1/*
   2 * message.c - synchronous message handling
   3 */
   4
   5#include <linux/pci.h>	/* for scatterlist macros */
   6#include <linux/usb.h>
   7#include <linux/module.h>
   8#include <linux/slab.h>
   9#include <linux/init.h>
  10#include <linux/mm.h>
  11#include <linux/timer.h>
  12#include <linux/ctype.h>
  13#include <linux/nls.h>
  14#include <linux/device.h>
  15#include <linux/scatterlist.h>
  16#include <linux/usb/quirks.h>
  17#include <linux/usb/hcd.h>	/* for usbcore internals */
  18#include <asm/byteorder.h>
  19
  20#include "usb.h"
  21
  22static void cancel_async_set_config(struct usb_device *udev);
  23
  24struct api_context {
  25	struct completion	done;
  26	int			status;
  27};
  28
  29static void usb_api_blocking_completion(struct urb *urb)
  30{
  31	struct api_context *ctx = urb->context;
  32
  33	ctx->status = urb->status;
  34	complete(&ctx->done);
  35}
  36
  37
  38/*
  39 * Starts urb and waits for completion or timeout. Note that this call
  40 * is NOT interruptible. Many device driver i/o requests should be
  41 * interruptible and therefore these drivers should implement their
  42 * own interruptible routines.
  43 */
  44static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length)
  45{
  46	struct api_context ctx;
  47	unsigned long expire;
  48	int retval;
  49
  50	init_completion(&ctx.done);
  51	urb->context = &ctx;
  52	urb->actual_length = 0;
  53	retval = usb_submit_urb(urb, GFP_NOIO);
  54	if (unlikely(retval))
  55		goto out;
  56
  57	expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT;
  58	if (!wait_for_completion_timeout(&ctx.done, expire)) {
  59		usb_kill_urb(urb);
  60		retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status);
  61
  62		dev_dbg(&urb->dev->dev,
  63			"%s timed out on ep%d%s len=%u/%u\n",
  64			current->comm,
  65			usb_endpoint_num(&urb->ep->desc),
  66			usb_urb_dir_in(urb) ? "in" : "out",
  67			urb->actual_length,
  68			urb->transfer_buffer_length);
  69	} else
  70		retval = ctx.status;
  71out:
  72	if (actual_length)
  73		*actual_length = urb->actual_length;
  74
  75	usb_free_urb(urb);
  76	return retval;
  77}
  78
  79/*-------------------------------------------------------------------*/
  80/* returns status (negative) or length (positive) */
  81static int usb_internal_control_msg(struct usb_device *usb_dev,
  82				    unsigned int pipe,
  83				    struct usb_ctrlrequest *cmd,
  84				    void *data, int len, int timeout)
  85{
  86	struct urb *urb;
  87	int retv;
  88	int length;
  89
  90	urb = usb_alloc_urb(0, GFP_NOIO);
  91	if (!urb)
  92		return -ENOMEM;
  93
  94	usb_fill_control_urb(urb, usb_dev, pipe, (unsigned char *)cmd, data,
  95			     len, usb_api_blocking_completion, NULL);
  96
  97	retv = usb_start_wait_urb(urb, timeout, &length);
  98	if (retv < 0)
  99		return retv;
 100	else
 101		return length;
 102}
 103
 104/**
 105 * usb_control_msg - Builds a control urb, sends it off and waits for completion
 106 * @dev: pointer to the usb device to send the message to
 107 * @pipe: endpoint "pipe" to send the message to
 108 * @request: USB message request value
 109 * @requesttype: USB message request type value
 110 * @value: USB message value
 111 * @index: USB message index value
 112 * @data: pointer to the data to send
 113 * @size: length in bytes of the data to send
 114 * @timeout: time in msecs to wait for the message to complete before timing
 115 *	out (if 0 the wait is forever)
 116 *
 117 * Context: !in_interrupt ()
 118 *
 119 * This function sends a simple control message to a specified endpoint and
 120 * waits for the message to complete, or timeout.
 121 *
 122 * If successful, it returns the number of bytes transferred, otherwise a
 123 * negative error number.
 124 *
 125 * Don't use this function from within an interrupt context, like a bottom half
 126 * handler.  If you need an asynchronous message, or need to send a message
 127 * from within interrupt context, use usb_submit_urb().
 128 * If a thread in your driver uses this call, make sure your disconnect()
 129 * method can wait for it to complete.  Since you don't have a handle on the
 130 * URB used, you can't cancel the request.
 
 
 
 131 */
 132int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request,
 133		    __u8 requesttype, __u16 value, __u16 index, void *data,
 134		    __u16 size, int timeout)
 135{
 136	struct usb_ctrlrequest *dr;
 137	int ret;
 138
 139	dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO);
 140	if (!dr)
 141		return -ENOMEM;
 142
 143	dr->bRequestType = requesttype;
 144	dr->bRequest = request;
 145	dr->wValue = cpu_to_le16(value);
 146	dr->wIndex = cpu_to_le16(index);
 147	dr->wLength = cpu_to_le16(size);
 148
 149	/* dbg("usb_control_msg"); */
 150
 151	ret = usb_internal_control_msg(dev, pipe, dr, data, size, timeout);
 152
 153	kfree(dr);
 154
 155	return ret;
 156}
 157EXPORT_SYMBOL_GPL(usb_control_msg);
 158
 159/**
 160 * usb_interrupt_msg - Builds an interrupt urb, sends it off and waits for completion
 161 * @usb_dev: pointer to the usb device to send the message to
 162 * @pipe: endpoint "pipe" to send the message to
 163 * @data: pointer to the data to send
 164 * @len: length in bytes of the data to send
 165 * @actual_length: pointer to a location to put the actual length transferred
 166 *	in bytes
 167 * @timeout: time in msecs to wait for the message to complete before
 168 *	timing out (if 0 the wait is forever)
 169 *
 170 * Context: !in_interrupt ()
 171 *
 172 * This function sends a simple interrupt message to a specified endpoint and
 173 * waits for the message to complete, or timeout.
 174 *
 175 * If successful, it returns 0, otherwise a negative error number.  The number
 176 * of actual bytes transferred will be stored in the actual_length paramater.
 177 *
 178 * Don't use this function from within an interrupt context, like a bottom half
 179 * handler.  If you need an asynchronous message, or need to send a message
 180 * from within interrupt context, use usb_submit_urb() If a thread in your
 181 * driver uses this call, make sure your disconnect() method can wait for it to
 182 * complete.  Since you don't have a handle on the URB used, you can't cancel
 183 * the request.
 
 
 
 
 184 */
 185int usb_interrupt_msg(struct usb_device *usb_dev, unsigned int pipe,
 186		      void *data, int len, int *actual_length, int timeout)
 187{
 188	return usb_bulk_msg(usb_dev, pipe, data, len, actual_length, timeout);
 189}
 190EXPORT_SYMBOL_GPL(usb_interrupt_msg);
 191
 192/**
 193 * usb_bulk_msg - Builds a bulk urb, sends it off and waits for completion
 194 * @usb_dev: pointer to the usb device to send the message to
 195 * @pipe: endpoint "pipe" to send the message to
 196 * @data: pointer to the data to send
 197 * @len: length in bytes of the data to send
 198 * @actual_length: pointer to a location to put the actual length transferred
 199 *	in bytes
 200 * @timeout: time in msecs to wait for the message to complete before
 201 *	timing out (if 0 the wait is forever)
 202 *
 203 * Context: !in_interrupt ()
 204 *
 205 * This function sends a simple bulk message to a specified endpoint
 206 * and waits for the message to complete, or timeout.
 207 *
 208 * If successful, it returns 0, otherwise a negative error number.  The number
 209 * of actual bytes transferred will be stored in the actual_length paramater.
 210 *
 211 * Don't use this function from within an interrupt context, like a bottom half
 212 * handler.  If you need an asynchronous message, or need to send a message
 213 * from within interrupt context, use usb_submit_urb() If a thread in your
 214 * driver uses this call, make sure your disconnect() method can wait for it to
 215 * complete.  Since you don't have a handle on the URB used, you can't cancel
 216 * the request.
 217 *
 218 * Because there is no usb_interrupt_msg() and no USBDEVFS_INTERRUPT ioctl,
 219 * users are forced to abuse this routine by using it to submit URBs for
 220 * interrupt endpoints.  We will take the liberty of creating an interrupt URB
 221 * (with the default interval) if the target is an interrupt endpoint.
 
