xref: /openbmc/linux/drivers/usb/image/mdc800.c (revision a2cce7a9)
1 /*
2  * copyright (C) 1999/2000 by Henning Zabel <henning@uni-paderborn.de>
3  *
4  * This program is free software; you can redistribute it and/or modify it
5  * under the terms of the GNU General Public License as published by the
6  * Free Software Foundation; either version 2 of the License, or (at your
7  * option) any later version.
8  *
9  * This program is distributed in the hope that it will be useful, but
10  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
11  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
12  * for more details.
13  *
14  * You should have received a copy of the GNU General Public License
15  * along with this program; if not, write to the Free Software Foundation,
16  * Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
17  */
18 
19 
20 /*
21  *	USB-Kernel Driver for the Mustek MDC800 Digital Camera
22  *	(c) 1999/2000 Henning Zabel <henning@uni-paderborn.de>
23  *
24  *
25  * The driver brings the USB functions of the MDC800 to Linux.
26  * To use the Camera you must support the USB Protocol of the camera
27  * to the Kernel Node.
28  * The Driver uses a misc device Node. Create it with :
29  * mknod /dev/mustek c 180 32
30  *
31  * The driver supports only one camera.
32  *
33  * Fix: mdc800 used sleep_on and slept with io_lock held.
34  * Converted sleep_on to waitqueues with schedule_timeout and made io_lock
35  * a semaphore from a spinlock.
36  * by Oliver Neukum <oliver@neukum.name>
37  * (02/12/2001)
38  *
39  * Identify version on module load.
40  * (08/04/2001) gb
41  *
42  * version 0.7.5
43  * Fixed potential SMP races with Spinlocks.
44  * Thanks to Oliver Neukum <oliver@neukum.name> who
45  * noticed the race conditions.
46  * (30/10/2000)
47  *
48  * Fixed: Setting urb->dev before submitting urb.
49  * by Greg KH <greg@kroah.com>
50  * (13/10/2000)
51  *
52  * version 0.7.3
53  * bugfix : The mdc800->state field gets set to READY after the
54  * the disconnect function sets it to NOT_CONNECTED. This makes the
55  * driver running like the camera is connected and causes some
56  * hang ups.
57  *
58  * version 0.7.1
59  * MOD_INC and MOD_DEC are changed in usb_probe to prevent load/unload
60  * problems when compiled as Module.
61  * (04/04/2000)
62  *
63  * The mdc800 driver gets assigned the USB Minor 32-47. The Registration
64  * was updated to use these values.
65  * (26/03/2000)
66  *
67  * The Init und Exit Module Function are updated.
68  * (01/03/2000)
69  *
70  * version 0.7.0
71  * Rewrite of the driver : The driver now uses URB's. The old stuff
72  * has been removed.
73  *
74  * version 0.6.0
75  * Rewrite of this driver: The Emulation of the rs232 protocoll
76  * has been removed from the driver. A special executeCommand function
77  * for this driver is included to gphoto.
78  * The driver supports two kind of communication to bulk endpoints.
79  * Either with the dev->bus->ops->bulk... or with callback function.
80  * (09/11/1999)
81  *
82  * version 0.5.0:
83  * first Version that gets a version number. Most of the needed
84  * functions work.
85  * (20/10/1999)
86  */
87 
88 #include <linux/sched.h>
89 #include <linux/signal.h>
90 #include <linux/spinlock.h>
91 #include <linux/errno.h>
92 #include <linux/random.h>
93 #include <linux/poll.h>
94 #include <linux/init.h>
95 #include <linux/slab.h>
96 #include <linux/module.h>
97 #include <linux/wait.h>
98 #include <linux/mutex.h>
99 
100 #include <linux/usb.h>
101 #include <linux/fs.h>
102 
103 /*
104  * Version Information
105  */
106 #define DRIVER_VERSION "v0.7.5 (30/10/2000)"
107 #define DRIVER_AUTHOR "Henning Zabel <henning@uni-paderborn.de>"
108 #define DRIVER_DESC "USB Driver for Mustek MDC800 Digital Camera"
109 
110 /* Vendor and Product Information */
111 #define MDC800_VENDOR_ID 	0x055f
112 #define MDC800_PRODUCT_ID	0xa800
113 
114 /* Timeouts (msec) */
115 #define TO_DOWNLOAD_GET_READY		1500
116 #define TO_DOWNLOAD_GET_BUSY		1500
117 #define TO_WRITE_GET_READY		1000
118 #define TO_DEFAULT_COMMAND		5000
119 #define TO_READ_FROM_IRQ 		TO_DEFAULT_COMMAND
120 #define TO_GET_READY			TO_DEFAULT_COMMAND
121 
122 /* Minor Number of the device (create with mknod /dev/mustek c 180 32) */
123 #define MDC800_DEVICE_MINOR_BASE 32
124 
125 
126 /**************************************************************************
127 	Data and structs
128 ***************************************************************************/
129 
130 
131 typedef enum {
132 	NOT_CONNECTED, READY, WORKING, DOWNLOAD
133 } mdc800_state;
134 
135 
136 /* Data for the driver */
137 struct mdc800_data
138 {
139 	struct usb_device *	dev;			// Device Data
140 	mdc800_state 		state;
141 
142 	unsigned int		endpoint [4];
143 
144 	struct urb *		irq_urb;
145 	wait_queue_head_t	irq_wait;
146 	int			irq_woken;
147 	char*			irq_urb_buffer;
148 
149 	int			camera_busy;          // is camera busy ?
