1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Released under the GPLv2 only. 4 */ 5 6 #include <linux/usb.h> 7 #include <linux/usb/ch9.h> 8 #include <linux/usb/hcd.h> 9 #include <linux/usb/quirks.h> 10 #include <linux/module.h> 11 #include <linux/slab.h> 12 #include <linux/device.h> 13 #include <asm/byteorder.h> 14 #include "usb.h" 15 16 17 #define USB_MAXALTSETTING 128 /* Hard limit */ 18 19 #define USB_MAXCONFIG 8 /* Arbitrary limit */ 20 21 22 static inline const char *plural(int n) 23 { 24 return (n == 1 ? "" : "s"); 25 } 26 27 static int find_next_descriptor(unsigned char *buffer, int size, 28 int dt1, int dt2, int *num_skipped) 29 { 30 struct usb_descriptor_header *h; 31 int n = 0; 32 unsigned char *buffer0 = buffer; 33 34 /* Find the next descriptor of type dt1 or dt2 */ 35 while (size > 0) { 36 h = (struct usb_descriptor_header *) buffer; 37 if (h->bDescriptorType == dt1 || h->bDescriptorType == dt2) 38 break; 39 buffer += h->bLength; 40 size -= h->bLength; 41 ++n; 42 } 43 44 /* Store the number of descriptors skipped and return the 45 * number of bytes skipped */ 46 if (num_skipped) 47 *num_skipped = n; 48 return buffer - buffer0; 49 } 50 51 static void usb_parse_ssp_isoc_endpoint_companion(struct device *ddev, 52 int cfgno, int inum, int asnum, struct usb_host_endpoint *ep, 53 unsigned char *buffer, int size) 54 { 55 struct usb_ssp_isoc_ep_comp_descriptor *desc; 56 57 /* 58 * The SuperSpeedPlus Isoc endpoint companion descriptor immediately 59 * follows the SuperSpeed Endpoint Companion descriptor 60 */ 61 desc = (struct usb_ssp_isoc_ep_comp_descriptor *) buffer; 62 if (desc->bDescriptorType != USB_DT_SSP_ISOC_ENDPOINT_COMP || 63 size < USB_DT_SSP_ISOC_EP_COMP_SIZE) { 64 dev_warn(ddev, "Invalid SuperSpeedPlus isoc endpoint companion" 65 "for config %d interface %d altsetting %d ep %d.\n", 66 cfgno, inum, asnum, ep->desc.bEndpointAddress); 67 return; 68 } 69 memcpy(&ep->ssp_isoc_ep_comp, desc, USB_DT_SSP_ISOC_EP_COMP_SIZE); 70 } 71 72 static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno, 73 int inum, int asnum, struct usb_host_endpoint *ep, 74 unsigned char *buffer, int size) 75 { 76 struct usb_ss_ep_comp_descriptor *desc; 77 int max_tx; 78 79 /* The SuperSpeed endpoint companion descriptor is supposed to 80 * be the first thing immediately following the endpoint descriptor. 81 */ 82 desc = (struct usb_ss_ep_comp_descriptor *) buffer; 83 84 if (desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP || 85 size < USB_DT_SS_EP_COMP_SIZE) { 86 dev_warn(ddev, "No SuperSpeed endpoint companion for config %d " 87 " interface %d altsetting %d ep %d: " 88 "using minimum values\n", 89 cfgno, inum, asnum, ep->desc.bEndpointAddress); 90 91 /* Fill in some default values. 92 * Leave bmAttributes as zero, which will mean no streams for 93 * bulk, and isoc won't support multiple bursts of packets. 94 * With bursts of only one packet, and a Mult of 1, the max 95 * amount of data moved per endpoint service interval is one 96 * packet. 97 */ 98 ep->ss_ep_comp.bLength = USB_DT_SS_EP_COMP_SIZE; 99 ep->ss_ep_comp.bDescriptorType = USB_DT_SS_ENDPOINT_COMP; 100 if (usb_endpoint_xfer_isoc(&ep->desc) || 101 usb_endpoint_xfer_int(&ep->desc)) 102 ep->ss_ep_comp.wBytesPerInterval = 103 ep->desc.wMaxPacketSize; 104 return; 105 } 106 buffer += desc->bLength; 107 size -= desc->bLength; 108 memcpy(&ep->ss_ep_comp, desc, USB_DT_SS_EP_COMP_SIZE); 109 110 /* Check the various values */ 111 if (usb_endpoint_xfer_control(&ep->desc) && desc->bMaxBurst != 0) { 112 dev_warn(ddev, "Control endpoint with bMaxBurst = %d in " 113 "config %d interface %d altsetting %d ep %d: " 114 "setting to zero\n", desc->bMaxBurst, 115 cfgno, inum, asnum, ep->desc.bEndpointAddress); 116 ep->ss_ep_comp.bMaxBurst = 0; 117 } else if (desc->bMaxBurst > 15) { 118 dev_warn(ddev, "Endpoint with bMaxBurst = %d in " 119 "config %d interface %d altsetting %d ep %d: " 120 "setting to 15\n", desc->bMaxBurst, 121 cfgno, inum, asnum, ep->desc.bEndpointAddress); 122 ep->ss_ep_comp.bMaxBurst = 15; 123 } 124 125 if ((usb_endpoint_xfer_control(&ep->desc) || 126 usb_endpoint_xfer_int(&ep->desc)) && 127 desc->bmAttributes != 0) { 128 dev_warn(ddev, "%s endpoint with bmAttributes = %d in " 129 "config %d interface %d