1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Released under the GPLv2 only. 4 */ 5 6 #include <linux/usb.h> 7 #include <linux/usb/ch9.h> 8 #include <linux/usb/hcd.h> 9 #include <linux/usb/quirks.h> 10 #include <linux/module.h> 11 #include <linux/slab.h> 12 #include <linux/device.h> 13 #include <asm/byteorder.h> 14 #include "usb.h" 15 16 17 #define USB_MAXALTSETTING 128 /* Hard limit */ 18 19 #define USB_MAXCONFIG 8 /* Arbitrary limit */ 20 21 22 static inline const char *plural(int n) 23 { 24 return (n == 1 ? "" : "s"); 25 } 26 27 static int find_next_descriptor(unsigned char *buffer, int size, 28 int dt1, int dt2, int *num_skipped) 29 { 30 struct usb_descriptor_header *h; 31 int n = 0; 32 unsigned char *buffer0 = buffer; 33 34 /* Find the next descriptor of type dt1 or dt2 */ 35 while (size > 0) { 36 h = (struct usb_descriptor_header *) buffer; 37 if (h->bDescriptorType == dt1 || h->bDescriptorType == dt2) 38 break; 39 buffer += h->bLength; 40 size -= h->bLength; 41 ++n; 42 } 43 44 /* Store the number of descriptors skipped and return the 45 * number of bytes skipped */ 46 if (num_skipped) 47 *num_skipped = n; 48 return buffer - buffer0; 49 } 50 51 static void usb_parse_ssp_isoc_endpoint_companion(struct device *ddev, 52 int cfgno, int inum, int asnum, struct usb_host_endpoint *ep, 53 unsigned char *buffer, int size) 54 { 55 struct usb_ssp_isoc_ep_comp_descriptor *desc; 56 57 /* 58 * The SuperSpeedPlus Isoc endpoint companion descriptor immediately 59 * follows the SuperSpeed Endpoint Companion descriptor 60 */ 61 desc = (struct usb_ssp_isoc_ep_comp_descriptor *) buffer; 62 if (desc->bDescriptorType != USB_DT_SSP_ISOC_ENDPOINT_COMP || 63 size < USB_DT_SSP_ISOC_EP_COMP_SIZE) { 64 dev_warn(ddev, "Invalid SuperSpeedPlus isoc endpoint companion" 65 "for config %d interface %d altsetting %d ep %d.\n", 66 cfgno, inum, asnum, ep->desc.bEndpointAddress); 67 return; 68 } 69 memcpy(&ep->ssp_isoc_ep_comp, desc, USB_DT_SSP_ISOC_EP_COMP_SIZE); 70 } 71 72 static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno, 73 int inum, int asnum, struct usb_host_endpoint *ep, 74 unsigned char *buffer, int size) 75 { 76 struct usb_ss_ep_comp_descriptor *desc; 77 int max_tx; 78 79 /* The SuperSpeed endpoint companion descriptor is supposed to 80 * be the first thing immediately following the endpoint descriptor. 81 */ 82 desc = (struct usb_ss_ep_comp_descriptor *) buffer; 83 84 if (desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP || 85 size < USB_DT_SS_EP_COMP_SIZE) { 86 dev_warn(ddev, "No SuperSpeed endpoint companion for config %d " 87 " interface %d altsetting %d ep %d: " 88 "using minimum values\n", 89 cfgno, inum, asnum, ep->desc.bEndpointAddress); 90 91 /* Fill in some default values. 92 * Leave bmAttributes as zero, which will mean no streams for 93 * bulk, and isoc won't support multiple bursts of packets. 94 * With bursts of only one packet, and a Mult of 1, the max 95 * amount of data moved per endpoint service interval is one 96 * packet. 97 */ 98 ep->ss_ep_comp.bLength = USB_DT_SS_EP_COMP_SIZE; 99 ep->ss_ep_comp.bDescriptorType = USB_DT_SS_ENDPOINT_COMP; 100 if (usb_endpoint_xfer_isoc(&ep->desc) || 101 usb_endpoint_xfer_int(&ep->desc)) 102 ep->ss_ep_comp.wBytesPerInterval = 103 ep->desc.wMaxPacketSize; 104 return; 105 } 106 buffer += desc->bLength; 107 size -= desc->bLength; 108 memcpy(&ep->ss_ep_comp, desc, USB_DT_SS_EP_COMP_SIZE); 109 110 /* Check the various values */ 111 if (usb_endpoint_xfer_control(&ep->desc) && desc->bMaxBurst != 0) { 112 dev_warn(ddev, "Control endpoint with bMaxBurst = %d in " 113 "config %d interface %d altsetting %d ep %d: " 114 "setting to zero\n", desc->bMaxBurst, 115 cfgno, inum, asnum, ep->desc.bEndpointAddress); 116 ep->ss_ep_comp.bMaxBurst = 0; 117 } else if (desc->bMaxBurst > 15) { 118 dev_warn(ddev, "Endpoint with bMaxBurst = %d in " 119 "config %d interface %d altsetting %d ep %d: " 120 "setting to 15\n", desc->bMaxBurst, 121 cfgno, inum, asnum, ep->desc.bEndpointAddress); 122 ep->ss_ep_comp.bMaxBurst = 15; 123 } 124 125 if ((usb_endpoint_xfer_control(&ep->desc) || 126 usb_endpoint_xfer_int(&ep->desc)) && 127 desc->bmAttributes != 0) { 128 