drivers/usb/core/devio.c

   1 /*****************************************************************************/
   2
   3 /*
   4  *      devio.c  --  User space communication with USB devices.
   5  *
   6  *      Copyright (C) 1999-2000  Thomas Sailer (sailer@ife.ee.ethz.ch)
   7  *
   8  *      This program is free software; you can redistribute it and/or modify
   9  *      it under the terms of the GNU General Public License as published by
  10  *      the Free Software Foundation; either version 2 of the License, or
  11  *      (at your option) any later version.
  12  *
  13  *      This program is distributed in the hope that it will be useful,
  14  *      but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *      GNU General Public License for more details.
  17  *
  18  *      You should have received a copy of the GNU General Public License
  19  *      along with this program; if not, write to the Free Software
  20  *      Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21  *
  22  *  This file implements the usbfs/x/y files, where
  23  *  x is the bus number and y the device number.
  24  *
  25  *  It allows user space programs/"drivers" to communicate directly
  26  *  with USB devices without intervening kernel driver.
  27  *
  28  *  Revision history
  29  *    22.12.1999   0.1   Initial release (split from proc_usb.c)
  30  *    04.01.2000   0.2   Turned into its own filesystem
  31  *    30.09.2005   0.3   Fix user-triggerable oops in async URB delivery
  32  *                       (CAN-2005-3055)
  33  */
  34
  35 /*****************************************************************************/
  36
  37 #include <linux/fs.h>
  38 #include <linux/mm.h>
  39 #include <linux/slab.h>
  40 #include <linux/signal.h>
  41 #include <linux/poll.h>
  42 #include <linux/module.h>
  43 #include <linux/string.h>
  44 #include <linux/usb.h>
  45 #include <linux/usbdevice_fs.h>
  46 #include <linux/usb/hcd.h>      /* for usbcore internals */
  47 #include <linux/cdev.h>
  48 #include <linux/notifier.h>
  49 #include <linux/security.h>
  50 #include <linux/user_namespace.h>
  51 #include <linux/scatterlist.h>
  52 #include <linux/uaccess.h>
  53 #include <linux/dma-mapping.h>
  54 #include <asm/byteorder.h>
  55 #include <linux/moduleparam.h>
  56
  57 #include "usb.h"
  58
  59 #define USB_MAXBUS                      64
  60 #define USB_DEVICE_MAX                  (USB_MAXBUS * 128)
  61 #define USB_SG_SIZE                     16384 /* split-size for large txs */
  62
  63 /* Mutual exclusion for removal, open, and release */
  64 DEFINE_MUTEX(usbfs_mutex);
  65
  66 struct usb_dev_state {
  67         struct list_head list;      /* state list */
  68         struct usb_device *dev;
  69         struct file *file;
  70         spinlock_t lock;            /* protects the async urb lists */
  71         struct list_head async_pending;
  72         struct list_head async_completed;
  73         struct list_head memory_list;
  74         wait_queue_head_t wait;     /* wake up if a request completed */
  75         unsigned int discsignr;
  76         struct pid *disc_pid;
  77         const struct cred *cred;
  78         void __user *disccontext;
  79         unsigned long ifclaimed;
  80         u32 secid;
  81         u32 disabled_bulk_eps;
  82         bool privileges_dropped;
  83         unsigned long interface_allowed_mask;
  84 };
  85
  86 struct usb_memory {
  87         struct list_head memlist;
  88         int vma_use_count;
  89         int urb_use_count;
  90         u32 size;
  91         void *mem;
  92         dma_addr_t dma_handle;
  93         unsigned long vm_start;
  94         struct usb_dev_state *ps;
  95 };
  96
  97 struct async {
  98         struct list_head asynclist;
  99         struct usb_dev_state *ps;
 100         struct pid *pid;
 101         const struct cred *cred;
 102         unsigned int signr;
 103         unsigned int ifnum;
 104         void __user *userbuffer;
 105         void __user *userurb;
 106         struct urb *urb;
 107         struct usb_memory *usbm;
 108         unsigned int mem_usage;
 109         int status;
 110         u32 secid;
 111         u8 bulk_addr;
 112         u8 bulk_status;
 113 };
 114
 115 static bool usbfs_snoop;
 116 module_param(usbfs_snoop, bool, S_IRUGO | S_IWUSR);
 117 MODULE_PARM_DESC(usbfs_snoop, "true to log all usbfs traffic");
 118
 119 static unsigned usbfs_snoop_max = 65536;
 120 module_param(usbfs_snoop_max, uint, S_IRUGO | S_IWUSR);
 121 MODULE_PARM_DESC(usbfs_snoop_max,
 122                 "maximum number of bytes to print while snooping");
 123
 124 #define snoop(dev, format, arg...)                              \
 125         do {                                                    \
 126                 if (usbfs_snoop)                                \
 127                         dev_info(dev, format, ## arg);          \
 128         } while (0)
 129
 130 enum snoop_when {
 131         SUBMIT, COMPLETE
 132 };
 133
 134 #define USB_DEVICE_DEV          MKDEV(USB_DEVICE_MAJOR, 0)
 135
 136 /* Limit on the total amount of memory we can allocate for transfers */
 137 static u32 usbfs_memory_mb = 16;
 138 module_param(usbfs_memory_mb, uint, 0644);
 139 MODULE_PARM_DESC(usbfs_memory_mb,
 140                 "maximum MB allowed for usbfs buffers (0 = no limit)");
 141
 142 /* Hard limit, necessary to avoid arithmetic overflow */
 143 #define USBFS_XFER_MAX         (UINT_MAX / 2 - 1000000)
 144
 145 static atomic64_t usbfs_memory_usage;   /* Total memory currently allocated */
 146
 147 /* Check whether it's okay to allocate more memory for a transfer */
 148 static int usbfs_increase_memory_usage(u64 amount)
 149 {
 150         u64 lim;
 151
 152         lim = ACCESS_ONCE(usbfs_memory_mb);
 153         lim <<= 20;
 154
 155         atomic64_add(amount, &usbfs_memory_usage);
 156
 157         if (lim > 0 && atomic64_read(&usbfs_memory_usage) > lim) {
 158                 atomic64_sub(amount, &usbfs_memory_usage);
 159                 return -ENOMEM;
 160         }
 161
 162         return 0;
 163 }
 164
 165 /* Memory for a transfer is being deallocated */
 166 static void usbfs_decrease_memory_usage(u64 amount)
 167 {
 168         atomic64_sub(amount, &usbfs_memory_usage);
 169 }
 170
 171 static int connected(struct usb_dev_state *ps)
 172 {
 173         return (!list_empty(&ps->list) &&
 174                         ps->dev->state != USB_STATE_NOTATTACHED);
 175 }
 176
 177 static void dec_usb_memory_use_count(struct usb_memory *usbm, int *count)
 178 {
 179         struct usb_dev_state *ps = usbm->ps;
 180         unsigned long flags;
 181
 182         spin_lock_irqsave(&ps->lock, flags);
 183         --*count;
 184         if (usbm->urb_use_count == 0 && usbm->vma_use_count == 0) {
 185                 list_del(&usbm->memlist);
 186                 spin_unlock_irqrestore(&ps->lock, flags);
 187
 188                 usb_free_coherent(ps->dev, usbm->size, usbm->mem,
 189                                 usbm->dma_handle);
 190                 usbfs_decrease_memory_usage(
 191                         usbm->size + sizeof(struct usb_memory));
 192                 kfree(usbm);
 193         } else {
 194                 spin_unlock_irqrestore(&ps->lock, flags);
 195         }
 196 }
 197
 198 static void usbdev_vm_open(struct vm_area_struct *vma)
 199 {
 200         struct usb_memory *usbm = vma->vm_private_data;
 201         unsigned long flags;
 202
 203         spin_lock_irqsave(&usbm->ps->lock, flags);
 204         ++usbm->vma_use_count;
 205         spin_unlock_irqrestore(&usbm->ps->lock, flags);
 206 }
 207
 208 static void usbdev_vm_close(struct vm_area_struct *vma)
 209 {
 210         struct usb_memory *usbm = vma->vm_private_data;
 211
 212         dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
 213 }
 214
 215 static struct vm_operations_struct usbdev_vm_ops = {
 216         .open = usbdev_vm_open,
 217         .close = usbdev_vm_close
 218 };
 219
 220 static int usbdev_mmap(struct file *file, struct vm_area_struct *vma)
 221 {
 222         struct usb_memory *usbm = NULL;
 223         struct usb_dev_state *ps = file->private_data;
 224         size_t size = vma->vm_end - vma->vm_start;
 225         void *mem;
 226         unsigned long flags;
 227         dma_addr_t dma_handle;
 228         int ret;
 229
 230         ret = usbfs_increase_memory_usage(size + sizeof(struct usb_memory));
 231         if (ret)
 232                 goto error;
 233
 234         usbm = kzalloc(sizeof(struct usb_memory), GFP_KERNEL);
 235         if (!usbm) {
 236                 ret = -ENOMEM;
 237                 goto error_decrease_mem;
 238         }
 239
 240         mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN,
 241                         &dma_handle);
 242         if (!mem) {
 243                 ret = -ENOMEM;
 244                 goto error_free_usbm;
 245         }
 246
 247         memset(mem, 0, size);
 248
 249         usbm->mem = mem;
 250         usbm->dma_handle = dma_handle;
 251         usbm->size = size;
 252         usbm->ps = ps;
 253         usbm->vm_start = vma->vm_start;
 254         usbm->vma_use_count = 1;
 255         INIT_LIST_HEAD(&usbm->memlist);
 256
 257         if (remap_pfn_range(vma, vma->vm_start,
 258                         virt_to_phys(usbm->mem) >> PAGE_SHIFT,
 259                         size, vma->vm_page_prot) < 0) {
 260                 dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
 261                 return -EAGAIN;
 262         }
 263
 264         vma->vm_flags |= VM_IO;
 265         vma->vm_flags |= (VM_DONTEXPAND | VM_DONTDUMP);
 266         vma->vm_ops = &usbdev_vm_ops;
 267         vma->vm_private_data = usbm;
 268
 269         spin_lock_irqsave(&ps->lock, flags);
 270         list_add_tail(&usbm->memlist, &ps->memory_list);
 271         spin_unlock_irqrestore(&ps->lock, flags);
 272
 273         return 0;
 274
 275 error_free_usbm:
 276         kfree(usbm);
 277 error_decrease_mem:
 278         usbfs_decrease_memory_usage(size + sizeof(struct usb_memory));
 279 error:
 280         return ret;
 281 }
 282
 283 static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
 284                            loff_t *ppos)
 285 {
 286         struct usb_dev_state *ps = file->private_data;
 287         struct usb_device *dev = ps->dev;
 288         ssize_t ret = 0;
 289         unsigned len;
 290         loff_t pos;
 291         int i;
 292
 293         pos = *ppos;
 294         usb_lock_device(dev);
 295         if (!connected(ps)) {
 296                 ret = -ENODEV;
 297                 goto err;
 298         } else if (pos < 0) {
 299                 ret = -EINVAL;
 300                 goto err;
 301         }
 302
 303         if (pos < sizeof(struct usb_device_descriptor)) {
 304                 /* 18 bytes - fits on the stack */
 305                 struct usb_device_descriptor temp_desc;
 306
 307                 memcpy(&temp_desc, &dev->descriptor, sizeof(dev->descriptor));
 308                 le16_to_cpus(&temp_desc.bcdUSB);
 309                 le16_to_cpus(&temp_desc.idVendor);
 310                 le16_to_cpus(&temp_desc.idProduct);
 311                 le16_to_cpus(&temp_desc.bcdDevice);
 312
 313                 len = sizeof(struct usb_device_descriptor) - pos;
 314                 if (len > nbytes)
 315                         len = nbytes;
 316                 if (copy_to_user(buf, ((char *)&temp_desc) + pos, len)) {
 317                         ret = -EFAULT;
 318                         goto err;
 319                 }
 320
 321                 *ppos += len;
 322                 buf += len;
 323                 nbytes -= len;
 324                 ret += len;
 325         }
 326
 327         pos = sizeof(struct usb_device_descriptor);
 328         for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {
 329                 struct usb_config_descriptor *config =
 330                         (struct usb_config_descriptor *)dev->rawdescriptors[i];
 331                 unsigned int length = le16_to_cpu(config->wTotalLength);
 332
 333                 if (*ppos < pos + length) {
 334
 335                         /* The descriptor may claim to be longer than it
 336                          * really is.  Here is the actual allocated length. */
 337                         unsigned alloclen =
 338                                 le16_to_cpu(dev->config[i].desc.wTotalLength);
 339
 340                         len = length - (*ppos - pos);
 341                         if (len > nbytes)
 342                                 len = nbytes;
 343
 344                         /* Simply don't write (skip over) unallocated parts */
 345                         if (alloclen > (*ppos - pos)) {
 346                                 alloclen -= (*ppos - pos);
 347                                 if (copy_to_user(buf,
 348                                     dev->rawdescriptors[i] + (*ppos - pos),
 349                                     min(len, alloclen))) {
