1/*****************************************************************************/
   2
   3/*
   4 *      devio.c  --  User space communication with USB devices.
   5 *
   6 *      Copyright (C) 1999-2000  Thomas Sailer (sailer@ife.ee.ethz.ch)
   7 *
   8 *      This program is free software; you can redistribute it and/or modify
   9 *      it under the terms of the GNU General Public License as published by
  10 *      the Free Software Foundation; either version 2 of the License, or
  11 *      (at your option) any later version.
  12 *
  13 *      This program is distributed in the hope that it will be useful,
  14 *      but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 *      GNU General Public License for more details.
  17 *
  18 *      You should have received a copy of the GNU General Public License
  19 *      along with this program; if not, write to the Free Software
  20 *      Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 *
  22 *  This file implements the usbfs/x/y files, where
  23 *  x is the bus number and y the device number.
  24 *
  25 *  It allows user space programs/"drivers" to communicate directly
  26 *  with USB devices without intervening kernel driver.
  27 *
  28 *  Revision history
  29 *    22.12.1999   0.1   Initial release (split from proc_usb.c)
  30 *    04.01.2000   0.2   Turned into its own filesystem
  31 *    30.09.2005   0.3   Fix user-triggerable oops in async URB delivery
  32 *    			 (CAN-2005-3055)
  33 */
  34
  35/*****************************************************************************/
  36
  37#include <linux/fs.h>
  38#include <linux/mm.h>
 
  39#include <linux/slab.h>
  40#include <linux/signal.h>
  41#include <linux/poll.h>
  42#include <linux/module.h>
  43#include <linux/string.h>
  44#include <linux/usb.h>
  45#include <linux/usbdevice_fs.h>
  46#include <linux/usb/hcd.h>	/* for usbcore internals */
  47#include <linux/cdev.h>
  48#include <linux/notifier.h>
  49#include <linux/security.h>
  50#include <linux/user_namespace.h>
  51#include <linux/scatterlist.h>
  52#include <linux/uaccess.h>
  53#include <linux/dma-mapping.h>
  54#include <asm/byteorder.h>
  55#include <linux/moduleparam.h>
  56
  57#include "usb.h"
  58
 
 
 
 
 
 
  59#define USB_MAXBUS			64
  60#define USB_DEVICE_MAX			(USB_MAXBUS * 128)
  61#define USB_SG_SIZE			16384 /* split-size for large txs */
  62
  63/* Mutual exclusion for removal, open, and release */
  64DEFINE_MUTEX(usbfs_mutex);
  65
  66struct usb_dev_state {
  67	struct list_head list;      /* state list */
  68	struct usb_device *dev;
  69	struct file *file;
  70	spinlock_t lock;            /* protects the async urb lists */
  71	struct list_head async_pending;
  72	struct list_head async_completed;
  73	struct list_head memory_list;
  74	wait_queue_head_t wait;     /* wake up if a request completed */
 
  75	unsigned int discsignr;
  76	struct pid *disc_pid;
  77	const struct cred *cred;
  78	void __user *disccontext;
  79	unsigned long ifclaimed;
  80	u32 secid;
  81	u32 disabled_bulk_eps;
  82	bool privileges_dropped;
  83	unsigned long interface_allowed_mask;
 
 
 
  84};
  85
  86struct usb_memory {
  87	struct list_head memlist;
  88	int vma_use_count;
  89	int urb_use_count;
  90	u32 size;
  91	void *mem;
  92	dma_addr_t dma_handle;
  93	unsigned long vm_start;
  94	struct usb_dev_state *ps;
  95};
  96
  97struct async {
  98	struct list_head asynclist;
  99	struct usb_dev_state *ps;
 100	struct pid *pid;
 101	const struct cred *cred;
 102	unsigned int signr;
 103	unsigned int ifnum;
 104	void __user *userbuffer;
 105	void __user *userurb;
 
 106	struct urb *urb;
 107	struct usb_memory *usbm;
 108	unsigned int mem_usage;
 109	int status;
 110	u32 secid;
 111	u8 bulk_addr;
 112	u8 bulk_status;
 113};
 114
 115static bool usbfs_snoop;
 116module_param(usbfs_snoop, bool, S_IRUGO | S_IWUSR);
 117MODULE_PARM_DESC(usbfs_snoop, "true to log all usbfs traffic");
 118
 119static unsigned usbfs_snoop_max = 65536;
 120module_param(usbfs_snoop_max, uint, S_IRUGO | S_IWUSR);
 121MODULE_PARM_DESC(usbfs_snoop_max,
 122		"maximum number of bytes to print while snooping");
 123
 124#define snoop(dev, format, arg...)				\
 125	do {							\
 126		if (usbfs_snoop)				\
 127			dev_info(dev, format, ## arg);		\
 128	} while (0)
 129
 130enum snoop_when {
 131	SUBMIT, COMPLETE
 132};
 133
 134#define USB_DEVICE_DEV		MKDEV(USB_DEVICE_MAJOR, 0)
 135
 136/* Limit on the total amount of memory we can allocate for transfers */
 137static unsigned usbfs_memory_mb = 16;
 138module_param(usbfs_memory_mb, uint, 0644);
 139MODULE_PARM_DESC(usbfs_memory_mb,
 140		"maximum MB allowed for usbfs buffers (0 = no limit)");
 141
 142/* Hard limit, necessary to avoid arithmetic overflow */
 143#define USBFS_XFER_MAX		(UINT_MAX / 2 - 1000000)
 144
 145static atomic_t usbfs_memory_usage;	/* Total memory currently allocated */
 146
 147/* Check whether it's okay to allocate more memory for a transfer */
 148static int usbfs_increase_memory_usage(unsigned amount)
 149{
 150	unsigned lim;
 151
 152	/*
 153	 * Convert usbfs_memory_mb to bytes, avoiding overflows.
 154	 * 0 means use the hard limit (effectively unlimited).
 155	 */
 156	lim = ACCESS_ONCE(usbfs_memory_mb);
 157	if (lim == 0 || lim > (USBFS_XFER_MAX >> 20))
 158		lim = USBFS_XFER_MAX;
 159	else
 160		lim <<= 20;
 161
 162	atomic_add(amount, &usbfs_memory_usage);
 163	if (atomic_read(&usbfs_memory_usage) <= lim)
 164		return 0;
 165	atomic_sub(amount, &usbfs_memory_usage);
 166	return -ENOMEM;
 
 
 
 167}
 168
 169/* Memory for a transfer is being deallocated */
 170static void usbfs_decrease_memory_usage(unsigned amount)
 171{
 172	atomic_sub(amount, &usbfs_memory_usage);
 173}
 174
 175static int connected(struct usb_dev_state *ps)
 176{
 177	return (!list_empty(&ps->list) &&
 178			ps->dev->state != USB_STATE_NOTATTACHED);
 179}
 180
 181static void dec_usb_memory_use_count(struct usb_memory *usbm, int *count)
 182{
 183	struct usb_dev_state *ps = usbm->ps;
 184	unsigned long flags;
 185
 186	spin_lock_irqsave(&ps->lock, flags);
 187	--*count;
 188	if (usbm->urb_use_count == 0 && usbm->vma_use_count == 0) {
 189		list_del(&usbm->memlist);
 190		spin_unlock_irqrestore(&ps->lock, flags);
 191
 192		usb_free_coherent(ps->dev, usbm->size, usbm->mem,
 193				usbm->dma_handle);
 194		usbfs_decrease_memory_usage(
 195			usbm->size + sizeof(struct usb_memory));
 196		kfree(usbm);
 197	} else {
 198		spin_unlock_irqrestore(&ps->lock, flags);
 199	}
 200}
 201
 202static void usbdev_vm_open(struct vm_area_struct *vma)
 203{
 204	struct usb_memory *usbm = vma->vm_private_data;
 205	unsigned long flags;
 206
 207	spin_lock_irqsave(&usbm->ps->lock, flags);
 208	++usbm->vma_use_count;
 209	spin_unlock_irqrestore(&usbm->ps->lock, flags);
 210}
 211
 212static void usbdev_vm_close(struct vm_area_struct *vma)
 213{
 214	struct usb_memory *usbm = vma->vm_private_data;
 215
 216	dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
 217}
 218
 219struct vm_operations_struct usbdev_vm_ops = {
 220	.open = usbdev_vm_open,
 221	.close = usbdev_vm_close
 222};
 223
 224static int usbdev_mmap(struct file *file, struct vm_area_struct *vma)
 225{
 226	struct usb_memory *usbm = NULL;
 227	struct usb_dev_state *ps = file->private_data;
 
 228	size_t size = vma->vm_end - vma->vm_start;
 229	void *mem;
 230	unsigned long flags;
 231	dma_addr_t dma_handle;
 232	int ret;
 233
 234	ret = usbfs_increase_memory_usage(size + sizeof(struct usb_memory));
 235	if (ret)
 236		goto error;
 237
 238	usbm = kzalloc(sizeof(struct usb_memory), GFP_KERNEL);
 239	if (!usbm) {
 240		ret = -ENOMEM;
 241		goto error_decrease_mem;
 242	}
 243
 244	mem = usb_alloc_coherent(ps->dev, size, GFP_USER, &dma_handle);
 
 245	if (!mem) {
 246		ret = -ENOMEM;
 247		goto error_free_usbm;
 248	}
 249
 250	memset(mem, 0, size);
 251
 252	usbm->mem = mem;
 253	usbm->dma_handle = dma_handle;
 254	usbm->size = size;
 255	usbm->ps = ps;
 256	usbm->vm_start = vma->vm_start;
 257	usbm->vma_use_count = 1;
 258	INIT_LIST_HEAD(&usbm->memlist);
 259
 260	if (remap_pfn_range(vma, vma->vm_start,
 261			virt_to_phys(usbm->mem) >> PAGE_SHIFT,
 262			size, vma->vm_page_prot) < 0) {
 263		dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
 264		return -EAGAIN;
 
 
 
 
 
 
 
