1 /*****************************************************************************/
2 
3 /*
4  *      devio.c  --  User space communication with USB devices.
5  *
6  *      Copyright (C) 1999-2000  Thomas Sailer (sailer@ife.ee.ethz.ch)
7  *
8  *      This program is free software; you can redistribute it and/or modify
9  *      it under the terms of the GNU General Public License as published by
10  *      the Free Software Foundation; either version 2 of the License, or
11  *      (at your option) any later version.
12  *
13  *      This program is distributed in the hope that it will be useful,
14  *      but WITHOUT ANY WARRANTY; without even the implied warranty of
15  *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  *      GNU General Public License for more details.
17  *
18  *      You should have received a copy of the GNU General Public License
19  *      along with this program; if not, write to the Free Software
20  *      Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
21  *
22  *  $Id: devio.c,v 1.7 2000/02/01 17:28:48 fliegl Exp $
23  *
24  *  This file implements the usbdevfs/x/y files, where
25  *  x is the bus number and y the device number.
26  *
27  *  It allows user space programs/"drivers" to communicate directly
28  *  with USB devices without intervening kernel driver.
29  *
30  *  Revision history
31  *    22.12.1999   0.1   Initial release (split from proc_usb.c)
32  *    04.01.2000   0.2   Turned into its own filesystem
33  */
34 
35 /*****************************************************************************/
36 
37 #include <linux/fs.h>
38 #include <linux/mm.h>
39 #include <linux/slab.h>
40 #include <linux/smp_lock.h>
41 #include <linux/signal.h>
42 #include <linux/poll.h>
43 #include <linux/usb.h>
44 #include <linux/usbdevice_fs.h>
45 #include <asm/uaccess.h>
46 
47 
48 struct async {
49         struct list_head asynclist;
50         struct dev_state *ps;
51 	struct task_struct *task;
52 	unsigned int signr;
53 	unsigned int intf;
54 	void *userbuffer;
55         void *userurb;
56         struct urb urb;
57 };
58 
usbdev_lseek(struct file * file,loff_t offset,int orig)59 static loff_t usbdev_lseek(struct file *file, loff_t offset, int orig)
60 {
61 	switch (orig) {
62 	case 0:
63 		file->f_pos = offset;
64 		return file->f_pos;
65 
66 	case 1:
67 		file->f_pos += offset;
68 		return file->f_pos;
69 
70 	case 2:
71 		return -EINVAL;
72 
73 	default:
74 		return -EINVAL;
75 	}
76 }
77 
usbdev_read(struct file * file,char * buf,size_t nbytes,loff_t * ppos)78 static ssize_t usbdev_read(struct file *file, char * buf, size_t nbytes, loff_t *ppos)
79 {
80 	struct dev_state *ps = (struct dev_state *)file->private_data;
81 	ssize_t ret = 0;
82 	unsigned len;
83 	loff_t pos, last;
84 	int i;
85 
86 	pos = *ppos;
87 	down_read(&ps->devsem);
88 	if (!ps->dev) {
89 		ret = -ENODEV;
90 		goto err;
91 	} else if (pos < 0) {
92 		ret = -EINVAL;
93 		goto err;
94 	}
95 
96 	if (pos < sizeof(struct usb_device_descriptor)) {
97 		len = sizeof(struct usb_device_descriptor) - pos;
98 		if (len > nbytes)
99 			len = nbytes;
100 		if (copy_to_user(buf, ((char *)&ps->dev->descriptor) + pos, len)) {
101 			ret = -EFAULT;
102 			goto err;
103 		}
104 
105 		pos += len;
106 		buf += len;
107 		nbytes -= len;
108 		ret += len;
109 	}
110 
111 	last = sizeof(struct usb_device_descriptor);
112 	for (i = 0; nbytes && i < ps->dev->descriptor.bNumConfigurations; i++) {
113 		struct usb_config_descriptor *config =
114 			(struct usb_config_descriptor *)ps->dev->rawdescriptors[i];
115 		unsigned int length = le16_to_cpu(config->wTotalLength);
116 
117 		if (pos < last + length) {
118 			len = length - (pos - last);
119 			if (len > nbytes)
120 				len = nbytes;
121 
122 			if (copy_to_user(buf,
123 			    ps->dev->rawdescriptors[i] + (pos - last), len)) {
124 				ret = -EFAULT;
125 				goto err;
126 			}
127 
128 			pos += len;
129 			buf += len;
130 			nbytes -= len;
131 			ret += len;
132 		}
133 
134 		last += length;
135 	}
136 	*ppos = pos;
137 
138 err:
139 	up_read(&ps->devsem);
140 	return ret;
141 }
142 
ld2(unsigned int x)143 static inline unsigned int ld2(unsigned int x)
144 {
145         unsigned int r = 0;
146 
147         if (x >= 0x10000) {
148                 x >>= 16;
149                 r += 16;
150         }
151         if (x >= 0x100) {
152                 x >>= 8;
153                 r += 8;
154         }
155         if (x >= 0x10) {
156                 x >>= 4;
157                 r += 4;
158         }
159         if (x >= 4) {
160                 x >>= 2;
161                 r += 2;
162         }
163         if (x >= 2)
164                 r++;
165         return r;
166 }
167 
168 /*
169  * async list handling
170  */
171 
alloc_async(unsigned int numisoframes)172 static struct async *alloc_async(unsigned int numisoframes)
173 {
174         unsigned int assize = sizeof(struct async) + numisoframes * sizeof(struct iso_packet_descriptor);
175         struct async *as = kmalloc(assize, GFP_KERNEL);
176         if (!as)
177                 return NULL;
178         memset(as, 0, assize);
179         as->urb.number_of_packets = numisoframes;
