1/*
   2 * copyright (C) 1999/2000 by Henning Zabel <henning@uni-paderborn.de>
   3 *
   4 * This program is free software; you can redistribute it and/or modify it
   5 * under the terms of the GNU General Public License as published by the
   6 * Free Software Foundation; either version 2 of the License, or (at your
   7 * option) any later version.
   8 *
   9 * This program is distributed in the hope that it will be useful, but
  10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  11 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12 * for more details.
  13 *
  14 * You should have received a copy of the GNU General Public License
  15 * along with this program; if not, write to the Free Software Foundation,
  16 * Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  17 */
  18
  19
  20/*
  21 *	USB-Kernel Driver for the Mustek MDC800 Digital Camera
  22 *	(c) 1999/2000 Henning Zabel <henning@uni-paderborn.de>
  23 *
  24 *
  25 * The driver brings the USB functions of the MDC800 to Linux.
  26 * To use the Camera you must support the USB Protocol of the camera
  27 * to the Kernel Node.
  28 * The Driver uses a misc device Node. Create it with :
  29 * mknod /dev/mustek c 180 32
  30 *
  31 * The driver supports only one camera.
  32 * 
  33 * Fix: mdc800 used sleep_on and slept with io_lock held.
  34 * Converted sleep_on to waitqueues with schedule_timeout and made io_lock
  35 * a semaphore from a spinlock.
  36 * by Oliver Neukum <oliver@neukum.name>
  37 * (02/12/2001)
  38 * 
  39 * Identify version on module load.
  40 * (08/04/2001) gb
  41 *
  42 * version 0.7.5
  43 * Fixed potential SMP races with Spinlocks.
  44 * Thanks to Oliver Neukum <oliver@neukum.name> who 
  45 * noticed the race conditions.
  46 * (30/10/2000)
  47 *
  48 * Fixed: Setting urb->dev before submitting urb.
  49 * by Greg KH <greg@kroah.com>
  50 * (13/10/2000)
  51 *
  52 * version 0.7.3
  53 * bugfix : The mdc800->state field gets set to READY after the
  54 * the disconnect function sets it to NOT_CONNECTED. This makes the
  55 * driver running like the camera is connected and causes some
  56 * hang ups.
  57 *
  58 * version 0.7.1
  59 * MOD_INC and MOD_DEC are changed in usb_probe to prevent load/unload
  60 * problems when compiled as Module.
  61 * (04/04/2000)
  62 *
  63 * The mdc800 driver gets assigned the USB Minor 32-47. The Registration
  64 * was updated to use these values.
  65 * (26/03/2000)
  66 *
  67 * The Init und Exit Module Function are updated.
  68 * (01/03/2000)
  69 *
  70 * version 0.7.0
  71 * Rewrite of the driver : The driver now uses URB's. The old stuff
  72 * has been removed.
  73 *
  74 * version 0.6.0
  75 * Rewrite of this driver: The Emulation of the rs232 protocoll
  76 * has been removed from the driver. A special executeCommand function
  77 * for this driver is included to gphoto.
  78 * The driver supports two kind of communication to bulk endpoints.
  79 * Either with the dev->bus->ops->bulk... or with callback function.
  80 * (09/11/1999)
  81 *
  82 * version 0.5.0:
  83 * first Version that gets a version number. Most of the needed
  84 * functions work.
  85 * (20/10/1999)
  86 */
  87
  88#include <linux/sched.h>
  89#include <linux/signal.h>
  90#include <linux/spinlock.h>
  91#include <linux/errno.h>
  92#include <linux/random.h>
  93#include <linux/poll.h>
  94#include <linux/init.h>
  95#include <linux/slab.h>
  96#include <linux/module.h>
  97#include <linux/wait.h>
  98#include <linux/mutex.h>
  99
 100#include <linux/usb.h>
 101#include <linux/fs.h>
 102
 103/*
 104 * Version Information
 105 */
 106#define DRIVER_VERSION "v0.7.5 (30/10/2000)"
 107#define DRIVER_AUTHOR "Henning Zabel <henning@uni-paderborn.de>"
 108#define DRIVER_DESC "USB Driver for Mustek MDC800 Digital Camera"
 109
 110/* Vendor and Product Information */
 111#define MDC800_VENDOR_ID 	0x055f
 112#define MDC800_PRODUCT_ID	0xa800
 113
 114/* Timeouts (msec) */
 115#define TO_DOWNLOAD_GET_READY		1500
 116#define TO_DOWNLOAD_GET_BUSY		1500
 117#define TO_WRITE_GET_READY		1000
 118#define TO_DEFAULT_COMMAND		5000
 119#define TO_READ_FROM_IRQ 		TO_DEFAULT_COMMAND
 120#define TO_GET_READY			TO_DEFAULT_COMMAND
 121
 122/* Minor Number of the device (create with mknod /dev/mustek c 180 32) */
 123#define MDC800_DEVICE_MINOR_BASE 32
 124
 125
 126/**************************************************************************
 127	Data and structs
 128***************************************************************************/
 129
 130
 131typedef enum {
 132	NOT_CONNECTED, READY, WORKING, DOWNLOAD
 133} mdc800_state;
 134
 135
 136/* Data for the driver */
 137struct mdc800_data
 138{
 139	struct usb_device *	dev;			// Device Data
 140	mdc800_state 		state;
 141
 142	unsigned int		endpoint [4];
 143
 144	struct urb *		irq_urb;
 145	wait_queue_head_t	irq_wait;
 146	int			irq_woken;
 147	char*			irq_urb_buffer;
 148
 149	int			camera_busy;          // is camera busy ?
