xref: /openbmc/linux/drivers/usb/core/config.c (revision 6774def6)
1 #include <linux/usb.h>
2 #include <linux/usb/ch9.h>
3 #include <linux/usb/hcd.h>
4 #include <linux/usb/quirks.h>
5 #include <linux/module.h>
6 #include <linux/slab.h>
7 #include <linux/device.h>
8 #include <asm/byteorder.h>
9 #include "usb.h"
10 
11 
12 #define USB_MAXALTSETTING		128	/* Hard limit */
13 
14 #define USB_MAXCONFIG			8	/* Arbitrary limit */
15 
16 
17 static inline const char *plural(int n)
18 {
19 	return (n == 1 ? "" : "s");
20 }
21 
22 static int find_next_descriptor(unsigned char *buffer, int size,
23     int dt1, int dt2, int *num_skipped)
24 {
25 	struct usb_descriptor_header *h;
26 	int n = 0;
27 	unsigned char *buffer0 = buffer;
28 
29 	/* Find the next descriptor of type dt1 or dt2 */
30 	while (size > 0) {
31 		h = (struct usb_descriptor_header *) buffer;
32 		if (h->bDescriptorType == dt1 || h->bDescriptorType == dt2)
33 			break;
34 		buffer += h->bLength;
35 		size -= h->bLength;
36 		++n;
37 	}
38 
39 	/* Store the number of descriptors skipped and return the
40 	 * number of bytes skipped */
41 	if (num_skipped)
42 		*num_skipped = n;
43 	return buffer - buffer0;
44 }
45 
46 static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
47 		int inum, int asnum, struct usb_host_endpoint *ep,
48 		unsigned char *buffer, int size)
49 {
50 	struct usb_ss_ep_comp_descriptor *desc;
51 	int max_tx;
52 
53 	/* The SuperSpeed endpoint companion descriptor is supposed to
54 	 * be the first thing immediately following the endpoint descriptor.
55 	 */
56 	desc = (struct usb_ss_ep_comp_descriptor *) buffer;
57 	if (desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP ||
58 			size < USB_DT_SS_EP_COMP_SIZE) {
59 		dev_warn(ddev, "No SuperSpeed endpoint companion for config %d "
60 				" interface %d altsetting %d ep %d: "
61 				"using minimum values\n",
62 				cfgno, inum, asnum, ep->desc.bEndpointAddress);
63 
64 		/* Fill in some default values.
65 		 * Leave bmAttributes as zero, which will mean no streams for
66 		 * bulk, and isoc won't support multiple bursts of packets.
67 		 * With bursts of only one packet, and a Mult of 1, the max
68 		 * amount of data moved per endpoint service interval is one
69 		 * packet.
70 		 */
71 		ep->ss_ep_comp.bLength = USB_DT_SS_EP_COMP_SIZE;
72 		ep->ss_ep_comp.bDescriptorType = USB_DT_SS_ENDPOINT_COMP;
73 		if (usb_endpoint_xfer_isoc(&ep->desc) ||
74 				usb_endpoint_xfer_int(&ep->desc))
75 			ep->ss_ep_comp.wBytesPerInterval =
76 					ep->desc.wMaxPacketSize;
77 		return;
78 	}
79 
80 	memcpy(&ep->ss_ep_comp, desc, USB_DT_SS_EP_COMP_SIZE);
81 
82 	/* Check the various values */
83 	if (usb_endpoint_xfer_control(&ep->desc) && desc->bMaxBurst != 0) {
84 		dev_warn(ddev, "Control endpoint with bMaxBurst = %d in "
85 				"config %d interface %d altsetting %d ep %d: "
86 				"setting to zero\n", desc->bMaxBurst,
87 				cfgno, inum, asnum, ep->desc.bEndpointAddress);
88 		ep->ss_ep_comp.bMaxBurst = 0;
89 	} else if (desc->bMaxBurst > 15) {
90 		dev_warn(ddev, "Endpoint with bMaxBurst = %d in "
91 				"config %d interface %d altsetting %d ep %d: "
92 				"setting to 15\n", desc->bMaxBurst,
93 				cfgno, inum, asnum, ep->desc.bEndpointAddress);
94 		ep->ss_ep_comp.bMaxBurst = 15;
95 	}
96 
97 	if ((usb_endpoint_xfer_control(&ep->desc) ||
98 			usb_endpoint_xfer_int(&ep->desc)) &&
99 				desc->bmAttributes != 0) {
100 		dev_warn(ddev, "%s endpoint with bmAttributes = %d in "
101 				"config %d interface %d altsetting %d ep %d: "
102 				"setting to zero\n",
103 				usb_endpoint_xfer_control(&ep->desc) ? "Control" : "Bulk",
104 				desc->bmAttributes,
105 				cfgno, inum, asnum, ep->desc.bEndpointAddress);
106 		ep->ss_ep_comp.bmAttributes = 0;
