devio.c 38 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479
  1. /*****************************************************************************/
  2. /*
  3. * devio.c -- User space communication with USB devices.
  4. *
  5. * Copyright (C) 1999-2000 Thomas Sailer (sailer@ife.ee.ethz.ch)
  6. *
  7. * This program is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License as published by
  9. * the Free Software Foundation; either version 2 of the License, or
  10. * (at your option) any later version.
  11. *
  12. * This program is distributed in the hope that it will be useful,
  13. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. * GNU General Public License for more details.
  16. *
  17. * You should have received a copy of the GNU General Public License
  18. * along with this program; if not, write to the Free Software
  19. * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20. *
  21. * $Id: devio.c,v 1.7 2000/02/01 17:28:48 fliegl Exp $
  22. *
  23. * This file implements the usbfs/x/y files, where
  24. * x is the bus number and y the device number.
  25. *
  26. * It allows user space programs/"drivers" to communicate directly
  27. * with USB devices without intervening kernel driver.
  28. *
  29. * Revision history
  30. * 22.12.1999 0.1 Initial release (split from proc_usb.c)
  31. * 04.01.2000 0.2 Turned into its own filesystem
  32. */
  33. /*****************************************************************************/
  34. #include <linux/fs.h>
  35. #include <linux/mm.h>
  36. #include <linux/slab.h>
  37. #include <linux/smp_lock.h>
  38. #include <linux/signal.h>
  39. #include <linux/poll.h>
  40. #include <linux/module.h>
  41. #include <linux/usb.h>
  42. #include <linux/usbdevice_fs.h>
  43. #include <asm/uaccess.h>
  44. #include <asm/byteorder.h>
  45. #include <linux/moduleparam.h>
  46. #include "hcd.h" /* for usbcore internals */
  47. #include "usb.h"
  48. struct async {
  49. struct list_head asynclist;
  50. struct dev_state *ps;
  51. struct task_struct *task;
  52. unsigned int signr;
  53. unsigned int ifnum;
  54. void __user *userbuffer;
  55. void __user *userurb;
  56. struct urb *urb;
  57. };
  58. static int usbfs_snoop = 0;
  59. module_param (usbfs_snoop, bool, S_IRUGO | S_IWUSR);
  60. MODULE_PARM_DESC (usbfs_snoop, "true to log all usbfs traffic");
  61. #define snoop(dev, format, arg...) \
  62. do { \
  63. if (usbfs_snoop) \
  64. dev_info( dev , format , ## arg); \
  65. } while (0)
  66. #define MAX_USBFS_BUFFER_SIZE 16384
  67. static inline int connected (struct usb_device *dev)
  68. {
  69. return dev->state != USB_STATE_NOTATTACHED;
  70. }
  71. static loff_t usbdev_lseek(struct file *file, loff_t offset, int orig)
  72. {
  73. loff_t ret;
  74. lock_kernel();
  75. switch (orig) {
  76. case 0:
  77. file->f_pos = offset;
  78. ret = file->f_pos;
  79. break;
  80. case 1:
  81. file->f_pos += offset;
  82. ret = file->f_pos;
  83. break;
  84. case 2:
  85. default:
  86. ret = -EINVAL;
  87. }
  88. unlock_kernel();
  89. return ret;
  90. }
  91. static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
  92. {
  93. struct dev_state *ps = (struct dev_state *)file->private_data;
  94. struct usb_device *dev = ps->dev;
  95. ssize_t ret = 0;
  96. unsigned len;
  97. loff_t pos;
  98. int i;
  99. pos = *ppos;
  100. usb_lock_device(dev);
  101. if (!connected(dev)) {
  102. ret = -ENODEV;
  103. goto err;
  104. } else if (pos < 0) {
  105. ret = -EINVAL;
  106. goto err;
  107. }
  108. if (pos < sizeof(struct usb_device_descriptor)) {
  109. struct usb_device_descriptor *desc = kmalloc(sizeof(*desc), GFP_KERNEL);
  110. if (!desc) {
  111. ret = -ENOMEM;
  112. goto err;
  113. }
  114. memcpy(desc, &dev->descriptor, sizeof(dev->descriptor));
  115. le16_to_cpus(&desc->bcdUSB);
  116. le16_to_cpus(&desc->idVendor);
  117. le16_to_cpus(&desc->idProduct);
  118. le16_to_cpus(&desc->bcdDevice);
  119. len = sizeof(struct usb_device_descriptor) - pos;
  120. if (len > nbytes)
  121. len = nbytes;
  122. if (copy_to_user(buf, ((char *)desc) + pos, len)) {
  123. kfree(desc);
  124. ret = -EFAULT;
  125. goto err;
  126. }
  127. kfree(desc);
  128. *ppos += len;
  129. buf += len;
  130. nbytes -= len;
  131. ret += len;
  132. }
  133. pos = sizeof(struct usb_device_descriptor);
  134. for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {
  135. struct usb_config_descriptor *config =
  136. (struct usb_config_descriptor *)dev->rawdescriptors[i];
  137. unsigned int length = le16_to_cpu(config->wTotalLength);
  138. if (*ppos < pos + length) {
  139. /* The descriptor may claim to be longer than it
  140. * really is. Here is the actual allocated length. */
  141. unsigned alloclen =
  142. le16_to_cpu(dev->config[i].desc.wTotalLength);
  143. len = length - (*ppos - pos);
  144. if (len > nbytes)
  145. len = nbytes;
  146. /* Simply don't write (skip over) unallocated parts */
  147. if (alloclen > (*ppos - pos)) {
  148. alloclen -= (*ppos - pos);
  149. if (copy_to_user(buf,
  150. dev->rawdescriptors[i] + (*ppos - pos),
  151. min(len, alloclen))) {
  152. ret = -EFAULT;
  153. goto err;
  154. }
  155. }
  156. *ppos += len;
  157. buf += len;
  158. nbytes -= len;
  159. ret += len;
  160. }
  161. pos += length;
  162. }
  163. err:
  164. usb_unlock_device(dev);
  165. return ret;
  166. }
  167. /*
  168. * async list handling
  169. */
  170. static struct async *alloc_async(unsigned int numisoframes)
  171. {
  172. unsigned int assize = sizeof(struct async) + numisoframes * sizeof(struct usb_iso_packet_descriptor);
  173. struct async *as = kmalloc(assize, GFP_KERNEL);
  174. if (!as)
  175. return NULL;
  176. memset(as, 0, assize);
