
1325     buffer[2] = ~data->bTag;
1326     buffer[3] = 0; /* Reserved */
1327     buffer[4] = transfer_size >> 0;
1328     buffer[5] = transfer_size >> 8;
1329     buffer[6] = transfer_size >> 16;
1330     buffer[7] = transfer_size >> 24;
1331     buffer[8] = file_data->term_char_enabled * 2;
1332     /* Use term character? */
1333     buffer[9] = file_data->term_char;
1334     buffer[10] = 0; /* Reserved */
1335     buffer[11] = 0; /* Reserved */
1336 
1337     /* Send bulk URB */
1338     retval = usb_bulk_msg(data->usb_dev,
1339                   usb_sndbulkpipe(data->usb_dev,
1340                           data->bulk_out),
1341                   buffer, USBTMC_HEADER_SIZE,
1342                   &actual, file_data->timeout);
1343 
1344     /* Store bTag (in case we need to abort) */
1345     data->bTag_last_write = data->bTag;
1346 
1347     /* Increment bTag -- and increment again if zero */
1348     data->bTag++;
1349     if (!data->bTag)
1350         data->bTag++;
1351 
1352     kfree(buffer);
1353     if (retval < 0)
1354         dev_err(&data->intf->dev, "%s returned %d\n",
1355             __func__, retval);
1356 
1357     return retval;
1358 }
1359 
1360 static ssize_t usbtmc_read(struct file *filp, char __user *buf,
1361                size_t count, loff_t *f_pos)
1362 {
1363     struct usbtmc_file_data *file_data;
1364     struct usbtmc_device_data *data;
1365     struct device *dev;
1366     const u32 bufsize = USBTMC_BUFSIZE;
1367     u32 n_characters;
1368     u8 *buffer;
1369     int actual;
1370     u32 done = 0;
1371     u32 remaining;
1372     int retval;
1373 
1374     /* Get pointer to private data structure */
1375     file_data = filp->private_data;
1376     data = file_data->data;
1377     dev = &data->intf->dev;
1378 
1379     buffer = kmalloc(bufsize, GFP_KERNEL);
1380     if (!buffer)
1381         return -ENOMEM;
1382 
1383     mutex_lock(&data->io_mutex);
1384     if (data->zombie) {
1385         retval = -ENODEV;
1386         goto exit;
1387     }
1388 
1389     if (count > INT_MAX)
1390         count = INT_MAX;
1391 
1392     dev_dbg(dev, "%s(count:%zu)\n", __func__, count);
1393 
1394     retval = send_request_dev_dep_msg_in(file_data, count);
1395 
1396     if (retval < 0) {
1397         if (file_data->auto_abort)
1398             usbtmc_ioctl_abort_bulk_out(data);
1399         goto exit;
1400     }
1401 
1402     /* Loop until we have fetched everything we requested */
1403     remaining = count;
1404     actual = 0;
1405 
1406     /* Send bulk URB */
1407     retval = usb_bulk_msg(data->usb_dev,
1408                   usb_rcvbulkpipe(data->usb_dev,
1409                           data->bulk_in),
1410                   buffer, bufsize, &actual,
1411                   file_data->timeout);
1412 
1413     dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
1414         __func__, retval, actual);
1415 
1416     /* Store bTag (in case we need to abort) */
1417     data->bTag_last_read = data->bTag;
1418 
1419     if (retval < 0) {
1420         if (file_data->auto_abort)
1421             usbtmc_ioctl_abort_bulk_in(data);
1422         goto exit;
1423     }
1424 
1425     /* Sanity checks for the header */
1426     if (actual < USBTMC_HEADER_SIZE) {
1427         dev_err(dev, "Device sent too small first packet: %u < %u\n",
1428             actual, USBTMC_HEADER_SIZE);
1429         if (file_data->auto_abort)
1430             usbtmc_ioctl_abort_bulk_in(data);
1431         goto exit;
1432     }
1433 
1434     if (buffer[0] != 2) {
1435         dev_err(dev, "Device sent reply with wrong MsgID: %u != 2\n",
1436             buffer[0]);
1437         if (file_data->auto_abort)
1438             usbtmc_ioctl_abort_bulk_in(data);
1439         goto exit;
1440     }
1441 
1442     if (buffer[1] != data->bTag_last_write) {
1443         dev_err(dev, "Device sent reply with wrong bTag: %u != %u\n",
1444         buffer[1], data->bTag_last_write);
1445         if (file_data->auto_abort)
1446             usbtmc_ioctl_abort_bulk_in(data);
1447         goto exit;
1448     }
1449 
1450     /* How many characters did the instrument send? */
1451     n_characters = buffer[4] +
1452                (buffer[5] << 8) +
1453                (buffer[6] << 16) +
1454                (buffer[7] << 24);
1455 
1456     file_data->bmTransferAttributes = buffer[8];
1457 
1458     dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
1459         n_characters, buffer[8]);
1460 
1461     if (n_characters > remaining) {
1462         dev_err(dev, "Device wants to return more data than requested: %u > %zu\n",
1463             n_characters, count);
1464         if (file_data->auto_abort)
1465             usbtmc_ioctl_abort_bulk_in(data);
1466         goto exit;
1467     }
1468 
1469     print_hex_dump_debug("usbtmc ", DUMP_PREFIX_NONE,
1470                  16, 1, buffer, actual, true);
1471 
1472     remaining = n_characters;
1473 
1474     /* Remove the USBTMC header */
1475     actual -= USBTMC_HEADER_SIZE;
1476 
1477     /* Remove padding if it exists */
1478     if (actual > remaining)
1479         actual = remaining;
1480 
1481     remaining -= actual;
1482 
1483     /* Copy buffer to user space */
