drivers/usb/input/hid-core.c

   1 /*
   2  *  USB HID support for Linux
   3  *
   4  *  Copyright (c) 1999 Andreas Gal
   5  *  Copyright (c) 2000-2001 Vojtech Pavlik <vojtech@suse.cz>
   6  */
   7
   8 /*
   9  * This program is free software; you can redistribute it and/or modify it
  10  * under the terms of the GNU General Public License as published by the Free
  11  * Software Foundation; either version 2 of the License, or (at your option)
  12  * any later version.
  13  */
  14
  15 #include <linux/module.h>
  16 #include <linux/slab.h>
  17 #include <linux/init.h>
  18 #include <linux/kernel.h>
  19 #include <linux/sched.h>
  20 #include <linux/list.h>
  21 #include <linux/mm.h>
  22 #include <linux/smp_lock.h>
  23 #include <linux/spinlock.h>
  24 #include <asm/unaligned.h>
  25 #include <asm/byteorder.h>
  26 #include <linux/input.h>
  27
  28 #undef DEBUG
  29 #undef DEBUG_DATA
  30
  31 #include <linux/usb.h>
  32
  33 #include "hid.h"
  34 #include <linux/hiddev.h>
  35
  36 /*
  37  * Version Information
  38  */
  39
  40 #define DRIVER_VERSION "v2.0"
  41 #define DRIVER_AUTHOR "Andreas Gal, Vojtech Pavlik"
  42 #define DRIVER_DESC "USB HID core driver"
  43 #define DRIVER_LICENSE "GPL"
  44
  45 static char *hid_types[] = {"Device", "Pointer", "Mouse", "Device", "Joystick",
  46                                 "Gamepad", "Keyboard", "Keypad", "Multi-Axis Controller"};
  47
  48 /*
  49  * Register a new report for a device.
  50  */
  51
  52 static struct hid_report *hid_register_report(struct hid_device *device, unsigned type, unsigned id)
  53 {
  54         struct hid_report_enum *report_enum = device->report_enum + type;
  55         struct hid_report *report;
  56
  57         if (report_enum->report_id_hash[id])
  58                 return report_enum->report_id_hash[id];
  59
  60         if (!(report = kmalloc(sizeof(struct hid_report), GFP_KERNEL)))
  61                 return NULL;
  62         memset(report, 0, sizeof(struct hid_report));
  63
  64         if (id != 0)
  65                 report_enum->numbered = 1;
  66
  67         report->id = id;
  68         report->type = type;
  69         report->size = 0;
  70         report->device = device;
  71         report_enum->report_id_hash[id] = report;
  72
  73         list_add_tail(&report->list, &report_enum->report_list);
  74
  75         return report;
  76 }
  77
  78 /*
  79  * Register a new field for this report.
  80  */
  81
  82 static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages, unsigned values)
  83 {
  84         struct hid_field *field;
  85
  86         if (report->maxfield == HID_MAX_FIELDS) {
  87                 dbg("too many fields in report");
  88                 return NULL;
  89         }
  90
  91         if (!(field = kmalloc(sizeof(struct hid_field) + usages * sizeof(struct hid_usage)
  92                 + values * sizeof(unsigned), GFP_KERNEL))) return NULL;
  93
  94         memset(field, 0, sizeof(struct hid_field) + usages * sizeof(struct hid_usage)
  95                 + values * sizeof(unsigned));
  96
  97         report->field[report->maxfield++] = field;
  98         field->usage = (struct hid_usage *)(field + 1);
  99         field->value = (unsigned *)(field->usage + usages);
 100         field->report = report;
 101
 102         return field;
 103 }
 104
 105 /*
 106  * Open a collection. The type/usage is pushed on the stack.
 107  */
 108
 109 static int open_collection(struct hid_parser *parser, unsigned type)
 110 {
 111         struct hid_collection *collection;
 112         unsigned usage;
 113
 114         usage = parser->local.usage[0];
 115
 116         if (parser->collection_stack_ptr == HID_COLLECTION_STACK_SIZE) {
 117                 dbg("collection stack overflow");
 118                 return -1;
 119         }
 120
 121         if (parser->device->maxcollection == parser->device->collection_size) {
 122                 collection = kmalloc(sizeof(struct hid_collection) *
 123                                      parser->device->collection_size * 2,
 124                                      GFP_KERNEL);
 125                 if (collection == NULL) {
 126                         dbg("failed to reallocate collection array");
 127                         return -1;
 128                 }
 129                 memcpy(collection, parser->device->collection,
 130                        sizeof(struct hid_collection) *
 131                        parser->device->collection_size);
 132                 memset(collection + parser->device->collection_size, 0,
 133                        sizeof(struct hid_collection) *
 134                        parser->device->collection_size);
 135                 kfree(parser->device->collection);
 136                 parser->device->collection = collection;
 137                 parser->device->collection_size *= 2;
 138         }
 139
 140         parser->collection_stack[parser->collection_stack_ptr++] =
 141                 parser->device->maxcollection;
 142
 143         collection = parser->device->collection +
 144                 parser->device->maxcollection++;
 145         collection->type = type;
 146         collection->usage = usage;
 147         collection->level = parser->collection_stack_ptr - 1;
 148
 149         if (type == HID_COLLECTION_APPLICATION)
 150                 parser->device->maxapplication++;
 151
 152         return 0;
 153 }
 154
 155 /*
 156  * Close a collection.
 157  */
 158
 159 static int close_collection(struct hid_parser *parser)
 160 {
 161         if (!parser->collection_stack_ptr) {
 162                 dbg("collection stack underflow");
 163                 return -1;
 164         }
 165         parser->collection_stack_ptr--;
 166         return 0;
 167 }
 168
 169 /*
 170  * Climb up the stack, search for the specified collection type
 171  * and return the usage.
 172  */
 173
 174 static unsigned hid_lookup_collection(struct hid_parser *parser, unsigned type)
 175 {
 176         int n;
 177         for (n = parser->collection_stack_ptr - 1; n >= 0; n--)
 178                 if (parser->device->collection[parser->collection_stack[n]].type == type)
 179                         return parser->device->collection[parser->collection_stack[n]].usage;
 180         return 0; /* we know nothing about this usage type */
 181 }
 182
 183 /*
 184  * Add a usage to the temporary parser table.
 185  */
 186
 187 static int hid_add_usage(struct hid_parser *parser, unsigned usage)
 188 {
 189         if (parser->local.usage_index >= HID_MAX_USAGES) {
 190                 dbg("usage index exceeded");
 191                 return -1;
 192         }
 193         parser->local.usage[parser->local.usage_index] = usage;
 194         parser->local.collection_index[parser->local.usage_index] =
 195                 parser->collection_stack_ptr ?
 196                 parser->collection_stack[parser->collection_stack_ptr - 1] : 0;
 197         parser->local.usage_index++;
 198         return 0;
 199 }
 200
 201 /*
 202  * Register a new field for this report.
 203  */
 204
 205 static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsigned flags)
 206 {
 207         struct hid_report *report;
 208         struct hid_field *field;
 209         int usages;
 210         unsigned offset;
 211         int i;
 212
 213         if (!(report = hid_register_report(parser->device, report_type, parser->global.report_id))) {
 214                 dbg("hid_register_report failed");
 215                 return -1;
 216         }
 217
 218         if (parser->global.logical_maximum < parser->global.logical_minimum) {
 219                 dbg("logical range invalid %d %d", parser->global.logical_minimum, parser->global.logical_maximum);
 220                 return -1;
 221         }
 222         usages = parser->local.usage_index;
 223
 224         offset = report->size;
 225         report->size += parser->global.report_size * parser->global.report_count;
 226
 227         if (usages < parser->global.report_count)
 228                 usages = parser->global.report_count;
 229
 230         if (usages == 0)
 231                 return 0; /* ignore padding fields */
 232
 233         if ((field = hid_register_field(report, usages, parser->global.report_count)) == NULL)
 234                 return 0;
 235
 236         field->physical = hid_lookup_collection(parser, HID_COLLECTION_PHYSICAL);
 237         field->logical = hid_lookup_collection(parser, HID_COLLECTION_LOGICAL);
 238         field->application = hid_lookup_collection(parser, HID_COLLECTION_APPLICATION);
 239
 240         for (i = 0; i < usages; i++) {
 241                 int j = i;
 242                 /* Duplicate the last usage we parsed if we have excess values */
 243                 if (i >= parser->local.usage_index)
 244                         j = parser->local.usage_index - 1;
 245                 field->usage[i].hid = parser->local.usage[j];
 246                 field->usage[i].collection_index =
 247                         parser->local.collection_index[j];
 248         }
 249
 250         field->maxusage = usages;
 251         field->flags = flags;
 252         field->report_offset = offset;
 253         field->report_type = report_type;
 254         field->report_size = parser->global.report_size;
 255         field->report_count = parser->global.report_count;
 256         field->logical_minimum = parser->global.logical_minimum;
 257         field->logical_maximum = parser->global.logical_maximum;
 258         field->physical_minimum = parser->global.physical_minimum;
 259         field->physical_maximum = parser->global.physical_maximum;
 260         field->unit_exponent = parser->global.unit_exponent;
 261         field->unit = parser->global.unit;
 262
 263         return 0;
 264 }
 265
 266 /*
 267  * Read data value from item.
