Linux Audio

Check our new training course

Loading...
v5.4
   1// SPDX-License-Identifier: GPL-2.0+
   2/*****************************************************************************/
   3
   4/*
   5 *      devio.c  --  User space communication with USB devices.
   6 *
   7 *      Copyright (C) 1999-2000  Thomas Sailer (sailer@ife.ee.ethz.ch)
   8 *
 
 
 
 
 
 
 
 
 
 
 
 
 
 
   9 *  This file implements the usbfs/x/y files, where
  10 *  x is the bus number and y the device number.
  11 *
  12 *  It allows user space programs/"drivers" to communicate directly
  13 *  with USB devices without intervening kernel driver.
  14 *
  15 *  Revision history
  16 *    22.12.1999   0.1   Initial release (split from proc_usb.c)
  17 *    04.01.2000   0.2   Turned into its own filesystem
  18 *    30.09.2005   0.3   Fix user-triggerable oops in async URB delivery
  19 *    			 (CAN-2005-3055)
  20 */
  21
  22/*****************************************************************************/
  23
  24#include <linux/fs.h>
  25#include <linux/mm.h>
  26#include <linux/sched/signal.h>
  27#include <linux/slab.h>
  28#include <linux/signal.h>
  29#include <linux/poll.h>
  30#include <linux/module.h>
  31#include <linux/string.h>
  32#include <linux/usb.h>
  33#include <linux/usbdevice_fs.h>
  34#include <linux/usb/hcd.h>	/* for usbcore internals */
  35#include <linux/cdev.h>
  36#include <linux/notifier.h>
  37#include <linux/security.h>
  38#include <linux/user_namespace.h>
  39#include <linux/scatterlist.h>
  40#include <linux/uaccess.h>
  41#include <linux/dma-mapping.h>
  42#include <asm/byteorder.h>
  43#include <linux/moduleparam.h>
  44
  45#include "usb.h"
  46
  47#ifdef CONFIG_PM
  48#define MAYBE_CAP_SUSPEND	USBDEVFS_CAP_SUSPEND
  49#else
  50#define MAYBE_CAP_SUSPEND	0
  51#endif
  52
  53#define USB_MAXBUS			64
  54#define USB_DEVICE_MAX			(USB_MAXBUS * 128)
  55#define USB_SG_SIZE			16384 /* split-size for large txs */
  56
  57/* Mutual exclusion for ps->list in resume vs. release and remove */
  58static DEFINE_MUTEX(usbfs_mutex);
  59
  60struct usb_dev_state {
  61	struct list_head list;      /* state list */
  62	struct usb_device *dev;
  63	struct file *file;
  64	spinlock_t lock;            /* protects the async urb lists */
  65	struct list_head async_pending;
  66	struct list_head async_completed;
  67	struct list_head memory_list;
  68	wait_queue_head_t wait;     /* wake up if a request completed */
  69	wait_queue_head_t wait_for_resume;   /* wake up upon runtime resume */
  70	unsigned int discsignr;
  71	struct pid *disc_pid;
  72	const struct cred *cred;
  73	sigval_t disccontext;
  74	unsigned long ifclaimed;
 
  75	u32 disabled_bulk_eps;
  76	unsigned long interface_allowed_mask;
  77	int not_yet_resumed;
  78	bool suspend_allowed;
  79	bool privileges_dropped;
  80};
  81
  82struct usb_memory {
  83	struct list_head memlist;
  84	int vma_use_count;
  85	int urb_use_count;
  86	u32 size;
  87	void *mem;
  88	dma_addr_t dma_handle;
  89	unsigned long vm_start;
  90	struct usb_dev_state *ps;
  91};
  92
  93struct async {
  94	struct list_head asynclist;
  95	struct usb_dev_state *ps;
  96	struct pid *pid;
  97	const struct cred *cred;
  98	unsigned int signr;
  99	unsigned int ifnum;
 100	void __user *userbuffer;
 101	void __user *userurb;
 102	sigval_t userurb_sigval;
 103	struct urb *urb;
 104	struct usb_memory *usbm;
 105	unsigned int mem_usage;
 106	int status;
 
 107	u8 bulk_addr;
 108	u8 bulk_status;
 109};
 110
 111static bool usbfs_snoop;
 112module_param(usbfs_snoop, bool, S_IRUGO | S_IWUSR);
 113MODULE_PARM_DESC(usbfs_snoop, "true to log all usbfs traffic");
 114
 115static unsigned usbfs_snoop_max = 65536;
 116module_param(usbfs_snoop_max, uint, S_IRUGO | S_IWUSR);
 117MODULE_PARM_DESC(usbfs_snoop_max,
 118		"maximum number of bytes to print while snooping");
 119
 120#define snoop(dev, format, arg...)				\
 121	do {							\
 122		if (usbfs_snoop)				\
 123			dev_info(dev, format, ## arg);		\
 124	} while (0)
 125
 126enum snoop_when {
 127	SUBMIT, COMPLETE
 128};
 129
 130#define USB_DEVICE_DEV		MKDEV(USB_DEVICE_MAJOR, 0)
 131
 132/* Limit on the total amount of memory we can allocate for transfers */
 133static u32 usbfs_memory_mb = 16;
 134module_param(usbfs_memory_mb, uint, 0644);
 135MODULE_PARM_DESC(usbfs_memory_mb,
 136		"maximum MB allowed for usbfs buffers (0 = no limit)");
 137
 138/* Hard limit, necessary to avoid arithmetic overflow */
 139#define USBFS_XFER_MAX         (UINT_MAX / 2 - 1000000)
 140
 141static atomic64_t usbfs_memory_usage;	/* Total memory currently allocated */
 142
 143/* Check whether it's okay to allocate more memory for a transfer */
 144static int usbfs_increase_memory_usage(u64 amount)
 145{
 146	u64 lim;
 147
 148	lim = READ_ONCE(usbfs_memory_mb);
 149	lim <<= 20;
 150
 151	atomic64_add(amount, &usbfs_memory_usage);
 152
 153	if (lim > 0 && atomic64_read(&usbfs_memory_usage) > lim) {
 154		atomic64_sub(amount, &usbfs_memory_usage);
 155		return -ENOMEM;
 156	}
 
 
 
 
 
 157
 158	return 0;
 
 
 
 
 159}
 160
 161/* Memory for a transfer is being deallocated */
 162static void usbfs_decrease_memory_usage(u64 amount)
 163{
 164	atomic64_sub(amount, &usbfs_memory_usage);
 165}
 166
 167static int connected(struct usb_dev_state *ps)
 168{
 169	return (!list_empty(&ps->list) &&
 170			ps->dev->state != USB_STATE_NOTATTACHED);
 171}
 172
 173static void dec_usb_memory_use_count(struct usb_memory *usbm, int *count)
 174{
 175	struct usb_dev_state *ps = usbm->ps;
 176	unsigned long flags;
 177
 178	spin_lock_irqsave(&ps->lock, flags);
 179	--*count;
 180	if (usbm->urb_use_count == 0 && usbm->vma_use_count == 0) {
 181		list_del(&usbm->memlist);
 182		spin_unlock_irqrestore(&ps->lock, flags);
 183
 184		usb_free_coherent(ps->dev, usbm->size, usbm->mem,
 185				usbm->dma_handle);
 186		usbfs_decrease_memory_usage(
 187			usbm->size + sizeof(struct usb_memory));
 188		kfree(usbm);
 189	} else {
 190		spin_unlock_irqrestore(&ps->lock, flags);
 191	}
 192}
 193
 194static void usbdev_vm_open(struct vm_area_struct *vma)
 195{
 196	struct usb_memory *usbm = vma->vm_private_data;
 197	unsigned long flags;
 198
 199	spin_lock_irqsave(&usbm->ps->lock, flags);
 200	++usbm->vma_use_count;
 201	spin_unlock_irqrestore(&usbm->ps->lock, flags);
 202}
 203
 204static void usbdev_vm_close(struct vm_area_struct *vma)
 205{
 206	struct usb_memory *usbm = vma->vm_private_data;
 207
 208	dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
 209}
 210
 211static const struct vm_operations_struct usbdev_vm_ops = {
 212	.open = usbdev_vm_open,
 213	.close = usbdev_vm_close
 214};
 215
 216static int usbdev_mmap(struct file *file, struct vm_area_struct *vma)
 217{
 218	struct usb_memory *usbm = NULL;
 219	struct usb_dev_state *ps = file->private_data;
 220	size_t size = vma->vm_end - vma->vm_start;
 221	void *mem;
 222	unsigned long flags;
 223	dma_addr_t dma_handle;
 224	int ret;
 225
 226	ret = usbfs_increase_memory_usage(size + sizeof(struct usb_memory));
 227	if (ret)
 228		goto error;
 229
 230	usbm = kzalloc(sizeof(struct usb_memory), GFP_KERNEL);
 231	if (!usbm) {
 232		ret = -ENOMEM;
 233		goto error_decrease_mem;
 234	}
 235
 236	mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN,
 237			&dma_handle);
 238	if (!mem) {
 239		ret = -ENOMEM;
 240		goto error_free_usbm;
 241	}
 242
 243	memset(mem, 0, size);
 244
 245	usbm->mem = mem;
 246	usbm->dma_handle = dma_handle;
 247	usbm->size = size;
 248	usbm->ps = ps;
 249	usbm->vm_start = vma->vm_start;
 250	usbm->vma_use_count = 1;
 251	INIT_LIST_HEAD(&usbm->memlist);
 252
 253	if (remap_pfn_range(vma, vma->vm_start,
 254			virt_to_phys(usbm->mem) >> PAGE_SHIFT,
 255			size, vma->vm_page_prot) < 0) {
 256		dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
 257		return -EAGAIN;
 258	}
 259
 260	vma->vm_flags |= VM_IO;
 261	vma->vm_flags |= (VM_DONTEXPAND | VM_DONTDUMP);
 262	vma->vm_ops = &usbdev_vm_ops;
 263	vma->vm_private_data = usbm;
 264
 265	spin_lock_irqsave(&ps->lock, flags);
 266	list_add_tail(&usbm->memlist, &ps->memory_list);
 267	spin_unlock_irqrestore(&ps->lock, flags);
 268
 269	return 0;
 270
 271error_free_usbm:
 272	kfree(usbm);
 273error_decrease_mem:
 274	usbfs_decrease_memory_usage(size + sizeof(struct usb_memory));
 275error:
 276	return ret;
 277}
 278
 279static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
 280			   loff_t *ppos)
 281{
 282	struct usb_dev_state *ps = file->private_data;
 283	struct usb_device *dev = ps->dev;
 284	ssize_t ret = 0;
 285	unsigned len;
 286	loff_t pos;
 287	int i;
 288
 289	pos = *ppos;
 290	usb_lock_device(dev);
 291	if (!connected(ps)) {
 292		ret = -ENODEV;
 293		goto err;
 294	} else if (pos < 0) {
 295		ret = -EINVAL;
 296		goto err;
 297	}
 298
 299	if (pos < sizeof(struct usb_device_descriptor)) {
 300		/* 18 bytes - fits on the stack */
 301		struct usb_device_descriptor temp_desc;
 302
 303		memcpy(&temp_desc, &dev->descriptor, sizeof(dev->descriptor));
 304		le16_to_cpus(&temp_desc.bcdUSB);
 305		le16_to_cpus(&temp_desc.idVendor);
 306		le16_to_cpus(&temp_desc.idProduct);
 307		le16_to_cpus(&temp_desc.bcdDevice);
 308
 309		len = sizeof(struct usb_device_descriptor) - pos;
 310		if (len > nbytes)
 311			len = nbytes;
 312		if (copy_to_user(buf, ((char *)&temp_desc) + pos, len)) {
 313			ret = -EFAULT;
 314			goto err;
 315		}
 316
 317		*ppos += len;
 318		buf += len;
 319		nbytes -= len;
 320		ret += len;
 321	}
 322
 323	pos = sizeof(struct usb_device_descriptor);
 324	for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {
 325		struct usb_config_descriptor *config =
 326			(struct usb_config_descriptor *)dev->rawdescriptors[i];
 327		unsigned int length = le16_to_cpu(config->wTotalLength);
 328
 329		if (*ppos < pos + length) {
 330
 331			/* The descriptor may claim to be longer than it
 332			 * really is.  Here is the actual allocated length. */
 333			unsigned alloclen =
 334				le16_to_cpu(dev->config[i].desc.wTotalLength);
 335
 336			len = length - (*ppos - pos);
 337			if (len > nbytes)
 338				len = nbytes;
 339
 340			/* Simply don't write (skip over) unallocated parts */
 341			if (alloclen > (*ppos - pos)) {
 342				alloclen -= (*ppos - pos);
 343				if (copy_to_user(buf,
 344				    dev->rawdescriptors[i] + (*ppos - pos),
 345				    min(len, alloclen))) {
 346					ret = -EFAULT;
 347					goto err;
 348				}
 349			}
 350
 351			*ppos += len;
 352			buf += len;
 353			nbytes -= len;
 354			ret += len;
 355		}
 356
 357		pos += length;
 358	}
 359
 360err:
 361	usb_unlock_device(dev);
 362	return ret;
 363}
 364
 365/*
 366 * async list handling
 367 */
 368
 369static struct async *alloc_async(unsigned int numisoframes)
 370{
 371	struct async *as;
 372
 373	as = kzalloc(sizeof(struct async), GFP_KERNEL);
 374	if (!as)
 375		return NULL;
 376	as->urb = usb_alloc_urb(numisoframes, GFP_KERNEL);
 377	if (!as->urb) {
 378		kfree(as);
 379		return NULL;
 380	}
 381	return as;
 382}
 383
 384static void free_async(struct async *as)
 385{
 386	int i;
 387
 388	put_pid(as->pid);
 389	if (as->cred)
 390		put_cred(as->cred);
 391	for (i = 0; i < as->urb->num_sgs; i++) {
 392		if (sg_page(&as->urb->sg[i]))
 393			kfree(sg_virt(&as->urb->sg[i]));
 394	}
 395
 396	kfree(as->urb->sg);
 397	if (as->usbm == NULL)
 398		kfree(as->urb->transfer_buffer);
 399	else
 400		dec_usb_memory_use_count(as->usbm, &as->usbm->urb_use_count);
 401
 402	kfree(as->urb->setup_packet);
 403	usb_free_urb(as->urb);
 404	usbfs_decrease_memory_usage(as->mem_usage);
 405	kfree(as);
 406}
 407
 408static void async_newpending(struct async *as)
 409{
 410	struct usb_dev_state *ps = as->ps;
 411	unsigned long flags;
 412
 413	spin_lock_irqsave(&ps->lock, flags);
 414	list_add_tail(&as->asynclist, &ps->async_pending);
 415	spin_unlock_irqrestore(&ps->lock, flags);
 416}
 417
 418static void async_removepending(struct async *as)
 419{
 420	struct usb_dev_state *ps = as->ps;
 421	unsigned long flags;
 422
 423	spin_lock_irqsave(&ps->lock, flags);
 424	list_del_init(&as->asynclist);
 425	spin_unlock_irqrestore(&ps->lock, flags);
 426}
 427
 428static struct async *async_getcompleted(struct usb_dev_state *ps)
 429{
 430	unsigned long flags;
 431	struct async *as = NULL;
 432
 433	spin_lock_irqsave(&ps->lock, flags);
 434	if (!list_empty(&ps->async_completed)) {
 435		as = list_entry(ps->async_completed.next, struct async,
 436				asynclist);
 437		list_del_init(&as->asynclist);
 438	}
 439	spin_unlock_irqrestore(&ps->lock, flags);
 440	return as;
 441}
 442
 443static struct async *async_getpending(struct usb_dev_state *ps,
 444					     void __user *userurb)
 445{
 446	struct async *as;
 447
 448	list_for_each_entry(as, &ps->async_pending, asynclist)
 449		if (as->userurb == userurb) {
 450			list_del_init(&as->asynclist);
 451			return as;
 452		}
 453
 454	return NULL;
 455}
 456
 457static void snoop_urb(struct usb_device *udev,
 458		void __user *userurb, int pipe, unsigned length,
 459		int timeout_or_status, enum snoop_when when,
 460		unsigned char *data, unsigned data_len)
 461{
 462	static const char *types[] = {"isoc", "int", "ctrl", "bulk"};
 463	static const char *dirs[] = {"out", "in"};
 464	int ep;
 465	const char *t, *d;
 466
 467	if (!usbfs_snoop)
 468		return;
 469
 470	ep = usb_pipeendpoint(pipe);
 471	t = types[usb_pipetype(pipe)];
 472	d = dirs[!!usb_pipein(pipe)];
 473
 474	if (userurb) {		/* Async */
 475		if (when == SUBMIT)
 476			dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
 477					"length %u\n",
 478					userurb, ep, t, d, length);
 479		else
 480			dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
 481					"actual_length %u status %d\n",
 482					userurb, ep, t, d, length,
 483					timeout_or_status);
 484	} else {
 485		if (when == SUBMIT)
 486			dev_info(&udev->dev, "ep%d %s-%s, length %u, "
 487					"timeout %d\n",
 488					ep, t, d, length, timeout_or_status);
 489		else
 490			dev_info(&udev->dev, "ep%d %s-%s, actual_length %u, "
 491					"status %d\n",
 492					ep, t, d, length, timeout_or_status);
 493	}
 494
 495	data_len = min(data_len, usbfs_snoop_max);
 496	if (data && data_len > 0) {
 497		print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
 498			data, data_len, 1);
 499	}
 500}
 501
 502static void snoop_urb_data(struct urb *urb, unsigned len)
 503{
 504	int i, size;
 505
 506	len = min(len, usbfs_snoop_max);
 507	if (!usbfs_snoop || len == 0)
 508		return;
 509
 510	if (urb->num_sgs == 0) {
 511		print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
 512			urb->transfer_buffer, len, 1);
 513		return;
 514	}
 515
 516	for (i = 0; i < urb->num_sgs && len; i++) {
 517		size = (len > USB_SG_SIZE) ? USB_SG_SIZE : len;
 518		print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
 519			sg_virt(&urb->sg[i]), size, 1);
 520		len -= size;
 521	}
 522}
 523
 524static int copy_urb_data_to_user(u8 __user *userbuffer, struct urb *urb)
 525{
 526	unsigned i, len, size;
 527
 528	if (urb->number_of_packets > 0)		/* Isochronous */
 529		len = urb->transfer_buffer_length;
 530	else					/* Non-Isoc */
 531		len = urb->actual_length;
 532
 533	if (urb->num_sgs == 0) {
 534		if (copy_to_user(userbuffer, urb->transfer_buffer, len))
 535			return -EFAULT;
 536		return 0;
 537	}
 538
 539	for (i = 0; i < urb->num_sgs && len; i++) {
 540		size = (len > USB_SG_SIZE) ? USB_SG_SIZE : len;
 541		if (copy_to_user(userbuffer, sg_virt(&urb->sg[i]), size))
 542			return -EFAULT;
 543		userbuffer += size;
 544		len -= size;
 545	}
 546
 547	return 0;
 548}
 549
 550#define AS_CONTINUATION	1
 551#define AS_UNLINK	2
 552
 553static void cancel_bulk_urbs(struct usb_dev_state *ps, unsigned bulk_addr)
 554__releases(ps->lock)
 555__acquires(ps->lock)
 556{
 557	struct urb *urb;
 558	struct async *as;
 559
 560	/* Mark all the pending URBs that match bulk_addr, up to but not
 561	 * including the first one without AS_CONTINUATION.  If such an
 562	 * URB is encountered then a new transfer has already started so
 563	 * the endpoint doesn't need to be disabled; otherwise it does.
 564	 */
 565	list_for_each_entry(as, &ps->async_pending, asynclist) {
 566		if (as->bulk_addr == bulk_addr) {
 567			if (as->bulk_status != AS_CONTINUATION)
 568				goto rescan;
 569			as->bulk_status = AS_UNLINK;
 570			as->bulk_addr = 0;
 571		}
 572	}
 573	ps->disabled_bulk_eps |= (1 << bulk_addr);
 574
 575	/* Now carefully unlink all the marked pending URBs */
 576 rescan:
 577	list_for_each_entry(as, &ps->async_pending, asynclist) {
 578		if (as->bulk_status == AS_UNLINK) {
 579			as->bulk_status = 0;		/* Only once */
 580			urb = as->urb;
 581			usb_get_urb(urb);
 582			spin_unlock(&ps->lock);		/* Allow completions */
 583			usb_unlink_urb(urb);
 584			usb_put_urb(urb);
 585			spin_lock(&ps->lock);
 586			goto rescan;
 587		}
 588	}
 589}
 590
 591static void async_completed(struct urb *urb)
 592{
 593	struct async *as = urb->context;
 594	struct usb_dev_state *ps = as->ps;
 
 595	struct pid *pid = NULL;
 
 596	const struct cred *cred = NULL;
 597	unsigned long flags;
 598	sigval_t addr;
 599	int signr, errno;
 600
 601	spin_lock_irqsave(&ps->lock, flags);
 602	list_move_tail(&as->asynclist, &ps->async_completed);
 603	as->status = urb->status;
 604	signr = as->signr;
 605	if (signr) {
 606		errno = as->status;
 607		addr = as->userurb_sigval;
 
 
 608		pid = get_pid(as->pid);
 609		cred = get_cred(as->cred);
 
 610	}
 611	snoop(&urb->dev->dev, "urb complete\n");
 612	snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
 613			as->status, COMPLETE, NULL, 0);
 614	if (usb_urb_dir_in(urb))
 615		snoop_urb_data(urb, urb->actual_length);
 616
 617	if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
 618			as->status != -ENOENT)
 619		cancel_bulk_urbs(ps, as->bulk_addr);
 620
 621	wake_up(&ps->wait);
 622	spin_unlock_irqrestore(&ps->lock, flags);
 623
 624	if (signr) {
 625		kill_pid_usb_asyncio(signr, errno, addr, pid, cred);
 626		put_pid(pid);
 627		put_cred(cred);
 628	}
 
