net: DCB: Validate DCB_ATTR_DCB_BUFFER argument
[linux/fpc-iii.git] / drivers / usb / misc / yurex.c
blob785080f79073823f90dee58b3ce942c5bbe253b2
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Driver for Meywa-Denki & KAYAC YUREX
5 * Copyright (C) 2010 Tomoki Sekiyama (tomoki.sekiyama@gmail.com)
6 */
8 #include <linux/kernel.h>
9 #include <linux/errno.h>
10 #include <linux/slab.h>
11 #include <linux/module.h>
12 #include <linux/kref.h>
13 #include <linux/mutex.h>
14 #include <linux/uaccess.h>
15 #include <linux/usb.h>
16 #include <linux/hid.h>
18 #define DRIVER_AUTHOR "Tomoki Sekiyama"
19 #define DRIVER_DESC "Driver for Meywa-Denki & KAYAC YUREX"
21 #define YUREX_VENDOR_ID 0x0c45
22 #define YUREX_PRODUCT_ID 0x1010
24 #define CMD_ACK '!'
25 #define CMD_ANIMATE 'A'
26 #define CMD_COUNT 'C'
27 #define CMD_LED 'L'
28 #define CMD_READ 'R'
29 #define CMD_SET 'S'
30 #define CMD_VERSION 'V'
31 #define CMD_EOF 0x0d
32 #define CMD_PADDING 0xff
34 #define YUREX_BUF_SIZE 8
35 #define YUREX_WRITE_TIMEOUT (HZ*2)
37 /* table of devices that work with this driver */
38 static struct usb_device_id yurex_table[] = {
39 { USB_DEVICE(YUREX_VENDOR_ID, YUREX_PRODUCT_ID) },
40 { } /* Terminating entry */
42 MODULE_DEVICE_TABLE(usb, yurex_table);
44 #ifdef CONFIG_USB_DYNAMIC_MINORS
45 #define YUREX_MINOR_BASE 0
46 #else
47 #define YUREX_MINOR_BASE 192
48 #endif
50 /* Structure to hold all of our device specific stuff */
51 struct usb_yurex {
52 struct usb_device *udev;
53 struct usb_interface *interface;
54 __u8 int_in_endpointAddr;
55 struct urb *urb; /* URB for interrupt in */
56 unsigned char *int_buffer; /* buffer for intterupt in */
57 struct urb *cntl_urb; /* URB for control msg */
58 struct usb_ctrlrequest *cntl_req; /* req for control msg */
59 unsigned char *cntl_buffer; /* buffer for control msg */
61 struct kref kref;
62 struct mutex io_mutex;
63 unsigned long disconnected:1;
64 struct fasync_struct *async_queue;
65 wait_queue_head_t waitq;
67 spinlock_t lock;
68 __s64 bbu; /* BBU from device */
70 #define to_yurex_dev(d) container_of(d, struct usb_yurex, kref)
72 static struct usb_driver yurex_driver;
73 static const struct file_operations yurex_fops;
76 static void yurex_control_callback(struct urb *urb)
78 struct usb_yurex *dev = urb->context;
79 int status = urb->status;
81 if (status) {
82 dev_err(&urb->dev->dev, "%s - control failed: %d\n",
83 __func__, status);
84 wake_up_interruptible(&dev->waitq);
85 return;
87 /* on success, sender woken up by CMD_ACK int in, or timeout */
90 static void yurex_delete(struct kref *kref)
92 struct usb_yurex *dev = to_yurex_dev(kref);
94 dev_dbg(&dev->interface->dev, "%s\n", __func__);
96 if (dev->cntl_urb) {
97 usb_kill_urb(dev->cntl_urb);
98 kfree(dev->cntl_req);
99 if (dev->cntl_buffer)
100 usb_free_coherent(dev->udev, YUREX_BUF_SIZE,
101 dev->cntl_buffer, dev->cntl_urb->transfer_dma);
102 usb_free_urb(dev->cntl_urb);
104 if (dev->urb) {
105 usb_kill_urb(dev->urb);
106 if (dev->int_buffer)
107 usb_free_coherent(dev->udev, YUREX_BUF_SIZE,
108 dev->int_buffer, dev->urb->transfer_dma);
109 usb_free_urb(dev->urb);
111 usb_put_intf(dev->interface);
112 usb_put_dev(dev->udev);
113 kfree(dev);
117 * usb class driver info in order to get a minor number from the usb core,
118 * and to have the device registered with the driver core
120 static struct usb_class_driver yurex_class = {
121 .name = "yurex%d",
122 .fops = &yurex_fops,
123 .minor_base = YUREX_MINOR_BASE,
