xref: /openbmc/linux/drivers/usb/misc/legousbtower.c (revision fa5e146e)
1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * LEGO USB Tower driver
4  *
5  * Copyright (C) 2003 David Glance <davidgsf@sourceforge.net>
6  *               2001-2004 Juergen Stuber <starblue@users.sourceforge.net>
7  *
8  * derived from USB Skeleton driver - 0.5
9  * Copyright (C) 2001 Greg Kroah-Hartman (greg@kroah.com)
10  *
11  * History:
12  *
13  * 2001-10-13 - 0.1 js
14  *   - first version
15  * 2001-11-03 - 0.2 js
16  *   - simplified buffering, one-shot URBs for writing
17  * 2001-11-10 - 0.3 js
18  *   - removed IOCTL (setting power/mode is more complicated, postponed)
19  * 2001-11-28 - 0.4 js
20  *   - added vendor commands for mode of operation and power level in open
21  * 2001-12-04 - 0.5 js
22  *   - set IR mode by default (by oversight 0.4 set VLL mode)
23  * 2002-01-11 - 0.5? pcchan
24  *   - make read buffer reusable and work around bytes_to_write issue between
25  *     uhci and legusbtower
26  * 2002-09-23 - 0.52 david (david@csse.uwa.edu.au)
27  *   - imported into lejos project
28  *   - changed wake_up to wake_up_interruptible
29  *   - changed to use lego0 rather than tower0
30  *   - changed dbg() to use __func__ rather than deprecated __func__
31  * 2003-01-12 - 0.53 david (david@csse.uwa.edu.au)
32  *   - changed read and write to write everything or
33  *     timeout (from a patch by Chris Riesen and Brett Thaeler driver)
34  *   - added ioctl functionality to set timeouts
35  * 2003-07-18 - 0.54 davidgsf (david@csse.uwa.edu.au)
36  *   - initial import into LegoUSB project
37  *   - merge of existing LegoUSB.c driver
38  * 2003-07-18 - 0.56 davidgsf (david@csse.uwa.edu.au)
39  *   - port to 2.6 style driver
40  * 2004-02-29 - 0.6 Juergen Stuber <starblue@users.sourceforge.net>
41  *   - fix locking
42  *   - unlink read URBs which are no longer needed
43  *   - allow increased buffer size, eliminates need for timeout on write
44  *   - have read URB running continuously
45  *   - added poll
46  *   - forbid seeking
47  *   - added nonblocking I/O
48  *   - changed back __func__ to __func__
49  *   - read and log tower firmware version
50  *   - reset tower on probe, avoids failure of first write
51  * 2004-03-09 - 0.7 Juergen Stuber <starblue@users.sourceforge.net>
52  *   - timeout read now only after inactivity, shorten default accordingly
53  * 2004-03-11 - 0.8 Juergen Stuber <starblue@users.sourceforge.net>
54  *   - log major, minor instead of possibly confusing device filename
55  *   - whitespace cleanup
56  * 2004-03-12 - 0.9 Juergen Stuber <starblue@users.sourceforge.net>
57  *   - normalize whitespace in debug messages
58  *   - take care about endianness in control message responses
59  * 2004-03-13 - 0.91 Juergen Stuber <starblue@users.sourceforge.net>
60  *   - make default intervals longer to accommodate current EHCI driver
61  * 2004-03-19 - 0.92 Juergen Stuber <starblue@users.sourceforge.net>
62  *   - replaced atomic_t by memory barriers
63  * 2004-04-21 - 0.93 Juergen Stuber <starblue@users.sourceforge.net>
64  *   - wait for completion of write urb in release (needed for remotecontrol)
65  *   - corrected poll for write direction (missing negation)
66  * 2004-04-22 - 0.94 Juergen Stuber <starblue@users.sourceforge.net>
67  *   - make device locking interruptible
68  * 2004-04-30 - 0.95 Juergen Stuber <starblue@users.sourceforge.net>
69  *   - check for valid udev on resubmitting and unlinking urbs
70  * 2004-08-03 - 0.96 Juergen Stuber <starblue@users.sourceforge.net>
71  *   - move reset into open to clean out spurious data
72  */
73 
74 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
75 
76 #include <linux/kernel.h>
77 #include <linux/errno.h>
78 #include <linux/slab.h>
79 #include <linux/module.h>
80 #include <linux/completion.h>
81 #include <linux/mutex.h>
82 #include <linux/uaccess.h>
83 #include <linux/usb.h>
84 #include <linux/poll.h>
85 
86 
87 #define DRIVER_AUTHOR "Juergen Stuber <starblue@sourceforge.net>"
88 #define DRIVER_DESC "LEGO USB Tower Driver"
89 
90 
91 /* The defaults are chosen to work with the latest versions of leJOS and NQC.
