drivers/usb/core/devio.c

   1 /*****************************************************************************/
   2
   3 /*
   4  *      devio.c  --  User space communication with USB devices.
   5  *
   6  *      Copyright (C) 1999-2000  Thomas Sailer (sailer@ife.ee.ethz.ch)
   7  *
   8  *      This program is free software; you can redistribute it and/or modify
   9  *      it under the terms of the GNU General Public License as published by
  10  *      the Free Software Foundation; either version 2 of the License, or
  11  *      (at your option) any later version.
  12  *
  13  *      This program is distributed in the hope that it will be useful,
  14  *      but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *      GNU General Public License for more details.
  17  *
  18  *      You should have received a copy of the GNU General Public License
  19  *      along with this program; if not, write to the Free Software
  20  *      Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21  *
  22  *  This file implements the usbfs/x/y files, where
  23  *  x is the bus number and y the device number.
  24  *
  25  *  It allows user space programs/"drivers" to communicate directly
  26  *  with USB devices without intervening kernel driver.
  27  *
  28  *  Revision history
  29  *    22.12.1999   0.1   Initial release (split from proc_usb.c)
  30  *    04.01.2000   0.2   Turned into its own filesystem
  31  *    30.09.2005   0.3   Fix user-triggerable oops in async URB delivery
  32  *                       (CAN-2005-3055)
  33  */
  34
  35 /*****************************************************************************/
  36
  37 #include <linux/fs.h>
  38 #include <linux/mm.h>
  39 #include <linux/slab.h>
  40 #include <linux/signal.h>
  41 #include <linux/poll.h>
  42 #include <linux/module.h>
  43 #include <linux/string.h>
  44 #include <linux/usb.h>
  45 #include <linux/usbdevice_fs.h>
  46 #include <linux/usb/hcd.h>      /* for usbcore internals */
  47 #include <linux/cdev.h>
  48 #include <linux/notifier.h>
  49 #include <linux/security.h>
  50 #include <linux/user_namespace.h>
  51 #include <linux/scatterlist.h>
  52 #include <linux/uaccess.h>
  53 #include <asm/byteorder.h>
  54 #include <linux/moduleparam.h>
  55
  56 #include "usb.h"
  57
  58 #define USB_MAXBUS                      64
  59 #define USB_DEVICE_MAX                  (USB_MAXBUS * 128)
  60 #define USB_SG_SIZE                     16384 /* split-size for large txs */
  61
  62 /* Mutual exclusion for removal, open, and release */
  63 DEFINE_MUTEX(usbfs_mutex);
  64
  65 struct usb_dev_state {
  66         struct list_head list;      /* state list */
  67         struct usb_device *dev;
  68         struct file *file;
  69         spinlock_t lock;            /* protects the async urb lists */
  70         struct list_head async_pending;
  71         struct list_head async_completed;
  72         wait_queue_head_t wait;     /* wake up if a request completed */
  73         unsigned int discsignr;
  74         struct pid *disc_pid;
  75         const struct cred *cred;
  76         void __user *disccontext;
  77         unsigned long ifclaimed;
  78         u32 secid;
  79         u32 disabled_bulk_eps;
  80 };
  81
  82 struct async {
  83         struct list_head asynclist;
  84         struct usb_dev_state *ps;
  85         struct pid *pid;
  86         const struct cred *cred;
  87         unsigned int signr;
  88         unsigned int ifnum;
  89         void __user *userbuffer;
  90         void __user *userurb;
  91         struct urb *urb;
  92         unsigned int mem_usage;
  93         int status;
  94         u32 secid;
  95         u8 bulk_addr;
  96         u8 bulk_status;
  97 };
  98
  99 static bool usbfs_snoop;
 100 module_param(usbfs_snoop, bool, S_IRUGO | S_IWUSR);
 101 MODULE_PARM_DESC(usbfs_snoop, "true to log all usbfs traffic");
 102
 103 static unsigned usbfs_snoop_max = 65536;
 104 module_param(usbfs_snoop_max, uint, S_IRUGO | S_IWUSR);
 105 MODULE_PARM_DESC(usbfs_snoop_max,
 106                 "maximum number of bytes to print while snooping");
 107
 108 #define snoop(dev, format, arg...)                              \
 109         do {                                                    \
 110                 if (usbfs_snoop)                                \
 111                         dev_info(dev, format, ## arg);          \
 112         } while (0)
 113
 114 enum snoop_when {
 115         SUBMIT, COMPLETE
 116 };
 117
 118 #define USB_DEVICE_DEV          MKDEV(USB_DEVICE_MAJOR, 0)
 119
 120 /* Limit on the total amount of memory we can allocate for transfers */
 121 static unsigned usbfs_memory_mb = 16;
 122 module_param(usbfs_memory_mb, uint, 0644);
 123 MODULE_PARM_DESC(usbfs_memory_mb,
 124                 "maximum MB allowed for usbfs buffers (0 = no limit)");
 125
 126 /* Hard limit, necessary to avoid arithmetic overflow */
 127 #define USBFS_XFER_MAX          (UINT_MAX / 2 - 1000000)
 128
 129 static atomic_t usbfs_memory_usage;     /* Total memory currently allocated */
 130
 131 /* Check whether it's okay to allocate more memory for a transfer */
 132 static int usbfs_increase_memory_usage(unsigned amount)
 133 {
 134         unsigned lim;
 135
 136         /*
 137          * Convert usbfs_memory_mb to bytes, avoiding overflows.
 138          * 0 means use the hard limit (effectively unlimited).
 139          */
 140         lim = ACCESS_ONCE(usbfs_memory_mb);
 141         if (lim == 0 || lim > (USBFS_XFER_MAX >> 20))
 142                 lim = USBFS_XFER_MAX;
 143         else
 144                 lim <<= 20;
 145
 146         atomic_add(amount, &usbfs_memory_usage);
 147         if (atomic_read(&usbfs_memory_usage) <= lim)
 148                 return 0;
 149         atomic_sub(amount, &usbfs_memory_usage);
 150         return -ENOMEM;
 151 }
 152
 153 /* Memory for a transfer is being deallocated */
 154 static void usbfs_decrease_memory_usage(unsigned amount)
 155 {
 156         atomic_sub(amount, &usbfs_memory_usage);
 157 }
 158
 159 static int connected(struct usb_dev_state *ps)
 160 {
 161         return (!list_empty(&ps->list) &&
 162                         ps->dev->state != USB_STATE_NOTATTACHED);
 163 }
 164
 165 static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
 166                            loff_t *ppos)
 167 {
 168         struct usb_dev_state *ps = file->private_data;
 169         struct usb_device *dev = ps->dev;
 170         ssize_t ret = 0;
 171         unsigned len;
 172         loff_t pos;
 173         int i;
 174
 175         pos = *ppos;
 176         usb_lock_device(dev);
 177         if (!connected(ps)) {
 178                 ret = -ENODEV;
 179                 goto err;
 180         } else if (pos < 0) {
 181                 ret = -EINVAL;
 182                 goto err;
 183         }
 184
 185         if (pos < sizeof(struct usb_device_descriptor)) {
 186                 /* 18 bytes - fits on the stack */
 187                 struct usb_device_descriptor temp_desc;
 188
 189                 memcpy(&temp_desc, &dev->descriptor, sizeof(dev->descriptor));
 190                 le16_to_cpus(&temp_desc.bcdUSB);
 191                 le16_to_cpus(&temp_desc.idVendor);
 192                 le16_to_cpus(&temp_desc.idProduct);
 193                 le16_to_cpus(&temp_desc.bcdDevice);
 194
 195                 len = sizeof(struct usb_device_descriptor) - pos;
 196                 if (len > nbytes)
 197                         len = nbytes;
 198                 if (copy_to_user(buf, ((char *)&temp_desc) + pos, len)) {
 199                         ret = -EFAULT;
 200                         goto err;
 201                 }
 202
 203                 *ppos += len;
 204                 buf += len;
 205                 nbytes -= len;
 206                 ret += len;
 207         }
 208
 209         pos = sizeof(struct usb_device_descriptor);
 210         for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {
 211                 struct usb_config_descriptor *config =
 212                         (struct usb_config_descriptor *)dev->rawdescriptors[i];
 213                 unsigned int length = le16_to_cpu(config->wTotalLength);
 214
 215                 if (*ppos < pos + length) {
 216
 217                         /* The descriptor may claim to be longer than it
 218                          * really is.  Here is the actual allocated length. */
 219                         unsigned alloclen =
 220                                 le16_to_cpu(dev->config[i].desc.wTotalLength);
 221
 222                         len = length - (*ppos - pos);
 223                         if (len > nbytes)
 224                                 len = nbytes;
 225
 226                         /* Simply don't write (skip over) unallocated parts */
 227                         if (alloclen > (*ppos - pos)) {
 228                                 alloclen -= (*ppos - pos);
 229                                 if (copy_to_user(buf,
 230                                     dev->rawdescriptors[i] + (*ppos - pos),
 231                                     min(len, alloclen))) {
 232                                         ret = -EFAULT;
 233                                         goto err;
 234                                 }
 235                         }
 236
 237                         *ppos += len;
 238                         buf += len;
 239                         nbytes -= len;
 240                         ret += len;
 241                 }
 242
 243                 pos += length;
 244         }
 245
 246 err:
 247         usb_unlock_device(dev);
 248         return ret;
 249 }
 250
 251 /*
 252  * async list handling
 253  */
 254
 255 static struct async *alloc_async(unsigned int numisoframes)
 256 {
 257         struct async *as;
 258
 259         as = kzalloc(sizeof(struct async), GFP_KERNEL);
 260         if (!as)
 261                 return NULL;
 262         as->urb = usb_alloc_urb(numisoframes, GFP_KERNEL);
 263         if (!as->urb) {
 264                 kfree(as);
 265                 return NULL;
 266         }
 267         return as;
 268 }
 269
 270 static void free_async(struct async *as)
 271 {
 272         int i;
 273
 274         put_pid(as->pid);
 275         if (as->cred)
 276                 put_cred(as->cred);
 277         for (i = 0; i < as->urb->num_sgs; i++) {
 278                 if (sg_page(&as->urb->sg[i]))
 279                         kfree(sg_virt(&as->urb->sg[i]));
 280         }
 281         kfree(as->urb->sg);
 282         kfree(as->urb->transfer_buffer);
 283         kfree(as->urb->setup_packet);
 284         usb_free_urb(as->urb);
 285         usbfs_decrease_memory_usage(as->mem_usage);
 286         kfree(as);
 287 }
 288
 289 static void async_newpending(struct async *as)
 290 {
 291         struct usb_dev_state *ps = as->ps;
 292         unsigned long flags;
 293
 294         spin_lock_irqsave(&ps->lock, flags);
 295         list_add_tail(&as->asynclist, &ps->async_pending);
 296         spin_unlock_irqrestore(&ps->lock, flags);
 297 }
 298
 299 static void async_removepending(struct async *as)
 300 {
 301         struct usb_dev_state *ps = as->ps;
 302         unsigned long flags;
 303
 304         spin_lock_irqsave(&ps->lock, flags);
 305         list_del_init(&as->asynclist);