 
 629}
 630
 631static void destroy_async(struct usb_dev_state *ps, struct list_head *list)
 632{
 633	struct urb *urb;
 634	struct async *as;
 635	unsigned long flags;
 636
 637	spin_lock_irqsave(&ps->lock, flags);
 638	while (!list_empty(list)) {
 639		as = list_entry(list->next, struct async, asynclist);
 640		list_del_init(&as->asynclist);
 641		urb = as->urb;
 642		usb_get_urb(urb);
 643
 644		/* drop the spinlock so the completion handler can run */
 645		spin_unlock_irqrestore(&ps->lock, flags);
 646		usb_kill_urb(urb);
 647		usb_put_urb(urb);
 648		spin_lock_irqsave(&ps->lock, flags);
 649	}
 650	spin_unlock_irqrestore(&ps->lock, flags);
 651}
 652
 653static void destroy_async_on_interface(struct usb_dev_state *ps,
 654				       unsigned int ifnum)
 655{
 656	struct list_head *p, *q, hitlist;
 657	unsigned long flags;
 658
 659	INIT_LIST_HEAD(&hitlist);
 660	spin_lock_irqsave(&ps->lock, flags);
 661	list_for_each_safe(p, q, &ps->async_pending)
 662		if (ifnum == list_entry(p, struct async, asynclist)->ifnum)
 663			list_move_tail(p, &hitlist);
 664	spin_unlock_irqrestore(&ps->lock, flags);
 665	destroy_async(ps, &hitlist);
 666}
 667
 668static void destroy_all_async(struct usb_dev_state *ps)
 669{
 670	destroy_async(ps, &ps->async_pending);
 671}
 672
 673/*
 674 * interface claims are made only at the request of user level code,
 675 * which can also release them (explicitly or by closing files).
 676 * they're also undone when devices disconnect.
 677 */
 678
 679static int driver_probe(struct usb_interface *intf,
 680			const struct usb_device_id *id)
 681{
 682	return -ENODEV;
 683}
 684
 685static void driver_disconnect(struct usb_interface *intf)
 686{
 687	struct usb_dev_state *ps = usb_get_intfdata(intf);
 688	unsigned int ifnum = intf->altsetting->desc.bInterfaceNumber;
 689
 690	if (!ps)
 691		return;
 692
 693	/* NOTE:  this relies on usbcore having canceled and completed
 694	 * all pending I/O requests; 2.6 does that.
 695	 */
 696
 697	if (likely(ifnum < 8*sizeof(ps->ifclaimed)))
 698		clear_bit(ifnum, &ps->ifclaimed);
 699	else
 700		dev_warn(&intf->dev, "interface number %u out of range\n",
 701			 ifnum);
 702
 703	usb_set_intfdata(intf, NULL);
 704
 705	/* force async requests to complete */
 706	destroy_async_on_interface(ps, ifnum);
 707}
 708
 709/* We don't care about suspend/resume of claimed interfaces */
 
 
 710static int driver_suspend(struct usb_interface *intf, pm_message_t msg)
 711{
 712	return 0;
 713}
 714
 715static int driver_resume(struct usb_interface *intf)
 716{
 717	return 0;
 718}
 719
 720/* The following routines apply to the entire device, not interfaces */
 721void usbfs_notify_suspend(struct usb_device *udev)
 722{
 723	/* We don't need to handle this */
 724}
 725
 726void usbfs_notify_resume(struct usb_device *udev)
 727{
 728	struct usb_dev_state *ps;
 729
 730	/* Protect against simultaneous remove or release */
 731	mutex_lock(&usbfs_mutex);
 732	list_for_each_entry(ps, &udev->filelist, list) {
 733		WRITE_ONCE(ps->not_yet_resumed, 0);
 734		wake_up_all(&ps->wait_for_resume);
 735	}
 736	mutex_unlock(&usbfs_mutex);
 737}
 738
 739struct usb_driver usbfs_driver = {
 740	.name =		"usbfs",
 741	.probe =	driver_probe,
 742	.disconnect =	driver_disconnect,
 743	.suspend =	driver_suspend,
 744	.resume =	driver_resume,
 745	.supports_autosuspend = 1,
 746};
 747
 748static int claimintf(struct usb_dev_state *ps, unsigned int ifnum)
 749{
 750	struct usb_device *dev = ps->dev;
 751	struct usb_interface *intf;
 752	int err;
 753
 754	if (ifnum >= 8*sizeof(ps->ifclaimed))
 755		return -EINVAL;
 756	/* already claimed */
 757	if (test_bit(ifnum, &ps->ifclaimed))
 758		return 0;
 759
 760	if (ps->privileges_dropped &&
 761			!test_bit(ifnum, &ps->interface_allowed_mask))
 762		return -EACCES;
 763
 764	intf = usb_ifnum_to_if(dev, ifnum);
 765	if (!intf)
 766		err = -ENOENT;
 767	else
 768		err = usb_driver_claim_interface(&usbfs_driver, intf, ps);
 769	if (err == 0)
 770		set_bit(ifnum, &ps->ifclaimed);
 771	return err;
 772}
 773
 774static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum)
 775{
 776	struct usb_device *dev;
 777	struct usb_interface *intf;
 778	int err;
 779
 780	err = -EINVAL;
 781	if (ifnum >= 8*sizeof(ps->ifclaimed))
 782		return err;
 783	dev = ps->dev;
 784	intf = usb_ifnum_to_if(dev, ifnum);
 785	if (!intf)
 786		err = -ENOENT;
 787	else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) {
 788		usb_driver_release_interface(&usbfs_driver, intf);
 789		err = 0;
 790	}
 791	return err;
 792}
 793
 794static int checkintf(struct usb_dev_state *ps, unsigned int ifnum)
 795{
 796	if (ps->dev->state != USB_STATE_CONFIGURED)
 797		return -EHOSTUNREACH;
 798	if (ifnum >= 8*sizeof(ps->ifclaimed))
 799		return -EINVAL;
 800	if (test_bit(ifnum, &ps->ifclaimed))
 801		return 0;
 802	/* if not yet claimed, claim it for the driver */
 803	dev_warn(&ps->dev->dev, "usbfs: process %d (%s) did not claim "
 804		 "interface %u before use\n", task_pid_nr(current),
 805		 current->comm, ifnum);
 806	return claimintf(ps, ifnum);
 807}
 808
 809static int findintfep(struct usb_device *dev, unsigned int ep)
 810{
 811	unsigned int i, j, e;
 812	struct usb_interface *intf;
 813	struct usb_host_interface *alts;
 814	struct usb_endpoint_descriptor *endpt;
 815
 816	if (ep & ~(USB_DIR_IN|0xf))
 817		return -EINVAL;
 818	if (!dev->actconfig)
 819		return -ESRCH;
 820	for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
 821		intf = dev->actconfig->interface[i];
 822		for (j = 0; j < intf->num_altsetting; j++) {
 823			alts = &intf->altsetting[j];
 824			for (e = 0; e < alts->desc.bNumEndpoints; e++) {
 825				endpt = &alts->endpoint[e].desc;
 826				if (endpt->bEndpointAddress == ep)
 827					return alts->desc.bInterfaceNumber;
 828			}
 829		}
 830	}
 831	return -ENOENT;
 832}
 833
 834static int check_ctrlrecip(struct usb_dev_state *ps, unsigned int requesttype,
 835			   unsigned int request, unsigned int index)
 836{
 837	int ret = 0;
 838	struct usb_host_interface *alt_setting;
 839
 840	if (ps->dev->state != USB_STATE_UNAUTHENTICATED
 841	 && ps->dev->state != USB_STATE_ADDRESS
 842	 && ps->dev->state != USB_STATE_CONFIGURED)
 843		return -EHOSTUNREACH;
 844	if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
 845		return 0;
 846
 847	/*
 848	 * check for the special corner case 'get_device_id' in the printer
 849	 * class specification, which we always want to allow as it is used
 850	 * to query things like ink level, etc.
 851	 */
 852	if (requesttype == 0xa1 && request == 0) {
 853		alt_setting = usb_find_alt_setting(ps->dev->actconfig,
 854						   index >> 8, index & 0xff);
 855		if (alt_setting
 856		 && alt_setting->desc.bInterfaceClass == USB_CLASS_PRINTER)
 857			return 0;
 858	}
 859
 860	index &= 0xff;
 861	switch (requesttype & USB_RECIP_MASK) {
 862	case USB_RECIP_ENDPOINT:
 863		if ((index & ~USB_DIR_IN) == 0)
 864			return 0;
 865		ret = findintfep(ps->dev, index);
 866		if (ret < 0) {
 867			/*
 868			 * Some not fully compliant Win apps seem to get
 869			 * index wrong and have the endpoint number here
 870			 * rather than the endpoint address (with the
 871			 * correct direction). Win does let this through,
 872			 * so we'll not reject it here but leave it to
 873			 * the device to not break KVM. But we warn.
 874			 */
 875			ret = findintfep(ps->dev, index ^ 0x80);
 876			if (ret >= 0)
 877				dev_info(&ps->dev->dev,
 878					"%s: process %i (%s) requesting ep %02x but needs %02x\n",
 879					__func__, task_pid_nr(current),
 880					current->comm, index, index ^ 0x80);
 881		}
 882		if (ret >= 0)
 883			ret = checkintf(ps, ret);
 884		break;
 885
 886	case USB_RECIP_INTERFACE:
 887		ret = checkintf(ps, index);
 888		break;
 889	}
 890	return ret;
 891}
 892
 893static struct usb_host_endpoint *ep_to_host_endpoint(struct usb_device *dev,
 894						     unsigned char ep)
 895{
 896	if (ep & USB_ENDPOINT_DIR_MASK)
 897		return dev->ep_in[ep & USB_ENDPOINT_NUMBER_MASK];
 898	else
 899		return dev->ep_out[ep & USB_ENDPOINT_NUMBER_MASK];
 900}
 901
 902static int parse_usbdevfs_streams(struct usb_dev_state *ps,
 903				  struct usbdevfs_streams __user *streams,
 904				  unsigned int *num_streams_ret,
 905				  unsigned int *num_eps_ret,
 906				  struct usb_host_endpoint ***eps_ret,
 907				  struct usb_interface **intf_ret)
 908{
 909	unsigned int i, num_streams, num_eps;
 910	struct usb_host_endpoint **eps;
 911	struct usb_interface *intf = NULL;
 912	unsigned char ep;
 913	int ifnum, ret;
 914
 915	if (get_user(num_streams, &streams->num_streams) ||
 916	    get_user(num_eps, &streams->num_eps))
 917		return -EFAULT;
 918
 919	if (num_eps < 1 || num_eps > USB_MAXENDPOINTS)
 920		return -EINVAL;
 921
 922	/* The XHCI controller allows max 2 ^ 16 streams */
 923	if (num_streams_ret && (num_streams < 2 || num_streams > 65536))
 924		return -EINVAL;
 925
 926	eps = kmalloc_array(num_eps, sizeof(*eps), GFP_KERNEL);
 927	if (!eps)
 928		return -ENOMEM;
 929
 930	for (i = 0; i < num_eps; i++) {
 931		if (get_user(ep, &streams->eps[i])) {
 932			ret = -EFAULT;
 933			goto error;
 934		}
 935		eps[i] = ep_to_host_endpoint(ps->dev, ep);
 936		if (!eps[i]) {
 937			ret = -EINVAL;
 938			goto error;
 939		}
 940
 941		/* usb_alloc/free_streams operate on an usb_interface */
 942		ifnum = findintfep(ps->dev, ep);
 943		if (ifnum < 0) {
 944			ret = ifnum;
 945			goto error;
 946		}
 947
 948		if (i == 0) {
 949			ret = checkintf(ps, ifnum);
 950			if (ret < 0)
 951				goto error;
 952			intf = usb_ifnum_to_if(ps->dev, ifnum);
 953		} else {
 954			/* Verify all eps belong to the same interface */
 955			if (ifnum != intf->altsetting->desc.bInterfaceNumber) {
 956				ret = -EINVAL;
 957				goto error;
 958			}
 959		}
 960	}
 961
 962	if (num_streams_ret)
 963		*num_streams_ret = num_streams;
 964	*num_eps_ret = num_eps;
 965	*eps_ret = eps;
 966	*intf_ret = intf;
 967
 968	return 0;
 969
 970error:
 971	kfree(eps);
 972	return ret;
 973}
 974
 975static struct usb_device *usbdev_lookup_by_devt(dev_t devt)
 976{
 977	struct device *dev;
 978
 979	dev = bus_find_device_by_devt(&usb_bus_type, devt);
 
 980	if (!dev)
 981		return NULL;
 982	return to_usb_device(dev);
 983}
 984
 985/*
 986 * file operations
 987 */
 988static int usbdev_open(struct inode *inode, struct file *file)
 989{
 990	struct usb_device *dev = NULL;
 991	struct usb_dev_state *ps;
 992	int ret;
 993
 994	ret = -ENOMEM;
 995	ps = kzalloc(sizeof(struct usb_dev_state), GFP_KERNEL);
 996	if (!ps)
 997		goto out_free_ps;
 998
 999	ret = -ENODEV;
1000
 
 
 
1001	/* usbdev device-node */
1002	if (imajor(inode) == USB_DEVICE_MAJOR)
1003		dev = usbdev_lookup_by_devt(inode->i_rdev);
 
 
 
1004	if (!dev)
1005		goto out_free_ps;
1006
1007	usb_lock_device(dev);
1008	if (dev->state == USB_STATE_NOTATTACHED)
1009		goto out_unlock_device;
1010
1011	ret = usb_autoresume_device(dev);
1012	if (ret)
1013		goto out_unlock_device;
1014
1015	ps->dev = dev;
1016	ps->file = file;
1017	ps->interface_allowed_mask = 0xFFFFFFFF; /* 32 bits */
1018	spin_lock_init(&ps->lock);
1019	INIT_LIST_HEAD(&ps->list);
1020	INIT_LIST_HEAD(&ps->async_pending);
1021	INIT_LIST_HEAD(&ps->async_completed);
1022	INIT_LIST_HEAD(&ps->memory_list);
1023	init_waitqueue_head(&ps->wait);
1024	init_waitqueue_head(&ps->wait_for_resume);
1025	ps->disc_pid = get_pid(task_pid(current));
1026	ps->cred = get_current_cred();
 
 
 
1027	smp_wmb();
1028
1029	/* Can't race with resume; the device is already active */
1030	list_add_tail(&ps->list, &dev->filelist);
1031	file->private_data = ps;
1032	usb_unlock_device(dev);
1033	snoop(&dev->dev, "opened by process %d: %s\n", task_pid_nr(current),
1034			current->comm);
1035	return ret;
1036
1037 out_unlock_device:
1038	usb_unlock_device(dev);
1039	usb_put_dev(dev);
1040 out_free_ps:
1041	kfree(ps);
1042	return ret;
1043}
1044
1045static int usbdev_release(struct inode *inode, struct file *file)
1046{
1047	struct usb_dev_state *ps = file->private_data;
1048	struct usb_device *dev = ps->dev;
1049	unsigned int ifnum;
1050	struct async *as;
1051
1052	usb_lock_device(dev);
1053	usb_hub_release_all_ports(dev, ps);
1054
1055	/* Protect against simultaneous resume */
1056	mutex_lock(&usbfs_mutex);
1057	list_del_init(&ps->list);
1058	mutex_unlock(&usbfs_mutex);
1059
1060	for (ifnum = 0; ps->ifclaimed && ifnum < 8*sizeof(ps->ifclaimed);
1061			ifnum++) {
1062		if (test_bit(ifnum, &ps->ifclaimed))
1063			releaseintf(ps, ifnum);
1064	}
1065	destroy_all_async(ps);
1066	if (!ps->suspend_allowed)
1067		usb_autosuspend_device(dev);
1068	usb_unlock_device(dev);
1069	usb_put_dev(dev);
1070	put_pid(ps->disc_pid);
1071	put_cred(ps->cred);
1072
1073	as = async_getcompleted(ps);
1074	while (as) {
1075		free_async(as);
1076		as = async_getcompleted(ps);
1077	}
1078
1079	kfree(ps);
1080	return 0;
1081}
1082
1083static int proc_control(struct usb_dev_state *ps, void __user *arg)
1084{
1085	struct usb_device *dev = ps->dev;
1086	struct usbdevfs_ctrltransfer ctrl;
1087	unsigned int tmo;
1088	unsigned char *tbuf;
1089	unsigned wLength;
1090	int i, pipe, ret;
1091
1092	if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
1093		return -EFAULT;
1094	ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.bRequest,
1095			      ctrl.wIndex);
1096	if (ret)
1097		return ret;
1098	wLength = ctrl.wLength;		/* To suppress 64k PAGE_SIZE warning */
1099	if (wLength > PAGE_SIZE)
1100		return -EINVAL;
1101	ret = usbfs_increase_memory_usage(PAGE_SIZE + sizeof(struct urb) +
1102			sizeof(struct usb_ctrlrequest));
1103	if (ret)
1104		return ret;
1105	tbuf = (unsigned char *)__get_free_page(GFP_KERNEL);
1106	if (!tbuf) {
1107		ret = -ENOMEM;
1108		goto done;
1109	}
1110	tmo = ctrl.timeout;
1111	snoop(&dev->dev, "control urb: bRequestType=%02x "
1112		"bRequest=%02x wValue=%04x "
1113		"wIndex=%04x wLength=%04x\n",
1114		ctrl.bRequestType, ctrl.bRequest, ctrl.wValue,
1115		ctrl.wIndex, ctrl.wLength);
 
