devio.c 38 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473
  1. /*****************************************************************************/
  2. /*
  3. * devio.c -- User space communication with USB devices.
  4. *
  5. * Copyright (C) 1999-2000 Thomas Sailer (sailer@ife.ee.ethz.ch)
  6. *
  7. * This program is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License as published by
  9. * the Free Software Foundation; either version 2 of the License, or
  10. * (at your option) any later version.
  11. *
  12. * This program is distributed in the hope that it will be useful,
  13. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. * GNU General Public License for more details.
  16. *
  17. * You should have received a copy of the GNU General Public License
  18. * along with this program; if not, write to the Free Software
  19. * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20. *
  21. * $Id: devio.c,v 1.7 2000/02/01 17:28:48 fliegl Exp $
  22. *
  23. * This file implements the usbfs/x/y files, where
  24. * x is the bus number and y the device number.
  25. *
  26. * It allows user space programs/"drivers" to communicate directly
  27. * with USB devices without intervening kernel driver.
  28. *
  29. * Revision history
  30. * 22.12.1999 0.1 Initial release (split from proc_usb.c)
  31. * 04.01.2000 0.2 Turned into its own filesystem
  32. */
  33. /*****************************************************************************/
  34. #include <linux/fs.h>
  35. #include <linux/mm.h>
  36. #include <linux/slab.h>
  37. #include <linux/smp_lock.h>
  38. #include <linux/signal.h>
  39. #include <linux/poll.h>
  40. #include <linux/module.h>
  41. #include <linux/usb.h>
  42. #include <linux/usbdevice_fs.h>
  43. #include <asm/uaccess.h>
  44. #include <asm/byteorder.h>
  45. #include <linux/moduleparam.h>
  46. #include "hcd.h" /* for usbcore internals */
  47. #include "usb.h"
  48. struct async {
  49. struct list_head asynclist;
  50. struct dev_state *ps;
  51. struct task_struct *task;
  52. unsigned int signr;
  53. unsigned int ifnum;
  54. void __user *userbuffer;
  55. void __user *userurb;
  56. struct urb *urb;
  57. };
  58. static int usbfs_snoop = 0;
  59. module_param (usbfs_snoop, bool, S_IRUGO | S_IWUSR);
  60. MODULE_PARM_DESC (usbfs_snoop, "true to log all usbfs traffic");
  61. #define snoop(dev, format, arg...) \
  62. do { \
  63. if (usbfs_snoop) \
  64. dev_info( dev , format , ## arg); \
  65. } while (0)
  66. #define MAX_USBFS_BUFFER_SIZE 16384
  67. static inline int connected (struct usb_device *dev)
  68. {
  69. return dev->state != USB_STATE_NOTATTACHED;
  70. }
  71. static loff_t usbdev_lseek(struct file *file, loff_t offset, int orig)
  72. {
  73. loff_t ret;
  74. lock_kernel();
  75. switch (orig) {
  76. case 0:
  77. file->f_pos = offset;
  78. ret = file->f_pos;
  79. break;
  80. case 1:
  81. file->f_pos += offset;
  82. ret = file->f_pos;
  83. break;
  84. case 2:
  85. default:
  86. ret = -EINVAL;
  87. }
  88. unlock_kernel();
  89. return ret;
  90. }
  91. static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
  92. {
  93. struct dev_state *ps = (struct dev_state *)file->private_data;
  94. struct usb_device *dev = ps->dev;
  95. ssize_t ret = 0;
  96. unsigned len;
  97. loff_t pos;
  98. int i;
  99. pos = *ppos;
  100. usb_lock_device(dev);
  101. if (!connected(dev)) {
  102. ret = -ENODEV;
  103. goto err;
  104. } else if (pos < 0) {
  105. ret = -EINVAL;
  106. goto err;
  107. }
  108. if (pos < sizeof(struct usb_device_descriptor)) {
  109. struct usb_device_descriptor *desc = kmalloc(sizeof(*desc), GFP_KERNEL);
  110. if (!desc) {
  111. ret = -ENOMEM;
  112. goto err;
  113. }
  114. memcpy(desc, &dev->descriptor, sizeof(dev->descriptor));
  115. le16_to_cpus(&desc->bcdUSB);
  116. le16_to_cpus(&desc->idVendor);
  117. le16_to_cpus(&desc->idProduct);
  118. le16_to_cpus(&desc->bcdDevice);
  119. len = sizeof(struct usb_device_descriptor) - pos;
  120. if (len > nbytes)
  121. len = nbytes;
  122. if (copy_to_user(buf, ((char *)desc) + pos, len)) {
  123. kfree(desc);
  124. ret = -EFAULT;
  125. goto err;
  126. }
  127. kfree(desc);
  128. *ppos += len;
  129. buf += len;
  130. nbytes -= len;
  131. ret += len;
  132. }
  133. pos = sizeof(struct usb_device_descriptor);
  134. for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {
  135. struct usb_config_descriptor *config =
  136. (struct usb_config_descriptor *)dev->rawdescriptors[i];
  137. unsigned int length = le16_to_cpu(config->wTotalLength);
  138. if (*ppos < pos + length) {
  139. /* The descriptor may claim to be longer than it
  140. * really is. Here is the actual allocated length. */
  141. unsigned alloclen =
  142. le16_to_cpu(dev->config[i].desc.wTotalLength);
  143. len = length - (*ppos - pos);
  144. if (len > nbytes)
  145. len = nbytes;
  146. /* Simply don't write (skip over) unallocated parts */
  147. if (alloclen > (*ppos - pos)) {
  148. alloclen -= (*ppos - pos);
  149. if (copy_to_user(buf,
  150. dev->rawdescriptors[i] + (*ppos - pos),
  151. min(len, alloclen))) {
  152. ret = -EFAULT;
  153. goto err;
  154. }
  155. }
  156. *ppos += len;
  157. buf += len;
  158. nbytes -= len;
  159. ret += len;
  160. }
  161. pos += length;
  162. }
  163. err:
  164. usb_unlock_device(dev);
  165. return ret;
  166. }
  167. /*
  168. * async list handling
  169. */
  170. static struct async *alloc_async(unsigned int numisoframes)
  171. {
  172. unsigned int assize = sizeof(struct async) + numisoframes * sizeof(struct usb_iso_packet_descriptor);
  173. struct async *as = kmalloc(assize, GFP_KERNEL);
  174. if (!as)
  175. return NULL;
  176. memset(as, 0, assize);