92  */
93 
94 /* Some legacy software likes to receive packets in one piece.
95  * In this case read_buffer_size should exceed the maximal packet length
96  * (417 for datalog uploads), and packet_timeout should be set.
97  */
98 static int read_buffer_size = 480;
99 module_param(read_buffer_size, int, 0);
100 MODULE_PARM_DESC(read_buffer_size, "Read buffer size");
101 
102 /* Some legacy software likes to send packets in one piece.
103  * In this case write_buffer_size should exceed the maximal packet length
104  * (417 for firmware and program downloads).
105  * A problem with long writes is that the following read may time out
106  * if the software is not prepared to wait long enough.
107  */
108 static int write_buffer_size = 480;
109 module_param(write_buffer_size, int, 0);
110 MODULE_PARM_DESC(write_buffer_size, "Write buffer size");
111 
112 /* Some legacy software expects reads to contain whole LASM packets.
113  * To achieve this, characters which arrive before a packet timeout
114  * occurs will be returned in a single read operation.
115  * A problem with long reads is that the software may time out
116  * if it is not prepared to wait long enough.
117  * The packet timeout should be greater than the time between the
118  * reception of subsequent characters, which should arrive about
119  * every 5ms for the standard 2400 baud.
120  * Set it to 0 to disable.
121  */
122 static int packet_timeout = 50;
123 module_param(packet_timeout, int, 0);
124 MODULE_PARM_DESC(packet_timeout, "Packet timeout in ms");
125 
126 /* Some legacy software expects blocking reads to time out.
127  * Timeout occurs after the specified time of read and write inactivity.
128  * Set it to 0 to disable.
129  */
130 static int read_timeout = 200;
131 module_param(read_timeout, int, 0);
132 MODULE_PARM_DESC(read_timeout, "Read timeout in ms");
133 
134 /* As of kernel version 2.6.4 ehci-hcd uses an
135  * "only one interrupt transfer per frame" shortcut
136  * to simplify the scheduling of periodic transfers.
137  * This conflicts with our standard 1ms intervals for in and out URBs.
138  * We use default intervals of 2ms for in and 8ms for out transfers,
139  * which is fast enough for 2400 baud and allows a small additional load.
140  * Increase the interval to allow more devices that do interrupt transfers,
141  * or set to 0 to use the standard interval from the endpoint descriptors.
142  */
143 static int interrupt_in_interval = 2;
144 module_param(interrupt_in_interval, int, 0);
145 MODULE_PARM_DESC(interrupt_in_interval, "Interrupt in interval in ms");
146 
147 static int interrupt_out_interval = 8;
148 module_param(interrupt_out_interval, int, 0);
149 MODULE_PARM_DESC(interrupt_out_interval, "Interrupt out interval in ms");
150 
151 /* Define these values to match your device */
152 #define LEGO_USB_TOWER_VENDOR_ID	0x0694
153 #define LEGO_USB_TOWER_PRODUCT_ID	0x0001
154 
155 /* Vendor requests */
156 #define LEGO_USB_TOWER_REQUEST_RESET		0x04
157 #define LEGO_USB_TOWER_REQUEST_GET_VERSION	0xFD
158 
159 struct tower_reset_reply {
160 	__le16 size;		/* little-endian */
161 	__u8 err_code;
162 	__u8 spare;
163 } __attribute__ ((packed));
164 
165 struct tower_get_version_reply {
166 	__le16 size;		/* little-endian */
167 	__u8 err_code;
168 	__u8 spare;
169 	__u8 major;
170 	__u8 minor;
171 	__le16 build_no;		/* little-endian */
172 } __attribute__ ((packed));
173 
174 
175 /* table of devices that work with this driver */
176 static const struct usb_device_id tower_table[] = {
177 	{ USB_DEVICE(LEGO_USB_TOWER_VENDOR_ID, LEGO_USB_TOWER_PRODUCT_ID) },
178 	{ }					/* Terminating entry */
179 };
180 
181 MODULE_DEVICE_TABLE (usb, tower_table);
182 
183 #define LEGO_USB_TOWER_MINOR_BASE	160
184 
185 
186 /* Structure to hold all of our device specific stuff */
187 struct lego_usb_tower {
188 	struct mutex		lock;		/* locks this structure */
189 	struct usb_device*	udev;		/* save off the usb device pointer */
190 	unsigned char		minor;		/* the starting minor number for this device */
191 
192 	int			open_count;	/* number of times this port has been opened */