 150	int 			camera_request_ready; // Status to synchronize with irq
 151	char 			camera_response [8];  // last Bytes send after busy
 152
 153	struct urb *   		write_urb;
 154	char*			write_urb_buffer;
 155	wait_queue_head_t	write_wait;
 156	int			written;
 157
 158
 159	struct urb *   		download_urb;
 160	char*			download_urb_buffer;
 161	wait_queue_head_t	download_wait;
 162	int			downloaded;
 163	int			download_left;		// Bytes left to download ?
 164
 165
 166	/* Device Data */
 167	char			out [64];	// Answer Buffer
 168	int 			out_ptr;	// Index to the first not readen byte
 169	int			out_count;	// Bytes in the buffer
 170
 171	int			open;		// Camera device open ?
 172	struct mutex		io_lock;	// IO -lock
 173
 174	char 			in [8];		// Command Input Buffer
 175	int  			in_count;
 176
 177	int			pic_index;	// Cache for the Imagesize (-1 for nothing cached )
 178	int			pic_len;
 179	int			minor;
 180};
 181
 182
 183/* Specification of the Endpoints */
 184static struct usb_endpoint_descriptor mdc800_ed [4] =
 185{
 186	{ 
 187		.bLength = 		0,
 188		.bDescriptorType =	0,
 189		.bEndpointAddress =	0x01,
 190		.bmAttributes = 	0x02,
 191		.wMaxPacketSize =	cpu_to_le16(8),
 192		.bInterval = 		0,
 193		.bRefresh = 		0,
 194		.bSynchAddress = 	0,
 195	},
 196	{
 197		.bLength = 		0,
 198		.bDescriptorType = 	0,
 199		.bEndpointAddress = 	0x82,
 200		.bmAttributes = 	0x03,
 201		.wMaxPacketSize = 	cpu_to_le16(8),
 202		.bInterval = 		0,
 203		.bRefresh = 		0,
 204		.bSynchAddress = 	0,
 205	},
 206	{
 207		.bLength = 		0,
 208		.bDescriptorType = 	0,
 209		.bEndpointAddress = 	0x03,
 210		.bmAttributes = 	0x02,
 211		.wMaxPacketSize = 	cpu_to_le16(64),
 212		.bInterval = 		0,
 213		.bRefresh = 		0,
 214		.bSynchAddress = 	0,
 215	},
 216	{
 217		.bLength = 		0,
 218		.bDescriptorType = 	0,
 219		.bEndpointAddress = 	0x84,
 220		.bmAttributes = 	0x02,
 221		.wMaxPacketSize = 	cpu_to_le16(64),
 222		.bInterval = 		0,
 223		.bRefresh = 		0,
 224		.bSynchAddress = 	0,
 225	},
 226};
 227
 228/* The Variable used by the driver */
 229static struct mdc800_data* mdc800;
 230
 231
 232/***************************************************************************
 233	The USB Part of the driver
 234****************************************************************************/
 235
 236static int mdc800_endpoint_equals (struct usb_endpoint_descriptor *a,struct usb_endpoint_descriptor *b)
 237{
 238	return (
 239		   ( a->bEndpointAddress == b->bEndpointAddress )
 240		&& ( a->bmAttributes     == b->bmAttributes     )
 241		&& ( a->wMaxPacketSize   == b->wMaxPacketSize   )
 242	);
 243}
 244
 245
 246/*
 247 * Checks whether the camera responds busy
 248 */
 249static int mdc800_isBusy (char* ch)
 250{
 251	int i=0;
 252	while (i<8)
 253	{
 254		if (ch [i] != (char)0x99)
 255			return 0;
 256		i++;
 257	}
 258	return 1;
 259}
 260
 261
 262/*
 263 * Checks whether the Camera is ready
 264 */
 265static int mdc800_isReady (char *ch)
 266{
 267	int i=0;
 268	while (i<8)
 269	{
 270		if (ch [i] != (char)0xbb)
 271			return 0;
 272		i++;
 273	}
 274	return 1;
 275}
 276
 277
 278
 279/*
 280 * USB IRQ Handler for InputLine
 281 */