180         spin_lock_init(&as->urb.lock);
181         return as;
182 }
183 
free_async(struct async * as)184 static void free_async(struct async *as)
185 {
186         if (as->urb.transfer_buffer)
187                 kfree(as->urb.transfer_buffer);
188         if (as->urb.setup_packet)
189                 kfree(as->urb.setup_packet);
190         kfree(as);
191 }
192 
async_newpending(struct async * as)193 static inline void async_newpending(struct async *as)
194 {
195         struct dev_state *ps = as->ps;
196         unsigned long flags;
197 
198         spin_lock_irqsave(&ps->lock, flags);
199         list_add_tail(&as->asynclist, &ps->async_pending);
200         spin_unlock_irqrestore(&ps->lock, flags);
201 }
202 
async_removepending(struct async * as)203 static inline void async_removepending(struct async *as)
204 {
205         struct dev_state *ps = as->ps;
206         unsigned long flags;
207 
208         spin_lock_irqsave(&ps->lock, flags);
209         list_del_init(&as->asynclist);
210         spin_unlock_irqrestore(&ps->lock, flags);
211 }
212 
async_getcompleted(struct dev_state * ps)213 static inline struct async *async_getcompleted(struct dev_state *ps)
214 {
215         unsigned long flags;
216         struct async *as = NULL;
217 
218         spin_lock_irqsave(&ps->lock, flags);
219         if (!list_empty(&ps->async_completed)) {
220                 as = list_entry(ps->async_completed.next, struct async, asynclist);
221                 list_del_init(&as->asynclist);
222         }
223         spin_unlock_irqrestore(&ps->lock, flags);
224         return as;
225 }
226 
async_getpending(struct dev_state * ps,void * userurb)227 static inline struct async *async_getpending(struct dev_state *ps, void *userurb)
228 {
229         unsigned long flags;
230         struct async *as;
231 
232         spin_lock_irqsave(&ps->lock, flags);
233 	list_for_each_entry(as, &ps->async_pending, asynclist)
234 		if (as->userurb == userurb) {
235 			list_del_init(&as->asynclist);
236 			spin_unlock_irqrestore(&ps->lock, flags);
237 			return as;
238 		}
239         spin_unlock_irqrestore(&ps->lock, flags);
240         return NULL;
241 }
242 
async_completed(struct urb * urb)243 static void async_completed(struct urb *urb)
244 {
245         struct async *as = (struct async *)urb->context;
246         struct dev_state *ps = as->ps;
247 	struct siginfo sinfo;
248 
249         spin_lock(&ps->lock);
250         list_move_tail(&as->asynclist, &ps->async_completed);
251         spin_unlock(&ps->lock);
252         wake_up(&ps->wait);
253 	if (as->signr) {
254 		sinfo.si_signo = as->signr;
255 		sinfo.si_errno = as->urb.status;
256 		sinfo.si_code = SI_ASYNCIO;
257 		sinfo.si_addr = as->userurb;
258 		send_sig_info(as->signr, &sinfo, as->task);
259 	}
260 }
261 
destroy_async(struct dev_state * ps,struct list_head * list)262 static void destroy_async (struct dev_state *ps, struct list_head *list)
263 {
264 	struct async *as;
265 	unsigned long flags;
266 
267 	spin_lock_irqsave(&ps->lock, flags);
268 	while (!list_empty(list)) {
269 		as = list_entry(list->next, struct async, asynclist);
270 		list_del_init(&as->asynclist);
271 		spin_unlock_irqrestore(&ps->lock, flags);
272 		/* usb_unlink_urb calls the completion handler with status == USB_ST_URB_KILLED */
273 		usb_unlink_urb(&as->urb);
274 		spin_lock_irqsave(&ps->lock, flags);
275 	}
276 	spin_unlock_irqrestore(&ps->lock, flags);
277 	while ((as = async_getcompleted(ps)))
278 		free_async(as);
279 }
280 
destroy_async_on_interface(struct dev_state * ps,unsigned int intf)281 static void destroy_async_on_interface (struct dev_state *ps, unsigned int intf)
282 {
283 	struct list_head *p, *q, hitlist;
284 	unsigned long flags;
285 
286 	INIT_LIST_HEAD(&hitlist);
287 	spin_lock_irqsave(&ps->lock, flags);
288 	list_for_each_safe(p, q, &ps->async_pending)
289 		if (intf == list_entry(p, struct async, asynclist)->intf)
290 			list_move_tail(p, &hitlist);
291 	spin_unlock_irqrestore(&ps->lock, flags);
292 	destroy_async(ps, &hitlist);
293 }
294 
destroy_all_async(struct dev_state * ps)295 static inline void destroy_all_async(struct dev_state *ps)
296 {
297 	destroy_async(ps, &ps->async_pending);
298 }
299 
300 /*
301  * interface claims are made only at the request of user level code,
302  * which can also release them (explicitly or by closing files).
303  * they're also undone when devices disconnect.
304  */
305 
driver_probe(struct usb_device * dev,unsigned int intf,const struct usb_device_id * id)306 static void *driver_probe(struct usb_device *dev, unsigned int intf,
307 			  const struct usb_device_id *id)
308 {
309 	return NULL;
310 }
311 
driver_disconnect(struct usb_device * dev,void * context)312 static void driver_disconnect(struct usb_device *dev, void *context)
313 {
314 	struct dev_state *ps = (struct dev_state *)context;
315 
316 	if (!ps)
317 		return;
318 
319 	/* this waits till synchronous requests complete */
320 	down_write (&ps->devsem);
321 
322 	/* prevent new I/O requests */
323 	ps->dev = 0;
324 	ps->ifclaimed = 0;
325 
326 	/* force async requests to complete */
327 	destroy_all_async (ps);
