drivers/usb/devio.c

   1 /*****************************************************************************/
   2
   3 /*
   4  *      devio.c  --  User space communication with USB devices.
   5  *
   6  *      Copyright (C) 1999-2000  Thomas Sailer (sailer@ife.ee.ethz.ch)
   7  *
   8  *      This program is free software; you can redistribute it and/or modify
   9  *      it under the terms of the GNU General Public License as published by
  10  *      the Free Software Foundation; either version 2 of the License, or
  11  *      (at your option) any later version.
  12  *
  13  *      This program is distributed in the hope that it will be useful,
  14  *      but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *      GNU General Public License for more details.
  17  *
  18  *      You should have received a copy of the GNU General Public License
  19  *      along with this program; if not, write to the Free Software
  20  *      Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21  *
  22  *  $Id: devio.c,v 1.7 2000/02/01 17:28:48 fliegl Exp $
  23  *
  24  *  This file implements the usbdevfs/x/y files, where
  25  *  x is the bus number and y the device number.
  26  *
  27  *  It allows user space programs/"drivers" to communicate directly
  28  *  with USB devices without intervening kernel driver.
  29  *
  30  *  Revision history
  31  *    22.12.1999   0.1   Initial release (split from proc_usb.c)
  32  *    04.01.2000   0.2   Turned into its own filesystem
  33  */
  34
  35 /*****************************************************************************/
  36
  37 #include <linux/fs.h>
  38 #include <linux/mm.h>
  39 #include <linux/slab.h>
  40 #include <linux/smp_lock.h>
  41 #include <linux/signal.h>
  42 #include <linux/poll.h>
  43 #include <linux/usb.h>
  44 #include <linux/usbdevice_fs.h>
  45 #include <asm/uaccess.h>
  46
  47
  48 struct async {
  49         struct list_head asynclist;
  50         struct dev_state *ps;
  51         struct task_struct *task;
  52         unsigned int signr;
  53         void *userbuffer;
  54         void *userurb;
  55         urb_t urb;
  56 };
  57
  58 /*
  59  * my own sync control and bulk methods. Here to experiment
  60  * and because the kernel ones set the process to TASK_UNINTERRUPTIBLE.
  61  */
  62
  63 struct sync {
  64         wait_queue_head_t wait;
  65 };
  66
  67 static void sync_completed(purb_t urb)
  68 {
  69         struct sync *s = (struct sync *)urb->context;
  70
  71         wake_up(&s->wait);
  72 }
  73
  74 static int do_sync(purb_t urb, int timeout)
  75 {
  76         DECLARE_WAITQUEUE(wait, current);
  77         unsigned long tm;
  78         signed long tmdiff;
  79         struct sync s;
  80         int ret;
  81
  82         tm = jiffies+timeout;
  83         init_waitqueue_head(&s.wait);
  84         add_wait_queue(&s.wait, &wait);
  85         urb->context = &s;
  86         urb->complete = sync_completed;
  87         set_current_state(TASK_INTERRUPTIBLE);
  88         if ((ret = usb_submit_urb(urb)))
  89                 goto out;
  90         while (urb->status == -EINPROGRESS) {
  91                 tmdiff = tm - jiffies;
  92                 if (tmdiff <= 0) {
  93                         ret = -ETIMEDOUT;
  94                         goto out;
  95                 }
  96                 if (signal_pending(current)) {
  97                         ret = -EINTR;
  98                         goto out;
  99                 }
 100                 schedule_timeout(tmdiff);
 101         }
 102         ret = urb->status;
 103  out:
 104         set_current_state(TASK_RUNNING);
 105         usb_unlink_urb(urb);
 106         remove_wait_queue(&s.wait, &wait);
 107         return ret;
 108 }
 109
 110 static int my_usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request, __u8 requesttype,
 111                               __u16 value, __u16 index, void *data, __u16 size, int timeout)
 112 {
 113         urb_t *urb;
 114         int ret;
 115
 116         if (!(urb = usb_alloc_urb(0)))
 117                 return -ENOMEM;
 118         if (!(urb->setup_packet = kmalloc(8, GFP_KERNEL))) {
 119                 usb_free_urb(urb);
 120                 return -ENOMEM;
 121         }
 122         urb->setup_packet[0] = requesttype;
 123         urb->setup_packet[1] = request;
 124         urb->setup_packet[2] = value;
 125         urb->setup_packet[3] = value >> 8;
 126         urb->setup_packet[4] = index;
 127         urb->setup_packet[5] = index >> 8;
 128         urb->setup_packet[6] = size;
 129         urb->setup_packet[7] = size >> 8;
 130         urb->dev = dev;
 131         urb->pipe = pipe;
 132         urb->transfer_buffer = data;
 133         urb->transfer_buffer_length = size;
 134         ret = do_sync(urb, timeout);
 135         //if (ret >= 0)
 136         //      ret = urb->status;
 137         if (ret >= 0)
 138                 ret = urb->actual_length;
 139         kfree(urb->setup_packet);
 140         usb_free_urb(urb);
 141         return ret;
 142 }
 143
 144 static int my_usb_bulk_msg(struct usb_device *dev, unsigned int pipe,
 145                            void *data, int len, int *actual_length, int timeout)
 146 {
 147         urb_t *urb;
 148         int ret;
 149
 150         if (!(urb = usb_alloc_urb(0)))
 151                 return -ENOMEM;
 152         urb->dev = dev;
 153         urb->pipe = pipe;
 154         urb->transfer_buffer = data;
 155         urb->transfer_buffer_length = len;
 156         ret = do_sync(urb, timeout);
 157         //if (ret >= 0)
