cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

iowarrior.c (26279B)


      1// SPDX-License-Identifier: GPL-2.0
      2/*
      3 *  Native support for the I/O-Warrior USB devices
      4 *
      5 *  Copyright (c) 2003-2005, 2020  Code Mercenaries GmbH
      6 *  written by Christian Lucht <lucht@codemercs.com> and
      7 *  Christoph Jung <jung@codemercs.com>
      8 *
      9 *  based on
     10
     11 *  usb-skeleton.c by Greg Kroah-Hartman  <greg@kroah.com>
     12 *  brlvger.c by Stephane Dalton  <sdalton@videotron.ca>
     13 *           and Stephane Doyon   <s.doyon@videotron.ca>
     14 *
     15 *  Released under the GPLv2.
     16 */
     17
     18#include <linux/module.h>
     19#include <linux/usb.h>
     20#include <linux/slab.h>
     21#include <linux/sched.h>
     22#include <linux/mutex.h>
     23#include <linux/poll.h>
     24#include <linux/usb/iowarrior.h>
     25
     26#define DRIVER_AUTHOR "Christian Lucht <lucht@codemercs.com>"
     27#define DRIVER_DESC "USB IO-Warrior driver"
     28
     29#define USB_VENDOR_ID_CODEMERCS		1984
     30/* low speed iowarrior */
     31#define USB_DEVICE_ID_CODEMERCS_IOW40	0x1500
     32#define USB_DEVICE_ID_CODEMERCS_IOW24	0x1501
     33#define USB_DEVICE_ID_CODEMERCS_IOWPV1	0x1511
     34#define USB_DEVICE_ID_CODEMERCS_IOWPV2	0x1512
     35/* full speed iowarrior */
     36#define USB_DEVICE_ID_CODEMERCS_IOW56	0x1503
     37/* fuller speed iowarrior */
     38#define USB_DEVICE_ID_CODEMERCS_IOW28	0x1504
     39#define USB_DEVICE_ID_CODEMERCS_IOW28L	0x1505
     40#define USB_DEVICE_ID_CODEMERCS_IOW100	0x1506
     41
     42/* OEMed devices */
     43#define USB_DEVICE_ID_CODEMERCS_IOW24SAG	0x158a
     44#define USB_DEVICE_ID_CODEMERCS_IOW56AM		0x158b
     45
     46/* Get a minor range for your devices from the usb maintainer */
     47#ifdef CONFIG_USB_DYNAMIC_MINORS
     48#define IOWARRIOR_MINOR_BASE	0
     49#else
     50#define IOWARRIOR_MINOR_BASE	208	// SKELETON_MINOR_BASE 192 + 16, not official yet
     51#endif
     52
     53/* interrupt input queue size */
     54#define MAX_INTERRUPT_BUFFER 16
     55/*
     56   maximum number of urbs that are submitted for writes at the same time,
     57   this applies to the IOWarrior56 only!
     58   IOWarrior24 and IOWarrior40 use synchronous usb_control_msg calls.
     59*/
     60#define MAX_WRITES_IN_FLIGHT 4
     61
     62MODULE_AUTHOR(DRIVER_AUTHOR);
     63MODULE_DESCRIPTION(DRIVER_DESC);
     64MODULE_LICENSE("GPL");
     65
     66static struct usb_driver iowarrior_driver;
     67
     68/*--------------*/
     69/*     data     */
     70/*--------------*/
     71
     72/* Structure to hold all of our device specific stuff */
     73struct iowarrior {
     74	struct mutex mutex;			/* locks this structure */
     75	struct usb_device *udev;		/* save off the usb device pointer */
     76	struct usb_interface *interface;	/* the interface for this device */
     77	unsigned char minor;			/* the starting minor number for this device */
     78	struct usb_endpoint_descriptor *int_out_endpoint;	/* endpoint for reading (needed for IOW56 only) */
     79	struct usb_endpoint_descriptor *int_in_endpoint;	/* endpoint for reading */
     80	struct urb *int_in_urb;		/* the urb for reading data */
     81	unsigned char *int_in_buffer;	/* buffer for data to be read */
     82	unsigned char serial_number;	/* to detect lost packages */
     83	unsigned char *read_queue;	/* size is MAX_INTERRUPT_BUFFER * packet size */
     84	wait_queue_head_t read_wait;
     85	wait_queue_head_t write_wait;	/* wait-queue for writing to the device */
     86	atomic_t write_busy;		/* number of write-urbs submitted */
     87	atomic_t read_idx;
     88	atomic_t intr_idx;
     89	atomic_t overflow_flag;		/* signals an index 'rollover' */
     90	int present;			/* this is 1 as long as the device is connected */
     91	int opened;			/* this is 1 if the device is currently open */
