1592 find_memory_area(struct usb_dev_state *ps, const struct usbdevfs_urb *uurb)  in find_memory_area()  argument
1596 	unsigned long uurb_start = (unsigned long)uurb->buffer;  in find_memory_area()
1602 			if (uurb->buffer_length > iter->vm_start + iter->size -  in find_memory_area()
1616 static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb,  in proc_do_submiturb()  argument
1638 	if (uurb->type == USBDEVFS_URB_TYPE_ISO)  in proc_do_submiturb()
1641 	if (uurb->flags & ~mask)  in proc_do_submiturb()
1644 	if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)  in proc_do_submiturb()
1646 	if (uurb->buffer_length > 0 && !uurb->buffer)  in proc_do_submiturb()
1648 	if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&  in proc_do_submiturb()
1649 	    (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {  in proc_do_submiturb()
1650 		ifnum = findintfep(ps->dev, uurb->endpoint);  in proc_do_submiturb()
1657 	ep = ep_to_host_endpoint(ps->dev, uurb->endpoint);  in proc_do_submiturb()
1660 	is_in = (uurb->endpoint & USB_ENDPOINT_DIR_MASK) != 0;  in proc_do_submiturb()
1663 	switch (uurb->type) {  in proc_do_submiturb()
1668 		if (uurb->buffer_length < 8)  in proc_do_submiturb()
1673 		if (copy_from_user(dr, uurb->buffer, 8)) {  in proc_do_submiturb()
1677 		if (uurb->buffer_length < (le16_to_cpu(dr->wLength) + 8)) {  in proc_do_submiturb()
1685 		uurb->buffer_length = le16_to_cpu(dr->wLength);  in proc_do_submiturb()
1686 		uurb->buffer += 8;  in proc_do_submiturb()
1687 		if ((dr->bRequestType & USB_DIR_IN) && uurb->buffer_length) {  in proc_do_submiturb()
1689 			uurb->endpoint |= USB_DIR_IN;  in proc_do_submiturb()
1692 			uurb->endpoint &= ~USB_DIR_IN;  in proc_do_submiturb()
1717 			uurb->type = USBDEVFS_URB_TYPE_INTERRUPT;  in proc_do_submiturb()
1720 		num_sgs = DIV_ROUND_UP(uurb->buffer_length, USB_SG_SIZE);  in proc_do_submiturb()
1724 			stream_id = uurb->stream_id;  in proc_do_submiturb()
1739 		if (uurb->number_of_packets < 1 ||  in proc_do_submiturb()
1740 		    uurb->number_of_packets > 128)  in proc_do_submiturb()
1744 		number_of_packets = uurb->number_of_packets;  in proc_do_submiturb()
1765 		uurb->buffer_length = totlen;  in proc_do_submiturb()
1772 	if (uurb->buffer_length > 0 &&  in proc_do_submiturb()
1773 			!access_ok(uurb->buffer, uurb->buffer_length)) {  in proc_do_submiturb()
1783 	as->usbm = find_memory_area(ps, uurb);  in proc_do_submiturb()
1797 	     (as->usbm ? 0 : uurb->buffer_length) +  in proc_do_submiturb()
1815 		totlen = uurb->buffer_length;  in proc_do_submiturb()
1826 				if (copy_from_user(buf, uurb->buffer, u)) {  in proc_do_submiturb()
1830 				uurb->buffer += u;  in proc_do_submiturb()
1834 	} else if (uurb->buffer_length > 0) {  in proc_do_submiturb()
1836 			unsigned long uurb_start = (unsigned long)uurb->buffer;  in proc_do_submiturb()
1841 			as->urb->transfer_buffer = kmalloc(uurb->buffer_length,  in proc_do_submiturb()
1849 						   uurb->buffer,  in proc_do_submiturb()
1850 						   uurb->buffer_length)) {  in proc_do_submiturb()
1854 			} else if (uurb->type == USBDEVFS_URB_TYPE_ISO) {  in proc_do_submiturb()
1862 						uurb->buffer_length);  in proc_do_submiturb()
1867 	as->urb->pipe = (uurb->type << 30) |  in proc_do_submiturb()
1868 			__create_pipe(ps->dev, uurb->endpoint & 0xf) |  in proc_do_submiturb()
1869 			(uurb->endpoint & USB_DIR_IN);  in proc_do_submiturb()
1876 	if (uurb->flags & USBDEVFS_URB_ISO_ASAP)  in proc_do_submiturb()
1878 	if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)  in proc_do_submiturb()
1880 	if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)  in proc_do_submiturb()
1882 	if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)  in proc_do_submiturb()
1886 	if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)  in proc_do_submiturb()
1888 	if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)  in proc_do_submiturb()
1891 	as->urb->transfer_buffer_length = uurb->buffer_length;  in proc_do_submiturb()
1894 	as->urb->start_frame = uurb->start_frame;  in proc_do_submiturb()
1899 		if (uurb->type == USBDEVFS_URB_TYPE_ISO ||  in proc_do_submiturb()
1921 		unsigned long uurb_start = (unsigned long)uurb->buffer;  in proc_do_submiturb()
1926 	} else if (is_in && uurb->buffer_length > 0)  in proc_do_submiturb()
1927 		as->userbuffer = uurb->buffer;  in proc_do_submiturb()
1928 	as->signr = uurb->signr;  in proc_do_submiturb()
1954 		if (uurb->flags & USBDEVFS_URB_BULK_CONTINUATION)  in proc_do_submiturb()
1991 	struct usbdevfs_urb uurb;  in proc_submiturb()  local
1994 	if (copy_from_user(&uurb, arg, sizeof(uurb)))  in proc_submiturb()
2000 	return proc_do_submiturb(ps, &uurb,  in proc_submiturb()
2175 		     struct usbdevfs_urb32 __user *uurb)  in get_urb32()  argument
2178 	if (copy_from_user(&urb32, uurb, sizeof(*uurb)))  in get_urb32()
2197 	struct usbdevfs_urb uurb;  in proc_submiturb_compat()  local
2200 	if (get_urb32(&uurb, (struct usbdevfs_urb32 __user *)arg))  in proc_submiturb_compat()
2206 	return proc_do_submiturb(ps, &uurb,  in proc_submiturb_compat()