 158         //      ret = urb->status;
 159         if (ret >= 0 && actual_length != NULL)
 160                 *actual_length = urb->actual_length;
 161         usb_free_urb(urb);
 162         return ret;
 163 }
 164
 165 static loff_t usbdev_lseek(struct file *file, loff_t offset, int orig)
 166 {
 167         switch (orig) {
 168         case 0:
 169                 file->f_pos = offset;
 170                 return file->f_pos;
 171
 172         case 1:
 173                 file->f_pos += offset;
 174                 return file->f_pos;
 175
 176         case 2:
 177                 return -EINVAL;
 178
 179         default:
 180                 return -EINVAL;
 181         }
 182 }
 183
 184 static ssize_t usbdev_read(struct file *file, char * buf, size_t nbytes, loff_t *ppos)
 185 {
 186         struct dev_state *ps = (struct dev_state *)file->private_data;
 187         ssize_t ret = 0;
 188         unsigned len;
 189         loff_t pos;
 190         int i;
 191
 192         pos = *ppos;
 193         down_read(&ps->devsem);
 194         if (!ps->dev) {
 195                 ret = -ENODEV;
 196                 goto err;
 197         } else if (pos < 0) {
 198                 ret = -EINVAL;
 199                 goto err;
 200         }
 201
 202         if (pos < sizeof(struct usb_device_descriptor)) {
 203                 len = sizeof(struct usb_device_descriptor) - pos;
 204                 if (len > nbytes)
 205                         len = nbytes;
 206                 if (copy_to_user(buf, ((char *)&ps->dev->descriptor) + pos, len)) {
 207                         ret = -EFAULT;
 208                         goto err;
 209                 }
 210
 211                 *ppos += len;
 212                 buf += len;
 213                 nbytes -= len;
 214                 ret += len;
 215         }
 216
 217         pos = sizeof(struct usb_device_descriptor);
 218         for (i = 0; nbytes && i < ps->dev->descriptor.bNumConfigurations; i++) {
 219                 struct usb_config_descriptor *config =
 220                         (struct usb_config_descriptor *)ps->dev->rawdescriptors[i];
 221                 unsigned int length = le16_to_cpu(config->wTotalLength);
 222
 223                 if (*ppos < pos + length) {
 224                         len = length - (*ppos - pos);
 225                         if (len > nbytes)
 226                                 len = nbytes;
 227
 228                         if (copy_to_user(buf,
 229                             ps->dev->rawdescriptors[i] + (*ppos - pos), len)) {
 230                                 ret = -EFAULT;
 231                                 goto err;
 232                         }
 233
 234                         *ppos += len;
 235                         buf += len;
 236                         nbytes -= len;
 237                         ret += len;
 238                 }
 239
 240                 pos += length;
 241         }
 242
 243 err:
 244         up_read(&ps->devsem);
 245         return ret;
 246 }
 247
 248 extern inline unsigned int ld2(unsigned int x)
 249 {
 250         unsigned int r = 0;
 251
 252         if (x >= 0x10000) {
 253                 x >>= 16;
 254                 r += 16;
 255         }
 256         if (x >= 0x100) {
 257                 x >>= 8;
 258                 r += 8;
 259         }
 260         if (x >= 0x10) {
 261                 x >>= 4;
 262                 r += 4;
 263         }
 264         if (x >= 4) {
 265                 x >>= 2;
 266                 r += 2;
 267         }
 268         if (x >= 2)
 269                 r++;
 270         return r;
 271 }
 272
 273 /*
 274  * async list handling
 275  */
 276
 277 static struct async *alloc_async(unsigned int numisoframes)
 278 {
 279         unsigned int assize = sizeof(struct async) + numisoframes * sizeof(iso_packet_descriptor_t);
 280         struct async *as = kmalloc(assize, GFP_KERNEL);
 281         if (!as)
 282                 return NULL;
 283         memset(as, 0, assize);
 284         as->urb.number_of_packets = numisoframes;
 285         return as;
 286 }
 287
 288 static void free_async(struct async *as)
 289 {
 290         if (as->urb.transfer_buffer)
 291                 kfree(as->urb.transfer_buffer);
 292         kfree(as);
 293 }
 294
 295 extern __inline__ void async_newpending(struct async *as)
 296 {
 297         struct dev_state *ps = as->ps;
 298         unsigned long flags;
 299
 300         spin_lock_irqsave(&ps->lock, flags);
 301         list_add_tail(&as->asynclist, &ps->async_pending);
 302         spin_unlock_irqrestore(&ps->lock, flags);
 303 }
 304
 305 extern __inline__ void async_removepending(struct async *as)
 306 {
 307         struct dev_state *ps = as->ps;
 308         unsigned long flags;
 309
 310         spin_lock_irqsave(&ps->lock, flags);
 311         list_del(&as->asynclist);
 312         INIT_LIST_HEAD(&as->asynclist);
 313         spin_unlock_irqrestore(&ps->lock, flags);
 314 }
 315
 316 extern __inline__ struct async *async_getcompleted(struct dev_state *ps)
 317 {
 318         unsigned long flags;
 319         struct async *as = NULL;
 320
 321         spin_lock_irqsave(&ps->lock, flags);
 322         if (!list_empty(&ps->async_completed)) {
 323                 as = list_entry(ps->async_completed.next, struct async, asynclist);
 324                 list_del(&as->asynclist);
 325                 INIT_LIST_HEAD(&as->asynclist);
 326         }
 327         spin_unlock_irqrestore(&ps->lock, flags);
 328         return as;
 329 }
 330