 
1116	if (ctrl.bRequestType & 0x80) {
1117		if (ctrl.wLength && !access_ok(ctrl.data,
1118					       ctrl.wLength)) {
1119			ret = -EINVAL;
1120			goto done;
1121		}
1122		pipe = usb_rcvctrlpipe(dev, 0);
1123		snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT, NULL, 0);
1124
1125		usb_unlock_device(dev);
1126		i = usb_control_msg(dev, pipe, ctrl.bRequest,
1127				    ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
1128				    tbuf, ctrl.wLength, tmo);
1129		usb_lock_device(dev);
1130		snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE,
1131			  tbuf, max(i, 0));
1132		if ((i > 0) && ctrl.wLength) {
1133			if (copy_to_user(ctrl.data, tbuf, i)) {
1134				ret = -EFAULT;
1135				goto done;
1136			}
1137		}
1138	} else {
1139		if (ctrl.wLength) {
1140			if (copy_from_user(tbuf, ctrl.data, ctrl.wLength)) {
1141				ret = -EFAULT;
1142				goto done;
1143			}
1144		}
1145		pipe = usb_sndctrlpipe(dev, 0);
1146		snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT,
1147			tbuf, ctrl.wLength);
1148
1149		usb_unlock_device(dev);
1150		i = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ctrl.bRequest,
1151				    ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
1152				    tbuf, ctrl.wLength, tmo);
1153		usb_lock_device(dev);
1154		snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE, NULL, 0);
1155	}
1156	if (i < 0 && i != -EPIPE) {
1157		dev_printk(KERN_DEBUG, &dev->dev, "usbfs: USBDEVFS_CONTROL "
1158			   "failed cmd %s rqt %u rq %u len %u ret %d\n",
1159			   current->comm, ctrl.bRequestType, ctrl.bRequest,
1160			   ctrl.wLength, i);
1161	}
1162	ret = i;
1163 done:
1164	free_page((unsigned long) tbuf);
1165	usbfs_decrease_memory_usage(PAGE_SIZE + sizeof(struct urb) +
1166			sizeof(struct usb_ctrlrequest));
1167	return ret;
1168}
1169
1170static int proc_bulk(struct usb_dev_state *ps, void __user *arg)
1171{
1172	struct usb_device *dev = ps->dev;
1173	struct usbdevfs_bulktransfer bulk;
1174	unsigned int tmo, len1, pipe;
1175	int len2;
1176	unsigned char *tbuf;
1177	int i, ret;
1178
1179	if (copy_from_user(&bulk, arg, sizeof(bulk)))
1180		return -EFAULT;
1181	ret = findintfep(ps->dev, bulk.ep);
1182	if (ret < 0)
1183		return ret;
1184	ret = checkintf(ps, ret);
1185	if (ret)
1186		return ret;
1187	if (bulk.ep & USB_DIR_IN)
1188		pipe = usb_rcvbulkpipe(dev, bulk.ep & 0x7f);
1189	else
1190		pipe = usb_sndbulkpipe(dev, bulk.ep & 0x7f);
1191	if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN)))
1192		return -EINVAL;
1193	len1 = bulk.len;
1194	if (len1 >= (INT_MAX - sizeof(struct urb)))
1195		return -EINVAL;
1196	ret = usbfs_increase_memory_usage(len1 + sizeof(struct urb));
1197	if (ret)
1198		return ret;
1199	tbuf = kmalloc(len1, GFP_KERNEL);
1200	if (!tbuf) {
1201		ret = -ENOMEM;
1202		goto done;
1203	}
1204	tmo = bulk.timeout;
1205	if (bulk.ep & 0x80) {
1206		if (len1 && !access_ok(bulk.data, len1)) {
1207			ret = -EINVAL;
1208			goto done;
1209		}
1210		snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, NULL, 0);
1211
1212		usb_unlock_device(dev);
1213		i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
1214		usb_lock_device(dev);
1215		snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, tbuf, len2);
1216
1217		if (!i && len2) {
1218			if (copy_to_user(bulk.data, tbuf, len2)) {
1219				ret = -EFAULT;
1220				goto done;
1221			}
1222		}
1223	} else {
1224		if (len1) {
1225			if (copy_from_user(tbuf, bulk.data, len1)) {
1226				ret = -EFAULT;
1227				goto done;
1228			}
1229		}
1230		snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, tbuf, len1);
1231
1232		usb_unlock_device(dev);
1233		i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
1234		usb_lock_device(dev);
1235		snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, NULL, 0);
1236	}
1237	ret = (i < 0 ? i : len2);
1238 done:
1239	kfree(tbuf);
1240	usbfs_decrease_memory_usage(len1 + sizeof(struct urb));
1241	return ret;
1242}
1243
1244static void check_reset_of_active_ep(struct usb_device *udev,
1245		unsigned int epnum, char *ioctl_name)
1246{
1247	struct usb_host_endpoint **eps;
1248	struct usb_host_endpoint *ep;
1249
1250	eps = (epnum & USB_DIR_IN) ? udev->ep_in : udev->ep_out;
1251	ep = eps[epnum & 0x0f];
1252	if (ep && !list_empty(&ep->urb_list))
1253		dev_warn(&udev->dev, "Process %d (%s) called USBDEVFS_%s for active endpoint 0x%02x\n",
1254				task_pid_nr(current), current->comm,
1255				ioctl_name, epnum);
1256}
1257
1258static int proc_resetep(struct usb_dev_state *ps, void __user *arg)
1259{
1260	unsigned int ep;
1261	int ret;
1262
1263	if (get_user(ep, (unsigned int __user *)arg))
1264		return -EFAULT;
1265	ret = findintfep(ps->dev, ep);
1266	if (ret < 0)
1267		return ret;
1268	ret = checkintf(ps, ret);
1269	if (ret)
1270		return ret;
1271	check_reset_of_active_ep(ps->dev, ep, "RESETEP");
1272	usb_reset_endpoint(ps->dev, ep);
1273	return 0;
1274}
1275
1276static int proc_clearhalt(struct usb_dev_state *ps, void __user *arg)
1277{
1278	unsigned int ep;
1279	int pipe;
1280	int ret;
1281
1282	if (get_user(ep, (unsigned int __user *)arg))
1283		return -EFAULT;
1284	ret = findintfep(ps->dev, ep);
1285	if (ret < 0)
1286		return ret;
1287	ret = checkintf(ps, ret);
1288	if (ret)
1289		return ret;
1290	check_reset_of_active_ep(ps->dev, ep, "CLEAR_HALT");
1291	if (ep & USB_DIR_IN)
1292		pipe = usb_rcvbulkpipe(ps->dev, ep & 0x7f);
1293	else
1294		pipe = usb_sndbulkpipe(ps->dev, ep & 0x7f);
1295
1296	return usb_clear_halt(ps->dev, pipe);
1297}
1298
1299static int proc_getdriver(struct usb_dev_state *ps, void __user *arg)
1300{
1301	struct usbdevfs_getdriver gd;
1302	struct usb_interface *intf;
1303	int ret;
1304
1305	if (copy_from_user(&gd, arg, sizeof(gd)))
1306		return -EFAULT;
1307	intf = usb_ifnum_to_if(ps->dev, gd.interface);
1308	if (!intf || !intf->dev.driver)
1309		ret = -ENODATA;
1310	else {
1311		strlcpy(gd.driver, intf->dev.driver->name,
1312				sizeof(gd.driver));
1313		ret = (copy_to_user(arg, &gd, sizeof(gd)) ? -EFAULT : 0);
1314	}
1315	return ret;
1316}
1317
1318static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg)
1319{
1320	struct usbdevfs_connectinfo ci;
1321
1322	memset(&ci, 0, sizeof(ci));
1323	ci.devnum = ps->dev->devnum;
1324	ci.slow = ps->dev->speed == USB_SPEED_LOW;
1325
1326	if (copy_to_user(arg, &ci, sizeof(ci)))
1327		return -EFAULT;
1328	return 0;
1329}
1330
1331static int proc_conninfo_ex(struct usb_dev_state *ps,
1332			    void __user *arg, size_t size)
1333{
1334	struct usbdevfs_conninfo_ex ci;
1335	struct usb_device *udev = ps->dev;
1336
1337	if (size < sizeof(ci.size))
1338		return -EINVAL;
1339
1340	memset(&ci, 0, sizeof(ci));
1341	ci.size = sizeof(ci);
1342	ci.busnum = udev->bus->busnum;
1343	ci.devnum = udev->devnum;
1344	ci.speed = udev->speed;
1345
1346	while (udev && udev->portnum != 0) {
1347		if (++ci.num_ports <= ARRAY_SIZE(ci.ports))
1348			ci.ports[ARRAY_SIZE(ci.ports) - ci.num_ports] =
1349					udev->portnum;
1350		udev = udev->parent;
1351	}
1352
1353	if (ci.num_ports < ARRAY_SIZE(ci.ports))
1354		memmove(&ci.ports[0],
1355			&ci.ports[ARRAY_SIZE(ci.ports) - ci.num_ports],
1356			ci.num_ports);
1357
1358	if (copy_to_user(arg, &ci, min(sizeof(ci), size)))
1359		return -EFAULT;
1360
1361	return 0;
1362}
1363
1364static int proc_resetdevice(struct usb_dev_state *ps)
1365{
1366	struct usb_host_config *actconfig = ps->dev->actconfig;
1367	struct usb_interface *interface;
1368	int i, number;
1369
1370	/* Don't allow a device reset if the process has dropped the
1371	 * privilege to do such things and any of the interfaces are
1372	 * currently claimed.
1373	 */
1374	if (ps->privileges_dropped && actconfig) {
1375		for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
1376			interface = actconfig->interface[i];
1377			number = interface->cur_altsetting->desc.bInterfaceNumber;
1378			if (usb_interface_claimed(interface) &&
1379					!test_bit(number, &ps->ifclaimed)) {
1380				dev_warn(&ps->dev->dev,
1381					"usbfs: interface %d claimed by %s while '%s' resets device\n",
1382					number,	interface->dev.driver->name, current->comm);
1383				return -EACCES;
1384			}
1385		}
1386	}
1387
1388	return usb_reset_device(ps->dev);
1389}
1390
1391static int proc_setintf(struct usb_dev_state *ps, void __user *arg)
1392{
1393	struct usbdevfs_setinterface setintf;
1394	int ret;
1395
1396	if (copy_from_user(&setintf, arg, sizeof(setintf)))
1397		return -EFAULT;
1398	ret = checkintf(ps, setintf.interface);
1399	if (ret)
1400		return ret;
1401
1402	destroy_async_on_interface(ps, setintf.interface);
1403
1404	return usb_set_interface(ps->dev, setintf.interface,
1405			setintf.altsetting);
1406}
1407
1408static int proc_setconfig(struct usb_dev_state *ps, void __user *arg)
1409{
1410	int u;
1411	int status = 0;
1412	struct usb_host_config *actconfig;
1413
1414	if (get_user(u, (int __user *)arg))
1415		return -EFAULT;
1416
1417	actconfig = ps->dev->actconfig;
1418
1419	/* Don't touch the device if any interfaces are claimed.
1420	 * It could interfere with other drivers' operations, and if
1421	 * an interface is claimed by usbfs it could easily deadlock.
1422	 */
1423	if (actconfig) {
1424		int i;
1425
1426		for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
1427			if (usb_interface_claimed(actconfig->interface[i])) {
1428				dev_warn(&ps->dev->dev,
1429					"usbfs: interface %d claimed by %s "
1430					"while '%s' sets config #%d\n",
1431					actconfig->interface[i]
1432						->cur_altsetting
1433						->desc.bInterfaceNumber,
1434					actconfig->interface[i]
1435						->dev.driver->name,
1436					current->comm, u);
1437				status = -EBUSY;
1438				break;
1439			}
1440		}
1441	}
1442
1443	/* SET_CONFIGURATION is often abused as a "cheap" driver reset,
1444	 * so avoid usb_set_configuration()'s kick to sysfs
1445	 */
1446	if (status == 0) {
1447		if (actconfig && actconfig->desc.bConfigurationValue == u)
1448			status = usb_reset_configuration(ps->dev);
1449		else
1450			status = usb_set_configuration(ps->dev, u);
1451	}
1452
1453	return status;
1454}
1455
1456static struct usb_memory *
1457find_memory_area(struct usb_dev_state *ps, const struct usbdevfs_urb *uurb)
1458{
1459	struct usb_memory *usbm = NULL, *iter;
1460	unsigned long flags;
1461	unsigned long uurb_start = (unsigned long)uurb->buffer;
1462
1463	spin_lock_irqsave(&ps->lock, flags);
1464	list_for_each_entry(iter, &ps->memory_list, memlist) {
1465		if (uurb_start >= iter->vm_start &&
1466				uurb_start < iter->vm_start + iter->size) {
1467			if (uurb->buffer_length > iter->vm_start + iter->size -
1468					uurb_start) {
1469				usbm = ERR_PTR(-EINVAL);
1470			} else {
1471				usbm = iter;
1472				usbm->urb_use_count++;
1473			}
1474			break;
1475		}
1476	}
1477	spin_unlock_irqrestore(&ps->lock, flags);
1478	return usbm;
1479}
1480
1481static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb,
1482			struct usbdevfs_iso_packet_desc __user *iso_frame_desc,
1483			void __user *arg, sigval_t userurb_sigval)
1484{
1485	struct usbdevfs_iso_packet_desc *isopkt = NULL;
1486	struct usb_host_endpoint *ep;
1487	struct async *as = NULL;
1488	struct usb_ctrlrequest *dr = NULL;
1489	unsigned int u, totlen, isofrmlen;
1490	int i, ret, num_sgs = 0, ifnum = -1;
1491	int number_of_packets = 0;
1492	unsigned int stream_id = 0;
1493	void *buf;
1494	bool is_in;
1495	bool allow_short = false;
1496	bool allow_zero = false;
1497	unsigned long mask =	USBDEVFS_URB_SHORT_NOT_OK |
1498				USBDEVFS_URB_BULK_CONTINUATION |
1499				USBDEVFS_URB_NO_FSBR |
1500				USBDEVFS_URB_ZERO_PACKET |
1501				USBDEVFS_URB_NO_INTERRUPT;
1502	/* USBDEVFS_URB_ISO_ASAP is a special case */
1503	if (uurb->type == USBDEVFS_URB_TYPE_ISO)
1504		mask |= USBDEVFS_URB_ISO_ASAP;
1505
1506	if (uurb->flags & ~mask)
1507			return -EINVAL;
1508
1509	if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
1510		return -EINVAL;
1511	if (uurb->buffer_length > 0 && !uurb->buffer)
1512		return -EINVAL;
1513	if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
1514	    (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
1515		ifnum = findintfep(ps->dev, uurb->endpoint);
1516		if (ifnum < 0)
1517			return ifnum;
1518		ret = checkintf(ps, ifnum);
1519		if (ret)
1520			return ret;
1521	}
1522	ep = ep_to_host_endpoint(ps->dev, uurb->endpoint);
 
 
 
 
 
 
1523	if (!ep)
1524		return -ENOENT;
1525	is_in = (uurb->endpoint & USB_ENDPOINT_DIR_MASK) != 0;
1526
1527	u = 0;
1528	switch (uurb->type) {
1529	case USBDEVFS_URB_TYPE_CONTROL:
1530		if (!usb_endpoint_xfer_control(&ep->desc))
1531			return -EINVAL;
1532		/* min 8 byte setup packet */
1533		if (uurb->buffer_length < 8)
1534			return -EINVAL;
1535		dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
1536		if (!dr)
1537			return -ENOMEM;
1538		if (copy_from_user(dr, uurb->buffer, 8)) {
1539			ret = -EFAULT;
1540			goto error;
1541		}
1542		if (uurb->buffer_length < (le16_to_cpu(dr->wLength) + 8)) {
1543			ret = -EINVAL;
1544			goto error;
1545		}
1546		ret = check_ctrlrecip(ps, dr->bRequestType, dr->bRequest,
1547				      le16_to_cpu(dr->wIndex));
1548		if (ret)
1549			goto error;
1550		uurb->buffer_length = le16_to_cpu(dr->wLength);
 
1551		uurb->buffer += 8;
1552		if ((dr->bRequestType & USB_DIR_IN) && uurb->buffer_length) {
1553			is_in = 1;
1554			uurb->endpoint |= USB_DIR_IN;
1555		} else {
1556			is_in = 0;
1557			uurb->endpoint &= ~USB_DIR_IN;
1558		}
1559		if (is_in)
1560			allow_short = true;
1561		snoop(&ps->dev->dev, "control urb: bRequestType=%02x "
1562			"bRequest=%02x wValue=%04x "
1563			"wIndex=%04x wLength=%04x\n",
1564			dr->bRequestType, dr->bRequest,
1565			__le16_to_cpu(dr->wValue),
1566			__le16_to_cpu(dr->wIndex),
1567			__le16_to_cpu(dr->wLength));
1568		u = sizeof(struct usb_ctrlrequest);
1569		break;
1570
1571	case USBDEVFS_URB_TYPE_BULK:
1572		if (!is_in)
1573			allow_zero = true;
1574		else
1575			allow_short = true;
1576		switch (usb_endpoint_type(&ep->desc)) {
1577		case USB_ENDPOINT_XFER_CONTROL:
1578		case USB_ENDPOINT_XFER_ISOC:
1579			return -EINVAL;
1580		case USB_ENDPOINT_XFER_INT:
1581			/* allow single-shot interrupt transfers */
1582			uurb->type = USBDEVFS_URB_TYPE_INTERRUPT;
1583			goto interrupt_urb;
1584		}
1585		num_sgs = DIV_ROUND_UP(uurb->buffer_length, USB_SG_SIZE);
1586		if (num_sgs == 1 || num_sgs > ps->dev->bus->sg_tablesize)
1587			num_sgs = 0;
1588		if (ep->streams)
1589			stream_id = uurb->stream_id;
1590		break;
1591
1592	case USBDEVFS_URB_TYPE_INTERRUPT:
1593		if (!usb_endpoint_xfer_int(&ep->desc))
1594			return -EINVAL;
1595 interrupt_urb:
1596		if (!is_in)
1597			allow_zero = true;
1598		else
1599			allow_short = true;
1600		break;
1601
1602	case USBDEVFS_URB_TYPE_ISO:
1603		/* arbitrary limit */
1604		if (uurb->number_of_packets < 1 ||
1605		    uurb->number_of_packets > 128)
1606			return -EINVAL;
1607		if (!usb_endpoint_xfer_isoc(&ep->desc))
1608			return -EINVAL;
1609		number_of_packets = uurb->number_of_packets;
1610		isofrmlen = sizeof(struct usbdevfs_iso_packet_desc) *
1611				   number_of_packets;
1612		isopkt = memdup_user(iso_frame_desc, isofrmlen);
1613		if (IS_ERR(isopkt)) {
1614			ret = PTR_ERR(isopkt);
1615			isopkt = NULL;
1616			goto error;
1617		}
1618		for (totlen = u = 0; u < number_of_packets; u++) {
1619			/*
1620			 * arbitrary limit need for USB 3.1 Gen2
1621			 * sizemax: 96 DPs at SSP, 96 * 1024 = 98304
1622			 */
1623			if (isopkt[u].length > 98304) {
1624				ret = -EINVAL;
1625				goto error;
1626			}
1627			totlen += isopkt[u].length;
1628		}
1629		u *= sizeof(struct usb_iso_packet_descriptor);
1630		uurb->buffer_length = totlen;
1631		break;
1632
1633	default:
1634		return -EINVAL;
1635	}
1636
 
 
 
 
1637	if (uurb->buffer_length > 0 &&
1638			!access_ok(uurb->buffer, uurb->buffer_length)) {
 
1639		ret = -EFAULT;
1640		goto error;
1641	}
1642	as = alloc_async(number_of_packets);
1643	if (!as) {
1644		ret = -ENOMEM;
1645		goto error;
1646	}
1647
1648	as->usbm = find_memory_area(ps, uurb);
1649	if (IS_ERR(as->usbm)) {
1650		ret = PTR_ERR(as->usbm);
1651		as->usbm = NULL;
1652		goto error;
1653	}
1654
1655	/* do not use SG buffers when memory mapped segments
1656	 * are in use
1657	 */
1658	if (as->usbm)
1659		num_sgs = 0;
1660
1661	u += sizeof(struct async) + sizeof(struct urb) +
1662	     (as->usbm ? 0 : uurb->buffer_length) +
1663	     num_sgs * sizeof(struct scatterlist);
1664	ret = usbfs_increase_memory_usage(u);
1665	if (ret)
1666		goto error;
1667	as->mem_usage = u;
1668
1669	if (num_sgs) {
1670		as->urb->sg = kmalloc_array(num_sgs,
1671					    sizeof(struct scatterlist),
1672					    GFP_KERNEL);
1673		if (!as->urb->sg) {
1674			ret = -ENOMEM;
1675			goto error;
1676		}
1677		as->urb->num_sgs = num_sgs;
1678		sg_init_table(as->urb->sg, as->urb->num_sgs);
1679
1680		totlen = uurb->buffer_length;
1681		for (i = 0; i < as->urb->num_sgs; i++) {
1682			u = (totlen > USB_SG_SIZE) ? USB_SG_SIZE : totlen;
1683			buf = kmalloc(u, GFP_KERNEL);
1684			if (!buf) {
1685				ret = -ENOMEM;
1686				goto error;
1687			}
1688			sg_set_buf(&as->urb->sg[i], buf, u);
1689
1690			if (!is_in) {
1691				if (copy_from_user(buf, uurb->buffer, u)) {
1692					ret = -EFAULT;
1693					goto error;
1694				}
1695				uurb->buffer += u;
1696			}
1697			totlen -= u;
1698		}
1699	} else if (uurb->buffer_length > 0) {
1700		if (as->usbm) {
1701			unsigned long uurb_start = (unsigned long)uurb->buffer;
1702
1703			as->urb->transfer_buffer = as->usbm->mem +
1704					(uurb_start - as->usbm->vm_start);
1705		} else {
1706			as->urb->transfer_buffer = kmalloc(uurb->buffer_length,
1707					GFP_KERNEL);
1708			if (!as->urb->transfer_buffer) {
1709				ret = -ENOMEM;
1710				goto error;
1711			}
1712			if (!is_in) {
1713				if (copy_from_user(as->urb->transfer_buffer,
1714						   uurb->buffer,
1715						   uurb->buffer_length)) {
1716					ret = -EFAULT;
1717					goto error;
1718				}
1719			} else if (uurb->type == USBDEVFS_URB_TYPE_ISO) {
1720				/*
1721				 * Isochronous input data may end up being
1722				 * discontiguous if some of the packets are
1723				 * short. Clear the buffer so that the gaps
1724				 * don't leak kernel data to userspace.
1725				 */
1726				memset(as->urb->transfer_buffer, 0,
1727						uurb->buffer_length);
1728			}
1729		}
1730	}
1731	as->urb->dev = ps->dev;
1732	as->urb->pipe = (uurb->type << 30) |
1733			__create_pipe(ps->dev, uurb->endpoint & 0xf) |
1734			(uurb->endpoint & USB_DIR_IN);
1735
1736	/* This tedious sequence is necessary because the URB_* flags
1737	 * are internal to the kernel and subject to change, whereas
1738	 * the USBDEVFS_URB_* flags are a user API and must not be changed.
1739	 */
1740	u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
1741	if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
1742		u |= URB_ISO_ASAP;
1743	if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
1744		u |= URB_SHORT_NOT_OK;
1745	if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
 
 
1746		u |= URB_ZERO_PACKET;
1747	if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
1748		u |= URB_NO_INTERRUPT;
1749	as->urb->transfer_flags = u;
1750
1751	if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
1752		dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n");
1753	if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
1754		dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n");
1755
1756	as->urb->transfer_buffer_length = uurb->buffer_length;
1757	as->urb->setup_packet = (unsigned char *)dr;
1758	dr = NULL;
1759	as->urb->start_frame = uurb->start_frame;
1760	as->urb->number_of_packets = number_of_packets;
1761	as->urb->stream_id = stream_id;
1762
1763	if (ep->desc.bInterval) {
1764		if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
1765				ps->dev->speed == USB_SPEED_HIGH ||
1766				ps->dev->speed >= USB_SPEED_SUPER)
1767			as->urb->interval = 1 <<
1768					min(15, ep->desc.bInterval - 1);
1769		else
1770			as->urb->interval = ep->desc.bInterval;
1771	}
1772
1773	as->urb->context = as;
1774	as->urb->complete = async_completed;
1775	for (totlen = u = 0; u < number_of_packets; u++) {
1776		as->urb->iso_frame_desc[u].offset = totlen;
1777		as->urb->iso_frame_desc[u].length = isopkt[u].length;
1778		totlen += isopkt[u].length;
1779	}
1780	kfree(isopkt);
1781	isopkt = NULL;
1782	as->ps = ps;
1783	as->userurb = arg;
1784	as->userurb_sigval = userurb_sigval;
1785	if (as->usbm) {
1786		unsigned long uurb_start = (unsigned long)uurb->buffer;
1787
1788		as->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1789		as->urb->transfer_dma = as->usbm->dma_handle +
1790				(uurb_start - as->usbm->vm_start);
1791	} else if (is_in && uurb->buffer_length > 0)
1792		as->userbuffer = uurb->buffer;
 
 
1793	as->signr = uurb->signr;
1794	as->ifnum = ifnum;
1795	as->pid = get_pid(task_pid(current));
1796	as->cred = get_current_cred();
 
 
 
 
 
 
 
