xref: /openbmc/linux/drivers/usb/class/usbtmc.c (revision 82e6fdd6)
1 // SPDX-License-Identifier: GPL-2.0+
2 /**
3  * drivers/usb/class/usbtmc.c - USB Test & Measurement class driver
4  *
5  * Copyright (C) 2007 Stefan Kopp, Gechingen, Germany
6  * Copyright (C) 2008 Novell, Inc.
7  * Copyright (C) 2008 Greg Kroah-Hartman <gregkh@suse.de>
8  */
9 
10 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11 
12 #include <linux/module.h>
13 #include <linux/kernel.h>
14 #include <linux/fs.h>
15 #include <linux/uaccess.h>
16 #include <linux/kref.h>
17 #include <linux/slab.h>
18 #include <linux/poll.h>
19 #include <linux/mutex.h>
20 #include <linux/usb.h>
21 #include <linux/usb/tmc.h>
22 
23 
24 #define RIGOL			1
25 #define USBTMC_HEADER_SIZE	12
26 #define USBTMC_MINOR_BASE	176
27 
28 /*
29  * Size of driver internal IO buffer. Must be multiple of 4 and at least as
30  * large as wMaxPacketSize (which is usually 512 bytes).
31  */
32 #define USBTMC_SIZE_IOBUFFER	2048
33 
34 /* Default USB timeout (in milliseconds) */
35 #define USBTMC_TIMEOUT		5000
36 
37 /*
38  * Maximum number of read cycles to empty bulk in endpoint during CLEAR and
39  * ABORT_BULK_IN requests. Ends the loop if (for whatever reason) a short
40  * packet is never read.
41  */
42 #define USBTMC_MAX_READS_TO_CLEAR_BULK_IN	100
43 
44 static const struct usb_device_id usbtmc_devices[] = {
45 	{ USB_INTERFACE_INFO(USB_CLASS_APP_SPEC, 3, 0), },
46 	{ USB_INTERFACE_INFO(USB_CLASS_APP_SPEC, 3, 1), },
47 	{ 0, } /* terminating entry */
48 };
49 MODULE_DEVICE_TABLE(usb, usbtmc_devices);
50 
51 /*
52  * This structure is the capabilities for the device
53  * See section 4.2.1.8 of the USBTMC specification,
54  * and section 4.2.2 of the USBTMC usb488 subclass
55  * specification for details.
56  */
57 struct usbtmc_dev_capabilities {
58 	__u8 interface_capabilities;
59 	__u8 device_capabilities;
60 	__u8 usb488_interface_capabilities;
61 	__u8 usb488_device_capabilities;
62 };
63 
64 /* This structure holds private data for each USBTMC device. One copy is
65  * allocated for each USBTMC device in the driver's probe function.
66  */
67 struct usbtmc_device_data {
68 	const struct usb_device_id *id;
69 	struct usb_device *usb_dev;
70 	struct usb_interface *intf;
71 
72 	unsigned int bulk_in;
73 	unsigned int bulk_out;
74 
75 	u8 bTag;
76 	u8 bTag_last_write;	/* needed for abort */
77 	u8 bTag_last_read;	/* needed for abort */
78 
79 	/* data for interrupt in endpoint handling */
80 	u8             bNotify1;
81 	u8             bNotify2;
82 	u16            ifnum;
83 	u8             iin_bTag;
84 	u8            *iin_buffer;
85 	atomic_t       iin_data_valid;
86 	unsigned int   iin_ep;
87 	int            iin_ep_present;
88 	int            iin_interval;
89 	struct urb    *iin_urb;
90 	u16            iin_wMaxPacketSize;
91 	atomic_t       srq_asserted;
92 
93 	/* coalesced usb488_caps from usbtmc_dev_capabilities */
94 	__u8 usb488_caps;
95 
96 	u8 rigol_quirk;
97 
98 	/* attributes from the USB TMC spec for this device */
99 	u8 TermChar;
100 	bool TermCharEnabled;
101 	bool auto_abort;
102 
103 	bool zombie; /* fd of disconnected device */
104 
105 	struct usbtmc_dev_capabilities	capabilities;
106 	struct kref kref;
107 	struct mutex io_mutex;	/* only one i/o function running at a time */
108 	wait_queue_head_t waitq;
109 	struct fasync_struct *fasync;
110 };
111 #define to_usbtmc_data(d) container_of(d, struct usbtmc_device_data, kref)
112 
113 struct usbtmc_ID_rigol_quirk {
114 	__u16 idVendor;
115 	__u16 idProduct;
116 };
117 
118 static const struct usbtmc_ID_rigol_quirk usbtmc_id_quirk[] = {
119 	{ 0x1ab1, 0x0588 },
120 	{ 0x1ab1, 0x04b0 },
121 	{ 0, 0 }
122 };
123 
124 /* Forward declarations */
125 static struct usb_driver usbtmc_driver;
126 
127 static void usbtmc_delete(struct kref *kref)
128 {
129 	struct usbtmc_device_data *data = to_usbtmc_data(kref);
130 
131 	usb_put_dev(data->usb_dev);
132 	kfree(data);
133 }
134 
135 static int usbtmc_open(struct inode *inode, struct file *filp)
136 {
137 	struct usb_interface *intf;
138 	struct usbtmc_device_data *data;
139 	int retval = 0;
140 
141 	intf = usb_find_interface(&usbtmc_driver, iminor(inode));
142 	if (!intf) {
143 		pr_err("can not find device for minor %d", iminor(inode));
144 		return -ENODEV;
145 	}
146 
147 	data = usb_get_intfdata(intf);
148 	/* Protect reference to data from file structure until release */
149 	kref_get(&data->kref);
150 
151 	/* Store pointer in file structure's private data field */
152 	filp->private_data = data;
153 
154 	return retval;
155 }
156 
157 static int usbtmc_release(struct inode *inode, struct file *file)
158 {
159 	struct usbtmc_device_data *data = file->private_data;
160 
161 	kref_put(&data->kref, usbtmc_delete);
162 	return 0;
163 }
164 
165 static int usbtmc_ioctl_abort_bulk_in(struct usbtmc_device_data *data)
166 {
167 	u8 *buffer;
168 	struct device *dev;
169 	int rv;
170 	int n;
171 	int actual;
172 	struct usb_host_interface *current_setting;
173 	int max_size;
174 
175 	dev = &data->intf->dev;
176 	buffer = kmalloc(USBTMC_SIZE_IOBUFFER, GFP_KERNEL);
177 	if (!buffer)
178 		return -ENOMEM;
179 
180 	rv = usb_control_msg(data->usb_dev,
181 			     usb_rcvctrlpipe(data->usb_dev, 0),
182 			     USBTMC_REQUEST_INITIATE_ABORT_BULK_IN,
183 			     USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT,
184 			     data->bTag_last_read, data->bulk_in,
185 			     buffer, 2, USBTMC_TIMEOUT);
186 
187 	if (rv < 0) {
188 		dev_err(dev, "usb_control_msg returned %d\n", rv);
189 		goto exit;
190 	}
191 
