Revert "Check integer overflow in do_cmd_ioctl() and do_cmdtest_ioctl()."
[comedi.git] / comedi / comedi_fops.c
1 /*
2     comedi/comedi_fops.c
3     comedi kernel module
4
5     COMEDI - Linux Control and Measurement Device Interface
6     Copyright (C) 1997-2000 David A. Schleef <ds@schleef.org>
7
8     This program is free software; you can redistribute it and/or modify
9     it under the terms of the GNU General Public License as published by
10     the Free Software Foundation; either version 2 of the License, or
11     (at your option) any later version.
12
13     This program is distributed in the hope that it will be useful,
14     but WITHOUT ANY WARRANTY; without even the implied warranty of
15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16     GNU General Public License for more details.
17
18     You should have received a copy of the GNU General Public License
19     along with this program; if not, write to the Free Software
20     Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
21
22 */
23
24 #undef DEBUG
25
26 #define __NO_VERSION__
27 #include "comedi_fops.h"
28 #include "comedi_compat32.h"
29
30 #include <linux/module.h>
31 #include <linux/errno.h>
32 #include <linux/kernel.h>
33 #include <linux/sched.h>
34 #include <linux/fcntl.h>
35 #include <linux/delay.h>
36 #include <linux/ioport.h>
37 #include <linux/mm.h>
38 #include <linux/slab.h>
39 #include <linux/kmod.h>
40 #include <linux/poll.h>
41 #include <linux/init.h>
42 #include <linux/device.h>
43 #include <linux/vmalloc.h>
44 #include <linux/fs.h>
45 #include <linux/comedidev.h>
46 #include <linux/cdev.h>
47 #include <linux/stat.h>
48
49 #include <asm/io.h>
50 #include <asm/uaccess.h>
51
52 //#include "kvmem.h"
53
54 MODULE_AUTHOR("http://www.comedi.org");
55 MODULE_DESCRIPTION("Comedi core module");
56 MODULE_LICENSE("GPL");
57
58 #ifdef CONFIG_COMEDI_DEBUG
59 int comedi_debug;
60 module_param(comedi_debug, int, 0644);
61 #endif
62
63 int comedi_autoconfig = 1;
64 module_param(comedi_autoconfig, bool, 0444);
65
66 int comedi_num_legacy_minors = 0;
67 module_param(comedi_num_legacy_minors, int, 0444);
68
69 static DEFINE_SPINLOCK(comedi_file_info_table_lock);
70 static struct comedi_device_file_info* comedi_file_info_table[COMEDI_NUM_MINORS];
71
72 static int do_devconfig_ioctl(comedi_device * dev, comedi_devconfig * arg);
73 static int do_bufconfig_ioctl(comedi_device * dev, void *arg);
74 static int do_devinfo_ioctl(comedi_device * dev, comedi_devinfo * arg,
75         struct file *file);
76 static int do_subdinfo_ioctl(comedi_device * dev, comedi_subdinfo * arg,
77         void *file);
78 static int do_chaninfo_ioctl(comedi_device * dev, comedi_chaninfo * arg);
79 static int do_bufinfo_ioctl(comedi_device * dev, void *arg, void *file);
80 static int do_cmd_ioctl(comedi_device * dev, void *arg, void *file);
81 static int do_lock_ioctl(comedi_device * dev, unsigned int arg, void *file);
82 static int do_unlock_ioctl(comedi_device * dev, unsigned int arg, void *file);
83 static int do_cancel_ioctl(comedi_device * dev, unsigned int arg, void *file);
84 static int do_cmdtest_ioctl(comedi_device * dev, void *arg, void *file);
85 static int do_insnlist_ioctl(comedi_device * dev, void *arg, void *file);
86 static int do_insn_ioctl(comedi_device * dev, void *arg, void *file);
87 static int do_poll_ioctl(comedi_device * dev, unsigned int subd, void *file);
88
89 void do_become_nonbusy(comedi_device * dev, comedi_subdevice * s);
90 static int do_cancel(comedi_device * dev, comedi_subdevice * s);
91
92 static int comedi_fasync(int fd, struct file *file, int on);
93
94 static int is_device_busy(comedi_device * dev);
95 static int resize_async_buffer(comedi_device *dev,
96         comedi_subdevice *s, comedi_async *async, unsigned new_size);
97
98 // sysfs attribute files
99
100 static COMEDI_DECLARE_ATTR_SHOW(show_max_read_buffer_kb, dev, buf);
101 static COMEDI_DECLARE_ATTR_STORE(store_max_read_buffer_kb, dev, buf, count);
102 static comedi_device_attribute_t dev_attr_max_read_buffer_kb =
103 {
104         .attr = {
105                         .name = "max_read_buffer_kb",
106                         .mode = S_IRUGO | S_IWUSR
107                 },
108         .show = &show_max_read_buffer_kb,
109         .store = &store_max_read_buffer_kb
110 };
111
112 static COMEDI_DECLARE_ATTR_SHOW(show_read_buffer_kb, dev, buf);
113 static COMEDI_DECLARE_ATTR_STORE(store_read_buffer_kb, dev, buf, count);
114 static comedi_device_attribute_t dev_attr_read_buffer_kb =
115 {
116         .attr = {
117                         .name = "read_buffer_kb",
118                         .mode = S_IRUGO | S_IWUSR | S_IWGRP
119                 },
120         .show = &show_read_buffer_kb,
121         .store = &store_read_buffer_kb
122 };
123
124 static COMEDI_DECLARE_ATTR_SHOW(show_max_write_buffer_kb, dev, buf);
125 static COMEDI_DECLARE_ATTR_STORE(store_max_write_buffer_kb, dev, buf, count);
126 static comedi_device_attribute_t dev_attr_max_write_buffer_kb =
127 {
128         .attr = {
129                         .name = "max_write_buffer_kb",
130                         .mode = S_IRUGO | S_IWUSR
131                 },
132         .show = &show_max_write_buffer_kb,
133         .store = &store_max_write_buffer_kb
134 };
135
136 static COMEDI_DECLARE_ATTR_SHOW(show_write_buffer_kb, dev, buf);
137 static COMEDI_DECLARE_ATTR_STORE(store_write_buffer_kb, dev, buf, count);
138 static comedi_device_attribute_t dev_attr_write_buffer_kb =
139 {
140         .attr = {
141                         .name = "write_buffer_kb",
142                         .mode = S_IRUGO | S_IWUSR | S_IWGRP
143                 },
144         .show = &show_write_buffer_kb,
145         .store = &store_write_buffer_kb
146 };
147
148 #ifdef HAVE_UNLOCKED_IOCTL
149 static long comedi_unlocked_ioctl(struct file *file, unsigned int cmd,
150         unsigned long arg)
151 #else
152 static int comedi_ioctl(struct inode *inode, struct file *file,
153         unsigned int cmd, unsigned long arg)
154 #endif
155 {
156         const unsigned minor = iminor(file->f_dentry->d_inode);
157         struct comedi_device_file_info *dev_file_info = comedi_get_device_file_info(minor);
158         comedi_device *dev;
159         int rc;
160
161         if (dev_file_info == NULL) return -ENODEV;
162         dev = dev_file_info->device;
163         if (dev == NULL) return -ENODEV;
164
165         mutex_lock(&dev->mutex);
166
167         /* Device config is special, because it must work on
168          * an unconfigured device. */
169         if (cmd == COMEDI_DEVCONFIG) {
170                 rc = do_devconfig_ioctl(dev, (void *)arg);
171                 goto done;
172         }
173
174         if (!dev->attached) {
175                 DPRINTK("no driver configured on /dev/comedi%i\n", dev->minor);
176                 rc = -ENODEV;
177                 goto done;
178         }
179
180         switch (cmd) {
181         case COMEDI_BUFCONFIG:
182                 rc = do_bufconfig_ioctl(dev, (void *)arg);
183                 break;
184         case COMEDI_DEVINFO:
185                 rc = do_devinfo_ioctl(dev, (void *)arg, file);
186                 break;
187         case COMEDI_SUBDINFO:
188                 rc = do_subdinfo_ioctl(dev, (void *)arg, file);
189                 break;
190         case COMEDI_CHANINFO:
191                 rc = do_chaninfo_ioctl(dev, (void *)arg);
192                 break;
193         case COMEDI_RANGEINFO:
194                 rc = do_rangeinfo_ioctl(dev, (void *)arg);
195                 break;
196         case COMEDI_BUFINFO:
197                 rc = do_bufinfo_ioctl(dev, (void *)arg, file);
198                 break;
199         case COMEDI_LOCK:
200                 rc = do_lock_ioctl(dev, arg, file);
201                 break;
202         case COMEDI_UNLOCK:
203                 rc = do_unlock_ioctl(dev, arg, file);
204                 break;
205         case COMEDI_CANCEL:
206                 rc = do_cancel_ioctl(dev, arg, file);
207                 break;
208         case COMEDI_CMD:
209                 rc = do_cmd_ioctl(dev, (void *)arg, file);
210                 break;
211         case COMEDI_CMDTEST:
212                 rc = do_cmdtest_ioctl(dev, (void *)arg, file);
213                 break;
214         case COMEDI_INSNLIST:
215                 rc = do_insnlist_ioctl(dev, (void *)arg, file);
216                 break;
217         case COMEDI_INSN:
218                 rc = do_insn_ioctl(dev, (void *)arg, file);
219                 break;
220         case COMEDI_POLL:
221                 rc = do_poll_ioctl(dev, arg, file);
222                 break;
223         default:
224                 rc = -ENOTTY;
225                 break;
226         }
227
228       done:
229         mutex_unlock(&dev->mutex);
230         return rc;
231 }
232
233 /*
234         COMEDI_DEVCONFIG
235         device config ioctl
236
237         arg:
238                 pointer to devconfig structure
239
240         reads:
241                 devconfig structure at arg
242
243         writes:
244                 none
245 */
246 static int do_devconfig_ioctl(comedi_device * dev, comedi_devconfig * arg)
247 {
248         comedi_devconfig it;
249         int ret;
250         unsigned char *aux_data = NULL;
251         int aux_len;
252
253         if (!capable(CAP_SYS_ADMIN))
254                 return -EPERM;
255
256         if (arg == NULL) {
257                 if (is_device_busy(dev))
258                         return -EBUSY;
259                 if(dev->attached)
260                 {
261                         struct module *driver_module = dev->driver->module;
262                         comedi_device_detach(dev);
263                         module_put(driver_module);
264                 }
265                 return 0;
266         }
267
268         if (copy_from_user(&it, arg, sizeof(comedi_devconfig)))
269                 return -EFAULT;
270
271         it.board_name[COMEDI_NAMELEN - 1] = 0;
272
273         if (comedi_aux_data(it.options, 0) &&
274                 it.options[COMEDI_DEVCONF_AUX_DATA_LENGTH]) {
275                 int bit_shift;
276                 aux_len = it.options[COMEDI_DEVCONF_AUX_DATA_LENGTH];
277                 if (aux_len < 0)
278                         return -EFAULT;
279
280                 aux_data = vmalloc(aux_len);
281                 if (!aux_data)
282                         return -ENOMEM;
283
284                 if (copy_from_user(aux_data,
285                                 comedi_aux_data(it.options, 0), aux_len)) {
286                         vfree(aux_data);
287                         return -EFAULT;
288                 }
289                 it.options[COMEDI_DEVCONF_AUX_DATA_LO] =
290                         (unsigned long)aux_data;
291                 if (sizeof(void *) > sizeof(int)) {
292                         bit_shift = sizeof(int) * 8;
293                         it.options[COMEDI_DEVCONF_AUX_DATA_HI] =
294                                 ((unsigned long)aux_data) >> bit_shift;
295                 } else
296                         it.options[COMEDI_DEVCONF_AUX_DATA_HI] = 0;
297         }
298
299         ret = comedi_device_attach(dev, &it);
300         if(ret == 0)
301         {
302                 if(!try_module_get(dev->driver->module)) {
303                         comedi_device_detach(dev);
304                         return -ENOSYS;
305                 }
306         }
307
308         if (aux_data)
309                 vfree(aux_data);
310
311         return ret;
312 }
313
314 /*
315         COMEDI_BUFCONFIG
316         buffer configuration ioctl
317
318         arg:
319                 pointer to bufconfig structure
320
321         reads:
322                 bufconfig at arg
323
324         writes:
325                 modified bufconfig at arg
326
327 */
328 static int do_bufconfig_ioctl(comedi_device * dev, void *arg)
329 {
330         comedi_bufconfig bc;
331         comedi_async *async;
332         comedi_subdevice *s;
333         int retval = 0;
334
335         if (copy_from_user(&bc, arg, sizeof(comedi_bufconfig)))
336                 return -EFAULT;
337
338         if (bc.subdevice >= dev->n_subdevices || bc.subdevice < 0)