  177. as->urb = usb_alloc_urb(numisoframes, GFP_KERNEL);
  178. if (!as->urb) {
  179. kfree(as);
  180. return NULL;
  181. }
  182. return as;
  183. }
  184. static void free_async(struct async *as)
  185. {
  186. kfree(as->urb->transfer_buffer);
  187. kfree(as->urb->setup_packet);
  188. usb_free_urb(as->urb);
  189. kfree(as);
  190. }
  191. static inline void async_newpending(struct async *as)
  192. {
  193. struct dev_state *ps = as->ps;
  194. unsigned long flags;
  195. spin_lock_irqsave(&ps->lock, flags);
  196. list_add_tail(&as->asynclist, &ps->async_pending);
  197. spin_unlock_irqrestore(&ps->lock, flags);
  198. }
  199. static inline void async_removepending(struct async *as)
  200. {
  201. struct dev_state *ps = as->ps;
  202. unsigned long flags;
  203. spin_lock_irqsave(&ps->lock, flags);
  204. list_del_init(&as->asynclist);
  205. spin_unlock_irqrestore(&ps->lock, flags);
  206. }
  207. static inline struct async *async_getcompleted(struct dev_state *ps)
  208. {
  209. unsigned long flags;
  210. struct async *as = NULL;
  211. spin_lock_irqsave(&ps->lock, flags);
  212. if (!list_empty(&ps->async_completed)) {
  213. as = list_entry(ps->async_completed.next, struct async, asynclist);
  214. list_del_init(&as->asynclist);
  215. }
  216. spin_unlock_irqrestore(&ps->lock, flags);
  217. return as;
  218. }
  219. static inline struct async *async_getpending(struct dev_state *ps, void __user *userurb)
  220. {
  221. unsigned long flags;
  222. struct async *as;
  223. spin_lock_irqsave(&ps->lock, flags);
  224. list_for_each_entry(as, &ps->async_pending, asynclist)
  225. if (as->userurb == userurb) {
  226. list_del_init(&as->asynclist);
  227. spin_unlock_irqrestore(&ps->lock, flags);
  228. return as;
  229. }
  230. spin_unlock_irqrestore(&ps->lock, flags);
  231. return NULL;
  232. }
  233. static void async_completed(struct urb *urb, struct pt_regs *regs)
  234. {
  235. struct async *as = (struct async *)urb->context;
  236. struct dev_state *ps = as->ps;
  237. struct siginfo sinfo;
  238. spin_lock(&ps->lock);
  239. list_move_tail(&as->asynclist, &ps->async_completed);
  240. spin_unlock(&ps->lock);
  241. if (as->signr) {
  242. sinfo.si_signo = as->signr;
  243. sinfo.si_errno = as->urb->status;
  244. sinfo.si_code = SI_ASYNCIO;
  245. sinfo.si_addr = as->userurb;
  246. send_sig_info(as->signr, &sinfo, as->task);
  247. }
  248. wake_up(&ps->wait);
  249. }
  250. static void destroy_async (struct dev_state *ps, struct list_head *list)
  251. {
  252. struct async *as;
  253. unsigned long flags;
  254. spin_lock_irqsave(&ps->lock, flags);
  255. while (!list_empty(list)) {
  256. as = list_entry(list->next, struct async, asynclist);
  257. list_del_init(&as->asynclist);
  258. /* drop the spinlock so the completion handler can run */
  259. spin_unlock_irqrestore(&ps->lock, flags);
  260. usb_kill_urb(as->urb);
  261. spin_lock_irqsave(&ps->lock, flags);
  262. }
  263. spin_unlock_irqrestore(&ps->lock, flags);
  264. as = async_getcompleted(ps);
  265. while (as) {
  266. free_async(as);
  267. as = async_getcompleted(ps);
  268. }
  269. }
  270. static void destroy_async_on_interface (struct dev_state *ps, unsigned int ifnum)
  271. {
  272. struct list_head *p, *q, hitlist;
  273. unsigned long flags;
  274. INIT_LIST_HEAD(&hitlist);
  275. spin_lock_irqsave(&ps->lock, flags);
  276. list_for_each_safe(p, q, &ps->async_pending)
  277. if (ifnum == list_entry(p, struct async, asynclist)->ifnum)
  278. list_move_tail(p, &hitlist);
  279. spin_unlock_irqrestore(&ps->lock, flags);
  280. destroy_async(ps, &hitlist);
  281. }
  282. static inline void destroy_all_async(struct dev_state *ps)
  283. {
  284. destroy_async(ps, &ps->async_pending);
  285. }
  286. /*
  287. * interface claims are made only at the request of user level code,
  288. * which can also release them (explicitly or by closing files).
  289. * they're also undone when devices disconnect.
  290. */
  291. static int driver_probe (struct usb_interface *intf,
  292. const struct usb_device_id *id)
  293. {
  294. return -ENODEV;
  295. }
  296. static void driver_disconnect(struct usb_interface *intf)
  297. {
  298. struct dev_state *ps = usb_get_intfdata (intf);
  299. unsigned int ifnum = intf->altsetting->desc.bInterfaceNumber;
  300. if (!ps)
  301. return;
  302. /* NOTE: this relies on usbcore having canceled and completed
  303. * all pending I/O requests; 2.6 does that.
  304. */
  305. if (likely(ifnum < 8*sizeof(ps->ifclaimed)))
  306. clear_bit(ifnum, &ps->ifclaimed);
  307. else
  308. warn("interface number %u out of range", ifnum);
  309. usb_set_intfdata (intf, NULL);
  310. /* force async requests to complete */
  311. destroy_async_on_interface(ps, ifnum);
  312. }
  313. struct usb_driver usbfs_driver = {
  314. .owner = THIS_MODULE,
  315. .name = "usbfs",
  316. .probe = driver_probe,
  317. .disconnect = driver_disconnect,
  318. };
  319. static int claimintf(struct dev_state *ps, unsigned int ifnum)
  320. {
  321. struct usb_device *dev = ps->dev;
  322. struct usb_interface *intf;
  323. int err;
  324. if (ifnum >= 8*sizeof(ps->ifclaimed))
  325. return -EINVAL;
  326. /* already claimed */
  327. if (test_bit(ifnum, &ps->ifclaimed))
  328. return 0;
  329. /* lock against other changes to driver bindings */
  330. down_write(&usb_bus_type.subsys.rwsem);
  331. intf = usb_ifnum_to_if(dev, ifnum);
  332. if (!intf)
  333. err = -ENOENT;
  334. else
  335. err = usb_driver_claim_interface(&usbfs_driver, intf, ps);
  336. up_write(&usb_bus_type.subsys.rwsem);
  337. if (err == 0)
  338. set_bit(ifnum, &ps->ifclaimed);
  339. return err;
  340. }
  341. static int releaseintf(struct dev_state *ps, unsigned int ifnum)
