USB: make the "usbfs_snoop" log more pertinent
[linux-2.6.git] / drivers / usb / core / devio.c
1 /*****************************************************************************/
2
3 /*
4  *      devio.c  --  User space communication with USB devices.
5  *
6  *      Copyright (C) 1999-2000  Thomas Sailer (sailer@ife.ee.ethz.ch)
7  *
8  *      This program is free software; you can redistribute it and/or modify
9  *      it under the terms of the GNU General Public License as published by
10  *      the Free Software Foundation; either version 2 of the License, or
11  *      (at your option) any later version.
12  *
13  *      This program is distributed in the hope that it will be useful,
14  *      but WITHOUT ANY WARRANTY; without even the implied warranty of
15  *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  *      GNU General Public License for more details.
17  *
18  *      You should have received a copy of the GNU General Public License
19  *      along with this program; if not, write to the Free Software
20  *      Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
21  *
22  *  This file implements the usbfs/x/y files, where
23  *  x is the bus number and y the device number.
24  *
25  *  It allows user space programs/"drivers" to communicate directly
26  *  with USB devices without intervening kernel driver.
27  *
28  *  Revision history
29  *    22.12.1999   0.1   Initial release (split from proc_usb.c)
30  *    04.01.2000   0.2   Turned into its own filesystem
31  *    30.09.2005   0.3   Fix user-triggerable oops in async URB delivery
32  *                       (CAN-2005-3055)
33  */
34
35 /*****************************************************************************/
36
37 #include <linux/fs.h>
38 #include <linux/mm.h>
39 #include <linux/slab.h>
40 #include <linux/smp_lock.h>
41 #include <linux/signal.h>
42 #include <linux/poll.h>
43 #include <linux/module.h>
44 #include <linux/usb.h>
45 #include <linux/usbdevice_fs.h>
46 #include <linux/cdev.h>
47 #include <linux/notifier.h>
48 #include <linux/security.h>
49 #include <asm/uaccess.h>
50 #include <asm/byteorder.h>
51 #include <linux/moduleparam.h>
52
53 #include "hcd.h"        /* for usbcore internals */
54 #include "usb.h"
55 #include "hub.h"
56
57 #define USB_MAXBUS                      64
58 #define USB_DEVICE_MAX                  USB_MAXBUS * 128
59
60 /* Mutual exclusion for removal, open, and release */
61 DEFINE_MUTEX(usbfs_mutex);
62
63 struct dev_state {
64         struct list_head list;      /* state list */
65         struct usb_device *dev;
66         struct file *file;
67         spinlock_t lock;            /* protects the async urb lists */
68         struct list_head async_pending;
69         struct list_head async_completed;
70         wait_queue_head_t wait;     /* wake up if a request completed */
71         unsigned int discsignr;
72         struct pid *disc_pid;
73         uid_t disc_uid, disc_euid;
74         void __user *disccontext;
75         unsigned long ifclaimed;
76         u32 secid;
77 };
78
79 struct async {
80         struct list_head asynclist;
81         struct dev_state *ps;
82         struct pid *pid;
83         uid_t uid, euid;
84         unsigned int signr;
85         unsigned int ifnum;
86         void __user *userbuffer;
87         void __user *userurb;
88         struct urb *urb;
89         int status;
90         u32 secid;
91 };
92
93 static int usbfs_snoop;
94 module_param(usbfs_snoop, bool, S_IRUGO | S_IWUSR);
95 MODULE_PARM_DESC(usbfs_snoop, "true to log all usbfs traffic");
96
97 #define snoop(dev, format, arg...)                              \
98         do {                                                    \
99                 if (usbfs_snoop)                                \
100                         dev_info(dev , format , ## arg);        \
101         } while (0)
102
103 enum snoop_when {
104         SUBMIT, COMPLETE
105 };
106
107 #define USB_DEVICE_DEV          MKDEV(USB_DEVICE_MAJOR, 0)
108
109 #define MAX_USBFS_BUFFER_SIZE   16384
110
111
112 static int connected(struct dev_state *ps)
113 {
114         return (!list_empty(&ps->list) &&
115                         ps->dev->state != USB_STATE_NOTATTACHED);
116 }
117
118 static loff_t usbdev_lseek(struct file *file, loff_t offset, int orig)
119 {
120         loff_t ret;
121
122         lock_kernel();
123
124         switch (orig) {
125         case 0:
126                 file->f_pos = offset;
127                 ret = file->f_pos;
128                 break;
129         case 1:
130                 file->f_pos += offset;
131                 ret = file->f_pos;
132                 break;
133         case 2:
134         default:
135                 ret = -EINVAL;
136         }
137
138         unlock_kernel();
139         return ret;
140 }
141
142 static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
143                            loff_t *ppos)
144 {
145         struct dev_state *ps = file->private_data;
146         struct usb_device *dev = ps->dev;
147         ssize_t ret = 0;
148         unsigned len;
149         loff_t pos;
150         int i;
151
152         pos = *ppos;
153         usb_lock_device(dev);
154         if (!connected(ps)) {
155                 ret = -ENODEV;
156                 goto err;
157         } else if (pos < 0) {
158                 ret = -EINVAL;
159                 goto err;
160         }
161
162         if (pos < sizeof(struct usb_device_descriptor)) {
163                 /* 18 bytes - fits on the stack */
164                 struct usb_device_descriptor temp_desc;
165
166                 memcpy(&temp_desc, &dev->descriptor, sizeof(dev->descriptor));
167                 le16_to_cpus(&temp_desc.bcdUSB);
168                 le16_to_cpus(&temp_desc.idVendor);
169                 le16_to_cpus(&temp_desc.idProduct);
170                 le16_to_cpus(&temp_desc.bcdDevice);
171
172                 len = sizeof(struct usb_device_descriptor) - pos;
173                 if (len > nbytes)
174                         len = nbytes;
175                 if (copy_to_user(buf, ((char *)&temp_desc) + pos, len)) {
176                         ret = -EFAULT;
177                         goto err;
178                 }
179
180                 *ppos += len;
181                 buf += len;
182                 nbytes -= len;
183                 ret += len;
184         }
185
186         pos = sizeof(struct usb_device_descriptor);
187         for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {
188                 struct usb_config_descriptor *config =
189                         (struct usb_config_descriptor *)dev->rawdescriptors[i];
190                 unsigned int length = le16_to_cpu(config->wTotalLength);
191
192                 if (*ppos < pos + length) {
193
194                         /* The descriptor may claim to be longer than it
195                          * really is.  Here is the actual allocated length. */
196                         unsigned alloclen =
197                                 le16_to_cpu(dev->config[i].desc.wTotalLength);
198
199                         len = length - (*ppos - pos);
200                         if (len > nbytes)
201                                 len = nbytes;
202
203                         /* Simply don't write (skip over) unallocated parts */
204                         if (alloclen > (*ppos - pos)) {
205                                 alloclen -= (*ppos - pos);
206                                 if (copy_to_user(buf,
207                                     dev->rawdescriptors[i] + (*ppos - pos),
208                                     min(len, alloclen))) {
209                                         ret = -EFAULT;
210                                         goto err;
211                                 }
212                         }
213
214                         *ppos += len;
215                         buf += len;
216                         nbytes -= len;
217                         ret += len;
218                 }
219
220                 pos += length;
221         }
222
223 err:
224         usb_unlock_device(dev);
225         return ret;
226 }
227
228 /*
229  * async list handling
230  */
231
