USB: race on disconnect in mdc800
[safe/jmp/linux-2.6] / drivers / usb / image / mdc800.c
1 /*
2  * copyright (C) 1999/2000 by Henning Zabel <henning@uni-paderborn.de>
3  *
4  * This program is free software; you can redistribute it and/or modify it
5  * under the terms of the GNU General Public License as published by the
6  * Free Software Foundation; either version 2 of the License, or (at your
7  * option) any later version.
8  *
9  * This program is distributed in the hope that it will be useful, but
10  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
11  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
12  * for more details.
13  *
14  * You should have received a copy of the GNU General Public License
15  * along with this program; if not, write to the Free Software Foundation,
16  * Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
17  */
18
19
20 /*
21  *      USB-Kernel Driver for the Mustek MDC800 Digital Camera
22  *      (c) 1999/2000 Henning Zabel <henning@uni-paderborn.de>
23  *
24  *
25  * The driver brings the USB functions of the MDC800 to Linux.
26  * To use the Camera you must support the USB Protocol of the camera
27  * to the Kernel Node.
28  * The Driver uses a misc device Node. Create it with :
29  * mknod /dev/mustek c 180 32
30  *
31  * The driver supports only one camera.
32  * 
33  * Fix: mdc800 used sleep_on and slept with io_lock held.
34  * Converted sleep_on to waitqueues with schedule_timeout and made io_lock
35  * a semaphore from a spinlock.
36  * by Oliver Neukum <oliver@neukum.name>
37  * (02/12/2001)
38  * 
39  * Identify version on module load.
40  * (08/04/2001) gb
41  *
42  * version 0.7.5
43  * Fixed potential SMP races with Spinlocks.
44  * Thanks to Oliver Neukum <oliver@neukum.name> who 
45  * noticed the race conditions.
46  * (30/10/2000)
47  *
48  * Fixed: Setting urb->dev before submitting urb.
49  * by Greg KH <greg@kroah.com>
50  * (13/10/2000)
51  *
52  * version 0.7.3
53  * bugfix : The mdc800->state field gets set to READY after the
54  * the diconnect function sets it to NOT_CONNECTED. This makes the
55  * driver running like the camera is connected and causes some
56  * hang ups.
57  *
58  * version 0.7.1
59  * MOD_INC and MOD_DEC are changed in usb_probe to prevent load/unload
60  * problems when compiled as Module.
61  * (04/04/2000)
62  *
63  * The mdc800 driver gets assigned the USB Minor 32-47. The Registration
64  * was updated to use these values.
65  * (26/03/2000)
66  *
67  * The Init und Exit Module Function are updated.
68  * (01/03/2000)
69  *
70  * version 0.7.0
71  * Rewrite of the driver : The driver now uses URB's. The old stuff
72  * has been removed.
73  *
74  * version 0.6.0
75  * Rewrite of this driver: The Emulation of the rs232 protocoll
76  * has been removed from the driver. A special executeCommand function
77  * for this driver is included to gphoto.
78  * The driver supports two kind of communication to bulk endpoints.
79  * Either with the dev->bus->ops->bulk... or with callback function.
80  * (09/11/1999)
81  *
82  * version 0.5.0:
83  * first Version that gets a version number. Most of the needed
84  * functions work.
85  * (20/10/1999)
86  */
87
88 #include <linux/sched.h>
89 #include <linux/signal.h>
90 #include <linux/spinlock.h>
91 #include <linux/errno.h>
92 #include <linux/random.h>
93 #include <linux/poll.h>
94 #include <linux/init.h>
95 #include <linux/slab.h>
96 #include <linux/module.h>
97 #include <linux/smp_lock.h>
98 #include <linux/wait.h>
99 #include <linux/mutex.h>
100
101 #include <linux/usb.h>
102 #include <linux/fs.h>
103
104 /*
105  * Version Information
106  */
107 #define DRIVER_VERSION "v0.7.5 (30/10/2000)"
108 #define DRIVER_AUTHOR "Henning Zabel <henning@uni-paderborn.de>"
109 #define DRIVER_DESC "USB Driver for Mustek MDC800 Digital Camera"
110
111 /* Vendor and Product Information */
112 #define MDC800_VENDOR_ID        0x055f
113 #define MDC800_PRODUCT_ID       0xa800
114
115 /* Timeouts (msec) */
116 #define TO_DOWNLOAD_GET_READY           1500
117 #define TO_DOWNLOAD_GET_BUSY            1500
118 #define TO_WRITE_GET_READY              1000
119 #define TO_DEFAULT_COMMAND              5000
120 #define TO_READ_FROM_IRQ                TO_DEFAULT_COMMAND
121 #define TO_GET_READY                    TO_DEFAULT_COMMAND
122
123 /* Minor Number of the device (create with mknod /dev/mustek c 180 32) */
124 #define MDC800_DEVICE_MINOR_BASE 32
125
126
127 /**************************************************************************
128         Data and structs
129 ***************************************************************************/
130
131
132 typedef enum {
133         NOT_CONNECTED, READY, WORKING, DOWNLOAD
134 } mdc800_state;
135
136
137 /* Data for the driver */
138 struct mdc800_data
139 {
140         struct usb_device *     dev;                    // Device Data
141         mdc800_state            state;
142
143         unsigned int            endpoint [4];
144
145         struct urb *            irq_urb;
146         wait_queue_head_t       irq_wait;
147         int                     irq_woken;
148         char*                   irq_urb_buffer;
149
150         int                     camera_busy;          // is camera busy ?
