1 /* $FreeBSD$ */
2 /*-
3 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4 *
5 * Copyright (c) 2008 Hans Petter Selasky. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #ifdef USB_GLOBAL_INCLUDE_FILE
30 #include USB_GLOBAL_INCLUDE_FILE
31 #else
32 #include <sys/stdint.h>
33 #include <sys/stddef.h>
34 #include <sys/param.h>
35 #include <sys/queue.h>
36 #include <sys/types.h>
37 #include <sys/systm.h>
38 #include <sys/kernel.h>
39 #include <sys/bus.h>
40 #include <sys/module.h>
41 #include <sys/lock.h>
42 #include <sys/mutex.h>
43 #include <sys/condvar.h>
44 #include <sys/sysctl.h>
45 #include <sys/sx.h>
46 #include <sys/unistd.h>
47 #include <sys/callout.h>
48 #include <sys/malloc.h>
49 #include <sys/priv.h>
50
51 #include <dev/usb/usb.h>
52 #include <dev/usb/usbdi.h>
53 #include <dev/usb/usbdi_util.h>
54
55 #define USB_DEBUG_VAR usb_debug
56
57 #include <dev/usb/usb_core.h>
58 #include <dev/usb/usb_debug.h>
59 #endif /* USB_GLOBAL_INCLUDE_FILE */
60
61 /*------------------------------------------------------------------------*
62 * usb_desc_foreach
63 *
64 * This function is the safe way to iterate across the USB config
65 * descriptor. It contains several checks against invalid
66 * descriptors. If the "desc" argument passed to this function is
67 * "NULL" the first descriptor, if any, will be returned.
68 *
69 * Return values:
70 * NULL: End of descriptors
71 * Else: Next descriptor after "desc"
72 *------------------------------------------------------------------------*/
73 struct usb_descriptor *
usb_desc_foreach(struct usb_config_descriptor * cd,struct usb_descriptor * _desc)74 usb_desc_foreach(struct usb_config_descriptor *cd,
75 struct usb_descriptor *_desc)
76 {
77 uint8_t *desc_next;
78 uint8_t *start;
79 uint8_t *end;
80 uint8_t *desc;
81
82 /* be NULL safe */
83 if (cd == NULL)
84 return (NULL);
85
86 /* We assume that the "wTotalLength" has been checked. */
87 start = (uint8_t *)cd;
88 end = start + UGETW(cd->wTotalLength);
89 desc = (uint8_t *)_desc;
90
91 /* Get start of next USB descriptor. */
92 if (desc == NULL)
93 desc = start;
94 else
95 desc = desc + desc[0];
96
97 /* Check that the next USB descriptor is within the range. */
98 if ((desc < start) || (desc >= end))
99 return (NULL); /* out of range, or EOD */
100
101 /* Check that the second next USB descriptor is within range. */
102 desc_next = desc + desc[0];
103 if ((desc_next < start) || (desc_next > end))
104 return (NULL); /* out of range */
105
106 /* Check minimum descriptor length. */
107 if (desc[0] < 3)
108 return (NULL); /* too short descriptor */
109
110 /* Return start of next descriptor. */
111 return ((struct usb_descriptor *)desc);
112 }
113
114 /*------------------------------------------------------------------------*
115 * usb_idesc_foreach
116 *
117 * This function will iterate the interface descriptors in the config
118 * descriptor. The parse state structure should be zeroed before
119 * calling this function the first time.
120 *
121 * Return values:
122 * NULL: End of descriptors
123 * Else: A valid interface descriptor
124 *------------------------------------------------------------------------*/
125 struct usb_interface_descriptor *
usb_idesc_foreach(struct usb_config_descriptor * cd,struct usb_idesc_parse_state * ps)126 usb_idesc_foreach(struct usb_config_descriptor *cd,
127 struct usb_idesc_parse_state *ps)
128 {
129 struct usb_interface_descriptor *id;
130 uint8_t new_iface;
131
132 /* retrieve current descriptor */
133 id = (struct usb_interface_descriptor *)ps->desc;
134 /* default is to start a new interface */
135 new_iface = 1;
136
137 while (1) {
138 id = (struct usb_interface_descriptor *)
139 usb_desc_foreach(cd, (struct usb_descriptor *)id);
140 if (id == NULL)
141 break;
142 if ((id->bDescriptorType == UDESC_INTERFACE) &&
143 (id->bLength >= sizeof(*id))) {
144 if (ps->iface_no_last == id->bInterfaceNumber)
145 new_iface = 0;
146 ps->iface_no_last = id->bInterfaceNumber;
147 break;
148 }
149 }
150
151 if (ps->desc == NULL) {
152 /* first time or zero descriptors */
153 } else if (new_iface) {
154 /* new interface */
155 ps->iface_index ++;
156 ps->iface_index_alt = 0;
157 } else {
158 /* new alternate interface */
159 ps->iface_index_alt ++;
160 }
161 #if (USB_IFACE_MAX <= 0)
162 #error "USB_IFACE_MAX must be defined greater than zero"
163 #endif
164 /* check for too many interfaces */
165 if (ps->iface_index >= USB_IFACE_MAX) {
166 DPRINTF("Interface limit reached\n");
167 id = NULL;
168 }
169
170 /* store and return current descriptor */
171 ps->desc = (struct usb_descriptor *)id;
172 return (id);
173 }
174
175 /*------------------------------------------------------------------------*
176 * usb_edesc_foreach
177 *
178 * This function will iterate all the endpoint descriptors within an
179 * interface descriptor. Starting value for the "ped" argument should
180 * be a valid interface descriptor.