150 	int 			camera_request_ready; // Status to synchronize with irq
151 	char 			camera_response [8];  // last Bytes send after busy
152 
153 	struct urb *   		write_urb;
154 	char*			write_urb_buffer;
155 	wait_queue_head_t	write_wait;
156 	int			written;
157 
158 
159 	struct urb *   		download_urb;
160 	char*			download_urb_buffer;
161 	wait_queue_head_t	download_wait;
162 	int			downloaded;
163 	int			download_left;		// Bytes left to download ?
164 
165 
166 	/* Device Data */
167 	char			out [64];	// Answer Buffer
168 	int 			out_ptr;	// Index to the first not readen byte
169 	int			out_count;	// Bytes in the buffer
170 
171 	int			open;		// Camera device open ?
172 	struct mutex		io_lock;	// IO -lock
173 
174 	char 			in [8];		// Command Input Buffer
175 	int  			in_count;
176 
177 	int			pic_index;	// Cache for the Imagesize (-1 for nothing cached )
178 	int			pic_len;
179 	int			minor;
180 };
181 
182 
183 /* Specification of the Endpoints */
184 static struct usb_endpoint_descriptor mdc800_ed [4] =
185 {
186 	{
187 		.bLength = 		0,
188 		.bDescriptorType =	0,
189 		.bEndpointAddress =	0x01,
190 		.bmAttributes = 	0x02,
191 		.wMaxPacketSize =	cpu_to_le16(8),
192 		.bInterval = 		0,
193 		.bRefresh = 		0,
194 		.bSynchAddress = 	0,
195 	},
196 	{
197 		.bLength = 		0,
198 		.bDescriptorType = 	0,
199 		.bEndpointAddress = 	0x82,
200 		.bmAttributes = 	0x03,
201 		.wMaxPacketSize = 	cpu_to_le16(8),
202 		.bInterval = 		0,
203 		.bRefresh = 		0,
204 		.bSynchAddress = 	0,
205 	},
206 	{
207 		.bLength = 		0,
208 		.bDescriptorType = 	0,
209 		.bEndpointAddress = 	0x03,
210 		.bmAttributes = 	0x02,
211 		.wMaxPacketSize = 	cpu_to_le16(64),
212 		.bInterval = 		0,
213 		.bRefresh = 		0,
214 		.bSynchAddress = 	0,
215 	},
216 	{
217 		.bLength = 		0,
218 		.bDescriptorType = 	0,
219 		.bEndpointAddress = 	0x84,
220 		.bmAttributes = 	0x02,
221 		.wMaxPacketSize = 	cpu_to_le16(64),
222 		.bInterval = 		0,
223 		.bRefresh = 		0,
224 		.bSynchAddress = 	0,
225 	},
226 };
227 
228 /* The Variable used by the driver */
229 static struct mdc800_data* mdc800;
230 
231 
232 /***************************************************************************
233 	The USB Part of the driver
234 ****************************************************************************/
235 
236 static int mdc800_endpoint_equals (struct usb_endpoint_descriptor *a,struct usb_endpoint_descriptor *b)
237 {
238 	return (
239 		   ( a->bEndpointAddress == b->bEndpointAddress )
240 		&& ( a->bmAttributes     == b->bmAttributes     )
241 		&& ( a->wMaxPacketSize   == b->wMaxPacketSize   )
242 	);
243 }
244 
245 
246 /*
247  * Checks whether the camera responds busy
248  */
249 static int mdc800_isBusy (char* ch)
250 {
251 	int i=0;
252 	while (i<8)
253 	{
254 		if (ch [i] != (char)0x99)
255 			return 0;
256 		i++;
257 	}
258 	return 1;
259 }
260 
261 
262 /*
263  * Checks whether the Camera is ready
264  */
265 static int mdc800_isReady (char *ch)
266 {
267 	int i=0;
268 	while (i<8)
269 	{
270 		if (ch [i] != (char)0xbb)
271 			return 0;
272 		i++;
273 	}
274 	return 1;
275 }
276 
277 
278 
279 /*
280  * USB IRQ Handler for InputLine
281  */
282 static void mdc800_usb_irq (struct urb *urb)
283 {
284 	int data_received=0, wake_up;
285 	unsigned char* b=urb->transfer_buffer;
286 	struct mdc800_data* mdc800=urb->context;
287 	struct device *dev = &mdc800->dev->dev;
288 	int status = urb->status;
289 
290 	if (status >= 0) {
291 		if (mdc800_isBusy (b))
292 		{
293 			if (!mdc800->camera_busy)
294 			{
295 				mdc800->camera_busy=1;
296 				dev_dbg(dev, "gets busy\n");
297 			}
298 		}
299 		else
300 		{
301 			if (mdc800->camera_busy && mdc800_isReady (b))
302 			{