 
1797	snoop_urb(ps->dev, as->userurb, as->urb->pipe,
1798			as->urb->transfer_buffer_length, 0, SUBMIT,
1799			NULL, 0);
1800	if (!is_in)
1801		snoop_urb_data(as->urb, as->urb->transfer_buffer_length);
1802
1803	async_newpending(as);
1804
1805	if (usb_endpoint_xfer_bulk(&ep->desc)) {
1806		spin_lock_irq(&ps->lock);
1807
1808		/* Not exactly the endpoint address; the direction bit is
1809		 * shifted to the 0x10 position so that the value will be
1810		 * between 0 and 31.
1811		 */
1812		as->bulk_addr = usb_endpoint_num(&ep->desc) |
1813			((ep->desc.bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1814				>> 3);
1815
1816		/* If this bulk URB is the start of a new transfer, re-enable
1817		 * the endpoint.  Otherwise mark it as a continuation URB.
1818		 */
1819		if (uurb->flags & USBDEVFS_URB_BULK_CONTINUATION)
1820			as->bulk_status = AS_CONTINUATION;
1821		else
1822			ps->disabled_bulk_eps &= ~(1 << as->bulk_addr);
1823
1824		/* Don't accept continuation URBs if the endpoint is
1825		 * disabled because of an earlier error.
1826		 */
1827		if (ps->disabled_bulk_eps & (1 << as->bulk_addr))
1828			ret = -EREMOTEIO;
1829		else
1830			ret = usb_submit_urb(as->urb, GFP_ATOMIC);
1831		spin_unlock_irq(&ps->lock);
1832	} else {
1833		ret = usb_submit_urb(as->urb, GFP_KERNEL);
1834	}
1835
1836	if (ret) {
1837		dev_printk(KERN_DEBUG, &ps->dev->dev,
1838			   "usbfs: usb_submit_urb returned %d\n", ret);
1839		snoop_urb(ps->dev, as->userurb, as->urb->pipe,
1840				0, ret, COMPLETE, NULL, 0);
1841		async_removepending(as);
1842		goto error;
1843	}
1844	return 0;
1845
1846 error:
1847	kfree(isopkt);
1848	kfree(dr);
1849	if (as)
1850		free_async(as);
1851	return ret;
1852}
1853
1854static int proc_submiturb(struct usb_dev_state *ps, void __user *arg)
1855{
1856	struct usbdevfs_urb uurb;
1857	sigval_t userurb_sigval;
1858
1859	if (copy_from_user(&uurb, arg, sizeof(uurb)))
1860		return -EFAULT;
1861
1862	memset(&userurb_sigval, 0, sizeof(userurb_sigval));
1863	userurb_sigval.sival_ptr = arg;
1864
1865	return proc_do_submiturb(ps, &uurb,
1866			(((struct usbdevfs_urb __user *)arg)->iso_frame_desc),
1867			arg, userurb_sigval);
1868}
1869
1870static int proc_unlinkurb(struct usb_dev_state *ps, void __user *arg)
1871{
1872	struct urb *urb;
1873	struct async *as;
1874	unsigned long flags;
1875
1876	spin_lock_irqsave(&ps->lock, flags);
1877	as = async_getpending(ps, arg);
1878	if (!as) {
1879		spin_unlock_irqrestore(&ps->lock, flags);
1880		return -EINVAL;
1881	}
1882
1883	urb = as->urb;
1884	usb_get_urb(urb);
1885	spin_unlock_irqrestore(&ps->lock, flags);
1886
1887	usb_kill_urb(urb);
1888	usb_put_urb(urb);
1889
1890	return 0;
1891}
1892
1893static void compute_isochronous_actual_length(struct urb *urb)
1894{
1895	unsigned int i;
1896
1897	if (urb->number_of_packets > 0) {
1898		urb->actual_length = 0;
1899		for (i = 0; i < urb->number_of_packets; i++)
1900			urb->actual_length +=
1901					urb->iso_frame_desc[i].actual_length;
1902	}
1903}
1904
1905static int processcompl(struct async *as, void __user * __user *arg)
1906{
1907	struct urb *urb = as->urb;
1908	struct usbdevfs_urb __user *userurb = as->userurb;
1909	void __user *addr = as->userurb;
1910	unsigned int i;
1911
1912	compute_isochronous_actual_length(urb);
1913	if (as->userbuffer && urb->actual_length) {
1914		if (copy_urb_data_to_user(as->userbuffer, urb))
 
 
 
 
1915			goto err_out;
1916	}
1917	if (put_user(as->status, &userurb->status))
1918		goto err_out;
1919	if (put_user(urb->actual_length, &userurb->actual_length))
1920		goto err_out;
1921	if (put_user(urb->error_count, &userurb->error_count))
1922		goto err_out;
1923
1924	if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
1925		for (i = 0; i < urb->number_of_packets; i++) {
1926			if (put_user(urb->iso_frame_desc[i].actual_length,
1927				     &userurb->iso_frame_desc[i].actual_length))
1928				goto err_out;
1929			if (put_user(urb->iso_frame_desc[i].status,
1930				     &userurb->iso_frame_desc[i].status))
1931				goto err_out;
1932		}
1933	}
1934
1935	if (put_user(addr, (void __user * __user *)arg))
1936		return -EFAULT;
1937	return 0;
1938
1939err_out:
1940	return -EFAULT;
1941}
1942
1943static struct async *reap_as(struct usb_dev_state *ps)
1944{
1945	DECLARE_WAITQUEUE(wait, current);
1946	struct async *as = NULL;
1947	struct usb_device *dev = ps->dev;
1948
1949	add_wait_queue(&ps->wait, &wait);
1950	for (;;) {
1951		__set_current_state(TASK_INTERRUPTIBLE);
1952		as = async_getcompleted(ps);
1953		if (as || !connected(ps))
1954			break;
1955		if (signal_pending(current))
1956			break;
1957		usb_unlock_device(dev);
1958		schedule();
1959		usb_lock_device(dev);
1960	}
1961	remove_wait_queue(&ps->wait, &wait);
1962	set_current_state(TASK_RUNNING);
1963	return as;
1964}
1965
1966static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
1967{
1968	struct async *as = reap_as(ps);
1969
1970	if (as) {
1971		int retval;
1972
1973		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
1974		retval = processcompl(as, (void __user * __user *)arg);
1975		free_async(as);
1976		return retval;
1977	}
1978	if (signal_pending(current))
1979		return -EINTR;
1980	return -ENODEV;
1981}
1982
1983static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
1984{
1985	int retval;
1986	struct async *as;
1987
1988	as = async_getcompleted(ps);
 
1989	if (as) {
1990		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
1991		retval = processcompl(as, (void __user * __user *)arg);
1992		free_async(as);
1993	} else {
1994		retval = (connected(ps) ? -EAGAIN : -ENODEV);
1995	}
1996	return retval;
1997}
1998
1999#ifdef CONFIG_COMPAT
2000static int proc_control_compat(struct usb_dev_state *ps,
2001				struct usbdevfs_ctrltransfer32 __user *p32)
2002{
2003	struct usbdevfs_ctrltransfer __user *p;
2004	__u32 udata;
2005	p = compat_alloc_user_space(sizeof(*p));
2006	if (copy_in_user(p, p32, (sizeof(*p32) - sizeof(compat_caddr_t))) ||
2007	    get_user(udata, &p32->data) ||
2008	    put_user(compat_ptr(udata), &p->data))
2009		return -EFAULT;
2010	return proc_control(ps, p);
2011}
2012
2013static int proc_bulk_compat(struct usb_dev_state *ps,
2014			struct usbdevfs_bulktransfer32 __user *p32)
2015{
2016	struct usbdevfs_bulktransfer __user *p;
2017	compat_uint_t n;
2018	compat_caddr_t addr;
2019
2020	p = compat_alloc_user_space(sizeof(*p));
2021
2022	if (get_user(n, &p32->ep) || put_user(n, &p->ep) ||
2023	    get_user(n, &p32->len) || put_user(n, &p->len) ||
2024	    get_user(n, &p32->timeout) || put_user(n, &p->timeout) ||
2025	    get_user(addr, &p32->data) || put_user(compat_ptr(addr), &p->data))
2026		return -EFAULT;
2027
2028	return proc_bulk(ps, p);
2029}
2030static int proc_disconnectsignal_compat(struct usb_dev_state *ps, void __user *arg)
2031{
2032	struct usbdevfs_disconnectsignal32 ds;
2033
2034	if (copy_from_user(&ds, arg, sizeof(ds)))
2035		return -EFAULT;
2036	ps->discsignr = ds.signr;
2037	ps->disccontext.sival_int = ds.context;
2038	return 0;
2039}
2040
2041static int get_urb32(struct usbdevfs_urb *kurb,
2042		     struct usbdevfs_urb32 __user *uurb)
2043{
2044	struct usbdevfs_urb32 urb32;
2045	if (copy_from_user(&urb32, uurb, sizeof(*uurb)))
 
 
 
 
 
 
 
 
 
 
 
 
 
2046		return -EFAULT;
2047	kurb->type = urb32.type;
2048	kurb->endpoint = urb32.endpoint;
2049	kurb->status = urb32.status;
2050	kurb->flags = urb32.flags;
2051	kurb->buffer = compat_ptr(urb32.buffer);
2052	kurb->buffer_length = urb32.buffer_length;
2053	kurb->actual_length = urb32.actual_length;
2054	kurb->start_frame = urb32.start_frame;
2055	kurb->number_of_packets = urb32.number_of_packets;
2056	kurb->error_count = urb32.error_count;
2057	kurb->signr = urb32.signr;
2058	kurb->usercontext = compat_ptr(urb32.usercontext);
2059	return 0;
2060}
2061
2062static int proc_submiturb_compat(struct usb_dev_state *ps, void __user *arg)
2063{
2064	struct usbdevfs_urb uurb;
2065	sigval_t userurb_sigval;
2066
2067	if (get_urb32(&uurb, (struct usbdevfs_urb32 __user *)arg))
2068		return -EFAULT;
2069
2070	memset(&userurb_sigval, 0, sizeof(userurb_sigval));
2071	userurb_sigval.sival_int = ptr_to_compat(arg);
2072
2073	return proc_do_submiturb(ps, &uurb,
2074			((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc,
2075			arg, userurb_sigval);
2076}
2077
2078static int processcompl_compat(struct async *as, void __user * __user *arg)
2079{
2080	struct urb *urb = as->urb;
2081	struct usbdevfs_urb32 __user *userurb = as->userurb;
2082	void __user *addr = as->userurb;
2083	unsigned int i;
2084
2085	compute_isochronous_actual_length(urb);
2086	if (as->userbuffer && urb->actual_length) {
2087		if (copy_urb_data_to_user(as->userbuffer, urb))
 
 
 
 
2088			return -EFAULT;
2089	}
2090	if (put_user(as->status, &userurb->status))
2091		return -EFAULT;
2092	if (put_user(urb->actual_length, &userurb->actual_length))
2093		return -EFAULT;
2094	if (put_user(urb->error_count, &userurb->error_count))
2095		return -EFAULT;
2096
2097	if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
2098		for (i = 0; i < urb->number_of_packets; i++) {
2099			if (put_user(urb->iso_frame_desc[i].actual_length,
2100				     &userurb->iso_frame_desc[i].actual_length))
2101				return -EFAULT;
2102			if (put_user(urb->iso_frame_desc[i].status,
2103				     &userurb->iso_frame_desc[i].status))
2104				return -EFAULT;
2105		}
2106	}
2107
2108	if (put_user(ptr_to_compat(addr), (u32 __user *)arg))
2109		return -EFAULT;
2110	return 0;
2111}
2112
2113static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
2114{
2115	struct async *as = reap_as(ps);
2116
2117	if (as) {
2118		int retval;
2119
2120		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
2121		retval = processcompl_compat(as, (void __user * __user *)arg);
2122		free_async(as);
2123		return retval;
2124	}
2125	if (signal_pending(current))
2126		return -EINTR;
2127	return -ENODEV;
2128}
2129
2130static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *arg)
2131{
2132	int retval;
2133	struct async *as;
2134
 
2135	as = async_getcompleted(ps);
2136	if (as) {
2137		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
2138		retval = processcompl_compat(as, (void __user * __user *)arg);
2139		free_async(as);
2140	} else {
2141		retval = (connected(ps) ? -EAGAIN : -ENODEV);
2142	}
2143	return retval;
2144}
2145
2146
2147#endif
2148
2149static int proc_disconnectsignal(struct usb_dev_state *ps, void __user *arg)
2150{
2151	struct usbdevfs_disconnectsignal ds;
2152
2153	if (copy_from_user(&ds, arg, sizeof(ds)))
2154		return -EFAULT;
2155	ps->discsignr = ds.signr;
2156	ps->disccontext.sival_ptr = ds.context;
2157	return 0;
2158}
2159
2160static int proc_claiminterface(struct usb_dev_state *ps, void __user *arg)
2161{
2162	unsigned int ifnum;
2163
2164	if (get_user(ifnum, (unsigned int __user *)arg))
2165		return -EFAULT;
2166	return claimintf(ps, ifnum);
2167}
2168
2169static int proc_releaseinterface(struct usb_dev_state *ps, void __user *arg)
2170{
2171	unsigned int ifnum;
2172	int ret;
2173
2174	if (get_user(ifnum, (unsigned int __user *)arg))
2175		return -EFAULT;
2176	ret = releaseintf(ps, ifnum);
2177	if (ret < 0)
2178		return ret;
2179	destroy_async_on_interface(ps, ifnum);
2180	return 0;
2181}
2182
2183static int proc_ioctl(struct usb_dev_state *ps, struct usbdevfs_ioctl *ctl)
2184{
2185	int			size;
2186	void			*buf = NULL;
2187	int			retval = 0;
2188	struct usb_interface    *intf = NULL;
2189	struct usb_driver       *driver = NULL;
2190
2191	if (ps->privileges_dropped)
2192		return -EACCES;
2193
2194	if (!connected(ps))
2195		return -ENODEV;
2196
2197	/* alloc buffer */
2198	size = _IOC_SIZE(ctl->ioctl_code);
2199	if (size > 0) {
2200		buf = kmalloc(size, GFP_KERNEL);
2201		if (buf == NULL)
2202			return -ENOMEM;
2203		if ((_IOC_DIR(ctl->ioctl_code) & _IOC_WRITE)) {
2204			if (copy_from_user(buf, ctl->data, size)) {
2205				kfree(buf);
2206				return -EFAULT;
2207			}
2208		} else {
2209			memset(buf, 0, size);
2210		}
2211	}
2212
 
 
 
 
 
2213	if (ps->dev->state != USB_STATE_CONFIGURED)
2214		retval = -EHOSTUNREACH;
2215	else if (!(intf = usb_ifnum_to_if(ps->dev, ctl->ifno)))
2216		retval = -EINVAL;
2217	else switch (ctl->ioctl_code) {
2218
2219	/* disconnect kernel driver from interface */
2220	case USBDEVFS_DISCONNECT:
2221		if (intf->dev.driver) {
2222			driver = to_usb_driver(intf->dev.driver);
2223			dev_dbg(&intf->dev, "disconnect by usbfs\n");
2224			usb_driver_release_interface(driver, intf);
2225		} else
2226			retval = -ENODATA;
2227		break;
2228
2229	/* let kernel drivers try to (re)bind to the interface */
2230	case USBDEVFS_CONNECT:
2231		if (!intf->dev.driver)
2232			retval = device_attach(&intf->dev);
2233		else
2234			retval = -EBUSY;
2235		break;
2236
2237	/* talk directly to the interface's driver */
2238	default:
2239		if (intf->dev.driver)
2240			driver = to_usb_driver(intf->dev.driver);
2241		if (driver == NULL || driver->unlocked_ioctl == NULL) {
2242			retval = -ENOTTY;
2243		} else {
2244			retval = driver->unlocked_ioctl(intf, ctl->ioctl_code, buf);
2245			if (retval == -ENOIOCTLCMD)
2246				retval = -ENOTTY;
2247		}
2248	}
2249
2250	/* cleanup and return */
2251	if (retval >= 0
2252			&& (_IOC_DIR(ctl->ioctl_code) & _IOC_READ) != 0
2253			&& size > 0
2254			&& copy_to_user(ctl->data, buf, size) != 0)
2255		retval = -EFAULT;
2256
2257	kfree(buf);
2258	return retval;
2259}
2260
2261static int proc_ioctl_default(struct usb_dev_state *ps, void __user *arg)
2262{
2263	struct usbdevfs_ioctl	ctrl;
2264
2265	if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
2266		return -EFAULT;
2267	return proc_ioctl(ps, &ctrl);
2268}
2269
2270#ifdef CONFIG_COMPAT
2271static int proc_ioctl_compat(struct usb_dev_state *ps, compat_uptr_t arg)
2272{
2273	struct usbdevfs_ioctl32 ioc32;
2274	struct usbdevfs_ioctl ctrl;
 
2275
2276	if (copy_from_user(&ioc32, compat_ptr(arg), sizeof(ioc32)))
 
 
 
 
2277		return -EFAULT;
2278	ctrl.ifno = ioc32.ifno;
2279	ctrl.ioctl_code = ioc32.ioctl_code;
2280	ctrl.data = compat_ptr(ioc32.data);
2281	return proc_ioctl(ps, &ctrl);
2282}
2283#endif
2284
2285static int proc_claim_port(struct usb_dev_state *ps, void __user *arg)
2286{
2287	unsigned portnum;
2288	int rc;
2289
2290	if (get_user(portnum, (unsigned __user *) arg))
2291		return -EFAULT;
2292	rc = usb_hub_claim_port(ps->dev, portnum, ps);
2293	if (rc == 0)
2294		snoop(&ps->dev->dev, "port %d claimed by process %d: %s\n",
2295			portnum, task_pid_nr(current), current->comm);
2296	return rc;
2297}
2298
2299static int proc_release_port(struct usb_dev_state *ps, void __user *arg)
2300{
2301	unsigned portnum;
2302
2303	if (get_user(portnum, (unsigned __user *) arg))
2304		return -EFAULT;
2305	return usb_hub_release_port(ps->dev, portnum, ps);
2306}
2307
2308static int proc_get_capabilities(struct usb_dev_state *ps, void __user *arg)
2309{
2310	__u32 caps;
2311
2312	caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM |
2313			USBDEVFS_CAP_REAP_AFTER_DISCONNECT | USBDEVFS_CAP_MMAP |
2314			USBDEVFS_CAP_DROP_PRIVILEGES |
2315			USBDEVFS_CAP_CONNINFO_EX | MAYBE_CAP_SUSPEND;
2316	if (!ps->dev->bus->no_stop_on_short)
2317		caps |= USBDEVFS_CAP_BULK_CONTINUATION;
2318	if (ps->dev->bus->sg_tablesize)
2319		caps |= USBDEVFS_CAP_BULK_SCATTER_GATHER;
2320
2321	if (put_user(caps, (__u32 __user *)arg))
2322		return -EFAULT;
2323
2324	return 0;
2325}
2326
2327static int proc_disconnect_claim(struct usb_dev_state *ps, void __user *arg)
2328{
2329	struct usbdevfs_disconnect_claim dc;
2330	struct usb_interface *intf;
2331
2332	if (copy_from_user(&dc, arg, sizeof(dc)))
2333		return -EFAULT;
2334
2335	intf = usb_ifnum_to_if(ps->dev, dc.interface);
2336	if (!intf)
2337		return -EINVAL;
2338
2339	if (intf->dev.driver) {
2340		struct usb_driver *driver = to_usb_driver(intf->dev.driver);
2341
2342		if (ps->privileges_dropped)
2343			return -EACCES;
2344
2345		if ((dc.flags & USBDEVFS_DISCONNECT_CLAIM_IF_DRIVER) &&
2346				strncmp(dc.driver, intf->dev.driver->name,
2347					sizeof(dc.driver)) != 0)
2348			return -EBUSY;
2349
2350		if ((dc.flags & USBDEVFS_DISCONNECT_CLAIM_EXCEPT_DRIVER) &&
2351				strncmp(dc.driver, intf->dev.driver->name,
2352					sizeof(dc.driver)) == 0)
2353			return -EBUSY;
2354
2355		dev_dbg(&intf->dev, "disconnect by usbfs\n");
2356		usb_driver_release_interface(driver, intf);
2357	}
2358
2359	return claimintf(ps, dc.interface);
2360}
2361
2362static int proc_alloc_streams(struct usb_dev_state *ps, void __user *arg)
2363{
2364	unsigned num_streams, num_eps;
2365	struct usb_host_endpoint **eps;
2366	struct usb_interface *intf;
2367	int r;
2368
2369	r = parse_usbdevfs_streams(ps, arg, &num_streams, &num_eps,
2370				   &eps, &intf);
2371	if (r)
2372		return r;
2373
2374	destroy_async_on_interface(ps,
2375				   intf->altsetting[0].desc.bInterfaceNumber);
2376
2377	r = usb_alloc_streams(intf, eps, num_eps, num_streams, GFP_KERNEL);
2378	kfree(eps);
2379	return r;
2380}
2381
2382static int proc_free_streams(struct usb_dev_state *ps, void __user *arg)
2383{
2384	unsigned num_eps;
2385	struct usb_host_endpoint **eps;
2386	struct usb_interface *intf;
2387	int r;
2388
2389	r = parse_usbdevfs_streams(ps, arg, NULL, &num_eps, &eps, &intf);
2390	if (r)
2391		return r;
2392
2393	destroy_async_on_interface(ps,
2394				   intf->altsetting[0].desc.bInterfaceNumber);
2395
2396	r = usb_free_streams(intf, eps, num_eps, GFP_KERNEL);
2397	kfree(eps);
2398	return r;
2399}
2400
2401static int proc_drop_privileges(struct usb_dev_state *ps, void __user *arg)
2402{
2403	u32 data;
2404
2405	if (copy_from_user(&data, arg, sizeof(data)))
2406		return -EFAULT;
2407
2408	/* This is a one way operation. Once privileges are
2409	 * dropped, you cannot regain them. You may however reissue
2410	 * this ioctl to shrink the allowed interfaces mask.
2411	 */
2412	ps->interface_allowed_mask &= data;
2413	ps->privileges_dropped = true;
2414
2415	return 0;
2416}
2417
2418static int proc_forbid_suspend(struct usb_dev_state *ps)
2419{
2420	int ret = 0;
2421
2422	if (ps->suspend_allowed) {
2423		ret = usb_autoresume_device(ps->dev);
2424		if (ret == 0)
2425			ps->suspend_allowed = false;
2426		else if (ret != -ENODEV)
2427			ret = -EIO;
2428	}
2429	return ret;
2430}
2431
2432static int proc_allow_suspend(struct usb_dev_state *ps)
2433{
2434	if (!connected(ps))
2435		return -ENODEV;
2436
2437	WRITE_ONCE(ps->not_yet_resumed, 1);
2438	if (!ps->suspend_allowed) {
2439		usb_autosuspend_device(ps->dev);
2440		ps->suspend_allowed = true;
2441	}
2442	return 0;
2443}
2444
2445static int proc_wait_for_resume(struct usb_dev_state *ps)
2446{
2447	int ret;
2448
2449	usb_unlock_device(ps->dev);
2450	ret = wait_event_interruptible(ps->wait_for_resume,
2451			READ_ONCE(ps->not_yet_resumed) == 0);
2452	usb_lock_device(ps->dev);
2453
2454	if (ret != 0)
2455		return -EINTR;
2456	return proc_forbid_suspend(ps);
2457}
2458
2459/*
2460 * NOTE:  All requests here that have interface numbers as parameters
2461 * are assuming that somehow the configuration has been prevented from
2462 * changing.  But there's no mechanism to ensure that...
2463 */
2464static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
2465				void __user *p)
2466{
2467	struct usb_dev_state *ps = file->private_data;
2468	struct inode *inode = file_inode(file);
2469	struct usb_device *dev = ps->dev;
2470	int ret = -ENOTTY;
2471
2472	if (!(file->f_mode & FMODE_WRITE))
2473		return -EPERM;
2474
2475	usb_lock_device(dev);
2476
2477	/* Reap operations are allowed even after disconnection */
2478	switch (cmd) {
2479	case USBDEVFS_REAPURB:
2480		snoop(&dev->dev, "%s: REAPURB\n", __func__);
2481		ret = proc_reapurb(ps, p);
2482		goto done;
2483
2484	case USBDEVFS_REAPURBNDELAY:
2485		snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
2486		ret = proc_reapurbnonblock(ps, p);
2487		goto done;
2488
2489#ifdef CONFIG_COMPAT
2490	case USBDEVFS_REAPURB32:
2491		snoop(&dev->dev, "%s: REAPURB32\n", __func__);
2492		ret = proc_reapurb_compat(ps, p);
2493		goto done;
2494
2495	case USBDEVFS_REAPURBNDELAY32:
2496		snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
2497		ret = proc_reapurbnonblock_compat(ps, p);
2498		goto done;
2499#endif
2500	}
2501
2502	if (!connected(ps)) {
2503		usb_unlock_device(dev);
2504		return -ENODEV;
2505	}
2506
2507	switch (cmd) {
2508	case USBDEVFS_CONTROL:
2509		snoop(&dev->dev, "%s: CONTROL\n", __func__);
2510		ret = proc_control(ps, p);
2511		if (ret >= 0)
2512			inode->i_mtime = current_time(inode);
2513		break;
2514
2515	case USBDEVFS_BULK:
2516		snoop(&dev->dev, "%s: BULK\n", __func__);
2517		ret = proc_bulk(ps, p);
2518		if (ret >= 0)
2519			inode->i_mtime = current_time(inode);
2520		break;
2521
2522	case USBDEVFS_RESETEP:
2523		snoop(&dev->dev, "%s: RESETEP\n", __func__);
2524		ret = proc_resetep(ps, p);
2525		if (ret >= 0)
2526			inode->i_mtime = current_time(inode);
2527		break;
2528
2529	case USBDEVFS_RESET:
2530		snoop(&dev->dev, "%s: RESET\n", __func__);
2531		ret = proc_resetdevice(ps);
2532		break;
2533
2534	case USBDEVFS_CLEAR_HALT:
2535		snoop(&dev->dev, "%s: CLEAR_HALT\n", __func__);
2536		ret = proc_clearhalt(ps, p);
2537		if (ret >= 0)
2538			inode->i_mtime = current_time(inode);
2539		break;
2540
2541	case USBDEVFS_GETDRIVER:
2542		snoop(&dev->dev, "%s: GETDRIVER\n", __func__);
2543		ret = proc_getdriver(ps, p);
2544		break;
2545
2546	case USBDEVFS_CONNECTINFO:
2547		snoop(&dev->dev, "%s: CONNECTINFO\n", __func__);
2548		ret = proc_connectinfo(ps, p);
2549		break;
2550
2551	case USBDEVFS_SETINTERFACE:
2552		snoop(&dev->dev, "%s: SETINTERFACE\n", __func__);
2553		ret = proc_setintf(ps, p);
2554		break;
2555
2556	case USBDEVFS_SETCONFIGURATION:
2557		snoop(&dev->dev, "%s: SETCONFIGURATION\n", __func__);
2558		ret = proc_setconfig(ps, p);
2559		break;
2560
2561	case USBDEVFS_SUBMITURB:
2562		snoop(&dev->dev, "%s: SUBMITURB\n", __func__);
2563		ret = proc_submiturb(ps, p);
2564		if (ret >= 0)
2565			inode->i_mtime = current_time(inode);
2566		break;
2567
2568#ifdef CONFIG_COMPAT
2569	case USBDEVFS_CONTROL32:
2570		snoop(&dev->dev, "%s: CONTROL32\n", __func__);
2571		ret = proc_control_compat(ps, p);
2572		if (ret >= 0)
2573			inode->i_mtime = current_time(inode);
2574		break;
2575
2576	case USBDEVFS_BULK32:
2577		snoop(&dev->dev, "%s: BULK32\n", __func__);
2578		ret = proc_bulk_compat(ps, p);
2579		if (ret >= 0)
2580			inode->i_mtime = current_time(inode);
2581		break;
2582
2583	case USBDEVFS_DISCSIGNAL32:
2584		snoop(&dev->dev, "%s: DISCSIGNAL32\n", __func__);
2585		ret = proc_disconnectsignal_compat(ps, p);
2586		break;
2587
2588	case USBDEVFS_SUBMITURB32:
2589		snoop(&dev->dev, "%s: SUBMITURB32\n", __func__);
2590		ret = proc_submiturb_compat(ps, p);
2591		if (ret >= 0)
2592			inode->i_mtime = current_time(inode);
 