  342. {
  343. struct usb_device *dev;
  344. struct usb_interface *intf;
  345. int err;
  346. err = -EINVAL;
  347. if (ifnum >= 8*sizeof(ps->ifclaimed))
  348. return err;
  349. dev = ps->dev;
  350. /* lock against other changes to driver bindings */
  351. down_write(&usb_bus_type.subsys.rwsem);
  352. intf = usb_ifnum_to_if(dev, ifnum);
  353. if (!intf)
  354. err = -ENOENT;
  355. else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) {
  356. usb_driver_release_interface(&usbfs_driver, intf);
  357. err = 0;
  358. }
  359. up_write(&usb_bus_type.subsys.rwsem);
  360. return err;
  361. }
  362. static int checkintf(struct dev_state *ps, unsigned int ifnum)
  363. {
  364. if (ps->dev->state != USB_STATE_CONFIGURED)
  365. return -EHOSTUNREACH;
  366. if (ifnum >= 8*sizeof(ps->ifclaimed))
  367. return -EINVAL;
  368. if (test_bit(ifnum, &ps->ifclaimed))
  369. return 0;
  370. /* if not yet claimed, claim it for the driver */
  371. dev_warn(&ps->dev->dev, "usbfs: process %d (%s) did not claim interface %u before use\n",
  372. current->pid, current->comm, ifnum);
  373. return claimintf(ps, ifnum);
  374. }
  375. static int findintfep(struct usb_device *dev, unsigned int ep)
  376. {
  377. unsigned int i, j, e;
  378. struct usb_interface *intf;
  379. struct usb_host_interface *alts;
  380. struct usb_endpoint_descriptor *endpt;
  381. if (ep & ~(USB_DIR_IN|0xf))
  382. return -EINVAL;
  383. if (!dev->actconfig)
  384. return -ESRCH;
  385. for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
  386. intf = dev->actconfig->interface[i];
  387. for (j = 0; j < intf->num_altsetting; j++) {
  388. alts = &intf->altsetting[j];
  389. for (e = 0; e < alts->desc.bNumEndpoints; e++) {
  390. endpt = &alts->endpoint[e].desc;
  391. if (endpt->bEndpointAddress == ep)
  392. return alts->desc.bInterfaceNumber;
  393. }
  394. }
  395. }
  396. return -ENOENT;
  397. }
  398. static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype, unsigned int index)
  399. {
  400. int ret = 0;
  401. if (ps->dev->state != USB_STATE_CONFIGURED)
  402. return -EHOSTUNREACH;
  403. if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
  404. return 0;
  405. index &= 0xff;
  406. switch (requesttype & USB_RECIP_MASK) {
  407. case USB_RECIP_ENDPOINT:
  408. if ((ret = findintfep(ps->dev, index)) >= 0)
  409. ret = checkintf(ps, ret);
  410. break;
  411. case USB_RECIP_INTERFACE:
  412. ret = checkintf(ps, index);
  413. break;
  414. }
  415. return ret;
  416. }
  417. /*
  418. * file operations
  419. */
  420. static int usbdev_open(struct inode *inode, struct file *file)
  421. {
  422. struct usb_device *dev;
  423. struct dev_state *ps;
  424. int ret;
  425. /*
  426. * no locking necessary here, as chrdev_open has the kernel lock
  427. * (still acquire the kernel lock for safety)
  428. */
  429. ret = -ENOMEM;
  430. if (!(ps = kmalloc(sizeof(struct dev_state), GFP_KERNEL)))
  431. goto out_nolock;
  432. lock_kernel();
  433. ret = -ENOENT;
  434. dev = usb_get_dev(inode->u.generic_ip);
  435. if (!dev) {
  436. kfree(ps);
  437. goto out;
  438. }
  439. ret = 0;
  440. ps->dev = dev;
  441. ps->file = file;
  442. spin_lock_init(&ps->lock);
  443. INIT_LIST_HEAD(&ps->async_pending);
  444. INIT_LIST_HEAD(&ps->async_completed);
  445. init_waitqueue_head(&ps->wait);
  446. ps->discsignr = 0;
  447. ps->disctask = current;
  448. ps->disccontext = NULL;
  449. ps->ifclaimed = 0;
  450. wmb();
  451. list_add_tail(&ps->list, &dev->filelist);
  452. file->private_data = ps;
  453. out:
  454. unlock_kernel();
  455. out_nolock:
  456. return ret;
  457. }
  458. static int usbdev_release(struct inode *inode, struct file *file)
  459. {
  460. struct dev_state *ps = (struct dev_state *)file->private_data;
  461. struct usb_device *dev = ps->dev;
  462. unsigned int ifnum;
  463. usb_lock_device(dev);
  464. list_del_init(&ps->list);
  465. for (ifnum = 0; ps->ifclaimed && ifnum < 8*sizeof(ps->ifclaimed);
  466. ifnum++) {
  467. if (test_bit(ifnum, &ps->ifclaimed))
  468. releaseintf(ps, ifnum);
  469. }
  470. destroy_all_async(ps);
  471. usb_unlock_device(dev);
  472. usb_put_dev(dev);
  473. ps->dev = NULL;
  474. kfree(ps);
  475. return 0;
  476. }
  477. static int proc_control(struct dev_state *ps, void __user *arg)
  478. {
  479. struct usb_device *dev = ps->dev;
  480. struct usbdevfs_ctrltransfer ctrl;
  481. unsigned int tmo;
  482. unsigned char *tbuf;
  483. int i, j, ret;
  484. if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
  485. return -EFAULT;
  486. if ((ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.wIndex)))
  487. return ret;
  488. if (ctrl.wLength > PAGE_SIZE)
  489. return -EINVAL;
  490. if (!(tbuf = (unsigned char *)__get_free_page(GFP_KERNEL)))
  491. return -ENOMEM;
  492. tmo = ctrl.timeout;
  493. if (ctrl.bRequestType & 0x80) {
  494. if (ctrl.wLength && !access_ok(VERIFY_WRITE, ctrl.data, ctrl.wLength)) {
  495. free_page((unsigned long)tbuf);
  496. return -EINVAL;
  497. }
  498. snoop(&dev->dev, "control read: bRequest=%02x "
  499. "bRrequestType=%02x wValue=%04x "
  500. "wIndex=%04x wLength=%04x\n",
  501. ctrl.bRequest, ctrl.bRequestType, ctrl.wValue,
  502. ctrl.wIndex, ctrl.wLength);
  503. usb_unlock_device(dev);
  504. i = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), ctrl.bRequest, ctrl.bRequestType,
  505. ctrl.wValue, ctrl.wIndex, tbuf, ctrl.wLength, tmo);
  506. usb_lock_device(dev);
  507. if ((i > 0) && ctrl.wLength) {
  508. if (usbfs_snoop) {
  509. dev_info(&dev->dev, "control read: data ");
  510. for (j = 0; j < i; ++j)
  511. printk ("%02x ", (unsigned char)(tbuf)[j]);
  512. printk("\n");
  513. }
  514. if (copy_to_user(ctrl.data, tbuf, i)) {