303 				mdc800->camera_busy=0;
304 				dev_dbg(dev, "gets ready\n");
305 			}
306 		}
307 		if (!(mdc800_isBusy (b) || mdc800_isReady (b)))
308 		{
309 			/* Store Data in camera_answer field */
310 			dev_dbg(dev, "%i %i %i %i %i %i %i %i \n",b[0],b[1],b[2],b[3],b[4],b[5],b[6],b[7]);
311 
312 			memcpy (mdc800->camera_response,b,8);
313 			data_received=1;
314 		}
315 	}
316 	wake_up= ( mdc800->camera_request_ready > 0 )
317 		&&
318 		(
319 			((mdc800->camera_request_ready == 1) && (!mdc800->camera_busy))
320 		||
321 			((mdc800->camera_request_ready == 2) && data_received)
322 		||
323 			((mdc800->camera_request_ready == 3) && (mdc800->camera_busy))
324 		||
325 			(status < 0)
326 		);
327 
328 	if (wake_up)
329 	{
330 		mdc800->camera_request_ready=0;
331 		mdc800->irq_woken=1;
332 		wake_up (&mdc800->irq_wait);
333 	}
334 }
335 
336 
337 /*
338  * Waits a while until the irq responds that camera is ready
339  *
340  *  mode : 0: Wait for camera gets ready
341  *         1: Wait for receiving data
342  *         2: Wait for camera gets busy
343  *
344  * msec: Time to wait
345  */
346 static int mdc800_usb_waitForIRQ (int mode, int msec)
347 {
348 	mdc800->camera_request_ready=1+mode;
349 
350 	wait_event_timeout(mdc800->irq_wait, mdc800->irq_woken,
351 			   msecs_to_jiffies(msec));
352 	mdc800->irq_woken = 0;
353 
354 	if (mdc800->camera_request_ready>0)
355 	{
356 		mdc800->camera_request_ready=0;
357 		dev_err(&mdc800->dev->dev, "timeout waiting for camera.\n");
358 		return -1;
359 	}
360 
361 	if (mdc800->state == NOT_CONNECTED)
362 	{
363 		printk(KERN_WARNING "mdc800: Camera gets disconnected "
364 		       "during waiting for irq.\n");
365 		mdc800->camera_request_ready=0;
366 		return -2;
367 	}
368 
369 	return 0;
370 }
371 
372 
373 /*
374  * The write_urb callback function
375  */
376 static void mdc800_usb_write_notify (struct urb *urb)
377 {
378 	struct mdc800_data* mdc800=urb->context;
379 	int status = urb->status;
380 
381 	if (status != 0)
382 		dev_err(&mdc800->dev->dev,
383 			"writing command fails (status=%i)\n", status);
384 	else
385 		mdc800->state=READY;
386 	mdc800->written = 1;
387 	wake_up (&mdc800->write_wait);
388 }
389 
390 
391 /*
392  * The download_urb callback function
393  */
394 static void mdc800_usb_download_notify (struct urb *urb)
395 {
396 	struct mdc800_data* mdc800=urb->context;
397 	int status = urb->status;
398 
399 	if (status == 0) {
400 		/* Fill output buffer with these data */
401 		memcpy (mdc800->out,  urb->transfer_buffer, 64);
402 		mdc800->out_count=64;
403 		mdc800->out_ptr=0;
404 		mdc800->download_left-=64;
405 		if (mdc800->download_left == 0)
406 		{
407 			mdc800->state=READY;
408 		}
409 	} else {
410 		dev_err(&mdc800->dev->dev,
411 			"request bytes fails (status:%i)\n", status);
412 	}
413 	mdc800->downloaded = 1;
414 	wake_up (&mdc800->download_wait);
415 }
416 
417 
418 /***************************************************************************
419 	Probing for the Camera
420  ***************************************************************************/
421 
422 static struct usb_driver mdc800_usb_driver;
423 static const struct file_operations mdc800_device_ops;
424 static struct usb_class_driver mdc800_class = {
425 	.name =		"mdc800%d",
426 	.fops =		&mdc800_device_ops,
427 	.minor_base =	MDC800_DEVICE_MINOR_BASE,
428 };
429 
430 
431 /*
432  * Callback to search the Mustek MDC800 on the USB Bus
433  */
434 static int mdc800_usb_probe (struct usb_interface *intf,
435 			       const struct usb_device_id *id)
436 {
437 	int i,j;
438 	struct usb_host_interface *intf_desc;
439 	struct usb_device *dev = interface_to_usbdev (intf);
440 	int irq_interval=0;
441 	int retval;
