1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/*
3	* USB HID support for Linux
4	*
5	* Copyright (c) 1999 Andreas Gal
6	* Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
7	* Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
8	* Copyright (c) 2007-2008 Oliver Neukum
9	* Copyright (c) 2006-2010 Jiri Kosina
10	*/
11
12	/*
13	*/
14
15	#include <linux/module.h>
16	#include <linux/slab.h>
17	#include <linux/init.h>
18	#include <linux/kernel.h>
19	#include <linux/list.h>
20	#include <linux/mm.h>
21	#include <linux/mutex.h>
22	#include <linux/property.h>
23	#include <linux/spinlock.h>
24	#include <linux/unaligned.h>
25	#include <asm/byteorder.h>
26	#include <linux/input.h>
27	#include <linux/wait.h>
28	#include <linux/workqueue.h>
29	#include <linux/string.h>
30
31	#include <linux/usb.h>
32
33	#include <linux/hid.h>
34	#include <linux/hiddev.h>
35	#include <linux/hid-debug.h>
36	#include <linux/hidraw.h>
37	#include "usbhid.h"
38	#include "hid-pidff.h"
39
40	/*
41	* Version Information
42	*/
43
44	#define DRIVER_DESC "USB HID core driver"
45
46	/*
47	* Module parameters.
48	*/
49
50	static unsigned int hid_mousepoll_interval;
51	module_param_named(mousepoll, hid_mousepoll_interval, uint, 0644);
52	MODULE_PARM_DESC(mousepoll, "Polling interval of mice");
53
54	static unsigned int hid_jspoll_interval;
55	module_param_named(jspoll, hid_jspoll_interval, uint, 0644);
56	MODULE_PARM_DESC(jspoll, "Polling interval of joysticks");
57
58	static unsigned int hid_kbpoll_interval;
59	module_param_named(kbpoll, hid_kbpoll_interval, uint, 0644);
60	MODULE_PARM_DESC(kbpoll, "Polling interval of keyboards");
61
62	static unsigned int ignoreled;
63	module_param_named(ignoreled, ignoreled, uint, 0644);
64	MODULE_PARM_DESC(ignoreled, "Autosuspend with active leds");
65
66	/* Quirks specified at module load time */
67	static char *quirks_param[MAX_USBHID_BOOT_QUIRKS];
68	module_param_array_named(quirks, quirks_param, charp, NULL, 0444);
69	MODULE_PARM_DESC(quirks, "Add/modify USB HID quirks by specifying "
70	" quirks=vendorID:productID:quirks"
71	" where vendorID, productID, and quirks are all in"
72	" 0x-prefixed hex");
73	/*
74	* Input submission and I/O error handler.
75	*/
76	static void hid_io_error(struct hid_device *hid);
77	static int hid_submit_out(struct hid_device *hid);
78	static int hid_submit_ctrl(struct hid_device *hid);
79	static void hid_cancel_delayed_stuff(struct usbhid_device *usbhid);
80
81	/* Start up the input URB */
82	static int hid_start_in(struct hid_device *hid)
83	{
84	unsigned long flags;
85	int rc = 0;
86	struct usbhid_device *usbhid = hid->driver_data;
87
88	spin_lock_irqsave(&usbhid->lock, flags);
89	if (test_bit(HID_IN_POLLING, &usbhid->iofl) &&
90	!test_bit(HID_DISCONNECTED, &usbhid->iofl) &&
91	!test_bit(HID_SUSPENDED, &usbhid->iofl) &&
92	!test_and_set_bit(HID_IN_RUNNING, addr: &usbhid->iofl)) {
93	rc = usb_submit_urb(urb: usbhid->urbin, GFP_ATOMIC);
94	if (rc != 0) {
95	clear_bit(HID_IN_RUNNING, addr: &usbhid->iofl);
96	if (rc == -ENOSPC)
97	set_bit(HID_NO_BANDWIDTH, addr: &usbhid->iofl);
98	} else {
99	clear_bit(HID_NO_BANDWIDTH, addr: &usbhid->iofl);
100	}
101	}
102	spin_unlock_irqrestore(lock: &usbhid->lock, flags);
103	return rc;
104	}
105
106	/* I/O retry timer routine */
107	static void hid_retry_timeout(struct timer_list *t)
108	{
109	struct usbhid_device *usbhid = timer_container_of(usbhid, t, io_retry);
110	struct hid_device *hid = usbhid->hid;
111
112	dev_dbg(&usbhid->intf->dev, "retrying intr urb\n");
113	if (hid_start_in(hid))
114	hid_io_error(hid);
115	}
116
117	/* Workqueue routine to reset the device or clear a halt */
118	static void hid_reset(struct work_struct *work)
119	{
120	struct usbhid_device *usbhid =
121	container_of(work, struct usbhid_device, reset_work);
122	struct hid_device *hid = usbhid->hid;
123	int rc;
124
125	if (test_bit(HID_CLEAR_HALT, &usbhid->iofl)) {
126	dev_dbg(&usbhid->intf->dev, "clear halt\n");
127	rc = usb_clear_halt(hid_to_usb_dev(hid), pipe: usbhid->urbin->pipe);
128	clear_bit(HID_CLEAR_HALT, addr: &usbhid->iofl);
129	if (rc == 0) {
130	hid_start_in(hid);
131	} else {
132	dev_dbg(&usbhid->intf->dev,
133	"clear-halt failed: %d\n", rc);
134	set_bit(HID_RESET_PENDING, addr: &usbhid->iofl);
135	}
136	}
137
138	if (test_bit(HID_RESET_PENDING, &usbhid->iofl)) {
139	dev_dbg(&usbhid->intf->dev, "resetting device\n");
140	usb_queue_reset_device(dev: usbhid->intf);
141	}
142	}
143
144	/* Main I/O error handler */
145	static void hid_io_error(struct hid_device *hid)
146	{
147	unsigned long flags;
148	struct usbhid_device *usbhid = hid->driver_data;
149
150	spin_lock_irqsave(&usbhid->lock, flags);
151
152	/* Stop when disconnected */
153	if (test_bit(HID_DISCONNECTED, &usbhid->iofl))
154	goto done;
155
156	/* If it has been a while since the last error, we'll assume
157	* this a brand new error and reset the retry timeout. */
158	if (time_after(jiffies, usbhid->stop_retry + HZ/2))
159	usbhid->retry_delay = 0;
160
161	/* When an error occurs, retry at increasing intervals */
162	if (usbhid->retry_delay == 0) {
163	usbhid->retry_delay = 13; /* Then 26, 52, 104, 104, ... */
164	usbhid->stop_retry = jiffies + msecs_to_jiffies(m: 1000);
165	} else if (usbhid->retry_delay < 100)
166	usbhid->retry_delay *= 2;
167
168	if (time_after(jiffies, usbhid->stop_retry)) {
169
170	/* Retries failed, so do a port reset unless we lack bandwidth*/
171	if (!test_bit(HID_NO_BANDWIDTH, &usbhid->iofl)
172	&& !test_and_set_bit(HID_RESET_PENDING, addr: &usbhid->iofl)) {
173
174	schedule_work(work: &usbhid->reset_work);
175	goto done;
176	}
177	}
178
179	mod_timer(timer: &usbhid->io_retry,
180	expires: jiffies + msecs_to_jiffies(m: usbhid->retry_delay));
181	done:
182	spin_unlock_irqrestore(lock: &usbhid->lock, flags);
183	}
184
185	static void usbhid_mark_busy(struct usbhid_device *usbhid)
186	{
187	struct usb_interface *intf = usbhid->intf;
188
189	usb_mark_last_busy(interface_to_usbdev(intf));
190	}
191
192	static int usbhid_restart_out_queue(struct usbhid_device *usbhid)
193	{
194	struct hid_device *hid = usb_get_intfdata(intf: usbhid->intf);
195	int kicked;
196	int r;
197
198	if (!hid || test_bit(HID_RESET_PENDING, &usbhid->iofl) ||
199	test_bit(HID_SUSPENDED, &usbhid->iofl))
200	return 0;
201
202	if ((kicked = (usbhid->outhead != usbhid->outtail))) {
203	hid_dbg(hid, "Kicking head %d tail %d", usbhid->outhead, usbhid->outtail);
204
205	/* Try to wake up from autosuspend... */
206	r = usb_autopm_get_interface_async(intf: usbhid->intf);
207	if (r < 0)
208	return r;
209
210	/*
211	* If still suspended, don't submit. Submission will
212	* occur if/when resume drains the queue.