192 	dev_dbg(dev, "INITIATE_ABORT_BULK_IN returned %x\n", buffer[0]);
193 
194 	if (buffer[0] == USBTMC_STATUS_FAILED) {
195 		rv = 0;
196 		goto exit;
197 	}
198 
199 	if (buffer[0] != USBTMC_STATUS_SUCCESS) {
200 		dev_err(dev, "INITIATE_ABORT_BULK_IN returned %x\n",
201 			buffer[0]);
202 		rv = -EPERM;
203 		goto exit;
204 	}
205 
206 	max_size = 0;
207 	current_setting = data->intf->cur_altsetting;
208 	for (n = 0; n < current_setting->desc.bNumEndpoints; n++)
209 		if (current_setting->endpoint[n].desc.bEndpointAddress ==
210 			data->bulk_in)
211 			max_size = usb_endpoint_maxp(&current_setting->endpoint[n].desc);
212 
213 	if (max_size == 0) {
214 		dev_err(dev, "Couldn't get wMaxPacketSize\n");
215 		rv = -EPERM;
216 		goto exit;
217 	}
218 
219 	dev_dbg(&data->intf->dev, "wMaxPacketSize is %d\n", max_size);
220 
221 	n = 0;
222 
223 	do {
224 		dev_dbg(dev, "Reading from bulk in EP\n");
225 
226 		rv = usb_bulk_msg(data->usb_dev,
227 				  usb_rcvbulkpipe(data->usb_dev,
228 						  data->bulk_in),
229 				  buffer, USBTMC_SIZE_IOBUFFER,
230 				  &actual, USBTMC_TIMEOUT);
231 
232 		n++;
233 
234 		if (rv < 0) {
235 			dev_err(dev, "usb_bulk_msg returned %d\n", rv);
236 			goto exit;
237 		}
238 	} while ((actual == max_size) &&
239 		 (n < USBTMC_MAX_READS_TO_CLEAR_BULK_IN));
240 
241 	if (actual == max_size) {
242 		dev_err(dev, "Couldn't clear device buffer within %d cycles\n",
243 			USBTMC_MAX_READS_TO_CLEAR_BULK_IN);
244 		rv = -EPERM;
245 		goto exit;
246 	}
247 
248 	n = 0;
249 
250 usbtmc_abort_bulk_in_status:
251 	rv = usb_control_msg(data->usb_dev,
252 			     usb_rcvctrlpipe(data->usb_dev, 0),
253 			     USBTMC_REQUEST_CHECK_ABORT_BULK_IN_STATUS,
254 			     USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT,
255 			     0, data->bulk_in, buffer, 0x08,
256 			     USBTMC_TIMEOUT);
257 
258 	if (rv < 0) {
259 		dev_err(dev, "usb_control_msg returned %d\n", rv);
260 		goto exit;
261 	}
262 
263 	dev_dbg(dev, "INITIATE_ABORT_BULK_IN returned %x\n", buffer[0]);
264 
265 	if (buffer[0] == USBTMC_STATUS_SUCCESS) {
266 		rv = 0;
267 		goto exit;
268 	}
269 
270 	if (buffer[0] != USBTMC_STATUS_PENDING) {
271 		dev_err(dev, "INITIATE_ABORT_BULK_IN returned %x\n", buffer[0]);
272 		rv = -EPERM;
273 		goto exit;
274 	}
275 
276 	if (buffer[1] == 1)
277 		do {
278 			dev_dbg(dev, "Reading from bulk in EP\n");
279 
280 			rv = usb_bulk_msg(data->usb_dev,
281 					  usb_rcvbulkpipe(data->usb_dev,
282 							  data->bulk_in),
283 					  buffer, USBTMC_SIZE_IOBUFFER,
284 					  &actual, USBTMC_TIMEOUT);
285 
286 			n++;
287 
288 			if (rv < 0) {
289 				dev_err(dev, "usb_bulk_msg returned %d\n", rv);
290 				goto exit;
291 			}
292 		} while ((actual == max_size) &&
293 			 (n < USBTMC_MAX_READS_TO_CLEAR_BULK_IN));
294 
295 	if (actual == max_size) {
296 		dev_err(dev, "Couldn't clear device buffer within %d cycles\n",
297 			USBTMC_MAX_READS_TO_CLEAR_BULK_IN);
298 		rv = -EPERM;
299 		goto exit;
300 	}
301 
302 	goto usbtmc_abort_bulk_in_status;
303 
304 exit:
305 	kfree(buffer);
306 	return rv;
307 
308 }
309 
310 static int usbtmc_ioctl_abort_bulk_out(struct usbtmc_device_data *data)
311 {
312 	struct device *dev;
313 	u8 *buffer;
314 	int rv;
315 	int n;
316 
317 	dev = &data->intf->dev;
318 
319 	buffer = kmalloc(8, GFP_KERNEL);
320 	if (!buffer)
321 		return -ENOMEM;
322 
323 	rv = usb_control_msg(data->usb_dev,
324 			     usb_rcvctrlpipe(data->usb_dev, 0),
325 			     USBTMC_REQUEST_INITIATE_ABORT_BULK_OUT,
326 			     USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT,
327 			     data->bTag_last_write, data->bulk_out,
328 			     buffer, 2, USBTMC_TIMEOUT);
329 
330 	if (rv < 0) {
331 		dev_err(dev, "usb_control_msg returned %d\n", rv);
332 		goto exit;
333 	}
334 
335 	dev_dbg(dev, "INITIATE_ABORT_BULK_OUT returned %x\n", buffer[0]);
336 
337 	if (buffer[0] != USBTMC_STATUS_SUCCESS) {
338 		dev_err(dev, "INITIATE_ABORT_BULK_OUT returned %x\n",
339 			buffer[0]);
340 		rv = -EPERM;
341 		goto exit;
342 	}
343 
344 	n = 0;
345 
346 usbtmc_abort_bulk_out_check_status:
347 	rv = usb_control_msg(data->usb_dev,
348 			     usb_rcvctrlpipe(data->usb_dev, 0),
349 			     USBTMC_REQUEST_CHECK_ABORT_BULK_OUT_STATUS,
350 			     USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT,
351 			     0, data->bulk_out, buffer, 0x08,
352 			     USBTMC_TIMEOUT);
353 	n++;
354 	if (rv < 0) {
355 		dev_err(dev, "usb_control_msg returned %d\n", rv);
356 		goto exit;
357 	}
358 
359 	dev_dbg(dev, "CHECK_ABORT_BULK_OUT returned %x\n", buffer[0]);
360 
361 	if (buffer[0] == USBTMC_STATUS_SUCCESS)
362 		goto usbtmc_abort_bulk_out_clear_halt;
363 
364 	if ((buffer[0] == USBTMC_STATUS_PENDING) &&
365 	    (n < USBTMC_MAX_READS_TO_CLEAR_BULK_IN))
366 		goto usbtmc_abort_bulk_out_check_status;
367 
368 	rv = -EPERM;
369 	goto exit;
370 
371 usbtmc_abort_bulk_out_clear_halt:
372 	rv = usb_clear_halt(data->usb_dev,
373 			    usb_sndbulkpipe(data->usb_dev, data->bulk_out));
374 
375 	if (rv < 0) {
376 		dev_err(dev, "usb_control_msg returned %d\n", rv);
377 		goto exit;
378 	}
379 	rv = 0;
380 
381 exit:
382 	kfree(buffer);
383 	return rv;
384 }
385 
386 static int usbtmc488_ioctl_read_stb(struct usbtmc_device_data *data,
387 				void __user *arg)
388 {
389 	struct device *dev = &data->intf->dev;
390 	u8 *buffer;
391 	u8 tag;
392 	__u8 stb;
393 	int rv;
394 
395 	dev_dbg(dev, "Enter ioctl_read_stb iin_ep_present: %d\n",
396 		data->iin_ep_present);
397 
398 	buffer = kmalloc(8, GFP_KERNEL);
399 	if (!buffer)
400 		return -ENOMEM;
401 
402 	atomic_set(&data->iin_data_valid, 0);
403 
