~hc/RK356X_SDK_RELEASE.git

..	..	@@ -1,10 +1,11 @@
1	1	// SPDX-License-Identifier: GPL-2.0+
2		-/**
	2	+/*
3	3	* drivers/usb/class/usbtmc.c - USB Test & Measurement class driver
4	4	*
5	5	* Copyright (C) 2007 Stefan Kopp, Gechingen, Germany
6	6	* Copyright (C) 2008 Novell, Inc.
7	7	* Copyright (C) 2008 Greg Kroah-Hartman <gregkh@suse.de>
	8	+ * Copyright (C) 2018 IVI Foundation, Inc.
8	9	*/
9	10
10	11	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
..	..	@@ -21,20 +22,23 @@
21	22	#include <linux/compat.h>
22	23	#include <linux/usb/tmc.h>
23	24
	25	+/* Increment API VERSION when changing tmc.h with new flags or ioctls
	26	+ * or when changing a significant behavior of the driver.
	27	+ */
	28	+#define USBTMC_API_VERSION (2)
24	29
25	30	#define USBTMC_HEADER_SIZE 12
26	31	#define USBTMC_MINOR_BASE 176
27		-
28		-/*
29		- * Size of driver internal IO buffer. Must be multiple of 4 and at least as
30		- * large as wMaxPacketSize (which is usually 512 bytes).
31		- */
32		-#define USBTMC_SIZE_IOBUFFER 2048
33	32
34	33	/* Minimum USB timeout (in milliseconds) */
35	34	#define USBTMC_MIN_TIMEOUT 100
36	35	/* Default USB timeout (in milliseconds) */
37	36	#define USBTMC_TIMEOUT 5000
	37	+
	38	+/* Max number of urbs used in write transfers */
	39	+#define MAX_URBS_IN_FLIGHT 16
	40	+/* I/O buffer size used in generic read/write functions */
	41	+#define USBTMC_BUFSIZE (4096)
38	42
39	43	/*
40	44	* Maximum number of read cycles to empty bulk in endpoint during CLEAR and
..	..	@@ -79,6 +83,9 @@
79	83	u8 bTag_last_write; /* needed for abort */
80	84	u8 bTag_last_read; /* needed for abort */
81	85
	86	+ /* packet size of IN bulk */
	87	+ u16 wMaxPacketSize;
	88	+
82	89	/* data for interrupt in endpoint handling */
83	90	u8 bNotify1;
84	91	u8 bNotify2;
..	..	@@ -94,11 +101,6 @@
94	101
95	102	/* coalesced usb488_caps from usbtmc_dev_capabilities */
96	103	__u8 usb488_caps;
97		-
98		- /* attributes from the USB TMC spec for this device */
99		- u8 TermChar;
100		- bool TermCharEnabled;
101		- bool auto_abort;
102	104
103	105	bool zombie; /* fd of disconnected device */
104	106
..	..	@@ -121,13 +123,34 @@
121	123	u32 timeout;
122	124	u8 srq_byte;
123	125	atomic_t srq_asserted;
	126	+ atomic_t closing;
	127	+ u8 bmTransferAttributes; /* member of DEV_DEP_MSG_IN */
	128	+
124	129	u8 eom_val;
125	130	u8 term_char;
126	131	bool term_char_enabled;
	132	+ bool auto_abort;
	133	+
	134	+ spinlock_t err_lock; /* lock for errors */
	135	+
	136	+ struct usb_anchor submitted;
	137	+
	138	+ /* data for generic_write */
	139	+ struct semaphore limit_write_sem;
	140	+ u32 out_transfer_size;
	141	+ int out_status;
	142	+
	143	+ /* data for generic_read */
	144	+ u32 in_transfer_size;
	145	+ int in_status;
	146	+ int in_urbs_used;
	147	+ struct usb_anchor in_anchor;
	148	+ wait_queue_head_t wait_bulk_in;
127	149	};
128	150
129	151	/* Forward declarations */
130	152	static struct usb_driver usbtmc_driver;
	153	+static void usbtmc_draw_down(struct usbtmc_file_data *file_data);
131	154
132	155	static void usbtmc_delete(struct kref *kref)
133	156	{
..	..	@@ -153,6 +176,12 @@
153	176	if (!file_data)
154	177	return -ENOMEM;
155	178
	179	+ spin_lock_init(&file_data->err_lock);
	180	+ sema_init(&file_data->limit_write_sem, MAX_URBS_IN_FLIGHT);
	181	+ init_usb_anchor(&file_data->submitted);
	182	+ init_usb_anchor(&file_data->in_anchor);
	183	+ init_waitqueue_head(&file_data->wait_bulk_in);
	184	+
156	185	data = usb_get_intfdata(intf);
157	186	/* Protect reference to data from file structure until release */
158	187	kref_get(&data->kref);
..	..	@@ -160,10 +189,12 @@
160	189	mutex_lock(&data->io_mutex);
161	190	file_data->data = data;
162	191
163		- /* copy default values from device settings */
	192	+ atomic_set(&file_data->closing, 0);
	193	+
164	194	file_data->timeout = USBTMC_TIMEOUT;
165		- file_data->term_char = data->TermChar;
166		- file_data->term_char_enabled = data->TermCharEnabled;
	195	+ file_data->term_char = '\n';
	196	+ file_data->term_char_enabled = 0;
	197	+ file_data->auto_abort = 0;
167	198	file_data->eom_val = 1;
168	199
169	200	INIT_LIST_HEAD(&file_data->file_elem);
..	..	@@ -174,6 +205,40 @@
174	205
175	206	/* Store pointer in file structure's private data field */
176	207	filp->private_data = file_data;
	208	+
	209	+ return 0;
	210	+}
	211	+
	212	+/*
	213	+ * usbtmc_flush - called before file handle is closed
	214	+ */
	215	+static int usbtmc_flush(struct file *file, fl_owner_t id)
	216	+{
	217	+ struct usbtmc_file_data *file_data;
	218	+ struct usbtmc_device_data *data;
	219	+
	220	+ file_data = file->private_data;
	221	+ if (file_data == NULL)
	222	+ return -ENODEV;
	223	+
	224	+ atomic_set(&file_data->closing, 1);
	225	+ data = file_data->data;
	226	+
	227	+ /* wait for io to stop */
	228	+ mutex_lock(&data->io_mutex);
	229	+
	230	+ usbtmc_draw_down(file_data);
	231	+
	232	+ spin_lock_irq(&file_data->err_lock);
	233	+ file_data->in_status = 0;
	234	+ file_data->in_transfer_size = 0;
	235	+ file_data->in_urbs_used = 0;
	236	+ file_data->out_status = 0;
	237	+ file_data->out_transfer_size = 0;
	238	+ spin_unlock_irq(&file_data->err_lock);
	239	+
	240	+ wake_up_interruptible_all(&data->waitq);
	241	+ mutex_unlock(&data->io_mutex);
177	242
178	243	return 0;
179	244	}
..	..	@@ -197,18 +262,17 @@
197	262	return 0;
198	263	}
199	264
200		-static int usbtmc_ioctl_abort_bulk_in(struct usbtmc_device_data *data)
	265	+static int usbtmc_ioctl_abort_bulk_in_tag(struct usbtmc_device_data *data,
	266	+ u8 tag)
201	267	{
202	268	u8 *buffer;
203	269	struct device *dev;
204	270	int rv;
205	271	int n;
206	272	int actual;
207		- struct usb_host_interface *current_setting;
208		- int max_size;
209	273
210	274	dev = &data->intf->dev;
211		- buffer = kmalloc(USBTMC_SIZE_IOBUFFER, GFP_KERNEL);
	275	+ buffer = kmalloc(USBTMC_BUFSIZE, GFP_KERNEL);
212	276	if (!buffer)
213	277	return -ENOMEM;
214	278
..	..	@@ -216,18 +280,31 @@
216	280	usb_rcvctrlpipe(data->usb_dev, 0),
217	281	USBTMC_REQUEST_INITIATE_ABORT_BULK_IN,
218	282	USB_DIR_IN \| USB_TYPE_CLASS \| USB_RECIP_ENDPOINT,
219		- data->bTag_last_read, data->bulk_in,
220		- buffer, 2, USBTMC_TIMEOUT);
	283	+ tag, data->bulk_in,
	284	+ buffer, 2, USB_CTRL_GET_TIMEOUT);
221	285
222	286	if (rv < 0) {
223	287	dev_err(dev, "usb_control_msg returned %d\n", rv);
224	288	goto exit;
225	289	}
226	290
227		- dev_dbg(dev, "INITIATE_ABORT_BULK_IN returned %x\n", buffer[0]);
	291	+ dev_dbg(dev, "INITIATE_ABORT_BULK_IN returned %x with tag %02x\n",
	292	+ buffer[0], buffer[1]);
228	293
229	294	if (buffer[0] == USBTMC_STATUS_FAILED) {
	295	+ /* No transfer in progress and the Bulk-OUT FIFO is empty. */
230	296	rv = 0;
	297	+ goto exit;
	298	+ }
	299	+
	300	+ if (buffer[0] == USBTMC_STATUS_TRANSFER_NOT_IN_PROGRESS) {
	301	+ /* The device returns this status if either:
	302	+ * - There is a transfer in progress, but the specified bTag
	303	+ * does not match.
	304	+ * - There is no transfer in progress, but the Bulk-OUT FIFO
	305	+ * is not empty.