altsetting %d ep %d: " 130 "setting to zero\n", 131 usb_endpoint_xfer_control(&ep->desc) ? "Control" : "Bulk", 132 desc->bmAttributes, 133 cfgno, inum, asnum, ep->desc.bEndpointAddress); 134 ep->ss_ep_comp.bmAttributes = 0; 135 } else if (usb_endpoint_xfer_bulk(&ep->desc) && 136 desc->bmAttributes > 16) { 137 dev_warn(ddev, "Bulk endpoint with more than 65536 streams in " 138 "config %d interface %d altsetting %d ep %d: " 139 "setting to max\n", 140 cfgno, inum, asnum, ep->desc.bEndpointAddress); 141 ep->ss_ep_comp.bmAttributes = 16; 142 } else if (usb_endpoint_xfer_isoc(&ep->desc) && 143 !USB_SS_SSP_ISOC_COMP(desc->bmAttributes) && 144 USB_SS_MULT(desc->bmAttributes) > 3) { 145 dev_warn(ddev, "Isoc endpoint has Mult of %d in " 146 "config %d interface %d altsetting %d ep %d: " 147 "setting to 3\n", 148 USB_SS_MULT(desc->bmAttributes), 149 cfgno, inum, asnum, ep->desc.bEndpointAddress); 150 ep->ss_ep_comp.bmAttributes = 2; 151 } 152 153 if (usb_endpoint_xfer_isoc(&ep->desc)) 154 max_tx = (desc->bMaxBurst + 1) * 155 (USB_SS_MULT(desc->bmAttributes)) * 156 usb_endpoint_maxp(&ep->desc); 157 else if (usb_endpoint_xfer_int(&ep->desc)) 158 max_tx = usb_endpoint_maxp(&ep->desc) * 159 (desc->bMaxBurst + 1); 160 else 161 max_tx = 999999; 162 if (le16_to_cpu(desc->wBytesPerInterval) > max_tx) { 163 dev_warn(ddev, "%s endpoint with wBytesPerInterval of %d in " 164 "config %d interface %d altsetting %d ep %d: " 165 "setting to %d\n", 166 usb_endpoint_xfer_isoc(&ep->desc) ? "Isoc" : "Int", 167 le16_to_cpu(desc->wBytesPerInterval), 168 cfgno, inum, asnum, ep->desc.bEndpointAddress, 169 max_tx); 170 ep->ss_ep_comp.wBytesPerInterval = cpu_to_le16(max_tx); 171 } 172 /* Parse a possible SuperSpeedPlus isoc ep companion descriptor */ 173 if (usb_endpoint_xfer_isoc(&ep->desc) && 174 USB_SS_SSP_ISOC_COMP(desc->bmAttributes)) 175 usb_parse_ssp_isoc_endpoint_companion(ddev, cfgno, inum, asnum, 176 ep, buffer, size); 177 } 178 179 static const unsigned short low_speed_maxpacket_maxes[4] = { 180 [USB_ENDPOINT_XFER_CONTROL] = 8, 181 [USB_ENDPOINT_XFER_ISOC] = 0, 182 [USB_ENDPOINT_XFER_BULK] = 0, 183 [USB_ENDPOINT_XFER_INT] = 8, 184 }; 185 static const unsigned short full_speed_maxpacket_maxes[4] = { 186 [USB_ENDPOINT_XFER_CONTROL] = 64, 187 [USB_ENDPOINT_XFER_ISOC] = 1023, 188 [USB_ENDPOINT_XFER_BULK] = 64, 189 [USB_ENDPOINT_XFER_INT] = 64, 190 }; 191 static const unsigned short high_speed_maxpacket_maxes[4] = { 192 [USB_ENDPOINT_XFER_CONTROL] = 64, 193 [USB_ENDPOINT_XFER_ISOC] = 1024, 194 195 /* Bulk should be 512, but some devices use 1024: we will warn below */ 196 [USB_ENDPOINT_XFER_BULK] = 1024, 197 [USB_ENDPOINT_XFER_INT] = 1024, 198 }; 199 static const unsigned short super_speed_maxpacket_maxes[4] = { 200 [USB_ENDPOINT_XFER_CONTROL] = 512, 201 [USB_ENDPOINT_XFER_ISOC] = 1024, 202 [USB_ENDPOINT_XFER_BULK] = 1024, 203 [USB_ENDPOINT_XFER_INT] = 1024, 204 }; 205 206 static bool endpoint_is_duplicate(struct usb_endpoint_descriptor *e1, 207 struct usb_endpoint_descriptor *e2) 208 { 209 if (e1->bEndpointAddress == e2->bEndpointAddress) 210 return true; 211 212 if (usb_endpoint_xfer_control(e1) || usb_endpoint_xfer_control(e2)) { 213 if (usb_endpoint_num(e1) == usb_endpoint_num(e2)) 214 return true; 215 } 216 217 return false; 218 } 219 220 /* 221 * Check for duplicate endpoint addresses in other interfaces and in the 222 * altsetting currently being parsed. 223 */ 224 static bool config_endpoint_is_duplicate(struct usb_host_config *config, 225 int inum, int asnum, struct usb_endpoint_descriptor *d) 226 { 227 struct usb_endpoint_descriptor *epd; 228 struct usb_interface_cache *intfc; 229 struct usb_host_interface *alt; 230 int i, j, k; 231 232 for (i = 0; i < config->desc.bNumInterfaces; ++i) { 233 intfc = config->intf_cache[i]; 234 235 for (j = 0; j < intfc->num_altsetting; ++j) { 236 alt = &intfc->altsetting[j]; 237 238 if (alt->desc.bInterfaceNumber == inum && 239 alt->desc.bAlternateSetting != asnum) 240 continue; 241 242 for (k = 0; k < alt->desc.bNumEndpoints; ++k) { 243 epd = &alt->endpoint[k].desc; 244 245 if (endpoint_is_duplicate(epd, d)) 246 return true; 247 } 248 } 249 } 250 251 return false; 252 } 253 254 static int usb_parse_endpoint(struct device *ddev, int cfgno, 255 struct