193 	unsigned long		disconnected:1;
194 
195 	char*			read_buffer;
196 	size_t			read_buffer_length; /* this much came in */
197 	size_t			read_packet_length; /* this much will be returned on read */
198 	spinlock_t		read_buffer_lock;
199 	int			packet_timeout_jiffies;
200 	unsigned long		read_last_arrival;
201 
202 	wait_queue_head_t	read_wait;
203 	wait_queue_head_t	write_wait;
204 
205 	char*			interrupt_in_buffer;
206 	struct usb_endpoint_descriptor* interrupt_in_endpoint;
207 	struct urb*		interrupt_in_urb;
208 	int			interrupt_in_interval;
209 	int			interrupt_in_running;
210 	int			interrupt_in_done;
211 
212 	char*			interrupt_out_buffer;
213 	struct usb_endpoint_descriptor* interrupt_out_endpoint;
214 	struct urb*		interrupt_out_urb;
215 	int			interrupt_out_interval;
216 	int			interrupt_out_busy;
217 
218 };
219 
220 
221 /* local function prototypes */
222 static ssize_t tower_read	(struct file *file, char __user *buffer, size_t count, loff_t *ppos);
223 static ssize_t tower_write	(struct file *file, const char __user *buffer, size_t count, loff_t *ppos);
224 static inline void tower_delete (struct lego_usb_tower *dev);
225 static int tower_open		(struct inode *inode, struct file *file);
226 static int tower_release	(struct inode *inode, struct file *file);
227 static __poll_t tower_poll	(struct file *file, poll_table *wait);
228 static loff_t tower_llseek	(struct file *file, loff_t off, int whence);
229 
230 static void tower_abort_transfers (struct lego_usb_tower *dev);
231 static void tower_check_for_read_packet (struct lego_usb_tower *dev);
232 static void tower_interrupt_in_callback (struct urb *urb);
233 static void tower_interrupt_out_callback (struct urb *urb);
234 
235 static int  tower_probe	(struct usb_interface *interface, const struct usb_device_id *id);
236 static void tower_disconnect	(struct usb_interface *interface);
237 
238 
239 /* file operations needed when we register this driver */
240 static const struct file_operations tower_fops = {
241 	.owner =	THIS_MODULE,
242 	.read  =	tower_read,
243 	.write =	tower_write,
244 	.open =		tower_open,
245 	.release =	tower_release,
246 	.poll =		tower_poll,
247 	.llseek =	tower_llseek,
248 };
249 
250 static char *legousbtower_devnode(struct device *dev, umode_t *mode)
251 {
252 	return kasprintf(GFP_KERNEL, "usb/%s", dev_name(dev));
253 }
254 
255 /*
256  * usb class driver info in order to get a minor number from the usb core,
257  * and to have the device registered with the driver core
258  */
259 static struct usb_class_driver tower_class = {
260 	.name =		"legousbtower%d",
261 	.devnode = 	legousbtower_devnode,
262 	.fops =		&tower_fops,
263 	.minor_base =	LEGO_USB_TOWER_MINOR_BASE,
264 };
265 
266 
267 /* usb specific object needed to register this driver with the usb subsystem */
268 static struct usb_driver tower_driver = {
269 	.name =		"legousbtower",
270 	.probe =	tower_probe,
271 	.disconnect =	tower_disconnect,
272 	.id_table =	tower_table,
273 };
274 
275 
276 /**
277  *	lego_usb_tower_debug_data
278  */
279 static inline void lego_usb_tower_debug_data(struct device *dev,
280 					     const char *function, int size,
281 					     const unsigned char *data)
282 {
283 	dev_dbg(dev, "%s - length = %d, data = %*ph\n",
284 		function, size, size, data);
285 }
286 
287 
288 /**
289  *	tower_delete
290  */
291 static inline void tower_delete (struct lego_usb_tower *dev)
292 {
293 	/* free data structures */
294 	usb_free_urb(dev->interrupt_in_urb);
295 	usb_free_urb(dev->interrupt_out_urb);
296 	kfree (dev->read_buffer);
297 	kfree (dev->interrupt_in_buffer);
298 	kfree (dev->interrupt_out_buffer);
299 	usb_put_dev(dev->udev);
300 	kfree (dev);
301 }
302 
303 
304 /**
305  *	tower_open
306  */
307 static int tower_open (struct inode *inode, struct file *file)
308 {
309 	struct lego_usb_tower *dev = NULL;
310 	int subminor;
311 	int retval = 0;
312 	struct usb_interface *interface;
313 	struct tower_reset_reply *reset_reply;
314 	int result;
315 
316 	reset_reply = kmalloc(sizeof(*reset_reply), GFP_KERNEL);
317 
318 	if (!reset_reply) {