181 *
182 * Return values:
183 * NULL: End of descriptors
184 * Else: A valid endpoint descriptor
185 *------------------------------------------------------------------------*/
186 struct usb_endpoint_descriptor *
usb_edesc_foreach(struct usb_config_descriptor * cd,struct usb_endpoint_descriptor * ped)187 usb_edesc_foreach(struct usb_config_descriptor *cd,
188 struct usb_endpoint_descriptor *ped)
189 {
190 struct usb_descriptor *desc;
191
192 desc = ((struct usb_descriptor *)ped);
193
194 while ((desc = usb_desc_foreach(cd, desc))) {
195 if (desc->bDescriptorType == UDESC_INTERFACE) {
196 break;
197 }
198 if (desc->bDescriptorType == UDESC_ENDPOINT) {
199 if (desc->bLength < sizeof(*ped)) {
200 /* endpoint descriptor is invalid */
201 break;
202 }
203 return ((struct usb_endpoint_descriptor *)desc);
204 }
205 }
206 return (NULL);
207 }
208
209 /*------------------------------------------------------------------------*
210 * usb_ed_comp_foreach
211 *
212 * This function will iterate all the endpoint companion descriptors
213 * within an endpoint descriptor in an interface descriptor. Starting
214 * value for the "ped" argument should be a valid endpoint companion
215 * descriptor.
216 *
217 * Return values:
218 * NULL: End of descriptors
219 * Else: A valid endpoint companion descriptor
220 *------------------------------------------------------------------------*/
221 struct usb_endpoint_ss_comp_descriptor *
usb_ed_comp_foreach(struct usb_config_descriptor * cd,struct usb_endpoint_ss_comp_descriptor * ped)222 usb_ed_comp_foreach(struct usb_config_descriptor *cd,
223 struct usb_endpoint_ss_comp_descriptor *ped)
224 {
225 struct usb_descriptor *desc;
226
227 desc = ((struct usb_descriptor *)ped);
228
229 while ((desc = usb_desc_foreach(cd, desc))) {
230 if (desc->bDescriptorType == UDESC_INTERFACE)
231 break;
232 if (desc->bDescriptorType == UDESC_ENDPOINT)
233 break;
234 if (desc->bDescriptorType == UDESC_ENDPOINT_SS_COMP) {
235 if (desc->bLength < sizeof(*ped)) {
236 /* endpoint companion descriptor is invalid */
237 break;
238 }
239 return ((struct usb_endpoint_ss_comp_descriptor *)desc);
240 }
241 }
242 return (NULL);
243 }
244
245 /*------------------------------------------------------------------------*
246 * usbd_get_no_descriptors
247 *
248 * This function will count the total number of descriptors in the
249 * configuration descriptor of type "type".
250 *------------------------------------------------------------------------*/
251 uint8_t
usbd_get_no_descriptors(struct usb_config_descriptor * cd,uint8_t type)252 usbd_get_no_descriptors(struct usb_config_descriptor *cd, uint8_t type)
253 {
254 struct usb_descriptor *desc = NULL;
255 uint8_t count = 0;
256
257 while ((desc = usb_desc_foreach(cd, desc))) {
258 if (desc->bDescriptorType == type) {
259 count++;
260 if (count == 0xFF)
261 break; /* crazy */
262 }
263 }
264 return (count);
265 }
266
267 /*------------------------------------------------------------------------*
268 * usbd_get_no_alts
269 *
270 * Return value:
271 * Number of alternate settings for the given interface descriptor
272 * pointer. If the USB descriptor is corrupt, the returned value can
273 * be greater than the actual number of alternate settings.
274 *------------------------------------------------------------------------*/
275 uint8_t
usbd_get_no_alts(struct usb_config_descriptor * cd,struct usb_interface_descriptor * id)276 usbd_get_no_alts(struct usb_config_descriptor *cd,
277 struct usb_interface_descriptor *id)
278 {
279 struct usb_descriptor *desc;
280 uint8_t n;
281 uint8_t ifaceno;
282
283 /* Reset interface count */
284
285 n = 0;
286
287 /* Get the interface number */
288
289 ifaceno = id->bInterfaceNumber;
290
291 /* Iterate all the USB descriptors */
292
293 desc = NULL;
294 while ((desc = usb_desc_foreach(cd, desc))) {
295 if ((desc->bDescriptorType == UDESC_INTERFACE) &&
296 (desc->bLength >= sizeof(*id))) {
297 id = (struct usb_interface_descriptor *)desc;
298 if (id->bInterfaceNumber == ifaceno) {
299 n++;
300 if (n == 0xFF)
301 break; /* crazy */
302 }
303 }
304 }
305 return (n);
306 }
307