328 
329 	up_write (&ps->devsem);
330 }
331 
332 struct usb_driver usbdevfs_driver = {
333 	name:		"usbdevfs",
334 	probe:		driver_probe,
335 	disconnect:	driver_disconnect,
336 };
337 
claimintf(struct dev_state * ps,unsigned int intf)338 static int claimintf(struct dev_state *ps, unsigned int intf)
339 {
340 	struct usb_device *dev = ps->dev;
341 	struct usb_interface *iface;
342 	int err;
343 
344 	if (intf >= 8*sizeof(ps->ifclaimed) || !dev || intf >= dev->actconfig->bNumInterfaces)
345 		return -EINVAL;
346 	/* already claimed */
347 	if (test_bit(intf, &ps->ifclaimed))
348 		return 0;
349 	iface = &dev->actconfig->interface[intf];
350 	err = -EBUSY;
351 	lock_kernel();
352 	if (!usb_interface_claimed(iface)) {
353 		usb_driver_claim_interface(&usbdevfs_driver, iface, ps);
354 		set_bit(intf, &ps->ifclaimed);
355 		err = 0;
356 	}
357 	unlock_kernel();
358 	return err;
359 }
360 
releaseintf(struct dev_state * ps,unsigned int intf)361 static int releaseintf(struct dev_state *ps, unsigned int intf)
362 {
363 	struct usb_device *dev;
364 	struct usb_interface *iface;
365 	int err;
366 
367 	if (intf >= 8*sizeof(ps->ifclaimed))
368 		return -EINVAL;
369 	err = -EINVAL;
370 	lock_kernel();
371 	dev = ps->dev;
372 	if (dev && test_and_clear_bit(intf, &ps->ifclaimed)) {
373 		iface = &dev->actconfig->interface[intf];
374 		usb_driver_release_interface(&usbdevfs_driver, iface);
375 		err = 0;
376 	}
377 	unlock_kernel();
378 	return err;
379 }
380 
checkintf(struct dev_state * ps,unsigned int intf)381 static int checkintf(struct dev_state *ps, unsigned int intf)
382 {
383 	if (intf >= 8*sizeof(ps->ifclaimed))
384 		return -EINVAL;
385 	if (test_bit(intf, &ps->ifclaimed))
386 		return 0;
387 	/* if not yet claimed, claim it for the driver */
388 	printk(KERN_WARNING "usbdevfs: process %d (%s) did not claim interface %u before use\n",
389 	       current->pid, current->comm, intf);
390 	return claimintf(ps, intf);
391 }
392 
findintfep(struct usb_device * dev,unsigned int ep)393 static int findintfep(struct usb_device *dev, unsigned int ep)
394 {
395 	unsigned int i, j, e;
396         struct usb_interface *iface;
397 	struct usb_interface_descriptor *alts;
398 	struct usb_endpoint_descriptor *endpt;
399 
400 	if (ep & ~(USB_DIR_IN|0xf))
401 		return -EINVAL;
402 	for (i = 0; i < dev->actconfig->bNumInterfaces; i++) {
403 		iface = &dev->actconfig->interface[i];
404 		for (j = 0; j < iface->num_altsetting; j++) {
405                         alts = &iface->altsetting[j];
406 			for (e = 0; e < alts->bNumEndpoints; e++) {
407 				endpt = &alts->endpoint[e];
408 				if (endpt->bEndpointAddress == ep)
409 					return i;
410 			}
411 		}
412 	}
413 	return -ENOENT;
414 }
415 
findintfif(struct usb_device * dev,unsigned int ifn)416 static int findintfif(struct usb_device *dev, unsigned int ifn)
417 {
418 	unsigned int i, j;
419         struct usb_interface *iface;
420 	struct usb_interface_descriptor *alts;
421 
422 	if (ifn & ~0xff)
423 		return -EINVAL;
424 	for (i = 0; i < dev->actconfig->bNumInterfaces; i++) {
425 		iface = &dev->actconfig->interface[i];
426 		for (j = 0; j < iface->num_altsetting; j++) {
427                         alts = &iface->altsetting[j];
428 			if (alts->bInterfaceNumber == ifn)
429 				return i;
430 		}
431 	}
432 	return -ENOENT;
433 }
434 
435 extern struct list_head usb_driver_list;
436 
437 #if 0
438 static int finddriver(struct usb_driver **driver, char *name)
439 {
440 	struct list_head *tmp;
441 
442 	tmp = usb_driver_list.next;
443 	while (tmp != &usb_driver_list) {
444 		struct usb_driver *d = list_entry(tmp, struct usb_driver,
445 							driver_list);
446 
447 		if (!strcmp(d->name, name)) {
448 			*driver = d;
449 			return 0;
450 		}
451 
452 		tmp = tmp->next;
453 	}
454 
455 	return -EINVAL;
456 }
457 #endif
458 
check_ctrlrecip(struct dev_state * ps,unsigned int requesttype,unsigned int index)459 static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype, unsigned int index)
460 {
461 	int ret;
462 
463 	if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
464 		return 0;
465 
466 	switch (requesttype & USB_RECIP_MASK) {
467 	case USB_RECIP_ENDPOINT:
468 		if ((ret = findintfep(ps->dev, index & 0xff)) < 0)
469 			return ret;
470 		if ((ret = checkintf(ps, ret)))
471 			return ret;
472 		break;
473 
474 	case USB_RECIP_INTERFACE:
475 		if ((ret = findintfif(ps->dev, index & 0xff)) < 0)
476 			return ret;
477 		if ((ret = checkintf(ps, ret)))
478 			return ret;
479 		break;
480 	}
481 	return 0;
482 }
483 
484 /*
485  * file operations
486  */
usbdev_open(struct inode * inode,struct file * file)487 static int usbdev_open(struct inode *inode, struct file *file)
488 {
489 	struct usb_device *dev;
490 	struct dev_state *ps;
491 	int ret;
492 
493 	/*
494 	 * no locking necessary here, as both sys_open (actually filp_open)
495 	 * and the hub thread have the kernel lock
496 	 * (still acquire the kernel lock for safety)
497 	 */
498 	lock_kernel();
499 	ret = -ENOENT;
500 	if (ITYPE(inode->i_ino) != IDEVICE)
501 		goto out;
502 	dev = inode->u.usbdev_i.p.dev;
503 	if (!dev)
504 		goto out;
505 	ret = -ENOMEM;