232 static struct async *alloc_async(unsigned int numisoframes)
233 {
234         struct async *as;
235
236         as = kzalloc(sizeof(struct async), GFP_KERNEL);
237         if (!as)
238                 return NULL;
239         as->urb = usb_alloc_urb(numisoframes, GFP_KERNEL);
240         if (!as->urb) {
241                 kfree(as);
242                 return NULL;
243         }
244         return as;
245 }
246
247 static void free_async(struct async *as)
248 {
249         put_pid(as->pid);
250         kfree(as->urb->transfer_buffer);
251         kfree(as->urb->setup_packet);
252         usb_free_urb(as->urb);
253         kfree(as);
254 }
255
256 static void async_newpending(struct async *as)
257 {
258         struct dev_state *ps = as->ps;
259         unsigned long flags;
260
261         spin_lock_irqsave(&ps->lock, flags);
262         list_add_tail(&as->asynclist, &ps->async_pending);
263         spin_unlock_irqrestore(&ps->lock, flags);
264 }
265
266 static void async_removepending(struct async *as)
267 {
268         struct dev_state *ps = as->ps;
269         unsigned long flags;
270
271         spin_lock_irqsave(&ps->lock, flags);
272         list_del_init(&as->asynclist);
273         spin_unlock_irqrestore(&ps->lock, flags);
274 }
275
276 static struct async *async_getcompleted(struct dev_state *ps)
277 {
278         unsigned long flags;
279         struct async *as = NULL;
280
281         spin_lock_irqsave(&ps->lock, flags);
282         if (!list_empty(&ps->async_completed)) {
283                 as = list_entry(ps->async_completed.next, struct async,
284                                 asynclist);
285                 list_del_init(&as->asynclist);
286         }
287         spin_unlock_irqrestore(&ps->lock, flags);
288         return as;
289 }
290
291 static struct async *async_getpending(struct dev_state *ps,
292                                              void __user *userurb)
293 {
294         unsigned long flags;
295         struct async *as;
296
297         spin_lock_irqsave(&ps->lock, flags);
298         list_for_each_entry(as, &ps->async_pending, asynclist)
299                 if (as->userurb == userurb) {
300                         list_del_init(&as->asynclist);
301                         spin_unlock_irqrestore(&ps->lock, flags);
302                         return as;
303                 }
304         spin_unlock_irqrestore(&ps->lock, flags);
305         return NULL;
306 }
307
308 static void snoop_urb(struct usb_device *udev,
309                 void __user *userurb, int pipe, unsigned length,
310                 int timeout_or_status, enum snoop_when when)
311 {
312         static const char *types[] = {"isoc", "int", "ctrl", "bulk"};
313         static const char *dirs[] = {"out", "in"};
314         int ep;
315         const char *t, *d;
316
317         if (!usbfs_snoop)
318                 return;
319
320         ep = usb_pipeendpoint(pipe);
321         t = types[usb_pipetype(pipe)];
322         d = dirs[!!usb_pipein(pipe)];
323
324         if (userurb) {          /* Async */
325                 if (when == SUBMIT)
326                         dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
327                                         "length %u\n",
328                                         userurb, ep, t, d, length);
329                 else
330                         dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
331                                         "actual_length %u status %d\n",
332                                         userurb, ep, t, d, length,
333                                         timeout_or_status);
334         } else {
335                 if (when == SUBMIT)
336                         dev_info(&udev->dev, "ep%d %s-%s, length %u, "
337                                         "timeout %d\n",
338                                         ep, t, d, length, timeout_or_status);
339                 else
340                         dev_info(&udev->dev, "ep%d %s-%s, actual_length %u, "
341                                         "status %d\n",
342                                         ep, t, d, length, timeout_or_status);
343         }
344 }
345
346 static void async_completed(struct urb *urb)
347 {
348         struct async *as = urb->context;
349         struct dev_state *ps = as->ps;
350         struct siginfo sinfo;
351         struct pid *pid = NULL;
352         uid_t uid = 0;
353         uid_t euid = 0;
354         u32 secid = 0;
355         int signr;
356
357         spin_lock(&ps->lock);
358         list_move_tail(&as->asynclist, &ps->async_completed);
359         as->status = urb->status;
360         signr = as->signr;
361         if (signr) {
362                 sinfo.si_signo = as->signr;
363                 sinfo.si_errno = as->status;
364                 sinfo.si_code = SI_ASYNCIO;
365                 sinfo.si_addr = as->userurb;
366                 pid = as->pid;
367                 uid = as->uid;
368                 euid = as->euid;
369                 secid = as->secid;
370         }
371         snoop(&urb->dev->dev, "urb complete\n");
372         snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
373                         as->status, COMPLETE);
374         spin_unlock(&ps->lock);
375
376         if (signr)
377                 kill_pid_info_as_uid(sinfo.si_signo, &sinfo, pid, uid,
378                                       euid, secid);
379
380         wake_up(&ps->wait);
381 }
382
383 static void destroy_async(struct dev_state *ps, struct list_head *list)
384 {
385         struct async *as;
386         unsigned long flags;
387
388         spin_lock_irqsave(&ps->lock, flags);
389         while (!list_empty(list)) {
390                 as = list_entry(list->next, struct async, asynclist);
391                 list_del_init(&as->asynclist);
392
393                 /* drop the spinlock so the completion handler can run */
394                 spin_unlock_irqrestore(&ps->lock, flags);
395                 usb_kill_urb(as->urb);
396                 spin_lock_irqsave(&ps->lock, flags);
397         }
398         spin_unlock_irqrestore(&ps->lock, flags);
399 }
400
401 static void destroy_async_on_interface(struct dev_state *ps,
402                                        unsigned int ifnum)
403 {
404         struct list_head *p, *q, hitlist;
405         unsigned long flags;
406
407         INIT_LIST_HEAD(&hitlist);
408         spin_lock_irqsave(&ps->lock, flags);
409         list_for_each_safe(p, q, &ps->async_pending)
410                 if (ifnum == list_entry(p, struct async, asynclist)->ifnum)
411                         list_move_tail(p, &hitlist);
412         spin_unlock_irqrestore(&ps->lock, flags);
413         destroy_async(ps, &hitlist);
414 }
415
416 static void destroy_all_async(struct dev_state *ps)
417 {
418         destroy_async(ps, &ps->async_pending);
419 }
420
421 /*
422  * interface claims are made only at the request of user level code,
423  * which can also release them (explicitly or by closing files).
424  * they're also undone when devices disconnect.
425  */
426
427 static int driver_probe(struct usb_interface *intf,
428                         const struct usb_device_id *id)
429 {
430         return -ENODEV;
431 }
432
433 static void driver_disconnect(struct usb_interface *intf)
434 {
435         struct dev_state *ps = usb_get_intfdata(intf);
436         unsigned int ifnum = intf->altsetting->desc.bInterfaceNumber;
437
438         if (!ps)
439                 return;
440
441         /* NOTE:  this relies on usbcore having canceled and completed
442          * all pending I/O requests; 2.6 does that.
443          */
444
445         if (likely(ifnum < 8*sizeof(ps->ifclaimed)))
446                 clear_bit(ifnum, &ps->ifclaimed);
447         else
448                 dev_warn(&intf->dev, "interface number %u out of range\n",
449                          ifnum);
450
451         usb_set_intfdata(intf, NULL);
452
453         /* force async requests to complete */
454         destroy_async_on_interface(ps, ifnum);
455 }
456
457 /* The following routines are merely placeholders.  There is no way
458  * to inform a user task about suspend or resumes.