usb_host_config *config, int inum, int asnum, 256 struct usb_host_interface *ifp, int num_ep, 257 unsigned char *buffer, int size) 258 { 259 struct usb_device *udev = to_usb_device(ddev); 260 unsigned char *buffer0 = buffer; 261 struct usb_endpoint_descriptor *d; 262 struct usb_host_endpoint *endpoint; 263 int n, i, j, retval; 264 unsigned int maxp; 265 const unsigned short *maxpacket_maxes; 266 267 d = (struct usb_endpoint_descriptor *) buffer; 268 buffer += d->bLength; 269 size -= d->bLength; 270 271 if (d->bLength >= USB_DT_ENDPOINT_AUDIO_SIZE) 272 n = USB_DT_ENDPOINT_AUDIO_SIZE; 273 else if (d->bLength >= USB_DT_ENDPOINT_SIZE) 274 n = USB_DT_ENDPOINT_SIZE; 275 else { 276 dev_warn(ddev, "config %d interface %d altsetting %d has an " 277 "invalid endpoint descriptor of length %d, skipping\n", 278 cfgno, inum, asnum, d->bLength); 279 goto skip_to_next_endpoint_or_interface_descriptor; 280 } 281 282 i = d->bEndpointAddress & ~USB_ENDPOINT_DIR_MASK; 283 if (i >= 16 || i == 0) { 284 dev_warn(ddev, "config %d interface %d altsetting %d has an " 285 "invalid endpoint with address 0x%X, skipping\n", 286 cfgno, inum, asnum, d->bEndpointAddress); 287 goto skip_to_next_endpoint_or_interface_descriptor; 288 } 289 290 /* Only store as many endpoints as we have room for */ 291 if (ifp->desc.bNumEndpoints >= num_ep) 292 goto skip_to_next_endpoint_or_interface_descriptor; 293 294 /* Check for duplicate endpoint addresses */ 295 if (config_endpoint_is_duplicate(config, inum, asnum, d)) { 296 dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n", 297 cfgno, inum, asnum, d->bEndpointAddress); 298 goto skip_to_next_endpoint_or_interface_descriptor; 299 } 300 301 /* Ignore blacklisted endpoints */ 302 if (udev->quirks & USB_QUIRK_ENDPOINT_BLACKLIST) { 303 if (usb_endpoint_is_blacklisted(udev, ifp, d)) { 304 dev_warn(ddev, "config %d interface %d altsetting %d has a blacklisted endpoint with address 0x%X, skipping\n", 305 cfgno, inum, asnum, 306 d->bEndpointAddress); 307 goto skip_to_next_endpoint_or_interface_descriptor; 308 } 309 } 310 311 endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; 312 ++ifp->desc.bNumEndpoints; 313 314 memcpy(&endpoint->desc, d, n); 315 INIT_LIST_HEAD(&endpoint->urb_list); 316 317 /* 318 * Fix up bInterval values outside the legal range. 319 * Use 10 or 8 ms if no proper value can be guessed. 320 */ 321 i = 0; /* i = min, j = max, n = default */ 322 j = 255; 323 if (usb_endpoint_xfer_int(d)) { 324 i = 1; 325 switch (to_usb_device(ddev)->speed) { 326 case USB_SPEED_SUPER_PLUS: 327 case USB_SPEED_SUPER: 328 case USB_SPEED_HIGH: 329 /* 330 * Many device manufacturers are using full-speed 331 * bInterval values in high-speed interrupt endpoint 332 * descriptors. Try to fix those and fall back to an 333 * 8-ms default value otherwise. 334 */ 335 n = fls(d->bInterval*8); 336 if (n == 0) 337 n = 7; /* 8 ms = 2^(7-1) uframes */ 338 j = 16; 339 340 /* 341 * Adjust bInterval for quirked devices. 342 */ 343 /* 344 * This quirk fixes bIntervals reported in ms. 345 */ 346 if (to_usb_device(ddev)->quirks & 347 USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL) { 348 n = clamp(fls(d->bInterval) + 3, i, j); 349 i = j = n; 350 } 351 /* 352 * This quirk fixes bIntervals reported in 353 * linear microframes. 354 */ 355 if (to_usb_device(ddev)->quirks & 356 USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL) { 357 n = clamp(fls(d->bInterval), i, j); 358 i = j = n; 359 } 360 break; 361 default: /* USB_SPEED_FULL or _LOW */ 362 /* 363 * For low-speed, 10 ms is the official minimum. 364 * But some "overclocked" devices might want faster 365 * polling so we'll allow it. 366 */ 367 n = 10; 368 break; 369 } 370 } else if (usb_endpoint_xfer_isoc(d)) { 371 i = 1; 372 j = 16; 373 switch (to_usb_device(ddev)->speed) { 374 case USB_SPEED_HIGH: 375 n = 7; /* 8 ms = 2^(7-1) uframes */ 376 break; 377 default: /* USB_SPEED_FULL */ 378 n = 4; /* 8 ms = 2^(4-1) frames */ 379 break; 380 } 381 } 382 if (d->bInterval < i || d->bInterval > j) { 383 dev_warn(ddev, "config %d interface %d altsetting %d " 384 "endpoint 0x%X has an invalid bInterval %d, " 385 "changing to %d\n", 386 cfgno, inum, asnum, 387 d->bEndpointAddress, d->bInterval, n); 388 endpoint->desc.bInterval = n; 389 } 390 391 /* Some buggy low-speed devices have Bulk endpoints, which is 392 * explicitly forbidden by the USB spec. In an attempt to make 393 * them usable, we will try treating them as Interrupt endpoints. 