 282static void mdc800_usb_irq (struct urb *urb)
 283{
 284	int data_received=0, wake_up;
 285	unsigned char* b=urb->transfer_buffer;
 286	struct mdc800_data* mdc800=urb->context;
 287	struct device *dev = &mdc800->dev->dev;
 288	int status = urb->status;
 289
 290	if (status >= 0) {
 291		if (mdc800_isBusy (b))
 292		{
 293			if (!mdc800->camera_busy)
 294			{
 295				mdc800->camera_busy=1;
 296				dev_dbg(dev, "gets busy\n");
 297			}
 298		}
 299		else
 300		{
 301			if (mdc800->camera_busy && mdc800_isReady (b))
 302			{
 303				mdc800->camera_busy=0;
 304				dev_dbg(dev, "gets ready\n");
 305			}
 306		}
 307		if (!(mdc800_isBusy (b) || mdc800_isReady (b)))
 308		{
 309			/* Store Data in camera_answer field */
 310			dev_dbg(dev, "%i %i %i %i %i %i %i %i \n",b[0],b[1],b[2],b[3],b[4],b[5],b[6],b[7]);
 311
 312			memcpy (mdc800->camera_response,b,8);
 313			data_received=1;
 314		}
 315	}
 316	wake_up= ( mdc800->camera_request_ready > 0 )
 317		&&
 318		(
 319			((mdc800->camera_request_ready == 1) && (!mdc800->camera_busy))
 320		||
 321			((mdc800->camera_request_ready == 2) && data_received)
 322		||
 323			((mdc800->camera_request_ready == 3) && (mdc800->camera_busy))
 324		||
 325			(status < 0)
 326		);
 327
 328	if (wake_up)
 329	{
 330		mdc800->camera_request_ready=0;
 331		mdc800->irq_woken=1;
 332		wake_up (&mdc800->irq_wait);
 333	}
 334}
 335
 336
 337/*
 338 * Waits a while until the irq responds that camera is ready
 339 *
 340 *  mode : 0: Wait for camera gets ready
 341 *         1: Wait for receiving data
 342 *         2: Wait for camera gets busy
 343 *
 344 * msec: Time to wait
 345 */
 346static int mdc800_usb_waitForIRQ (int mode, int msec)
 347{
 348	mdc800->camera_request_ready=1+mode;
 349
 350	wait_event_timeout(mdc800->irq_wait, mdc800->irq_woken,
 351			   msecs_to_jiffies(msec));
 352	mdc800->irq_woken = 0;
 353
 354	if (mdc800->camera_request_ready>0)
 355	{
 356		mdc800->camera_request_ready=0;
 357		dev_err(&mdc800->dev->dev, "timeout waiting for camera.\n");
 358		return -1;
 359	}
 360	
 361	if (mdc800->state == NOT_CONNECTED)
 362	{
 363		printk(KERN_WARNING "mdc800: Camera gets disconnected "
 364		       "during waiting for irq.\n");
 365		mdc800->camera_request_ready=0;
 366		return -2;
 367	}
 368	
 369	return 0;
 370}
 371
 372
 373/*
 374 * The write_urb callback function
 375 */
 376static void mdc800_usb_write_notify (struct urb *urb)
 377{
 378	struct mdc800_data* mdc800=urb->context;
 379	int status = urb->status;
 380
 381	if (status != 0)
 382		dev_err(&mdc800->dev->dev,
 383			"writing command fails (status=%i)\n", status);
 384	else
 385		mdc800->state=READY;
 386	mdc800->written = 1;
 387	wake_up (&mdc800->write_wait);
 388}
 389
 390
 391/*
 392 * The download_urb callback function
 393 */
 394static void mdc800_usb_download_notify (struct urb *urb)
 395{
 396	struct mdc800_data* mdc800=urb->context;
 397	int status = urb->status;
 398
 399	if (status == 0) {
 400		/* Fill output buffer with these data */
 401		memcpy (mdc800->out,  urb->transfer_buffer, 64);
 402		mdc800->out_count=64;
 403		mdc800->out_ptr=0;
 404		mdc800->download_left-=64;
 405		if (mdc800->download_left == 0)
 406		{