 
 265	}
 266
 267	vma->vm_flags |= VM_IO;
 268	vma->vm_flags |= (VM_DONTEXPAND | VM_DONTDUMP);
 269	vma->vm_ops = &usbdev_vm_ops;
 270	vma->vm_private_data = usbm;
 271
 272	spin_lock_irqsave(&ps->lock, flags);
 273	list_add_tail(&usbm->memlist, &ps->memory_list);
 274	spin_unlock_irqrestore(&ps->lock, flags);
 275
 276	return 0;
 277
 278error_free_usbm:
 279	kfree(usbm);
 280error_decrease_mem:
 281	usbfs_decrease_memory_usage(size + sizeof(struct usb_memory));
 282error:
 283	return ret;
 284}
 285
 286static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
 287			   loff_t *ppos)
 288{
 289	struct usb_dev_state *ps = file->private_data;
 290	struct usb_device *dev = ps->dev;
 291	ssize_t ret = 0;
 292	unsigned len;
 293	loff_t pos;
 294	int i;
 295
 296	pos = *ppos;
 297	usb_lock_device(dev);
 298	if (!connected(ps)) {
 299		ret = -ENODEV;
 300		goto err;
 301	} else if (pos < 0) {
 302		ret = -EINVAL;
 303		goto err;
 304	}
 305
 306	if (pos < sizeof(struct usb_device_descriptor)) {
 307		/* 18 bytes - fits on the stack */
 308		struct usb_device_descriptor temp_desc;
 309
 310		memcpy(&temp_desc, &dev->descriptor, sizeof(dev->descriptor));
 311		le16_to_cpus(&temp_desc.bcdUSB);
 312		le16_to_cpus(&temp_desc.idVendor);
 313		le16_to_cpus(&temp_desc.idProduct);
 314		le16_to_cpus(&temp_desc.bcdDevice);
 315
 316		len = sizeof(struct usb_device_descriptor) - pos;
 317		if (len > nbytes)
 318			len = nbytes;
 319		if (copy_to_user(buf, ((char *)&temp_desc) + pos, len)) {
 320			ret = -EFAULT;
 321			goto err;
 322		}
 323
 324		*ppos += len;
 325		buf += len;
 326		nbytes -= len;
 327		ret += len;
 328	}
 329
 330	pos = sizeof(struct usb_device_descriptor);
 331	for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {
 332		struct usb_config_descriptor *config =
 333			(struct usb_config_descriptor *)dev->rawdescriptors[i];
 334		unsigned int length = le16_to_cpu(config->wTotalLength);
 335
 336		if (*ppos < pos + length) {
 337
 338			/* The descriptor may claim to be longer than it
 339			 * really is.  Here is the actual allocated length. */
 340			unsigned alloclen =
 341				le16_to_cpu(dev->config[i].desc.wTotalLength);
 342
 343			len = length - (*ppos - pos);
 344			if (len > nbytes)
 345				len = nbytes;
 346
 347			/* Simply don't write (skip over) unallocated parts */
 348			if (alloclen > (*ppos - pos)) {
 349				alloclen -= (*ppos - pos);
 350				if (copy_to_user(buf,
 351				    dev->rawdescriptors[i] + (*ppos - pos),
 352				    min(len, alloclen))) {
 353					ret = -EFAULT;
 354					goto err;
 355				}
 356			}
 357
 358			*ppos += len;
 359			buf += len;
 360			nbytes -= len;
 361			ret += len;
 362		}
 363
 364		pos += length;
 365	}
 366
 367err:
 368	usb_unlock_device(dev);
 369	return ret;
 370}
 371
 372/*
 373 * async list handling
 374 */
 375
 376static struct async *alloc_async(unsigned int numisoframes)
 377{
 378	struct async *as;
 379
 380	as = kzalloc(sizeof(struct async), GFP_KERNEL);
 381	if (!as)
 382		return NULL;
 383	as->urb = usb_alloc_urb(numisoframes, GFP_KERNEL);
 384	if (!as->urb) {
 385		kfree(as);
 386		return NULL;
 387	}
 388	return as;
 389}
 390
 391static void free_async(struct async *as)
 392{
 393	int i;
 394
 395	put_pid(as->pid);
 396	if (as->cred)
 397		put_cred(as->cred);
 398	for (i = 0; i < as->urb->num_sgs; i++) {
 399		if (sg_page(&as->urb->sg[i]))
 400			kfree(sg_virt(&as->urb->sg[i]));
 401	}
 402
 403	kfree(as->urb->sg);
 404	if (as->usbm == NULL)
 405		kfree(as->urb->transfer_buffer);
 406	else
 407		dec_usb_memory_use_count(as->usbm, &as->usbm->urb_use_count);
 408
 409	kfree(as->urb->setup_packet);
 410	usb_free_urb(as->urb);
 411	usbfs_decrease_memory_usage(as->mem_usage);
 412	kfree(as);
 413}
 414
 415static void async_newpending(struct async *as)
 416{
 417	struct usb_dev_state *ps = as->ps;
 418	unsigned long flags;
 419
 420	spin_lock_irqsave(&ps->lock, flags);
 421	list_add_tail(&as->asynclist, &ps->async_pending);
 422	spin_unlock_irqrestore(&ps->lock, flags);
 423}
 424
 425static void async_removepending(struct async *as)
 426{
 427	struct usb_dev_state *ps = as->ps;
 428	unsigned long flags;
 429
 430	spin_lock_irqsave(&ps->lock, flags);
 431	list_del_init(&as->asynclist);
 432	spin_unlock_irqrestore(&ps->lock, flags);
 433}
 434
 435static struct async *async_getcompleted(struct usb_dev_state *ps)
 436{
 437	unsigned long flags;
 438	struct async *as = NULL;
 439
 440	spin_lock_irqsave(&ps->lock, flags);
 441	if (!list_empty(&ps->async_completed)) {
 442		as = list_entry(ps->async_completed.next, struct async,
 443				asynclist);
 444		list_del_init(&as->asynclist);
 445	}
 446	spin_unlock_irqrestore(&ps->lock, flags);
 447	return as;
 448}
 449
 450static struct async *async_getpending(struct usb_dev_state *ps,
 451					     void __user *userurb)
 452{
 453	struct async *as;
 454
 455	list_for_each_entry(as, &ps->async_pending, asynclist)
 456		if (as->userurb == userurb) {
 457			list_del_init(&as->asynclist);
 458			return as;
 459		}
 460
 461	return NULL;
 462}
 463
 464static void snoop_urb(struct usb_device *udev,
 465		void __user *userurb, int pipe, unsigned length,
 466		int timeout_or_status, enum snoop_when when,
 467		unsigned char *data, unsigned data_len)
 468{
 469	static const char *types[] = {"isoc", "int", "ctrl", "bulk"};
 470	static const char *dirs[] = {"out", "in"};
 471	int ep;
 472	const char *t, *d;
 473
 474	if (!usbfs_snoop)
 475		return;
 476
 477	ep = usb_pipeendpoint(pipe);
 478	t = types[usb_pipetype(pipe)];
 479	d = dirs[!!usb_pipein(pipe)];
 480
 481	if (userurb) {		/* Async */
 482		if (when == SUBMIT)
 483			dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
 484					"length %u\n",
 485					userurb, ep, t, d, length);
 486		else
 487			dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
 488					"actual_length %u status %d\n",
 489					userurb, ep, t, d, length,
 490					timeout_or_status);
 491	} else {
 492		if (when == SUBMIT)
 493			dev_info(&udev->dev, "ep%d %s-%s, length %u, "
 494					"timeout %d\n",
 495					ep, t, d, length, timeout_or_status);
 496		else
 497			dev_info(&udev->dev, "ep%d %s-%s, actual_length %u, "
 498					"status %d\n",
 499					ep, t, d, length, timeout_or_status);
 500	}
 501
 502	data_len = min(data_len, usbfs_snoop_max);
 503	if (data && data_len > 0) {
 504		print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
 505			data, data_len, 1);
 506	}
 507}
 508
 509static void snoop_urb_data(struct urb *urb, unsigned len)
 510{
 511	int i, size;
 512
 513	len = min(len, usbfs_snoop_max);
 514	if (!usbfs_snoop || len == 0)
 515		return;
 516
 517	if (urb->num_sgs == 0) {
 518		print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
 519			urb->transfer_buffer, len, 1);
 520		return;
 521	}
 522
 523	for (i = 0; i < urb->num_sgs && len; i++) {
 524		size = (len > USB_SG_SIZE) ? USB_SG_SIZE : len;
 525		print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
 526			sg_virt(&urb->sg[i]), size, 1);
 527		len -= size;
 528	}
 529}
 530
 531static int copy_urb_data_to_user(u8 __user *userbuffer, struct urb *urb)
 532{
 533	unsigned i, len, size;
 534
 535	if (urb->number_of_packets > 0)		/* Isochronous */
 536		len = urb->transfer_buffer_length;
 537	else					/* Non-Isoc */
 538		len = urb->actual_length;
 539
 540	if (urb->num_sgs == 0) {
 541		if (copy_to_user(userbuffer, urb->transfer_buffer, len))
 542			return -EFAULT;
 543		return 0;
 544	}
 545
 546	for (i = 0; i < urb->num_sgs && len; i++) {
 547		size = (len > USB_SG_SIZE) ? USB_SG_SIZE : len;
 548		if (copy_to_user(userbuffer, sg_virt(&urb->sg[i]), size))
 549			return -EFAULT;
 550		userbuffer += size;
 551		len -= size;
 552	}
 553
 554	return 0;
 555}
 556
 557#define AS_CONTINUATION	1
 558#define AS_UNLINK	2
 559
 560static void cancel_bulk_urbs(struct usb_dev_state *ps, unsigned bulk_addr)
 561__releases(ps->lock)
 562__acquires(ps->lock)
 563{
 564	struct urb *urb;
 565	struct async *as;
 566
 567	/* Mark all the pending URBs that match bulk_addr, up to but not
 568	 * including the first one without AS_CONTINUATION.  If such an
 569	 * URB is encountered then a new transfer has already started so
 570	 * the endpoint doesn't need to be disabled; otherwise it does.
 571	 */
 572	list_for_each_entry(as, &ps->async_pending, asynclist) {
 573		if (as->bulk_addr == bulk_addr) {
 574			if (as->bulk_status != AS_CONTINUATION)
 575				goto rescan;
 576			as->bulk_status = AS_UNLINK;
 577			as->bulk_addr = 0;
 578		}
 579	}
 580	ps->disabled_bulk_eps |= (1 << bulk_addr);
 581
 582	/* Now carefully unlink all the marked pending URBs */
 583 rescan:
 584	list_for_each_entry(as, &ps->async_pending, asynclist) {
 585		if (as->bulk_status == AS_UNLINK) {
 586			as->bulk_status = 0;		/* Only once */
 587			urb = as->urb;
 588			usb_get_urb(urb);
 589			spin_unlock(&ps->lock);		/* Allow completions */
 590			usb_unlink_urb(urb);
 591			usb_put_urb(urb);
 592			spin_lock(&ps->lock);
 593			goto rescan;
 594		}
 595	}
 596}
 597
 598static void async_completed(struct urb *urb)
 599{
 600	struct async *as = urb->context;
 601	struct usb_dev_state *ps = as->ps;
 602	struct siginfo sinfo;
 603	struct pid *pid = NULL;
 604	u32 secid = 0;
 605	const struct cred *cred = NULL;
 606	int signr;
 
 
 607
 608	spin_lock(&ps->lock);
 609	list_move_tail(&as->asynclist, &ps->async_completed);
 610	as->status = urb->status;
 611	signr = as->signr;
 612	if (signr) {
 613		memset(&sinfo, 0, sizeof(sinfo));
 614		sinfo.si_signo = as->signr;
 615		sinfo.si_errno = as->status;
 616		sinfo.si_code = SI_ASYNCIO;
 617		sinfo.si_addr = as->userurb;
 618		pid = get_pid(as->pid);
 619		cred = get_cred(as->cred);
 620		secid = as->secid;
 621	}
 622	snoop(&urb->dev->dev, "urb complete\n");
 623	snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
 624			as->status, COMPLETE, NULL, 0);
 625	if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN)
 626		snoop_urb_data(urb, urb->actual_length);
 627
 628	if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
 629			as->status != -ENOENT)
 630		cancel_bulk_urbs(ps, as->bulk_addr);
 631	spin_unlock(&ps->lock);
 
 
 632
 633	if (signr) {
 634		kill_pid_info_as_cred(sinfo.si_signo, &sinfo, pid, cred, secid);
 635		put_pid(pid);
 636		put_cred(cred);
 637	}
 638
 639	wake_up(&ps->wait);
 640}
 641
 642static void destroy_async(struct usb_dev_state *ps, struct list_head *list)
 643{
 644	struct urb *urb;
 645	struct async *as;
 646	unsigned long flags;
 647
 648	spin_lock_irqsave(&ps->lock, flags);
 649	while (!list_empty(list)) {
 650		as = list_entry(list->next, struct async, asynclist);
 651		list_del_init(&as->asynclist);
 652		urb = as->urb;
 653		usb_get_urb(urb);
 654
 655		/* drop the spinlock so the completion handler can run */
 656		spin_unlock_irqrestore(&ps->lock, flags);
 657		usb_kill_urb(urb);
 658		usb_put_urb(urb);
 659		spin_lock_irqsave(&ps->lock, flags);
 660	}
 661	spin_unlock_irqrestore(&ps->lock, flags);
 662}
 663
 664static void destroy_async_on_interface(struct usb_dev_state *ps,
 665				       unsigned int ifnum)
 666{
 667	struct list_head *p, *q, hitlist;
 668	unsigned long flags;
 669
 670	INIT_LIST_HEAD(&hitlist);
 671	spin_lock_irqsave(&ps->lock, flags);
 672	list_for_each_safe(p, q, &ps->async_pending)
 673		if (ifnum == list_entry(p, struct async, asynclist)->ifnum)
 674			list_move_tail(p, &hitlist);
 675	spin_unlock_irqrestore(&ps->lock, flags);
 676	destroy_async(ps, &hitlist);
 677}
 678
 679static void destroy_all_async(struct usb_dev_state *ps)
 680{
 681	destroy_async(ps, &ps->async_pending);
 682}
 683
 684/*
 685 * interface claims are made only at the request of user level code,
 686 * which can also release them (explicitly or by closing files).
 687 * they're also undone when devices disconnect.
 688 */
 689
 690static int driver_probe(struct usb_interface *intf,
 691			const struct usb_device_id *id)
 692{
 693	return -ENODEV;
 694}
 695
 696static void driver_disconnect(struct usb_interface *intf)
 697{
 698	struct usb_dev_state *ps = usb_get_intfdata(intf);
 699	unsigned int ifnum = intf->altsetting->desc.bInterfaceNumber;
 700
 701	if (!ps)
 702		return;
 703
 704	/* NOTE:  this relies on usbcore having canceled and completed
 705	 * all pending I/O requests; 2.6 does that.
 706	 */
 707
 708	if (likely(ifnum < 8*sizeof(ps->ifclaimed)))
 709		clear_bit(ifnum, &ps->ifclaimed);
 710	else
 711		dev_warn(&intf->dev, "interface number %u out of range\n",
 712			 ifnum);
 713
 714	usb_set_intfdata(intf, NULL);
 715
 716	/* force async requests to complete */
 717	destroy_async_on_interface(ps, ifnum);
 718}
 719
 720/* The following routines are merely placeholders.  There is no way
 721 * to inform a user task about suspend or resumes.
 722 */
 723static int driver_suspend(struct usb_interface *intf, pm_message_t msg)
 724{
 725	return 0;
 726}
 727
 728static int driver_resume(struct usb_interface *intf)
 729{
 730	return 0;
 731}
 732
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 733struct usb_driver usbfs_driver = {
 734	.name =		"usbfs",
 735	.probe =	driver_probe,
 736	.disconnect =	driver_disconnect,
 737	.suspend =	driver_suspend,
 738	.resume =	driver_resume,
 