	306	+ */
	307	+ rv = -ENOMSG;
231	308	goto exit;
232	309	}
233	310
..	..	@@ -238,64 +315,53 @@
238	315	goto exit;
239	316	}
240	317
241		- max_size = 0;
242		- current_setting = data->intf->cur_altsetting;
243		- for (n = 0; n < current_setting->desc.bNumEndpoints; n++)
244		- if (current_setting->endpoint[n].desc.bEndpointAddress ==
245		- data->bulk_in)
246		- max_size = usb_endpoint_maxp(&current_setting->endpoint[n].desc);
247		-
248		- if (max_size == 0) {
249		- dev_err(dev, "Couldn't get wMaxPacketSize\n");
250		- rv = -EPERM;
251		- goto exit;
252		- }
253		-
254		- dev_dbg(&data->intf->dev, "wMaxPacketSize is %d\n", max_size);
255		-
256	318	n = 0;
257	319
258		- do {
259		- dev_dbg(dev, "Reading from bulk in EP\n");
	320	+usbtmc_abort_bulk_in_status:
	321	+ dev_dbg(dev, "Reading from bulk in EP\n");
260	322
261		- rv = usb_bulk_msg(data->usb_dev,
262		- usb_rcvbulkpipe(data->usb_dev,
263		- data->bulk_in),
264		- buffer, USBTMC_SIZE_IOBUFFER,
265		- &actual, USBTMC_TIMEOUT);
	323	+ /* Data must be present. So use low timeout 300 ms */
	324	+ actual = 0;
	325	+ rv = usb_bulk_msg(data->usb_dev,
	326	+ usb_rcvbulkpipe(data->usb_dev,
	327	+ data->bulk_in),
	328	+ buffer, USBTMC_BUFSIZE,
	329	+ &actual, 300);
266	330
267		- n++;
	331	+ print_hex_dump_debug("usbtmc ", DUMP_PREFIX_NONE, 16, 1,
	332	+ buffer, actual, true);
268	333
269		- if (rv < 0) {
270		- dev_err(dev, "usb_bulk_msg returned %d\n", rv);
	334	+ n++;
	335	+
	336	+ if (rv < 0) {
	337	+ dev_err(dev, "usb_bulk_msg returned %d\n", rv);
	338	+ if (rv != -ETIMEDOUT)
271	339	goto exit;
272		- }
273		- } while ((actual == max_size) &&
274		- (n < USBTMC_MAX_READS_TO_CLEAR_BULK_IN));
	340	+ }
275	341
276		- if (actual == max_size) {
	342	+ if (actual == USBTMC_BUFSIZE)
	343	+ goto usbtmc_abort_bulk_in_status;
	344	+
	345	+ if (n >= USBTMC_MAX_READS_TO_CLEAR_BULK_IN) {
277	346	dev_err(dev, "Couldn't clear device buffer within %d cycles\n",
278	347	USBTMC_MAX_READS_TO_CLEAR_BULK_IN);
279	348	rv = -EPERM;
280	349	goto exit;
281	350	}
282	351
283		- n = 0;
284		-
285		-usbtmc_abort_bulk_in_status:
286	352	rv = usb_control_msg(data->usb_dev,
287	353	usb_rcvctrlpipe(data->usb_dev, 0),
288	354	USBTMC_REQUEST_CHECK_ABORT_BULK_IN_STATUS,
289	355	USB_DIR_IN \| USB_TYPE_CLASS \| USB_RECIP_ENDPOINT,
290	356	0, data->bulk_in, buffer, 0x08,
291		- USBTMC_TIMEOUT);
	357	+ USB_CTRL_GET_TIMEOUT);
292	358
293	359	if (rv < 0) {
294	360	dev_err(dev, "usb_control_msg returned %d\n", rv);
295	361	goto exit;
296	362	}
297	363
298		- dev_dbg(dev, "INITIATE_ABORT_BULK_IN returned %x\n", buffer[0]);
	364	+ dev_dbg(dev, "CHECK_ABORT_BULK_IN returned %x\n", buffer[0]);
299	365
300	366	if (buffer[0] == USBTMC_STATUS_SUCCESS) {
301	367	rv = 0;
..	..	@@ -303,43 +369,26 @@
303	369	}
304	370
305	371	if (buffer[0] != USBTMC_STATUS_PENDING) {
306		- dev_err(dev, "INITIATE_ABORT_BULK_IN returned %x\n", buffer[0]);
	372	+ dev_err(dev, "CHECK_ABORT_BULK_IN returned %x\n", buffer[0]);
307	373	rv = -EPERM;
308	374	goto exit;
309	375	}
310	376
311		- if (buffer[1] == 1)
312		- do {
313		- dev_dbg(dev, "Reading from bulk in EP\n");
314		-
315		- rv = usb_bulk_msg(data->usb_dev,
316		- usb_rcvbulkpipe(data->usb_dev,
317		- data->bulk_in),
318		- buffer, USBTMC_SIZE_IOBUFFER,
319		- &actual, USBTMC_TIMEOUT);
320		-
321		- n++;
322		-
323		- if (rv < 0) {
324		- dev_err(dev, "usb_bulk_msg returned %d\n", rv);
325		- goto exit;
326		- }
327		- } while ((actual == max_size) &&
328		- (n < USBTMC_MAX_READS_TO_CLEAR_BULK_IN));
329		-
330		- if (actual == max_size) {
331		- dev_err(dev, "Couldn't clear device buffer within %d cycles\n",
332		- USBTMC_MAX_READS_TO_CLEAR_BULK_IN);
333		- rv = -EPERM;
334		- goto exit;
	377	+ if ((buffer[1] & 1) > 0) {
	378	+ /* The device has 1 or more queued packets the Host can read */
	379	+ goto usbtmc_abort_bulk_in_status;
335	380	}
336	381
337		- goto usbtmc_abort_bulk_in_status;
338		-
	382	+ /* The Host must send CHECK_ABORT_BULK_IN_STATUS at a later time. */
	383	+ rv = -EAGAIN;
339	384	exit:
340	385	kfree(buffer);
341	386	return rv;
	387	+}
342	388
	389	+static int usbtmc_ioctl_abort_bulk_in(struct usbtmc_device_data *data)
	390	+{
	391	+ return usbtmc_ioctl_abort_bulk_in_tag(data, data->bTag_last_read);
343	392	}
344	393
345	394	static int usbtmc_ioctl_abort_bulk_out_tag(struct usbtmc_device_data *data,
..	..	@@ -465,7 +514,7 @@
465	514	USB_DIR_IN \| USB_TYPE_CLASS \| USB_RECIP_INTERFACE,
466	515	data->iin_bTag,
467	516	data->ifnum,
468		- buffer, 0x03, USBTMC_TIMEOUT);
	517	+ buffer, 0x03, USB_CTRL_GET_TIMEOUT);
469	518	if (rv < 0) {
470	519	dev_err(dev, "stb usb_control_msg returned %d\n", rv);
471	520	goto exit;
..	..	@@ -518,6 +567,54 @@
518	567	return rv;
519	568	}
520	569
	570	+static int usbtmc488_ioctl_wait_srq(struct usbtmc_file_data *file_data,
	571	+ __u32 __user *arg)
	572	+{
	573	+ struct usbtmc_device_data *data = file_data->data;
	574	+ struct device *dev = &data->intf->dev;
	575	+ int rv;
	576	+ u32 timeout;
	577	+ unsigned long expire;
	578	+
	579	+ if (!data->iin_ep_present) {
	580	+ dev_dbg(dev, "no interrupt endpoint present\n");
	581	+ return -EFAULT;
	582	+ }
	583	+
	584	+ if (get_user(timeout, arg))
	585	+ return -EFAULT;
	586	+
	587	+ expire = msecs_to_jiffies(timeout);
	588	+
	589	+ mutex_unlock(&data->io_mutex);
	590	+
	591	+ rv = wait_event_interruptible_timeout(
	592	+ data->waitq,
	593	+ atomic_read(&file_data->srq_asserted) != 0 \|\|
	594	+ atomic_read(&file_data->closing),
	595	+ expire);
	596	+
	597	+ mutex_lock(&data->io_mutex);
	598	+
	599	+ /* Note! disconnect or close could be called in the meantime */
	600	+ if (atomic_read(&file_data->closing) \|\| data->zombie)
	601	+ rv = -ENODEV;
	602	+
	603	+ if (rv < 0) {
	604	+ /* dev can be invalid now! */
	605	+ pr_debug("%s - wait interrupted %d\n", __func__, rv);
	606	+ return rv;
	607	+ }
	608	+
	609	+ if (rv == 0) {
	610	+ dev_dbg(dev, "%s - wait timed out\n", __func__);
	611	+ return -ETIMEDOUT;
	612	+ }
	613	+
	614	+ dev_dbg(dev, "%s - srq asserted\n", __func__);
	615	+ return 0;
	616	+}
	617	+
521	618	static int usbtmc488_ioctl_simple(struct usbtmc_device_data *data,
522	619	void __user *arg, unsigned int cmd)
523	620	{
..	..	@@ -551,7 +648,7 @@
551	648	USB_DIR_IN \| USB_TYPE_CLASS \| USB_RECIP_INTERFACE,
552	649	wValue,
553	650	data->ifnum,
554		- buffer, 0x01, USBTMC_TIMEOUT);
	651	+ buffer, 0x01, USB_CTRL_GET_TIMEOUT);
555	652	if (rv < 0) {
556	653	dev_err(dev, "simple usb_control_msg failed %d\n", rv);
557	654	goto exit;
..	..	@@ -618,6 +715,559 @@
618	715	return 0;
619	716	}
620	717
	718	+static struct urb *usbtmc_create_urb(void)
	719	+{
	720	+ const size_t bufsize = USBTMC_BUFSIZE;
	721	+ u8 *dmabuf = NULL;
	722	+ struct urb *urb = usb_alloc_urb(0, GFP_KERNEL);
	723	+
	724	+ if (!urb)
	725	+ return NULL;
	726	+
	727	+ dmabuf = kmalloc(bufsize, GFP_KERNEL);
	728	+ if (!dmabuf) {
	729	+ usb_free_urb(urb);
	730	+ return NULL;
	731	+ }
	732	+
	733	+ urb->transfer_buffer = dmabuf;
	734	+ urb->transfer_buffer_length = bufsize;
	735	+ urb->transfer_flags \|= URB_FREE_BUFFER;
	736	+ return urb;
	737	+}
	738	+
	739	+static void usbtmc_read_bulk_cb(struct urb *urb)
	740	+{
	741	+ struct usbtmc_file_data *file_data = urb->context;
	742	+ int status = urb->status;
	743	+ unsigned long flags;
	744	+
	745	+ /* sync/async unlink faults aren't errors */
	746	+ if (status) {
	747	+ if (!(/* status == -ENOENT \|\| */
	748	+ status == -ECONNRESET \|\|
	749	+ status == -EREMOTEIO \|\| /* Short packet */
	750	+ status == -ESHUTDOWN))
	751	+ dev_err(&file_data->data->intf->dev,
	752	+ "%s - nonzero read bulk status received: %d\n",
	753	+ __func__, status);
	754	+
	755	+ spin_lock_irqsave(&file_data->err_lock, flags);
	756	+ if (!file_data->in_status)
	757	+ file_data->in_status = status;
	758	+ spin_unlock_irqrestore(&file_data->err_lock, flags);
	759	+ }
	760	+
	761	+ spin_lock_irqsave(&file_data->err_lock, flags);
	762	+ file_data->in_transfer_size += urb->actual_length;
	763	+ dev_dbg(&file_data->data->intf->dev,
	764	+ "%s - total size: %u current: %d status: %d\n",
	765	+ __func__, file_data->in_transfer_size,
	766	+ urb->actual_length, status);
	767	+ spin_unlock_irqrestore(&file_data->err_lock, flags);
	768	+ usb_anchor_urb(urb, &file_data->in_anchor);
	769	+
	770	+ wake_up_interruptible(&file_data->wait_bulk_in);
	771	+ wake_up_interruptible(&file_data->data->waitq);
	772	+}
	773	+
	774	+static inline bool usbtmc_do_transfer(struct usbtmc_file_data *file_data)
	775	+{
	776	+ bool data_or_error;
	777	+
	778	+ spin_lock_irq(&file_data->err_lock);
	779	+ data_or_error = !usb_anchor_empty(&file_data->in_anchor)
