libusb/os/linux_usbfs.c

   1 /* -*- Mode: C; c-basic-offset:8 ; indent-tabs-mode:t -*- */
   2 /*
   3  * Linux usbfs backend for libusb
   4  * Copyright © 2007-2009 Daniel Drake <dsd@gentoo.org>
   5  * Copyright © 2001 Johannes Erdfelt <johannes@erdfelt.com>
   6  * Copyright © 2013 Nathan Hjelm <hjelmn@mac.com>
   7  * Copyright © 2012-2013 Hans de Goede <hdegoede@redhat.com>
   8  * Copyright © 2020 Chris Dickens <christopher.a.dickens@gmail.com>
   9  *
  10  * This library is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU Lesser General Public
  12  * License as published by the Free Software Foundation; either
  13  * version 2.1 of the License, or (at your option) any later version.
  14  *
  15  * This library is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18  * Lesser General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU Lesser General Public
  21  * License along with this library; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  23  */
  24
  25 #include "libusbi.h"
  26 #include "linux_usbfs.h"
  27
  28 #include <alloca.h>
  29 #include <ctype.h>
  30 #include <dirent.h>
  31 #include <errno.h>
  32 #include <fcntl.h>
  33 #include <stdio.h>
  34 #include <string.h>
  35 #include <sys/ioctl.h>
  36 #include <sys/mman.h>
  37 #include <sys/utsname.h>
  38 #include <sys/vfs.h>
  39 #include <unistd.h>
  40
  41 /* sysfs vs usbfs:
  42  * opening a usbfs node causes the device to be resumed, so we attempt to
  43  * avoid this during enumeration.
  44  *
  45  * sysfs allows us to read the kernel's in-memory copies of device descriptors
  46  * and so forth, avoiding the need to open the device:
  47  *  - The binary "descriptors" file contains all config descriptors since
  48  *    2.6.26, commit 217a9081d8e69026186067711131b77f0ce219ed
  49  *  - The binary "descriptors" file was added in 2.6.23, commit
  50  *    69d42a78f935d19384d1f6e4f94b65bb162b36df, but it only contains the
  51  *    active config descriptors
  52  *  - The "busnum" file was added in 2.6.22, commit
  53  *    83f7d958eab2fbc6b159ee92bf1493924e1d0f72
  54  *  - The "devnum" file has been present since pre-2.6.18
  55  *  - the "bConfigurationValue" file has been present since pre-2.6.18
  56  *
  57  * If we have bConfigurationValue, busnum, and devnum, then we can determine
  58  * the active configuration without having to open the usbfs node in RDWR mode.
  59  * The busnum file is important as that is the only way we can relate sysfs
  60  * devices to usbfs nodes.
  61  *
  62  * If we also have all descriptors, we can obtain the device descriptor and
  63  * configuration without touching usbfs at all.
  64  */
  65
  66 /* endianness for multi-byte fields:
  67  *
  68  * Descriptors exposed by usbfs have the multi-byte fields in the device
  69  * descriptor as host endian. Multi-byte fields in the other descriptors are
  70  * bus-endian. The kernel documentation says otherwise, but it is wrong.
  71  *
  72  * In sysfs all descriptors are bus-endian.
  73  */
  74
  75 #define USBDEV_PATH             "/dev"
  76 #define USB_DEVTMPFS_PATH       "/dev/bus/usb"
  77
  78 /* use usbdev*.* device names in /dev instead of the usbfs bus directories */
  79 static int usbdev_names = 0;
  80
  81 /* Linux has changed the maximum length of an individual isochronous packet
  82  * over time.  Initially this limit was 1,023 bytes, but Linux 2.6.18
  83  * (commit 3612242e527eb47ee4756b5350f8bdf791aa5ede) increased this value to
  84  * 8,192 bytes to support higher bandwidth devices.  Linux 3.10
  85  * (commit e2e2f0ea1c935edcf53feb4c4c8fdb4f86d57dd9) further increased this
  86  * value to 49,152 bytes to support super speed devices.  Linux 5.2
  87  * (commit 8a1dbc8d91d3d1602282c7e6b4222c7759c916fa) even further increased
  88  * this value to 98,304 bytes to support super speed plus devices.
  89  */
  90 static unsigned int max_iso_packet_len = 0;
  91
  92 /* is sysfs available (mounted) ? */
  93 static int sysfs_available = -1;
  94
  95 /* how many times have we initted (and not exited) ? */
  96 static int init_count = 0;
  97
  98 /* have no authority to operate usb device directly */
  99 static int no_enumeration = 0;
 100
 101 /* Serialize scan-devices, event-thread, and poll */
 102 usbi_mutex_static_t linux_hotplug_lock = USBI_MUTEX_INITIALIZER;
 103
 104 static int linux_scan_devices(struct libusb_context *ctx);
 105 static int detach_kernel_driver_and_claim(struct libusb_device_handle *, uint8_t);
 106
 107 #if !defined(HAVE_LIBUDEV)
 108 static int linux_default_scan_devices(struct libusb_context *ctx);
 109 #endif
 110
 111 struct kernel_version {
 112         int major;
 113         int minor;
 114         int sublevel;
 115 };
 116
 117 struct config_descriptor {
 118         struct usbi_configuration_descriptor *desc;
 119         size_t actual_len;
 120 };
 121
 122 struct linux_device_priv {
 123         char *sysfs_dir;
 124         void *descriptors;
 125         size_t descriptors_len;
 126         struct config_descriptor *config_descriptors;
 127         int active_config; /* cache val for !sysfs_available  */
 128 };
 129
 130 struct linux_device_handle_priv {
 131         int fd;
 132         int fd_removed;
 133         int fd_keep;
 134         uint32_t caps;
 135 };
 136
 137 enum reap_action {
 138         NORMAL = 0,
 139         /* submission failed after the first URB, so await cancellation/completion
 140          * of all the others */
 141         SUBMIT_FAILED,
 142
 143         /* cancelled by user or timeout */
 144         CANCELLED,
 145
 146         /* completed multi-URB transfer in non-final URB */
 147         COMPLETED_EARLY,
 148
 149         /* one or more urbs encountered a low-level error */
 150         ERROR,
 151 };
 152
 153 struct linux_transfer_priv {
 154         union {
 155                 struct usbfs_urb *urbs;
 156                 struct usbfs_urb **iso_urbs;
 157         };
 158
 159         enum reap_action reap_action;
 160         int num_urbs;
 161         int num_retired;
 162         enum libusb_transfer_status reap_status;
 163
 164         /* next iso packet in user-supplied transfer to be populated */
 165         int iso_packet_offset;
 166 };
 167
 168 static int dev_has_config0(struct libusb_device *dev)
 169 {
 170         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 171         struct config_descriptor *config;
 172         uint8_t idx;
 173
 174         for (idx = 0; idx < dev->device_descriptor.bNumConfigurations; idx++) {
 175                 config = &priv->config_descriptors[idx];
 176                 if (config->desc->bConfigurationValue == 0)
 177                         return 1;
 178         }
 179
 180         return 0;
 181 }
 182
 183 static int get_usbfs_fd(struct libusb_device *dev, mode_t mode, int silent)
 184 {
 185         struct libusb_context *ctx = DEVICE_CTX(dev);
 186         char path[24];
 187         int fd;
 188
 189         if (usbdev_names)
 190                 sprintf(path, USBDEV_PATH "/usbdev%u.%u",
 191                         dev->bus_number, dev->device_address);
 192         else
 193                 sprintf(path, USB_DEVTMPFS_PATH "/%03u/%03u",
 194                         dev->bus_number, dev->device_address);
 195
 196         fd = open(path, mode | O_CLOEXEC);
 197         if (fd != -1)
 198                 return fd; /* Success */
 199
 200         if (errno == ENOENT) {
 201                 const long delay_ms = 10L;
 202                 const struct timespec delay_ts = { 0L, delay_ms * 1000L * 1000L };
 203
 204                 if (!silent)
 205                         usbi_err(ctx, "File doesn't exist, wait %ld ms and try again", delay_ms);
 206
 207                 /* Wait 10ms for USB device path creation.*/
 208                 nanosleep(&delay_ts, NULL);
 209
 210                 fd = open(path, mode | O_CLOEXEC);
 211                 if (fd != -1)
 212                         return fd; /* Success */
 213         }
 214
 215         if (!silent) {
 216                 usbi_err(ctx, "libusb couldn't open USB device %s, errno=%d", path, errno);
 217                 if (errno == EACCES && mode == O_RDWR)
 218                         usbi_err(ctx, "libusb requires write access to USB device nodes");
 219         }
 220
 221         if (errno == EACCES)
 222                 return LIBUSB_ERROR_ACCESS;
 223         if (errno == ENOENT)
 224                 return LIBUSB_ERROR_NO_DEVICE;
 225         return LIBUSB_ERROR_IO;
 226 }
 227
 228 /* check dirent for a /dev/usbdev%d.%d name
 229  * optionally return bus/device on success */
 230 static int is_usbdev_entry(const char *name, uint8_t *bus_p, uint8_t *dev_p)
 231 {
 232         int busnum, devnum;
 233
 234         if (sscanf(name, "usbdev%d.%d", &busnum, &devnum) != 2)
 235                 return 0;
 236         if (busnum < 0 || busnum > UINT8_MAX || devnum < 0 || devnum > UINT8_MAX) {
 237                 usbi_dbg(NULL, "invalid usbdev format '%s'", name);
 238                 return 0;
 239         }
 240
 241         usbi_dbg(NULL, "found: %s", name);
 242         if (bus_p)
 243                 *bus_p = (uint8_t)busnum;
 244         if (dev_p)
 245                 *dev_p = (uint8_t)devnum;
 246         return 1;
 247 }
 248
 249 static const char *find_usbfs_path(void)
 250 {
 251         const char *path;
 252         DIR *dir;
 253         struct dirent *entry;
 254
 255         path = USB_DEVTMPFS_PATH;
 256         dir = opendir(path);
 257         if (dir) {
 258                 while ((entry = readdir(dir))) {
 259                         if (entry->d_name[0] == '.')
 260                                 continue;
 261
 262                         /* We assume if we find any files that it must be the right place */
 263                         break;
 264                 }
 265
 266                 closedir(dir);
 267
 268                 if (entry)
 269                         return path;
 270         }
 271
 272         /* look for /dev/usbdev*.* if the normal place fails */
 273         path = USBDEV_PATH;
 274         dir = opendir(path);
 275         if (dir) {
 276                 while ((entry = readdir(dir))) {
 277                         if (entry->d_name[0] == '.')
 278                                 continue;
 279
 280                         if (is_usbdev_entry(entry->d_name, NULL, NULL)) {
 281                                 /* found one; that's enough */
 282                                 break;
 283                         }
 284                 }
 285
 286                 closedir(dir);
 287
 288                 if (entry) {
 289                         usbdev_names = 1;
 290                         return path;
 291                 }
 292         }
 293
 294 /* On udev based systems without any usb-devices /dev/bus/usb will not
 295  * exist. So if we've not found anything and we're using udev for hotplug
 296  * simply assume /dev/bus/usb rather then making libusb_init fail.