1484     if (copy_to_user(buf, &buffer[USBTMC_HEADER_SIZE], actual)) {
1485         /* There must have been an addressing problem */
1486         retval = -EFAULT;
1487         goto exit;
1488     }
1489 
1490     if ((actual + USBTMC_HEADER_SIZE) == bufsize) {
1491         retval = usbtmc_generic_read(file_data, buf + actual,
1492                          remaining,
1493                          &done,
1494                          USBTMC_FLAG_IGNORE_TRAILER);
1495         if (retval < 0)
1496             goto exit;
1497     }
1498     done += actual;
1499 
1500     /* Update file position value */
1501     *f_pos = *f_pos + done;
1502     retval = done;
1503 
1504 exit:
1505     mutex_unlock(&data->io_mutex);
1506     kfree(buffer);
1507     return retval;
1508 }
1509 
1510 static ssize_t usbtmc_write(struct file *filp, const char __user *buf,
1511                 size_t count, loff_t *f_pos)
1512 {
1513     struct usbtmc_file_data *file_data;
1514     struct usbtmc_device_data *data;
1515     struct urb *urb = NULL;
1516     ssize_t retval = 0;
1517     u8 *buffer;
1518     u32 remaining, done;
1519     u32 transfersize, aligned, buflen;
1520 
1521     file_data = filp->private_data;
1522     data = file_data->data;
1523 
1524     mutex_lock(&data->io_mutex);
1525 
1526     if (data->zombie) {
1527         retval = -ENODEV;
1528         goto exit;
1529     }
1530 
1531     done = 0;
1532 
1533     spin_lock_irq(&file_data->err_lock);
1534     file_data->out_transfer_size = 0;
1535     file_data->out_status = 0;
1536     spin_unlock_irq(&file_data->err_lock);
1537 
1538     if (!count)
1539         goto exit;
1540 
1541     if (down_trylock(&file_data->limit_write_sem)) {
1542         /* previous calls were async */
1543         retval = -EBUSY;
1544         goto exit;
1545     }
1546 
1547     urb = usbtmc_create_urb();
1548     if (!urb) {
1549         retval = -ENOMEM;
1550         up(&file_data->limit_write_sem);
1551         goto exit;
1552     }
1553 
1554     buffer = urb->transfer_buffer;
1555     buflen = urb->transfer_buffer_length;
1556 
1557     if (count > INT_MAX) {
1558         transfersize = INT_MAX;
1559         buffer[8] = 0;
1560     } else {
1561         transfersize = count;
1562         buffer[8] = file_data->eom_val;
1563     }
1564 
1565     /* Setup IO buffer for DEV_DEP_MSG_OUT message */
1566     buffer[0] = 1;
1567     buffer[1] = data->bTag;
1568     buffer[2] = ~data->bTag;
1569     buffer[3] = 0; /* Reserved */
1570     buffer[4] = transfersize >> 0;
1571     buffer[5] = transfersize >> 8;
1572     buffer[6] = transfersize >> 16;
1573     buffer[7] = transfersize >> 24;
1574     /* buffer[8] is set above... */
1575     buffer[9] = 0; /* Reserved */
1576     buffer[10] = 0; /* Reserved */
1577     buffer[11] = 0; /* Reserved */
1578 
1579     remaining = transfersize;
1580 
1581     if (transfersize + USBTMC_HEADER_SIZE > buflen) {
1582         transfersize = buflen - USBTMC_HEADER_SIZE;
1583         aligned = buflen;
1584     } else {
1585         aligned = (transfersize + (USBTMC_HEADER_SIZE + 3)) & ~3;
1586     }
1587 
1588     if (copy_from_user(&buffer[USBTMC_HEADER_SIZE], buf, transfersize)) {
1589         retval = -EFAULT;
1590         up(&file_data->limit_write_sem);
1591         goto exit;
1592     }
1593 
1594     dev_dbg(&data->intf->dev, "%s(size:%u align:%u)\n", __func__,
1595         (unsigned int)transfersize, (unsigned int)aligned);
1596 
1597     print_hex_dump_debug("usbtmc ", DUMP_PREFIX_NONE,
1598                  16, 1, buffer, aligned, true);
1599 
1600     usb_fill_bulk_urb(urb, data->usb_dev,
1601         usb_sndbulkpipe(data->usb_dev, data->bulk_out),
1602         urb->transfer_buffer, aligned,
1603         usbtmc_write_bulk_cb, file_data);
1604 
1605     usb_anchor_urb(urb, &file_data->submitted);
1606     retval = usb_submit_urb(urb, GFP_KERNEL);
1607     if (unlikely(retval)) {
1608         usb_unanchor_urb(urb);
1609         up(&file_data->limit_write_sem);
1610         goto exit;
1611     }
1612 
1613     remaining -= transfersize;
1614 
1615     data->bTag_last_write = data->bTag;
1616     data->bTag++;
1617 
1618     if (!data->bTag)
1619         data->bTag++;
1620 
1621     /* call generic_write even when remaining = 0 */
1622     retval = usbtmc_generic_write(file_data, buf + transfersize, remaining,
1623                       &done, USBTMC_FLAG_APPEND);
1624     /* truncate alignment bytes */
1625     if (done > remaining)
1626         done = remaining;
1627 
1628     /*add size of first urb*/
1629     done += transfersize;
1630 
1631     if (retval < 0) {
1632         usb_kill_anchored_urbs(&file_data->submitted);
1633 
1634         dev_err(&data->intf->dev,
1635             "Unable to send data, error %d\n", (int)retval);
1636         if (file_data->auto_abort)
1637             usbtmc_ioctl_abort_bulk_out(data);
1638         goto exit;
1639     }
1640 
1641     retval = done;
1642 exit:
1643     usb_free_urb(urb);
1644     mutex_unlock(&data->io_mutex);
1645     return retval;
1646 }
1647 
1648 static int usbtmc_ioctl_clear(struct usbtmc_device_data *data)
1649 {
1650     struct device *dev;
1651     u8 *buffer;
1652     int rv;
1653     int n;
1654     int actual = 0;
1655 
