devio.c 68 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*****************************************************************************/
  3. /*
  4. * devio.c -- User space communication with USB devices.
  5. *
  6. * Copyright (C) 1999-2000 Thomas Sailer (sailer@ife.ee.ethz.ch)
  7. *
  8. * This file implements the usbfs/x/y files, where
  9. * x is the bus number and y the device number.
  10. *
  11. * It allows user space programs/"drivers" to communicate directly
  12. * with USB devices without intervening kernel driver.
  13. *
  14. * Revision history
  15. * 22.12.1999 0.1 Initial release (split from proc_usb.c)
  16. * 04.01.2000 0.2 Turned into its own filesystem
  17. * 30.09.2005 0.3 Fix user-triggerable oops in async URB delivery
  18. * (CAN-2005-3055)
  19. */
  20. /*****************************************************************************/
  21. #include <linux/fs.h>
  22. #include <linux/mm.h>
  23. #include <linux/sched/signal.h>
  24. #include <linux/slab.h>
  25. #include <linux/signal.h>
  26. #include <linux/poll.h>
  27. #include <linux/module.h>
  28. #include <linux/string.h>
  29. #include <linux/usb.h>
  30. #include <linux/usbdevice_fs.h>
  31. #include <linux/usb/hcd.h> /* for usbcore internals */
  32. #include <linux/cdev.h>
  33. #include <linux/notifier.h>
  34. #include <linux/security.h>
  35. #include <linux/user_namespace.h>
  36. #include <linux/scatterlist.h>
  37. #include <linux/uaccess.h>
  38. #include <linux/dma-mapping.h>
  39. #include <asm/byteorder.h>
  40. #include <linux/moduleparam.h>
  41. #include "usb.h"
  42. #ifdef CONFIG_PM
  43. #define MAYBE_CAP_SUSPEND USBDEVFS_CAP_SUSPEND
  44. #else
  45. #define MAYBE_CAP_SUSPEND 0
  46. #endif
  47. #define USB_MAXBUS 64
  48. #define USB_DEVICE_MAX (USB_MAXBUS * 128)
  49. #define USB_SG_SIZE 16384 /* split-size for large txs */
  50. /* Mutual exclusion for ps->list in resume vs. release and remove */
  51. static DEFINE_MUTEX(usbfs_mutex);
  52. struct usb_dev_state {
  53. struct list_head list; /* state list */
  54. struct usb_device *dev;
  55. struct file *file;
  56. spinlock_t lock; /* protects the async urb lists */
  57. struct list_head async_pending;
  58. struct list_head async_completed;
  59. struct list_head memory_list;
  60. wait_queue_head_t wait; /* wake up if a request completed */
  61. wait_queue_head_t wait_for_resume; /* wake up upon runtime resume */
  62. unsigned int discsignr;
  63. struct pid *disc_pid;
  64. const struct cred *cred;
  65. sigval_t disccontext;
  66. unsigned long ifclaimed;
  67. u32 disabled_bulk_eps;
  68. unsigned long interface_allowed_mask;
  69. int not_yet_resumed;
  70. bool suspend_allowed;
  71. bool privileges_dropped;
  72. };
  73. struct usb_memory {
  74. struct list_head memlist;
  75. int vma_use_count;
  76. int urb_use_count;
  77. u32 size;
  78. void *mem;
  79. dma_addr_t dma_handle;
  80. unsigned long vm_start;
  81. struct usb_dev_state *ps;
  82. };
  83. struct async {
  84. struct list_head asynclist;
  85. struct usb_dev_state *ps;
  86. struct pid *pid;
  87. const struct cred *cred;
  88. unsigned int signr;
  89. unsigned int ifnum;
  90. void __user *userbuffer;
  91. void __user *userurb;
  92. sigval_t userurb_sigval;
  93. struct urb *urb;
  94. struct usb_memory *usbm;
  95. unsigned int mem_usage;
  96. int status;
  97. u8 bulk_addr;
  98. u8 bulk_status;
  99. };
  100. static bool usbfs_snoop;
  101. module_param(usbfs_snoop, bool, S_IRUGO | S_IWUSR);
  102. MODULE_PARM_DESC(usbfs_snoop, "true to log all usbfs traffic");
  103. static unsigned usbfs_snoop_max = 65536;
  104. module_param(usbfs_snoop_max, uint, S_IRUGO | S_IWUSR);
  105. MODULE_PARM_DESC(usbfs_snoop_max,
  106. "maximum number of bytes to print while snooping");
  107. #define snoop(dev, format, arg...) \
  108. do { \
  109. if (usbfs_snoop) \
  110. dev_info(dev, format, ## arg); \
  111. } while (0)
  112. enum snoop_when {
  113. SUBMIT, COMPLETE
  114. };
  115. #define USB_DEVICE_DEV MKDEV(USB_DEVICE_MAJOR, 0)
  116. /* Limit on the total amount of memory we can allocate for transfers */
  117. static u32 usbfs_memory_mb = 16;
  118. module_param(usbfs_memory_mb, uint, 0644);
  119. MODULE_PARM_DESC(usbfs_memory_mb,
  120. "maximum MB allowed for usbfs buffers (0 = no limit)");
  121. /* Hard limit, necessary to avoid arithmetic overflow */
  122. #define USBFS_XFER_MAX (UINT_MAX / 2 - 1000000)
  123. static atomic64_t usbfs_memory_usage; /* Total memory currently allocated */
  124. /* Check whether it's okay to allocate more memory for a transfer */
  125. static int usbfs_increase_memory_usage(u64 amount)
  126. {
  127. u64 lim;
  128. lim = READ_ONCE(usbfs_memory_mb);
  129. lim <<= 20;
  130. atomic64_add(amount, &usbfs_memory_usage);
  131. if (lim > 0 && atomic64_read(&usbfs_memory_usage) > lim) {
  132. atomic64_sub(amount, &usbfs_memory_usage);
  133. return -ENOMEM;
  134. }
  135. return 0;
  136. }
  137. /* Memory for a transfer is being deallocated */
  138. static void usbfs_decrease_memory_usage(u64 amount)
  139. {
  140. atomic64_sub(amount, &usbfs_memory_usage);
  141. }
  142. static int connected(struct usb_dev_state *ps)
  143. {
  144. return (!list_empty(&ps->list) &&
  145. ps->dev->state != USB_STATE_NOTATTACHED);
  146. }
  147. static void dec_usb_memory_use_count(struct usb_memory *usbm, int *count)
  148. {
  149. struct usb_dev_state *ps = usbm->ps;
  150. unsigned long flags;
  151. spin_lock_irqsave(&ps->lock, flags);
  152. --*count;
  153. if (usbm->urb_use_count == 0 && usbm->vma_use_count == 0) {
  154. list_del(&usbm->memlist);
  155. spin_unlock_irqrestore(&ps->lock, flags);
  156. usb_free_coherent(ps->dev, usbm->size, usbm->mem,
  157. usbm->dma_handle);
  158. usbfs_decrease_memory_usage(
  159. usbm->size + sizeof(struct usb_memory));
  160. kfree(usbm);
  161. } else {
  162. spin_unlock_irqrestore(&ps->lock, flags);
  163. }
  164. }
  165. static void usbdev_vm_open(struct vm_area_struct *vma)
  166. {
  167. struct usb_memory *usbm = vma->vm_private_data;
  168. unsigned long flags;
  169. spin_lock_irqsave(&usbm->ps->lock, flags);
  170. ++usbm->vma_use_count;
  171. spin_unlock_irqrestore(&usbm->ps->lock, flags);
  172. }
  173. static void usbdev_vm_close(struct vm_area_struct *vma)
  174. {
  175. struct usb_memory *usbm = vma->vm_private_data;
  176. dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
  177. }
  178. static const struct vm_operations_struct usbdev_vm_ops = {
  179. .open = usbdev_vm_open,
  180. .close = usbdev_vm_close
  181. };
  182. static int usbdev_mmap(struct file *file, struct vm_area_struct *vma)
  183. {
  184. struct usb_memory *usbm = NULL;
  185. struct usb_dev_state *ps = file->private_data;
  186. struct usb_hcd *hcd = bus_to_hcd(ps->dev->bus);
  187. size_t size = vma->vm_end - vma->vm_start;
  188. void *mem;
  189. unsigned long flags;
  190. dma_addr_t dma_handle;
  191. int ret;
  192. ret = usbfs_increase_memory_usage(size + sizeof(struct usb_memory));
  193. if (ret)
  194. goto error;
  195. usbm = kzalloc(sizeof(struct usb_memory), GFP_KERNEL);
  196. if (!usbm) {
  197. ret = -ENOMEM;
  198. goto error_decrease_mem;
  199. }
  200. mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN,
  201. &dma_handle);
  202. if (!mem) {
  203. ret = -ENOMEM;
  204. goto error_free_usbm;
  205. }
  206. memset(mem, 0, size);
  207. usbm->mem = mem;
  208. usbm->dma_handle = dma_handle;
  209. usbm->size = size;
  210. usbm->ps = ps;
  211. usbm->vm_start = vma->vm_start;
  212. usbm->vma_use_count = 1;
  213. INIT_LIST_HEAD(&usbm->memlist);
  214. if (hcd->localmem_pool || !hcd_uses_dma(hcd)) {
  215. if (remap_pfn_range(vma, vma->vm_start,
  216. virt_to_phys(usbm->mem) >> PAGE_SHIFT,
  217. size, vma->vm_page_prot) < 0) {
  218. dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
  219. return -EAGAIN;
  220. }
  221. } else {
  222. if (dma_mmap_coherent(hcd->self.sysdev, vma, mem, dma_handle,
  223. size)) {
  224. dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
  225. return -EAGAIN;
  226. }
  227. }
  228. vma->vm_flags |= VM_IO;
  229. vma->vm_flags |= (VM_DONTEXPAND | VM_DONTDUMP);
  230. vma->vm_ops = &usbdev_vm_ops;
  231. vma->vm_private_data = usbm;
  232. spin_lock_irqsave(&ps->lock, flags);
  233. list_add_tail(&usbm->memlist, &ps->memory_list);
  234. spin_unlock_irqrestore(&ps->lock, flags);
  235. return 0;
  236. error_free_usbm:
  237. kfree(usbm);
  238. error_decrease_mem:
  239. usbfs_decrease_memory_usage(size + sizeof(struct usb_memory));
  240. error:
  241. return ret;
  242. }
  243. static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
  244. loff_t *ppos)
  245. {
  246. struct usb_dev_state *ps = file->private_data;
  247. struct usb_device *dev = ps->dev;
  248. ssize_t ret = 0;
  249. unsigned len;
  250. loff_t pos;
  251. int i;
  252. pos = *ppos;
  253. usb_lock_device(dev);
  254. if (!connected(ps)) {
  255. ret = -ENODEV;
  256. goto err;
  257. } else if (pos < 0) {
  258. ret = -EINVAL;
  259. goto err;
  260. }
  261. if (pos < sizeof(struct usb_device_descriptor)) {
  262. /* 18 bytes - fits on the stack */
  263. struct usb_device_descriptor temp_desc;
  264. memcpy(&temp_desc, &dev->descriptor, sizeof(dev->descriptor));
  265. le16_to_cpus(&temp_desc.bcdUSB);
  266. le16_to_cpus(&temp_desc.idVendor);
  267. le16_to_cpus(&temp_desc.idProduct);
  268. le16_to_cpus(&temp_desc.bcdDevice);
  269. len = sizeof(struct usb_device_descriptor) - pos;
  270. if (len > nbytes)
  271. len = nbytes;
  272. if (copy_to_user(buf, ((char *)&temp_desc) + pos, len)) {
  273. ret = -EFAULT;
  274. goto err;
  275. }
  276. *ppos += len;
  277. buf += len;
  278. nbytes -= len;
  279. ret += len;
  280. }
  281. pos = sizeof(struct usb_device_descriptor);
  282. for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {
  283. struct usb_config_descriptor *config =
  284. (struct usb_config_descriptor *)dev->rawdescriptors[i];
  285. unsigned int length = le16_to_cpu(config->wTotalLength);
  286. if (*ppos < pos + length) {
  287. /* The descriptor may claim to be longer than it
  288. * really is. Here is the actual allocated length. */
