libusb/os/linux_usbfs.c

   1 /* -*- Mode: C; c-basic-offset:8 ; indent-tabs-mode:t -*- */
   2 /*
   3  * Linux usbfs backend for libusb
   4  * Copyright © 2007-2009 Daniel Drake <dsd@gentoo.org>
   5  * Copyright © 2001 Johannes Erdfelt <johannes@erdfelt.com>
   6  * Copyright © 2013 Nathan Hjelm <hjelmn@mac.com>
   7  * Copyright © 2012-2013 Hans de Goede <hdegoede@redhat.com>
   8  * Copyright © 2020 Chris Dickens <christopher.a.dickens@gmail.com>
   9  *
  10  * This library is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU Lesser General Public
  12  * License as published by the Free Software Foundation; either
  13  * version 2.1 of the License, or (at your option) any later version.
  14  *
  15  * This library is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18  * Lesser General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU Lesser General Public
  21  * License along with this library; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  23  */
  24
  25 #include "libusbi.h"
  26 #include "linux_usbfs.h"
  27
  28 #include <alloca.h>
  29 #include <ctype.h>
  30 #include <dirent.h>
  31 #include <errno.h>
  32 #include <fcntl.h>
  33 #include <stdio.h>
  34 #include <string.h>
  35 #include <sys/ioctl.h>
  36 #include <sys/mman.h>
  37 #include <sys/utsname.h>
  38 #include <sys/vfs.h>
  39 #include <unistd.h>
  40
  41 /* sysfs vs usbfs:
  42  * opening a usbfs node causes the device to be resumed, so we attempt to
  43  * avoid this during enumeration.
  44  *
  45  * sysfs allows us to read the kernel's in-memory copies of device descriptors
  46  * and so forth, avoiding the need to open the device:
  47  *  - The binary "descriptors" file contains all config descriptors since
  48  *    2.6.26, commit 217a9081d8e69026186067711131b77f0ce219ed
  49  *  - The binary "descriptors" file was added in 2.6.23, commit
  50  *    69d42a78f935d19384d1f6e4f94b65bb162b36df, but it only contains the
  51  *    active config descriptors
  52  *  - The "busnum" file was added in 2.6.22, commit
  53  *    83f7d958eab2fbc6b159ee92bf1493924e1d0f72
  54  *  - The "devnum" file has been present since pre-2.6.18
  55  *  - the "bConfigurationValue" file has been present since pre-2.6.18
  56  *
  57  * If we have bConfigurationValue, busnum, and devnum, then we can determine
  58  * the active configuration without having to open the usbfs node in RDWR mode.
  59  * The busnum file is important as that is the only way we can relate sysfs
  60  * devices to usbfs nodes.
  61  *
  62  * If we also have all descriptors, we can obtain the device descriptor and
  63  * configuration without touching usbfs at all.
  64  */
  65
  66 /* endianness for multi-byte fields:
  67  *
  68  * Descriptors exposed by usbfs have the multi-byte fields in the device
  69  * descriptor as host endian. Multi-byte fields in the other descriptors are
  70  * bus-endian. The kernel documentation says otherwise, but it is wrong.
  71  *
  72  * In sysfs all descriptors are bus-endian.
  73  */
  74
  75 #define USBDEV_PATH             "/dev"
  76 #define USB_DEVTMPFS_PATH       "/dev/bus/usb"
  77
  78 /* use usbdev*.* device names in /dev instead of the usbfs bus directories */
  79 static int usbdev_names = 0;
  80
  81 /* Linux has changed the maximum length of an individual isochronous packet
  82  * over time.  Initially this limit was 1,023 bytes, but Linux 2.6.18
  83  * (commit 3612242e527eb47ee4756b5350f8bdf791aa5ede) increased this value to
  84  * 8,192 bytes to support higher bandwidth devices.  Linux 3.10
  85  * (commit e2e2f0ea1c935edcf53feb4c4c8fdb4f86d57dd9) further increased this
  86  * value to 49,152 bytes to support super speed devices.  Linux 5.2
  87  * (commit 8a1dbc8d91d3d1602282c7e6b4222c7759c916fa) even further increased
  88  * this value to 98,304 bytes to support super speed plus devices.
  89  */
  90 static unsigned int max_iso_packet_len = 0;
  91
  92 /* is sysfs available (mounted) ? */
  93 static int sysfs_available = -1;
  94
  95 /* how many times have we initted (and not exited) ? */
  96 static int init_count = 0;
  97
  98 #ifdef __ANDROID__
  99 /* have no authority to operate usb device directly */
 100 static int weak_authority = 0;
 101 #endif
 102
 103 /* Serialize hotplug start/stop */
 104 static usbi_mutex_static_t linux_hotplug_startstop_lock = USBI_MUTEX_INITIALIZER;
 105 /* Serialize scan-devices, event-thread, and poll */
 106 usbi_mutex_static_t linux_hotplug_lock = USBI_MUTEX_INITIALIZER;
 107
 108 static int linux_scan_devices(struct libusb_context *ctx);
 109 static int detach_kernel_driver_and_claim(struct libusb_device_handle *, uint8_t);
 110
 111 #if !defined(HAVE_LIBUDEV)
 112 static int linux_default_scan_devices(struct libusb_context *ctx);
 113 #endif
 114
 115 struct kernel_version {
 116         int major;
 117         int minor;
 118         int sublevel;
 119 };
 120
 121 struct config_descriptor {
 122         struct usbi_configuration_descriptor *desc;
 123         size_t actual_len;
 124 };
 125
 126 struct linux_device_priv {
 127         char *sysfs_dir;
 128         void *descriptors;
 129         size_t descriptors_len;
 130         struct config_descriptor *config_descriptors;
 131         uint8_t active_config; /* cache val for !sysfs_available  */
 132 };
 133
 134 struct linux_device_handle_priv {
 135         int fd;
 136         int fd_removed;
 137         int fd_keep;
 138         uint32_t caps;
 139 };
 140
 141 enum reap_action {
 142         NORMAL = 0,
 143         /* submission failed after the first URB, so await cancellation/completion
 144          * of all the others */
 145         SUBMIT_FAILED,
 146
 147         /* cancelled by user or timeout */
 148         CANCELLED,
 149
 150         /* completed multi-URB transfer in non-final URB */
 151         COMPLETED_EARLY,
 152
 153         /* one or more urbs encountered a low-level error */
 154         ERROR,
 155 };
 156
 157 struct linux_transfer_priv {
 158         union {
 159                 struct usbfs_urb *urbs;
 160                 struct usbfs_urb **iso_urbs;
 161         };
 162
 163         enum reap_action reap_action;
 164         int num_urbs;
 165         int num_retired;
 166         enum libusb_transfer_status reap_status;
 167
 168         /* next iso packet in user-supplied transfer to be populated */
 169         int iso_packet_offset;
 170 };
 171
 172 static int get_usbfs_fd(struct libusb_device *dev, mode_t mode, int silent)
 173 {
 174         struct libusb_context *ctx = DEVICE_CTX(dev);
 175         char path[24];
 176         int fd;
 177
 178         if (usbdev_names)
 179                 sprintf(path, USBDEV_PATH "/usbdev%u.%u",
 180                         dev->bus_number, dev->device_address);
 181         else
 182                 sprintf(path, USB_DEVTMPFS_PATH "/%03u/%03u",
 183                         dev->bus_number, dev->device_address);
 184
 185         fd = open(path, mode | O_CLOEXEC);
 186         if (fd != -1)
 187                 return fd; /* Success */
 188
 189         if (errno == ENOENT) {
 190                 const long delay_ms = 10L;
 191                 const struct timespec delay_ts = { 0L, delay_ms * 1000L * 1000L };
 192
 193                 if (!silent)
 194                         usbi_err(ctx, "File doesn't exist, wait %ld ms and try again", delay_ms);
 195
 196                 /* Wait 10ms for USB device path creation.*/
 197                 nanosleep(&delay_ts, NULL);
 198
 199                 fd = open(path, mode | O_CLOEXEC);
 200                 if (fd != -1)
 201                         return fd; /* Success */
 202         }
 203
 204         if (!silent) {
 205                 usbi_err(ctx, "libusb couldn't open USB device %s, errno=%d", path, errno);
 206                 if (errno == EACCES && mode == O_RDWR)
 207                         usbi_err(ctx, "libusb requires write access to USB device nodes");
 208         }
 209
 210         if (errno == EACCES)
 211                 return LIBUSB_ERROR_ACCESS;
 212         if (errno == ENOENT)
 213                 return LIBUSB_ERROR_NO_DEVICE;
 214         return LIBUSB_ERROR_IO;
 215 }
 216
 217 /* check dirent for a /dev/usbdev%d.%d name
 218  * optionally return bus/device on success */
 219 static int is_usbdev_entry(const char *name, uint8_t *bus_p, uint8_t *dev_p)
 220 {
 221         int busnum, devnum;
 222
 223         if (sscanf(name, "usbdev%d.%d", &busnum, &devnum) != 2)
 224                 return 0;
 225         if (busnum < 0 || busnum > UINT8_MAX || devnum < 0 || devnum > UINT8_MAX) {
 226                 usbi_dbg("invalid usbdev format '%s'", name);
 227                 return 0;
 228         }
 229
 230         usbi_dbg("found: %s", name);
 231         if (bus_p)
 232                 *bus_p = (uint8_t)busnum;
 233         if (dev_p)
 234                 *dev_p = (uint8_t)devnum;
 235         return 1;
 236 }
 237
 238 static const char *find_usbfs_path(void)
 239 {
 240         const char *path;
 241         DIR *dir;
 242         struct dirent *entry;
 243
 244         path = USB_DEVTMPFS_PATH;
 245         dir = opendir(path);
 246         if (dir) {
 247                 while ((entry = readdir(dir))) {
 248                         if (entry->d_name[0] == '.')
 249                                 continue;
 250
 251                         /* We assume if we find any files that it must be the right place */
 252                         break;
 253                 }
 254
 255                 closedir(dir);
 256
 257                 if (entry)
 258                         return path;
 259         }
 260
 261         /* look for /dev/usbdev*.* if the normal place fails */
 262         path = USBDEV_PATH;
 263         dir = opendir(path);
 264         if (dir) {
 265                 while ((entry = readdir(dir))) {
 266                         if (entry->d_name[0] == '.')
 267                                 continue;
 268
 269                         if (is_usbdev_entry(entry->d_name, NULL, NULL)) {
 270                                 /* found one; that's enough */
 271                                 break;
 272                         }
 273                 }
 274
 275                 closedir(dir);
 276
 277                 if (entry) {
 278                         usbdev_names = 1;
 279                         return path;
 280                 }
 281         }
 282
 283 /* On udev based systems without any usb-devices /dev/bus/usb will not
 284  * exist. So if we've not found anything and we're using udev for hotplug
 285  * simply assume /dev/bus/usb rather then making libusb_init fail.