107 	} else if (usb_endpoint_xfer_bulk(&ep->desc) &&
108 			desc->bmAttributes > 16) {
109 		dev_warn(ddev, "Bulk endpoint with more than 65536 streams in "
110 				"config %d interface %d altsetting %d ep %d: "
111 				"setting to max\n",
112 				cfgno, inum, asnum, ep->desc.bEndpointAddress);
113 		ep->ss_ep_comp.bmAttributes = 16;
114 	} else if (usb_endpoint_xfer_isoc(&ep->desc) &&
115 			desc->bmAttributes > 2) {
116 		dev_warn(ddev, "Isoc endpoint has Mult of %d in "
117 				"config %d interface %d altsetting %d ep %d: "
118 				"setting to 3\n", desc->bmAttributes + 1,
119 				cfgno, inum, asnum, ep->desc.bEndpointAddress);
120 		ep->ss_ep_comp.bmAttributes = 2;
121 	}
122 
123 	if (usb_endpoint_xfer_isoc(&ep->desc))
124 		max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) *
125 			usb_endpoint_maxp(&ep->desc);
126 	else if (usb_endpoint_xfer_int(&ep->desc))
127 		max_tx = usb_endpoint_maxp(&ep->desc) *
128 			(desc->bMaxBurst + 1);
129 	else
130 		max_tx = 999999;
131 	if (le16_to_cpu(desc->wBytesPerInterval) > max_tx) {
132 		dev_warn(ddev, "%s endpoint with wBytesPerInterval of %d in "
133 				"config %d interface %d altsetting %d ep %d: "
134 				"setting to %d\n",
135 				usb_endpoint_xfer_isoc(&ep->desc) ? "Isoc" : "Int",
136 				le16_to_cpu(desc->wBytesPerInterval),
137 				cfgno, inum, asnum, ep->desc.bEndpointAddress,
138 				max_tx);
139 		ep->ss_ep_comp.wBytesPerInterval = cpu_to_le16(max_tx);
140 	}
141 }
142 
143 static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
144     int asnum, struct usb_host_interface *ifp, int num_ep,
145     unsigned char *buffer, int size)
146 {
147 	unsigned char *buffer0 = buffer;
148 	struct usb_endpoint_descriptor *d;
149 	struct usb_host_endpoint *endpoint;
150 	int n, i, j, retval;
151 
152 	d = (struct usb_endpoint_descriptor *) buffer;
153 	buffer += d->bLength;
154 	size -= d->bLength;
155 
156 	if (d->bLength >= USB_DT_ENDPOINT_AUDIO_SIZE)
157 		n = USB_DT_ENDPOINT_AUDIO_SIZE;
158 	else if (d->bLength >= USB_DT_ENDPOINT_SIZE)
159 		n = USB_DT_ENDPOINT_SIZE;
160 	else {
161 		dev_warn(ddev, "config %d interface %d altsetting %d has an "
162 		    "invalid endpoint descriptor of length %d, skipping\n",
163 		    cfgno, inum, asnum, d->bLength);
164 		goto skip_to_next_endpoint_or_interface_descriptor;
165 	}
166 
167 	i = d->bEndpointAddress & ~USB_ENDPOINT_DIR_MASK;
168 	if (i >= 16 || i == 0) {
169 		dev_warn(ddev, "config %d interface %d altsetting %d has an "
170 		    "invalid endpoint with address 0x%X, skipping\n",
171 		    cfgno, inum, asnum, d->bEndpointAddress);
172 		goto skip_to_next_endpoint_or_interface_descriptor;
173 	}
174 
175 	/* Only store as many endpoints as we have room for */
176 	if (ifp->desc.bNumEndpoints >= num_ep)
177 		goto skip_to_next_endpoint_or_interface_descriptor;
178 
179 	endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
180 	++ifp->desc.bNumEndpoints;
181 
182 	memcpy(&endpoint->desc, d, n);
183 	INIT_LIST_HEAD(&endpoint->urb_list);
184 
185 	/* Fix up bInterval values outside the legal range. Use 32 ms if no
186 	 * proper value can be guessed. */
187 	i = 0;		/* i = min, j = max, n = default */
188 	j = 255;
189 	if (usb_endpoint_xfer_int(d)) {
190 		i = 1;
191 		switch (to_usb_device(ddev)->speed) {
192 		case USB_SPEED_SUPER:
193 		case USB_SPEED_HIGH:
194 			/* Many device manufacturers are using full-speed
195 			 * bInterval values in high-speed interrupt endpoint
196 			 * descriptors. Try to fix those and fall back to a
197 			 * 32 ms default value otherwise. */
198 			n = fls(d->bInterval*8);
199 			if (n == 0)
200 				n = 9;	/* 32 ms = 2^(9-1) uframes */
201 			j = 16;
202 
203 			/*
204 			 * Adjust bInterval for quirked devices.