  289. unsigned alloclen =
  290. le16_to_cpu(dev->config[i].desc.wTotalLength);
  291. len = length - (*ppos - pos);
  292. if (len > nbytes)
  293. len = nbytes;
  294. /* Simply don't write (skip over) unallocated parts */
  295. if (alloclen > (*ppos - pos)) {
  296. alloclen -= (*ppos - pos);
  297. if (copy_to_user(buf,
  298. dev->rawdescriptors[i] + (*ppos - pos),
  299. min(len, alloclen))) {
  300. ret = -EFAULT;
  301. goto err;
  302. }
  303. }
  304. *ppos += len;
  305. buf += len;
  306. nbytes -= len;
  307. ret += len;
  308. }
  309. pos += length;
  310. }
  311. err:
  312. usb_unlock_device(dev);
  313. return ret;
  314. }
  315. /*
  316. * async list handling
  317. */
  318. static struct async *alloc_async(unsigned int numisoframes)
  319. {
  320. struct async *as;
  321. as = kzalloc(sizeof(struct async), GFP_KERNEL);
  322. if (!as)
  323. return NULL;
  324. as->urb = usb_alloc_urb(numisoframes, GFP_KERNEL);
  325. if (!as->urb) {
  326. kfree(as);
  327. return NULL;
  328. }
  329. return as;
  330. }
  331. static void free_async(struct async *as)
  332. {
  333. int i;
  334. put_pid(as->pid);
  335. if (as->cred)
  336. put_cred(as->cred);
  337. for (i = 0; i < as->urb->num_sgs; i++) {
  338. if (sg_page(&as->urb->sg[i]))
  339. kfree(sg_virt(&as->urb->sg[i]));
  340. }
  341. kfree(as->urb->sg);
  342. if (as->usbm == NULL)
  343. kfree(as->urb->transfer_buffer);
  344. else
  345. dec_usb_memory_use_count(as->usbm, &as->usbm->urb_use_count);
  346. kfree(as->urb->setup_packet);
  347. usb_free_urb(as->urb);
  348. usbfs_decrease_memory_usage(as->mem_usage);
  349. kfree(as);
  350. }
  351. static void async_newpending(struct async *as)
  352. {
  353. struct usb_dev_state *ps = as->ps;
  354. unsigned long flags;
  355. spin_lock_irqsave(&ps->lock, flags);
  356. list_add_tail(&as->asynclist, &ps->async_pending);
  357. spin_unlock_irqrestore(&ps->lock, flags);
  358. }
  359. static void async_removepending(struct async *as)
  360. {
  361. struct usb_dev_state *ps = as->ps;
  362. unsigned long flags;
  363. spin_lock_irqsave(&ps->lock, flags);
  364. list_del_init(&as->asynclist);
  365. spin_unlock_irqrestore(&ps->lock, flags);
  366. }
  367. static struct async *async_getcompleted(struct usb_dev_state *ps)
  368. {
  369. unsigned long flags;
  370. struct async *as = NULL;
  371. spin_lock_irqsave(&ps->lock, flags);
  372. if (!list_empty(&ps->async_completed)) {
  373. as = list_entry(ps->async_completed.next, struct async,
  374. asynclist);
  375. list_del_init(&as->asynclist);
  376. }
  377. spin_unlock_irqrestore(&ps->lock, flags);
  378. return as;
  379. }
  380. static struct async *async_getpending(struct usb_dev_state *ps,
  381. void __user *userurb)
  382. {
  383. struct async *as;
  384. list_for_each_entry(as, &ps->async_pending, asynclist)
  385. if (as->userurb == userurb) {
  386. list_del_init(&as->asynclist);
  387. return as;
  388. }
  389. return NULL;
  390. }
  391. static void snoop_urb(struct usb_device *udev,
  392. void __user *userurb, int pipe, unsigned length,
  393. int timeout_or_status, enum snoop_when when,
  394. unsigned char *data, unsigned data_len)
  395. {
  396. static const char *types[] = {"isoc", "int", "ctrl", "bulk"};
  397. static const char *dirs[] = {"out", "in"};
  398. int ep;
  399. const char *t, *d;
  400. if (!usbfs_snoop)
  401. return;
  402. ep = usb_pipeendpoint(pipe);
  403. t = types[usb_pipetype(pipe)];
  404. d = dirs[!!usb_pipein(pipe)];
  405. if (userurb) { /* Async */
  406. if (when == SUBMIT)
  407. dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
  408. "length %u\n",
  409. userurb, ep, t, d, length);
  410. else
  411. dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
  412. "actual_length %u status %d\n",
  413. userurb, ep, t, d, length,
  414. timeout_or_status);
  415. } else {
  416. if (when == SUBMIT)
  417. dev_info(&udev->dev, "ep%d %s-%s, length %u, "
  418. "timeout %d\n",
  419. ep, t, d, length, timeout_or_status);
  420. else
  421. dev_info(&udev->dev, "ep%d %s-%s, actual_length %u, "
  422. "status %d\n",
  423. ep, t, d, length, timeout_or_status);
  424. }
  425. data_len = min(data_len, usbfs_snoop_max);
  426. if (data && data_len > 0) {
  427. print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
  428. data, data_len, 1);
  429. }
  430. }
  431. static void snoop_urb_data(struct urb *urb, unsigned len)
  432. {
  433. int i, size;
  434. len = min(len, usbfs_snoop_max);
  435. if (!usbfs_snoop || len == 0)
  436. return;
  437. if (urb->num_sgs == 0) {
  438. print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
  439. urb->transfer_buffer, len, 1);
  440. return;
  441. }
  442. for (i = 0; i < urb->num_sgs && len; i++) {
  443. size = (len > USB_SG_SIZE) ? USB_SG_SIZE : len;
  444. print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
  445. sg_virt(&urb->sg[i]), size, 1);
  446. len -= size;
  447. }
  448. }
  449. static int copy_urb_data_to_user(u8 __user *userbuffer, struct urb *urb)
  450. {
  451. unsigned i, len, size;
  452. if (urb->number_of_packets > 0) /* Isochronous */
  453. len = urb->transfer_buffer_length;
  454. else /* Non-Isoc */
  455. len = urb->actual_length;
  456. if (urb->num_sgs == 0) {
  457. if (copy_to_user(userbuffer, urb->transfer_buffer, len))
  458. return -EFAULT;
  459. return 0;
  460. }
  461. for (i = 0; i < urb->num_sgs && len; i++) {
  462. size = (len > USB_SG_SIZE) ? USB_SG_SIZE : len;
  463. if (copy_to_user(userbuffer, sg_virt(&urb->sg[i]), size))
  464. return -EFAULT;
  465. userbuffer += size;
  466. len -= size;
  467. }
  468. return 0;
  469. }
  470. #define AS_CONTINUATION 1
  471. #define AS_UNLINK 2
  472. static void cancel_bulk_urbs(struct usb_dev_state *ps, unsigned bulk_addr)
  473. __releases(ps->lock)
  474. __acquires(ps->lock)
  475. {
  476. struct urb *urb;
  477. struct async *as;
  478. /* Mark all the pending URBs that match bulk_addr, up to but not
  479. * including the first one without AS_CONTINUATION. If such an
  480. * URB is encountered then a new transfer has already started so
  481. * the endpoint doesn't need to be disabled; otherwise it does.
  482. */
  483. list_for_each_entry(as, &ps->async_pending, asynclist) {
  484. if (as->bulk_addr == bulk_addr) {
  485. if (as->bulk_status != AS_CONTINUATION)
  486. goto rescan;
  487. as->bulk_status = AS_UNLINK;
  488. as->bulk_addr = 0;
  489. }
  490. }
  491. ps->disabled_bulk_eps |= (1 << bulk_addr);
  492. /* Now carefully unlink all the marked pending URBs */
  493. rescan:
  494. list_for_each_entry_reverse(as, &ps->async_pending, asynclist) {
  495. if (as->bulk_status == AS_UNLINK) {
  496. as->bulk_status = 0; /* Only once */
  497. urb = as->urb;
  498. usb_get_urb(urb);
  499. spin_unlock(&ps->lock); /* Allow completions */
  500. usb_unlink_urb(urb);
  501. usb_put_urb(urb);
  502. spin_lock(&ps->lock);
  503. goto rescan;
  504. }
  505. }
  506. }
  507. static void async_completed(struct urb *urb)
  508. {
  509. struct async *as = urb->context;
  510. struct usb_dev_state *ps = as->ps;
  511. struct pid *pid = NULL;
  512. const struct cred *cred = NULL;
  513. unsigned long flags;
  514. sigval_t addr;
  515. int signr, errno;
  516. spin_lock_irqsave(&ps->lock, flags);
  517. list_move_tail(&as->asynclist, &ps->async_completed);
  518. as->status = urb->status;
  519. signr = as->signr;
  520. if (signr) {
  521. errno = as->status;
  522. addr = as->userurb_sigval;
  523. pid = get_pid(as->pid);
  524. cred = get_cred(as->cred);
  525. }
  526. snoop(&urb->dev->dev, "urb complete\n");
  527. snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
  528. as->status, COMPLETE, NULL, 0);
  529. if (usb_urb_dir_in(urb))
  530. snoop_urb_data(urb, urb->actual_length);
  531. if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
  532. as->status != -ENOENT)
  533. cancel_bulk_urbs(ps, as->bulk_addr);
  534. wake_up(&ps->wait);
  535. spin_unlock_irqrestore(&ps->lock, flags);
  536. if (signr) {
  537. kill_pid_usb_asyncio(signr, errno, addr, pid, cred);
  538. put_pid(pid);
  539. put_cred(cred);
  540. }
  541. }
  542. static void destroy_async(struct usb_dev_state *ps, struct list_head *list)
  543. {
  544. struct urb *urb;
  545. struct async *as;
  546. unsigned long flags;
  547. spin_lock_irqsave(&ps->lock, flags);
  548. while (!list_empty(list)) {
  549. as = list_last_entry(list, struct async, asynclist);
  550. list_del_init(&as->asynclist);
  551. urb = as->urb;
  552. usb_get_urb(urb);
  553. /* drop the spinlock so the completion handler can run */
  554. spin_unlock_irqrestore(&ps->lock, flags);
  555. usb_kill_urb(urb);
  556. usb_put_urb(urb);
  557. spin_lock_irqsave(&ps->lock, flags);
  558. }
  559. spin_unlock_irqrestore(&ps->lock, flags);
  560. }
  561. static void destroy_async_on_interface(struct usb_dev_state *ps,
  562. unsigned int ifnum)
  563. {
  564. struct list_head *p, *q, hitlist;
  565. unsigned long flags;
  566. INIT_LIST_HEAD(&hitlist);
  567. spin_lock_irqsave(&ps->lock, flags);
  568. list_for_each_safe(p, q, &ps->async_pending)
  569. if (ifnum == list_entry(p, struct async, asynclist)->ifnum)
  570. list_move_tail(p, &hitlist);
  571. spin_unlock_irqrestore(&ps->lock, flags);
  572. destroy_async(ps, &hitlist);
  573. }
  574. static void destroy_all_async(struct usb_dev_state *ps)
  575. {
  576. destroy_async(ps, &ps->async_pending);
  577. }
  578. /*
  579. * interface claims are made only at the request of user level code,
  580. * which can also release them (explicitly or by closing files).
  581. * they're also undone when devices disconnect.
  582. */
  583. static int driver_probe(struct usb_interface *intf,
  584. const struct usb_device_id *id)
  585. {
  586. return -ENODEV;
  587. }
  588. static void driver_disconnect(struct usb_interface *intf)
  589. {
  590. struct usb_dev_state *ps = usb_get_intfdata(intf);
  591. unsigned int ifnum = intf->altsetting->desc.bInterfaceNumber;
  592. if (!ps)
  593. return;
  594. /* NOTE: this relies on usbcore having canceled and completed
  595. * all pending I/O requests; 2.6 does that.
