1 /* 2 * Released under the GPLv2 only. 3 * SPDX-License-Identifier: GPL-2.0 4 */ 5 6 #include <linux/usb.h> 7 #include <linux/usb/ch9.h> 8 #include <linux/usb/hcd.h> 9 #include <linux/usb/quirks.h> 10 #include <linux/module.h> 11 #include <linux/slab.h> 12 #include <linux/device.h> 13 #include <asm/byteorder.h> 14 #include "usb.h" 15 16 17 #define USB_MAXALTSETTING 128 /* Hard limit */ 18 19 #define USB_MAXCONFIG 8 /* Arbitrary limit */ 20 21 22 static inline const char *plural(int n) 23 { 24 return (n == 1 ? "" : "s"); 25 } 26 27 static int find_next_descriptor(unsigned char *buffer, int size, 28 int dt1, int dt2, int *num_skipped) 29 { 30 struct usb_descriptor_header *h; 31 int n = 0; 32 unsigned char *buffer0 = buffer; 33 34 /* Find the next descriptor of type dt1 or dt2 */ 35 while (size > 0) { 36 h = (struct usb_descriptor_header *) buffer; 37 if (h->bDescriptorType == dt1 || h->bDescriptorType == dt2) 38 break; 39 buffer += h->bLength; 40 size -= h->bLength; 41 ++n; 42 } 43 44 /* Store the number of descriptors skipped and return the 45 * number of bytes skipped */ 46 if (num_skipped) 47 *num_skipped = n; 48 return buffer - buffer0; 49 } 50 51 static void usb_parse_ssp_isoc_endpoint_companion(struct device *ddev, 52 int cfgno, int inum, int asnum, struct usb_host_endpoint *ep, 53 unsigned char *buffer, int size) 54 { 55 struct usb_ssp_isoc_ep_comp_descriptor *desc; 56 57 /* 58 * The SuperSpeedPlus Isoc endpoint companion descriptor immediately 59 * follows the SuperSpeed Endpoint Companion descriptor 60 */ 61 desc = (struct usb_ssp_isoc_ep_comp_descriptor *) buffer; 62 if (desc->bDescriptorType != USB_DT_SSP_ISOC_ENDPOINT_COMP || 63 size < USB_DT_SSP_ISOC_EP_COMP_SIZE) { 64 dev_warn(ddev, "Invalid SuperSpeedPlus isoc endpoint companion" 65 "for config %d interface %d altsetting %d ep %d.\n", 66 cfgno, inum, asnum, ep->desc.bEndpointAddress); 67 return; 68 } 69 memcpy(&ep->ssp_isoc_ep_comp, desc, USB_DT_SSP_ISOC_EP_COMP_SIZE); 70 } 71 72 static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno, 73 int inum, int asnum, struct usb_host_endpoint *ep, 74 unsigned char *buffer, int size) 75 { 76 struct usb_ss_ep_comp_descriptor *desc; 77 int max_tx; 78 79 /* The SuperSpeed endpoint companion descriptor is supposed to 80 * be the first thing immediately following the endpoint descriptor. 81 */ 82 desc = (struct usb_ss_ep_comp_descriptor *) buffer; 83 84 if (desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP || 85 size < USB_DT_SS_EP_COMP_SIZE) { 86 dev_warn(ddev, "No SuperSpeed endpoint companion for config %d " 87 " interface %d altsetting %d ep %d: " 88 "using minimum values\n", 89 cfgno, inum, asnum, ep->desc.bEndpointAddress); 90 91 /* Fill in some default values. 92 * Leave bmAttributes as zero, which will mean no streams for 93 * bulk, and isoc won't support multiple bursts of packets. 94 * With bursts of only one packet, and a Mult of 1, the max 95 * amount of data moved per endpoint service interval is one 96 * packet. 97 */ 98 ep->ss_ep_comp.bLength = USB_DT_SS_EP_COMP_SIZE; 99 ep->ss_ep_comp.bDescriptorType = USB_DT_SS_ENDPOINT_COMP; 100 if (usb_endpoint_xfer_isoc(&ep->desc) || 101 usb_endpoint_xfer_int(&ep->desc)) 102 ep->ss_ep_comp.wBytesPerInterval = 103 ep->desc.wMaxPacketSize; 104 return; 105 } 106 buffer += desc->bLength; 107 size -= desc->bLength; 108 memcpy(&ep->ss_ep_comp, desc, USB_DT_SS_EP_COMP_SIZE); 109 110 /* Check the various values */ 111 if (usb_endpoint_xfer_control(&ep->desc) && desc->bMaxBurst != 0) { 112 dev_warn(ddev, "Control endpoint with bMaxBurst = %d in " 113 "config %d interface %d altsetting %d ep %d: " 114 "setting to zero\n", desc->bMaxBurst, 115 cfgno, inum, asnum, ep->desc.bEndpointAddress); 116 ep->ss_ep_comp.bMaxBurst = 0; 117 } else if (desc->bMaxBurst > 15) { 118 dev_warn(ddev, "Endpoint with bMaxBurst = %d in " 119 "config %d interface %d altsetting %d ep %d: " 120 "setting to 15\n", desc->bMaxBurst, 121 cfgno, inum, asnum, ep->desc.bEndpointAddress); 122 ep->ss_ep_comp.bMaxBurst = 15; 123 } 124 125 if ((usb_endpoint_xfer_control(&ep->desc) || 126 usb_endpoint_xfer_int(&ep->desc)) && 127 desc->bmAttributes != 0) { 128 dev_warn(ddev, "%s endpoint with bmAttributes = %d in " 129 "config %d interface %d altsetting %d ep %d: " 130 "setting to zero\n", 131 usb_endpoint_xfer_control(&ep->desc) ? "Control" : "Bulk", 132 desc->bmAttributes, 133 cfgno, inum, asnum, ep->desc.bEndpointAddress); 134 ep->ss_ep_comp.bmAttributes = 0; 135 } else if (usb_endpoint_xfer_bulk(&ep->desc) && 136 desc->bmAttributes > 16) { 137 dev_warn(ddev, "Bulk endpoint with more than 65536 streams in " 138 "config %d interface %d altsetting %d ep %d: " 139 "setting to max\n", 140 cfgno, inum, asnum, ep->desc.bEndpointAddress); 141 ep->ss_ep_comp.bmAttributes = 16; 142 } else if (usb_endpoint_xfer_isoc(&ep->desc) && 143 !USB_SS_SSP_ISOC_COMP(desc->bmAttributes) && 144 USB_SS_MULT(desc->bmAttributes) > 3) { 145 dev_warn(ddev, "Isoc endpoint has Mult of %d in " 146 "config %d interface %d altsetting %d ep %d: " 147 "setting to 3\n", 148 USB_SS_MULT(desc->bmAttributes), 149 cfgno, inum, asnum, ep->desc.bEndpointAddress); 150 ep->ss_ep_comp.bmAttributes = 2; 151 } 152 153 if (usb_endpoint_xfer_isoc(&ep->desc)) 154 max_tx = (desc->bMaxBurst + 1) * 155 (USB_SS_MULT(desc->bmAttributes)) * 156 usb_endpoint_maxp(&ep->desc); 157 else if (usb_endpoint_xfer_int(&ep->desc)) 158 max_tx = usb_endpoint_maxp(&ep->desc) * 159 (desc->bMaxBurst + 1); 160 else 161 max_tx = 999999; 162 if (le16_to_cpu(desc->wBytesPerInterval) > max_tx) { 163 dev_warn(ddev, "%s endpoint with wBytesPerInterval of %d in " 164 "config %d interface %d altsetting %d ep %d: " 165 "setting to %d\n", 166 usb_endpoint_xfer_isoc(&ep->desc) ? "Isoc" : "Int", 167 le16_to_cpu(desc->wBytesPerInterval), 168 cfgno, inum, asnum, ep->desc.bEndpointAddress, 169 max_tx); 170 ep->ss_ep_comp.wBytesPerInterval = cpu_to_le16(max_tx); 171 } 172 /* Parse a possible SuperSpeedPlus isoc ep companion descriptor */ 173 if (usb_endpoint_xfer_isoc(&ep->desc) && 174 USB_SS_SSP_ISOC_COMP(desc->bmAttributes)) 175 usb_parse_ssp_isoc_endpoint_companion(ddev, cfgno, inum, asnum, 176 ep, buffer, size); 177 } 178 179 static const unsigned short low_speed_maxpacket_maxes[4] = { 180 [USB_ENDPOINT_XFER_CONTROL] = 8, 181 [USB_ENDPOINT_XFER_ISOC] = 0, 182 [USB_ENDPOINT_XFER_BULK] = 0, 183 [USB_ENDPOINT_XFER_INT] = 8, 184 }; 185 static const unsigned short full_speed_maxpacket_maxes[4] = { 186 [USB_ENDPOINT_XFER_CONTROL] = 64, 187 [USB_ENDPOINT_XFER_ISOC] = 1023, 188 [USB_ENDPOINT_XFER_BULK] = 64, 189 [USB_ENDPOINT_XFER_INT] = 64, 190 }; 191 static const unsigned short high_speed_maxpacket_maxes[4] = { 192 [USB_ENDPOINT_XFER_CONTROL] = 64, 193 [USB_ENDPOINT_XFER_ISOC] = 1024, 194 [USB_ENDPOINT_XFER_BULK] = 512, 195 [USB_ENDPOINT_XFER_INT] = 1024, 196 }; 197 static const unsigned short super_speed_maxpacket_maxes[4] = { 198 [USB_ENDPOINT_XFER_CONTROL] = 512, 199 [USB_ENDPOINT_XFER_ISOC] = 1024, 200 [USB_ENDPOINT_XFER_BULK] = 1024, 201 [USB_ENDPOINT_XFER_INT] = 1024, 202 }; 203 204 static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, 205 int asnum, struct usb_host_interface *ifp, int num_ep, 206 unsigned char *buffer, int size) 207 { 208 unsigned char *buffer0 = buffer; 209 struct usb_endpoint_descriptor *d; 210 struct usb_host_endpoint *endpoint; 211 int n, i, j, retval; 212 unsigned int maxp; 213 const unsigned short *maxpacket_maxes; 214 215 d = (struct usb_endpoint_descriptor *) buffer; 