 350                                         ret = -EFAULT;
 351                                         goto err;
 352                                 }
 353                         }
 354
 355                         *ppos += len;
 356                         buf += len;
 357                         nbytes -= len;
 358                         ret += len;
 359                 }
 360
 361                 pos += length;
 362         }
 363
 364 err:
 365         usb_unlock_device(dev);
 366         return ret;
 367 }
 368
 369 /*
 370  * async list handling
 371  */
 372
 373 static struct async *alloc_async(unsigned int numisoframes)
 374 {
 375         struct async *as;
 376
 377         as = kzalloc(sizeof(struct async), GFP_KERNEL);
 378         if (!as)
 379                 return NULL;
 380         as->urb = usb_alloc_urb(numisoframes, GFP_KERNEL);
 381         if (!as->urb) {
 382                 kfree(as);
 383                 return NULL;
 384         }
 385         return as;
 386 }
 387
 388 static void free_async(struct async *as)
 389 {
 390         int i;
 391
 392         put_pid(as->pid);
 393         if (as->cred)
 394                 put_cred(as->cred);
 395         for (i = 0; i < as->urb->num_sgs; i++) {
 396                 if (sg_page(&as->urb->sg[i]))
 397                         kfree(sg_virt(&as->urb->sg[i]));
 398         }
 399
 400         kfree(as->urb->sg);
 401         if (as->usbm == NULL)
 402                 kfree(as->urb->transfer_buffer);
 403         else
 404                 dec_usb_memory_use_count(as->usbm, &as->usbm->urb_use_count);
 405
 406         kfree(as->urb->setup_packet);
 407         usb_free_urb(as->urb);
 408         usbfs_decrease_memory_usage(as->mem_usage);
 409         kfree(as);
 410 }
 411
 412 static void async_newpending(struct async *as)
 413 {
 414         struct usb_dev_state *ps = as->ps;
 415         unsigned long flags;
 416
 417         spin_lock_irqsave(&ps->lock, flags);
 418         list_add_tail(&as->asynclist, &ps->async_pending);
 419         spin_unlock_irqrestore(&ps->lock, flags);
 420 }
 421
 422 static void async_removepending(struct async *as)
 423 {
 424         struct usb_dev_state *ps = as->ps;
 425         unsigned long flags;
 426
 427         spin_lock_irqsave(&ps->lock, flags);
 428         list_del_init(&as->asynclist);
 429         spin_unlock_irqrestore(&ps->lock, flags);
 430 }
 431
 432 static struct async *async_getcompleted(struct usb_dev_state *ps)
 433 {
 434         unsigned long flags;
 435         struct async *as = NULL;
 436
 437         spin_lock_irqsave(&ps->lock, flags);
 438         if (!list_empty(&ps->async_completed)) {
 439                 as = list_entry(ps->async_completed.next, struct async,
 440                                 asynclist);
 441                 list_del_init(&as->asynclist);
 442         }
 443         spin_unlock_irqrestore(&ps->lock, flags);
 444         return as;
 445 }
 446
 447 static struct async *async_getpending(struct usb_dev_state *ps,
 448                                              void __user *userurb)
 449 {
 450         struct async *as;
 451
 452         list_for_each_entry(as, &ps->async_pending, asynclist)
 453                 if (as->userurb == userurb) {
 454                         list_del_init(&as->asynclist);
 455                         return as;
 456                 }
 457
 458         return NULL;
 459 }
 460
 461 static void snoop_urb(struct usb_device *udev,
 462                 void __user *userurb, int pipe, unsigned length,
 463                 int timeout_or_status, enum snoop_when when,
 464                 unsigned char *data, unsigned data_len)
 465 {
 466         static const char *types[] = {"isoc", "int", "ctrl", "bulk"};
 467         static const char *dirs[] = {"out", "in"};
 468         int ep;
 469         const char *t, *d;
 470
 471         if (!usbfs_snoop)
 472                 return;
 473
 474         ep = usb_pipeendpoint(pipe);
 475         t = types[usb_pipetype(pipe)];
 476         d = dirs[!!usb_pipein(pipe)];
 477
 478         if (userurb) {          /* Async */
 479                 if (when == SUBMIT)
 480                         dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
 481                                         "length %u\n",
 482                                         userurb, ep, t, d, length);
 483                 else
 484                         dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
 485                                         "actual_length %u status %d\n",
 486                                         userurb, ep, t, d, length,
 487                                         timeout_or_status);
 488         } else {
 489                 if (when == SUBMIT)
 490                         dev_info(&udev->dev, "ep%d %s-%s, length %u, "
 491                                         "timeout %d\n",
 492                                         ep, t, d, length, timeout_or_status);
 493                 else
 494                         dev_info(&udev->dev, "ep%d %s-%s, actual_length %u, "
 495                                         "status %d\n",
 496                                         ep, t, d, length, timeout_or_status);
 497         }
 498
 499         data_len = min(data_len, usbfs_snoop_max);
 500         if (data && data_len > 0) {
 501                 print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
 502                         data, data_len, 1);
 503         }
 504 }
 505
 506 static void snoop_urb_data(struct urb *urb, unsigned len)
 507 {
 508         int i, size;
 509
 510         len = min(len, usbfs_snoop_max);
 511         if (!usbfs_snoop || len == 0)
 512                 return;
 513
 514         if (urb->num_sgs == 0) {
 515                 print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
 516                         urb->transfer_buffer, len, 1);
 517                 return;
 518         }
 519
 520         for (i = 0; i < urb->num_sgs && len; i++) {
 521                 size = (len > USB_SG_SIZE) ? USB_SG_SIZE : len;
 522                 print_hex_dump(KERN_DEBUG, "data: ", DUMP_PREFIX_NONE, 32, 1,
 523                         sg_virt(&urb->sg[i]), size, 1);
 524                 len -= size;
 525         }
 526 }
 527
 528 static int copy_urb_data_to_user(u8 __user *userbuffer, struct urb *urb)
 529 {
 530         unsigned i, len, size;
 531
 532         if (urb->number_of_packets > 0)         /* Isochronous */
 533                 len = urb->transfer_buffer_length;
 534         else                                    /* Non-Isoc */
 535                 len = urb->actual_length;
 536
 537         if (urb->num_sgs == 0) {
 538                 if (copy_to_user(userbuffer, urb->transfer_buffer, len))
 539                         return -EFAULT;
 540                 return 0;
 541         }
 542
 543         for (i = 0; i < urb->num_sgs && len; i++) {
 544                 size = (len > USB_SG_SIZE) ? USB_SG_SIZE : len;
 545                 if (copy_to_user(userbuffer, sg_virt(&urb->sg[i]), size))
 546                         return -EFAULT;
 547                 userbuffer += size;
 548                 len -= size;
 549         }
 550
 551         return 0;
 552 }
 553
 554 #define AS_CONTINUATION 1
 555 #define AS_UNLINK       2
 556
 557 static void cancel_bulk_urbs(struct usb_dev_state *ps, unsigned bulk_addr)
 558 __releases(ps->lock)
 559 __acquires(ps->lock)
 560 {
 561         struct urb *urb;
 562         struct async *as;
 563
 564         /* Mark all the pending URBs that match bulk_addr, up to but not
 565          * including the first one without AS_CONTINUATION.  If such an
 566          * URB is encountered then a new transfer has already started so
 567          * the endpoint doesn't need to be disabled; otherwise it does.
 568          */
 569         list_for_each_entry(as, &ps->async_pending, asynclist) {
 570                 if (as->bulk_addr == bulk_addr) {
 571                         if (as->bulk_status != AS_CONTINUATION)
 572                                 goto rescan;
 573                         as->bulk_status = AS_UNLINK;
 574                         as->bulk_addr = 0;
 575                 }
 576         }
 577         ps->disabled_bulk_eps |= (1 << bulk_addr);
 578
 579         /* Now carefully unlink all the marked pending URBs */
 580  rescan:
 581         list_for_each_entry(as, &ps->async_pending, asynclist) {
 582                 if (as->bulk_status == AS_UNLINK) {
 583                         as->bulk_status = 0;            /* Only once */
 584                         urb = as->urb;
 585                         usb_get_urb(urb);
 586                         spin_unlock(&ps->lock);         /* Allow completions */
 587                         usb_unlink_urb(urb);
 588                         usb_put_urb(urb);
 589                         spin_lock(&ps->lock);
 590                         goto rescan;
 591                 }
 592         }
 593 }
 594
 595 static void async_completed(struct urb *urb)
 596 {
 597         struct async *as = urb->context;
 598         struct usb_dev_state *ps = as->ps;
 599         struct siginfo sinfo;
 600         struct pid *pid = NULL;
 601         u32 secid = 0;
 602         const struct cred *cred = NULL;
 603         int signr;
 604
 605         spin_lock(&ps->lock);
 606         list_move_tail(&as->asynclist, &ps->async_completed);
 607         as->status = urb->status;
 608         signr = as->signr;
 609         if (signr) {
 610                 memset(&sinfo, 0, sizeof(sinfo));
 611                 sinfo.si_signo = as->signr;
 612                 sinfo.si_errno = as->status;
 613                 sinfo.si_code = SI_ASYNCIO;
 614                 sinfo.si_addr = as->userurb;
 615                 pid = get_pid(as->pid);
 616                 cred = get_cred(as->cred);
 617                 secid = as->secid;
 618         }
 619         snoop(&urb->dev->dev, "urb complete\n");
 620         snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
 621                         as->status, COMPLETE, NULL, 0);
 622         if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN)
 623                 snoop_urb_data(urb, urb->actual_length);
 624
 625         if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
 626                         as->status != -ENOENT)
 627                 cancel_bulk_urbs(ps, as->bulk_addr);
 628
 629         wake_up(&ps->wait);
 630         spin_unlock(&ps->lock);
 631
 632         if (signr) {
 633                 kill_pid_info_as_cred(sinfo.si_signo, &sinfo, pid, cred, secid);
 634                 put_pid(pid);
 635                 put_cred(cred);
 636         }
 637 }
 638
 639 static void destroy_async(struct usb_dev_state *ps, struct list_head *list)
 640 {
 641         struct urb *urb;
 642         struct async *as;
 643         unsigned long flags;
 644
 645         spin_lock_irqsave(&ps->lock, flags);
 646         while (!list_empty(list)) {
 647                 as = list_entry(list->next, struct async, asynclist);
 648                 list_del_init(&as->asynclist);
 649                 urb = as->urb;
 650                 usb_get_urb(urb);
 651
 652                 /* drop the spinlock so the completion handler can run */
 653                 spin_unlock_irqrestore(&ps->lock, flags);
 654                 usb_kill_urb(urb);
 655                 usb_put_urb(urb);
 656                 spin_lock_irqsave(&ps->lock, flags);
 657         }
 658         spin_unlock_irqrestore(&ps->lock, flags);
 659 }
 660
 661 static void destroy_async_on_interface(struct usb_dev_state *ps,
 662                                        unsigned int ifnum)
 663 {
 664         struct list_head *p, *q, hitlist;
 665         unsigned long flags;
 666
 667         INIT_LIST_HEAD(&hitlist);
 668         spin_lock_irqsave(&ps->lock, flags);
 669         list_for_each_safe(p, q, &ps->async_pending)
 670                 if (ifnum == list_entry(p, struct async, asynclist)->ifnum)
 671                         list_move_tail(p, &hitlist);
 672         spin_unlock_irqrestore(&ps->lock, flags);
 673         destroy_async(ps, &hitlist);
 674 }
 675
 676 static void destroy_all_async(struct usb_dev_state *ps)
 677 {
 678         destroy_async(ps, &ps->async_pending);
 679 }
 680
 681 /*
 682  * interface claims are made only at the request of user level code,
 683  * which can also release them (explicitly or by closing files).
 684  * they're also undone when devices disconnect.
 685  */
 686
 687 static int driver_probe(struct usb_interface *intf,
 688                         const struct usb_device_id *id)
 689 {
 690         return -ENODEV;
 691 }
 692
 693 static void driver_disconnect(struct usb_interface *intf)
 694 {
 695         struct usb_dev_state *ps = usb_get_intfdata(intf);
 696         unsigned int ifnum = intf->altsetting->desc.bInterfaceNumber;
 697
 698         if (!ps)
 699                 return;
 700
 701         /* NOTE:  this relies on usbcore having canceled and completed
 702          * all pending I/O requests; 2.6 does that.
