1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/*
3	* USB HID support for Linux
4	*
5	* Copyright (c) 1999 Andreas Gal
6	* Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
7	* Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
8	* Copyright (c) 2007-2008 Oliver Neukum
9	* Copyright (c) 2006-2010 Jiri Kosina
10	*/
11
12	/*
13	*/
14
15	#include <linux/module.h>
16	#include <linux/slab.h>
17	#include <linux/init.h>
18	#include <linux/kernel.h>
19	#include <linux/list.h>
20	#include <linux/mm.h>
21	#include <linux/mutex.h>
22	#include <linux/spinlock.h>
23	#include <asm/unaligned.h>
24	#include <asm/byteorder.h>
25	#include <linux/input.h>
26	#include <linux/wait.h>
27	#include <linux/workqueue.h>
28	#include <linux/string.h>
29
30	#include <linux/usb.h>
31
32	#include <linux/hid.h>
33	#include <linux/hiddev.h>
34	#include <linux/hid-debug.h>
35	#include <linux/hidraw.h>
36	#include "usbhid.h"
37
38	/*
39	* Version Information
40	*/
41
42	#define DRIVER_DESC "USB HID core driver"
43
44	/*
45	* Module parameters.
46	*/
47
48	static unsigned int hid_mousepoll_interval;
49	module_param_named(mousepoll, hid_mousepoll_interval, uint, 0644);
50	MODULE_PARM_DESC(mousepoll, "Polling interval of mice");
51
52	static unsigned int hid_jspoll_interval;
53	module_param_named(jspoll, hid_jspoll_interval, uint, 0644);
54	MODULE_PARM_DESC(jspoll, "Polling interval of joysticks");
55
56	static unsigned int hid_kbpoll_interval;
57	module_param_named(kbpoll, hid_kbpoll_interval, uint, 0644);
58	MODULE_PARM_DESC(kbpoll, "Polling interval of keyboards");
59
60	static unsigned int ignoreled;
61	module_param_named(ignoreled, ignoreled, uint, 0644);
62	MODULE_PARM_DESC(ignoreled, "Autosuspend with active leds");
63
64	/* Quirks specified at module load time */
65	static char *quirks_param[MAX_USBHID_BOOT_QUIRKS];
66	module_param_array_named(quirks, quirks_param, charp, NULL, 0444);
67	MODULE_PARM_DESC(quirks, "Add/modify USB HID quirks by specifying "
68	" quirks=vendorID:productID:quirks"
69	" where vendorID, productID, and quirks are all in"
70	" 0x-prefixed hex");
71	/*
72	* Input submission and I/O error handler.
73	*/
74	static void hid_io_error(struct hid_device *hid);
75	static int hid_submit_out(struct hid_device *hid);
76	static int hid_submit_ctrl(struct hid_device *hid);
77	static void hid_cancel_delayed_stuff(struct usbhid_device *usbhid);
78
79	/* Start up the input URB */
80	static int hid_start_in(struct hid_device *hid)
81	{
82	unsigned long flags;
83	int rc = 0;
84	struct usbhid_device *usbhid = hid->driver_data;
85
86	spin_lock_irqsave(&usbhid->lock, flags);
87	if (test_bit(HID_IN_POLLING, &usbhid->iofl) &&
88	!test_bit(HID_DISCONNECTED, &usbhid->iofl) &&
89	!test_bit(HID_SUSPENDED, &usbhid->iofl) &&
90	!test_and_set_bit(HID_IN_RUNNING, addr: &usbhid->iofl)) {
91	rc = usb_submit_urb(urb: usbhid->urbin, GFP_ATOMIC);
92	if (rc != 0) {
93	clear_bit(HID_IN_RUNNING, addr: &usbhid->iofl);
94	if (rc == -ENOSPC)
95	set_bit(HID_NO_BANDWIDTH, addr: &usbhid->iofl);
96	} else {
97	clear_bit(HID_NO_BANDWIDTH, addr: &usbhid->iofl);
98	}
99	}
100	spin_unlock_irqrestore(lock: &usbhid->lock, flags);
101	return rc;
102	}
103
104	/* I/O retry timer routine */
105	static void hid_retry_timeout(struct timer_list *t)
106	{
107	struct usbhid_device *usbhid = from_timer(usbhid, t, io_retry);
108	struct hid_device *hid = usbhid->hid;
109
110	dev_dbg(&usbhid->intf->dev, "retrying intr urb\n");
111	if (hid_start_in(hid))
112	hid_io_error(hid);
113	}
114
115	/* Workqueue routine to reset the device or clear a halt */
116	static void hid_reset(struct work_struct *work)
117	{
118	struct usbhid_device *usbhid =
119	container_of(work, struct usbhid_device, reset_work);
120	struct hid_device *hid = usbhid->hid;
121	int rc;
122
123	if (test_bit(HID_CLEAR_HALT, &usbhid->iofl)) {
124	dev_dbg(&usbhid->intf->dev, "clear halt\n");
125	rc = usb_clear_halt(hid_to_usb_dev(hid), pipe: usbhid->urbin->pipe);
126	clear_bit(HID_CLEAR_HALT, addr: &usbhid->iofl);
127	if (rc == 0) {
128	hid_start_in(hid);
129	} else {
130	dev_dbg(&usbhid->intf->dev,
131	"clear-halt failed: %d\n", rc);
132	set_bit(HID_RESET_PENDING, addr: &usbhid->iofl);
133	}
134	}
135
136	if (test_bit(HID_RESET_PENDING, &usbhid->iofl)) {
137	dev_dbg(&usbhid->intf->dev, "resetting device\n");
138	usb_queue_reset_device(dev: usbhid->intf);
139	}
140	}
141
142	/* Main I/O error handler */
143	static void hid_io_error(struct hid_device *hid)
144	{
145	unsigned long flags;
146	struct usbhid_device *usbhid = hid->driver_data;
147
148	spin_lock_irqsave(&usbhid->lock, flags);
149
150	/* Stop when disconnected */
151	if (test_bit(HID_DISCONNECTED, &usbhid->iofl))
152	goto done;
153
154	/* If it has been a while since the last error, we'll assume
155	* this a brand new error and reset the retry timeout. */
156	if (time_after(jiffies, usbhid->stop_retry + HZ/2))
157	usbhid->retry_delay = 0;
158
159	/* When an error occurs, retry at increasing intervals */
160	if (usbhid->retry_delay == 0) {
161	usbhid->retry_delay = 13; /* Then 26, 52, 104, 104, ... */
162	usbhid->stop_retry = jiffies + msecs_to_jiffies(m: 1000);
163	} else if (usbhid->retry_delay < 100)
164	usbhid->retry_delay *= 2;
165
166	if (time_after(jiffies, usbhid->stop_retry)) {
167
168	/* Retries failed, so do a port reset unless we lack bandwidth*/
169	if (!test_bit(HID_NO_BANDWIDTH, &usbhid->iofl)
170	&& !test_and_set_bit(HID_RESET_PENDING, addr: &usbhid->iofl)) {
171
172	schedule_work(work: &usbhid->reset_work);
173	goto done;
174	}
175	}
176
177	mod_timer(timer: &usbhid->io_retry,
178	expires: jiffies + msecs_to_jiffies(m: usbhid->retry_delay));
179	done:
180	spin_unlock_irqrestore(lock: &usbhid->lock, flags);
181	}
182
183	static void usbhid_mark_busy(struct usbhid_device *usbhid)
184	{
185	struct usb_interface *intf = usbhid->intf;
186
187	usb_mark_last_busy(interface_to_usbdev(intf));
188	}
189
190	static int usbhid_restart_out_queue(struct usbhid_device *usbhid)
191	{
192	struct hid_device *hid = usb_get_intfdata(intf: usbhid->intf);
193	int kicked;
194	int r;
195
196	if (!hid || test_bit(HID_RESET_PENDING, &usbhid->iofl) ||
197	test_bit(HID_SUSPENDED, &usbhid->iofl))
198	return 0;
199
200	if ((kicked = (usbhid->outhead != usbhid->outtail))) {
201	hid_dbg(hid, "Kicking head %d tail %d", usbhid->outhead, usbhid->outtail);
202
203	/* Try to wake up from autosuspend... */
204	r = usb_autopm_get_interface_async(intf: usbhid->intf);
205	if (r < 0)
206	return r;
207
208	/*
209	* If still suspended, don't submit. Submission will
210	* occur if/when resume drains the queue.