 297  * Make the same assumption for Android where SELinux policies might block us
 298  * from reading /dev on newer devices. */
 299 #if defined(HAVE_LIBUDEV) || defined(__ANDROID__)
 300         return USB_DEVTMPFS_PATH;
 301 #else
 302         return NULL;
 303 #endif
 304 }
 305
 306 static int get_kernel_version(struct libusb_context *ctx,
 307         struct kernel_version *ver)
 308 {
 309         struct utsname uts;
 310         int atoms;
 311
 312         if (uname(&uts) < 0) {
 313                 usbi_err(ctx, "uname failed, errno=%d", errno);
 314                 return -1;
 315         }
 316
 317         atoms = sscanf(uts.release, "%d.%d.%d", &ver->major, &ver->minor, &ver->sublevel);
 318         if (atoms < 2) {
 319                 usbi_err(ctx, "failed to parse uname release '%s'", uts.release);
 320                 return -1;
 321         }
 322
 323         if (atoms < 3)
 324                 ver->sublevel = -1;
 325
 326         usbi_dbg(ctx, "reported kernel version is %s", uts.release);
 327
 328         return 0;
 329 }
 330
 331 static int kernel_version_ge(const struct kernel_version *ver,
 332         int major, int minor, int sublevel)
 333 {
 334         if (ver->major > major)
 335                 return 1;
 336         else if (ver->major < major)
 337                 return 0;
 338
 339         /* kmajor == major */
 340         if (ver->minor > minor)
 341                 return 1;
 342         else if (ver->minor < minor)
 343                 return 0;
 344
 345         /* kminor == minor */
 346         if (ver->sublevel == -1)
 347                 return sublevel == 0;
 348
 349         return ver->sublevel >= sublevel;
 350 }
 351
 352 static int op_init(struct libusb_context *ctx)
 353 {
 354         struct kernel_version kversion;
 355         const char *usbfs_path;
 356         int r;
 357
 358         if (get_kernel_version(ctx, &kversion) < 0)
 359                 return LIBUSB_ERROR_OTHER;
 360
 361         if (!kernel_version_ge(&kversion, 2, 6, 32)) {
 362                 usbi_err(ctx, "kernel version is too old (reported as %d.%d.%d)",
 363                          kversion.major, kversion.minor,
 364                          kversion.sublevel != -1 ? kversion.sublevel : 0);
 365                 return LIBUSB_ERROR_NOT_SUPPORTED;
 366         }
 367
 368         usbfs_path = find_usbfs_path();
 369         if (!usbfs_path) {
 370                 usbi_err(ctx, "could not find usbfs");
 371                 return LIBUSB_ERROR_OTHER;
 372         }
 373
 374         usbi_dbg(ctx, "found usbfs at %s", usbfs_path);
 375
 376         if (!max_iso_packet_len) {
 377                 if (kernel_version_ge(&kversion, 5, 2, 0))
 378                         max_iso_packet_len = 98304;
 379                 else if (kernel_version_ge(&kversion, 3, 10, 0))
 380                         max_iso_packet_len = 49152;
 381                 else
 382                         max_iso_packet_len = 8192;
 383         }
 384
 385         usbi_dbg(ctx, "max iso packet length is (likely) %u bytes", max_iso_packet_len);
 386
 387         if (sysfs_available == -1) {
 388                 struct statfs statfsbuf;
 389
 390                 r = statfs(SYSFS_MOUNT_PATH, &statfsbuf);
 391                 if (r == 0 && statfsbuf.f_type == SYSFS_MAGIC) {
 392                         usbi_dbg(ctx, "sysfs is available");
 393                         sysfs_available = 1;
 394                 } else {
 395                         usbi_warn(ctx, "sysfs not mounted");
 396                         sysfs_available = 0;
 397                 }
 398         }
 399
 400         if (no_enumeration) {
 401                 return LIBUSB_SUCCESS;
 402         }
 403
 404         r = LIBUSB_SUCCESS;
 405         if (init_count == 0) {
 406                 /* start up hotplug event handler */
 407                 r = linux_start_event_monitor();
 408         }
 409         if (r == LIBUSB_SUCCESS) {
 410                 r = linux_scan_devices(ctx);
 411                 if (r == LIBUSB_SUCCESS)
 412                         init_count++;
 413                 else if (init_count == 0)
 414                         linux_stop_event_monitor();
 415         } else {
 416                 usbi_err(ctx, "error starting hotplug event monitor");
 417         }
 418
 419         return r;
 420 }
 421
 422 static void op_exit(struct libusb_context *ctx)
 423 {
 424         UNUSED(ctx);
 425
 426         if (no_enumeration) {
 427                 return;
 428         }
 429
 430         assert(init_count != 0);
 431         if (!--init_count) {
 432                 /* tear down event handler */
 433                 linux_stop_event_monitor();
 434         }
 435 }
 436
 437 static int op_set_option(struct libusb_context *ctx, enum libusb_option option, va_list ap)
 438 {
 439         UNUSED(ctx);
 440         UNUSED(ap);
 441
 442         if (option == LIBUSB_OPTION_NO_DEVICE_DISCOVERY) {
 443                 usbi_dbg(ctx, "no enumeration will be performed");
 444                 no_enumeration = 1;
 445                 return LIBUSB_SUCCESS;
 446         }
 447
 448         return LIBUSB_ERROR_NOT_SUPPORTED;
 449 }
 450
 451 static int linux_scan_devices(struct libusb_context *ctx)
 452 {
 453         int ret;
 454
 455         usbi_mutex_static_lock(&linux_hotplug_lock);
 456
 457 #if defined(HAVE_LIBUDEV)
 458         ret = linux_udev_scan_devices(ctx);
 459 #else
 460         ret = linux_default_scan_devices(ctx);
 461 #endif
 462
 463         usbi_mutex_static_unlock(&linux_hotplug_lock);
 464
 465         return ret;
 466 }
 467
 468 static void op_hotplug_poll(void)
 469 {
 470         linux_hotplug_poll();
 471 }
 472
 473 static int open_sysfs_attr(struct libusb_context *ctx,
 474         const char *sysfs_dir, const char *attr)
 475 {
 476         char filename[256];
 477         int fd;
 478
 479         snprintf(filename, sizeof(filename), SYSFS_DEVICE_PATH "/%s/%s", sysfs_dir, attr);
 480         fd = open(filename, O_RDONLY | O_CLOEXEC);
 481         if (fd < 0) {
 482                 if (errno == ENOENT) {
 483                         /* File doesn't exist. Assume the device has been
 484                            disconnected (see trac ticket #70). */
 485                         return LIBUSB_ERROR_NO_DEVICE;
 486                 }
 487                 usbi_err(ctx, "open %s failed, errno=%d", filename, errno);
 488                 return LIBUSB_ERROR_IO;
 489         }
 490
 491         return fd;
 492 }
 493
 494 /* Note only suitable for attributes which always read >= 0, < 0 is error */
 495 static int read_sysfs_attr(struct libusb_context *ctx,
 496         const char *sysfs_dir, const char *attr, int max_value, int *value_p)
 497 {
 498         char buf[20], *endptr;
 499         long value;
 500         ssize_t r;
 501         int fd;
 502
 503         fd = open_sysfs_attr(ctx, sysfs_dir, attr);
 504         if (fd < 0)
 505                 return fd;
 506
 507         r = read(fd, buf, sizeof(buf) - 1);
 508         if (r < 0) {
 509                 r = errno;
 510                 close(fd);
 511                 if (r == ENODEV)
 512                         return LIBUSB_ERROR_NO_DEVICE;
 513                 usbi_err(ctx, "attribute %s read failed, errno=%zd", attr, r);
 514                 return LIBUSB_ERROR_IO;
 515         }
 516         close(fd);
 517
 518         if (r == 0) {
 519                 /* Certain attributes (e.g. bConfigurationValue) are not
 520                  * populated if the device is not configured. */
 521                 *value_p = -1;
 522                 return 0;
 523         }
 524
 525         /* The kernel does *not* NUL-terminate the string, but every attribute
 526          * should be terminated with a newline character. */
 527         if (!isdigit(buf[0])) {
 528                 usbi_err(ctx, "attribute %s doesn't have numeric value?", attr);
 529                 return LIBUSB_ERROR_IO;
 530         } else if (buf[r - 1] != '\n') {
 531                 usbi_warn(ctx, "attribute %s doesn't end with newline?", attr);
 532         } else {
 533                 /* Remove the terminating newline character */
 534                 r--;
 535         }
 536         buf[r] = '\0';
 537
 538         errno = 0;
 539         value = strtol(buf, &endptr, 10);
 540         if (value < 0 || value > (long)max_value || errno) {
 541                 usbi_err(ctx, "attribute %s contains an invalid value: '%s'", attr, buf);
 542                 return LIBUSB_ERROR_INVALID_PARAM;
 543         } else if (*endptr != '\0') {
 544                 /* Consider the value to be valid if the remainder is a '.'
 545                  * character followed by numbers.  This occurs, for example,
 546                  * when reading the "speed" attribute for a low-speed device
 547                  * (e.g. "1.5") */
 548                 if (*endptr == '.' && isdigit(*(endptr + 1))) {
 549                         endptr++;
 550                         while (isdigit(*endptr))
 551                                 endptr++;
 552                 }
 553                 if (*endptr != '\0') {
 554                         usbi_err(ctx, "attribute %s contains an invalid value: '%s'", attr, buf);
 555                         return LIBUSB_ERROR_INVALID_PARAM;
 556                 }
 557         }
 558
 559         *value_p = (int)value;
 560         return 0;
 561 }
 562
 563 static int sysfs_scan_device(struct libusb_context *ctx, const char *devname)
 564 {
 565         uint8_t busnum, devaddr;
 566         int ret;
 567
 568         ret = linux_get_device_address(ctx, 0, &busnum, &devaddr, NULL, devname, -1);
 569         if (ret != LIBUSB_SUCCESS)
 570                 return ret;
 571
 572         return linux_enumerate_device(ctx, busnum, devaddr, devname);
 573 }
 574
 575 /* read the bConfigurationValue for a device */
 576 static int sysfs_get_active_config(struct libusb_device *dev, int *config)
 577 {
 578         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 579
 580         return read_sysfs_attr(DEVICE_CTX(dev), priv->sysfs_dir, "bConfigurationValue",
 581                         UINT8_MAX, config);
 582 }
 583
 584 int linux_get_device_address(struct libusb_context *ctx, int detached,
 585         uint8_t *busnum, uint8_t *devaddr, const char *dev_node,
 586         const char *sys_name, int fd)
 587 {
 588         int sysfs_val;
 589         int r;
 590
 591         usbi_dbg(ctx, "getting address for device: %s detached: %d", sys_name, detached);
 592         /* can't use sysfs to read the bus and device number if the
 593          * device has been detached */
 594         if (!sysfs_available || detached || !sys_name) {
 595                 if (!dev_node && fd >= 0) {
 596                         char *fd_path = alloca(PATH_MAX);
 597                         char proc_path[32];
 598
 599                         /* try to retrieve the device node from fd */
 600                         sprintf(proc_path, "/proc/self/fd/%d", fd);
 601                         r = readlink(proc_path, fd_path, PATH_MAX - 1);
 602                         if (r > 0) {
 603                                 fd_path[r] = '\0';
 604                                 dev_node = fd_path;
 605                         }
 606                 }
 607
 608                 if (!dev_node)
 609                         return LIBUSB_ERROR_OTHER;
 610
 611                 /* will this work with all supported kernel versions? */
 612                 if (!strncmp(dev_node, "/dev/bus/usb", 12))
 613                         sscanf(dev_node, "/dev/bus/usb/%hhu/%hhu", busnum, devaddr);
 614                 else
 615                         return LIBUSB_ERROR_OTHER;
 616
 617                 return LIBUSB_SUCCESS;
 618         }
 619
 620         usbi_dbg(ctx, "scan %s", sys_name);
 621
 622         r = read_sysfs_attr(ctx, sys_name, "busnum", UINT8_MAX, &sysfs_val);
 623         if (r < 0)
 624                 return r;
 625         *busnum = (uint8_t)sysfs_val;
 626
 627         r = read_sysfs_attr(ctx, sys_name, "devnum", UINT8_MAX, &sysfs_val);
 628         if (r < 0)
 629                 return r;
 630         *devaddr = (uint8_t)sysfs_val;
 631
 632         usbi_dbg(ctx, "bus=%u dev=%u", *busnum, *devaddr);
 633
 634         return LIBUSB_SUCCESS;
 635 }
 636
 637 /* Return offset of the next config descriptor */
 638 static int seek_to_next_config(struct libusb_context *ctx,
 639         uint8_t *buffer, size_t len)
 640 {
 641         struct usbi_descriptor_header *header;
 642         int offset;
 643
 644         /* Start seeking past the config descriptor */
 645         offset = LIBUSB_DT_CONFIG_SIZE;
 646         buffer += LIBUSB_DT_CONFIG_SIZE;
 647         len -= LIBUSB_DT_CONFIG_SIZE;
 648
 649         while (len > 0) {
 650                 if (len < 2) {
 651                         usbi_err(ctx, "short descriptor read %zu/2", len);
 652                         return LIBUSB_ERROR_IO;
 653                 }
 654
 655                 header = (struct usbi_descriptor_header *)buffer;
 656                 if (header->bDescriptorType == LIBUSB_DT_CONFIG)
 657                         return offset;
 658
 659                 if (len < header->bLength) {
 660                         usbi_err(ctx, "bLength overflow by %zu bytes",
 661                                  (size_t)header->bLength - len);
 662                         return LIBUSB_ERROR_IO;
 663                 }
 664
 665                 offset += header->bLength;
 666                 buffer += header->bLength;
 667                 len -= header->bLength;
 668         }
 669
 670         usbi_err(ctx, "config descriptor not found");
 671         return LIBUSB_ERROR_IO;
 672 }
 673
 674 static int parse_config_descriptors(struct libusb_device *dev)
 675 {
 676         struct libusb_context *ctx = DEVICE_CTX(dev);
 677         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 678         struct usbi_device_descriptor *device_desc;
 679         uint8_t idx, num_configs;
 680         uint8_t *buffer;
 681         size_t remaining;
 682
 683         device_desc = priv->descriptors;
 684         num_configs = device_desc->bNumConfigurations;
 685
 686         if (num_configs == 0)
 687                 return 0;       /* no configurations? */
 688
 689         priv->config_descriptors = malloc(num_configs * sizeof(priv->config_descriptors[0]));
 690         if (!priv->config_descriptors)
 691                 return LIBUSB_ERROR_NO_MEM;
 692
 693         buffer = (uint8_t *)priv->descriptors + LIBUSB_DT_DEVICE_SIZE;
 694         remaining = priv->descriptors_len - LIBUSB_DT_DEVICE_SIZE;
 695
 696         for (idx = 0; idx < num_configs; idx++) {
 697                 struct usbi_configuration_descriptor *config_desc;
 698                 uint16_t config_len;
 699
 700                 if (remaining < LIBUSB_DT_CONFIG_SIZE) {
 701                         usbi_err(ctx, "short descriptor read %zu/%d",
 702                                  remaining, LIBUSB_DT_CONFIG_SIZE);
 703                         return LIBUSB_ERROR_IO;
 704                 }
 705
 706                 config_desc = (struct usbi_configuration_descriptor *)buffer;
 707                 if (config_desc->bDescriptorType != LIBUSB_DT_CONFIG) {
 708                         usbi_err(ctx, "descriptor is not a config desc (type 0x%02x)",
 709                                  config_desc->bDescriptorType);
 710                         return LIBUSB_ERROR_IO;
 711                 } else if (config_desc->bLength < LIBUSB_DT_CONFIG_SIZE) {
 712                         usbi_err(ctx, "invalid descriptor bLength %u",
 713                                  config_desc->bLength);
 714                         return LIBUSB_ERROR_IO;
 715                 }
 716
 717                 config_len = libusb_le16_to_cpu(config_desc->wTotalLength);
 718                 if (config_len < LIBUSB_DT_CONFIG_SIZE) {
 719                         usbi_err(ctx, "invalid wTotalLength %u", config_len);
 720                         return LIBUSB_ERROR_IO;
 721                 }
 722
 723                 if (priv->sysfs_dir) {
 724                         /*
 725                          * In sysfs wTotalLength is ignored, instead the kernel returns a
 726                          * config descriptor with verified bLength fields, with descriptors
 727                          * with an invalid bLength removed.
