libusb/os/linux_usbfs.c

   1 /* -*- Mode: C; c-basic-offset:8 ; indent-tabs-mode:t -*- */
   2 /*
   3  * Linux usbfs backend for libusb
   4  * Copyright © 2007-2009 Daniel Drake <dsd@gentoo.org>
   5  * Copyright © 2001 Johannes Erdfelt <johannes@erdfelt.com>
   6  * Copyright © 2013 Nathan Hjelm <hjelmn@mac.com>
   7  * Copyright © 2012-2013 Hans de Goede <hdegoede@redhat.com>
   8  * Copyright © 2020 Chris Dickens <christopher.a.dickens@gmail.com>
   9  *
  10  * This library is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU Lesser General Public
  12  * License as published by the Free Software Foundation; either
  13  * version 2.1 of the License, or (at your option) any later version.
  14  *
  15  * This library is distributed in the hope that it will be useful,
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18  * Lesser General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU Lesser General Public
  21  * License along with this library; if not, write to the Free Software
  22  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  23  */
  24
  25 #include "libusbi.h"
  26 #include "linux_usbfs.h"
  27
  28 #include <alloca.h>
  29 #include <ctype.h>
  30 #include <dirent.h>
  31 #include <errno.h>
  32 #include <fcntl.h>
  33 #include <stdio.h>
  34 #include <string.h>
  35 #include <sys/ioctl.h>
  36 #include <sys/mman.h>
  37 #include <sys/utsname.h>
  38 #include <sys/vfs.h>
  39 #include <unistd.h>
  40
  41 /* sysfs vs usbfs:
  42  * opening a usbfs node causes the device to be resumed, so we attempt to
  43  * avoid this during enumeration.
  44  *
  45  * sysfs allows us to read the kernel's in-memory copies of device descriptors
  46  * and so forth, avoiding the need to open the device:
  47  *  - The binary "descriptors" file contains all config descriptors since
  48  *    2.6.26, commit 217a9081d8e69026186067711131b77f0ce219ed
  49  *  - The binary "descriptors" file was added in 2.6.23, commit
  50  *    69d42a78f935d19384d1f6e4f94b65bb162b36df, but it only contains the
  51  *    active config descriptors
  52  *  - The "busnum" file was added in 2.6.22, commit
  53  *    83f7d958eab2fbc6b159ee92bf1493924e1d0f72
  54  *  - The "devnum" file has been present since pre-2.6.18
  55  *  - the "bConfigurationValue" file has been present since pre-2.6.18
  56  *
  57  * If we have bConfigurationValue, busnum, and devnum, then we can determine
  58  * the active configuration without having to open the usbfs node in RDWR mode.
  59  * The busnum file is important as that is the only way we can relate sysfs
  60  * devices to usbfs nodes.
  61  *
  62  * If we also have all descriptors, we can obtain the device descriptor and
  63  * configuration without touching usbfs at all.
  64  */
  65
  66 /* endianness for multi-byte fields:
  67  *
  68  * Descriptors exposed by usbfs have the multi-byte fields in the device
  69  * descriptor as host endian. Multi-byte fields in the other descriptors are
  70  * bus-endian. The kernel documentation says otherwise, but it is wrong.
  71  *
  72  * In sysfs all descriptors are bus-endian.
  73  */
  74
  75 #define USBDEV_PATH             "/dev"
  76 #define USB_DEVTMPFS_PATH       "/dev/bus/usb"
  77
  78 /* use usbdev*.* device names in /dev instead of the usbfs bus directories */
  79 static int usbdev_names = 0;
  80
  81 /* Linux has changed the maximum length of an individual isochronous packet
  82  * over time.  Initially this limit was 1,023 bytes, but Linux 2.6.18
  83  * (commit 3612242e527eb47ee4756b5350f8bdf791aa5ede) increased this value to
  84  * 8,192 bytes to support higher bandwidth devices.  Linux 3.10
  85  * (commit e2e2f0ea1c935edcf53feb4c4c8fdb4f86d57dd9) further increased this
  86  * value to 49,152 bytes to support super speed devices.  Linux 5.2
  87  * (commit 8a1dbc8d91d3d1602282c7e6b4222c7759c916fa) even further increased
  88  * this value to 98,304 bytes to support super speed plus devices.
  89  */
  90 static unsigned int max_iso_packet_len = 0;
  91
  92 /* is sysfs available (mounted) ? */
  93 static int sysfs_available = -1;
  94
  95 /* how many times have we initted (and not exited) ? */
  96 static int init_count = 0;
  97
  98 #ifdef __ANDROID__
  99 /* have no authority to operate usb device directly */
 100 static int weak_authority = 0;
 101 #endif
 102
 103 /* Serialize hotplug start/stop */
 104 static usbi_mutex_static_t linux_hotplug_startstop_lock = USBI_MUTEX_INITIALIZER;
 105 /* Serialize scan-devices, event-thread, and poll */
 106 usbi_mutex_static_t linux_hotplug_lock = USBI_MUTEX_INITIALIZER;
 107
 108 static int linux_scan_devices(struct libusb_context *ctx);
 109 static int detach_kernel_driver_and_claim(struct libusb_device_handle *, uint8_t);
 110
 111 #if !defined(HAVE_LIBUDEV)
 112 static int linux_default_scan_devices(struct libusb_context *ctx);
 113 #endif
 114
 115 struct kernel_version {
 116         int major;
 117         int minor;
 118         int sublevel;
 119 };
 120
 121 struct config_descriptor {
 122         struct usbi_configuration_descriptor *desc;
 123         size_t actual_len;
 124 };
 125
 126 struct linux_device_priv {
 127         char *sysfs_dir;
 128         void *descriptors;
 129         size_t descriptors_len;
 130         struct config_descriptor *config_descriptors;
 131         uint8_t active_config; /* cache val for !sysfs_available  */
 132 };
 133
 134 struct linux_device_handle_priv {
 135         int fd;
 136         int fd_removed;
 137         int fd_keep;
 138         uint32_t caps;
 139 };
 140
 141 enum reap_action {
 142         NORMAL = 0,
 143         /* submission failed after the first URB, so await cancellation/completion
 144          * of all the others */
 145         SUBMIT_FAILED,
 146
 147         /* cancelled by user or timeout */
 148         CANCELLED,
 149
 150         /* completed multi-URB transfer in non-final URB */
 151         COMPLETED_EARLY,
 152
 153         /* one or more urbs encountered a low-level error */
 154         ERROR,
 155 };
 156
 157 struct linux_transfer_priv {
 158         union {
 159                 struct usbfs_urb *urbs;
 160                 struct usbfs_urb **iso_urbs;
 161         };
 162
 163         enum reap_action reap_action;
 164         int num_urbs;
 165         int num_retired;
 166         enum libusb_transfer_status reap_status;
 167
 168         /* next iso packet in user-supplied transfer to be populated */
 169         int iso_packet_offset;
 170 };
 171
 172 static int get_usbfs_fd(struct libusb_device *dev, mode_t mode, int silent)
 173 {
 174         struct libusb_context *ctx = DEVICE_CTX(dev);
 175         char path[24];
 176         int fd;
 177
 178         if (usbdev_names)
 179                 sprintf(path, USBDEV_PATH "/usbdev%u.%u",
 180                         dev->bus_number, dev->device_address);
 181         else
 182                 sprintf(path, USB_DEVTMPFS_PATH "/%03u/%03u",
 183                         dev->bus_number, dev->device_address);
 184
 185         fd = open(path, mode | O_CLOEXEC);
 186         if (fd != -1)
 187                 return fd; /* Success */
 188
 189         if (errno == ENOENT) {
 190                 const long delay_ms = 10L;
 191                 const struct timespec delay_ts = { 0L, delay_ms * 1000L * 1000L };
 192
 193                 if (!silent)
 194                         usbi_err(ctx, "File doesn't exist, wait %ld ms and try again", delay_ms);
 195
 196                 /* Wait 10ms for USB device path creation.*/
 197                 nanosleep(&delay_ts, NULL);
 198
 199                 fd = open(path, mode | O_CLOEXEC);
 200                 if (fd != -1)
 201                         return fd; /* Success */
 202         }
 203
 204         if (!silent) {
 205                 usbi_err(ctx, "libusb couldn't open USB device %s, errno=%d", path, errno);
 206                 if (errno == EACCES && mode == O_RDWR)
 207                         usbi_err(ctx, "libusb requires write access to USB device nodes");
 208         }
 209
 210         if (errno == EACCES)
 211                 return LIBUSB_ERROR_ACCESS;
 212         if (errno == ENOENT)
 213                 return LIBUSB_ERROR_NO_DEVICE;
 214         return LIBUSB_ERROR_IO;
 215 }
 216
 217 /* check dirent for a /dev/usbdev%d.%d name
 218  * optionally return bus/device on success */
 219 static int is_usbdev_entry(const char *name, uint8_t *bus_p, uint8_t *dev_p)
 220 {
 221         int busnum, devnum;
 222
 223         if (sscanf(name, "usbdev%d.%d", &busnum, &devnum) != 2)
 224                 return 0;
 225         if (busnum < 0 || busnum > UINT8_MAX || devnum < 0 || devnum > UINT8_MAX) {
 226                 usbi_dbg("invalid usbdev format '%s'", name);
 227                 return 0;
 228         }
 229
 230         usbi_dbg("found: %s", name);
 231         if (bus_p)
 232                 *bus_p = (uint8_t)busnum;
 233         if (dev_p)
 234                 *dev_p = (uint8_t)devnum;
 235         return 1;
 236 }
 237
 238 static const char *find_usbfs_path(void)
 239 {
 240         const char *path;
 241         DIR *dir;
 242         struct dirent *entry;
 243
 244         path = USB_DEVTMPFS_PATH;
 245         dir = opendir(path);
 246         if (dir) {
 247                 while ((entry = readdir(dir))) {
 248                         if (entry->d_name[0] == '.')
 249                                 continue;
 250
 251                         /* We assume if we find any files that it must be the right place */
 252                         break;
 253                 }
 254
 255                 closedir(dir);
 256
 257                 if (entry)
 258                         return path;
 259         }
 260
 261         /* look for /dev/usbdev*.* if the normal place fails */
 262         path = USBDEV_PATH;
 263         dir = opendir(path);
 264         if (dir) {
 265                 while ((entry = readdir(dir))) {
 266                         if (entry->d_name[0] == '.')
 267                                 continue;
 268
 269                         if (is_usbdev_entry(entry->d_name, NULL, NULL)) {
 270                                 /* found one; that's enough */
 271                                 break;
 272                         }
 273                 }
 274
 275                 closedir(dir);
 276
 277                 if (entry) {
 278                         usbdev_names = 1;
 279                         return path;
 280                 }
 281         }
 282
 283 /* On udev based systems without any usb-devices /dev/bus/usb will not
 284  * exist. So if we've not found anything and we're using udev for hotplug
 285  * simply assume /dev/bus/usb rather then making libusb_init fail.