126 static void yurex_interrupt(struct urb *urb)
128 struct usb_yurex *dev = urb->context;
129 unsigned char *buf = dev->int_buffer;
130 int status = urb->status;
131 unsigned long flags;
132 int retval, i;
134 switch (status) {
135 case 0: /*success*/
136 break;
137 /* The device is terminated or messed up, give up */
138 case -EOVERFLOW:
139 dev_err(&dev->interface->dev,
140 "%s - overflow with length %d, actual length is %d\n",
141 __func__, YUREX_BUF_SIZE, dev->urb->actual_length);
142 case -ECONNRESET:
143 case -ENOENT:
144 case -ESHUTDOWN:
145 case -EILSEQ:
146 case -EPROTO:
147 case -ETIME:
148 return;
149 default:
150 dev_err(&dev->interface->dev,
151 "%s - unknown status received: %d\n", __func__, status);
152 return;
155 /* handle received message */
156 switch (buf[0]) {
157 case CMD_COUNT:
158 case CMD_READ:
159 if (buf[6] == CMD_EOF) {
160 spin_lock_irqsave(&dev->lock, flags);
161 dev->bbu = 0;
162 for (i = 1; i < 6; i++) {
163 dev->bbu += buf[i];
164 if (i != 5)
165 dev->bbu <<= 8;
167 dev_dbg(&dev->interface->dev, "%s count: %lld\n",
168 __func__, dev->bbu);
169 spin_unlock_irqrestore(&dev->lock, flags);
171 kill_fasync(&dev->async_queue, SIGIO, POLL_IN);
173 else
174 dev_dbg(&dev->interface->dev,
175 "data format error - no EOF\n");
176 break;
177 case CMD_ACK:
178 dev_dbg(&dev->interface->dev, "%s ack: %c\n",
179 __func__, buf[1]);
180 wake_up_interruptible(&dev->waitq);
181 break;
184 retval = usb_submit_urb(dev->urb, GFP_ATOMIC);
185 if (retval) {
186 dev_err(&dev->interface->dev, "%s - usb_submit_urb failed: %d\n",
187 __func__, retval);
191 static int yurex_probe(struct usb_interface *interface, const struct usb_device_id *id)
193 struct usb_yurex *dev;
194 struct usb_host_interface *iface_desc;
195 struct usb_endpoint_descriptor *endpoint;
196 int retval = -ENOMEM;
197 DEFINE_WAIT(wait);
198 int res;
200 /* allocate memory for our device state and initialize it */
201 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
202 if (!dev)
203 goto error;
204 kref_init(&dev->kref);
205 mutex_init(&dev->io_mutex);
206 spin_lock_init(&dev->lock);
207 init_waitqueue_head(&dev->waitq);
209 dev->udev = usb_get_dev(interface_to_usbdev(interface));
210 dev->interface = usb_get_intf(interface);
212 /* set up the endpoint information */
213 iface_desc = interface->cur_altsetting;
214 res = usb_find_int_in_endpoint(iface_desc, &endpoint);
215 if (res) {
216 dev_err(&interface->dev, "Could not find endpoints\n");
217 retval = res;
218 goto error;
221 dev->int_in_endpointAddr = endpoint->bEndpointAddress;
223 /* allocate control URB */
224 dev->cntl_urb = usb_alloc_urb(0, GFP_KERNEL);
225 if (!dev->cntl_urb)
226 goto error;
228 /* allocate buffer for control req */
229 dev->cntl_req = kmalloc(YUREX_BUF_SIZE, GFP_KERNEL);
230 if (!dev->cntl_req)
231 goto error;
233 /* allocate buffer for control msg */
234 dev->cntl_buffer = usb_alloc_coherent(dev->udev, YUREX_BUF_SIZE,
235 GFP_KERNEL,
236 &dev->cntl_urb->transfer_dma);
237 if (!dev->cntl_buffer) {
238 dev_err(&interface->dev, "Could not allocate cntl_buffer\n");
239 goto error;
242 /* configure control URB */
243 dev->cntl_req->bRequestType = USB_DIR_OUT | USB_TYPE_CLASS |
244 USB_RECIP_INTERFACE;
245 dev->cntl_req->bRequest = HID_REQ_SET_REPORT;
246 dev->cntl_req->wValue = cpu_to_le16((HID_OUTPUT_REPORT + 1) << 8);
247 dev->cntl_req->wIndex = cpu_to_le16(iface_desc->desc.bInterfaceNumber);
248 dev->cntl_req->wLength = cpu_to_le16(YUREX_BUF_SIZE);
