Bug Summary

File:dev/usb/usb_subr.c
Warning:line 980, column 30
Array access (via field 'subdevs') results in a null pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name usb_subr.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -target-feature +retpoline-external-thunk -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/legacy-dpm -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu13 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/inc -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc/pmfw_if -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D SUSPEND -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-110808-61670-1 -x c /usr/src/sys/dev/usb/usb_subr.c
1/* $OpenBSD: usb_subr.c,v 1.162 2023/10/06 16:06:11 krw Exp $ */
2/* $NetBSD: usb_subr.c,v 1.103 2003/01/10 11:19:13 augustss Exp $ */
3/* $FreeBSD: src/sys/dev/usb/usb_subr.c,v 1.18 1999/11/17 22:33:47 n_hibma Exp $ */
4
5/*
6 * Copyright (c) 1998 The NetBSD Foundation, Inc.
7 * All rights reserved.
8 *
9 * This code is derived from software contributed to The NetBSD Foundation
10 * by Lennart Augustsson (lennart@augustsson.net) at
11 * Carlstedt Research & Technology.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
23 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
24 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
25 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
26 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32 * POSSIBILITY OF SUCH DAMAGE.
33 */
34
35#include <sys/param.h>
36#include <sys/systm.h>
37#include <sys/kernel.h>
38#include <sys/malloc.h>
39#include <sys/device.h>
40#include <sys/rwlock.h>
41
42#include <machine/bus.h>
43
44#include <dev/usb/usb.h>
45
46#include <dev/usb/usbdi.h>
47#include <dev/usb/usbdi_util.h>
48#include <dev/usb/usbdivar.h>
49#include <dev/usb/usbdevs.h>
50#include <dev/usb/usb_quirks.h>
51
52#ifdef USB_DEBUG
53#define DPRINTF(x) do { if (usbdebug) printf x; } while (0)
54#define DPRINTFN(n,x) do { if (usbdebug>(n)) printf x; } while (0)
55extern int usbdebug;
56#else
57#define DPRINTF(x)
58#define DPRINTFN(n,x)
59#endif
60
61usbd_status usbd_set_config(struct usbd_device *, int);
62void usbd_devinfo(struct usbd_device *, int, char *, size_t);
63char *usbd_get_string(struct usbd_device *, int, char *, size_t);
64int usbd_getnewaddr(struct usbd_bus *);
65int usbd_print(void *, const char *);
66void usbd_free_iface_data(struct usbd_device *, int);
67int usbd_cache_devinfo(struct usbd_device *);
68usbd_status usbd_probe_and_attach(struct device *,
69 struct usbd_device *, int, int);
70
71int usbd_printBCD(char *cp, size_t len, int bcd);
72void usb_free_device(struct usbd_device *);
73int usbd_parse_idesc(struct usbd_device *, struct usbd_interface *);
74
75#ifdef USBVERBOSE1
76#include <dev/usb/usbdevs_data.h>
77#endif /* USBVERBOSE */
78
79const char * const usbd_error_strs[] = {
80 "NORMAL_COMPLETION",
81 "IN_PROGRESS",
82 "PENDING_REQUESTS",
83 "NOT_STARTED",
84 "INVAL",
85 "NOMEM",
86 "CANCELLED",
87 "BAD_ADDRESS",
88 "IN_USE",
89 "NO_ADDR",
90 "SET_ADDR_FAILED",
91 "NO_POWER",
92 "TOO_DEEP",
93 "IOERROR",
94 "NOT_CONFIGURED",
95 "TIMEOUT",
96 "SHORT_XFER",
97 "STALLED",
98 "INTERRUPTED",
99 "XXX",
100};
101
102const char *
103usbd_errstr(usbd_status err)
104{
105 static char buffer[5];
106
107 if (err < USBD_ERROR_MAX)
108 return (usbd_error_strs[err]);
109 else {
110 snprintf(buffer, sizeof(buffer), "%d", err);
111 return (buffer);
112 }
113}
114
115usbd_status
116usbd_get_string_desc(struct usbd_device *dev, int sindex, int langid,
117 usb_string_descriptor_t *sdesc, int *sizep)
118{
119 usb_device_request_t req;
120 usbd_status err;
121 int actlen;
122
123 req.bmRequestType = UT_READ_DEVICE(0x80 | 0x00 | 0x00);
124 req.bRequest = UR_GET_DESCRIPTOR0x06;
125 USETW2(req.wValue, UDESC_STRING, sindex)((req.wValue)[0] = (u_int8_t)(sindex), (req.wValue)[1] = (u_int8_t
)(0x03));
126 USETW(req.wIndex, langid)(*(u_int16_t *)(req.wIndex) = (langid));
127 USETW(req.wLength, 2)(*(u_int16_t *)(req.wLength) = (2)); /* size and descriptor type first */
128 err = usbd_do_request_flags(dev, &req, sdesc, USBD_SHORT_XFER_OK0x04,
129 &actlen, USBD_DEFAULT_TIMEOUT5000);
130 if (err)
131 return (err);
132
133 if (actlen < 2)
134 return (USBD_SHORT_XFER);
135
136 USETW(req.wLength, sdesc->bLength)(*(u_int16_t *)(req.wLength) = (sdesc->bLength)); /* the whole string */
137 err = usbd_do_request_flags(dev, &req, sdesc, USBD_SHORT_XFER_OK0x04,
138 &actlen, USBD_DEFAULT_TIMEOUT5000);
139 if (err)
140 return (err);
141
142 if (actlen != sdesc->bLength) {
143 DPRINTFN(-1, ("%s: expected %d, got %d\n", __func__,
144 sdesc->bLength, actlen));
145 }
146
147 *sizep = actlen;
148 return (USBD_NORMAL_COMPLETION);
149}
150
151char *
152usbd_get_string(struct usbd_device *dev, int si, char *buf, size_t buflen)
153{
154 int swap = dev->quirks->uq_flags & UQ_SWAP_UNICODE0x00000002;
155 usb_string_descriptor_t us;
156 char *s;
157 int i, n;
158 u_int16_t c;
159 usbd_status err;
160 int size;
161
162 if (si == 0)
163 return (0);
164 if (dev->quirks->uq_flags & UQ_NO_STRINGS0x00000008)
165 return (0);
166 if (dev->langid == USBD_NOLANG(-1)) {
167 /* Set up default language */
168 err = usbd_get_string_desc(dev, USB_LANGUAGE_TABLE0, 0, &us,
169 &size);
170 if (err || size < 4)
171 dev->langid = 0; /* Well, just pick English then */
172 else {
173 /* Pick the first language as the default. */
174 dev->langid = UGETW(us.bString[0])(*(u_int16_t *)(us.bString[0]));
175 }
176 }
177 err = usbd_get_string_desc(dev, si, dev->langid, &us, &size);
178 if (err)
179 return (0);
180 s = buf;
181 n = size / 2 - 1;
182 for (i = 0; i < n && i < buflen ; i++) {
183 c = UGETW(us.bString[i])(*(u_int16_t *)(us.bString[i]));
184 /* Convert from Unicode, handle buggy strings. */
185 if ((c & 0xff00) == 0)
186 *s++ = c;
187 else if ((c & 0x00ff) == 0 && swap)
188 *s++ = c >> 8;
189 else
190 *s++ = '?';
191 }
192 if (buflen > 0)
193 *s++ = 0;
194 return (buf);
195}
196
197static void
198usbd_trim_spaces(char *p)
199{
200 char *q, *e;
201
202 if (p == NULL((void *)0))
203 return;
204 q = e = p;
205 while (*q == ' ') /* skip leading spaces */
206 q++;
207 while ((*p = *q++)) /* copy string */
208 if (*p++ != ' ') /* remember last non-space */
209 e = p;
210 *e = 0; /* kill trailing spaces */
211}
212
213int
214usbd_cache_devinfo(struct usbd_device *dev)
215{
216 usb_device_descriptor_t *udd = &dev->ddesc;
217
218 dev->serial = malloc(USB_MAX_STRING_LEN127, M_USB101, M_NOWAIT0x0002);
219 if (dev->serial == NULL((void *)0))
220 return (ENOMEM12);