 268  */
 269
 270 static __inline__ __u32 item_udata(struct hid_item *item)
 271 {
 272         switch (item->size) {
 273                 case 1: return item->data.u8;
 274                 case 2: return item->data.u16;
 275                 case 4: return item->data.u32;
 276         }
 277         return 0;
 278 }
 279
 280 static __inline__ __s32 item_sdata(struct hid_item *item)
 281 {
 282         switch (item->size) {
 283                 case 1: return item->data.s8;
 284                 case 2: return item->data.s16;
 285                 case 4: return item->data.s32;
 286         }
 287         return 0;
 288 }
 289
 290 /*
 291  * Process a global item.
 292  */
 293
 294 static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
 295 {
 296         switch (item->tag) {
 297
 298                 case HID_GLOBAL_ITEM_TAG_PUSH:
 299
 300                         if (parser->global_stack_ptr == HID_GLOBAL_STACK_SIZE) {
 301                                 dbg("global enviroment stack overflow");
 302                                 return -1;
 303                         }
 304
 305                         memcpy(parser->global_stack + parser->global_stack_ptr++,
 306                                 &parser->global, sizeof(struct hid_global));
 307                         return 0;
 308
 309                 case HID_GLOBAL_ITEM_TAG_POP:
 310
 311                         if (!parser->global_stack_ptr) {
 312                                 dbg("global enviroment stack underflow");
 313                                 return -1;
 314                         }
 315
 316                         memcpy(&parser->global, parser->global_stack + --parser->global_stack_ptr,
 317                                 sizeof(struct hid_global));
 318                         return 0;
 319
 320                 case HID_GLOBAL_ITEM_TAG_USAGE_PAGE:
 321                         parser->global.usage_page = item_udata(item);
 322                         return 0;
 323
 324                 case HID_GLOBAL_ITEM_TAG_LOGICAL_MINIMUM:
 325                         parser->global.logical_minimum = item_sdata(item);
 326                         return 0;
 327
 328                 case HID_GLOBAL_ITEM_TAG_LOGICAL_MAXIMUM:
 329                         if (parser->global.logical_minimum < 0)
 330                                 parser->global.logical_maximum = item_sdata(item);
 331                         else
 332                                 parser->global.logical_maximum = item_udata(item);
 333                         return 0;
 334
 335                 case HID_GLOBAL_ITEM_TAG_PHYSICAL_MINIMUM:
 336                         parser->global.physical_minimum = item_sdata(item);
 337                         return 0;
 338
 339                 case HID_GLOBAL_ITEM_TAG_PHYSICAL_MAXIMUM:
 340                         if (parser->global.physical_minimum < 0)
 341                                 parser->global.physical_maximum = item_sdata(item);
 342                         else
 343                                 parser->global.physical_maximum = item_udata(item);
 344                         return 0;
 345
 346                 case HID_GLOBAL_ITEM_TAG_UNIT_EXPONENT:
 347                         parser->global.unit_exponent = item_sdata(item);
 348                         return 0;
 349
 350                 case HID_GLOBAL_ITEM_TAG_UNIT:
 351                         parser->global.unit = item_udata(item);
 352                         return 0;
 353
 354                 case HID_GLOBAL_ITEM_TAG_REPORT_SIZE:
 355                         if ((parser->global.report_size = item_udata(item)) > 32) {
 356                                 dbg("invalid report_size %d", parser->global.report_size);
 357                                 return -1;
 358                         }
 359                         return 0;
 360
 361                 case HID_GLOBAL_ITEM_TAG_REPORT_COUNT:
 362                         if ((parser->global.report_count = item_udata(item)) > HID_MAX_USAGES) {
 363                                 dbg("invalid report_count %d", parser->global.report_count);
 364                                 return -1;
 365                         }
 366                         return 0;
 367
 368                 case HID_GLOBAL_ITEM_TAG_REPORT_ID:
 369                         if ((parser->global.report_id = item_udata(item)) == 0) {
 370                                 dbg("report_id 0 is invalid");
 371                                 return -1;
 372                         }
 373                         return 0;
 374
 375                 default:
 376                         dbg("unknown global tag 0x%x", item->tag);
 377                         return -1;
 378         }
 379 }
 380
 381 /*
 382  * Process a local item.
 383  */
 384
 385 static int hid_parser_local(struct hid_parser *parser, struct hid_item *item)
 386 {
 387         __u32 data;
 388         unsigned n;
 389
 390         if (item->size == 0) {
 391                 dbg("item data expected for local item");
 392                 return -1;
 393         }
 394
 395         data = item_udata(item);
 396
 397         switch (item->tag) {
 398
 399                 case HID_LOCAL_ITEM_TAG_DELIMITER:
 400
 401                         if (data) {
 402                                 /*
 403                                  * We treat items before the first delimiter
 404                                  * as global to all usage sets (branch 0).
 405                                  * In the moment we process only these global
 406                                  * items and the first delimiter set.
 407                                  */
 408                                 if (parser->local.delimiter_depth != 0) {
 409                                         dbg("nested delimiters");
 410                                         return -1;
 411                                 }
 412                                 parser->local.delimiter_depth++;
 413                                 parser->local.delimiter_branch++;
 414                         } else {
 415                                 if (parser->local.delimiter_depth < 1) {
 416                                         dbg("bogus close delimiter");
 417                                         return -1;
 418                                 }
 419                                 parser->local.delimiter_depth--;
 420                         }
 421                         return 1;
 422
 423                 case HID_LOCAL_ITEM_TAG_USAGE:
 424
 425                         if (parser->local.delimiter_branch > 1) {
 426                                 dbg("alternative usage ignored");
 427                                 return 0;
 428                         }
 429
 430                         if (item->size <= 2)
 431                                 data = (parser->global.usage_page << 16) + data;
 432
 433                         return hid_add_usage(parser, data);
 434
 435                 case HID_LOCAL_ITEM_TAG_USAGE_MINIMUM:
 436
 437                         if (parser->local.delimiter_branch > 1) {
 438                                 dbg("alternative usage ignored");
 439                                 return 0;
 440                         }
 441
 442                         if (item->size <= 2)
 443                                 data = (parser->global.usage_page << 16) + data;
 444
 445                         parser->local.usage_minimum = data;
 446                         return 0;
 447
 448                 case HID_LOCAL_ITEM_TAG_USAGE_MAXIMUM:
 449
 450                         if (parser->local.delimiter_branch > 1) {
 451                                 dbg("alternative usage ignored");
 452                                 return 0;
 453                         }
 454
 455                         if (item->size <= 2)
 456                                 data = (parser->global.usage_page << 16) + data;
 457
 458                         for (n = parser->local.usage_minimum; n <= data; n++)
 459                                 if (hid_add_usage(parser, n)) {
 460                                         dbg("hid_add_usage failed\n");
 461                                         return -1;
 462                                 }
 463                         return 0;
 464
 465                 default:
 466
 467                         dbg("unknown local item tag 0x%x", item->tag);
 468                         return 0;
 469         }
 470         return 0;
 471 }
 472
 473 /*
 474  * Process a main item.
 475  */
 476
 477 static int hid_parser_main(struct hid_parser *parser, struct hid_item *item)
 478 {
 479         __u32 data;
 480         int ret;
 481
 482         data = item_udata(item);
 483
 484         switch (item->tag) {
 485                 case HID_MAIN_ITEM_TAG_BEGIN_COLLECTION:
 486                         ret = open_collection(parser, data & 0xff);
 487                         break;
 488                 case HID_MAIN_ITEM_TAG_END_COLLECTION:
 489                         ret = close_collection(parser);
 490                         break;
 491                 case HID_MAIN_ITEM_TAG_INPUT:
 492                         ret = hid_add_field(parser, HID_INPUT_REPORT, data);
 493                         break;
 494                 case HID_MAIN_ITEM_TAG_OUTPUT:
 495                         ret = hid_add_field(parser, HID_OUTPUT_REPORT, data);
 496                         break;
 497                 case HID_MAIN_ITEM_TAG_FEATURE:
 498                         ret = hid_add_field(parser, HID_FEATURE_REPORT, data);
 499                         break;
 500                 default:
 501                         dbg("unknown main item tag 0x%x", item->tag);
 502                         ret = 0;
 503         }
 504
 505         memset(&parser->local, 0, sizeof(parser->local));       /* Reset the local parser environment */
 506
 507         return ret;
 508 }
 509
 510 /*
 511  * Process a reserved item.