442 
443 	dev_dbg(&intf->dev, "(%s) called.\n", __func__);
444 
445 
446 	if (mdc800->dev != NULL)
447 	{
448 		dev_warn(&intf->dev, "only one Mustek MDC800 is supported.\n");
449 		return -ENODEV;
450 	}
451 
452 	if (dev->descriptor.bNumConfigurations != 1)
453 	{
454 		dev_err(&intf->dev,
455 			"probe fails -> wrong Number of Configuration\n");
456 		return -ENODEV;
457 	}
458 	intf_desc = intf->cur_altsetting;
459 
460 	if (
461 			( intf_desc->desc.bInterfaceClass != 0xff )
462 		||	( intf_desc->desc.bInterfaceSubClass != 0 )
463 		|| ( intf_desc->desc.bInterfaceProtocol != 0 )
464 		|| ( intf_desc->desc.bNumEndpoints != 4)
465 	)
466 	{
467 		dev_err(&intf->dev, "probe fails -> wrong Interface\n");
468 		return -ENODEV;
469 	}
470 
471 	/* Check the Endpoints */
472 	for (i=0; i<4; i++)
473 	{
474 		mdc800->endpoint[i]=-1;
475 		for (j=0; j<4; j++)
476 		{
477 			if (mdc800_endpoint_equals (&intf_desc->endpoint [j].desc,&mdc800_ed [i]))
478 			{
479 				mdc800->endpoint[i]=intf_desc->endpoint [j].desc.bEndpointAddress ;
480 				if (i==1)
481 				{
482 					irq_interval=intf_desc->endpoint [j].desc.bInterval;
483 				}
484 			}
485 		}
486 		if (mdc800->endpoint[i] == -1)
487 		{
488 			dev_err(&intf->dev, "probe fails -> Wrong Endpoints.\n");
489 			return -ENODEV;
490 		}
491 	}
492 
493 
494 	dev_info(&intf->dev, "Found Mustek MDC800 on USB.\n");
495 
496 	mutex_lock(&mdc800->io_lock);
497 
498 	retval = usb_register_dev(intf, &mdc800_class);
499 	if (retval) {
500 		dev_err(&intf->dev, "Not able to get a minor for this device.\n");
501 		mutex_unlock(&mdc800->io_lock);
502 		return -ENODEV;
503 	}
504 
505 	mdc800->dev=dev;
506 	mdc800->open=0;
507 
508 	/* Setup URB Structs */
509 	usb_fill_int_urb (
510 		mdc800->irq_urb,
511 		mdc800->dev,
512 		usb_rcvintpipe (mdc800->dev,mdc800->endpoint [1]),
513 		mdc800->irq_urb_buffer,
514 		8,
515 		mdc800_usb_irq,
516 		mdc800,
517 		irq_interval
518 	);
519 
520 	usb_fill_bulk_urb (
521 		mdc800->write_urb,
522 		mdc800->dev,
523 		usb_sndbulkpipe (mdc800->dev, mdc800->endpoint[0]),
524 		mdc800->write_urb_buffer,
525 		8,
526 		mdc800_usb_write_notify,
527 		mdc800
528 	);
529 
530 	usb_fill_bulk_urb (
531 		mdc800->download_urb,
532 		mdc800->dev,
533 		usb_rcvbulkpipe (mdc800->dev, mdc800->endpoint [3]),
534 		mdc800->download_urb_buffer,
535 		64,
536 		mdc800_usb_download_notify,
537 		mdc800
538 	);
539 
540 	mdc800->state=READY;
541 
542 	mutex_unlock(&mdc800->io_lock);
543 
544 	usb_set_intfdata(intf, mdc800);
545 	return 0;
546 }
547 
548 
549 /*
550  * Disconnect USB device (maybe the MDC800)
551  */
552 static void mdc800_usb_disconnect (struct usb_interface *intf)
553 {
554 	struct mdc800_data* mdc800 = usb_get_intfdata(intf);
555 
556 	dev_dbg(&intf->dev, "(%s) called\n", __func__);
557 
558 	if (mdc800) {
559 		if (mdc800->state == NOT_CONNECTED)
560 			return;
561 
562 		usb_deregister_dev(intf, &mdc800_class);
563 
564 		/* must be under lock to make sure no URB
565 		   is submitted after usb_kill_urb() */
566 		mutex_lock(&mdc800->io_lock);
567 		mdc800->state=NOT_CONNECTED;
568 
569 		usb_kill_urb(mdc800->irq_urb);
570 		usb_kill_urb(mdc800->write_urb);
571 		usb_kill_urb(mdc800->download_urb);
572 		mutex_unlock(&mdc800->io_lock);
573 
574 		mdc800->dev = NULL;
575 		usb_set_intfdata(intf, NULL);
576 	}
577 	dev_info(&intf->dev, "Mustek MDC800 disconnected from USB.\n");
578 }
579 
580 
581 /***************************************************************************
582 	The Misc device Part (file_operations)
583 ****************************************************************************/
584 
585 /*
586  * This Function calc the Answersize for a command.