dev_warn(ddev, "%s endpoint with bmAttributes = %d in " 129 "config %d interface %d altsetting %d ep %d: " 130 "setting to zero\n", 131 usb_endpoint_xfer_control(&ep->desc) ? "Control" : "Bulk", 132 desc->bmAttributes, 133 cfgno, inum, asnum, ep->desc.bEndpointAddress); 134 ep->ss_ep_comp.bmAttributes = 0; 135 } else if (usb_endpoint_xfer_bulk(&ep->desc) && 136 desc->bmAttributes > 16) { 137 dev_warn(ddev, "Bulk endpoint with more than 65536 streams in " 138 "config %d interface %d altsetting %d ep %d: " 139 "setting to max\n", 140 cfgno, inum, asnum, ep->desc.bEndpointAddress); 141 ep->ss_ep_comp.bmAttributes = 16; 142 } else if (usb_endpoint_xfer_isoc(&ep->desc) && 143 !USB_SS_SSP_ISOC_COMP(desc->bmAttributes) && 144 USB_SS_MULT(desc->bmAttributes) > 3) { 145 dev_warn(ddev, "Isoc endpoint has Mult of %d in " 146 "config %d interface %d altsetting %d ep %d: " 147 "setting to 3\n", 148 USB_SS_MULT(desc->bmAttributes), 149 cfgno, inum, asnum, ep->desc.bEndpointAddress); 150 ep->ss_ep_comp.bmAttributes = 2; 151 } 152 153 if (usb_endpoint_xfer_isoc(&ep->desc)) 154 max_tx = (desc->bMaxBurst + 1) * 155 (USB_SS_MULT(desc->bmAttributes)) * 156 usb_endpoint_maxp(&ep->desc); 157 else if (usb_endpoint_xfer_int(&ep->desc)) 158 max_tx = usb_endpoint_maxp(&ep->desc) * 159 (desc->bMaxBurst + 1); 160 else 161 max_tx = 999999; 162 if (le16_to_cpu(desc->wBytesPerInterval) > max_tx) { 163 dev_warn(ddev, "%s endpoint with wBytesPerInterval of %d in " 164 "config %d interface %d altsetting %d ep %d: " 165 "setting to %d\n", 166 usb_endpoint_xfer_isoc(&ep->desc) ? "Isoc" : "Int", 167 le16_to_cpu(desc->wBytesPerInterval), 168 cfgno, inum, asnum, ep->desc.bEndpointAddress, 169 max_tx); 170 ep->ss_ep_comp.wBytesPerInterval = cpu_to_le16(max_tx); 171 } 172 /* Parse a possible SuperSpeedPlus isoc ep companion descriptor */ 173 if (usb_endpoint_xfer_isoc(&ep->desc) && 174 USB_SS_SSP_ISOC_COMP(desc->bmAttributes)) 175 usb_parse_ssp_isoc_endpoint_companion(ddev, cfgno, inum, asnum, 176 ep, buffer, size); 177 } 178 179 static const unsigned short low_speed_maxpacket_maxes[4] = { 180 [USB_ENDPOINT_XFER_CONTROL] = 8, 181 [USB_ENDPOINT_XFER_ISOC] = 0, 182 [USB_ENDPOINT_XFER_BULK] = 0, 183 [USB_ENDPOINT_XFER_INT] = 8, 184 }; 185 static const unsigned short full_speed_maxpacket_maxes[4] = { 186 [USB_ENDPOINT_XFER_CONTROL] = 64, 187 [USB_ENDPOINT_XFER_ISOC] = 1023, 188 [USB_ENDPOINT_XFER_BULK] = 64, 189 [USB_ENDPOINT_XFER_INT] = 64, 190 }; 191 static const unsigned short high_speed_maxpacket_maxes[4] = { 192 [USB_ENDPOINT_XFER_CONTROL] = 64, 193 [USB_ENDPOINT_XFER_ISOC] = 1024, 194 195 /* Bulk should be 512, but some devices use 1024: we will warn below */ 196 [USB_ENDPOINT_XFER_BULK] = 1024, 197 [USB_ENDPOINT_XFER_INT] = 1024, 198 }; 199 static const unsigned short super_speed_maxpacket_maxes[4] = { 200 [USB_ENDPOINT_XFER_CONTROL] = 512, 201 [USB_ENDPOINT_XFER_ISOC] = 1024, 202 [USB_ENDPOINT_XFER_BULK] = 1024, 203 [USB_ENDPOINT_XFER_INT] = 1024, 204 }; 205 206 static bool endpoint_is_duplicate(struct usb_endpoint_descriptor *e1, 207 struct usb_endpoint_descriptor *e2) 208 { 209 if (e1->bEndpointAddress == e2->bEndpointAddress) 210 return true; 211 212 if (usb_endpoint_xfer_control(e1) || usb_endpoint_xfer_control(e2)) { 213 if (usb_endpoint_num(e1) == usb_endpoint_num(e2)) 214 return true; 215 } 216 217 return false; 218 } 219 220 /* 221 * Check for duplicate endpoint addresses in other interfaces and in the 222 * altsetting currently being parsed. 223 */ 224 static bool config_endpoint_is_duplicate(struct usb_host_config *config, 225 int inum, int asnum, struct usb_endpoint_descriptor *d) 226 { 227 struct usb_endpoint_descriptor *epd; 228 struct usb_interface_cache *intfc; 229 struct usb_host_interface *alt; 230 int i, j, k; 231 232 for (i = 0; i < config->desc.bNumInterfaces; ++i) { 233 intfc = config->intf_cache[i]; 234 235 for (j = 0; j < intfc->num_altsetting; ++j) { 236 alt = &intfc->altsetting[j]; 237 238 if (alt->desc.bInterfaceNumber == inum && 239 alt->desc.bAlternateSetting != asnum) 240 continue; 241 242 for (k = 0; k < alt->desc.bNumEndpoints; ++k) { 243 epd = &alt->endpoint[k].desc; 244 245 if (endpoint_is_duplicate(epd, d)) 