 703          */
 704
 705         if (likely(ifnum < 8*sizeof(ps->ifclaimed)))
 706                 clear_bit(ifnum, &ps->ifclaimed);
 707         else
 708                 dev_warn(&intf->dev, "interface number %u out of range\n",
 709                          ifnum);
 710
 711         usb_set_intfdata(intf, NULL);
 712
 713         /* force async requests to complete */
 714         destroy_async_on_interface(ps, ifnum);
 715 }
 716
 717 /* The following routines are merely placeholders.  There is no way
 718  * to inform a user task about suspend or resumes.
 719  */
 720 static int driver_suspend(struct usb_interface *intf, pm_message_t msg)
 721 {
 722         return 0;
 723 }
 724
 725 static int driver_resume(struct usb_interface *intf)
 726 {
 727         return 0;
 728 }
 729
 730 struct usb_driver usbfs_driver = {
 731         .name =         "usbfs",
 732         .probe =        driver_probe,
 733         .disconnect =   driver_disconnect,
 734         .suspend =      driver_suspend,
 735         .resume =       driver_resume,
 736 };
 737
 738 static int claimintf(struct usb_dev_state *ps, unsigned int ifnum)
 739 {
 740         struct usb_device *dev = ps->dev;
 741         struct usb_interface *intf;
 742         int err;
 743
 744         if (ifnum >= 8*sizeof(ps->ifclaimed))
 745                 return -EINVAL;
 746         /* already claimed */
 747         if (test_bit(ifnum, &ps->ifclaimed))
 748                 return 0;
 749
 750         if (ps->privileges_dropped &&
 751                         !test_bit(ifnum, &ps->interface_allowed_mask))
 752                 return -EACCES;
 753
 754         intf = usb_ifnum_to_if(dev, ifnum);
 755         if (!intf)
 756                 err = -ENOENT;
 757         else {
 758                 unsigned int old_suppress;
 759
 760                 /* suppress uevents while claiming interface */
 761                 old_suppress = dev_get_uevent_suppress(&intf->dev);
 762                 dev_set_uevent_suppress(&intf->dev, 1);
 763                 err = usb_driver_claim_interface(&usbfs_driver, intf, ps);
 764                 dev_set_uevent_suppress(&intf->dev, old_suppress);
 765         }
 766         if (err == 0)
 767                 set_bit(ifnum, &ps->ifclaimed);
 768         return err;
 769 }
 770
 771 static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum)
 772 {
 773         struct usb_device *dev;
 774         struct usb_interface *intf;
 775         int err;
 776
 777         err = -EINVAL;
 778         if (ifnum >= 8*sizeof(ps->ifclaimed))
 779                 return err;
 780         dev = ps->dev;
 781         intf = usb_ifnum_to_if(dev, ifnum);
 782         if (!intf)
 783                 err = -ENOENT;
 784         else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) {
 785                 unsigned int old_suppress;
 786
 787                 /* suppress uevents while releasing interface */
 788                 old_suppress = dev_get_uevent_suppress(&intf->dev);
 789                 dev_set_uevent_suppress(&intf->dev, 1);
 790                 usb_driver_release_interface(&usbfs_driver, intf);
 791                 dev_set_uevent_suppress(&intf->dev, old_suppress);
 792                 err = 0;
 793         }
 794         return err;
 795 }
 796
 797 static int checkintf(struct usb_dev_state *ps, unsigned int ifnum)
 798 {
 799         if (ps->dev->state != USB_STATE_CONFIGURED)
 800                 return -EHOSTUNREACH;
 801         if (ifnum >= 8*sizeof(ps->ifclaimed))
 802                 return -EINVAL;
 803         if (test_bit(ifnum, &ps->ifclaimed))
 804                 return 0;
 805         /* if not yet claimed, claim it for the driver */
 806         dev_warn(&ps->dev->dev, "usbfs: process %d (%s) did not claim "
 807                  "interface %u before use\n", task_pid_nr(current),
 808                  current->comm, ifnum);
 809         return claimintf(ps, ifnum);
 810 }
 811
 812 static int findintfep(struct usb_device *dev, unsigned int ep)
 813 {
 814         unsigned int i, j, e;
 815         struct usb_interface *intf;
 816         struct usb_host_interface *alts;
 817         struct usb_endpoint_descriptor *endpt;
 818
 819         if (ep & ~(USB_DIR_IN|0xf))
 820                 return -EINVAL;
 821         if (!dev->actconfig)
 822                 return -ESRCH;
 823         for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
 824                 intf = dev->actconfig->interface[i];
 825                 for (j = 0; j < intf->num_altsetting; j++) {
 826                         alts = &intf->altsetting[j];
 827                         for (e = 0; e < alts->desc.bNumEndpoints; e++) {
 828                                 endpt = &alts->endpoint[e].desc;
 829                                 if (endpt->bEndpointAddress == ep)
 830                                         return alts->desc.bInterfaceNumber;
 831                         }
 832                 }
 833         }
 834         return -ENOENT;
 835 }
 836
 837 static int check_ctrlrecip(struct usb_dev_state *ps, unsigned int requesttype,
 838                            unsigned int request, unsigned int index)
 839 {
 840         int ret = 0;
 841         struct usb_host_interface *alt_setting;
 842
 843         if (ps->dev->state != USB_STATE_UNAUTHENTICATED
 844          && ps->dev->state != USB_STATE_ADDRESS
 845          && ps->dev->state != USB_STATE_CONFIGURED)
 846                 return -EHOSTUNREACH;
 847         if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
 848                 return 0;
 849
 850         /*
 851          * check for the special corner case 'get_device_id' in the printer
 852          * class specification, which we always want to allow as it is used
 853          * to query things like ink level, etc.
 854          */
 855         if (requesttype == 0xa1 && request == 0) {
 856                 alt_setting = usb_find_alt_setting(ps->dev->actconfig,
 857                                                    index >> 8, index & 0xff);
 858                 if (alt_setting
 859                  && alt_setting->desc.bInterfaceClass == USB_CLASS_PRINTER)
 860                         return 0;
 861         }
 862
 863         index &= 0xff;
 864         switch (requesttype & USB_RECIP_MASK) {
 865         case USB_RECIP_ENDPOINT:
 866                 if ((index & ~USB_DIR_IN) == 0)
 867                         return 0;
 868                 ret = findintfep(ps->dev, index);
 869                 if (ret < 0) {
 870                         /*
 871                          * Some not fully compliant Win apps seem to get
 872                          * index wrong and have the endpoint number here
 873                          * rather than the endpoint address (with the
 874                          * correct direction). Win does let this through,
 875                          * so we'll not reject it here but leave it to
 876                          * the device to not break KVM. But we warn.
 877                          */
 878                         ret = findintfep(ps->dev, index ^ 0x80);
 879                         if (ret >= 0)
 880                                 dev_info(&ps->dev->dev,
 881                                         "%s: process %i (%s) requesting ep %02x but needs %02x\n",
 882                                         __func__, task_pid_nr(current),
 883                                         current->comm, index, index ^ 0x80);
 884                 }
 885                 if (ret >= 0)
 886                         ret = checkintf(ps, ret);
 887                 break;
 888
 889         case USB_RECIP_INTERFACE:
 890                 ret = checkintf(ps, index);
 891                 break;
 892         }
 893         return ret;
 894 }
 895
 896 static struct usb_host_endpoint *ep_to_host_endpoint(struct usb_device *dev,
 897                                                      unsigned char ep)
 898 {
 899         if (ep & USB_ENDPOINT_DIR_MASK)
 900                 return dev->ep_in[ep & USB_ENDPOINT_NUMBER_MASK];
 901         else
 902                 return dev->ep_out[ep & USB_ENDPOINT_NUMBER_MASK];
 903 }
 904
 905 static int parse_usbdevfs_streams(struct usb_dev_state *ps,
 906                                   struct usbdevfs_streams __user *streams,
 907                                   unsigned int *num_streams_ret,
 908                                   unsigned int *num_eps_ret,
 909                                   struct usb_host_endpoint ***eps_ret,
 910                                   struct usb_interface **intf_ret)
 911 {
 912         unsigned int i, num_streams, num_eps;
 913         struct usb_host_endpoint **eps;
 914         struct usb_interface *intf = NULL;
 915         unsigned char ep;
 916         int ifnum, ret;
 917
 918         if (get_user(num_streams, &streams->num_streams) ||
 919             get_user(num_eps, &streams->num_eps))
 920                 return -EFAULT;
 921
 922         if (num_eps < 1 || num_eps > USB_MAXENDPOINTS)
 923                 return -EINVAL;
 924
 925         /* The XHCI controller allows max 2 ^ 16 streams */
 926         if (num_streams_ret && (num_streams < 2 || num_streams > 65536))
 927                 return -EINVAL;
 928
 929         eps = kmalloc(num_eps * sizeof(*eps), GFP_KERNEL);
 930         if (!eps)
 931                 return -ENOMEM;
 932
 933         for (i = 0; i < num_eps; i++) {
 934                 if (get_user(ep, &streams->eps[i])) {
 935                         ret = -EFAULT;
 936                         goto error;
 937                 }
 938                 eps[i] = ep_to_host_endpoint(ps->dev, ep);
 939                 if (!eps[i]) {
 940                         ret = -EINVAL;
 941                         goto error;
 942                 }
 943
 944                 /* usb_alloc/free_streams operate on an usb_interface */
 945                 ifnum = findintfep(ps->dev, ep);
 946                 if (ifnum < 0) {
 947                         ret = ifnum;
 948                         goto error;
 949                 }
 950
 951                 if (i == 0) {
 952                         ret = checkintf(ps, ifnum);
 953                         if (ret < 0)
 954                                 goto error;
 955                         intf = usb_ifnum_to_if(ps->dev, ifnum);
 956                 } else {
 957                         /* Verify all eps belong to the same interface */
 958                         if (ifnum != intf->altsetting->desc.bInterfaceNumber) {
 959                                 ret = -EINVAL;
 960                                 goto error;
 961                         }
 962                 }
 963         }
 964
 965         if (num_streams_ret)
 966                 *num_streams_ret = num_streams;
 967         *num_eps_ret = num_eps;
 968         *eps_ret = eps;
 969         *intf_ret = intf;
 970
 971         return 0;
 972
 973 error:
 974         kfree(eps);
 975         return ret;
 976 }
 977
 978 static int match_devt(struct device *dev, void *data)
 979 {
 980         return dev->devt == (dev_t) (unsigned long) data;
 981 }
 982
 983 static struct usb_device *usbdev_lookup_by_devt(dev_t devt)
 984 {
 985         struct device *dev;
 986
 987         dev = bus_find_device(&usb_bus_type, NULL,
 988                               (void *) (unsigned long) devt, match_devt);
 989         if (!dev)
 990                 return NULL;
 991         return to_usb_device(dev);
 992 }
 993
 994 /*
 995  * file operations
 996  */
 997 static int usbdev_open(struct inode *inode, struct file *file)
 998 {
 999         struct usb_device *dev = NULL;
1000         struct usb_dev_state *ps;
1001         int ret;
1002
1003         ret = -ENOMEM;
1004         ps = kzalloc(sizeof(struct usb_dev_state), GFP_KERNEL);
1005         if (!ps)
1006                 goto out_free_ps;
1007
1008         ret = -ENODEV;
1009
1010         /* Protect against simultaneous removal or release */
1011         mutex_lock(&usbfs_mutex);
1012
1013         /* usbdev device-node */
1014         if (imajor(inode) == USB_DEVICE_MAJOR)
1015                 dev = usbdev_lookup_by_devt(inode->i_rdev);
1016
1017         mutex_unlock(&usbfs_mutex);
1018
1019         if (!dev)
1020                 goto out_free_ps;
1021
1022         usb_lock_device(dev);
1023         if (dev->state == USB_STATE_NOTATTACHED)
1024                 goto out_unlock_device;
1025
1026         ret = usb_autoresume_device(dev);
1027         if (ret)
1028                 goto out_unlock_device;
1029
1030         ps->dev = dev;
1031         ps->file = file;
1032         ps->interface_allowed_mask = 0xFFFFFFFF; /* 32 bits */
1033         spin_lock_init(&ps->lock);
1034         INIT_LIST_HEAD(&ps->list);
1035         INIT_LIST_HEAD(&ps->async_pending);
1036         INIT_LIST_HEAD(&ps->async_completed);
1037         INIT_LIST_HEAD(&ps->memory_list);
1038         init_waitqueue_head(&ps->wait);
1039         ps->disc_pid = get_pid(task_pid(current));
1040         ps->cred = get_current_cred();
1041         security_task_getsecid(current, &ps->secid);
1042         smp_wmb();
1043         list_add_tail(&ps->list, &dev->filelist);
1044         file->private_data = ps;
1045         usb_unlock_device(dev);
1046         snoop(&dev->dev, "opened by process %d: %s\n", task_pid_nr(current),
1047                         current->comm);
1048         return ret;
1049
1050  out_unlock_device:
1051         usb_unlock_device(dev);
1052         usb_put_dev(dev);
1053  out_free_ps:
1054         kfree(ps);
1055         return ret;