1656     dev = &data->intf->dev;
1657 
1658     dev_dbg(dev, "Sending INITIATE_CLEAR request\n");
1659 
1660     buffer = kmalloc(USBTMC_BUFSIZE, GFP_KERNEL);
1661     if (!buffer)
1662         return -ENOMEM;
1663 
1664     rv = usb_control_msg(data->usb_dev,
1665                  usb_rcvctrlpipe(data->usb_dev, 0),
1666                  USBTMC_REQUEST_INITIATE_CLEAR,
1667                  USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
1668                  0, 0, buffer, 1, USB_CTRL_GET_TIMEOUT);
1669     if (rv < 0) {
1670         dev_err(dev, "usb_control_msg returned %d\n", rv);
1671         goto exit;
1672     }
1673 
1674     dev_dbg(dev, "INITIATE_CLEAR returned %x\n", buffer[0]);
1675 
1676     if (buffer[0] != USBTMC_STATUS_SUCCESS) {
1677         dev_err(dev, "INITIATE_CLEAR returned %x\n", buffer[0]);
1678         rv = -EPERM;
1679         goto exit;
1680     }
1681 
1682     n = 0;
1683 
1684 usbtmc_clear_check_status:
1685 
1686     dev_dbg(dev, "Sending CHECK_CLEAR_STATUS request\n");
1687 
1688     rv = usb_control_msg(data->usb_dev,
1689                  usb_rcvctrlpipe(data->usb_dev, 0),
1690                  USBTMC_REQUEST_CHECK_CLEAR_STATUS,
1691                  USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
1692                  0, 0, buffer, 2, USB_CTRL_GET_TIMEOUT);
1693     if (rv < 0) {
1694         dev_err(dev, "usb_control_msg returned %d\n", rv);
1695         goto exit;
1696     }
1697 
1698     dev_dbg(dev, "CHECK_CLEAR_STATUS returned %x\n", buffer[0]);
1699 
1700     if (buffer[0] == USBTMC_STATUS_SUCCESS)
1701         goto usbtmc_clear_bulk_out_halt;
1702 
1703     if (buffer[0] != USBTMC_STATUS_PENDING) {
1704         dev_err(dev, "CHECK_CLEAR_STATUS returned %x\n", buffer[0]);
1705         rv = -EPERM;
1706         goto exit;
1707     }
1708 
1709     if ((buffer[1] & 1) != 0) {
1710         do {
1711             dev_dbg(dev, "Reading from bulk in EP\n");
1712 
1713             actual = 0;
1714             rv = usb_bulk_msg(data->usb_dev,
1715                       usb_rcvbulkpipe(data->usb_dev,
1716                               data->bulk_in),
1717                       buffer, USBTMC_BUFSIZE,
1718                       &actual, USB_CTRL_GET_TIMEOUT);
1719 
1720             print_hex_dump_debug("usbtmc ", DUMP_PREFIX_NONE,
1721                          16, 1, buffer, actual, true);
1722 
1723             n++;
1724 
1725             if (rv < 0) {
1726                 dev_err(dev, "usb_control_msg returned %d\n",
1727                     rv);
1728                 goto exit;
1729             }
1730         } while ((actual == USBTMC_BUFSIZE) &&
1731               (n < USBTMC_MAX_READS_TO_CLEAR_BULK_IN));
1732     } else {
1733         /* do not stress device with subsequent requests */
1734         msleep(50);
1735         n++;
1736     }
1737 
1738     if (n >= USBTMC_MAX_READS_TO_CLEAR_BULK_IN) {
1739         dev_err(dev, "Couldn't clear device buffer within %d cycles\n",
1740             USBTMC_MAX_READS_TO_CLEAR_BULK_IN);
1741         rv = -EPERM;
1742         goto exit;
1743     }
1744 
1745     goto usbtmc_clear_check_status;
1746 
1747 usbtmc_clear_bulk_out_halt:
1748 
1749     rv = usb_clear_halt(data->usb_dev,
1750                 usb_sndbulkpipe(data->usb_dev, data->bulk_out));
1751     if (rv < 0) {
1752         dev_err(dev, "usb_clear_halt returned %d\n", rv);
1753         goto exit;
1754     }
1755     rv = 0;
1756 
1757 exit:
1758     kfree(buffer);
1759     return rv;
1760 }
1761 
1762 static int usbtmc_ioctl_clear_out_halt(struct usbtmc_device_data *data)
1763 {
1764     int rv;
1765 
1766     rv = usb_clear_halt(data->usb_dev,
1767                 usb_sndbulkpipe(data->usb_dev, data->bulk_out));
1768 
1769     if (rv < 0)
1770         dev_err(&data->usb_dev->dev, "%s returned %d\n", __func__, rv);
1771     return rv;
1772 }
1773 
1774 static int usbtmc_ioctl_clear_in_halt(struct usbtmc_device_data *data)
1775 {
1776     int rv;
1777 
1778     rv = usb_clear_halt(data->usb_dev,
1779                 usb_rcvbulkpipe(data->usb_dev, data->bulk_in));
1780 
1781     if (rv < 0)
1782         dev_err(&data->usb_dev->dev, "%s returned %d\n", __func__, rv);
1783     return rv;
1784 }
1785 
1786 static int usbtmc_ioctl_cancel_io(struct usbtmc_file_data *file_data)
1787 {
1788     spin_lock_irq(&file_data->err_lock);
1789     file_data->in_status = -ECANCELED;
1790     file_data->out_status = -ECANCELED;
1791     spin_unlock_irq(&file_data->err_lock);
1792     usb_kill_anchored_urbs(&file_data->submitted);
1793     return 0;
1794 }
1795 
1796 static int usbtmc_ioctl_cleanup_io(struct usbtmc_file_data *file_data)
1797 {
1798     usb_kill_anchored_urbs(&file_data->submitted);
1799     usb_scuttle_anchored_urbs(&file_data->in_anchor);
1800     spin_lock_irq(&file_data->err_lock);
1801     file_data->in_status = 0;
1802     file_data->in_transfer_size = 0;
1803     file_data->out_status = 0;
1804     file_data->out_transfer_size = 0;
1805     spin_unlock_irq(&file_data->err_lock);
1806 
1807     file_data->in_urbs_used = 0;
1808     return 0;
1809 }
1810 
1811 static int get_capabilities(struct usbtmc_device_data *data)
1812 {
1813     struct device *dev = &data->usb_dev->dev;