 407			mdc800->state=READY;
 408		}
 409	} else {
 410		dev_err(&mdc800->dev->dev,
 411			"request bytes fails (status:%i)\n", status);
 412	}
 413	mdc800->downloaded = 1;
 414	wake_up (&mdc800->download_wait);
 415}
 416
 417
 418/***************************************************************************
 419	Probing for the Camera
 420 ***************************************************************************/
 421
 422static struct usb_driver mdc800_usb_driver;
 423static const struct file_operations mdc800_device_ops;
 424static struct usb_class_driver mdc800_class = {
 425	.name =		"mdc800%d",
 426	.fops =		&mdc800_device_ops,
 427	.minor_base =	MDC800_DEVICE_MINOR_BASE,
 428};
 429
 430
 431/*
 432 * Callback to search the Mustek MDC800 on the USB Bus
 433 */
 434static int mdc800_usb_probe (struct usb_interface *intf,
 435			       const struct usb_device_id *id)
 436{
 437	int i,j;
 438	struct usb_host_interface *intf_desc;
 439	struct usb_device *dev = interface_to_usbdev (intf);
 440	int irq_interval=0;
 441	int retval;
 442
 443	dev_dbg(&intf->dev, "(%s) called.\n", __func__);
 444
 445
 446	if (mdc800->dev != NULL)
 447	{
 448		dev_warn(&intf->dev, "only one Mustek MDC800 is supported.\n");
 449		return -ENODEV;
 450	}
 451
 452	if (dev->descriptor.bNumConfigurations != 1)
 453	{
 454		dev_err(&intf->dev,
 455			"probe fails -> wrong Number of Configuration\n");
 456		return -ENODEV;
 457	}
 458	intf_desc = intf->cur_altsetting;
 459
 460	if (
 461			( intf_desc->desc.bInterfaceClass != 0xff )
 462		||	( intf_desc->desc.bInterfaceSubClass != 0 )
 463		|| ( intf_desc->desc.bInterfaceProtocol != 0 )
 464		|| ( intf_desc->desc.bNumEndpoints != 4)
 465	)
 466	{
 467		dev_err(&intf->dev, "probe fails -> wrong Interface\n");
 468		return -ENODEV;
 469	}
 470
 471	/* Check the Endpoints */
 472	for (i=0; i<4; i++)
 473	{
 474		mdc800->endpoint[i]=-1;
 475		for (j=0; j<4; j++)
 476		{
 477			if (mdc800_endpoint_equals (&intf_desc->endpoint [j].desc,&mdc800_ed [i]))
 478			{
 479				mdc800->endpoint[i]=intf_desc->endpoint [j].desc.bEndpointAddress ;
 480				if (i==1)
 481				{
 482					irq_interval=intf_desc->endpoint [j].desc.bInterval;
 483				}
 484			}
 485		}
 486		if (mdc800->endpoint[i] == -1)
 487		{
 488			dev_err(&intf->dev, "probe fails -> Wrong Endpoints.\n");
 489			return -ENODEV;
 490		}
 491	}
 492
 493
 494	dev_info(&intf->dev, "Found Mustek MDC800 on USB.\n");
 495
 496	mutex_lock(&mdc800->io_lock);
 497
 498	retval = usb_register_dev(intf, &mdc800_class);
 499	if (retval) {
 500		dev_err(&intf->dev, "Not able to get a minor for this device.\n");
 501		mutex_unlock(&mdc800->io_lock);
 502		return -ENODEV;
 503	}
 504
 505	mdc800->dev=dev;
 506	mdc800->open=0;
 507
 508	/* Setup URB Structs */
 509	usb_fill_int_urb (
 510		mdc800->irq_urb,
 511		mdc800->dev,
 512		usb_rcvintpipe (mdc800->dev,mdc800->endpoint [1]),
 513		mdc800->irq_urb_buffer,
 514		8,
 515		mdc800_usb_irq,
 516		mdc800,
 517		irq_interval
 518	);
 519
 520	usb_fill_bulk_urb (
 521		mdc800->write_urb,
 522		mdc800->dev,
 523		usb_sndbulkpipe (mdc800->dev, mdc800->endpoint[0]),
 524		mdc800->write_urb_buffer,
 525		8,
 526		mdc800_usb_write_notify,