459  */
460 static int driver_suspend(struct usb_interface *intf, pm_message_t msg)
461 {
462         return 0;
463 }
464
465 static int driver_resume(struct usb_interface *intf)
466 {
467         return 0;
468 }
469
470 struct usb_driver usbfs_driver = {
471         .name =         "usbfs",
472         .probe =        driver_probe,
473         .disconnect =   driver_disconnect,
474         .suspend =      driver_suspend,
475         .resume =       driver_resume,
476 };
477
478 static int claimintf(struct dev_state *ps, unsigned int ifnum)
479 {
480         struct usb_device *dev = ps->dev;
481         struct usb_interface *intf;
482         int err;
483
484         if (ifnum >= 8*sizeof(ps->ifclaimed))
485                 return -EINVAL;
486         /* already claimed */
487         if (test_bit(ifnum, &ps->ifclaimed))
488                 return 0;
489
490         intf = usb_ifnum_to_if(dev, ifnum);
491         if (!intf)
492                 err = -ENOENT;
493         else
494                 err = usb_driver_claim_interface(&usbfs_driver, intf, ps);
495         if (err == 0)
496                 set_bit(ifnum, &ps->ifclaimed);
497         return err;
498 }
499
500 static int releaseintf(struct dev_state *ps, unsigned int ifnum)
501 {
502         struct usb_device *dev;
503         struct usb_interface *intf;
504         int err;
505
506         err = -EINVAL;
507         if (ifnum >= 8*sizeof(ps->ifclaimed))
508                 return err;
509         dev = ps->dev;
510         intf = usb_ifnum_to_if(dev, ifnum);
511         if (!intf)
512                 err = -ENOENT;
513         else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) {
514                 usb_driver_release_interface(&usbfs_driver, intf);
515                 err = 0;
516         }
517         return err;
518 }
519
520 static int checkintf(struct dev_state *ps, unsigned int ifnum)
521 {
522         if (ps->dev->state != USB_STATE_CONFIGURED)
523                 return -EHOSTUNREACH;
524         if (ifnum >= 8*sizeof(ps->ifclaimed))
525                 return -EINVAL;
526         if (test_bit(ifnum, &ps->ifclaimed))
527                 return 0;
528         /* if not yet claimed, claim it for the driver */
529         dev_warn(&ps->dev->dev, "usbfs: process %d (%s) did not claim "
530                  "interface %u before use\n", task_pid_nr(current),
531                  current->comm, ifnum);
532         return claimintf(ps, ifnum);
533 }
534
535 static int findintfep(struct usb_device *dev, unsigned int ep)
536 {
537         unsigned int i, j, e;
538         struct usb_interface *intf;
539         struct usb_host_interface *alts;
540         struct usb_endpoint_descriptor *endpt;
541
542         if (ep & ~(USB_DIR_IN|0xf))
543                 return -EINVAL;
544         if (!dev->actconfig)
545                 return -ESRCH;
546         for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
547                 intf = dev->actconfig->interface[i];
548                 for (j = 0; j < intf->num_altsetting; j++) {
549                         alts = &intf->altsetting[j];
550                         for (e = 0; e < alts->desc.bNumEndpoints; e++) {
551                                 endpt = &alts->endpoint[e].desc;
552                                 if (endpt->bEndpointAddress == ep)
553                                         return alts->desc.bInterfaceNumber;
554                         }
555                 }
556         }
557         return -ENOENT;
558 }
559
560 static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype,
561                            unsigned int index)
562 {
563         int ret = 0;
564
565         if (ps->dev->state != USB_STATE_UNAUTHENTICATED
566          && ps->dev->state != USB_STATE_ADDRESS
567          && ps->dev->state != USB_STATE_CONFIGURED)
568                 return -EHOSTUNREACH;
569         if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
570                 return 0;
571
572         index &= 0xff;
573         switch (requesttype & USB_RECIP_MASK) {
574         case USB_RECIP_ENDPOINT:
575                 ret = findintfep(ps->dev, index);
576                 if (ret >= 0)
577                         ret = checkintf(ps, ret);
578                 break;
579
580         case USB_RECIP_INTERFACE:
581                 ret = checkintf(ps, index);
582                 break;
583         }
584         return ret;
585 }
586
587 static int match_devt(struct device *dev, void *data)
588 {
589         return dev->devt == (dev_t) (unsigned long) data;
590 }
591
592 static struct usb_device *usbdev_lookup_by_devt(dev_t devt)
593 {
594         struct device *dev;
595
596         dev = bus_find_device(&usb_bus_type, NULL,
597                               (void *) (unsigned long) devt, match_devt);
598         if (!dev)
599                 return NULL;
600         return container_of(dev, struct usb_device, dev);
601 }
602
603 /*
604  * file operations
605  */
606 static int usbdev_open(struct inode *inode, struct file *file)
607 {
608         struct usb_device *dev = NULL;
609         struct dev_state *ps;
610         const struct cred *cred = current_cred();
611         int ret;
612
613         lock_kernel();
614         /* Protect against simultaneous removal or release */
615         mutex_lock(&usbfs_mutex);
616
617         ret = -ENOMEM;
618         ps = kmalloc(sizeof(struct dev_state), GFP_KERNEL);
619         if (!ps)
620                 goto out;
621
622         ret = -ENODEV;
623
624         /* usbdev device-node */
625         if (imajor(inode) == USB_DEVICE_MAJOR)
626                 dev = usbdev_lookup_by_devt(inode->i_rdev);
627 #ifdef CONFIG_USB_DEVICEFS
628         /* procfs file */
629         if (!dev) {
630                 dev = inode->i_private;
631                 if (dev && dev->usbfs_dentry &&
632                                         dev->usbfs_dentry->d_inode == inode)
633                         usb_get_dev(dev);
634                 else
635                         dev = NULL;
636         }
637 #endif
638         if (!dev || dev->state == USB_STATE_NOTATTACHED)
639                 goto out;
640         ret = usb_autoresume_device(dev);
641         if (ret)
642                 goto out;
643
644         ret = 0;
645         ps->dev = dev;
646         ps->file = file;
647         spin_lock_init(&ps->lock);
648         INIT_LIST_HEAD(&ps->list);
649         INIT_LIST_HEAD(&ps->async_pending);
650         INIT_LIST_HEAD(&ps->async_completed);
651         init_waitqueue_head(&ps->wait);
652         ps->discsignr = 0;
653         ps->disc_pid = get_pid(task_pid(current));
654         ps->disc_uid = cred->uid;
655         ps->disc_euid = cred->euid;
656         ps->disccontext = NULL;
657         ps->ifclaimed = 0;
658         security_task_getsecid(current, &ps->secid);
659         smp_wmb();
660         list_add_tail(&ps->list, &dev->filelist);
661         file->private_data = ps;
662         snoop(&dev->dev, "opened by process %d: %s\n", task_pid_nr(current),
663                         current->comm);
664  out:
665         if (ret) {
666                 kfree(ps);
667                 usb_put_dev(dev);
668         }
669         mutex_unlock(&usbfs_mutex);
670         unlock_kernel();
671         return ret;
672 }
673
674 static int usbdev_release(struct inode *inode, struct file *file)
675 {
676         struct dev_state *ps = file->private_data;
677         struct usb_device *dev = ps->dev;
678         unsigned int ifnum;
679         struct async *as;
680
681         usb_lock_device(dev);
682         usb_hub_release_all_ports(dev, ps);
683
684         /* Protect against simultaneous open */
685         mutex_lock(&usbfs_mutex);
686         list_del_init(&ps->list);
687         mutex_unlock(&usbfs_mutex);
688
689         for (ifnum = 0; ps->ifclaimed && ifnum < 8*sizeof(ps->ifclaimed);
690                         ifnum++) {
691                 if (test_bit(ifnum, &ps->ifclaimed))
692                         releaseintf(ps, ifnum);
693         }
694         destroy_all_async(ps);
695         usb_autosuspend_device(dev);
696         usb_unlock_device(dev);
697         usb_put_dev(dev);
698         put_pid(ps->disc_pid);
699
700         as = async_getcompleted(ps);
701         while (as) {
702                 free_async(as);
703                 as = async_getcompleted(ps);
704         }
705         kfree(ps);
706         return 0;
707 }
708
709 static int proc_control(struct dev_state *ps, void __user *arg)
710 {
711         struct usb_device *dev = ps->dev;
712         struct usbdevfs_ctrltransfer ctrl;
713         unsigned int tmo;
714         unsigned char *tbuf;
715         unsigned wLength;
716         int i, pipe, ret;
717
718         if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
