1 /*
2  * Device driver for the Apple Desktop Bus
3  * and the /dev/adb device on macintoshes.
4  *
5  * Copyright (C) 1996 Paul Mackerras.
6  *
7  * Modified to declare controllers as structures, added
8  * client notification of bus reset and handles PowerBook
9  * sleep, by Benjamin Herrenschmidt.
10  *
11  * To do:
12  *
13  * - /proc/adb to list the devices and infos
14  * - more /dev/adb to allow userland to receive the
15  *   flow of auto-polling datas from a given device.
16  * - move bus probe to a kernel thread
17  */
18 
19 #include <linux/config.h>
20 #include <linux/types.h>
21 #include <linux/errno.h>
22 #include <linux/kernel.h>
23 #include <linux/slab.h>
24 #include <linux/module.h>
25 #include <linux/fs.h>
26 #include <linux/devfs_fs_kernel.h>
27 #include <linux/mm.h>
28 #include <linux/sched.h>
29 #include <linux/smp_lock.h>
30 #include <linux/adb.h>
31 #include <linux/cuda.h>
32 #include <linux/pmu.h>
33 #include <linux/notifier.h>
34 #include <linux/wait.h>
35 #include <linux/init.h>
36 #include <linux/delay.h>
37 #include <linux/completion.h>
38 #include <asm/uaccess.h>
39 #ifdef CONFIG_PPC
40 #include <asm/prom.h>
41 #include <asm/hydra.h>
42 #endif
43 
44 EXPORT_SYMBOL(adb_controller);
45 EXPORT_SYMBOL(adb_client_list);
46 
47 extern struct adb_driver via_macii_driver;
48 extern struct adb_driver via_maciisi_driver;
49 extern struct adb_driver via_cuda_driver;
50 extern struct adb_driver adb_iop_driver;
51 extern struct adb_driver via_pmu_driver;
52 extern struct adb_driver macio_adb_driver;
53 
54 static struct adb_driver *adb_driver_list[] = {
55 #ifdef CONFIG_ADB_MACII
56 	&via_macii_driver,
57 #endif
58 #ifdef CONFIG_ADB_MACIISI
59 	&via_maciisi_driver,
60 #endif
61 #ifdef CONFIG_ADB_CUDA
62 	&via_cuda_driver,
63 #endif
64 #ifdef CONFIG_ADB_IOP
65 	&adb_iop_driver,
66 #endif
67 #if defined(CONFIG_ADB_PMU) || defined(CONFIG_ADB_PMU68K)
68 	&via_pmu_driver,
69 #endif
70 #ifdef CONFIG_ADB_MACIO
71 	&macio_adb_driver,
72 #endif
73 	NULL
74 };
75 
76 struct adb_driver *adb_controller;
77 struct notifier_block *adb_client_list = NULL;
78 static int adb_got_sleep = 0;
79 static int adb_inited = 0;
80 static pid_t adb_probe_task_pid;
81 static DECLARE_MUTEX(adb_probe_mutex);
82 static struct completion adb_probe_task_comp;
83 static int sleepy_trackpad;
84 int __adb_probe_sync;
85 
86 #ifdef CONFIG_PMAC_PBOOK
87 static int adb_notify_sleep(struct pmu_sleep_notifier *self, int when);
88 static struct pmu_sleep_notifier adb_sleep_notifier = {
89 	adb_notify_sleep,
90 	SLEEP_LEVEL_ADB,
91 };
92 #endif
93 
94 static int adb_scan_bus(void);
95 static int do_adb_reset_bus(void);
96 static void adbdev_init(void);
97 
98 
99 static struct adb_handler {
100 	void (*handler)(unsigned char *, int, struct pt_regs *, int);
101 	int original_address;
102 	int handler_id;
103 } adb_handler[16];
104 
105 #if 0
106 static void printADBreply(struct adb_request *req)
107 {
108         int i;
109 
110         printk("adb reply (%d)", req->reply_len);
111         for(i = 0; i < req->reply_len; i++)
112                 printk(" %x", req->reply[i]);
113         printk("\n");
114 
115 }
116 #endif
117 
118 
adb_wait_ms(unsigned int ms)119 static __inline__ void adb_wait_ms(unsigned int ms)
120 {
121 	if (current->pid && adb_probe_task_pid &&
122 	  adb_probe_task_pid == current->pid) {
123 		current->state = TASK_UNINTERRUPTIBLE;
124 		schedule_timeout(1 + ms * HZ / 1000);
125 	} else
126 		mdelay(ms);
127 }
128 
adb_scan_bus(void)129 static int adb_scan_bus(void)
130 {
131 	int i, highFree=0, noMovement;
132 	int devmask = 0;
133 	struct adb_request req;
134 
135 	/* assumes adb_handler[] is all zeroes at this point */
136 	for (i = 1; i < 16; i++) {
137 		/* see if there is anything at address i */
138 		adb_request(&req, NULL, ADBREQ_SYNC | ADBREQ_REPLY, 1,
139                             (i << 4) | 0xf);
140 		if (req.reply_len > 1)
141 			/* one or more devices at this address */
142 			adb_handler[i].original_address = i;
143 		else if (i > highFree)
144 			highFree = i;
145 	}
146 
147 	/* Note we reset noMovement to 0 each time we move a device */
148 	for (noMovement = 1; noMovement < 2 && highFree > 0; noMovement++) {
149 		for (i = 1; i < 16; i++) {
150 			if (adb_handler[i].original_address == 0)
151 				continue;
152 			/*
153 			 * Send a "talk register 3" command to address i
154 			 * to provoke a collision if there is more than
155 			 * one device at this address.