 
 
 
 
 
 
 
 
 
2593		break;
2594
2595	case USBDEVFS_IOCTL32:
2596		snoop(&dev->dev, "%s: IOCTL32\n", __func__);
2597		ret = proc_ioctl_compat(ps, ptr_to_compat(p));
2598		break;
2599#endif
2600
2601	case USBDEVFS_DISCARDURB:
2602		snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p);
2603		ret = proc_unlinkurb(ps, p);
2604		break;
2605
 
 
 
 
 
 
 
 
 
 
2606	case USBDEVFS_DISCSIGNAL:
2607		snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
2608		ret = proc_disconnectsignal(ps, p);
2609		break;
2610
2611	case USBDEVFS_CLAIMINTERFACE:
2612		snoop(&dev->dev, "%s: CLAIMINTERFACE\n", __func__);
2613		ret = proc_claiminterface(ps, p);
2614		break;
2615
2616	case USBDEVFS_RELEASEINTERFACE:
2617		snoop(&dev->dev, "%s: RELEASEINTERFACE\n", __func__);
2618		ret = proc_releaseinterface(ps, p);
2619		break;
2620
2621	case USBDEVFS_IOCTL:
2622		snoop(&dev->dev, "%s: IOCTL\n", __func__);
2623		ret = proc_ioctl_default(ps, p);
2624		break;
2625
2626	case USBDEVFS_CLAIM_PORT:
2627		snoop(&dev->dev, "%s: CLAIM_PORT\n", __func__);
2628		ret = proc_claim_port(ps, p);
2629		break;
2630
2631	case USBDEVFS_RELEASE_PORT:
2632		snoop(&dev->dev, "%s: RELEASE_PORT\n", __func__);
2633		ret = proc_release_port(ps, p);
2634		break;
2635	case USBDEVFS_GET_CAPABILITIES:
2636		ret = proc_get_capabilities(ps, p);
2637		break;
2638	case USBDEVFS_DISCONNECT_CLAIM:
2639		ret = proc_disconnect_claim(ps, p);
2640		break;
2641	case USBDEVFS_ALLOC_STREAMS:
2642		ret = proc_alloc_streams(ps, p);
2643		break;
2644	case USBDEVFS_FREE_STREAMS:
2645		ret = proc_free_streams(ps, p);
2646		break;
2647	case USBDEVFS_DROP_PRIVILEGES:
2648		ret = proc_drop_privileges(ps, p);
2649		break;
2650	case USBDEVFS_GET_SPEED:
2651		ret = ps->dev->speed;
2652		break;
2653	case USBDEVFS_FORBID_SUSPEND:
2654		ret = proc_forbid_suspend(ps);
2655		break;
2656	case USBDEVFS_ALLOW_SUSPEND:
2657		ret = proc_allow_suspend(ps);
2658		break;
2659	case USBDEVFS_WAIT_FOR_RESUME:
2660		ret = proc_wait_for_resume(ps);
2661		break;
2662	}
2663
2664	/* Handle variable-length commands */
2665	switch (cmd & ~IOCSIZE_MASK) {
2666	case USBDEVFS_CONNINFO_EX(0):
2667		ret = proc_conninfo_ex(ps, p, _IOC_SIZE(cmd));
2668		break;
2669	}
2670
2671 done:
2672	usb_unlock_device(dev);
2673	if (ret >= 0)
2674		inode->i_atime = current_time(inode);
2675	return ret;
2676}
2677
2678static long usbdev_ioctl(struct file *file, unsigned int cmd,
2679			unsigned long arg)
2680{
2681	int ret;
2682
2683	ret = usbdev_do_ioctl(file, cmd, (void __user *)arg);
2684
2685	return ret;
2686}
2687
2688#ifdef CONFIG_COMPAT
2689static long usbdev_compat_ioctl(struct file *file, unsigned int cmd,
2690			unsigned long arg)
2691{
2692	int ret;
2693
2694	ret = usbdev_do_ioctl(file, cmd, compat_ptr(arg));
2695
2696	return ret;
2697}
2698#endif
2699
2700/* No kernel lock - fine */
2701static __poll_t usbdev_poll(struct file *file,
2702				struct poll_table_struct *wait)
2703{
2704	struct usb_dev_state *ps = file->private_data;
2705	__poll_t mask = 0;
2706
2707	poll_wait(file, &ps->wait, wait);
2708	if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
2709		mask |= EPOLLOUT | EPOLLWRNORM;
2710	if (!connected(ps))
2711		mask |= EPOLLHUP;
2712	if (list_empty(&ps->list))
2713		mask |= EPOLLERR;
2714	return mask;
2715}
2716
2717const struct file_operations usbdev_file_operations = {
2718	.owner =	  THIS_MODULE,
2719	.llseek =	  no_seek_end_llseek,
2720	.read =		  usbdev_read,
2721	.poll =		  usbdev_poll,
2722	.unlocked_ioctl = usbdev_ioctl,
2723#ifdef CONFIG_COMPAT
2724	.compat_ioctl =   usbdev_compat_ioctl,
2725#endif
2726	.mmap =           usbdev_mmap,
2727	.open =		  usbdev_open,
2728	.release =	  usbdev_release,
2729};
2730
2731static void usbdev_remove(struct usb_device *udev)
2732{
2733	struct usb_dev_state *ps;
 
2734
2735	/* Protect against simultaneous resume */
2736	mutex_lock(&usbfs_mutex);
2737	while (!list_empty(&udev->filelist)) {
2738		ps = list_entry(udev->filelist.next, struct usb_dev_state, list);
2739		destroy_all_async(ps);
2740		wake_up_all(&ps->wait);
2741		WRITE_ONCE(ps->not_yet_resumed, 0);
2742		wake_up_all(&ps->wait_for_resume);
2743		list_del_init(&ps->list);
2744		if (ps->discsignr)
2745			kill_pid_usb_asyncio(ps->discsignr, EPIPE, ps->disccontext,
2746					     ps->disc_pid, ps->cred);
 
 
 
 
 
2747	}
2748	mutex_unlock(&usbfs_mutex);
2749}
2750
2751static int usbdev_notify(struct notifier_block *self,
2752			       unsigned long action, void *dev)
2753{
2754	switch (action) {
2755	case USB_DEVICE_ADD:
2756		break;
2757	case USB_DEVICE_REMOVE:
2758		usbdev_remove(dev);
2759		break;
2760	}
2761	return NOTIFY_OK;
2762}
2763
2764static struct notifier_block usbdev_nb = {
2765	.notifier_call =	usbdev_notify,
2766};
2767
2768static struct cdev usb_device_cdev;
2769
2770int __init usb_devio_init(void)
2771{
2772	int retval;
2773
2774	retval = register_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX,
2775					"usb_device");
2776	if (retval) {
2777		printk(KERN_ERR "Unable to register minors for usb_device\n");
2778		goto out;
2779	}
2780	cdev_init(&usb_device_cdev, &usbdev_file_operations);
2781	retval = cdev_add(&usb_device_cdev, USB_DEVICE_DEV, USB_DEVICE_MAX);
2782	if (retval) {
2783		printk(KERN_ERR "Unable to get usb_device major %d\n",
2784		       USB_DEVICE_MAJOR);
2785		goto error_cdev;
2786	}
2787	usb_register_notify(&usbdev_nb);
2788out:
2789	return retval;
2790
2791error_cdev:
2792	unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
2793	goto out;
2794}
2795
2796void usb_devio_cleanup(void)
2797{
2798	usb_unregister_notify(&usbdev_nb);
2799	cdev_del(&usb_device_cdev);
2800	unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
2801}
v3.5.6
 
   1/*****************************************************************************/
   2
   3/*
   4 *      devio.c  --  User space communication with USB devices.
   5 *
   6 *      Copyright (C) 1999-2000  Thomas Sailer (sailer@ife.ee.ethz.ch)
   7 *
   8 *      This program is free software; you can redistribute it and/or modify
   9 *      it under the terms of the GNU General Public License as published by
  10 *      the Free Software Foundation; either version 2 of the License, or
  11 *      (at your option) any later version.
  12 *
  13 *      This program is distributed in the hope that it will be useful,
  14 *      but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 *      GNU General Public License for more details.
  17 *
  18 *      You should have received a copy of the GNU General Public License
  19 *      along with this program; if not, write to the Free Software
  20 *      Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 *
  22 *  This file implements the usbfs/x/y files, where
  23 *  x is the bus number and y the device number.
  24 *
  25 *  It allows user space programs/"drivers" to communicate directly
  26 *  with USB devices without intervening kernel driver.
  27 *
  28 *  Revision history
  29 *    22.12.1999   0.1   Initial release (split from proc_usb.c)
  30 *    04.01.2000   0.2   Turned into its own filesystem
  31 *    30.09.2005   0.3   Fix user-triggerable oops in async URB delivery
  32 *    			 (CAN-2005-3055)
  33 */
  34
  35/*****************************************************************************/
  36
  37#include <linux/fs.h>
  38#include <linux/mm.h>
 
  39#include <linux/slab.h>
  40#include <linux/signal.h>
  41#include <linux/poll.h>
  42#include <linux/module.h>
 
  43#include <linux/usb.h>
  44#include <linux/usbdevice_fs.h>
  45#include <linux/usb/hcd.h>	/* for usbcore internals */
  46#include <linux/cdev.h>
  47#include <linux/notifier.h>
  48#include <linux/security.h>
  49#include <linux/user_namespace.h>
  50#include <asm/uaccess.h>
 
 
  51#include <asm/byteorder.h>
  52#include <linux/moduleparam.h>
  53
  54#include "usb.h"
  55
 
 
 
 
 
 
  56#define USB_MAXBUS			64
  57#define USB_DEVICE_MAX			USB_MAXBUS * 128
 
  58
  59/* Mutual exclusion for removal, open, and release */
  60DEFINE_MUTEX(usbfs_mutex);
  61
  62struct dev_state {
  63	struct list_head list;      /* state list */
  64	struct usb_device *dev;
  65	struct file *file;
  66	spinlock_t lock;            /* protects the async urb lists */
  67	struct list_head async_pending;
  68	struct list_head async_completed;
 
  69	wait_queue_head_t wait;     /* wake up if a request completed */
 
  70	unsigned int discsignr;
  71	struct pid *disc_pid;
  72	const struct cred *cred;
  73	void __user *disccontext;
  74	unsigned long ifclaimed;
  75	u32 secid;
  76	u32 disabled_bulk_eps;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  77};
  78
  79struct async {
  80	struct list_head asynclist;
  81	struct dev_state *ps;
  82	struct pid *pid;
  83	const struct cred *cred;
  84	unsigned int signr;
  85	unsigned int ifnum;
  86	void __user *userbuffer;
  87	void __user *userurb;
 
  88	struct urb *urb;
 
  89	unsigned int mem_usage;
  90	int status;
  91	u32 secid;
  92	u8 bulk_addr;
  93	u8 bulk_status;
  94};
  95
  96static bool usbfs_snoop;
  97module_param(usbfs_snoop, bool, S_IRUGO | S_IWUSR);
  98MODULE_PARM_DESC(usbfs_snoop, "true to log all usbfs traffic");
  99
 
 
 
 
 
 100#define snoop(dev, format, arg...)				\
 101	do {							\
 102		if (usbfs_snoop)				\
 103			dev_info(dev , format , ## arg);	\
 104	} while (0)
 105
 106enum snoop_when {
 107	SUBMIT, COMPLETE
 108};
 109
 110#define USB_DEVICE_DEV		MKDEV(USB_DEVICE_MAJOR, 0)
 111
 112/* Limit on the total amount of memory we can allocate for transfers */
 113static unsigned usbfs_memory_mb = 16;
 114module_param(usbfs_memory_mb, uint, 0644);
 115MODULE_PARM_DESC(usbfs_memory_mb,
 116		"maximum MB allowed for usbfs buffers (0 = no limit)");
 117
 118/* Hard limit, necessary to avoid aithmetic overflow */
 119#define USBFS_XFER_MAX		(UINT_MAX / 2 - 1000000)
 120
 121static atomic_t usbfs_memory_usage;	/* Total memory currently allocated */
 122
 123/* Check whether it's okay to allocate more memory for a transfer */
 124static int usbfs_increase_memory_usage(unsigned amount)
 125{
 126	unsigned lim;
 
 
 
 
 
 127
 128	/*
 129	 * Convert usbfs_memory_mb to bytes, avoiding overflows.
 130	 * 0 means use the hard limit (effectively unlimited).
 131	 */
 132	lim = ACCESS_ONCE(usbfs_memory_mb);
 133	if (lim == 0 || lim > (USBFS_XFER_MAX >> 20))
 134		lim = USBFS_XFER_MAX;
 135	else
 136		lim <<= 20;
 137
 138	atomic_add(amount, &usbfs_memory_usage);
 139	if (atomic_read(&usbfs_memory_usage) <= lim)
 140		return 0;
 141	atomic_sub(amount, &usbfs_memory_usage);
 142	return -ENOMEM;
 143}
 144
 145/* Memory for a transfer is being deallocated */
 146static void usbfs_decrease_memory_usage(unsigned amount)
 147{
 148	atomic_sub(amount, &usbfs_memory_usage);
 149}
 150
 151static int connected(struct dev_state *ps)
 152{
 153	return (!list_empty(&ps->list) &&
 154			ps->dev->state != USB_STATE_NOTATTACHED);
 155}
 156
 157static loff_t usbdev_lseek(struct file *file, loff_t offset, int orig)
 158{
 159	loff_t ret;
 
 160
 161	mutex_lock(&file->f_dentry->d_inode->i_mutex);
 
 
 
 
 162
 163	switch (orig) {
 164	case 0:
 165		file->f_pos = offset;
 166		ret = file->f_pos;
 167		break;
 168	case 1:
 169		file->f_pos += offset;
 170		ret = file->f_pos;
 171		break;
 172	case 2:
 173	default:
 174		ret = -EINVAL;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 175	}
 176
 177	mutex_unlock(&file->f_dentry->d_inode->i_mutex);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 178	return ret;
 179}
 180
 181static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
 182			   loff_t *ppos)
 183{
 184	struct dev_state *ps = file->private_data;
 185	struct usb_device *dev = ps->dev;
 186	ssize_t ret = 0;
 187	unsigned len;
 188	loff_t pos;
 189	int i;
 190
 191	pos = *ppos;
 192	usb_lock_device(dev);
 193	if (!connected(ps)) {
 194		ret = -ENODEV;
 195		goto err;
 196	} else if (pos < 0) {
 197		ret = -EINVAL;
 198		goto err;
 199	}
 200
 201	if (pos < sizeof(struct usb_device_descriptor)) {
 202		/* 18 bytes - fits on the stack */
 203		struct usb_device_descriptor temp_desc;
 204
 205		memcpy(&temp_desc, &dev->descriptor, sizeof(dev->descriptor));
 206		le16_to_cpus(&temp_desc.bcdUSB);
 207		le16_to_cpus(&temp_desc.idVendor);
 208		le16_to_cpus(&temp_desc.idProduct);
 209		le16_to_cpus(&temp_desc.bcdDevice);
 210
 211		len = sizeof(struct usb_device_descriptor) - pos;
 212		if (len > nbytes)
 213			len = nbytes;
 214		if (copy_to_user(buf, ((char *)&temp_desc) + pos, len)) {
 215			ret = -EFAULT;
 216			goto err;
 217		}
 218
 219		*ppos += len;
 220		buf += len;
 221		nbytes -= len;
 222		ret += len;
 223	}
 224
 225	pos = sizeof(struct usb_device_descriptor);
 226	for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {
 227		struct usb_config_descriptor *config =
 228			(struct usb_config_descriptor *)dev->rawdescriptors[i];
 229		unsigned int length = le16_to_cpu(config->wTotalLength);
 230
 231		if (*ppos < pos + length) {
 232
 233			/* The descriptor may claim to be longer than it
 234			 * really is.  Here is the actual allocated length. */
 235			unsigned alloclen =
 236				le16_to_cpu(dev->config[i].desc.wTotalLength);
 237
 238			len = length - (*ppos - pos);
 239			if (len > nbytes)
 240				len = nbytes;
 241
 242			/* Simply don't write (skip over) unallocated parts */
 243			if (alloclen > (*ppos - pos)) {
 244				alloclen -= (*ppos - pos);
 245				if (copy_to_user(buf,
 246				    dev->rawdescriptors[i] + (*ppos - pos),
 247				    min(len, alloclen))) {
 248					ret = -EFAULT;
 249					goto err;
 250				}
 251			}
 252
 253			*ppos += len;
 254			buf += len;
 255			nbytes -= len;
 256			ret += len;
 257		}
 258
 259		pos += length;
 260	}
 261
 262err:
 263	usb_unlock_device(dev);
 264	return ret;
 265}
 266
 267/*
 268 * async list handling
 269 */
 270
 271static struct async *alloc_async(unsigned int numisoframes)
 272{
 273	struct async *as;
 274
 275	as = kzalloc(sizeof(struct async), GFP_KERNEL);
 276	if (!as)
 277		return NULL;
 278	as->urb = usb_alloc_urb(numisoframes, GFP_KERNEL);
 279	if (!as->urb) {
 280		kfree(as);
 281		return NULL;
 282	}
 283	return as;
 284}
 285
 286static void free_async(struct async *as)
 287{
 
 
 288	put_pid(as->pid);
 289	if (as->cred)
 290		put_cred(as->cred);
 291	kfree(as->urb->transfer_buffer);
 
 
 
 
 
 
 
 
 