205 			 * This quirk fixes bIntervals reported in
206 			 * linear microframes.
207 			 */
208 			if (to_usb_device(ddev)->quirks &
209 				USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL) {
210 				n = clamp(fls(d->bInterval), i, j);
211 				i = j = n;
212 			}
213 			break;
214 		default:		/* USB_SPEED_FULL or _LOW */
215 			/* For low-speed, 10 ms is the official minimum.
216 			 * But some "overclocked" devices might want faster
217 			 * polling so we'll allow it. */
218 			n = 32;
219 			break;
220 		}
221 	} else if (usb_endpoint_xfer_isoc(d)) {
222 		i = 1;
223 		j = 16;
224 		switch (to_usb_device(ddev)->speed) {
225 		case USB_SPEED_HIGH:
226 			n = 9;		/* 32 ms = 2^(9-1) uframes */
227 			break;
228 		default:		/* USB_SPEED_FULL */
229 			n = 6;		/* 32 ms = 2^(6-1) frames */
230 			break;
231 		}
232 	}
233 	if (d->bInterval < i || d->bInterval > j) {
234 		dev_warn(ddev, "config %d interface %d altsetting %d "
235 		    "endpoint 0x%X has an invalid bInterval %d, "
236 		    "changing to %d\n",
237 		    cfgno, inum, asnum,
238 		    d->bEndpointAddress, d->bInterval, n);
239 		endpoint->desc.bInterval = n;
240 	}
241 
242 	/* Some buggy low-speed devices have Bulk endpoints, which is
243 	 * explicitly forbidden by the USB spec.  In an attempt to make
244 	 * them usable, we will try treating them as Interrupt endpoints.
245 	 */
246 	if (to_usb_device(ddev)->speed == USB_SPEED_LOW &&
247 			usb_endpoint_xfer_bulk(d)) {
248 		dev_warn(ddev, "config %d interface %d altsetting %d "
249 		    "endpoint 0x%X is Bulk; changing to Interrupt\n",
250 		    cfgno, inum, asnum, d->bEndpointAddress);
251 		endpoint->desc.bmAttributes = USB_ENDPOINT_XFER_INT;
252 		endpoint->desc.bInterval = 1;
253 		if (usb_endpoint_maxp(&endpoint->desc) > 8)
254 			endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
255 	}
256 
257 	/*
258 	 * Some buggy high speed devices have bulk endpoints using
259 	 * maxpacket sizes other than 512.  High speed HCDs may not
260 	 * be able to handle that particular bug, so let's warn...
