drivers/usb/input/hid-core.c

   1 /*
   2  *  USB HID support for Linux
   3  *
   4  *  Copyright (c) 1999 Andreas Gal
   5  *  Copyright (c) 2000-2001 Vojtech Pavlik <vojtech@suse.cz>
   6  */
   7
   8 /*
   9  * This program is free software; you can redistribute it and/or modify it
  10  * under the terms of the GNU General Public License as published by the Free
  11  * Software Foundation; either version 2 of the License, or (at your option)
  12  * any later version.
  13  */
  14
  15 #include <linux/module.h>
  16 #include <linux/slab.h>
  17 #include <linux/init.h>
  18 #include <linux/kernel.h>
  19 #include <linux/sched.h>
  20 #include <linux/list.h>
  21 #include <linux/mm.h>
  22 #include <linux/smp_lock.h>
  23 #include <linux/spinlock.h>
  24 #include <asm/unaligned.h>
  25 #include <asm/byteorder.h>
  26 #include <linux/input.h>
  27
  28 #undef DEBUG
  29 #undef DEBUG_DATA
  30
  31 #include <linux/usb.h>
  32
  33 #include "hid.h"
  34 #include <linux/hiddev.h>
  35
  36 /*
  37  * Version Information
  38  */
  39
  40 #define DRIVER_VERSION "v2.0"
  41 #define DRIVER_AUTHOR "Andreas Gal, Vojtech Pavlik"
  42 #define DRIVER_DESC "USB HID core driver"
  43 #define DRIVER_LICENSE "GPL"
  44
  45 static char *hid_types[] = {"Device", "Pointer", "Mouse", "Device", "Joystick",
  46                                 "Gamepad", "Keyboard", "Keypad", "Multi-Axis Controller"};
  47
  48 /*
  49  * Register a new report for a device.
  50  */
  51
  52 static struct hid_report *hid_register_report(struct hid_device *device, unsigned type, unsigned id)
  53 {
  54         struct hid_report_enum *report_enum = device->report_enum + type;
  55         struct hid_report *report;
  56
  57         if (report_enum->report_id_hash[id])
  58                 return report_enum->report_id_hash[id];
  59
  60         if (!(report = kmalloc(sizeof(struct hid_report), GFP_KERNEL)))
  61                 return NULL;
  62         memset(report, 0, sizeof(struct hid_report));
  63
  64         if (id != 0)
  65                 report_enum->numbered = 1;
  66
  67         report->id = id;
  68         report->type = type;
  69         report->size = 0;
  70         report->device = device;
  71         report_enum->report_id_hash[id] = report;
  72
  73         list_add_tail(&report->list, &report_enum->report_list);
  74
  75         return report;
  76 }
  77
  78 /*
  79  * Register a new field for this report.
  80  */
  81
  82 static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages, unsigned values)
  83 {
  84         struct hid_field *field;
  85
  86         if (report->maxfield == HID_MAX_FIELDS) {
  87                 dbg("too many fields in report");
  88                 return NULL;
  89         }
  90
  91         if (!(field = kmalloc(sizeof(struct hid_field) + usages * sizeof(struct hid_usage)
  92                 + values * sizeof(unsigned), GFP_KERNEL))) return NULL;
  93
  94         memset(field, 0, sizeof(struct hid_field) + usages * sizeof(struct hid_usage)
  95                 + values * sizeof(unsigned));
  96
  97         report->field[report->maxfield++] = field;
  98         field->usage = (struct hid_usage *)(field + 1);
  99         field->value = (unsigned *)(field->usage + usages);
 100         field->report = report;
 101
 102         return field;
 103 }
 104
 105 /*
 106  * Open a collection. The type/usage is pushed on the stack.
 107  */
 108
 109 static int open_collection(struct hid_parser *parser, unsigned type)
 110 {
 111         struct hid_collection *collection;
 112         unsigned usage;
 113
 114         usage = parser->local.usage[0];
 115
 116         if (parser->collection_stack_ptr == HID_COLLECTION_STACK_SIZE) {
 117                 dbg("collection stack overflow");
 118                 return -1;
 119         }
 120
 121         if (parser->device->maxcollection == parser->device->collection_size) {
 122                 collection = kmalloc(sizeof(struct hid_collection) *
 123                                      parser->device->collection_size * 2,
 124                                      GFP_KERNEL);
 125                 if (collection == NULL) {
 126                         dbg("failed to reallocate collection array");
 127                         return -1;
 128                 }
 129                 memcpy(collection, parser->device->collection,
 130                        sizeof(struct hid_collection) *
 131                        parser->device->collection_size);
 132                 memset(collection + parser->device->collection_size, 0,
 133                        sizeof(struct hid_collection) *
 134                        parser->device->collection_size);
 135                 kfree(parser->device->collection);
 136                 parser->device->collection = collection;
 137                 parser->device->collection_size *= 2;
 138         }
 139
 140         parser->collection_stack[parser->collection_stack_ptr++] =
 141                 parser->device->maxcollection;
 142
 143         collection = parser->device->collection +
 144                 parser->device->maxcollection++;
 145         collection->type = type;
 146         collection->usage = usage;
 147         collection->level = parser->collection_stack_ptr - 1;
 148
 149         if (type == HID_COLLECTION_APPLICATION)
 150                 parser->device->maxapplication++;
 151
 152         return 0;
 153 }
 154
 155 /*
 156  * Close a collection.
 157  */
 158
 159 static int close_collection(struct hid_parser *parser)
 160 {
 161         if (!parser->collection_stack_ptr) {
 162                 dbg("collection stack underflow");
 163                 return -1;
 164         }
 165         parser->collection_stack_ptr--;
 166         return 0;
 167 }
 168
 169 /*
 170  * Climb up the stack, search for the specified collection type
 171  * and return the usage.
 172  */
 173
 174 static unsigned hid_lookup_collection(struct hid_parser *parser, unsigned type)
 175 {
 176         int n;
 177         for (n = parser->collection_stack_ptr - 1; n >= 0; n--)
 178                 if (parser->device->collection[parser->collection_stack[n]].type == type)
 179                         return parser->device->collection[parser->collection_stack[n]].usage;
 180         return 0; /* we know nothing about this usage type */
 181 }
 182
 183 /*
 184  * Add a usage to the temporary parser table.
 185  */
 186
 187 static int hid_add_usage(struct hid_parser *parser, unsigned usage)
 188 {
 189         if (parser->local.usage_index >= HID_MAX_USAGES) {
 190                 dbg("usage index exceeded");
 191                 return -1;
 192         }
 193         parser->local.usage[parser->local.usage_index] = usage;
 194         parser->local.collection_index[parser->local.usage_index] =
 195                 parser->collection_stack_ptr ?
 196                 parser->collection_stack[parser->collection_stack_ptr - 1] : 0;
 197         parser->local.usage_index++;
 198         return 0;
 199 }
 200
 201 /*
 202  * Register a new field for this report.
 203  */
 204
 205 static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsigned flags)
 206 {
 207         struct hid_report *report;
 208         struct hid_field *field;
 209         int usages;
 210         unsigned offset;
 211         int i;
 212
 213         if (!(report = hid_register_report(parser->device, report_type, parser->global.report_id))) {
 214                 dbg("hid_register_report failed");
 215                 return -1;
 216         }
 217
 218         if (parser->global.logical_maximum < parser->global.logical_minimum) {
 219                 dbg("logical range invalid %d %d", parser->global.logical_minimum, parser->global.logical_maximum);
 220                 return -1;
 221         }
 222         usages = parser->local.usage_index;
 223
 224         offset = report->size;
 225         report->size += parser->global.report_size * parser->global.report_count;
 226
 227         if (usages == 0)
 228                 return 0; /* ignore padding fields */
 229
 230         if ((field = hid_register_field(report, usages, parser->global.report_count)) == NULL)
 231                 return 0;
 232
 233         field->physical = hid_lookup_collection(parser, HID_COLLECTION_PHYSICAL);
 234         field->logical = hid_lookup_collection(parser, HID_COLLECTION_LOGICAL);
 235         field->application = hid_lookup_collection(parser, HID_COLLECTION_APPLICATION);
 236
 237         for (i = 0; i < usages; i++) {
 238                 field->usage[i].hid = parser->local.usage[i];
 239                 field->usage[i].collection_index =
 240                         parser->local.collection_index[i];
 241         }
 242
 243         field->maxusage = usages;
 244         field->flags = flags;
 245         field->report_offset = offset;
 246         field->report_type = report_type;
 247         field->report_size = parser->global.report_size;
 248         field->report_count = parser->global.report_count;
 249         field->logical_minimum = parser->global.logical_minimum;
 250         field->logical_maximum = parser->global.logical_maximum;
 251         field->physical_minimum = parser->global.physical_minimum;
 252         field->physical_maximum = parser->global.physical_maximum;
 253         field->unit_exponent = parser->global.unit_exponent;
 254         field->unit = parser->global.unit;
 255
 256         return 0;
 257 }
 258
 259 /*
 260  * Read data value from item.