 728                          */
 729                         uint16_t sysfs_config_len;
 730                         int offset;
 731
 732                         if (num_configs > 1 && idx < num_configs - 1) {
 733                                 offset = seek_to_next_config(ctx, buffer, remaining);
 734                                 if (offset < 0)
 735                                         return offset;
 736                                 sysfs_config_len = (uint16_t)offset;
 737                         } else {
 738                                 sysfs_config_len = (uint16_t)remaining;
 739                         }
 740
 741                         if (config_len != sysfs_config_len) {
 742                                 usbi_warn(ctx, "config length mismatch wTotalLength %u real %u",
 743                                           config_len, sysfs_config_len);
 744                                 config_len = sysfs_config_len;
 745                         }
 746                 } else {
 747                         /*
 748                          * In usbfs the config descriptors are wTotalLength bytes apart,
 749                          * with any short reads from the device appearing as holes in the file.
 750                          */
 751                         if (config_len > remaining) {
 752                                 usbi_warn(ctx, "short descriptor read %zu/%u", remaining, config_len);
 753                                 config_len = (uint16_t)remaining;
 754                         }
 755                 }
 756
 757                 if (config_desc->bConfigurationValue == 0)
 758                         usbi_warn(ctx, "device has configuration 0");
 759
 760                 priv->config_descriptors[idx].desc = config_desc;
 761                 priv->config_descriptors[idx].actual_len = config_len;
 762
 763                 buffer += config_len;
 764                 remaining -= config_len;
 765         }
 766
 767         return LIBUSB_SUCCESS;
 768 }
 769
 770 static int op_get_config_descriptor_by_value(struct libusb_device *dev,
 771         uint8_t value, void **buffer)
 772 {
 773         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 774         struct config_descriptor *config;
 775         uint8_t idx;
 776
 777         for (idx = 0; idx < dev->device_descriptor.bNumConfigurations; idx++) {
 778                 config = &priv->config_descriptors[idx];
 779                 if (config->desc->bConfigurationValue == value) {
 780                         *buffer = config->desc;
 781                         return (int)config->actual_len;
 782                 }
 783         }
 784
 785         return LIBUSB_ERROR_NOT_FOUND;
 786 }
 787
 788 static int op_get_active_config_descriptor(struct libusb_device *dev,
 789         void *buffer, size_t len)
 790 {
 791         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 792         void *config_desc;
 793         int active_config;
 794         int r;
 795
 796         if (priv->sysfs_dir) {
 797                 r = sysfs_get_active_config(dev, &active_config);
 798                 if (r < 0)
 799                         return r;
 800         } else {
 801                 /* Use cached bConfigurationValue */
 802                 active_config = priv->active_config;
 803         }
 804
 805         if (active_config == -1) {
 806                 usbi_err(DEVICE_CTX(dev), "device unconfigured");
 807                 return LIBUSB_ERROR_NOT_FOUND;
 808         }
 809
 810         r = op_get_config_descriptor_by_value(dev, (uint8_t)active_config, &config_desc);
 811         if (r < 0)
 812                 return r;
 813
 814         len = MIN(len, (size_t)r);
 815         memcpy(buffer, config_desc, len);
 816         return len;
 817 }
 818
 819 static int op_get_config_descriptor(struct libusb_device *dev,
 820         uint8_t config_index, void *buffer, size_t len)
 821 {
 822         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 823         struct config_descriptor *config;
 824
 825         if (config_index >= dev->device_descriptor.bNumConfigurations)
 826                 return LIBUSB_ERROR_NOT_FOUND;
 827
 828         config = &priv->config_descriptors[config_index];
 829         len = MIN(len, config->actual_len);
 830         memcpy(buffer, config->desc, len);
 831         return len;
 832 }
 833
 834 /* send a control message to retrieve active configuration */
 835 static int usbfs_get_active_config(struct libusb_device *dev, int fd)
 836 {
 837         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 838         uint8_t active_config = 0;
 839         int r;
 840
 841         struct usbfs_ctrltransfer ctrl = {
 842                 .bmRequestType = LIBUSB_ENDPOINT_IN,
 843                 .bRequest = LIBUSB_REQUEST_GET_CONFIGURATION,
 844                 .wValue = 0,
 845                 .wIndex = 0,
 846                 .wLength = 1,
 847                 .timeout = 1000,
 848                 .data = &active_config
 849         };
 850
 851         r = ioctl(fd, IOCTL_USBFS_CONTROL, &ctrl);
 852         if (r < 0) {
 853                 if (errno == ENODEV)
 854                         return LIBUSB_ERROR_NO_DEVICE;
 855
 856                 /* we hit this error path frequently with buggy devices :( */
 857                 usbi_warn(DEVICE_CTX(dev), "get configuration failed, errno=%d", errno);
 858
 859                 /* assume the current configuration is the first one if we have
 860                  * the configuration descriptors, otherwise treat the device
 861                  * as unconfigured. */
 862                 if (priv->config_descriptors)
 863                         priv->active_config = (int)priv->config_descriptors[0].desc->bConfigurationValue;
 864                 else
 865                         priv->active_config = -1;
 866         } else if (active_config == 0) {
 867                 if (dev_has_config0(dev)) {
 868                         /* some buggy devices have a configuration 0, but we're
 869                          * reaching into the corner of a corner case here. */
 870                         priv->active_config = 0;
 871                 } else {
 872                         priv->active_config = -1;
 873                 }
 874         } else {
 875                 priv->active_config = (int)active_config;
 876         }
 877
 878         return LIBUSB_SUCCESS;
 879 }
 880
 881 static enum libusb_speed usbfs_get_speed(struct libusb_context *ctx, int fd)
 882 {
 883         int r;
 884
 885         r = ioctl(fd, IOCTL_USBFS_GET_SPEED, NULL);
 886         switch (r) {
 887         case USBFS_SPEED_UNKNOWN:       return LIBUSB_SPEED_UNKNOWN;
 888         case USBFS_SPEED_LOW:           return LIBUSB_SPEED_LOW;
 889         case USBFS_SPEED_FULL:          return LIBUSB_SPEED_FULL;
 890         case USBFS_SPEED_HIGH:          return LIBUSB_SPEED_HIGH;
 891         case USBFS_SPEED_WIRELESS:      return LIBUSB_SPEED_HIGH;
 892         case USBFS_SPEED_SUPER:         return LIBUSB_SPEED_SUPER;
 893         case USBFS_SPEED_SUPER_PLUS:    return LIBUSB_SPEED_SUPER_PLUS;
 894         default:
 895                 usbi_warn(ctx, "Error getting device speed: %d", r);
 896         }
 897
 898         return LIBUSB_SPEED_UNKNOWN;
 899 }
 900
 901 static int initialize_device(struct libusb_device *dev, uint8_t busnum,
 902         uint8_t devaddr, const char *sysfs_dir, int wrapped_fd)
 903 {
 904         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 905         struct libusb_context *ctx = DEVICE_CTX(dev);
 906         size_t alloc_len;
 907         int fd, speed, r;
 908         ssize_t nb;
 909
 910         dev->bus_number = busnum;
 911         dev->device_address = devaddr;
 912
 913         if (sysfs_dir) {
 914                 priv->sysfs_dir = strdup(sysfs_dir);
 915                 if (!priv->sysfs_dir)
 916                         return LIBUSB_ERROR_NO_MEM;
 917
 918                 /* Note speed can contain 1.5, in this case read_sysfs_attr()
 919                    will stop parsing at the '.' and return 1 */
 920                 if (read_sysfs_attr(ctx, sysfs_dir, "speed", INT_MAX, &speed) == 0) {
 921                         switch (speed) {
 922                         case     1: dev->speed = LIBUSB_SPEED_LOW; break;
 923                         case    12: dev->speed = LIBUSB_SPEED_FULL; break;
 924                         case   480: dev->speed = LIBUSB_SPEED_HIGH; break;
 925                         case  5000: dev->speed = LIBUSB_SPEED_SUPER; break;
 926                         case 10000: dev->speed = LIBUSB_SPEED_SUPER_PLUS; break;
 927                         default:
 928                                 usbi_warn(ctx, "unknown device speed: %d Mbps", speed);
 929                         }
 930                 }
 931         } else if (wrapped_fd >= 0) {
 932                 dev->speed = usbfs_get_speed(ctx, wrapped_fd);
 933         }
 934
 935         /* cache descriptors in memory */
 936         if (sysfs_dir) {
 937                 fd = open_sysfs_attr(ctx, sysfs_dir, "descriptors");
 938         } else if (wrapped_fd < 0) {
 939                 fd = get_usbfs_fd(dev, O_RDONLY, 0);
 940         } else {
 941                 fd = wrapped_fd;
 942                 r = lseek(fd, 0, SEEK_SET);
 943                 if (r < 0) {
 944                         usbi_err(ctx, "lseek failed, errno=%d", errno);
 945                         return LIBUSB_ERROR_IO;
 946                 }
 947         }
 948         if (fd < 0)
 949                 return fd;
 950
 951         alloc_len = 0;
 952         do {
 953                 const size_t desc_read_length = 256;
 954                 uint8_t *read_ptr;
 955
 956                 alloc_len += desc_read_length;
 957                 priv->descriptors = usbi_reallocf(priv->descriptors, alloc_len);
 958                 if (!priv->descriptors) {
 959                         if (fd != wrapped_fd)
 960                                 close(fd);
 961                         return LIBUSB_ERROR_NO_MEM;
 962                 }
 963                 read_ptr = (uint8_t *)priv->descriptors + priv->descriptors_len;
 964                 /* usbfs has holes in the file */
 965                 if (!sysfs_dir)
 966                         memset(read_ptr, 0, desc_read_length);
 967                 nb = read(fd, read_ptr, desc_read_length);
 968                 if (nb < 0) {
 969                         usbi_err(ctx, "read descriptor failed, errno=%d", errno);
 970                         if (fd != wrapped_fd)
 971                                 close(fd);
 972                         return LIBUSB_ERROR_IO;
 973                 }
 974                 priv->descriptors_len += (size_t)nb;
 975         } while (priv->descriptors_len == alloc_len);
 976
 977         if (fd != wrapped_fd)
 978                 close(fd);
 979
 980         if (priv->descriptors_len < LIBUSB_DT_DEVICE_SIZE) {
 981                 usbi_err(ctx, "short descriptor read (%zu)", priv->descriptors_len);
 982                 return LIBUSB_ERROR_IO;
 983         }
 984
 985         r = parse_config_descriptors(dev);
 986         if (r < 0)
 987                 return r;
 988
 989         memcpy(&dev->device_descriptor, priv->descriptors, LIBUSB_DT_DEVICE_SIZE);
 990
 991         if (sysfs_dir) {
 992                 /* sysfs descriptors are in bus-endian format */
 993                 usbi_localize_device_descriptor(&dev->device_descriptor);
 994                 return LIBUSB_SUCCESS;
 995         }
 996
 997         /* cache active config */
 998         if (wrapped_fd < 0)
 999                 fd = get_usbfs_fd(dev, O_RDWR, 1);
1000         else
1001                 fd = wrapped_fd;
1002         if (fd < 0) {
1003                 /* cannot send a control message to determine the active
1004                  * config. just assume the first one is active. */
1005                 usbi_warn(ctx, "Missing rw usbfs access; cannot determine "
1006                                "active configuration descriptor");
1007                 if (priv->config_descriptors)
1008                         priv->active_config = (int)priv->config_descriptors[0].desc->bConfigurationValue;
1009                 else
1010                         priv->active_config = -1; /* No config dt */
1011
1012                 return LIBUSB_SUCCESS;
1013         }
1014
1015         r = usbfs_get_active_config(dev, fd);
1016         if (fd != wrapped_fd)
1017                 close(fd);
1018
1019         return r;
1020 }
1021
1022 static int linux_get_parent_info(struct libusb_device *dev, const char *sysfs_dir)
1023 {
1024         struct libusb_context *ctx = DEVICE_CTX(dev);
1025         struct libusb_device *it;
1026         char *parent_sysfs_dir, *tmp;
1027         int ret, add_parent = 1;
1028
1029         /* XXX -- can we figure out the topology when using usbfs? */
1030         if (!sysfs_dir || !strncmp(sysfs_dir, "usb", 3)) {
1031                 /* either using usbfs or finding the parent of a root hub */
1032                 return LIBUSB_SUCCESS;
1033         }
1034
1035         parent_sysfs_dir = strdup(sysfs_dir);
1036         if (!parent_sysfs_dir)
1037                 return LIBUSB_ERROR_NO_MEM;
1038
1039         if ((tmp = strrchr(parent_sysfs_dir, '.')) ||
1040             (tmp = strrchr(parent_sysfs_dir, '-'))) {
1041                 dev->port_number = atoi(tmp + 1);
1042                 *tmp = '\0';
1043         } else {
1044                 usbi_warn(ctx, "Can not parse sysfs_dir: %s, no parent info",
1045                           parent_sysfs_dir);
1046                 free(parent_sysfs_dir);
1047                 return LIBUSB_SUCCESS;
1048         }
1049
1050         /* is the parent a root hub? */
1051         if (!strchr(parent_sysfs_dir, '-')) {
1052                 tmp = parent_sysfs_dir;
1053                 ret = asprintf(&parent_sysfs_dir, "usb%s", tmp);
1054                 free(tmp);
1055                 if (ret < 0)
1056                         return LIBUSB_ERROR_NO_MEM;
1057         }
1058
1059 retry:
1060         /* find the parent in the context */
1061         usbi_mutex_lock(&ctx->usb_devs_lock);
1062         for_each_device(ctx, it) {
1063                 struct linux_device_priv *priv = usbi_get_device_priv(it);
1064
1065                 if (priv->sysfs_dir) {
1066                         if (!strcmp(priv->sysfs_dir, parent_sysfs_dir)) {
1067                                 dev->parent_dev = libusb_ref_device(it);
1068                                 break;
1069                         }
1070                 }
1071         }
1072         usbi_mutex_unlock(&ctx->usb_devs_lock);
1073
1074         if (!dev->parent_dev && add_parent) {
1075                 usbi_dbg(ctx, "parent_dev %s not enumerated yet, enumerating now",
1076                          parent_sysfs_dir);
1077                 sysfs_scan_device(ctx, parent_sysfs_dir);
1078                 add_parent = 0;
1079                 goto retry;
1080         }
1081
1082         usbi_dbg(ctx, "dev %p (%s) has parent %p (%s) port %u", dev, sysfs_dir,
1083                  dev->parent_dev, parent_sysfs_dir, dev->port_number);
1084
1085         free(parent_sysfs_dir);
1086
1087         return LIBUSB_SUCCESS;
1088 }
1089
1090 int linux_enumerate_device(struct libusb_context *ctx,
1091         uint8_t busnum, uint8_t devaddr, const char *sysfs_dir)
1092 {
1093         unsigned long session_id;
1094         struct libusb_device *dev;
1095         int r;
1096
1097         /* FIXME: session ID is not guaranteed unique as addresses can wrap and
1098          * will be reused. instead we should add a simple sysfs attribute with
1099          * a session ID. */
