[media] lirc_zilog: Add ref counting of struct IR, IR_tx, and IR_rx

This is a major change to add pointer reference counting for struct IR, struct IR_tx, and struct IR_rx object instances. This ref counting gets lirc_zilog closer to gracefully handling bridge drivers and hot-unplugged USB devices disappearing out from under lirc_zilog when the /dev/lircN node is still open. (mutexes to protect the i2c_client pointers in struct IR_tx and struct IR_rx still need to be added.) This reference counting also helps lirc_zilog clean up properly when the i2c_clients disappear.

Andy Walls committed 15 years ago

Commit 5bd6b041 parent 534c1ea1 file · +380 −204Browse files

Showing the changes to drivers/staging/lirc (1 of 1 file). Show all

Unified · Split

drivers/staging/lirc/lirc_zilog.c+380−204

@@ -63,8 +63,14 @@ · 62 unmodified lines
63	63	#include <media/lirc_dev.h>
64	64	#include <media/lirc.h>
65	65
	66	+struct IR;
	67	+
66	68	struct IR_rx {
	69	+ struct kref ref;
	70	+ struct IR *ir;
	71	+
67	72	/* RX device */
	73	+ /* FIXME mutex lock access to this pointer */
68	74	struct i2c_client *c;
69	75
70	76	/* RX polling thread data */
@@ -76,7 +82,11 @@ struct IR_rx { · 5 unmodified lines
76	82	};
77	83
78	84	struct IR_tx {
	85	+ struct kref ref;
	86	+ struct IR *ir;
	87	+
79	88	/* TX device */
	89	+ /* FIXME mutex lock access to this pointer */
80	90	struct i2c_client *c;
81	91
82	92	/* TX additional actions needed */
@@ -85,8 +95,10 @@ struct IR_tx { · 2 unmodified lines
85	95	};
86	96
87	97	struct IR {
	98	+ struct kref ref;
88	99	struct list_head list;
89	100
	101	+ /* FIXME spinlock access to l.features */
90	102	struct lirc_driver l;
91	103	struct lirc_buffer rbuf;
92	104
@@ -94,11 +106,21 @@ struct IR { · 1 unmodified line
94	106	atomic_t open_count;
95	107
96	108	struct i2c_adapter *adapter;
	109	+
	110	+ spinlock_t rx_ref_lock; /* struct IR_rx kref get()/put() */
97	111	struct IR_rx *rx;
	112	+
	113	+ spinlock_t tx_ref_lock; /* struct IR_tx kref get()/put() */
98	114	struct IR_tx *tx;
99	115	};
100	116
101	117	/* IR transceiver instance object list */
	118	+/*
	119	+ * This lock is used for the following:
	120	+ * a. ir_devices_list access, insertions, deletions
	121	+ * b. struct IR kref get()s and put()s
	122	+ * c. serialization of ir_probe() for the two i2c_clients for a Z8
	123	+ */
102	124	static DEFINE_MUTEX(ir_devices_lock);
103	125	static LIST_HEAD(ir_devices_list);
104	126
@@ -146,6 +168,157 @@ static int minor = -1; /* minor number */ · 41 unmodified lines
146	168	## args); \
147	169	} while (0)
148	170
	171	+
	172	+/* struct IR reference counting */
	173	+static struct IR get_ir_device(struct IR ir, bool ir_devices_lock_held)
	174	+{
	175	+ if (ir_devices_lock_held) {
	176	+ kref_get(&ir->ref);
	177	+ } else {
	178	+ mutex_lock(&ir_devices_lock);
	179	+ kref_get(&ir->ref);
	180	+ mutex_unlock(&ir_devices_lock);
	181	+ }
	182	+ return ir;
	183	+}
	184	+
	185	+static void release_ir_device(struct kref *ref)
	186	+{
	187	+ struct IR *ir = container_of(ref, struct IR, ref);
	188	+
	189	+ /*
	190	+ * Things should be in this state by now:
	191	+ * ir->rx set to NULL and deallocated - happens before ir->rx->ir put()
	192	+ * ir->rx->task kthread stopped - happens before ir->rx->ir put()
	193	+ * ir->tx set to NULL and deallocated - happens before ir->tx->ir put()
	194	+ * ir->open_count == 0 - happens on final close()
	195	+ * ir_lock, tx_ref_lock, rx_ref_lock, all released
	196	+ */
	197	+ if (ir->l.minor >= 0 && ir->l.minor < MAX_IRCTL_DEVICES) {
	198	+ lirc_unregister_driver(ir->l.minor);
	199	+ ir->l.minor = MAX_IRCTL_DEVICES;
	200	+ }
	201	+ if (ir->rbuf.fifo_initialized)
	202	+ lirc_buffer_free(&ir->rbuf);
	203	+ list_del(&ir->list);
	204	+ kfree(ir);
	205	+}
	206	+