211	*/
212	if (test_bit(HID_SUSPENDED, &usbhid->iofl)) {
213	usb_autopm_put_interface_no_suspend(intf: usbhid->intf);
214	return r;
215	}
216
217	/* Asynchronously flush queue. */
218	set_bit(HID_OUT_RUNNING, addr: &usbhid->iofl);
219	if (hid_submit_out(hid)) {
220	clear_bit(HID_OUT_RUNNING, addr: &usbhid->iofl);
221	usb_autopm_put_interface_async(intf: usbhid->intf);
222	}
223	wake_up(&usbhid->wait);
224	}
225	return kicked;
226	}
227
228	static int usbhid_restart_ctrl_queue(struct usbhid_device *usbhid)
229	{
230	struct hid_device *hid = usb_get_intfdata(intf: usbhid->intf);
231	int kicked;
232	int r;
233
234	WARN_ON(hid == NULL);
235	if (!hid || test_bit(HID_RESET_PENDING, &usbhid->iofl) ||
236	test_bit(HID_SUSPENDED, &usbhid->iofl))
237	return 0;
238
239	if ((kicked = (usbhid->ctrlhead != usbhid->ctrltail))) {
240	hid_dbg(hid, "Kicking head %d tail %d", usbhid->ctrlhead, usbhid->ctrltail);
241
242	/* Try to wake up from autosuspend... */
243	r = usb_autopm_get_interface_async(intf: usbhid->intf);
244	if (r < 0)
245	return r;
246
247	/*
248	* If still suspended, don't submit. Submission will
249	* occur if/when resume drains the queue.
250	*/
251	if (test_bit(HID_SUSPENDED, &usbhid->iofl)) {
252	usb_autopm_put_interface_no_suspend(intf: usbhid->intf);
253	return r;
254	}
255
256	/* Asynchronously flush queue. */
257	set_bit(HID_CTRL_RUNNING, addr: &usbhid->iofl);
258	if (hid_submit_ctrl(hid)) {
259	clear_bit(HID_CTRL_RUNNING, addr: &usbhid->iofl);
260	usb_autopm_put_interface_async(intf: usbhid->intf);
261	}
262	wake_up(&usbhid->wait);
263	}
264	return kicked;
265	}
266
267	/*
268	* Input interrupt completion handler.
269	*/
270
271	static void hid_irq_in(struct urb *urb)
272	{
273	struct hid_device *hid = urb->context;
274	struct usbhid_device *usbhid = hid->driver_data;
275	int status;
276
277	switch (urb->status) {
278	case 0: /* success */
279	usbhid->retry_delay = 0;
280	if (!test_bit(HID_OPENED, &usbhid->iofl))
281	break;
282	usbhid_mark_busy(usbhid);
283	if (!test_bit(HID_RESUME_RUNNING, &usbhid->iofl)) {
284	hid_input_report(hid: urb->context, type: HID_INPUT_REPORT,
285	data: urb->transfer_buffer,
286	size: urb->actual_length, interrupt: 1);
287	/*
288	* autosuspend refused while keys are pressed
289	* because most keyboards don't wake up when
290	* a key is released
291	*/
292	if (hid_check_keys_pressed(hid))
293	set_bit(HID_KEYS_PRESSED, addr: &usbhid->iofl);
294	else
295	clear_bit(HID_KEYS_PRESSED, addr: &usbhid->iofl);
296	}
297	break;
298	case -EPIPE: /* stall */
299	usbhid_mark_busy(usbhid);
300	clear_bit(HID_IN_RUNNING, addr: &usbhid->iofl);
301	set_bit(HID_CLEAR_HALT, addr: &usbhid->iofl);
302	schedule_work(work: &usbhid->reset_work);
303	return;
304	case -ECONNRESET: /* unlink */
305	case -ENOENT:
306	case -ESHUTDOWN: /* unplug */
307	clear_bit(HID_IN_RUNNING, addr: &usbhid->iofl);
308	return;
309	case -EILSEQ: /* protocol error or unplug */
310	case -EPROTO: /* protocol error or unplug */
311	case -ETIME: /* protocol error or unplug */
312	case -ETIMEDOUT: /* Should never happen, but... */
313	usbhid_mark_busy(usbhid);
314	clear_bit(HID_IN_RUNNING, addr: &usbhid->iofl);
315	hid_io_error(hid);
316	return;
317	default: /* error */
318	hid_warn(urb->dev, "input irq status %d received\n",
319	urb->status);
320	}
321
322	status = usb_submit_urb(urb, GFP_ATOMIC);
323	if (status) {
324	clear_bit(HID_IN_RUNNING, addr: &usbhid->iofl);
325	if (status != -EPERM) {
326	hid_err(hid, "can't resubmit intr, %s-%s/input%d, status %d\n",
327	hid_to_usb_dev(hid)->bus->bus_name,
328	hid_to_usb_dev(hid)->devpath,
329	usbhid->ifnum, status);
330	hid_io_error(hid);
331	}
332	}
333	}
334
335	static int hid_submit_out(struct hid_device *hid)
336	{
337	struct hid_report *report;
338	char *raw_report;
339	struct usbhid_device *usbhid = hid->driver_data;
340	int r;
341
342	report = usbhid->out[usbhid->outtail].report;
343	raw_report = usbhid->out[usbhid->outtail].raw_report;
344
345	usbhid->urbout->transfer_buffer_length = hid_report_len(report);
346	usbhid->urbout->dev = hid_to_usb_dev(hid);
347	if (raw_report) {
348	memcpy(usbhid->outbuf, raw_report,
349	usbhid->urbout->transfer_buffer_length);
350	kfree(objp: raw_report);
351	usbhid->out[usbhid->outtail].raw_report = NULL;
352	}
353
354	dbg_hid("submitting out urb\n");
355
356	r = usb_submit_urb(urb: usbhid->urbout, GFP_ATOMIC);
357	if (r < 0) {
358	hid_err(hid, "usb_submit_urb(out) failed: %d\n", r);
359	return r;
360	}
361	usbhid->last_out = jiffies;
362	return 0;
363	}
364
365	static int hid_submit_ctrl(struct hid_device *hid)
366	{
367	struct hid_report *report;
368	unsigned char dir;
369	char *raw_report;
370	int len, r;
371	struct usbhid_device *usbhid = hid->driver_data;
372
373	report = usbhid->ctrl[usbhid->ctrltail].report;
374	raw_report = usbhid->ctrl[usbhid->ctrltail].raw_report;
375	dir = usbhid->ctrl[usbhid->ctrltail].dir;
376
377	len = hid_report_len(report);
378	if (dir == USB_DIR_OUT) {
379	usbhid->urbctrl->pipe = usb_sndctrlpipe(hid_to_usb_dev(hid), 0);
380	if (raw_report) {
381	memcpy(usbhid->ctrlbuf, raw_report, len);
382	kfree(objp: raw_report);
383	usbhid->ctrl[usbhid->ctrltail].raw_report = NULL;
384	}
385	} else {
386	int maxpacket;
387
388	usbhid->urbctrl->pipe = usb_rcvctrlpipe(hid_to_usb_dev(hid), 0);
389	maxpacket = usb_maxpacket(hid_to_usb_dev(hid),
390	pipe: usbhid->urbctrl->pipe);
391	len += (len == 0); /* Don't allow 0-length reports */
392	len = round_up(len, maxpacket);
393	if (len > usbhid->bufsize)
394	len = usbhid->bufsize;
395	}
396	usbhid->urbctrl->transfer_buffer_length = len;
397	usbhid->urbctrl->dev = hid_to_usb_dev(hid);
398
399	usbhid->cr->bRequestType = USB_TYPE_CLASS | USB_RECIP_INTERFACE | dir;
400	usbhid->cr->bRequest = (dir == USB_DIR_OUT) ? HID_REQ_SET_REPORT :
401	HID_REQ_GET_REPORT;
402	usbhid->cr->wValue = cpu_to_le16(((report->type + 1) << 8) |
403	report->id);
404	usbhid->cr->wIndex = cpu_to_le16(usbhid->ifnum);
405	usbhid->cr->wLength = cpu_to_le16(len);
406
407	dbg_hid("submitting ctrl urb: %s wValue=0x%04x wIndex=0x%04x wLength=%u\n",
408	usbhid->cr->bRequest == HID_REQ_SET_REPORT ? "Set_Report" :
409	"Get_Report",
410	usbhid->cr->wValue, usbhid->cr->wIndex, usbhid->cr->wLength);
411
412	r = usb_submit_urb(urb: usbhid->urbctrl, GFP_ATOMIC);
413	if (r < 0) {
414	hid_err(hid, "usb_submit_urb(ctrl) failed: %d\n", r);
415	return r;
416	}
417	usbhid->last_ctrl = jiffies;
418	return 0;
419	}
420
421	/*
422	* Output interrupt completion handler.