151         int                     camera_request_ready; // Status to synchronize with irq
152         char                    camera_response [8];  // last Bytes send after busy
153
154         struct urb *            write_urb;
155         char*                   write_urb_buffer;
156         wait_queue_head_t       write_wait;
157         int                     written;
158
159
160         struct urb *            download_urb;
161         char*                   download_urb_buffer;
162         wait_queue_head_t       download_wait;
163         int                     downloaded;
164         int                     download_left;          // Bytes left to download ?
165
166
167         /* Device Data */
168         char                    out [64];       // Answer Buffer
169         int                     out_ptr;        // Index to the first not readen byte
170         int                     out_count;      // Bytes in the buffer
171
172         int                     open;           // Camera device open ?
173         struct mutex            io_lock;        // IO -lock
174
175         char                    in [8];         // Command Input Buffer
176         int                     in_count;
177
178         int                     pic_index;      // Cache for the Imagesize (-1 for nothing cached )
179         int                     pic_len;
180         int                     minor;
181 };
182
183
184 /* Specification of the Endpoints */
185 static struct usb_endpoint_descriptor mdc800_ed [4] =
186 {
187         { 
188                 .bLength =              0,
189                 .bDescriptorType =      0,
190                 .bEndpointAddress =     0x01,
191                 .bmAttributes =         0x02,
192                 .wMaxPacketSize =       __constant_cpu_to_le16(8),
193                 .bInterval =            0,
194                 .bRefresh =             0,
195                 .bSynchAddress =        0,
196         },
197         {
198                 .bLength =              0,
199                 .bDescriptorType =      0,
200                 .bEndpointAddress =     0x82,
201                 .bmAttributes =         0x03,
202                 .wMaxPacketSize =       __constant_cpu_to_le16(8),
203                 .bInterval =            0,
204                 .bRefresh =             0,
205                 .bSynchAddress =        0,
206         },
207         {
208                 .bLength =              0,
209                 .bDescriptorType =      0,
210                 .bEndpointAddress =     0x03,
211                 .bmAttributes =         0x02,
212                 .wMaxPacketSize =       __constant_cpu_to_le16(64),
213                 .bInterval =            0,
214                 .bRefresh =             0,
215                 .bSynchAddress =        0,
216         },
217         {
218                 .bLength =              0,
219                 .bDescriptorType =      0,
220                 .bEndpointAddress =     0x84,
221                 .bmAttributes =         0x02,
222                 .wMaxPacketSize =       __constant_cpu_to_le16(64),
223                 .bInterval =            0,
224                 .bRefresh =             0,
225                 .bSynchAddress =        0,
226         },
227 };
228
229 /* The Variable used by the driver */
230 static struct mdc800_data* mdc800;
231
232
233 /***************************************************************************
234         The USB Part of the driver
235 ****************************************************************************/
236
237 static int mdc800_endpoint_equals (struct usb_endpoint_descriptor *a,struct usb_endpoint_descriptor *b)
238 {
239         return (
240                    ( a->bEndpointAddress == b->bEndpointAddress )
241                 && ( a->bmAttributes     == b->bmAttributes     )
242                 && ( a->wMaxPacketSize   == b->wMaxPacketSize   )
243         );
244 }
245
246
247 /*
248  * Checks whether the camera responds busy
249  */
250 static int mdc800_isBusy (char* ch)
251 {
252         int i=0;
253         while (i<8)
254         {
255                 if (ch [i] != (char)0x99)
256                         return 0;
257                 i++;
258         }
259         return 1;
260 }
261
262
263 /*
264  * Checks whether the Camera is ready
265  */
266 static int mdc800_isReady (char *ch)
267 {
268         int i=0;
269         while (i<8)
270         {
271                 if (ch [i] != (char)0xbb)
272                         return 0;
273                 i++;
274         }
275         return 1;
276 }
277
278
279
280 /*
281  * USB IRQ Handler for InputLine
282  */
283 static void mdc800_usb_irq (struct urb *urb)
284 {
285         int data_received=0, wake_up;
286         unsigned char* b=urb->transfer_buffer;