 331 extern __inline__ struct async *async_getpending(struct dev_state *ps, void *userurb)
 332 {
 333         unsigned long flags;
 334         struct async *as;
 335         struct list_head *p;
 336
 337         spin_lock_irqsave(&ps->lock, flags);
 338         for (p = ps->async_pending.next; p != &ps->async_pending; ) {
 339                 as = list_entry(p, struct async, asynclist);
 340                 p = p->next;
 341                 if (as->userurb != userurb)
 342                         continue;
 343                 list_del(&as->asynclist);
 344                 INIT_LIST_HEAD(&as->asynclist);
 345                 spin_unlock_irqrestore(&ps->lock, flags);
 346                 return as;
 347         }
 348         spin_unlock_irqrestore(&ps->lock, flags);
 349         return NULL;
 350 }
 351
 352 static void async_completed(purb_t urb)
 353 {
 354         struct async *as = (struct async *)urb->context;
 355         struct dev_state *ps = as->ps;
 356         struct siginfo sinfo;
 357
 358 #if 1
 359         printk(KERN_DEBUG "usbdevfs: async_completed: status %d errcount %d actlen %d pipe 0x%x\n",
 360                urb->status, urb->error_count, urb->actual_length, urb->pipe);
 361 #endif
 362         spin_lock(&ps->lock);
 363         list_del(&as->asynclist);
 364         list_add_tail(&as->asynclist, &ps->async_completed);
 365         spin_unlock(&ps->lock);
 366         wake_up(&ps->wait);
 367         if (as->signr) {
 368                 sinfo.si_signo = as->signr;
 369                 sinfo.si_errno = as->urb.status;
 370                 sinfo.si_code = SI_ASYNCIO;
 371                 sinfo.si_addr = as->userurb;
 372                 send_sig_info(as->signr, &sinfo, as->task);
 373         }
 374 }
 375
 376 static void destroy_all_async(struct dev_state *ps)
 377 {
 378         struct async *as;
 379         unsigned long flags;
 380
 381         spin_lock_irqsave(&ps->lock, flags);
 382         while (!list_empty(&ps->async_pending)) {
 383                 as = list_entry(ps->async_pending.next, struct async, asynclist);
 384                 list_del(&as->asynclist);
 385                 INIT_LIST_HEAD(&as->asynclist);
 386                 spin_unlock_irqrestore(&ps->lock, flags);
 387                 /* usb_unlink_urb calls the completion handler with status == USB_ST_URB_KILLED */
 388                 usb_unlink_urb(&as->urb);
 389                 spin_lock_irqsave(&ps->lock, flags);
 390         }
 391         spin_unlock_irqrestore(&ps->lock, flags);
 392         while ((as = async_getcompleted(ps)))
 393                 free_async(as);
 394 }
 395
 396 /*
 397  * interface claiming
 398  */
 399
 400 static void *driver_probe(struct usb_device *dev, unsigned int intf)
 401 {
 402         return NULL;
 403 }
 404
 405 static void driver_disconnect(struct usb_device *dev, void *context)
 406 {
 407         struct dev_state *ps = (struct dev_state *)context;
 408
 409         ps->ifclaimed = 0;
 410 }
 411
 412 struct usb_driver usbdevfs_driver = {
 413         name:           "usbdevfs",
 414         probe:          driver_probe,
 415         disconnect:     driver_disconnect,
 416 };
 417
 418 static int claimintf(struct dev_state *ps, unsigned int intf)
 419 {
 420         struct usb_device *dev = ps->dev;
 421         struct usb_interface *iface;
 422         int err;
 423
 424         if (intf >= 8*sizeof(ps->ifclaimed) || !dev || intf >= dev->actconfig->bNumInterfaces)
 425                 return -EINVAL;
 426         /* already claimed */
 427         if (test_bit(intf, &ps->ifclaimed))
 428                 return 0;
 429         iface = &dev->actconfig->interface[intf];
 430         err = -EBUSY;
 431         lock_kernel();
 432         if (!usb_interface_claimed(iface)) {
 433                 usb_driver_claim_interface(&usbdevfs_driver, iface, ps);
 434                 set_bit(intf, &ps->ifclaimed);
 435                 err = 0;
 436         }
 437         unlock_kernel();
 438         return err;
 439 }
 440
 441 static int releaseintf(struct dev_state *ps, unsigned int intf)
 442 {
 443         struct usb_device *dev;
 444         struct usb_interface *iface;
 445         int err;
 446
 447         if (intf >= 8*sizeof(ps->ifclaimed))
 448                 return -EINVAL;
 449         err = -EINVAL;
 450         lock_kernel();
 451         dev = ps->dev;
 452         if (dev && test_and_clear_bit(intf, &ps->ifclaimed)) {
 453                 iface = &dev->actconfig->interface[intf];
 454                 usb_driver_release_interface(&usbdevfs_driver, iface);
 455                 err = 0;
 456         }
 457         unlock_kernel();
 458         return err;
 459 }
 460
 461 static int checkintf(struct dev_state *ps, unsigned int intf)
 462 {
 463         if (intf >= 8*sizeof(ps->ifclaimed))
 464                 return -EINVAL;
 465         if (test_bit(intf, &ps->ifclaimed))
 466                 return 0;
 467         /* if not yet claimed, claim it for the driver */
 468         printk(KERN_WARNING "usbdevfs: process %d (%s) did not claim interface %u before use\n",
 469                current->pid, current->comm, intf);
 470         return claimintf(ps, intf);
 471 }
 472
 473 static int findintfep(struct usb_device *dev, unsigned int ep)
 474 {
 475         unsigned int i, j, e;
 476         struct usb_interface *iface;
 477         struct usb_interface_descriptor *alts;
 478         struct usb_endpoint_descriptor *endpt;
 479
 480         if (ep & ~(USB_DIR_IN|0xf))
 481                 return -EINVAL;
 482         for (i = 0; i < dev->actconfig->bNumInterfaces; i++) {