423	*/
424
425	static void hid_irq_out(struct urb *urb)
426	{
427	struct hid_device *hid = urb->context;
428	struct usbhid_device *usbhid = hid->driver_data;
429	unsigned long flags;
430	int unplug = 0;
431
432	switch (urb->status) {
433	case 0: /* success */
434	break;
435	case -ESHUTDOWN: /* unplug */
436	unplug = 1;
437	break;
438	case -EILSEQ: /* protocol error or unplug */
439	case -EPROTO: /* protocol error or unplug */
440	case -ECONNRESET: /* unlink */
441	case -ENOENT:
442	break;
443	default: /* error */
444	hid_warn(urb->dev, "output irq status %d received\n",
445	urb->status);
446	}
447
448	spin_lock_irqsave(&usbhid->lock, flags);
449
450	if (unplug) {
451	usbhid->outtail = usbhid->outhead;
452	} else {
453	usbhid->outtail = (usbhid->outtail + 1) & (HID_OUTPUT_FIFO_SIZE - 1);
454
455	if (usbhid->outhead != usbhid->outtail &&
456	hid_submit_out(hid) == 0) {
457	/* Successfully submitted next urb in queue */
458	spin_unlock_irqrestore(lock: &usbhid->lock, flags);
459	return;
460	}
461	}
462
463	clear_bit(HID_OUT_RUNNING, addr: &usbhid->iofl);
464	spin_unlock_irqrestore(lock: &usbhid->lock, flags);
465	usb_autopm_put_interface_async(intf: usbhid->intf);
466	wake_up(&usbhid->wait);
467	}
468
469	/*
470	* Control pipe completion handler.
471	*/
472
473	static void hid_ctrl(struct urb *urb)
474	{
475	struct hid_device *hid = urb->context;
476	struct usbhid_device *usbhid = hid->driver_data;
477	unsigned long flags;
478	int unplug = 0, status = urb->status;
479
480	switch (status) {
481	case 0: /* success */
482	if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_IN)
483	hid_input_report(hid: urb->context,
484	type: usbhid->ctrl[usbhid->ctrltail].report->type,
485	data: urb->transfer_buffer, size: urb->actual_length, interrupt: 0);
486	break;
487	case -ESHUTDOWN: /* unplug */
488	unplug = 1;
489	break;
490	case -EILSEQ: /* protocol error or unplug */
491	case -EPROTO: /* protocol error or unplug */
492	case -ECONNRESET: /* unlink */
493	case -ENOENT:
494	case -EPIPE: /* report not available */
495	break;
496	default: /* error */
497	hid_warn(urb->dev, "ctrl urb status %d received\n", status);
498	}
499
500	spin_lock_irqsave(&usbhid->lock, flags);
501
502	if (unplug) {
503	usbhid->ctrltail = usbhid->ctrlhead;
504	} else if (usbhid->ctrlhead != usbhid->ctrltail) {
505	usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1);
506
507	if (usbhid->ctrlhead != usbhid->ctrltail &&
508	hid_submit_ctrl(hid) == 0) {
509	/* Successfully submitted next urb in queue */
510	spin_unlock_irqrestore(lock: &usbhid->lock, flags);
511	return;
512	}
513	}
514
515	clear_bit(HID_CTRL_RUNNING, addr: &usbhid->iofl);
516	spin_unlock_irqrestore(lock: &usbhid->lock, flags);
517	usb_autopm_put_interface_async(intf: usbhid->intf);
518	wake_up(&usbhid->wait);
519	}
520
521	static void __usbhid_submit_report(struct hid_device *hid, struct hid_report *report,
522	unsigned char dir)
523	{
524	int head;
525	struct usbhid_device *usbhid = hid->driver_data;
526
527	if (((hid->quirks & HID_QUIRK_NOGET) && dir == USB_DIR_IN) ||
528	test_bit(HID_DISCONNECTED, &usbhid->iofl))
529	return;
530
531	if (usbhid->urbout && dir == USB_DIR_OUT && report->type == HID_OUTPUT_REPORT) {
532	if ((head = (usbhid->outhead + 1) & (HID_OUTPUT_FIFO_SIZE - 1)) == usbhid->outtail) {
533	hid_warn(hid, "output queue full\n");
534	return;
535	}
536
537	usbhid->out[usbhid->outhead].raw_report = hid_alloc_report_buf(report, GFP_ATOMIC);
538	if (!usbhid->out[usbhid->outhead].raw_report) {
539	hid_warn(hid, "output queueing failed\n");
540	return;
541	}
542	hid_output_report(report, data: usbhid->out[usbhid->outhead].raw_report);
543	usbhid->out[usbhid->outhead].report = report;
544	usbhid->outhead = head;
545
546	/* If the queue isn't running, restart it */
547	if (!test_bit(HID_OUT_RUNNING, &usbhid->iofl)) {
548	usbhid_restart_out_queue(usbhid);
549
550	/* Otherwise see if an earlier request has timed out */
551	} else if (time_after(jiffies, usbhid->last_out + HZ * 5)) {
552
553	/* Prevent autosuspend following the unlink */
554	usb_autopm_get_interface_no_resume(intf: usbhid->intf);
555
556	/*
557	* Prevent resubmission in case the URB completes
558	* before we can unlink it. We don't want to cancel
559	* the wrong transfer!
560	*/
561	usb_block_urb(urb: usbhid->urbout);
562
563	/* Drop lock to avoid deadlock if the callback runs */
564	spin_unlock(lock: &usbhid->lock);
565
566	usb_unlink_urb(urb: usbhid->urbout);
567	spin_lock(lock: &usbhid->lock);
568	usb_unblock_urb(urb: usbhid->urbout);
569
570	/* Unlink might have stopped the queue */
571	if (!test_bit(HID_OUT_RUNNING, &usbhid->iofl))
572	usbhid_restart_out_queue(usbhid);
573
574	/* Now we can allow autosuspend again */
575	usb_autopm_put_interface_async(intf: usbhid->intf);
576	}
577	return;
578	}
579
580	if ((head = (usbhid->ctrlhead + 1) & (HID_CONTROL_FIFO_SIZE - 1)) == usbhid->ctrltail) {
581	hid_warn(hid, "control queue full\n");
582	return;
583	}
584
585	if (dir == USB_DIR_OUT) {
586	usbhid->ctrl[usbhid->ctrlhead].raw_report = hid_alloc_report_buf(report, GFP_ATOMIC);
587	if (!usbhid->ctrl[usbhid->ctrlhead].raw_report) {
588	hid_warn(hid, "control queueing failed\n");
589	return;
590	}
591	hid_output_report(report, data: usbhid->ctrl[usbhid->ctrlhead].raw_report);
592	}
593	usbhid->ctrl[usbhid->ctrlhead].report = report;
594	usbhid->ctrl[usbhid->ctrlhead].dir = dir;
595	usbhid->ctrlhead = head;
596
597	/* If the queue isn't running, restart it */
598	if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) {
599	usbhid_restart_ctrl_queue(usbhid);
600
601	/* Otherwise see if an earlier request has timed out */
602	} else if (time_after(jiffies, usbhid->last_ctrl + HZ * 5)) {
603
604	/* Prevent autosuspend following the unlink */
605	usb_autopm_get_interface_no_resume(intf: usbhid->intf);
606
607	/*
608	* Prevent resubmission in case the URB completes
609	* before we can unlink it. We don't want to cancel
610	* the wrong transfer!