  177. as->urb = usb_alloc_urb(numisoframes, GFP_KERNEL);
  178. if (!as->urb) {
  179. kfree(as);
  180. return NULL;
  181. }
  182. return as;
  183. }
  184. static void free_async(struct async *as)
  185. {
  186. kfree(as->urb->transfer_buffer);
  187. kfree(as->urb->setup_packet);
  188. usb_free_urb(as->urb);
  189. kfree(as);
  190. }
  191. static inline void async_newpending(struct async *as)
  192. {
  193. struct dev_state *ps = as->ps;
  194. unsigned long flags;
  195. spin_lock_irqsave(&ps->lock, flags);
  196. list_add_tail(&as->asynclist, &ps->async_pending);
  197. spin_unlock_irqrestore(&ps->lock, flags);
  198. }
  199. static inline void async_removepending(struct async *as)
  200. {
  201. struct dev_state *ps = as->ps;
  202. unsigned long flags;
  203. spin_lock_irqsave(&ps->lock, flags);
  204. list_del_init(&as->asynclist);
  205. spin_unlock_irqrestore(&ps->lock, flags);
  206. }
  207. static inline struct async *async_getcompleted(struct dev_state *ps)
  208. {
  209. unsigned long flags;
  210. struct async *as = NULL;
  211. spin_lock_irqsave(&ps->lock, flags);
  212. if (!list_empty(&ps->async_completed)) {
  213. as = list_entry(ps->async_completed.next, struct async, asynclist);
  214. list_del_init(&as->asynclist);
  215. }
  216. spin_unlock_irqrestore(&ps->lock, flags);
  217. return as;
  218. }
  219. static inline struct async *async_getpending(struct dev_state *ps, void __user *userurb)
  220. {
  221. unsigned long flags;
  222. struct async *as;
  223. spin_lock_irqsave(&ps->lock, flags);
  224. list_for_each_entry(as, &ps->async_pending, asynclist)
  225. if (as->userurb == userurb) {
  226. list_del_init(&as->asynclist);
  227. spin_unlock_irqrestore(&ps->lock, flags);
  228. return as;
  229. }
  230. spin_unlock_irqrestore(&ps->lock, flags);
  231. return NULL;
  232. }
  233. static void async_completed(struct urb *urb, struct pt_regs *regs)
  234. {
  235. struct async *as = (struct async *)urb->context;
  236. struct dev_state *ps = as->ps;
  237. struct siginfo sinfo;
  238. spin_lock(&ps->lock);
  239. list_move_tail(&as->asynclist, &ps->async_completed);
  240. spin_unlock(&ps->lock);
  241. if (as->signr) {
  242. sinfo.si_signo = as->signr;
  243. sinfo.si_errno = as->urb->status;
  244. sinfo.si_code = SI_ASYNCIO;
  245. sinfo.si_addr = as->userurb;
  246. send_sig_info(as->signr, &sinfo, as->task);
  247. }
  248. wake_up(&ps->wait);
  249. }
  250. static void destroy_async (struct dev_state *ps, struct list_head *list)
  251. {
  252. struct async *as;
  253. unsigned long flags;
  254. spin_lock_irqsave(&ps->lock, flags);
  255. while (!list_empty(list)) {
  256. as = list_entry(list->next, struct async, asynclist);
  257. list_del_init(&as->asynclist);
  258. /* drop the spinlock so the completion handler can run */
  259. spin_unlock_irqrestore(&ps->lock, flags);
  260. usb_kill_urb(as->urb);
  261. spin_lock_irqsave(&ps->lock, flags);
  262. }
  263. spin_unlock_irqrestore(&ps->lock, flags);
  264. as = async_getcompleted(ps);
  265. while (as) {
  266. free_async(as);
  267. as = async_getcompleted(ps);
  268. }
  269. }
  270. static void destroy_async_on_interface (struct dev_state *ps, unsigned int ifnum)
  271. {
  272. struct list_head *p, *q, hitlist;
  273. unsigned long flags;
  274. INIT_LIST_HEAD(&hitlist);
  275. spin_lock_irqsave(&ps->lock, flags);
  276. list_for_each_safe(p, q, &ps->async_pending)
  277. if (ifnum == list_entry(p, struct async, asynclist)->ifnum)
  278. list_move_tail(p, &hitlist);
  279. spin_unlock_irqrestore(&ps->lock, flags);
  280. destroy_async(ps, &hitlist);
  281. }
  282. static inline void destroy_all_async(struct dev_state *ps)
  283. {
  284. destroy_async(ps, &ps->async_pending);
  285. }
  286. /*
  287. * interface claims are made only at the request of user level code,
  288. * which can also release them (explicitly or by closing files).
  289. * they're also undone when devices disconnect.
  290. */
  291. static int driver_probe (struct usb_interface *intf,
  292. const struct usb_device_id *id)
  293. {
  294. return -ENODEV;
  295. }
  296. static void driver_disconnect(struct usb_interface *intf)
  297. {
  298. struct dev_state *ps = usb_get_intfdata (intf);
  299. unsigned int ifnum = intf->altsetting->desc.bInterfaceNumber;
  300. if (!ps)
  301. return;
  302. /* NOTE: this relies on usbcore having canceled and completed
  303. * all pending I/O requests; 2.6 does that.
  304. */
  305. if (likely(ifnum < 8*sizeof(ps->ifclaimed)))
  306. clear_bit(ifnum, &ps->ifclaimed);
  307. else
  308. warn("interface number %u out of range", ifnum);
  309. usb_set_intfdata (intf, NULL);
  310. /* force async requests to complete */
  311. destroy_async_on_interface(ps, ifnum);
  312. }
  313. struct usb_driver usbfs_driver = {
  314. .owner = THIS_MODULE,
  315. .name = "usbfs",
  316. .probe = driver_probe,
  317. .disconnect = driver_disconnect,
  318. };
  319. static int claimintf(struct dev_state *ps, unsigned int ifnum)
  320. {
  321. struct usb_device *dev = ps->dev;
  322. struct usb_interface *intf;
  323. int err;
  324. if (ifnum >= 8*sizeof(ps->ifclaimed))
  325. return -EINVAL;
  326. /* already claimed */
  327. if (test_bit(ifnum, &ps->ifclaimed))
  328. return 0;
  329. /* lock against other changes to driver bindings */
  330. down_write(&usb_bus_type.subsys.rwsem);
  331. intf = usb_ifnum_to_if(dev, ifnum);
  332. if (!intf)
  333. err = -ENOENT;
  334. else
  335. err = usb_driver_claim_interface(&usbfs_driver, intf, ps);
  336. up_write(&usb_bus_type.subsys.rwsem);
  337. if (err == 0)
  338. set_bit(ifnum, &ps->ifclaimed);
  339. return err;
  340. }