404 	/* must issue read_stb before using poll or select */
405 	atomic_set(&data->srq_asserted, 0);
406 
407 	rv = usb_control_msg(data->usb_dev,
408 			usb_rcvctrlpipe(data->usb_dev, 0),
409 			USBTMC488_REQUEST_READ_STATUS_BYTE,
410 			USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
411 			data->iin_bTag,
412 			data->ifnum,
413 			buffer, 0x03, USBTMC_TIMEOUT);
414 	if (rv < 0) {
415 		dev_err(dev, "stb usb_control_msg returned %d\n", rv);
416 		goto exit;
417 	}
418 
419 	if (buffer[0] != USBTMC_STATUS_SUCCESS) {
420 		dev_err(dev, "control status returned %x\n", buffer[0]);
421 		rv = -EIO;
422 		goto exit;
423 	}
424 
425 	if (data->iin_ep_present) {
426 		rv = wait_event_interruptible_timeout(
427 			data->waitq,
428 			atomic_read(&data->iin_data_valid) != 0,
429 			USBTMC_TIMEOUT);
430 		if (rv < 0) {
431 			dev_dbg(dev, "wait interrupted %d\n", rv);
432 			goto exit;
433 		}
434 
435 		if (rv == 0) {
436 			dev_dbg(dev, "wait timed out\n");
437 			rv = -ETIME;
438 			goto exit;
439 		}
440 
441 		tag = data->bNotify1 & 0x7f;
442 		if (tag != data->iin_bTag) {
443 			dev_err(dev, "expected bTag %x got %x\n",
444 				data->iin_bTag, tag);
445 		}
446 
447 		stb = data->bNotify2;
448 	} else {
449 		stb = buffer[2];
450 	}
451 
452 	rv = copy_to_user(arg, &stb, sizeof(stb));
453 	if (rv)
454 		rv = -EFAULT;
455 
456  exit:
457 	/* bump interrupt bTag */
458 	data->iin_bTag += 1;
459 	if (data->iin_bTag > 127)
460 		/* 1 is for SRQ see USBTMC-USB488 subclass spec section 4.3.1 */
461 		data->iin_bTag = 2;
462 
463 	kfree(buffer);
464 	return rv;
465 }
466 
467 static int usbtmc488_ioctl_simple(struct usbtmc_device_data *data,
468 				void __user *arg, unsigned int cmd)
469 {
470 	struct device *dev = &data->intf->dev;
471 	__u8 val;
472 	u8 *buffer;
473 	u16 wValue;
474 	int rv;
475 
476 	if (!(data->usb488_caps & USBTMC488_CAPABILITY_SIMPLE))
477 		return -EINVAL;
478 
479 	buffer = kmalloc(8, GFP_KERNEL);
480 	if (!buffer)
481 		return -ENOMEM;
482 
483 	if (cmd == USBTMC488_REQUEST_REN_CONTROL) {
484 		rv = copy_from_user(&val, arg, sizeof(val));
485 		if (rv) {
486 			rv = -EFAULT;
487 			goto exit;
488 		}
489 		wValue = val ? 1 : 0;
490 	} else {
491 		wValue = 0;
492 	}
493 
494 	rv = usb_control_msg(data->usb_dev,
495 			usb_rcvctrlpipe(data->usb_dev, 0),
496 			cmd,
497 			USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
498 			wValue,
499 			data->ifnum,
500 			buffer, 0x01, USBTMC_TIMEOUT);
501 	if (rv < 0) {
502 		dev_err(dev, "simple usb_control_msg failed %d\n", rv);
503 		goto exit;
504 	} else if (rv != 1) {
505 		dev_warn(dev, "simple usb_control_msg returned %d\n", rv);
506 		rv = -EIO;
507 		goto exit;
508 	}
509 
510 	if (buffer[0] != USBTMC_STATUS_SUCCESS) {
511 		dev_err(dev, "simple control status returned %x\n", buffer[0]);
512 		rv = -EIO;
513 		goto exit;
514 	}
515 	rv = 0;
516 
517  exit:
518 	kfree(buffer);
519 	return rv;
520 }
521 
522 /*
523  * Sends a REQUEST_DEV_DEP_MSG_IN message on the Bulk-OUT endpoint.
524  * @transfer_size: number of bytes to request from the device.
525  *
526  * See the USBTMC specification, Table 4.
527  *
528  * Also updates bTag_last_write.
529  */
530 static int send_request_dev_dep_msg_in(struct usbtmc_device_data *data, size_t transfer_size)
531 {
532 	int retval;
533 	u8 *buffer;
534 	int actual;
535 
536 	buffer = kmalloc(USBTMC_HEADER_SIZE, GFP_KERNEL);
537 	if (!buffer)
538 		return -ENOMEM;
539 	/* Setup IO buffer for REQUEST_DEV_DEP_MSG_IN message
540 	 * Refer to class specs for details
541 	 */
542 	buffer[0] = 2;
543 	buffer[1] = data->bTag;
544 	buffer[2] = ~data->bTag;
545 	buffer[3] = 0; /* Reserved */
546 	buffer[4] = transfer_size >> 0;
547 	buffer[5] = transfer_size >> 8;
548 	buffer[6] = transfer_size >> 16;
549 	buffer[7] = transfer_size >> 24;
550 	buffer[8] = data->TermCharEnabled * 2;
551 	/* Use term character? */
552 	buffer[9] = data->TermChar;
553 	buffer[10] = 0; /* Reserved */
554 	buffer[11] = 0; /* Reserved */
555 
556 	/* Send bulk URB */
557 	retval = usb_bulk_msg(data->usb_dev,
558 			      usb_sndbulkpipe(data->usb_dev,
559 					      data->bulk_out),
560 			      buffer, USBTMC_HEADER_SIZE, &actual, USBTMC_TIMEOUT);
561 
562 	/* Store bTag (in case we need to abort) */
563 	data->bTag_last_write = data->bTag;
564 
565 	/* Increment bTag -- and increment again if zero */
566 	data->bTag++;
567 	if (!data->bTag)
568 		data->bTag++;
569 
570 	kfree(buffer);
571 	if (retval < 0) {
572 		dev_err(&data->intf->dev, "usb_bulk_msg in send_request_dev_dep_msg_in() returned %d\n", retval);
573 		return retval;
574 	}
575 
576 	return 0;
577 }
578 
579 static ssize_t usbtmc_read(struct file *filp, char __user *buf,
580 			   size_t count, loff_t *f_pos)
581 {
582 	struct usbtmc_device_data *data;
583 	struct device *dev;
584 	u32 n_characters;
585 	u8 *buffer;
586 	int actual;
587 	size_t done;
588 	size_t remaining;
589 	int retval;
590 	size_t this_part;
591 
592 	/* Get pointer to private data structure */
593 	data = filp->private_data;
594 	dev = &data->intf->dev;
595 
596 	buffer = kmalloc(USBTMC_SIZE_IOBUFFER, GFP_KERNEL);
597 	if (!buffer)
598 		return -ENOMEM;
599 
600 	mutex_lock(&data->io_mutex);
601 	if (data->zombie) {
602 		retval = -ENODEV;
603 		goto exit;
604 	}
605 
606 	if (data->rigol_quirk) {
607 		dev_dbg(dev, "usb_bulk_msg_in: count(%zu)\n", count);
608 
609 		retval = send_request_dev_dep_msg_in(data, count);
610 
611 		if (retval < 0) {
612 			if (data->auto_abort)
613 				usbtmc_ioctl_abort_bulk_out(data);
614 			goto exit;
615 		}
616 	}