 
 
 
 
 222 */
 223int usb_bulk_msg(struct usb_device *usb_dev, unsigned int pipe,
 224		 void *data, int len, int *actual_length, int timeout)
 225{
 226	struct urb *urb;
 227	struct usb_host_endpoint *ep;
 228
 229	ep = usb_pipe_endpoint(usb_dev, pipe);
 230	if (!ep || len < 0)
 231		return -EINVAL;
 232
 233	urb = usb_alloc_urb(0, GFP_KERNEL);
 234	if (!urb)
 235		return -ENOMEM;
 236
 237	if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
 238			USB_ENDPOINT_XFER_INT) {
 239		pipe = (pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30);
 240		usb_fill_int_urb(urb, usb_dev, pipe, data, len,
 241				usb_api_blocking_completion, NULL,
 242				ep->desc.bInterval);
 243	} else
 244		usb_fill_bulk_urb(urb, usb_dev, pipe, data, len,
 245				usb_api_blocking_completion, NULL);
 246
 247	return usb_start_wait_urb(urb, timeout, actual_length);
 248}
 249EXPORT_SYMBOL_GPL(usb_bulk_msg);
 250
 251/*-------------------------------------------------------------------*/
 252
 253static void sg_clean(struct usb_sg_request *io)
 254{
 255	if (io->urbs) {
 256		while (io->entries--)
 257			usb_free_urb(io->urbs [io->entries]);
 258		kfree(io->urbs);
 259		io->urbs = NULL;
 260	}
 261	io->dev = NULL;
 262}
 263
 264static void sg_complete(struct urb *urb)
 265{
 266	struct usb_sg_request *io = urb->context;
 267	int status = urb->status;
 268
 269	spin_lock(&io->lock);
 270
 271	/* In 2.5 we require hcds' endpoint queues not to progress after fault
 272	 * reports, until the completion callback (this!) returns.  That lets
 273	 * device driver code (like this routine) unlink queued urbs first,
 274	 * if it needs to, since the HC won't work on them at all.  So it's
 275	 * not possible for page N+1 to overwrite page N, and so on.
 276	 *
 277	 * That's only for "hard" faults; "soft" faults (unlinks) sometimes
 278	 * complete before the HCD can get requests away from hardware,
 279	 * though never during cleanup after a hard fault.
 280	 */
 281	if (io->status
 282			&& (io->status != -ECONNRESET
 283				|| status != -ECONNRESET)
 284			&& urb->actual_length) {
 285		dev_err(io->dev->bus->controller,
 286			"dev %s ep%d%s scatterlist error %d/%d\n",
 287			io->dev->devpath,
 288			usb_endpoint_num(&urb->ep->desc),
 289			usb_urb_dir_in(urb) ? "in" : "out",
 290			status, io->status);
 291		/* BUG (); */
 292	}
 293
 294	if (io->status == 0 && status && status != -ECONNRESET) {
 295		int i, found, retval;
 296
 297		io->status = status;
 298
 299		/* the previous urbs, and this one, completed already.
 300		 * unlink pending urbs so they won't rx/tx bad data.
 301		 * careful: unlink can sometimes be synchronous...
 302		 */
 303		spin_unlock(&io->lock);
 304		for (i = 0, found = 0; i < io->entries; i++) {
 305			if (!io->urbs [i] || !io->urbs [i]->dev)
 306				continue;
 307			if (found) {
 308				retval = usb_unlink_urb(io->urbs [i]);
 309				if (retval != -EINPROGRESS &&
 310				    retval != -ENODEV &&
 311				    retval != -EBUSY)
 
 312					dev_err(&io->dev->dev,
 313						"%s, unlink --> %d\n",
 314						__func__, retval);
 315			} else if (urb == io->urbs [i])
 316				found = 1;
 317		}
 318		spin_lock(&io->lock);
 319	}
 320	urb->dev = NULL;
 321
 322	/* on the last completion, signal usb_sg_wait() */
 323	io->bytes += urb->actual_length;
 324	io->count--;
 325	if (!io->count)
 326		complete(&io->complete);
 327
 328	spin_unlock(&io->lock);
 329}
 330
 331
 332/**
 333 * usb_sg_init - initializes scatterlist-based bulk/interrupt I/O request
 334 * @io: request block being initialized.  until usb_sg_wait() returns,
 335 *	treat this as a pointer to an opaque block of memory,
 336 * @dev: the usb device that will send or receive the data
 337 * @pipe: endpoint "pipe" used to transfer the data
 338 * @period: polling rate for interrupt endpoints, in frames or
 339 * 	(for high speed endpoints) microframes; ignored for bulk
 340 * @sg: scatterlist entries
 341 * @nents: how many entries in the scatterlist
 342 * @length: how many bytes to send from the scatterlist, or zero to
 343 * 	send every byte identified in the list.
 344 * @mem_flags: SLAB_* flags affecting memory allocations in this call
 345 *
 346 * Returns zero for success, else a negative errno value.  This initializes a
 347 * scatter/gather request, allocating resources such as I/O mappings and urb
 348 * memory (except maybe memory used by USB controller drivers).
 349 *
 350 * The request must be issued using usb_sg_wait(), which waits for the I/O to
 351 * complete (or to be canceled) and then cleans up all resources allocated by
 352 * usb_sg_init().
 353 *
 354 * The request may be canceled with usb_sg_cancel(), either before or after
 355 * usb_sg_wait() is called.
 
 
 356 */
 357int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
 358		unsigned pipe, unsigned	period, struct scatterlist *sg,
 359		int nents, size_t length, gfp_t mem_flags)
 360{
 361	int i;
 362	int urb_flags;
 363	int use_sg;
 364
 365	if (!io || !dev || !sg
 366			|| usb_pipecontrol(pipe)
 367			|| usb_pipeisoc(pipe)
 368			|| nents <= 0)
 369		return -EINVAL;
 370
 371	spin_lock_init(&io->lock);
 372	io->dev = dev;
 373	io->pipe = pipe;
 374
 375	if (dev->bus->sg_tablesize > 0) {
 376		use_sg = true;
 377		io->entries = 1;
 378	} else {
 379		use_sg = false;
 380		io->entries = nents;
 381	}
 382
 383	/* initialize all the urbs we'll use */
 384	io->urbs = kmalloc(io->entries * sizeof *io->urbs, mem_flags);
 385	if (!io->urbs)
 386		goto nomem;
 387
 388	urb_flags = URB_NO_INTERRUPT;
 389	if (usb_pipein(pipe))
 390		urb_flags |= URB_SHORT_NOT_OK;
 391
 392	for_each_sg(sg, sg, io->entries, i) {
 393		struct urb *urb;
 394		unsigned len;
 395
 396		urb = usb_alloc_urb(0, mem_flags);
 397		if (!urb) {
 398			io->entries = i;
 399			goto nomem;
 400		}
 401		io->urbs[i] = urb;
 402
 403		urb->dev = NULL;
 404		urb->pipe = pipe;
 405		urb->interval = period;
 406		urb->transfer_flags = urb_flags;
 407		urb->complete = sg_complete;
 408		urb->context = io;
 409		urb->sg = sg;
 410
 411		if (use_sg) {
 412			/* There is no single transfer buffer */
 413			urb->transfer_buffer = NULL;
 414			urb->num_sgs = nents;
 415
 416			/* A length of zero means transfer the whole sg list */
 417			len = length;
 418			if (len == 0) {
 419				struct scatterlist	*sg2;
 420				int			j;
 421
 422				for_each_sg(sg, sg2, nents, j)
 423					len += sg2->length;
 424			}
 425		} else {
 426			/*
 427			 * Some systems can't use DMA; they use PIO instead.
 428			 * For their sakes, transfer_buffer is set whenever
 429			 * possible.
 430			 */
 431			if (!PageHighMem(sg_page(sg)))
 432				urb->transfer_buffer = sg_virt(sg);
 433			else
 434				urb->transfer_buffer = NULL;
 435
 436			len = sg->length;
 437			if (length) {
 438				len = min_t(unsigned, len, length);
 439				length -= len;
 440				if (length == 0)
 441					io->entries = i + 1;
 442			}
 443		}
 444		urb->transfer_buffer_length = len;
 445	}
 446	io->urbs[--i]->transfer_flags &= ~URB_NO_INTERRUPT;
 447
 448	/* transaction state */
 449	io->count = io->entries;
 450	io->status = 0;
 451	io->bytes = 0;
 452	init_completion(&io->complete);
 453	return 0;
 454
 455nomem:
 456	sg_clean(io);
 457	return -ENOMEM;
 458}
 459EXPORT_SYMBOL_GPL(usb_sg_init);
 460
 461/**
 462 * usb_sg_wait - synchronously execute scatter/gather request
 463 * @io: request block handle, as initialized with usb_sg_init().
 464 * 	some fields become accessible when this call returns.
 465 * Context: !in_interrupt ()
 466 *
 467 * This function blocks until the specified I/O operation completes.  It
 468 * leverages the grouping of the related I/O requests to get good transfer
 469 * rates, by queueing the requests.  At higher speeds, such queuing can
 470 * significantly improve USB throughput.
 471 *
 472 * There are three kinds of completion for this function.
 473 * (1) success, where io->status is zero.  The number of io->bytes
 474 *     transferred is as requested.
 475 * (2) error, where io->status is a negative errno value.  The number
 476 *     of io->bytes transferred before the error is usually less
 477 *     than requested, and can be nonzero.
 478 * (3) cancellation, a type of error with status -ECONNRESET that
 479 *     is initiated by usb_sg_cancel().
 480 *
 481 * When this function returns, all memory allocated through usb_sg_init() or
 482 * this call will have been freed.  The request block parameter may still be
 483 * passed to usb_sg_cancel(), or it may be freed.  It could also be
 484 * reinitialized and then reused.
 485 *
 486 * Data Transfer Rates:
 487 *
 488 * Bulk transfers are valid for full or high speed endpoints.
 489 * The best full speed data rate is 19 packets of 64 bytes each
 490 * per frame, or 1216 bytes per millisecond.
 491 * The best high speed data rate is 13 packets of 512 bytes each
 492 * per microframe, or 52 KBytes per millisecond.
 493 *
 494 * The reason to use interrupt transfers through this API would most likely
 495 * be to reserve high speed bandwidth, where up to 24 KBytes per millisecond
 496 * could be transferred.  That capability is less useful for low or full
 497 * speed interrupt endpoints, which allow at most one packet per millisecond,
 498 * of at most 8 or 64 bytes (respectively).
 499 *
 500 * It is not necessary to call this function to reserve bandwidth for devices
 501 * under an xHCI host controller, as the bandwidth is reserved when the
 502 * configuration or interface alt setting is selected.
 503 */
 504void usb_sg_wait(struct usb_sg_request *io)
 505{
 506	int i;
 507	int entries = io->entries;
 508
 509	/* queue the urbs.  */
 510	spin_lock_irq(&io->lock);
 511	i = 0;
 512	while (i < entries && !io->status) {
 513		int retval;
 514
 515		io->urbs[i]->dev = io->dev;
 516		retval = usb_submit_urb(io->urbs [i], GFP_ATOMIC);
 517
 518		/* after we submit, let completions or cancelations fire;
 519		 * we handshake using io->status.
 520		 */
 521		spin_unlock_irq(&io->lock);
 522		switch (retval) {
 523			/* maybe we retrying will recover */
 524		case -ENXIO:	/* hc didn't queue this one */
 525		case -EAGAIN:
 526		case -ENOMEM:
 527			io->urbs[i]->dev = NULL;
 528			retval = 0;
 529			yield();
 530			break;
 531
 532			/* no error? continue immediately.
 533			 *
 534			 * NOTE: to work better with UHCI (4K I/O buffer may
 535			 * need 3K of TDs) it may be good to limit how many
 536			 * URBs are queued at once; N milliseconds?
 537			 */
 538		case 0:
 539			++i;
 540			cpu_relax();
 541			break;
 542
 543			/* fail any uncompleted urbs */
 544		default:
 545			io->urbs[i]->dev = NULL;
 546			io->urbs[i]->status = retval;
 547			dev_dbg(&io->dev->dev, "%s, submit --> %d\n",
 548				__func__, retval);
 549			usb_sg_cancel(io);
 550		}
 551		spin_lock_irq(&io->lock);
 552		if (retval && (io->status == 0 || io->status == -ECONNRESET))
 553			io->status = retval;
 554	}
 555	io->count -= entries - i;
 556	if (io->count == 0)
 557		complete(&io->complete);
 558	spin_unlock_irq(&io->lock);
 559
 560	/* OK, yes, this could be packaged as non-blocking.
 561	 * So could the submit loop above ... but it's easier to
 562	 * solve neither problem than to solve both!
 563	 */
 564	wait_for_completion(&io->complete);
 565
 566	sg_clean(io);
 567}
 568EXPORT_SYMBOL_GPL(usb_sg_wait);
 569
 570/**
 571 * usb_sg_cancel - stop scatter/gather i/o issued by usb_sg_wait()
 572 * @io: request block, initialized with usb_sg_init()
 573 *
 574 * This stops a request after it has been started by usb_sg_wait().
 575 * It can also prevents one initialized by usb_sg_init() from starting,
 576 * so that call just frees resources allocated to the request.
 577 */
 578void usb_sg_cancel(struct usb_sg_request *io)
 579{
 580	unsigned long flags;
 581
 582	spin_lock_irqsave(&io->lock, flags);
 583
 584	/* shut everything down, if it didn't already */
 585	if (!io->status) {
 586		int i;
 587
 588		io->status = -ECONNRESET;
 589		spin_unlock(&io->lock);
 590		for (i = 0; i < io->entries; i++) {
 591			int retval;
 592
 593			if (!io->urbs [i]->dev)
 594				continue;
 595			retval = usb_unlink_urb(io->urbs [i]);
 596			if (retval != -EINPROGRESS && retval != -EBUSY)
 
