dlls/hidclass.sys/device.c

   1 /*
   2  * HIDClass device functions
   3  *
   4  * Copyright (C) 2015 Aric Stewart
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  */
  20
  21 #include <stdarg.h>
  22 #include <stdlib.h>
  23 #include "hid.h"
  24 #include "winreg.h"
  25 #include "winuser.h"
  26
  27 #include "wine/debug.h"
  28 #include "ddk/hidsdi.h"
  29 #include "ddk/hidtypes.h"
  30 #include "ddk/wdm.h"
  31
  32 WINE_DEFAULT_DEBUG_CHANNEL(hid);
  33 WINE_DECLARE_DEBUG_CHANNEL(hid_report);
  34
  35 IRP *pop_irp_from_queue(BASE_DEVICE_EXTENSION *ext)
  36 {
  37     LIST_ENTRY *entry;
  38     KIRQL old_irql;
  39     IRP *irp = NULL;
  40
  41     KeAcquireSpinLock(&ext->u.pdo.irp_queue_lock, &old_irql);
  42
  43     while (!irp && (entry = RemoveHeadList(&ext->u.pdo.irp_queue)) != &ext->u.pdo.irp_queue)
  44     {
  45         irp = CONTAINING_RECORD(entry, IRP, Tail.Overlay.ListEntry);
  46         if (!IoSetCancelRoutine(irp, NULL))
  47         {
  48             /* cancel routine is already cleared, meaning that it was called. let it handle completion. */
  49             InitializeListHead(&irp->Tail.Overlay.ListEntry);
  50             irp = NULL;
  51         }
  52     }
  53
  54     KeReleaseSpinLock(&ext->u.pdo.irp_queue_lock, old_irql);
  55     return irp;
  56 }
  57
  58 static void WINAPI read_cancel_routine(DEVICE_OBJECT *device, IRP *irp)
  59 {
  60     BASE_DEVICE_EXTENSION *ext;
  61     KIRQL old_irql;
  62
  63     TRACE("cancel %p IRP on device %p\n", irp, device);
  64
  65     ext = device->DeviceExtension;
  66
  67     IoReleaseCancelSpinLock(irp->CancelIrql);
  68
  69     KeAcquireSpinLock(&ext->u.pdo.irp_queue_lock, &old_irql);
  70
  71     RemoveEntryList(&irp->Tail.Overlay.ListEntry);
  72
  73     KeReleaseSpinLock(&ext->u.pdo.irp_queue_lock, old_irql);
  74
  75     irp->IoStatus.Status = STATUS_CANCELLED;
  76     irp->IoStatus.Information = 0;
  77     IoCompleteRequest(irp, IO_NO_INCREMENT);
  78 }
  79
  80 static NTSTATUS copy_packet_into_buffer(HID_XFER_PACKET *packet, BYTE* buffer, ULONG buffer_length, ULONG *out_length)
  81 {
  82     BOOL zero_id = (packet->reportId == 0);
  83
  84     *out_length = 0;
  85
  86     if ((zero_id && buffer_length > packet->reportBufferLen) ||
  87         (!zero_id && buffer_length >= packet->reportBufferLen))
  88     {
  89         if (packet->reportId != 0)
  90         {
  91             memcpy(buffer, packet->reportBuffer, packet->reportBufferLen);
  92             *out_length = packet->reportBufferLen;
  93         }
  94         else
  95         {
  96             buffer[0] = 0;
  97             memcpy(&buffer[1], packet->reportBuffer, packet->reportBufferLen);
  98             *out_length = packet->reportBufferLen + 1;
  99         }
 100         return STATUS_SUCCESS;
 101     }
 102     else
 103         return STATUS_BUFFER_OVERFLOW;
 104 }
 105
 106 static void hid_device_send_input(DEVICE_OBJECT *device, HID_XFER_PACKET *packet)
 107 {
 108     BASE_DEVICE_EXTENSION *ext = device->DeviceExtension;
 109     RAWINPUT *rawinput;
 110     UCHAR *report, id;
 111     ULONG data_size;
 112     INPUT input;
 113
 114     data_size = offsetof(RAWINPUT, data.hid.bRawData) + packet->reportBufferLen;
 115     if (!(id = ext->u.pdo.preparsed_data->reports[0].reportID)) data_size += 1;
 116
 117     if (!(rawinput = malloc(data_size)))
 118     {
 119         ERR("Failed to allocate rawinput data!\n");
 120         return;
 121     }
 122
 123     rawinput->header.dwType = RIM_TYPEHID;
 124     rawinput->header.dwSize = data_size;
 125     rawinput->header.hDevice = ULongToHandle(ext->u.pdo.rawinput_handle);
 126     rawinput->header.wParam = RIM_INPUT;
 127     rawinput->data.hid.dwCount = 1;
 128     rawinput->data.hid.dwSizeHid = data_size - offsetof(RAWINPUT, data.hid.bRawData);
