]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/blob - sys/dev/usb/usb_hid.c
Fix USB HID descriptor parsing error.
[FreeBSD/FreeBSD.git] / sys / dev / usb / usb_hid.c
1 /* $FreeBSD$ */
2 /*      $NetBSD: hid.c,v 1.17 2001/11/13 06:24:53 lukem Exp $   */
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause-NetBSD
5  *
6  * Copyright (c) 1998 The NetBSD Foundation, Inc.
7  * All rights reserved.
8  *
9  * This code is derived from software contributed to The NetBSD Foundation
10  * by Lennart Augustsson (lennart@augustsson.net) at
11  * Carlstedt Research & Technology.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
23  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
24  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
25  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
26  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  */
34
35 #ifdef USB_GLOBAL_INCLUDE_FILE
36 #include USB_GLOBAL_INCLUDE_FILE
37 #else
38 #include <sys/stdint.h>
39 #include <sys/stddef.h>
40 #include <sys/param.h>
41 #include <sys/queue.h>
42 #include <sys/types.h>
43 #include <sys/systm.h>
44 #include <sys/kernel.h>
45 #include <sys/bus.h>
46 #include <sys/module.h>
47 #include <sys/lock.h>
48 #include <sys/mutex.h>
49 #include <sys/condvar.h>
50 #include <sys/sysctl.h>
51 #include <sys/sx.h>
52 #include <sys/unistd.h>
53 #include <sys/callout.h>
54 #include <sys/malloc.h>
55 #include <sys/priv.h>
56
57 #include <dev/usb/usb.h>
58 #include <dev/usb/usbdi.h>
59 #include <dev/usb/usbdi_util.h>
60 #include <dev/usb/usbhid.h>
61
62 #define USB_DEBUG_VAR usb_debug
63
64 #include <dev/usb/usb_core.h>
65 #include <dev/usb/usb_debug.h>
66 #include <dev/usb/usb_process.h>
67 #include <dev/usb/usb_device.h>
68 #include <dev/usb/usb_request.h>
69 #endif                  /* USB_GLOBAL_INCLUDE_FILE */
70
71 static void hid_clear_local(struct hid_item *);
72 static uint8_t hid_get_byte(struct hid_data *s, const uint16_t wSize);
73
74 #define MAXUSAGE 64
75 #define MAXPUSH 4
76 #define MAXID 16
77 #define MAXLOCCNT 1024
78
79 struct hid_pos_data {
80         int32_t rid;
81         uint32_t pos;
82 };
83
84 struct hid_data {
85         const uint8_t *start;
86         const uint8_t *end;
87         const uint8_t *p;
88         struct hid_item cur[MAXPUSH];
89         struct hid_pos_data last_pos[MAXID];
90         int32_t usages_min[MAXUSAGE];
91         int32_t usages_max[MAXUSAGE];
92         int32_t usage_last;     /* last seen usage */
93         uint32_t loc_size;      /* last seen size */
94         uint32_t loc_count;     /* last seen count */
95         uint32_t ncount;        /* end usage item count */
96         uint32_t icount;        /* current usage item count */
97         uint8_t kindset;        /* we have 5 kinds so 8 bits are enough */
98         uint8_t pushlevel;      /* current pushlevel */
99         uint8_t nusage;         /* end "usages_min/max" index */
100         uint8_t iusage;         /* current "usages_min/max" index */
101         uint8_t ousage;         /* current "usages_min/max" offset */
102         uint8_t susage;         /* usage set flags */
103 };
104
105 /*------------------------------------------------------------------------*
106  *      hid_clear_local
107  *------------------------------------------------------------------------*/
108 static void
109 hid_clear_local(struct hid_item *c)
110 {
111
112         c->loc.count = 0;
113         c->loc.size = 0;
114         c->usage = 0;
115         c->usage_minimum = 0;
116         c->usage_maximum = 0;
117         c->designator_index = 0;
118         c->designator_minimum = 0;
119         c->designator_maximum = 0;
120         c->string_index = 0;
121         c->string_minimum = 0;
122         c->string_maximum = 0;
123         c->set_delimiter = 0;
124 }
125
126 static void
127 hid_switch_rid(struct hid_data *s, struct hid_item *c, int32_t next_rID)
128 {
129         uint8_t i;
130
131         /* check for same report ID - optimise */
132
133         if (c->report_ID == next_rID)
134                 return;
135
136         /* save current position for current rID */
137
138         if (c->report_ID == 0) {
139                 i = 0;
140         } else {
141                 for (i = 1; i != MAXID; i++) {
142                         if (s->last_pos[i].rid == c->report_ID)
143                                 break;
144                         if (s->last_pos[i].rid == 0)
145                                 break;