 286  * Make the same assumption for Android where SELinux policies might block us
 287  * from reading /dev on newer devices. */
 288 #if defined(HAVE_LIBUDEV) || defined(__ANDROID__)
 289         return USB_DEVTMPFS_PATH;
 290 #else
 291         return NULL;
 292 #endif
 293 }
 294
 295 static int get_kernel_version(struct libusb_context *ctx,
 296         struct kernel_version *ver)
 297 {
 298         struct utsname uts;
 299         int atoms;
 300
 301         if (uname(&uts) < 0) {
 302                 usbi_err(ctx, "uname failed, errno=%d", errno);
 303                 return -1;
 304         }
 305
 306         atoms = sscanf(uts.release, "%d.%d.%d", &ver->major, &ver->minor, &ver->sublevel);
 307         if (atoms < 2) {
 308                 usbi_err(ctx, "failed to parse uname release '%s'", uts.release);
 309                 return -1;
 310         }
 311
 312         if (atoms < 3)
 313                 ver->sublevel = -1;
 314
 315         usbi_dbg("reported kernel version is %s", uts.release);
 316
 317         return 0;
 318 }
 319
 320 static int kernel_version_ge(const struct kernel_version *ver,
 321         int major, int minor, int sublevel)
 322 {
 323         if (ver->major > major)
 324                 return 1;
 325         else if (ver->major < major)
 326                 return 0;
 327
 328         /* kmajor == major */
 329         if (ver->minor > minor)
 330                 return 1;
 331         else if (ver->minor < minor)
 332                 return 0;
 333
 334         /* kminor == minor */
 335         if (ver->sublevel == -1)
 336                 return sublevel == 0;
 337
 338         return ver->sublevel >= sublevel;
 339 }
 340
 341 static int op_init(struct libusb_context *ctx)
 342 {
 343         struct kernel_version kversion;
 344         const char *usbfs_path;
 345         int r;
 346
 347         if (get_kernel_version(ctx, &kversion) < 0)
 348                 return LIBUSB_ERROR_OTHER;
 349
 350         if (!kernel_version_ge(&kversion, 2, 6, 32)) {
 351                 usbi_err(ctx, "kernel version is too old (reported as %d.%d.%d)",
 352                          kversion.major, kversion.minor,
 353                          kversion.sublevel != -1 ? kversion.sublevel : 0);
 354                 return LIBUSB_ERROR_NOT_SUPPORTED;
 355         }
 356
 357         usbfs_path = find_usbfs_path();
 358         if (!usbfs_path) {
 359                 usbi_err(ctx, "could not find usbfs");
 360                 return LIBUSB_ERROR_OTHER;
 361         }
 362
 363         usbi_dbg("found usbfs at %s", usbfs_path);
 364
 365         if (!max_iso_packet_len) {
 366                 if (kernel_version_ge(&kversion, 5, 2, 0))
 367                         max_iso_packet_len = 98304;
 368                 else if (kernel_version_ge(&kversion, 3, 10, 0))
 369                         max_iso_packet_len = 49152;
 370                 else
 371                         max_iso_packet_len = 8192;
 372         }
 373
 374         usbi_dbg("max iso packet length is (likely) %u bytes", max_iso_packet_len);
 375
 376         if (sysfs_available == -1) {
 377                 struct statfs statfsbuf;
 378
 379                 r = statfs(SYSFS_MOUNT_PATH, &statfsbuf);
 380                 if (r == 0 && statfsbuf.f_type == SYSFS_MAGIC) {
 381                         usbi_dbg("sysfs is available");
 382                         sysfs_available = 1;
 383                 } else {
 384                         usbi_warn(ctx, "sysfs not mounted");
 385                         sysfs_available = 0;
 386                 }
 387         }
 388
 389 #ifdef __ANDROID__
 390         if (weak_authority) {
 391                 return LIBUSB_SUCCESS;
 392         }
 393 #endif
 394
 395         usbi_mutex_static_lock(&linux_hotplug_startstop_lock);
 396         r = LIBUSB_SUCCESS;
 397         if (init_count == 0) {
 398                 /* start up hotplug event handler */
 399                 r = linux_start_event_monitor();
 400         }
 401         if (r == LIBUSB_SUCCESS) {
 402                 r = linux_scan_devices(ctx);
 403                 if (r == LIBUSB_SUCCESS)
 404                         init_count++;
 405                 else if (init_count == 0)
 406                         linux_stop_event_monitor();
 407         } else {
 408                 usbi_err(ctx, "error starting hotplug event monitor");
 409         }
 410         usbi_mutex_static_unlock(&linux_hotplug_startstop_lock);
 411
 412         return r;
 413 }
 414
 415 static void op_exit(struct libusb_context *ctx)
 416 {
 417         UNUSED(ctx);
 418         usbi_mutex_static_lock(&linux_hotplug_startstop_lock);
 419         assert(init_count != 0);
 420         if (!--init_count) {
 421                 /* tear down event handler */
 422                 linux_stop_event_monitor();
 423         }
 424         usbi_mutex_static_unlock(&linux_hotplug_startstop_lock);
 425 }
 426
 427 static int op_set_option(struct libusb_context *ctx, enum libusb_option option, va_list ap)
 428 {
 429         UNUSED(ctx);
 430         UNUSED(ap);
 431
 432         switch (option) {
 433 #ifdef __ANDROID__
 434         case LIBUSB_OPTION_WEAK_AUTHORITY:
 435                 usbi_dbg("set libusb has weak authority");
 436                 weak_authority = 1;
 437                 return LIBUSB_SUCCESS;
 438 #endif
 439         default:
 440                 return LIBUSB_ERROR_NOT_SUPPORTED;
 441         }
 442 }
 443
 444 static int linux_scan_devices(struct libusb_context *ctx)
 445 {
 446         int ret;
 447
 448         usbi_mutex_static_lock(&linux_hotplug_lock);
 449
 450 #if defined(HAVE_LIBUDEV)
 451         ret = linux_udev_scan_devices(ctx);
 452 #else
 453         ret = linux_default_scan_devices(ctx);
 454 #endif
 455
 456         usbi_mutex_static_unlock(&linux_hotplug_lock);
 457
 458         return ret;
 459 }
 460
 461 static void op_hotplug_poll(void)
 462 {
 463         linux_hotplug_poll();
 464 }
 465
 466 static int open_sysfs_attr(struct libusb_context *ctx,
 467         const char *sysfs_dir, const char *attr)
 468 {
 469         char filename[256];
 470         int fd;
 471
 472         snprintf(filename, sizeof(filename), SYSFS_DEVICE_PATH "/%s/%s", sysfs_dir, attr);
 473         fd = open(filename, O_RDONLY | O_CLOEXEC);
 474         if (fd < 0) {
 475                 if (errno == ENOENT) {
 476                         /* File doesn't exist. Assume the device has been
 477                            disconnected (see trac ticket #70). */
 478                         return LIBUSB_ERROR_NO_DEVICE;
 479                 }
 480                 usbi_err(ctx, "open %s failed, errno=%d", filename, errno);
 481                 return LIBUSB_ERROR_IO;
 482         }
 483
 484         return fd;
 485 }
 486
 487 /* Note only suitable for attributes which always read >= 0, < 0 is error */
 488 static int read_sysfs_attr(struct libusb_context *ctx,
 489         const char *sysfs_dir, const char *attr, int max_value, int *value_p)
 490 {
 491         char buf[20], *endptr;
 492         long value;
 493         ssize_t r;
 494         int fd;
 495
 496         fd = open_sysfs_attr(ctx, sysfs_dir, attr);
 497         if (fd < 0)
 498                 return fd;
 499
 500         r = read(fd, buf, sizeof(buf));
 501         if (r < 0) {
 502                 r = errno;
 503                 close(fd);
 504                 if (r == ENODEV)
 505                         return LIBUSB_ERROR_NO_DEVICE;
 506                 usbi_err(ctx, "attribute %s read failed, errno=%zd", attr, r);
 507                 return LIBUSB_ERROR_IO;
 508         }
 509         close(fd);
 510
 511         if (r == 0) {
 512                 /* Certain attributes (e.g. bConfigurationValue) are not
 513                  * populated if the device is not configured. */
 514                 *value_p = -1;
 515                 return 0;
 516         }
 517
 518         /* The kernel does *not* NULL-terminate the string, but every attribute
 519          * should be terminated with a newline character. */
 520         if (!isdigit(buf[0])) {
 521                 usbi_err(ctx, "attribute %s doesn't have numeric value?", attr);
 522                 return LIBUSB_ERROR_IO;
 523         } else if (buf[r - 1] != '\n') {
 524                 usbi_err(ctx, "attribute %s doesn't end with newline?", attr);
 525                 return LIBUSB_ERROR_IO;
 526         }
 527         buf[r - 1] = '\0';
 528
 529         errno = 0;
 530         value = strtol(buf, &endptr, 10);
 531         if (value < 0 || value > (long)max_value || errno) {
 532                 usbi_err(ctx, "attribute %s contains an invalid value: '%s'", attr, buf);
 533                 return LIBUSB_ERROR_INVALID_PARAM;
 534         } else if (*endptr != '\0') {
 535                 /* Consider the value to be valid if the remainder is a '.'
 536                  * character followed by numbers.  This occurs, for example,
 537                  * when reading the "speed" attribute for a low-speed device
 538                  * (e.g. "1.5") */
 539                 if (*endptr == '.' && isdigit(*(endptr + 1))) {
 540                         endptr++;
 541                         while (isdigit(*endptr))
 542                                 endptr++;
 543                 }
 544                 if (*endptr != '\0') {
 545                         usbi_err(ctx, "attribute %s contains an invalid value: '%s'", attr, buf);
 546                         return LIBUSB_ERROR_INVALID_PARAM;
 547                 }
 548         }
 549
 550         *value_p = (int)value;
 551         return 0;
 552 }
 553
 554 static int sysfs_scan_device(struct libusb_context *ctx, const char *devname)
 555 {
 556         uint8_t busnum, devaddr;
 557         int ret;
 558
 559         ret = linux_get_device_address(ctx, 0, &busnum, &devaddr, NULL, devname, -1);
 560         if (ret != LIBUSB_SUCCESS)
 561                 return ret;
 562
 563         return linux_enumerate_device(ctx, busnum, devaddr, devname);
 564 }
 565
 566 /* read the bConfigurationValue for a device */
 567 static int sysfs_get_active_config(struct libusb_device *dev, uint8_t *config)
 568 {
 569         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 570         int ret, tmp;
 571
 572         ret = read_sysfs_attr(DEVICE_CTX(dev), priv->sysfs_dir, "bConfigurationValue",
 573                               UINT8_MAX, &tmp);
 574         if (ret < 0)
 575                 return ret;
 576
 577         if (tmp == -1)
 578                 tmp = 0;        /* unconfigured */
 579
 580         *config = (uint8_t)tmp;
 581
 582         return 0;
 583 }
 584
 585 int linux_get_device_address(struct libusb_context *ctx, int detached,
 586         uint8_t *busnum, uint8_t *devaddr, const char *dev_node,
 587         const char *sys_name, int fd)
 588 {
 589         int sysfs_val;
 590         int r;
 591
 592         usbi_dbg("getting address for device: %s detached: %d", sys_name, detached);
 593         /* can't use sysfs to read the bus and device number if the
 594          * device has been detached */
 595         if (!sysfs_available || detached || !sys_name) {
 596                 if (!dev_node && fd >= 0) {
 597                         char *fd_path = alloca(PATH_MAX);
 598                         char proc_path[32];
 599
 600                         /* try to retrieve the device node from fd */
 601                         sprintf(proc_path, "/proc/self/fd/%d", fd);
 602                         r = readlink(proc_path, fd_path, PATH_MAX - 1);
 603                         if (r > 0) {
 604                                 fd_path[r] = '\0';
 605                                 dev_node = fd_path;
 606                         }
 607                 }
 608
 609                 if (!dev_node)
 610                         return LIBUSB_ERROR_OTHER;
 611
 612                 /* will this work with all supported kernel versions? */
 613                 if (!strncmp(dev_node, "/dev/bus/usb", 12))
 614                         sscanf(dev_node, "/dev/bus/usb/%hhu/%hhu", busnum, devaddr);
 615                 else
 616                         return LIBUSB_ERROR_OTHER;
 617
 618                 return LIBUSB_SUCCESS;
 619         }
 620
 621         usbi_dbg("scan %s", sys_name);
 622
 623         r = read_sysfs_attr(ctx, sys_name, "busnum", UINT8_MAX, &sysfs_val);
 624         if (r < 0)
 625                 return r;
 626         *busnum = (uint8_t)sysfs_val;
 627
 628         r = read_sysfs_attr(ctx, sys_name, "devnum", UINT8_MAX, &sysfs_val);
 629         if (r < 0)
 630                 return r;
 631         *devaddr = (uint8_t)sysfs_val;
 632
 633         usbi_dbg("bus=%u dev=%u", *busnum, *devaddr);
 634
 635         return LIBUSB_SUCCESS;
 636 }
 637
 638 /* Return offset of the next config descriptor */
 639 static int seek_to_next_config(struct libusb_context *ctx,
 640         uint8_t *buffer, size_t len)
 641 {
 642         struct usbi_descriptor_header *header;
 643         int offset = 0;
 644
 645         while (len > 0) {
 646                 if (len < 2) {
 647                         usbi_err(ctx, "short descriptor read %zu/2", len);
 648                         return LIBUSB_ERROR_IO;
 649                 }
 650
 651                 header = (struct usbi_descriptor_header *)buffer;
 652                 if (header->bDescriptorType == LIBUSB_DT_CONFIG)
 653                         return offset;
 654
 655                 if (len < header->bLength) {
 656                         usbi_err(ctx, "bLength overflow by %zu bytes",
 657                                  (size_t)header->bLength - len);
 658                         return LIBUSB_ERROR_IO;
 659                 }
 660
 661                 offset += header->bLength;
 662                 buffer += header->bLength;
 663                 len -= header->bLength;
 664         }
 665
 666         usbi_err(ctx, "config descriptor not found");
 667         return LIBUSB_ERROR_IO;
 668 }
 669
 670 static int parse_config_descriptors(struct libusb_device *dev)
 671 {
 672         struct libusb_context *ctx = DEVICE_CTX(dev);
 673         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 674         struct usbi_device_descriptor *device_desc;
 675         uint8_t idx, num_configs;
 676         uint8_t *buffer;
 677         size_t remaining;
 678
 679         device_desc = (struct usbi_device_descriptor *)priv->descriptors;
 680         num_configs = device_desc->bNumConfigurations;
 681
 682         if (num_configs == 0)
 683                 return 0;       /* no configurations? */
 684
 685         priv->config_descriptors = malloc(num_configs * sizeof(priv->config_descriptors[0]));
 686         if (!priv->config_descriptors)
 687                 return LIBUSB_ERROR_NO_MEM;
 688
 689         buffer = priv->descriptors + LIBUSB_DT_DEVICE_SIZE;
 690         remaining = priv->descriptors_len - LIBUSB_DT_DEVICE_SIZE;
 691
 692         for (idx = 0; idx < num_configs; idx++) {
 693                 struct usbi_configuration_descriptor *config_desc;
 694                 uint16_t config_len;
 695
 696                 if (remaining < LIBUSB_DT_CONFIG_SIZE) {
 697                         usbi_err(ctx, "short descriptor read %zu/%d",
 698                                  remaining, LIBUSB_DT_CONFIG_SIZE);
 699                         return LIBUSB_ERROR_IO;
 700                 }
 701
 702                 config_desc = (struct usbi_configuration_descriptor *)buffer;
 703                 if (config_desc->bDescriptorType != LIBUSB_DT_CONFIG) {
 704                         usbi_err(ctx, "descriptor is not a config desc (type 0x%02x)",
 705                                  config_desc->bDescriptorType);
 706                         return LIBUSB_ERROR_IO;
 707                 } else if (config_desc->bLength < LIBUSB_DT_CONFIG_SIZE) {
 708                         usbi_err(ctx, "invalid descriptor bLength %u",
 709                                  config_desc->bLength);
 710                         return LIBUSB_ERROR_IO;
 711                 }
 712
 713                 config_len = libusb_le16_to_cpu(config_desc->wTotalLength);
 714                 if (config_len < LIBUSB_DT_CONFIG_SIZE) {
 715                         usbi_err(ctx, "invalid wTotalLength %u", config_len);
 716                         return LIBUSB_ERROR_IO;
 717                 }
 718
 719                 if (priv->sysfs_dir) {
 720                          /*
 721                          * In sysfs wTotalLength is ignored, instead the kernel returns a
 722                          * config descriptor with verified bLength fields, with descriptors
 723                          * with an invalid bLength removed.