506 	if (!(ps = kmalloc(sizeof(struct dev_state), GFP_KERNEL)))
507 		goto out;
508 	ret = 0;
509 	ps->dev = dev;
510 	ps->file = file;
511 	spin_lock_init(&ps->lock);
512 	INIT_LIST_HEAD(&ps->async_pending);
513 	INIT_LIST_HEAD(&ps->async_completed);
514 	init_waitqueue_head(&ps->wait);
515 	init_rwsem(&ps->devsem);
516 	ps->discsignr = 0;
517 	ps->disctask = current;
518 	ps->disccontext = NULL;
519 	ps->ifclaimed = 0;
520 	wmb();
521 	list_add_tail(&ps->list, &dev->filelist);
522 	file->private_data = ps;
523  out:
524 	unlock_kernel();
525         return ret;
526 }
527 
usbdev_release(struct inode * inode,struct file * file)528 static int usbdev_release(struct inode *inode, struct file *file)
529 {
530 	struct dev_state *ps = (struct dev_state *)file->private_data;
531 	unsigned int i;
532 
533 	lock_kernel();
534 	list_del_init(&ps->list);
535 	if (ps->dev) {
536 		for (i = 0; ps->ifclaimed && i < 8*sizeof(ps->ifclaimed); i++)
537 			if (test_bit(i, &ps->ifclaimed))
538 				releaseintf(ps, i);
539 	}
540 	unlock_kernel();
541 	destroy_all_async(ps);
542 	kfree(ps);
543         return 0;
544 }
545 
proc_control(struct dev_state * ps,void * arg)546 static int proc_control(struct dev_state *ps, void *arg)
547 {
548 	struct usb_device *dev = ps->dev;
549 	struct usbdevfs_ctrltransfer ctrl;
550 	unsigned int tmo;
551 	unsigned char *tbuf;
552 	int i, ret;
553 
554 	if (copy_from_user(&ctrl, (void *)arg, sizeof(ctrl)))
555 		return -EFAULT;
556 	if ((ret = check_ctrlrecip(ps, ctrl.requesttype, ctrl.index)))
557 		return ret;
558 	if (ctrl.length > PAGE_SIZE)
559 		return -EINVAL;
560 	if (!(tbuf = (unsigned char *)__get_free_page(GFP_KERNEL)))
561 		return -ENOMEM;
562 	tmo = (ctrl.timeout * HZ + 999) / 1000;
563 	if (ctrl.requesttype & 0x80) {
564 		if (ctrl.length && !access_ok(VERIFY_WRITE, ctrl.data, ctrl.length)) {
565 			free_page((unsigned long)tbuf);
566 			return -EINVAL;
567 		}
568 		i = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), ctrl.request, ctrl.requesttype,
569 				       ctrl.value, ctrl.index, tbuf, ctrl.length, tmo);
570 		if ((i > 0) && ctrl.length) {
571 			if (copy_to_user(ctrl.data, tbuf, ctrl.length)) {
572 				free_page((unsigned long)tbuf);
573 				return -EFAULT;
574 			}
575 		}
576 	} else {
577 		if (ctrl.length) {
578 			if (copy_from_user(tbuf, ctrl.data, ctrl.length)) {
579 				free_page((unsigned long)tbuf);
580 				return -EFAULT;
581 			}
582 		}
583 		i = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ctrl.request, ctrl.requesttype,
584 				       ctrl.value, ctrl.index, tbuf, ctrl.length, tmo);
585 	}
586 	free_page((unsigned long)tbuf);
587 	if (i<0) {
588 		printk(KERN_DEBUG "usbdevfs: USBDEVFS_CONTROL failed dev %d rqt %u rq %u len %u ret %d\n",
589 		       dev->devnum, ctrl.requesttype, ctrl.request, ctrl.length, i);
590 	}
591 	return i;
592 }
593 
proc_bulk(struct dev_state * ps,void * arg)594 static int proc_bulk(struct dev_state *ps, void *arg)
595 {
596 	struct usb_device *dev = ps->dev;
597 	struct usbdevfs_bulktransfer bulk;
598 	unsigned int tmo, len1, pipe;
599 	int len2;
600 	unsigned char *tbuf;
601 	int i, ret;
602 
603 	if (copy_from_user(&bulk, (void *)arg, sizeof(bulk)))
604 		return -EFAULT;
605 	if ((ret = findintfep(ps->dev, bulk.ep)) < 0)
606 		return ret;
607 	if ((ret = checkintf(ps, ret)))
608 		return ret;
609 	if (bulk.ep & USB_DIR_IN)
610 		pipe = usb_rcvbulkpipe(dev, bulk.ep & 0x7f);
611 	else
612 		pipe = usb_sndbulkpipe(dev, bulk.ep & 0x7f);
613 	if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN)))
614 		return -EINVAL;
615 	len1 = bulk.len;
616 	if (len1 > PAGE_SIZE)
617 		return -EINVAL;
618 	if (!(tbuf = (unsigned char *)__get_free_page(GFP_KERNEL)))
619 		return -ENOMEM;
620 	tmo = (bulk.timeout * HZ + 999) / 1000;
621 	if (bulk.ep & 0x80) {
622 		if (len1 && !access_ok(VERIFY_WRITE, bulk.data, len1)) {
623 			free_page((unsigned long)tbuf);
624 			return -EINVAL;
625 		}
626 		if (usb_excl_lock(dev, 1, 1) != 0) {
627 			free_page((unsigned long)tbuf);
628 			return -ERESTARTSYS;
629 		}
630 		i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
631 		usb_excl_unlock(dev, 1);
632 		if (!i && len2) {
633 			if (copy_to_user(bulk.data, tbuf, len2)) {
634 				free_page((unsigned long)tbuf);
635 				return -EFAULT;
636 			}
637 		}
638 	} else {
639 		if (len1) {
640 			if (copy_from_user(tbuf, bulk.data, len1)) {
641 				free_page((unsigned long)tbuf);
642 				return -EFAULT;
643 			}
644 		}
645 		if (usb_excl_lock(dev, 2, 1) != 0) {
646 			free_page((unsigned long)tbuf);
647 			return -ERESTARTSYS;
648 		}
649 		i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
650 		usb_excl_unlock(dev, 2);
651 	}
652 	free_page((unsigned long)tbuf);
653 	if (i < 0) {
654 		printk(KERN_WARNING "usbdevfs: USBDEVFS_BULK failed dev %d ep 0x%x len %u ret %d\n",
655 		       dev->devnum, bulk.ep, bulk.len, i);
656 		return i;
657 	}
658 	return len2;
659 }
660 
proc_resetep(struct dev_state * ps,void * arg)661 static int proc_resetep(struct dev_state *ps, void *arg)
662 {
663 	unsigned int ep;
664 	int ret;
665 
666 	if (get_user(ep, (unsigned int *)arg))
667 		return -EFAULT;