 512  */
 513
 514 static int hid_parser_reserved(struct hid_parser *parser, struct hid_item *item)
 515 {
 516         dbg("reserved item type, tag 0x%x", item->tag);
 517         return 0;
 518 }
 519
 520 /*
 521  * Free a report and all registered fields. The field->usage and
 522  * field->value table's are allocated behind the field, so we need
 523  * only to free(field) itself.
 524  */
 525
 526 static void hid_free_report(struct hid_report *report)
 527 {
 528         unsigned n;
 529
 530         for (n = 0; n < report->maxfield; n++)
 531                 kfree(report->field[n]);
 532         kfree(report);
 533 }
 534
 535 /*
 536  * Free a device structure, all reports, and all fields.
 537  */
 538
 539 static void hid_free_device(struct hid_device *device)
 540 {
 541         unsigned i,j;
 542
 543         hid_ff_exit(device);
 544
 545         for (i = 0; i < HID_REPORT_TYPES; i++) {
 546                 struct hid_report_enum *report_enum = device->report_enum + i;
 547
 548                 for (j = 0; j < 256; j++) {
 549                         struct hid_report *report = report_enum->report_id_hash[j];
 550                         if (report)
 551                                 hid_free_report(report);
 552                 }
 553         }
 554
 555         if (device->rdesc)
 556                 kfree(device->rdesc);
 557         kfree(device);
 558 }
 559
 560 /*
 561  * Fetch a report description item from the data stream. We support long
 562  * items, though they are not used yet.
 563  */
 564
 565 static u8 *fetch_item(__u8 *start, __u8 *end, struct hid_item *item)
 566 {
 567         u8 b;
 568
 569         if ((end - start) <= 0)
 570                 return NULL;
 571
 572         b = *start++;
 573
 574         item->type = (b >> 2) & 3;
 575         item->tag  = (b >> 4) & 15;
 576
 577         if (item->tag == HID_ITEM_TAG_LONG) {
 578
 579                 item->format = HID_ITEM_FORMAT_LONG;
 580
 581                 if ((end - start) < 2)
 582                         return NULL;
 583
 584                 item->size = *start++;
 585                 item->tag  = *start++;
 586
 587                 if ((end - start) < item->size)
 588                         return NULL;
 589
 590                 item->data.longdata = start;
 591                 start += item->size;
 592                 return start;
 593         }
 594
 595         item->format = HID_ITEM_FORMAT_SHORT;
 596         item->size = b & 3;
 597
 598         switch (item->size) {
 599
 600                 case 0:
 601                         return start;
 602
 603                 case 1:
 604                         if ((end - start) < 1)
 605                                 return NULL;
 606                         item->data.u8 = *start++;
 607                         return start;
 608
 609                 case 2:
 610                         if ((end - start) < 2)
 611                                 return NULL;
 612                         item->data.u16 = le16_to_cpu(get_unaligned((__u16*)start));
 613                         start = (__u8 *)((__u16 *)start + 1);
 614                         return start;
 615
 616                 case 3:
 617                         item->size++;
 618                         if ((end - start) < 4)
 619                                 return NULL;
 620                         item->data.u32 = le32_to_cpu(get_unaligned((__u32*)start));
 621                         start = (__u8 *)((__u32 *)start + 1);
 622                         return start;
 623         }
 624
 625         return NULL;
 626 }
 627
 628 /*
 629  * Parse a report description into a hid_device structure. Reports are
 630  * enumerated, fields are attached to these reports.
 631  */
 632
 633 static struct hid_device *hid_parse_report(__u8 *start, unsigned size)
 634 {
 635         struct hid_device *device;
 636         struct hid_parser *parser;
 637         struct hid_item item;
 638         __u8 *end;
 639         unsigned i;
 640         static int (*dispatch_type[])(struct hid_parser *parser,
 641                                       struct hid_item *item) = {
 642                 hid_parser_main,
 643                 hid_parser_global,
 644                 hid_parser_local,
 645                 hid_parser_reserved
 646         };
 647
 648         if (!(device = kmalloc(sizeof(struct hid_device), GFP_KERNEL)))
 649                 return NULL;
 650         memset(device, 0, sizeof(struct hid_device));
 651
 652         if (!(device->collection =kmalloc(sizeof(struct hid_collection) *
 653                                    HID_DEFAULT_NUM_COLLECTIONS, GFP_KERNEL))) {
 654                 kfree(device);
 655                 return NULL;
 656         }
 657         memset(device->collection, 0, sizeof(struct hid_collection) *
 658                HID_DEFAULT_NUM_COLLECTIONS);
 659         device->collection_size = HID_DEFAULT_NUM_COLLECTIONS;
 660
 661         for (i = 0; i < HID_REPORT_TYPES; i++)
 662                 INIT_LIST_HEAD(&device->report_enum[i].report_list);
 663
 664         if (!(device->rdesc = (__u8 *)kmalloc(size, GFP_KERNEL))) {
 665                 kfree(device->collection);
 666                 kfree(device);
 667                 return NULL;
 668         }
 669         memcpy(device->rdesc, start, size);
 670         device->rsize = size;
 671
 672         if (!(parser = kmalloc(sizeof(struct hid_parser), GFP_KERNEL))) {
 673                 kfree(device->rdesc);
 674                 kfree(device->collection);
 675                 kfree(device);
 676                 return NULL;
 677         }
 678         memset(parser, 0, sizeof(struct hid_parser));
 679         parser->device = device;
 680
 681         end = start + size;
 682         while ((start = fetch_item(start, end, &item)) != 0) {
 683
 684                 if (item.format != HID_ITEM_FORMAT_SHORT) {
 685                         dbg("unexpected long global item");
 686                         kfree(device->collection);
 687                         hid_free_device(device);
 688                         kfree(parser);
 689                         return NULL;
 690                 }
 691
 692                 if (dispatch_type[item.type](parser, &item)) {
 693                         dbg("item %u %u %u %u parsing failed\n",
 694                                 item.format, (unsigned)item.size, (unsigned)item.type, (unsigned)item.tag);
 695                         kfree(device->collection);
 696                         hid_free_device(device);
 697                         kfree(parser);
 698                         return NULL;
 699                 }
 700
 701                 if (start == end) {
 702                         if (parser->collection_stack_ptr) {
 703                                 dbg("unbalanced collection at end of report description");
 704                                 kfree(device->collection);
 705                                 hid_free_device(device);
 706                                 kfree(parser);
 707                                 return NULL;
 708                         }
 709                         if (parser->local.delimiter_depth) {
 710                                 dbg("unbalanced delimiter at end of report description");
 711                                 kfree(device->collection);
 712                                 hid_free_device(device);
 713                                 kfree(parser);
 714                                 return NULL;
 715                         }
 716                         kfree(parser);
 717                         return device;
 718                 }
 719         }
 720
 721         dbg("item fetching failed at offset %d\n", (int)(end - start));
 722         kfree(device->collection);
 723         hid_free_device(device);
 724         kfree(parser);
 725         return NULL;
 726 }
 727
 728 /*
 729  * Convert a signed n-bit integer to signed 32-bit integer. Common
 730  * cases are done through the compiler, the screwed things has to be
 731  * done by hand.
 732  */
 733
 734 static __inline__ __s32 snto32(__u32 value, unsigned n)
 735 {
 736         switch (n) {
 737                 case 8:  return ((__s8)value);
 738                 case 16: return ((__s16)value);
 739                 case 32: return ((__s32)value);
 740         }
 741         return value & (1 << (n - 1)) ? value | (-1 << n) : value;
 742 }
 743
 744 /*
 745  * Convert a signed 32-bit integer to a signed n-bit integer.
 746  */
 747
 748 static __inline__ __u32 s32ton(__s32 value, unsigned n)
 749 {
 750         __s32 a = value >> (n - 1);
 751         if (a && a != -1)
 752                 return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
 753         return value & ((1 << n) - 1);
 754 }
 755
 756 /*
 757  * Extract/implement a data field from/to a report.
 758  */
 759
 760 static __inline__ __u32 extract(__u8 *report, unsigned offset, unsigned n)
 761 {
 762         report += (offset >> 5) << 2; offset &= 31;
 763         return (le64_to_cpu(get_unaligned((__u64*)report)) >> offset) & ((1 << n) - 1);
 764 }
 765
 766 static __inline__ void implement(__u8 *report, unsigned offset, unsigned n, __u32 value)
 767 {
 768         report += (offset >> 5) << 2; offset &= 31;
 769         put_unaligned((get_unaligned((__u64*)report)
 770                 & cpu_to_le64(~((((__u64) 1 << n) - 1) << offset)))
 771                 | cpu_to_le64((__u64)value << offset), (__u64*)report);
 772 }
 773
 774 /*
 775  * Search an array for a value.