 129
 130     report = rawinput->data.hid.bRawData;
 131     if (!id) *report++ = 0;
 132     memcpy(report, packet->reportBuffer, packet->reportBufferLen);
 133
 134     input.type = INPUT_HARDWARE;
 135     input.hi.uMsg = WM_INPUT;
 136     input.hi.wParamH = 0;
 137     input.hi.wParamL = 0;
 138     __wine_send_input(0, &input, rawinput);
 139
 140     free(rawinput);
 141 }
 142
 143 static void HID_Device_processQueue(DEVICE_OBJECT *device)
 144 {
 145     IRP *irp;
 146     BASE_DEVICE_EXTENSION *ext = device->DeviceExtension;
 147     UINT buffer_size = RingBuffer_GetBufferSize(ext->u.pdo.ring_buffer);
 148     HID_XFER_PACKET *packet;
 149
 150     packet = malloc(buffer_size);
 151
 152     while((irp = pop_irp_from_queue(ext)))
 153     {
 154         int ptr;
 155         ptr = PtrToUlong( irp->Tail.Overlay.OriginalFileObject->FsContext );
 156
 157         RingBuffer_Read(ext->u.pdo.ring_buffer, ptr, packet, &buffer_size);
 158         if (buffer_size)
 159         {
 160             NTSTATUS rc;
 161             ULONG out_length;
 162             IO_STACK_LOCATION *irpsp = IoGetCurrentIrpStackLocation(irp);
 163             packet->reportBuffer = (BYTE *)packet + sizeof(*packet);
 164             TRACE_(hid_report)("Processing Request (%i)\n",ptr);
 165             rc = copy_packet_into_buffer(packet, irp->AssociatedIrp.SystemBuffer, irpsp->Parameters.Read.Length, &out_length);
 166             irp->IoStatus.Status = rc;
 167             irp->IoStatus.Information = out_length;
 168         }
 169         else
 170         {
 171             irp->IoStatus.Information = 0;
 172             irp->IoStatus.Status = STATUS_UNSUCCESSFUL;
 173         }
 174         IoCompleteRequest( irp, IO_NO_INCREMENT );
 175     }
 176     free(packet);
 177 }
 178
 179 static DWORD CALLBACK hid_device_thread(void *args)
 180 {
 181     DEVICE_OBJECT *device = (DEVICE_OBJECT*)args;
 182
 183     IRP *irp;
 184     IO_STATUS_BLOCK irp_status;
 185     HID_XFER_PACKET *packet;
 186     DWORD rc;
 187
 188     BASE_DEVICE_EXTENSION *ext = device->DeviceExtension;
 189     USHORT report_size = ext->u.pdo.preparsed_data->caps.InputReportByteLength;
 190
 191     packet = malloc(sizeof(*packet) + report_size);
 192     packet->reportBuffer = (BYTE *)packet + sizeof(*packet);
 193
 194     if (ext->u.pdo.information.Polled)
 195     {
 196         while(1)
 197         {
 198             KEVENT event;
 199
 200             KeInitializeEvent(&event, NotificationEvent, FALSE);
 201
 202             packet->reportBufferLen = report_size;
 203             packet->reportId = 0;
 204
 205             irp = IoBuildDeviceIoControlRequest(IOCTL_HID_GET_INPUT_REPORT, ext->u.pdo.parent_fdo,
 206                     NULL, 0, packet, sizeof(*packet), TRUE, &event, &irp_status);
 207
 208             if (IoCallDriver(ext->u.pdo.parent_fdo, irp) == STATUS_PENDING)
 209                 KeWaitForSingleObject(&event, Executive, KernelMode, FALSE, NULL);
 210
 211             if (irp_status.Status == STATUS_SUCCESS)
 212             {
 213                 RingBuffer_Write(ext->u.pdo.ring_buffer, packet);
 214                 hid_device_send_input(device, packet);
 215                 HID_Device_processQueue(device);
 216             }
 217
 218             rc = WaitForSingleObject(ext->u.pdo.halt_event,
 219                     ext->u.pdo.poll_interval ? ext->u.pdo.poll_interval : DEFAULT_POLL_INTERVAL);
 220
 221             if (rc == WAIT_OBJECT_0)
 222                 break;
 223             else if (rc != WAIT_TIMEOUT)
 224                 ERR("Wait returned unexpected value %x\n",rc);
 225         }
 226     }
 227     else
 228     {
 229         INT exit_now = FALSE;
 230
 231         while(1)
 232         {
 233             KEVENT event;
 234