  515. free_page((unsigned long)tbuf);
  516. return -EFAULT;
  517. }
  518. }
  519. } else {
  520. if (ctrl.wLength) {
  521. if (copy_from_user(tbuf, ctrl.data, ctrl.wLength)) {
  522. free_page((unsigned long)tbuf);
  523. return -EFAULT;
  524. }
  525. }
  526. snoop(&dev->dev, "control write: bRequest=%02x "
  527. "bRrequestType=%02x wValue=%04x "
  528. "wIndex=%04x wLength=%04x\n",
  529. ctrl.bRequest, ctrl.bRequestType, ctrl.wValue,
  530. ctrl.wIndex, ctrl.wLength);
  531. if (usbfs_snoop) {
  532. dev_info(&dev->dev, "control write: data: ");
  533. for (j = 0; j < ctrl.wLength; ++j)
  534. printk ("%02x ", (unsigned char)(tbuf)[j]);
  535. printk("\n");
  536. }
  537. usb_unlock_device(dev);
  538. i = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ctrl.bRequest, ctrl.bRequestType,
  539. ctrl.wValue, ctrl.wIndex, tbuf, ctrl.wLength, tmo);
  540. usb_lock_device(dev);
  541. }
  542. free_page((unsigned long)tbuf);
  543. if (i<0 && i != -EPIPE) {
  544. dev_printk(KERN_DEBUG, &dev->dev, "usbfs: USBDEVFS_CONTROL "
  545. "failed cmd %s rqt %u rq %u len %u ret %d\n",
  546. current->comm, ctrl.bRequestType, ctrl.bRequest,
  547. ctrl.wLength, i);
  548. }
  549. return i;
  550. }
  551. static int proc_bulk(struct dev_state *ps, void __user *arg)
  552. {
  553. struct usb_device *dev = ps->dev;
  554. struct usbdevfs_bulktransfer bulk;
  555. unsigned int tmo, len1, pipe;
  556. int len2;
  557. unsigned char *tbuf;
  558. int i, ret;
  559. if (copy_from_user(&bulk, arg, sizeof(bulk)))
  560. return -EFAULT;
  561. if ((ret = findintfep(ps->dev, bulk.ep)) < 0)
  562. return ret;
  563. if ((ret = checkintf(ps, ret)))
  564. return ret;
  565. if (bulk.ep & USB_DIR_IN)
  566. pipe = usb_rcvbulkpipe(dev, bulk.ep & 0x7f);
  567. else
  568. pipe = usb_sndbulkpipe(dev, bulk.ep & 0x7f);
  569. if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN)))
  570. return -EINVAL;
  571. len1 = bulk.len;
  572. if (len1 > MAX_USBFS_BUFFER_SIZE)
  573. return -EINVAL;
  574. if (!(tbuf = kmalloc(len1, GFP_KERNEL)))
  575. return -ENOMEM;
  576. tmo = bulk.timeout;
  577. if (bulk.ep & 0x80) {
  578. if (len1 && !access_ok(VERIFY_WRITE, bulk.data, len1)) {
  579. kfree(tbuf);
  580. return -EINVAL;
  581. }
  582. usb_unlock_device(dev);
  583. i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
  584. usb_lock_device(dev);
  585. if (!i && len2) {
  586. if (copy_to_user(bulk.data, tbuf, len2)) {
  587. kfree(tbuf);
  588. return -EFAULT;
  589. }
  590. }
  591. } else {
  592. if (len1) {
  593. if (copy_from_user(tbuf, bulk.data, len1)) {
  594. kfree(tbuf);
  595. return -EFAULT;
  596. }
  597. }
  598. usb_unlock_device(dev);
  599. i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
  600. usb_lock_device(dev);
  601. }
  602. kfree(tbuf);
  603. if (i < 0)
  604. return i;
  605. return len2;
  606. }
  607. static int proc_resetep(struct dev_state *ps, void __user *arg)
  608. {
  609. unsigned int ep;
  610. int ret;
  611. if (get_user(ep, (unsigned int __user *)arg))
  612. return -EFAULT;
  613. if ((ret = findintfep(ps->dev, ep)) < 0)
  614. return ret;
  615. if ((ret = checkintf(ps, ret)))
  616. return ret;
  617. usb_settoggle(ps->dev, ep & 0xf, !(ep & USB_DIR_IN), 0);
  618. return 0;
  619. }
  620. static int proc_clearhalt(struct dev_state *ps, void __user *arg)
  621. {
  622. unsigned int ep;
  623. int pipe;
  624. int ret;
  625. if (get_user(ep, (unsigned int __user *)arg))
  626. return -EFAULT;
  627. if ((ret = findintfep(ps->dev, ep)) < 0)
  628. return ret;
  629. if ((ret = checkintf(ps, ret)))
  630. return ret;
  631. if (ep & USB_DIR_IN)
  632. pipe = usb_rcvbulkpipe(ps->dev, ep & 0x7f);
  633. else
  634. pipe = usb_sndbulkpipe(ps->dev, ep & 0x7f);
  635. return usb_clear_halt(ps->dev, pipe);
  636. }
  637. static int proc_getdriver(struct dev_state *ps, void __user *arg)
  638. {
  639. struct usbdevfs_getdriver gd;
  640. struct usb_interface *intf;
  641. int ret;
  642. if (copy_from_user(&gd, arg, sizeof(gd)))
  643. return -EFAULT;
  644. down_read(&usb_bus_type.subsys.rwsem);
  645. intf = usb_ifnum_to_if(ps->dev, gd.interface);
  646. if (!intf || !intf->dev.driver)
  647. ret = -ENODATA;
  648. else {
  649. strncpy(gd.driver, intf->dev.driver->name,
  650. sizeof(gd.driver));
  651. ret = (copy_to_user(arg, &gd, sizeof(gd)) ? -EFAULT : 0);
  652. }
  653. up_read(&usb_bus_type.subsys.rwsem);
  654. return ret;
  655. }
  656. static int proc_connectinfo(struct dev_state *ps, void __user *arg)
  657. {
  658. struct usbdevfs_connectinfo ci;
  659. ci.devnum = ps->dev->devnum;
  660. ci.slow = ps->dev->speed == USB_SPEED_LOW;
  661. if (copy_to_user(arg, &ci, sizeof(ci)))
  662. return -EFAULT;
  663. return 0;
  664. }
  665. static int proc_resetdevice(struct dev_state *ps)
  666. {
  667. return usb_reset_device(ps->dev);
  668. }
  669. static int proc_setintf(struct dev_state *ps, void __user *arg)
  670. {
  671. struct usbdevfs_setinterface setintf;
  672. int ret;
  673. if (copy_from_user(&setintf, arg, sizeof(setintf)))
  674. return -EFAULT;
  675. if ((ret = checkintf(ps, setintf.interface)))
  676. return ret;
  677. return usb_set_interface(ps->dev, setintf.interface,
  678. setintf.altsetting);
  679. }
  680. static int proc_setconfig(struct dev_state *ps, void __user *arg)
  681. {
  682. unsigned int u;
  683. int status = 0;
  684. struct usb_host_config *actconfig;
  685. if (get_user(u, (unsigned int __user *)arg))
  686. return -EFAULT;
  687. actconfig = ps->dev->actconfig;
  688. /* Don't touch the device if any interfaces are claimed.
  689. * It could interfere with other drivers' operations, and if
  690. * an interface is claimed by usbfs it could easily deadlock.
