libusb/os/linux_usbfs.c

   1 /* -*- Mode: C; c-basic-offset:8 ; indent-tabs-mode:t -*- */
   2 /*
   3  * Linux usbfs backend for libusb
   4  * Copyright © 2007-2009 Daniel Drake <dsd@gentoo.org>
   5  * Copyright © 2001 Johannes Erdfelt <johannes@erdfelt.com>
   6  * Copyright © 2013 Nathan Hjelm <hjelmn@mac.com>
   7  * Copyright © 2012-2013 Hans de Goede <hdegoede@redhat.com>
   8  * Copyright © 2020 Chris Dickens <christopher.a.dickens@gmail.com>
   9  *
  10  * This library is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU Lesser General Public
  12  * License as published by the Free Software Foundation; either
  13  * version 2.1 of the License, or (at your option) any later version.
  14  *
  15  * This library is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18  * Lesser General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU Lesser General Public
  21  * License along with this library; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  23  */
  24
  25 #include "libusbi.h"
  26 #include "linux_usbfs.h"
  27
  28 #include <alloca.h>
  29 #include <ctype.h>
  30 #include <dirent.h>
  31 #include <errno.h>
  32 #include <fcntl.h>
  33 #include <stdio.h>
  34 #include <string.h>
  35 #include <sys/ioctl.h>
  36 #include <sys/mman.h>
  37 #include <sys/utsname.h>
  38 #include <sys/vfs.h>
  39 #include <unistd.h>
  40
  41 /* sysfs vs usbfs:
  42  * opening a usbfs node causes the device to be resumed, so we attempt to
  43  * avoid this during enumeration.
  44  *
  45  * sysfs allows us to read the kernel's in-memory copies of device descriptors
  46  * and so forth, avoiding the need to open the device:
  47  *  - The binary "descriptors" file contains all config descriptors since
  48  *    2.6.26, commit 217a9081d8e69026186067711131b77f0ce219ed
  49  *  - The binary "descriptors" file was added in 2.6.23, commit
  50  *    69d42a78f935d19384d1f6e4f94b65bb162b36df, but it only contains the
  51  *    active config descriptors
  52  *  - The "busnum" file was added in 2.6.22, commit
  53  *    83f7d958eab2fbc6b159ee92bf1493924e1d0f72
  54  *  - The "devnum" file has been present since pre-2.6.18
  55  *  - the "bConfigurationValue" file has been present since pre-2.6.18
  56  *
  57  * If we have bConfigurationValue, busnum, and devnum, then we can determine
  58  * the active configuration without having to open the usbfs node in RDWR mode.
  59  * The busnum file is important as that is the only way we can relate sysfs
  60  * devices to usbfs nodes.
  61  *
  62  * If we also have all descriptors, we can obtain the device descriptor and
  63  * configuration without touching usbfs at all.
  64  */
  65
  66 /* endianness for multi-byte fields:
  67  *
  68  * Descriptors exposed by usbfs have the multi-byte fields in the device
  69  * descriptor as host endian. Multi-byte fields in the other descriptors are
  70  * bus-endian. The kernel documentation says otherwise, but it is wrong.
  71  *
  72  * In sysfs all descriptors are bus-endian.
  73  */
  74
  75 #define USBDEV_PATH             "/dev"
  76 #define USB_DEVTMPFS_PATH       "/dev/bus/usb"
  77
  78 /* use usbdev*.* device names in /dev instead of the usbfs bus directories */
  79 static int usbdev_names = 0;
  80
  81 /* Linux has changed the maximum length of an individual isochronous packet
  82  * over time.  Initially this limit was 1,023 bytes, but Linux 2.6.18
  83  * (commit 3612242e527eb47ee4756b5350f8bdf791aa5ede) increased this value to
  84  * 8,192 bytes to support higher bandwidth devices.  Linux 3.10
  85  * (commit e2e2f0ea1c935edcf53feb4c4c8fdb4f86d57dd9) further increased this
  86  * value to 49,152 bytes to support super speed devices.  Linux 5.2
  87  * (commit 8a1dbc8d91d3d1602282c7e6b4222c7759c916fa) even further increased
  88  * this value to 98,304 bytes to support super speed plus devices.
  89  */
  90 static unsigned int max_iso_packet_len = 0;
  91
  92 /* is sysfs available (mounted) ? */
  93 static int sysfs_available = -1;
  94
  95 /* how many times have we initted (and not exited) ? */
  96 static int init_count = 0;
  97
  98 #ifdef __ANDROID__
  99 /* have no authority to operate usb device directly */
 100 static int weak_authority = 0;
 101 #endif
 102
 103 /* Serialize hotplug start/stop */
 104 static usbi_mutex_static_t linux_hotplug_startstop_lock = USBI_MUTEX_INITIALIZER;
 105 /* Serialize scan-devices, event-thread, and poll */
 106 usbi_mutex_static_t linux_hotplug_lock = USBI_MUTEX_INITIALIZER;
 107
 108 static int linux_scan_devices(struct libusb_context *ctx);
 109 static int detach_kernel_driver_and_claim(struct libusb_device_handle *, uint8_t);
 110
 111 #if !defined(HAVE_LIBUDEV)
 112 static int linux_default_scan_devices(struct libusb_context *ctx);
 113 #endif
 114
 115 struct kernel_version {
 116         int major;
 117         int minor;
 118         int sublevel;
 119 };
 120
 121 struct config_descriptor {
 122         struct usbi_configuration_descriptor *desc;
 123         size_t actual_len;
 124 };
 125
 126 struct linux_device_priv {
 127         char *sysfs_dir;
 128         void *descriptors;
 129         size_t descriptors_len;
 130         struct config_descriptor *config_descriptors;
 131         uint8_t active_config; /* cache val for !sysfs_available  */
 132 };
 133
 134 struct linux_device_handle_priv {
 135         int fd;
 136         int fd_removed;
 137         int fd_keep;
 138         uint32_t caps;
 139 };
 140
 141 enum reap_action {
 142         NORMAL = 0,
 143         /* submission failed after the first URB, so await cancellation/completion
 144          * of all the others */
 145         SUBMIT_FAILED,
 146
 147         /* cancelled by user or timeout */
 148         CANCELLED,
 149
 150         /* completed multi-URB transfer in non-final URB */
 151         COMPLETED_EARLY,
 152
 153         /* one or more urbs encountered a low-level error */
 154         ERROR,
 155 };
 156
 157 struct linux_transfer_priv {
 158         union {
 159                 struct usbfs_urb *urbs;
 160                 struct usbfs_urb **iso_urbs;
 161         };
 162
 163         enum reap_action reap_action;
 164         int num_urbs;
 165         int num_retired;
 166         enum libusb_transfer_status reap_status;
 167
 168         /* next iso packet in user-supplied transfer to be populated */
 169         int iso_packet_offset;
 170 };
 171
 172 static int get_usbfs_fd(struct libusb_device *dev, mode_t mode, int silent)
 173 {
 174         struct libusb_context *ctx = DEVICE_CTX(dev);
 175         char path[24];
 176         int fd;
 177
 178         if (usbdev_names)
 179                 sprintf(path, USBDEV_PATH "/usbdev%u.%u",
 180                         dev->bus_number, dev->device_address);
 181         else
 182                 sprintf(path, USB_DEVTMPFS_PATH "/%03u/%03u",
 183                         dev->bus_number, dev->device_address);
 184
 185         fd = open(path, mode | O_CLOEXEC);
 186         if (fd != -1)
 187                 return fd; /* Success */
 188
 189         if (errno == ENOENT) {
 190                 const long delay_ms = 10L;
 191                 const struct timespec delay_ts = { 0L, delay_ms * 1000L * 1000L };
 192
 193                 if (!silent)
 194                         usbi_err(ctx, "File doesn't exist, wait %ld ms and try again", delay_ms);
 195
 196                 /* Wait 10ms for USB device path creation.*/
 197                 nanosleep(&delay_ts, NULL);
 198
 199                 fd = open(path, mode | O_CLOEXEC);
 200                 if (fd != -1)
 201                         return fd; /* Success */
 202         }
 203
 204         if (!silent) {
 205                 usbi_err(ctx, "libusb couldn't open USB device %s, errno=%d", path, errno);
 206                 if (errno == EACCES && mode == O_RDWR)
 207                         usbi_err(ctx, "libusb requires write access to USB device nodes");
 208         }
 209
 210         if (errno == EACCES)
 211                 return LIBUSB_ERROR_ACCESS;
 212         if (errno == ENOENT)
 213                 return LIBUSB_ERROR_NO_DEVICE;
 214         return LIBUSB_ERROR_IO;
 215 }
 216
 217 /* check dirent for a /dev/usbdev%d.%d name
 218  * optionally return bus/device on success */
 219 static int is_usbdev_entry(const char *name, uint8_t *bus_p, uint8_t *dev_p)
 220 {
 221         int busnum, devnum;
 222
 223         if (sscanf(name, "usbdev%d.%d", &busnum, &devnum) != 2)
 224                 return 0;
 225         if (busnum < 0 || busnum > UINT8_MAX || devnum < 0 || devnum > UINT8_MAX) {
 226                 usbi_dbg("invalid usbdev format '%s'", name);
 227                 return 0;
 228         }
 229
 230         usbi_dbg("found: %s", name);
 231         if (bus_p)
 232                 *bus_p = (uint8_t)busnum;
 233         if (dev_p)
 234                 *dev_p = (uint8_t)devnum;
 235         return 1;
 236 }
 237
 238 static const char *find_usbfs_path(void)
 239 {
 240         const char *path;
 241         DIR *dir;
 242         struct dirent *entry;
 243
 244         path = USB_DEVTMPFS_PATH;
 245         dir = opendir(path);
 246         if (dir) {
 247                 while ((entry = readdir(dir))) {
 248                         if (entry->d_name[0] == '.')
 249                                 continue;
 250
 251                         /* We assume if we find any files that it must be the right place */
 252                         break;
 253                 }
 254
 255                 closedir(dir);
 256
 257                 if (entry)
 258                         return path;
 259         }
 260
 261         /* look for /dev/usbdev*.* if the normal place fails */
 262         path = USBDEV_PATH;
 263         dir = opendir(path);
 264         if (dir) {
 265                 while ((entry = readdir(dir))) {
 266                         if (entry->d_name[0] == '.')
 267                                 continue;
 268
 269                         if (is_usbdev_entry(entry->d_name, NULL, NULL)) {
 270                                 /* found one; that's enough */
 271                                 break;
 272                         }
 273                 }
 274
 275                 closedir(dir);
 276
 277                 if (entry) {
 278                         usbdev_names = 1;
 279                         return path;
 280                 }
 281         }
 282
 283 /* On udev based systems without any usb-devices /dev/bus/usb will not
 284  * exist. So if we've not found anything and we're using udev for hotplug
 285  * simply assume /dev/bus/usb rather then making libusb_init fail.