 235             KeInitializeEvent(&event, NotificationEvent, FALSE);
 236
 237             irp = IoBuildDeviceIoControlRequest(IOCTL_HID_READ_REPORT, ext->u.pdo.parent_fdo,
 238                     NULL, 0, packet->reportBuffer, report_size, TRUE, &event, &irp_status);
 239
 240             if (IoCallDriver(ext->u.pdo.parent_fdo, irp) == STATUS_PENDING)
 241                 KeWaitForSingleObject(&event, Executive, KernelMode, FALSE, NULL);
 242
 243             rc = WaitForSingleObject(ext->u.pdo.halt_event, 0);
 244             if (rc == WAIT_OBJECT_0)
 245                 exit_now = TRUE;
 246
 247             if (!exit_now && irp_status.Status == STATUS_SUCCESS)
 248             {
 249                 packet->reportBufferLen = irp_status.Information;
 250                 if (ext->u.pdo.preparsed_data->reports[0].reportID)
 251                     packet->reportId = packet->reportBuffer[0];
 252                 else
 253                     packet->reportId = 0;
 254                 RingBuffer_Write(ext->u.pdo.ring_buffer, packet);
 255                 hid_device_send_input(device, packet);
 256                 HID_Device_processQueue(device);
 257             }
 258
 259             if (exit_now)
 260                 break;
 261         }
 262     }
 263
 264     TRACE("Device thread exiting\n");
 265     return 1;
 266 }
 267
 268 void HID_StartDeviceThread(DEVICE_OBJECT *device)
 269 {
 270     BASE_DEVICE_EXTENSION *ext = device->DeviceExtension;
 271     ext->u.pdo.halt_event = CreateEventA(NULL, TRUE, FALSE, NULL);
 272     ext->u.pdo.thread = CreateThread(NULL, 0, hid_device_thread, device, 0, NULL);
 273 }
 274
 275 static NTSTATUS handle_IOCTL_HID_GET_COLLECTION_INFORMATION(IRP *irp, BASE_DEVICE_EXTENSION *ext)
 276 {
 277     IO_STACK_LOCATION *irpsp = IoGetCurrentIrpStackLocation( irp );
 278     if (irpsp->Parameters.DeviceIoControl.OutputBufferLength <  sizeof(HID_COLLECTION_INFORMATION))
 279     {
 280         irp->IoStatus.Status = STATUS_BUFFER_OVERFLOW;
 281         irp->IoStatus.Information = 0;
 282     }
 283     else
 284     {
 285         memcpy(irp->AssociatedIrp.SystemBuffer, &ext->u.pdo.information, sizeof(HID_COLLECTION_INFORMATION));
 286         irp->IoStatus.Information = sizeof(HID_COLLECTION_INFORMATION);
 287         irp->IoStatus.Status = STATUS_SUCCESS;
 288     }
 289     return STATUS_SUCCESS;
 290 }
 291
 292 static NTSTATUS handle_IOCTL_HID_GET_COLLECTION_DESCRIPTOR(IRP *irp, BASE_DEVICE_EXTENSION *ext)
 293 {
 294     IO_STACK_LOCATION *irpsp = IoGetCurrentIrpStackLocation( irp );
 295     const WINE_HIDP_PREPARSED_DATA *data = ext->u.pdo.preparsed_data;
 296
 297     if (irpsp->Parameters.DeviceIoControl.OutputBufferLength < data->dwSize)
 298     {
 299         irp->IoStatus.Status = STATUS_INVALID_BUFFER_SIZE;
 300         irp->IoStatus.Information = 0;
 301     }
 302     else
 303     {
 304         memcpy(irp->UserBuffer, data, data->dwSize);
 305         irp->IoStatus.Information = data->dwSize;
 306         irp->IoStatus.Status = STATUS_SUCCESS;
 307     }
 308     return STATUS_SUCCESS;
 309 }
 310
 311 static NTSTATUS handle_minidriver_string(BASE_DEVICE_EXTENSION *ext, IRP *irp, SHORT index)
 312 {
 313     IO_STACK_LOCATION *irpsp = IoGetCurrentIrpStackLocation( irp );
 314     WCHAR buffer[127];
 315     NTSTATUS status;
 316     ULONG InputBuffer;
 317
 318     InputBuffer = MAKELONG(index, 0);
 319     status = call_minidriver(IOCTL_HID_GET_STRING, ext->u.pdo.parent_fdo,
 320             ULongToPtr(InputBuffer), sizeof(InputBuffer), buffer, sizeof(buffer));
 321
 322     if (status == STATUS_SUCCESS)
 323     {
 324         WCHAR *out_buffer = MmGetSystemAddressForMdlSafe(irp->MdlAddress, NormalPagePriority);
 325         int length = irpsp->Parameters.DeviceIoControl.OutputBufferLength/sizeof(WCHAR);