 527		mdc800
 528	);
 529
 530	usb_fill_bulk_urb (
 531		mdc800->download_urb,
 532		mdc800->dev,
 533		usb_rcvbulkpipe (mdc800->dev, mdc800->endpoint [3]),
 534		mdc800->download_urb_buffer,
 535		64,
 536		mdc800_usb_download_notify,
 537		mdc800
 538	);
 539
 540	mdc800->state=READY;
 541
 542	mutex_unlock(&mdc800->io_lock);
 543	
 544	usb_set_intfdata(intf, mdc800);
 545	return 0;
 546}
 547
 548
 549/*
 550 * Disconnect USB device (maybe the MDC800)
 551 */
 552static void mdc800_usb_disconnect (struct usb_interface *intf)
 553{
 554	struct mdc800_data* mdc800 = usb_get_intfdata(intf);
 555
 556	dev_dbg(&intf->dev, "(%s) called\n", __func__);
 557
 558	if (mdc800) {
 559		if (mdc800->state == NOT_CONNECTED)
 560			return;
 561
 562		usb_deregister_dev(intf, &mdc800_class);
 563
 564		/* must be under lock to make sure no URB
 565		   is submitted after usb_kill_urb() */
 566		mutex_lock(&mdc800->io_lock);
 567		mdc800->state=NOT_CONNECTED;
 568
 569		usb_kill_urb(mdc800->irq_urb);
 570		usb_kill_urb(mdc800->write_urb);
 571		usb_kill_urb(mdc800->download_urb);
 572		mutex_unlock(&mdc800->io_lock);
 573
 574		mdc800->dev = NULL;
 575		usb_set_intfdata(intf, NULL);
 576	}
 577	dev_info(&intf->dev, "Mustek MDC800 disconnected from USB.\n");
 578}
 579
 580
 581/***************************************************************************
 582	The Misc device Part (file_operations)
 583****************************************************************************/
 584
 585/*
 586 * This Function calc the Answersize for a command.
 587 */
 588static int mdc800_getAnswerSize (char command)
 589{
 590	switch ((unsigned char) command)
 591	{
 592		case 0x2a:
 593		case 0x49:
 594		case 0x51:
 595		case 0x0d:
 596		case 0x20:
 597		case 0x07:
 598		case 0x01:
 599		case 0x25:
 600		case 0x00:
 601			return 8;
 602
 603		case 0x05:
 604		case 0x3e:
 605			return mdc800->pic_len;
 606
 607		case 0x09:
 608			return 4096;
 609
 610		default:
 611			return 0;
 612	}
 613}
 614
 615
 616/*
 617 * Init the device: (1) alloc mem (2) Increase MOD Count ..
 618 */
 619static int mdc800_device_open (struct inode* inode, struct file *file)
 620{
 621	int retval=0;
 622	int errn=0;
 623
 624	mutex_lock(&mdc800->io_lock);
 625	
 626	if (mdc800->state == NOT_CONNECTED)
 627	{
 628		errn=-EBUSY;
 629		goto error_out;
 630	}
 631	if (mdc800->open)
 632	{
 633		errn=-EBUSY;
 634		goto error_out;
 635	}
 636
 637	mdc800->in_count=0;
 638	mdc800->out_count=0;
 639	mdc800->out_ptr=0;
 640	mdc800->pic_index=0;
 641	mdc800->pic_len=-1;
 642	mdc800->download_left=0;
 643
 644	mdc800->camera_busy=0;
 645	mdc800->camera_request_ready=0;
 646
 647	retval=0;
 648	mdc800->irq_urb->dev = mdc800->dev;
 649	retval = usb_submit_urb (mdc800->irq_urb, GFP_KERNEL);
 650	if (retval) {
 651		dev_err(&mdc800->dev->dev,
 652			"request USB irq fails (submit_retval=%i).\n", retval);
 653		errn = -EIO;
 654		goto error_out;
 655	}
 656
 657	mdc800->open=1;
 658	dev_dbg(&mdc800->dev->dev, "Mustek MDC800 device opened.\n");
 659
 660error_out:
 661	mutex_unlock(&mdc800->io_lock);
 662	return errn;
 663}
 664
 665
 666/*
 667 * Close the Camera and release Memory
 668 */