156 			 */
157 			adb_request(&req, NULL, ADBREQ_SYNC | ADBREQ_REPLY, 1,
158 				    (i << 4) | 0xf);
159 			/*
160 			 * Move the device(s) which didn't detect a
161 			 * collision to address `highFree'.  Hopefully
162 			 * this only moves one device.
163 			 */
164 			adb_request(&req, NULL, ADBREQ_SYNC, 3,
165 				    (i<< 4) | 0xb, (highFree | 0x60), 0xfe);
166 			/*
167 			 * See if anybody actually moved. This is suggested
168 			 * by HW TechNote 01:
169 			 *
170 			 * http://developer.apple.com/technotes/hw/hw_01.html
171 			 */
172 			adb_request(&req, NULL, ADBREQ_SYNC | ADBREQ_REPLY, 1,
173 				    (highFree << 4) | 0xf);
174 			if (req.reply_len <= 1) continue;
175 			/*
176 			 * Test whether there are any device(s) left
177 			 * at address i.
178 			 */
179 			adb_request(&req, NULL, ADBREQ_SYNC | ADBREQ_REPLY, 1,
180 				    (i << 4) | 0xf);
181 			if (req.reply_len > 1) {
182 				/*
183 				 * There are still one or more devices
184 				 * left at address i.  Register the one(s)
185 				 * we moved to `highFree', and find a new
186 				 * value for highFree.
187 				 */
188 				adb_handler[highFree].original_address =
189 					adb_handler[i].original_address;
190 				while (highFree > 0 &&
191 				       adb_handler[highFree].original_address)
192 					highFree--;
193 				if (highFree <= 0)
194 					break;
195 
196 				noMovement = 0;
197 			}
198 			else {
199 				/*
200 				 * No devices left at address i; move the
201 				 * one(s) we moved to `highFree' back to i.
202 				 */
203 				adb_request(&req, NULL, ADBREQ_SYNC, 3,
204 					    (highFree << 4) | 0xb,
205 					    (i | 0x60), 0xfe);
206 			}
207 		}
208 	}
209 
210 	/* Now fill in the handler_id field of the adb_handler entries. */
211 	printk(KERN_DEBUG "adb devices:");
212 	for (i = 1; i < 16; i++) {
213 		if (adb_handler[i].original_address == 0)
214 			continue;
215 		adb_request(&req, NULL, ADBREQ_SYNC | ADBREQ_REPLY, 1,
216 			    (i << 4) | 0xf);
217 		adb_handler[i].handler_id = req.reply[2];
218 		printk(" [%d]: %d %x", i, adb_handler[i].original_address,
219 		       adb_handler[i].handler_id);
220 		devmask |= 1 << i;
221 	}
222 	printk("\n");
223 	return devmask;
224 }
225 
226 /*
227  * This kernel task handles ADB probing. It dies once probing is
228  * completed.