 739};
 740
 741static int claimintf(struct usb_dev_state *ps, unsigned int ifnum)
 742{
 743	struct usb_device *dev = ps->dev;
 744	struct usb_interface *intf;
 745	int err;
 746
 747	if (ifnum >= 8*sizeof(ps->ifclaimed))
 748		return -EINVAL;
 749	/* already claimed */
 750	if (test_bit(ifnum, &ps->ifclaimed))
 751		return 0;
 752
 753	if (ps->privileges_dropped &&
 754			!test_bit(ifnum, &ps->interface_allowed_mask))
 755		return -EACCES;
 756
 757	intf = usb_ifnum_to_if(dev, ifnum);
 758	if (!intf)
 759		err = -ENOENT;
 760	else
 
 
 
 
 
 761		err = usb_driver_claim_interface(&usbfs_driver, intf, ps);
 
 
 762	if (err == 0)
 763		set_bit(ifnum, &ps->ifclaimed);
 764	return err;
 765}
 766
 767static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum)
 768{
 769	struct usb_device *dev;
 770	struct usb_interface *intf;
 771	int err;
 772
 773	err = -EINVAL;
 774	if (ifnum >= 8*sizeof(ps->ifclaimed))
 775		return err;
 776	dev = ps->dev;
 777	intf = usb_ifnum_to_if(dev, ifnum);
 778	if (!intf)
 779		err = -ENOENT;
 780	else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) {
 
 
 
 
 
 781		usb_driver_release_interface(&usbfs_driver, intf);
 
 782		err = 0;
 783	}
 784	return err;
 785}
 786
 787static int checkintf(struct usb_dev_state *ps, unsigned int ifnum)
 788{
 789	if (ps->dev->state != USB_STATE_CONFIGURED)
 790		return -EHOSTUNREACH;
 791	if (ifnum >= 8*sizeof(ps->ifclaimed))
 792		return -EINVAL;
 793	if (test_bit(ifnum, &ps->ifclaimed))
 794		return 0;
 795	/* if not yet claimed, claim it for the driver */
 796	dev_warn(&ps->dev->dev, "usbfs: process %d (%s) did not claim "
 797		 "interface %u before use\n", task_pid_nr(current),
 798		 current->comm, ifnum);
 799	return claimintf(ps, ifnum);
 800}
 801
 802static int findintfep(struct usb_device *dev, unsigned int ep)
 803{
 804	unsigned int i, j, e;
 805	struct usb_interface *intf;
 806	struct usb_host_interface *alts;
 807	struct usb_endpoint_descriptor *endpt;
 808
 809	if (ep & ~(USB_DIR_IN|0xf))
 810		return -EINVAL;
 811	if (!dev->actconfig)
 812		return -ESRCH;
 813	for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
 814		intf = dev->actconfig->interface[i];
 815		for (j = 0; j < intf->num_altsetting; j++) {
 816			alts = &intf->altsetting[j];
 817			for (e = 0; e < alts->desc.bNumEndpoints; e++) {
 818				endpt = &alts->endpoint[e].desc;
 819				if (endpt->bEndpointAddress == ep)
 820					return alts->desc.bInterfaceNumber;
 821			}
 822		}
 823	}
 824	return -ENOENT;
 825}
 826
 827static int check_ctrlrecip(struct usb_dev_state *ps, unsigned int requesttype,
 828			   unsigned int request, unsigned int index)
 829{
 830	int ret = 0;
 831	struct usb_host_interface *alt_setting;
 832
 833	if (ps->dev->state != USB_STATE_UNAUTHENTICATED
 834	 && ps->dev->state != USB_STATE_ADDRESS
 835	 && ps->dev->state != USB_STATE_CONFIGURED)
 836		return -EHOSTUNREACH;
 837	if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
 838		return 0;
 839
 840	/*
 841	 * check for the special corner case 'get_device_id' in the printer
 842	 * class specification, which we always want to allow as it is used
 843	 * to query things like ink level, etc.
 844	 */
 845	if (requesttype == 0xa1 && request == 0) {
 846		alt_setting = usb_find_alt_setting(ps->dev->actconfig,
 847						   index >> 8, index & 0xff);
 848		if (alt_setting
 849		 && alt_setting->desc.bInterfaceClass == USB_CLASS_PRINTER)
 850			return 0;
 851	}
 852
 853	index &= 0xff;
 854	switch (requesttype & USB_RECIP_MASK) {
 855	case USB_RECIP_ENDPOINT:
 856		if ((index & ~USB_DIR_IN) == 0)
 857			return 0;
 858		ret = findintfep(ps->dev, index);
 859		if (ret < 0) {
 860			/*
 861			 * Some not fully compliant Win apps seem to get
 862			 * index wrong and have the endpoint number here
 863			 * rather than the endpoint address (with the
 864			 * correct direction). Win does let this through,
 865			 * so we'll not reject it here but leave it to
 866			 * the device to not break KVM. But we warn.
 867			 */
 868			ret = findintfep(ps->dev, index ^ 0x80);
 869			if (ret >= 0)
 870				dev_info(&ps->dev->dev,
 871					"%s: process %i (%s) requesting ep %02x but needs %02x\n",
 872					__func__, task_pid_nr(current),
 873					current->comm, index, index ^ 0x80);
 874		}
 875		if (ret >= 0)
 876			ret = checkintf(ps, ret);
 877		break;
 878
 879	case USB_RECIP_INTERFACE:
 880		ret = checkintf(ps, index);
 881		break;
 882	}
 883	return ret;
 884}
 885
 886static struct usb_host_endpoint *ep_to_host_endpoint(struct usb_device *dev,
 887						     unsigned char ep)
 888{
 889	if (ep & USB_ENDPOINT_DIR_MASK)
 890		return dev->ep_in[ep & USB_ENDPOINT_NUMBER_MASK];
 891	else
 892		return dev->ep_out[ep & USB_ENDPOINT_NUMBER_MASK];
 893}
 894
 895static int parse_usbdevfs_streams(struct usb_dev_state *ps,
 896				  struct usbdevfs_streams __user *streams,
 897				  unsigned int *num_streams_ret,
 898				  unsigned int *num_eps_ret,
 899				  struct usb_host_endpoint ***eps_ret,
 900				  struct usb_interface **intf_ret)
 901{
 902	unsigned int i, num_streams, num_eps;
 903	struct usb_host_endpoint **eps;
 904	struct usb_interface *intf = NULL;
 905	unsigned char ep;
 906	int ifnum, ret;
 907
 908	if (get_user(num_streams, &streams->num_streams) ||
 909	    get_user(num_eps, &streams->num_eps))
 910		return -EFAULT;
 911
 912	if (num_eps < 1 || num_eps > USB_MAXENDPOINTS)
 913		return -EINVAL;
 914
 915	/* The XHCI controller allows max 2 ^ 16 streams */
 916	if (num_streams_ret && (num_streams < 2 || num_streams > 65536))
 917		return -EINVAL;
 918
 919	eps = kmalloc(num_eps * sizeof(*eps), GFP_KERNEL);
 920	if (!eps)
 921		return -ENOMEM;
 922
 923	for (i = 0; i < num_eps; i++) {
 924		if (get_user(ep, &streams->eps[i])) {
 925			ret = -EFAULT;
 926			goto error;
 927		}
 928		eps[i] = ep_to_host_endpoint(ps->dev, ep);
 929		if (!eps[i]) {
 930			ret = -EINVAL;
 931			goto error;
 932		}
 933
 934		/* usb_alloc/free_streams operate on an usb_interface */
 935		ifnum = findintfep(ps->dev, ep);
 936		if (ifnum < 0) {
 937			ret = ifnum;
 938			goto error;
 939		}
 940
 941		if (i == 0) {
 942			ret = checkintf(ps, ifnum);
 943			if (ret < 0)
 944				goto error;
 945			intf = usb_ifnum_to_if(ps->dev, ifnum);
 946		} else {
 947			/* Verify all eps belong to the same interface */
 948			if (ifnum != intf->altsetting->desc.bInterfaceNumber) {
 949				ret = -EINVAL;
 950				goto error;
 951			}
 952		}
 953	}
 954
 955	if (num_streams_ret)
 956		*num_streams_ret = num_streams;
 957	*num_eps_ret = num_eps;
 958	*eps_ret = eps;
 959	*intf_ret = intf;
 960
 961	return 0;
 962
 963error:
 964	kfree(eps);
 965	return ret;
 966}
 967
 968static int match_devt(struct device *dev, void *data)
 969{
 970	return dev->devt == (dev_t) (unsigned long) data;
 971}
 972
 973static struct usb_device *usbdev_lookup_by_devt(dev_t devt)
 974{
 975	struct device *dev;
 976
 977	dev = bus_find_device(&usb_bus_type, NULL,
 978			      (void *) (unsigned long) devt, match_devt);
 979	if (!dev)
 980		return NULL;
 981	return to_usb_device(dev);
 982}
 983
 984/*
 985 * file operations
 986 */
 987static int usbdev_open(struct inode *inode, struct file *file)
 988{
 989	struct usb_device *dev = NULL;
 990	struct usb_dev_state *ps;
 991	int ret;
 992
 993	ret = -ENOMEM;
 994	ps = kzalloc(sizeof(struct usb_dev_state), GFP_KERNEL);
 995	if (!ps)
 996		goto out_free_ps;
 997
 998	ret = -ENODEV;
 999
1000	/* Protect against simultaneous removal or release */
1001	mutex_lock(&usbfs_mutex);
1002
1003	/* usbdev device-node */
1004	if (imajor(inode) == USB_DEVICE_MAJOR)
1005		dev = usbdev_lookup_by_devt(inode->i_rdev);
1006
1007	mutex_unlock(&usbfs_mutex);
1008
1009	if (!dev)
1010		goto out_free_ps;
1011
1012	usb_lock_device(dev);
1013	if (dev->state == USB_STATE_NOTATTACHED)
1014		goto out_unlock_device;
1015
1016	ret = usb_autoresume_device(dev);
1017	if (ret)
1018		goto out_unlock_device;
1019
1020	ps->dev = dev;
1021	ps->file = file;
1022	ps->interface_allowed_mask = 0xFFFFFFFF; /* 32 bits */
1023	spin_lock_init(&ps->lock);
1024	INIT_LIST_HEAD(&ps->list);
1025	INIT_LIST_HEAD(&ps->async_pending);
1026	INIT_LIST_HEAD(&ps->async_completed);
1027	INIT_LIST_HEAD(&ps->memory_list);
1028	init_waitqueue_head(&ps->wait);
 
1029	ps->disc_pid = get_pid(task_pid(current));
1030	ps->cred = get_current_cred();
1031	security_task_getsecid(current, &ps->secid);
1032	smp_wmb();
 