1814     char *buffer;
1815     int rv = 0;
1816 
1817     buffer = kmalloc(0x18, GFP_KERNEL);
1818     if (!buffer)
1819         return -ENOMEM;
1820 
1821     rv = usb_control_msg(data->usb_dev, usb_rcvctrlpipe(data->usb_dev, 0),
1822                  USBTMC_REQUEST_GET_CAPABILITIES,
1823                  USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
1824                  0, 0, buffer, 0x18, USB_CTRL_GET_TIMEOUT);
1825     if (rv < 0) {
1826         dev_err(dev, "usb_control_msg returned %d\n", rv);
1827         goto err_out;
1828     }
1829 
1830     dev_dbg(dev, "GET_CAPABILITIES returned %x\n", buffer[0]);
1831     if (buffer[0] != USBTMC_STATUS_SUCCESS) {
1832         dev_err(dev, "GET_CAPABILITIES returned %x\n", buffer[0]);
1833         rv = -EPERM;
1834         goto err_out;
1835     }
1836     dev_dbg(dev, "Interface capabilities are %x\n", buffer[4]);
1837     dev_dbg(dev, "Device capabilities are %x\n", buffer[5]);
1838     dev_dbg(dev, "USB488 interface capabilities are %x\n", buffer[14]);
1839     dev_dbg(dev, "USB488 device capabilities are %x\n", buffer[15]);
1840 
1841     data->capabilities.interface_capabilities = buffer[4];
1842     data->capabilities.device_capabilities = buffer[5];
1843     data->capabilities.usb488_interface_capabilities = buffer[14];
1844     data->capabilities.usb488_device_capabilities = buffer[15];
1845     data->usb488_caps = (buffer[14] & 0x07) | ((buffer[15] & 0x0f) << 4);
1846     rv = 0;
1847 
1848 err_out:
1849     kfree(buffer);
1850     return rv;
1851 }
1852 
1853 #define capability_attribute(name)                  \
1854 static ssize_t name##_show(struct device *dev,              \
1855                struct device_attribute *attr, char *buf)    \
1856 {                                   \
1857     struct usb_interface *intf = to_usb_interface(dev);     \
1858     struct usbtmc_device_data *data = usb_get_intfdata(intf);   \
1859                                     \
1860     return sprintf(buf, "%d\n", data->capabilities.name);       \
1861 }                                   \
1862 static DEVICE_ATTR_RO(name)
1863 
1864 capability_attribute(interface_capabilities);
1865 capability_attribute(device_capabilities);
1866 capability_attribute(usb488_interface_capabilities);
1867 capability_attribute(usb488_device_capabilities);
1868 
1869 static struct attribute *usbtmc_attrs[] = {
1870     &dev_attr_interface_capabilities.attr,
1871     &dev_attr_device_capabilities.attr,
1872     &dev_attr_usb488_interface_capabilities.attr,
1873     &dev_attr_usb488_device_capabilities.attr,
1874     NULL,
1875 };
1876 ATTRIBUTE_GROUPS(usbtmc);
1877 
1878 static int usbtmc_ioctl_indicator_pulse(struct usbtmc_device_data *data)
1879 {
1880     struct device *dev;
1881     u8 *buffer;
1882     int rv;
1883 
1884     dev = &data->intf->dev;
1885 
1886     buffer = kmalloc(2, GFP_KERNEL);
1887     if (!buffer)
1888         return -ENOMEM;
1889 
1890     rv = usb_control_msg(data->usb_dev,
1891                  usb_rcvctrlpipe(data->usb_dev, 0),
1892                  USBTMC_REQUEST_INDICATOR_PULSE,
1893                  USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
1894                  0, 0, buffer, 0x01, USB_CTRL_GET_TIMEOUT);
1895 
1896     if (rv < 0) {
1897         dev_err(dev, "usb_control_msg returned %d\n", rv);
1898         goto exit;
1899     }
1900 
1901     dev_dbg(dev, "INDICATOR_PULSE returned %x\n", buffer[0]);
1902 
1903     if (buffer[0] != USBTMC_STATUS_SUCCESS) {
1904         dev_err(dev, "INDICATOR_PULSE returned %x\n", buffer[0]);
1905         rv = -EPERM;
1906         goto exit;
1907     }
1908     rv = 0;
1909 
1910 exit:
1911     kfree(buffer);
1912     return rv;
1913 }
1914 
1915 static int usbtmc_ioctl_request(struct usbtmc_device_data *data,
1916                 void __user *arg)
1917 {
1918     struct device *dev = &data->intf->dev;
1919     struct usbtmc_ctrlrequest request;
1920     u8 *buffer = NULL;
1921     int rv;
1922     unsigned int is_in, pipe;
1923     unsigned long res;
1924 
1925     res = copy_from_user(&request, arg, sizeof(struct usbtmc_ctrlrequest));
1926     if (res)
1927         return -EFAULT;
1928 
1929     if (request.req.wLength > USBTMC_BUFSIZE)
1930         return -EMSGSIZE;
1931 
1932     is_in = request.req.bRequestType & USB_DIR_IN;
1933 
1934     if (request.req.wLength) {
1935         buffer = kmalloc(request.req.wLength, GFP_KERNEL);
1936         if (!buffer)
1937             return -ENOMEM;
1938 
1939         if (!is_in) {
1940             /* Send control data to device */
1941             res = copy_from_user(buffer, request.data,
1942                          request.req.wLength);
1943             if (res) {
1944                 rv = -EFAULT;
1945                 goto exit;
1946             }
1947         }
1948     }
1949 
1950     if (is_in)
1951         pipe = usb_rcvctrlpipe(data->usb_dev, 0);
1952     else
1953         pipe = usb_sndctrlpipe(data->usb_dev, 0);
1954     rv = usb_control_msg(data->usb_dev,
1955             pipe,
1956             request.req.bRequest,
1957             request.req.bRequestType,
1958             request.req.wValue,
1959             request.req.wIndex,