229  */
230 static int
adb_probe_task(void * x)231 adb_probe_task(void *x)
232 {
233 	strcpy(current->comm, "kadbprobe");
234 
235 	spin_lock_irq(&current->sigmask_lock);
236 	sigfillset(&current->blocked);
237 	flush_signals(current);
238 	spin_unlock_irq(&current->sigmask_lock);
239 
240 	printk(KERN_INFO "adb: starting probe task...\n");
241 	do_adb_reset_bus();
242 	printk(KERN_INFO "adb: finished probe task...\n");
243 
244 	adb_probe_task_pid = 0;
245 	up(&adb_probe_mutex);
246 
247 	return 0;
248 }
249 
250 static void
__adb_probe_task(void * data)251 __adb_probe_task(void *data)
252 {
253 	adb_probe_task_pid = kernel_thread(adb_probe_task, NULL,
254 		SIGCHLD | CLONE_FS | CLONE_FILES | CLONE_SIGHAND);
255 	if (adb_probe_task_pid < 0) {
256 		adb_probe_task_pid = 0;
257 		printk(KERN_ERR "adb: failed to create probe task !\n");
258 	}
259 }
260 
261 int
adb_reset_bus(void)262 adb_reset_bus(void)
263 {
264 	static struct tq_struct tqs = {
265 		routine:	__adb_probe_task,
266 	};
267 
268 	if (__adb_probe_sync) {
269 		do_adb_reset_bus();
270 		return 0;
271 	}
272 
273 	down(&adb_probe_mutex);
274 
275 	/* Create probe thread as a child of keventd */
276 	if (current_is_keventd())
277 		__adb_probe_task(NULL);
278 	else
279 		schedule_task(&tqs);
280 	return 0;
281 }
282 
adb_init(void)283 int __init adb_init(void)
284 {
285 	struct adb_driver *driver;
286 	int i;
287 
288 #ifdef CONFIG_PPC
289 	if ( (_machine != _MACH_chrp) && (_machine != _MACH_Pmac) )
290 		return 0;
291 #endif
292 #ifdef CONFIG_MAC
293 	if (!MACH_IS_MAC)
294 		return 0;
295 #endif
296 
297 	/* xmon may do early-init */
298 	if (adb_inited)
299 		return 0;
300 	adb_inited = 1;
301 
302 	adb_controller = NULL;
303 
304 	i = 0;
305 	while ((driver = adb_driver_list[i++]) != NULL) {
306 		if (!driver->probe()) {
307 			adb_controller = driver;
308 			break;
309 		}
310 	}
311 	if ((adb_controller == NULL) || adb_controller->init()) {
312 		printk(KERN_WARNING "Warning: no ADB interface detected\n");
313 		adb_controller = NULL;
314 	} else {
315 #ifdef CONFIG_PMAC_PBOOK
316 		pmu_register_sleep_notifier(&adb_sleep_notifier);
317 #endif /* CONFIG_PMAC_PBOOK */
318 #ifdef CONFIG_PPC
319 		if (machine_is_compatible("AAPL,PowerBook1998") ||
320 			machine_is_compatible("PowerBook1,1"))
321 			sleepy_trackpad = 1;
322 #endif /* CONFIG_PPC */
323 		init_completion(&adb_probe_task_comp);
324 		adbdev_init();
325 		adb_reset_bus();
326 	}
327 	return 0;
328 }
329 
330 __initcall(adb_init);
331 
332 #ifdef CONFIG_PMAC_PBOOK
333 /*
334  * notify clients before sleep and reset bus afterwards
335  */
336 int
adb_notify_sleep(struct pmu_sleep_notifier * self,int when)337 adb_notify_sleep(struct pmu_sleep_notifier *self, int when)
338 {
339 	int ret;
340 
341 	switch (when) {
342 	case PBOOK_SLEEP_REQUEST:
343 		adb_got_sleep = 1;
344 		/* We need to get a lock on the probe thread */
345 		down(&adb_probe_mutex);
346 		/* Stop autopoll */
347 		if (adb_controller->autopoll)
348 			adb_controller->autopoll(0);
349 		ret = notifier_call_chain(&adb_client_list, ADB_MSG_POWERDOWN, NULL);
350 		if (ret & NOTIFY_STOP_MASK) {
351 			up(&adb_probe_mutex);
352 			return PBOOK_SLEEP_REFUSE;
353 		}
354 		break;
355 	case PBOOK_SLEEP_REJECT:
356 		if (adb_got_sleep) {
