libusb/os/linux_usbfs.c

   1 /* -*- Mode: C; c-basic-offset:8 ; indent-tabs-mode:t -*- */
   2 /*
   3  * Linux usbfs backend for libusb
   4  * Copyright © 2007-2009 Daniel Drake <dsd@gentoo.org>
   5  * Copyright © 2001 Johannes Erdfelt <johannes@erdfelt.com>
   6  * Copyright © 2013 Nathan Hjelm <hjelmn@mac.com>
   7  * Copyright © 2012-2013 Hans de Goede <hdegoede@redhat.com>
   8  * Copyright © 2020 Chris Dickens <christopher.a.dickens@gmail.com>
   9  *
  10  * This library is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU Lesser General Public
  12  * License as published by the Free Software Foundation; either
  13  * version 2.1 of the License, or (at your option) any later version.
  14  *
  15  * This library is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18  * Lesser General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU Lesser General Public
  21  * License along with this library; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  23  */
  24
  25 #include "libusbi.h"
  26 #include "linux_usbfs.h"
  27
  28 #include <alloca.h>
  29 #include <ctype.h>
  30 #include <dirent.h>
  31 #include <errno.h>
  32 #include <fcntl.h>
  33 #include <stdio.h>
  34 #include <string.h>
  35 #include <sys/ioctl.h>
  36 #include <sys/mman.h>
  37 #include <sys/utsname.h>
  38 #include <sys/vfs.h>
  39 #include <unistd.h>
  40
  41 /* sysfs vs usbfs:
  42  * opening a usbfs node causes the device to be resumed, so we attempt to
  43  * avoid this during enumeration.
  44  *
  45  * sysfs allows us to read the kernel's in-memory copies of device descriptors
  46  * and so forth, avoiding the need to open the device:
  47  *  - The binary "descriptors" file contains all config descriptors since
  48  *    2.6.26, commit 217a9081d8e69026186067711131b77f0ce219ed
  49  *  - The binary "descriptors" file was added in 2.6.23, commit
  50  *    69d42a78f935d19384d1f6e4f94b65bb162b36df, but it only contains the
  51  *    active config descriptors
  52  *  - The "busnum" file was added in 2.6.22, commit
  53  *    83f7d958eab2fbc6b159ee92bf1493924e1d0f72
  54  *  - The "devnum" file has been present since pre-2.6.18
  55  *  - the "bConfigurationValue" file has been present since pre-2.6.18
  56  *
  57  * If we have bConfigurationValue, busnum, and devnum, then we can determine
  58  * the active configuration without having to open the usbfs node in RDWR mode.
  59  * The busnum file is important as that is the only way we can relate sysfs
  60  * devices to usbfs nodes.
  61  *
  62  * If we also have all descriptors, we can obtain the device descriptor and
  63  * configuration without touching usbfs at all.
  64  */
  65
  66 /* endianness for multi-byte fields:
  67  *
  68  * Descriptors exposed by usbfs have the multi-byte fields in the device
  69  * descriptor as host endian. Multi-byte fields in the other descriptors are
  70  * bus-endian. The kernel documentation says otherwise, but it is wrong.
  71  *
  72  * In sysfs all descriptors are bus-endian.
  73  */
  74
  75 #define USBDEV_PATH             "/dev"
  76 #define USB_DEVTMPFS_PATH       "/dev/bus/usb"
  77
  78 /* use usbdev*.* device names in /dev instead of the usbfs bus directories */
  79 static int usbdev_names = 0;
  80
  81 /* Linux has changed the maximum length of an individual isochronous packet
  82  * over time.  Initially this limit was 1,023 bytes, but Linux 2.6.18
  83  * (commit 3612242e527eb47ee4756b5350f8bdf791aa5ede) increased this value to
  84  * 8,192 bytes to support higher bandwidth devices.  Linux 3.10
  85  * (commit e2e2f0ea1c935edcf53feb4c4c8fdb4f86d57dd9) further increased this
  86  * value to 49,152 bytes to support super speed devices.  Linux 5.2
  87  * (commit 8a1dbc8d91d3d1602282c7e6b4222c7759c916fa) even further increased
  88  * this value to 98,304 bytes to support super speed plus devices.
  89  */
  90 static unsigned int max_iso_packet_len = 0;
  91
  92 /* is sysfs available (mounted) ? */
  93 static int sysfs_available = -1;
  94
  95 /* how many times have we initted (and not exited) ? */
  96 static int init_count = 0;
  97
  98 #ifdef __ANDROID__
  99 /* have no authority to operate usb device directly */
 100 static int weak_authority = 0;
 101 #endif
 102
 103 /* Serialize scan-devices, event-thread, and poll */
 104 usbi_mutex_static_t linux_hotplug_lock = USBI_MUTEX_INITIALIZER;
 105
 106 static int linux_scan_devices(struct libusb_context *ctx);
 107 static int detach_kernel_driver_and_claim(struct libusb_device_handle *, uint8_t);
 108
 109 #if !defined(HAVE_LIBUDEV)
 110 static int linux_default_scan_devices(struct libusb_context *ctx);
 111 #endif
 112
 113 struct kernel_version {
 114         int major;
 115         int minor;
 116         int sublevel;
 117 };
 118
 119 struct config_descriptor {
 120         struct usbi_configuration_descriptor *desc;
 121         size_t actual_len;
 122 };
 123
 124 struct linux_device_priv {
 125         char *sysfs_dir;
 126         void *descriptors;
 127         size_t descriptors_len;
 128         struct config_descriptor *config_descriptors;
 129         int active_config; /* cache val for !sysfs_available  */
 130 };
 131
 132 struct linux_device_handle_priv {
 133         int fd;
 134         int fd_removed;
 135         int fd_keep;
 136         uint32_t caps;
 137 };
 138
 139 enum reap_action {
 140         NORMAL = 0,
 141         /* submission failed after the first URB, so await cancellation/completion
 142          * of all the others */
 143         SUBMIT_FAILED,
 144
 145         /* cancelled by user or timeout */
 146         CANCELLED,
 147
 148         /* completed multi-URB transfer in non-final URB */
 149         COMPLETED_EARLY,
 150
 151         /* one or more urbs encountered a low-level error */
 152         ERROR,
 153 };
 154
 155 struct linux_transfer_priv {
 156         union {
 157                 struct usbfs_urb *urbs;
 158                 struct usbfs_urb **iso_urbs;
 159         };
 160
 161         enum reap_action reap_action;
 162         int num_urbs;
 163         int num_retired;
 164         enum libusb_transfer_status reap_status;
 165
 166         /* next iso packet in user-supplied transfer to be populated */
 167         int iso_packet_offset;
 168 };
 169
 170 static int dev_has_config0(struct libusb_device *dev)
 171 {
 172         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 173         struct config_descriptor *config;
 174         uint8_t idx;
 175
 176         for (idx = 0; idx < dev->device_descriptor.bNumConfigurations; idx++) {
 177                 config = &priv->config_descriptors[idx];
 178                 if (config->desc->bConfigurationValue == 0)
 179                         return 1;
 180         }
 181
 182         return 0;
 183 }
 184
 185 static int get_usbfs_fd(struct libusb_device *dev, mode_t mode, int silent)
 186 {
 187         struct libusb_context *ctx = DEVICE_CTX(dev);
 188         char path[24];
 189         int fd;
 190
 191         if (usbdev_names)
 192                 sprintf(path, USBDEV_PATH "/usbdev%u.%u",
 193                         dev->bus_number, dev->device_address);
 194         else
 195                 sprintf(path, USB_DEVTMPFS_PATH "/%03u/%03u",
 196                         dev->bus_number, dev->device_address);
 197
 198         fd = open(path, mode | O_CLOEXEC);
 199         if (fd != -1)
 200                 return fd; /* Success */
 201
 202         if (errno == ENOENT) {
 203                 const long delay_ms = 10L;
 204                 const struct timespec delay_ts = { 0L, delay_ms * 1000L * 1000L };
 205
 206                 if (!silent)
 207                         usbi_err(ctx, "File doesn't exist, wait %ld ms and try again", delay_ms);
 208
 209                 /* Wait 10ms for USB device path creation.*/
 210                 nanosleep(&delay_ts, NULL);
 211
 212                 fd = open(path, mode | O_CLOEXEC);
 213                 if (fd != -1)
 214                         return fd; /* Success */
 215         }
 216
 217         if (!silent) {
 218                 usbi_err(ctx, "libusb couldn't open USB device %s, errno=%d", path, errno);
 219                 if (errno == EACCES && mode == O_RDWR)
 220                         usbi_err(ctx, "libusb requires write access to USB device nodes");
 221         }
 222
 223         if (errno == EACCES)
 224                 return LIBUSB_ERROR_ACCESS;
 225         if (errno == ENOENT)
 226                 return LIBUSB_ERROR_NO_DEVICE;
 227         return LIBUSB_ERROR_IO;
 228 }
 229
 230 /* check dirent for a /dev/usbdev%d.%d name
 231  * optionally return bus/device on success */
 232 static int is_usbdev_entry(const char *name, uint8_t *bus_p, uint8_t *dev_p)
 233 {
 234         int busnum, devnum;
 235
 236         if (sscanf(name, "usbdev%d.%d", &busnum, &devnum) != 2)
 237                 return 0;
 238         if (busnum < 0 || busnum > UINT8_MAX || devnum < 0 || devnum > UINT8_MAX) {
 239                 usbi_dbg("invalid usbdev format '%s'", name);
 240                 return 0;
 241         }
 242
 243         usbi_dbg("found: %s", name);
 244         if (bus_p)
 245                 *bus_p = (uint8_t)busnum;
 246         if (dev_p)
 247                 *dev_p = (uint8_t)devnum;
 248         return 1;
 249 }
 250
 251 static const char *find_usbfs_path(void)
 252 {
 253         const char *path;
 254         DIR *dir;
 255         struct dirent *entry;
 256
 257         path = USB_DEVTMPFS_PATH;
 258         dir = opendir(path);
 259         if (dir) {
 260                 while ((entry = readdir(dir))) {
 261                         if (entry->d_name[0] == '.')
 262                                 continue;
 263
 264                         /* We assume if we find any files that it must be the right place */
 265                         break;
 266                 }
 267
 268                 closedir(dir);
 269
 270                 if (entry)
 271                         return path;
 272         }
 273
 274         /* look for /dev/usbdev*.* if the normal place fails */
 275         path = USBDEV_PATH;
 276         dir = opendir(path);
 277         if (dir) {
 278                 while ((entry = readdir(dir))) {
 279                         if (entry->d_name[0] == '.')
 280                                 continue;
 281
 282                         if (is_usbdev_entry(entry->d_name, NULL, NULL)) {
 283                                 /* found one; that's enough */
 284                                 break;
 285                         }
 286                 }
 287
 288                 closedir(dir);
 289
 290                 if (entry) {
 291                         usbdev_names = 1;
 292                         return path;
 293                 }
 294         }
 295
 296 /* On udev based systems without any usb-devices /dev/bus/usb will not
 297  * exist. So if we've not found anything and we're using udev for hotplug
 298  * simply assume /dev/bus/usb rather then making libusb_init fail.