261 	 */
262 	if (to_usb_device(ddev)->speed == USB_SPEED_HIGH
263 			&& usb_endpoint_xfer_bulk(d)) {
264 		unsigned maxp;
265 
266 		maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff;
267 		if (maxp != 512)
268 			dev_warn(ddev, "config %d interface %d altsetting %d "
269 				"bulk endpoint 0x%X has invalid maxpacket %d\n",
270 				cfgno, inum, asnum, d->bEndpointAddress,
271 				maxp);
272 	}
273 
274 	/* Parse a possible SuperSpeed endpoint companion descriptor */
275 	if (to_usb_device(ddev)->speed == USB_SPEED_SUPER)
276 		usb_parse_ss_endpoint_companion(ddev, cfgno,
277 				inum, asnum, endpoint, buffer, size);
278 
279 	/* Skip over any Class Specific or Vendor Specific descriptors;
280 	 * find the next endpoint or interface descriptor */
281 	endpoint->extra = buffer;
282 	i = find_next_descriptor(buffer, size, USB_DT_ENDPOINT,
283 			USB_DT_INTERFACE, &n);
284 	endpoint->extralen = i;
285 	retval = buffer - buffer0 + i;
286 	if (n > 0)
287 		dev_dbg(ddev, "skipped %d descriptor%s after %s\n",
288 		    n, plural(n), "endpoint");
289 	return retval;
290 
291 skip_to_next_endpoint_or_interface_descriptor:
292 	i = find_next_descriptor(buffer, size, USB_DT_ENDPOINT,
293 	    USB_DT_INTERFACE, NULL);
294 	return buffer - buffer0 + i;
295 }
296 
297 void usb_release_interface_cache(struct kref *ref)
298 {
299 	struct usb_interface_cache *intfc = ref_to_usb_interface_cache(ref);
300 	int j;
301 
302 	for (j = 0; j < intfc->num_altsetting; j++) {
303 		struct usb_host_interface *alt = &intfc->altsetting[j];
304 
305 		kfree(alt->endpoint);
306 		kfree(alt->string);
307 	}
308 	kfree(intfc);
309 }
310 
311 static int usb_parse_interface(struct device *ddev, int cfgno,
312     struct usb_host_config *config, unsigned char *buffer, int size,
313     u8 inums[], u8 nalts[])
314 {
315 	unsigned char *buffer0 = buffer;
316 	struct usb_interface_descriptor	*d;
317 	int inum, asnum;
318 	struct usb_interface_cache *intfc;
319 	struct usb_host_interface *alt;
320 	int i, n;
321 	int len, retval;
322 	int num_ep, num_ep_orig;
323 
324 	d = (struct usb_interface_descriptor *) buffer;
325 	buffer += d->bLength;
326 	size -= d->bLength;
327 
328 	if (d->bLength < USB_DT_INTERFACE_SIZE)
329 		goto skip_to_next_interface_descriptor;
330 
331 	/* Which interface entry is this? */
332 	intfc = NULL;
333 	inum = d->bInterfaceNumber;
334 	for (i = 0; i < config->desc.bNumInterfaces; ++i) {
335 		if (inums[i] == inum) {
336 			intfc = config->intf_cache[i];
337 			break;
338 		}
339 	}
340 	if (!intfc || intfc->num_altsetting >= nalts[i])
341 		goto skip_to_next_interface_descriptor;
342 
343 	/* Check for duplicate altsetting entries */
344 	asnum = d->bAlternateSetting;
345 	for ((i = 0, alt = &intfc->altsetting[0]);
346 	      i < intfc->num_altsetting;
347 	     (++i, ++alt)) {
348 		if (alt->desc.bAlternateSetting == asnum) {
349 			dev_warn(ddev, "Duplicate descriptor for config %d "
350 			    "interface %d altsetting %d, skipping\n",
351 			    cfgno, inum, asnum);
352 			goto skip_to_next_interface_descriptor;
353 		}
354 	}
355 
356 	++intfc->num_altsetting;
357 	memcpy(&alt->desc, d, USB_DT_INTERFACE_SIZE);
358 
359 	/* Skip over any Class Specific or Vendor Specific descriptors;
360 	 * find the first endpoint or interface descriptor */
361 	alt->extra = buffer;
362 	i = find_next_descriptor(buffer, size, USB_DT_ENDPOINT,
363 	    USB_DT_INTERFACE, &n);
364 	alt->extralen = i;
365 	if (n > 0)
366 		dev_dbg(ddev, "skipped %d descriptor%s after %s\n",
367 		    n, plural(n), "interface");
368 	buffer += i;
369 	size -= i;
370 
371 	/* Allocate space for the right(?) number of endpoints */
372 	num_ep = num_ep_orig = alt->desc.bNumEndpoints;
373 	alt->desc.bNumEndpoints = 0;		/* Use as a counter */
374 	if (num_ep > USB_MAXENDPOINTS) {
375 		dev_warn(ddev, "too many endpoints for config %d interface %d "
376 		    "altsetting %d: %d, using maximum allowed: %d\n",
377 		    cfgno, inum, asnum, num_ep, USB_MAXENDPOINTS);
378 		num_ep = USB_MAXENDPOINTS;
379 	}
380 
381 	if (num_ep > 0) {
382 		/* Can't allocate 0 bytes */
383 		len = sizeof(struct usb_host_endpoint) * num_ep;