 261  */
 262
 263 static __inline__ __u32 item_udata(struct hid_item *item)
 264 {
 265         switch (item->size) {
 266                 case 1: return item->data.u8;
 267                 case 2: return item->data.u16;
 268                 case 4: return item->data.u32;
 269         }
 270         return 0;
 271 }
 272
 273 static __inline__ __s32 item_sdata(struct hid_item *item)
 274 {
 275         switch (item->size) {
 276                 case 1: return item->data.s8;
 277                 case 2: return item->data.s16;
 278                 case 4: return item->data.s32;
 279         }
 280         return 0;
 281 }
 282
 283 /*
 284  * Process a global item.
 285  */
 286
 287 static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
 288 {
 289         switch (item->tag) {
 290
 291                 case HID_GLOBAL_ITEM_TAG_PUSH:
 292
 293                         if (parser->global_stack_ptr == HID_GLOBAL_STACK_SIZE) {
 294                                 dbg("global enviroment stack overflow");
 295                                 return -1;
 296                         }
 297
 298                         memcpy(parser->global_stack + parser->global_stack_ptr++,
 299                                 &parser->global, sizeof(struct hid_global));
 300                         return 0;
 301
 302                 case HID_GLOBAL_ITEM_TAG_POP:
 303
 304                         if (!parser->global_stack_ptr) {
 305                                 dbg("global enviroment stack underflow");
 306                                 return -1;
 307                         }
 308
 309                         memcpy(&parser->global, parser->global_stack + --parser->global_stack_ptr,
 310                                 sizeof(struct hid_global));
 311                         return 0;
 312
 313                 case HID_GLOBAL_ITEM_TAG_USAGE_PAGE:
 314                         parser->global.usage_page = item_udata(item);
 315                         return 0;
 316
 317                 case HID_GLOBAL_ITEM_TAG_LOGICAL_MINIMUM:
 318                         parser->global.logical_minimum = item_sdata(item);
 319                         return 0;
 320
 321                 case HID_GLOBAL_ITEM_TAG_LOGICAL_MAXIMUM:
 322                         if (parser->global.logical_minimum < 0)
 323                                 parser->global.logical_maximum = item_sdata(item);
 324                         else
 325                                 parser->global.logical_maximum = item_udata(item);
 326                         return 0;
 327
 328                 case HID_GLOBAL_ITEM_TAG_PHYSICAL_MINIMUM:
 329                         parser->global.physical_minimum = item_sdata(item);
 330                         return 0;
 331
 332                 case HID_GLOBAL_ITEM_TAG_PHYSICAL_MAXIMUM:
 333                         if (parser->global.physical_minimum < 0)
 334                                 parser->global.physical_maximum = item_sdata(item);
 335                         else
 336                                 parser->global.physical_maximum = item_udata(item);
 337                         return 0;
 338
 339                 case HID_GLOBAL_ITEM_TAG_UNIT_EXPONENT:
 340                         parser->global.unit_exponent = item_sdata(item);
 341                         return 0;
 342
 343                 case HID_GLOBAL_ITEM_TAG_UNIT:
 344                         parser->global.unit = item_udata(item);
 345                         return 0;
 346
 347                 case HID_GLOBAL_ITEM_TAG_REPORT_SIZE:
 348                         if ((parser->global.report_size = item_udata(item)) > 32) {
 349                                 dbg("invalid report_size %d", parser->global.report_size);
 350                                 return -1;
 351                         }
 352                         return 0;
 353
 354                 case HID_GLOBAL_ITEM_TAG_REPORT_COUNT:
 355                         if ((parser->global.report_count = item_udata(item)) > HID_MAX_USAGES) {
 356                                 dbg("invalid report_count %d", parser->global.report_count);
 357                                 return -1;
 358                         }
 359                         return 0;
 360
 361                 case HID_GLOBAL_ITEM_TAG_REPORT_ID:
 362                         if ((parser->global.report_id = item_udata(item)) == 0) {
 363                                 dbg("report_id 0 is invalid");
 364                                 return -1;
 365                         }
 366                         return 0;
 367
 368                 default:
 369                         dbg("unknown global tag 0x%x", item->tag);
 370                         return -1;
 371         }
 372 }
 373
 374 /*
 375  * Process a local item.
 376  */
 377
 378 static int hid_parser_local(struct hid_parser *parser, struct hid_item *item)
 379 {
 380         __u32 data;
 381         unsigned n;
 382
 383         if (item->size == 0) {
 384                 dbg("item data expected for local item");
 385                 return -1;
 386         }
 387
 388         data = item_udata(item);
 389
 390         switch (item->tag) {
 391
 392                 case HID_LOCAL_ITEM_TAG_DELIMITER:
 393
 394                         if (data) {
 395                                 /*
 396                                  * We treat items before the first delimiter
 397                                  * as global to all usage sets (branch 0).
 398                                  * In the moment we process only these global
 399                                  * items and the first delimiter set.
 400                                  */
 401                                 if (parser->local.delimiter_depth != 0) {
 402                                         dbg("nested delimiters");
 403                                         return -1;
 404                                 }
 405                                 parser->local.delimiter_depth++;
 406                                 parser->local.delimiter_branch++;
 407                         } else {
 408                                 if (parser->local.delimiter_depth < 1) {
 409                                         dbg("bogus close delimiter");
 410                                         return -1;
 411                                 }
 412                                 parser->local.delimiter_depth--;
 413                         }
 414                         return 1;
 415
 416                 case HID_LOCAL_ITEM_TAG_USAGE:
 417
 418                         if (parser->local.delimiter_branch > 1) {
 419                                 dbg("alternative usage ignored");
 420                                 return 0;
 421                         }
 422
 423                         if (item->size <= 2)
 424                                 data = (parser->global.usage_page << 16) + data;
 425
 426                         return hid_add_usage(parser, data);
 427
 428                 case HID_LOCAL_ITEM_TAG_USAGE_MINIMUM:
 429
 430                         if (parser->local.delimiter_branch > 1) {
 431                                 dbg("alternative usage ignored");
 432                                 return 0;
 433                         }
 434
 435                         if (item->size <= 2)
 436                                 data = (parser->global.usage_page << 16) + data;
 437
 438                         parser->local.usage_minimum = data;
 439                         return 0;
 440
 441                 case HID_LOCAL_ITEM_TAG_USAGE_MAXIMUM:
 442
 443                         if (parser->local.delimiter_branch > 1) {
 444                                 dbg("alternative usage ignored");
 445                                 return 0;
 446                         }
 447
 448                         if (item->size <= 2)
 449                                 data = (parser->global.usage_page << 16) + data;
 450
 451                         for (n = parser->local.usage_minimum; n <= data; n++)
 452                                 if (hid_add_usage(parser, n)) {
 453                                         dbg("hid_add_usage failed\n");
 454                                         return -1;
 455                                 }
 456                         return 0;
 457
 458                 default:
 459
 460                         dbg("unknown local item tag 0x%x", item->tag);
 461                         return 0;
 462         }
 463         return 0;
 464 }
 465
 466 /*
 467  * Process a main item.