 
 
 597				dev_warn(&io->dev->dev, "%s, unlink --> %d\n",
 598					__func__, retval);
 599		}
 600		spin_lock(&io->lock);
 601	}
 602	spin_unlock_irqrestore(&io->lock, flags);
 603}
 604EXPORT_SYMBOL_GPL(usb_sg_cancel);
 605
 606/*-------------------------------------------------------------------*/
 607
 608/**
 609 * usb_get_descriptor - issues a generic GET_DESCRIPTOR request
 610 * @dev: the device whose descriptor is being retrieved
 611 * @type: the descriptor type (USB_DT_*)
 612 * @index: the number of the descriptor
 613 * @buf: where to put the descriptor
 614 * @size: how big is "buf"?
 615 * Context: !in_interrupt ()
 616 *
 617 * Gets a USB descriptor.  Convenience functions exist to simplify
 618 * getting some types of descriptors.  Use
 619 * usb_get_string() or usb_string() for USB_DT_STRING.
 620 * Device (USB_DT_DEVICE) and configuration descriptors (USB_DT_CONFIG)
 621 * are part of the device structure.
 622 * In addition to a number of USB-standard descriptors, some
 623 * devices also use class-specific or vendor-specific descriptors.
 624 *
 625 * This call is synchronous, and may not be used in an interrupt context.
 626 *
 627 * Returns the number of bytes received on success, or else the status code
 628 * returned by the underlying usb_control_msg() call.
 629 */
 630int usb_get_descriptor(struct usb_device *dev, unsigned char type,
 631		       unsigned char index, void *buf, int size)
 632{
 633	int i;
 634	int result;
 635
 636	memset(buf, 0, size);	/* Make sure we parse really received data */
 637
 638	for (i = 0; i < 3; ++i) {
 639		/* retry on length 0 or error; some devices are flakey */
 640		result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
 641				USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,
 642				(type << 8) + index, 0, buf, size,
 643				USB_CTRL_GET_TIMEOUT);
 644		if (result <= 0 && result != -ETIMEDOUT)
 645			continue;
 646		if (result > 1 && ((u8 *)buf)[1] != type) {
 647			result = -ENODATA;
 648			continue;
 649		}
 650		break;
 651	}
 652	return result;
 653}
 654EXPORT_SYMBOL_GPL(usb_get_descriptor);
 655
 656/**
 657 * usb_get_string - gets a string descriptor
 658 * @dev: the device whose string descriptor is being retrieved
 659 * @langid: code for language chosen (from string descriptor zero)
 660 * @index: the number of the descriptor
 661 * @buf: where to put the string
 662 * @size: how big is "buf"?
 663 * Context: !in_interrupt ()
 664 *
 665 * Retrieves a string, encoded using UTF-16LE (Unicode, 16 bits per character,
 666 * in little-endian byte order).
 667 * The usb_string() function will often be a convenient way to turn
 668 * these strings into kernel-printable form.
 669 *
 670 * Strings may be referenced in device, configuration, interface, or other
 671 * descriptors, and could also be used in vendor-specific ways.
 672 *
 673 * This call is synchronous, and may not be used in an interrupt context.
 674 *
 675 * Returns the number of bytes received on success, or else the status code
 676 * returned by the underlying usb_control_msg() call.
 677 */
 678static int usb_get_string(struct usb_device *dev, unsigned short langid,
 679			  unsigned char index, void *buf, int size)
 680{
 681	int i;
 682	int result;
 683
 684	for (i = 0; i < 3; ++i) {
 685		/* retry on length 0 or stall; some devices are flakey */
 686		result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
 687			USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,
 688			(USB_DT_STRING << 8) + index, langid, buf, size,
 689			USB_CTRL_GET_TIMEOUT);
 690		if (result == 0 || result == -EPIPE)
 691			continue;
 692		if (result > 1 && ((u8 *) buf)[1] != USB_DT_STRING) {
 693			result = -ENODATA;
 694			continue;
 695		}
 696		break;
 697	}
 698	return result;
 699}
 700
 701static void usb_try_string_workarounds(unsigned char *buf, int *length)
 702{
 703	int newlength, oldlength = *length;
 704
 705	for (newlength = 2; newlength + 1 < oldlength; newlength += 2)
 706		if (!isprint(buf[newlength]) || buf[newlength + 1])
 707			break;
 708
 709	if (newlength > 2) {
 710		buf[0] = newlength;
 711		*length = newlength;
 712	}
 713}
 714
 715static int usb_string_sub(struct usb_device *dev, unsigned int langid,
 716			  unsigned int index, unsigned char *buf)
 717{
 718	int rc;
 719
 720	/* Try to read the string descriptor by asking for the maximum
 721	 * possible number of bytes */
 722	if (dev->quirks & USB_QUIRK_STRING_FETCH_255)
 723		rc = -EIO;
 724	else
 725		rc = usb_get_string(dev, langid, index, buf, 255);
 726
 727	/* If that failed try to read the descriptor length, then
 728	 * ask for just that many bytes */
 729	if (rc < 2) {
 730		rc = usb_get_string(dev, langid, index, buf, 2);
 731		if (rc == 2)
 732			rc = usb_get_string(dev, langid, index, buf, buf[0]);
 733	}
 734
 735	if (rc >= 2) {
 736		if (!buf[0] && !buf[1])
 737			usb_try_string_workarounds(buf, &rc);
 738
 739		/* There might be extra junk at the end of the descriptor */
 740		if (buf[0] < rc)
 741			rc = buf[0];
 742
 743		rc = rc - (rc & 1); /* force a multiple of two */
 744	}
 745
 746	if (rc < 2)
 747		rc = (rc < 0 ? rc : -EINVAL);
 748
 749	return rc;
 750}
 751
 752static int usb_get_langid(struct usb_device *dev, unsigned char *tbuf)
 753{
 754	int err;
 755
 756	if (dev->have_langid)
 757		return 0;
 758
 759	if (dev->string_langid < 0)
 760		return -EPIPE;
 761
 762	err = usb_string_sub(dev, 0, 0, tbuf);
 763
 764	/* If the string was reported but is malformed, default to english
 765	 * (0x0409) */
 766	if (err == -ENODATA || (err > 0 && err < 4)) {
 767		dev->string_langid = 0x0409;
 768		dev->have_langid = 1;
 769		dev_err(&dev->dev,
 770			"string descriptor 0 malformed (err = %d), "
 771			"defaulting to 0x%04x\n",
 772				err, dev->string_langid);
 773		return 0;
 774	}
 775
 776	/* In case of all other errors, we assume the device is not able to
 777	 * deal with strings at all. Set string_langid to -1 in order to
 778	 * prevent any string to be retrieved from the device */
 779	if (err < 0) {
 780		dev_err(&dev->dev, "string descriptor 0 read error: %d\n",
 781					err);
 782		dev->string_langid = -1;
 783		return -EPIPE;
 784	}
 785
 786	/* always use the first langid listed */
 787	dev->string_langid = tbuf[2] | (tbuf[3] << 8);
 788	dev->have_langid = 1;
 789	dev_dbg(&dev->dev, "default language 0x%04x\n",
 790				dev->string_langid);
 791	return 0;
 792}
 793
 794/**
 795 * usb_string - returns UTF-8 version of a string descriptor
 796 * @dev: the device whose string descriptor is being retrieved
 797 * @index: the number of the descriptor
 798 * @buf: where to put the string
 799 * @size: how big is "buf"?
 800 * Context: !in_interrupt ()
 801 *
 802 * This converts the UTF-16LE encoded strings returned by devices, from
 803 * usb_get_string_descriptor(), to null-terminated UTF-8 encoded ones
 804 * that are more usable in most kernel contexts.  Note that this function
 805 * chooses strings in the first language supported by the device.
 806 *
 807 * This call is synchronous, and may not be used in an interrupt context.
 808 *
 809 * Returns length of the string (>= 0) or usb_control_msg status (< 0).
 810 */
 811int usb_string(struct usb_device *dev, int index, char *buf, size_t size)
 812{
 813	unsigned char *tbuf;
 814	int err;
 815
 816	if (dev->state == USB_STATE_SUSPENDED)
 817		return -EHOSTUNREACH;
 818	if (size <= 0 || !buf || !index)
 819		return -EINVAL;
 820	buf[0] = 0;
 821	tbuf = kmalloc(256, GFP_NOIO);
 822	if (!tbuf)
 823		return -ENOMEM;
 824
 825	err = usb_get_langid(dev, tbuf);
 826	if (err < 0)
 827		goto errout;
 828
 829	err = usb_string_sub(dev, dev->string_langid, index, tbuf);
 830	if (err < 0)
 831		goto errout;
 832
 833	size--;		/* leave room for trailing NULL char in output buffer */
 834	err = utf16s_to_utf8s((wchar_t *) &tbuf[2], (err - 2) / 2,
 835			UTF16_LITTLE_ENDIAN, buf, size);
 836	buf[err] = 0;
 837
 838	if (tbuf[1] != USB_DT_STRING)
 839		dev_dbg(&dev->dev,
 840			"wrong descriptor type %02x for string %d (\"%s\")\n",
 841			tbuf[1], index, buf);
 842
 843 errout:
 844	kfree(tbuf);
 845	return err;
 846}
 847EXPORT_SYMBOL_GPL(usb_string);
 848
 849/* one UTF-8-encoded 16-bit character has at most three bytes */
 850#define MAX_USB_STRING_SIZE (127 * 3 + 1)
 851
 852/**
 853 * usb_cache_string - read a string descriptor and cache it for later use
 854 * @udev: the device whose string descriptor is being read
 855 * @index: the descriptor index
 856 *
 857 * Returns a pointer to a kmalloc'ed buffer containing the descriptor string,
 858 * or NULL if the index is 0 or the string could not be read.
 859 */
 860char *usb_cache_string(struct usb_device *udev, int index)
 861{
 862	char *buf;
 863	char *smallbuf = NULL;
 864	int len;
 865
 866	if (index <= 0)
 867		return NULL;
 868
 869	buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
 870	if (buf) {
 871		len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
 872		if (len > 0) {
 873			smallbuf = kmalloc(++len, GFP_NOIO);
 874			if (!smallbuf)
 875				return buf;
 876			memcpy(smallbuf, buf, len);
 877		}
 878		kfree(buf);
 879	}
 880	return smallbuf;
 881}
 882
 883/*
 884 * usb_get_device_descriptor - (re)reads the device descriptor (usbcore)
 885 * @dev: the device whose device descriptor is being updated
 886 * @size: how much of the descriptor to read
 887 * Context: !in_interrupt ()
 888 *
 889 * Updates the copy of the device descriptor stored in the device structure,
 890 * which dedicates space for this purpose.
 891 *
 892 * Not exported, only for use by the core.  If drivers really want to read
 893 * the device descriptor directly, they can call usb_get_descriptor() with
 894 * type = USB_DT_DEVICE and index = 0.
 895 *
 896 * This call is synchronous, and may not be used in an interrupt context.
 897 *
 898 * Returns the number of bytes received on success, or else the status code
 899 * returned by the underlying usb_control_msg() call.
 900 */
 901int usb_get_device_descriptor(struct usb_device *dev, unsigned int size)
 902{
 903	struct usb_device_descriptor *desc;
 904	int ret;
 905
 906	if (size > sizeof(*desc))
 907		return -EINVAL;
 908	desc = kmalloc(sizeof(*desc), GFP_NOIO);
 909	if (!desc)
 910		return -ENOMEM;
 911
 912	ret = usb_get_descriptor(dev, USB_DT_DEVICE, 0, desc, size);
 913	if (ret >= 0)
 914		memcpy(&dev->descriptor, desc, size);
 915	kfree(desc);
 916	return ret;
 917}
 918
 919/**
 920 * usb_get_status - issues a GET_STATUS call
 921 * @dev: the device whose status is being checked
 922 * @type: USB_RECIP_*; for device, interface, or endpoint
 923 * @target: zero (for device), else interface or endpoint number
 924 * @data: pointer to two bytes of bitmap data
 925 * Context: !in_interrupt ()
 926 *
 927 * Returns device, interface, or endpoint status.  Normally only of
 928 * interest to see if the device is self powered, or has enabled the
 929 * remote wakeup facility; or whether a bulk or interrupt endpoint
 930 * is halted ("stalled").
 931 *
 932 * Bits in these status bitmaps are set using the SET_FEATURE request,
 933 * and cleared using the CLEAR_FEATURE request.  The usb_clear_halt()
 934 * function should be used to clear halt ("stall") status.
 935 *
 936 * This call is synchronous, and may not be used in an interrupt context.
 937 *
 938 * Returns the number of bytes received on success, or else the status code
 939 * returned by the underlying usb_control_msg() call.
 940 */
 941int usb_get_status(struct usb_device *dev, int type, int target, void *data)
 942{
 943	int ret;
 944	u16 *status = kmalloc(sizeof(*status), GFP_KERNEL);
 945
 946	if (!status)
 947		return -ENOMEM;
 948
 949	ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
 950		USB_REQ_GET_STATUS, USB_DIR_IN | type, 0, target, status,
 951		sizeof(*status), USB_CTRL_GET_TIMEOUT);
 952
 953	*(u16 *)data = *status;
 
 
 
 
 