384 		alt->endpoint = kzalloc(len, GFP_KERNEL);
385 		if (!alt->endpoint)
386 			return -ENOMEM;
387 	}
388 
389 	/* Parse all the endpoint descriptors */
390 	n = 0;
391 	while (size > 0) {
392 		if (((struct usb_descriptor_header *) buffer)->bDescriptorType
393 		     == USB_DT_INTERFACE)
394 			break;
395 		retval = usb_parse_endpoint(ddev, cfgno, inum, asnum, alt,
396 		    num_ep, buffer, size);
397 		if (retval < 0)
398 			return retval;
399 		++n;
400 
401 		buffer += retval;
402 		size -= retval;
403 	}
404 
405 	if (n != num_ep_orig)
406 		dev_warn(ddev, "config %d interface %d altsetting %d has %d "
407 		    "endpoint descriptor%s, different from the interface "
408 		    "descriptor's value: %d\n",
409 		    cfgno, inum, asnum, n, plural(n), num_ep_orig);
410 	return buffer - buffer0;
411 
412 skip_to_next_interface_descriptor:
413 	i = find_next_descriptor(buffer, size, USB_DT_INTERFACE,
414 	    USB_DT_INTERFACE, NULL);
415 	return buffer - buffer0 + i;
416 }
417 
418 static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
419     struct usb_host_config *config, unsigned char *buffer, int size)
420 {
421 	struct device *ddev = &dev->dev;
422 	unsigned char *buffer0 = buffer;
423 	int cfgno;
424 	int nintf, nintf_orig;
425 	int i, j, n;
426 	struct usb_interface_cache *intfc;
427 	unsigned char *buffer2;
428 	int size2;
429 	struct usb_descriptor_header *header;
430 	int len, retval;
431 	u8 inums[USB_MAXINTERFACES], nalts[USB_MAXINTERFACES];
432 	unsigned iad_num = 0;
433 
434 	memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
435 	if (config->desc.bDescriptorType != USB_DT_CONFIG ||
436 	    config->desc.bLength < USB_DT_CONFIG_SIZE ||
437 	    config->desc.bLength > size) {
438 		dev_err(ddev, "invalid descriptor for config index %d: "
439 		    "type = 0x%X, length = %d\n", cfgidx,
440 		    config->desc.bDescriptorType, config->desc.bLength);
441 		return -EINVAL;
442 	}
443 	cfgno = config->desc.bConfigurationValue;
444 
445 	buffer += config->desc.bLength;
446 	size -= config->desc.bLength;
447 
448 	nintf = nintf_orig = config->desc.bNumInterfaces;
449 	if (nintf > USB_MAXINTERFACES) {
450 		dev_warn(ddev, "config %d has too many interfaces: %d, "
451 		    "using maximum allowed: %d\n",
452 		    cfgno, nintf, USB_MAXINTERFACES);
453 		nintf = USB_MAXINTERFACES;
454 	}
455 
456 	/* Go through the descriptors, checking their length and counting the
457 	 * number of altsettings for each interface */
458 	n = 0;
459 	for ((buffer2 = buffer, size2 = size);
460 	      size2 > 0;
461 	     (buffer2 += header->bLength, size2 -= header->bLength)) {
462 
463 		if (size2 < sizeof(struct usb_descriptor_header)) {
464 			dev_warn(ddev, "config %d descriptor has %d excess "
465 			    "byte%s, ignoring\n",
466 			    cfgno, size2, plural(size2));
467 			break;
468 		}
469 
470 		header = (struct usb_descriptor_header *) buffer2;
471 		if ((header->bLength > size2) || (header->bLength < 2)) {
472 			dev_warn(ddev, "config %d has an invalid descriptor "
473 			    "of length %d, skipping remainder of the config\n",
474 			    cfgno, header->bLength);
475 			break;
476 		}
477 
478 		if (header->bDescriptorType == USB_DT_INTERFACE) {
479 			struct usb_interface_descriptor *d;
480 			int inum;
481 
482 			d = (struct usb_interface_descriptor *) header;
483 			if (d->bLength < USB_DT_INTERFACE_SIZE) {
484 				dev_warn(ddev, "config %d has an invalid "
485 				    "interface descriptor of length %d, "
486 				    "skipping\n", cfgno, d->bLength);
487 				continue;
488 			}
489 
490 			inum = d->bInterfaceNumber;
491 
492 			if ((dev->quirks & USB_QUIRK_HONOR_BNUMINTERFACES) &&
493 			    n >= nintf_orig) {
494 				dev_warn(ddev, "config %d has more interface "
495 				    "descriptors, than it declares in "
496 				    "bNumInterfaces, ignoring interface "
497 				    "number: %d\n", cfgno, inum);
498 				continue;
499 			}
500 
501 			if (inum >= nintf_orig)
502 				dev_warn(ddev, "config %d has an invalid "
503 				    "interface number: %d but max is %d\n",
504 				    cfgno, inum, nintf_orig - 1);
505 
506 			/* Have we already encountered this interface?