287         struct mdc800_data* mdc800=urb->context;
288
289         if (urb->status >= 0)
290         {
291
292                 //dbg ("%i %i %i %i %i %i %i %i \n",b[0],b[1],b[2],b[3],b[4],b[5],b[6],b[7]);
293
294                 if (mdc800_isBusy (b))
295                 {
296                         if (!mdc800->camera_busy)
297                         {
298                                 mdc800->camera_busy=1;
299                                 dbg ("gets busy");
300                         }
301                 }
302                 else
303                 {
304                         if (mdc800->camera_busy && mdc800_isReady (b))
305                         {
306                                 mdc800->camera_busy=0;
307                                 dbg ("gets ready");
308                         }
309                 }
310                 if (!(mdc800_isBusy (b) || mdc800_isReady (b)))
311                 {
312                         /* Store Data in camera_answer field */
313                         dbg ("%i %i %i %i %i %i %i %i ",b[0],b[1],b[2],b[3],b[4],b[5],b[6],b[7]);
314
315                         memcpy (mdc800->camera_response,b,8);
316                         data_received=1;
317                 }
318         }
319         wake_up= ( mdc800->camera_request_ready > 0 )
320                 &&
321                 (
322                         ((mdc800->camera_request_ready == 1) && (!mdc800->camera_busy))
323                 ||
324                         ((mdc800->camera_request_ready == 2) && data_received)
325                 ||
326                         ((mdc800->camera_request_ready == 3) && (mdc800->camera_busy))
327                 ||
328                         (urb->status < 0)
329                 );
330
331         if (wake_up)
332         {
333                 mdc800->camera_request_ready=0;
334                 mdc800->irq_woken=1;
335                 wake_up (&mdc800->irq_wait);
336         }
337 }
338
339
340 /*
341  * Waits a while until the irq responds that camera is ready
342  *
343  *  mode : 0: Wait for camera gets ready
344  *         1: Wait for receiving data
345  *         2: Wait for camera gets busy
346  *
347  * msec: Time to wait
348  */
349 static int mdc800_usb_waitForIRQ (int mode, int msec)
350 {
351         mdc800->camera_request_ready=1+mode;
352
353         wait_event_timeout(mdc800->irq_wait, mdc800->irq_woken, msec*HZ/1000);
354         mdc800->irq_woken = 0;
355
356         if (mdc800->camera_request_ready>0)
357         {
358                 mdc800->camera_request_ready=0;
359                 err ("timeout waiting for camera.");
360                 return -1;
361         }
362         
363         if (mdc800->state == NOT_CONNECTED)
364         {
365                 warn ("Camera gets disconnected during waiting for irq.");
366                 mdc800->camera_request_ready=0;
367                 return -2;
368         }
369         
370         return 0;
371 }
372
373
374 /*
375  * The write_urb callback function
376  */
377 static void mdc800_usb_write_notify (struct urb *urb)
378 {
379         struct mdc800_data* mdc800=urb->context;
380
381         if (urb->status != 0)
382         {
383                 err ("writing command fails (status=%i)", urb->status);
384         }
385         else
386         {       
387                 mdc800->state=READY;
388         }
389         mdc800->written = 1;
390         wake_up (&mdc800->write_wait);
391 }
392
393
394 /*
395  * The download_urb callback function
396  */
397 static void mdc800_usb_download_notify (struct urb *urb)
398 {
399         struct mdc800_data* mdc800=urb->context;
400
401         if (urb->status == 0)
402         {
403                 /* Fill output buffer with these data */
404                 memcpy (mdc800->out,  urb->transfer_buffer, 64);
405                 mdc800->out_count=64;
406                 mdc800->out_ptr=0;
407                 mdc800->download_left-=64;
408                 if (mdc800->download_left == 0)
409                 {
410                         mdc800->state=READY;
411                 }
412         }
413         else
414         {
415                 err ("request bytes fails (status:%i)", urb->status);
416         }
417         mdc800->downloaded = 1;
418         wake_up (&mdc800->download_wait);
419 }
420
421
422 /***************************************************************************
423         Probing for the Camera
424  ***************************************************************************/
425
426 static struct usb_driver mdc800_usb_driver;
427 static const struct file_operations mdc800_device_ops;
428 static struct usb_class_driver mdc800_class = {
429         .name =         "mdc800%d",
430         .fops =         &mdc800_device_ops,
