devio.c 44 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806
  1. /*****************************************************************************/
  2. /*
  3. * devio.c -- User space communication with USB devices.
  4. *
  5. * Copyright (C) 1999-2000 Thomas Sailer (sailer@ife.ee.ethz.ch)
  6. *
  7. * This program is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License as published by
  9. * the Free Software Foundation; either version 2 of the License, or
  10. * (at your option) any later version.
  11. *
  12. * This program is distributed in the hope that it will be useful,
  13. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. * GNU General Public License for more details.
  16. *
  17. * You should have received a copy of the GNU General Public License
  18. * along with this program; if not, write to the Free Software
  19. * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20. *
  21. * This file implements the usbfs/x/y files, where
  22. * x is the bus number and y the device number.
  23. *
  24. * It allows user space programs/"drivers" to communicate directly
  25. * with USB devices without intervening kernel driver.
  26. *
  27. * Revision history
  28. * 22.12.1999 0.1 Initial release (split from proc_usb.c)
  29. * 04.01.2000 0.2 Turned into its own filesystem
  30. * 30.09.2005 0.3 Fix user-triggerable oops in async URB delivery
  31. * (CAN-2005-3055)
  32. */
  33. /*****************************************************************************/
  34. #include <linux/fs.h>
  35. #include <linux/mm.h>
  36. #include <linux/slab.h>
  37. #include <linux/smp_lock.h>
  38. #include <linux/signal.h>
  39. #include <linux/poll.h>
  40. #include <linux/module.h>
  41. #include <linux/usb.h>
  42. #include <linux/usbdevice_fs.h>
  43. #include <linux/cdev.h>
  44. #include <linux/notifier.h>
  45. #include <linux/security.h>
  46. #include <asm/uaccess.h>
  47. #include <asm/byteorder.h>
  48. #include <linux/moduleparam.h>
  49. #include "hcd.h" /* for usbcore internals */
  50. #include "usb.h"
  51. #define USB_MAXBUS 64
  52. #define USB_DEVICE_MAX USB_MAXBUS * 128
  53. /* Mutual exclusion for removal, open, and release */
  54. DEFINE_MUTEX(usbfs_mutex);
  55. struct dev_state {
  56. struct list_head list; /* state list */
  57. struct usb_device *dev;
  58. struct file *file;
  59. spinlock_t lock; /* protects the async urb lists */
  60. struct list_head async_pending;
  61. struct list_head async_completed;
  62. wait_queue_head_t wait; /* wake up if a request completed */
  63. unsigned int discsignr;
  64. struct pid *disc_pid;
  65. uid_t disc_uid, disc_euid;
  66. void __user *disccontext;
  67. unsigned long ifclaimed;
  68. u32 secid;
  69. };
  70. struct async {
  71. struct list_head asynclist;
  72. struct dev_state *ps;
  73. struct pid *pid;
  74. uid_t uid, euid;
  75. unsigned int signr;
  76. unsigned int ifnum;
  77. void __user *userbuffer;
  78. void __user *userurb;
  79. struct urb *urb;
  80. int status;
  81. u32 secid;
  82. };
  83. static int usbfs_snoop;
  84. module_param(usbfs_snoop, bool, S_IRUGO | S_IWUSR);
  85. MODULE_PARM_DESC(usbfs_snoop, "true to log all usbfs traffic");
  86. #define snoop(dev, format, arg...) \
  87. do { \
  88. if (usbfs_snoop) \
  89. dev_info(dev , format , ## arg); \
  90. } while (0)
  91. #define USB_DEVICE_DEV MKDEV(USB_DEVICE_MAJOR, 0)
  92. #define MAX_USBFS_BUFFER_SIZE 16384
  93. static inline int connected(struct dev_state *ps)
  94. {
  95. return (!list_empty(&ps->list) &&
  96. ps->dev->state != USB_STATE_NOTATTACHED);
  97. }
  98. static loff_t usbdev_lseek(struct file *file, loff_t offset, int orig)
  99. {
  100. loff_t ret;
  101. lock_kernel();
  102. switch (orig) {
  103. case 0:
  104. file->f_pos = offset;
  105. ret = file->f_pos;
  106. break;
  107. case 1:
  108. file->f_pos += offset;
  109. ret = file->f_pos;
  110. break;
  111. case 2:
  112. default:
  113. ret = -EINVAL;
  114. }
  115. unlock_kernel();
  116. return ret;
  117. }
  118. static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
  119. loff_t *ppos)
  120. {
  121. struct dev_state *ps = file->private_data;
  122. struct usb_device *dev = ps->dev;
  123. ssize_t ret = 0;
  124. unsigned len;
  125. loff_t pos;
  126. int i;
  127. pos = *ppos;
  128. usb_lock_device(dev);
  129. if (!connected(ps)) {
  130. ret = -ENODEV;
  131. goto err;
  132. } else if (pos < 0) {
  133. ret = -EINVAL;
  134. goto err;
  135. }
  136. if (pos < sizeof(struct usb_device_descriptor)) {
  137. /* 18 bytes - fits on the stack */
  138. struct usb_device_descriptor temp_desc;
  139. memcpy(&temp_desc, &dev->descriptor, sizeof(dev->descriptor));
  140. le16_to_cpus(&temp_desc.bcdUSB);
  141. le16_to_cpus(&temp_desc.idVendor);
  142. le16_to_cpus(&temp_desc.idProduct);
  143. le16_to_cpus(&temp_desc.bcdDevice);
  144. len = sizeof(struct usb_device_descriptor) - pos;
  145. if (len > nbytes)
  146. len = nbytes;
  147. if (copy_to_user(buf, ((char *)&temp_desc) + pos, len)) {
  148. ret = -EFAULT;
  149. goto err;
  150. }
  151. *ppos += len;
  152. buf += len;
  153. nbytes -= len;
  154. ret += len;
  155. }
  156. pos = sizeof(struct usb_device_descriptor);
  157. for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {
  158. struct usb_config_descriptor *config =
  159. (struct usb_config_descriptor *)dev->rawdescriptors[i];
  160. unsigned int length = le16_to_cpu(config->wTotalLength);
  161. if (*ppos < pos + length) {
  162. /* The descriptor may claim to be longer than it
  163. * really is. Here is the actual allocated length. */
  164. unsigned alloclen =
  165. le16_to_cpu(dev->config[i].desc.wTotalLength);
  166. len = length - (*ppos - pos);
  167. if (len > nbytes)
  168. len = nbytes;
  169. /* Simply don't write (skip over) unallocated parts */
  170. if (alloclen > (*ppos - pos)) {
  171. alloclen -= (*ppos - pos);
  172. if (copy_to_user(buf,
  173. dev->rawdescriptors[i] + (*ppos - pos),
  174. min(len, alloclen))) {
  175. ret = -EFAULT;
  176. goto err;
  177. }
  178. }
  179. *ppos += len;
  180. buf += len;