 286  * Make the same assumption for Android where SELinux policies might block us
 287  * from reading /dev on newer devices. */
 288 #if defined(HAVE_LIBUDEV) || defined(__ANDROID__)
 289         return USB_DEVTMPFS_PATH;
 290 #else
 291         return NULL;
 292 #endif
 293 }
 294
 295 static int get_kernel_version(struct libusb_context *ctx,
 296         struct kernel_version *ver)
 297 {
 298         struct utsname uts;
 299         int atoms;
 300
 301         if (uname(&uts) < 0) {
 302                 usbi_err(ctx, "uname failed, errno=%d", errno);
 303                 return -1;
 304         }
 305
 306         atoms = sscanf(uts.release, "%d.%d.%d", &ver->major, &ver->minor, &ver->sublevel);
 307         if (atoms < 2) {
 308                 usbi_err(ctx, "failed to parse uname release '%s'", uts.release);
 309                 return -1;
 310         }
 311
 312         if (atoms < 3)
 313                 ver->sublevel = -1;
 314
 315         usbi_dbg("reported kernel version is %s", uts.release);
 316
 317         return 0;
 318 }
 319
 320 static int kernel_version_ge(const struct kernel_version *ver,
 321         int major, int minor, int sublevel)
 322 {
 323         if (ver->major > major)
 324                 return 1;
 325         else if (ver->major < major)
 326                 return 0;
 327
 328         /* kmajor == major */
 329         if (ver->minor > minor)
 330                 return 1;
 331         else if (ver->minor < minor)
 332                 return 0;
 333
 334         /* kminor == minor */
 335         if (ver->sublevel == -1)
 336                 return sublevel == 0;
 337
 338         return ver->sublevel >= sublevel;
 339 }
 340
 341 static int op_init(struct libusb_context *ctx)
 342 {
 343         struct kernel_version kversion;
 344         const char *usbfs_path;
 345         int r;
 346
 347         if (get_kernel_version(ctx, &kversion) < 0)
 348                 return LIBUSB_ERROR_OTHER;
 349
 350         if (!kernel_version_ge(&kversion, 2, 6, 32)) {
 351                 usbi_err(ctx, "kernel version is too old (reported as %d.%d.%d)",
 352                          kversion.major, kversion.minor,
 353                          kversion.sublevel != -1 ? kversion.sublevel : 0);
 354                 return LIBUSB_ERROR_NOT_SUPPORTED;
 355         }
 356
 357         usbfs_path = find_usbfs_path();
 358         if (!usbfs_path) {
 359                 usbi_err(ctx, "could not find usbfs");
 360                 return LIBUSB_ERROR_OTHER;
 361         }
 362
 363         usbi_dbg("found usbfs at %s", usbfs_path);
 364
 365         if (!max_iso_packet_len) {
 366                 if (kernel_version_ge(&kversion, 5, 2, 0))
 367                         max_iso_packet_len = 98304;
 368                 else if (kernel_version_ge(&kversion, 3, 10, 0))
 369                         max_iso_packet_len = 49152;
 370                 else
 371                         max_iso_packet_len = 8192;
 372         }
 373
 374         usbi_dbg("max iso packet length is (likely) %u bytes", max_iso_packet_len);
 375
 376         if (sysfs_available == -1) {
 377                 struct statfs statfsbuf;
 378
 379                 r = statfs(SYSFS_MOUNT_PATH, &statfsbuf);
 380                 if (r == 0 && statfsbuf.f_type == SYSFS_MAGIC) {
 381                         usbi_dbg("sysfs is available");
 382                         sysfs_available = 1;
 383                 } else {
 384                         usbi_warn(ctx, "sysfs not mounted");
 385                         sysfs_available = 0;
 386                 }
 387         }
 388
 389 #ifdef __ANDROID__
 390         if (weak_authority) {
 391                 return LIBUSB_SUCCESS;
 392         }
 393 #endif
 394
 395         usbi_mutex_static_lock(&linux_hotplug_startstop_lock);
 396         r = LIBUSB_SUCCESS;
 397         if (init_count == 0) {
 398                 /* start up hotplug event handler */
 399                 r = linux_start_event_monitor();
 400         }
 401         if (r == LIBUSB_SUCCESS) {
 402                 r = linux_scan_devices(ctx);
 403                 if (r == LIBUSB_SUCCESS)
 404                         init_count++;
 405                 else if (init_count == 0)
 406                         linux_stop_event_monitor();
 407         } else {
 408                 usbi_err(ctx, "error starting hotplug event monitor");
 409         }
 410         usbi_mutex_static_unlock(&linux_hotplug_startstop_lock);
 411
 412         return r;
 413 }
 414
 415 static void op_exit(struct libusb_context *ctx)
 416 {
 417         UNUSED(ctx);
 418
 419 #ifdef __ANDROID__
 420         if (weak_authority) {
 421                 return;
 422         }
 423 #endif
 424
 425         usbi_mutex_static_lock(&linux_hotplug_startstop_lock);
 426         assert(init_count != 0);
 427         if (!--init_count) {
 428                 /* tear down event handler */
 429                 linux_stop_event_monitor();
 430         }
 431         usbi_mutex_static_unlock(&linux_hotplug_startstop_lock);
 432 }
 433
 434 static int op_set_option(struct libusb_context *ctx, enum libusb_option option, va_list ap)
 435 {
 436         UNUSED(ctx);
 437         UNUSED(ap);
 438
 439 #ifdef __ANDROID__
 440         if (option == LIBUSB_OPTION_WEAK_AUTHORITY) {
 441                 usbi_dbg("set libusb has weak authority");
 442                 weak_authority = 1;
 443                 return LIBUSB_SUCCESS;
 444         }
 445 #else
 446         UNUSED(option);
 447 #endif
 448
 449         return LIBUSB_ERROR_NOT_SUPPORTED;
 450 }
 451
 452 static int linux_scan_devices(struct libusb_context *ctx)
 453 {
 454         int ret;
 455
 456         usbi_mutex_static_lock(&linux_hotplug_lock);
 457
 458 #if defined(HAVE_LIBUDEV)
 459         ret = linux_udev_scan_devices(ctx);
 460 #else
 461         ret = linux_default_scan_devices(ctx);
 462 #endif
 463
 464         usbi_mutex_static_unlock(&linux_hotplug_lock);
 465
 466         return ret;
 467 }
 468
 469 static void op_hotplug_poll(void)
 470 {
 471         linux_hotplug_poll();
 472 }
 473
 474 static int open_sysfs_attr(struct libusb_context *ctx,
 475         const char *sysfs_dir, const char *attr)
 476 {
 477         char filename[256];
 478         int fd;
 479
 480         snprintf(filename, sizeof(filename), SYSFS_DEVICE_PATH "/%s/%s", sysfs_dir, attr);
 481         fd = open(filename, O_RDONLY | O_CLOEXEC);
 482         if (fd < 0) {
 483                 if (errno == ENOENT) {
 484                         /* File doesn't exist. Assume the device has been
 485                            disconnected (see trac ticket #70). */
 486                         return LIBUSB_ERROR_NO_DEVICE;
 487                 }
 488                 usbi_err(ctx, "open %s failed, errno=%d", filename, errno);
 489                 return LIBUSB_ERROR_IO;
 490         }
 491
 492         return fd;
 493 }
 494
 495 /* Note only suitable for attributes which always read >= 0, < 0 is error */
 496 static int read_sysfs_attr(struct libusb_context *ctx,
 497         const char *sysfs_dir, const char *attr, int max_value, int *value_p)
 498 {
 499         char buf[20], *endptr;
 500         long value;
 501         ssize_t r;
 502         int fd;
 503
 504         fd = open_sysfs_attr(ctx, sysfs_dir, attr);
 505         if (fd < 0)
 506                 return fd;
 507
 508         r = read(fd, buf, sizeof(buf) - 1);
 509         if (r < 0) {
 510                 r = errno;
 511                 close(fd);
 512                 if (r == ENODEV)
 513                         return LIBUSB_ERROR_NO_DEVICE;
 514                 usbi_err(ctx, "attribute %s read failed, errno=%zd", attr, r);
 515                 return LIBUSB_ERROR_IO;
 516         }
 517         close(fd);
 518
 519         if (r == 0) {
 520                 /* Certain attributes (e.g. bConfigurationValue) are not
 521                  * populated if the device is not configured. */
 522                 *value_p = -1;
 523                 return 0;
 524         }
 525
 526         /* The kernel does *not* NUL-terminate the string, but every attribute
 527          * should be terminated with a newline character. */
 528         if (!isdigit(buf[0])) {
 529                 usbi_err(ctx, "attribute %s doesn't have numeric value?", attr);
 530                 return LIBUSB_ERROR_IO;
 531         } else if (buf[r - 1] != '\n') {
 532                 usbi_warn(ctx, "attribute %s doesn't end with newline?", attr);
 533         } else {
 534                 /* Remove the terminating newline character */
 535                 r--;
 536         }
 537         buf[r] = '\0';
 538
 539         errno = 0;
 540         value = strtol(buf, &endptr, 10);
 541         if (value < 0 || value > (long)max_value || errno) {
 542                 usbi_err(ctx, "attribute %s contains an invalid value: '%s'", attr, buf);
 543                 return LIBUSB_ERROR_INVALID_PARAM;
 544         } else if (*endptr != '\0') {
 545                 /* Consider the value to be valid if the remainder is a '.'
 546                  * character followed by numbers.  This occurs, for example,
 547                  * when reading the "speed" attribute for a low-speed device
 548                  * (e.g. "1.5") */
 549                 if (*endptr == '.' && isdigit(*(endptr + 1))) {
 550                         endptr++;
 551                         while (isdigit(*endptr))
 552                                 endptr++;
 553                 }
 554                 if (*endptr != '\0') {
 555                         usbi_err(ctx, "attribute %s contains an invalid value: '%s'", attr, buf);
 556                         return LIBUSB_ERROR_INVALID_PARAM;
 557                 }
 558         }
 559
 560         *value_p = (int)value;
 561         return 0;
 562 }
 563
 564 static int sysfs_scan_device(struct libusb_context *ctx, const char *devname)
 565 {
 566         uint8_t busnum, devaddr;
 567         int ret;
 568
 569         ret = linux_get_device_address(ctx, 0, &busnum, &devaddr, NULL, devname, -1);
 570         if (ret != LIBUSB_SUCCESS)
 571                 return ret;
 572
 573         return linux_enumerate_device(ctx, busnum, devaddr, devname);
 574 }
 575
 576 /* read the bConfigurationValue for a device */
 577 static int sysfs_get_active_config(struct libusb_device *dev, uint8_t *config)
 578 {
 579         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 580         int ret, tmp;
 581
 582         ret = read_sysfs_attr(DEVICE_CTX(dev), priv->sysfs_dir, "bConfigurationValue",
 583                               UINT8_MAX, &tmp);
 584         if (ret < 0)
 585                 return ret;
 586
 587         if (tmp == -1)
 588                 tmp = 0;        /* unconfigured */
 589
 590         *config = (uint8_t)tmp;
 591
 592         return 0;
 593 }
 594
 595 int linux_get_device_address(struct libusb_context *ctx, int detached,
 596         uint8_t *busnum, uint8_t *devaddr, const char *dev_node,
 597         const char *sys_name, int fd)
 598 {
 599         int sysfs_val;
 600         int r;
 601
 602         usbi_dbg("getting address for device: %s detached: %d", sys_name, detached);
 603         /* can't use sysfs to read the bus and device number if the
 604          * device has been detached */
 605         if (!sysfs_available || detached || !sys_name) {
 606                 if (!dev_node && fd >= 0) {
 607                         char *fd_path = alloca(PATH_MAX);
 608                         char proc_path[32];
 609
 610                         /* try to retrieve the device node from fd */
 611                         sprintf(proc_path, "/proc/self/fd/%d", fd);
 612                         r = readlink(proc_path, fd_path, PATH_MAX - 1);
 613                         if (r > 0) {
 614                                 fd_path[r] = '\0';
 615                                 dev_node = fd_path;
 616                         }
 617                 }
 618
 619                 if (!dev_node)
 620                         return LIBUSB_ERROR_OTHER;
 621
 622                 /* will this work with all supported kernel versions? */
 623                 if (!strncmp(dev_node, "/dev/bus/usb", 12))
 624                         sscanf(dev_node, "/dev/bus/usb/%hhu/%hhu", busnum, devaddr);
 625                 else
 626                         return LIBUSB_ERROR_OTHER;
 627
 628                 return LIBUSB_SUCCESS;
 629         }
 630
 631         usbi_dbg("scan %s", sys_name);
 632
 633         r = read_sysfs_attr(ctx, sys_name, "busnum", UINT8_MAX, &sysfs_val);
 634         if (r < 0)
 635                 return r;
 636         *busnum = (uint8_t)sysfs_val;
 637
 638         r = read_sysfs_attr(ctx, sys_name, "devnum", UINT8_MAX, &sysfs_val);
 639         if (r < 0)
 640                 return r;
 641         *devaddr = (uint8_t)sysfs_val;
 642
 643         usbi_dbg("bus=%u dev=%u", *busnum, *devaddr);
 644
 645         return LIBUSB_SUCCESS;
 646 }
 647
 648 /* Return offset of the next config descriptor */
 649 static int seek_to_next_config(struct libusb_context *ctx,
 650         uint8_t *buffer, size_t len)
 651 {
 652         struct usbi_descriptor_header *header;
 653         int offset;
 654
 655         /* Start seeking past the config descriptor */
 656         offset = LIBUSB_DT_CONFIG_SIZE;
 657         buffer += LIBUSB_DT_CONFIG_SIZE;
 658         len -= LIBUSB_DT_CONFIG_SIZE;
 659
 660         while (len > 0) {
 661                 if (len < 2) {
 662                         usbi_err(ctx, "short descriptor read %zu/2", len);
 663                         return LIBUSB_ERROR_IO;
 664                 }
 665
 666                 header = (struct usbi_descriptor_header *)buffer;
 667                 if (header->bDescriptorType == LIBUSB_DT_CONFIG)
 668                         return offset;
 669
 670                 if (len < header->bLength) {
 671                         usbi_err(ctx, "bLength overflow by %zu bytes",
 672                                  (size_t)header->bLength - len);
 673                         return LIBUSB_ERROR_IO;
 674                 }
 675
 676                 offset += header->bLength;
 677                 buffer += header->bLength;
 678                 len -= header->bLength;
 679         }
 680
 681         usbi_err(ctx, "config descriptor not found");
 682         return LIBUSB_ERROR_IO;
 683 }
 684
 685 static int parse_config_descriptors(struct libusb_device *dev)
 686 {
 687         struct libusb_context *ctx = DEVICE_CTX(dev);
 688         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 689         struct usbi_device_descriptor *device_desc;
 690         uint8_t idx, num_configs;
 691         uint8_t *buffer;
 692         size_t remaining;
 693
 694         device_desc = priv->descriptors;
 695         num_configs = device_desc->bNumConfigurations;
 696
 697         if (num_configs == 0)
 698                 return 0;       /* no configurations? */
 699
 700         priv->config_descriptors = malloc(num_configs * sizeof(priv->config_descriptors[0]));
 701         if (!priv->config_descriptors)
 702                 return LIBUSB_ERROR_NO_MEM;
 703
 704         buffer = (uint8_t *)priv->descriptors + LIBUSB_DT_DEVICE_SIZE;
 705         remaining = priv->descriptors_len - LIBUSB_DT_DEVICE_SIZE;
 706
 707         for (idx = 0; idx < num_configs; idx++) {
 708                 struct usbi_configuration_descriptor *config_desc;
 709                 uint16_t config_len;
 710
 711                 if (remaining < LIBUSB_DT_CONFIG_SIZE) {
 712                         usbi_err(ctx, "short descriptor read %zu/%d",
 713                                  remaining, LIBUSB_DT_CONFIG_SIZE);
 714                         return LIBUSB_ERROR_IO;
 715                 }
 716
 717                 config_desc = (struct usbi_configuration_descriptor *)buffer;
 718                 if (config_desc->bDescriptorType != LIBUSB_DT_CONFIG) {
 719                         usbi_err(ctx, "descriptor is not a config desc (type 0x%02x)",
 720                                  config_desc->bDescriptorType);
 721                         return LIBUSB_ERROR_IO;
 722                 } else if (config_desc->bLength < LIBUSB_DT_CONFIG_SIZE) {
 723                         usbi_err(ctx, "invalid descriptor bLength %u",
 724                                  config_desc->bLength);
 725                         return LIBUSB_ERROR_IO;
 726                 }
 727
 728                 config_len = libusb_le16_to_cpu(config_desc->wTotalLength);
 729                 if (config_len < LIBUSB_DT_CONFIG_SIZE) {
 730                         usbi_err(ctx, "invalid wTotalLength %u", config_len);
 731                         return LIBUSB_ERROR_IO;
 732                 }
 733
 734                 if (priv->sysfs_dir) {
 735                         /*
 736                          * In sysfs wTotalLength is ignored, instead the kernel returns a
 737                          * config descriptor with verified bLength fields, with descriptors
 738                          * with an invalid bLength removed.
