A malicious device can make the driver divide ny zero
with a nonsense maximum packet size.
Signed-off-by: NOliver Neukum <oneukum@suse.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190820092826.17694-1-oneukum@suse.comSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Fix uninitialized symbol 'actual' in function
usbtmc_ioctl_abort_bulk_in_tag().

When symbol 'actual' is not initialized and usb_bulk_msg() fails,
the subsequent kernel debug message shows invalid data.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Fixes: cbe743f1 ("usb: usbtmc: Fix ioctl USBTMC_IOCTL_ABORT_BULK_IN")
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Fix uninitialized symbol 'actual' in function usbtmc_ioctl_clear.

When symbol 'actual' is not initialized and usb_bulk_msg() fails,
the subsequent kernel debug message shows a random value.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Fixes: dfee02ac ("usb: usbtmc: Fix ioctl USBTMC_IOCTL_CLEAR")
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Fix uninitialized symbol 'actual' in function usbtmc_read.

When symbol 'actual' is not initialized and usb_bulk_msg() fails,
the subsequent kernel debug message shows a random value.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Fixes: d7604ff0 ("usb: usbtmc: Optimize usbtmc_read")
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Kernel memory is allocated twice in new function
usbtmc_ioctl_request and creates a memory leak.
This fix removes the superfluous kmalloc().
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Fixes: 658f24f4 ("usb: usbtmc: Add ioctl for generic requests on control")
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

As all the properties of the usbtmc driver can now be
controlled on a per file descriptor basis by ioctl functions
the sysfs interface is of limited use.
We are not aware about applications that are using the sysfs
parameter TermChar, TermCharEnabled or auto_abort.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove redundant code and fix debug messages.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add ioctl USBTMC_IOCTL_API_VERSION to get current API version
of usbtmc driver.

This is to allow an instrument library to determine whether
the driver API is compatible with the implementation.

The API may change in future versions. Therefore the macro
USBTMC_API_VERSION should be incremented when changing tmc.h
with new flags, ioctls or when changing a significant behavior
of the driver.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Use common timeout macro USB_CTRL_GET_TIMEOUT (=5s) for all
usb_control_msg() function calls.

The macro USBTMC_TIMEOUT should only be used as default value for
Bulk IN/OUT transfers.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add parameter 'tag' to function usbtmc_ioctl_abort_bulk_out_tag()
for future versions.

Use USBTMC_BUFSIZE (4k) instead of USBTMC_SIZE_IOBUFFER (2k).
Using USBTMC_SIZE_IOBUFFER is deprecated.

Insert a sleep of 50 ms between subsequent
CHECK_ABORT_BULK_OUT_STATUS control requests to avoid stressing
the instrument with repeated requests.

Use common macro USB_CTRL_GET_TIMEOUT instead of USBTMC_TIMEOUT.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add parameter 'tag' to function usbtmc_ioctl_abort_bulk_in_tag()
for future versions.

Remove calculation of max_size (=wMaxPacketSize) and wrong
condition (actual == max_size) in while loop. An abort operation
should always flush the complete Bulk-IN until a short packet is
received.

Return error code ENOMSG when transfer (specified by given tag)
is not in progress and device returns code
USBTMC_STATUS_TRANSFER_NOT_IN_PROGRESS.

Use USBTMC_BUFSIZE (4k) instead of USBTMC_SIZE_IOBUFFER (2k).
Using USBTMC_SIZE_IOBUFFER is deprecated.

Use common macro USB_CTRL_GET_TIMEOUT instead of USBTMC_TIMEOUT.

Check only bit 0 (field bmAbortBulkIn) of the
CHECK_ABORT_BULK_IN_STATUS response, since other bits are reserved
and can change in future versions.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove calculation of max_size (=wMaxPacketSize) and wrong
condition (actual == max_size) in while loop. A device clear
should always flush the complete Bulk-IN FIFO.

Insert a sleep of 50 ms between subsequent CHECK_CLEAR_STATUS
control requests to avoid stressing the instrument with
repeated requests.

Some instruments need time to cleanup internal I/O buffers.
Polling and nonbraked requests slow down the response time of
devices.

Use USBTMC_BUFSIZE (4k) instead of USBTMC_SIZE_IOBUFFER (2k).
Using USBTMC_SIZE_IOBUFFER is deprecated.

Check only bit 0 (field bmClear) of the CHECK_CLEAR_STATUS
response, since other bits are reserved and can change in
future versions.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Use new usbtmc_generic_read function to maximize bandwidth
during long data transfer. Also fix reading of zero length
packet (ZLP) or trailing short packet.
The maximum input transfer size is limited to INT_MAX (=2GB).
Also remove redundant return in send_request_dev_dep_msg_in().
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Use new usbtmc_generic_write function to maximize bandwidth
during long data transfer.
The maximum output transfer size is limited to INT_MAX (=2GB).
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add ioctl USBTMC_IOCTL_AUTO_ABORT to configure auto_abort for
each specific file handle.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

add ioctl USBTMC_IOCTL_MSG_IN_ATTR that returns the specific
bmTransferAttributes field of the last DEV_DEP_MSG_IN Bulk-IN
header. This header is received by the read() function. The
meaning of the (u8) bitmap bmTransferAttributes is:

Bit 0 = EOM flag is set when the last transfer of a USBTMC
message is received.