	207	+static int put_ir_device(struct IR *ir, bool ir_devices_lock_held)
	208	+{
	209	+ int released;
	210	+
	211	+ if (ir_devices_lock_held)
	212	+ return kref_put(&ir->ref, release_ir_device);
	213	+
	214	+ mutex_lock(&ir_devices_lock);
	215	+ released = kref_put(&ir->ref, release_ir_device);
	216	+ mutex_unlock(&ir_devices_lock);
	217	+
	218	+ return released;
	219	+}
	220	+
	221	+/* struct IR_rx reference counting */
	222	+static struct IR_rx get_ir_rx(struct IR ir)
	223	+{
	224	+ struct IR_rx *rx;
	225	+
	226	+ spin_lock(&ir->rx_ref_lock);
	227	+ rx = ir->rx;
	228	+ if (rx != NULL)
	229	+ kref_get(&rx->ref);
	230	+ spin_unlock(&ir->rx_ref_lock);
	231	+ return rx;
	232	+}
	233	+
	234	+static void destroy_rx_kthread(struct IR_rx *rx, bool ir_devices_lock_held)
	235	+{
	236	+ /* end up polling thread */
	237	+ if (!IS_ERR_OR_NULL(rx->task)) {
	238	+ kthread_stop(rx->task);
	239	+ rx->task = NULL;
	240	+ /* Put the ir ptr that ir_probe() gave to the rx poll thread */
	241	+ put_ir_device(rx->ir, ir_devices_lock_held);
	242	+ }
	243	+}
	244	+
	245	+static void release_ir_rx(struct kref *ref)
	246	+{
	247	+ struct IR_rx *rx = container_of(ref, struct IR_rx, ref);
	248	+ struct IR *ir = rx->ir;
	249	+
	250	+ /*
	251	+ * This release function can't do all the work, as we want
	252	+ * to keep the rx_ref_lock a spinlock, and killing the poll thread
	253	+ * and releasing the ir reference can cause a sleep. That work is
	254	+ * performed by put_ir_rx()
	255	+ */
	256	+ ir->l.features &= ~LIRC_CAN_REC_LIRCCODE;
	257	+ /* Don't put_ir_device(rx->ir) here; lock can't be freed yet */
	258	+ ir->rx = NULL;
	259	+ /* Don't do the kfree(rx) here; we still need to kill the poll thread */
	260	+ return;
	261	+}
	262	+
	263	+static int put_ir_rx(struct IR_rx *rx, bool ir_devices_lock_held)
	264	+{
	265	+ int released;
	266	+ struct IR *ir = rx->ir;
	267	+
	268	+ spin_lock(&ir->rx_ref_lock);
	269	+ released = kref_put(&rx->ref, release_ir_rx);
	270	+ spin_unlock(&ir->rx_ref_lock);
	271	+ /* Destroy the rx kthread while not holding the spinlock */
	272	+ if (released) {
	273	+ destroy_rx_kthread(rx, ir_devices_lock_held);
	274	+ kfree(rx);
	275	+ /* Make sure we're not still in a poll_table somewhere */
	276	+ wake_up_interruptible(&ir->rbuf.wait_poll);
	277	+ }
	278	+ /* Do a reference put() for the rx->ir reference, if we released rx */
	279	+ if (released)
	280	+ put_ir_device(ir, ir_devices_lock_held);
	281	+ return released;
	282	+}
	283	+
	284	+/* struct IR_tx reference counting */
	285	+static struct IR_tx get_ir_tx(struct IR ir)
	286	+{
	287	+ struct IR_tx *tx;
	288	+
	289	+ spin_lock(&ir->tx_ref_lock);
	290	+ tx = ir->tx;
	291	+ if (tx != NULL)
	292	+ kref_get(&tx->ref);
	293	+ spin_unlock(&ir->tx_ref_lock);
	294	+ return tx;
	295	+}
	296	+
	297	+static void release_ir_tx(struct kref *ref)
	298	+{
	299	+ struct IR_tx *tx = container_of(ref, struct IR_tx, ref);
	300	+ struct IR *ir = tx->ir;
	301	+
	302	+ ir->l.features &= ~LIRC_CAN_SEND_PULSE;
	303	+ /* Don't put_ir_device(tx->ir) here, so our lock doesn't get freed */
	304	+ ir->tx = NULL;
	305	+ kfree(tx);
	306	+}
	307	+
	308	+static int put_ir_tx(struct IR_tx *tx, bool ir_devices_lock_held)
	309	+{
	310	+ int released;
	311	+ struct IR *ir = tx->ir;
	312	+
	313	+ spin_lock(&ir->tx_ref_lock);
	314	+ released = kref_put(&tx->ref, release_ir_tx);
	315	+ spin_unlock(&ir->tx_ref_lock);
	316	+ /* Do a reference put() for the tx->ir reference, if we released tx */
	317	+ if (released)
	318	+ put_ir_device(ir, ir_devices_lock_held);
	319	+ return released;
	320	+}
	321	+
149	322	static int add_to_buf(struct IR *ir)
150	323	{
151	324	__u16 code;
@@ -156,23 +329,29 @@ static int add_to_buf(struct IR *ir) · 4 unmodified lines
156	329	int failures = 0;
157	330	unsigned char sendbuf[1] = { 0 };