216 buffer += d->bLength; 217 size -= d->bLength; 218 219 if (d->bLength >= USB_DT_ENDPOINT_AUDIO_SIZE) 220 n = USB_DT_ENDPOINT_AUDIO_SIZE; 221 else if (d->bLength >= USB_DT_ENDPOINT_SIZE) 222 n = USB_DT_ENDPOINT_SIZE; 223 else { 224 dev_warn(ddev, "config %d interface %d altsetting %d has an " 225 "invalid endpoint descriptor of length %d, skipping\n", 226 cfgno, inum, asnum, d->bLength); 227 goto skip_to_next_endpoint_or_interface_descriptor; 228 } 229 230 i = d->bEndpointAddress & ~USB_ENDPOINT_DIR_MASK; 231 if (i >= 16 || i == 0) { 232 dev_warn(ddev, "config %d interface %d altsetting %d has an " 233 "invalid endpoint with address 0x%X, skipping\n", 234 cfgno, inum, asnum, d->bEndpointAddress); 235 goto skip_to_next_endpoint_or_interface_descriptor; 236 } 237 238 /* Only store as many endpoints as we have room for */ 239 if (ifp->desc.bNumEndpoints >= num_ep) 240 goto skip_to_next_endpoint_or_interface_descriptor; 241 242 endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; 243 ++ifp->desc.bNumEndpoints; 244 245 memcpy(&endpoint->desc, d, n); 246 INIT_LIST_HEAD(&endpoint->urb_list); 247 248 /* 249 * Fix up bInterval values outside the legal range. 250 * Use 10 or 8 ms if no proper value can be guessed. 251 */ 252 i = 0; /* i = min, j = max, n = default */ 253 j = 255; 254 if (usb_endpoint_xfer_int(d)) { 255 i = 1; 256 switch (to_usb_device(ddev)->speed) { 257 case USB_SPEED_SUPER_PLUS: 258 case USB_SPEED_SUPER: 259 case USB_SPEED_HIGH: 260 /* 261 * Many device manufacturers are using full-speed 262 * bInterval values in high-speed interrupt endpoint 263 * descriptors. Try to fix those and fall back to an 264 * 8-ms default value otherwise. 265 */ 266 n = fls(d->bInterval*8); 267 if (n == 0) 268 n = 7; /* 8 ms = 2^(7-1) uframes */ 269 j = 16; 270 271 /* 272 * Adjust bInterval for quirked devices. 273 * This quirk fixes bIntervals reported in 274 * linear microframes. 275 */ 276 if (to_usb_device(ddev)->quirks & 277 USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL) { 278 n = clamp(fls(d->bInterval), i, j); 279 i = j = n; 280 } 281 break; 282 default: /* USB_SPEED_FULL or _LOW */ 283 /* 284 * For low-speed, 10 ms is the official minimum. 285 * But some "overclocked" devices might want faster 286 * polling so we'll allow it. 287 */ 288 n = 10; 289 break; 290 } 291 } else if (usb_endpoint_xfer_isoc(d)) { 292 i = 1; 293 j = 16; 294 switch (to_usb_device(ddev)->speed) { 295 case USB_SPEED_HIGH: 296 n = 7; /* 8 ms = 2^(7-1) uframes */ 297 break; 298 default: /* USB_SPEED_FULL */ 299 n = 4; /* 8 ms = 2^(4-1) frames */ 300 break; 301 } 302 } 303 if (d->bInterval < i || d->bInterval > j) { 304 dev_warn(ddev, "config %d interface %d altsetting %d " 305 "endpoint 0x%X has an invalid bInterval %d, " 306 "changing to %d\n", 307 cfgno, inum, asnum, 308 d->bEndpointAddress, d->bInterval, n); 309 endpoint->desc.bInterval = n; 310 } 311 312 /* Some buggy low-speed devices have Bulk endpoints, which is 313 * explicitly forbidden by the USB spec. In an attempt to make 314 * them usable, we will try treating them as Interrupt endpoints. 315 */ 316 if (to_usb_device(ddev)->speed == USB_SPEED_LOW && 317 usb_endpoint_xfer_bulk(d)) { 318 dev_warn(ddev, "config %d interface %d altsetting %d " 319 "endpoint 0x%X is Bulk; changing to Interrupt\n", 320 cfgno, inum, asnum, d->bEndpointAddress); 321 endpoint->desc.bmAttributes = USB_ENDPOINT_XFER_INT; 322 endpoint->desc.bInterval = 1; 323 if (usb_endpoint_maxp(&endpoint->desc) > 8) 324 endpoint->desc.wMaxPacketSize = cpu_to_le16(8); 325 } 326 327 /* Validate the wMaxPacketSize field */ 328 maxp = usb_endpoint_maxp(&endpoint->desc); 329 330 /* Find the highest legal maxpacket size for this endpoint */ 331 i = 0; /* additional transactions