394 */ 395 if (to_usb_device(ddev)->speed == USB_SPEED_LOW && 396 usb_endpoint_xfer_bulk(d)) { 397 dev_warn(ddev, "config %d interface %d altsetting %d " 398 "endpoint 0x%X is Bulk; changing to Interrupt\n", 399 cfgno, inum, asnum, d->bEndpointAddress); 400 endpoint->desc.bmAttributes = USB_ENDPOINT_XFER_INT; 401 endpoint->desc.bInterval = 1; 402 if (usb_endpoint_maxp(&endpoint->desc) > 8) 403 endpoint->desc.wMaxPacketSize = cpu_to_le16(8); 404 } 405 406 /* 407 * Validate the wMaxPacketSize field. 408 * Some devices have isochronous endpoints in altsetting 0; 409 * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0 410 * (see the end of section 5.6.3), so don't warn about them. 411 */ 412 maxp = usb_endpoint_maxp(&endpoint->desc); 413 if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) { 414 dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n", 415 cfgno, inum, asnum, d->bEndpointAddress); 416 } 417 418 /* Find the highest legal maxpacket size for this endpoint */ 419 i = 0; /* additional transactions per microframe */ 420 switch (to_usb_device(ddev)->speed) { 421 case USB_SPEED_LOW: 422 maxpacket_maxes = low_speed_maxpacket_maxes; 423 break; 424 case USB_SPEED_FULL: 425 maxpacket_maxes = full_speed_maxpacket_maxes; 426 break; 427 case USB_SPEED_HIGH: 428 /* Bits 12..11 are allowed only for HS periodic endpoints */ 429 if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) { 430 i = maxp & (BIT(12) | BIT(11)); 431 maxp &= ~i; 432 } 433 /* fallthrough */ 434 default: 435 maxpacket_maxes = high_speed_maxpacket_maxes; 436 break; 437 case USB_SPEED_SUPER: 438 case USB_SPEED_SUPER_PLUS: 439 maxpacket_maxes = super_speed_maxpacket_maxes; 440 break; 441 } 442 j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)]; 443 444 if (maxp > j) { 445 dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n", 446 cfgno, inum, asnum, d->bEndpointAddress, maxp, j); 447 maxp = j; 448 endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp); 449 } 450 451 /* 452 * Some buggy high speed devices have bulk endpoints using 453 * maxpacket sizes other than 512. High speed HCDs may not 454 * be able to handle that particular bug, so let's warn... 455 */ 456 if (to_usb_device(ddev)->speed == USB_SPEED_HIGH 457 && usb_endpoint_xfer_bulk(d)) { 458 if (maxp != 512) 459 dev_warn(ddev, "config %d interface %d altsetting %d " 460 "bulk endpoint 0x%X has invalid maxpacket %d\n", 461 cfgno, inum, asnum, d->bEndpointAddress, 462 maxp); 463 } 464 465 /* Parse a possible SuperSpeed endpoint companion descriptor */ 466 if (to_usb_device(ddev)->speed >= USB_SPEED_SUPER) 467 usb_parse_ss_endpoint_companion(ddev, cfgno, 468 inum, asnum, endpoint, buffer, size); 469 470 /* Skip over any Class Specific or Vendor Specific descriptors; 471 * find the next endpoint or interface descriptor */ 472 endpoint->extra = buffer; 473 i = find_next_descriptor(buffer, size, USB_DT_ENDPOINT, 474 USB_DT_INTERFACE, &n); 475 endpoint->extralen = i; 476 retval = buffer - buffer0 + i; 477 if (n > 0) 478 dev_dbg(ddev, "skipped %d descriptor%s after %s\n", 479 n, plural(n), "endpoint"); 480 return retval; 481 482 skip_to_next_endpoint_or_interface_descriptor: 483 i = find_next_descriptor(buffer, size, USB_DT_ENDPOINT, 484 USB_DT_INTERFACE, NULL); 485 return buffer - buffer0 + i; 486 } 487 488 void usb_release_interface_cache(struct kref *ref) 489 { 490 struct usb_interface_cache *intfc = ref_to_usb_interface_cache(ref); 491 int j; 492 493 for (j = 0; j < intfc->num_altsetting; j++) { 494 struct usb_host_interface *alt = &intfc->altsetting[j]; 495 496 kfree(alt->endpoint); 497 kfree(alt->string); 498 } 499 kfree(intfc); 500 } 501 502 static int usb_parse_interface(struct device *ddev, int cfgno, 503 struct usb_host_config *config, unsigned char *buffer, int size, 504 u8 inums[], u8 nalts[]) 505 { 506 unsigned char *buffer0 = buffer; 507 struct usb_interface_descriptor *d; 508 int inum, asnum; 509 struct usb_interface_cache *intfc; 510 struct usb_host_interface *alt; 511 int i, n; 512 int len, retval; 513 int num_ep, num_ep_orig; 