 954	kfree(status);
 955	return ret;
 956}
 957EXPORT_SYMBOL_GPL(usb_get_status);
 958
 959/**
 960 * usb_clear_halt - tells device to clear endpoint halt/stall condition
 961 * @dev: device whose endpoint is halted
 962 * @pipe: endpoint "pipe" being cleared
 963 * Context: !in_interrupt ()
 964 *
 965 * This is used to clear halt conditions for bulk and interrupt endpoints,
 966 * as reported by URB completion status.  Endpoints that are halted are
 967 * sometimes referred to as being "stalled".  Such endpoints are unable
 968 * to transmit or receive data until the halt status is cleared.  Any URBs
 969 * queued for such an endpoint should normally be unlinked by the driver
 970 * before clearing the halt condition, as described in sections 5.7.5
 971 * and 5.8.5 of the USB 2.0 spec.
 972 *
 973 * Note that control and isochronous endpoints don't halt, although control
 974 * endpoints report "protocol stall" (for unsupported requests) using the
 975 * same status code used to report a true stall.
 976 *
 977 * This call is synchronous, and may not be used in an interrupt context.
 978 *
 979 * Returns zero on success, or else the status code returned by the
 980 * underlying usb_control_msg() call.
 981 */
 982int usb_clear_halt(struct usb_device *dev, int pipe)
 983{
 984	int result;
 985	int endp = usb_pipeendpoint(pipe);
 986
 987	if (usb_pipein(pipe))
 988		endp |= USB_DIR_IN;
 989
 990	/* we don't care if it wasn't halted first. in fact some devices
 991	 * (like some ibmcam model 1 units) seem to expect hosts to make
 992	 * this request for iso endpoints, which can't halt!
 993	 */
 994	result = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
 995		USB_REQ_CLEAR_FEATURE, USB_RECIP_ENDPOINT,
 996		USB_ENDPOINT_HALT, endp, NULL, 0,
 997		USB_CTRL_SET_TIMEOUT);
 998
 999	/* don't un-halt or force to DATA0 except on success */
1000	if (result < 0)
1001		return result;
1002
1003	/* NOTE:  seems like Microsoft and Apple don't bother verifying
1004	 * the clear "took", so some devices could lock up if you check...
1005	 * such as the Hagiwara FlashGate DUAL.  So we won't bother.
1006	 *
1007	 * NOTE:  make sure the logic here doesn't diverge much from
1008	 * the copy in usb-storage, for as long as we need two copies.
1009	 */
1010
1011	usb_reset_endpoint(dev, endp);
1012
1013	return 0;
1014}
1015EXPORT_SYMBOL_GPL(usb_clear_halt);
1016
1017static int create_intf_ep_devs(struct usb_interface *intf)
1018{
1019	struct usb_device *udev = interface_to_usbdev(intf);
1020	struct usb_host_interface *alt = intf->cur_altsetting;
1021	int i;
1022
1023	if (intf->ep_devs_created || intf->unregistering)
1024		return 0;
1025
1026	for (i = 0; i < alt->desc.bNumEndpoints; ++i)
1027		(void) usb_create_ep_devs(&intf->dev, &alt->endpoint[i], udev);
1028	intf->ep_devs_created = 1;
1029	return 0;
1030}
1031
1032static void remove_intf_ep_devs(struct usb_interface *intf)
1033{
1034	struct usb_host_interface *alt = intf->cur_altsetting;
1035	int i;
1036
1037	if (!intf->ep_devs_created)
1038		return;
1039
1040	for (i = 0; i < alt->desc.bNumEndpoints; ++i)
1041		usb_remove_ep_devs(&alt->endpoint[i]);
1042	intf->ep_devs_created = 0;
1043}
1044
1045/**
1046 * usb_disable_endpoint -- Disable an endpoint by address
1047 * @dev: the device whose endpoint is being disabled
1048 * @epaddr: the endpoint's address.  Endpoint number for output,
1049 *	endpoint number + USB_DIR_IN for input
1050 * @reset_hardware: flag to erase any endpoint state stored in the
1051 *	controller hardware
1052 *
1053 * Disables the endpoint for URB submission and nukes all pending URBs.
1054 * If @reset_hardware is set then also deallocates hcd/hardware state
1055 * for the endpoint.
1056 */
1057void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr,
1058		bool reset_hardware)
1059{
1060	unsigned int epnum = epaddr & USB_ENDPOINT_NUMBER_MASK;
1061	struct usb_host_endpoint *ep;
1062
1063	if (!dev)
1064		return;
1065
1066	if (usb_endpoint_out(epaddr)) {
1067		ep = dev->ep_out[epnum];
1068		if (reset_hardware)
1069			dev->ep_out[epnum] = NULL;
1070	} else {
1071		ep = dev->ep_in[epnum];
1072		if (reset_hardware)
1073			dev->ep_in[epnum] = NULL;
1074	}
1075	if (ep) {
1076		ep->enabled = 0;
1077		usb_hcd_flush_endpoint(dev, ep);
1078		if (reset_hardware)
1079			usb_hcd_disable_endpoint(dev, ep);
1080	}
1081}
1082
1083/**
1084 * usb_reset_endpoint - Reset an endpoint's state.
1085 * @dev: the device whose endpoint is to be reset
1086 * @epaddr: the endpoint's address.  Endpoint number for output,
1087 *	endpoint number + USB_DIR_IN for input
1088 *
1089 * Resets any host-side endpoint state such as the toggle bit,
1090 * sequence number or current window.
1091 */
1092void usb_reset_endpoint(struct usb_device *dev, unsigned int epaddr)
1093{
1094	unsigned int epnum = epaddr & USB_ENDPOINT_NUMBER_MASK;
1095	struct usb_host_endpoint *ep;
1096
1097	if (usb_endpoint_out(epaddr))
1098		ep = dev->ep_out[epnum];
1099	else
1100		ep = dev->ep_in[epnum];
1101	if (ep)
1102		usb_hcd_reset_endpoint(dev, ep);
1103}
1104EXPORT_SYMBOL_GPL(usb_reset_endpoint);
1105
1106
1107/**
1108 * usb_disable_interface -- Disable all endpoints for an interface
1109 * @dev: the device whose interface is being disabled
1110 * @intf: pointer to the interface descriptor
1111 * @reset_hardware: flag to erase any endpoint state stored in the
1112 *	controller hardware
1113 *
1114 * Disables all the endpoints for the interface's current altsetting.
1115 */
1116void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf,
1117		bool reset_hardware)
1118{
1119	struct usb_host_interface *alt = intf->cur_altsetting;
1120	int i;
1121
1122	for (i = 0; i < alt->desc.bNumEndpoints; ++i) {
1123		usb_disable_endpoint(dev,
1124				alt->endpoint[i].desc.bEndpointAddress,
1125				reset_hardware);
1126	}
1127}
1128
1129/**
1130 * usb_disable_device - Disable all the endpoints for a USB device
1131 * @dev: the device whose endpoints are being disabled
1132 * @skip_ep0: 0 to disable endpoint 0, 1 to skip it.
1133 *
1134 * Disables all the device's endpoints, potentially including endpoint 0.
1135 * Deallocates hcd/hardware state for the endpoints (nuking all or most
1136 * pending urbs) and usbcore state for the interfaces, so that usbcore
1137 * must usb_set_configuration() before any interfaces could be used.
1138 *
1139 * Must be called with hcd->bandwidth_mutex held.
1140 */