158	331	struct lirc_buffer *rbuf = ir->l.rbuf;
159		− struct IR_rx *rx = ir->rx;
160		−
161		− if (rx == NULL)
162		− return -ENXIO;
	332	+ struct IR_rx *rx;
	333	+ struct IR_tx *tx;
163	334
164	335	if (lirc_buffer_full(rbuf)) {
165	336	dprintk("buffer overflow\n");
166	337	return -EOVERFLOW;
167	338	}
168	339
	340	+ rx = get_ir_rx(ir);
	341	+ if (rx == NULL)
	342	+ return -ENXIO;
	343	+
	344	+ tx = get_ir_tx(ir);
	345	+
169	346	/*
170	347	* service the device as long as it is returning
171	348	* data and we have space
172	349	*/
173	350	do {
174		− if (kthread_should_stop())
175		− return -ENODATA;
	351	+ if (kthread_should_stop()) {
	352	+ ret = -ENODATA;
	353	+ break;
	354	+ }
176	355
177	356	/*
178	357	* Lock i2c bus for the duration. RX/TX chips interfere so
@@ -182,7 +361,8 @@ static int add_to_buf(struct IR *ir) · 3 unmodified lines
182	361
183	362	if (kthread_should_stop()) {
184	363	mutex_unlock(&ir->ir_lock);
185		− return -ENODATA;
	364	+ ret = -ENODATA;
	365	+ break;
186	366	}
187	367
188	368	/*
@@ -196,7 +376,7 @@ static int add_to_buf(struct IR *ir) · 7 unmodified lines
196	376	mutex_unlock(&ir->ir_lock);
197	377	zilog_error("unable to read from the IR chip "
198	378	"after 3 resets, giving up\n");
199		− return ret;
	379	+ break;
200	380	}
201	381
202	382	/* Looks like the chip crashed, reset it */
@@ -206,20 +386,23 @@ static int add_to_buf(struct IR *ir) · 3 unmodified lines
206	386	set_current_state(TASK_UNINTERRUPTIBLE);
207	387	if (kthread_should_stop()) {
208	388	mutex_unlock(&ir->ir_lock);
209		− return -ENODATA;
	389	+ ret = -ENODATA;
	390	+ break;
210	391	}
211	392	schedule_timeout((100 * HZ + 999) / 1000);
212		− if (ir->tx != NULL)
213		− ir->tx->need_boot = 1;
	393	+ if (tx != NULL)
	394	+ tx->need_boot = 1;
214	395
215	396	++failures;
216	397	mutex_unlock(&ir->ir_lock);
	398	+ ret = 0;
217	399	continue;
218	400	}
219	401
220	402	if (kthread_should_stop()) {
221	403	mutex_unlock(&ir->ir_lock);
222		− return -ENODATA;
	404	+ ret = -ENODATA;
	405	+ break;
223	406	}
224	407	ret = i2c_master_recv(rx->c, keybuf, sizeof(keybuf));
225	408	mutex_unlock(&ir->ir_lock);
@@ -235,12 +418,17 @@ static int add_to_buf(struct IR *ir) · 9 unmodified lines
235	418
236	419	/* key pressed ? */
237	420	if (rx->hdpvr_data_fmt) {
238		− if (got_data && (keybuf[0] == 0x80))
239		− return 0;
240		− else if (got_data && (keybuf[0] == 0x00))
241		− return -ENODATA;
242		− } else if ((rx->b[0] & 0x80) == 0)
243		− return got_data ? 0 : -ENODATA;
	421	+ if (got_data && (keybuf[0] == 0x80)) {
	422	+ ret = 0;
	423	+ break;
	424	+ } else if (got_data && (keybuf[0] == 0x00)) {
	425	+ ret = -ENODATA;
	426	+ break;
	427	+ }
	428	+ } else if ((rx->b[0] & 0x80) == 0) {
	429	+ ret = got_data ? 0 : -ENODATA;
	430	+ break;
	431	+ }
244	432
245	433	/* look what we have */
246	434	code = (((__u16)rx->b[0] & 0x7f) << 6) \| (rx->b[1] >> 2);
@@ -251,9 +439,13 @@ static int add_to_buf(struct IR *ir) · 4 unmodified lines
251	439	/* return it */
252	440	lirc_buffer_write(rbuf, codes);
253	441	++got_data;
	442	+ ret = 0;
254	443	} while (!lirc_buffer_full(rbuf));
255	444
256		− return 0;
	445	+ if (tx != NULL)
	446	+ put_ir_tx(tx, false);
	447	+ put_ir_rx(rx, false);
	448	+ return ret;
257	449	}
258	450
259	451	/*
@@ -274,14 +466,14 @@ static int lirc_thread(void *arg) · 14 unmodified lines
274	466	dprintk("poll thread started\n");
275	467
276	468	while (!kthread_should_stop()) {
277		− set_current_state(TASK_INTERRUPTIBLE);
278		−
279	469	/* if device not opened, we can sleep half a second */
280	470	if (atomic_read(&ir->open_count) == 0) {
281	471	schedule_timeout(HZ/2);
282	472	continue;
283	473	}
284	474
	475	+ set_current_state(TASK_INTERRUPTIBLE);
	476	+
285	477	/*
286	478	* This is ~1132 + 24 + jitter (2repeat gap + code length).