  596. */
  597. if (likely(ifnum < 8*sizeof(ps->ifclaimed)))
  598. clear_bit(ifnum, &ps->ifclaimed);
  599. else
  600. dev_warn(&intf->dev, "interface number %u out of range\n",
  601. ifnum);
  602. usb_set_intfdata(intf, NULL);
  603. /* force async requests to complete */
  604. destroy_async_on_interface(ps, ifnum);
  605. }
  606. /* We don't care about suspend/resume of claimed interfaces */
  607. static int driver_suspend(struct usb_interface *intf, pm_message_t msg)
  608. {
  609. return 0;
  610. }
  611. static int driver_resume(struct usb_interface *intf)
  612. {
  613. return 0;
  614. }
  615. /* The following routines apply to the entire device, not interfaces */
  616. void usbfs_notify_suspend(struct usb_device *udev)
  617. {
  618. /* We don't need to handle this */
  619. }
  620. void usbfs_notify_resume(struct usb_device *udev)
  621. {
  622. struct usb_dev_state *ps;
  623. /* Protect against simultaneous remove or release */
  624. mutex_lock(&usbfs_mutex);
  625. list_for_each_entry(ps, &udev->filelist, list) {
  626. WRITE_ONCE(ps->not_yet_resumed, 0);
  627. wake_up_all(&ps->wait_for_resume);
  628. }
  629. mutex_unlock(&usbfs_mutex);
  630. }
  631. struct usb_driver usbfs_driver = {
  632. .name = "usbfs",
  633. .probe = driver_probe,
  634. .disconnect = driver_disconnect,
  635. .suspend = driver_suspend,
  636. .resume = driver_resume,
  637. .supports_autosuspend = 1,
  638. };
  639. static int claimintf(struct usb_dev_state *ps, unsigned int ifnum)
  640. {
  641. struct usb_device *dev = ps->dev;
  642. struct usb_interface *intf;
  643. int err;
  644. if (ifnum >= 8*sizeof(ps->ifclaimed))
  645. return -EINVAL;
  646. /* already claimed */
  647. if (test_bit(ifnum, &ps->ifclaimed))
  648. return 0;
  649. if (ps->privileges_dropped &&
  650. !test_bit(ifnum, &ps->interface_allowed_mask))
  651. return -EACCES;
  652. intf = usb_ifnum_to_if(dev, ifnum);
  653. if (!intf)
  654. err = -ENOENT;
  655. else {
  656. unsigned int old_suppress;
  657. /* suppress uevents while claiming interface */
  658. old_suppress = dev_get_uevent_suppress(&intf->dev);
  659. dev_set_uevent_suppress(&intf->dev, 1);
  660. err = usb_driver_claim_interface(&usbfs_driver, intf, ps);
  661. dev_set_uevent_suppress(&intf->dev, old_suppress);
  662. }
  663. if (err == 0)
  664. set_bit(ifnum, &ps->ifclaimed);
  665. return err;
  666. }
  667. static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum)
  668. {
  669. struct usb_device *dev;
  670. struct usb_interface *intf;
  671. int err;
  672. err = -EINVAL;
  673. if (ifnum >= 8*sizeof(ps->ifclaimed))
  674. return err;
  675. dev = ps->dev;
  676. intf = usb_ifnum_to_if(dev, ifnum);
  677. if (!intf)
  678. err = -ENOENT;
  679. else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) {
  680. unsigned int old_suppress;
  681. /* suppress uevents while releasing interface */
  682. old_suppress = dev_get_uevent_suppress(&intf->dev);
  683. dev_set_uevent_suppress(&intf->dev, 1);
  684. usb_driver_release_interface(&usbfs_driver, intf);
  685. dev_set_uevent_suppress(&intf->dev, old_suppress);
  686. err = 0;
  687. }
  688. return err;
  689. }
  690. static int checkintf(struct usb_dev_state *ps, unsigned int ifnum)
  691. {
  692. if (ps->dev->state != USB_STATE_CONFIGURED)
  693. return -EHOSTUNREACH;
  694. if (ifnum >= 8*sizeof(ps->ifclaimed))
  695. return -EINVAL;
  696. if (test_bit(ifnum, &ps->ifclaimed))
  697. return 0;
  698. /* if not yet claimed, claim it for the driver */
  699. dev_warn(&ps->dev->dev, "usbfs: process %d (%s) did not claim "
  700. "interface %u before use\n", task_pid_nr(current),
  701. current->comm, ifnum);
  702. return claimintf(ps, ifnum);
  703. }
  704. static int findintfep(struct usb_device *dev, unsigned int ep)
  705. {
  706. unsigned int i, j, e;
  707. struct usb_interface *intf;
  708. struct usb_host_interface *alts;
  709. struct usb_endpoint_descriptor *endpt;
  710. if (ep & ~(USB_DIR_IN|0xf))
  711. return -EINVAL;
  712. if (!dev->actconfig)
  713. return -ESRCH;
  714. for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
  715. intf = dev->actconfig->interface[i];
  716. for (j = 0; j < intf->num_altsetting; j++) {
  717. alts = &intf->altsetting[j];
  718. for (e = 0; e < alts->desc.bNumEndpoints; e++) {
  719. endpt = &alts->endpoint[e].desc;
  720. if (endpt->bEndpointAddress == ep)
  721. return alts->desc.bInterfaceNumber;
  722. }
  723. }
  724. }
  725. return -ENOENT;
  726. }
  727. static int check_ctrlrecip(struct usb_dev_state *ps, unsigned int requesttype,
  728. unsigned int request, unsigned int index)
  729. {
  730. int ret = 0;
  731. struct usb_host_interface *alt_setting;
  732. if (ps->dev->state != USB_STATE_UNAUTHENTICATED
  733. && ps->dev->state != USB_STATE_ADDRESS
  734. && ps->dev->state != USB_STATE_CONFIGURED)
  735. return -EHOSTUNREACH;
  736. if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
  737. return 0;
  738. /*
  739. * check for the special corner case 'get_device_id' in the printer
  740. * class specification, which we always want to allow as it is used
  741. * to query things like ink level, etc.
  742. */
  743. if (requesttype == 0xa1 && request == 0) {
  744. alt_setting = usb_find_alt_setting(ps->dev->actconfig,
  745. index >> 8, index & 0xff);
  746. if (alt_setting
  747. && alt_setting->desc.bInterfaceClass == USB_CLASS_PRINTER)
  748. return 0;
  749. }
  750. index &= 0xff;
  751. switch (requesttype & USB_RECIP_MASK) {
  752. case USB_RECIP_ENDPOINT:
  753. if ((index & ~USB_DIR_IN) == 0)
  754. return 0;
  755. ret = findintfep(ps->dev, index);
  756. if (ret < 0) {
  757. /*
  758. * Some not fully compliant Win apps seem to get
  759. * index wrong and have the endpoint number here
  760. * rather than the endpoint address (with the
  761. * correct direction). Win does let this through,
  762. * so we'll not reject it here but leave it to
  763. * the device to not break KVM. But we warn.
  764. */
  765. ret = findintfep(ps->dev, index ^ 0x80);
  766. if (ret >= 0)
  767. dev_info(&ps->dev->dev,
  768. "%s: process %i (%s) requesting ep %02x but needs %02x\n",
  769. __func__, task_pid_nr(current),
  770. current->comm, index, index ^ 0x80);
  771. }
  772. if (ret >= 0)
  773. ret = checkintf(ps, ret);
  774. break;
  775. case USB_RECIP_INTERFACE:
  776. ret = checkintf(ps, index);
  777. break;
  778. }
  779. return ret;
  780. }
  781. static struct usb_host_endpoint *ep_to_host_endpoint(struct usb_device *dev,
  782. unsigned char ep)
  783. {
  784. if (ep & USB_ENDPOINT_DIR_MASK)
  785. return dev->ep_in[ep & USB_ENDPOINT_NUMBER_MASK];
  786. else
  787. return dev->ep_out[ep & USB_ENDPOINT_NUMBER_MASK];
  788. }
  789. static int parse_usbdevfs_streams(struct usb_dev_state *ps,
  790. struct usbdevfs_streams __user *streams,
  791. unsigned int *num_streams_ret,
  792. unsigned int *num_eps_ret,
  793. struct usb_host_endpoint ***eps_ret,
  794. struct usb_interface **intf_ret)
  795. {
  796. unsigned int i, num_streams, num_eps;
  797. struct usb_host_endpoint **eps;
  798. struct usb_interface *intf = NULL;
  799. unsigned char ep;
  800. int ifnum, ret;
  801. if (get_user(num_streams, &streams->num_streams) ||
  802. get_user(num_eps, &streams->num_eps))
  803. return -EFAULT;
  804. if (num_eps < 1 || num_eps > USB_MAXENDPOINTS)
  805. return -EINVAL;
  806. /* The XHCI controller allows max 2 ^ 16 streams */
  807. if (num_streams_ret && (num_streams < 2 || num_streams > 65536))
  808. return -EINVAL;
  809. eps = kmalloc_array(num_eps, sizeof(*eps), GFP_KERNEL);
  810. if (!eps)
  811. return -ENOMEM;
  812. for (i = 0; i < num_eps; i++) {
  813. if (get_user(ep, &streams->eps[i])) {
  814. ret = -EFAULT;
  815. goto error;
  816. }
  817. eps[i] = ep_to_host_endpoint(ps->dev, ep);
  818. if (!eps[i]) {
  819. ret = -EINVAL;
  820. goto error;
  821. }
  822. /* usb_alloc/free_streams operate on an usb_interface */
  823. ifnum = findintfep(ps->dev, ep);
  824. if (ifnum < 0) {
  825. ret = ifnum;
  826. goto error;
  827. }
  828. if (i == 0) {
  829. ret = checkintf(ps, ifnum);
  830. if (ret < 0)
  831. goto error;
  832. intf = usb_ifnum_to_if(ps->dev, ifnum);
  833. } else {
  834. /* Verify all eps belong to the same interface */
  835. if (ifnum != intf->altsetting->desc.bInterfaceNumber) {
  836. ret = -EINVAL;
  837. goto error;
  838. }
  839. }
  840. }
  841. if (num_streams_ret)
  842. *num_streams_ret = num_streams;
  843. *num_eps_ret = num_eps;
  844. *eps_ret = eps;
  845. *intf_ret = intf;
  846. return 0;
  847. error:
  848. kfree(eps);
  849. return ret;
  850. }
  851. static struct usb_device *usbdev_lookup_by_devt(dev_t devt)
  852. {
  853. struct device *dev;
  854. dev = bus_find_device_by_devt(&usb_bus_type, devt);
  855. if (!dev)
  856. return NULL;
  857. return to_usb_device(dev);
  858. }
  859. /*
  860. * file operations
  861. */
  862. static int usbdev_open(struct inode *inode, struct file *file)
  863. {
  864. struct usb_device *dev = NULL;
  865. struct usb_dev_state *ps;
  866. int ret;
  867. ret = -ENOMEM;
  868. ps = kzalloc(sizeof(struct usb_dev_state), GFP_KERNEL);
  869. if (!ps)
  870. goto out_free_ps;
  871. ret = -ENODEV;
  872. /* usbdev device-node */
  873. if (imajor(inode) == USB_DEVICE_MAJOR)
  874. dev = usbdev_lookup_by_devt(inode->i_rdev);
  875. if (!dev)
  876. goto out_free_ps;
  877. usb_lock_device(dev);
  878. if (dev->state == USB_STATE_NOTATTACHED)
  879. goto out_unlock_device;
  880. ret = usb_autoresume_device(dev);
  881. if (ret)
  882. goto out_unlock_device;
  883. ps->dev = dev;
  884. ps->file = file;
  885. ps->interface_allowed_mask = 0xFFFFFFFF; /* 32 bits */
  886. spin_lock_init(&ps->lock);
  887. INIT_LIST_HEAD(&ps->list);
  888. INIT_LIST_HEAD(&ps->async_pending);
  889. INIT_LIST_HEAD(&ps->async_completed);
  890. INIT_LIST_HEAD(&ps->memory_list);
  891. init_waitqueue_head(&ps->wait);
  892. init_waitqueue_head(&ps->wait_for_resume);
  893. ps->disc_pid = get_pid(task_pid(current));
  894. ps->cred = get_current_cred();
  895. smp_wmb();
  896. /* Can't race with resume; the device is already active */
  897. list_add_tail(&ps->list, &dev->filelist);
  898. file->private_data = ps;
  899. usb_unlock_device(dev);
  900. snoop(&dev->dev, "opened by process %d: %s\n", task_pid_nr(current),
  901. current->comm);
  902. return ret;
  903. out_unlock_device:
  904. usb_unlock_device(dev);
  905. usb_put_dev(dev);
  906. out_free_ps:
  907. kfree(ps);
  908. return ret;
  909. }
  910. static int usbdev_release(struct inode *inode, struct file *file)
  911. {
  912. struct usb_dev_state *ps = file->private_data;
  913. struct usb_device *dev = ps->dev;
  914. unsigned int ifnum;
  915. struct async *as;
  916. usb_lock_device(dev);
  917. usb_hub_release_all_ports(dev, ps);
  918. /* Protect against simultaneous resume */
  919. mutex_lock(&usbfs_mutex);
  920. list_del_init(&ps->list);
  921. mutex_unlock(&usbfs_mutex);
  922. for (ifnum = 0; ps->ifclaimed && ifnum < 8*sizeof(ps->ifclaimed);
  923. ifnum++) {
  924. if (test_bit(ifnum, &ps->ifclaimed))
  925. releaseintf(ps, ifnum);
  926. }
  927. destroy_all_async(ps);