per microframe */ 332 switch (to_usb_device(ddev)->speed) { 333 case USB_SPEED_LOW: 334 maxpacket_maxes = low_speed_maxpacket_maxes; 335 break; 336 case USB_SPEED_FULL: 337 maxpacket_maxes = full_speed_maxpacket_maxes; 338 break; 339 case USB_SPEED_HIGH: 340 /* Bits 12..11 are allowed only for HS periodic endpoints */ 341 if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) { 342 i = maxp & (BIT(12) | BIT(11)); 343 maxp &= ~i; 344 } 345 /* fallthrough */ 346 default: 347 maxpacket_maxes = high_speed_maxpacket_maxes; 348 break; 349 case USB_SPEED_SUPER: 350 case USB_SPEED_SUPER_PLUS: 351 maxpacket_maxes = super_speed_maxpacket_maxes; 352 break; 353 } 354 j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)]; 355 356 if (maxp > j) { 357 dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n", 358 cfgno, inum, asnum, d->bEndpointAddress, maxp, j); 359 maxp = j; 360 endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp); 361 } 362 363 /* 364 * Some buggy high speed devices have bulk endpoints using 365 * maxpacket sizes other than 512. High speed HCDs may not 366 * be able to handle that particular bug, so let's warn... 367 */ 368 if (to_usb_device(ddev)->speed == USB_SPEED_HIGH 369 && usb_endpoint_xfer_bulk(d)) { 370 if (maxp != 512) 371 dev_warn(ddev, "config %d interface %d altsetting %d " 372 "bulk endpoint 0x%X has invalid maxpacket %d\n", 373 cfgno, inum, asnum, d->bEndpointAddress, 374 maxp); 375 } 376 377 /* Parse a possible SuperSpeed endpoint companion descriptor */ 378 if (to_usb_device(ddev)->speed >= USB_SPEED_SUPER) 379 usb_parse_ss_endpoint_companion(ddev, cfgno, 380 inum, asnum, endpoint, buffer, size); 381 382 /* Skip over any Class Specific or Vendor Specific descriptors; 383 * find the next endpoint or interface descriptor */ 384 endpoint->extra = buffer; 385 i = find_next_descriptor(buffer, size, USB_DT_ENDPOINT, 386 USB_DT_INTERFACE, &n); 387 endpoint->extralen = i; 388 retval = buffer - buffer0 + i; 389 if (n > 0) 390 dev_dbg(ddev, "skipped %d descriptor%s after %s\n", 391 n, plural(n), "endpoint"); 392 return retval; 393 394 skip_to_next_endpoint_or_interface_descriptor: 395 i = find_next_descriptor(buffer, size, USB_DT_ENDPOINT, 396 USB_DT_INTERFACE, NULL); 397 return buffer - buffer0 + i; 398 } 399 400 void usb_release_interface_cache(struct kref *ref) 401 { 402 struct usb_interface_cache *intfc = ref_to_usb_interface_cache(ref); 403 int j; 404 405 for (j = 0; j < intfc->num_altsetting; j++) { 406 struct usb_host_interface *alt = &intfc->altsetting[j]; 407 408 kfree(alt->endpoint); 409 kfree(alt->string); 410 } 411 kfree(intfc); 412 } 413 414 static int usb_parse_interface(struct device *ddev, int cfgno, 415 struct usb_host_config *config, unsigned char *buffer, int size, 416 u8 inums[], u8 nalts[]) 417 { 418 unsigned char *buffer0 = buffer; 419 struct usb_interface_descriptor *d; 420 int inum, asnum; 421 struct usb_interface_cache *intfc; 422 struct usb_host_interface *alt; 423 int i, n; 424 int len, retval; 425 int num_ep, num_ep_orig; 426 427 d = (struct usb_interface_descriptor *) buffer; 428 buffer += d->bLength; 429 size -= d->bLength; 430 431 if (d->bLength < USB_DT_INTERFACE_SIZE) 432 goto skip_to_next_interface_descriptor; 433 434 /* Which interface entry is this? */ 435 intfc = NULL; 436 inum = d->bInterfaceNumber; 437 for (i = 0; i < config->desc.bNumInterfaces; ++i) { 438 if (inums[i] == inum) { 439 intfc = config->intf_cache[i]; 440 break; 441 } 442 } 443 if (!intfc || intfc->num_altsetting >= nalts[i]) 444 goto skip_to_next_interface_descriptor; 445 446 /* Check for duplicate altsetting entries */ 447 asnum = d->bAlternateSetting; 448 for ((i = 0, alt = &intfc->altsetting[0]); 449 i < intfc->num_altsetting; 450 (++i, ++alt)) { 