 299  * Make the same assumption for Android where SELinux policies might block us
 300  * from reading /dev on newer devices. */
 301 #if defined(HAVE_LIBUDEV) || defined(__ANDROID__)
 302         return USB_DEVTMPFS_PATH;
 303 #else
 304         return NULL;
 305 #endif
 306 }
 307
 308 static int get_kernel_version(struct libusb_context *ctx,
 309         struct kernel_version *ver)
 310 {
 311         struct utsname uts;
 312         int atoms;
 313
 314         if (uname(&uts) < 0) {
 315                 usbi_err(ctx, "uname failed, errno=%d", errno);
 316                 return -1;
 317         }
 318
 319         atoms = sscanf(uts.release, "%d.%d.%d", &ver->major, &ver->minor, &ver->sublevel);
 320         if (atoms < 2) {
 321                 usbi_err(ctx, "failed to parse uname release '%s'", uts.release);
 322                 return -1;
 323         }
 324
 325         if (atoms < 3)
 326                 ver->sublevel = -1;
 327
 328         usbi_dbg("reported kernel version is %s", uts.release);
 329
 330         return 0;
 331 }
 332
 333 static int kernel_version_ge(const struct kernel_version *ver,
 334         int major, int minor, int sublevel)
 335 {
 336         if (ver->major > major)
 337                 return 1;
 338         else if (ver->major < major)
 339                 return 0;
 340
 341         /* kmajor == major */
 342         if (ver->minor > minor)
 343                 return 1;
 344         else if (ver->minor < minor)
 345                 return 0;
 346
 347         /* kminor == minor */
 348         if (ver->sublevel == -1)
 349                 return sublevel == 0;
 350
 351         return ver->sublevel >= sublevel;
 352 }
 353
 354 static int op_init(struct libusb_context *ctx)
 355 {
 356         struct kernel_version kversion;
 357         const char *usbfs_path;
 358         int r;
 359
 360         if (get_kernel_version(ctx, &kversion) < 0)
 361                 return LIBUSB_ERROR_OTHER;
 362
 363         if (!kernel_version_ge(&kversion, 2, 6, 32)) {
 364                 usbi_err(ctx, "kernel version is too old (reported as %d.%d.%d)",
 365                          kversion.major, kversion.minor,
 366                          kversion.sublevel != -1 ? kversion.sublevel : 0);
 367                 return LIBUSB_ERROR_NOT_SUPPORTED;
 368         }
 369
 370         usbfs_path = find_usbfs_path();
 371         if (!usbfs_path) {
 372                 usbi_err(ctx, "could not find usbfs");
 373                 return LIBUSB_ERROR_OTHER;
 374         }
 375
 376         usbi_dbg("found usbfs at %s", usbfs_path);
 377
 378         if (!max_iso_packet_len) {
 379                 if (kernel_version_ge(&kversion, 5, 2, 0))
 380                         max_iso_packet_len = 98304;
 381                 else if (kernel_version_ge(&kversion, 3, 10, 0))
 382                         max_iso_packet_len = 49152;
 383                 else
 384                         max_iso_packet_len = 8192;
 385         }
 386
 387         usbi_dbg("max iso packet length is (likely) %u bytes", max_iso_packet_len);
 388
 389         if (sysfs_available == -1) {
 390                 struct statfs statfsbuf;
 391
 392                 r = statfs(SYSFS_MOUNT_PATH, &statfsbuf);
 393                 if (r == 0 && statfsbuf.f_type == SYSFS_MAGIC) {
 394                         usbi_dbg("sysfs is available");
 395                         sysfs_available = 1;
 396                 } else {
 397                         usbi_warn(ctx, "sysfs not mounted");
 398                         sysfs_available = 0;
 399                 }
 400         }
 401
 402 #ifdef __ANDROID__
 403         if (weak_authority) {
 404                 return LIBUSB_SUCCESS;
 405         }
 406 #endif
 407
 408         r = LIBUSB_SUCCESS;
 409         if (init_count == 0) {
 410                 /* start up hotplug event handler */
 411                 r = linux_start_event_monitor();
 412         }
 413         if (r == LIBUSB_SUCCESS) {
 414                 r = linux_scan_devices(ctx);
 415                 if (r == LIBUSB_SUCCESS)
 416                         init_count++;
 417                 else if (init_count == 0)
 418                         linux_stop_event_monitor();
 419         } else {
 420                 usbi_err(ctx, "error starting hotplug event monitor");
 421         }
 422
 423         return r;
 424 }
 425
 426 static void op_exit(struct libusb_context *ctx)
 427 {
 428         UNUSED(ctx);
 429
 430 #ifdef __ANDROID__
 431         if (weak_authority) {
 432                 return;
 433         }
 434 #endif
 435
 436         assert(init_count != 0);
 437         if (!--init_count) {
 438                 /* tear down event handler */
 439                 linux_stop_event_monitor();
 440         }
 441 }
 442
 443 static int op_set_option(struct libusb_context *ctx, enum libusb_option option, va_list ap)
 444 {
 445         UNUSED(ctx);
 446         UNUSED(ap);
 447
 448 #ifdef __ANDROID__
 449         if (option == LIBUSB_OPTION_WEAK_AUTHORITY) {
 450                 usbi_dbg("set libusb has weak authority");
 451                 weak_authority = 1;
 452                 return LIBUSB_SUCCESS;
 453         }
 454 #else
 455         UNUSED(option);
 456 #endif
 457
 458         return LIBUSB_ERROR_NOT_SUPPORTED;
 459 }
 460
 461 static int linux_scan_devices(struct libusb_context *ctx)
 462 {
 463         int ret;
 464
 465         usbi_mutex_static_lock(&linux_hotplug_lock);
 466
 467 #if defined(HAVE_LIBUDEV)
 468         ret = linux_udev_scan_devices(ctx);
 469 #else
 470         ret = linux_default_scan_devices(ctx);
 471 #endif
 472
 473         usbi_mutex_static_unlock(&linux_hotplug_lock);
 474
 475         return ret;
 476 }
 477
 478 static void op_hotplug_poll(void)
 479 {
 480         linux_hotplug_poll();
 481 }
 482
 483 static int open_sysfs_attr(struct libusb_context *ctx,
 484         const char *sysfs_dir, const char *attr)
 485 {
 486         char filename[256];
 487         int fd;
 488
 489         snprintf(filename, sizeof(filename), SYSFS_DEVICE_PATH "/%s/%s", sysfs_dir, attr);
 490         fd = open(filename, O_RDONLY | O_CLOEXEC);
 491         if (fd < 0) {
 492                 if (errno == ENOENT) {
 493                         /* File doesn't exist. Assume the device has been
 494                            disconnected (see trac ticket #70). */
 495                         return LIBUSB_ERROR_NO_DEVICE;
 496                 }
 497                 usbi_err(ctx, "open %s failed, errno=%d", filename, errno);
 498                 return LIBUSB_ERROR_IO;
 499         }
 500
 501         return fd;
 502 }
 503
 504 /* Note only suitable for attributes which always read >= 0, < 0 is error */
 505 static int read_sysfs_attr(struct libusb_context *ctx,
 506         const char *sysfs_dir, const char *attr, int max_value, int *value_p)
 507 {
 508         char buf[20], *endptr;
 509         long value;
 510         ssize_t r;
 511         int fd;
 512
 513         fd = open_sysfs_attr(ctx, sysfs_dir, attr);
 514         if (fd < 0)
 515                 return fd;
 516
 517         r = read(fd, buf, sizeof(buf) - 1);
 518         if (r < 0) {
 519                 r = errno;
 520                 close(fd);
 521                 if (r == ENODEV)
 522                         return LIBUSB_ERROR_NO_DEVICE;
 523                 usbi_err(ctx, "attribute %s read failed, errno=%zd", attr, r);
 524                 return LIBUSB_ERROR_IO;
 525         }
 526         close(fd);
 527
 528         if (r == 0) {
 529                 /* Certain attributes (e.g. bConfigurationValue) are not
 530                  * populated if the device is not configured. */
 531                 *value_p = -1;
 532                 return 0;
 533         }
 534
 535         /* The kernel does *not* NUL-terminate the string, but every attribute
 536          * should be terminated with a newline character. */
 537         if (!isdigit(buf[0])) {
 538                 usbi_err(ctx, "attribute %s doesn't have numeric value?", attr);
 539                 return LIBUSB_ERROR_IO;
 540         } else if (buf[r - 1] != '\n') {
 541                 usbi_warn(ctx, "attribute %s doesn't end with newline?", attr);
 542         } else {
 543                 /* Remove the terminating newline character */
 544                 r--;
 545         }
 546         buf[r] = '\0';
 547
 548         errno = 0;
 549         value = strtol(buf, &endptr, 10);
 550         if (value < 0 || value > (long)max_value || errno) {
 551                 usbi_err(ctx, "attribute %s contains an invalid value: '%s'", attr, buf);
 552                 return LIBUSB_ERROR_INVALID_PARAM;
 553         } else if (*endptr != '\0') {
 554                 /* Consider the value to be valid if the remainder is a '.'
 555                  * character followed by numbers.  This occurs, for example,
 556                  * when reading the "speed" attribute for a low-speed device
 557                  * (e.g. "1.5") */
 558                 if (*endptr == '.' && isdigit(*(endptr + 1))) {
 559                         endptr++;
 560                         while (isdigit(*endptr))
 561                                 endptr++;
 562                 }
 563                 if (*endptr != '\0') {
 564                         usbi_err(ctx, "attribute %s contains an invalid value: '%s'", attr, buf);
 565                         return LIBUSB_ERROR_INVALID_PARAM;
 566                 }
 567         }
 568
 569         *value_p = (int)value;
 570         return 0;
 571 }
 572
 573 static int sysfs_scan_device(struct libusb_context *ctx, const char *devname)
 574 {
 575         uint8_t busnum, devaddr;
 576         int ret;
 577
 578         ret = linux_get_device_address(ctx, 0, &busnum, &devaddr, NULL, devname, -1);
 579         if (ret != LIBUSB_SUCCESS)
 580                 return ret;
 581
 582         return linux_enumerate_device(ctx, busnum, devaddr, devname);
 583 }
 584
 585 /* read the bConfigurationValue for a device */
 586 static int sysfs_get_active_config(struct libusb_device *dev, int *config)
 587 {
 588         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 589
 590         return read_sysfs_attr(DEVICE_CTX(dev), priv->sysfs_dir, "bConfigurationValue",
 591                         UINT8_MAX, config);
 592 }
 593
 594 int linux_get_device_address(struct libusb_context *ctx, int detached,
 595         uint8_t *busnum, uint8_t *devaddr, const char *dev_node,
 596         const char *sys_name, int fd)
 597 {
 598         int sysfs_val;
 599         int r;
 600
 601         usbi_dbg("getting address for device: %s detached: %d", sys_name, detached);
 602         /* can't use sysfs to read the bus and device number if the
 603          * device has been detached */
 604         if (!sysfs_available || detached || !sys_name) {
 605                 if (!dev_node && fd >= 0) {
 606                         char *fd_path = alloca(PATH_MAX);
 607                         char proc_path[32];
 608
 609                         /* try to retrieve the device node from fd */
 610                         sprintf(proc_path, "/proc/self/fd/%d", fd);
 611                         r = readlink(proc_path, fd_path, PATH_MAX - 1);
 612                         if (r > 0) {
 613                                 fd_path[r] = '\0';
 614                                 dev_node = fd_path;
 615                         }
 616                 }
 617
 618                 if (!dev_node)
 619                         return LIBUSB_ERROR_OTHER;
 620
 621                 /* will this work with all supported kernel versions? */
 622                 if (!strncmp(dev_node, "/dev/bus/usb", 12))
 623                         sscanf(dev_node, "/dev/bus/usb/%hhu/%hhu", busnum, devaddr);
 624                 else
 625                         return LIBUSB_ERROR_OTHER;
 626
 627                 return LIBUSB_SUCCESS;
 628         }
 629
 630         usbi_dbg("scan %s", sys_name);
 631
 632         r = read_sysfs_attr(ctx, sys_name, "busnum", UINT8_MAX, &sysfs_val);
 633         if (r < 0)
 634                 return r;
 635         *busnum = (uint8_t)sysfs_val;
 636
 637         r = read_sysfs_attr(ctx, sys_name, "devnum", UINT8_MAX, &sysfs_val);
 638         if (r < 0)
 639                 return r;
 640         *devaddr = (uint8_t)sysfs_val;
 641
 642         usbi_dbg("bus=%u dev=%u", *busnum, *devaddr);
 643
 644         return LIBUSB_SUCCESS;
 645 }
 646
 647 /* Return offset of the next config descriptor */
 648 static int seek_to_next_config(struct libusb_context *ctx,
 649         uint8_t *buffer, size_t len)
 650 {
 651         struct usbi_descriptor_header *header;
 652         int offset;
 653
 654         /* Start seeking past the config descriptor */
 655         offset = LIBUSB_DT_CONFIG_SIZE;
 656         buffer += LIBUSB_DT_CONFIG_SIZE;
 657         len -= LIBUSB_DT_CONFIG_SIZE;
 658
 659         while (len > 0) {
 660                 if (len < 2) {
 661                         usbi_err(ctx, "short descriptor read %zu/2", len);
 662                         return LIBUSB_ERROR_IO;
 663                 }
 664
 665                 header = (struct usbi_descriptor_header *)buffer;
 666                 if (header->bDescriptorType == LIBUSB_DT_CONFIG)
 667                         return offset;
 668
 669                 if (len < header->bLength) {
 670                         usbi_err(ctx, "bLength overflow by %zu bytes",
 671                                  (size_t)header->bLength - len);
 672                         return LIBUSB_ERROR_IO;
 673                 }
 674
 675                 offset += header->bLength;
 676                 buffer += header->bLength;
 677                 len -= header->bLength;
 678         }
 679
 680         usbi_err(ctx, "config descriptor not found");
 681         return LIBUSB_ERROR_IO;
 682 }
 683
 684 static int parse_config_descriptors(struct libusb_device *dev)
 685 {
 686         struct libusb_context *ctx = DEVICE_CTX(dev);
 687         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 688         struct usbi_device_descriptor *device_desc;
 689         uint8_t idx, num_configs;
 690         uint8_t *buffer;
 691         size_t remaining;
 692
 693         device_desc = priv->descriptors;
 694         num_configs = device_desc->bNumConfigurations;
 695
 696         if (num_configs == 0)
 697                 return 0;       /* no configurations? */
 698
 699         priv->config_descriptors = malloc(num_configs * sizeof(priv->config_descriptors[0]));
 700         if (!priv->config_descriptors)
 701                 return LIBUSB_ERROR_NO_MEM;
 702
 703         buffer = (uint8_t *)priv->descriptors + LIBUSB_DT_DEVICE_SIZE;
 704         remaining = priv->descriptors_len - LIBUSB_DT_DEVICE_SIZE;
 705
 706         for (idx = 0; idx < num_configs; idx++) {
 707                 struct usbi_configuration_descriptor *config_desc;
 708                 uint16_t config_len;
 709
 710                 if (remaining < LIBUSB_DT_CONFIG_SIZE) {
 711                         usbi_err(ctx, "short descriptor read %zu/%d",
 712                                  remaining, LIBUSB_DT_CONFIG_SIZE);
 713                         return LIBUSB_ERROR_IO;
 714                 }
 715
 716                 config_desc = (struct usbi_configuration_descriptor *)buffer;
 717                 if (config_desc->bDescriptorType != LIBUSB_DT_CONFIG) {
 718                         usbi_err(ctx, "descriptor is not a config desc (type 0x%02x)",
 719                                  config_desc->bDescriptorType);
 720                         return LIBUSB_ERROR_IO;
 721                 } else if (config_desc->bLength < LIBUSB_DT_CONFIG_SIZE) {
 722                         usbi_err(ctx, "invalid descriptor bLength %u",
 723                                  config_desc->bLength);
 724                         return LIBUSB_ERROR_IO;
 725                 }
 726
 727                 config_len = libusb_le16_to_cpu(config_desc->wTotalLength);
 728                 if (config_len < LIBUSB_DT_CONFIG_SIZE) {
 729                         usbi_err(ctx, "invalid wTotalLength %u", config_len);
 730                         return LIBUSB_ERROR_IO;
 731                 }
 732
 733                 if (priv->sysfs_dir) {
 734                         /*
 735                          * In sysfs wTotalLength is ignored, instead the kernel returns a
 736                          * config descriptor with verified bLength fields, with descriptors
 737                          * with an invalid bLength removed.