 326         TRACE("got string %s from minidriver\n",debugstr_w(buffer));
 327         lstrcpynW(out_buffer, buffer, length);
 328         irp->IoStatus.Information = (lstrlenW(buffer)+1) * sizeof(WCHAR);
 329     }
 330     irp->IoStatus.Status = status;
 331
 332     return STATUS_SUCCESS;
 333 }
 334
 335 static NTSTATUS HID_get_feature(BASE_DEVICE_EXTENSION *ext, IRP *irp)
 336 {
 337     IO_STACK_LOCATION *irpsp = IoGetCurrentIrpStackLocation( irp );
 338     HID_XFER_PACKET *packet;
 339     DWORD len;
 340     NTSTATUS rc = STATUS_SUCCESS;
 341     BYTE *out_buffer;
 342
 343     irp->IoStatus.Information = 0;
 344
 345     out_buffer = MmGetSystemAddressForMdlSafe(irp->MdlAddress, NormalPagePriority);
 346     TRACE_(hid_report)("Device %p Buffer length %i Buffer %p\n", ext, irpsp->Parameters.DeviceIoControl.OutputBufferLength, out_buffer);
 347
 348     if (!irpsp->Parameters.DeviceIoControl.OutputBufferLength || !out_buffer)
 349     {
 350         irp->IoStatus.Status = STATUS_BUFFER_TOO_SMALL;
 351         return rc;
 352     }
 353
 354     len = sizeof(*packet) + irpsp->Parameters.DeviceIoControl.OutputBufferLength;
 355     packet = malloc(len);
 356     packet->reportBufferLen = irpsp->Parameters.DeviceIoControl.OutputBufferLength;
 357     packet->reportBuffer = ((BYTE*)packet) + sizeof(*packet);
 358     packet->reportId = out_buffer[0];
 359
 360     TRACE_(hid_report)("(id %i, len %i buffer %p)\n", packet->reportId, packet->reportBufferLen, packet->reportBuffer);
 361
 362     rc = call_minidriver(IOCTL_HID_GET_FEATURE, ext->u.pdo.parent_fdo, NULL, 0, packet, sizeof(*packet));
 363
 364     irp->IoStatus.Status = rc;
 365     if (irp->IoStatus.Status == STATUS_SUCCESS)
 366     {
 367         irp->IoStatus.Information = packet->reportBufferLen;
 368         memcpy(out_buffer, packet->reportBuffer, packet->reportBufferLen);
 369     }
 370     else
 371         irp->IoStatus.Information = 0;
 372
 373     TRACE_(hid_report)("Result 0x%x get %li bytes\n", rc, irp->IoStatus.Information);
 374
 375     free(packet);
 376
 377     return rc;
 378 }
 379
 380 static NTSTATUS HID_set_to_device(DEVICE_OBJECT *device, IRP *irp)
 381 {
 382     IO_STACK_LOCATION *irpsp = IoGetCurrentIrpStackLocation(irp);
 383     BASE_DEVICE_EXTENSION *ext = device->DeviceExtension;
 384     const WINE_HIDP_PREPARSED_DATA *data = ext->u.pdo.preparsed_data;
 385     HID_XFER_PACKET packet;
 386     ULONG max_len;
 387     NTSTATUS rc;
 388
 389     TRACE_(hid_report)("Device %p Buffer length %i Buffer %p\n", device, irpsp->Parameters.DeviceIoControl.InputBufferLength, irp->AssociatedIrp.SystemBuffer);
 390     packet.reportId = ((BYTE*)irp->AssociatedIrp.SystemBuffer)[0];
 391     if (packet.reportId == 0)
 392     {
 393         packet.reportBuffer = &((BYTE*)irp->AssociatedIrp.SystemBuffer)[1];
 394         packet.reportBufferLen = irpsp->Parameters.DeviceIoControl.InputBufferLength - 1;
 395         if (irpsp->Parameters.DeviceIoControl.IoControlCode == IOCTL_HID_SET_FEATURE)
 396             max_len = data->caps.FeatureReportByteLength;
 397         else
 398             max_len = data->caps.OutputReportByteLength;
 399     }
 400     else
 401     {
 402         packet.reportBuffer = irp->AssociatedIrp.SystemBuffer;
 403         packet.reportBufferLen = irpsp->Parameters.DeviceIoControl.InputBufferLength;
 404         if (irpsp->Parameters.DeviceIoControl.IoControlCode == IOCTL_HID_SET_FEATURE)
 405             max_len = data->reports[data->reportIdx[HidP_Feature][packet.reportId]].bitSize;
 406         else
 407             max_len = data->reports[data->reportIdx[HidP_Output][packet.reportId]].bitSize;
 408         max_len = (max_len + 7) / 8;
 409     }
 410     if (packet.reportBufferLen > max_len)
 411         packet.reportBufferLen = max_len;
 412