319 		retval = -ENOMEM;
320 		goto exit;
321 	}
322 
323 	nonseekable_open(inode, file);
324 	subminor = iminor(inode);
325 
326 	interface = usb_find_interface (&tower_driver, subminor);
327 
328 	if (!interface) {
329 		pr_err("error, can't find device for minor %d\n", subminor);
330 		retval = -ENODEV;
331 		goto exit;
332 	}
333 
334 	dev = usb_get_intfdata(interface);
335 	if (!dev) {
336 		retval = -ENODEV;
337 		goto exit;
338 	}
339 
340 	/* lock this device */
341 	if (mutex_lock_interruptible(&dev->lock)) {
342 	        retval = -ERESTARTSYS;
343 		goto exit;
344 	}
345 
346 
347 	/* allow opening only once */
348 	if (dev->open_count) {
349 		retval = -EBUSY;
350 		goto unlock_exit;
351 	}
352 
353 	/* reset the tower */
354 	result = usb_control_msg (dev->udev,
355 				  usb_rcvctrlpipe(dev->udev, 0),
356 				  LEGO_USB_TOWER_REQUEST_RESET,
357 				  USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE,
358 				  0,
359 				  0,
360 				  reset_reply,
361 				  sizeof(*reset_reply),
362 				  1000);
363 	if (result < 0) {
364 		dev_err(&dev->udev->dev,
365 			"LEGO USB Tower reset control request failed\n");
366 		retval = result;
367 		goto unlock_exit;
368 	}
369 
370 	/* initialize in direction */
371 	dev->read_buffer_length = 0;
372 	dev->read_packet_length = 0;
373 	usb_fill_int_urb (dev->interrupt_in_urb,
374 			  dev->udev,
375 			  usb_rcvintpipe(dev->udev, dev->interrupt_in_endpoint->bEndpointAddress),
376 			  dev->interrupt_in_buffer,
377 			  usb_endpoint_maxp(dev->interrupt_in_endpoint),
378 			  tower_interrupt_in_callback,
379 			  dev,
380 			  dev->interrupt_in_interval);
381 
382 	dev->interrupt_in_running = 1;
383 	dev->interrupt_in_done = 0;
384 	mb();
385 
386 	retval = usb_submit_urb (dev->interrupt_in_urb, GFP_KERNEL);
387 	if (retval) {
388 		dev_err(&dev->udev->dev,
389 			"Couldn't submit interrupt_in_urb %d\n", retval);
390 		dev->interrupt_in_running = 0;
391 		goto unlock_exit;
392 	}
393 
394 	/* save device in the file's private structure */
395 	file->private_data = dev;
396 
397 	dev->open_count = 1;
398 
399 unlock_exit:
400 	mutex_unlock(&dev->lock);
401 
402 exit:
403 	kfree(reset_reply);
404 	return retval;
405 }
406 
407 /**
408  *	tower_release
409  */
410 static int tower_release (struct inode *inode, struct file *file)
411 {
412 	struct lego_usb_tower *dev;
413 	int retval = 0;
414 
415 	dev = file->private_data;
416 
417 	if (dev == NULL) {
418 		retval = -ENODEV;
419 		goto exit;
420 	}
421 
422 	mutex_lock(&dev->lock);
423 
424 	if (dev->open_count != 1) {
425 		dev_dbg(&dev->udev->dev, "%s: device not opened exactly once\n",
426 			__func__);
427 		retval = -ENODEV;
428 		goto unlock_exit;
429 	}
430 
431 	if (dev->disconnected) {
432 		/* the device was unplugged before the file was released */
433 
434 		/* unlock here as tower_delete frees dev */
435 		mutex_unlock(&dev->lock);
436 		tower_delete (dev);
437 		goto exit;
438 	}
439 
440 	/* wait until write transfer is finished */
441 	if (dev->interrupt_out_busy) {
442 		wait_event_interruptible_timeout (dev->write_wait, !dev->interrupt_out_busy, 2 * HZ);
443 	}
444 	tower_abort_transfers (dev);
445 	dev->open_count = 0;
446 
447 unlock_exit:
448 	mutex_unlock(&dev->lock);
449 exit:
450 	return retval;
451 }
452 
453 
454 /**
455  *	tower_abort_transfers
456  *      aborts transfers and frees associated data structures
457  */
458 static void tower_abort_transfers (struct lego_usb_tower *dev)
459 {
460 	if (dev == NULL)
461 		return;
462 
463 	/* shutdown transfer */
464 	if (dev->interrupt_in_running) {
465 		dev->interrupt_in_running = 0;
466 		mb();
467 		usb_kill_urb(dev->interrupt_in_urb);
468 	}
469 	if (dev->interrupt_out_busy)
470 		usb_kill_urb(dev->interrupt_out_urb);
471 }
472 
473 
474 /**
475  *	tower_check_for_read_packet
476  *
477  *      To get correct semantics for signals and non-blocking I/O
478  *      with packetizing we pretend not to see any data in the read buffer
479  *      until it has been there unchanged for at least
480  *      dev->packet_timeout_jiffies, or until the buffer is full.