 468  */
 469
 470 static int hid_parser_main(struct hid_parser *parser, struct hid_item *item)
 471 {
 472         __u32 data;
 473         int ret;
 474
 475         data = item_udata(item);
 476
 477         switch (item->tag) {
 478                 case HID_MAIN_ITEM_TAG_BEGIN_COLLECTION:
 479                         ret = open_collection(parser, data & 0xff);
 480                         break;
 481                 case HID_MAIN_ITEM_TAG_END_COLLECTION:
 482                         ret = close_collection(parser);
 483                         break;
 484                 case HID_MAIN_ITEM_TAG_INPUT:
 485                         ret = hid_add_field(parser, HID_INPUT_REPORT, data);
 486                         break;
 487                 case HID_MAIN_ITEM_TAG_OUTPUT:
 488                         ret = hid_add_field(parser, HID_OUTPUT_REPORT, data);
 489                         break;
 490                 case HID_MAIN_ITEM_TAG_FEATURE:
 491                         ret = hid_add_field(parser, HID_FEATURE_REPORT, data);
 492                         break;
 493                 default:
 494                         dbg("unknown main item tag 0x%x", item->tag);
 495                         ret = 0;
 496         }
 497
 498         memset(&parser->local, 0, sizeof(parser->local));       /* Reset the local parser environment */
 499
 500         return ret;
 501 }
 502
 503 /*
 504  * Process a reserved item.
 505  */
 506
 507 static int hid_parser_reserved(struct hid_parser *parser, struct hid_item *item)
 508 {
 509         dbg("reserved item type, tag 0x%x", item->tag);
 510         return 0;
 511 }
 512
 513 /*
 514  * Free a report and all registered fields. The field->usage and
 515  * field->value table's are allocated behind the field, so we need
 516  * only to free(field) itself.
 517  */
 518
 519 static void hid_free_report(struct hid_report *report)
 520 {
 521         unsigned n;
 522
 523         for (n = 0; n < report->maxfield; n++)
 524                 kfree(report->field[n]);
 525         kfree(report);
 526 }
 527
 528 /*
 529  * Free a device structure, all reports, and all fields.
 530  */
 531
 532 static void hid_free_device(struct hid_device *device)
 533 {
 534         unsigned i,j;
 535
 536         hid_ff_exit(device);
 537
 538         for (i = 0; i < HID_REPORT_TYPES; i++) {
 539                 struct hid_report_enum *report_enum = device->report_enum + i;
 540
 541                 for (j = 0; j < 256; j++) {
 542                         struct hid_report *report = report_enum->report_id_hash[j];
 543                         if (report)
 544                                 hid_free_report(report);
 545                 }
 546         }
 547
 548         if (device->rdesc)
 549                 kfree(device->rdesc);
 550         kfree(device);
 551 }
 552
 553 /*
 554  * Fetch a report description item from the data stream. We support long
 555  * items, though they are not used yet.
 556  */
 557
 558 static u8 *fetch_item(__u8 *start, __u8 *end, struct hid_item *item)
 559 {
 560         u8 b;
 561
 562         if ((end - start) <= 0)
 563                 return NULL;
 564
 565         b = *start++;
 566
 567         item->type = (b >> 2) & 3;
 568         item->tag  = (b >> 4) & 15;
 569
 570         if (item->tag == HID_ITEM_TAG_LONG) {
 571
 572                 item->format = HID_ITEM_FORMAT_LONG;
 573
 574                 if ((end - start) < 2)
 575                         return NULL;
 576
 577                 item->size = *start++;
 578                 item->tag  = *start++;
 579
 580                 if ((end - start) < item->size)
 581                         return NULL;
 582
 583                 item->data.longdata = start;
 584                 start += item->size;
 585                 return start;
 586         }
 587
 588         item->format = HID_ITEM_FORMAT_SHORT;
 589         item->size = b & 3;
 590
 591         switch (item->size) {
 592
 593                 case 0:
 594                         return start;
 595
 596                 case 1:
 597                         if ((end - start) < 1)
 598                                 return NULL;
 599                         item->data.u8 = *start++;
 600                         return start;
 601
 602                 case 2:
 603                         if ((end - start) < 2)
 604                                 return NULL;
 605                         item->data.u16 = le16_to_cpu(get_unaligned(((__u16*)start)++));
 606                         return start;
 607
 608                 case 3:
 609                         item->size++;
 610                         if ((end - start) < 4)
 611                                 return NULL;
 612                         item->data.u32 = le32_to_cpu(get_unaligned(((__u32*)start)++));
 613                         return start;
 614         }
 615
 616         return NULL;
 617 }
 618
 619 /*
 620  * Parse a report description into a hid_device structure. Reports are
 621  * enumerated, fields are attached to these reports.
 622  */
 623
 624 static struct hid_device *hid_parse_report(__u8 *start, unsigned size)
 625 {
 626         struct hid_device *device;
 627         struct hid_parser *parser;
 628         struct hid_item item;
 629         __u8 *end;
 630         unsigned i;
 631         static int (*dispatch_type[])(struct hid_parser *parser,
 632                                       struct hid_item *item) = {
 633                 hid_parser_main,
 634                 hid_parser_global,
 635                 hid_parser_local,
 636                 hid_parser_reserved
 637         };
 638
 639         if (!(device = kmalloc(sizeof(struct hid_device), GFP_KERNEL)))
 640                 return NULL;
 641         memset(device, 0, sizeof(struct hid_device));
 642
 643         if (!(device->collection =kmalloc(sizeof(struct hid_collection) *
 644                                    HID_DEFAULT_NUM_COLLECTIONS, GFP_KERNEL))) {
 645                 kfree(device);
 646                 return NULL;
 647         }
 648         memset(device->collection, 0, sizeof(struct hid_collection) *
 649                HID_DEFAULT_NUM_COLLECTIONS);
 650         device->collection_size = HID_DEFAULT_NUM_COLLECTIONS;
 651
 652         for (i = 0; i < HID_REPORT_TYPES; i++)
 653                 INIT_LIST_HEAD(&device->report_enum[i].report_list);
 654
 655         if (!(device->rdesc = (__u8 *)kmalloc(size, GFP_KERNEL))) {
 656                 kfree(device->collection);
 657                 kfree(device);
 658                 return NULL;
 659         }
 660         memcpy(device->rdesc, start, size);
 661         device->rsize = size;
 662
 663         if (!(parser = kmalloc(sizeof(struct hid_parser), GFP_KERNEL))) {
 664                 kfree(device->rdesc);
 665                 kfree(device->collection);
 666                 kfree(device);
 667                 return NULL;
 668         }
 669         memset(parser, 0, sizeof(struct hid_parser));
 670         parser->device = device;
 671
 672         end = start + size;
 673         while ((start = fetch_item(start, end, &item)) != 0) {
 674
 675                 if (item.format != HID_ITEM_FORMAT_SHORT) {
 676                         dbg("unexpected long global item");
 677                         kfree(device->collection);
 678                         hid_free_device(device);
 679                         kfree(parser);
 680                         return NULL;
 681                 }
 682
 683                 if (dispatch_type[item.type](parser, &item)) {
 684                         dbg("item %u %u %u %u parsing failed\n",
 685                                 item.format, (unsigned)item.size, (unsigned)item.type, (unsigned)item.tag);
 686                         kfree(device->collection);
 687                         hid_free_device(device);
 688                         kfree(parser);
 689                         return NULL;
 690                 }
 691
 692                 if (start == end) {
 693                         if (parser->collection_stack_ptr) {
 694                                 dbg("unbalanced collection at end of report description");
 695                                 kfree(device->collection);
 696                                 hid_free_device(device);
 697                                 kfree(parser);
 698                                 return NULL;
 699                         }
 700                         if (parser->local.delimiter_depth) {
 701                                 dbg("unbalanced delimiter at end of report description");
 702                                 kfree(device->collection);
 703                                 hid_free_device(device);
 704                                 kfree(parser);
 705                                 return NULL;
 706                         }
 707                         kfree(parser);
 708                         return device;
 709                 }
 710         }
 711
 712         dbg("item fetching failed at offset %d\n", (int)(end - start));
 713         kfree(device->collection);
 714         hid_free_device(device);
 715         kfree(parser);
 716         return NULL;
 717 }
 718
 719 /*
 720  * Convert a signed n-bit integer to signed 32-bit integer. Common
 721  * cases are done through the compiler, the screwed things has to be
 722  * done by hand.
 723  */
 724
 725 static __inline__ __s32 snto32(__u32 value, unsigned n)
 726 {
 727         switch (n) {
 728                 case 8:  return ((__s8)value);
 729                 case 16: return ((__s16)value);
 730                 case 32: return ((__s32)value);
 731         }
 732         return value & (1 << (n - 1)) ? value | (-1 << n) : value;
 733 }
 734
 735 /*
 736  * Convert a signed 32-bit integer to a signed n-bit integer.