1960             buffer, request.req.wLength, USB_CTRL_GET_TIMEOUT);
1961 
1962     if (rv < 0) {
1963         dev_err(dev, "%s failed %d\n", __func__, rv);
1964         goto exit;
1965     }
1966 
1967     if (rv && is_in) {
1968         /* Read control data from device */
1969         res = copy_to_user(request.data, buffer, rv);
1970         if (res)
1971             rv = -EFAULT;
1972     }
1973 
1974  exit:
1975     kfree(buffer);
1976     return rv;
1977 }
1978 
1979 /*
1980  * Get the usb timeout value
1981  */
1982 static int usbtmc_ioctl_get_timeout(struct usbtmc_file_data *file_data,
1983                 void __user *arg)
1984 {
1985     u32 timeout;
1986 
1987     timeout = file_data->timeout;
1988 
1989     return put_user(timeout, (__u32 __user *)arg);
1990 }
1991 
1992 /*
1993  * Set the usb timeout value
1994  */
1995 static int usbtmc_ioctl_set_timeout(struct usbtmc_file_data *file_data,
1996                 void __user *arg)
1997 {
1998     u32 timeout;
1999 
2000     if (get_user(timeout, (__u32 __user *)arg))
2001         return -EFAULT;
2002 
2003     /* Note that timeout = 0 means
2004      * MAX_SCHEDULE_TIMEOUT in usb_control_msg
2005      */
2006     if (timeout < USBTMC_MIN_TIMEOUT)
2007         return -EINVAL;
2008 
2009     file_data->timeout = timeout;
2010 
2011     return 0;
2012 }
2013 
2014 /*
2015  * enables/disables sending EOM on write
2016  */
2017 static int usbtmc_ioctl_eom_enable(struct usbtmc_file_data *file_data,
2018                 void __user *arg)
2019 {
2020     u8 eom_enable;
2021 
2022     if (copy_from_user(&eom_enable, arg, sizeof(eom_enable)))
2023         return -EFAULT;
2024 
2025     if (eom_enable > 1)
2026         return -EINVAL;
2027 
2028     file_data->eom_val = eom_enable;
2029 
2030     return 0;
2031 }
2032 
2033 /*
2034  * Configure termination character for read()
2035  */
2036 static int usbtmc_ioctl_config_termc(struct usbtmc_file_data *file_data,
2037                 void __user *arg)
2038 {
2039     struct usbtmc_termchar termc;
2040 
2041     if (copy_from_user(&termc, arg, sizeof(termc)))
2042         return -EFAULT;
2043 
2044     if ((termc.term_char_enabled > 1) ||
2045         (termc.term_char_enabled &&
2046         !(file_data->data->capabilities.device_capabilities & 1)))
2047         return -EINVAL;
2048 
2049     file_data->term_char = termc.term_char;
2050     file_data->term_char_enabled = termc.term_char_enabled;
2051 
2052     return 0;
2053 }
2054 
2055 static long usbtmc_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2056 {
2057     struct usbtmc_file_data *file_data;
2058     struct usbtmc_device_data *data;
2059     int retval = -EBADRQC;
2060     __u8 tmp_byte;
2061 
2062     file_data = file->private_data;
2063     data = file_data->data;
2064 
2065     mutex_lock(&data->io_mutex);
2066     if (data->zombie) {
2067         retval = -ENODEV;
2068         goto skip_io_on_zombie;
2069     }
2070 
2071     switch (cmd) {
2072     case USBTMC_IOCTL_CLEAR_OUT_HALT:
2073         retval = usbtmc_ioctl_clear_out_halt(data);
2074         break;
2075 
2076     case USBTMC_IOCTL_CLEAR_IN_HALT:
2077         retval = usbtmc_ioctl_clear_in_halt(data);
2078         break;
2079 
2080     case USBTMC_IOCTL_INDICATOR_PULSE:
2081         retval = usbtmc_ioctl_indicator_pulse(data);
2082         break;
2083 
2084     case USBTMC_IOCTL_CLEAR:
2085         retval = usbtmc_ioctl_clear(data);
2086         break;
2087 
2088     case USBTMC_IOCTL_ABORT_BULK_OUT:
2089         retval = usbtmc_ioctl_abort_bulk_out(data);
2090         break;
2091 
2092     case USBTMC_IOCTL_ABORT_BULK_IN:
2093         retval = usbtmc_ioctl_abort_bulk_in(data);
2094         break;
2095 
2096     case USBTMC_IOCTL_CTRL_REQUEST:
2097         retval = usbtmc_ioctl_request(data, (void __user *)arg);
2098         break;
2099 
2100     case USBTMC_IOCTL_GET_TIMEOUT:
2101         retval = usbtmc_ioctl_get_timeout(file_data,
2102                           (void __user *)arg);
2103         break;
2104 
2105     case USBTMC_IOCTL_SET_TIMEOUT:
2106         retval = usbtmc_ioctl_set_timeout(file_data,
2107                           (void __user *)arg);
2108         break;
2109 
2110     case USBTMC_IOCTL_EOM_ENABLE:
2111         retval = usbtmc_ioctl_eom_enable(file_data,
2112                          (void __user *)arg);
2113         break;
2114 
2115     case USBTMC_IOCTL_CONFIG_TERMCHAR:
2116         retval = usbtmc_ioctl_config_termc(file_data,
2117                            (void __user *)arg);
2118         break;
2119 
2120     case USBTMC_IOCTL_WRITE:
2121         retval = usbtmc_ioctl_generic_write(file_data,
2122                             (void __user *)arg);
2123         break;
2124 
2125     case USBTMC_IOCTL_READ:
2126         retval = usbtmc_ioctl_generic_read(file_data,
2127                            (void __user *)arg);
2128         break;
2129 
2130     case USBTMC_IOCTL_WRITE_RESULT:
2131         retval = usbtmc_ioctl_write_result(file_data,
2132                            (void __user *)arg);
2133         break;
2134 
2135     case USBTMC_IOCTL_API_VERSION:
2136         retval = put_user(USBTMC_API_VERSION,
2137                   (__u32 __user *)arg);
2138         break;
2139 