617 
618 	/* Loop until we have fetched everything we requested */
619 	remaining = count;
620 	this_part = remaining;
621 	done = 0;
622 
623 	while (remaining > 0) {
624 		if (!data->rigol_quirk) {
625 			dev_dbg(dev, "usb_bulk_msg_in: remaining(%zu), count(%zu)\n", remaining, count);
626 
627 			if (remaining > USBTMC_SIZE_IOBUFFER - USBTMC_HEADER_SIZE - 3)
628 				this_part = USBTMC_SIZE_IOBUFFER - USBTMC_HEADER_SIZE - 3;
629 			else
630 				this_part = remaining;
631 
632 			retval = send_request_dev_dep_msg_in(data, this_part);
633 			if (retval < 0) {
634 			dev_err(dev, "usb_bulk_msg returned %d\n", retval);
635 				if (data->auto_abort)
636 					usbtmc_ioctl_abort_bulk_out(data);
637 				goto exit;
638 			}
639 		}
640 
641 		/* Send bulk URB */
642 		retval = usb_bulk_msg(data->usb_dev,
643 				      usb_rcvbulkpipe(data->usb_dev,
644 						      data->bulk_in),
645 				      buffer, USBTMC_SIZE_IOBUFFER, &actual,
646 				      USBTMC_TIMEOUT);
647 
648 		dev_dbg(dev, "usb_bulk_msg: retval(%u), done(%zu), remaining(%zu), actual(%d)\n", retval, done, remaining, actual);
649 
650 		/* Store bTag (in case we need to abort) */
651 		data->bTag_last_read = data->bTag;
652 
653 		if (retval < 0) {
654 			dev_dbg(dev, "Unable to read data, error %d\n", retval);
655 			if (data->auto_abort)
656 				usbtmc_ioctl_abort_bulk_in(data);
657 			goto exit;
658 		}
659 
660 		/* Parse header in first packet */
661 		if ((done == 0) || !data->rigol_quirk) {
662 			/* Sanity checks for the header */
663 			if (actual < USBTMC_HEADER_SIZE) {
664 				dev_err(dev, "Device sent too small first packet: %u < %u\n", actual, USBTMC_HEADER_SIZE);
665 				if (data->auto_abort)
666 					usbtmc_ioctl_abort_bulk_in(data);
667 				goto exit;
668 			}
669 
670 			if (buffer[0] != 2) {
671 				dev_err(dev, "Device sent reply with wrong MsgID: %u != 2\n", buffer[0]);
672 				if (data->auto_abort)
673 					usbtmc_ioctl_abort_bulk_in(data);
674 				goto exit;
675 			}
676 
677 			if (buffer[1] != data->bTag_last_write) {
678 				dev_err(dev, "Device sent reply with wrong bTag: %u != %u\n", buffer[1], data->bTag_last_write);
679 				if (data->auto_abort)
680 					usbtmc_ioctl_abort_bulk_in(data);
681 				goto exit;
682 			}
683 
684 			/* How many characters did the instrument send? */
685 			n_characters = buffer[4] +
686 				       (buffer[5] << 8) +
687 				       (buffer[6] << 16) +
688 				       (buffer[7] << 24);
689 
690 			if (n_characters > this_part) {
691 				dev_err(dev, "Device wants to return more data than requested: %u > %zu\n", n_characters, count);
692 				if (data->auto_abort)
693 					usbtmc_ioctl_abort_bulk_in(data);
694 				goto exit;
695 			}
696 
697 			/* Remove the USBTMC header */
698 			actual -= USBTMC_HEADER_SIZE;
699 
700 			/* Check if the message is smaller than requested */
701 			if (data->rigol_quirk) {
702 				if (remaining > n_characters)
703 					remaining = n_characters;
704 				/* Remove padding if it exists */
705 				if (actual > remaining)
706 					actual = remaining;
707 			}
708 			else {
709 				if (this_part > n_characters)
710 					this_part = n_characters;
711 				/* Remove padding if it exists */
712 				if (actual > this_part)
713 					actual = this_part;
714 			}
715 
716 			dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", n_characters, buffer[8]);
717 
718 			remaining -= actual;
719 
720 			/* Terminate if end-of-message bit received from device */
721 			if ((buffer[8] & 0x01) && (actual >= n_characters))
722 				remaining = 0;
723 
724 			dev_dbg(dev, "Bulk-IN header: remaining(%zu), buf(%p), buffer(%p) done(%zu)\n", remaining,buf,buffer,done);
725 
726 
727 			/* Copy buffer to user space */
728 			if (copy_to_user(buf + done, &buffer[USBTMC_HEADER_SIZE], actual)) {
729 				/* There must have been an addressing problem */
730 				retval = -EFAULT;
731 				goto exit;
732 			}
733 			done += actual;
734 		}
735 		else  {
736 			if (actual > remaining)
737 				actual = remaining;
738 
739 			remaining -= actual;
740 
741 			dev_dbg(dev, "Bulk-IN header cont: actual(%u), done(%zu), remaining(%zu), buf(%p), buffer(%p)\n", actual, done, remaining,buf,buffer);
742 
743 			/* Copy buffer to user space */
744 			if (copy_to_user(buf + done, buffer, actual)) {
745 				/* There must have been an addressing problem */
746 				retval = -EFAULT;
747 				goto exit;
748 			}
749 			done += actual;
750 		}
751 	}
752 
753 	/* Update file position value */
754 	*f_pos = *f_pos + done;
755 	retval = done;
756 
757 exit:
758 	mutex_unlock(&data->io_mutex);
759 	kfree(buffer);
760 	return retval;
761 }
762 
763 static ssize_t usbtmc_write(struct file *filp, const char __user *buf,
764 			    size_t count, loff_t *f_pos)
765 {
766 	struct usbtmc_device_data *data;
767 	u8 *buffer;
768 	int retval;
769 	int actual;
770 	unsigned long int n_bytes;
771 	int remaining;
772 	int done;
773 	int this_part;
774 
775 	data = filp->private_data;
776 
777 	buffer = kmalloc(USBTMC_SIZE_IOBUFFER, GFP_KERNEL);
778 	if (!buffer)
779 		return -ENOMEM;
780 
781 	mutex_lock(&data->io_mutex);
782 	if (data->zombie) {
783 		retval = -ENODEV;
784 		goto exit;
785 	}
786 
787 	remaining = count;
788 	done = 0;
789 
790 	while (remaining > 0) {
791 		if (remaining > USBTMC_SIZE_IOBUFFER - USBTMC_HEADER_SIZE) {
792 			this_part = USBTMC_SIZE_IOBUFFER - USBTMC_HEADER_SIZE;
793 			buffer[8] = 0;
794 		} else {
795 			this_part = remaining;
796 			buffer[8] = 1;
797 		}
798 
799 		/* Setup IO buffer for DEV_DEP_MSG_OUT message */
800 		buffer[0] = 1;
801 		buffer[1] = data->bTag;