  341. static int releaseintf(struct dev_state *ps, unsigned int ifnum)
  342. {
  343. struct usb_device *dev;
  344. struct usb_interface *intf;
  345. int err;
  346. err = -EINVAL;
  347. if (ifnum >= 8*sizeof(ps->ifclaimed))
  348. return err;
  349. dev = ps->dev;
  350. /* lock against other changes to driver bindings */
  351. down_write(&usb_bus_type.subsys.rwsem);
  352. intf = usb_ifnum_to_if(dev, ifnum);
  353. if (!intf)
  354. err = -ENOENT;
  355. else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) {
  356. usb_driver_release_interface(&usbfs_driver, intf);
  357. err = 0;
  358. }
  359. up_write(&usb_bus_type.subsys.rwsem);
  360. return err;
  361. }
  362. static int checkintf(struct dev_state *ps, unsigned int ifnum)
  363. {
  364. if (ps->dev->state != USB_STATE_CONFIGURED)
  365. return -EHOSTUNREACH;
  366. if (ifnum >= 8*sizeof(ps->ifclaimed))
  367. return -EINVAL;
  368. if (test_bit(ifnum, &ps->ifclaimed))
  369. return 0;
  370. /* if not yet claimed, claim it for the driver */
  371. dev_warn(&ps->dev->dev, "usbfs: process %d (%s) did not claim interface %u before use\n",
  372. current->pid, current->comm, ifnum);
  373. return claimintf(ps, ifnum);
  374. }
  375. static int findintfep(struct usb_device *dev, unsigned int ep)
  376. {
  377. unsigned int i, j, e;
  378. struct usb_interface *intf;
  379. struct usb_host_interface *alts;
  380. struct usb_endpoint_descriptor *endpt;
  381. if (ep & ~(USB_DIR_IN|0xf))
  382. return -EINVAL;
  383. if (!dev->actconfig)
  384. return -ESRCH;
  385. for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
  386. intf = dev->actconfig->interface[i];
  387. for (j = 0; j < intf->num_altsetting; j++) {
  388. alts = &intf->altsetting[j];
  389. for (e = 0; e < alts->desc.bNumEndpoints; e++) {
  390. endpt = &alts->endpoint[e].desc;
  391. if (endpt->bEndpointAddress == ep)
  392. return alts->desc.bInterfaceNumber;
  393. }
  394. }
  395. }
  396. return -ENOENT;
  397. }
  398. static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype, unsigned int index)
  399. {
  400. int ret = 0;
  401. if (ps->dev->state != USB_STATE_CONFIGURED)
  402. return -EHOSTUNREACH;
  403. if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
  404. return 0;
  405. index &= 0xff;
  406. switch (requesttype & USB_RECIP_MASK) {
  407. case USB_RECIP_ENDPOINT:
  408. if ((ret = findintfep(ps->dev, index)) >= 0)
  409. ret = checkintf(ps, ret);
  410. break;
  411. case USB_RECIP_INTERFACE:
  412. ret = checkintf(ps, index);
  413. break;
  414. }
  415. return ret;
  416. }
  417. /*
  418. * file operations
  419. */
  420. static int usbdev_open(struct inode *inode, struct file *file)
  421. {
  422. struct usb_device *dev;
  423. struct dev_state *ps;
  424. int ret;
  425. /*
  426. * no locking necessary here, as chrdev_open has the kernel lock
  427. * (still acquire the kernel lock for safety)
  428. */
  429. ret = -ENOMEM;
  430. if (!(ps = kmalloc(sizeof(struct dev_state), GFP_KERNEL)))
  431. goto out_nolock;
  432. lock_kernel();
  433. ret = -ENOENT;
  434. dev = usb_get_dev(inode->u.generic_ip);
  435. if (!dev) {
  436. kfree(ps);
  437. goto out;
  438. }
  439. ret = 0;
  440. ps->dev = dev;
  441. ps->file = file;
  442. spin_lock_init(&ps->lock);
  443. INIT_LIST_HEAD(&ps->async_pending);
  444. INIT_LIST_HEAD(&ps->async_completed);
  445. init_waitqueue_head(&ps->wait);
  446. ps->discsignr = 0;
  447. ps->disctask = current;
  448. ps->disccontext = NULL;
  449. ps->ifclaimed = 0;
  450. wmb();
  451. list_add_tail(&ps->list, &dev->filelist);
  452. file->private_data = ps;
  453. out:
  454. unlock_kernel();
  455. out_nolock:
  456. return ret;
  457. }
  458. static int usbdev_release(struct inode *inode, struct file *file)
  459. {
  460. struct dev_state *ps = (struct dev_state *)file->private_data;
  461. struct usb_device *dev = ps->dev;
  462. unsigned int ifnum;
  463. usb_lock_device(dev);
  464. list_del_init(&ps->list);
  465. for (ifnum = 0; ps->ifclaimed && ifnum < 8*sizeof(ps->ifclaimed);
  466. ifnum++) {
  467. if (test_bit(ifnum, &ps->ifclaimed))
  468. releaseintf(ps, ifnum);
  469. }
  470. destroy_all_async(ps);
  471. usb_unlock_device(dev);
  472. usb_put_dev(dev);
  473. ps->dev = NULL;
  474. kfree(ps);
  475. return 0;
  476. }
  477. static int proc_control(struct dev_state *ps, void __user *arg)
  478. {
  479. struct usb_device *dev = ps->dev;
  480. struct usbdevfs_ctrltransfer ctrl;
  481. unsigned int tmo;
  482. unsigned char *tbuf;
  483. int i, j, ret;
  484. if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
  485. return -EFAULT;
  486. if ((ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.wIndex)))
  487. return ret;
  488. if (ctrl.wLength > PAGE_SIZE)
  489. return -EINVAL;
  490. if (!(tbuf = (unsigned char *)__get_free_page(GFP_KERNEL)))
  491. return -ENOMEM;
  492. tmo = ctrl.timeout;
  493. if (ctrl.bRequestType & 0x80) {
  494. if (ctrl.wLength && !access_ok(VERIFY_WRITE, ctrl.data, ctrl.wLength)) {
  495. free_page((unsigned long)tbuf);
  496. return -EINVAL;
  497. }
  498. snoop(&dev->dev, "control read: bRequest=%02x bRrequestType=%02x wValue=%04x wIndex=%04x\n",
  499. ctrl.bRequest, ctrl.bRequestType, ctrl.wValue, ctrl.wIndex);
  500. usb_unlock_device(dev);
  501. i = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), ctrl.bRequest, ctrl.bRequestType,
  502. ctrl.wValue, ctrl.wIndex, tbuf, ctrl.wLength, tmo);
  503. usb_lock_device(dev);
  504. if ((i > 0) && ctrl.wLength) {
  505. if (usbfs_snoop) {
  506. dev_info(&dev->dev, "control read: data ");
  507. for (j = 0; j < ctrl.wLength; ++j)
  508. printk ("%02x ", (unsigned char)(tbuf)[j]);
  509. printk("\n");
  510. }
  511. if (copy_to_user(ctrl.data, tbuf, ctrl.wLength)) {