 306         spin_unlock_irqrestore(&ps->lock, flags);
 307 }
 308
 309 static struct async *async_getcompleted(struct usb_dev_state *ps)
 310 {
 311         unsigned long flags;
 312         struct async *as = NULL;
 313
 314         spin_lock_irqsave(&ps->lock, flags);
 315         if (!list_empty(&ps->async_completed)) {
 316                 as = list_entry(ps->async_completed.next, struct async,
 317                                 asynclist);
 318                 list_del_init(&as->asynclist);
 319         }
 320         spin_unlock_irqrestore(&ps->lock, flags);
 321         return as;
 322 }
 323
 324 static struct async *async_getpending(struct usb_dev_state *ps,
 325                                              void __user *userurb)
 326 {
 327         struct async *as;
 328
 329         list_for_each_entry(as, &ps->async_pending, asynclist)
 330                 if (as->userurb == userurb) {
 331                         list_del_init(&as->asynclist);
 332                         return as;
 333                 }
 334
 335         return NULL;
 336 }
 337
 338 static void snoop_urb(struct usb_device *udev,
 339                 void __user *userurb, int pipe, unsigned length,
 340                 int timeout_or_status, enum snoop_when when,
 341                 unsigned char *data, unsigned data_len)
 342 {
 343         static const char *types[] = {"isoc", "int", "ctrl", "bulk"};
 344         static const char *dirs[] = {"out", "in"};
 345         int ep;
 346         const char *t, *d;
 347
 348         if (!usbfs_snoop)
 349                 return;
 350
 351         ep = usb_pipeendpoint(pipe);
 352         t = types[usb_pipetype(pipe)];
 353         d = dirs[!!usb_pipein(pipe)];
 354
 355         if (userurb) {          /* Async */
 356                 if (when == SUBMIT)
 357                         dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
 358                                         "length %u\n",
 359                                         userurb, ep, t, d, length);
 360                 else
 361                         dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
 362                                         "actual_length %u status %d\n",
 363                                         userurb, ep, t, d, length,
 364                                         timeout_or_status);
 365         } else {
 366                 if (when == SUBMIT)
 367                         dev_info(&udev->dev, "ep%d %s-%s, length %u, "
 368                                         "timeout %d\n",
 369                                         ep, t, d, length, timeout_or_status);
 370                 else
 371                         dev_info(&udev->dev, "ep%d %s-%s, actual_length %u, "
 372                                         "status %d\n",
 373                                         ep, t, d, length, timeout_or_status);
 374         }
 375
 376         data_len = min(data_len, usbfs_snoop_max);
 377         if (data && data_len > 0) {
 378                 print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
 379                         data, data_len, 1);
 380         }
 381 }
 382
 383 static void snoop_urb_data(struct urb *urb, unsigned len)
 384 {
 385         int i, size;
 386
 387         len = min(len, usbfs_snoop_max);
 388         if (!usbfs_snoop || len == 0)
 389                 return;
 390
 391         if (urb->num_sgs == 0) {
 392                 print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
 393                         urb->transfer_buffer, len, 1);
 394                 return;
 395         }
 396
 397         for (i = 0; i < urb->num_sgs && len; i++) {
 398                 size = (len > USB_SG_SIZE) ? USB_SG_SIZE : len;
 399                 print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
 400                         sg_virt(&urb->sg[i]), size, 1);
 401                 len -= size;
 402         }
 403 }
 404
 405 static int copy_urb_data_to_user(u8 __user *userbuffer, struct urb *urb)
 406 {
 407         unsigned i, len, size;
 408
 409         if (urb->number_of_packets > 0)         /* Isochronous */
 410                 len = urb->transfer_buffer_length;
 411         else                                    /* Non-Isoc */
 412                 len = urb->actual_length;
 413
 414         if (urb->num_sgs == 0) {
 415                 if (copy_to_user(userbuffer, urb->transfer_buffer, len))
 416                         return -EFAULT;
 417                 return 0;
 418         }
 419
 420         for (i = 0; i < urb->num_sgs && len; i++) {
 421                 size = (len > USB_SG_SIZE) ? USB_SG_SIZE : len;
 422                 if (copy_to_user(userbuffer, sg_virt(&urb->sg[i]), size))
 423                         return -EFAULT;
 424                 userbuffer += size;
 425                 len -= size;
 426         }
 427
 428         return 0;
 429 }
 430
 431 #define AS_CONTINUATION 1
 432 #define AS_UNLINK       2
 433
 434 static void cancel_bulk_urbs(struct usb_dev_state *ps, unsigned bulk_addr)
 435 __releases(ps->lock)
 436 __acquires(ps->lock)
 437 {
 438         struct urb *urb;
 439         struct async *as;
 440
 441         /* Mark all the pending URBs that match bulk_addr, up to but not
 442          * including the first one without AS_CONTINUATION.  If such an
 443          * URB is encountered then a new transfer has already started so
 444          * the endpoint doesn't need to be disabled; otherwise it does.
 445          */
 446         list_for_each_entry(as, &ps->async_pending, asynclist) {
 447                 if (as->bulk_addr == bulk_addr) {
 448                         if (as->bulk_status != AS_CONTINUATION)
 449                                 goto rescan;
 450                         as->bulk_status = AS_UNLINK;
 451                         as->bulk_addr = 0;
 452                 }
 453         }
 454         ps->disabled_bulk_eps |= (1 << bulk_addr);
 455
 456         /* Now carefully unlink all the marked pending URBs */
 457  rescan:
 458         list_for_each_entry(as, &ps->async_pending, asynclist) {
 459                 if (as->bulk_status == AS_UNLINK) {
 460                         as->bulk_status = 0;            /* Only once */
 461                         urb = as->urb;
 462                         usb_get_urb(urb);
 463                         spin_unlock(&ps->lock);         /* Allow completions */
 464                         usb_unlink_urb(urb);
 465                         usb_put_urb(urb);
 466                         spin_lock(&ps->lock);
 467                         goto rescan;
 468                 }
 469         }
 470 }
 471
 472 static void async_completed(struct urb *urb)
 473 {
 474         struct async *as = urb->context;
 475         struct usb_dev_state *ps = as->ps;
 476         struct siginfo sinfo;
 477         struct pid *pid = NULL;
 478         u32 secid = 0;
 479         const struct cred *cred = NULL;
 480         int signr;
 481
 482         spin_lock(&ps->lock);
 483         list_move_tail(&as->asynclist, &ps->async_completed);
 484         as->status = urb->status;
 485         signr = as->signr;
 486         if (signr) {
 487                 memset(&sinfo, 0, sizeof(sinfo));
 488                 sinfo.si_signo = as->signr;
 489                 sinfo.si_errno = as->status;
 490                 sinfo.si_code = SI_ASYNCIO;
 491                 sinfo.si_addr = as->userurb;
 492                 pid = get_pid(as->pid);
 493                 cred = get_cred(as->cred);
 494                 secid = as->secid;
 495         }
 496         snoop(&urb->dev->dev, "urb complete\n");
 497         snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
 498                         as->status, COMPLETE, NULL, 0);
 499         if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN)
 500                 snoop_urb_data(urb, urb->actual_length);
 501
 502         if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
 503                         as->status != -ENOENT)
 504                 cancel_bulk_urbs(ps, as->bulk_addr);
 505         spin_unlock(&ps->lock);
 506
 507         if (signr) {
 508                 kill_pid_info_as_cred(sinfo.si_signo, &sinfo, pid, cred, secid);
 509                 put_pid(pid);
 510                 put_cred(cred);
 511         }
 512
 513         wake_up(&ps->wait);
 514 }
 515
 516 static void destroy_async(struct usb_dev_state *ps, struct list_head *list)
 517 {
 518         struct urb *urb;
 519         struct async *as;
 520         unsigned long flags;
 521
 522         spin_lock_irqsave(&ps->lock, flags);
 523         while (!list_empty(list)) {
 524                 as = list_entry(list->next, struct async, asynclist);
 525                 list_del_init(&as->asynclist);
 526                 urb = as->urb;
 527                 usb_get_urb(urb);
 528
 529                 /* drop the spinlock so the completion handler can run */
 530                 spin_unlock_irqrestore(&ps->lock, flags);
 531                 usb_kill_urb(urb);
 532                 usb_put_urb(urb);
 533                 spin_lock_irqsave(&ps->lock, flags);
 534         }
 535         spin_unlock_irqrestore(&ps->lock, flags);
 536 }
 537
 538 static void destroy_async_on_interface(struct usb_dev_state *ps,
 539                                        unsigned int ifnum)
 540 {
 541         struct list_head *p, *q, hitlist;
 542         unsigned long flags;
 543
 544         INIT_LIST_HEAD(&hitlist);
 545         spin_lock_irqsave(&ps->lock, flags);
 546         list_for_each_safe(p, q, &ps->async_pending)
 547                 if (ifnum == list_entry(p, struct async, asynclist)->ifnum)
 548                         list_move_tail(p, &hitlist);
 549         spin_unlock_irqrestore(&ps->lock, flags);
 550         destroy_async(ps, &hitlist);
 551 }
 552
 553 static void destroy_all_async(struct usb_dev_state *ps)
 554 {
 555         destroy_async(ps, &ps->async_pending);
 556 }
 557
 558 /*
 559  * interface claims are made only at the request of user level code,
 560  * which can also release them (explicitly or by closing files).
 561  * they're also undone when devices disconnect.
 562  */
 563
 564 static int driver_probe(struct usb_interface *intf,
 565                         const struct usb_device_id *id)
 566 {
 567         return -ENODEV;
 568 }
 569
 570 static void driver_disconnect(struct usb_interface *intf)
 571 {
 572         struct usb_dev_state *ps = usb_get_intfdata(intf);
 573         unsigned int ifnum = intf->altsetting->desc.bInterfaceNumber;
 574
 575         if (!ps)
 576                 return;
 577
 578         /* NOTE:  this relies on usbcore having canceled and completed
 579          * all pending I/O requests; 2.6 does that.
 580          */
 581
 582         if (likely(ifnum < 8*sizeof(ps->ifclaimed)))
 583                 clear_bit(ifnum, &ps->ifclaimed);
 584         else
 585                 dev_warn(&intf->dev, "interface number %u out of range\n",
 586                          ifnum);
 587
 588         usb_set_intfdata(intf, NULL);
 589
 590         /* force async requests to complete */
 591         destroy_async_on_interface(ps, ifnum);
 592 }
 593
 594 /* The following routines are merely placeholders.  There is no way
 595  * to inform a user task about suspend or resumes.