250 usb_fill_control_urb(dev->cntl_urb, dev->udev,
251 usb_sndctrlpipe(dev->udev, 0),
252 (void *)dev->cntl_req, dev->cntl_buffer,
253 YUREX_BUF_SIZE, yurex_control_callback, dev);
254 dev->cntl_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
257 /* allocate interrupt URB */
258 dev->urb = usb_alloc_urb(0, GFP_KERNEL);
259 if (!dev->urb)
260 goto error;
262 /* allocate buffer for interrupt in */
263 dev->int_buffer = usb_alloc_coherent(dev->udev, YUREX_BUF_SIZE,
264 GFP_KERNEL, &dev->urb->transfer_dma);
265 if (!dev->int_buffer) {
266 dev_err(&interface->dev, "Could not allocate int_buffer\n");
267 goto error;
270 /* configure interrupt URB */
271 usb_fill_int_urb(dev->urb, dev->udev,
272 usb_rcvintpipe(dev->udev, dev->int_in_endpointAddr),
273 dev->int_buffer, YUREX_BUF_SIZE, yurex_interrupt,
274 dev, 1);
275 dev->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
276 if (usb_submit_urb(dev->urb, GFP_KERNEL)) {
277 retval = -EIO;
278 dev_err(&interface->dev, "Could not submitting URB\n");
279 goto error;
282 /* save our data pointer in this interface device */
283 usb_set_intfdata(interface, dev);
284 dev->bbu = -1;
286 /* we can register the device now, as it is ready */
287 retval = usb_register_dev(interface, &yurex_class);
288 if (retval) {
289 dev_err(&interface->dev,
290 "Not able to get a minor for this device.\n");
291 usb_set_intfdata(interface, NULL);
292 goto error;
295 dev_info(&interface->dev,
296 "USB YUREX device now attached to Yurex #%d\n",
297 interface->minor);
299 return 0;
301 error:
302 if (dev)
303 /* this frees allocated memory */
304 kref_put(&dev->kref, yurex_delete);
305 return retval;
308 static void yurex_disconnect(struct usb_interface *interface)
310 struct usb_yurex *dev;
311 int minor = interface->minor;
313 dev = usb_get_intfdata(interface);
314 usb_set_intfdata(interface, NULL);
316 /* give back our minor */
317 usb_deregister_dev(interface, &yurex_class);
319 /* prevent more I/O from starting */
320 usb_poison_urb(dev->urb);
321 usb_poison_urb(dev->cntl_urb);
322 mutex_lock(&dev->io_mutex);
323 dev->disconnected = 1;
324 mutex_unlock(&dev->io_mutex);
326 /* wakeup waiters */
327 kill_fasync(&dev->async_queue, SIGIO, POLL_IN);
328 wake_up_interruptible(&dev->waitq);
330 /* decrement our usage count */
331 kref_put(&dev->kref, yurex_delete);
333 dev_info(&interface->dev, "USB YUREX #%d now disconnected\n", minor);
336 static struct usb_driver yurex_driver = {
337 .name = "yurex",
338 .probe = yurex_probe,
339 .disconnect = yurex_disconnect,
340 .id_table = yurex_table,
344 static int yurex_fasync(int fd, struct file *file, int on)
346 struct usb_yurex *dev;
348 dev = file->private_data;
349 return fasync_helper(fd, file, on, &dev->async_queue);
352 static int yurex_open(struct inode *inode, struct file *file)
354 struct usb_yurex *dev;
355 struct usb_interface *interface;
356 int subminor;
357 int retval = 0;
359 subminor = iminor(inode);
361 interface = usb_find_interface(&yurex_driver, subminor);
362 if (!interface) {
363 printk(KERN_ERR "%s - error, can't find device for minor %d",
364 __func__, subminor);
365 retval = -ENODEV;
366 goto exit;
369 dev = usb_get_intfdata(interface);
370 if (!dev) {
371 retval = -ENODEV;
372 goto exit;
375 /* increment our usage count for the device */
376 kref_get(&dev->kref);
378 /* save our object in the file's private structure */
379 mutex_lock(&dev->io_mutex);
380 file->private_data = dev;