  512. free_page((unsigned long)tbuf);
  513. return -EFAULT;
  514. }
  515. }
  516. } else {
  517. if (ctrl.wLength) {
  518. if (copy_from_user(tbuf, ctrl.data, ctrl.wLength)) {
  519. free_page((unsigned long)tbuf);
  520. return -EFAULT;
  521. }
  522. }
  523. snoop(&dev->dev, "control write: bRequest=%02x bRrequestType=%02x wValue=%04x wIndex=%04x\n",
  524. ctrl.bRequest, ctrl.bRequestType, ctrl.wValue, ctrl.wIndex);
  525. if (usbfs_snoop) {
  526. dev_info(&dev->dev, "control write: data: ");
  527. for (j = 0; j < ctrl.wLength; ++j)
  528. printk ("%02x ", (unsigned char)(tbuf)[j]);
  529. printk("\n");
  530. }
  531. usb_unlock_device(dev);
  532. i = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ctrl.bRequest, ctrl.bRequestType,
  533. ctrl.wValue, ctrl.wIndex, tbuf, ctrl.wLength, tmo);
  534. usb_lock_device(dev);
  535. }
  536. free_page((unsigned long)tbuf);
  537. if (i<0 && i != -EPIPE) {
  538. dev_printk(KERN_DEBUG, &dev->dev, "usbfs: USBDEVFS_CONTROL "
  539. "failed cmd %s rqt %u rq %u len %u ret %d\n",
  540. current->comm, ctrl.bRequestType, ctrl.bRequest,
  541. ctrl.wLength, i);
  542. }
  543. return i;
  544. }
  545. static int proc_bulk(struct dev_state *ps, void __user *arg)
  546. {
  547. struct usb_device *dev = ps->dev;
  548. struct usbdevfs_bulktransfer bulk;
  549. unsigned int tmo, len1, pipe;
  550. int len2;
  551. unsigned char *tbuf;
  552. int i, ret;
  553. if (copy_from_user(&bulk, arg, sizeof(bulk)))
  554. return -EFAULT;
  555. if ((ret = findintfep(ps->dev, bulk.ep)) < 0)
  556. return ret;
  557. if ((ret = checkintf(ps, ret)))
  558. return ret;
  559. if (bulk.ep & USB_DIR_IN)
  560. pipe = usb_rcvbulkpipe(dev, bulk.ep & 0x7f);
  561. else
  562. pipe = usb_sndbulkpipe(dev, bulk.ep & 0x7f);
  563. if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN)))
  564. return -EINVAL;
  565. len1 = bulk.len;
  566. if (len1 > MAX_USBFS_BUFFER_SIZE)
  567. return -EINVAL;
  568. if (!(tbuf = kmalloc(len1, GFP_KERNEL)))
  569. return -ENOMEM;
  570. tmo = bulk.timeout;
  571. if (bulk.ep & 0x80) {
  572. if (len1 && !access_ok(VERIFY_WRITE, bulk.data, len1)) {
  573. kfree(tbuf);
  574. return -EINVAL;
  575. }
  576. usb_unlock_device(dev);
  577. i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
  578. usb_lock_device(dev);
  579. if (!i && len2) {
  580. if (copy_to_user(bulk.data, tbuf, len2)) {
  581. kfree(tbuf);
  582. return -EFAULT;
  583. }
  584. }
  585. } else {
  586. if (len1) {
  587. if (copy_from_user(tbuf, bulk.data, len1)) {
  588. kfree(tbuf);
  589. return -EFAULT;
  590. }
  591. }
  592. usb_unlock_device(dev);
  593. i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
  594. usb_lock_device(dev);
  595. }
  596. kfree(tbuf);
  597. if (i < 0)
  598. return i;
  599. return len2;
  600. }
  601. static int proc_resetep(struct dev_state *ps, void __user *arg)
  602. {
  603. unsigned int ep;
  604. int ret;
  605. if (get_user(ep, (unsigned int __user *)arg))
  606. return -EFAULT;
  607. if ((ret = findintfep(ps->dev, ep)) < 0)
  608. return ret;
  609. if ((ret = checkintf(ps, ret)))
  610. return ret;
  611. usb_settoggle(ps->dev, ep & 0xf, !(ep & USB_DIR_IN), 0);
  612. return 0;
  613. }
  614. static int proc_clearhalt(struct dev_state *ps, void __user *arg)
  615. {
  616. unsigned int ep;
  617. int pipe;
  618. int ret;
  619. if (get_user(ep, (unsigned int __user *)arg))
  620. return -EFAULT;
  621. if ((ret = findintfep(ps->dev, ep)) < 0)
  622. return ret;
  623. if ((ret = checkintf(ps, ret)))
  624. return ret;
  625. if (ep & USB_DIR_IN)
  626. pipe = usb_rcvbulkpipe(ps->dev, ep & 0x7f);
  627. else
  628. pipe = usb_sndbulkpipe(ps->dev, ep & 0x7f);
  629. return usb_clear_halt(ps->dev, pipe);
  630. }
  631. static int proc_getdriver(struct dev_state *ps, void __user *arg)
  632. {
  633. struct usbdevfs_getdriver gd;
  634. struct usb_interface *intf;
  635. int ret;
  636. if (copy_from_user(&gd, arg, sizeof(gd)))
  637. return -EFAULT;
  638. down_read(&usb_bus_type.subsys.rwsem);
  639. intf = usb_ifnum_to_if(ps->dev, gd.interface);
  640. if (!intf || !intf->dev.driver)
  641. ret = -ENODATA;
  642. else {
  643. strncpy(gd.driver, intf->dev.driver->name,
  644. sizeof(gd.driver));
  645. ret = (copy_to_user(arg, &gd, sizeof(gd)) ? -EFAULT : 0);
  646. }
  647. up_read(&usb_bus_type.subsys.rwsem);
  648. return ret;
  649. }
  650. static int proc_connectinfo(struct dev_state *ps, void __user *arg)
  651. {
  652. struct usbdevfs_connectinfo ci;
  653. ci.devnum = ps->dev->devnum;
  654. ci.slow = ps->dev->speed == USB_SPEED_LOW;
  655. if (copy_to_user(arg, &ci, sizeof(ci)))
  656. return -EFAULT;
  657. return 0;
  658. }
  659. static int proc_resetdevice(struct dev_state *ps)
  660. {
  661. return usb_reset_device(ps->dev);
  662. }
  663. static int proc_setintf(struct dev_state *ps, void __user *arg)
  664. {
  665. struct usbdevfs_setinterface setintf;
  666. int ret;
  667. if (copy_from_user(&setintf, arg, sizeof(setintf)))
  668. return -EFAULT;
  669. if ((ret = checkintf(ps, setintf.interface)))
  670. return ret;
  671. return usb_set_interface(ps->dev, setintf.interface,
  672. setintf.altsetting);
  673. }
  674. static int proc_setconfig(struct dev_state *ps, void __user *arg)
  675. {
  676. unsigned int u;
  677. int status = 0;
  678. struct usb_host_config *actconfig;
  679. if (get_user(u, (unsigned int __user *)arg))
  680. return -EFAULT;
  681. actconfig = ps->dev->actconfig;
  682. /* Don't touch the device if any interfaces are claimed.
  683. * It could interfere with other drivers' operations, and if
  684. * an interface is claimed by usbfs it could easily deadlock.