719                 return -EFAULT;
720         ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.wIndex);
721         if (ret)
722                 return ret;
723         wLength = ctrl.wLength;         /* To suppress 64k PAGE_SIZE warning */
724         if (wLength > PAGE_SIZE)
725                 return -EINVAL;
726         tbuf = (unsigned char *)__get_free_page(GFP_KERNEL);
727         if (!tbuf)
728                 return -ENOMEM;
729         tmo = ctrl.timeout;
730         if (ctrl.bRequestType & 0x80) {
731                 if (ctrl.wLength && !access_ok(VERIFY_WRITE, ctrl.data,
732                                                ctrl.wLength)) {
733                         free_page((unsigned long)tbuf);
734                         return -EINVAL;
735                 }
736                 pipe = usb_rcvctrlpipe(dev, 0);
737                 snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT);
738
739                 usb_unlock_device(dev);
740                 i = usb_control_msg(dev, pipe, ctrl.bRequest,
741                                     ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
742                                     tbuf, ctrl.wLength, tmo);
743                 usb_lock_device(dev);
744                 snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE);
745
746                 if ((i > 0) && ctrl.wLength) {
747                         if (copy_to_user(ctrl.data, tbuf, i)) {
748                                 free_page((unsigned long)tbuf);
749                                 return -EFAULT;
750                         }
751                 }
752         } else {
753                 if (ctrl.wLength) {
754                         if (copy_from_user(tbuf, ctrl.data, ctrl.wLength)) {
755                                 free_page((unsigned long)tbuf);
756                                 return -EFAULT;
757                         }
758                 }
759                 pipe = usb_sndctrlpipe(dev, 0);
760                 snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT);
761
762                 usb_unlock_device(dev);
763                 i = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ctrl.bRequest,
764                                     ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
765                                     tbuf, ctrl.wLength, tmo);
766                 usb_lock_device(dev);
767                 snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE);
768         }
769         free_page((unsigned long)tbuf);
770         if (i < 0 && i != -EPIPE) {
771                 dev_printk(KERN_DEBUG, &dev->dev, "usbfs: USBDEVFS_CONTROL "
772                            "failed cmd %s rqt %u rq %u len %u ret %d\n",
773                            current->comm, ctrl.bRequestType, ctrl.bRequest,
774                            ctrl.wLength, i);
775         }
776         return i;
777 }
778
779 static int proc_bulk(struct dev_state *ps, void __user *arg)
780 {
781         struct usb_device *dev = ps->dev;
782         struct usbdevfs_bulktransfer bulk;
783         unsigned int tmo, len1, pipe;
784         int len2;
785         unsigned char *tbuf;
786         int i, ret;
787
788         if (copy_from_user(&bulk, arg, sizeof(bulk)))
789                 return -EFAULT;
790         ret = findintfep(ps->dev, bulk.ep);
791         if (ret < 0)
792                 return ret;
793         ret = checkintf(ps, ret);
794         if (ret)
795                 return ret;
796         if (bulk.ep & USB_DIR_IN)
797                 pipe = usb_rcvbulkpipe(dev, bulk.ep & 0x7f);
798         else
799                 pipe = usb_sndbulkpipe(dev, bulk.ep & 0x7f);
800         if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN)))
801                 return -EINVAL;
802         len1 = bulk.len;
803         if (len1 > MAX_USBFS_BUFFER_SIZE)
804                 return -EINVAL;
805         if (!(tbuf = kmalloc(len1, GFP_KERNEL)))
806                 return -ENOMEM;
807         tmo = bulk.timeout;
808         if (bulk.ep & 0x80) {
809                 if (len1 && !access_ok(VERIFY_WRITE, bulk.data, len1)) {
810                         kfree(tbuf);
811                         return -EINVAL;
812                 }
813                 snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT);
814
815                 usb_unlock_device(dev);
816                 i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
817                 usb_lock_device(dev);
818                 snoop_urb(dev, NULL, pipe, len2, i, COMPLETE);
819
820                 if (!i && len2) {
821                         if (copy_to_user(bulk.data, tbuf, len2)) {
822                                 kfree(tbuf);
823                                 return -EFAULT;
824                         }
825                 }
826         } else {
827                 if (len1) {
828                         if (copy_from_user(tbuf, bulk.data, len1)) {
829                                 kfree(tbuf);
830                                 return -EFAULT;
831                         }
832                 }
833                 snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT);
834
835                 usb_unlock_device(dev);
836                 i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
837                 usb_lock_device(dev);
838                 snoop_urb(dev, NULL, pipe, len2, i, COMPLETE);
839         }
840         kfree(tbuf);
841         if (i < 0)
842                 return i;
843         return len2;
844 }
845
846 static int proc_resetep(struct dev_state *ps, void __user *arg)
847 {
848         unsigned int ep;
849         int ret;
850
851         if (get_user(ep, (unsigned int __user *)arg))
852                 return -EFAULT;
853         ret = findintfep(ps->dev, ep);
854         if (ret < 0)
855                 return ret;
856         ret = checkintf(ps, ret);
857         if (ret)
858                 return ret;
859         usb_reset_endpoint(ps->dev, ep);
860         return 0;
861 }
862
863 static int proc_clearhalt(struct dev_state *ps, void __user *arg)
864 {
865         unsigned int ep;
866         int pipe;
867         int ret;
868
869         if (get_user(ep, (unsigned int __user *)arg))
870                 return -EFAULT;
871         ret = findintfep(ps->dev, ep);
872         if (ret < 0)
873                 return ret;
874         ret = checkintf(ps, ret);
875         if (ret)
876                 return ret;
877         if (ep & USB_DIR_IN)
878                 pipe = usb_rcvbulkpipe(ps->dev, ep & 0x7f);
879         else
880                 pipe = usb_sndbulkpipe(ps->dev, ep & 0x7f);
881
882         return usb_clear_halt(ps->dev, pipe);
883 }
884
885 static int proc_getdriver(struct dev_state *ps, void __user *arg)
886 {
887         struct usbdevfs_getdriver gd;
888         struct usb_interface *intf;
889         int ret;
890
891         if (copy_from_user(&gd, arg, sizeof(gd)))
892                 return -EFAULT;
893         intf = usb_ifnum_to_if(ps->dev, gd.interface);
894         if (!intf || !intf->dev.driver)
895                 ret = -ENODATA;
896         else {
897                 strncpy(gd.driver, intf->dev.driver->name,
898                                 sizeof(gd.driver));
899                 ret = (copy_to_user(arg, &gd, sizeof(gd)) ? -EFAULT : 0);
900         }
901         return ret;
902 }
903
904 static int proc_connectinfo(struct dev_state *ps, void __user *arg)
905 {
906         struct usbdevfs_connectinfo ci;
907
908         ci.devnum = ps->dev->devnum;
909         ci.slow = ps->dev->speed == USB_SPEED_LOW;
910         if (copy_to_user(arg, &ci, sizeof(ci)))
911                 return -EFAULT;
912         return 0;
913 }
914
915 static int proc_resetdevice(struct dev_state *ps)
916 {
917         return usb_reset_device(ps->dev);
918 }
919
920 static int proc_setintf(struct dev_state *ps, void __user *arg)
921 {
922         struct usbdevfs_setinterface setintf;
923         int ret;
924
925         if (copy_from_user(&setintf, arg, sizeof(setintf)))
926                 return -EFAULT;
927         if ((ret = checkintf(ps, setintf.interface)))
928                 return ret;
929         return usb_set_interface(ps->dev, setintf.interface,
930                         setintf.altsetting);
931 }
932
933 static int proc_setconfig(struct dev_state *ps, void __user *arg)
934 {
935         int u;
936         int status = 0;
937         struct usb_host_config *actconfig;
938
939         if (get_user(u, (int __user *)arg))
940                 return -EFAULT;
941
942         actconfig = ps->dev->actconfig;
943
944         /* Don't touch the device if any interfaces are claimed.
945          * It could interfere with other drivers' operations, and if
946          * an interface is claimed by usbfs it could easily deadlock.