668 	if ((ret = findintfep(ps->dev, ep)) < 0)
669 		return ret;
670 	if ((ret = checkintf(ps, ret)))
671 		return ret;
672 	usb_settoggle(ps->dev, ep & 0xf, !(ep & USB_DIR_IN), 0);
673 	return 0;
674 }
675 
proc_clearhalt(struct dev_state * ps,void * arg)676 static int proc_clearhalt(struct dev_state *ps, void *arg)
677 {
678 	unsigned int ep;
679 	int pipe;
680 	int ret;
681 
682 	if (get_user(ep, (unsigned int *)arg))
683 		return -EFAULT;
684 	if ((ret = findintfep(ps->dev, ep)) < 0)
685 		return ret;
686 	if ((ret = checkintf(ps, ret)))
687 		return ret;
688 	if (ep & USB_DIR_IN)
689                 pipe = usb_rcvbulkpipe(ps->dev, ep & 0x7f);
690         else
691                 pipe = usb_sndbulkpipe(ps->dev, ep & 0x7f);
692 
693 	return usb_clear_halt(ps->dev, pipe);
694 }
695 
696 
proc_getdriver(struct dev_state * ps,void * arg)697 static int proc_getdriver(struct dev_state *ps, void *arg)
698 {
699 	struct usbdevfs_getdriver gd;
700 	struct usb_interface *interface;
701 	int ret;
702 
703 	if (copy_from_user(&gd, arg, sizeof(gd)))
704 		return -EFAULT;
705 	if ((ret = findintfif(ps->dev, gd.interface)) < 0)
706 		return ret;
707 	interface = usb_ifnum_to_if(ps->dev, gd.interface);
708 	if (!interface)
709 		return -EINVAL;
710 	if (!interface->driver)
711 		return -ENODATA;
712 	strcpy(gd.driver, interface->driver->name);
713 	if (copy_to_user(arg, &gd, sizeof(gd)))
714 		return -EFAULT;
715 	return 0;
716 }
717 
proc_connectinfo(struct dev_state * ps,void * arg)718 static int proc_connectinfo(struct dev_state *ps, void *arg)
719 {
720 	struct usbdevfs_connectinfo ci;
721 
722 	ci.devnum = ps->dev->devnum;
723 	ci.slow = ps->dev->speed == USB_SPEED_LOW;
724 	if (copy_to_user(arg, &ci, sizeof(ci)))
725 		return -EFAULT;
726 	return 0;
727 }
728 
proc_resetdevice(struct dev_state * ps)729 static int proc_resetdevice(struct dev_state *ps)
730 {
731 	int i, ret;
732 
733 	ret = usb_reset_device(ps->dev);
734 	if (ret < 0)
735 		return ret;
736 
737 	for (i = 0; i < ps->dev->actconfig->bNumInterfaces; i++) {
738 		struct usb_interface *intf = &ps->dev->actconfig->interface[i];
739 
740 		/* Don't simulate interfaces we've claimed */
741 		if (test_bit(i, &ps->ifclaimed))
742 			continue;
743 
744 		if (intf->driver) {
745 			const struct usb_device_id *id;
746 			down(&intf->driver->serialize);
747 			intf->driver->disconnect(ps->dev, intf->private_data);
748 			id = usb_match_id(ps->dev,intf,intf->driver->id_table);
749 			intf->driver->probe(ps->dev, i, id);
750 			up(&intf->driver->serialize);
751 		}
752 	}
753 
754 	return 0;
755 }
756 
proc_setintf(struct dev_state * ps,void * arg)757 static int proc_setintf(struct dev_state *ps, void *arg)
758 {
759 	struct usbdevfs_setinterface setintf;
760 	struct usb_interface *interface;
761 	int ret;
762 
763 	if (copy_from_user(&setintf, arg, sizeof(setintf)))
764 		return -EFAULT;
765 	if ((ret = findintfif(ps->dev, setintf.interface)) < 0)
766 		return ret;
767 	interface = usb_ifnum_to_if(ps->dev, setintf.interface);
768 	if (!interface)
769 		return -EINVAL;
770 	if (interface->driver) {
771 		if ((ret = checkintf(ps, ret)))
772 			return ret;
773 	}
774 	if (usb_set_interface(ps->dev, setintf.interface, setintf.altsetting))
775 		return -EINVAL;
776 	return 0;
777 }
778 
proc_setconfig(struct dev_state * ps,void * arg)779 static int proc_setconfig(struct dev_state *ps, void *arg)
780 {
781 	unsigned int u;
782 
783 	if (get_user(u, (unsigned int *)arg))
784 		return -EFAULT;
785 	if (usb_set_configuration(ps->dev, u) < 0)
786 		return -EINVAL;
787 	return 0;
788 }
789 
proc_submiturb(struct dev_state * ps,void * arg)790 static int proc_submiturb(struct dev_state *ps, void *arg)
791 {
792 	struct usbdevfs_urb uurb;
793 	struct usbdevfs_iso_packet_desc *isopkt = NULL;
794 	struct usb_endpoint_descriptor *ep_desc;
795 	struct async *as;
796 	struct usb_ctrlrequest *dr = NULL;
797 	unsigned int u, totlen, isofrmlen;
798 	int ret;
799 	int intf = -1;
800 
801 	if (copy_from_user(&uurb, arg, sizeof(uurb)))
802 		return -EFAULT;
803 	if (uurb.flags & ~(USBDEVFS_URB_ISO_ASAP|USBDEVFS_URB_DISABLE_SPD|USBDEVFS_URB_QUEUE_BULK|
804 			   USB_NO_FSBR|USB_ZERO_PACKET))
805 		return -EINVAL;
806 	if (!uurb.buffer)
807 		return -EINVAL;
808 	if (uurb.signr != 0 && (uurb.signr < SIGRTMIN || uurb.signr > SIGRTMAX))
809 		return -EINVAL;
810 	if (!(uurb.type == USBDEVFS_URB_TYPE_CONTROL && (uurb.endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
811 		if ((intf = findintfep(ps->dev, uurb.endpoint)) < 0)
812 			return intf;
813 		if ((ret = checkintf(ps, intf)))
814 			return ret;
815 	}
816 	switch(uurb.type) {
817 	case USBDEVFS_URB_TYPE_CONTROL:
818 		if ((uurb.endpoint & ~USB_ENDPOINT_DIR_MASK) != 0) {
819 			if (!(ep_desc = usb_epnum_to_ep_desc(ps->dev, uurb.endpoint)))
820 				return -ENOENT;
821 			if ((ep_desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) != USB_ENDPOINT_XFER_CONTROL)
822 				return -EINVAL;
823 		}
824 		/* min 8 byte setup packet, max arbitrary */
825 		if (uurb.buffer_length < 8 || uurb.buffer_length > PAGE_SIZE)
826 			return -EINVAL;
827 		if (!(dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL)))