357 			adb_got_sleep = 0;
358 			up(&adb_probe_mutex);
359 			adb_reset_bus();
360 		}
361 		break;
362 
363 	case PBOOK_SLEEP_NOW:
364 		break;
365 	case PBOOK_WAKE:
366 		adb_got_sleep = 0;
367 		up(&adb_probe_mutex);
368 		adb_reset_bus();
369 		break;
370 	}
371 	return PBOOK_SLEEP_OK;
372 }
373 #endif /* CONFIG_PMAC_PBOOK */
374 
375 static int
do_adb_reset_bus(void)376 do_adb_reset_bus(void)
377 {
378 	int ret, nret, devs;
379 	unsigned long flags;
380 
381 	if (adb_controller == NULL)
382 		return -ENXIO;
383 
384 	if (adb_controller->autopoll)
385 		adb_controller->autopoll(0);
386 
387 	nret = notifier_call_chain(&adb_client_list, ADB_MSG_PRE_RESET, NULL);
388 	if (nret & NOTIFY_STOP_MASK) {
389 		if (adb_controller->autopoll)
390 			adb_controller->autopoll(devs);
391 		return -EBUSY;
392 	}
393 
394 	if (sleepy_trackpad) {
395 		/* Let the trackpad settle down */
396 		adb_wait_ms(500);
397 	}
398 
399 	save_flags(flags);
400 	cli();
401 	memset(adb_handler, 0, sizeof(adb_handler));
402 	restore_flags(flags);
403 
404 	/* That one is still a bit synchronous, oh well... */
405 	if (adb_controller->reset_bus)
406 		ret = adb_controller->reset_bus();
407 	else
408 		ret = 0;
409 
410 	if (sleepy_trackpad) {
411 		/* Let the trackpad settle down */
412 		adb_wait_ms(1500);
413 	}
414 
415 	if (!ret) {
416 		devs = adb_scan_bus();
417 		if (adb_controller->autopoll)
418 			adb_controller->autopoll(devs);
419 	}
420 
421 	nret = notifier_call_chain(&adb_client_list, ADB_MSG_POST_RESET, NULL);
422 	if (nret & NOTIFY_STOP_MASK)
423 		return -EBUSY;
424 
425 	return ret;
426 }
427 
428 void
adb_poll(void)429 adb_poll(void)
430 {
431 	if ((adb_controller == NULL)||(adb_controller->poll == NULL))
432 		return;
433 	adb_controller->poll();
434 }
435 
436 static void
adb_probe_wakeup(struct adb_request * req)437 adb_probe_wakeup(struct adb_request *req)
438 {
439 	complete(&adb_probe_task_comp);
440 }
441 
442 static struct adb_request adb_sreq;
443 static int adb_sreq_lock; // Use semaphore ! */
444 
445 int
adb_request(struct adb_request * req,void (* done)(struct adb_request *),int flags,int nbytes,...)446 adb_request(struct adb_request *req, void (*done)(struct adb_request *),
447 	    int flags, int nbytes, ...)
448 {
449 	va_list list;
450 	int i, use_sreq;
451 	int rc;
452 
453 	if ((adb_controller == NULL) || (adb_controller->send_request == NULL))
454 		return -ENXIO;
455 	if (nbytes < 1)
456 		return -EINVAL;
457 	if (req == NULL && (flags & ADBREQ_NOSEND))
458 		return -EINVAL;
459 
460 	if (req == NULL) {
461 		if (test_and_set_bit(0,&adb_sreq_lock)) {
462 			printk("adb.c: Warning: contention on static request !\n");
463 			return -EPERM;
464 		}
465 		req = &adb_sreq;
466 		flags |= ADBREQ_SYNC;
467 		use_sreq = 1;
468 	} else
469 		use_sreq = 0;
470 	req->nbytes = nbytes+1;
471 	req->done = done;
472 	req->reply_expected = flags & ADBREQ_REPLY;
473 	req->data[0] = ADB_PACKET;
474 	va_start(list, nbytes);
475 	for (i = 0; i < nbytes; ++i)
476 		req->data[i+1] = va_arg(list, int);
477 	va_end(list);
478 
479 	if (flags & ADBREQ_NOSEND)
480 		return 0;
481 
482 	/* Synchronous requests send from the probe thread cause it to
483 	 * block. Beware that the "done" callback will be overriden !