146                 }
147         }
148         if (i != MAXID) {
149                 s->last_pos[i].rid = c->report_ID;
150                 s->last_pos[i].pos = c->loc.pos;
151         }
152
153         /* store next report ID */
154
155         c->report_ID = next_rID;
156
157         /* lookup last position for next rID */
158
159         if (next_rID == 0) {
160                 i = 0;
161         } else {
162                 for (i = 1; i != MAXID; i++) {
163                         if (s->last_pos[i].rid == next_rID)
164                                 break;
165                         if (s->last_pos[i].rid == 0)
166                                 break;
167                 }
168         }
169         if (i != MAXID) {
170                 s->last_pos[i].rid = next_rID;
171                 c->loc.pos = s->last_pos[i].pos;
172         } else {
173                 DPRINTF("Out of RID entries, position is set to zero!\n");
174                 c->loc.pos = 0;
175         }
176 }
177
178 /*------------------------------------------------------------------------*
179  *      hid_start_parse
180  *------------------------------------------------------------------------*/
181 struct hid_data *
182 hid_start_parse(const void *d, usb_size_t len, int kindset)
183 {
184         struct hid_data *s;
185
186         if ((kindset-1) & kindset) {
187                 DPRINTFN(0, "Only one bit can be "
188                     "set in the kindset\n");
189                 return (NULL);
190         }
191
192         s = malloc(sizeof *s, M_TEMP, M_WAITOK | M_ZERO);
193         s->start = s->p = d;
194         s->end = ((const uint8_t *)d) + len;
195         s->kindset = kindset;
196         return (s);
197 }
198
199 /*------------------------------------------------------------------------*
200  *      hid_end_parse
201  *------------------------------------------------------------------------*/
202 void
203 hid_end_parse(struct hid_data *s)
204 {
205         if (s == NULL)
206                 return;
207
208         free(s, M_TEMP);
209 }
210
211 /*------------------------------------------------------------------------*
212  *      get byte from HID descriptor
213  *------------------------------------------------------------------------*/
214 static uint8_t
215 hid_get_byte(struct hid_data *s, const uint16_t wSize)
216 {
217         const uint8_t *ptr;
218         uint8_t retval;
219
220         ptr = s->p;
221
222         /* check if end is reached */
223         if (ptr == s->end)
224                 return (0);
225
226         /* read out a byte */
227         retval = *ptr;
228
229         /* check if data pointer can be advanced by "wSize" bytes */
230         if ((s->end - ptr) < wSize)
231                 ptr = s->end;
232         else
233                 ptr += wSize;
234
235         /* update pointer */
236         s->p = ptr;
237
238         return (retval);
239 }
240
241 /*------------------------------------------------------------------------*
242  *      hid_get_item
243  *------------------------------------------------------------------------*/
244 int
245 hid_get_item(struct hid_data *s, struct hid_item *h)
246 {
247         struct hid_item *c;
248         unsigned int bTag, bType, bSize;
249         uint32_t oldpos;
250         int32_t mask;
251         int32_t dval;
252
253         if (s == NULL)
254                 return (0);
255
256         c = &s->cur[s->pushlevel];
257
258  top:
259         /* check if there is an array of items */
260         if (s->icount < s->ncount) {
261                 /* get current usage */
262                 if (s->iusage < s->nusage) {
263                         dval = s->usages_min[s->iusage] + s->ousage;
264                         c->usage = dval;
265                         s->usage_last = dval;
266                         if (dval == s->usages_max[s->iusage]) {
267                                 s->iusage ++;
268                                 s->ousage = 0;
269                         } else {
270                                 s->ousage ++;
271                         }
272                 } else {
273                         DPRINTFN(1, "Using last usage\n");
274                         dval = s->usage_last;
275                 }
276                 s->icount ++;
277                 /* 
278                  * Only copy HID item, increment position and return
279                  * if correct kindset!