	780	+ \|\| file_data->in_status;
	781	+ spin_unlock_irq(&file_data->err_lock);
	782	+ dev_dbg(&file_data->data->intf->dev, "%s: returns %d\n", __func__,
	783	+ data_or_error);
	784	+ return data_or_error;
	785	+}
	786	+
	787	+static ssize_t usbtmc_generic_read(struct usbtmc_file_data *file_data,
	788	+ void __user *user_buffer,
	789	+ u32 transfer_size,
	790	+ u32 *transferred,
	791	+ u32 flags)
	792	+{
	793	+ struct usbtmc_device_data *data = file_data->data;
	794	+ struct device *dev = &data->intf->dev;
	795	+ u32 done = 0;
	796	+ u32 remaining;
	797	+ const u32 bufsize = USBTMC_BUFSIZE;
	798	+ int retval = 0;
	799	+ u32 max_transfer_size;
	800	+ unsigned long expire;
	801	+ int bufcount = 1;
	802	+ int again = 0;
	803	+
	804	+ /* mutex already locked */
	805	+
	806	+ *transferred = done;
	807	+
	808	+ max_transfer_size = transfer_size;
	809	+
	810	+ if (flags & USBTMC_FLAG_IGNORE_TRAILER) {
	811	+ /* The device may send extra alignment bytes (up to
	812	+ * wMaxPacketSize – 1) to avoid sending a zero-length
	813	+ * packet
	814	+ */
	815	+ remaining = transfer_size;
	816	+ if ((max_transfer_size % data->wMaxPacketSize) == 0)
	817	+ max_transfer_size += (data->wMaxPacketSize - 1);
	818	+ } else {
	819	+ /* round down to bufsize to avoid truncated data left */
	820	+ if (max_transfer_size > bufsize) {
	821	+ max_transfer_size =
	822	+ roundup(max_transfer_size + 1 - bufsize,
	823	+ bufsize);
	824	+ }
	825	+ remaining = max_transfer_size;
	826	+ }
	827	+
	828	+ spin_lock_irq(&file_data->err_lock);
	829	+
	830	+ if (file_data->in_status) {
	831	+ /* return the very first error */
	832	+ retval = file_data->in_status;
	833	+ spin_unlock_irq(&file_data->err_lock);
	834	+ goto error;
	835	+ }
	836	+
	837	+ if (flags & USBTMC_FLAG_ASYNC) {
	838	+ if (usb_anchor_empty(&file_data->in_anchor))
	839	+ again = 1;
	840	+
	841	+ if (file_data->in_urbs_used == 0) {
	842	+ file_data->in_transfer_size = 0;
	843	+ file_data->in_status = 0;
	844	+ }
	845	+ } else {
	846	+ file_data->in_transfer_size = 0;
	847	+ file_data->in_status = 0;
	848	+ }
	849	+
	850	+ if (max_transfer_size == 0) {
	851	+ bufcount = 0;
	852	+ } else {
	853	+ bufcount = roundup(max_transfer_size, bufsize) / bufsize;
	854	+ if (bufcount > file_data->in_urbs_used)
	855	+ bufcount -= file_data->in_urbs_used;
	856	+ else
	857	+ bufcount = 0;
	858	+
	859	+ if (bufcount + file_data->in_urbs_used > MAX_URBS_IN_FLIGHT) {
	860	+ bufcount = MAX_URBS_IN_FLIGHT -
	861	+ file_data->in_urbs_used;
	862	+ }
	863	+ }
	864	+ spin_unlock_irq(&file_data->err_lock);
	865	+
	866	+ dev_dbg(dev, "%s: requested=%u flags=0x%X size=%u bufs=%d used=%d\n",
	867	+ __func__, transfer_size, flags,
	868	+ max_transfer_size, bufcount, file_data->in_urbs_used);
	869	+
	870	+ while (bufcount > 0) {
	871	+ u8 *dmabuf = NULL;
	872	+ struct urb *urb = usbtmc_create_urb();
	873	+
	874	+ if (!urb) {
	875	+ retval = -ENOMEM;
	876	+ goto error;
	877	+ }
	878	+
	879	+ dmabuf = urb->transfer_buffer;
	880	+
	881	+ usb_fill_bulk_urb(urb, data->usb_dev,
	882	+ usb_rcvbulkpipe(data->usb_dev, data->bulk_in),
	883	+ dmabuf, bufsize,
	884	+ usbtmc_read_bulk_cb, file_data);
	885	+
	886	+ usb_anchor_urb(urb, &file_data->submitted);
	887	+ retval = usb_submit_urb(urb, GFP_KERNEL);
	888	+ /* urb is anchored. We can release our reference. */
	889	+ usb_free_urb(urb);
	890	+ if (unlikely(retval)) {
	891	+ usb_unanchor_urb(urb);
	892	+ goto error;
	893	+ }
	894	+ file_data->in_urbs_used++;
	895	+ bufcount--;
	896	+ }
	897	+
	898	+ if (again) {
	899	+ dev_dbg(dev, "%s: ret=again\n", __func__);
	900	+ return -EAGAIN;
	901	+ }
	902	+
	903	+ if (user_buffer == NULL)
	904	+ return -EINVAL;
	905	+
	906	+ expire = msecs_to_jiffies(file_data->timeout);
	907	+
	908	+ while (max_transfer_size > 0) {
	909	+ u32 this_part;
	910	+ struct urb *urb = NULL;
	911	+
	912	+ if (!(flags & USBTMC_FLAG_ASYNC)) {
	913	+ dev_dbg(dev, "%s: before wait time %lu\n",
	914	+ __func__, expire);
	915	+ retval = wait_event_interruptible_timeout(
	916	+ file_data->wait_bulk_in,
	917	+ usbtmc_do_transfer(file_data),
	918	+ expire);
	919	+
	920	+ dev_dbg(dev, "%s: wait returned %d\n",
	921	+ __func__, retval);
	922	+
	923	+ if (retval <= 0) {
	924	+ if (retval == 0)
	925	+ retval = -ETIMEDOUT;
	926	+ goto error;
	927	+ }
	928	+ }
	929	+
	930	+ urb = usb_get_from_anchor(&file_data->in_anchor);
	931	+ if (!urb) {
	932	+ if (!(flags & USBTMC_FLAG_ASYNC)) {
	933	+ /* synchronous case: must not happen */
	934	+ retval = -EFAULT;
	935	+ goto error;
	936	+ }
	937	+
	938	+ /* asynchronous case: ready, do not block or wait */
	939	+ *transferred = done;
	940	+ dev_dbg(dev, "%s: (async) done=%u ret=0\n",
	941	+ __func__, done);
	942	+ return 0;
	943	+ }
	944	+
	945	+ file_data->in_urbs_used--;
	946	+
	947	+ if (max_transfer_size > urb->actual_length)
	948	+ max_transfer_size -= urb->actual_length;
	949	+ else
	950	+ max_transfer_size = 0;
	951	+
	952	+ if (remaining > urb->actual_length)
	953	+ this_part = urb->actual_length;
	954	+ else
	955	+ this_part = remaining;
	956	+
	957	+ print_hex_dump_debug("usbtmc ", DUMP_PREFIX_NONE, 16, 1,
	958	+ urb->transfer_buffer, urb->actual_length, true);
	959	+
	960	+ if (copy_to_user(user_buffer + done,
	961	+ urb->transfer_buffer, this_part)) {
	962	+ usb_free_urb(urb);
	963	+ retval = -EFAULT;
	964	+ goto error;
	965	+ }
	966	+
	967	+ remaining -= this_part;
	968	+ done += this_part;
	969	+
	970	+ spin_lock_irq(&file_data->err_lock);
	971	+ if (urb->status) {
	972	+ /* return the very first error */
	973	+ retval = file_data->in_status;
	974	+ spin_unlock_irq(&file_data->err_lock);
	975	+ usb_free_urb(urb);
	976	+ goto error;
	977	+ }
	978	+ spin_unlock_irq(&file_data->err_lock);
	979	+
	980	+ if (urb->actual_length < bufsize) {
	981	+ /* short packet or ZLP received => ready */
	982	+ usb_free_urb(urb);
	983	+ retval = 1;
	984	+ break;
	985	+ }
	986	+
	987	+ if (!(flags & USBTMC_FLAG_ASYNC) &&
	988	+ max_transfer_size > (bufsize * file_data->in_urbs_used)) {
	989	+ /* resubmit, since other buffers still not enough */
	990	+ usb_anchor_urb(urb, &file_data->submitted);
	991	+ retval = usb_submit_urb(urb, GFP_KERNEL);
	992	+ if (unlikely(retval)) {
	993	+ usb_unanchor_urb(urb);
	994	+ usb_free_urb(urb);
	995	+ goto error;
	996	+ }
	997	+ file_data->in_urbs_used++;
	998	+ }
	999	+ usb_free_urb(urb);
	1000	+ retval = 0;
	1001	+ }
	1002	+
	1003	+error:
	1004	+ *transferred = done;
	1005	+
	1006	+ dev_dbg(dev, "%s: before kill\n", __func__);
	1007	+ /* Attention: killing urbs can take long time (2 ms) */
	1008	+ usb_kill_anchored_urbs(&file_data->submitted);
	1009	+ dev_dbg(dev, "%s: after kill\n", __func__);
	1010	+ usb_scuttle_anchored_urbs(&file_data->in_anchor);
	1011	+ file_data->in_urbs_used = 0;
	1012	+ file_data->in_status = 0; /* no spinlock needed here */
	1013	+ dev_dbg(dev, "%s: done=%u ret=%d\n", __func__, done, retval);
	1014	+
	1015	+ return retval;
	1016	+}
	1017	+
	1018	+static ssize_t usbtmc_ioctl_generic_read(struct usbtmc_file_data *file_data,
	1019	+ void __user *arg)
	1020	+{
	1021	+ struct usbtmc_message msg;
	1022	+ ssize_t retval = 0;
	1023	+
	1024	+ /* mutex already locked */
	1025	+
	1026	+ if (copy_from_user(&msg, arg, sizeof(struct usbtmc_message)))
	1027	+ return -EFAULT;
	1028	+
	1029	+ retval = usbtmc_generic_read(file_data, msg.message,
	1030	+ msg.transfer_size, &msg.transferred,
	1031	+ msg.flags);
	1032	+
	1033	+ if (put_user(msg.transferred,
	1034	+ &((struct usbtmc_message __user *)arg)->transferred))
	1035	+ return -EFAULT;
	1036	+
	1037	+ return retval;
	1038	+}
	1039	+
	1040	+static void usbtmc_write_bulk_cb(struct urb *urb)
	1041	+{
	1042	+ struct usbtmc_file_data *file_data = urb->context;
	1043	+ int wakeup = 0;
	1044	+ unsigned long flags;
	1045	+
	1046	+ spin_lock_irqsave(&file_data->err_lock, flags);
	1047	+ file_data->out_transfer_size += urb->actual_length;
	1048	+
	1049	+ /* sync/async unlink faults aren't errors */
	1050	+ if (urb->status) {
	1051	+ if (!(urb->status == -ENOENT \|\|
	1052	+ urb->status == -ECONNRESET \|\|
	1053	+ urb->status == -ESHUTDOWN))
	1054	+ dev_err(&file_data->data->intf->dev,
	1055	+ "%s - nonzero write bulk status received: %d\n",
	1056	+ __func__, urb->status);
	1057	+
	1058	+ if (!file_data->out_status) {
	1059	+ file_data->out_status = urb->status;
	1060	+ wakeup = 1;
	1061	+ }
	1062	+ }
	1063	+ spin_unlock_irqrestore(&file_data->err_lock, flags);
	1064	+
	1065	+ dev_dbg(&file_data->data->intf->dev,
	1066	+ "%s - write bulk total size: %u\n",
	1067	+ __func__, file_data->out_transfer_size);
	1068	+
	1069	+ up(&file_data->limit_write_sem);