451 if (alt->desc.bAlternateSetting == asnum) { 452 dev_warn(ddev, "Duplicate descriptor for config %d " 453 "interface %d altsetting %d, skipping\n", 454 cfgno, inum, asnum); 455 goto skip_to_next_interface_descriptor; 456 } 457 } 458 459 ++intfc->num_altsetting; 460 memcpy(&alt->desc, d, USB_DT_INTERFACE_SIZE); 461 462 /* Skip over any Class Specific or Vendor Specific descriptors; 463 * find the first endpoint or interface descriptor */ 464 alt->extra = buffer; 465 i = find_next_descriptor(buffer, size, USB_DT_ENDPOINT, 466 USB_DT_INTERFACE, &n); 467 alt->extralen = i; 468 if (n > 0) 469 dev_dbg(ddev, "skipped %d descriptor%s after %s\n", 470 n, plural(n), "interface"); 471 buffer += i; 472 size -= i; 473 474 /* Allocate space for the right(?) number of endpoints */ 475 num_ep = num_ep_orig = alt->desc.bNumEndpoints; 476 alt->desc.bNumEndpoints = 0; /* Use as a counter */ 477 if (num_ep > USB_MAXENDPOINTS) { 478 dev_warn(ddev, "too many endpoints for config %d interface %d " 479 "altsetting %d: %d, using maximum allowed: %d\n", 480 cfgno, inum, asnum, num_ep, USB_MAXENDPOINTS); 481 num_ep = USB_MAXENDPOINTS; 482 } 483 484 if (num_ep > 0) { 485 /* Can't allocate 0 bytes */ 486 len = sizeof(struct usb_host_endpoint) * num_ep; 487 alt->endpoint = kzalloc(len, GFP_KERNEL); 488 if (!alt->endpoint) 489 return -ENOMEM; 490 } 491 492 /* Parse all the endpoint descriptors */ 493 n = 0; 494 while (size > 0) { 495 if (((struct usb_descriptor_header *) buffer)->bDescriptorType 496 == USB_DT_INTERFACE) 497 break; 498 retval = usb_parse_endpoint(ddev, cfgno, inum, asnum, alt, 499 num_ep, buffer, size); 500 if (retval < 0) 501 return retval; 502 ++n; 503 504 buffer += retval; 505 size -= retval; 506 } 507 508 if (n != num_ep_orig) 509 dev_warn(ddev, "config %d interface %d altsetting %d has %d " 510 "endpoint descriptor%s, different from the interface " 511 "descriptor's value: %d\n", 512 cfgno, inum, asnum, n, plural(n), num_ep_orig); 513 return buffer - buffer0; 514 515 skip_to_next_interface_descriptor: 516 i = find_next_descriptor(buffer, size, USB_DT_INTERFACE, 517 USB_DT_INTERFACE, NULL); 518 return buffer - buffer0 + i; 519 } 520 521 static int usb_parse_configuration(struct usb_device *dev, int cfgidx, 522 struct usb_host_config *config, unsigned char *buffer, int size) 523 { 524 struct device *ddev = &dev->dev; 525 unsigned char *buffer0 = buffer; 526 int cfgno; 527 int nintf, nintf_orig; 528 int i, j, n; 529 struct usb_interface_cache *intfc; 530 unsigned char *buffer2; 531 int size2; 532 struct usb_descriptor_header *header; 533 int len, retval; 534 u8 inums[USB_MAXINTERFACES], nalts[USB_MAXINTERFACES]; 535 unsigned iad_num = 0; 536 537 memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE); 538 if (config->desc.bDescriptorType != USB_DT_CONFIG || 539 config->desc.bLength < USB_DT_CONFIG_SIZE || 540 config->desc.bLength > size) { 541 dev_err(ddev, "invalid descriptor for config index %d: " 542 "type = 0x%X, length = %d\n", cfgidx, 543 config->desc.bDescriptorType, config->desc.bLength); 544 return -EINVAL; 545 } 546 cfgno = config->desc.bConfigurationValue; 547 548 buffer += config->desc.bLength; 549 size -= config->desc.bLength; 550 551 nintf = nintf_orig = config->desc.bNumInterfaces; 552 if (nintf > USB_MAXINTERFACES) { 553 dev_warn(ddev, "config %d has too many interfaces: %d, " 554 "using maximum allowed: %d\n", 555 cfgno, nintf, USB_MAXINTERFACES); 556 nintf = USB_MAXINTERFACES; 557 } 558 559 /* Go through the descriptors, checking their length and counting the 560 * number of altsettings for each interface */ 561 n = 0; 562 for ((buffer2 = buffer, size2 = size); 563 size2 > 0; 564 (buffer2 += header->bLength, size2 -= header->bLength)) { 565 566 if (size2 < sizeof(struct usb_descriptor_header)) { 567 dev_warn(ddev, "config %d descriptor has %d excess " 568 "byte%s, ignoring\n", 569 cfgno, size2, plural(size2)); 570 break; 571 } 572 573 header = (struct usb_descriptor_header *) buffer2; 574 if ((header->bLength > size2) || (header->bLength < 2)) { 575 dev_warn(ddev, "config %d has an invalid descriptor " 576 "of length %d, skipping remainder of the config\n", 577 cfgno, header->bLength); 578 break; 579 } 580 581 if (header->bDescriptorType == USB_DT_INTERFACE) { 582 struct usb_interface_descriptor *d; 583 int inum; 584 585 d = (struct usb_interface_descriptor *) header; 586 if (d->bLength < USB_DT_INTERFACE_SIZE) { 587 dev_warn(ddev, "config %d has an invalid " 588 "interface descriptor of length %d, " 589 "skipping\n", cfgno, d->bLength); 590 continue; 591 } 592 593 inum = d->bInterfaceNumber; 594 595 if ((dev->quirks & USB_QUIRK_HONOR_BNUMINTERFACES) && 596 n >= nintf_orig) { 597 dev_warn(ddev, "config %d has more interface " 598 "descriptors, than it declares in " 599 "bNumInterfaces, ignoring interface " 600 "number: %d\n", cfgno, inum); 601 continue; 602 } 603 604 if (inum >= nintf_orig) 605 dev_warn(ddev, "config %d has an invalid " 606 "interface number: %d but max is %d\n", 607 cfgno, inum, nintf_orig - 1); 608 609 /* Have we already encountered this interface? 610 * Count its altsettings */ 611 for (i = 0; i < n; ++i) { 612 if (inums[i] == inum) 613 break; 614 } 615 if (i < n) { 616 if (nalts[i] < 255) 617 ++nalts[i]; 618 } else if (n < USB_MAXINTERFACES) { 619 inums[n] = inum; 620 nalts[n] = 1; 621 ++n; 622 } 623 624 } else if (header->bDescriptorType == 625 USB_DT_INTERFACE_ASSOCIATION) { 626 if (iad_num == USB_MAXIADS) { 627 dev_warn(ddev, "found more Interface " 628 "Association Descriptors " 629 "than allocated for in " 630 "configuration %d\n", cfgno); 631 } else { 632 config->intf_assoc[iad_num] = 633 (struct usb_interface_assoc_descriptor 634 *)header; 635 iad_num++; 636 } 637 638 } else if (header->bDescriptorType == USB_DT_DEVICE || 639 header->bDescriptorType == USB_DT_CONFIG) 640 dev_warn(ddev, "config %d contains an unexpected " 641 "descriptor of type 0x%X, skipping\n", 642 cfgno, header->bDescriptorType); 643 644 } /* for ((buffer2 = buffer, size2 = size); ...) */ 645 size = buffer2 - buffer; 646 config->desc.wTotalLength = cpu_to_le16(buffer2 - buffer0); 647 648 if (n != nintf) 649 dev_warn(ddev, "config %d has %d interface%s, different from " 650 "the descriptor's value: %d\n", 651 cfgno, n, plural(n), nintf_orig); 652 else if (n == 0) 653 dev_warn(ddev, "config %d has no interfaces?\n", cfgno); 654 config->desc.bNumInterfaces = nintf = n; 655 656 /* Check for missing interface numbers */ 657 for (i = 0; i < nintf; ++i) { 658 for (j = 0; j < nintf; ++j) { 659 if (inums[j] == i) 660 break; 661 } 662 if (j >= nintf) 663 dev_warn(ddev, "config %d has no interface number " 664 "%d\n", cfgno, i); 665 } 666 667 /* Allocate the usb_interface_caches and altsetting arrays */ 668 for (i = 0; i < nintf; ++i) { 669 j = nalts[i]; 670 if (j > USB_MAXALTSETTING) { 671 dev_warn(ddev, "too many alternate settings for " 672 "config %d interface %d: %d, " 673 "using maximum allowed: %d\n", 674 cfgno, inums[i], j, USB_MAXALTSETTING); 675 nalts[i] = j = USB_MAXALTSETTING; 676 } 677 678 len = sizeof(*intfc) + sizeof(struct usb_host_interface) * j; 679 config->intf_cache[i] = intfc = kzalloc(len, GFP_KERNEL); 680 if (!intfc) 681 return -ENOMEM; 682 kref_init(&intfc->ref); 683 } 684 685 /* FIXME: parse the BOS descriptor */ 686 687 /* Skip over any Class Specific or Vendor Specific descriptors; 688 * find the first interface descriptor */ 689 config->extra = buffer; 690 i = find_next_descriptor(buffer, size, USB_DT_INTERFACE, 