947          */
948         if (actconfig) {
949                 int i;
950
951                 for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
952                         if (usb_interface_claimed(actconfig->interface[i])) {
953                                 dev_warn(&ps->dev->dev,
954                                         "usbfs: interface %d claimed by %s "
955                                         "while '%s' sets config #%d\n",
956                                         actconfig->interface[i]
957                                                 ->cur_altsetting
958                                                 ->desc.bInterfaceNumber,
959                                         actconfig->interface[i]
960                                                 ->dev.driver->name,
961                                         current->comm, u);
962                                 status = -EBUSY;
963                                 break;
964                         }
965                 }
966         }
967
968         /* SET_CONFIGURATION is often abused as a "cheap" driver reset,
969          * so avoid usb_set_configuration()'s kick to sysfs
970          */
971         if (status == 0) {
972                 if (actconfig && actconfig->desc.bConfigurationValue == u)
973                         status = usb_reset_configuration(ps->dev);
974                 else
975                         status = usb_set_configuration(ps->dev, u);
976         }
977
978         return status;
979 }
980
981 static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
982                         struct usbdevfs_iso_packet_desc __user *iso_frame_desc,
983                         void __user *arg)
984 {
985         struct usbdevfs_iso_packet_desc *isopkt = NULL;
986         struct usb_host_endpoint *ep;
987         struct async *as;
988         struct usb_ctrlrequest *dr = NULL;
989         const struct cred *cred = current_cred();
990         unsigned int u, totlen, isofrmlen;
991         int ret, ifnum = -1;
992         int is_in;
993
994         if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
995                                 USBDEVFS_URB_SHORT_NOT_OK |
996                                 USBDEVFS_URB_NO_FSBR |
997                                 USBDEVFS_URB_ZERO_PACKET |
998                                 USBDEVFS_URB_NO_INTERRUPT))
999                 return -EINVAL;
1000         if (uurb->buffer_length > 0 && !uurb->buffer)
1001                 return -EINVAL;
1002         if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
1003             (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
1004                 ifnum = findintfep(ps->dev, uurb->endpoint);
1005                 if (ifnum < 0)
1006                         return ifnum;
1007                 ret = checkintf(ps, ifnum);
1008                 if (ret)
1009                         return ret;
1010         }
1011         if ((uurb->endpoint & USB_ENDPOINT_DIR_MASK) != 0) {
1012                 is_in = 1;
1013                 ep = ps->dev->ep_in[uurb->endpoint & USB_ENDPOINT_NUMBER_MASK];
1014         } else {
1015                 is_in = 0;
1016                 ep = ps->dev->ep_out[uurb->endpoint & USB_ENDPOINT_NUMBER_MASK];
1017         }
1018         if (!ep)
1019                 return -ENOENT;
1020         switch(uurb->type) {
1021         case USBDEVFS_URB_TYPE_CONTROL:
1022                 if (!usb_endpoint_xfer_control(&ep->desc))
1023                         return -EINVAL;
1024                 /* min 8 byte setup packet,
1025                  * max 8 byte setup plus an arbitrary data stage */
1026                 if (uurb->buffer_length < 8 ||
1027                     uurb->buffer_length > (8 + MAX_USBFS_BUFFER_SIZE))
1028                         return -EINVAL;
1029                 dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
1030                 if (!dr)
1031                         return -ENOMEM;
1032                 if (copy_from_user(dr, uurb->buffer, 8)) {
1033                         kfree(dr);
1034                         return -EFAULT;
1035                 }
1036                 if (uurb->buffer_length < (le16_to_cpup(&dr->wLength) + 8)) {
1037                         kfree(dr);
1038                         return -EINVAL;
1039                 }
1040                 ret = check_ctrlrecip(ps, dr->bRequestType,
1041                                       le16_to_cpup(&dr->wIndex));
1042                 if (ret) {
1043                         kfree(dr);
1044                         return ret;
1045                 }
1046                 uurb->number_of_packets = 0;
1047                 uurb->buffer_length = le16_to_cpup(&dr->wLength);
1048                 uurb->buffer += 8;
1049                 if ((dr->bRequestType & USB_DIR_IN) && uurb->buffer_length) {
1050                         is_in = 1;
1051                         uurb->endpoint |= USB_DIR_IN;
1052                 } else {
1053                         is_in = 0;
1054                         uurb->endpoint &= ~USB_DIR_IN;
1055                 }
1056                 break;
1057
1058         case USBDEVFS_URB_TYPE_BULK:
1059                 switch (usb_endpoint_type(&ep->desc)) {
1060                 case USB_ENDPOINT_XFER_CONTROL:
1061                 case USB_ENDPOINT_XFER_ISOC:
1062                         return -EINVAL;
1063                 /* allow single-shot interrupt transfers, at bogus rates */
1064                 }
1065                 uurb->number_of_packets = 0;
1066                 if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
1067                         return -EINVAL;
1068                 break;
1069
1070         case USBDEVFS_URB_TYPE_ISO:
1071                 /* arbitrary limit */
1072                 if (uurb->number_of_packets < 1 ||
1073                     uurb->number_of_packets > 128)
1074                         return -EINVAL;
1075                 if (!usb_endpoint_xfer_isoc(&ep->desc))
1076                         return -EINVAL;
1077                 isofrmlen = sizeof(struct usbdevfs_iso_packet_desc) *
1078                                    uurb->number_of_packets;
1079                 if (!(isopkt = kmalloc(isofrmlen, GFP_KERNEL)))
1080                         return -ENOMEM;
1081                 if (copy_from_user(isopkt, iso_frame_desc, isofrmlen)) {
1082                         kfree(isopkt);
1083                         return -EFAULT;
1084                 }
1085                 for (totlen = u = 0; u < uurb->number_of_packets; u++) {
1086                         /* arbitrary limit,
1087                          * sufficient for USB 2.0 high-bandwidth iso */
1088                         if (isopkt[u].length > 8192) {
1089                                 kfree(isopkt);
1090                                 return -EINVAL;
1091                         }
1092                         totlen += isopkt[u].length;
1093                 }
1094                 if (totlen > 32768) {
1095                         kfree(isopkt);
1096                         return -EINVAL;
1097                 }
1098                 uurb->buffer_length = totlen;
1099                 break;
1100
1101         case USBDEVFS_URB_TYPE_INTERRUPT:
1102                 uurb->number_of_packets = 0;
1103                 if (!usb_endpoint_xfer_int(&ep->desc))
1104                         return -EINVAL;
1105                 if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
1106                         return -EINVAL;
1107                 break;
1108
1109         default:
1110                 return -EINVAL;
1111         }
1112         if (uurb->buffer_length > 0 &&
1113                         !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
1114                                 uurb->buffer, uurb->buffer_length)) {
1115                 kfree(isopkt);
1116                 kfree(dr);
1117                 return -EFAULT;
1118         }
1119         as = alloc_async(uurb->number_of_packets);
1120         if (!as) {
1121                 kfree(isopkt);
1122                 kfree(dr);
1123                 return -ENOMEM;
1124         }
1125         if (uurb->buffer_length > 0) {
1126                 as->urb->transfer_buffer = kmalloc(uurb->buffer_length,
1127                                 GFP_KERNEL);
1128                 if (!as->urb->transfer_buffer) {
1129                         kfree(isopkt);
1130                         kfree(dr);
1131                         free_async(as);
1132                         return -ENOMEM;
1133                 }
1134         }
1135         as->urb->dev = ps->dev;
1136         as->urb->pipe = (uurb->type << 30) |
1137                         __create_pipe(ps->dev, uurb->endpoint & 0xf) |
1138                         (uurb->endpoint & USB_DIR_IN);
1139
1140         /* This tedious sequence is necessary because the URB_* flags
1141          * are internal to the kernel and subject to change, whereas
1142          * the USBDEVFS_URB_* flags are a user API and must not be changed.
1143          */
1144         u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
1145         if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
1146                 u |= URB_ISO_ASAP;