 738                          */
 739                         uint16_t sysfs_config_len;
 740                         int offset;
 741
 742                         if (num_configs > 1 && idx < num_configs - 1) {
 743                                 offset = seek_to_next_config(ctx, buffer, remaining);
 744                                 if (offset < 0)
 745                                         return offset;
 746                                 sysfs_config_len = (uint16_t)offset;
 747                         } else {
 748                                 sysfs_config_len = (uint16_t)remaining;
 749                         }
 750
 751                         if (config_len != sysfs_config_len) {
 752                                 usbi_warn(ctx, "config length mismatch wTotalLength %u real %u",
 753                                           config_len, sysfs_config_len);
 754                                 config_len = sysfs_config_len;
 755                         }
 756                 } else {
 757                         /*
 758                          * In usbfs the config descriptors are wTotalLength bytes apart,
 759                          * with any short reads from the device appearing as holes in the file.
 760                          */
 761                         if (config_len > remaining) {
 762                                 usbi_warn(ctx, "short descriptor read %zu/%u", remaining, config_len);
 763                                 config_len = (uint16_t)remaining;
 764                         }
 765                 }
 766
 767                 if (config_desc->bConfigurationValue == 0)
 768                         usbi_warn(ctx, "device has configuration 0");
 769
 770                 priv->config_descriptors[idx].desc = config_desc;
 771                 priv->config_descriptors[idx].actual_len = config_len;
 772
 773                 buffer += config_len;
 774                 remaining -= config_len;
 775         }
 776
 777         return LIBUSB_SUCCESS;
 778 }
 779
 780 static int op_get_config_descriptor_by_value(struct libusb_device *dev,
 781         uint8_t value, void **buffer)
 782 {
 783         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 784         struct config_descriptor *config;
 785         uint8_t idx;
 786
 787         for (idx = 0; idx < dev->device_descriptor.bNumConfigurations; idx++) {
 788                 config = &priv->config_descriptors[idx];
 789                 if (config->desc->bConfigurationValue == value) {
 790                         *buffer = config->desc;
 791                         return (int)config->actual_len;
 792                 }
 793         }
 794
 795         return LIBUSB_ERROR_NOT_FOUND;
 796 }
 797
 798 static int op_get_active_config_descriptor(struct libusb_device *dev,
 799         void *buffer, size_t len)
 800 {
 801         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 802         void *config_desc;
 803         int active_config;
 804         int r;
 805
 806         if (priv->sysfs_dir) {
 807                 r = sysfs_get_active_config(dev, &active_config);
 808                 if (r < 0)
 809                         return r;
 810         } else {
 811                 /* Use cached bConfigurationValue */
 812                 active_config = priv->active_config;
 813         }
 814
 815         if (active_config == -1) {
 816                 usbi_err(DEVICE_CTX(dev), "device unconfigured");
 817                 return LIBUSB_ERROR_NOT_FOUND;
 818         }
 819
 820         r = op_get_config_descriptor_by_value(dev, (uint8_t)active_config, &config_desc);
 821         if (r < 0)
 822                 return r;
 823
 824         len = MIN(len, (size_t)r);
 825         memcpy(buffer, config_desc, len);
 826         return len;
 827 }
 828
 829 static int op_get_config_descriptor(struct libusb_device *dev,
 830         uint8_t config_index, void *buffer, size_t len)
 831 {
 832         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 833         struct config_descriptor *config;
 834
 835         if (config_index >= dev->device_descriptor.bNumConfigurations)
 836                 return LIBUSB_ERROR_NOT_FOUND;
 837
 838         config = &priv->config_descriptors[config_index];
 839         len = MIN(len, config->actual_len);
 840         memcpy(buffer, config->desc, len);
 841         return len;
 842 }
 843
 844 /* send a control message to retrieve active configuration */
 845 static int usbfs_get_active_config(struct libusb_device *dev, int fd)
 846 {
 847         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 848         uint8_t active_config = 0;
 849         int r;
 850
 851         struct usbfs_ctrltransfer ctrl = {
 852                 .bmRequestType = LIBUSB_ENDPOINT_IN,
 853                 .bRequest = LIBUSB_REQUEST_GET_CONFIGURATION,
 854                 .wValue = 0,
 855                 .wIndex = 0,
 856                 .wLength = 1,
 857                 .timeout = 1000,
 858                 .data = &active_config
 859         };
 860
 861         r = ioctl(fd, IOCTL_USBFS_CONTROL, &ctrl);
 862         if (r < 0) {
 863                 if (errno == ENODEV)
 864                         return LIBUSB_ERROR_NO_DEVICE;
 865
 866                 /* we hit this error path frequently with buggy devices :( */
 867                 usbi_warn(DEVICE_CTX(dev), "get configuration failed, errno=%d", errno);
 868
 869                 /* assume the current configuration is the first one if we have
 870                  * the configuration descriptors, otherwise treat the device
 871                  * as unconfigured. */
 872                 if (priv->config_descriptors)
 873                         priv->active_config = (int)priv->config_descriptors[0].desc->bConfigurationValue;
 874                 else
 875                         priv->active_config = -1;
 876         } else if (active_config == 0) {
 877                 if (dev_has_config0(dev)) {
 878                         /* some buggy devices have a configuration 0, but we're
 879                          * reaching into the corner of a corner case here. */
 880                         priv->active_config = 0;
 881                 } else {
 882                         priv->active_config = -1;
 883                 }
 884         } else {
 885                 priv->active_config = (int)active_config;
 886         }
 887
 888         return LIBUSB_SUCCESS;
 889 }
 890
 891 static enum libusb_speed usbfs_get_speed(struct libusb_context *ctx, int fd)
 892 {
 893         int r;
 894
 895         r = ioctl(fd, IOCTL_USBFS_GET_SPEED, NULL);
 896         switch (r) {
 897         case USBFS_SPEED_UNKNOWN:       return LIBUSB_SPEED_UNKNOWN;
 898         case USBFS_SPEED_LOW:           return LIBUSB_SPEED_LOW;
 899         case USBFS_SPEED_FULL:          return LIBUSB_SPEED_FULL;
 900         case USBFS_SPEED_HIGH:          return LIBUSB_SPEED_HIGH;
 901         case USBFS_SPEED_WIRELESS:      return LIBUSB_SPEED_HIGH;
 902         case USBFS_SPEED_SUPER:         return LIBUSB_SPEED_SUPER;
 903         case USBFS_SPEED_SUPER_PLUS:    return LIBUSB_SPEED_SUPER_PLUS;
 904         default:
 905                 usbi_warn(ctx, "Error getting device speed: %d", r);
 906         }
 907
 908         return LIBUSB_SPEED_UNKNOWN;
 909 }
 910
 911 static int initialize_device(struct libusb_device *dev, uint8_t busnum,
 912         uint8_t devaddr, const char *sysfs_dir, int wrapped_fd)
 913 {
 914         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 915         struct libusb_context *ctx = DEVICE_CTX(dev);
 916         size_t alloc_len;
 917         int fd, speed, r;
 918         ssize_t nb;
 919
 920         dev->bus_number = busnum;
 921         dev->device_address = devaddr;
 922
 923         if (sysfs_dir) {
 924                 priv->sysfs_dir = strdup(sysfs_dir);
 925                 if (!priv->sysfs_dir)
 926                         return LIBUSB_ERROR_NO_MEM;
 927
 928                 /* Note speed can contain 1.5, in this case read_sysfs_attr()
 929                    will stop parsing at the '.' and return 1 */
 930                 if (read_sysfs_attr(ctx, sysfs_dir, "speed", INT_MAX, &speed) == 0) {
 931                         switch (speed) {
 932                         case     1: dev->speed = LIBUSB_SPEED_LOW; break;
 933                         case    12: dev->speed = LIBUSB_SPEED_FULL; break;
 934                         case   480: dev->speed = LIBUSB_SPEED_HIGH; break;
 935                         case  5000: dev->speed = LIBUSB_SPEED_SUPER; break;
 936                         case 10000: dev->speed = LIBUSB_SPEED_SUPER_PLUS; break;
 937                         default:
 938                                 usbi_warn(ctx, "unknown device speed: %d Mbps", speed);
 939                         }
 940                 }
 941         } else if (wrapped_fd >= 0) {
 942                 dev->speed = usbfs_get_speed(ctx, wrapped_fd);
 943         }
 944
 945         /* cache descriptors in memory */
 946         if (sysfs_dir) {
 947                 fd = open_sysfs_attr(ctx, sysfs_dir, "descriptors");
 948         } else if (wrapped_fd < 0) {
 949                 fd = get_usbfs_fd(dev, O_RDONLY, 0);
 950         } else {
 951                 fd = wrapped_fd;
 952                 r = lseek(fd, 0, SEEK_SET);
 953                 if (r < 0) {
 954                         usbi_err(ctx, "lseek failed, errno=%d", errno);
 955                         return LIBUSB_ERROR_IO;
 956                 }
 957         }
 958         if (fd < 0)
 959                 return fd;
 960
 961         alloc_len = 0;
 962         do {
 963                 const size_t desc_read_length = 256;
 964                 uint8_t *read_ptr;
 965
 966                 alloc_len += desc_read_length;
 967                 priv->descriptors = usbi_reallocf(priv->descriptors, alloc_len);
 968                 if (!priv->descriptors) {
 969                         if (fd != wrapped_fd)
 970                                 close(fd);
 971                         return LIBUSB_ERROR_NO_MEM;
 972                 }
 973                 read_ptr = (uint8_t *)priv->descriptors + priv->descriptors_len;
 974                 /* usbfs has holes in the file */
 975                 if (!sysfs_dir)
 976                         memset(read_ptr, 0, desc_read_length);
 977                 nb = read(fd, read_ptr, desc_read_length);
 978                 if (nb < 0) {
 979                         usbi_err(ctx, "read descriptor failed, errno=%d", errno);
 980                         if (fd != wrapped_fd)
 981                                 close(fd);
 982                         return LIBUSB_ERROR_IO;
 983                 }
 984                 priv->descriptors_len += (size_t)nb;
 985         } while (priv->descriptors_len == alloc_len);
 986
 987         if (fd != wrapped_fd)
 988                 close(fd);
 989
 990         if (priv->descriptors_len < LIBUSB_DT_DEVICE_SIZE) {
 991                 usbi_err(ctx, "short descriptor read (%zu)", priv->descriptors_len);
 992                 return LIBUSB_ERROR_IO;
 993         }
 994
 995         r = parse_config_descriptors(dev);
 996         if (r < 0)
 997                 return r;
 998
 999         memcpy(&dev->device_descriptor, priv->descriptors, LIBUSB_DT_DEVICE_SIZE);
1000
1001         if (sysfs_dir) {
1002                 /* sysfs descriptors are in bus-endian format */
1003                 usbi_localize_device_descriptor(&dev->device_descriptor);
1004                 return LIBUSB_SUCCESS;
1005         }
1006
1007         /* cache active config */
1008         if (wrapped_fd < 0)
1009                 fd = get_usbfs_fd(dev, O_RDWR, 1);
1010         else
1011                 fd = wrapped_fd;
1012         if (fd < 0) {
1013                 /* cannot send a control message to determine the active
1014                  * config. just assume the first one is active. */
1015                 usbi_warn(ctx, "Missing rw usbfs access; cannot determine "
1016                                "active configuration descriptor");
1017                 if (priv->config_descriptors)
1018                         priv->active_config = (int)priv->config_descriptors[0].desc->bConfigurationValue;
1019                 else
1020                         priv->active_config = -1; /* No config dt */
1021
1022                 return LIBUSB_SUCCESS;
1023         }
1024
1025         r = usbfs_get_active_config(dev, fd);
1026         if (fd != wrapped_fd)
1027                 close(fd);
1028
1029         return r;
1030 }
1031
1032 static int linux_get_parent_info(struct libusb_device *dev, const char *sysfs_dir)
1033 {
1034         struct libusb_context *ctx = DEVICE_CTX(dev);
1035         struct libusb_device *it;
1036         char *parent_sysfs_dir, *tmp;
1037         int ret, add_parent = 1;
1038
1039         /* XXX -- can we figure out the topology when using usbfs? */
1040         if (!sysfs_dir || !strncmp(sysfs_dir, "usb", 3)) {
1041                 /* either using usbfs or finding the parent of a root hub */
1042                 return LIBUSB_SUCCESS;
1043         }
1044
1045         parent_sysfs_dir = strdup(sysfs_dir);
1046         if (!parent_sysfs_dir)
1047                 return LIBUSB_ERROR_NO_MEM;
1048
1049         if ((tmp = strrchr(parent_sysfs_dir, '.')) ||
1050             (tmp = strrchr(parent_sysfs_dir, '-'))) {
1051                 dev->port_number = atoi(tmp + 1);
1052                 *tmp = '\0';
1053         } else {
1054                 usbi_warn(ctx, "Can not parse sysfs_dir: %s, no parent info",
1055                           parent_sysfs_dir);
1056                 free(parent_sysfs_dir);
1057                 return LIBUSB_SUCCESS;
1058         }
1059
1060         /* is the parent a root hub? */
1061         if (!strchr(parent_sysfs_dir, '-')) {
1062                 tmp = parent_sysfs_dir;
1063                 ret = asprintf(&parent_sysfs_dir, "usb%s", tmp);
1064                 free(tmp);
1065                 if (ret < 0)