280                  */
281                 if (s->kindset & (1 << c->kind)) {
282                         *h = *c;
283                         DPRINTFN(1, "%u,%u,%u\n", h->loc.pos,
284                             h->loc.size, h->loc.count);
285                         c->loc.pos += c->loc.size * c->loc.count;
286                         return (1);
287                 }
288         }
289
290         /* reset state variables */
291         s->icount = 0;
292         s->ncount = 0;
293         s->iusage = 0;
294         s->nusage = 0;
295         s->susage = 0;
296         s->ousage = 0;
297         hid_clear_local(c);
298
299         /* get next item */
300         while (s->p != s->end) {
301
302                 bSize = hid_get_byte(s, 1);
303                 if (bSize == 0xfe) {
304                         /* long item */
305                         bSize = hid_get_byte(s, 1);
306                         bSize |= hid_get_byte(s, 1) << 8;
307                         bTag = hid_get_byte(s, 1);
308                         bType = 0xff;   /* XXX what should it be */
309                 } else {
310                         /* short item */
311                         bTag = bSize >> 4;
312                         bType = (bSize >> 2) & 3;
313                         bSize &= 3;
314                         if (bSize == 3)
315                                 bSize = 4;
316                 }
317                 switch (bSize) {
318                 case 0:
319                         dval = 0;
320                         mask = 0;
321                         break;
322                 case 1:
323                         dval = (int8_t)hid_get_byte(s, 1);
324                         mask = 0xFF;
325                         break;
326                 case 2:
327                         dval = hid_get_byte(s, 1);
328                         dval |= hid_get_byte(s, 1) << 8;
329                         dval = (int16_t)dval;
330                         mask = 0xFFFF;
331                         break;
332                 case 4:
333                         dval = hid_get_byte(s, 1);
334                         dval |= hid_get_byte(s, 1) << 8;
335                         dval |= hid_get_byte(s, 1) << 16;
336                         dval |= hid_get_byte(s, 1) << 24;
337                         mask = 0xFFFFFFFF;
338                         break;
339                 default:
340                         dval = hid_get_byte(s, bSize);
341                         DPRINTFN(0, "bad length %u (data=0x%02x)\n",
342                             bSize, dval);
343                         continue;
344                 }
345
346                 switch (bType) {
347                 case 0:         /* Main */
348                         switch (bTag) {
349                         case 8: /* Input */
350                                 c->kind = hid_input;
351                 ret:
352                                 c->flags = dval;
353                                 c->loc.count = s->loc_count;
354                                 c->loc.size = s->loc_size;
355
356                                 if (c->flags & HIO_VARIABLE) {
357                                         /* range check usage count */
358                                         if (c->loc.count > MAXLOCCNT) {
359                                                 DPRINTFN(0, "Number of "
360                                                     "items(%u) truncated to %u\n",
361                                                     (unsigned)(c->loc.count),
362                                                     MAXLOCCNT);
363                                                 s->ncount = MAXLOCCNT;
364                                         } else
365                                                 s->ncount = c->loc.count;
366
367                                         /* 
368                                          * The "top" loop will return
369                                          * one and one item:
370                                          */
371                                         c->loc.count = 1;
372                                 } else {
373                                         s->ncount = 1;
374                                 }
375                                 goto top;
376
377                         case 9: /* Output */
378                                 c->kind = hid_output;
379                                 goto ret;
380                         case 10:        /* Collection */
381                                 c->kind = hid_collection;
382                                 c->collection = dval;
383                                 c->collevel++;
384                                 c->usage = s->usage_last;
385                                 *h = *c;
386                                 return (1);
387                         case 11:        /* Feature */
388                                 c->kind = hid_feature;
389                                 goto ret;
390                         case 12:        /* End collection */
391                                 c->kind = hid_endcollection;
392                                 if (c->collevel == 0) {
393                                         DPRINTFN(0, "invalid end collection\n");