481  */
482 static void tower_check_for_read_packet (struct lego_usb_tower *dev)
483 {
484 	spin_lock_irq (&dev->read_buffer_lock);
485 	if (!packet_timeout
486 	    || time_after(jiffies, dev->read_last_arrival + dev->packet_timeout_jiffies)
487 	    || dev->read_buffer_length == read_buffer_size) {
488 		dev->read_packet_length = dev->read_buffer_length;
489 	}
490 	dev->interrupt_in_done = 0;
491 	spin_unlock_irq (&dev->read_buffer_lock);
492 }
493 
494 
495 /**
496  *	tower_poll
497  */
498 static __poll_t tower_poll (struct file *file, poll_table *wait)
499 {
500 	struct lego_usb_tower *dev;
501 	__poll_t mask = 0;
502 
503 	dev = file->private_data;
504 
505 	if (dev->disconnected)
506 		return EPOLLERR | EPOLLHUP;
507 
508 	poll_wait(file, &dev->read_wait, wait);
509 	poll_wait(file, &dev->write_wait, wait);
510 
511 	tower_check_for_read_packet(dev);
512 	if (dev->read_packet_length > 0) {
513 		mask |= EPOLLIN | EPOLLRDNORM;
514 	}
515 	if (!dev->interrupt_out_busy) {
516 		mask |= EPOLLOUT | EPOLLWRNORM;
517 	}
518 
519 	return mask;
520 }
521 
522 
523 /**
524  *	tower_llseek
525  */
526 static loff_t tower_llseek (struct file *file, loff_t off, int whence)
527 {
528 	return -ESPIPE;		/* unseekable */
529 }
530 
531 
532 /**
533  *	tower_read
534  */
535 static ssize_t tower_read (struct file *file, char __user *buffer, size_t count, loff_t *ppos)
536 {
537 	struct lego_usb_tower *dev;
538 	size_t bytes_to_read;
539 	int i;
540 	int retval = 0;
541 	unsigned long timeout = 0;
542 
543 	dev = file->private_data;
544 
545 	/* lock this object */
546 	if (mutex_lock_interruptible(&dev->lock)) {
547 		retval = -ERESTARTSYS;
548 		goto exit;
549 	}
550 
551 	/* verify that the device wasn't unplugged */
552 	if (dev->disconnected) {
553 		retval = -ENODEV;
554 		pr_err("No device or device unplugged %d\n", retval);
555 		goto unlock_exit;
556 	}
557 
558 	/* verify that we actually have some data to read */
559 	if (count == 0) {
560 		dev_dbg(&dev->udev->dev, "read request of 0 bytes\n");
561 		goto unlock_exit;
562 	}
563 
564 	if (read_timeout) {
565 		timeout = jiffies + msecs_to_jiffies(read_timeout);
566 	}
567 
568 	/* wait for data */
569 	tower_check_for_read_packet (dev);
570 	while (dev->read_packet_length == 0) {
571 		if (file->f_flags & O_NONBLOCK) {
572 			retval = -EAGAIN;
573 			goto unlock_exit;
574 		}
575 		retval = wait_event_interruptible_timeout(dev->read_wait, dev->interrupt_in_done, dev->packet_timeout_jiffies);
576 		if (retval < 0) {
577 			goto unlock_exit;
578 		}
579 
580 		/* reset read timeout during read or write activity */
581 		if (read_timeout
582 		    && (dev->read_buffer_length || dev->interrupt_out_busy)) {
583 			timeout = jiffies + msecs_to_jiffies(read_timeout);
584 		}
585 		/* check for read timeout */
586 		if (read_timeout && time_after (jiffies, timeout)) {
587 			retval = -ETIMEDOUT;
588 			goto unlock_exit;
589 		}
590 		tower_check_for_read_packet (dev);
591 	}
592 
593 	/* copy the data from read_buffer into userspace */
594 	bytes_to_read = min(count, dev->read_packet_length);
595 
596 	if (copy_to_user (buffer, dev->read_buffer, bytes_to_read)) {
597 		retval = -EFAULT;
598 		goto unlock_exit;
599 	}
600 
601 	spin_lock_irq (&dev->read_buffer_lock);
602 	dev->read_buffer_length -= bytes_to_read;
603 	dev->read_packet_length -= bytes_to_read;
604 	for (i=0; i<dev->read_buffer_length; i++) {
605 		dev->read_buffer[i] = dev->read_buffer[i+bytes_to_read];
606 	}