     92	char chip_serial[9];		/* the serial number string of the chip connected */
     93	int report_size;		/* number of bytes in a report */
     94	u16 product_id;
     95	struct usb_anchor submitted;
     96};
     97
     98/*--------------*/
     99/*    globals   */
    100/*--------------*/
    101
    102#define USB_REQ_GET_REPORT  0x01
    103//#if 0
    104static int usb_get_report(struct usb_device *dev,
    105			  struct usb_host_interface *inter, unsigned char type,
    106			  unsigned char id, void *buf, int size)
    107{
    108	return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
    109			       USB_REQ_GET_REPORT,
    110			       USB_DIR_IN | USB_TYPE_CLASS |
    111			       USB_RECIP_INTERFACE, (type << 8) + id,
    112			       inter->desc.bInterfaceNumber, buf, size,
    113			       USB_CTRL_GET_TIMEOUT);
    114}
    115//#endif
    116
    117#define USB_REQ_SET_REPORT 0x09
    118
    119static int usb_set_report(struct usb_interface *intf, unsigned char type,
    120			  unsigned char id, void *buf, int size)
    121{
    122	return usb_control_msg(interface_to_usbdev(intf),
    123			       usb_sndctrlpipe(interface_to_usbdev(intf), 0),
    124			       USB_REQ_SET_REPORT,
    125			       USB_TYPE_CLASS | USB_RECIP_INTERFACE,
    126			       (type << 8) + id,
    127			       intf->cur_altsetting->desc.bInterfaceNumber, buf,
    128			       size, 1000);
    129}
    130
    131/*---------------------*/
    132/* driver registration */
    133/*---------------------*/
    134/* table of devices that work with this driver */
    135static const struct usb_device_id iowarrior_ids[] = {
    136	{USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW40)},
    137	{USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW24)},
    138	{USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOWPV1)},
    139	{USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOWPV2)},
    140	{USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW56)},
    141	{USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW24SAG)},
    142	{USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW56AM)},
    143	{USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW28)},
    144	{USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW28L)},
    145	{USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW100)},
    146	{}			/* Terminating entry */
    147};
    148MODULE_DEVICE_TABLE(usb, iowarrior_ids);
    149
    150/*
    151 * USB callback handler for reading data
    152 */
    153static void iowarrior_callback(struct urb *urb)
    154{
    155	struct iowarrior *dev = urb->context;
    156	int intr_idx;
    157	int read_idx;
    158	int aux_idx;
    159	int offset;
    160	int status = urb->status;
    161	int retval;
    162
    163	switch (status) {
    164	case 0:
    165		/* success */
    166		break;
    167	case -ECONNRESET:
    168	case -ENOENT:
    169	case -ESHUTDOWN:
    170		return;
    171	default:
    172		goto exit;
    173	}
    174
    175	intr_idx = atomic_read(&dev->intr_idx);
    176	/* aux_idx become previous intr_idx */
    177	aux_idx = (intr_idx == 0) ? (MAX_INTERRUPT_BUFFER - 1) : (intr_idx - 1);
    178	read_idx = atomic_read(&dev->read_idx);
    179
    180	/* queue is not empty and it's interface 0 */
    181	if ((intr_idx != read_idx)
    182	    && (dev->interface->cur_altsetting->desc.bInterfaceNumber == 0)) {
    183		/* + 1 for serial number */
    184		offset = aux_idx * (dev->report_size + 1);
    185		if (!memcmp
    186		    (dev->read_queue + offset, urb->transfer_buffer,
    187		     dev->report_size)) {
    188			/* equal values on interface 0 will be ignored */
    189			goto exit;
    190		}
    191	}
    192
    193	/* aux_idx become next intr_idx */
    194	aux_idx = (intr_idx == (MAX_INTERRUPT_BUFFER - 1)) ? 0 : (intr_idx + 1);
    195	if (read_idx == aux_idx) {
    196		/* queue full, dropping oldest input */
    197		read_idx = (++read_idx == MAX_INTERRUPT_BUFFER) ? 0 : read_idx;