802 		buffer[2] = ~data->bTag;
803 		buffer[3] = 0; /* Reserved */
804 		buffer[4] = this_part >> 0;
805 		buffer[5] = this_part >> 8;
806 		buffer[6] = this_part >> 16;
807 		buffer[7] = this_part >> 24;
808 		/* buffer[8] is set above... */
809 		buffer[9] = 0; /* Reserved */
810 		buffer[10] = 0; /* Reserved */
811 		buffer[11] = 0; /* Reserved */
812 
813 		if (copy_from_user(&buffer[USBTMC_HEADER_SIZE], buf + done, this_part)) {
814 			retval = -EFAULT;
815 			goto exit;
816 		}
817 
818 		n_bytes = roundup(USBTMC_HEADER_SIZE + this_part, 4);
819 		memset(buffer + USBTMC_HEADER_SIZE + this_part, 0, n_bytes - (USBTMC_HEADER_SIZE + this_part));
820 
821 		do {
822 			retval = usb_bulk_msg(data->usb_dev,
823 					      usb_sndbulkpipe(data->usb_dev,
824 							      data->bulk_out),
825 					      buffer, n_bytes,
826 					      &actual, USBTMC_TIMEOUT);
827 			if (retval != 0)
828 				break;
829 			n_bytes -= actual;
830 		} while (n_bytes);
831 
832 		data->bTag_last_write = data->bTag;
833 		data->bTag++;
834 
835 		if (!data->bTag)
836 			data->bTag++;
837 
838 		if (retval < 0) {
839 			dev_err(&data->intf->dev,
840 				"Unable to send data, error %d\n", retval);
841 			if (data->auto_abort)
842 				usbtmc_ioctl_abort_bulk_out(data);
843 			goto exit;
844 		}
845 
846 		remaining -= this_part;
847 		done += this_part;
848 	}
849 
850 	retval = count;
851 exit:
852 	mutex_unlock(&data->io_mutex);
853 	kfree(buffer);
854 	return retval;
855 }
856 
857 static int usbtmc_ioctl_clear(struct usbtmc_device_data *data)
858 {
859 	struct usb_host_interface *current_setting;
860 	struct usb_endpoint_descriptor *desc;
861 	struct device *dev;
862 	u8 *buffer;
863 	int rv;
864 	int n;
865 	int actual = 0;
866 	int max_size;
867 
868 	dev = &data->intf->dev;
869 
870 	dev_dbg(dev, "Sending INITIATE_CLEAR request\n");
871 
872 	buffer = kmalloc(USBTMC_SIZE_IOBUFFER, GFP_KERNEL);
873 	if (!buffer)
874 		return -ENOMEM;
875 
876 	rv = usb_control_msg(data->usb_dev,
877 			     usb_rcvctrlpipe(data->usb_dev, 0),
878 			     USBTMC_REQUEST_INITIATE_CLEAR,
879 			     USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
880 			     0, 0, buffer, 1, USBTMC_TIMEOUT);
881 	if (rv < 0) {
882 		dev_err(dev, "usb_control_msg returned %d\n", rv);
883 		goto exit;
884 	}
885 
886 	dev_dbg(dev, "INITIATE_CLEAR returned %x\n", buffer[0]);
887 
888 	if (buffer[0] != USBTMC_STATUS_SUCCESS) {
889 		dev_err(dev, "INITIATE_CLEAR returned %x\n", buffer[0]);
890 		rv = -EPERM;
891 		goto exit;
892 	}
893 
894 	max_size = 0;
895 	current_setting = data->intf->cur_altsetting;
896 	for (n = 0; n < current_setting->desc.bNumEndpoints; n++) {
897 		desc = &current_setting->endpoint[n].desc;
898 		if (desc->bEndpointAddress == data->bulk_in)
899 			max_size = usb_endpoint_maxp(desc);
900 	}
901 
902 	if (max_size == 0) {
903 		dev_err(dev, "Couldn't get wMaxPacketSize\n");
904 		rv = -EPERM;
905 		goto exit;
906 	}
907 
908 	dev_dbg(dev, "wMaxPacketSize is %d\n", max_size);
909 
910 	n = 0;
911 
912 usbtmc_clear_check_status:
913 
914 	dev_dbg(dev, "Sending CHECK_CLEAR_STATUS request\n");
915 
916 	rv = usb_control_msg(data->usb_dev,
917 			     usb_rcvctrlpipe(data->usb_dev, 0),
918 			     USBTMC_REQUEST_CHECK_CLEAR_STATUS,
919 			     USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
920 			     0, 0, buffer, 2, USBTMC_TIMEOUT);
921 	if (rv < 0) {
922 		dev_err(dev, "usb_control_msg returned %d\n", rv);
923 		goto exit;
924 	}
925 
926 	dev_dbg(dev, "CHECK_CLEAR_STATUS returned %x\n", buffer[0]);
927 
928 	if (buffer[0] == USBTMC_STATUS_SUCCESS)
929 		goto usbtmc_clear_bulk_out_halt;
930 
931 	if (buffer[0] != USBTMC_STATUS_PENDING) {
932 		dev_err(dev, "CHECK_CLEAR_STATUS returned %x\n", buffer[0]);
933 		rv = -EPERM;
934 		goto exit;
935 	}
936 
937 	if (buffer[1] == 1)
938 		do {
939 			dev_dbg(dev, "Reading from bulk in EP\n");
940 
941 			rv = usb_bulk_msg(data->usb_dev,
942 					  usb_rcvbulkpipe(data->usb_dev,
943 							  data->bulk_in),
944 					  buffer, USBTMC_SIZE_IOBUFFER,
945 					  &actual, USBTMC_TIMEOUT);
946 			n++;
947 
948 			if (rv < 0) {
949 				dev_err(dev, "usb_control_msg returned %d\n",
950 					rv);
951 				goto exit;
952 			}
953 		} while ((actual == max_size) &&
954 			  (n < USBTMC_MAX_READS_TO_CLEAR_BULK_IN));
955 
956 	if (actual == max_size) {
957 		dev_err(dev, "Couldn't clear device buffer within %d cycles\n",
958 			USBTMC_MAX_READS_TO_CLEAR_BULK_IN);
959 		rv = -EPERM;
960 		goto exit;
961 	}
962 
963 	goto usbtmc_clear_check_status;
964 
965 usbtmc_clear_bulk_out_halt:
966 
967 	rv = usb_clear_halt(data->usb_dev,
968 			    usb_sndbulkpipe(data->usb_dev, data->bulk_out));
969 	if (rv < 0) {
970 		dev_err(dev, "usb_control_msg returned %d\n", rv);
971 		goto exit;
972 	}
973 	rv = 0;
974 
975 exit:
976 	kfree(buffer);
977 	return rv;
978 }
979 
980 static int usbtmc_ioctl_clear_out_halt(struct usbtmc_device_data *data)
981 {
982 	int rv;
983 
984 	rv = usb_clear_halt(data->usb_dev,
985 			    usb_sndbulkpipe(data->usb_dev, data->bulk_out));
986 
987 	if (rv < 0) {
988 		dev_err(&data->usb_dev->dev, "usb_control_msg returned %d\n",
989 			rv);
990 		return rv;
991 	}
992 	return 0;
993 }
994 
995 static int usbtmc_ioctl_clear_in_halt(struct usbtmc_device_data *data)
996 {
997 	int rv;
998 
999 	rv = usb_clear_halt(data->usb_dev,
1000 			    usb_rcvbulkpipe(data->usb_dev, data->bulk_in));
1001 
1002 	if (rv < 0) {
1003 		dev_err(&data->usb_dev->dev, "usb_control_msg returned %d\n",
1004 			rv);
1005 		return rv;
1006 	}
1007 	return 0;
1008 }
1009 