  181. nbytes -= len;
  182. ret += len;
  183. }
  184. pos += length;
  185. }
  186. err:
  187. usb_unlock_device(dev);
  188. return ret;
  189. }
  190. /*
  191. * async list handling
  192. */
  193. static struct async *alloc_async(unsigned int numisoframes)
  194. {
  195. struct async *as;
  196. as = kzalloc(sizeof(struct async), GFP_KERNEL);
  197. if (!as)
  198. return NULL;
  199. as->urb = usb_alloc_urb(numisoframes, GFP_KERNEL);
  200. if (!as->urb) {
  201. kfree(as);
  202. return NULL;
  203. }
  204. return as;
  205. }
  206. static void free_async(struct async *as)
  207. {
  208. put_pid(as->pid);
  209. kfree(as->urb->transfer_buffer);
  210. kfree(as->urb->setup_packet);
  211. usb_free_urb(as->urb);
  212. kfree(as);
  213. }
  214. static inline void async_newpending(struct async *as)
  215. {
  216. struct dev_state *ps = as->ps;
  217. unsigned long flags;
  218. spin_lock_irqsave(&ps->lock, flags);
  219. list_add_tail(&as->asynclist, &ps->async_pending);
  220. spin_unlock_irqrestore(&ps->lock, flags);
  221. }
  222. static inline void async_removepending(struct async *as)
  223. {
  224. struct dev_state *ps = as->ps;
  225. unsigned long flags;
  226. spin_lock_irqsave(&ps->lock, flags);
  227. list_del_init(&as->asynclist);
  228. spin_unlock_irqrestore(&ps->lock, flags);
  229. }
  230. static inline struct async *async_getcompleted(struct dev_state *ps)
  231. {
  232. unsigned long flags;
  233. struct async *as = NULL;
  234. spin_lock_irqsave(&ps->lock, flags);
  235. if (!list_empty(&ps->async_completed)) {
  236. as = list_entry(ps->async_completed.next, struct async,
  237. asynclist);
  238. list_del_init(&as->asynclist);
  239. }
  240. spin_unlock_irqrestore(&ps->lock, flags);
  241. return as;
  242. }
  243. static inline struct async *async_getpending(struct dev_state *ps,
  244. void __user *userurb)
  245. {
  246. unsigned long flags;
  247. struct async *as;
  248. spin_lock_irqsave(&ps->lock, flags);
  249. list_for_each_entry(as, &ps->async_pending, asynclist)
  250. if (as->userurb == userurb) {
  251. list_del_init(&as->asynclist);
  252. spin_unlock_irqrestore(&ps->lock, flags);
  253. return as;
  254. }
  255. spin_unlock_irqrestore(&ps->lock, flags);
  256. return NULL;
  257. }
  258. static void snoop_urb(struct urb *urb, void __user *userurb)
  259. {
  260. int j;
  261. unsigned char *data = urb->transfer_buffer;
  262. if (!usbfs_snoop)
  263. return;
  264. dev_info(&urb->dev->dev, "direction=%s\n",
  265. usb_urb_dir_in(urb) ? "IN" : "OUT");
  266. dev_info(&urb->dev->dev, "userurb=%p\n", userurb);
  267. dev_info(&urb->dev->dev, "transfer_buffer_length=%d\n",
  268. urb->transfer_buffer_length);
  269. dev_info(&urb->dev->dev, "actual_length=%d\n", urb->actual_length);
  270. dev_info(&urb->dev->dev, "data: ");
  271. for (j = 0; j < urb->transfer_buffer_length; ++j)
  272. printk("%02x ", data[j]);
  273. printk("\n");
  274. }
  275. static void async_completed(struct urb *urb)
  276. {
  277. struct async *as = urb->context;
  278. struct dev_state *ps = as->ps;
  279. struct siginfo sinfo;
  280. spin_lock(&ps->lock);
  281. list_move_tail(&as->asynclist, &ps->async_completed);
  282. spin_unlock(&ps->lock);
  283. as->status = urb->status;
  284. if (as->signr) {
  285. sinfo.si_signo = as->signr;
  286. sinfo.si_errno = as->status;
  287. sinfo.si_code = SI_ASYNCIO;
  288. sinfo.si_addr = as->userurb;
  289. kill_pid_info_as_uid(as->signr, &sinfo, as->pid, as->uid,
  290. as->euid, as->secid);
  291. }
  292. snoop(&urb->dev->dev, "urb complete\n");
  293. snoop_urb(urb, as->userurb);
  294. wake_up(&ps->wait);
  295. }
  296. static void destroy_async(struct dev_state *ps, struct list_head *list)
  297. {
  298. struct async *as;
  299. unsigned long flags;
  300. spin_lock_irqsave(&ps->lock, flags);
  301. while (!list_empty(list)) {
  302. as = list_entry(list->next, struct async, asynclist);
  303. list_del_init(&as->asynclist);
  304. /* drop the spinlock so the completion handler can run */
  305. spin_unlock_irqrestore(&ps->lock, flags);
  306. usb_kill_urb(as->urb);
  307. spin_lock_irqsave(&ps->lock, flags);
  308. }
  309. spin_unlock_irqrestore(&ps->lock, flags);
  310. as = async_getcompleted(ps);
  311. while (as) {
  312. free_async(as);
  313. as = async_getcompleted(ps);
  314. }
  315. }
  316. static void destroy_async_on_interface(struct dev_state *ps,
  317. unsigned int ifnum)
  318. {
  319. struct list_head *p, *q, hitlist;
  320. unsigned long flags;
  321. INIT_LIST_HEAD(&hitlist);
  322. spin_lock_irqsave(&ps->lock, flags);
  323. list_for_each_safe(p, q, &ps->async_pending)
  324. if (ifnum == list_entry(p, struct async, asynclist)->ifnum)
  325. list_move_tail(p, &hitlist);
  326. spin_unlock_irqrestore(&ps->lock, flags);
  327. destroy_async(ps, &hitlist);
  328. }
  329. static inline void destroy_all_async(struct dev_state *ps)
  330. {
  331. destroy_async(ps, &ps->async_pending);
  332. }
  333. /*
  334. * interface claims are made only at the request of user level code,
  335. * which can also release them (explicitly or by closing files).
  336. * they're also undone when devices disconnect.
  337. */
  338. static int driver_probe(struct usb_interface *intf,
  339. const struct usb_device_id *id)
  340. {
  341. return -ENODEV;
  342. }
  343. static void driver_disconnect(struct usb_interface *intf)
  344. {
  345. struct dev_state *ps = usb_get_intfdata(intf);
  346. unsigned int ifnum = intf->altsetting->desc.bInterfaceNumber;
  347. if (!ps)
  348. return;
  349. /* NOTE: this relies on usbcore having canceled and completed
  350. * all pending I/O requests; 2.6 does that.
  351. */
  352. if (likely(ifnum < 8*sizeof(ps->ifclaimed)))
  353. clear_bit(ifnum, &ps->ifclaimed);
  354. else
  355. warn("interface number %u out of range", ifnum);
  356. usb_set_intfdata(intf, NULL);
  357. /* force async requests to complete */
  358. destroy_async_on_interface(ps, ifnum);
  359. }
  360. /* The following routines are merely placeholders. There is no way
  361. * to inform a user task about suspend or resumes.