 669static int mdc800_device_release (struct inode* inode, struct file *file)
 670{
 671	int retval=0;
 672
 673	mutex_lock(&mdc800->io_lock);
 674	if (mdc800->open && (mdc800->state != NOT_CONNECTED))
 675	{
 676		usb_kill_urb(mdc800->irq_urb);
 677		usb_kill_urb(mdc800->write_urb);
 678		usb_kill_urb(mdc800->download_urb);
 679		mdc800->open=0;
 680	}
 681	else
 682	{
 683		retval=-EIO;
 684	}
 685
 686	mutex_unlock(&mdc800->io_lock);
 687	return retval;
 688}
 689
 690
 691/*
 692 * The Device read callback Function
 693 */
 694static ssize_t mdc800_device_read (struct file *file, char __user *buf, size_t len, loff_t *pos)
 695{
 696	size_t left=len, sts=len; /* single transfer size */
 697	char __user *ptr = buf;
 698	int retval;
 699
 700	mutex_lock(&mdc800->io_lock);
 701	if (mdc800->state == NOT_CONNECTED)
 702	{
 703		mutex_unlock(&mdc800->io_lock);
 704		return -EBUSY;
 705	}
 706	if (mdc800->state == WORKING)
 707	{
 708		printk(KERN_WARNING "mdc800: Illegal State \"working\""
 709		       "reached during read ?!\n");
 710		mutex_unlock(&mdc800->io_lock);
 711		return -EBUSY;
 712	}
 713	if (!mdc800->open)
 714	{
 715		mutex_unlock(&mdc800->io_lock);
 716		return -EBUSY;
 717	}
 718
 719	while (left)
 720	{
 721		if (signal_pending (current)) 
 722		{
 723			mutex_unlock(&mdc800->io_lock);
 724			return -EINTR;
 725		}
 726
 727		sts=left > (mdc800->out_count-mdc800->out_ptr)?mdc800->out_count-mdc800->out_ptr:left;
 728
 729		if (sts <= 0)
 730		{
 731			/* Too less Data in buffer */
 732			if (mdc800->state == DOWNLOAD)
 733			{
 734				mdc800->out_count=0;
 735				mdc800->out_ptr=0;
 736
 737				/* Download -> Request new bytes */
 738				mdc800->download_urb->dev = mdc800->dev;
 739				retval = usb_submit_urb (mdc800->download_urb, GFP_KERNEL);
 740				if (retval) {
 741					dev_err(&mdc800->dev->dev,
 742						"Can't submit download urb "
 743						"(retval=%i)\n", retval);
 744					mutex_unlock(&mdc800->io_lock);
 745					return len-left;
 746				}
 747				wait_event_timeout(mdc800->download_wait,
 748				     mdc800->downloaded,
 749				     msecs_to_jiffies(TO_DOWNLOAD_GET_READY));
 750				mdc800->downloaded = 0;
 751				if (mdc800->download_urb->status != 0)
 752				{
 753					dev_err(&mdc800->dev->dev,
 754						"request download-bytes fails "
 755						"(status=%i)\n",
 756						mdc800->download_urb->status);
 757					mutex_unlock(&mdc800->io_lock);
 758					return len-left;
 759				}
 760			}
 761			else
 762			{
 763				/* No more bytes -> that's an error*/
 764				mutex_unlock(&mdc800->io_lock);
 765				return -EIO;
 766			}
 767		}
 768		else
 769		{
 770			/* Copy Bytes */
 771			if (copy_to_user(ptr, &mdc800->out [mdc800->out_ptr],
 772						sts)) {
 773				mutex_unlock(&mdc800->io_lock);
 774				return -EFAULT;
 775			}
 776			ptr+=sts;
 777			left-=sts;
 778			mdc800->out_ptr+=sts;
 779		}
 780	}
 781
 782	mutex_unlock(&mdc800->io_lock);
 783	return len-left;
 784}
 785
 786
 787/*
 788 * The Device write callback Function
 789 * If a 8Byte Command is received, it will be send to the camera.
 790 * After this the driver initiates the request for the answer or
 791 * just waits until the camera becomes ready.