514 515 d = (struct usb_interface_descriptor *) buffer; 516 buffer += d->bLength; 517 size -= d->bLength; 518 519 if (d->bLength < USB_DT_INTERFACE_SIZE) 520 goto skip_to_next_interface_descriptor; 521 522 /* Which interface entry is this? */ 523 intfc = NULL; 524 inum = d->bInterfaceNumber; 525 for (i = 0; i < config->desc.bNumInterfaces; ++i) { 526 if (inums[i] == inum) { 527 intfc = config->intf_cache[i]; 528 break; 529 } 530 } 531 if (!intfc || intfc->num_altsetting >= nalts[i]) 532 goto skip_to_next_interface_descriptor; 533 534 /* Check for duplicate altsetting entries */ 535 asnum = d->bAlternateSetting; 536 for ((i = 0, alt = &intfc->altsetting[0]); 537 i < intfc->num_altsetting; 538 (++i, ++alt)) { 539 if (alt->desc.bAlternateSetting == asnum) { 540 dev_warn(ddev, "Duplicate descriptor for config %d " 541 "interface %d altsetting %d, skipping\n", 542 cfgno, inum, asnum); 543 goto skip_to_next_interface_descriptor; 544 } 545 } 546 547 ++intfc->num_altsetting; 548 memcpy(&alt->desc, d, USB_DT_INTERFACE_SIZE); 549 550 /* Skip over any Class Specific or Vendor Specific descriptors; 551 * find the first endpoint or interface descriptor */ 552 alt->extra = buffer; 553 i = find_next_descriptor(buffer, size, USB_DT_ENDPOINT, 554 USB_DT_INTERFACE, &n); 555 alt->extralen = i; 556 if (n > 0) 557 dev_dbg(ddev, "skipped %d descriptor%s after %s\n", 558 n, plural(n), "interface"); 559 buffer += i; 560 size -= i; 561 562 /* Allocate space for the right(?) number of endpoints */ 563 num_ep = num_ep_orig = alt->desc.bNumEndpoints; 564 alt->desc.bNumEndpoints = 0; /* Use as a counter */ 565 if (num_ep > USB_MAXENDPOINTS) { 566 dev_warn(ddev, "too many endpoints for config %d interface %d " 567 "altsetting %d: %d, using maximum allowed: %d\n", 568 cfgno, inum, asnum, num_ep, USB_MAXENDPOINTS); 569 num_ep = USB_MAXENDPOINTS; 570 } 571 572 if (num_ep > 0) { 573 /* Can't allocate 0 bytes */ 574 len = sizeof(struct usb_host_endpoint) * num_ep; 575 alt->endpoint = kzalloc(len, GFP_KERNEL); 576 if (!alt->endpoint) 577 return -ENOMEM; 578 } 579 580 /* Parse all the endpoint descriptors */ 581 n = 0; 582 while (size > 0) { 583 if (((struct usb_descriptor_header *) buffer)->bDescriptorType 584 == USB_DT_INTERFACE) 585 break; 586 retval = usb_parse_endpoint(ddev, cfgno, config, inum, asnum, 587 alt, num_ep, buffer, size); 588 if (retval < 0) 589 return retval; 590 ++n; 591 592 buffer += retval; 593 size -= retval; 594 } 595 596 if (n != num_ep_orig) 597 dev_warn(ddev, "config %d interface %d altsetting %d has %d " 598 "endpoint descriptor%s, different from the interface " 599 "descriptor's value: %d\n", 600 cfgno, inum, asnum, n, plural(n), num_ep_orig); 601 return buffer - buffer0; 602 603 skip_to_next_interface_descriptor: 604 i = find_next_descriptor(buffer, size, USB_DT_INTERFACE, 605 USB_DT_INTERFACE, NULL); 606 return buffer - buffer0 + i; 607 } 608 609 static int usb_parse_configuration(struct usb_device *dev, int cfgidx, 610 struct usb_host_config *config, unsigned char *buffer, int size) 611 { 612 struct device *ddev = &dev->dev; 613 unsigned char *buffer0 = buffer; 614 int cfgno; 615 int nintf, nintf_orig; 616 int i, j, n; 617 struct usb_interface_cache *intfc; 618 unsigned char *buffer2; 619 int size2; 620 struct usb_descriptor_header *header; 621 int retval; 622 u8 inums[USB_MAXINTERFACES], nalts[USB_MAXINTERFACES]; 623 unsigned iad_num = 0; 624 625 memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE); 626 nintf = nintf_orig = config->desc.bNumInterfaces; 627 config->desc.bNumInterfaces = 0; // Adjusted later 628 629 if (config->desc.bDescriptorType != USB_DT_CONFIG || 630 config->desc.bLength < USB_DT_CONFIG_SIZE || 631 config->desc.bLength > size) { 632 dev_err(ddev, "invalid descriptor for config index %d: " 633 "type = 0x%X, length = %d\n", cfgidx, 634 config->desc.bDescriptorType, config->desc.bLength); 635 return -EINVAL; 636 } 637 cfgno = config->desc.bConfigurationValue; 638 639 buffer += config->desc.bLength; 640 size -= config->desc.bLength; 641 642 if (nintf > USB_MAXINTERFACES) { 643 dev_warn(ddev, "config %d has too many interfaces: %d, " 644 "using maximum allowed: %d\n", 645 cfgno, nintf, USB_MAXINTERFACES); 646 nintf = USB_MAXINTERFACES; 647 } 