1010 static int get_capabilities(struct usbtmc_device_data *data)
1011 {
1012 	struct device *dev = &data->usb_dev->dev;
1013 	char *buffer;
1014 	int rv = 0;
1015 
1016 	buffer = kmalloc(0x18, GFP_KERNEL);
1017 	if (!buffer)
1018 		return -ENOMEM;
1019 
1020 	rv = usb_control_msg(data->usb_dev, usb_rcvctrlpipe(data->usb_dev, 0),
1021 			     USBTMC_REQUEST_GET_CAPABILITIES,
1022 			     USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
1023 			     0, 0, buffer, 0x18, USBTMC_TIMEOUT);
1024 	if (rv < 0) {
1025 		dev_err(dev, "usb_control_msg returned %d\n", rv);
1026 		goto err_out;
1027 	}
1028 
1029 	dev_dbg(dev, "GET_CAPABILITIES returned %x\n", buffer[0]);
1030 	if (buffer[0] != USBTMC_STATUS_SUCCESS) {
1031 		dev_err(dev, "GET_CAPABILITIES returned %x\n", buffer[0]);
1032 		rv = -EPERM;
1033 		goto err_out;
1034 	}
1035 	dev_dbg(dev, "Interface capabilities are %x\n", buffer[4]);
1036 	dev_dbg(dev, "Device capabilities are %x\n", buffer[5]);
1037 	dev_dbg(dev, "USB488 interface capabilities are %x\n", buffer[14]);
1038 	dev_dbg(dev, "USB488 device capabilities are %x\n", buffer[15]);
1039 
1040 	data->capabilities.interface_capabilities = buffer[4];
1041 	data->capabilities.device_capabilities = buffer[5];
1042 	data->capabilities.usb488_interface_capabilities = buffer[14];
1043 	data->capabilities.usb488_device_capabilities = buffer[15];
1044 	data->usb488_caps = (buffer[14] & 0x07) | ((buffer[15] & 0x0f) << 4);
1045 	rv = 0;
1046 
1047 err_out:
1048 	kfree(buffer);
1049 	return rv;
1050 }
1051 
1052 #define capability_attribute(name)					\
1053 static ssize_t name##_show(struct device *dev,				\
1054 			   struct device_attribute *attr, char *buf)	\
1055 {									\
1056 	struct usb_interface *intf = to_usb_interface(dev);		\
1057 	struct usbtmc_device_data *data = usb_get_intfdata(intf);	\
1058 									\
1059 	return sprintf(buf, "%d\n", data->capabilities.name);		\
1060 }									\
1061 static DEVICE_ATTR_RO(name)
1062 
1063 capability_attribute(interface_capabilities);
1064 capability_attribute(device_capabilities);
1065 capability_attribute(usb488_interface_capabilities);
1066 capability_attribute(usb488_device_capabilities);
1067 
1068 static struct attribute *capability_attrs[] = {
1069 	&dev_attr_interface_capabilities.attr,
1070 	&dev_attr_device_capabilities.attr,
1071 	&dev_attr_usb488_interface_capabilities.attr,
1072 	&dev_attr_usb488_device_capabilities.attr,
1073 	NULL,
1074 };
1075 
1076 static const struct attribute_group capability_attr_grp = {
1077 	.attrs = capability_attrs,
1078 };
1079 
1080 static ssize_t TermChar_show(struct device *dev,
1081 			     struct device_attribute *attr, char *buf)
1082 {
1083 	struct usb_interface *intf = to_usb_interface(dev);
1084 	struct usbtmc_device_data *data = usb_get_intfdata(intf);
1085 
1086 	return sprintf(buf, "%c\n", data->TermChar);
1087 }
1088 
1089 static ssize_t TermChar_store(struct device *dev,
1090 			      struct device_attribute *attr,
1091 			      const char *buf, size_t count)
1092 {
1093 	struct usb_interface *intf = to_usb_interface(dev);
1094 	struct usbtmc_device_data *data = usb_get_intfdata(intf);
1095 
1096 	if (count < 1)
1097 		return -EINVAL;
1098 	data->TermChar = buf[0];
1099 	return count;
1100 }
1101 static DEVICE_ATTR_RW(TermChar);
1102 
1103 #define data_attribute(name)						\
1104 static ssize_t name##_show(struct device *dev,				\
1105 			   struct device_attribute *attr, char *buf)	\
1106 {									\
1107 	struct usb_interface *intf = to_usb_interface(dev);		\
1108 	struct usbtmc_device_data *data = usb_get_intfdata(intf);	\
1109 									\
1110 	return sprintf(buf, "%d\n", data->name);			\
1111 }									\
1112 static ssize_t name##_store(struct device *dev,				\
1113 			    struct device_attribute *attr,		\
1114 			    const char *buf, size_t count)		\
1115 {									\
1116 	struct usb_interface *intf = to_usb_interface(dev);		\
1117 	struct usbtmc_device_data *data = usb_get_intfdata(intf);	\
1118 	ssize_t result;							\
1119 	unsigned val;							\
1120 									\
1121 	result = sscanf(buf, "%u\n", &val);				\
1122 	if (result != 1)						\
1123 		result = -EINVAL;					\
1124 	data->name = val;						\
1125 	if (result < 0)							\
1126 		return result;						\
1127 	else								\
1128 		return count;						\
1129 }									\
1130 static DEVICE_ATTR_RW(name)
1131 
1132 data_attribute(TermCharEnabled);
1133 data_attribute(auto_abort);
1134 
1135 static struct attribute *data_attrs[] = {
1136 	&dev_attr_TermChar.attr,
1137 	&dev_attr_TermCharEnabled.attr,
1138 	&dev_attr_auto_abort.attr,
1139 	NULL,
1140 };
1141 
1142 static const struct attribute_group data_attr_grp = {
1143 	.attrs = data_attrs,
1144 };
1145 
1146 static int usbtmc_ioctl_indicator_pulse(struct usbtmc_device_data *data)
1147 {
1148 	struct device *dev;
1149 	u8 *buffer;
1150 	int rv;
1151 
1152 	dev = &data->intf->dev;
1153 
1154 	buffer = kmalloc(2, GFP_KERNEL);
1155 	if (!buffer)
1156 		return -ENOMEM;
1157 
1158 	rv = usb_control_msg(data->usb_dev,
1159 			     usb_rcvctrlpipe(data->usb_dev, 0),
1160 			     USBTMC_REQUEST_INDICATOR_PULSE,
1161 			     USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
1162 			     0, 0, buffer, 0x01, USBTMC_TIMEOUT);
1163 
1164 	if (rv < 0) {
1165 		dev_err(dev, "usb_control_msg returned %d\n", rv);
1166 		goto exit;
1167 	}
1168 
1169 	dev_dbg(dev, "INDICATOR_PULSE returned %x\n", buffer[0]);
1170 
1171 	if (buffer[0] != USBTMC_STATUS_SUCCESS) {
1172 		dev_err(dev, "INDICATOR_PULSE returned %x\n", buffer[0]);
1173 		rv = -EPERM;
1174 		goto exit;
1175 	}