 596  */
 597 static int driver_suspend(struct usb_interface *intf, pm_message_t msg)
 598 {
 599         return 0;
 600 }
 601
 602 static int driver_resume(struct usb_interface *intf)
 603 {
 604         return 0;
 605 }
 606
 607 struct usb_driver usbfs_driver = {
 608         .name =         "usbfs",
 609         .probe =        driver_probe,
 610         .disconnect =   driver_disconnect,
 611         .suspend =      driver_suspend,
 612         .resume =       driver_resume,
 613 };
 614
 615 static int claimintf(struct usb_dev_state *ps, unsigned int ifnum)
 616 {
 617         struct usb_device *dev = ps->dev;
 618         struct usb_interface *intf;
 619         int err;
 620
 621         if (ifnum >= 8*sizeof(ps->ifclaimed))
 622                 return -EINVAL;
 623         /* already claimed */
 624         if (test_bit(ifnum, &ps->ifclaimed))
 625                 return 0;
 626
 627         intf = usb_ifnum_to_if(dev, ifnum);
 628         if (!intf)
 629                 err = -ENOENT;
 630         else
 631                 err = usb_driver_claim_interface(&usbfs_driver, intf, ps);
 632         if (err == 0)
 633                 set_bit(ifnum, &ps->ifclaimed);
 634         return err;
 635 }
 636
 637 static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum)
 638 {
 639         struct usb_device *dev;
 640         struct usb_interface *intf;
 641         int err;
 642
 643         err = -EINVAL;
 644         if (ifnum >= 8*sizeof(ps->ifclaimed))
 645                 return err;
 646         dev = ps->dev;
 647         intf = usb_ifnum_to_if(dev, ifnum);
 648         if (!intf)
 649                 err = -ENOENT;
 650         else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) {
 651                 usb_driver_release_interface(&usbfs_driver, intf);
 652                 err = 0;
 653         }
 654         return err;
 655 }
 656
 657 static int checkintf(struct usb_dev_state *ps, unsigned int ifnum)
 658 {
 659         if (ps->dev->state != USB_STATE_CONFIGURED)
 660                 return -EHOSTUNREACH;
 661         if (ifnum >= 8*sizeof(ps->ifclaimed))
 662                 return -EINVAL;
 663         if (test_bit(ifnum, &ps->ifclaimed))
 664                 return 0;
 665         /* if not yet claimed, claim it for the driver */
 666         dev_warn(&ps->dev->dev, "usbfs: process %d (%s) did not claim "
 667                  "interface %u before use\n", task_pid_nr(current),
 668                  current->comm, ifnum);
 669         return claimintf(ps, ifnum);
 670 }
 671
 672 static int findintfep(struct usb_device *dev, unsigned int ep)
 673 {
 674         unsigned int i, j, e;
 675         struct usb_interface *intf;
 676         struct usb_host_interface *alts;
 677         struct usb_endpoint_descriptor *endpt;
 678
 679         if (ep & ~(USB_DIR_IN|0xf))
 680                 return -EINVAL;
 681         if (!dev->actconfig)
 682                 return -ESRCH;
 683         for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
 684                 intf = dev->actconfig->interface[i];
 685                 for (j = 0; j < intf->num_altsetting; j++) {
 686                         alts = &intf->altsetting[j];
 687                         for (e = 0; e < alts->desc.bNumEndpoints; e++) {
 688                                 endpt = &alts->endpoint[e].desc;
 689                                 if (endpt->bEndpointAddress == ep)
 690                                         return alts->desc.bInterfaceNumber;
 691                         }
 692                 }
 693         }
 694         return -ENOENT;
 695 }
 696
 697 static int check_ctrlrecip(struct usb_dev_state *ps, unsigned int requesttype,
 698                            unsigned int request, unsigned int index)
 699 {
 700         int ret = 0;
 701         struct usb_host_interface *alt_setting;
 702
 703         if (ps->dev->state != USB_STATE_UNAUTHENTICATED
 704          && ps->dev->state != USB_STATE_ADDRESS
 705          && ps->dev->state != USB_STATE_CONFIGURED)
 706                 return -EHOSTUNREACH;
 707         if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
 708                 return 0;
 709
 710         /*
 711          * check for the special corner case 'get_device_id' in the printer
 712          * class specification, which we always want to allow as it is used
 713          * to query things like ink level, etc.
 714          */
 715         if (requesttype == 0xa1 && request == 0) {
 716                 alt_setting = usb_find_alt_setting(ps->dev->actconfig,
 717                                                    index >> 8, index & 0xff);
 718                 if (alt_setting
 719                  && alt_setting->desc.bInterfaceClass == USB_CLASS_PRINTER)
 720                         return 0;
 721         }
 722
 723         index &= 0xff;
 724         switch (requesttype & USB_RECIP_MASK) {
 725         case USB_RECIP_ENDPOINT:
 726                 if ((index & ~USB_DIR_IN) == 0)
 727                         return 0;
 728                 ret = findintfep(ps->dev, index);
 729                 if (ret < 0) {
 730                         /*
 731                          * Some not fully compliant Win apps seem to get
 732                          * index wrong and have the endpoint number here
 733                          * rather than the endpoint address (with the
 734                          * correct direction). Win does let this through,
 735                          * so we'll not reject it here but leave it to
 736                          * the device to not break KVM. But we warn.
 737                          */
 738                         ret = findintfep(ps->dev, index ^ 0x80);
 739                         if (ret >= 0)
 740                                 dev_info(&ps->dev->dev,
 741                                         "%s: process %i (%s) requesting ep %02x but needs %02x\n",
 742                                         __func__, task_pid_nr(current),
 743                                         current->comm, index, index ^ 0x80);
 744                 }
 745                 if (ret >= 0)
 746                         ret = checkintf(ps, ret);
 747                 break;
 748
 749         case USB_RECIP_INTERFACE:
 750                 ret = checkintf(ps, index);
 751                 break;
 752         }
 753         return ret;
 754 }
 755
 756 static struct usb_host_endpoint *ep_to_host_endpoint(struct usb_device *dev,
 757                                                      unsigned char ep)
 758 {
 759         if (ep & USB_ENDPOINT_DIR_MASK)
 760                 return dev->ep_in[ep & USB_ENDPOINT_NUMBER_MASK];
 761         else
 762                 return dev->ep_out[ep & USB_ENDPOINT_NUMBER_MASK];
 763 }
 764
 765 static int parse_usbdevfs_streams(struct usb_dev_state *ps,
 766                                   struct usbdevfs_streams __user *streams,
 767                                   unsigned int *num_streams_ret,
 768                                   unsigned int *num_eps_ret,
 769                                   struct usb_host_endpoint ***eps_ret,
 770                                   struct usb_interface **intf_ret)
 771 {
 772         unsigned int i, num_streams, num_eps;
 773         struct usb_host_endpoint **eps;
 774         struct usb_interface *intf = NULL;
 775         unsigned char ep;
 776         int ifnum, ret;
 777
 778         if (get_user(num_streams, &streams->num_streams) ||
 779             get_user(num_eps, &streams->num_eps))
 780                 return -EFAULT;
 781
 782         if (num_eps < 1 || num_eps > USB_MAXENDPOINTS)
 783                 return -EINVAL;
 784
 785         /* The XHCI controller allows max 2 ^ 16 streams */
 786         if (num_streams_ret && (num_streams < 2 || num_streams > 65536))
 787                 return -EINVAL;
 788
 789         eps = kmalloc(num_eps * sizeof(*eps), GFP_KERNEL);
 790         if (!eps)
 791                 return -ENOMEM;
 792
 793         for (i = 0; i < num_eps; i++) {
 794                 if (get_user(ep, &streams->eps[i])) {
 795                         ret = -EFAULT;
 796                         goto error;
 797                 }
 798                 eps[i] = ep_to_host_endpoint(ps->dev, ep);
 799                 if (!eps[i]) {
 800                         ret = -EINVAL;
 801                         goto error;
 802                 }
 803
 804                 /* usb_alloc/free_streams operate on an usb_interface */
 805                 ifnum = findintfep(ps->dev, ep);
 806                 if (ifnum < 0) {
 807                         ret = ifnum;
 808                         goto error;
 809                 }
 810
 811                 if (i == 0) {
 812                         ret = checkintf(ps, ifnum);
 813                         if (ret < 0)
 814                                 goto error;
 815                         intf = usb_ifnum_to_if(ps->dev, ifnum);
 816                 } else {
 817                         /* Verify all eps belong to the same interface */
 818                         if (ifnum != intf->altsetting->desc.bInterfaceNumber) {
 819                                 ret = -EINVAL;
 820                                 goto error;
 821                         }
 822                 }
 823         }
 824
 825         if (num_streams_ret)
 826                 *num_streams_ret = num_streams;
 827         *num_eps_ret = num_eps;
 828         *eps_ret = eps;
 829         *intf_ret = intf;
 830
 831         return 0;
 832
 833 error:
 834         kfree(eps);
 835         return ret;
 836 }
 837
 838 static int match_devt(struct device *dev, void *data)
 839 {
 840         return dev->devt == (dev_t) (unsigned long) data;
 841 }
 842
 843 static struct usb_device *usbdev_lookup_by_devt(dev_t devt)
 844 {
 845         struct device *dev;
 846
 847         dev = bus_find_device(&usb_bus_type, NULL,
 848                               (void *) (unsigned long) devt, match_devt);
 849         if (!dev)
 850                 return NULL;
 851         return container_of(dev, struct usb_device, dev);
 852 }
 853
 854 /*
 855  * file operations
 856  */
 857 static int usbdev_open(struct inode *inode, struct file *file)
 858 {
 859         struct usb_device *dev = NULL;
 860         struct usb_dev_state *ps;
 861         int ret;
 862
 863         ret = -ENOMEM;
 864         ps = kmalloc(sizeof(struct usb_dev_state), GFP_KERNEL);
 865         if (!ps)
 866                 goto out_free_ps;
 867
 868         ret = -ENODEV;
 869
 870         /* Protect against simultaneous removal or release */
 871         mutex_lock(&usbfs_mutex);
 872
 873         /* usbdev device-node */
 874         if (imajor(inode) == USB_DEVICE_MAJOR)
 875                 dev = usbdev_lookup_by_devt(inode->i_rdev);
 876
 877         mutex_unlock(&usbfs_mutex);
 878
 879         if (!dev)
 880                 goto out_free_ps;
 881
 882         usb_lock_device(dev);
 883         if (dev->state == USB_STATE_NOTATTACHED)
 884                 goto out_unlock_device;
 885
 886         ret = usb_autoresume_device(dev);
 887         if (ret)
 888                 goto out_unlock_device;
 889
 890         ps->dev = dev;
 891         ps->file = file;
 892         spin_lock_init(&ps->lock);
 893         INIT_LIST_HEAD(&ps->list);
 894         INIT_LIST_HEAD(&ps->async_pending);
 895         INIT_LIST_HEAD(&ps->async_completed);
 896         init_waitqueue_head(&ps->wait);
 897         ps->discsignr = 0;
 898         ps->disc_pid = get_pid(task_pid(current));
 899         ps->cred = get_current_cred();
 900         ps->disccontext = NULL;
 901         ps->ifclaimed = 0;
 902         security_task_getsecid(current, &ps->secid);
 903         smp_wmb();
 904         list_add_tail(&ps->list, &dev->filelist);
 905         file->private_data = ps;
 906         usb_unlock_device(dev);
 907         snoop(&dev->dev, "opened by process %d: %s\n", task_pid_nr(current),
 908                         current->comm);
 909         return ret;
 910
 911  out_unlock_device:
 912         usb_unlock_device(dev);
 913         usb_put_dev(dev);
 914  out_free_ps:
 915         kfree(ps);
 916         return ret;
 917 }
 918
 919 static int usbdev_release(struct inode *inode, struct file *file)
 920 {
 921         struct usb_dev_state *ps = file->private_data;