1147         if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
1148                 u |= URB_SHORT_NOT_OK;
1149         if (uurb->flags & USBDEVFS_URB_NO_FSBR)
1150                 u |= URB_NO_FSBR;
1151         if (uurb->flags & USBDEVFS_URB_ZERO_PACKET)
1152                 u |= URB_ZERO_PACKET;
1153         if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
1154                 u |= URB_NO_INTERRUPT;
1155         as->urb->transfer_flags = u;
1156
1157         as->urb->transfer_buffer_length = uurb->buffer_length;
1158         as->urb->setup_packet = (unsigned char *)dr;
1159         as->urb->start_frame = uurb->start_frame;
1160         as->urb->number_of_packets = uurb->number_of_packets;
1161         if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
1162                         ps->dev->speed == USB_SPEED_HIGH)
1163                 as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);
1164         else
1165                 as->urb->interval = ep->desc.bInterval;
1166         as->urb->context = as;
1167         as->urb->complete = async_completed;
1168         for (totlen = u = 0; u < uurb->number_of_packets; u++) {
1169                 as->urb->iso_frame_desc[u].offset = totlen;
1170                 as->urb->iso_frame_desc[u].length = isopkt[u].length;
1171                 totlen += isopkt[u].length;
1172         }
1173         kfree(isopkt);
1174         as->ps = ps;
1175         as->userurb = arg;
1176         if (is_in && uurb->buffer_length > 0)
1177                 as->userbuffer = uurb->buffer;
1178         else
1179                 as->userbuffer = NULL;
1180         as->signr = uurb->signr;
1181         as->ifnum = ifnum;
1182         as->pid = get_pid(task_pid(current));
1183         as->uid = cred->uid;
1184         as->euid = cred->euid;
1185         security_task_getsecid(current, &as->secid);
1186         if (!is_in && uurb->buffer_length > 0) {
1187                 if (copy_from_user(as->urb->transfer_buffer, uurb->buffer,
1188                                 uurb->buffer_length)) {
1189                         free_async(as);
1190                         return -EFAULT;
1191                 }
1192         }
1193         snoop_urb(ps->dev, as->userurb, as->urb->pipe,
1194                         as->urb->transfer_buffer_length, 0, SUBMIT);
1195         async_newpending(as);
1196         if ((ret = usb_submit_urb(as->urb, GFP_KERNEL))) {
1197                 dev_printk(KERN_DEBUG, &ps->dev->dev,
1198                            "usbfs: usb_submit_urb returned %d\n", ret);
1199                 snoop_urb(ps->dev, as->userurb, as->urb->pipe,
1200                                 0, ret, COMPLETE);
1201                 async_removepending(as);
1202                 free_async(as);
1203                 return ret;
1204         }
1205         return 0;
1206 }
1207
1208 static int proc_submiturb(struct dev_state *ps, void __user *arg)
1209 {
1210         struct usbdevfs_urb uurb;
1211
1212         if (copy_from_user(&uurb, arg, sizeof(uurb)))
1213                 return -EFAULT;
1214
1215         return proc_do_submiturb(ps, &uurb,
1216                         (((struct usbdevfs_urb __user *)arg)->iso_frame_desc),
1217                         arg);
1218 }
1219
1220 static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
1221 {
1222         struct async *as;
1223
1224         as = async_getpending(ps, arg);
1225         if (!as)
1226                 return -EINVAL;
1227         usb_kill_urb(as->urb);
1228         return 0;
1229 }
1230
1231 static int processcompl(struct async *as, void __user * __user *arg)
1232 {
1233         struct urb *urb = as->urb;
1234         struct usbdevfs_urb __user *userurb = as->userurb;
1235         void __user *addr = as->userurb;
1236         unsigned int i;
1237
1238         if (as->userbuffer)
1239                 if (copy_to_user(as->userbuffer, urb->transfer_buffer,
1240                                  urb->transfer_buffer_length))
1241                         goto err_out;
1242         if (put_user(as->status, &userurb->status))
1243                 goto err_out;
1244         if (put_user(urb->actual_length, &userurb->actual_length))
1245                 goto err_out;
1246         if (put_user(urb->error_count, &userurb->error_count))
1247                 goto err_out;
1248
1249         if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
1250                 for (i = 0; i < urb->number_of_packets; i++) {
1251                         if (put_user(urb->iso_frame_desc[i].actual_length,
1252                                      &userurb->iso_frame_desc[i].actual_length))
1253                                 goto err_out;
1254                         if (put_user(urb->iso_frame_desc[i].status,
1255                                      &userurb->iso_frame_desc[i].status))
1256                                 goto err_out;
1257                 }
1258         }
1259
1260         free_async(as);
1261
1262         if (put_user(addr, (void __user * __user *)arg))
1263                 return -EFAULT;
1264         return 0;
1265
1266 err_out:
1267         free_async(as);
1268         return -EFAULT;
1269 }
1270
1271 static struct async *reap_as(struct dev_state *ps)
1272 {
1273         DECLARE_WAITQUEUE(wait, current);
1274         struct async *as = NULL;
1275         struct usb_device *dev = ps->dev;
1276
1277         add_wait_queue(&ps->wait, &wait);
1278         for (;;) {
1279                 __set_current_state(TASK_INTERRUPTIBLE);
1280                 as = async_getcompleted(ps);
1281                 if (as)
1282                         break;
1283                 if (signal_pending(current))
1284                         break;
1285                 usb_unlock_device(dev);
1286                 schedule();
1287                 usb_lock_device(dev);
1288         }
1289         remove_wait_queue(&ps->wait, &wait);
1290         set_current_state(TASK_RUNNING);
1291         return as;
1292 }
1293
1294 static int proc_reapurb(struct dev_state *ps, void __user *arg)
1295 {
1296         struct async *as = reap_as(ps);
1297         if (as)
1298                 return processcompl(as, (void __user * __user *)arg);
1299         if (signal_pending(current))
1300                 return -EINTR;
1301         return -EIO;
1302 }
1303
1304 static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
1305 {
1306         struct async *as;
1307
1308         if (!(as = async_getcompleted(ps)))
1309                 return -EAGAIN;
1310         return processcompl(as, (void __user * __user *)arg);
1311 }
1312
1313 #ifdef CONFIG_COMPAT
1314
1315 static int get_urb32(struct usbdevfs_urb *kurb,
1316                      struct usbdevfs_urb32 __user *uurb)
1317 {
1318         __u32  uptr;
1319         if (!access_ok(VERIFY_READ, uurb, sizeof(*uurb)) ||
1320             __get_user(kurb->type, &uurb->type) ||
1321             __get_user(kurb->endpoint, &uurb->endpoint) ||
1322             __get_user(kurb->status, &uurb->status) ||
1323             __get_user(kurb->flags, &uurb->flags) ||
1324             __get_user(kurb->buffer_length, &uurb->buffer_length) ||
1325             __get_user(kurb->actual_length, &uurb->actual_length) ||
1326             __get_user(kurb->start_frame, &uurb->start_frame) ||
1327             __get_user(kurb->number_of_packets, &uurb->number_of_packets) ||
1328             __get_user(kurb->error_count, &uurb->error_count) ||
1329             __get_user(kurb->signr, &uurb->signr))
1330                 return -EFAULT;
1331
1332         if (__get_user(uptr, &uurb->buffer))
1333                 return -EFAULT;
1334         kurb->buffer = compat_ptr(uptr);
1335         if (__get_user(uptr, &uurb->usercontext))
1336                 return -EFAULT;
1337         kurb->usercontext = compat_ptr(uptr);
1338
1339         return 0;
1340 }
1341
1342 static int proc_submiturb_compat(struct dev_state *ps, void __user *arg)
1343 {
1344         struct usbdevfs_urb uurb;
1345
1346         if (get_urb32(&uurb, (struct usbdevfs_urb32 __user *)arg))
1347                 return -EFAULT;
1348
1349         return proc_do_submiturb(ps, &uurb,
1350                         ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc,
1351                         arg);
1352 }
1353
1354 static int processcompl_compat(struct async *as, void __user * __user *arg)
1355 {
1356         struct urb *urb = as->urb;
1357         struct usbdevfs_urb32 __user *userurb = as->userurb;
1358         void __user *addr = as->userurb;
1359         unsigned int i;
1360
1361         if (as->userbuffer)
1362                 if (copy_to_user(as->userbuffer, urb->transfer_buffer,
1363                                  urb->transfer_buffer_length))
1364                         return -EFAULT;
1365         if (put_user(as->status, &userurb->status))
1366                 return -EFAULT;
1367         if (put_user(urb->actual_length, &userurb->actual_length))
1368                 return -EFAULT;
1369         if (put_user(urb->error_count, &userurb->error_count))
1370                 return -EFAULT;
1371
1372         if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
1373                 for (i = 0; i < urb->number_of_packets; i++) {
1374                         if (put_user(urb->iso_frame_desc[i].actual_length,