221
222 if (usbd_get_string(dev, udd->iSerialNumber, dev->serial, USB_MAX_STRING_LEN127) != NULL((void *)0)) {
223 usbd_trim_spaces(dev->serial);
224 } else {
225 free(dev->serial, M_USB101, USB_MAX_STRING_LEN127);
226 dev->serial = NULL((void *)0);
227 }
228
229 dev->vendor = malloc(USB_MAX_STRING_LEN127, M_USB101, M_NOWAIT0x0002);
230 if (dev->vendor == NULL((void *)0))
231 return (ENOMEM12);
232
233 if (usbd_get_string(dev, udd->iManufacturer, dev->vendor, USB_MAX_STRING_LEN127) != NULL((void *)0)) {
234 usbd_trim_spaces(dev->vendor);
235 } else {
236#ifdef USBVERBOSE1
237 const struct usb_known_vendor *ukv;
238
239 for (ukv = usb_known_vendors; ukv->vendorname != NULL((void *)0); ukv++) {
240 if (ukv->vendor == UGETW(udd->idVendor)(*(u_int16_t *)(udd->idVendor))) {
241 strlcpy(dev->vendor, ukv->vendorname,
242 USB_MAX_STRING_LEN127);
243 break;
244 }
245 }
246 if (ukv->vendorname == NULL((void *)0))
247#endif
248 snprintf(dev->vendor, USB_MAX_STRING_LEN127, "vendor 0x%04x",
249 UGETW(udd->idVendor)(*(u_int16_t *)(udd->idVendor)));
250 }
251
252 dev->product = malloc(USB_MAX_STRING_LEN127, M_USB101, M_NOWAIT0x0002);
253 if (dev->product == NULL((void *)0))
254 return (ENOMEM12);
255
256 if (usbd_get_string(dev, udd->iProduct, dev->product, USB_MAX_STRING_LEN127) != NULL((void *)0)) {
257 usbd_trim_spaces(dev->product);
258 } else {
259#ifdef USBVERBOSE1
260 const struct usb_known_product *ukp;
261
262 for (ukp = usb_known_products; ukp->productname != NULL((void *)0); ukp++) {
263 if (ukp->vendor == UGETW(udd->idVendor)(*(u_int16_t *)(udd->idVendor)) &&
264 (ukp->product == UGETW(udd->idProduct)(*(u_int16_t *)(udd->idProduct)))) {
265 strlcpy(dev->product, ukp->productname,
266 USB_MAX_STRING_LEN127);
267 break;
268 }
269 }
270 if (ukp->productname == NULL((void *)0))
271#endif
272 snprintf(dev->product, USB_MAX_STRING_LEN127, "product 0x%04x",
273 UGETW(udd->idProduct)(*(u_int16_t *)(udd->idProduct)));
274 }
275
276 return (0);
277}
278
279int
280usbd_printBCD(char *cp, size_t len, int bcd)
281{
282 int l;
283
284 l = snprintf(cp, len, "%x.%02x", bcd >> 8, bcd & 0xff);
285 if (l == -1 || len == 0)
286 return (0);
287 if (l >= len)
288 return len - 1;
289 return (l);
290}
291
292void
293usbd_devinfo(struct usbd_device *dev, int showclass, char *base, size_t len)
294{
295 usb_device_descriptor_t *udd = &dev->ddesc;
296 char *cp = base;
297 int bcdDevice, bcdUSB;
298
299 snprintf(cp, len, "\"%s %s\"", dev->vendor, dev->product);
300 cp += strlen(cp);
301 if (showclass) {
302 snprintf(cp, base + len - cp, ", class %d/%d",
303 udd->bDeviceClass, udd->bDeviceSubClass);
304 cp += strlen(cp);
305 }
306 bcdUSB = UGETW(udd->bcdUSB)(*(u_int16_t *)(udd->bcdUSB));
307 bcdDevice = UGETW(udd->bcdDevice)(*(u_int16_t *)(udd->bcdDevice));
308 snprintf(cp, base + len - cp, " rev ");
309 cp += strlen(cp);
310 usbd_printBCD(cp, base + len - cp, bcdUSB);
311 cp += strlen(cp);
312 snprintf(cp, base + len - cp, "/");
313 cp += strlen(cp);
314 usbd_printBCD(cp, base + len - cp, bcdDevice);
315 cp += strlen(cp);
316 snprintf(cp, base + len - cp, " addr %d", dev->address);
317}
318
319/* Delay for a certain number of ms */
320void
321usb_delay_ms(struct usbd_bus *bus, u_int ms)
322{
323 static int usb_delay_wchan;
324
325 if (bus->use_polling || cold)
326 delay((ms+1) * 1000)(*delay_func)((ms+1) * 1000);
327 else
328 tsleep_nsec(&usb_delay_wchan, PRIBIO16, "usbdly",
329 MSEC_TO_NSEC(ms));
330}
331
332/* Delay given a device handle. */
333void
334usbd_delay_ms(struct usbd_device *dev, u_int ms)
335{
336 if (usbd_is_dying(dev))
337 return;
338
339 usb_delay_ms(dev->bus, ms);
340}
341
342usbd_status
343usbd_port_disown_to_1_1(struct usbd_device *dev, int port)
344{
345 usb_port_status_t ps;
346 usbd_status err;
347 int n;
348
349 err = usbd_set_port_feature(dev, port, UHF_PORT_DISOWN_TO_1_130);
350 DPRINTF(("%s: port %d disown request done, error=%s\n", __func__,
351 port, usbd_errstr(err)));
352 if (err)
353 return (err);
354 n = 10;
355 do {
356 /* Wait for device to recover from reset. */
357 usbd_delay_ms(dev, USB_PORT_RESET_DELAY50);
358 err = usbd_get_port_status(dev, port, &ps);
359 if (err) {
360 DPRINTF(("%s: get status failed %d\n", __func__, err));
361 return (err);
362 }
363 /* If the device disappeared, just give up. */
364 if (!(UGETW(ps.wPortStatus)(*(u_int16_t *)(ps.wPortStatus)) & UPS_CURRENT_CONNECT_STATUS0x0001))
365 return (USBD_NORMAL_COMPLETION);
366 } while ((UGETW(ps.wPortChange)(*(u_int16_t *)(ps.wPortChange)) & UPS_C_PORT_RESET0x0010) == 0 && --n > 0);
367 if (n == 0)
368 return (USBD_TIMEOUT);
369
370 return (err);
371}
372
373int
374usbd_reset_port(struct usbd_device *dev, int port)
375{
376 usb_port_status_t ps;
377 int n;
378
379 if (usbd_set_port_feature(dev, port, UHF_PORT_RESET4))
380 return (EIO5);
381 DPRINTF(("%s: port %d reset done\n", __func__, port));
382 n = 10;
383 do {
384 /* Wait for device to recover from reset. */
385 usbd_delay_ms(dev, USB_PORT_RESET_DELAY50);
386 if (usbd_get_port_status(dev, port, &ps)) {
387 DPRINTF(("%s: get status failed\n", __func__));
388 return (EIO5);
389 }
390 /* If the device disappeared, just give up. */
391 if (!(UGETW(ps.wPortStatus)(*(u_int16_t *)(ps.wPortStatus)) & UPS_CURRENT_CONNECT_STATUS0x0001))
392 return (0);
393 } while ((UGETW(ps.wPortChange)(*(u_int16_t *)(ps.wPortChange)) & UPS_C_PORT_RESET0x0010) == 0 && --n > 0);
394
395 /* Clear port reset even if a timeout occurred. */
396 if (usbd_clear_port_feature(dev, port, UHF_C_PORT_RESET20)) {
397 DPRINTF(("%s: clear port feature failed\n", __func__));
398 return (EIO5);
399 }
400
401 if (n == 0)
402 return (ETIMEDOUT60);
403
404 /* Wait for the device to recover from reset. */
405 usbd_delay_ms(dev, USB_PORT_RESET_RECOVERY250);
406 return (0);
407}
408
409usb_interface_descriptor_t *
410usbd_find_idesc(usb_config_descriptor_t *cd, int ifaceno, int altno)
411{
412 char *p = (char *)cd;
413 char *end = p + UGETW(cd->wTotalLength)(*(u_int16_t *)(cd->wTotalLength));
414 usb_interface_descriptor_t *d;
415 int curidx, lastidx, curaidx = 0;
416
417 for (curidx = lastidx = -1; p < end; ) {
418 d = (usb_interface_descriptor_t *)p;
419 DPRINTFN(4,("usbd_find_idesc: ifaceno=%d(%d) altno=%d(%d) "
420 "len=%d type=%d\n",
421 ifaceno, curidx, altno, curaidx,
422 d->bLength, d->bDescriptorType));
423 if (d->bLength == 0) /* bad descriptor */
424 break;
425 p += d->bLength;
426 if (p <= end && d->bDescriptorType == UDESC_INTERFACE0x04) {
427 if (d->bInterfaceNumber != lastidx) {
428 lastidx = d->bInterfaceNumber;
429 curidx++;