587  */
588 static int mdc800_getAnswerSize (char command)
589 {
590 	switch ((unsigned char) command)
591 	{
592 		case 0x2a:
593 		case 0x49:
594 		case 0x51:
595 		case 0x0d:
596 		case 0x20:
597 		case 0x07:
598 		case 0x01:
599 		case 0x25:
600 		case 0x00:
601 			return 8;
602 
603 		case 0x05:
604 		case 0x3e:
605 			return mdc800->pic_len;
606 
607 		case 0x09:
608 			return 4096;
609 
610 		default:
611 			return 0;
612 	}
613 }
614 
615 
616 /*
617  * Init the device: (1) alloc mem (2) Increase MOD Count ..
618  */
619 static int mdc800_device_open (struct inode* inode, struct file *file)
620 {
621 	int retval=0;
622 	int errn=0;
623 
624 	mutex_lock(&mdc800->io_lock);
625 
626 	if (mdc800->state == NOT_CONNECTED)
627 	{
628 		errn=-EBUSY;
629 		goto error_out;
630 	}
631 	if (mdc800->open)
632 	{
633 		errn=-EBUSY;
634 		goto error_out;
635 	}
636 
637 	mdc800->in_count=0;
638 	mdc800->out_count=0;
639 	mdc800->out_ptr=0;
640 	mdc800->pic_index=0;
641 	mdc800->pic_len=-1;
642 	mdc800->download_left=0;
643 
644 	mdc800->camera_busy=0;
645 	mdc800->camera_request_ready=0;
646 
647 	retval=0;
648 	mdc800->irq_urb->dev = mdc800->dev;
649 	retval = usb_submit_urb (mdc800->irq_urb, GFP_KERNEL);
650 	if (retval) {
651 		dev_err(&mdc800->dev->dev,
652 			"request USB irq fails (submit_retval=%i).\n", retval);
653 		errn = -EIO;
654 		goto error_out;
655 	}
656 
657 	mdc800->open=1;
658 	dev_dbg(&mdc800->dev->dev, "Mustek MDC800 device opened.\n");
659 
660 error_out:
661 	mutex_unlock(&mdc800->io_lock);
662 	return errn;
663 }
664 
665 
666 /*
667  * Close the Camera and release Memory
668  */
669 static int mdc800_device_release (struct inode* inode, struct file *file)
670 {
671 	int retval=0;
672 
673 	mutex_lock(&mdc800->io_lock);
674 	if (mdc800->open && (mdc800->state != NOT_CONNECTED))
675 	{
676 		usb_kill_urb(mdc800->irq_urb);
677 		usb_kill_urb(mdc800->write_urb);
678 		usb_kill_urb(mdc800->download_urb);
679 		mdc800->open=0;
680 	}
681 	else
682 	{
683 		retval=-EIO;
684 	}
685 
686 	mutex_unlock(&mdc800->io_lock);
687 	return retval;
688 }
689 
690 
691 /*
692  * The Device read callback Function
693  */
694 static ssize_t mdc800_device_read (struct file *file, char __user *buf, size_t len, loff_t *pos)
695 {
696 	size_t left=len, sts=len; /* single transfer size */
697 	char __user *ptr = buf;
698 	int retval;
699 
700 	mutex_lock(&mdc800->io_lock);
701 	if (mdc800->state == NOT_CONNECTED)
702 	{
703 		mutex_unlock(&mdc800->io_lock);
704 		return -EBUSY;
705 	}
706 	if (mdc800->state == WORKING)
707 	{
708 		printk(KERN_WARNING "mdc800: Illegal State \"working\""
709 		       "reached during read ?!\n");
710 		mutex_unlock(&mdc800->io_lock);
711 		return -EBUSY;
712 	}
713 	if (!mdc800->open)
714 	{
715 		mutex_unlock(&mdc800->io_lock);
716 		return -EBUSY;
717 	}
718 
719 	while (left)
720 	{
721 		if (signal_pending (current))
722 		{
723 			mutex_unlock(&mdc800->io_lock);
724 			return -EINTR;
725 		}
726 
727 		sts=left > (mdc800->out_count-mdc800->out_ptr)?mdc800->out_count-mdc800->out_ptr:left;
728 
729 		if (sts <= 0)
730 		{
731 			/* Too less Data in buffer */
732 			if (mdc800->state == DOWNLOAD)
733 			{
734 				mdc800->out_count=0;
735 				mdc800->out_ptr=0;
736 
737 				/* Download -> Request new bytes */