213	*/
214	if (test_bit(HID_SUSPENDED, &usbhid->iofl)) {
215	usb_autopm_put_interface_no_suspend(intf: usbhid->intf);
216	return r;
217	}
218
219	/* Asynchronously flush queue. */
220	set_bit(HID_OUT_RUNNING, addr: &usbhid->iofl);
221	if (hid_submit_out(hid)) {
222	clear_bit(HID_OUT_RUNNING, addr: &usbhid->iofl);
223	usb_autopm_put_interface_async(intf: usbhid->intf);
224	}
225	wake_up(&usbhid->wait);
226	}
227	return kicked;
228	}
229
230	static int usbhid_restart_ctrl_queue(struct usbhid_device *usbhid)
231	{
232	struct hid_device *hid = usb_get_intfdata(intf: usbhid->intf);
233	int kicked;
234	int r;
235
236	WARN_ON(hid == NULL);
237	if (!hid || test_bit(HID_RESET_PENDING, &usbhid->iofl) ||
238	test_bit(HID_SUSPENDED, &usbhid->iofl))
239	return 0;
240
241	if ((kicked = (usbhid->ctrlhead != usbhid->ctrltail))) {
242	hid_dbg(hid, "Kicking head %d tail %d", usbhid->ctrlhead, usbhid->ctrltail);
243
244	/* Try to wake up from autosuspend... */
245	r = usb_autopm_get_interface_async(intf: usbhid->intf);
246	if (r < 0)
247	return r;
248
249	/*
250	* If still suspended, don't submit. Submission will
251	* occur if/when resume drains the queue.
252	*/
253	if (test_bit(HID_SUSPENDED, &usbhid->iofl)) {
254	usb_autopm_put_interface_no_suspend(intf: usbhid->intf);
255	return r;
256	}
257
258	/* Asynchronously flush queue. */
259	set_bit(HID_CTRL_RUNNING, addr: &usbhid->iofl);
260	if (hid_submit_ctrl(hid)) {
261	clear_bit(HID_CTRL_RUNNING, addr: &usbhid->iofl);
262	usb_autopm_put_interface_async(intf: usbhid->intf);
263	}
264	wake_up(&usbhid->wait);
265	}
266	return kicked;
267	}
268
269	/*
270	* Input interrupt completion handler.
271	*/
272
273	static void hid_irq_in(struct urb *urb)
274	{
275	struct hid_device *hid = urb->context;
276	struct usbhid_device *usbhid = hid->driver_data;
277	int status;
278
279	switch (urb->status) {
280	case 0: /* success */
281	usbhid->retry_delay = 0;
282	if (!test_bit(HID_OPENED, &usbhid->iofl))
283	break;
284	usbhid_mark_busy(usbhid);
285	if (!test_bit(HID_RESUME_RUNNING, &usbhid->iofl)) {
286	hid_input_report(hid: urb->context, type: HID_INPUT_REPORT,
287	data: urb->transfer_buffer,
288	size: urb->actual_length, interrupt: 1);
289	/*
290	* autosuspend refused while keys are pressed
291	* because most keyboards don't wake up when
292	* a key is released
293	*/
294	if (hid_check_keys_pressed(hid))
295	set_bit(HID_KEYS_PRESSED, addr: &usbhid->iofl);
296	else
297	clear_bit(HID_KEYS_PRESSED, addr: &usbhid->iofl);
298	}
299	break;
300	case -EPIPE: /* stall */
301	usbhid_mark_busy(usbhid);
302	clear_bit(HID_IN_RUNNING, addr: &usbhid->iofl);
303	set_bit(HID_CLEAR_HALT, addr: &usbhid->iofl);
304	schedule_work(work: &usbhid->reset_work);
305	return;
306	case -ECONNRESET: /* unlink */
307	case -ENOENT:
308	case -ESHUTDOWN: /* unplug */
309	clear_bit(HID_IN_RUNNING, addr: &usbhid->iofl);
310	return;
311	case -EILSEQ: /* protocol error or unplug */
312	case -EPROTO: /* protocol error or unplug */
313	case -ETIME: /* protocol error or unplug */
314	case -ETIMEDOUT: /* Should never happen, but... */
315	usbhid_mark_busy(usbhid);
316	clear_bit(HID_IN_RUNNING, addr: &usbhid->iofl);
317	hid_io_error(hid);
318	return;
319	default: /* error */
320	hid_warn(urb->dev, "input irq status %d received\n",
321	urb->status);
322	}
323
324	status = usb_submit_urb(urb, GFP_ATOMIC);
325	if (status) {
326	clear_bit(HID_IN_RUNNING, addr: &usbhid->iofl);
327	if (status != -EPERM) {
328	hid_err(hid, "can't resubmit intr, %s-%s/input%d, status %d\n",
329	hid_to_usb_dev(hid)->bus->bus_name,
330	hid_to_usb_dev(hid)->devpath,
331	usbhid->ifnum, status);
332	hid_io_error(hid);
333	}
334	}
335	}
336
337	static int hid_submit_out(struct hid_device *hid)
338	{
339	struct hid_report *report;
340	char *raw_report;
341	struct usbhid_device *usbhid = hid->driver_data;
342	int r;
343
344	report = usbhid->out[usbhid->outtail].report;
345	raw_report = usbhid->out[usbhid->outtail].raw_report;
346
347	usbhid->urbout->transfer_buffer_length = hid_report_len(report);
348	usbhid->urbout->dev = hid_to_usb_dev(hid);
349	if (raw_report) {
350	memcpy(usbhid->outbuf, raw_report,
351	usbhid->urbout->transfer_buffer_length);
352	kfree(objp: raw_report);
353	usbhid->out[usbhid->outtail].raw_report = NULL;
354	}
355
356	dbg_hid("submitting out urb\n");
357
358	r = usb_submit_urb(urb: usbhid->urbout, GFP_ATOMIC);
359	if (r < 0) {
360	hid_err(hid, "usb_submit_urb(out) failed: %d\n", r);
361	return r;
362	}
363	usbhid->last_out = jiffies;
364	return 0;
365	}
366
367	static int hid_submit_ctrl(struct hid_device *hid)
368	{
369	struct hid_report *report;
370	unsigned char dir;
371	char *raw_report;
372	int len, r;
373	struct usbhid_device *usbhid = hid->driver_data;
374
375	report = usbhid->ctrl[usbhid->ctrltail].report;
376	raw_report = usbhid->ctrl[usbhid->ctrltail].raw_report;
377	dir = usbhid->ctrl[usbhid->ctrltail].dir;
378
379	len = hid_report_len(report);
380	if (dir == USB_DIR_OUT) {
381	usbhid->urbctrl->pipe = usb_sndctrlpipe(hid_to_usb_dev(hid), 0);
382	if (raw_report) {
383	memcpy(usbhid->ctrlbuf, raw_report, len);
384	kfree(objp: raw_report);
385	usbhid->ctrl[usbhid->ctrltail].raw_report = NULL;
386	}
387	} else {
388	int maxpacket;
389
390	usbhid->urbctrl->pipe = usb_rcvctrlpipe(hid_to_usb_dev(hid), 0);
391	maxpacket = usb_maxpacket(hid_to_usb_dev(hid),
392	pipe: usbhid->urbctrl->pipe);
393	len += (len == 0); /* Don't allow 0-length reports */
394	len = round_up(len, maxpacket);
395	if (len > usbhid->bufsize)
396	len = usbhid->bufsize;
397	}
398	usbhid->urbctrl->transfer_buffer_length = len;
399	usbhid->urbctrl->dev = hid_to_usb_dev(hid);
400
401	usbhid->cr->bRequestType = USB_TYPE_CLASS | USB_RECIP_INTERFACE | dir;
402	usbhid->cr->bRequest = (dir == USB_DIR_OUT) ? HID_REQ_SET_REPORT :
403	HID_REQ_GET_REPORT;
404	usbhid->cr->wValue = cpu_to_le16(((report->type + 1) << 8) |
405	report->id);
406	usbhid->cr->wIndex = cpu_to_le16(usbhid->ifnum);
407	usbhid->cr->wLength = cpu_to_le16(len);
408
409	dbg_hid("submitting ctrl urb: %s wValue=0x%04x wIndex=0x%04x wLength=%u\n",
410	usbhid->cr->bRequest == HID_REQ_SET_REPORT ? "Set_Report" :
411	"Get_Report",
412	usbhid->cr->wValue, usbhid->cr->wIndex, usbhid->cr->wLength);
413
414	r = usb_submit_urb(urb: usbhid->urbctrl, GFP_ATOMIC);
415	if (r < 0) {
416	hid_err(hid, "usb_submit_urb(ctrl) failed: %d\n", r);
417	return r;
418	}
419	usbhid->last_ctrl = jiffies;
420	return 0;
421	}
422
423	/*
424	* Output interrupt completion handler.