 922         struct usb_device *dev = ps->dev;
 923         unsigned int ifnum;
 924         struct async *as;
 925
 926         usb_lock_device(dev);
 927         usb_hub_release_all_ports(dev, ps);
 928
 929         list_del_init(&ps->list);
 930
 931         for (ifnum = 0; ps->ifclaimed && ifnum < 8*sizeof(ps->ifclaimed);
 932                         ifnum++) {
 933                 if (test_bit(ifnum, &ps->ifclaimed))
 934                         releaseintf(ps, ifnum);
 935         }
 936         destroy_all_async(ps);
 937         usb_autosuspend_device(dev);
 938         usb_unlock_device(dev);
 939         usb_put_dev(dev);
 940         put_pid(ps->disc_pid);
 941         put_cred(ps->cred);
 942
 943         as = async_getcompleted(ps);
 944         while (as) {
 945                 free_async(as);
 946                 as = async_getcompleted(ps);
 947         }
 948         kfree(ps);
 949         return 0;
 950 }
 951
 952 static int proc_control(struct usb_dev_state *ps, void __user *arg)
 953 {
 954         struct usb_device *dev = ps->dev;
 955         struct usbdevfs_ctrltransfer ctrl;
 956         unsigned int tmo;
 957         unsigned char *tbuf;
 958         unsigned wLength;
 959         int i, pipe, ret;
 960
 961         if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
 962                 return -EFAULT;
 963         ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.bRequest,
 964                               ctrl.wIndex);
 965         if (ret)
 966                 return ret;
 967         wLength = ctrl.wLength;         /* To suppress 64k PAGE_SIZE warning */
 968         if (wLength > PAGE_SIZE)
 969                 return -EINVAL;
 970         ret = usbfs_increase_memory_usage(PAGE_SIZE + sizeof(struct urb) +
 971                         sizeof(struct usb_ctrlrequest));
 972         if (ret)
 973                 return ret;
 974         tbuf = (unsigned char *)__get_free_page(GFP_KERNEL);
 975         if (!tbuf) {
 976                 ret = -ENOMEM;
 977                 goto done;
 978         }
 979         tmo = ctrl.timeout;
 980         snoop(&dev->dev, "control urb: bRequestType=%02x "
 981                 "bRequest=%02x wValue=%04x "
 982                 "wIndex=%04x wLength=%04x\n",
 983                 ctrl.bRequestType, ctrl.bRequest, ctrl.wValue,
 984                 ctrl.wIndex, ctrl.wLength);
 985         if (ctrl.bRequestType & 0x80) {
 986                 if (ctrl.wLength && !access_ok(VERIFY_WRITE, ctrl.data,
 987                                                ctrl.wLength)) {
 988                         ret = -EINVAL;
 989                         goto done;
 990                 }
 991                 pipe = usb_rcvctrlpipe(dev, 0);
 992                 snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT, NULL, 0);
 993
 994                 usb_unlock_device(dev);
 995                 i = usb_control_msg(dev, pipe, ctrl.bRequest,
 996                                     ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
 997                                     tbuf, ctrl.wLength, tmo);
 998                 usb_lock_device(dev);
 999                 snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE,
1000                           tbuf, max(i, 0));
1001                 if ((i > 0) && ctrl.wLength) {
1002                         if (copy_to_user(ctrl.data, tbuf, i)) {
1003                                 ret = -EFAULT;
1004                                 goto done;
1005                         }
1006                 }
1007         } else {
1008                 if (ctrl.wLength) {
1009                         if (copy_from_user(tbuf, ctrl.data, ctrl.wLength)) {
1010                                 ret = -EFAULT;
1011                                 goto done;
1012                         }
1013                 }
1014                 pipe = usb_sndctrlpipe(dev, 0);
1015                 snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT,
1016                         tbuf, ctrl.wLength);
1017
1018                 usb_unlock_device(dev);
1019                 i = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ctrl.bRequest,
1020                                     ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
1021                                     tbuf, ctrl.wLength, tmo);
1022                 usb_lock_device(dev);
1023                 snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE, NULL, 0);
1024         }
1025         if (i < 0 && i != -EPIPE) {
1026                 dev_printk(KERN_DEBUG, &dev->dev, "usbfs: USBDEVFS_CONTROL "
1027                            "failed cmd %s rqt %u rq %u len %u ret %d\n",
1028                            current->comm, ctrl.bRequestType, ctrl.bRequest,
1029                            ctrl.wLength, i);
1030         }
1031         ret = i;
1032  done:
1033         free_page((unsigned long) tbuf);
1034         usbfs_decrease_memory_usage(PAGE_SIZE + sizeof(struct urb) +
1035                         sizeof(struct usb_ctrlrequest));
1036         return ret;
1037 }
1038
1039 static int proc_bulk(struct usb_dev_state *ps, void __user *arg)
1040 {
1041         struct usb_device *dev = ps->dev;
1042         struct usbdevfs_bulktransfer bulk;
1043         unsigned int tmo, len1, pipe;
1044         int len2;
1045         unsigned char *tbuf;
1046         int i, ret;
1047
1048         if (copy_from_user(&bulk, arg, sizeof(bulk)))
1049                 return -EFAULT;
1050         ret = findintfep(ps->dev, bulk.ep);
1051         if (ret < 0)
1052                 return ret;
1053         ret = checkintf(ps, ret);
1054         if (ret)
1055                 return ret;
1056         if (bulk.ep & USB_DIR_IN)
1057                 pipe = usb_rcvbulkpipe(dev, bulk.ep & 0x7f);
1058         else
1059                 pipe = usb_sndbulkpipe(dev, bulk.ep & 0x7f);
1060         if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN)))
1061                 return -EINVAL;
1062         len1 = bulk.len;
1063         if (len1 >= USBFS_XFER_MAX)
1064                 return -EINVAL;
1065         ret = usbfs_increase_memory_usage(len1 + sizeof(struct urb));
1066         if (ret)
1067                 return ret;
1068         tbuf = kmalloc(len1, GFP_KERNEL);
1069         if (!tbuf) {
1070                 ret = -ENOMEM;
1071                 goto done;
1072         }
1073         tmo = bulk.timeout;
1074         if (bulk.ep & 0x80) {
1075                 if (len1 && !access_ok(VERIFY_WRITE, bulk.data, len1)) {
1076                         ret = -EINVAL;
1077                         goto done;
1078                 }
1079                 snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, NULL, 0);
1080
1081                 usb_unlock_device(dev);
1082                 i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
1083                 usb_lock_device(dev);
1084                 snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, tbuf, len2);
1085
1086                 if (!i && len2) {
1087                         if (copy_to_user(bulk.data, tbuf, len2)) {
1088                                 ret = -EFAULT;
1089                                 goto done;
1090                         }
1091                 }
1092         } else {
1093                 if (len1) {
1094                         if (copy_from_user(tbuf, bulk.data, len1)) {
1095                                 ret = -EFAULT;
1096                                 goto done;
1097                         }
1098                 }
1099                 snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, tbuf, len1);
1100
1101                 usb_unlock_device(dev);
1102                 i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
1103                 usb_lock_device(dev);
1104                 snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, NULL, 0);
1105         }
1106         ret = (i < 0 ? i : len2);
1107  done:
1108         kfree(tbuf);
1109         usbfs_decrease_memory_usage(len1 + sizeof(struct urb));
1110         return ret;
1111 }
1112
1113 static void check_reset_of_active_ep(struct usb_device *udev,
1114                 unsigned int epnum, char *ioctl_name)
1115 {
1116         struct usb_host_endpoint **eps;
1117         struct usb_host_endpoint *ep;
1118
1119         eps = (epnum & USB_DIR_IN) ? udev->ep_in : udev->ep_out;
1120         ep = eps[epnum & 0x0f];
1121         if (ep && !list_empty(&ep->urb_list))
1122                 dev_warn(&udev->dev, "Process %d (%s) called USBDEVFS_%s for active endpoint 0x%02x\n",
1123                                 task_pid_nr(current), current->comm,
1124                                 ioctl_name, epnum);
1125 }
1126
1127 static int proc_resetep(struct usb_dev_state *ps, void __user *arg)
1128 {
1129         unsigned int ep;
1130         int ret;
1131
1132         if (get_user(ep, (unsigned int __user *)arg))
1133                 return -EFAULT;
1134         ret = findintfep(ps->dev, ep);
1135         if (ret < 0)
1136                 return ret;
1137         ret = checkintf(ps, ret);
1138         if (ret)
1139                 return ret;
1140         check_reset_of_active_ep(ps->dev, ep, "RESETEP");
1141         usb_reset_endpoint(ps->dev, ep);
1142         return 0;
1143 }
1144
1145 static int proc_clearhalt(struct usb_dev_state *ps, void __user *arg)
1146 {
1147         unsigned int ep;
1148         int pipe;
1149         int ret;
1150
1151         if (get_user(ep, (unsigned int __user *)arg))
1152                 return -EFAULT;
1153         ret = findintfep(ps->dev, ep);
1154         if (ret < 0)
1155                 return ret;
1156         ret = checkintf(ps, ret);
1157         if (ret)
1158                 return ret;
1159         check_reset_of_active_ep(ps->dev, ep, "CLEAR_HALT");
1160         if (ep & USB_DIR_IN)
1161                 pipe = usb_rcvbulkpipe(ps->dev, ep & 0x7f);
1162         else
1163                 pipe = usb_sndbulkpipe(ps->dev, ep & 0x7f);
1164
1165         return usb_clear_halt(ps->dev, pipe);
1166 }
1167
1168 static int proc_getdriver(struct usb_dev_state *ps, void __user *arg)
1169 {
1170         struct usbdevfs_getdriver gd;
1171         struct usb_interface *intf;
1172         int ret;
1173
1174         if (copy_from_user(&gd, arg, sizeof(gd)))
1175                 return -EFAULT;
1176         intf = usb_ifnum_to_if(ps->dev, gd.interface);
1177         if (!intf || !intf->dev.driver)
1178                 ret = -ENODATA;
1179         else {
1180                 strlcpy(gd.driver, intf->dev.driver->name,
1181                                 sizeof(gd.driver));
1182                 ret = (copy_to_user(arg, &gd, sizeof(gd)) ? -EFAULT : 0);
1183         }
1184         return ret;
1185 }
1186
1187 static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg)
1188 {
1189         struct usbdevfs_connectinfo ci = {
1190                 .devnum = ps->dev->devnum,
1191                 .slow = ps->dev->speed == USB_SPEED_LOW
1192         };
1193
1194         if (copy_to_user(arg, &ci, sizeof(ci)))
1195                 return -EFAULT;
1196         return 0;
1197 }
1198
1199 static int proc_resetdevice(struct usb_dev_state *ps)
1200 {
1201         return usb_reset_device(ps->dev);
1202 }
1203
1204 static int proc_setintf(struct usb_dev_state *ps, void __user *arg)
1205 {
1206         struct usbdevfs_setinterface setintf;
1207         int ret;
1208
1209         if (copy_from_user(&setintf, arg, sizeof(setintf)))
1210                 return -EFAULT;
1211         ret = checkintf(ps, setintf.interface);
1212         if (ret)
1213                 return ret;
1214
1215         destroy_async_on_interface(ps, setintf.interface);
1216
1217         return usb_set_interface(ps->dev, setintf.interface,
1218                         setintf.altsetting);
1219 }
1220
1221 static int proc_setconfig(struct usb_dev_state *ps, void __user *arg)
1222 {
1223         int u;
1224         int status = 0;
1225         struct usb_host_config *actconfig;
1226
1227         if (get_user(u, (int __user *)arg))
1228                 return -EFAULT;
1229
1230         actconfig = ps->dev->actconfig;
1231
1232         /* Don't touch the device if any interfaces are claimed.
1233          * It could interfere with other drivers' operations, and if
1234          * an interface is claimed by usbfs it could easily deadlock.