287	479	* We use this interval as the chip resets every time you poll
@@ -564,7 +756,7 @@ static int fw_load(struct IR_tx *tx) · 276 unmodified lines
564	756	}
565	757
566	758	/* Request codeset data file */
567		− ret = request_firmware(&fw_entry, "haup-ir-blaster.bin", &tx->c->dev);
	759	+ ret = request_firmware(&fw_entry, "haup-ir-blaster.bin", tx->ir->l.dev);
568	760	if (ret != 0) {
569	761	zilog_error("firmware haup-ir-blaster.bin not available "
570	762	"(%d)\n", ret);
@@ -690,45 +882,26 @@ out: · 119 unmodified lines
690	882	return ret;
691	883	}
692	884
693		−/* initialise the IR TX device */
694		−static int tx_init(struct IR_tx *tx)
695		−{
696		− int ret;
697		−
698		− /* Load 'firmware' */
699		− ret = fw_load(tx);
700		− if (ret != 0)
701		− return ret;
702		−
703		− /* Send boot block */
704		− ret = send_boot_data(tx);
705		− if (ret != 0)
706		− return ret;
707		− tx->need_boot = 0;
708		−
709		− /* Looks good */
710		− return 0;
711		−}
712		−
713	885	/* copied from lirc_dev */
714	886	static ssize_t read(struct file filep, char outbuf, size_t n, loff_t *ppos)
715	887	{
716	888	struct IR *ir = filep->private_data;
717		− struct IR_rx *rx = ir->rx;
	889	+ struct IR_rx *rx;
718	890	struct lirc_buffer *rbuf = ir->l.rbuf;
719	891	int ret = 0, written = 0;
720	892	unsigned int m;
721	893	DECLARE_WAITQUEUE(wait, current);
722	894
723	895	dprintk("read called\n");
724		− if (rx == NULL)
725		− return -ENODEV;
726		−
727	896	if (n % rbuf->chunk_size) {
728	897	dprintk("read result = -EINVAL\n");
729	898	return -EINVAL;
730	899	}
731	900
	901	+ rx = get_ir_rx(ir);
	902	+ if (rx == NULL)
	903	+ return -ENXIO;
	904	+
732	905	/*
733	906	* we add ourselves to the task queue before buffer check
734	907	* to avoid losing scan code (in case when queue is awaken somewhere
@@ -773,6 +946,7 @@ static ssize_t read(struct file filep, char outbuf, size_t n, loff_t *ppos) · 38 unmodified lines
773	946	}
774	947
775	948	remove_wait_queue(&rbuf->wait_poll, &wait);
	949	+ put_ir_rx(rx, false);
776	950	set_current_state(TASK_RUNNING);
777	951
778	952	dprintk("read result = %d (%s)\n", ret, ret ? "Error" : "OK");
@@ -902,17 +1076,19 @@ static ssize_t write(struct file filep, const char buf, size_t n, · 123 unmodified lines
902	1076	loff_t *ppos)
903	1077	{
904	1078	struct IR *ir = filep->private_data;
905		− struct IR_tx *tx = ir->tx;
	1079	+ struct IR_tx *tx;
906	1080	size_t i;
907	1081	int failures = 0;
908	1082
909		− if (tx == NULL)
910		− return -ENODEV;
911		−
912	1083	/* Validate user parameters */
913	1084	if (n % sizeof(int))
914	1085	return -EINVAL;
915	1086
	1087	+ /* Get a struct IR_tx reference */
	1088	+ tx = get_ir_tx(ir);
	1089	+ if (tx == NULL)
	1090	+ return -ENXIO;
	1091	+
916	1092	/* Lock i2c bus for the duration */
917	1093	mutex_lock(&ir->ir_lock);
918	1094
@@ -923,11 +1099,22 @@ static ssize_t write(struct file filep, const char buf, size_t n, · 4 unmodified lines
923	1099
924	1100	if (copy_from_user(&command, buf + i, sizeof(command))) {
925	1101	mutex_unlock(&ir->ir_lock);
	1102	+ put_ir_tx(tx, false);
926	1103	return -EFAULT;
927	1104	}
928	1105
929	1106	/* Send boot data first if required */
930	1107	if (tx->need_boot == 1) {
	1108	+ /* Make sure we have the 'firmware' loaded, first */
	1109	+ ret = fw_load(tx);
	1110	+ if (ret != 0) {
	1111	+ mutex_unlock(&ir->ir_lock);
	1112	+ put_ir_tx(tx, false);
	1113	+ if (ret != -ENOMEM)
	1114	+ ret = -EIO;
	1115	+ return ret;
	1116	+ }
	1117	+ /* Prep the chip for transmitting codes */
931	1118	ret = send_boot_data(tx);
932	1119	if (ret == 0)
933	1120	tx->need_boot = 0;
@@ -939,6 +1126,7 @@ static ssize_t write(struct file filep, const char buf, size_t n, · 5 unmodified lines
939	1126	(unsigned)command & 0xFFFF);
940	1127	if (ret == -EPROTO) {
941	1128	mutex_unlock(&ir->ir_lock);
	1129	+ put_ir_tx(tx, false);
942	1130	return ret;
943	1131	}
944	1132	}
@@ -956,6 +1144,7 @@ static ssize_t write(struct file filep, const char buf, size_t n, · 11 unmodified lines