425	*/
426
427	static void hid_irq_out(struct urb *urb)
428	{
429	struct hid_device *hid = urb->context;
430	struct usbhid_device *usbhid = hid->driver_data;
431	unsigned long flags;
432	int unplug = 0;
433
434	switch (urb->status) {
435	case 0: /* success */
436	break;
437	case -ESHUTDOWN: /* unplug */
438	unplug = 1;
439	break;
440	case -EILSEQ: /* protocol error or unplug */
441	case -EPROTO: /* protocol error or unplug */
442	case -ECONNRESET: /* unlink */
443	case -ENOENT:
444	break;
445	default: /* error */
446	hid_warn(urb->dev, "output irq status %d received\n",
447	urb->status);
448	}
449
450	spin_lock_irqsave(&usbhid->lock, flags);
451
452	if (unplug) {
453	usbhid->outtail = usbhid->outhead;
454	} else {
455	usbhid->outtail = (usbhid->outtail + 1) & (HID_OUTPUT_FIFO_SIZE - 1);
456
457	if (usbhid->outhead != usbhid->outtail &&
458	hid_submit_out(hid) == 0) {
459	/* Successfully submitted next urb in queue */
460	spin_unlock_irqrestore(lock: &usbhid->lock, flags);
461	return;
462	}
463	}
464
465	clear_bit(HID_OUT_RUNNING, addr: &usbhid->iofl);
466	spin_unlock_irqrestore(lock: &usbhid->lock, flags);
467	usb_autopm_put_interface_async(intf: usbhid->intf);
468	wake_up(&usbhid->wait);
469	}
470
471	/*
472	* Control pipe completion handler.
473	*/
474
475	static void hid_ctrl(struct urb *urb)
476	{
477	struct hid_device *hid = urb->context;
478	struct usbhid_device *usbhid = hid->driver_data;
479	unsigned long flags;
480	int unplug = 0, status = urb->status;
481
482	switch (status) {
483	case 0: /* success */
484	if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_IN)
485	hid_input_report(hid: urb->context,
486	type: usbhid->ctrl[usbhid->ctrltail].report->type,
487	data: urb->transfer_buffer, size: urb->actual_length, interrupt: 0);
488	break;
489	case -ESHUTDOWN: /* unplug */
490	unplug = 1;
491	break;
492	case -EILSEQ: /* protocol error or unplug */
493	case -EPROTO: /* protocol error or unplug */
494	case -ECONNRESET: /* unlink */
495	case -ENOENT:
496	case -EPIPE: /* report not available */
497	break;
498	default: /* error */
499	hid_warn(urb->dev, "ctrl urb status %d received\n", status);
500	}
501
502	spin_lock_irqsave(&usbhid->lock, flags);
503
504	if (unplug) {
505	usbhid->ctrltail = usbhid->ctrlhead;
506	} else if (usbhid->ctrlhead != usbhid->ctrltail) {
507	usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1);
508
509	if (usbhid->ctrlhead != usbhid->ctrltail &&
510	hid_submit_ctrl(hid) == 0) {
511	/* Successfully submitted next urb in queue */
512	spin_unlock_irqrestore(lock: &usbhid->lock, flags);
513	return;
514	}
515	}
516
517	clear_bit(HID_CTRL_RUNNING, addr: &usbhid->iofl);
518	spin_unlock_irqrestore(lock: &usbhid->lock, flags);
519	usb_autopm_put_interface_async(intf: usbhid->intf);
520	wake_up(&usbhid->wait);
521	}
522
523	static void __usbhid_submit_report(struct hid_device *hid, struct hid_report *report,
524	unsigned char dir)
525	{
526	int head;
527	struct usbhid_device *usbhid = hid->driver_data;
528
529	if (((hid->quirks & HID_QUIRK_NOGET) && dir == USB_DIR_IN) ||
530	test_bit(HID_DISCONNECTED, &usbhid->iofl))
531	return;
532
533	if (usbhid->urbout && dir == USB_DIR_OUT && report->type == HID_OUTPUT_REPORT) {
534	if ((head = (usbhid->outhead + 1) & (HID_OUTPUT_FIFO_SIZE - 1)) == usbhid->outtail) {
535	hid_warn(hid, "output queue full\n");
536	return;
537	}
538
539	usbhid->out[usbhid->outhead].raw_report = hid_alloc_report_buf(report, GFP_ATOMIC);
540	if (!usbhid->out[usbhid->outhead].raw_report) {
541	hid_warn(hid, "output queueing failed\n");
542	return;
543	}
544	hid_output_report(report, data: usbhid->out[usbhid->outhead].raw_report);
545	usbhid->out[usbhid->outhead].report = report;
546	usbhid->outhead = head;
547
548	/* If the queue isn't running, restart it */
549	if (!test_bit(HID_OUT_RUNNING, &usbhid->iofl)) {
550	usbhid_restart_out_queue(usbhid);
551
552	/* Otherwise see if an earlier request has timed out */
553	} else if (time_after(jiffies, usbhid->last_out + HZ * 5)) {
554
555	/* Prevent autosuspend following the unlink */
556	usb_autopm_get_interface_no_resume(intf: usbhid->intf);
557
558	/*
559	* Prevent resubmission in case the URB completes
560	* before we can unlink it. We don't want to cancel
561	* the wrong transfer!
562	*/
563	usb_block_urb(urb: usbhid->urbout);
564
565	/* Drop lock to avoid deadlock if the callback runs */
566	spin_unlock(lock: &usbhid->lock);
567
568	usb_unlink_urb(urb: usbhid->urbout);
569	spin_lock(lock: &usbhid->lock);
570	usb_unblock_urb(urb: usbhid->urbout);
571
572	/* Unlink might have stopped the queue */
573	if (!test_bit(HID_OUT_RUNNING, &usbhid->iofl))
574	usbhid_restart_out_queue(usbhid);
575
576	/* Now we can allow autosuspend again */
577	usb_autopm_put_interface_async(intf: usbhid->intf);
578	}
579	return;
580	}
581
582	if ((head = (usbhid->ctrlhead + 1) & (HID_CONTROL_FIFO_SIZE - 1)) == usbhid->ctrltail) {
583	hid_warn(hid, "control queue full\n");
584	return;
585	}
586
587	if (dir == USB_DIR_OUT) {
588	usbhid->ctrl[usbhid->ctrlhead].raw_report = hid_alloc_report_buf(report, GFP_ATOMIC);
589	if (!usbhid->ctrl[usbhid->ctrlhead].raw_report) {
590	hid_warn(hid, "control queueing failed\n");
591	return;
592	}
593	hid_output_report(report, data: usbhid->ctrl[usbhid->ctrlhead].raw_report);
594	}
595	usbhid->ctrl[usbhid->ctrlhead].report = report;
596	usbhid->ctrl[usbhid->ctrlhead].dir = dir;
597	usbhid->ctrlhead = head;
598
599	/* If the queue isn't running, restart it */
600	if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) {
601	usbhid_restart_ctrl_queue(usbhid);
602
603	/* Otherwise see if an earlier request has timed out */
604	} else if (time_after(jiffies, usbhid->last_ctrl + HZ * 5)) {
605
606	/* Prevent autosuspend following the unlink */
607	usb_autopm_get_interface_no_resume(intf: usbhid->intf);
608
609	/*
610	* Prevent resubmission in case the URB completes
611	* before we can unlink it. We don't want to cancel
612	* the wrong transfer!
