2 * The USB Monitor, inspired by Dave Harding's USBMon.
4 * This is a text format reader.
7 #include <linux/kernel.h>
8 #include <linux/list.h>
10 #include <linux/time.h>
11 #include <linux/mutex.h>
12 #include <asm/uaccess.h>
17 * No, we do not want arbitrarily long data strings.
18 * Use the binary interface if you want to capture bulk data!
23 * Defined by USB 2.0 clause 9.3, table 9.2.
28 * This limit exists to prevent OOMs when the user process stops reading.
29 * If usbmon were available to unprivileged processes, it might be open
30 * to a local DoS. But we have to keep to root in order to prevent
31 * password sniffing from HID devices.
33 #define EVENT_MAX (2*PAGE_SIZE / sizeof(struct mon_event_text))
35 #define PRINTF_DFL 160
37 struct mon_event_text {
38 struct list_head e_link;
39 int type; /* submit, complete, etc. */
40 unsigned int pipe; /* Pipe */
41 unsigned long id; /* From pointer, most of the time */
43 int length; /* Depends on type: xfer length or act length */
47 unsigned char setup[SETUP_MAX];
48 unsigned char data[DATA_MAX];
51 #define SLAB_NAME_SZ 30
52 struct mon_reader_text {
55 struct list_head e_list;
56 struct mon_reader r; /* In C, parent class can be placed anywhere */
58 wait_queue_head_t wait;
61 struct mutex printf_lock;
63 char slab_name[SLAB_NAME_SZ];
66 static void mon_text_ctor(void *, kmem_cache_t *, unsigned long);
67 static void mon_text_dtor(void *, kmem_cache_t *, unsigned long);
73 * May be called from an interrupt.
75 * This is called with the whole mon_bus locked, so no additional lock.
78 static inline char mon_text_get_setup(struct mon_event_text *ep,
79 struct urb *urb, char ev_type)
82 if (!usb_pipecontrol(urb->pipe) || ev_type != 'S')
85 if (urb->transfer_flags & URB_NO_SETUP_DMA_MAP)
86 return mon_dmapeek(ep->setup, urb->setup_dma, SETUP_MAX);
87 if (urb->setup_packet == NULL)
88 return 'Z'; /* '0' would be not as pretty. */
90 memcpy(ep->setup, urb->setup_packet, SETUP_MAX);
94 static inline char mon_text_get_data(struct mon_event_text *ep, struct urb *urb,
95 int len, char ev_type)
104 if (usb_pipein(pipe)) {
113 * The check to see if it's safe to poke at data has an enormous
114 * number of corner cases, but it seems that the following is
117 * We do not even try to look at transfer_buffer, because it can
118 * contain non-NULL garbage in case the upper level promised to
119 * set DMA for the HCD.
121 if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
122 return mon_dmapeek(ep->data, urb->transfer_dma, len);
124 if (urb->transfer_buffer == NULL)
125 return 'Z'; /* '0' would be not as pretty. */
127 memcpy(ep->data, urb->transfer_buffer, len);
131 static inline unsigned int mon_get_timestamp(void)
136 do_gettimeofday(&tval);
137 stamp = tval.tv_sec & 0xFFFF; /* 2^32 = 4294967296. Limit to 4096s. */
138 stamp = stamp * 1000000 + tval.tv_usec;
142 static void mon_text_event(struct mon_reader_text *rp, struct urb *urb,
145 struct mon_event_text *ep;
148 stamp = mon_get_timestamp();
150 if (rp->nevents >= EVENT_MAX ||
151 (ep = kmem_cache_alloc(rp->e_slab, SLAB_ATOMIC)) == NULL) {
152 rp->r.m_bus->cnt_text_lost++;
157 ep->pipe = urb->pipe;
158 ep->id = (unsigned long) urb;
160 ep->length = (ev_type == 'S') ?