484 	 */
485 	if ((flags & ADBREQ_SYNC) &&
486 	    (current->pid && adb_probe_task_pid &&
487 	    adb_probe_task_pid == current->pid)) {
488 		req->done = adb_probe_wakeup;
489 		rc = adb_controller->send_request(req, 0);
490 		if (rc || req->complete)
491 			goto bail;
492 		wait_for_completion(&adb_probe_task_comp);
493 		rc = 0;
494 		goto bail;
495 	}
496 
497 	rc = adb_controller->send_request(req, flags & ADBREQ_SYNC);
498 bail:
499 	if (use_sreq)
500 		clear_bit(0, &adb_sreq_lock);
501 
502 	return rc;
503 }
504 
505  /* Ultimately this should return the number of devices with
506     the given default id.
507     And it does it now ! Note: changed behaviour: This function
508     will now register if default_id _and_ handler_id both match
509     but handler_id can be left to 0 to match with default_id only.
510     When handler_id is set, this function will try to adjust
511     the handler_id id it doesn't match. */
512 int
adb_register(int default_id,int handler_id,struct adb_ids * ids,void (* handler)(unsigned char *,int,struct pt_regs *,int))513 adb_register(int default_id, int handler_id, struct adb_ids *ids,
514 	     void (*handler)(unsigned char *, int, struct pt_regs *, int))
515 {
516 	int i;
517 
518 	ids->nids = 0;
519 	for (i = 1; i < 16; i++) {
520 		if ((adb_handler[i].original_address == default_id) &&
521 		    (!handler_id || (handler_id == adb_handler[i].handler_id) ||
522 		    adb_try_handler_change(i, handler_id))) {
523 			if (adb_handler[i].handler != 0) {
524 				printk(KERN_ERR
525 				       "Two handlers for ADB device %d\n",
526 				       default_id);
527 				continue;
528 			}
529 			adb_handler[i].handler = handler;
530 			ids->id[ids->nids++] = i;
531 		}
532 	}
533 	return ids->nids;
534 }
535 
536 int
adb_unregister(int index)537 adb_unregister(int index)
538 {
539 	if (!adb_handler[index].handler)
540 		return -ENODEV;
541 	adb_handler[index].handler = 0;
542 	return 0;
543 }
544 
545 void
adb_input(unsigned char * buf,int nb,struct pt_regs * regs,int autopoll)546 adb_input(unsigned char *buf, int nb, struct pt_regs *regs, int autopoll)
547 {
548 	int i, id;
549 	static int dump_adb_input = 0;
550 
551 	/* We skip keystrokes and mouse moves when the sleep process
552 	 * has been started. We stop autopoll, but this is another security
553 	 */
554 	if (adb_got_sleep)
555 		return;
556 
557 	id = buf[0] >> 4;
558 	if (dump_adb_input) {
559 		printk(KERN_INFO "adb packet: ");
560 		for (i = 0; i < nb; ++i)
561 			printk(" %x", buf[i]);
562 		printk(", id = %d\n", id);
563 	}
564 	if (adb_handler[id].handler != 0) {
565 		(*adb_handler[id].handler)(buf, nb, regs, autopoll);
566 	}
567 }
568 
569 /* Try to change handler to new_id. Will return 1 if successful */
570 int
adb_try_handler_change(int address,int new_id)571 adb_try_handler_change(int address, int new_id)
572 {
573 	struct adb_request req;
574 
575 	if (adb_handler[address].handler_id == new_id)
576 	    return 1;
577 	adb_request(&req, NULL, ADBREQ_SYNC, 3,
578 	    ADB_WRITEREG(address, 3), address | 0x20, new_id);
579 	adb_request(&req, NULL, ADBREQ_SYNC | ADBREQ_REPLY, 1,
580 	    ADB_READREG(address, 3));
581 	if (req.reply_len < 2)
582 	    return 0;
583 	if (req.reply[2] != new_id)
584 	    return 0;
585 	adb_handler[address].handler_id = req.reply[2];
586 
587 	return 1;
588 }
589 
590 int
adb_get_infos(int address,int * original_address,int * handler_id)591 adb_get_infos(int address, int *original_address, int *handler_id)
592 {
593 	*original_address = adb_handler[address].original_address;
594 	*handler_id = adb_handler[address].handler_id;
595 
596 	return (*original_address != 0);
597 }
598 
599 /*
600  * /dev/adb device driver.