  362. */
  363. static int driver_suspend(struct usb_interface *intf, pm_message_t msg)
  364. {
  365. return 0;
  366. }
  367. static int driver_resume(struct usb_interface *intf)
  368. {
  369. return 0;
  370. }
  371. struct usb_driver usbfs_driver = {
  372. .name = "usbfs",
  373. .probe = driver_probe,
  374. .disconnect = driver_disconnect,
  375. .suspend = driver_suspend,
  376. .resume = driver_resume,
  377. };
  378. static int claimintf(struct dev_state *ps, unsigned int ifnum)
  379. {
  380. struct usb_device *dev = ps->dev;
  381. struct usb_interface *intf;
  382. int err;
  383. if (ifnum >= 8*sizeof(ps->ifclaimed))
  384. return -EINVAL;
  385. /* already claimed */
  386. if (test_bit(ifnum, &ps->ifclaimed))
  387. return 0;
  388. intf = usb_ifnum_to_if(dev, ifnum);
  389. if (!intf)
  390. err = -ENOENT;
  391. else
  392. err = usb_driver_claim_interface(&usbfs_driver, intf, ps);
  393. if (err == 0)
  394. set_bit(ifnum, &ps->ifclaimed);
  395. return err;
  396. }
  397. static int releaseintf(struct dev_state *ps, unsigned int ifnum)
  398. {
  399. struct usb_device *dev;
  400. struct usb_interface *intf;
  401. int err;
  402. err = -EINVAL;
  403. if (ifnum >= 8*sizeof(ps->ifclaimed))
  404. return err;
  405. dev = ps->dev;
  406. intf = usb_ifnum_to_if(dev, ifnum);
  407. if (!intf)
  408. err = -ENOENT;
  409. else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) {
  410. usb_driver_release_interface(&usbfs_driver, intf);
  411. err = 0;
  412. }
  413. return err;
  414. }
  415. static int checkintf(struct dev_state *ps, unsigned int ifnum)
  416. {
  417. if (ps->dev->state != USB_STATE_CONFIGURED)
  418. return -EHOSTUNREACH;
  419. if (ifnum >= 8*sizeof(ps->ifclaimed))
  420. return -EINVAL;
  421. if (test_bit(ifnum, &ps->ifclaimed))
  422. return 0;
  423. /* if not yet claimed, claim it for the driver */
  424. dev_warn(&ps->dev->dev, "usbfs: process %d (%s) did not claim "
  425. "interface %u before use\n", task_pid_nr(current),
  426. current->comm, ifnum);
  427. return claimintf(ps, ifnum);
  428. }
  429. static int findintfep(struct usb_device *dev, unsigned int ep)
  430. {
  431. unsigned int i, j, e;
  432. struct usb_interface *intf;
  433. struct usb_host_interface *alts;
  434. struct usb_endpoint_descriptor *endpt;
  435. if (ep & ~(USB_DIR_IN|0xf))
  436. return -EINVAL;
  437. if (!dev->actconfig)
  438. return -ESRCH;
  439. for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
  440. intf = dev->actconfig->interface[i];
  441. for (j = 0; j < intf->num_altsetting; j++) {
  442. alts = &intf->altsetting[j];
  443. for (e = 0; e < alts->desc.bNumEndpoints; e++) {
  444. endpt = &alts->endpoint[e].desc;
  445. if (endpt->bEndpointAddress == ep)
  446. return alts->desc.bInterfaceNumber;
  447. }
  448. }
  449. }
  450. return -ENOENT;
  451. }
  452. static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype,
  453. unsigned int index)
  454. {
  455. int ret = 0;
  456. if (ps->dev->state != USB_STATE_ADDRESS
  457. && ps->dev->state != USB_STATE_CONFIGURED)
  458. return -EHOSTUNREACH;
  459. if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
  460. return 0;
  461. index &= 0xff;
  462. switch (requesttype & USB_RECIP_MASK) {
  463. case USB_RECIP_ENDPOINT:
  464. ret = findintfep(ps->dev, index);
  465. if (ret >= 0)
  466. ret = checkintf(ps, ret);
  467. break;
  468. case USB_RECIP_INTERFACE:
  469. ret = checkintf(ps, index);
  470. break;
  471. }
  472. return ret;
  473. }
  474. static int match_devt(struct device *dev, void *data)
  475. {
  476. return (dev->devt == (dev_t) data);
  477. }
  478. static struct usb_device *usbdev_lookup_by_devt(dev_t devt)
  479. {
  480. struct device *dev;
  481. dev = bus_find_device(&usb_bus_type, NULL, (void *) devt, match_devt);
  482. if (!dev)
  483. return NULL;
  484. put_device(dev);
  485. return container_of(dev, struct usb_device, dev);
  486. }
  487. /*
  488. * file operations
  489. */
  490. static int usbdev_open(struct inode *inode, struct file *file)
  491. {
  492. struct usb_device *dev = NULL;
  493. struct dev_state *ps;
  494. int ret;
  495. lock_kernel();
  496. /* Protect against simultaneous removal or release */
  497. mutex_lock(&usbfs_mutex);
  498. ret = -ENOMEM;
  499. ps = kmalloc(sizeof(struct dev_state), GFP_KERNEL);
  500. if (!ps)
  501. goto out;
  502. ret = -ENOENT;
  503. /* usbdev device-node */
  504. if (imajor(inode) == USB_DEVICE_MAJOR)
  505. dev = usbdev_lookup_by_devt(inode->i_rdev);
  506. #ifdef CONFIG_USB_DEVICEFS
  507. /* procfs file */
  508. if (!dev)
  509. dev = inode->i_private;
  510. #endif
  511. if (!dev)
  512. goto out;
  513. ret = usb_autoresume_device(dev);
  514. if (ret)
  515. goto out;
  516. usb_get_dev(dev);
  517. ret = 0;
  518. ps->dev = dev;
  519. ps->file = file;
  520. spin_lock_init(&ps->lock);
  521. INIT_LIST_HEAD(&ps->list);
  522. INIT_LIST_HEAD(&ps->async_pending);
  523. INIT_LIST_HEAD(&ps->async_completed);
  524. init_waitqueue_head(&ps->wait);
  525. ps->discsignr = 0;
  526. ps->disc_pid = get_pid(task_pid(current));
  527. ps->disc_uid = current->uid;
  528. ps->disc_euid = current->euid;
  529. ps->disccontext = NULL;
  530. ps->ifclaimed = 0;
  531. security_task_getsecid(current, &ps->secid);
  532. smp_wmb();
  533. list_add_tail(&ps->list, &dev->filelist);
  534. file->private_data = ps;
  535. out:
  536. if (ret)
  537. kfree(ps);
  538. mutex_unlock(&usbfs_mutex);
  539. unlock_kernel();
  540. return ret;
  541. }
  542. static int usbdev_release(struct inode *inode, struct file *file)
  543. {
  544. struct dev_state *ps = file->private_data;
  545. struct usb_device *dev = ps->dev;
  546. unsigned int ifnum;
  547. usb_lock_device(dev);
  548. /* Protect against simultaneous open */
  549. mutex_lock(&usbfs_mutex);
  550. list_del_init(&ps->list);
  551. mutex_unlock(&usbfs_mutex);
  552. for (ifnum = 0; ps->ifclaimed && ifnum < 8*sizeof(ps->ifclaimed);
  553. ifnum++) {
  554. if (test_bit(ifnum, &ps->ifclaimed))
  555. releaseintf(ps, ifnum);
  556. }
  557. destroy_all_async(ps);
  558. usb_autosuspend_device(dev);
  559. usb_unlock_device(dev);
  560. usb_put_dev(dev);
  561. put_pid(ps->disc_pid);
  562. kfree(ps);
  563. return 0;
  564. }
  565. static int proc_control(struct dev_state *ps, void __user *arg)
  566. {
  567. struct usb_device *dev = ps->dev;
  568. struct usbdevfs_ctrltransfer ctrl;
  569. unsigned int tmo;
  570. unsigned char *tbuf;
  571. unsigned wLength;
  572. int i, j, ret;
  573. if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
  574. return -EFAULT;
  575. ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.wIndex);
  576. if (ret)
  577. return ret;
  578. wLength = ctrl.wLength; /* To suppress 64k PAGE_SIZE warning */
  579. if (wLength > PAGE_SIZE)
  580. return -EINVAL;
  581. tbuf = (unsigned char *)__get_free_page(GFP_KERNEL);
  582. if (!tbuf)
  583. return -ENOMEM;
  584. tmo = ctrl.timeout;
  585. if (ctrl.bRequestType & 0x80) {
  586. if (ctrl.wLength && !access_ok(VERIFY_WRITE, ctrl.data,