611	*/
612	usb_block_urb(urb: usbhid->urbctrl);
613
614	/* Drop lock to avoid deadlock if the callback runs */
615	spin_unlock(lock: &usbhid->lock);
616
617	usb_unlink_urb(urb: usbhid->urbctrl);
618	spin_lock(lock: &usbhid->lock);
619	usb_unblock_urb(urb: usbhid->urbctrl);
620
621	/* Unlink might have stopped the queue */
622	if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
623	usbhid_restart_ctrl_queue(usbhid);
624
625	/* Now we can allow autosuspend again */
626	usb_autopm_put_interface_async(intf: usbhid->intf);
627	}
628	}
629
630	static void usbhid_submit_report(struct hid_device *hid, struct hid_report *report, unsigned char dir)
631	{
632	struct usbhid_device *usbhid = hid->driver_data;
633	unsigned long flags;
634
635	spin_lock_irqsave(&usbhid->lock, flags);
636	__usbhid_submit_report(hid, report, dir);
637	spin_unlock_irqrestore(lock: &usbhid->lock, flags);
638	}
639
640	static int usbhid_wait_io(struct hid_device *hid)
641	{
642	struct usbhid_device *usbhid = hid->driver_data;
643
644	if (!wait_event_timeout(usbhid->wait,
645	(!test_bit(HID_CTRL_RUNNING, &usbhid->iofl) &&
646	!test_bit(HID_OUT_RUNNING, &usbhid->iofl)),
647	10*HZ)) {
648	dbg_hid("timeout waiting for ctrl or out queue to clear\n");
649	return -1;
650	}
651
652	return 0;
653	}
654
655	static int hid_set_idle(struct usb_device *dev, int ifnum, int report, int idle)
656	{
657	return usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
658	request: HID_REQ_SET_IDLE, USB_TYPE_CLASS | USB_RECIP_INTERFACE, value: (idle << 8) | report,
659	index: ifnum, NULL, size: 0, USB_CTRL_SET_TIMEOUT);
660	}
661
662	static int hid_get_class_descriptor(struct usb_device *dev, int ifnum,
663	unsigned char type, void *buf, int size)
664	{
665	int result, retries = 4;
666
667	memset(buf, 0, size);
668
669	do {
670	result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
671	USB_REQ_GET_DESCRIPTOR, USB_RECIP_INTERFACE | USB_DIR_IN,
672	value: (type << 8), index: ifnum, data: buf, size, USB_CTRL_GET_TIMEOUT);
673	retries--;
674	} while (result < size && retries);
675	return result;
676	}
677
678	static int usbhid_open(struct hid_device *hid)
679	{
680	struct usbhid_device *usbhid = hid->driver_data;
681	int res;
682
683	mutex_lock(&usbhid->mutex);
684
685	set_bit(HID_OPENED, addr: &usbhid->iofl);
686
687	if (hid->quirks & HID_QUIRK_ALWAYS_POLL) {
688	res = 0;
689	goto Done;
690	}
691
692	res = usb_autopm_get_interface(intf: usbhid->intf);
693	/* the device must be awake to reliably request remote wakeup */
694	if (res < 0) {
695	clear_bit(HID_OPENED, addr: &usbhid->iofl);
696	res = -EIO;
697	goto Done;
698	}
699
700	usbhid->intf->needs_remote_wakeup = 1;
701
702	set_bit(HID_RESUME_RUNNING, addr: &usbhid->iofl);
703	set_bit(HID_IN_POLLING, addr: &usbhid->iofl);
704
705	res = hid_start_in(hid);
706	if (res) {
707	if (res != -ENOSPC) {
708	hid_io_error(hid);
709	res = 0;
710	} else {
711	/* no use opening if resources are insufficient */
712	res = -EBUSY;
713	clear_bit(HID_OPENED, addr: &usbhid->iofl);
714	clear_bit(HID_IN_POLLING, addr: &usbhid->iofl);
715	usbhid->intf->needs_remote_wakeup = 0;
716	}
717	}
718
719	usb_autopm_put_interface(intf: usbhid->intf);
720
721	/*
722	* In case events are generated while nobody was listening,
723	* some are released when the device is re-opened.
724	* Wait 50 msec for the queue to empty before allowing events
725	* to go through hid.
726	*/
727	if (res == 0)
728	msleep(msecs: 50);
729
730	clear_bit(HID_RESUME_RUNNING, addr: &usbhid->iofl);
731
732	Done:
733	mutex_unlock(lock: &usbhid->mutex);
734	return res;
735	}
736
737	static void usbhid_close(struct hid_device *hid)
738	{
739	struct usbhid_device *usbhid = hid->driver_data;
740
741	mutex_lock(&usbhid->mutex);
742
743	/*
744	* Make sure we don't restart data acquisition due to
745	* a resumption we no longer care about by avoiding racing
746	* with hid_start_in().
747	*/
748	spin_lock_irq(lock: &usbhid->lock);
749	clear_bit(HID_OPENED, addr: &usbhid->iofl);
750	if (!(hid->quirks & HID_QUIRK_ALWAYS_POLL))
751	clear_bit(HID_IN_POLLING, addr: &usbhid->iofl);
752	spin_unlock_irq(lock: &usbhid->lock);
753
754	if (!(hid->quirks & HID_QUIRK_ALWAYS_POLL)) {
755	hid_cancel_delayed_stuff(usbhid);
756	usb_kill_urb(urb: usbhid->urbin);
757	usbhid->intf->needs_remote_wakeup = 0;
758	}
759
760	mutex_unlock(lock: &usbhid->mutex);
761	}
762
763	/*
764	* Initialize all reports
765	*/
766
767	void usbhid_init_reports(struct hid_device *hid)
768	{
769	struct hid_report *report;
770	struct usbhid_device *usbhid = hid->driver_data;
771	struct hid_report_enum *report_enum;
772	int err, ret;
773
774	report_enum = &hid->report_enum[HID_INPUT_REPORT];
775	list_for_each_entry(report, &report_enum->report_list, list)
776	usbhid_submit_report(hid, report, USB_DIR_IN);
777
778	report_enum = &hid->report_enum[HID_FEATURE_REPORT];
779	list_for_each_entry(report, &report_enum->report_list, list)
780	usbhid_submit_report(hid, report, USB_DIR_IN);
781
782	err = 0;
783	ret = usbhid_wait_io(hid);
784	while (ret) {
785	err |= ret;
786	if (test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
787	usb_kill_urb(urb: usbhid->urbctrl);
788	if (test_bit(HID_OUT_RUNNING, &usbhid->iofl))
789	usb_kill_urb(urb: usbhid->urbout);
790	ret = usbhid_wait_io(hid);
791	}
792
793	if (err)
794	hid_warn(hid, "timeout initializing reports\n");
795	}
796
797	/*
798	* Reset LEDs which BIOS might have left on. For now, just NumLock (0x01).
799	*/
800	static int hid_find_field_early(struct hid_device *hid, unsigned int page,
801	unsigned int hid_code, struct hid_field **pfield)
802	{
803	struct hid_report *report;
804	struct hid_field *field;
805	struct hid_usage *usage;
806	int i, j;
807
808	list_for_each_entry(report, &hid->report_enum[HID_OUTPUT_REPORT].report_list, list) {
809	for (i = 0; i < report->maxfield; i++) {
810	field = report->field[i];
811	for (j = 0; j < field->maxusage; j++) {
812	usage = &field->usage[j];
813	if ((usage->hid & HID_USAGE_PAGE) == page &&
814	(usage->hid & 0xFFFF) == hid_code) {
815	*pfield = field;
816	return j;
817	}
818	}
819	}
820	}
821	return -1;
822	}
823
824	static void usbhid_set_leds(struct hid_device *hid)
825	{
826	struct hid_field *field;
827	int offset;
828
829	if ((offset = hid_find_field_early(hid, HID_UP_LED, hid_code: 0x01, pfield: &field)) != -1) {
830	hid_set_field(field, offset, 0);
831	usbhid_submit_report(hid, report: field->report, USB_DIR_OUT);
832	}
833	}
834
835	/*
836	* Traverse the supplied list of reports and find the longest
837	*/
838	static void hid_find_max_report(struct hid_device *hid, unsigned int type,
839	unsigned int *max)
840	{
841	struct hid_report *report;
842	unsigned int size;
843
844	list_for_each_entry(report, &hid->report_enum[type].report_list, list) {
845	size = ((report->size - 1) >> 3) + 1 + hid->report_enum[type].numbered;
846	if (*max < size)
847	*max = size;
848	}
849	}
850
851	static int hid_alloc_buffers(struct usb_device *dev, struct hid_device *hid)
852	{
853	struct usbhid_device *usbhid = hid->driver_data;
854
855	usbhid->inbuf = usb_alloc_coherent(dev, size: usbhid->bufsize, GFP_KERNEL,
856	dma: &usbhid->inbuf_dma);
857	usbhid->outbuf = usb_alloc_coherent(dev, size: usbhid->bufsize, GFP_KERNEL,
858	dma: &usbhid->outbuf_dma);
859	usbhid->cr = kmalloc(size: sizeof(*usbhid->cr), GFP_KERNEL);
860	usbhid->ctrlbuf = usb_alloc_coherent(dev, size: usbhid->bufsize, GFP_KERNEL,
861	dma: &usbhid->ctrlbuf_dma);
862	if (!usbhid->inbuf || !usbhid->outbuf || !usbhid->cr ||
863	!usbhid->ctrlbuf)
864	return -1;
865
866	return 0;
867	}
868
869	static int usbhid_get_raw_report(struct hid_device *hid,
870	unsigned char report_number, __u8 *buf, size_t count,
871	unsigned char report_type)
872	{
873	struct usbhid_device *usbhid = hid->driver_data;