601  */
602 
603 #define ADB_MAJOR	56	/* major number for /dev/adb */
604 
605 struct adbdev_state {
606 	spinlock_t	lock;
607 	atomic_t	n_pending;
608 	struct adb_request *completed;
609   	wait_queue_head_t wait_queue;
610 	int		inuse;
611 };
612 
adb_write_done(struct adb_request * req)613 static void adb_write_done(struct adb_request *req)
614 {
615 	struct adbdev_state *state = (struct adbdev_state *) req->arg;
616 	unsigned long flags;
617 
618 	if (!req->complete) {
619 		req->reply_len = 0;
620 		req->complete = 1;
621 	}
622 	spin_lock_irqsave(&state->lock, flags);
623 	atomic_dec(&state->n_pending);
624 	if (!state->inuse) {
625 		kfree(req);
626 		if (atomic_read(&state->n_pending) == 0) {
627 			spin_unlock_irqrestore(&state->lock, flags);
628 			kfree(state);
629 			return;
630 		}
631 	} else {
632 		struct adb_request **ap = &state->completed;
633 		while (*ap != NULL)
634 			ap = &(*ap)->next;
635 		req->next = NULL;
636 		*ap = req;
637 		wake_up_interruptible(&state->wait_queue);
638 	}
639 	spin_unlock_irqrestore(&state->lock, flags);
640 }
641 
642 static int
do_adb_query(struct adb_request * req)643 do_adb_query(struct adb_request *req)
644 {
645 	int	ret = -EINVAL;
646 
647 	switch(req->data[1])
648 	{
649 	case ADB_QUERY_GETDEVINFO:
650 		if (req->nbytes < 3)
651 			break;
652 		req->reply[0] = adb_handler[req->data[2]].original_address;
653 		req->reply[1] = adb_handler[req->data[2]].handler_id;
654 		req->complete = 1;
655 		req->reply_len = 2;
656 		adb_write_done(req);
657 		ret = 0;
658 		break;
659 	}
660 	return ret;
661 }
662 
adb_open(struct inode * inode,struct file * file)663 static int adb_open(struct inode *inode, struct file *file)
664 {
665 	struct adbdev_state *state;
666 
667 	if (MINOR(inode->i_rdev) > 0 || adb_controller == NULL)
668 		return -ENXIO;
669 	state = kmalloc(sizeof(struct adbdev_state), GFP_KERNEL);
670 	if (state == 0)
671 		return -ENOMEM;
672 	file->private_data = state;
673 	spin_lock_init(&state->lock);
674 	atomic_set(&state->n_pending, 0);
675 	state->completed = NULL;
676 	init_waitqueue_head(&state->wait_queue);
677 	state->inuse = 1;
678 
679 	return 0;
680 }
681 
682 /* FIXME: Should wait completion, dequeue & delete pending requests */
adb_release(struct inode * inode,struct file * file)683 static int adb_release(struct inode *inode, struct file *file)
684 {
685 	struct adbdev_state *state = file->private_data;
686 	unsigned long flags;
687 
688 	lock_kernel();
689 	if (state) {
690 		file->private_data = NULL;
691 		spin_lock_irqsave(&state->lock, flags);
692 		if (atomic_read(&state->n_pending) == 0
693 		    && state->completed == NULL) {
694 			spin_unlock_irqrestore(&state->lock, flags);
695 			kfree(state);
696 		} else {
697 			state->inuse = 0;
698 			spin_unlock_irqrestore(&state->lock, flags);
699 		}
700 	}
701 	unlock_kernel();
702 	return 0;
703 }
704 
adb_read(struct file * file,char * buf,size_t count,loff_t * ppos)705 static ssize_t adb_read(struct file *file, char *buf,
706 			size_t count, loff_t *ppos)
707 {
708 	int ret;
709 	struct adbdev_state *state = file->private_data;
710 	struct adb_request *req;
711 	wait_queue_t wait = __WAITQUEUE_INITIALIZER(wait,current);
712 	unsigned long flags;
713 
714 	if (count < 2)
715 		return -EINVAL;
716 	if (count > sizeof(req->reply))
717 		count = sizeof(req->reply);
718 	ret = verify_area(VERIFY_WRITE, buf, count);
719 	if (ret)
720 		return ret;
721 
722 	req = NULL;
723 	spin_lock_irqsave(&state->lock, flags);