613	*/
614	usb_block_urb(urb: usbhid->urbctrl);
615
616	/* Drop lock to avoid deadlock if the callback runs */
617	spin_unlock(lock: &usbhid->lock);
618
619	usb_unlink_urb(urb: usbhid->urbctrl);
620	spin_lock(lock: &usbhid->lock);
621	usb_unblock_urb(urb: usbhid->urbctrl);
622
623	/* Unlink might have stopped the queue */
624	if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
625	usbhid_restart_ctrl_queue(usbhid);
626
627	/* Now we can allow autosuspend again */
628	usb_autopm_put_interface_async(intf: usbhid->intf);
629	}
630	}
631
632	static void usbhid_submit_report(struct hid_device *hid, struct hid_report *report, unsigned char dir)
633	{
634	struct usbhid_device *usbhid = hid->driver_data;
635	unsigned long flags;
636
637	spin_lock_irqsave(&usbhid->lock, flags);
638	__usbhid_submit_report(hid, report, dir);
639	spin_unlock_irqrestore(lock: &usbhid->lock, flags);
640	}
641
642	static int usbhid_wait_io(struct hid_device *hid)
643	{
644	struct usbhid_device *usbhid = hid->driver_data;
645
646	if (!wait_event_timeout(usbhid->wait,
647	(!test_bit(HID_CTRL_RUNNING, &usbhid->iofl) &&
648	!test_bit(HID_OUT_RUNNING, &usbhid->iofl)),
649	10*HZ)) {
650	dbg_hid("timeout waiting for ctrl or out queue to clear\n");
651	return -1;
652	}
653
654	return 0;
655	}
656
657	static int hid_set_idle(struct usb_device *dev, int ifnum, int report, int idle)
658	{
659	return usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
660	request: HID_REQ_SET_IDLE, USB_TYPE_CLASS | USB_RECIP_INTERFACE, value: (idle << 8) | report,
661	index: ifnum, NULL, size: 0, USB_CTRL_SET_TIMEOUT);
662	}
663
664	static int hid_get_class_descriptor(struct usb_device *dev, int ifnum,
665	unsigned char type, void *buf, int size)
666	{
667	int result, retries = 4;
668
669	memset(buf, 0, size);
670
671	do {
672	result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
673	USB_REQ_GET_DESCRIPTOR, USB_RECIP_INTERFACE | USB_DIR_IN,
674	value: (type << 8), index: ifnum, data: buf, size, USB_CTRL_GET_TIMEOUT);
675	retries--;
676	} while (result < size && retries);
677	return result;
678	}
679
680	static int usbhid_open(struct hid_device *hid)
681	{
682	struct usbhid_device *usbhid = hid->driver_data;
683	int res;
684
685	mutex_lock(&usbhid->mutex);
686
687	set_bit(HID_OPENED, addr: &usbhid->iofl);
688
689	if (hid->quirks & HID_QUIRK_ALWAYS_POLL) {
690	res = 0;
691	goto Done;
692	}
693
694	res = usb_autopm_get_interface(intf: usbhid->intf);
695	/* the device must be awake to reliably request remote wakeup */
696	if (res < 0) {
697	clear_bit(HID_OPENED, addr: &usbhid->iofl);
698	res = -EIO;
699	goto Done;
700	}
701
702	usbhid->intf->needs_remote_wakeup = 1;
703
704	set_bit(HID_RESUME_RUNNING, addr: &usbhid->iofl);
705	set_bit(HID_IN_POLLING, addr: &usbhid->iofl);
706
707	res = hid_start_in(hid);
708	if (res) {
709	if (res != -ENOSPC) {
710	hid_io_error(hid);
711	res = 0;
712	} else {
713	/* no use opening if resources are insufficient */
714	res = -EBUSY;
715	clear_bit(HID_OPENED, addr: &usbhid->iofl);
716	clear_bit(HID_IN_POLLING, addr: &usbhid->iofl);
717	usbhid->intf->needs_remote_wakeup = 0;
718	}
719	}
720
721	usb_autopm_put_interface(intf: usbhid->intf);
722
723	/*
724	* In case events are generated while nobody was listening,
725	* some are released when the device is re-opened.
726	* Wait 50 msec for the queue to empty before allowing events
727	* to go through hid.
728	*/
729	if (res == 0)
730	msleep(msecs: 50);
731
732	clear_bit(HID_RESUME_RUNNING, addr: &usbhid->iofl);
733
734	Done:
735	mutex_unlock(lock: &usbhid->mutex);
736	return res;
737	}
738
739	static void usbhid_close(struct hid_device *hid)
740	{
741	struct usbhid_device *usbhid = hid->driver_data;
742
743	mutex_lock(&usbhid->mutex);
744
745	/*
746	* Make sure we don't restart data acquisition due to
747	* a resumption we no longer care about by avoiding racing
748	* with hid_start_in().
749	*/
750	spin_lock_irq(lock: &usbhid->lock);
751	clear_bit(HID_OPENED, addr: &usbhid->iofl);
752	if (!(hid->quirks & HID_QUIRK_ALWAYS_POLL))
753	clear_bit(HID_IN_POLLING, addr: &usbhid->iofl);
754	spin_unlock_irq(lock: &usbhid->lock);
755
756	if (!(hid->quirks & HID_QUIRK_ALWAYS_POLL)) {
757	hid_cancel_delayed_stuff(usbhid);
758	usb_kill_urb(urb: usbhid->urbin);
759	usbhid->intf->needs_remote_wakeup = 0;
760	}
761
762	mutex_unlock(lock: &usbhid->mutex);
763	}
764
765	/*
766	* Initialize all reports
767	*/
768
769	void usbhid_init_reports(struct hid_device *hid)
770	{
771	struct hid_report *report;
772	struct usbhid_device *usbhid = hid->driver_data;
773	struct hid_report_enum *report_enum;
774	int err, ret;
775
776	report_enum = &hid->report_enum[HID_INPUT_REPORT];
777	list_for_each_entry(report, &report_enum->report_list, list)
778	usbhid_submit_report(hid, report, USB_DIR_IN);
779
780	report_enum = &hid->report_enum[HID_FEATURE_REPORT];
781	list_for_each_entry(report, &report_enum->report_list, list)
782	usbhid_submit_report(hid, report, USB_DIR_IN);
783
784	err = 0;
785	ret = usbhid_wait_io(hid);
786	while (ret) {
787	err |= ret;
788	if (test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
789	usb_kill_urb(urb: usbhid->urbctrl);
790	if (test_bit(HID_OUT_RUNNING, &usbhid->iofl))
791	usb_kill_urb(urb: usbhid->urbout);
792	ret = usbhid_wait_io(hid);
793	}
794
795	if (err)
796	hid_warn(hid, "timeout initializing reports\n");
797	}
798
799	/*
800	* Reset LEDs which BIOS might have left on. For now, just NumLock (0x01).
801	*/
802	static int hid_find_field_early(struct hid_device *hid, unsigned int page,
803	unsigned int hid_code, struct hid_field **pfield)
804	{
805	struct hid_report *report;
806	struct hid_field *field;
807	struct hid_usage *usage;
808	int i, j;
809
810	list_for_each_entry(report, &hid->report_enum[HID_OUTPUT_REPORT].report_list, list) {
811	for (i = 0; i < report->maxfield; i++) {
812	field = report->field[i];
813	for (j = 0; j < field->maxusage; j++) {
814	usage = &field->usage[j];
815	if ((usage->hid & HID_USAGE_PAGE) == page &&
816	(usage->hid & 0xFFFF) == hid_code) {
817	*pfield = field;
818	return j;
819	}
820	}
821	}
822	}
823	return -1;
824	}
825
826	static void usbhid_set_leds(struct hid_device *hid)
827	{
828	struct hid_field *field;
829	int offset;
830
831	if ((offset = hid_find_field_early(hid, HID_UP_LED, hid_code: 0x01, pfield: &field)) != -1) {
832	hid_set_field(field, offset, 0);
833	usbhid_submit_report(hid, report: field->report, USB_DIR_OUT);
834	}
835	}
836
837	/*
838	* Traverse the supplied list of reports and find the longest
839	*/
840	static void hid_find_max_report(struct hid_device *hid, unsigned int type,
841	unsigned int *max)
842	{
843	struct hid_report *report;
844	unsigned int size;
845
846	list_for_each_entry(report, &hid->report_enum[type].report_list, list) {
847	size = ((report->size - 1) >> 3) + 1 + hid->report_enum[type].numbered;
848	if (*max < size)
849	*max = size;
850	}
851	}
852
853	static int hid_alloc_buffers(struct usb_device *dev, struct hid_device *hid)
854	{
855	struct usbhid_device *usbhid = hid->driver_data;
856
857	usbhid->inbuf = usb_alloc_coherent(dev, size: usbhid->bufsize, GFP_KERNEL,
858	dma: &usbhid->inbuf_dma);
859	usbhid->outbuf = usb_alloc_coherent(dev, size: usbhid->bufsize, GFP_KERNEL,
860	dma: &usbhid->outbuf_dma);
861	usbhid->cr = kmalloc(sizeof(*usbhid->cr), GFP_KERNEL);
862	usbhid->ctrlbuf = usb_alloc_coherent(dev, size: usbhid->bufsize, GFP_KERNEL,
863	dma: &usbhid->ctrlbuf_dma);
864	if (!usbhid->inbuf || !usbhid->outbuf || !usbhid->cr ||
865	!usbhid->ctrlbuf)
866	return -1;
867
868	return 0;
869	}
870
871	static int usbhid_get_raw_report(struct hid_device *hid,
872	unsigned char report_number, __u8 *buf, size_t count,
873	unsigned char report_type)
874	{
875	struct usbhid_device *usbhid = hid->driver_data;
876	struct usb_device *dev = hid_to_usb_dev(hid);
877	struct usb_interface *intf = usbhid->intf;
878	struct usb_host_interface *interface = intf->cur_altsetting;
879	int skipped_report_id = 0;
880	int ret;
881
882	/* Byte 0 is the report number. Report data starts at byte 1.*/
883	buf[0] = report_number;
