/*****************************************************************************/ /* *      devio.c  --  User space communication with USB devices. * *      Copyright (C) 1999-2000  Thomas Sailer (sailer@ife.ee.ethz.ch) * *      This program is free software; you can redistribute it and/or modify *      it under the terms of the GNU General Public License as published by *      the Free Software Foundation; either version 2 of the License, or *      (at your option) any later version. * *      This program is distributed in the hope that it will be useful, *      but WITHOUT ANY WARRANTY; without even the implied warranty of *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the *      GNU General Public License for more details. * *      You should have received a copy of the GNU General Public License *      along with this program; if not, write to the Free Software *      Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. * *  This file implements the usbfs/x/y files, where *  x is the bus number and y the device number. * *  It allows user space programs/"drivers" to communicate directly *  with USB devices without intervening kernel driver. * *  Revision history *    22.12.1999   0.1   Initial release (split from proc_usb.c) *    04.01.2000   0.2   Turned into its own filesystem *    30.09.2005   0.3   Fix user-triggerable oops in async URB delivery *    			 (CAN-2005-3055) */ /*****************************************************************************/ #include <linux/fs.h>#include <linux/mm.h>#include <linux/slab.h>#include <linux/signal.h>#include <linux/poll.h>#include <linux/module.h>#include <linux/string.h>#include <linux/usb.h>#include <linux/usbdevice_fs.h>#include <linux/usb/hcd.h>	/* for usbcore internals */#include <linux/cdev.h>#include <linux/notifier.h>#include <linux/security.h>#include <linux/user_namespace.h>#include <linux/scatterlist.h>#include <linux/uaccess.h>#include <linux/dma-mapping.h>#include <asm/byteorder.h>#include <linux/moduleparam.h> #include "usb.h" #define USB_MAXBUS			64#define USB_DEVICE_MAX			(USB_MAXBUS * 128)#define USB_SG_SIZE			16384 /* split-size for large txs */ /* Mutual exclusion for removal, open, and release */DEFINE_MUTEX(usbfs_mutex); struct usb_dev_state {	struct list_head list;      /* state list */	struct usb_device *dev;	struct file *file;	spinlock_t lock;            /* protects the async urb lists */	struct list_head async_pending;	struct list_head async_completed;	struct list_head memory_list;	wait_queue_head_t wait;     /* wake up if a request completed */	unsigned int discsignr;	struct pid *disc_pid;	const struct cred *cred;	void __user *disccontext;	unsigned long ifclaimed;	u32 secid;	u32 disabled_bulk_eps;	bool privileges_dropped;	unsigned long interface_allowed_mask;}; struct usb_memory {	struct list_head memlist;	int vma_use_count;	int urb_use_count;	u32 size;	void *mem;	dma_addr_t dma_handle;	unsigned long vm_start;	struct usb_dev_state *ps;}; struct async {	struct list_head asynclist;	struct usb_dev_state *ps;	struct pid *pid;	const struct cred *cred;	unsigned int signr;	unsigned int ifnum;	void __user *userbuffer;	void __user *userurb;	struct urb *urb;	struct usb_memory *usbm;	unsigned int mem_usage;	int status;	u32 secid;	u8 bulk_addr;	u8 bulk_status;}; static bool usbfs_snoop;module_param(usbfs_snoop, bool, S_IRUGO | S_IWUSR);MODULE_PARM_DESC(usbfs_snoop, "true to log all usbfs traffic"); static unsigned usbfs_snoop_max = 65536;module_param(usbfs_snoop_max, uint, S_IRUGO | S_IWUSR);MODULE_PARM_DESC(usbfs_snoop_max,		"maximum number of bytes to print while snooping"); #define snoop(dev, format, arg...)				\	do {							\		if (usbfs_snoop)				\			dev_info(dev, format, ## arg);		\	} while (0) enum snoop_when {	SUBMIT, COMPLETE}; #define USB_DEVICE_DEV		MKDEV(USB_DEVICE_MAJOR, 0) /* Limit on the total amount of memory we can allocate for transfers */static unsigned usbfs_memory_mb = 16;module_param(usbfs_memory_mb, uint, 0644);MODULE_PARM_DESC(usbfs_memory_mb,		"maximum MB allowed for usbfs buffers (0 = no limit)"); /* Hard limit, necessary to avoid arithmetic overflow */#define USBFS_XFER_MAX		(UINT_MAX / 2 - 1000000) static atomic_t usbfs_memory_usage;	/* Total memory currently allocated */ /* Check whether it's okay to allocate more memory for a transfer */static int usbfs_increase_memory_usage(unsigned amount){	unsigned lim; 	/*	 * Convert usbfs_memory_mb to bytes, avoiding overflows.	 * 0 means use the hard limit (effectively unlimited).	 */	lim = ACCESS_ONCE(usbfs_memory_mb);	if (lim == 0 || lim > (USBFS_XFER_MAX >> 20))		lim = USBFS_XFER_MAX;	else		lim <<= 20; 	atomic_add(amount, &usbfs_memory_usage);	if (atomic_read(&usbfs_memory_usage) <= lim)		return 0;	atomic_sub(amount, &usbfs_memory_usage);	return -ENOMEM;} /* Memory for a transfer is being deallocated */static void usbfs_decrease_memory_usage(unsigned amount){	atomic_sub(amount, &usbfs_memory_usage);} static int connected(struct usb_dev_state *ps){	return (!list_empty(&ps->list) &&			ps->dev->state != USB_STATE_NOTATTACHED);} static void dec_usb_memory_use_count(struct usb_memory *usbm, int *count){	struct usb_dev_state *ps = usbm->ps;	unsigned long flags; 	spin_lock_irqsave(&ps->lock, flags);	--*count;	if (usbm->urb_use_count == 0 && usbm->vma_use_count == 0) {		list_del(&usbm->memlist);		spin_unlock_irqrestore(&ps->lock, flags); 		usb_free_coherent(ps->dev, usbm->size, usbm->mem,				usbm->dma_handle);		usbfs_decrease_memory_usage(			usbm->size + sizeof(struct usb_memory));		kfree(usbm);	} else {		spin_unlock_irqrestore(&ps->lock, flags);	}} static void usbdev_vm_open(struct vm_area_struct *vma){	struct usb_memory *usbm = vma->vm_private_data;	unsigned long flags; 	spin_lock_irqsave(&usbm->ps->lock, flags);	++usbm->vma_use_count;	spin_unlock_irqrestore(&usbm->ps->lock, flags);} static void usbdev_vm_close(struct vm_area_struct *vma){	struct usb_memory *usbm = vma->vm_private_data; 	dec_usb_memory_use_count(usbm, &usbm->vma_use_count);} static struct vm_operations_struct usbdev_vm_ops = {	.open = usbdev_vm_open,	.close = usbdev_vm_close}; static int usbdev_mmap(struct file *file, struct vm_area_struct *vma){	struct usb_memory *usbm = NULL;	struct usb_dev_state *ps = file->private_data;	size_t size = vma->vm_end - vma->vm_start;	void *mem;	unsigned long flags;	dma_addr_t dma_handle;	int ret; 	ret = usbfs_increase_memory_usage(size + sizeof(struct usb_memory));	if (ret)		goto error; 	usbm = kzalloc(sizeof(struct usb_memory), GFP_KERNEL);	if (!usbm) {		ret = -ENOMEM;		goto error_decrease_mem;	} 	mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN,			&dma_handle);	if (!mem) {		ret = -ENOMEM;		goto error_free_usbm;	} 	memset(mem, 0, size); 	usbm->mem = mem;	usbm->dma_handle = dma_handle;	usbm->size = size;	usbm->ps = ps;	usbm->vm_start = vma->vm_start;	usbm->vma_use_count = 1;	INIT_LIST_HEAD(&usbm->memlist); 	if (remap_pfn_range(vma, vma->vm_start,			virt_to_phys(usbm->mem) >> PAGE_SHIFT,			size, vma->vm_page_prot) < 0) {		dec_usb_memory_use_count(usbm, &usbm->vma_use_count);		return -EAGAIN;	} 	vma->vm_flags |= VM_IO;	vma->vm_flags |= (VM_DONTEXPAND | VM_DONTDUMP);	vma->vm_ops = &usbdev_vm_ops;	vma->vm_private_data = usbm; 	spin_lock_irqsave(&ps->lock, flags);	list_add_tail(&usbm->memlist, &ps->memory_list);	spin_unlock_irqrestore(&ps->lock, flags); 	return 0; error_free_usbm:	kfree(usbm);error_decrease_mem:	usbfs_decrease_memory_usage(size + sizeof(struct usb_memory));error:	return ret;} static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,			   loff_t *ppos){	struct usb_dev_state *ps = file->private_data;	struct usb_device *dev = ps->dev;	ssize_t ret = 0;	unsigned len;	loff_t pos;	int i; 	pos = *ppos;	usb_lock_device(dev);	if (!connected(ps)) {		ret = -ENODEV;		goto err;	} else if (pos < 0) {		ret = -EINVAL;		goto err;	} 	if (pos < sizeof(struct usb_device_descriptor)) {		/* 18 bytes - fits on the stack */		struct usb_device_descriptor temp_desc; 		memcpy(&temp_desc, &dev->descriptor, sizeof(dev->descriptor));		le16_to_cpus(&temp_desc.bcdUSB);		le16_to_cpus(&temp_desc.idVendor);		le16_to_cpus(&temp_desc.idProduct);		