738 				mdc800->download_urb->dev = mdc800->dev;
739 				retval = usb_submit_urb (mdc800->download_urb, GFP_KERNEL);
740 				if (retval) {
741 					dev_err(&mdc800->dev->dev,
742 						"Can't submit download urb "
743 						"(retval=%i)\n", retval);
744 					mutex_unlock(&mdc800->io_lock);
745 					return len-left;
746 				}
747 				wait_event_timeout(mdc800->download_wait,
748 				     mdc800->downloaded,
749 				     msecs_to_jiffies(TO_DOWNLOAD_GET_READY));
750 				mdc800->downloaded = 0;
751 				if (mdc800->download_urb->status != 0)
752 				{
753 					dev_err(&mdc800->dev->dev,
754 						"request download-bytes fails "
755 						"(status=%i)\n",
756 						mdc800->download_urb->status);
757 					mutex_unlock(&mdc800->io_lock);
758 					return len-left;
759 				}
760 			}
761 			else
762 			{
763 				/* No more bytes -> that's an error*/
764 				mutex_unlock(&mdc800->io_lock);
765 				return -EIO;
766 			}
767 		}
768 		else
769 		{
770 			/* Copy Bytes */
771 			if (copy_to_user(ptr, &mdc800->out [mdc800->out_ptr],
772 						sts)) {
773 				mutex_unlock(&mdc800->io_lock);
774 				return -EFAULT;
775 			}
776 			ptr+=sts;
777 			left-=sts;
778 			mdc800->out_ptr+=sts;
779 		}
780 	}
781 
782 	mutex_unlock(&mdc800->io_lock);
783 	return len-left;
784 }
785 
786 
787 /*
788  * The Device write callback Function
789  * If a 8Byte Command is received, it will be send to the camera.
790  * After this the driver initiates the request for the answer or
791  * just waits until the camera becomes ready.
792  */
793 static ssize_t mdc800_device_write (struct file *file, const char __user *buf, size_t len, loff_t *pos)
794 {
795 	size_t i=0;
796 	int retval;
797 
798 	mutex_lock(&mdc800->io_lock);
799 	if (mdc800->state != READY)
800 	{
801 		mutex_unlock(&mdc800->io_lock);
802 		return -EBUSY;
803 	}
804 	if (!mdc800->open )
805 	{
806 		mutex_unlock(&mdc800->io_lock);
807 		return -EBUSY;
808 	}
809 
810 	while (i<len)
811 	{
812 		unsigned char c;
813 		if (signal_pending (current))
814 		{
815 			mutex_unlock(&mdc800->io_lock);
816 			return -EINTR;
817 		}
818 
819 		if(get_user(c, buf+i))
820 		{
821 			mutex_unlock(&mdc800->io_lock);
822 			return -EFAULT;
823 		}
824 
825 		/* check for command start */
826 		if (c == 0x55)
827 		{
828 			mdc800->in_count=0;
829 			mdc800->out_count=0;
830 			mdc800->out_ptr=0;
831 			mdc800->download_left=0;
832 		}
833 
834 		/* save command byte */
835 		if (mdc800->in_count < 8)
836 		{
837 			mdc800->in[mdc800->in_count] = c;
838 			mdc800->in_count++;
839 		}
840 		else
841 		{
842 			mutex_unlock(&mdc800->io_lock);
843 			return -EIO;
844 		}
845 
846 		/* Command Buffer full ? -> send it to camera */
847 		if (mdc800->in_count == 8)
848 		{
849 			int answersize;
850 
851 			if (mdc800_usb_waitForIRQ (0,TO_GET_READY))
852 			{
853 				dev_err(&mdc800->dev->dev,
854 					"Camera didn't get ready.\n");
855 				mutex_unlock(&mdc800->io_lock);
856 				return -EIO;
857 			}
858 
859 			answersize=mdc800_getAnswerSize (mdc800->in[1]);
860 
861 			mdc800->state=WORKING;
862 			memcpy (mdc800->write_urb->transfer_buffer, mdc800->in,8);
863 			mdc800->write_urb->dev = mdc800->dev;
864 			retval = usb_submit_urb (mdc800->write_urb, GFP_KERNEL);
865 			if (retval) {