828 			return -ENOMEM;
829 		if (copy_from_user(dr, (unsigned char*)uurb.buffer, 8)) {
830 			kfree(dr);
831 			return -EFAULT;
832 		}
833 		if (uurb.buffer_length < (le16_to_cpup(&dr->wLength) + 8)) {
834 			kfree(dr);
835 			return -EINVAL;
836 		}
837 		if ((ret = check_ctrlrecip(ps, dr->bRequestType, le16_to_cpup(&dr->wIndex)))) {
838 			kfree(dr);
839 			return ret;
840 		}
841 		uurb.endpoint = (uurb.endpoint & ~USB_ENDPOINT_DIR_MASK) | (dr->bRequestType & USB_ENDPOINT_DIR_MASK);
842 		uurb.number_of_packets = 0;
843 		uurb.buffer_length = le16_to_cpup(&dr->wLength);
844 		uurb.buffer += 8;
845 		if (!access_ok((uurb.endpoint & USB_DIR_IN) ?  VERIFY_WRITE : VERIFY_READ, uurb.buffer, uurb.buffer_length)) {
846 			kfree(dr);
847 			return -EFAULT;
848 		}
849 		break;
850 
851 	case USBDEVFS_URB_TYPE_BULK:
852 		uurb.number_of_packets = 0;
853 		if (uurb.buffer_length > 16384)
854 			return -EINVAL;
855 		if (!access_ok((uurb.endpoint & USB_DIR_IN) ? VERIFY_WRITE : VERIFY_READ, uurb.buffer, uurb.buffer_length))
856 			return -EFAULT;
857 		break;
858 
859 	case USBDEVFS_URB_TYPE_ISO:
860 		/* arbitrary limit */
861 		if (uurb.number_of_packets < 1 || uurb.number_of_packets > 128)
862 			return -EINVAL;
863 		isofrmlen = sizeof(struct usbdevfs_iso_packet_desc) * uurb.number_of_packets;
864 		if (!(isopkt = kmalloc(isofrmlen, GFP_KERNEL)))
865 			return -ENOMEM;
866 		if (copy_from_user(isopkt, &((struct usbdevfs_urb *)arg)->iso_frame_desc, isofrmlen)) {
867 			kfree(isopkt);
868 			return -EFAULT;
869 		}
870 		for (totlen = u = 0; u < uurb.number_of_packets; u++) {
871 			if (isopkt[u].length > 1023) {
872 				kfree(isopkt);
873 				return -EINVAL;
874 			}
875 			totlen += isopkt[u].length;
876 		}
877 		if (totlen > 32768) {
878 			kfree(isopkt);
879 			return -EINVAL;
880 		}
881 		uurb.buffer_length = totlen;
882 		break;
883 
884 	case USBDEVFS_URB_TYPE_INTERRUPT:
885 		uurb.number_of_packets = 0;
886 		if (uurb.buffer_length > 16384)
887 			return -EINVAL;
888 		if (!access_ok((uurb.endpoint & USB_DIR_IN) ? VERIFY_WRITE : VERIFY_READ, uurb.buffer, uurb.buffer_length))
889 			return -EFAULT;
890 		break;
891 
892 	default:
893 		return -EINVAL;
894 	}
895 	if (!(as = alloc_async(uurb.number_of_packets))) {
896 		if (isopkt)
897 			kfree(isopkt);
898 		if (dr)
899 			kfree(dr);
900 		return -ENOMEM;
901 	}
902 	if (!(as->urb.transfer_buffer = kmalloc(uurb.buffer_length, GFP_KERNEL))) {
903 		if (isopkt)
904 			kfree(isopkt);
905 		if (dr)
906 			kfree(dr);
907 		free_async(as);
908 		return -ENOMEM;
909 	}
910         as->urb.next = NULL;
911         as->urb.dev = ps->dev;
912         as->urb.pipe = (uurb.type << 30) | __create_pipe(ps->dev, uurb.endpoint & 0xf) | (uurb.endpoint & USB_DIR_IN);
913         as->urb.transfer_flags = uurb.flags;
914 	as->urb.transfer_buffer_length = uurb.buffer_length;
915 	as->urb.setup_packet = (unsigned char*)dr;
916 	as->urb.start_frame = uurb.start_frame;
917 	as->urb.number_of_packets = uurb.number_of_packets;
918         as->urb.context = as;
919         as->urb.complete = async_completed;
920 	for (totlen = u = 0; u < uurb.number_of_packets; u++) {
921 		as->urb.iso_frame_desc[u].offset = totlen;
922 		as->urb.iso_frame_desc[u].length = isopkt[u].length;
923 		totlen += isopkt[u].length;
924 	}
925 	if (isopkt)
926 		kfree(isopkt);
927 	as->ps = ps;
928         as->userurb = arg;
929 	if (uurb.endpoint & USB_DIR_IN)
930 		as->userbuffer = uurb.buffer;
931 	else
932 		as->userbuffer = NULL;
933 	as->signr = uurb.signr;
934 	as->intf = intf;
935 	as->task = current;
936 	if (!(uurb.endpoint & USB_DIR_IN)) {
937 		if (copy_from_user(as->urb.transfer_buffer, uurb.buffer, as->urb.transfer_buffer_length)) {
938 			free_async(as);
939 			return -EFAULT;
940 		}
941 	}
942         async_newpending(as);
943         if ((ret = usb_submit_urb(&as->urb))) {
944 		printk(KERN_DEBUG "usbdevfs: usb_submit_urb returned %d\n", ret);
945                 async_removepending(as);
946                 free_async(as);
947                 return ret;
948         }
949         return 0;
950 }
951 
proc_unlinkurb(struct dev_state * ps,void * arg)952 static int proc_unlinkurb(struct dev_state *ps, void *arg)
953 {
954 	struct async *as;
955 
956 	as = async_getpending(ps, arg);
957 	if (!as)
958 		return -EINVAL;
959 	usb_unlink_urb(&as->urb);
960 	return 0;
961 }
962 
processcompl(struct async * as)963 static int processcompl(struct async *as)
964 {
965 	unsigned int i;
966 
967 	if (as->userbuffer)
968 		if (copy_to_user(as->userbuffer, as->urb.transfer_buffer, as->urb.transfer_buffer_length))
969 			return -EFAULT;
970 	if (put_user(as->urb.status,
971 		     &((struct usbdevfs_urb *)as->userurb)->status))
972 		return -EFAULT;
973 	if (put_user(as->urb.actual_length,
974 		     &((struct usbdevfs_urb *)as->userurb)->actual_length))
975 		return -EFAULT;
976 	if (put_user(as->urb.error_count,
977 		     &((struct usbdevfs_urb *)as->userurb)->error_count))
978 		return -EFAULT;
979 
980 	if (!(usb_pipeisoc(as->urb.pipe)))
981 		return 0;
982 	for (i = 0; i < as->urb.number_of_packets; i++) {