 737  */
 738
 739 static __inline__ __u32 s32ton(__s32 value, unsigned n)
 740 {
 741         __s32 a = value >> (n - 1);
 742         if (a && a != -1)
 743                 return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 744         return value & ((1 << n) - 1);
 745 }
 746
 747 /*
 748  * Extract/implement a data field from/to a report.
 749  */
 750
 751 static __inline__ __u32 extract(__u8 *report, unsigned offset, unsigned n)
 752 {
 753         report += (offset >> 5) << 2; offset &= 31;
 754         return (le64_to_cpu(get_unaligned((__u64*)report)) >> offset) & ((1 << n) - 1);
 755 }
 756
 757 static __inline__ void implement(__u8 *report, unsigned offset, unsigned n, __u32 value)
 758 {
 759         report += (offset >> 5) << 2; offset &= 31;
 760         put_unaligned((get_unaligned((__u64*)report)
 761                 & cpu_to_le64(~((((__u64) 1 << n) - 1) << offset)))
 762                 | cpu_to_le64((__u64)value << offset), (__u64*)report);
 763 }
 764
 765 /*
 766  * Search an array for a value.
 767  */
 768
 769 static __inline__ int search(__s32 *array, __s32 value, unsigned n)
 770 {
 771         while (n--) {
 772                 if (*array++ == value)
 773                         return 0;
 774         }
 775         return -1;
 776 }
 777
 778 static void hid_process_event(struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value, struct pt_regs *regs)
 779 {
 780         hid_dump_input(usage, value);
 781         if (hid->claimed & HID_CLAIMED_INPUT)
 782                 hidinput_hid_event(hid, field, usage, value, regs);
 783         if (hid->claimed & HID_CLAIMED_HIDDEV)
 784                 hiddev_hid_event(hid, field, usage, value, regs);
 785 }
 786
 787 /*
 788  * Analyse a received field, and fetch the data from it. The field
 789  * content is stored for next report processing (we do differential
 790  * reporting to the layer).
 791  */
 792
 793 static void hid_input_field(struct hid_device *hid, struct hid_field *field, __u8 *data, struct pt_regs *regs)
 794 {
 795         unsigned n;
 796         unsigned count = field->report_count;
 797         unsigned offset = field->report_offset;
 798         unsigned size = field->report_size;
 799         __s32 min = field->logical_minimum;
 800         __s32 max = field->logical_maximum;
 801         __s32 value[count]; /* WARNING: gcc specific */
 802
 803         for (n = 0; n < count; n++) {
 804
 805                         value[n] = min < 0 ? snto32(extract(data, offset + n * size, size), size) :
 806                                                     extract(data, offset + n * size, size);
 807
 808                         if (!(field->flags & HID_MAIN_ITEM_VARIABLE) /* Ignore report if ErrorRollOver */
 809                             && value[n] >= min && value[n] <= max
 810                             && field->usage[value[n] - min].hid == HID_UP_KEYBOARD + 1)
 811                                 return;
 812         }
 813
 814         for (n = 0; n < count; n++) {
 815
 816                 if (HID_MAIN_ITEM_VARIABLE & field->flags) {
 817
 818                         if (field->flags & HID_MAIN_ITEM_RELATIVE) {
 819                                 if (!value[n])
 820                                         continue;
 821                         } else {
 822                                 if (value[n] == field->value[n])
 823                                         continue;
 824                         }
 825                         hid_process_event(hid, field, &field->usage[n], value[n], regs);
 826                         continue;
 827                 }
 828
 829                 if (field->value[n] >= min && field->value[n] <= max
 830                         && field->usage[field->value[n] - min].hid
 831                         && search(value, field->value[n], count))
 832                                 hid_process_event(hid, field, &field->usage[field->value[n] - min], 0, regs);
 833
 834                 if (value[n] >= min && value[n] <= max
 835                         && field->usage[value[n] - min].hid
 836                         && search(field->value, value[n], count))
 837                                 hid_process_event(hid, field, &field->usage[value[n] - min], 1, regs);
 838         }
 839
 840         memcpy(field->value, value, count * sizeof(__s32));
 841 }
 842
 843 static int hid_input_report(int type, struct urb *urb, struct pt_regs *regs)
 844 {
 845         struct hid_device *hid = urb->context;
 846         struct hid_report_enum *report_enum = hid->report_enum + type;
 847         u8 *data = urb->transfer_buffer;
 848         int len = urb->actual_length;
 849         struct hid_report *report;
 850         int n, size;
 851
 852         if (!len) {
 853                 dbg("empty report");
 854                 return -1;
 855         }
 856
 857 #ifdef DEBUG_DATA
 858         printk(KERN_DEBUG __FILE__ ": report (size %u) (%snumbered)\n", len, report_enum->numbered ? "" : "un");
 859 #endif
 860
 861         n = 0;                          /* Normally report number is 0 */
 862         if (report_enum->numbered) {    /* Device uses numbered reports, data[0] is report number */
 863                 n = *data++;
 864                 len--;
 865         }
 866
 867 #ifdef DEBUG_DATA
 868         {
 869                 int i;
 870                 printk(KERN_DEBUG __FILE__ ": report %d (size %u) = ", n, len);
 871                 for (i = 0; i < len; i++)
 872                         printk(" %02x", data[i]);
 873                 printk("\n");
 874         }
 875 #endif
 876
 877         if (!(report = report_enum->report_id_hash[n])) {
 878                 dbg("undefined report_id %d received", n);
 879                 return -1;
 880         }
 881
 882         size = ((report->size - 1) >> 3) + 1;
 883
 884         if (len < size) {
 885                 dbg("report %d is too short, (%d < %d)", report->id, len, size);
 886                 return -1;
 887         }
 888
 889         if (hid->claimed & HID_CLAIMED_HIDDEV)
 890                 hiddev_report_event(hid, report);
 891
 892         for (n = 0; n < report->maxfield; n++)
 893                 hid_input_field(hid, report->field[n], data, regs);
 894
 895         if (hid->claimed & HID_CLAIMED_INPUT)
 896                 hidinput_report_event(hid, report);
 897
 898         return 0;
 899 }
 900
 901 /*
 902  * Input interrupt completion handler.
 903  */
 904
 905 static void hid_irq_in(struct urb *urb, struct pt_regs *regs)
 906 {
 907         struct hid_device       *hid = urb->context;
 908         int                     status;
 909
 910         switch (urb->status) {
 911         case 0:                 /* success */
 912                 hid_input_report(HID_INPUT_REPORT, urb, regs);
 913                 break;
 914         case -ECONNRESET:       /* unlink */
 915         case -ENOENT:
 916         case -ESHUTDOWN:
 917                 return;
 918         default:                /* error */
 919                 dbg("nonzero status in input irq %d", urb->status);
 920         }
 921
 922         status = usb_submit_urb (urb, SLAB_ATOMIC);
 923         if (status)
 924                 err ("can't resubmit intr, %s-%s/input%d, status %d",
 925                                 hid->dev->bus->bus_name, hid->dev->devpath,
 926                                 hid->ifnum, status);
 927 }
 928
 929 /*
 930  * Output the field into the report.
 931  */
 932
 933 static void hid_output_field(struct hid_field *field, __u8 *data)
 934 {
 935         unsigned count = field->report_count;
 936         unsigned offset = field->report_offset;
 937         unsigned size = field->report_size;
 938         unsigned n;
 939
 940         for (n = 0; n < count; n++) {
 941                 if (field->logical_minimum < 0) /* signed values */
 942                         implement(data, offset + n * size, size, s32ton(field->value[n], size));
 943                  else                           /* unsigned values */
 944                         implement(data, offset + n * size, size, field->value[n]);
 945         }
 946 }
 947
 948 /*
 949  * Create a report.
 950  */
 951
 952 void hid_output_report(struct hid_report *report, __u8 *data)
 953 {
 954         unsigned n;
 955
 956         if (report->id > 0)
 957                 *data++ = report->id;
 958
 959         for (n = 0; n < report->maxfield; n++)
 960                 hid_output_field(report->field[n], data);
 961 }
 962
 963 /*
 964  * Set a field value. The report this field belongs to has to be
 965  * created and transferred to the device, to set this value in the
 966  * device.