866 				dev_err(&mdc800->dev->dev,
867 					"submitting write urb fails "
868 					"(retval=%i)\n", retval);
869 				mutex_unlock(&mdc800->io_lock);
870 				return -EIO;
871 			}
872 			wait_event_timeout(mdc800->write_wait, mdc800->written,
873 					msecs_to_jiffies(TO_WRITE_GET_READY));
874 			mdc800->written = 0;
875 			if (mdc800->state == WORKING)
876 			{
877 				usb_kill_urb(mdc800->write_urb);
878 				mutex_unlock(&mdc800->io_lock);
879 				return -EIO;
880 			}
881 
882 			switch ((unsigned char) mdc800->in[1])
883 			{
884 				case 0x05: /* Download Image */
885 				case 0x3e: /* Take shot in Fine Mode (WCam Mode) */
886 					if (mdc800->pic_len < 0)
887 					{
888 						dev_err(&mdc800->dev->dev,
889 							"call 0x07 before "
890 							"0x05,0x3e\n");
891 						mdc800->state=READY;
892 						mutex_unlock(&mdc800->io_lock);
893 						return -EIO;
894 					}
895 					mdc800->pic_len=-1;
896 
897 				case 0x09: /* Download Thumbnail */
898 					mdc800->download_left=answersize+64;
899 					mdc800->state=DOWNLOAD;
900 					mdc800_usb_waitForIRQ (0,TO_DOWNLOAD_GET_BUSY);
901 					break;
902 
903 
904 				default:
905 					if (answersize)
906 					{
907 
908 						if (mdc800_usb_waitForIRQ (1,TO_READ_FROM_IRQ))
909 						{
910 							dev_err(&mdc800->dev->dev, "requesting answer from irq fails\n");
911 							mutex_unlock(&mdc800->io_lock);
912 							return -EIO;
913 						}
914 
915 						/* Write dummy data, (this is ugly but part of the USB Protocol */
916 						/* if you use endpoint 1 as bulk and not as irq) */
917 						memcpy (mdc800->out, mdc800->camera_response,8);
918 
919 						/* This is the interpreted answer */
920 						memcpy (&mdc800->out[8], mdc800->camera_response,8);
921 
922 						mdc800->out_ptr=0;
923 						mdc800->out_count=16;
924 
925 						/* Cache the Imagesize, if command was getImageSize */
926 						if (mdc800->in [1] == (char) 0x07)
927 						{
928 							mdc800->pic_len=(int) 65536*(unsigned char) mdc800->camera_response[0]+256*(unsigned char) mdc800->camera_response[1]+(unsigned char) mdc800->camera_response[2];
929 
930 							dev_dbg(&mdc800->dev->dev, "cached imagesize = %i\n", mdc800->pic_len);
931 						}
932 
933 					}
934 					else
935 					{
936 						if (mdc800_usb_waitForIRQ (0,TO_DEFAULT_COMMAND))
937 						{
938 							dev_err(&mdc800->dev->dev, "Command Timeout.\n");
939 							mutex_unlock(&mdc800->io_lock);
940 							return -EIO;
941 						}
942 					}
943 					mdc800->state=READY;
944 					break;
945 			}
946 		}
947 		i++;
948 	}
949 	mutex_unlock(&mdc800->io_lock);
950 	return i;
951 }
952 
953 
954 /***************************************************************************
955 	Init and Cleanup this driver (Structs and types)
956 ****************************************************************************/
957 
958 /* File Operations of this drivers */
959 static const struct file_operations mdc800_device_ops =
960 {
961 	.owner =	THIS_MODULE,
962 	.read =		mdc800_device_read,
963 	.write =	mdc800_device_write,
964 	.open =		mdc800_device_open,
965 	.release =	mdc800_device_release,
966 	.llseek =	noop_llseek,
967 };
968 
969 
970 
971 static const struct usb_device_id mdc800_table[] = {
972 	{ USB_DEVICE(MDC800_VENDOR_ID, MDC800_PRODUCT_ID) },