1141void usb_disable_device(struct usb_device *dev, int skip_ep0)
1142{
1143	int i;
1144	struct usb_hcd *hcd = bus_to_hcd(dev->bus);
1145
1146	/* getting rid of interfaces will disconnect
1147	 * any drivers bound to them (a key side effect)
1148	 */
1149	if (dev->actconfig) {
1150		/*
1151		 * FIXME: In order to avoid self-deadlock involving the
1152		 * bandwidth_mutex, we have to mark all the interfaces
1153		 * before unregistering any of them.
1154		 */
1155		for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++)
1156			dev->actconfig->interface[i]->unregistering = 1;
1157
1158		for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
1159			struct usb_interface	*interface;
1160
1161			/* remove this interface if it has been registered */
1162			interface = dev->actconfig->interface[i];
1163			if (!device_is_registered(&interface->dev))
1164				continue;
1165			dev_dbg(&dev->dev, "unregistering interface %s\n",
1166				dev_name(&interface->dev));
1167			remove_intf_ep_devs(interface);
1168			device_del(&interface->dev);
1169		}
1170
1171		/* Now that the interfaces are unbound, nobody should
1172		 * try to access them.
1173		 */
1174		for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
1175			put_device(&dev->actconfig->interface[i]->dev);
1176			dev->actconfig->interface[i] = NULL;
1177		}
 
 
 
 
 
 
1178		dev->actconfig = NULL;
1179		if (dev->state == USB_STATE_CONFIGURED)
1180			usb_set_device_state(dev, USB_STATE_ADDRESS);
1181	}
1182
1183	dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
1184		skip_ep0 ? "non-ep0" : "all");
1185	if (hcd->driver->check_bandwidth) {
1186		/* First pass: Cancel URBs, leave endpoint pointers intact. */
1187		for (i = skip_ep0; i < 16; ++i) {
1188			usb_disable_endpoint(dev, i, false);
1189			usb_disable_endpoint(dev, i + USB_DIR_IN, false);
1190		}
1191		/* Remove endpoints from the host controller internal state */
 
1192		usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
 
1193		/* Second pass: remove endpoint pointers */
1194	}
1195	for (i = skip_ep0; i < 16; ++i) {
1196		usb_disable_endpoint(dev, i, true);
1197		usb_disable_endpoint(dev, i + USB_DIR_IN, true);
1198	}
1199}
1200
1201/**
1202 * usb_enable_endpoint - Enable an endpoint for USB communications
1203 * @dev: the device whose interface is being enabled
1204 * @ep: the endpoint
1205 * @reset_ep: flag to reset the endpoint state
1206 *
1207 * Resets the endpoint state if asked, and sets dev->ep_{in,out} pointers.
1208 * For control endpoints, both the input and output sides are handled.
1209 */
1210void usb_enable_endpoint(struct usb_device *dev, struct usb_host_endpoint *ep,
1211		bool reset_ep)
1212{
1213	int epnum = usb_endpoint_num(&ep->desc);
1214	int is_out = usb_endpoint_dir_out(&ep->desc);
1215	int is_control = usb_endpoint_xfer_control(&ep->desc);
1216
1217	if (reset_ep)
1218		usb_hcd_reset_endpoint(dev, ep);
1219	if (is_out || is_control)
1220		dev->ep_out[epnum] = ep;
1221	if (!is_out || is_control)
1222		dev->ep_in[epnum] = ep;
1223	ep->enabled = 1;
1224}
1225
1226/**
1227 * usb_enable_interface - Enable all the endpoints for an interface
1228 * @dev: the device whose interface is being enabled
1229 * @intf: pointer to the interface descriptor
1230 * @reset_eps: flag to reset the endpoints' state
1231 *
1232 * Enables all the endpoints for the interface's current altsetting.
1233 */
1234void usb_enable_interface(struct usb_device *dev,
1235		struct usb_interface *intf, bool reset_eps)
1236{
1237	struct usb_host_interface *alt = intf->cur_altsetting;
1238	int i;
1239
1240	for (i = 0; i < alt->desc.bNumEndpoints; ++i)
1241		usb_enable_endpoint(dev, &alt->endpoint[i], reset_eps);
1242}
1243
1244/**
1245 * usb_set_interface - Makes a particular alternate setting be current
1246 * @dev: the device whose interface is being updated
1247 * @interface: the interface being updated
1248 * @alternate: the setting being chosen.
1249 * Context: !in_interrupt ()
1250 *
1251 * This is used to enable data transfers on interfaces that may not
1252 * be enabled by default.  Not all devices support such configurability.
1253 * Only the driver bound to an interface may change its setting.
1254 *
1255 * Within any given configuration, each interface may have several
1256 * alternative settings.  These are often used to control levels of
1257 * bandwidth consumption.  For example, the default setting for a high
1258 * speed interrupt endpoint may not send more than 64 bytes per microframe,
1259 * while interrupt transfers of up to 3KBytes per microframe are legal.
1260 * Also, isochronous endpoints may never be part of an
1261 * interface's default setting.  To access such bandwidth, alternate
1262 * interface settings must be made current.
1263 *
1264 * Note that in the Linux USB subsystem, bandwidth associated with
1265 * an endpoint in a given alternate setting is not reserved until an URB
1266 * is submitted that needs that bandwidth.  Some other operating systems
1267 * allocate bandwidth early, when a configuration is chosen.
1268 *
1269 * This call is synchronous, and may not be used in an interrupt context.
1270 * Also, drivers must not change altsettings while urbs are scheduled for
1271 * endpoints in that interface; all such urbs must first be completed
1272 * (perhaps forced by unlinking).
1273 *
1274 * Returns zero on success, or else the status code returned by the
1275 * underlying usb_control_msg() call.
1276 */
1277int usb_set_interface(struct usb_device *dev, int interface, int alternate)
1278{
1279	struct usb_interface *iface;
1280	struct usb_host_interface *alt;
1281	struct usb_hcd *hcd = bus_to_hcd(dev->bus);
1282	int ret;
1283	int manual = 0;
1284	unsigned int epaddr;
1285	unsigned int pipe;
1286
1287	if (dev->state == USB_STATE_SUSPENDED)
1288		return -EHOSTUNREACH;
1289
1290	iface = usb_ifnum_to_if(dev, interface);
1291	if (!iface) {
1292		dev_dbg(&dev->dev, "selecting invalid interface %d\n",
1293			interface);
1294		return -EINVAL;
1295	}
1296	if (iface->unregistering)
1297		return -ENODEV;
1298
1299	alt = usb_altnum_to_altsetting(iface, alternate);
1300	if (!alt) {
1301		dev_warn(&dev->dev, "selecting invalid altsetting %d\n",
1302			 alternate);
1303		return -EINVAL;
1304	}
1305
1306	/* Make sure we have enough bandwidth for this alternate interface.
1307	 * Remove the current alt setting and add the new alt setting.
1308	 */
1309	mutex_lock(hcd->bandwidth_mutex);
 