874	struct usb_device *dev = hid_to_usb_dev(hid);
875	struct usb_interface *intf = usbhid->intf;
876	struct usb_host_interface *interface = intf->cur_altsetting;
877	int skipped_report_id = 0;
878	int ret;
879
880	/* Byte 0 is the report number. Report data starts at byte 1.*/
881	buf[0] = report_number;
882	if (report_number == 0x0) {
883	/* Offset the return buffer by 1, so that the report ID
884	will remain in byte 0. */
885	buf++;
886	count--;
887	skipped_report_id = 1;
888	}
889	ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
890	request: HID_REQ_GET_REPORT,
891	USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
892	value: ((report_type + 1) << 8) | report_number,
893	index: interface->desc.bInterfaceNumber, data: buf, size: count,
894	USB_CTRL_SET_TIMEOUT);
895
896	/* count also the report id */
897	if (ret > 0 && skipped_report_id)
898	ret++;
899
900	return ret;
901	}
902
903	static int usbhid_set_raw_report(struct hid_device *hid, unsigned int reportnum,
904	__u8 *buf, size_t count, unsigned char rtype)
905	{
906	struct usbhid_device *usbhid = hid->driver_data;
907	struct usb_device *dev = hid_to_usb_dev(hid);
908	struct usb_interface *intf = usbhid->intf;
909	struct usb_host_interface *interface = intf->cur_altsetting;
910	int ret, skipped_report_id = 0;
911
912	/* Byte 0 is the report number. Report data starts at byte 1.*/
913	if ((rtype == HID_OUTPUT_REPORT) &&
914	(hid->quirks & HID_QUIRK_SKIP_OUTPUT_REPORT_ID))
915	buf[0] = 0;
916	else
917	buf[0] = reportnum;
918
919	if (buf[0] == 0x0) {
920	/* Don't send the Report ID */
921	buf++;
922	count--;
923	skipped_report_id = 1;
924	}
925
926	ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
927	request: HID_REQ_SET_REPORT,
928	USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
929	value: ((rtype + 1) << 8) | reportnum,
930	index: interface->desc.bInterfaceNumber, data: buf, size: count,
931	USB_CTRL_SET_TIMEOUT);
932	/* count also the report id, if this was a numbered report. */
933	if (ret > 0 && skipped_report_id)
934	ret++;
935
936	return ret;
937	}
938
939	static int usbhid_output_report(struct hid_device *hid, __u8 *buf, size_t count)
940	{
941	struct usbhid_device *usbhid = hid->driver_data;
942	struct usb_device *dev = hid_to_usb_dev(hid);
943	int actual_length, skipped_report_id = 0, ret;
944
945	if (!usbhid->urbout)
946	return -ENOSYS;
947
948	if (buf[0] == 0x0) {
949	/* Don't send the Report ID */
950	buf++;
951	count--;
952	skipped_report_id = 1;
953	}
954
955	ret = usb_interrupt_msg(usb_dev: dev, pipe: usbhid->urbout->pipe,
956	data: buf, len: count, actual_length: &actual_length,
957	USB_CTRL_SET_TIMEOUT);
958	/* return the number of bytes transferred */
959	if (ret == 0) {
960	ret = actual_length;
961	/* count also the report id */
962	if (skipped_report_id)
963	ret++;
964	}
965
966	return ret;
967	}
968
969	static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid)
970	{
971	struct usbhid_device *usbhid = hid->driver_data;
972
973	usb_free_coherent(dev, size: usbhid->bufsize, addr: usbhid->inbuf, dma: usbhid->inbuf_dma);
974	usb_free_coherent(dev, size: usbhid->bufsize, addr: usbhid->outbuf, dma: usbhid->outbuf_dma);
975	kfree(objp: usbhid->cr);
976	usb_free_coherent(dev, size: usbhid->bufsize, addr: usbhid->ctrlbuf, dma: usbhid->ctrlbuf_dma);
977	}
978
979	static int usbhid_parse(struct hid_device *hid)
980	{
981	struct usb_interface *intf = to_usb_interface(hid->dev.parent);
982	struct usb_host_interface *interface = intf->cur_altsetting;
983	struct usb_device *dev = interface_to_usbdev (intf);
984	struct hid_descriptor *hdesc;
985	u32 quirks = 0;
986	unsigned int rsize = 0;
987	char *rdesc;
988	int ret, n;
989	int num_descriptors;
990	size_t offset = offsetof(struct hid_descriptor, desc);
991
992	quirks = hid_lookup_quirk(hdev: hid);
993
994	if (quirks & HID_QUIRK_IGNORE)
995	return -ENODEV;
996
997	/* Many keyboards and mice don't like to be polled for reports,
998	* so we will always set the HID_QUIRK_NOGET flag for them. */
999	if (interface->desc.bInterfaceSubClass == USB_INTERFACE_SUBCLASS_BOOT) {
1000	if (interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_KEYBOARD ||
1001	interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_MOUSE)
1002	quirks |= HID_QUIRK_NOGET;
1003	}
1004
1005	if (usb_get_extra_descriptor(interface, HID_DT_HID, &hdesc) &&
1006	(!interface->desc.bNumEndpoints ||
1007	usb_get_extra_descriptor(&interface->endpoint[0], HID_DT_HID, &hdesc))) {
1008	dbg_hid("class descriptor not present\n");
1009	return -ENODEV;
1010	}
1011
1012	if (hdesc->bLength < sizeof(struct hid_descriptor)) {
1013	dbg_hid("hid descriptor is too short\n");
1014	return -EINVAL;
1015	}
1016
1017	hid->version = le16_to_cpu(hdesc->bcdHID);
1018	hid->country = hdesc->bCountryCode;
1019
1020	num_descriptors = min_t(int, hdesc->bNumDescriptors,
1021	(hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));
1022
1023	for (n = 0; n < num_descriptors; n++)
1024	if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
1025	rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
1026
1027	if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) {
1028	dbg_hid("weird size of report descriptor (%u)\n", rsize);
1029	return -EINVAL;
1030	}
1031
1032	rdesc = kmalloc(size: rsize, GFP_KERNEL);
1033	if (!rdesc)
1034	return -ENOMEM;
1035
1036	hid_set_idle(dev, ifnum: interface->desc.bInterfaceNumber, report: 0, idle: 0);
1037
1038	ret = hid_get_class_descriptor(dev, ifnum: interface->desc.bInterfaceNumber,
1039	HID_DT_REPORT, buf: rdesc, size: rsize);
1040	if (ret < 0) {
1041	dbg_hid("reading report descriptor failed\n");
1042	kfree(objp: rdesc);
1043	goto err;
1044	}
1045
1046	ret = hid_parse_report(hid, start: rdesc, size: rsize);
1047	kfree(objp: rdesc);
1048	if (ret) {
1049	dbg_hid("parsing report descriptor failed\n");
1050	goto err;
1051	}
1052
1053	hid->quirks |= quirks;
1054
1055	return 0;
1056	err:
1057	return ret;
1058	}
1059
1060	static int usbhid_start(struct hid_device *hid)
1061	{
1062	struct usb_interface *intf = to_usb_interface(hid->dev.parent);
1063	struct usb_host_interface *interface = intf->cur_altsetting;
1064	struct usb_device *dev = interface_to_usbdev(intf);
1065	struct usbhid_device *usbhid = hid->driver_data;
1066	unsigned int n, insize = 0;
1067	int ret;
1068
1069	mutex_lock(&usbhid->mutex);
1070
1071	clear_bit(HID_DISCONNECTED, addr: &usbhid->iofl);
1072
1073	usbhid->bufsize = HID_MIN_BUFFER_SIZE;
1074	hid_find_max_report(hid, type: HID_INPUT_REPORT, max: &usbhid->bufsize);
1075	hid_find_max_report(hid, type: HID_OUTPUT_REPORT, max: &usbhid->bufsize);
1076	hid_find_max_report(hid, type: HID_FEATURE_REPORT, max: &usbhid->bufsize);
1077
1078	if (usbhid->bufsize > HID_MAX_BUFFER_SIZE)
1079	usbhid->bufsize = HID_MAX_BUFFER_SIZE;
1080
1081	hid_find_max_report(hid, type: HID_INPUT_REPORT, max: &insize);
1082
1083	if (insize > HID_MAX_BUFFER_SIZE)
1084	insize = HID_MAX_BUFFER_SIZE;
1085
1086	if (hid_alloc_buffers(dev, hid)) {
1087	ret = -ENOMEM;
1088	goto fail;
1089	}
1090
1091	for (n = 0; n < interface->desc.bNumEndpoints; n++) {
1092	struct usb_endpoint_descriptor *endpoint;
1093	int pipe;
1094	int interval;
1095
1096	endpoint = &interface->endpoint[n].desc;
1097	if (!usb_endpoint_xfer_int(epd: endpoint))
1098	continue;
1099
1100	interval = endpoint->bInterval;
1101
1102	/* Some vendors give fullspeed interval on highspeed devides */
1103	if (hid->quirks & HID_QUIRK_FULLSPEED_INTERVAL &&
1104	dev->speed == USB_SPEED_HIGH) {
1105	interval = fls(x: endpoint->bInterval*8);
1106	pr_info("%s: Fixing fullspeed to highspeed interval: %d -> %d\n",
1107	hid->name, endpoint->bInterval, interval);
1108	}
1109
1110	/* Change the polling interval of mice, joysticks
1111	* and keyboards.