339                 return -EINVAL;
340
341         s = dev->subdevices + bc.subdevice;
342         async = s->async;
343
344         if (!async) {
345                 DPRINTK("subdevice does not have async capability\n");
346                 bc.size = 0;
347                 bc.maximum_size = 0;
348                 goto copyback;
349         }
350
351         if (bc.maximum_size) {
352                 if (!capable(CAP_SYS_ADMIN))
353                         return -EPERM;
354
355                 async->max_bufsize = bc.maximum_size;
356         }
357
358         if (bc.size) {
359                 retval = resize_async_buffer(dev, s, async, bc.size);
360                 if(retval < 0) return retval;
361         }
362
363         bc.size = async->prealloc_bufsz;
364         bc.maximum_size = async->max_bufsize;
365
366       copyback:
367         if (copy_to_user(arg, &bc, sizeof(comedi_bufconfig)))
368                 return -EFAULT;
369
370         return 0;
371 }
372
373 /*
374         COMEDI_DEVINFO
375         device info ioctl
376
377         arg:
378                 pointer to devinfo structure
379
380         reads:
381                 none
382
383         writes:
384                 devinfo structure
385
386 */
387 static int do_devinfo_ioctl(comedi_device * dev, comedi_devinfo * arg,
388         struct file *file)
389 {
390         comedi_devinfo devinfo;
391         const unsigned minor = iminor(file->f_dentry->d_inode);
392         struct comedi_device_file_info *dev_file_info = comedi_get_device_file_info(minor);
393         comedi_subdevice *read_subdev = comedi_get_read_subdevice(dev_file_info);
394         comedi_subdevice *write_subdev = comedi_get_write_subdevice(dev_file_info);
395
396         memset(&devinfo, 0, sizeof(devinfo));
397
398         /* fill devinfo structure */
399         devinfo.version_code = COMEDI_VERSION_CODE;
400         devinfo.n_subdevs = dev->n_subdevices;
401         strlcpy(devinfo.driver_name, dev->driver->driver_name, COMEDI_NAMELEN);
402         strlcpy(devinfo.board_name, dev->board_name, COMEDI_NAMELEN);
403
404         if (read_subdev) {
405                 devinfo.read_subdevice = read_subdev - dev->subdevices;
406         } else {
407                 devinfo.read_subdevice = -1;
408         }
409         if (write_subdev) {
410                 devinfo.write_subdevice = write_subdev - dev->subdevices;
411         } else {
412                 devinfo.write_subdevice = -1;
413         }
414
415         if (copy_to_user(arg, &devinfo, sizeof(comedi_devinfo)))
416                 return -EFAULT;
417
418         return 0;
419 }
420
421 /*
422         COMEDI_SUBDINFO
423         subdevice info ioctl
424
425         arg:
426                 pointer to array of subdevice info structures
427
428         reads:
429                 none
430
431         writes:
432                 array of subdevice info structures at arg
433
434 */
435 static int do_subdinfo_ioctl(comedi_device * dev, comedi_subdinfo * arg,
436         void *file)
437 {
438         int ret, i;
439         comedi_subdinfo *tmp, *us;
440         comedi_subdevice *s;
441
442         tmp = kcalloc(dev->n_subdevices, sizeof(comedi_subdinfo), GFP_KERNEL);
443         if (!tmp)
444                 return -ENOMEM;
445
446         /* fill subdinfo structs */
447         for (i = 0; i < dev->n_subdevices; i++) {
448                 s = dev->subdevices + i;
449                 us = tmp + i;
450
451                 us->type = s->type;
452                 us->n_chan = s->n_chan;
453                 us->subd_flags = s->subdev_flags;
454                 if (comedi_get_subdevice_runflags(s) & SRF_RUNNING)
455                         us->subd_flags |= SDF_RUNNING;
456 #define TIMER_nanosec 5         /* backwards compatibility */
457                 us->timer_type = TIMER_nanosec;
458                 us->len_chanlist = s->len_chanlist;
459                 us->maxdata = s->maxdata;
460                 if (s->range_table) {
461                         us->range_type =
462                                 (i << 24) | (0 << 16) | (s->
463                                 range_table->length);
464                 } else {
465                         us->range_type = 0;     /* XXX */
466                 }
467                 us->flags = s->flags;
468
469                 if (s->busy)
470                         us->subd_flags |= SDF_BUSY;
471                 if (s->busy == file)
472                         us->subd_flags |= SDF_BUSY_OWNER;
473                 if (s->lock)
474                         us->subd_flags |= SDF_LOCKED;
475                 if (s->lock == file)
476                         us->subd_flags |= SDF_LOCK_OWNER;
477                 if (!s->maxdata && s->maxdata_list)
478                         us->subd_flags |= SDF_MAXDATA;
479                 if (s->flaglist)
480                         us->subd_flags |= SDF_FLAGS;
481                 if (s->range_table_list)
482                         us->subd_flags |= SDF_RANGETYPE;
483                 if (s->do_cmd)
484                         us->subd_flags |= SDF_CMD;
485
486                 if (s->insn_bits != &insn_inval)
487                         us->insn_bits_support = COMEDI_SUPPORTED;
488                 else
489                         us->insn_bits_support = COMEDI_UNSUPPORTED;
490
491                 us->settling_time_0 = s->settling_time_0;
492         }
493
494         ret = copy_to_user(arg, tmp,
495                 dev->n_subdevices * sizeof(comedi_subdinfo));
496
497         kfree(tmp);
498
499         return ret ? -EFAULT : 0;
500 }
501
502 /*
503         COMEDI_CHANINFO
504         subdevice info ioctl
505
506         arg:
507                 pointer to chaninfo structure
508
509         reads:
510                 chaninfo structure at arg
511
512         writes:
513                 arrays at elements of chaninfo structure
514
515 */
516 static int do_chaninfo_ioctl(comedi_device * dev, comedi_chaninfo * arg)
517 {
518         comedi_subdevice *s;
519         comedi_chaninfo it;
520
521         if (copy_from_user(&it, arg, sizeof(comedi_chaninfo)))
522                 return -EFAULT;
523
524         if (it.subdev >= dev->n_subdevices)
525                 return -EINVAL;
526         s = dev->subdevices + it.subdev;
527
528         if (it.maxdata_list) {
529                 if (s->maxdata || !s->maxdata_list)
530                         return -EINVAL;
531                 if (copy_to_user(it.maxdata_list, s->maxdata_list,
532                                 s->n_chan * sizeof(lsampl_t)))
533                         return -EFAULT;
534         }
535
536         if (it.flaglist) {
537                 if (!s->flaglist)
538                         return -EINVAL;
539                 if (copy_to_user(it.flaglist, s->flaglist,
540                                 s->n_chan * sizeof(unsigned int)))
541                         return -EFAULT;
542         }
543
544         if (it.rangelist) {
545                 int i;
546
547                 if (!s->range_table_list)
548                         return -EINVAL;
549                 for (i = 0; i < s->n_chan; i++) {
550                         int x;
551
552                         x = (dev->minor << 28) | (it.subdev << 24) | (i << 16) |
553                                 (s->range_table_list[i]->length);
554                         put_user(x, it.rangelist + i);
555                 }
556                 //if(copy_to_user(it.rangelist,s->range_type_list,s->n_chan*sizeof(unsigned int)))
557                 //      return -EFAULT;
558         }
559
560         return 0;
561 }
562
563  /*
564     COMEDI_BUFINFO
565     buffer information ioctl
566
567     arg:
568     pointer to bufinfo structure
569
570     reads:
571     bufinfo at arg
572
573     writes:
574     modified bufinfo at arg
575
576   */
577 static int do_bufinfo_ioctl(comedi_device * dev, void *arg, void *file)
578 {
579         comedi_bufinfo bi;
580         comedi_subdevice *s;
581         comedi_async *async;
582         int retval = 0;
583
584         if (copy_from_user(&bi, arg, sizeof(comedi_bufinfo)))
585                 return -EFAULT;
586
587         if (bi.subdevice >= dev->n_subdevices || bi.subdevice < 0)
588                 return -EINVAL;
589
590         s = dev->subdevices + bi.subdevice;
591
592         if (s->lock && s->lock != file)
593                 return -EACCES;
594
595         async = s->async;
596         if (!async) {
597                 DPRINTK("subdevice does not have async capability\n");
598                 bi.buf_write_ptr = 0;
599                 bi.buf_read_ptr = 0;
600                 bi.buf_write_count = 0;
601                 bi.buf_read_count = 0;
602                 bi.bytes_read = 0;
603                 bi.bytes_written = 0;
604                 goto copyback;
605         }
606         if (!s->busy) {
607                 bi.bytes_read = 0;
608                 bi.bytes_written = 0;
609                 goto copyback_position;
610         }
611         if (s->busy != file)
612                 return -EACCES;
613
614         if ((s->subdev_flags & SDF_CMD_READ) != 0) {
615                 if (bi.bytes_read) {
616                         bi.bytes_read = comedi_buf_read_alloc(async,
617                                         bi.bytes_read);
618                         comedi_buf_read_free(async, bi.bytes_read);
619                 }
620                 if (async->buf_write_count == async->buf_read_count) {
621                         if (!(comedi_get_subdevice_runflags(s) & (SRF_RUNNING
622                                                         | SRF_ERROR))) {
623                                 do_become_nonbusy(dev, s);
624                         }
625                         if (bi.bytes_read == 0) {
626                                 if ((comedi_get_subdevice_runflags(s)
627                                                 & (SRF_RUNNING | SRF_ERROR))
628                                                 == SRF_ERROR) {
629                                         retval = -EPIPE;
630                                 }
631                         }
632                 }
633         }
634
635         if ((s->subdev_flags & SDF_CMD_WRITE) != 0) {
636                 if (bi.bytes_written) {
637                         bi.bytes_written = comedi_buf_write_alloc(async,
638                                         bi.bytes_written);
639                         comedi_buf_write_free(async, bi.bytes_written);
640                 }
641                 if (bi.bytes_written == 0) {
642                         if (!(comedi_get_subdevice_runflags(s) & SRF_RUNNING)) {
643                                 if ((comedi_get_subdevice_runflags(s)
644                                                 & SRF_ERROR) != 0) {
645                                         retval = -EPIPE;
646                                 }
647                         }
648                 }
649         }
650
651         if (retval)
652                 return retval;
653
654       copyback_position:
655         bi.buf_write_count = async->buf_write_count;
656         bi.buf_write_ptr = async->buf_write_ptr;
657         bi.buf_read_count = async->buf_read_count;
658         bi.buf_read_ptr = async->buf_read_ptr;
659
660       copyback:
661         if (copy_to_user(arg, &bi, sizeof(comedi_bufinfo)))
662                 return -EFAULT;
663
664         return 0;
665 }
666
667 static int parse_insn(comedi_device * dev, comedi_insn * insn, lsampl_t * data,
668         void *file);
669 /*
670  *      COMEDI_INSNLIST
671  *      synchronous instructions
672  *
673  *      arg:
674  *              pointer to sync cmd structure
675  *
676  *      reads:
677  *              sync cmd struct at arg
678  *              instruction list
679  *              data (for writes)
680  *
681  *      writes:
682  *              data (for reads)
683  */
684 static int do_insnlist_ioctl(comedi_device * dev, void *arg, void *file)
685 {
686         comedi_insnlist insnlist;
687         comedi_insn *insns = NULL;
688         lsampl_t *data = NULL;
689         unsigned int max_samples;
690         int i;
691         int ret = 0;
692
693         if (copy_from_user(&insnlist, arg, sizeof(comedi_insnlist)))