    198		atomic_set(&dev->read_idx, read_idx);
    199		atomic_set(&dev->overflow_flag, 1);
    200	}
    201
    202	/* +1 for serial number */
    203	offset = intr_idx * (dev->report_size + 1);
    204	memcpy(dev->read_queue + offset, urb->transfer_buffer,
    205	       dev->report_size);
    206	*(dev->read_queue + offset + (dev->report_size)) = dev->serial_number++;
    207
    208	atomic_set(&dev->intr_idx, aux_idx);
    209	/* tell the blocking read about the new data */
    210	wake_up_interruptible(&dev->read_wait);
    211
    212exit:
    213	retval = usb_submit_urb(urb, GFP_ATOMIC);
    214	if (retval)
    215		dev_err(&dev->interface->dev, "%s - usb_submit_urb failed with result %d\n",
    216			__func__, retval);
    217
    218}
    219
    220/*
    221 * USB Callback handler for write-ops
    222 */
    223static void iowarrior_write_callback(struct urb *urb)
    224{
    225	struct iowarrior *dev;
    226	int status = urb->status;
    227
    228	dev = urb->context;
    229	/* sync/async unlink faults aren't errors */
    230	if (status &&
    231	    !(status == -ENOENT ||
    232	      status == -ECONNRESET || status == -ESHUTDOWN)) {
    233		dev_dbg(&dev->interface->dev,
    234			"nonzero write bulk status received: %d\n", status);
    235	}
    236	/* free up our allocated buffer */
    237	usb_free_coherent(urb->dev, urb->transfer_buffer_length,
    238			  urb->transfer_buffer, urb->transfer_dma);
    239	/* tell a waiting writer the interrupt-out-pipe is available again */
    240	atomic_dec(&dev->write_busy);
    241	wake_up_interruptible(&dev->write_wait);
    242}
    243
    244/*
    245 *	iowarrior_delete
    246 */
    247static inline void iowarrior_delete(struct iowarrior *dev)
    248{
    249	dev_dbg(&dev->interface->dev, "minor %d\n", dev->minor);
    250	kfree(dev->int_in_buffer);
    251	usb_free_urb(dev->int_in_urb);
    252	kfree(dev->read_queue);
    253	usb_put_intf(dev->interface);
    254	kfree(dev);
    255}
    256
    257/*---------------------*/
    258/* fops implementation */
    259/*---------------------*/
    260
    261static int read_index(struct iowarrior *dev)
    262{
    263	int intr_idx, read_idx;
    264
    265	read_idx = atomic_read(&dev->read_idx);
    266	intr_idx = atomic_read(&dev->intr_idx);
    267
    268	return (read_idx == intr_idx ? -1 : read_idx);
    269}
    270
    271/*
    272 *  iowarrior_read
    273 */
    274static ssize_t iowarrior_read(struct file *file, char __user *buffer,
    275			      size_t count, loff_t *ppos)
    276{
    277	struct iowarrior *dev;
    278	int read_idx;
    279	int offset;
    280
    281	dev = file->private_data;
    282
    283	/* verify that the device wasn't unplugged */
    284	if (!dev || !dev->present)
    285		return -ENODEV;
    286
    287	dev_dbg(&dev->interface->dev, "minor %d, count = %zd\n",
    288		dev->minor, count);
    289
    290	/* read count must be packet size (+ time stamp) */
    291	if ((count != dev->report_size)
    292	    && (count != (dev->report_size + 1)))
    293		return -EINVAL;
    294
    295	/* repeat until no buffer overrun in callback handler occur */
    296	do {
    297		atomic_set(&dev->overflow_flag, 0);
    298		if ((read_idx = read_index(dev)) == -1) {
    299			/* queue empty */
    300			if (file->f_flags & O_NONBLOCK)
    301				return -EAGAIN;
    302			else {
    303				//next line will return when there is either new data, or the device is unplugged
    304				int r = wait_event_interruptible(dev->read_wait,
    305								 (!dev->present
    306								  || (read_idx =
    307								      read_index
    308								      (dev)) !=
    309								  -1));
    310				if (r) {
    311					//we were interrupted by a signal
    312					return -ERESTART;
    313				}
    314				if (!dev->present) {
    315					//The device was unplugged
    316					return -ENODEV;
    317				}
    318				if (read_idx == -1) {
    319					// Can this happen ???