 776  */
 777
 778 static __inline__ int search(__s32 *array, __s32 value, unsigned n)
 779 {
 780         while (n--) {
 781                 if (*array++ == value)
 782                         return 0;
 783         }
 784         return -1;
 785 }
 786
 787 static void hid_process_event(struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value, struct pt_regs *regs)
 788 {
 789         hid_dump_input(usage, value);
 790         if (hid->claimed & HID_CLAIMED_INPUT)
 791                 hidinput_hid_event(hid, field, usage, value, regs);
 792         if (hid->claimed & HID_CLAIMED_HIDDEV)
 793                 hiddev_hid_event(hid, field, usage, value, regs);
 794 }
 795
 796 /*
 797  * Analyse a received field, and fetch the data from it. The field
 798  * content is stored for next report processing (we do differential
 799  * reporting to the layer).
 800  */
 801
 802 static void hid_input_field(struct hid_device *hid, struct hid_field *field, __u8 *data, struct pt_regs *regs)
 803 {
 804         unsigned n;
 805         unsigned count = field->report_count;
 806         unsigned offset = field->report_offset;
 807         unsigned size = field->report_size;
 808         __s32 min = field->logical_minimum;
 809         __s32 max = field->logical_maximum;
 810         __s32 value[count]; /* WARNING: gcc specific */
 811
 812         for (n = 0; n < count; n++) {
 813
 814                         value[n] = min < 0 ? snto32(extract(data, offset + n * size, size), size) :
 815                                                     extract(data, offset + n * size, size);
 816
 817                         if (!(field->flags & HID_MAIN_ITEM_VARIABLE) /* Ignore report if ErrorRollOver */
 818                             && value[n] >= min && value[n] <= max
 819                             && field->usage[value[n] - min].hid == HID_UP_KEYBOARD + 1)
 820                                 return;
 821         }
 822
 823         for (n = 0; n < count; n++) {
 824
 825                 if (HID_MAIN_ITEM_VARIABLE & field->flags) {
 826
 827                         if (field->flags & HID_MAIN_ITEM_RELATIVE) {
 828                                 if (!value[n])
 829                                         continue;
 830                         } else {
 831                                 if (value[n] == field->value[n])
 832                                         continue;
 833                         }
 834                         hid_process_event(hid, field, &field->usage[n], value[n], regs);
 835                         continue;
 836                 }
 837
 838                 if (field->value[n] >= min && field->value[n] <= max
 839                         && field->usage[field->value[n] - min].hid
 840                         && search(value, field->value[n], count))
 841                                 hid_process_event(hid, field, &field->usage[field->value[n] - min], 0, regs);
 842
 843                 if (value[n] >= min && value[n] <= max
 844                         && field->usage[value[n] - min].hid
 845                         && search(field->value, value[n], count))
 846                                 hid_process_event(hid, field, &field->usage[value[n] - min], 1, regs);
 847         }
 848
 849         memcpy(field->value, value, count * sizeof(__s32));
 850 }
 851
 852 static int hid_input_report(int type, struct urb *urb, struct pt_regs *regs)
 853 {
 854         struct hid_device *hid = urb->context;
 855         struct hid_report_enum *report_enum = hid->report_enum + type;
 856         u8 *data = urb->transfer_buffer;
 857         int len = urb->actual_length;
 858         struct hid_report *report;
 859         int n, size;
 860
 861         if (!len) {
 862                 dbg("empty report");
 863                 return -1;
 864         }
 865
 866 #ifdef DEBUG_DATA
 867         printk(KERN_DEBUG __FILE__ ": report (size %u) (%snumbered)\n", len, report_enum->numbered ? "" : "un");
 868 #endif
 869
 870         n = 0;                          /* Normally report number is 0 */
 871         if (report_enum->numbered) {    /* Device uses numbered reports, data[0] is report number */
 872                 n = *data++;
 873                 len--;
 874         }
 875
 876 #ifdef DEBUG_DATA
 877         {
 878                 int i;
 879                 printk(KERN_DEBUG __FILE__ ": report %d (size %u) = ", n, len);
 880                 for (i = 0; i < len; i++)
 881                         printk(" %02x", data[i]);
 882                 printk("\n");
 883         }
 884 #endif
 885
 886         if (!(report = report_enum->report_id_hash[n])) {
 887                 dbg("undefined report_id %d received", n);
 888                 return -1;
 889         }
 890
 891         size = ((report->size - 1) >> 3) + 1;
 892
 893         if (len < size) {
 894                 dbg("report %d is too short, (%d < %d)", report->id, len, size);
 895                 return -1;
 896         }
 897
 898         if (hid->claimed & HID_CLAIMED_HIDDEV)
 899                 hiddev_report_event(hid, report);
 900
 901         for (n = 0; n < report->maxfield; n++)
 902                 hid_input_field(hid, report->field[n], data, regs);
 903
 904         if (hid->claimed & HID_CLAIMED_INPUT)
 905                 hidinput_report_event(hid, report);
 906
 907         return 0;
 908 }
 909
 910 /*
 911  * Input interrupt completion handler.
 912  */
 913
 914 static void hid_irq_in(struct urb *urb, struct pt_regs *regs)
 915 {
 916         struct hid_device       *hid = urb->context;
 917         int                     status;
 918
 919         switch (urb->status) {
 920         case 0:                 /* success */
 921                 hid_input_report(HID_INPUT_REPORT, urb, regs);
 922                 break;
 923         case -ECONNRESET:       /* unlink */
 924         case -ENOENT:
 925         case -ESHUTDOWN:
 926                 return;
 927         default:                /* error */
 928                 dbg("nonzero status in input irq %d", urb->status);
 929         }
 930
 931         status = usb_submit_urb (urb, SLAB_ATOMIC);
 932         if (status)
 933                 err ("can't resubmit intr, %s-%s/input%d, status %d",
 934                                 hid->dev->bus->bus_name, hid->dev->devpath,
 935                                 hid->ifnum, status);
 936 }
 937
 938 /*
 939  * Output the field into the report.
 940  */
 941
 942 static void hid_output_field(struct hid_field *field, __u8 *data)
 943 {
 944         unsigned count = field->report_count;
 945         unsigned offset = field->report_offset;
 946         unsigned size = field->report_size;
 947         unsigned n;
 948
 949         for (n = 0; n < count; n++) {
 950                 if (field->logical_minimum < 0) /* signed values */
 951                         implement(data, offset + n * size, size, s32ton(field->value[n], size));
 952                  else                           /* unsigned values */
 953                         implement(data, offset + n * size, size, field->value[n]);
 954         }
 955 }
 956
 957 /*
 958  * Create a report.
 959  */
 960
 961 void hid_output_report(struct hid_report *report, __u8 *data)
 962 {
 963         unsigned n;
 964
 965         if (report->id > 0)
 966                 *data++ = report->id;
 967
 968         for (n = 0; n < report->maxfield; n++)
 969                 hid_output_field(report->field[n], data);
 970 }
 971
 972 /*
 973  * Set a field value. The report this field belongs to has to be
 974  * created and transferred to the device, to set this value in the
 975  * device.
 976  */
 977
 978 int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
 979 {
 980         unsigned size = field->report_size;
 981
 982         hid_dump_input(field->usage + offset, value);
 983
 984         if (offset >= field->report_count) {
 985                 dbg("offset (%d) exceeds report_count (%d)", offset, field->report_count);
 986                 hid_dump_field(field, 8);
 987                 return -1;
 988         }
 989         if (field->logical_minimum < 0) {
 990                 if (value != snto32(s32ton(value, size), size)) {
 991                         dbg("value %d is out of range", value);
 992                         return -1;
 993                 }
 994         }
 995         field->value[offset] = value;
 996         return 0;
 997 }
 998
 999 int hid_find_field(struct hid_device *hid, unsigned int type, unsigned int code, struct hid_field **field)
1000 {
1001         struct hid_report_enum *report_enum = hid->report_enum + HID_OUTPUT_REPORT;
1002         struct list_head *list = report_enum->report_list.next;
1003         int i, j;
1004
1005         while (list != &report_enum->report_list) {
1006                 struct hid_report *report = (struct hid_report *) list;
1007                 list = list->next;
1008                 for (i = 0; i < report->maxfield; i++) {
1009                         *field = report->field[i];
1010                         for (j = 0; j < (*field)->maxusage; j++)
1011                                 if ((*field)->usage[j].type == type && (*field)->usage[j].code == code)
1012                                         return j;
1013                 }
1014         }
1015         return -1;
1016 }
1017
1018 /*
1019  * Find a report with a specified HID usage.