2140     case USBTMC488_IOCTL_GET_CAPS:
2141         retval = put_user(data->usb488_caps,
2142                   (unsigned char __user *)arg);
2143         break;
2144 
2145     case USBTMC488_IOCTL_READ_STB:
2146         retval = usbtmc488_ioctl_read_stb(file_data,
2147                           (void __user *)arg);
2148         break;
2149 
2150     case USBTMC488_IOCTL_REN_CONTROL:
2151         retval = usbtmc488_ioctl_simple(data, (void __user *)arg,
2152                         USBTMC488_REQUEST_REN_CONTROL);
2153         break;
2154 
2155     case USBTMC488_IOCTL_GOTO_LOCAL:
2156         retval = usbtmc488_ioctl_simple(data, (void __user *)arg,
2157                         USBTMC488_REQUEST_GOTO_LOCAL);
2158         break;
2159 
2160     case USBTMC488_IOCTL_LOCAL_LOCKOUT:
2161         retval = usbtmc488_ioctl_simple(data, (void __user *)arg,
2162                         USBTMC488_REQUEST_LOCAL_LOCKOUT);
2163         break;
2164 
2165     case USBTMC488_IOCTL_TRIGGER:
2166         retval = usbtmc488_ioctl_trigger(file_data);
2167         break;
2168 
2169     case USBTMC488_IOCTL_WAIT_SRQ:
2170         retval = usbtmc488_ioctl_wait_srq(file_data,
2171                           (__u32 __user *)arg);
2172         break;
2173 
2174     case USBTMC_IOCTL_MSG_IN_ATTR:
2175         retval = put_user(file_data->bmTransferAttributes,
2176                   (__u8 __user *)arg);
2177         break;
2178 
2179     case USBTMC_IOCTL_AUTO_ABORT:
2180         retval = get_user(tmp_byte, (unsigned char __user *)arg);
2181         if (retval == 0)
2182             file_data->auto_abort = !!tmp_byte;
2183         break;
2184 
2185     case USBTMC_IOCTL_GET_STB:
2186         retval = usbtmc_get_stb(file_data, &tmp_byte);
2187         if (retval > 0)
2188             retval = put_user(tmp_byte, (__u8 __user *)arg);
2189         break;
2190 
2191     case USBTMC_IOCTL_GET_SRQ_STB:
2192         retval = usbtmc_ioctl_get_srq_stb(file_data,
2193                           (void __user *)arg);
2194         break;
2195 
2196     case USBTMC_IOCTL_CANCEL_IO:
2197         retval = usbtmc_ioctl_cancel_io(file_data);
2198         break;
2199 
2200     case USBTMC_IOCTL_CLEANUP_IO:
2201         retval = usbtmc_ioctl_cleanup_io(file_data);
2202         break;
2203     }
2204 
2205 skip_io_on_zombie:
2206     mutex_unlock(&data->io_mutex);
2207     return retval;
2208 }
2209 
2210 static int usbtmc_fasync(int fd, struct file *file, int on)
2211 {
2212     struct usbtmc_file_data *file_data = file->private_data;
2213 
2214     return fasync_helper(fd, file, on, &file_data->data->fasync);
2215 }
2216 
2217 static __poll_t usbtmc_poll(struct file *file, poll_table *wait)
2218 {
2219     struct usbtmc_file_data *file_data = file->private_data;
2220     struct usbtmc_device_data *data = file_data->data;
2221     __poll_t mask;
2222 
2223     mutex_lock(&data->io_mutex);
2224 
2225     if (data->zombie) {
2226         mask = EPOLLHUP | EPOLLERR;
2227         goto no_poll;
2228     }
2229 
2230     poll_wait(file, &data->waitq, wait);
2231 
2232     /* Note that EPOLLPRI is now assigned to SRQ, and
2233      * EPOLLIN|EPOLLRDNORM to normal read data.
2234      */
2235     mask = 0;
2236     if (atomic_read(&file_data->srq_asserted))
2237         mask |= EPOLLPRI;
2238 
2239     /* Note that the anchor submitted includes all urbs for BULK IN
2240      * and OUT. So EPOLLOUT is signaled when BULK OUT is empty and
2241      * all BULK IN urbs are completed and moved to in_anchor.
2242      */
2243     if (usb_anchor_empty(&file_data->submitted))
2244         mask |= (EPOLLOUT | EPOLLWRNORM);
2245     if (!usb_anchor_empty(&file_data->in_anchor))
2246         mask |= (EPOLLIN | EPOLLRDNORM);
2247 
2248     spin_lock_irq(&file_data->err_lock);
2249     if (file_data->in_status || file_data->out_status)
2250         mask |= EPOLLERR;
2251     spin_unlock_irq(&file_data->err_lock);
2252 
2253     dev_dbg(&data->intf->dev, "poll mask = %x\n", mask);
2254 
2255 no_poll:
2256     mutex_unlock(&data->io_mutex);
2257     return mask;
2258 }
2259 
2260 static const struct file_operations fops = {
2261     .owner      = THIS_MODULE,
2262     .read       = usbtmc_read,
2263     .write      = usbtmc_write,
2264     .open       = usbtmc_open,
2265     .release    = usbtmc_release,
2266     .flush      = usbtmc_flush,
2267     .unlocked_ioctl = usbtmc_ioctl,
2268     .compat_ioctl   = compat_ptr_ioctl,
2269     .fasync         = usbtmc_fasync,
2270     .poll           = usbtmc_poll,
2271     .llseek     = default_llseek,
2272 };
2273 
2274 static struct usb_class_driver usbtmc_class = {
2275     .name =     "usbtmc%d",
2276     .fops =     &fops,
2277     .minor_base =   USBTMC_MINOR_BASE,
2278 };
2279 
2280 static void usbtmc_interrupt(struct urb *urb)
2281 {
2282     struct usbtmc_device_data *data = urb->context;
2283     struct device *dev = &data->intf->dev;
2284     int status = urb->status;
2285     int rv;
2286 
2287     dev_dbg(&data->intf->dev, "int status: %d len %d\n",
2288         status, urb->actual_length);
2289 
2290     switch (status) {
2291     case 0: /* SUCCESS */
2292         /* check for valid STB notification */
2293         if (data->iin_buffer[0] > 0x81) {