694                 return -EFAULT;
695
696         if (insnlist.n_insns <= ULONG_MAX / sizeof(comedi_insn))
697                 insns = kmalloc(sizeof(comedi_insn) * insnlist.n_insns,
698                                 GFP_KERNEL);
699         if (!insns) {
700                 DPRINTK("kmalloc failed\n");
701                 ret = -ENOMEM;
702                 goto error;
703         }
704
705         if (copy_from_user(insns, insnlist.insns,
706                         sizeof(comedi_insn) * insnlist.n_insns)) {
707                 DPRINTK("copy_from_user failed\n");
708                 ret = -EFAULT;
709                 goto error;
710         }
711
712         max_samples = 0;
713         for (i = 0; i < insnlist.n_insns; i++) {
714                 if (max_samples < insns[i].n)
715                         max_samples = insns[i].n;
716         }
717
718         if (max_samples) {
719                 if (max_samples <= ULONG_MAX / sizeof(lsampl_t))
720                         data = kmalloc(sizeof(lsampl_t) * max_samples,
721                                         GFP_KERNEL);
722                 if (!data) {
723                         DPRINTK("kmalloc failed\n");
724                         ret = -ENOMEM;
725                         goto error;
726                 }
727         }
728
729         for (i = 0; i < insnlist.n_insns; i++) {
730                 if (insns[i].insn & INSN_MASK_WRITE) {
731                         if (copy_from_user(data, insns[i].data,
732                                         insns[i].n * sizeof(lsampl_t))) {
733                                 DPRINTK("copy_from_user failed\n");
734                                 ret = -EFAULT;
735                                 goto error;
736                         }
737                 }
738                 ret = parse_insn(dev, insns + i, data, file);
739                 if (ret < 0)
740                         goto error;
741                 if (insns[i].insn & INSN_MASK_READ) {
742                         if (copy_to_user(insns[i].data, data,
743                                         insns[i].n * sizeof(lsampl_t))) {
744                                 DPRINTK("copy_to_user failed\n");
745                                 ret = -EFAULT;
746                                 goto error;
747                         }
748                 }
749                 if (need_resched())
750                         schedule();
751         }
752
753       error:
754         if (insns)
755                 kfree(insns);
756         if (data)
757                 kfree(data);
758
759         if (ret < 0)
760                 return ret;
761         return i;
762 }
763
764 static int check_insn_config_length(comedi_insn * insn, lsampl_t * data)
765 {
766         if(insn->n < 1) return -EINVAL;
767
768         switch (data[0]) {
769         case INSN_CONFIG_DIO_OUTPUT:
770         case INSN_CONFIG_DIO_INPUT:
771         case INSN_CONFIG_DISARM:
772         case INSN_CONFIG_RESET:
773                 if (insn->n == 1)
774                         return 0;
775                 break;
776         case INSN_CONFIG_ARM:
777         case INSN_CONFIG_DIO_QUERY:
778         case INSN_CONFIG_BLOCK_SIZE:
779         case INSN_CONFIG_FILTER:
780         case INSN_CONFIG_SERIAL_CLOCK:
781         case INSN_CONFIG_BIDIRECTIONAL_DATA:
782         case INSN_CONFIG_ALT_SOURCE:
783         case INSN_CONFIG_SET_COUNTER_MODE:
784         case INSN_CONFIG_8254_READ_STATUS:
785         case INSN_CONFIG_SET_ROUTING:
786         case INSN_CONFIG_GET_ROUTING:
787         case INSN_CONFIG_GET_PWM_STATUS:
788         case INSN_CONFIG_PWM_SET_PERIOD:
789         case INSN_CONFIG_PWM_GET_PERIOD:
790                 if (insn->n == 2)
791                         return 0;
792                 break;
793         case INSN_CONFIG_SET_GATE_SRC:
794         case INSN_CONFIG_GET_GATE_SRC:
795         case INSN_CONFIG_SET_CLOCK_SRC:
796         case INSN_CONFIG_GET_CLOCK_SRC:
797         case INSN_CONFIG_SET_OTHER_SRC:
798         case INSN_CONFIG_GET_COUNTER_STATUS:
799         case INSN_CONFIG_PWM_SET_H_BRIDGE:
800         case INSN_CONFIG_PWM_GET_H_BRIDGE:
801         case INSN_CONFIG_GET_HARDWARE_BUFFER_SIZE:
802                 if (insn->n == 3)
803                         return 0;
804                 break;
805         case INSN_CONFIG_PWM_OUTPUT:
806         case INSN_CONFIG_ANALOG_TRIG:
807                 if (insn->n == 5)
808                         return 0;
809                 break;
810                 //by default we allow the insn since we don't have checks for all possible cases yet
811         default:
812                 rt_printk
813                         ("comedi: no check for data length of config insn id %i is implemented.\n"
814                         " Add a check to %s in %s.\n"
815                         " Assuming n=%i is correct.\n", data[0], __FUNCTION__,
816                         __FILE__, insn->n);
817                 return 0;
818                 break;
819         }
820         return -EINVAL;
821 }
822
823 static int parse_insn(comedi_device * dev, comedi_insn * insn, lsampl_t * data,
824         void *file)
825 {
826         comedi_subdevice *s;
827         int ret = 0;
828         int i;
829
830         if (insn->insn & INSN_MASK_SPECIAL) {
831                 /* a non-subdevice instruction */
832
833                 switch (insn->insn) {
834                 case INSN_GTOD:
835                         {
836                                 struct timeval tv;
837
838                                 if (insn->n != 2) {
839                                         ret = -EINVAL;
840                                         break;
841                                 }
842
843                                 do_gettimeofday(&tv);
844                                 data[0] = tv.tv_sec;
845                                 data[1] = tv.tv_usec;
846                                 ret = 2;
847
848                                 break;
849                         }
850                 case INSN_WAIT:
851                         if (insn->n != 1 || data[0] >= 100000) {
852                                 ret = -EINVAL;
853                                 break;
854                         }
855                         udelay(data[0] / 1000);
856                         ret = 1;
857                         break;
858                 case INSN_INTTRIG:
859                         if (insn->n != 1) {
860                                 ret = -EINVAL;
861                                 break;
862                         }
863                         if (insn->subdev >= dev->n_subdevices) {
864                                 DPRINTK("%d not usable subdevice\n",
865                                         insn->subdev);
866                                 ret = -EINVAL;
867                                 break;
868                         }
869                         s = dev->subdevices + insn->subdev;
870                         if (!s->async) {
871                                 DPRINTK("no async\n");
872                                 ret = -EINVAL;
873                                 break;
874                         }
875                         if (!s->async->inttrig) {
876                                 DPRINTK("no inttrig\n");
877                                 ret = -EAGAIN;
878                                 break;
879                         }
880                         ret = s->async->inttrig(dev, s, insn->data[0]);
881                         if (ret >= 0)
882                                 ret = 1;
883                         break;
884                 default:
885                         DPRINTK("invalid insn\n");
886                         ret = -EINVAL;
887                         break;
888                 }
889         } else {
890                 /* a subdevice instruction */
891                 lsampl_t maxdata;
892
893                 if (insn->subdev >= dev->n_subdevices) {
894                         DPRINTK("subdevice %d out of range\n", insn->subdev);
895                         ret = -EINVAL;
896                         goto out;
897                 }
898                 s = dev->subdevices + insn->subdev;
899
900                 if (s->type == COMEDI_SUBD_UNUSED) {
901                         DPRINTK("%d not usable subdevice\n", insn->subdev);
902                         ret = -EIO;
903                         goto out;
904                 }
905
906                 /* are we locked? (ioctl lock) */
907                 if (s->lock && s->lock != file) {
908                         DPRINTK("device locked\n");
909                         ret = -EACCES;
910                         goto out;
911                 }
912
913                 if ((ret = check_chanlist(s, 1, &insn->chanspec)) < 0) {
914                         ret = -EINVAL;
915                         DPRINTK("bad chanspec\n");
916                         goto out;
917                 }
918
919                 if (s->busy) {
920                         ret = -EBUSY;
921                         goto out;
922                 }
923                 /* This looks arbitrary.  It is. */
924                 s->busy = &parse_insn;
925                 switch (insn->insn) {
926                 case INSN_READ:
927                         ret = s->insn_read(dev, s, insn, data);
928                         break;
929                 case INSN_WRITE:
930                         maxdata = s->maxdata_list
931                                 ? s->maxdata_list[CR_CHAN(insn->chanspec)]
932                                 : s->maxdata;
933                         for (i = 0; i < insn->n; ++i) {
934                                 if (data[i] > maxdata) {
935                                         ret = -EINVAL;
936                                         DPRINTK("bad data value(s)\n");
937                                         break;
938                                 }
939                         }
940                         if (ret == 0)
941                                 ret = s->insn_write(dev, s, insn, data);
942                         break;
943                 case INSN_BITS:
944                         if (insn->n != 2) {
945                                 ret = -EINVAL;
946                         } else {
947                                 /* Most drivers ignore the base channel in
948                                  * insn->chanspec.  Deal with it here if
949                                  * the subdevice has <= 32 channels. */
950                                 unsigned int shift;
951                                 lsampl_t orig_mask;
952
953                                 orig_mask = data[0];
954                                 if (s->n_chan <= 32) {
955                                         shift = CR_CHAN(insn->chanspec);
956                                         if (shift > 0) {
957                                                 insn->chanspec = 0;
958                                                 data[0] <<= shift;
959                                                 data[1] <<= shift;
960                                         }
961                                 } else {
962                                         shift = 0;
963                                 }
964                                 ret = s->insn_bits(dev, s, insn, data);
965                                 data[0] = orig_mask;
966                                 if (shift > 0)
967                                         data[1] >>= shift;
968                         }
969                         break;
970                 case INSN_CONFIG:
971                         ret = check_insn_config_length(insn, data);
972                         if (ret)
973                                 break;
974                         ret = s->insn_config(dev, s, insn, data);
975                         break;
976                 default:
977                         ret = -EINVAL;
978                         break;
979                 }
980
981                 s->busy = NULL;
982         }
983
984       out:
985         return ret;
986 }
987
988 /*
989  *      COMEDI_INSN