507 			 * Count its altsettings */
508 			for (i = 0; i < n; ++i) {
509 				if (inums[i] == inum)
510 					break;
511 			}
512 			if (i < n) {
513 				if (nalts[i] < 255)
514 					++nalts[i];
515 			} else if (n < USB_MAXINTERFACES) {
516 				inums[n] = inum;
517 				nalts[n] = 1;
518 				++n;
519 			}
520 
521 		} else if (header->bDescriptorType ==
522 				USB_DT_INTERFACE_ASSOCIATION) {
523 			if (iad_num == USB_MAXIADS) {
524 				dev_warn(ddev, "found more Interface "
525 					       "Association Descriptors "
526 					       "than allocated for in "
527 					       "configuration %d\n", cfgno);
528 			} else {
529 				config->intf_assoc[iad_num] =
530 					(struct usb_interface_assoc_descriptor
531 					*)header;
532 				iad_num++;
533 			}
534 
535 		} else if (header->bDescriptorType == USB_DT_DEVICE ||
536 			    header->bDescriptorType == USB_DT_CONFIG)
537 			dev_warn(ddev, "config %d contains an unexpected "
538 			    "descriptor of type 0x%X, skipping\n",
539 			    cfgno, header->bDescriptorType);
540 
541 	}	/* for ((buffer2 = buffer, size2 = size); ...) */
542 	size = buffer2 - buffer;
543 	config->desc.wTotalLength = cpu_to_le16(buffer2 - buffer0);
544 
545 	if (n != nintf)
546 		dev_warn(ddev, "config %d has %d interface%s, different from "
547 		    "the descriptor's value: %d\n",
548 		    cfgno, n, plural(n), nintf_orig);
549 	else if (n == 0)
550 		dev_warn(ddev, "config %d has no interfaces?\n", cfgno);
551 	config->desc.bNumInterfaces = nintf = n;
552 
553 	/* Check for missing interface numbers */
554 	for (i = 0; i < nintf; ++i) {
555 		for (j = 0; j < nintf; ++j) {
556 			if (inums[j] == i)
557 				break;
558 		}
559 		if (j >= nintf)
560 			dev_warn(ddev, "config %d has no interface number "
561 			    "%d\n", cfgno, i);
562 	}
563 
564 	/* Allocate the usb_interface_caches and altsetting arrays */
565 	for (i = 0; i < nintf; ++i) {
566 		j = nalts[i];
567 		if (j > USB_MAXALTSETTING) {
568 			dev_warn(ddev, "too many alternate settings for "
569 			    "config %d interface %d: %d, "
570 			    "using maximum allowed: %d\n",
571 			    cfgno, inums[i], j, USB_MAXALTSETTING);
572 			nalts[i] = j = USB_MAXALTSETTING;
573 		}
574 
575 		len = sizeof(*intfc) + sizeof(struct usb_host_interface) * j;
576 		config->intf_cache[i] = intfc = kzalloc(len, GFP_KERNEL);
577 		if (!intfc)
578 			return -ENOMEM;
579 		kref_init(&intfc->ref);
580 	}
581 
582 	/* FIXME: parse the BOS descriptor */
583 
584 	/* Skip over any Class Specific or Vendor Specific descriptors;
585 	 * find the first interface descriptor */
586 	config->extra = buffer;
587 	i = find_next_descriptor(buffer, size, USB_DT_INTERFACE,
588 	    USB_DT_INTERFACE, &n);
589 	config->extralen = i;
590 	if (n > 0)
591 		dev_dbg(ddev, "skipped %d descriptor%s after %s\n",
592 		    n, plural(n), "configuration");
593 	buffer += i;
594 	size -= i;
595 
596 	/* Parse all the interface/altsetting descriptors */
597 	while (size > 0) {
598 		retval = usb_parse_interface(ddev, cfgno, config,
599 		    buffer, size, inums, nalts);
600 		if (retval < 0)
601 			return retval;
602 
603 		buffer += retval;
604 		size -= retval;
605 	}
606 
607 	/* Check for missing altsettings */
608 	for (i = 0; i < nintf; ++i) {
609 		intfc = config->intf_cache[i];
610 		for (j = 0; j < intfc->num_altsetting; ++j) {
611 			for (n = 0; n < intfc->num_altsetting; ++n) {
612 				if (intfc->altsetting[n].desc.