246 return true; 247 } 248 } 249 } 250 251 return false; 252 } 253 254 static int usb_parse_endpoint(struct device *ddev, int cfgno, 255 struct usb_host_config *config, int inum, int asnum, 256 struct usb_host_interface *ifp, int num_ep, 257 unsigned char *buffer, int size) 258 { 259 unsigned char *buffer0 = buffer; 260 struct usb_endpoint_descriptor *d; 261 struct usb_host_endpoint *endpoint; 262 int n, i, j, retval; 263 unsigned int maxp; 264 const unsigned short *maxpacket_maxes; 265 266 d = (struct usb_endpoint_descriptor *) buffer; 267 buffer += d->bLength; 268 size -= d->bLength; 269 270 if (d->bLength >= USB_DT_ENDPOINT_AUDIO_SIZE) 271 n = USB_DT_ENDPOINT_AUDIO_SIZE; 272 else if (d->bLength >= USB_DT_ENDPOINT_SIZE) 273 n = USB_DT_ENDPOINT_SIZE; 274 else { 275 dev_warn(ddev, "config %d interface %d altsetting %d has an " 276 "invalid endpoint descriptor of length %d, skipping\n", 277 cfgno, inum, asnum, d->bLength); 278 goto skip_to_next_endpoint_or_interface_descriptor; 279 } 280 281 i = d->bEndpointAddress & ~USB_ENDPOINT_DIR_MASK; 282 if (i >= 16 || i == 0) { 283 dev_warn(ddev, "config %d interface %d altsetting %d has an " 284 "invalid endpoint with address 0x%X, skipping\n", 285 cfgno, inum, asnum, d->bEndpointAddress); 286 goto skip_to_next_endpoint_or_interface_descriptor; 287 } 288 289 /* Only store as many endpoints as we have room for */ 290 if (ifp->desc.bNumEndpoints >= num_ep) 291 goto skip_to_next_endpoint_or_interface_descriptor; 292 293 /* Check for duplicate endpoint addresses */ 294 if (config_endpoint_is_duplicate(config, inum, asnum, d)) { 295 dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n", 296 cfgno, inum, asnum, d->bEndpointAddress); 297 goto skip_to_next_endpoint_or_interface_descriptor; 298 } 299 300 endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; 301 ++ifp->desc.bNumEndpoints; 302 303 memcpy(&endpoint->desc, d, n); 304 INIT_LIST_HEAD(&endpoint->urb_list); 305 306 /* 307 * Fix up bInterval values outside the legal range. 308 * Use 10 or 8 ms if no proper value can be guessed. 309 */ 310 i = 0; /* i = min, j = max, n = default */ 311 j = 255; 312 if (usb_endpoint_xfer_int(d)) { 313 i = 1; 314 switch (to_usb_device(ddev)->speed) { 315 case USB_SPEED_SUPER_PLUS: 316 case USB_SPEED_SUPER: 317 case USB_SPEED_HIGH: 318 /* 319 * Many device manufacturers are using full-speed 320 * bInterval values in high-speed interrupt endpoint 321 * descriptors. Try to fix those and fall back to an 322 * 8-ms default value otherwise. 323 */ 324 n = fls(d->bInterval*8); 325 if (n == 0) 326 n = 7; /* 8 ms = 2^(7-1) uframes */ 327 j = 16; 328 329 /* 330 * Adjust bInterval for quirked devices. 331 */ 332 /* 333 * This quirk fixes bIntervals reported in ms. 334 */ 335 if (to_usb_device(ddev)->quirks & 336 USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL) { 337 n = clamp(fls(d->bInterval) + 3, i, j); 338 i = j = n; 339 } 340 /* 341 * This quirk fixes bIntervals reported in 342 * linear microframes. 343 */ 344 if (to_usb_device(ddev)->quirks & 345 USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL) { 346 n = clamp(fls(d->bInterval), i, j); 347 i = j = n; 348 } 349 break; 350 default: /* USB_SPEED_FULL or _LOW */ 351 /* 352 * For low-speed, 10 ms is the official minimum. 353 * But some "overclocked" devices might want faster 354 * polling so we'll allow it. 355 */ 356 n = 10; 357 break; 358 } 359 } else if (usb_endpoint_xfer_isoc(d)) { 360 i = 1; 361 j = 16; 362 switch (to_usb_device(ddev)->speed) { 363 case USB_SPEED_HIGH: 364 n = 7; /* 8 ms = 2^(7-1) uframes */ 365 break; 366 default: /* USB_SPEED_FULL */ 367 n = 4; /* 8 ms = 2^(4-1) frames */ 368 break; 369 } 370 } 371 if (d->bInterval < i || d->bInterval > j) { 372 dev_warn(ddev, "config %d interface %d altsetting %d " 373 "endpoint 0x%X has an invalid bInterval %d, " 374 "changing to %d\n", 375 cfgno, inum, asnum, 376 d->bEndpointAddress, d->bInterval, n); 377 endpoint->desc.bInterval = n; 378 } 379 380 /* Some buggy low-speed devices have Bulk endpoints, which is 381 * explicitly forbidden by the USB spec. In an attempt to make 382 * them usable, we will try treating them as Interrupt endpoints. 