607 	spin_unlock_irq (&dev->read_buffer_lock);
608 
609 	retval = bytes_to_read;
610 
611 unlock_exit:
612 	/* unlock the device */
613 	mutex_unlock(&dev->lock);
614 
615 exit:
616 	return retval;
617 }
618 
619 
620 /**
621  *	tower_write
622  */
623 static ssize_t tower_write (struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
624 {
625 	struct lego_usb_tower *dev;
626 	size_t bytes_to_write;
627 	int retval = 0;
628 
629 	dev = file->private_data;
630 
631 	/* lock this object */
632 	if (mutex_lock_interruptible(&dev->lock)) {
633 		retval = -ERESTARTSYS;
634 		goto exit;
635 	}
636 
637 	/* verify that the device wasn't unplugged */
638 	if (dev->disconnected) {
639 		retval = -ENODEV;
640 		pr_err("No device or device unplugged %d\n", retval);
641 		goto unlock_exit;
642 	}
643 
644 	/* verify that we actually have some data to write */
645 	if (count == 0) {
646 		dev_dbg(&dev->udev->dev, "write request of 0 bytes\n");
647 		goto unlock_exit;
648 	}
649 
650 	/* wait until previous transfer is finished */
651 	while (dev->interrupt_out_busy) {
652 		if (file->f_flags & O_NONBLOCK) {
653 			retval = -EAGAIN;
654 			goto unlock_exit;
655 		}
656 		retval = wait_event_interruptible (dev->write_wait, !dev->interrupt_out_busy);
657 		if (retval) {
658 			goto unlock_exit;
659 		}
660 	}
661 
662 	/* write the data into interrupt_out_buffer from userspace */
663 	bytes_to_write = min_t(int, count, write_buffer_size);
664 	dev_dbg(&dev->udev->dev, "%s: count = %zd, bytes_to_write = %zd\n",
665 		__func__, count, bytes_to_write);
666 
667 	if (copy_from_user (dev->interrupt_out_buffer, buffer, bytes_to_write)) {
668 		retval = -EFAULT;
669 		goto unlock_exit;
670 	}
671 
672 	/* send off the urb */
673 	usb_fill_int_urb(dev->interrupt_out_urb,
674 			 dev->udev,
675 			 usb_sndintpipe(dev->udev, dev->interrupt_out_endpoint->bEndpointAddress),
676 			 dev->interrupt_out_buffer,
677 			 bytes_to_write,
678 			 tower_interrupt_out_callback,
679 			 dev,
680 			 dev->interrupt_out_interval);
681 
682 	dev->interrupt_out_busy = 1;
683 	wmb();
684 
685 	retval = usb_submit_urb (dev->interrupt_out_urb, GFP_KERNEL);
686 	if (retval) {
687 		dev->interrupt_out_busy = 0;
688 		dev_err(&dev->udev->dev,
689 			"Couldn't submit interrupt_out_urb %d\n", retval);
690 		goto unlock_exit;
691 	}
692 	retval = bytes_to_write;
693 
694 unlock_exit:
695 	/* unlock the device */
696 	mutex_unlock(&dev->lock);
697 
698 exit:
699 	return retval;
700 }
701 
702 
703 /**
704  *	tower_interrupt_in_callback
705  */
706 static void tower_interrupt_in_callback (struct urb *urb)
707 {
708 	struct lego_usb_tower *dev = urb->context;
709 	int status = urb->status;
710 	int retval;
711 	unsigned long flags;
712 
713 	lego_usb_tower_debug_data(&dev->udev->dev, __func__,
714 				  urb->actual_length, urb->transfer_buffer);
715 
716 	if (status) {
717 		if (status == -ENOENT ||
718 		    status == -ECONNRESET ||
719 		    status == -ESHUTDOWN) {
720 			goto exit;
721 		} else {
722 			dev_dbg(&dev->udev->dev,
723 				"%s: nonzero status received: %d\n", __func__,
724 				status);
725 			goto resubmit; /* maybe we can recover */
726 		}
727 	}
728 
729 	if (urb->actual_length > 0) {
730 		spin_lock_irqsave(&dev->read_buffer_lock, flags);
731 		if (dev->read_buffer_length + urb->actual_length < read_buffer_size) {
732 			memcpy (dev->read_buffer + dev->read_buffer_length,
733 				dev->interrupt_in_buffer,
734 				urb->actual_length);
