2 * The USB Monitor, inspired by Dave Harding's USBMon.
4 * This is a text format reader.
7 #include <linux/kernel.h>
8 #include <linux/list.h>
10 #include <linux/time.h>
11 #include <linux/mutex.h>
12 #include <asm/uaccess.h>
17 * No, we do not want arbitrarily long data strings.
18 * Use the binary interface if you want to capture bulk data!
23 * Defined by USB 2.0 clause 9.3, table 9.2.
28 * This limit exists to prevent OOMs when the user process stops reading.
29 * If usbmon were available to unprivileged processes, it might be open
30 * to a local DoS. But we have to keep to root in order to prevent
31 * password sniffing from HID devices.
33 #define EVENT_MAX (2*PAGE_SIZE / sizeof(struct mon_event_text))
35 #define PRINTF_DFL 160
37 struct mon_event_text
{
38 struct list_head e_link
;
39 int type
; /* submit, complete, etc. */
40 unsigned int pipe
; /* Pipe */
41 unsigned long id
; /* From pointer, most of the time */
43 int length
; /* Depends on type: xfer length or act length */
47 unsigned char setup
[SETUP_MAX
];
48 unsigned char data
[DATA_MAX
];
51 #define SLAB_NAME_SZ 30
52 struct mon_reader_text
{
55 struct list_head e_list
;
56 struct mon_reader r
; /* In C, parent class can be placed anywhere */
58 wait_queue_head_t wait
;
61 struct mutex printf_lock
;
63 char slab_name
[SLAB_NAME_SZ
];
66 static void mon_text_ctor(void *, kmem_cache_t
*, unsigned long);
72 * May be called from an interrupt.
74 * This is called with the whole mon_bus locked, so no additional lock.
77 static inline char mon_text_get_setup(struct mon_event_text
*ep
,
78 struct urb
*urb
, char ev_type
)
81 if (!usb_pipecontrol(urb
->pipe
) || ev_type
!= 'S')
84 if (urb
->transfer_flags
& URB_NO_SETUP_DMA_MAP
)
85 return mon_dmapeek(ep
->setup
, urb
->setup_dma
, SETUP_MAX
);
86 if (urb
->setup_packet
== NULL
)
87 return 'Z'; /* '0' would be not as pretty. */
89 memcpy(ep
->setup
, urb
->setup_packet
, SETUP_MAX
);
93 static inline char mon_text_get_data(struct mon_event_text
*ep
, struct urb
*urb
,
94 int len
, char ev_type
)
103 if (usb_pipein(pipe
)) {
112 * The check to see if it's safe to poke at data has an enormous
113 * number of corner cases, but it seems that the following is
116 * We do not even try to look at transfer_buffer, because it can
117 * contain non-NULL garbage in case the upper level promised to
118 * set DMA for the HCD.
120 if (urb
->transfer_flags
& URB_NO_TRANSFER_DMA_MAP
)
121 return mon_dmapeek(ep
->data
, urb
->transfer_dma
, len
);
123 if (urb
->transfer_buffer
== NULL
)
124 return 'Z'; /* '0' would be not as pretty. */
126 memcpy(ep
->data
, urb
->transfer_buffer
, len
);
130 static inline unsigned int mon_get_timestamp(void)
135 do_gettimeofday(&tval
);
136 stamp
= tval
.tv_sec
& 0xFFFF; /* 2^32 = 4294967296. Limit to 4096s. */
137 stamp
= stamp
* 1000000 + tval
.tv_usec
;
141 static void mon_text_event(struct mon_reader_text
*rp
, struct urb
*urb
,
144 struct mon_event_text
*ep
;
147 stamp
= mon_get_timestamp();
149 if (rp
->nevents
>= EVENT_MAX
||
150 (ep
= kmem_cache_alloc(rp
->e_slab
, SLAB_ATOMIC
)) == NULL
) {
151 rp
->r
.m_bus
->cnt_text_lost
++;
156 ep
->pipe
= urb
->pipe
;
157 ep
->id
= (unsigned long) urb
;
159 ep
->length
= (ev_type
== 'S') ?