1100         session_id = busnum << 8 | devaddr;
1101         usbi_dbg(ctx, "busnum %u devaddr %u session_id %lu", busnum, devaddr, session_id);
1102
1103         dev = usbi_get_device_by_session_id(ctx, session_id);
1104         if (dev) {
1105                 /* device already exists in the context */
1106                 usbi_dbg(ctx, "session_id %lu already exists", session_id);
1107                 libusb_unref_device(dev);
1108                 return LIBUSB_SUCCESS;
1109         }
1110
1111         usbi_dbg(ctx, "allocating new device for %u/%u (session %lu)",
1112                  busnum, devaddr, session_id);
1113         dev = usbi_alloc_device(ctx, session_id);
1114         if (!dev)
1115                 return LIBUSB_ERROR_NO_MEM;
1116
1117         r = initialize_device(dev, busnum, devaddr, sysfs_dir, -1);
1118         if (r < 0)
1119                 goto out;
1120         r = usbi_sanitize_device(dev);
1121         if (r < 0)
1122                 goto out;
1123
1124         r = linux_get_parent_info(dev, sysfs_dir);
1125         if (r < 0)
1126                 goto out;
1127 out:
1128         if (r < 0)
1129                 libusb_unref_device(dev);
1130         else
1131                 usbi_connect_device(dev);
1132
1133         return r;
1134 }
1135
1136 void linux_hotplug_enumerate(uint8_t busnum, uint8_t devaddr, const char *sys_name)
1137 {
1138         struct libusb_context *ctx;
1139
1140         usbi_mutex_static_lock(&active_contexts_lock);
1141         for_each_context(ctx) {
1142                 linux_enumerate_device(ctx, busnum, devaddr, sys_name);
1143         }
1144         usbi_mutex_static_unlock(&active_contexts_lock);
1145 }
1146
1147 void linux_device_disconnected(uint8_t busnum, uint8_t devaddr)
1148 {
1149         struct libusb_context *ctx;
1150         struct libusb_device *dev;
1151         unsigned long session_id = busnum << 8 | devaddr;
1152
1153         usbi_mutex_static_lock(&active_contexts_lock);
1154         for_each_context(ctx) {
1155                 dev = usbi_get_device_by_session_id(ctx, session_id);
1156                 if (dev) {
1157                         usbi_disconnect_device(dev);
1158                         libusb_unref_device(dev);
1159                 } else {
1160                         usbi_dbg(ctx, "device not found for session %lx", session_id);
1161                 }
1162         }
1163         usbi_mutex_static_unlock(&active_contexts_lock);
1164 }
1165
1166 #if !defined(HAVE_LIBUDEV)
1167 static int parse_u8(const char *str, uint8_t *val_p)
1168 {
1169         char *endptr;
1170         long num;
1171
1172         errno = 0;
1173         num = strtol(str, &endptr, 10);
1174         if (num < 0 || num > UINT8_MAX || errno)
1175                 return 0;
1176         if (endptr == str || *endptr != '\0')
1177                 return 0;
1178
1179         *val_p = (uint8_t)num;
1180         return 1;
1181 }
1182
1183 /* open a bus directory and adds all discovered devices to the context */
1184 static int usbfs_scan_busdir(struct libusb_context *ctx, uint8_t busnum)
1185 {
1186         DIR *dir;
1187         char dirpath[20];
1188         struct dirent *entry;
1189         int r = LIBUSB_ERROR_IO;
1190
1191         sprintf(dirpath, USB_DEVTMPFS_PATH "/%03u", busnum);
1192         usbi_dbg(ctx, "%s", dirpath);
1193         dir = opendir(dirpath);
1194         if (!dir) {
1195                 usbi_err(ctx, "opendir '%s' failed, errno=%d", dirpath, errno);
1196                 /* FIXME: should handle valid race conditions like hub unplugged
1197                  * during directory iteration - this is not an error */
1198                 return r;
1199         }
1200
1201         while ((entry = readdir(dir))) {
1202                 uint8_t devaddr;
1203
1204                 if (entry->d_name[0] == '.')
1205                         continue;
1206
1207                 if (!parse_u8(entry->d_name, &devaddr)) {
1208                         usbi_dbg(ctx, "unknown dir entry %s", entry->d_name);
1209                         continue;
1210                 }
1211
1212                 if (linux_enumerate_device(ctx, busnum, devaddr, NULL)) {
1213                         usbi_dbg(ctx, "failed to enumerate dir entry %s", entry->d_name);
1214                         continue;
1215                 }
1216
1217                 r = 0;
1218         }
1219
1220         closedir(dir);
1221         return r;
1222 }
1223
1224 static int usbfs_get_device_list(struct libusb_context *ctx)
1225 {
1226         struct dirent *entry;
1227         DIR *buses;
1228         uint8_t busnum, devaddr;
1229         int r = 0;
1230
1231         if (usbdev_names)
1232                 buses = opendir(USBDEV_PATH);
1233         else
1234                 buses = opendir(USB_DEVTMPFS_PATH);
1235
1236         if (!buses) {
1237                 usbi_err(ctx, "opendir buses failed, errno=%d", errno);
1238                 return LIBUSB_ERROR_IO;
1239         }
1240
1241         while ((entry = readdir(buses))) {
1242                 if (entry->d_name[0] == '.')
1243                         continue;
1244
1245                 if (usbdev_names) {
1246                         if (!is_usbdev_entry(entry->d_name, &busnum, &devaddr))
1247                                 continue;
1248
1249                         r = linux_enumerate_device(ctx, busnum, devaddr, NULL);
1250                         if (r < 0) {
1251                                 usbi_dbg(ctx, "failed to enumerate dir entry %s", entry->d_name);
1252                                 continue;
1253                         }
1254                 } else {
1255                         if (!parse_u8(entry->d_name, &busnum)) {
1256                                 usbi_dbg(ctx, "unknown dir entry %s", entry->d_name);
1257                                 continue;
1258                         }
1259
1260                         r = usbfs_scan_busdir(ctx, busnum);
1261                         if (r < 0)
1262                                 break;
1263                 }
1264         }
1265
1266         closedir(buses);
1267         return r;
1268
1269 }
1270
1271 static int sysfs_get_device_list(struct libusb_context *ctx)
1272 {
1273         DIR *devices = opendir(SYSFS_DEVICE_PATH);
1274         struct dirent *entry;
1275         int num_devices = 0;
1276         int num_enumerated = 0;
1277
1278         if (!devices) {
1279                 usbi_err(ctx, "opendir devices failed, errno=%d", errno);
1280                 return LIBUSB_ERROR_IO;
1281         }
1282
1283         while ((entry = readdir(devices))) {
1284                 if ((!isdigit(entry->d_name[0]) && strncmp(entry->d_name, "usb", 3))
1285                     || strchr(entry->d_name, ':'))
1286                         continue;
1287
1288                 num_devices++;
1289
1290                 if (sysfs_scan_device(ctx, entry->d_name)) {
1291                         usbi_dbg(ctx, "failed to enumerate dir entry %s", entry->d_name);
1292                         continue;
1293                 }
1294
1295                 num_enumerated++;
1296         }
1297
1298         closedir(devices);
1299
1300         /* successful if at least one device was enumerated or no devices were found */
1301         if (num_enumerated || !num_devices)
1302                 return LIBUSB_SUCCESS;
1303         else
1304                 return LIBUSB_ERROR_IO;
1305 }
1306
1307 static int linux_default_scan_devices(struct libusb_context *ctx)
1308 {
1309         /* we can retrieve device list and descriptors from sysfs or usbfs.
1310          * sysfs is preferable, because if we use usbfs we end up resuming
1311          * any autosuspended USB devices. however, sysfs is not available
1312          * everywhere, so we need a usbfs fallback too.
1313          */
1314         if (sysfs_available)
1315                 return sysfs_get_device_list(ctx);
1316         else
1317                 return usbfs_get_device_list(ctx);
1318 }
1319 #endif
1320
1321 static int initialize_handle(struct libusb_device_handle *handle, int fd)
1322 {
1323         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1324         int r;
1325
1326         hpriv->fd = fd;
1327
1328         r = ioctl(fd, IOCTL_USBFS_GET_CAPABILITIES, &hpriv->caps);
1329         if (r < 0) {
1330                 if (errno == ENOTTY)
1331                         usbi_dbg(HANDLE_CTX(handle), "getcap not available");
1332                 else
1333                         usbi_err(HANDLE_CTX(handle), "getcap failed, errno=%d", errno);
1334                 hpriv->caps = USBFS_CAP_BULK_CONTINUATION;
1335         }
1336
1337         return usbi_add_event_source(HANDLE_CTX(handle), hpriv->fd, POLLOUT);
1338 }
1339
1340 static int op_wrap_sys_device(struct libusb_context *ctx,
1341         struct libusb_device_handle *handle, intptr_t sys_dev)
1342 {
1343         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1344         int fd = (int)sys_dev;
1345         uint8_t busnum, devaddr;
1346         struct usbfs_connectinfo ci;
1347         struct libusb_device *dev;
1348         int r;
1349
1350         r = linux_get_device_address(ctx, 1, &busnum, &devaddr, NULL, NULL, fd);
1351         if (r < 0) {
1352                 r = ioctl(fd, IOCTL_USBFS_CONNECTINFO, &ci);
1353                 if (r < 0) {
1354                         usbi_err(ctx, "connectinfo failed, errno=%d", errno);
1355                         return LIBUSB_ERROR_IO;
1356                 }
1357                 /* There is no ioctl to get the bus number. We choose 0 here
1358                  * as linux starts numbering buses from 1. */
1359                 busnum = 0;
1360                 devaddr = ci.devnum;
1361         }
1362
1363         /* Session id is unused as we do not add the device to the list of
1364          * connected devices. */
1365         usbi_dbg(ctx, "allocating new device for fd %d", fd);
1366         dev = usbi_alloc_device(ctx, 0);
1367         if (!dev)
1368                 return LIBUSB_ERROR_NO_MEM;
1369
1370         r = initialize_device(dev, busnum, devaddr, NULL, fd);
1371         if (r < 0)
1372                 goto out;
1373         r = usbi_sanitize_device(dev);
1374         if (r < 0)
1375                 goto out;
1376         /* Consider the device as connected, but do not add it to the managed
1377          * device list. */
1378         usbi_atomic_store(&dev->attached, 1);
1379         handle->dev = dev;
1380
1381         r = initialize_handle(handle, fd);
1382         hpriv->fd_keep = 1;
1383
1384 out:
1385         if (r < 0)
1386                 libusb_unref_device(dev);
1387         return r;
1388 }
1389
1390 static int op_open(struct libusb_device_handle *handle)
1391 {
1392         int fd, r;
1393
1394         fd = get_usbfs_fd(handle->dev, O_RDWR, 0);
1395         if (fd < 0) {
1396                 if (fd == LIBUSB_ERROR_NO_DEVICE) {
1397                         /* device will still be marked as attached if hotplug monitor thread
1398                          * hasn't processed remove event yet */
1399                         usbi_mutex_static_lock(&linux_hotplug_lock);
1400                         if (usbi_atomic_load(&handle->dev->attached)) {
1401                                 usbi_dbg(HANDLE_CTX(handle), "open failed with no device, but device still attached");
1402                                 linux_device_disconnected(handle->dev->bus_number,
1403                                                           handle->dev->device_address);
1404                         }
1405                         usbi_mutex_static_unlock(&linux_hotplug_lock);
1406                 }
1407                 return fd;
1408         }
1409
1410         r = initialize_handle(handle, fd);
1411         if (r < 0)
1412                 close(fd);
1413
1414         return r;
1415 }
1416
1417 static void op_close(struct libusb_device_handle *dev_handle)
1418 {
1419         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(dev_handle);
1420
1421         /* fd may have already been removed by POLLERR condition in op_handle_events() */
1422         if (!hpriv->fd_removed)
1423                 usbi_remove_event_source(HANDLE_CTX(dev_handle), hpriv->fd);
1424         if (!hpriv->fd_keep)
1425                 close(hpriv->fd);
1426 }
1427
1428 static int op_get_configuration(struct libusb_device_handle *handle,
1429         uint8_t *config)
1430 {
1431         struct linux_device_priv *priv = usbi_get_device_priv(handle->dev);
1432         int active_config;
1433         int r;
1434
1435         if (priv->sysfs_dir) {
1436                 r = sysfs_get_active_config(handle->dev, &active_config);
1437         } else {
1438                 struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1439
1440                 r = usbfs_get_active_config(handle->dev, hpriv->fd);
1441                 if (r == LIBUSB_SUCCESS)
1442                         active_config = priv->active_config;
1443         }
1444         if (r < 0)
1445                 return r;
1446
1447         if (active_config == -1) {
1448                 usbi_warn(HANDLE_CTX(handle), "device unconfigured");
1449                 active_config = 0;
1450         }
1451
1452         *config = (uint8_t)active_config;
1453
1454         return 0;
1455 }
1456
1457 static int op_set_configuration(struct libusb_device_handle *handle, int config)
1458 {
1459         struct linux_device_priv *priv = usbi_get_device_priv(handle->dev);
1460         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1461         int fd = hpriv->fd;
1462         int r = ioctl(fd, IOCTL_USBFS_SETCONFIGURATION, &config);
1463
1464         if (r < 0) {
1465                 if (errno == EINVAL)
1466                         return LIBUSB_ERROR_NOT_FOUND;
1467                 else if (errno == EBUSY)
1468                         return LIBUSB_ERROR_BUSY;
1469                 else if (errno == ENODEV)
1470                         return LIBUSB_ERROR_NO_DEVICE;
1471
1472                 usbi_err(HANDLE_CTX(handle), "set configuration failed, errno=%d", errno);
1473                 return LIBUSB_ERROR_OTHER;
1474         }
1475
1476         /* if necessary, update our cached active config descriptor */
1477         if (!priv->sysfs_dir) {
1478                 if (config == 0 && !dev_has_config0(handle->dev))
1479                         config = -1;
1480
1481                 priv->active_config = config;
1482         }
1483
1484         return LIBUSB_SUCCESS;
1485 }
1486
1487 static int claim_interface(struct libusb_device_handle *handle, unsigned int iface)
1488 {
1489         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1490         int fd = hpriv->fd;
1491         int r = ioctl(fd, IOCTL_USBFS_CLAIMINTERFACE, &iface);
1492
1493         if (r < 0) {
1494                 if (errno == ENOENT)
1495                         return LIBUSB_ERROR_NOT_FOUND;
1496                 else if (errno == EBUSY)
1497                         return LIBUSB_ERROR_BUSY;
1498                 else if (errno == ENODEV)
1499                         return LIBUSB_ERROR_NO_DEVICE;
1500
1501                 usbi_err(HANDLE_CTX(handle), "claim interface failed, errno=%d", errno);
1502                 return LIBUSB_ERROR_OTHER;
1503         }
1504         return 0;
1505 }
1506
1507 static int release_interface(struct libusb_device_handle *handle, unsigned int iface)
1508 {
1509         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1510         int fd = hpriv->fd;
1511         int r = ioctl(fd, IOCTL_USBFS_RELEASEINTERFACE, &iface);
1512
1513         if (r < 0) {
1514                 if (errno == ENODEV)
1515                         return LIBUSB_ERROR_NO_DEVICE;
1516
1517                 usbi_err(HANDLE_CTX(handle), "release interface failed, errno=%d", errno);