956	1144	zilog_error("unable to send to the IR chip "
957	1145	"after 3 resets, giving up\n");
958	1146	mutex_unlock(&ir->ir_lock);
	1147	+ put_ir_tx(tx, false);
959	1148	return ret;
960	1149	}
961	1150	set_current_state(TASK_UNINTERRUPTIBLE);
@@ -969,6 +1158,9 @@ static ssize_t write(struct file filep, const char buf, size_t n, · 7 unmodified lines
969	1158	/* Release i2c bus */
970	1159	mutex_unlock(&ir->ir_lock);
971	1160
	1161	+ /* Give back our struct IR_tx reference */
	1162	+ put_ir_tx(tx, false);
	1163	+
972	1164	/* All looks good */
973	1165	return n;
974	1166	}
@@ -977,12 +1169,13 @@ static ssize_t write(struct file filep, const char buf, size_t n, · 2 unmodified lines
977	1169	static unsigned int poll(struct file filep, poll_table wait)
978	1170	{
979	1171	struct IR *ir = filep->private_data;
980		− struct IR_rx *rx = ir->rx;
	1172	+ struct IR_rx *rx;
981	1173	struct lirc_buffer *rbuf = ir->l.rbuf;
982	1174	unsigned int ret;
983	1175
984	1176	dprintk("poll called\n");
985	1177
	1178	+ rx = get_ir_rx(ir);
986	1179	if (rx == NULL) {
987	1180	/*
988	1181	* Revisit this, if our poll function ever reports writeable
@@ -1009,12 +1202,9 @@ static long ioctl(struct file *filep, unsigned int cmd, unsigned long arg) · 20 unmodified lines
1009	1202	{
1010	1203	struct IR *ir = filep->private_data;
1011	1204	int result;
1012		− unsigned long mode, features = 0;
	1205	+ unsigned long mode, features;
1013	1206
1014		− if (ir->rx != NULL)
1015		− features \|= LIRC_CAN_REC_LIRCCODE;
1016		− if (ir->tx != NULL)
1017		− features \|= LIRC_CAN_SEND_PULSE;
	1207	+ features = ir->l.features;
1018	1208
1019	1209	switch (cmd) {
1020	1210	case LIRC_GET_LENGTH:
@@ -1060,19 +1250,24 @@ static long ioctl(struct file *filep, unsigned int cmd, unsigned long arg) · 39 unmodified lines
1060	1250	return result;
1061	1251	}
1062	1252
1063		−/* ir_devices_lock must be held */
1064		−static struct IR *find_ir_device_by_minor(unsigned int minor)
	1253	+static struct IR *get_ir_device_by_minor(unsigned int minor)
1065	1254	{
1066	1255	struct IR *ir;
	1256	+ struct IR *ret = NULL;
1067	1257
1068		− if (list_empty(&ir_devices_list))
1069		− return NULL;
	1258	+ mutex_lock(&ir_devices_lock);
1070	1259
1071		− list_for_each_entry(ir, &ir_devices_list, list)
1072		− if (ir->l.minor == minor)
1073		− return ir;
	1260	+ if (!list_empty(&ir_devices_list)) {
	1261	+ list_for_each_entry(ir, &ir_devices_list, list) {
	1262	+ if (ir->l.minor == minor) {
	1263	+ ret = get_ir_device(ir, true);
	1264	+ break;
	1265	+ }
	1266	+ }
	1267	+ }
1074	1268
1075		− return NULL;
	1269	+ mutex_unlock(&ir_devices_lock);
	1270	+ return ret;
1076	1271	}
1077	1272
1078	1273	/*
@@ -1085,9 +1280,7 @@ static int open(struct inode node, struct file filep) · 6 unmodified lines
1085	1280	unsigned int minor = MINOR(node->i_rdev);
1086	1281
1087	1282	/* find our IR struct */
1088		− mutex_lock(&ir_devices_lock);
1089		− ir = find_ir_device_by_minor(minor);
1090		− mutex_unlock(&ir_devices_lock);
	1283	+ ir = get_ir_device_by_minor(minor);
1091	1284
1092	1285	if (ir == NULL)
1093	1286	return -ENODEV;
@@ -1113,6 +1306,7 @@ static int close(struct inode node, struct file filep) · 19 unmodified lines
1113	1306
1114	1307	atomic_dec(&ir->open_count);
1115	1308
	1309	+ put_ir_device(ir, false);
1116	1310	return 0;
1117	1311	}
1118	1312
@@ -1167,78 +1361,23 @@ static struct lirc_driver lirc_template = { · 48 unmodified lines
1167	1361	.owner = THIS_MODULE,
1168	1362	};
1169	1363
1170		−static void destroy_rx_kthread(struct IR_rx *rx)
1171		−{
1172		− /* end up polling thread */
1173		− if (rx != NULL && !IS_ERR_OR_NULL(rx->task)) {
1174		− kthread_stop(rx->task);
1175		− rx->task = NULL;
1176		− }
1177		−}
1178		−
1179		−/* ir_devices_lock must be held */
1180		−static int add_ir_device(struct IR *ir)
1181		−{
1182		− list_add_tail(&ir->list, &ir_devices_list);
1183		− return 0;
1184		−}
1185		−
1186		−/* ir_devices_lock must be held */
1187		−static void del_ir_device(struct IR *ir)