 
 
 
 
 
 
 
 
 
 
 
1310	ret = usb_hcd_alloc_bandwidth(dev, NULL, iface->cur_altsetting, alt);
1311	if (ret < 0) {
1312		dev_info(&dev->dev, "Not enough bandwidth for altsetting %d\n",
1313				alternate);
 
1314		mutex_unlock(hcd->bandwidth_mutex);
1315		return ret;
1316	}
1317
1318	if (dev->quirks & USB_QUIRK_NO_SET_INTF)
1319		ret = -EPIPE;
1320	else
1321		ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
1322				   USB_REQ_SET_INTERFACE, USB_RECIP_INTERFACE,
1323				   alternate, interface, NULL, 0, 5000);
1324
1325	/* 9.4.10 says devices don't need this and are free to STALL the
1326	 * request if the interface only has one alternate setting.
1327	 */
1328	if (ret == -EPIPE && iface->num_altsetting == 1) {
1329		dev_dbg(&dev->dev,
1330			"manual set_interface for iface %d, alt %d\n",
1331			interface, alternate);
1332		manual = 1;
1333	} else if (ret < 0) {
1334		/* Re-instate the old alt setting */
1335		usb_hcd_alloc_bandwidth(dev, NULL, alt, iface->cur_altsetting);
 
1336		mutex_unlock(hcd->bandwidth_mutex);
1337		return ret;
1338	}
1339	mutex_unlock(hcd->bandwidth_mutex);
1340
1341	/* FIXME drivers shouldn't need to replicate/bugfix the logic here
1342	 * when they implement async or easily-killable versions of this or
1343	 * other "should-be-internal" functions (like clear_halt).
1344	 * should hcd+usbcore postprocess control requests?
1345	 */
1346
1347	/* prevent submissions using previous endpoint settings */
1348	if (iface->cur_altsetting != alt) {
1349		remove_intf_ep_devs(iface);
1350		usb_remove_sysfs_intf_files(iface);
1351	}
1352	usb_disable_interface(dev, iface, true);
1353
1354	iface->cur_altsetting = alt;
1355
 
 
 
1356	/* If the interface only has one altsetting and the device didn't
1357	 * accept the request, we attempt to carry out the equivalent action
1358	 * by manually clearing the HALT feature for each endpoint in the
1359	 * new altsetting.
1360	 */
1361	if (manual) {
1362		int i;
1363
1364		for (i = 0; i < alt->desc.bNumEndpoints; i++) {
1365			epaddr = alt->endpoint[i].desc.bEndpointAddress;
1366			pipe = __create_pipe(dev,
1367					USB_ENDPOINT_NUMBER_MASK & epaddr) |
1368					(usb_endpoint_out(epaddr) ?
1369					USB_DIR_OUT : USB_DIR_IN);
1370
1371			usb_clear_halt(dev, pipe);
1372		}
1373	}
1374
1375	/* 9.1.1.5: reset toggles for all endpoints in the new altsetting
1376	 *
1377	 * Note:
1378	 * Despite EP0 is always present in all interfaces/AS, the list of
1379	 * endpoints from the descriptor does not contain EP0. Due to its
1380	 * omnipresence one might expect EP0 being considered "affected" by
1381	 * any SetInterface request and hence assume toggles need to be reset.
1382	 * However, EP0 toggles are re-synced for every individual transfer
1383	 * during the SETUP stage - hence EP0 toggles are "don't care" here.
1384	 * (Likewise, EP0 never "halts" on well designed devices.)
1385	 */
1386	usb_enable_interface(dev, iface, true);
1387	if (device_is_registered(&iface->dev)) {
1388		usb_create_sysfs_intf_files(iface);
1389		create_intf_ep_devs(iface);
1390	}
1391	return 0;
1392}
1393EXPORT_SYMBOL_GPL(usb_set_interface);
1394
1395/**
1396 * usb_reset_configuration - lightweight device reset
1397 * @dev: the device whose configuration is being reset
1398 *
1399 * This issues a standard SET_CONFIGURATION request to the device using
1400 * the current configuration.  The effect is to reset most USB-related
1401 * state in the device, including interface altsettings (reset to zero),
1402 * endpoint halts (cleared), and endpoint state (only for bulk and interrupt
1403 * endpoints).  Other usbcore state is unchanged, including bindings of
1404 * usb device drivers to interfaces.
1405 *
1406 * Because this affects multiple interfaces, avoid using this with composite
1407 * (multi-interface) devices.  Instead, the driver for each interface may
1408 * use usb_set_interface() on the interfaces it claims.  Be careful though;
1409 * some devices don't support the SET_INTERFACE request, and others won't
1410 * reset all the interface state (notably endpoint state).  Resetting the whole
1411 * configuration would affect other drivers' interfaces.
1412 *
1413 * The caller must own the device lock.
1414 *
1415 * Returns zero on success, else a negative error code.
1416 */
1417int usb_reset_configuration(struct usb_device *dev)
1418{
1419	int			i, retval;
1420	struct usb_host_config	*config;
1421	struct usb_hcd *hcd = bus_to_hcd(dev->bus);
1422
1423	if (dev->state == USB_STATE_SUSPENDED)
1424		return -EHOSTUNREACH;
1425
1426	/* caller must have locked the device and must own
1427	 * the usb bus readlock (so driver bindings are stable);
1428	 * calls during probe() are fine
1429	 */
1430
1431	for (i = 1; i < 16; ++i) {
1432		usb_disable_endpoint(dev, i, true);
1433		usb_disable_endpoint(dev, i + USB_DIR_IN, true);
1434	}
1435
1436	config = dev->actconfig;
1437	retval = 0;
1438	mutex_lock(hcd->bandwidth_mutex);
 
 
 
 
 
 
 
 
1439	/* Make sure we have enough bandwidth for each alternate setting 0 */
1440	for (i = 0; i < config->desc.bNumInterfaces; i++) {
1441		struct usb_interface *intf = config->interface[i];
1442		struct usb_host_interface *alt;
1443
1444		alt = usb_altnum_to_altsetting(intf, 0);
1445		if (!alt)
1446			alt = &intf->altsetting[0];
1447		if (alt != intf->cur_altsetting)
1448			retval = usb_hcd_alloc_bandwidth(dev, NULL,
1449					intf->cur_altsetting, alt);
1450		if (retval < 0)
1451			break;
1452	}
1453	/* If not, reinstate the old alternate settings */
1454	if (retval < 0) {
1455reset_old_alts:
1456		for (i--; i >= 0; i--) {
1457			struct usb_interface *intf = config->interface[i];
1458			struct usb_host_interface *alt;
1459
1460			alt = usb_altnum_to_altsetting(intf, 0);
1461			if (!alt)
1462				alt = &intf->altsetting[0];
1463			if (alt != intf->cur_altsetting)
1464				usb_hcd_alloc_bandwidth(dev, NULL,
1465						alt, intf->cur_altsetting);
1466		}
 