430 curaidx = 0;
431 } else
432 curaidx++;
433 if (ifaceno == curidx && altno == curaidx)
434 return (d);
435 }
436 }
437 return (NULL((void *)0));
438}
439
440usb_endpoint_descriptor_t *
441usbd_find_edesc(usb_config_descriptor_t *cd, int ifaceno, int altno,
442 int endptidx)
443{
444 char *p = (char *)cd;
445 char *end = p + UGETW(cd->wTotalLength)(*(u_int16_t *)(cd->wTotalLength));
446 usb_interface_descriptor_t *d;
447 usb_endpoint_descriptor_t *e;
448 int curidx;
449
450 d = usbd_find_idesc(cd, ifaceno, altno);
451 if (d == NULL((void *)0))
452 return (NULL((void *)0));
453 if (endptidx >= d->bNumEndpoints) /* quick exit */
454 return (NULL((void *)0));
455
456 curidx = -1;
457 for (p = (char *)d + d->bLength; p < end; ) {
458 e = (usb_endpoint_descriptor_t *)p;
459 if (e->bLength == 0) /* bad descriptor */
460 break;
461 p += e->bLength;
462 if (p <= end && e->bDescriptorType == UDESC_INTERFACE0x04)
463 return (NULL((void *)0));
464 if (p <= end && e->bDescriptorType == UDESC_ENDPOINT0x05) {
465 curidx++;
466 if (curidx == endptidx)
467 return (e);
468 }
469 }
470 return (NULL((void *)0));
471}
472
473usbd_status
474usbd_fill_iface_data(struct usbd_device *dev, int ifaceno, int altno)
475{
476 struct usbd_interface *ifc = &dev->ifaces[ifaceno];
477 usb_interface_descriptor_t *idesc;
478 int nendpt;
479
480 DPRINTFN(4,("%s: ifaceno=%d altno=%d\n", __func__, ifaceno, altno));
481
482 idesc = usbd_find_idesc(dev->cdesc, ifaceno, altno);
483 if (idesc == NULL((void *)0))
484 return (USBD_INVAL);
485
486 nendpt = idesc->bNumEndpoints;
487 DPRINTFN(4,("%s: found idesc nendpt=%d\n", __func__, nendpt));
488
489 ifc->device = dev;
490 ifc->idesc = idesc;
491 ifc->index = ifaceno;
492 ifc->altindex = altno;
493 ifc->endpoints = NULL((void *)0);
494 ifc->priv = NULL((void *)0);
495 LIST_INIT(&ifc->pipes)do { ((&ifc->pipes)->lh_first) = ((void *)0); } while
(0);
496 ifc->nendpt = nendpt;
497
498 if (nendpt != 0) {
499 ifc->endpoints = mallocarray(nendpt, sizeof(*ifc->endpoints),
500 M_USB101, M_NOWAIT0x0002 | M_ZERO0x0008);
501 if (ifc->endpoints == NULL((void *)0))
502 return (USBD_NOMEM);
503 }
504
505 if (usbd_parse_idesc(dev, ifc)) {
506 free(ifc->endpoints, M_USB101, nendpt * sizeof(*ifc->endpoints));
507 ifc->endpoints = NULL((void *)0);
508 return (USBD_INVAL);
509 }
510
511 return (USBD_NORMAL_COMPLETION);
512}
513
514int
515usbd_parse_idesc(struct usbd_device *dev, struct usbd_interface *ifc)
516{
517#define ed ((usb_endpoint_descriptor_t *)p)
518 char *p, *end;
519 int i;
520
521 p = (char *)ifc->idesc + ifc->idesc->bLength;
522 end = (char *)dev->cdesc + UGETW(dev->cdesc->wTotalLength)(*(u_int16_t *)(dev->cdesc->wTotalLength));
523
524 for (i = 0; i < ifc->idesc->bNumEndpoints; i++) {
525 for (; p < end; p += ed->bLength) {
526 if (p + ed->bLength <= end && ed->bLength != 0 &&
527 ed->bDescriptorType == UDESC_ENDPOINT0x05)
528 break;
529
530 if (ed->bLength == 0 ||
531 ed->bDescriptorType == UDESC_INTERFACE0x04)
532 return (-1);
533 }
534
535 if (p >= end)
536 return (-1);
537
538 if (dev->speed == USB_SPEED_HIGH3) {
539 unsigned int mps;
540
541 /* Control and bulk endpoints have max packet limits. */
542 switch (UE_GET_XFERTYPE(ed->bmAttributes)((ed->bmAttributes) & 0x03)) {
543 case UE_CONTROL0x00:
544 mps = USB_2_MAX_CTRL_PACKET64;
545 goto check;
546 case UE_BULK0x02:
547 mps = USB_2_MAX_BULK_PACKET512;
548 check:
549 if (UGETW(ed->wMaxPacketSize)(*(u_int16_t *)(ed->wMaxPacketSize)) != mps) {
550 USETW(ed->wMaxPacketSize, mps)(*(u_int16_t *)(ed->wMaxPacketSize) = (mps));
551 DPRINTF(("%s: bad max packet size\n",
552 __func__));
553 }
554 break;
555 default:
556 break;
557 }
558 }
559
560 ifc->endpoints[i].edesc = ed;
561 ifc->endpoints[i].refcnt = 0;
562 ifc->endpoints[i].savedtoggle = 0;
563 p += ed->bLength;
564 }
565
566 return (0);
567#undef ed
568}
569
570void
571usbd_free_iface_data(struct usbd_device *dev, int ifcno)
572{
573 struct usbd_interface *ifc = &dev->ifaces[ifcno];
574
575 free(ifc->endpoints, M_USB101, ifc->nendpt * sizeof(*ifc->endpoints));
576 ifc->endpoints = NULL((void *)0);
577}
578
579usbd_status
580usbd_set_config(struct usbd_device *dev, int conf)
581{
582 usb_device_request_t req;
583
584 req.bmRequestType = UT_WRITE_DEVICE(0x00 | 0x00 | 0x00);
585 req.bRequest = UR_SET_CONFIG0x09;
586 USETW(req.wValue, conf)(*(u_int16_t *)(req.wValue) = (conf));
587 USETW(req.wIndex, 0)(*(u_int16_t *)(req.wIndex) = (0));
588 USETW(req.wLength, 0)(*(u_int16_t *)(req.wLength) = (0));
589 return (usbd_do_request(dev, &req, 0));
590}
591
592usbd_status
593usbd_set_config_no(struct usbd_device *dev, int no, int msg)
594{
595 int index;
596 usb_config_descriptor_t cd;
597 usbd_status err;
598
599 DPRINTFN(5,("%s: %d\n", __func__, no));
600 /* Figure out what config index to use. */
601 for (index = 0; index < dev->ddesc.bNumConfigurations; index++) {
602 err = usbd_get_desc(dev, UDESC_CONFIG0x02, index,
603 USB_CONFIG_DESCRIPTOR_SIZE9, &cd);
604 if (err || cd.bDescriptorType != UDESC_CONFIG0x02)
605 return (err);
606 if (cd.bConfigurationValue == no)
607 return (usbd_set_config_index(dev, index, msg));
608 }
609 return (USBD_INVAL);
610}
611
612usbd_status
613usbd_set_config_index(struct usbd_device *dev, int index, int msg)
614{
615 usb_status_t ds;
616 usb_config_descriptor_t cd, *cdp;
617 usbd_status err;
618 int i, ifcidx, nifc, cdplen, selfpowered, power;
619
620 DPRINTFN(5,("%s: dev=%p index=%d\n", __func__, dev, index));
621
622 /* XXX check that all interfaces are idle */
623 if (dev->config != USB_UNCONFIG_NO0) {
40
←
Assuming field 'config' is equal to USB_UNCONFIG_NO
→
41
←
Taking false branch
→
624 DPRINTF(("%s: free old config\n", __func__));
625 /* Free all configuration data structures. */
626 nifc = dev->cdesc->bNumInterfaces;
627 for (ifcidx = 0; ifcidx < nifc; ifcidx++)
628 usbd_free_iface_data(dev, ifcidx);
629 free(dev->ifaces, M_USB101, nifc * sizeof(*dev->ifaces));
630 free(dev->cdesc, M_USB101, UGETW(dev->cdesc->wTotalLength)(*(u_int16_t *)(dev->cdesc->wTotalLength)));
631 dev->ifaces = NULL((void *)0);
632 dev->cdesc = NULL((void *)0);
633 dev->config = USB_UNCONFIG_NO0;
634 }
635
636 if (index == USB_UNCONFIG_INDEX(-1)) {
42
←
Taking false branch
→
637 /* We are unconfiguring the device, so leave unallocated. */
638 DPRINTF(("%s: set config 0\n", __func__));
639 err = usbd_set_config(dev, USB_UNCONFIG_NO0);
640 if (err)
641 DPRINTF(("%s: setting config=0 failed, error=%s\n",
642 __func__, usbd_errstr(err)));
643 return (err);
644 }
645
646 /* Get the short descriptor. */