1188		−{
1189		− struct IR *p;
1190		−
1191		− if (list_empty(&ir_devices_list))
1192		− return;
1193		−
1194		− list_for_each_entry(p, &ir_devices_list, list)
1195		− if (p == ir) {
1196		− list_del(&p->list);
1197		− break;
1198		− }
1199		−}
1200		−
1201	1364	static int ir_remove(struct i2c_client *client)
1202	1365	{
1203		− struct IR *ir = i2c_get_clientdata(client);
1204		−
1205		− mutex_lock(&ir_devices_lock);
1206		−
1207		− if (ir == NULL) {
1208		− /* We destroyed everything when the first client came through */
1209		− mutex_unlock(&ir_devices_lock);
1210		− return 0;
	1366	+ if (strncmp("ir_tx_z8", client->name, 8) == 0) {
	1367	+ struct IR_tx *tx = i2c_get_clientdata(client);
	1368	+ if (tx != NULL)
	1369	+ put_ir_tx(tx, false);
	1370	+ } else if (strncmp("ir_rx_z8", client->name, 8) == 0) {
	1371	+ struct IR_rx *rx = i2c_get_clientdata(client);
	1372	+ if (rx != NULL)
	1373	+ put_ir_rx(rx, false);
1211	1374	}
1212		−
1213		− /* Good-bye LIRC */
1214		− lirc_unregister_driver(ir->l.minor);
1215		−
1216		− /* Good-bye Rx */
1217		− destroy_rx_kthread(ir->rx);
1218		− if (ir->rx != NULL) {
1219		− i2c_set_clientdata(ir->rx->c, NULL);
1220		− kfree(ir->rx);
1221		− }
1222		−
1223		− /* Good-bye Tx */
1224		− if (ir->tx != NULL) {
1225		− i2c_set_clientdata(ir->tx->c, NULL);
1226		− kfree(ir->tx);
1227		− }
1228		−
1229		− /* Good-bye IR */
1230		− if (ir->rbuf.fifo_initialized)
1231		− lirc_buffer_free(&ir->rbuf);
1232		− del_ir_device(ir);
1233		− kfree(ir);
1234		−
1235		− mutex_unlock(&ir_devices_lock);
1236	1375	return 0;
1237	1376	}
1238	1377
1239	1378
1240	1379	/* ir_devices_lock must be held */
1241		−static struct IR find_ir_device_by_adapter(struct i2c_adapter adapter)
	1380	+static struct IR get_ir_device_by_adapter(struct i2c_adapter adapter)
1242	1381	{
1243	1382	struct IR *ir;
1244	1383
@@ -1246,8 +1385,10 @@ static struct IR find_ir_device_by_adapter(struct i2c_adapter adapter) · 1 unmodified line
1246	1385	return NULL;
1247	1386
1248	1387	list_for_each_entry(ir, &ir_devices_list, list)
1249		− if (ir->adapter == adapter)
	1388	+ if (ir->adapter == adapter) {
	1389	+ get_ir_device(ir, true);
1250	1390	return ir;
	1391	+ }
1251	1392
1252	1393	return NULL;
1253	1394	}
@@ -1255,6 +1396,8 @@ static struct IR find_ir_device_by_adapter(struct i2c_adapter adapter) · 1 unmodified line
1255	1396	static int ir_probe(struct i2c_client client, const struct i2c_device_id id)
1256	1397	{
1257	1398	struct IR *ir;
	1399	+ struct IR_tx *tx;
	1400	+ struct IR_rx *rx;
1258	1401	struct i2c_adapter *adap = client->adapter;
1259	1402	int ret;
1260	1403	bool tx_probe = false;
@@ -1278,133 +1421,166 @@ static int ir_probe(struct i2c_client client, const struct i2c_device_id id) · 17 unmodified lines
1278	1421	mutex_lock(&ir_devices_lock);
1279	1422
1280	1423	/* Use a single struct IR instance for both the Rx and Tx functions */
1281		− ir = find_ir_device_by_adapter(adap);
	1424	+ ir = get_ir_device_by_adapter(adap);
1282	1425	if (ir == NULL) {
1283	1426	ir = kzalloc(sizeof(struct IR), GFP_KERNEL);
1284	1427	if (ir == NULL) {
1285	1428	ret = -ENOMEM;
1286	1429	goto out_no_ir;
1287	1430	}
	1431	+ kref_init(&ir->ref);
	1432	+
1288	1433	/* store for use in ir_probe() again, and open() later on */
1289	1434	INIT_LIST_HEAD(&ir->list);
1290		− ret = add_ir_device(ir);
1291		− if (ret)
1292		− goto out_free_ir;
	1435	+ list_add_tail(&ir->list, &ir_devices_list);
1293	1436
1294	1437	ir->adapter = adap;
1295	1438	mutex_init(&ir->ir_lock);
1296	1439	atomic_set(&ir->open_count, 0);
	1440	+ spin_lock_init(&ir->tx_ref_lock);
	1441	+ spin_lock_init(&ir->rx_ref_lock);
1297	1442
1298	1443	/* set lirc_dev stuff */
1299	1444	memcpy(&ir->l, &lirc_template, sizeof(struct lirc_driver));
1300		− ir->l.minor = minor; /* module option */
1301		− ir->l.rbuf = &ir->rbuf;
1302		− ir->l.data = ir;
1303		− ir->l.dev = &adap->dev;
	1445	+ /*
	1446	+ * FIXME this is a pointer reference to us, but no refcount.