 739                          */
 740                         uint16_t sysfs_config_len;
 741                         int offset;
 742
 743                         if (num_configs > 1 && idx < num_configs - 1) {
 744                                 offset = seek_to_next_config(ctx, buffer, remaining);
 745                                 if (offset < 0)
 746                                         return offset;
 747                                 sysfs_config_len = (uint16_t)offset;
 748                         } else {
 749                                 sysfs_config_len = (uint16_t)remaining;
 750                         }
 751
 752                         if (config_len != sysfs_config_len) {
 753                                 usbi_warn(ctx, "config length mismatch wTotalLength %u real %u",
 754                                           config_len, sysfs_config_len);
 755                                 config_len = sysfs_config_len;
 756                         }
 757                 } else {
 758                         /*
 759                          * In usbfs the config descriptors are wTotalLength bytes apart,
 760                          * with any short reads from the device appearing as holes in the file.
 761                          */
 762                         if (config_len > remaining) {
 763                                 usbi_warn(ctx, "short descriptor read %zu/%u", remaining, config_len);
 764                                 config_len = (uint16_t)remaining;
 765                         }
 766                 }
 767
 768                 priv->config_descriptors[idx].desc = config_desc;
 769                 priv->config_descriptors[idx].actual_len = config_len;
 770
 771                 buffer += config_len;
 772                 remaining -= config_len;
 773         }
 774
 775         return LIBUSB_SUCCESS;
 776 }
 777
 778 static int op_get_config_descriptor_by_value(struct libusb_device *dev,
 779         uint8_t value, void **buffer)
 780 {
 781         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 782         struct config_descriptor *config;
 783         uint8_t idx;
 784
 785         for (idx = 0; idx < dev->device_descriptor.bNumConfigurations; idx++) {
 786                 config = &priv->config_descriptors[idx];
 787                 if (config->desc->bConfigurationValue == value) {
 788                         *buffer = config->desc;
 789                         return (int)config->actual_len;
 790                 }
 791         }
 792
 793         return LIBUSB_ERROR_NOT_FOUND;
 794 }
 795
 796 static int op_get_active_config_descriptor(struct libusb_device *dev,
 797         void *buffer, size_t len)
 798 {
 799         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 800         void *config_desc;
 801         uint8_t active_config;
 802         int r;
 803
 804         if (priv->sysfs_dir) {
 805                 r = sysfs_get_active_config(dev, &active_config);
 806                 if (r < 0)
 807                         return r;
 808         } else {
 809                 /* Use cached bConfigurationValue */
 810                 active_config = priv->active_config;
 811         }
 812
 813         if (active_config == 0) {
 814                 usbi_err(DEVICE_CTX(dev), "device unconfigured");
 815                 return LIBUSB_ERROR_NOT_FOUND;
 816         }
 817
 818         r = op_get_config_descriptor_by_value(dev, active_config, &config_desc);
 819         if (r < 0)
 820                 return r;
 821
 822         len = MIN(len, (size_t)r);
 823         memcpy(buffer, config_desc, len);
 824         return len;
 825 }
 826
 827 static int op_get_config_descriptor(struct libusb_device *dev,
 828         uint8_t config_index, void *buffer, size_t len)
 829 {
 830         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 831         struct config_descriptor *config;
 832
 833         if (config_index >= dev->device_descriptor.bNumConfigurations)
 834                 return LIBUSB_ERROR_NOT_FOUND;
 835
 836         config = &priv->config_descriptors[config_index];
 837         len = MIN(len, config->actual_len);
 838         memcpy(buffer, config->desc, len);
 839         return len;
 840 }
 841
 842 /* send a control message to retrieve active configuration */
 843 static int usbfs_get_active_config(struct libusb_device *dev, int fd)
 844 {
 845         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 846         uint8_t active_config = 0;
 847         int r;
 848
 849         struct usbfs_ctrltransfer ctrl = {
 850                 .bmRequestType = LIBUSB_ENDPOINT_IN,
 851                 .bRequest = LIBUSB_REQUEST_GET_CONFIGURATION,
 852                 .wValue = 0,
 853                 .wIndex = 0,
 854                 .wLength = 1,
 855                 .timeout = 1000,
 856                 .data = &active_config
 857         };
 858
 859         r = ioctl(fd, IOCTL_USBFS_CONTROL, &ctrl);
 860         if (r < 0) {
 861                 if (errno == ENODEV)
 862                         return LIBUSB_ERROR_NO_DEVICE;
 863
 864                 /* we hit this error path frequently with buggy devices :( */
 865                 usbi_warn(DEVICE_CTX(dev), "get configuration failed, errno=%d", errno);
 866         } else if (active_config == 0) {
 867                 /* some buggy devices have a configuration 0, but we're
 868                  * reaching into the corner of a corner case here, so let's
 869                  * not support buggy devices in these circumstances.
 870                  * stick to the specs: a configuration value of 0 means
 871                  * unconfigured. */
 872                 usbi_warn(DEVICE_CTX(dev), "active cfg 0? assuming unconfigured device");
 873         }
 874
 875         priv->active_config = active_config;
 876
 877         return LIBUSB_SUCCESS;
 878 }
 879
 880 static enum libusb_speed usbfs_get_speed(struct libusb_context *ctx, int fd)
 881 {
 882         int r;
 883
 884         r = ioctl(fd, IOCTL_USBFS_GET_SPEED, NULL);
 885         switch (r) {
 886         case USBFS_SPEED_UNKNOWN:       return LIBUSB_SPEED_UNKNOWN;
 887         case USBFS_SPEED_LOW:           return LIBUSB_SPEED_LOW;
 888         case USBFS_SPEED_FULL:          return LIBUSB_SPEED_FULL;
 889         case USBFS_SPEED_HIGH:          return LIBUSB_SPEED_HIGH;
 890         case USBFS_SPEED_WIRELESS:      return LIBUSB_SPEED_HIGH;
 891         case USBFS_SPEED_SUPER:         return LIBUSB_SPEED_SUPER;
 892         case USBFS_SPEED_SUPER_PLUS:    return LIBUSB_SPEED_SUPER_PLUS;
 893         default:
 894                 usbi_warn(ctx, "Error getting device speed: %d", r);
 895         }
 896
 897         return LIBUSB_SPEED_UNKNOWN;
 898 }
 899
 900 static int initialize_device(struct libusb_device *dev, uint8_t busnum,
 901         uint8_t devaddr, const char *sysfs_dir, int wrapped_fd)
 902 {
 903         struct linux_device_priv *priv = usbi_get_device_priv(dev);
 904         struct libusb_context *ctx = DEVICE_CTX(dev);
 905         size_t alloc_len;
 906         int fd, speed, r;
 907         ssize_t nb;
 908
 909         dev->bus_number = busnum;
 910         dev->device_address = devaddr;
 911
 912         if (sysfs_dir) {
 913                 priv->sysfs_dir = strdup(sysfs_dir);
 914                 if (!priv->sysfs_dir)
 915                         return LIBUSB_ERROR_NO_MEM;
 916
 917                 /* Note speed can contain 1.5, in this case read_sysfs_attr()
 918                    will stop parsing at the '.' and return 1 */
 919                 if (read_sysfs_attr(ctx, sysfs_dir, "speed", INT_MAX, &speed) == 0) {
 920                         switch (speed) {
 921                         case     1: dev->speed = LIBUSB_SPEED_LOW; break;
 922                         case    12: dev->speed = LIBUSB_SPEED_FULL; break;
 923                         case   480: dev->speed = LIBUSB_SPEED_HIGH; break;
 924                         case  5000: dev->speed = LIBUSB_SPEED_SUPER; break;
 925                         case 10000: dev->speed = LIBUSB_SPEED_SUPER_PLUS; break;
 926                         default:
 927                                 usbi_warn(ctx, "unknown device speed: %d Mbps", speed);
 928                         }
 929                 }
 930         } else if (wrapped_fd >= 0) {
 931                 dev->speed = usbfs_get_speed(ctx, wrapped_fd);
 932         }
 933
 934         /* cache descriptors in memory */
 935         if (sysfs_dir) {
 936                 fd = open_sysfs_attr(ctx, sysfs_dir, "descriptors");
 937         } else if (wrapped_fd < 0) {
 938                 fd = get_usbfs_fd(dev, O_RDONLY, 0);
 939         } else {
 940                 fd = wrapped_fd;
 941                 r = lseek(fd, 0, SEEK_SET);
 942                 if (r < 0) {
 943                         usbi_err(ctx, "lseek failed, errno=%d", errno);
 944                         return LIBUSB_ERROR_IO;
 945                 }
 946         }
 947         if (fd < 0)
 948                 return fd;
 949
 950         alloc_len = 0;
 951         do {
 952                 const size_t desc_read_length = 256;
 953                 uint8_t *read_ptr;
 954
 955                 alloc_len += desc_read_length;
 956                 priv->descriptors = usbi_reallocf(priv->descriptors, alloc_len);
 957                 if (!priv->descriptors) {
 958                         if (fd != wrapped_fd)
 959                                 close(fd);
 960                         return LIBUSB_ERROR_NO_MEM;
 961                 }
 962                 read_ptr = (uint8_t *)priv->descriptors + priv->descriptors_len;
 963                 /* usbfs has holes in the file */
 964                 if (!sysfs_dir)
 965                         memset(read_ptr, 0, desc_read_length);
 966                 nb = read(fd, read_ptr, desc_read_length);
 967                 if (nb < 0) {
 968                         usbi_err(ctx, "read descriptor failed, errno=%d", errno);
 969                         if (fd != wrapped_fd)
 970                                 close(fd);
 971                         return LIBUSB_ERROR_IO;
 972                 }
 973                 priv->descriptors_len += (size_t)nb;
 974         } while (priv->descriptors_len == alloc_len);
 975
 976         if (fd != wrapped_fd)
 977                 close(fd);
 978
 979         if (priv->descriptors_len < LIBUSB_DT_DEVICE_SIZE) {
 980                 usbi_err(ctx, "short descriptor read (%zu)", priv->descriptors_len);
 981                 return LIBUSB_ERROR_IO;
 982         }
 983
 984         r = parse_config_descriptors(dev);
 985         if (r < 0)
 986                 return r;
 987
 988         memcpy(&dev->device_descriptor, priv->descriptors, LIBUSB_DT_DEVICE_SIZE);
 989
 990         if (sysfs_dir) {
 991                 /* sysfs descriptors are in bus-endian format */
 992                 usbi_localize_device_descriptor(&dev->device_descriptor);
 993                 return LIBUSB_SUCCESS;
 994         }
 995
 996         /* cache active config */
 997         if (wrapped_fd < 0)
 998                 fd = get_usbfs_fd(dev, O_RDWR, 1);
 999         else
1000                 fd = wrapped_fd;
1001         if (fd < 0) {
1002                 /* cannot send a control message to determine the active
1003                  * config. just assume the first one is active. */
1004                 usbi_warn(ctx, "Missing rw usbfs access; cannot determine "
1005                                "active configuration descriptor");
1006                 if (priv->config_descriptors)
1007                         priv->active_config = priv->config_descriptors[0].desc->bConfigurationValue;
1008                 else
1009                         priv->active_config = 0; /* No config dt */
1010
1011                 return LIBUSB_SUCCESS;
1012         }
1013
1014         r = usbfs_get_active_config(dev, fd);
1015         if (fd != wrapped_fd)
1016                 close(fd);
1017
1018         return r;
1019 }
1020
1021 static int linux_get_parent_info(struct libusb_device *dev, const char *sysfs_dir)
1022 {
1023         struct libusb_context *ctx = DEVICE_CTX(dev);
1024         struct libusb_device *it;
1025         char *parent_sysfs_dir, *tmp;
1026         int ret, add_parent = 1;
1027
1028         /* XXX -- can we figure out the topology when using usbfs? */
1029         if (!sysfs_dir || !strncmp(sysfs_dir, "usb", 3)) {
1030                 /* either using usbfs or finding the parent of a root hub */
1031                 return LIBUSB_SUCCESS;
1032         }
1033
1034         parent_sysfs_dir = strdup(sysfs_dir);
1035         if (!parent_sysfs_dir)
1036                 return LIBUSB_ERROR_NO_MEM;
1037
1038         if ((tmp = strrchr(parent_sysfs_dir, '.')) ||
1039             (tmp = strrchr(parent_sysfs_dir, '-'))) {
1040                 dev->port_number = atoi(tmp + 1);
1041                 *tmp = '\0';
1042         } else {
1043                 usbi_warn(ctx, "Can not parse sysfs_dir: %s, no parent info",
1044                           parent_sysfs_dir);
1045                 free(parent_sysfs_dir);
1046                 return LIBUSB_SUCCESS;
1047         }
1048
1049         /* is the parent a root hub? */
1050         if (!strchr(parent_sysfs_dir, '-')) {
1051                 tmp = parent_sysfs_dir;
1052                 ret = asprintf(&parent_sysfs_dir, "usb%s", tmp);
1053                 free(tmp);
1054                 if (ret < 0)
1055                         return LIBUSB_ERROR_NO_MEM;
1056         }
1057
1058 retry:
1059         /* find the parent in the context */
1060         usbi_mutex_lock(&ctx->usb_devs_lock);
1061         for_each_device(ctx, it) {
1062                 struct linux_device_priv *priv = usbi_get_device_priv(it);
1063
1064                 if (priv->sysfs_dir) {