973 	{ }						/* Terminating entry */
974 };
975 
976 MODULE_DEVICE_TABLE (usb, mdc800_table);
977 /*
978  * USB Driver Struct for this device
979  */
980 static struct usb_driver mdc800_usb_driver =
981 {
982 	.name =		"mdc800",
983 	.probe =	mdc800_usb_probe,
984 	.disconnect =	mdc800_usb_disconnect,
985 	.id_table =	mdc800_table
986 };
987 
988 
989 
990 /************************************************************************
991 	Init and Cleanup this driver (Main Functions)
992 *************************************************************************/
993 
994 static int __init usb_mdc800_init (void)
995 {
996 	int retval = -ENODEV;
997 	/* Allocate Memory */
998 	mdc800=kzalloc (sizeof (struct mdc800_data), GFP_KERNEL);
999 	if (!mdc800)
1000 		goto cleanup_on_fail;
1001 
1002 	mdc800->dev = NULL;
1003 	mdc800->state=NOT_CONNECTED;
1004 	mutex_init (&mdc800->io_lock);
1005 
1006 	init_waitqueue_head (&mdc800->irq_wait);
1007 	init_waitqueue_head (&mdc800->write_wait);
1008 	init_waitqueue_head (&mdc800->download_wait);
1009 
1010 	mdc800->irq_woken = 0;
1011 	mdc800->downloaded = 0;
1012 	mdc800->written = 0;
1013 
1014 	mdc800->irq_urb_buffer=kmalloc (8, GFP_KERNEL);
1015 	if (!mdc800->irq_urb_buffer)
1016 		goto cleanup_on_fail;
1017 	mdc800->write_urb_buffer=kmalloc (8, GFP_KERNEL);
1018 	if (!mdc800->write_urb_buffer)
1019 		goto cleanup_on_fail;
1020 	mdc800->download_urb_buffer=kmalloc (64, GFP_KERNEL);
1021 	if (!mdc800->download_urb_buffer)
1022 		goto cleanup_on_fail;
1023 
1024 	mdc800->irq_urb=usb_alloc_urb (0, GFP_KERNEL);
1025 	if (!mdc800->irq_urb)
1026 		goto cleanup_on_fail;
1027 	mdc800->download_urb=usb_alloc_urb (0, GFP_KERNEL);
1028 	if (!mdc800->download_urb)
1029 		goto cleanup_on_fail;
1030 	mdc800->write_urb=usb_alloc_urb (0, GFP_KERNEL);
1031 	if (!mdc800->write_urb)
1032 		goto cleanup_on_fail;
1033 
1034 	/* Register the driver */
1035 	retval = usb_register(&mdc800_usb_driver);
1036 	if (retval)
1037 		goto cleanup_on_fail;
1038 
1039 	printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_VERSION ":"
1040 	       DRIVER_DESC "\n");
1041 
1042 	return 0;
1043 
1044 	/* Clean driver up, when something fails */
1045 
1046 cleanup_on_fail:
1047 
1048 	if (mdc800 != NULL)
1049 	{
1050 		printk(KERN_ERR "mdc800: can't alloc memory!\n");
1051 
1052 		kfree(mdc800->download_urb_buffer);
1053 		kfree(mdc800->write_urb_buffer);
1054 		kfree(mdc800->irq_urb_buffer);
1055 
1056 		usb_free_urb(mdc800->write_urb);
1057 		usb_free_urb(mdc800->download_urb);
1058 		usb_free_urb(mdc800->irq_urb);
1059 
1060 		kfree (mdc800);
1061 	}
1062 	mdc800 = NULL;
1063 	return retval;
1064 }
1065 
1066 
1067 static void __exit usb_mdc800_cleanup (void)
1068 {
1069 	usb_deregister (&mdc800_usb_driver);
1070 
1071 	usb_free_urb (mdc800->irq_urb);
1072 	usb_free_urb (mdc800->download_urb);
1073 	usb_free_urb (mdc800->write_urb);
1074 
1075 	kfree (mdc800->irq_urb_buffer);
1076 	kfree (mdc800->write_urb_buffer);
1077 	kfree (mdc800->download_urb_buffer);
1078 
1079 	kfree (mdc800);
1080 	mdc800 = NULL;
1081 }
1082 
1083 module_init (usb_mdc800_init);
1084 module_exit (usb_mdc800_cleanup);
1085 
1086 MODULE_AUTHOR( DRIVER_AUTHOR );
1087 MODULE_DESCRIPTION( DRIVER_DESC );
1088 MODULE_LICENSE("GPL");
1089 
1090