647 err = usbd_get_desc(dev, UDESC_CONFIG0x02, index,
648 USB_CONFIG_DESCRIPTOR_SIZE9, &cd);
649 if (err)
43
←
Assuming 'err' is 0
→
44
←
Taking false branch
→
650 return (err);
651 if (cd.bDescriptorType != UDESC_CONFIG0x02)
45
←
Assuming field 'bDescriptorType' is equal to UDESC_CONFIG
→
46
←
Taking false branch
→
652 return (USBD_INVAL);
653 cdplen = UGETW(cd.wTotalLength)(*(u_int16_t *)(cd.wTotalLength));
654 cdp = malloc(cdplen, M_USB101, M_NOWAIT0x0002);
655 if (cdp == NULL((void *)0))
47
←
Assuming 'cdp' is not equal to NULL
→
48
←
Taking false branch
→
656 return (USBD_NOMEM);
657 /* Get the full descriptor. */
658 for (i = 0; i < 3; i++) {
49
←
Loop condition is true. Entering loop body
→
659 err = usbd_get_desc(dev, UDESC_CONFIG0x02, index, cdplen, cdp);
660 if (!err)
50
←
Assuming 'err' is 0, which participates in a condition later
→
51
←
Taking true branch
→
661 break;
662 usbd_delay_ms(dev, 200);
663 }
664 if (err
52.1
'err' is 0
)
52
←
 Execution continues on line 664
→
53
←
Taking false branch
→
665 goto bad;
666
667 if (cdp->bDescriptorType != UDESC_CONFIG0x02) {
54
←
Assuming field 'bDescriptorType' is equal to UDESC_CONFIG
→
55
←
Taking false branch
→
668 DPRINTFN(-1,("%s: bad desc %d\n", __func__,
669 cdp->bDescriptorType));
670 err = USBD_INVAL;
671 goto bad;
672 }
673
674 /* Figure out if the device is self or bus powered. */
675 selfpowered = 0;
676 if (!(dev->quirks->uq_flags & UQ_BUS_POWERED0x00000020) &&
56
←
Assuming the condition is false
→
677 (cdp->bmAttributes & UC_SELF_POWERED0x40)) {
678 /* May be self powered. */
679 if (cdp->bmAttributes & UC_BUS_POWERED0x80) {
680 /* Must ask device. */
681 if (dev->quirks->uq_flags & UQ_POWER_CLAIM0x00000200) {
682 /*
683 * Hub claims to be self powered, but isn't.
684 * It seems that the power status can be
685 * determined by the hub characteristics.
686 */
687 usb_hub_descriptor_t hd;
688 usb_device_request_t req;
689 req.bmRequestType = UT_READ_CLASS_DEVICE(0x80 | 0x20 | 0x00);
690 req.bRequest = UR_GET_DESCRIPTOR0x06;
691 USETW(req.wValue, 0)(*(u_int16_t *)(req.wValue) = (0));
692 USETW(req.wIndex, 0)(*(u_int16_t *)(req.wIndex) = (0));
693 USETW(req.wLength, USB_HUB_DESCRIPTOR_SIZE)(*(u_int16_t *)(req.wLength) = (8));
694 err = usbd_do_request(dev, &req, &hd);
695 if (!err &&
696 (UGETW(hd.wHubCharacteristics)(*(u_int16_t *)(hd.wHubCharacteristics)) &
697 UHD_PWR_INDIVIDUAL0x0001))
698 selfpowered = 1;
699 DPRINTF(("%s: charac=0x%04x, error=%s\n",
700 __func__, UGETW(hd.wHubCharacteristics),
701 usbd_errstr(err)));
702 } else {
703 err = usbd_get_device_status(dev, &ds);
704 if (!err &&
705 (UGETW(ds.wStatus)(*(u_int16_t *)(ds.wStatus)) & UDS_SELF_POWERED0x0001))
706 selfpowered = 1;
707 DPRINTF(("%s: status=0x%04x, error=%s\n",
708 __func__, UGETW(ds.wStatus),
709 usbd_errstr(err)));
710 }
711 } else
712 selfpowered = 1;
713 }
714 DPRINTF(("%s: (addr %d) cno=%d attr=0x%02x, selfpowered=%d, power=%d\n",
715 __func__, dev->address, cdp->bConfigurationValue, cdp->bmAttributes,
716 selfpowered, cdp->bMaxPower * 2));
717
718 /* Check if we have enough power. */
719#ifdef USB_DEBUG
720 if (dev->powersrc == NULL((void *)0)) {
721 DPRINTF(("%s: No power source?\n", __func__));
722 err = USBD_IOERROR;
723 goto bad;
724 }
725#endif
726 power = cdp->bMaxPower * 2;
727 if (power > dev->powersrc->power) {
57
←
Assuming 'power' is <= field 'power'
→
58
←
Taking false branch
→
728 DPRINTF(("power exceeded %d %d\n", power,dev->powersrc->power));
729 /* XXX print nicer message. */
730 if (msg)
731 printf("%s: device addr %d (config %d) exceeds power "
732 "budget, %d mA > %d mA\n",
733 dev->bus->bdev.dv_xname, dev->address,
734 cdp->bConfigurationValue,
735 power, dev->powersrc->power);
736 err = USBD_NO_POWER;
737 goto bad;
738 }
739 dev->power = power;
740 dev->self_powered = selfpowered;
741
742 /* Set the actual configuration value. */
743 DPRINTF(("%s: set config %d\n", __func__, cdp->bConfigurationValue));
744 err = usbd_set_config(dev, cdp->bConfigurationValue);
745 if (err) {
59
←
Assuming 'err' is 0
→
60
←
Taking false branch
→
746 DPRINTF(("%s: setting config=%d failed, error=%s\n", __func__,
747 cdp->bConfigurationValue, usbd_errstr(err)));
748 goto bad;
749 }
750
751 /* Allocate and fill interface data. */
752 nifc = cdp->bNumInterfaces;
753 dev->ifaces = mallocarray(nifc, sizeof(*dev->ifaces), M_USB101,
754 M_NOWAIT0x0002 | M_ZERO0x0008);
755 if (dev->ifaces == NULL((void *)0)) {
61
←
Assuming field 'ifaces' is not equal to NULL
→
62
←
Taking false branch
→
756 err = USBD_NOMEM;
757 goto bad;
758 }
759 DPRINTFN(5,("%s: dev=%p cdesc=%p\n", __func__, dev, cdp));
760 dev->cdesc = cdp;
761 dev->config = cdp->bConfigurationValue;
762 for (ifcidx = 0; ifcidx < nifc; ifcidx++) {
63
←
Assuming 'ifcidx' is >= 'nifc'
→
64
←
Loop condition is false. Execution continues on line 768
→
763 err = usbd_fill_iface_data(dev, ifcidx, 0);
764 if (err)
765 return (err);
766 }
767
768 return (USBD_NORMAL_COMPLETION);
65
←
Returning zero, which participates in a condition later
→
769
770 bad:
771 free(cdp, M_USB101, cdplen);
772 return (err);
773}
774
775/* XXX add function for alternate settings */
776
777usbd_status
778usbd_setup_pipe(struct usbd_device *dev, struct usbd_interface *iface,
779 struct usbd_endpoint *ep, int ival, struct usbd_pipe **pipe)
780{
781 struct usbd_pipe *p;
782 usbd_status err;
783
784 DPRINTF(("%s: dev=%p iface=%p ep=%p pipe=%p\n", __func__,
785 dev, iface, ep, pipe));
786 p = malloc(dev->bus->pipe_size, M_USB101, M_NOWAIT0x0002|M_ZERO0x0008);
787 if (p == NULL((void *)0))
9
←
Assuming 'p' is not equal to NULL
→
10
←
Taking false branch
→
788 return (USBD_NOMEM);
789 p->pipe_size = dev->bus->pipe_size;
790 p->device = dev;
791 p->iface = iface;
792 p->endpoint = ep;
793 ep->refcnt++;
794 p->interval = ival;
795 SIMPLEQ_INIT(&p->queue)do { (&p->queue)->sqh_first = ((void *)0); (&p->
queue)->sqh_last = &(&p->queue)->sqh_first; }
while (0);
11
←
Loop condition is false. Exiting loop
→
796 err = dev->bus->methods->open_pipe(p);
797 if (err) {
12
←
Assuming 'err' is 0
→
13
←
Taking false branch
→
798 DPRINTF(("%s: endpoint=0x%x failed, error=%s\n", __func__,
799 ep->edesc->bEndpointAddress, usbd_errstr(err)));
800 free(p, M_USB101, dev->bus->pipe_size);
801 return (err);
802 }
803 *pipe = p;
804 return (USBD_NORMAL_COMPLETION);
805}
806
807int
808usbd_set_address(struct usbd_device *dev, int addr)
809{
810 usb_device_request_t req;
811
812 req.bmRequestType = UT_WRITE_DEVICE(0x00 | 0x00 | 0x00);
813 req.bRequest = UR_SET_ADDRESS0x05;