 286  * Make the same assumption for Android where SELinux policies might block us
 287  * from reading /dev on newer devices. */
 288 #if defined(HAVE_LIBUDEV) || defined(__ANDROID__)
 289         return USB_DEVTMPFS_PATH;
 290 #else
 291         return NULL;
 292 #endif
 293 }
 294
 295 static int get_kernel_version(struct libusb_context *ctx,
 296         struct kernel_version *ver)
 297 {
 298         struct utsname uts;
 299         int atoms;
 300
 301         if (uname(&uts) < 0) {
 302                 usbi_err(ctx, "uname failed, errno=%d", errno);
 303                 return -1;
 304         }
 305
 306         atoms = sscanf(uts.release, "%d.%d.%d", &ver->major, &ver->minor, &ver->sublevel);
 307         if (atoms < 2) {
 308                 usbi_err(ctx, "failed to parse uname release '%s'", uts.release);
 309                 return -1;
 310         }
 311
 312         if (atoms < 3)
 313                 ver->sublevel = -1;
 314
 315         usbi_dbg("reported kernel version is %s", uts.release);
 316
 317         return 0;
 318 }
 319
 320 static int kernel_version_ge(const struct kernel_version *ver,
 321         int major, int minor, int sublevel)
 322 {
 323         if (ver->major > major)
 324                 return 1;
 325         else if (ver->major < major)
 326                 return 0;
 327
 328         /* kmajor == major */
 329         if (ver->minor > minor)
 330                 return 1;
 331         else if (ver->minor < minor)
 332                 return 0;
 333
 334         /* kminor == minor */
 335         if (ver->sublevel == -1)
 336                 return sublevel == 0;
 337
 338         return ver->sublevel >= sublevel;
 339 }
 340
 341 static int op_init(struct libusb_context *ctx)
 342 {
 343         struct kernel_version kversion;
 344         const char *usbfs_path;
 345         int r;
 346
 347         if (get_kernel_version(ctx, &kversion) < 0)
 348                 return LIBUSB_ERROR_OTHER;
 349
 350         if (!kernel_version_ge(&kversion, 2, 6, 32)) {
 351                 usbi_err(ctx, "kernel version is too old (reported as %d.%d.%d)",
 352                          kversion.major, kversion.minor,
 353                          kversion.sublevel != -1 ? kversion.sublevel : 0);
 354                 return LIBUSB_ERROR_NOT_SUPPORTED;
 355         }
 356
 357         usbfs_path = find_usbfs_path();
 358         if (!usbfs_path) {
 359                 usbi_err(ctx, "could not find usbfs");
 360                 return LIBUSB_ERROR_OTHER;
 361         }
 362
 363         usbi_dbg("found usbfs at %s", usbfs_path);
 364
 365         if (!max_iso_packet_len) {
 366                 if (kernel_version_ge(&kversion, 5, 2, 0))
 367                         max_iso_packet_len = 98304;
 368                 else if (kernel_version_ge(&kversion, 3, 10, 0))
 369                         max_iso_packet_len = 49152;
 370                 else
 371                         max_iso_packet_len = 8192;
 372         }
 373
 374         usbi_dbg("max iso packet length is (likely) %u bytes", max_iso_packet_len);
 375
 376         if (sysfs_available == -1) {
 377                 struct statfs statfsbuf;
 378
 379                 r = statfs(SYSFS_MOUNT_PATH, &statfsbuf);
 380                 if (r == 0 && statfsbuf.f_type == SYSFS_MAGIC) {
 381                         usbi_dbg("sysfs is available");
 382                         sysfs_available = 1;
 383                 } else {
 384                         usbi_warn(ctx, "sysfs not mounted");
 385                         sysfs_available = 0;
 386                 }
 387         }
 388
 389 #ifdef __ANDROID__
 390         if (weak_authority) {
 391                 return LIBUSB_SUCCESS;
 392         }
 393 #endif
 394
 395         usbi_mutex_static_lock(&linux_hotplug_startstop_lock);
 396         r = LIBUSB_SUCCESS;
 397         if (init_count == 0) {
 398                 /* start up hotplug event handler */
 399                 r = linux_start_event_monitor();
 400         }
 401         if (r == LIBUSB_SUCCESS) {
 402                 r = linux_scan_devices(ctx);
 403                 if (r == LIBUSB_SUCCESS)
 404                         init_count++;
 405                 else if (init_count == 0)
 406                         linux_stop_event_monitor();
 407         } else {
 408                 usbi_err(ctx, "error starting hotplug event monitor");
 409         }
 410         usbi_mutex_static_unlock(&linux_hotplug_startstop_lock);
 411
 412         return r;
 413 }
 414
 415 static void op_exit(struct libusb_context *ctx)
 416 {
 417         UNUSED(ctx);
 418         usbi_mutex_static_lock(&linux_hotplug_startstop_lock);
 419         assert(init_count != 0);
 420         if (!--init_count) {
 421                 /* tear down event handler */
 422                 linux_stop_event_monitor();
 423         }
 424         usbi_mutex_static_unlock(&linux_hotplug_startstop_lock);
 425 }
 426
 427 static int op_set_option(struct libusb_context *ctx, enum libusb_option option, va_list ap)
 428 {
 429         UNUSED(ctx);
 430         UNUSED(ap);
 431
 432 #ifdef __ANDROID__
 433         if (option == LIBUSB_OPTION_WEAK_AUTHORITY) {
 434                 usbi_dbg("set libusb has weak authority");
 435                 weak_authority = 1;
 436                 return LIBUSB_SUCCESS;
 437         }
 438 #else
 439         UNUSED(option);
 440 #endif
 441
 442         return LIBUSB_ERROR_NOT_SUPPORTED;
 443 }
 444
 445 static int linux_scan_devices(struct libusb_context *ctx)
 446 {
 447         int ret;
 448
 449         usbi_mutex_static_lock(&linux_hotplug_lock);
 450
 451 #if defined(HAVE_LIBUDEV)
 452         ret = linux_udev_scan_devices(ctx);
 453 #else
 454         ret = linux_default_scan_devices(ctx);
 455 #endif
 456
 457         usbi_mutex_static_unlock(&linux_hotplug_lock);
 458
 459         return ret;
 460 }
 461
 462 static void op_hotplug_poll(void)
 463 {
 464         linux_hotplug_poll();
 465 }
 466
 467 static int open_sysfs_attr(struct libusb_context *ctx,
 468         const char *sysfs_dir, const char *attr)
 469 {
 470         char filename[256];
 471         int fd;
 472
 473         snprintf(filename, sizeof(filename), SYSFS_DEVICE_PATH "/%s/%s", sysfs_dir, attr);
 474         fd = open(filename, O_RDONLY | O_CLOEXEC);
 475         if (fd < 0) {
 476                 if (errno == ENOENT) {
 477                         /* File doesn't exist. Assume the device has been
 478                            disconnected (see trac ticket #70). */
 479                         return LIBUSB_ERROR_NO_DEVICE;
 480                 }
 481                 usbi_err(ctx, "open %s failed, errno=%d", filename, errno);
 482                 return LIBUSB_ERROR_IO;
 483         }
 484
 485         return fd;
 486 }
 487
 488 /* Note only suitable for attributes which always read >= 0, < 0 is error */
 489 static int read_sysfs_attr(struct libusb_context *ctx,
 490         const char *sysfs_dir, const char *attr, int max_value, int *value_p)
 491 {
 492         char buf[20], *endptr;
 493         long value;
 494         ssize_t r;
 495         int fd;
 496
 497         fd = open_sysfs_attr(ctx, sysfs_dir, attr);
 498         if (fd < 0)
 499                 return fd;
 500
 501         r = read(fd, buf, sizeof(buf));
 502         if (r < 0) {
 503                 r = errno;
 504                 close(fd);
 505                 if (r == ENODEV)
 506                         return LIBUSB_ERROR_NO_DEVICE;
 507                 usbi_err(ctx, "attribute %s read failed, errno=%zd", attr, r);
 508                 return LIBUSB_ERROR_IO;
 509         }
 510         close(fd);
 511
 512         if (r == 0) {
 513                 /* Certain attributes (e.g. bConfigurationValue) are not
 514                  * populated if the device is not configured. */
 515                 *value_p = -1;
 516                 return 0;
 517         }
 518
 519         /* The kernel does *not* NULL-terminate the string, but every attribute
 520          * should be terminated with a newline character. */
 521         if (!isdigit(buf[0])) {
 522                 usbi_err(ctx, "attribute %s doesn't have numeric value?", attr);
 523                 return LIBUSB_ERROR_IO;
 524         } else if (buf[r - 1] != '\n') {
 525                 usbi_err(ctx, "attribute %s doesn't end with newline?", attr);
 526                 return LIBUSB_ERROR_IO;
 527         }
 528         buf[r - 1] = '\0';
 529
 530         errno = 0;
 531         value = strtol(buf, &endptr, 10);
 532         if (value < 0 || value > (long)max_value || errno) {
 533                 usbi_err(ctx, "attribute %s contains an invalid value: '%s'", attr, buf);
 534                 return LIBUSB_ERROR_INVALID_PARAM;
 535         } else if (*endptr != '\0') {
 536                 /* Consider the value to be valid if the remainder is a '.'
 537                  * character followed by numbers.  This occurs, for example,
 538                  * when reading the "speed" attribute for a low-speed device
 539                  * (e.g. "1.5") */
 540                 if (*endptr == '.' && isdigit(*(endptr + 1))) {
 541                         endptr++;
 542                         while (isdigit(*endptr))
 543                                 endptr++;
 544                 }
 545                 if (*endptr != '\0') {
 546                         usbi_err(ctx, "attribute %s contains an invalid value: '%s'", attr, buf);
 547                         return LIBUSB_ERROR_INVALID_PARAM;
 548                 }
 549         }
 550
 551         *value_p = (int)value;
 552         return 0;
 553 }
 554
 555 static int sysfs_scan_device(struct libusb_context *ctx, const char *devname)
 556 {
 557         uint8_t busnum, devaddr;
 558         int ret;
 559
 560         ret = linux_get_device_address(ctx, 0, &busnum, &devaddr, NULL, devname, -1);
 561         if (ret != LIBUSB_SUCCESS)
 562                 return ret;
 563
 564         return linux_enumerate_device(ctx, busnum, devaddr, devname);
 565 }
 566
 567 /* read the bConfigurationValue for a device */
 568 static int sysfs_get_active_config(struct libusb_device *dev, uint8_t *config)
 569 {
 570         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 571         int ret, tmp;
 572
 573         ret = read_sysfs_attr(DEVICE_CTX(dev), priv->sysfs_dir, "bConfigurationValue",
 574                               UINT8_MAX, &tmp);
 575         if (ret < 0)
 576                 return ret;
 577
 578         if (tmp == -1)
 579                 tmp = 0;        /* unconfigured */
 580
 581         *config = (uint8_t)tmp;
 582
 583         return 0;
 584 }
 585
 586 int linux_get_device_address(struct libusb_context *ctx, int detached,
 587         uint8_t *busnum, uint8_t *devaddr, const char *dev_node,
 588         const char *sys_name, int fd)
 589 {
 590         int sysfs_val;
 591         int r;
 592
 593         usbi_dbg("getting address for device: %s detached: %d", sys_name, detached);
 594         /* can't use sysfs to read the bus and device number if the
 595          * device has been detached */
 596         if (!sysfs_available || detached || !sys_name) {
 597                 if (!dev_node && fd >= 0) {
 598                         char *fd_path = alloca(PATH_MAX);
 599                         char proc_path[32];
 600
 601                         /* try to retrieve the device node from fd */
 602                         sprintf(proc_path, "/proc/self/fd/%d", fd);
 603                         r = readlink(proc_path, fd_path, PATH_MAX - 1);
 604                         if (r > 0) {
 605                                 fd_path[r] = '\0';
 606                                 dev_node = fd_path;
 607                         }
 608                 }
 609
 610                 if (!dev_node)
 611                         return LIBUSB_ERROR_OTHER;
 612
 613                 /* will this work with all supported kernel versions? */
 614                 if (!strncmp(dev_node, "/dev/bus/usb", 12))
 615                         sscanf(dev_node, "/dev/bus/usb/%hhu/%hhu", busnum, devaddr);
 616                 else
 617                         return LIBUSB_ERROR_OTHER;
 618
 619                 return LIBUSB_SUCCESS;
 620         }
 621
 622         usbi_dbg("scan %s", sys_name);
 623
 624         r = read_sysfs_attr(ctx, sys_name, "busnum", UINT8_MAX, &sysfs_val);
 625         if (r < 0)
 626                 return r;
 627         *busnum = (uint8_t)sysfs_val;
 628
 629         r = read_sysfs_attr(ctx, sys_name, "devnum", UINT8_MAX, &sysfs_val);
 630         if (r < 0)
 631                 return r;
 632         *devaddr = (uint8_t)sysfs_val;
 633
 634         usbi_dbg("bus=%u dev=%u", *busnum, *devaddr);
 635
 636         return LIBUSB_SUCCESS;
 637 }
 638
 639 /* Return offset of the next config descriptor */
 640 static int seek_to_next_config(struct libusb_context *ctx,
 641         uint8_t *buffer, size_t len)
 642 {
 643         struct usbi_descriptor_header *header;
 644         int offset;
 645
 646         /* Start seeking past the config descriptor */
 647         offset = LIBUSB_DT_CONFIG_SIZE;
 648         buffer += LIBUSB_DT_CONFIG_SIZE;
 649         len -= LIBUSB_DT_CONFIG_SIZE;
 650
 651         while (len > 0) {
 652                 if (len < 2) {
 653                         usbi_err(ctx, "short descriptor read %zu/2", len);
 654                         return LIBUSB_ERROR_IO;
 655                 }
 656
 657                 header = (struct usbi_descriptor_header *)buffer;
 658                 if (header->bDescriptorType == LIBUSB_DT_CONFIG)
 659                         return offset;
 660
 661                 if (len < header->bLength) {
 662                         usbi_err(ctx, "bLength overflow by %zu bytes",
 663                                  (size_t)header->bLength - len);
 664                         return LIBUSB_ERROR_IO;
 665                 }
 666
 667                 offset += header->bLength;
 668                 buffer += header->bLength;
 669                 len -= header->bLength;
 670         }
 671
 672         usbi_err(ctx, "config descriptor not found");
 673         return LIBUSB_ERROR_IO;
 674 }
 675
 676 static int parse_config_descriptors(struct libusb_device *dev)
 677 {
 678         struct libusb_context *ctx = DEVICE_CTX(dev);
 679         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 680         struct usbi_device_descriptor *device_desc;
 681         uint8_t idx, num_configs;
 682         uint8_t *buffer;
 683         size_t remaining;
 684
 685         device_desc = priv->descriptors;
 686         num_configs = device_desc->bNumConfigurations;
 687
 688         if (num_configs == 0)
 689                 return 0;       /* no configurations? */
 690
 691         priv->config_descriptors = malloc(num_configs * sizeof(priv->config_descriptors[0]));
 692         if (!priv->config_descriptors)
 693                 return LIBUSB_ERROR_NO_MEM;
 694
 695         buffer = (uint8_t *)priv->descriptors + LIBUSB_DT_DEVICE_SIZE;
 696         remaining = priv->descriptors_len - LIBUSB_DT_DEVICE_SIZE;
 697
 698         for (idx = 0; idx < num_configs; idx++) {
 699                 struct usbi_configuration_descriptor *config_desc;
 700                 uint16_t config_len;
 701
 702                 if (remaining < LIBUSB_DT_CONFIG_SIZE) {
 703                         usbi_err(ctx, "short descriptor read %zu/%d",
 704                                  remaining, LIBUSB_DT_CONFIG_SIZE);
 705                         return LIBUSB_ERROR_IO;
 706                 }
 707
 708                 config_desc = (struct usbi_configuration_descriptor *)buffer;
 709                 if (config_desc->bDescriptorType != LIBUSB_DT_CONFIG) {
 710                         usbi_err(ctx, "descriptor is not a config desc (type 0x%02x)",
 711                                  config_desc->bDescriptorType);
 712                         return LIBUSB_ERROR_IO;
 713                 } else if (config_desc->bLength < LIBUSB_DT_CONFIG_SIZE) {
 714                         usbi_err(ctx, "invalid descriptor bLength %u",
 715                                  config_desc->bLength);
 716                         return LIBUSB_ERROR_IO;
 717                 }
 718
 719                 config_len = libusb_le16_to_cpu(config_desc->wTotalLength);
 720                 if (config_len < LIBUSB_DT_CONFIG_SIZE) {
 721                         usbi_err(ctx, "invalid wTotalLength %u", config_len);
 722                         return LIBUSB_ERROR_IO;
 723                 }
 724
 725                 if (priv->sysfs_dir) {
 726                         /*
 727                          * In sysfs wTotalLength is ignored, instead the kernel returns a
 728                          * config descriptor with verified bLength fields, with descriptors
 729                          * with an invalid bLength removed.