	1070	+ if (usb_anchor_empty(&file_data->submitted) \|\| wakeup)
	1071	+ wake_up_interruptible(&file_data->data->waitq);
	1072	+}
	1073	+
	1074	+static ssize_t usbtmc_generic_write(struct usbtmc_file_data *file_data,
	1075	+ const void __user *user_buffer,
	1076	+ u32 transfer_size,
	1077	+ u32 *transferred,
	1078	+ u32 flags)
	1079	+{
	1080	+ struct usbtmc_device_data *data = file_data->data;
	1081	+ struct device *dev;
	1082	+ u32 done = 0;
	1083	+ u32 remaining;
	1084	+ unsigned long expire;
	1085	+ const u32 bufsize = USBTMC_BUFSIZE;
	1086	+ struct urb *urb = NULL;
	1087	+ int retval = 0;
	1088	+ u32 timeout;
	1089	+
	1090	+ *transferred = 0;
	1091	+
	1092	+ /* Get pointer to private data structure */
	1093	+ dev = &data->intf->dev;
	1094	+
	1095	+ dev_dbg(dev, "%s: size=%u flags=0x%X sema=%u\n",
	1096	+ __func__, transfer_size, flags,
	1097	+ file_data->limit_write_sem.count);
	1098	+
	1099	+ if (flags & USBTMC_FLAG_APPEND) {
	1100	+ spin_lock_irq(&file_data->err_lock);
	1101	+ retval = file_data->out_status;
	1102	+ spin_unlock_irq(&file_data->err_lock);
	1103	+ if (retval < 0)
	1104	+ return retval;
	1105	+ } else {
	1106	+ spin_lock_irq(&file_data->err_lock);
	1107	+ file_data->out_transfer_size = 0;
	1108	+ file_data->out_status = 0;
	1109	+ spin_unlock_irq(&file_data->err_lock);
	1110	+ }
	1111	+
	1112	+ remaining = transfer_size;
	1113	+ if (remaining > INT_MAX)
	1114	+ remaining = INT_MAX;
	1115	+
	1116	+ timeout = file_data->timeout;
	1117	+ expire = msecs_to_jiffies(timeout);
	1118	+
	1119	+ while (remaining > 0) {
	1120	+ u32 this_part, aligned;
	1121	+ u8 *buffer = NULL;
	1122	+
	1123	+ if (flags & USBTMC_FLAG_ASYNC) {
	1124	+ if (down_trylock(&file_data->limit_write_sem)) {
	1125	+ retval = (done)?(0):(-EAGAIN);
	1126	+ goto exit;
	1127	+ }
	1128	+ } else {
	1129	+ retval = down_timeout(&file_data->limit_write_sem,
	1130	+ expire);
	1131	+ if (retval < 0) {
	1132	+ retval = -ETIMEDOUT;
	1133	+ goto error;
	1134	+ }
	1135	+ }
	1136	+
	1137	+ spin_lock_irq(&file_data->err_lock);
	1138	+ retval = file_data->out_status;
	1139	+ spin_unlock_irq(&file_data->err_lock);
	1140	+ if (retval < 0) {
	1141	+ up(&file_data->limit_write_sem);
	1142	+ goto error;
	1143	+ }
	1144	+
	1145	+ /* prepare next urb to send */
	1146	+ urb = usbtmc_create_urb();
	1147	+ if (!urb) {
	1148	+ retval = -ENOMEM;
	1149	+ up(&file_data->limit_write_sem);
	1150	+ goto error;
	1151	+ }
	1152	+ buffer = urb->transfer_buffer;
	1153	+
	1154	+ if (remaining > bufsize)
	1155	+ this_part = bufsize;
	1156	+ else
	1157	+ this_part = remaining;
	1158	+
	1159	+ if (copy_from_user(buffer, user_buffer + done, this_part)) {
	1160	+ retval = -EFAULT;
	1161	+ up(&file_data->limit_write_sem);
	1162	+ goto error;
	1163	+ }
	1164	+
	1165	+ print_hex_dump_debug("usbtmc ", DUMP_PREFIX_NONE,
	1166	+ 16, 1, buffer, this_part, true);
	1167	+
	1168	+ /* fill bulk with 32 bit alignment to meet USBTMC specification
	1169	+ * (size + 3 & ~3) rounds up and simplifies user code
	1170	+ */
	1171	+ aligned = (this_part + 3) & ~3;
	1172	+ dev_dbg(dev, "write(size:%u align:%u done:%u)\n",
	1173	+ (unsigned int)this_part,
	1174	+ (unsigned int)aligned,
	1175	+ (unsigned int)done);
	1176	+
	1177	+ usb_fill_bulk_urb(urb, data->usb_dev,
	1178	+ usb_sndbulkpipe(data->usb_dev, data->bulk_out),
	1179	+ urb->transfer_buffer, aligned,
	1180	+ usbtmc_write_bulk_cb, file_data);
	1181	+
	1182	+ usb_anchor_urb(urb, &file_data->submitted);
	1183	+ retval = usb_submit_urb(urb, GFP_KERNEL);
	1184	+ if (unlikely(retval)) {
	1185	+ usb_unanchor_urb(urb);
	1186	+ up(&file_data->limit_write_sem);
	1187	+ goto error;
	1188	+ }
	1189	+
	1190	+ usb_free_urb(urb);
	1191	+ urb = NULL; /* urb will be finally released by usb driver */
	1192	+
	1193	+ remaining -= this_part;
	1194	+ done += this_part;
	1195	+ }
	1196	+
	1197	+ /* All urbs are on the fly */
	1198	+ if (!(flags & USBTMC_FLAG_ASYNC)) {
	1199	+ if (!usb_wait_anchor_empty_timeout(&file_data->submitted,
	1200	+ timeout)) {
	1201	+ retval = -ETIMEDOUT;
	1202	+ goto error;
	1203	+ }
	1204	+ }
	1205	+
	1206	+ retval = 0;
	1207	+ goto exit;
	1208	+
	1209	+error:
	1210	+ usb_kill_anchored_urbs(&file_data->submitted);
	1211	+exit:
	1212	+ usb_free_urb(urb);
	1213	+
	1214	+ spin_lock_irq(&file_data->err_lock);
	1215	+ if (!(flags & USBTMC_FLAG_ASYNC))
	1216	+ done = file_data->out_transfer_size;
	1217	+ if (!retval && file_data->out_status)
	1218	+ retval = file_data->out_status;
	1219	+ spin_unlock_irq(&file_data->err_lock);
	1220	+
	1221	+ *transferred = done;
	1222	+
	1223	+ dev_dbg(dev, "%s: done=%u, retval=%d, urbstat=%d\n",
	1224	+ __func__, done, retval, file_data->out_status);
	1225	+
	1226	+ return retval;
	1227	+}
	1228	+
	1229	+static ssize_t usbtmc_ioctl_generic_write(struct usbtmc_file_data *file_data,
	1230	+ void __user *arg)
	1231	+{
	1232	+ struct usbtmc_message msg;
	1233	+ ssize_t retval = 0;
	1234	+
	1235	+ /* mutex already locked */
	1236	+
	1237	+ if (copy_from_user(&msg, arg, sizeof(struct usbtmc_message)))
	1238	+ return -EFAULT;
	1239	+
	1240	+ retval = usbtmc_generic_write(file_data, msg.message,
	1241	+ msg.transfer_size, &msg.transferred,
	1242	+ msg.flags);
	1243	+
	1244	+ if (put_user(msg.transferred,
	1245	+ &((struct usbtmc_message __user *)arg)->transferred))
	1246	+ return -EFAULT;
	1247	+
	1248	+ return retval;
	1249	+}
	1250	+
	1251	+/*
	1252	+ * Get the generic write result
	1253	+ */
	1254	+static ssize_t usbtmc_ioctl_write_result(struct usbtmc_file_data *file_data,
	1255	+ void __user *arg)
	1256	+{
	1257	+ u32 transferred;
	1258	+ int retval;
	1259	+
	1260	+ spin_lock_irq(&file_data->err_lock);
	1261	+ transferred = file_data->out_transfer_size;
	1262	+ retval = file_data->out_status;
	1263	+ spin_unlock_irq(&file_data->err_lock);
	1264	+
	1265	+ if (put_user(transferred, (__u32 __user *)arg))
	1266	+ return -EFAULT;
	1267	+
	1268	+ return retval;
	1269	+}
	1270	+
621	1271	/*
622	1272	* Sends a REQUEST_DEV_DEP_MSG_IN message on the Bulk-OUT endpoint.
623	1273	* @transfer_size: number of bytes to request from the device.
..	..	@@ -627,7 +1277,7 @@
627	1277	* Also updates bTag_last_write.
628	1278	*/
629	1279	static int send_request_dev_dep_msg_in(struct usbtmc_file_data *file_data,
630		- size_t transfer_size)
	1280	+ u32 transfer_size)
631	1281	{
632	1282	struct usbtmc_device_data *data = file_data->data;
633	1283	int retval;
..	..	@@ -670,12 +1320,11 @@
670	1320	data->bTag++;
671	1321
672	1322	kfree(buffer);
673		- if (retval < 0) {
674		- dev_err(&data->intf->dev, "usb_bulk_msg in send_request_dev_dep_msg_in() returned %d\n", retval);
675		- return retval;
676		- }
	1323	+ if (retval < 0)
	1324	+ dev_err(&data->intf->dev, "%s returned %d\n",
	1325	+ __func__, retval);
677	1326
678		- return 0;
	1327	+ return retval;
679	1328	}
680	1329
681	1330	static ssize_t usbtmc_read(struct file filp, char __user buf,
..	..	@@ -684,20 +1333,20 @@
684	1333	struct usbtmc_file_data *file_data;
685	1334	struct usbtmc_device_data *data;
686	1335	struct device *dev;
	1336	+ const u32 bufsize = USBTMC_BUFSIZE;
687	1337	u32 n_characters;
688	1338	u8 *buffer;
689	1339	int actual;
690		- size_t done;
691		- size_t remaining;
	1340	+ u32 done = 0;
	1341	+ u32 remaining;
692	1342	int retval;
693		- size_t this_part;
694	1343
695	1344	/* Get pointer to private data structure */
696	1345	file_data = filp->private_data;
697	1346	data = file_data->data;
698	1347	dev = &data->intf->dev;
699	1348
700		- buffer = kmalloc(USBTMC_SIZE_IOBUFFER, GFP_KERNEL);
	1349	+ buffer = kmalloc(bufsize, GFP_KERNEL);
701	1350	if (!buffer)
702	1351	return -ENOMEM;
703	1352
..	..	@@ -707,124 +1356,116 @@
707	1356	goto exit;
708	1357	}
709	1358
710		- dev_dbg(dev, "usb_bulk_msg_in: count(%zu)\n", count);
	1359	+ if (count > INT_MAX)
	1360	+ count = INT_MAX;
	1361	+
	1362	+ dev_dbg(dev, "%s(count:%zu)\n", __func__, count);
711	1363
712	1364	retval = send_request_dev_dep_msg_in(file_data, count);
713	1365
714	1366	if (retval < 0) {
715		- if (data->auto_abort)
	1367	+ if (file_data->auto_abort)
716	1368	usbtmc_ioctl_abort_bulk_out(data);
717	1369	goto exit;
718	1370	}
719	1371
720	1372	/* Loop until we have fetched everything we requested */
721	1373	remaining = count;
722		- this_part = remaining;
723		- done = 0;
	1374	+ actual = 0;
724	1375
725		- while (remaining > 0) {
726		- /* Send bulk URB */
727		- retval = usb_bulk_msg(data->usb_dev,
728		- usb_rcvbulkpipe(data->usb_dev,
729		- data->bulk_in),
730		- buffer, USBTMC_SIZE_IOBUFFER, &actual,
731		- file_data->timeout);
	1376	+ /* Send bulk URB */
	1377	+ retval = usb_bulk_msg(data->usb_dev,
	1378	+ usb_rcvbulkpipe(data->usb_dev,