 724                          */
 725                         uint16_t sysfs_config_len;
 726                         int offset;
 727
 728                         if (num_configs > 1 && idx < num_configs - 1) {
 729                                 offset = seek_to_next_config(ctx, buffer + LIBUSB_DT_CONFIG_SIZE,
 730                                                              remaining - LIBUSB_DT_CONFIG_SIZE);
 731                                 if (offset < 0)
 732                                         return offset;
 733                                 sysfs_config_len = (uint16_t)offset;
 734                         } else {
 735                                 sysfs_config_len = (uint16_t)remaining;
 736                         }
 737
 738                         if (config_len != sysfs_config_len) {
 739                                 usbi_warn(ctx, "config length mismatch wTotalLength %u real %u",
 740                                           config_len, sysfs_config_len);
 741                                 config_len = sysfs_config_len;
 742                         }
 743                 } else {
 744                         /*
 745                          * In usbfs the config descriptors are wTotalLength bytes apart,
 746                          * with any short reads from the device appearing as holes in the file.
 747                          */
 748                         if (config_len > remaining) {
 749                                 usbi_warn(ctx, "short descriptor read %zu/%u", remaining, config_len);
 750                                 config_len = (uint16_t)remaining;
 751                         }
 752                 }
 753
 754                 priv->config_descriptors[idx].desc = config_desc;
 755                 priv->config_descriptors[idx].actual_len = config_len;
 756
 757                 buffer += config_len;
 758                 remaining -= config_len;
 759         }
 760
 761         return LIBUSB_SUCCESS;
 762 }
 763
 764 static int op_get_config_descriptor_by_value(struct libusb_device *dev,
 765         uint8_t value, void **buffer)
 766 {
 767         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 768         struct config_descriptor *config;
 769         uint8_t idx;
 770
 771         for (idx = 0; idx < dev->device_descriptor.bNumConfigurations; idx++) {
 772                 config = &priv->config_descriptors[idx];
 773                 if (config->desc->bConfigurationValue == value) {
 774                         *buffer = config->desc;
 775                         return (int)config->actual_len;
 776                 }
 777         }
 778
 779         return LIBUSB_ERROR_NOT_FOUND;
 780 }
 781
 782 static int op_get_active_config_descriptor(struct libusb_device *dev,
 783         void *buffer, size_t len)
 784 {
 785         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 786         void *config_desc;
 787         uint8_t active_config;
 788         int r;
 789
 790         if (priv->sysfs_dir) {
 791                 r = sysfs_get_active_config(dev, &active_config);
 792                 if (r < 0)
 793                         return r;
 794         } else {
 795                 /* Use cached bConfigurationValue */
 796                 active_config = priv->active_config;
 797         }
 798
 799         if (active_config == 0) {
 800                 usbi_err(DEVICE_CTX(dev), "device unconfigured");
 801                 return LIBUSB_ERROR_NOT_FOUND;
 802         }
 803
 804         r = op_get_config_descriptor_by_value(dev, active_config, &config_desc);
 805         if (r < 0)
 806                 return r;
 807
 808         len = MIN(len, (size_t)r);
 809         memcpy(buffer, config_desc, len);
 810         return len;
 811 }
 812
 813 static int op_get_config_descriptor(struct libusb_device *dev,
 814         uint8_t config_index, void *buffer, size_t len)
 815 {
 816         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 817         struct config_descriptor *config;
 818
 819         if (config_index >= dev->device_descriptor.bNumConfigurations)
 820                 return LIBUSB_ERROR_NOT_FOUND;
 821
 822         config = &priv->config_descriptors[config_index];
 823         len = MIN(len, config->actual_len);
 824         memcpy(buffer, config->desc, len);
 825         return len;
 826 }
 827
 828 /* send a control message to retrieve active configuration */
 829 static int usbfs_get_active_config(struct libusb_device *dev, int fd)
 830 {
 831         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 832         uint8_t active_config = 0;
 833         int r;
 834
 835         struct usbfs_ctrltransfer ctrl = {
 836                 .bmRequestType = LIBUSB_ENDPOINT_IN,
 837                 .bRequest = LIBUSB_REQUEST_GET_CONFIGURATION,
 838                 .wValue = 0,
 839                 .wIndex = 0,
 840                 .wLength = 1,
 841                 .timeout = 1000,
 842                 .data = &active_config
 843         };
 844
 845         r = ioctl(fd, IOCTL_USBFS_CONTROL, &ctrl);
 846         if (r < 0) {
 847                 if (errno == ENODEV)
 848                         return LIBUSB_ERROR_NO_DEVICE;
 849
 850                 /* we hit this error path frequently with buggy devices :( */
 851                 usbi_warn(DEVICE_CTX(dev), "get configuration failed, errno=%d", errno);
 852         } else if (active_config == 0) {
 853                 /* some buggy devices have a configuration 0, but we're
 854                  * reaching into the corner of a corner case here, so let's
 855                  * not support buggy devices in these circumstances.
 856                  * stick to the specs: a configuration value of 0 means
 857                  * unconfigured. */
 858                 usbi_warn(DEVICE_CTX(dev), "active cfg 0? assuming unconfigured device");
 859         }
 860
 861         priv->active_config = active_config;
 862
 863         return LIBUSB_SUCCESS;
 864 }
 865
 866 static int initialize_device(struct libusb_device *dev, uint8_t busnum,
 867         uint8_t devaddr, const char *sysfs_dir, int wrapped_fd)
 868 {
 869         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 870         struct libusb_context *ctx = DEVICE_CTX(dev);
 871         size_t alloc_len;
 872         int fd, speed, r;
 873         ssize_t nb;
 874
 875         dev->bus_number = busnum;
 876         dev->device_address = devaddr;
 877
 878         if (sysfs_dir) {
 879                 priv->sysfs_dir = strdup(sysfs_dir);
 880                 if (!priv->sysfs_dir)
 881                         return LIBUSB_ERROR_NO_MEM;
 882
 883                 /* Note speed can contain 1.5, in this case read_sysfs_attr()
 884                    will stop parsing at the '.' and return 1 */
 885                 if (read_sysfs_attr(ctx, sysfs_dir, "speed", INT_MAX, &speed) == 0) {
 886                         switch (speed) {
 887                         case     1: dev->speed = LIBUSB_SPEED_LOW; break;
 888                         case    12: dev->speed = LIBUSB_SPEED_FULL; break;
 889                         case   480: dev->speed = LIBUSB_SPEED_HIGH; break;
 890                         case  5000: dev->speed = LIBUSB_SPEED_SUPER; break;
 891                         case 10000: dev->speed = LIBUSB_SPEED_SUPER_PLUS; break;
 892                         default:
 893                                 usbi_warn(ctx, "unknown device speed: %d Mbps", speed);
 894                         }
 895                 }
 896         }
 897
 898         /* cache descriptors in memory */
 899         if (sysfs_dir) {
 900                 fd = open_sysfs_attr(ctx, sysfs_dir, "descriptors");
 901         } else if (wrapped_fd < 0) {
 902                 fd = get_usbfs_fd(dev, O_RDONLY, 0);
 903         } else {
 904                 fd = wrapped_fd;
 905                 r = lseek(fd, 0, SEEK_SET);
 906                 if (r < 0) {
 907                         usbi_err(ctx, "lseek failed, errno=%d", errno);
 908                         return LIBUSB_ERROR_IO;
 909                 }
 910         }
 911         if (fd < 0)
 912                 return fd;
 913
 914         alloc_len = 0;
 915         do {
 916                 alloc_len += 256;
 917                 priv->descriptors = usbi_reallocf(priv->descriptors, alloc_len);
 918                 if (!priv->descriptors) {
 919                         if (fd != wrapped_fd)
 920                                 close(fd);
 921                         return LIBUSB_ERROR_NO_MEM;
 922                 }
 923                 /* usbfs has holes in the file */
 924                 if (!sysfs_dir)
 925                         memset(priv->descriptors + priv->descriptors_len,
 926                                0, alloc_len - priv->descriptors_len);
 927                 nb = read(fd, priv->descriptors + priv->descriptors_len,
 928                           alloc_len - priv->descriptors_len);
 929                 if (nb < 0) {
 930                         usbi_err(ctx, "read descriptor failed, errno=%d", errno);
 931                         if (fd != wrapped_fd)
 932                                 close(fd);
 933                         return LIBUSB_ERROR_IO;
 934                 }
 935                 priv->descriptors_len += (size_t)nb;
 936         } while (priv->descriptors_len == alloc_len);
 937
 938         if (fd != wrapped_fd)
 939                 close(fd);
 940
 941         if (priv->descriptors_len < LIBUSB_DT_DEVICE_SIZE) {
 942                 usbi_err(ctx, "short descriptor read (%zu)", priv->descriptors_len);
 943                 return LIBUSB_ERROR_IO;
 944         }
 945
 946         r = parse_config_descriptors(dev);
 947         if (r < 0)
 948                 return r;
 949
 950         memcpy(&dev->device_descriptor, priv->descriptors, LIBUSB_DT_DEVICE_SIZE);
 951
 952         if (sysfs_dir) {
 953                 /* sysfs descriptors are in bus-endian format */
 954                 usbi_localize_device_descriptor(&dev->device_descriptor);
 955                 return LIBUSB_SUCCESS;
 956         }
 957
 958         /* cache active config */
 959         if (wrapped_fd < 0)
 960                 fd = get_usbfs_fd(dev, O_RDWR, 1);
 961         else
 962                 fd = wrapped_fd;
 963         if (fd < 0) {
 964                 /* cannot send a control message to determine the active
 965                  * config. just assume the first one is active. */
 966                 usbi_warn(ctx, "Missing rw usbfs access; cannot determine "
 967                                "active configuration descriptor");
 968                 if (priv->config_descriptors)
 969                         priv->active_config = priv->config_descriptors[0].desc->bConfigurationValue;
 970                 else
 971                         priv->active_config = 0; /* No config dt */
 972
 973                 return LIBUSB_SUCCESS;
 974         }
 975
 976         r = usbfs_get_active_config(dev, fd);
 977         if (fd != wrapped_fd)
 978                 close(fd);
 979
 980         return r;
 981 }
 982
 983 static int linux_get_parent_info(struct libusb_device *dev, const char *sysfs_dir)
 984 {
 985         struct libusb_context *ctx = DEVICE_CTX(dev);
 986         struct libusb_device *it;
 987         char *parent_sysfs_dir, *tmp;
 988         int ret, add_parent = 1;
 989
 990         /* XXX -- can we figure out the topology when using usbfs? */
 991         if (!sysfs_dir || !strncmp(sysfs_dir, "usb", 3)) {
 992                 /* either using usbfs or finding the parent of a root hub */
 993                 return LIBUSB_SUCCESS;
 994         }
 995
 996         parent_sysfs_dir = strdup(sysfs_dir);
 997         if (!parent_sysfs_dir)
 998                 return LIBUSB_ERROR_NO_MEM;
 999
1000         if ((tmp = strrchr(parent_sysfs_dir, '.')) ||
1001             (tmp = strrchr(parent_sysfs_dir, '-'))) {
1002                 dev->port_number = atoi(tmp + 1);
1003                 *tmp = '\0';
1004         } else {
1005                 usbi_warn(ctx, "Can not parse sysfs_dir: %s, no parent info",
1006                           parent_sysfs_dir);
1007                 free(parent_sysfs_dir);
1008                 return LIBUSB_SUCCESS;
1009         }
1010
1011         /* is the parent a root hub? */
1012         if (!strchr(parent_sysfs_dir, '-')) {
1013                 tmp = parent_sysfs_dir;
1014                 ret = asprintf(&parent_sysfs_dir, "usb%s", tmp);
1015                 free(tmp);
1016                 if (ret < 0)
1017                         return LIBUSB_ERROR_NO_MEM;
1018         }
1019
1020 retry:
1021         /* find the parent in the context */
1022         usbi_mutex_lock(&ctx->usb_devs_lock);
1023         for_each_device(ctx, it) {
1024                 struct linux_device_priv *priv = usbi_get_device_priv(it);
1025
1026                 if (priv->sysfs_dir) {
1027                         if (!strcmp(priv->sysfs_dir, parent_sysfs_dir)) {
1028                                 dev->parent_dev = libusb_ref_device(it);
1029                                 break;
1030                         }
1031                 }
1032         }
1033         usbi_mutex_unlock(&ctx->usb_devs_lock);
1034
1035         if (!dev->parent_dev && add_parent) {
1036                 usbi_dbg("parent_dev %s not enumerated yet, enumerating now",
1037                          parent_sysfs_dir);
1038                 sysfs_scan_device(ctx, parent_sysfs_dir);
1039                 add_parent = 0;
1040                 goto retry;
1041         }
1042
1043         usbi_dbg("dev %p (%s) has parent %p (%s) port %u", dev, sysfs_dir,
1044                  dev->parent_dev, parent_sysfs_dir, dev->port_number);
1045
1046         free(parent_sysfs_dir);
1047
1048         return LIBUSB_SUCCESS;
1049 }
1050
1051 int linux_enumerate_device(struct libusb_context *ctx,
1052         uint8_t busnum, uint8_t devaddr, const char *sysfs_dir)
1053 {
1054         unsigned long session_id;
1055         struct libusb_device *dev;
1056         int r;
1057
1058         /* FIXME: session ID is not guaranteed unique as addresses can wrap and
1059          * will be reused. instead we should add a simple sysfs attribute with
1060          * a session ID. */
1061         session_id = busnum << 8 | devaddr;
1062         usbi_dbg("busnum %u devaddr %u session_id %lu", busnum, devaddr, session_id);
1063
1064         dev = usbi_get_device_by_session_id(ctx, session_id);
1065         if (dev) {
1066                 /* device already exists in the context */
1067                 usbi_dbg("session_id %lu already exists", session_id);
1068                 libusb_unref_device(dev);
1069                 return LIBUSB_SUCCESS;
1070         }
1071
1072         usbi_dbg("allocating new device for %u/%u (session %lu)",
1073                  busnum, devaddr, session_id);
1074         dev = usbi_alloc_device(ctx, session_id);
1075         if (!dev)
1076                 return LIBUSB_ERROR_NO_MEM;
1077
1078         r = initialize_device(dev, busnum, devaddr, sysfs_dir, -1);
1079         if (r < 0)
1080                 goto out;