648 649 /* Go through the descriptors, checking their length and counting the 650 * number of altsettings for each interface */ 651 n = 0; 652 for ((buffer2 = buffer, size2 = size); 653 size2 > 0; 654 (buffer2 += header->bLength, size2 -= header->bLength)) { 655 656 if (size2 < sizeof(struct usb_descriptor_header)) { 657 dev_warn(ddev, "config %d descriptor has %d excess " 658 "byte%s, ignoring\n", 659 cfgno, size2, plural(size2)); 660 break; 661 } 662 663 header = (struct usb_descriptor_header *) buffer2; 664 if ((header->bLength > size2) || (header->bLength < 2)) { 665 dev_warn(ddev, "config %d has an invalid descriptor " 666 "of length %d, skipping remainder of the config\n", 667 cfgno, header->bLength); 668 break; 669 } 670 671 if (header->bDescriptorType == USB_DT_INTERFACE) { 672 struct usb_interface_descriptor *d; 673 int inum; 674 675 d = (struct usb_interface_descriptor *) header; 676 if (d->bLength < USB_DT_INTERFACE_SIZE) { 677 dev_warn(ddev, "config %d has an invalid " 678 "interface descriptor of length %d, " 679 "skipping\n", cfgno, d->bLength); 680 continue; 681 } 682 683 inum = d->bInterfaceNumber; 684 685 if ((dev->quirks & USB_QUIRK_HONOR_BNUMINTERFACES) && 686 n >= nintf_orig) { 687 dev_warn(ddev, "config %d has more interface " 688 "descriptors, than it declares in " 689 "bNumInterfaces, ignoring interface " 690 "number: %d\n", cfgno, inum); 691 continue; 692 } 693 694 if (inum >= nintf_orig) 695 dev_warn(ddev, "config %d has an invalid " 696 "interface number: %d but max is %d\n", 697 cfgno, inum, nintf_orig - 1); 698 699 /* Have we already encountered this interface? 700 * Count its altsettings */ 701 for (i = 0; i < n; ++i) { 702 if (inums[i] == inum) 703 break; 704 } 705 if (i < n) { 706 if (nalts[i] < 255) 707 ++nalts[i]; 708 } else if (n < USB_MAXINTERFACES) { 709 inums[n] = inum; 710 nalts[n] = 1; 711 ++n; 712 } 713 714 } else if (header->bDescriptorType == 715 USB_DT_INTERFACE_ASSOCIATION) { 716 struct usb_interface_assoc_descriptor *d; 717 718 d = (struct usb_interface_assoc_descriptor *)header; 719 if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) { 720 dev_warn(ddev, 721 "config %d has an invalid interface association descriptor of length %d, skipping\n", 722 cfgno, d->bLength); 723 continue; 724 } 725 726 if (iad_num == USB_MAXIADS) { 727 dev_warn(ddev, "found more Interface " 728 "Association Descriptors " 729 "than allocated for in " 730 "configuration %d\n", cfgno); 731 } else { 732 config->intf_assoc[iad_num] = d; 733 iad_num++; 734 } 735 736 } else if (header->bDescriptorType == USB_DT_DEVICE || 737 header->bDescriptorType == USB_DT_CONFIG) 738 dev_warn(ddev, "config %d contains an unexpected " 739 "descriptor of type 0x%X, skipping\n", 740 cfgno, header->bDescriptorType); 741 742 } /* for ((buffer2 = buffer, size2 = size); ...) */ 743 size = buffer2 - buffer; 744 config->desc.wTotalLength = cpu_to_le16(buffer2 - buffer0); 745 746 if (n != nintf) 747 dev_warn(ddev, "config %d has %d interface%s, different from " 748 "the descriptor's value: %d\n", 749 cfgno, n, plural(n), nintf_orig); 750 else if (n == 0) 751 dev_warn(ddev, "config %d has no interfaces?\n", cfgno); 752 config->desc.bNumInterfaces = nintf = n; 753 754 /* Check for missing interface numbers */ 755 for (i = 0; i < nintf; ++i) { 756 for (j = 0; j < nintf; ++j) { 757 if (inums[j] == i) 758 break; 759 } 760 if (j >= nintf) 761 dev_warn(ddev, "config %d has no interface number " 762 "%d\n", cfgno, i); 763 } 764 765 /* Allocate the usb_interface_caches and altsetting arrays */ 766 for (i = 0; i < nintf; ++i) { 767 j = nalts[i]; 768 if (j > USB_MAXALTSETTING) { 769 dev_warn(ddev, "too many alternate settings for " 770 "config %d interface %d: %d, " 771 "using maximum allowed: %d\n", 772 cfgno, inums[i], j, USB_MAXALTSETTING); 773 nalts[i] = j = USB_MAXALTSETTING; 774 } 775 776 intfc = kzalloc(struct_size(intfc, altsetting, j), GFP_KERNEL); 777 config->intf_cache[i] = intfc; 778 if (!intfc) 779 return -ENOMEM; 780 kref_init(&intfc->ref); 781 } 782 783 /* FIXME: parse the BOS descriptor */ 784 785 /* Skip over any Class Specific or Vendor Specific descriptors; 786 * find the first interface descriptor */ 787 config->extra = buffer; 788 i = find_next_descriptor(buffer, size, USB_DT_INTERFACE, 