1112	*/
1113	switch (hid->collection->usage) {
1114	case HID_GD_MOUSE:
1115	if (hid_mousepoll_interval > 0)
1116	interval = hid_mousepoll_interval;
1117	break;
1118	case HID_GD_JOYSTICK:
1119	if (hid_jspoll_interval > 0)
1120	interval = hid_jspoll_interval;
1121	break;
1122	case HID_GD_KEYBOARD:
1123	if (hid_kbpoll_interval > 0)
1124	interval = hid_kbpoll_interval;
1125	break;
1126	}
1127
1128	ret = -ENOMEM;
1129	if (usb_endpoint_dir_in(epd: endpoint)) {
1130	if (usbhid->urbin)
1131	continue;
1132	if (!(usbhid->urbin = usb_alloc_urb(iso_packets: 0, GFP_KERNEL)))
1133	goto fail;
1134	pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
1135	usb_fill_int_urb(urb: usbhid->urbin, dev, pipe, transfer_buffer: usbhid->inbuf, buffer_length: insize,
1136	complete_fn: hid_irq_in, context: hid, interval);
1137	usbhid->urbin->transfer_dma = usbhid->inbuf_dma;
1138	usbhid->urbin->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1139	} else {
1140	if (usbhid->urbout)
1141	continue;
1142	if (!(usbhid->urbout = usb_alloc_urb(iso_packets: 0, GFP_KERNEL)))
1143	goto fail;
1144	pipe = usb_sndintpipe(dev, endpoint->bEndpointAddress);
1145	usb_fill_int_urb(urb: usbhid->urbout, dev, pipe, transfer_buffer: usbhid->outbuf, buffer_length: 0,
1146	complete_fn: hid_irq_out, context: hid, interval);
1147	usbhid->urbout->transfer_dma = usbhid->outbuf_dma;
1148	usbhid->urbout->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1149	}
1150	}
1151
1152	usbhid->urbctrl = usb_alloc_urb(iso_packets: 0, GFP_KERNEL);
1153	if (!usbhid->urbctrl) {
1154	ret = -ENOMEM;
1155	goto fail;
1156	}
1157
1158	usb_fill_control_urb(urb: usbhid->urbctrl, dev, pipe: 0, setup_packet: (void *) usbhid->cr,
1159	transfer_buffer: usbhid->ctrlbuf, buffer_length: 1, complete_fn: hid_ctrl, context: hid);
1160	usbhid->urbctrl->transfer_dma = usbhid->ctrlbuf_dma;
1161	usbhid->urbctrl->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1162
1163	set_bit(HID_STARTED, addr: &usbhid->iofl);
1164
1165	if (hid->quirks & HID_QUIRK_ALWAYS_POLL) {
1166	ret = usb_autopm_get_interface(intf: usbhid->intf);
1167	if (ret)
1168	goto fail;
1169	set_bit(HID_IN_POLLING, addr: &usbhid->iofl);
1170	usbhid->intf->needs_remote_wakeup = 1;
1171	ret = hid_start_in(hid);
1172	if (ret) {
1173	dev_err(&hid->dev,
1174	"failed to start in urb: %d\n", ret);
1175	}
1176	usb_autopm_put_interface(intf: usbhid->intf);
1177	}
1178
1179	/* Some keyboards don't work until their LEDs have been set.
1180	* Since BIOSes do set the LEDs, it must be safe for any device
1181	* that supports the keyboard boot protocol.
1182	* In addition, enable remote wakeup by default for all keyboard
1183	* devices supporting the boot protocol.
1184	*/
1185	if (interface->desc.bInterfaceSubClass == USB_INTERFACE_SUBCLASS_BOOT &&
1186	interface->desc.bInterfaceProtocol ==
1187	USB_INTERFACE_PROTOCOL_KEYBOARD) {
1188	usbhid_set_leds(hid);
1189	device_set_wakeup_enable(dev: &dev->dev, enable: 1);
1190	}
1191
1192	mutex_unlock(lock: &usbhid->mutex);
1193	return 0;
1194
1195	fail:
1196	usb_free_urb(urb: usbhid->urbin);
1197	usb_free_urb(urb: usbhid->urbout);
1198	usb_free_urb(urb: usbhid->urbctrl);
1199	usbhid->urbin = NULL;
1200	usbhid->urbout = NULL;
1201	usbhid->urbctrl = NULL;
1202	hid_free_buffers(dev, hid);
1203	mutex_unlock(lock: &usbhid->mutex);
1204	return ret;
1205	}
1206
1207	static void usbhid_stop(struct hid_device *hid)
1208	{
1209	struct usbhid_device *usbhid = hid->driver_data;
1210
1211	if (WARN_ON(!usbhid))
1212	return;
1213
1214	if (hid->quirks & HID_QUIRK_ALWAYS_POLL) {
1215	clear_bit(HID_IN_POLLING, addr: &usbhid->iofl);
1216	usbhid->intf->needs_remote_wakeup = 0;
1217	}
1218
1219	mutex_lock(&usbhid->mutex);
1220
1221	clear_bit(HID_STARTED, addr: &usbhid->iofl);
1222
1223	spin_lock_irq(lock: &usbhid->lock); /* Sync with error and led handlers */
1224	set_bit(HID_DISCONNECTED, addr: &usbhid->iofl);
1225	while (usbhid->ctrltail != usbhid->ctrlhead) {
1226	if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_OUT) {
1227	kfree(objp: usbhid->ctrl[usbhid->ctrltail].raw_report);
1228	usbhid->ctrl[usbhid->ctrltail].raw_report = NULL;
1229	}
1230
1231	usbhid->ctrltail = (usbhid->ctrltail + 1) &
1232	(HID_CONTROL_FIFO_SIZE - 1);
1233	}
1234	spin_unlock_irq(lock: &usbhid->lock);
1235
1236	usb_kill_urb(urb: usbhid->urbin);
1237	usb_kill_urb(urb: usbhid->urbout);
1238	usb_kill_urb(urb: usbhid->urbctrl);
1239
1240	hid_cancel_delayed_stuff(usbhid);
1241
1242	hid->claimed = 0;
1243
1244	usb_free_urb(urb: usbhid->urbin);
1245	usb_free_urb(urb: usbhid->urbctrl);
1246	usb_free_urb(urb: usbhid->urbout);
1247	usbhid->urbin = NULL; /* don't mess up next start */
1248	usbhid->urbctrl = NULL;
1249	usbhid->urbout = NULL;
1250
1251	hid_free_buffers(hid_to_usb_dev(hid), hid);
1252
1253	mutex_unlock(lock: &usbhid->mutex);
1254	}
1255
1256	static int usbhid_power(struct hid_device *hid, int lvl)
1257	{
1258	struct usbhid_device *usbhid = hid->driver_data;
1259	int r = 0;
1260
1261	switch (lvl) {
1262	case PM_HINT_FULLON:
1263	r = usb_autopm_get_interface(intf: usbhid->intf);
1264	break;
1265
1266	case PM_HINT_NORMAL:
1267	usb_autopm_put_interface(intf: usbhid->intf);
1268	break;
1269	}
1270
1271	return r;
1272	}
1273
1274	static void usbhid_request(struct hid_device *hid, struct hid_report *rep, int reqtype)
1275	{
1276	switch (reqtype) {
1277	case HID_REQ_GET_REPORT:
1278	usbhid_submit_report(hid, report: rep, USB_DIR_IN);
1279	break;
1280	case HID_REQ_SET_REPORT:
1281	usbhid_submit_report(hid, report: rep, USB_DIR_OUT);
1282	break;
1283	}
1284	}
1285
1286	static int usbhid_raw_request(struct hid_device *hid, unsigned char reportnum,
1287	__u8 *buf, size_t len, unsigned char rtype,
1288	int reqtype)
1289	{
1290	switch (reqtype) {
1291	case HID_REQ_GET_REPORT:
1292	return usbhid_get_raw_report(hid, report_number: reportnum, buf, count: len, report_type: rtype);
1293	case HID_REQ_SET_REPORT:
1294	return usbhid_set_raw_report(hid, reportnum, buf, count: len, rtype);
1295	default:
1296	return -EIO;
1297	}
1298	}
1299
1300	static int usbhid_idle(struct hid_device *hid, int report, int idle,
1301	int reqtype)
1302	{
1303	struct usb_device *dev = hid_to_usb_dev(hid);
1304	struct usb_interface *intf = to_usb_interface(hid->dev.parent);
1305	struct usb_host_interface *interface = intf->cur_altsetting;
1306	int ifnum = interface->desc.bInterfaceNumber;
1307
1308	if (reqtype != HID_REQ_SET_IDLE)
1309	return -EINVAL;
1310
1311	return hid_set_idle(dev, ifnum, report, idle);
1312	}
1313
1314	static bool usbhid_may_wakeup(struct hid_device *hid)
1315	{
1316	struct usb_device *dev = hid_to_usb_dev(hid);
1317
1318	return device_may_wakeup(dev: &dev->dev);
1319	}
1320
1321	static const struct hid_ll_driver usb_hid_driver = {
1322	.parse = usbhid_parse,
1323	.start = usbhid_start,
1324	.stop = usbhid_stop,
1325	.open = usbhid_open,
1326	.close = usbhid_close,