1056 }
1057
1058 static int usbdev_release(struct inode *inode, struct file *file)
1059 {
1060         struct usb_dev_state *ps = file->private_data;
1061         struct usb_device *dev = ps->dev;
1062         unsigned int ifnum;
1063         struct async *as;
1064
1065         usb_lock_device(dev);
1066         usb_hub_release_all_ports(dev, ps);
1067
1068         list_del_init(&ps->list);
1069
1070         for (ifnum = 0; ps->ifclaimed && ifnum < 8*sizeof(ps->ifclaimed);
1071                         ifnum++) {
1072                 if (test_bit(ifnum, &ps->ifclaimed))
1073                         releaseintf(ps, ifnum);
1074         }
1075         destroy_all_async(ps);
1076         usb_autosuspend_device(dev);
1077         usb_unlock_device(dev);
1078         usb_put_dev(dev);
1079         put_pid(ps->disc_pid);
1080         put_cred(ps->cred);
1081
1082         as = async_getcompleted(ps);
1083         while (as) {
1084                 free_async(as);
1085                 as = async_getcompleted(ps);
1086         }
1087
1088         kfree(ps);
1089         return 0;
1090 }
1091
1092 static int proc_control(struct usb_dev_state *ps, void __user *arg)
1093 {
1094         struct usb_device *dev = ps->dev;
1095         struct usbdevfs_ctrltransfer ctrl;
1096         unsigned int tmo;
1097         unsigned char *tbuf;
1098         unsigned wLength;
1099         int i, pipe, ret;
1100
1101         if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
1102                 return -EFAULT;
1103         ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.bRequest,
1104                               ctrl.wIndex);
1105         if (ret)
1106                 return ret;
1107         wLength = ctrl.wLength;         /* To suppress 64k PAGE_SIZE warning */
1108         if (wLength > PAGE_SIZE)
1109                 return -EINVAL;
1110         ret = usbfs_increase_memory_usage(PAGE_SIZE + sizeof(struct urb) +
1111                         sizeof(struct usb_ctrlrequest));
1112         if (ret)
1113                 return ret;
1114         tbuf = (unsigned char *)__get_free_page(GFP_KERNEL);
1115         if (!tbuf) {
1116                 ret = -ENOMEM;
1117                 goto done;
1118         }
1119         tmo = ctrl.timeout;
1120         snoop(&dev->dev, "control urb: bRequestType=%02x "
1121                 "bRequest=%02x wValue=%04x "
1122                 "wIndex=%04x wLength=%04x\n",
1123                 ctrl.bRequestType, ctrl.bRequest, ctrl.wValue,
1124                 ctrl.wIndex, ctrl.wLength);
1125         if (ctrl.bRequestType & 0x80) {
1126                 if (ctrl.wLength && !access_ok(VERIFY_WRITE, ctrl.data,
1127                                                ctrl.wLength)) {
1128                         ret = -EINVAL;
1129                         goto done;
1130                 }
1131                 pipe = usb_rcvctrlpipe(dev, 0);
1132                 snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT, NULL, 0);
1133
1134                 usb_unlock_device(dev);
1135                 i = usb_control_msg(dev, pipe, ctrl.bRequest,
1136                                     ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
1137                                     tbuf, ctrl.wLength, tmo);
1138                 usb_lock_device(dev);
1139                 snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE,
1140                           tbuf, max(i, 0));
1141                 if ((i > 0) && ctrl.wLength) {
1142                         if (copy_to_user(ctrl.data, tbuf, i)) {
1143                                 ret = -EFAULT;
1144                                 goto done;
1145                         }
1146                 }
1147         } else {
1148                 if (ctrl.wLength) {
1149                         if (copy_from_user(tbuf, ctrl.data, ctrl.wLength)) {
1150                                 ret = -EFAULT;
1151                                 goto done;
1152                         }
1153                 }
1154                 pipe = usb_sndctrlpipe(dev, 0);
1155                 snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT,
1156                         tbuf, ctrl.wLength);
1157
1158                 usb_unlock_device(dev);
1159                 i = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ctrl.bRequest,
1160                                     ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
1161                                     tbuf, ctrl.wLength, tmo);
1162                 usb_lock_device(dev);
1163                 snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE, NULL, 0);
1164         }
1165         if (i < 0 && i != -EPIPE) {
1166                 dev_printk(KERN_DEBUG, &dev->dev, "usbfs: USBDEVFS_CONTROL "
1167                            "failed cmd %s rqt %u rq %u len %u ret %d\n",
1168                            current->comm, ctrl.bRequestType, ctrl.bRequest,
1169                            ctrl.wLength, i);
1170         }
1171         ret = i;
1172  done:
1173         free_page((unsigned long) tbuf);
1174         usbfs_decrease_memory_usage(PAGE_SIZE + sizeof(struct urb) +
1175                         sizeof(struct usb_ctrlrequest));
1176         return ret;
1177 }
1178
1179 static int proc_bulk(struct usb_dev_state *ps, void __user *arg)
1180 {
1181         struct usb_device *dev = ps->dev;
1182         struct usbdevfs_bulktransfer bulk;
1183         unsigned int tmo, len1, pipe;
1184         int len2;
1185         unsigned char *tbuf;
1186         int i, ret;
1187
1188         if (copy_from_user(&bulk, arg, sizeof(bulk)))
1189                 return -EFAULT;
1190         ret = findintfep(ps->dev, bulk.ep);
1191         if (ret < 0)
1192                 return ret;
1193         ret = checkintf(ps, ret);
1194         if (ret)
1195                 return ret;
1196         if (bulk.ep & USB_DIR_IN)
1197                 pipe = usb_rcvbulkpipe(dev, bulk.ep & 0x7f);
1198         else
1199                 pipe = usb_sndbulkpipe(dev, bulk.ep & 0x7f);
1200         if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN)))
1201                 return -EINVAL;
1202         len1 = bulk.len;
1203         if (len1 >= (INT_MAX - sizeof(struct urb)))
1204                 return -EINVAL;
1205         ret = usbfs_increase_memory_usage(len1 + sizeof(struct urb));
1206         if (ret)
1207                 return ret;
1208         tbuf = kmalloc(len1, GFP_KERNEL);
1209         if (!tbuf) {
1210                 ret = -ENOMEM;
1211                 goto done;
1212         }
1213         tmo = bulk.timeout;
1214         if (bulk.ep & 0x80) {
1215                 if (len1 && !access_ok(VERIFY_WRITE, bulk.data, len1)) {
1216                         ret = -EINVAL;
1217                         goto done;
1218                 }
1219                 snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, NULL, 0);
1220
1221                 usb_unlock_device(dev);
1222                 i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
1223                 usb_lock_device(dev);
1224                 snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, tbuf, len2);
1225
1226                 if (!i && len2) {
1227                         if (copy_to_user(bulk.data, tbuf, len2)) {
1228                                 ret = -EFAULT;
1229                                 goto done;
1230                         }
1231                 }
1232         } else {
1233                 if (len1) {
1234                         if (copy_from_user(tbuf, bulk.data, len1)) {
1235                                 ret = -EFAULT;
1236                                 goto done;
1237                         }
1238                 }
1239                 snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, tbuf, len1);
1240
1241                 usb_unlock_device(dev);
1242                 i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
1243                 usb_lock_device(dev);
1244                 snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, NULL, 0);
1245         }
1246         ret = (i < 0 ? i : len2);
1247  done:
1248         kfree(tbuf);
1249         usbfs_decrease_memory_usage(len1 + sizeof(struct urb));
1250         return ret;
1251 }
1252
1253 static void check_reset_of_active_ep(struct usb_device *udev,
1254                 unsigned int epnum, char *ioctl_name)
1255 {
1256         struct usb_host_endpoint **eps;
1257         struct usb_host_endpoint *ep;
1258
1259         eps = (epnum & USB_DIR_IN) ? udev->ep_in : udev->ep_out;
1260         ep = eps[epnum & 0x0f];
1261         if (ep && !list_empty(&ep->urb_list))
1262                 dev_warn(&udev->dev, "Process %d (%s) called USBDEVFS_%s for active endpoint 0x%02x\n",
1263                                 task_pid_nr(current), current->comm,
1264                                 ioctl_name, epnum);
1265 }
1266
1267 static int proc_resetep(struct usb_dev_state *ps, void __user *arg)
1268 {
1269         unsigned int ep;
1270         int ret;
1271
1272         if (get_user(ep, (unsigned int __user *)arg))
1273                 return -EFAULT;
1274         ret = findintfep(ps->dev, ep);
1275         if (ret < 0)
1276                 return ret;
1277         ret = checkintf(ps, ret);
1278         if (ret)
1279                 return ret;
1280         check_reset_of_active_ep(ps->dev, ep, "RESETEP");
1281         usb_reset_endpoint(ps->dev, ep);
1282         return 0;
1283 }
1284
1285 static int proc_clearhalt(struct usb_dev_state *ps, void __user *arg)
1286 {
1287         unsigned int ep;
1288         int pipe;
1289         int ret;
1290
1291         if (get_user(ep, (unsigned int __user *)arg))
1292                 return -EFAULT;
1293         ret = findintfep(ps->dev, ep);
1294         if (ret < 0)
1295                 return ret;
1296         ret = checkintf(ps, ret);
1297         if (ret)
1298                 return ret;
1299         check_reset_of_active_ep(ps->dev, ep, "CLEAR_HALT");
1300         if (ep & USB_DIR_IN)
1301                 pipe = usb_rcvbulkpipe(ps->dev, ep & 0x7f);
1302         else
1303                 pipe = usb_sndbulkpipe(ps->dev, ep & 0x7f);
1304
1305         return usb_clear_halt(ps->dev, pipe);
1306 }
1307
1308 static int proc_getdriver(struct usb_dev_state *ps, void __user *arg)
1309 {
1310         struct usbdevfs_getdriver gd;
1311         struct usb_interface *intf;
1312         int ret;
1313
1314         if (copy_from_user(&gd, arg, sizeof(gd)))
1315                 return -EFAULT;
1316         intf = usb_ifnum_to_if(ps->dev, gd.interface);
1317         if (!intf || !intf->dev.driver)
1318                 ret = -ENODATA;
1319         else {
1320                 strlcpy(gd.driver, intf->dev.driver->name,
1321                                 sizeof(gd.driver));
1322                 ret = (copy_to_user(arg, &gd, sizeof(gd)) ? -EFAULT : 0);
1323         }
1324         return ret;
1325 }
1326
1327 static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg)
1328 {
1329         struct usbdevfs_connectinfo ci;
1330
1331         memset(&ci, 0, sizeof(ci));
1332         ci.devnum = ps->dev->devnum;
1333         ci.slow = ps->dev->speed == USB_SPEED_LOW;
1334
1335         if (copy_to_user(arg, &ci, sizeof(ci)))
1336                 return -EFAULT;
1337         return 0;
1338 }
1339
1340 static int proc_resetdevice(struct usb_dev_state *ps)
1341 {
1342         struct usb_host_config *actconfig = ps->dev->actconfig;
1343         struct usb_interface *interface;
1344         int i, number;
1345
1346         /* Don't allow a device reset if the process has dropped the
1347          * privilege to do such things and any of the interfaces are
1348          * currently claimed.
1349          */
1350         if (ps->privileges_dropped && actconfig) {
1351                 for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
1352                         interface = actconfig->interface[i];
1353                         number = interface->cur_altsetting->desc.bInterfaceNumber;
1354                         if (usb_interface_claimed(interface) &&
1355                                         !test_bit(number, &ps->ifclaimed)) {
1356                                 dev_warn(&ps->dev->dev,
1357                                         "usbfs: interface %d claimed by %s while '%s' resets device\n",
1358                                         number, interface->dev.driver->name, current->comm);
1359                                 return -EACCES;
1360                         }
1361                 }
1362         }
1363
1364         return usb_reset_device(ps->dev);
1365 }
1366
1367 static int proc_setintf(struct usb_dev_state *ps, void __user *arg)
1368 {
1369         struct usbdevfs_setinterface setintf;
1370         int ret;
1371
1372         if (copy_from_user(&setintf, arg, sizeof(setintf)))
1373                 return -EFAULT;
1374         ret = checkintf(ps, setintf.interface);
1375         if (ret)
1376                 return ret;
1377
1378         destroy_async_on_interface(ps, setintf.interface);
1379
1380         return usb_set_interface(ps->dev, setintf.interface,
1381                         setintf.altsetting);
1382 }
1383
1384 static int proc_setconfig(struct usb_dev_state *ps, void __user *arg)
1385 {
1386         int u;
1387         int status = 0;
1388         struct usb_host_config *actconfig;
1389
1390         if (get_user(u, (int __user *)arg))
1391                 return -EFAULT;
1392
1393         actconfig = ps->dev->actconfig;
1394
1395         /* Don't touch the device if any interfaces are claimed.