1066                         return LIBUSB_ERROR_NO_MEM;
1067         }
1068
1069 retry:
1070         /* find the parent in the context */
1071         usbi_mutex_lock(&ctx->usb_devs_lock);
1072         for_each_device(ctx, it) {
1073                 struct linux_device_priv *priv = usbi_get_device_priv(it);
1074
1075                 if (priv->sysfs_dir) {
1076                         if (!strcmp(priv->sysfs_dir, parent_sysfs_dir)) {
1077                                 dev->parent_dev = libusb_ref_device(it);
1078                                 break;
1079                         }
1080                 }
1081         }
1082         usbi_mutex_unlock(&ctx->usb_devs_lock);
1083
1084         if (!dev->parent_dev && add_parent) {
1085                 usbi_dbg("parent_dev %s not enumerated yet, enumerating now",
1086                          parent_sysfs_dir);
1087                 sysfs_scan_device(ctx, parent_sysfs_dir);
1088                 add_parent = 0;
1089                 goto retry;
1090         }
1091
1092         usbi_dbg("dev %p (%s) has parent %p (%s) port %u", dev, sysfs_dir,
1093                  dev->parent_dev, parent_sysfs_dir, dev->port_number);
1094
1095         free(parent_sysfs_dir);
1096
1097         return LIBUSB_SUCCESS;
1098 }
1099
1100 int linux_enumerate_device(struct libusb_context *ctx,
1101         uint8_t busnum, uint8_t devaddr, const char *sysfs_dir)
1102 {
1103         unsigned long session_id;
1104         struct libusb_device *dev;
1105         int r;
1106
1107         /* FIXME: session ID is not guaranteed unique as addresses can wrap and
1108          * will be reused. instead we should add a simple sysfs attribute with
1109          * a session ID. */
1110         session_id = busnum << 8 | devaddr;
1111         usbi_dbg("busnum %u devaddr %u session_id %lu", busnum, devaddr, session_id);
1112
1113         dev = usbi_get_device_by_session_id(ctx, session_id);
1114         if (dev) {
1115                 /* device already exists in the context */
1116                 usbi_dbg("session_id %lu already exists", session_id);
1117                 libusb_unref_device(dev);
1118                 return LIBUSB_SUCCESS;
1119         }
1120
1121         usbi_dbg("allocating new device for %u/%u (session %lu)",
1122                  busnum, devaddr, session_id);
1123         dev = usbi_alloc_device(ctx, session_id);
1124         if (!dev)
1125                 return LIBUSB_ERROR_NO_MEM;
1126
1127         r = initialize_device(dev, busnum, devaddr, sysfs_dir, -1);
1128         if (r < 0)
1129                 goto out;
1130         r = usbi_sanitize_device(dev);
1131         if (r < 0)
1132                 goto out;
1133
1134         r = linux_get_parent_info(dev, sysfs_dir);
1135         if (r < 0)
1136                 goto out;
1137 out:
1138         if (r < 0)
1139                 libusb_unref_device(dev);
1140         else
1141                 usbi_connect_device(dev);
1142
1143         return r;
1144 }
1145
1146 void linux_hotplug_enumerate(uint8_t busnum, uint8_t devaddr, const char *sys_name)
1147 {
1148         struct libusb_context *ctx;
1149
1150         usbi_mutex_static_lock(&active_contexts_lock);
1151         for_each_context(ctx) {
1152                 linux_enumerate_device(ctx, busnum, devaddr, sys_name);
1153         }
1154         usbi_mutex_static_unlock(&active_contexts_lock);
1155 }
1156
1157 void linux_device_disconnected(uint8_t busnum, uint8_t devaddr)
1158 {
1159         struct libusb_context *ctx;
1160         struct libusb_device *dev;
1161         unsigned long session_id = busnum << 8 | devaddr;
1162
1163         usbi_mutex_static_lock(&active_contexts_lock);
1164         for_each_context(ctx) {
1165                 dev = usbi_get_device_by_session_id(ctx, session_id);
1166                 if (dev) {
1167                         usbi_disconnect_device(dev);
1168                         libusb_unref_device(dev);
1169                 } else {
1170                         usbi_dbg("device not found for session %lx", session_id);
1171                 }
1172         }
1173         usbi_mutex_static_unlock(&active_contexts_lock);
1174 }
1175
1176 #if !defined(HAVE_LIBUDEV)
1177 static int parse_u8(const char *str, uint8_t *val_p)
1178 {
1179         char *endptr;
1180         long num;
1181
1182         errno = 0;
1183         num = strtol(str, &endptr, 10);
1184         if (num < 0 || num > UINT8_MAX || errno)
1185                 return 0;
1186         if (endptr == str || *endptr != '\0')
1187                 return 0;
1188
1189         *val_p = (uint8_t)num;
1190         return 1;
1191 }
1192
1193 /* open a bus directory and adds all discovered devices to the context */
1194 static int usbfs_scan_busdir(struct libusb_context *ctx, uint8_t busnum)
1195 {
1196         DIR *dir;
1197         char dirpath[20];
1198         struct dirent *entry;
1199         int r = LIBUSB_ERROR_IO;
1200
1201         sprintf(dirpath, USB_DEVTMPFS_PATH "/%03u", busnum);
1202         usbi_dbg("%s", dirpath);
1203         dir = opendir(dirpath);
1204         if (!dir) {
1205                 usbi_err(ctx, "opendir '%s' failed, errno=%d", dirpath, errno);
1206                 /* FIXME: should handle valid race conditions like hub unplugged
1207                  * during directory iteration - this is not an error */
1208                 return r;
1209         }
1210
1211         while ((entry = readdir(dir))) {
1212                 uint8_t devaddr;
1213
1214                 if (entry->d_name[0] == '.')
1215                         continue;
1216
1217                 if (!parse_u8(entry->d_name, &devaddr)) {
1218                         usbi_dbg("unknown dir entry %s", entry->d_name);
1219                         continue;
1220                 }
1221
1222                 if (linux_enumerate_device(ctx, busnum, devaddr, NULL)) {
1223                         usbi_dbg("failed to enumerate dir entry %s", entry->d_name);
1224                         continue;
1225                 }
1226
1227                 r = 0;
1228         }
1229
1230         closedir(dir);
1231         return r;
1232 }
1233
1234 static int usbfs_get_device_list(struct libusb_context *ctx)
1235 {
1236         struct dirent *entry;
1237         DIR *buses;
1238         uint8_t busnum, devaddr;
1239         int r = 0;
1240
1241         if (usbdev_names)
1242                 buses = opendir(USBDEV_PATH);
1243         else
1244                 buses = opendir(USB_DEVTMPFS_PATH);
1245
1246         if (!buses) {
1247                 usbi_err(ctx, "opendir buses failed, errno=%d", errno);
1248                 return LIBUSB_ERROR_IO;
1249         }
1250
1251         while ((entry = readdir(buses))) {
1252                 if (entry->d_name[0] == '.')
1253                         continue;
1254
1255                 if (usbdev_names) {
1256                         if (!is_usbdev_entry(entry->d_name, &busnum, &devaddr))
1257                                 continue;
1258
1259                         r = linux_enumerate_device(ctx, busnum, devaddr, NULL);
1260                         if (r < 0) {
1261                                 usbi_dbg("failed to enumerate dir entry %s", entry->d_name);
1262                                 continue;
1263                         }
1264                 } else {
1265                         if (!parse_u8(entry->d_name, &busnum)) {
1266                                 usbi_dbg("unknown dir entry %s", entry->d_name);
1267                                 continue;
1268                         }
1269
1270                         r = usbfs_scan_busdir(ctx, busnum);
1271                         if (r < 0)
1272                                 break;
1273                 }
1274         }
1275
1276         closedir(buses);
1277         return r;
1278
1279 }
1280
1281 static int sysfs_get_device_list(struct libusb_context *ctx)
1282 {
1283         DIR *devices = opendir(SYSFS_DEVICE_PATH);
1284         struct dirent *entry;
1285         int num_devices = 0;
1286         int num_enumerated = 0;
1287
1288         if (!devices) {
1289                 usbi_err(ctx, "opendir devices failed, errno=%d", errno);
1290                 return LIBUSB_ERROR_IO;
1291         }
1292
1293         while ((entry = readdir(devices))) {
1294                 if ((!isdigit(entry->d_name[0]) && strncmp(entry->d_name, "usb", 3))
1295                     || strchr(entry->d_name, ':'))
1296                         continue;
1297
1298                 num_devices++;
1299
1300                 if (sysfs_scan_device(ctx, entry->d_name)) {
1301                         usbi_dbg("failed to enumerate dir entry %s", entry->d_name);
1302                         continue;
1303                 }
1304
1305                 num_enumerated++;
1306         }
1307
1308         closedir(devices);
1309
1310         /* successful if at least one device was enumerated or no devices were found */
1311         if (num_enumerated || !num_devices)
1312                 return LIBUSB_SUCCESS;
1313         else
1314                 return LIBUSB_ERROR_IO;
1315 }
1316
1317 static int linux_default_scan_devices(struct libusb_context *ctx)
1318 {
1319         /* we can retrieve device list and descriptors from sysfs or usbfs.
1320          * sysfs is preferable, because if we use usbfs we end up resuming
1321          * any autosuspended USB devices. however, sysfs is not available
1322          * everywhere, so we need a usbfs fallback too.
1323          */
1324         if (sysfs_available)
1325                 return sysfs_get_device_list(ctx);
1326         else
1327                 return usbfs_get_device_list(ctx);
1328 }
1329 #endif
1330
1331 static int initialize_handle(struct libusb_device_handle *handle, int fd)
1332 {
1333         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1334         int r;
1335
1336         hpriv->fd = fd;
1337
1338         r = ioctl(fd, IOCTL_USBFS_GET_CAPABILITIES, &hpriv->caps);
1339         if (r < 0) {
1340                 if (errno == ENOTTY)
1341                         usbi_dbg("getcap not available");
1342                 else
1343                         usbi_err(HANDLE_CTX(handle), "getcap failed, errno=%d", errno);
1344                 hpriv->caps = USBFS_CAP_BULK_CONTINUATION;
1345         }
1346
1347         return usbi_add_event_source(HANDLE_CTX(handle), hpriv->fd, POLLOUT);
1348 }
1349
1350 static int op_wrap_sys_device(struct libusb_context *ctx,
1351         struct libusb_device_handle *handle, intptr_t sys_dev)
1352 {
1353         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1354         int fd = (int)sys_dev;
1355         uint8_t busnum, devaddr;
1356         struct usbfs_connectinfo ci;
1357         struct libusb_device *dev;
1358         int r;
1359
1360         r = linux_get_device_address(ctx, 1, &busnum, &devaddr, NULL, NULL, fd);
1361         if (r < 0) {
1362                 r = ioctl(fd, IOCTL_USBFS_CONNECTINFO, &ci);
1363                 if (r < 0) {
1364                         usbi_err(ctx, "connectinfo failed, errno=%d", errno);
1365                         return LIBUSB_ERROR_IO;
1366                 }
1367                 /* There is no ioctl to get the bus number. We choose 0 here
1368                  * as linux starts numbering buses from 1. */
1369                 busnum = 0;
1370                 devaddr = ci.devnum;
1371         }
1372
1373         /* Session id is unused as we do not add the device to the list of
1374          * connected devices. */
1375         usbi_dbg("allocating new device for fd %d", fd);
1376         dev = usbi_alloc_device(ctx, 0);
1377         if (!dev)
1378                 return LIBUSB_ERROR_NO_MEM;
1379
1380         r = initialize_device(dev, busnum, devaddr, NULL, fd);
1381         if (r < 0)
1382                 goto out;
1383         r = usbi_sanitize_device(dev);
1384         if (r < 0)
1385                 goto out;
1386         /* Consider the device as connected, but do not add it to the managed
1387          * device list. */
1388         usbi_atomic_store(&dev->attached, 1);
1389         handle->dev = dev;
1390
1391         r = initialize_handle(handle, fd);
1392         hpriv->fd_keep = 1;
1393
1394 out:
1395         if (r < 0)
1396                 libusb_unref_device(dev);
1397         return r;
1398 }
1399
1400 static int op_open(struct libusb_device_handle *handle)
1401 {
1402         int fd, r;
1403
1404         fd = get_usbfs_fd(handle->dev, O_RDWR, 0);
1405         if (fd < 0) {
1406                 if (fd == LIBUSB_ERROR_NO_DEVICE) {
1407                         /* device will still be marked as attached if hotplug monitor thread
1408                          * hasn't processed remove event yet */
1409                         usbi_mutex_static_lock(&linux_hotplug_lock);
1410                         if (usbi_atomic_load(&handle->dev->attached)) {
1411                                 usbi_dbg("open failed with no device, but device still attached");
1412                                 linux_device_disconnected(handle->dev->bus_number,
1413                                                           handle->dev->device_address);
1414                         }
1415                         usbi_mutex_static_unlock(&linux_hotplug_lock);
1416                 }
1417                 return fd;
1418         }
1419
1420         r = initialize_handle(handle, fd);
1421         if (r < 0)
1422                 close(fd);
1423
1424         return r;
1425 }
1426
1427 static void op_close(struct libusb_device_handle *dev_handle)
1428 {
1429         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(dev_handle);
1430
1431         /* fd may have already been removed by POLLERR condition in op_handle_events() */
1432         if (!hpriv->fd_removed)
1433                 usbi_remove_event_source(HANDLE_CTX(dev_handle), hpriv->fd);
1434         if (!hpriv->fd_keep)
1435                 close(hpriv->fd);
1436 }
1437
1438 static int op_get_configuration(struct libusb_device_handle *handle,
1439         uint8_t *config)
1440 {