  928. if (!ps->suspend_allowed)
  929. usb_autosuspend_device(dev);
  930. usb_unlock_device(dev);
  931. usb_put_dev(dev);
  932. put_pid(ps->disc_pid);
  933. put_cred(ps->cred);
  934. as = async_getcompleted(ps);
  935. while (as) {
  936. free_async(as);
  937. as = async_getcompleted(ps);
  938. }
  939. kfree(ps);
  940. return 0;
  941. }
  942. static int do_proc_control(struct usb_dev_state *ps,
  943. struct usbdevfs_ctrltransfer *ctrl)
  944. {
  945. struct usb_device *dev = ps->dev;
  946. unsigned int tmo;
  947. unsigned char *tbuf;
  948. unsigned wLength;
  949. int i, pipe, ret;
  950. ret = check_ctrlrecip(ps, ctrl->bRequestType, ctrl->bRequest,
  951. ctrl->wIndex);
  952. if (ret)
  953. return ret;
  954. wLength = ctrl->wLength; /* To suppress 64k PAGE_SIZE warning */
  955. if (wLength > PAGE_SIZE)
  956. return -EINVAL;
  957. ret = usbfs_increase_memory_usage(PAGE_SIZE + sizeof(struct urb) +
  958. sizeof(struct usb_ctrlrequest));
  959. if (ret)
  960. return ret;
  961. tbuf = (unsigned char *)__get_free_page(GFP_KERNEL);
  962. if (!tbuf) {
  963. ret = -ENOMEM;
  964. goto done;
  965. }
  966. tmo = ctrl->timeout;
  967. snoop(&dev->dev, "control urb: bRequestType=%02x "
  968. "bRequest=%02x wValue=%04x "
  969. "wIndex=%04x wLength=%04x\n",
  970. ctrl->bRequestType, ctrl->bRequest, ctrl->wValue,
  971. ctrl->wIndex, ctrl->wLength);
  972. if ((ctrl->bRequestType & USB_DIR_IN) && ctrl->wLength) {
  973. pipe = usb_rcvctrlpipe(dev, 0);
  974. snoop_urb(dev, NULL, pipe, ctrl->wLength, tmo, SUBMIT, NULL, 0);
  975. usb_unlock_device(dev);
  976. i = usb_control_msg(dev, pipe, ctrl->bRequest,
  977. ctrl->bRequestType, ctrl->wValue, ctrl->wIndex,
  978. tbuf, ctrl->wLength, tmo);
  979. usb_lock_device(dev);
  980. snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE,
  981. tbuf, max(i, 0));
  982. if ((i > 0) && ctrl->wLength) {
  983. if (copy_to_user(ctrl->data, tbuf, i)) {
  984. ret = -EFAULT;
  985. goto done;
  986. }
  987. }
  988. } else {
  989. if (ctrl->wLength) {
  990. if (copy_from_user(tbuf, ctrl->data, ctrl->wLength)) {
  991. ret = -EFAULT;
  992. goto done;
  993. }
  994. }
  995. pipe = usb_sndctrlpipe(dev, 0);
  996. snoop_urb(dev, NULL, pipe, ctrl->wLength, tmo, SUBMIT,
  997. tbuf, ctrl->wLength);
  998. usb_unlock_device(dev);
  999. i = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ctrl->bRequest,
  1000. ctrl->bRequestType, ctrl->wValue, ctrl->wIndex,
  1001. tbuf, ctrl->wLength, tmo);
  1002. usb_lock_device(dev);
  1003. snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE, NULL, 0);
  1004. }
  1005. if (i < 0 && i != -EPIPE) {
  1006. dev_printk(KERN_DEBUG, &dev->dev, "usbfs: USBDEVFS_CONTROL "
  1007. "failed cmd %s rqt %u rq %u len %u ret %d\n",
  1008. current->comm, ctrl->bRequestType, ctrl->bRequest,
  1009. ctrl->wLength, i);
  1010. }
  1011. ret = i;
  1012. done:
  1013. free_page((unsigned long) tbuf);
  1014. usbfs_decrease_memory_usage(PAGE_SIZE + sizeof(struct urb) +
  1015. sizeof(struct usb_ctrlrequest));
  1016. return ret;
  1017. }
  1018. static int proc_control(struct usb_dev_state *ps, void __user *arg)
  1019. {
  1020. struct usbdevfs_ctrltransfer ctrl;
  1021. if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
  1022. return -EFAULT;
  1023. return do_proc_control(ps, &ctrl);
  1024. }
  1025. static int do_proc_bulk(struct usb_dev_state *ps,
  1026. struct usbdevfs_bulktransfer *bulk)
  1027. {
  1028. struct usb_device *dev = ps->dev;
  1029. unsigned int tmo, len1, pipe;
  1030. int len2;
  1031. unsigned char *tbuf;
  1032. int i, ret;
  1033. ret = findintfep(ps->dev, bulk->ep);
  1034. if (ret < 0)
  1035. return ret;
  1036. ret = checkintf(ps, ret);
  1037. if (ret)
  1038. return ret;
  1039. if (bulk->ep & USB_DIR_IN)
  1040. pipe = usb_rcvbulkpipe(dev, bulk->ep & 0x7f);
  1041. else
  1042. pipe = usb_sndbulkpipe(dev, bulk->ep & 0x7f);
  1043. if (!usb_maxpacket(dev, pipe, !(bulk->ep & USB_DIR_IN)))
  1044. return -EINVAL;
  1045. len1 = bulk->len;
  1046. if (len1 >= (INT_MAX - sizeof(struct urb)))
  1047. return -EINVAL;
  1048. ret = usbfs_increase_memory_usage(len1 + sizeof(struct urb));
  1049. if (ret)
  1050. return ret;
  1051. /*
  1052. * len1 can be almost arbitrarily large. Don't WARN if it's
  1053. * too big, just fail the request.
  1054. */
  1055. tbuf = kmalloc(len1, GFP_KERNEL | __GFP_NOWARN);
  1056. if (!tbuf) {
  1057. ret = -ENOMEM;
  1058. goto done;
  1059. }
  1060. tmo = bulk->timeout;
  1061. if (bulk->ep & 0x80) {
  1062. snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, NULL, 0);
  1063. usb_unlock_device(dev);
  1064. i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
  1065. usb_lock_device(dev);
  1066. snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, tbuf, len2);
  1067. if (!i && len2) {
  1068. if (copy_to_user(bulk->data, tbuf, len2)) {
  1069. ret = -EFAULT;
  1070. goto done;
  1071. }
  1072. }
  1073. } else {
  1074. if (len1) {
  1075. if (copy_from_user(tbuf, bulk->data, len1)) {
  1076. ret = -EFAULT;
  1077. goto done;
  1078. }
  1079. }
  1080. snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, tbuf, len1);
  1081. usb_unlock_device(dev);
  1082. i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
  1083. usb_lock_device(dev);
  1084. snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, NULL, 0);
  1085. }
  1086. ret = (i < 0 ? i : len2);
  1087. done:
  1088. kfree(tbuf);
  1089. usbfs_decrease_memory_usage(len1 + sizeof(struct urb));
  1090. return ret;
  1091. }
  1092. static int proc_bulk(struct usb_dev_state *ps, void __user *arg)
  1093. {
  1094. struct usbdevfs_bulktransfer bulk;
  1095. if (copy_from_user(&bulk, arg, sizeof(bulk)))
  1096. return -EFAULT;
  1097. return do_proc_bulk(ps, &bulk);
  1098. }
  1099. static void check_reset_of_active_ep(struct usb_device *udev,
  1100. unsigned int epnum, char *ioctl_name)
  1101. {
  1102. struct usb_host_endpoint **eps;
  1103. struct usb_host_endpoint *ep;
  1104. eps = (epnum & USB_DIR_IN) ? udev->ep_in : udev->ep_out;
  1105. ep = eps[epnum & 0x0f];
  1106. if (ep && !list_empty(&ep->urb_list))
  1107. dev_warn(&udev->dev, "Process %d (%s) called USBDEVFS_%s for active endpoint 0x%02x\n",
  1108. task_pid_nr(current), current->comm,
  1109. ioctl_name, epnum);
  1110. }
  1111. static int proc_resetep(struct usb_dev_state *ps, void __user *arg)
  1112. {
  1113. unsigned int ep;
  1114. int ret;
  1115. if (get_user(ep, (unsigned int __user *)arg))
  1116. return -EFAULT;
  1117. ret = findintfep(ps->dev, ep);
  1118. if (ret < 0)
  1119. return ret;
  1120. ret = checkintf(ps, ret);
  1121. if (ret)
  1122. return ret;
  1123. check_reset_of_active_ep(ps->dev, ep, "RESETEP");
  1124. usb_reset_endpoint(ps->dev, ep);
  1125. return 0;
  1126. }
  1127. static int proc_clearhalt(struct usb_dev_state *ps, void __user *arg)
  1128. {
  1129. unsigned int ep;
  1130. int pipe;
  1131. int ret;
  1132. if (get_user(ep, (unsigned int __user *)arg))
  1133. return -EFAULT;
  1134. ret = findintfep(ps->dev, ep);
  1135. if (ret < 0)
  1136. return ret;
  1137. ret = checkintf(ps, ret);
  1138. if (ret)
  1139. return ret;
  1140. check_reset_of_active_ep(ps->dev, ep, "CLEAR_HALT");
  1141. if (ep & USB_DIR_IN)
  1142. pipe = usb_rcvbulkpipe(ps->dev, ep & 0x7f);
  1143. else
  1144. pipe = usb_sndbulkpipe(ps->dev, ep & 0x7f);
  1145. return usb_clear_halt(ps->dev, pipe);
  1146. }
  1147. static int proc_getdriver(struct usb_dev_state *ps, void __user *arg)
  1148. {
  1149. struct usbdevfs_getdriver gd;
  1150. struct usb_interface *intf;
  1151. int ret;
  1152. if (copy_from_user(&gd, arg, sizeof(gd)))
  1153. return -EFAULT;
  1154. intf = usb_ifnum_to_if(ps->dev, gd.interface);
  1155. if (!intf || !intf->dev.driver)
  1156. ret = -ENODATA;
  1157. else {
  1158. strlcpy(gd.driver, intf->dev.driver->name,
  1159. sizeof(gd.driver));
  1160. ret = (copy_to_user(arg, &gd, sizeof(gd)) ? -EFAULT : 0);
  1161. }
  1162. return ret;
  1163. }
  1164. static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg)
  1165. {
  1166. struct usbdevfs_connectinfo ci;
  1167. memset(&ci, 0, sizeof(ci));
  1168. ci.devnum = ps->dev->devnum;
  1169. ci.slow = ps->dev->speed == USB_SPEED_LOW;
  1170. if (copy_to_user(arg, &ci, sizeof(ci)))
  1171. return -EFAULT;
  1172. return 0;
  1173. }
  1174. static int proc_conninfo_ex(struct usb_dev_state *ps,
  1175. void __user *arg, size_t size)
  1176. {
  1177. struct usbdevfs_conninfo_ex ci;
  1178. struct usb_device *udev = ps->dev;
  1179. if (size < sizeof(ci.size))
  1180. return -EINVAL;
  1181. memset(&ci, 0, sizeof(ci));
  1182. ci.size = sizeof(ci);
  1183. ci.busnum = udev->bus->busnum;
  1184. ci.devnum = udev->devnum;
  1185. ci.speed = udev->speed;
  1186. while (udev && udev->portnum != 0) {
  1187. if (++ci.num_ports <= ARRAY_SIZE(ci.ports))
  1188. ci.ports[ARRAY_SIZE(ci.ports) - ci.num_ports] =
  1189. udev->portnum;
  1190. udev = udev->parent;
  1191. }
  1192. if (ci.num_ports < ARRAY_SIZE(ci.ports))
  1193. memmove(&ci.ports[0],
  1194. &ci.ports[ARRAY_SIZE(ci.ports) - ci.num_ports],
  1195. ci.num_ports);
  1196. if (copy_to_user(arg, &ci, min(sizeof(ci), size)))
  1197. return -EFAULT;
  1198. return 0;
  1199. }
  1200. static int proc_resetdevice(struct usb_dev_state *ps)
  1201. {
  1202. struct usb_host_config *actconfig = ps->dev->actconfig;
  1203. struct usb_interface *interface;
  1204. int i, number;
  1205. /* Don't allow a device reset if the process has dropped the
  1206. * privilege to do such things and any of the interfaces are
  1207. * currently claimed.
  1208. */
  1209. if (ps->privileges_dropped && actconfig) {
  1210. for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
  1211. interface = actconfig->interface[i];
  1212. number = interface->cur_altsetting->desc.bInterfaceNumber;
  1213. if (usb_interface_claimed(interface) &&
  1214. !test_bit(number, &ps->ifclaimed)) {
  1215. dev_warn(&ps->dev->dev,
  1216. "usbfs: interface %d claimed by %s while '%s' resets device\n",
  1217. number, interface->dev.driver->name, current->comm);
  1218. return -EACCES;
  1219. }
  1220. }
  1221. }
  1222. return usb_reset_device(ps->dev);
  1223. }
  1224. static int proc_setintf(struct usb_dev_state *ps, void __user *arg)
  1225. {
  1226. struct usbdevfs_setinterface setintf;
  1227. int ret;
  1228. if (copy_from_user(&setintf, arg, sizeof(setintf)))
  1229. return -EFAULT;
  1230. ret = checkintf(ps, setintf.interface);
  1231. if (ret)
  1232. return ret;
  1233. destroy_async_on_interface(ps, setintf.interface);
  1234. return usb_set_interface(ps->dev, setintf.interface,
  1235. setintf.altsetting);
  1236. }
  1237. static int proc_setconfig(struct usb_dev_state *ps, void __user *arg)
  1238. {
  1239. int u;
  1240. int status = 0;
  1241. struct usb_host_config *actconfig;
  1242. if (get_user(u, (int __user *)arg))
  1243. return -EFAULT;
  1244. actconfig = ps->dev->actconfig;
  1245. /* Don't touch the device if any interfaces are claimed.
  1246. * It could interfere with other drivers' operations, and if
  1247. * an interface is claimed by usbfs it could easily deadlock.