383 */ 384 if (to_usb_device(ddev)->speed == USB_SPEED_LOW && 385 usb_endpoint_xfer_bulk(d)) { 386 dev_warn(ddev, "config %d interface %d altsetting %d " 387 "endpoint 0x%X is Bulk; changing to Interrupt\n", 388 cfgno, inum, asnum, d->bEndpointAddress); 389 endpoint->desc.bmAttributes = USB_ENDPOINT_XFER_INT; 390 endpoint->desc.bInterval = 1; 391 if (usb_endpoint_maxp(&endpoint->desc) > 8) 392 endpoint->desc.wMaxPacketSize = cpu_to_le16(8); 393 } 394 395 /* Validate the wMaxPacketSize field */ 396 maxp = usb_endpoint_maxp(&endpoint->desc); 397 if (maxp == 0) { 398 dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n", 399 cfgno, inum, asnum, d->bEndpointAddress); 400 goto skip_to_next_endpoint_or_interface_descriptor; 401 } 402 403 /* Find the highest legal maxpacket size for this endpoint */ 404 i = 0; /* additional transactions per microframe */ 405 switch (to_usb_device(ddev)->speed) { 406 case USB_SPEED_LOW: 407 maxpacket_maxes = low_speed_maxpacket_maxes; 408 break; 409 case USB_SPEED_FULL: 410 maxpacket_maxes = full_speed_maxpacket_maxes; 411 break; 412 case USB_SPEED_HIGH: 413 /* Bits 12..11 are allowed only for HS periodic endpoints */ 414 if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) { 415 i = maxp & (BIT(12) | BIT(11)); 416 maxp &= ~i; 417 } 418 /* fallthrough */ 419 default: 420 maxpacket_maxes = high_speed_maxpacket_maxes; 421 break; 422 case USB_SPEED_SUPER: 423 case USB_SPEED_SUPER_PLUS: 424 maxpacket_maxes = super_speed_maxpacket_maxes; 425 break; 426 } 427 j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)]; 428 429 if (maxp > j) { 430 dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n", 431 cfgno, inum, asnum, d->bEndpointAddress, maxp, j); 432 maxp = j; 433 endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp); 434 } 435 436 /* 437 * Some buggy high speed devices have bulk endpoints using 438 * maxpacket sizes other than 512. High speed HCDs may not 439 * be able to handle that particular bug, so let's warn... 440 */ 441 if (to_usb_device(ddev)->speed == USB_SPEED_HIGH 442 && usb_endpoint_xfer_bulk(d)) { 443 if (maxp != 512) 444 dev_warn(ddev, "config %d interface %d altsetting %d " 445 "bulk endpoint 0x%X has invalid maxpacket %d\n", 446 cfgno, inum, asnum, d->bEndpointAddress, 447 maxp); 448 } 449 450 /* Parse a possible SuperSpeed endpoint companion descriptor */ 451 if (to_usb_device(ddev)->speed >= USB_SPEED_SUPER) 452 usb_parse_ss_endpoint_companion(ddev, cfgno, 453 inum, asnum, endpoint, buffer, size); 454 455 /* Skip over any Class Specific or Vendor Specific descriptors; 456 * find the next endpoint or interface descriptor */ 457 endpoint->extra = buffer; 458 i = find_next_descriptor(buffer, size, USB_DT_ENDPOINT, 459 USB_DT_INTERFACE, &n); 460 endpoint->extralen = i; 461 retval = buffer - buffer0 + i; 462 if (n > 0) 463 dev_dbg(ddev, "skipped %d descriptor%s after %s\n", 464 n, plural(n), "endpoint"); 465 return retval; 466 467 skip_to_next_endpoint_or_interface_descriptor: 468 i = find_next_descriptor(buffer, size, USB_DT_ENDPOINT, 469 USB_DT_INTERFACE, NULL); 470 return buffer - buffer0 + i; 471 } 472 473 void usb_release_interface_cache(struct kref *ref) 474 { 475 struct usb_interface_cache *intfc = ref_to_usb_interface_cache(ref); 476 int j; 477 478 for (j = 0; j < intfc->num_altsetting; j++) { 479 struct usb_host_interface *alt = &intfc->altsetting[j]; 480 481 kfree(alt->endpoint); 482 kfree(alt->string); 483 } 484 kfree(intfc); 485 } 486 487 static int usb_parse_interface(struct device *ddev, int cfgno, 488 struct usb_host_config *config, unsigned char *buffer, int size, 489 u8 inums[], u8 nalts[]) 490 { 491 unsigned char *buffer0 = buffer; 492 struct usb_interface_descriptor *d; 493 int inum, asnum; 494 struct usb_interface_cache *intfc; 495 struct usb_host_interface *alt; 496 int i, n; 497 int len, retval; 498 int num_ep, num_ep_orig; 499 500 d = (struct usb_interface_descriptor *) buffer; 501 buffer += d->bLength; 502 size -= d->bLength; 503 504 if (d->bLength < USB_DT_INTERFACE_SIZE) 505 goto skip_to_next_interface_descriptor; 506 507 /* Which interface entry is this? */ 508 intfc = NULL; 509 inum = d->bInterfaceNumber; 