160 urb
->transfer_buffer_length
: urb
->actual_length
;
161 /* Collecting status makes debugging sense for submits, too */
162 ep
->status
= urb
->status
;
164 ep
->setup_flag
= mon_text_get_setup(ep
, urb
, ev_type
);
165 ep
->data_flag
= mon_text_get_data(ep
, urb
, ep
->length
, ev_type
);
168 list_add_tail(&ep
->e_link
, &rp
->e_list
);
172 static void mon_text_submit(void *data
, struct urb
*urb
)
174 struct mon_reader_text
*rp
= data
;
175 mon_text_event(rp
, urb
, 'S');
178 static void mon_text_complete(void *data
, struct urb
*urb
)
180 struct mon_reader_text
*rp
= data
;
181 mon_text_event(rp
, urb
, 'C');
184 static void mon_text_error(void *data
, struct urb
*urb
, int error
)
186 struct mon_reader_text
*rp
= data
;
187 struct mon_event_text
*ep
;
189 if (rp
->nevents
>= EVENT_MAX
||
190 (ep
= kmem_cache_alloc(rp
->e_slab
, SLAB_ATOMIC
)) == NULL
) {
191 rp
->r
.m_bus
->cnt_text_lost
++;
196 ep
->pipe
= urb
->pipe
;
197 ep
->id
= (unsigned long) urb
;
202 ep
->setup_flag
= '-';
206 list_add_tail(&ep
->e_link
, &rp
->e_list
);
211 * Fetch next event from the circular buffer.
213 static struct mon_event_text
*mon_text_fetch(struct mon_reader_text
*rp
,
214 struct mon_bus
*mbus
)
219 spin_lock_irqsave(&mbus
->lock
, flags
);
220 if (list_empty(&rp
->e_list
)) {
221 spin_unlock_irqrestore(&mbus
->lock
, flags
);
227 spin_unlock_irqrestore(&mbus
->lock
, flags
);
228 return list_entry(p
, struct mon_event_text
, e_link
);
233 static int mon_text_open(struct inode
*inode
, struct file
*file
)
235 struct mon_bus
*mbus
;
236 struct usb_bus
*ubus
;
237 struct mon_reader_text
*rp
;
240 mutex_lock(&mon_lock
);
241 mbus
= inode
->u
.generic_ip
;
244 rp
= kzalloc(sizeof(struct mon_reader_text
), GFP_KERNEL
);
249 INIT_LIST_HEAD(&rp
->e_list
);
250 init_waitqueue_head(&rp
->wait
);
251 mutex_init(&rp
->printf_lock
);
253 rp
->printf_size
= PRINTF_DFL
;
254 rp
->printf_buf
= kmalloc(rp
->printf_size
, GFP_KERNEL
);
255 if (rp
->printf_buf
== NULL
) {
262 rp
->r
.rnf_submit
= mon_text_submit
;
263 rp
->r
.rnf_error
= mon_text_error
;
264 rp
->r
.rnf_complete
= mon_text_complete
;
266 snprintf(rp
->slab_name
, SLAB_NAME_SZ
, "mon%dt_%lx", ubus
->busnum
,
268 rp
->e_slab
= kmem_cache_create(rp
->slab_name
,
269 sizeof(struct mon_event_text
), sizeof(long), 0,
270 mon_text_ctor
, NULL
);
271 if (rp
->e_slab
== NULL
) {
276 mon_reader_add(mbus
, &rp
->r
);
278 file
->private_data
= rp
;
279 mutex_unlock(&mon_lock
);
283 // kmem_cache_destroy(rp->e_slab);
285 kfree(rp
->printf_buf
);
289 mutex_unlock(&mon_lock
);
294 * For simplicity, we read one record in one system call and throw out
295 * what does not fit. This means that the following does not work:
296 * dd if=/dbg/usbmon/0t bs=10
297 * Also, we do not allow seeks and do not bother advancing the offset.
299 static ssize_t
mon_text_read(struct file
*file
, char __user
*buf
,
300 size_t nbytes
, loff_t
*ppos
)
302 struct mon_reader_text
*rp
= file
->private_data
;
303 struct mon_bus
*mbus
= rp
->r
.m_bus
;
304 DECLARE_WAITQUEUE(waita
, current
);
305 struct mon_event_text
*ep
;
311 add_wait_queue(&rp
->wait
, &waita
);
312 set_current_state(TASK_INTERRUPTIBLE
);
313 while ((ep
= mon_text_fetch(rp
, mbus
)) == NULL
) {
314 if (file
->f_flags
& O_NONBLOCK
) {
315 set_current_state(TASK_RUNNING
);
316 remove_wait_queue(&rp
->wait
, &waita
);
317 return -EWOULDBLOCK
; /* Same as EAGAIN in Linux */
320 * We do not count nwaiters, because ->release is supposed
321 * to be called when all openers are gone only.