1065                         if (!strcmp(priv->sysfs_dir, parent_sysfs_dir)) {
1066                                 dev->parent_dev = libusb_ref_device(it);
1067                                 break;
1068                         }
1069                 }
1070         }
1071         usbi_mutex_unlock(&ctx->usb_devs_lock);
1072
1073         if (!dev->parent_dev && add_parent) {
1074                 usbi_dbg("parent_dev %s not enumerated yet, enumerating now",
1075                          parent_sysfs_dir);
1076                 sysfs_scan_device(ctx, parent_sysfs_dir);
1077                 add_parent = 0;
1078                 goto retry;
1079         }
1080
1081         usbi_dbg("dev %p (%s) has parent %p (%s) port %u", dev, sysfs_dir,
1082                  dev->parent_dev, parent_sysfs_dir, dev->port_number);
1083
1084         free(parent_sysfs_dir);
1085
1086         return LIBUSB_SUCCESS;
1087 }
1088
1089 int linux_enumerate_device(struct libusb_context *ctx,
1090         uint8_t busnum, uint8_t devaddr, const char *sysfs_dir)
1091 {
1092         unsigned long session_id;
1093         struct libusb_device *dev;
1094         int r;
1095
1096         /* FIXME: session ID is not guaranteed unique as addresses can wrap and
1097          * will be reused. instead we should add a simple sysfs attribute with
1098          * a session ID. */
1099         session_id = busnum << 8 | devaddr;
1100         usbi_dbg("busnum %u devaddr %u session_id %lu", busnum, devaddr, session_id);
1101
1102         dev = usbi_get_device_by_session_id(ctx, session_id);
1103         if (dev) {
1104                 /* device already exists in the context */
1105                 usbi_dbg("session_id %lu already exists", session_id);
1106                 libusb_unref_device(dev);
1107                 return LIBUSB_SUCCESS;
1108         }
1109
1110         usbi_dbg("allocating new device for %u/%u (session %lu)",
1111                  busnum, devaddr, session_id);
1112         dev = usbi_alloc_device(ctx, session_id);
1113         if (!dev)
1114                 return LIBUSB_ERROR_NO_MEM;
1115
1116         r = initialize_device(dev, busnum, devaddr, sysfs_dir, -1);
1117         if (r < 0)
1118                 goto out;
1119         r = usbi_sanitize_device(dev);
1120         if (r < 0)
1121                 goto out;
1122
1123         r = linux_get_parent_info(dev, sysfs_dir);
1124         if (r < 0)
1125                 goto out;
1126 out:
1127         if (r < 0)
1128                 libusb_unref_device(dev);
1129         else
1130                 usbi_connect_device(dev);
1131
1132         return r;
1133 }
1134
1135 void linux_hotplug_enumerate(uint8_t busnum, uint8_t devaddr, const char *sys_name)
1136 {
1137         struct libusb_context *ctx;
1138
1139         usbi_mutex_static_lock(&active_contexts_lock);
1140         for_each_context(ctx) {
1141                 linux_enumerate_device(ctx, busnum, devaddr, sys_name);
1142         }
1143         usbi_mutex_static_unlock(&active_contexts_lock);
1144 }
1145
1146 void linux_device_disconnected(uint8_t busnum, uint8_t devaddr)
1147 {
1148         struct libusb_context *ctx;
1149         struct libusb_device *dev;
1150         unsigned long session_id = busnum << 8 | devaddr;
1151
1152         usbi_mutex_static_lock(&active_contexts_lock);
1153         for_each_context(ctx) {
1154                 dev = usbi_get_device_by_session_id(ctx, session_id);
1155                 if (dev) {
1156                         usbi_disconnect_device(dev);
1157                         libusb_unref_device(dev);
1158                 } else {
1159                         usbi_dbg("device not found for session %lx", session_id);
1160                 }
1161         }
1162         usbi_mutex_static_unlock(&active_contexts_lock);
1163 }
1164
1165 #if !defined(HAVE_LIBUDEV)
1166 static int parse_u8(const char *str, uint8_t *val_p)
1167 {
1168         char *endptr;
1169         long num;
1170
1171         errno = 0;
1172         num = strtol(str, &endptr, 10);
1173         if (num < 0 || num > UINT8_MAX || errno)
1174                 return 0;
1175         if (endptr == str || *endptr != '\0')
1176                 return 0;
1177
1178         *val_p = (uint8_t)num;
1179         return 1;
1180 }
1181
1182 /* open a bus directory and adds all discovered devices to the context */
1183 static int usbfs_scan_busdir(struct libusb_context *ctx, uint8_t busnum)
1184 {
1185         DIR *dir;
1186         char dirpath[20];
1187         struct dirent *entry;
1188         int r = LIBUSB_ERROR_IO;
1189
1190         sprintf(dirpath, USB_DEVTMPFS_PATH "/%03u", busnum);
1191         usbi_dbg("%s", dirpath);
1192         dir = opendir(dirpath);
1193         if (!dir) {
1194                 usbi_err(ctx, "opendir '%s' failed, errno=%d", dirpath, errno);
1195                 /* FIXME: should handle valid race conditions like hub unplugged
1196                  * during directory iteration - this is not an error */
1197                 return r;
1198         }
1199
1200         while ((entry = readdir(dir))) {
1201                 uint8_t devaddr;
1202
1203                 if (entry->d_name[0] == '.')
1204                         continue;
1205
1206                 if (!parse_u8(entry->d_name, &devaddr)) {
1207                         usbi_dbg("unknown dir entry %s", entry->d_name);
1208                         continue;
1209                 }
1210
1211                 if (linux_enumerate_device(ctx, busnum, devaddr, NULL)) {
1212                         usbi_dbg("failed to enumerate dir entry %s", entry->d_name);
1213                         continue;
1214                 }
1215
1216                 r = 0;
1217         }
1218
1219         closedir(dir);
1220         return r;
1221 }
1222
1223 static int usbfs_get_device_list(struct libusb_context *ctx)
1224 {
1225         struct dirent *entry;
1226         DIR *buses;
1227         uint8_t busnum, devaddr;
1228         int r = 0;
1229
1230         if (usbdev_names)
1231                 buses = opendir(USBDEV_PATH);
1232         else
1233                 buses = opendir(USB_DEVTMPFS_PATH);
1234
1235         if (!buses) {
1236                 usbi_err(ctx, "opendir buses failed, errno=%d", errno);
1237                 return LIBUSB_ERROR_IO;
1238         }
1239
1240         while ((entry = readdir(buses))) {
1241                 if (entry->d_name[0] == '.')
1242                         continue;
1243
1244                 if (usbdev_names) {
1245                         if (!is_usbdev_entry(entry->d_name, &busnum, &devaddr))
1246                                 continue;
1247
1248                         r = linux_enumerate_device(ctx, busnum, devaddr, NULL);
1249                         if (r < 0) {
1250                                 usbi_dbg("failed to enumerate dir entry %s", entry->d_name);
1251                                 continue;
1252                         }
1253                 } else {
1254                         if (!parse_u8(entry->d_name, &busnum)) {
1255                                 usbi_dbg("unknown dir entry %s", entry->d_name);
1256                                 continue;
1257                         }
1258
1259                         r = usbfs_scan_busdir(ctx, busnum);
1260                         if (r < 0)
1261                                 break;
1262                 }
1263         }
1264
1265         closedir(buses);
1266         return r;
1267
1268 }
1269
1270 static int sysfs_get_device_list(struct libusb_context *ctx)
1271 {
1272         DIR *devices = opendir(SYSFS_DEVICE_PATH);
1273         struct dirent *entry;
1274         int num_devices = 0;
1275         int num_enumerated = 0;
1276
1277         if (!devices) {
1278                 usbi_err(ctx, "opendir devices failed, errno=%d", errno);
1279                 return LIBUSB_ERROR_IO;
1280         }
1281
1282         while ((entry = readdir(devices))) {
1283                 if ((!isdigit(entry->d_name[0]) && strncmp(entry->d_name, "usb", 3))
1284                     || strchr(entry->d_name, ':'))
1285                         continue;
1286
1287                 num_devices++;
1288
1289                 if (sysfs_scan_device(ctx, entry->d_name)) {
1290                         usbi_dbg("failed to enumerate dir entry %s", entry->d_name);
1291                         continue;
1292                 }
1293
1294                 num_enumerated++;
1295         }
1296
1297         closedir(devices);
1298
1299         /* successful if at least one device was enumerated or no devices were found */
1300         if (num_enumerated || !num_devices)
1301                 return LIBUSB_SUCCESS;
1302         else
1303                 return LIBUSB_ERROR_IO;
1304 }
1305
1306 static int linux_default_scan_devices(struct libusb_context *ctx)
1307 {
1308         /* we can retrieve device list and descriptors from sysfs or usbfs.
1309          * sysfs is preferable, because if we use usbfs we end up resuming
1310          * any autosuspended USB devices. however, sysfs is not available
1311          * everywhere, so we need a usbfs fallback too.
1312          */
1313         if (sysfs_available)
1314                 return sysfs_get_device_list(ctx);
1315         else
1316                 return usbfs_get_device_list(ctx);
1317 }
1318 #endif
1319
1320 static int initialize_handle(struct libusb_device_handle *handle, int fd)
1321 {
1322         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1323         int r;
1324
1325         hpriv->fd = fd;
1326
1327         r = ioctl(fd, IOCTL_USBFS_GET_CAPABILITIES, &hpriv->caps);
1328         if (r < 0) {
1329                 if (errno == ENOTTY)
1330                         usbi_dbg("getcap not available");
1331                 else
1332                         usbi_err(HANDLE_CTX(handle), "getcap failed, errno=%d", errno);
1333                 hpriv->caps = USBFS_CAP_BULK_CONTINUATION;
1334         }
1335
1336         return usbi_add_event_source(HANDLE_CTX(handle), hpriv->fd, POLLOUT);
1337 }
1338
1339 static int op_wrap_sys_device(struct libusb_context *ctx,
1340         struct libusb_device_handle *handle, intptr_t sys_dev)
1341 {
1342         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1343         int fd = (int)sys_dev;
1344         uint8_t busnum, devaddr;
1345         struct usbfs_connectinfo ci;
1346         struct libusb_device *dev;
1347         int r;
1348
1349         r = linux_get_device_address(ctx, 1, &busnum, &devaddr, NULL, NULL, fd);
1350         if (r < 0) {
1351                 r = ioctl(fd, IOCTL_USBFS_CONNECTINFO, &ci);
1352                 if (r < 0) {
1353                         usbi_err(ctx, "connectinfo failed, errno=%d", errno);
1354                         return LIBUSB_ERROR_IO;
1355                 }
1356                 /* There is no ioctl to get the bus number. We choose 0 here
1357                  * as linux starts numbering buses from 1. */
1358                 busnum = 0;
1359                 devaddr = ci.devnum;
1360         }
1361
1362         /* Session id is unused as we do not add the device to the list of
1363          * connected devices. */
1364         usbi_dbg("allocating new device for fd %d", fd);
1365         dev = usbi_alloc_device(ctx, 0);
1366         if (!dev)
1367                 return LIBUSB_ERROR_NO_MEM;
1368
1369         r = initialize_device(dev, busnum, devaddr, NULL, fd);
1370         if (r < 0)
1371                 goto out;
1372         r = usbi_sanitize_device(dev);
1373         if (r < 0)
1374                 goto out;
1375         /* Consider the device as connected, but do not add it to the managed
1376          * device list. */
1377         usbi_atomic_store(&dev->attached, 1);
1378         handle->dev = dev;
1379
1380         r = initialize_handle(handle, fd);
1381         hpriv->fd_keep = 1;
1382
1383 out:
1384         if (r < 0)
1385                 libusb_unref_device(dev);
1386         return r;
1387 }
1388
1389 static int op_open(struct libusb_device_handle *handle)
1390 {
1391         int fd, r;
1392
1393         fd = get_usbfs_fd(handle->dev, O_RDWR, 0);
1394         if (fd < 0) {
1395                 if (fd == LIBUSB_ERROR_NO_DEVICE) {
1396                         /* device will still be marked as attached if hotplug monitor thread
1397                          * hasn't processed remove event yet */
1398                         usbi_mutex_static_lock(&linux_hotplug_lock);
1399                         if (usbi_atomic_load(&handle->dev->attached)) {
1400                                 usbi_dbg("open failed with no device, but device still attached");
1401                                 linux_device_disconnected(handle->dev->bus_number,
1402                                                           handle->dev->device_address);
1403                         }
1404                         usbi_mutex_static_unlock(&linux_hotplug_lock);
1405                 }
1406                 return fd;
1407         }
1408
1409         r = initialize_handle(handle, fd);
1410         if (r < 0)
1411                 close(fd);
1412
1413         return r;
1414 }
1415
1416 static void op_close(struct libusb_device_handle *dev_handle)
1417 {
1418         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(dev_handle);
1419
1420         /* fd may have already been removed by POLLERR condition in op_handle_events() */
1421         if (!hpriv->fd_removed)
1422                 usbi_remove_event_source(HANDLE_CTX(dev_handle), hpriv->fd);
1423         if (!hpriv->fd_keep)
1424                 close(hpriv->fd);
1425 }
1426
1427 static int op_get_configuration(struct libusb_device_handle *handle,
1428         uint8_t *config)
1429 {
1430         struct linux_device_priv *priv = usbi_get_device_priv(handle->dev);
1431         int r;
1432
1433         if (priv->sysfs_dir) {