1235          */
1236         if (actconfig) {
1237                 int i;
1238
1239                 for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
1240                         if (usb_interface_claimed(actconfig->interface[i])) {
1241                                 dev_warn(&ps->dev->dev,
1242                                         "usbfs: interface %d claimed by %s "
1243                                         "while '%s' sets config #%d\n",
1244                                         actconfig->interface[i]
1245                                                 ->cur_altsetting
1246                                                 ->desc.bInterfaceNumber,
1247                                         actconfig->interface[i]
1248                                                 ->dev.driver->name,
1249                                         current->comm, u);
1250                                 status = -EBUSY;
1251                                 break;
1252                         }
1253                 }
1254         }
1255
1256         /* SET_CONFIGURATION is often abused as a "cheap" driver reset,
1257          * so avoid usb_set_configuration()'s kick to sysfs
1258          */
1259         if (status == 0) {
1260                 if (actconfig && actconfig->desc.bConfigurationValue == u)
1261                         status = usb_reset_configuration(ps->dev);
1262                 else
1263                         status = usb_set_configuration(ps->dev, u);
1264         }
1265
1266         return status;
1267 }
1268
1269 static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb,
1270                         struct usbdevfs_iso_packet_desc __user *iso_frame_desc,
1271                         void __user *arg)
1272 {
1273         struct usbdevfs_iso_packet_desc *isopkt = NULL;
1274         struct usb_host_endpoint *ep;
1275         struct async *as = NULL;
1276         struct usb_ctrlrequest *dr = NULL;
1277         unsigned int u, totlen, isofrmlen;
1278         int i, ret, is_in, num_sgs = 0, ifnum = -1;
1279         int number_of_packets = 0;
1280         unsigned int stream_id = 0;
1281         void *buf;
1282
1283         if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
1284                                 USBDEVFS_URB_SHORT_NOT_OK |
1285                                 USBDEVFS_URB_BULK_CONTINUATION |
1286                                 USBDEVFS_URB_NO_FSBR |
1287                                 USBDEVFS_URB_ZERO_PACKET |
1288                                 USBDEVFS_URB_NO_INTERRUPT))
1289                 return -EINVAL;
1290         if (uurb->buffer_length > 0 && !uurb->buffer)
1291                 return -EINVAL;
1292         if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
1293             (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
1294                 ifnum = findintfep(ps->dev, uurb->endpoint);
1295                 if (ifnum < 0)
1296                         return ifnum;
1297                 ret = checkintf(ps, ifnum);
1298                 if (ret)
1299                         return ret;
1300         }
1301         ep = ep_to_host_endpoint(ps->dev, uurb->endpoint);
1302         if (!ep)
1303                 return -ENOENT;
1304         is_in = (uurb->endpoint & USB_ENDPOINT_DIR_MASK) != 0;
1305
1306         u = 0;
1307         switch (uurb->type) {
1308         case USBDEVFS_URB_TYPE_CONTROL:
1309                 if (!usb_endpoint_xfer_control(&ep->desc))
1310                         return -EINVAL;
1311                 /* min 8 byte setup packet */
1312                 if (uurb->buffer_length < 8)
1313                         return -EINVAL;
1314                 dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
1315                 if (!dr)
1316                         return -ENOMEM;
1317                 if (copy_from_user(dr, uurb->buffer, 8)) {
1318                         ret = -EFAULT;
1319                         goto error;
1320                 }
1321                 if (uurb->buffer_length < (le16_to_cpup(&dr->wLength) + 8)) {
1322                         ret = -EINVAL;
1323                         goto error;
1324                 }
1325                 ret = check_ctrlrecip(ps, dr->bRequestType, dr->bRequest,
1326                                       le16_to_cpup(&dr->wIndex));
1327                 if (ret)
1328                         goto error;
1329                 uurb->buffer_length = le16_to_cpup(&dr->wLength);
1330                 uurb->buffer += 8;
1331                 if ((dr->bRequestType & USB_DIR_IN) && uurb->buffer_length) {
1332                         is_in = 1;
1333                         uurb->endpoint |= USB_DIR_IN;
1334                 } else {
1335                         is_in = 0;
1336                         uurb->endpoint &= ~USB_DIR_IN;
1337                 }
1338                 snoop(&ps->dev->dev, "control urb: bRequestType=%02x "
1339                         "bRequest=%02x wValue=%04x "
1340                         "wIndex=%04x wLength=%04x\n",
1341                         dr->bRequestType, dr->bRequest,
1342                         __le16_to_cpup(&dr->wValue),
1343                         __le16_to_cpup(&dr->wIndex),
1344                         __le16_to_cpup(&dr->wLength));
1345                 u = sizeof(struct usb_ctrlrequest);
1346                 break;
1347
1348         case USBDEVFS_URB_TYPE_BULK:
1349                 switch (usb_endpoint_type(&ep->desc)) {
1350                 case USB_ENDPOINT_XFER_CONTROL:
1351                 case USB_ENDPOINT_XFER_ISOC:
1352                         return -EINVAL;
1353                 case USB_ENDPOINT_XFER_INT:
1354                         /* allow single-shot interrupt transfers */
1355                         uurb->type = USBDEVFS_URB_TYPE_INTERRUPT;
1356                         goto interrupt_urb;
1357                 }
1358                 num_sgs = DIV_ROUND_UP(uurb->buffer_length, USB_SG_SIZE);
1359                 if (num_sgs == 1 || num_sgs > ps->dev->bus->sg_tablesize)
1360                         num_sgs = 0;
1361                 if (ep->streams)
1362                         stream_id = uurb->stream_id;
1363                 break;
1364
1365         case USBDEVFS_URB_TYPE_INTERRUPT:
1366                 if (!usb_endpoint_xfer_int(&ep->desc))
1367                         return -EINVAL;
1368  interrupt_urb:
1369                 break;
1370
1371         case USBDEVFS_URB_TYPE_ISO:
1372                 /* arbitrary limit */
1373                 if (uurb->number_of_packets < 1 ||
1374                     uurb->number_of_packets > 128)
1375                         return -EINVAL;
1376                 if (!usb_endpoint_xfer_isoc(&ep->desc))
1377                         return -EINVAL;
1378                 number_of_packets = uurb->number_of_packets;
1379                 isofrmlen = sizeof(struct usbdevfs_iso_packet_desc) *
1380                                    number_of_packets;
1381                 isopkt = kmalloc(isofrmlen, GFP_KERNEL);
1382                 if (!isopkt)
1383                         return -ENOMEM;
1384                 if (copy_from_user(isopkt, iso_frame_desc, isofrmlen)) {
1385                         ret = -EFAULT;
1386                         goto error;
1387                 }
1388                 for (totlen = u = 0; u < number_of_packets; u++) {
1389                         /*
1390                          * arbitrary limit need for USB 3.0
1391                          * bMaxBurst (0~15 allowed, 1~16 packets)
1392                          * bmAttributes (bit 1:0, mult 0~2, 1~3 packets)
1393                          * sizemax: 1024 * 16 * 3 = 49152
1394                          */
1395                         if (isopkt[u].length > 49152) {
1396                                 ret = -EINVAL;
1397                                 goto error;
1398                         }
1399                         totlen += isopkt[u].length;
1400                 }
1401                 u *= sizeof(struct usb_iso_packet_descriptor);
1402                 uurb->buffer_length = totlen;
1403                 break;
1404
1405         default:
1406                 return -EINVAL;
1407         }
1408
1409         if (uurb->buffer_length >= USBFS_XFER_MAX) {
1410                 ret = -EINVAL;
1411                 goto error;
1412         }
1413         if (uurb->buffer_length > 0 &&
1414                         !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
1415                                 uurb->buffer, uurb->buffer_length)) {
1416                 ret = -EFAULT;
1417                 goto error;
1418         }
1419         as = alloc_async(number_of_packets);
1420         if (!as) {
1421                 ret = -ENOMEM;
1422                 goto error;
1423         }
1424
1425         u += sizeof(struct async) + sizeof(struct urb) + uurb->buffer_length +
1426              num_sgs * sizeof(struct scatterlist);
1427         ret = usbfs_increase_memory_usage(u);
1428         if (ret)
1429                 goto error;
1430         as->mem_usage = u;
1431
1432         if (num_sgs) {
1433                 as->urb->sg = kmalloc(num_sgs * sizeof(struct scatterlist),
1434                                       GFP_KERNEL);
1435                 if (!as->urb->sg) {
1436                         ret = -ENOMEM;
1437                         goto error;
1438                 }
1439                 as->urb->num_sgs = num_sgs;
1440                 sg_init_table(as->urb->sg, as->urb->num_sgs);
1441
1442                 totlen = uurb->buffer_length;
1443                 for (i = 0; i < as->urb->num_sgs; i++) {
1444                         u = (totlen > USB_SG_SIZE) ? USB_SG_SIZE : totlen;
1445                         buf = kmalloc(u, GFP_KERNEL);
1446                         if (!buf) {
1447                                 ret = -ENOMEM;
1448                                 goto error;
1449                         }
1450                         sg_set_buf(&as->urb->sg[i], buf, u);
1451
1452                         if (!is_in) {
1453                                 if (copy_from_user(buf, uurb->buffer, u)) {
1454                                         ret = -EFAULT;
1455                                         goto error;
1456                                 }
1457                                 uurb->buffer += u;
1458                         }
1459                         totlen -= u;
1460                 }
1461         } else if (uurb->buffer_length > 0) {
1462                 as->urb->transfer_buffer = kmalloc(uurb->buffer_length,
1463                                 GFP_KERNEL);
1464                 if (!as->urb->transfer_buffer) {
1465                         ret = -ENOMEM;
1466                         goto error;
1467                 }
1468
1469                 if (!is_in) {
1470                         if (copy_from_user(as->urb->transfer_buffer,
1471                                            uurb->buffer,
1472                                            uurb->buffer_length)) {
1473                                 ret = -EFAULT;
1474                                 goto error;
1475                         }
1476                 } else if (uurb->type == USBDEVFS_URB_TYPE_ISO) {
1477                         /*
1478                          * Isochronous input data may end up being
1479                          * discontiguous if some of the packets are short.
1480                          * Clear the buffer so that the gaps don't leak
1481                          * kernel data to userspace.
1482                          */
1483                         memset(as->urb->transfer_buffer, 0,
1484                                         uurb->buffer_length);
1485                 }
1486         }
1487         as->urb->dev = ps->dev;
1488         as->urb->pipe = (uurb->type << 30) |
1489                         __create_pipe(ps->dev, uurb->endpoint & 0xf) |
1490                         (uurb->endpoint & USB_DIR_IN);
1491
1492         /* This tedious sequence is necessary because the URB_* flags
1493          * are internal to the kernel and subject to change, whereas
1494          * the USBDEVFS_URB_* flags are a user API and must not be changed.
1495          */
1496         u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
1497         if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
1498                 u |= URB_ISO_ASAP;
1499         if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in)
1500                 u |= URB_SHORT_NOT_OK;
1501         if (uurb->flags & USBDEVFS_URB_NO_FSBR)
1502                 u |= URB_NO_FSBR;
1503         if (uurb->flags & USBDEVFS_URB_ZERO_PACKET)
1504                 u |= URB_ZERO_PACKET;
1505         if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
1506                 u |= URB_NO_INTERRUPT;
1507         as->urb->transfer_flags = u;
1508
1509         as->urb->transfer_buffer_length = uurb->buffer_length;
1510         as->urb->setup_packet = (unsigned char *)dr;
1511         dr = NULL;
1512         as->urb->start_frame = uurb->start_frame;
1513         as->urb->number_of_packets = number_of_packets;
1514         as->urb->stream_id = stream_id;
1515         if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
1516                         ps->dev->speed == USB_SPEED_HIGH)
1517                 as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);
1518         else
1519                 as->urb->interval = ep->desc.bInterval;
1520         as->urb->context = as;
1521         as->urb->complete = async_completed;
1522         for (totlen = u = 0; u < number_of_packets; u++) {
1523                 as->urb->iso_frame_desc[u].offset = totlen;
1524                 as->urb->iso_frame_desc[u].length = isopkt[u].length;
1525                 totlen += isopkt[u].length;
1526         }
1527         kfree(isopkt);
1528         isopkt = NULL;
1529         as->ps = ps;
1530         as->userurb = arg;
1531         if (is_in && uurb->buffer_length > 0)
1532                 as->userbuffer = uurb->buffer;
1533         else
1534                 as->userbuffer = NULL;
1535         as->signr = uurb->signr;
1536         as->ifnum = ifnum;
1537         as->pid = get_pid(task_pid(current));
1538         as->cred = get_current_cred();
1539         security_task_getsecid(current, &as->secid);
1540         snoop_urb(ps->dev, as->userurb, as->urb->pipe,
1541                         as->urb->transfer_buffer_length, 0, SUBMIT,
1542                         NULL, 0);
1543         if (!is_in)
1544                 snoop_urb_data(as->urb, as->urb->transfer_buffer_length);
1545
1546         async_newpending(as);
1547
1548         if (usb_endpoint_xfer_bulk(&ep->desc)) {
1549                 spin_lock_irq(&ps->lock);
1550
1551                 /* Not exactly the endpoint address; the direction bit is
1552                  * shifted to the 0x10 position so that the value will be
1553                  * between 0 and 31.
