Attachment #224186 for bug #254974




	},
};

static inline usb_frlength_t
usbhid_xfer_max_len(struct usb_xfer *xfer)
{
	return (xfer == NULL ? 0 : usbd_xfer_max_len(xfer));
}

static inline int
usbhid_xfer_check_len(struct usb_xfer *xfer, hid_size_t len)
{
	if (xfer == NULL)
		return (ENODEV);
	if (len > usbd_xfer_max_len(xfer))
		return (ENOBUFS);
	return (0);
}

static void
usbhid_intr_setup(device_t dev, hid_intr_t intr, void *context,
    struct hid_rdesc_info *rdesc)

	 * keyboard driver was processing a key at the moment of panic.
	 */
	for (n = 0; n != USBHID_N_TRANSFER; n++) {
		sc->sc_xfer[n] = NULL;
		if (nowrite && n == USBHID_INTR_OUT_DT)
			continue;
		error = usbd_transfer_setup(sc->sc_udev, &sc->sc_iface_index,
		    sc->sc_xfer + n, sc->sc_config + n, 1,
		    (void *)(sc->sc_xfer_ctx + n), &sc->sc_mtx);
		if (error)
			DPRINTF("xfer %d setup error=%s\n", n,
			    usbd_errstr(error));
	}

	rdesc->rdsize = usbhid_xfer_max_len(sc->sc_xfer[USBHID_INTR_IN_DT]);
	rdesc->grsize = usbhid_xfer_max_len(sc->sc_xfer[USBHID_CTRL_DT]);

	rdesc->rdsize = usbd_xfer_max_len(sc->sc_xfer[USBHID_INTR_IN_DT]);
	rdesc->grsize = usbd_xfer_max_len(sc->sc_xfer[USBHID_CTRL_DT]);
	rdesc->srsize = rdesc->grsize;
	rdesc->wrsize = nowrite ? rdesc->srsize :
	    usbhid_xfer_max_len(sc->sc_xfer[USBHID_INTR_OUT_DT]);

	sc->sc_intr_buf = malloc(rdesc->rdsize, M_USBDEV, M_ZERO | M_WAITOK);
}

{
	struct usbhid_softc* sc = device_get_softc(dev);

	if (sc->sc_xfer[USBHID_INTR_IN_DT] == NULL)
		return (ENODEV);

	mtx_lock(&sc->sc_mtx);
	sc->sc_xfer_ctx[USBHID_INTR_IN_DT] = (struct usbhid_xfer_ctx) {
		.req.intr.maxlen =

	union usbhid_device_request req;
	int error;

	error = usbhid_xfer_check_len(sc->sc_xfer[USBHID_CTRL_DT], maxlen);
	if (error)
		return (error);

	req.ctrl.bmRequestType = UT_READ_CLASS_INTERFACE;
	req.ctrl.bRequest = UR_GET_REPORT;

{
	struct usbhid_softc* sc = device_get_softc(dev);
	union usbhid_device_request req;
	int error;

	error = usbhid_xfer_check_len(sc->sc_xfer[USBHID_CTRL_DT], len);
	if (error)
		return (error);

	req.ctrl.bmRequestType = UT_WRITE_CLASS_INTERFACE;
	req.ctrl.bRequest = UR_SET_REPORT;

	union usbhid_device_request req;
	int error;

	error = usbhid_xfer_check_len(sc->sc_xfer[USBHID_INTR_IN_DT], maxlen);
	if (error)
		return (error);

	req.intr.maxlen = maxlen;
	error = usbhid_sync_xfer(sc, USBHID_INTR_IN_DT, &req, buf);

{
	struct usbhid_softc* sc = device_get_softc(dev);
	union usbhid_device_request req;
	int error;

	error = usbhid_xfer_check_len(sc->sc_xfer[USBHID_INTR_OUT_DT], len);
	if (error)
		return (error);

	req.intr.maxlen = len;
	return (usbhid_sync_xfer(sc, USBHID_INTR_OUT_DT, &req,

	struct usbhid_softc* sc = device_get_softc(dev);
	union usbhid_device_request req;

	if (sc->sc_xfer[USBHID_CTRL_DT] == NULL)
		return (ENODEV);

	/* Duration is measured in 4 milliseconds per unit. */
	req.ctrl.bmRequestType = UT_WRITE_CLASS_INTERFACE;
	req.ctrl.bRequest = UR_SET_IDLE;

	struct usbhid_softc* sc = device_get_softc(dev);
	union usbhid_device_request req;

	if (sc->sc_xfer[USBHID_CTRL_DT] == NULL)
		return (ENODEV);

	req.ctrl.bmRequestType = UT_WRITE_CLASS_INTERFACE;
	req.ctrl.bRequest = UR_SET_PROTOCOL;
	USETW(req.ctrl.wValue, protocol);

Return to bug 254974

Lines 308-313 static const struct usb_config usbhid_config[USBHID_N_TRANSFER] = { Link Here