1441         struct linux_device_priv *priv = usbi_get_device_priv(handle->dev);
1442         int active_config;
1443         int r;
1444
1445         if (priv->sysfs_dir) {
1446                 r = sysfs_get_active_config(handle->dev, &active_config);
1447         } else {
1448                 struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1449
1450                 r = usbfs_get_active_config(handle->dev, hpriv->fd);
1451                 if (r == LIBUSB_SUCCESS)
1452                         active_config = priv->active_config;
1453         }
1454         if (r < 0)
1455                 return r;
1456
1457         if (active_config == -1) {
1458                 usbi_warn(HANDLE_CTX(handle), "device unconfigured");
1459                 active_config = 0;
1460         }
1461
1462         *config = (uint8_t)active_config;
1463
1464         return 0;
1465 }
1466
1467 static int op_set_configuration(struct libusb_device_handle *handle, int config)
1468 {
1469         struct linux_device_priv *priv = usbi_get_device_priv(handle->dev);
1470         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1471         int fd = hpriv->fd;
1472         int r = ioctl(fd, IOCTL_USBFS_SETCONFIGURATION, &config);
1473
1474         if (r < 0) {
1475                 if (errno == EINVAL)
1476                         return LIBUSB_ERROR_NOT_FOUND;
1477                 else if (errno == EBUSY)
1478                         return LIBUSB_ERROR_BUSY;
1479                 else if (errno == ENODEV)
1480                         return LIBUSB_ERROR_NO_DEVICE;
1481
1482                 usbi_err(HANDLE_CTX(handle), "set configuration failed, errno=%d", errno);
1483                 return LIBUSB_ERROR_OTHER;
1484         }
1485
1486         /* if necessary, update our cached active config descriptor */
1487         if (!priv->sysfs_dir) {
1488                 if (config == 0 && !dev_has_config0(handle->dev))
1489                         config = -1;
1490
1491                 priv->active_config = config;
1492         }
1493
1494         return LIBUSB_SUCCESS;
1495 }
1496
1497 static int claim_interface(struct libusb_device_handle *handle, unsigned int iface)
1498 {
1499         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1500         int fd = hpriv->fd;
1501         int r = ioctl(fd, IOCTL_USBFS_CLAIMINTERFACE, &iface);
1502
1503         if (r < 0) {
1504                 if (errno == ENOENT)
1505                         return LIBUSB_ERROR_NOT_FOUND;
1506                 else if (errno == EBUSY)
1507                         return LIBUSB_ERROR_BUSY;
1508                 else if (errno == ENODEV)
1509                         return LIBUSB_ERROR_NO_DEVICE;
1510
1511                 usbi_err(HANDLE_CTX(handle), "claim interface failed, errno=%d", errno);
1512                 return LIBUSB_ERROR_OTHER;
1513         }
1514         return 0;
1515 }
1516
1517 static int release_interface(struct libusb_device_handle *handle, unsigned int iface)
1518 {
1519         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1520         int fd = hpriv->fd;
1521         int r = ioctl(fd, IOCTL_USBFS_RELEASEINTERFACE, &iface);
1522
1523         if (r < 0) {
1524                 if (errno == ENODEV)
1525                         return LIBUSB_ERROR_NO_DEVICE;
1526
1527                 usbi_err(HANDLE_CTX(handle), "release interface failed, errno=%d", errno);
1528                 return LIBUSB_ERROR_OTHER;
1529         }
1530         return 0;
1531 }
1532
1533 static int op_set_interface(struct libusb_device_handle *handle, uint8_t interface,
1534         uint8_t altsetting)
1535 {
1536         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1537         int fd = hpriv->fd;
1538         struct usbfs_setinterface setintf;
1539         int r;
1540
1541         setintf.interface = interface;
1542         setintf.altsetting = altsetting;
1543         r = ioctl(fd, IOCTL_USBFS_SETINTERFACE, &setintf);
1544         if (r < 0) {
1545                 if (errno == EINVAL)
1546                         return LIBUSB_ERROR_NOT_FOUND;
1547                 else if (errno == ENODEV)
1548                         return LIBUSB_ERROR_NO_DEVICE;
1549
1550                 usbi_err(HANDLE_CTX(handle), "set interface failed, errno=%d", errno);
1551                 return LIBUSB_ERROR_OTHER;
1552         }
1553
1554         return 0;
1555 }
1556
1557 static int op_clear_halt(struct libusb_device_handle *handle,
1558         unsigned char endpoint)
1559 {
1560         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1561         int fd = hpriv->fd;
1562         unsigned int _endpoint = endpoint;
1563         int r = ioctl(fd, IOCTL_USBFS_CLEAR_HALT, &_endpoint);
1564
1565         if (r < 0) {
1566                 if (errno == ENOENT)
1567                         return LIBUSB_ERROR_NOT_FOUND;
1568                 else if (errno == ENODEV)
1569                         return LIBUSB_ERROR_NO_DEVICE;
1570
1571                 usbi_err(HANDLE_CTX(handle), "clear halt failed, errno=%d", errno);
1572                 return LIBUSB_ERROR_OTHER;
1573         }
1574
1575         return 0;
1576 }
1577
1578 static int op_reset_device(struct libusb_device_handle *handle)
1579 {
1580         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1581         int fd = hpriv->fd;
1582         int r, ret = 0;
1583         uint8_t i;
1584
1585         /* Doing a device reset will cause the usbfs driver to get unbound
1586          * from any interfaces it is bound to. By voluntarily unbinding
1587          * the usbfs driver ourself, we stop the kernel from rebinding
1588          * the interface after reset (which would end up with the interface
1589          * getting bound to the in kernel driver if any). */
1590         for (i = 0; i < USB_MAXINTERFACES; i++) {
1591                 if (handle->claimed_interfaces & (1UL << i))
1592                         release_interface(handle, i);
1593         }
1594
1595         usbi_mutex_lock(&handle->lock);
1596         r = ioctl(fd, IOCTL_USBFS_RESET, NULL);
1597         if (r < 0) {
1598                 if (errno == ENODEV) {
1599                         ret = LIBUSB_ERROR_NOT_FOUND;
1600                         goto out;
1601                 }
1602
1603                 usbi_err(HANDLE_CTX(handle), "reset failed, errno=%d", errno);
1604                 ret = LIBUSB_ERROR_OTHER;
1605                 goto out;
1606         }
1607
1608         /* And re-claim any interfaces which were claimed before the reset */
1609         for (i = 0; i < USB_MAXINTERFACES; i++) {
1610                 if (!(handle->claimed_interfaces & (1UL << i)))
1611                         continue;
1612                 /*
1613                  * A driver may have completed modprobing during
1614                  * IOCTL_USBFS_RESET, and bound itself as soon as
1615                  * IOCTL_USBFS_RESET released the device lock
1616                  */
1617                 r = detach_kernel_driver_and_claim(handle, i);
1618                 if (r) {
1619                         usbi_warn(HANDLE_CTX(handle), "failed to re-claim interface %u after reset: %s",
1620                                   i, libusb_error_name(r));
1621                         handle->claimed_interfaces &= ~(1UL << i);
1622                         ret = LIBUSB_ERROR_NOT_FOUND;
1623                 }
1624         }
1625 out:
1626         usbi_mutex_unlock(&handle->lock);
1627         return ret;
1628 }
1629
1630 static int do_streams_ioctl(struct libusb_device_handle *handle, long req,
1631         uint32_t num_streams, unsigned char *endpoints, int num_endpoints)
1632 {
1633         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1634         int r, fd = hpriv->fd;
1635         struct usbfs_streams *streams;
1636
1637         if (num_endpoints > 30) /* Max 15 in + 15 out eps */
1638                 return LIBUSB_ERROR_INVALID_PARAM;
1639
1640         streams = malloc(sizeof(*streams) + num_endpoints);
1641         if (!streams)
1642                 return LIBUSB_ERROR_NO_MEM;
1643
1644         streams->num_streams = num_streams;
1645         streams->num_eps = num_endpoints;
1646         memcpy(streams->eps, endpoints, num_endpoints);
1647
1648         r = ioctl(fd, req, streams);
1649
1650         free(streams);
1651
1652         if (r < 0) {
1653                 if (errno == ENOTTY)
1654                         return LIBUSB_ERROR_NOT_SUPPORTED;
1655                 else if (errno == EINVAL)
1656                         return LIBUSB_ERROR_INVALID_PARAM;
1657                 else if (errno == ENODEV)
1658                         return LIBUSB_ERROR_NO_DEVICE;
1659
1660                 usbi_err(HANDLE_CTX(handle), "streams-ioctl failed, errno=%d", errno);
1661                 return LIBUSB_ERROR_OTHER;
1662         }
1663         return r;
1664 }
1665
1666 static int op_alloc_streams(struct libusb_device_handle *handle,
1667         uint32_t num_streams, unsigned char *endpoints, int num_endpoints)
1668 {
1669         return do_streams_ioctl(handle, IOCTL_USBFS_ALLOC_STREAMS,
1670                                 num_streams, endpoints, num_endpoints);
1671 }
1672
1673 static int op_free_streams(struct libusb_device_handle *handle,
1674                 unsigned char *endpoints, int num_endpoints)
1675 {
1676         return do_streams_ioctl(handle, IOCTL_USBFS_FREE_STREAMS, 0,
1677                                 endpoints, num_endpoints);
1678 }
1679
1680 static void *op_dev_mem_alloc(struct libusb_device_handle *handle, size_t len)
1681 {
1682         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1683         void *buffer;
1684
1685         buffer = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, hpriv->fd, 0);
1686         if (buffer == MAP_FAILED) {
1687                 usbi_err(HANDLE_CTX(handle), "alloc dev mem failed, errno=%d", errno);
1688                 return NULL;
1689         }
1690         return buffer;
1691 }
1692
1693 static int op_dev_mem_free(struct libusb_device_handle *handle, void *buffer,
1694         size_t len)
1695 {
1696         if (munmap(buffer, len) != 0) {
1697                 usbi_err(HANDLE_CTX(handle), "free dev mem failed, errno=%d", errno);
1698                 return LIBUSB_ERROR_OTHER;
1699         } else {
1700                 return LIBUSB_SUCCESS;
1701         }
1702 }
1703
1704 static int op_kernel_driver_active(struct libusb_device_handle *handle,
1705         uint8_t interface)
1706 {
1707         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1708         int fd = hpriv->fd;
1709         struct usbfs_getdriver getdrv;
1710         int r;
1711
1712         getdrv.interface = interface;
1713         r = ioctl(fd, IOCTL_USBFS_GETDRIVER, &getdrv);
1714         if (r < 0) {
1715                 if (errno == ENODATA)
1716                         return 0;
1717                 else if (errno == ENODEV)
1718                         return LIBUSB_ERROR_NO_DEVICE;
1719
1720                 usbi_err(HANDLE_CTX(handle), "get driver failed, errno=%d", errno);
1721                 return LIBUSB_ERROR_OTHER;
1722         }
1723
1724         return strcmp(getdrv.driver, "usbfs") != 0;
1725 }
1726
1727 static int op_detach_kernel_driver(struct libusb_device_handle *handle,
1728         uint8_t interface)
1729 {
1730         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1731         int fd = hpriv->fd;
1732         struct usbfs_ioctl command;
1733         struct usbfs_getdriver getdrv;
1734         int r;
1735
1736         command.ifno = interface;
1737         command.ioctl_code = IOCTL_USBFS_DISCONNECT;
1738         command.data = NULL;
1739
1740         getdrv.interface = interface;
1741         r = ioctl(fd, IOCTL_USBFS_GETDRIVER, &getdrv);
1742         if (r == 0 && !strcmp(getdrv.driver, "usbfs"))
1743                 return LIBUSB_ERROR_NOT_FOUND;
1744
1745         r = ioctl(fd, IOCTL_USBFS_IOCTL, &command);
1746         if (r < 0) {
1747                 if (errno == ENODATA)
1748                         return LIBUSB_ERROR_NOT_FOUND;
1749                 else if (errno == EINVAL)
1750                         return LIBUSB_ERROR_INVALID_PARAM;
1751                 else if (errno == ENODEV)
1752                         return LIBUSB_ERROR_NO_DEVICE;
1753
1754                 usbi_err(HANDLE_CTX(handle), "detach failed, errno=%d", errno);
1755                 return LIBUSB_ERROR_OTHER;
1756         }
1757
1758         return 0;
1759 }
1760
1761 static int op_attach_kernel_driver(struct libusb_device_handle *handle,
1762         uint8_t interface)
1763 {
1764         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1765         int fd = hpriv->fd;
1766         struct usbfs_ioctl command;
1767         int r;
1768
1769         command.ifno = interface;
1770         command.ioctl_code = IOCTL_USBFS_CONNECT;
1771         command.data = NULL;
1772
1773         r = ioctl(fd, IOCTL_USBFS_IOCTL, &command);
1774         if (r < 0) {
1775                 if (errno == ENODATA)
1776                         return LIBUSB_ERROR_NOT_FOUND;
1777                 else if (errno == EINVAL)
1778                         return LIBUSB_ERROR_INVALID_PARAM;
1779                 else if (errno == ENODEV)
1780                         return LIBUSB_ERROR_NO_DEVICE;
1781                 else if (errno == EBUSY)
1782                         return LIBUSB_ERROR_BUSY;
1783
1784                 usbi_err(HANDLE_CTX(handle), "attach failed, errno=%d", errno);
1785                 return LIBUSB_ERROR_OTHER;
1786         } else if (r == 0) {
1787                 return LIBUSB_ERROR_NOT_FOUND;
1788         }
1789
1790         return 0;
1791 }
1792
1793 static int detach_kernel_driver_and_claim(struct libusb_device_handle *handle,
1794         uint8_t interface)
1795 {
1796         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1797         struct usbfs_disconnect_claim dc;
1798         int r, fd = hpriv->fd;
1799
1800         dc.interface = interface;
1801         strcpy(dc.driver, "usbfs");
1802         dc.flags = USBFS_DISCONNECT_CLAIM_EXCEPT_DRIVER;