1518                 return LIBUSB_ERROR_OTHER;
1519         }
1520         return 0;
1521 }
1522
1523 static int op_set_interface(struct libusb_device_handle *handle, uint8_t interface,
1524         uint8_t altsetting)
1525 {
1526         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1527         int fd = hpriv->fd;
1528         struct usbfs_setinterface setintf;
1529         int r;
1530
1531         setintf.interface = interface;
1532         setintf.altsetting = altsetting;
1533         r = ioctl(fd, IOCTL_USBFS_SETINTERFACE, &setintf);
1534         if (r < 0) {
1535                 if (errno == EINVAL)
1536                         return LIBUSB_ERROR_NOT_FOUND;
1537                 else if (errno == ENODEV)
1538                         return LIBUSB_ERROR_NO_DEVICE;
1539
1540                 usbi_err(HANDLE_CTX(handle), "set interface failed, errno=%d", errno);
1541                 return LIBUSB_ERROR_OTHER;
1542         }
1543
1544         return 0;
1545 }
1546
1547 static int op_clear_halt(struct libusb_device_handle *handle,
1548         unsigned char endpoint)
1549 {
1550         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1551         int fd = hpriv->fd;
1552         unsigned int _endpoint = endpoint;
1553         int r = ioctl(fd, IOCTL_USBFS_CLEAR_HALT, &_endpoint);
1554
1555         if (r < 0) {
1556                 if (errno == ENOENT)
1557                         return LIBUSB_ERROR_NOT_FOUND;
1558                 else if (errno == ENODEV)
1559                         return LIBUSB_ERROR_NO_DEVICE;
1560
1561                 usbi_err(HANDLE_CTX(handle), "clear halt failed, errno=%d", errno);
1562                 return LIBUSB_ERROR_OTHER;
1563         }
1564
1565         return 0;
1566 }
1567
1568 static int op_reset_device(struct libusb_device_handle *handle)
1569 {
1570         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1571         int fd = hpriv->fd;
1572         int r, ret = 0;
1573         uint8_t i;
1574
1575         /* Doing a device reset will cause the usbfs driver to get unbound
1576          * from any interfaces it is bound to. By voluntarily unbinding
1577          * the usbfs driver ourself, we stop the kernel from rebinding
1578          * the interface after reset (which would end up with the interface
1579          * getting bound to the in kernel driver if any). */
1580         for (i = 0; i < USB_MAXINTERFACES; i++) {
1581                 if (handle->claimed_interfaces & (1UL << i))
1582                         release_interface(handle, i);
1583         }
1584
1585         usbi_mutex_lock(&handle->lock);
1586         r = ioctl(fd, IOCTL_USBFS_RESET, NULL);
1587         if (r < 0) {
1588                 if (errno == ENODEV) {
1589                         ret = LIBUSB_ERROR_NOT_FOUND;
1590                         goto out;
1591                 }
1592
1593                 usbi_err(HANDLE_CTX(handle), "reset failed, errno=%d", errno);
1594                 ret = LIBUSB_ERROR_OTHER;
1595                 goto out;
1596         }
1597
1598         /* And re-claim any interfaces which were claimed before the reset */
1599         for (i = 0; i < USB_MAXINTERFACES; i++) {
1600                 if (!(handle->claimed_interfaces & (1UL << i)))
1601                         continue;
1602                 /*
1603                  * A driver may have completed modprobing during
1604                  * IOCTL_USBFS_RESET, and bound itself as soon as
1605                  * IOCTL_USBFS_RESET released the device lock
1606                  */
1607                 r = detach_kernel_driver_and_claim(handle, i);
1608                 if (r) {
1609                         usbi_warn(HANDLE_CTX(handle), "failed to re-claim interface %u after reset: %s",
1610                                   i, libusb_error_name(r));
1611                         handle->claimed_interfaces &= ~(1UL << i);
1612                         ret = LIBUSB_ERROR_NOT_FOUND;
1613                 }
1614         }
1615 out:
1616         usbi_mutex_unlock(&handle->lock);
1617         return ret;
1618 }
1619
1620 static int do_streams_ioctl(struct libusb_device_handle *handle, long req,
1621         uint32_t num_streams, unsigned char *endpoints, int num_endpoints)
1622 {
1623         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1624         int r, fd = hpriv->fd;
1625         struct usbfs_streams *streams;
1626
1627         if (num_endpoints > 30) /* Max 15 in + 15 out eps */
1628                 return LIBUSB_ERROR_INVALID_PARAM;
1629
1630         streams = malloc(sizeof(*streams) + num_endpoints);
1631         if (!streams)
1632                 return LIBUSB_ERROR_NO_MEM;
1633
1634         streams->num_streams = num_streams;
1635         streams->num_eps = num_endpoints;
1636         memcpy(streams->eps, endpoints, num_endpoints);
1637
1638         r = ioctl(fd, req, streams);
1639
1640         free(streams);
1641
1642         if (r < 0) {
1643                 if (errno == ENOTTY)
1644                         return LIBUSB_ERROR_NOT_SUPPORTED;
1645                 else if (errno == EINVAL)
1646                         return LIBUSB_ERROR_INVALID_PARAM;
1647                 else if (errno == ENODEV)
1648                         return LIBUSB_ERROR_NO_DEVICE;
1649
1650                 usbi_err(HANDLE_CTX(handle), "streams-ioctl failed, errno=%d", errno);
1651                 return LIBUSB_ERROR_OTHER;
1652         }
1653         return r;
1654 }
1655
1656 static int op_alloc_streams(struct libusb_device_handle *handle,
1657         uint32_t num_streams, unsigned char *endpoints, int num_endpoints)
1658 {
1659         return do_streams_ioctl(handle, IOCTL_USBFS_ALLOC_STREAMS,
1660                                 num_streams, endpoints, num_endpoints);
1661 }
1662
1663 static int op_free_streams(struct libusb_device_handle *handle,
1664                 unsigned char *endpoints, int num_endpoints)
1665 {
1666         return do_streams_ioctl(handle, IOCTL_USBFS_FREE_STREAMS, 0,
1667                                 endpoints, num_endpoints);
1668 }
1669
1670 static void *op_dev_mem_alloc(struct libusb_device_handle *handle, size_t len)
1671 {
1672         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1673         void *buffer;
1674
1675         buffer = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, hpriv->fd, 0);
1676         if (buffer == MAP_FAILED) {
1677                 usbi_err(HANDLE_CTX(handle), "alloc dev mem failed, errno=%d", errno);
1678                 return NULL;
1679         }
1680         return buffer;
1681 }
1682
1683 static int op_dev_mem_free(struct libusb_device_handle *handle, void *buffer,
1684         size_t len)
1685 {
1686         if (munmap(buffer, len) != 0) {
1687                 usbi_err(HANDLE_CTX(handle), "free dev mem failed, errno=%d", errno);
1688                 return LIBUSB_ERROR_OTHER;
1689         } else {
1690                 return LIBUSB_SUCCESS;
1691         }
1692 }
1693
1694 static int op_kernel_driver_active(struct libusb_device_handle *handle,
1695         uint8_t interface)
1696 {
1697         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1698         int fd = hpriv->fd;
1699         struct usbfs_getdriver getdrv;
1700         int r;
1701
1702         getdrv.interface = interface;
1703         r = ioctl(fd, IOCTL_USBFS_GETDRIVER, &getdrv);
1704         if (r < 0) {
1705                 if (errno == ENODATA)
1706                         return 0;
1707                 else if (errno == ENODEV)
1708                         return LIBUSB_ERROR_NO_DEVICE;
1709
1710                 usbi_err(HANDLE_CTX(handle), "get driver failed, errno=%d", errno);
1711                 return LIBUSB_ERROR_OTHER;
1712         }
1713
1714         return strcmp(getdrv.driver, "usbfs") != 0;
1715 }
1716
1717 static int op_detach_kernel_driver(struct libusb_device_handle *handle,
1718         uint8_t interface)
1719 {
1720         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1721         int fd = hpriv->fd;
1722         struct usbfs_ioctl command;
1723         struct usbfs_getdriver getdrv;
1724         int r;
1725
1726         command.ifno = interface;
1727         command.ioctl_code = IOCTL_USBFS_DISCONNECT;
1728         command.data = NULL;
1729
1730         getdrv.interface = interface;
1731         r = ioctl(fd, IOCTL_USBFS_GETDRIVER, &getdrv);
1732         if (r == 0 && !strcmp(getdrv.driver, "usbfs"))
1733                 return LIBUSB_ERROR_NOT_FOUND;
1734
1735         r = ioctl(fd, IOCTL_USBFS_IOCTL, &command);
1736         if (r < 0) {
1737                 if (errno == ENODATA)
1738                         return LIBUSB_ERROR_NOT_FOUND;
1739                 else if (errno == EINVAL)
1740                         return LIBUSB_ERROR_INVALID_PARAM;
1741                 else if (errno == ENODEV)
1742                         return LIBUSB_ERROR_NO_DEVICE;
1743
1744                 usbi_err(HANDLE_CTX(handle), "detach failed, errno=%d", errno);
1745                 return LIBUSB_ERROR_OTHER;
1746         }
1747
1748         return 0;
1749 }
1750
1751 static int op_attach_kernel_driver(struct libusb_device_handle *handle,
1752         uint8_t interface)
1753 {
1754         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1755         int fd = hpriv->fd;
1756         struct usbfs_ioctl command;
1757         int r;
1758
1759         command.ifno = interface;
1760         command.ioctl_code = IOCTL_USBFS_CONNECT;
1761         command.data = NULL;
1762
1763         r = ioctl(fd, IOCTL_USBFS_IOCTL, &command);
1764         if (r < 0) {
1765                 if (errno == ENODATA)
1766                         return LIBUSB_ERROR_NOT_FOUND;
1767                 else if (errno == EINVAL)
1768                         return LIBUSB_ERROR_INVALID_PARAM;
1769                 else if (errno == ENODEV)
1770                         return LIBUSB_ERROR_NO_DEVICE;
1771                 else if (errno == EBUSY)
1772                         return LIBUSB_ERROR_BUSY;
1773
1774                 usbi_err(HANDLE_CTX(handle), "attach failed, errno=%d", errno);
1775                 return LIBUSB_ERROR_OTHER;
1776         } else if (r == 0) {
1777                 return LIBUSB_ERROR_NOT_FOUND;
1778         }
1779
1780         return 0;
1781 }
1782
1783 static int detach_kernel_driver_and_claim(struct libusb_device_handle *handle,
1784         uint8_t interface)
1785 {
1786         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1787         struct usbfs_disconnect_claim dc;
1788         int r, fd = hpriv->fd;
1789
1790         dc.interface = interface;
1791         strcpy(dc.driver, "usbfs");
1792         dc.flags = USBFS_DISCONNECT_CLAIM_EXCEPT_DRIVER;
1793         r = ioctl(fd, IOCTL_USBFS_DISCONNECT_CLAIM, &dc);
1794         if (r == 0)
1795                 return 0;
1796         switch (errno) {
1797         case ENOTTY:
1798                 break;
1799         case EBUSY:
1800                 return LIBUSB_ERROR_BUSY;
1801         case EINVAL:
1802                 return LIBUSB_ERROR_INVALID_PARAM;
1803         case ENODEV:
1804                 return LIBUSB_ERROR_NO_DEVICE;
1805         default:
1806                 usbi_err(HANDLE_CTX(handle), "disconnect-and-claim failed, errno=%d", errno);
1807                 return LIBUSB_ERROR_OTHER;
1808         }
1809
1810         /* Fallback code for kernels which don't support the
1811            disconnect-and-claim ioctl */
1812         r = op_detach_kernel_driver(handle, interface);
1813         if (r != 0 && r != LIBUSB_ERROR_NOT_FOUND)
1814                 return r;
1815
1816         return claim_interface(handle, interface);
1817 }
1818
1819 static int op_claim_interface(struct libusb_device_handle *handle, uint8_t interface)
1820 {
1821         if (handle->auto_detach_kernel_driver)
1822                 return detach_kernel_driver_and_claim(handle, interface);
1823         else
1824                 return claim_interface(handle, interface);
1825 }
1826
1827 static int op_release_interface(struct libusb_device_handle *handle, uint8_t interface)
1828 {
1829         int r;
1830
1831         r = release_interface(handle, interface);
1832         if (r)
1833                 return r;
1834
1835         if (handle->auto_detach_kernel_driver)
1836                 op_attach_kernel_driver(handle, interface);
1837
1838         return 0;
1839 }
1840
1841 static void op_destroy_device(struct libusb_device *dev)
1842 {
1843         struct linux_device_priv *priv = usbi_get_device_priv(dev);
1844
1845         free(priv->config_descriptors);
1846         free(priv->descriptors);
1847         free(priv->sysfs_dir);
1848 }
1849
1850 /* URBs are discarded in reverse order of submission to avoid races. */
1851 static int discard_urbs(struct usbi_transfer *itransfer, int first, int last_plus_one)
1852 {
1853         struct libusb_transfer *transfer =
1854                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
1855         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
1856         struct linux_device_handle_priv *hpriv =
1857                 usbi_get_device_handle_priv(transfer->dev_handle);
1858         int i, ret = 0;
1859         struct usbfs_urb *urb;
1860
1861         for (i = last_plus_one - 1; i >= first; i--) {
1862                 if (transfer->type == LIBUSB_TRANSFER_TYPE_ISOCHRONOUS)
1863                         urb = tpriv->iso_urbs[i];
1864                 else
1865                         urb = &tpriv->urbs[i];
1866
1867                 if (ioctl(hpriv->fd, IOCTL_USBFS_DISCARDURB, urb) == 0)
1868                         continue;
1869
1870                 if (errno == EINVAL) {
1871                         usbi_dbg(TRANSFER_CTX(transfer), "URB not found --> assuming ready to be reaped");
1872                         if (i == (last_plus_one - 1))
1873                                 ret = LIBUSB_ERROR_NOT_FOUND;
1874                 } else if (errno == ENODEV) {
1875                         usbi_dbg(TRANSFER_CTX(transfer), "Device not found for URB --> assuming ready to be reaped");
1876                         ret = LIBUSB_ERROR_NO_DEVICE;
1877                 } else {
1878                         usbi_warn(TRANSFER_CTX(transfer), "unrecognised discard errno %d", errno);
1879                         ret = LIBUSB_ERROR_OTHER;
1880                 }
1881         }
1882         return ret;
1883 }
1884
1885 static void free_iso_urbs(struct linux_transfer_priv *tpriv)
1886 {
1887         int i;
1888
1889         for (i = 0; i < tpriv->num_urbs; i++) {
1890                 struct usbfs_urb *urb = tpriv->iso_urbs[i];
1891
1892                 if (!urb)
1893                         break;
1894                 free(urb);
1895         }
1896
1897         free(tpriv->iso_urbs);
1898         tpriv->iso_urbs = NULL;
1899 }
1900
1901 static int submit_bulk_transfer(struct usbi_transfer *itransfer)
1902 {
1903         struct libusb_transfer *transfer =
1904                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
1905         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
1906         struct linux_device_handle_priv *hpriv =
1907                 usbi_get_device_handle_priv(transfer->dev_handle);
1908         struct usbfs_urb *urbs;
1909         int is_out = IS_XFEROUT(transfer);
1910         int bulk_buffer_len, use_bulk_continuation;
1911         int num_urbs;
1912         int last_urb_partial = 0;
1913         int r;
1914         int i;
1915
1916         /*
1917          * Older versions of usbfs place a 16kb limit on bulk URBs. We work
1918          * around this by splitting large transfers into 16k blocks, and then
1919          * submit all urbs at once. it would be simpler to submit one urb at
1920          * a time, but there is a big performance gain doing it this way.