789 USB_DT_INTERFACE, &n); 790 config->extralen = i; 791 if (n > 0) 792 dev_dbg(ddev, "skipped %d descriptor%s after %s\n", 793 n, plural(n), "configuration"); 794 buffer += i; 795 size -= i; 796 797 /* Parse all the interface/altsetting descriptors */ 798 while (size > 0) { 799 retval = usb_parse_interface(ddev, cfgno, config, 800 buffer, size, inums, nalts); 801 if (retval < 0) 802 return retval; 803 804 buffer += retval; 805 size -= retval; 806 } 807 808 /* Check for missing altsettings */ 809 for (i = 0; i < nintf; ++i) { 810 intfc = config->intf_cache[i]; 811 for (j = 0; j < intfc->num_altsetting; ++j) { 812 for (n = 0; n < intfc->num_altsetting; ++n) { 813 if (intfc->altsetting[n].desc. 814 bAlternateSetting == j) 815 break; 816 } 817 if (n >= intfc->num_altsetting) 818 dev_warn(ddev, "config %d interface %d has no " 819 "altsetting %d\n", cfgno, inums[i], j); 820 } 821 } 822 823 return 0; 824 } 825 826 /* hub-only!! ... and only exported for reset/reinit path. 827 * otherwise used internally on disconnect/destroy path 828 */ 829 void usb_destroy_configuration(struct usb_device *dev) 830 { 831 int c, i; 832 833 if (!dev->config) 834 return; 835 836 if (dev->rawdescriptors) { 837 for (i = 0; i < dev->descriptor.bNumConfigurations; i++) 838 kfree(dev->rawdescriptors[i]); 839 840 kfree(dev->rawdescriptors); 841 dev->rawdescriptors = NULL; 842 } 843 844 for (c = 0; c < dev->descriptor.bNumConfigurations; c++) { 845 struct usb_host_config *cf = &dev->config[c]; 846 847 kfree(cf->string); 848 for (i = 0; i < cf->desc.bNumInterfaces; i++) { 849 if (cf->intf_cache[i]) 850 kref_put(&cf->intf_cache[i]->ref, 851 usb_release_interface_cache); 852 } 853 } 854 kfree(dev->config); 855 dev->config = NULL; 856 } 857 858 859 /* 860 * Get the USB config descriptors, cache and parse'em 861 * 862 * hub-only!! ... and only in reset path, or usb_new_device() 863 * (used by real hubs and virtual root hubs) 864 */ 865 int usb_get_configuration(struct usb_device *dev) 866 { 867 struct device *ddev = &dev->dev; 868 int ncfg = dev->descriptor.bNumConfigurations; 869 unsigned int cfgno, length; 870 unsigned char *bigbuffer; 871 struct usb_config_descriptor *desc; 872 int result; 873 874 if (ncfg > USB_MAXCONFIG) { 875 dev_warn(ddev, "too many configurations: %d, " 876 "using maximum allowed: %d\n", ncfg, USB_MAXCONFIG); 877 dev->descriptor.bNumConfigurations = ncfg = USB_MAXCONFIG; 878 } 879 880 if (ncfg < 1) { 881 dev_err(ddev, "no configurations\n"); 882 return -EINVAL; 883 } 884 885 length = ncfg * sizeof(struct usb_host_config); 886 dev->config = kzalloc(length, GFP_KERNEL); 887 if (!dev->config) 888 return -ENOMEM; 889 890 length = ncfg * sizeof(char *); 891 dev->rawdescriptors = kzalloc(length, GFP_KERNEL); 892 if (!dev->rawdescriptors) 893 return -ENOMEM; 894 895 desc = kmalloc(USB_DT_CONFIG_SIZE, GFP_KERNEL); 896 if (!desc) 897 return -ENOMEM; 898 899 for (cfgno = 0; cfgno < ncfg; cfgno++) { 900 /* We grab just the first descriptor so we know how long 901 * the whole configuration is */ 902 result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, 903 desc, USB_DT_CONFIG_SIZE); 904 if (result < 0) { 905 dev_err(ddev, "unable to read config index %d " 906 "descriptor/%s: %d\n", cfgno, "start", result); 907 if (result != -EPIPE) 908 goto err; 909 dev_err(ddev, "chopping to %d config(s)\n", cfgno); 910 dev->descriptor.bNumConfigurations = cfgno; 911 break; 912 } else if (result < 4) { 913 dev_err(ddev, "config index %d descriptor too short " 914 "(expected %i, got %i)\n", cfgno, 915 USB_DT_CONFIG_SIZE, result); 916 result = -EINVAL; 917 goto err; 918 } 919 length = max((int) le16_to_cpu(desc->wTotalLength), 920 USB_DT_CONFIG_SIZE); 921 922 /* Now that we know the length, get the whole thing */ 923 bigbuffer = kmalloc(length, GFP_KERNEL); 924 if (!bigbuffer) { 925 result = -ENOMEM; 926 goto err; 927 } 928 929 if (dev->quirks & USB_QUIRK_DELAY_INIT) 930 msleep(200); 931 932 result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, 933 bigbuffer, length); 934 if (result < 0) { 935 dev_err(ddev, "unable to read config index %d " 936 "descriptor/%s\n", cfgno, "all"); 937 kfree(bigbuffer); 938 goto err; 939 } 940 if (result < length) { 941 dev_warn(ddev, "config