 413     TRACE_(hid_report)("(id %i, len %i buffer %p)\n", packet.reportId, packet.reportBufferLen, packet.reportBuffer);
 414
 415     rc = call_minidriver(irpsp->Parameters.DeviceIoControl.IoControlCode,
 416             ext->u.pdo.parent_fdo, NULL, 0, &packet, sizeof(packet));
 417
 418     irp->IoStatus.Status = rc;
 419     if (irp->IoStatus.Status == STATUS_SUCCESS)
 420         irp->IoStatus.Information = irpsp->Parameters.DeviceIoControl.InputBufferLength;
 421     else
 422         irp->IoStatus.Information = 0;
 423
 424     TRACE_(hid_report)("Result 0x%x set %li bytes\n", rc, irp->IoStatus.Information);
 425
 426     return rc;
 427 }
 428
 429 NTSTATUS WINAPI pdo_ioctl(DEVICE_OBJECT *device, IRP *irp)
 430 {
 431     NTSTATUS rc = STATUS_SUCCESS;
 432     IO_STACK_LOCATION *irpsp = IoGetCurrentIrpStackLocation( irp );
 433     BASE_DEVICE_EXTENSION *ext = device->DeviceExtension;
 434     BOOL removed;
 435     KIRQL irql;
 436
 437     irp->IoStatus.Information = 0;
 438
 439     TRACE("device %p ioctl(%x)\n", device, irpsp->Parameters.DeviceIoControl.IoControlCode);
 440
 441     KeAcquireSpinLock(&ext->u.pdo.lock, &irql);
 442     removed = ext->u.pdo.removed;
 443     KeReleaseSpinLock(&ext->u.pdo.lock, irql);
 444
 445     if (removed)
 446     {
 447         irp->IoStatus.Status = STATUS_DELETE_PENDING;
 448         IoCompleteRequest(irp, IO_NO_INCREMENT);
 449         return STATUS_DELETE_PENDING;
 450     }
 451
 452     switch (irpsp->Parameters.DeviceIoControl.IoControlCode)
 453     {
 454         case IOCTL_HID_GET_POLL_FREQUENCY_MSEC:
 455             TRACE("IOCTL_HID_GET_POLL_FREQUENCY_MSEC\n");
 456             if (irpsp->Parameters.DeviceIoControl.OutputBufferLength < sizeof(ULONG))
 457             {
 458                 irp->IoStatus.Status = STATUS_BUFFER_OVERFLOW;
 459                 irp->IoStatus.Information = 0;
 460                 break;
 461             }
 462             *(ULONG *)irp->AssociatedIrp.SystemBuffer = ext->u.pdo.poll_interval;
 463             irp->IoStatus.Information = sizeof(ULONG);
 464             irp->IoStatus.Status = STATUS_SUCCESS;
 465             break;
 466         case IOCTL_HID_SET_POLL_FREQUENCY_MSEC:
 467         {
 468             ULONG poll_interval;
 469             TRACE("IOCTL_HID_SET_POLL_FREQUENCY_MSEC\n");
 470             if (irpsp->Parameters.DeviceIoControl.InputBufferLength < sizeof(ULONG))
 471             {
 472                 irp->IoStatus.Status = STATUS_BUFFER_TOO_SMALL;
 473                 break;
 474             }
 475             poll_interval = *(ULONG *)irp->AssociatedIrp.SystemBuffer;
 476             if (poll_interval <= MAX_POLL_INTERVAL_MSEC)
 477             {
 478                 ext->u.pdo.poll_interval = poll_interval;
 479                 irp->IoStatus.Status = STATUS_SUCCESS;
 480             }
 481             else
 482                 irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
 483             break;
 484         }
 485         case IOCTL_HID_GET_PRODUCT_STRING:
 486         {
 487             rc = handle_minidriver_string(ext, irp, HID_STRING_ID_IPRODUCT);
 488             break;
 489         }
 490         case IOCTL_HID_GET_SERIALNUMBER_STRING:
 491         {
 492             rc = handle_minidriver_string(ext, irp, HID_STRING_ID_ISERIALNUMBER);
 493             break;
 494         }
 495         case IOCTL_HID_GET_MANUFACTURER_STRING:
 496         {
 497             rc = handle_minidriver_string(ext, irp, HID_STRING_ID_IMANUFACTURER);
 498             break;
 499         }
 500         case IOCTL_HID_GET_COLLECTION_INFORMATION:
 501         {
 502             rc = handle_IOCTL_HID_GET_COLLECTION_INFORMATION(irp, ext);
 503             break;
 504         }
 505         case IOCTL_HID_GET_COLLECTION_DESCRIPTOR:
 506         {