1081         r = usbi_sanitize_device(dev);
1082         if (r < 0)
1083                 goto out;
1084
1085         r = linux_get_parent_info(dev, sysfs_dir);
1086         if (r < 0)
1087                 goto out;
1088 out:
1089         if (r < 0)
1090                 libusb_unref_device(dev);
1091         else
1092                 usbi_connect_device(dev);
1093
1094         return r;
1095 }
1096
1097 void linux_hotplug_enumerate(uint8_t busnum, uint8_t devaddr, const char *sys_name)
1098 {
1099         struct libusb_context *ctx;
1100
1101         usbi_mutex_static_lock(&active_contexts_lock);
1102         for_each_context(ctx) {
1103                 linux_enumerate_device(ctx, busnum, devaddr, sys_name);
1104         }
1105         usbi_mutex_static_unlock(&active_contexts_lock);
1106 }
1107
1108 void linux_device_disconnected(uint8_t busnum, uint8_t devaddr)
1109 {
1110         struct libusb_context *ctx;
1111         struct libusb_device *dev;
1112         unsigned long session_id = busnum << 8 | devaddr;
1113
1114         usbi_mutex_static_lock(&active_contexts_lock);
1115         for_each_context(ctx) {
1116                 dev = usbi_get_device_by_session_id(ctx, session_id);
1117                 if (dev) {
1118                         usbi_disconnect_device(dev);
1119                         libusb_unref_device(dev);
1120                 } else {
1121                         usbi_dbg("device not found for session %lx", session_id);
1122                 }
1123         }
1124         usbi_mutex_static_unlock(&active_contexts_lock);
1125 }
1126
1127 #if !defined(HAVE_LIBUDEV)
1128 static int parse_u8(const char *str, uint8_t *val_p)
1129 {
1130         char *endptr;
1131         long num;
1132
1133         errno = 0;
1134         num = strtol(str, &endptr, 10);
1135         if (num < 0 || num > UINT8_MAX || errno)
1136                 return 0;
1137         if (endptr == str || *endptr != '\0')
1138                 return 0;
1139
1140         *val_p = (uint8_t)num;
1141         return 1;
1142 }
1143
1144 /* open a bus directory and adds all discovered devices to the context */
1145 static int usbfs_scan_busdir(struct libusb_context *ctx, uint8_t busnum)
1146 {
1147         DIR *dir;
1148         char dirpath[20];
1149         struct dirent *entry;
1150         int r = LIBUSB_ERROR_IO;
1151
1152         sprintf(dirpath, USB_DEVTMPFS_PATH "/%03u", busnum);
1153         usbi_dbg("%s", dirpath);
1154         dir = opendir(dirpath);
1155         if (!dir) {
1156                 usbi_err(ctx, "opendir '%s' failed, errno=%d", dirpath, errno);
1157                 /* FIXME: should handle valid race conditions like hub unplugged
1158                  * during directory iteration - this is not an error */
1159                 return r;
1160         }
1161
1162         while ((entry = readdir(dir))) {
1163                 uint8_t devaddr;
1164
1165                 if (entry->d_name[0] == '.')
1166                         continue;
1167
1168                 if (!parse_u8(entry->d_name, &devaddr)) {
1169                         usbi_dbg("unknown dir entry %s", entry->d_name);
1170                         continue;
1171                 }
1172
1173                 if (linux_enumerate_device(ctx, busnum, devaddr, NULL)) {
1174                         usbi_dbg("failed to enumerate dir entry %s", entry->d_name);
1175                         continue;
1176                 }
1177
1178                 r = 0;
1179         }
1180
1181         closedir(dir);
1182         return r;
1183 }
1184
1185 static int usbfs_get_device_list(struct libusb_context *ctx)
1186 {
1187         struct dirent *entry;
1188         DIR *buses;
1189         uint8_t busnum, devaddr;
1190         int r = 0;
1191
1192         if (usbdev_names)
1193                 buses = opendir(USBDEV_PATH);
1194         else
1195                 buses = opendir(USB_DEVTMPFS_PATH);
1196
1197         if (!buses) {
1198                 usbi_err(ctx, "opendir buses failed, errno=%d", errno);
1199                 return LIBUSB_ERROR_IO;
1200         }
1201
1202         while ((entry = readdir(buses))) {
1203                 if (entry->d_name[0] == '.')
1204                         continue;
1205
1206                 if (usbdev_names) {
1207                         if (!is_usbdev_entry(entry->d_name, &busnum, &devaddr))
1208                                 continue;
1209
1210                         r = linux_enumerate_device(ctx, busnum, devaddr, NULL);
1211                         if (r < 0) {
1212                                 usbi_dbg("failed to enumerate dir entry %s", entry->d_name);
1213                                 continue;
1214                         }
1215                 } else {
1216                         if (!parse_u8(entry->d_name, &busnum)) {
1217                                 usbi_dbg("unknown dir entry %s", entry->d_name);
1218                                 continue;
1219                         }
1220
1221                         r = usbfs_scan_busdir(ctx, busnum);
1222                         if (r < 0)
1223                                 break;
1224                 }
1225         }
1226
1227         closedir(buses);
1228         return r;
1229
1230 }
1231
1232 static int sysfs_get_device_list(struct libusb_context *ctx)
1233 {
1234         DIR *devices = opendir(SYSFS_DEVICE_PATH);
1235         struct dirent *entry;
1236         int num_devices = 0;
1237         int num_enumerated = 0;
1238
1239         if (!devices) {
1240                 usbi_err(ctx, "opendir devices failed, errno=%d", errno);
1241                 return LIBUSB_ERROR_IO;
1242         }
1243
1244         while ((entry = readdir(devices))) {
1245                 if ((!isdigit(entry->d_name[0]) && strncmp(entry->d_name, "usb", 3))
1246                     || strchr(entry->d_name, ':'))
1247                         continue;
1248
1249                 num_devices++;
1250
1251                 if (sysfs_scan_device(ctx, entry->d_name)) {
1252                         usbi_dbg("failed to enumerate dir entry %s", entry->d_name);
1253                         continue;
1254                 }
1255
1256                 num_enumerated++;
1257         }
1258
1259         closedir(devices);
1260
1261         /* successful if at least one device was enumerated or no devices were found */
1262         if (num_enumerated || !num_devices)
1263                 return LIBUSB_SUCCESS;
1264         else
1265                 return LIBUSB_ERROR_IO;
1266 }
1267
1268 static int linux_default_scan_devices(struct libusb_context *ctx)
1269 {
1270         /* we can retrieve device list and descriptors from sysfs or usbfs.
1271          * sysfs is preferable, because if we use usbfs we end up resuming
1272          * any autosuspended USB devices. however, sysfs is not available
1273          * everywhere, so we need a usbfs fallback too.
1274          */
1275         if (sysfs_available)
1276                 return sysfs_get_device_list(ctx);
1277         else
1278                 return usbfs_get_device_list(ctx);
1279 }
1280 #endif
1281
1282 static int initialize_handle(struct libusb_device_handle *handle, int fd)
1283 {
1284         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1285         int r;
1286
1287         hpriv->fd = fd;
1288
1289         r = ioctl(fd, IOCTL_USBFS_GET_CAPABILITIES, &hpriv->caps);
1290         if (r < 0) {
1291                 if (errno == ENOTTY)
1292                         usbi_dbg("getcap not available");
1293                 else
1294                         usbi_err(HANDLE_CTX(handle), "getcap failed, errno=%d", errno);
1295                 hpriv->caps = USBFS_CAP_BULK_CONTINUATION;
1296         }
1297
1298         return usbi_add_event_source(HANDLE_CTX(handle), hpriv->fd, POLLOUT);
1299 }
1300
1301 static int op_wrap_sys_device(struct libusb_context *ctx,
1302         struct libusb_device_handle *handle, intptr_t sys_dev)
1303 {
1304         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1305         int fd = (int)sys_dev;
1306         uint8_t busnum, devaddr;
1307         struct usbfs_connectinfo ci;
1308         struct libusb_device *dev;
1309         int r;
1310
1311         r = linux_get_device_address(ctx, 1, &busnum, &devaddr, NULL, NULL, fd);
1312         if (r < 0) {
1313                 r = ioctl(fd, IOCTL_USBFS_CONNECTINFO, &ci);
1314                 if (r < 0) {
1315                         usbi_err(ctx, "connectinfo failed, errno=%d", errno);
1316                         return LIBUSB_ERROR_IO;
1317                 }
1318                 /* There is no ioctl to get the bus number. We choose 0 here
1319                  * as linux starts numbering buses from 1. */
1320                 busnum = 0;
1321                 devaddr = ci.devnum;
1322         }
1323
1324         /* Session id is unused as we do not add the device to the list of
1325          * connected devices. */
1326         usbi_dbg("allocating new device for fd %d", fd);
1327         dev = usbi_alloc_device(ctx, 0);
1328         if (!dev)
1329                 return LIBUSB_ERROR_NO_MEM;
1330
1331         r = initialize_device(dev, busnum, devaddr, NULL, fd);
1332         if (r < 0)
1333                 goto out;
1334         r = usbi_sanitize_device(dev);
1335         if (r < 0)
1336                 goto out;
1337         /* Consider the device as connected, but do not add it to the managed
1338          * device list. */
1339         dev->attached = 1;
1340         handle->dev = dev;
1341
1342         r = initialize_handle(handle, fd);
1343         hpriv->fd_keep = 1;
1344
1345 out:
1346         if (r < 0)
1347                 libusb_unref_device(dev);
1348         return r;
1349 }
1350
1351 static int op_open(struct libusb_device_handle *handle)
1352 {
1353         int fd, r;
1354
1355         fd = get_usbfs_fd(handle->dev, O_RDWR, 0);
1356         if (fd < 0) {
1357                 if (fd == LIBUSB_ERROR_NO_DEVICE) {
1358                         /* device will still be marked as attached if hotplug monitor thread
1359                          * hasn't processed remove event yet */
1360                         usbi_mutex_static_lock(&linux_hotplug_lock);
1361                         if (handle->dev->attached) {
1362                                 usbi_dbg("open failed with no device, but device still attached");
1363                                 linux_device_disconnected(handle->dev->bus_number,
1364                                                           handle->dev->device_address);
1365                         }
1366                         usbi_mutex_static_unlock(&linux_hotplug_lock);
1367                 }
1368                 return fd;
1369         }
1370
1371         r = initialize_handle(handle, fd);
1372         if (r < 0)
1373                 close(fd);
1374
1375         return r;
1376 }
1377
1378 static void op_close(struct libusb_device_handle *dev_handle)
1379 {
1380         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(dev_handle);
1381
1382         /* fd may have already been removed by POLLERR condition in op_handle_events() */
1383         if (!hpriv->fd_removed)
1384                 usbi_remove_event_source(HANDLE_CTX(dev_handle), hpriv->fd);
1385         if (!hpriv->fd_keep)
1386                 close(hpriv->fd);
1387 }
1388
1389 static int op_get_configuration(struct libusb_device_handle *handle,
1390         uint8_t *config)
1391 {
1392         struct linux_device_priv *priv = usbi_get_device_priv(handle->dev);
1393         int r;
1394
1395         if (priv->sysfs_dir) {
1396                 r = sysfs_get_active_config(handle->dev, config);
1397         } else {
1398                 struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1399
1400                 r = usbfs_get_active_config(handle->dev, hpriv->fd);
1401                 if (r == LIBUSB_SUCCESS)
1402                         *config = priv->active_config;
1403         }
1404         if (r < 0)
1405                 return r;
1406
1407         if (*config == 0)
1408                 usbi_err(HANDLE_CTX(handle), "device unconfigured");
1409
1410         return 0;
1411 }
1412
1413 static int op_set_configuration(struct libusb_device_handle *handle, int config)
1414 {
1415         struct linux_device_priv *priv = usbi_get_device_priv(handle->dev);
1416         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1417         int fd = hpriv->fd;
1418         int r = ioctl(fd, IOCTL_USBFS_SETCONFIGURATION, &config);
1419
1420         if (r < 0) {
1421                 if (errno == EINVAL)
1422                         return LIBUSB_ERROR_NOT_FOUND;
1423                 else if (errno == EBUSY)
1424                         return LIBUSB_ERROR_BUSY;
1425                 else if (errno == ENODEV)
1426                         return LIBUSB_ERROR_NO_DEVICE;
1427
1428                 usbi_err(HANDLE_CTX(handle), "set configuration failed, errno=%d", errno);
1429                 return LIBUSB_ERROR_OTHER;
1430         }
1431
1432         if (config == -1)
1433                 config = 0;
1434
1435         /* update our cached active config descriptor */
1436         priv->active_config = (uint8_t)config;
1437
1438         return LIBUSB_SUCCESS;
1439 }
1440
1441 static int claim_interface(struct libusb_device_handle *handle, unsigned int iface)
1442 {
1443         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1444         int fd = hpriv->fd;
1445         int r = ioctl(fd, IOCTL_USBFS_CLAIMINTERFACE, &iface);
1446
1447         if (r < 0) {
1448                 if (errno == ENOENT)
1449                         return LIBUSB_ERROR_NOT_FOUND;
1450                 else if (errno == EBUSY)
1451                         return LIBUSB_ERROR_BUSY;
1452                 else if (errno == ENODEV)
1453                         return LIBUSB_ERROR_NO_DEVICE;
1454
1455                 usbi_err(HANDLE_CTX(handle), "claim interface failed, errno=%d", errno);
1456                 return LIBUSB_ERROR_OTHER;
1457         }
1458         return 0;
1459 }
1460
1461 static int release_interface(struct libusb_device_handle *handle, unsigned int iface)
1462 {
1463         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1464         int fd = hpriv->fd;
1465         int r = ioctl(fd, IOCTL_USBFS_RELEASEINTERFACE, &iface);
1466
1467         if (r < 0) {
1468                 if (errno == ENODEV)
1469                         return LIBUSB_ERROR_NO_DEVICE;
1470
1471                 usbi_err(HANDLE_CTX(handle), "release interface failed, errno=%d", errno);
1472                 return LIBUSB_ERROR_OTHER;
1473         }
1474         return 0;
1475 }
1476
1477 static int op_set_interface(struct libusb_device_handle *handle, uint8_t interface,
1478         uint8_t altsetting)
1479 {
1480         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1481         int fd = hpriv->fd;
1482         struct usbfs_setinterface setintf;
1483         int r;
1484
1485         setintf.interface = interface;
1486         setintf.altsetting = altsetting;
1487         r = ioctl(fd, IOCTL_USBFS_SETINTERFACE, &setintf);
1488         if (r < 0) {
1489                 if (errno == EINVAL)