index %d descriptor too short " 942 "(expected %i, got %i)\n", cfgno, length, result); 943 length = result; 944 } 945 946 dev->rawdescriptors[cfgno] = bigbuffer; 947 948 result = usb_parse_configuration(dev, cfgno, 949 &dev->config[cfgno], bigbuffer, length); 950 if (result < 0) { 951 ++cfgno; 952 goto err; 953 } 954 } 955 956 err: 957 kfree(desc); 958 dev->descriptor.bNumConfigurations = cfgno; 959 960 return result; 961 } 962 963 void usb_release_bos_descriptor(struct usb_device *dev) 964 { 965 if (dev->bos) { 966 kfree(dev->bos->desc); 967 kfree(dev->bos); 968 dev->bos = NULL; 969 } 970 } 971 972 static const __u8 bos_desc_len[256] = { 973 [USB_CAP_TYPE_WIRELESS_USB] = USB_DT_USB_WIRELESS_CAP_SIZE, 974 [USB_CAP_TYPE_EXT] = USB_DT_USB_EXT_CAP_SIZE, 975 [USB_SS_CAP_TYPE] = USB_DT_USB_SS_CAP_SIZE, 976 [USB_SSP_CAP_TYPE] = USB_DT_USB_SSP_CAP_SIZE(1), 977 [CONTAINER_ID_TYPE] = USB_DT_USB_SS_CONTN_ID_SIZE, 978 [USB_PTM_CAP_TYPE] = USB_DT_USB_PTM_ID_SIZE, 979 }; 980 981 /* Get BOS descriptor set */ 982 int usb_get_bos_descriptor(struct usb_device *dev) 983 { 984 struct device *ddev = &dev->dev; 985 struct usb_bos_descriptor *bos; 986 struct usb_dev_cap_header *cap; 987 struct usb_ssp_cap_descriptor *ssp_cap; 988 unsigned char *buffer, *buffer0; 989 int length, total_len, num, i, ssac; 990 __u8 cap_type; 991 int ret; 992 993 bos = kzalloc(sizeof(struct usb_bos_descriptor), GFP_KERNEL); 994 if (!bos) 995 return -ENOMEM; 996 997 /* Get BOS descriptor */ 998 ret = usb_get_descriptor(dev, USB_DT_BOS, 0, bos, USB_DT_BOS_SIZE); 999 if (ret < USB_DT_BOS_SIZE || bos->bLength < USB_DT_BOS_SIZE) { 1000 dev_err(ddev, "unable to get BOS descriptor or descriptor too short\n"); 1001 if (ret >= 0) 1002 ret = -ENOMSG; 1003 kfree(bos); 1004 return ret; 1005 } 1006 1007 length = bos->bLength; 1008 total_len = le16_to_cpu(bos->wTotalLength); 1009 num = bos->bNumDeviceCaps; 1010 kfree(bos); 1011 if (total_len < length) 1012 return -EINVAL; 1013 1014 dev->bos = kzalloc(sizeof(struct usb_host_bos), GFP_KERNEL); 1015 if (!dev->bos) 1016 return -ENOMEM; 1017 1018 /* Now let's get the whole BOS descriptor set */ 1019 buffer = kzalloc(total_len, GFP_KERNEL); 1020 if (!buffer) { 1021 ret = -ENOMEM; 1022 goto err; 1023 } 1024 dev->bos->desc = (struct usb_bos_descriptor *)buffer; 1025 1026 ret = usb_get_descriptor(dev, USB_DT_BOS, 0, buffer, total_len); 1027 if (ret < total_len) { 1028 dev_err(ddev, "unable to get BOS descriptor set\n"); 1029 if (ret >= 0) 1030 ret = -ENOMSG; 1031 goto err; 1032 } 1033 1034 buffer0 = buffer; 1035 total_len -= length; 1036 buffer += length; 1037 1038 for (i = 0; i < num; i++) { 1039 cap = (struct usb_dev_cap_header *)buffer; 1040 1041 if (total_len < sizeof(*cap) || total_len < cap->bLength) { 1042 dev->bos->desc->bNumDeviceCaps = i; 1043 break; 1044 } 1045 cap_type = cap->bDevCapabilityType; 1046 length = cap->bLength; 1047 if (bos_desc_len[cap_type] && length < bos_desc_len[cap_type]) { 1048 dev->bos->desc->bNumDeviceCaps = i; 1049 break; 1050 } 1051 1052 if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) { 1053 dev_warn(ddev, "descriptor type invalid, skip\n"); 1054 continue; 1055 } 1056 1057 switch (cap_type) { 1058 case USB_CAP_TYPE_WIRELESS_USB: 1059 /* Wireless USB cap descriptor is handled by wusb */ 1060 break; 1061 case USB_CAP_TYPE_EXT: 1062 dev->bos->ext_cap = 1063 (struct usb_ext_cap_descriptor *)buffer; 1064 break; 1065 case USB_SS_CAP_TYPE: 1066 dev->bos->ss_cap = 1067 (struct usb_ss_cap_descriptor *)buffer; 1068 break; 1069 case USB_SSP_CAP_TYPE: 1070 ssp_cap = (struct usb_ssp_cap_descriptor *)buffer; 1071 ssac = (le32_to_cpu(ssp_cap->bmAttributes) & 1072 USB_SSP_SUBLINK_SPEED_ATTRIBS); 1073 if (length >= USB_DT_USB_SSP_CAP_SIZE(ssac)) 1074 dev->bos->ssp_cap = ssp_cap; 1075 break; 1076 case CONTAINER_ID_TYPE: 1077 dev->bos->ss_id = 1078 (struct usb_ss_container_id_descriptor *)buffer; 1079 break; 1080 case USB_PTM_CAP_TYPE: 1081 dev->bos->ptm_cap = 1082 (struct usb_ptm_cap_descriptor *)buffer; 1083 default: 1084 break; 1085 } 1086 1087 total_len -= length; 1088 buffer += length; 1089 } 1090 dev->bos->desc->wTotalLength = cpu_to_le16(buffer - buffer0); 1091 1092 return 0; 1093 1094 err: 1095 usb_release_bos_descriptor(dev); 1096 return ret; 1097 } 1098