(-)b/sys/dev/usb/input/usbhid.c (-15 / +45 lines)
308	},	308	},
309	};	309	};
310		310
		311	static inline usb_frlength_t
		312	usbhid_xfer_max_len(struct usb_xfer *xfer)
		313	{
		314	return (xfer == NULL ? 0 : usbd_xfer_max_len(xfer));
		315	}
		316
		317	static inline int
		318	usbhid_xfer_check_len(struct usb_xfer *xfer, hid_size_t len)
		319	{
		320	if (xfer == NULL)
		321	return (ENODEV);
		322	if (len > usbd_xfer_max_len(xfer))
		323	return (ENOBUFS);
		324	return (0);
		325	}
		326
311	static void	327	static void
312	usbhid_intr_setup(device_t dev, hid_intr_t intr, void *context,	328	usbhid_intr_setup(device_t dev, hid_intr_t intr, void *context,
313	struct hid_rdesc_info *rdesc)	329	struct hid_rdesc_info *rdesc)
Lines 336-358 usbhid_intr_setup(device_t dev, hid_intr_t intr, void *context, Link Here
336	* keyboard driver was processing a key at the moment of panic.	352	* keyboard driver was processing a key at the moment of panic.
337	*/	353	*/
338	for (n = 0; n != USBHID_N_TRANSFER; n++) {	354	for (n = 0; n != USBHID_N_TRANSFER; n++) {
		355	sc->sc_xfer[n] = NULL;
339	if (nowrite && n == USBHID_INTR_OUT_DT)	356	if (nowrite && n == USBHID_INTR_OUT_DT)
340	continue;	357	continue;
341	error = usbd_transfer_setup(sc->sc_udev, &sc->sc_iface_index,	358	error = usbd_transfer_setup(sc->sc_udev, &sc->sc_iface_index,
342	sc->sc_xfer + n, sc->sc_config + n, 1,	359	sc->sc_xfer + n, sc->sc_config + n, 1,
343	(void *)(sc->sc_xfer_ctx + n), &sc->sc_mtx);	360	(void *)(sc->sc_xfer_ctx + n), &sc->sc_mtx);
344	if (error)	361	if (error)
345	break;	362	DPRINTF("xfer %d setup error=%s\n", n,
		363	usbd_errstr(error));
346	}	364	}
347		365
348	if (error)	366	rdesc->rdsize = usbhid_xfer_max_len(sc->sc_xfer[USBHID_INTR_IN_DT]);
349	DPRINTF("error=%s\n", usbd_errstr(error));	367	rdesc->grsize = usbhid_xfer_max_len(sc->sc_xfer[USBHID_CTRL_DT]);
350
351	rdesc->rdsize = usbd_xfer_max_len(sc->sc_xfer[USBHID_INTR_IN_DT]);
352	rdesc->grsize = usbd_xfer_max_len(sc->sc_xfer[USBHID_CTRL_DT]);
353	rdesc->srsize = rdesc->grsize;	368	rdesc->srsize = rdesc->grsize;
354	rdesc->wrsize = nowrite ? rdesc->srsize :	369	rdesc->wrsize = nowrite ? rdesc->srsize :
355	usbd_xfer_max_len(sc->sc_xfer[USBHID_INTR_OUT_DT]);	370	usbhid_xfer_max_len(sc->sc_xfer[USBHID_INTR_OUT_DT]);
356		371
357	sc->sc_intr_buf = malloc(rdesc->rdsize, M_USBDEV, M_ZERO \| M_WAITOK);	372	sc->sc_intr_buf = malloc(rdesc->rdsize, M_USBDEV, M_ZERO \| M_WAITOK);
358	}	373	}
Lines 371-376 usbhid_intr_start(device_t dev) Link Here
371	{	386	{
372	struct usbhid_softc* sc = device_get_softc(dev);	387	struct usbhid_softc* sc = device_get_softc(dev);
373		388
		389	if (sc->sc_xfer[USBHID_INTR_IN_DT] == NULL)
		390	return (ENODEV);
		391
374	mtx_lock(&sc->sc_mtx);	392	mtx_lock(&sc->sc_mtx);
375	sc->sc_xfer_ctx[USBHID_INTR_IN_DT] = (struct usbhid_xfer_ctx) {	393	sc->sc_xfer_ctx[USBHID_INTR_IN_DT] = (struct usbhid_xfer_ctx) {
376	.req.intr.maxlen =	394	.req.intr.maxlen =
Lines 493-500 usbhid_get_report(device_t dev, void *buf, hid_size_t maxlen, Link Here
493	union usbhid_device_request req;	511	union usbhid_device_request req;
494	int error;	512	int error;
495		513
496	if (maxlen > usbd_xfer_max_len(sc->sc_xfer[USBHID_CTRL_DT]))	514	error = usbhid_xfer_check_len(sc->sc_xfer[USBHID_CTRL_DT], maxlen);
497	return (ENOBUFS);	515	if (error)
		516	return (error);
498		517