394                                         return (0);
395                                 }
396                                 c->collevel--;
397                                 *h = *c;
398                                 return (1);
399                         default:
400                                 DPRINTFN(0, "Main bTag=%d\n", bTag);
401                                 break;
402                         }
403                         break;
404                 case 1:         /* Global */
405                         switch (bTag) {
406                         case 0:
407                                 c->_usage_page = dval << 16;
408                                 break;
409                         case 1:
410                                 c->logical_minimum = dval;
411                                 break;
412                         case 2:
413                                 c->logical_maximum = dval;
414                                 break;
415                         case 3:
416                                 c->physical_minimum = dval;
417                                 break;
418                         case 4:
419                                 c->physical_maximum = dval;
420                                 break;
421                         case 5:
422                                 c->unit_exponent = dval;
423                                 break;
424                         case 6:
425                                 c->unit = dval;
426                                 break;
427                         case 7:
428                                 /* mask because value is unsigned */
429                                 s->loc_size = dval & mask;
430                                 break;
431                         case 8:
432                                 hid_switch_rid(s, c, dval & mask);
433                                 break;
434                         case 9:
435                                 /* mask because value is unsigned */
436                                 s->loc_count = dval & mask;
437                                 break;
438                         case 10:        /* Push */
439                                 /* stop parsing, if invalid push level */
440                                 if ((s->pushlevel + 1) >= MAXPUSH) {
441                                         DPRINTFN(0, "Cannot push item @ %d\n", s->pushlevel);
442                                         return (0);
443                                 }
444                                 s->pushlevel ++;
445                                 s->cur[s->pushlevel] = *c;
446                                 /* store size and count */
447                                 c->loc.size = s->loc_size;
448                                 c->loc.count = s->loc_count;
449                                 /* update current item pointer */
450                                 c = &s->cur[s->pushlevel];
451                                 break;
452                         case 11:        /* Pop */
453                                 /* stop parsing, if invalid push level */
454                                 if (s->pushlevel == 0) {
455                                         DPRINTFN(0, "Cannot pop item @ 0\n");
456                                         return (0);
457                                 }
458                                 s->pushlevel --;
459                                 /* preserve position */
460                                 oldpos = c->loc.pos;
461                                 c = &s->cur[s->pushlevel];
462                                 /* restore size and count */
463                                 s->loc_size = c->loc.size;
464                                 s->loc_count = c->loc.count;
465                                 /* set default item location */
466                                 c->loc.pos = oldpos;
467                                 c->loc.size = 0;
468                                 c->loc.count = 0;
469                                 break;
470                         default:
471                                 DPRINTFN(0, "Global bTag=%d\n", bTag);
472                                 break;
473                         }
474                         break;
475                 case 2:         /* Local */
476                         switch (bTag) {
477                         case 0:
478                                 if (bSize != 4)
479                                         dval = (dval & mask) | c->_usage_page;
480
481                                 /* set last usage, in case of a collection */
482                                 s->usage_last = dval;
483
484                                 if (s->nusage < MAXUSAGE) {
485                                         s->usages_min[s->nusage] = dval;
486                                         s->usages_max[s->nusage] = dval;
487                                         s->nusage ++;
488                                 } else {
489                                         DPRINTFN(0, "max usage reached\n");
490                                 }
491
492                                 /* clear any pending usage sets */