510 for (i = 0; i < config->desc.bNumInterfaces; ++i) { 511 if (inums[i] == inum) { 512 intfc = config->intf_cache[i]; 513 break; 514 } 515 } 516 if (!intfc || intfc->num_altsetting >= nalts[i]) 517 goto skip_to_next_interface_descriptor; 518 519 /* Check for duplicate altsetting entries */ 520 asnum = d->bAlternateSetting; 521 for ((i = 0, alt = &intfc->altsetting[0]); 522 i < intfc->num_altsetting; 523 (++i, ++alt)) { 524 if (alt->desc.bAlternateSetting == asnum) { 525 dev_warn(ddev, "Duplicate descriptor for config %d " 526 "interface %d altsetting %d, skipping\n", 527 cfgno, inum, asnum); 528 goto skip_to_next_interface_descriptor; 529 } 530 } 531 532 ++intfc->num_altsetting; 533 memcpy(&alt->desc, d, USB_DT_INTERFACE_SIZE); 534 535 /* Skip over any Class Specific or Vendor Specific descriptors; 536 * find the first endpoint or interface descriptor */ 537 alt->extra = buffer; 538 i = find_next_descriptor(buffer, size, USB_DT_ENDPOINT, 539 USB_DT_INTERFACE, &n); 540 alt->extralen = i; 541 if (n > 0) 542 dev_dbg(ddev, "skipped %d descriptor%s after %s\n", 543 n, plural(n), "interface"); 544 buffer += i; 545 size -= i; 546 547 /* Allocate space for the right(?) number of endpoints */ 548 num_ep = num_ep_orig = alt->desc.bNumEndpoints; 549 alt->desc.bNumEndpoints = 0; /* Use as a counter */ 550 if (num_ep > USB_MAXENDPOINTS) { 551 dev_warn(ddev, "too many endpoints for config %d interface %d " 552 "altsetting %d: %d, using maximum allowed: %d\n", 553 cfgno, inum, asnum, num_ep, USB_MAXENDPOINTS); 554 num_ep = USB_MAXENDPOINTS; 555 } 556 557 if (num_ep > 0) { 558 /* Can't allocate 0 bytes */ 559 len = sizeof(struct usb_host_endpoint) * num_ep; 560 alt->endpoint = kzalloc(len, GFP_KERNEL); 561 if (!alt->endpoint) 562 return -ENOMEM; 563 } 564 565 /* Parse all the endpoint descriptors */ 566 n = 0; 567 while (size > 0) { 568 if (((struct usb_descriptor_header *) buffer)->bDescriptorType 569 == USB_DT_INTERFACE) 570 break; 571 retval = usb_parse_endpoint(ddev, cfgno, config, inum, asnum, 572 alt, num_ep, buffer, size); 573 if (retval < 0) 574 return retval; 575 ++n; 576 577 buffer += retval; 578 size -= retval; 579 } 580 581 if (n != num_ep_orig) 582 dev_warn(ddev, "config %d interface %d altsetting %d has %d " 583 "endpoint descriptor%s, different from the interface " 584 "descriptor's value: %d\n", 585 cfgno, inum, asnum, n, plural(n), num_ep_orig); 586 return buffer - buffer0; 587 588 skip_to_next_interface_descriptor: 589 i = find_next_descriptor(buffer, size, USB_DT_INTERFACE, 590 USB_DT_INTERFACE, NULL); 591 return buffer - buffer0 + i; 592 } 593 594 static int usb_parse_configuration(struct usb_device *dev, int cfgidx, 595 struct usb_host_config *config, unsigned char *buffer, int size) 596 { 597 struct device *ddev = &dev->dev; 598 unsigned char *buffer0 = buffer; 599 int cfgno; 600 int nintf, nintf_orig; 601 int i, j, n; 602 struct usb_interface_cache *intfc; 603 unsigned char *buffer2; 604 int size2; 605 struct usb_descriptor_header *header; 606 int retval; 607 u8 inums[USB_MAXINTERFACES], nalts[USB_MAXINTERFACES]; 608 unsigned iad_num = 0; 609 610 memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE); 611 nintf = nintf_orig = config->desc.bNumInterfaces; 612 config->desc.bNumInterfaces = 0; // Adjusted later 613 614 if (config->desc.bDescriptorType != USB_DT_CONFIG || 615 config->desc.bLength < USB_DT_CONFIG_SIZE || 616 config->desc.bLength > size) { 617 dev_err(ddev, "invalid descriptor for config index %d: " 618 "type = 0x%X, length = %d\n", cfgidx, 619 config->desc.bDescriptorType, config->desc.bLength); 620 return -EINVAL; 621 } 622 cfgno = config->desc.bConfigurationValue; 623 624 buffer += config->desc.bLength; 625 size -= config->desc.bLength; 626 627 if (nintf > USB_MAXINTERFACES) { 628 dev_warn(ddev, "config %d has too many interfaces: %d, " 629 "using maximum allowed: %d\n", 630 cfgno, nintf, USB_MAXINTERFACES); 631 nintf = USB_MAXINTERFACES; 632 } 633 634 /* Go through the descriptors, checking their length and counting the 635 * number of altsettings for each interface */ 636 n = 0; 637 for ((buffer2 = buffer, size2 = size); 638 size2 > 0; 639 (buffer2 += header->bLength, size2 -= header->bLength)) { 640 641 if (size2 < sizeof(struct usb_descriptor_header)) { 642 dev_warn(ddev, "config %d descriptor has %d excess " 643 "byte%s, ignoring\n", 644 cfgno, size2, plural(size2)); 645 break; 646 } 647 648 header = (struct usb_descriptor_header *) buffer2; 649 if ((header->bLength > size2) || (header->bLength < 2)) { 650 dev_warn(ddev, "config %d has an invalid descriptor " 651 "of length %d, skipping remainder of the config\n", 652 cfgno, header->bLength); 653 break; 654 } 655 656 if (header->bDescriptorType == USB_DT_INTERFACE) { 657 struct usb_interface_descriptor *d; 658 int inum; 659 660 d = (struct usb_interface_descriptor *) header; 661 if (d->bLength < USB_DT_INTERFACE_SIZE) { 662 dev_warn(ddev, "config %d has an invalid " 663 "interface descriptor of length %d, " 664 "skipping\n", cfgno, d->bLength); 665 continue; 666 } 667 668 inum = d->bInterfaceNumber; 669 670 if ((dev->quirks & USB_QUIRK_HONOR_BNUMINTERFACES) && 671 n >= nintf_orig) { 672 dev_warn(ddev, "config %d has more interface " 673 "descriptors, than it declares in " 674 "bNumInterfaces, ignoring interface " 675 "number: %d\n", cfgno, inum); 676 continue; 677 } 678 679 if (inum >= nintf_orig) 680 dev_warn(ddev, "config %d has an invalid " 681 "interface number: %d but max is %d\n", 682 cfgno, inum, nintf_orig - 1); 683 684 /* Have we already encountered this interface? 685 * Count its altsettings */ 686 for (i = 0; i < n; ++i) { 687 if (inums[i] == inum) 688 break; 689 } 690 if (i < n) { 691 if (nalts[i] < 255) 692 ++nalts[i]; 693 } else if (n < USB_MAXINTERFACES) { 694 inums[n] = inum; 695 nalts[n] = 1; 696 ++n; 697 } 698 699 } else if (header->bDescriptorType == 700 USB_DT_INTERFACE_ASSOCIATION) { 701 struct usb_interface_assoc_descriptor *d; 702 703 d = (struct usb_interface_assoc_descriptor *)header; 704 if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) { 705 dev_warn(ddev, 706 "config %d has an invalid interface association descriptor of length %d, skipping\n", 707 cfgno, d->bLength); 708 continue; 709 } 710 711 if (iad_num == USB_MAXIADS) { 712 dev_warn(ddev, "found more Interface " 713 "Association Descriptors " 714 "than allocated for in " 715 "configuration %d\n", cfgno); 716 } else { 717 config->intf_assoc[iad_num] = d; 718 iad_num++; 719 } 720 721 } else if (header->bDescriptorType == USB_DT_DEVICE || 722 header->bDescriptorType == USB_DT_CONFIG) 723 dev_warn(ddev, "config %d contains an unexpected " 724 "descriptor of type 0x%X, skipping\n", 725 cfgno, header->bDescriptorType); 726 727 } /* for ((buffer2 = buffer, size2 = size); ...) */ 728 size = buffer2 - buffer; 729 config->desc.wTotalLength = cpu_to_le16(buffer2 - buffer0); 730 731 if (n != nintf) 732 dev_warn(ddev, "config %d has %d interface%s, different from " 733 "the descriptor's value: %d\n", 734 cfgno, n, plural(n), nintf_orig); 735 else if (n == 0) 736 dev_warn(ddev, "config %d has no interfaces?\n", cfgno); 737 config->desc.bNumInterfaces = nintf = n; 738 739 /* Check for missing interface numbers */ 740 for (i = 0; i < nintf; ++i) { 741 for (j = 0; j < nintf; ++j) { 742 if (inums[j] == i) 743 break; 744 } 745 if (j >= nintf) 746 dev_warn(ddev, "config %d has no interface number " 747 "%d\n", cfgno, i); 748 } 749 750 /* Allocate the usb_interface_caches and altsetting arrays */ 751 for (i = 0; i < nintf; ++i) { 752 j = nalts[i]; 753 if (j > USB_MAXALTSETTING) { 754 dev_warn(ddev, "too many alternate settings for " 755 "config %d interface %d: %d, " 756 "using maximum allowed: %d\n", 757 cfgno, inums[i], j, USB_MAXALTSETTING); 758 nalts[i] = j = USB_MAXALTSETTING; 759 } 760 761 intfc = kzalloc(struct_size(intfc, altsetting, j), GFP_KERNEL); 762 config->intf_cache[i] = intfc; 763 if (!intfc) 764 return -ENOMEM; 765 kref_init(&intfc->ref); 766 } 767 768 /* FIXME: parse the BOS descriptor */ 769 770 /* Skip over any Class Specific or Vendor Specific descriptors; 771 * find the first interface descriptor */ 772 config->extra = buffer; 773 i = find_next_descriptor(buffer, size, USB_DT_INTERFACE, 774 USB_DT_INTERFACE, &n); 775 config->extralen = i; 776 if (n > 0) 777 dev_dbg(ddev, "skipped %d descriptor%s after %s\n", 