	1447	+ *
	1448	+ * This OK for now, since lirc_dev currently won't touch this
	1449	+ * buffer as we provide our own lirc_fops.
	1450	+ *
	1451	+ * Currently our own lirc_fops rely on this ir->l.rbuf pointer
	1452	+ */
	1453	+ ir->l.rbuf = &ir->rbuf;
	1454	+ ir->l.dev = &adap->dev;
1304	1455	ret = lirc_buffer_init(ir->l.rbuf,
1305	1456	ir->l.chunk_size, ir->l.buffer_size);
1306	1457	if (ret)
1307		− goto out_free_ir;
	1458	+ goto out_put_ir;
1308	1459	}
1309	1460
1310	1461	if (tx_probe) {
	1462	+ /* Get the IR_rx instance for later, if already allocated */
	1463	+ rx = get_ir_rx(ir);
	1464	+
1311	1465	/* Set up a struct IR_tx instance */
1312		− ir->tx = kzalloc(sizeof(struct IR_tx), GFP_KERNEL);
1313		− if (ir->tx == NULL) {
	1466	+ tx = kzalloc(sizeof(struct IR_tx), GFP_KERNEL);
	1467	+ if (tx == NULL) {
1314	1468	ret = -ENOMEM;
1315		− goto out_free_xx;
	1469	+ goto out_put_xx;
1316	1470	}
	1471	+ kref_init(&tx->ref);
	1472	+ ir->tx = tx;
1317	1473
1318	1474	ir->l.features \|= LIRC_CAN_SEND_PULSE;
1319		− ir->tx->c = client;
1320		− ir->tx->need_boot = 1;
1321		− ir->tx->post_tx_ready_poll =
	1475	+ tx->c = client;
	1476	+ tx->need_boot = 1;
	1477	+ tx->post_tx_ready_poll =
1322	1478	(id->driver_data & ID_FLAG_HDPVR) ? false : true;
	1479	+
	1480	+ /* An ir ref goes to the struct IR_tx instance */
	1481	+ tx->ir = get_ir_device(ir, true);
	1482	+
	1483	+ /* A tx ref goes to the i2c_client */
	1484	+ i2c_set_clientdata(client, get_ir_tx(ir));
	1485	+
	1486	+ /*
	1487	+ * Load the 'firmware'. We do this before registering with
	1488	+ * lirc_dev, so the first firmware load attempt does not happen
	1489	+ * after a open() or write() call on the device.
	1490	+ *
	1491	+ * Failure here is not deemed catastrophic, so the receiver will
	1492	+ * still be usable. Firmware load will be retried in write(),
	1493	+ * if it is needed.
	1494	+ */
	1495	+ fw_load(tx);
	1496	+
	1497	+ /* Proceed only if the Rx client is also ready or not needed */
	1498	+ if (rx == NULL && !tx_only) {
	1499	+ zilog_info("probe of IR Tx on %s (i2c-%d) done. Waiting"
	1500	+ " on IR Rx.\n", adap->name, adap->nr);
	1501	+ goto out_ok;
	1502	+ }
1323	1503	} else {
	1504	+ /* Get the IR_tx instance for later, if already allocated */
	1505	+ tx = get_ir_tx(ir);
	1506	+
1324	1507	/* Set up a struct IR_rx instance */
1325		− ir->rx = kzalloc(sizeof(struct IR_rx), GFP_KERNEL);
1326		− if (ir->rx == NULL) {
	1508	+ rx = kzalloc(sizeof(struct IR_rx), GFP_KERNEL);
	1509	+ if (rx == NULL) {
1327	1510	ret = -ENOMEM;
1328		− goto out_free_xx;
	1511	+ goto out_put_xx;
1329	1512	}
	1513	+ kref_init(&rx->ref);
	1514	+ ir->rx = rx;
1330	1515
1331	1516	ir->l.features \|= LIRC_CAN_REC_LIRCCODE;
1332		− ir->rx->c = client;
1333		− ir->rx->hdpvr_data_fmt =
	1517	+ rx->c = client;
	1518	+ rx->hdpvr_data_fmt =
1334	1519	(id->driver_data & ID_FLAG_HDPVR) ? true : false;
1335		− }
1336	1520
1337		− i2c_set_clientdata(client, ir);
	1521	+ /* An ir ref goes to the struct IR_rx instance */
	1522	+ rx->ir = get_ir_device(ir, true);
1338	1523
1339		− /* Proceed only if we have the required Tx and Rx clients ready to go */
1340		− if (ir->tx == NULL \|\|
1341		− (ir->rx == NULL && !tx_only)) {
1342		− zilog_info("probe of IR %s on %s (i2c-%d) done. Waiting on "
1343		− "IR %s.\n", tx_probe ? "Tx" : "Rx", adap->name,
1344		− adap->nr, tx_probe ? "Rx" : "Tx");
1345		− goto out_ok;
1346		− }
	1524	+ /* An rx ref goes to the i2c_client */
	1525	+ i2c_set_clientdata(client, get_ir_rx(ir));
1347	1526
1348		− /* initialise RX device */
1349		− if (ir->rx != NULL) {
1350		− /* try to fire up polling thread */
1351		− ir->rx->task = kthread_run(lirc_thread, ir,
1352		− "zilog-rx-i2c-%d", adap->nr);
1353		− if (IS_ERR(ir->rx->task)) {
1354		− ret = PTR_ERR(ir->rx->task);
	1527	+ /*
	1528	+ * Start the polling thread.