735 			dev->read_buffer_length += urb->actual_length;
736 			dev->read_last_arrival = jiffies;
737 			dev_dbg(&dev->udev->dev, "%s: received %d bytes\n",
738 				__func__, urb->actual_length);
739 		} else {
740 			pr_warn("read_buffer overflow, %d bytes dropped\n",
741 				urb->actual_length);
742 		}
743 		spin_unlock_irqrestore(&dev->read_buffer_lock, flags);
744 	}
745 
746 resubmit:
747 	/* resubmit if we're still running */
748 	if (dev->interrupt_in_running) {
749 		retval = usb_submit_urb (dev->interrupt_in_urb, GFP_ATOMIC);
750 		if (retval)
751 			dev_err(&dev->udev->dev,
752 				"%s: usb_submit_urb failed (%d)\n",
753 				__func__, retval);
754 	}
755 
756 exit:
757 	dev->interrupt_in_done = 1;
758 	wake_up_interruptible (&dev->read_wait);
759 }
760 
761 
762 /**
763  *	tower_interrupt_out_callback
764  */
765 static void tower_interrupt_out_callback (struct urb *urb)
766 {
767 	struct lego_usb_tower *dev = urb->context;
768 	int status = urb->status;
769 
770 	lego_usb_tower_debug_data(&dev->udev->dev, __func__,
771 				  urb->actual_length, urb->transfer_buffer);
772 
773 	/* sync/async unlink faults aren't errors */
774 	if (status && !(status == -ENOENT ||
775 			status == -ECONNRESET ||
776 			status == -ESHUTDOWN)) {
777 		dev_dbg(&dev->udev->dev,
778 			"%s: nonzero write bulk status received: %d\n", __func__,
779 			status);
780 	}
781 
782 	dev->interrupt_out_busy = 0;
783 	wake_up_interruptible(&dev->write_wait);
784 }
785 
786 
787 /**
788  *	tower_probe
789  *
790  *	Called by the usb core when a new device is connected that it thinks
791  *	this driver might be interested in.
792  */
793 static int tower_probe (struct usb_interface *interface, const struct usb_device_id *id)
794 {
795 	struct device *idev = &interface->dev;
796 	struct usb_device *udev = interface_to_usbdev(interface);
797 	struct lego_usb_tower *dev = NULL;
798 	struct tower_get_version_reply *get_version_reply = NULL;
799 	int retval = -ENOMEM;
800 	int result;
801 
802 	/* allocate memory for our device state and initialize it */
803 
804 	dev = kmalloc (sizeof(struct lego_usb_tower), GFP_KERNEL);
805 
806 	if (!dev)
807 		goto exit;
808 
809 	mutex_init(&dev->lock);
810 
811 	dev->udev = usb_get_dev(udev);
812 	dev->open_count = 0;
813 	dev->disconnected = 0;
814 
815 	dev->read_buffer = NULL;
816 	dev->read_buffer_length = 0;
817 	dev->read_packet_length = 0;
818 	spin_lock_init (&dev->read_buffer_lock);
819 	dev->packet_timeout_jiffies = msecs_to_jiffies(packet_timeout);
820 	dev->read_last_arrival = jiffies;
821 
822 	init_waitqueue_head (&dev->read_wait);
823 	init_waitqueue_head (&dev->write_wait);
824 
825 	dev->interrupt_in_buffer = NULL;
826 	dev->interrupt_in_endpoint = NULL;
827 	dev->interrupt_in_urb = NULL;
828 	dev->interrupt_in_running = 0;
829 	dev->interrupt_in_done = 0;
830 
831 	dev->interrupt_out_buffer = NULL;
832 	dev->interrupt_out_endpoint = NULL;
833 	dev->interrupt_out_urb = NULL;
834 	dev->interrupt_out_busy = 0;
835 
836 	result = usb_find_common_endpoints_reverse(interface->cur_altsetting,
837 			NULL, NULL,
838 			&dev->interrupt_in_endpoint,
839 			&dev->interrupt_out_endpoint);
840 	if (result) {
841 		dev_err(idev, "interrupt endpoints not found\n");
842 		retval = result;
843 		goto error;
844 	}
845 
846 	dev->read_buffer = kmalloc (read_buffer_size, GFP_KERNEL);
847 	if (!dev->read_buffer)
848 		goto error;
849 	dev->interrupt_in_buffer = kmalloc (usb_endpoint_maxp(dev->interrupt_in_endpoint), GFP_KERNEL);