499	req.ctrl.bmRequestType = UT_READ_CLASS_INTERFACE;	518	req.ctrl.bmRequestType = UT_READ_CLASS_INTERFACE;
500	req.ctrl.bRequest = UR_GET_REPORT;	519	req.ctrl.bRequest = UR_GET_REPORT;
Lines 516-524 usbhid_set_report(device_t dev, const void *buf, hid_size_t len, uint8_t type, Link Here
516	{	535	{
517	struct usbhid_softc* sc = device_get_softc(dev);	536	struct usbhid_softc* sc = device_get_softc(dev);
518	union usbhid_device_request req;	537	union usbhid_device_request req;
		538	int error;
519		539
520	if (len > usbd_xfer_max_len(sc->sc_xfer[USBHID_CTRL_DT]))	540	error = usbhid_xfer_check_len(sc->sc_xfer[USBHID_CTRL_DT], len);
521	return (ENOBUFS);	541	if (error)
		542	return (error);
522		543
523	req.ctrl.bmRequestType = UT_WRITE_CLASS_INTERFACE;	544	req.ctrl.bmRequestType = UT_WRITE_CLASS_INTERFACE;
524	req.ctrl.bRequest = UR_SET_REPORT;	545	req.ctrl.bRequest = UR_SET_REPORT;
Lines 538-545 usbhid_read(device_t dev, void buf, hid_size_t maxlen, hid_size_t actlen) Link Here
538	union usbhid_device_request req;	559	union usbhid_device_request req;
539	int error;	560	int error;
540		561
541	if (maxlen > usbd_xfer_max_len(sc->sc_xfer[USBHID_INTR_IN_DT]))	562	error = usbhid_xfer_check_len(sc->sc_xfer[USBHID_INTR_IN_DT], maxlen);
542	return (ENOBUFS);	563	if (error)
		564	return (error);
543		565
544	req.intr.maxlen = maxlen;	566	req.intr.maxlen = maxlen;
545	error = usbhid_sync_xfer(sc, USBHID_INTR_IN_DT, &req, buf);	567	error = usbhid_sync_xfer(sc, USBHID_INTR_IN_DT, &req, buf);
Lines 554-562 usbhid_write(device_t dev, const void *buf, hid_size_t len) Link Here
554	{	576	{
555	struct usbhid_softc* sc = device_get_softc(dev);	577	struct usbhid_softc* sc = device_get_softc(dev);
556	union usbhid_device_request req;	578	union usbhid_device_request req;
		579	int error;
557		580
558	if (len > usbd_xfer_max_len(sc->sc_xfer[USBHID_INTR_OUT_DT]))	581	error = usbhid_xfer_check_len(sc->sc_xfer[USBHID_INTR_OUT_DT], len);
559	return (ENOBUFS);	582	if (error)
		583	return (error);
560		584
561	req.intr.maxlen = len;	585	req.intr.maxlen = len;
562	return (usbhid_sync_xfer(sc, USBHID_INTR_OUT_DT, &req,	586	return (usbhid_sync_xfer(sc, USBHID_INTR_OUT_DT, &req,
Lines 569-574 usbhid_set_idle(device_t dev, uint16_t duration, uint8_t id) Link Here
569	struct usbhid_softc* sc = device_get_softc(dev);	593	struct usbhid_softc* sc = device_get_softc(dev);
570	union usbhid_device_request req;	594	union usbhid_device_request req;
571		595
		596	if (sc->sc_xfer[USBHID_CTRL_DT] == NULL)
		597	return (ENODEV);
		598
572	/* Duration is measured in 4 milliseconds per unit. */	599	/* Duration is measured in 4 milliseconds per unit. */
573	req.ctrl.bmRequestType = UT_WRITE_CLASS_INTERFACE;	600	req.ctrl.bmRequestType = UT_WRITE_CLASS_INTERFACE;
574	req.ctrl.bRequest = UR_SET_IDLE;	601	req.ctrl.bRequest = UR_SET_IDLE;
Lines 586-591 usbhid_set_protocol(device_t dev, uint16_t protocol) Link Here
586	struct usbhid_softc* sc = device_get_softc(dev);	613	struct usbhid_softc* sc = device_get_softc(dev);
587	union usbhid_device_request req;	614	union usbhid_device_request req;
588		615
		616	if (sc->sc_xfer[USBHID_CTRL_DT] == NULL)
		617	return (ENODEV);
		618
589	req.ctrl.bmRequestType = UT_WRITE_CLASS_INTERFACE;	619	req.ctrl.bmRequestType = UT_WRITE_CLASS_INTERFACE;
590	req.ctrl.bRequest = UR_SET_PROTOCOL;	620	req.ctrl.bRequest = UR_SET_PROTOCOL;
591	USETW(req.ctrl.wValue, protocol);	621	USETW(req.ctrl.wValue, protocol);