 507             rc = handle_IOCTL_HID_GET_COLLECTION_DESCRIPTOR(irp, ext);
 508             break;
 509         }
 510         case IOCTL_HID_GET_INPUT_REPORT:
 511         {
 512             HID_XFER_PACKET *packet;
 513             UINT packet_size = sizeof(*packet) + irpsp->Parameters.DeviceIoControl.OutputBufferLength;
 514             BYTE *buffer = MmGetSystemAddressForMdlSafe(irp->MdlAddress, NormalPagePriority);
 515             ULONG out_length;
 516
 517             if (!irpsp->Parameters.DeviceIoControl.OutputBufferLength || !buffer)
 518             {
 519                 irp->IoStatus.Status = STATUS_BUFFER_TOO_SMALL;
 520                 break;
 521             }
 522
 523             packet = malloc(packet_size);
 524
 525             if (ext->u.pdo.preparsed_data->reports[0].reportID)
 526                 packet->reportId = buffer[0];
 527             else
 528                 packet->reportId = 0;
 529             packet->reportBuffer = (BYTE *)packet + sizeof(*packet);
 530             packet->reportBufferLen = irpsp->Parameters.DeviceIoControl.OutputBufferLength - 1;
 531
 532             rc = call_minidriver(IOCTL_HID_GET_INPUT_REPORT, ext->u.pdo.parent_fdo, NULL, 0, packet, sizeof(*packet));
 533             if (rc == STATUS_SUCCESS)
 534             {
 535                 rc = copy_packet_into_buffer(packet, buffer, irpsp->Parameters.DeviceIoControl.OutputBufferLength, &out_length);
 536                 irp->IoStatus.Information = out_length;
 537             }
 538             else
 539                 irp->IoStatus.Information = 0;
 540             irp->IoStatus.Status = rc;
 541             free(packet);
 542             break;
 543         }
 544         case IOCTL_SET_NUM_DEVICE_INPUT_BUFFERS:
 545         {
 546             irp->IoStatus.Information = 0;
 547
 548             if (irpsp->Parameters.DeviceIoControl.InputBufferLength != sizeof(ULONG))
 549             {
 550                 irp->IoStatus.Status = rc = STATUS_BUFFER_OVERFLOW;
 551             }
 552             else
 553             {
 554                 rc = RingBuffer_SetSize(ext->u.pdo.ring_buffer, *(ULONG *)irp->AssociatedIrp.SystemBuffer);
 555                 irp->IoStatus.Status = rc;
 556             }
 557             break;
 558         }
 559         case IOCTL_GET_NUM_DEVICE_INPUT_BUFFERS:
 560         {
 561             if (irpsp->Parameters.DeviceIoControl.OutputBufferLength < sizeof(ULONG))
 562             {
 563                 irp->IoStatus.Information = 0;
 564                 irp->IoStatus.Status = rc = STATUS_BUFFER_TOO_SMALL;
 565             }
 566             else
 567             {
 568                 *(ULONG *)irp->AssociatedIrp.SystemBuffer = RingBuffer_GetSize(ext->u.pdo.ring_buffer);
 569                 irp->IoStatus.Information = sizeof(ULONG);
 570                 rc = irp->IoStatus.Status = STATUS_SUCCESS;
 571             }
 572             break;
 573         }
 574         case IOCTL_HID_GET_FEATURE:
 575             rc = HID_get_feature(ext, irp);
 576             break;
 577         case IOCTL_HID_SET_FEATURE:
 578         case IOCTL_HID_SET_OUTPUT_REPORT:
 579             rc = HID_set_to_device(device, irp);
 580             break;
 581         default:
 582         {
 583             ULONG code = irpsp->Parameters.DeviceIoControl.IoControlCode;
 584             FIXME("Unsupported ioctl %x (device=%x access=%x func=%x method=%x)\n",
 585                   code, code >> 16, (code >> 14) & 3, (code >> 2) & 0xfff, code & 3);
 586             irp->IoStatus.Status = STATUS_NOT_SUPPORTED;
 587             rc = STATUS_UNSUCCESSFUL;
 588             break;
 589         }
 590     }
 591
 592     if (rc != STATUS_PENDING)
 593         IoCompleteRequest( irp, IO_NO_INCREMENT );
 594
 595     return rc;
 596 }
 597