1803         r = ioctl(fd, IOCTL_USBFS_DISCONNECT_CLAIM, &dc);
1804         if (r == 0)
1805                 return 0;
1806         switch (errno) {
1807         case ENOTTY:
1808                 break;
1809         case EBUSY:
1810                 return LIBUSB_ERROR_BUSY;
1811         case EINVAL:
1812                 return LIBUSB_ERROR_INVALID_PARAM;
1813         case ENODEV:
1814                 return LIBUSB_ERROR_NO_DEVICE;
1815         default:
1816                 usbi_err(HANDLE_CTX(handle), "disconnect-and-claim failed, errno=%d", errno);
1817                 return LIBUSB_ERROR_OTHER;
1818         }
1819
1820         /* Fallback code for kernels which don't support the
1821            disconnect-and-claim ioctl */
1822         r = op_detach_kernel_driver(handle, interface);
1823         if (r != 0 && r != LIBUSB_ERROR_NOT_FOUND)
1824                 return r;
1825
1826         return claim_interface(handle, interface);
1827 }
1828
1829 static int op_claim_interface(struct libusb_device_handle *handle, uint8_t interface)
1830 {
1831         if (handle->auto_detach_kernel_driver)
1832                 return detach_kernel_driver_and_claim(handle, interface);
1833         else
1834                 return claim_interface(handle, interface);
1835 }
1836
1837 static int op_release_interface(struct libusb_device_handle *handle, uint8_t interface)
1838 {
1839         int r;
1840
1841         r = release_interface(handle, interface);
1842         if (r)
1843                 return r;
1844
1845         if (handle->auto_detach_kernel_driver)
1846                 op_attach_kernel_driver(handle, interface);
1847
1848         return 0;
1849 }
1850
1851 static void op_destroy_device(struct libusb_device *dev)
1852 {
1853         struct linux_device_priv *priv = usbi_get_device_priv(dev);
1854
1855         free(priv->config_descriptors);
1856         free(priv->descriptors);
1857         free(priv->sysfs_dir);
1858 }
1859
1860 /* URBs are discarded in reverse order of submission to avoid races. */
1861 static int discard_urbs(struct usbi_transfer *itransfer, int first, int last_plus_one)
1862 {
1863         struct libusb_transfer *transfer =
1864                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
1865         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
1866         struct linux_device_handle_priv *hpriv =
1867                 usbi_get_device_handle_priv(transfer->dev_handle);
1868         int i, ret = 0;
1869         struct usbfs_urb *urb;
1870
1871         for (i = last_plus_one - 1; i >= first; i--) {
1872                 if (transfer->type == LIBUSB_TRANSFER_TYPE_ISOCHRONOUS)
1873                         urb = tpriv->iso_urbs[i];
1874                 else
1875                         urb = &tpriv->urbs[i];
1876
1877                 if (ioctl(hpriv->fd, IOCTL_USBFS_DISCARDURB, urb) == 0)
1878                         continue;
1879
1880                 if (errno == EINVAL) {
1881                         usbi_dbg("URB not found --> assuming ready to be reaped");
1882                         if (i == (last_plus_one - 1))
1883                                 ret = LIBUSB_ERROR_NOT_FOUND;
1884                 } else if (errno == ENODEV) {
1885                         usbi_dbg("Device not found for URB --> assuming ready to be reaped");
1886                         ret = LIBUSB_ERROR_NO_DEVICE;
1887                 } else {
1888                         usbi_warn(TRANSFER_CTX(transfer), "unrecognised discard errno %d", errno);
1889                         ret = LIBUSB_ERROR_OTHER;
1890                 }
1891         }
1892         return ret;
1893 }
1894
1895 static void free_iso_urbs(struct linux_transfer_priv *tpriv)
1896 {
1897         int i;
1898
1899         for (i = 0; i < tpriv->num_urbs; i++) {
1900                 struct usbfs_urb *urb = tpriv->iso_urbs[i];
1901
1902                 if (!urb)
1903                         break;
1904                 free(urb);
1905         }
1906
1907         free(tpriv->iso_urbs);
1908         tpriv->iso_urbs = NULL;
1909 }
1910
1911 static int submit_bulk_transfer(struct usbi_transfer *itransfer)
1912 {
1913         struct libusb_transfer *transfer =
1914                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
1915         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
1916         struct linux_device_handle_priv *hpriv =
1917                 usbi_get_device_handle_priv(transfer->dev_handle);
1918         struct usbfs_urb *urbs;
1919         int is_out = IS_XFEROUT(transfer);
1920         int bulk_buffer_len, use_bulk_continuation;
1921         int num_urbs;
1922         int last_urb_partial = 0;
1923         int r;
1924         int i;
1925
1926         /*
1927          * Older versions of usbfs place a 16kb limit on bulk URBs. We work
1928          * around this by splitting large transfers into 16k blocks, and then
1929          * submit all urbs at once. it would be simpler to submit one urb at
1930          * a time, but there is a big performance gain doing it this way.
1931          *
1932          * Newer versions lift the 16k limit (USBFS_CAP_NO_PACKET_SIZE_LIM),
1933          * using arbitrary large transfers can still be a bad idea though, as
1934          * the kernel needs to allocate physical contiguous memory for this,
1935          * which may fail for large buffers.
1936          *
1937          * The kernel solves this problem by splitting the transfer into
1938          * blocks itself when the host-controller is scatter-gather capable
1939          * (USBFS_CAP_BULK_SCATTER_GATHER), which most controllers are.
1940          *
1941          * Last, there is the issue of short-transfers when splitting, for
1942          * short split-transfers to work reliable USBFS_CAP_BULK_CONTINUATION
1943          * is needed, but this is not always available.
1944          */
1945         if (hpriv->caps & USBFS_CAP_BULK_SCATTER_GATHER) {
1946                 /* Good! Just submit everything in one go */
1947                 bulk_buffer_len = transfer->length ? transfer->length : 1;
1948                 use_bulk_continuation = 0;
1949         } else if (hpriv->caps & USBFS_CAP_BULK_CONTINUATION) {
1950                 /* Split the transfers and use bulk-continuation to
1951                    avoid issues with short-transfers */
1952                 bulk_buffer_len = MAX_BULK_BUFFER_LENGTH;
1953                 use_bulk_continuation = 1;
1954         } else if (hpriv->caps & USBFS_CAP_NO_PACKET_SIZE_LIM) {
1955                 /* Don't split, assume the kernel can alloc the buffer
1956                    (otherwise the submit will fail with -ENOMEM) */
1957                 bulk_buffer_len = transfer->length ? transfer->length : 1;
1958                 use_bulk_continuation = 0;
1959         } else {
1960                 /* Bad, splitting without bulk-continuation, short transfers
1961                    which end before the last urb will not work reliable! */
1962                 /* Note we don't warn here as this is "normal" on kernels <
1963                    2.6.32 and not a problem for most applications */
1964                 bulk_buffer_len = MAX_BULK_BUFFER_LENGTH;
1965                 use_bulk_continuation = 0;
1966         }
1967
1968         num_urbs = transfer->length / bulk_buffer_len;
1969
1970         if (transfer->length == 0) {
1971                 num_urbs = 1;
1972         } else if ((transfer->length % bulk_buffer_len) > 0) {
1973                 last_urb_partial = 1;
1974                 num_urbs++;
1975         }
1976         usbi_dbg("need %d urbs for new transfer with length %d", num_urbs, transfer->length);
1977         urbs = calloc(num_urbs, sizeof(*urbs));
1978         if (!urbs)
1979                 return LIBUSB_ERROR_NO_MEM;
1980         tpriv->urbs = urbs;
1981         tpriv->num_urbs = num_urbs;
1982         tpriv->num_retired = 0;
1983         tpriv->reap_action = NORMAL;
1984         tpriv->reap_status = LIBUSB_TRANSFER_COMPLETED;
1985
1986         for (i = 0; i < num_urbs; i++) {
1987                 struct usbfs_urb *urb = &urbs[i];
1988
1989                 urb->usercontext = itransfer;
1990                 switch (transfer->type) {
1991                 case LIBUSB_TRANSFER_TYPE_BULK:
1992                         urb->type = USBFS_URB_TYPE_BULK;
1993                         urb->stream_id = 0;
1994                         break;
1995                 case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
1996                         urb->type = USBFS_URB_TYPE_BULK;
1997                         urb->stream_id = itransfer->stream_id;
1998                         break;
1999                 case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2000                         urb->type = USBFS_URB_TYPE_INTERRUPT;
2001                         break;
2002                 }
2003                 urb->endpoint = transfer->endpoint;
2004                 urb->buffer = transfer->buffer + (i * bulk_buffer_len);
2005
2006                 /* don't set the short not ok flag for the last URB */
2007                 if (use_bulk_continuation && !is_out && (i < num_urbs - 1))
2008                         urb->flags = USBFS_URB_SHORT_NOT_OK;
2009
2010                 if (i == num_urbs - 1 && last_urb_partial)
2011                         urb->buffer_length = transfer->length % bulk_buffer_len;
2012                 else if (transfer->length == 0)
2013                         urb->buffer_length = 0;
2014                 else
2015                         urb->buffer_length = bulk_buffer_len;
2016
2017                 if (i > 0 && use_bulk_continuation)
2018                         urb->flags |= USBFS_URB_BULK_CONTINUATION;
2019
2020                 /* we have already checked that the flag is supported */
2021                 if (is_out && i == num_urbs - 1 &&
2022                     (transfer->flags & LIBUSB_TRANSFER_ADD_ZERO_PACKET))
2023                         urb->flags |= USBFS_URB_ZERO_PACKET;
2024
2025                 r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urb);
2026                 if (r == 0)
2027                         continue;
2028
2029                 if (errno == ENODEV) {
2030                         r = LIBUSB_ERROR_NO_DEVICE;
2031                 } else if (errno == ENOMEM) {
2032                         r = LIBUSB_ERROR_NO_MEM;
2033                 } else {
2034                         usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
2035                         r = LIBUSB_ERROR_IO;
2036                 }
2037
2038                 /* if the first URB submission fails, we can simply free up and
2039                  * return failure immediately. */
2040                 if (i == 0) {
2041                         usbi_dbg("first URB failed, easy peasy");
2042                         free(urbs);
2043                         tpriv->urbs = NULL;
2044                         return r;
2045                 }
2046
2047                 /* if it's not the first URB that failed, the situation is a bit
2048                  * tricky. we may need to discard all previous URBs. there are
2049                  * complications:
2050                  *  - discarding is asynchronous - discarded urbs will be reaped
2051                  *    later. the user must not have freed the transfer when the
2052                  *    discarded URBs are reaped, otherwise libusb will be using
2053                  *    freed memory.
2054                  *  - the earlier URBs may have completed successfully and we do
2055                  *    not want to throw away any data.
2056                  *  - this URB failing may be no error; EREMOTEIO means that
2057                  *    this transfer simply didn't need all the URBs we submitted
2058                  * so, we report that the transfer was submitted successfully and
2059                  * in case of error we discard all previous URBs. later when
2060                  * the final reap completes we can report error to the user,
2061                  * or success if an earlier URB was completed successfully.
2062                  */
2063                 tpriv->reap_action = errno == EREMOTEIO ? COMPLETED_EARLY : SUBMIT_FAILED;
2064
2065                 /* The URBs we haven't submitted yet we count as already
2066                  * retired. */
2067                 tpriv->num_retired += num_urbs - i;
2068
2069                 /* If we completed short then don't try to discard. */
2070                 if (tpriv->reap_action == COMPLETED_EARLY)
2071                         return 0;
2072
2073                 discard_urbs(itransfer, 0, i);
2074
2075                 usbi_dbg("reporting successful submission but waiting for %d "
2076                          "discards before reporting error", i);
2077                 return 0;
2078         }
2079
2080         return 0;
2081 }
2082
2083 static int submit_iso_transfer(struct usbi_transfer *itransfer)
2084 {
2085         struct libusb_transfer *transfer =
2086                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2087         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2088         struct linux_device_handle_priv *hpriv =
2089                 usbi_get_device_handle_priv(transfer->dev_handle);
2090         struct usbfs_urb **urbs;
2091         int num_packets = transfer->num_iso_packets;
2092         int num_packets_remaining;
2093         int i, j;
2094         int num_urbs;
2095         unsigned int packet_len;
2096         unsigned int total_len = 0;
2097         unsigned char *urb_buffer = transfer->buffer;
2098
2099         if (num_packets < 1)
2100                 return LIBUSB_ERROR_INVALID_PARAM;
2101
2102         /* usbfs places arbitrary limits on iso URBs. this limit has changed
2103          * at least three times, but we attempt to detect this limit during
2104          * init and check it here. if the kernel rejects the request due to
2105          * its size, we return an error indicating such to the user.