990  *      synchronous instructions
991  *
992  *      arg:
993  *              pointer to insn
994  *
995  *      reads:
996  *              comedi_insn struct at arg
997  *              data (for writes)
998  *
999  *      writes:
1000  *              data (for reads)
1001  */
1002 static int do_insn_ioctl(comedi_device * dev, void *arg, void *file)
1003 {
1004         comedi_insn insn;
1005         lsampl_t *data = NULL;
1006         int ret = 0;
1007
1008         if (copy_from_user(&insn, arg, sizeof(comedi_insn))) {
1009                 ret = -EFAULT;
1010                 goto error;
1011         }
1012
1013         if (insn.n) {
1014                 if (insn.n <= ULONG_MAX / sizeof(lsampl_t))
1015                         data = kmalloc(sizeof(lsampl_t) * insn.n, GFP_KERNEL);
1016                 if (!data) {
1017                         ret = -ENOMEM;
1018                         goto error;
1019                 }
1020         }
1021
1022         if (insn.insn & INSN_MASK_WRITE) {
1023                 if (copy_from_user(data, insn.data, insn.n * sizeof(lsampl_t))) {
1024                         ret = -EFAULT;
1025                         goto error;
1026                 }
1027         }
1028         ret = parse_insn(dev, &insn, data, file);
1029         if (ret < 0)
1030                 goto error;
1031         if (insn.insn & INSN_MASK_READ) {
1032                 if (copy_to_user(insn.data, data, insn.n * sizeof(lsampl_t))) {
1033                         ret = -EFAULT;
1034                         goto error;
1035                 }
1036         }
1037         ret = insn.n;
1038
1039       error:
1040         if (data)
1041                 kfree(data);
1042
1043         return ret;
1044 }
1045
1046 /*
1047         COMEDI_CMD
1048         command ioctl
1049
1050         arg:
1051                 pointer to cmd structure
1052
1053         reads:
1054                 cmd structure at arg
1055                 channel/range list
1056
1057         writes:
1058                 modified cmd structure at arg
1059
1060 */
1061 static int do_cmd_ioctl(comedi_device * dev, void *arg, void *file)
1062 {
1063         comedi_cmd user_cmd;
1064         comedi_subdevice *s;
1065         comedi_async *async;
1066         int ret = 0;
1067         unsigned int *chanlist_saver = NULL;
1068
1069         if (copy_from_user(&user_cmd, arg, sizeof(comedi_cmd))) {
1070                 DPRINTK("bad cmd address\n");
1071                 return -EFAULT;
1072         }
1073         // save user's chanlist pointer so it can be restored later
1074         chanlist_saver = user_cmd.chanlist;
1075
1076         if (user_cmd.subdev >= dev->n_subdevices) {
1077                 DPRINTK("%d no such subdevice\n", user_cmd.subdev);
1078                 return -ENODEV;
1079         }
1080
1081         s = dev->subdevices + user_cmd.subdev;
1082         async = s->async;
1083
1084         if (s->type == COMEDI_SUBD_UNUSED) {
1085                 DPRINTK("%d not valid subdevice\n", user_cmd.subdev);
1086                 return -EIO;
1087         }
1088
1089         if (!s->do_cmd || !s->do_cmdtest || !s->async) {
1090                 DPRINTK("subdevice %i does not support commands\n",
1091                         user_cmd.subdev);
1092                 return -EIO;
1093         }
1094
1095         /* are we locked? (ioctl lock) */
1096         if (s->lock && s->lock != file) {
1097                 DPRINTK("subdevice locked\n");
1098                 return -EACCES;
1099         }
1100
1101         /* are we busy? */
1102         if (s->busy) {
1103                 DPRINTK("subdevice busy\n");
1104                 return -EBUSY;
1105         }
1106         s->busy = file;
1107
1108         /* make sure channel/gain list isn't too long */
1109         if (user_cmd.chanlist_len > s->len_chanlist) {
1110                 DPRINTK("channel/gain list too long %u > %d\n",
1111                         user_cmd.chanlist_len, s->len_chanlist);
1112                 ret = -EINVAL;
1113                 goto cleanup;
1114         }
1115
1116         /* make sure channel/gain list isn't too short */
1117         if (user_cmd.chanlist_len < 1) {
1118                 DPRINTK("channel/gain list too short %u < 1\n",
1119                         user_cmd.chanlist_len);
1120                 ret = -EINVAL;
1121                 goto cleanup;
1122         }
1123
1124         if (async->cmd.chanlist)
1125                 kfree(async->cmd.chanlist);
1126         async->cmd = user_cmd;
1127         async->cmd.data = NULL;
1128         /* load channel/gain list */
1129         async->cmd.chanlist =
1130                 kmalloc(async->cmd.chanlist_len * sizeof(int), GFP_KERNEL);
1131         if (!async->cmd.chanlist) {
1132                 DPRINTK("allocation failed\n");
1133                 ret = -ENOMEM;
1134                 goto cleanup;
1135         }
1136
1137         if (copy_from_user(async->cmd.chanlist, user_cmd.chanlist,
1138                         async->cmd.chanlist_len * sizeof(int))) {
1139                 DPRINTK("fault reading chanlist\n");
1140                 ret = -EFAULT;
1141                 goto cleanup;
1142         }
1143
1144         /* make sure each element in channel/gain list is valid */
1145         if ((ret = check_chanlist(s, async->cmd.chanlist_len,
1146                                 async->cmd.chanlist)) < 0) {
1147                 DPRINTK("bad chanlist\n");
1148                 goto cleanup;
1149         }
1150
1151         ret = s->do_cmdtest(dev, s, &async->cmd);
1152
1153         if (async->cmd.flags & TRIG_BOGUS || ret) {
1154                 DPRINTK("test returned %d\n", ret);
1155                 user_cmd = async->cmd;
1156                 // restore chanlist pointer before copying back
1157                 user_cmd.chanlist = chanlist_saver;
1158                 user_cmd.data = NULL;
1159                 if (copy_to_user(arg, &user_cmd, sizeof(comedi_cmd))) {
1160                         DPRINTK("fault writing cmd\n");
1161                         ret = -EFAULT;
1162                         goto cleanup;
1163                 }
1164                 ret = -EAGAIN;
1165                 goto cleanup;
1166         }
1167
1168         if (!async->prealloc_bufsz) {
1169                 ret = -ENOMEM;
1170                 DPRINTK("no buffer (?)\n");
1171                 goto cleanup;
1172         }
1173
1174         comedi_reset_async_buf(async);
1175
1176         async->cb_mask =
1177                 COMEDI_CB_EOA | COMEDI_CB_BLOCK | COMEDI_CB_ERROR |
1178                 COMEDI_CB_OVERFLOW;
1179         if (async->cmd.flags & TRIG_WAKE_EOS) {
1180                 async->cb_mask |= COMEDI_CB_EOS;
1181         }
1182
1183         comedi_set_subdevice_runflags(s, ~0, SRF_USER | SRF_RUNNING);
1184
1185 #ifdef CONFIG_COMEDI_RT
1186         if (async->cmd.flags & TRIG_RT) {
1187                 if (comedi_switch_to_rt(dev) == 0)
1188                         comedi_set_subdevice_runflags(s, SRF_RT, SRF_RT);
1189         }
1190 #endif
1191
1192         ret = s->do_cmd(dev, s);
1193         if (ret == 0)
1194                 return 0;
1195
1196       cleanup:
1197         do_become_nonbusy(dev, s);
1198
1199         return ret;
1200 }
1201
1202 /*
1203         COMEDI_CMDTEST
1204         command testing ioctl
1205
1206         arg:
1207                 pointer to cmd structure
1208
1209         reads:
1210                 cmd structure at arg
1211                 channel/range list
1212
1213         writes:
1214                 modified cmd structure at arg
1215
1216 */
1217 static int do_cmdtest_ioctl(comedi_device * dev, void *arg, void *file)
1218 {
1219         comedi_cmd user_cmd;
1220         comedi_subdevice *s;
1221         int ret = 0;
1222         unsigned int *chanlist = NULL;
1223         unsigned int *chanlist_saver = NULL;
1224
1225         if (copy_from_user(&user_cmd, arg, sizeof(comedi_cmd))) {
1226                 DPRINTK("bad cmd address\n");
1227                 return -EFAULT;
1228         }
1229         // save user's chanlist pointer so it can be restored later
1230         chanlist_saver = user_cmd.chanlist;
1231
1232         if (user_cmd.subdev >= dev->n_subdevices) {
1233                 DPRINTK("%d no such subdevice\n", user_cmd.subdev);
1234                 return -ENODEV;
1235         }
1236
1237         s = dev->subdevices + user_cmd.subdev;
1238         if (s->type == COMEDI_SUBD_UNUSED) {
1239                 DPRINTK("%d not valid subdevice\n", user_cmd.subdev);
1240                 return -EIO;
1241         }
1242
1243         if (!s->do_cmd || !s->do_cmdtest) {
1244                 DPRINTK("subdevice %i does not support commands\n",
1245                         user_cmd.subdev);
1246                 return -EIO;
1247         }
1248
1249         /* make sure channel/gain list isn't too long */
1250         if (user_cmd.chanlist_len > s->len_chanlist) {
1251                 DPRINTK("channel/gain list too long %d > %d\n",
1252                         user_cmd.chanlist_len, s->len_chanlist);
1253                 ret = -EINVAL;
1254                 goto cleanup;
1255         }
1256
1257         /* load channel/gain list */
1258         if (user_cmd.chanlist) {
1259                 chanlist =
1260                         kmalloc(user_cmd.chanlist_len * sizeof(int),
1261                         GFP_KERNEL);
1262                 if (!chanlist) {
1263                         DPRINTK("allocation failed\n");
1264                         ret = -ENOMEM;
1265                         goto cleanup;
1266                 }
1267
1268                 if (copy_from_user(chanlist, user_cmd.chanlist,
1269                                 user_cmd.chanlist_len * sizeof(int))) {
1270                         DPRINTK("fault reading chanlist\n");
1271                         ret = -EFAULT;
1272                         goto cleanup;
1273                 }
1274
1275                 /* make sure each element in channel/gain list is valid */
1276                 if ((ret = check_chanlist(s, user_cmd.chanlist_len,
1277                                         chanlist)) < 0) {
1278                         DPRINTK("bad chanlist\n");
1279                         goto cleanup;
1280                 }
1281
1282                 user_cmd.chanlist = chanlist;
1283         }
1284
1285         ret = s->do_cmdtest(dev, s, &user_cmd);
1286
1287         // restore chanlist pointer before copying back
1288         user_cmd.chanlist = chanlist_saver;
1289
1290         if (copy_to_user(arg, &user_cmd, sizeof(comedi_cmd))) {
1291                 DPRINTK("bad cmd address\n");
1292                 ret = -EFAULT;
1293                 goto cleanup;
1294         }
1295       cleanup:
1296         if (chanlist)
1297                 kfree(chanlist);
1298
1299         return ret;
1300 }
1301
1302 /*
1303         COMEDI_LOCK
1304         lock subdevice
1305
1306         arg:
1307                 subdevice number
1308
1309         reads:
1310                 none
1311
1312         writes:
1313                 none
1314
1315 */
1316
1317 static int do_lock_ioctl(comedi_device * dev, unsigned int arg, void *file)
1318 {
1319         int ret = 0;
1320         unsigned long flags;
1321         comedi_subdevice *s;
1322
1323         if (arg >= dev->n_subdevices)
1324                 return -EINVAL;
1325         s = dev->subdevices + arg;
1326
1327         comedi_spin_lock_irqsave(&s->spin_lock, flags);
1328         if (s->busy || s->lock) {
1329                 ret = -EBUSY;
1330         } else {
1331                 s->lock = file;
1332         }
1333         comedi_spin_unlock_irqrestore(&s->spin_lock, flags);
1334
1335         if (ret < 0)
1336                 return ret;
1337
1338 #if 0
1339         if (s->lock_f)
1340                 ret = s->lock_f(dev, s);
1341 #endif
1342
1343         return ret;
1344 }
1345
1346 /*
1347         COMEDI_UNLOCK
1348         unlock subdevice
1349
1350         arg:
1351                 subdevice number
1352
1353         reads:
1354                 none
1355
1356         writes:
1357                 none
1358
1359         This function isn't protected by the semaphore, since
1360         we already own the lock.