 
1033	list_add_tail(&ps->list, &dev->filelist);
1034	file->private_data = ps;
1035	usb_unlock_device(dev);
1036	snoop(&dev->dev, "opened by process %d: %s\n", task_pid_nr(current),
1037			current->comm);
1038	return ret;
1039
1040 out_unlock_device:
1041	usb_unlock_device(dev);
1042	usb_put_dev(dev);
1043 out_free_ps:
1044	kfree(ps);
1045	return ret;
1046}
1047
1048static int usbdev_release(struct inode *inode, struct file *file)
1049{
1050	struct usb_dev_state *ps = file->private_data;
1051	struct usb_device *dev = ps->dev;
1052	unsigned int ifnum;
1053	struct async *as;
1054
1055	usb_lock_device(dev);
1056	usb_hub_release_all_ports(dev, ps);
1057
 
 
1058	list_del_init(&ps->list);
 
1059
1060	for (ifnum = 0; ps->ifclaimed && ifnum < 8*sizeof(ps->ifclaimed);
1061			ifnum++) {
1062		if (test_bit(ifnum, &ps->ifclaimed))
1063			releaseintf(ps, ifnum);
1064	}
1065	destroy_all_async(ps);
1066	usb_autosuspend_device(dev);
 
1067	usb_unlock_device(dev);
1068	usb_put_dev(dev);
1069	put_pid(ps->disc_pid);
1070	put_cred(ps->cred);
1071
1072	as = async_getcompleted(ps);
1073	while (as) {
1074		free_async(as);
1075		as = async_getcompleted(ps);
1076	}
1077
1078	kfree(ps);
1079	return 0;
1080}
1081
1082static int proc_control(struct usb_dev_state *ps, void __user *arg)
 
1083{
1084	struct usb_device *dev = ps->dev;
1085	struct usbdevfs_ctrltransfer ctrl;
1086	unsigned int tmo;
1087	unsigned char *tbuf;
1088	unsigned wLength;
1089	int i, pipe, ret;
1090
1091	if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
1092		return -EFAULT;
1093	ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.bRequest,
1094			      ctrl.wIndex);
1095	if (ret)
1096		return ret;
1097	wLength = ctrl.wLength;		/* To suppress 64k PAGE_SIZE warning */
1098	if (wLength > PAGE_SIZE)
1099		return -EINVAL;
1100	ret = usbfs_increase_memory_usage(PAGE_SIZE + sizeof(struct urb) +
1101			sizeof(struct usb_ctrlrequest));
1102	if (ret)
1103		return ret;
1104	tbuf = (unsigned char *)__get_free_page(GFP_KERNEL);
1105	if (!tbuf) {
1106		ret = -ENOMEM;
1107		goto done;
1108	}
1109	tmo = ctrl.timeout;
1110	snoop(&dev->dev, "control urb: bRequestType=%02x "
1111		"bRequest=%02x wValue=%04x "
1112		"wIndex=%04x wLength=%04x\n",
1113		ctrl.bRequestType, ctrl.bRequest, ctrl.wValue,
1114		ctrl.wIndex, ctrl.wLength);
1115	if (ctrl.bRequestType & 0x80) {
1116		if (ctrl.wLength && !access_ok(VERIFY_WRITE, ctrl.data,
1117					       ctrl.wLength)) {
1118			ret = -EINVAL;
1119			goto done;
1120		}
1121		pipe = usb_rcvctrlpipe(dev, 0);
1122		snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT, NULL, 0);
1123
1124		usb_unlock_device(dev);
1125		i = usb_control_msg(dev, pipe, ctrl.bRequest,
1126				    ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
1127				    tbuf, ctrl.wLength, tmo);
1128		usb_lock_device(dev);
1129		snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE,
1130			  tbuf, max(i, 0));
1131		if ((i > 0) && ctrl.wLength) {
1132			if (copy_to_user(ctrl.data, tbuf, i)) {
1133				ret = -EFAULT;
1134				goto done;
1135			}
1136		}
1137	} else {
1138		if (ctrl.wLength) {
1139			if (copy_from_user(tbuf, ctrl.data, ctrl.wLength)) {
1140				ret = -EFAULT;
1141				goto done;
1142			}
1143		}
1144		pipe = usb_sndctrlpipe(dev, 0);
1145		snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT,
1146			tbuf, ctrl.wLength);
1147
1148		usb_unlock_device(dev);
1149		i = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ctrl.bRequest,
1150				    ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
1151				    tbuf, ctrl.wLength, tmo);
1152		usb_lock_device(dev);
1153		snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE, NULL, 0);
1154	}
1155	if (i < 0 && i != -EPIPE) {
1156		dev_printk(KERN_DEBUG, &dev->dev, "usbfs: USBDEVFS_CONTROL "
1157			   "failed cmd %s rqt %u rq %u len %u ret %d\n",
1158			   current->comm, ctrl.bRequestType, ctrl.bRequest,
1159			   ctrl.wLength, i);
1160	}
1161	ret = i;
1162 done:
1163	free_page((unsigned long) tbuf);
1164	usbfs_decrease_memory_usage(PAGE_SIZE + sizeof(struct urb) +
1165			sizeof(struct usb_ctrlrequest));
1166	return ret;
1167}
1168
1169static int proc_bulk(struct usb_dev_state *ps, void __user *arg)
 
 
 
 
 
 
 
 
 
 
1170{
1171	struct usb_device *dev = ps->dev;
1172	struct usbdevfs_bulktransfer bulk;
1173	unsigned int tmo, len1, pipe;
1174	int len2;
1175	unsigned char *tbuf;
1176	int i, ret;
1177
1178	if (copy_from_user(&bulk, arg, sizeof(bulk)))
1179		return -EFAULT;
1180	ret = findintfep(ps->dev, bulk.ep);
1181	if (ret < 0)
1182		return ret;
1183	ret = checkintf(ps, ret);
1184	if (ret)
1185		return ret;
1186	if (bulk.ep & USB_DIR_IN)
1187		pipe = usb_rcvbulkpipe(dev, bulk.ep & 0x7f);
1188	else
1189		pipe = usb_sndbulkpipe(dev, bulk.ep & 0x7f);
1190	if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN)))
1191		return -EINVAL;
1192	len1 = bulk.len;
1193	if (len1 >= USBFS_XFER_MAX)
1194		return -EINVAL;
1195	ret = usbfs_increase_memory_usage(len1 + sizeof(struct urb));
1196	if (ret)
1197		return ret;
1198	tbuf = kmalloc(len1, GFP_KERNEL);
1199	if (!tbuf) {
1200		ret = -ENOMEM;
1201		goto done;
1202	}
1203	tmo = bulk.timeout;
1204	if (bulk.ep & 0x80) {
1205		if (len1 && !access_ok(VERIFY_WRITE, bulk.data, len1)) {
1206			ret = -EINVAL;
1207			goto done;
1208		}
1209		snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, NULL, 0);
1210
1211		usb_unlock_device(dev);
1212		i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
1213		usb_lock_device(dev);
1214		snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, tbuf, len2);
1215
1216		if (!i && len2) {
1217			if (copy_to_user(bulk.data, tbuf, len2)) {
1218				ret = -EFAULT;
1219				goto done;
1220			}
1221		}
1222	} else {
1223		if (len1) {
1224			if (copy_from_user(tbuf, bulk.data, len1)) {
1225				ret = -EFAULT;
1226				goto done;
1227			}
1228		}
1229		snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, tbuf, len1);
1230
1231		usb_unlock_device(dev);
1232		i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
1233		usb_lock_device(dev);
1234		snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, NULL, 0);
1235	}
1236	ret = (i < 0 ? i : len2);
1237 done:
1238	kfree(tbuf);
1239	usbfs_decrease_memory_usage(len1 + sizeof(struct urb));
1240	return ret;
1241}
1242
 
 
 
 
 
 
 
 
 
1243static void check_reset_of_active_ep(struct usb_device *udev,
1244		unsigned int epnum, char *ioctl_name)
1245{
1246	struct usb_host_endpoint **eps;
1247	struct usb_host_endpoint *ep;
1248
1249	eps = (epnum & USB_DIR_IN) ? udev->ep_in : udev->ep_out;
1250	ep = eps[epnum & 0x0f];
1251	if (ep && !list_empty(&ep->urb_list))
1252		dev_warn(&udev->dev, "Process %d (%s) called USBDEVFS_%s for active endpoint 0x%02x\n",
1253				task_pid_nr(current), current->comm,
1254				ioctl_name, epnum);
1255}
1256
1257static int proc_resetep(struct usb_dev_state *ps, void __user *arg)
1258{
1259	unsigned int ep;
1260	int ret;
1261
1262	if (get_user(ep, (unsigned int __user *)arg))
1263		return -EFAULT;
1264	ret = findintfep(ps->dev, ep);
1265	if (ret < 0)
1266		return ret;
1267	ret = checkintf(ps, ret);
1268	if (ret)
1269		return ret;
1270	check_reset_of_active_ep(ps->dev, ep, "RESETEP");
1271	usb_reset_endpoint(ps->dev, ep);
1272	return 0;
1273}
1274
1275static int proc_clearhalt(struct usb_dev_state *ps, void __user *arg)
1276{
1277	unsigned int ep;
1278	int pipe;
1279	int ret;
1280
1281	if (get_user(ep, (unsigned int __user *)arg))
1282		return -EFAULT;
1283	ret = findintfep(ps->dev, ep);
1284	if (ret < 0)
1285		return ret;
1286	ret = checkintf(ps, ret);
1287	if (ret)
1288		return ret;
1289	check_reset_of_active_ep(ps->dev, ep, "CLEAR_HALT");
1290	if (ep & USB_DIR_IN)
1291		pipe = usb_rcvbulkpipe(ps->dev, ep & 0x7f);
1292	else
1293		pipe = usb_sndbulkpipe(ps->dev, ep & 0x7f);
1294
1295	return usb_clear_halt(ps->dev, pipe);
1296}
1297
1298static int proc_getdriver(struct usb_dev_state *ps, void __user *arg)
1299{
1300	struct usbdevfs_getdriver gd;
1301	struct usb_interface *intf;
1302	int ret;
1303
1304	if (copy_from_user(&gd, arg, sizeof(gd)))
1305		return -EFAULT;
1306	intf = usb_ifnum_to_if(ps->dev, gd.interface);
1307	if (!intf || !intf->dev.driver)
1308		ret = -ENODATA;
1309	else {
1310		strlcpy(gd.driver, intf->dev.driver->name,
1311				sizeof(gd.driver));
1312		ret = (copy_to_user(arg, &gd, sizeof(gd)) ? -EFAULT : 0);
1313	}
1314	return ret;
1315}
1316
1317static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg)
1318{
1319	struct usbdevfs_connectinfo ci = {
1320		.devnum = ps->dev->devnum,
1321		.slow = ps->dev->speed == USB_SPEED_LOW
1322	};
 