	1379	+ data->bulk_in),
	1380	+ buffer, bufsize, &actual,
	1381	+ file_data->timeout);
732	1382
733		- dev_dbg(dev, "usb_bulk_msg: retval(%u), done(%zu), remaining(%zu), actual(%d)\n", retval, done, remaining, actual);
	1383	+ dev_dbg(dev, "%s: bulk_msg retval(%u), actual(%d)\n",
	1384	+ __func__, retval, actual);
734	1385
735		- /* Store bTag (in case we need to abort) */
736		- data->bTag_last_read = data->bTag;
	1386	+ /* Store bTag (in case we need to abort) */
	1387	+ data->bTag_last_read = data->bTag;
737	1388
738		- if (retval < 0) {
739		- dev_dbg(dev, "Unable to read data, error %d\n", retval);
740		- if (data->auto_abort)
741		- usbtmc_ioctl_abort_bulk_in(data);
742		- goto exit;
743		- }
744		-
745		- /* Parse header in first packet */
746		- if (done == 0) {
747		- /* Sanity checks for the header */
748		- if (actual < USBTMC_HEADER_SIZE) {
749		- dev_err(dev, "Device sent too small first packet: %u < %u\n", actual, USBTMC_HEADER_SIZE);
750		- if (data->auto_abort)
751		- usbtmc_ioctl_abort_bulk_in(data);
752		- goto exit;
753		- }
754		-
755		- if (buffer[0] != 2) {
756		- dev_err(dev, "Device sent reply with wrong MsgID: %u != 2\n", buffer[0]);
757		- if (data->auto_abort)
758		- usbtmc_ioctl_abort_bulk_in(data);
759		- goto exit;
760		- }
761		-
762		- if (buffer[1] != data->bTag_last_write) {
763		- dev_err(dev, "Device sent reply with wrong bTag: %u != %u\n", buffer[1], data->bTag_last_write);
764		- if (data->auto_abort)
765		- usbtmc_ioctl_abort_bulk_in(data);
766		- goto exit;
767		- }
768		-
769		- /* How many characters did the instrument send? */
770		- n_characters = buffer[4] +
771		- (buffer[5] << 8) +
772		- (buffer[6] << 16) +
773		- (buffer[7] << 24);
774		-
775		- if (n_characters > this_part) {
776		- dev_err(dev, "Device wants to return more data than requested: %u > %zu\n", n_characters, count);
777		- if (data->auto_abort)
778		- usbtmc_ioctl_abort_bulk_in(data);
779		- goto exit;
780		- }
781		-
782		- /* Remove the USBTMC header */
783		- actual -= USBTMC_HEADER_SIZE;
784		-
785		- /* Check if the message is smaller than requested */
786		- if (remaining > n_characters)
787		- remaining = n_characters;
788		- /* Remove padding if it exists */
789		- if (actual > remaining)
790		- actual = remaining;
791		-
792		- dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n", n_characters, buffer[8]);
793		-
794		- remaining -= actual;
795		-
796		- /* Terminate if end-of-message bit received from device */
797		- if ((buffer[8] & 0x01) && (actual >= n_characters))
798		- remaining = 0;
799		-
800		- dev_dbg(dev, "Bulk-IN header: remaining(%zu), buf(%p), buffer(%p) done(%zu)\n", remaining,buf,buffer,done);
801		-
802		-
803		- /* Copy buffer to user space */
804		- if (copy_to_user(buf + done, &buffer[USBTMC_HEADER_SIZE], actual)) {
805		- /* There must have been an addressing problem */
806		- retval = -EFAULT;
807		- goto exit;
808		- }
809		- done += actual;
810		- }
811		- else {
812		- if (actual > remaining)
813		- actual = remaining;
814		-
815		- remaining -= actual;
816		-
817		- dev_dbg(dev, "Bulk-IN header cont: actual(%u), done(%zu), remaining(%zu), buf(%p), buffer(%p)\n", actual, done, remaining,buf,buffer);
818		-
819		- /* Copy buffer to user space */
820		- if (copy_to_user(buf + done, buffer, actual)) {
821		- /* There must have been an addressing problem */
822		- retval = -EFAULT;
823		- goto exit;
824		- }
825		- done += actual;
826		- }
	1389	+ if (retval < 0) {
	1390	+ if (file_data->auto_abort)
	1391	+ usbtmc_ioctl_abort_bulk_in(data);
	1392	+ goto exit;
827	1393	}
	1394	+
	1395	+ /* Sanity checks for the header */
	1396	+ if (actual < USBTMC_HEADER_SIZE) {
	1397	+ dev_err(dev, "Device sent too small first packet: %u < %u\n",
	1398	+ actual, USBTMC_HEADER_SIZE);
	1399	+ if (file_data->auto_abort)
	1400	+ usbtmc_ioctl_abort_bulk_in(data);
	1401	+ goto exit;
	1402	+ }
	1403	+
	1404	+ if (buffer[0] != 2) {
	1405	+ dev_err(dev, "Device sent reply with wrong MsgID: %u != 2\n",
	1406	+ buffer[0]);
	1407	+ if (file_data->auto_abort)
	1408	+ usbtmc_ioctl_abort_bulk_in(data);
	1409	+ goto exit;
	1410	+ }
	1411	+
	1412	+ if (buffer[1] != data->bTag_last_write) {
	1413	+ dev_err(dev, "Device sent reply with wrong bTag: %u != %u\n",
	1414	+ buffer[1], data->bTag_last_write);
	1415	+ if (file_data->auto_abort)
	1416	+ usbtmc_ioctl_abort_bulk_in(data);
	1417	+ goto exit;
	1418	+ }
	1419	+
	1420	+ /* How many characters did the instrument send? */
	1421	+ n_characters = buffer[4] +
	1422	+ (buffer[5] << 8) +
	1423	+ (buffer[6] << 16) +
	1424	+ (buffer[7] << 24);
	1425	+
	1426	+ file_data->bmTransferAttributes = buffer[8];
	1427	+
	1428	+ dev_dbg(dev, "Bulk-IN header: N_characters(%u), bTransAttr(%u)\n",
	1429	+ n_characters, buffer[8]);
	1430	+
	1431	+ if (n_characters > remaining) {
	1432	+ dev_err(dev, "Device wants to return more data than requested: %u > %zu\n",
	1433	+ n_characters, count);
	1434	+ if (file_data->auto_abort)
	1435	+ usbtmc_ioctl_abort_bulk_in(data);
	1436	+ goto exit;
	1437	+ }
	1438	+
	1439	+ print_hex_dump_debug("usbtmc ", DUMP_PREFIX_NONE,
	1440	+ 16, 1, buffer, actual, true);
	1441	+
	1442	+ remaining = n_characters;
	1443	+
	1444	+ /* Remove the USBTMC header */
	1445	+ actual -= USBTMC_HEADER_SIZE;
	1446	+
	1447	+ /* Remove padding if it exists */
	1448	+ if (actual > remaining)
	1449	+ actual = remaining;
	1450	+
	1451	+ remaining -= actual;
	1452	+
	1453	+ /* Copy buffer to user space */
	1454	+ if (copy_to_user(buf, &buffer[USBTMC_HEADER_SIZE], actual)) {
	1455	+ /* There must have been an addressing problem */
	1456	+ retval = -EFAULT;
	1457	+ goto exit;
	1458	+ }
	1459	+
	1460	+ if ((actual + USBTMC_HEADER_SIZE) == bufsize) {
	1461	+ retval = usbtmc_generic_read(file_data, buf + actual,
	1462	+ remaining,
	1463	+ &done,
	1464	+ USBTMC_FLAG_IGNORE_TRAILER);
	1465	+ if (retval < 0)
	1466	+ goto exit;
	1467	+ }
	1468	+ done += actual;
828	1469
829	1470	/* Update file position value */
830	1471	f_pos = f_pos + done;
..	..	@@ -841,113 +1482,152 @@
841	1482	{
842	1483	struct usbtmc_file_data *file_data;
843	1484	struct usbtmc_device_data *data;
	1485	+ struct urb *urb = NULL;
	1486	+ ssize_t retval = 0;
844	1487	u8 *buffer;
845		- int retval;
846		- int actual;
847		- unsigned long int n_bytes;
848		- int remaining;
849		- int done;
850		- int this_part;
	1488	+ u32 remaining, done;
	1489	+ u32 transfersize, aligned, buflen;
851	1490
852	1491	file_data = filp->private_data;
853	1492	data = file_data->data;
854	1493
855		- buffer = kmalloc(USBTMC_SIZE_IOBUFFER, GFP_KERNEL);
856		- if (!buffer)
857		- return -ENOMEM;
858		-
859	1494	mutex_lock(&data->io_mutex);
	1495	+
860	1496	if (data->zombie) {
861	1497	retval = -ENODEV;
862	1498	goto exit;
863	1499	}
864	1500
865		- remaining = count;
866	1501	done = 0;
867	1502
868		- while (remaining > 0) {
869		- if (remaining > USBTMC_SIZE_IOBUFFER - USBTMC_HEADER_SIZE) {
870		- this_part = USBTMC_SIZE_IOBUFFER - USBTMC_HEADER_SIZE;
871		- buffer[8] = 0;
872		- } else {
873		- this_part = remaining;
874		- buffer[8] = file_data->eom_val;
875		- }
	1503	+ spin_lock_irq(&file_data->err_lock);
	1504	+ file_data->out_transfer_size = 0;
	1505	+ file_data->out_status = 0;
	1506	+ spin_unlock_irq(&file_data->err_lock);
876	1507
877		- /* Setup IO buffer for DEV_DEP_MSG_OUT message */
878		- buffer[0] = 1;
879		- buffer[1] = data->bTag;
880		- buffer[2] = ~data->bTag;
881		- buffer[3] = 0; /* Reserved */
882		- buffer[4] = this_part >> 0;
883		- buffer[5] = this_part >> 8;
884		- buffer[6] = this_part >> 16;
885		- buffer[7] = this_part >> 24;
886		- /* buffer[8] is set above... */
887		- buffer[9] = 0; /* Reserved */
888		- buffer[10] = 0; /* Reserved */
889		- buffer[11] = 0; /* Reserved */
	1508	+ if (!count)
	1509	+ goto exit;
890	1510
891		- if (copy_from_user(&buffer[USBTMC_HEADER_SIZE], buf + done, this_part)) {
892		- retval = -EFAULT;
893		- goto exit;
894		- }
895		-
896		- n_bytes = roundup(USBTMC_HEADER_SIZE + this_part, 4);
897		- memset(buffer + USBTMC_HEADER_SIZE + this_part, 0, n_bytes - (USBTMC_HEADER_SIZE + this_part));
898		-
899		- do {
900		- retval = usb_bulk_msg(data->usb_dev,
901		- usb_sndbulkpipe(data->usb_dev,
902		- data->bulk_out),
903		- buffer, n_bytes,
904		- &actual, file_data->timeout);
905		- if (retval != 0)
906		- break;
907		- n_bytes -= actual;
908		- } while (n_bytes);
909		-
910		- data->bTag_last_write = data->bTag;
911		- data->bTag++;
912		-
913		- if (!data->bTag)
914		- data->bTag++;
915		-
916		- if (retval < 0) {
917		- dev_err(&data->intf->dev,
918		- "Unable to send data, error %d\n", retval);