724 	add_wait_queue(&state->wait_queue, &wait);
725 	current->state = TASK_INTERRUPTIBLE;
726 
727 	for (;;) {
728 		req = state->completed;
729 		if (req != NULL)
730 			state->completed = req->next;
731 		else if (atomic_read(&state->n_pending) == 0)
732 			ret = -EIO;
733 		if (req != NULL || ret != 0)
734 			break;
735 
736 		if (file->f_flags & O_NONBLOCK) {
737 			ret = -EAGAIN;
738 			break;
739 		}
740 		if (signal_pending(current)) {
741 			ret = -ERESTARTSYS;
742 			break;
743 		}
744 		spin_unlock_irqrestore(&state->lock, flags);
745 		schedule();
746 		spin_lock_irqsave(&state->lock, flags);
747 	}
748 
749 	current->state = TASK_RUNNING;
750 	remove_wait_queue(&state->wait_queue, &wait);
751 	spin_unlock_irqrestore(&state->lock, flags);
752 
753 	if (ret)
754 		return ret;
755 
756 	ret = req->reply_len;
757 	if (ret > count)
758 		ret = count;
759 	if (ret > 0 && copy_to_user(buf, req->reply, ret))
760 		ret = -EFAULT;
761 
762 	kfree(req);
763 	return ret;
764 }
765 
adb_write(struct file * file,const char * buf,size_t count,loff_t * ppos)766 static ssize_t adb_write(struct file *file, const char *buf,
767 			 size_t count, loff_t *ppos)
768 {
769 	int ret/*, i*/;
770 	struct adbdev_state *state = file->private_data;
771 	struct adb_request *req;
772 
773 	if (count < 2 || count > sizeof(req->data))
774 		return -EINVAL;
775 	if (adb_controller == NULL)
776 		return -ENXIO;
777 	ret = verify_area(VERIFY_READ, buf, count);
778 	if (ret)
779 		return ret;
780 
781 	req = (struct adb_request *) kmalloc(sizeof(struct adb_request),
782 					     GFP_KERNEL);
783 	if (req == NULL)
784 		return -ENOMEM;
785 
786 	req->nbytes = count;
787 	req->done = adb_write_done;
788 	req->arg = (void *) state;
789 	req->complete = 0;
790 
791 	ret = -EFAULT;
792 	if (copy_from_user(req->data, buf, count))
793 		goto out;
794 
795 	atomic_inc(&state->n_pending);
796 
797 	/* If a probe is in progress or we are sleeping, wait for it to complete */
798 	down(&adb_probe_mutex);
799 
800 	/* Queries are special requests sent to the ADB driver itself */
801 	if (req->data[0] == ADB_QUERY) {
802 		if (count > 1)
803 			ret = do_adb_query(req);
804 		else
805 			ret = -EINVAL;
806 		up(&adb_probe_mutex);
807 	}
808 	/* Special case for ADB_BUSRESET request, all others are sent to
809 	   the controller */
810 	else if ((req->data[0] == ADB_PACKET)&&(count > 1)
811 		&&(req->data[1] == ADB_BUSRESET)) {
812 		ret = do_adb_reset_bus();
813 		up(&adb_probe_mutex);
814 		atomic_dec(&state->n_pending);
815 		if (ret == 0)
816 			ret = count;
817 		goto out;
818 	} else {
819 		req->reply_expected = ((req->data[1] & 0xc) == 0xc);
820 		if (adb_controller && adb_controller->send_request)
821 			ret = adb_controller->send_request(req, 0);
822 		else
823 			ret = -ENXIO;
824 		up(&adb_probe_mutex);
825 	}
826 
827 	if (ret != 0) {
828 		atomic_dec(&state->n_pending);
829 		goto out;
830 	}
831 	return count;
832 
833 out:
834 	kfree(req);
835 	return ret;
836 }
837 
838 static struct file_operations adb_fops = {
839 	llseek:		no_llseek,
840 	read:		adb_read,
841 	write:		adb_write,
842 	open:		adb_open,
843 	release:	adb_release,
844 };
845 
846 static void
adbdev_init(void)847 adbdev_init(void)
848 {
849 	if (devfs_register_chrdev(ADB_MAJOR, "adb", &adb_fops))
850 		printk(KERN_ERR "adb: unable to get major %d\n", ADB_MAJOR);
851 	else
852 		devfs_register (NULL, "adb", DEVFS_FL_DEFAULT,
853 				ADB_MAJOR, 0,
854 				S_IFCHR | S_IRUSR | S_IWUSR,
855 				&adb_fops, NULL);
856 }
857