1434                 r = sysfs_get_active_config(handle->dev, config);
1435         } else {
1436                 struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1437
1438                 r = usbfs_get_active_config(handle->dev, hpriv->fd);
1439                 if (r == LIBUSB_SUCCESS)
1440                         *config = priv->active_config;
1441         }
1442         if (r < 0)
1443                 return r;
1444
1445         if (*config == 0)
1446                 usbi_err(HANDLE_CTX(handle), "device unconfigured");
1447
1448         return 0;
1449 }
1450
1451 static int op_set_configuration(struct libusb_device_handle *handle, int config)
1452 {
1453         struct linux_device_priv *priv = usbi_get_device_priv(handle->dev);
1454         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1455         int fd = hpriv->fd;
1456         int r = ioctl(fd, IOCTL_USBFS_SETCONFIGURATION, &config);
1457
1458         if (r < 0) {
1459                 if (errno == EINVAL)
1460                         return LIBUSB_ERROR_NOT_FOUND;
1461                 else if (errno == EBUSY)
1462                         return LIBUSB_ERROR_BUSY;
1463                 else if (errno == ENODEV)
1464                         return LIBUSB_ERROR_NO_DEVICE;
1465
1466                 usbi_err(HANDLE_CTX(handle), "set configuration failed, errno=%d", errno);
1467                 return LIBUSB_ERROR_OTHER;
1468         }
1469
1470         if (config == -1)
1471                 config = 0;
1472
1473         /* update our cached active config descriptor */
1474         priv->active_config = (uint8_t)config;
1475
1476         return LIBUSB_SUCCESS;
1477 }
1478
1479 static int claim_interface(struct libusb_device_handle *handle, unsigned int iface)
1480 {
1481         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1482         int fd = hpriv->fd;
1483         int r = ioctl(fd, IOCTL_USBFS_CLAIMINTERFACE, &iface);
1484
1485         if (r < 0) {
1486                 if (errno == ENOENT)
1487                         return LIBUSB_ERROR_NOT_FOUND;
1488                 else if (errno == EBUSY)
1489                         return LIBUSB_ERROR_BUSY;
1490                 else if (errno == ENODEV)
1491                         return LIBUSB_ERROR_NO_DEVICE;
1492
1493                 usbi_err(HANDLE_CTX(handle), "claim interface failed, errno=%d", errno);
1494                 return LIBUSB_ERROR_OTHER;
1495         }
1496         return 0;
1497 }
1498
1499 static int release_interface(struct libusb_device_handle *handle, unsigned int iface)
1500 {
1501         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1502         int fd = hpriv->fd;
1503         int r = ioctl(fd, IOCTL_USBFS_RELEASEINTERFACE, &iface);
1504
1505         if (r < 0) {
1506                 if (errno == ENODEV)
1507                         return LIBUSB_ERROR_NO_DEVICE;
1508
1509                 usbi_err(HANDLE_CTX(handle), "release interface failed, errno=%d", errno);
1510                 return LIBUSB_ERROR_OTHER;
1511         }
1512         return 0;
1513 }
1514
1515 static int op_set_interface(struct libusb_device_handle *handle, uint8_t interface,
1516         uint8_t altsetting)
1517 {
1518         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1519         int fd = hpriv->fd;
1520         struct usbfs_setinterface setintf;
1521         int r;
1522
1523         setintf.interface = interface;
1524         setintf.altsetting = altsetting;
1525         r = ioctl(fd, IOCTL_USBFS_SETINTERFACE, &setintf);
1526         if (r < 0) {
1527                 if (errno == EINVAL)
1528                         return LIBUSB_ERROR_NOT_FOUND;
1529                 else if (errno == ENODEV)
1530                         return LIBUSB_ERROR_NO_DEVICE;
1531
1532                 usbi_err(HANDLE_CTX(handle), "set interface failed, errno=%d", errno);
1533                 return LIBUSB_ERROR_OTHER;
1534         }
1535
1536         return 0;
1537 }
1538
1539 static int op_clear_halt(struct libusb_device_handle *handle,
1540         unsigned char endpoint)
1541 {
1542         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1543         int fd = hpriv->fd;
1544         unsigned int _endpoint = endpoint;
1545         int r = ioctl(fd, IOCTL_USBFS_CLEAR_HALT, &_endpoint);
1546
1547         if (r < 0) {
1548                 if (errno == ENOENT)
1549                         return LIBUSB_ERROR_NOT_FOUND;
1550                 else if (errno == ENODEV)
1551                         return LIBUSB_ERROR_NO_DEVICE;
1552
1553                 usbi_err(HANDLE_CTX(handle), "clear halt failed, errno=%d", errno);
1554                 return LIBUSB_ERROR_OTHER;
1555         }
1556
1557         return 0;
1558 }
1559
1560 static int op_reset_device(struct libusb_device_handle *handle)
1561 {
1562         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1563         int fd = hpriv->fd;
1564         int r, ret = 0;
1565         uint8_t i;
1566
1567         /* Doing a device reset will cause the usbfs driver to get unbound
1568          * from any interfaces it is bound to. By voluntarily unbinding
1569          * the usbfs driver ourself, we stop the kernel from rebinding
1570          * the interface after reset (which would end up with the interface
1571          * getting bound to the in kernel driver if any). */
1572         for (i = 0; i < USB_MAXINTERFACES; i++) {
1573                 if (handle->claimed_interfaces & (1UL << i))
1574                         release_interface(handle, i);
1575         }
1576
1577         usbi_mutex_lock(&handle->lock);
1578         r = ioctl(fd, IOCTL_USBFS_RESET, NULL);
1579         if (r < 0) {
1580                 if (errno == ENODEV) {
1581                         ret = LIBUSB_ERROR_NOT_FOUND;
1582                         goto out;
1583                 }
1584
1585                 usbi_err(HANDLE_CTX(handle), "reset failed, errno=%d", errno);
1586                 ret = LIBUSB_ERROR_OTHER;
1587                 goto out;
1588         }
1589
1590         /* And re-claim any interfaces which were claimed before the reset */
1591         for (i = 0; i < USB_MAXINTERFACES; i++) {
1592                 if (!(handle->claimed_interfaces & (1UL << i)))
1593                         continue;
1594                 /*
1595                  * A driver may have completed modprobing during
1596                  * IOCTL_USBFS_RESET, and bound itself as soon as
1597                  * IOCTL_USBFS_RESET released the device lock
1598                  */
1599                 r = detach_kernel_driver_and_claim(handle, i);
1600                 if (r) {
1601                         usbi_warn(HANDLE_CTX(handle), "failed to re-claim interface %u after reset: %s",
1602                                   i, libusb_error_name(r));
1603                         handle->claimed_interfaces &= ~(1UL << i);
1604                         ret = LIBUSB_ERROR_NOT_FOUND;
1605                 }
1606         }
1607 out:
1608         usbi_mutex_unlock(&handle->lock);
1609         return ret;
1610 }
1611
1612 static int do_streams_ioctl(struct libusb_device_handle *handle, long req,
1613         uint32_t num_streams, unsigned char *endpoints, int num_endpoints)
1614 {
1615         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1616         int r, fd = hpriv->fd;
1617         struct usbfs_streams *streams;
1618
1619         if (num_endpoints > 30) /* Max 15 in + 15 out eps */
1620                 return LIBUSB_ERROR_INVALID_PARAM;
1621
1622         streams = malloc(sizeof(*streams) + num_endpoints);
1623         if (!streams)
1624                 return LIBUSB_ERROR_NO_MEM;
1625
1626         streams->num_streams = num_streams;
1627         streams->num_eps = num_endpoints;
1628         memcpy(streams->eps, endpoints, num_endpoints);
1629
1630         r = ioctl(fd, req, streams);
1631
1632         free(streams);
1633
1634         if (r < 0) {
1635                 if (errno == ENOTTY)
1636                         return LIBUSB_ERROR_NOT_SUPPORTED;
1637                 else if (errno == EINVAL)
1638                         return LIBUSB_ERROR_INVALID_PARAM;
1639                 else if (errno == ENODEV)
1640                         return LIBUSB_ERROR_NO_DEVICE;
1641
1642                 usbi_err(HANDLE_CTX(handle), "streams-ioctl failed, errno=%d", errno);
1643                 return LIBUSB_ERROR_OTHER;
1644         }
1645         return r;
1646 }
1647
1648 static int op_alloc_streams(struct libusb_device_handle *handle,
1649         uint32_t num_streams, unsigned char *endpoints, int num_endpoints)
1650 {
1651         return do_streams_ioctl(handle, IOCTL_USBFS_ALLOC_STREAMS,
1652                                 num_streams, endpoints, num_endpoints);
1653 }
1654
1655 static int op_free_streams(struct libusb_device_handle *handle,
1656                 unsigned char *endpoints, int num_endpoints)
1657 {
1658         return do_streams_ioctl(handle, IOCTL_USBFS_FREE_STREAMS, 0,
1659                                 endpoints, num_endpoints);
1660 }
1661
1662 static void *op_dev_mem_alloc(struct libusb_device_handle *handle, size_t len)
1663 {
1664         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1665         void *buffer;
1666
1667         buffer = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, hpriv->fd, 0);
1668         if (buffer == MAP_FAILED) {
1669                 usbi_err(HANDLE_CTX(handle), "alloc dev mem failed, errno=%d", errno);
1670                 return NULL;
1671         }
1672         return buffer;
1673 }
1674
1675 static int op_dev_mem_free(struct libusb_device_handle *handle, void *buffer,
1676         size_t len)
1677 {
1678         if (munmap(buffer, len) != 0) {
1679                 usbi_err(HANDLE_CTX(handle), "free dev mem failed, errno=%d", errno);
1680                 return LIBUSB_ERROR_OTHER;
1681         } else {
1682                 return LIBUSB_SUCCESS;
1683         }
1684 }
1685
1686 static int op_kernel_driver_active(struct libusb_device_handle *handle,
1687         uint8_t interface)
1688 {
1689         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1690         int fd = hpriv->fd;
1691         struct usbfs_getdriver getdrv;
1692         int r;
1693
1694         getdrv.interface = interface;
1695         r = ioctl(fd, IOCTL_USBFS_GETDRIVER, &getdrv);
1696         if (r < 0) {
1697                 if (errno == ENODATA)
1698                         return 0;
1699                 else if (errno == ENODEV)
1700                         return LIBUSB_ERROR_NO_DEVICE;
1701
1702                 usbi_err(HANDLE_CTX(handle), "get driver failed, errno=%d", errno);
1703                 return LIBUSB_ERROR_OTHER;
1704         }
1705
1706         return strcmp(getdrv.driver, "usbfs") != 0;
1707 }
1708
1709 static int op_detach_kernel_driver(struct libusb_device_handle *handle,
1710         uint8_t interface)
1711 {
1712         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1713         int fd = hpriv->fd;
1714         struct usbfs_ioctl command;
1715         struct usbfs_getdriver getdrv;
1716         int r;
1717
1718         command.ifno = interface;
1719         command.ioctl_code = IOCTL_USBFS_DISCONNECT;
1720         command.data = NULL;
1721
1722         getdrv.interface = interface;
1723         r = ioctl(fd, IOCTL_USBFS_GETDRIVER, &getdrv);
1724         if (r == 0 && !strcmp(getdrv.driver, "usbfs"))
1725                 return LIBUSB_ERROR_NOT_FOUND;
1726
1727         r = ioctl(fd, IOCTL_USBFS_IOCTL, &command);
1728         if (r < 0) {
1729                 if (errno == ENODATA)
1730                         return LIBUSB_ERROR_NOT_FOUND;
1731                 else if (errno == EINVAL)
1732                         return LIBUSB_ERROR_INVALID_PARAM;
1733                 else if (errno == ENODEV)
1734                         return LIBUSB_ERROR_NO_DEVICE;
1735
1736                 usbi_err(HANDLE_CTX(handle), "detach failed, errno=%d", errno);
1737                 return LIBUSB_ERROR_OTHER;
1738         }
1739
1740         return 0;
1741 }
1742
1743 static int op_attach_kernel_driver(struct libusb_device_handle *handle,
1744         uint8_t interface)
1745 {
1746         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1747         int fd = hpriv->fd;
1748         struct usbfs_ioctl command;
1749         int r;
1750
1751         command.ifno = interface;
1752         command.ioctl_code = IOCTL_USBFS_CONNECT;
1753         command.data = NULL;
1754
1755         r = ioctl(fd, IOCTL_USBFS_IOCTL, &command);
1756         if (r < 0) {
1757                 if (errno == ENODATA)
1758                         return LIBUSB_ERROR_NOT_FOUND;
1759                 else if (errno == EINVAL)
1760                         return LIBUSB_ERROR_INVALID_PARAM;
1761                 else if (errno == ENODEV)
1762                         return LIBUSB_ERROR_NO_DEVICE;
1763                 else if (errno == EBUSY)
1764                         return LIBUSB_ERROR_BUSY;
1765
1766                 usbi_err(HANDLE_CTX(handle), "attach failed, errno=%d", errno);
1767                 return LIBUSB_ERROR_OTHER;
1768         } else if (r == 0) {
1769                 return LIBUSB_ERROR_NOT_FOUND;
1770         }
1771
1772         return 0;
1773 }
1774
1775 static int detach_kernel_driver_and_claim(struct libusb_device_handle *handle,
1776         uint8_t interface)
1777 {
1778         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
1779         struct usbfs_disconnect_claim dc;
1780         int r, fd = hpriv->fd;
1781
1782         dc.interface = interface;
1783         strcpy(dc.driver, "usbfs");
1784         dc.flags = USBFS_DISCONNECT_CLAIM_EXCEPT_DRIVER;
1785         r = ioctl(fd, IOCTL_USBFS_DISCONNECT_CLAIM, &dc);
1786         if (r == 0)
1787                 return 0;
1788         switch (errno) {
1789         case ENOTTY:
1790                 break;
1791         case EBUSY:
1792                 return LIBUSB_ERROR_BUSY;
1793         case EINVAL:
1794                 return LIBUSB_ERROR_INVALID_PARAM;
1795         case ENODEV:
1796                 return LIBUSB_ERROR_NO_DEVICE;
1797         default:
1798                 usbi_err(HANDLE_CTX(handle), "disconnect-and-claim failed, errno=%d", errno);
1799                 return LIBUSB_ERROR_OTHER;
1800         }
1801
1802         /* Fallback code for kernels which don't support the
1803            disconnect-and-claim ioctl */
1804         r = op_detach_kernel_driver(handle, interface);
1805         if (r != 0 && r != LIBUSB_ERROR_NOT_FOUND)
1806                 return r;
1807
1808         return claim_interface(handle, interface);
1809 }
1810
1811 static int op_claim_interface(struct libusb_device_handle *handle, uint8_t interface)
1812 {
1813         if (handle->auto_detach_kernel_driver)
1814                 return detach_kernel_driver_and_claim(handle, interface);
1815         else
1816                 return claim_interface(handle, interface);
1817 }
1818
1819 static int op_release_interface(struct libusb_device_handle *handle, uint8_t interface)
1820 {
1821         int r;
1822
1823         r = release_interface(handle, interface);
1824         if (r)
1825                 return r;
1826
1827         if (handle->auto_detach_kernel_driver)
1828                 op_attach_kernel_driver(handle, interface);
1829
1830         return 0;
1831 }
1832
1833 static void op_destroy_device(struct libusb_device *dev)
1834 {
1835         struct linux_device_priv *priv = usbi_get_device_priv(dev);
1836
1837         free(priv->config_descriptors);
1838         free(priv->descriptors);
1839         free(priv->sysfs_dir);
1840 }
1841
1842 /* URBs are discarded in reverse order of submission to avoid races. */
1843 static int discard_urbs(struct usbi_transfer *itransfer, int first, int last_plus_one)
1844 {
1845         struct libusb_transfer *transfer =
1846                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
1847         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
1848         struct linux_device_handle_priv *hpriv =
1849                 usbi_get_device_handle_priv(transfer->dev_handle);
1850         int i, ret = 0;
1851         struct usbfs_urb *urb;
1852
1853         for (i = last_plus_one - 1; i >= first; i--) {
1854                 if (transfer->type == LIBUSB_TRANSFER_TYPE_ISOCHRONOUS)
1855                         urb = tpriv->iso_urbs[i];
1856                 else
1857                         urb = &tpriv->urbs[i];
1858
1859                 if (ioctl(hpriv->fd, IOCTL_USBFS_DISCARDURB, urb) == 0)
1860                         continue;
1861
1862                 if (errno == EINVAL) {
1863                         usbi_dbg("URB not found --> assuming ready to be reaped");
1864                         if (i == (last_plus_one - 1))
1865                                 ret = LIBUSB_ERROR_NOT_FOUND;
1866                 } else if (errno == ENODEV) {
1867                         usbi_dbg("Device not found for URB --> assuming ready to be reaped");
1868                         ret = LIBUSB_ERROR_NO_DEVICE;
1869                 } else {
1870                         usbi_warn(TRANSFER_CTX(transfer), "unrecognised discard errno %d", errno);
1871                         ret = LIBUSB_ERROR_OTHER;
1872                 }
1873         }
1874         return ret;
1875 }
1876
1877 static void free_iso_urbs(struct linux_transfer_priv *tpriv)
1878 {
1879         int i;
1880
1881         for (i = 0; i < tpriv->num_urbs; i++) {
1882                 struct usbfs_urb *urb = tpriv->iso_urbs[i];
1883
1884                 if (!urb)
1885                         break;
1886                 free(urb);
1887         }
1888
1889         free(tpriv->iso_urbs);
1890         tpriv->iso_urbs = NULL;
1891 }
1892
1893 static int submit_bulk_transfer(struct usbi_transfer *itransfer)
1894 {
1895         struct libusb_transfer *transfer =
1896                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
1897         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
1898         struct linux_device_handle_priv *hpriv =
1899                 usbi_get_device_handle_priv(transfer->dev_handle);
1900         struct usbfs_urb *urbs;
1901         int is_out = IS_XFEROUT(transfer);
1902         int bulk_buffer_len, use_bulk_continuation;
1903         int num_urbs;
1904         int last_urb_partial = 0;
1905         int r;
1906         int i;
1907
1908         /*
1909          * Older versions of usbfs place a 16kb limit on bulk URBs. We work
1910          * around this by splitting large transfers into 16k blocks, and then
1911          * submit all urbs at once. it would be simpler to submit one urb at
1912          * a time, but there is a big performance gain doing it this way.
1913          *
1914          * Newer versions lift the 16k limit (USBFS_CAP_NO_PACKET_SIZE_LIM),
1915          * using arbitrary large transfers can still be a bad idea though, as
1916          * the kernel needs to allocate physical contiguous memory for this,
1917          * which may fail for large buffers.
1918          *
1919          * The kernel solves this problem by splitting the transfer into
1920          * blocks itself when the host-controller is scatter-gather capable
1921          * (USBFS_CAP_BULK_SCATTER_GATHER), which most controllers are.
1922          *
1923          * Last, there is the issue of short-transfers when splitting, for
1924          * short split-transfers to work reliable USBFS_CAP_BULK_CONTINUATION
1925          * is needed, but this is not always available.
1926          */
1927         if (hpriv->caps & USBFS_CAP_BULK_SCATTER_GATHER) {
1928                 /* Good! Just submit everything in one go */
1929                 bulk_buffer_len = transfer->length ? transfer->length : 1;
1930                 use_bulk_continuation = 0;
1931         } else if (hpriv->caps & USBFS_CAP_BULK_CONTINUATION) {
1932                 /* Split the transfers and use bulk-continuation to
1933                    avoid issues with short-transfers */
1934                 bulk_buffer_len = MAX_BULK_BUFFER_LENGTH;
1935                 use_bulk_continuation = 1;
1936         } else if (hpriv->caps & USBFS_CAP_NO_PACKET_SIZE_LIM) {
1937                 /* Don't split, assume the kernel can alloc the buffer
1938                    (otherwise the submit will fail with -ENOMEM) */
1939                 bulk_buffer_len = transfer->length ? transfer->length : 1;
1940                 use_bulk_continuation = 0;
1941         } else {
1942                 /* Bad, splitting without bulk-continuation, short transfers
1943                    which end before the last urb will not work reliable! */
1944                 /* Note we don't warn here as this is "normal" on kernels <
1945                    2.6.32 and not a problem for most applications */
1946                 bulk_buffer_len = MAX_BULK_BUFFER_LENGTH;
1947                 use_bulk_continuation = 0;
1948         }
1949
1950         num_urbs = transfer->length / bulk_buffer_len;
1951
1952         if (transfer->length == 0) {
1953                 num_urbs = 1;
1954         } else if ((transfer->length % bulk_buffer_len) > 0) {
1955                 last_urb_partial = 1;
1956                 num_urbs++;
1957         }
1958         usbi_dbg("need %d urbs for new transfer with length %d", num_urbs, transfer->length);
1959         urbs = calloc(num_urbs, sizeof(*urbs));
1960         if (!urbs)
1961                 return LIBUSB_ERROR_NO_MEM;
1962         tpriv->urbs = urbs;
1963         tpriv->num_urbs = num_urbs;
1964         tpriv->num_retired = 0;
1965         tpriv->reap_action = NORMAL;
1966         tpriv->reap_status = LIBUSB_TRANSFER_COMPLETED;
1967
1968         for (i = 0; i < num_urbs; i++) {
1969                 struct usbfs_urb *urb = &urbs[i];
1970
1971                 urb->usercontext = itransfer;
1972                 switch (transfer->type) {
1973                 case LIBUSB_TRANSFER_TYPE_BULK:
1974                         urb->type = USBFS_URB_TYPE_BULK;
1975                         urb->stream_id = 0;
1976                         break;
1977                 case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
1978                         urb->type = USBFS_URB_TYPE_BULK;
1979                         urb->stream_id = itransfer->stream_id;
1980                         break;
1981                 case LIBUSB_TRANSFER_TYPE_INTERRUPT:
1982                         urb->type = USBFS_URB_TYPE_INTERRUPT;
1983                         break;
1984                 }
1985                 urb->endpoint = transfer->endpoint;
1986                 urb->buffer = transfer->buffer + (i * bulk_buffer_len);
1987
1988                 /* don't set the short not ok flag for the last URB */
1989                 if (use_bulk_continuation && !is_out && (i < num_urbs - 1))
1990                         urb->flags = USBFS_URB_SHORT_NOT_OK;
1991
1992                 if (i == num_urbs - 1 && last_urb_partial)
1993                         urb->buffer_length = transfer->length % bulk_buffer_len;
1994                 else if (transfer->length == 0)
1995                         urb->buffer_length = 0;
1996                 else
1997                         urb->buffer_length = bulk_buffer_len;
1998
1999                 if (i > 0 && use_bulk_continuation)
2000                         urb->flags |= USBFS_URB_BULK_CONTINUATION;
2001
2002                 /* we have already checked that the flag is supported */
2003                 if (is_out && i == num_urbs - 1 &&
2004                     (transfer->flags & LIBUSB_TRANSFER_ADD_ZERO_PACKET))
2005                         urb->flags |= USBFS_URB_ZERO_PACKET;
2006
2007                 r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urb);
2008                 if (r == 0)
2009                         continue;
2010
2011                 if (errno == ENODEV) {
2012                         r = LIBUSB_ERROR_NO_DEVICE;
2013                 } else if (errno == ENOMEM) {
2014                         r = LIBUSB_ERROR_NO_MEM;
2015                 } else {
2016                         usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
2017                         r = LIBUSB_ERROR_IO;
2018                 }
2019
2020                 /* if the first URB submission fails, we can simply free up and
2021                  * return failure immediately. */
2022                 if (i == 0) {
2023                         usbi_dbg("first URB failed, easy peasy");
2024                         free(urbs);
2025                         tpriv->urbs = NULL;
2026                         return r;
2027                 }
2028
2029                 /* if it's not the first URB that failed, the situation is a bit
2030                  * tricky. we may need to discard all previous URBs. there are
2031                  * complications:
2032                  *  - discarding is asynchronous - discarded urbs will be reaped
2033                  *    later. the user must not have freed the transfer when the
2034                  *    discarded URBs are reaped, otherwise libusb will be using
2035                  *    freed memory.
2036                  *  - the earlier URBs may have completed successfully and we do
2037                  *    not want to throw away any data.
2038                  *  - this URB failing may be no error; EREMOTEIO means that
2039                  *    this transfer simply didn't need all the URBs we submitted
2040                  * so, we report that the transfer was submitted successfully and
2041                  * in case of error we discard all previous URBs. later when
2042                  * the final reap completes we can report error to the user,
2043                  * or success if an earlier URB was completed successfully.
2044                  */
2045                 tpriv->reap_action = errno == EREMOTEIO ? COMPLETED_EARLY : SUBMIT_FAILED;
2046
2047                 /* The URBs we haven't submitted yet we count as already
2048                  * retired. */
2049                 tpriv->num_retired += num_urbs - i;
2050
2051                 /* If we completed short then don't try to discard. */
2052                 if (tpriv->reap_action == COMPLETED_EARLY)
2053                         return 0;
2054
2055                 discard_urbs(itransfer, 0, i);
2056
2057                 usbi_dbg("reporting successful submission but waiting for %d "
2058                          "discards before reporting error", i);
2059                 return 0;
2060         }
2061
2062         return 0;
2063 }
2064
2065 static int submit_iso_transfer(struct usbi_transfer *itransfer)
2066 {
2067         struct libusb_transfer *transfer =
2068                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2069         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2070         struct linux_device_handle_priv *hpriv =
2071                 usbi_get_device_handle_priv(transfer->dev_handle);
2072         struct usbfs_urb **urbs;
2073         int num_packets = transfer->num_iso_packets;
2074         int num_packets_remaining;
2075         int i, j;
2076         int num_urbs;
2077         unsigned int packet_len;
2078         unsigned int total_len = 0;
2079         unsigned char *urb_buffer = transfer->buffer;
2080
2081         if (num_packets < 1)
2082                 return LIBUSB_ERROR_INVALID_PARAM;
2083
2084         /* usbfs places arbitrary limits on iso URBs. this limit has changed
2085          * at least three times, but we attempt to detect this limit during
2086          * init and check it here. if the kernel rejects the request due to
2087          * its size, we return an error indicating such to the user.