2294             data->bNotify1 = data->iin_buffer[0];
2295             data->bNotify2 = data->iin_buffer[1];
2296             atomic_set(&data->iin_data_valid, 1);
2297             wake_up_interruptible(&data->waitq);
2298             goto exit;
2299         }
2300         /* check for SRQ notification */
2301         if (data->iin_buffer[0] == 0x81) {
2302             unsigned long flags;
2303             struct list_head *elem;
2304 
2305             if (data->fasync)
2306                 kill_fasync(&data->fasync,
2307                     SIGIO, POLL_PRI);
2308 
2309             spin_lock_irqsave(&data->dev_lock, flags);
2310             list_for_each(elem, &data->file_list) {
2311                 struct usbtmc_file_data *file_data;
2312 
2313                 file_data = list_entry(elem,
2314                                struct usbtmc_file_data,
2315                                file_elem);
2316                 file_data->srq_byte = data->iin_buffer[1];
2317                 atomic_set(&file_data->srq_asserted, 1);
2318             }
2319             spin_unlock_irqrestore(&data->dev_lock, flags);
2320 
2321             dev_dbg(dev, "srq received bTag %x stb %x\n",
2322                 (unsigned int)data->iin_buffer[0],
2323                 (unsigned int)data->iin_buffer[1]);
2324             wake_up_interruptible_all(&data->waitq);
2325             goto exit;
2326         }
2327         dev_warn(dev, "invalid notification: %x\n",
2328              data->iin_buffer[0]);
2329         break;
2330     case -EOVERFLOW:
2331         dev_err(dev, "overflow with length %d, actual length is %d\n",
2332             data->iin_wMaxPacketSize, urb->actual_length);
2333         fallthrough;
2334     default:
2335         /* urb terminated, clean up */
2336         dev_dbg(dev, "urb terminated, status: %d\n", status);
2337         return;
2338     }
2339 exit:
2340     rv = usb_submit_urb(urb, GFP_ATOMIC);
2341     if (rv)
2342         dev_err(dev, "usb_submit_urb failed: %d\n", rv);
2343 }
2344 
2345 static void usbtmc_free_int(struct usbtmc_device_data *data)
2346 {
2347     if (!data->iin_ep_present || !data->iin_urb)
2348         return;
2349     usb_kill_urb(data->iin_urb);
2350     kfree(data->iin_buffer);
2351     data->iin_buffer = NULL;
2352     usb_free_urb(data->iin_urb);
2353     data->iin_urb = NULL;
2354     kref_put(&data->kref, usbtmc_delete);
2355 }
2356 
2357 static int usbtmc_probe(struct usb_interface *intf,
2358             const struct usb_device_id *id)
2359 {
2360     struct usbtmc_device_data *data;
2361     struct usb_host_interface *iface_desc;
2362     struct usb_endpoint_descriptor *bulk_in, *bulk_out, *int_in;
2363     int retcode;
2364 
2365     dev_dbg(&intf->dev, "%s called\n", __func__);
2366 
2367     data = kzalloc(sizeof(*data), GFP_KERNEL);
2368     if (!data)
2369         return -ENOMEM;
2370 
2371     data->intf = intf;
2372     data->id = id;
2373     data->usb_dev = usb_get_dev(interface_to_usbdev(intf));
2374     usb_set_intfdata(intf, data);
2375     kref_init(&data->kref);
2376     mutex_init(&data->io_mutex);
2377     init_waitqueue_head(&data->waitq);
2378     atomic_set(&data->iin_data_valid, 0);
2379     INIT_LIST_HEAD(&data->file_list);
2380     spin_lock_init(&data->dev_lock);
2381 
2382     data->zombie = 0;
2383 
2384     /* Initialize USBTMC bTag and other fields */
2385     data->bTag  = 1;
2386     /*  2 <= bTag <= 127   USBTMC-USB488 subclass specification 4.3.1 */
2387     data->iin_bTag = 2;
2388 
2389     /* USBTMC devices have only one setting, so use that */
2390     iface_desc = data->intf->cur_altsetting;
2391     data->ifnum = iface_desc->desc.bInterfaceNumber;
2392 
2393     /* Find bulk endpoints */
2394     retcode = usb_find_common_endpoints(iface_desc,
2395             &bulk_in, &bulk_out, NULL, NULL);
2396     if (retcode) {
2397         dev_err(&intf->dev, "bulk endpoints not found\n");
2398         goto err_put;
2399     }
2400 
2401     retcode = -EINVAL;
2402     data->bulk_in = bulk_in->bEndpointAddress;
2403     data->wMaxPacketSize = usb_endpoint_maxp(bulk_in);
2404     if (!data->wMaxPacketSize)
2405         goto err_put;
2406     dev_dbg(&intf->dev, "Found bulk in endpoint at %u\n", data->bulk_in);
2407 
2408     data->bulk_out = bulk_out->bEndpointAddress;
2409     dev_dbg(&intf->dev, "Found Bulk out endpoint at %u\n", data->bulk_out);
2410 
2411     /* Find int endpoint */
2412     retcode = usb_find_int_in_endpoint(iface_desc, &int_in);
2413     if (!retcode) {
2414         data->iin_ep_present = 1;
2415         data->iin_ep = int_in->bEndpointAddress;
2416         data->iin_wMaxPacketSize = usb_endpoint_maxp(int_in);
2417         data->iin_interval = int_in->bInterval;
2418         dev_dbg(&intf->dev, "Found Int in endpoint at %u\n",
2419                 data->iin_ep);
2420     }
2421 
2422     retcode = get_capabilities(data);
2423     if (retcode)
2424         dev_err(&intf->dev, "can't read capabilities\n");
2425 
2426     if (data->iin_ep_present) {
2427         /* allocate int urb */
2428         data->iin_urb = usb_alloc_urb(0, GFP_KERNEL);
2429         if (!data->iin_urb) {
2430             retcode = -ENOMEM;
2431             goto error_register;