1176 	rv = 0;
1177 
1178 exit:
1179 	kfree(buffer);
1180 	return rv;
1181 }
1182 
1183 static long usbtmc_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1184 {
1185 	struct usbtmc_device_data *data;
1186 	int retval = -EBADRQC;
1187 
1188 	data = file->private_data;
1189 	mutex_lock(&data->io_mutex);
1190 	if (data->zombie) {
1191 		retval = -ENODEV;
1192 		goto skip_io_on_zombie;
1193 	}
1194 
1195 	switch (cmd) {
1196 	case USBTMC_IOCTL_CLEAR_OUT_HALT:
1197 		retval = usbtmc_ioctl_clear_out_halt(data);
1198 		break;
1199 
1200 	case USBTMC_IOCTL_CLEAR_IN_HALT:
1201 		retval = usbtmc_ioctl_clear_in_halt(data);
1202 		break;
1203 
1204 	case USBTMC_IOCTL_INDICATOR_PULSE:
1205 		retval = usbtmc_ioctl_indicator_pulse(data);
1206 		break;
1207 
1208 	case USBTMC_IOCTL_CLEAR:
1209 		retval = usbtmc_ioctl_clear(data);
1210 		break;
1211 
1212 	case USBTMC_IOCTL_ABORT_BULK_OUT:
1213 		retval = usbtmc_ioctl_abort_bulk_out(data);
1214 		break;
1215 
1216 	case USBTMC_IOCTL_ABORT_BULK_IN:
1217 		retval = usbtmc_ioctl_abort_bulk_in(data);
1218 		break;
1219 
1220 	case USBTMC488_IOCTL_GET_CAPS:
1221 		retval = copy_to_user((void __user *)arg,
1222 				&data->usb488_caps,
1223 				sizeof(data->usb488_caps));
1224 		if (retval)
1225 			retval = -EFAULT;
1226 		break;
1227 
1228 	case USBTMC488_IOCTL_READ_STB:
1229 		retval = usbtmc488_ioctl_read_stb(data, (void __user *)arg);
1230 		break;
1231 
1232 	case USBTMC488_IOCTL_REN_CONTROL:
1233 		retval = usbtmc488_ioctl_simple(data, (void __user *)arg,
1234 						USBTMC488_REQUEST_REN_CONTROL);
1235 		break;
1236 
1237 	case USBTMC488_IOCTL_GOTO_LOCAL:
1238 		retval = usbtmc488_ioctl_simple(data, (void __user *)arg,
1239 						USBTMC488_REQUEST_GOTO_LOCAL);
1240 		break;
1241 
1242 	case USBTMC488_IOCTL_LOCAL_LOCKOUT:
1243 		retval = usbtmc488_ioctl_simple(data, (void __user *)arg,
1244 						USBTMC488_REQUEST_LOCAL_LOCKOUT);
1245 		break;
1246 	}
1247 
1248 skip_io_on_zombie:
1249 	mutex_unlock(&data->io_mutex);
1250 	return retval;
1251 }
1252 
1253 static int usbtmc_fasync(int fd, struct file *file, int on)
1254 {
1255 	struct usbtmc_device_data *data = file->private_data;
1256 
1257 	return fasync_helper(fd, file, on, &data->fasync);
1258 }
1259 
1260 static __poll_t usbtmc_poll(struct file *file, poll_table *wait)
1261 {
1262 	struct usbtmc_device_data *data = file->private_data;
1263 	__poll_t mask;
1264 
1265 	mutex_lock(&data->io_mutex);
1266 
1267 	if (data->zombie) {
1268 		mask = EPOLLHUP | EPOLLERR;
1269 		goto no_poll;
1270 	}
1271 
1272 	poll_wait(file, &data->waitq, wait);
1273 
1274 	mask = (atomic_read(&data->srq_asserted)) ? EPOLLIN | EPOLLRDNORM : 0;
1275 
1276 no_poll:
1277 	mutex_unlock(&data->io_mutex);
1278 	return mask;
1279 }
1280 
1281 static const struct file_operations fops = {
1282 	.owner		= THIS_MODULE,
1283 	.read		= usbtmc_read,
1284 	.write		= usbtmc_write,
1285 	.open		= usbtmc_open,
1286 	.release	= usbtmc_release,
1287 	.unlocked_ioctl	= usbtmc_ioctl,
1288 	.fasync         = usbtmc_fasync,
1289 	.poll           = usbtmc_poll,
1290 	.llseek		= default_llseek,
1291 };
1292 
1293 static struct usb_class_driver usbtmc_class = {
1294 	.name =		"usbtmc%d",
1295 	.fops =		&fops,
1296 	.minor_base =	USBTMC_MINOR_BASE,
1297 };
1298 
1299 static void usbtmc_interrupt(struct urb *urb)
1300 {
1301 	struct usbtmc_device_data *data = urb->context;
1302 	struct device *dev = &data->intf->dev;
1303 	int status = urb->status;
1304 	int rv;
1305 
1306 	dev_dbg(&data->intf->dev, "int status: %d len %d\n",
1307 		status, urb->actual_length);
1308 
1309 	switch (status) {
1310 	case 0: /* SUCCESS */
1311 		/* check for valid STB notification */
1312 		if (data->iin_buffer[0] > 0x81) {
1313 			data->bNotify1 = data->iin_buffer[0];
1314 			data->bNotify2 = data->iin_buffer[1];
1315 			atomic_set(&data->iin_data_valid, 1);
1316 			wake_up_interruptible(&data->waitq);
1317 			goto exit;
1318 		}
1319 		/* check for SRQ notification */
1320 		if (data->iin_buffer[0] == 0x81) {
1321 			if (data->fasync)
1322 				kill_fasync(&data->fasync,
1323 					SIGIO, POLL_IN);
1324 
1325 			atomic_set(&data->srq_asserted, 1);
1326 			wake_up_interruptible(&data->waitq);
1327 			goto exit;
1328 		}
1329 		dev_warn(dev, "invalid notification: %x\n", data->iin_buffer[0]);
1330 		break;
1331 	case -EOVERFLOW:
1332 		dev_err(dev, "overflow with length %d, actual length is %d\n",
1333 			data->iin_wMaxPacketSize, urb->actual_length);
1334 		/* fall through */
1335 	case -ECONNRESET:
1336 	case -ENOENT:
1337 	case -ESHUTDOWN:
1338 	case -EILSEQ:
1339 	case -ETIME:
1340 		/* urb terminated, clean up */
1341 		dev_dbg(dev, "urb terminated, status: %d\n", status);
1342 		return;
1343 	default:
1344 		dev_err(dev, "unknown status received: %d\n", status);
1345 	}
1346 exit:
1347 	rv = usb_submit_urb(urb, GFP_ATOMIC);
1348 	if (rv)
1349 		dev_err(dev, "usb_submit_urb failed: %d\n", rv);
1350 }
1351 
1352 static void usbtmc_free_int(struct usbtmc_device_data *data)
1353 {
1354 	if (!data->iin_ep_present || !data->iin_urb)
1355 		return;
1356 	usb_kill_urb(data->iin_urb);
1357 	kfree(data->iin_buffer);
1358 	usb_free_urb(data->iin_urb);
1359 	kref_put(&data->kref, usbtmc_delete);
1360 }
1361 
1362 static int usbtmc_probe(struct usb_interface *intf,
1363 			const struct usb_device_id *id)
1364 {
1365 	struct usbtmc_device_data *data;
1366 	struct usb_host_interface *iface_desc;
1367 	struct usb_endpoint_descriptor *bulk_in, *bulk_out, *int_in;
1368 	int n;
1369 	int retcode;
1370 
1371 	dev_dbg(&intf->dev, "%s called\n", __func__);
1372 