1361 */
1362 static int do_unlock_ioctl(comedi_device * dev, unsigned int arg, void *file)
1363 {
1364         comedi_subdevice *s;
1365
1366         if (arg >= dev->n_subdevices)
1367                 return -EINVAL;
1368         s = dev->subdevices + arg;
1369
1370         if (s->busy)
1371                 return -EBUSY;
1372
1373         if (s->lock && s->lock != file)
1374                 return -EACCES;
1375
1376         if (s->lock == file) {
1377 #if 0
1378                 if (s->unlock)
1379                         s->unlock(dev, s);
1380 #endif
1381
1382                 s->lock = NULL;
1383         }
1384
1385         return 0;
1386 }
1387
1388 /*
1389         COMEDI_CANCEL
1390         cancel acquisition ioctl
1391
1392         arg:
1393                 subdevice number
1394
1395         reads:
1396                 nothing
1397
1398         writes:
1399                 nothing
1400
1401 */
1402 static int do_cancel_ioctl(comedi_device * dev, unsigned int arg, void *file)
1403 {
1404         comedi_subdevice *s;
1405
1406         if (arg >= dev->n_subdevices)
1407                 return -EINVAL;
1408         s = dev->subdevices + arg;
1409         if (s->async == NULL)
1410                 return -EINVAL;
1411
1412         if (s->lock && s->lock != file)
1413                 return -EACCES;
1414
1415         if (!s->busy)
1416                 return 0;
1417
1418         if (s->busy != file)
1419                 return -EBUSY;
1420
1421         return do_cancel(dev, s);
1422 }
1423
1424 /*
1425         COMEDI_POLL ioctl
1426         instructs driver to synchronize buffers
1427
1428         arg:
1429                 subdevice number
1430
1431         reads:
1432                 nothing
1433
1434         writes:
1435                 nothing
1436
1437 */
1438 static int do_poll_ioctl(comedi_device * dev, unsigned int arg, void *file)
1439 {
1440         comedi_subdevice *s;
1441
1442         if (arg >= dev->n_subdevices)
1443                 return -EINVAL;
1444         s = dev->subdevices + arg;
1445
1446         if (s->lock && s->lock != file)
1447                 return -EACCES;
1448
1449         if (!s->busy)
1450                 return 0;
1451
1452         if (s->busy != file)
1453                 return -EBUSY;
1454
1455         if (s->poll)
1456                 return s->poll(dev, s);
1457
1458         return -EINVAL;
1459 }
1460
1461 static int do_cancel(comedi_device * dev, comedi_subdevice * s)
1462 {
1463         int ret = 0;
1464
1465         if ((comedi_get_subdevice_runflags(s) & SRF_RUNNING) && s->cancel)
1466                 ret = s->cancel(dev, s);
1467
1468         do_become_nonbusy(dev, s);
1469
1470         return ret;
1471 }
1472
1473 void comedi_vm_open(struct vm_area_struct *area)
1474 {
1475         comedi_async *async;
1476         comedi_device *dev;
1477
1478         async = area->vm_private_data;
1479         dev = async->subdevice->device;
1480
1481         mutex_lock(&dev->mutex);
1482         async->mmap_count++;
1483         mutex_unlock(&dev->mutex);
1484 }
1485
1486 void comedi_vm_close(struct vm_area_struct *area)
1487 {
1488         comedi_async *async;
1489         comedi_device *dev;
1490
1491         async = area->vm_private_data;
1492         dev = async->subdevice->device;
1493
1494         mutex_lock(&dev->mutex);
1495         async->mmap_count--;
1496         mutex_unlock(&dev->mutex);
1497 }
1498
1499 static struct vm_operations_struct comedi_vm_ops = {
1500         .open = comedi_vm_open,
1501         .close = comedi_vm_close,
1502 };
1503
1504 static int comedi_mmap(struct file *file, struct vm_area_struct *vma)
1505 {
1506         const unsigned minor = iminor(file->f_dentry->d_inode);
1507         comedi_async *async = NULL;
1508         unsigned long start = vma->vm_start;
1509         unsigned long size;
1510         int n_pages;
1511         int i;
1512         int retval;
1513         comedi_subdevice *s;
1514         struct comedi_device_file_info *dev_file_info = comedi_get_device_file_info(minor);
1515         comedi_device *dev;
1516         if (dev_file_info==NULL) return -ENODEV;
1517         dev = dev_file_info->device;
1518         if (dev==NULL) return -ENODEV;
1519
1520         mutex_lock(&dev->mutex);
1521         if (!dev->attached) {
1522                 DPRINTK("no driver configured on comedi%i\n", dev->minor);
1523                 retval = -ENODEV;
1524                 goto done;
1525         }
1526         if (vma->vm_flags & VM_WRITE) {
1527                 s = comedi_get_write_subdevice(dev_file_info);
1528         } else {
1529                 s = comedi_get_read_subdevice(dev_file_info);
1530         }
1531         if (s == NULL) {
1532                 retval = -EINVAL;
1533                 goto done;
1534         }
1535         async = s->async;
1536         if (async == NULL) {
1537                 retval = -EINVAL;
1538                 goto done;
1539         }
1540
1541         if (vma->vm_pgoff != 0) {
1542                 DPRINTK("comedi: mmap() offset must be 0.\n");
1543                 retval = -EINVAL;
1544                 goto done;
1545         }
1546
1547         size = vma->vm_end - vma->vm_start;
1548         if (size > async->prealloc_bufsz) {
1549                 retval = -EFAULT;
1550                 goto done;
1551         }
1552         if (size & (~PAGE_MASK)) {
1553                 retval = -EFAULT;
1554                 goto done;
1555         }
1556
1557         n_pages = size >> PAGE_SHIFT;
1558         for (i = 0; i < n_pages; ++i) {
1559                 if (remap_pfn_range(vma, start,
1560                                 page_to_pfn(virt_to_page(async->
1561                                                 buf_page_list[i].virt_addr)),
1562                                 PAGE_SIZE, PAGE_SHARED)) {
1563                         retval = -EAGAIN;
1564                         goto done;
1565                 }
1566                 start += PAGE_SIZE;
1567         }
1568
1569         vma->vm_ops = &comedi_vm_ops;
1570         vma->vm_private_data = async;
1571
1572         async->mmap_count++;
1573
1574         retval = 0;
1575       done:
1576         mutex_unlock(&dev->mutex);
1577         return retval;
1578 }
1579
1580 static unsigned int comedi_poll(struct file *file, poll_table * wait)
1581 {
1582         unsigned int mask = 0;
1583         const unsigned minor = iminor(file->f_dentry->d_inode);
1584         comedi_subdevice *read_subdev;
1585         comedi_subdevice *write_subdev;
1586         struct comedi_device_file_info *dev_file_info = comedi_get_device_file_info(minor);
1587         comedi_device *dev;
1588         if (dev_file_info==NULL) return -ENODEV;
1589         dev = dev_file_info->device;
1590         if (dev==NULL) return -ENODEV;
1591
1592         mutex_lock(&dev->mutex);
1593         if (!dev->attached) {
1594                 DPRINTK("no driver configured on comedi%i\n", dev->minor);
1595                 mutex_unlock(&dev->mutex);
1596                 return 0;
1597         }
1598
1599         mask = 0;
1600         read_subdev = comedi_get_read_subdevice(dev_file_info);
1601         if (read_subdev) {
1602                 poll_wait(file, &read_subdev->async->wait_head, wait);
1603                 if (!read_subdev->busy
1604                         || comedi_buf_read_n_available(read_subdev->async) > 0
1605                         || !(comedi_get_subdevice_runflags(read_subdev) &
1606                                 SRF_RUNNING)) {
1607                         mask |= POLLIN | POLLRDNORM;
1608                 }
1609         }
1610         write_subdev = comedi_get_write_subdevice(dev_file_info);
1611         if (write_subdev) {
1612                 poll_wait(file, &write_subdev->async->wait_head, wait);
1613                 comedi_buf_write_alloc(write_subdev->async, write_subdev->async->prealloc_bufsz);
1614                 if (!write_subdev->busy
1615                         || !(comedi_get_subdevice_runflags(write_subdev) &
1616                                 SRF_RUNNING)
1617                         || comedi_buf_write_n_allocated(write_subdev->async) >=
1618                         bytes_per_sample(write_subdev->async->subdevice)) {
1619                         mask |= POLLOUT | POLLWRNORM;
1620                 }
1621         }
1622
1623         mutex_unlock(&dev->mutex);
1624         return mask;
1625 }
1626
1627 static ssize_t comedi_write(struct file *file, const char *buf, size_t nbytes,
1628         loff_t * offset)
1629 {
1630         comedi_subdevice *s;
1631         comedi_async *async;
1632         int n, m, count = 0, retval = 0;
1633         DECLARE_WAITQUEUE(wait, current);
1634         const unsigned minor = iminor(file->f_dentry->d_inode);
1635         struct comedi_device_file_info *dev_file_info = comedi_get_device_file_info(minor);
1636         comedi_device *dev;
1637         if (dev_file_info==NULL) return -ENODEV;
1638         dev = dev_file_info->device;
1639         if (dev==NULL) return -ENODEV;
1640
1641         if (!dev->attached) {
1642                 DPRINTK("no driver configured on comedi%i\n", dev->minor);
1643                 retval = -ENODEV;
1644                 goto done;
1645         }
1646
1647         s = comedi_get_write_subdevice(dev_file_info);
1648         if (s == NULL) {
1649                 retval = -EIO;
1650                 goto done;
1651         }
1652         async = s->async;
1653
1654         if (!nbytes) {
1655                 retval = 0;
1656                 goto done;
1657         }
1658         if (!s->busy) {
1659                 retval = 0;
1660                 goto done;
1661         }
1662         if (s->busy != file) {
1663                 retval = -EACCES;
1664                 goto done;
1665         }
1666         add_wait_queue(&async->wait_head, &wait);
1667         while (nbytes > 0 && !retval) {
1668                 set_current_state(TASK_INTERRUPTIBLE);
1669
1670                 if (!(comedi_get_subdevice_runflags(s) & SRF_RUNNING)) {
1671                         if (count == 0) {
1672                                 if (comedi_get_subdevice_runflags(s) &
1673                                         SRF_ERROR) {
1674                                         retval = -EPIPE;
1675                                 } else {
1676                                         retval = 0;
1677                                 }
1678                                 do_become_nonbusy(dev, s);
1679                         }
1680                         break;
1681                 }
1682
1683                 n = nbytes;
1684
1685                 m = n;
1686                 if (async->buf_write_ptr + m > async->prealloc_bufsz) {
1687                         m = async->prealloc_bufsz - async->buf_write_ptr;
1688                 }
1689                 comedi_buf_write_alloc(async, async->prealloc_bufsz);
1690                 if (m > comedi_buf_write_n_allocated(async)) {
1691                         m = comedi_buf_write_n_allocated(async);
1692                 }
1693                 if (m < n)
1694                         n = m;
1695
1696                 if (n == 0) {
1697                         if (file->f_flags & O_NONBLOCK) {
1698                                 retval = -EAGAIN;
1699                                 break;
1700                         }
1701                         schedule();
1702                         if (signal_pending(current)) {
1703                                 retval = -ERESTARTSYS;
1704                                 break;
1705                         }
1706                         if (!s->busy) {
1707                                 break;
1708                         }
1709                         if (s->busy != file) {
1710                                 retval = -EACCES;
1711                                 break;
1712                         }
1713                         continue;
1714                 }
1715
1716                 m = copy_from_user(async->prealloc_buf + async->buf_write_ptr,
1717                         buf, n);
1718                 if (m) {
1719                         n -= m;
1720                         retval = -EFAULT;
1721                 }
1722                 comedi_buf_write_free(async, n);
1723
1724                 count += n;
1725                 nbytes -= n;
1726
1727                 buf += n;
1728                 break;          /* makes device work like a pipe */
1729         }
1730         set_current_state(TASK_RUNNING);
1731         remove_wait_queue(&async->wait_head, &wait);
1732
1733 done:
1734         return (count ? count : retval);
1735 }
1736
1737 static ssize_t comedi_read(struct file *file, char *buf, size_t nbytes,
1738         loff_t * offset)
1739 {
1740         comedi_subdevice *s;
1741         comedi_async *async;
1742         int n, m, count = 0, retval = 0;
1743         DECLARE_WAITQUEUE(wait, current);
1744         const unsigned minor = iminor(file->f_dentry->d_inode);
1745         struct comedi_device_file_info *dev_file_info = comedi_get_device_file_info(minor);
1746         comedi_device *dev;
1747         if (dev_file_info==NULL) return -ENODEV;
1748         dev = dev_file_info->device;
1749         if (dev==NULL) return -ENODEV;
1750
1751         if (!dev->attached) {
1752                 DPRINTK("no driver configured on comedi%i\n", dev->minor);
1753                 retval = -ENODEV;
1754                 goto done;
1755         }
1756
1757         s = comedi_get_read_subdevice(dev_file_info);
1758         if (s == NULL) {
1759                 retval = -EIO;
1760                 goto done;
1761         }
1762         async = s->async;
1763         if (!nbytes) {
1764                 retval = 0;
1765                 goto done;
1766         }
1767         if (!s->busy) {
1768                 retval = 0;
1769                 goto done;
1770         }
1771         if (s->busy != file) {
1772                 retval = -EACCES;
1773                 goto done;
1774         }
1775
1776         add_wait_queue(&async->wait_head, &wait);
1777         while (nbytes > 0 && !retval) {
1778                 set_current_state(TASK_INTERRUPTIBLE);
1779
1780                 n = nbytes;
1781
1782                 m = comedi_buf_read_n_available(async);
1783 //printk("%d available\n",m);
1784                 if (async->buf_read_ptr + m > async->prealloc_bufsz) {
1785                         m = async->prealloc_bufsz - async->buf_read_ptr;
1786                 }
1787 //printk("%d contiguous\n",m);
1788                 if (m < n)
1789                         n = m;
1790
1791                 if (n == 0) {
1792                         if (!(comedi_get_subdevice_runflags(s) & SRF_RUNNING)) {
1793                                 do_become_nonbusy(dev, s);
1794                                 if (comedi_get_subdevice_runflags(s) &
1795                                         SRF_ERROR) {
1796                                         retval = -EPIPE;
1797                                 } else {
1798                                         retval = 0;
1799                                 }
1800                                 break;
1801                         }
1802                         if (file->f_flags & O_NONBLOCK) {
1803                                 retval = -EAGAIN;
1804                                 break;
1805                         }
1806                         schedule();
1807                         if (signal_pending(current)) {
1808                                 retval = -ERESTARTSYS;
1809                                 break;
1810                         }
1811                         if (!s->busy) {
1812                                 retval = 0;
1813                                 break;
1814                         }
1815                         if (s->busy != file) {
1816                                 retval = -EACCES;
1817                                 break;
1818                         }
1819                         continue;
1820                 }
1821                 m = copy_to_user(buf, async->prealloc_buf +
1822                         async->buf_read_ptr, n);
1823                 if (m) {
1824                         n -= m;
1825                         retval = -EFAULT;
1826                 }
1827
1828                 comedi_buf_read_alloc(async, n);
1829                 comedi_buf_read_free(async, n);
1830
1831                 count += n;
1832                 nbytes -= n;
1833
1834                 buf += n;
1835                 break;          /* makes device work like a pipe */
1836         }
1837         if (!(comedi_get_subdevice_runflags(s) & (SRF_ERROR | SRF_RUNNING)) &&
1838                 async->buf_read_count - async->buf_write_count == 0) {
1839                 do_become_nonbusy(dev, s);
1840         }
1841         set_current_state(TASK_RUNNING);
1842         remove_wait_queue(&async->wait_head, &wait);
1843
1844 done:
1845         return (count ? count : retval);