613 				    bAlternateSetting == j)
614 					break;
615 			}
616 			if (n >= intfc->num_altsetting)
617 				dev_warn(ddev, "config %d interface %d has no "
618 				    "altsetting %d\n", cfgno, inums[i], j);
619 		}
620 	}
621 
622 	return 0;
623 }
624 
625 /* hub-only!! ... and only exported for reset/reinit path.
626  * otherwise used internally on disconnect/destroy path
627  */
628 void usb_destroy_configuration(struct usb_device *dev)
629 {
630 	int c, i;
631 
632 	if (!dev->config)
633 		return;
634 
635 	if (dev->rawdescriptors) {
636 		for (i = 0; i < dev->descriptor.bNumConfigurations; i++)
637 			kfree(dev->rawdescriptors[i]);
638 
639 		kfree(dev->rawdescriptors);
640 		dev->rawdescriptors = NULL;
641 	}
642 
643 	for (c = 0; c < dev->descriptor.bNumConfigurations; c++) {
644 		struct usb_host_config *cf = &dev->config[c];
645 
646 		kfree(cf->string);
647 		for (i = 0; i < cf->desc.bNumInterfaces; i++) {
648 			if (cf->intf_cache[i])
649 				kref_put(&cf->intf_cache[i]->ref,
650 					  usb_release_interface_cache);
651 		}
652 	}
653 	kfree(dev->config);
654 	dev->config = NULL;
655 }
656 
657 
658 /*
659  * Get the USB config descriptors, cache and parse'em
660  *
661  * hub-only!! ... and only in reset path, or usb_new_device()
662  * (used by real hubs and virtual root hubs)
663  */
664 int usb_get_configuration(struct usb_device *dev)
665 {
666 	struct device *ddev = &dev->dev;
667 	int ncfg = dev->descriptor.bNumConfigurations;
668 	int result = 0;
669 	unsigned int cfgno, length;
670 	unsigned char *bigbuffer;
671 	struct usb_config_descriptor *desc;
672 
673 	cfgno = 0;
674 	result = -ENOMEM;
675 	if (ncfg > USB_MAXCONFIG) {
676 		dev_warn(ddev, "too many configurations: %d, "
677 		    "using maximum allowed: %d\n", ncfg, USB_MAXCONFIG);
678 		dev->descriptor.bNumConfigurations = ncfg = USB_MAXCONFIG;
679 	}
680 
681 	if (ncfg < 1) {
682 		dev_err(ddev, "no configurations\n");
683 		return -EINVAL;
684 	}
685 
686 	length = ncfg * sizeof(struct usb_host_config);
687 	dev->config = kzalloc(length, GFP_KERNEL);
688 	if (!dev->config)
689 		goto err2;
690 
691 	length = ncfg * sizeof(char *);
692 	dev->rawdescriptors = kzalloc(length, GFP_KERNEL);
693 	if (!dev->rawdescriptors)
694 		goto err2;
695 
696 	desc = kmalloc(USB_DT_CONFIG_SIZE, GFP_KERNEL);
697 	if (!desc)
698 		goto err2;
699 
700 	result = 0;
701 	for (; cfgno < ncfg; cfgno++) {
702 		/* We grab just the first descriptor so we know how long
703 		 * the whole configuration is */
704 		result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
705 		    desc, USB_DT_CONFIG_SIZE);
706 		if (result < 0) {
707 			dev_err(ddev, "unable to read config index %d "
708 			    "descriptor/%s: %d\n", cfgno, "start", result);
709 			if (result != -EPIPE)
710 				goto err;
711 			dev_err(ddev, "chopping to %d config(s)\n", cfgno);
712 			dev->descriptor.bNumConfigurations = cfgno;
713 			break;
714 		} else if (result < 4) {
715 			dev_err(ddev, "config index %d descriptor too short "
716 			    "(expected %i, got %i)\n", cfgno,
717 			    USB_DT_CONFIG_SIZE, result);
718 			result = -EINVAL;
719 			goto err;
720 		}
721 		length = max((int) le16_to_cpu(desc->wTotalLength),
722 		    USB_DT_CONFIG_SIZE);
723 
724 		/* Now that we know the length, get the whole thing */
725 		bigbuffer = kmalloc(length, GFP_KERNEL);
726 		if (!bigbuffer) {
727 			result = -ENOMEM;
728 			goto err;
729 		}
730 
731 		if (dev->quirks & USB_QUIRK_DELAY_INIT)
732 			msleep(100);
733 