919		- if (data->auto_abort)
920		- usbtmc_ioctl_abort_bulk_out(data);
921		- goto exit;
922		- }
923		-
924		- remaining -= this_part;
925		- done += this_part;
	1511	+ if (down_trylock(&file_data->limit_write_sem)) {
	1512	+ /* previous calls were async */
	1513	+ retval = -EBUSY;
	1514	+ goto exit;
926	1515	}
927	1516
928		- retval = count;
	1517	+ urb = usbtmc_create_urb();
	1518	+ if (!urb) {
	1519	+ retval = -ENOMEM;
	1520	+ up(&file_data->limit_write_sem);
	1521	+ goto exit;
	1522	+ }
	1523	+
	1524	+ buffer = urb->transfer_buffer;
	1525	+ buflen = urb->transfer_buffer_length;
	1526	+
	1527	+ if (count > INT_MAX) {
	1528	+ transfersize = INT_MAX;
	1529	+ buffer[8] = 0;
	1530	+ } else {
	1531	+ transfersize = count;
	1532	+ buffer[8] = file_data->eom_val;
	1533	+ }
	1534	+
	1535	+ /* Setup IO buffer for DEV_DEP_MSG_OUT message */
	1536	+ buffer[0] = 1;
	1537	+ buffer[1] = data->bTag;
	1538	+ buffer[2] = ~data->bTag;
	1539	+ buffer[3] = 0; /* Reserved */
	1540	+ buffer[4] = transfersize >> 0;
	1541	+ buffer[5] = transfersize >> 8;
	1542	+ buffer[6] = transfersize >> 16;
	1543	+ buffer[7] = transfersize >> 24;
	1544	+ /* buffer[8] is set above... */
	1545	+ buffer[9] = 0; /* Reserved */
	1546	+ buffer[10] = 0; /* Reserved */
	1547	+ buffer[11] = 0; /* Reserved */
	1548	+
	1549	+ remaining = transfersize;
	1550	+
	1551	+ if (transfersize + USBTMC_HEADER_SIZE > buflen) {
	1552	+ transfersize = buflen - USBTMC_HEADER_SIZE;
	1553	+ aligned = buflen;
	1554	+ } else {
	1555	+ aligned = (transfersize + (USBTMC_HEADER_SIZE + 3)) & ~3;
	1556	+ }
	1557	+
	1558	+ if (copy_from_user(&buffer[USBTMC_HEADER_SIZE], buf, transfersize)) {
	1559	+ retval = -EFAULT;
	1560	+ up(&file_data->limit_write_sem);
	1561	+ goto exit;
	1562	+ }
	1563	+
	1564	+ dev_dbg(&data->intf->dev, "%s(size:%u align:%u)\n", __func__,
	1565	+ (unsigned int)transfersize, (unsigned int)aligned);
	1566	+
	1567	+ print_hex_dump_debug("usbtmc ", DUMP_PREFIX_NONE,
	1568	+ 16, 1, buffer, aligned, true);
	1569	+
	1570	+ usb_fill_bulk_urb(urb, data->usb_dev,
	1571	+ usb_sndbulkpipe(data->usb_dev, data->bulk_out),
	1572	+ urb->transfer_buffer, aligned,
	1573	+ usbtmc_write_bulk_cb, file_data);
	1574	+
	1575	+ usb_anchor_urb(urb, &file_data->submitted);
	1576	+ retval = usb_submit_urb(urb, GFP_KERNEL);
	1577	+ if (unlikely(retval)) {
	1578	+ usb_unanchor_urb(urb);
	1579	+ up(&file_data->limit_write_sem);
	1580	+ goto exit;
	1581	+ }
	1582	+
	1583	+ remaining -= transfersize;
	1584	+
	1585	+ data->bTag_last_write = data->bTag;
	1586	+ data->bTag++;
	1587	+
	1588	+ if (!data->bTag)
	1589	+ data->bTag++;
	1590	+
	1591	+ /* call generic_write even when remaining = 0 */
	1592	+ retval = usbtmc_generic_write(file_data, buf + transfersize, remaining,
	1593	+ &done, USBTMC_FLAG_APPEND);
	1594	+ /* truncate alignment bytes */
	1595	+ if (done > remaining)
	1596	+ done = remaining;
	1597	+
	1598	+ /add size of first urb/
	1599	+ done += transfersize;
	1600	+
	1601	+ if (retval < 0) {
	1602	+ usb_kill_anchored_urbs(&file_data->submitted);
	1603	+
	1604	+ dev_err(&data->intf->dev,
	1605	+ "Unable to send data, error %d\n", (int)retval);
	1606	+ if (file_data->auto_abort)
	1607	+ usbtmc_ioctl_abort_bulk_out(data);
	1608	+ goto exit;
	1609	+ }
	1610	+
	1611	+ retval = done;
929	1612	exit:
	1613	+ usb_free_urb(urb);
930	1614	mutex_unlock(&data->io_mutex);
931		- kfree(buffer);
932	1615	return retval;
933	1616	}
934	1617
935	1618	static int usbtmc_ioctl_clear(struct usbtmc_device_data *data)
936	1619	{
937		- struct usb_host_interface *current_setting;
938		- struct usb_endpoint_descriptor *desc;
939	1620	struct device *dev;
940	1621	u8 *buffer;
941	1622	int rv;
942	1623	int n;
943	1624	int actual = 0;
944		- int max_size;
945	1625
946	1626	dev = &data->intf->dev;
947	1627
948	1628	dev_dbg(dev, "Sending INITIATE_CLEAR request\n");
949	1629
950		- buffer = kmalloc(USBTMC_SIZE_IOBUFFER, GFP_KERNEL);
	1630	+ buffer = kmalloc(USBTMC_BUFSIZE, GFP_KERNEL);
951	1631	if (!buffer)
952	1632	return -ENOMEM;
953	1633
..	..	@@ -955,7 +1635,7 @@
955	1635	usb_rcvctrlpipe(data->usb_dev, 0),
956	1636	USBTMC_REQUEST_INITIATE_CLEAR,
957	1637	USB_DIR_IN \| USB_TYPE_CLASS \| USB_RECIP_INTERFACE,
958		- 0, 0, buffer, 1, USBTMC_TIMEOUT);
	1638	+ 0, 0, buffer, 1, USB_CTRL_GET_TIMEOUT);
959	1639	if (rv < 0) {
960	1640	dev_err(dev, "usb_control_msg returned %d\n", rv);
961	1641	goto exit;
..	..	@@ -969,22 +1649,6 @@
969	1649	goto exit;
970	1650	}
971	1651
972		- max_size = 0;
973		- current_setting = data->intf->cur_altsetting;
974		- for (n = 0; n < current_setting->desc.bNumEndpoints; n++) {
975		- desc = &current_setting->endpoint[n].desc;
976		- if (desc->bEndpointAddress == data->bulk_in)
977		- max_size = usb_endpoint_maxp(desc);
978		- }
979		-
980		- if (max_size == 0) {
981		- dev_err(dev, "Couldn't get wMaxPacketSize\n");
982		- rv = -EPERM;
983		- goto exit;
984		- }
985		-
986		- dev_dbg(dev, "wMaxPacketSize is %d\n", max_size);
987		-
988	1652	n = 0;
989	1653
990	1654	usbtmc_clear_check_status:
..	..	@@ -995,7 +1659,7 @@
995	1659	usb_rcvctrlpipe(data->usb_dev, 0),
996	1660	USBTMC_REQUEST_CHECK_CLEAR_STATUS,
997	1661	USB_DIR_IN \| USB_TYPE_CLASS \| USB_RECIP_INTERFACE,
998		- 0, 0, buffer, 2, USBTMC_TIMEOUT);
	1662	+ 0, 0, buffer, 2, USB_CTRL_GET_TIMEOUT);
999	1663	if (rv < 0) {
1000	1664	dev_err(dev, "usb_control_msg returned %d\n", rv);
1001	1665	goto exit;
..	..	@@ -1012,7 +1676,7 @@
1012	1676	goto exit;
1013	1677	}
1014	1678
1015		- if (buffer[1] == 1)
	1679	+ if ((buffer[1] & 1) != 0) {
1016	1680	do {
1017	1681	dev_dbg(dev, "Reading from bulk in EP\n");
1018	1682
..	..	@@ -1020,8 +1684,12 @@
1020	1684	rv = usb_bulk_msg(data->usb_dev,
1021	1685	usb_rcvbulkpipe(data->usb_dev,
1022	1686	data->bulk_in),
1023		- buffer, USBTMC_SIZE_IOBUFFER,
1024		- &actual, USBTMC_TIMEOUT);
	1687	+ buffer, USBTMC_BUFSIZE,
	1688	+ &actual, USB_CTRL_GET_TIMEOUT);
	1689	+
	1690	+ print_hex_dump_debug("usbtmc ", DUMP_PREFIX_NONE,
	1691	+ 16, 1, buffer, actual, true);
	1692	+
1025	1693	n++;
1026	1694
1027	1695	if (rv < 0) {
..	..	@@ -1029,10 +1697,15 @@
1029	1697	rv);
1030	1698	goto exit;
1031	1699	}
1032		- } while ((actual == max_size) &&
	1700	+ } while ((actual == USBTMC_BUFSIZE) &&
1033	1701	(n < USBTMC_MAX_READS_TO_CLEAR_BULK_IN));
	1702	+ } else {
	1703	+ /* do not stress device with subsequent requests */
	1704	+ msleep(50);
	1705	+ n++;
	1706	+ }
1034	1707
1035		- if (actual == max_size) {
	1708	+ if (n >= USBTMC_MAX_READS_TO_CLEAR_BULK_IN) {
1036	1709	dev_err(dev, "Couldn't clear device buffer within %d cycles\n",
1037	1710	USBTMC_MAX_READS_TO_CLEAR_BULK_IN);
1038	1711	rv = -EPERM;
..	..	@@ -1046,7 +1719,7 @@
1046	1719	rv = usb_clear_halt(data->usb_dev,
1047	1720	usb_sndbulkpipe(data->usb_dev, data->bulk_out));
1048	1721	if (rv < 0) {
1049		- dev_err(dev, "usb_control_msg returned %d\n", rv);
	1722	+ dev_err(dev, "usb_clear_halt returned %d\n", rv);
1050	1723	goto exit;
1051	1724	}
1052	1725	rv = 0;
..	..	@@ -1063,12 +1736,9 @@
1063	1736	rv = usb_clear_halt(data->usb_dev,
1064	1737	usb_sndbulkpipe(data->usb_dev, data->bulk_out));
1065	1738
1066		- if (rv < 0) {
1067		- dev_err(&data->usb_dev->dev, "usb_control_msg returned %d\n",
1068		- rv);
1069		- return rv;
1070		- }
1071		- return 0;
	1739	+ if (rv < 0)
	1740	+ dev_err(&data->usb_dev->dev, "%s returned %d\n", __func__, rv);
	1741	+ return rv;
1072	1742	}
1073	1743
1074	1744	static int usbtmc_ioctl_clear_in_halt(struct usbtmc_device_data *data)
..	..	@@ -1078,11 +1748,33 @@
1078	1748	rv = usb_clear_halt(data->usb_dev,
1079	1749	usb_rcvbulkpipe(data->usb_dev, data->bulk_in));
1080	1750
1081		- if (rv < 0) {
1082		- dev_err(&data->usb_dev->dev, "usb_control_msg returned %d\n",
1083		- rv);
1084		- return rv;
1085		- }
	1751	+ if (rv < 0)
	1752	+ dev_err(&data->usb_dev->dev, "%s returned %d\n", __func__, rv);
	1753	+ return rv;
	1754	+}
	1755	+
	1756	+static int usbtmc_ioctl_cancel_io(struct usbtmc_file_data *file_data)
	1757	+{
	1758	+ spin_lock_irq(&file_data->err_lock);
	1759	+ file_data->in_status = -ECANCELED;
	1760	+ file_data->out_status = -ECANCELED;
	1761	+ spin_unlock_irq(&file_data->err_lock);
	1762	+ usb_kill_anchored_urbs(&file_data->submitted);
	1763	+ return 0;
	1764	+}
	1765	+
	1766	+static int usbtmc_ioctl_cleanup_io(struct usbtmc_file_data *file_data)
	1767	+{
	1768	+ usb_kill_anchored_urbs(&file_data->submitted);
	1769	+ usb_scuttle_anchored_urbs(&file_data->in_anchor);
	1770	+ spin_lock_irq(&file_data->err_lock);
	1771	+ file_data->in_status = 0;
	1772	+ file_data->in_transfer_size = 0;
	1773	+ file_data->out_status = 0;