 730                          */
 731                         uint16_t sysfs_config_len;
 732                         int offset;
 733
 734                         if (num_configs > 1 && idx < num_configs - 1) {
 735                                 offset = seek_to_next_config(ctx, buffer, remaining);
 736                                 if (offset < 0)
 737                                         return offset;
 738                                 sysfs_config_len = (uint16_t)offset;
 739                         } else {
 740                                 sysfs_config_len = (uint16_t)remaining;
 741                         }
 742
 743                         if (config_len != sysfs_config_len) {
 744                                 usbi_warn(ctx, "config length mismatch wTotalLength %u real %u",
 745                                           config_len, sysfs_config_len);
 746                                 config_len = sysfs_config_len;
 747                         }
 748                 } else {
 749                         /*
 750                          * In usbfs the config descriptors are wTotalLength bytes apart,
 751                          * with any short reads from the device appearing as holes in the file.
 752                          */
 753                         if (config_len > remaining) {
 754                                 usbi_warn(ctx, "short descriptor read %zu/%u", remaining, config_len);
 755                                 config_len = (uint16_t)remaining;
 756                         }
 757                 }
 758
 759                 priv->config_descriptors[idx].desc = config_desc;
 760                 priv->config_descriptors[idx].actual_len = config_len;
 761
 762                 buffer += config_len;
 763                 remaining -= config_len;
 764         }
 765
 766         return LIBUSB_SUCCESS;
 767 }
 768
 769 static int op_get_config_descriptor_by_value(struct libusb_device *dev,
 770         uint8_t value, void **buffer)
 771 {
 772         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 773         struct config_descriptor *config;
 774         uint8_t idx;
 775
 776         for (idx = 0; idx < dev->device_descriptor.bNumConfigurations; idx++) {
 777                 config = &priv->config_descriptors[idx];
 778                 if (config->desc->bConfigurationValue == value) {
 779                         *buffer = config->desc;
 780                         return (int)config->actual_len;
 781                 }
 782         }
 783
 784         return LIBUSB_ERROR_NOT_FOUND;
 785 }
 786
 787 static int op_get_active_config_descriptor(struct libusb_device *dev,
 788         void *buffer, size_t len)
 789 {
 790         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 791         void *config_desc;
 792         uint8_t active_config;
 793         int r;
 794
 795         if (priv->sysfs_dir) {
 796                 r = sysfs_get_active_config(dev, &active_config);
 797                 if (r < 0)
 798                         return r;
 799         } else {
 800                 /* Use cached bConfigurationValue */
 801                 active_config = priv->active_config;
 802         }
 803
 804         if (active_config == 0) {
 805                 usbi_err(DEVICE_CTX(dev), "device unconfigured");
 806                 return LIBUSB_ERROR_NOT_FOUND;
 807         }
 808
 809         r = op_get_config_descriptor_by_value(dev, active_config, &config_desc);
 810         if (r < 0)
 811                 return r;
 812
 813         len = MIN(len, (size_t)r);
 814         memcpy(buffer, config_desc, len);
 815         return len;
 816 }
 817
 818 static int op_get_config_descriptor(struct libusb_device *dev,
 819         uint8_t config_index, void *buffer, size_t len)
 820 {
 821         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 822         struct config_descriptor *config;
 823
 824         if (config_index >= dev->device_descriptor.bNumConfigurations)
 825                 return LIBUSB_ERROR_NOT_FOUND;
 826
 827         config = &priv->config_descriptors[config_index];
 828         len = MIN(len, config->actual_len);
 829         memcpy(buffer, config->desc, len);
 830         return len;
 831 }
 832
 833 /* send a control message to retrieve active configuration */
 834 static int usbfs_get_active_config(struct libusb_device *dev, int fd)
 835 {
 836         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 837         uint8_t active_config = 0;
 838         int r;
 839
 840         struct usbfs_ctrltransfer ctrl = {
 841                 .bmRequestType = LIBUSB_ENDPOINT_IN,
 842                 .bRequest = LIBUSB_REQUEST_GET_CONFIGURATION,
 843                 .wValue = 0,
 844                 .wIndex = 0,
 845                 .wLength = 1,
 846                 .timeout = 1000,
 847                 .data = &active_config
 848         };
 849
 850         r = ioctl(fd, IOCTL_USBFS_CONTROL, &ctrl);
 851         if (r < 0) {
 852                 if (errno == ENODEV)
 853                         return LIBUSB_ERROR_NO_DEVICE;
 854
 855                 /* we hit this error path frequently with buggy devices :( */
 856                 usbi_warn(DEVICE_CTX(dev), "get configuration failed, errno=%d", errno);
 857         } else if (active_config == 0) {
 858                 /* some buggy devices have a configuration 0, but we're
 859                  * reaching into the corner of a corner case here, so let's
 860                  * not support buggy devices in these circumstances.
 861                  * stick to the specs: a configuration value of 0 means
 862                  * unconfigured. */
 863                 usbi_warn(DEVICE_CTX(dev), "active cfg 0? assuming unconfigured device");
 864         }
 865
 866         priv->active_config = active_config;
 867
 868         return LIBUSB_SUCCESS;
 869 }
 870
 871 static enum libusb_speed usbfs_get_speed(struct libusb_context *ctx, int fd)
 872 {
 873         int r;
 874
 875         r = ioctl(fd, IOCTL_USBFS_GET_SPEED, NULL);
 876         switch (r) {
 877         case USBFS_SPEED_UNKNOWN:       return LIBUSB_SPEED_UNKNOWN;
 878         case USBFS_SPEED_LOW:           return LIBUSB_SPEED_LOW;
 879         case USBFS_SPEED_FULL:          return LIBUSB_SPEED_FULL;
 880         case USBFS_SPEED_HIGH:          return LIBUSB_SPEED_HIGH;
 881         case USBFS_SPEED_WIRELESS:      return LIBUSB_SPEED_HIGH;
 882         case USBFS_SPEED_SUPER:         return LIBUSB_SPEED_SUPER;
 883         case USBFS_SPEED_SUPER_PLUS:    return LIBUSB_SPEED_SUPER_PLUS;
 884         default:
 885                 usbi_warn(ctx, "Error getting device speed: %d", r);
 886         }
 887
 888         return LIBUSB_SPEED_UNKNOWN;
 889 }
 890
 891 static int initialize_device(struct libusb_device *dev, uint8_t busnum,
 892         uint8_t devaddr, const char *sysfs_dir, int wrapped_fd)
 893 {
 894         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 895         struct libusb_context *ctx = DEVICE_CTX(dev);
 896         size_t alloc_len;
 897         int fd, speed, r;
 898         ssize_t nb;
 899
 900         dev->bus_number = busnum;
 901         dev->device_address = devaddr;
 902
 903         if (sysfs_dir) {
 904                 priv->sysfs_dir = strdup(sysfs_dir);
 905                 if (!priv->sysfs_dir)
 906                         return LIBUSB_ERROR_NO_MEM;
 907
 908                 /* Note speed can contain 1.5, in this case read_sysfs_attr()
 909                    will stop parsing at the '.' and return 1 */
 910                 if (read_sysfs_attr(ctx, sysfs_dir, "speed", INT_MAX, &speed) == 0) {
 911                         switch (speed) {
 912                         case     1: dev->speed = LIBUSB_SPEED_LOW; break;
 913                         case    12: dev->speed = LIBUSB_SPEED_FULL; break;
 914                         case   480: dev->speed = LIBUSB_SPEED_HIGH; break;
 915                         case  5000: dev->speed = LIBUSB_SPEED_SUPER; break;
 916                         case 10000: dev->speed = LIBUSB_SPEED_SUPER_PLUS; break;
 917                         default:
 918                                 usbi_warn(ctx, "unknown device speed: %d Mbps", speed);
 919                         }
 920                 }
 921         } else if (wrapped_fd >= 0) {
 922                 dev->speed = usbfs_get_speed(ctx, wrapped_fd);
 923         }
 924
 925         /* cache descriptors in memory */
 926         if (sysfs_dir) {
 927                 fd = open_sysfs_attr(ctx, sysfs_dir, "descriptors");
 928         } else if (wrapped_fd < 0) {
 929                 fd = get_usbfs_fd(dev, O_RDONLY, 0);
 930         } else {
 931                 fd = wrapped_fd;
 932                 r = lseek(fd, 0, SEEK_SET);
 933                 if (r < 0) {
 934                         usbi_err(ctx, "lseek failed, errno=%d", errno);
 935                         return LIBUSB_ERROR_IO;
 936                 }
 937         }
 938         if (fd < 0)
 939                 return fd;
 940
 941         alloc_len = 0;
 942         do {
 943                 const size_t desc_read_length = 256;
 944                 uint8_t *read_ptr;
 945
 946                 alloc_len += desc_read_length;
 947                 priv->descriptors = usbi_reallocf(priv->descriptors, alloc_len);
 948                 if (!priv->descriptors) {
 949                         if (fd != wrapped_fd)
 950                                 close(fd);
 951                         return LIBUSB_ERROR_NO_MEM;
 952                 }
 953                 read_ptr = (uint8_t *)priv->descriptors + priv->descriptors_len;
 954                 /* usbfs has holes in the file */
 955                 if (!sysfs_dir)
 956                         memset(read_ptr, 0, desc_read_length);
 957                 nb = read(fd, read_ptr, desc_read_length);
 958                 if (nb < 0) {
 959                         usbi_err(ctx, "read descriptor failed, errno=%d", errno);
 960                         if (fd != wrapped_fd)
 961                                 close(fd);
 962                         return LIBUSB_ERROR_IO;
 963                 }
 964                 priv->descriptors_len += (size_t)nb;
 965         } while (priv->descriptors_len == alloc_len);
 966
 967         if (fd != wrapped_fd)
 968                 close(fd);
 969
 970         if (priv->descriptors_len < LIBUSB_DT_DEVICE_SIZE) {
 971                 usbi_err(ctx, "short descriptor read (%zu)", priv->descriptors_len);
 972                 return LIBUSB_ERROR_IO;
 973         }
 974
 975         r = parse_config_descriptors(dev);
 976         if (r < 0)
 977                 return r;
 978
 979         memcpy(&dev->device_descriptor, priv->descriptors, LIBUSB_DT_DEVICE_SIZE);
 980
 981         if (sysfs_dir) {
 982                 /* sysfs descriptors are in bus-endian format */
 983                 usbi_localize_device_descriptor(&dev->device_descriptor);
 984                 return LIBUSB_SUCCESS;
 985         }
 986
 987         /* cache active config */
 988         if (wrapped_fd < 0)
 989                 fd = get_usbfs_fd(dev, O_RDWR, 1);
 990         else
 991                 fd = wrapped_fd;
 992         if (fd < 0) {
 993                 /* cannot send a control message to determine the active
 994                  * config. just assume the first one is active. */
 995                 usbi_warn(ctx, "Missing rw usbfs access; cannot determine "
 996                                "active configuration descriptor");
 997                 if (priv->config_descriptors)
 998                         priv->active_config = priv->config_descriptors[0].desc->bConfigurationValue;
 999                 else
1000                         priv->active_config = 0; /* No config dt */
1001
1002                 return LIBUSB_SUCCESS;
1003         }
1004
1005         r = usbfs_get_active_config(dev, fd);
1006         if (fd != wrapped_fd)
1007                 close(fd);
1008
1009         return r;
1010 }
1011
1012 static int linux_get_parent_info(struct libusb_device *dev, const char *sysfs_dir)
1013 {
1014         struct libusb_context *ctx = DEVICE_CTX(dev);
1015         struct libusb_device *it;
1016         char *parent_sysfs_dir, *tmp;
1017         int ret, add_parent = 1;
1018
1019         /* XXX -- can we figure out the topology when using usbfs? */
1020         if (!sysfs_dir || !strncmp(sysfs_dir, "usb", 3)) {
1021                 /* either using usbfs or finding the parent of a root hub */
1022                 return LIBUSB_SUCCESS;
1023         }
1024
1025         parent_sysfs_dir = strdup(sysfs_dir);
1026         if (!parent_sysfs_dir)
1027                 return LIBUSB_ERROR_NO_MEM;
1028
1029         if ((tmp = strrchr(parent_sysfs_dir, '.')) ||
1030             (tmp = strrchr(parent_sysfs_dir, '-'))) {
1031                 dev->port_number = atoi(tmp + 1);
1032                 *tmp = '\0';
1033         } else {
1034                 usbi_warn(ctx, "Can not parse sysfs_dir: %s, no parent info",
1035                           parent_sysfs_dir);
1036                 free(parent_sysfs_dir);
1037                 return LIBUSB_SUCCESS;
1038         }
1039
1040         /* is the parent a root hub? */
1041         if (!strchr(parent_sysfs_dir, '-')) {
1042                 tmp = parent_sysfs_dir;
1043                 ret = asprintf(&parent_sysfs_dir, "usb%s", tmp);
1044                 free(tmp);
1045                 if (ret < 0)
1046                         return LIBUSB_ERROR_NO_MEM;
1047         }
1048
1049 retry:
1050         /* find the parent in the context */
1051         usbi_mutex_lock(&ctx->usb_devs_lock);
1052         for_each_device(ctx, it) {
1053                 struct linux_device_priv *priv = usbi_get_device_priv(it);
1054
1055                 if (priv->sysfs_dir) {