691 USB_DT_INTERFACE, &n); 692 config->extralen = i; 693 if (n > 0) 694 dev_dbg(ddev, "skipped %d descriptor%s after %s\n", 695 n, plural(n), "configuration"); 696 buffer += i; 697 size -= i; 698 699 /* Parse all the interface/altsetting descriptors */ 700 while (size > 0) { 701 retval = usb_parse_interface(ddev, cfgno, config, 702 buffer, size, inums, nalts); 703 if (retval < 0) 704 return retval; 705 706 buffer += retval; 707 size -= retval; 708 } 709 710 /* Check for missing altsettings */ 711 for (i = 0; i < nintf; ++i) { 712 intfc = config->intf_cache[i]; 713 for (j = 0; j < intfc->num_altsetting; ++j) { 714 for (n = 0; n < intfc->num_altsetting; ++n) { 715 if (intfc->altsetting[n].desc. 716 bAlternateSetting == j) 717 break; 718 } 719 if (n >= intfc->num_altsetting) 720 dev_warn(ddev, "config %d interface %d has no " 721 "altsetting %d\n", cfgno, inums[i], j); 722 } 723 } 724 725 return 0; 726 } 727 728 /* hub-only!! ... and only exported for reset/reinit path. 729 * otherwise used internally on disconnect/destroy path 730 */ 731 void usb_destroy_configuration(struct usb_device *dev) 732 { 733 int c, i; 734 735 if (!dev->config) 736 return; 737 738 if (dev->rawdescriptors) { 739 for (i = 0; i < dev->descriptor.bNumConfigurations; i++) 740 kfree(dev->rawdescriptors[i]); 741 742 kfree(dev->rawdescriptors); 743 dev->rawdescriptors = NULL; 744 } 745 746 for (c = 0; c < dev->descriptor.bNumConfigurations; c++) { 747 struct usb_host_config *cf = &dev->config[c]; 748 749 kfree(cf->string); 750 for (i = 0; i < cf->desc.bNumInterfaces; i++) { 751 if (cf->intf_cache[i]) 752 kref_put(&cf->intf_cache[i]->ref, 753 usb_release_interface_cache); 754 } 755 } 756 kfree(dev->config); 757 dev->config = NULL; 758 } 759 760 761 /* 762 * Get the USB config descriptors, cache and parse'em 763 * 764 * hub-only!! ... and only in reset path, or usb_new_device() 765 * (used by real hubs and virtual root hubs) 766 */ 767 int usb_get_configuration(struct usb_device *dev) 768 { 769 struct device *ddev = &dev->dev; 770 int ncfg = dev->descriptor.bNumConfigurations; 771 int result = 0; 772 unsigned int cfgno, length; 773 unsigned char *bigbuffer; 774 struct usb_config_descriptor *desc; 775 776 cfgno = 0; 777 result = -ENOMEM; 778 if (ncfg > USB_MAXCONFIG) { 779 dev_warn(ddev, "too many configurations: %d, " 780 "using maximum allowed: %d\n", ncfg, USB_MAXCONFIG); 781 dev->descriptor.bNumConfigurations = ncfg = USB_MAXCONFIG; 782 } 783 784 if (ncfg < 1) { 785 dev_err(ddev, "no configurations\n"); 786 return -EINVAL; 787 } 788 789 length = ncfg * sizeof(struct usb_host_config); 790 dev->config = kzalloc(length, GFP_KERNEL); 791 if (!dev->config) 792 goto err2; 793 794 length = ncfg * sizeof(char *); 795 dev->rawdescriptors = kzalloc(length, GFP_KERNEL); 796 if (!dev->rawdescriptors) 797 goto err2; 798 799 desc = kmalloc(USB_DT_CONFIG_SIZE, GFP_KERNEL); 800 if (!desc) 801 goto err2; 802 803 result = 0; 804 for (; cfgno < ncfg; cfgno++) { 805 /* We grab just the first descriptor so we know how long 806 * the whole configuration is */ 807 result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, 808 desc, USB_DT_CONFIG_SIZE); 809 if (result < 0) { 810 dev_err(ddev, "unable to read config index %d " 811 "descriptor/%s: %d\n", cfgno, "start", result); 812 if (result != -EPIPE) 813 goto err; 814 dev_err(ddev, "chopping to %d config(s)\n", cfgno); 815 dev->descriptor.bNumConfigurations = cfgno; 816 break; 817 } else if (result < 4) { 818 dev_err(ddev, "config index %d descriptor too short " 819 "(expected %i, got %i)\n", cfgno, 820 USB_DT_CONFIG_SIZE, result); 821 result = -EINVAL; 822 goto err; 823 } 824 length = max((int) le16_to_cpu(desc->wTotalLength), 825 USB_DT_CONFIG_SIZE); 826 827 /* Now that