1375                                      &userurb->iso_frame_desc[i].actual_length))
1376                                 return -EFAULT;
1377                         if (put_user(urb->iso_frame_desc[i].status,
1378                                      &userurb->iso_frame_desc[i].status))
1379                                 return -EFAULT;
1380                 }
1381         }
1382
1383         free_async(as);
1384         if (put_user(ptr_to_compat(addr), (u32 __user *)arg))
1385                 return -EFAULT;
1386         return 0;
1387 }
1388
1389 static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
1390 {
1391         struct async *as = reap_as(ps);
1392         if (as)
1393                 return processcompl_compat(as, (void __user * __user *)arg);
1394         if (signal_pending(current))
1395                 return -EINTR;
1396         return -EIO;
1397 }
1398
1399 static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
1400 {
1401         struct async *as;
1402
1403         if (!(as = async_getcompleted(ps)))
1404                 return -EAGAIN;
1405         return processcompl_compat(as, (void __user * __user *)arg);
1406 }
1407
1408 #endif
1409
1410 static int proc_disconnectsignal(struct dev_state *ps, void __user *arg)
1411 {
1412         struct usbdevfs_disconnectsignal ds;
1413
1414         if (copy_from_user(&ds, arg, sizeof(ds)))
1415                 return -EFAULT;
1416         ps->discsignr = ds.signr;
1417         ps->disccontext = ds.context;
1418         return 0;
1419 }
1420
1421 static int proc_claiminterface(struct dev_state *ps, void __user *arg)
1422 {
1423         unsigned int ifnum;
1424
1425         if (get_user(ifnum, (unsigned int __user *)arg))
1426                 return -EFAULT;
1427         return claimintf(ps, ifnum);
1428 }
1429
1430 static int proc_releaseinterface(struct dev_state *ps, void __user *arg)
1431 {
1432         unsigned int ifnum;
1433         int ret;
1434
1435         if (get_user(ifnum, (unsigned int __user *)arg))
1436                 return -EFAULT;
1437         if ((ret = releaseintf(ps, ifnum)) < 0)
1438                 return ret;
1439         destroy_async_on_interface (ps, ifnum);
1440         return 0;
1441 }
1442
1443 static int proc_ioctl(struct dev_state *ps, struct usbdevfs_ioctl *ctl)
1444 {
1445         int                     size;
1446         void                    *buf = NULL;
1447         int                     retval = 0;
1448         struct usb_interface    *intf = NULL;
1449         struct usb_driver       *driver = NULL;
1450
1451         /* alloc buffer */
1452         if ((size = _IOC_SIZE(ctl->ioctl_code)) > 0) {
1453                 if ((buf = kmalloc(size, GFP_KERNEL)) == NULL)
1454                         return -ENOMEM;
1455                 if ((_IOC_DIR(ctl->ioctl_code) & _IOC_WRITE)) {
1456                         if (copy_from_user(buf, ctl->data, size)) {
1457                                 kfree(buf);
1458                                 return -EFAULT;
1459                         }
1460                 } else {
1461                         memset(buf, 0, size);
1462                 }
1463         }
1464
1465         if (!connected(ps)) {
1466                 kfree(buf);
1467                 return -ENODEV;
1468         }
1469
1470         if (ps->dev->state != USB_STATE_CONFIGURED)
1471                 retval = -EHOSTUNREACH;
1472         else if (!(intf = usb_ifnum_to_if(ps->dev, ctl->ifno)))
1473                 retval = -EINVAL;
1474         else switch (ctl->ioctl_code) {
1475
1476         /* disconnect kernel driver from interface */
1477         case USBDEVFS_DISCONNECT:
1478                 if (intf->dev.driver) {
1479                         driver = to_usb_driver(intf->dev.driver);
1480                         dev_dbg(&intf->dev, "disconnect by usbfs\n");
1481                         usb_driver_release_interface(driver, intf);
1482                 } else
1483                         retval = -ENODATA;
1484                 break;
1485
1486         /* let kernel drivers try to (re)bind to the interface */
1487         case USBDEVFS_CONNECT:
1488                 if (!intf->dev.driver)
1489                         retval = device_attach(&intf->dev);
1490                 else
1491                         retval = -EBUSY;
1492                 break;
1493
1494         /* talk directly to the interface's driver */
1495         default:
1496                 if (intf->dev.driver)
1497                         driver = to_usb_driver(intf->dev.driver);
1498                 if (driver == NULL || driver->ioctl == NULL) {
1499                         retval = -ENOTTY;
1500                 } else {
1501                         retval = driver->ioctl(intf, ctl->ioctl_code, buf);
1502                         if (retval == -ENOIOCTLCMD)
1503                                 retval = -ENOTTY;
1504                 }
1505         }
1506
1507         /* cleanup and return */
1508         if (retval >= 0
1509                         && (_IOC_DIR(ctl->ioctl_code) & _IOC_READ) != 0
1510                         && size > 0
1511                         && copy_to_user(ctl->data, buf, size) != 0)
1512                 retval = -EFAULT;
1513
1514         kfree(buf);
1515         return retval;
1516 }
1517
1518 static int proc_ioctl_default(struct dev_state *ps, void __user *arg)
1519 {
1520         struct usbdevfs_ioctl   ctrl;
1521
1522         if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
1523                 return -EFAULT;
1524         return proc_ioctl(ps, &ctrl);
1525 }
1526
1527 #ifdef CONFIG_COMPAT
1528 static int proc_ioctl_compat(struct dev_state *ps, compat_uptr_t arg)
1529 {
1530         struct usbdevfs_ioctl32 __user *uioc;
1531         struct usbdevfs_ioctl ctrl;
1532         u32 udata;
1533
1534         uioc = compat_ptr((long)arg);
1535         if (!access_ok(VERIFY_READ, uioc, sizeof(*uioc)) ||
1536             __get_user(ctrl.ifno, &uioc->ifno) ||
1537             __get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
1538             __get_user(udata, &uioc->data))
1539                 return -EFAULT;
1540         ctrl.data = compat_ptr(udata);
1541
1542         return proc_ioctl(ps, &ctrl);
1543 }
1544 #endif
1545
1546 static int proc_claim_port(struct dev_state *ps, void __user *arg)
1547 {
1548         unsigned portnum;
1549         int rc;
1550
1551         if (get_user(portnum, (unsigned __user *) arg))
1552                 return -EFAULT;
1553         rc = usb_hub_claim_port(ps->dev, portnum, ps);
1554         if (rc == 0)
1555                 snoop(&ps->dev->dev, "port %d claimed by process %d: %s\n",
1556                         portnum, task_pid_nr(current), current->comm);
1557         return rc;
1558 }
1559
1560 static int proc_release_port(struct dev_state *ps, void __user *arg)
1561 {
1562         unsigned portnum;
1563
1564         if (get_user(portnum, (unsigned __user *) arg))
1565                 return -EFAULT;
1566         return usb_hub_release_port(ps->dev, portnum, ps);
1567 }
1568
1569 /*
1570  * NOTE:  All requests here that have interface numbers as parameters
1571  * are assuming that somehow the configuration has been prevented from
1572  * changing.  But there's no mechanism to ensure that...
1573  */
1574 static int usbdev_ioctl(struct inode *inode, struct file *file,
1575                         unsigned int cmd, unsigned long arg)
1576 {
1577         struct dev_state *ps = file->private_data;
1578         struct usb_device *dev = ps->dev;
1579         void __user *p = (void __user *)arg;
1580         int ret = -ENOTTY;
1581
1582         if (!(file->f_mode & FMODE_WRITE))
1583                 return -EPERM;
1584         usb_lock_device(dev);
1585         if (!connected(ps)) {
1586                 usb_unlock_device(dev);
1587                 return -ENODEV;
1588         }
1589
1590         switch (cmd) {
1591         case USBDEVFS_CONTROL:
1592                 snoop(&dev->dev, "%s: CONTROL\n", __func__);
1593                 ret = proc_control(ps, p);
1594                 if (ret >= 0)
1595                         inode->i_mtime = CURRENT_TIME;
1596                 break;
1597
1598         case USBDEVFS_BULK:
1599                 snoop(&dev->dev, "%s: BULK\n", __func__);
1600                 ret = proc_bulk(ps, p);
1601                 if (ret >= 0)
1602                         inode->i_mtime = CURRENT_TIME;
1603                 break;
1604
1605         case USBDEVFS_RESETEP:
1606                 snoop(&dev->dev, "%s: RESETEP\n", __func__);
1607                 ret = proc_resetep(ps, p);
1608                 if (ret >= 0)
1609                         inode->i_mtime = CURRENT_TIME;
1610                 break;
1611
1612         case USBDEVFS_RESET:
1613                 snoop(&dev->dev, "%s: RESET\n", __func__);
1614                 ret = proc_resetdevice(ps);
1615                 break;
1616
1617         case USBDEVFS_CLEAR_HALT:
1618                 snoop(&dev->dev, "%s: CLEAR_HALT\n", __func__);
1619                 ret = proc_clearhalt(ps, p);
1620                 if (ret >= 0)
1621                         inode->i_mtime = CURRENT_TIME;
1622                 break;
1623
1624         case USBDEVFS_GETDRIVER:
1625                 snoop(&dev->dev, "%s: GETDRIVER\n", __func__);
1626                 ret = proc_getdriver(ps, p);
1627                 break;
1628
1629         case USBDEVFS_CONNECTINFO:
1630                 snoop(&dev->dev, "%s: CONNECTINFO\n", __func__);
1631                 ret = proc_connectinfo(ps, p);
1632                 break;
1633
1634         case USBDEVFS_SETINTERFACE:
1635                 snoop(&dev->dev, "%s: SETINTERFACE\n", __func__);
1636                 ret = proc_setintf(ps, p);
1637                 break;
1638
1639         case USBDEVFS_SETCONFIGURATION:
1640                 snoop(&dev->dev, "%s: SETCONFIGURATION\n", __func__);
1641                 ret = proc_setconfig(ps, p);
1642                 break;
1643
1644         case USBDEVFS_SUBMITURB:
1645                 snoop(&dev->dev, "%s: SUBMITURB\n", __func__);
1646                 ret = proc_submiturb(ps, p);
1647                 if (ret >= 0)
1648                         inode->i_mtime = CURRENT_TIME;
1649                 break;
1650
1651 #ifdef CONFIG_COMPAT
1652
1653         case USBDEVFS_SUBMITURB32:
1654                 snoop(&dev->dev, "%s: SUBMITURB32\n", __func__);
1655                 ret = proc_submiturb_compat(ps, p);
1656                 if (ret >= 0)
1657                         inode->i_mtime = CURRENT_TIME;
1658                 break;
1659
1660         case USBDEVFS_REAPURB32:
1661                 snoop(&dev->dev, "%s: REAPURB32\n", __func__);
1662                 ret = proc_reapurb_compat(ps, p);
1663                 break;
1664
1665         case USBDEVFS_REAPURBNDELAY32:
1666                 snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
1667                 ret = proc_reapurbnonblock_compat(ps, p);
1668                 break;
1669
1670         case USBDEVFS_IOCTL32:
1671                 snoop(&dev->dev, "%s: IOCTL\n", __func__);
1672                 ret = proc_ioctl_compat(ps, ptr_to_compat(p));
1673                 break;
1674 #endif
1675
1676         case USBDEVFS_DISCARDURB:
1677                 snoop(&dev->dev, "%s: DISCARDURB\n", __func__);
1678                 ret = proc_unlinkurb(ps, p);
1679                 break;
1680
1681         case USBDEVFS_REAPURB:
1682                 snoop(&dev->dev, "%s: REAPURB\n", __func__);
1683                 ret = proc_reapurb(ps, p);
1684                 break;
1685
1686         case USBDEVFS_REAPURBNDELAY:
1687                 snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
1688                 ret = proc_reapurbnonblock(ps, p);
1689                 break;
1690
1691         case USBDEVFS_DISCSIGNAL:
1692                 snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
1693                 ret = proc_disconnectsignal(ps, p);
1694                 break;
1695
1696         case USBDEVFS_CLAIMINTERFACE:
1697                 snoop(&dev->dev, "%s: CLAIMINTERFACE\n", __func__);
1698                 ret = proc_claiminterface(ps, p);
1699                 break;
1700
1701         case USBDEVFS_RELEASEINTERFACE:
1702                 snoop(&dev->dev, "%s: RELEASEINTERFACE\n", __func__);
1703                 ret = proc_releaseinterface(ps, p);
1704                 break;
1705
1706         case USBDEVFS_IOCTL:
1707                 snoop(&dev->dev, "%s: IOCTL\n", __func__);
1708                 ret = proc_ioctl_default(ps, p);
1709                 break;
1710
1711         case USBDEVFS_CLAIM_PORT:
1712                 snoop(&dev->dev, "%s: CLAIM_PORT\n", __func__);
1713                 ret = proc_claim_port(ps, p);
1714                 break;
1715
1716         case USBDEVFS_RELEASE_PORT:
1717                 snoop(&dev->dev, "%s: RELEASE_PORT\n", __func__);
1718                 ret = proc_release_port(ps, p);
1719                 break;
1720         }
1721         usb_unlock_device(dev);
1722         if (ret >= 0)
1723                 inode->i_atime = CURRENT_TIME;
1724         return ret;
1725 }
1726
1727 /* No kernel lock - fine */
1728 static unsigned int usbdev_poll(struct file *file,
1729                                 struct poll_table_struct *wait)
1730 {
1731         struct dev_state *ps = file->private_data;
1732         unsigned int mask = 0;
1733
1734         poll_wait(file, &ps->wait, wait);
1735         if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
1736                 mask |= POLLOUT | POLLWRNORM;
1737         if (!connected(ps))
1738                 mask |= POLLERR | POLLHUP;
1739         return mask;
1740 }
1741
1742 const struct file_operations usbdev_file_operations = {
1743         .owner =        THIS_MODULE,
1744         .llseek =       usbdev_lseek,
1745         .read =         usbdev_read,
1746         .poll =         usbdev_poll,
1747         .ioctl =        usbdev_ioctl,
1748         .open =         usbdev_open,
1749         .release =      usbdev_release,
1750 };
1751
1752 static void usbdev_remove(struct usb_device *udev)
1753 {
1754         struct dev_state *ps;
1755         struct siginfo sinfo;
1756
1757         while (!list_empty(&udev->filelist)) {
1758                 ps = list_entry(udev->filelist.next, struct dev_state, list);
1759                 destroy_all_async(ps);
1760                 wake_up_all(&ps->wait);
1761                 list_del_init(&ps->list);
1762                 if (ps->discsignr) {
1763                         sinfo.si_signo = ps->discsignr;
1764                         sinfo.si_errno = EPIPE;
1765                         sinfo.si_code = SI_ASYNCIO;
1766                         sinfo.si_addr = ps->disccontext;
1767                         kill_pid_info_as_uid(ps->discsignr, &sinfo,
1768                                         ps->disc_pid, ps->disc_uid,
1769                                         ps->disc_euid, ps->secid);
1770                 }
1771         }
1772 }
1773
1774 #ifdef CONFIG_USB_DEVICE_CLASS
1775 static struct class *usb_classdev_class;
1776
1777 static int usb_classdev_add(struct usb_device *dev)
1778 {
1779         struct device *cldev;
1780
1781         cldev = device_create(usb_classdev_class, &dev->dev, dev->dev.devt,
1782                               NULL, "usbdev%d.%d", dev->bus->busnum,
1783                               dev->devnum);
1784         if (IS_ERR(cldev))
1785                 return PTR_ERR(cldev);
1786         dev->usb_classdev = cldev;
1787         return 0;
1788 }
1789
1790 static void usb_classdev_remove(struct usb_device *dev)
1791 {
1792         if (dev->usb_classdev)
1793                 device_unregister(dev->usb_classdev);
1794 }
1795
1796 #else
1797 #define usb_classdev_add(dev)           0
1798 #define usb_classdev_remove(dev)        do {} while (0)
1799
1800 #endif
1801
1802 static int usbdev_notify(struct notifier_block *self,
1803                                unsigned long action, void *dev)
1804 {
1805         switch (action) {
1806         case USB_DEVICE_ADD:
1807                 if (usb_classdev_add(dev))
1808                         return NOTIFY_BAD;
1809                 break;
1810         case USB_DEVICE_REMOVE:
1811                 usb_classdev_remove(dev);
1812                 usbdev_remove(dev);
1813                 break;
1814         }
1815         return NOTIFY_OK;
1816 }
1817
1818 static struct notifier_block usbdev_nb = {
1819         .notifier_call =        usbdev_notify,
1820 };
1821
1822 static struct cdev usb_device_cdev;
1823
1824 int __init usb_devio_init(void)
1825 {
1826         int retval;
1827
1828         retval = register_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX,
1829                                         "usb_device");
1830         if (retval) {
1831                 printk(KERN_ERR "Unable to register minors for usb_device\n");
1832                 goto out;
1833         }
1834         cdev_init(&usb_device_cdev, &usbdev_file_operations);
1835         retval = cdev_add(&usb_device_cdev, USB_DEVICE_DEV, USB_DEVICE_MAX);
1836         if (retval) {
1837                 printk(KERN_ERR "Unable to get usb_device major %d\n",
1838                        USB_DEVICE_MAJOR);
1839                 goto error_cdev;
1840         }
1841 #ifdef CONFIG_USB_DEVICE_CLASS
1842         usb_classdev_class = class_create(THIS_MODULE, "usb_device");
1843         if (IS_ERR(usb_classdev_class)) {
1844                 printk(KERN_ERR "Unable to register usb_device class\n");
1845                 retval = PTR_ERR(usb_classdev_class);
1846                 cdev_del(&usb_device_cdev);
1847                 usb_classdev_class = NULL;
1848                 goto out;
1849         }
1850         /* devices of this class shadow the major:minor of their parent
1851          * device, so clear ->dev_kobj to prevent adding duplicate entries
1852          * to /sys/dev
1853          */
1854         usb_classdev_class->dev_kobj = NULL;
1855 #endif
1856         usb_register_notify(&usbdev_nb);
1857 out:
1858         return retval;
1859
1860 error_cdev:
1861         unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
1862         goto out;
1863 }
1864
1865 void usb_devio_cleanup(void)
1866 {
1867         usb_unregister_notify(&usbdev_nb);
1868 #ifdef CONFIG_USB_DEVICE_CLASS
1869         class_destroy(usb_classdev_class);
1870 #endif
1871         cdev_del(&usb_device_cdev);
1872         unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
1873 }