431         .minor_base =   MDC800_DEVICE_MINOR_BASE,
432 };
433
434
435 /*
436  * Callback to search the Mustek MDC800 on the USB Bus
437  */
438 static int mdc800_usb_probe (struct usb_interface *intf,
439                                const struct usb_device_id *id)
440 {
441         int i,j;
442         struct usb_host_interface *intf_desc;
443         struct usb_device *dev = interface_to_usbdev (intf);
444         int irq_interval=0;
445         int retval;
446
447         dbg ("(mdc800_usb_probe) called.");
448
449
450         if (mdc800->dev != NULL)
451         {
452                 warn ("only one Mustek MDC800 is supported.");
453                 return -ENODEV;
454         }
455
456         if (dev->descriptor.bNumConfigurations != 1)
457         {
458                 err ("probe fails -> wrong Number of Configuration");
459                 return -ENODEV;
460         }
461         intf_desc = intf->cur_altsetting;
462
463         if (
464                         ( intf_desc->desc.bInterfaceClass != 0xff )
465                 ||      ( intf_desc->desc.bInterfaceSubClass != 0 )
466                 || ( intf_desc->desc.bInterfaceProtocol != 0 )
467                 || ( intf_desc->desc.bNumEndpoints != 4)
468         )
469         {
470                 err ("probe fails -> wrong Interface");
471                 return -ENODEV;
472         }
473
474         /* Check the Endpoints */
475         for (i=0; i<4; i++)
476         {
477                 mdc800->endpoint[i]=-1;
478                 for (j=0; j<4; j++)
479                 {
480                         if (mdc800_endpoint_equals (&intf_desc->endpoint [j].desc,&mdc800_ed [i]))
481                         {
482                                 mdc800->endpoint[i]=intf_desc->endpoint [j].desc.bEndpointAddress ;
483                                 if (i==1)
484                                 {
485                                         irq_interval=intf_desc->endpoint [j].desc.bInterval;
486                                 }
487
488                                 continue;
489                         }
490                 }
491                 if (mdc800->endpoint[i] == -1)
492                 {
493                         err ("probe fails -> Wrong Endpoints.");
494                         return -ENODEV;
495                 }
496         }
497
498
499         info ("Found Mustek MDC800 on USB.");
500
501         mutex_lock(&mdc800->io_lock);
502
503         retval = usb_register_dev(intf, &mdc800_class);
504         if (retval) {
505                 err ("Not able to get a minor for this device.");
506                 return -ENODEV;
507         }
508
509         mdc800->dev=dev;
510         mdc800->open=0;
511
512         /* Setup URB Structs */
513         usb_fill_int_urb (
514                 mdc800->irq_urb,
515                 mdc800->dev,
516                 usb_rcvintpipe (mdc800->dev,mdc800->endpoint [1]),
517                 mdc800->irq_urb_buffer,
518                 8,
519                 mdc800_usb_irq,
520                 mdc800,
521                 irq_interval
522         );
523
524         usb_fill_bulk_urb (
525                 mdc800->write_urb,
526                 mdc800->dev,
527                 usb_sndbulkpipe (mdc800->dev, mdc800->endpoint[0]),
528                 mdc800->write_urb_buffer,
529                 8,
530                 mdc800_usb_write_notify,
531                 mdc800
532         );
533
534         usb_fill_bulk_urb (
535                 mdc800->download_urb,
536                 mdc800->dev,
537                 usb_rcvbulkpipe (mdc800->dev, mdc800->endpoint [3]),
538                 mdc800->download_urb_buffer,
539                 64,
540                 mdc800_usb_download_notify,
541                 mdc800
542         );
543
544         mdc800->state=READY;
545
546         mutex_unlock(&mdc800->io_lock);
547         
548         usb_set_intfdata(intf, mdc800);
549         return 0;
550 }
551
552
553 /*
554  * Disconnect USB device (maybe the MDC800)
555  */
556 static void mdc800_usb_disconnect (struct usb_interface *intf)
557 {
558         struct mdc800_data* mdc800 = usb_get_intfdata(intf);
559
560         dbg ("(mdc800_usb_disconnect) called");
561
562         if (mdc800) {
563                 if (mdc800->state == NOT_CONNECTED)
564                         return;
565
566                 usb_deregister_dev(intf, &mdc800_class);
567
568                 /* must be under lock to make sure no URB
569                    is submitted after usb_kill_urb() */
570                 mutex_lock(&mdc800->io_lock);
571                 mdc800->state=NOT_CONNECTED;
572
573                 usb_kill_urb(mdc800->irq_urb);
574                 usb_kill_urb(mdc800->write_urb);
575                 usb_kill_urb(mdc800->download_urb);