1396          * It could interfere with other drivers' operations, and if
1397          * an interface is claimed by usbfs it could easily deadlock.
1398          */
1399         if (actconfig) {
1400                 int i;
1401
1402                 for (i = 0; i < actconfig->desc.bNumInterfaces; ++i) {
1403                         if (usb_interface_claimed(actconfig->interface[i])) {
1404                                 dev_warn(&ps->dev->dev,
1405                                         "usbfs: interface %d claimed by %s "
1406                                         "while '%s' sets config #%d\n",
1407                                         actconfig->interface[i]
1408                                                 ->cur_altsetting
1409                                                 ->desc.bInterfaceNumber,
1410                                         actconfig->interface[i]
1411                                                 ->dev.driver->name,
1412                                         current->comm, u);
1413                                 status = -EBUSY;
1414                                 break;
1415                         }
1416                 }
1417         }
1418
1419         /* SET_CONFIGURATION is often abused as a "cheap" driver reset,
1420          * so avoid usb_set_configuration()'s kick to sysfs
1421          */
1422         if (status == 0) {
1423                 if (actconfig && actconfig->desc.bConfigurationValue == u)
1424                         status = usb_reset_configuration(ps->dev);
1425                 else
1426                         status = usb_set_configuration(ps->dev, u);
1427         }
1428
1429         return status;
1430 }
1431
1432 static struct usb_memory *
1433 find_memory_area(struct usb_dev_state *ps, const struct usbdevfs_urb *uurb)
1434 {
1435         struct usb_memory *usbm = NULL, *iter;
1436         unsigned long flags;
1437         unsigned long uurb_start = (unsigned long)uurb->buffer;
1438
1439         spin_lock_irqsave(&ps->lock, flags);
1440         list_for_each_entry(iter, &ps->memory_list, memlist) {
1441                 if (uurb_start >= iter->vm_start &&
1442                                 uurb_start < iter->vm_start + iter->size) {
1443                         if (uurb->buffer_length > iter->vm_start + iter->size -
1444                                         uurb_start) {
1445                                 usbm = ERR_PTR(-EINVAL);
1446                         } else {
1447                                 usbm = iter;
1448                                 usbm->urb_use_count++;
1449                         }
1450                         break;
1451                 }
1452         }
1453         spin_unlock_irqrestore(&ps->lock, flags);
1454         return usbm;
1455 }
1456
1457 static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb,
1458                         struct usbdevfs_iso_packet_desc __user *iso_frame_desc,
1459                         void __user *arg)
1460 {
1461         struct usbdevfs_iso_packet_desc *isopkt = NULL;
1462         struct usb_host_endpoint *ep;
1463         struct async *as = NULL;
1464         struct usb_ctrlrequest *dr = NULL;
1465         unsigned int u, totlen, isofrmlen;
1466         int i, ret, num_sgs = 0, ifnum = -1;
1467         int number_of_packets = 0;
1468         unsigned int stream_id = 0;
1469         void *buf;
1470         bool is_in;
1471         bool allow_short = false;
1472         bool allow_zero = false;
1473         unsigned long mask =    USBDEVFS_URB_SHORT_NOT_OK |
1474                                 USBDEVFS_URB_BULK_CONTINUATION |
1475                                 USBDEVFS_URB_NO_FSBR |
1476                                 USBDEVFS_URB_ZERO_PACKET |
1477                                 USBDEVFS_URB_NO_INTERRUPT;
1478         /* USBDEVFS_URB_ISO_ASAP is a special case */
1479         if (uurb->type == USBDEVFS_URB_TYPE_ISO)
1480                 mask |= USBDEVFS_URB_ISO_ASAP;
1481
1482         if (uurb->flags & ~mask)
1483                         return -EINVAL;
1484
1485         if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
1486                 return -EINVAL;
1487         if (uurb->buffer_length > 0 && !uurb->buffer)
1488                 return -EINVAL;
1489         if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
1490             (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
1491                 ifnum = findintfep(ps->dev, uurb->endpoint);
1492                 if (ifnum < 0)
1493                         return ifnum;
1494                 ret = checkintf(ps, ifnum);
1495                 if (ret)
1496                         return ret;
1497         }
1498         ep = ep_to_host_endpoint(ps->dev, uurb->endpoint);
1499         if (!ep)
1500                 return -ENOENT;
1501         is_in = (uurb->endpoint & USB_ENDPOINT_DIR_MASK) != 0;
1502
1503         u = 0;
1504         switch (uurb->type) {
1505         case USBDEVFS_URB_TYPE_CONTROL:
1506                 if (!usb_endpoint_xfer_control(&ep->desc))
1507                         return -EINVAL;
1508                 /* min 8 byte setup packet */
1509                 if (uurb->buffer_length < 8)
1510                         return -EINVAL;
1511                 dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
1512                 if (!dr)
1513                         return -ENOMEM;
1514                 if (copy_from_user(dr, uurb->buffer, 8)) {
1515                         ret = -EFAULT;
1516                         goto error;
1517                 }
1518                 if (uurb->buffer_length < (le16_to_cpup(&dr->wLength) + 8)) {
1519                         ret = -EINVAL;
1520                         goto error;
1521                 }
1522                 ret = check_ctrlrecip(ps, dr->bRequestType, dr->bRequest,
1523                                       le16_to_cpup(&dr->wIndex));
1524                 if (ret)
1525                         goto error;
1526                 uurb->buffer_length = le16_to_cpup(&dr->wLength);
1527                 uurb->buffer += 8;
1528                 if ((dr->bRequestType & USB_DIR_IN) && uurb->buffer_length) {
1529                         is_in = 1;
1530                         uurb->endpoint |= USB_DIR_IN;
1531                 } else {
1532                         is_in = 0;
1533                         uurb->endpoint &= ~USB_DIR_IN;
1534                 }
1535                 if (is_in)
1536                         allow_short = true;
1537                 snoop(&ps->dev->dev, "control urb: bRequestType=%02x "
1538                         "bRequest=%02x wValue=%04x "
1539                         "wIndex=%04x wLength=%04x\n",
1540                         dr->bRequestType, dr->bRequest,
1541                         __le16_to_cpup(&dr->wValue),
1542                         __le16_to_cpup(&dr->wIndex),
1543                         __le16_to_cpup(&dr->wLength));
1544                 u = sizeof(struct usb_ctrlrequest);
1545                 break;
1546
1547         case USBDEVFS_URB_TYPE_BULK:
1548                 if (!is_in)
1549                         allow_zero = true;
1550                 else
1551                         allow_short = true;
1552                 switch (usb_endpoint_type(&ep->desc)) {
1553                 case USB_ENDPOINT_XFER_CONTROL:
1554                 case USB_ENDPOINT_XFER_ISOC:
1555                         return -EINVAL;
1556                 case USB_ENDPOINT_XFER_INT:
1557                         /* allow single-shot interrupt transfers */
1558                         uurb->type = USBDEVFS_URB_TYPE_INTERRUPT;
1559                         goto interrupt_urb;
1560                 }
1561                 num_sgs = DIV_ROUND_UP(uurb->buffer_length, USB_SG_SIZE);
1562                 if (num_sgs == 1 || num_sgs > ps->dev->bus->sg_tablesize)
1563                         num_sgs = 0;
1564                 if (ep->streams)
1565                         stream_id = uurb->stream_id;
1566                 break;
1567
1568         case USBDEVFS_URB_TYPE_INTERRUPT:
1569                 if (!usb_endpoint_xfer_int(&ep->desc))
1570                         return -EINVAL;
1571  interrupt_urb:
1572                 if (!is_in)
1573                         allow_zero = true;
1574                 else
1575                         allow_short = true;
1576                 break;
1577
1578         case USBDEVFS_URB_TYPE_ISO:
1579                 /* arbitrary limit */
1580                 if (uurb->number_of_packets < 1 ||
1581                     uurb->number_of_packets > 128)
1582                         return -EINVAL;
1583                 if (!usb_endpoint_xfer_isoc(&ep->desc))
1584                         return -EINVAL;
1585                 number_of_packets = uurb->number_of_packets;
1586                 isofrmlen = sizeof(struct usbdevfs_iso_packet_desc) *
1587                                    number_of_packets;
1588                 isopkt = memdup_user(iso_frame_desc, isofrmlen);
1589                 if (IS_ERR(isopkt)) {
1590                         ret = PTR_ERR(isopkt);
1591                         isopkt = NULL;
1592                         goto error;
1593                 }
1594                 for (totlen = u = 0; u < number_of_packets; u++) {
1595                         /*
1596                          * arbitrary limit need for USB 3.0
1597                          * bMaxBurst (0~15 allowed, 1~16 packets)
1598                          * bmAttributes (bit 1:0, mult 0~2, 1~3 packets)
1599                          * sizemax: 1024 * 16 * 3 = 49152
1600                          */
1601                         if (isopkt[u].length > 49152) {
1602                                 ret = -EINVAL;
1603                                 goto error;
1604                         }
1605                         totlen += isopkt[u].length;
1606                 }
1607                 u *= sizeof(struct usb_iso_packet_descriptor);
1608                 uurb->buffer_length = totlen;
1609                 break;
1610
1611         default:
1612                 return -EINVAL;
1613         }
1614
1615         if (uurb->buffer_length > 0 &&
1616                         !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
1617                                 uurb->buffer, uurb->buffer_length)) {
1618                 ret = -EFAULT;
1619                 goto error;
1620         }
1621         as = alloc_async(number_of_packets);
1622         if (!as) {
1623                 ret = -ENOMEM;
1624                 goto error;
1625         }
1626
1627         as->usbm = find_memory_area(ps, uurb);
1628         if (IS_ERR(as->usbm)) {
1629                 ret = PTR_ERR(as->usbm);
1630                 as->usbm = NULL;
1631                 goto error;
1632         }
1633
1634         /* do not use SG buffers when memory mapped segments
1635          * are in use
1636          */
1637         if (as->usbm)
1638                 num_sgs = 0;
1639
1640         u += sizeof(struct async) + sizeof(struct urb) + uurb->buffer_length +
1641              num_sgs * sizeof(struct scatterlist);
1642         ret = usbfs_increase_memory_usage(u);
1643         if (ret)
1644                 goto error;
1645         as->mem_usage = u;
1646
1647         if (num_sgs) {
1648                 as->urb->sg = kmalloc(num_sgs * sizeof(struct scatterlist),
1649                                       GFP_KERNEL);
1650                 if (!as->urb->sg) {
1651                         ret = -ENOMEM;
1652                         goto error;
1653                 }
1654                 as->urb->num_sgs = num_sgs;
1655                 sg_init_table(as->urb->sg, as->urb->num_sgs);
1656
1657                 totlen = uurb->buffer_length;
1658                 for (i = 0; i < as->urb->num_sgs; i++) {
1659                         u = (totlen > USB_SG_SIZE) ? USB_SG_SIZE : totlen;
1660                         buf = kmalloc(u, GFP_KERNEL);
1661                         if (!buf) {
1662                                 ret = -ENOMEM;
1663                                 goto error;
1664                         }
1665                         sg_set_buf(&as->urb->sg[i], buf, u);
1666
1667                         if (!is_in) {
1668                                 if (copy_from_user(buf, uurb->buffer, u)) {
1669                                         ret = -EFAULT;
1670                                         goto error;
1671                                 }
1672                                 uurb->buffer += u;
1673                         }
1674                         totlen -= u;
1675                 }
1676         } else if (uurb->buffer_length > 0) {
1677                 if (as->usbm) {
1678                         unsigned long uurb_start = (unsigned long)uurb->buffer;
1679
1680                         as->urb->transfer_buffer = as->usbm->mem +
1681                                         (uurb_start - as->usbm->vm_start);
1682                 } else {
1683                         as->urb->transfer_buffer = kmalloc(uurb->buffer_length,
1684                                         GFP_KERNEL);
1685                         if (!as->urb->transfer_buffer) {
1686                                 ret = -ENOMEM;
1687                                 goto error;
1688                         }
1689                         if (!is_in) {
1690                                 if (copy_from_user(as->urb->transfer_buffer,
1691                                                    uurb->buffer,
1692                                                    uurb->buffer_length)) {
1693                                         ret = -EFAULT;
1694                                         goto error;
1695                                 }
1696                         } else if (uurb->type == USBDEVFS_URB_TYPE_ISO) {
1697                                 /*
1698                                  * Isochronous input data may end up being
1699                                  * discontiguous if some of the packets are
1700                                  * short. Clear the buffer so that the gaps
1701                                  * don't leak kernel data to userspace.