884	if (report_number == 0x0) {
885	/* Offset the return buffer by 1, so that the report ID
886	will remain in byte 0. */
887	buf++;
888	count--;
889	skipped_report_id = 1;
890	}
891	ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
892	request: HID_REQ_GET_REPORT,
893	USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
894	value: ((report_type + 1) << 8) | report_number,
895	index: interface->desc.bInterfaceNumber, data: buf, size: count,
896	USB_CTRL_SET_TIMEOUT);
897
898	/* count also the report id */
899	if (ret > 0 && skipped_report_id)
900	ret++;
901
902	return ret;
903	}
904
905	static int usbhid_set_raw_report(struct hid_device *hid, unsigned int reportnum,
906	__u8 *buf, size_t count, unsigned char rtype)
907	{
908	struct usbhid_device *usbhid = hid->driver_data;
909	struct usb_device *dev = hid_to_usb_dev(hid);
910	struct usb_interface *intf = usbhid->intf;
911	struct usb_host_interface *interface = intf->cur_altsetting;
912	int ret, skipped_report_id = 0;
913
914	/* Byte 0 is the report number. Report data starts at byte 1.*/
915	if ((rtype == HID_OUTPUT_REPORT) &&
916	(hid->quirks & HID_QUIRK_SKIP_OUTPUT_REPORT_ID))
917	buf[0] = 0;
918	else
919	buf[0] = reportnum;
920
921	if (buf[0] == 0x0) {
922	/* Don't send the Report ID */
923	buf++;
924	count--;
925	skipped_report_id = 1;
926	}
927
928	ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
929	request: HID_REQ_SET_REPORT,
930	USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
931	value: ((rtype + 1) << 8) | reportnum,
932	index: interface->desc.bInterfaceNumber, data: buf, size: count,
933	USB_CTRL_SET_TIMEOUT);
934	/* count also the report id, if this was a numbered report. */
935	if (ret > 0 && skipped_report_id)
936	ret++;
937
938	return ret;
939	}
940
941	static int usbhid_output_report(struct hid_device *hid, __u8 *buf, size_t count)
942	{
943	struct usbhid_device *usbhid = hid->driver_data;
944	struct usb_device *dev = hid_to_usb_dev(hid);
945	int actual_length, skipped_report_id = 0, ret;
946
947	if (!usbhid->urbout)
948	return -ENOSYS;
949
950	if (buf[0] == 0x0) {
951	/* Don't send the Report ID */
952	buf++;
953	count--;
954	skipped_report_id = 1;
955	}
956
957	ret = usb_interrupt_msg(usb_dev: dev, pipe: usbhid->urbout->pipe,
958	data: buf, len: count, actual_length: &actual_length,
959	USB_CTRL_SET_TIMEOUT);
960	/* return the number of bytes transferred */
961	if (ret == 0) {
962	ret = actual_length;
963	/* count also the report id */
964	if (skipped_report_id)
965	ret++;
966	}
967
968	return ret;
969	}
970
971	static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid)
972	{
973	struct usbhid_device *usbhid = hid->driver_data;
974
975	usb_free_coherent(dev, size: usbhid->bufsize, addr: usbhid->inbuf, dma: usbhid->inbuf_dma);
976	usb_free_coherent(dev, size: usbhid->bufsize, addr: usbhid->outbuf, dma: usbhid->outbuf_dma);
977	kfree(objp: usbhid->cr);
978	usb_free_coherent(dev, size: usbhid->bufsize, addr: usbhid->ctrlbuf, dma: usbhid->ctrlbuf_dma);
979	}
980
981	static int usbhid_parse(struct hid_device *hid)
982	{
983	struct usb_interface *intf = to_usb_interface(hid->dev.parent);
984	struct usb_host_interface *interface = intf->cur_altsetting;
985	struct usb_device *dev = interface_to_usbdev (intf);
986	struct hid_descriptor *hdesc;
987	struct hid_class_descriptor *hcdesc;
988	__u8 fixed_opt_descriptors_size;
989	u32 quirks = 0;
990	unsigned int rsize = 0;
991	char *rdesc;
992	int ret;
993
994	quirks = hid_lookup_quirk(hdev: hid);
995
996	if (quirks & HID_QUIRK_IGNORE)
997	return -ENODEV;
998
999	/* Many keyboards and mice don't like to be polled for reports,
1000	* so we will always set the HID_QUIRK_NOGET flag for them. */
1001	if (interface->desc.bInterfaceSubClass == USB_INTERFACE_SUBCLASS_BOOT) {
1002	if (interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_KEYBOARD ||
1003	interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_MOUSE)
1004	quirks |= HID_QUIRK_NOGET;
1005	}
1006
1007	if (usb_get_extra_descriptor(interface, HID_DT_HID, &hdesc) &&
1008	(!interface->desc.bNumEndpoints ||
1009	usb_get_extra_descriptor(&interface->endpoint[0], HID_DT_HID, &hdesc))) {
1010	dbg_hid("class descriptor not present\n");
1011	return -ENODEV;
1012	}
1013
1014	if (!hdesc->bNumDescriptors ||
1015	hdesc->bLength != sizeof(*hdesc) +
1016	(hdesc->bNumDescriptors - 1) * sizeof(*hcdesc)) {
1017	dbg_hid("hid descriptor invalid, bLen=%hhu bNum=%hhu\n",
1018	hdesc->bLength, hdesc->bNumDescriptors);
1019
1020	/*
1021	* Some devices may expose a wrong number of descriptors compared
1022	* to the provided length.
1023	* However, we ignore the optional hid class descriptors entirely
1024	* so we can safely recompute the proper field.
1025	*/
1026	if (hdesc->bLength >= sizeof(*hdesc)) {
1027	fixed_opt_descriptors_size = hdesc->bLength - sizeof(*hdesc);
1028
1029	hid_warn(intf, "fixing wrong optional hid class descriptors count\n");
1030	hdesc->bNumDescriptors = fixed_opt_descriptors_size / sizeof(*hcdesc) + 1;
1031	} else {
1032	return -EINVAL;
1033	}
1034	}
1035
1036	hid->version = le16_to_cpu(hdesc->bcdHID);
1037	hid->country = hdesc->bCountryCode;
1038
1039	if (hdesc->rpt_desc.bDescriptorType == HID_DT_REPORT)
1040	rsize = le16_to_cpu(hdesc->rpt_desc.wDescriptorLength);
1041
1042	if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) {
1043	dbg_hid("weird size of report descriptor (%u)\n", rsize);
1044	return -EINVAL;
1045	}
1046
1047	rdesc = kmalloc(rsize, GFP_KERNEL);
1048	if (!rdesc)
1049	return -ENOMEM;
1050
1051	hid_set_idle(dev, ifnum: interface->desc.bInterfaceNumber, report: 0, idle: 0);
1052
1053	ret = hid_get_class_descriptor(dev, ifnum: interface->desc.bInterfaceNumber,
1054	HID_DT_REPORT, buf: rdesc, size: rsize);
1055	if (ret < 0) {
1056	dbg_hid("reading report descriptor failed\n");
1057	kfree(objp: rdesc);
1058	goto err;
1059	}
1060
1061	ret = hid_parse_report(hid, start: rdesc, size: rsize);
1062	kfree(objp: rdesc);
1063	if (ret) {
1064	dbg_hid("parsing report descriptor failed\n");
1065	goto err;
1066	}
1067
1068	if (hdesc->bNumDescriptors > 1)
1069	hid_warn(intf,
1070	"%u unsupported optional hid class descriptors\n",
1071	(int)(hdesc->bNumDescriptors - 1));
1072
1073	hid->quirks |= quirks;
1074
1075	return 0;
1076	err:
1077	return ret;
1078	}
1079
1080	static int usbhid_start(struct hid_device *hid)
1081	{
1082	struct usb_interface *intf = to_usb_interface(hid->dev.parent);
1083	struct usb_host_interface *interface = intf->cur_altsetting;
1084	struct usb_device *dev = interface_to_usbdev(intf);
1085	struct usbhid_device *usbhid = hid->driver_data;
1086	unsigned int n, insize = 0;
1087	int ret;
1088
1089	mutex_lock(&usbhid->mutex);
1090
1091	clear_bit(HID_DISCONNECTED, addr: &usbhid->iofl);
1092
1093	usbhid->bufsize = HID_MIN_BUFFER_SIZE;
1094	hid_find_max_report(hid, type: HID_INPUT_REPORT, max: &usbhid->bufsize);
1095	hid_find_max_report(hid, type: HID_OUTPUT_REPORT, max: &usbhid->bufsize);
1096	hid_find_max_report(hid, type: HID_FEATURE_REPORT, max: &usbhid->bufsize);
1097
1098	if (usbhid->bufsize > HID_MAX_BUFFER_SIZE)
1099	usbhid->bufsize = HID_MAX_BUFFER_SIZE;
1100
1101	hid_find_max_report(hid, type: HID_INPUT_REPORT, max: &insize);
1102
1103	if (insize > HID_MAX_BUFFER_SIZE)
1104	insize = HID_MAX_BUFFER_SIZE;
1105
1106	if (hid_alloc_buffers(dev, hid)) {
1107	ret = -ENOMEM;
1108	goto fail;
1109	}
1110
1111	for (n = 0; n < interface->desc.bNumEndpoints; n++) {
1112	struct usb_endpoint_descriptor *endpoint;
1113	int pipe;
1114	int interval;
1115
1116	endpoint = &interface->endpoint[n].desc;
1117	if (!usb_endpoint_xfer_int(epd: endpoint))
1118	continue;
1119
1120	interval = endpoint->bInterval;
1121
1122	/* Some vendors give fullspeed interval on highspeed devices */
1123	if (hid->quirks & HID_QUIRK_FULLSPEED_INTERVAL &&
1124	dev->speed == USB_SPEED_HIGH) {
1125	interval = fls(x: endpoint->bInterval*8);
1126	pr_info("%s: Fixing fullspeed to highspeed interval: %d -> %d\n",
1127	hid->name, endpoint->bInterval, interval);
1128	}
1129
1130	/* Change the polling interval of mice, joysticks
1131	* and keyboards.