  685. */
  686. if (actconfig) {
  687. int i;
  688. for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
  689. if (usb_interface_claimed(actconfig->interface[i])) {
  690. dev_warn (&ps->dev->dev,
  691. "usbfs: interface %d claimed by %s "
  692. "while '%s' sets config #%d\n",
  693. actconfig->interface[i]
  694. ->cur_altsetting
  695. ->desc.bInterfaceNumber,
  696. actconfig->interface[i]
  697. ->dev.driver->name,
  698. current->comm, u);
  699. status = -EBUSY;
  700. break;
  701. }
  702. }
  703. }
  704. /* SET_CONFIGURATION is often abused as a "cheap" driver reset,
  705. * so avoid usb_set_configuration()'s kick to sysfs
  706. */
  707. if (status == 0) {
  708. if (actconfig && actconfig->desc.bConfigurationValue == u)
  709. status = usb_reset_configuration(ps->dev);
  710. else
  711. status = usb_set_configuration(ps->dev, u);
  712. }
  713. return status;
  714. }
  715. static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
  716. struct usbdevfs_iso_packet_desc __user *iso_frame_desc,
  717. void __user *arg)
  718. {
  719. struct usbdevfs_iso_packet_desc *isopkt = NULL;
  720. struct usb_host_endpoint *ep;
  721. struct async *as;
  722. struct usb_ctrlrequest *dr = NULL;
  723. unsigned int u, totlen, isofrmlen;
  724. int ret, interval = 0, ifnum = -1;
  725. if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP|USBDEVFS_URB_SHORT_NOT_OK|
  726. URB_NO_FSBR|URB_ZERO_PACKET))
  727. return -EINVAL;
  728. if (!uurb->buffer)
  729. return -EINVAL;
  730. if (uurb->signr != 0 && (uurb->signr < SIGRTMIN || uurb->signr > SIGRTMAX))
  731. return -EINVAL;
  732. if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL && (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
  733. if ((ifnum = findintfep(ps->dev, uurb->endpoint)) < 0)
  734. return ifnum;
  735. if ((ret = checkintf(ps, ifnum)))
  736. return ret;
  737. }
  738. if ((uurb->endpoint & USB_ENDPOINT_DIR_MASK) != 0)
  739. ep = ps->dev->ep_in [uurb->endpoint & USB_ENDPOINT_NUMBER_MASK];
  740. else
  741. ep = ps->dev->ep_out [uurb->endpoint & USB_ENDPOINT_NUMBER_MASK];
  742. if (!ep)
  743. return -ENOENT;
  744. switch(uurb->type) {
  745. case USBDEVFS_URB_TYPE_CONTROL:
  746. if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
  747. != USB_ENDPOINT_XFER_CONTROL)
  748. return -EINVAL;
  749. /* min 8 byte setup packet, max arbitrary */
  750. if (uurb->buffer_length < 8 || uurb->buffer_length > PAGE_SIZE)
  751. return -EINVAL;
  752. if (!(dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL)))
  753. return -ENOMEM;
  754. if (copy_from_user(dr, uurb->buffer, 8)) {
  755. kfree(dr);
  756. return -EFAULT;
  757. }
  758. if (uurb->buffer_length < (le16_to_cpup(&dr->wLength) + 8)) {
  759. kfree(dr);
  760. return -EINVAL;
  761. }
  762. if ((ret = check_ctrlrecip(ps, dr->bRequestType, le16_to_cpup(&dr->wIndex)))) {
  763. kfree(dr);
  764. return ret;
  765. }
  766. uurb->endpoint = (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) | (dr->bRequestType & USB_ENDPOINT_DIR_MASK);
  767. uurb->number_of_packets = 0;
  768. uurb->buffer_length = le16_to_cpup(&dr->wLength);
  769. uurb->buffer += 8;
  770. if (!access_ok((uurb->endpoint & USB_DIR_IN) ? VERIFY_WRITE : VERIFY_READ, uurb->buffer, uurb->buffer_length)) {
  771. kfree(dr);
  772. return -EFAULT;
  773. }
  774. break;
  775. case USBDEVFS_URB_TYPE_BULK:
  776. switch (ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
  777. case USB_ENDPOINT_XFER_CONTROL:
  778. case USB_ENDPOINT_XFER_ISOC:
  779. return -EINVAL;
  780. /* allow single-shot interrupt transfers, at bogus rates */
  781. }
  782. uurb->number_of_packets = 0;
  783. if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
  784. return -EINVAL;
  785. if (!access_ok((uurb->endpoint & USB_DIR_IN) ? VERIFY_WRITE : VERIFY_READ, uurb->buffer, uurb->buffer_length))
  786. return -EFAULT;
  787. break;
  788. case USBDEVFS_URB_TYPE_ISO:
  789. /* arbitrary limit */
  790. if (uurb->number_of_packets < 1 || uurb->number_of_packets > 128)
  791. return -EINVAL;
  792. if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
  793. != USB_ENDPOINT_XFER_ISOC)
  794. return -EINVAL;
  795. interval = 1 << min (15, ep->desc.bInterval - 1);
  796. isofrmlen = sizeof(struct usbdevfs_iso_packet_desc) * uurb->number_of_packets;
  797. if (!(isopkt = kmalloc(isofrmlen, GFP_KERNEL)))
  798. return -ENOMEM;
  799. if (copy_from_user(isopkt, iso_frame_desc, isofrmlen)) {
  800. kfree(isopkt);
  801. return -EFAULT;
  802. }
  803. for (totlen = u = 0; u < uurb->number_of_packets; u++) {
  804. if (isopkt[u].length > 1023) {
  805. kfree(isopkt);
  806. return -EINVAL;
  807. }
  808. totlen += isopkt[u].length;
  809. }
  810. if (totlen > 32768) {
  811. kfree(isopkt);
  812. return -EINVAL;
  813. }
  814. uurb->buffer_length = totlen;
  815. break;
  816. case USBDEVFS_URB_TYPE_INTERRUPT:
  817. uurb->number_of_packets = 0;
  818. if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
  819. != USB_ENDPOINT_XFER_INT)
  820. return -EINVAL;
  821. if (ps->dev->speed == USB_SPEED_HIGH)
  822. interval = 1 << min (15, ep->desc.bInterval - 1);
  823. else
  824. interval = ep->desc.bInterval;
  825. if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
  826. return -EINVAL;
  827. if (!access_ok((uurb->endpoint & USB_DIR_IN) ? VERIFY_WRITE : VERIFY_READ, uurb->buffer, uurb->buffer_length))
  828. return -EFAULT;
  829. break;
  830. default:
  831. return -EINVAL;
  832. }
  833. if (!(as = alloc_async(uurb->number_of_packets))) {
  834. kfree(isopkt);
  835. kfree(dr);
  836. return -ENOMEM;
  837. }
  838. if (!(as->urb->transfer_buffer = kmalloc(uurb->buffer_length, GFP_KERNEL))) {