1554                  */
1555                 as->bulk_addr = usb_endpoint_num(&ep->desc) |
1556                         ((ep->desc.bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1557                                 >> 3);
1558
1559                 /* If this bulk URB is the start of a new transfer, re-enable
1560                  * the endpoint.  Otherwise mark it as a continuation URB.
1561                  */
1562                 if (uurb->flags & USBDEVFS_URB_BULK_CONTINUATION)
1563                         as->bulk_status = AS_CONTINUATION;
1564                 else
1565                         ps->disabled_bulk_eps &= ~(1 << as->bulk_addr);
1566
1567                 /* Don't accept continuation URBs if the endpoint is
1568                  * disabled because of an earlier error.
1569                  */
1570                 if (ps->disabled_bulk_eps & (1 << as->bulk_addr))
1571                         ret = -EREMOTEIO;
1572                 else
1573                         ret = usb_submit_urb(as->urb, GFP_ATOMIC);
1574                 spin_unlock_irq(&ps->lock);
1575         } else {
1576                 ret = usb_submit_urb(as->urb, GFP_KERNEL);
1577         }
1578
1579         if (ret) {
1580                 dev_printk(KERN_DEBUG, &ps->dev->dev,
1581                            "usbfs: usb_submit_urb returned %d\n", ret);
1582                 snoop_urb(ps->dev, as->userurb, as->urb->pipe,
1583                                 0, ret, COMPLETE, NULL, 0);
1584                 async_removepending(as);
1585                 goto error;
1586         }
1587         return 0;
1588
1589  error:
1590         kfree(isopkt);
1591         kfree(dr);
1592         if (as)
1593                 free_async(as);
1594         return ret;
1595 }
1596
1597 static int proc_submiturb(struct usb_dev_state *ps, void __user *arg)
1598 {
1599         struct usbdevfs_urb uurb;
1600
1601         if (copy_from_user(&uurb, arg, sizeof(uurb)))
1602                 return -EFAULT;
1603
1604         return proc_do_submiturb(ps, &uurb,
1605                         (((struct usbdevfs_urb __user *)arg)->iso_frame_desc),
1606                         arg);
1607 }
1608
1609 static int proc_unlinkurb(struct usb_dev_state *ps, void __user *arg)
1610 {
1611         struct urb *urb;
1612         struct async *as;
1613         unsigned long flags;
1614
1615         spin_lock_irqsave(&ps->lock, flags);
1616         as = async_getpending(ps, arg);
1617         if (!as) {
1618                 spin_unlock_irqrestore(&ps->lock, flags);
1619                 return -EINVAL;
1620         }
1621
1622         urb = as->urb;
1623         usb_get_urb(urb);
1624         spin_unlock_irqrestore(&ps->lock, flags);
1625
1626         usb_kill_urb(urb);
1627         usb_put_urb(urb);
1628
1629         return 0;
1630 }
1631
1632 static int processcompl(struct async *as, void __user * __user *arg)
1633 {
1634         struct urb *urb = as->urb;
1635         struct usbdevfs_urb __user *userurb = as->userurb;
1636         void __user *addr = as->userurb;
1637         unsigned int i;
1638
1639         if (as->userbuffer && urb->actual_length) {
1640                 if (copy_urb_data_to_user(as->userbuffer, urb))
1641                         goto err_out;
1642         }
1643         if (put_user(as->status, &userurb->status))
1644                 goto err_out;
1645         if (put_user(urb->actual_length, &userurb->actual_length))
1646                 goto err_out;
1647         if (put_user(urb->error_count, &userurb->error_count))
1648                 goto err_out;
1649
1650         if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
1651                 for (i = 0; i < urb->number_of_packets; i++) {
1652                         if (put_user(urb->iso_frame_desc[i].actual_length,
1653                                      &userurb->iso_frame_desc[i].actual_length))
1654                                 goto err_out;
1655                         if (put_user(urb->iso_frame_desc[i].status,
1656                                      &userurb->iso_frame_desc[i].status))
1657                                 goto err_out;
1658                 }
1659         }
1660
1661         if (put_user(addr, (void __user * __user *)arg))
1662                 return -EFAULT;
1663         return 0;
1664
1665 err_out:
1666         return -EFAULT;
1667 }
1668
1669 static struct async *reap_as(struct usb_dev_state *ps)
1670 {
1671         DECLARE_WAITQUEUE(wait, current);
1672         struct async *as = NULL;
1673         struct usb_device *dev = ps->dev;
1674
1675         add_wait_queue(&ps->wait, &wait);
1676         for (;;) {
1677                 __set_current_state(TASK_INTERRUPTIBLE);
1678                 as = async_getcompleted(ps);
1679                 if (as || !connected(ps))
1680                         break;
1681                 if (signal_pending(current))
1682                         break;
1683                 usb_unlock_device(dev);
1684                 schedule();
1685                 usb_lock_device(dev);
1686         }
1687         remove_wait_queue(&ps->wait, &wait);
1688         set_current_state(TASK_RUNNING);
1689         return as;
1690 }
1691
1692 static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
1693 {
1694         struct async *as = reap_as(ps);
1695
1696         if (as) {
1697                 int retval;
1698
1699                 snoop(&ps->dev->dev, "reap %p\n", as->userurb);
1700                 retval = processcompl(as, (void __user * __user *)arg);
1701                 free_async(as);
1702                 return retval;
1703         }
1704         if (signal_pending(current))
1705                 return -EINTR;
1706         return -ENODEV;
1707 }
1708
1709 static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
1710 {
1711         int retval;
1712         struct async *as;
1713
1714         as = async_getcompleted(ps);
1715         if (as) {
1716                 snoop(&ps->dev->dev, "reap %p\n", as->userurb);
1717                 retval = processcompl(as, (void __user * __user *)arg);
1718                 free_async(as);
1719         } else {
1720                 retval = (connected(ps) ? -EAGAIN : -ENODEV);
1721         }
1722         return retval;
1723 }
1724
1725 #ifdef CONFIG_COMPAT
1726 static int proc_control_compat(struct usb_dev_state *ps,
1727                                 struct usbdevfs_ctrltransfer32 __user *p32)
1728 {
1729         struct usbdevfs_ctrltransfer __user *p;
1730         __u32 udata;
1731         p = compat_alloc_user_space(sizeof(*p));
1732         if (copy_in_user(p, p32, (sizeof(*p32) - sizeof(compat_caddr_t))) ||
1733             get_user(udata, &p32->data) ||
1734             put_user(compat_ptr(udata), &p->data))
1735                 return -EFAULT;
1736         return proc_control(ps, p);
1737 }
1738
1739 static int proc_bulk_compat(struct usb_dev_state *ps,
1740                         struct usbdevfs_bulktransfer32 __user *p32)
1741 {
1742         struct usbdevfs_bulktransfer __user *p;
1743         compat_uint_t n;
1744         compat_caddr_t addr;
1745
1746         p = compat_alloc_user_space(sizeof(*p));
1747
1748         if (get_user(n, &p32->ep) || put_user(n, &p->ep) ||
1749             get_user(n, &p32->len) || put_user(n, &p->len) ||
1750             get_user(n, &p32->timeout) || put_user(n, &p->timeout) ||
1751             get_user(addr, &p32->data) || put_user(compat_ptr(addr), &p->data))
1752                 return -EFAULT;
1753
1754         return proc_bulk(ps, p);
1755 }
1756 static int proc_disconnectsignal_compat(struct usb_dev_state *ps, void __user *arg)
1757 {
1758         struct usbdevfs_disconnectsignal32 ds;
1759
1760         if (copy_from_user(&ds, arg, sizeof(ds)))
1761                 return -EFAULT;
1762         ps->discsignr = ds.signr;
1763         ps->disccontext = compat_ptr(ds.context);
1764         return 0;
1765 }
1766
1767 static int get_urb32(struct usbdevfs_urb *kurb,
1768                      struct usbdevfs_urb32 __user *uurb)
1769 {
1770         __u32  uptr;
1771         if (!access_ok(VERIFY_READ, uurb, sizeof(*uurb)) ||
1772             __get_user(kurb->type, &uurb->type) ||
1773             __get_user(kurb->endpoint, &uurb->endpoint) ||
1774             __get_user(kurb->status, &uurb->status) ||
1775             __get_user(kurb->flags, &uurb->flags) ||
1776             __get_user(kurb->buffer_length, &uurb->buffer_length) ||
1777             __get_user(kurb->actual_length, &uurb->actual_length) ||
1778             __get_user(kurb->start_frame, &uurb->start_frame) ||
1779             __get_user(kurb->number_of_packets, &uurb->number_of_packets) ||
1780             __get_user(kurb->error_count, &uurb->error_count) ||
1781             __get_user(kurb->signr, &uurb->signr))
1782                 return -EFAULT;
1783
1784         if (__get_user(uptr, &uurb->buffer))
1785                 return -EFAULT;
1786         kurb->buffer = compat_ptr(uptr);
1787         if (__get_user(uptr, &uurb->usercontext))
1788                 return -EFAULT;
1789         kurb->usercontext = compat_ptr(uptr);
1790
1791         return 0;
1792 }
1793
1794 static int proc_submiturb_compat(struct usb_dev_state *ps, void __user *arg)
1795 {
1796         struct usbdevfs_urb uurb;
1797
1798         if (get_urb32(&uurb, (struct usbdevfs_urb32 __user *)arg))
1799                 return -EFAULT;
1800
1801         return proc_do_submiturb(ps, &uurb,
1802                         ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc,
1803                         arg);
1804 }
1805
1806 static int processcompl_compat(struct async *as, void __user * __user *arg)
1807 {
1808         struct urb *urb = as->urb;
1809         struct usbdevfs_urb32 __user *userurb = as->userurb;
1810         void __user *addr = as->userurb;
1811         unsigned int i;
1812
1813         if (as->userbuffer && urb->actual_length) {
1814                 if (copy_urb_data_to_user(as->userbuffer, urb))
1815                         return -EFAULT;
1816         }
1817         if (put_user(as->status, &userurb->status))
1818                 return -EFAULT;
1819         if (put_user(urb->actual_length, &userurb->actual_length))
1820                 return -EFAULT;
1821         if (put_user(urb->error_count, &userurb->error_count))
1822                 return -EFAULT;
1823
1824         if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
1825                 for (i = 0; i < urb->number_of_packets; i++) {
1826                         if (put_user(urb->iso_frame_desc[i].actual_length,
1827                                      &userurb->iso_frame_desc[i].actual_length))
1828                                 return -EFAULT;
1829                         if (put_user(urb->iso_frame_desc[i].status,