  587. ctrl.wLength)) {
  588. free_page((unsigned long)tbuf);
  589. return -EINVAL;
  590. }
  591. snoop(&dev->dev, "control read: bRequest=%02x "
  592. "bRrequestType=%02x wValue=%04x "
  593. "wIndex=%04x wLength=%04x\n",
  594. ctrl.bRequest, ctrl.bRequestType, ctrl.wValue,
  595. ctrl.wIndex, ctrl.wLength);
  596. usb_unlock_device(dev);
  597. i = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), ctrl.bRequest,
  598. ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
  599. tbuf, ctrl.wLength, tmo);
  600. usb_lock_device(dev);
  601. if ((i > 0) && ctrl.wLength) {
  602. if (usbfs_snoop) {
  603. dev_info(&dev->dev, "control read: data ");
  604. for (j = 0; j < i; ++j)
  605. printk("%02x ", (u8)(tbuf)[j]);
  606. printk("\n");
  607. }
  608. if (copy_to_user(ctrl.data, tbuf, i)) {
  609. free_page((unsigned long)tbuf);
  610. return -EFAULT;
  611. }
  612. }
  613. } else {
  614. if (ctrl.wLength) {
  615. if (copy_from_user(tbuf, ctrl.data, ctrl.wLength)) {
  616. free_page((unsigned long)tbuf);
  617. return -EFAULT;
  618. }
  619. }
  620. snoop(&dev->dev, "control write: bRequest=%02x "
  621. "bRrequestType=%02x wValue=%04x "
  622. "wIndex=%04x wLength=%04x\n",
  623. ctrl.bRequest, ctrl.bRequestType, ctrl.wValue,
  624. ctrl.wIndex, ctrl.wLength);
  625. if (usbfs_snoop) {
  626. dev_info(&dev->dev, "control write: data: ");
  627. for (j = 0; j < ctrl.wLength; ++j)
  628. printk("%02x ", (unsigned char)(tbuf)[j]);
  629. printk("\n");
  630. }
  631. usb_unlock_device(dev);
  632. i = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ctrl.bRequest,
  633. ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
  634. tbuf, ctrl.wLength, tmo);
  635. usb_lock_device(dev);
  636. }
  637. free_page((unsigned long)tbuf);
  638. if (i < 0 && i != -EPIPE) {
  639. dev_printk(KERN_DEBUG, &dev->dev, "usbfs: USBDEVFS_CONTROL "
  640. "failed cmd %s rqt %u rq %u len %u ret %d\n",
  641. current->comm, ctrl.bRequestType, ctrl.bRequest,
  642. ctrl.wLength, i);
  643. }
  644. return i;
  645. }
  646. static int proc_bulk(struct dev_state *ps, void __user *arg)
  647. {
  648. struct usb_device *dev = ps->dev;
  649. struct usbdevfs_bulktransfer bulk;
  650. unsigned int tmo, len1, pipe;
  651. int len2;
  652. unsigned char *tbuf;
  653. int i, j, ret;
  654. if (copy_from_user(&bulk, arg, sizeof(bulk)))
  655. return -EFAULT;
  656. ret = findintfep(ps->dev, bulk.ep);
  657. if (ret < 0)
  658. return ret;
  659. ret = checkintf(ps, ret);
  660. if (ret)
  661. return ret;
  662. if (bulk.ep & USB_DIR_IN)
  663. pipe = usb_rcvbulkpipe(dev, bulk.ep & 0x7f);
  664. else
  665. pipe = usb_sndbulkpipe(dev, bulk.ep & 0x7f);
  666. if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN)))
  667. return -EINVAL;
  668. len1 = bulk.len;
  669. if (len1 > MAX_USBFS_BUFFER_SIZE)
  670. return -EINVAL;
  671. if (!(tbuf = kmalloc(len1, GFP_KERNEL)))
  672. return -ENOMEM;
  673. tmo = bulk.timeout;
  674. if (bulk.ep & 0x80) {
  675. if (len1 && !access_ok(VERIFY_WRITE, bulk.data, len1)) {
  676. kfree(tbuf);
  677. return -EINVAL;
  678. }
  679. snoop(&dev->dev, "bulk read: len=0x%02x timeout=%04d\n",
  680. bulk.len, bulk.timeout);
  681. usb_unlock_device(dev);
  682. i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
  683. usb_lock_device(dev);
  684. if (!i && len2) {
  685. if (usbfs_snoop) {
  686. dev_info(&dev->dev, "bulk read: data ");
  687. for (j = 0; j < len2; ++j)
  688. printk("%02x ", (u8)(tbuf)[j]);
  689. printk("\n");
  690. }
  691. if (copy_to_user(bulk.data, tbuf, len2)) {
  692. kfree(tbuf);
  693. return -EFAULT;
  694. }
  695. }
  696. } else {
  697. if (len1) {
  698. if (copy_from_user(tbuf, bulk.data, len1)) {
  699. kfree(tbuf);
  700. return -EFAULT;
  701. }
  702. }
  703. snoop(&dev->dev, "bulk write: len=0x%02x timeout=%04d\n",
  704. bulk.len, bulk.timeout);
  705. if (usbfs_snoop) {
  706. dev_info(&dev->dev, "bulk write: data: ");
  707. for (j = 0; j < len1; ++j)
  708. printk("%02x ", (unsigned char)(tbuf)[j]);
  709. printk("\n");
  710. }
  711. usb_unlock_device(dev);
  712. i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
  713. usb_lock_device(dev);
  714. }
  715. kfree(tbuf);
  716. if (i < 0)
  717. return i;
  718. return len2;
  719. }
  720. static int proc_resetep(struct dev_state *ps, void __user *arg)
  721. {
  722. unsigned int ep;
  723. int ret;
  724. if (get_user(ep, (unsigned int __user *)arg))
  725. return -EFAULT;
  726. ret = findintfep(ps->dev, ep);
  727. if (ret < 0)
  728. return ret;
  729. ret = checkintf(ps, ret);
  730. if (ret)
  731. return ret;
  732. usb_settoggle(ps->dev, ep & 0xf, !(ep & USB_DIR_IN), 0);
  733. return 0;
  734. }
  735. static int proc_clearhalt(struct dev_state *ps, void __user *arg)
  736. {
  737. unsigned int ep;
  738. int pipe;
  739. int ret;
  740. if (get_user(ep, (unsigned int __user *)arg))
  741. return -EFAULT;
  742. ret = findintfep(ps->dev, ep);
  743. if (ret < 0)
  744. return ret;
  745. ret = checkintf(ps, ret);
  746. if (ret)
  747. return ret;
  748. if (ep & USB_DIR_IN)
  749. pipe = usb_rcvbulkpipe(ps->dev, ep & 0x7f);
  750. else
  751. pipe = usb_sndbulkpipe(ps->dev, ep & 0x7f);
  752. return usb_clear_halt(ps->dev, pipe);
  753. }
  754. static int proc_getdriver(struct dev_state *ps, void __user *arg)
  755. {
  756. struct usbdevfs_getdriver gd;
  757. struct usb_interface *intf;
  758. int ret;
  759. if (copy_from_user(&gd, arg, sizeof(gd)))
  760. return -EFAULT;
  761. intf = usb_ifnum_to_if(ps->dev, gd.interface);
  762. if (!intf || !intf->dev.driver)
  763. ret = -ENODATA;
  764. else {
  765. strncpy(gd.driver, intf->dev.driver->name,
  766. sizeof(gd.driver));
  767. ret = (copy_to_user(arg, &gd, sizeof(gd)) ? -EFAULT : 0);
  768. }
  769. return ret;
  770. }
  771. static int proc_connectinfo(struct dev_state *ps, void __user *arg)
  772. {
  773. struct usbdevfs_connectinfo ci;
  774. ci.devnum = ps->dev->devnum;
  775. ci.slow = ps->dev->speed == USB_SPEED_LOW;
  776. if (copy_to_user(arg, &ci, sizeof(ci)))
  777. return -EFAULT;
  778. return 0;
  779. }
  780. static int proc_resetdevice(struct dev_state *ps)
  781. {
  782. return usb_reset_device(ps->dev);
  783. }
  784. static int proc_setintf(struct dev_state *ps, void __user *arg)
  785. {
  786. struct usbdevfs_setinterface setintf;
  787. int ret;
  788. if (copy_from_user(&setintf, arg, sizeof(setintf)))
  789. return -EFAULT;
  790. if ((ret = checkintf(ps, setintf.interface)))
  791. return ret;
  792. return usb_set_interface(ps->dev, setintf.interface,
  793. setintf.altsetting);
  794. }
  795. static int proc_setconfig(struct dev_state *ps, void __user *arg)
  796. {
  797. int u;
  798. int status = 0;
  799. struct usb_host_config *actconfig;
  800. if (get_user(u, (int __user *)arg))
  801. return -EFAULT;
  802. actconfig = ps->dev->actconfig;
  803. /* Don't touch the device if any interfaces are claimed.
  804. * It could interfere with other drivers' operations, and if
  805. * an interface is claimed by usbfs it could easily deadlock.