 598 NTSTATUS WINAPI pdo_read(DEVICE_OBJECT *device, IRP *irp)
 599 {
 600     HID_XFER_PACKET *packet;
 601     BASE_DEVICE_EXTENSION *ext = device->DeviceExtension;
 602     const WINE_HIDP_PREPARSED_DATA *data = ext->u.pdo.preparsed_data;
 603     UINT buffer_size = RingBuffer_GetBufferSize(ext->u.pdo.ring_buffer);
 604     NTSTATUS rc = STATUS_SUCCESS;
 605     IO_STACK_LOCATION *irpsp = IoGetCurrentIrpStackLocation(irp);
 606     int ptr = -1;
 607     BOOL removed;
 608     KIRQL irql;
 609
 610     KeAcquireSpinLock(&ext->u.pdo.lock, &irql);
 611     removed = ext->u.pdo.removed;
 612     KeReleaseSpinLock(&ext->u.pdo.lock, irql);
 613
 614     if (removed)
 615     {
 616         irp->IoStatus.Status = STATUS_DELETE_PENDING;
 617         IoCompleteRequest(irp, IO_NO_INCREMENT);
 618         return STATUS_DELETE_PENDING;
 619     }
 620
 621     if (irpsp->Parameters.Read.Length < data->caps.InputReportByteLength)
 622     {
 623         irp->IoStatus.Status = STATUS_INVALID_BUFFER_SIZE;
 624         IoCompleteRequest( irp, IO_NO_INCREMENT );
 625         return STATUS_INVALID_BUFFER_SIZE;
 626     }
 627
 628     packet = malloc(buffer_size);
 629     ptr = PtrToUlong( irp->Tail.Overlay.OriginalFileObject->FsContext );
 630
 631     irp->IoStatus.Information = 0;
 632     RingBuffer_ReadNew(ext->u.pdo.ring_buffer, ptr, packet, &buffer_size);
 633
 634     if (buffer_size)
 635     {
 636         IO_STACK_LOCATION *irpsp = IoGetCurrentIrpStackLocation( irp );
 637         NTSTATUS rc;
 638         ULONG out_length;
 639         packet->reportBuffer = (BYTE *)packet + sizeof(*packet);
 640         TRACE_(hid_report)("Got Packet %p %i\n", packet->reportBuffer, packet->reportBufferLen);
 641
 642         rc = copy_packet_into_buffer(packet, irp->AssociatedIrp.SystemBuffer, irpsp->Parameters.Read.Length, &out_length);
 643         irp->IoStatus.Information = out_length;
 644         irp->IoStatus.Status = rc;
 645         IoCompleteRequest(irp, IO_NO_INCREMENT);
 646     }
 647     else
 648     {
 649         if (ext->u.pdo.poll_interval)
 650         {
 651             KIRQL old_irql;
 652             TRACE_(hid_report)("Queue irp\n");
 653
 654             KeAcquireSpinLock(&ext->u.pdo.irp_queue_lock, &old_irql);
 655
 656             IoSetCancelRoutine(irp, read_cancel_routine);
 657             if (irp->Cancel && !IoSetCancelRoutine(irp, NULL))
 658             {
 659                 /* IRP was canceled before we set cancel routine */
 660                 InitializeListHead(&irp->Tail.Overlay.ListEntry);
 661                 KeReleaseSpinLock(&ext->u.pdo.irp_queue_lock, old_irql);
 662                 return STATUS_CANCELLED;
 663             }
 664
 665             InsertTailList(&ext->u.pdo.irp_queue, &irp->Tail.Overlay.ListEntry);
 666             IoMarkIrpPending(irp);
 667
 668             KeReleaseSpinLock(&ext->u.pdo.irp_queue_lock, old_irql);
 669             rc = STATUS_PENDING;
 670         }
 671         else
 672         {
 673             HID_XFER_PACKET packet;
 674             TRACE("No packet, but opportunistic reads enabled\n");
 675             packet.reportId = ((BYTE*)irp->AssociatedIrp.SystemBuffer)[0];
 676             packet.reportBuffer = &((BYTE*)irp->AssociatedIrp.SystemBuffer)[1];
 677             packet.reportBufferLen = irpsp->Parameters.Read.Length - 1;
 678             rc = call_minidriver(IOCTL_HID_GET_INPUT_REPORT, ext->u.pdo.parent_fdo, NULL, 0, &packet, sizeof(packet));
 679
 680             if (rc == STATUS_SUCCESS)
 681             {
 682                 ((BYTE*)irp->AssociatedIrp.SystemBuffer)[0] = packet.reportId;
 683                 irp->IoStatus.Information = packet.reportBufferLen + 1;
 684                 irp->IoStatus.Status = rc;
 685             }
 686             IoCompleteRequest(irp, IO_NO_INCREMENT);
 687         }
 688     }