576                 mutex_unlock(&mdc800->io_lock);
577
578                 mdc800->dev = NULL;
579                 usb_set_intfdata(intf, NULL);
580         }
581         info ("Mustek MDC800 disconnected from USB.");
582 }
583
584
585 /***************************************************************************
586         The Misc device Part (file_operations)
587 ****************************************************************************/
588
589 /*
590  * This Function calc the Answersize for a command.
591  */
592 static int mdc800_getAnswerSize (char command)
593 {
594         switch ((unsigned char) command)
595         {
596                 case 0x2a:
597                 case 0x49:
598                 case 0x51:
599                 case 0x0d:
600                 case 0x20:
601                 case 0x07:
602                 case 0x01:
603                 case 0x25:
604                 case 0x00:
605                         return 8;
606
607                 case 0x05:
608                 case 0x3e:
609                         return mdc800->pic_len;
610
611                 case 0x09:
612                         return 4096;
613
614                 default:
615                         return 0;
616         }
617 }
618
619
620 /*
621  * Init the device: (1) alloc mem (2) Increase MOD Count ..
622  */
623 static int mdc800_device_open (struct inode* inode, struct file *file)
624 {
625         int retval=0;
626         int errn=0;
627
628         mutex_lock(&mdc800->io_lock);
629         
630         if (mdc800->state == NOT_CONNECTED)
631         {
632                 errn=-EBUSY;
633                 goto error_out;
634         }
635         if (mdc800->open)
636         {
637                 errn=-EBUSY;
638                 goto error_out;
639         }
640
641         mdc800->in_count=0;
642         mdc800->out_count=0;
643         mdc800->out_ptr=0;
644         mdc800->pic_index=0;
645         mdc800->pic_len=-1;
646         mdc800->download_left=0;
647
648         mdc800->camera_busy=0;
649         mdc800->camera_request_ready=0;
650
651         retval=0;
652         mdc800->irq_urb->dev = mdc800->dev;
653         if (usb_submit_urb (mdc800->irq_urb, GFP_KERNEL))
654         {
655                 err ("request USB irq fails (submit_retval=%i urb_status=%i).",retval, mdc800->irq_urb->status);
656                 errn = -EIO;
657                 goto error_out;
658         }
659
660         mdc800->open=1;
661         dbg ("Mustek MDC800 device opened.");
662
663 error_out:
664         mutex_unlock(&mdc800->io_lock);
665         return errn;
666 }
667
668
669 /*
670  * Close the Camera and release Memory
671  */
672 static int mdc800_device_release (struct inode* inode, struct file *file)
673 {
674         int retval=0;
675         dbg ("Mustek MDC800 device closed.");
676
677         mutex_lock(&mdc800->io_lock);
678         if (mdc800->open && (mdc800->state != NOT_CONNECTED))
679         {
680                 usb_kill_urb(mdc800->irq_urb);
681                 usb_kill_urb(mdc800->write_urb);
682                 usb_kill_urb(mdc800->download_urb);
683                 mdc800->open=0;
684         }
685         else
686         {
687                 retval=-EIO;
688         }
689
690         mutex_unlock(&mdc800->io_lock);
691         return retval;
692 }
693
694
695 /*
696  * The Device read callback Function
697  */
698 static ssize_t mdc800_device_read (struct file *file, char __user *buf, size_t len, loff_t *pos)
699 {
700         size_t left=len, sts=len; /* single transfer size */
701         char __user *ptr = buf;
702
703         mutex_lock(&mdc800->io_lock);
704         if (mdc800->state == NOT_CONNECTED)
705         {
706                 mutex_unlock(&mdc800->io_lock);
707                 return -EBUSY;
708         }
709         if (mdc800->state == WORKING)
710         {
711                 warn ("Illegal State \"working\" reached during read ?!");
712                 mutex_unlock(&mdc800->io_lock);
713                 return -EBUSY;
714         }
715         if (!mdc800->open)
716         {
717                 mutex_unlock(&mdc800->io_lock);
718                 return -EBUSY;
719         }
720
721         while (left)
722         {
723                 if (signal_pending (current)) 
724                 {
725                         mutex_unlock(&mdc800->io_lock);
726                         return -EINTR;
727                 }
728
729                 sts=left > (mdc800->out_count-mdc800->out_ptr)?mdc800->out_count-mdc800->out_ptr:left;
730
731                 if (sts <= 0)
732                 {
733                         /* Too less Data in buffer */
734                         if (mdc800->state == DOWNLOAD)
735                         {
736                                 mdc800->out_count=0;