    320					return 0;
    321				}
    322			}
    323		}
    324
    325		offset = read_idx * (dev->report_size + 1);
    326		if (copy_to_user(buffer, dev->read_queue + offset, count)) {
    327			return -EFAULT;
    328		}
    329	} while (atomic_read(&dev->overflow_flag));
    330
    331	read_idx = ++read_idx == MAX_INTERRUPT_BUFFER ? 0 : read_idx;
    332	atomic_set(&dev->read_idx, read_idx);
    333	return count;
    334}
    335
    336/*
    337 * iowarrior_write
    338 */
    339static ssize_t iowarrior_write(struct file *file,
    340			       const char __user *user_buffer,
    341			       size_t count, loff_t *ppos)
    342{
    343	struct iowarrior *dev;
    344	int retval = 0;
    345	char *buf = NULL;	/* for IOW24 and IOW56 we need a buffer */
    346	struct urb *int_out_urb = NULL;
    347
    348	dev = file->private_data;
    349
    350	mutex_lock(&dev->mutex);
    351	/* verify that the device wasn't unplugged */
    352	if (!dev->present) {
    353		retval = -ENODEV;
    354		goto exit;
    355	}
    356	dev_dbg(&dev->interface->dev, "minor %d, count = %zd\n",
    357		dev->minor, count);
    358	/* if count is 0 we're already done */
    359	if (count == 0) {
    360		retval = 0;
    361		goto exit;
    362	}
    363	/* We only accept full reports */
    364	if (count != dev->report_size) {
    365		retval = -EINVAL;
    366		goto exit;
    367	}
    368	switch (dev->product_id) {
    369	case USB_DEVICE_ID_CODEMERCS_IOW24:
    370	case USB_DEVICE_ID_CODEMERCS_IOW24SAG:
    371	case USB_DEVICE_ID_CODEMERCS_IOWPV1:
    372	case USB_DEVICE_ID_CODEMERCS_IOWPV2:
    373	case USB_DEVICE_ID_CODEMERCS_IOW40:
    374		/* IOW24 and IOW40 use a synchronous call */
    375		buf = memdup_user(user_buffer, count);
    376		if (IS_ERR(buf)) {
    377			retval = PTR_ERR(buf);
    378			goto exit;
    379		}
    380		retval = usb_set_report(dev->interface, 2, 0, buf, count);
    381		kfree(buf);
    382		goto exit;
    383	case USB_DEVICE_ID_CODEMERCS_IOW56:
    384	case USB_DEVICE_ID_CODEMERCS_IOW56AM:
    385	case USB_DEVICE_ID_CODEMERCS_IOW28:
    386	case USB_DEVICE_ID_CODEMERCS_IOW28L:
    387	case USB_DEVICE_ID_CODEMERCS_IOW100:
    388		/* The IOW56 uses asynchronous IO and more urbs */
    389		if (atomic_read(&dev->write_busy) == MAX_WRITES_IN_FLIGHT) {
    390			/* Wait until we are below the limit for submitted urbs */
    391			if (file->f_flags & O_NONBLOCK) {
    392				retval = -EAGAIN;
    393				goto exit;
    394			} else {
    395				retval = wait_event_interruptible(dev->write_wait,
    396								  (!dev->present || (atomic_read (&dev-> write_busy) < MAX_WRITES_IN_FLIGHT)));
    397				if (retval) {
    398					/* we were interrupted by a signal */
    399					retval = -ERESTART;
    400					goto exit;
    401				}
    402				if (!dev->present) {
    403					/* The device was unplugged */
    404					retval = -ENODEV;
    405					goto exit;
    406				}
    407				if (!dev->opened) {
    408					/* We were closed while waiting for an URB */
    409					retval = -ENODEV;
    410					goto exit;
    411				}
    412			}
    413		}
    414		atomic_inc(&dev->write_busy);
    415		int_out_urb = usb_alloc_urb(0, GFP_KERNEL);
    416		if (!int_out_urb) {
    417			retval = -ENOMEM;
    418			goto error_no_urb;
    419		}
    420		buf = usb_alloc_coherent(dev->udev, dev->report_size,
    421					 GFP_KERNEL, &int_out_urb->transfer_dma);
    422		if (!buf) {
    423			retval = -ENOMEM;
    424			dev_dbg(&dev->interface->dev,
    425				"Unable to allocate buffer\n");
    426			goto error_no_buffer;
    427		}
    428		usb_fill_int_urb(int_out_urb, dev->udev,
    429				 usb_sndintpipe(dev->udev,
    430						dev->int_out_endpoint->bEndpointAddress),
    431				 buf, dev->report_size,
    432				 iowarrior_write_callback, dev,
    433				 dev->int_out_endpoint->bInterval);
    434		int_out_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
    435		if (copy_from_user(buf, user_buffer, count)) {
    436			retval = -EFAULT;
    437			goto error;
    438		}
    439		usb_anchor_urb(int_out_urb, &dev->submitted);
    440		retval = usb_submit_urb(int_out_urb, GFP_KERNEL);