1020  */
1021
1022 int hid_find_report_by_usage(struct hid_device *hid, __u32 wanted_usage, struct hid_report **report, int type)
1023 {
1024         struct hid_report_enum *report_enum = hid->report_enum + type;
1025         struct list_head *list = report_enum->report_list.next;
1026         int i, j;
1027
1028         while (list != &report_enum->report_list) {
1029                 *report = (struct hid_report *) list;
1030                 list = list->next;
1031                 for (i = 0; i < (*report)->maxfield; i++) {
1032                         struct hid_field *field = (*report)->field[i];
1033                         for (j = 0; j < field->maxusage; j++)
1034                                 if (field->logical == wanted_usage)
1035                                         return j;
1036                 }
1037         }
1038         return -1;
1039 }
1040
1041 int hid_find_field_in_report(struct hid_report *report, __u32 wanted_usage, struct hid_field **field)
1042 {
1043         int i, j;
1044
1045         for (i = 0; i < report->maxfield; i++) {
1046                 *field = report->field[i];
1047                 for (j = 0; j < (*field)->maxusage; j++)
1048                         if ((*field)->usage[j].hid == wanted_usage)
1049                                 return j;
1050         }
1051
1052         return -1;
1053 }
1054
1055 static int hid_submit_out(struct hid_device *hid)
1056 {
1057         struct hid_report *report;
1058
1059         report = hid->out[hid->outtail];
1060
1061         hid_output_report(report, hid->outbuf);
1062         hid->urbout->transfer_buffer_length = ((report->size - 1) >> 3) + 1 + (report->id > 0);
1063         hid->urbout->dev = hid->dev;
1064
1065         dbg("submitting out urb");
1066
1067         if (usb_submit_urb(hid->urbout, GFP_ATOMIC)) {
1068                 err("usb_submit_urb(out) failed");
1069                 return -1;
1070         }
1071
1072         return 0;
1073 }
1074
1075 static int hid_submit_ctrl(struct hid_device *hid)
1076 {
1077         struct hid_report *report;
1078         unsigned char dir;
1079         int len;
1080
1081         report = hid->ctrl[hid->ctrltail].report;
1082         dir = hid->ctrl[hid->ctrltail].dir;
1083
1084         len = ((report->size - 1) >> 3) + 1 + (report->id > 0);
1085         if (dir == USB_DIR_OUT) {
1086                 hid_output_report(report, hid->ctrlbuf);
1087                 hid->urbctrl->pipe = usb_sndctrlpipe(hid->dev, 0);
1088                 hid->urbctrl->transfer_buffer_length = len;
1089         } else {
1090                 int maxpacket, padlen;
1091
1092                 hid->urbctrl->pipe = usb_rcvctrlpipe(hid->dev, 0);
1093                 maxpacket = usb_maxpacket(hid->dev, hid->urbctrl->pipe, 0);
1094                 if (maxpacket > 0) {
1095                         padlen = (len + maxpacket - 1) / maxpacket;
1096                         padlen *= maxpacket;
1097                         if (padlen > HID_BUFFER_SIZE)
1098                                 padlen = HID_BUFFER_SIZE;
1099                 } else
1100                         padlen = 0;
1101                 hid->urbctrl->transfer_buffer_length = padlen;
1102         }
1103         hid->urbctrl->dev = hid->dev;
1104
1105         hid->cr->bRequestType = USB_TYPE_CLASS | USB_RECIP_INTERFACE | dir;
1106         hid->cr->bRequest = (dir == USB_DIR_OUT) ? HID_REQ_SET_REPORT : HID_REQ_GET_REPORT;
1107         hid->cr->wValue = cpu_to_le16(((report->type + 1) << 8) | report->id);
1108         hid->cr->wIndex = cpu_to_le16(hid->ifnum);
1109         hid->cr->wLength = cpu_to_le16(len);
1110
1111         dbg("submitting ctrl urb: %s wValue=0x%04x wIndex=0x%04x wLength=%u",
1112             hid->cr->bRequest == HID_REQ_SET_REPORT ? "Set_Report" : "Get_Report",
1113             hid->cr->wValue, hid->cr->wIndex, hid->cr->wLength);
1114
1115         if (usb_submit_urb(hid->urbctrl, GFP_ATOMIC)) {
1116                 err("usb_submit_urb(ctrl) failed");
1117                 return -1;
1118         }
1119
1120         return 0;
1121 }
1122
1123 /*
1124  * Output interrupt completion handler.
1125  */
1126
1127 static void hid_irq_out(struct urb *urb, struct pt_regs *regs)
1128 {
1129         struct hid_device *hid = urb->context;
1130         unsigned long flags;
1131
1132         if (urb->status)
1133                 warn("output irq status %d received", urb->status);
1134
1135         spin_lock_irqsave(&hid->outlock, flags);
1136
1137         hid->outtail = (hid->outtail + 1) & (HID_OUTPUT_FIFO_SIZE - 1);
1138
1139         if (hid->outhead != hid->outtail) {
1140                 hid_submit_out(hid);
1141                 spin_unlock_irqrestore(&hid->outlock, flags);
1142                 return;
1143         }
1144
1145         clear_bit(HID_OUT_RUNNING, &hid->iofl);
1146
1147         spin_unlock_irqrestore(&hid->outlock, flags);
1148
1149         wake_up(&hid->wait);
1150 }
1151
1152 /*
1153  * Control pipe completion handler.
1154  */
1155
1156 static void hid_ctrl(struct urb *urb, struct pt_regs *regs)
1157 {
1158         struct hid_device *hid = urb->context;
1159         unsigned long flags;
1160
1161         if (urb->status)
1162                 warn("ctrl urb status %d received", urb->status);
1163
1164         spin_lock_irqsave(&hid->ctrllock, flags);
1165
1166         if (hid->ctrl[hid->ctrltail].dir == USB_DIR_IN)
1167                 hid_input_report(hid->ctrl[hid->ctrltail].report->type, urb, regs);
1168
1169         hid->ctrltail = (hid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1);
1170
1171         if (hid->ctrlhead != hid->ctrltail) {
1172                 hid_submit_ctrl(hid);
1173                 spin_unlock_irqrestore(&hid->ctrllock, flags);
1174                 return;
1175         }
1176
1177         clear_bit(HID_CTRL_RUNNING, &hid->iofl);
1178
1179         spin_unlock_irqrestore(&hid->ctrllock, flags);
1180
1181         wake_up(&hid->wait);
1182 }
1183
1184 void hid_submit_report(struct hid_device *hid, struct hid_report *report, unsigned char dir)
1185 {
1186         int head;
1187         unsigned long flags;
1188
1189         if ((hid->quirks & HID_QUIRK_NOGET) && dir == USB_DIR_IN)
1190                 return;
1191
1192         if (hid->urbout && dir == USB_DIR_OUT && report->type == HID_OUTPUT_REPORT) {
1193
1194                 spin_lock_irqsave(&hid->outlock, flags);
1195
1196                 if ((head = (hid->outhead + 1) & (HID_OUTPUT_FIFO_SIZE - 1)) == hid->outtail) {
1197                         spin_unlock_irqrestore(&hid->outlock, flags);
1198                         warn("output queue full");
1199                         return;
1200                 }
1201
1202                 hid->out[hid->outhead] = report;
1203                 hid->outhead = head;
1204
1205                 if (!test_and_set_bit(HID_OUT_RUNNING, &hid->iofl))
1206                         hid_submit_out(hid);
1207
1208                 spin_unlock_irqrestore(&hid->outlock, flags);
1209                 return;
1210         }
1211
1212         spin_lock_irqsave(&hid->ctrllock, flags);
1213
1214         if ((head = (hid->ctrlhead + 1) & (HID_CONTROL_FIFO_SIZE - 1)) == hid->ctrltail) {
1215                 spin_unlock_irqrestore(&hid->ctrllock, flags);
1216                 warn("control queue full");
1217                 return;
1218         }
1219
1220         hid->ctrl[hid->ctrlhead].report = report;
1221         hid->ctrl[hid->ctrlhead].dir = dir;
1222         hid->ctrlhead = head;
1223
1224         if (!test_and_set_bit(HID_CTRL_RUNNING, &hid->iofl))
1225                 hid_submit_ctrl(hid);
1226
1227         spin_unlock_irqrestore(&hid->ctrllock, flags);
1228 }
1229
1230 int hid_wait_io(struct hid_device *hid)
1231 {
1232         DECLARE_WAITQUEUE(wait, current);
1233         int timeout = 10*HZ;
1234
1235         set_current_state(TASK_UNINTERRUPTIBLE);
1236         add_wait_queue(&hid->wait, &wait);
1237
1238         while (timeout && (test_bit(HID_CTRL_RUNNING, &hid->iofl) ||
1239                            test_bit(HID_OUT_RUNNING, &hid->iofl)))
1240                 timeout = schedule_timeout(timeout);
1241
1242         set_current_state(TASK_RUNNING);
1243         remove_wait_queue(&hid->wait, &wait);
1244
1245         if (!timeout) {
1246                 dbg("timeout waiting for ctrl or out queue to clear");
1247                 return -1;
1248         }
1249
1250         return 0;
1251 }
1252
1253 static int hid_get_class_descriptor(struct usb_device *dev, int ifnum,
1254                 unsigned char type, void *buf, int size)
1255 {
1256         return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
1257                 USB_REQ_GET_DESCRIPTOR, USB_RECIP_INTERFACE | USB_DIR_IN,
1258                 (type << 8), ifnum, buf, size, HZ * USB_CTRL_GET_TIMEOUT);
1259 }
1260
1261 int hid_open(struct hid_device *hid)
1262 {
1263         if (hid->open++)
1264                 return 0;
1265
1266         hid->urbin->dev = hid->dev;
1267
1268         if (usb_submit_urb(hid->urbin, GFP_KERNEL))
1269                 return -EIO;
1270
1271         return 0;
1272 }
1273
1274 void hid_close(struct hid_device *hid)
1275 {
1276         if (!--hid->open)
1277                 usb_unlink_urb(hid->urbin);
1278 }
1279
1280 /*
1281  * Initialize all reports
1282  */
1283
1284 void hid_init_reports(struct hid_device *hid)
1285 {
1286         struct hid_report_enum *report_enum;
1287         struct hid_report *report;
1288         struct list_head *list;
1289         int err, ret;
1290
1291         /*
1292          * The Set_Idle request is supposed to affect only the
1293          * "Interrupt In" pipe. Unfortunately, buggy devices such as
1294          * the BTC keyboard (ID 046e:5303) the request also affects
1295          * Get_Report requests on the control pipe.  In the worst
1296          * case, if the device was put on idle for an indefinite
1297          * amount of time (as we do below) and there are no input
1298          * events to report, the Get_Report requests will just hang
1299          * until we get a USB timeout.  To avoid this, we temporarily
1300          * establish a minimal idle time of 1ms.  This shouldn't hurt
1301          * bugfree devices and will cause a worst-case extra delay of
1302          * 1ms for buggy ones.