2088          */
2089         for (i = 0; i < num_packets; i++) {
2090                 packet_len = transfer->iso_packet_desc[i].length;
2091
2092                 if (packet_len > max_iso_packet_len) {
2093                         usbi_warn(TRANSFER_CTX(transfer),
2094                                   "iso packet length of %u bytes exceeds maximum of %u bytes",
2095                                   packet_len, max_iso_packet_len);
2096                         return LIBUSB_ERROR_INVALID_PARAM;
2097                 }
2098
2099                 total_len += packet_len;
2100         }
2101
2102         if (transfer->length < (int)total_len)
2103                 return LIBUSB_ERROR_INVALID_PARAM;
2104
2105         /* usbfs limits the number of iso packets per URB */
2106         num_urbs = (num_packets + (MAX_ISO_PACKETS_PER_URB - 1)) / MAX_ISO_PACKETS_PER_URB;
2107
2108         usbi_dbg("need %d urbs for new transfer with length %d", num_urbs, transfer->length);
2109
2110         urbs = calloc(num_urbs, sizeof(*urbs));
2111         if (!urbs)
2112                 return LIBUSB_ERROR_NO_MEM;
2113
2114         tpriv->iso_urbs = urbs;
2115         tpriv->num_urbs = num_urbs;
2116         tpriv->num_retired = 0;
2117         tpriv->reap_action = NORMAL;
2118         tpriv->iso_packet_offset = 0;
2119
2120         /* allocate + initialize each URB with the correct number of packets */
2121         num_packets_remaining = num_packets;
2122         for (i = 0, j = 0; i < num_urbs; i++) {
2123                 int num_packets_in_urb = MIN(num_packets_remaining, MAX_ISO_PACKETS_PER_URB);
2124                 struct usbfs_urb *urb;
2125                 size_t alloc_size;
2126                 int k;
2127
2128                 alloc_size = sizeof(*urb)
2129                         + (num_packets_in_urb * sizeof(struct usbfs_iso_packet_desc));
2130                 urb = calloc(1, alloc_size);
2131                 if (!urb) {
2132                         free_iso_urbs(tpriv);
2133                         return LIBUSB_ERROR_NO_MEM;
2134                 }
2135                 urbs[i] = urb;
2136
2137                 /* populate packet lengths */
2138                 for (k = 0; k < num_packets_in_urb; j++, k++) {
2139                         packet_len = transfer->iso_packet_desc[j].length;
2140                         urb->buffer_length += packet_len;
2141                         urb->iso_frame_desc[k].length = packet_len;
2142                 }
2143
2144                 urb->usercontext = itransfer;
2145                 urb->type = USBFS_URB_TYPE_ISO;
2146                 /* FIXME: interface for non-ASAP data? */
2147                 urb->flags = USBFS_URB_ISO_ASAP;
2148                 urb->endpoint = transfer->endpoint;
2149                 urb->number_of_packets = num_packets_in_urb;
2150                 urb->buffer = urb_buffer;
2151
2152                 urb_buffer += urb->buffer_length;
2153                 num_packets_remaining -= num_packets_in_urb;
2154         }
2155
2156         /* submit URBs */
2157         for (i = 0; i < num_urbs; i++) {
2158                 int r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urbs[i]);
2159
2160                 if (r == 0)
2161                         continue;
2162
2163                 if (errno == ENODEV) {
2164                         r = LIBUSB_ERROR_NO_DEVICE;
2165                 } else if (errno == EINVAL) {
2166                         usbi_warn(TRANSFER_CTX(transfer), "submiturb failed, transfer too large");
2167                         r = LIBUSB_ERROR_INVALID_PARAM;
2168                 } else if (errno == EMSGSIZE) {
2169                         usbi_warn(TRANSFER_CTX(transfer), "submiturb failed, iso packet length too large");
2170                         r = LIBUSB_ERROR_INVALID_PARAM;
2171                 } else {
2172                         usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
2173                         r = LIBUSB_ERROR_IO;
2174                 }
2175
2176                 /* if the first URB submission fails, we can simply free up and
2177                  * return failure immediately. */
2178                 if (i == 0) {
2179                         usbi_dbg("first URB failed, easy peasy");
2180                         free_iso_urbs(tpriv);
2181                         return r;
2182                 }
2183
2184                 /* if it's not the first URB that failed, the situation is a bit
2185                  * tricky. we must discard all previous URBs. there are
2186                  * complications:
2187                  *  - discarding is asynchronous - discarded urbs will be reaped
2188                  *    later. the user must not have freed the transfer when the
2189                  *    discarded URBs are reaped, otherwise libusb will be using
2190                  *    freed memory.
2191                  *  - the earlier URBs may have completed successfully and we do
2192                  *    not want to throw away any data.
2193                  * so, in this case we discard all the previous URBs BUT we report
2194                  * that the transfer was submitted successfully. then later when
2195                  * the final discard completes we can report error to the user.
2196                  */
2197                 tpriv->reap_action = SUBMIT_FAILED;
2198
2199                 /* The URBs we haven't submitted yet we count as already
2200                  * retired. */
2201                 tpriv->num_retired = num_urbs - i;
2202                 discard_urbs(itransfer, 0, i);
2203
2204                 usbi_dbg("reporting successful submission but waiting for %d "
2205                          "discards before reporting error", i);
2206                 return 0;
2207         }
2208
2209         return 0;
2210 }
2211
2212 static int submit_control_transfer(struct usbi_transfer *itransfer)
2213 {
2214         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2215         struct libusb_transfer *transfer =
2216                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2217         struct linux_device_handle_priv *hpriv =
2218                 usbi_get_device_handle_priv(transfer->dev_handle);
2219         struct usbfs_urb *urb;
2220         int r;
2221
2222         if (transfer->length - LIBUSB_CONTROL_SETUP_SIZE > MAX_CTRL_BUFFER_LENGTH)
2223                 return LIBUSB_ERROR_INVALID_PARAM;
2224
2225         urb = calloc(1, sizeof(*urb));
2226         if (!urb)
2227                 return LIBUSB_ERROR_NO_MEM;
2228         tpriv->urbs = urb;
2229         tpriv->num_urbs = 1;
2230         tpriv->reap_action = NORMAL;
2231
2232         urb->usercontext = itransfer;
2233         urb->type = USBFS_URB_TYPE_CONTROL;
2234         urb->endpoint = transfer->endpoint;
2235         urb->buffer = transfer->buffer;
2236         urb->buffer_length = transfer->length;
2237
2238         r = ioctl(hpriv->fd, IOCTL_USBFS_SUBMITURB, urb);
2239         if (r < 0) {
2240                 free(urb);
2241                 tpriv->urbs = NULL;
2242                 if (errno == ENODEV)
2243                         return LIBUSB_ERROR_NO_DEVICE;
2244
2245                 usbi_err(TRANSFER_CTX(transfer), "submiturb failed, errno=%d", errno);
2246                 return LIBUSB_ERROR_IO;
2247         }
2248         return 0;
2249 }
2250
2251 static int op_submit_transfer(struct usbi_transfer *itransfer)
2252 {
2253         struct libusb_transfer *transfer =
2254                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2255
2256         switch (transfer->type) {
2257         case LIBUSB_TRANSFER_TYPE_CONTROL:
2258                 return submit_control_transfer(itransfer);
2259         case LIBUSB_TRANSFER_TYPE_BULK:
2260         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2261                 return submit_bulk_transfer(itransfer);
2262         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2263                 return submit_bulk_transfer(itransfer);
2264         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2265                 return submit_iso_transfer(itransfer);
2266         default:
2267                 usbi_err(TRANSFER_CTX(transfer), "unknown transfer type %u", transfer->type);
2268                 return LIBUSB_ERROR_INVALID_PARAM;
2269         }
2270 }
2271
2272 static int op_cancel_transfer(struct usbi_transfer *itransfer)
2273 {
2274         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2275         struct libusb_transfer *transfer =
2276                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2277         int r;
2278
2279         if (!tpriv->urbs)
2280                 return LIBUSB_ERROR_NOT_FOUND;
2281
2282         r = discard_urbs(itransfer, 0, tpriv->num_urbs);
2283         if (r != 0)
2284                 return r;
2285
2286         switch (transfer->type) {
2287         case LIBUSB_TRANSFER_TYPE_BULK:
2288         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2289                 if (tpriv->reap_action == ERROR)
2290                         break;
2291                 /* else, fall through */
2292         default:
2293                 tpriv->reap_action = CANCELLED;
2294         }
2295
2296         return 0;
2297 }
2298
2299 static void op_clear_transfer_priv(struct usbi_transfer *itransfer)
2300 {
2301         struct libusb_transfer *transfer =
2302                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2303         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2304
2305         switch (transfer->type) {
2306         case LIBUSB_TRANSFER_TYPE_CONTROL:
2307         case LIBUSB_TRANSFER_TYPE_BULK:
2308         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2309         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2310                 if (tpriv->urbs) {
2311                         free(tpriv->urbs);
2312                         tpriv->urbs = NULL;
2313                 }
2314                 break;
2315         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2316                 if (tpriv->iso_urbs) {
2317                         free_iso_urbs(tpriv);
2318                         tpriv->iso_urbs = NULL;
2319                 }
2320                 break;
2321         default:
2322                 usbi_err(TRANSFER_CTX(transfer), "unknown transfer type %u", transfer->type);
2323         }
2324 }
2325
2326 static int handle_bulk_completion(struct usbi_transfer *itransfer,
2327         struct usbfs_urb *urb)
2328 {
2329         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2330         struct libusb_transfer *transfer = USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2331         int urb_idx = urb - tpriv->urbs;
2332
2333         usbi_mutex_lock(&itransfer->lock);
2334         usbi_dbg("handling completion status %d of bulk urb %d/%d", urb->status,
2335                  urb_idx + 1, tpriv->num_urbs);
2336
2337         tpriv->num_retired++;
2338
2339         if (tpriv->reap_action != NORMAL) {
2340                 /* cancelled, submit_fail, or completed early */
2341                 usbi_dbg("abnormal reap: urb status %d", urb->status);
2342
2343                 /* even though we're in the process of cancelling, it's possible that
2344                  * we may receive some data in these URBs that we don't want to lose.
2345                  * examples:
2346                  * 1. while the kernel is cancelling all the packets that make up an
2347                  *    URB, a few of them might complete. so we get back a successful
2348                  *    cancellation *and* some data.
2349                  * 2. we receive a short URB which marks the early completion condition,
2350                  *    so we start cancelling the remaining URBs. however, we're too
2351                  *    slow and another URB completes (or at least completes partially).
2352                  *    (this can't happen since we always use BULK_CONTINUATION.)
2353                  *
2354                  * When this happens, our objectives are not to lose any "surplus" data,
2355                  * and also to stick it at the end of the previously-received data
2356                  * (closing any holes), so that libusb reports the total amount of
2357                  * transferred data and presents it in a contiguous chunk.
2358                  */
2359                 if (urb->actual_length > 0) {
2360                         unsigned char *target = transfer->buffer + itransfer->transferred;
2361
2362                         usbi_dbg("received %d bytes of surplus data", urb->actual_length);
2363                         if (urb->buffer != target) {
2364                                 usbi_dbg("moving surplus data from offset %zu to offset %zu",
2365                                          (unsigned char *)urb->buffer - transfer->buffer,
2366                                          target - transfer->buffer);
2367                                 memmove(target, urb->buffer, urb->actual_length);
2368                         }
2369                         itransfer->transferred += urb->actual_length;
2370                 }
2371
2372                 if (tpriv->num_retired == tpriv->num_urbs) {
2373                         usbi_dbg("abnormal reap: last URB handled, reporting");
2374                         if (tpriv->reap_action != COMPLETED_EARLY &&
2375                             tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2376                                 tpriv->reap_status = LIBUSB_TRANSFER_ERROR;
2377                         goto completed;
2378                 }
2379                 goto out_unlock;
2380         }
2381
2382         itransfer->transferred += urb->actual_length;
2383
2384         /* Many of these errors can occur on *any* urb of a multi-urb
2385          * transfer.  When they do, we tear down the rest of the transfer.
2386          */
2387         switch (urb->status) {
2388         case 0:
2389                 break;
2390         case -EREMOTEIO: /* short transfer */
2391                 break;
2392         case -ENOENT: /* cancelled */
2393         case -ECONNRESET:
2394                 break;
2395         case -ENODEV:
2396         case -ESHUTDOWN:
2397                 usbi_dbg("device removed");
2398                 tpriv->reap_status = LIBUSB_TRANSFER_NO_DEVICE;
2399                 goto cancel_remaining;
2400         case -EPIPE:
2401                 usbi_dbg("detected endpoint stall");
2402                 if (tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2403                         tpriv->reap_status = LIBUSB_TRANSFER_STALL;
2404                 goto cancel_remaining;
2405         case -EOVERFLOW:
2406                 /* overflow can only ever occur in the last urb */
2407                 usbi_dbg("overflow, actual_length=%d", urb->actual_length);
2408                 if (tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2409                         tpriv->reap_status = LIBUSB_TRANSFER_OVERFLOW;
2410                 goto completed;
2411         case -ETIME:
2412         case -EPROTO:
2413         case -EILSEQ:
2414         case -ECOMM:
2415         case -ENOSR:
2416                 usbi_dbg("low-level bus error %d", urb->status);
2417                 tpriv->reap_action = ERROR;
2418                 goto cancel_remaining;
2419         default:
2420                 usbi_warn(ITRANSFER_CTX(itransfer), "unrecognised urb status %d", urb->status);
2421                 tpriv->reap_action = ERROR;
2422                 goto cancel_remaining;
2423         }
2424
2425         /* if we've reaped all urbs or we got less data than requested then we're
2426          * done */
2427         if (tpriv->num_retired == tpriv->num_urbs) {
2428                 usbi_dbg("all URBs in transfer reaped --> complete!");
2429                 goto completed;
2430         } else if (urb->actual_length < urb->buffer_length) {
2431                 usbi_dbg("short transfer %d/%d --> complete!",
2432                          urb->actual_length, urb->buffer_length);
2433                 if (tpriv->reap_action == NORMAL)
2434                         tpriv->reap_action = COMPLETED_EARLY;
2435         } else {
2436                 goto out_unlock;
2437         }
2438
2439 cancel_remaining:
2440         if (tpriv->reap_action == ERROR && tpriv->reap_status == LIBUSB_TRANSFER_COMPLETED)
2441                 tpriv->reap_status = LIBUSB_TRANSFER_ERROR;
2442
2443         if (tpriv->num_retired == tpriv->num_urbs) /* nothing to cancel */
2444                 goto completed;
2445
2446         /* cancel remaining urbs and wait for their completion before
2447          * reporting results */
2448         discard_urbs(itransfer, urb_idx + 1, tpriv->num_urbs);
2449
2450 out_unlock:
2451         usbi_mutex_unlock(&itransfer->lock);
2452         return 0;
2453
2454 completed:
2455         free(tpriv->urbs);
2456         tpriv->urbs = NULL;
2457         usbi_mutex_unlock(&itransfer->lock);
2458         return tpriv->reap_action == CANCELLED ?