1373 	data = kzalloc(sizeof(*data), GFP_KERNEL);
1374 	if (!data)
1375 		return -ENOMEM;
1376 
1377 	data->intf = intf;
1378 	data->id = id;
1379 	data->usb_dev = usb_get_dev(interface_to_usbdev(intf));
1380 	usb_set_intfdata(intf, data);
1381 	kref_init(&data->kref);
1382 	mutex_init(&data->io_mutex);
1383 	init_waitqueue_head(&data->waitq);
1384 	atomic_set(&data->iin_data_valid, 0);
1385 	atomic_set(&data->srq_asserted, 0);
1386 	data->zombie = 0;
1387 
1388 	/* Determine if it is a Rigol or not */
1389 	data->rigol_quirk = 0;
1390 	dev_dbg(&intf->dev, "Trying to find if device Vendor 0x%04X Product 0x%04X has the RIGOL quirk\n",
1391 		le16_to_cpu(data->usb_dev->descriptor.idVendor),
1392 		le16_to_cpu(data->usb_dev->descriptor.idProduct));
1393 	for(n = 0; usbtmc_id_quirk[n].idVendor > 0; n++) {
1394 		if ((usbtmc_id_quirk[n].idVendor == le16_to_cpu(data->usb_dev->descriptor.idVendor)) &&
1395 		    (usbtmc_id_quirk[n].idProduct == le16_to_cpu(data->usb_dev->descriptor.idProduct))) {
1396 			dev_dbg(&intf->dev, "Setting this device as having the RIGOL quirk\n");
1397 			data->rigol_quirk = 1;
1398 			break;
1399 		}
1400 	}
1401 
1402 	/* Initialize USBTMC bTag and other fields */
1403 	data->bTag	= 1;
1404 	data->TermCharEnabled = 0;
1405 	data->TermChar = '\n';
1406 	/*  2 <= bTag <= 127   USBTMC-USB488 subclass specification 4.3.1 */
1407 	data->iin_bTag = 2;
1408 
1409 	/* USBTMC devices have only one setting, so use that */
1410 	iface_desc = data->intf->cur_altsetting;
1411 	data->ifnum = iface_desc->desc.bInterfaceNumber;
1412 
1413 	/* Find bulk endpoints */
1414 	retcode = usb_find_common_endpoints(iface_desc,
1415 			&bulk_in, &bulk_out, NULL, NULL);
1416 	if (retcode) {
1417 		dev_err(&intf->dev, "bulk endpoints not found\n");
1418 		goto err_put;
1419 	}
1420 
1421 	data->bulk_in = bulk_in->bEndpointAddress;
1422 	dev_dbg(&intf->dev, "Found bulk in endpoint at %u\n", data->bulk_in);
1423 
1424 	data->bulk_out = bulk_out->bEndpointAddress;
1425 	dev_dbg(&intf->dev, "Found Bulk out endpoint at %u\n", data->bulk_out);
1426 
1427 	/* Find int endpoint */
1428 	retcode = usb_find_int_in_endpoint(iface_desc, &int_in);
1429 	if (!retcode) {
1430 		data->iin_ep_present = 1;
1431 		data->iin_ep = int_in->bEndpointAddress;
1432 		data->iin_wMaxPacketSize = usb_endpoint_maxp(int_in);
1433 		data->iin_interval = int_in->bInterval;
1434 		dev_dbg(&intf->dev, "Found Int in endpoint at %u\n",
1435 				data->iin_ep);
1436 	}
1437 
1438 	retcode = get_capabilities(data);
1439 	if (retcode)
1440 		dev_err(&intf->dev, "can't read capabilities\n");
1441 	else
1442 		retcode = sysfs_create_group(&intf->dev.kobj,
1443 					     &capability_attr_grp);
1444 
1445 	if (data->iin_ep_present) {
1446 		/* allocate int urb */
1447 		data->iin_urb = usb_alloc_urb(0, GFP_KERNEL);
1448 		if (!data->iin_urb) {
1449 			retcode = -ENOMEM;
1450 			goto error_register;
1451 		}
1452 
1453 		/* Protect interrupt in endpoint data until iin_urb is freed */
1454 		kref_get(&data->kref);
1455 
1456 		/* allocate buffer for interrupt in */
1457 		data->iin_buffer = kmalloc(data->iin_wMaxPacketSize,
1458 					GFP_KERNEL);
1459 		if (!data->iin_buffer) {
1460 			retcode = -ENOMEM;
1461 			goto error_register;
1462 		}
1463 
1464 		/* fill interrupt urb */
1465 		usb_fill_int_urb(data->iin_urb, data->usb_dev,
1466 				usb_rcvintpipe(data->usb_dev, data->iin_ep),
1467 				data->iin_buffer, data->iin_wMaxPacketSize,
1468 				usbtmc_interrupt,
1469 				data, data->iin_interval);
1470 
1471 		retcode = usb_submit_urb(data->iin_urb, GFP_KERNEL);
1472 		if (retcode) {
1473 			dev_err(&intf->dev, "Failed to submit iin_urb\n");
1474 			goto error_register;
1475 		}
1476 	}
1477 
1478 	retcode = sysfs_create_group(&intf->dev.kobj, &data_attr_grp);
1479 
1480 	retcode = usb_register_dev(intf, &usbtmc_class);
1481 	if (retcode) {
1482 		dev_err(&intf->dev, "Not able to get a minor"
1483 			" (base %u, slice default): %d\n", USBTMC_MINOR_BASE,
1484 			retcode);
1485 		goto error_register;
1486 	}
1487 	dev_dbg(&intf->dev, "Using minor number %d\n", intf->minor);
1488 
1489 	return 0;
1490 
1491 error_register:
1492 	sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp);
1493 	sysfs_remove_group(&intf->dev.kobj, &data_attr_grp);
1494 	usbtmc_free_int(data);
1495 err_put:
1496 	kref_put(&data->kref, usbtmc_delete);
1497 	return retcode;
1498 }
1499 
1500 static void usbtmc_disconnect(struct usb_interface *intf)
1501 {
1502 	struct usbtmc_device_data *data;
1503 
1504 	dev_dbg(&intf->dev, "usbtmc_disconnect called\n");
1505 
1506 	data = usb_get_intfdata(intf);
1507 	usb_deregister_dev(intf, &usbtmc_class);
1508 	sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp);
1509 	sysfs_remove_group(&intf->dev.kobj, &data_attr_grp);
1510 	mutex_lock(&data->io_mutex);
1511 	data->zombie = 1;
1512 	wake_up_all(&data->waitq);
1513 	mutex_unlock(&data->io_mutex);
1514 	usbtmc_free_int(data);
1515 	kref_put(&data->kref, usbtmc_delete);
1516 }
1517 
1518 static int usbtmc_suspend(struct usb_interface *intf, pm_message_t message)
1519 {
1520 	/* this driver does not have pending URBs */
1521 	return 0;
1522 }
1523 
1524 static int usbtmc_resume(struct usb_interface *intf)
1525 {
1526 	return 0;
1527 }
1528 
1529 static struct usb_driver usbtmc_driver = {
1530 	.name		= "usbtmc",
1531 	.id_table	= usbtmc_devices,
1532 	.probe		= usbtmc_probe,
1533 	.disconnect	= usbtmc_disconnect,
1534 	.suspend	= usbtmc_suspend,
1535 	.resume		= usbtmc_resume,
1536 };
1537 
1538 module_usb_driver(usbtmc_driver);
1539 
1540 MODULE_LICENSE("GPL");
1541