1303          */
1304         usb_control_msg(hid->dev, usb_sndctrlpipe(hid->dev, 0),
1305                         HID_REQ_SET_IDLE, USB_TYPE_CLASS | USB_RECIP_INTERFACE, (1 << 8),
1306                         hid->ifnum, NULL, 0, HZ * USB_CTRL_SET_TIMEOUT);
1307
1308         report_enum = hid->report_enum + HID_INPUT_REPORT;
1309         list = report_enum->report_list.next;
1310         while (list != &report_enum->report_list) {
1311                 report = (struct hid_report *) list;
1312                 hid_submit_report(hid, report, USB_DIR_IN);
1313                 list = list->next;
1314         }
1315
1316         report_enum = hid->report_enum + HID_FEATURE_REPORT;
1317         list = report_enum->report_list.next;
1318         while (list != &report_enum->report_list) {
1319                 report = (struct hid_report *) list;
1320                 hid_submit_report(hid, report, USB_DIR_IN);
1321                 list = list->next;
1322         }
1323
1324         err = 0;
1325         while ((ret = hid_wait_io(hid))) {
1326                 err |= ret;
1327                 if (test_bit(HID_CTRL_RUNNING, &hid->iofl))
1328                         usb_unlink_urb(hid->urbctrl);
1329                 if (test_bit(HID_OUT_RUNNING, &hid->iofl))
1330                         usb_unlink_urb(hid->urbout);
1331         }
1332
1333         if (err)
1334                 warn("timeout initializing reports\n");
1335
1336         report_enum = hid->report_enum + HID_INPUT_REPORT;
1337         list = report_enum->report_list.next;
1338         while (list != &report_enum->report_list) {
1339                 report = (struct hid_report *) list;
1340                 usb_control_msg(hid->dev, usb_sndctrlpipe(hid->dev, 0),
1341                         HID_REQ_SET_IDLE, USB_TYPE_CLASS | USB_RECIP_INTERFACE, report->id,
1342                         hid->ifnum, NULL, 0, HZ * USB_CTRL_SET_TIMEOUT);
1343                 list = list->next;
1344         }
1345 }
1346
1347 #define USB_VENDOR_ID_WACOM             0x056a
1348 #define USB_DEVICE_ID_WACOM_PENPARTNER  0x0000
1349 #define USB_DEVICE_ID_WACOM_GRAPHIRE    0x0010
1350 #define USB_DEVICE_ID_WACOM_INTUOS      0x0020
1351 #define USB_DEVICE_ID_WACOM_PL          0x0030
1352 #define USB_DEVICE_ID_WACOM_INTUOS2     0x0040
1353 #define USB_DEVICE_ID_WACOM_VOLITO      0x0060
1354 #define USB_DEVICE_ID_WACOM_PTU         0x0003
1355
1356 #define USB_VENDOR_ID_KBGEAR            0x084e
1357 #define USB_DEVICE_ID_KBGEAR_JAMSTUDIO  0x1001
1358
1359 #define USB_VENDOR_ID_AIPTEK            0x08ca
1360 #define USB_DEVICE_ID_AIPTEK_6000       0x0020
1361
1362 #define USB_VENDOR_ID_GRIFFIN           0x077d
1363 #define USB_DEVICE_ID_POWERMATE         0x0410
1364 #define USB_DEVICE_ID_SOUNDKNOB         0x04AA
1365
1366 #define USB_VENDOR_ID_ATEN             0x0557
1367 #define USB_DEVICE_ID_ATEN_UC100KM     0x2004
1368 #define USB_DEVICE_ID_ATEN_CS124U      0x2202
1369 #define USB_DEVICE_ID_ATEN_2PORTKVM    0x2204
1370 #define USB_DEVICE_ID_ATEN_4PORTKVM    0x2205
1371 #define USB_DEVICE_ID_ATEN_4PORTKVMC   0x2208
1372
1373 #define USB_VENDOR_ID_TOPMAX           0x0663
1374 #define USB_DEVICE_ID_TOPMAX_COBRAPAD  0x0103
1375
1376 #define USB_VENDOR_ID_HAPP             0x078b
1377 #define USB_DEVICE_ID_UGCI_DRIVING     0x0010
1378 #define USB_DEVICE_ID_UGCI_FLYING      0x0020
1379 #define USB_DEVICE_ID_UGCI_FIGHTING    0x0030
1380
1381 #define USB_VENDOR_ID_MGE              0x0463
1382 #define USB_DEVICE_ID_MGE_UPS          0xffff
1383 #define USB_DEVICE_ID_MGE_UPS1         0x0001
1384
1385 #define USB_VENDOR_ID_ONTRAK            0x0a07
1386 #define USB_DEVICE_ID_ONTRAK_ADU100     0x0064
1387
1388 #define USB_VENDOR_ID_TANGTOP          0x0d3d
1389 #define USB_DEVICE_ID_TANGTOP_USBPS2   0x0001
1390
1391 #define USB_VENDOR_ID_ESSENTIAL_REALITY 0x0d7f
1392 #define USB_DEVICE_ID_ESSENTIAL_REALITY_P5      0x0100
1393
1394 #define USB_VENDOR_ID_A4TECH            0x09DA
1395 #define USB_DEVICE_ID_A4TECH_WCP32PU    0x0006
1396
1397 #define USB_VENDOR_ID_CYPRESS           0x04b4
1398 #define USB_DEVICE_ID_CYPRESS_MOUSE     0x0001
1399
1400 #define USB_VENDOR_ID_BERKSHIRE         0x0c98
1401 #define USB_DEVICE_ID_BERKSHIRE_PCWD    0x1140
1402
1403 #define USB_VENDOR_ID_ALPS              0x0433
1404 #define USB_DEVICE_ID_IBM_GAMEPAD       0x1101
1405
1406 #define USB_VENDOR_ID_SAITEK            0x06a3
1407 #define USB_DEVICE_ID_SAITEK_RUMBLEPAD  0xff17
1408
1409 #define USB_VENDOR_ID_NEC               0x073e
1410 #define USB_DEVICE_ID_NEC_USB_GAME_PAD  0x0301
1411
1412 #define USB_VENDOR_ID_CHIC              0x05fe
1413 #define USB_DEVICE_ID_CHIC_GAMEPAD      0x0014
1414
1415 struct hid_blacklist {
1416         __u16 idVendor;
1417         __u16 idProduct;
1418         unsigned quirks;
1419 } hid_blacklist[] = {
1420
1421         { USB_VENDOR_ID_AIPTEK, USB_DEVICE_ID_AIPTEK_6000, HID_QUIRK_IGNORE },
1422         { USB_VENDOR_ID_BERKSHIRE, USB_DEVICE_ID_BERKSHIRE_PCWD, HID_QUIRK_IGNORE },
1423         { USB_VENDOR_ID_ESSENTIAL_REALITY, USB_DEVICE_ID_ESSENTIAL_REALITY_P5, HID_QUIRK_IGNORE },
1424         { USB_VENDOR_ID_KBGEAR, USB_DEVICE_ID_KBGEAR_JAMSTUDIO, HID_QUIRK_IGNORE },
1425         { USB_VENDOR_ID_GRIFFIN, USB_DEVICE_ID_POWERMATE, HID_QUIRK_IGNORE },
1426         { USB_VENDOR_ID_GRIFFIN, USB_DEVICE_ID_SOUNDKNOB, HID_QUIRK_IGNORE },
1427         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_IGNORE },
1428         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS1, HID_QUIRK_IGNORE },
1429
1430         { USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100, HID_QUIRK_IGNORE },
1431         { USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100 + 100, HID_QUIRK_IGNORE },
1432         { USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100 + 200, HID_QUIRK_IGNORE },
1433         { USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100 + 300, HID_QUIRK_IGNORE },
1434         { USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100 + 400, HID_QUIRK_IGNORE },
1435         { USB_VENDOR_ID_ONTRAK, USB_DEVICE_ID_ONTRAK_ADU100 + 500, HID_QUIRK_IGNORE },
1436
1437         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PENPARTNER, HID_QUIRK_IGNORE },
1438         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE, HID_QUIRK_IGNORE },
1439         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE + 1, HID_QUIRK_IGNORE },
1440         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE + 2, HID_QUIRK_IGNORE },
1441         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE + 3, HID_QUIRK_IGNORE },
1442         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE + 4, HID_QUIRK_IGNORE },
1443         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS, HID_QUIRK_IGNORE },
1444         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS + 1, HID_QUIRK_IGNORE },
1445         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS + 2, HID_QUIRK_IGNORE },
1446         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS + 3, HID_QUIRK_IGNORE },
1447         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS + 4, HID_QUIRK_IGNORE },
1448         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL, HID_QUIRK_IGNORE },
1449         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 1, HID_QUIRK_IGNORE },
1450         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 2, HID_QUIRK_IGNORE },
1451         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 3, HID_QUIRK_IGNORE },