1490                         return LIBUSB_ERROR_NOT_FOUND;
1491                 else if (errno == ENODEV)
1492                         return LIBUSB_ERROR_NO_DEVICE;
1493
1494                 usbi_err(HANDLE_CTX(handle), "set interface failed, errno=%d", errno);
1495                 return LIBUSB_ERROR_OTHER;
1496         }
1497
1498         return 0;
1499 }
1500
1501 static int op_clear_halt(struct libusb_device_handle *handle,
1502         unsigned char endpoint)
1503 {
1504         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1505         int fd = hpriv->fd;
1506         unsigned int _endpoint = endpoint;
1507         int r = ioctl(fd, IOCTL_USBFS_CLEAR_HALT, &_endpoint);
1508
1509         if (r < 0) {
1510                 if (errno == ENOENT)
1511                         return LIBUSB_ERROR_NOT_FOUND;
1512                 else if (errno == ENODEV)
1513                         return LIBUSB_ERROR_NO_DEVICE;
1514
1515                 usbi_err(HANDLE_CTX(handle), "clear halt failed, errno=%d", errno);
1516                 return LIBUSB_ERROR_OTHER;
1517         }
1518
1519         return 0;
1520 }
1521
1522 static int op_reset_device(struct libusb_device_handle *handle)
1523 {
1524         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1525         int fd = hpriv->fd;
1526         int r, ret = 0;
1527         uint8_t i;
1528
1529         /* Doing a device reset will cause the usbfs driver to get unbound
1530          * from any interfaces it is bound to. By voluntarily unbinding
1531          * the usbfs driver ourself, we stop the kernel from rebinding
1532          * the interface after reset (which would end up with the interface
1533          * getting bound to the in kernel driver if any). */
1534         for (i = 0; i < USB_MAXINTERFACES; i++) {
1535                 if (handle->claimed_interfaces & (1UL << i))
1536                         release_interface(handle, i);
1537         }
1538
1539         usbi_mutex_lock(&handle->lock);
1540         r = ioctl(fd, IOCTL_USBFS_RESET, NULL);
1541         if (r < 0) {
1542                 if (errno == ENODEV) {
1543                         ret = LIBUSB_ERROR_NOT_FOUND;
1544                         goto out;
1545                 }
1546
1547                 usbi_err(HANDLE_CTX(handle), "reset failed, errno=%d", errno);
1548                 ret = LIBUSB_ERROR_OTHER;
1549                 goto out;
1550         }
1551
1552         /* And re-claim any interfaces which were claimed before the reset */
1553         for (i = 0; i < USB_MAXINTERFACES; i++) {
1554                 if (!(handle->claimed_interfaces & (1UL << i)))
1555                         continue;
1556                 /*
1557                  * A driver may have completed modprobing during
1558                  * IOCTL_USBFS_RESET, and bound itself as soon as
1559                  * IOCTL_USBFS_RESET released the device lock
1560                  */
1561                 r = detach_kernel_driver_and_claim(handle, i);
1562                 if (r) {
1563                         usbi_warn(HANDLE_CTX(handle), "failed to re-claim interface %u after reset: %s",
1564                                   i, libusb_error_name(r));
1565                         handle->claimed_interfaces &= ~(1UL << i);
1566                         ret = LIBUSB_ERROR_NOT_FOUND;
1567                 }
1568         }
1569 out:
1570         usbi_mutex_unlock(&handle->lock);
1571         return ret;
1572 }
1573
1574 static int do_streams_ioctl(struct libusb_device_handle *handle, long req,
1575         uint32_t num_streams, unsigned char *endpoints, int num_endpoints)
1576 {
1577         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1578         int r, fd = hpriv->fd;
1579         struct usbfs_streams *streams;
1580
1581         if (num_endpoints > 30) /* Max 15 in + 15 out eps */
1582                 return LIBUSB_ERROR_INVALID_PARAM;
1583
1584         streams = malloc(sizeof(*streams) + num_endpoints);
1585         if (!streams)
1586                 return LIBUSB_ERROR_NO_MEM;
1587
1588         streams->num_streams = num_streams;
1589         streams->num_eps = num_endpoints;
1590         memcpy(streams->eps, endpoints, num_endpoints);
1591
1592         r = ioctl(fd, req, streams);
1593
1594         free(streams);
1595
1596         if (r < 0) {
1597                 if (errno == ENOTTY)
1598                         return LIBUSB_ERROR_NOT_SUPPORTED;
1599                 else if (errno == EINVAL)
1600                         return LIBUSB_ERROR_INVALID_PARAM;
1601                 else if (errno == ENODEV)
1602                         return LIBUSB_ERROR_NO_DEVICE;
1603
1604                 usbi_err(HANDLE_CTX(handle), "streams-ioctl failed, errno=%d", errno);
1605                 return LIBUSB_ERROR_OTHER;
1606         }
1607         return r;
1608 }
1609
1610 static int op_alloc_streams(struct libusb_device_handle *handle,
1611         uint32_t num_streams, unsigned char *endpoints, int num_endpoints)
1612 {
1613         return do_streams_ioctl(handle, IOCTL_USBFS_ALLOC_STREAMS,
1614                                 num_streams, endpoints, num_endpoints);
1615 }
1616
1617 static int op_free_streams(struct libusb_device_handle *handle,
1618                 unsigned char *endpoints, int num_endpoints)
1619 {
1620         return do_streams_ioctl(handle, IOCTL_USBFS_FREE_STREAMS, 0,
1621                                 endpoints, num_endpoints);
1622 }
1623
1624 static void *op_dev_mem_alloc(struct libusb_device_handle *handle, size_t len)
1625 {
1626         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1627         void *buffer;
1628
1629         buffer = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, hpriv->fd, 0);
1630         if (buffer == MAP_FAILED) {
1631                 usbi_err(HANDLE_CTX(handle), "alloc dev mem failed, errno=%d", errno);
1632                 return NULL;
1633         }
1634         return buffer;
1635 }
1636
1637 static int op_dev_mem_free(struct libusb_device_handle *handle, void *buffer,
1638         size_t len)
1639 {
1640         if (munmap(buffer, len) != 0) {
1641                 usbi_err(HANDLE_CTX(handle), "free dev mem failed, errno=%d", errno);
1642                 return LIBUSB_ERROR_OTHER;
1643         } else {
1644                 return LIBUSB_SUCCESS;
1645         }
1646 }
1647
1648 static int op_kernel_driver_active(struct libusb_device_handle *handle,
1649         uint8_t interface)
1650 {
1651         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1652         int fd = hpriv->fd;
1653         struct usbfs_getdriver getdrv;
1654         int r;
1655
1656         getdrv.interface = interface;
1657         r = ioctl(fd, IOCTL_USBFS_GETDRIVER, &getdrv);
1658         if (r < 0) {
1659                 if (errno == ENODATA)
1660                         return 0;
1661                 else if (errno == ENODEV)
1662                         return LIBUSB_ERROR_NO_DEVICE;
1663
1664                 usbi_err(HANDLE_CTX(handle), "get driver failed, errno=%d", errno);
1665                 return LIBUSB_ERROR_OTHER;
1666         }
1667
1668         return strcmp(getdrv.driver, "usbfs") != 0;
1669 }
1670
1671 static int op_detach_kernel_driver(struct libusb_device_handle *handle,
1672         uint8_t interface)
1673 {
1674         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1675         int fd = hpriv->fd;
1676         struct usbfs_ioctl command;
1677         struct usbfs_getdriver getdrv;
1678         int r;
1679
1680         command.ifno = interface;
1681         command.ioctl_code = IOCTL_USBFS_DISCONNECT;
1682         command.data = NULL;
1683
1684         getdrv.interface = interface;
1685         r = ioctl(fd, IOCTL_USBFS_GETDRIVER, &getdrv);
1686         if (r == 0 && !strcmp(getdrv.driver, "usbfs"))
1687                 return LIBUSB_ERROR_NOT_FOUND;
1688
1689         r = ioctl(fd, IOCTL_USBFS_IOCTL, &command);
1690         if (r < 0) {
1691                 if (errno == ENODATA)
1692                         return LIBUSB_ERROR_NOT_FOUND;
1693                 else if (errno == EINVAL)
1694                         return LIBUSB_ERROR_INVALID_PARAM;
1695                 else if (errno == ENODEV)
1696                         return LIBUSB_ERROR_NO_DEVICE;
1697
1698                 usbi_err(HANDLE_CTX(handle), "detach failed, errno=%d", errno);
1699                 return LIBUSB_ERROR_OTHER;
1700         }
1701
1702         return 0;
1703 }
1704
1705 static int op_attach_kernel_driver(struct libusb_device_handle *handle,
1706         uint8_t interface)
1707 {
1708         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1709         int fd = hpriv->fd;
1710         struct usbfs_ioctl command;
1711         int r;
1712
1713         command.ifno = interface;
1714         command.ioctl_code = IOCTL_USBFS_CONNECT;
1715         command.data = NULL;
1716
1717         r = ioctl(fd, IOCTL_USBFS_IOCTL, &command);
1718         if (r < 0) {
1719                 if (errno == ENODATA)
1720                         return LIBUSB_ERROR_NOT_FOUND;
1721                 else if (errno == EINVAL)
1722                         return LIBUSB_ERROR_INVALID_PARAM;
1723                 else if (errno == ENODEV)
1724                         return LIBUSB_ERROR_NO_DEVICE;
1725                 else if (errno == EBUSY)
1726                         return LIBUSB_ERROR_BUSY;
1727
1728                 usbi_err(HANDLE_CTX(handle), "attach failed, errno=%d", errno);
1729                 return LIBUSB_ERROR_OTHER;
1730         } else if (r == 0) {
1731                 return LIBUSB_ERROR_NOT_FOUND;
1732         }
1733
1734         return 0;
1735 }
1736
1737 static int detach_kernel_driver_and_claim(struct libusb_device_handle *handle,
1738         uint8_t interface)
1739 {
1740         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1741         struct usbfs_disconnect_claim dc;
1742         int r, fd = hpriv->fd;
1743
1744         dc.interface = interface;
1745         strcpy(dc.driver, "usbfs");
1746         dc.flags = USBFS_DISCONNECT_CLAIM_EXCEPT_DRIVER;
1747         r = ioctl(fd, IOCTL_USBFS_DISCONNECT_CLAIM, &dc);
1748         if (r == 0)
1749                 return 0;
1750         switch (errno) {
1751         case ENOTTY:
1752                 break;
1753         case EBUSY:
1754                 return LIBUSB_ERROR_BUSY;
1755         case EINVAL:
1756                 return LIBUSB_ERROR_INVALID_PARAM;
1757         case ENODEV:
1758                 return LIBUSB_ERROR_NO_DEVICE;
1759         default:
1760                 usbi_err(HANDLE_CTX(handle), "disconnect-and-claim failed, errno=%d", errno);
1761                 return LIBUSB_ERROR_OTHER;
1762         }
1763
1764         /* Fallback code for kernels which don't support the
1765            disconnect-and-claim ioctl */
1766         r = op_detach_kernel_driver(handle, interface);
1767         if (r != 0 && r != LIBUSB_ERROR_NOT_FOUND)
1768                 return r;
1769
1770         return claim_interface(handle, interface);
1771 }
1772
1773 static int op_claim_interface(struct libusb_device_handle *handle, uint8_t interface)
1774 {
1775         if (handle->auto_detach_kernel_driver)
1776                 return detach_kernel_driver_and_claim(handle, interface);
1777         else
1778                 return claim_interface(handle, interface);
1779 }
1780
1781 static int op_release_interface(struct libusb_device_handle *handle, uint8_t interface)
1782 {
1783         int r;
1784
1785         r = release_interface(handle, interface);
1786         if (r)
1787                 return r;
1788
1789         if (handle->auto_detach_kernel_driver)
1790                 op_attach_kernel_driver(handle, interface);
1791
1792         return 0;
1793 }
1794
1795 static void op_destroy_device(struct libusb_device *dev)
1796 {
1797         struct linux_device_priv *priv = usbi_get_device_priv(dev);
1798
1799         free(priv->config_descriptors);
1800         free(priv->descriptors);
1801         free(priv->sysfs_dir);
1802 }
1803
1804 /* URBs are discarded in reverse order of submission to avoid races. */
1805 static int discard_urbs(struct usbi_transfer *itransfer, int first, int last_plus_one)
1806 {
1807         struct libusb_transfer *transfer =
1808                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
1809         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
1810         struct linux_device_handle_priv *hpriv =
1811                 usbi_get_device_handle_priv(transfer->dev_handle);
1812         int i, ret = 0;
1813         struct usbfs_urb *urb;
1814
1815         for (i = last_plus_one - 1; i >= first; i--) {
1816                 if (transfer->type == LIBUSB_TRANSFER_TYPE_ISOCHRONOUS)
1817                         urb = tpriv->iso_urbs[i];
1818                 else
1819                         urb = &tpriv->urbs[i];
1820
1821                 if (ioctl(hpriv->fd, IOCTL_USBFS_DISCARDURB, urb) == 0)
1822                         continue;
1823
1824                 if (errno == EINVAL) {
1825                         usbi_dbg("URB not found --> assuming ready to be reaped");
1826                         if (i == (last_plus_one - 1))
1827                                 ret = LIBUSB_ERROR_NOT_FOUND;
1828                 } else if (errno == ENODEV) {
1829                         usbi_dbg("Device not found for URB --> assuming ready to be reaped");
1830                         ret = LIBUSB_ERROR_NO_DEVICE;
1831                 } else {
1832                         usbi_warn(TRANSFER_CTX(transfer), "unrecognised discard errno %d", errno);
1833                         ret = LIBUSB_ERROR_OTHER;
1834                 }
1835         }
1836         return ret;
1837 }
1838
1839 static void free_iso_urbs(struct linux_transfer_priv *tpriv)
1840 {
1841         int i;
1842
1843         for (i = 0; i < tpriv->num_urbs; i++) {
1844                 struct usbfs_urb *urb = tpriv->iso_urbs[i];
1845
1846                 if (!urb)
1847                         break;
1848                 free(urb);
1849         }
1850
1851         free(tpriv->iso_urbs);
1852         tpriv->iso_urbs = NULL;
1853 }
1854
1855 static int submit_bulk_transfer(struct usbi_transfer *itransfer)
1856 {
1857         struct libusb_transfer *transfer =
1858                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
1859         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
1860         struct linux_device_handle_priv *hpriv =
1861                 usbi_get_device_handle_priv(transfer->dev_handle);
1862         struct usbfs_urb *urbs;
1863         int is_out = IS_XFEROUT(transfer);
1864         int bulk_buffer_len, use_bulk_continuation;
1865         int num_urbs;
1866         int last_urb_partial = 0;
1867         int r;
1868         int i;
1869
1870         /*
1871          * Older versions of usbfs place a 16kb limit on bulk URBs. We work
1872          * around this by splitting large transfers into 16k blocks, and then
1873          * submit all urbs at once. it would be simpler to submit one urb at
1874          * a time, but there is a big performance gain doing it this way.