1323
1324	if (copy_to_user(arg, &ci, sizeof(ci)))
1325		return -EFAULT;
1326	return 0;
1327}
1328
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1329static int proc_resetdevice(struct usb_dev_state *ps)
1330{
1331	struct usb_host_config *actconfig = ps->dev->actconfig;
1332	struct usb_interface *interface;
1333	int i, number;
1334
1335	/* Don't allow a device reset if the process has dropped the
1336	 * privilege to do such things and any of the interfaces are
1337	 * currently claimed.
1338	 */
1339	if (ps->privileges_dropped && actconfig) {
1340		for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
1341			interface = actconfig->interface[i];
1342			number = interface->cur_altsetting->desc.bInterfaceNumber;
1343			if (usb_interface_claimed(interface) &&
1344					!test_bit(number, &ps->ifclaimed)) {
1345				dev_warn(&ps->dev->dev,
1346					"usbfs: interface %d claimed by %s while '%s' resets device\n",
1347					number,	interface->dev.driver->name, current->comm);
1348				return -EACCES;
1349			}
1350		}
1351	}
1352
1353	return usb_reset_device(ps->dev);
1354}
1355
1356static int proc_setintf(struct usb_dev_state *ps, void __user *arg)
1357{
1358	struct usbdevfs_setinterface setintf;
1359	int ret;
1360
1361	if (copy_from_user(&setintf, arg, sizeof(setintf)))
1362		return -EFAULT;
1363	ret = checkintf(ps, setintf.interface);
1364	if (ret)
1365		return ret;
1366
1367	destroy_async_on_interface(ps, setintf.interface);
1368
1369	return usb_set_interface(ps->dev, setintf.interface,
1370			setintf.altsetting);
1371}
1372
1373static int proc_setconfig(struct usb_dev_state *ps, void __user *arg)
1374{
1375	int u;
1376	int status = 0;
1377	struct usb_host_config *actconfig;
1378
1379	if (get_user(u, (int __user *)arg))
1380		return -EFAULT;
1381
1382	actconfig = ps->dev->actconfig;
1383
1384	/* Don't touch the device if any interfaces are claimed.
1385	 * It could interfere with other drivers' operations, and if
1386	 * an interface is claimed by usbfs it could easily deadlock.
1387	 */
1388	if (actconfig) {
1389		int i;
1390
1391		for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
1392			if (usb_interface_claimed(actconfig->interface[i])) {
1393				dev_warn(&ps->dev->dev,
1394					"usbfs: interface %d claimed by %s "
1395					"while '%s' sets config #%d\n",
1396					actconfig->interface[i]
1397						->cur_altsetting
1398						->desc.bInterfaceNumber,
1399					actconfig->interface[i]
1400						->dev.driver->name,
1401					current->comm, u);
1402				status = -EBUSY;
1403				break;
1404			}
1405		}
1406	}
1407
1408	/* SET_CONFIGURATION is often abused as a "cheap" driver reset,
1409	 * so avoid usb_set_configuration()'s kick to sysfs
1410	 */
1411	if (status == 0) {
1412		if (actconfig && actconfig->desc.bConfigurationValue == u)
1413			status = usb_reset_configuration(ps->dev);
1414		else
1415			status = usb_set_configuration(ps->dev, u);
1416	}
1417
1418	return status;
1419}
1420
1421static struct usb_memory *
1422find_memory_area(struct usb_dev_state *ps, const struct usbdevfs_urb *uurb)
1423{
1424	struct usb_memory *usbm = NULL, *iter;
1425	unsigned long flags;
1426	unsigned long uurb_start = (unsigned long)uurb->buffer;
1427
1428	spin_lock_irqsave(&ps->lock, flags);
1429	list_for_each_entry(iter, &ps->memory_list, memlist) {
1430		if (uurb_start >= iter->vm_start &&
1431				uurb_start < iter->vm_start + iter->size) {
1432			if (uurb->buffer_length > iter->vm_start + iter->size -
1433					uurb_start) {
1434				usbm = ERR_PTR(-EINVAL);
1435			} else {
1436				usbm = iter;
1437				usbm->urb_use_count++;
1438			}
1439			break;
1440		}
1441	}
1442	spin_unlock_irqrestore(&ps->lock, flags);
1443	return usbm;
1444}
1445
1446static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb,
1447			struct usbdevfs_iso_packet_desc __user *iso_frame_desc,
1448			void __user *arg)
1449{
1450	struct usbdevfs_iso_packet_desc *isopkt = NULL;
1451	struct usb_host_endpoint *ep;
1452	struct async *as = NULL;
1453	struct usb_ctrlrequest *dr = NULL;
1454	unsigned int u, totlen, isofrmlen;
1455	int i, ret, is_in, num_sgs = 0, ifnum = -1;
1456	int number_of_packets = 0;
1457	unsigned int stream_id = 0;
1458	void *buf;
1459
1460	if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
1461				USBDEVFS_URB_SHORT_NOT_OK |
 
1462				USBDEVFS_URB_BULK_CONTINUATION |
1463				USBDEVFS_URB_NO_FSBR |
1464				USBDEVFS_URB_ZERO_PACKET |
1465				USBDEVFS_URB_NO_INTERRUPT))
 
 
 
 
 
 
 
 
1466		return -EINVAL;
1467	if (uurb->buffer_length > 0 && !uurb->buffer)
1468		return -EINVAL;
1469	if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
1470	    (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
1471		ifnum = findintfep(ps->dev, uurb->endpoint);
1472		if (ifnum < 0)
1473			return ifnum;
1474		ret = checkintf(ps, ifnum);
1475		if (ret)
1476			return ret;
1477	}
1478	ep = ep_to_host_endpoint(ps->dev, uurb->endpoint);
1479	if (!ep)
1480		return -ENOENT;
1481	is_in = (uurb->endpoint & USB_ENDPOINT_DIR_MASK) != 0;
1482
1483	u = 0;
1484	switch (uurb->type) {
1485	case USBDEVFS_URB_TYPE_CONTROL:
1486		if (!usb_endpoint_xfer_control(&ep->desc))
1487			return -EINVAL;
1488		/* min 8 byte setup packet */
1489		if (uurb->buffer_length < 8)
1490			return -EINVAL;
1491		dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
1492		if (!dr)
1493			return -ENOMEM;
1494		if (copy_from_user(dr, uurb->buffer, 8)) {
1495			ret = -EFAULT;
1496			goto error;
1497		}
1498		if (uurb->buffer_length < (le16_to_cpup(&dr->wLength) + 8)) {
1499			ret = -EINVAL;
1500			goto error;
1501		}
1502		ret = check_ctrlrecip(ps, dr->bRequestType, dr->bRequest,
1503				      le16_to_cpup(&dr->wIndex));
1504		if (ret)
1505			goto error;
1506		uurb->buffer_length = le16_to_cpup(&dr->wLength);
1507		uurb->buffer += 8;
1508		if ((dr->bRequestType & USB_DIR_IN) && uurb->buffer_length) {
1509			is_in = 1;
1510			uurb->endpoint |= USB_DIR_IN;
1511		} else {
1512			is_in = 0;
1513			uurb->endpoint &= ~USB_DIR_IN;
1514		}
 
 
1515		snoop(&ps->dev->dev, "control urb: bRequestType=%02x "
1516			"bRequest=%02x wValue=%04x "
1517			"wIndex=%04x wLength=%04x\n",
1518			dr->bRequestType, dr->bRequest,
1519			__le16_to_cpup(&dr->wValue),
1520			__le16_to_cpup(&dr->wIndex),
1521			__le16_to_cpup(&dr->wLength));
1522		u = sizeof(struct usb_ctrlrequest);
1523		break;
1524
1525	case USBDEVFS_URB_TYPE_BULK:
 
 
 
 
1526		switch (usb_endpoint_type(&ep->desc)) {
1527		case USB_ENDPOINT_XFER_CONTROL:
1528		case USB_ENDPOINT_XFER_ISOC:
1529			return -EINVAL;
1530		case USB_ENDPOINT_XFER_INT:
1531			/* allow single-shot interrupt transfers */
1532			uurb->type = USBDEVFS_URB_TYPE_INTERRUPT;
1533			goto interrupt_urb;
1534		}
1535		num_sgs = DIV_ROUND_UP(uurb->buffer_length, USB_SG_SIZE);
1536		if (num_sgs == 1 || num_sgs > ps->dev->bus->sg_tablesize)
1537			num_sgs = 0;
1538		if (ep->streams)
1539			stream_id = uurb->stream_id;
1540		break;
1541
1542	case USBDEVFS_URB_TYPE_INTERRUPT:
1543		if (!usb_endpoint_xfer_int(&ep->desc))
1544			return -EINVAL;
1545 interrupt_urb:
 
 
 
 
1546		break;
1547
1548	case USBDEVFS_URB_TYPE_ISO:
1549		/* arbitrary limit */
1550		if (uurb->number_of_packets < 1 ||
1551		    uurb->number_of_packets > 128)
1552			return -EINVAL;
1553		if (!usb_endpoint_xfer_isoc(&ep->desc))
1554			return -EINVAL;
1555		number_of_packets = uurb->number_of_packets;
1556		isofrmlen = sizeof(struct usbdevfs_iso_packet_desc) *
1557				   number_of_packets;
1558		isopkt = memdup_user(iso_frame_desc, isofrmlen);
1559		if (IS_ERR(isopkt)) {
1560			ret = PTR_ERR(isopkt);
1561			isopkt = NULL;
1562			goto error;
1563		}
1564		for (totlen = u = 0; u < number_of_packets; u++) {
1565			/*
1566			 * arbitrary limit need for USB 3.0
1567			 * bMaxBurst (0~15 allowed, 1~16 packets)
1568			 * bmAttributes (bit 1:0, mult 0~2, 1~3 packets)
1569			 * sizemax: 1024 * 16 * 3 = 49152
1570			 */
1571			if (isopkt[u].length > 49152) {
1572				ret = -EINVAL;
1573				goto error;
1574			}
1575			totlen += isopkt[u].length;
1576		}
1577		u *= sizeof(struct usb_iso_packet_descriptor);
1578		uurb->buffer_length = totlen;
1579		break;
1580
1581	default:
1582		return -EINVAL;
1583	}
1584
1585	if (uurb->buffer_length >= USBFS_XFER_MAX) {
1586		ret = -EINVAL;
1587		goto error;
1588	}
1589	if (uurb->buffer_length > 0 &&
1590			!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
1591				uurb->buffer, uurb->buffer_length)) {
1592		ret = -EFAULT;
1593		goto error;
1594	}
1595	as = alloc_async(number_of_packets);
1596	if (!as) {
1597		ret = -ENOMEM;
1598		goto error;
1599	}
1600
1601	as->usbm = find_memory_area(ps, uurb);
1602	if (IS_ERR(as->usbm)) {
1603		ret = PTR_ERR(as->usbm);
1604		as->usbm = NULL;
1605		goto error;
1606	}
1607
1608	/* do not use SG buffers when memory mapped segments
1609	 * are in use
1610	 */
1611	if (as->usbm)
1612		num_sgs = 0;
1613
1614	u += sizeof(struct async) + sizeof(struct urb) + uurb->buffer_length +
 
1615	     num_sgs * sizeof(struct scatterlist);
1616	ret = usbfs_increase_memory_usage(u);
1617	if (ret)
1618		goto error;
1619	as->mem_usage = u;
1620
1621	if (num_sgs) {
1622		as->urb->sg = kmalloc(num_sgs * sizeof(struct scatterlist),
1623				      GFP_KERNEL);
 
1624		if (!as->urb->sg) {
1625			ret = -ENOMEM;
1626			goto error;
1627		}
1628		as->urb->num_sgs = num_sgs;
1629		sg_init_table(as->urb->sg, as->urb->num_sgs);
1630
1631		totlen = uurb->buffer_length;
1632		for (i = 0; i < as->urb->num_sgs; i++) {
1633			u = (totlen > USB_SG_SIZE) ? USB_SG_SIZE : totlen;
1634			buf = kmalloc(u, GFP_KERNEL);
1635			if (!buf) {
1636				ret = -ENOMEM;
1637				goto error;
1638			}
1639			sg_set_buf(&as->urb->sg[i], buf, u);
1640
1641			if (!is_in) {
1642				if (copy_from_user(buf, uurb->buffer, u)) {
1643					ret = -EFAULT;
1644					goto error;
1645				}
1646				uurb->buffer += u;
1647			}
1648			totlen -= u;
1649		}
1650	} else if (uurb->buffer_length > 0) {
1651		if (as->usbm) {
1652			unsigned long uurb_start = (unsigned long)uurb->buffer;
1653
1654			as->urb->transfer_buffer = as->usbm->mem +
1655					(uurb_start - as->usbm->vm_start);
1656		} else {
1657			as->urb->transfer_buffer = kmalloc(uurb->buffer_length,
1658					GFP_KERNEL);
1659			if (!as->urb->transfer_buffer) {
1660				ret = -ENOMEM;
1661				goto error;
1662			}
1663			if (!is_in) {
1664				if (copy_from_user(as->urb->transfer_buffer,
1665						   uurb->buffer,
1666						   uurb->buffer_length)) {
1667					ret = -EFAULT;
1668					goto error;
1669				}
1670			} else if (uurb->type == USBDEVFS_URB_TYPE_ISO) {
1671				/*
1672				 * Isochronous input data may end up being
1673				 * discontiguous if some of the packets are
1674				 * short. Clear the buffer so that the gaps
1675				 * don't leak kernel data to userspace.
1676				 */
1677				memset(as->urb->transfer_buffer, 0,
1678						uurb->buffer_length);
1679			}
1680		}
1681	}
1682	as->urb->dev = ps->dev;
1683	as->urb->pipe = (uurb->type << 30) |
1684			__create_pipe(ps->dev, uurb->endpoint & 0xf) |
1685			(uurb->endpoint & USB_DIR_IN);
1686
1687	/* This tedious sequence is necessary because the URB_* flags
1688	 * are internal to the kernel and subject to change, whereas
1689	 * the USBDEVFS_URB_* flags are a user API and must not be changed.
1690	 */
1691	u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
1692	if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
1693		u |= URB_ISO_ASAP;
1694	if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in)
1695		u |= URB_SHORT_NOT_OK;
1696	if (uurb->flags & USBDEVFS_URB_NO_FSBR)
1697		u |= URB_NO_FSBR;
1698	if (uurb->flags & USBDEVFS_URB_ZERO_PACKET)
1699		u |= URB_ZERO_PACKET;
1700	if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
1701		u |= URB_NO_INTERRUPT;
1702	as->urb->transfer_flags = u;
1703
 