	1774	+ file_data->out_transfer_size = 0;
	1775	+ spin_unlock_irq(&file_data->err_lock);
	1776	+
	1777	+ file_data->in_urbs_used = 0;
1086	1778	return 0;
1087	1779	}
1088	1780
..	..	@@ -1099,7 +1791,7 @@
1099	1791	rv = usb_control_msg(data->usb_dev, usb_rcvctrlpipe(data->usb_dev, 0),
1100	1792	USBTMC_REQUEST_GET_CAPABILITIES,
1101	1793	USB_DIR_IN \| USB_TYPE_CLASS \| USB_RECIP_INTERFACE,
1102		- 0, 0, buffer, 0x18, USBTMC_TIMEOUT);
	1794	+ 0, 0, buffer, 0x18, USB_CTRL_GET_TIMEOUT);
1103	1795	if (rv < 0) {
1104	1796	dev_err(dev, "usb_control_msg returned %d\n", rv);
1105	1797	goto err_out;
..	..	@@ -1144,83 +1836,14 @@
1144	1836	capability_attribute(usb488_interface_capabilities);
1145	1837	capability_attribute(usb488_device_capabilities);
1146	1838
1147		-static struct attribute *capability_attrs[] = {
	1839	+static struct attribute *usbtmc_attrs[] = {
1148	1840	&dev_attr_interface_capabilities.attr,
1149	1841	&dev_attr_device_capabilities.attr,
1150	1842	&dev_attr_usb488_interface_capabilities.attr,
1151	1843	&dev_attr_usb488_device_capabilities.attr,
1152	1844	NULL,
1153	1845	};
1154		-
1155		-static const struct attribute_group capability_attr_grp = {
1156		- .attrs = capability_attrs,
1157		-};
1158		-
1159		-static ssize_t TermChar_show(struct device *dev,
1160		- struct device_attribute attr, char buf)
1161		-{
1162		- struct usb_interface *intf = to_usb_interface(dev);
1163		- struct usbtmc_device_data *data = usb_get_intfdata(intf);
1164		-
1165		- return sprintf(buf, "%c\n", data->TermChar);
1166		-}
1167		-
1168		-static ssize_t TermChar_store(struct device *dev,
1169		- struct device_attribute *attr,
1170		- const char *buf, size_t count)
1171		-{
1172		- struct usb_interface *intf = to_usb_interface(dev);
1173		- struct usbtmc_device_data *data = usb_get_intfdata(intf);
1174		-
1175		- if (count < 1)
1176		- return -EINVAL;
1177		- data->TermChar = buf[0];
1178		- return count;
1179		-}
1180		-static DEVICE_ATTR_RW(TermChar);
1181		-
1182		-#define data_attribute(name) \
1183		-static ssize_t name##_show(struct device *dev, \
1184		- struct device_attribute attr, char buf) \
1185		-{ \
1186		- struct usb_interface *intf = to_usb_interface(dev); \
1187		- struct usbtmc_device_data *data = usb_get_intfdata(intf); \
1188		- \
1189		- return sprintf(buf, "%d\n", data->name); \
1190		-} \
1191		-static ssize_t name##_store(struct device *dev, \
1192		- struct device_attribute *attr, \
1193		- const char *buf, size_t count) \
1194		-{ \
1195		- struct usb_interface *intf = to_usb_interface(dev); \
1196		- struct usbtmc_device_data *data = usb_get_intfdata(intf); \
1197		- ssize_t result; \
1198		- unsigned val; \
1199		- \
1200		- result = sscanf(buf, "%u\n", &val); \
1201		- if (result != 1) \
1202		- result = -EINVAL; \
1203		- data->name = val; \
1204		- if (result < 0) \
1205		- return result; \
1206		- else \
1207		- return count; \
1208		-} \
1209		-static DEVICE_ATTR_RW(name)
1210		-
1211		-data_attribute(TermCharEnabled);
1212		-data_attribute(auto_abort);
1213		-
1214		-static struct attribute *data_attrs[] = {
1215		- &dev_attr_TermChar.attr,
1216		- &dev_attr_TermCharEnabled.attr,
1217		- &dev_attr_auto_abort.attr,
1218		- NULL,
1219		-};
1220		-
1221		-static const struct attribute_group data_attr_grp = {
1222		- .attrs = data_attrs,
1223		-};
	1846	+ATTRIBUTE_GROUPS(usbtmc);
1224	1847
1225	1848	static int usbtmc_ioctl_indicator_pulse(struct usbtmc_device_data *data)
1226	1849	{
..	..	@@ -1238,7 +1861,7 @@
1238	1861	usb_rcvctrlpipe(data->usb_dev, 0),
1239	1862	USBTMC_REQUEST_INDICATOR_PULSE,
1240	1863	USB_DIR_IN \| USB_TYPE_CLASS \| USB_RECIP_INTERFACE,
1241		- 0, 0, buffer, 0x01, USBTMC_TIMEOUT);
	1864	+ 0, 0, buffer, 0x01, USB_CTRL_GET_TIMEOUT);
1242	1865
1243	1866	if (rv < 0) {
1244	1867	dev_err(dev, "usb_control_msg returned %d\n", rv);
..	..	@@ -1255,6 +1878,72 @@
1255	1878	rv = 0;
1256	1879
1257	1880	exit:
	1881	+ kfree(buffer);
	1882	+ return rv;
	1883	+}
	1884	+
	1885	+static int usbtmc_ioctl_request(struct usbtmc_device_data *data,
	1886	+ void __user *arg)
	1887	+{
	1888	+ struct device *dev = &data->intf->dev;
	1889	+ struct usbtmc_ctrlrequest request;
	1890	+ u8 *buffer = NULL;
	1891	+ int rv;
	1892	+ unsigned int is_in, pipe;
	1893	+ unsigned long res;
	1894	+
	1895	+ res = copy_from_user(&request, arg, sizeof(struct usbtmc_ctrlrequest));
	1896	+ if (res)
	1897	+ return -EFAULT;
	1898	+
	1899	+ if (request.req.wLength > USBTMC_BUFSIZE)
	1900	+ return -EMSGSIZE;
	1901	+ if (request.req.wLength == 0) /* Length-0 requests are never IN */
	1902	+ request.req.bRequestType &= ~USB_DIR_IN;
	1903	+
	1904	+ is_in = request.req.bRequestType & USB_DIR_IN;
	1905	+
	1906	+ if (request.req.wLength) {
	1907	+ buffer = kmalloc(request.req.wLength, GFP_KERNEL);
	1908	+ if (!buffer)
	1909	+ return -ENOMEM;
	1910	+
	1911	+ if (!is_in) {
	1912	+ /* Send control data to device */
	1913	+ res = copy_from_user(buffer, request.data,
	1914	+ request.req.wLength);
	1915	+ if (res) {
	1916	+ rv = -EFAULT;
	1917	+ goto exit;
	1918	+ }
	1919	+ }
	1920	+ }
	1921	+
	1922	+ if (is_in)
	1923	+ pipe = usb_rcvctrlpipe(data->usb_dev, 0);
	1924	+ else
	1925	+ pipe = usb_sndctrlpipe(data->usb_dev, 0);
	1926	+ rv = usb_control_msg(data->usb_dev,
	1927	+ pipe,
	1928	+ request.req.bRequest,
	1929	+ request.req.bRequestType,
	1930	+ request.req.wValue,
	1931	+ request.req.wIndex,
	1932	+ buffer, request.req.wLength, USB_CTRL_GET_TIMEOUT);
	1933	+
	1934	+ if (rv < 0) {
	1935	+ dev_err(dev, "%s failed %d\n", __func__, rv);
	1936	+ goto exit;
	1937	+ }
	1938	+
	1939	+ if (rv && is_in) {
	1940	+ /* Read control data from device */
	1941	+ res = copy_to_user(request.data, buffer, rv);
	1942	+ if (res)
	1943	+ rv = -EFAULT;
	1944	+ }
	1945	+
	1946	+ exit:
1258	1947	kfree(buffer);
1259	1948	return rv;
1260	1949	}
..	..	@@ -1340,6 +2029,7 @@
1340	2029	struct usbtmc_file_data *file_data;
1341	2030	struct usbtmc_device_data *data;
1342	2031	int retval = -EBADRQC;
	2032	+ __u8 tmp_byte;
1343	2033
1344	2034	file_data = file->private_data;
1345	2035	data = file_data->data;
..	..	@@ -1375,6 +2065,10 @@
1375	2065	retval = usbtmc_ioctl_abort_bulk_in(data);
1376	2066	break;
1377	2067
	2068	+ case USBTMC_IOCTL_CTRL_REQUEST:
	2069	+ retval = usbtmc_ioctl_request(data, (void __user *)arg);
	2070	+ break;
	2071	+
1378	2072	case USBTMC_IOCTL_GET_TIMEOUT:
1379	2073	retval = usbtmc_ioctl_get_timeout(file_data,
1380	2074	(void __user *)arg);
..	..	@@ -1395,12 +2089,29 @@
1395	2089	(void __user *)arg);
1396	2090	break;
1397	2091
	2092	+ case USBTMC_IOCTL_WRITE:
	2093	+ retval = usbtmc_ioctl_generic_write(file_data,
	2094	+ (void __user *)arg);
	2095	+ break;
	2096	+
	2097	+ case USBTMC_IOCTL_READ:
	2098	+ retval = usbtmc_ioctl_generic_read(file_data,
	2099	+ (void __user *)arg);
	2100	+ break;
	2101	+
	2102	+ case USBTMC_IOCTL_WRITE_RESULT:
	2103	+ retval = usbtmc_ioctl_write_result(file_data,
	2104	+ (void __user *)arg);
	2105	+ break;
	2106	+
	2107	+ case USBTMC_IOCTL_API_VERSION:
	2108	+ retval = put_user(USBTMC_API_VERSION,
	2109	+ (__u32 __user *)arg);
	2110	+ break;
	2111	+
1398	2112	case USBTMC488_IOCTL_GET_CAPS:
1399		- retval = copy_to_user((void __user *)arg,
1400		- &data->usb488_caps,
1401		- sizeof(data->usb488_caps));
1402		- if (retval)
1403		- retval = -EFAULT;
	2113	+ retval = put_user(data->usb488_caps,
	2114	+ (unsigned char __user *)arg);
1404	2115	break;
1405	2116
1406	2117	case USBTMC488_IOCTL_READ_STB:
..	..	@@ -1425,6 +2136,30 @@
1425	2136
1426	2137	case USBTMC488_IOCTL_TRIGGER:
1427	2138	retval = usbtmc488_ioctl_trigger(file_data);
	2139	+ break;
	2140	+
	2141	+ case USBTMC488_IOCTL_WAIT_SRQ:
	2142	+ retval = usbtmc488_ioctl_wait_srq(file_data,
	2143	+ (__u32 __user *)arg);
	2144	+ break;
	2145	+
	2146	+ case USBTMC_IOCTL_MSG_IN_ATTR:
	2147	+ retval = put_user(file_data->bmTransferAttributes,
	2148	+ (__u8 __user *)arg);
	2149	+ break;
	2150	+
	2151	+ case USBTMC_IOCTL_AUTO_ABORT:
	2152	+ retval = get_user(tmp_byte, (unsigned char __user *)arg);
	2153	+ if (retval == 0)
	2154	+ file_data->auto_abort = !!tmp_byte;
	2155	+ break;
	2156	+
	2157	+ case USBTMC_IOCTL_CANCEL_IO:
	2158	+ retval = usbtmc_ioctl_cancel_io(file_data);
	2159	+ break;
	2160	+
	2161	+ case USBTMC_IOCTL_CLEANUP_IO:
	2162	+ retval = usbtmc_ioctl_cleanup_io(file_data);
1428	2163	break;
1429	2164	}
1430	2165
..	..	@@ -1455,7 +2190,28 @@
1455	2190
1456	2191	poll_wait(file, &data->waitq, wait);
1457	2192
1458		- mask = (atomic_read(&file_data->srq_asserted)) ? EPOLLPRI : 0;
	2193	+ /* Note that EPOLLPRI is now assigned to SRQ, and
	2194	+ * EPOLLIN\|EPOLLRDNORM to normal read data.