  1248. */
  1249. if (actconfig) {
  1250. int i;
  1251. for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
  1252. if (usb_interface_claimed(actconfig->interface[i])) {
  1253. dev_warn(&ps->dev->dev,
  1254. "usbfs: interface %d claimed by %s "
  1255. "while '%s' sets config #%d\n",
  1256. actconfig->interface[i]
  1257. ->cur_altsetting
  1258. ->desc.bInterfaceNumber,
  1259. actconfig->interface[i]
  1260. ->dev.driver->name,
  1261. current->comm, u);
  1262. status = -EBUSY;
  1263. break;
  1264. }
  1265. }
  1266. }
  1267. /* SET_CONFIGURATION is often abused as a "cheap" driver reset,
  1268. * so avoid usb_set_configuration()'s kick to sysfs
  1269. */
  1270. if (status == 0) {
  1271. if (actconfig && actconfig->desc.bConfigurationValue == u)
  1272. status = usb_reset_configuration(ps->dev);
  1273. else
  1274. status = usb_set_configuration(ps->dev, u);
  1275. }
  1276. return status;
  1277. }
  1278. static struct usb_memory *
  1279. find_memory_area(struct usb_dev_state *ps, const struct usbdevfs_urb *uurb)
  1280. {
  1281. struct usb_memory *usbm = NULL, *iter;
  1282. unsigned long flags;
  1283. unsigned long uurb_start = (unsigned long)uurb->buffer;
  1284. spin_lock_irqsave(&ps->lock, flags);
  1285. list_for_each_entry(iter, &ps->memory_list, memlist) {
  1286. if (uurb_start >= iter->vm_start &&
  1287. uurb_start < iter->vm_start + iter->size) {
  1288. if (uurb->buffer_length > iter->vm_start + iter->size -
  1289. uurb_start) {
  1290. usbm = ERR_PTR(-EINVAL);
  1291. } else {
  1292. usbm = iter;
  1293. usbm->urb_use_count++;
  1294. }
  1295. break;
  1296. }
  1297. }
  1298. spin_unlock_irqrestore(&ps->lock, flags);
  1299. return usbm;
  1300. }
  1301. static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb,
  1302. struct usbdevfs_iso_packet_desc __user *iso_frame_desc,
  1303. void __user *arg, sigval_t userurb_sigval)
  1304. {
  1305. struct usbdevfs_iso_packet_desc *isopkt = NULL;
  1306. struct usb_host_endpoint *ep;
  1307. struct async *as = NULL;
  1308. struct usb_ctrlrequest *dr = NULL;
  1309. unsigned int u, totlen, isofrmlen;
  1310. int i, ret, num_sgs = 0, ifnum = -1;
  1311. int number_of_packets = 0;
  1312. unsigned int stream_id = 0;
  1313. void *buf;
  1314. bool is_in;
  1315. bool allow_short = false;
  1316. bool allow_zero = false;
  1317. unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK |
  1318. USBDEVFS_URB_BULK_CONTINUATION |
  1319. USBDEVFS_URB_NO_FSBR |
  1320. USBDEVFS_URB_ZERO_PACKET |
  1321. USBDEVFS_URB_NO_INTERRUPT;
  1322. /* USBDEVFS_URB_ISO_ASAP is a special case */
  1323. if (uurb->type == USBDEVFS_URB_TYPE_ISO)
  1324. mask |= USBDEVFS_URB_ISO_ASAP;
  1325. if (uurb->flags & ~mask)
  1326. return -EINVAL;
  1327. if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
  1328. return -EINVAL;
  1329. if (uurb->buffer_length > 0 && !uurb->buffer)
  1330. return -EINVAL;
  1331. if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
  1332. (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
  1333. ifnum = findintfep(ps->dev, uurb->endpoint);
  1334. if (ifnum < 0)
  1335. return ifnum;
  1336. ret = checkintf(ps, ifnum);
  1337. if (ret)
  1338. return ret;
  1339. }
  1340. ep = ep_to_host_endpoint(ps->dev, uurb->endpoint);
  1341. if (!ep)
  1342. return -ENOENT;
  1343. is_in = (uurb->endpoint & USB_ENDPOINT_DIR_MASK) != 0;
  1344. u = 0;
  1345. switch (uurb->type) {
  1346. case USBDEVFS_URB_TYPE_CONTROL:
  1347. if (!usb_endpoint_xfer_control(&ep->desc))
  1348. return -EINVAL;
  1349. /* min 8 byte setup packet */
  1350. if (uurb->buffer_length < 8)
  1351. return -EINVAL;
  1352. dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
  1353. if (!dr)
  1354. return -ENOMEM;
  1355. if (copy_from_user(dr, uurb->buffer, 8)) {
  1356. ret = -EFAULT;
  1357. goto error;
  1358. }
  1359. if (uurb->buffer_length < (le16_to_cpu(dr->wLength) + 8)) {
  1360. ret = -EINVAL;
  1361. goto error;
  1362. }
  1363. ret = check_ctrlrecip(ps, dr->bRequestType, dr->bRequest,
  1364. le16_to_cpu(dr->wIndex));
  1365. if (ret)
  1366. goto error;
  1367. uurb->buffer_length = le16_to_cpu(dr->wLength);
  1368. uurb->buffer += 8;
  1369. if ((dr->bRequestType & USB_DIR_IN) && uurb->buffer_length) {
  1370. is_in = true;
  1371. uurb->endpoint |= USB_DIR_IN;
  1372. } else {
  1373. is_in = false;
  1374. uurb->endpoint &= ~USB_DIR_IN;
  1375. }
  1376. if (is_in)
  1377. allow_short = true;
  1378. snoop(&ps->dev->dev, "control urb: bRequestType=%02x "
  1379. "bRequest=%02x wValue=%04x "
  1380. "wIndex=%04x wLength=%04x\n",
  1381. dr->bRequestType, dr->bRequest,
  1382. __le16_to_cpu(dr->wValue),
  1383. __le16_to_cpu(dr->wIndex),
  1384. __le16_to_cpu(dr->wLength));
  1385. u = sizeof(struct usb_ctrlrequest);
  1386. break;
  1387. case USBDEVFS_URB_TYPE_BULK:
  1388. if (!is_in)
  1389. allow_zero = true;
  1390. else
  1391. allow_short = true;
  1392. switch (usb_endpoint_type(&ep->desc)) {
  1393. case USB_ENDPOINT_XFER_CONTROL:
  1394. case USB_ENDPOINT_XFER_ISOC:
  1395. return -EINVAL;
  1396. case USB_ENDPOINT_XFER_INT:
  1397. /* allow single-shot interrupt transfers */
  1398. uurb->type = USBDEVFS_URB_TYPE_INTERRUPT;
  1399. goto interrupt_urb;
  1400. }
  1401. num_sgs = DIV_ROUND_UP(uurb->buffer_length, USB_SG_SIZE);
  1402. if (num_sgs == 1 || num_sgs > ps->dev->bus->sg_tablesize)
  1403. num_sgs = 0;
  1404. if (ep->streams)
  1405. stream_id = uurb->stream_id;
  1406. break;
  1407. case USBDEVFS_URB_TYPE_INTERRUPT:
  1408. if (!usb_endpoint_xfer_int(&ep->desc))
  1409. return -EINVAL;
  1410. interrupt_urb:
  1411. if (!is_in)
  1412. allow_zero = true;
  1413. else
  1414. allow_short = true;
  1415. break;
  1416. case USBDEVFS_URB_TYPE_ISO:
  1417. /* arbitrary limit */
  1418. if (uurb->number_of_packets < 1 ||
  1419. uurb->number_of_packets > 128)
  1420. return -EINVAL;
  1421. if (!usb_endpoint_xfer_isoc(&ep->desc))
  1422. return -EINVAL;
  1423. number_of_packets = uurb->number_of_packets;
  1424. isofrmlen = sizeof(struct usbdevfs_iso_packet_desc) *
  1425. number_of_packets;
  1426. isopkt = memdup_user(iso_frame_desc, isofrmlen);
  1427. if (IS_ERR(isopkt)) {
  1428. ret = PTR_ERR(isopkt);
  1429. isopkt = NULL;
  1430. goto error;
  1431. }
  1432. for (totlen = u = 0; u < number_of_packets; u++) {
  1433. /*
  1434. * arbitrary limit need for USB 3.1 Gen2
  1435. * sizemax: 96 DPs at SSP, 96 * 1024 = 98304
  1436. */
  1437. if (isopkt[u].length > 98304) {
  1438. ret = -EINVAL;
  1439. goto error;
  1440. }
  1441. totlen += isopkt[u].length;
  1442. }
  1443. u *= sizeof(struct usb_iso_packet_descriptor);
  1444. uurb->buffer_length = totlen;
  1445. break;
  1446. default:
  1447. return -EINVAL;
  1448. }
  1449. if (uurb->buffer_length > 0 &&
  1450. !access_ok(uurb->buffer, uurb->buffer_length)) {
  1451. ret = -EFAULT;
  1452. goto error;
  1453. }
  1454. as = alloc_async(number_of_packets);
  1455. if (!as) {
  1456. ret = -ENOMEM;
  1457. goto error;
  1458. }
  1459. as->usbm = find_memory_area(ps, uurb);
  1460. if (IS_ERR(as->usbm)) {
  1461. ret = PTR_ERR(as->usbm);
  1462. as->usbm = NULL;
  1463. goto error;
  1464. }
  1465. /* do not use SG buffers when memory mapped segments
  1466. * are in use
  1467. */
  1468. if (as->usbm)
  1469. num_sgs = 0;
  1470. u += sizeof(struct async) + sizeof(struct urb) +
  1471. (as->usbm ? 0 : uurb->buffer_length) +
  1472. num_sgs * sizeof(struct scatterlist);
  1473. ret = usbfs_increase_memory_usage(u);
  1474. if (ret)
  1475. goto error;
  1476. as->mem_usage = u;
  1477. if (num_sgs) {
  1478. as->urb->sg = kmalloc_array(num_sgs,
  1479. sizeof(struct scatterlist),
  1480. GFP_KERNEL | __GFP_NOWARN);
  1481. if (!as->urb->sg) {
  1482. ret = -ENOMEM;
  1483. goto error;
  1484. }
  1485. as->urb->num_sgs = num_sgs;
  1486. sg_init_table(as->urb->sg, as->urb->num_sgs);
  1487. totlen = uurb->buffer_length;
  1488. for (i = 0; i < as->urb->num_sgs; i++) {
  1489. u = (totlen > USB_SG_SIZE) ? USB_SG_SIZE : totlen;
  1490. buf = kmalloc(u, GFP_KERNEL);
  1491. if (!buf) {
  1492. ret = -ENOMEM;
  1493. goto error;
  1494. }
  1495. sg_set_buf(&as->urb->sg[i], buf, u);
  1496. if (!is_in) {
  1497. if (copy_from_user(buf, uurb->buffer, u)) {
  1498. ret = -EFAULT;
  1499. goto error;
  1500. }
  1501. uurb->buffer += u;
  1502. }
  1503. totlen -= u;
  1504. }
  1505. } else if (uurb->buffer_length > 0) {
  1506. if (as->usbm) {
  1507. unsigned long uurb_start = (unsigned long)uurb->buffer;
  1508. as->urb->transfer_buffer = as->usbm->mem +
  1509. (uurb_start - as->usbm->vm_start);
  1510. } else {
  1511. as->urb->transfer_buffer = kmalloc(uurb->buffer_length,
  1512. GFP_KERNEL | __GFP_NOWARN);
  1513. if (!as->urb->transfer_buffer) {
  1514. ret = -ENOMEM;
  1515. goto error;
  1516. }
  1517. if (!is_in) {
  1518. if (copy_from_user(as->urb->transfer_buffer,
  1519. uurb->buffer,
  1520. uurb->buffer_length)) {
  1521. ret = -EFAULT;
  1522. goto error;
  1523. }
  1524. } else if (uurb->type == USBDEVFS_URB_TYPE_ISO) {
  1525. /*
  1526. * Isochronous input data may end up being
  1527. * discontiguous if some of the packets are
  1528. * short. Clear the buffer so that the gaps
  1529. * don't leak kernel data to userspace.
  1530. */
  1531. memset(as->urb->transfer_buffer, 0,
  1532. uurb->buffer_length);
  1533. }
  1534. }
  1535. }
  1536. as->urb->dev = ps->dev;
  1537. as->urb->pipe = (uurb->type << 30) |
  1538. __create_pipe(ps->dev, uurb->endpoint & 0xf) |
  1539. (uurb->endpoint & USB_DIR_IN);
  1540. /* This tedious sequence is necessary because the URB_* flags
  1541. * are internal to the kernel and subject to change, whereas
  1542. * the USBDEVFS_URB_* flags are a user API and must not be changed.