 967  */
 968
 969 int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
 970 {
 971         unsigned size = field->report_size;
 972
 973         hid_dump_input(field->usage + offset, value);
 974
 975         if (offset >= field->report_count) {
 976                 dbg("offset (%d) exceeds report_count (%d)", offset, field->report_count);
 977                 hid_dump_field(field, 8);
 978                 return -1;
 979         }
 980         if (field->logical_minimum < 0) {
 981                 if (value != snto32(s32ton(value, size), size)) {
 982                         dbg("value %d is out of range", value);
 983                         return -1;
 984                 }
 985         }
 986         field->value[offset] = value;
 987         return 0;
 988 }
 989
 990 int hid_find_field(struct hid_device *hid, unsigned int type, unsigned int code, struct hid_field **field)
 991 {
 992         struct hid_report_enum *report_enum = hid->report_enum + HID_OUTPUT_REPORT;
 993         struct list_head *list = report_enum->report_list.next;
 994         int i, j;
 995
 996         while (list != &report_enum->report_list) {
 997                 struct hid_report *report = (struct hid_report *) list;
 998                 list = list->next;
 999                 for (i = 0; i < report->maxfield; i++) {
1000                         *field = report->field[i];
1001                         for (j = 0; j < (*field)->maxusage; j++)
1002                                 if ((*field)->usage[j].type == type && (*field)->usage[j].code == code)
1003                                         return j;
1004                 }
1005         }
1006         return -1;
1007 }
1008
1009 /*
1010  * Find a report with a specified HID usage.
1011  */
1012
1013 int hid_find_report_by_usage(struct hid_device *hid, __u32 wanted_usage, struct hid_report **report, int type)
1014 {
1015         struct hid_report_enum *report_enum = hid->report_enum + type;
1016         struct list_head *list = report_enum->report_list.next;
1017         int i, j;
1018
1019         while (list != &report_enum->report_list) {
1020                 *report = (struct hid_report *) list;
1021                 list = list->next;
1022                 for (i = 0; i < (*report)->maxfield; i++) {
1023                         struct hid_field *field = (*report)->field[i];
1024                         for (j = 0; j < field->maxusage; j++)
1025                                 if (field->logical == wanted_usage)
1026                                         return j;
1027                 }
1028         }
1029         return -1;
1030 }
1031
1032 int hid_find_field_in_report(struct hid_report *report, __u32 wanted_usage, struct hid_field **field)
1033 {
1034         int i, j;
1035
1036         for (i = 0; i < report->maxfield; i++) {
1037                 *field = report->field[i];
1038                 for (j = 0; j < (*field)->maxusage; j++)
1039                         if ((*field)->usage[j].hid == wanted_usage)
1040                                 return j;
1041         }
1042
1043         return -1;
1044 }
1045
1046 static int hid_submit_out(struct hid_device *hid)
1047 {
1048         struct hid_report *report;
1049
1050         report = hid->out[hid->outtail];
1051
1052         hid_output_report(report, hid->outbuf);
1053         hid->urbout->transfer_buffer_length = ((report->size - 1) >> 3) + 1 + (report->id > 0);
1054         hid->urbout->dev = hid->dev;
1055
1056         dbg("submitting out urb");
1057
1058         if (usb_submit_urb(hid->urbout, GFP_ATOMIC)) {
1059                 err("usb_submit_urb(out) failed");
1060                 return -1;
1061         }
1062
1063         return 0;
1064 }
1065
1066 static int hid_submit_ctrl(struct hid_device *hid)
1067 {
1068         struct hid_report *report;
1069         unsigned char dir;
1070
1071         report = hid->ctrl[hid->ctrltail].report;
1072         dir = hid->ctrl[hid->ctrltail].dir;
1073
1074         if (dir == USB_DIR_OUT)
1075                 hid_output_report(report, hid->ctrlbuf);
1076
1077         hid->urbctrl->transfer_buffer_length = ((report->size - 1) >> 3) + 1 + (report->id > 0);
1078         hid->urbctrl->pipe = (dir == USB_DIR_OUT) ?  usb_sndctrlpipe(hid->dev, 0) : usb_rcvctrlpipe(hid->dev, 0);
1079         hid->urbctrl->dev = hid->dev;
1080
1081         hid->cr->bRequestType = USB_TYPE_CLASS | USB_RECIP_INTERFACE | dir;
1082         hid->cr->bRequest = (dir == USB_DIR_OUT) ? HID_REQ_SET_REPORT : HID_REQ_GET_REPORT;
1083         hid->cr->wValue = cpu_to_le16(((report->type + 1) << 8) | report->id);
1084         hid->cr->wIndex = cpu_to_le16(hid->ifnum);
1085         hid->cr->wLength = cpu_to_le16(hid->urbctrl->transfer_buffer_length);
1086
1087         dbg("submitting ctrl urb");
1088
1089         if (usb_submit_urb(hid->urbctrl, GFP_ATOMIC)) {
1090                 err("usb_submit_urb(ctrl) failed");
1091                 return -1;
1092         }
1093
1094         return 0;
1095 }
1096
1097 /*
1098  * Output interrupt completion handler.
1099  */
1100
1101 static void hid_irq_out(struct urb *urb, struct pt_regs *regs)
1102 {
1103         struct hid_device *hid = urb->context;
1104         unsigned long flags;
1105
1106         if (urb->status)
1107                 warn("output irq status %d received", urb->status);
1108
1109         spin_lock_irqsave(&hid->outlock, flags);
1110
1111         hid->outtail = (hid->outtail + 1) & (HID_OUTPUT_FIFO_SIZE - 1);
1112
1113         if (hid->outhead != hid->outtail) {
1114                 hid_submit_out(hid);
1115                 spin_unlock_irqrestore(&hid->outlock, flags);
1116                 return;
1117         }
1118
1119         clear_bit(HID_OUT_RUNNING, &hid->iofl);
1120
1121         spin_unlock_irqrestore(&hid->outlock, flags);
1122
1123         wake_up(&hid->wait);
1124 }
1125
1126 /*
1127  * Control pipe completion handler.