1830                                      &userurb->iso_frame_desc[i].status))
1831                                 return -EFAULT;
1832                 }
1833         }
1834
1835         if (put_user(ptr_to_compat(addr), (u32 __user *)arg))
1836                 return -EFAULT;
1837         return 0;
1838 }
1839
1840 static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
1841 {
1842         struct async *as = reap_as(ps);
1843
1844         if (as) {
1845                 int retval;
1846
1847                 snoop(&ps->dev->dev, "reap %p\n", as->userurb);
1848                 retval = processcompl_compat(as, (void __user * __user *)arg);
1849                 free_async(as);
1850                 return retval;
1851         }
1852         if (signal_pending(current))
1853                 return -EINTR;
1854         return -ENODEV;
1855 }
1856
1857 static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *arg)
1858 {
1859         int retval;
1860         struct async *as;
1861
1862         as = async_getcompleted(ps);
1863         if (as) {
1864                 snoop(&ps->dev->dev, "reap %p\n", as->userurb);
1865                 retval = processcompl_compat(as, (void __user * __user *)arg);
1866                 free_async(as);
1867         } else {
1868                 retval = (connected(ps) ? -EAGAIN : -ENODEV);
1869         }
1870         return retval;
1871 }
1872
1873
1874 #endif
1875
1876 static int proc_disconnectsignal(struct usb_dev_state *ps, void __user *arg)
1877 {
1878         struct usbdevfs_disconnectsignal ds;
1879
1880         if (copy_from_user(&ds, arg, sizeof(ds)))
1881                 return -EFAULT;
1882         ps->discsignr = ds.signr;
1883         ps->disccontext = ds.context;
1884         return 0;
1885 }
1886
1887 static int proc_claiminterface(struct usb_dev_state *ps, void __user *arg)
1888 {
1889         unsigned int ifnum;
1890
1891         if (get_user(ifnum, (unsigned int __user *)arg))
1892                 return -EFAULT;
1893         return claimintf(ps, ifnum);
1894 }
1895
1896 static int proc_releaseinterface(struct usb_dev_state *ps, void __user *arg)
1897 {
1898         unsigned int ifnum;
1899         int ret;
1900
1901         if (get_user(ifnum, (unsigned int __user *)arg))
1902                 return -EFAULT;
1903         ret = releaseintf(ps, ifnum);
1904         if (ret < 0)
1905                 return ret;
1906         destroy_async_on_interface (ps, ifnum);
1907         return 0;
1908 }
1909
1910 static int proc_ioctl(struct usb_dev_state *ps, struct usbdevfs_ioctl *ctl)
1911 {
1912         int                     size;
1913         void                    *buf = NULL;
1914         int                     retval = 0;
1915         struct usb_interface    *intf = NULL;
1916         struct usb_driver       *driver = NULL;
1917
1918         /* alloc buffer */
1919         size = _IOC_SIZE(ctl->ioctl_code);
1920         if (size > 0) {
1921                 buf = kmalloc(size, GFP_KERNEL);
1922                 if (buf == NULL)
1923                         return -ENOMEM;
1924                 if ((_IOC_DIR(ctl->ioctl_code) & _IOC_WRITE)) {
1925                         if (copy_from_user(buf, ctl->data, size)) {
1926                                 kfree(buf);
1927                                 return -EFAULT;
1928                         }
1929                 } else {
1930                         memset(buf, 0, size);
1931                 }
1932         }
1933
1934         if (!connected(ps)) {
1935                 kfree(buf);
1936                 return -ENODEV;
1937         }
1938
1939         if (ps->dev->state != USB_STATE_CONFIGURED)
1940                 retval = -EHOSTUNREACH;
1941         else if (!(intf = usb_ifnum_to_if(ps->dev, ctl->ifno)))
1942                 retval = -EINVAL;
1943         else switch (ctl->ioctl_code) {
1944
1945         /* disconnect kernel driver from interface */
1946         case USBDEVFS_DISCONNECT:
1947                 if (intf->dev.driver) {
1948                         driver = to_usb_driver(intf->dev.driver);
1949                         dev_dbg(&intf->dev, "disconnect by usbfs\n");
1950                         usb_driver_release_interface(driver, intf);
1951                 } else
1952                         retval = -ENODATA;
1953                 break;
1954
1955         /* let kernel drivers try to (re)bind to the interface */
1956         case USBDEVFS_CONNECT:
1957                 if (!intf->dev.driver)
1958                         retval = device_attach(&intf->dev);
1959                 else
1960                         retval = -EBUSY;
1961                 break;
1962
1963         /* talk directly to the interface's driver */
1964         default:
1965                 if (intf->dev.driver)
1966                         driver = to_usb_driver(intf->dev.driver);
1967                 if (driver == NULL || driver->unlocked_ioctl == NULL) {
1968                         retval = -ENOTTY;
1969                 } else {
1970                         retval = driver->unlocked_ioctl(intf, ctl->ioctl_code, buf);
1971                         if (retval == -ENOIOCTLCMD)
1972                                 retval = -ENOTTY;
1973                 }
1974         }
1975
1976         /* cleanup and return */
1977         if (retval >= 0
1978                         && (_IOC_DIR(ctl->ioctl_code) & _IOC_READ) != 0
1979                         && size > 0
1980                         && copy_to_user(ctl->data, buf, size) != 0)
1981                 retval = -EFAULT;
1982
1983         kfree(buf);
1984         return retval;
1985 }
1986
1987 static int proc_ioctl_default(struct usb_dev_state *ps, void __user *arg)
1988 {
1989         struct usbdevfs_ioctl   ctrl;
1990
1991         if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
1992                 return -EFAULT;
1993         return proc_ioctl(ps, &ctrl);
1994 }
1995
1996 #ifdef CONFIG_COMPAT
1997 static int proc_ioctl_compat(struct usb_dev_state *ps, compat_uptr_t arg)
1998 {
1999         struct usbdevfs_ioctl32 __user *uioc;
2000         struct usbdevfs_ioctl ctrl;
2001         u32 udata;
2002
2003         uioc = compat_ptr((long)arg);
2004         if (!access_ok(VERIFY_READ, uioc, sizeof(*uioc)) ||
2005             __get_user(ctrl.ifno, &uioc->ifno) ||
2006             __get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
2007             __get_user(udata, &uioc->data))
2008                 return -EFAULT;
2009         ctrl.data = compat_ptr(udata);
2010
2011         return proc_ioctl(ps, &ctrl);
2012 }
2013 #endif
2014
2015 static int proc_claim_port(struct usb_dev_state *ps, void __user *arg)
2016 {
2017         unsigned portnum;
2018         int rc;
2019
2020         if (get_user(portnum, (unsigned __user *) arg))
2021                 return -EFAULT;
2022         rc = usb_hub_claim_port(ps->dev, portnum, ps);
2023         if (rc == 0)
2024                 snoop(&ps->dev->dev, "port %d claimed by process %d: %s\n",
2025                         portnum, task_pid_nr(current), current->comm);
2026         return rc;
2027 }
2028
2029 static int proc_release_port(struct usb_dev_state *ps, void __user *arg)
2030 {
2031         unsigned portnum;
2032
2033         if (get_user(portnum, (unsigned __user *) arg))
2034                 return -EFAULT;
2035         return usb_hub_release_port(ps->dev, portnum, ps);
2036 }
2037
2038 static int proc_get_capabilities(struct usb_dev_state *ps, void __user *arg)
2039 {
2040         __u32 caps;
2041
2042         caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM |
2043                         USBDEVFS_CAP_REAP_AFTER_DISCONNECT;
2044         if (!ps->dev->bus->no_stop_on_short)
2045                 caps |= USBDEVFS_CAP_BULK_CONTINUATION;
2046         if (ps->dev->bus->sg_tablesize)
2047                 caps |= USBDEVFS_CAP_BULK_SCATTER_GATHER;
2048
2049         if (put_user(caps, (__u32 __user *)arg))
2050                 return -EFAULT;
2051
2052         return 0;
2053 }
2054
2055 static int proc_disconnect_claim(struct usb_dev_state *ps, void __user *arg)
2056 {
2057         struct usbdevfs_disconnect_claim dc;
2058         struct usb_interface *intf;
2059
2060         if (copy_from_user(&dc, arg, sizeof(dc)))
2061                 return -EFAULT;
2062
2063         intf = usb_ifnum_to_if(ps->dev, dc.interface);
2064         if (!intf)
2065                 return -EINVAL;
2066
2067         if (intf->dev.driver) {
2068                 struct usb_driver *driver = to_usb_driver(intf->dev.driver);
2069
2070                 if ((dc.flags & USBDEVFS_DISCONNECT_CLAIM_IF_DRIVER) &&
2071                                 strncmp(dc.driver, intf->dev.driver->name,
2072                                         sizeof(dc.driver)) != 0)
2073                         return -EBUSY;
2074
2075                 if ((dc.flags & USBDEVFS_DISCONNECT_CLAIM_EXCEPT_DRIVER) &&
2076                                 strncmp(dc.driver, intf->dev.driver->name,
2077                                         sizeof(dc.driver)) == 0)
2078                         return -EBUSY;
2079
2080                 dev_dbg(&intf->dev, "disconnect by usbfs\n");
2081                 usb_driver_release_interface(driver, intf);
2082         }
2083
2084         return claimintf(ps, dc.interface);
2085 }
2086
2087 static int proc_alloc_streams(struct usb_dev_state *ps, void __user *arg)
2088 {
2089         unsigned num_streams, num_eps;
2090         struct usb_host_endpoint **eps;
2091         struct usb_interface *intf;
2092         int r;
2093
2094         r = parse_usbdevfs_streams(ps, arg, &num_streams, &num_eps,
2095                                    &eps, &intf);
2096         if (r)
2097                 return r;
2098
2099         destroy_async_on_interface(ps,
2100                                    intf->altsetting[0].desc.bInterfaceNumber);
2101
2102         r = usb_alloc_streams(intf, eps, num_eps, num_streams, GFP_KERNEL);
2103         kfree(eps);
2104         return r;
2105 }
2106
2107 static int proc_free_streams(struct usb_dev_state *ps, void __user *arg)
2108 {
2109         unsigned num_eps;
2110         struct usb_host_endpoint **eps;
2111         struct usb_interface *intf;
2112         int r;
2113
2114         r = parse_usbdevfs_streams(ps, arg, NULL, &num_eps, &eps, &intf);
2115         if (r)
2116                 return r;
2117
2118         destroy_async_on_interface(ps,
2119                                    intf->altsetting[0].desc.bInterfaceNumber);
2120
2121         r = usb_free_streams(intf, eps, num_eps, GFP_KERNEL);
2122         kfree(eps);
2123         return r;
2124 }
2125
2126 /*
2127  * NOTE:  All requests here that have interface numbers as parameters
2128  * are assuming that somehow the configuration has been prevented from
2129  * changing.  But there's no mechanism to ensure that...