  691. */
  692. if (actconfig) {
  693. int i;
  694. for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
  695. if (usb_interface_claimed(actconfig->interface[i])) {
  696. dev_warn (&ps->dev->dev,
  697. "usbfs: interface %d claimed by %s "
  698. "while '%s' sets config #%d\n",
  699. actconfig->interface[i]
  700. ->cur_altsetting
  701. ->desc.bInterfaceNumber,
  702. actconfig->interface[i]
  703. ->dev.driver->name,
  704. current->comm, u);
  705. status = -EBUSY;
  706. break;
  707. }
  708. }
  709. }
  710. /* SET_CONFIGURATION is often abused as a "cheap" driver reset,
  711. * so avoid usb_set_configuration()'s kick to sysfs
  712. */
  713. if (status == 0) {
  714. if (actconfig && actconfig->desc.bConfigurationValue == u)
  715. status = usb_reset_configuration(ps->dev);
  716. else
  717. status = usb_set_configuration(ps->dev, u);
  718. }
  719. return status;
  720. }
  721. static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
  722. struct usbdevfs_iso_packet_desc __user *iso_frame_desc,
  723. void __user *arg)
  724. {
  725. struct usbdevfs_iso_packet_desc *isopkt = NULL;
  726. struct usb_host_endpoint *ep;
  727. struct async *as;
  728. struct usb_ctrlrequest *dr = NULL;
  729. unsigned int u, totlen, isofrmlen;
  730. int ret, interval = 0, ifnum = -1;
  731. if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP|USBDEVFS_URB_SHORT_NOT_OK|
  732. URB_NO_FSBR|URB_ZERO_PACKET))
  733. return -EINVAL;
  734. if (!uurb->buffer)
  735. return -EINVAL;
  736. if (uurb->signr != 0 && (uurb->signr < SIGRTMIN || uurb->signr > SIGRTMAX))
  737. return -EINVAL;
  738. if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL && (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
  739. if ((ifnum = findintfep(ps->dev, uurb->endpoint)) < 0)
  740. return ifnum;
  741. if ((ret = checkintf(ps, ifnum)))
  742. return ret;
  743. }
  744. if ((uurb->endpoint & USB_ENDPOINT_DIR_MASK) != 0)
  745. ep = ps->dev->ep_in [uurb->endpoint & USB_ENDPOINT_NUMBER_MASK];
  746. else
  747. ep = ps->dev->ep_out [uurb->endpoint & USB_ENDPOINT_NUMBER_MASK];
  748. if (!ep)
  749. return -ENOENT;
  750. switch(uurb->type) {
  751. case USBDEVFS_URB_TYPE_CONTROL:
  752. if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
  753. != USB_ENDPOINT_XFER_CONTROL)
  754. return -EINVAL;
  755. /* min 8 byte setup packet, max arbitrary */
  756. if (uurb->buffer_length < 8 || uurb->buffer_length > PAGE_SIZE)
  757. return -EINVAL;
  758. if (!(dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL)))
  759. return -ENOMEM;
  760. if (copy_from_user(dr, uurb->buffer, 8)) {
  761. kfree(dr);
  762. return -EFAULT;
  763. }
  764. if (uurb->buffer_length < (le16_to_cpup(&dr->wLength) + 8)) {
  765. kfree(dr);
  766. return -EINVAL;
  767. }
  768. if ((ret = check_ctrlrecip(ps, dr->bRequestType, le16_to_cpup(&dr->wIndex)))) {
  769. kfree(dr);
  770. return ret;
  771. }
  772. uurb->endpoint = (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) | (dr->bRequestType & USB_ENDPOINT_DIR_MASK);
  773. uurb->number_of_packets = 0;
  774. uurb->buffer_length = le16_to_cpup(&dr->wLength);
  775. uurb->buffer += 8;
  776. if (!access_ok((uurb->endpoint & USB_DIR_IN) ? VERIFY_WRITE : VERIFY_READ, uurb->buffer, uurb->buffer_length)) {
  777. kfree(dr);
  778. return -EFAULT;
  779. }
  780. break;
  781. case USBDEVFS_URB_TYPE_BULK:
  782. switch (ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
  783. case USB_ENDPOINT_XFER_CONTROL:
  784. case USB_ENDPOINT_XFER_ISOC:
  785. return -EINVAL;
  786. /* allow single-shot interrupt transfers, at bogus rates */
  787. }
  788. uurb->number_of_packets = 0;
  789. if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
  790. return -EINVAL;
  791. if (!access_ok((uurb->endpoint & USB_DIR_IN) ? VERIFY_WRITE : VERIFY_READ, uurb->buffer, uurb->buffer_length))
  792. return -EFAULT;
  793. break;
  794. case USBDEVFS_URB_TYPE_ISO:
  795. /* arbitrary limit */
  796. if (uurb->number_of_packets < 1 || uurb->number_of_packets > 128)
  797. return -EINVAL;
  798. if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
  799. != USB_ENDPOINT_XFER_ISOC)
  800. return -EINVAL;
  801. interval = 1 << min (15, ep->desc.bInterval - 1);
  802. isofrmlen = sizeof(struct usbdevfs_iso_packet_desc) * uurb->number_of_packets;
  803. if (!(isopkt = kmalloc(isofrmlen, GFP_KERNEL)))
  804. return -ENOMEM;
  805. if (copy_from_user(isopkt, iso_frame_desc, isofrmlen)) {
  806. kfree(isopkt);
  807. return -EFAULT;
  808. }
  809. for (totlen = u = 0; u < uurb->number_of_packets; u++) {
  810. if (isopkt[u].length > 1023) {
  811. kfree(isopkt);
  812. return -EINVAL;
  813. }
  814. totlen += isopkt[u].length;
  815. }
  816. if (totlen > 32768) {
  817. kfree(isopkt);
  818. return -EINVAL;
  819. }
  820. uurb->buffer_length = totlen;
  821. break;
  822. case USBDEVFS_URB_TYPE_INTERRUPT:
  823. uurb->number_of_packets = 0;
  824. if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
  825. != USB_ENDPOINT_XFER_INT)
  826. return -EINVAL;
  827. if (ps->dev->speed == USB_SPEED_HIGH)
  828. interval = 1 << min (15, ep->desc.bInterval - 1);
  829. else
  830. interval = ep->desc.bInterval;
  831. if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
  832. return -EINVAL;
  833. if (!access_ok((uurb->endpoint & USB_DIR_IN) ? VERIFY_WRITE : VERIFY_READ, uurb->buffer, uurb->buffer_length))
  834. return -EFAULT;
  835. break;
  836. default:
  837. return -EINVAL;
  838. }
  839. if (!(as = alloc_async(uurb->number_of_packets))) {
  840. kfree(isopkt);
  841. kfree(dr);
  842. return -ENOMEM;
  843. }
  844. if (!(as->urb->transfer_buffer = kmalloc(uurb->buffer_length, GFP_KERNEL))) {