983 		if (put_user(as->urb.iso_frame_desc[i].actual_length,
984 			     &((struct usbdevfs_urb *)as->userurb)->iso_frame_desc[i].actual_length))
985 			return -EFAULT;
986 		if (put_user(as->urb.iso_frame_desc[i].status,
987 			     &((struct usbdevfs_urb *)as->userurb)->iso_frame_desc[i].status))
988 			return -EFAULT;
989 	}
990 	return 0;
991 }
992 
proc_reapurb(struct dev_state * ps,void * arg)993 static int proc_reapurb(struct dev_state *ps, void *arg)
994 {
995         DECLARE_WAITQUEUE(wait, current);
996 	struct async *as = NULL;
997 	void *addr;
998 	int ret;
999 
1000 	add_wait_queue(&ps->wait, &wait);
1001 	while (ps->dev) {
1002 		__set_current_state(TASK_INTERRUPTIBLE);
1003 		if ((as = async_getcompleted(ps)))
1004 			break;
1005 		if (signal_pending(current))
1006 			break;
1007 		up_read(&ps->devsem);
1008 		schedule();
1009 		down_read(&ps->devsem);
1010 	}
1011 	remove_wait_queue(&ps->wait, &wait);
1012 	set_current_state(TASK_RUNNING);
1013 	if (as) {
1014 		ret = processcompl(as);
1015 		addr = as->userurb;
1016 		free_async(as);
1017 		if (ret)
1018 			return ret;
1019 		if (put_user(addr, (void **)arg))
1020 			return -EFAULT;
1021 		return 0;
1022 	}
1023 	if (signal_pending(current))
1024 		return -EINTR;
1025 	return -EIO;
1026 }
1027 
proc_reapurbnonblock(struct dev_state * ps,void * arg)1028 static int proc_reapurbnonblock(struct dev_state *ps, void *arg)
1029 {
1030 	struct async *as;
1031 	void *addr;
1032 	int ret;
1033 
1034 	if (!(as = async_getcompleted(ps)))
1035 		return -EAGAIN;
1036 	ret = processcompl(as);
1037 	addr = as->userurb;
1038 	free_async(as);
1039 	if (ret)
1040 		return ret;
1041 	if (put_user(addr, (void **)arg))
1042 		return -EFAULT;
1043 	return 0;
1044 }
1045 
proc_disconnectsignal(struct dev_state * ps,void * arg)1046 static int proc_disconnectsignal(struct dev_state *ps, void *arg)
1047 {
1048 	struct usbdevfs_disconnectsignal ds;
1049 
1050 	if (copy_from_user(&ds, arg, sizeof(ds)))
1051 		return -EFAULT;
1052 	if (ds.signr != 0 && (ds.signr < SIGRTMIN || ds.signr > SIGRTMAX))
1053 		return -EINVAL;
1054 	ps->discsignr = ds.signr;
1055 	ps->disccontext = ds.context;
1056 	return 0;
1057 }
1058 
proc_claiminterface(struct dev_state * ps,void * arg)1059 static int proc_claiminterface(struct dev_state *ps, void *arg)
1060 {
1061 	unsigned int intf;
1062 	int ret;
1063 
1064 	if (get_user(intf, (unsigned int *)arg))
1065 		return -EFAULT;
1066 	if ((ret = findintfif(ps->dev, intf)) < 0)
1067 		return ret;
1068 	return claimintf(ps, ret);
1069 }
1070 
proc_releaseinterface(struct dev_state * ps,void * arg)1071 static int proc_releaseinterface(struct dev_state *ps, void *arg)
1072 {
1073 	unsigned int intf;
1074 	int ret;
1075 
1076 	if (get_user(intf, (unsigned int *)arg))
1077 		return -EFAULT;
1078 	if ((ret = findintfif(ps->dev, intf)) < 0)
1079 		return ret;
1080 	if ((ret = releaseintf(ps, intf)) < 0)
1081 		return ret;
1082 	destroy_async_on_interface (ps, intf);
1083 	return 0;
1084 }
1085 
proc_ioctl(struct dev_state * ps,void * arg)1086 static int proc_ioctl (struct dev_state *ps, void *arg)
1087 {
1088 	struct usbdevfs_ioctl	ctrl;
1089 	int			size;
1090 	void			*buf = 0;
1091 	int			retval = 0;
1092        struct usb_interface    *ifp = 0;
1093        struct usb_driver       *driver = 0;
1094 
1095 	/* get input parameters and alloc buffer */
1096 	if (copy_from_user(&ctrl, (void *) arg, sizeof (ctrl)))
1097 		return -EFAULT;
1098 	if ((size = _IOC_SIZE (ctrl.ioctl_code)) > 0) {
1099 		if ((buf = kmalloc (size, GFP_KERNEL)) == 0)
1100 			return -ENOMEM;
1101 		if ((_IOC_DIR(ctrl.ioctl_code) & _IOC_WRITE)) {
1102 			if (copy_from_user (buf, ctrl.data, size)) {
1103 				kfree (buf);
1104 				return -EFAULT;
1105 			}
1106 		} else {
1107 			memset (buf, 0, size);
1108 		}
1109 	}
1110 
1111        if (!ps->dev)
1112                retval = -ENODEV;
1113        else if (!(ifp = usb_ifnum_to_if (ps->dev, ctrl.ifno)))
1114                retval = -EINVAL;
1115        else switch (ctrl.ioctl_code) {
1116 
1117        /* disconnect kernel driver from interface, leaving it unbound.  */
1118        case USBDEVFS_DISCONNECT:
1119                driver = ifp->driver;
1120                if (driver) {
1121                        down (&driver->serialize);
1122                        dbg ("disconnect '%s' from dev %d interface %d",
1123                                driver->name, ps->dev->devnum, ctrl.ifno);
1124                        driver->disconnect (ps->dev, ifp->private_data);
1125                        usb_driver_release_interface (driver, ifp);
1126                        up (&driver->serialize);
1127                } else
1128                        retval = -ENODATA;
1129                break;
1130 
1131        /* let kernel drivers try to (re)bind to the interface */
1132        case USBDEVFS_CONNECT:
1133                usb_find_interface_driver_for_ifnum (ps->dev, ctrl.ifno);
1134                break;
1135 
1136        /* talk directly to the interface's driver */
1137        default:
1138                driver = ifp->driver;
1139                if (driver == 0 || driver->ioctl == 0)