le16_to_cpus(&temp_desc.bcdDevice); 		len = sizeof(struct usb_device_descriptor) - pos;		if (len > nbytes)			len = nbytes;		if (copy_to_user(buf, ((char *)&temp_desc) + pos, len)) {			ret = -EFAULT;			goto err;		} 		*ppos += len;		buf += len;		nbytes -= len;		ret += len;	} 	pos = sizeof(struct usb_device_descriptor);	for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {		struct usb_config_descriptor *config =			(struct usb_config_descriptor *)dev->rawdescriptors[i];		unsigned int length = le16_to_cpu(config->wTotalLength); 		if (*ppos < pos + length) { 			/* The descriptor may claim to be longer than it			 * really is.  Here is the actual allocated length. */			unsigned alloclen =				le16_to_cpu(dev->config[i].desc.wTotalLength); 			len = length - (*ppos - pos);			if (len > nbytes)				len = nbytes; 			/* Simply don't write (skip over) unallocated parts */			if (alloclen > (*ppos - pos)) {				alloclen -= (*ppos - pos);				if (copy_to_user(buf,				    dev->rawdescriptors[i] + (*ppos - pos),				    min(len, alloclen))) {					ret = -EFAULT;					goto err;				}			} 			*ppos += len;			buf += len;			nbytes -= len;			ret += len;		} 		pos += length;	} err:	usb_unlock_device(dev);	return ret;} /* * async list handling */ static struct async *alloc_async(unsigned int numisoframes){	struct async *as; 	as = kzalloc(sizeof(struct async), GFP_KERNEL);	if (!as)		return NULL;	as->urb = usb_alloc_urb(numisoframes, GFP_KERNEL);	if (!as->urb) {		kfree(as);		return NULL;	}	return as;} static void free_async(struct async *as){	int i; 	put_pid(as->pid);	if (as->cred)		put_cred(as->cred);	for (i = 0; i < as->urb->num_sgs; i++) {		if (sg_page(&as->urb->sg[i]))			kfree(sg_virt(&as->urb->sg[i]));	} 	kfree(as->urb->sg);	if (as->usbm == NULL)		kfree(as->urb->transfer_buffer);	else		dec_usb_memory_use_count(as->usbm, &as->usbm->urb_use_count); 	kfree(as->urb->setup_packet);	usb_free_urb(as->urb);	usbfs_decrease_memory_usage(as->mem_usage);	kfree(as);} static void async_newpending(struct async *as){	struct usb_dev_state *ps = as->ps;	unsigned long flags; 	spin_lock_irqsave(&ps->lock, flags);	list_add_tail(&as->asynclist, &ps->async_pending);	spin_unlock_irqrestore(&ps->lock, flags);} static void async_removepending(struct async *as){	struct usb_dev_state *ps = as->ps;	unsigned long flags; 	spin_lock_irqsave(&ps->lock, flags);	list_del_init(&as->asynclist);	spin_unlock_irqrestore(&ps->lock, flags);} static struct async *async_getcompleted(struct usb_dev_state *ps){	unsigned long flags;	struct async *as = NULL; 	spin_lock_irqsave(&ps->lock, flags);	if (!list_empty(&ps->async_completed)) {		as = list_entry(ps->async_completed.next, struct async,				asynclist);		list_del_init(&as->asynclist);	}	spin_unlock_irqrestore(&ps->lock, flags);	return as;} static struct async *async_getpending(struct usb_dev_state *ps,					     void __user *userurb){	struct async *as; 	list_for_each_entry(as, &ps->async_pending, asynclist)		if (as->userurb == userurb) {			list_del_init(&as->asynclist);			return as;		} 	return NULL;} static void snoop_urb(struct usb_device *udev,		void __user *userurb, int pipe, unsigned length,		int timeout_or_status, enum snoop_when when,		unsigned char *data, unsigned data_len){	static const char *types[] = {"isoc", "int", "ctrl", "bulk"};	static const char *dirs[] = {"out", "in"};	int ep;	const char *t, *d; 	if (!usbfs_snoop)		return; 	ep = usb_pipeendpoint(pipe);	t = types[usb_pipetype(pipe)];	d = dirs[!!usb_pipein(pipe)]; 	if (userurb) {		/* Async */		if (when == SUBMIT)			dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "					"length %u\n",					userurb, ep, t, d, length);		else			dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "					"actual_length %u status %d\n",					userurb, ep, t, d, length,					timeout_or_status);	} else {		if (when == SUBMIT)			dev_info(&udev->dev, "ep%d %s-%s, length %u, "					"timeout %d\n",					ep, t, d, length, timeout_or_status);		else			dev_info(&udev->dev, "ep%d %s-%s, actual_length %u, "					"status %d\n",					ep, t, d, length, timeout_or_status);

Lines 1–500 of 2684. Load more