1467		mutex_unlock(hcd->bandwidth_mutex);
1468		return retval;
1469	}
1470	retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
1471			USB_REQ_SET_CONFIGURATION, 0,
1472			config->desc.bConfigurationValue, 0,
1473			NULL, 0, USB_CTRL_SET_TIMEOUT);
1474	if (retval < 0)
1475		goto reset_old_alts;
1476	mutex_unlock(hcd->bandwidth_mutex);
1477
1478	/* re-init hc/hcd interface/endpoint state */
1479	for (i = 0; i < config->desc.bNumInterfaces; i++) {
1480		struct usb_interface *intf = config->interface[i];
1481		struct usb_host_interface *alt;
1482
1483		alt = usb_altnum_to_altsetting(intf, 0);
1484
1485		/* No altsetting 0?  We'll assume the first altsetting.
1486		 * We could use a GetInterface call, but if a device is
1487		 * so non-compliant that it doesn't have altsetting 0
1488		 * then I wouldn't trust its reply anyway.
1489		 */
1490		if (!alt)
1491			alt = &intf->altsetting[0];
1492
1493		if (alt != intf->cur_altsetting) {
1494			remove_intf_ep_devs(intf);
1495			usb_remove_sysfs_intf_files(intf);
1496		}
1497		intf->cur_altsetting = alt;
1498		usb_enable_interface(dev, intf, true);
1499		if (device_is_registered(&intf->dev)) {
1500			usb_create_sysfs_intf_files(intf);
1501			create_intf_ep_devs(intf);
1502		}
1503	}
 
 
1504	return 0;
1505}
1506EXPORT_SYMBOL_GPL(usb_reset_configuration);
1507
1508static void usb_release_interface(struct device *dev)
1509{
1510	struct usb_interface *intf = to_usb_interface(dev);
1511	struct usb_interface_cache *intfc =
1512			altsetting_to_usb_interface_cache(intf->altsetting);
1513
1514	kref_put(&intfc->ref, usb_release_interface_cache);
 
1515	kfree(intf);
1516}
1517
1518#ifdef	CONFIG_HOTPLUG
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1519static int usb_if_uevent(struct device *dev, struct kobj_uevent_env *env)
1520{
1521	struct usb_device *usb_dev;
1522	struct usb_interface *intf;
1523	struct usb_host_interface *alt;
1524
1525	intf = to_usb_interface(dev);
1526	usb_dev = interface_to_usbdev(intf);
1527	alt = intf->cur_altsetting;
1528
1529	if (add_uevent_var(env, "INTERFACE=%d/%d/%d",
1530		   alt->desc.bInterfaceClass,
1531		   alt->desc.bInterfaceSubClass,
1532		   alt->desc.bInterfaceProtocol))
1533		return -ENOMEM;
1534
1535	if (add_uevent_var(env,
1536		   "MODALIAS=usb:"
1537		   "v%04Xp%04Xd%04Xdc%02Xdsc%02Xdp%02Xic%02Xisc%02Xip%02X",
1538		   le16_to_cpu(usb_dev->descriptor.idVendor),
1539		   le16_to_cpu(usb_dev->descriptor.idProduct),
1540		   le16_to_cpu(usb_dev->descriptor.bcdDevice),
1541		   usb_dev->descriptor.bDeviceClass,
1542		   usb_dev->descriptor.bDeviceSubClass,
1543		   usb_dev->descriptor.bDeviceProtocol,
1544		   alt->desc.bInterfaceClass,
1545		   alt->desc.bInterfaceSubClass,
1546		   alt->desc.bInterfaceProtocol))
 
1547		return -ENOMEM;
1548
1549	return 0;
1550}
1551
1552#else
1553
1554static int usb_if_uevent(struct device *dev, struct kobj_uevent_env *env)
1555{
1556	return -ENODEV;
1557}
1558#endif	/* CONFIG_HOTPLUG */
1559
1560struct device_type usb_if_device_type = {
1561	.name =		"usb_interface",
1562	.release =	usb_release_interface,
1563	.uevent =	usb_if_uevent,
1564};
1565
1566static struct usb_interface_assoc_descriptor *find_iad(struct usb_device *dev,
1567						struct usb_host_config *config,
1568						u8 inum)
1569{
1570	struct usb_interface_assoc_descriptor *retval = NULL;
1571	struct usb_interface_assoc_descriptor *intf_assoc;
1572	int first_intf;
1573	int last_intf;
1574	int i;
1575
1576	for (i = 0; (i < USB_MAXIADS && config->intf_assoc[i]); i++) {
1577		intf_assoc = config->intf_assoc[i];
1578		if (intf_assoc->bInterfaceCount == 0)
1579			continue;
1580
1581		first_intf = intf_assoc->bFirstInterface;
1582		last_intf = first_intf + (intf_assoc->bInterfaceCount - 1);
1583		if (inum >= first_intf && inum <= last_intf) {
1584			if (!retval)
1585				retval = intf_assoc;
1586			else
1587				dev_err(&dev->dev, "Interface #%d referenced"
1588					" by multiple IADs\n", inum);
1589		}
1590	}
1591
1592	return retval;
1593}
1594
1595
1596/*
1597 * Internal function to queue a device reset
1598 *
1599 * This is initialized into the workstruct in 'struct
1600 * usb_device->reset_ws' that is launched by
1601 * message.c:usb_set_configuration() when initializing each 'struct
1602 * usb_interface'.
1603 *
1604 * It is safe to get the USB device without reference counts because
1605 * the life cycle of @iface is bound to the life cycle of @udev. Then,
1606 * this function will be ran only if @iface is alive (and before
1607 * freeing it any scheduled instances of it will have been cancelled).
1608 *
1609 * We need to set a flag (usb_dev->reset_running) because when we call
1610 * the reset, the interfaces might be unbound. The current interface
1611 * cannot try to remove the queued work as it would cause a deadlock
1612 * (you cannot remove your work from within your executing
1613 * workqueue). This flag lets it know, so that
1614 * usb_cancel_queued_reset() doesn't try to do it.
1615 *
1616 * See usb_queue_reset_device() for more details
1617 */
1618static void __usb_queue_reset_device(struct work_struct *ws)
1619{
1620	int rc;
1621	struct usb_interface *iface =
1622		container_of(ws, struct usb_interface, reset_ws);
1623	struct usb_device *udev = interface_to_usbdev(iface);
1624
1625	rc = usb_lock_device_for_reset(udev, iface);
1626	if (rc >= 0) {
1627		iface->reset_running = 1;
1628		usb_reset_device(udev);
1629		iface->reset_running = 0;
1630		usb_unlock_device(udev);
1631	}
 
1632}
1633
1634
1635/*
1636 * usb_set_configuration - Makes a particular device setting be current
1637 * @dev: the device whose configuration is being updated
1638 * @configuration: the configuration being chosen.
1639 * Context: !in_interrupt(), caller owns the device lock
1640 *
1641 * This is used to enable non-default device modes.  Not all devices
1642 * use this kind of configurability; many devices only have one
1643 * configuration.
1644 *
1645 * @configuration is the value of the configuration to be installed.
1646 * According to the USB spec (e.g. section 9.1.1.5), configuration values
1647 * must be non-zero; a value of zero indicates that the device in
1648 * unconfigured.  However some devices erroneously use 0 as one of their
1649 * configuration values.  To help manage such devices, this routine will
1650 * accept @configuration = -1 as indicating the device should be put in
1651 * an unconfigured state.
1652 *
1653 * USB device configurations may affect Linux interoperability,
1654 * power consumption and the functionality available.  For example,
1655 * the default configuration is limited to using 100mA of bus power,
1656 * so that when certain device functionality requires more power,
1657 * and the device is bus powered, that functionality should be in some
1658 * non-default device configuration.  Other device modes may also be
1659 * reflected as configuration options, such as whether two ISDN
1660 * channels are available independently; and choosing between open
1661 * standard device protocols (like CDC) or proprietary ones.
1662 *
1663 * Note that a non-authorized device (dev->authorized == 0) will only
1664 * be put in unconfigured mode.
1665 *
1666 * Note that USB has an additional level of device configurability,
1667 * associated with interfaces.  That configurability is accessed using
1668 * usb_set_interface().
1669 *
1670 * This call is synchronous. The calling context must be able to sleep,
1671 * must own the device lock, and must not hold the driver model's USB
1672 * bus mutex; usb interface driver probe() methods cannot use this routine.
1673 *
1674 * Returns zero on success, or else the status code returned by the
1675 * underlying call that failed.  On successful completion, each interface
1676 * in the original device configuration has been destroyed, and each one
1677 * in the new configuration has been probed by all relevant usb device
1678 * drivers currently known to the kernel.
1679 */
1680int usb_set_configuration(struct usb_device *dev, int configuration)
1681{
1682	int i, ret;
1683	struct usb_host_config *cp = NULL;
1684	struct usb_interface **new_interfaces = NULL;
1685	struct usb_hcd *hcd = bus_to_hcd(dev->bus);
1686	int n, nintf;
1687
1688	if (dev->authorized == 0 || configuration == -1)
1689		configuration = 0;
1690	else {
1691		for (i = 0; i < dev->descriptor.bNumConfigurations; i++) {
1692			if (dev->config[i].desc.bConfigurationValue ==
1693					configuration) {
1694				cp = &dev->config[i];
1695				break;
1696			}
1697		}
1698	}
1699	if ((!cp && configuration != 0))
1700		return -EINVAL;
1701
1702	/* The USB spec says configuration 0 means unconfigured.
1703	 * But if a device includes a configuration numbered 0,
1704	 * we will accept it as a correctly configured state.
1705	 * Use -1 if you really want to unconfigure the device.
1706	 */
1707	if (cp && configuration == 0)
1708		dev_warn(&dev->dev, "config 0 descriptor??\n");
1709
1710	/* Allocate memory for new interfaces before doing anything else,
1711	 * so that if we run out then nothing will have changed. */
1712	n = nintf = 0;
1713	if (cp) {
1714		nintf = cp->desc.bNumInterfaces;
1715		new_interfaces = kmalloc(nintf * sizeof(*new_interfaces),
1716				GFP_NOIO);
1717		if (!new_interfaces) {
1718			dev_err(&dev->dev, "Out of memory\n");
1719			return -ENOMEM;
1720		}
1721
1722		for (; n < nintf; ++n) {
1723			new_interfaces[n] = kzalloc(
1724					sizeof(struct usb_interface),
1725					GFP_NOIO);
1726			if (!new_interfaces[n]) {
1727				dev_err(&dev->dev, "Out of memory\n");
1728				ret = -ENOMEM;
1729free_interfaces:
1730				while (--n >= 0)
1731					kfree(new_interfaces[n]);
1732				kfree(new_interfaces);
1733				return ret;
1734			}
1735		}
1736
1737		i = dev->bus_mA - cp->desc.bMaxPower * 2;
1738		if (i < 0)
1739			dev_warn(&dev->dev, "new config #%d exceeds power "
1740					"limit by %dmA\n",
1741					configuration, -i);
1742	}
1743
1744	/* Wake up the device so we can send it the Set-Config request */
1745	ret = usb_autoresume_device(dev);
1746	if (ret)
1747		goto free_interfaces;
1748
1749	/* if it's already configured, clear out old state first.
1750	 * getting rid of old interfaces means unbinding their drivers.
1751	 */
1752	mutex_lock(hcd->bandwidth_mutex);
1753	if (dev->state != USB_STATE_ADDRESS)
1754		usb_disable_device(dev, 1);	/* Skip ep0 */
1755
1756	/* Get rid of pending async Set-Config requests for this device */
1757	cancel_async_set_config(dev);
1758
1759	/* Make sure we have bandwidth (and available HCD resources) for this
1760	 * configuration.  Remove endpoints from the schedule if we're dropping
1761	 * this configuration to set configuration 0.  After this point, the
1762	 * host controller will not allow submissions to dropped endpoints.  If
1763	 * this call fails, the device state is unchanged.
1764	 */
1765	ret = usb_hcd_alloc_bandwidth(dev, cp, NULL, NULL);
1766	if (ret < 0) {
 