 483                 iface = &dev->actconfig->interface[i];
 484                 for (j = 0; j < iface->num_altsetting; j++) {
 485                         alts = &iface->altsetting[j];
 486                         for (e = 0; e < alts->bNumEndpoints; e++) {
 487                                 endpt = &alts->endpoint[e];
 488                                 if (endpt->bEndpointAddress == ep)
 489                                         return i;
 490                         }
 491                 }
 492         }
 493         return -ENOENT;
 494 }
 495
 496 static int findintfif(struct usb_device *dev, unsigned int ifn)
 497 {
 498         unsigned int i, j;
 499         struct usb_interface *iface;
 500         struct usb_interface_descriptor *alts;
 501
 502         if (ifn & ~0xff)
 503                 return -EINVAL;
 504         for (i = 0; i < dev->actconfig->bNumInterfaces; i++) {
 505                 iface = &dev->actconfig->interface[i];
 506                 for (j = 0; j < iface->num_altsetting; j++) {
 507                         alts = &iface->altsetting[j];
 508                         if (alts->bInterfaceNumber == ifn)
 509                                 return i;
 510                 }
 511         }
 512         return -ENOENT;
 513 }
 514
 515 extern struct list_head usb_driver_list;
 516
 517 static int finddriver(struct usb_driver **driver, char *name)
 518 {
 519         struct list_head *tmp;
 520
 521         tmp = usb_driver_list.next;
 522         while (tmp != &usb_driver_list) {
 523                 struct usb_driver *d = list_entry(tmp, struct usb_driver,
 524                                                         driver_list);
 525
 526                 if (!strcmp(d->name, name)) {
 527                         *driver = d;
 528                         return 0;
 529                 }
 530
 531                 tmp = tmp->next;
 532         }
 533
 534         return -EINVAL;
 535 }
 536
 537 /*
 538  * file operations
 539  */
 540 static int usbdev_open(struct inode *inode, struct file *file)
 541 {
 542         struct usb_device *dev;
 543         struct dev_state *ps;
 544         int ret;
 545
 546         /*
 547          * no locking necessary here, as both sys_open (actually filp_open)
 548          * and the hub thread have the kernel lock
 549          * (still acquire the kernel lock for safety)
 550          */
 551         lock_kernel();
 552         ret = -ENOENT;
 553         if (ITYPE(inode->i_ino) != IDEVICE)
 554                 goto out;
 555         dev = inode->u.usbdev_i.p.dev;
 556         if (!dev)
 557                 goto out;
 558         ret = -ENOMEM;
 559         if (!(ps = kmalloc(sizeof(struct dev_state), GFP_KERNEL)))
 560                 goto out;
 561         ret = 0;
 562         ps->dev = dev;
 563         ps->file = file;
 564         spin_lock_init(&ps->lock);
 565         INIT_LIST_HEAD(&ps->async_pending);
 566         INIT_LIST_HEAD(&ps->async_completed);
 567         init_waitqueue_head(&ps->wait);
 568         init_rwsem(&ps->devsem);
 569         ps->discsignr = 0;
 570         ps->disctask = current;
 571         ps->disccontext = NULL;
 572         ps->ifclaimed = 0;
 573         wmb();
 574         list_add_tail(&ps->list, &dev->filelist);
 575         file->private_data = ps;
 576  out:
 577         unlock_kernel();
 578         return ret;
 579 }
 580
 581 static int usbdev_release(struct inode *inode, struct file *file)
 582 {
 583         struct dev_state *ps = (struct dev_state *)file->private_data;
 584         unsigned int i;
 585
 586         lock_kernel();
 587         list_del(&ps->list);
 588         INIT_LIST_HEAD(&ps->list);
 589         if (ps->dev) {
 590                 for (i = 0; ps->ifclaimed && i < 8*sizeof(ps->ifclaimed); i++)
 591                         if (test_bit(i, &ps->ifclaimed))
 592                                 releaseintf(ps, i);
 593         }
 594         unlock_kernel();
 595         destroy_all_async(ps);
 596         kfree(ps);
 597         return 0;
 598 }
 599
 600 static int proc_control(struct dev_state *ps, void *arg)
 601 {
 602         struct usb_device *dev = ps->dev;
 603         struct usbdevfs_ctrltransfer ctrl;
 604         unsigned int tmo;
 605         unsigned char *tbuf;
 606         int i, ret;
 607
 608         copy_from_user_ret(&ctrl, (void *)arg, sizeof(ctrl), -EFAULT);
 609         switch (ctrl.requesttype & 0x1f) {
 610         case USB_RECIP_ENDPOINT:
 611                 if ((ret = findintfep(ps->dev, ctrl.index & 0xff)) < 0)
 612                         return ret;
 613                 if ((ret = checkintf(ps, ret)))
 614                         return ret;
 615                 break;
 616
 617         case USB_RECIP_INTERFACE:
 618                 if ((ret = findintfif(ps->dev, ctrl.index & 0xff)) < 0)
 619                         return ret;
 620                 if ((ret = checkintf(ps, ret)))
 621                         return ret;
 622                 break;
 623         }
 624         if (ctrl.length > PAGE_SIZE)
 625                 return -EINVAL;
 626         if (!(tbuf = (unsigned char *)__get_free_page(GFP_KERNEL)))
 627                 return -ENOMEM;
 628         tmo = (ctrl.timeout * HZ + 999) / 1000;
 629         if (ctrl.requesttype & 0x80) {
 630                 if (ctrl.length && !access_ok(VERIFY_WRITE, ctrl.data, ctrl.length)) {
 631                         free_page((unsigned long)tbuf);
 632                         return -EINVAL;
 633                 }
 634                 i = my_usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), ctrl.request, ctrl.requesttype,