493                                 s->susage = 0;
494                                 break;
495                         case 1:
496                                 s->susage |= 1;
497
498                                 if (bSize != 4)
499                                         dval = (dval & mask) | c->_usage_page;
500                                 c->usage_minimum = dval;
501
502                                 goto check_set;
503                         case 2:
504                                 s->susage |= 2;
505
506                                 if (bSize != 4)
507                                         dval = (dval & mask) | c->_usage_page;
508                                 c->usage_maximum = dval;
509
510                         check_set:
511                                 if (s->susage != 3)
512                                         break;
513
514                                 /* sanity check */
515                                 if ((s->nusage < MAXUSAGE) &&
516                                     (c->usage_minimum <= c->usage_maximum)) {
517                                         /* add usage range */
518                                         s->usages_min[s->nusage] = 
519                                             c->usage_minimum;
520                                         s->usages_max[s->nusage] = 
521                                             c->usage_maximum;
522                                         s->nusage ++;
523                                 } else {
524                                         DPRINTFN(0, "Usage set dropped\n");
525                                 }
526                                 s->susage = 0;
527                                 break;
528                         case 3:
529                                 c->designator_index = dval;
530                                 break;
531                         case 4:
532                                 c->designator_minimum = dval;
533                                 break;
534                         case 5:
535                                 c->designator_maximum = dval;
536                                 break;
537                         case 7:
538                                 c->string_index = dval;
539                                 break;
540                         case 8:
541                                 c->string_minimum = dval;
542                                 break;
543                         case 9:
544                                 c->string_maximum = dval;
545                                 break;
546                         case 10:
547                                 c->set_delimiter = dval;
548                                 break;
549                         default:
550                                 DPRINTFN(0, "Local bTag=%d\n", bTag);
551                                 break;
552                         }
553                         break;
554                 default:
555                         DPRINTFN(0, "default bType=%d\n", bType);
556                         break;
557                 }
558         }
559         return (0);
560 }
561
562 /*------------------------------------------------------------------------*
563  *      hid_report_size
564  *------------------------------------------------------------------------*/
565 int
566 hid_report_size(const void *buf, usb_size_t len, enum hid_kind k, uint8_t *id)
567 {
568         struct hid_data *d;
569         struct hid_item h;
570         uint32_t temp;
571         uint32_t hpos;
572         uint32_t lpos;
573         uint8_t any_id;
574
575         any_id = 0;
576         hpos = 0;
577         lpos = 0xFFFFFFFF;
578
579         for (d = hid_start_parse(buf, len, 1 << k); hid_get_item(d, &h);) {
580                 if (h.kind == k) {
581                         /* check for ID-byte presence */
582                         if ((h.report_ID != 0) && !any_id) {
583                                 if (id != NULL)
584                                         *id = h.report_ID;
585                                 any_id = 1;
586                         }
587                         /* compute minimum */
588                         if (lpos > h.loc.pos)
589                                 lpos = h.loc.pos;
590                         /* compute end position */
591                         temp = h.loc.pos + (h.loc.size * h.loc.count);
592                         /* compute maximum */
593                         if (hpos < temp)
594                                 hpos = temp;
595                 }
596         }
597         hid_end_parse(d);
598
599         /* safety check - can happen in case of currupt descriptors */
600         if (lpos > hpos)
601                 temp = 0;
602         else
603                 temp = hpos - lpos;
604
605         /* check for ID byte */
606         if (any_id)
607                 temp += 8;
608         else if (id != NULL)
609                 *id = 0;
610
611         /* return length in bytes rounded up */
612         return ((temp + 7) / 8);
613 }
614
615 /*------------------------------------------------------------------------*
616  *      hid_locate
617  *------------------------------------------------------------------------*/