1128  */
1129
1130 static void hid_ctrl(struct urb *urb, struct pt_regs *regs)
1131 {
1132         struct hid_device *hid = urb->context;
1133         unsigned long flags;
1134
1135         if (urb->status)
1136                 warn("ctrl urb status %d received", urb->status);
1137
1138         spin_lock_irqsave(&hid->ctrllock, flags);
1139
1140         if (hid->ctrl[hid->ctrltail].dir == USB_DIR_IN)
1141                 hid_input_report(hid->ctrl[hid->ctrltail].report->type, urb, regs);
1142
1143         hid->ctrltail = (hid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1);
1144
1145         if (hid->ctrlhead != hid->ctrltail) {
1146                 hid_submit_ctrl(hid);
1147                 spin_unlock_irqrestore(&hid->ctrllock, flags);
1148                 return;
1149         }
1150
1151         clear_bit(HID_CTRL_RUNNING, &hid->iofl);
1152
1153         spin_unlock_irqrestore(&hid->ctrllock, flags);
1154
1155         wake_up(&hid->wait);
1156 }
1157
1158 void hid_submit_report(struct hid_device *hid, struct hid_report *report, unsigned char dir)
1159 {
1160         int head;
1161         unsigned long flags;
1162
1163         if ((hid->quirks & HID_QUIRK_NOGET) && dir == USB_DIR_IN)
1164                 return;
1165
1166         if (hid->urbout && dir == USB_DIR_OUT && report->type == HID_OUTPUT_REPORT) {
1167
1168                 spin_lock_irqsave(&hid->outlock, flags);
1169
1170                 if ((head = (hid->outhead + 1) & (HID_OUTPUT_FIFO_SIZE - 1)) == hid->outtail) {
1171                         spin_unlock_irqrestore(&hid->outlock, flags);
1172                         warn("output queue full");
1173                         return;
1174                 }
1175
1176                 hid->out[hid->outhead] = report;
1177                 hid->outhead = head;
1178
1179                 if (!test_and_set_bit(HID_OUT_RUNNING, &hid->iofl))
1180                         hid_submit_out(hid);
1181
1182                 spin_unlock_irqrestore(&hid->outlock, flags);
1183                 return;
1184         }
1185
1186         spin_lock_irqsave(&hid->ctrllock, flags);
1187
1188         if ((head = (hid->ctrlhead + 1) & (HID_CONTROL_FIFO_SIZE - 1)) == hid->ctrltail) {
1189                 spin_unlock_irqrestore(&hid->ctrllock, flags);
1190                 warn("control queue full");
1191                 return;
1192         }
1193
1194         hid->ctrl[hid->ctrlhead].report = report;
1195         hid->ctrl[hid->ctrlhead].dir = dir;
1196         hid->ctrlhead = head;
1197
1198         if (!test_and_set_bit(HID_CTRL_RUNNING, &hid->iofl))
1199                 hid_submit_ctrl(hid);
1200
1201         spin_unlock_irqrestore(&hid->ctrllock, flags);
1202 }
1203
1204 int hid_wait_io(struct hid_device *hid)
1205 {
1206         DECLARE_WAITQUEUE(wait, current);
1207         int timeout = 10*HZ;
1208
1209         set_current_state(TASK_UNINTERRUPTIBLE);
1210         add_wait_queue(&hid->wait, &wait);
1211
1212         while (timeout && (test_bit(HID_CTRL_RUNNING, &hid->iofl) ||
1213                            test_bit(HID_OUT_RUNNING, &hid->iofl)))
1214                 timeout = schedule_timeout(timeout);
1215
1216         set_current_state(TASK_RUNNING);
1217         remove_wait_queue(&hid->wait, &wait);
1218
1219         if (!timeout) {
1220                 dbg("timeout waiting for ctrl or out queue to clear");
1221                 return -1;
1222         }
1223
1224         return 0;
1225 }
1226
1227 static int hid_get_class_descriptor(struct usb_device *dev, int ifnum,
1228                 unsigned char type, void *buf, int size)
1229 {
1230         return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
1231                 USB_REQ_GET_DESCRIPTOR, USB_RECIP_INTERFACE | USB_DIR_IN,
1232                 (type << 8), ifnum, buf, size, HZ * USB_CTRL_GET_TIMEOUT);
1233 }
1234
1235 int hid_open(struct hid_device *hid)
1236 {
1237         if (hid->open++)
1238                 return 0;
1239
1240         hid->urbin->dev = hid->dev;
1241
1242         if (usb_submit_urb(hid->urbin, GFP_KERNEL))
1243                 return -EIO;
1244
1245         return 0;
1246 }
1247
1248 void hid_close(struct hid_device *hid)
1249 {
1250         if (!--hid->open)
1251                 usb_unlink_urb(hid->urbin);
1252 }
1253
1254 /*
1255  * Initialize all reports
1256  */
1257
1258 void hid_init_reports(struct hid_device *hid)
1259 {
1260         struct hid_report_enum *report_enum;
1261         struct hid_report *report;
1262         struct list_head *list;
1263         int len;
1264         int err, ret;
1265
1266         report_enum = hid->report_enum + HID_INPUT_REPORT;
1267         list = report_enum->report_list.next;
1268         while (list != &report_enum->report_list) {
1269                 report = (struct hid_report *) list;
1270                 hid_submit_report(hid, report, USB_DIR_IN);
1271                 list = list->next;
1272         }
1273
1274         report_enum = hid->report_enum + HID_FEATURE_REPORT;
1275         list = report_enum->report_list.next;
1276         while (list != &report_enum->report_list) {
1277                 report = (struct hid_report *) list;
1278                 hid_submit_report(hid, report, USB_DIR_IN);
1279                 list = list->next;
1280         }
1281
1282         err = 0;
1283         while ((ret = hid_wait_io(hid))) {
1284                 err |= ret;
1285                 if (test_bit(HID_CTRL_RUNNING, &hid->iofl))
1286                         usb_unlink_urb(hid->urbctrl);
1287                 if (test_bit(HID_OUT_RUNNING, &hid->iofl))
1288                         usb_unlink_urb(hid->urbout);
1289         }
1290
1291         if (err)
1292                 warn("timeout initializing reports\n");
1293
1294         report_enum = hid->report_enum + HID_INPUT_REPORT;
1295         list = report_enum->report_list.next;
1296         while (list != &report_enum->report_list) {
1297                 report = (struct hid_report *) list;
1298                 len = ((report->size - 1) >> 3) + 1 + report_enum->numbered;
1299                 if (len > hid->urbin->transfer_buffer_length)
1300                         hid->urbin->transfer_buffer_length = len < HID_BUFFER_SIZE ? len : HID_BUFFER_SIZE;
1301                 usb_control_msg(hid->dev, usb_sndctrlpipe(hid->dev, 0),
1302                         0x0a, USB_TYPE_CLASS | USB_RECIP_INTERFACE, report->id,
1303                         hid->ifnum, NULL, 0, HZ * USB_CTRL_SET_TIMEOUT);
1304                 list = list->next;
1305         }
1306 }
1307
1308 #define USB_VENDOR_ID_WACOM             0x056a
1309 #define USB_DEVICE_ID_WACOM_PENPARTNER  0x0000
1310 #define USB_DEVICE_ID_WACOM_GRAPHIRE    0x0010
1311 #define USB_DEVICE_ID_WACOM_INTUOS      0x0020
1312 #define USB_DEVICE_ID_WACOM_PL          0x0030
1313 #define USB_DEVICE_ID_WACOM_INTUOS2     0x0040
1314
1315 #define USB_VENDOR_ID_KBGEAR            0x084e
1316 #define USB_DEVICE_ID_KBGEAR_JAMSTUDIO  0x1001
1317
1318
1319 #define USB_VENDOR_ID_AIPTEK            0x08ca
1320 #define USB_DEVICE_ID_AIPTEK_6000       0x0020
1321
1322 #define USB_VENDOR_ID_GRIFFIN           0x077d
1323 #define USB_DEVICE_ID_POWERMATE         0x0410
1324 #define USB_DEVICE_ID_SOUNDKNOB         0x04AA
1325
1326 #define USB_VENDOR_ID_ATEN             0x0557
1327 #define USB_DEVICE_ID_ATEN_UC100KM     0x2004
1328 #define USB_DEVICE_ID_ATEN_CS124U      0x2202
1329 #define USB_DEVICE_ID_ATEN_2PORTKVM    0x2204
1330 #define USB_DEVICE_ID_ATEN_4PORTKVM    0x2205
1331 #define USB_DEVICE_ID_ATEN_4PORTKVMC   0x2208
1332
1333 #define USB_VENDOR_ID_TOPMAX           0x0663
1334 #define USB_DEVICE_ID_TOPMAX_COBRAPAD  0x0103
1335
1336 #define USB_VENDOR_ID_HAPP             0x078b
1337 #define USB_DEVICE_ID_UGCI_DRIVING     0x0010
1338 #define USB_DEVICE_ID_UGCI_FLYING      0x0020
1339 #define USB_DEVICE_ID_UGCI_FIGHTING    0x0030
1340
1341 #define USB_VENDOR_ID_MGE              0x0463
1342 #define USB_DEVICE_ID_MGE_UPS          0xffff
1343 #define USB_DEVICE_ID_MGE_UPS1         0x0001
1344
1345 #define USB_VENDOR_ID_ONTRAK            0x0a07
1346 #define USB_DEVICE_ID_ONTRAK_ADU100     0x0064
1347
1348 #define USB_VENDOR_ID_TANGTOP          0x0d3d
1349 #define USB_DEVICE_ID_TANGTOP_USBPS2   0x0001
1350
1351 #define USB_VENDOR_ID_ESSENTIAL_REALITY 0x0d7f
1352 #define USB_DEVICE_ID_ESSENTIAL_REALITY_P5      0x0100
1353