  839. kfree(isopkt);
  840. kfree(dr);
  841. free_async(as);
  842. return -ENOMEM;
  843. }
  844. as->urb->dev = ps->dev;
  845. as->urb->pipe = (uurb->type << 30) | __create_pipe(ps->dev, uurb->endpoint & 0xf) | (uurb->endpoint & USB_DIR_IN);
  846. as->urb->transfer_flags = uurb->flags;
  847. as->urb->transfer_buffer_length = uurb->buffer_length;
  848. as->urb->setup_packet = (unsigned char*)dr;
  849. as->urb->start_frame = uurb->start_frame;
  850. as->urb->number_of_packets = uurb->number_of_packets;
  851. as->urb->interval = interval;
  852. as->urb->context = as;
  853. as->urb->complete = async_completed;
  854. for (totlen = u = 0; u < uurb->number_of_packets; u++) {
  855. as->urb->iso_frame_desc[u].offset = totlen;
  856. as->urb->iso_frame_desc[u].length = isopkt[u].length;
  857. totlen += isopkt[u].length;
  858. }
  859. kfree(isopkt);
  860. as->ps = ps;
  861. as->userurb = arg;
  862. if (uurb->endpoint & USB_DIR_IN)
  863. as->userbuffer = uurb->buffer;
  864. else
  865. as->userbuffer = NULL;
  866. as->signr = uurb->signr;
  867. as->ifnum = ifnum;
  868. as->task = current;
  869. if (!(uurb->endpoint & USB_DIR_IN)) {
  870. if (copy_from_user(as->urb->transfer_buffer, uurb->buffer, as->urb->transfer_buffer_length)) {
  871. free_async(as);
  872. return -EFAULT;
  873. }
  874. }
  875. async_newpending(as);
  876. if ((ret = usb_submit_urb(as->urb, GFP_KERNEL))) {
  877. dev_printk(KERN_DEBUG, &ps->dev->dev, "usbfs: usb_submit_urb returned %d\n", ret);
  878. async_removepending(as);
  879. free_async(as);
  880. return ret;
  881. }
  882. return 0;
  883. }
  884. static int proc_submiturb(struct dev_state *ps, void __user *arg)
  885. {
  886. struct usbdevfs_urb uurb;
  887. if (copy_from_user(&uurb, arg, sizeof(uurb)))
  888. return -EFAULT;
  889. return proc_do_submiturb(ps, &uurb, (((struct usbdevfs_urb __user *)arg)->iso_frame_desc), arg);
  890. }
  891. static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
  892. {
  893. struct async *as;
  894. as = async_getpending(ps, arg);
  895. if (!as)
  896. return -EINVAL;
  897. usb_kill_urb(as->urb);
  898. return 0;
  899. }
  900. static int processcompl(struct async *as, void __user * __user *arg)
  901. {
  902. struct urb *urb = as->urb;
  903. struct usbdevfs_urb __user *userurb = as->userurb;
  904. void __user *addr = as->userurb;
  905. unsigned int i;
  906. if (as->userbuffer)
  907. if (copy_to_user(as->userbuffer, urb->transfer_buffer, urb->transfer_buffer_length))
  908. return -EFAULT;
  909. if (put_user(urb->status, &userurb->status))
  910. return -EFAULT;
  911. if (put_user(urb->actual_length, &userurb->actual_length))
  912. return -EFAULT;
  913. if (put_user(urb->error_count, &userurb->error_count))
  914. return -EFAULT;
  915. if (usb_pipeisoc(urb->pipe)) {
  916. for (i = 0; i < urb->number_of_packets; i++) {
  917. if (put_user(urb->iso_frame_desc[i].actual_length,
  918. &userurb->iso_frame_desc[i].actual_length))
  919. return -EFAULT;
  920. if (put_user(urb->iso_frame_desc[i].status,
  921. &userurb->iso_frame_desc[i].status))
  922. return -EFAULT;
  923. }
  924. }
  925. free_async(as);
  926. if (put_user(addr, (void __user * __user *)arg))
  927. return -EFAULT;
  928. return 0;
  929. }
  930. static struct async* reap_as(struct dev_state *ps)
  931. {
  932. DECLARE_WAITQUEUE(wait, current);
  933. struct async *as = NULL;
  934. struct usb_device *dev = ps->dev;
  935. add_wait_queue(&ps->wait, &wait);
  936. for (;;) {
  937. __set_current_state(TASK_INTERRUPTIBLE);
  938. if ((as = async_getcompleted(ps)))
  939. break;
  940. if (signal_pending(current))
  941. break;
  942. usb_unlock_device(dev);
  943. schedule();
  944. usb_lock_device(dev);
  945. }
  946. remove_wait_queue(&ps->wait, &wait);
  947. set_current_state(TASK_RUNNING);
  948. return as;
  949. }
  950. static int proc_reapurb(struct dev_state *ps, void __user *arg)
  951. {
  952. struct async *as = reap_as(ps);
  953. if (as)
  954. return processcompl(as, (void __user * __user *)arg);
  955. if (signal_pending(current))
  956. return -EINTR;
  957. return -EIO;
  958. }
  959. static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
  960. {
  961. struct async *as;
  962. if (!(as = async_getcompleted(ps)))
  963. return -EAGAIN;
  964. return processcompl(as, (void __user * __user *)arg);
  965. }
  966. #ifdef CONFIG_COMPAT
  967. static int get_urb32(struct usbdevfs_urb *kurb,
  968. struct usbdevfs_urb32 __user *uurb)
  969. {
  970. __u32 uptr;
  971. if (get_user(kurb->type, &uurb->type) ||
  972. __get_user(kurb->endpoint, &uurb->endpoint) ||
  973. __get_user(kurb->status, &uurb->status) ||
  974. __get_user(kurb->flags, &uurb->flags) ||
  975. __get_user(kurb->buffer_length, &uurb->buffer_length) ||
  976. __get_user(kurb->actual_length, &uurb->actual_length) ||
  977. __get_user(kurb->start_frame, &uurb->start_frame) ||
  978. __get_user(kurb->number_of_packets, &uurb->number_of_packets) ||
  979. __get_user(kurb->error_count, &uurb->error_count) ||
  980. __get_user(kurb->signr, &uurb->signr))
  981. return -EFAULT;
  982. if (__get_user(uptr, &uurb->buffer))
  983. return -EFAULT;
  984. kurb->buffer = compat_ptr(uptr);
  985. if (__get_user(uptr, &uurb->buffer))
  986. return -EFAULT;
  987. kurb->usercontext = compat_ptr(uptr);
  988. return 0;
  989. }
  990. static int proc_submiturb_compat(struct dev_state *ps, void __user *arg)
  991. {
  992. struct usbdevfs_urb uurb;
  993. if (get_urb32(&uurb,(struct usbdevfs_urb32 *)arg))
  994. return -EFAULT;
  995. return proc_do_submiturb(ps, &uurb, ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc, arg);
  996. }
  997. static int processcompl_compat(struct async *as, void __user * __user *arg)