1452         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 4, HID_QUIRK_IGNORE },
1453         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PL + 5, HID_QUIRK_IGNORE },
1454         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 1, HID_QUIRK_IGNORE },
1455         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 2, HID_QUIRK_IGNORE },
1456         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 3, HID_QUIRK_IGNORE },
1457         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 4, HID_QUIRK_IGNORE },
1458         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 5, HID_QUIRK_IGNORE },
1459         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS2 + 7, HID_QUIRK_IGNORE },
1460         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_VOLITO, HID_QUIRK_IGNORE },
1461         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_PTU, HID_QUIRK_IGNORE },
1462
1463         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
1464         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
1465         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
1466         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
1467         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
1468         { USB_VENDOR_ID_TANGTOP, USB_DEVICE_ID_TANGTOP_USBPS2, HID_QUIRK_NOGET },
1469
1470         { USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU, HID_QUIRK_2WHEEL_MOUSE_HACK_BACK },
1471         { USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE, HID_QUIRK_2WHEEL_MOUSE_HACK_EXTRA },
1472
1473         { USB_VENDOR_ID_ALPS, USB_DEVICE_ID_IBM_GAMEPAD, HID_QUIRK_BADPAD },
1474         { USB_VENDOR_ID_CHIC, USB_DEVICE_ID_CHIC_GAMEPAD, HID_QUIRK_BADPAD },
1475         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
1476         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
1477         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
1478         { USB_VENDOR_ID_NEC, USB_DEVICE_ID_NEC_USB_GAME_PAD, HID_QUIRK_BADPAD },
1479         { USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD, HID_QUIRK_BADPAD },
1480         { USB_VENDOR_ID_TOPMAX, USB_DEVICE_ID_TOPMAX_COBRAPAD, HID_QUIRK_BADPAD },
1481
1482         { 0, 0 }
1483 };
1484
1485 static int hid_alloc_buffers(struct usb_device *dev, struct hid_device *hid)
1486 {
1487         if (!(hid->inbuf = usb_buffer_alloc(dev, HID_BUFFER_SIZE, SLAB_ATOMIC, &hid->inbuf_dma)))
1488                 return -1;
1489         if (!(hid->outbuf = usb_buffer_alloc(dev, HID_BUFFER_SIZE, SLAB_ATOMIC, &hid->outbuf_dma)))
1490                 return -1;
1491         if (!(hid->cr = usb_buffer_alloc(dev, sizeof(*(hid->cr)), SLAB_ATOMIC, &hid->cr_dma)))
1492                 return -1;
1493         if (!(hid->ctrlbuf = usb_buffer_alloc(dev, HID_BUFFER_SIZE, SLAB_ATOMIC, &hid->ctrlbuf_dma)))
1494                 return -1;
1495
1496         return 0;
1497 }
1498
1499 static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid)
1500 {
1501         if (hid->inbuf)
1502                 usb_buffer_free(dev, HID_BUFFER_SIZE, hid->inbuf, hid->inbuf_dma);
1503         if (hid->outbuf)
1504                 usb_buffer_free(dev, HID_BUFFER_SIZE, hid->outbuf, hid->outbuf_dma);
1505         if (hid->cr)
1506                 usb_buffer_free(dev, sizeof(*(hid->cr)), hid->cr, hid->cr_dma);
1507         if (hid->ctrlbuf)
1508                 usb_buffer_free(dev, HID_BUFFER_SIZE, hid->ctrlbuf, hid->ctrlbuf_dma);
1509 }
1510
1511 static struct hid_device *usb_hid_configure(struct usb_interface *intf)
1512 {
1513         struct usb_host_interface *interface = intf->cur_altsetting;
1514         struct usb_device *dev = interface_to_usbdev (intf);
1515         struct hid_descriptor *hdesc;
1516         struct hid_device *hid;
1517         unsigned quirks = 0, rsize = 0;
1518         char *buf, *rdesc;
1519         int n;
1520
1521         for (n = 0; hid_blacklist[n].idVendor; n++)
1522                 if ((hid_blacklist[n].idVendor == dev->descriptor.idVendor) &&
1523                         (hid_blacklist[n].idProduct == dev->descriptor.idProduct))
1524                                 quirks = hid_blacklist[n].quirks;
1525
1526         if (quirks & HID_QUIRK_IGNORE)
1527                 return NULL;
1528
1529         if (usb_get_extra_descriptor(interface, HID_DT_HID, &hdesc) && ((!interface->desc.bNumEndpoints) ||
1530                 usb_get_extra_descriptor(&interface->endpoint[0], HID_DT_HID, &hdesc))) {
1531                         dbg("class descriptor not present\n");
1532                         return NULL;
1533         }
1534
1535         for (n = 0; n < hdesc->bNumDescriptors; n++)
1536                 if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
1537                         rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
1538
1539         if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) {
1540                 dbg("weird size of report descriptor (%u)", rsize);
1541                 return NULL;
1542         }
1543
1544         if (!(rdesc = kmalloc(rsize, GFP_KERNEL))) {
1545                 dbg("couldn't allocate rdesc memory");
1546                 return NULL;
1547         }
1548
1549         if ((n = hid_get_class_descriptor(dev, interface->desc.bInterfaceNumber, HID_DT_REPORT, rdesc, rsize)) < 0) {
1550                 dbg("reading report descriptor failed");
1551                 kfree(rdesc);
1552                 return NULL;
1553         }
1554
1555 #ifdef DEBUG_DATA
1556         printk(KERN_DEBUG __FILE__ ": report descriptor (size %u, read %d) = ", rsize, n);
1557         for (n = 0; n < rsize; n++)
1558                 printk(" %02x", (unsigned char) rdesc[n]);
1559         printk("\n");
1560 #endif
1561
1562         if (!(hid = hid_parse_report(rdesc, rsize))) {
1563                 dbg("parsing report descriptor failed");
1564                 kfree(rdesc);
1565                 return NULL;
1566         }
1567
1568         kfree(rdesc);
1569         hid->quirks = quirks;
1570
1571         if (hid_alloc_buffers(dev, hid)) {
1572                 hid_free_buffers(dev, hid);
1573                 goto fail;
1574         }
1575
1576         for (n = 0; n < interface->desc.bNumEndpoints; n++) {
1577
1578                 struct usb_endpoint_descriptor *endpoint;
1579                 int pipe;
1580
1581                 endpoint = &interface->endpoint[n].desc;
1582                 if ((endpoint->bmAttributes & 3) != 3)          /* Not an interrupt endpoint */
1583                         continue;
1584
1585                 if (endpoint->bEndpointAddress & USB_DIR_IN) {
1586                         int len;
1587
1588                         if (hid->urbin)
1589                                 continue;
1590                         if (!(hid->urbin = usb_alloc_urb(0, GFP_KERNEL)))
1591                                 goto fail;
1592                         pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
1593                         len = usb_maxpacket(dev, pipe, 0);
1594                         if (len > HID_BUFFER_SIZE)
1595                                 len = HID_BUFFER_SIZE;
1596                         usb_fill_int_urb(hid->urbin, dev, pipe, hid->inbuf, len,
1597                                          hid_irq_in, hid, endpoint->bInterval);
1598                         hid->urbin->transfer_dma = hid->inbuf_dma;