381 mutex_unlock(&dev->io_mutex);
383 exit:
384 return retval;
387 static int yurex_release(struct inode *inode, struct file *file)
389 struct usb_yurex *dev;
391 dev = file->private_data;
392 if (dev == NULL)
393 return -ENODEV;
395 /* decrement the count on our device */
396 kref_put(&dev->kref, yurex_delete);
397 return 0;
400 static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,
401 loff_t *ppos)
403 struct usb_yurex *dev;
404 int len = 0;
405 char in_buffer[20];
406 unsigned long flags;
408 dev = file->private_data;
410 mutex_lock(&dev->io_mutex);
411 if (dev->disconnected) { /* already disconnected */
412 mutex_unlock(&dev->io_mutex);
413 return -ENODEV;
416 spin_lock_irqsave(&dev->lock, flags);
417 len = snprintf(in_buffer, 20, "%lld\n", dev->bbu);
418 spin_unlock_irqrestore(&dev->lock, flags);
419 mutex_unlock(&dev->io_mutex);
421 if (WARN_ON_ONCE(len >= sizeof(in_buffer)))
422 return -EIO;
424 return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
427 static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
428 size_t count, loff_t *ppos)
430 struct usb_yurex *dev;
431 int i, set = 0, retval = 0;
432 char buffer[16 + 1];
433 char *data = buffer;
434 unsigned long long c, c2 = 0;
435 signed long timeout = 0;
436 DEFINE_WAIT(wait);
438 count = min(sizeof(buffer) - 1, count);
439 dev = file->private_data;
441 /* verify that we actually have some data to write */
442 if (count == 0)
443 goto error;
445 mutex_lock(&dev->io_mutex);
446 if (dev->disconnected) { /* already disconnected */
447 mutex_unlock(&dev->io_mutex);
448 retval = -ENODEV;
449 goto error;
452 if (copy_from_user(buffer, user_buffer, count)) {
453 mutex_unlock(&dev->io_mutex);
454 retval = -EFAULT;
455 goto error;
457 buffer[count] = 0;
458 memset(dev->cntl_buffer, CMD_PADDING, YUREX_BUF_SIZE);
460 switch (buffer[0]) {
461 case CMD_ANIMATE:
462 case CMD_LED:
463 dev->cntl_buffer[0] = buffer[0];
464 dev->cntl_buffer[1] = buffer[1];
465 dev->cntl_buffer[2] = CMD_EOF;
466 break;
467 case CMD_READ:
468 case CMD_VERSION:
469 dev->cntl_buffer[0] = buffer[0];
470 dev->cntl_buffer[1] = 0x00;
471 dev->cntl_buffer[2] = CMD_EOF;
472 break;
473 case CMD_SET:
474 data++;
475 /* FALL THROUGH */
476 case '0' ... '9':
477 set = 1;
478 c = c2 = simple_strtoull(data, NULL, 0);
479 dev->cntl_buffer[0] = CMD_SET;
480 for (i = 1; i < 6; i++) {
481 dev->cntl_buffer[i] = (c>>32) & 0xff;
482 c <<= 8;
484 buffer[6] = CMD_EOF;
485 break;
486 default:
487 mutex_unlock(&dev->io_mutex);
488 return -EINVAL;
491 /* send the data as the control msg */
492 prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE);
493 dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__,
494 dev->cntl_buffer[0]);
495 retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC);
496 if (retval >= 0)
497 timeout = schedule_timeout(YUREX_WRITE_TIMEOUT);
498 finish_wait(&dev->waitq, &wait);
500 mutex_unlock(&dev->io_mutex);
502 if (retval < 0) {
503 dev_err(&dev->interface->dev,
504 "%s - failed to send bulk msg, error %d\n",
505 __func__, retval);
506 goto error;
508 if (set && timeout)
509 dev->bbu = c2;
510 return timeout ? count : -EIO;
512 error:
513 return retval;
516 static const struct file_operations yurex_fops = {
517 .owner = THIS_MODULE,
518 .read = yurex_read,
519 .write = yurex_write,
520 .open = yurex_open,
521 .release = yurex_release,
522 .fasync = yurex_fasync,
523 .llseek = default_llseek,
526 module_usb_driver(yurex_driver);
528 MODULE_LICENSE("GPL");