 792 */
 793static ssize_t mdc800_device_write (struct file *file, const char __user *buf, size_t len, loff_t *pos)
 794{
 795	size_t i=0;
 796	int retval;
 797
 798	mutex_lock(&mdc800->io_lock);
 799	if (mdc800->state != READY)
 800	{
 801		mutex_unlock(&mdc800->io_lock);
 802		return -EBUSY;
 803	}
 804	if (!mdc800->open )
 805	{
 806		mutex_unlock(&mdc800->io_lock);
 807		return -EBUSY;
 808	}
 809
 810	while (i<len)
 811	{
 812		unsigned char c;
 813		if (signal_pending (current)) 
 814		{
 815			mutex_unlock(&mdc800->io_lock);
 816			return -EINTR;
 817		}
 818		
 819		if(get_user(c, buf+i))
 820		{
 821			mutex_unlock(&mdc800->io_lock);
 822			return -EFAULT;
 823		}
 824
 825		/* check for command start */
 826		if (c == 0x55)
 827		{
 828			mdc800->in_count=0;
 829			mdc800->out_count=0;
 830			mdc800->out_ptr=0;
 831			mdc800->download_left=0;
 832		}
 833
 834		/* save command byte */
 835		if (mdc800->in_count < 8)
 836		{
 837			mdc800->in[mdc800->in_count] = c;
 838			mdc800->in_count++;
 839		}
 840		else
 841		{
 842			mutex_unlock(&mdc800->io_lock);
 843			return -EIO;
 844		}
 845
 846		/* Command Buffer full ? -> send it to camera */
 847		if (mdc800->in_count == 8)
 848		{
 849			int answersize;
 850
 851			if (mdc800_usb_waitForIRQ (0,TO_GET_READY))
 852			{
 853				dev_err(&mdc800->dev->dev,
 854					"Camera didn't get ready.\n");
 855				mutex_unlock(&mdc800->io_lock);
 856				return -EIO;
 857			}
 858
 859			answersize=mdc800_getAnswerSize (mdc800->in[1]);
 860
 861			mdc800->state=WORKING;
 862			memcpy (mdc800->write_urb->transfer_buffer, mdc800->in,8);
 863			mdc800->write_urb->dev = mdc800->dev;
 864			retval = usb_submit_urb (mdc800->write_urb, GFP_KERNEL);
 865			if (retval) {
 866				dev_err(&mdc800->dev->dev,
 867					"submitting write urb fails "
 868					"(retval=%i)\n", retval);
 869				mutex_unlock(&mdc800->io_lock);
 870				return -EIO;
 871			}
 872			wait_event_timeout(mdc800->write_wait, mdc800->written,
 873					msecs_to_jiffies(TO_WRITE_GET_READY));
 874			mdc800->written = 0;
 875			if (mdc800->state == WORKING)
 876			{
 877				usb_kill_urb(mdc800->write_urb);
 878				mutex_unlock(&mdc800->io_lock);
 879				return -EIO;
 880			}
 881
 882			switch ((unsigned char) mdc800->in[1])
 883			{
 884				case 0x05: /* Download Image */
 885				case 0x3e: /* Take shot in Fine Mode (WCam Mode) */
 886					if (mdc800->pic_len < 0)
 887					{
 888						dev_err(&mdc800->dev->dev,
 889							"call 0x07 before "
 890							"0x05,0x3e\n");
 891						mdc800->state=READY;
 892						mutex_unlock(&mdc800->io_lock);
 893						return -EIO;
 894					}
 895					mdc800->pic_len=-1;
 896
 897				case 0x09: /* Download Thumbnail */
 898					mdc800->download_left=answersize+64;
 899					mdc800->state=DOWNLOAD;
 900					mdc800_usb_waitForIRQ (0,TO_DOWNLOAD_GET_BUSY);
 901					break;
 902
 903
 904				default:
 905					if (answersize)
 906					{
 907
 908						if (mdc800_usb_waitForIRQ (1,TO_READ_FROM_IRQ))
 909						{
 910							dev_err(&mdc800->dev->dev, "requesting answer from irq fails\n");
 911							mutex_unlock(&mdc800->io_lock);
 912							return -EIO;
 913						}
 914
 915						/* Write dummy data, (this is ugly but part of the USB Protocol */
 916						/* if you use endpoint 1 as bulk and not as irq) */
 917						memcpy (mdc800->out, mdc800->camera_response,8);
 918
 919						/* This is the interpreted answer */
 920						memcpy (&mdc800->out[8], mdc800->camera_response,8);
 921
 922						mdc800->out_ptr=0;
 923						mdc800->out_count=16;
 924
 925						/* Cache the Imagesize, if command was getImageSize */
 926						if (mdc800->in [1] == (char) 0x07)
 927						{
 928							mdc800->pic_len=(int) 65536*(unsigned char) mdc800->camera_response[0]+256*(unsigned char) mdc800->camera_response[1]+(unsigned char) mdc800->camera_response[2];
 929
 930							dev_dbg(&mdc800->dev->dev, "cached imagesize = %i\n", mdc800->pic_len);
 931						}
 932
 933					}
 934					else
 935					{
 936						if (mdc800_usb_waitForIRQ (0,TO_DEFAULT_COMMAND))
 937						{
 938							dev_err(&mdc800->dev->dev, "Command Timeout.\n");