 
 
 
 
1767		mutex_unlock(hcd->bandwidth_mutex);
1768		usb_autosuspend_device(dev);
1769		goto free_interfaces;
1770	}
1771
1772	ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
1773			      USB_REQ_SET_CONFIGURATION, 0, configuration, 0,
1774			      NULL, 0, USB_CTRL_SET_TIMEOUT);
1775	if (ret < 0) {
1776		/* All the old state is gone, so what else can we do?
1777		 * The device is probably useless now anyway.
1778		 */
1779		cp = NULL;
1780	}
1781
1782	dev->actconfig = cp;
1783	if (!cp) {
1784		usb_set_device_state(dev, USB_STATE_ADDRESS);
1785		usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
1786		mutex_unlock(hcd->bandwidth_mutex);
1787		usb_autosuspend_device(dev);
1788		goto free_interfaces;
1789	}
1790	mutex_unlock(hcd->bandwidth_mutex);
1791	usb_set_device_state(dev, USB_STATE_CONFIGURED);
1792
1793	/* Initialize the new interface structures and the
 
1794	 * hc/hcd/usbcore interface/endpoint state.
1795	 */
1796	for (i = 0; i < nintf; ++i) {
1797		struct usb_interface_cache *intfc;
1798		struct usb_interface *intf;
1799		struct usb_host_interface *alt;
1800
1801		cp->interface[i] = intf = new_interfaces[i];
1802		intfc = cp->intf_cache[i];
1803		intf->altsetting = intfc->altsetting;
1804		intf->num_altsetting = intfc->num_altsetting;
1805		intf->intf_assoc = find_iad(dev, cp, i);
1806		kref_get(&intfc->ref);
1807
1808		alt = usb_altnum_to_altsetting(intf, 0);
1809
1810		/* No altsetting 0?  We'll assume the first altsetting.
1811		 * We could use a GetInterface call, but if a device is
1812		 * so non-compliant that it doesn't have altsetting 0
1813		 * then I wouldn't trust its reply anyway.
1814		 */
1815		if (!alt)
1816			alt = &intf->altsetting[0];
1817
 
 
1818		intf->cur_altsetting = alt;
1819		usb_enable_interface(dev, intf, true);
1820		intf->dev.parent = &dev->dev;
1821		intf->dev.driver = NULL;
1822		intf->dev.bus = &usb_bus_type;
1823		intf->dev.type = &usb_if_device_type;
1824		intf->dev.groups = usb_interface_groups;
1825		intf->dev.dma_mask = dev->dev.dma_mask;
1826		INIT_WORK(&intf->reset_ws, __usb_queue_reset_device);
1827		intf->minor = -1;
1828		device_initialize(&intf->dev);
1829		pm_runtime_no_callbacks(&intf->dev);
1830		dev_set_name(&intf->dev, "%d-%s:%d.%d",
1831			dev->bus->busnum, dev->devpath,
1832			configuration, alt->desc.bInterfaceNumber);
 
1833	}
1834	kfree(new_interfaces);
1835
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1836	if (cp->string == NULL &&
1837			!(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
1838		cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
1839
 
 
 
 
 
1840	/* Now that all the interfaces are set up, register them
1841	 * to trigger binding of drivers to interfaces.  probe()
1842	 * routines may install different altsettings and may
1843	 * claim() any interfaces not yet bound.  Many class drivers
1844	 * need that: CDC, audio, video, etc.
1845	 */
1846	for (i = 0; i < nintf; ++i) {
1847		struct usb_interface *intf = cp->interface[i];
1848
1849		dev_dbg(&dev->dev,
1850			"adding %s (config #%d, interface %d)\n",
1851			dev_name(&intf->dev), configuration,
1852			intf->cur_altsetting->desc.bInterfaceNumber);
1853		device_enable_async_suspend(&intf->dev);
1854		ret = device_add(&intf->dev);
1855		if (ret != 0) {
1856			dev_err(&dev->dev, "device_add(%s) --> %d\n",
1857				dev_name(&intf->dev), ret);
1858			continue;
1859		}
1860		create_intf_ep_devs(intf);
1861	}
1862
1863	usb_autosuspend_device(dev);
1864	return 0;
1865}
 
1866
1867static LIST_HEAD(set_config_list);
1868static DEFINE_SPINLOCK(set_config_lock);
1869
1870struct set_config_request {
1871	struct usb_device	*udev;
1872	int			config;
1873	struct work_struct	work;
1874	struct list_head	node;
1875};
1876
1877/* Worker routine for usb_driver_set_configuration() */
1878static void driver_set_config_work(struct work_struct *work)
1879{
1880	struct set_config_request *req =
1881		container_of(work, struct set_config_request, work);
1882	struct usb_device *udev = req->udev;
1883
1884	usb_lock_device(udev);
1885	spin_lock(&set_config_lock);
1886	list_del(&req->node);
1887	spin_unlock(&set_config_lock);
1888
1889	if (req->config >= -1)		/* Is req still valid? */
1890		usb_set_configuration(udev, req->config);
1891	usb_unlock_device(udev);
1892	usb_put_dev(udev);
1893	kfree(req);
1894}
1895
1896/* Cancel pending Set-Config requests for a device whose configuration
1897 * was just changed
1898 */
1899static void cancel_async_set_config(struct usb_device *udev)
1900{
1901	struct set_config_request *req;
1902
1903	spin_lock(&set_config_lock);
1904	list_for_each_entry(req, &set_config_list, node) {
1905		if (req->udev == udev)
1906			req->config = -999;	/* Mark as cancelled */
1907	}
1908	spin_unlock(&set_config_lock);
1909}
1910
1911/**
1912 * usb_driver_set_configuration - Provide a way for drivers to change device configurations
1913 * @udev: the device whose configuration is being updated
1914 * @config: the configuration being chosen.
1915 * Context: In process context, must be able to sleep
1916 *
1917 * Device interface drivers are not allowed to change device configurations.
1918 * This is because changing configurations will destroy the interface the
1919 * driver is bound to and create new ones; it would be like a floppy-disk
1920 * driver telling the computer to replace the floppy-disk drive with a
1921 * tape drive!
1922 *
1923 * Still, in certain specialized circumstances the need may arise.  This
1924 * routine gets around the normal restrictions by using a work thread to
1925 * submit the change-config request.
1926 *
1927 * Returns 0 if the request was successfully queued, error code otherwise.
1928 * The caller has no way to know whether the queued request will eventually
1929 * succeed.
1930 */
1931int usb_driver_set_configuration(struct usb_device *udev, int config)
1932{
1933	struct set_config_request *req;
1934
1935	req = kmalloc(sizeof(*req), GFP_KERNEL);
1936	if (!req)
1937		return -ENOMEM;
1938	req->udev = udev;
1939	req->config = config;
1940	INIT_WORK(&req->work, driver_set_config_work);
1941
1942	spin_lock(&set_config_lock);
1943	list_add(&req->node, &set_config_list);
1944	spin_unlock(&set_config_lock);
1945
1946	usb_get_dev(udev);
1947	schedule_work(&req->work);
1948	return 0;
1949}
1950EXPORT_SYMBOL_GPL(usb_driver_set_configuration);