814 USETW(req.wValue, addr)(*(u_int16_t *)(req.wValue) = (addr));
815 USETW(req.wIndex, 0)(*(u_int16_t *)(req.wIndex) = (0));
816 USETW(req.wLength, 0)(*(u_int16_t *)(req.wLength) = (0));
817 if (usbd_do_request(dev, &req, 0))
818 return (1);
819
820 /* Allow device time to set new address */
821 usbd_delay_ms(dev, USB_SET_ADDRESS_SETTLE10);
822
823 return (0);
824}
825
826int
827usbd_getnewaddr(struct usbd_bus *bus)
828{
829 int addr;
830
831 for (addr = 1; addr < USB_MAX_DEVICES128; addr++)
832 if (bus->devices[addr] == NULL((void *)0))
833 return (addr);
834 return (-1);
835}
836
837usbd_status
838usbd_probe_and_attach(struct device *parent, struct usbd_device *dev, int port,
839 int addr)
840{
841 /*
842 * Used to correlate audio and wskbd devices as this is the common point
843 * of attachment between the two.
844 */
845 static char *cookie = 0;
846 struct usb_attach_arg uaa;
847 usb_device_descriptor_t *dd = &dev->ddesc;
848 int i, confi, nifaces;
849 usbd_status err;
850 struct device *dv;
851 struct usbd_interface **ifaces;
852 extern struct rwlock usbpalock;
853
854 rw_enter_write(&usbpalock);
855
856 uaa.device = dev;
857 uaa.iface = NULL((void *)0);
858 uaa.ifaces = NULL((void *)0);
859 uaa.nifaces = 0;
860 uaa.usegeneric = 0;
861 uaa.port = port;
862 uaa.configno = UHUB_UNK_CONFIGURATION-1;
863 uaa.ifaceno = UHUB_UNK_INTERFACE-1;
864 uaa.vendor = UGETW(dd->idVendor)(*(u_int16_t *)(dd->idVendor));
865 uaa.product = UGETW(dd->idProduct)(*(u_int16_t *)(dd->idProduct));
866 uaa.release = UGETW(dd->bcdDevice)(*(u_int16_t *)(dd->bcdDevice));
867 uaa.cookie = ++cookie;
868
869 /* First try with device specific drivers. */
870 DPRINTF(("usbd_probe_and_attach trying device specific drivers\n"));
871 dv = config_found(parent, &uaa, usbd_print)config_found_sm((parent), (&uaa), (usbd_print), ((void *)
0));
872 if (dv) {
35
←
Assuming 'dv' is null
→
36
←
Taking false branch
→
873 dev->subdevs = mallocarray(2, sizeof dv, M_USB101, M_NOWAIT0x0002);
874 if (dev->subdevs == NULL((void *)0)) {
875 err = USBD_NOMEM;
876 goto fail;
877 }
878 dev->nsubdev = 2;
879 dev->subdevs[dev->ndevs++] = dv;
880 dev->subdevs[dev->ndevs] = 0;
881 err = USBD_NORMAL_COMPLETION;
882 goto fail;
883 }
884
885 DPRINTF(("%s: no device specific driver found\n", __func__));
886
887 DPRINTF(("%s: looping over %d configurations\n", __func__,
888 dd->bNumConfigurations));
889 /* Next try with interface drivers. */
890 for (confi = 0; confi < dd->bNumConfigurations; confi++) {
37
←
Assuming 'confi' is < field 'bNumConfigurations'
→
38
←
Loop condition is true. Entering loop body
→
77
←
Assuming 'confi' is >= field 'bNumConfigurations'
→
78
←
Loop condition is false. Execution continues on line 958
→
891 DPRINTFN(1,("%s: trying config idx=%d\n", __func__,
892 confi));
893 err = usbd_set_config_index(dev, confi, 1);
39
←
Calling 'usbd_set_config_index'
→
66
←
Returning from 'usbd_set_config_index'
→
894 if (err
66.1
'err' is 0
) {
67
←
Taking false branch
→
895#ifdef USB_DEBUG
896 DPRINTF(("%s: port %d, set config at addr %d failed, "
897 "error=%s\n", parent->dv_xname, port,
898 addr, usbd_errstr(err)));
899#else
900 printf("%s: port %d, set config %d at addr %d failed\n",
901 parent->dv_xname, port, confi, addr);
902#endif
903
904 goto fail;
905 }
906 nifaces = dev->cdesc->bNumInterfaces;
907 uaa.configno = dev->cdesc->bConfigurationValue;
908 ifaces = mallocarray(nifaces, sizeof(*ifaces), M_USB101, M_NOWAIT0x0002);
909 if (ifaces == NULL((void *)0)) {
68
←
Assuming 'ifaces' is not equal to NULL
→
69
←
Taking false branch
→
910 err = USBD_NOMEM;
911 goto fail;
912 }
913 for (i = 0; i < nifaces; i++)
70
←
Loop condition is false. Execution continues on line 915
→
914 ifaces[i] = &dev->ifaces[i];
915 uaa.ifaces = ifaces;
916 uaa.nifaces = nifaces;
917
918 /* add 1 for possible ugen and 1 for NULL terminator */
919 dev->subdevs = mallocarray(nifaces + 2, sizeof(dv), M_USB101,
920 M_NOWAIT0x0002 | M_ZERO0x0008);
921 if (dev->subdevs == NULL((void *)0)) {
71
←
Assuming field 'subdevs' is not equal to NULL
→
72
←
Taking false branch
→
922 free(ifaces, M_USB101, nifaces * sizeof(*ifaces));
923 err = USBD_NOMEM;
924 goto fail;
925 }
926 dev->nsubdev = nifaces + 2;
927
928 for (i = 0; i < nifaces; i++) {
73
←
Loop condition is false. Execution continues on line 939
→
929 if (usbd_iface_claimed(dev, i))
930 continue;
931 uaa.iface = ifaces[i];
932 uaa.ifaceno = ifaces[i]->idesc->bInterfaceNumber;
933 dv = config_found(parent, &uaa, usbd_print)config_found_sm((parent), (&uaa), (usbd_print), ((void *)
0));
934 if (dv != NULL((void *)0)) {
935 dev->subdevs[dev->ndevs++] = dv;
936 usbd_claim_iface(dev, i);
937 }
938 }
939 free(ifaces, M_USB101, nifaces * sizeof(*ifaces));
940
941 if (dev->ndevs > 0) {
74
←
Assuming field 'ndevs' is <= 0
→
75
←
Taking false branch
→
942 for (i = 0; i < nifaces; i++) {
943 if (!usbd_iface_claimed(dev, i))
944 break;
945 }
946 if (i < nifaces)
947 goto generic;
948 else
949 goto fail;
950 }
951
952 free(dev->subdevs, M_USB101, dev->nsubdev * sizeof(*dev->subdevs));
953 dev->subdevs = NULL((void *)0);
76
←
Null pointer value stored to field 'subdevs'
→
954 dev->nsubdev = 0;
955 }
956 /* No interfaces were attached in any of the configurations. */
957
958 if (dd->bNumConfigurations
78.1
Field 'bNumConfigurations' is <= 1
 > 1) /* don't change if only 1 config */
79
←
Taking false branch
→
959 usbd_set_config_index(dev, 0, 0);
960
961 DPRINTF(("%s: no interface drivers found\n", __func__));
962
963generic:
964 /* Finally try the generic driver. */
965 uaa.iface = NULL((void *)0);
966 uaa.usegeneric = 1;
967 uaa.configno = dev->ndevs == 0 ? UHUB_UNK_CONFIGURATION-1 :
80
←
Assuming field 'ndevs' is not equal to 0
→
81
←
'?' condition is false
→
968 dev->cdesc->bConfigurationValue;
969 uaa.ifaceno = UHUB_UNK_INTERFACE-1;
970 dv = config_found(parent, &uaa, usbd_print)config_found_sm((parent), (&uaa), (usbd_print), ((void *)
0));
971 if (dv != NULL((void *)0)) {
82
←
Assuming 'dv' is not equal to NULL
→
83
←
Taking true branch
→
972 if (dev->ndevs
83.1
Field 'ndevs' is not equal to 0
 == 0) {
84
←
Taking false branch
→
973 dev->subdevs = mallocarray(2, sizeof dv, M_USB101, M_NOWAIT0x0002);
974 if (dev->subdevs == NULL((void *)0)) {
975 err = USBD_NOMEM;
976 goto fail;
977 }
978 dev->nsubdev = 2;
979 }
980 dev->subdevs[dev->ndevs++] = dv;
85
←
Array access (via field 'subdevs') results in a null pointer dereference
981 dev->subdevs[dev->ndevs] = 0;
982 err = USBD_NORMAL_COMPLETION;
983 goto fail;
984 }
985
986 /*
987 * The generic attach failed, but leave the device as it is.