1132	*/
1133	switch (hid->collection->usage) {
1134	case HID_GD_MOUSE:
1135	if (hid_mousepoll_interval > 0)
1136	interval = hid_mousepoll_interval;
1137	break;
1138	case HID_GD_JOYSTICK:
1139	if (hid_jspoll_interval > 0)
1140	interval = hid_jspoll_interval;
1141	break;
1142	case HID_GD_KEYBOARD:
1143	if (hid_kbpoll_interval > 0)
1144	interval = hid_kbpoll_interval;
1145	break;
1146	}
1147
1148	ret = -ENOMEM;
1149	if (usb_endpoint_dir_in(epd: endpoint)) {
1150	if (usbhid->urbin)
1151	continue;
1152	if (!(usbhid->urbin = usb_alloc_urb(iso_packets: 0, GFP_KERNEL)))
1153	goto fail;
1154	pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
1155	usb_fill_int_urb(urb: usbhid->urbin, dev, pipe, transfer_buffer: usbhid->inbuf, buffer_length: insize,
1156	complete_fn: hid_irq_in, context: hid, interval);
1157	usbhid->urbin->transfer_dma = usbhid->inbuf_dma;
1158	usbhid->urbin->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1159	} else {
1160	if (usbhid->urbout)
1161	continue;
1162	if (!(usbhid->urbout = usb_alloc_urb(iso_packets: 0, GFP_KERNEL)))
1163	goto fail;
1164	pipe = usb_sndintpipe(dev, endpoint->bEndpointAddress);
1165	usb_fill_int_urb(urb: usbhid->urbout, dev, pipe, transfer_buffer: usbhid->outbuf, buffer_length: 0,
1166	complete_fn: hid_irq_out, context: hid, interval);
1167	usbhid->urbout->transfer_dma = usbhid->outbuf_dma;
1168	usbhid->urbout->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1169	}
1170	}
1171
1172	usbhid->urbctrl = usb_alloc_urb(iso_packets: 0, GFP_KERNEL);
1173	if (!usbhid->urbctrl) {
1174	ret = -ENOMEM;
1175	goto fail;
1176	}
1177
1178	usb_fill_control_urb(urb: usbhid->urbctrl, dev, pipe: 0, setup_packet: (void *) usbhid->cr,
1179	transfer_buffer: usbhid->ctrlbuf, buffer_length: 1, complete_fn: hid_ctrl, context: hid);
1180	usbhid->urbctrl->transfer_dma = usbhid->ctrlbuf_dma;
1181	usbhid->urbctrl->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1182
1183	set_bit(HID_STARTED, addr: &usbhid->iofl);
1184
1185	if (hid->quirks & HID_QUIRK_ALWAYS_POLL) {
1186	ret = usb_autopm_get_interface(intf: usbhid->intf);
1187	if (ret)
1188	goto fail;
1189	set_bit(HID_IN_POLLING, addr: &usbhid->iofl);
1190	usbhid->intf->needs_remote_wakeup = 1;
1191	ret = hid_start_in(hid);
1192	if (ret) {
1193	dev_err(&hid->dev,
1194	"failed to start in urb: %d\n", ret);
1195	}
1196	usb_autopm_put_interface(intf: usbhid->intf);
1197	}
1198
1199	/* Some keyboards don't work until their LEDs have been set.
1200	* Since BIOSes do set the LEDs, it must be safe for any device
1201	* that supports the keyboard boot protocol.
1202	* In addition, enable remote wakeup by default for all keyboard
1203	* devices supporting the boot protocol.
1204	*/
1205	if (interface->desc.bInterfaceSubClass == USB_INTERFACE_SUBCLASS_BOOT &&
1206	interface->desc.bInterfaceProtocol ==
1207	USB_INTERFACE_PROTOCOL_KEYBOARD) {
1208	usbhid_set_leds(hid);
1209	device_set_wakeup_enable(dev: &dev->dev, enable: 1);
1210	}
1211
1212	mutex_unlock(lock: &usbhid->mutex);
1213	return 0;
1214
1215	fail:
1216	usb_free_urb(urb: usbhid->urbin);
1217	usb_free_urb(urb: usbhid->urbout);
1218	usb_free_urb(urb: usbhid->urbctrl);
1219	usbhid->urbin = NULL;
1220	usbhid->urbout = NULL;
1221	usbhid->urbctrl = NULL;
1222	hid_free_buffers(dev, hid);
1223	mutex_unlock(lock: &usbhid->mutex);
1224	return ret;
1225	}
1226
1227	static void usbhid_stop(struct hid_device *hid)
1228	{
1229	struct usbhid_device *usbhid = hid->driver_data;
1230
1231	if (WARN_ON(!usbhid))
1232	return;
1233
1234	if (hid->quirks & HID_QUIRK_ALWAYS_POLL) {
1235	clear_bit(HID_IN_POLLING, addr: &usbhid->iofl);
1236	usbhid->intf->needs_remote_wakeup = 0;
1237	}
1238
1239	mutex_lock(&usbhid->mutex);
1240
1241	clear_bit(HID_STARTED, addr: &usbhid->iofl);
1242
1243	spin_lock_irq(lock: &usbhid->lock); /* Sync with error and led handlers */
1244	set_bit(HID_DISCONNECTED, addr: &usbhid->iofl);
1245	while (usbhid->ctrltail != usbhid->ctrlhead) {
1246	if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_OUT) {
1247	kfree(objp: usbhid->ctrl[usbhid->ctrltail].raw_report);
1248	usbhid->ctrl[usbhid->ctrltail].raw_report = NULL;
1249	}
1250
1251	usbhid->ctrltail = (usbhid->ctrltail + 1) &
1252	(HID_CONTROL_FIFO_SIZE - 1);
1253	}
1254	spin_unlock_irq(lock: &usbhid->lock);
1255
1256	usb_kill_urb(urb: usbhid->urbin);
1257	usb_kill_urb(urb: usbhid->urbout);
1258	usb_kill_urb(urb: usbhid->urbctrl);
1259
1260	hid_cancel_delayed_stuff(usbhid);
1261
1262	hid->claimed = 0;
1263
1264	usb_free_urb(urb: usbhid->urbin);
1265	usb_free_urb(urb: usbhid->urbctrl);
1266	usb_free_urb(urb: usbhid->urbout);
1267	usbhid->urbin = NULL; /* don't mess up next start */
1268	usbhid->urbctrl = NULL;
1269	usbhid->urbout = NULL;
1270
1271	hid_free_buffers(hid_to_usb_dev(hid), hid);
1272
1273	mutex_unlock(lock: &usbhid->mutex);
1274	}
1275
1276	static int usbhid_power(struct hid_device *hid, int lvl)
1277	{
1278	struct usbhid_device *usbhid = hid->driver_data;
1279	int r = 0;
1280
1281	switch (lvl) {
1282	case PM_HINT_FULLON:
1283	r = usb_autopm_get_interface(intf: usbhid->intf);
1284	break;
1285
1286	case PM_HINT_NORMAL:
1287	usb_autopm_put_interface(intf: usbhid->intf);
1288	break;
1289	}
1290
1291	return r;
1292	}
1293
1294	static void usbhid_request(struct hid_device *hid, struct hid_report *rep, int reqtype)
1295	{
1296	switch (reqtype) {
1297	case HID_REQ_GET_REPORT:
1298	usbhid_submit_report(hid, report: rep, USB_DIR_IN);
1299	break;
1300	case HID_REQ_SET_REPORT:
1301	usbhid_submit_report(hid, report: rep, USB_DIR_OUT);
1302	break;
1303	}
1304	}
1305
1306	static int usbhid_raw_request(struct hid_device *hid, unsigned char reportnum,
1307	__u8 *buf, size_t len, unsigned char rtype,
1308	int reqtype)
1309	{
1310	switch (reqtype) {
1311	case HID_REQ_GET_REPORT:
1312	return usbhid_get_raw_report(hid, report_number: reportnum, buf, count: len, report_type: rtype);
1313	case HID_REQ_SET_REPORT:
1314	return usbhid_set_raw_report(hid, reportnum, buf, count: len, rtype);
1315	default:
1316	return -EIO;
1317	}
1318	}
1319
1320	static int usbhid_idle(struct hid_device *hid, int report, int idle,
1321	int reqtype)
1322	{
1323	struct usb_device *dev = hid_to_usb_dev(hid);
1324	struct usb_interface *intf = to_usb_interface(hid->dev.parent);
1325	struct usb_host_interface *interface = intf->cur_altsetting;
1326	int ifnum = interface->desc.bInterfaceNumber;
1327
1328	if (reqtype != HID_REQ_SET_IDLE)
1329	return -EINVAL;
1330
1331	return hid_set_idle(dev, ifnum, report, idle);
1332	}
1333
1334	static bool usbhid_may_wakeup(struct hid_device *hid)
1335	{
1336	struct usb_device *dev = hid_to_usb_dev(hid);
1337
1338	return device_may_wakeup(dev: &dev->dev);
1339	}
1340
1341	static const struct hid_ll_driver usb_hid_driver = {
1342	.parse = usbhid_parse,
1343	.start = usbhid_start,
1344	.stop = usbhid_stop,
1345	.open = usbhid_open,
1346	.close = usbhid_close,