  998. {
  999. struct urb *urb = as->urb;
  1000. struct usbdevfs_urb32 __user *userurb = as->userurb;
  1001. void __user *addr = as->userurb;
  1002. unsigned int i;
  1003. if (as->userbuffer)
  1004. if (copy_to_user(as->userbuffer, urb->transfer_buffer, urb->transfer_buffer_length))
  1005. return -EFAULT;
  1006. if (put_user(urb->status, &userurb->status))
  1007. return -EFAULT;
  1008. if (put_user(urb->actual_length, &userurb->actual_length))
  1009. return -EFAULT;
  1010. if (put_user(urb->error_count, &userurb->error_count))
  1011. return -EFAULT;
  1012. if (usb_pipeisoc(urb->pipe)) {
  1013. for (i = 0; i < urb->number_of_packets; i++) {
  1014. if (put_user(urb->iso_frame_desc[i].actual_length,
  1015. &userurb->iso_frame_desc[i].actual_length))
  1016. return -EFAULT;
  1017. if (put_user(urb->iso_frame_desc[i].status,
  1018. &userurb->iso_frame_desc[i].status))
  1019. return -EFAULT;
  1020. }
  1021. }
  1022. free_async(as);
  1023. if (put_user((u32)(u64)addr, (u32 __user *)arg))
  1024. return -EFAULT;
  1025. return 0;
  1026. }
  1027. static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
  1028. {
  1029. struct async *as = reap_as(ps);
  1030. if (as)
  1031. return processcompl_compat(as, (void __user * __user *)arg);
  1032. if (signal_pending(current))
  1033. return -EINTR;
  1034. return -EIO;
  1035. }
  1036. static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
  1037. {
  1038. struct async *as;
  1039. if (!(as = async_getcompleted(ps)))
  1040. return -EAGAIN;
  1041. return processcompl_compat(as, (void __user * __user *)arg);
  1042. }
  1043. #endif
  1044. static int proc_disconnectsignal(struct dev_state *ps, void __user *arg)
  1045. {
  1046. struct usbdevfs_disconnectsignal ds;
  1047. if (copy_from_user(&ds, arg, sizeof(ds)))
  1048. return -EFAULT;
  1049. if (ds.signr != 0 && (ds.signr < SIGRTMIN || ds.signr > SIGRTMAX))
  1050. return -EINVAL;
  1051. ps->discsignr = ds.signr;
  1052. ps->disccontext = ds.context;
  1053. return 0;
  1054. }
  1055. static int proc_claiminterface(struct dev_state *ps, void __user *arg)
  1056. {
  1057. unsigned int ifnum;
  1058. if (get_user(ifnum, (unsigned int __user *)arg))
  1059. return -EFAULT;
  1060. return claimintf(ps, ifnum);
  1061. }
  1062. static int proc_releaseinterface(struct dev_state *ps, void __user *arg)
  1063. {
  1064. unsigned int ifnum;
  1065. int ret;
  1066. if (get_user(ifnum, (unsigned int __user *)arg))
  1067. return -EFAULT;
  1068. if ((ret = releaseintf(ps, ifnum)) < 0)
  1069. return ret;
  1070. destroy_async_on_interface (ps, ifnum);
  1071. return 0;
  1072. }
  1073. static int proc_ioctl (struct dev_state *ps, void __user *arg)
  1074. {
  1075. struct usbdevfs_ioctl ctrl;
  1076. int size;
  1077. void *buf = NULL;
  1078. int retval = 0;
  1079. struct usb_interface *intf = NULL;
  1080. struct usb_driver *driver = NULL;
  1081. int i;
  1082. /* get input parameters and alloc buffer */
  1083. if (copy_from_user(&ctrl, arg, sizeof (ctrl)))
  1084. return -EFAULT;
  1085. if ((size = _IOC_SIZE (ctrl.ioctl_code)) > 0) {
  1086. if ((buf = kmalloc (size, GFP_KERNEL)) == NULL)
  1087. return -ENOMEM;
  1088. if ((_IOC_DIR(ctrl.ioctl_code) & _IOC_WRITE)) {
  1089. if (copy_from_user (buf, ctrl.data, size)) {
  1090. kfree(buf);
  1091. return -EFAULT;
  1092. }
  1093. } else {
  1094. memset (buf, 0, size);
  1095. }
  1096. }
  1097. if (!connected(ps->dev)) {
  1098. kfree(buf);
  1099. return -ENODEV;
  1100. }
  1101. if (ps->dev->state != USB_STATE_CONFIGURED)
  1102. retval = -EHOSTUNREACH;
  1103. else if (!(intf = usb_ifnum_to_if (ps->dev, ctrl.ifno)))
  1104. retval = -EINVAL;
  1105. else switch (ctrl.ioctl_code) {
  1106. /* disconnect kernel driver from interface */
  1107. case USBDEVFS_DISCONNECT:
  1108. /* don't allow the user to unbind the hub driver from
  1109. * a hub with children to manage */
  1110. for (i = 0; i < ps->dev->maxchild; ++i) {
  1111. if (ps->dev->children[i])
  1112. retval = -EBUSY;
  1113. }
  1114. if (retval)
  1115. break;
  1116. down_write(&usb_bus_type.subsys.rwsem);
  1117. if (intf->dev.driver) {
  1118. driver = to_usb_driver(intf->dev.driver);
  1119. dev_dbg (&intf->dev, "disconnect by usbfs\n");
  1120. usb_driver_release_interface(driver, intf);
  1121. } else
  1122. retval = -ENODATA;
  1123. up_write(&usb_bus_type.subsys.rwsem);
  1124. break;
  1125. /* let kernel drivers try to (re)bind to the interface */
  1126. case USBDEVFS_CONNECT:
  1127. usb_unlock_device(ps->dev);
  1128. usb_lock_all_devices();
  1129. bus_rescan_devices(intf->dev.bus);
  1130. usb_unlock_all_devices();
  1131. usb_lock_device(ps->dev);
  1132. break;
  1133. /* talk directly to the interface's driver */
  1134. default:
  1135. down_read(&usb_bus_type.subsys.rwsem);
  1136. if (intf->dev.driver)
  1137. driver = to_usb_driver(intf->dev.driver);
  1138. if (driver == NULL || driver->ioctl == NULL) {
  1139. retval = -ENOTTY;
  1140. } else {
  1141. retval = driver->ioctl (intf, ctrl.ioctl_code, buf);
  1142. if (retval == -ENOIOCTLCMD)
  1143. retval = -ENOTTY;
  1144. }
  1145. up_read(&usb_bus_type.subsys.rwsem);
  1146. }
  1147. /* cleanup and return */
  1148. if (retval >= 0
  1149. && (_IOC_DIR (ctrl.ioctl_code) & _IOC_READ) != 0
  1150. && size > 0
  1151. && copy_to_user (ctrl.data, buf, size) != 0)
  1152. retval = -EFAULT;
  1153. kfree(buf);
  1154. return retval;
  1155. }
  1156. /*
  1157. * NOTE: All requests here that have interface numbers as parameters
  1158. * are assuming that somehow the configuration has been prevented from
  1159. * changing. But there's no mechanism to ensure that...