1846 }
1847
1848 /*
1849    This function restores a subdevice to an idle state.
1850  */
1851 void do_become_nonbusy(comedi_device * dev, comedi_subdevice * s)
1852 {
1853         comedi_async *async = s->async;
1854
1855         comedi_set_subdevice_runflags(s, SRF_RUNNING, 0);
1856 #ifdef CONFIG_COMEDI_RT
1857         if (comedi_get_subdevice_runflags(s) & SRF_RT) {
1858                 comedi_switch_to_non_rt(dev);
1859                 comedi_set_subdevice_runflags(s, SRF_RT, 0);
1860         }
1861 #endif
1862         if (async) {
1863                 comedi_reset_async_buf(async);
1864                 async->inttrig = NULL;
1865         } else {
1866                 printk("BUG: (?) do_become_nonbusy called with async=0\n");
1867         }
1868
1869         s->busy = NULL;
1870 }
1871
1872 static int comedi_open(struct inode *inode, struct file *file)
1873 {
1874         const unsigned minor = iminor(inode);
1875         struct comedi_device_file_info *dev_file_info = comedi_get_device_file_info(minor);
1876         comedi_device *dev = dev_file_info ? dev_file_info->device : NULL;
1877         if (dev == NULL) {
1878                 DPRINTK("invalid minor number\n");
1879                 return -ENODEV;
1880         }
1881
1882         /* This is slightly hacky, but we want module autoloading
1883          * to work for root.
1884          * case: user opens device, attached -> ok
1885          * case: user opens device, unattached, in_request_module=0 -> autoload
1886          * case: user opens device, unattached, in_request_module=1 -> fail
1887          * case: root opens device, attached -> ok
1888          * case: root opens device, unattached, in_request_module=1 -> ok
1889          *   (typically called from modprobe)
1890          * case: root opens device, unattached, in_request_module=0 -> autoload
1891          *
1892          * The last could be changed to "-> ok", which would deny root
1893          * autoloading.
1894          */
1895         mutex_lock(&dev->mutex);
1896         if (dev->attached)
1897                 goto ok;
1898         if (!capable(CAP_SYS_MODULE) && dev->in_request_module) {
1899                 DPRINTK("in request module\n");
1900                 mutex_unlock(&dev->mutex);
1901                 return -ENODEV;
1902         }
1903         if (capable(CAP_SYS_MODULE) && dev->in_request_module)
1904                 goto ok;
1905
1906         dev->in_request_module = 1;
1907
1908 #ifdef CONFIG_KMOD
1909         mutex_unlock(&dev->mutex);
1910         request_module("char-major-%i-%i", COMEDI_MAJOR, dev->minor);
1911         mutex_lock(&dev->mutex);
1912 #endif
1913
1914         dev->in_request_module = 0;
1915
1916         if (!dev->attached && !capable(CAP_SYS_MODULE)) {
1917                 DPRINTK("not attached and not CAP_SYS_MODULE\n");
1918                 mutex_unlock(&dev->mutex);
1919                 return -ENODEV;
1920         }
1921 ok:
1922         __module_get(THIS_MODULE);
1923
1924         if (dev->attached) {
1925                 if (!try_module_get(dev->driver->module)) {
1926                         module_put(THIS_MODULE);
1927                         mutex_unlock(&dev->mutex);
1928                         return -ENOSYS;
1929                 }
1930         }
1931
1932         if (dev->attached && dev->use_count == 0 && dev->open) {
1933                 int rc = dev->open(dev);
1934
1935                 if (rc < 0) {
1936                         module_put(dev->driver->module);
1937                         module_put(THIS_MODULE);
1938                         mutex_unlock(&dev->mutex);
1939                         return rc;
1940                 }
1941         }
1942
1943         dev->use_count++;
1944
1945         mutex_unlock(&dev->mutex);
1946
1947         return 0;
1948 }
1949
1950 static int comedi_close(struct inode *inode, struct file *file)
1951 {
1952         const unsigned minor = iminor(inode);
1953         comedi_subdevice *s = NULL;
1954         int i;
1955         struct comedi_device_file_info *dev_file_info = comedi_get_device_file_info(minor);
1956         comedi_device *dev;
1957         if (dev_file_info==NULL) return -ENODEV;
1958         dev = dev_file_info->device;
1959         if (dev==NULL) return -ENODEV;
1960
1961         mutex_lock(&dev->mutex);
1962
1963         if (dev->subdevices) {
1964                 for (i = 0; i < dev->n_subdevices; i++) {
1965                         s = dev->subdevices + i;
1966
1967                         if (s->busy == file) {
1968                                 do_cancel(dev, s);
1969                         }
1970                         if (s->lock == file) {
1971                                 s->lock = NULL;
1972                         }
1973                 }
1974         }
1975         if (dev->attached && dev->use_count == 1 && dev->close) {
1976                 dev->close(dev);
1977         }
1978
1979         module_put(THIS_MODULE);
1980         if (dev->attached) {
1981                 module_put(dev->driver->module);
1982         }
1983
1984         dev->use_count--;
1985
1986         mutex_unlock(&dev->mutex);
1987
1988         if (file->f_flags & FASYNC) {
1989                 comedi_fasync(-1, file, 0);
1990         }
1991
1992         return 0;
1993 }
1994
1995 static int comedi_fasync(int fd, struct file *file, int on)
1996 {
1997         const unsigned minor = iminor(file->f_dentry->d_inode);
1998         struct comedi_device_file_info *dev_file_info = comedi_get_device_file_info(minor);
1999         comedi_device *dev;
2000         if (dev_file_info==NULL) return -ENODEV;
2001         dev = dev_file_info->device;
2002         if (dev==NULL) return -ENODEV;
2003
2004         return fasync_helper(fd, file, on, &dev->async_queue);
2005 }
2006
2007 const struct file_operations comedi_fops = {
2008       owner:THIS_MODULE,
2009 #ifdef HAVE_UNLOCKED_IOCTL
2010       unlocked_ioctl:comedi_unlocked_ioctl,
2011 #else
2012       ioctl:comedi_ioctl,
2013 #endif
2014 #ifdef HAVE_COMPAT_IOCTL
2015       compat_ioctl:comedi_compat_ioctl,
2016 #endif
2017       open:comedi_open,
2018       release:comedi_close,
2019       read:comedi_read,
2020       write:comedi_write,
2021       mmap:comedi_mmap,
2022       poll:comedi_poll,
2023       fasync:comedi_fasync,
2024 };
2025
2026 struct class *comedi_class = NULL;
2027 static struct cdev comedi_cdev;
2028
2029 static void comedi_cleanup_legacy_minors(void)
2030 {
2031         unsigned i;
2032         for (i = 0; i < comedi_num_legacy_minors; i++) {
2033                 comedi_free_board_minor(i);
2034         }
2035 }
2036
2037 static int __init comedi_init(void)
2038 {
2039         int i;
2040         int retval;
2041
2042         printk("comedi: version " COMEDI_RELEASE
2043                 " - http://www.comedi.org\n");
2044
2045         if(comedi_num_legacy_minors < 0 || comedi_num_legacy_minors > COMEDI_NUM_BOARD_MINORS)
2046         {
2047                 printk("comedi:  error: invalid value for module parameter \"comedi_num_legacy_minors\".  Valid "
2048                         "values are 0 through %i.\n", COMEDI_NUM_BOARD_MINORS);
2049                 return -EINVAL;
2050         }
2051         /* comedi is unusable if both comedi_autoconfig and comedi_num_legacy_minors are zero,
2052                 so we might as well adjust the defaults in that case */
2053         if(comedi_autoconfig == 0 && comedi_num_legacy_minors == 0)
2054         {
2055                 comedi_num_legacy_minors = 16;
2056         }
2057
2058         memset(comedi_file_info_table, 0, sizeof(struct comedi_device_file_info*) * COMEDI_NUM_MINORS);
2059
2060         retval = register_chrdev_region(MKDEV(COMEDI_MAJOR, 0),
2061                 COMEDI_NUM_MINORS, "comedi");
2062         if (retval)
2063                 return -EIO;
2064         cdev_init(&comedi_cdev, &comedi_fops);
2065         comedi_cdev.owner = THIS_MODULE;
2066         kobject_set_name(&comedi_cdev.kobj, "comedi");
2067         if (cdev_add(&comedi_cdev, MKDEV(COMEDI_MAJOR, 0), COMEDI_NUM_MINORS)) {
2068                 unregister_chrdev_region(MKDEV(COMEDI_MAJOR, 0),
2069                         COMEDI_NUM_MINORS);
2070                 return -EIO;
2071         }
2072         comedi_class = class_create(THIS_MODULE, "comedi");
2073         if (IS_ERR(comedi_class)) {
2074                 printk("comedi: failed to create class");
2075                 cdev_del(&comedi_cdev);
2076                 unregister_chrdev_region(MKDEV(COMEDI_MAJOR, 0),
2077                         COMEDI_NUM_MINORS);
2078                 return PTR_ERR(comedi_class);
2079         }
2080
2081         /* XXX requires /proc interface */
2082         comedi_proc_init();
2083
2084         // create devices files for legacy/manual use
2085         for (i = 0; i < comedi_num_legacy_minors; i++) {
2086                 int minor;
2087                 minor = comedi_alloc_board_minor(NULL);
2088                 if(minor < 0)
2089                 {
2090                         comedi_cleanup_legacy_minors();
2091                         cdev_del(&comedi_cdev);
2092                         unregister_chrdev_region(MKDEV(COMEDI_MAJOR, 0),
2093                                 COMEDI_NUM_MINORS);
2094                         return minor;
2095                 }
2096         }
2097
2098         comedi_rt_init();
2099
2100         comedi_register_ioctl32();
2101
2102         return 0;
2103 }
2104
2105 static void __exit comedi_cleanup(void)
2106 {
2107         int i;
2108
2109         comedi_cleanup_legacy_minors();
2110         for(i = 0; i < COMEDI_NUM_MINORS; ++i)
2111         {
2112                 BUG_ON(comedi_file_info_table[i]);
2113         }
2114
2115         class_destroy(comedi_class);
2116         cdev_del(&comedi_cdev);
2117         unregister_chrdev_region(MKDEV(COMEDI_MAJOR, 0), COMEDI_NUM_MINORS);
2118
2119         comedi_proc_cleanup();
2120
2121         comedi_rt_cleanup();
2122
2123         comedi_unregister_ioctl32();
2124 }
2125
2126 module_init(comedi_init);
2127 module_exit(comedi_cleanup);
2128
2129 void comedi_error(const comedi_device * dev, const char *s)
2130 {
2131         rt_printk("comedi%d: %s: %s\n", dev->minor, dev->driver->driver_name,
2132                 s);
2133 }
2134
2135 void comedi_event(comedi_device * dev, comedi_subdevice * s)
2136 {
2137         comedi_async *async = s->async;
2138         unsigned runflags = 0;
2139         unsigned runflags_mask = 0;
2140
2141         //DPRINTK("comedi_event 0x%x\n",mask);
2142
2143         if ((comedi_get_subdevice_runflags(s) & SRF_RUNNING) == 0)
2144                 return;
2145
2146         if (s->async->
2147                 events & (COMEDI_CB_EOA | COMEDI_CB_ERROR | COMEDI_CB_OVERFLOW))
2148         {
2149                 runflags_mask |= SRF_RUNNING;
2150         }
2151         /* remember if an error event has occured, so an error
2152          * can be returned the next time the user does a read() */
2153         if (s->async->events & (COMEDI_CB_ERROR | COMEDI_CB_OVERFLOW)) {
2154                 runflags_mask |= SRF_ERROR;