	1529	+ * It will only perform an empty loop around schedule_timeout()
	1530	+ * until we register with lirc_dev and the first user open()
	1531	+ */
	1532	+ /* An ir ref goes to the new rx polling kthread */
	1533	+ rx->task = kthread_run(lirc_thread, get_ir_device(ir, true),
	1534	+ "zilog-rx-i2c-%d", adap->nr);
	1535	+ if (IS_ERR(rx->task)) {
	1536	+ ret = PTR_ERR(rx->task);
1355	1537	zilog_error("%s: could not start IR Rx polling thread"
1356	1538	"\n", __func__);
1357		− goto out_free_xx;
	1539	+ /* Failed kthread, so put back the ir ref */
	1540	+ put_ir_device(ir, true);
	1541	+ /* Failure exit, so put back rx ref from i2c_client */
	1542	+ i2c_set_clientdata(client, NULL);
	1543	+ put_ir_rx(rx, true);
	1544	+ ir->l.features &= ~LIRC_CAN_REC_LIRCCODE;
	1545	+ goto out_put_xx;
	1546	+ }
	1547	+
	1548	+ /* Proceed only if the Tx client is also ready */
	1549	+ if (tx == NULL) {
	1550	+ zilog_info("probe of IR Rx on %s (i2c-%d) done. Waiting"
	1551	+ " on IR Tx.\n", adap->name, adap->nr);
	1552	+ goto out_ok;
1358	1553	}
1359	1554	}
1360	1555
1361	1556	/* register with lirc */
	1557	+ ir->l.minor = minor; /* module option: user requested minor number */
1362	1558	ir->l.minor = lirc_register_driver(&ir->l);
1363	1559	if (ir->l.minor < 0 \|\| ir->l.minor >= MAX_IRCTL_DEVICES) {
1364	1560	zilog_error("%s: \"minor\" must be between 0 and %d (%d)!\n",
1365	1561	__func__, MAX_IRCTL_DEVICES-1, ir->l.minor);
1366	1562	ret = -EBADRQC;
1367		− goto out_free_thread;
1368		− }
1369		−
1370		− /*
1371		− * if we have the tx device, load the 'firmware'. We do this
1372		− * after registering with lirc as otherwise hotplug seems to take
1373		− * 10s to create the lirc device.
1374		− */
1375		− if (ir->tx != NULL) {
1376		− /* Special TX init */
1377		− ret = tx_init(ir->tx);
1378		− if (ret != 0)
1379		− goto out_unregister;
	1563	+ goto out_put_xx;
1380	1564	}
1381	1565
	1566	+out_ok:
	1567	+ if (rx != NULL)
	1568	+ put_ir_rx(rx, true);
	1569	+ if (tx != NULL)
	1570	+ put_ir_tx(tx, true);
	1571	+ put_ir_device(ir, true);
1382	1572	zilog_info("probe of IR %s on %s (i2c-%d) done. IR unit ready.\n",
1383	1573	tx_probe ? "Tx" : "Rx", adap->name, adap->nr);
1384		−out_ok:
1385	1574	mutex_unlock(&ir_devices_lock);
1386	1575	return 0;
1387	1576
1388		−out_unregister:
1389		− lirc_unregister_driver(ir->l.minor);
1390		−out_free_thread:
1391		− destroy_rx_kthread(ir->rx);
1392		−out_free_xx:
1393		− if (ir->rx != NULL) {
1394		− if (ir->rx->c != NULL)
1395		− i2c_set_clientdata(ir->rx->c, NULL);
1396		− kfree(ir->rx);
1397		− }
1398		− if (ir->tx != NULL) {
1399		− if (ir->tx->c != NULL)
1400		− i2c_set_clientdata(ir->tx->c, NULL);
1401		− kfree(ir->tx);
1402		− }
1403		− if (ir->rbuf.fifo_initialized)
1404		− lirc_buffer_free(&ir->rbuf);
1405		−out_free_ir:
1406		− del_ir_device(ir);
1407		− kfree(ir);
	1577	+out_put_xx:
	1578	+ if (rx != NULL)
	1579	+ put_ir_rx(rx, true);
	1580	+ if (tx != NULL)
	1581	+ put_ir_tx(tx, true);
	1582	+out_put_ir:
	1583	+ put_ir_device(ir, true);
1408	1584	out_no_ir:
1409	1585	zilog_error("%s: probing IR %s on %s (i2c-%d) failed with %d\n",
1410	1586	__func__, tx_probe ? "Tx" : "Rx", adap->name, adap->nr,