    441		if (retval) {
    442			dev_dbg(&dev->interface->dev,
    443				"submit error %d for urb nr.%d\n",
    444				retval, atomic_read(&dev->write_busy));
    445			usb_unanchor_urb(int_out_urb);
    446			goto error;
    447		}
    448		/* submit was ok */
    449		retval = count;
    450		usb_free_urb(int_out_urb);
    451		goto exit;
    452	default:
    453		/* what do we have here ? An unsupported Product-ID ? */
    454		dev_err(&dev->interface->dev, "%s - not supported for product=0x%x\n",
    455			__func__, dev->product_id);
    456		retval = -EFAULT;
    457		goto exit;
    458	}
    459error:
    460	usb_free_coherent(dev->udev, dev->report_size, buf,
    461			  int_out_urb->transfer_dma);
    462error_no_buffer:
    463	usb_free_urb(int_out_urb);
    464error_no_urb:
    465	atomic_dec(&dev->write_busy);
    466	wake_up_interruptible(&dev->write_wait);
    467exit:
    468	mutex_unlock(&dev->mutex);
    469	return retval;
    470}
    471
    472/*
    473 *	iowarrior_ioctl
    474 */
    475static long iowarrior_ioctl(struct file *file, unsigned int cmd,
    476							unsigned long arg)
    477{
    478	struct iowarrior *dev = NULL;
    479	__u8 *buffer;
    480	__u8 __user *user_buffer;
    481	int retval;
    482	int io_res;		/* checks for bytes read/written and copy_to/from_user results */
    483
    484	dev = file->private_data;
    485	if (!dev)
    486		return -ENODEV;
    487
    488	buffer = kzalloc(dev->report_size, GFP_KERNEL);
    489	if (!buffer)
    490		return -ENOMEM;
    491
    492	mutex_lock(&dev->mutex);
    493
    494	/* verify that the device wasn't unplugged */
    495	if (!dev->present) {
    496		retval = -ENODEV;
    497		goto error_out;
    498	}
    499
    500	dev_dbg(&dev->interface->dev, "minor %d, cmd 0x%.4x, arg %ld\n",
    501		dev->minor, cmd, arg);
    502
    503	retval = 0;
    504	io_res = 0;
    505	switch (cmd) {
    506	case IOW_WRITE:
    507		if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW24 ||
    508		    dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW24SAG ||
    509		    dev->product_id == USB_DEVICE_ID_CODEMERCS_IOWPV1 ||
    510		    dev->product_id == USB_DEVICE_ID_CODEMERCS_IOWPV2 ||
    511		    dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW40) {
    512			user_buffer = (__u8 __user *)arg;
    513			io_res = copy_from_user(buffer, user_buffer,
    514						dev->report_size);
    515			if (io_res) {
    516				retval = -EFAULT;
    517			} else {
    518				io_res = usb_set_report(dev->interface, 2, 0,
    519							buffer,
    520							dev->report_size);
    521				if (io_res < 0)
    522					retval = io_res;
    523			}
    524		} else {
    525			retval = -EINVAL;
    526			dev_err(&dev->interface->dev,
    527				"ioctl 'IOW_WRITE' is not supported for product=0x%x.\n",
    528				dev->product_id);
    529		}
    530		break;
    531	case IOW_READ:
    532		user_buffer = (__u8 __user *)arg;
    533		io_res = usb_get_report(dev->udev,
    534					dev->interface->cur_altsetting, 1, 0,
    535					buffer, dev->report_size);
    536		if (io_res < 0)
    537			retval = io_res;
    538		else {
    539			io_res = copy_to_user(user_buffer, buffer, dev->report_size);
    540			if (io_res)
    541				retval = -EFAULT;
    542		}
    543		break;
    544	case IOW_GETINFO:
    545		{
    546			/* Report available information for the device */
    547			struct iowarrior_info info;
    548			/* needed for power consumption */
    549			struct usb_config_descriptor *cfg_descriptor = &dev->udev->actconfig->desc;
    550
    551			memset(&info, 0, sizeof(info));
    552			/* directly from the descriptor */
    553			info.vendor = le16_to_cpu(dev->udev->descriptor.idVendor);
    554			info.product = dev->product_id;
    555			info.revision = le16_to_cpu(dev->udev->descriptor.bcdDevice);
    556
    557			/* 0==UNKNOWN, 1==LOW(usb1.1) ,2=FULL(usb1.1), 3=HIGH(usb2.0) */
    558			info.speed = dev->udev->speed;
    559			info.if_num = dev->interface->cur_altsetting->desc.bInterfaceNumber;
    560			info.report_size = dev->report_size;
    561
    562			/* serial number string has been read earlier 8 chars or empty string */