 635                                        ctrl.value, ctrl.index, tbuf, ctrl.length, tmo);
 636                 if ((i > 0) && ctrl.length) {
 637                         copy_to_user_ret(ctrl.data, tbuf, ctrl.length, -EFAULT);
 638                 }
 639         } else {
 640                 if (ctrl.length) {
 641                         copy_from_user_ret(tbuf, ctrl.data, ctrl.length, -EFAULT);
 642                 }
 643                 i = my_usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ctrl.request, ctrl.requesttype,
 644                                        ctrl.value, ctrl.index, tbuf, ctrl.length, tmo);
 645         }
 646         free_page((unsigned long)tbuf);
 647         if (i<0) {
 648                 printk(KERN_DEBUG "usbdevfs: USBDEVFS_CONTROL failed dev %d rqt %u rq %u len %u ret %d\n",
 649                        dev->devnum, ctrl.requesttype, ctrl.request, ctrl.length, i);
 650         }
 651         return i;
 652 }
 653
 654 static int proc_bulk(struct dev_state *ps, void *arg)
 655 {
 656         struct usb_device *dev = ps->dev;
 657         struct usbdevfs_bulktransfer bulk;
 658         unsigned int tmo, len1, pipe;
 659         int len2;
 660         unsigned char *tbuf;
 661         int i, ret;
 662
 663         copy_from_user_ret(&bulk, (void *)arg, sizeof(bulk), -EFAULT);
 664         if ((ret = findintfep(ps->dev, bulk.ep)) < 0)
 665                 return ret;
 666         if ((ret = checkintf(ps, ret)))
 667                 return ret;
 668         if (bulk.ep & USB_DIR_IN)
 669                 pipe = usb_rcvbulkpipe(dev, bulk.ep & 0x7f);
 670         else
 671                 pipe = usb_sndbulkpipe(dev, bulk.ep & 0x7f);
 672         if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN)))
 673                 return -EINVAL;
 674         len1 = bulk.len;
 675         if (len1 > PAGE_SIZE)
 676                 len1 = PAGE_SIZE;
 677         if (!(tbuf = (unsigned char *)__get_free_page(GFP_KERNEL)))
 678                 return -ENOMEM;
 679         tmo = (bulk.timeout * HZ + 999) / 1000;
 680         if (bulk.ep & 0x80) {
 681                 if (len1 && !access_ok(VERIFY_WRITE, bulk.data, len1)) {
 682                         free_page((unsigned long)tbuf);
 683                         return -EINVAL;
 684                 }
 685                 i = my_usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
 686                 if (!i && len2) {
 687                         copy_to_user_ret(bulk.data, tbuf, len2, -EFAULT);
 688                 }
 689         } else {
 690                 if (len1) {
 691                         copy_from_user_ret(tbuf, bulk.data, len1, -EFAULT);
 692                 }
 693                 i = my_usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
 694         }
 695         free_page((unsigned long)tbuf);
 696         if (i < 0) {
 697                 printk(KERN_WARNING "usbdevfs: USBDEVFS_BULK failed dev %d ep 0x%x len %u ret %d\n",
 698                        dev->devnum, bulk.ep, bulk.len, i);
 699                 return i;
 700         }
 701         return len2;
 702 }
 703
 704 static int proc_resetep(struct dev_state *ps, void *arg)
 705 {
 706         unsigned int ep;
 707         int ret;
 708
 709         get_user_ret(ep, (unsigned int *)arg, -EFAULT);
 710         if ((ret = findintfep(ps->dev, ep)) < 0)
 711                 return ret;
 712         if ((ret = checkintf(ps, ret)))
 713                 return ret;
 714         usb_settoggle(ps->dev, ep & 0xf, !(ep & USB_DIR_IN), 0);
 715         return 0;
 716 }
 717
 718 static int proc_getdriver(struct dev_state *ps, void *arg)
 719 {
 720         struct usbdevfs_getdriver gd;
 721         struct usb_interface *interface;
 722         int ret;
 723
 724         copy_from_user_ret(&gd, arg, sizeof(gd), -EFAULT);
 725         if ((ret = findintfif(ps->dev, gd.interface)) < 0)
 726                 return ret;
 727         interface = usb_ifnum_to_if(ps->dev, gd.interface);
 728         if (!interface)
 729                 return -EINVAL;
 730         if (!interface->driver)
 731                 return -ENODATA;
 732         strcpy(gd.driver, interface->driver->name);
 733         copy_to_user_ret(arg, &gd, sizeof(gd), -EFAULT);
 734         return 0;
 735 }
 736
 737 static int proc_connectinfo(struct dev_state *ps, void *arg)
 738 {
 739         struct usbdevfs_connectinfo ci;
 740
 741         ci.devnum = ps->dev->devnum;
 742         ci.slow = ps->dev->slow;
 743         copy_to_user_ret(arg, &ci, sizeof(ci), -EFAULT);
 744         return 0;
 745 }
 746
 747 static int proc_resetdevice(struct dev_state *ps)
 748 {
 749         int i, ret;
 750
 751         ret = usb_reset_device(ps->dev);
 752         if (ret < 0)
 753                 return ret;
 754
 755         for (i = 0; i < ps->dev->actconfig->bNumInterfaces; i++) {
 756                 struct usb_interface *intf = &ps->dev->actconfig->interface[i];
 757
 758                 /* Don't simulate interfaces we've claimed */
 759                 if (test_bit(i, &ps->ifclaimed))
 760                         continue;
 761
 762                 if (intf->driver) {
 763                         down(&intf->driver->serialize);
 764                         intf->driver->disconnect(ps->dev, intf->private_data);
 765                         intf->driver->probe(ps->dev, i);
 766                         up(&intf->driver->serialize);
 767                 }
 768         }
 769
 770         return 0;
 771 }
 772
 773 static int proc_setintf(struct dev_state *ps, void *arg)