1921          *
1922          * Newer versions lift the 16k limit (USBFS_CAP_NO_PACKET_SIZE_LIM),
1923          * using arbitrary large transfers can still be a bad idea though, as
1924          * the kernel needs to allocate physical contiguous memory for this,
1925          * which may fail for large buffers.
1926          *
1927          * The kernel solves this problem by splitting the transfer into
1928          * blocks itself when the host-controller is scatter-gather capable
1929          * (USBFS_CAP_BULK_SCATTER_GATHER), which most controllers are.
1930          *
1931          * Last, there is the issue of short-transfers when splitting, for
1932          * short split-transfers to work reliable USBFS_CAP_BULK_CONTINUATION
1933          * is needed, but this is not always available.
1934          */
1935         if (hpriv->caps & USBFS_CAP_BULK_SCATTER_GATHER) {
1936                 /* Good! Just submit everything in one go */
1937                 bulk_buffer_len = transfer->length ? transfer->length : 1;
1938                 use_bulk_continuation = 0;
1939         } else if (hpriv->caps & USBFS_CAP_BULK_CONTINUATION) {
1940                 /* Split the transfers and use bulk-continuation to
1941                    avoid issues with short-transfers */
1942                 bulk_buffer_len = MAX_BULK_BUFFER_LENGTH;
1943                 use_bulk_continuation = 1;
1944         } else if (hpriv->caps & USBFS_CAP_NO_PACKET_SIZE_LIM) {
1945                 /* Don't split, assume the kernel can alloc the buffer
1946                    (otherwise the submit will fail with -ENOMEM) */
1947                 bulk_buffer_len = transfer->length ? transfer->length : 1;
1948                 use_bulk_continuation = 0;
1949         } else {
1950                 /* Bad, splitting without bulk-continuation, short transfers
1951                    which end before the last urb will not work reliable! */
1952                 /* Note we don't warn here as this is "normal" on kernels <
1953                    2.6.32 and not a problem for most applications */
1954                 bulk_buffer_len = MAX_BULK_BUFFER_LENGTH;
1955                 use_bulk_continuation = 0;
1956         }
1957
1958         num_urbs = transfer->length / bulk_buffer_len;
1959
1960         if (transfer->length == 0) {
1961                 num_urbs = 1;
1962         } else if ((transfer->length % bulk_buffer_len) > 0) {
1963                 last_urb_partial = 1;
1964                 num_urbs++;
1965         }
1966         usbi_dbg(TRANSFER_CTX(transfer), "need %d urbs for new transfer with length %d", num_urbs, transfer->length);
1967         urbs = calloc(num_urbs, sizeof(*urbs));
1968         if (!urbs)
1969                 return LIBUSB_ERROR_NO_MEM;
1970         tpriv->urbs = urbs;
1971         tpriv->num_urbs = num_urbs;
1972         tpriv->num_retired = 0;
1973         tpriv->reap_action = NORMAL;
1974         tpriv->reap_status = LIBUSB_TRANSFER_COMPLETED;
1975
1976         for (i = 0; i < num_urbs; i++) {
1977                 struct usbfs_urb *urb = &urbs[i];
1978
1979                 urb->usercontext = itransfer;
1980                 switch (transfer->type) {
1981                 case LIBUSB_TRANSFER_TYPE_BULK:
1982                         urb->type = USBFS_URB_TYPE_BULK;
1983                         urb->stream_id = 0;
1984                         break;
1985                 case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
1986                         urb->type = USBFS_URB_TYPE_BULK;
1987                         urb->stream_id = itransfer->stream_id;
1988                         break;
1989                 case LIBUSB_TRANSFER_TYPE_INTERRUPT:
1990                         urb->type = USBFS_URB_TYPE_INTERRUPT;
1991                         break;
1992                 }
1993                 urb->endpoint = transfer->endpoint;
1994                 urb->buffer = transfer->buffer + (i * bulk_buffer_len);
1995
1996                 /* don't set the short not ok flag for the last URB */
1997                 if (use_bulk_continuation && !is_out && (i < num_urbs - 1))
1998                         urb->flags = USBFS_URB_SHORT_NOT_OK;
1999
2000                 if (i == num_urbs - 1 && last_urb_partial)
2001                         urb->buffer_length = transfer->length % bulk_buffer_len;
2002                 else if (transfer->length == 0)
2003                         urb->buffer_length = 0;
2004                 else
2005                         urb->buffer_length = bulk_buffer_len;
2006
2007                 if (i > 0 && use_bulk_continuation)
2008                         urb->flags |= USBFS_URB_BULK_CONTINUATION;
2009
2010                 /* we have already checked that the flag is supported */
2011                 if (is_out && i == num_urbs - 1 &&
2012                     (transfer->flags & LIBUSB_TRANSFER_ADD_ZERO_PACKET))
2013                         urb->flags |= USBFS_URB_ZERO_PACKET;
2014
2015                 r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urb);
2016                 if (r == 0)
2017                         continue;
2018
2019                 if (errno == ENODEV) {
2020                         r = LIBUSB_ERROR_NO_DEVICE;
2021                 } else if (errno == ENOMEM) {
2022                         r = LIBUSB_ERROR_NO_MEM;
2023                 } else {
2024                         usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
2025                         r = LIBUSB_ERROR_IO;
2026                 }
2027
2028                 /* if the first URB submission fails, we can simply free up and
2029                  * return failure immediately. */
2030                 if (i == 0) {
2031                         usbi_dbg(TRANSFER_CTX(transfer), "first URB failed, easy peasy");
2032                         free(urbs);
2033                         tpriv->urbs = NULL;
2034                         return r;
2035                 }
2036
2037                 /* if it's not the first URB that failed, the situation is a bit
2038                  * tricky. we may need to discard all previous URBs. there are
2039                  * complications:
2040                  *  - discarding is asynchronous - discarded urbs will be reaped
2041                  *    later. the user must not have freed the transfer when the
2042                  *    discarded URBs are reaped, otherwise libusb will be using
2043                  *    freed memory.
2044                  *  - the earlier URBs may have completed successfully and we do
2045                  *    not want to throw away any data.
2046                  *  - this URB failing may be no error; EREMOTEIO means that
2047                  *    this transfer simply didn't need all the URBs we submitted
2048                  * so, we report that the transfer was submitted successfully and
2049                  * in case of error we discard all previous URBs. later when
2050                  * the final reap completes we can report error to the user,
2051                  * or success if an earlier URB was completed successfully.
2052                  */
2053                 tpriv->reap_action = errno == EREMOTEIO ? COMPLETED_EARLY : SUBMIT_FAILED;
2054
2055                 /* The URBs we haven't submitted yet we count as already
2056                  * retired. */
2057                 tpriv->num_retired += num_urbs - i;
2058
2059                 /* If we completed short then don't try to discard. */
2060                 if (tpriv->reap_action == COMPLETED_EARLY)
2061                         return 0;
2062
2063                 discard_urbs(itransfer, 0, i);
2064
2065                 usbi_dbg(TRANSFER_CTX(transfer), "reporting successful submission but waiting for %d "
2066                          "discards before reporting error", i);
2067                 return 0;
2068         }
2069
2070         return 0;
2071 }
2072
2073 static int submit_iso_transfer(struct usbi_transfer *itransfer)
2074 {
2075         struct libusb_transfer *transfer =
2076                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2077         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2078         struct linux_device_handle_priv *hpriv =
2079                 usbi_get_device_handle_priv(transfer->dev_handle);
2080         struct usbfs_urb **urbs;
2081         int num_packets = transfer->num_iso_packets;
2082         int num_packets_remaining;
2083         int i, j;
2084         int num_urbs;
2085         unsigned int packet_len;
2086         unsigned int total_len = 0;
2087         unsigned char *urb_buffer = transfer->buffer;
2088
2089         if (num_packets < 1)
2090                 return LIBUSB_ERROR_INVALID_PARAM;
2091
2092         /* usbfs places arbitrary limits on iso URBs. this limit has changed
2093          * at least three times, but we attempt to detect this limit during
2094          * init and check it here. if the kernel rejects the request due to
2095          * its size, we return an error indicating such to the user.