1875          *
1876          * Newer versions lift the 16k limit (USBFS_CAP_NO_PACKET_SIZE_LIM),
1877          * using arbitrary large transfers can still be a bad idea though, as
1878          * the kernel needs to allocate physical contiguous memory for this,
1879          * which may fail for large buffers.
1880          *
1881          * The kernel solves this problem by splitting the transfer into
1882          * blocks itself when the host-controller is scatter-gather capable
1883          * (USBFS_CAP_BULK_SCATTER_GATHER), which most controllers are.
1884          *
1885          * Last, there is the issue of short-transfers when splitting, for
1886          * short split-transfers to work reliable USBFS_CAP_BULK_CONTINUATION
1887          * is needed, but this is not always available.
1888          */
1889         if (hpriv->caps & USBFS_CAP_BULK_SCATTER_GATHER) {
1890                 /* Good! Just submit everything in one go */
1891                 bulk_buffer_len = transfer->length ? transfer->length : 1;
1892                 use_bulk_continuation = 0;
1893         } else if (hpriv->caps & USBFS_CAP_BULK_CONTINUATION) {
1894                 /* Split the transfers and use bulk-continuation to
1895                    avoid issues with short-transfers */
1896                 bulk_buffer_len = MAX_BULK_BUFFER_LENGTH;
1897                 use_bulk_continuation = 1;
1898         } else if (hpriv->caps & USBFS_CAP_NO_PACKET_SIZE_LIM) {
1899                 /* Don't split, assume the kernel can alloc the buffer
1900                    (otherwise the submit will fail with -ENOMEM) */
1901                 bulk_buffer_len = transfer->length ? transfer->length : 1;
1902                 use_bulk_continuation = 0;
1903         } else {
1904                 /* Bad, splitting without bulk-continuation, short transfers
1905                    which end before the last urb will not work reliable! */
1906                 /* Note we don't warn here as this is "normal" on kernels <
1907                    2.6.32 and not a problem for most applications */
1908                 bulk_buffer_len = MAX_BULK_BUFFER_LENGTH;
1909                 use_bulk_continuation = 0;
1910         }
1911
1912         num_urbs = transfer->length / bulk_buffer_len;
1913
1914         if (transfer->length == 0) {
1915                 num_urbs = 1;
1916         } else if ((transfer->length % bulk_buffer_len) > 0) {
1917                 last_urb_partial = 1;
1918                 num_urbs++;
1919         }
1920         usbi_dbg("need %d urbs for new transfer with length %d", num_urbs, transfer->length);
1921         urbs = calloc(num_urbs, sizeof(*urbs));
1922         if (!urbs)
1923                 return LIBUSB_ERROR_NO_MEM;
1924         tpriv->urbs = urbs;
1925         tpriv->num_urbs = num_urbs;
1926         tpriv->num_retired = 0;
1927         tpriv->reap_action = NORMAL;
1928         tpriv->reap_status = LIBUSB_TRANSFER_COMPLETED;
1929
1930         for (i = 0; i < num_urbs; i++) {
1931                 struct usbfs_urb *urb = &urbs[i];
1932
1933                 urb->usercontext = itransfer;
1934                 switch (transfer->type) {
1935                 case LIBUSB_TRANSFER_TYPE_BULK:
1936                         urb->type = USBFS_URB_TYPE_BULK;
1937                         urb->stream_id = 0;
1938                         break;
1939                 case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
1940                         urb->type = USBFS_URB_TYPE_BULK;
1941                         urb->stream_id = itransfer->stream_id;
1942                         break;
1943                 case LIBUSB_TRANSFER_TYPE_INTERRUPT:
1944                         urb->type = USBFS_URB_TYPE_INTERRUPT;
1945                         break;
1946                 }
1947                 urb->endpoint = transfer->endpoint;
1948                 urb->buffer = transfer->buffer + (i * bulk_buffer_len);
1949
1950                 /* don't set the short not ok flag for the last URB */
1951                 if (use_bulk_continuation && !is_out && (i < num_urbs - 1))
1952                         urb->flags = USBFS_URB_SHORT_NOT_OK;
1953
1954                 if (i == num_urbs - 1 && last_urb_partial)
1955                         urb->buffer_length = transfer->length % bulk_buffer_len;
1956                 else if (transfer->length == 0)
1957                         urb->buffer_length = 0;
1958                 else
1959                         urb->buffer_length = bulk_buffer_len;
1960
1961                 if (i > 0 && use_bulk_continuation)
1962                         urb->flags |= USBFS_URB_BULK_CONTINUATION;
1963
1964                 /* we have already checked that the flag is supported */
1965                 if (is_out && i == num_urbs - 1 &&
1966                     (transfer->flags & LIBUSB_TRANSFER_ADD_ZERO_PACKET))
1967                         urb->flags |= USBFS_URB_ZERO_PACKET;
1968
1969                 r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urb);
1970                 if (r == 0)
1971                         continue;
1972
1973                 if (errno == ENODEV) {
1974                         r = LIBUSB_ERROR_NO_DEVICE;
1975                 } else if (errno == ENOMEM) {
1976                         r = LIBUSB_ERROR_NO_MEM;
1977                 } else {
1978                         usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
1979                         r = LIBUSB_ERROR_IO;
1980                 }
1981
1982                 /* if the first URB submission fails, we can simply free up and
1983                  * return failure immediately. */
1984                 if (i == 0) {
1985                         usbi_dbg("first URB failed, easy peasy");
1986                         free(urbs);
1987                         tpriv->urbs = NULL;
1988                         return r;
1989                 }
1990
1991                 /* if it's not the first URB that failed, the situation is a bit
1992                  * tricky. we may need to discard all previous URBs. there are
1993                  * complications:
1994                  *  - discarding is asynchronous - discarded urbs will be reaped
1995                  *    later. the user must not have freed the transfer when the
1996                  *    discarded URBs are reaped, otherwise libusb will be using
1997                  *    freed memory.
1998                  *  - the earlier URBs may have completed successfully and we do
1999                  *    not want to throw away any data.
2000                  *  - this URB failing may be no error; EREMOTEIO means that
2001                  *    this transfer simply didn't need all the URBs we submitted
2002                  * so, we report that the transfer was submitted successfully and
2003                  * in case of error we discard all previous URBs. later when
2004                  * the final reap completes we can report error to the user,
2005                  * or success if an earlier URB was completed successfully.
2006                  */
2007                 tpriv->reap_action = errno == EREMOTEIO ? COMPLETED_EARLY : SUBMIT_FAILED;
2008
2009                 /* The URBs we haven't submitted yet we count as already
2010                  * retired. */
2011                 tpriv->num_retired += num_urbs - i;
2012
2013                 /* If we completed short then don't try to discard. */
2014                 if (tpriv->reap_action == COMPLETED_EARLY)
2015                         return 0;
2016
2017                 discard_urbs(itransfer, 0, i);
2018
2019                 usbi_dbg("reporting successful submission but waiting for %d "
2020                          "discards before reporting error", i);
2021                 return 0;
2022         }
2023
2024         return 0;
2025 }
2026
2027 static int submit_iso_transfer(struct usbi_transfer *itransfer)
2028 {
2029         struct libusb_transfer *transfer =
2030                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2031         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2032         struct linux_device_handle_priv *hpriv =
2033                 usbi_get_device_handle_priv(transfer->dev_handle);
2034         struct usbfs_urb **urbs;
2035         int num_packets = transfer->num_iso_packets;
2036         int num_packets_remaining;
2037         int i, j;
2038         int num_urbs;
2039         unsigned int packet_len;
2040         unsigned int total_len = 0;
2041         unsigned char *urb_buffer = transfer->buffer;
2042
2043         if (num_packets < 1)
2044                 return LIBUSB_ERROR_INVALID_PARAM;
2045
2046         /* usbfs places arbitrary limits on iso URBs. this limit has changed
2047          * at least three times, but we attempt to detect this limit during
2048          * init and check it here. if the kernel rejects the request due to
2049          * its size, we return an error indicating such to the user.