 
 292	kfree(as->urb->setup_packet);
 293	usb_free_urb(as->urb);
 294	usbfs_decrease_memory_usage(as->mem_usage);
 295	kfree(as);
 296}
 297
 298static void async_newpending(struct async *as)
 299{
 300	struct dev_state *ps = as->ps;
 301	unsigned long flags;
 302
 303	spin_lock_irqsave(&ps->lock, flags);
 304	list_add_tail(&as->asynclist, &ps->async_pending);
 305	spin_unlock_irqrestore(&ps->lock, flags);
 306}
 307
 308static void async_removepending(struct async *as)
 309{
 310	struct dev_state *ps = as->ps;
 311	unsigned long flags;
 312
 313	spin_lock_irqsave(&ps->lock, flags);
 314	list_del_init(&as->asynclist);
 315	spin_unlock_irqrestore(&ps->lock, flags);
 316}
 317
 318static struct async *async_getcompleted(struct dev_state *ps)
 319{
 320	unsigned long flags;
 321	struct async *as = NULL;
 322
 323	spin_lock_irqsave(&ps->lock, flags);
 324	if (!list_empty(&ps->async_completed)) {
 325		as = list_entry(ps->async_completed.next, struct async,
 326				asynclist);
 327		list_del_init(&as->asynclist);
 328	}
 329	spin_unlock_irqrestore(&ps->lock, flags);
 330	return as;
 331}
 332
 333static struct async *async_getpending(struct dev_state *ps,
 334					     void __user *userurb)
 335{
 336	struct async *as;
 337
 338	list_for_each_entry(as, &ps->async_pending, asynclist)
 339		if (as->userurb == userurb) {
 340			list_del_init(&as->asynclist);
 341			return as;
 342		}
 343
 344	return NULL;
 345}
 346
 347static void snoop_urb(struct usb_device *udev,
 348		void __user *userurb, int pipe, unsigned length,
 349		int timeout_or_status, enum snoop_when when,
 350		unsigned char *data, unsigned data_len)
 351{
 352	static const char *types[] = {"isoc", "int", "ctrl", "bulk"};
 353	static const char *dirs[] = {"out", "in"};
 354	int ep;
 355	const char *t, *d;
 356
 357	if (!usbfs_snoop)
 358		return;
 359
 360	ep = usb_pipeendpoint(pipe);
 361	t = types[usb_pipetype(pipe)];
 362	d = dirs[!!usb_pipein(pipe)];
 363
 364	if (userurb) {		/* Async */
 365		if (when == SUBMIT)
 366			dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
 367					"length %u\n",
 368					userurb, ep, t, d, length);
 369		else
 370			dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
 371					"actual_length %u status %d\n",
 372					userurb, ep, t, d, length,
 373					timeout_or_status);
 374	} else {
 375		if (when == SUBMIT)
 376			dev_info(&udev->dev, "ep%d %s-%s, length %u, "
 377					"timeout %d\n",
 378					ep, t, d, length, timeout_or_status);
 379		else
 380			dev_info(&udev->dev, "ep%d %s-%s, actual_length %u, "
 381					"status %d\n",
 382					ep, t, d, length, timeout_or_status);
 383	}
 384
 
 385	if (data && data_len > 0) {
 386		print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
 387			data, data_len, 1);
 388	}
 389}
 390
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 391#define AS_CONTINUATION	1
 392#define AS_UNLINK	2
 393
 394static void cancel_bulk_urbs(struct dev_state *ps, unsigned bulk_addr)
 395__releases(ps->lock)
 396__acquires(ps->lock)
 397{
 398	struct urb *urb;
 399	struct async *as;
 400
 401	/* Mark all the pending URBs that match bulk_addr, up to but not
 402	 * including the first one without AS_CONTINUATION.  If such an
 403	 * URB is encountered then a new transfer has already started so
 404	 * the endpoint doesn't need to be disabled; otherwise it does.
 405	 */
 406	list_for_each_entry(as, &ps->async_pending, asynclist) {
 407		if (as->bulk_addr == bulk_addr) {
 408			if (as->bulk_status != AS_CONTINUATION)
 409				goto rescan;
 410			as->bulk_status = AS_UNLINK;
 411			as->bulk_addr = 0;
 412		}
 413	}
 414	ps->disabled_bulk_eps |= (1 << bulk_addr);
 415
 416	/* Now carefully unlink all the marked pending URBs */
 417 rescan:
 418	list_for_each_entry(as, &ps->async_pending, asynclist) {
 419		if (as->bulk_status == AS_UNLINK) {
 420			as->bulk_status = 0;		/* Only once */
 421			urb = as->urb;
 422			usb_get_urb(urb);
 423			spin_unlock(&ps->lock);		/* Allow completions */
 424			usb_unlink_urb(urb);
 425			usb_put_urb(urb);
 426			spin_lock(&ps->lock);
 427			goto rescan;
 428		}
 429	}
 430}
 431
 432static void async_completed(struct urb *urb)
 433{
 434	struct async *as = urb->context;
 435	struct dev_state *ps = as->ps;
 436	struct siginfo sinfo;
 437	struct pid *pid = NULL;
 438	u32 secid = 0;
 439	const struct cred *cred = NULL;
 440	int signr;
 
 
 441
 442	spin_lock(&ps->lock);
 443	list_move_tail(&as->asynclist, &ps->async_completed);
 444	as->status = urb->status;
 445	signr = as->signr;
 446	if (signr) {
 447		sinfo.si_signo = as->signr;
 448		sinfo.si_errno = as->status;
 449		sinfo.si_code = SI_ASYNCIO;
 450		sinfo.si_addr = as->userurb;
 451		pid = get_pid(as->pid);
 452		cred = get_cred(as->cred);
 453		secid = as->secid;
 454	}
 455	snoop(&urb->dev->dev, "urb complete\n");
 456	snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
 457			as->status, COMPLETE,
 458			((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_OUT) ?
 459				NULL : urb->transfer_buffer, urb->actual_length);
 
 460	if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
 461			as->status != -ENOENT)
 462		cancel_bulk_urbs(ps, as->bulk_addr);
 463	spin_unlock(&ps->lock);
 
 
 464
 465	if (signr) {
 466		kill_pid_info_as_cred(sinfo.si_signo, &sinfo, pid, cred, secid);
 467		put_pid(pid);
 468		put_cred(cred);
 469	}
 470
 471	wake_up(&ps->wait);
 472}
 473
 474static void destroy_async(struct dev_state *ps, struct list_head *list)
 475{
 476	struct urb *urb;
 477	struct async *as;
 478	unsigned long flags;
 479
 480	spin_lock_irqsave(&ps->lock, flags);
 481	while (!list_empty(list)) {
 482		as = list_entry(list->next, struct async, asynclist);
 483		list_del_init(&as->asynclist);
 484		urb = as->urb;
 485		usb_get_urb(urb);
 486
 487		/* drop the spinlock so the completion handler can run */
 488		spin_unlock_irqrestore(&ps->lock, flags);
 489		usb_kill_urb(urb);
 490		usb_put_urb(urb);
 491		spin_lock_irqsave(&ps->lock, flags);
 492	}
 493	spin_unlock_irqrestore(&ps->lock, flags);
 494}
 495
 496static void destroy_async_on_interface(struct dev_state *ps,
 497				       unsigned int ifnum)
 498{
 499	struct list_head *p, *q, hitlist;
 500	unsigned long flags;
 501
 502	INIT_LIST_HEAD(&hitlist);
 503	spin_lock_irqsave(&ps->lock, flags);
 504	list_for_each_safe(p, q, &ps->async_pending)
 505		if (ifnum == list_entry(p, struct async, asynclist)->ifnum)
 506			list_move_tail(p, &hitlist);
 507	spin_unlock_irqrestore(&ps->lock, flags);
 508	destroy_async(ps, &hitlist);
 509}
 510
 511static void destroy_all_async(struct dev_state *ps)
 512{
 513	destroy_async(ps, &ps->async_pending);
 514}
 515
 516/*
 517 * interface claims are made only at the request of user level code,
 518 * which can also release them (explicitly or by closing files).
 519 * they're also undone when devices disconnect.
 520 */
 521
 522static int driver_probe(struct usb_interface *intf,
 523			const struct usb_device_id *id)
 524{
 525	return -ENODEV;
 526}
 527
 528static void driver_disconnect(struct usb_interface *intf)
 529{
 530	struct dev_state *ps = usb_get_intfdata(intf);
 531	unsigned int ifnum = intf->altsetting->desc.bInterfaceNumber;
 532
 533	if (!ps)
 534		return;
 535
 536	/* NOTE:  this relies on usbcore having canceled and completed
 537	 * all pending I/O requests; 2.6 does that.
 538	 */
 539
 540	if (likely(ifnum < 8*sizeof(ps->ifclaimed)))
 541		clear_bit(ifnum, &ps->ifclaimed);
 542	else
 543		dev_warn(&intf->dev, "interface number %u out of range\n",
 544			 ifnum);
 545
 546	usb_set_intfdata(intf, NULL);
 547
 548	/* force async requests to complete */
 549	destroy_async_on_interface(ps, ifnum);
 550}
 551
 552/* The following routines are merely placeholders.  There is no way
 553 * to inform a user task about suspend or resumes.
 554 */
 555static int driver_suspend(struct usb_interface *intf, pm_message_t msg)
 556{
 557	return 0;
 558}
 559
 560static int driver_resume(struct usb_interface *intf)
 561{
 562	return 0;
 563}
 564
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 565struct usb_driver usbfs_driver = {
 566	.name =		"usbfs",
 567	.probe =	driver_probe,
 568	.disconnect =	driver_disconnect,
 569	.suspend =	driver_suspend,
 570	.resume =	driver_resume,
 
 571};
 572
 573static int claimintf(struct dev_state *ps, unsigned int ifnum)
 574{
 575	struct usb_device *dev = ps->dev;
 576	struct usb_interface *intf;
 577	int err;
 578
 579	if (ifnum >= 8*sizeof(ps->ifclaimed))
 580		return -EINVAL;
 581	/* already claimed */
 582	if (test_bit(ifnum, &ps->ifclaimed))
 583		return 0;
 584
 
 
 
 
 585	intf = usb_ifnum_to_if(dev, ifnum);
 586	if (!intf)
 587		err = -ENOENT;
 588	else
 589		err = usb_driver_claim_interface(&usbfs_driver, intf, ps);
 590	if (err == 0)
 591		set_bit(ifnum, &ps->ifclaimed);
 592	return err;
 593}
 594
 595static int releaseintf(struct dev_state *ps, unsigned int ifnum)
 596{
 597	struct usb_device *dev;
 598	struct usb_interface *intf;
 599	int err;
 600
 601	err = -EINVAL;
 602	if (ifnum >= 8*sizeof(ps->ifclaimed))
 603		return err;
 604	dev = ps->dev;
 605	intf = usb_ifnum_to_if(dev, ifnum);
 606	if (!intf)
 607		err = -ENOENT;
 608	else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) {
 609		usb_driver_release_interface(&usbfs_driver, intf);
 610		err = 0;
 611	}
 612	return err;
 613}
 614
 615static int checkintf(struct dev_state *ps, unsigned int ifnum)
 616{
 617	if (ps->dev->state != USB_STATE_CONFIGURED)
 618		return -EHOSTUNREACH;
 619	if (ifnum >= 8*sizeof(ps->ifclaimed))
 620		return -EINVAL;
 621	if (test_bit(ifnum, &ps->ifclaimed))
 622		return 0;
 623	/* if not yet claimed, claim it for the driver */
 624	dev_warn(&ps->dev->dev, "usbfs: process %d (%s) did not claim "
 625		 "interface %u before use\n", task_pid_nr(current),
 626		 current->comm, ifnum);
 627	return claimintf(ps, ifnum);
 628}
 629
 630static int findintfep(struct usb_device *dev, unsigned int ep)
 631{
 632	unsigned int i, j, e;
 633	struct usb_interface *intf;
 634	struct usb_host_interface *alts;
 635	struct usb_endpoint_descriptor *endpt;
 636
 637	if (ep & ~(USB_DIR_IN|0xf))
 638		return -EINVAL;
 639	if (!dev->actconfig)
 640		return -ESRCH;
 641	for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
 642		intf = dev->actconfig->interface[i];
 643		for (j = 0; j < intf->num_altsetting; j++) {
 644			alts = &intf->altsetting[j];
 645			for (e = 0; e < alts->desc.bNumEndpoints; e++) {
 646				endpt = &alts->endpoint[e].desc;
 647				if (endpt->bEndpointAddress == ep)
 648					return alts->desc.bInterfaceNumber;
 649			}
 650		}
 651	}
 652	return -ENOENT;
 653}
 654
 655static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype,
 656			   unsigned int request, unsigned int index)
 657{
 658	int ret = 0;
 659	struct usb_host_interface *alt_setting;
 660
 661	if (ps->dev->state != USB_STATE_UNAUTHENTICATED
 662	 && ps->dev->state != USB_STATE_ADDRESS
 663	 && ps->dev->state != USB_STATE_CONFIGURED)
 664		return -EHOSTUNREACH;
 665	if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
 666		return 0;
 667
 668	/*
 669	 * check for the special corner case 'get_device_id' in the printer
 670	 * class specification, where wIndex is (interface << 8 | altsetting)
 671	 * instead of just interface
 672	 */
 673	if (requesttype == 0xa1 && request == 0) {
 674		alt_setting = usb_find_alt_setting(ps->dev->actconfig,
 675						   index >> 8, index & 0xff);
 676		if (alt_setting
 677		 && alt_setting->desc.bInterfaceClass == USB_CLASS_PRINTER)
 678			index >>= 8;
 679	}
 680
 681	index &= 0xff;
 682	switch (requesttype & USB_RECIP_MASK) {
 683	case USB_RECIP_ENDPOINT:
 
 
 684		ret = findintfep(ps->dev, index);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 685		if (ret >= 0)
 686			ret = checkintf(ps, ret);
 687		break;
 688
 689	case USB_RECIP_INTERFACE:
 690		ret = checkintf(ps, index);
 691		break;
 692	}
 693	return ret;
 694}
 695
 696static int match_devt(struct device *dev, void *data)
 
 697{
 698	return dev->devt == (dev_t) (unsigned long) data;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 699}
 700
 701static struct usb_device *usbdev_lookup_by_devt(dev_t devt)
 702{
 703	struct device *dev;
 704
 705	dev = bus_find_device(&usb_bus_type, NULL,
 706			      (void *) (unsigned long) devt, match_devt);
 707	if (!dev)
 708		return NULL;
 709	return container_of(dev, struct usb_device, dev);
 710}
 711
 712/*
 713 * file operations
 714 */
 715static int usbdev_open(struct inode *inode, struct file *file)
 716{
 717	struct usb_device *dev = NULL;
 718	struct dev_state *ps;
 719	int ret;
 720
 721	ret = -ENOMEM;
 722	ps = kmalloc(sizeof(struct dev_state), GFP_KERNEL);
 723	if (!ps)
 724		goto out_free_ps;
 725
 726	ret = -ENODEV;
 727
 728	/* Protect against simultaneous removal or release */
 729	mutex_lock(&usbfs_mutex);
 730
 731	/* usbdev device-node */
 732	if (imajor(inode) == USB_DEVICE_MAJOR)
 733		dev = usbdev_lookup_by_devt(inode->i_rdev);
 734
 735	mutex_unlock(&usbfs_mutex);
 736
 737	if (!dev)
 738		goto out_free_ps;
 739
 740	usb_lock_device(dev);
 741	if (dev->state == USB_STATE_NOTATTACHED)
 742		goto out_unlock_device;
 743
 744	ret = usb_autoresume_device(dev);
 745	if (ret)
 746		goto out_unlock_device;
 747
 748	ps->dev = dev;
 749	ps->file = file;
 
 750	spin_lock_init(&ps->lock);
 751	INIT_LIST_HEAD(&ps->list);
 752	INIT_LIST_HEAD(&ps->async_pending);
 753	INIT_LIST_HEAD(&ps->async_completed);
 
 754	init_waitqueue_head(&ps->wait);
 755	ps->discsignr = 0;
 756	ps->disc_pid = get_pid(task_pid(current));
 757	ps->cred = get_current_cred();
 758	ps->disccontext = NULL;
 759	ps->ifclaimed = 0;
 760	security_task_getsecid(current, &ps->secid);
 761	smp_wmb();
 
 
 762	list_add_tail(&ps->list, &dev->filelist);
 763	file->private_data = ps;
 764	usb_unlock_device(dev);
 765	snoop(&dev->dev, "opened by process %d: %s\n", task_pid_nr(current),
 766			current->comm);
 767	return ret;
 768
 769 out_unlock_device:
 770	usb_unlock_device(dev);
 771	usb_put_dev(dev);
 772 out_free_ps:
 773	kfree(ps);
 774	return ret;
 775}
 776
 777static int usbdev_release(struct inode *inode, struct file *file)
 778{
 779	struct dev_state *ps = file->private_data;
 780	struct usb_device *dev = ps->dev;
 781	unsigned int ifnum;
 782	struct async *as;
 783
 784	usb_lock_device(dev);
 785	usb_hub_release_all_ports(dev, ps);
 786
 
 
 787	list_del_init(&ps->list);
 
 788
 789	for (ifnum = 0; ps->ifclaimed && ifnum < 8*sizeof(ps->ifclaimed);
 790			ifnum++) {
 791		if (test_bit(ifnum, &ps->ifclaimed))
 792			releaseintf(ps, ifnum);
 793	}
 794	destroy_all_async(ps);
 795	usb_autosuspend_device(dev);
 
 796	usb_unlock_device(dev);
 797	usb_put_dev(dev);
 798	put_pid(ps->disc_pid);
 799	put_cred(ps->cred);
 800
 801	as = async_getcompleted(ps);
 802	while (as) {
 803		free_async(as);
 804		as = async_getcompleted(ps);
 805	}
 
 806	kfree(ps);
 807	return 0;
 808}
 809
 810static int proc_control(struct dev_state *ps, void __user *arg)
 811{
 812	struct usb_device *dev = ps->dev;
 813	struct usbdevfs_ctrltransfer ctrl;
 814	unsigned int tmo;
 815	unsigned char *tbuf;
 816	unsigned wLength;
 817	int i, pipe, ret;
 818
 819	if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
 820		return -EFAULT;
 821	ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.bRequest,
 822			      ctrl.wIndex);
 823	if (ret)
 824		return ret;
 825	wLength = ctrl.wLength;		/* To suppress 64k PAGE_SIZE warning */
 826	if (wLength > PAGE_SIZE)
 827		return -EINVAL;
 828	ret = usbfs_increase_memory_usage(PAGE_SIZE + sizeof(struct urb) +
 829			sizeof(struct usb_ctrlrequest));
 830	if (ret)
 831		return ret;
 832	tbuf = (unsigned char *)__get_free_page(GFP_KERNEL);
 833	if (!tbuf) {
 834		ret = -ENOMEM;
 835		goto done;
 836	}
 837	tmo = ctrl.timeout;
 838	snoop(&dev->dev, "control urb: bRequestType=%02x "
 839		"bRequest=%02x wValue=%04x "
 840		"wIndex=%04x wLength=%04x\n",
 841		ctrl.bRequestType, ctrl.bRequest,
 842		__le16_to_cpup(&ctrl.wValue),
 843		__le16_to_cpup(&ctrl.wIndex),
 844		__le16_to_cpup(&ctrl.wLength));
 845	if (ctrl.bRequestType & 0x80) {
 846		if (ctrl.wLength && !access_ok(VERIFY_WRITE, ctrl.data,
 847					       ctrl.wLength)) {
 848			ret = -EINVAL;
 849			goto done;
 850		}
 851		pipe = usb_rcvctrlpipe(dev, 0);
 852		snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT, NULL, 0);
 853
 854		usb_unlock_device(dev);
 855		i = usb_control_msg(dev, pipe, ctrl.bRequest,
 856				    ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
 857				    tbuf, ctrl.wLength, tmo);
 858		usb_lock_device(dev);
 859		snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE,
 860			  tbuf, max(i, 0));
 861		if ((i > 0) && ctrl.wLength) {
 862			if (copy_to_user(ctrl.data, tbuf, i)) {
 863				ret = -EFAULT;
 864				goto done;
 865			}
 866		}
 867	} else {
 868		if (ctrl.wLength) {
 869			if (copy_from_user(tbuf, ctrl.data, ctrl.wLength)) {
 870				ret = -EFAULT;
 871				goto done;
 872			}
 873		}
 874		pipe = usb_sndctrlpipe(dev, 0);
 875		snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT,
 876			tbuf, ctrl.wLength);
 877
 878		usb_unlock_device(dev);
 879		i = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ctrl.bRequest,
 880				    ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
 881				    tbuf, ctrl.wLength, tmo);
 882		usb_lock_device(dev);
 883		snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE, NULL, 0);
 884	}
 885	if (i < 0 && i != -EPIPE) {
 886		dev_printk(KERN_DEBUG, &dev->dev, "usbfs: USBDEVFS_CONTROL "
 887			   "failed cmd %s rqt %u rq %u len %u ret %d\n",
 888			   current->comm, ctrl.bRequestType, ctrl.bRequest,
 889			   ctrl.wLength, i);
 890	}
 891	ret = i;
 892 done:
 893	free_page((unsigned long) tbuf);
 894	usbfs_decrease_memory_usage(PAGE_SIZE + sizeof(struct urb) +
 895			sizeof(struct usb_ctrlrequest));
 896	return ret;
 897}
 898
 899static int proc_bulk(struct dev_state *ps, void __user *arg)
 900{
 901	struct usb_device *dev = ps->dev;
 902	struct usbdevfs_bulktransfer bulk;
 903	unsigned int tmo, len1, pipe;
 904	int len2;
 905	unsigned char *tbuf;
 906	int i, ret;
 907
 908	if (copy_from_user(&bulk, arg, sizeof(bulk)))
 909		return -EFAULT;
 910	ret = findintfep(ps->dev, bulk.ep);
 911	if (ret < 0)
 912		return ret;
 913	ret = checkintf(ps, ret);
 914	if (ret)
 915		return ret;
 916	if (bulk.ep & USB_DIR_IN)
 917		pipe = usb_rcvbulkpipe(dev, bulk.ep & 0x7f);
 918	else
 919		pipe = usb_sndbulkpipe(dev, bulk.ep & 0x7f);
 920	if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN)))
 921		return -EINVAL;
 922	len1 = bulk.len;
 923	if (len1 >= USBFS_XFER_MAX)
 924		return -EINVAL;
 925	ret = usbfs_increase_memory_usage(len1 + sizeof(struct urb));
 926	if (ret)
 927		return ret;
 928	if (!(tbuf = kmalloc(len1, GFP_KERNEL))) {
 