161 urb->transfer_buffer_length : urb->actual_length;
162 /* Collecting status makes debugging sense for submits, too */
163 ep->status = urb->status;
165 ep->setup_flag = mon_text_get_setup(ep, urb, ev_type);
166 ep->data_flag = mon_text_get_data(ep, urb, ep->length, ev_type);
169 list_add_tail(&ep->e_link, &rp->e_list);
173 static void mon_text_submit(void *data, struct urb *urb)
175 struct mon_reader_text *rp = data;
176 mon_text_event(rp, urb, 'S');
179 static void mon_text_complete(void *data, struct urb *urb)
181 struct mon_reader_text *rp = data;
182 mon_text_event(rp, urb, 'C');
186 * Fetch next event from the circular buffer.
188 static struct mon_event_text *mon_text_fetch(struct mon_reader_text *rp,
189 struct mon_bus *mbus)
194 spin_lock_irqsave(&mbus->lock, flags);
195 if (list_empty(&rp->e_list)) {
196 spin_unlock_irqrestore(&mbus->lock, flags);
202 spin_unlock_irqrestore(&mbus->lock, flags);
203 return list_entry(p, struct mon_event_text, e_link);
208 static int mon_text_open(struct inode *inode, struct file *file)
210 struct mon_bus *mbus;
211 struct usb_bus *ubus;
212 struct mon_reader_text *rp;
215 mutex_lock(&mon_lock);
216 mbus = inode->u.generic_ip;
219 rp = kzalloc(sizeof(struct mon_reader_text), GFP_KERNEL);
224 INIT_LIST_HEAD(&rp->e_list);
225 init_waitqueue_head(&rp->wait);
226 mutex_init(&rp->printf_lock);
228 rp->printf_size = PRINTF_DFL;
229 rp->printf_buf = kmalloc(rp->printf_size, GFP_KERNEL);
230 if (rp->printf_buf == NULL) {
237 rp->r.rnf_submit = mon_text_submit;
238 rp->r.rnf_complete = mon_text_complete;
240 snprintf(rp->slab_name, SLAB_NAME_SZ, "mon%dt_%lx", ubus->busnum,
242 rp->e_slab = kmem_cache_create(rp->slab_name,
243 sizeof(struct mon_event_text), sizeof(long), 0,
244 mon_text_ctor, mon_text_dtor);
245 if (rp->e_slab == NULL) {
250 mon_reader_add(mbus, &rp->r);
252 file->private_data = rp;
253 mutex_unlock(&mon_lock);
257 // kmem_cache_destroy(rp->e_slab);
259 kfree(rp->printf_buf);
263 mutex_unlock(&mon_lock);
268 * For simplicity, we read one record in one system call and throw out
269 * what does not fit. This means that the following does not work:
270 * dd if=/dbg/usbmon/0t bs=10
271 * Also, we do not allow seeks and do not bother advancing the offset.
273 static ssize_t mon_text_read(struct file *file, char __user *buf,
274 size_t nbytes, loff_t *ppos)
276 struct mon_reader_text *rp = file->private_data;
277 struct mon_bus *mbus = rp->r.m_bus;
278 DECLARE_WAITQUEUE(waita, current);
279 struct mon_event_text *ep;
285 add_wait_queue(&rp->wait, &waita);
286 set_current_state(TASK_INTERRUPTIBLE);
287 while ((ep = mon_text_fetch(rp, mbus)) == NULL) {
288 if (file->f_flags & O_NONBLOCK) {
289 set_current_state(TASK_RUNNING);
290 remove_wait_queue(&rp->wait, &waita);
291 return -EWOULDBLOCK; /* Same as EAGAIN in Linux */
294 * We do not count nwaiters, because ->release is supposed
295 * to be called when all openers are gone only.