 
 
 
 
1704	as->urb->transfer_buffer_length = uurb->buffer_length;
1705	as->urb->setup_packet = (unsigned char *)dr;
1706	dr = NULL;
1707	as->urb->start_frame = uurb->start_frame;
1708	as->urb->number_of_packets = number_of_packets;
1709	as->urb->stream_id = stream_id;
1710	if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
1711			ps->dev->speed == USB_SPEED_HIGH)
1712		as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);
1713	else
1714		as->urb->interval = ep->desc.bInterval;
 
 
 
 
 
 
1715	as->urb->context = as;
1716	as->urb->complete = async_completed;
1717	for (totlen = u = 0; u < number_of_packets; u++) {
1718		as->urb->iso_frame_desc[u].offset = totlen;
1719		as->urb->iso_frame_desc[u].length = isopkt[u].length;
1720		totlen += isopkt[u].length;
1721	}
1722	kfree(isopkt);
1723	isopkt = NULL;
1724	as->ps = ps;
1725	as->userurb = arg;
 
1726	if (as->usbm) {
1727		unsigned long uurb_start = (unsigned long)uurb->buffer;
1728
1729		as->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1730		as->urb->transfer_dma = as->usbm->dma_handle +
1731				(uurb_start - as->usbm->vm_start);
1732	} else if (is_in && uurb->buffer_length > 0)
1733		as->userbuffer = uurb->buffer;
1734	as->signr = uurb->signr;
1735	as->ifnum = ifnum;
1736	as->pid = get_pid(task_pid(current));
1737	as->cred = get_current_cred();
1738	security_task_getsecid(current, &as->secid);
1739	snoop_urb(ps->dev, as->userurb, as->urb->pipe,
1740			as->urb->transfer_buffer_length, 0, SUBMIT,
1741			NULL, 0);
1742	if (!is_in)
1743		snoop_urb_data(as->urb, as->urb->transfer_buffer_length);
1744
1745	async_newpending(as);
1746
1747	if (usb_endpoint_xfer_bulk(&ep->desc)) {
1748		spin_lock_irq(&ps->lock);
1749
1750		/* Not exactly the endpoint address; the direction bit is
1751		 * shifted to the 0x10 position so that the value will be
1752		 * between 0 and 31.
1753		 */
1754		as->bulk_addr = usb_endpoint_num(&ep->desc) |
1755			((ep->desc.bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1756				>> 3);
1757
1758		/* If this bulk URB is the start of a new transfer, re-enable
1759		 * the endpoint.  Otherwise mark it as a continuation URB.
1760		 */
1761		if (uurb->flags & USBDEVFS_URB_BULK_CONTINUATION)
1762			as->bulk_status = AS_CONTINUATION;
1763		else
1764			ps->disabled_bulk_eps &= ~(1 << as->bulk_addr);
1765
1766		/* Don't accept continuation URBs if the endpoint is
1767		 * disabled because of an earlier error.
1768		 */
1769		if (ps->disabled_bulk_eps & (1 << as->bulk_addr))
1770			ret = -EREMOTEIO;
1771		else
1772			ret = usb_submit_urb(as->urb, GFP_ATOMIC);
1773		spin_unlock_irq(&ps->lock);
1774	} else {
1775		ret = usb_submit_urb(as->urb, GFP_KERNEL);
1776	}
1777
1778	if (ret) {
1779		dev_printk(KERN_DEBUG, &ps->dev->dev,
1780			   "usbfs: usb_submit_urb returned %d\n", ret);
1781		snoop_urb(ps->dev, as->userurb, as->urb->pipe,
1782				0, ret, COMPLETE, NULL, 0);
1783		async_removepending(as);
1784		goto error;
1785	}
1786	return 0;
1787
1788 error:
1789	if (as && as->usbm)
1790		dec_usb_memory_use_count(as->usbm, &as->usbm->urb_use_count);
1791	kfree(isopkt);
1792	kfree(dr);
1793	if (as)
1794		free_async(as);
1795	return ret;
1796}
1797
1798static int proc_submiturb(struct usb_dev_state *ps, void __user *arg)
1799{
1800	struct usbdevfs_urb uurb;
 
1801
1802	if (copy_from_user(&uurb, arg, sizeof(uurb)))
1803		return -EFAULT;
1804
 
 
 
1805	return proc_do_submiturb(ps, &uurb,
1806			(((struct usbdevfs_urb __user *)arg)->iso_frame_desc),
1807			arg);
1808}
1809
1810static int proc_unlinkurb(struct usb_dev_state *ps, void __user *arg)
1811{
1812	struct urb *urb;
1813	struct async *as;
1814	unsigned long flags;
1815
1816	spin_lock_irqsave(&ps->lock, flags);
1817	as = async_getpending(ps, arg);
1818	if (!as) {
1819		spin_unlock_irqrestore(&ps->lock, flags);
1820		return -EINVAL;
1821	}
1822
1823	urb = as->urb;
1824	usb_get_urb(urb);
1825	spin_unlock_irqrestore(&ps->lock, flags);
1826
1827	usb_kill_urb(urb);
1828	usb_put_urb(urb);
1829
1830	return 0;
1831}
1832
 
 
 
 
 
 
 
 
 
 
 
 
1833static int processcompl(struct async *as, void __user * __user *arg)
1834{
1835	struct urb *urb = as->urb;
1836	struct usbdevfs_urb __user *userurb = as->userurb;
1837	void __user *addr = as->userurb;
1838	unsigned int i;
1839
 
1840	if (as->userbuffer && urb->actual_length) {
1841		if (copy_urb_data_to_user(as->userbuffer, urb))
1842			goto err_out;
1843	}
1844	if (put_user(as->status, &userurb->status))
1845		goto err_out;
1846	if (put_user(urb->actual_length, &userurb->actual_length))
1847		goto err_out;
1848	if (put_user(urb->error_count, &userurb->error_count))
1849		goto err_out;
1850
1851	if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
1852		for (i = 0; i < urb->number_of_packets; i++) {
1853			if (put_user(urb->iso_frame_desc[i].actual_length,
1854				     &userurb->iso_frame_desc[i].actual_length))
1855				goto err_out;
1856			if (put_user(urb->iso_frame_desc[i].status,
1857				     &userurb->iso_frame_desc[i].status))
1858				goto err_out;
1859		}
1860	}
1861
1862	if (put_user(addr, (void __user * __user *)arg))
1863		return -EFAULT;
1864	return 0;
1865
1866err_out:
1867	return -EFAULT;
1868}
1869
1870static struct async *reap_as(struct usb_dev_state *ps)
1871{
1872	DECLARE_WAITQUEUE(wait, current);
1873	struct async *as = NULL;
1874	struct usb_device *dev = ps->dev;
1875
1876	add_wait_queue(&ps->wait, &wait);
1877	for (;;) {
1878		__set_current_state(TASK_INTERRUPTIBLE);
1879		as = async_getcompleted(ps);
1880		if (as || !connected(ps))
1881			break;
1882		if (signal_pending(current))
1883			break;
1884		usb_unlock_device(dev);
1885		schedule();
1886		usb_lock_device(dev);
1887	}
1888	remove_wait_queue(&ps->wait, &wait);
1889	set_current_state(TASK_RUNNING);
1890	return as;
1891}
1892
1893static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
1894{
1895	struct async *as = reap_as(ps);
1896
1897	if (as) {
1898		int retval;
1899
1900		snoop(&ps->dev->dev, "reap %p\n", as->userurb);
1901		retval = processcompl(as, (void __user * __user *)arg);
1902		free_async(as);
1903		return retval;
1904	}
1905	if (signal_pending(current))
1906		return -EINTR;
1907	return -ENODEV;
1908}
1909
1910static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
1911{
1912	int retval;
1913	struct async *as;
1914
1915	as = async_getcompleted(ps);
1916	if (as) {
1917		snoop(&ps->dev->dev, "reap %p\n", as->userurb);
1918		retval = processcompl(as, (void __user * __user *)arg);
1919		free_async(as);
1920	} else {
1921		retval = (connected(ps) ? -EAGAIN : -ENODEV);
1922	}
1923	return retval;
1924}
1925
1926#ifdef CONFIG_COMPAT
1927static int proc_control_compat(struct usb_dev_state *ps,
1928				struct usbdevfs_ctrltransfer32 __user *p32)
1929{
1930	struct usbdevfs_ctrltransfer __user *p;
1931	__u32 udata;
1932	p = compat_alloc_user_space(sizeof(*p));
1933	if (copy_in_user(p, p32, (sizeof(*p32) - sizeof(compat_caddr_t))) ||
1934	    get_user(udata, &p32->data) ||
1935	    put_user(compat_ptr(udata), &p->data))
1936		return -EFAULT;
1937	return proc_control(ps, p);
 
1938}
1939
1940static int proc_bulk_compat(struct usb_dev_state *ps,
1941			struct usbdevfs_bulktransfer32 __user *p32)
1942{
1943	struct usbdevfs_bulktransfer __user *p;
1944	compat_uint_t n;
1945	compat_caddr_t addr;
1946
1947	p = compat_alloc_user_space(sizeof(*p));
1948
1949	if (get_user(n, &p32->ep) || put_user(n, &p->ep) ||
1950	    get_user(n, &p32->len) || put_user(n, &p->len) ||
1951	    get_user(n, &p32->timeout) || put_user(n, &p->timeout) ||
1952	    get_user(addr, &p32->data) || put_user(compat_ptr(addr), &p->data))
1953		return -EFAULT;
1954
1955	return proc_bulk(ps, p);
1956}
 
1957static int proc_disconnectsignal_compat(struct usb_dev_state *ps, void __user *arg)
1958{
1959	struct usbdevfs_disconnectsignal32 ds;
1960
1961	if (copy_from_user(&ds, arg, sizeof(ds)))
1962		return -EFAULT;
1963	ps->discsignr = ds.signr;
1964	ps->disccontext = compat_ptr(ds.context);
1965	return 0;
1966}
1967
1968static int get_urb32(struct usbdevfs_urb *kurb,
1969		     struct usbdevfs_urb32 __user *uurb)
1970{
1971	__u32  uptr;
1972	if (!access_ok(VERIFY_READ, uurb, sizeof(*uurb)) ||
1973	    __get_user(kurb->type, &uurb->type) ||
1974	    __get_user(kurb->endpoint, &uurb->endpoint) ||
1975	    __get_user(kurb->status, &uurb->status) ||
1976	    __get_user(kurb->flags, &uurb->flags) ||
1977	    __get_user(kurb->buffer_length, &uurb->buffer_length) ||
1978	    __get_user(kurb->actual_length, &uurb->actual_length) ||
1979	    __get_user(kurb->start_frame, &uurb->start_frame) ||
1980	    __get_user(kurb->number_of_packets, &uurb->number_of_packets) ||
1981	    __get_user(kurb->error_count, &uurb->error_count) ||
1982	    __get_user(kurb->signr, &uurb->signr))
1983		return -EFAULT;
1984
1985	if (__get_user(uptr, &uurb->buffer))
1986		return -EFAULT;
1987	kurb->buffer = compat_ptr(uptr);
1988	if (__get_user(uptr, &uurb->usercontext))
1989		return -EFAULT;
1990	kurb->usercontext = compat_ptr(uptr);
1991
 
 
 
 
 
 
 