1354 #define USB_VENDOR_ID_A4TECH            0x09DA
1355 #define USB_DEVICE_ID_A4TECH_WCP32PU    0x0006
1356
1357 struct hid_blacklist {
1358         __u16 idVendor;
1359         __u16 idProduct;
1360         unsigned quirks;
1361 } hid_blacklist[] = {
1362         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PENPARTNER, HID_QUIRK_IGNORE },
1363         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE, HID_QUIRK_IGNORE },
1364         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE + 1, HID_QUIRK_IGNORE },
1365         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE + 2, HID_QUIRK_IGNORE },
1366         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS, HID_QUIRK_IGNORE },
1367         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS + 1, HID_QUIRK_IGNORE },
1368         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS + 2, HID_QUIRK_IGNORE },
1369         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS + 3, HID_QUIRK_IGNORE },
1370         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS + 4, HID_QUIRK_IGNORE },
1371         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL, HID_QUIRK_IGNORE },
1372         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 1, HID_QUIRK_IGNORE },
1373         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 2, HID_QUIRK_IGNORE },
1374         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 3, HID_QUIRK_IGNORE },
1375         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 4, HID_QUIRK_IGNORE },
1376         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 5, HID_QUIRK_IGNORE },
1377         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2, HID_QUIRK_IGNORE },
1378         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 1, HID_QUIRK_IGNORE },
1379         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 2, HID_QUIRK_IGNORE },
1380         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 3, HID_QUIRK_IGNORE },
1381         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 4, HID_QUIRK_IGNORE },
1382         { USB_VENDOR_ID_KBGEAR, USB_DEVICE_ID_KBGEAR_JAMSTUDIO, HID_QUIRK_IGNORE },
1383         { USB_VENDOR_ID_AIPTEK, USB_DEVICE_ID_AIPTEK_6000, HID_QUIRK_IGNORE },
1384         { USB_VENDOR_ID_GRIFFIN, USB_DEVICE_ID_POWERMATE, HID_QUIRK_IGNORE },
1385         { USB_VENDOR_ID_GRIFFIN, USB_DEVICE_ID_SOUNDKNOB, HID_QUIRK_IGNORE },
1386         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
1387         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
1388         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
1389         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
1390         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
1391         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_HIDDEV },
1392         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS1, HID_QUIRK_HIDDEV },
1393         { USB_VENDOR_ID_TOPMAX, USB_DEVICE_ID_TOPMAX_COBRAPAD, HID_QUIRK_BADPAD },
1394         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING, HID_QUIRK_BADPAD|HID_QUIRK_MULTI_INPUT },
1395         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING, HID_QUIRK_BADPAD|HID_QUIRK_MULTI_INPUT },
1396         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING, HID_QUIRK_BADPAD|HID_QUIRK_MULTI_INPUT },
1397         { USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100, HID_QUIRK_IGNORE },
1398         { USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100 + 100, HID_QUIRK_IGNORE },
1399         { USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100 + 200, HID_QUIRK_IGNORE },
1400         { USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100 + 300, HID_QUIRK_IGNORE },
1401         { USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100 + 400, HID_QUIRK_IGNORE },
1402         { USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100 + 500, HID_QUIRK_IGNORE },
1403         { USB_VENDOR_ID_TANGTOP, USB_DEVICE_ID_TANGTOP_USBPS2, HID_QUIRK_NOGET },
1404         { USB_VENDOR_ID_ESSENTIAL_REALITY, USB_DEVICE_ID_ESSENTIAL_REALITY_P5, HID_QUIRK_IGNORE },
1405         { USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU, HID_QUIRK_2WHEEL_MOUSE_HACK },
1406         { 0, 0 }
1407 };
1408
1409 static int hid_alloc_buffers(struct usb_device *dev, struct hid_device *hid)
1410 {
1411         if (!(hid->inbuf = usb_buffer_alloc(dev, HID_BUFFER_SIZE, SLAB_ATOMIC, &hid->inbuf_dma)))
1412                 return -1;
1413         if (!(hid->outbuf = usb_buffer_alloc(dev, HID_BUFFER_SIZE, SLAB_ATOMIC, &hid->outbuf_dma)))
1414                 return -1;
1415         if (!(hid->cr = usb_buffer_alloc(dev, sizeof(*(hid->cr)), SLAB_ATOMIC, &hid->cr_dma)))
1416                 return -1;
1417         if (!(hid->ctrlbuf = usb_buffer_alloc(dev, HID_BUFFER_SIZE, SLAB_ATOMIC, &hid->ctrlbuf_dma)))
1418                 return -1;
1419
1420         return 0;
1421 }
1422
1423 static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid)
1424 {
1425         if (hid->inbuf)
1426                 usb_buffer_free(dev, HID_BUFFER_SIZE, hid->inbuf, hid->inbuf_dma);
1427         if (hid->outbuf)
1428                 usb_buffer_free(dev, HID_BUFFER_SIZE, hid->outbuf, hid->outbuf_dma);
1429         if (hid->cr)
1430                 usb_buffer_free(dev, sizeof(*(hid->cr)), hid->cr, hid->cr_dma);
1431         if (hid->ctrlbuf)
1432                 usb_buffer_free(dev, HID_BUFFER_SIZE, hid->ctrlbuf, hid->ctrlbuf_dma);
1433 }
1434
1435 static struct hid_device *usb_hid_configure(struct usb_interface *intf)
1436 {
1437         struct usb_host_interface *interface = intf->altsetting + intf->act_altsetting;
1438         struct usb_device *dev = interface_to_usbdev (intf);
1439         struct hid_descriptor *hdesc;
1440         struct hid_device *hid;
1441         unsigned quirks = 0, rsize = 0;
1442         char *buf, *rdesc;
1443         int n;
1444
1445         for (n = 0; hid_blacklist[n].idVendor; n++)
1446                 if ((hid_blacklist[n].idVendor == dev->descriptor.idVendor) &&
1447                         (hid_blacklist[n].idProduct == dev->descriptor.idProduct))
1448                                 quirks = hid_blacklist[n].quirks;
1449
1450         if (quirks & HID_QUIRK_IGNORE)
1451                 return NULL;
1452
1453         if (usb_get_extra_descriptor(interface, HID_DT_HID, &hdesc) && ((!interface->desc.bNumEndpoints) ||
1454                 usb_get_extra_descriptor(&interface->endpoint[0], HID_DT_HID, &hdesc))) {
1455                         dbg("class descriptor not present\n");
1456                         return NULL;
1457         }
1458
1459         for (n = 0; n < hdesc->bNumDescriptors; n++)
1460                 if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
1461                         rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
1462
1463         if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) {
1464                 dbg("weird size of report descriptor (%u)", rsize);
1465                 return NULL;
1466         }
1467
1468         if (!(rdesc = kmalloc(rsize, GFP_KERNEL))) {
1469                 dbg("couldn't allocate rdesc memory");
1470                 return NULL;
1471         }
1472
1473         if ((n = hid_get_class_descriptor(dev, interface->desc.bInterfaceNumber, HID_DT_REPORT, rdesc, rsize)) < 0) {
1474                 dbg("reading report descriptor failed");
1475                 kfree(rdesc);
1476                 return NULL;
1477         }
1478
1479 #ifdef DEBUG_DATA
1480         printk(KERN_DEBUG __FILE__ ": report descriptor (size %u, read %d) = ", rsize, n);
1481         for (n = 0; n < rsize; n++)
1482                 printk(" %02x", (unsigned char) rdesc[n]);
1483         printk("\n");
1484 #endif
1485
1486         if (!(hid = hid_parse_report(rdesc, rsize))) {
1487                 dbg("parsing report descriptor failed");
1488                 kfree(rdesc);
1489                 return NULL;
1490         }
1491
1492         kfree(rdesc);
1493         hid->quirks = quirks;
1494
1495         if (hid_alloc_buffers(dev, hid)) {
1496                 hid_free_buffers(dev, hid);
1497                 goto fail;
1498         }
1499
1500         for (n = 0; n < interface->desc.bNumEndpoints; n++) {
1501
1502                 struct usb_endpoint_descriptor *endpoint;