2106          */
2107         for (i = 0; i < num_packets; i++) {
2108                 packet_len = transfer->iso_packet_desc[i].length;
2109
2110                 if (packet_len > max_iso_packet_len) {
2111                         usbi_warn(TRANSFER_CTX(transfer),
2112                                   "iso packet length of %u bytes exceeds maximum of %u bytes",
2113                                   packet_len, max_iso_packet_len);
2114                         return LIBUSB_ERROR_INVALID_PARAM;
2115                 }
2116
2117                 total_len += packet_len;
2118         }
2119
2120         if (transfer->length < (int)total_len)
2121                 return LIBUSB_ERROR_INVALID_PARAM;
2122
2123         /* usbfs limits the number of iso packets per URB */
2124         num_urbs = (num_packets + (MAX_ISO_PACKETS_PER_URB - 1)) / MAX_ISO_PACKETS_PER_URB;
2125
2126         usbi_dbg("need %d urbs for new transfer with length %d", num_urbs, transfer->length);
2127
2128         urbs = calloc(num_urbs, sizeof(*urbs));
2129         if (!urbs)
2130                 return LIBUSB_ERROR_NO_MEM;
2131
2132         tpriv->iso_urbs = urbs;
2133         tpriv->num_urbs = num_urbs;
2134         tpriv->num_retired = 0;
2135         tpriv->reap_action = NORMAL;
2136         tpriv->iso_packet_offset = 0;
2137
2138         /* allocate + initialize each URB with the correct number of packets */
2139         num_packets_remaining = num_packets;
2140         for (i = 0, j = 0; i < num_urbs; i++) {
2141                 int num_packets_in_urb = MIN(num_packets_remaining, MAX_ISO_PACKETS_PER_URB);
2142                 struct usbfs_urb *urb;
2143                 size_t alloc_size;
2144                 int k;
2145
2146                 alloc_size = sizeof(*urb)
2147                         + (num_packets_in_urb * sizeof(struct usbfs_iso_packet_desc));
2148                 urb = calloc(1, alloc_size);
2149                 if (!urb) {
2150                         free_iso_urbs(tpriv);
2151                         return LIBUSB_ERROR_NO_MEM;
2152                 }
2153                 urbs[i] = urb;
2154
2155                 /* populate packet lengths */
2156                 for (k = 0; k < num_packets_in_urb; j++, k++) {
2157                         packet_len = transfer->iso_packet_desc[j].length;
2158                         urb->buffer_length += packet_len;
2159                         urb->iso_frame_desc[k].length = packet_len;
2160                 }
2161
2162                 urb->usercontext = itransfer;
2163                 urb->type = USBFS_URB_TYPE_ISO;
2164                 /* FIXME: interface for non-ASAP data? */
2165                 urb->flags = USBFS_URB_ISO_ASAP;
2166                 urb->endpoint = transfer->endpoint;
2167                 urb->number_of_packets = num_packets_in_urb;
2168                 urb->buffer = urb_buffer;
2169
2170                 urb_buffer += urb->buffer_length;
2171                 num_packets_remaining -= num_packets_in_urb;
2172         }
2173
2174         /* submit URBs */
2175         for (i = 0; i < num_urbs; i++) {
2176                 int r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urbs[i]);
2177
2178                 if (r == 0)
2179                         continue;
2180
2181                 if (errno == ENODEV) {
2182                         r = LIBUSB_ERROR_NO_DEVICE;
2183                 } else if (errno == EINVAL) {
2184                         usbi_warn(TRANSFER_CTX(transfer), "submiturb failed, transfer too large");
2185                         r = LIBUSB_ERROR_INVALID_PARAM;
2186                 } else if (errno == EMSGSIZE) {
2187                         usbi_warn(TRANSFER_CTX(transfer), "submiturb failed, iso packet length too large");
2188                         r = LIBUSB_ERROR_INVALID_PARAM;
2189                 } else {
2190                         usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
2191                         r = LIBUSB_ERROR_IO;
2192                 }
2193
2194                 /* if the first URB submission fails, we can simply free up and
2195                  * return failure immediately. */
2196                 if (i == 0) {
2197                         usbi_dbg("first URB failed, easy peasy");
2198                         free_iso_urbs(tpriv);
2199                         return r;
2200                 }
2201
2202                 /* if it's not the first URB that failed, the situation is a bit
2203                  * tricky. we must discard all previous URBs. there are
2204                  * complications:
2205                  *  - discarding is asynchronous - discarded urbs will be reaped
2206                  *    later. the user must not have freed the transfer when the
2207                  *    discarded URBs are reaped, otherwise libusb will be using
2208                  *    freed memory.
2209                  *  - the earlier URBs may have completed successfully and we do
2210                  *    not want to throw away any data.
2211                  * so, in this case we discard all the previous URBs BUT we report
2212                  * that the transfer was submitted successfully. then later when
2213                  * the final discard completes we can report error to the user.
2214                  */
2215                 tpriv->reap_action = SUBMIT_FAILED;
2216
2217                 /* The URBs we haven't submitted yet we count as already
2218                  * retired. */
2219                 tpriv->num_retired = num_urbs - i;
2220                 discard_urbs(itransfer, 0, i);
2221
2222                 usbi_dbg("reporting successful submission but waiting for %d "
2223                          "discards before reporting error", i);
2224                 return 0;
2225         }
2226
2227         return 0;
2228 }
2229
2230 static int submit_control_transfer(struct usbi_transfer *itransfer)
2231 {
2232         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2233         struct libusb_transfer *transfer =
2234                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2235         struct linux_device_handle_priv *hpriv =
2236                 usbi_get_device_handle_priv(transfer->dev_handle);
2237         struct usbfs_urb *urb;
2238         int r;
2239
2240         if (transfer->length - LIBUSB_CONTROL_SETUP_SIZE > MAX_CTRL_BUFFER_LENGTH)
2241                 return LIBUSB_ERROR_INVALID_PARAM;
2242
2243         urb = calloc(1, sizeof(*urb));
2244         if (!urb)
2245                 return LIBUSB_ERROR_NO_MEM;
2246         tpriv->urbs = urb;
2247         tpriv->num_urbs = 1;
2248         tpriv->reap_action = NORMAL;
2249
2250         urb->usercontext = itransfer;
2251         urb->type = USBFS_URB_TYPE_CONTROL;
2252         urb->endpoint = transfer->endpoint;
2253         urb->buffer = transfer->buffer;
2254         urb->buffer_length = transfer->length;
2255
2256         r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urb);
2257         if (r < 0) {
2258                 free(urb);
2259                 tpriv->urbs = NULL;
2260                 if (errno == ENODEV)
2261                         return LIBUSB_ERROR_NO_DEVICE;
2262
2263                 usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
2264                 return LIBUSB_ERROR_IO;
2265         }
2266         return 0;
2267 }
2268
2269 static int op_submit_transfer(struct usbi_transfer *itransfer)
2270 {
2271         struct libusb_transfer *transfer =
2272                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2273
2274         switch (transfer->type) {
2275         case LIBUSB_TRANSFER_TYPE_CONTROL:
2276                 return submit_control_transfer(itransfer);
2277         case LIBUSB_TRANSFER_TYPE_BULK:
2278         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2279                 return submit_bulk_transfer(itransfer);
2280         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2281                 return submit_bulk_transfer(itransfer);
2282         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2283                 return submit_iso_transfer(itransfer);
2284         default:
2285                 usbi_err(TRANSFER_CTX(transfer), "unknown transfer type %u", transfer->type);
2286                 return LIBUSB_ERROR_INVALID_PARAM;
2287         }
2288 }
2289
2290 static int op_cancel_transfer(struct usbi_transfer *itransfer)
2291 {
2292         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2293         struct libusb_transfer *transfer =
2294                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2295         int r;
2296
2297         if (!tpriv->urbs)
2298                 return LIBUSB_ERROR_NOT_FOUND;
2299
2300         r = discard_urbs(itransfer, 0, tpriv->num_urbs);
2301         if (r != 0)
2302                 return r;
2303
2304         switch (transfer->type) {
2305         case LIBUSB_TRANSFER_TYPE_BULK:
2306         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2307                 if (tpriv->reap_action == ERROR)
2308                         break;
2309                 /* else, fall through */
2310         default:
2311                 tpriv->reap_action = CANCELLED;
2312         }
2313
2314         return 0;
2315 }
2316
2317 static void op_clear_transfer_priv(struct usbi_transfer *itransfer)
2318 {
2319         struct libusb_transfer *transfer =
2320                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2321         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2322
2323         switch (transfer->type) {
2324         case LIBUSB_TRANSFER_TYPE_CONTROL:
2325         case LIBUSB_TRANSFER_TYPE_BULK:
2326         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2327         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2328                 if (tpriv->urbs) {
2329                         free(tpriv->urbs);
2330                         tpriv->urbs = NULL;
2331                 }
2332                 break;
2333         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2334                 if (tpriv->iso_urbs) {
2335                         free_iso_urbs(tpriv);
2336                         tpriv->iso_urbs = NULL;
2337                 }
2338                 break;
2339         default:
2340                 usbi_err(TRANSFER_CTX(transfer), "unknown transfer type %u", transfer->type);
2341         }
2342 }
2343
2344 static int handle_bulk_completion(struct usbi_transfer *itransfer,
2345         struct usbfs_urb *urb)
2346 {
2347         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2348         struct libusb_transfer *transfer = USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2349         int urb_idx = urb - tpriv->urbs;
2350
2351         usbi_mutex_lock(&itransfer->lock);
2352         usbi_dbg("handling completion status %d of bulk urb %d/%d", urb->status,
2353                  urb_idx + 1, tpriv->num_urbs);
2354
2355         tpriv->num_retired++;
2356
2357         if (tpriv->reap_action != NORMAL) {
2358                 /* cancelled, submit_fail, or completed early */
2359                 usbi_dbg("abnormal reap: urb status %d", urb->status);
2360
2361                 /* even though we're in the process of cancelling, it's possible that
2362                  * we may receive some data in these URBs that we don't want to lose.
2363                  * examples:
2364                  * 1. while the kernel is cancelling all the packets that make up an
2365                  *    URB, a few of them might complete. so we get back a successful
2366                  *    cancellation *and* some data.
2367                  * 2. we receive a short URB which marks the early completion condition,
2368                  *    so we start cancelling the remaining URBs. however, we're too
2369                  *    slow and another URB completes (or at least completes partially).
2370                  *    (this can't happen since we always use BULK_CONTINUATION.)
2371                  *
2372                  * When this happens, our objectives are not to lose any "surplus" data,
2373                  * and also to stick it at the end of the previously-received data
2374                  * (closing any holes), so that libusb reports the total amount of
2375                  * transferred data and presents it in a contiguous chunk.
2376                  */
2377                 if (urb->actual_length > 0) {
2378                         unsigned char *target = transfer->buffer + itransfer->transferred;
2379
2380                         usbi_dbg("received %d bytes of surplus data", urb->actual_length);
2381                         if (urb->buffer != target) {
2382                                 usbi_dbg("moving surplus data from offset %zu to offset %zu",
2383                                          (unsigned char *)urb->buffer - transfer->buffer,
2384                                          target - transfer->buffer);
2385                                 memmove(target, urb->buffer, urb->actual_length);
2386                         }
2387                         itransfer->transferred += urb->actual_length;
2388                 }
2389
2390                 if (tpriv->num_retired == tpriv->num_urbs) {
2391                         usbi_dbg("abnormal reap: last URB handled, reporting");
2392                         if (tpriv->reap_action != COMPLETED_EARLY &&
2393                             tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2394                                 tpriv->reap_status = LIBUSB_TRANSFER_ERROR;
2395                         goto completed;
2396                 }
2397                 goto out_unlock;
2398         }
2399
2400         itransfer->transferred += urb->actual_length;
2401
2402         /* Many of these errors can occur on *any* urb of a multi-urb
2403          * transfer.  When they do, we tear down the rest of the transfer.
2404          */
2405         switch (urb->status) {
2406         case 0:
2407                 break;
2408         case -EREMOTEIO: /* short transfer */
2409                 break;
2410         case -ENOENT: /* cancelled */
2411         case -ECONNRESET:
2412                 break;
2413         case -ENODEV:
2414         case -ESHUTDOWN:
2415                 usbi_dbg("device removed");
2416                 tpriv->reap_status = LIBUSB_TRANSFER_NO_DEVICE;
2417                 goto cancel_remaining;
2418         case -EPIPE:
2419                 usbi_dbg("detected endpoint stall");
2420                 if (tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2421                         tpriv->reap_status = LIBUSB_TRANSFER_STALL;
2422                 goto cancel_remaining;
2423         case -EOVERFLOW:
2424                 /* overflow can only ever occur in the last urb */
2425                 usbi_dbg("overflow, actual_length=%d", urb->actual_length);
2426                 if (tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2427                         tpriv->reap_status = LIBUSB_TRANSFER_OVERFLOW;
2428                 goto completed;
2429         case -ETIME:
2430         case -EPROTO:
2431         case -EILSEQ:
2432         case -ECOMM:
2433         case -ENOSR:
2434                 usbi_dbg("low-level bus error %d", urb->status);
2435                 tpriv->reap_action = ERROR;
2436                 goto cancel_remaining;
2437         default:
2438                 usbi_warn(ITRANSFER_CTX(itransfer), "unrecognised urb status %d", urb->status);
2439                 tpriv->reap_action = ERROR;
2440                 goto cancel_remaining;
2441         }
2442
2443         /* if we've reaped all urbs or we got less data than requested then we're
2444          * done */
2445         if (tpriv->num_retired == tpriv->num_urbs) {
2446                 usbi_dbg("all URBs in transfer reaped --> complete!");
2447                 goto completed;
2448         } else if (urb->actual_length < urb->buffer_length) {
2449                 usbi_dbg("short transfer %d/%d --> complete!",
2450                          urb->actual_length, urb->buffer_length);
2451                 if (tpriv->reap_action == NORMAL)
2452                         tpriv->reap_action = COMPLETED_EARLY;
2453         } else {
2454                 goto out_unlock;
2455         }
2456
2457 cancel_remaining:
2458         if (tpriv->reap_action == ERROR && tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2459                 tpriv->reap_status = LIBUSB_TRANSFER_ERROR;
2460
2461         if (tpriv->num_retired == tpriv->num_urbs) /* nothing to cancel */
2462                 goto completed;
2463
2464         /* cancel remaining urbs and wait for their completion before
2465          * reporting results */
2466         discard_urbs(itransfer, urb_idx + 1, tpriv->num_urbs);
2467
2468 out_unlock:
2469         usbi_mutex_unlock(&itransfer->lock);
2470         return 0;
2471
2472 completed:
2473         free(tpriv->urbs);
2474         tpriv->urbs = NULL;
2475         usbi_mutex_unlock(&itransfer->lock);
2476         return tpriv->reap_action == CANCELLED ?