    563			memcpy(info.serial, dev->chip_serial,
    564			       sizeof(dev->chip_serial));
    565			if (cfg_descriptor == NULL) {
    566				info.power = -1;	/* no information available */
    567			} else {
    568				/* the MaxPower is stored in units of 2mA to make it fit into a byte-value */
    569				info.power = cfg_descriptor->bMaxPower * 2;
    570			}
    571			io_res = copy_to_user((struct iowarrior_info __user *)arg, &info,
    572					 sizeof(struct iowarrior_info));
    573			if (io_res)
    574				retval = -EFAULT;
    575			break;
    576		}
    577	default:
    578		/* return that we did not understand this ioctl call */
    579		retval = -ENOTTY;
    580		break;
    581	}
    582error_out:
    583	/* unlock the device */
    584	mutex_unlock(&dev->mutex);
    585	kfree(buffer);
    586	return retval;
    587}
    588
    589/*
    590 *	iowarrior_open
    591 */
    592static int iowarrior_open(struct inode *inode, struct file *file)
    593{
    594	struct iowarrior *dev = NULL;
    595	struct usb_interface *interface;
    596	int subminor;
    597	int retval = 0;
    598
    599	subminor = iminor(inode);
    600
    601	interface = usb_find_interface(&iowarrior_driver, subminor);
    602	if (!interface) {
    603		pr_err("%s - error, can't find device for minor %d\n",
    604		       __func__, subminor);
    605		return -ENODEV;
    606	}
    607
    608	dev = usb_get_intfdata(interface);
    609	if (!dev)
    610		return -ENODEV;
    611
    612	mutex_lock(&dev->mutex);
    613
    614	/* Only one process can open each device, no sharing. */
    615	if (dev->opened) {
    616		retval = -EBUSY;
    617		goto out;
    618	}
    619
    620	/* setup interrupt handler for receiving values */
    621	if ((retval = usb_submit_urb(dev->int_in_urb, GFP_KERNEL)) < 0) {
    622		dev_err(&interface->dev, "Error %d while submitting URB\n", retval);
    623		retval = -EFAULT;
    624		goto out;
    625	}
    626	/* increment our usage count for the driver */
    627	++dev->opened;
    628	/* save our object in the file's private structure */
    629	file->private_data = dev;
    630	retval = 0;
    631
    632out:
    633	mutex_unlock(&dev->mutex);
    634	return retval;
    635}
    636
    637/*
    638 *	iowarrior_release
    639 */
    640static int iowarrior_release(struct inode *inode, struct file *file)
    641{
    642	struct iowarrior *dev;
    643	int retval = 0;
    644
    645	dev = file->private_data;
    646	if (!dev)
    647		return -ENODEV;
    648
    649	dev_dbg(&dev->interface->dev, "minor %d\n", dev->minor);
    650
    651	/* lock our device */
    652	mutex_lock(&dev->mutex);
    653
    654	if (dev->opened <= 0) {
    655		retval = -ENODEV;	/* close called more than once */
    656		mutex_unlock(&dev->mutex);
    657	} else {
    658		dev->opened = 0;	/* we're closing now */
    659		retval = 0;
    660		if (dev->present) {
    661			/*
    662			   The device is still connected so we only shutdown
    663			   pending read-/write-ops.
    664			 */
    665			usb_kill_urb(dev->int_in_urb);
    666			wake_up_interruptible(&dev->read_wait);
    667			wake_up_interruptible(&dev->write_wait);
    668			mutex_unlock(&dev->mutex);
    669		} else {
    670			/* The device was unplugged, cleanup resources */
    671			mutex_unlock(&dev->mutex);
    672			iowarrior_delete(dev);
    673		}
    674	}
    675	return retval;
    676}
    677
    678static __poll_t iowarrior_poll(struct file *file, poll_table * wait)
    679{
    680	struct iowarrior *dev = file->private_data;
    681	__poll_t mask = 0;
    682
    683	if (!dev->present)
    684		return EPOLLERR | EPOLLHUP;
    685
    686	poll_wait(file, &dev->read_wait, wait);
    687	poll_wait(file, &dev->write_wait, wait);
    688
    689	if (!dev->present)
    690		return EPOLLERR | EPOLLHUP;
    691
    692	if (read_index(dev) != -1)
    693		mask |= EPOLLIN | EPOLLRDNORM;
    694
    695	if (atomic_read(&dev->write_busy) < MAX_WRITES_IN_FLIGHT)
    696		mask |= EPOLLOUT | EPOLLWRNORM;
    697	return mask;
    698}
    699
    700/*
    701 * File operations needed when we register this driver.