1992	return 0;
1993}
1994
1995static int proc_submiturb_compat(struct usb_dev_state *ps, void __user *arg)
1996{
1997	struct usbdevfs_urb uurb;
 
1998
1999	if (get_urb32(&uurb, (struct usbdevfs_urb32 __user *)arg))
2000		return -EFAULT;
2001
 
 
 
2002	return proc_do_submiturb(ps, &uurb,
2003			((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc,
2004			arg);
2005}
2006
2007static int processcompl_compat(struct async *as, void __user * __user *arg)
2008{
2009	struct urb *urb = as->urb;
2010	struct usbdevfs_urb32 __user *userurb = as->userurb;
2011	void __user *addr = as->userurb;
2012	unsigned int i;
2013
 
2014	if (as->userbuffer && urb->actual_length) {
2015		if (copy_urb_data_to_user(as->userbuffer, urb))
2016			return -EFAULT;
2017	}
2018	if (put_user(as->status, &userurb->status))
2019		return -EFAULT;
2020	if (put_user(urb->actual_length, &userurb->actual_length))
2021		return -EFAULT;
2022	if (put_user(urb->error_count, &userurb->error_count))
2023		return -EFAULT;
2024
2025	if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
2026		for (i = 0; i < urb->number_of_packets; i++) {
2027			if (put_user(urb->iso_frame_desc[i].actual_length,
2028				     &userurb->iso_frame_desc[i].actual_length))
2029				return -EFAULT;
2030			if (put_user(urb->iso_frame_desc[i].status,
2031				     &userurb->iso_frame_desc[i].status))
2032				return -EFAULT;
2033		}
2034	}
2035
2036	if (put_user(ptr_to_compat(addr), (u32 __user *)arg))
2037		return -EFAULT;
2038	return 0;
2039}
2040
2041static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
2042{
2043	struct async *as = reap_as(ps);
2044
2045	if (as) {
2046		int retval;
2047
2048		snoop(&ps->dev->dev, "reap %p\n", as->userurb);
2049		retval = processcompl_compat(as, (void __user * __user *)arg);
2050		free_async(as);
2051		return retval;
2052	}
2053	if (signal_pending(current))
2054		return -EINTR;
2055	return -ENODEV;
2056}
2057
2058static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *arg)
2059{
2060	int retval;
2061	struct async *as;
2062
2063	as = async_getcompleted(ps);
2064	if (as) {
2065		snoop(&ps->dev->dev, "reap %p\n", as->userurb);
2066		retval = processcompl_compat(as, (void __user * __user *)arg);
2067		free_async(as);
2068	} else {
2069		retval = (connected(ps) ? -EAGAIN : -ENODEV);
2070	}
2071	return retval;
2072}
2073
2074
2075#endif
2076
2077static int proc_disconnectsignal(struct usb_dev_state *ps, void __user *arg)
2078{
2079	struct usbdevfs_disconnectsignal ds;
2080
2081	if (copy_from_user(&ds, arg, sizeof(ds)))
2082		return -EFAULT;
2083	ps->discsignr = ds.signr;
2084	ps->disccontext = ds.context;
2085	return 0;
2086}
2087
2088static int proc_claiminterface(struct usb_dev_state *ps, void __user *arg)
2089{
2090	unsigned int ifnum;
2091
2092	if (get_user(ifnum, (unsigned int __user *)arg))
2093		return -EFAULT;
2094	return claimintf(ps, ifnum);
2095}
2096
2097static int proc_releaseinterface(struct usb_dev_state *ps, void __user *arg)
2098{
2099	unsigned int ifnum;
2100	int ret;
2101
2102	if (get_user(ifnum, (unsigned int __user *)arg))
2103		return -EFAULT;
2104	ret = releaseintf(ps, ifnum);
2105	if (ret < 0)
2106		return ret;
2107	destroy_async_on_interface(ps, ifnum);
2108	return 0;
2109}
2110
2111static int proc_ioctl(struct usb_dev_state *ps, struct usbdevfs_ioctl *ctl)
2112{
2113	int			size;
2114	void			*buf = NULL;
2115	int			retval = 0;
2116	struct usb_interface    *intf = NULL;
2117	struct usb_driver       *driver = NULL;
2118
2119	if (ps->privileges_dropped)
2120		return -EACCES;
2121
 
 
 
2122	/* alloc buffer */
2123	size = _IOC_SIZE(ctl->ioctl_code);
2124	if (size > 0) {
2125		buf = kmalloc(size, GFP_KERNEL);
2126		if (buf == NULL)
2127			return -ENOMEM;
2128		if ((_IOC_DIR(ctl->ioctl_code) & _IOC_WRITE)) {
2129			if (copy_from_user(buf, ctl->data, size)) {
2130				kfree(buf);
2131				return -EFAULT;
2132			}
2133		} else {
2134			memset(buf, 0, size);
2135		}
2136	}
2137
2138	if (!connected(ps)) {
2139		kfree(buf);
2140		return -ENODEV;
2141	}
2142
2143	if (ps->dev->state != USB_STATE_CONFIGURED)
2144		retval = -EHOSTUNREACH;
2145	else if (!(intf = usb_ifnum_to_if(ps->dev, ctl->ifno)))
2146		retval = -EINVAL;
2147	else switch (ctl->ioctl_code) {
2148
2149	/* disconnect kernel driver from interface */
2150	case USBDEVFS_DISCONNECT:
2151		if (intf->dev.driver) {
2152			driver = to_usb_driver(intf->dev.driver);
2153			dev_dbg(&intf->dev, "disconnect by usbfs\n");
2154			usb_driver_release_interface(driver, intf);
2155		} else
2156			retval = -ENODATA;
2157		break;
2158
2159	/* let kernel drivers try to (re)bind to the interface */
2160	case USBDEVFS_CONNECT:
2161		if (!intf->dev.driver)
2162			retval = device_attach(&intf->dev);
2163		else
2164			retval = -EBUSY;
2165		break;
2166
2167	/* talk directly to the interface's driver */
2168	default:
2169		if (intf->dev.driver)
2170			driver = to_usb_driver(intf->dev.driver);
2171		if (driver == NULL || driver->unlocked_ioctl == NULL) {
2172			retval = -ENOTTY;
2173		} else {
2174			retval = driver->unlocked_ioctl(intf, ctl->ioctl_code, buf);
2175			if (retval == -ENOIOCTLCMD)
2176				retval = -ENOTTY;
2177		}
2178	}
2179
2180	/* cleanup and return */
2181	if (retval >= 0
2182			&& (_IOC_DIR(ctl->ioctl_code) & _IOC_READ) != 0
2183			&& size > 0
2184			&& copy_to_user(ctl->data, buf, size) != 0)
2185		retval = -EFAULT;
2186
2187	kfree(buf);
2188	return retval;
2189}
2190
2191static int proc_ioctl_default(struct usb_dev_state *ps, void __user *arg)
2192{
2193	struct usbdevfs_ioctl	ctrl;
2194
2195	if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
2196		return -EFAULT;
2197	return proc_ioctl(ps, &ctrl);
2198}
2199
2200#ifdef CONFIG_COMPAT
2201static int proc_ioctl_compat(struct usb_dev_state *ps, compat_uptr_t arg)
2202{
2203	struct usbdevfs_ioctl32 __user *uioc;
2204	struct usbdevfs_ioctl ctrl;
2205	u32 udata;
2206
2207	uioc = compat_ptr((long)arg);
2208	if (!access_ok(VERIFY_READ, uioc, sizeof(*uioc)) ||
2209	    __get_user(ctrl.ifno, &uioc->ifno) ||
2210	    __get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
2211	    __get_user(udata, &uioc->data))
2212		return -EFAULT;
2213	ctrl.data = compat_ptr(udata);
2214
 
2215	return proc_ioctl(ps, &ctrl);
2216}
2217#endif
2218
2219static int proc_claim_port(struct usb_dev_state *ps, void __user *arg)
2220{
2221	unsigned portnum;
2222	int rc;
2223
2224	if (get_user(portnum, (unsigned __user *) arg))
2225		return -EFAULT;
2226	rc = usb_hub_claim_port(ps->dev, portnum, ps);
2227	if (rc == 0)
2228		snoop(&ps->dev->dev, "port %d claimed by process %d: %s\n",
2229			portnum, task_pid_nr(current), current->comm);
2230	return rc;
2231}
2232
2233static int proc_release_port(struct usb_dev_state *ps, void __user *arg)
2234{
2235	unsigned portnum;
2236
2237	if (get_user(portnum, (unsigned __user *) arg))
2238		return -EFAULT;
2239	return usb_hub_release_port(ps->dev, portnum, ps);
2240}
2241
2242static int proc_get_capabilities(struct usb_dev_state *ps, void __user *arg)
2243{
2244	__u32 caps;
2245
2246	caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM |
2247			USBDEVFS_CAP_REAP_AFTER_DISCONNECT | USBDEVFS_CAP_MMAP |
2248			USBDEVFS_CAP_DROP_PRIVILEGES;
 