1056                         if (!strcmp(priv->sysfs_dir, parent_sysfs_dir)) {
1057                                 dev->parent_dev = libusb_ref_device(it);
1058                                 break;
1059                         }
1060                 }
1061         }
1062         usbi_mutex_unlock(&ctx->usb_devs_lock);
1063
1064         if (!dev->parent_dev && add_parent) {
1065                 usbi_dbg("parent_dev %s not enumerated yet, enumerating now",
1066                          parent_sysfs_dir);
1067                 sysfs_scan_device(ctx, parent_sysfs_dir);
1068                 add_parent = 0;
1069                 goto retry;
1070         }
1071
1072         usbi_dbg("dev %p (%s) has parent %p (%s) port %u", dev, sysfs_dir,
1073                  dev->parent_dev, parent_sysfs_dir, dev->port_number);
1074
1075         free(parent_sysfs_dir);
1076
1077         return LIBUSB_SUCCESS;
1078 }
1079
1080 int linux_enumerate_device(struct libusb_context *ctx,
1081         uint8_t busnum, uint8_t devaddr, const char *sysfs_dir)
1082 {
1083         unsigned long session_id;
1084         struct libusb_device *dev;
1085         int r;
1086
1087         /* FIXME: session ID is not guaranteed unique as addresses can wrap and
1088          * will be reused. instead we should add a simple sysfs attribute with
1089          * a session ID. */
1090         session_id = busnum << 8 | devaddr;
1091         usbi_dbg("busnum %u devaddr %u session_id %lu", busnum, devaddr, session_id);
1092
1093         dev = usbi_get_device_by_session_id(ctx, session_id);
1094         if (dev) {
1095                 /* device already exists in the context */
1096                 usbi_dbg("session_id %lu already exists", session_id);
1097                 libusb_unref_device(dev);
1098                 return LIBUSB_SUCCESS;
1099         }
1100
1101         usbi_dbg("allocating new device for %u/%u (session %lu)",
1102                  busnum, devaddr, session_id);
1103         dev = usbi_alloc_device(ctx, session_id);
1104         if (!dev)
1105                 return LIBUSB_ERROR_NO_MEM;
1106
1107         r = initialize_device(dev, busnum, devaddr, sysfs_dir, -1);
1108         if (r < 0)
1109                 goto out;
1110         r = usbi_sanitize_device(dev);
1111         if (r < 0)
1112                 goto out;
1113
1114         r = linux_get_parent_info(dev, sysfs_dir);
1115         if (r < 0)
1116                 goto out;
1117 out:
1118         if (r < 0)
1119                 libusb_unref_device(dev);
1120         else
1121                 usbi_connect_device(dev);
1122
1123         return r;
1124 }
1125
1126 void linux_hotplug_enumerate(uint8_t busnum, uint8_t devaddr, const char *sys_name)
1127 {
1128         struct libusb_context *ctx;
1129
1130         usbi_mutex_static_lock(&active_contexts_lock);
1131         for_each_context(ctx) {
1132                 linux_enumerate_device(ctx, busnum, devaddr, sys_name);
1133         }
1134         usbi_mutex_static_unlock(&active_contexts_lock);
1135 }
1136
1137 void linux_device_disconnected(uint8_t busnum, uint8_t devaddr)
1138 {
1139         struct libusb_context *ctx;
1140         struct libusb_device *dev;
1141         unsigned long session_id = busnum << 8 | devaddr;
1142
1143         usbi_mutex_static_lock(&active_contexts_lock);
1144         for_each_context(ctx) {
1145                 dev = usbi_get_device_by_session_id(ctx, session_id);
1146                 if (dev) {
1147                         usbi_disconnect_device(dev);
1148                         libusb_unref_device(dev);
1149                 } else {
1150                         usbi_dbg("device not found for session %lx", session_id);
1151                 }
1152         }
1153         usbi_mutex_static_unlock(&active_contexts_lock);
1154 }
1155
1156 #if !defined(HAVE_LIBUDEV)
1157 static int parse_u8(const char *str, uint8_t *val_p)
1158 {
1159         char *endptr;
1160         long num;
1161
1162         errno = 0;
1163         num = strtol(str, &endptr, 10);
1164         if (num < 0 || num > UINT8_MAX || errno)
1165                 return 0;
1166         if (endptr == str || *endptr != '\0')
1167                 return 0;
1168
1169         *val_p = (uint8_t)num;
1170         return 1;
1171 }
1172
1173 /* open a bus directory and adds all discovered devices to the context */
1174 static int usbfs_scan_busdir(struct libusb_context *ctx, uint8_t busnum)
1175 {
1176         DIR *dir;
1177         char dirpath[20];
1178         struct dirent *entry;
1179         int r = LIBUSB_ERROR_IO;
1180
1181         sprintf(dirpath, USB_DEVTMPFS_PATH "/%03u", busnum);
1182         usbi_dbg("%s", dirpath);
1183         dir = opendir(dirpath);
1184         if (!dir) {
1185                 usbi_err(ctx, "opendir '%s' failed, errno=%d", dirpath, errno);
1186                 /* FIXME: should handle valid race conditions like hub unplugged
1187                  * during directory iteration - this is not an error */
1188                 return r;
1189         }
1190
1191         while ((entry = readdir(dir))) {
1192                 uint8_t devaddr;
1193
1194                 if (entry->d_name[0] == '.')
1195                         continue;
1196
1197                 if (!parse_u8(entry->d_name, &devaddr)) {
1198                         usbi_dbg("unknown dir entry %s", entry->d_name);
1199                         continue;
1200                 }
1201
1202                 if (linux_enumerate_device(ctx, busnum, devaddr, NULL)) {
1203                         usbi_dbg("failed to enumerate dir entry %s", entry->d_name);
1204                         continue;
1205                 }
1206
1207                 r = 0;
1208         }
1209
1210         closedir(dir);
1211         return r;
1212 }
1213
1214 static int usbfs_get_device_list(struct libusb_context *ctx)
1215 {
1216         struct dirent *entry;
1217         DIR *buses;
1218         uint8_t busnum, devaddr;
1219         int r = 0;
1220
1221         if (usbdev_names)
1222                 buses = opendir(USBDEV_PATH);
1223         else
1224                 buses = opendir(USB_DEVTMPFS_PATH);
1225
1226         if (!buses) {
1227                 usbi_err(ctx, "opendir buses failed, errno=%d", errno);
1228                 return LIBUSB_ERROR_IO;
1229         }
1230
1231         while ((entry = readdir(buses))) {
1232                 if (entry->d_name[0] == '.')
1233                         continue;
1234
1235                 if (usbdev_names) {
1236                         if (!is_usbdev_entry(entry->d_name, &busnum, &devaddr))
1237                                 continue;
1238
1239                         r = linux_enumerate_device(ctx, busnum, devaddr, NULL);
1240                         if (r < 0) {
1241                                 usbi_dbg("failed to enumerate dir entry %s", entry->d_name);
1242                                 continue;
1243                         }
1244                 } else {
1245                         if (!parse_u8(entry->d_name, &busnum)) {
1246                                 usbi_dbg("unknown dir entry %s", entry->d_name);
1247                                 continue;
1248                         }
1249
1250                         r = usbfs_scan_busdir(ctx, busnum);
1251                         if (r < 0)
1252                                 break;
1253                 }
1254         }
1255
1256         closedir(buses);
1257         return r;
1258
1259 }
1260
1261 static int sysfs_get_device_list(struct libusb_context *ctx)
1262 {
1263         DIR *devices = opendir(SYSFS_DEVICE_PATH);
1264         struct dirent *entry;
1265         int num_devices = 0;
1266         int num_enumerated = 0;
1267
1268         if (!devices) {
1269                 usbi_err(ctx, "opendir devices failed, errno=%d", errno);
1270                 return LIBUSB_ERROR_IO;
1271         }
1272
1273         while ((entry = readdir(devices))) {
1274                 if ((!isdigit(entry->d_name[0]) && strncmp(entry->d_name, "usb", 3))
1275                     || strchr(entry->d_name, ':'))
1276                         continue;
1277
1278                 num_devices++;
1279
1280                 if (sysfs_scan_device(ctx, entry->d_name)) {
1281                         usbi_dbg("failed to enumerate dir entry %s", entry->d_name);
1282                         continue;
1283                 }
1284
1285                 num_enumerated++;
1286         }
1287
1288         closedir(devices);
1289
1290         /* successful if at least one device was enumerated or no devices were found */
1291         if (num_enumerated || !num_devices)
1292                 return LIBUSB_SUCCESS;
1293         else
1294                 return LIBUSB_ERROR_IO;
1295 }
1296
1297 static int linux_default_scan_devices(struct libusb_context *ctx)
1298 {
1299         /* we can retrieve device list and descriptors from sysfs or usbfs.
1300          * sysfs is preferable, because if we use usbfs we end up resuming
1301          * any autosuspended USB devices. however, sysfs is not available
1302          * everywhere, so we need a usbfs fallback too.
1303          */
1304         if (sysfs_available)
1305                 return sysfs_get_device_list(ctx);
1306         else
1307                 return usbfs_get_device_list(ctx);
1308 }
1309 #endif
1310
1311 static int initialize_handle(struct libusb_device_handle *handle, int fd)
1312 {
1313         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1314         int r;
1315
1316         hpriv->fd = fd;
1317
1318         r = ioctl(fd, IOCTL_USBFS_GET_CAPABILITIES, &hpriv->caps);
1319         if (r < 0) {
1320                 if (errno == ENOTTY)
1321                         usbi_dbg("getcap not available");
1322                 else
1323                         usbi_err(HANDLE_CTX(handle), "getcap failed, errno=%d", errno);
1324                 hpriv->caps = USBFS_CAP_BULK_CONTINUATION;
1325         }
1326
1327         return usbi_add_event_source(HANDLE_CTX(handle), hpriv->fd, POLLOUT);
1328 }
1329
1330 static int op_wrap_sys_device(struct libusb_context *ctx,
1331         struct libusb_device_handle *handle, intptr_t sys_dev)
1332 {
1333         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1334         int fd = (int)sys_dev;
1335         uint8_t busnum, devaddr;
1336         struct usbfs_connectinfo ci;
1337         struct libusb_device *dev;
1338         int r;
1339
1340         r = linux_get_device_address(ctx, 1, &busnum, &devaddr, NULL, NULL, fd);
1341         if (r < 0) {
1342                 r = ioctl(fd, IOCTL_USBFS_CONNECTINFO, &ci);
1343                 if (r < 0) {
1344                         usbi_err(ctx, "connectinfo failed, errno=%d", errno);
1345                         return LIBUSB_ERROR_IO;
1346                 }
1347                 /* There is no ioctl to get the bus number. We choose 0 here
1348                  * as linux starts numbering buses from 1. */
1349                 busnum = 0;
1350                 devaddr = ci.devnum;
1351         }
1352
1353         /* Session id is unused as we do not add the device to the list of
1354          * connected devices. */
1355         usbi_dbg("allocating new device for fd %d", fd);
1356         dev = usbi_alloc_device(ctx, 0);
1357         if (!dev)
1358                 return LIBUSB_ERROR_NO_MEM;
1359
1360         r = initialize_device(dev, busnum, devaddr, NULL, fd);
1361         if (r < 0)
1362                 goto out;
1363         r = usbi_sanitize_device(dev);
1364         if (r < 0)
1365                 goto out;
1366         /* Consider the device as connected, but do not add it to the managed
1367          * device list. */
1368         usbi_atomic_store(&dev->attached, 1);
1369         handle->dev = dev;
1370
1371         r = initialize_handle(handle, fd);
1372         hpriv->fd_keep = 1;
1373
1374 out:
1375         if (r < 0)
1376                 libusb_unref_device(dev);
1377         return r;
1378 }
1379
1380 static int op_open(struct libusb_device_handle *handle)
1381 {
1382         int fd, r;
1383
1384         fd = get_usbfs_fd(handle->dev, O_RDWR, 0);
1385         if (fd < 0) {
1386                 if (fd == LIBUSB_ERROR_NO_DEVICE) {
1387                         /* device will still be marked as attached if hotplug monitor thread
1388                          * hasn't processed remove event yet */
1389                         usbi_mutex_static_lock(&linux_hotplug_lock);
1390                         if (usbi_atomic_load(&handle->dev->attached)) {
1391                                 usbi_dbg("open failed with no device, but device still attached");
1392                                 linux_device_disconnected(handle->dev->bus_number,
1393                                                           handle->dev->device_address);
1394                         }
1395                         usbi_mutex_static_unlock(&linux_hotplug_lock);
1396                 }
1397                 return fd;
1398         }
1399
1400         r = initialize_handle(handle, fd);
1401         if (r < 0)
1402                 close(fd);
1403
1404         return r;
1405 }
1406
1407 static void op_close(struct libusb_device_handle *dev_handle)
1408 {
1409         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(dev_handle);
1410
1411         /* fd may have already been removed by POLLERR condition in op_handle_events() */
1412         if (!hpriv->fd_removed)
1413                 usbi_remove_event_source(HANDLE_CTX(dev_handle), hpriv->fd);
1414         if (!hpriv->fd_keep)
1415                 close(hpriv->fd);
1416 }
1417
1418 static int op_get_configuration(struct libusb_device_handle *handle,
1419         uint8_t *config)
1420 {
1421         struct linux_device_priv *priv = usbi_get_device_priv(handle->dev);
1422         int r;
1423
1424         if (priv->sysfs_dir) {