  1160. */
  1161. static int usbdev_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
  1162. {
  1163. struct dev_state *ps = (struct dev_state *)file->private_data;
  1164. struct usb_device *dev = ps->dev;
  1165. void __user *p = (void __user *)arg;
  1166. int ret = -ENOTTY;
  1167. if (!(file->f_mode & FMODE_WRITE))
  1168. return -EPERM;
  1169. usb_lock_device(dev);
  1170. if (!connected(dev)) {
  1171. usb_unlock_device(dev);
  1172. return -ENODEV;
  1173. }
  1174. switch (cmd) {
  1175. case USBDEVFS_CONTROL:
  1176. snoop(&dev->dev, "%s: CONTROL\n", __FUNCTION__);
  1177. ret = proc_control(ps, p);
  1178. if (ret >= 0)
  1179. inode->i_mtime = CURRENT_TIME;
  1180. break;
  1181. case USBDEVFS_BULK:
  1182. snoop(&dev->dev, "%s: BULK\n", __FUNCTION__);
  1183. ret = proc_bulk(ps, p);
  1184. if (ret >= 0)
  1185. inode->i_mtime = CURRENT_TIME;
  1186. break;
  1187. case USBDEVFS_RESETEP:
  1188. snoop(&dev->dev, "%s: RESETEP\n", __FUNCTION__);
  1189. ret = proc_resetep(ps, p);
  1190. if (ret >= 0)
  1191. inode->i_mtime = CURRENT_TIME;
  1192. break;
  1193. case USBDEVFS_RESET:
  1194. snoop(&dev->dev, "%s: RESET\n", __FUNCTION__);
  1195. ret = proc_resetdevice(ps);
  1196. break;
  1197. case USBDEVFS_CLEAR_HALT:
  1198. snoop(&dev->dev, "%s: CLEAR_HALT\n", __FUNCTION__);
  1199. ret = proc_clearhalt(ps, p);
  1200. if (ret >= 0)
  1201. inode->i_mtime = CURRENT_TIME;
  1202. break;
  1203. case USBDEVFS_GETDRIVER:
  1204. snoop(&dev->dev, "%s: GETDRIVER\n", __FUNCTION__);
  1205. ret = proc_getdriver(ps, p);
  1206. break;
  1207. case USBDEVFS_CONNECTINFO:
  1208. snoop(&dev->dev, "%s: CONNECTINFO\n", __FUNCTION__);
  1209. ret = proc_connectinfo(ps, p);
  1210. break;
  1211. case USBDEVFS_SETINTERFACE:
  1212. snoop(&dev->dev, "%s: SETINTERFACE\n", __FUNCTION__);
  1213. ret = proc_setintf(ps, p);
  1214. break;
  1215. case USBDEVFS_SETCONFIGURATION:
  1216. snoop(&dev->dev, "%s: SETCONFIGURATION\n", __FUNCTION__);
  1217. ret = proc_setconfig(ps, p);
  1218. break;
  1219. case USBDEVFS_SUBMITURB:
  1220. snoop(&dev->dev, "%s: SUBMITURB\n", __FUNCTION__);
  1221. ret = proc_submiturb(ps, p);
  1222. if (ret >= 0)
  1223. inode->i_mtime = CURRENT_TIME;
  1224. break;
  1225. #ifdef CONFIG_COMPAT
  1226. case USBDEVFS_SUBMITURB32:
  1227. snoop(&dev->dev, "%s: SUBMITURB32\n", __FUNCTION__);
  1228. ret = proc_submiturb_compat(ps, p);
  1229. if (ret >= 0)
  1230. inode->i_mtime = CURRENT_TIME;
  1231. break;
  1232. case USBDEVFS_REAPURB32:
  1233. snoop(&dev->dev, "%s: REAPURB32\n", __FUNCTION__);
  1234. ret = proc_reapurb_compat(ps, p);
  1235. break;
  1236. case USBDEVFS_REAPURBNDELAY32:
  1237. snoop(&dev->dev, "%s: REAPURBDELAY32\n", __FUNCTION__);
  1238. ret = proc_reapurbnonblock_compat(ps, p);
  1239. break;
  1240. #endif
  1241. case USBDEVFS_DISCARDURB:
  1242. snoop(&dev->dev, "%s: DISCARDURB\n", __FUNCTION__);
  1243. ret = proc_unlinkurb(ps, p);
  1244. break;
  1245. case USBDEVFS_REAPURB:
  1246. snoop(&dev->dev, "%s: REAPURB\n", __FUNCTION__);
  1247. ret = proc_reapurb(ps, p);
  1248. break;
  1249. case USBDEVFS_REAPURBNDELAY:
  1250. snoop(&dev->dev, "%s: REAPURBDELAY\n", __FUNCTION__);
  1251. ret = proc_reapurbnonblock(ps, p);
  1252. break;
  1253. case USBDEVFS_DISCSIGNAL:
  1254. snoop(&dev->dev, "%s: DISCSIGNAL\n", __FUNCTION__);
  1255. ret = proc_disconnectsignal(ps, p);
  1256. break;
  1257. case USBDEVFS_CLAIMINTERFACE:
  1258. snoop(&dev->dev, "%s: CLAIMINTERFACE\n", __FUNCTION__);
  1259. ret = proc_claiminterface(ps, p);
  1260. break;
  1261. case USBDEVFS_RELEASEINTERFACE:
  1262. snoop(&dev->dev, "%s: RELEASEINTERFACE\n", __FUNCTION__);
  1263. ret = proc_releaseinterface(ps, p);
  1264. break;
  1265. case USBDEVFS_IOCTL:
  1266. snoop(&dev->dev, "%s: IOCTL\n", __FUNCTION__);
  1267. ret = proc_ioctl(ps, p);
  1268. break;
  1269. }
  1270. usb_unlock_device(dev);
  1271. if (ret >= 0)
  1272. inode->i_atime = CURRENT_TIME;
  1273. return ret;
  1274. }
  1275. /* No kernel lock - fine */
  1276. static unsigned int usbdev_poll(struct file *file, struct poll_table_struct *wait)
  1277. {
  1278. struct dev_state *ps = (struct dev_state *)file->private_data;
  1279. unsigned int mask = 0;
  1280. poll_wait(file, &ps->wait, wait);
  1281. if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
  1282. mask |= POLLOUT | POLLWRNORM;
  1283. if (!connected(ps->dev))
  1284. mask |= POLLERR | POLLHUP;
  1285. return mask;
  1286. }
  1287. struct file_operations usbfs_device_file_operations = {
  1288. .llseek = usbdev_lseek,
  1289. .read = usbdev_read,
  1290. .poll = usbdev_poll,
  1291. .ioctl = usbdev_ioctl,
  1292. .open = usbdev_open,
  1293. .release = usbdev_release,
  1294. };