988 * We just did not find any drivers, that's all. The device is
989 * fully operational and not harming anyone.
990 */
991 DPRINTF(("%s: generic attach failed\n", __func__));
992 err = USBD_NORMAL_COMPLETION;
993fail:
994 rw_exit_write(&usbpalock);
995 return (err);
996}
997
998
999/*
1000 * Called when a new device has been put in the powered state,
1001 * but not yet in the addressed state.
1002 * Get initial descriptor, set the address, get full descriptor,
1003 * and attach a driver.
1004 */
1005usbd_status
1006usbd_new_device(struct device *parent, struct usbd_bus *bus, int depth,
1007 int speed, int port, struct usbd_port *up)
1008{
1009 struct usbd_device *dev, *adev, *hub;
1010 usb_device_descriptor_t *dd;
1011 usbd_status err;
1012 uint32_t mps, mps0;
1013 int addr, i, p;
1014
1015 DPRINTF(("%s: bus=%p port=%d depth=%d speed=%d\n", __func__,
1016 bus, port, depth, speed));
1017
1018 /*
1019 * Fixed size for ep0 max packet, FULL device variable size is
1020 * handled below.
1021 */
1022 switch (speed) {
1
Control jumps to 'case 4:' at line 1030
→
1023 case USB_SPEED_LOW1:
1024 mps0 = 8;
1025 break;
1026 case USB_SPEED_HIGH3:
1027 case USB_SPEED_FULL2:
1028 mps0 = 64;
1029 break;
1030 case USB_SPEED_SUPER4:
1031 mps0 = 512;
1032 break;
1033 default:
1034 return (USBD_INVAL);
1035 }
1036
1037 addr = usbd_getnewaddr(bus);
2
←
 Execution continues on line 1037
→
1038 if (addr
2.1
'addr' is >= 0
 < 0) {
3
←
Taking false branch
→
1039 printf("%s: No free USB addresses, new device ignored.\n",
1040 bus->bdev.dv_xname);
1041 return (USBD_NO_ADDR);
1042 }
1043
1044 dev = malloc(sizeof *dev, M_USB101, M_NOWAIT0x0002 | M_ZERO0x0008);
1045 if (dev == NULL((void *)0))
4
←
Assuming 'dev' is not equal to NULL
→
5
←
Taking false branch
→
1046 return (USBD_NOMEM);
1047
1048 dev->bus = bus;
1049
1050 /* Set up default endpoint handle. */
1051 dev->def_ep.edesc = &dev->def_ep_desc;
1052
1053 /* Set up default endpoint descriptor. */
1054 dev->def_ep_desc.bLength = USB_ENDPOINT_DESCRIPTOR_SIZE7;
1055 dev->def_ep_desc.bDescriptorType = UDESC_ENDPOINT0x05;
1056 dev->def_ep_desc.bEndpointAddress = USB_CONTROL_ENDPOINT0;
1057 dev->def_ep_desc.bmAttributes = UE_CONTROL0x00;
1058 dev->def_ep_desc.bInterval = 0;
1059 USETW(dev->def_ep_desc.wMaxPacketSize, mps0)(*(u_int16_t *)(dev->def_ep_desc.wMaxPacketSize) = (mps0));
1060
1061 dev->quirks = &usbd_no_quirk;
1062 dev->address = USB_START_ADDR0;
1063 dev->ddesc.bMaxPacketSize = 0;
1064 dev->depth = depth;
1065 dev->powersrc = up;
1066 dev->myhub = up->parent;
1067 dev->speed = speed;
1068 dev->langid = USBD_NOLANG(-1);
1069
1070 up->device = dev;
1071
1072 /* Locate port on upstream high speed hub */
1073 for (adev = dev, hub = up->parent;
1074 hub != NULL((void *)0) && hub->speed != USB_SPEED_HIGH3;
6
←
Assuming 'hub' is equal to NULL
→
1075 adev = hub, hub = hub->myhub)
1076 ;
1077 if (hub
6.1
'hub' is null
) {
7
←
Taking false branch
→
1078 for (p = 0; p < hub->hub->nports; p++) {
1079 if (hub->hub->ports[p].device == adev) {
1080 dev->myhsport = &hub->hub->ports[p];
1081 goto found;
1082 }
1083 }
1084 panic("usbd_new_device: cannot find HS port");
1085 found:
1086 DPRINTFN(1,("%s: high speed port %d\n", __func__, p));
1087 } else {
1088 dev->myhsport = NULL((void *)0);
1089 }
1090
1091 /* Establish the default pipe. */
1092 err = usbd_setup_pipe(dev, 0, &dev->def_ep, USBD_DEFAULT_INTERVAL(-1),
8
←
Calling 'usbd_setup_pipe'
→
14
←
Returning from 'usbd_setup_pipe'
→
1093 &dev->default_pipe);
1094 if (err
14.1
'err' is 0
)
15
←
Taking false branch
→
1095 goto fail;
1096
1097 dd = &dev->ddesc;
1098
1099 /* Try to get device descriptor */
1100 /*
1101 * some device will need small size query at first (XXX: out of spec)
1102 * we will get full size descriptor later, just determine the maximum
1103 * packet size of the control pipe at this moment.