2432         }
2433 
2434         /* Protect interrupt in endpoint data until iin_urb is freed */
2435         kref_get(&data->kref);
2436 
2437         /* allocate buffer for interrupt in */
2438         data->iin_buffer = kmalloc(data->iin_wMaxPacketSize,
2439                     GFP_KERNEL);
2440         if (!data->iin_buffer) {
2441             retcode = -ENOMEM;
2442             goto error_register;
2443         }
2444 
2445         /* fill interrupt urb */
2446         usb_fill_int_urb(data->iin_urb, data->usb_dev,
2447                 usb_rcvintpipe(data->usb_dev, data->iin_ep),
2448                 data->iin_buffer, data->iin_wMaxPacketSize,
2449                 usbtmc_interrupt,
2450                 data, data->iin_interval);
2451 
2452         retcode = usb_submit_urb(data->iin_urb, GFP_KERNEL);
2453         if (retcode) {
2454             dev_err(&intf->dev, "Failed to submit iin_urb\n");
2455             goto error_register;
2456         }
2457     }
2458 
2459     retcode = usb_register_dev(intf, &usbtmc_class);
2460     if (retcode) {
2461         dev_err(&intf->dev, "Not able to get a minor (base %u, slice default): %d\n",
2462             USBTMC_MINOR_BASE,
2463             retcode);
2464         goto error_register;
2465     }
2466     dev_dbg(&intf->dev, "Using minor number %d\n", intf->minor);
2467 
2468     return 0;
2469 
2470 error_register:
2471     usbtmc_free_int(data);
2472 err_put:
2473     kref_put(&data->kref, usbtmc_delete);
2474     return retcode;
2475 }
2476 
2477 static void usbtmc_disconnect(struct usb_interface *intf)
2478 {
2479     struct usbtmc_device_data *data  = usb_get_intfdata(intf);
2480     struct list_head *elem;
2481 
2482     usb_deregister_dev(intf, &usbtmc_class);
2483     mutex_lock(&data->io_mutex);
2484     data->zombie = 1;
2485     wake_up_interruptible_all(&data->waitq);
2486     list_for_each(elem, &data->file_list) {
2487         struct usbtmc_file_data *file_data;
2488 
2489         file_data = list_entry(elem,
2490                        struct usbtmc_file_data,
2491                        file_elem);
2492         usb_kill_anchored_urbs(&file_data->submitted);
2493         usb_scuttle_anchored_urbs(&file_data->in_anchor);
2494     }
2495     mutex_unlock(&data->io_mutex);
2496     usbtmc_free_int(data);
2497     kref_put(&data->kref, usbtmc_delete);
2498 }
2499 
2500 static void usbtmc_draw_down(struct usbtmc_file_data *file_data)
2501 {
2502     int time;
2503 
2504     time = usb_wait_anchor_empty_timeout(&file_data->submitted, 1000);
2505     if (!time)
2506         usb_kill_anchored_urbs(&file_data->submitted);
2507     usb_scuttle_anchored_urbs(&file_data->in_anchor);
2508 }
2509 
2510 static int usbtmc_suspend(struct usb_interface *intf, pm_message_t message)
2511 {
2512     struct usbtmc_device_data *data = usb_get_intfdata(intf);
2513     struct list_head *elem;
2514 
2515     if (!data)
2516         return 0;
2517 
2518     mutex_lock(&data->io_mutex);
2519     list_for_each(elem, &data->file_list) {
2520         struct usbtmc_file_data *file_data;
2521 
2522         file_data = list_entry(elem,
2523                        struct usbtmc_file_data,
2524                        file_elem);
2525         usbtmc_draw_down(file_data);
2526     }
2527 
2528     if (data->iin_ep_present && data->iin_urb)
2529         usb_kill_urb(data->iin_urb);
2530 
2531     mutex_unlock(&data->io_mutex);
2532     return 0;
2533 }
2534 
2535 static int usbtmc_resume(struct usb_interface *intf)
2536 {
2537     struct usbtmc_device_data *data = usb_get_intfdata(intf);
2538     int retcode = 0;
2539 
2540     if (data->iin_ep_present && data->iin_urb)
2541         retcode = usb_submit_urb(data->iin_urb, GFP_KERNEL);
2542     if (retcode)
2543         dev_err(&intf->dev, "Failed to submit iin_urb\n");
2544 
2545     return retcode;
2546 }
2547 
2548 static int usbtmc_pre_reset(struct usb_interface *intf)
2549 {
2550     struct usbtmc_device_data *data  = usb_get_intfdata(intf);
2551     struct list_head *elem;
2552 
2553     if (!data)
2554         return 0;
2555 
2556     mutex_lock(&data->io_mutex);
2557 
2558     list_for_each(elem, &data->file_list) {
2559         struct usbtmc_file_data *file_data;
2560 
2561         file_data = list_entry(elem,
2562                        struct usbtmc_file_data,
2563                        file_elem);
2564         usbtmc_ioctl_cancel_io(file_data);
2565     }
2566 
2567     return 0;
2568 }
2569 
2570 static int usbtmc_post_reset(struct usb_interface *intf)
2571 {
2572     struct usbtmc_device_data *data  = usb_get_intfdata(intf);
2573 
2574     mutex_unlock(&data->io_mutex);
2575 
2576     return 0;
2577 }
2578 
2579 static struct usb_driver usbtmc_driver = {
2580     .name       = "usbtmc",
2581     .id_table   = usbtmc_devices,
2582     .probe      = usbtmc_probe,
2583     .disconnect = usbtmc_disconnect,
2584     .suspend    = usbtmc_suspend,
2585     .resume     = usbtmc_resume,
2586     .pre_reset  = usbtmc_pre_reset,
2587     .post_reset = usbtmc_post_reset,
2588     .dev_groups = usbtmc_groups,
2589 };
2590 
2591 module_usb_driver(usbtmc_driver);
2592 
2593 MODULE_LICENSE("GPL");
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!