298 if (signal_pending(current)) {
299 remove_wait_queue(&rp->wait, &waita);
302 set_current_state(TASK_INTERRUPTIBLE);
304 set_current_state(TASK_RUNNING);
305 remove_wait_queue(&rp->wait, &waita);
307 mutex_lock(&rp->printf_lock);
309 pbuf = rp->printf_buf;
310 limit = rp->printf_size;
312 udir = usb_pipein(ep->pipe) ? 'i' : 'o';
313 switch (usb_pipetype(ep->pipe)) {
314 case PIPE_ISOCHRONOUS: utype = 'Z'; break;
315 case PIPE_INTERRUPT: utype = 'I'; break;
316 case PIPE_CONTROL: utype = 'C'; break;
317 default: /* PIPE_BULK */ utype = 'B';
319 cnt += snprintf(pbuf + cnt, limit - cnt,
320 "%lx %u %c %c%c:%03u:%02u",
321 ep->id, ep->tstamp, ep->type,
322 utype, udir, usb_pipedevice(ep->pipe), usb_pipeendpoint(ep->pipe));
324 if (ep->setup_flag == 0) { /* Setup packet is present and captured */
325 cnt += snprintf(pbuf + cnt, limit - cnt,
326 " s %02x %02x %04x %04x %04x",
329 (ep->setup[3] << 8) | ep->setup[2],
330 (ep->setup[5] << 8) | ep->setup[4],
331 (ep->setup[7] << 8) | ep->setup[6]);
332 } else if (ep->setup_flag != '-') { /* Unable to capture setup packet */
333 cnt += snprintf(pbuf + cnt, limit - cnt,
334 " %c __ __ ____ ____ ____", ep->setup_flag);
335 } else { /* No setup for this kind of URB */
336 cnt += snprintf(pbuf + cnt, limit - cnt, " %d", ep->status);
338 cnt += snprintf(pbuf + cnt, limit - cnt, " %d", ep->length);
340 if ((data_len = ep->length) > 0) {
341 if (ep->data_flag == 0) {
342 cnt += snprintf(pbuf + cnt, limit - cnt, " =");
343 if (data_len >= DATA_MAX)
345 for (i = 0; i < data_len; i++) {
347 cnt += snprintf(pbuf + cnt, limit - cnt,
350 cnt += snprintf(pbuf + cnt, limit - cnt,
351 "%02x", ep->data[i]);
353 cnt += snprintf(pbuf + cnt, limit - cnt, "\n");
355 cnt += snprintf(pbuf + cnt, limit - cnt,
356 " %c\n", ep->data_flag);
359 cnt += snprintf(pbuf + cnt, limit - cnt, "\n");
362 if (copy_to_user(buf, rp->printf_buf, cnt))
364 mutex_unlock(&rp->printf_lock);
365 kmem_cache_free(rp->e_slab, ep);
369 static int mon_text_release(struct inode *inode, struct file *file)
371 struct mon_reader_text *rp = file->private_data;
372 struct mon_bus *mbus;
373 /* unsigned long flags; */
375 struct mon_event_text *ep;
377 mutex_lock(&mon_lock);
378 mbus = inode->u.generic_ip;
380 if (mbus->nreaders <= 0) {
381 printk(KERN_ERR TAG ": consistency error on close\n");
382 mutex_unlock(&mon_lock);
385 mon_reader_del(mbus, &rp->r);
388 * In theory, e_list is protected by mbus->lock. However,
389 * after mon_reader_del has finished, the following is the case:
390 * - we are not on reader list anymore, so new events won't be added;
391 * - whole mbus may be dropped if it was orphaned.
392 * So, we better not touch mbus.
394 /* spin_lock_irqsave(&mbus->lock, flags); */
395 while (!list_empty(&rp->e_list)) {
397 ep = list_entry(p, struct mon_event_text, e_link);
400 kmem_cache_free(rp->e_slab, ep);
402 /* spin_unlock_irqrestore(&mbus->lock, flags); */
404 kmem_cache_destroy(rp->e_slab);
405 kfree(rp->printf_buf);
408 mutex_unlock(&mon_lock);
412 struct file_operations mon_fops_text = {
413 .owner = THIS_MODULE,
414 .open = mon_text_open,
416 .read = mon_text_read,
417 /* .write = mon_text_write, */
418 /* .poll = mon_text_poll, */
419 /* .ioctl = mon_text_ioctl, */
420 .release = mon_text_release,
424 * Slab interface: constructor.
426 static void mon_text_ctor(void *mem, kmem_cache_t *slab, unsigned long sflags)
429 * Nothing to initialize. No, really!
430 * So, we fill it with garbage to emulate a reused object.
432 memset(mem, 0xe5, sizeof(struct mon_event_text));
435 static void mon_text_dtor(void *mem, kmem_cache_t *slab, unsigned long sflags)