1702                                  */
1703                                 memset(as->urb->transfer_buffer, 0,
1704                                                 uurb->buffer_length);
1705                         }
1706                 }
1707         }
1708         as->urb->dev = ps->dev;
1709         as->urb->pipe = (uurb->type << 30) |
1710                         __create_pipe(ps->dev, uurb->endpoint & 0xf) |
1711                         (uurb->endpoint & USB_DIR_IN);
1712
1713         /* This tedious sequence is necessary because the URB_* flags
1714          * are internal to the kernel and subject to change, whereas
1715          * the USBDEVFS_URB_* flags are a user API and must not be changed.
1716          */
1717         u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
1718         if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
1719                 u |= URB_ISO_ASAP;
1720         if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
1721                 u |= URB_SHORT_NOT_OK;
1722         if (uurb->flags & USBDEVFS_URB_NO_FSBR)
1723                 u |= URB_NO_FSBR;
1724         if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
1725                 u |= URB_ZERO_PACKET;
1726         if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
1727                 u |= URB_NO_INTERRUPT;
1728         as->urb->transfer_flags = u;
1729
1730         if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
1731                 dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n");
1732         if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
1733                 dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n");
1734
1735         as->urb->transfer_buffer_length = uurb->buffer_length;
1736         as->urb->setup_packet = (unsigned char *)dr;
1737         dr = NULL;
1738         as->urb->start_frame = uurb->start_frame;
1739         as->urb->number_of_packets = number_of_packets;
1740         as->urb->stream_id = stream_id;
1741
1742         if (ep->desc.bInterval) {
1743                 if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
1744                                 ps->dev->speed == USB_SPEED_HIGH ||
1745                                 ps->dev->speed >= USB_SPEED_SUPER)
1746                         as->urb->interval = 1 <<
1747                                         min(15, ep->desc.bInterval - 1);
1748                 else
1749                         as->urb->interval = ep->desc.bInterval;
1750         }
1751
1752         as->urb->context = as;
1753         as->urb->complete = async_completed;
1754         for (totlen = u = 0; u < number_of_packets; u++) {
1755                 as->urb->iso_frame_desc[u].offset = totlen;
1756                 as->urb->iso_frame_desc[u].length = isopkt[u].length;
1757                 totlen += isopkt[u].length;
1758         }
1759         kfree(isopkt);
1760         isopkt = NULL;
1761         as->ps = ps;
1762         as->userurb = arg;
1763         if (as->usbm) {
1764                 unsigned long uurb_start = (unsigned long)uurb->buffer;
1765
1766                 as->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1767                 as->urb->transfer_dma = as->usbm->dma_handle +
1768                                 (uurb_start - as->usbm->vm_start);
1769         } else if (is_in && uurb->buffer_length > 0)
1770                 as->userbuffer = uurb->buffer;
1771         as->signr = uurb->signr;
1772         as->ifnum = ifnum;
1773         as->pid = get_pid(task_pid(current));
1774         as->cred = get_current_cred();
1775         security_task_getsecid(current, &as->secid);
1776         snoop_urb(ps->dev, as->userurb, as->urb->pipe,
1777                         as->urb->transfer_buffer_length, 0, SUBMIT,
1778                         NULL, 0);
1779         if (!is_in)
1780                 snoop_urb_data(as->urb, as->urb->transfer_buffer_length);
1781
1782         async_newpending(as);
1783
1784         if (usb_endpoint_xfer_bulk(&ep->desc)) {
1785                 spin_lock_irq(&ps->lock);
1786
1787                 /* Not exactly the endpoint address; the direction bit is
1788                  * shifted to the 0x10 position so that the value will be
1789                  * between 0 and 31.
1790                  */
1791                 as->bulk_addr = usb_endpoint_num(&ep->desc) |
1792                         ((ep->desc.bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1793                                 >> 3);
1794
1795                 /* If this bulk URB is the start of a new transfer, re-enable
1796                  * the endpoint.  Otherwise mark it as a continuation URB.
1797                  */
1798                 if (uurb->flags & USBDEVFS_URB_BULK_CONTINUATION)
1799                         as->bulk_status = AS_CONTINUATION;
1800                 else
1801                         ps->disabled_bulk_eps &= ~(1 << as->bulk_addr);
1802
1803                 /* Don't accept continuation URBs if the endpoint is
1804                  * disabled because of an earlier error.
1805                  */
1806                 if (ps->disabled_bulk_eps & (1 << as->bulk_addr))
1807                         ret = -EREMOTEIO;
1808                 else
1809                         ret = usb_submit_urb(as->urb, GFP_ATOMIC);
1810                 spin_unlock_irq(&ps->lock);
1811         } else {
1812                 ret = usb_submit_urb(as->urb, GFP_KERNEL);
1813         }
1814
1815         if (ret) {
1816                 dev_printk(KERN_DEBUG, &ps->dev->dev,
1817                            "usbfs: usb_submit_urb returned %d\n", ret);
1818                 snoop_urb(ps->dev, as->userurb, as->urb->pipe,
1819                                 0, ret, COMPLETE, NULL, 0);
1820                 async_removepending(as);
1821                 goto error;
1822         }
1823         return 0;
1824
1825  error:
1826         kfree(isopkt);
1827         kfree(dr);
1828         if (as)
1829                 free_async(as);
1830         return ret;
1831 }
1832
1833 static int proc_submiturb(struct usb_dev_state *ps, void __user *arg)
1834 {
1835         struct usbdevfs_urb uurb;
1836
1837         if (copy_from_user(&uurb, arg, sizeof(uurb)))
1838                 return -EFAULT;
1839
1840         return proc_do_submiturb(ps, &uurb,
1841                         (((struct usbdevfs_urb __user *)arg)->iso_frame_desc),
1842                         arg);
1843 }
1844
1845 static int proc_unlinkurb(struct usb_dev_state *ps, void __user *arg)
1846 {
1847         struct urb *urb;
1848         struct async *as;
1849         unsigned long flags;
1850
1851         spin_lock_irqsave(&ps->lock, flags);
1852         as = async_getpending(ps, arg);
1853         if (!as) {
1854                 spin_unlock_irqrestore(&ps->lock, flags);
1855                 return -EINVAL;
1856         }
1857
1858         urb = as->urb;
1859         usb_get_urb(urb);
1860         spin_unlock_irqrestore(&ps->lock, flags);
1861
1862         usb_kill_urb(urb);
1863         usb_put_urb(urb);
1864
1865         return 0;
1866 }
1867
1868 static void compute_isochronous_actual_length(struct urb *urb)
1869 {
1870         unsigned int i;
1871
1872         if (urb->number_of_packets > 0) {
1873                 urb->actual_length = 0;
1874                 for (i = 0; i < urb->number_of_packets; i++)
1875                         urb->actual_length +=
1876                                         urb->iso_frame_desc[i].actual_length;
1877         }
1878 }
1879
1880 static int processcompl(struct async *as, void __user * __user *arg)
1881 {
1882         struct urb *urb = as->urb;
1883         struct usbdevfs_urb __user *userurb = as->userurb;
1884         void __user *addr = as->userurb;
1885         unsigned int i;
1886
1887         compute_isochronous_actual_length(urb);
1888         if (as->userbuffer && urb->actual_length) {
1889                 if (copy_urb_data_to_user(as->userbuffer, urb))
1890                         goto err_out;
1891         }
1892         if (put_user(as->status, &userurb->status))
1893                 goto err_out;
1894         if (put_user(urb->actual_length, &userurb->actual_length))
1895                 goto err_out;
1896         if (put_user(urb->error_count, &userurb->error_count))
1897                 goto err_out;
1898
1899         if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
1900                 for (i = 0; i < urb->number_of_packets; i++) {
1901                         if (put_user(urb->iso_frame_desc[i].actual_length,
1902                                      &userurb->iso_frame_desc[i].actual_length))
1903                                 goto err_out;
1904                         if (put_user(urb->iso_frame_desc[i].status,
1905                                      &userurb->iso_frame_desc[i].status))
1906                                 goto err_out;
1907                 }
1908         }
1909
1910         if (put_user(addr, (void __user * __user *)arg))
1911                 return -EFAULT;
1912         return 0;
1913
1914 err_out:
1915         return -EFAULT;
1916 }
1917
1918 static struct async *reap_as(struct usb_dev_state *ps)
1919 {
1920         DECLARE_WAITQUEUE(wait, current);
1921         struct async *as = NULL;
1922         struct usb_device *dev = ps->dev;
1923
1924         add_wait_queue(&ps->wait, &wait);
1925         for (;;) {
1926                 __set_current_state(TASK_INTERRUPTIBLE);
1927                 as = async_getcompleted(ps);
1928                 if (as || !connected(ps))
1929                         break;
1930                 if (signal_pending(current))
1931                         break;
1932                 usb_unlock_device(dev);
1933                 schedule();
1934                 usb_lock_device(dev);
1935         }
1936         remove_wait_queue(&ps->wait, &wait);
1937         set_current_state(TASK_RUNNING);
1938         return as;
1939 }
1940
1941 static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
1942 {
1943         struct async *as = reap_as(ps);
1944
1945         if (as) {
1946                 int retval;
1947
1948                 snoop(&ps->dev->dev, "reap %px\n", as->userurb);
1949                 retval = processcompl(as, (void __user * __user *)arg);
1950                 free_async(as);
1951                 return retval;
1952         }
1953         if (signal_pending(current))
1954                 return -EINTR;
1955         return -ENODEV;
1956 }
1957
1958 static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
1959 {
1960         int retval;
1961         struct async *as;
1962
1963         as = async_getcompleted(ps);
1964         if (as) {
1965                 snoop(&ps->dev->dev, "reap %px\n", as->userurb);
1966                 retval = processcompl(as, (void __user * __user *)arg);
1967                 free_async(as);
1968         } else {
1969                 retval = (connected(ps) ? -EAGAIN : -ENODEV);
1970         }
1971         return retval;
1972 }
1973
1974 #ifdef CONFIG_COMPAT
1975 static int proc_control_compat(struct usb_dev_state *ps,
1976                                 struct usbdevfs_ctrltransfer32 __user *p32)
1977 {
1978         struct usbdevfs_ctrltransfer __user *p;
1979         __u32 udata;
1980         p = compat_alloc_user_space(sizeof(*p));
1981         if (copy_in_user(p, p32, (sizeof(*p32) - sizeof(compat_caddr_t))) ||
1982             get_user(udata, &p32->data) ||
1983             put_user(compat_ptr(udata), &p->data))
1984                 return -EFAULT;
1985         return proc_control(ps, p);
1986 }
1987
1988 static int proc_bulk_compat(struct usb_dev_state *ps,
1989                         struct usbdevfs_bulktransfer32 __user *p32)
1990 {
1991         struct usbdevfs_bulktransfer __user *p;
1992         compat_uint_t n;
1993         compat_caddr_t addr;
1994
1995         p = compat_alloc_user_space(sizeof(*p));
1996
1997         if (get_user(n, &p32->ep) || put_user(n, &p->ep) ||
1998             get_user(n, &p32->len) || put_user(n, &p->len) ||
1999             get_user(n, &p32->timeout) || put_user(n, &p->timeout) ||
2000             get_user(addr, &p32->data) || put_user(compat_ptr(addr), &p->data))
2001                 return -EFAULT;
2002
2003         return proc_bulk(ps, p);
2004 }
2005 static int proc_disconnectsignal_compat(struct usb_dev_state *ps, void __user *arg)
2006 {
2007         struct usbdevfs_disconnectsignal32 ds;
2008
2009         if (copy_from_user(&ds, arg, sizeof(ds)))
2010                 return -EFAULT;
2011         ps->discsignr = ds.signr;
2012         ps->disccontext = compat_ptr(ds.context);
2013         return 0;
2014 }
2015
2016 static int get_urb32(struct usbdevfs_urb *kurb,
2017                      struct usbdevfs_urb32 __user *uurb)
2018 {
2019         __u32  uptr;
2020         if (!access_ok(VERIFY_READ, uurb, sizeof(*uurb)) ||
2021             __get_user(kurb->type, &uurb->type) ||
2022             __get_user(kurb->endpoint, &uurb->endpoint) ||
2023             __get_user(kurb->status, &uurb->status) ||
2024             __get_user(kurb->flags, &uurb->flags) ||
2025             __get_user(kurb->buffer_length, &uurb->buffer_length) ||
2026             __get_user(kurb->actual_length, &uurb->actual_length) ||
2027             __get_user(kurb->start_frame, &uurb->start_frame) ||
2028             __get_user(kurb->number_of_packets, &uurb->number_of_packets) ||