618 int
619 hid_locate(const void *desc, usb_size_t size, int32_t u, enum hid_kind k,
620     uint8_t index, struct hid_location *loc, uint32_t *flags, uint8_t *id)
621 {
622         struct hid_data *d;
623         struct hid_item h;
624
625         for (d = hid_start_parse(desc, size, 1 << k); hid_get_item(d, &h);) {
626                 if (h.kind == k && !(h.flags & HIO_CONST) && h.usage == u) {
627                         if (index--)
628                                 continue;
629                         if (loc != NULL)
630                                 *loc = h.loc;
631                         if (flags != NULL)
632                                 *flags = h.flags;
633                         if (id != NULL)
634                                 *id = h.report_ID;
635                         hid_end_parse(d);
636                         return (1);
637                 }
638         }
639         if (loc != NULL)
640                 loc->size = 0;
641         if (flags != NULL)
642                 *flags = 0;
643         if (id != NULL)
644                 *id = 0;
645         hid_end_parse(d);
646         return (0);
647 }
648
649 /*------------------------------------------------------------------------*
650  *      hid_get_data
651  *------------------------------------------------------------------------*/
652 static uint32_t
653 hid_get_data_sub(const uint8_t *buf, usb_size_t len, struct hid_location *loc,
654     int is_signed)
655 {
656         uint32_t hpos = loc->pos;
657         uint32_t hsize = loc->size;
658         uint32_t data;
659         uint32_t rpos;
660         uint8_t n;
661
662         DPRINTFN(11, "hid_get_data: loc %d/%d\n", hpos, hsize);
663
664         /* Range check and limit */
665         if (hsize == 0)
666                 return (0);
667         if (hsize > 32)
668                 hsize = 32;
669
670         /* Get data in a safe way */    
671         data = 0;
672         rpos = (hpos / 8);
673         n = (hsize + 7) / 8;
674         rpos += n;
675         while (n--) {
676                 rpos--;
677                 if (rpos < len)
678                         data |= buf[rpos] << (8 * n);
679         }
680
681         /* Correctly shift down data */
682         data = (data >> (hpos % 8));
683         n = 32 - hsize;
684
685         /* Mask and sign extend in one */
686         if (is_signed != 0)
687                 data = (int32_t)((int32_t)data << n) >> n;
688         else
689                 data = (uint32_t)((uint32_t)data << n) >> n;
690
691         DPRINTFN(11, "hid_get_data: loc %d/%d = %lu\n",
692             loc->pos, loc->size, (long)data);
693         return (data);
694 }
695
696 int32_t
697 hid_get_data(const uint8_t *buf, usb_size_t len, struct hid_location *loc)
698 {
699         return (hid_get_data_sub(buf, len, loc, 1));
700 }
701
702 uint32_t
703 hid_get_data_unsigned(const uint8_t *buf, usb_size_t len, struct hid_location *loc)
704 {
705         return (hid_get_data_sub(buf, len, loc, 0));
706 }
707
708 /*------------------------------------------------------------------------*
709  *      hid_put_data
710  *------------------------------------------------------------------------*/
711 void
712 hid_put_data_unsigned(uint8_t *buf, usb_size_t len,
713     struct hid_location *loc, unsigned int value)
714 {
715         uint32_t hpos = loc->pos;
716         uint32_t hsize = loc->size;
717         uint64_t data;
718         uint64_t mask;
719         uint32_t rpos;
720         uint8_t n;
721
722         DPRINTFN(11, "hid_put_data: loc %d/%d = %u\n", hpos, hsize, value);
723
724         /* Range check and limit */
725         if (hsize == 0)
726                 return;
727         if (hsize > 32)
728                 hsize = 32;
729
730         /* Put data in a safe way */    
731         rpos = (hpos / 8);
732         n = (hsize + 7) / 8;
733         data = ((uint64_t)value) << (hpos % 8);
734         mask = ((1ULL << hsize) - 1ULL) << (hpos % 8);
735         rpos += n;
736         while (n--) {
737                 rpos--;
738                 if (rpos < len) {
739                         buf[rpos] &= ~(mask >> (8 * n));
740                         buf[rpos] |= (data >> (8 * n));
741                 }
742         }
743 }
744
745 /*------------------------------------------------------------------------*
746  *      hid_is_collection
747  *------------------------------------------------------------------------*/
748 int
749 hid_is_collection(const void *desc, usb_size_t size, int32_t usage)
750 {
751         struct hid_data *hd;
752         struct hid_item hi;
753         int err;
754
755         hd = hid_start_parse(desc, size, hid_input);
756         if (hd == NULL)
757                 return (0);
758
759         while ((err = hid_get_item(hd, &hi))) {
760                  if (hi.kind == hid_collection &&
761                      hi.usage == usage)
762                         break;
763         }
764         hid_end_parse(hd);
765         return (err);
766 }
767
768 /*------------------------------------------------------------------------*
769  *      hid_get_descriptor_from_usb
770  *
771  * This function will search for a HID descriptor between two USB
772  * interface descriptors.