 774 {
 775         struct usbdevfs_setinterface setintf;
 776         struct usb_interface *interface;
 777         int ret;
 778
 779         copy_from_user_ret(&setintf, arg, sizeof(setintf), -EFAULT);
 780         if ((ret = findintfif(ps->dev, setintf.interface)) < 0)
 781                 return ret;
 782         interface = usb_ifnum_to_if(ps->dev, setintf.interface);
 783         if (!interface)
 784                 return -EINVAL;
 785         if (interface->driver) {
 786                 if ((ret = checkintf(ps, ret)))
 787                         return ret;
 788         }
 789         if (usb_set_interface(ps->dev, setintf.interface, setintf.altsetting))
 790                 return -EINVAL;
 791         return 0;
 792 }
 793
 794 static int proc_setconfig(struct dev_state *ps, void *arg)
 795 {
 796         unsigned int u;
 797
 798         get_user_ret(u, (unsigned int *)arg, -EFAULT);
 799         if (usb_set_configuration(ps->dev, u) < 0)
 800                 return -EINVAL;
 801         return 0;
 802 }
 803
 804 static int proc_submiturb(struct dev_state *ps, void *arg)
 805 {
 806         struct usbdevfs_urb uurb;
 807         struct usbdevfs_iso_packet_desc *isopkt = NULL;
 808         struct async *as;
 809         unsigned int u, totlen, isofrmlen;
 810         int ret;
 811
 812         copy_from_user_ret(&uurb, arg, sizeof(uurb), -EFAULT);
 813         if (uurb.flags & ~(USBDEVFS_URB_ISO_ASAP|USBDEVFS_URB_DISABLE_SPD))
 814                 return -EINVAL;
 815         if (!uurb.buffer)
 816                 return -EINVAL;
 817         if (uurb.signr != 0 && (uurb.signr < SIGRTMIN || uurb.signr > SIGRTMAX))
 818                 return -EINVAL;
 819         if ((ret = findintfep(ps->dev, uurb.endpoint)) < 0)
 820                 return ret;
 821         if ((ret = checkintf(ps, ret)))
 822                 return ret;
 823         switch(uurb.type) {
 824         case USBDEVFS_URB_TYPE_BULK:
 825                 uurb.number_of_packets = 0;
 826                 if (uurb.buffer_length > 16384)
 827                         return -EINVAL;
 828                 if (!access_ok((uurb.endpoint & USB_DIR_IN) ? VERIFY_WRITE : VERIFY_READ, uurb.buffer, uurb.buffer_length))
 829                         return -EFAULT;
 830                 break;
 831
 832         case USBDEVFS_URB_TYPE_ISO:
 833                 /* arbitrary limit */
 834                 if (uurb.number_of_packets < 1 || uurb.number_of_packets > 128)
 835                         return -EINVAL;
 836                 isofrmlen = sizeof(struct usbdevfs_iso_packet_desc) * uurb.number_of_packets;
 837                 if (!(isopkt = kmalloc(isofrmlen, GFP_KERNEL)))
 838                         return -ENOMEM;
 839                 if (copy_from_user(isopkt, &((struct usbdevfs_urb *)arg)->iso_frame_desc, isofrmlen)) {
 840                         kfree(isopkt);
 841                         return -EFAULT;
 842                 }
 843                 for (totlen = u = 0; u < uurb.number_of_packets; u++) {
 844                         if (isopkt[u].length > 1023) {
 845                                 kfree(isopkt);
 846                                 return -EINVAL;
 847                         }
 848                         totlen += isopkt[u].length;
 849                 }
 850                 if (totlen > 32768) {
 851                         kfree(isopkt);
 852                         return -ENOMEM;
 853                 }
 854                 uurb.buffer_length = totlen;
 855                 break;
 856
 857         default:
 858                 return -EINVAL;
 859         }
 860         if (!(as = alloc_async(uurb.number_of_packets))) {
 861                 if (isopkt)
 862                         kfree(isopkt);
 863                 return -ENOMEM;
 864         }
 865         if (!(as->urb.transfer_buffer = kmalloc(uurb.buffer_length, GFP_KERNEL))) {
 866                 if (isopkt)
 867                         kfree(isopkt);
 868                 free_async(as);
 869                 return -ENOMEM;
 870         }
 871         as->urb.next = NULL;
 872         as->urb.dev = ps->dev;
 873         as->urb.pipe = (uurb.type << 30) | __create_pipe(ps->dev, uurb.endpoint & 0xf) | (uurb.endpoint & USB_DIR_IN);
 874         as->urb.transfer_flags = uurb.flags;
 875         as->urb.transfer_buffer_length = uurb.buffer_length;
 876         as->urb.start_frame = uurb.start_frame;
 877         as->urb.number_of_packets = uurb.number_of_packets;
 878         as->urb.context = as;
 879         as->urb.complete = async_completed;
 880         for (totlen = u = 0; u < uurb.number_of_packets; u++) {
 881                 as->urb.iso_frame_desc[u].offset = totlen;
 882                 as->urb.iso_frame_desc[u].length = isopkt[u].length;
 883                 totlen += isopkt[u].length;
 884         }
 885         if (isopkt)
 886                 kfree(isopkt);
 887         as->ps = ps;
 888         as->userurb = arg;
 889         if (uurb.endpoint & USB_DIR_IN)
 890                 as->userbuffer = uurb.buffer;
 891         else
 892                 as->userbuffer = NULL;
 893         as->signr = uurb.signr;
 894         as->task = current;
 895         if (!(uurb.endpoint & USB_DIR_IN)) {
 896                 if (copy_from_user(as->urb.transfer_buffer, uurb.buffer, as->urb.transfer_buffer_length)) {
 897                         free_async(as);
 898                         return -EFAULT;
 899                 }
 900         }
 901         async_newpending(as);
 902         if ((ret = usb_submit_urb(&as->urb))) {