we know the length, get the whole thing */ 828 bigbuffer = kmalloc(length, GFP_KERNEL); 829 if (!bigbuffer) { 830 result = -ENOMEM; 831 goto err; 832 } 833 834 if (dev->quirks & USB_QUIRK_DELAY_INIT) 835 msleep(100); 836 837 result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, 838 bigbuffer, length); 839 if (result < 0) { 840 dev_err(ddev, "unable to read config index %d " 841 "descriptor/%s\n", cfgno, "all"); 842 kfree(bigbuffer); 843 goto err; 844 } 845 if (result < length) { 846 dev_warn(ddev, "config index %d descriptor too short " 847 "(expected %i, got %i)\n", cfgno, length, result); 848 length = result; 849 } 850 851 dev->rawdescriptors[cfgno] = bigbuffer; 852 853 result = usb_parse_configuration(dev, cfgno, 854 &dev->config[cfgno], bigbuffer, length); 855 if (result < 0) { 856 ++cfgno; 857 goto err; 858 } 859 } 860 result = 0; 861 862 err: 863 kfree(desc); 864 dev->descriptor.bNumConfigurations = cfgno; 865 err2: 866 if (result == -ENOMEM) 867 dev_err(ddev, "out of memory\n"); 868 return result; 869 } 870 871 void usb_release_bos_descriptor(struct usb_device *dev) 872 { 873 if (dev->bos) { 874 kfree(dev->bos->desc); 875 kfree(dev->bos); 876 dev->bos = NULL; 877 } 878 } 879 880 /* Get BOS descriptor set */ 881 int usb_get_bos_descriptor(struct usb_device *dev) 882 { 883 struct device *ddev = &dev->dev; 884 struct usb_bos_descriptor *bos; 885 struct usb_dev_cap_header *cap; 886 unsigned char *buffer; 887 int length, total_len, num, i; 888 int ret; 889 890 bos = kzalloc(sizeof(struct usb_bos_descriptor), GFP_KERNEL); 891 if (!bos) 892 return -ENOMEM; 893 894 /* Get BOS descriptor */ 895 ret = usb_get_descriptor(dev, USB_DT_BOS, 0, bos, USB_DT_BOS_SIZE); 896 if (ret < USB_DT_BOS_SIZE) { 897 dev_err(ddev, "unable to get BOS descriptor\n"); 898 if (ret >= 0) 899 ret = -ENOMSG; 900 kfree(bos); 901 return ret; 902 } 903 904 length = bos->bLength; 905 total_len = le16_to_cpu(bos->wTotalLength); 906 num = bos->bNumDeviceCaps; 907 kfree(bos); 908 if (total_len < length) 909 return -EINVAL; 910 911 dev->bos = kzalloc(sizeof(struct usb_host_bos), GFP_KERNEL); 912 if (!dev->bos) 913 return -ENOMEM; 914 915 /* Now let's get the whole BOS descriptor set */ 916 buffer = kzalloc(total_len, GFP_KERNEL); 917 if (!buffer) { 918 ret = -ENOMEM; 919 goto err; 920 } 921 dev->bos->desc = (struct usb_bos_descriptor *)buffer; 922 923 ret = usb_get_descriptor(dev, USB_DT_BOS, 0, buffer, total_len); 924 if (ret < total_len) { 925 dev_err(ddev, "unable to get BOS descriptor set\n"); 926 if (ret >= 0) 927 ret = -ENOMSG; 928 goto err; 929 } 930 total_len -= length; 931 932 for (i = 0; i < num; i++) { 933 buffer += length; 934 cap = (struct usb_dev_cap_header *)buffer; 935 length = cap->bLength; 936 937 if (total_len < length) 938 break; 939 total_len -= length; 940 941 if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) { 942 dev_warn(ddev, "descriptor type invalid, skip\n"); 943 continue; 944 } 945 946 switch (cap->bDevCapabilityType) { 947 case USB_CAP_TYPE_WIRELESS_USB: 948 /* Wireless USB cap descriptor is handled by wusb */ 949 break; 950 case USB_CAP_TYPE_EXT: 951 dev->bos->ext_cap = 952 (struct usb_ext_cap_descriptor *)buffer; 953 break; 954 case USB_SS_CAP_TYPE: 955 dev->bos->ss_cap = 956 (struct usb_ss_cap_descriptor *)buffer; 957 break; 958 case USB_SSP_CAP_TYPE: 959 dev->bos->ssp_cap = 960 (struct usb_ssp_cap_descriptor *)buffer; 961 break; 962 case CONTAINER_ID_TYPE: 963 dev->bos->ss_id = 964 (struct usb_ss_container_id_descriptor *)buffer; 965 break; 966 case USB_PTM_CAP_TYPE: 967 dev->bos->ptm_cap = 968 (struct usb_ptm_cap_descriptor *)buffer; 969 default: 970 break; 971 } 972 } 973 974 return 0; 975 976 err: 977 usb_release_bos_descriptor(dev); 978 return ret; 979 } 980