1327	.power = usbhid_power,
1328	.request = usbhid_request,
1329	.wait = usbhid_wait_io,
1330	.raw_request = usbhid_raw_request,
1331	.output_report = usbhid_output_report,
1332	.idle = usbhid_idle,
1333	.may_wakeup = usbhid_may_wakeup,
1334	};
1335
1336	bool hid_is_usb(const struct hid_device *hdev)
1337	{
1338	return hdev->ll_driver == &usb_hid_driver;
1339	}
1340	EXPORT_SYMBOL_GPL(hid_is_usb);
1341
1342	static int usbhid_probe(struct usb_interface *intf, const struct usb_device_id *id)
1343	{
1344	struct usb_host_interface *interface = intf->cur_altsetting;
1345	struct usb_device *dev = interface_to_usbdev(intf);
1346	struct usbhid_device *usbhid;
1347	struct hid_device *hid;
1348	unsigned int n, has_in = 0;
1349	size_t len;
1350	int ret;
1351
1352	dbg_hid("HID probe called for ifnum %d\n",
1353	intf->altsetting->desc.bInterfaceNumber);
1354
1355	for (n = 0; n < interface->desc.bNumEndpoints; n++)
1356	if (usb_endpoint_is_int_in(epd: &interface->endpoint[n].desc))
1357	has_in++;
1358	if (!has_in) {
1359	hid_err(intf, "couldn't find an input interrupt endpoint\n");
1360	return -ENODEV;
1361	}
1362
1363	hid = hid_allocate_device();
1364	if (IS_ERR(ptr: hid))
1365	return PTR_ERR(ptr: hid);
1366
1367	usb_set_intfdata(intf, data: hid);
1368	hid->ll_driver = &usb_hid_driver;
1369	hid->ff_init = hid_pidff_init;
1370	#ifdef CONFIG_USB_HIDDEV
1371	hid->hiddev_connect = hiddev_connect;
1372	hid->hiddev_disconnect = hiddev_disconnect;
1373	hid->hiddev_hid_event = hiddev_hid_event;
1374	hid->hiddev_report_event = hiddev_report_event;
1375	#endif
1376	hid->dev.parent = &intf->dev;
1377	hid->bus = BUS_USB;
1378	hid->vendor = le16_to_cpu(dev->descriptor.idVendor);
1379	hid->product = le16_to_cpu(dev->descriptor.idProduct);
1380	hid->version = le16_to_cpu(dev->descriptor.bcdDevice);
1381	hid->name[0] = 0;
1382	if (intf->cur_altsetting->desc.bInterfaceProtocol ==
1383	USB_INTERFACE_PROTOCOL_MOUSE)
1384	hid->type = HID_TYPE_USBMOUSE;
1385	else if (intf->cur_altsetting->desc.bInterfaceProtocol == 0)
1386	hid->type = HID_TYPE_USBNONE;
1387
1388	if (dev->manufacturer)
1389	strscpy(p: hid->name, q: dev->manufacturer, size: sizeof(hid->name));
1390
1391	if (dev->product) {
1392	if (dev->manufacturer)
1393	strlcat(p: hid->name, q: " ", avail: sizeof(hid->name));
1394	strlcat(p: hid->name, q: dev->product, avail: sizeof(hid->name));
1395	}
1396
1397	if (!strlen(hid->name))
1398	snprintf(buf: hid->name, size: sizeof(hid->name), fmt: "HID %04x:%04x",
1399	le16_to_cpu(dev->descriptor.idVendor),
1400	le16_to_cpu(dev->descriptor.idProduct));
1401
1402	usb_make_path(dev, buf: hid->phys, size: sizeof(hid->phys));
1403	strlcat(p: hid->phys, q: "/input", avail: sizeof(hid->phys));
1404	len = strlen(hid->phys);
1405	if (len < sizeof(hid->phys) - 1)
1406	snprintf(buf: hid->phys + len, size: sizeof(hid->phys) - len,
1407	fmt: "%d", intf->altsetting[0].desc.bInterfaceNumber);
1408
1409	if (usb_string(dev, index: dev->descriptor.iSerialNumber, buf: hid->uniq, size: 64) <= 0)
1410	hid->uniq[0] = 0;
1411
1412	usbhid = kzalloc(size: sizeof(*usbhid), GFP_KERNEL);
1413	if (usbhid == NULL) {
1414	ret = -ENOMEM;
1415	goto err;
1416	}
1417
1418	hid->driver_data = usbhid;
1419	usbhid->hid = hid;
1420	usbhid->intf = intf;
1421	usbhid->ifnum = interface->desc.bInterfaceNumber;
1422
1423	init_waitqueue_head(&usbhid->wait);
1424	INIT_WORK(&usbhid->reset_work, hid_reset);
1425	timer_setup(&usbhid->io_retry, hid_retry_timeout, 0);
1426	spin_lock_init(&usbhid->lock);
1427	mutex_init(&usbhid->mutex);
1428
1429	ret = hid_add_device(hid);
1430	if (ret) {
1431	if (ret != -ENODEV)
1432	hid_err(intf, "can't add hid device: %d\n", ret);
1433	goto err_free;
1434	}
1435
1436	return 0;
1437	err_free:
1438	kfree(objp: usbhid);
1439	err:
1440	hid_destroy_device(hid);
1441	return ret;
1442	}
1443
1444	static void usbhid_disconnect(struct usb_interface *intf)
1445	{
1446	struct hid_device *hid = usb_get_intfdata(intf);
1447	struct usbhid_device *usbhid;
1448
1449	if (WARN_ON(!hid))
1450	return;
1451
1452	usbhid = hid->driver_data;
1453	spin_lock_irq(lock: &usbhid->lock); /* Sync with error and led handlers */
1454	set_bit(HID_DISCONNECTED, addr: &usbhid->iofl);
1455	spin_unlock_irq(lock: &usbhid->lock);
1456	hid_destroy_device(hid);
1457	kfree(objp: usbhid);
1458	}
1459
1460	static void hid_cancel_delayed_stuff(struct usbhid_device *usbhid)
1461	{
1462	del_timer_sync(timer: &usbhid->io_retry);
1463	cancel_work_sync(work: &usbhid->reset_work);
1464	}
1465
1466	static void hid_cease_io(struct usbhid_device *usbhid)
1467	{
1468	del_timer_sync(timer: &usbhid->io_retry);
1469	usb_kill_urb(urb: usbhid->urbin);
1470	usb_kill_urb(urb: usbhid->urbctrl);
1471	usb_kill_urb(urb: usbhid->urbout);
1472	}
1473
1474	static void hid_restart_io(struct hid_device *hid)
1475	{
1476	struct usbhid_device *usbhid = hid->driver_data;
1477	int clear_halt = test_bit(HID_CLEAR_HALT, &usbhid->iofl);
1478	int reset_pending = test_bit(HID_RESET_PENDING, &usbhid->iofl);
1479
1480	spin_lock_irq(lock: &usbhid->lock);
1481	clear_bit(HID_SUSPENDED, addr: &usbhid->iofl);
1482	usbhid_mark_busy(usbhid);
1483
1484	if (clear_halt || reset_pending)
1485	schedule_work(work: &usbhid->reset_work);
1486	usbhid->retry_delay = 0;
1487	spin_unlock_irq(lock: &usbhid->lock);
1488
1489	if (reset_pending || !test_bit(HID_STARTED, &usbhid->iofl))
1490	return;
1491
1492	if (!clear_halt) {
1493	if (hid_start_in(hid) < 0)
1494	hid_io_error(hid);
1495	}
1496
1497	spin_lock_irq(lock: &usbhid->lock);
1498	if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl))
1499	usbhid_restart_out_queue(usbhid);
1500	if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
1501	usbhid_restart_ctrl_queue(usbhid);
1502	spin_unlock_irq(lock: &usbhid->lock);
1503	}
1504
1505	/* Treat USB reset pretty much the same as suspend/resume */
1506	static int hid_pre_reset(struct usb_interface *intf)
1507	{
1508	struct hid_device *hid = usb_get_intfdata(intf);
1509	struct usbhid_device *usbhid = hid->driver_data;
1510
1511	spin_lock_irq(lock: &usbhid->lock);
1512	set_bit(HID_RESET_PENDING, addr: &usbhid->iofl);
1513	spin_unlock_irq(lock: &usbhid->lock);
1514	hid_cease_io(usbhid);
1515
1516	return 0;
1517	}
1518
1519	/* Same routine used for post_reset and reset_resume */
1520	static int hid_post_reset(struct usb_interface *intf)
1521	{
1522	struct usb_device *dev = interface_to_usbdev (intf);
1523	struct hid_device *hid = usb_get_intfdata(intf);
1524	struct usbhid_device *usbhid = hid->driver_data;
1525	struct usb_host_interface *interface = intf->cur_altsetting;
1526	int status;
1527	char *rdesc;
1528
1529	/* Fetch and examine the HID report descriptor. If this
1530	* has changed, then rebind. Since usbcore's check of the
1531	* configuration descriptors passed, we already know that
1532	* the size of the HID report descriptor has not changed.