1140                        retval = -ENOSYS;
1141 		else {
1142 			/* ifno might usefully be passed ... */
1143                        retval = driver->ioctl (ps->dev, ctrl.ioctl_code, buf);
1144 			/* size = min_t(int, size, retval)? */
1145 			if (retval == -ENOIOCTLCMD)
1146 				retval = -ENOTTY;
1147                }
1148 	}
1149 
1150 	/* cleanup and return */
1151 	if (retval >= 0
1152 			&& (_IOC_DIR (ctrl.ioctl_code) & _IOC_READ) != 0
1153 			&& size > 0
1154 			&& copy_to_user (ctrl.data, buf, size) != 0)
1155 		retval = -EFAULT;
1156 	if (buf != 0)
1157 		kfree (buf);
1158 	return retval;
1159 }
1160 
usbdev_ioctl_exclusive(struct dev_state * ps,struct inode * inode,unsigned int cmd,unsigned long arg)1161 static int usbdev_ioctl_exclusive(struct dev_state *ps, struct inode *inode,
1162 				  unsigned int cmd, unsigned long arg)
1163 {
1164 	int ret;
1165 
1166 	switch (cmd) {
1167 	case USBDEVFS_CONTROL:
1168 		ret = proc_control(ps, (void *)arg);
1169 		if (ret >= 0)
1170 			inode->i_mtime = CURRENT_TIME;
1171 		break;
1172 
1173 	case USBDEVFS_RESETEP:
1174 		ret = proc_resetep(ps, (void *)arg);
1175 		if (ret >= 0)
1176 			inode->i_mtime = CURRENT_TIME;
1177 		break;
1178 
1179 	case USBDEVFS_RESET:
1180 		ret = proc_resetdevice(ps);
1181 		break;
1182 
1183 	case USBDEVFS_CLEAR_HALT:
1184 		ret = proc_clearhalt(ps, (void *)arg);
1185 		if (ret >= 0)
1186 			inode->i_mtime = CURRENT_TIME;
1187 		break;
1188 
1189 	case USBDEVFS_SETINTERFACE:
1190 		ret = proc_setintf(ps, (void *)arg);
1191 		break;
1192 
1193 	case USBDEVFS_SETCONFIGURATION:
1194 		ret = proc_setconfig(ps, (void *)arg);
1195 		break;
1196 
1197 	case USBDEVFS_SUBMITURB:
1198 		ret = proc_submiturb(ps, (void *)arg);
1199 		if (ret >= 0)
1200 			inode->i_mtime = CURRENT_TIME;
1201 		break;
1202 
1203 	case USBDEVFS_DISCARDURB:
1204 		ret = proc_unlinkurb(ps, (void *)arg);
1205 		break;
1206 
1207 	case USBDEVFS_CLAIMINTERFACE:
1208 		ret = proc_claiminterface(ps, (void *)arg);
1209 		break;
1210 
1211 	case USBDEVFS_RELEASEINTERFACE:
1212 		ret = proc_releaseinterface(ps, (void *)arg);
1213 		break;
1214 
1215 	case USBDEVFS_IOCTL:
1216 		ret = proc_ioctl(ps, (void *) arg);
1217 		break;
1218 
1219 	default:
1220 		ret = -ENOTTY;
1221 	}
1222 	return ret;
1223 }
1224 
usbdev_ioctl(struct inode * inode,struct file * file,unsigned int cmd,unsigned long arg)1225 static int usbdev_ioctl(struct inode *inode, struct file *file,
1226 			unsigned int cmd, unsigned long arg)
1227 {
1228 	struct dev_state *ps = file->private_data;
1229 	int ret;
1230 
1231 	if (!(file->f_mode & FMODE_WRITE))
1232 		return -EPERM;
1233 	down_read(&ps->devsem);
1234 	if (!ps->dev) {
1235 		up_read(&ps->devsem);
1236 		return -ENODEV;
1237 	}
1238 
1239 	/*
1240 	 * Some ioctls don't touch the device and can be called without
1241 	 * grabbing its exclusive_access mutex; they are handled in this
1242 	 * switch.  Other ioctls which need exclusive_access are handled in
1243 	 * usbdev_ioctl_exclusive().
1244 	 */
1245 	switch (cmd) {
1246 	case USBDEVFS_GETDRIVER:
1247 		ret = proc_getdriver(ps, (void *)arg);
1248 		break;
1249 
1250 	case USBDEVFS_CONNECTINFO:
1251 		ret = proc_connectinfo(ps, (void *)arg);
1252 		break;
1253 
1254 	case USBDEVFS_REAPURB:
1255 		ret = proc_reapurb(ps, (void *)arg);
1256 		break;
1257 
1258 	case USBDEVFS_REAPURBNDELAY:
1259 		ret = proc_reapurbnonblock(ps, (void *)arg);
1260 		break;
1261 
1262 	case USBDEVFS_DISCSIGNAL:
1263 		ret = proc_disconnectsignal(ps, (void *)arg);
1264 		break;
1265 
1266 	case USBDEVFS_BULK:
1267 		ret = proc_bulk(ps, (void *)arg);
1268 		if (ret >= 0)
1269 			inode->i_mtime = CURRENT_TIME;
1270 		break;
1271 
1272 	case USBDEVFS_CONTROL:
1273 	case USBDEVFS_RESETEP:
1274 	case USBDEVFS_RESET:
1275 	case USBDEVFS_CLEAR_HALT:
1276 	case USBDEVFS_SETINTERFACE:
1277 	case USBDEVFS_SETCONFIGURATION:
1278 	case USBDEVFS_SUBMITURB:
1279 	case USBDEVFS_DISCARDURB:
1280 	case USBDEVFS_CLAIMINTERFACE:
1281 	case USBDEVFS_RELEASEINTERFACE:
1282 	case USBDEVFS_IOCTL:
1283 		ret = -ERESTARTSYS;
1284 		if (usb_excl_lock(ps->dev, 3, 1) == 0) {
1285 			ret = usbdev_ioctl_exclusive(ps, inode, cmd, arg);
1286 			usb_excl_unlock(ps->dev, 3);
1287 		}
1288 		break;
1289 
1290 	default:
1291 		ret = -ENOTTY;
1292 	}
1293 	up_read(&ps->devsem);
1294 	if (ret >= 0)
1295 		inode->i_atime = CURRENT_TIME;
1296 	return ret;
1297 }
1298 
1299 /* No kernel lock - fine */
usbdev_poll(struct file * file,struct poll_table_struct * wait)1300 static unsigned int usbdev_poll(struct file *file, struct poll_table_struct *wait)
1301 {
1302 	struct dev_state *ps = (struct dev_state *)file->private_data;
1303         unsigned int mask = 0;
1304 
1305 	poll_wait(file, &ps->wait, wait);
1306 	if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
1307 		mask |= POLLOUT | POLLWRNORM;
1308 	if (!ps->dev)
1309 		mask |= POLLERR | POLLHUP;
1310 	return mask;
1311 }
1312 
1313 struct file_operations usbdevfs_device_file_operations = {
1314 	llseek:		usbdev_lseek,
1315 	read:		usbdev_read,
1316 	poll:		usbdev_poll,
1317 	ioctl:		usbdev_ioctl,
1318 	open:		usbdev_open,
1319 	release:	usbdev_release,
1320 };
1321