  806. */
  807. if (actconfig) {
  808. int i;
  809. for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
  810. if (usb_interface_claimed(actconfig->interface[i])) {
  811. dev_warn(&ps->dev->dev,
  812. "usbfs: interface %d claimed by %s "
  813. "while '%s' sets config #%d\n",
  814. actconfig->interface[i]
  815. ->cur_altsetting
  816. ->desc.bInterfaceNumber,
  817. actconfig->interface[i]
  818. ->dev.driver->name,
  819. current->comm, u);
  820. status = -EBUSY;
  821. break;
  822. }
  823. }
  824. }
  825. /* SET_CONFIGURATION is often abused as a "cheap" driver reset,
  826. * so avoid usb_set_configuration()'s kick to sysfs
  827. */
  828. if (status == 0) {
  829. if (actconfig && actconfig->desc.bConfigurationValue == u)
  830. status = usb_reset_configuration(ps->dev);
  831. else
  832. status = usb_set_configuration(ps->dev, u);
  833. }
  834. return status;
  835. }
  836. static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
  837. struct usbdevfs_iso_packet_desc __user *iso_frame_desc,
  838. void __user *arg)
  839. {
  840. struct usbdevfs_iso_packet_desc *isopkt = NULL;
  841. struct usb_host_endpoint *ep;
  842. struct async *as;
  843. struct usb_ctrlrequest *dr = NULL;
  844. unsigned int u, totlen, isofrmlen;
  845. int ret, ifnum = -1;
  846. int is_in;
  847. if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
  848. USBDEVFS_URB_SHORT_NOT_OK |
  849. USBDEVFS_URB_NO_FSBR |
  850. USBDEVFS_URB_ZERO_PACKET |
  851. USBDEVFS_URB_NO_INTERRUPT))
  852. return -EINVAL;
  853. if (!uurb->buffer)
  854. return -EINVAL;
  855. if (uurb->signr != 0 && (uurb->signr < SIGRTMIN ||
  856. uurb->signr > SIGRTMAX))
  857. return -EINVAL;
  858. if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
  859. (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
  860. ifnum = findintfep(ps->dev, uurb->endpoint);
  861. if (ifnum < 0)
  862. return ifnum;
  863. ret = checkintf(ps, ifnum);
  864. if (ret)
  865. return ret;
  866. }
  867. if ((uurb->endpoint & USB_ENDPOINT_DIR_MASK) != 0) {
  868. is_in = 1;
  869. ep = ps->dev->ep_in[uurb->endpoint & USB_ENDPOINT_NUMBER_MASK];
  870. } else {
  871. is_in = 0;
  872. ep = ps->dev->ep_out[uurb->endpoint & USB_ENDPOINT_NUMBER_MASK];
  873. }
  874. if (!ep)
  875. return -ENOENT;
  876. switch(uurb->type) {
  877. case USBDEVFS_URB_TYPE_CONTROL:
  878. if (!usb_endpoint_xfer_control(&ep->desc))
  879. return -EINVAL;
  880. /* min 8 byte setup packet,
  881. * max 8 byte setup plus an arbitrary data stage */
  882. if (uurb->buffer_length < 8 ||
  883. uurb->buffer_length > (8 + MAX_USBFS_BUFFER_SIZE))
  884. return -EINVAL;
  885. dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
  886. if (!dr)
  887. return -ENOMEM;
  888. if (copy_from_user(dr, uurb->buffer, 8)) {
  889. kfree(dr);
  890. return -EFAULT;
  891. }
  892. if (uurb->buffer_length < (le16_to_cpup(&dr->wLength) + 8)) {
  893. kfree(dr);
  894. return -EINVAL;
  895. }
  896. ret = check_ctrlrecip(ps, dr->bRequestType,
  897. le16_to_cpup(&dr->wIndex));
  898. if (ret) {
  899. kfree(dr);
  900. return ret;
  901. }
  902. uurb->number_of_packets = 0;
  903. uurb->buffer_length = le16_to_cpup(&dr->wLength);
  904. uurb->buffer += 8;
  905. if ((dr->bRequestType & USB_DIR_IN) && uurb->buffer_length) {
  906. is_in = 1;
  907. uurb->endpoint |= USB_DIR_IN;
  908. } else {
  909. is_in = 0;
  910. uurb->endpoint &= ~USB_DIR_IN;
  911. }
  912. if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
  913. uurb->buffer, uurb->buffer_length)) {
  914. kfree(dr);
  915. return -EFAULT;
  916. }
  917. snoop(&ps->dev->dev, "control urb: bRequest=%02x "
  918. "bRrequestType=%02x wValue=%04x "
  919. "wIndex=%04x wLength=%04x\n",
  920. dr->bRequest, dr->bRequestType,
  921. __le16_to_cpup(&dr->wValue),
  922. __le16_to_cpup(&dr->wIndex),
  923. __le16_to_cpup(&dr->wLength));
  924. break;
  925. case USBDEVFS_URB_TYPE_BULK:
  926. switch (usb_endpoint_type(&ep->desc)) {
  927. case USB_ENDPOINT_XFER_CONTROL:
  928. case USB_ENDPOINT_XFER_ISOC:
  929. return -EINVAL;
  930. /* allow single-shot interrupt transfers, at bogus rates */
  931. }
  932. uurb->number_of_packets = 0;
  933. if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
  934. return -EINVAL;
  935. if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
  936. uurb->buffer, uurb->buffer_length))
  937. return -EFAULT;
  938. snoop(&ps->dev->dev, "bulk urb\n");
  939. break;
  940. case USBDEVFS_URB_TYPE_ISO:
  941. /* arbitrary limit */
  942. if (uurb->number_of_packets < 1 ||
  943. uurb->number_of_packets > 128)
  944. return -EINVAL;
  945. if (!usb_endpoint_xfer_isoc(&ep->desc))
  946. return -EINVAL;
  947. isofrmlen = sizeof(struct usbdevfs_iso_packet_desc) *
  948. uurb->number_of_packets;
  949. if (!(isopkt = kmalloc(isofrmlen, GFP_KERNEL)))
  950. return -ENOMEM;
  951. if (copy_from_user(isopkt, iso_frame_desc, isofrmlen)) {
  952. kfree(isopkt);
  953. return -EFAULT;
  954. }
  955. for (totlen = u = 0; u < uurb->number_of_packets; u++) {
  956. /* arbitrary limit,
  957. * sufficient for USB 2.0 high-bandwidth iso */
  958. if (isopkt[u].length > 8192) {
  959. kfree(isopkt);
  960. return -EINVAL;
  961. }
  962. totlen += isopkt[u].length;
  963. }
  964. if (totlen > 32768) {
  965. kfree(isopkt);
  966. return -EINVAL;
  967. }
  968. uurb->buffer_length = totlen;
  969. snoop(&ps->dev->dev, "iso urb\n");
  970. break;
  971. case USBDEVFS_URB_TYPE_INTERRUPT:
  972. uurb->number_of_packets = 0;
  973. if (!usb_endpoint_xfer_int(&ep->desc))
  974. return -EINVAL;
  975. if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
  976. return -EINVAL;
  977. if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
  978. uurb->buffer, uurb->buffer_length))
  979. return -EFAULT;
  980. snoop(&ps->dev->dev, "interrupt urb\n");
  981. break;
  982. default:
  983. return -EINVAL;
  984. }
  985. as = alloc_async(uurb->number_of_packets);
  986. if (!as) {
  987. kfree(isopkt);
  988. kfree(dr);
  989. return -ENOMEM;
  990. }
  991. as->urb->transfer_buffer = kmalloc(uurb->buffer_length, GFP_KERNEL);
  992. if (!as->urb->transfer_buffer) {
  993. kfree(isopkt);
  994. kfree(dr);
  995. free_async(as);
  996. return -ENOMEM;
  997. }
  998. as->urb->dev = ps->dev;
  999. as->urb->pipe = (uurb->type << 30) |
  1000. __create_pipe(ps->dev, uurb->endpoint & 0xf) |
  1001. (uurb->endpoint & USB_DIR_IN);
  1002. /* This tedious sequence is necessary because the URB_* flags
  1003. * are internal to the kernel and subject to change, whereas
  1004. * the USBDEVFS_URB_* flags are a user API and must not be changed.