    702 * This assumes that this driver NEEDS file operations,
    703 * of course, which means that the driver is expected
    704 * to have a node in the /dev directory. If the USB
    705 * device were for a network interface then the driver
    706 * would use "struct net_driver" instead, and a serial
    707 * device would use "struct tty_driver".
    708 */
    709static const struct file_operations iowarrior_fops = {
    710	.owner = THIS_MODULE,
    711	.write = iowarrior_write,
    712	.read = iowarrior_read,
    713	.unlocked_ioctl = iowarrior_ioctl,
    714	.open = iowarrior_open,
    715	.release = iowarrior_release,
    716	.poll = iowarrior_poll,
    717	.llseek = noop_llseek,
    718};
    719
    720static char *iowarrior_devnode(struct device *dev, umode_t *mode)
    721{
    722	return kasprintf(GFP_KERNEL, "usb/%s", dev_name(dev));
    723}
    724
    725/*
    726 * usb class driver info in order to get a minor number from the usb core,
    727 * and to have the device registered with devfs and the driver core
    728 */
    729static struct usb_class_driver iowarrior_class = {
    730	.name = "iowarrior%d",
    731	.devnode = iowarrior_devnode,
    732	.fops = &iowarrior_fops,
    733	.minor_base = IOWARRIOR_MINOR_BASE,
    734};
    735
    736/*---------------------------------*/
    737/*  probe and disconnect functions */
    738/*---------------------------------*/
    739/*
    740 *	iowarrior_probe
    741 *
    742 *	Called by the usb core when a new device is connected that it thinks
    743 *	this driver might be interested in.
    744 */
    745static int iowarrior_probe(struct usb_interface *interface,
    746			   const struct usb_device_id *id)
    747{
    748	struct usb_device *udev = interface_to_usbdev(interface);
    749	struct iowarrior *dev = NULL;
    750	struct usb_host_interface *iface_desc;
    751	int retval = -ENOMEM;
    752	int res;
    753
    754	/* allocate memory for our device state and initialize it */
    755	dev = kzalloc(sizeof(struct iowarrior), GFP_KERNEL);
    756	if (!dev)
    757		return retval;
    758
    759	mutex_init(&dev->mutex);
    760
    761	atomic_set(&dev->intr_idx, 0);
    762	atomic_set(&dev->read_idx, 0);
    763	atomic_set(&dev->overflow_flag, 0);
    764	init_waitqueue_head(&dev->read_wait);
    765	atomic_set(&dev->write_busy, 0);
    766	init_waitqueue_head(&dev->write_wait);
    767
    768	dev->udev = udev;
    769	dev->interface = usb_get_intf(interface);
    770
    771	iface_desc = interface->cur_altsetting;
    772	dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
    773
    774	init_usb_anchor(&dev->submitted);
    775
    776	res = usb_find_last_int_in_endpoint(iface_desc, &dev->int_in_endpoint);
    777	if (res) {
    778		dev_err(&interface->dev, "no interrupt-in endpoint found\n");
    779		retval = res;
    780		goto error;
    781	}
    782
    783	if ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) ||
    784	    (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM) ||
    785	    (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28) ||
    786	    (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L) ||
    787	    (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW100)) {
    788		res = usb_find_last_int_out_endpoint(iface_desc,
    789				&dev->int_out_endpoint);
    790		if (res) {
    791			dev_err(&interface->dev, "no interrupt-out endpoint found\n");
    792			retval = res;
    793			goto error;
    794		}
    795	}
    796
    797	/* we have to check the report_size often, so remember it in the endianness suitable for our machine */
    798	dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint);
    799
    800	/*
    801	 * Some devices need the report size to be different than the
    802	 * endpoint size.