Bit 1 = is set when the last byte is a termchar (e.g. '\n').
Note that this bit is always zero when the device does not support
the termchar feature or when termchar detection is not enabled
(see ioctl USBTMC_IOCTL_CONFIG_TERMCHAR).
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Wait until an SRQ (service request) is received on the interrupt pipe
or until the given period of time is expired. In contrast to the
poll() function this ioctl does not return when other (a)synchronous
I/O operations fail with EPOLLERR.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Submitted urbs are not allowed when system is suspended.
Thus the submitted urb waiting at interrupt pipe is killed
during suspend callback and submitted again when system resumes.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The ioctl USBTMC_IOCTL_CLEANUP_IO kills all submitted urbs to OUT
and IN bulk, and clears all received data from IN bulk. Internal
transfer counters and error states are reset.

An application should use this ioctl after an asnychronous transfer
was canceled and/or error handling has finished.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

ioctl USBTMC_IOCTL_CANCEL_IO stops and kills all flying urbs of
last USBTMC_IOCTL_READ and USBTMC_IOCTL_WRITE function calls.
A subsequent call to USBTMC_IOCTL_READ or
USBTMC_IOCTL_WRITE_RESULT returns -ECANCELED with
information about current transferred data.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The USBTMC_IOCTL_READ call provides for generic synchronous and
asynchronous reads on bulk IN to implement vendor specific library
routines.

Depending on transfer_size the function submits one or more urbs (up
to 16) each with a size of up to 4kB.

The flag USBTMC_FLAG_IGNORE_TRAILER can be used when the transmission
size is already known. Then the function does not truncate the
transfer_size to a multiple of 4 kB, but does reserve extra space
to receive the final short or zero length packet. Note that the
instrument is allowed to send up to wMaxPacketSize - 1 bytes at the
end of a message to avoid sending a zero length packet.

With flag USBTMC_FLAG_ASYNC the ioctl is non blocking. When no
received data is available, the read function submits as many urbs as
needed to receive transfer_size bytes. However the number of flying
urbs (=4kB) is limited to 16 even with subsequent calls of this ioctl.

Returns -EAGAIN when non blocking and no data is received.
Signals EPOLLIN | EPOLLRDNORM when asynchronous urbs are ready to
be read.

In non blocking mode the usbtmc_message.message pointer may be NULL
and the ioctl just submits urbs to initiate receiving data. However if
data is already available due to a previous non blocking call the ioctl
will return -EINVAL when the message pointer is NULL.

This ioctl does not support compatibility for 32 bit
applications running on 64 bit systems. However all other
convenient ioctls of the USBTMC driver can still be used in 32
bit applications as well. Note that 32 bit applications running
on 32 bit target systems are not affected by this limitation.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

ioctl USBTMC_IOCTL_WRITE_RESULT copies current out_transfer_size
to given __u32 pointer and returns current out_status of the last
(asnynchronous) USBTMC_IOCTL_WRITE call.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The new ioctl USBTMC_IOCTL_WRITE sends a generic message to bulk OUT.
This ioctl is used for vendor specific or asynchronous I/O as well.

The message is split into chunks of 4k (page size).
Message size is aligned to 32 bit boundaries.

With flag USBTMC_FLAG_ASYNC the ioctl is non blocking.
With flag USBTMC_FLAG_APPEND additional urbs are queued and
out_status/out_transfer_size is not reset. EPOLLOUT | EPOLLWRNORM
is signaled when all submitted urbs are completed.

Flush flying urbs when file handle is closed or device is
suspended or reset.

This ioctl does not support compatibility for 32 bit
applications running on 64 bit systems. However all other
convenient ioctls of the USBTMC driver can still be used in 32
bit applications as well. Note that 32 bit applications running
on 32 bit target systems are not affected by this limitation.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add USBTMC_IOCTL_CTRL_REQUEST to send arbitrary requests on the
control pipe.  Used by specific applications of IVI Foundation,
Inc. to implement VISA API functions: viUsbControlIn/Out.

The maximum length of control request is set to 4k.

This ioctl does not support compatibility for 32 bit
applications running on 64 bit systems. However all other
convenient ioctls of the USBTMC driver can still be used in 32
bit applications as well. Note that 32 bit applications running
on 32 bit target systems are not affected by this limitation.
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

32 bit applications can only call ioctl functions on 64 bit systems
when the field .compat_ioctl is defined for file operations.
Tested-by: NDave Penkler <dpenkler@gmail.com>
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

add USBTMC_IOCTL_CONFIG_TERMCHAR to control TermChar handling
for next read(). Controls field 'TermChar' and Bit 1 of field
'bmTransferAttributes' of REQUEST_DEV_DEP_MSG_IN BULK-OUT header.