2155                 runflags |= SRF_ERROR;
2156         }
2157         if (runflags_mask) {
2158                 /*sets SRF_ERROR and SRF_RUNNING together atomically */
2159                 comedi_set_subdevice_runflags(s, runflags_mask, runflags);
2160         }
2161
2162         if (async->cb_mask & s->async->events) {
2163                 if (comedi_get_subdevice_runflags(s) & SRF_USER) {
2164
2165                         if (dev->rt) {
2166 #ifdef CONFIG_COMEDI_RT
2167                                 // pend wake up
2168                                 comedi_rt_pend_wakeup(&async->wait_head);
2169 #else
2170                                 printk("BUG: comedi_event() code unreachable\n");
2171 #endif
2172                         } else {
2173                                 wake_up_interruptible(&async->wait_head);
2174                                 if (s->subdev_flags & SDF_CMD_READ) {
2175                                         kill_fasync(&dev->async_queue, SIGIO,
2176                                                 POLL_IN);
2177                                 }
2178                                 if (s->subdev_flags & SDF_CMD_WRITE) {
2179                                         kill_fasync(&dev->async_queue, SIGIO,
2180                                                 POLL_OUT);
2181                                 }
2182                         }
2183                 } else {
2184                         if (async->cb_func)
2185                                 async->cb_func(s->async->events, async->cb_arg);
2186                         /* XXX bug here.  If subdevice A is rt, and
2187                          * subdevice B tries to callback to a normal
2188                          * linux kernel function, it will be at the
2189                          * wrong priority.  Since this isn't very
2190                          * common, I'm not going to worry about it. */
2191                 }
2192         }
2193         s->async->events = 0;
2194 }
2195
2196 void comedi_set_subdevice_runflags(comedi_subdevice * s, unsigned mask,
2197         unsigned bits)
2198 {
2199         unsigned long flags;
2200
2201         comedi_spin_lock_irqsave(&s->spin_lock, flags);
2202         s->runflags &= ~mask;
2203         s->runflags |= (bits & mask);
2204         comedi_spin_unlock_irqrestore(&s->spin_lock, flags);
2205 }
2206
2207 unsigned comedi_get_subdevice_runflags(comedi_subdevice * s)
2208 {
2209         unsigned long flags;
2210         unsigned runflags;
2211
2212         comedi_spin_lock_irqsave(&s->spin_lock, flags);
2213         runflags = s->runflags;
2214         comedi_spin_unlock_irqrestore(&s->spin_lock, flags);
2215         return runflags;
2216 }
2217
2218 static int is_device_busy(comedi_device * dev)
2219 {
2220         comedi_subdevice *s;
2221         int i;
2222
2223         if (!dev->attached)
2224                 return 0;
2225
2226         for (i = 0; i < dev->n_subdevices; i++) {
2227                 s = dev->subdevices + i;
2228                 if (s->busy)
2229                         return 1;
2230                 if (s->async && s->async->mmap_count)
2231                         return 1;
2232         }
2233
2234         return 0;
2235 }
2236
2237 void comedi_device_init(comedi_device *dev)
2238 {
2239         memset(dev, 0, sizeof(comedi_device));
2240         spin_lock_init(&dev->spinlock);
2241         mutex_init(&dev->mutex);
2242         dev->minor = -1;
2243 }
2244
2245 void comedi_device_cleanup(comedi_device *dev)
2246 {
2247         if(dev == NULL) return;
2248         mutex_lock(&dev->mutex);
2249         comedi_device_detach(dev);
2250         mutex_unlock(&dev->mutex);
2251         mutex_destroy(&dev->mutex);
2252 }
2253
2254 int comedi_alloc_board_minor(struct device *hardware_device)
2255 {
2256         unsigned long flags;
2257         struct comedi_device_file_info *info;
2258         comedi_device_create_t *csdev;
2259         unsigned i;
2260         int retval;
2261
2262         info = kzalloc(sizeof(struct comedi_device_file_info), GFP_KERNEL);
2263         if(info == NULL) return -ENOMEM;
2264         info->device = kzalloc(sizeof(comedi_device), GFP_KERNEL);
2265         if(info->device == NULL)
2266         {
2267                 kfree(info);
2268                 return -ENOMEM;
2269         }
2270         comedi_device_init(info->device);
2271         comedi_spin_lock_irqsave(&comedi_file_info_table_lock, flags);
2272         for(i = 0; i < COMEDI_NUM_BOARD_MINORS; ++i)
2273         {
2274                 if(comedi_file_info_table[i] == NULL)
2275                 {
2276                         comedi_file_info_table[i] = info;
2277                         break;
2278                 }
2279         }
2280         comedi_spin_unlock_irqrestore(&comedi_file_info_table_lock, flags);
2281         if(i == COMEDI_NUM_BOARD_MINORS)
2282         {
2283                 comedi_device_cleanup(info->device);
2284                 kfree(info->device);
2285                 kfree(info);
2286                 printk("comedi: error: ran out of minor numbers for board device files.\n");
2287                 return -EBUSY;
2288         }
2289         info->device->minor = i;
2290         csdev = COMEDI_DEVICE_CREATE(comedi_class, NULL,
2291                 MKDEV(COMEDI_MAJOR, i), NULL, hardware_device, "comedi%i", i);
2292         if(!IS_ERR(csdev)) {
2293                 info->device->class_dev = csdev;
2294         }
2295         COMEDI_DEV_SET_DRVDATA(csdev, info);
2296         retval = COMEDI_DEVICE_CREATE_FILE(csdev, &dev_attr_max_read_buffer_kb);
2297         if(retval)
2298         {
2299                 printk(KERN_ERR "comedi: failed to create sysfs attribute file \"%s\".\n", dev_attr_max_read_buffer_kb.attr.name);
2300                 comedi_free_board_minor(i);
2301                 return retval;
2302         }
2303         retval = COMEDI_DEVICE_CREATE_FILE(csdev, &dev_attr_read_buffer_kb);
2304         if(retval)
2305         {
2306                 printk(KERN_ERR "comedi: failed to create sysfs attribute file \"%s\".\n", dev_attr_read_buffer_kb.attr.name);
2307                 comedi_free_board_minor(i);
2308                 return retval;
2309         }
2310         retval = COMEDI_DEVICE_CREATE_FILE(csdev, &dev_attr_max_write_buffer_kb);
2311         if(retval)
2312         {
2313                 printk(KERN_ERR "comedi: failed to create sysfs attribute file \"%s\".\n", dev_attr_max_write_buffer_kb.attr.name);
2314                 comedi_free_board_minor(i);
2315                 return retval;
2316         }
2317         retval = COMEDI_DEVICE_CREATE_FILE(csdev, &dev_attr_write_buffer_kb);
2318         if(retval)
2319         {
2320                 printk(KERN_ERR "comedi: failed to create sysfs attribute file \"%s\".\n", dev_attr_write_buffer_kb.attr.name);
2321                 comedi_free_board_minor(i);
2322                 return retval;
2323         }
2324         return i;
2325 }
2326
2327 void comedi_free_board_minor(unsigned minor)
2328 {
2329         unsigned long flags;
2330         struct comedi_device_file_info *info;
2331
2332         BUG_ON(minor >= COMEDI_NUM_BOARD_MINORS);
2333         comedi_spin_lock_irqsave(&comedi_file_info_table_lock, flags);
2334         info = comedi_file_info_table[minor];
2335         comedi_file_info_table[minor] = NULL;
2336         comedi_spin_unlock_irqrestore(&comedi_file_info_table_lock, flags);
2337
2338         if(info)
2339         {
2340                 comedi_device *dev = info->device;
2341                 if(dev)
2342                 {
2343                         if(dev->class_dev)
2344                         {
2345                                 COMEDI_DEVICE_DESTROY(comedi_class,
2346                                         MKDEV(COMEDI_MAJOR, dev->minor));
2347                         }
2348                         comedi_device_cleanup(dev);
2349                         kfree(dev);
2350                 }
2351                 kfree(info);
2352         }
2353 }
2354
2355 int comedi_alloc_subdevice_minor(comedi_device *dev, comedi_subdevice *s)
2356 {
2357         unsigned long flags;
2358         struct comedi_device_file_info *info;
2359         comedi_device_create_t *csdev;
2360         unsigned i;
2361         int retval;
2362
2363         info = kmalloc(sizeof(struct comedi_device_file_info), GFP_KERNEL);
2364         if(info == NULL) return -ENOMEM;
2365         info->device = dev;
2366         info->read_subdevice = s;
2367         info->write_subdevice = s;
2368         comedi_spin_lock_irqsave(&comedi_file_info_table_lock, flags);
2369         for(i = COMEDI_FIRST_SUBDEVICE_MINOR; i < COMEDI_NUM_MINORS; ++i)
2370         {
2371                 if(comedi_file_info_table[i] == NULL)
2372                 {
2373                         comedi_file_info_table[i] = info;
2374                         break;
2375                 }
2376         }
2377         comedi_spin_unlock_irqrestore(&comedi_file_info_table_lock, flags);
2378         if(i == COMEDI_NUM_MINORS)
2379         {
2380                 kfree(info);
2381                 printk("comedi: error: ran out of minor numbers for board device files.\n");
2382                 return -EBUSY;
2383         }
2384         s->minor = i;
2385         csdev = COMEDI_DEVICE_CREATE(comedi_class, dev->class_dev,
2386                 MKDEV(COMEDI_MAJOR, i), NULL, NULL, "comedi%i_subd%i", dev->minor, (int)(s - dev->subdevices));
2387         if(!IS_ERR(csdev))
2388         {
2389                 s->class_dev = csdev;
2390         }
2391         COMEDI_DEV_SET_DRVDATA(csdev, info);
2392         retval = COMEDI_DEVICE_CREATE_FILE(csdev, &dev_attr_max_read_buffer_kb);
2393         if(retval)
2394         {
2395                 printk(KERN_ERR "comedi: failed to create sysfs attribute file \"%s\".\n", dev_attr_max_read_buffer_kb.attr.name);
2396                 comedi_free_subdevice_minor(s);
2397                 return retval;
2398         }
2399         retval = COMEDI_DEVICE_CREATE_FILE(csdev, &dev_attr_read_buffer_kb);
2400         if(retval)
2401         {
2402                 printk(KERN_ERR "comedi: failed to create sysfs attribute file \"%s\".\n", dev_attr_read_buffer_kb.attr.name);
2403                 comedi_free_subdevice_minor(s);
2404                 return retval;
2405         }
2406         retval = COMEDI_DEVICE_CREATE_FILE(csdev, &dev_attr_max_write_buffer_kb);
2407         if(retval)
2408         {
2409                 printk(KERN_ERR "comedi: failed to create sysfs attribute file \"%s\".\n", dev_attr_max_write_buffer_kb.attr.name);
2410                 comedi_free_subdevice_minor(s);
2411                 return retval;
2412         }
2413         retval = COMEDI_DEVICE_CREATE_FILE(csdev, &dev_attr_write_buffer_kb);
2414         if(retval)
2415         {
2416                 printk(KERN_ERR "comedi: failed to create sysfs attribute file \"%s\".\n", dev_attr_write_buffer_kb.attr.name);
2417                 comedi_free_subdevice_minor(s);
2418                 return retval;
2419         }