1347	.power = usbhid_power,
1348	.request = usbhid_request,
1349	.wait = usbhid_wait_io,
1350	.raw_request = usbhid_raw_request,
1351	.output_report = usbhid_output_report,
1352	.idle = usbhid_idle,
1353	.may_wakeup = usbhid_may_wakeup,
1354	};
1355
1356	bool hid_is_usb(const struct hid_device *hdev)
1357	{
1358	return hdev->ll_driver == &usb_hid_driver;
1359	}
1360	EXPORT_SYMBOL_GPL(hid_is_usb);
1361
1362	static int usbhid_probe(struct usb_interface *intf, const struct usb_device_id *id)
1363	{
1364	struct usb_host_interface *interface = intf->cur_altsetting;
1365	struct usb_device *dev = interface_to_usbdev(intf);
1366	struct usbhid_device *usbhid;
1367	struct hid_device *hid;
1368	unsigned int n, has_in = 0;
1369	size_t len;
1370	int ret;
1371
1372	dbg_hid("HID probe called for ifnum %d\n",
1373	intf->altsetting->desc.bInterfaceNumber);
1374
1375	for (n = 0; n < interface->desc.bNumEndpoints; n++)
1376	if (usb_endpoint_is_int_in(epd: &interface->endpoint[n].desc))
1377	has_in++;
1378	if (!has_in) {
1379	hid_err(intf, "couldn't find an input interrupt endpoint\n");
1380	return -ENODEV;
1381	}
1382
1383	hid = hid_allocate_device();
1384	if (IS_ERR(ptr: hid))
1385	return PTR_ERR(ptr: hid);
1386
1387	usb_set_intfdata(intf, data: hid);
1388	hid->ll_driver = &usb_hid_driver;
1389	hid->ff_init = hid_pidff_init;
1390	#ifdef CONFIG_USB_HIDDEV
1391	hid->hiddev_connect = hiddev_connect;
1392	hid->hiddev_disconnect = hiddev_disconnect;
1393	hid->hiddev_hid_event = hiddev_hid_event;
1394	hid->hiddev_report_event = hiddev_report_event;
1395	#endif
1396	hid->dev.parent = &intf->dev;
1397	device_set_node(dev: &hid->dev, dev_fwnode(&intf->dev));
1398	hid->bus = BUS_USB;
1399	hid->vendor = le16_to_cpu(dev->descriptor.idVendor);
1400	hid->product = le16_to_cpu(dev->descriptor.idProduct);
1401	hid->version = le16_to_cpu(dev->descriptor.bcdDevice);
1402	hid->name[0] = 0;
1403	if (intf->cur_altsetting->desc.bInterfaceProtocol ==
1404	USB_INTERFACE_PROTOCOL_MOUSE)
1405	hid->type = HID_TYPE_USBMOUSE;
1406	else if (intf->cur_altsetting->desc.bInterfaceProtocol == 0)
1407	hid->type = HID_TYPE_USBNONE;
1408
1409	if (dev->manufacturer)
1410	strscpy(hid->name, dev->manufacturer, sizeof(hid->name));
1411
1412	if (dev->product) {
1413	if (dev->manufacturer)
1414	strlcat(p: hid->name, q: " ", avail: sizeof(hid->name));
1415	strlcat(p: hid->name, q: dev->product, avail: sizeof(hid->name));
1416	}
1417
1418	if (!strlen(hid->name))
1419	snprintf(buf: hid->name, size: sizeof(hid->name), fmt: "HID %04x:%04x",
1420	le16_to_cpu(dev->descriptor.idVendor),
1421	le16_to_cpu(dev->descriptor.idProduct));
1422
1423	usb_make_path(dev, buf: hid->phys, size: sizeof(hid->phys));
1424	strlcat(p: hid->phys, q: "/input", avail: sizeof(hid->phys));
1425	len = strlen(hid->phys);
1426	if (len < sizeof(hid->phys) - 1)
1427	snprintf(buf: hid->phys + len, size: sizeof(hid->phys) - len,
1428	fmt: "%d", intf->altsetting[0].desc.bInterfaceNumber);
1429
1430	if (usb_string(dev, index: dev->descriptor.iSerialNumber, buf: hid->uniq, size: 64) <= 0)
1431	hid->uniq[0] = 0;
1432
1433	usbhid = kzalloc(sizeof(*usbhid), GFP_KERNEL);
1434	if (usbhid == NULL) {
1435	ret = -ENOMEM;
1436	goto err;
1437	}
1438
1439	hid->driver_data = usbhid;
1440	usbhid->hid = hid;
1441	usbhid->intf = intf;
1442	usbhid->ifnum = interface->desc.bInterfaceNumber;
1443
1444	init_waitqueue_head(&usbhid->wait);
1445	INIT_WORK(&usbhid->reset_work, hid_reset);
1446	timer_setup(&usbhid->io_retry, hid_retry_timeout, 0);
1447	spin_lock_init(&usbhid->lock);
1448	mutex_init(&usbhid->mutex);
1449
1450	ret = hid_add_device(hid);
1451	if (ret) {
1452	if (ret != -ENODEV)
1453	hid_err(intf, "can't add hid device: %d\n", ret);
1454	goto err_free;
1455	}
1456
1457	return 0;
1458	err_free:
1459	kfree(objp: usbhid);
1460	err:
1461	hid_destroy_device(hid);
1462	return ret;
1463	}
1464
1465	static void usbhid_disconnect(struct usb_interface *intf)
1466	{
1467	struct hid_device *hid = usb_get_intfdata(intf);
1468	struct usbhid_device *usbhid;
1469
1470	if (WARN_ON(!hid))
1471	return;
1472
1473	usbhid = hid->driver_data;
1474	spin_lock_irq(lock: &usbhid->lock); /* Sync with error and led handlers */
1475	set_bit(HID_DISCONNECTED, addr: &usbhid->iofl);
1476	spin_unlock_irq(lock: &usbhid->lock);
1477	hid_destroy_device(hid);
1478	kfree(objp: usbhid);
1479	}
1480
1481	static void hid_cancel_delayed_stuff(struct usbhid_device *usbhid)
1482	{
1483	timer_delete_sync(timer: &usbhid->io_retry);
1484	cancel_work_sync(work: &usbhid->reset_work);
1485	}
1486
1487	static void hid_cease_io(struct usbhid_device *usbhid)
1488	{
1489	timer_delete_sync(timer: &usbhid->io_retry);
1490	usb_kill_urb(urb: usbhid->urbin);
1491	usb_kill_urb(urb: usbhid->urbctrl);
1492	usb_kill_urb(urb: usbhid->urbout);
1493	}
1494
1495	static void hid_restart_io(struct hid_device *hid)
1496	{
1497	struct usbhid_device *usbhid = hid->driver_data;
1498	int clear_halt = test_bit(HID_CLEAR_HALT, &usbhid->iofl);
1499	int reset_pending = test_bit(HID_RESET_PENDING, &usbhid->iofl);
1500
1501	spin_lock_irq(lock: &usbhid->lock);
1502	clear_bit(HID_SUSPENDED, addr: &usbhid->iofl);
1503	usbhid_mark_busy(usbhid);
1504
1505	if (clear_halt || reset_pending)
1506	schedule_work(work: &usbhid->reset_work);
1507	usbhid->retry_delay = 0;
1508	spin_unlock_irq(lock: &usbhid->lock);
1509
1510	if (reset_pending || !test_bit(HID_STARTED, &usbhid->iofl))
1511	return;
1512
1513	if (!clear_halt) {
1514	if (hid_start_in(hid) < 0)
1515	hid_io_error(hid);
1516	}
1517
1518	spin_lock_irq(lock: &usbhid->lock);
1519	if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl))
1520	usbhid_restart_out_queue(usbhid);
1521	if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
1522	usbhid_restart_ctrl_queue(usbhid);
1523	spin_unlock_irq(lock: &usbhid->lock);
1524	}
1525
1526	/* Treat USB reset pretty much the same as suspend/resume */
1527	static int hid_pre_reset(struct usb_interface *intf)
1528	{
1529	struct hid_device *hid = usb_get_intfdata(intf);
1530	struct usbhid_device *usbhid = hid->driver_data;
1531
1532	spin_lock_irq(lock: &usbhid->lock);
1533	set_bit(HID_RESET_PENDING, addr: &usbhid->iofl);
1534	spin_unlock_irq(lock: &usbhid->lock);
1535	hid_cease_io(usbhid);
1536
1537	return 0;
1538	}
1539
1540	/* Same routine used for post_reset and reset_resume */
1541	static int hid_post_reset(struct usb_interface *intf)
1542	{
1543	struct usb_device *dev = interface_to_usbdev (intf);
1544	struct hid_device *hid = usb_get_intfdata(intf);
1545	struct usbhid_device *usbhid = hid->driver_data;
1546	struct usb_host_interface *interface = intf->cur_altsetting;
1547	int status;
1548	char *rdesc;
1549
1550	/* Fetch and examine the HID report descriptor. If this
1551	* has changed, then rebind. Since usbcore's check of the
1552	* configuration descriptors passed, we already know that
1553	* the size of the HID report descriptor has not changed.