  1005. */
  1006. u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
  1007. if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
  1008. u |= URB_ISO_ASAP;
  1009. if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
  1010. u |= URB_SHORT_NOT_OK;
  1011. if (uurb->flags & USBDEVFS_URB_NO_FSBR)
  1012. u |= URB_NO_FSBR;
  1013. if (uurb->flags & USBDEVFS_URB_ZERO_PACKET)
  1014. u |= URB_ZERO_PACKET;
  1015. if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
  1016. u |= URB_NO_INTERRUPT;
  1017. as->urb->transfer_flags = u;
  1018. as->urb->transfer_buffer_length = uurb->buffer_length;
  1019. as->urb->setup_packet = (unsigned char *)dr;
  1020. as->urb->start_frame = uurb->start_frame;
  1021. as->urb->number_of_packets = uurb->number_of_packets;
  1022. if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
  1023. ps->dev->speed == USB_SPEED_HIGH)
  1024. as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);
  1025. else
  1026. as->urb->interval = ep->desc.bInterval;
  1027. as->urb->context = as;
  1028. as->urb->complete = async_completed;
  1029. for (totlen = u = 0; u < uurb->number_of_packets; u++) {
  1030. as->urb->iso_frame_desc[u].offset = totlen;
  1031. as->urb->iso_frame_desc[u].length = isopkt[u].length;
  1032. totlen += isopkt[u].length;
  1033. }
  1034. kfree(isopkt);
  1035. as->ps = ps;
  1036. as->userurb = arg;
  1037. if (uurb->endpoint & USB_DIR_IN)
  1038. as->userbuffer = uurb->buffer;
  1039. else
  1040. as->userbuffer = NULL;
  1041. as->signr = uurb->signr;
  1042. as->ifnum = ifnum;
  1043. as->pid = get_pid(task_pid(current));
  1044. as->uid = current->uid;
  1045. as->euid = current->euid;
  1046. security_task_getsecid(current, &as->secid);
  1047. if (!is_in) {
  1048. if (copy_from_user(as->urb->transfer_buffer, uurb->buffer,
  1049. as->urb->transfer_buffer_length)) {
  1050. free_async(as);
  1051. return -EFAULT;
  1052. }
  1053. }
  1054. snoop_urb(as->urb, as->userurb);
  1055. async_newpending(as);
  1056. if ((ret = usb_submit_urb(as->urb, GFP_KERNEL))) {
  1057. dev_printk(KERN_DEBUG, &ps->dev->dev,
  1058. "usbfs: usb_submit_urb returned %d\n", ret);
  1059. async_removepending(as);
  1060. free_async(as);
  1061. return ret;
  1062. }
  1063. return 0;
  1064. }
  1065. static int proc_submiturb(struct dev_state *ps, void __user *arg)
  1066. {
  1067. struct usbdevfs_urb uurb;
  1068. if (copy_from_user(&uurb, arg, sizeof(uurb)))
  1069. return -EFAULT;
  1070. return proc_do_submiturb(ps, &uurb,
  1071. (((struct usbdevfs_urb __user *)arg)->iso_frame_desc),
  1072. arg);
  1073. }
  1074. static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
  1075. {
  1076. struct async *as;
  1077. as = async_getpending(ps, arg);
  1078. if (!as)
  1079. return -EINVAL;
  1080. usb_kill_urb(as->urb);
  1081. return 0;
  1082. }
  1083. static int processcompl(struct async *as, void __user * __user *arg)
  1084. {
  1085. struct urb *urb = as->urb;
  1086. struct usbdevfs_urb __user *userurb = as->userurb;
  1087. void __user *addr = as->userurb;
  1088. unsigned int i;
  1089. if (as->userbuffer)
  1090. if (copy_to_user(as->userbuffer, urb->transfer_buffer,
  1091. urb->transfer_buffer_length))
  1092. return -EFAULT;
  1093. if (put_user(as->status, &userurb->status))
  1094. return -EFAULT;
  1095. if (put_user(urb->actual_length, &userurb->actual_length))
  1096. return -EFAULT;
  1097. if (put_user(urb->error_count, &userurb->error_count))
  1098. return -EFAULT;
  1099. if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
  1100. for (i = 0; i < urb->number_of_packets; i++) {
  1101. if (put_user(urb->iso_frame_desc[i].actual_length,
  1102. &userurb->iso_frame_desc[i].actual_length))
  1103. return -EFAULT;
  1104. if (put_user(urb->iso_frame_desc[i].status,
  1105. &userurb->iso_frame_desc[i].status))
  1106. return -EFAULT;
  1107. }
  1108. }
  1109. free_async(as);
  1110. if (put_user(addr, (void __user * __user *)arg))
  1111. return -EFAULT;
  1112. return 0;
  1113. }
  1114. static struct async *reap_as(struct dev_state *ps)
  1115. {
  1116. DECLARE_WAITQUEUE(wait, current);
  1117. struct async *as = NULL;
  1118. struct usb_device *dev = ps->dev;
  1119. add_wait_queue(&ps->wait, &wait);
  1120. for (;;) {
  1121. __set_current_state(TASK_INTERRUPTIBLE);
  1122. as = async_getcompleted(ps);
  1123. if (as)
  1124. break;
  1125. if (signal_pending(current))
  1126. break;
  1127. usb_unlock_device(dev);
  1128. schedule();
  1129. usb_lock_device(dev);
  1130. }
  1131. remove_wait_queue(&ps->wait, &wait);
  1132. set_current_state(TASK_RUNNING);
  1133. return as;
  1134. }
  1135. static int proc_reapurb(struct dev_state *ps, void __user *arg)
  1136. {
  1137. struct async *as = reap_as(ps);
  1138. if (as)
  1139. return processcompl(as, (void __user * __user *)arg);
  1140. if (signal_pending(current))
  1141. return -EINTR;
  1142. return -EIO;
  1143. }
  1144. static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
  1145. {
  1146. struct async *as;
  1147. if (!(as = async_getcompleted(ps)))
  1148. return -EAGAIN;
  1149. return processcompl(as, (void __user * __user *)arg);
  1150. }
  1151. #ifdef CONFIG_COMPAT
  1152. static int get_urb32(struct usbdevfs_urb *kurb,
  1153. struct usbdevfs_urb32 __user *uurb)
  1154. {
  1155. __u32 uptr;
  1156. if (get_user(kurb->type, &uurb->type) ||
  1157. __get_user(kurb->endpoint, &uurb->endpoint) ||
  1158. __get_user(kurb->status, &uurb->status) ||
  1159. __get_user(kurb->flags, &uurb->flags) ||
  1160. __get_user(kurb->buffer_length, &uurb->buffer_length) ||
  1161. __get_user(kurb->actual_length, &uurb->actual_length) ||
  1162. __get_user(kurb->start_frame, &uurb->start_frame) ||
  1163. __get_user(kurb->number_of_packets, &uurb->number_of_packets) ||
  1164. __get_user(kurb->error_count, &uurb->error_count) ||
  1165. __get_user(kurb->signr, &uurb->signr))
  1166. return -EFAULT;
  1167. if (__get_user(uptr, &uurb->buffer))
  1168. return -EFAULT;
  1169. kurb->buffer = compat_ptr(uptr);
  1170. if (__get_user(uptr, &uurb->buffer))
  1171. return -EFAULT;
  1172. kurb->usercontext = compat_ptr(uptr);
  1173. return 0;
  1174. }
  1175. static int proc_submiturb_compat(struct dev_state *ps, void __user *arg)
  1176. {
  1177. struct usbdevfs_urb uurb;
  1178. if (get_urb32(&uurb, (struct usbdevfs_urb32 __user *)arg))
  1179. return -EFAULT;
  1180. return proc_do_submiturb(ps, &uurb,
  1181. ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc,
  1182. arg);
  1183. }
  1184. static int processcompl_compat(struct async *as, void __user * __user *arg)
  1185. {
  1186. struct urb *urb = as->urb;
  1187. struct usbdevfs_urb32 __user *userurb = as->userurb;
  1188. void __user *addr = as->userurb;
  1189. unsigned int i;
  1190. if (as->userbuffer)
  1191. if (copy_to_user(as->userbuffer, urb->transfer_buffer,