 903                 printk(KERN_DEBUG "usbdevfs: usb_submit_urb returned %d\n", ret);
 904                 async_removepending(as);
 905                 free_async(as);
 906                 return ret;
 907         }
 908         return 0;
 909 }
 910
 911 static int proc_unlinkurb(struct dev_state *ps, void *arg)
 912 {
 913         struct async *as;
 914
 915         as = async_getpending(ps, arg);
 916         if (!as)
 917                 return -EINVAL;
 918         usb_unlink_urb(&as->urb);
 919         return 0;
 920 }
 921
 922 static int processcompl(struct async *as)
 923 {
 924         unsigned int i;
 925
 926         if (as->userbuffer)
 927                 if (copy_to_user(as->userbuffer, as->urb.transfer_buffer, as->urb.transfer_buffer_length))
 928                         return -EFAULT;
 929         put_user_ret(as->urb.status, &((struct usbdevfs_urb *)as->userurb)->status, -EFAULT);
 930         put_user_ret(as->urb.actual_length, &((struct usbdevfs_urb *)as->userurb)->actual_length, -EFAULT);
 931         put_user_ret(as->urb.error_count, &((struct usbdevfs_urb *)as->userurb)->error_count, -EFAULT);
 932         if (!(usb_pipeisoc(as->urb.pipe)))
 933                 return 0;
 934         for (i = 0; i < as->urb.number_of_packets; i++) {
 935                 put_user_ret(as->urb.iso_frame_desc[i].actual_length,
 936                              &((struct usbdevfs_urb *)as->userurb)->iso_frame_desc[i].actual_length,
 937                              -EFAULT);
 938                 put_user_ret(as->urb.iso_frame_desc[i].status,
 939                              &((struct usbdevfs_urb *)as->userurb)->iso_frame_desc[i].status,
 940                              -EFAULT);
 941         }
 942         return 0;
 943 }
 944
 945 static int proc_reapurb(struct dev_state *ps, void *arg)
 946 {
 947         DECLARE_WAITQUEUE(wait, current);
 948         struct async *as = NULL;
 949         void *addr;
 950         int ret;
 951
 952         add_wait_queue(&ps->wait, &wait);
 953         while (ps->dev) {
 954                 __set_current_state(TASK_INTERRUPTIBLE);
 955                 if ((as = async_getcompleted(ps)))
 956                         break;
 957                 if (signal_pending(current))
 958                         break;
 959                 up_read(&ps->devsem);
 960                 schedule();
 961                 down_read(&ps->devsem);
 962         }
 963         remove_wait_queue(&ps->wait, &wait);
 964         set_current_state(TASK_RUNNING);
 965         if (as) {
 966                 ret = processcompl(as);
 967                 addr = as->userurb;
 968                 free_async(as);
 969                 if (ret)
 970                         return ret;
 971                 put_user_ret(addr, (void **)arg, -EFAULT);
 972                 return 0;
 973         }
 974         if (signal_pending(current))
 975                 return -EINTR;
 976         return -EIO;
 977 }
 978
 979 static int proc_reapurbnonblock(struct dev_state *ps, void *arg)
 980 {
 981         struct async *as;
 982         void *addr;
 983         int ret;
 984
 985         if (!(as = async_getcompleted(ps)))
 986                 return -EAGAIN;
 987         ret = processcompl(as);
 988         addr = as->userurb;
 989         free_async(as);
 990         if (ret)
 991                 return ret;
 992         put_user_ret(addr, (void **)arg, -EFAULT);
 993         return 0;
 994 }
 995
 996 static int proc_disconnectsignal(struct dev_state *ps, void *arg)
 997 {
 998         struct usbdevfs_disconnectsignal ds;
 999
1000         copy_from_user_ret(&ds, arg, sizeof(ds), -EFAULT);
1001         if (ds.signr != 0 && (ds.signr < SIGRTMIN || ds.signr > SIGRTMAX))
1002                 return -EINVAL;
1003         ps->discsignr = ds.signr;
1004         ps->disccontext = ds.context;
1005         return 0;
1006 }
1007
1008 static int proc_claiminterface(struct dev_state *ps, void *arg)
1009 {
1010         unsigned int intf;
1011         int ret;
1012
1013         get_user_ret(intf, (unsigned int *)arg, -EFAULT);
1014         if ((ret = findintfif(ps->dev, intf)) < 0)
1015                 return ret;
1016         return claimintf(ps, ret);
1017 }
1018
1019 static int proc_releaseinterface(struct dev_state *ps, void *arg)
1020 {
1021         unsigned int intf;
1022         int ret;
1023
1024         get_user_ret(intf, (unsigned int *)arg, -EFAULT);
1025         if ((ret = findintfif(ps->dev, intf)) < 0)
1026                 return ret;
1027         return releaseintf(ps, intf);
1028 }
1029
1030 static int proc_ioctl (struct dev_state *ps, void *arg)
1031 {
1032         struct usbdevfs_ioctl   ctrl;
1033         int                     size;
1034         void                    *buf = 0;
1035         int                     retval = 0;
1036
1037         /* get input parameters and alloc buffer */
1038         copy_from_user_ret (&ctrl, (void *) arg, sizeof (ctrl), -EFAULT);
1039         if ((size = _IOC_SIZE (ctrl.ioctl_code)) > 0) {
1040                 if ((buf = kmalloc (size, GFP_KERNEL)) == 0)
1041                         return -ENOMEM;
1042                 if ((_IOC_DIR (ctrl.ioctl_code) & _IOC_WRITE) != 0
1043                                 && copy_from_user (buf, ctrl.data, size) != 0) {
1044                         kfree (buf);
1045                         return -EFAULT;
1046                 } else
1047                         memset (arg, 0, size);
1048         }
1049
1050         /* ioctl to device */
1051         if (ctrl.ifno < 0) {
1052                 switch (ctrl.ioctl_code) {