737                                 mdc800->out_ptr=0;
738
739                                 /* Download -> Request new bytes */
740                                 mdc800->download_urb->dev = mdc800->dev;
741                                 if (usb_submit_urb (mdc800->download_urb, GFP_KERNEL))
742                                 {
743                                         err ("Can't submit download urb (status=%i)",mdc800->download_urb->status);
744                                         mutex_unlock(&mdc800->io_lock);
745                                         return len-left;
746                                 }
747                                 wait_event_timeout(mdc800->download_wait, mdc800->downloaded,
748                                                                                 TO_DOWNLOAD_GET_READY*HZ/1000);
749                                 mdc800->downloaded = 0;
750                                 if (mdc800->download_urb->status != 0)
751                                 {
752                                         err ("request download-bytes fails (status=%i)",mdc800->download_urb->status);
753                                         mutex_unlock(&mdc800->io_lock);
754                                         return len-left;
755                                 }
756                         }
757                         else
758                         {
759                                 /* No more bytes -> that's an error*/
760                                 mutex_unlock(&mdc800->io_lock);
761                                 return -EIO;
762                         }
763                 }
764                 else
765                 {
766                         /* Copy Bytes */
767                         if (copy_to_user(ptr, &mdc800->out [mdc800->out_ptr],
768                                                 sts)) {
769                                 mutex_unlock(&mdc800->io_lock);
770                                 return -EFAULT;
771                         }
772                         ptr+=sts;
773                         left-=sts;
774                         mdc800->out_ptr+=sts;
775                 }
776         }
777
778         mutex_unlock(&mdc800->io_lock);
779         return len-left;
780 }
781
782
783 /*
784  * The Device write callback Function
785  * If a 8Byte Command is received, it will be send to the camera.
786  * After this the driver initiates the request for the answer or
787  * just waits until the camera becomes ready.
788  */
789 static ssize_t mdc800_device_write (struct file *file, const char __user *buf, size_t len, loff_t *pos)
790 {
791         size_t i=0;
792
793         mutex_lock(&mdc800->io_lock);
794         if (mdc800->state != READY)
795         {
796                 mutex_unlock(&mdc800->io_lock);
797                 return -EBUSY;
798         }
799         if (!mdc800->open )
800         {
801                 mutex_unlock(&mdc800->io_lock);
802                 return -EBUSY;
803         }
804
805         while (i<len)
806         {
807                 unsigned char c;
808                 if (signal_pending (current)) 
809                 {
810                         mutex_unlock(&mdc800->io_lock);
811                         return -EINTR;
812                 }
813                 
814                 if(get_user(c, buf+i))
815                 {
816                         mutex_unlock(&mdc800->io_lock);
817                         return -EFAULT;
818                 }
819
820                 /* check for command start */
821                 if (c == 0x55)
822                 {
823                         mdc800->in_count=0;
824                         mdc800->out_count=0;
825                         mdc800->out_ptr=0;
826                         mdc800->download_left=0;
827                 }
828
829                 /* save command byte */
830                 if (mdc800->in_count < 8)
831                 {
832                         mdc800->in[mdc800->in_count] = c;
833                         mdc800->in_count++;
834                 }
835                 else
836                 {
837                         mutex_unlock(&mdc800->io_lock);
838                         return -EIO;
839                 }
840
841                 /* Command Buffer full ? -> send it to camera */
842                 if (mdc800->in_count == 8)
843                 {
844                         int answersize;
845
846                         if (mdc800_usb_waitForIRQ (0,TO_GET_READY))
847                         {
848                                 err ("Camera didn't get ready.\n");
849                                 mutex_unlock(&mdc800->io_lock);
850                                 return -EIO;
851                         }
852
853                         answersize=mdc800_getAnswerSize (mdc800->in[1]);