778 n, plural(n), "configuration"); 779 buffer += i; 780 size -= i; 781 782 /* Parse all the interface/altsetting descriptors */ 783 while (size > 0) { 784 retval = usb_parse_interface(ddev, cfgno, config, 785 buffer, size, inums, nalts); 786 if (retval < 0) 787 return retval; 788 789 buffer += retval; 790 size -= retval; 791 } 792 793 /* Check for missing altsettings */ 794 for (i = 0; i < nintf; ++i) { 795 intfc = config->intf_cache[i]; 796 for (j = 0; j < intfc->num_altsetting; ++j) { 797 for (n = 0; n < intfc->num_altsetting; ++n) { 798 if (intfc->altsetting[n].desc. 799 bAlternateSetting == j) 800 break; 801 } 802 if (n >= intfc->num_altsetting) 803 dev_warn(ddev, "config %d interface %d has no " 804 "altsetting %d\n", cfgno, inums[i], j); 805 } 806 } 807 808 return 0; 809 } 810 811 /* hub-only!! ... and only exported for reset/reinit path. 812 * otherwise used internally on disconnect/destroy path 813 */ 814 void usb_destroy_configuration(struct usb_device *dev) 815 { 816 int c, i; 817 818 if (!dev->config) 819 return; 820 821 if (dev->rawdescriptors) { 822 for (i = 0; i < dev->descriptor.bNumConfigurations; i++) 823 kfree(dev->rawdescriptors[i]); 824 825 kfree(dev->rawdescriptors); 826 dev->rawdescriptors = NULL; 827 } 828 829 for (c = 0; c < dev->descriptor.bNumConfigurations; c++) { 830 struct usb_host_config *cf = &dev->config[c]; 831 832 kfree(cf->string); 833 for (i = 0; i < cf->desc.bNumInterfaces; i++) { 834 if (cf->intf_cache[i]) 835 kref_put(&cf->intf_cache[i]->ref, 836 usb_release_interface_cache); 837 } 838 } 839 kfree(dev->config); 840 dev->config = NULL; 841 } 842 843 844 /* 845 * Get the USB config descriptors, cache and parse'em 846 * 847 * hub-only!! ... and only in reset path, or usb_new_device() 848 * (used by real hubs and virtual root hubs) 849 */ 850 int usb_get_configuration(struct usb_device *dev) 851 { 852 struct device *ddev = &dev->dev; 853 int ncfg = dev->descriptor.bNumConfigurations; 854 unsigned int cfgno, length; 855 unsigned char *bigbuffer; 856 struct usb_config_descriptor *desc; 857 int result; 858 859 if (ncfg > USB_MAXCONFIG) { 860 dev_warn(ddev, "too many configurations: %d, " 861 "using maximum allowed: %d\n", ncfg, USB_MAXCONFIG); 862 dev->descriptor.bNumConfigurations = ncfg = USB_MAXCONFIG; 863 } 864 865 if (ncfg < 1) { 866 dev_err(ddev, "no configurations\n"); 867 return -EINVAL; 868 } 869 870 length = ncfg * sizeof(struct usb_host_config); 871 dev->config = kzalloc(length, GFP_KERNEL); 872 if (!dev->config) 873 return -ENOMEM; 874 875 length = ncfg * sizeof(char *); 876 dev->rawdescriptors = kzalloc(length, GFP_KERNEL); 877 if (!dev->rawdescriptors) 878 return -ENOMEM; 879 880 desc = kmalloc(USB_DT_CONFIG_SIZE, GFP_KERNEL); 881 if (!desc) 882 return -ENOMEM; 883 884 for (cfgno = 0; cfgno < ncfg; cfgno++) { 885 /* We grab just the first descriptor so we know how long 886 * the whole configuration is */ 887 result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, 888 desc, USB_DT_CONFIG_SIZE); 889 if (result < 0) { 890 dev_err(ddev, "unable to read config index %d " 891 "descriptor/%s: %d\n", cfgno, "start", result); 892 if (result != -EPIPE) 893 goto err; 894 dev_err(ddev, "chopping to %d config(s)\n", cfgno); 895 dev->descriptor.bNumConfigurations = cfgno; 896 break; 897 } else if (result < 4) { 898 dev_err(ddev, "config index %d descriptor too short " 899 "(expected %i, got %i)\n", cfgno, 900 USB_DT_CONFIG_SIZE, result); 901 result = -EINVAL; 902 goto err; 903 } 904 length = max((int) le16_to_cpu(desc->wTotalLength), 905 USB_DT_CONFIG_SIZE); 906 907 /* Now that we know the length, get the whole thing */ 908 bigbuffer = kmalloc(length, GFP_KERNEL); 909 if (!bigbuffer) { 910 result = -ENOMEM; 911 goto err; 912 } 913 914 if (dev->quirks & USB_QUIRK_DELAY_INIT) 915 msleep(200); 916 917 result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, 918 bigbuffer, length); 919 if (result < 0) { 920 dev_err(ddev, "unable to read config index %d " 921 "descriptor/%s\n", cfgno, "all"); 922 kfree(bigbuffer); 923 goto err; 924 } 925 if (result < length) { 926 dev_warn(ddev, "config index %d descriptor too short " 927 "(expected %i, got %i)\n", cfgno, length, result); 928 length = result; 929 } 930 931 dev->rawdescriptors[cfgno] = bigbuffer; 932 933 result = usb_parse_configuration(dev, cfgno, 934 &dev->config[cfgno], bigbuffer, length); 935 if (result < 0) { 936 ++cfgno; 937 goto err; 938 } 939 } 940 941 err: 942 kfree(desc); 943 dev->descriptor.bNumConfigurations = cfgno; 944 945 return result; 946 } 947 948 void usb_release_bos_descriptor(struct usb_device *dev) 949 { 950 if (dev->bos) { 951 kfree(dev->bos->desc); 952 kfree(dev->bos); 953 dev->bos = NULL; 954 } 955 } 956 957 static const __u8 bos_desc_len[256] = { 958 [USB_CAP_TYPE_WIRELESS_USB] = USB_DT_USB_WIRELESS_CAP_SIZE, 959 [USB_CAP_TYPE_EXT] = USB_DT_USB_EXT_CAP_SIZE, 960 [USB_SS_CAP_TYPE] = USB_DT_USB_SS_CAP_SIZE, 961 [USB_SSP_CAP_TYPE] = USB_DT_USB_SSP_CAP_SIZE(1), 962 [CONTAINER_ID_TYPE] = USB_DT_USB_SS_CONTN_ID_SIZE, 963 [USB_PTM_CAP_TYPE] = USB_DT_USB_PTM_ID_SIZE, 964 }; 965 966 /* Get BOS descriptor set */ 967 int usb_get_bos_descriptor(struct usb_device *dev) 968 { 969 struct device *ddev = &dev->dev; 970 struct usb_bos_descriptor *bos; 971 struct usb_dev_cap_header *cap; 972 struct usb_ssp_cap_descriptor *ssp_cap; 973 unsigned char *buffer, *buffer0; 974 int length, total_len, num, i, ssac; 975 __u8 cap_type; 976 int ret; 977 978 bos = kzalloc(sizeof(struct usb_bos_descriptor), GFP_KERNEL); 979 if (!bos) 980 return -ENOMEM; 981 982 /* Get BOS descriptor */ 983 ret = usb_get_descriptor(dev, USB_DT_BOS, 0, bos, USB_DT_BOS_SIZE); 984 if (ret < USB_DT_BOS_SIZE || bos->bLength < USB_DT_BOS_SIZE) { 985 dev_err(ddev, "unable to get BOS descriptor or descriptor too short\n"); 986 if (ret >= 0) 987 ret = -ENOMSG; 988 kfree(bos); 989 return ret; 990 } 991 992 length = bos->bLength; 993 total_len = le16_to_cpu(bos->wTotalLength); 994 num = bos->bNumDeviceCaps; 995 kfree(bos); 996 if (total_len < length) 997 return -EINVAL; 998 999 dev->bos = kzalloc(sizeof(struct usb_host_bos), GFP_KERNEL); 1000 if (!dev->bos) 1001 return -ENOMEM; 1002 1003 /* Now let's get the whole BOS descriptor set */ 1004 buffer = kzalloc(total_len, GFP_KERNEL); 1005 if (!buffer) { 1006 ret = -ENOMEM; 1007 goto err; 1008 } 1009 dev->bos->desc = (struct usb_bos_descriptor *)buffer; 1010 1011 ret = usb_get_descriptor(dev, USB_DT_BOS, 0, buffer, total_len); 1012 if (ret < total_len) { 1013 dev_err(ddev, "unable to get BOS descriptor set\n"); 1014 if (ret >= 0) 1015 ret = -ENOMSG; 1016 goto err; 1017 } 1018 1019 buffer0 = buffer; 1020 total_len -= length; 1021 buffer += length; 1022 1023 for (i = 0; i < num; i++) { 1024 cap = (struct usb_dev_cap_header *)buffer; 1025 1026 if (total_len < sizeof(*cap) || total_len < cap->bLength) { 1027 dev->bos->desc->bNumDeviceCaps = i; 1028 break; 1029 } 1030 cap_type = cap->bDevCapabilityType; 1031 length = cap->bLength; 1032 if (bos_desc_len[cap_type] && length < bos_desc_len[cap_type]) { 1033 dev->bos->desc->bNumDeviceCaps = i; 1034 break; 1035 } 1036 1037 if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) { 1038 dev_warn(ddev, "descriptor type invalid, skip\n"); 1039 continue; 1040 } 1041 1042 switch (cap_type) { 1043 case USB_CAP_TYPE_WIRELESS_USB: 1044 /* Wireless USB cap descriptor is handled by wusb */ 1045 break; 1046 case USB_CAP_TYPE_EXT: 1047 dev->bos->ext_cap = 1048 (struct usb_ext_cap_descriptor *)buffer; 1049 break; 1050 case USB_SS_CAP_TYPE: 1051 dev->bos->ss_cap = 1052 (struct usb_ss_cap_descriptor *)buffer; 1053 break; 1054 case USB_SSP_CAP_TYPE: 1055 ssp_cap = (struct usb_ssp_cap_descriptor *)buffer; 1056 ssac = (le32_to_cpu(ssp_cap->bmAttributes) & 1057 USB_SSP_SUBLINK_SPEED_ATTRIBS); 1058 if (length >= USB_DT_USB_SSP_CAP_SIZE(ssac)) 1059 dev->bos->ssp_cap = ssp_cap; 1060 break; 1061 case CONTAINER_ID_TYPE: 1062 dev->bos->ss_id = 1063 (struct usb_ss_container_id_descriptor *)buffer; 1064 break; 1065 case USB_PTM_CAP_TYPE: 1066 dev->bos->ptm_cap = 1067 (struct usb_ptm_cap_descriptor *)buffer; 1068 default: 1069 break; 1070 } 1071 1072 total_len -= length; 1073 buffer += length; 1074 } 1075 dev->bos->desc->wTotalLength = cpu_to_le16(buffer - buffer0); 1076 1077 return 0; 1078 1079 err: 1080 usb_release_bos_descriptor(dev); 1081 return ret; 1082 } 1083