  1543. */
  1544. u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
  1545. if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
  1546. u |= URB_ISO_ASAP;
  1547. if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
  1548. u |= URB_SHORT_NOT_OK;
  1549. if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
  1550. u |= URB_ZERO_PACKET;
  1551. if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
  1552. u |= URB_NO_INTERRUPT;
  1553. as->urb->transfer_flags = u;
  1554. if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
  1555. dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n");
  1556. if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
  1557. dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n");
  1558. as->urb->transfer_buffer_length = uurb->buffer_length;
  1559. as->urb->setup_packet = (unsigned char *)dr;
  1560. dr = NULL;
  1561. as->urb->start_frame = uurb->start_frame;
  1562. as->urb->number_of_packets = number_of_packets;
  1563. as->urb->stream_id = stream_id;
  1564. if (ep->desc.bInterval) {
  1565. if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
  1566. ps->dev->speed == USB_SPEED_HIGH ||
  1567. ps->dev->speed >= USB_SPEED_SUPER)
  1568. as->urb->interval = 1 <<
  1569. min(15, ep->desc.bInterval - 1);
  1570. else
  1571. as->urb->interval = ep->desc.bInterval;
  1572. }
  1573. as->urb->context = as;
  1574. as->urb->complete = async_completed;
  1575. for (totlen = u = 0; u < number_of_packets; u++) {
  1576. as->urb->iso_frame_desc[u].offset = totlen;
  1577. as->urb->iso_frame_desc[u].length = isopkt[u].length;
  1578. totlen += isopkt[u].length;
  1579. }
  1580. kfree(isopkt);
  1581. isopkt = NULL;
  1582. as->ps = ps;
  1583. as->userurb = arg;
  1584. as->userurb_sigval = userurb_sigval;
  1585. if (as->usbm) {
  1586. unsigned long uurb_start = (unsigned long)uurb->buffer;
  1587. as->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
  1588. as->urb->transfer_dma = as->usbm->dma_handle +
  1589. (uurb_start - as->usbm->vm_start);
  1590. } else if (is_in && uurb->buffer_length > 0)
  1591. as->userbuffer = uurb->buffer;
  1592. as->signr = uurb->signr;
  1593. as->ifnum = ifnum;
  1594. as->pid = get_pid(task_pid(current));
  1595. as->cred = get_current_cred();
  1596. snoop_urb(ps->dev, as->userurb, as->urb->pipe,
  1597. as->urb->transfer_buffer_length, 0, SUBMIT,
  1598. NULL, 0);
  1599. if (!is_in)
  1600. snoop_urb_data(as->urb, as->urb->transfer_buffer_length);
  1601. async_newpending(as);
  1602. if (usb_endpoint_xfer_bulk(&ep->desc)) {
  1603. spin_lock_irq(&ps->lock);
  1604. /* Not exactly the endpoint address; the direction bit is
  1605. * shifted to the 0x10 position so that the value will be
  1606. * between 0 and 31.
  1607. */
  1608. as->bulk_addr = usb_endpoint_num(&ep->desc) |
  1609. ((ep->desc.bEndpointAddress & USB_ENDPOINT_DIR_MASK)
  1610. >> 3);
  1611. /* If this bulk URB is the start of a new transfer, re-enable
  1612. * the endpoint. Otherwise mark it as a continuation URB.
  1613. */
  1614. if (uurb->flags & USBDEVFS_URB_BULK_CONTINUATION)
  1615. as->bulk_status = AS_CONTINUATION;
  1616. else
  1617. ps->disabled_bulk_eps &= ~(1 << as->bulk_addr);
  1618. /* Don't accept continuation URBs if the endpoint is
  1619. * disabled because of an earlier error.
  1620. */
  1621. if (ps->disabled_bulk_eps & (1 << as->bulk_addr))
  1622. ret = -EREMOTEIO;
  1623. else
  1624. ret = usb_submit_urb(as->urb, GFP_ATOMIC);
  1625. spin_unlock_irq(&ps->lock);
  1626. } else {
  1627. ret = usb_submit_urb(as->urb, GFP_KERNEL);
  1628. }
  1629. if (ret) {
  1630. dev_printk(KERN_DEBUG, &ps->dev->dev,
  1631. "usbfs: usb_submit_urb returned %d\n", ret);
  1632. snoop_urb(ps->dev, as->userurb, as->urb->pipe,
  1633. 0, ret, COMPLETE, NULL, 0);
  1634. async_removepending(as);
  1635. goto error;
  1636. }
  1637. return 0;
  1638. error:
  1639. kfree(isopkt);
  1640. kfree(dr);
  1641. if (as)
  1642. free_async(as);
  1643. return ret;
  1644. }
  1645. static int proc_submiturb(struct usb_dev_state *ps, void __user *arg)
  1646. {
  1647. struct usbdevfs_urb uurb;
  1648. sigval_t userurb_sigval;
  1649. if (copy_from_user(&uurb, arg, sizeof(uurb)))
  1650. return -EFAULT;
  1651. memset(&userurb_sigval, 0, sizeof(userurb_sigval));
  1652. userurb_sigval.sival_ptr = arg;
  1653. return proc_do_submiturb(ps, &uurb,
  1654. (((struct usbdevfs_urb __user *)arg)->iso_frame_desc),
  1655. arg, userurb_sigval);
  1656. }
  1657. static int proc_unlinkurb(struct usb_dev_state *ps, void __user *arg)
  1658. {
  1659. struct urb *urb;
  1660. struct async *as;
  1661. unsigned long flags;
  1662. spin_lock_irqsave(&ps->lock, flags);
  1663. as = async_getpending(ps, arg);
  1664. if (!as) {
  1665. spin_unlock_irqrestore(&ps->lock, flags);
  1666. return -EINVAL;
  1667. }
  1668. urb = as->urb;
  1669. usb_get_urb(urb);
  1670. spin_unlock_irqrestore(&ps->lock, flags);
  1671. usb_kill_urb(urb);
  1672. usb_put_urb(urb);
  1673. return 0;
  1674. }
  1675. static void compute_isochronous_actual_length(struct urb *urb)
  1676. {
  1677. unsigned int i;
  1678. if (urb->number_of_packets > 0) {
  1679. urb->actual_length = 0;
  1680. for (i = 0; i < urb->number_of_packets; i++)
  1681. urb->actual_length +=
  1682. urb->iso_frame_desc[i].actual_length;
  1683. }
  1684. }
  1685. static int processcompl(struct async *as, void __user * __user *arg)
  1686. {
  1687. struct urb *urb = as->urb;
  1688. struct usbdevfs_urb __user *userurb = as->userurb;
  1689. void __user *addr = as->userurb;
  1690. unsigned int i;
  1691. compute_isochronous_actual_length(urb);
  1692. if (as->userbuffer && urb->actual_length) {
  1693. if (copy_urb_data_to_user(as->userbuffer, urb))
  1694. goto err_out;
  1695. }
  1696. if (put_user(as->status, &userurb->status))
  1697. goto err_out;
  1698. if (put_user(urb->actual_length, &userurb->actual_length))
  1699. goto err_out;
  1700. if (put_user(urb->error_count, &userurb->error_count))
  1701. goto err_out;
  1702. if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
  1703. for (i = 0; i < urb->number_of_packets; i++) {
  1704. if (put_user(urb->iso_frame_desc[i].actual_length,
  1705. &userurb->iso_frame_desc[i].actual_length))
  1706. goto err_out;
  1707. if (put_user(urb->iso_frame_desc[i].status,
  1708. &userurb->iso_frame_desc[i].status))
  1709. goto err_out;
  1710. }
  1711. }
  1712. if (put_user(addr, (void __user * __user *)arg))
  1713. return -EFAULT;
  1714. return 0;
  1715. err_out:
  1716. return -EFAULT;
  1717. }
  1718. static struct async *reap_as(struct usb_dev_state *ps)
  1719. {
  1720. DECLARE_WAITQUEUE(wait, current);
  1721. struct async *as = NULL;
  1722. struct usb_device *dev = ps->dev;
  1723. add_wait_queue(&ps->wait, &wait);
  1724. for (;;) {
  1725. __set_current_state(TASK_INTERRUPTIBLE);
  1726. as = async_getcompleted(ps);
  1727. if (as || !connected(ps))
  1728. break;
  1729. if (signal_pending(current))
  1730. break;
  1731. usb_unlock_device(dev);
  1732. schedule();
  1733. usb_lock_device(dev);
  1734. }
  1735. remove_wait_queue(&ps->wait, &wait);
  1736. set_current_state(TASK_RUNNING);
  1737. return as;
  1738. }
  1739. static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
  1740. {
  1741. struct async *as = reap_as(ps);
  1742. if (as) {
  1743. int retval;
  1744. snoop(&ps->dev->dev, "reap %px\n", as->userurb);
  1745. retval = processcompl(as, (void __user * __user *)arg);
  1746. free_async(as);
  1747. return retval;
  1748. }
  1749. if (signal_pending(current))
  1750. return -EINTR;
  1751. return -ENODEV;
  1752. }
  1753. static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
  1754. {
  1755. int retval;
  1756. struct async *as;
  1757. as = async_getcompleted(ps);
  1758. if (as) {
  1759. snoop(&ps->dev->dev, "reap %px\n", as->userurb);
  1760. retval = processcompl(as, (void __user * __user *)arg);
  1761. free_async(as);
  1762. } else {
  1763. retval = (connected(ps) ? -EAGAIN : -ENODEV);
  1764. }
  1765. return retval;
  1766. }
  1767. #ifdef CONFIG_COMPAT
  1768. static int proc_control_compat(struct usb_dev_state *ps,
  1769. struct usbdevfs_ctrltransfer32 __user *p32)
  1770. {
  1771. struct usbdevfs_ctrltransfer ctrl;
  1772. u32 udata;
  1773. if (copy_from_user(&ctrl, p32, sizeof(*p32) - sizeof(compat_caddr_t)) ||
  1774. get_user(udata, &p32->data))
  1775. return -EFAULT;
  1776. ctrl.data = compat_ptr(udata);
  1777. return do_proc_control(ps, &ctrl);
  1778. }
  1779. static int proc_bulk_compat(struct usb_dev_state *ps,
  1780. struct usbdevfs_bulktransfer32 __user *p32)
  1781. {
  1782. struct usbdevfs_bulktransfer bulk;
  1783. compat_caddr_t addr;
  1784. if (get_user(bulk.ep, &p32->ep) ||
  1785. get_user(bulk.len, &p32->len) ||
  1786. get_user(bulk.timeout, &p32->timeout) ||
  1787. get_user(addr, &p32->data))
  1788. return -EFAULT;
  1789. bulk.data = compat_ptr(addr);
  1790. return do_proc_bulk(ps, &bulk);
  1791. }
  1792. static int proc_disconnectsignal_compat(struct usb_dev_state *ps, void __user *arg)
  1793. {
  1794. struct usbdevfs_disconnectsignal32 ds;
  1795. if (copy_from_user(&ds, arg, sizeof(ds)))
  1796. return -EFAULT;
  1797. ps->discsignr = ds.signr;
  1798. ps->disccontext.sival_int = ds.context;
  1799. return 0;
  1800. }
  1801. static int get_urb32(struct usbdevfs_urb *kurb,
  1802. struct usbdevfs_urb32 __user *uurb)
  1803. {
  1804. struct usbdevfs_urb32 urb32;
  1805. if (copy_from_user(&urb32, uurb, sizeof(*uurb)))
  1806. return -EFAULT;
  1807. kurb->type = urb32.type;
  1808. kurb->endpoint = urb32.endpoint;
  1809. kurb->status = urb32.status;
  1810. kurb->flags = urb32.flags;
  1811. kurb->buffer = compat_ptr(urb32.buffer);
  1812. kurb->buffer_length = urb32.buffer_length;
  1813. kurb->actual_length = urb32.actual_length;
  1814. kurb->start_frame = urb32.start_frame;
  1815. kurb->number_of_packets = urb32.number_of_packets;
  1816. kurb->error_count = urb32.error_count;
  1817. kurb->signr = urb32.signr;
  1818. kurb->usercontext = compat_ptr(urb32.usercontext);
  1819. return 0;
  1820. }
  1821. static int proc_submiturb_compat(struct usb_dev_state *ps, void __user *arg)
  1822. {
  1823. struct usbdevfs_urb uurb;
  1824. sigval_t userurb_sigval;
  1825. if (get_urb32(&uurb, (struct usbdevfs_urb32 __user *)arg))
  1826. return -EFAULT;
  1827. memset(&userurb_sigval, 0, sizeof(userurb_sigval));
  1828. userurb_sigval.sival_int = ptr_to_compat(arg);
  1829. return proc_do_submiturb(ps, &uurb,
  1830. ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc,
  1831. arg, userurb_sigval);
  1832. }
  1833. static int processcompl_compat(struct async *as, void __user * __user *arg)
  1834. {
  1835. struct urb *urb = as->urb;
  1836. struct usbdevfs_urb32 __user *userurb = as->userurb;
  1837. void __user *addr = as->userurb;
  1838. unsigned int i;