2249	if (!ps->dev->bus->no_stop_on_short)
2250		caps |= USBDEVFS_CAP_BULK_CONTINUATION;
2251	if (ps->dev->bus->sg_tablesize)
2252		caps |= USBDEVFS_CAP_BULK_SCATTER_GATHER;
2253
2254	if (put_user(caps, (__u32 __user *)arg))
2255		return -EFAULT;
2256
2257	return 0;
2258}
2259
2260static int proc_disconnect_claim(struct usb_dev_state *ps, void __user *arg)
2261{
2262	struct usbdevfs_disconnect_claim dc;
2263	struct usb_interface *intf;
2264
2265	if (copy_from_user(&dc, arg, sizeof(dc)))
2266		return -EFAULT;
2267
2268	intf = usb_ifnum_to_if(ps->dev, dc.interface);
2269	if (!intf)
2270		return -EINVAL;
2271
2272	if (intf->dev.driver) {
2273		struct usb_driver *driver = to_usb_driver(intf->dev.driver);
2274
2275		if (ps->privileges_dropped)
2276			return -EACCES;
2277
2278		if ((dc.flags & USBDEVFS_DISCONNECT_CLAIM_IF_DRIVER) &&
2279				strncmp(dc.driver, intf->dev.driver->name,
2280					sizeof(dc.driver)) != 0)
2281			return -EBUSY;
2282
2283		if ((dc.flags & USBDEVFS_DISCONNECT_CLAIM_EXCEPT_DRIVER) &&
2284				strncmp(dc.driver, intf->dev.driver->name,
2285					sizeof(dc.driver)) == 0)
2286			return -EBUSY;
2287
2288		dev_dbg(&intf->dev, "disconnect by usbfs\n");
2289		usb_driver_release_interface(driver, intf);
2290	}
2291
2292	return claimintf(ps, dc.interface);
2293}
2294
2295static int proc_alloc_streams(struct usb_dev_state *ps, void __user *arg)
2296{
2297	unsigned num_streams, num_eps;
2298	struct usb_host_endpoint **eps;
2299	struct usb_interface *intf;
2300	int r;
2301
2302	r = parse_usbdevfs_streams(ps, arg, &num_streams, &num_eps,
2303				   &eps, &intf);
2304	if (r)
2305		return r;
2306
2307	destroy_async_on_interface(ps,
2308				   intf->altsetting[0].desc.bInterfaceNumber);
2309
2310	r = usb_alloc_streams(intf, eps, num_eps, num_streams, GFP_KERNEL);
2311	kfree(eps);
2312	return r;
2313}
2314
2315static int proc_free_streams(struct usb_dev_state *ps, void __user *arg)
2316{
2317	unsigned num_eps;
2318	struct usb_host_endpoint **eps;
2319	struct usb_interface *intf;
2320	int r;
2321
2322	r = parse_usbdevfs_streams(ps, arg, NULL, &num_eps, &eps, &intf);
2323	if (r)
2324		return r;
2325
2326	destroy_async_on_interface(ps,
2327				   intf->altsetting[0].desc.bInterfaceNumber);
2328
2329	r = usb_free_streams(intf, eps, num_eps, GFP_KERNEL);
2330	kfree(eps);
2331	return r;
2332}
2333
2334static int proc_drop_privileges(struct usb_dev_state *ps, void __user *arg)
2335{
2336	u32 data;
2337
2338	if (copy_from_user(&data, arg, sizeof(data)))
2339		return -EFAULT;
2340
2341	/* This is an one way operation. Once privileges are
2342	 * dropped, you cannot regain them. You may however reissue
2343	 * this ioctl to shrink the allowed interfaces mask.
2344	 */
2345	ps->interface_allowed_mask &= data;
2346	ps->privileges_dropped = true;
2347
2348	return 0;
2349}
2350
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2351/*
2352 * NOTE:  All requests here that have interface numbers as parameters
2353 * are assuming that somehow the configuration has been prevented from
2354 * changing.  But there's no mechanism to ensure that...
2355 */
2356static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
2357				void __user *p)
2358{
2359	struct usb_dev_state *ps = file->private_data;
2360	struct inode *inode = file_inode(file);
2361	struct usb_device *dev = ps->dev;
2362	int ret = -ENOTTY;
2363
2364	if (!(file->f_mode & FMODE_WRITE))
2365		return -EPERM;
2366
2367	usb_lock_device(dev);
2368
2369	/* Reap operations are allowed even after disconnection */
2370	switch (cmd) {
2371	case USBDEVFS_REAPURB:
2372		snoop(&dev->dev, "%s: REAPURB\n", __func__);
2373		ret = proc_reapurb(ps, p);
2374		goto done;
2375
2376	case USBDEVFS_REAPURBNDELAY:
2377		snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
2378		ret = proc_reapurbnonblock(ps, p);
2379		goto done;
2380
2381#ifdef CONFIG_COMPAT
2382	case USBDEVFS_REAPURB32:
2383		snoop(&dev->dev, "%s: REAPURB32\n", __func__);
2384		ret = proc_reapurb_compat(ps, p);
2385		goto done;
2386
2387	case USBDEVFS_REAPURBNDELAY32:
2388		snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
2389		ret = proc_reapurbnonblock_compat(ps, p);
2390		goto done;
2391#endif
2392	}
2393
2394	if (!connected(ps)) {
2395		usb_unlock_device(dev);
2396		return -ENODEV;
2397	}
2398
2399	switch (cmd) {
2400	case USBDEVFS_CONTROL:
2401		snoop(&dev->dev, "%s: CONTROL\n", __func__);
2402		ret = proc_control(ps, p);
2403		if (ret >= 0)
2404			inode->i_mtime = CURRENT_TIME;
2405		break;
2406
2407	case USBDEVFS_BULK:
2408		snoop(&dev->dev, "%s: BULK\n", __func__);
2409		ret = proc_bulk(ps, p);
2410		if (ret >= 0)
2411			inode->i_mtime = CURRENT_TIME;
2412		break;
2413
2414	case USBDEVFS_RESETEP:
2415		snoop(&dev->dev, "%s: RESETEP\n", __func__);
2416		ret = proc_resetep(ps, p);
2417		if (ret >= 0)
2418			inode->i_mtime = CURRENT_TIME;
2419		break;
2420
2421	case USBDEVFS_RESET:
2422		snoop(&dev->dev, "%s: RESET\n", __func__);
2423		ret = proc_resetdevice(ps);
2424		break;
2425
2426	case USBDEVFS_CLEAR_HALT:
2427		snoop(&dev->dev, "%s: CLEAR_HALT\n", __func__);
2428		ret = proc_clearhalt(ps, p);
2429		if (ret >= 0)
2430			inode->i_mtime = CURRENT_TIME;
2431		break;
2432
2433	case USBDEVFS_GETDRIVER:
2434		snoop(&dev->dev, "%s: GETDRIVER\n", __func__);
2435		ret = proc_getdriver(ps, p);
2436		break;
2437
2438	case USBDEVFS_CONNECTINFO:
2439		snoop(&dev->dev, "%s: CONNECTINFO\n", __func__);
2440		ret = proc_connectinfo(ps, p);
2441		break;
2442
2443	case USBDEVFS_SETINTERFACE:
2444		snoop(&dev->dev, "%s: SETINTERFACE\n", __func__);
2445		ret = proc_setintf(ps, p);
2446		break;
2447
2448	case USBDEVFS_SETCONFIGURATION:
2449		snoop(&dev->dev, "%s: SETCONFIGURATION\n", __func__);
2450		ret = proc_setconfig(ps, p);
2451		break;
2452
2453	case USBDEVFS_SUBMITURB:
2454		snoop(&dev->dev, "%s: SUBMITURB\n", __func__);
2455		ret = proc_submiturb(ps, p);
2456		if (ret >= 0)
2457			inode->i_mtime = CURRENT_TIME;
2458		break;
2459
2460#ifdef CONFIG_COMPAT
2461	case USBDEVFS_CONTROL32:
2462		snoop(&dev->dev, "%s: CONTROL32\n", __func__);
2463		ret = proc_control_compat(ps, p);
2464		if (ret >= 0)
2465			inode->i_mtime = CURRENT_TIME;
2466		break;
2467
2468	case USBDEVFS_BULK32:
2469		snoop(&dev->dev, "%s: BULK32\n", __func__);
2470		ret = proc_bulk_compat(ps, p);
2471		if (ret >= 0)
2472			inode->i_mtime = CURRENT_TIME;
2473		break;
2474
2475	case USBDEVFS_DISCSIGNAL32:
2476		snoop(&dev->dev, "%s: DISCSIGNAL32\n", __func__);
2477		ret = proc_disconnectsignal_compat(ps, p);
2478		break;
2479
2480	case USBDEVFS_SUBMITURB32:
2481		snoop(&dev->dev, "%s: SUBMITURB32\n", __func__);
2482		ret = proc_submiturb_compat(ps, p);
2483		if (ret >= 0)
2484			inode->i_mtime = CURRENT_TIME;
2485		break;
2486
2487	case USBDEVFS_IOCTL32:
2488		snoop(&dev->dev, "%s: IOCTL32\n", __func__);
2489		ret = proc_ioctl_compat(ps, ptr_to_compat(p));
2490		break;
2491#endif
2492
2493	case USBDEVFS_DISCARDURB:
2494		snoop(&dev->dev, "%s: DISCARDURB %p\n", __func__, p);
2495		ret = proc_unlinkurb(ps, p);
2496		break;
2497
2498	case USBDEVFS_DISCSIGNAL:
2499		snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
2500		ret = proc_disconnectsignal(ps, p);
2501		break;
2502
2503	case USBDEVFS_CLAIMINTERFACE:
2504		snoop(&dev->dev, "%s: CLAIMINTERFACE\n", __func__);
2505		ret = proc_claiminterface(ps, p);
2506		break;
2507
2508	case USBDEVFS_RELEASEINTERFACE:
2509		snoop(&dev->dev, "%s: RELEASEINTERFACE\n", __func__);
2510		ret = proc_releaseinterface(ps, p);
2511		break;
2512
2513	case USBDEVFS_IOCTL:
2514		snoop(&dev->dev, "%s: IOCTL\n", __func__);
2515		ret = proc_ioctl_default(ps, p);
2516		break;
2517
2518	case USBDEVFS_CLAIM_PORT:
2519		snoop(&dev->dev, "%s: CLAIM_PORT\n", __func__);
2520		ret = proc_claim_port(ps, p);
2521		break;
2522
2523	case USBDEVFS_RELEASE_PORT:
2524		snoop(&dev->dev, "%s: RELEASE_PORT\n", __func__);
2525		ret = proc_release_port(ps, p);
2526		break;
2527	case USBDEVFS_GET_CAPABILITIES:
2528		ret = proc_get_capabilities(ps, p);
2529		break;
2530	case USBDEVFS_DISCONNECT_CLAIM:
2531		ret = proc_disconnect_claim(ps, p);
2532		break;
2533	case USBDEVFS_ALLOC_STREAMS:
2534		ret = proc_alloc_streams(ps, p);
2535		break;
2536	case USBDEVFS_FREE_STREAMS:
2537		ret = proc_free_streams(ps, p);
2538		break;
2539	case USBDEVFS_DROP_PRIVILEGES:
2540		ret = proc_drop_privileges(ps, p);
2541		break;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2542	}
2543
2544 done:
2545	usb_unlock_device(dev);
2546	if (ret >= 0)
2547		inode->i_atime = CURRENT_TIME;
2548	return ret;
2549}
2550
2551static long usbdev_ioctl(struct file *file, unsigned int cmd,
2552			unsigned long arg)
2553{
2554	int ret;
2555
2556	ret = usbdev_do_ioctl(file, cmd, (void __user *)arg);
2557
2558	return ret;
2559}
2560
2561#ifdef CONFIG_COMPAT
2562static long usbdev_compat_ioctl(struct file *file, unsigned int cmd,
2563			unsigned long arg)
2564{
2565	int ret;
2566
2567	ret = usbdev_do_ioctl(file, cmd, compat_ptr(arg));
2568
2569	return ret;
2570}
2571#endif
2572
2573/* No kernel lock - fine */
2574static unsigned int usbdev_poll(struct file *file,
2575				struct poll_table_struct *wait)
2576{
2577	struct usb_dev_state *ps = file->private_data;
2578	unsigned int mask = 0;
2579
2580	poll_wait(file, &ps->wait, wait);
2581	if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
2582		mask |= POLLOUT | POLLWRNORM;
2583	if (!connected(ps))
2584		mask |= POLLERR | POLLHUP;
 
 
2585	return mask;
2586}
2587
2588const struct file_operations usbdev_file_operations = {
2589	.owner =	  THIS_MODULE,
2590	.llseek =	  no_seek_end_llseek,
2591	.read =		  usbdev_read,
2592	.poll =		  usbdev_poll,
2593	.unlocked_ioctl = usbdev_ioctl,
2594#ifdef CONFIG_COMPAT
2595	.compat_ioctl =   usbdev_compat_ioctl,
2596#endif
2597	.mmap =           usbdev_mmap,
2598	.open =		  usbdev_open,
2599	.release =	  usbdev_release,
2600};
2601
2602static void usbdev_remove(struct usb_device *udev)
2603{
2604	struct usb_dev_state *ps;
2605	struct siginfo sinfo;
2606
 
 
2607	while (!list_empty(&udev->filelist)) {
2608		ps = list_entry(udev->filelist.next, struct usb_dev_state, list);
2609		destroy_all_async(ps);
2610		wake_up_all(&ps->wait);
 
 
2611		list_del_init(&ps->list);
2612		if (ps->discsignr) {
2613			memset(&sinfo, 0, sizeof(sinfo));
2614			sinfo.si_signo = ps->discsignr;
2615			sinfo.si_errno = EPIPE;
2616			sinfo.si_code = SI_ASYNCIO;
2617			sinfo.si_addr = ps->disccontext;
2618			kill_pid_info_as_cred(ps->discsignr, &sinfo,
2619					ps->disc_pid, ps->cred, ps->secid);
2620		}
2621	}
 
2622}
2623
2624static int usbdev_notify(struct notifier_block *self,
2625			       unsigned long action, void *dev)
2626{
2627	switch (action) {
2628	case USB_DEVICE_ADD:
2629		break;
2630	case USB_DEVICE_REMOVE:
2631		usbdev_remove(dev);
2632		break;
2633	}
2634	return NOTIFY_OK;
2635}
2636
2637static struct notifier_block usbdev_nb = {
2638	.notifier_call =	usbdev_notify,
2639};
2640
2641static struct cdev usb_device_cdev;
2642
2643int __init usb_devio_init(void)
2644{
2645	int retval;
2646
2647	retval = register_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX,
2648					"usb_device");
2649	if (retval) {
2650		printk(KERN_ERR "Unable to register minors for usb_device\n");
2651		goto out;
2652	}
2653	cdev_init(&usb_device_cdev, &usbdev_file_operations);
2654	retval = cdev_add(&usb_device_cdev, USB_DEVICE_DEV, USB_DEVICE_MAX);
2655	if (retval) {
2656		printk(KERN_ERR "Unable to get usb_device major %d\n",
2657		       USB_DEVICE_MAJOR);
2658		goto error_cdev;
2659	}
2660	usb_register_notify(&usbdev_nb);
2661out:
2662	return retval;
2663
2664error_cdev:
2665	unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
2666	goto out;
2667}
2668
2669void usb_devio_cleanup(void)
2670{
2671	usb_unregister_notify(&usbdev_nb);
2672	cdev_del(&usb_device_cdev);
2673	unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
2674}