1503                 int pipe;
1504
1505                 endpoint = &interface->endpoint[n].desc;
1506                 if ((endpoint->bmAttributes & 3) != 3)          /* Not an interrupt endpoint */
1507                         continue;
1508
1509                 if (endpoint->bEndpointAddress & USB_DIR_IN) {
1510                         if (hid->urbin)
1511                                 continue;
1512                         if (!(hid->urbin = usb_alloc_urb(0, GFP_KERNEL)))
1513                                 goto fail;
1514                         pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
1515                         usb_fill_int_urb(hid->urbin, dev, pipe, hid->inbuf, 0,
1516                                          hid_irq_in, hid, endpoint->bInterval);
1517                         hid->urbin->transfer_dma = hid->inbuf_dma;
1518                         hid->urbin->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1519                 } else {
1520                         if (hid->urbout)
1521                                 continue;
1522                         if (!(hid->urbout = usb_alloc_urb(0, GFP_KERNEL)))
1523                                 goto fail;
1524                         pipe = usb_sndbulkpipe(dev, endpoint->bEndpointAddress);
1525                         usb_fill_bulk_urb(hid->urbout, dev, pipe, hid->outbuf, 0,
1526                                           hid_irq_out, hid);
1527                         hid->urbout->transfer_dma = hid->outbuf_dma;
1528                         hid->urbout->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1529                 }
1530         }
1531
1532         if (!hid->urbin) {
1533                 err("couldn't find an input interrupt endpoint");
1534                 goto fail;
1535         }
1536
1537         init_waitqueue_head(&hid->wait);
1538
1539         hid->outlock = SPIN_LOCK_UNLOCKED;
1540         hid->ctrllock = SPIN_LOCK_UNLOCKED;
1541
1542         hid->version = le16_to_cpu(hdesc->bcdHID);
1543         hid->country = hdesc->bCountryCode;
1544         hid->dev = dev;
1545         hid->ifnum = interface->desc.bInterfaceNumber;
1546
1547         hid->name[0] = 0;
1548
1549         if (!(buf = kmalloc(64, GFP_KERNEL)))
1550                 goto fail;
1551
1552         if (usb_string(dev, dev->descriptor.iManufacturer, buf, 64) > 0) {
1553                 strcat(hid->name, buf);
1554                 if (usb_string(dev, dev->descriptor.iProduct, buf, 64) > 0)
1555                         snprintf(hid->name, 64, "%s %s", hid->name, buf);
1556         } else if (usb_string(dev, dev->descriptor.iProduct, buf, 128) > 0) {
1557                         snprintf(hid->name, 128, "%s", buf);
1558         } else
1559                 snprintf(hid->name, 128, "%04x:%04x", dev->descriptor.idVendor, dev->descriptor.idProduct);
1560
1561         usb_make_path(dev, buf, 64);
1562         snprintf(hid->phys, 64, "%s/input%d", buf,
1563                         intf->altsetting[0].desc.bInterfaceNumber);
1564
1565         if (usb_string(dev, dev->descriptor.iSerialNumber, hid->uniq, 64) <= 0)
1566                 hid->uniq[0] = 0;
1567
1568         kfree(buf);
1569
1570         hid->urbctrl = usb_alloc_urb(0, GFP_KERNEL);
1571         if (!hid->urbctrl)
1572                 goto fail;
1573         usb_fill_control_urb(hid->urbctrl, dev, 0, (void *) hid->cr,
1574                              hid->ctrlbuf, 1, hid_ctrl, hid);
1575         hid->urbctrl->setup_dma = hid->cr_dma;
1576         hid->urbctrl->transfer_dma = hid->ctrlbuf_dma;
1577         hid->urbctrl->transfer_flags |= (URB_NO_TRANSFER_DMA_MAP
1578                                 | URB_NO_SETUP_DMA_MAP);
1579
1580         return hid;
1581
1582 fail:
1583
1584         if (hid->urbin)
1585                 usb_free_urb(hid->urbin);
1586         if (hid->urbout)
1587                 usb_free_urb(hid->urbout);
1588         if (hid->urbctrl)
1589                 usb_free_urb(hid->urbctrl);
1590         hid_free_buffers(dev, hid);
1591         hid_free_device(hid);
1592
1593         return NULL;
1594 }
1595
1596 static void hid_disconnect(struct usb_interface *intf)
1597 {
1598         struct hid_device *hid = usb_get_intfdata (intf);
1599
1600         if (!hid)
1601                 return;
1602
1603         usb_set_intfdata(intf, NULL);
1604         usb_unlink_urb(hid->urbin);
1605         usb_unlink_urb(hid->urbout);
1606         usb_unlink_urb(hid->urbctrl);
1607
1608         if (hid->claimed & HID_CLAIMED_INPUT)
1609                 hidinput_disconnect(hid);
1610         if (hid->claimed & HID_CLAIMED_HIDDEV)
1611                 hiddev_disconnect(hid);
1612
1613         usb_free_urb(hid->urbin);
1614         usb_free_urb(hid->urbctrl);
1615         if (hid->urbout)
1616                 usb_free_urb(hid->urbout);
1617
1618         hid_free_buffers(hid->dev, hid);
1619         hid_free_device(hid);
1620 }
1621
1622 static int hid_probe (struct usb_interface *intf, const struct usb_device_id *id)
1623 {
1624         struct hid_device *hid;
1625         char path[64];
1626         int i;
1627         char *c;
1628
1629         dbg("HID probe called for ifnum %d",
1630                         intf->altsetting->desc.bInterfaceNumber);
1631
1632         if (!(hid = usb_hid_configure(intf)))
1633                 return -EIO;
1634
1635         hid_init_reports(hid);
1636         hid_dump_device(hid);
1637
1638         if (!hidinput_connect(hid))
1639                 hid->claimed |= HID_CLAIMED_INPUT;
1640         if (!hiddev_connect(hid))
1641                 hid->claimed |= HID_CLAIMED_HIDDEV;
1642
1643         usb_set_intfdata(intf, hid);
1644
1645         if (!hid->claimed) {
1646                 printk ("HID device not claimed by input or hiddev\n");
1647                 hid_disconnect(intf);
1648                 return -EIO;
1649         }
1650
1651         printk(KERN_INFO);
1652
1653         if (hid->claimed & HID_CLAIMED_INPUT)
1654                 printk("input");
1655         if (hid->claimed == (HID_CLAIMED_INPUT | HID_CLAIMED_HIDDEV))
1656                 printk(",");
1657         if (hid->claimed & HID_CLAIMED_HIDDEV)
1658                 printk("hiddev%d", hid->minor);
1659
1660         c = "Device";
1661         for (i = 0; i < hid->maxcollection; i++) {
1662                 if (hid->collection[i].type == HID_COLLECTION_APPLICATION &&
1663                     (hid->collection[i].usage & HID_USAGE_PAGE) == HID_UP_GENDESK &&
1664                     (hid->collection[i].usage & 0xffff) < ARRAY_SIZE(hid_types)) {
1665                         c = hid_types[hid->collection[i].usage & 0xffff];
1666                         break;
1667                 }
1668         }
1669
1670         usb_make_path(interface_to_usbdev(intf), path, 63);
1671
1672         printk(": USB HID v%x.%02x %s [%s] on %s\n",
1673                 hid->version >> 8, hid->version & 0xff, c, hid->name, path);
1674
1675         return 0;
1676 }
1677
1678 static struct usb_device_id hid_usb_ids [] = {
1679         { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
1680             .bInterfaceClass = USB_INTERFACE_CLASS_HID },
1681         { }                                             /* Terminating entry */
1682 };
1683
1684 MODULE_DEVICE_TABLE (usb, hid_usb_ids);
1685
1686 static struct usb_driver hid_driver = {
1687         .owner =        THIS_MODULE,
1688         .name =         "hid",
1689         .probe =        hid_probe,
1690         .disconnect =   hid_disconnect,
1691         .id_table =     hid_usb_ids,
1692 };
1693
1694 static int __init hid_init(void)
1695 {
1696         int retval;
1697         retval = hiddev_init();
1698         if (retval)
1699                 goto hiddev_init_fail;
1700         retval = usb_register(&hid_driver);
1701         if (retval)
1702                 goto usb_register_fail;
1703         info(DRIVER_VERSION ":" DRIVER_DESC);
1704
1705         return 0;
1706 usb_register_fail:
1707         hiddev_exit();
1708 hiddev_init_fail:
1709         return retval;
1710 }
1711
1712 static void __exit hid_exit(void)
1713 {
1714         hiddev_exit();
1715         usb_deregister(&hid_driver);
1716 }
1717
1718 module_init(hid_init);
1719 module_exit(hid_exit);
1720
1721 MODULE_AUTHOR(DRIVER_AUTHOR);
1722 MODULE_DESCRIPTION(DRIVER_DESC);
1723 MODULE_LICENSE(DRIVER_LICENSE);