2477                 usbi_handle_transfer_cancellation(itransfer) :
2478                 usbi_handle_transfer_completion(itransfer, tpriv->reap_status);
2479 }
2480
2481 static int handle_iso_completion(struct usbi_transfer *itransfer,
2482         struct usbfs_urb *urb)
2483 {
2484         struct libusb_transfer *transfer =
2485                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2486         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2487         int num_urbs = tpriv->num_urbs;
2488         int urb_idx = 0;
2489         int i;
2490         enum libusb_transfer_status status = LIBUSB_TRANSFER_COMPLETED;
2491
2492         usbi_mutex_lock(&itransfer->lock);
2493         for (i = 0; i < num_urbs; i++) {
2494                 if (urb == tpriv->iso_urbs[i]) {
2495                         urb_idx = i + 1;
2496                         break;
2497                 }
2498         }
2499         if (urb_idx == 0) {
2500                 usbi_err(TRANSFER_CTX(transfer), "could not locate urb!");
2501                 usbi_mutex_unlock(&itransfer->lock);
2502                 return LIBUSB_ERROR_NOT_FOUND;
2503         }
2504
2505         usbi_dbg("handling completion status %d of iso urb %d/%d", urb->status,
2506                  urb_idx, num_urbs);
2507
2508         /* copy isochronous results back in */
2509
2510         for (i = 0; i < urb->number_of_packets; i++) {
2511                 struct usbfs_iso_packet_desc *urb_desc = &urb->iso_frame_desc[i];
2512                 struct libusb_iso_packet_descriptor *lib_desc =
2513                         &transfer->iso_packet_desc[tpriv->iso_packet_offset++];
2514
2515                 lib_desc->status = LIBUSB_TRANSFER_COMPLETED;
2516                 switch (urb_desc->status) {
2517                 case 0:
2518                         break;
2519                 case -ENOENT: /* cancelled */
2520                 case -ECONNRESET:
2521                         break;
2522                 case -ENODEV:
2523                 case -ESHUTDOWN:
2524                         usbi_dbg("packet %d - device removed", i);
2525                         lib_desc->status = LIBUSB_TRANSFER_NO_DEVICE;
2526                         break;
2527                 case -EPIPE:
2528                         usbi_dbg("packet %d - detected endpoint stall", i);
2529                         lib_desc->status = LIBUSB_TRANSFER_STALL;
2530                         break;
2531                 case -EOVERFLOW:
2532                         usbi_dbg("packet %d - overflow error", i);
2533                         lib_desc->status = LIBUSB_TRANSFER_OVERFLOW;
2534                         break;
2535                 case -ETIME:
2536                 case -EPROTO:
2537                 case -EILSEQ:
2538                 case -ECOMM:
2539                 case -ENOSR:
2540                 case -EXDEV:
2541                         usbi_dbg("packet %d - low-level USB error %d", i, urb_desc->status);
2542                         lib_desc->status = LIBUSB_TRANSFER_ERROR;
2543                         break;
2544                 default:
2545                         usbi_warn(TRANSFER_CTX(transfer), "packet %d - unrecognised urb status %d",
2546                                   i, urb_desc->status);
2547                         lib_desc->status = LIBUSB_TRANSFER_ERROR;
2548                         break;
2549                 }
2550                 lib_desc->actual_length = urb_desc->actual_length;
2551         }
2552
2553         tpriv->num_retired++;
2554
2555         if (tpriv->reap_action != NORMAL) { /* cancelled or submit_fail */
2556                 usbi_dbg("CANCEL: urb status %d", urb->status);
2557
2558                 if (tpriv->num_retired == num_urbs) {
2559                         usbi_dbg("CANCEL: last URB handled, reporting");
2560                         free_iso_urbs(tpriv);
2561                         if (tpriv->reap_action == CANCELLED) {
2562                                 usbi_mutex_unlock(&itransfer->lock);
2563                                 return usbi_handle_transfer_cancellation(itransfer);
2564                         } else {
2565                                 usbi_mutex_unlock(&itransfer->lock);
2566                                 return usbi_handle_transfer_completion(itransfer, LIBUSB_TRANSFER_ERROR);
2567                         }
2568                 }
2569                 goto out;
2570         }
2571
2572         switch (urb->status) {
2573         case 0:
2574                 break;
2575         case -ENOENT: /* cancelled */
2576         case -ECONNRESET:
2577                 break;
2578         case -ESHUTDOWN:
2579                 usbi_dbg("device removed");
2580                 status = LIBUSB_TRANSFER_NO_DEVICE;
2581                 break;
2582         default:
2583                 usbi_warn(TRANSFER_CTX(transfer), "unrecognised urb status %d", urb->status);
2584                 status = LIBUSB_TRANSFER_ERROR;
2585                 break;
2586         }
2587
2588         /* if we've reaped all urbs then we're done */
2589         if (tpriv->num_retired == num_urbs) {
2590                 usbi_dbg("all URBs in transfer reaped --> complete!");
2591                 free_iso_urbs(tpriv);
2592                 usbi_mutex_unlock(&itransfer->lock);
2593                 return usbi_handle_transfer_completion(itransfer, status);
2594         }
2595
2596 out:
2597         usbi_mutex_unlock(&itransfer->lock);
2598         return 0;
2599 }
2600
2601 static int handle_control_completion(struct usbi_transfer *itransfer,
2602         struct usbfs_urb *urb)
2603 {
2604         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2605         int status;
2606
2607         usbi_mutex_lock(&itransfer->lock);
2608         usbi_dbg("handling completion status %d", urb->status);
2609
2610         itransfer->transferred += urb->actual_length;
2611
2612         if (tpriv->reap_action == CANCELLED) {
2613                 if (urb->status && urb->status != -ENOENT)
2614                         usbi_warn(ITRANSFER_CTX(itransfer), "cancel: unrecognised urb status %d",
2615                                   urb->status);
2616                 free(tpriv->urbs);
2617                 tpriv->urbs = NULL;
2618                 usbi_mutex_unlock(&itransfer->lock);
2619                 return usbi_handle_transfer_cancellation(itransfer);
2620         }
2621
2622         switch (urb->status) {
2623         case 0:
2624                 status = LIBUSB_TRANSFER_COMPLETED;
2625                 break;
2626         case -ENOENT: /* cancelled */
2627                 status = LIBUSB_TRANSFER_CANCELLED;
2628                 break;
2629         case -ENODEV:
2630         case -ESHUTDOWN:
2631                 usbi_dbg("device removed");
2632                 status = LIBUSB_TRANSFER_NO_DEVICE;
2633                 break;
2634         case -EPIPE:
2635                 usbi_dbg("unsupported control request");
2636                 status = LIBUSB_TRANSFER_STALL;
2637                 break;
2638         case -EOVERFLOW:
2639                 usbi_dbg("overflow, actual_length=%d", urb->actual_length);
2640                 status = LIBUSB_TRANSFER_OVERFLOW;
2641                 break;
2642         case -ETIME:
2643         case -EPROTO:
2644         case -EILSEQ:
2645         case -ECOMM:
2646         case -ENOSR:
2647                 usbi_dbg("low-level bus error %d", urb->status);
2648                 status = LIBUSB_TRANSFER_ERROR;
2649                 break;
2650         default:
2651                 usbi_warn(ITRANSFER_CTX(itransfer), "unrecognised urb status %d", urb->status);
2652                 status = LIBUSB_TRANSFER_ERROR;
2653                 break;
2654         }
2655
2656         free(tpriv->urbs);
2657         tpriv->urbs = NULL;
2658         usbi_mutex_unlock(&itransfer->lock);
2659         return usbi_handle_transfer_completion(itransfer, status);
2660 }
2661
2662 static int reap_for_handle(struct libusb_device_handle *handle)
2663 {
2664         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
2665         int r;
2666         struct usbfs_urb *urb = NULL;
2667         struct usbi_transfer *itransfer;
2668         struct libusb_transfer *transfer;
2669
2670         r = ioctl(hpriv->fd, IOCTL_USBFS_REAPURBNDELAY, &urb);
2671         if (r < 0) {
2672                 if (errno == EAGAIN)
2673                         return 1;
2674                 if (errno == ENODEV)
2675                         return LIBUSB_ERROR_NO_DEVICE;
2676
2677                 usbi_err(HANDLE_CTX(handle), "reap failed, errno=%d", errno);
2678                 return LIBUSB_ERROR_IO;
2679         }
2680
2681         itransfer = urb->usercontext;
2682         transfer = USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2683
2684         usbi_dbg("urb type=%u status=%d transferred=%d", urb->type, urb->status, urb->actual_length);
2685
2686         switch (transfer->type) {
2687         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2688                 return handle_iso_completion(itransfer, urb);
2689         case LIBUSB_TRANSFER_TYPE_BULK:
2690         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2691         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2692                 return handle_bulk_completion(itransfer, urb);
2693         case LIBUSB_TRANSFER_TYPE_CONTROL:
2694                 return handle_control_completion(itransfer, urb);
2695         default:
2696                 usbi_err(HANDLE_CTX(handle), "unrecognised transfer type %u", transfer->type);
2697                 return LIBUSB_ERROR_OTHER;
2698         }
2699 }
2700
2701 static int op_handle_events(struct libusb_context *ctx,
2702         void *event_data, unsigned int count, unsigned int num_ready)
2703 {
2704         struct pollfd *fds = event_data;
2705         unsigned int n;
2706         int r;
2707
2708         usbi_mutex_lock(&ctx->open_devs_lock);
2709         for (n = 0; n < count && num_ready > 0; n++) {
2710                 struct pollfd *pollfd = &fds[n];
2711                 struct libusb_device_handle *handle;
2712                 struct linux_device_handle_priv *hpriv = NULL;
2713                 int reap_count;
2714
2715                 if (!pollfd->revents)
2716                         continue;
2717
2718                 num_ready--;
2719                 for_each_open_device(ctx, handle) {
2720                         hpriv = usbi_get_device_handle_priv(handle);
2721                         if (hpriv->fd == pollfd->fd)
2722                                 break;
2723                 }
2724
2725                 if (!hpriv || hpriv->fd != pollfd->fd) {
2726                         usbi_err(ctx, "cannot find handle for fd %d",
2727                                  pollfd->fd);
2728                         continue;
2729                 }
2730
2731                 if (pollfd->revents & POLLERR) {
2732                         /* remove the fd from the pollfd set so that it doesn't continuously
2733                          * trigger an event, and flag that it has been removed so op_close()
2734                          * doesn't try to remove it a second time */
2735                         usbi_remove_event_source(HANDLE_CTX(handle), hpriv->fd);
2736                         hpriv->fd_removed = 1;
2737
2738                         /* device will still be marked as attached if hotplug monitor thread
2739                          * hasn't processed remove event yet */
2740                         usbi_mutex_static_lock(&linux_hotplug_lock);
2741                         if (usbi_atomic_load(&handle->dev->attached))
2742                                 linux_device_disconnected(handle->dev->bus_number,
2743                                                           handle->dev->device_address);
2744                         usbi_mutex_static_unlock(&linux_hotplug_lock);
2745
2746                         if (hpriv->caps & USBFS_CAP_REAP_AFTER_DISCONNECT) {
2747                                 do {
2748                                         r = reap_for_handle(handle);
2749                                 } while (r == 0);
2750                         }
2751
2752                         usbi_handle_disconnect(handle);
2753                         continue;
2754                 }
2755
2756                 reap_count = 0;
2757                 do {
2758                         r = reap_for_handle(handle);
2759                 } while (r == 0 && ++reap_count <= 25);
2760
2761                 if (r == 1 || r == LIBUSB_ERROR_NO_DEVICE)
2762                         continue;
2763                 else if (r < 0)
2764                         goto out;
2765         }
2766
2767         r = 0;
2768 out:
2769         usbi_mutex_unlock(&ctx->open_devs_lock);
2770         return r;
2771 }
2772
2773 const struct usbi_os_backend usbi_backend = {
2774         .name = "Linux usbfs",
2775         .caps = USBI_CAP_HAS_HID_ACCESS|USBI_CAP_SUPPORTS_DETACH_KERNEL_DRIVER,
2776         .init = op_init,
2777         .exit = op_exit,
2778         .set_option = op_set_option,
2779         .hotplug_poll = op_hotplug_poll,
2780         .get_active_config_descriptor = op_get_active_config_descriptor,
2781         .get_config_descriptor = op_get_config_descriptor,
2782         .get_config_descriptor_by_value = op_get_config_descriptor_by_value,
2783
2784         .wrap_sys_device = op_wrap_sys_device,
2785         .open = op_open,
2786         .close = op_close,
2787         .get_configuration = op_get_configuration,
2788         .set_configuration = op_set_configuration,
2789         .claim_interface = op_claim_interface,
2790         .release_interface = op_release_interface,
2791
2792         .set_interface_altsetting = op_set_interface,
2793         .clear_halt = op_clear_halt,
2794         .reset_device = op_reset_device,
2795
2796         .alloc_streams = op_alloc_streams,
2797         .free_streams = op_free_streams,
2798
2799         .dev_mem_alloc = op_dev_mem_alloc,
2800         .dev_mem_free = op_dev_mem_free,
2801
2802         .kernel_driver_active = op_kernel_driver_active,
2803         .detach_kernel_driver = op_detach_kernel_driver,
2804         .attach_kernel_driver = op_attach_kernel_driver,
2805
2806         .destroy_device = op_destroy_device,
2807
2808         .submit_transfer = op_submit_transfer,
2809         .cancel_transfer = op_cancel_transfer,
2810         .clear_transfer_priv = op_clear_transfer_priv,
2811
2812         .handle_events = op_handle_events,
2813
2814         .device_priv_size = sizeof(struct linux_device_priv),
2815         .device_handle_priv_size = sizeof(struct linux_device_handle_priv),
2816         .transfer_priv_size = sizeof(struct linux_transfer_priv),
2817 };