734 		result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
735 		    bigbuffer, length);
736 		if (result < 0) {
737 			dev_err(ddev, "unable to read config index %d "
738 			    "descriptor/%s\n", cfgno, "all");
739 			kfree(bigbuffer);
740 			goto err;
741 		}
742 		if (result < length) {
743 			dev_warn(ddev, "config index %d descriptor too short "
744 			    "(expected %i, got %i)\n", cfgno, length, result);
745 			length = result;
746 		}
747 
748 		dev->rawdescriptors[cfgno] = bigbuffer;
749 
750 		result = usb_parse_configuration(dev, cfgno,
751 		    &dev->config[cfgno], bigbuffer, length);
752 		if (result < 0) {
753 			++cfgno;
754 			goto err;
755 		}
756 	}
757 	result = 0;
758 
759 err:
760 	kfree(desc);
761 	dev->descriptor.bNumConfigurations = cfgno;
762 err2:
763 	if (result == -ENOMEM)
764 		dev_err(ddev, "out of memory\n");
765 	return result;
766 }
767 
768 void usb_release_bos_descriptor(struct usb_device *dev)
769 {
770 	if (dev->bos) {
771 		kfree(dev->bos->desc);
772 		kfree(dev->bos);
773 		dev->bos = NULL;
774 	}
775 }
776 
777 /* Get BOS descriptor set */
778 int usb_get_bos_descriptor(struct usb_device *dev)
779 {
780 	struct device *ddev = &dev->dev;
781 	struct usb_bos_descriptor *bos;
782 	struct usb_dev_cap_header *cap;
783 	unsigned char *buffer;
784 	int length, total_len, num, i;
785 	int ret;
786 
787 	bos = kzalloc(sizeof(struct usb_bos_descriptor), GFP_KERNEL);
788 	if (!bos)
789 		return -ENOMEM;
790 
791 	/* Get BOS descriptor */
792 	ret = usb_get_descriptor(dev, USB_DT_BOS, 0, bos, USB_DT_BOS_SIZE);
793 	if (ret < USB_DT_BOS_SIZE) {
794 		dev_err(ddev, "unable to get BOS descriptor\n");
795 		if (ret >= 0)
796 			ret = -ENOMSG;
797 		kfree(bos);
798 		return ret;
799 	}
800 
801 	length = bos->bLength;
802 	total_len = le16_to_cpu(bos->wTotalLength);
803 	num = bos->bNumDeviceCaps;
804 	kfree(bos);
805 	if (total_len < length)
806 		return -EINVAL;
807 
808 	dev->bos = kzalloc(sizeof(struct usb_host_bos), GFP_KERNEL);
809 	if (!dev->bos)
810 		return -ENOMEM;
811 
812 	/* Now let's get the whole BOS descriptor set */
813 	buffer = kzalloc(total_len, GFP_KERNEL);
814 	if (!buffer) {
815 		ret = -ENOMEM;
816 		goto err;
817 	}
818 	dev->bos->desc = (struct usb_bos_descriptor *)buffer;
819 
820 	ret = usb_get_descriptor(dev, USB_DT_BOS, 0, buffer, total_len);
821 	if (ret < total_len) {
822 		dev_err(ddev, "unable to get BOS descriptor set\n");
823 		if (ret >= 0)
824 			ret = -ENOMSG;
825 		goto err;
826 	}
827 	total_len -= length;
828 
829 	for (i = 0; i < num; i++) {
830 		buffer += length;
831 		cap = (struct usb_dev_cap_header *)buffer;
832 		length = cap->bLength;
833 
834 		if (total_len < length)
835 			break;
836 		total_len -= length;
837 
838 		if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
839 			dev_warn(ddev, "descriptor type invalid, skip\n");
840 			continue;
841 		}
842 
843 		switch (cap->bDevCapabilityType) {
844 		case USB_CAP_TYPE_WIRELESS_USB:
845 			/* Wireless USB cap descriptor is handled by wusb */
846 			break;
847 		case USB_CAP_TYPE_EXT:
848 			dev->bos->ext_cap =
849 				(struct usb_ext_cap_descriptor *)buffer;
850 			break;
851 		case USB_SS_CAP_TYPE:
852 			dev->bos->ss_cap =
853 				(struct usb_ss_cap_descriptor *)buffer;
854 			break;
855 		case CONTAINER_ID_TYPE:
856 			dev->bos->ss_id =
857 				(struct usb_ss_container_id_descriptor *)buffer;
858 			break;
859 		default:
860 			break;
861 		}
862 	}
863 
864 	return 0;
865 
866 err:
867 	usb_release_bos_descriptor(dev);
868 	return ret;
869 }
870