  845. kfree(isopkt);
  846. kfree(dr);
  847. free_async(as);
  848. return -ENOMEM;
  849. }
  850. as->urb->dev = ps->dev;
  851. as->urb->pipe = (uurb->type << 30) | __create_pipe(ps->dev, uurb->endpoint & 0xf) | (uurb->endpoint & USB_DIR_IN);
  852. as->urb->transfer_flags = uurb->flags;
  853. as->urb->transfer_buffer_length = uurb->buffer_length;
  854. as->urb->setup_packet = (unsigned char*)dr;
  855. as->urb->start_frame = uurb->start_frame;
  856. as->urb->number_of_packets = uurb->number_of_packets;
  857. as->urb->interval = interval;
  858. as->urb->context = as;
  859. as->urb->complete = async_completed;
  860. for (totlen = u = 0; u < uurb->number_of_packets; u++) {
  861. as->urb->iso_frame_desc[u].offset = totlen;
  862. as->urb->iso_frame_desc[u].length = isopkt[u].length;
  863. totlen += isopkt[u].length;
  864. }
  865. kfree(isopkt);
  866. as->ps = ps;
  867. as->userurb = arg;
  868. if (uurb->endpoint & USB_DIR_IN)
  869. as->userbuffer = uurb->buffer;
  870. else
  871. as->userbuffer = NULL;
  872. as->signr = uurb->signr;
  873. as->ifnum = ifnum;
  874. as->task = current;
  875. if (!(uurb->endpoint & USB_DIR_IN)) {
  876. if (copy_from_user(as->urb->transfer_buffer, uurb->buffer, as->urb->transfer_buffer_length)) {
  877. free_async(as);
  878. return -EFAULT;
  879. }
  880. }
  881. async_newpending(as);
  882. if ((ret = usb_submit_urb(as->urb, GFP_KERNEL))) {
  883. dev_printk(KERN_DEBUG, &ps->dev->dev, "usbfs: usb_submit_urb returned %d\n", ret);
  884. async_removepending(as);
  885. free_async(as);
  886. return ret;
  887. }
  888. return 0;
  889. }
  890. static int proc_submiturb(struct dev_state *ps, void __user *arg)
  891. {
  892. struct usbdevfs_urb uurb;
  893. if (copy_from_user(&uurb, arg, sizeof(uurb)))
  894. return -EFAULT;
  895. return proc_do_submiturb(ps, &uurb, (((struct usbdevfs_urb __user *)arg)->iso_frame_desc), arg);
  896. }
  897. static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
  898. {
  899. struct async *as;
  900. as = async_getpending(ps, arg);
  901. if (!as)
  902. return -EINVAL;
  903. usb_kill_urb(as->urb);
  904. return 0;
  905. }
  906. static int processcompl(struct async *as, void __user * __user *arg)
  907. {
  908. struct urb *urb = as->urb;
  909. struct usbdevfs_urb __user *userurb = as->userurb;
  910. void __user *addr = as->userurb;
  911. unsigned int i;
  912. if (as->userbuffer)
  913. if (copy_to_user(as->userbuffer, urb->transfer_buffer, urb->transfer_buffer_length))
  914. return -EFAULT;
  915. if (put_user(urb->status, &userurb->status))
  916. return -EFAULT;
  917. if (put_user(urb->actual_length, &userurb->actual_length))
  918. return -EFAULT;
  919. if (put_user(urb->error_count, &userurb->error_count))
  920. return -EFAULT;
  921. if (usb_pipeisoc(urb->pipe)) {
  922. for (i = 0; i < urb->number_of_packets; i++) {
  923. if (put_user(urb->iso_frame_desc[i].actual_length,
  924. &userurb->iso_frame_desc[i].actual_length))
  925. return -EFAULT;
  926. if (put_user(urb->iso_frame_desc[i].status,
  927. &userurb->iso_frame_desc[i].status))
  928. return -EFAULT;
  929. }
  930. }
  931. free_async(as);
  932. if (put_user(addr, (void __user * __user *)arg))
  933. return -EFAULT;
  934. return 0;
  935. }
  936. static struct async* reap_as(struct dev_state *ps)
  937. {
  938. DECLARE_WAITQUEUE(wait, current);
  939. struct async *as = NULL;
  940. struct usb_device *dev = ps->dev;
  941. add_wait_queue(&ps->wait, &wait);
  942. for (;;) {
  943. __set_current_state(TASK_INTERRUPTIBLE);
  944. if ((as = async_getcompleted(ps)))
  945. break;
  946. if (signal_pending(current))
  947. break;
  948. usb_unlock_device(dev);
  949. schedule();
  950. usb_lock_device(dev);
  951. }
  952. remove_wait_queue(&ps->wait, &wait);
  953. set_current_state(TASK_RUNNING);
  954. return as;
  955. }
  956. static int proc_reapurb(struct dev_state *ps, void __user *arg)
  957. {
  958. struct async *as = reap_as(ps);
  959. if (as)
  960. return processcompl(as, (void __user * __user *)arg);
  961. if (signal_pending(current))
  962. return -EINTR;
  963. return -EIO;
  964. }
  965. static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
  966. {
  967. struct async *as;
  968. if (!(as = async_getcompleted(ps)))
  969. return -EAGAIN;
  970. return processcompl(as, (void __user * __user *)arg);
  971. }
  972. #ifdef CONFIG_COMPAT
  973. static int get_urb32(struct usbdevfs_urb *kurb,
  974. struct usbdevfs_urb32 __user *uurb)
  975. {
  976. __u32 uptr;
  977. if (get_user(kurb->type, &uurb->type) ||
  978. __get_user(kurb->endpoint, &uurb->endpoint) ||
  979. __get_user(kurb->status, &uurb->status) ||
  980. __get_user(kurb->flags, &uurb->flags) ||
  981. __get_user(kurb->buffer_length, &uurb->buffer_length) ||
  982. __get_user(kurb->actual_length, &uurb->actual_length) ||
  983. __get_user(kurb->start_frame, &uurb->start_frame) ||
  984. __get_user(kurb->number_of_packets, &uurb->number_of_packets) ||
  985. __get_user(kurb->error_count, &uurb->error_count) ||
  986. __get_user(kurb->signr, &uurb->signr))
  987. return -EFAULT;
  988. if (__get_user(uptr, &uurb->buffer))
  989. return -EFAULT;
  990. kurb->buffer = compat_ptr(uptr);
  991. if (__get_user(uptr, &uurb->buffer))
  992. return -EFAULT;
  993. kurb->usercontext = compat_ptr(uptr);
  994. return 0;
  995. }
  996. static int proc_submiturb_compat(struct dev_state *ps, void __user *arg)
  997. {
  998. struct usbdevfs_urb uurb;
  999. if (get_urb32(&uurb,(struct usbdevfs_urb32 *)arg))
  1000. return -EFAULT;
  1001. return proc_do_submiturb(ps, &uurb, ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc, arg);
  1002. }
  1003. static int processcompl_compat(struct async *as, void __user * __user *arg)