1599                         hid->urbin->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1600                 } else {
1601                         if (hid->urbout)
1602                                 continue;
1603                         if (!(hid->urbout = usb_alloc_urb(0, GFP_KERNEL)))
1604                                 goto fail;
1605                         pipe = usb_sndintpipe(dev, endpoint->bEndpointAddress);
1606                         usb_fill_int_urb(hid->urbout, dev, pipe, hid->outbuf, 0,
1607                                           hid_irq_out, hid, 1);
1608                         hid->urbout->transfer_dma = hid->outbuf_dma;
1609                         hid->urbout->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1610                 }
1611         }
1612
1613         if (!hid->urbin) {
1614                 err("couldn't find an input interrupt endpoint");
1615                 goto fail;
1616         }
1617
1618         init_waitqueue_head(&hid->wait);
1619
1620         hid->outlock = SPIN_LOCK_UNLOCKED;
1621         hid->ctrllock = SPIN_LOCK_UNLOCKED;
1622
1623         hid->version = le16_to_cpu(hdesc->bcdHID);
1624         hid->country = hdesc->bCountryCode;
1625         hid->dev = dev;
1626         hid->intf = intf;
1627         hid->ifnum = interface->desc.bInterfaceNumber;
1628
1629         hid->name[0] = 0;
1630
1631         if (!(buf = kmalloc(64, GFP_KERNEL)))
1632                 goto fail;
1633
1634         if (usb_string(dev, dev->descriptor.iManufacturer, buf, 64) > 0) {
1635                 strcat(hid->name, buf);
1636                 if (usb_string(dev, dev->descriptor.iProduct, buf, 64) > 0)
1637                         snprintf(hid->name, 64, "%s %s", hid->name, buf);
1638         } else if (usb_string(dev, dev->descriptor.iProduct, buf, 128) > 0) {
1639                         snprintf(hid->name, 128, "%s", buf);
1640         } else
1641                 snprintf(hid->name, 128, "%04x:%04x", dev->descriptor.idVendor, dev->descriptor.idProduct);
1642
1643         usb_make_path(dev, buf, 64);
1644         snprintf(hid->phys, 64, "%s/input%d", buf,
1645                         intf->altsetting[0].desc.bInterfaceNumber);
1646
1647         if (usb_string(dev, dev->descriptor.iSerialNumber, hid->uniq, 64) <= 0)
1648                 hid->uniq[0] = 0;
1649
1650         kfree(buf);
1651
1652         hid->urbctrl = usb_alloc_urb(0, GFP_KERNEL);
1653         if (!hid->urbctrl)
1654                 goto fail;
1655         usb_fill_control_urb(hid->urbctrl, dev, 0, (void *) hid->cr,
1656                              hid->ctrlbuf, 1, hid_ctrl, hid);
1657         hid->urbctrl->setup_dma = hid->cr_dma;
1658         hid->urbctrl->transfer_dma = hid->ctrlbuf_dma;
1659         hid->urbctrl->transfer_flags |= (URB_NO_TRANSFER_DMA_MAP
1660                                 | URB_NO_SETUP_DMA_MAP);
1661
1662         return hid;
1663
1664 fail:
1665
1666         if (hid->urbin)
1667                 usb_free_urb(hid->urbin);
1668         if (hid->urbout)
1669                 usb_free_urb(hid->urbout);
1670         if (hid->urbctrl)
1671                 usb_free_urb(hid->urbctrl);
1672         hid_free_buffers(dev, hid);
1673         hid_free_device(hid);
1674
1675         return NULL;
1676 }
1677
1678 static void hid_disconnect(struct usb_interface *intf)
1679 {
1680         struct hid_device *hid = usb_get_intfdata (intf);
1681
1682         if (!hid)
1683                 return;
1684
1685         usb_set_intfdata(intf, NULL);
1686         usb_unlink_urb(hid->urbin);
1687         usb_unlink_urb(hid->urbout);
1688         usb_unlink_urb(hid->urbctrl);
1689
1690         if (hid->claimed & HID_CLAIMED_INPUT)
1691                 hidinput_disconnect(hid);
1692         if (hid->claimed & HID_CLAIMED_HIDDEV)
1693                 hiddev_disconnect(hid);
1694
1695         usb_free_urb(hid->urbin);
1696         usb_free_urb(hid->urbctrl);
1697         if (hid->urbout)
1698                 usb_free_urb(hid->urbout);
1699
1700         hid_free_buffers(hid->dev, hid);
1701         hid_free_device(hid);
1702 }
1703
1704 static int hid_probe (struct usb_interface *intf, const struct usb_device_id *id)
1705 {
1706         struct hid_device *hid;
1707         char path[64];
1708         int i;
1709         char *c;
1710
1711         dbg("HID probe called for ifnum %d",
1712                         intf->altsetting->desc.bInterfaceNumber);
1713
1714         if (!(hid = usb_hid_configure(intf)))
1715                 return -EIO;
1716
1717         hid_init_reports(hid);
1718         hid_dump_device(hid);
1719
1720         if (!hidinput_connect(hid))
1721                 hid->claimed |= HID_CLAIMED_INPUT;
1722         if (!hiddev_connect(hid))
1723                 hid->claimed |= HID_CLAIMED_HIDDEV;
1724
1725         usb_set_intfdata(intf, hid);
1726
1727         if (!hid->claimed) {
1728                 printk ("HID device not claimed by input or hiddev\n");
1729                 hid_disconnect(intf);
1730                 return -EIO;
1731         }
1732
1733         printk(KERN_INFO);
1734
1735         if (hid->claimed & HID_CLAIMED_INPUT)
1736                 printk("input");
1737         if (hid->claimed == (HID_CLAIMED_INPUT | HID_CLAIMED_HIDDEV))
1738                 printk(",");
1739         if (hid->claimed & HID_CLAIMED_HIDDEV)
1740                 printk("hiddev%d", hid->minor);
1741
1742         c = "Device";
1743         for (i = 0; i < hid->maxcollection; i++) {
1744                 if (hid->collection[i].type == HID_COLLECTION_APPLICATION &&
1745                     (hid->collection[i].usage & HID_USAGE_PAGE) == HID_UP_GENDESK &&
1746                     (hid->collection[i].usage & 0xffff) < ARRAY_SIZE(hid_types)) {
1747                         c = hid_types[hid->collection[i].usage & 0xffff];
1748                         break;
1749                 }
1750         }
1751
1752         usb_make_path(interface_to_usbdev(intf), path, 63);
1753
1754         printk(": USB HID v%x.%02x %s [%s] on %s\n",
1755                 hid->version >> 8, hid->version & 0xff, c, hid->name, path);
1756
1757         return 0;
1758 }
1759
1760 static struct usb_device_id hid_usb_ids [] = {
1761         { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
1762             .bInterfaceClass = USB_INTERFACE_CLASS_HID },
1763         { }                                             /* Terminating entry */
1764 };
1765
1766 MODULE_DEVICE_TABLE (usb, hid_usb_ids);
1767
1768 static struct usb_driver hid_driver = {
1769         .owner =        THIS_MODULE,
1770         .name =         "hid",
1771         .probe =        hid_probe,
1772         .disconnect =   hid_disconnect,
1773         .id_table =     hid_usb_ids,
1774 };
1775
1776 static int __init hid_init(void)
1777 {
1778         int retval;
1779         retval = hiddev_init();
1780         if (retval)
1781                 goto hiddev_init_fail;
1782         retval = usb_register(&hid_driver);
1783         if (retval)
1784                 goto usb_register_fail;
1785         info(DRIVER_VERSION ":" DRIVER_DESC);
1786
1787         return 0;
1788 usb_register_fail:
1789         hiddev_exit();
1790 hiddev_init_fail:
1791         return retval;
1792 }
1793
1794 static void __exit hid_exit(void)
1795 {
1796         hiddev_exit();
1797         usb_deregister(&hid_driver);
1798 }
1799
1800 module_init(hid_init);
1801 module_exit(hid_exit);
1802
1803 MODULE_AUTHOR(DRIVER_AUTHOR);
1804 MODULE_DESCRIPTION(DRIVER_DESC);
1805 MODULE_LICENSE(DRIVER_LICENSE);