1554	*/
1555	rdesc = kmalloc(hid->dev_rsize, GFP_KERNEL);
1556	if (!rdesc)
1557	return -ENOMEM;
1558
1559	status = hid_get_class_descriptor(dev,
1560	ifnum: interface->desc.bInterfaceNumber,
1561	HID_DT_REPORT, buf: rdesc, size: hid->dev_rsize);
1562	if (status < 0) {
1563	dbg_hid("reading report descriptor failed (post_reset)\n");
1564	kfree(objp: rdesc);
1565	return status;
1566	}
1567	status = memcmp(p: rdesc, q: hid->dev_rdesc, size: hid->dev_rsize);
1568	kfree(objp: rdesc);
1569	if (status != 0) {
1570	dbg_hid("report descriptor changed\n");
1571	return -EPERM;
1572	}
1573
1574	/* No need to do another reset or clear a halted endpoint */
1575	spin_lock_irq(lock: &usbhid->lock);
1576	clear_bit(HID_RESET_PENDING, addr: &usbhid->iofl);
1577	clear_bit(HID_CLEAR_HALT, addr: &usbhid->iofl);
1578	spin_unlock_irq(lock: &usbhid->lock);
1579	hid_set_idle(dev, ifnum: intf->cur_altsetting->desc.bInterfaceNumber, report: 0, idle: 0);
1580
1581	hid_restart_io(hid);
1582
1583	return 0;
1584	}
1585
1586	static int hid_resume_common(struct hid_device *hid, bool driver_suspended)
1587	{
1588	int status = 0;
1589
1590	hid_restart_io(hid);
1591	if (driver_suspended)
1592	status = hid_driver_resume(hdev: hid);
1593	return status;
1594	}
1595
1596	static int hid_suspend(struct usb_interface *intf, pm_message_t message)
1597	{
1598	struct hid_device *hid = usb_get_intfdata(intf);
1599	struct usbhid_device *usbhid = hid->driver_data;
1600	int status = 0;
1601	bool driver_suspended = false;
1602	unsigned int ledcount;
1603
1604	if (PMSG_IS_AUTO(message)) {
1605	ledcount = hidinput_count_leds(hid);
1606	spin_lock_irq(lock: &usbhid->lock); /* Sync with error handler */
1607	if (!test_bit(HID_RESET_PENDING, &usbhid->iofl)
1608	&& !test_bit(HID_CLEAR_HALT, &usbhid->iofl)
1609	&& !test_bit(HID_OUT_RUNNING, &usbhid->iofl)
1610	&& !test_bit(HID_CTRL_RUNNING, &usbhid->iofl)
1611	&& !test_bit(HID_KEYS_PRESSED, &usbhid->iofl)
1612	&& (!ledcount || ignoreled))
1613	{
1614	set_bit(HID_SUSPENDED, addr: &usbhid->iofl);
1615	spin_unlock_irq(lock: &usbhid->lock);
1616	status = hid_driver_suspend(hdev: hid, state: message);
1617	if (status < 0)
1618	goto failed;
1619	driver_suspended = true;
1620	} else {
1621	usbhid_mark_busy(usbhid);
1622	spin_unlock_irq(lock: &usbhid->lock);
1623	return -EBUSY;
1624	}
1625
1626	} else {
1627	/* TODO: resume() might need to handle suspend failure */
1628	status = hid_driver_suspend(hdev: hid, state: message);
1629	driver_suspended = true;
1630	spin_lock_irq(lock: &usbhid->lock);
1631	set_bit(HID_SUSPENDED, addr: &usbhid->iofl);
1632	spin_unlock_irq(lock: &usbhid->lock);
1633	if (usbhid_wait_io(hid) < 0)
1634	status = -EIO;
1635	}
1636
1637	hid_cancel_delayed_stuff(usbhid);
1638	hid_cease_io(usbhid);
1639
1640	if (PMSG_IS_AUTO(message) && test_bit(HID_KEYS_PRESSED, &usbhid->iofl)) {
1641	/* lost race against keypresses */
1642	status = -EBUSY;
1643	goto failed;
1644	}
1645	dev_dbg(&intf->dev, "suspend\n");
1646	return status;
1647
1648	failed:
1649	hid_resume_common(hid, driver_suspended);
1650	return status;
1651	}
1652
1653	static int hid_resume(struct usb_interface *intf)
1654	{
1655	struct hid_device *hid = usb_get_intfdata (intf);
1656	int status;
1657
1658	status = hid_resume_common(hid, driver_suspended: true);
1659	dev_dbg(&intf->dev, "resume status %d\n", status);
1660	return 0;
1661	}
1662
1663	static int hid_reset_resume(struct usb_interface *intf)
1664	{
1665	struct hid_device *hid = usb_get_intfdata(intf);
1666	int status;
1667
1668	status = hid_post_reset(intf);
1669	if (status >= 0) {
1670	int ret = hid_driver_reset_resume(hdev: hid);
1671	if (ret < 0)
1672	status = ret;
1673	}
1674	return status;
1675	}
1676
1677	static const struct usb_device_id hid_usb_ids[] = {
1678	{ .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
1679	.bInterfaceClass = USB_INTERFACE_CLASS_HID },
1680	{ } /* Terminating entry */
1681	};
1682
1683	MODULE_DEVICE_TABLE (usb, hid_usb_ids);
1684
1685	static struct usb_driver hid_driver = {
1686	.name = "usbhid",
1687	.probe = usbhid_probe,
1688	.disconnect = usbhid_disconnect,
1689	.suspend = pm_ptr(hid_suspend),
1690	.resume = pm_ptr(hid_resume),
1691	.reset_resume = pm_ptr(hid_reset_resume),
1692	.pre_reset = hid_pre_reset,
1693	.post_reset = hid_post_reset,
1694	.id_table = hid_usb_ids,
1695	.supports_autosuspend = 1,
1696	};
1697
1698	struct usb_interface *usbhid_find_interface(int minor)
1699	{
1700	return usb_find_interface(drv: &hid_driver, minor);
1701	}
1702
1703	static int __init hid_init(void)
1704	{
1705	int retval;
1706
1707	retval = hid_quirks_init(quirks_param, BUS_USB, MAX_USBHID_BOOT_QUIRKS);
1708	if (retval)
1709	goto usbhid_quirks_init_fail;
1710	retval = usb_register(&hid_driver);
1711	if (retval)
1712	goto usb_register_fail;
1713	pr_info(KBUILD_MODNAME ": " DRIVER_DESC "\n");
1714
1715	return 0;
1716	usb_register_fail:
1717	hid_quirks_exit(BUS_USB);
1718	usbhid_quirks_init_fail:
1719	return retval;
1720	}
1721
1722	static void __exit hid_exit(void)
1723	{
1724	usb_deregister(&hid_driver);
1725	hid_quirks_exit(BUS_USB);
1726	}
1727
1728	module_init(hid_init);
1729	module_exit(hid_exit);
1730
1731	MODULE_AUTHOR("Andreas Gal");
1732	MODULE_AUTHOR("Vojtech Pavlik");
1733	MODULE_AUTHOR("Jiri Kosina");
1734	MODULE_DESCRIPTION(DRIVER_DESC);
1735	MODULE_LICENSE("GPL");
1736