1425                 r = sysfs_get_active_config(handle->dev, config);
1426         } else {
1427                 struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1428
1429                 r = usbfs_get_active_config(handle->dev, hpriv->fd);
1430                 if (r == LIBUSB_SUCCESS)
1431                         *config = priv->active_config;
1432         }
1433         if (r < 0)
1434                 return r;
1435
1436         if (*config == 0)
1437                 usbi_err(HANDLE_CTX(handle), "device unconfigured");
1438
1439         return 0;
1440 }
1441
1442 static int op_set_configuration(struct libusb_device_handle *handle, int config)
1443 {
1444         struct linux_device_priv *priv = usbi_get_device_priv(handle->dev);
1445         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1446         int fd = hpriv->fd;
1447         int r = ioctl(fd, IOCTL_USBFS_SETCONFIGURATION, &config);
1448
1449         if (r < 0) {
1450                 if (errno == EINVAL)
1451                         return LIBUSB_ERROR_NOT_FOUND;
1452                 else if (errno == EBUSY)
1453                         return LIBUSB_ERROR_BUSY;
1454                 else if (errno == ENODEV)
1455                         return LIBUSB_ERROR_NO_DEVICE;
1456
1457                 usbi_err(HANDLE_CTX(handle), "set configuration failed, errno=%d", errno);
1458                 return LIBUSB_ERROR_OTHER;
1459         }
1460
1461         if (config == -1)
1462                 config = 0;
1463
1464         /* update our cached active config descriptor */
1465         priv->active_config = (uint8_t)config;
1466
1467         return LIBUSB_SUCCESS;
1468 }
1469
1470 static int claim_interface(struct libusb_device_handle *handle, unsigned int iface)
1471 {
1472         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1473         int fd = hpriv->fd;
1474         int r = ioctl(fd, IOCTL_USBFS_CLAIMINTERFACE, &iface);
1475
1476         if (r < 0) {
1477                 if (errno == ENOENT)
1478                         return LIBUSB_ERROR_NOT_FOUND;
1479                 else if (errno == EBUSY)
1480                         return LIBUSB_ERROR_BUSY;
1481                 else if (errno == ENODEV)
1482                         return LIBUSB_ERROR_NO_DEVICE;
1483
1484                 usbi_err(HANDLE_CTX(handle), "claim interface failed, errno=%d", errno);
1485                 return LIBUSB_ERROR_OTHER;
1486         }
1487         return 0;
1488 }
1489
1490 static int release_interface(struct libusb_device_handle *handle, unsigned int iface)
1491 {
1492         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1493         int fd = hpriv->fd;
1494         int r = ioctl(fd, IOCTL_USBFS_RELEASEINTERFACE, &iface);
1495
1496         if (r < 0) {
1497                 if (errno == ENODEV)
1498                         return LIBUSB_ERROR_NO_DEVICE;
1499
1500                 usbi_err(HANDLE_CTX(handle), "release interface failed, errno=%d", errno);
1501                 return LIBUSB_ERROR_OTHER;
1502         }
1503         return 0;
1504 }
1505
1506 static int op_set_interface(struct libusb_device_handle *handle, uint8_t interface,
1507         uint8_t altsetting)
1508 {
1509         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1510         int fd = hpriv->fd;
1511         struct usbfs_setinterface setintf;
1512         int r;
1513
1514         setintf.interface = interface;
1515         setintf.altsetting = altsetting;
1516         r = ioctl(fd, IOCTL_USBFS_SETINTERFACE, &setintf);
1517         if (r < 0) {
1518                 if (errno == EINVAL)
1519                         return LIBUSB_ERROR_NOT_FOUND;
1520                 else if (errno == ENODEV)
1521                         return LIBUSB_ERROR_NO_DEVICE;
1522
1523                 usbi_err(HANDLE_CTX(handle), "set interface failed, errno=%d", errno);
1524                 return LIBUSB_ERROR_OTHER;
1525         }
1526
1527         return 0;
1528 }
1529
1530 static int op_clear_halt(struct libusb_device_handle *handle,
1531         unsigned char endpoint)
1532 {
1533         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1534         int fd = hpriv->fd;
1535         unsigned int _endpoint = endpoint;
1536         int r = ioctl(fd, IOCTL_USBFS_CLEAR_HALT, &_endpoint);
1537
1538         if (r < 0) {
1539                 if (errno == ENOENT)
1540                         return LIBUSB_ERROR_NOT_FOUND;
1541                 else if (errno == ENODEV)
1542                         return LIBUSB_ERROR_NO_DEVICE;
1543
1544                 usbi_err(HANDLE_CTX(handle), "clear halt failed, errno=%d", errno);
1545                 return LIBUSB_ERROR_OTHER;
1546         }
1547
1548         return 0;
1549 }
1550
1551 static int op_reset_device(struct libusb_device_handle *handle)
1552 {
1553         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1554         int fd = hpriv->fd;
1555         int r, ret = 0;
1556         uint8_t i;
1557
1558         /* Doing a device reset will cause the usbfs driver to get unbound
1559          * from any interfaces it is bound to. By voluntarily unbinding
1560          * the usbfs driver ourself, we stop the kernel from rebinding
1561          * the interface after reset (which would end up with the interface
1562          * getting bound to the in kernel driver if any). */
1563         for (i = 0; i < USB_MAXINTERFACES; i++) {
1564                 if (handle->claimed_interfaces & (1UL << i))
1565                         release_interface(handle, i);
1566         }
1567
1568         usbi_mutex_lock(&handle->lock);
1569         r = ioctl(fd, IOCTL_USBFS_RESET, NULL);
1570         if (r < 0) {
1571                 if (errno == ENODEV) {
1572                         ret = LIBUSB_ERROR_NOT_FOUND;
1573                         goto out;
1574                 }
1575
1576                 usbi_err(HANDLE_CTX(handle), "reset failed, errno=%d", errno);
1577                 ret = LIBUSB_ERROR_OTHER;
1578                 goto out;
1579         }
1580
1581         /* And re-claim any interfaces which were claimed before the reset */
1582         for (i = 0; i < USB_MAXINTERFACES; i++) {
1583                 if (!(handle->claimed_interfaces & (1UL << i)))
1584                         continue;
1585                 /*
1586                  * A driver may have completed modprobing during
1587                  * IOCTL_USBFS_RESET, and bound itself as soon as
1588                  * IOCTL_USBFS_RESET released the device lock
1589                  */
1590                 r = detach_kernel_driver_and_claim(handle, i);
1591                 if (r) {
1592                         usbi_warn(HANDLE_CTX(handle), "failed to re-claim interface %u after reset: %s",
1593                                   i, libusb_error_name(r));
1594                         handle->claimed_interfaces &= ~(1UL << i);
1595                         ret = LIBUSB_ERROR_NOT_FOUND;
1596                 }
1597         }
1598 out:
1599         usbi_mutex_unlock(&handle->lock);
1600         return ret;
1601 }
1602
1603 static int do_streams_ioctl(struct libusb_device_handle *handle, long req,
1604         uint32_t num_streams, unsigned char *endpoints, int num_endpoints)
1605 {
1606         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1607         int r, fd = hpriv->fd;
1608         struct usbfs_streams *streams;
1609
1610         if (num_endpoints > 30) /* Max 15 in + 15 out eps */
1611                 return LIBUSB_ERROR_INVALID_PARAM;
1612
1613         streams = malloc(sizeof(*streams) + num_endpoints);
1614         if (!streams)
1615                 return LIBUSB_ERROR_NO_MEM;
1616
1617         streams->num_streams = num_streams;
1618         streams->num_eps = num_endpoints;
1619         memcpy(streams->eps, endpoints, num_endpoints);
1620
1621         r = ioctl(fd, req, streams);
1622
1623         free(streams);
1624
1625         if (r < 0) {
1626                 if (errno == ENOTTY)
1627                         return LIBUSB_ERROR_NOT_SUPPORTED;
1628                 else if (errno == EINVAL)
1629                         return LIBUSB_ERROR_INVALID_PARAM;
1630                 else if (errno == ENODEV)
1631                         return LIBUSB_ERROR_NO_DEVICE;
1632
1633                 usbi_err(HANDLE_CTX(handle), "streams-ioctl failed, errno=%d", errno);
1634                 return LIBUSB_ERROR_OTHER;
1635         }
1636         return r;
1637 }
1638
1639 static int op_alloc_streams(struct libusb_device_handle *handle,
1640         uint32_t num_streams, unsigned char *endpoints, int num_endpoints)
1641 {
1642         return do_streams_ioctl(handle, IOCTL_USBFS_ALLOC_STREAMS,
1643                                 num_streams, endpoints, num_endpoints);
1644 }
1645
1646 static int op_free_streams(struct libusb_device_handle *handle,
1647                 unsigned char *endpoints, int num_endpoints)
1648 {
1649         return do_streams_ioctl(handle, IOCTL_USBFS_FREE_STREAMS, 0,
1650                                 endpoints, num_endpoints);
1651 }
1652
1653 static void *op_dev_mem_alloc(struct libusb_device_handle *handle, size_t len)
1654 {
1655         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1656         void *buffer;
1657
1658         buffer = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, hpriv->fd, 0);
1659         if (buffer == MAP_FAILED) {
1660                 usbi_err(HANDLE_CTX(handle), "alloc dev mem failed, errno=%d", errno);
1661                 return NULL;
1662         }
1663         return buffer;
1664 }
1665
1666 static int op_dev_mem_free(struct libusb_device_handle *handle, void *buffer,
1667         size_t len)
1668 {
1669         if (munmap(buffer, len) != 0) {
1670                 usbi_err(HANDLE_CTX(handle), "free dev mem failed, errno=%d", errno);
1671                 return LIBUSB_ERROR_OTHER;
1672         } else {
1673                 return LIBUSB_SUCCESS;
1674         }
1675 }
1676
1677 static int op_kernel_driver_active(struct libusb_device_handle *handle,
1678         uint8_t interface)
1679 {
1680         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1681         int fd = hpriv->fd;
1682         struct usbfs_getdriver getdrv;
1683         int r;
1684
1685         getdrv.interface = interface;
1686         r = ioctl(fd, IOCTL_USBFS_GETDRIVER, &getdrv);
1687         if (r < 0) {
1688                 if (errno == ENODATA)
1689                         return 0;
1690                 else if (errno == ENODEV)
1691                         return LIBUSB_ERROR_NO_DEVICE;
1692
1693                 usbi_err(HANDLE_CTX(handle), "get driver failed, errno=%d", errno);
1694                 return LIBUSB_ERROR_OTHER;
1695         }
1696
1697         return strcmp(getdrv.driver, "usbfs") != 0;
1698 }
1699
1700 static int op_detach_kernel_driver(struct libusb_device_handle *handle,
1701         uint8_t interface)
1702 {
1703         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1704         int fd = hpriv->fd;
1705         struct usbfs_ioctl command;
1706         struct usbfs_getdriver getdrv;
1707         int r;
1708
1709         command.ifno = interface;
1710         command.ioctl_code = IOCTL_USBFS_DISCONNECT;
1711         command.data = NULL;
1712
1713         getdrv.interface = interface;
1714         r = ioctl(fd, IOCTL_USBFS_GETDRIVER, &getdrv);
1715         if (r == 0 && !strcmp(getdrv.driver, "usbfs"))
1716                 return LIBUSB_ERROR_NOT_FOUND;
1717
1718         r = ioctl(fd, IOCTL_USBFS_IOCTL, &command);
1719         if (r < 0) {
1720                 if (errno == ENODATA)
1721                         return LIBUSB_ERROR_NOT_FOUND;
1722                 else if (errno == EINVAL)
1723                         return LIBUSB_ERROR_INVALID_PARAM;
1724                 else if (errno == ENODEV)
1725                         return LIBUSB_ERROR_NO_DEVICE;
1726
1727                 usbi_err(HANDLE_CTX(handle), "detach failed, errno=%d", errno);
1728                 return LIBUSB_ERROR_OTHER;
1729         }
1730
1731         return 0;
1732 }
1733
1734 static int op_attach_kernel_driver(struct libusb_device_handle *handle,
1735         uint8_t interface)
1736 {
1737         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1738         int fd = hpriv->fd;
1739         struct usbfs_ioctl command;
1740         int r;
1741
1742         command.ifno = interface;
1743         command.ioctl_code = IOCTL_USBFS_CONNECT;
1744         command.data = NULL;
1745
1746         r = ioctl(fd, IOCTL_USBFS_IOCTL, &command);
1747         if (r < 0) {
1748                 if (errno == ENODATA)
1749                         return LIBUSB_ERROR_NOT_FOUND;
1750                 else if (errno == EINVAL)
1751                         return LIBUSB_ERROR_INVALID_PARAM;
1752                 else if (errno == ENODEV)
1753                         return LIBUSB_ERROR_NO_DEVICE;
1754                 else if (errno == EBUSY)
1755                         return LIBUSB_ERROR_BUSY;
1756
1757                 usbi_err(HANDLE_CTX(handle), "attach failed, errno=%d", errno);
1758                 return LIBUSB_ERROR_OTHER;
1759         } else if (r == 0) {
1760                 return LIBUSB_ERROR_NOT_FOUND;
1761         }
1762
1763         return 0;
1764 }
1765
1766 static int detach_kernel_driver_and_claim(struct libusb_device_handle *handle,
1767         uint8_t interface)
1768 {
1769         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1770         struct usbfs_disconnect_claim dc;
1771         int r, fd = hpriv->fd;
1772
1773         dc.interface = interface;
1774         strcpy(dc.driver, "usbfs");
1775         dc.flags = USBFS_DISCONNECT_CLAIM_EXCEPT_DRIVER;
1776         r = ioctl(fd, IOCTL_USBFS_DISCONNECT_CLAIM, &dc);
1777         if (r == 0)
1778                 return 0;
1779         switch (errno) {
1780         case ENOTTY:
1781                 break;
1782         case EBUSY:
1783                 return LIBUSB_ERROR_BUSY;
1784         case EINVAL:
1785                 return LIBUSB_ERROR_INVALID_PARAM;
1786         case ENODEV:
1787                 return LIBUSB_ERROR_NO_DEVICE;
1788         default:
1789                 usbi_err(HANDLE_CTX(handle), "disconnect-and-claim failed, errno=%d", errno);
1790                 return LIBUSB_ERROR_OTHER;
1791         }
1792
1793         /* Fallback code for kernels which don't support the
1794            disconnect-and-claim ioctl */
1795         r = op_detach_kernel_driver(handle, interface);
1796         if (r != 0 && r != LIBUSB_ERROR_NOT_FOUND)
1797                 return r;
1798
1799         return claim_interface(handle, interface);
1800 }
1801
1802 static int op_claim_interface(struct libusb_device_handle *handle, uint8_t interface)
1803 {
1804         if (handle->auto_detach_kernel_driver)
1805                 return detach_kernel_driver_and_claim(handle, interface);
1806         else
1807                 return claim_interface(handle, interface);
1808 }
1809
1810 static int op_release_interface(struct libusb_device_handle *handle, uint8_t interface)
1811 {
1812         int r;
1813
1814         r = release_interface(handle, interface);
1815         if (r)
1816                 return r;
1817
1818         if (handle->auto_detach_kernel_driver)
1819                 op_attach_kernel_driver(handle, interface);
1820
1821         return 0;
1822 }
1823
1824 static void op_destroy_device(struct libusb_device *dev)
1825 {
1826         struct linux_device_priv *priv = usbi_get_device_priv(dev);
1827
1828         free(priv->config_descriptors);
1829         free(priv->descriptors);
1830         free(priv->sysfs_dir);
1831 }
1832
1833 /* URBs are discarded in reverse order of submission to avoid races. */
1834 static int discard_urbs(struct usbi_transfer *itransfer, int first, int last_plus_one)
1835 {
1836         struct libusb_transfer *transfer =
1837                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
1838         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
1839         struct linux_device_handle_priv *hpriv =
1840                 usbi_get_device_handle_priv(transfer->dev_handle);
1841         int i, ret = 0;
1842         struct usbfs_urb *urb;
1843
1844         for (i = last_plus_one - 1; i >= first; i--) {
1845                 if (transfer->type == LIBUSB_TRANSFER_TYPE_ISOCHRONOUS)
1846                         urb = tpriv->iso_urbs[i];
1847                 else
1848                         urb = &tpriv->urbs[i];
1849
1850                 if (ioctl(hpriv->fd, IOCTL_USBFS_DISCARDURB, urb) == 0)
1851                         continue;
1852
1853                 if (errno == EINVAL) {
1854                         usbi_dbg("URB not found --> assuming ready to be reaped");
1855                         if (i == (last_plus_one - 1))
1856                                 ret = LIBUSB_ERROR_NOT_FOUND;
1857                 } else if (errno == ENODEV) {
1858                         usbi_dbg("Device not found for URB --> assuming ready to be reaped");
1859                         ret = LIBUSB_ERROR_NO_DEVICE;
1860                 } else {
1861                         usbi_warn(TRANSFER_CTX(transfer), "unrecognised discard errno %d", errno);
1862                         ret = LIBUSB_ERROR_OTHER;
1863                 }
1864         }
1865         return ret;
1866 }
1867
1868 static void free_iso_urbs(struct linux_transfer_priv *tpriv)
1869 {
1870         int i;
1871
1872         for (i = 0; i < tpriv->num_urbs; i++) {
1873                 struct usbfs_urb *urb = tpriv->iso_urbs[i];
1874
1875                 if (!urb)
1876                         break;
1877                 free(urb);
1878         }
1879
1880         free(tpriv->iso_urbs);
1881         tpriv->iso_urbs = NULL;
1882 }
1883
1884 static int submit_bulk_transfer(struct usbi_transfer *itransfer)
1885 {
1886         struct libusb_transfer *transfer =
1887                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
1888         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
1889         struct linux_device_handle_priv *hpriv =
1890                 usbi_get_device_handle_priv(transfer->dev_handle);
1891         struct usbfs_urb *urbs;
1892         int is_out = IS_XFEROUT(transfer);
1893         int bulk_buffer_len, use_bulk_continuation;
1894         int num_urbs;
1895         int last_urb_partial = 0;
1896         int r;
1897         int i;
1898
1899         /*
1900          * Older versions of usbfs place a 16kb limit on bulk URBs. We work
1901          * around this by splitting large transfers into 16k blocks, and then
1902          * submit all urbs at once. it would be simpler to submit one urb at
1903          * a time, but there is a big performance gain doing it this way.
1904          *
1905          * Newer versions lift the 16k limit (USBFS_CAP_NO_PACKET_SIZE_LIM),
1906          * using arbitrary large transfers can still be a bad idea though, as
1907          * the kernel needs to allocate physical contiguous memory for this,
1908          * which may fail for large buffers.
1909          *
1910          * The kernel solves this problem by splitting the transfer into
1911          * blocks itself when the host-controller is scatter-gather capable
1912          * (USBFS_CAP_BULK_SCATTER_GATHER), which most controllers are.
1913          *
1914          * Last, there is the issue of short-transfers when splitting, for
1915          * short split-transfers to work reliable USBFS_CAP_BULK_CONTINUATION
1916          * is needed, but this is not always available.
1917          */
1918         if (hpriv->caps & USBFS_CAP_BULK_SCATTER_GATHER) {
1919                 /* Good! Just submit everything in one go */
1920                 bulk_buffer_len = transfer->length ? transfer->length : 1;
1921                 use_bulk_continuation = 0;
1922         } else if (hpriv->caps & USBFS_CAP_BULK_CONTINUATION) {
1923                 /* Split the transfers and use bulk-continuation to
1924                    avoid issues with short-transfers */
1925                 bulk_buffer_len = MAX_BULK_BUFFER_LENGTH;
1926                 use_bulk_continuation = 1;
1927         } else if (hpriv->caps & USBFS_CAP_NO_PACKET_SIZE_LIM) {
1928                 /* Don't split, assume the kernel can alloc the buffer
1929                    (otherwise the submit will fail with -ENOMEM) */
1930                 bulk_buffer_len = transfer->length ? transfer->length : 1;
1931                 use_bulk_continuation = 0;
1932         } else {
1933                 /* Bad, splitting without bulk-continuation, short transfers
1934                    which end before the last urb will not work reliable! */
1935                 /* Note we don't warn here as this is "normal" on kernels <
1936                    2.6.32 and not a problem for most applications */
1937                 bulk_buffer_len = MAX_BULK_BUFFER_LENGTH;
1938                 use_bulk_continuation = 0;
1939         }
1940
1941         num_urbs = transfer->length / bulk_buffer_len;
1942
1943         if (transfer->length == 0) {
1944                 num_urbs = 1;
1945         } else if ((transfer->length % bulk_buffer_len) > 0) {
1946                 last_urb_partial = 1;
1947                 num_urbs++;
1948         }
1949         usbi_dbg("need %d urbs for new transfer with length %d", num_urbs, transfer->length);
1950         urbs = calloc(num_urbs, sizeof(*urbs));
1951         if (!urbs)
1952                 return LIBUSB_ERROR_NO_MEM;
1953         tpriv->urbs = urbs;
1954         tpriv->num_urbs = num_urbs;
1955         tpriv->num_retired = 0;
1956         tpriv->reap_action = NORMAL;
1957         tpriv->reap_status = LIBUSB_TRANSFER_COMPLETED;
1958
1959         for (i = 0; i < num_urbs; i++) {
1960                 struct usbfs_urb *urb = &urbs[i];
1961
1962                 urb->usercontext = itransfer;
1963                 switch (transfer->type) {
1964                 case LIBUSB_TRANSFER_TYPE_BULK:
1965                         urb->type = USBFS_URB_TYPE_BULK;
1966                         urb->stream_id = 0;
1967                         break;
1968                 case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
1969                         urb->type = USBFS_URB_TYPE_BULK;
1970                         urb->stream_id = itransfer->stream_id;
1971                         break;
1972                 case LIBUSB_TRANSFER_TYPE_INTERRUPT:
1973                         urb->type = USBFS_URB_TYPE_INTERRUPT;
1974                         break;
1975                 }
1976                 urb->endpoint = transfer->endpoint;
1977                 urb->buffer = transfer->buffer + (i * bulk_buffer_len);
1978
1979                 /* don't set the short not ok flag for the last URB */
1980                 if (use_bulk_continuation && !is_out && (i < num_urbs - 1))
1981                         urb->flags = USBFS_URB_SHORT_NOT_OK;
1982
1983                 if (i == num_urbs - 1 && last_urb_partial)
1984                         urb->buffer_length = transfer->length % bulk_buffer_len;
1985                 else if (transfer->length == 0)
1986                         urb->buffer_length = 0;
1987                 else
1988                         urb->buffer_length = bulk_buffer_len;
1989
1990                 if (i > 0 && use_bulk_continuation)
1991                         urb->flags |= USBFS_URB_BULK_CONTINUATION;
1992
1993                 /* we have already checked that the flag is supported */
1994                 if (is_out && i == num_urbs - 1 &&
1995                     (transfer->flags & LIBUSB_TRANSFER_ADD_ZERO_PACKET))
1996                         urb->flags |= USBFS_URB_ZERO_PACKET;
1997
1998                 r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urb);
1999                 if (r == 0)
2000                         continue;
2001
2002                 if (errno == ENODEV) {
2003                         r = LIBUSB_ERROR_NO_DEVICE;
2004                 } else if (errno == ENOMEM) {
2005                         r = LIBUSB_ERROR_NO_MEM;
2006                 } else {
2007                         usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
2008                         r = LIBUSB_ERROR_IO;
2009                 }
2010
2011                 /* if the first URB submission fails, we can simply free up and
2012                  * return failure immediately. */
2013                 if (i == 0) {
2014                         usbi_dbg("first URB failed, easy peasy");
2015                         free(urbs);
2016                         tpriv->urbs = NULL;
2017                         return r;
2018                 }
2019
2020                 /* if it's not the first URB that failed, the situation is a bit
2021                  * tricky. we may need to discard all previous URBs. there are
2022                  * complications:
2023                  *  - discarding is asynchronous - discarded urbs will be reaped
2024                  *    later. the user must not have freed the transfer when the
2025                  *    discarded URBs are reaped, otherwise libusb will be using
2026                  *    freed memory.
2027                  *  - the earlier URBs may have completed successfully and we do
2028                  *    not want to throw away any data.
2029                  *  - this URB failing may be no error; EREMOTEIO means that
2030                  *    this transfer simply didn't need all the URBs we submitted
2031                  * so, we report that the transfer was submitted successfully and
2032                  * in case of error we discard all previous URBs. later when
2033                  * the final reap completes we can report error to the user,
2034                  * or success if an earlier URB was completed successfully.
2035                  */
2036                 tpriv->reap_action = errno == EREMOTEIO ? COMPLETED_EARLY : SUBMIT_FAILED;
2037
2038                 /* The URBs we haven't submitted yet we count as already
2039                  * retired. */
2040                 tpriv->num_retired += num_urbs - i;
2041
2042                 /* If we completed short then don't try to discard. */
2043                 if (tpriv->reap_action == COMPLETED_EARLY)
2044                         return 0;
2045
2046                 discard_urbs(itransfer, 0, i);
2047
2048                 usbi_dbg("reporting successful submission but waiting for %d "
2049                          "discards before reporting error", i);
2050                 return 0;
2051         }
2052
2053         return 0;
2054 }
2055
2056 static int submit_iso_transfer(struct usbi_transfer *itransfer)
2057 {
2058         struct libusb_transfer *transfer =
2059                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2060         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2061         struct linux_device_handle_priv *hpriv =
2062                 usbi_get_device_handle_priv(transfer->dev_handle);
2063         struct usbfs_urb **urbs;
2064         int num_packets = transfer->num_iso_packets;
2065         int num_packets_remaining;
2066         int i, j;
2067         int num_urbs;
2068         unsigned int packet_len;
2069         unsigned int total_len = 0;
2070         unsigned char *urb_buffer = transfer->buffer;
2071
2072         if (num_packets < 1)
2073                 return LIBUSB_ERROR_INVALID_PARAM;
2074
2075         /* usbfs places arbitrary limits on iso URBs. this limit has changed
2076          * at least three times, but we attempt to detect this limit during
2077          * init and check it here. if the kernel rejects the request due to
2078          * its size, we return an error indicating such to the user.