 929		ret = -ENOMEM;
 930		goto done;
 931	}
 932	tmo = bulk.timeout;
 933	if (bulk.ep & 0x80) {
 934		if (len1 && !access_ok(VERIFY_WRITE, bulk.data, len1)) {
 935			ret = -EINVAL;
 936			goto done;
 937		}
 938		snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, NULL, 0);
 939
 940		usb_unlock_device(dev);
 941		i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
 942		usb_lock_device(dev);
 943		snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, tbuf, len2);
 944
 945		if (!i && len2) {
 946			if (copy_to_user(bulk.data, tbuf, len2)) {
 947				ret = -EFAULT;
 948				goto done;
 949			}
 950		}
 951	} else {
 952		if (len1) {
 953			if (copy_from_user(tbuf, bulk.data, len1)) {
 954				ret = -EFAULT;
 955				goto done;
 956			}
 957		}
 958		snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, tbuf, len1);
 959
 960		usb_unlock_device(dev);
 961		i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
 962		usb_lock_device(dev);
 963		snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, NULL, 0);
 964	}
 965	ret = (i < 0 ? i : len2);
 966 done:
 967	kfree(tbuf);
 968	usbfs_decrease_memory_usage(len1 + sizeof(struct urb));
 969	return ret;
 970}
 971
 972static int proc_resetep(struct dev_state *ps, void __user *arg)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 973{
 974	unsigned int ep;
 975	int ret;
 976
 977	if (get_user(ep, (unsigned int __user *)arg))
 978		return -EFAULT;
 979	ret = findintfep(ps->dev, ep);
 980	if (ret < 0)
 981		return ret;
 982	ret = checkintf(ps, ret);
 983	if (ret)
 984		return ret;
 
 985	usb_reset_endpoint(ps->dev, ep);
 986	return 0;
 987}
 988
 989static int proc_clearhalt(struct dev_state *ps, void __user *arg)
 990{
 991	unsigned int ep;
 992	int pipe;
 993	int ret;
 994
 995	if (get_user(ep, (unsigned int __user *)arg))
 996		return -EFAULT;
 997	ret = findintfep(ps->dev, ep);
 998	if (ret < 0)
 999		return ret;
1000	ret = checkintf(ps, ret);
1001	if (ret)
1002		return ret;
 
1003	if (ep & USB_DIR_IN)
1004		pipe = usb_rcvbulkpipe(ps->dev, ep & 0x7f);
1005	else
1006		pipe = usb_sndbulkpipe(ps->dev, ep & 0x7f);
1007
1008	return usb_clear_halt(ps->dev, pipe);
1009}
1010
1011static int proc_getdriver(struct dev_state *ps, void __user *arg)
1012{
1013	struct usbdevfs_getdriver gd;
1014	struct usb_interface *intf;
1015	int ret;
1016
1017	if (copy_from_user(&gd, arg, sizeof(gd)))
1018		return -EFAULT;
1019	intf = usb_ifnum_to_if(ps->dev, gd.interface);
1020	if (!intf || !intf->dev.driver)
1021		ret = -ENODATA;
1022	else {
1023		strncpy(gd.driver, intf->dev.driver->name,
1024				sizeof(gd.driver));
1025		ret = (copy_to_user(arg, &gd, sizeof(gd)) ? -EFAULT : 0);
1026	}
1027	return ret;
1028}
1029
1030static int proc_connectinfo(struct dev_state *ps, void __user *arg)
1031{
1032	struct usbdevfs_connectinfo ci = {
1033		.devnum = ps->dev->devnum,
1034		.slow = ps->dev->speed == USB_SPEED_LOW
1035	};
 
1036
1037	if (copy_to_user(arg, &ci, sizeof(ci)))
1038		return -EFAULT;
1039	return 0;
1040}
1041
1042static int proc_resetdevice(struct dev_state *ps)
 
1043{
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1044	return usb_reset_device(ps->dev);
1045}
1046
1047static int proc_setintf(struct dev_state *ps, void __user *arg)
1048{
1049	struct usbdevfs_setinterface setintf;
1050	int ret;
1051
1052	if (copy_from_user(&setintf, arg, sizeof(setintf)))
1053		return -EFAULT;
1054	if ((ret = checkintf(ps, setintf.interface)))
 
1055		return ret;
 
 
 
1056	return usb_set_interface(ps->dev, setintf.interface,
1057			setintf.altsetting);
1058}
1059
1060static int proc_setconfig(struct dev_state *ps, void __user *arg)
1061{
1062	int u;
1063	int status = 0;
1064	struct usb_host_config *actconfig;
1065
1066	if (get_user(u, (int __user *)arg))
1067		return -EFAULT;
1068
1069	actconfig = ps->dev->actconfig;
1070
1071	/* Don't touch the device if any interfaces are claimed.
1072	 * It could interfere with other drivers' operations, and if
1073	 * an interface is claimed by usbfs it could easily deadlock.
1074	 */
1075	if (actconfig) {
1076		int i;
1077
1078		for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
1079			if (usb_interface_claimed(actconfig->interface[i])) {
1080				dev_warn(&ps->dev->dev,
1081					"usbfs: interface %d claimed by %s "
1082					"while '%s' sets config #%d\n",
1083					actconfig->interface[i]
1084						->cur_altsetting
1085						->desc.bInterfaceNumber,
1086					actconfig->interface[i]
1087						->dev.driver->name,
1088					current->comm, u);
1089				status = -EBUSY;
1090				break;
1091			}
1092		}
1093	}
1094
1095	/* SET_CONFIGURATION is often abused as a "cheap" driver reset,
1096	 * so avoid usb_set_configuration()'s kick to sysfs
1097	 */
1098	if (status == 0) {
1099		if (actconfig && actconfig->desc.bConfigurationValue == u)
1100			status = usb_reset_configuration(ps->dev);
1101		else
1102			status = usb_set_configuration(ps->dev, u);
1103	}
1104
1105	return status;
1106}
1107
1108static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1109			struct usbdevfs_iso_packet_desc __user *iso_frame_desc,
1110			void __user *arg)
1111{
1112	struct usbdevfs_iso_packet_desc *isopkt = NULL;
1113	struct usb_host_endpoint *ep;
1114	struct async *as = NULL;
1115	struct usb_ctrlrequest *dr = NULL;
1116	unsigned int u, totlen, isofrmlen;
1117	int ret, ifnum = -1;
1118	int is_in;
1119
1120	if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
1121				USBDEVFS_URB_SHORT_NOT_OK |
 
 
 
1122				USBDEVFS_URB_BULK_CONTINUATION |
1123				USBDEVFS_URB_NO_FSBR |
1124				USBDEVFS_URB_ZERO_PACKET |
1125				USBDEVFS_URB_NO_INTERRUPT))
 
 
 
 
 
 
 
 
1126		return -EINVAL;
1127	if (uurb->buffer_length > 0 && !uurb->buffer)
1128		return -EINVAL;
1129	if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
1130	    (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
1131		ifnum = findintfep(ps->dev, uurb->endpoint);
1132		if (ifnum < 0)
1133			return ifnum;
1134		ret = checkintf(ps, ifnum);
1135		if (ret)
1136			return ret;
1137	}
1138	if ((uurb->endpoint & USB_ENDPOINT_DIR_MASK) != 0) {
1139		is_in = 1;
1140		ep = ps->dev->ep_in[uurb->endpoint & USB_ENDPOINT_NUMBER_MASK];
1141	} else {
1142		is_in = 0;
1143		ep = ps->dev->ep_out[uurb->endpoint & USB_ENDPOINT_NUMBER_MASK];
1144	}
1145	if (!ep)
1146		return -ENOENT;
 
1147
1148	u = 0;
1149	switch(uurb->type) {
1150	case USBDEVFS_URB_TYPE_CONTROL:
1151		if (!usb_endpoint_xfer_control(&ep->desc))
1152			return -EINVAL;
1153		/* min 8 byte setup packet */
1154		if (uurb->buffer_length < 8)
1155			return -EINVAL;
1156		dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
1157		if (!dr)
1158			return -ENOMEM;
1159		if (copy_from_user(dr, uurb->buffer, 8)) {
1160			ret = -EFAULT;
1161			goto error;
1162		}
1163		if (uurb->buffer_length < (le16_to_cpup(&dr->wLength) + 8)) {
1164			ret = -EINVAL;
1165			goto error;
1166		}
1167		ret = check_ctrlrecip(ps, dr->bRequestType, dr->bRequest,
1168				      le16_to_cpup(&dr->wIndex));
1169		if (ret)
1170			goto error;
1171		uurb->number_of_packets = 0;
1172		uurb->buffer_length = le16_to_cpup(&dr->wLength);
1173		uurb->buffer += 8;
1174		if ((dr->bRequestType & USB_DIR_IN) && uurb->buffer_length) {
1175			is_in = 1;
1176			uurb->endpoint |= USB_DIR_IN;
1177		} else {
1178			is_in = 0;
1179			uurb->endpoint &= ~USB_DIR_IN;
1180		}
 
 
1181		snoop(&ps->dev->dev, "control urb: bRequestType=%02x "
1182			"bRequest=%02x wValue=%04x "
1183			"wIndex=%04x wLength=%04x\n",
1184			dr->bRequestType, dr->bRequest,
1185			__le16_to_cpup(&dr->wValue),
1186			__le16_to_cpup(&dr->wIndex),
1187			__le16_to_cpup(&dr->wLength));
1188		u = sizeof(struct usb_ctrlrequest);
1189		break;
1190
1191	case USBDEVFS_URB_TYPE_BULK:
 
 
 
 
1192		switch (usb_endpoint_type(&ep->desc)) {
1193		case USB_ENDPOINT_XFER_CONTROL:
1194		case USB_ENDPOINT_XFER_ISOC:
1195			return -EINVAL;
1196		case USB_ENDPOINT_XFER_INT:
1197			/* allow single-shot interrupt transfers */
1198			uurb->type = USBDEVFS_URB_TYPE_INTERRUPT;
1199			goto interrupt_urb;
1200		}
1201		uurb->number_of_packets = 0;
 
 
 
 
1202		break;
1203
1204	case USBDEVFS_URB_TYPE_INTERRUPT:
1205		if (!usb_endpoint_xfer_int(&ep->desc))
1206			return -EINVAL;
1207 interrupt_urb:
1208		uurb->number_of_packets = 0;
 
 
 
1209		break;
1210
1211	case USBDEVFS_URB_TYPE_ISO:
1212		/* arbitrary limit */
1213		if (uurb->number_of_packets < 1 ||
1214		    uurb->number_of_packets > 128)
1215			return -EINVAL;
1216		if (!usb_endpoint_xfer_isoc(&ep->desc))
1217			return -EINVAL;
 
1218		isofrmlen = sizeof(struct usbdevfs_iso_packet_desc) *
1219				   uurb->number_of_packets;
1220		if (!(isopkt = kmalloc(isofrmlen, GFP_KERNEL)))
1221			return -ENOMEM;
1222		if (copy_from_user(isopkt, iso_frame_desc, isofrmlen)) {
1223			ret = -EFAULT;
1224			goto error;
1225		}
1226		for (totlen = u = 0; u < uurb->number_of_packets; u++) {
1227			/* arbitrary limit,
1228			 * sufficient for USB 2.0 high-bandwidth iso */
1229			if (isopkt[u].length > 8192) {
 
 
1230				ret = -EINVAL;
1231				goto error;
1232			}
1233			totlen += isopkt[u].length;
1234		}
1235		u *= sizeof(struct usb_iso_packet_descriptor);
1236		uurb->buffer_length = totlen;
1237		break;
1238
1239	default:
1240		return -EINVAL;
1241	}
1242
1243	if (uurb->buffer_length >= USBFS_XFER_MAX) {
1244		ret = -EINVAL;
1245		goto error;
1246	}
1247	if (uurb->buffer_length > 0 &&
1248			!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
1249				uurb->buffer, uurb->buffer_length)) {
1250		ret = -EFAULT;
1251		goto error;
1252	}
1253	as = alloc_async(uurb->number_of_packets);
1254	if (!as) {
1255		ret = -ENOMEM;
1256		goto error;
1257	}
1258	u += sizeof(struct async) + sizeof(struct urb) + uurb->buffer_length;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1259	ret = usbfs_increase_memory_usage(u);
1260	if (ret)
1261		goto error;
1262	as->mem_usage = u;
1263
1264	if (uurb->buffer_length > 0) {
1265		as->urb->transfer_buffer = kmalloc(uurb->buffer_length,
1266				GFP_KERNEL);
1267		if (!as->urb->transfer_buffer) {
 
1268			ret = -ENOMEM;
1269			goto error;
1270		}
1271		/* Isochronous input data may end up being discontiguous
1272		 * if some of the packets are short.  Clear the buffer so
1273		 * that the gaps don't leak kernel data to userspace.
1274		 */
1275		if (is_in && uurb->type == USBDEVFS_URB_TYPE_ISO)
1276			memset(as->urb->transfer_buffer, 0,
1277					uurb->buffer_length);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1278	}
1279	as->urb->dev = ps->dev;
1280	as->urb->pipe = (uurb->type << 30) |
1281			__create_pipe(ps->dev, uurb->endpoint & 0xf) |
1282			(uurb->endpoint & USB_DIR_IN);
1283
1284	/* This tedious sequence is necessary because the URB_* flags
1285	 * are internal to the kernel and subject to change, whereas
1286	 * the USBDEVFS_URB_* flags are a user API and must not be changed.
1287	 */
1288	u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
1289	if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
1290		u |= URB_ISO_ASAP;
1291	if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
1292		u |= URB_SHORT_NOT_OK;
1293	if (uurb->flags & USBDEVFS_URB_NO_FSBR)
1294		u |= URB_NO_FSBR;
1295	if (uurb->flags & USBDEVFS_URB_ZERO_PACKET)
1296		u |= URB_ZERO_PACKET;
1297	if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
1298		u |= URB_NO_INTERRUPT;
1299	as->urb->transfer_flags = u;
1300
 
 
 
 
 
1301	as->urb->transfer_buffer_length = uurb->buffer_length;
1302	as->urb->setup_packet = (unsigned char *)dr;
1303	dr = NULL;
1304	as->urb->start_frame = uurb->start_frame;
1305	as->urb->number_of_packets = uurb->number_of_packets;
1306	if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
1307			ps->dev->speed == USB_SPEED_HIGH)
1308		as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);
1309	else
1310		as->urb->interval = ep->desc.bInterval;
 
 
 
 
 
 
 
1311	as->urb->context = as;
1312	as->urb->complete = async_completed;
1313	for (totlen = u = 0; u < uurb->number_of_packets; u++) {
1314		as->urb->iso_frame_desc[u].offset = totlen;
1315		as->urb->iso_frame_desc[u].length = isopkt[u].length;
1316		totlen += isopkt[u].length;
1317	}
1318	kfree(isopkt);
1319	isopkt = NULL;
1320	as->ps = ps;
1321	as->userurb = arg;
1322	if (is_in && uurb->buffer_length > 0)
 
 
 
 
 
 
 
1323		as->userbuffer = uurb->buffer;
1324	else
1325		as->userbuffer = NULL;
1326	as->signr = uurb->signr;
1327	as->ifnum = ifnum;
1328	as->pid = get_pid(task_pid(current));
1329	as->cred = get_current_cred();
1330	security_task_getsecid(current, &as->secid);
1331	if (!is_in && uurb->buffer_length > 0) {
1332		if (copy_from_user(as->urb->transfer_buffer, uurb->buffer,
1333				uurb->buffer_length)) {
1334			ret = -EFAULT;
1335			goto error;
1336		}
1337	}
1338	snoop_urb(ps->dev, as->userurb, as->urb->pipe,
1339			as->urb->transfer_buffer_length, 0, SUBMIT,
1340			is_in ? NULL : as->urb->transfer_buffer,
1341				uurb->buffer_length);
 
 
1342	async_newpending(as);
1343
1344	if (usb_endpoint_xfer_bulk(&ep->desc)) {
1345		spin_lock_irq(&ps->lock);
1346
1347		/* Not exactly the endpoint address; the direction bit is
1348		 * shifted to the 0x10 position so that the value will be
1349		 * between 0 and 31.
1350		 */
1351		as->bulk_addr = usb_endpoint_num(&ep->desc) |
1352			((ep->desc.bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1353				>> 3);
1354
1355		/* If this bulk URB is the start of a new transfer, re-enable
1356		 * the endpoint.  Otherwise mark it as a continuation URB.
1357		 */
1358		if (uurb->flags & USBDEVFS_URB_BULK_CONTINUATION)
1359			as->bulk_status = AS_CONTINUATION;
1360		else
1361			ps->disabled_bulk_eps &= ~(1 << as->bulk_addr);
1362
1363		/* Don't accept continuation URBs if the endpoint is
1364		 * disabled because of an earlier error.
1365		 */
1366		if (ps->disabled_bulk_eps & (1 << as->bulk_addr))
1367			ret = -EREMOTEIO;
1368		else
1369			ret = usb_submit_urb(as->urb, GFP_ATOMIC);
1370		spin_unlock_irq(&ps->lock);
1371	} else {
1372		ret = usb_submit_urb(as->urb, GFP_KERNEL);
1373	}
1374
1375	if (ret) {
1376		dev_printk(KERN_DEBUG, &ps->dev->dev,
1377			   "usbfs: usb_submit_urb returned %d\n", ret);
1378		snoop_urb(ps->dev, as->userurb, as->urb->pipe,
1379				0, ret, COMPLETE, NULL, 0);
1380		async_removepending(as);
1381		goto error;
1382	}
1383	return 0;
1384
1385 error:
1386	kfree(isopkt);
1387	kfree(dr);
1388	if (as)
1389		free_async(as);
1390	return ret;
1391}
1392
1393static int proc_submiturb(struct dev_state *ps, void __user *arg)
1394{
1395	struct usbdevfs_urb uurb;
 
1396
1397	if (copy_from_user(&uurb, arg, sizeof(uurb)))
1398		return -EFAULT;
1399
 
 
 
1400	return proc_do_submiturb(ps, &uurb,
1401			(((struct usbdevfs_urb __user *)arg)->iso_frame_desc),
1402			arg);
1403}
1404
1405static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
1406{
1407	struct urb *urb;
1408	struct async *as;
1409	unsigned long flags;
1410
1411	spin_lock_irqsave(&ps->lock, flags);
1412	as = async_getpending(ps, arg);
1413	if (!as) {
1414		spin_unlock_irqrestore(&ps->lock, flags);
1415		return -EINVAL;
1416	}
1417
1418	urb = as->urb;
1419	usb_get_urb(urb);
1420	spin_unlock_irqrestore(&ps->lock, flags);
1421
1422	usb_kill_urb(urb);
1423	usb_put_urb(urb);
1424
1425	return 0;
1426}
1427
 
 
 
 
 
 
 
 
 
 
 
 
1428static int processcompl(struct async *as, void __user * __user *arg)
1429{
1430	struct urb *urb = as->urb;
1431	struct usbdevfs_urb __user *userurb = as->userurb;
1432	void __user *addr = as->userurb;
1433	unsigned int i;
1434
 
1435	if (as->userbuffer && urb->actual_length) {
1436		if (urb->number_of_packets > 0)		/* Isochronous */
1437			i = urb->transfer_buffer_length;
1438		else					/* Non-Isoc */
1439			i = urb->actual_length;
1440		if (copy_to_user(as->userbuffer, urb->transfer_buffer, i))
1441			goto err_out;
1442	}
1443	if (put_user(as->status, &userurb->status))
1444		goto err_out;
1445	if (put_user(urb->actual_length, &userurb->actual_length))
1446		goto err_out;
1447	if (put_user(urb->error_count, &userurb->error_count))
1448		goto err_out;
1449
1450	if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
1451		for (i = 0; i < urb->number_of_packets; i++) {
1452			if (put_user(urb->iso_frame_desc[i].actual_length,
1453				     &userurb->iso_frame_desc[i].actual_length))
1454				goto err_out;
1455			if (put_user(urb->iso_frame_desc[i].status,
1456				     &userurb->iso_frame_desc[i].status))
1457				goto err_out;
1458		}
1459	}
1460
1461	if (put_user(addr, (void __user * __user *)arg))
1462		return -EFAULT;
1463	return 0;
1464
1465err_out:
1466	return -EFAULT;
1467}
1468
1469static struct async *reap_as(struct dev_state *ps)
1470{
1471	DECLARE_WAITQUEUE(wait, current);
1472	struct async *as = NULL;
1473	struct usb_device *dev = ps->dev;
1474
1475	add_wait_queue(&ps->wait, &wait);
1476	for (;;) {
1477		__set_current_state(TASK_INTERRUPTIBLE);
1478		as = async_getcompleted(ps);
1479		if (as)
1480			break;
1481		if (signal_pending(current))
1482			break;
1483		usb_unlock_device(dev);
1484		schedule();
1485		usb_lock_device(dev);
1486	}
1487	remove_wait_queue(&ps->wait, &wait);
1488	set_current_state(TASK_RUNNING);
1489	return as;
1490}
1491
1492static int proc_reapurb(struct dev_state *ps, void __user *arg)
1493{
1494	struct async *as = reap_as(ps);
 
1495	if (as) {
1496		int retval = processcompl(as, (void __user * __user *)arg);
 
 
 
1497		free_async(as);
1498		return retval;
1499	}
1500	if (signal_pending(current))
1501		return -EINTR;
1502	return -EIO;
1503}
1504
1505static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
1506{
1507	int retval;
1508	struct async *as;
1509
1510	as = async_getcompleted(ps);
1511	retval = -EAGAIN;
1512	if (as) {
 
1513		retval = processcompl(as, (void __user * __user *)arg);
1514		free_async(as);
 