2130  */
2131 static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
2132                                 void __user *p)
2133 {
2134         struct usb_dev_state *ps = file->private_data;
2135         struct inode *inode = file_inode(file);
2136         struct usb_device *dev = ps->dev;
2137         int ret = -ENOTTY;
2138
2139         if (!(file->f_mode & FMODE_WRITE))
2140                 return -EPERM;
2141
2142         usb_lock_device(dev);
2143
2144         /* Reap operations are allowed even after disconnection */
2145         switch (cmd) {
2146         case USBDEVFS_REAPURB:
2147                 snoop(&dev->dev, "%s: REAPURB\n", __func__);
2148                 ret = proc_reapurb(ps, p);
2149                 goto done;
2150
2151         case USBDEVFS_REAPURBNDELAY:
2152                 snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
2153                 ret = proc_reapurbnonblock(ps, p);
2154                 goto done;
2155
2156 #ifdef CONFIG_COMPAT
2157         case USBDEVFS_REAPURB32:
2158                 snoop(&dev->dev, "%s: REAPURB32\n", __func__);
2159                 ret = proc_reapurb_compat(ps, p);
2160                 goto done;
2161
2162         case USBDEVFS_REAPURBNDELAY32:
2163                 snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
2164                 ret = proc_reapurbnonblock_compat(ps, p);
2165                 goto done;
2166 #endif
2167         }
2168
2169         if (!connected(ps)) {
2170                 usb_unlock_device(dev);
2171                 return -ENODEV;
2172         }
2173
2174         switch (cmd) {
2175         case USBDEVFS_CONTROL:
2176                 snoop(&dev->dev, "%s: CONTROL\n", __func__);
2177                 ret = proc_control(ps, p);
2178                 if (ret >= 0)
2179                         inode->i_mtime = CURRENT_TIME;
2180                 break;
2181
2182         case USBDEVFS_BULK:
2183                 snoop(&dev->dev, "%s: BULK\n", __func__);
2184                 ret = proc_bulk(ps, p);
2185                 if (ret >= 0)
2186                         inode->i_mtime = CURRENT_TIME;
2187                 break;
2188
2189         case USBDEVFS_RESETEP:
2190                 snoop(&dev->dev, "%s: RESETEP\n", __func__);
2191                 ret = proc_resetep(ps, p);
2192                 if (ret >= 0)
2193                         inode->i_mtime = CURRENT_TIME;
2194                 break;
2195
2196         case USBDEVFS_RESET:
2197                 snoop(&dev->dev, "%s: RESET\n", __func__);
2198                 ret = proc_resetdevice(ps);
2199                 break;
2200
2201         case USBDEVFS_CLEAR_HALT:
2202                 snoop(&dev->dev, "%s: CLEAR_HALT\n", __func__);
2203                 ret = proc_clearhalt(ps, p);
2204                 if (ret >= 0)
2205                         inode->i_mtime = CURRENT_TIME;
2206                 break;
2207
2208         case USBDEVFS_GETDRIVER:
2209                 snoop(&dev->dev, "%s: GETDRIVER\n", __func__);
2210                 ret = proc_getdriver(ps, p);
2211                 break;
2212
2213         case USBDEVFS_CONNECTINFO:
2214                 snoop(&dev->dev, "%s: CONNECTINFO\n", __func__);
2215                 ret = proc_connectinfo(ps, p);
2216                 break;
2217
2218         case USBDEVFS_SETINTERFACE:
2219                 snoop(&dev->dev, "%s: SETINTERFACE\n", __func__);
2220                 ret = proc_setintf(ps, p);
2221                 break;
2222
2223         case USBDEVFS_SETCONFIGURATION:
2224                 snoop(&dev->dev, "%s: SETCONFIGURATION\n", __func__);
2225                 ret = proc_setconfig(ps, p);
2226                 break;
2227
2228         case USBDEVFS_SUBMITURB:
2229                 snoop(&dev->dev, "%s: SUBMITURB\n", __func__);
2230                 ret = proc_submiturb(ps, p);
2231                 if (ret >= 0)
2232                         inode->i_mtime = CURRENT_TIME;
2233                 break;
2234
2235 #ifdef CONFIG_COMPAT
2236         case USBDEVFS_CONTROL32:
2237                 snoop(&dev->dev, "%s: CONTROL32\n", __func__);
2238                 ret = proc_control_compat(ps, p);
2239                 if (ret >= 0)
2240                         inode->i_mtime = CURRENT_TIME;
2241                 break;
2242
2243         case USBDEVFS_BULK32:
2244                 snoop(&dev->dev, "%s: BULK32\n", __func__);
2245                 ret = proc_bulk_compat(ps, p);
2246                 if (ret >= 0)
2247                         inode->i_mtime = CURRENT_TIME;
2248                 break;
2249
2250         case USBDEVFS_DISCSIGNAL32:
2251                 snoop(&dev->dev, "%s: DISCSIGNAL32\n", __func__);
2252                 ret = proc_disconnectsignal_compat(ps, p);
2253                 break;
2254
2255         case USBDEVFS_SUBMITURB32:
2256                 snoop(&dev->dev, "%s: SUBMITURB32\n", __func__);
2257                 ret = proc_submiturb_compat(ps, p);
2258                 if (ret >= 0)
2259                         inode->i_mtime = CURRENT_TIME;
2260                 break;
2261
2262         case USBDEVFS_IOCTL32:
2263                 snoop(&dev->dev, "%s: IOCTL32\n", __func__);
2264                 ret = proc_ioctl_compat(ps, ptr_to_compat(p));
2265                 break;
2266 #endif
2267
2268         case USBDEVFS_DISCARDURB:
2269                 snoop(&dev->dev, "%s: DISCARDURB %p\n", __func__, p);
2270                 ret = proc_unlinkurb(ps, p);
2271                 break;
2272
2273         case USBDEVFS_DISCSIGNAL:
2274                 snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
2275                 ret = proc_disconnectsignal(ps, p);
2276                 break;
2277
2278         case USBDEVFS_CLAIMINTERFACE:
2279                 snoop(&dev->dev, "%s: CLAIMINTERFACE\n", __func__);
2280                 ret = proc_claiminterface(ps, p);
2281                 break;
2282
2283         case USBDEVFS_RELEASEINTERFACE:
2284                 snoop(&dev->dev, "%s: RELEASEINTERFACE\n", __func__);
2285                 ret = proc_releaseinterface(ps, p);
2286                 break;
2287
2288         case USBDEVFS_IOCTL:
2289                 snoop(&dev->dev, "%s: IOCTL\n", __func__);
2290                 ret = proc_ioctl_default(ps, p);
2291                 break;
2292
2293         case USBDEVFS_CLAIM_PORT:
2294                 snoop(&dev->dev, "%s: CLAIM_PORT\n", __func__);
2295                 ret = proc_claim_port(ps, p);
2296                 break;
2297
2298         case USBDEVFS_RELEASE_PORT:
2299                 snoop(&dev->dev, "%s: RELEASE_PORT\n", __func__);
2300                 ret = proc_release_port(ps, p);
2301                 break;
2302         case USBDEVFS_GET_CAPABILITIES:
2303                 ret = proc_get_capabilities(ps, p);
2304                 break;
2305         case USBDEVFS_DISCONNECT_CLAIM:
2306                 ret = proc_disconnect_claim(ps, p);
2307                 break;
2308         case USBDEVFS_ALLOC_STREAMS:
2309                 ret = proc_alloc_streams(ps, p);
2310                 break;
2311         case USBDEVFS_FREE_STREAMS:
2312                 ret = proc_free_streams(ps, p);
2313                 break;
2314         }
2315
2316  done:
2317         usb_unlock_device(dev);
2318         if (ret >= 0)
2319                 inode->i_atime = CURRENT_TIME;
2320         return ret;
2321 }
2322
2323 static long usbdev_ioctl(struct file *file, unsigned int cmd,
2324                         unsigned long arg)
2325 {
2326         int ret;
2327
2328         ret = usbdev_do_ioctl(file, cmd, (void __user *)arg);
2329
2330         return ret;
2331 }
2332
2333 #ifdef CONFIG_COMPAT
2334 static long usbdev_compat_ioctl(struct file *file, unsigned int cmd,
2335                         unsigned long arg)
2336 {
2337         int ret;
2338
2339         ret = usbdev_do_ioctl(file, cmd, compat_ptr(arg));
2340
2341         return ret;
2342 }
2343 #endif
2344
2345 /* No kernel lock - fine */
2346 static unsigned int usbdev_poll(struct file *file,
2347                                 struct poll_table_struct *wait)
2348 {
2349         struct usb_dev_state *ps = file->private_data;
2350         unsigned int mask = 0;
2351
2352         poll_wait(file, &ps->wait, wait);
2353         if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
2354                 mask |= POLLOUT | POLLWRNORM;
2355         if (!connected(ps))
2356                 mask |= POLLERR | POLLHUP;
2357         return mask;
2358 }
2359
2360 const struct file_operations usbdev_file_operations = {
2361         .owner =          THIS_MODULE,
2362         .llseek =         no_seek_end_llseek,
2363         .read =           usbdev_read,
2364         .poll =           usbdev_poll,
2365         .unlocked_ioctl = usbdev_ioctl,
2366 #ifdef CONFIG_COMPAT
2367         .compat_ioctl =   usbdev_compat_ioctl,
2368 #endif
2369         .open =           usbdev_open,
2370         .release =        usbdev_release,
2371 };
2372
2373 static void usbdev_remove(struct usb_device *udev)
2374 {
2375         struct usb_dev_state *ps;
2376         struct siginfo sinfo;
2377
2378         while (!list_empty(&udev->filelist)) {
2379                 ps = list_entry(udev->filelist.next, struct usb_dev_state, list);
2380                 destroy_all_async(ps);
2381                 wake_up_all(&ps->wait);
2382                 list_del_init(&ps->list);
2383                 if (ps->discsignr) {
2384                         memset(&sinfo, 0, sizeof(sinfo));
2385                         sinfo.si_signo = ps->discsignr;
2386                         sinfo.si_errno = EPIPE;
2387                         sinfo.si_code = SI_ASYNCIO;
2388                         sinfo.si_addr = ps->disccontext;
2389                         kill_pid_info_as_cred(ps->discsignr, &sinfo,
2390                                         ps->disc_pid, ps->cred, ps->secid);
2391                 }
2392         }
2393 }
2394
2395 static int usbdev_notify(struct notifier_block *self,
2396                                unsigned long action, void *dev)
2397 {
2398         switch (action) {
2399         case USB_DEVICE_ADD:
2400                 break;
2401         case USB_DEVICE_REMOVE:
2402                 usbdev_remove(dev);
2403                 break;
2404         }
2405         return NOTIFY_OK;
2406 }
2407
2408 static struct notifier_block usbdev_nb = {
2409         .notifier_call =        usbdev_notify,
2410 };
2411
2412 static struct cdev usb_device_cdev;
2413
2414 int __init usb_devio_init(void)
2415 {
2416         int retval;
2417
2418         retval = register_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX,
2419                                         "usb_device");
2420         if (retval) {
2421                 printk(KERN_ERR "Unable to register minors for usb_device\n");
2422                 goto out;
2423         }
2424         cdev_init(&usb_device_cdev, &usbdev_file_operations);
2425         retval = cdev_add(&usb_device_cdev, USB_DEVICE_DEV, USB_DEVICE_MAX);
2426         if (retval) {
2427                 printk(KERN_ERR "Unable to get usb_device major %d\n",
2428                        USB_DEVICE_MAJOR);
2429                 goto error_cdev;
2430         }
2431         usb_register_notify(&usbdev_nb);
2432 out:
2433         return retval;
2434
2435 error_cdev:
2436         unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
2437         goto out;
2438 }
2439
2440 void usb_devio_cleanup(void)
2441 {
2442         usb_unregister_notify(&usbdev_nb);
2443         cdev_del(&usb_device_cdev);
2444         unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
2445 }