  1192. urb->transfer_buffer_length))
  1193. return -EFAULT;
  1194. if (put_user(as->status, &userurb->status))
  1195. return -EFAULT;
  1196. if (put_user(urb->actual_length, &userurb->actual_length))
  1197. return -EFAULT;
  1198. if (put_user(urb->error_count, &userurb->error_count))
  1199. return -EFAULT;
  1200. if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
  1201. for (i = 0; i < urb->number_of_packets; i++) {
  1202. if (put_user(urb->iso_frame_desc[i].actual_length,
  1203. &userurb->iso_frame_desc[i].actual_length))
  1204. return -EFAULT;
  1205. if (put_user(urb->iso_frame_desc[i].status,
  1206. &userurb->iso_frame_desc[i].status))
  1207. return -EFAULT;
  1208. }
  1209. }
  1210. free_async(as);
  1211. if (put_user(ptr_to_compat(addr), (u32 __user *)arg))
  1212. return -EFAULT;
  1213. return 0;
  1214. }
  1215. static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
  1216. {
  1217. struct async *as = reap_as(ps);
  1218. if (as)
  1219. return processcompl_compat(as, (void __user * __user *)arg);
  1220. if (signal_pending(current))
  1221. return -EINTR;
  1222. return -EIO;
  1223. }
  1224. static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
  1225. {
  1226. struct async *as;
  1227. if (!(as = async_getcompleted(ps)))
  1228. return -EAGAIN;
  1229. return processcompl_compat(as, (void __user * __user *)arg);
  1230. }
  1231. #endif
  1232. static int proc_disconnectsignal(struct dev_state *ps, void __user *arg)
  1233. {
  1234. struct usbdevfs_disconnectsignal ds;
  1235. if (copy_from_user(&ds, arg, sizeof(ds)))
  1236. return -EFAULT;
  1237. if (ds.signr != 0 && (ds.signr < SIGRTMIN || ds.signr > SIGRTMAX))
  1238. return -EINVAL;
  1239. ps->discsignr = ds.signr;
  1240. ps->disccontext = ds.context;
  1241. return 0;
  1242. }
  1243. static int proc_claiminterface(struct dev_state *ps, void __user *arg)
  1244. {
  1245. unsigned int ifnum;
  1246. if (get_user(ifnum, (unsigned int __user *)arg))
  1247. return -EFAULT;
  1248. return claimintf(ps, ifnum);
  1249. }
  1250. static int proc_releaseinterface(struct dev_state *ps, void __user *arg)
  1251. {
  1252. unsigned int ifnum;
  1253. int ret;
  1254. if (get_user(ifnum, (unsigned int __user *)arg))
  1255. return -EFAULT;
  1256. if ((ret = releaseintf(ps, ifnum)) < 0)
  1257. return ret;
  1258. destroy_async_on_interface (ps, ifnum);
  1259. return 0;
  1260. }
  1261. static int proc_ioctl(struct dev_state *ps, struct usbdevfs_ioctl *ctl)
  1262. {
  1263. int size;
  1264. void *buf = NULL;
  1265. int retval = 0;
  1266. struct usb_interface *intf = NULL;
  1267. struct usb_driver *driver = NULL;
  1268. /* alloc buffer */
  1269. if ((size = _IOC_SIZE(ctl->ioctl_code)) > 0) {
  1270. if ((buf = kmalloc(size, GFP_KERNEL)) == NULL)
  1271. return -ENOMEM;
  1272. if ((_IOC_DIR(ctl->ioctl_code) & _IOC_WRITE)) {
  1273. if (copy_from_user(buf, ctl->data, size)) {
  1274. kfree(buf);
  1275. return -EFAULT;
  1276. }
  1277. } else {
  1278. memset(buf, 0, size);
  1279. }
  1280. }
  1281. if (!connected(ps)) {
  1282. kfree(buf);
  1283. return -ENODEV;
  1284. }
  1285. if (ps->dev->state != USB_STATE_CONFIGURED)
  1286. retval = -EHOSTUNREACH;
  1287. else if (!(intf = usb_ifnum_to_if(ps->dev, ctl->ifno)))
  1288. retval = -EINVAL;
  1289. else switch (ctl->ioctl_code) {
  1290. /* disconnect kernel driver from interface */
  1291. case USBDEVFS_DISCONNECT:
  1292. if (intf->dev.driver) {
  1293. driver = to_usb_driver(intf->dev.driver);
  1294. dev_dbg(&intf->dev, "disconnect by usbfs\n");
  1295. usb_driver_release_interface(driver, intf);
  1296. } else
  1297. retval = -ENODATA;
  1298. break;
  1299. /* let kernel drivers try to (re)bind to the interface */
  1300. case USBDEVFS_CONNECT:
  1301. if (!intf->dev.driver)
  1302. retval = device_attach(&intf->dev);
  1303. else
  1304. retval = -EBUSY;
  1305. break;
  1306. /* talk directly to the interface's driver */
  1307. default:
  1308. if (intf->dev.driver)
  1309. driver = to_usb_driver(intf->dev.driver);
  1310. if (driver == NULL || driver->ioctl == NULL) {
  1311. retval = -ENOTTY;
  1312. } else {
  1313. retval = driver->ioctl(intf, ctl->ioctl_code, buf);
  1314. if (retval == -ENOIOCTLCMD)
  1315. retval = -ENOTTY;
  1316. }
  1317. }
  1318. /* cleanup and return */
  1319. if (retval >= 0
  1320. && (_IOC_DIR(ctl->ioctl_code) & _IOC_READ) != 0
  1321. && size > 0
  1322. && copy_to_user(ctl->data, buf, size) != 0)
  1323. retval = -EFAULT;
  1324. kfree(buf);
  1325. return retval;
  1326. }
  1327. static int proc_ioctl_default(struct dev_state *ps, void __user *arg)
  1328. {
  1329. struct usbdevfs_ioctl ctrl;
  1330. if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
  1331. return -EFAULT;
  1332. return proc_ioctl(ps, &ctrl);
  1333. }
  1334. #ifdef CONFIG_COMPAT
  1335. static int proc_ioctl_compat(struct dev_state *ps, compat_uptr_t arg)
  1336. {
  1337. struct usbdevfs_ioctl32 __user *uioc;
  1338. struct usbdevfs_ioctl ctrl;
  1339. u32 udata;
  1340. uioc = compat_ptr((long)arg);
  1341. if (get_user(ctrl.ifno, &uioc->ifno) ||
  1342. get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
  1343. __get_user(udata, &uioc->data))
  1344. return -EFAULT;
  1345. ctrl.data = compat_ptr(udata);
  1346. return proc_ioctl(ps, &ctrl);
  1347. }
  1348. #endif
  1349. /*
  1350. * NOTE: All requests here that have interface numbers as parameters
  1351. * are assuming that somehow the configuration has been prevented from
  1352. * changing. But there's no mechanism to ensure that...
  1353. */
  1354. static int usbdev_ioctl(struct inode *inode, struct file *file,
  1355. unsigned int cmd, unsigned long arg)
  1356. {
  1357. struct dev_state *ps = file->private_data;
  1358. struct usb_device *dev = ps->dev;
  1359. void __user *p = (void __user *)arg;
  1360. int ret = -ENOTTY;
  1361. if (!(file->f_mode & FMODE_WRITE))
  1362. return -EPERM;
  1363. usb_lock_device(dev);
  1364. if (!connected(ps)) {
  1365. usb_unlock_device(dev);
  1366. return -ENODEV;
  1367. }
  1368. switch (cmd) {
  1369. case USBDEVFS_CONTROL:
  1370. snoop(&dev->dev, "%s: CONTROL\n", __func__);
  1371. ret = proc_control(ps, p);
  1372. if (ret >= 0)
  1373. inode->i_mtime = CURRENT_TIME;
  1374. break;
  1375. case USBDEVFS_BULK:
  1376. snoop(&dev->dev, "%s: BULK\n", __func__);
  1377. ret = proc_bulk(ps, p);
  1378. if (ret >= 0)
  1379. inode->i_mtime = CURRENT_TIME;
  1380. break;
  1381. case USBDEVFS_RESETEP:
  1382. snoop(&dev->dev, "%s: RESETEP\n", __func__);
  1383. ret = proc_resetep(ps, p);
  1384. if (ret >= 0)
  1385. inode->i_mtime = CURRENT_TIME;
  1386. break;
  1387. case USBDEVFS_RESET:
  1388. snoop(&dev->dev, "%s: RESET\n", __func__);
  1389. ret = proc_resetdevice(ps);
  1390. break;
  1391. case USBDEVFS_CLEAR_HALT:
  1392. snoop(&dev->dev, "%s: CLEAR_HALT\n", __func__);
  1393. ret = proc_clearhalt(ps, p);
  1394. if (ret >= 0)
  1395. inode->i_mtime = CURRENT_TIME;
  1396. break;
  1397. case USBDEVFS_GETDRIVER:
  1398. snoop(&dev->dev, "%s: GETDRIVER\n", __func__);
  1399. ret = proc_getdriver(ps, p);
  1400. break;
  1401. case USBDEVFS_CONNECTINFO:
  1402. snoop(&dev->dev, "%s: CONNECTINFO\n", __func__);
  1403. ret = proc_connectinfo(ps, p);
  1404. break;
  1405. case USBDEVFS_SETINTERFACE:
  1406. snoop(&dev->dev, "%s: SETINTERFACE\n", __func__);
  1407. ret = proc_setintf(ps, p);
  1408. break;
  1409. case USBDEVFS_SETCONFIGURATION:
  1410. snoop(&dev->dev, "%s: SETCONFIGURATION\n", __func__);
  1411. ret = proc_setconfig(ps, p);
  1412. break;
  1413. case USBDEVFS_SUBMITURB:
  1414. snoop(&dev->dev, "%s: SUBMITURB\n", __func__);
  1415. ret = proc_submiturb(ps, p);
  1416. if (ret >= 0)
  1417. inode->i_mtime = CURRENT_TIME;
  1418. break;
  1419. #ifdef CONFIG_COMPAT
  1420. case USBDEVFS_SUBMITURB32:
  1421. snoop(&dev->dev, "%s: SUBMITURB32\n", __func__);
  1422. ret = proc_submiturb_compat(ps, p);
  1423. if (ret >= 0)
  1424. inode->i_mtime = CURRENT_TIME;
  1425. break;
  1426. case USBDEVFS_REAPURB32:
  1427. snoop(&dev->dev, "%s: REAPURB32\n", __func__);
  1428. ret = proc_reapurb_compat(ps, p);
  1429. break;
  1430. case USBDEVFS_REAPURBNDELAY32:
  1431. snoop(&dev->dev, "%s: REAPURBDELAY32\n", __func__);
  1432. ret = proc_reapurbnonblock_compat(ps, p);
  1433. break;
  1434. case USBDEVFS_IOCTL32:
  1435. snoop(&dev->dev, "%s: IOCTL\n", __func__);
  1436. ret = proc_ioctl_compat(ps, ptr_to_compat(p));
  1437. break;
  1438. #endif
  1439. case USBDEVFS_DISCARDURB:
  1440. snoop(&dev->dev, "%s: DISCARDURB\n", __func__);
  1441. ret = proc_unlinkurb(ps, p);
  1442. break;
  1443. case USBDEVFS_REAPURB:
  1444. snoop(&dev->dev, "%s: REAPURB\n", __func__);
  1445. ret = proc_reapurb(ps, p);
  1446. break;
  1447. case USBDEVFS_REAPURBNDELAY:
  1448. snoop(&dev->dev, "%s: REAPURBDELAY\n", __func__);
  1449. ret = proc_reapurbnonblock(ps, p);
  1450. break;
  1451. case USBDEVFS_DISCSIGNAL:
  1452. snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
  1453. ret = proc_disconnectsignal(ps, p);
  1454. break;
  1455. case USBDEVFS_CLAIMINTERFACE:
  1456. snoop(&dev->dev, "%s: CLAIMINTERFACE\n", __func__);
  1457. ret = proc_claiminterface(ps, p);
  1458. break;
  1459. case USBDEVFS_RELEASEINTERFACE:
  1460. snoop(&dev->dev, "%s: RELEASEINTERFACE\n", __func__);
  1461. ret = proc_releaseinterface(ps, p);
  1462. break;
  1463. case USBDEVFS_IOCTL:
  1464. snoop(&dev->dev, "%s: IOCTL\n", __func__);
  1465. ret = proc_ioctl_default(ps, p);
  1466. break;
  1467. }
  1468. usb_unlock_device(dev);
  1469. if (ret >= 0)
  1470. inode->i_atime = CURRENT_TIME;
  1471. return ret;
  1472. }
  1473. /* No kernel lock - fine */
  1474. static unsigned int usbdev_poll(struct file *file,
  1475. struct poll_table_struct *wait)
  1476. {
  1477. struct dev_state *ps = file->private_data;
  1478. unsigned int mask = 0;
  1479. poll_wait(file, &ps->wait, wait);
  1480. if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
  1481. mask |= POLLOUT | POLLWRNORM;
  1482. if (!connected(ps))
  1483. mask |= POLLERR | POLLHUP;
  1484. return mask;
  1485. }
  1486. const struct file_operations usbdev_file_operations = {
  1487. .owner = THIS_MODULE,
  1488. .llseek = usbdev_lseek,
  1489. .read = usbdev_read,
  1490. .poll = usbdev_poll,
  1491. .ioctl = usbdev_ioctl,
  1492. .open = usbdev_open,
  1493. .release = usbdev_release,
  1494. };
  1495. void usb_fs_classdev_common_remove(struct usb_device *udev)
  1496. {
  1497. struct dev_state *ps;
  1498. struct siginfo sinfo;
  1499. while (!list_empty(&udev->filelist)) {
  1500. ps = list_entry(udev->filelist.next, struct dev_state, list);
  1501. destroy_all_async(ps);
  1502. wake_up_all(&ps->wait);
  1503. list_del_init(&ps->list);
  1504. if (ps->discsignr) {
  1505. sinfo.si_signo = ps->discsignr;
  1506. sinfo.si_errno = EPIPE;
  1507. sinfo.si_code = SI_ASYNCIO;
  1508. sinfo.si_addr = ps->disccontext;
  1509. kill_pid_info_as_uid(ps->discsignr, &sinfo,
  1510. ps->disc_pid, ps->disc_uid,
  1511. ps->disc_euid, ps->secid);
  1512. }
  1513. }
  1514. }
  1515. #ifdef CONFIG_USB_DEVICE_CLASS
  1516. static struct class *usb_classdev_class;
  1517. static int usb_classdev_add(struct usb_device *dev)
  1518. {
  1519. int minor = ((dev->bus->busnum-1) * 128) + (dev->devnum-1);
  1520. dev->usb_classdev = device_create(usb_classdev_class, &dev->dev,
  1521. MKDEV(USB_DEVICE_MAJOR, minor),
  1522. "usbdev%d.%d", dev->bus->busnum, dev->devnum);
  1523. if (IS_ERR(dev->usb_classdev))
  1524. return PTR_ERR(dev->usb_classdev);
  1525. return 0;
  1526. }
  1527. static void usb_classdev_remove(struct usb_device *dev)
  1528. {
  1529. device_unregister(dev->usb_classdev);
  1530. usb_fs_classdev_common_remove(dev);
  1531. }
  1532. static int usb_classdev_notify(struct notifier_block *self,
  1533. unsigned long action, void *dev)
  1534. {
  1535. switch (action) {
  1536. case USB_DEVICE_ADD:
  1537. if (usb_classdev_add(dev))
  1538. return NOTIFY_BAD;
  1539. break;
  1540. case USB_DEVICE_REMOVE:
  1541. usb_classdev_remove(dev);
  1542. break;
  1543. }
  1544. return NOTIFY_OK;
  1545. }
  1546. static struct notifier_block usbdev_nb = {
  1547. .notifier_call = usb_classdev_notify,
  1548. };
  1549. #endif
  1550. static struct cdev usb_device_cdev;
  1551. int __init usb_devio_init(void)
  1552. {
  1553. int retval;
  1554. retval = register_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX,
  1555. "usb_device");
  1556. if (retval) {
  1557. err("unable to register minors for usb_device");
  1558. goto out;
  1559. }
  1560. cdev_init(&usb_device_cdev, &usbdev_file_operations);
  1561. retval = cdev_add(&usb_device_cdev, USB_DEVICE_DEV, USB_DEVICE_MAX);
  1562. if (retval) {
  1563. err("unable to get usb_device major %d", USB_DEVICE_MAJOR);
  1564. goto error_cdev;
  1565. }
  1566. #ifdef CONFIG_USB_DEVICE_CLASS
  1567. usb_classdev_class = class_create(THIS_MODULE, "usb_device");
  1568. if (IS_ERR(usb_classdev_class)) {
  1569. err("unable to register usb_device class");
  1570. retval = PTR_ERR(usb_classdev_class);
  1571. cdev_del(&usb_device_cdev);
  1572. usb_classdev_class = NULL;
  1573. goto out;
  1574. }
  1575. usb_register_notify(&usbdev_nb);
  1576. #endif
  1577. out:
  1578. return retval;
  1579. error_cdev:
  1580. unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
  1581. goto out;
  1582. }
  1583. void usb_devio_cleanup(void)
  1584. {
  1585. #ifdef CONFIG_USB_DEVICE_CLASS
  1586. usb_unregister_notify(&usbdev_nb);
  1587. class_destroy(usb_classdev_class);
  1588. #endif
  1589. cdev_del(&usb_device_cdev);
  1590. unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
  1591. }