2029             __get_user(kurb->error_count, &uurb->error_count) ||
2030             __get_user(kurb->signr, &uurb->signr))
2031                 return -EFAULT;
2032
2033         if (__get_user(uptr, &uurb->buffer))
2034                 return -EFAULT;
2035         kurb->buffer = compat_ptr(uptr);
2036         if (__get_user(uptr, &uurb->usercontext))
2037                 return -EFAULT;
2038         kurb->usercontext = compat_ptr(uptr);
2039
2040         return 0;
2041 }
2042
2043 static int proc_submiturb_compat(struct usb_dev_state *ps, void __user *arg)
2044 {
2045         struct usbdevfs_urb uurb;
2046
2047         if (get_urb32(&uurb, (struct usbdevfs_urb32 __user *)arg))
2048                 return -EFAULT;
2049
2050         return proc_do_submiturb(ps, &uurb,
2051                         ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc,
2052                         arg);
2053 }
2054
2055 static int processcompl_compat(struct async *as, void __user * __user *arg)
2056 {
2057         struct urb *urb = as->urb;
2058         struct usbdevfs_urb32 __user *userurb = as->userurb;
2059         void __user *addr = as->userurb;
2060         unsigned int i;
2061
2062         compute_isochronous_actual_length(urb);
2063         if (as->userbuffer && urb->actual_length) {
2064                 if (copy_urb_data_to_user(as->userbuffer, urb))
2065                         return -EFAULT;
2066         }
2067         if (put_user(as->status, &userurb->status))
2068                 return -EFAULT;
2069         if (put_user(urb->actual_length, &userurb->actual_length))
2070                 return -EFAULT;
2071         if (put_user(urb->error_count, &userurb->error_count))
2072                 return -EFAULT;
2073
2074         if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
2075                 for (i = 0; i < urb->number_of_packets; i++) {
2076                         if (put_user(urb->iso_frame_desc[i].actual_length,
2077                                      &userurb->iso_frame_desc[i].actual_length))
2078                                 return -EFAULT;
2079                         if (put_user(urb->iso_frame_desc[i].status,
2080                                      &userurb->iso_frame_desc[i].status))
2081                                 return -EFAULT;
2082                 }
2083         }
2084
2085         if (put_user(ptr_to_compat(addr), (u32 __user *)arg))
2086                 return -EFAULT;
2087         return 0;
2088 }
2089
2090 static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
2091 {
2092         struct async *as = reap_as(ps);
2093
2094         if (as) {
2095                 int retval;
2096
2097                 snoop(&ps->dev->dev, "reap %px\n", as->userurb);
2098                 retval = processcompl_compat(as, (void __user * __user *)arg);
2099                 free_async(as);
2100                 return retval;
2101         }
2102         if (signal_pending(current))
2103                 return -EINTR;
2104         return -ENODEV;
2105 }
2106
2107 static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *arg)
2108 {
2109         int retval;
2110         struct async *as;
2111
2112         as = async_getcompleted(ps);
2113         if (as) {
2114                 snoop(&ps->dev->dev, "reap %px\n", as->userurb);
2115                 retval = processcompl_compat(as, (void __user * __user *)arg);
2116                 free_async(as);
2117         } else {
2118                 retval = (connected(ps) ? -EAGAIN : -ENODEV);
2119         }
2120         return retval;
2121 }
2122
2123
2124 #endif
2125
2126 static int proc_disconnectsignal(struct usb_dev_state *ps, void __user *arg)
2127 {
2128         struct usbdevfs_disconnectsignal ds;
2129
2130         if (copy_from_user(&ds, arg, sizeof(ds)))
2131                 return -EFAULT;
2132         ps->discsignr = ds.signr;
2133         ps->disccontext = ds.context;
2134         return 0;
2135 }
2136
2137 static int proc_claiminterface(struct usb_dev_state *ps, void __user *arg)
2138 {
2139         unsigned int ifnum;
2140
2141         if (get_user(ifnum, (unsigned int __user *)arg))
2142                 return -EFAULT;
2143         return claimintf(ps, ifnum);
2144 }
2145
2146 static int proc_releaseinterface(struct usb_dev_state *ps, void __user *arg)
2147 {
2148         unsigned int ifnum;
2149         int ret;
2150
2151         if (get_user(ifnum, (unsigned int __user *)arg))
2152                 return -EFAULT;
2153         ret = releaseintf(ps, ifnum);
2154         if (ret < 0)
2155                 return ret;
2156         destroy_async_on_interface(ps, ifnum);
2157         return 0;
2158 }
2159
2160 static int proc_ioctl(struct usb_dev_state *ps, struct usbdevfs_ioctl *ctl)
2161 {
2162         int                     size;
2163         void                    *buf = NULL;
2164         int                     retval = 0;
2165         struct usb_interface    *intf = NULL;
2166         struct usb_driver       *driver = NULL;
2167
2168         if (ps->privileges_dropped)
2169                 return -EACCES;
2170
2171         /* alloc buffer */
2172         size = _IOC_SIZE(ctl->ioctl_code);
2173         if (size > 0) {
2174                 buf = kmalloc(size, GFP_KERNEL);
2175                 if (buf == NULL)
2176                         return -ENOMEM;
2177                 if ((_IOC_DIR(ctl->ioctl_code) & _IOC_WRITE)) {
2178                         if (copy_from_user(buf, ctl->data, size)) {
2179                                 kfree(buf);
2180                                 return -EFAULT;
2181                         }
2182                 } else {
2183                         memset(buf, 0, size);
2184                 }
2185         }
2186
2187         if (!connected(ps)) {
2188                 kfree(buf);
2189                 return -ENODEV;
2190         }
2191
2192         if (ps->dev->state != USB_STATE_CONFIGURED)
2193                 retval = -EHOSTUNREACH;
2194         else if (!(intf = usb_ifnum_to_if(ps->dev, ctl->ifno)))
2195                 retval = -EINVAL;
2196         else switch (ctl->ioctl_code) {
2197
2198         /* disconnect kernel driver from interface */
2199         case USBDEVFS_DISCONNECT:
2200                 if (intf->dev.driver) {
2201                         driver = to_usb_driver(intf->dev.driver);
2202                         dev_dbg(&intf->dev, "disconnect by usbfs\n");
2203                         usb_driver_release_interface(driver, intf);
2204                 } else
2205                         retval = -ENODATA;
2206                 break;
2207
2208         /* let kernel drivers try to (re)bind to the interface */
2209         case USBDEVFS_CONNECT:
2210                 if (!intf->dev.driver)
2211                         retval = device_attach(&intf->dev);
2212                 else
2213                         retval = -EBUSY;
2214                 break;
2215
2216         /* talk directly to the interface's driver */
2217         default:
2218                 if (intf->dev.driver)
2219                         driver = to_usb_driver(intf->dev.driver);
2220                 if (driver == NULL || driver->unlocked_ioctl == NULL) {
2221                         retval = -ENOTTY;
2222                 } else {
2223                         retval = driver->unlocked_ioctl(intf, ctl->ioctl_code, buf);
2224                         if (retval == -ENOIOCTLCMD)
2225                                 retval = -ENOTTY;
2226                 }
2227         }
2228
2229         /* cleanup and return */
2230         if (retval >= 0
2231                         && (_IOC_DIR(ctl->ioctl_code) & _IOC_READ) != 0
2232                         && size > 0
2233                         && copy_to_user(ctl->data, buf, size) != 0)
2234                 retval = -EFAULT;
2235
2236         kfree(buf);
2237         return retval;
2238 }
2239
2240 static int proc_ioctl_default(struct usb_dev_state *ps, void __user *arg)
2241 {
2242         struct usbdevfs_ioctl   ctrl;
2243
2244         if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
2245                 return -EFAULT;
2246         return proc_ioctl(ps, &ctrl);
2247 }
2248
2249 #ifdef CONFIG_COMPAT
2250 static int proc_ioctl_compat(struct usb_dev_state *ps, compat_uptr_t arg)
2251 {
2252         struct usbdevfs_ioctl32 __user *uioc;
2253         struct usbdevfs_ioctl ctrl;
2254         u32 udata;
2255
2256         uioc = compat_ptr((long)arg);
2257         if (!access_ok(VERIFY_READ, uioc, sizeof(*uioc)) ||
2258             __get_user(ctrl.ifno, &uioc->ifno) ||
2259             __get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
2260             __get_user(udata, &uioc->data))
2261                 return -EFAULT;
2262         ctrl.data = compat_ptr(udata);
2263
2264         return proc_ioctl(ps, &ctrl);
2265 }
2266 #endif
2267
2268 static int proc_claim_port(struct usb_dev_state *ps, void __user *arg)
2269 {
2270         unsigned portnum;
2271         int rc;
2272
2273         if (get_user(portnum, (unsigned __user *) arg))
2274                 return -EFAULT;
2275         rc = usb_hub_claim_port(ps->dev, portnum, ps);
2276         if (rc == 0)
2277                 snoop(&ps->dev->dev, "port %d claimed by process %d: %s\n",
2278                         portnum, task_pid_nr(current), current->comm);
2279         return rc;
2280 }
2281
2282 static int proc_release_port(struct usb_dev_state *ps, void __user *arg)
2283 {
2284         unsigned portnum;
2285
2286         if (get_user(portnum, (unsigned __user *) arg))
2287                 return -EFAULT;
2288         return usb_hub_release_port(ps->dev, portnum, ps);
2289 }
2290
2291 static int proc_get_capabilities(struct usb_dev_state *ps, void __user *arg)
2292 {
2293         __u32 caps;
2294
2295         caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM |
2296                         USBDEVFS_CAP_REAP_AFTER_DISCONNECT | USBDEVFS_CAP_MMAP |
2297                         USBDEVFS_CAP_DROP_PRIVILEGES;
2298         if (!ps->dev->bus->no_stop_on_short)
2299                 caps |= USBDEVFS_CAP_BULK_CONTINUATION;
2300         if (ps->dev->bus->sg_tablesize)
2301                 caps |= USBDEVFS_CAP_BULK_SCATTER_GATHER;
2302
2303         if (put_user(caps, (__u32 __user *)arg))
2304                 return -EFAULT;
2305
2306         return 0;
2307 }
2308
2309 static int proc_disconnect_claim(struct usb_dev_state *ps, void __user *arg)
2310 {
2311         struct usbdevfs_disconnect_claim dc;
2312         struct usb_interface *intf;
2313
2314         if (copy_from_user(&dc, arg, sizeof(dc)))
2315                 return -EFAULT;
2316
2317         intf = usb_ifnum_to_if(ps->dev, dc.interface);
2318         if (!intf)
2319                 return -EINVAL;
2320
2321         if (intf->dev.driver) {
2322                 struct usb_driver *driver = to_usb_driver(intf->dev.driver);
2323
2324                 if (ps->privileges_dropped)
2325                         return -EACCES;
2326
2327                 if ((dc.flags & USBDEVFS_DISCONNECT_CLAIM_IF_DRIVER) &&
2328                                 strncmp(dc.driver, intf->dev.driver->name,
2329                                         sizeof(dc.driver)) != 0)
2330                         return -EBUSY;
2331
2332                 if ((dc.flags & USBDEVFS_DISCONNECT_CLAIM_EXCEPT_DRIVER) &&
2333                                 strncmp(dc.driver, intf->dev.driver->name,
2334                                         sizeof(dc.driver)) == 0)
2335                         return -EBUSY;
2336
2337                 dev_dbg(&intf->dev, "disconnect by usbfs\n");
2338                 usb_driver_release_interface(driver, intf);
2339         }
2340
2341         return claimintf(ps, dc.interface);
2342 }
2343
2344 static int proc_alloc_streams(struct usb_dev_state *ps, void __user *arg)
2345 {
2346         unsigned num_streams, num_eps;
2347         struct usb_host_endpoint **eps;
2348         struct usb_interface *intf;
2349         int r;
2350
2351         r = parse_usbdevfs_streams(ps, arg, &num_streams, &num_eps,
2352                                    &eps, &intf);
2353         if (r)
2354                 return r;
2355
2356         destroy_async_on_interface(ps,
2357                                    intf->altsetting[0].desc.bInterfaceNumber);
2358
2359         r = usb_alloc_streams(intf, eps, num_eps, num_streams, GFP_KERNEL);
2360         kfree(eps);
2361         return r;
2362 }
2363
2364 static int proc_free_streams(struct usb_dev_state *ps, void __user *arg)
2365 {
2366         unsigned num_eps;
2367         struct usb_host_endpoint **eps;
2368         struct usb_interface *intf;
2369         int r;
2370
2371         r = parse_usbdevfs_streams(ps, arg, NULL, &num_eps, &eps, &intf);
2372         if (r)
2373                 return r;
2374
2375         destroy_async_on_interface(ps,
2376                                    intf->altsetting[0].desc.bInterfaceNumber);
2377
2378         r = usb_free_streams(intf, eps, num_eps, GFP_KERNEL);
2379         kfree(eps);
2380         return r;
2381 }
2382
2383 static int proc_drop_privileges(struct usb_dev_state *ps, void __user *arg)
2384 {
2385         u32 data;
2386
2387         if (copy_from_user(&data, arg, sizeof(data)))
2388                 return -EFAULT;
2389
2390         /* This is an one way operation. Once privileges are
2391          * dropped, you cannot regain them. You may however reissue
2392          * this ioctl to shrink the allowed interfaces mask.