854
855                         mdc800->state=WORKING;
856                         memcpy (mdc800->write_urb->transfer_buffer, mdc800->in,8);
857                         mdc800->write_urb->dev = mdc800->dev;
858                         if (usb_submit_urb (mdc800->write_urb, GFP_KERNEL))
859                         {
860                                 err ("submitting write urb fails (status=%i)", mdc800->write_urb->status);
861                                 mutex_unlock(&mdc800->io_lock);
862                                 return -EIO;
863                         }
864                         wait_event_timeout(mdc800->write_wait, mdc800->written, TO_WRITE_GET_READY*HZ/1000);
865                         mdc800->written = 0;
866                         if (mdc800->state == WORKING)
867                         {
868                                 usb_kill_urb(mdc800->write_urb);
869                                 mutex_unlock(&mdc800->io_lock);
870                                 return -EIO;
871                         }
872
873                         switch ((unsigned char) mdc800->in[1])
874                         {
875                                 case 0x05: /* Download Image */
876                                 case 0x3e: /* Take shot in Fine Mode (WCam Mode) */
877                                         if (mdc800->pic_len < 0)
878                                         {
879                                                 err ("call 0x07 before 0x05,0x3e");
880                                                 mdc800->state=READY;
881                                                 mutex_unlock(&mdc800->io_lock);
882                                                 return -EIO;
883                                         }
884                                         mdc800->pic_len=-1;
885
886                                 case 0x09: /* Download Thumbnail */
887                                         mdc800->download_left=answersize+64;
888                                         mdc800->state=DOWNLOAD;
889                                         mdc800_usb_waitForIRQ (0,TO_DOWNLOAD_GET_BUSY);
890                                         break;
891
892
893                                 default:
894                                         if (answersize)
895                                         {
896
897                                                 if (mdc800_usb_waitForIRQ (1,TO_READ_FROM_IRQ))
898                                                 {
899                                                         err ("requesting answer from irq fails");
900                                                         mutex_unlock(&mdc800->io_lock);
901                                                         return -EIO;
902                                                 }
903
904                                                 /* Write dummy data, (this is ugly but part of the USB Protocol */
905                                                 /* if you use endpoint 1 as bulk and not as irq) */
906                                                 memcpy (mdc800->out, mdc800->camera_response,8);
907
908                                                 /* This is the interpreted answer */
909                                                 memcpy (&mdc800->out[8], mdc800->camera_response,8);
910
911                                                 mdc800->out_ptr=0;
912                                                 mdc800->out_count=16;
913
914                                                 /* Cache the Imagesize, if command was getImageSize */
915                                                 if (mdc800->in [1] == (char) 0x07)
916                                                 {
917                                                         mdc800->pic_len=(int) 65536*(unsigned char) mdc800->camera_response[0]+256*(unsigned char) mdc800->camera_response[1]+(unsigned char) mdc800->camera_response[2];
918
919                                                         dbg ("cached imagesize = %i",mdc800->pic_len);
920                                                 }
921
922                                         }
923                                         else
924                                         {
925                                                 if (mdc800_usb_waitForIRQ (0,TO_DEFAULT_COMMAND))
926                                                 {
927                                                         err ("Command Timeout.");
928                                                         mutex_unlock(&mdc800->io_lock);
929                                                         return -EIO;
930                                                 }