 689     free(packet);
 690
 691     return rc;
 692 }
 693
 694 NTSTATUS WINAPI pdo_write(DEVICE_OBJECT *device, IRP *irp)
 695 {
 696     IO_STACK_LOCATION *irpsp = IoGetCurrentIrpStackLocation( irp );
 697     BASE_DEVICE_EXTENSION *ext = device->DeviceExtension;
 698     const WINE_HIDP_PREPARSED_DATA *data = ext->u.pdo.preparsed_data;
 699     HID_XFER_PACKET packet;
 700     ULONG max_len;
 701     BOOL removed;
 702     NTSTATUS rc;
 703     KIRQL irql;
 704
 705     KeAcquireSpinLock(&ext->u.pdo.lock, &irql);
 706     removed = ext->u.pdo.removed;
 707     KeReleaseSpinLock(&ext->u.pdo.lock, irql);
 708
 709     if (removed)
 710     {
 711         irp->IoStatus.Status = STATUS_DELETE_PENDING;
 712         IoCompleteRequest(irp, IO_NO_INCREMENT);
 713         return STATUS_DELETE_PENDING;
 714     }
 715
 716     if (!irpsp->Parameters.Write.Length)
 717     {
 718         irp->IoStatus.Status = STATUS_INVALID_USER_BUFFER;
 719         IoCompleteRequest( irp, IO_NO_INCREMENT );
 720         return irp->IoStatus.Status;
 721     }
 722
 723     if (irpsp->Parameters.Write.Length < data->caps.OutputReportByteLength)
 724     {
 725         irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
 726         IoCompleteRequest( irp, IO_NO_INCREMENT );
 727         return irp->IoStatus.Status;
 728     }
 729
 730     irp->IoStatus.Information = 0;
 731
 732     TRACE_(hid_report)("Device %p Buffer length %i Buffer %p\n", device, irpsp->Parameters.Write.Length, irp->AssociatedIrp.SystemBuffer);
 733     packet.reportId = ((BYTE*)irp->AssociatedIrp.SystemBuffer)[0];
 734     if (packet.reportId == 0)
 735     {
 736         packet.reportBuffer = &((BYTE*)irp->AssociatedIrp.SystemBuffer)[1];
 737         packet.reportBufferLen = irpsp->Parameters.Write.Length - 1;
 738         max_len = data->caps.OutputReportByteLength;
 739     }
 740     else
 741     {
 742         packet.reportBuffer = irp->AssociatedIrp.SystemBuffer;
 743         packet.reportBufferLen = irpsp->Parameters.Write.Length;
 744         max_len = (data->reports[data->reportIdx[HidP_Output][packet.reportId]].bitSize + 7) / 8;
 745     }
 746     if (packet.reportBufferLen > max_len)
 747         packet.reportBufferLen = max_len;
 748
 749     TRACE_(hid_report)("(id %i, len %i buffer %p)\n", packet.reportId, packet.reportBufferLen, packet.reportBuffer);
 750
 751     rc = call_minidriver(IOCTL_HID_WRITE_REPORT, ext->u.pdo.parent_fdo, NULL, 0, &packet, sizeof(packet));
 752
 753     irp->IoStatus.Status = rc;
 754     if (irp->IoStatus.Status == STATUS_SUCCESS)
 755         irp->IoStatus.Information = irpsp->Parameters.Write.Length;
 756     else
 757         irp->IoStatus.Information = 0;
 758
 759     TRACE_(hid_report)("Result 0x%x wrote %li bytes\n", rc, irp->IoStatus.Information);
 760
 761     IoCompleteRequest( irp, IO_NO_INCREMENT );
 762     return rc;
 763 }
 764
 765 NTSTATUS WINAPI pdo_create(DEVICE_OBJECT *device, IRP *irp)
 766 {
 767     BASE_DEVICE_EXTENSION *ext = device->DeviceExtension;
 768
 769     TRACE("Open handle on device %p\n", device);
 770     irp->Tail.Overlay.OriginalFileObject->FsContext = UlongToPtr(RingBuffer_AddPointer(ext->u.pdo.ring_buffer));
 771     irp->IoStatus.Status = STATUS_SUCCESS;
 772     IoCompleteRequest( irp, IO_NO_INCREMENT );
 773     return STATUS_SUCCESS;
 774 }
 775
 776 NTSTATUS WINAPI pdo_close(DEVICE_OBJECT *device, IRP *irp)
 777 {
 778     BASE_DEVICE_EXTENSION *ext = device->DeviceExtension;
 779     int ptr = PtrToUlong(irp->Tail.Overlay.OriginalFileObject->FsContext);
 780     TRACE("Close handle on device %p\n", device);
 781     RingBuffer_RemovePointer(ext->u.pdo.ring_buffer, ptr);
 782     irp->IoStatus.Status = STATUS_SUCCESS;
 783     IoCompleteRequest( irp, IO_NO_INCREMENT );
 784     return STATUS_SUCCESS;
 785 }