2393          */
2394         ps->interface_allowed_mask &= data;
2395         ps->privileges_dropped = true;
2396
2397         return 0;
2398 }
2399
2400 /*
2401  * NOTE:  All requests here that have interface numbers as parameters
2402  * are assuming that somehow the configuration has been prevented from
2403  * changing.  But there's no mechanism to ensure that...
2404  */
2405 static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
2406                                 void __user *p)
2407 {
2408         struct usb_dev_state *ps = file->private_data;
2409         struct inode *inode = file_inode(file);
2410         struct usb_device *dev = ps->dev;
2411         int ret = -ENOTTY;
2412
2413         if (!(file->f_mode & FMODE_WRITE))
2414                 return -EPERM;
2415
2416         usb_lock_device(dev);
2417
2418         /* Reap operations are allowed even after disconnection */
2419         switch (cmd) {
2420         case USBDEVFS_REAPURB:
2421                 snoop(&dev->dev, "%s: REAPURB\n", __func__);
2422                 ret = proc_reapurb(ps, p);
2423                 goto done;
2424
2425         case USBDEVFS_REAPURBNDELAY:
2426                 snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
2427                 ret = proc_reapurbnonblock(ps, p);
2428                 goto done;
2429
2430 #ifdef CONFIG_COMPAT
2431         case USBDEVFS_REAPURB32:
2432                 snoop(&dev->dev, "%s: REAPURB32\n", __func__);
2433                 ret = proc_reapurb_compat(ps, p);
2434                 goto done;
2435
2436         case USBDEVFS_REAPURBNDELAY32:
2437                 snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
2438                 ret = proc_reapurbnonblock_compat(ps, p);
2439                 goto done;
2440 #endif
2441         }
2442
2443         if (!connected(ps)) {
2444                 usb_unlock_device(dev);
2445                 return -ENODEV;
2446         }
2447
2448         switch (cmd) {
2449         case USBDEVFS_CONTROL:
2450                 snoop(&dev->dev, "%s: CONTROL\n", __func__);
2451                 ret = proc_control(ps, p);
2452                 if (ret >= 0)
2453                         inode->i_mtime = current_time(inode);
2454                 break;
2455
2456         case USBDEVFS_BULK:
2457                 snoop(&dev->dev, "%s: BULK\n", __func__);
2458                 ret = proc_bulk(ps, p);
2459                 if (ret >= 0)
2460                         inode->i_mtime = current_time(inode);
2461                 break;
2462
2463         case USBDEVFS_RESETEP:
2464                 snoop(&dev->dev, "%s: RESETEP\n", __func__);
2465                 ret = proc_resetep(ps, p);
2466                 if (ret >= 0)
2467                         inode->i_mtime = current_time(inode);
2468                 break;
2469
2470         case USBDEVFS_RESET:
2471                 snoop(&dev->dev, "%s: RESET\n", __func__);
2472                 ret = proc_resetdevice(ps);
2473                 break;
2474
2475         case USBDEVFS_CLEAR_HALT:
2476                 snoop(&dev->dev, "%s: CLEAR_HALT\n", __func__);
2477                 ret = proc_clearhalt(ps, p);
2478                 if (ret >= 0)
2479                         inode->i_mtime = current_time(inode);
2480                 break;
2481
2482         case USBDEVFS_GETDRIVER:
2483                 snoop(&dev->dev, "%s: GETDRIVER\n", __func__);
2484                 ret = proc_getdriver(ps, p);
2485                 break;
2486
2487         case USBDEVFS_CONNECTINFO:
2488                 snoop(&dev->dev, "%s: CONNECTINFO\n", __func__);
2489                 ret = proc_connectinfo(ps, p);
2490                 break;
2491
2492         case USBDEVFS_SETINTERFACE:
2493                 snoop(&dev->dev, "%s: SETINTERFACE\n", __func__);
2494                 ret = proc_setintf(ps, p);
2495                 break;
2496
2497         case USBDEVFS_SETCONFIGURATION:
2498                 snoop(&dev->dev, "%s: SETCONFIGURATION\n", __func__);
2499                 ret = proc_setconfig(ps, p);
2500                 break;
2501
2502         case USBDEVFS_SUBMITURB:
2503                 snoop(&dev->dev, "%s: SUBMITURB\n", __func__);
2504                 ret = proc_submiturb(ps, p);
2505                 if (ret >= 0)
2506                         inode->i_mtime = current_time(inode);
2507                 break;
2508
2509 #ifdef CONFIG_COMPAT
2510         case USBDEVFS_CONTROL32:
2511                 snoop(&dev->dev, "%s: CONTROL32\n", __func__);
2512                 ret = proc_control_compat(ps, p);
2513                 if (ret >= 0)
2514                         inode->i_mtime = current_time(inode);
2515                 break;
2516
2517         case USBDEVFS_BULK32:
2518                 snoop(&dev->dev, "%s: BULK32\n", __func__);
2519                 ret = proc_bulk_compat(ps, p);
2520                 if (ret >= 0)
2521                         inode->i_mtime = current_time(inode);
2522                 break;
2523
2524         case USBDEVFS_DISCSIGNAL32:
2525                 snoop(&dev->dev, "%s: DISCSIGNAL32\n", __func__);
2526                 ret = proc_disconnectsignal_compat(ps, p);
2527                 break;
2528
2529         case USBDEVFS_SUBMITURB32:
2530                 snoop(&dev->dev, "%s: SUBMITURB32\n", __func__);
2531                 ret = proc_submiturb_compat(ps, p);
2532                 if (ret >= 0)
2533                         inode->i_mtime = current_time(inode);
2534                 break;
2535
2536         case USBDEVFS_IOCTL32:
2537                 snoop(&dev->dev, "%s: IOCTL32\n", __func__);
2538                 ret = proc_ioctl_compat(ps, ptr_to_compat(p));
2539                 break;
2540 #endif
2541
2542         case USBDEVFS_DISCARDURB:
2543                 snoop(&dev->dev, "%s: DISCARDURB %px\n", __func__, p);
2544                 ret = proc_unlinkurb(ps, p);
2545                 break;
2546
2547         case USBDEVFS_DISCSIGNAL:
2548                 snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
2549                 ret = proc_disconnectsignal(ps, p);
2550                 break;
2551
2552         case USBDEVFS_CLAIMINTERFACE:
2553                 snoop(&dev->dev, "%s: CLAIMINTERFACE\n", __func__);
2554                 ret = proc_claiminterface(ps, p);
2555                 break;
2556
2557         case USBDEVFS_RELEASEINTERFACE:
2558                 snoop(&dev->dev, "%s: RELEASEINTERFACE\n", __func__);
2559                 ret = proc_releaseinterface(ps, p);
2560                 break;
2561
2562         case USBDEVFS_IOCTL:
2563                 snoop(&dev->dev, "%s: IOCTL\n", __func__);
2564                 ret = proc_ioctl_default(ps, p);
2565                 break;
2566
2567         case USBDEVFS_CLAIM_PORT:
2568                 snoop(&dev->dev, "%s: CLAIM_PORT\n", __func__);
2569                 ret = proc_claim_port(ps, p);
2570                 break;
2571
2572         case USBDEVFS_RELEASE_PORT:
2573                 snoop(&dev->dev, "%s: RELEASE_PORT\n", __func__);
2574                 ret = proc_release_port(ps, p);
2575                 break;
2576         case USBDEVFS_GET_CAPABILITIES:
2577                 ret = proc_get_capabilities(ps, p);
2578                 break;
2579         case USBDEVFS_DISCONNECT_CLAIM:
2580                 ret = proc_disconnect_claim(ps, p);
2581                 break;
2582         case USBDEVFS_ALLOC_STREAMS:
2583                 ret = proc_alloc_streams(ps, p);
2584                 break;
2585         case USBDEVFS_FREE_STREAMS:
2586                 ret = proc_free_streams(ps, p);
2587                 break;
2588         case USBDEVFS_DROP_PRIVILEGES:
2589                 ret = proc_drop_privileges(ps, p);
2590                 break;
2591         }
2592
2593  done:
2594         usb_unlock_device(dev);
2595         if (ret >= 0)
2596                 inode->i_atime = current_time(inode);
2597         return ret;
2598 }
2599
2600 static long usbdev_ioctl(struct file *file, unsigned int cmd,
2601                         unsigned long arg)
2602 {
2603         int ret;
2604
2605         ret = usbdev_do_ioctl(file, cmd, (void __user *)arg);
2606
2607         return ret;
2608 }
2609
2610 #ifdef CONFIG_COMPAT
2611 static long usbdev_compat_ioctl(struct file *file, unsigned int cmd,
2612                         unsigned long arg)
2613 {
2614         int ret;
2615
2616         ret = usbdev_do_ioctl(file, cmd, compat_ptr(arg));
2617
2618         return ret;
2619 }
2620 #endif
2621
2622 /* No kernel lock - fine */
2623 static unsigned int usbdev_poll(struct file *file,
2624                                 struct poll_table_struct *wait)
2625 {
2626         struct usb_dev_state *ps = file->private_data;
2627         unsigned int mask = 0;
2628
2629         poll_wait(file, &ps->wait, wait);
2630         if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
2631                 mask |= POLLOUT | POLLWRNORM;
2632         if (!connected(ps))
2633                 mask |= POLLHUP;
2634         if (list_empty(&ps->list))
2635                 mask |= POLLERR;
2636         return mask;
2637 }
2638
2639 const struct file_operations usbdev_file_operations = {
2640         .owner =          THIS_MODULE,
2641         .llseek =         no_seek_end_llseek,
2642         .read =           usbdev_read,
2643         .poll =           usbdev_poll,
2644         .unlocked_ioctl = usbdev_ioctl,
2645 #ifdef CONFIG_COMPAT
2646         .compat_ioctl =   usbdev_compat_ioctl,
2647 #endif
2648         .mmap =           usbdev_mmap,
2649         .open =           usbdev_open,
2650         .release =        usbdev_release,
2651 };
2652
2653 static void usbdev_remove(struct usb_device *udev)
2654 {
2655         struct usb_dev_state *ps;
2656         struct siginfo sinfo;
2657
2658         while (!list_empty(&udev->filelist)) {
2659                 ps = list_entry(udev->filelist.next, struct usb_dev_state, list);
2660                 destroy_all_async(ps);
2661                 wake_up_all(&ps->wait);
2662                 list_del_init(&ps->list);
2663                 if (ps->discsignr) {
2664                         memset(&sinfo, 0, sizeof(sinfo));
2665                         sinfo.si_signo = ps->discsignr;
2666                         sinfo.si_errno = EPIPE;
2667                         sinfo.si_code = SI_ASYNCIO;
2668                         sinfo.si_addr = ps->disccontext;
2669                         kill_pid_info_as_cred(ps->discsignr, &sinfo,
2670                                         ps->disc_pid, ps->cred, ps->secid);
2671                 }
2672         }
2673 }
2674
2675 static int usbdev_notify(struct notifier_block *self,
2676                                unsigned long action, void *dev)
2677 {
2678         switch (action) {
2679         case USB_DEVICE_ADD:
2680                 break;
2681         case USB_DEVICE_REMOVE:
2682                 usbdev_remove(dev);
2683                 break;
2684         }
2685         return NOTIFY_OK;
2686 }
2687
2688 static struct notifier_block usbdev_nb = {
2689         .notifier_call =        usbdev_notify,
2690 };
2691
2692 static struct cdev usb_device_cdev;
2693
2694 int __init usb_devio_init(void)
2695 {
2696         int retval;
2697
2698         retval = register_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX,
2699                                         "usb_device");
2700         if (retval) {
2701                 printk(KERN_ERR "Unable to register minors for usb_device\n");
2702                 goto out;
2703         }
2704         cdev_init(&usb_device_cdev, &usbdev_file_operations);
2705         retval = cdev_add(&usb_device_cdev, USB_DEVICE_DEV, USB_DEVICE_MAX);
2706         if (retval) {
2707                 printk(KERN_ERR "Unable to get usb_device major %d\n",
2708                        USB_DEVICE_MAJOR);
2709                 goto error_cdev;
2710         }
2711         usb_register_notify(&usbdev_nb);
2712 out:
2713         return retval;
2714
2715 error_cdev:
2716         unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
2717         goto out;
2718 }
2719
2720 void usb_devio_cleanup(void)
2721 {
2722         usb_unregister_notify(&usbdev_nb);
2723         cdev_del(&usb_device_cdev);
2724         unregister_chrdev_region(USB_DEVICE_DEV, USB_DEVICE_MAX);
2725 }