931                                         }
932                                         mdc800->state=READY;
933                                         break;
934                         }
935                 }
936                 i++;
937         }
938         mutex_unlock(&mdc800->io_lock);
939         return i;
940 }
941
942
943 /***************************************************************************
944         Init and Cleanup this driver (Structs and types)
945 ****************************************************************************/
946
947 /* File Operations of this drivers */
948 static const struct file_operations mdc800_device_ops =
949 {
950         .owner =        THIS_MODULE,
951         .read =         mdc800_device_read,
952         .write =        mdc800_device_write,
953         .open =         mdc800_device_open,
954         .release =      mdc800_device_release,
955 };
956
957
958
959 static struct usb_device_id mdc800_table [] = {
960         { USB_DEVICE(MDC800_VENDOR_ID, MDC800_PRODUCT_ID) },
961         { }                                             /* Terminating entry */
962 };
963
964 MODULE_DEVICE_TABLE (usb, mdc800_table);
965 /*
966  * USB Driver Struct for this device
967  */
968 static struct usb_driver mdc800_usb_driver =
969 {
970         .name =         "mdc800",
971         .probe =        mdc800_usb_probe,
972         .disconnect =   mdc800_usb_disconnect,
973         .id_table =     mdc800_table
974 };
975
976
977
978 /************************************************************************
979         Init and Cleanup this driver (Main Functions)
980 *************************************************************************/
981
982 static int __init usb_mdc800_init (void)
983 {
984         int retval = -ENODEV;
985         /* Allocate Memory */
986         mdc800=kzalloc (sizeof (struct mdc800_data), GFP_KERNEL);
987         if (!mdc800)
988                 goto cleanup_on_fail;
989
990         mdc800->dev = NULL;
991         mdc800->state=NOT_CONNECTED;
992         mutex_init (&mdc800->io_lock);
993
994         init_waitqueue_head (&mdc800->irq_wait);
995         init_waitqueue_head (&mdc800->write_wait);
996         init_waitqueue_head (&mdc800->download_wait);
997
998         mdc800->irq_woken = 0;
999         mdc800->downloaded = 0;
1000         mdc800->written = 0;
1001
1002         mdc800->irq_urb_buffer=kmalloc (8, GFP_KERNEL);
1003         if (!mdc800->irq_urb_buffer)
1004                 goto cleanup_on_fail;
1005         mdc800->write_urb_buffer=kmalloc (8, GFP_KERNEL);
1006         if (!mdc800->write_urb_buffer)
1007                 goto cleanup_on_fail;
1008         mdc800->download_urb_buffer=kmalloc (64, GFP_KERNEL);
1009         if (!mdc800->download_urb_buffer)
1010                 goto cleanup_on_fail;
1011
1012         mdc800->irq_urb=usb_alloc_urb (0, GFP_KERNEL);
1013         if (!mdc800->irq_urb)
1014                 goto cleanup_on_fail;
1015         mdc800->download_urb=usb_alloc_urb (0, GFP_KERNEL);
1016         if (!mdc800->download_urb)
1017                 goto cleanup_on_fail;
1018         mdc800->write_urb=usb_alloc_urb (0, GFP_KERNEL);
1019         if (!mdc800->write_urb)
1020                 goto cleanup_on_fail;
1021
1022         /* Register the driver */
1023         retval = usb_register(&mdc800_usb_driver);
1024         if (retval)
1025                 goto cleanup_on_fail;
1026
1027         info (DRIVER_VERSION ":" DRIVER_DESC);
1028
1029         return 0;
1030
1031         /* Clean driver up, when something fails */
1032
1033 cleanup_on_fail:
1034
1035         if (mdc800 != NULL)
1036         {
1037                 err ("can't alloc memory!");
1038
1039                 kfree(mdc800->download_urb_buffer);
1040                 kfree(mdc800->write_urb_buffer);
1041                 kfree(mdc800->irq_urb_buffer);
1042
1043                 usb_free_urb(mdc800->write_urb);
1044                 usb_free_urb(mdc800->download_urb);
1045                 usb_free_urb(mdc800->irq_urb);
1046
1047                 kfree (mdc800);
1048         }
1049         mdc800 = NULL;
1050         return retval;
1051 }
1052
1053
1054 static void __exit usb_mdc800_cleanup (void)
1055 {
1056         usb_deregister (&mdc800_usb_driver);
1057
1058         usb_free_urb (mdc800->irq_urb);
1059         usb_free_urb (mdc800->download_urb);
1060         usb_free_urb (mdc800->write_urb);
1061
1062         kfree (mdc800->irq_urb_buffer);
1063         kfree (mdc800->write_urb_buffer);
1064         kfree (mdc800->download_urb_buffer);
1065
1066         kfree (mdc800);
1067         mdc800 = NULL;
1068 }
1069
1070 module_init (usb_mdc800_init);
1071 module_exit (usb_mdc800_cleanup);
1072
1073 MODULE_AUTHOR( DRIVER_AUTHOR );
1074 MODULE_DESCRIPTION( DRIVER_DESC );
1075 MODULE_LICENSE("GPL");
1076