  1004. {
  1005. struct urb *urb = as->urb;
  1006. struct usbdevfs_urb32 __user *userurb = as->userurb;
  1007. void __user *addr = as->userurb;
  1008. unsigned int i;
  1009. if (as->userbuffer)
  1010. if (copy_to_user(as->userbuffer, urb->transfer_buffer, urb->transfer_buffer_length))
  1011. return -EFAULT;
  1012. if (put_user(urb->status, &userurb->status))
  1013. return -EFAULT;
  1014. if (put_user(urb->actual_length, &userurb->actual_length))
  1015. return -EFAULT;
  1016. if (put_user(urb->error_count, &userurb->error_count))
  1017. return -EFAULT;
  1018. if (usb_pipeisoc(urb->pipe)) {
  1019. for (i = 0; i < urb->number_of_packets; i++) {
  1020. if (put_user(urb->iso_frame_desc[i].actual_length,
  1021. &userurb->iso_frame_desc[i].actual_length))
  1022. return -EFAULT;
  1023. if (put_user(urb->iso_frame_desc[i].status,
  1024. &userurb->iso_frame_desc[i].status))
  1025. return -EFAULT;
  1026. }
  1027. }
  1028. free_async(as);
  1029. if (put_user((u32)(u64)addr, (u32 __user *)arg))
  1030. return -EFAULT;
  1031. return 0;
  1032. }
  1033. static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
  1034. {
  1035. struct async *as = reap_as(ps);
  1036. if (as)
  1037. return processcompl_compat(as, (void __user * __user *)arg);
  1038. if (signal_pending(current))
  1039. return -EINTR;
  1040. return -EIO;
  1041. }
  1042. static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
  1043. {
  1044. struct async *as;
  1045. if (!(as = async_getcompleted(ps)))
  1046. return -EAGAIN;
  1047. return processcompl_compat(as, (void __user * __user *)arg);
  1048. }
  1049. #endif
  1050. static int proc_disconnectsignal(struct dev_state *ps, void __user *arg)
  1051. {
  1052. struct usbdevfs_disconnectsignal ds;
  1053. if (copy_from_user(&ds, arg, sizeof(ds)))
  1054. return -EFAULT;
  1055. if (ds.signr != 0 && (ds.signr < SIGRTMIN || ds.signr > SIGRTMAX))
  1056. return -EINVAL;
  1057. ps->discsignr = ds.signr;
  1058. ps->disccontext = ds.context;
  1059. return 0;
  1060. }
  1061. static int proc_claiminterface(struct dev_state *ps, void __user *arg)
  1062. {
  1063. unsigned int ifnum;
  1064. if (get_user(ifnum, (unsigned int __user *)arg))
  1065. return -EFAULT;
  1066. return claimintf(ps, ifnum);
  1067. }
  1068. static int proc_releaseinterface(struct dev_state *ps, void __user *arg)
  1069. {
  1070. unsigned int ifnum;
  1071. int ret;
  1072. if (get_user(ifnum, (unsigned int __user *)arg))
  1073. return -EFAULT;
  1074. if ((ret = releaseintf(ps, ifnum)) < 0)
  1075. return ret;
  1076. destroy_async_on_interface (ps, ifnum);
  1077. return 0;
  1078. }
  1079. static int proc_ioctl (struct dev_state *ps, void __user *arg)
  1080. {
  1081. struct usbdevfs_ioctl ctrl;
  1082. int size;
  1083. void *buf = NULL;
  1084. int retval = 0;
  1085. struct usb_interface *intf = NULL;
  1086. struct usb_driver *driver = NULL;
  1087. int i;
  1088. /* get input parameters and alloc buffer */
  1089. if (copy_from_user(&ctrl, arg, sizeof (ctrl)))
  1090. return -EFAULT;
  1091. if ((size = _IOC_SIZE (ctrl.ioctl_code)) > 0) {
  1092. if ((buf = kmalloc (size, GFP_KERNEL)) == NULL)
  1093. return -ENOMEM;
  1094. if ((_IOC_DIR(ctrl.ioctl_code) & _IOC_WRITE)) {
  1095. if (copy_from_user (buf, ctrl.data, size)) {
  1096. kfree(buf);
  1097. return -EFAULT;
  1098. }
  1099. } else {
  1100. memset (buf, 0, size);
  1101. }
  1102. }
  1103. if (!connected(ps->dev)) {
  1104. kfree(buf);
  1105. return -ENODEV;
  1106. }
  1107. if (ps->dev->state != USB_STATE_CONFIGURED)
  1108. retval = -EHOSTUNREACH;
  1109. else if (!(intf = usb_ifnum_to_if (ps->dev, ctrl.ifno)))
  1110. retval = -EINVAL;
  1111. else switch (ctrl.ioctl_code) {
  1112. /* disconnect kernel driver from interface */
  1113. case USBDEVFS_DISCONNECT:
  1114. /* don't allow the user to unbind the hub driver from
  1115. * a hub with children to manage */
  1116. for (i = 0; i < ps->dev->maxchild; ++i) {
  1117. if (ps->dev->children[i])
  1118. retval = -EBUSY;
  1119. }
  1120. if (retval)
  1121. break;
  1122. down_write(&usb_bus_type.subsys.rwsem);
  1123. if (intf->dev.driver) {
  1124. driver = to_usb_driver(intf->dev.driver);
  1125. dev_dbg (&intf->dev, "disconnect by usbfs\n");
  1126. usb_driver_release_interface(driver, intf);
  1127. } else
  1128. retval = -ENODATA;
  1129. up_write(&usb_bus_type.subsys.rwsem);
  1130. break;
  1131. /* let kernel drivers try to (re)bind to the interface */
  1132. case USBDEVFS_CONNECT:
  1133. usb_unlock_device(ps->dev);
  1134. usb_lock_all_devices();
  1135. bus_rescan_devices(intf->dev.bus);
  1136. usb_unlock_all_devices();
  1137. usb_lock_device(ps->dev);
  1138. break;
  1139. /* talk directly to the interface's driver */
  1140. default:
  1141. down_read(&usb_bus_type.subsys.rwsem);
  1142. if (intf->dev.driver)
  1143. driver = to_usb_driver(intf->dev.driver);
  1144. if (driver == NULL || driver->ioctl == NULL) {
  1145. retval = -ENOTTY;
  1146. } else {
  1147. retval = driver->ioctl (intf, ctrl.ioctl_code, buf);
  1148. if (retval == -ENOIOCTLCMD)
  1149. retval = -ENOTTY;
  1150. }
  1151. up_read(&usb_bus_type.subsys.rwsem);
  1152. }
  1153. /* cleanup and return */
  1154. if (retval >= 0
  1155. && (_IOC_DIR (ctrl.ioctl_code) & _IOC_READ) != 0
  1156. && size > 0
  1157. && copy_to_user (ctrl.data, buf, size) != 0)
  1158. retval = -EFAULT;
  1159. kfree(buf);
  1160. return retval;
  1161. }
  1162. /*
  1163. * NOTE: All requests here that have interface numbers as parameters
  1164. * are assuming that somehow the configuration has been prevented from
  1165. * changing. But there's no mechanism to ensure that...