2420         return i;
2421 }
2422
2423 void comedi_free_subdevice_minor(comedi_subdevice *s)
2424 {
2425         unsigned long flags;
2426         struct comedi_device_file_info *info;
2427
2428         if(s == NULL) return;
2429         if(s->minor < 0) return;
2430
2431         BUG_ON(s->minor >= COMEDI_NUM_MINORS);
2432         BUG_ON(s->minor < COMEDI_FIRST_SUBDEVICE_MINOR);
2433
2434         comedi_spin_lock_irqsave(&comedi_file_info_table_lock, flags);
2435         info = comedi_file_info_table[s->minor];
2436         comedi_file_info_table[s->minor] = NULL;
2437         comedi_spin_unlock_irqrestore(&comedi_file_info_table_lock, flags);
2438
2439         if(s->class_dev)
2440         {
2441                 COMEDI_DEVICE_DESTROY(comedi_class,
2442                         MKDEV(COMEDI_MAJOR, s->minor));
2443                 s->class_dev = NULL;
2444         }
2445         kfree(info);
2446 }
2447
2448 struct comedi_device_file_info *comedi_get_device_file_info(unsigned minor)
2449 {
2450         unsigned long flags;
2451         struct comedi_device_file_info *info;
2452
2453         BUG_ON(minor >= COMEDI_NUM_MINORS);
2454         comedi_spin_lock_irqsave(&comedi_file_info_table_lock, flags);
2455         info = comedi_file_info_table[minor];
2456         comedi_spin_unlock_irqrestore(&comedi_file_info_table_lock, flags);
2457         return info;
2458 }
2459
2460 static int resize_async_buffer(comedi_device *dev,
2461         comedi_subdevice *s, comedi_async *async, unsigned new_size)
2462 {
2463         int retval;
2464
2465         if (new_size > async->max_bufsize)
2466                 return -EPERM;
2467
2468         if (s->busy) {
2469                 DPRINTK("subdevice is busy, cannot resize buffer\n");
2470                 return -EBUSY;
2471         }
2472         if (async->mmap_count) {
2473                 DPRINTK("subdevice is mmapped, cannot resize buffer\n");
2474                 return -EBUSY;
2475         }
2476
2477         if (!async->prealloc_buf)
2478                 return -EINVAL;
2479
2480         /* make sure buffer is an integral number of pages
2481                 * (we round up) */
2482         new_size = (new_size + PAGE_SIZE - 1) & PAGE_MASK;
2483
2484         retval = comedi_buf_alloc(dev, s, new_size);
2485         if (retval < 0)
2486                 return retval;
2487
2488         if (s->buf_change) {
2489                 retval = s->buf_change(dev, s, new_size);
2490                 if (retval < 0)
2491                         return retval;
2492         }
2493
2494         DPRINTK("comedi%i subd %d buffer resized to %i bytes\n",
2495                 dev->minor, (int)(s - dev->subdevices), async->prealloc_bufsz);
2496         return 0;
2497 }
2498
2499 // sysfs attribute file functions
2500
2501 static const unsigned bytes_per_kibi = 1024;
2502
2503 static COMEDI_DECLARE_ATTR_SHOW(show_max_read_buffer_kb, dev, buf)
2504 {
2505         ssize_t retval;
2506         struct comedi_device_file_info *info = COMEDI_DEV_GET_DRVDATA(dev);
2507         unsigned max_buffer_size_kb = 0;
2508         comedi_subdevice * const read_subdevice = comedi_get_read_subdevice(info);
2509
2510         mutex_lock(&info->device->mutex);
2511         if(read_subdevice &&
2512                 (read_subdevice->subdev_flags & SDF_CMD_READ) &&
2513                 read_subdevice->async)
2514         {
2515                 max_buffer_size_kb = read_subdevice->async->max_bufsize / bytes_per_kibi;
2516         }
2517         retval =  snprintf(buf, PAGE_SIZE, "%i\n", max_buffer_size_kb);
2518         mutex_unlock(&info->device->mutex);
2519
2520         return retval;
2521 }
2522
2523 static COMEDI_DECLARE_ATTR_STORE(store_max_read_buffer_kb, dev, buf, count)
2524 {
2525         struct comedi_device_file_info *info = COMEDI_DEV_GET_DRVDATA(dev);
2526         unsigned long new_max_size_kb;
2527         uint64_t new_max_size;
2528         comedi_subdevice * const read_subdevice = comedi_get_read_subdevice(info);
2529
2530         if(strict_strtoul(buf, 10, &new_max_size_kb))
2531         {
2532                 return -EINVAL;
2533         }
2534         if(new_max_size_kb != (uint32_t)new_max_size_kb) return -EINVAL;
2535         new_max_size = ((uint64_t)new_max_size_kb) * bytes_per_kibi;
2536         if(new_max_size != (uint32_t)new_max_size) return -EINVAL;
2537
2538         mutex_lock(&info->device->mutex);
2539         if(read_subdevice == NULL ||
2540                 (read_subdevice->subdev_flags & SDF_CMD_READ) == 0 ||
2541                 read_subdevice->async == NULL)
2542         {
2543                 mutex_unlock(&info->device->mutex);
2544                 return -EINVAL;
2545         }
2546         read_subdevice->async->max_bufsize = new_max_size;
2547         mutex_unlock(&info->device->mutex);
2548
2549         return count;
2550 }
2551
2552 static COMEDI_DECLARE_ATTR_SHOW(show_read_buffer_kb, dev, buf)
2553 {
2554         ssize_t retval;
2555         struct comedi_device_file_info *info = COMEDI_DEV_GET_DRVDATA(dev);
2556         unsigned buffer_size_kb = 0;
2557         comedi_subdevice * const read_subdevice = comedi_get_read_subdevice(info);
2558
2559         mutex_lock(&info->device->mutex);
2560         if(read_subdevice &&
2561                 (read_subdevice->subdev_flags & SDF_CMD_READ) &&
2562                 read_subdevice->async)
2563         {
2564                 buffer_size_kb = read_subdevice->async->prealloc_bufsz / bytes_per_kibi;
2565         }
2566         retval =  snprintf(buf, PAGE_SIZE, "%i\n", buffer_size_kb);
2567         mutex_unlock(&info->device->mutex);
2568
2569         return retval;
2570 }
2571
2572 static COMEDI_DECLARE_ATTR_STORE(store_read_buffer_kb, dev, buf, count)
2573 {
2574         struct comedi_device_file_info *info = COMEDI_DEV_GET_DRVDATA(dev);
2575         unsigned long new_size_kb;
2576         uint64_t new_size;
2577         int retval;
2578         comedi_subdevice * const read_subdevice = comedi_get_read_subdevice(info);
2579
2580         if(strict_strtoul(buf, 10, &new_size_kb))
2581         {
2582                 return -EINVAL;
2583         }
2584         if(new_size_kb != (uint32_t)new_size_kb) return -EINVAL;
2585         new_size = ((uint64_t)new_size_kb) * bytes_per_kibi;
2586         if(new_size != (uint32_t)new_size) return -EINVAL;
2587
2588         mutex_lock(&info->device->mutex);
2589         if(read_subdevice == NULL ||
2590                 (read_subdevice->subdev_flags & SDF_CMD_READ) == 0 ||
2591                 read_subdevice->async == NULL)
2592         {
2593                 mutex_unlock(&info->device->mutex);
2594                 return -EINVAL;
2595         }
2596         retval = resize_async_buffer(info->device, read_subdevice,
2597                 read_subdevice->async, new_size);
2598         mutex_unlock(&info->device->mutex);
2599
2600         if(retval < 0) return retval;
2601         return count;
2602 }
2603
2604 static COMEDI_DECLARE_ATTR_SHOW(show_max_write_buffer_kb, dev, buf)
2605 {
2606         ssize_t retval;
2607         struct comedi_device_file_info *info = COMEDI_DEV_GET_DRVDATA(dev);
2608         unsigned max_buffer_size_kb = 0;
2609         comedi_subdevice * const write_subdevice = comedi_get_write_subdevice(info);
2610
2611         mutex_lock(&info->device->mutex);
2612         if(write_subdevice &&
2613                 (write_subdevice->subdev_flags & SDF_CMD_WRITE) &&
2614                 write_subdevice->async)
2615         {
2616                 max_buffer_size_kb = write_subdevice->async->max_bufsize / bytes_per_kibi;
2617         }
2618         retval =  snprintf(buf, PAGE_SIZE, "%i\n", max_buffer_size_kb);
2619         mutex_unlock(&info->device->mutex);
2620
2621         return retval;
2622 }
2623
2624 static COMEDI_DECLARE_ATTR_STORE(store_max_write_buffer_kb, dev, buf, count)
2625 {
2626         struct comedi_device_file_info *info = COMEDI_DEV_GET_DRVDATA(dev);
2627         unsigned long new_max_size_kb;
2628         uint64_t new_max_size;
2629         comedi_subdevice * const write_subdevice = comedi_get_write_subdevice(info);
2630
2631         if(strict_strtoul(buf, 10, &new_max_size_kb))
2632         {
2633                 return -EINVAL;
2634         }
2635         if(new_max_size_kb != (uint32_t)new_max_size_kb) return -EINVAL;
2636         new_max_size = ((uint64_t)new_max_size_kb) * bytes_per_kibi;
2637         if(new_max_size != (uint32_t)new_max_size) return -EINVAL;
2638
2639         mutex_lock(&info->device->mutex);
2640         if(write_subdevice == NULL ||
2641                 (write_subdevice->subdev_flags & SDF_CMD_WRITE) == 0 ||
2642                 write_subdevice->async == NULL)
2643         {
2644                 mutex_unlock(&info->device->mutex);
2645                 return -EINVAL;
2646         }
2647         write_subdevice->async->max_bufsize = new_max_size;
2648         mutex_unlock(&info->device->mutex);
2649
2650         return count;
2651 }
2652
2653 static COMEDI_DECLARE_ATTR_SHOW(show_write_buffer_kb, dev, buf)
2654 {
2655         ssize_t retval;
2656         struct comedi_device_file_info *info = COMEDI_DEV_GET_DRVDATA(dev);
2657         unsigned buffer_size_kb = 0;
2658         comedi_subdevice * const write_subdevice = comedi_get_write_subdevice(info);
2659
2660         mutex_lock(&info->device->mutex);
2661         if(write_subdevice &&
2662                 (write_subdevice->subdev_flags & SDF_CMD_WRITE) &&
2663                 write_subdevice->async)
2664         {
2665                 buffer_size_kb = write_subdevice->async->prealloc_bufsz / bytes_per_kibi;
2666         }
2667         retval =  snprintf(buf, PAGE_SIZE, "%i\n", buffer_size_kb);
2668         mutex_unlock(&info->device->mutex);
2669
2670         return retval;
2671 }
2672
2673 static COMEDI_DECLARE_ATTR_STORE(store_write_buffer_kb, dev, buf, count)
2674 {
2675         struct comedi_device_file_info *info = COMEDI_DEV_GET_DRVDATA(dev);
2676         unsigned long new_size_kb;
2677         uint64_t new_size;
2678         int retval;
2679         comedi_subdevice * const write_subdevice = comedi_get_write_subdevice(info);
2680
2681         if(strict_strtoul(buf, 10, &new_size_kb))
2682         {
2683                 return -EINVAL;
2684         }
2685         if(new_size_kb != (uint32_t)new_size_kb) return -EINVAL;
2686         new_size = ((uint64_t)new_size_kb) * bytes_per_kibi;
2687         if(new_size != (uint32_t)new_size) return -EINVAL;
2688
2689         mutex_lock(&info->device->mutex);
2690         if(write_subdevice == NULL ||
2691                 (write_subdevice->subdev_flags & SDF_CMD_WRITE) == 0 ||
2692                 write_subdevice->async == NULL)
2693         {
2694                 mutex_unlock(&info->device->mutex);
2695                 return -EINVAL;
2696         }
2697         retval = resize_async_buffer(info->device, write_subdevice,
2698                 write_subdevice->async, new_size);
2699         mutex_unlock(&info->device->mutex);
2700
2701         if(retval < 0) return retval;
2702         return count;
2703 }