2096          */
2097         for (i = 0; i < num_packets; i++) {
2098                 packet_len = transfer->iso_packet_desc[i].length;
2099
2100                 if (packet_len > max_iso_packet_len) {
2101                         usbi_warn(TRANSFER_CTX(transfer),
2102                                   "iso packet length of %u bytes exceeds maximum of %u bytes",
2103                                   packet_len, max_iso_packet_len);
2104                         return LIBUSB_ERROR_INVALID_PARAM;
2105                 }
2106
2107                 total_len += packet_len;
2108         }
2109
2110         if (transfer->length < (int)total_len)
2111                 return LIBUSB_ERROR_INVALID_PARAM;
2112
2113         /* usbfs limits the number of iso packets per URB */
2114         num_urbs = (num_packets + (MAX_ISO_PACKETS_PER_URB - 1)) / MAX_ISO_PACKETS_PER_URB;
2115
2116         usbi_dbg(TRANSFER_CTX(transfer), "need %d urbs for new transfer with length %d", num_urbs, transfer->length);
2117
2118         urbs = calloc(num_urbs, sizeof(*urbs));
2119         if (!urbs)
2120                 return LIBUSB_ERROR_NO_MEM;
2121
2122         tpriv->iso_urbs = urbs;
2123         tpriv->num_urbs = num_urbs;
2124         tpriv->num_retired = 0;
2125         tpriv->reap_action = NORMAL;
2126         tpriv->iso_packet_offset = 0;
2127
2128         /* allocate + initialize each URB with the correct number of packets */
2129         num_packets_remaining = num_packets;
2130         for (i = 0, j = 0; i < num_urbs; i++) {
2131                 int num_packets_in_urb = MIN(num_packets_remaining, MAX_ISO_PACKETS_PER_URB);
2132                 struct usbfs_urb *urb;
2133                 size_t alloc_size;
2134                 int k;
2135
2136                 alloc_size = sizeof(*urb)
2137                         + (num_packets_in_urb * sizeof(struct usbfs_iso_packet_desc));
2138                 urb = calloc(1, alloc_size);
2139                 if (!urb) {
2140                         free_iso_urbs(tpriv);
2141                         return LIBUSB_ERROR_NO_MEM;
2142                 }
2143                 urbs[i] = urb;
2144
2145                 /* populate packet lengths */
2146                 for (k = 0; k < num_packets_in_urb; j++, k++) {
2147                         packet_len = transfer->iso_packet_desc[j].length;
2148                         urb->buffer_length += packet_len;
2149                         urb->iso_frame_desc[k].length = packet_len;
2150                 }
2151
2152                 urb->usercontext = itransfer;
2153                 urb->type = USBFS_URB_TYPE_ISO;
2154                 /* FIXME: interface for non-ASAP data? */
2155                 urb->flags = USBFS_URB_ISO_ASAP;
2156                 urb->endpoint = transfer->endpoint;
2157                 urb->number_of_packets = num_packets_in_urb;
2158                 urb->buffer = urb_buffer;
2159
2160                 urb_buffer += urb->buffer_length;
2161                 num_packets_remaining -= num_packets_in_urb;
2162         }
2163
2164         /* submit URBs */
2165         for (i = 0; i < num_urbs; i++) {
2166                 int r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urbs[i]);
2167
2168                 if (r == 0)
2169                         continue;
2170
2171                 if (errno == ENODEV) {
2172                         r = LIBUSB_ERROR_NO_DEVICE;
2173                 } else if (errno == EINVAL) {
2174                         usbi_warn(TRANSFER_CTX(transfer), "submiturb failed, transfer too large");
2175                         r = LIBUSB_ERROR_INVALID_PARAM;
2176                 } else if (errno == EMSGSIZE) {
2177                         usbi_warn(TRANSFER_CTX(transfer), "submiturb failed, iso packet length too large");
2178                         r = LIBUSB_ERROR_INVALID_PARAM;
2179                 } else {
2180                         usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
2181                         r = LIBUSB_ERROR_IO;
2182                 }
2183
2184                 /* if the first URB submission fails, we can simply free up and
2185                  * return failure immediately. */
2186                 if (i == 0) {
2187                         usbi_dbg(TRANSFER_CTX(transfer), "first URB failed, easy peasy");
2188                         free_iso_urbs(tpriv);
2189                         return r;
2190                 }
2191
2192                 /* if it's not the first URB that failed, the situation is a bit
2193                  * tricky. we must discard all previous URBs. there are
2194                  * complications:
2195                  *  - discarding is asynchronous - discarded urbs will be reaped
2196                  *    later. the user must not have freed the transfer when the
2197                  *    discarded URBs are reaped, otherwise libusb will be using
2198                  *    freed memory.
2199                  *  - the earlier URBs may have completed successfully and we do
2200                  *    not want to throw away any data.
2201                  * so, in this case we discard all the previous URBs BUT we report
2202                  * that the transfer was submitted successfully. then later when
2203                  * the final discard completes we can report error to the user.
2204                  */
2205                 tpriv->reap_action = SUBMIT_FAILED;
2206
2207                 /* The URBs we haven't submitted yet we count as already
2208                  * retired. */
2209                 tpriv->num_retired = num_urbs - i;
2210                 discard_urbs(itransfer, 0, i);
2211
2212                 usbi_dbg(TRANSFER_CTX(transfer), "reporting successful submission but waiting for %d "
2213                          "discards before reporting error", i);
2214                 return 0;
2215         }
2216
2217         return 0;
2218 }
2219
2220 static int submit_control_transfer(struct usbi_transfer *itransfer)
2221 {
2222         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2223         struct libusb_transfer *transfer =
2224                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2225         struct linux_device_handle_priv *hpriv =
2226                 usbi_get_device_handle_priv(transfer->dev_handle);
2227         struct usbfs_urb *urb;
2228         int r;
2229
2230         if (transfer->length - LIBUSB_CONTROL_SETUP_SIZE > MAX_CTRL_BUFFER_LENGTH)
2231                 return LIBUSB_ERROR_INVALID_PARAM;
2232
2233         urb = calloc(1, sizeof(*urb));
2234         if (!urb)
2235                 return LIBUSB_ERROR_NO_MEM;
2236         tpriv->urbs = urb;
2237         tpriv->num_urbs = 1;
2238         tpriv->reap_action = NORMAL;
2239
2240         urb->usercontext = itransfer;
2241         urb->type = USBFS_URB_TYPE_CONTROL;
2242         urb->endpoint = transfer->endpoint;
2243         urb->buffer = transfer->buffer;
2244         urb->buffer_length = transfer->length;
2245
2246         r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urb);
2247         if (r < 0) {
2248                 free(urb);
2249                 tpriv->urbs = NULL;
2250                 if (errno == ENODEV)
2251                         return LIBUSB_ERROR_NO_DEVICE;
2252
2253                 usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
2254                 return LIBUSB_ERROR_IO;
2255         }
2256         return 0;
2257 }
2258
2259 static int op_submit_transfer(struct usbi_transfer *itransfer)
2260 {
2261         struct libusb_transfer *transfer =
2262                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2263
2264         switch (transfer->type) {
2265         case LIBUSB_TRANSFER_TYPE_CONTROL:
2266                 return submit_control_transfer(itransfer);
2267         case LIBUSB_TRANSFER_TYPE_BULK:
2268         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2269                 return submit_bulk_transfer(itransfer);
2270         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2271                 return submit_bulk_transfer(itransfer);
2272         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2273                 return submit_iso_transfer(itransfer);
2274         default:
2275                 usbi_err(TRANSFER_CTX(transfer), "unknown transfer type %u", transfer->type);
2276                 return LIBUSB_ERROR_INVALID_PARAM;
2277         }
2278 }
2279
2280 static int op_cancel_transfer(struct usbi_transfer *itransfer)
2281 {
2282         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2283         struct libusb_transfer *transfer =
2284                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2285         int r;
2286
2287         if (!tpriv->urbs)
2288                 return LIBUSB_ERROR_NOT_FOUND;
2289
2290         r = discard_urbs(itransfer, 0, tpriv->num_urbs);
2291         if (r != 0)
2292                 return r;
2293
2294         switch (transfer->type) {
2295         case LIBUSB_TRANSFER_TYPE_BULK:
2296         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2297                 if (tpriv->reap_action == ERROR)
2298                         break;
2299                 /* else, fall through */
2300         default:
2301                 tpriv->reap_action = CANCELLED;
2302         }
2303
2304         return 0;
2305 }
2306
2307 static void op_clear_transfer_priv(struct usbi_transfer *itransfer)
2308 {
2309         struct libusb_transfer *transfer =
2310                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2311         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2312
2313         switch (transfer->type) {
2314         case LIBUSB_TRANSFER_TYPE_CONTROL:
2315         case LIBUSB_TRANSFER_TYPE_BULK:
2316         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2317         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2318                 if (tpriv->urbs) {
2319                         free(tpriv->urbs);
2320                         tpriv->urbs = NULL;
2321                 }
2322                 break;
2323         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2324                 if (tpriv->iso_urbs) {
2325                         free_iso_urbs(tpriv);
2326                         tpriv->iso_urbs = NULL;
2327                 }
2328                 break;
2329         default:
2330                 usbi_err(TRANSFER_CTX(transfer), "unknown transfer type %u", transfer->type);
2331         }
2332 }
2333
2334 static int handle_bulk_completion(struct usbi_transfer *itransfer,
2335         struct usbfs_urb *urb)
2336 {
2337         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2338         struct libusb_transfer *transfer = USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2339         int urb_idx = urb - tpriv->urbs;
2340
2341         usbi_mutex_lock(&itransfer->lock);
2342         usbi_dbg(TRANSFER_CTX(transfer), "handling completion status %d of bulk urb %d/%d", urb->status,
2343                  urb_idx + 1, tpriv->num_urbs);
2344
2345         tpriv->num_retired++;
2346
2347         if (tpriv->reap_action != NORMAL) {
2348                 /* cancelled, submit_fail, or completed early */
2349                 usbi_dbg(TRANSFER_CTX(transfer), "abnormal reap: urb status %d", urb->status);
2350
2351                 /* even though we're in the process of cancelling, it's possible that
2352                  * we may receive some data in these URBs that we don't want to lose.
2353                  * examples:
2354                  * 1. while the kernel is cancelling all the packets that make up an
2355                  *    URB, a few of them might complete. so we get back a successful
2356                  *    cancellation *and* some data.
2357                  * 2. we receive a short URB which marks the early completion condition,
2358                  *    so we start cancelling the remaining URBs. however, we're too
2359                  *    slow and another URB completes (or at least completes partially).
2360                  *    (this can't happen since we always use BULK_CONTINUATION.)
2361                  *
2362                  * When this happens, our objectives are not to lose any "surplus" data,
2363                  * and also to stick it at the end of the previously-received data
2364                  * (closing any holes), so that libusb reports the total amount of
2365                  * transferred data and presents it in a contiguous chunk.
2366                  */
2367                 if (urb->actual_length > 0) {
2368                         unsigned char *target = transfer->buffer + itransfer->transferred;
2369
2370                         usbi_dbg(TRANSFER_CTX(transfer), "received %d bytes of surplus data", urb->actual_length);
2371                         if (urb->buffer != target) {
2372                                 usbi_dbg(TRANSFER_CTX(transfer), "moving surplus data from offset %zu to offset %zu",
2373                                          (unsigned char *)urb->buffer - transfer->buffer,
2374                                          target - transfer->buffer);
2375                                 memmove(target, urb->buffer, urb->actual_length);
2376                         }
2377                         itransfer->transferred += urb->actual_length;
2378                 }
2379
2380                 if (tpriv->num_retired == tpriv->num_urbs) {
2381                         usbi_dbg(TRANSFER_CTX(transfer), "abnormal reap: last URB handled, reporting");
2382                         if (tpriv->reap_action != COMPLETED_EARLY &&
2383                             tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2384                                 tpriv->reap_status = LIBUSB_TRANSFER_ERROR;
2385                         goto completed;
2386                 }
2387                 goto out_unlock;
2388         }
2389
2390         itransfer->transferred += urb->actual_length;
2391
2392         /* Many of these errors can occur on *any* urb of a multi-urb
2393          * transfer.  When they do, we tear down the rest of the transfer.
2394          */
2395         switch (urb->status) {
2396         case 0:
2397                 break;
2398         case -EREMOTEIO: /* short transfer */
2399                 break;
2400         case -ENOENT: /* cancelled */
2401         case -ECONNRESET:
2402                 break;
2403         case -ENODEV:
2404         case -ESHUTDOWN:
2405                 usbi_dbg(TRANSFER_CTX(transfer), "device removed");
2406                 tpriv->reap_status = LIBUSB_TRANSFER_NO_DEVICE;
2407                 goto cancel_remaining;
2408         case -EPIPE:
2409                 usbi_dbg(TRANSFER_CTX(transfer), "detected endpoint stall");
2410                 if (tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2411                         tpriv->reap_status = LIBUSB_TRANSFER_STALL;
2412                 goto cancel_remaining;
2413         case -EOVERFLOW:
2414                 /* overflow can only ever occur in the last urb */
2415                 usbi_dbg(TRANSFER_CTX(transfer), "overflow, actual_length=%d", urb->actual_length);
2416                 if (tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2417                         tpriv->reap_status = LIBUSB_TRANSFER_OVERFLOW;
2418                 goto completed;
2419         case -ETIME:
2420         case -EPROTO:
2421         case -EILSEQ:
2422         case -ECOMM:
2423         case -ENOSR:
2424                 usbi_dbg(TRANSFER_CTX(transfer), "low-level bus error %d", urb->status);
2425                 tpriv->reap_action = ERROR;
2426                 goto cancel_remaining;
2427         default:
2428                 usbi_warn(ITRANSFER_CTX(itransfer), "unrecognised urb status %d", urb->status);
2429                 tpriv->reap_action = ERROR;
2430                 goto cancel_remaining;
2431         }
2432
2433         /* if we've reaped all urbs or we got less data than requested then we're
2434          * done */
2435         if (tpriv->num_retired == tpriv->num_urbs) {
2436                 usbi_dbg(TRANSFER_CTX(transfer), "all URBs in transfer reaped --> complete!");
2437                 goto completed;
2438         } else if (urb->actual_length < urb->buffer_length) {
2439                 usbi_dbg(TRANSFER_CTX(transfer), "short transfer %d/%d --> complete!",
2440                          urb->actual_length, urb->buffer_length);
2441                 if (tpriv->reap_action == NORMAL)
2442                         tpriv->reap_action = COMPLETED_EARLY;
2443         } else {
2444                 goto out_unlock;
2445         }
2446
2447 cancel_remaining:
2448         if (tpriv->reap_action == ERROR && tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2449                 tpriv->reap_status = LIBUSB_TRANSFER_ERROR;
2450
2451         if (tpriv->num_retired == tpriv->num_urbs) /* nothing to cancel */
2452                 goto completed;
2453
2454         /* cancel remaining urbs and wait for their completion before
2455          * reporting results */
2456         discard_urbs(itransfer, urb_idx + 1, tpriv->num_urbs);
2457
2458 out_unlock:
2459         usbi_mutex_unlock(&itransfer->lock);
2460         return 0;
2461
2462 completed:
2463         free(tpriv->urbs);
2464         tpriv->urbs = NULL;
2465         usbi_mutex_unlock(&itransfer->lock);
2466         return tpriv->reap_action == CANCELLED ?