  1166. */
  1167. static int usbdev_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
  1168. {
  1169. struct dev_state *ps = (struct dev_state *)file->private_data;
  1170. struct usb_device *dev = ps->dev;
  1171. void __user *p = (void __user *)arg;
  1172. int ret = -ENOTTY;
  1173. if (!(file->f_mode & FMODE_WRITE))
  1174. return -EPERM;
  1175. usb_lock_device(dev);
  1176. if (!connected(dev)) {
  1177. usb_unlock_device(dev);
  1178. return -ENODEV;
  1179. }
  1180. switch (cmd) {
  1181. case USBDEVFS_CONTROL:
  1182. snoop(&dev->dev, "%s: CONTROL\n", __FUNCTION__);
  1183. ret = proc_control(ps, p);
  1184. if (ret >= 0)
  1185. inode->i_mtime = CURRENT_TIME;
  1186. break;
  1187. case USBDEVFS_BULK:
  1188. snoop(&dev->dev, "%s: BULK\n", __FUNCTION__);
  1189. ret = proc_bulk(ps, p);
  1190. if (ret >= 0)
  1191. inode->i_mtime = CURRENT_TIME;
  1192. break;
  1193. case USBDEVFS_RESETEP:
  1194. snoop(&dev->dev, "%s: RESETEP\n", __FUNCTION__);
  1195. ret = proc_resetep(ps, p);
  1196. if (ret >= 0)
  1197. inode->i_mtime = CURRENT_TIME;
  1198. break;
  1199. case USBDEVFS_RESET:
  1200. snoop(&dev->dev, "%s: RESET\n", __FUNCTION__);
  1201. ret = proc_resetdevice(ps);
  1202. break;
  1203. case USBDEVFS_CLEAR_HALT:
  1204. snoop(&dev->dev, "%s: CLEAR_HALT\n", __FUNCTION__);
  1205. ret = proc_clearhalt(ps, p);
  1206. if (ret >= 0)
  1207. inode->i_mtime = CURRENT_TIME;
  1208. break;
  1209. case USBDEVFS_GETDRIVER:
  1210. snoop(&dev->dev, "%s: GETDRIVER\n", __FUNCTION__);
  1211. ret = proc_getdriver(ps, p);
  1212. break;
  1213. case USBDEVFS_CONNECTINFO:
  1214. snoop(&dev->dev, "%s: CONNECTINFO\n", __FUNCTION__);
  1215. ret = proc_connectinfo(ps, p);
  1216. break;
  1217. case USBDEVFS_SETINTERFACE:
  1218. snoop(&dev->dev, "%s: SETINTERFACE\n", __FUNCTION__);
  1219. ret = proc_setintf(ps, p);
  1220. break;
  1221. case USBDEVFS_SETCONFIGURATION:
  1222. snoop(&dev->dev, "%s: SETCONFIGURATION\n", __FUNCTION__);
  1223. ret = proc_setconfig(ps, p);
  1224. break;
  1225. case USBDEVFS_SUBMITURB:
  1226. snoop(&dev->dev, "%s: SUBMITURB\n", __FUNCTION__);
  1227. ret = proc_submiturb(ps, p);
  1228. if (ret >= 0)
  1229. inode->i_mtime = CURRENT_TIME;
  1230. break;
  1231. #ifdef CONFIG_COMPAT
  1232. case USBDEVFS_SUBMITURB32:
  1233. snoop(&dev->dev, "%s: SUBMITURB32\n", __FUNCTION__);
  1234. ret = proc_submiturb_compat(ps, p);
  1235. if (ret >= 0)
  1236. inode->i_mtime = CURRENT_TIME;
  1237. break;
  1238. case USBDEVFS_REAPURB32:
  1239. snoop(&dev->dev, "%s: REAPURB32\n", __FUNCTION__);
  1240. ret = proc_reapurb_compat(ps, p);
  1241. break;
  1242. case USBDEVFS_REAPURBNDELAY32:
  1243. snoop(&dev->dev, "%s: REAPURBDELAY32\n", __FUNCTION__);
  1244. ret = proc_reapurbnonblock_compat(ps, p);
  1245. break;
  1246. #endif
  1247. case USBDEVFS_DISCARDURB:
  1248. snoop(&dev->dev, "%s: DISCARDURB\n", __FUNCTION__);
  1249. ret = proc_unlinkurb(ps, p);
  1250. break;
  1251. case USBDEVFS_REAPURB:
  1252. snoop(&dev->dev, "%s: REAPURB\n", __FUNCTION__);
  1253. ret = proc_reapurb(ps, p);
  1254. break;
  1255. case USBDEVFS_REAPURBNDELAY:
  1256. snoop(&dev->dev, "%s: REAPURBDELAY\n", __FUNCTION__);
  1257. ret = proc_reapurbnonblock(ps, p);
  1258. break;
  1259. case USBDEVFS_DISCSIGNAL:
  1260. snoop(&dev->dev, "%s: DISCSIGNAL\n", __FUNCTION__);
  1261. ret = proc_disconnectsignal(ps, p);
  1262. break;
  1263. case USBDEVFS_CLAIMINTERFACE:
  1264. snoop(&dev->dev, "%s: CLAIMINTERFACE\n", __FUNCTION__);
  1265. ret = proc_claiminterface(ps, p);
  1266. break;
  1267. case USBDEVFS_RELEASEINTERFACE:
  1268. snoop(&dev->dev, "%s: RELEASEINTERFACE\n", __FUNCTION__);
  1269. ret = proc_releaseinterface(ps, p);
  1270. break;
  1271. case USBDEVFS_IOCTL:
  1272. snoop(&dev->dev, "%s: IOCTL\n", __FUNCTION__);
  1273. ret = proc_ioctl(ps, p);
  1274. break;
  1275. }
  1276. usb_unlock_device(dev);
  1277. if (ret >= 0)
  1278. inode->i_atime = CURRENT_TIME;
  1279. return ret;
  1280. }
  1281. /* No kernel lock - fine */
  1282. static unsigned int usbdev_poll(struct file *file, struct poll_table_struct *wait)
  1283. {
  1284. struct dev_state *ps = (struct dev_state *)file->private_data;
  1285. unsigned int mask = 0;
  1286. poll_wait(file, &ps->wait, wait);
  1287. if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
  1288. mask |= POLLOUT | POLLWRNORM;
  1289. if (!connected(ps->dev))
  1290. mask |= POLLERR | POLLHUP;
  1291. return mask;
  1292. }
  1293. struct file_operations usbfs_device_file_operations = {
  1294. .llseek = usbdev_lseek,
  1295. .read = usbdev_read,
  1296. .poll = usbdev_poll,
  1297. .ioctl = usbdev_ioctl,
  1298. .open = usbdev_open,
  1299. .release = usbdev_release,
  1300. };