2079          */
2080         for (i = 0; i < num_packets; i++) {
2081                 packet_len = transfer->iso_packet_desc[i].length;
2082
2083                 if (packet_len > max_iso_packet_len) {
2084                         usbi_warn(TRANSFER_CTX(transfer),
2085                                   "iso packet length of %u bytes exceeds maximum of %u bytes",
2086                                   packet_len, max_iso_packet_len);
2087                         return LIBUSB_ERROR_INVALID_PARAM;
2088                 }
2089
2090                 total_len += packet_len;
2091         }
2092
2093         if (transfer->length < (int)total_len)
2094                 return LIBUSB_ERROR_INVALID_PARAM;
2095
2096         /* usbfs limits the number of iso packets per URB */
2097         num_urbs = (num_packets + (MAX_ISO_PACKETS_PER_URB - 1)) / MAX_ISO_PACKETS_PER_URB;
2098
2099         usbi_dbg("need %d urbs for new transfer with length %d", num_urbs, transfer->length);
2100
2101         urbs = calloc(num_urbs, sizeof(*urbs));
2102         if (!urbs)
2103                 return LIBUSB_ERROR_NO_MEM;
2104
2105         tpriv->iso_urbs = urbs;
2106         tpriv->num_urbs = num_urbs;
2107         tpriv->num_retired = 0;
2108         tpriv->reap_action = NORMAL;
2109         tpriv->iso_packet_offset = 0;
2110
2111         /* allocate + initialize each URB with the correct number of packets */
2112         num_packets_remaining = num_packets;
2113         for (i = 0, j = 0; i < num_urbs; i++) {
2114                 int num_packets_in_urb = MIN(num_packets_remaining, MAX_ISO_PACKETS_PER_URB);
2115                 struct usbfs_urb *urb;
2116                 size_t alloc_size;
2117                 int k;
2118
2119                 alloc_size = sizeof(*urb)
2120                         + (num_packets_in_urb * sizeof(struct usbfs_iso_packet_desc));
2121                 urb = calloc(1, alloc_size);
2122                 if (!urb) {
2123                         free_iso_urbs(tpriv);
2124                         return LIBUSB_ERROR_NO_MEM;
2125                 }
2126                 urbs[i] = urb;
2127
2128                 /* populate packet lengths */
2129                 for (k = 0; k < num_packets_in_urb; j++, k++) {
2130                         packet_len = transfer->iso_packet_desc[j].length;
2131                         urb->buffer_length += packet_len;
2132                         urb->iso_frame_desc[k].length = packet_len;
2133                 }
2134
2135                 urb->usercontext = itransfer;
2136                 urb->type = USBFS_URB_TYPE_ISO;
2137                 /* FIXME: interface for non-ASAP data? */
2138                 urb->flags = USBFS_URB_ISO_ASAP;
2139                 urb->endpoint = transfer->endpoint;
2140                 urb->number_of_packets = num_packets_in_urb;
2141                 urb->buffer = urb_buffer;
2142
2143                 urb_buffer += urb->buffer_length;
2144                 num_packets_remaining -= num_packets_in_urb;
2145         }
2146
2147         /* submit URBs */
2148         for (i = 0; i < num_urbs; i++) {
2149                 int r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urbs[i]);
2150
2151                 if (r == 0)
2152                         continue;
2153
2154                 if (errno == ENODEV) {
2155                         r = LIBUSB_ERROR_NO_DEVICE;
2156                 } else if (errno == EINVAL) {
2157                         usbi_warn(TRANSFER_CTX(transfer), "submiturb failed, transfer too large");
2158                         r = LIBUSB_ERROR_INVALID_PARAM;
2159                 } else if (errno == EMSGSIZE) {
2160                         usbi_warn(TRANSFER_CTX(transfer), "submiturb failed, iso packet length too large");
2161                         r = LIBUSB_ERROR_INVALID_PARAM;
2162                 } else {
2163                         usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
2164                         r = LIBUSB_ERROR_IO;
2165                 }
2166
2167                 /* if the first URB submission fails, we can simply free up and
2168                  * return failure immediately. */
2169                 if (i == 0) {
2170                         usbi_dbg("first URB failed, easy peasy");
2171                         free_iso_urbs(tpriv);
2172                         return r;
2173                 }
2174
2175                 /* if it's not the first URB that failed, the situation is a bit
2176                  * tricky. we must discard all previous URBs. there are
2177                  * complications:
2178                  *  - discarding is asynchronous - discarded urbs will be reaped
2179                  *    later. the user must not have freed the transfer when the
2180                  *    discarded URBs are reaped, otherwise libusb will be using
2181                  *    freed memory.
2182                  *  - the earlier URBs may have completed successfully and we do
2183                  *    not want to throw away any data.
2184                  * so, in this case we discard all the previous URBs BUT we report
2185                  * that the transfer was submitted successfully. then later when
2186                  * the final discard completes we can report error to the user.
2187                  */
2188                 tpriv->reap_action = SUBMIT_FAILED;
2189
2190                 /* The URBs we haven't submitted yet we count as already
2191                  * retired. */
2192                 tpriv->num_retired = num_urbs - i;
2193                 discard_urbs(itransfer, 0, i);
2194
2195                 usbi_dbg("reporting successful submission but waiting for %d "
2196                          "discards before reporting error", i);
2197                 return 0;
2198         }
2199
2200         return 0;
2201 }
2202
2203 static int submit_control_transfer(struct usbi_transfer *itransfer)
2204 {
2205         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2206         struct libusb_transfer *transfer =
2207                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2208         struct linux_device_handle_priv *hpriv =
2209                 usbi_get_device_handle_priv(transfer->dev_handle);
2210         struct usbfs_urb *urb;
2211         int r;
2212
2213         if (transfer->length - LIBUSB_CONTROL_SETUP_SIZE > MAX_CTRL_BUFFER_LENGTH)
2214                 return LIBUSB_ERROR_INVALID_PARAM;
2215
2216         urb = calloc(1, sizeof(*urb));
2217         if (!urb)
2218                 return LIBUSB_ERROR_NO_MEM;
2219         tpriv->urbs = urb;
2220         tpriv->num_urbs = 1;
2221         tpriv->reap_action = NORMAL;
2222
2223         urb->usercontext = itransfer;
2224         urb->type = USBFS_URB_TYPE_CONTROL;
2225         urb->endpoint = transfer->endpoint;
2226         urb->buffer = transfer->buffer;
2227         urb->buffer_length = transfer->length;
2228
2229         r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urb);
2230         if (r < 0) {
2231                 free(urb);
2232                 tpriv->urbs = NULL;
2233                 if (errno == ENODEV)
2234                         return LIBUSB_ERROR_NO_DEVICE;
2235
2236                 usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
2237                 return LIBUSB_ERROR_IO;
2238         }
2239         return 0;
2240 }
2241
2242 static int op_submit_transfer(struct usbi_transfer *itransfer)
2243 {
2244         struct libusb_transfer *transfer =
2245                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2246
2247         switch (transfer->type) {
2248         case LIBUSB_TRANSFER_TYPE_CONTROL:
2249                 return submit_control_transfer(itransfer);
2250         case LIBUSB_TRANSFER_TYPE_BULK:
2251         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2252                 return submit_bulk_transfer(itransfer);
2253         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2254                 return submit_bulk_transfer(itransfer);
2255         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2256                 return submit_iso_transfer(itransfer);
2257         default:
2258                 usbi_err(TRANSFER_CTX(transfer), "unknown transfer type %u", transfer->type);
2259                 return LIBUSB_ERROR_INVALID_PARAM;
2260         }
2261 }
2262
2263 static int op_cancel_transfer(struct usbi_transfer *itransfer)
2264 {
2265         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2266         struct libusb_transfer *transfer =
2267                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2268         int r;
2269
2270         if (!tpriv->urbs)
2271                 return LIBUSB_ERROR_NOT_FOUND;
2272
2273         r = discard_urbs(itransfer, 0, tpriv->num_urbs);
2274         if (r != 0)
2275                 return r;
2276
2277         switch (transfer->type) {
2278         case LIBUSB_TRANSFER_TYPE_BULK:
2279         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2280                 if (tpriv->reap_action == ERROR)
2281                         break;
2282                 /* else, fall through */
2283         default:
2284                 tpriv->reap_action = CANCELLED;
2285         }
2286
2287         return 0;
2288 }
2289
2290 static void op_clear_transfer_priv(struct usbi_transfer *itransfer)
2291 {
2292         struct libusb_transfer *transfer =
2293                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2294         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2295
2296         switch (transfer->type) {
2297         case LIBUSB_TRANSFER_TYPE_CONTROL:
2298         case LIBUSB_TRANSFER_TYPE_BULK:
2299         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2300         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2301                 if (tpriv->urbs) {
2302                         free(tpriv->urbs);
2303                         tpriv->urbs = NULL;
2304                 }
2305                 break;
2306         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2307                 if (tpriv->iso_urbs) {
2308                         free_iso_urbs(tpriv);
2309                         tpriv->iso_urbs = NULL;
2310                 }
2311                 break;
2312         default:
2313                 usbi_err(TRANSFER_CTX(transfer), "unknown transfer type %u", transfer->type);
2314         }
2315 }
2316
2317 static int handle_bulk_completion(struct usbi_transfer *itransfer,
2318         struct usbfs_urb *urb)
2319 {
2320         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2321         struct libusb_transfer *transfer = USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2322         int urb_idx = urb - tpriv->urbs;
2323
2324         usbi_mutex_lock(&itransfer->lock);
2325         usbi_dbg("handling completion status %d of bulk urb %d/%d", urb->status,
2326                  urb_idx + 1, tpriv->num_urbs);
2327
2328         tpriv->num_retired++;
2329
2330         if (tpriv->reap_action != NORMAL) {
2331                 /* cancelled, submit_fail, or completed early */
2332                 usbi_dbg("abnormal reap: urb status %d", urb->status);
2333
2334                 /* even though we're in the process of cancelling, it's possible that
2335                  * we may receive some data in these URBs that we don't want to lose.
2336                  * examples:
2337                  * 1. while the kernel is cancelling all the packets that make up an
2338                  *    URB, a few of them might complete. so we get back a successful
2339                  *    cancellation *and* some data.
2340                  * 2. we receive a short URB which marks the early completion condition,
2341                  *    so we start cancelling the remaining URBs. however, we're too
2342                  *    slow and another URB completes (or at least completes partially).
2343                  *    (this can't happen since we always use BULK_CONTINUATION.)
2344                  *
2345                  * When this happens, our objectives are not to lose any "surplus" data,
2346                  * and also to stick it at the end of the previously-received data
2347                  * (closing any holes), so that libusb reports the total amount of
2348                  * transferred data and presents it in a contiguous chunk.
2349                  */
2350                 if (urb->actual_length > 0) {
2351                         unsigned char *target = transfer->buffer + itransfer->transferred;
2352
2353                         usbi_dbg("received %d bytes of surplus data", urb->actual_length);
2354                         if (urb->buffer != target) {
2355                                 usbi_dbg("moving surplus data from offset %zu to offset %zu",
2356                                          (unsigned char *)urb->buffer - transfer->buffer,
2357                                          target - transfer->buffer);
2358                                 memmove(target, urb->buffer, urb->actual_length);
2359                         }
2360                         itransfer->transferred += urb->actual_length;
2361                 }
2362
2363                 if (tpriv->num_retired == tpriv->num_urbs) {
2364                         usbi_dbg("abnormal reap: last URB handled, reporting");
2365                         if (tpriv->reap_action != COMPLETED_EARLY &&
2366                             tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2367                                 tpriv->reap_status = LIBUSB_TRANSFER_ERROR;
2368                         goto completed;
2369                 }
2370                 goto out_unlock;
2371         }
2372
2373         itransfer->transferred += urb->actual_length;
2374
2375         /* Many of these errors can occur on *any* urb of a multi-urb
2376          * transfer.  When they do, we tear down the rest of the transfer.
2377          */
2378         switch (urb->status) {
2379         case 0:
2380                 break;
2381         case -EREMOTEIO: /* short transfer */
2382                 break;
2383         case -ENOENT: /* cancelled */
2384         case -ECONNRESET:
2385                 break;
2386         case -ENODEV:
2387         case -ESHUTDOWN:
2388                 usbi_dbg("device removed");
2389                 tpriv->reap_status = LIBUSB_TRANSFER_NO_DEVICE;
2390                 goto cancel_remaining;
2391         case -EPIPE:
2392                 usbi_dbg("detected endpoint stall");
2393                 if (tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2394                         tpriv->reap_status = LIBUSB_TRANSFER_STALL;
2395                 goto cancel_remaining;
2396         case -EOVERFLOW:
2397                 /* overflow can only ever occur in the last urb */
2398                 usbi_dbg("overflow, actual_length=%d", urb->actual_length);
2399                 if (tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2400                         tpriv->reap_status = LIBUSB_TRANSFER_OVERFLOW;
2401                 goto completed;
2402         case -ETIME:
2403         case -EPROTO:
2404         case -EILSEQ:
2405         case -ECOMM:
2406         case -ENOSR:
2407                 usbi_dbg("low-level bus error %d", urb->status);
2408                 tpriv->reap_action = ERROR;
2409                 goto cancel_remaining;
2410         default:
2411                 usbi_warn(ITRANSFER_CTX(itransfer), "unrecognised urb status %d", urb->status);
2412                 tpriv->reap_action = ERROR;
2413                 goto cancel_remaining;
2414         }
2415
2416         /* if we've reaped all urbs or we got less data than requested then we're
2417          * done */
2418         if (tpriv->num_retired == tpriv->num_urbs) {
2419                 usbi_dbg("all URBs in transfer reaped --> complete!");
2420                 goto completed;
2421         } else if (urb->actual_length < urb->buffer_length) {
2422                 usbi_dbg("short transfer %d/%d --> complete!",
2423                          urb->actual_length, urb->buffer_length);
2424                 if (tpriv->reap_action == NORMAL)
2425                         tpriv->reap_action = COMPLETED_EARLY;
2426         } else {
2427                 goto out_unlock;
2428         }
2429
2430 cancel_remaining:
2431         if (tpriv->reap_action == ERROR && tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2432                 tpriv->reap_status = LIBUSB_TRANSFER_ERROR;
2433
2434         if (tpriv->num_retired == tpriv->num_urbs) /* nothing to cancel */
2435                 goto completed;
2436
2437         /* cancel remaining urbs and wait for their completion before
2438          * reporting results */
2439         discard_urbs(itransfer, urb_idx + 1, tpriv->num_urbs);
2440
2441 out_unlock:
2442         usbi_mutex_unlock(&itransfer->lock);
2443         return 0;
2444
2445 completed:
2446         free(tpriv->urbs);
2447         tpriv->urbs = NULL;
2448         usbi_mutex_unlock(&itransfer->lock);
2449         return tpriv->reap_action == CANCELLED ?