  1839. compute_isochronous_actual_length(urb);
  1840. if (as->userbuffer && urb->actual_length) {
  1841. if (copy_urb_data_to_user(as->userbuffer, urb))
  1842. return -EFAULT;
  1843. }
  1844. if (put_user(as->status, &userurb->status))
  1845. return -EFAULT;
  1846. if (put_user(urb->actual_length, &userurb->actual_length))
  1847. return -EFAULT;
  1848. if (put_user(urb->error_count, &userurb->error_count))
  1849. return -EFAULT;
  1850. if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
  1851. for (i = 0; i < urb->number_of_packets; i++) {
  1852. if (put_user(urb->iso_frame_desc[i].actual_length,
  1853. &userurb->iso_frame_desc[i].actual_length))
  1854. return -EFAULT;
  1855. if (put_user(urb->iso_frame_desc[i].status,
  1856. &userurb->iso_frame_desc[i].status))
  1857. return -EFAULT;
  1858. }
  1859. }
  1860. if (put_user(ptr_to_compat(addr), (u32 __user *)arg))
  1861. return -EFAULT;
  1862. return 0;
  1863. }
  1864. static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
  1865. {
  1866. struct async *as = reap_as(ps);
  1867. if (as) {
  1868. int retval;
  1869. snoop(&ps->dev->dev, "reap %px\n", as->userurb);
  1870. retval = processcompl_compat(as, (void __user * __user *)arg);
  1871. free_async(as);
  1872. return retval;
  1873. }
  1874. if (signal_pending(current))
  1875. return -EINTR;
  1876. return -ENODEV;
  1877. }
  1878. static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *arg)
  1879. {
  1880. int retval;
  1881. struct async *as;
  1882. as = async_getcompleted(ps);
  1883. if (as) {
  1884. snoop(&ps->dev->dev, "reap %px\n", as->userurb);
  1885. retval = processcompl_compat(as, (void __user * __user *)arg);
  1886. free_async(as);
  1887. } else {
  1888. retval = (connected(ps) ? -EAGAIN : -ENODEV);
  1889. }
  1890. return retval;
  1891. }
  1892. #endif
  1893. static int proc_disconnectsignal(struct usb_dev_state *ps, void __user *arg)
  1894. {
  1895. struct usbdevfs_disconnectsignal ds;
  1896. if (copy_from_user(&ds, arg, sizeof(ds)))
  1897. return -EFAULT;
  1898. ps->discsignr = ds.signr;
  1899. ps->disccontext.sival_ptr = ds.context;
  1900. return 0;
  1901. }
  1902. static int proc_claiminterface(struct usb_dev_state *ps, void __user *arg)
  1903. {
  1904. unsigned int ifnum;
  1905. if (get_user(ifnum, (unsigned int __user *)arg))
  1906. return -EFAULT;
  1907. return claimintf(ps, ifnum);
  1908. }
  1909. static int proc_releaseinterface(struct usb_dev_state *ps, void __user *arg)
  1910. {
  1911. unsigned int ifnum;
  1912. int ret;
  1913. if (get_user(ifnum, (unsigned int __user *)arg))
  1914. return -EFAULT;
  1915. ret = releaseintf(ps, ifnum);
  1916. if (ret < 0)
  1917. return ret;
  1918. destroy_async_on_interface(ps, ifnum);
  1919. return 0;
  1920. }
  1921. static int proc_ioctl(struct usb_dev_state *ps, struct usbdevfs_ioctl *ctl)
  1922. {
  1923. int size;
  1924. void *buf = NULL;
  1925. int retval = 0;
  1926. struct usb_interface *intf = NULL;
  1927. struct usb_driver *driver = NULL;
  1928. if (ps->privileges_dropped)
  1929. return -EACCES;
  1930. if (!connected(ps))
  1931. return -ENODEV;
  1932. /* alloc buffer */
  1933. size = _IOC_SIZE(ctl->ioctl_code);
  1934. if (size > 0) {
  1935. buf = kmalloc(size, GFP_KERNEL);
  1936. if (buf == NULL)
  1937. return -ENOMEM;
  1938. if ((_IOC_DIR(ctl->ioctl_code) & _IOC_WRITE)) {
  1939. if (copy_from_user(buf, ctl->data, size)) {
  1940. kfree(buf);
  1941. return -EFAULT;
  1942. }
  1943. } else {
  1944. memset(buf, 0, size);
  1945. }
  1946. }
  1947. if (ps->dev->state != USB_STATE_CONFIGURED)
  1948. retval = -EHOSTUNREACH;
  1949. else if (!(intf = usb_ifnum_to_if(ps->dev, ctl->ifno)))
  1950. retval = -EINVAL;
  1951. else switch (ctl->ioctl_code) {
  1952. /* disconnect kernel driver from interface */
  1953. case USBDEVFS_DISCONNECT:
  1954. if (intf->dev.driver) {
  1955. driver = to_usb_driver(intf->dev.driver);
  1956. dev_dbg(&intf->dev, "disconnect by usbfs\n");
  1957. usb_driver_release_interface(driver, intf);
  1958. } else
  1959. retval = -ENODATA;
  1960. break;
  1961. /* let kernel drivers try to (re)bind to the interface */
  1962. case USBDEVFS_CONNECT:
  1963. if (!intf->dev.driver)
  1964. retval = device_attach(&intf->dev);
  1965. else
  1966. retval = -EBUSY;
  1967. break;
  1968. /* talk directly to the interface's driver */
  1969. default:
  1970. if (intf->dev.driver)
  1971. driver = to_usb_driver(intf->dev.driver);
  1972. if (driver == NULL || driver->unlocked_ioctl == NULL) {
  1973. retval = -ENOTTY;
  1974. } else {
  1975. retval = driver->unlocked_ioctl(intf, ctl->ioctl_code, buf);
  1976. if (retval == -ENOIOCTLCMD)
  1977. retval = -ENOTTY;
  1978. }
  1979. }
  1980. /* cleanup and return */
  1981. if (retval >= 0
  1982. && (_IOC_DIR(ctl->ioctl_code) & _IOC_READ) != 0
  1983. && size > 0
  1984. && copy_to_user(ctl->data, buf, size) != 0)
  1985. retval = -EFAULT;
  1986. kfree(buf);
  1987. return retval;
  1988. }
  1989. static int proc_ioctl_default(struct usb_dev_state *ps, void __user *arg)
  1990. {
  1991. struct usbdevfs_ioctl ctrl;
  1992. if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
  1993. return -EFAULT;
  1994. return proc_ioctl(ps, &ctrl);
  1995. }
  1996. #ifdef CONFIG_COMPAT
  1997. static int proc_ioctl_compat(struct usb_dev_state *ps, compat_uptr_t arg)
  1998. {
  1999. struct usbdevfs_ioctl32 ioc32;
  2000. struct usbdevfs_ioctl ctrl;
  2001. if (copy_from_user(&ioc32, compat_ptr(arg), sizeof(ioc32)))
  2002. return -EFAULT;
  2003. ctrl.ifno = ioc32.ifno;
  2004. ctrl.ioctl_code = ioc32.ioctl_code;
  2005. ctrl.data = compat_ptr(ioc32.data);
  2006. return proc_ioctl(ps, &ctrl);
  2007. }
  2008. #endif
  2009. static int proc_claim_port(struct usb_dev_state *ps, void __user *arg)
  2010. {
  2011. unsigned portnum;
  2012. int rc;
  2013. if (get_user(portnum, (unsigned __user *) arg))
  2014. return -EFAULT;
  2015. rc = usb_hub_claim_port(ps->dev, portnum, ps);
  2016. if (rc == 0)
  2017. snoop(&ps->dev->dev, "port %d claimed by process %d: %s\n",
  2018. portnum, task_pid_nr(current), current->comm);
  2019. return rc;
  2020. }
  2021. static int proc_release_port(struct usb_dev_state *ps, void __user *arg)
  2022. {
  2023. unsigned portnum;
  2024. if (get_user(portnum, (unsigned __user *) arg))
  2025. return -EFAULT;
  2026. return usb_hub_release_port(ps->dev, portnum, ps);
  2027. }
  2028. static int proc_get_capabilities(struct usb_dev_state *ps, void __user *arg)
  2029. {
  2030. __u32 caps;
  2031. caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM |
  2032. USBDEVFS_CAP_REAP_AFTER_DISCONNECT | USBDEVFS_CAP_MMAP |
  2033. USBDEVFS_CAP_DROP_PRIVILEGES |
  2034. USBDEVFS_CAP_CONNINFO_EX | MAYBE_CAP_SUSPEND;
  2035. if (!ps->dev->bus->no_stop_on_short)
  2036. caps |= USBDEVFS_CAP_BULK_CONTINUATION;
  2037. if (ps->dev->bus->sg_tablesize)
  2038. caps |= USBDEVFS_CAP_BULK_SCATTER_GATHER;
  2039. if (put_user(caps, (__u32 __user *)arg))
  2040. return -EFAULT;
  2041. return 0;
  2042. }
  2043. static int proc_disconnect_claim(struct usb_dev_state *ps, void __user *arg)
  2044. {
  2045. struct usbdevfs_disconnect_claim dc;
  2046. struct usb_interface *intf;
  2047. if (copy_from_user(&dc, arg, sizeof(dc)))
  2048. return -EFAULT;
  2049. intf = usb_ifnum_to_if(ps->dev, dc.interface);
  2050. if (!intf)
  2051. return -EINVAL;
  2052. if (intf->dev.driver) {
  2053. struct usb_driver *driver = to_usb_driver(intf->dev.driver);
  2054. if (ps->privileges_dropped)
  2055. return -EACCES;
  2056. if ((dc.flags & USBDEVFS_DISCONNECT_CLAIM_IF_DRIVER) &&
  2057. strncmp(dc.driver, intf->dev.driver->name,
  2058. sizeof(dc.driver)) != 0)
  2059. return -EBUSY;
  2060. if ((dc.flags & USBDEVFS_DISCONNECT_CLAIM_EXCEPT_DRIVER) &&
  2061. strncmp(dc.driver, intf->dev.driver->name,
  2062. sizeof(dc.driver)) == 0)
  2063. return -EBUSY;
  2064. dev_dbg(&intf->dev, "disconnect by usbfs\n");
  2065. usb_driver_release_interface(driver, intf);
  2066. }
  2067. return claimintf(ps, dc.interface);
  2068. }
  2069. static int proc_alloc_streams(struct usb_dev_state *ps, void __user *arg)
  2070. {
  2071. unsigned num_streams, num_eps;
  2072. struct usb_host_endpoint **eps;
  2073. struct usb_interface *intf;
  2074. int r;
  2075. r = parse_usbdevfs_streams(ps, arg, &num_streams, &num_eps,
  2076. &eps, &intf);
  2077. if (r)
  2078. return r;
  2079. destroy_async_on_interface(ps,
  2080. intf->altsetting[0].desc.bInterfaceNumber);
  2081. r = usb_alloc_streams(intf, eps, num_eps, num_streams, GFP_KERNEL);
  2082. kfree(eps);
  2083. return r;
  2084. }
  2085. static int proc_free_streams(struct usb_dev_state *ps, void __user *arg)
  2086. {
  2087. unsigned num_eps;
  2088. struct usb_host_endpoint **eps;
  2089. struct usb_interface *intf;
  2090. int r;
  2091. r = parse_usbdevfs_streams(ps, arg, NULL, &num_eps, &eps, &intf);
  2092. if (r)
  2093. return r;
  2094. destroy_async_on_interface(ps,
  2095. intf->altsetting[0].desc.bInterfaceNumber);
  2096. r = usb_free_streams(intf, eps, num_eps, GFP_KERNEL);
  2097. kfree(eps);
  2098. return r;
  2099. }
  2100. static int proc_drop_privileges(struct usb_dev_state *ps, void __user *arg)
  2101. {
  2102. u32 data;
  2103. if (copy_from_user(&data, arg, sizeof(data)))
  2104. return -EFAULT;
  2105. /* This is a one way operation. Once privileges are
  2106. * dropped, you cannot regain them. You may however reissue
  2107. * this ioctl to shrink the allowed interfaces mask.
  2108. */
  2109. ps->interface_allowed_mask &= data;
  2110. ps->privileges_dropped = true;
  2111. return 0;
  2112. }
  2113. static int proc_forbid_suspend(struct usb_dev_state *ps)
  2114. {
  2115. int ret = 0;
  2116. if (ps->suspend_allowed) {
  2117. ret = usb_autoresume_device(ps->dev);
  2118. if (ret == 0)
  2119. ps->suspend_allowed = false;
  2120. else if (ret != -ENODEV)
  2121. ret = -EIO;
  2122. }
  2123. return ret;
  2124. }
  2125. static int proc_allow_suspend(struct usb_dev_state *ps)
  2126. {
  2127. if (!connected(ps))
  2128. return -ENODEV;
  2129. WRITE_ONCE(ps->not_yet_resumed, 1);
  2130. if (!ps->suspend_allowed) {
  2131. usb_autosuspend_device(ps->dev);
  2132. ps->suspend_allowed = true;
  2133. }
  2134. return 0;
  2135. }
  2136. static int proc_wait_for_resume(struct usb_dev_state *ps)
  2137. {
  2138. int ret;
  2139. usb_unlock_device(ps->dev);
  2140. ret = wait_event_interruptible(ps->wait_for_resume,
  2141. READ_ONCE(ps->not_yet_resumed) == 0);
  2142. usb_lock_device(ps->dev);
  2143. if (ret != 0)
  2144. return -EINTR;
  2145. return proc_forbid_suspend(ps);
  2146. }
  2147. /*
  2148. * NOTE: All requests here that have interface numbers as parameters
  2149. * are assuming that somehow the configuration has been prevented from
  2150. * changing. But there's no mechanism to ensure that...