 
1515	}
1516	return retval;
1517}
1518
1519#ifdef CONFIG_COMPAT
1520static int proc_control_compat(struct dev_state *ps,
1521				struct usbdevfs_ctrltransfer32 __user *p32)
1522{
1523        struct usbdevfs_ctrltransfer __user *p;
1524        __u32 udata;
1525        p = compat_alloc_user_space(sizeof(*p));
1526        if (copy_in_user(p, p32, (sizeof(*p32) - sizeof(compat_caddr_t))) ||
1527            get_user(udata, &p32->data) ||
1528	    put_user(compat_ptr(udata), &p->data))
1529		return -EFAULT;
1530        return proc_control(ps, p);
1531}
1532
1533static int proc_bulk_compat(struct dev_state *ps,
1534			struct usbdevfs_bulktransfer32 __user *p32)
1535{
1536        struct usbdevfs_bulktransfer __user *p;
1537        compat_uint_t n;
1538        compat_caddr_t addr;
1539
1540        p = compat_alloc_user_space(sizeof(*p));
1541
1542        if (get_user(n, &p32->ep) || put_user(n, &p->ep) ||
1543            get_user(n, &p32->len) || put_user(n, &p->len) ||
1544            get_user(n, &p32->timeout) || put_user(n, &p->timeout) ||
1545            get_user(addr, &p32->data) || put_user(compat_ptr(addr), &p->data))
1546                return -EFAULT;
1547
1548        return proc_bulk(ps, p);
1549}
1550static int proc_disconnectsignal_compat(struct dev_state *ps, void __user *arg)
1551{
1552	struct usbdevfs_disconnectsignal32 ds;
1553
1554	if (copy_from_user(&ds, arg, sizeof(ds)))
1555		return -EFAULT;
1556	ps->discsignr = ds.signr;
1557	ps->disccontext = compat_ptr(ds.context);
1558	return 0;
1559}
1560
1561static int get_urb32(struct usbdevfs_urb *kurb,
1562		     struct usbdevfs_urb32 __user *uurb)
1563{
1564	__u32  uptr;
1565	if (!access_ok(VERIFY_READ, uurb, sizeof(*uurb)) ||
1566	    __get_user(kurb->type, &uurb->type) ||
1567	    __get_user(kurb->endpoint, &uurb->endpoint) ||
1568	    __get_user(kurb->status, &uurb->status) ||
1569	    __get_user(kurb->flags, &uurb->flags) ||
1570	    __get_user(kurb->buffer_length, &uurb->buffer_length) ||
1571	    __get_user(kurb->actual_length, &uurb->actual_length) ||
1572	    __get_user(kurb->start_frame, &uurb->start_frame) ||
1573	    __get_user(kurb->number_of_packets, &uurb->number_of_packets) ||
1574	    __get_user(kurb->error_count, &uurb->error_count) ||
1575	    __get_user(kurb->signr, &uurb->signr))
1576		return -EFAULT;
1577
1578	if (__get_user(uptr, &uurb->buffer))
1579		return -EFAULT;
1580	kurb->buffer = compat_ptr(uptr);
1581	if (__get_user(uptr, &uurb->usercontext))
1582		return -EFAULT;
1583	kurb->usercontext = compat_ptr(uptr);
1584
 
 
 
 
 
 
 
1585	return 0;
1586}
1587
1588static int proc_submiturb_compat(struct dev_state *ps, void __user *arg)
1589{
1590	struct usbdevfs_urb uurb;
 
1591
1592	if (get_urb32(&uurb, (struct usbdevfs_urb32 __user *)arg))
1593		return -EFAULT;
1594
 
 
 
1595	return proc_do_submiturb(ps, &uurb,
1596			((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc,
1597			arg);
1598}
1599
1600static int processcompl_compat(struct async *as, void __user * __user *arg)
1601{
1602	struct urb *urb = as->urb;
1603	struct usbdevfs_urb32 __user *userurb = as->userurb;
1604	void __user *addr = as->userurb;
1605	unsigned int i;
1606
 
1607	if (as->userbuffer && urb->actual_length) {
1608		if (urb->number_of_packets > 0)		/* Isochronous */
1609			i = urb->transfer_buffer_length;
1610		else					/* Non-Isoc */
1611			i = urb->actual_length;
1612		if (copy_to_user(as->userbuffer, urb->transfer_buffer, i))
1613			return -EFAULT;
1614	}
1615	if (put_user(as->status, &userurb->status))
1616		return -EFAULT;
1617	if (put_user(urb->actual_length, &userurb->actual_length))
1618		return -EFAULT;
1619	if (put_user(urb->error_count, &userurb->error_count))
1620		return -EFAULT;
1621
1622	if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
1623		for (i = 0; i < urb->number_of_packets; i++) {
1624			if (put_user(urb->iso_frame_desc[i].actual_length,
1625				     &userurb->iso_frame_desc[i].actual_length))
1626				return -EFAULT;
1627			if (put_user(urb->iso_frame_desc[i].status,
1628				     &userurb->iso_frame_desc[i].status))
1629				return -EFAULT;
1630		}
1631	}
1632
1633	if (put_user(ptr_to_compat(addr), (u32 __user *)arg))
1634		return -EFAULT;
1635	return 0;
1636}
1637
1638static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
1639{
1640	struct async *as = reap_as(ps);
 
1641	if (as) {
1642		int retval = processcompl_compat(as, (void __user * __user *)arg);
 
 
 
1643		free_async(as);
1644		return retval;
1645	}
1646	if (signal_pending(current))
1647		return -EINTR;
1648	return -EIO;
1649}
1650
1651static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
1652{
1653	int retval;
1654	struct async *as;
1655
1656	retval = -EAGAIN;
1657	as = async_getcompleted(ps);
1658	if (as) {
 
1659		retval = processcompl_compat(as, (void __user * __user *)arg);
1660		free_async(as);
 
 
1661	}
1662	return retval;
1663}
1664
1665
1666#endif
1667
1668static int proc_disconnectsignal(struct dev_state *ps, void __user *arg)
1669{
1670	struct usbdevfs_disconnectsignal ds;
1671
1672	if (copy_from_user(&ds, arg, sizeof(ds)))
1673		return -EFAULT;
1674	ps->discsignr = ds.signr;
1675	ps->disccontext = ds.context;
1676	return 0;
1677}
1678
1679static int proc_claiminterface(struct dev_state *ps, void __user *arg)
1680{
1681	unsigned int ifnum;
1682
1683	if (get_user(ifnum, (unsigned int __user *)arg))
1684		return -EFAULT;
1685	return claimintf(ps, ifnum);
1686}
1687
1688static int proc_releaseinterface(struct dev_state *ps, void __user *arg)
1689{
1690	unsigned int ifnum;
1691	int ret;
1692
1693	if (get_user(ifnum, (unsigned int __user *)arg))
1694		return -EFAULT;
1695	if ((ret = releaseintf(ps, ifnum)) < 0)
 
1696		return ret;
1697	destroy_async_on_interface (ps, ifnum);
1698	return 0;
1699}
1700
1701static int proc_ioctl(struct dev_state *ps, struct usbdevfs_ioctl *ctl)
1702{
1703	int			size;
1704	void			*buf = NULL;
1705	int			retval = 0;
1706	struct usb_interface    *intf = NULL;
1707	struct usb_driver       *driver = NULL;
1708
 
 
 
 
 
 
1709	/* alloc buffer */
1710	if ((size = _IOC_SIZE(ctl->ioctl_code)) > 0) {
1711		if ((buf = kmalloc(size, GFP_KERNEL)) == NULL)
 
 
1712			return -ENOMEM;
1713		if ((_IOC_DIR(ctl->ioctl_code) & _IOC_WRITE)) {
1714			if (copy_from_user(buf, ctl->data, size)) {
1715				kfree(buf);
1716				return -EFAULT;
1717			}
1718		} else {
1719			memset(buf, 0, size);
1720		}
1721	}
1722
1723	if (!connected(ps)) {
1724		kfree(buf);
1725		return -ENODEV;
1726	}
1727
1728	if (ps->dev->state != USB_STATE_CONFIGURED)
1729		retval = -EHOSTUNREACH;
1730	else if (!(intf = usb_ifnum_to_if(ps->dev, ctl->ifno)))
1731		retval = -EINVAL;
1732	else switch (ctl->ioctl_code) {
1733
1734	/* disconnect kernel driver from interface */
1735	case USBDEVFS_DISCONNECT:
1736		if (intf->dev.driver) {
1737			driver = to_usb_driver(intf->dev.driver);
1738			dev_dbg(&intf->dev, "disconnect by usbfs\n");
1739			usb_driver_release_interface(driver, intf);
1740		} else
1741			retval = -ENODATA;
1742		break;
1743
1744	/* let kernel drivers try to (re)bind to the interface */
1745	case USBDEVFS_CONNECT:
1746		if (!intf->dev.driver)
1747			retval = device_attach(&intf->dev);
1748		else
1749			retval = -EBUSY;
1750		break;
1751
1752	/* talk directly to the interface's driver */
1753	default:
1754		if (intf->dev.driver)
1755			driver = to_usb_driver(intf->dev.driver);
1756		if (driver == NULL || driver->unlocked_ioctl == NULL) {
1757			retval = -ENOTTY;
1758		} else {
1759			retval = driver->unlocked_ioctl(intf, ctl->ioctl_code, buf);
1760			if (retval == -ENOIOCTLCMD)
1761				retval = -ENOTTY;
1762		}
1763	}
1764
1765	/* cleanup and return */
1766	if (retval >= 0
1767			&& (_IOC_DIR(ctl->ioctl_code) & _IOC_READ) != 0
1768			&& size > 0
1769			&& copy_to_user(ctl->data, buf, size) != 0)
1770		retval = -EFAULT;
1771
1772	kfree(buf);
1773	return retval;
1774}
1775
1776static int proc_ioctl_default(struct dev_state *ps, void __user *arg)
1777{
1778	struct usbdevfs_ioctl	ctrl;
1779
1780	if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
1781		return -EFAULT;
1782	return proc_ioctl(ps, &ctrl);
1783}
1784
1785#ifdef CONFIG_COMPAT
1786static int proc_ioctl_compat(struct dev_state *ps, compat_uptr_t arg)
1787{
1788	struct usbdevfs_ioctl32 __user *uioc;
1789	struct usbdevfs_ioctl ctrl;
1790	u32 udata;
1791
1792	uioc = compat_ptr((long)arg);
1793	if (!access_ok(VERIFY_READ, uioc, sizeof(*uioc)) ||
1794	    __get_user(ctrl.ifno, &uioc->ifno) ||
1795	    __get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
1796	    __get_user(udata, &uioc->data))
1797		return -EFAULT;
1798	ctrl.data = compat_ptr(udata);
1799
 
1800	return proc_ioctl(ps, &ctrl);
1801}
1802#endif
1803
1804static int proc_claim_port(struct dev_state *ps, void __user *arg)
1805{
1806	unsigned portnum;
1807	int rc;
1808
1809	if (get_user(portnum, (unsigned __user *) arg))
1810		return -EFAULT;
1811	rc = usb_hub_claim_port(ps->dev, portnum, ps);
1812	if (rc == 0)
1813		snoop(&ps->dev->dev, "port %d claimed by process %d: %s\n",
1814			portnum, task_pid_nr(current), current->comm);
1815	return rc;
1816}
1817
1818static int proc_release_port(struct dev_state *ps, void __user *arg)
1819{
1820	unsigned portnum;
1821
1822	if (get_user(portnum, (unsigned __user *) arg))
1823		return -EFAULT;
1824	return usb_hub_release_port(ps->dev, portnum, ps);
1825}
1826
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1827/*
1828 * NOTE:  All requests here that have interface numbers as parameters
1829 * are assuming that somehow the configuration has been prevented from
1830 * changing.  But there's no mechanism to ensure that...
1831 */
1832static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
1833				void __user *p)
1834{
1835	struct dev_state *ps = file->private_data;
1836	struct inode *inode = file->f_path.dentry->d_inode;
1837	struct usb_device *dev = ps->dev;
1838	int ret = -ENOTTY;
1839
1840	if (!(file->f_mode & FMODE_WRITE))
1841		return -EPERM;
1842
1843	usb_lock_device(dev);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1844	if (!connected(ps)) {
1845		usb_unlock_device(dev);
1846		return -ENODEV;
1847	}
1848
1849	switch (cmd) {
1850	case USBDEVFS_CONTROL:
1851		snoop(&dev->dev, "%s: CONTROL\n", __func__);
1852		ret = proc_control(ps, p);
1853		if (ret >= 0)
1854			inode->i_mtime = CURRENT_TIME;
1855		break;
1856
1857	case USBDEVFS_BULK:
1858		snoop(&dev->dev, "%s: BULK\n", __func__);
1859		ret = proc_bulk(ps, p);
1860		if (ret >= 0)
1861			inode->i_mtime = CURRENT_TIME;
1862		break;
1863
1864	case USBDEVFS_RESETEP:
1865		snoop(&dev->dev, "%s: RESETEP\n", __func__);
1866		ret = proc_resetep(ps, p);
1867		if (ret >= 0)
1868			inode->i_mtime = CURRENT_TIME;
1869		break;
1870
1871	case USBDEVFS_RESET:
1872		snoop(&dev->dev, "%s: RESET\n", __func__);
1873		ret = proc_resetdevice(ps);
1874		break;
1875
1876	case USBDEVFS_CLEAR_HALT:
1877		snoop(&dev->dev, "%s: CLEAR_HALT\n", __func__);
1878		ret = proc_clearhalt(ps, p);
1879		if (ret >= 0)
1880			inode->i_mtime = CURRENT_TIME;
1881		break;
1882
1883	case USBDEVFS_GETDRIVER:
1884		snoop(&dev->dev, "%s: GETDRIVER\n", __func__);
1885		ret = proc_getdriver(ps, p);
1886		break;
1887
1888	case USBDEVFS_CONNECTINFO:
1889		snoop(&dev->dev, "%s: CONNECTINFO\n", __func__);
1890		ret = proc_connectinfo(ps, p);
1891		break;
1892
1893	case USBDEVFS_SETINTERFACE:
1894		snoop(&dev->dev, "%s: SETINTERFACE\n", __func__);
1895		ret = proc_setintf(ps, p);
1896		break;
1897
1898	case USBDEVFS_SETCONFIGURATION:
1899		snoop(&dev->dev, "%s: SETCONFIGURATION\n", __func__);
1900		ret = proc_setconfig(ps, p);
1901		break;
1902
1903	case USBDEVFS_SUBMITURB:
1904		snoop(&dev->dev, "%s: SUBMITURB\n", __func__);
1905		ret = proc_submiturb(ps, p);
1906		if (ret >= 0)
1907			inode->i_mtime = CURRENT_TIME;
1908		break;
1909
1910#ifdef CONFIG_COMPAT
1911	case USBDEVFS_CONTROL32:
1912		snoop(&dev->dev, "%s: CONTROL32\n", __func__);
1913		ret = proc_control_compat(ps, p);
1914		if (ret >= 0)
1915			inode->i_mtime = CURRENT_TIME;
1916		break;
1917
1918	case USBDEVFS_BULK32:
1919		snoop(&dev->dev, "%s: BULK32\n", __func__);
1920		ret = proc_bulk_compat(ps, p);
1921		if (ret >= 0)
1922			inode->i_mtime = CURRENT_TIME;
1923		break;
1924
1925	case USBDEVFS_DISCSIGNAL32:
1926		snoop(&dev->dev, "%s: DISCSIGNAL32\n", __func__);
1927		ret = proc_disconnectsignal_compat(ps, p);
1928		break;
1929
1930	case USBDEVFS_SUBMITURB32:
1931		snoop(&dev->dev, "%s: SUBMITURB32\n", __func__);
1932		ret = proc_submiturb_compat(ps, p);
1933		if (ret >= 0)
1934			inode->i_mtime = CURRENT_TIME;
1935		break;
1936
1937	case USBDEVFS_REAPURB32:
1938		snoop(&dev->dev, "%s: REAPURB32\n", __func__);
1939		ret = proc_reapurb_compat(ps, p);
1940		break;
1941
1942	case USBDEVFS_REAPURBNDELAY32:
1943		snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
1944		ret = proc_reapurbnonblock_compat(ps, p);
1945		break;
1946
1947	case USBDEVFS_IOCTL32:
1948		snoop(&dev->dev, "%s: IOCTL32\n", __func__);
1949		ret = proc_ioctl_compat(ps, ptr_to_compat(p));
1950		break;
1951#endif
1952
1953	case USBDEVFS_DISCARDURB:
1954		snoop(&dev->dev, "%s: DISCARDURB\n", __func__);
1955		ret = proc_unlinkurb(ps, p);
1956		break;
1957
1958	case USBDEVFS_REAPURB:
1959		snoop(&dev->dev, "%s: REAPURB\n", __func__);
1960		ret = proc_reapurb(ps, p);
1961		break;
1962
1963	case USBDEVFS_REAPURBNDELAY:
1964		snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
1965		ret = proc_reapurbnonblock(ps, p);
1966		break;
1967
1968	case USBDEVFS_DISCSIGNAL:
1969		snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
1970		ret = proc_disconnectsignal(ps, p);
1971		break;
1972
1973	case USBDEVFS_CLAIMINTERFACE:
1974		snoop(&dev->dev, "%s: CLAIMINTERFACE\n", __func__);
1975		ret = proc_claiminterface(ps, p);
1976		break;
1977
1978	case USBDEVFS_RELEASEINTERFACE:
1979		snoop(&dev->dev, "%s: RELEASEINTERFACE\n", __func__);
1980		ret = proc_releaseinterface(ps, p);
1981		break;
1982
1983	case USBDEVFS_IOCTL:
1984		snoop(&dev->dev, "%s: IOCTL\n", __func__);
1985		ret = proc_ioctl_default(ps, p);
1986		break;
1987
1988	case USBDEVFS_CLAIM_PORT:
1989		snoop(&dev->dev, "%s: CLAIM_PORT\n", __func__);
1990		ret = proc_claim_port(ps, p);
1991		break;
1992
1993	case USBDEVFS_RELEASE_PORT:
1994		snoop(&dev->dev, "%s: RELEASE_PORT\n", __func__);
1995		ret = proc_release_port(ps, p);
1996		break;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1997	}
 
 
1998	usb_unlock_device(dev);
1999	if (ret >= 0)
2000		inode->i_atime = CURRENT_TIME;
2001	return ret;
2002}
2003
2004static long usbdev_ioctl(struct file *file, unsigned int cmd,
2005			unsigned long arg)
2006{
2007	int ret;
2008
2009	ret = usbdev_do_ioctl(file, cmd, (void __user *)arg);
2010
2011	return ret;
2012}
2013
2014#ifdef CONFIG_COMPAT
2015static long usbdev_compat_ioctl(struct file *file, unsigned int cmd,
2016			unsigned long arg)
2017{
2018	int ret;
2019
2020	ret = usbdev_do_ioctl(file, cmd, compat_ptr(arg));
2021
2022	return ret;
2023}
2024#endif
2025
2026/* No kernel lock - fine */
2027static unsigned int usbdev_poll(struct file *file,
2028				struct poll_table_struct *wait)
2029{
2030	struct dev_state *ps = file->private_data;
2031	unsigned int mask = 0;
2032
2033	poll_wait(file, &ps->wait, wait);
2034	if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
2035		mask |= POLLOUT | POLLWRNORM;
2036	if (!connected(ps))
2037		mask |= POLLERR | POLLHUP;
 
 
2038	return mask;
2039}
2040
2041const struct file_operations usbdev_file_operations = {
2042	.owner =	  THIS_MODULE,
2043	.llseek =	  usbdev_lseek,
2044	.read =		  usbdev_read,
2045	.poll =		  usbdev_poll,
2046	.unlocked_ioctl = usbdev_ioctl,
2047#ifdef CONFIG_COMPAT
2048	.compat_ioctl =   usbdev_compat_ioctl,
2049#endif
 
2050	.open =		  usbdev_open,
2051	.release =	  usbdev_release,
2052};
2053
2054static void usbdev_remove(struct usb_device *udev)
2055{
2056	struct dev_state *ps;
2057	struct siginfo sinfo;
2058
 
 
2059	while (!list_empty(&udev->filelist)) {
2060		ps = list_entry(udev->filelist.next, struct dev_state, list);
2061		destroy_all_async(ps);
2062		wake_up_all(&ps->wait);
 
 
2063		list_del_init(&ps->list);
2064		if (ps->discsignr) {
2065			sinfo.si_signo = ps->discsignr;
2066			sinfo.si_errno = EPIPE;
2067			sinfo.si_code = SI_ASYNCIO;
2068			sinfo.si_addr = ps->disccontext;
2069			kill_pid_info_as_cred(ps->discsignr, &sinfo,
2070					ps->disc_pid, ps->cred, ps->secid);
2071		}
2072	}
 
2073}
2074
2075static int usbdev_notify(struct notifier_block *self,
2076			       unsigned long action, void *dev)
2077{
2078	switch (action) {
2079	case USB_DEVICE_ADD:
2080		break;
2081	case USB_DEVICE_REMOVE:
2082		usbdev_remove(dev);
2083		break;
2084	}
2085	return NOTIFY_OK;
2086}
2087
2088static struct notifier_block usbdev_nb = {
2089	.notifier_call = 	usbdev_notify,
2090};
2091
2092static struct cdev usb_device_cdev;
2093
2094int __init usb_devio_init(void)
2095{
2096	int retval;
2097
2098	retval = register_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX,
2099					"usb_device");
2100	if (retval) {
2101		printk(KERN_ERR "Unable to register minors for usb_device\n");
2102		goto out;
2103	}
2104	cdev_init(&usb_device_cdev, &usbdev_file_operations);
2105	retval = cdev_add(&usb_device_cdev, USB_DEVICE_DEV, USB_DEVICE_MAX);
2106	if (retval) {
2107		printk(KERN_ERR "Unable to get usb_device major %d\n",
2108		       USB_DEVICE_MAJOR);
2109		goto error_cdev;
2110	}
2111	usb_register_notify(&usbdev_nb);
2112out:
2113	return retval;
2114
2115error_cdev:
2116	unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
2117	goto out;
2118}
2119
2120void usb_devio_cleanup(void)
2121{
2122	usb_unregister_notify(&usbdev_nb);
2123	cdev_del(&usb_device_cdev);
2124	unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
2125}