1053                 /* access/release token for issuing control messages
1054                  * ask a particular driver to bind/unbind, ... etc
1055                  */
1056                 }
1057                 retval = -ENOSYS;
1058
1059         /* ioctl to the driver which has claimed a given interface */
1060         } else {
1061                 struct usb_interface    *ifp = 0;
1062                 if (!ps->dev)
1063                         retval = -ENODEV;
1064                 else if (ctrl.ifno >= ps->dev->actconfig->bNumInterfaces)
1065                         retval = -EINVAL;
1066                 else {
1067                         if (!(ifp = usb_ifnum_to_if (ps->dev, ctrl.ifno)))
1068                                 retval = -EINVAL;
1069                         else if (ifp->driver == 0 || ifp->driver->ioctl == 0)
1070                                 retval = -ENOSYS;
1071                 }
1072                 if (retval == 0)
1073                         /* ifno might usefully be passed ... */
1074                         retval = ifp->driver->ioctl (ps->dev, ctrl.ioctl_code, buf);
1075                         /* size = min (size, retval)? */
1076         }
1077
1078         /* cleanup and return */
1079         if (retval >= 0
1080                         && (_IOC_DIR (ctrl.ioctl_code) & _IOC_READ) != 0
1081                         && size > 0
1082                         && copy_to_user (ctrl.data, buf, size) != 0)
1083                 retval = -EFAULT;
1084         if (buf != 0)
1085                 kfree (buf);
1086         return retval;
1087 }
1088
1089 static int usbdev_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
1090 {
1091         struct dev_state *ps = (struct dev_state *)file->private_data;
1092         int ret = -ENOIOCTLCMD;
1093
1094         if (!(file->f_mode & FMODE_WRITE))
1095                 return -EPERM;
1096         down_read(&ps->devsem);
1097         if (!ps->dev) {
1098                 up_read(&ps->devsem);
1099                 return -ENODEV;
1100         }
1101         switch (cmd) {
1102         case USBDEVFS_CONTROL:
1103                 ret = proc_control(ps, (void *)arg);
1104                 if (ret >= 0)
1105                         inode->i_mtime = CURRENT_TIME;
1106                 break;
1107
1108         case USBDEVFS_BULK:
1109                 ret = proc_bulk(ps, (void *)arg);
1110                 if (ret >= 0)
1111                         inode->i_mtime = CURRENT_TIME;
1112                 break;
1113
1114         case USBDEVFS_RESETEP:
1115                 ret = proc_resetep(ps, (void *)arg);
1116                 if (ret >= 0)
1117                         inode->i_mtime = CURRENT_TIME;
1118                 break;
1119
1120         case USBDEVFS_RESET:
1121                 ret = proc_resetdevice(ps);
1122                 break;
1123
1124         case USBDEVFS_GETDRIVER:
1125                 ret = proc_getdriver(ps, (void *)arg);
1126                 break;
1127
1128         case USBDEVFS_CONNECTINFO:
1129                 ret = proc_connectinfo(ps, (void *)arg);
1130                 break;
1131
1132         case USBDEVFS_SETINTERFACE:
1133                 ret = proc_setintf(ps, (void *)arg);
1134                 break;
1135
1136         case USBDEVFS_SETCONFIGURATION:
1137                 ret = proc_setconfig(ps, (void *)arg);
1138                 break;
1139
1140         case USBDEVFS_SUBMITURB:
1141                 ret = proc_submiturb(ps, (void *)arg);
1142                 if (ret >= 0)
1143                         inode->i_mtime = CURRENT_TIME;
1144                 break;
1145
1146         case USBDEVFS_DISCARDURB:
1147                 ret = proc_unlinkurb(ps, (void *)arg);
1148                 break;
1149
1150         case USBDEVFS_REAPURB:
1151                 ret = proc_reapurb(ps, (void *)arg);
1152                 break;
1153
1154         case USBDEVFS_REAPURBNDELAY:
1155                 ret = proc_reapurbnonblock(ps, (void *)arg);
1156                 break;
1157
1158         case USBDEVFS_DISCSIGNAL:
1159                 ret = proc_disconnectsignal(ps, (void *)arg);
1160                 break;
1161
1162         case USBDEVFS_CLAIMINTERFACE:
1163                 ret = proc_claiminterface(ps, (void *)arg);
1164                 break;
1165
1166         case USBDEVFS_RELEASEINTERFACE:
1167                 ret = proc_releaseinterface(ps, (void *)arg);
1168                 break;
1169
1170         case USBDEVFS_IOCTL:
1171                 ret = proc_ioctl(ps, (void *) arg);
1172                 break;
1173         }
1174         up_read(&ps->devsem);
1175         if (ret >= 0)
1176                 inode->i_atime = CURRENT_TIME;
1177         return ret;
1178 }
1179
1180 /* No kernel lock - fine */
1181 static unsigned int usbdev_poll(struct file *file, struct poll_table_struct *wait)
1182 {
1183         struct dev_state *ps = (struct dev_state *)file->private_data;
1184         unsigned int mask = 0;
1185
1186         poll_wait(file, &ps->wait, wait);
1187         if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
1188                 mask |= POLLOUT | POLLWRNORM;
1189         if (!ps->dev)
1190                 mask |= POLLERR | POLLHUP;
1191         return mask;
1192 }
1193
1194 struct file_operations usbdevfs_device_file_operations = {
1195         llseek:         usbdev_lseek,
1196         read:           usbdev_read,
1197         poll:           usbdev_poll,
1198         ioctl:          usbdev_ioctl,
1199         open:           usbdev_open,
1200         release:        usbdev_release,
1201 };