773  *
774  * Return values:
775  * NULL: No more HID descriptors.
776  * Else: Pointer to HID descriptor.
777  *------------------------------------------------------------------------*/
778 struct usb_hid_descriptor *
779 hid_get_descriptor_from_usb(struct usb_config_descriptor *cd,
780     struct usb_interface_descriptor *id)
781 {
782         struct usb_descriptor *desc = (void *)id;
783
784         if (desc == NULL) {
785                 return (NULL);
786         }
787         while ((desc = usb_desc_foreach(cd, desc))) {
788                 if ((desc->bDescriptorType == UDESC_HID) &&
789                     (desc->bLength >= USB_HID_DESCRIPTOR_SIZE(0))) {
790                         return (void *)desc;
791                 }
792                 if (desc->bDescriptorType == UDESC_INTERFACE) {
793                         break;
794                 }
795         }
796         return (NULL);
797 }
798
799 /*------------------------------------------------------------------------*
800  *      usbd_req_get_hid_desc
801  *
802  * This function will read out an USB report descriptor from the USB
803  * device.
804  *
805  * Return values:
806  * NULL: Failure.
807  * Else: Success. The pointer should eventually be passed to free().
808  *------------------------------------------------------------------------*/
809 usb_error_t
810 usbd_req_get_hid_desc(struct usb_device *udev, struct mtx *mtx,
811     void **descp, uint16_t *sizep,
812     struct malloc_type *mem, uint8_t iface_index)
813 {
814         struct usb_interface *iface = usbd_get_iface(udev, iface_index);
815         struct usb_hid_descriptor *hid;
816         usb_error_t err;
817
818         if ((iface == NULL) || (iface->idesc == NULL)) {
819                 return (USB_ERR_INVAL);
820         }
821         hid = hid_get_descriptor_from_usb
822             (usbd_get_config_descriptor(udev), iface->idesc);
823
824         if (hid == NULL) {
825                 return (USB_ERR_IOERROR);
826         }
827         *sizep = UGETW(hid->descrs[0].wDescriptorLength);
828         if (*sizep == 0) {
829                 return (USB_ERR_IOERROR);
830         }
831         if (mtx)
832                 mtx_unlock(mtx);
833
834         *descp = malloc(*sizep, mem, M_ZERO | M_WAITOK);
835
836         if (mtx)
837                 mtx_lock(mtx);
838
839         if (*descp == NULL) {
840                 return (USB_ERR_NOMEM);
841         }
842         err = usbd_req_get_report_descriptor
843             (udev, mtx, *descp, *sizep, iface_index);
844
845         if (err) {
846                 free(*descp, mem);
847                 *descp = NULL;
848                 return (err);
849         }
850         return (USB_ERR_NORMAL_COMPLETION);
851 }
852
853 /*------------------------------------------------------------------------*
854  * calculate HID item resolution. unit/mm for distances, unit/rad for angles
855  *------------------------------------------------------------------------*/
856 int32_t
857 hid_item_resolution(struct hid_item *hi)
858 {
859         /*
860          * hid unit scaling table according to HID Usage Table Review
861          * Request 39 Tbl 17 http://www.usb.org/developers/hidpage/HUTRR39b.pdf
862          */
863         static const int64_t scale[0x10][2] = {
864             [0x00] = { 1, 1 },
865             [0x01] = { 1, 10 },
866             [0x02] = { 1, 100 },
867             [0x03] = { 1, 1000 },
868             [0x04] = { 1, 10000 },
869             [0x05] = { 1, 100000 },
870             [0x06] = { 1, 1000000 },
871             [0x07] = { 1, 10000000 },
872             [0x08] = { 100000000, 1 },
873             [0x09] = { 10000000, 1 },
874             [0x0A] = { 1000000, 1 },
875             [0x0B] = { 100000, 1 },
876             [0x0C] = { 10000, 1 },
877             [0x0D] = { 1000, 1 },
878             [0x0E] = { 100, 1 },
879             [0x0F] = { 10, 1 },
880         };
881         int64_t logical_size;
882         int64_t physical_size;
883         int64_t multiplier;
884         int64_t divisor;
885         int64_t resolution;
886
887         switch (hi->unit) {
888         case HUM_CENTIMETER:
889                 multiplier = 1;
890                 divisor = 10;
891                 break;
892         case HUM_INCH:
893                 multiplier = 10;
894                 divisor = 254;
895                 break;
896         case HUM_RADIAN:
897                 multiplier = 1;
898                 divisor = 1;
899                 break;
900         case HUM_DEGREE:
901                 multiplier = 573;
902                 divisor = 10;
903                 break;
904         default:
905                 return (0);
906         }
907
908         if ((hi->logical_maximum <= hi->logical_minimum) ||
909             (hi->physical_maximum <= hi->physical_minimum) ||
910             (hi->unit_exponent < 0) || (hi->unit_exponent >= nitems(scale)))
911                 return (0);
912
913         logical_size = (int64_t)hi->logical_maximum -
914             (int64_t)hi->logical_minimum;
915         physical_size = (int64_t)hi->physical_maximum -
916             (int64_t)hi->physical_minimum;
917         /* Round to ceiling */
918         resolution = logical_size * multiplier * scale[hi->unit_exponent][0] /
919             (physical_size * divisor * scale[hi->unit_exponent][1]);
920
921         if (resolution > INT32_MAX)
922                 return (0);
923
924         return (resolution);
925 }
926
927 /*------------------------------------------------------------------------*
928  *      hid_is_mouse
929  *
930  * This function will decide if a USB descriptor belongs to a USB mouse.
931  *
932  * Return values:
933  * Zero: Not a USB mouse.
934  * Else: Is a USB mouse.
935  *------------------------------------------------------------------------*/
936 int
937 hid_is_mouse(const void *d_ptr, uint16_t d_len)
938 {
939         struct hid_data *hd;
940         struct hid_item hi;
941         int mdepth;
942         int found;
943
944         hd = hid_start_parse(d_ptr, d_len, 1 << hid_input);
945         if (hd == NULL)
946                 return (0);
947
948         mdepth = 0;
949         found = 0;
950
951         while (hid_get_item(hd, &hi)) {
952                 switch (hi.kind) {
953                 case hid_collection:
954                         if (mdepth != 0)
955                                 mdepth++;
956                         else if (hi.collection == 1 &&
957                              hi.usage ==
958                               HID_USAGE2(HUP_GENERIC_DESKTOP, HUG_MOUSE))
959                                 mdepth++;
960                         break;
961                 case hid_endcollection:
962                         if (mdepth != 0)
963                                 mdepth--;
964                         break;
965                 case hid_input:
966                         if (mdepth == 0)
967                                 break;
968                         if (hi.usage ==
969                              HID_USAGE2(HUP_GENERIC_DESKTOP, HUG_X) &&
970                             (hi.flags & (HIO_CONST|HIO_RELATIVE)) == HIO_RELATIVE)
971                                 found++;
972                         if (hi.usage ==
973                              HID_USAGE2(HUP_GENERIC_DESKTOP, HUG_Y) &&
974                             (hi.flags & (HIO_CONST|HIO_RELATIVE)) == HIO_RELATIVE)
975                                 found++;
976                         break;
977                 default:
978                         break;
979                 }
980         }
981         hid_end_parse(hd);
982         return (found);
983 }
984
985 /*------------------------------------------------------------------------*
986  *      hid_is_keyboard
987  *
988  * This function will decide if a USB descriptor belongs to a USB keyboard.
989  *
990  * Return values:
991  * Zero: Not a USB keyboard.
992  * Else: Is a USB keyboard.
993  *------------------------------------------------------------------------*/
994 int
995 hid_is_keyboard(const void *d_ptr, uint16_t d_len)
996 {
997         if (hid_is_collection(d_ptr, d_len,
998             HID_USAGE2(HUP_GENERIC_DESKTOP, HUG_KEYBOARD)))
999                 return (1);
1000         return (0);
1001 }