Allows enabling/disabling of terminating a read on reception of
term_char individually for each read request.
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Tested-by: NDave Penkler <dpenkler@gmail.com>
Signed-off-by: NDave Penkler <dpenkler@gmail.com>
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

add USBTMC_IOCTL_EOM_ENABLE to specify EOM bit for next write()
call. Sets Bit 0 of field 'bmTransferAttributes' of DEV_DEP_MSG_OUT
Bulk-OUT Header.
Allows fine grained control over end of message handling on a
per file descriptor basis.
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Tested-by: NDave Penkler <dpenkler@gmail.com>
Signed-off-by: NDave Penkler <dpenkler@gmail.com>
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

add USBTMC488_IOCTL_TRIGGER to send TRIGGER Bulk-OUT header
according to Subclass USB488 Specification

The usbtmc trigger command is equivalent to the IEEE 488 GET (Group
Execute Trigger) action. While the "*TRG" command can be sent as
data to perform the same operation, in some situations an instrument
will be busy and unable to process the data immediately in which
case the USBTMC488_IOCTL_TRIGGER can be used to trigger the
instrument with lower latency.
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Tested-by: NDave Penkler <dpenkler@gmail.com>
Signed-off-by: NDave Penkler <dpenkler@gmail.com>
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add ioctls USBTMC_IOCTL_GET_TIMEOUT / USBTMC_IOCTL_SET_TIMEOUT to
get/set I/O timeout for specific file handle.

Different operations on an instrument can take different lengths of
time thus it is important to be able to set the timeout slightly
longer than the expected duration of each operation to optimise the
responsiveness of the application. As the instrument may be shared by
multiple applications the timeout should be settable on a per file
descriptor basis.
Tested-by: NDave Penkler <dpenkler@gmail.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NDave Penkler <dpenkler@gmail.com>
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

- use consistent error value ETIMEOUT instead of ETIME
Tested-by: NDave Penkler <dpenkler@gmail.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add 'struct usbtmc_file_data' for each file handle to cache last
srq_byte (=Status Byte with SRQ) received by usbtmc_interrupt(..)

usbtmc488_ioctl_read_stb returns cached srq_byte when available for
each file handle to avoid race conditions of concurrent applications.

SRQ now sets EPOLLPRI instead of EPOLLIN since EPOLLIN is now reserved
for asynchronous reads
Tested-by: NDave Penkler <dpenkler@gmail.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

All T&M instruments should also work with rigol_quirk = 1 code path.
So remove unnecessary code in rigol_quirk = 0 code path to simplify the driver.
Tested-by: NDave Penkler <dpenkler@gmail.com>
Reviewed-by: NSteve Bayless <steve_bayless@keysight.com>
Signed-off-by: NGuido Kiener <guido.kiener@rohde-schwarz.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This is the mindless scripted replacement of kernel use of POLL*
variables as described by Al, done by this script:

    for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do
        L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'`
        for f in $L; do sed -i "-es/^\([^\"]*\)\(\<POLL$V\>\)/\\1E\\2/" $f; done
    done

with de-mangling cleanups yet to come.

NOTE! On almost all architectures, the EPOLL* constants have the same
values as the POLL* constants do.  But they keyword here is "almost".
For various bad reasons they aren't the same, and epoll() doesn't
actually work quite correctly in some cases due to this on Sparc et al.

The next patch from Al will sort out the final differences, and we
should be all done.
Scripted-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Now that the SPDX tag is in all USB files, that identifies the license
in a specific and legally-defined manner.  So the extra GPL text wording
can be removed as it is no longer needed at all.

This is done on a quest to remove the 700+ different ways that files in
the kernel describe the GPL license text.  And there's unneeded stuff
like the address (sometimes incorrect) for the FSF which is never
needed.

No copyright headers or other non-license-description text was removed.

Cc: Oliver Neukum <oneukum@suse.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

It's good to have SPDX identifiers in all files to make it easier to
audit the kernel tree for correct licenses.

Update the drivers/usb/ and include/linux/usb* files with the correct
SPDX license identifier based on the license text in the file itself.
The SPDX identifier is a legally binding shorthand, which can be used
instead of the full boiler plate text.

This work is based on a script and data from Thomas Gleixner, Philippe
Ombredanne, and Kate Stewart.

Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Kate Stewart <kstewart@linuxfoundation.org>
Cc: Philippe Ombredanne <pombredanne@nexb.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
Acked-by: NJohan Hovold <johan@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

In preparation to enabling -Wimplicit-fallthrough, mark switch cases
where we are expecting to fall through.
Signed-off-by: NGustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

attribute_group are not supposed to change at runtime. All functions
working with attribute_group provided by <linux/sysfs.h> work with
const attribute_group. So mark the non-const structs as const.
Signed-off-by: NArvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>