2050          */
2051         for (i = 0; i < num_packets; i++) {
2052                 packet_len = transfer->iso_packet_desc[i].length;
2053
2054                 if (packet_len > max_iso_packet_len) {
2055                         usbi_warn(TRANSFER_CTX(transfer),
2056                                   "iso packet length of %u bytes exceeds maximum of %u bytes",
2057                                   packet_len, max_iso_packet_len);
2058                         return LIBUSB_ERROR_INVALID_PARAM;
2059                 }
2060
2061                 total_len += packet_len;
2062         }
2063
2064         if (transfer->length < (int)total_len)
2065                 return LIBUSB_ERROR_INVALID_PARAM;
2066
2067         /* usbfs limits the number of iso packets per URB */
2068         num_urbs = (num_packets + (MAX_ISO_PACKETS_PER_URB - 1)) / MAX_ISO_PACKETS_PER_URB;
2069
2070         usbi_dbg("need %d urbs for new transfer with length %d", num_urbs, transfer->length);
2071
2072         urbs = calloc(num_urbs, sizeof(*urbs));
2073         if (!urbs)
2074                 return LIBUSB_ERROR_NO_MEM;
2075
2076         tpriv->iso_urbs = urbs;
2077         tpriv->num_urbs = num_urbs;
2078         tpriv->num_retired = 0;
2079         tpriv->reap_action = NORMAL;
2080         tpriv->iso_packet_offset = 0;
2081
2082         /* allocate + initialize each URB with the correct number of packets */
2083         num_packets_remaining = num_packets;
2084         for (i = 0, j = 0; i < num_urbs; i++) {
2085                 int num_packets_in_urb = MIN(num_packets_remaining, MAX_ISO_PACKETS_PER_URB);
2086                 struct usbfs_urb *urb;
2087                 size_t alloc_size;
2088                 int k;
2089
2090                 alloc_size = sizeof(*urb)
2091                         + (num_packets_in_urb * sizeof(struct usbfs_iso_packet_desc));
2092                 urb = calloc(1, alloc_size);
2093                 if (!urb) {
2094                         free_iso_urbs(tpriv);
2095                         return LIBUSB_ERROR_NO_MEM;
2096                 }
2097                 urbs[i] = urb;
2098
2099                 /* populate packet lengths */
2100                 for (k = 0; k < num_packets_in_urb; j++, k++) {
2101                         packet_len = transfer->iso_packet_desc[j].length;
2102                         urb->buffer_length += packet_len;
2103                         urb->iso_frame_desc[k].length = packet_len;
2104                 }
2105
2106                 urb->usercontext = itransfer;
2107                 urb->type = USBFS_URB_TYPE_ISO;
2108                 /* FIXME: interface for non-ASAP data? */
2109                 urb->flags = USBFS_URB_ISO_ASAP;
2110                 urb->endpoint = transfer->endpoint;
2111                 urb->number_of_packets = num_packets_in_urb;
2112                 urb->buffer = urb_buffer;
2113
2114                 urb_buffer += urb->buffer_length;
2115                 num_packets_remaining -= num_packets_in_urb;
2116         }
2117
2118         /* submit URBs */
2119         for (i = 0; i < num_urbs; i++) {
2120                 int r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urbs[i]);
2121
2122                 if (r == 0)
2123                         continue;
2124
2125                 if (errno == ENODEV) {
2126                         r = LIBUSB_ERROR_NO_DEVICE;
2127                 } else if (errno == EINVAL) {
2128                         usbi_warn(TRANSFER_CTX(transfer), "submiturb failed, transfer too large");
2129                         r = LIBUSB_ERROR_INVALID_PARAM;
2130                 } else if (errno == EMSGSIZE) {
2131                         usbi_warn(TRANSFER_CTX(transfer), "submiturb failed, iso packet length too large");
2132                         r = LIBUSB_ERROR_INVALID_PARAM;
2133                 } else {
2134                         usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
2135                         r = LIBUSB_ERROR_IO;
2136                 }
2137
2138                 /* if the first URB submission fails, we can simply free up and
2139                  * return failure immediately. */
2140                 if (i == 0) {
2141                         usbi_dbg("first URB failed, easy peasy");
2142                         free_iso_urbs(tpriv);
2143                         return r;
2144                 }
2145
2146                 /* if it's not the first URB that failed, the situation is a bit
2147                  * tricky. we must discard all previous URBs. there are
2148                  * complications:
2149                  *  - discarding is asynchronous - discarded urbs will be reaped
2150                  *    later. the user must not have freed the transfer when the
2151                  *    discarded URBs are reaped, otherwise libusb will be using
2152                  *    freed memory.
2153                  *  - the earlier URBs may have completed successfully and we do
2154                  *    not want to throw away any data.
2155                  * so, in this case we discard all the previous URBs BUT we report
2156                  * that the transfer was submitted successfully. then later when
2157                  * the final discard completes we can report error to the user.
2158                  */
2159                 tpriv->reap_action = SUBMIT_FAILED;
2160
2161                 /* The URBs we haven't submitted yet we count as already
2162                  * retired. */
2163                 tpriv->num_retired = num_urbs - i;
2164                 discard_urbs(itransfer, 0, i);
2165
2166                 usbi_dbg("reporting successful submission but waiting for %d "
2167                          "discards before reporting error", i);
2168                 return 0;
2169         }
2170
2171         return 0;
2172 }
2173
2174 static int submit_control_transfer(struct usbi_transfer *itransfer)
2175 {
2176         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2177         struct libusb_transfer *transfer =
2178                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2179         struct linux_device_handle_priv *hpriv =
2180                 usbi_get_device_handle_priv(transfer->dev_handle);
2181         struct usbfs_urb *urb;
2182         int r;
2183
2184         if (transfer->length - LIBUSB_CONTROL_SETUP_SIZE > MAX_CTRL_BUFFER_LENGTH)
2185                 return LIBUSB_ERROR_INVALID_PARAM;
2186
2187         urb = calloc(1, sizeof(*urb));
2188         if (!urb)
2189                 return LIBUSB_ERROR_NO_MEM;
2190         tpriv->urbs = urb;
2191         tpriv->num_urbs = 1;
2192         tpriv->reap_action = NORMAL;
2193
2194         urb->usercontext = itransfer;
2195         urb->type = USBFS_URB_TYPE_CONTROL;
2196         urb->endpoint = transfer->endpoint;
2197         urb->buffer = transfer->buffer;
2198         urb->buffer_length = transfer->length;
2199
2200         r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urb);
2201         if (r < 0) {
2202                 free(urb);
2203                 tpriv->urbs = NULL;
2204                 if (errno == ENODEV)
2205                         return LIBUSB_ERROR_NO_DEVICE;
2206
2207                 usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
2208                 return LIBUSB_ERROR_IO;
2209         }
2210         return 0;
2211 }
2212
2213 static int op_submit_transfer(struct usbi_transfer *itransfer)
2214 {
2215         struct libusb_transfer *transfer =
2216                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2217
2218         switch (transfer->type) {
2219         case LIBUSB_TRANSFER_TYPE_CONTROL:
2220                 return submit_control_transfer(itransfer);
2221         case LIBUSB_TRANSFER_TYPE_BULK:
2222         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2223                 return submit_bulk_transfer(itransfer);
2224         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2225                 return submit_bulk_transfer(itransfer);
2226         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2227                 return submit_iso_transfer(itransfer);
2228         default:
2229                 usbi_err(TRANSFER_CTX(transfer), "unknown transfer type %u", transfer->type);
2230                 return LIBUSB_ERROR_INVALID_PARAM;
2231         }
2232 }
2233
2234 static int op_cancel_transfer(struct usbi_transfer *itransfer)
2235 {
2236         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2237         struct libusb_transfer *transfer =
2238                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2239         int r;
2240
2241         if (!tpriv->urbs)
2242                 return LIBUSB_ERROR_NOT_FOUND;
2243
2244         r = discard_urbs(itransfer, 0, tpriv->num_urbs);
2245         if (r != 0)
2246                 return r;
2247
2248         switch (transfer->type) {
2249         case LIBUSB_TRANSFER_TYPE_BULK:
2250         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2251                 if (tpriv->reap_action == ERROR)
2252                         break;
2253                 /* else, fall through */
2254         default:
2255                 tpriv->reap_action = CANCELLED;
2256         }
2257
2258         return 0;
2259 }
2260
2261 static void op_clear_transfer_priv(struct usbi_transfer *itransfer)
2262 {
2263         struct libusb_transfer *transfer =
2264                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2265         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2266
2267         switch (transfer->type) {
2268         case LIBUSB_TRANSFER_TYPE_CONTROL:
2269         case LIBUSB_TRANSFER_TYPE_BULK:
2270         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2271         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2272                 if (tpriv->urbs) {
2273                         free(tpriv->urbs);
2274                         tpriv->urbs = NULL;
2275                 }
2276                 break;
2277         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2278                 if (tpriv->iso_urbs) {
2279                         free_iso_urbs(tpriv);
2280                         tpriv->iso_urbs = NULL;
2281                 }
2282                 break;
2283         default:
2284                 usbi_err(TRANSFER_CTX(transfer), "unknown transfer type %u", transfer->type);
2285         }
2286 }
2287
2288 static int handle_bulk_completion(struct usbi_transfer *itransfer,
2289         struct usbfs_urb *urb)
2290 {
2291         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2292         struct libusb_transfer *transfer = USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2293         int urb_idx = urb - tpriv->urbs;
2294
2295         usbi_mutex_lock(&itransfer->lock);
2296         usbi_dbg("handling completion status %d of bulk urb %d/%d", urb->status,
2297                  urb_idx + 1, tpriv->num_urbs);
2298
2299         tpriv->num_retired++;
2300
2301         if (tpriv->reap_action != NORMAL) {
2302                 /* cancelled, submit_fail, or completed early */
2303                 usbi_dbg("abnormal reap: urb status %d", urb->status);
2304
2305                 /* even though we're in the process of cancelling, it's possible that
2306                  * we may receive some data in these URBs that we don't want to lose.
2307                  * examples:
2308                  * 1. while the kernel is cancelling all the packets that make up an
2309                  *    URB, a few of them might complete. so we get back a successful
2310                  *    cancellation *and* some data.
2311                  * 2. we receive a short URB which marks the early completion condition,
2312                  *    so we start cancelling the remaining URBs. however, we're too
2313                  *    slow and another URB completes (or at least completes partially).
2314                  *    (this can't happen since we always use BULK_CONTINUATION.)
2315                  *
2316                  * When this happens, our objectives are not to lose any "surplus" data,
2317                  * and also to stick it at the end of the previously-received data
2318                  * (closing any holes), so that libusb reports the total amount of
2319                  * transferred data and presents it in a contiguous chunk.
2320                  */
2321                 if (urb->actual_length > 0) {
2322                         unsigned char *target = transfer->buffer + itransfer->transferred;
2323
2324                         usbi_dbg("received %d bytes of surplus data", urb->actual_length);
2325                         if (urb->buffer != target) {
2326                                 usbi_dbg("moving surplus data from offset %zu to offset %zu",
2327                                          (unsigned char *)urb->buffer - transfer->buffer,
2328                                          target - transfer->buffer);
2329                                 memmove(target, urb->buffer, urb->actual_length);
2330                         }
2331                         itransfer->transferred += urb->actual_length;
2332                 }
2333
2334                 if (tpriv->num_retired == tpriv->num_urbs) {
2335                         usbi_dbg("abnormal reap: last URB handled, reporting");
2336                         if (tpriv->reap_action != COMPLETED_EARLY &&
2337                             tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2338                                 tpriv->reap_status = LIBUSB_TRANSFER_ERROR;
2339                         goto completed;
2340                 }
2341                 goto out_unlock;
2342         }
2343
2344         itransfer->transferred += urb->actual_length;
2345
2346         /* Many of these errors can occur on *any* urb of a multi-urb
2347          * transfer.  When they do, we tear down the rest of the transfer.
2348          */
2349         switch (urb->status) {
2350         case 0:
2351                 break;
2352         case -EREMOTEIO: /* short transfer */
2353                 break;
2354         case -ENOENT: /* cancelled */
2355         case -ECONNRESET:
2356                 break;
2357         case -ENODEV:
2358         case -ESHUTDOWN:
2359                 usbi_dbg("device removed");
2360                 tpriv->reap_status = LIBUSB_TRANSFER_NO_DEVICE;
2361                 goto cancel_remaining;
2362         case -EPIPE:
2363                 usbi_dbg("detected endpoint stall");
2364                 if (tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2365                         tpriv->reap_status = LIBUSB_TRANSFER_STALL;
2366                 goto cancel_remaining;
2367         case -EOVERFLOW:
2368                 /* overflow can only ever occur in the last urb */
2369                 usbi_dbg("overflow, actual_length=%d", urb->actual_length);
2370                 if (tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2371                         tpriv->reap_status = LIBUSB_TRANSFER_OVERFLOW;
2372                 goto completed;
2373         case -ETIME:
2374         case -EPROTO:
2375         case -EILSEQ:
2376         case -ECOMM:
2377         case -ENOSR:
2378                 usbi_dbg("low-level bus error %d", urb->status);
2379                 tpriv->reap_action = ERROR;
2380                 goto cancel_remaining;
2381         default:
2382                 usbi_warn(ITRANSFER_CTX(itransfer), "unrecognised urb status %d", urb->status);
2383                 tpriv->reap_action = ERROR;
2384                 goto cancel_remaining;
2385         }
2386
2387         /* if we've reaped all urbs or we got less data than requested then we're
2388          * done */
2389         if (tpriv->num_retired == tpriv->num_urbs) {
2390                 usbi_dbg("all URBs in transfer reaped --> complete!");
2391                 goto completed;
2392         } else if (urb->actual_length < urb->buffer_length) {
2393                 usbi_dbg("short transfer %d/%d --> complete!",
2394                          urb->actual_length, urb->buffer_length);
2395                 if (tpriv->reap_action == NORMAL)
2396                         tpriv->reap_action = COMPLETED_EARLY;
2397         } else {
2398                 goto out_unlock;
2399         }
2400
2401 cancel_remaining:
2402         if (tpriv->reap_action == ERROR && tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2403                 tpriv->reap_status = LIBUSB_TRANSFER_ERROR;
2404
2405         if (tpriv->num_retired == tpriv->num_urbs) /* nothing to cancel */
2406                 goto completed;
2407
2408         /* cancel remaining urbs and wait for their completion before
2409          * reporting results */
2410         discard_urbs(itransfer, urb_idx + 1, tpriv->num_urbs);
2411
2412 out_unlock:
2413         usbi_mutex_unlock(&itransfer->lock);
2414         return 0;
2415
2416 completed:
2417         free(tpriv->urbs);
2418         tpriv->urbs = NULL;
2419         usbi_mutex_unlock(&itransfer->lock);
2420         return tpriv->reap_action == CANCELLED ?