 939							mutex_unlock(&mdc800->io_lock);
 940							return -EIO;
 941						}
 942					}
 943					mdc800->state=READY;
 944					break;
 945			}
 946		}
 947		i++;
 948	}
 949	mutex_unlock(&mdc800->io_lock);
 950	return i;
 951}
 952
 953
 954/***************************************************************************
 955	Init and Cleanup this driver (Structs and types)
 956****************************************************************************/
 957
 958/* File Operations of this drivers */
 959static const struct file_operations mdc800_device_ops =
 960{
 961	.owner =	THIS_MODULE,
 962	.read =		mdc800_device_read,
 963	.write =	mdc800_device_write,
 964	.open =		mdc800_device_open,
 965	.release =	mdc800_device_release,
 966	.llseek =	noop_llseek,
 967};
 968
 969
 970
 971static const struct usb_device_id mdc800_table[] = {
 972	{ USB_DEVICE(MDC800_VENDOR_ID, MDC800_PRODUCT_ID) },
 973	{ }						/* Terminating entry */
 974};
 975
 976MODULE_DEVICE_TABLE (usb, mdc800_table);
 977/*
 978 * USB Driver Struct for this device
 979 */
 980static struct usb_driver mdc800_usb_driver =
 981{
 982	.name =		"mdc800",
 983	.probe =	mdc800_usb_probe,
 984	.disconnect =	mdc800_usb_disconnect,
 985	.id_table =	mdc800_table
 986};
 987
 988
 989
 990/************************************************************************
 991	Init and Cleanup this driver (Main Functions)
 992*************************************************************************/
 993
 994static int __init usb_mdc800_init (void)
 995{
 996	int retval = -ENODEV;
 997	/* Allocate Memory */
 998	mdc800=kzalloc (sizeof (struct mdc800_data), GFP_KERNEL);
 999	if (!mdc800)
1000		goto cleanup_on_fail;
1001
1002	mdc800->dev = NULL;
1003	mdc800->state=NOT_CONNECTED;
1004	mutex_init (&mdc800->io_lock);
1005
1006	init_waitqueue_head (&mdc800->irq_wait);
1007	init_waitqueue_head (&mdc800->write_wait);
1008	init_waitqueue_head (&mdc800->download_wait);
1009
1010	mdc800->irq_woken = 0;
1011	mdc800->downloaded = 0;
1012	mdc800->written = 0;
1013
1014	mdc800->irq_urb_buffer=kmalloc (8, GFP_KERNEL);
1015	if (!mdc800->irq_urb_buffer)
1016		goto cleanup_on_fail;
1017	mdc800->write_urb_buffer=kmalloc (8, GFP_KERNEL);
1018	if (!mdc800->write_urb_buffer)
1019		goto cleanup_on_fail;
1020	mdc800->download_urb_buffer=kmalloc (64, GFP_KERNEL);
1021	if (!mdc800->download_urb_buffer)
1022		goto cleanup_on_fail;
1023
1024	mdc800->irq_urb=usb_alloc_urb (0, GFP_KERNEL);
1025	if (!mdc800->irq_urb)
1026		goto cleanup_on_fail;
1027	mdc800->download_urb=usb_alloc_urb (0, GFP_KERNEL);
1028	if (!mdc800->download_urb)
1029		goto cleanup_on_fail;
1030	mdc800->write_urb=usb_alloc_urb (0, GFP_KERNEL);
1031	if (!mdc800->write_urb)
1032		goto cleanup_on_fail;
1033
1034	/* Register the driver */
1035	retval = usb_register(&mdc800_usb_driver);
1036	if (retval)
1037		goto cleanup_on_fail;
1038
1039	printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_VERSION ":"
1040	       DRIVER_DESC "\n");
1041
1042	return 0;
1043
1044	/* Clean driver up, when something fails */
1045
1046cleanup_on_fail:
1047
1048	if (mdc800 != NULL)
1049	{
1050		printk(KERN_ERR "mdc800: can't alloc memory!\n");
1051
1052		kfree(mdc800->download_urb_buffer);
1053		kfree(mdc800->write_urb_buffer);
1054		kfree(mdc800->irq_urb_buffer);
1055
1056		usb_free_urb(mdc800->write_urb);
1057		usb_free_urb(mdc800->download_urb);
1058		usb_free_urb(mdc800->irq_urb);
1059
1060		kfree (mdc800);
1061	}
1062	mdc800 = NULL;
1063	return retval;
1064}
1065
1066
1067static void __exit usb_mdc800_cleanup (void)
1068{
1069	usb_deregister (&mdc800_usb_driver);
1070
1071	usb_free_urb (mdc800->irq_urb);
1072	usb_free_urb (mdc800->download_urb);
1073	usb_free_urb (mdc800->write_urb);
1074
1075	kfree (mdc800->irq_urb_buffer);
1076	kfree (mdc800->write_urb_buffer);
1077	kfree (mdc800->download_urb_buffer);
1078
1079	kfree (mdc800);
1080	mdc800 = NULL;
1081}
1082
1083module_init (usb_mdc800_init);
1084module_exit (usb_mdc800_cleanup);
1085
1086MODULE_AUTHOR( DRIVER_AUTHOR );
1087MODULE_DESCRIPTION( DRIVER_DESC );
1088MODULE_LICENSE("GPL");
1089