2467                 usbi_handle_transfer_cancellation(itransfer) :
2468                 usbi_handle_transfer_completion(itransfer, tpriv->reap_status);
2469 }
2470
2471 static int handle_iso_completion(struct usbi_transfer *itransfer,
2472         struct usbfs_urb *urb)
2473 {
2474         struct libusb_transfer *transfer =
2475                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2476         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2477         int num_urbs = tpriv->num_urbs;
2478         int urb_idx = 0;
2479         int i;
2480         enum libusb_transfer_status status = LIBUSB_TRANSFER_COMPLETED;
2481
2482         usbi_mutex_lock(&itransfer->lock);
2483         for (i = 0; i < num_urbs; i++) {
2484                 if (urb == tpriv->iso_urbs[i]) {
2485                         urb_idx = i + 1;
2486                         break;
2487                 }
2488         }
2489         if (urb_idx == 0) {
2490                 usbi_err(TRANSFER_CTX(transfer), "could not locate urb!");
2491                 usbi_mutex_unlock(&itransfer->lock);
2492                 return LIBUSB_ERROR_NOT_FOUND;
2493         }
2494
2495         usbi_dbg(TRANSFER_CTX(transfer), "handling completion status %d of iso urb %d/%d", urb->status,
2496                  urb_idx, num_urbs);
2497
2498         /* copy isochronous results back in */
2499
2500         for (i = 0; i < urb->number_of_packets; i++) {
2501                 struct usbfs_iso_packet_desc *urb_desc = &urb->iso_frame_desc[i];
2502                 struct libusb_iso_packet_descriptor *lib_desc =
2503                         &transfer->iso_packet_desc[tpriv->iso_packet_offset++];
2504
2505                 lib_desc->status = LIBUSB_TRANSFER_COMPLETED;
2506                 switch (urb_desc->status) {
2507                 case 0:
2508                         break;
2509                 case -ENOENT: /* cancelled */
2510                 case -ECONNRESET:
2511                         break;
2512                 case -ENODEV:
2513                 case -ESHUTDOWN:
2514                         usbi_dbg(TRANSFER_CTX(transfer), "packet %d - device removed", i);
2515                         lib_desc->status = LIBUSB_TRANSFER_NO_DEVICE;
2516                         break;
2517                 case -EPIPE:
2518                         usbi_dbg(TRANSFER_CTX(transfer), "packet %d - detected endpoint stall", i);
2519                         lib_desc->status = LIBUSB_TRANSFER_STALL;
2520                         break;
2521                 case -EOVERFLOW:
2522                         usbi_dbg(TRANSFER_CTX(transfer), "packet %d - overflow error", i);
2523                         lib_desc->status = LIBUSB_TRANSFER_OVERFLOW;
2524                         break;
2525                 case -ETIME:
2526                 case -EPROTO:
2527                 case -EILSEQ:
2528                 case -ECOMM:
2529                 case -ENOSR:
2530                 case -EXDEV:
2531                         usbi_dbg(TRANSFER_CTX(transfer), "packet %d - low-level USB error %d", i, urb_desc->status);
2532                         lib_desc->status = LIBUSB_TRANSFER_ERROR;
2533                         break;
2534                 default:
2535                         usbi_warn(TRANSFER_CTX(transfer), "packet %d - unrecognised urb status %d",
2536                                   i, urb_desc->status);
2537                         lib_desc->status = LIBUSB_TRANSFER_ERROR;
2538                         break;
2539                 }
2540                 lib_desc->actual_length = urb_desc->actual_length;
2541         }
2542
2543         tpriv->num_retired++;
2544
2545         if (tpriv->reap_action != NORMAL) { /* cancelled or submit_fail */
2546                 usbi_dbg(TRANSFER_CTX(transfer), "CANCEL: urb status %d", urb->status);
2547
2548                 if (tpriv->num_retired == num_urbs) {
2549                         usbi_dbg(TRANSFER_CTX(transfer), "CANCEL: last URB handled, reporting");
2550                         free_iso_urbs(tpriv);
2551                         if (tpriv->reap_action == CANCELLED) {
2552                                 usbi_mutex_unlock(&itransfer->lock);
2553                                 return usbi_handle_transfer_cancellation(itransfer);
2554                         } else {
2555                                 usbi_mutex_unlock(&itransfer->lock);
2556                                 return usbi_handle_transfer_completion(itransfer, LIBUSB_TRANSFER_ERROR);
2557                         }
2558                 }
2559                 goto out;
2560         }
2561
2562         switch (urb->status) {
2563         case 0:
2564                 break;
2565         case -ENOENT: /* cancelled */
2566         case -ECONNRESET:
2567                 break;
2568         case -ESHUTDOWN:
2569                 usbi_dbg(TRANSFER_CTX(transfer), "device removed");
2570                 status = LIBUSB_TRANSFER_NO_DEVICE;
2571                 break;
2572         default:
2573                 usbi_warn(TRANSFER_CTX(transfer), "unrecognised urb status %d", urb->status);
2574                 status = LIBUSB_TRANSFER_ERROR;
2575                 break;
2576         }
2577
2578         /* if we've reaped all urbs then we're done */
2579         if (tpriv->num_retired == num_urbs) {
2580                 usbi_dbg(TRANSFER_CTX(transfer), "all URBs in transfer reaped --> complete!");
2581                 free_iso_urbs(tpriv);
2582                 usbi_mutex_unlock(&itransfer->lock);
2583                 return usbi_handle_transfer_completion(itransfer, status);
2584         }
2585
2586 out:
2587         usbi_mutex_unlock(&itransfer->lock);
2588         return 0;
2589 }
2590
2591 static int handle_control_completion(struct usbi_transfer *itransfer,
2592         struct usbfs_urb *urb)
2593 {
2594         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2595         int status;
2596
2597         usbi_mutex_lock(&itransfer->lock);
2598         usbi_dbg(ITRANSFER_CTX(itransfer), "handling completion status %d", urb->status);
2599
2600         itransfer->transferred += urb->actual_length;
2601
2602         if (tpriv->reap_action == CANCELLED) {
2603                 if (urb->status && urb->status != -ENOENT)
2604                         usbi_warn(ITRANSFER_CTX(itransfer), "cancel: unrecognised urb status %d",
2605                                   urb->status);
2606                 free(tpriv->urbs);
2607                 tpriv->urbs = NULL;
2608                 usbi_mutex_unlock(&itransfer->lock);
2609                 return usbi_handle_transfer_cancellation(itransfer);
2610         }
2611
2612         switch (urb->status) {
2613         case 0:
2614                 status = LIBUSB_TRANSFER_COMPLETED;
2615                 break;
2616         case -ENOENT: /* cancelled */
2617                 status = LIBUSB_TRANSFER_CANCELLED;
2618                 break;
2619         case -ENODEV:
2620         case -ESHUTDOWN:
2621                 usbi_dbg(ITRANSFER_CTX(itransfer), "device removed");
2622                 status = LIBUSB_TRANSFER_NO_DEVICE;
2623                 break;
2624         case -EPIPE:
2625                 usbi_dbg(ITRANSFER_CTX(itransfer), "unsupported control request");
2626                 status = LIBUSB_TRANSFER_STALL;
2627                 break;
2628         case -EOVERFLOW:
2629                 usbi_dbg(ITRANSFER_CTX(itransfer), "overflow, actual_length=%d", urb->actual_length);
2630                 status = LIBUSB_TRANSFER_OVERFLOW;
2631                 break;
2632         case -ETIME:
2633         case -EPROTO:
2634         case -EILSEQ:
2635         case -ECOMM:
2636         case -ENOSR:
2637                 usbi_dbg(ITRANSFER_CTX(itransfer), "low-level bus error %d", urb->status);
2638                 status = LIBUSB_TRANSFER_ERROR;
2639                 break;
2640         default:
2641                 usbi_warn(ITRANSFER_CTX(itransfer), "unrecognised urb status %d", urb->status);
2642                 status = LIBUSB_TRANSFER_ERROR;
2643                 break;
2644         }
2645
2646         free(tpriv->urbs);
2647         tpriv->urbs = NULL;
2648         usbi_mutex_unlock(&itransfer->lock);
2649         return usbi_handle_transfer_completion(itransfer, status);
2650 }
2651
2652 static int reap_for_handle(struct libusb_device_handle *handle)
2653 {
2654         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
2655         int r;
2656         struct usbfs_urb *urb = NULL;
2657         struct usbi_transfer *itransfer;
2658         struct libusb_transfer *transfer;
2659
2660         r = ioctl(hpriv->fd, IOCTL_USBFS_REAPURBNDELAY, &urb);
2661         if (r < 0) {
2662                 if (errno == EAGAIN)
2663                         return 1;
2664                 if (errno == ENODEV)
2665                         return LIBUSB_ERROR_NO_DEVICE;
2666
2667                 usbi_err(HANDLE_CTX(handle), "reap failed, errno=%d", errno);
2668                 return LIBUSB_ERROR_IO;
2669         }
2670
2671         itransfer = urb->usercontext;
2672         transfer = USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2673
2674         usbi_dbg(HANDLE_CTX(handle), "urb type=%u status=%d transferred=%d", urb->type, urb->status, urb->actual_length);
2675
2676         switch (transfer->type) {
2677         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2678                 return handle_iso_completion(itransfer, urb);
2679         case LIBUSB_TRANSFER_TYPE_BULK:
2680         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2681         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2682                 return handle_bulk_completion(itransfer, urb);
2683         case LIBUSB_TRANSFER_TYPE_CONTROL:
2684                 return handle_control_completion(itransfer, urb);
2685         default:
2686                 usbi_err(HANDLE_CTX(handle), "unrecognised transfer type %u", transfer->type);
2687                 return LIBUSB_ERROR_OTHER;
2688         }
2689 }
2690
2691 static int op_handle_events(struct libusb_context *ctx,
2692         void *event_data, unsigned int count, unsigned int num_ready)
2693 {
2694         struct pollfd *fds = event_data;
2695         unsigned int n;
2696         int r;
2697
2698         usbi_mutex_lock(&ctx->open_devs_lock);
2699         for (n = 0; n < count && num_ready > 0; n++) {
2700                 struct pollfd *pollfd = &fds[n];
2701                 struct libusb_device_handle *handle;
2702                 struct linux_device_handle_priv *hpriv = NULL;
2703                 int reap_count;
2704
2705                 if (!pollfd->revents)
2706                         continue;
2707
2708                 num_ready--;
2709                 for_each_open_device(ctx, handle) {
2710                         hpriv = usbi_get_device_handle_priv(handle);
2711                         if (hpriv->fd == pollfd->fd)
2712                                 break;
2713                 }
2714
2715                 if (!hpriv || hpriv->fd != pollfd->fd) {
2716                         usbi_err(ctx, "cannot find handle for fd %d",
2717                                  pollfd->fd);
2718                         continue;
2719                 }
2720
2721                 if (pollfd->revents & POLLERR) {
2722                         /* remove the fd from the pollfd set so that it doesn't continuously
2723                          * trigger an event, and flag that it has been removed so op_close()
2724                          * doesn't try to remove it a second time */
2725                         usbi_remove_event_source(HANDLE_CTX(handle), hpriv->fd);
2726                         hpriv->fd_removed = 1;
2727
2728                         /* device will still be marked as attached if hotplug monitor thread
2729                          * hasn't processed remove event yet */
2730                         usbi_mutex_static_lock(&linux_hotplug_lock);
2731                         if (usbi_atomic_load(&handle->dev->attached))
2732                                 linux_device_disconnected(handle->dev->bus_number,
2733                                                           handle->dev->device_address);
2734                         usbi_mutex_static_unlock(&linux_hotplug_lock);
2735
2736                         if (hpriv->caps & USBFS_CAP_REAP_AFTER_DISCONNECT) {
2737                                 do {
2738                                         r = reap_for_handle(handle);
2739                                 } while (r == 0);
2740                         }
2741
2742                         usbi_handle_disconnect(handle);
2743                         continue;
2744                 }
2745
2746                 reap_count = 0;
2747                 do {
2748                         r = reap_for_handle(handle);
2749                 } while (r == 0 && ++reap_count <= 25);
2750
2751                 if (r == 1 || r == LIBUSB_ERROR_NO_DEVICE)
2752                         continue;
2753                 else if (r < 0)
2754                         goto out;
2755         }
2756
2757         r = 0;
2758 out:
2759         usbi_mutex_unlock(&ctx->open_devs_lock);
2760         return r;
2761 }
2762
2763 const struct usbi_os_backend usbi_backend = {
2764         .name = "Linux usbfs",
2765         .caps = USBI_CAP_HAS_HID_ACCESS|USBI_CAP_SUPPORTS_DETACH_KERNEL_DRIVER,
2766         .init = op_init,
2767         .exit = op_exit,
2768         .set_option = op_set_option,
2769         .hotplug_poll = op_hotplug_poll,
2770         .get_active_config_descriptor = op_get_active_config_descriptor,
2771         .get_config_descriptor = op_get_config_descriptor,
2772         .get_config_descriptor_by_value = op_get_config_descriptor_by_value,
2773
2774         .wrap_sys_device = op_wrap_sys_device,
2775         .open = op_open,
2776         .close = op_close,
2777         .get_configuration = op_get_configuration,
2778         .set_configuration = op_set_configuration,
2779         .claim_interface = op_claim_interface,
2780         .release_interface = op_release_interface,
2781
2782         .set_interface_altsetting = op_set_interface,
2783         .clear_halt = op_clear_halt,
2784         .reset_device = op_reset_device,
2785
2786         .alloc_streams = op_alloc_streams,
2787         .free_streams = op_free_streams,
2788
2789         .dev_mem_alloc = op_dev_mem_alloc,
2790         .dev_mem_free = op_dev_mem_free,
2791
2792         .kernel_driver_active = op_kernel_driver_active,
2793         .detach_kernel_driver = op_detach_kernel_driver,
2794         .attach_kernel_driver = op_attach_kernel_driver,
2795
2796         .destroy_device = op_destroy_device,
2797
2798         .submit_transfer = op_submit_transfer,
2799         .cancel_transfer = op_cancel_transfer,
2800         .clear_transfer_priv = op_clear_transfer_priv,
2801
2802         .handle_events = op_handle_events,
2803
2804         .device_priv_size = sizeof(struct linux_device_priv),
2805         .device_handle_priv_size = sizeof(struct linux_device_handle_priv),
2806         .transfer_priv_size = sizeof(struct linux_transfer_priv),
2807 };