2459                 usbi_handle_transfer_cancellation(itransfer) :
2460                 usbi_handle_transfer_completion(itransfer, tpriv->reap_status);
2461 }
2462
2463 static int handle_iso_completion(struct usbi_transfer *itransfer,
2464         struct usbfs_urb *urb)
2465 {
2466         struct libusb_transfer *transfer =
2467                 USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2468         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2469         int num_urbs = tpriv->num_urbs;
2470         int urb_idx = 0;
2471         int i;
2472         enum libusb_transfer_status status = LIBUSB_TRANSFER_COMPLETED;
2473
2474         usbi_mutex_lock(&itransfer->lock);
2475         for (i = 0; i < num_urbs; i++) {
2476                 if (urb == tpriv->iso_urbs[i]) {
2477                         urb_idx = i + 1;
2478                         break;
2479                 }
2480         }
2481         if (urb_idx == 0) {
2482                 usbi_err(TRANSFER_CTX(transfer), "could not locate urb!");
2483                 usbi_mutex_unlock(&itransfer->lock);
2484                 return LIBUSB_ERROR_NOT_FOUND;
2485         }
2486
2487         usbi_dbg("handling completion status %d of iso urb %d/%d", urb->status,
2488                  urb_idx, num_urbs);
2489
2490         /* copy isochronous results back in */
2491
2492         for (i = 0; i < urb->number_of_packets; i++) {
2493                 struct usbfs_iso_packet_desc *urb_desc = &urb->iso_frame_desc[i];
2494                 struct libusb_iso_packet_descriptor *lib_desc =
2495                         &transfer->iso_packet_desc[tpriv->iso_packet_offset++];
2496
2497                 lib_desc->status = LIBUSB_TRANSFER_COMPLETED;
2498                 switch (urb_desc->status) {
2499                 case 0:
2500                         break;
2501                 case -ENOENT: /* cancelled */
2502                 case -ECONNRESET:
2503                         break;
2504                 case -ENODEV:
2505                 case -ESHUTDOWN:
2506                         usbi_dbg("packet %d - device removed", i);
2507                         lib_desc->status = LIBUSB_TRANSFER_NO_DEVICE;
2508                         break;
2509                 case -EPIPE:
2510                         usbi_dbg("packet %d - detected endpoint stall", i);
2511                         lib_desc->status = LIBUSB_TRANSFER_STALL;
2512                         break;
2513                 case -EOVERFLOW:
2514                         usbi_dbg("packet %d - overflow error", i);
2515                         lib_desc->status = LIBUSB_TRANSFER_OVERFLOW;
2516                         break;
2517                 case -ETIME:
2518                 case -EPROTO:
2519                 case -EILSEQ:
2520                 case -ECOMM:
2521                 case -ENOSR:
2522                 case -EXDEV:
2523                         usbi_dbg("packet %d - low-level USB error %d", i, urb_desc->status);
2524                         lib_desc->status = LIBUSB_TRANSFER_ERROR;
2525                         break;
2526                 default:
2527                         usbi_warn(TRANSFER_CTX(transfer), "packet %d - unrecognised urb status %d",
2528                                   i, urb_desc->status);
2529                         lib_desc->status = LIBUSB_TRANSFER_ERROR;
2530                         break;
2531                 }
2532                 lib_desc->actual_length = urb_desc->actual_length;
2533         }
2534
2535         tpriv->num_retired++;
2536
2537         if (tpriv->reap_action != NORMAL) { /* cancelled or submit_fail */
2538                 usbi_dbg("CANCEL: urb status %d", urb->status);
2539
2540                 if (tpriv->num_retired == num_urbs) {
2541                         usbi_dbg("CANCEL: last URB handled, reporting");
2542                         free_iso_urbs(tpriv);
2543                         if (tpriv->reap_action == CANCELLED) {
2544                                 usbi_mutex_unlock(&itransfer->lock);
2545                                 return usbi_handle_transfer_cancellation(itransfer);
2546                         } else {
2547                                 usbi_mutex_unlock(&itransfer->lock);
2548                                 return usbi_handle_transfer_completion(itransfer, LIBUSB_TRANSFER_ERROR);
2549                         }
2550                 }
2551                 goto out;
2552         }
2553
2554         switch (urb->status) {
2555         case 0:
2556                 break;
2557         case -ENOENT: /* cancelled */
2558         case -ECONNRESET:
2559                 break;
2560         case -ESHUTDOWN:
2561                 usbi_dbg("device removed");
2562                 status = LIBUSB_TRANSFER_NO_DEVICE;
2563                 break;
2564         default:
2565                 usbi_warn(TRANSFER_CTX(transfer), "unrecognised urb status %d", urb->status);
2566                 status = LIBUSB_TRANSFER_ERROR;
2567                 break;
2568         }
2569
2570         /* if we've reaped all urbs then we're done */
2571         if (tpriv->num_retired == num_urbs) {
2572                 usbi_dbg("all URBs in transfer reaped --> complete!");
2573                 free_iso_urbs(tpriv);
2574                 usbi_mutex_unlock(&itransfer->lock);
2575                 return usbi_handle_transfer_completion(itransfer, status);
2576         }
2577
2578 out:
2579         usbi_mutex_unlock(&itransfer->lock);
2580         return 0;
2581 }
2582
2583 static int handle_control_completion(struct usbi_transfer *itransfer,
2584         struct usbfs_urb *urb)
2585 {
2586         struct linux_transfer_priv *tpriv = usbi_get_transfer_priv(itransfer);
2587         int status;
2588
2589         usbi_mutex_lock(&itransfer->lock);
2590         usbi_dbg("handling completion status %d", urb->status);
2591
2592         itransfer->transferred += urb->actual_length;
2593
2594         if (tpriv->reap_action == CANCELLED) {
2595                 if (urb->status && urb->status != -ENOENT)
2596                         usbi_warn(ITRANSFER_CTX(itransfer), "cancel: unrecognised urb status %d",
2597                                   urb->status);
2598                 free(tpriv->urbs);
2599                 tpriv->urbs = NULL;
2600                 usbi_mutex_unlock(&itransfer->lock);
2601                 return usbi_handle_transfer_cancellation(itransfer);
2602         }
2603
2604         switch (urb->status) {
2605         case 0:
2606                 status = LIBUSB_TRANSFER_COMPLETED;
2607                 break;
2608         case -ENOENT: /* cancelled */
2609                 status = LIBUSB_TRANSFER_CANCELLED;
2610                 break;
2611         case -ENODEV:
2612         case -ESHUTDOWN:
2613                 usbi_dbg("device removed");
2614                 status = LIBUSB_TRANSFER_NO_DEVICE;
2615                 break;
2616         case -EPIPE:
2617                 usbi_dbg("unsupported control request");
2618                 status = LIBUSB_TRANSFER_STALL;
2619                 break;
2620         case -EOVERFLOW:
2621                 usbi_dbg("overflow, actual_length=%d", urb->actual_length);
2622                 status = LIBUSB_TRANSFER_OVERFLOW;
2623                 break;
2624         case -ETIME:
2625         case -EPROTO:
2626         case -EILSEQ:
2627         case -ECOMM:
2628         case -ENOSR:
2629                 usbi_dbg("low-level bus error %d", urb->status);
2630                 status = LIBUSB_TRANSFER_ERROR;
2631                 break;
2632         default:
2633                 usbi_warn(ITRANSFER_CTX(itransfer), "unrecognised urb status %d", urb->status);
2634                 status = LIBUSB_TRANSFER_ERROR;
2635                 break;
2636         }
2637
2638         free(tpriv->urbs);
2639         tpriv->urbs = NULL;
2640         usbi_mutex_unlock(&itransfer->lock);
2641         return usbi_handle_transfer_completion(itransfer, status);
2642 }
2643
2644 static int reap_for_handle(struct libusb_device_handle *handle)
2645 {
2646         struct linux_device_handle_priv *hpriv = usbi_get_device_handle_priv(handle);
2647         int r;
2648         struct usbfs_urb *urb = NULL;
2649         struct usbi_transfer *itransfer;
2650         struct libusb_transfer *transfer;
2651
2652         r = ioctl(hpriv->fd, IOCTL_USBFS_REAPURBNDELAY, &urb);
2653         if (r < 0) {
2654                 if (errno == EAGAIN)
2655                         return 1;
2656                 if (errno == ENODEV)
2657                         return LIBUSB_ERROR_NO_DEVICE;
2658
2659                 usbi_err(HANDLE_CTX(handle), "reap failed, errno=%d", errno);
2660                 return LIBUSB_ERROR_IO;
2661         }
2662
2663         itransfer = urb->usercontext;
2664         transfer = USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer);
2665
2666         usbi_dbg("urb type=%u status=%d transferred=%d", urb->type, urb->status, urb->actual_length);
2667
2668         switch (transfer->type) {
2669         case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS:
2670                 return handle_iso_completion(itransfer, urb);
2671         case LIBUSB_TRANSFER_TYPE_BULK:
2672         case LIBUSB_TRANSFER_TYPE_BULK_STREAM:
2673         case LIBUSB_TRANSFER_TYPE_INTERRUPT:
2674                 return handle_bulk_completion(itransfer, urb);
2675         case LIBUSB_TRANSFER_TYPE_CONTROL:
2676                 return handle_control_completion(itransfer, urb);
2677         default:
2678                 usbi_err(HANDLE_CTX(handle), "unrecognised transfer type %u", transfer->type);
2679                 return LIBUSB_ERROR_OTHER;
2680         }
2681 }
2682
2683 static int op_handle_events(struct libusb_context *ctx,
2684         void *event_data, unsigned int count, unsigned int num_ready)
2685 {
2686         struct pollfd *fds = event_data;
2687         unsigned int n;
2688         int r;
2689
2690         usbi_mutex_lock(&ctx->open_devs_lock);
2691         for (n = 0; n < count && num_ready > 0; n++) {
2692                 struct pollfd *pollfd = &fds[n];
2693                 struct libusb_device_handle *handle;
2694                 struct linux_device_handle_priv *hpriv = NULL;
2695                 int reap_count;
2696
2697                 if (!pollfd->revents)
2698                         continue;
2699
2700                 num_ready--;
2701                 for_each_open_device(ctx, handle) {
2702                         hpriv = usbi_get_device_handle_priv(handle);
2703                         if (hpriv->fd == pollfd->fd)
2704                                 break;
2705                 }
2706
2707                 if (!hpriv || hpriv->fd != pollfd->fd) {
2708                         usbi_err(ctx, "cannot find handle for fd %d",
2709                                  pollfd->fd);
2710                         continue;
2711                 }
2712
2713                 if (pollfd->revents & POLLERR) {
2714                         /* remove the fd from the pollfd set so that it doesn't continuously
2715                          * trigger an event, and flag that it has been removed so op_close()
2716                          * doesn't try to remove it a second time */
2717                         usbi_remove_event_source(HANDLE_CTX(handle), hpriv->fd);
2718                         hpriv->fd_removed = 1;
2719
2720                         /* device will still be marked as attached if hotplug monitor thread
2721                          * hasn't processed remove event yet */
2722                         usbi_mutex_static_lock(&linux_hotplug_lock);
2723                         if (usbi_atomic_load(&handle->dev->attached))
2724                                 linux_device_disconnected(handle->dev->bus_number,
2725                                                           handle->dev->device_address);
2726                         usbi_mutex_static_unlock(&linux_hotplug_lock);
2727
2728                         if (hpriv->caps & USBFS_CAP_REAP_AFTER_DISCONNECT) {
2729                                 do {
2730                                         r = reap_for_handle(handle);
2731                                 } while (r == 0);
2732                         }
2733
2734                         usbi_handle_disconnect(handle);
2735                         continue;
2736                 }
2737
2738                 reap_count = 0;
2739                 do {
2740                         r = reap_for_handle(handle);
2741                 } while (r == 0 && ++reap_count <= 25);
2742
2743                 if (r == 1 || r == LIBUSB_ERROR_NO_DEVICE)
2744                         continue;
2745                 else if (r < 0)
2746                         goto out;
2747         }
2748
2749         r = 0;
2750 out:
2751         usbi_mutex_unlock(&ctx->open_devs_lock);
2752         return r;
2753 }
2754
2755 const struct usbi_os_backend usbi_backend = {
2756         .name = "Linux usbfs",
2757         .caps = USBI_CAP_HAS_HID_ACCESS|USBI_CAP_SUPPORTS_DETACH_KERNEL_DRIVER,
2758         .init = op_init,
2759         .exit = op_exit,
2760         .set_option = op_set_option,
2761         .hotplug_poll = op_hotplug_poll,
2762         .get_active_config_descriptor = op_get_active_config_descriptor,
2763         .get_config_descriptor = op_get_config_descriptor,
2764         .get_config_descriptor_by_value = op_get_config_descriptor_by_value,
2765
2766         .wrap_sys_device = op_wrap_sys_device,
2767         .open = op_open,
2768         .close = op_close,
2769         .get_configuration = op_get_configuration,
2770         .set_configuration = op_set_configuration,
2771         .claim_interface = op_claim_interface,
2772         .release_interface = op_release_interface,
2773
2774         .set_interface_altsetting = op_set_interface,
2775         .clear_halt = op_clear_halt,
2776         .reset_device = op_reset_device,
2777
2778         .alloc_streams = op_alloc_streams,
2779         .free_streams = op_free_streams,
2780
2781         .dev_mem_alloc = op_dev_mem_alloc,
2782         .dev_mem_free = op_dev_mem_free,
2783
2784         .kernel_driver_active = op_kernel_driver_active,
2785         .detach_kernel_driver = op_detach_kernel_driver,
2786         .attach_kernel_driver = op_attach_kernel_driver,
2787
2788         .destroy_device = op_destroy_device,
2789
2790         .submit_transfer = op_submit_transfer,
2791         .cancel_transfer = op_cancel_transfer,
2792         .clear_transfer_priv = op_clear_transfer_priv,
2793
2794         .handle_events = op_handle_events,
2795
2796         .device_priv_size = sizeof(struct linux_device_priv),
2797         .device_handle_priv_size = sizeof(struct linux_device_handle_priv),
2798         .transfer_priv_size = sizeof(struct linux_transfer_priv),
2799 };