    803	 */
    804	if (dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) {
    805		switch (dev->product_id) {
    806		case USB_DEVICE_ID_CODEMERCS_IOW56:
    807		case USB_DEVICE_ID_CODEMERCS_IOW56AM:
    808			dev->report_size = 7;
    809			break;
    810
    811		case USB_DEVICE_ID_CODEMERCS_IOW28:
    812		case USB_DEVICE_ID_CODEMERCS_IOW28L:
    813			dev->report_size = 4;
    814			break;
    815
    816		case USB_DEVICE_ID_CODEMERCS_IOW100:
    817			dev->report_size = 13;
    818			break;
    819		}
    820	}
    821
    822	/* create the urb and buffer for reading */
    823	dev->int_in_urb = usb_alloc_urb(0, GFP_KERNEL);
    824	if (!dev->int_in_urb)
    825		goto error;
    826	dev->int_in_buffer = kmalloc(dev->report_size, GFP_KERNEL);
    827	if (!dev->int_in_buffer)
    828		goto error;
    829	usb_fill_int_urb(dev->int_in_urb, dev->udev,
    830			 usb_rcvintpipe(dev->udev,
    831					dev->int_in_endpoint->bEndpointAddress),
    832			 dev->int_in_buffer, dev->report_size,
    833			 iowarrior_callback, dev,
    834			 dev->int_in_endpoint->bInterval);
    835	/* create an internal buffer for interrupt data from the device */
    836	dev->read_queue =
    837	    kmalloc_array(dev->report_size + 1, MAX_INTERRUPT_BUFFER,
    838			  GFP_KERNEL);
    839	if (!dev->read_queue)
    840		goto error;
    841	/* Get the serial-number of the chip */
    842	memset(dev->chip_serial, 0x00, sizeof(dev->chip_serial));
    843	usb_string(udev, udev->descriptor.iSerialNumber, dev->chip_serial,
    844		   sizeof(dev->chip_serial));
    845	if (strlen(dev->chip_serial) != 8)
    846		memset(dev->chip_serial, 0x00, sizeof(dev->chip_serial));
    847
    848	/* Set the idle timeout to 0, if this is interface 0 */
    849	if (dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) {
    850	    usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
    851			    0x0A,
    852			    USB_TYPE_CLASS | USB_RECIP_INTERFACE, 0,
    853			    0, NULL, 0, USB_CTRL_SET_TIMEOUT);
    854	}
    855	/* allow device read and ioctl */
    856	dev->present = 1;
    857
    858	/* we can register the device now, as it is ready */
    859	usb_set_intfdata(interface, dev);
    860
    861	retval = usb_register_dev(interface, &iowarrior_class);
    862	if (retval) {
    863		/* something prevented us from registering this driver */
    864		dev_err(&interface->dev, "Not able to get a minor for this device.\n");
    865		goto error;
    866	}
    867
    868	dev->minor = interface->minor;
    869
    870	/* let the user know what node this device is now attached to */
    871	dev_info(&interface->dev, "IOWarrior product=0x%x, serial=%s interface=%d "
    872		 "now attached to iowarrior%d\n", dev->product_id, dev->chip_serial,
    873		 iface_desc->desc.bInterfaceNumber, dev->minor - IOWARRIOR_MINOR_BASE);
    874	return retval;
    875
    876error:
    877	iowarrior_delete(dev);
    878	return retval;
    879}
    880
    881/*
    882 *	iowarrior_disconnect
    883 *
    884 *	Called by the usb core when the device is removed from the system.
    885 */
    886static void iowarrior_disconnect(struct usb_interface *interface)
    887{
    888	struct iowarrior *dev = usb_get_intfdata(interface);
    889	int minor = dev->minor;
    890
    891	usb_deregister_dev(interface, &iowarrior_class);
    892
    893	mutex_lock(&dev->mutex);
    894
    895	/* prevent device read, write and ioctl */
    896	dev->present = 0;
    897
    898	if (dev->opened) {
    899		/* There is a process that holds a filedescriptor to the device ,
    900		   so we only shutdown read-/write-ops going on.
    901		   Deleting the device is postponed until close() was called.
    902		 */
    903		usb_kill_urb(dev->int_in_urb);
    904		usb_kill_anchored_urbs(&dev->submitted);
    905		wake_up_interruptible(&dev->read_wait);
    906		wake_up_interruptible(&dev->write_wait);
    907		mutex_unlock(&dev->mutex);
    908	} else {
    909		/* no process is using the device, cleanup now */
    910		mutex_unlock(&dev->mutex);
    911		iowarrior_delete(dev);
    912	}
    913
    914	dev_info(&interface->dev, "I/O-Warror #%d now disconnected\n",
    915		 minor - IOWARRIOR_MINOR_BASE);
    916}
    917
    918/* usb specific object needed to register this driver with the usb subsystem */
    919static struct usb_driver iowarrior_driver = {
    920	.name = "iowarrior",
    921	.probe = iowarrior_probe,
    922	.disconnect = iowarrior_disconnect,
    923	.id_table = iowarrior_ids,
    924};
    925
    926module_usb_driver(iowarrior_driver);