324 if (signal_pending(current
)) {
325 remove_wait_queue(&rp
->wait
, &waita
);
328 set_current_state(TASK_INTERRUPTIBLE
);
330 set_current_state(TASK_RUNNING
);
331 remove_wait_queue(&rp
->wait
, &waita
);
333 mutex_lock(&rp
->printf_lock
);
335 pbuf
= rp
->printf_buf
;
336 limit
= rp
->printf_size
;
338 udir
= usb_pipein(ep
->pipe
) ? 'i' : 'o';
339 switch (usb_pipetype(ep
->pipe
)) {
340 case PIPE_ISOCHRONOUS
: utype
= 'Z'; break;
341 case PIPE_INTERRUPT
: utype
= 'I'; break;
342 case PIPE_CONTROL
: utype
= 'C'; break;
343 default: /* PIPE_BULK */ utype
= 'B';
345 cnt
+= snprintf(pbuf
+ cnt
, limit
- cnt
,
346 "%lx %u %c %c%c:%03u:%02u",
347 ep
->id
, ep
->tstamp
, ep
->type
,
348 utype
, udir
, usb_pipedevice(ep
->pipe
), usb_pipeendpoint(ep
->pipe
));
350 if (ep
->setup_flag
== 0) { /* Setup packet is present and captured */
351 cnt
+= snprintf(pbuf
+ cnt
, limit
- cnt
,
352 " s %02x %02x %04x %04x %04x",
355 (ep
->setup
[3] << 8) | ep
->setup
[2],
356 (ep
->setup
[5] << 8) | ep
->setup
[4],
357 (ep
->setup
[7] << 8) | ep
->setup
[6]);
358 } else if (ep
->setup_flag
!= '-') { /* Unable to capture setup packet */
359 cnt
+= snprintf(pbuf
+ cnt
, limit
- cnt
,
360 " %c __ __ ____ ____ ____", ep
->setup_flag
);
361 } else { /* No setup for this kind of URB */
362 cnt
+= snprintf(pbuf
+ cnt
, limit
- cnt
, " %d", ep
->status
);
364 cnt
+= snprintf(pbuf
+ cnt
, limit
- cnt
, " %d", ep
->length
);
366 if ((data_len
= ep
->length
) > 0) {
367 if (ep
->data_flag
== 0) {
368 cnt
+= snprintf(pbuf
+ cnt
, limit
- cnt
, " =");
369 if (data_len
>= DATA_MAX
)
371 for (i
= 0; i
< data_len
; i
++) {
373 cnt
+= snprintf(pbuf
+ cnt
, limit
- cnt
,
376 cnt
+= snprintf(pbuf
+ cnt
, limit
- cnt
,
377 "%02x", ep
->data
[i
]);
379 cnt
+= snprintf(pbuf
+ cnt
, limit
- cnt
, "\n");
381 cnt
+= snprintf(pbuf
+ cnt
, limit
- cnt
,
382 " %c\n", ep
->data_flag
);
385 cnt
+= snprintf(pbuf
+ cnt
, limit
- cnt
, "\n");
388 if (copy_to_user(buf
, rp
->printf_buf
, cnt
))
390 mutex_unlock(&rp
->printf_lock
);
391 kmem_cache_free(rp
->e_slab
, ep
);
395 static int mon_text_release(struct inode
*inode
, struct file
*file
)
397 struct mon_reader_text
*rp
= file
->private_data
;
398 struct mon_bus
*mbus
;
399 /* unsigned long flags; */
401 struct mon_event_text
*ep
;
403 mutex_lock(&mon_lock
);
404 mbus
= inode
->u
.generic_ip
;
406 if (mbus
->nreaders
<= 0) {
407 printk(KERN_ERR TAG
": consistency error on close\n");
408 mutex_unlock(&mon_lock
);
411 mon_reader_del(mbus
, &rp
->r
);
414 * In theory, e_list is protected by mbus->lock. However,
415 * after mon_reader_del has finished, the following is the case:
416 * - we are not on reader list anymore, so new events won't be added;
417 * - whole mbus may be dropped if it was orphaned.
418 * So, we better not touch mbus.
420 /* spin_lock_irqsave(&mbus->lock, flags); */
421 while (!list_empty(&rp
->e_list
)) {
423 ep
= list_entry(p
, struct mon_event_text
, e_link
);
426 kmem_cache_free(rp
->e_slab
, ep
);
428 /* spin_unlock_irqrestore(&mbus->lock, flags); */
430 kmem_cache_destroy(rp
->e_slab
);
431 kfree(rp
->printf_buf
);
434 mutex_unlock(&mon_lock
);
438 struct file_operations mon_fops_text
= {
439 .owner
= THIS_MODULE
,
440 .open
= mon_text_open
,
442 .read
= mon_text_read
,
443 /* .write = mon_text_write, */
444 /* .poll = mon_text_poll, */
445 /* .ioctl = mon_text_ioctl, */
446 .release
= mon_text_release
,
450 * Slab interface: constructor.
452 static void mon_text_ctor(void *mem
, kmem_cache_t
*slab
, unsigned long sflags
)
455 * Nothing to initialize. No, really!
456 * So, we fill it with garbage to emulate a reused object.
458 memset(mem
, 0xe5, sizeof(struct mon_event_text
));