1533	*/
1534	rdesc = kmalloc(size: hid->dev_rsize, GFP_KERNEL);
1535	if (!rdesc)
1536	return -ENOMEM;
1537
1538	status = hid_get_class_descriptor(dev,
1539	ifnum: interface->desc.bInterfaceNumber,
1540	HID_DT_REPORT, buf: rdesc, size: hid->dev_rsize);
1541	if (status < 0) {
1542	dbg_hid("reading report descriptor failed (post_reset)\n");
1543	kfree(objp: rdesc);
1544	return status;
1545	}
1546	status = memcmp(p: rdesc, q: hid->dev_rdesc, size: hid->dev_rsize);
1547	kfree(objp: rdesc);
1548	if (status != 0) {
1549	dbg_hid("report descriptor changed\n");
1550	return -EPERM;
1551	}
1552
1553	/* No need to do another reset or clear a halted endpoint */
1554	spin_lock_irq(lock: &usbhid->lock);
1555	clear_bit(HID_RESET_PENDING, addr: &usbhid->iofl);
1556	clear_bit(HID_CLEAR_HALT, addr: &usbhid->iofl);
1557	spin_unlock_irq(lock: &usbhid->lock);
1558	hid_set_idle(dev, ifnum: intf->cur_altsetting->desc.bInterfaceNumber, report: 0, idle: 0);
1559
1560	hid_restart_io(hid);
1561
1562	return 0;
1563	}
1564
1565	static int hid_resume_common(struct hid_device *hid, bool driver_suspended)
1566	{
1567	int status = 0;
1568
1569	hid_restart_io(hid);
1570	if (driver_suspended)
1571	status = hid_driver_resume(hdev: hid);
1572	return status;
1573	}
1574
1575	static int hid_suspend(struct usb_interface *intf, pm_message_t message)
1576	{
1577	struct hid_device *hid = usb_get_intfdata(intf);
1578	struct usbhid_device *usbhid = hid->driver_data;
1579	int status = 0;
1580	bool driver_suspended = false;
1581	unsigned int ledcount;
1582
1583	if (PMSG_IS_AUTO(message)) {
1584	ledcount = hidinput_count_leds(hid);
1585	spin_lock_irq(lock: &usbhid->lock); /* Sync with error handler */
1586	if (!test_bit(HID_RESET_PENDING, &usbhid->iofl)
1587	&& !test_bit(HID_CLEAR_HALT, &usbhid->iofl)
1588	&& !test_bit(HID_OUT_RUNNING, &usbhid->iofl)
1589	&& !test_bit(HID_CTRL_RUNNING, &usbhid->iofl)
1590	&& !test_bit(HID_KEYS_PRESSED, &usbhid->iofl)
1591	&& (!ledcount || ignoreled))
1592	{
1593	set_bit(HID_SUSPENDED, addr: &usbhid->iofl);
1594	spin_unlock_irq(lock: &usbhid->lock);
1595	status = hid_driver_suspend(hdev: hid, state: message);
1596	if (status < 0)
1597	goto failed;
1598	driver_suspended = true;
1599	} else {
1600	usbhid_mark_busy(usbhid);
1601	spin_unlock_irq(lock: &usbhid->lock);
1602	return -EBUSY;
1603	}
1604
1605	} else {
1606	/* TODO: resume() might need to handle suspend failure */
1607	status = hid_driver_suspend(hdev: hid, state: message);
1608	driver_suspended = true;
1609	spin_lock_irq(lock: &usbhid->lock);
1610	set_bit(HID_SUSPENDED, addr: &usbhid->iofl);
1611	spin_unlock_irq(lock: &usbhid->lock);
1612	if (usbhid_wait_io(hid) < 0)
1613	status = -EIO;
1614	}
1615
1616	hid_cancel_delayed_stuff(usbhid);
1617	hid_cease_io(usbhid);
1618
1619	if (PMSG_IS_AUTO(message) && test_bit(HID_KEYS_PRESSED, &usbhid->iofl)) {
1620	/* lost race against keypresses */
1621	status = -EBUSY;
1622	goto failed;
1623	}
1624	dev_dbg(&intf->dev, "suspend\n");
1625	return status;
1626
1627	failed:
1628	hid_resume_common(hid, driver_suspended);
1629	return status;
1630	}
1631
1632	static int hid_resume(struct usb_interface *intf)
1633	{
1634	struct hid_device *hid = usb_get_intfdata (intf);
1635	int status;
1636
1637	status = hid_resume_common(hid, driver_suspended: true);
1638	dev_dbg(&intf->dev, "resume status %d\n", status);
1639	return 0;
1640	}
1641
1642	static int hid_reset_resume(struct usb_interface *intf)
1643	{
1644	struct hid_device *hid = usb_get_intfdata(intf);
1645	int status;
1646
1647	status = hid_post_reset(intf);
1648	if (status >= 0) {
1649	int ret = hid_driver_reset_resume(hdev: hid);
1650	if (ret < 0)
1651	status = ret;
1652	}
1653	return status;
1654	}
1655
1656	static const struct usb_device_id hid_usb_ids[] = {
1657	{ .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
1658	.bInterfaceClass = USB_INTERFACE_CLASS_HID },
1659	{ } /* Terminating entry */
1660	};
1661
1662	MODULE_DEVICE_TABLE (usb, hid_usb_ids);
1663
1664	static struct usb_driver hid_driver = {
1665	.name = "usbhid",
1666	.probe = usbhid_probe,
1667	.disconnect = usbhid_disconnect,
1668	.suspend = pm_ptr(hid_suspend),
1669	.resume = pm_ptr(hid_resume),
1670	.reset_resume = pm_ptr(hid_reset_resume),
1671	.pre_reset = hid_pre_reset,
1672	.post_reset = hid_post_reset,
1673	.id_table = hid_usb_ids,
1674	.supports_autosuspend = 1,
1675	};
1676
1677	struct usb_interface *usbhid_find_interface(int minor)
1678	{
1679	return usb_find_interface(drv: &hid_driver, minor);
1680	}
1681
1682	static int __init hid_init(void)
1683	{
1684	int retval;
1685
1686	retval = hid_quirks_init(quirks_param, BUS_USB, MAX_USBHID_BOOT_QUIRKS);
1687	if (retval)
1688	goto usbhid_quirks_init_fail;
1689	retval = usb_register(&hid_driver);
1690	if (retval)
1691	goto usb_register_fail;
1692	pr_info(KBUILD_MODNAME ": " DRIVER_DESC "\n");
1693
1694	return 0;
1695	usb_register_fail:
1696	hid_quirks_exit(BUS_USB);
1697	usbhid_quirks_init_fail:
1698	return retval;
1699	}
1700
1701	static void __exit hid_exit(void)
1702	{
1703	usb_deregister(&hid_driver);
1704	hid_quirks_exit(BUS_USB);
1705	}
1706
1707	module_init(hid_init);
1708	module_exit(hid_exit);
1709
1710	MODULE_AUTHOR("Andreas Gal");
1711	MODULE_AUTHOR("Vojtech Pavlik");
1712	MODULE_AUTHOR("Jiri Kosina");
1713	MODULE_DESCRIPTION(DRIVER_DESC);
1714	MODULE_LICENSE("GPL");
1715