1104 */
1105 for (i = 0; i < 3; i++) {
16
←
Loop condition is true. Entering loop body
→
1106 /* Get the first 8 bytes of the device descriptor. */
1107 /* 8 byte is magic size, some device only return 8 byte for 1st
1108 * query (XXX: out of spec) */
1109 err = usbd_get_desc(dev, UDESC_DEVICE0x01, 0, USB_MAX_IPACKET8, dd);
1110 if (!err)
17
←
Assuming 'err' is 0
→
18
←
Taking true branch
→
1111 break;
1112 if (err == USBD_TIMEOUT)
1113 goto fail;
1114 usbd_delay_ms(dev, 100+50*i);
1115 }
1116
1117 /* some device need actual size request for the query. try again */
1118 if (err
19.1
'err' is 0
) {
19
←
 Execution continues on line 1118
→
20
←
Taking false branch
→
1119 USETW(dev->def_ep_desc.wMaxPacketSize,(*(u_int16_t *)(dev->def_ep_desc.wMaxPacketSize) = (18))
1120 USB_DEVICE_DESCRIPTOR_SIZE)(*(u_int16_t *)(dev->def_ep_desc.wMaxPacketSize) = (18));
1121 usbd_reset_port(up->parent, port);
1122 for (i = 0; i < 3; i++) {
1123 err = usbd_get_desc(dev, UDESC_DEVICE0x01, 0,
1124 USB_DEVICE_DESCRIPTOR_SIZE18, dd);
1125 if (!err)
1126 break;
1127 if (err == USBD_TIMEOUT)
1128 goto fail;
1129 usbd_delay_ms(dev, 100+50*i);
1130 }
1131 }
1132
1133 /* XXX some devices need more time to wake up */
1134 if (err
20.1
'err' is 0
) {
21
←
Taking false branch
→
1135 USETW(dev->def_ep_desc.wMaxPacketSize, USB_MAX_IPACKET)(*(u_int16_t *)(dev->def_ep_desc.wMaxPacketSize) = (8));
1136 usbd_reset_port(up->parent, port);
1137 usbd_delay_ms(dev, 500);
1138 err = usbd_get_desc(dev, UDESC_DEVICE0x01, 0,
1139 USB_MAX_IPACKET8, dd);
1140 }
1141
1142 if (err
21.1
'err' is 0
)
1143 goto fail;
1144
1145 DPRINTF(("%s: adding unit addr=%d, rev=%02x, class=%d, subclass=%d, "
1146 "protocol=%d, maxpacket=%d, len=%d, speed=%d\n", __func__,
1147 addr,UGETW(dd->bcdUSB), dd->bDeviceClass, dd->bDeviceSubClass,
1148 dd->bDeviceProtocol, dd->bMaxPacketSize, dd->bLength,
1149 dev->speed));
1150
1151 if ((dd->bDescriptorType != UDESC_DEVICE0x01) ||
22
←
Assuming field 'bDescriptorType' is equal to UDESC_DEVICE
→
24
←
Taking false branch
→
1152 (dd->bLength < USB_DEVICE_DESCRIPTOR_SIZE18)) {
23
←
Assuming field 'bLength' is >= USB_DEVICE_DESCRIPTOR_SIZE
→
1153 err = USBD_INVAL;
1154 goto fail;
1155 }
1156
1157 mps = dd->bMaxPacketSize;
1158 if (speed
24.1
'speed' is equal to USB_SPEED_SUPER
 == USB_SPEED_SUPER4) {
25
←
Taking true branch
→
1159 if (mps == 0xff)
26
←
Assuming 'mps' is not equal to 255
→
27
←
Taking false branch
→
1160 mps = 9;
1161 /* xHCI Section 4.8.2.1 */
1162 mps = (1 << mps);
1163 }
1164
1165 if (mps != mps0) {
28
←
Assuming 'mps' is equal to 'mps0'
→
1166 if ((speed == USB_SPEED_LOW1) ||
1167 (mps != 8 && mps != 16 && mps != 32 && mps != 64)) {
1168 err = USBD_INVAL;
1169 goto fail;
1170 }
1171 USETW(dev->def_ep_desc.wMaxPacketSize, mps)(*(u_int16_t *)(dev->def_ep_desc.wMaxPacketSize) = (mps));
1172 }
1173
1174
1175 /* Set the address if the HC didn't do it already. */
1176 if (bus->methods->dev_setaddr != NULL((void *)0) &&
29
←
Assuming field 'dev_setaddr' is equal to NULL
→
1177 bus->methods->dev_setaddr(dev, addr)) {
1178 err = USBD_SET_ADDR_FAILED;
1179 goto fail;
1180 }
1181
1182 /* Wait for device to settle before reloading the descriptor. */
1183 usbd_delay_ms(dev, 10);
1184
1185 /*
1186 * If this device is attached to an xHCI controller, this
1187 * address does not correspond to the hardware one.
1188 */
1189 dev->address = addr;
1190
1191 err = usbd_reload_device_desc(dev);
1192 if (err
29.1
'err' is 0
)
30
←
Taking false branch
→
1193 goto fail;
1194
1195 /* send disown request to handover 2.0 to 1.1. */
1196 if (dev->quirks->uq_flags & UQ_EHCI_NEEDTO_DISOWN0x00020000) {
31
←
Assuming the condition is false
→
32
←
Taking false branch
→
1197 /* only effective when the target device is on ehci */
1198 if (dev->bus->usbrev == USBREV_2_04) {
1199 DPRINTF(("%s: disown request issues to dev:%p on usb2.0 bus\n",
1200 __func__, dev));
1201 usbd_port_disown_to_1_1(dev->myhub, port);
1202 /* reset_port required to finish disown request */
1203 usbd_reset_port(dev->myhub, port);
1204 return (USBD_NORMAL_COMPLETION);
1205 }
1206 }
1207
1208 /* Assume 100mA bus powered for now. Changed when configured. */
1209 dev->power = USB_MIN_POWER100;
1210 dev->self_powered = 0;
1211
1212 DPRINTF(("%s: new dev (addr %d), dev=%p, parent=%p\n", __func__,
1213 addr, dev, parent));
1214
1215 /* Get device info and cache it */
1216 err = usbd_cache_devinfo(dev);
1217 if (err
32.1
'err' is 0
)
33
←
Taking false branch
→
1218 goto fail;
1219
1220 bus->devices[addr] = dev;
1221
1222 err = usbd_probe_and_attach(parent, dev, port, addr);
34
←
Calling 'usbd_probe_and_attach'
→
1223 if (err)
1224 goto fail;
1225
1226 return (USBD_NORMAL_COMPLETION);
1227
1228fail:
1229 usb_free_device(dev);
1230 up->device = NULL((void *)0);
1231 return (err);
1232}
1233
1234usbd_status
1235usbd_reload_device_desc(struct usbd_device *dev)
1236{
1237 usbd_status err;
1238
1239 /* Get the full device descriptor. */
1240 err = usbd_get_desc(dev, UDESC_DEVICE0x01, 0,
1241 USB_DEVICE_DESCRIPTOR_SIZE18, &dev->ddesc);
1242 if (err)
1243 return (err);
1244
1245 /* Figure out what's wrong with this device. */
1246 dev->quirks = usbd_find_quirk(&dev->ddesc);
1247
1248 return (USBD_NORMAL_COMPLETION);
1249}
1250
1251int
1252usbd_print(void *aux, const char *pnp)
1253{
1254 struct usb_attach_arg *uaa = aux;
1255 char *devinfop;
1256
1257 devinfop = malloc(DEVINFOSIZE1024, M_TEMP127, M_WAITOK0x0001);
1258 usbd_devinfo(uaa->device, 0, devinfop, DEVINFOSIZE1024);
1259
1260 DPRINTFN(15, ("usbd_print dev=%p\n", uaa->device));
1261 if (pnp) {
1262 if (!uaa->usegeneric) {
1263 free(devinfop, M_TEMP127, DEVINFOSIZE1024);
1264 return (QUIET0);
1265 }
1266 printf("%s at %s", devinfop, pnp);
1267 }
1268 if (uaa->port != 0)
1269 printf(" port %d", uaa->port);
1270 if (uaa->configno != UHUB_UNK_CONFIGURATION-1)
1271 printf(" configuration %d", uaa->configno);
1272 if (uaa->ifaceno != UHUB_UNK_INTERFACE-1)
1273 printf(" interface %d", uaa->ifaceno);
1274
1275 if (!pnp)
1276 printf(" %s\n", devinfop);
1277 free(devinfop, M_TEMP127, DEVINFOSIZE1024);
1278 return (UNCONF1);
1279}
1280
1281void
1282usbd_fill_deviceinfo(struct usbd_device *dev, struct usb_device_info *di)
1283{
1284 struct usbd_port *p;
1285 int i;
1286
1287 di->udi_bus = dev->bus->usbctl->dv_unit;
1288 di->udi_addr = dev->address;
1289 strlcpy(di->udi_vendor, dev->vendor, sizeof(di->udi_vendor));
1290 strlcpy(di->udi_product, dev->product, sizeof(di->udi_product));
1291 usbd_printBCD(di->udi_release, sizeof di->udi_release,
1292 UGETW(dev->ddesc.bcdDevice)(*(u_int16_t *)(dev->ddesc.bcdDevice)));
1293 di->udi_vendorNo = UGETW(dev->ddesc.idVendor)(*(u_int16_t *)(dev->ddesc.idVendor));
1294 di->udi_productNo = UGETW(dev->ddesc.idProduct)(*(u_int16_t *)(dev->ddesc.idProduct));
1295 di->udi_releaseNo = UGETW(dev->ddesc.bcdDevice)(*(u_int16_t *)(dev->ddesc.bcdDevice));
1296 di->udi_class = dev->ddesc.bDeviceClass;
1297 di->udi_subclass = dev->ddesc.bDeviceSubClass;
1298 di->udi_protocol = dev->ddesc.bDeviceProtocol;
1299 di->udi_config = dev->config;
1300 di->udi_power = dev->self_powered ? 0 : dev->power;
1301 di->udi_speed = dev->speed;
1302 di->udi_port = dev->powersrc ? dev->powersrc->portno : 0;
1303
1304 if (dev->subdevs != NULL((void *)0)) {
1305 for (i = 0; dev->subdevs[i] && i < USB_MAX_DEVNAMES4; i++) {
1306 strncpy(di->udi_devnames[i],
1307 dev->subdevs[i]->dv_xname, USB_MAX_DEVNAMELEN16);
1308 di->udi_devnames[i][USB_MAX_DEVNAMELEN16-1] = '\0';
1309 }
1310 } else
1311 i = 0;
1312
1313 for (/*i is set */; i < USB_MAX_DEVNAMES4; i++)
1314 di->udi_devnames[i][0] = 0; /* empty */
1315
1316 if (dev->hub) {
1317 for (i = 0;
1318 i < nitems(di->udi_ports)(sizeof((di->udi_ports)) / sizeof((di->udi_ports)[0])) && i < dev->hub->nports; i++) {
1319 p = &dev->hub->ports[i];
1320 di->udi_ports[i] = UGETW(p->status.wPortChange)(*(u_int16_t *)(p->status.wPortChange)) << 16 |
1321 UGETW(p->status.wPortStatus)(*(u_int16_t *)(p->status.wPortStatus));
1322 }
1323 di->udi_nports = dev->hub->nports;
1324 } else
1325 di->udi_nports = 0;
1326
1327 bzero(di->udi_serial, sizeof(di->udi_serial))__builtin_bzero((di->udi_serial), (sizeof(di->udi_serial
)));
1328 if (dev->serial != NULL((void *)0))
1329 strlcpy(di->udi_serial, dev->serial,
1330 sizeof(di->udi_serial));
1331}
1332
1333int
1334usbd_get_routestring(struct usbd_device *dev, uint32_t *route)
1335{
1336 struct usbd_device *hub;
1337 uint32_t r;
1338 uint8_t port;
1339
1340 /*
1341 * Calculate the Route String. Assume that there is no hub with
1342 * more than 15 ports and that they all have a depth < 6. See
1343 * section 8.9 of USB 3.1 Specification for more details.