  2151. */
  2152. static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
  2153. void __user *p)
  2154. {
  2155. struct usb_dev_state *ps = file->private_data;
  2156. struct inode *inode = file_inode(file);
  2157. struct usb_device *dev = ps->dev;
  2158. int ret = -ENOTTY;
  2159. if (!(file->f_mode & FMODE_WRITE))
  2160. return -EPERM;
  2161. usb_lock_device(dev);
  2162. /* Reap operations are allowed even after disconnection */
  2163. switch (cmd) {
  2164. case USBDEVFS_REAPURB:
  2165. snoop(&dev->dev, "%s: REAPURB\n", __func__);
  2166. ret = proc_reapurb(ps, p);
  2167. goto done;
  2168. case USBDEVFS_REAPURBNDELAY:
  2169. snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
  2170. ret = proc_reapurbnonblock(ps, p);
  2171. goto done;
  2172. #ifdef CONFIG_COMPAT
  2173. case USBDEVFS_REAPURB32:
  2174. snoop(&dev->dev, "%s: REAPURB32\n", __func__);
  2175. ret = proc_reapurb_compat(ps, p);
  2176. goto done;
  2177. case USBDEVFS_REAPURBNDELAY32:
  2178. snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
  2179. ret = proc_reapurbnonblock_compat(ps, p);
  2180. goto done;
  2181. #endif
  2182. }
  2183. if (!connected(ps)) {
  2184. usb_unlock_device(dev);
  2185. return -ENODEV;
  2186. }
  2187. switch (cmd) {
  2188. case USBDEVFS_CONTROL:
  2189. snoop(&dev->dev, "%s: CONTROL\n", __func__);
  2190. ret = proc_control(ps, p);
  2191. if (ret >= 0)
  2192. inode->i_mtime = current_time(inode);
  2193. break;
  2194. case USBDEVFS_BULK:
  2195. snoop(&dev->dev, "%s: BULK\n", __func__);
  2196. ret = proc_bulk(ps, p);
  2197. if (ret >= 0)
  2198. inode->i_mtime = current_time(inode);
  2199. break;
  2200. case USBDEVFS_RESETEP:
  2201. snoop(&dev->dev, "%s: RESETEP\n", __func__);
  2202. ret = proc_resetep(ps, p);
  2203. if (ret >= 0)
  2204. inode->i_mtime = current_time(inode);
  2205. break;
  2206. case USBDEVFS_RESET:
  2207. snoop(&dev->dev, "%s: RESET\n", __func__);
  2208. ret = proc_resetdevice(ps);
  2209. break;
  2210. case USBDEVFS_CLEAR_HALT:
  2211. snoop(&dev->dev, "%s: CLEAR_HALT\n", __func__);
  2212. ret = proc_clearhalt(ps, p);
  2213. if (ret >= 0)
  2214. inode->i_mtime = current_time(inode);
  2215. break;
  2216. case USBDEVFS_GETDRIVER:
  2217. snoop(&dev->dev, "%s: GETDRIVER\n", __func__);
  2218. ret = proc_getdriver(ps, p);
  2219. break;
  2220. case USBDEVFS_CONNECTINFO:
  2221. snoop(&dev->dev, "%s: CONNECTINFO\n", __func__);
  2222. ret = proc_connectinfo(ps, p);
  2223. break;
  2224. case USBDEVFS_SETINTERFACE:
  2225. snoop(&dev->dev, "%s: SETINTERFACE\n", __func__);
  2226. ret = proc_setintf(ps, p);
  2227. break;
  2228. case USBDEVFS_SETCONFIGURATION:
  2229. snoop(&dev->dev, "%s: SETCONFIGURATION\n", __func__);
  2230. ret = proc_setconfig(ps, p);
  2231. break;
  2232. case USBDEVFS_SUBMITURB:
  2233. snoop(&dev->dev, "%s: SUBMITURB\n", __func__);
  2234. ret = proc_submiturb(ps, p);
  2235. if (ret >= 0)
  2236. inode->i_mtime = current_time(inode);
  2237. break;
  2238. #ifdef CONFIG_COMPAT
  2239. case USBDEVFS_CONTROL32:
  2240. snoop(&dev->dev, "%s: CONTROL32\n", __func__);
  2241. ret = proc_control_compat(ps, p);
  2242. if (ret >= 0)
  2243. inode->i_mtime = current_time(inode);
  2244. break;
  2245. case USBDEVFS_BULK32:
  2246. snoop(&dev->dev, "%s: BULK32\n", __func__);
  2247. ret = proc_bulk_compat(ps, p);
  2248. if (ret >= 0)
  2249. inode->i_mtime = current_time(inode);
  2250. break;
  2251. case USBDEVFS_DISCSIGNAL32:
  2252. snoop(&dev->dev, "%s: DISCSIGNAL32\n", __func__);
  2253. ret = proc_disconnectsignal_compat(ps, p);
  2254. break;
  2255. case USBDEVFS_SUBMITURB32:
  2256. snoop(&dev->dev, "%s: SUBMITURB32\n", __func__);
  2257. ret = proc_submiturb_compat(ps, p);
  2258. if (ret >= 0)
  2259. inode->i_mtime = current_time(inode);
  2260. break;
  2261. case USBDEVFS_IOCTL32:
  2262. snoop(&dev->dev, "%s: IOCTL32\n", __func__);
  2263. ret = proc_ioctl_compat(ps, ptr_to_compat(p));
  2264. break;
  2265. #endif
  2266. case USBDEVFS_DISCARDURB:
  2267. snoop(&dev->dev, "%s: DISCARDURB %px\n", __func__, p);
  2268. ret = proc_unlinkurb(ps, p);
  2269. break;
  2270. case USBDEVFS_DISCSIGNAL:
  2271. snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
  2272. ret = proc_disconnectsignal(ps, p);
  2273. break;
  2274. case USBDEVFS_CLAIMINTERFACE:
  2275. snoop(&dev->dev, "%s: CLAIMINTERFACE\n", __func__);
  2276. ret = proc_claiminterface(ps, p);
  2277. break;
  2278. case USBDEVFS_RELEASEINTERFACE:
  2279. snoop(&dev->dev, "%s: RELEASEINTERFACE\n", __func__);
  2280. ret = proc_releaseinterface(ps, p);
  2281. break;
  2282. case USBDEVFS_IOCTL:
  2283. snoop(&dev->dev, "%s: IOCTL\n", __func__);
  2284. ret = proc_ioctl_default(ps, p);
  2285. break;
  2286. case USBDEVFS_CLAIM_PORT:
  2287. snoop(&dev->dev, "%s: CLAIM_PORT\n", __func__);
  2288. ret = proc_claim_port(ps, p);
  2289. break;
  2290. case USBDEVFS_RELEASE_PORT:
  2291. snoop(&dev->dev, "%s: RELEASE_PORT\n", __func__);
  2292. ret = proc_release_port(ps, p);
  2293. break;
  2294. case USBDEVFS_GET_CAPABILITIES:
  2295. ret = proc_get_capabilities(ps, p);
  2296. break;
  2297. case USBDEVFS_DISCONNECT_CLAIM:
  2298. ret = proc_disconnect_claim(ps, p);
  2299. break;
  2300. case USBDEVFS_ALLOC_STREAMS:
  2301. ret = proc_alloc_streams(ps, p);
  2302. break;
  2303. case USBDEVFS_FREE_STREAMS:
  2304. ret = proc_free_streams(ps, p);
  2305. break;
  2306. case USBDEVFS_DROP_PRIVILEGES:
  2307. ret = proc_drop_privileges(ps, p);
  2308. break;
  2309. case USBDEVFS_GET_SPEED:
  2310. ret = ps->dev->speed;
  2311. break;
  2312. case USBDEVFS_FORBID_SUSPEND:
  2313. ret = proc_forbid_suspend(ps);
  2314. break;
  2315. case USBDEVFS_ALLOW_SUSPEND:
  2316. ret = proc_allow_suspend(ps);
  2317. break;
  2318. case USBDEVFS_WAIT_FOR_RESUME:
  2319. ret = proc_wait_for_resume(ps);
  2320. break;
  2321. }
  2322. /* Handle variable-length commands */
  2323. switch (cmd & ~IOCSIZE_MASK) {
  2324. case USBDEVFS_CONNINFO_EX(0):
  2325. ret = proc_conninfo_ex(ps, p, _IOC_SIZE(cmd));
  2326. break;
  2327. }
  2328. done:
  2329. usb_unlock_device(dev);
  2330. if (ret >= 0)
  2331. inode->i_atime = current_time(inode);
  2332. return ret;
  2333. }
  2334. static long usbdev_ioctl(struct file *file, unsigned int cmd,
  2335. unsigned long arg)
  2336. {
  2337. int ret;
  2338. ret = usbdev_do_ioctl(file, cmd, (void __user *)arg);
  2339. return ret;
  2340. }
  2341. /* No kernel lock - fine */
  2342. static __poll_t usbdev_poll(struct file *file,
  2343. struct poll_table_struct *wait)
  2344. {
  2345. struct usb_dev_state *ps = file->private_data;
  2346. __poll_t mask = 0;
  2347. poll_wait(file, &ps->wait, wait);
  2348. if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
  2349. mask |= EPOLLOUT | EPOLLWRNORM;
  2350. if (!connected(ps))
  2351. mask |= EPOLLHUP;
  2352. if (list_empty(&ps->list))
  2353. mask |= EPOLLERR;
  2354. return mask;
  2355. }
  2356. const struct file_operations usbdev_file_operations = {
  2357. .owner = THIS_MODULE,
  2358. .llseek = no_seek_end_llseek,
  2359. .read = usbdev_read,
  2360. .poll = usbdev_poll,
  2361. .unlocked_ioctl = usbdev_ioctl,
  2362. .compat_ioctl = compat_ptr_ioctl,
  2363. .mmap = usbdev_mmap,
  2364. .open = usbdev_open,
  2365. .release = usbdev_release,
  2366. };
  2367. static void usbdev_remove(struct usb_device *udev)
  2368. {
  2369. struct usb_dev_state *ps;
  2370. /* Protect against simultaneous resume */
  2371. mutex_lock(&usbfs_mutex);
  2372. while (!list_empty(&udev->filelist)) {
  2373. ps = list_entry(udev->filelist.next, struct usb_dev_state, list);
  2374. destroy_all_async(ps);
  2375. wake_up_all(&ps->wait);
  2376. WRITE_ONCE(ps->not_yet_resumed, 0);
  2377. wake_up_all(&ps->wait_for_resume);
  2378. list_del_init(&ps->list);
  2379. if (ps->discsignr)
  2380. kill_pid_usb_asyncio(ps->discsignr, EPIPE, ps->disccontext,
  2381. ps->disc_pid, ps->cred);
  2382. }
  2383. mutex_unlock(&usbfs_mutex);
  2384. }
  2385. static int usbdev_notify(struct notifier_block *self,
  2386. unsigned long action, void *dev)
  2387. {
  2388. switch (action) {
  2389. case USB_DEVICE_ADD:
  2390. break;
  2391. case USB_DEVICE_REMOVE:
  2392. usbdev_remove(dev);
  2393. break;
  2394. }
  2395. return NOTIFY_OK;
  2396. }
  2397. static struct notifier_block usbdev_nb = {
  2398. .notifier_call = usbdev_notify,
  2399. };
  2400. static struct cdev usb_device_cdev;
  2401. int __init usb_devio_init(void)
  2402. {
  2403. int retval;
  2404. retval = register_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX,
  2405. "usb_device");
  2406. if (retval) {
  2407. printk(KERN_ERR "Unable to register minors for usb_device\n");
  2408. goto out;
  2409. }
  2410. cdev_init(&usb_device_cdev, &usbdev_file_operations);
  2411. retval = cdev_add(&usb_device_cdev, USB_DEVICE_DEV, USB_DEVICE_MAX);
  2412. if (retval) {
  2413. printk(KERN_ERR "Unable to get usb_device major %d\n",
  2414. USB_DEVICE_MAJOR);
  2415. goto error_cdev;
  2416. }
  2417. usb_register_notify(&usbdev_nb);
  2418. out:
  2419. return retval;
  2420. error_cdev:
  2421. unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
  2422. goto out;
  2423. }
  2424. void usb_devio_cleanup(void)
  2425. {
  2426. usb_unregister_notify(&usbdev_nb);
  2427. cdev_del(&usb_device_cdev);
  2428. unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
  2429. }