850 	if (!dev->interrupt_in_buffer)
851 		goto error;
852 	dev->interrupt_in_urb = usb_alloc_urb(0, GFP_KERNEL);
853 	if (!dev->interrupt_in_urb)
854 		goto error;
855 	dev->interrupt_out_buffer = kmalloc (write_buffer_size, GFP_KERNEL);
856 	if (!dev->interrupt_out_buffer)
857 		goto error;
858 	dev->interrupt_out_urb = usb_alloc_urb(0, GFP_KERNEL);
859 	if (!dev->interrupt_out_urb)
860 		goto error;
861 	dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval;
862 	dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval;
863 
864 	get_version_reply = kmalloc(sizeof(*get_version_reply), GFP_KERNEL);
865 
866 	if (!get_version_reply) {
867 		retval = -ENOMEM;
868 		goto error;
869 	}
870 
871 	/* get the firmware version and log it */
872 	result = usb_control_msg (udev,
873 				  usb_rcvctrlpipe(udev, 0),
874 				  LEGO_USB_TOWER_REQUEST_GET_VERSION,
875 				  USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE,
876 				  0,
877 				  0,
878 				  get_version_reply,
879 				  sizeof(*get_version_reply),
880 				  1000);
881 	if (result != sizeof(*get_version_reply)) {
882 		if (result >= 0)
883 			result = -EIO;
884 		dev_err(idev, "get version request failed: %d\n", result);
885 		retval = result;
886 		goto error;
887 	}
888 	dev_info(&interface->dev,
889 		 "LEGO USB Tower firmware version is %d.%d build %d\n",
890 		 get_version_reply->major,
891 		 get_version_reply->minor,
892 		 le16_to_cpu(get_version_reply->build_no));
893 
894 	/* we can register the device now, as it is ready */
895 	usb_set_intfdata (interface, dev);
896 
897 	retval = usb_register_dev (interface, &tower_class);
898 
899 	if (retval) {
900 		/* something prevented us from registering this driver */
901 		dev_err(idev, "Not able to get a minor for this device.\n");
902 		goto error;
903 	}
904 	dev->minor = interface->minor;
905 
906 	/* let the user know what node this device is now attached to */
907 	dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
908 		 "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
909 		 USB_MAJOR, dev->minor);
910 
911 exit:
912 	kfree(get_version_reply);
913 	return retval;
914 
915 error:
916 	kfree(get_version_reply);
917 	tower_delete(dev);
918 	return retval;
919 }
920 
921 
922 /**
923  *	tower_disconnect
924  *
925  *	Called by the usb core when the device is removed from the system.
926  */
927 static void tower_disconnect (struct usb_interface *interface)
928 {
929 	struct lego_usb_tower *dev;
930 	int minor;
931 
932 	dev = usb_get_intfdata (interface);
933 
934 	minor = dev->minor;
935 
936 	/* give back our minor and prevent further open() */
937 	usb_deregister_dev (interface, &tower_class);
938 
939 	/* stop I/O */
940 	usb_poison_urb(dev->interrupt_in_urb);
941 	usb_poison_urb(dev->interrupt_out_urb);
942 
943 	mutex_lock(&dev->lock);
944 
945 	/* if the device is not opened, then we clean up right now */
946 	if (!dev->open_count) {
947 		mutex_unlock(&dev->lock);
948 		tower_delete (dev);
949 	} else {
950 		dev->disconnected = 1;
951 		/* wake up pollers */
952 		wake_up_interruptible_all(&dev->read_wait);
953 		wake_up_interruptible_all(&dev->write_wait);
954 		mutex_unlock(&dev->lock);
955 	}
956 
957 	dev_info(&interface->dev, "LEGO USB Tower #%d now disconnected\n",
958 		 (minor - LEGO_USB_TOWER_MINOR_BASE));
959 }
960 
961 module_usb_driver(tower_driver);
962 
963 MODULE_AUTHOR(DRIVER_AUTHOR);
964 MODULE_DESCRIPTION(DRIVER_DESC);
965 MODULE_LICENSE("GPL");
966