1344 */
1345 r = dev->powersrc ? dev->powersrc->portno : 0;
1346 for (hub = dev->myhub; hub && hub->depth > 1; hub = hub->myhub) {
1347 port = hub->powersrc ? hub->powersrc->portno : 0;
1348 if (port > 15)
1349 return -1;
1350 r <<= 4;
1351 r |= port;
1352 }
1353
1354 /* Add in the host root port, of which there may be 255. */
1355 port = (hub && hub->powersrc) ? hub->powersrc->portno : 0;
1356 r <<= 8;
1357 r |= port;
1358
1359 *route = r;
1360 return 0;
1361}
1362
1363int
1364usbd_get_location(struct usbd_device *dev, struct usbd_interface *iface,
1365 uint8_t *bus, uint32_t *route, uint8_t *ifaceno)
1366{
1367 int i;
1368 uint32_t r;
1369
1370 if (dev == NULL((void *)0) || usbd_is_dying(dev) ||
1371 dev->cdesc == NULL((void *)0) ||
1372 dev->cdesc->bNumInterfaces == 0 ||
1373 dev->bus == NULL((void *)0) ||
1374 dev->bus->usbctl == NULL((void *)0) ||
1375 dev->myhub == NULL((void *)0) ||
1376 dev->powersrc == NULL((void *)0))
1377 return -1;
1378
1379 for(i = 0; i < dev->cdesc->bNumInterfaces; i++) {
1380 if (iface == &dev->ifaces[i]) {
1381 *bus = dev->bus->usbctl->dv_unit;
1382 *route = (usbd_get_routestring(dev, &r)) ? 0 : r;
1383 *ifaceno = i;
1384 return 0;
1385 }
1386 }
1387
1388 return -1;
1389}
1390
1391/* Retrieve a complete descriptor for a certain device and index. */
1392usb_config_descriptor_t *
1393usbd_get_cdesc(struct usbd_device *dev, int index, u_int *lenp)
1394{
1395 usb_config_descriptor_t *cdesc, *tdesc, cdescr;
1396 u_int len;
1397 usbd_status err;
1398
1399 if (index == USB_CURRENT_CONFIG_INDEX(-1)) {
1400 tdesc = usbd_get_config_descriptor(dev);
1401 if (tdesc == NULL((void *)0))
1402 return (NULL((void *)0));
1403 len = UGETW(tdesc->wTotalLength)(*(u_int16_t *)(tdesc->wTotalLength));
1404 if (lenp)
1405 *lenp = len;
1406 cdesc = malloc(len, M_TEMP127, M_WAITOK0x0001);
1407 memcpy(cdesc, tdesc, len)__builtin_memcpy((cdesc), (tdesc), (len));
1408 DPRINTFN(5,("%s: current, len=%u\n", __func__, len));
1409 } else {
1410 err = usbd_get_desc(dev, UDESC_CONFIG0x02, index,
1411 USB_CONFIG_DESCRIPTOR_SIZE9, &cdescr);
1412 if (err || cdescr.bDescriptorType != UDESC_CONFIG0x02)
1413 return (NULL((void *)0));
1414 len = UGETW(cdescr.wTotalLength)(*(u_int16_t *)(cdescr.wTotalLength));
1415 DPRINTFN(5,("%s: index=%d, len=%u\n", __func__, index, len));
1416 if (lenp)
1417 *lenp = len;
1418 cdesc = malloc(len, M_TEMP127, M_WAITOK0x0001);
1419 err = usbd_get_desc(dev, UDESC_CONFIG0x02, index, len, cdesc);
1420 if (err) {
1421 free(cdesc, M_TEMP127, len);
1422 return (NULL((void *)0));
1423 }
1424 }
1425 return (cdesc);
1426}
1427
1428void
1429usb_free_device(struct usbd_device *dev)
1430{
1431 int ifcidx, nifc;
1432
1433 DPRINTF(("%s: %p\n", __func__, dev));
1434
1435 if (dev->default_pipe != NULL((void *)0))
1436 usbd_close_pipe(dev->default_pipe);
1437 if (dev->ifaces != NULL((void *)0)) {
1438 nifc = dev->cdesc->bNumInterfaces;
1439 for (ifcidx = 0; ifcidx < nifc; ifcidx++)
1440 usbd_free_iface_data(dev, ifcidx);
1441 free(dev->ifaces, M_USB101, nifc * sizeof(*dev->ifaces));
1442 }
1443 if (dev->cdesc != NULL((void *)0))
1444 free(dev->cdesc, M_USB101, UGETW(dev->cdesc->wTotalLength)(*(u_int16_t *)(dev->cdesc->wTotalLength)));
1445 free(dev->subdevs, M_USB101, dev->nsubdev * sizeof(*dev->subdevs));
1446 dev->bus->devices[dev->address] = NULL((void *)0);
1447
1448 if (dev->vendor != NULL((void *)0))
1449 free(dev->vendor, M_USB101, USB_MAX_STRING_LEN127);
1450 if (dev->product != NULL((void *)0))
1451 free(dev->product, M_USB101, USB_MAX_STRING_LEN127);
1452 if (dev->serial != NULL((void *)0))
1453 free(dev->serial, M_USB101, USB_MAX_STRING_LEN127);
1454
1455 free(dev, M_USB101, sizeof *dev);
1456}
1457
1458/*
1459 * Should only be called by the USB thread doing bus exploration to
1460 * avoid connect/disconnect races.
1461 */
1462int
1463usbd_detach(struct usbd_device *dev, struct device *parent)
1464{
1465 int i, rv = 0;
1466
1467 usbd_deactivate(dev);
1468
1469 if (dev->ndevs > 0) {
1470 for (i = 0; dev->subdevs[i] != NULL((void *)0); i++)
1471 rv |= config_detach(dev->subdevs[i], DETACH_FORCE0x01);
1472 }
1473
1474 if (rv == 0)
1475 usb_free_device(dev);
1476
1477 return (rv);
1478}