2450                 usbi_handle_transfer_cancellation(itransfer) :
2451                 usbi_handle_transfer_completion(itransfer, tpriv->reap_status);
2452 }
2453
2454 static int handle_iso_completion(struct usbi_transfer *itransfer,
2455         struct usbfs_urb *urb)
2456 {
2457         struct libusb_transfer *transfer =
2458                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2459         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2460         int num_urbs = tpriv->num_urbs;
2461         int urb_idx = 0;
2462         int i;
2463         enum libusb_transfer_status status = LIBUSB_TRANSFER_COMPLETED;
2464
2465         usbi_mutex_lock(&itransfer->lock);
2466         for (i = 0; i < num_urbs; i++) {
2467                 if (urb == tpriv->iso_urbs[i]) {
2468                         urb_idx = i + 1;
2469                         break;
2470                 }
2471         }
2472         if (urb_idx == 0) {
2473                 usbi_err(TRANSFER_CTX(transfer), "could not locate urb!");
2474                 usbi_mutex_unlock(&itransfer->lock);
2475                 return LIBUSB_ERROR_NOT_FOUND;
2476         }
2477
2478         usbi_dbg("handling completion status %d of iso urb %d/%d", urb->status,
2479                  urb_idx, num_urbs);
2480
2481         /* copy isochronous results back in */
2482
2483         for (i = 0; i < urb->number_of_packets; i++) {
2484                 struct usbfs_iso_packet_desc *urb_desc = &urb->iso_frame_desc[i];
2485                 struct libusb_iso_packet_descriptor *lib_desc =
2486                         &transfer->iso_packet_desc[tpriv->iso_packet_offset++];
2487
2488                 lib_desc->status = LIBUSB_TRANSFER_COMPLETED;
2489                 switch (urb_desc->status) {
2490                 case 0:
2491                         break;
2492                 case -ENOENT: /* cancelled */
2493                 case -ECONNRESET:
2494                         break;
2495                 case -ENODEV:
2496                 case -ESHUTDOWN:
2497                         usbi_dbg("packet %d - device removed", i);
2498                         lib_desc->status = LIBUSB_TRANSFER_NO_DEVICE;
2499                         break;
2500                 case -EPIPE:
2501                         usbi_dbg("packet %d - detected endpoint stall", i);
2502                         lib_desc->status = LIBUSB_TRANSFER_STALL;
2503                         break;
2504                 case -EOVERFLOW:
2505                         usbi_dbg("packet %d - overflow error", i);
2506                         lib_desc->status = LIBUSB_TRANSFER_OVERFLOW;
2507                         break;
2508                 case -ETIME:
2509                 case -EPROTO:
2510                 case -EILSEQ:
2511                 case -ECOMM:
2512                 case -ENOSR:
2513                 case -EXDEV:
2514                         usbi_dbg("packet %d - low-level USB error %d", i, urb_desc->status);
2515                         lib_desc->status = LIBUSB_TRANSFER_ERROR;
2516                         break;
2517                 default:
2518                         usbi_warn(TRANSFER_CTX(transfer), "packet %d - unrecognised urb status %d",
2519                                   i, urb_desc->status);
2520                         lib_desc->status = LIBUSB_TRANSFER_ERROR;
2521                         break;
2522                 }
2523                 lib_desc->actual_length = urb_desc->actual_length;
2524         }
2525
2526         tpriv->num_retired++;
2527
2528         if (tpriv->reap_action != NORMAL) { /* cancelled or submit_fail */
2529                 usbi_dbg("CANCEL: urb status %d", urb->status);
2530
2531                 if (tpriv->num_retired == num_urbs) {
2532                         usbi_dbg("CANCEL: last URB handled, reporting");
2533                         free_iso_urbs(tpriv);
2534                         if (tpriv->reap_action == CANCELLED) {
2535                                 usbi_mutex_unlock(&itransfer->lock);
2536                                 return usbi_handle_transfer_cancellation(itransfer);
2537                         } else {
2538                                 usbi_mutex_unlock(&itransfer->lock);
2539                                 return usbi_handle_transfer_completion(itransfer, LIBUSB_TRANSFER_ERROR);
2540                         }
2541                 }
2542                 goto out;
2543         }
2544
2545         switch (urb->status) {
2546         case 0:
2547                 break;
2548         case -ENOENT: /* cancelled */
2549         case -ECONNRESET:
2550                 break;
2551         case -ESHUTDOWN:
2552                 usbi_dbg("device removed");
2553                 status = LIBUSB_TRANSFER_NO_DEVICE;
2554                 break;
2555         default:
2556                 usbi_warn(TRANSFER_CTX(transfer), "unrecognised urb status %d", urb->status);
2557                 status = LIBUSB_TRANSFER_ERROR;
2558                 break;
2559         }
2560
2561         /* if we've reaped all urbs then we're done */
2562         if (tpriv->num_retired == num_urbs) {
2563                 usbi_dbg("all URBs in transfer reaped --> complete!");
2564                 free_iso_urbs(tpriv);
2565                 usbi_mutex_unlock(&itransfer->lock);
2566                 return usbi_handle_transfer_completion(itransfer, status);
2567         }
2568
2569 out:
2570         usbi_mutex_unlock(&itransfer->lock);
2571         return 0;
2572 }
2573
2574 static int handle_control_completion(struct usbi_transfer *itransfer,
2575         struct usbfs_urb *urb)
2576 {
2577         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2578         int status;
2579
2580         usbi_mutex_lock(&itransfer->lock);
2581         usbi_dbg("handling completion status %d", urb->status);
2582
2583         itransfer->transferred += urb->actual_length;
2584
2585         if (tpriv->reap_action == CANCELLED) {
2586                 if (urb->status && urb->status != -ENOENT)
2587                         usbi_warn(ITRANSFER_CTX(itransfer), "cancel: unrecognised urb status %d",
2588                                   urb->status);
2589                 free(tpriv->urbs);
2590                 tpriv->urbs = NULL;
2591                 usbi_mutex_unlock(&itransfer->lock);
2592                 return usbi_handle_transfer_cancellation(itransfer);
2593         }
2594
2595         switch (urb->status) {
2596         case 0:
2597                 status = LIBUSB_TRANSFER_COMPLETED;
2598                 break;
2599         case -ENOENT: /* cancelled */
2600                 status = LIBUSB_TRANSFER_CANCELLED;
2601                 break;
2602         case -ENODEV:
2603         case -ESHUTDOWN:
2604                 usbi_dbg("device removed");
2605                 status = LIBUSB_TRANSFER_NO_DEVICE;
2606                 break;
2607         case -EPIPE:
2608                 usbi_dbg("unsupported control request");
2609                 status = LIBUSB_TRANSFER_STALL;
2610                 break;
2611         case -EOVERFLOW:
2612                 usbi_dbg("overflow, actual_length=%d", urb->actual_length);
2613                 status = LIBUSB_TRANSFER_OVERFLOW;
2614                 break;
2615         case -ETIME:
2616         case -EPROTO:
2617         case -EILSEQ:
2618         case -ECOMM:
2619         case -ENOSR:
2620                 usbi_dbg("low-level bus error %d", urb->status);
2621                 status = LIBUSB_TRANSFER_ERROR;
2622                 break;
2623         default:
2624                 usbi_warn(ITRANSFER_CTX(itransfer), "unrecognised urb status %d", urb->status);
2625                 status = LIBUSB_TRANSFER_ERROR;
2626                 break;
2627         }
2628
2629         free(tpriv->urbs);
2630         tpriv->urbs = NULL;
2631         usbi_mutex_unlock(&itransfer->lock);
2632         return usbi_handle_transfer_completion(itransfer, status);
2633 }
2634
2635 static int reap_for_handle(struct libusb_device_handle *handle)
2636 {
2637         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
2638         int r;
2639         struct usbfs_urb *urb = NULL;
2640         struct usbi_transfer *itransfer;
2641         struct libusb_transfer *transfer;
2642
2643         r = ioctl(hpriv->fd, IOCTL_USBFS_REAPURBNDELAY, &urb);
2644         if (r < 0) {
2645                 if (errno == EAGAIN)
2646                         return 1;
2647                 if (errno == ENODEV)
2648                         return LIBUSB_ERROR_NO_DEVICE;
2649
2650                 usbi_err(HANDLE_CTX(handle), "reap failed, errno=%d", errno);
2651                 return LIBUSB_ERROR_IO;
2652         }
2653
2654         itransfer = urb->usercontext;
2655         transfer = USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2656
2657         usbi_dbg("urb type=%u status=%d transferred=%d", urb->type, urb->status, urb->actual_length);
2658
2659         switch (transfer->type) {
2660         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2661                 return handle_iso_completion(itransfer, urb);
2662         case LIBUSB_TRANSFER_TYPE_BULK:
2663         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2664         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2665                 return handle_bulk_completion(itransfer, urb);
2666         case LIBUSB_TRANSFER_TYPE_CONTROL:
2667                 return handle_control_completion(itransfer, urb);
2668         default:
2669                 usbi_err(HANDLE_CTX(handle), "unrecognised transfer type %u", transfer->type);
2670                 return LIBUSB_ERROR_OTHER;
2671         }
2672 }
2673
2674 static int op_handle_events(struct libusb_context *ctx,
2675         void *event_data, unsigned int count, unsigned int num_ready)
2676 {
2677         struct pollfd *fds = event_data;
2678         unsigned int n;
2679         int r;
2680
2681         usbi_mutex_lock(&ctx->open_devs_lock);
2682         for (n = 0; n < count && num_ready > 0; n++) {
2683                 struct pollfd *pollfd = &fds[n];
2684                 struct libusb_device_handle *handle;
2685                 struct linux_device_handle_priv *hpriv = NULL;
2686                 int reap_count;
2687
2688                 if (!pollfd->revents)
2689                         continue;
2690
2691                 num_ready--;
2692                 for_each_open_device(ctx, handle) {
2693                         hpriv = usbi_get_device_handle_priv(handle);
2694                         if (hpriv->fd == pollfd->fd)
2695                                 break;
2696                 }
2697
2698                 if (!hpriv || hpriv->fd != pollfd->fd) {
2699                         usbi_err(ctx, "cannot find handle for fd %d",
2700                                  pollfd->fd);
2701                         continue;
2702                 }
2703
2704                 if (pollfd->revents & POLLERR) {
2705                         /* remove the fd from the pollfd set so that it doesn't continuously
2706                          * trigger an event, and flag that it has been removed so op_close()
2707                          * doesn't try to remove it a second time */
2708                         usbi_remove_event_source(HANDLE_CTX(handle), hpriv->fd);
2709                         hpriv->fd_removed = 1;
2710
2711                         /* device will still be marked as attached if hotplug monitor thread
2712                          * hasn't processed remove event yet */
2713                         usbi_mutex_static_lock(&linux_hotplug_lock);
2714                         if (usbi_atomic_load(&handle->dev->attached))
2715                                 linux_device_disconnected(handle->dev->bus_number,
2716                                                           handle->dev->device_address);
2717                         usbi_mutex_static_unlock(&linux_hotplug_lock);
2718
2719                         if (hpriv->caps & USBFS_CAP_REAP_AFTER_DISCONNECT) {
2720                                 do {
2721                                         r = reap_for_handle(handle);
2722                                 } while (r == 0);
2723                         }
2724
2725                         usbi_handle_disconnect(handle);
2726                         continue;
2727                 }
2728
2729                 reap_count = 0;
2730                 do {
2731                         r = reap_for_handle(handle);
2732                 } while (r == 0 && ++reap_count <= 25);
2733
2734                 if (r == 1 || r == LIBUSB_ERROR_NO_DEVICE)
2735                         continue;
2736                 else if (r < 0)
2737                         goto out;
2738         }
2739
2740         r = 0;
2741 out:
2742         usbi_mutex_unlock(&ctx->open_devs_lock);
2743         return r;
2744 }
2745
2746 const struct usbi_os_backend usbi_backend = {
2747         .name = "Linux usbfs",
2748         .caps = USBI_CAP_HAS_HID_ACCESS|USBI_CAP_SUPPORTS_DETACH_KERNEL_DRIVER,
2749         .init = op_init,
2750         .exit = op_exit,
2751         .set_option = op_set_option,
2752         .hotplug_poll = op_hotplug_poll,
2753         .get_active_config_descriptor = op_get_active_config_descriptor,
2754         .get_config_descriptor = op_get_config_descriptor,
2755         .get_config_descriptor_by_value = op_get_config_descriptor_by_value,
2756
2757         .wrap_sys_device = op_wrap_sys_device,
2758         .open = op_open,
2759         .close = op_close,
2760         .get_configuration = op_get_configuration,
2761         .set_configuration = op_set_configuration,
2762         .claim_interface = op_claim_interface,
2763         .release_interface = op_release_interface,
2764
2765         .set_interface_altsetting = op_set_interface,
2766         .clear_halt = op_clear_halt,
2767         .reset_device = op_reset_device,
2768
2769         .alloc_streams = op_alloc_streams,
2770         .free_streams = op_free_streams,
2771
2772         .dev_mem_alloc = op_dev_mem_alloc,
2773         .dev_mem_free = op_dev_mem_free,
2774
2775         .kernel_driver_active = op_kernel_driver_active,
2776         .detach_kernel_driver = op_detach_kernel_driver,
2777         .attach_kernel_driver = op_attach_kernel_driver,
2778
2779         .destroy_device = op_destroy_device,
2780
2781         .submit_transfer = op_submit_transfer,
2782         .cancel_transfer = op_cancel_transfer,
2783         .clear_transfer_priv = op_clear_transfer_priv,
2784
2785         .handle_events = op_handle_events,
2786
2787         .device_priv_size = sizeof(struct linux_device_priv),
2788         .device_handle_priv_size = sizeof(struct linux_device_handle_priv),
2789         .transfer_priv_size = sizeof(struct linux_transfer_priv),
2790 };