2421                 usbi_handle_transfer_cancellation(itransfer) :
2422                 usbi_handle_transfer_completion(itransfer, tpriv->reap_status);
2423 }
2424
2425 static int handle_iso_completion(struct usbi_transfer *itransfer,
2426         struct usbfs_urb *urb)
2427 {
2428         struct libusb_transfer *transfer =
2429                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2430         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2431         int num_urbs = tpriv->num_urbs;
2432         int urb_idx = 0;
2433         int i;
2434         enum libusb_transfer_status status = LIBUSB_TRANSFER_COMPLETED;
2435
2436         usbi_mutex_lock(&itransfer->lock);
2437         for (i = 0; i < num_urbs; i++) {
2438                 if (urb == tpriv->iso_urbs[i]) {
2439                         urb_idx = i + 1;
2440                         break;
2441                 }
2442         }
2443         if (urb_idx == 0) {
2444                 usbi_err(TRANSFER_CTX(transfer), "could not locate urb!");
2445                 usbi_mutex_unlock(&itransfer->lock);
2446                 return LIBUSB_ERROR_NOT_FOUND;
2447         }
2448
2449         usbi_dbg("handling completion status %d of iso urb %d/%d", urb->status,
2450                  urb_idx, num_urbs);
2451
2452         /* copy isochronous results back in */
2453
2454         for (i = 0; i < urb->number_of_packets; i++) {
2455                 struct usbfs_iso_packet_desc *urb_desc = &urb->iso_frame_desc[i];
2456                 struct libusb_iso_packet_descriptor *lib_desc =
2457                         &transfer->iso_packet_desc[tpriv->iso_packet_offset++];
2458
2459                 lib_desc->status = LIBUSB_TRANSFER_COMPLETED;
2460                 switch (urb_desc->status) {
2461                 case 0:
2462                         break;
2463                 case -ENOENT: /* cancelled */
2464                 case -ECONNRESET:
2465                         break;
2466                 case -ENODEV:
2467                 case -ESHUTDOWN:
2468                         usbi_dbg("packet %d - device removed", i);
2469                         lib_desc->status = LIBUSB_TRANSFER_NO_DEVICE;
2470                         break;
2471                 case -EPIPE:
2472                         usbi_dbg("packet %d - detected endpoint stall", i);
2473                         lib_desc->status = LIBUSB_TRANSFER_STALL;
2474                         break;
2475                 case -EOVERFLOW:
2476                         usbi_dbg("packet %d - overflow error", i);
2477                         lib_desc->status = LIBUSB_TRANSFER_OVERFLOW;
2478                         break;
2479                 case -ETIME:
2480                 case -EPROTO:
2481                 case -EILSEQ:
2482                 case -ECOMM:
2483                 case -ENOSR:
2484                 case -EXDEV:
2485                         usbi_dbg("packet %d - low-level USB error %d", i, urb_desc->status);
2486                         lib_desc->status = LIBUSB_TRANSFER_ERROR;
2487                         break;
2488                 default:
2489                         usbi_warn(TRANSFER_CTX(transfer), "packet %d - unrecognised urb status %d",
2490                                   i, urb_desc->status);
2491                         lib_desc->status = LIBUSB_TRANSFER_ERROR;
2492                         break;
2493                 }
2494                 lib_desc->actual_length = urb_desc->actual_length;
2495         }
2496
2497         tpriv->num_retired++;
2498
2499         if (tpriv->reap_action != NORMAL) { /* cancelled or submit_fail */
2500                 usbi_dbg("CANCEL: urb status %d", urb->status);
2501
2502                 if (tpriv->num_retired == num_urbs) {
2503                         usbi_dbg("CANCEL: last URB handled, reporting");
2504                         free_iso_urbs(tpriv);
2505                         if (tpriv->reap_action == CANCELLED) {
2506                                 usbi_mutex_unlock(&itransfer->lock);
2507                                 return usbi_handle_transfer_cancellation(itransfer);
2508                         } else {
2509                                 usbi_mutex_unlock(&itransfer->lock);
2510                                 return usbi_handle_transfer_completion(itransfer, LIBUSB_TRANSFER_ERROR);
2511                         }
2512                 }
2513                 goto out;
2514         }
2515
2516         switch (urb->status) {
2517         case 0:
2518                 break;
2519         case -ENOENT: /* cancelled */
2520         case -ECONNRESET:
2521                 break;
2522         case -ESHUTDOWN:
2523                 usbi_dbg("device removed");
2524                 status = LIBUSB_TRANSFER_NO_DEVICE;
2525                 break;
2526         default:
2527                 usbi_warn(TRANSFER_CTX(transfer), "unrecognised urb status %d", urb->status);
2528                 status = LIBUSB_TRANSFER_ERROR;
2529                 break;
2530         }
2531
2532         /* if we've reaped all urbs then we're done */
2533         if (tpriv->num_retired == num_urbs) {
2534                 usbi_dbg("all URBs in transfer reaped --> complete!");
2535                 free_iso_urbs(tpriv);
2536                 usbi_mutex_unlock(&itransfer->lock);
2537                 return usbi_handle_transfer_completion(itransfer, status);
2538         }
2539
2540 out:
2541         usbi_mutex_unlock(&itransfer->lock);
2542         return 0;
2543 }
2544
2545 static int handle_control_completion(struct usbi_transfer *itransfer,
2546         struct usbfs_urb *urb)
2547 {
2548         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2549         int status;
2550
2551         usbi_mutex_lock(&itransfer->lock);
2552         usbi_dbg("handling completion status %d", urb->status);
2553
2554         itransfer->transferred += urb->actual_length;
2555
2556         if (tpriv->reap_action == CANCELLED) {
2557                 if (urb->status && urb->status != -ENOENT)
2558                         usbi_warn(ITRANSFER_CTX(itransfer), "cancel: unrecognised urb status %d",
2559                                   urb->status);
2560                 free(tpriv->urbs);
2561                 tpriv->urbs = NULL;
2562                 usbi_mutex_unlock(&itransfer->lock);
2563                 return usbi_handle_transfer_cancellation(itransfer);
2564         }
2565
2566         switch (urb->status) {
2567         case 0:
2568                 status = LIBUSB_TRANSFER_COMPLETED;
2569                 break;
2570         case -ENOENT: /* cancelled */
2571                 status = LIBUSB_TRANSFER_CANCELLED;
2572                 break;
2573         case -ENODEV:
2574         case -ESHUTDOWN:
2575                 usbi_dbg("device removed");
2576                 status = LIBUSB_TRANSFER_NO_DEVICE;
2577                 break;
2578         case -EPIPE:
2579                 usbi_dbg("unsupported control request");
2580                 status = LIBUSB_TRANSFER_STALL;
2581                 break;
2582         case -EOVERFLOW:
2583                 usbi_dbg("overflow, actual_length=%d", urb->actual_length);
2584                 status = LIBUSB_TRANSFER_OVERFLOW;
2585                 break;
2586         case -ETIME:
2587         case -EPROTO:
2588         case -EILSEQ:
2589         case -ECOMM:
2590         case -ENOSR:
2591                 usbi_dbg("low-level bus error %d", urb->status);
2592                 status = LIBUSB_TRANSFER_ERROR;
2593                 break;
2594         default:
2595                 usbi_warn(ITRANSFER_CTX(itransfer), "unrecognised urb status %d", urb->status);
2596                 status = LIBUSB_TRANSFER_ERROR;
2597                 break;
2598         }
2599
2600         free(tpriv->urbs);
2601         tpriv->urbs = NULL;
2602         usbi_mutex_unlock(&itransfer->lock);
2603         return usbi_handle_transfer_completion(itransfer, status);
2604 }
2605
2606 static int reap_for_handle(struct libusb_device_handle *handle)
2607 {
2608         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
2609         int r;
2610         struct usbfs_urb *urb = NULL;
2611         struct usbi_transfer *itransfer;
2612         struct libusb_transfer *transfer;
2613
2614         r = ioctl(hpriv->fd, IOCTL_USBFS_REAPURBNDELAY, &urb);
2615         if (r < 0) {
2616                 if (errno == EAGAIN)
2617                         return 1;
2618                 if (errno == ENODEV)
2619                         return LIBUSB_ERROR_NO_DEVICE;
2620
2621                 usbi_err(HANDLE_CTX(handle), "reap failed, errno=%d", errno);
2622                 return LIBUSB_ERROR_IO;
2623         }
2624
2625         itransfer = urb->usercontext;
2626         transfer = USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2627
2628         usbi_dbg("urb type=%u status=%d transferred=%d", urb->type, urb->status, urb->actual_length);
2629
2630         switch (transfer->type) {
2631         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2632                 return handle_iso_completion(itransfer, urb);
2633         case LIBUSB_TRANSFER_TYPE_BULK:
2634         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2635         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2636                 return handle_bulk_completion(itransfer, urb);
2637         case LIBUSB_TRANSFER_TYPE_CONTROL:
2638                 return handle_control_completion(itransfer, urb);
2639         default:
2640                 usbi_err(HANDLE_CTX(handle), "unrecognised transfer type %u", transfer->type);
2641                 return LIBUSB_ERROR_OTHER;
2642         }
2643 }
2644
2645 static int op_handle_events(struct libusb_context *ctx,
2646         void *event_data, unsigned int count, unsigned int num_ready)
2647 {
2648         struct pollfd *fds = event_data;
2649         unsigned int n;
2650         int r;
2651
2652         usbi_mutex_lock(&ctx->open_devs_lock);
2653         for (n = 0; n < count && num_ready > 0; n++) {
2654                 struct pollfd *pollfd = &fds[n];
2655                 struct libusb_device_handle *handle;
2656                 struct linux_device_handle_priv *hpriv = NULL;
2657                 int reap_count;
2658
2659                 if (!pollfd->revents)
2660                         continue;
2661
2662                 num_ready--;
2663                 for_each_open_device(ctx, handle) {
2664                         hpriv = usbi_get_device_handle_priv(handle);
2665                         if (hpriv->fd == pollfd->fd)
2666                                 break;
2667                 }
2668
2669                 if (!hpriv || hpriv->fd != pollfd->fd) {
2670                         usbi_err(ctx, "cannot find handle for fd %d",
2671                                  pollfd->fd);
2672                         continue;
2673                 }
2674
2675                 if (pollfd->revents & POLLERR) {
2676                         /* remove the fd from the pollfd set so that it doesn't continuously
2677                          * trigger an event, and flag that it has been removed so op_close()
2678                          * doesn't try to remove it a second time */
2679                         usbi_remove_event_source(HANDLE_CTX(handle), hpriv->fd);
2680                         hpriv->fd_removed = 1;
2681
2682                         /* device will still be marked as attached if hotplug monitor thread
2683                          * hasn't processed remove event yet */
2684                         usbi_mutex_static_lock(&linux_hotplug_lock);
2685                         if (handle->dev->attached)
2686                                 linux_device_disconnected(handle->dev->bus_number,
2687                                                           handle->dev->device_address);
2688                         usbi_mutex_static_unlock(&linux_hotplug_lock);
2689
2690                         if (hpriv->caps & USBFS_CAP_REAP_AFTER_DISCONNECT) {
2691                                 do {
2692                                         r = reap_for_handle(handle);
2693                                 } while (r == 0);
2694                         }
2695
2696                         usbi_handle_disconnect(handle);
2697                         continue;
2698                 }
2699
2700                 reap_count = 0;
2701                 do {
2702                         r = reap_for_handle(handle);
2703                 } while (r == 0 && ++reap_count <= 25);
2704
2705                 if (r == 1 || r == LIBUSB_ERROR_NO_DEVICE)
2706                         continue;
2707                 else if (r < 0)
2708                         goto out;
2709         }
2710
2711         r = 0;
2712 out:
2713         usbi_mutex_unlock(&ctx->open_devs_lock);
2714         return r;
2715 }
2716
2717 const struct usbi_os_backend usbi_backend = {
2718         .name = "Linux usbfs",
2719         .caps = USBI_CAP_HAS_HID_ACCESS|USBI_CAP_SUPPORTS_DETACH_KERNEL_DRIVER,
2720         .init = op_init,
2721         .exit = op_exit,
2722         .set_option = op_set_option,
2723         .hotplug_poll = op_hotplug_poll,
2724         .get_active_config_descriptor = op_get_active_config_descriptor,
2725         .get_config_descriptor = op_get_config_descriptor,
2726         .get_config_descriptor_by_value = op_get_config_descriptor_by_value,
2727
2728         .wrap_sys_device = op_wrap_sys_device,
2729         .open = op_open,
2730         .close = op_close,
2731         .get_configuration = op_get_configuration,
2732         .set_configuration = op_set_configuration,
2733         .claim_interface = op_claim_interface,
2734         .release_interface = op_release_interface,
2735
2736         .set_interface_altsetting = op_set_interface,
2737         .clear_halt = op_clear_halt,
2738         .reset_device = op_reset_device,
2739
2740         .alloc_streams = op_alloc_streams,
2741         .free_streams = op_free_streams,
2742
2743         .dev_mem_alloc = op_dev_mem_alloc,
2744         .dev_mem_free = op_dev_mem_free,
2745
2746         .kernel_driver_active = op_kernel_driver_active,
2747         .detach_kernel_driver = op_detach_kernel_driver,
2748         .attach_kernel_driver = op_attach_kernel_driver,
2749
2750         .destroy_device = op_destroy_device,
2751
2752         .submit_transfer = op_submit_transfer,
2753         .cancel_transfer = op_cancel_transfer,
2754         .clear_transfer_priv = op_clear_transfer_priv,
2755
2756         .handle_events = op_handle_events,
2757
2758         .device_priv_size = sizeof(struct linux_device_priv),
2759         .device_handle_priv_size = sizeof(struct linux_device_handle_priv),
2760         .transfer_priv_size = sizeof(struct linux_transfer_priv),
2761 };