	2195	+ */
	2196	+ mask = 0;
	2197	+ if (atomic_read(&file_data->srq_asserted))
	2198	+ mask \|= EPOLLPRI;
	2199	+
	2200	+ /* Note that the anchor submitted includes all urbs for BULK IN
	2201	+ * and OUT. So EPOLLOUT is signaled when BULK OUT is empty and
	2202	+ * all BULK IN urbs are completed and moved to in_anchor.
	2203	+ */
	2204	+ if (usb_anchor_empty(&file_data->submitted))
	2205	+ mask \|= (EPOLLOUT \| EPOLLWRNORM);
	2206	+ if (!usb_anchor_empty(&file_data->in_anchor))
	2207	+ mask \|= (EPOLLIN \| EPOLLRDNORM);
	2208	+
	2209	+ spin_lock_irq(&file_data->err_lock);
	2210	+ if (file_data->in_status \|\| file_data->out_status)
	2211	+ mask \|= EPOLLERR;
	2212	+ spin_unlock_irq(&file_data->err_lock);
	2213	+
	2214	+ dev_dbg(&data->intf->dev, "poll mask = %x\n", mask);
1459	2215
1460	2216	no_poll:
1461	2217	mutex_unlock(&data->io_mutex);
..	..	@@ -1468,10 +2224,9 @@
1468	2224	.write = usbtmc_write,
1469	2225	.open = usbtmc_open,
1470	2226	.release = usbtmc_release,
	2227	+ .flush = usbtmc_flush,
1471	2228	.unlocked_ioctl = usbtmc_ioctl,
1472		-#ifdef CONFIG_COMPAT
1473		- .compat_ioctl = usbtmc_ioctl,
1474		-#endif
	2229	+ .compat_ioctl = compat_ptr_ioctl,
1475	2230	.fasync = usbtmc_fasync,
1476	2231	.poll = usbtmc_poll,
1477	2232	.llseek = default_llseek,
..	..	@@ -1536,7 +2291,7 @@
1536	2291	case -EOVERFLOW:
1537	2292	dev_err(dev, "overflow with length %d, actual length is %d\n",
1538	2293	data->iin_wMaxPacketSize, urb->actual_length);
1539		- /* fall through */
	2294	+ fallthrough;
1540	2295	default:
1541	2296	/* urb terminated, clean up */
1542	2297	dev_dbg(dev, "urb terminated, status: %d\n", status);
..	..	@@ -1554,7 +2309,9 @@
1554	2309	return;
1555	2310	usb_kill_urb(data->iin_urb);
1556	2311	kfree(data->iin_buffer);
	2312	+ data->iin_buffer = NULL;
1557	2313	usb_free_urb(data->iin_urb);
	2314	+ data->iin_urb = NULL;
1558	2315	kref_put(&data->kref, usbtmc_delete);
1559	2316	}
1560	2317
..	..	@@ -1587,8 +2344,6 @@
1587	2344
1588	2345	/* Initialize USBTMC bTag and other fields */
1589	2346	data->bTag = 1;
1590		- data->TermCharEnabled = 0;
1591		- data->TermChar = '\n';
1592	2347	/* 2 <= bTag <= 127 USBTMC-USB488 subclass specification 4.3.1 */
1593	2348	data->iin_bTag = 2;
1594	2349
..	..	@@ -1604,7 +2359,11 @@
1604	2359	goto err_put;
1605	2360	}
1606	2361
	2362	+ retcode = -EINVAL;
1607	2363	data->bulk_in = bulk_in->bEndpointAddress;
	2364	+ data->wMaxPacketSize = usb_endpoint_maxp(bulk_in);
	2365	+ if (!data->wMaxPacketSize)
	2366	+ goto err_put;
1608	2367	dev_dbg(&intf->dev, "Found bulk in endpoint at %u\n", data->bulk_in);
1609	2368
1610	2369	data->bulk_out = bulk_out->bEndpointAddress;
..	..	@@ -1624,9 +2383,6 @@
1624	2383	retcode = get_capabilities(data);
1625	2384	if (retcode)
1626	2385	dev_err(&intf->dev, "can't read capabilities\n");
1627		- else
1628		- retcode = sysfs_create_group(&intf->dev.kobj,
1629		- &capability_attr_grp);
1630	2386
1631	2387	if (data->iin_ep_present) {
1632	2388	/* allocate int urb */
..	..	@@ -1661,12 +2417,10 @@
1661	2417	}
1662	2418	}
1663	2419
1664		- retcode = sysfs_create_group(&intf->dev.kobj, &data_attr_grp);
1665		-
1666	2420	retcode = usb_register_dev(intf, &usbtmc_class);
1667	2421	if (retcode) {
1668		- dev_err(&intf->dev, "Not able to get a minor"
1669		- " (base %u, slice default): %d\n", USBTMC_MINOR_BASE,
	2422	+ dev_err(&intf->dev, "Not able to get a minor (base %u, slice default): %d\n",
	2423	+ USBTMC_MINOR_BASE,
1670	2424	retcode);
1671	2425	goto error_register;
1672	2426	}
..	..	@@ -1675,8 +2429,6 @@
1675	2429	return 0;
1676	2430
1677	2431	error_register:
1678		- sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp);
1679		- sysfs_remove_group(&intf->dev.kobj, &data_attr_grp);
1680	2432	usbtmc_free_int(data);
1681	2433	err_put:
1682	2434	kref_put(&data->kref, usbtmc_delete);
..	..	@@ -1686,26 +2438,102 @@
1686	2438	static void usbtmc_disconnect(struct usb_interface *intf)
1687	2439	{
1688	2440	struct usbtmc_device_data *data = usb_get_intfdata(intf);
	2441	+ struct list_head *elem;
1689	2442
1690	2443	usb_deregister_dev(intf, &usbtmc_class);
1691		- sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp);
1692		- sysfs_remove_group(&intf->dev.kobj, &data_attr_grp);
1693	2444	mutex_lock(&data->io_mutex);
1694	2445	data->zombie = 1;
1695	2446	wake_up_interruptible_all(&data->waitq);
	2447	+ list_for_each(elem, &data->file_list) {
	2448	+ struct usbtmc_file_data *file_data;
	2449	+
	2450	+ file_data = list_entry(elem,
	2451	+ struct usbtmc_file_data,
	2452	+ file_elem);
	2453	+ usb_kill_anchored_urbs(&file_data->submitted);
	2454	+ usb_scuttle_anchored_urbs(&file_data->in_anchor);
	2455	+ }
1696	2456	mutex_unlock(&data->io_mutex);
1697	2457	usbtmc_free_int(data);
1698	2458	kref_put(&data->kref, usbtmc_delete);
1699	2459	}
1700	2460
	2461	+static void usbtmc_draw_down(struct usbtmc_file_data *file_data)
	2462	+{
	2463	+ int time;
	2464	+
	2465	+ time = usb_wait_anchor_empty_timeout(&file_data->submitted, 1000);
	2466	+ if (!time)
	2467	+ usb_kill_anchored_urbs(&file_data->submitted);
	2468	+ usb_scuttle_anchored_urbs(&file_data->in_anchor);
	2469	+}
	2470	+
1701	2471	static int usbtmc_suspend(struct usb_interface *intf, pm_message_t message)
1702	2472	{
1703		- /* this driver does not have pending URBs */
	2473	+ struct usbtmc_device_data *data = usb_get_intfdata(intf);
	2474	+ struct list_head *elem;
	2475	+
	2476	+ if (!data)
	2477	+ return 0;
	2478	+
	2479	+ mutex_lock(&data->io_mutex);
	2480	+ list_for_each(elem, &data->file_list) {
	2481	+ struct usbtmc_file_data *file_data;
	2482	+
	2483	+ file_data = list_entry(elem,
	2484	+ struct usbtmc_file_data,
	2485	+ file_elem);
	2486	+ usbtmc_draw_down(file_data);
	2487	+ }
	2488	+
	2489	+ if (data->iin_ep_present && data->iin_urb)
	2490	+ usb_kill_urb(data->iin_urb);
	2491	+
	2492	+ mutex_unlock(&data->io_mutex);
1704	2493	return 0;
1705	2494	}
1706	2495
1707	2496	static int usbtmc_resume(struct usb_interface *intf)
1708	2497	{
	2498	+ struct usbtmc_device_data *data = usb_get_intfdata(intf);
	2499	+ int retcode = 0;
	2500	+
	2501	+ if (data->iin_ep_present && data->iin_urb)
	2502	+ retcode = usb_submit_urb(data->iin_urb, GFP_KERNEL);
	2503	+ if (retcode)
	2504	+ dev_err(&intf->dev, "Failed to submit iin_urb\n");
	2505	+
	2506	+ return retcode;
	2507	+}
	2508	+
	2509	+static int usbtmc_pre_reset(struct usb_interface *intf)
	2510	+{
	2511	+ struct usbtmc_device_data *data = usb_get_intfdata(intf);
	2512	+ struct list_head *elem;
	2513	+
	2514	+ if (!data)
	2515	+ return 0;
	2516	+
	2517	+ mutex_lock(&data->io_mutex);
	2518	+
	2519	+ list_for_each(elem, &data->file_list) {
	2520	+ struct usbtmc_file_data *file_data;
	2521	+
	2522	+ file_data = list_entry(elem,
	2523	+ struct usbtmc_file_data,
	2524	+ file_elem);
	2525	+ usbtmc_ioctl_cancel_io(file_data);
	2526	+ }
	2527	+
	2528	+ return 0;
	2529	+}
	2530	+
	2531	+static int usbtmc_post_reset(struct usb_interface *intf)
	2532	+{
	2533	+ struct usbtmc_device_data *data = usb_get_intfdata(intf);
	2534	+
	2535	+ mutex_unlock(&data->io_mutex);
	2536	+
1709	2537	return 0;
1710	2538	}
1711	2539
..	..	@@ -1716,6 +2544,9 @@
1716	2544	.disconnect = usbtmc_disconnect,
1717	2545	.suspend = usbtmc_suspend,
1718	2546	.resume = usbtmc_resume,
	2547	+ .pre_reset = usbtmc_pre_reset,
	2548	+ .post_reset = usbtmc_post_reset,
	2549	+ .dev_groups = usbtmc_groups,
1719	2550	};
1720	2551
1721	2552	module_usb_driver(usbtmc_driver);