Keyboard and Mouse HID Client Drivers

Keyboard and mouse HID client driversArticle01/11/2024

Note

This topic is for developers who are creating drivers for keyboard and mouse HID clients. If you are looking to fix a mouse or keyboard, see:

Mouse, touchpad, and keyboard problems in WindowsTroubleshoot a wireless mouse that does not function correctly

This article discusses keyboard and mouse HID client drivers. Keyboards and mice represent the first set of HID clients that were standardized in the HID usage tables and implemented in Windows operating systems.

Keyboard and mouse HID client drivers are implemented in the form of HID Mapper Drivers. A HID mapper driver is a kernel-mode WDM filter driver that provides a bidirectional interface for I/O requests between a non-HID Class driver and the HID class driver. The mapper driver maps the I/O requests and data protocols of one to the other.

Windows provides system-supplied HID mapper drivers for HID keyboard, and HID mice devices.

Architecture and overview

The following figure illustrates the system-supplied driver stacks for USB keyboard, mouse, and touchpad devices.

The figure shows the following components:

KBDHID.sys: HID client mapper driver for keyboards. Converts HID usages into scan codes to interface with the existing keyboard class driver.MOUHID.sys: HID client mapper driver for mice/touchpads. Converts HID usages into mouse commands (X/Y, buttons, wheel) to interface with the existing keyboard class driver.KBDCLASS.sys: The keyboard class driver provides functionality for all keyboards and keypads on the system in a secure manner.MOUCLASS.sys: The mouse class driver provides functionality for all mice and touchpads on the system. The driver supports both absolute and relative pointing devices. MOUCLASS.sys isn't the Windows driver for touchscreens.HIDCLASS.sys: The HID class driver. The HID Class driver is the glue between KBDHID.sys and MOUHID.sys HID clients and various transports, such as USB, Bluetooth, and so on.

The system builds the driver stack as follows:

The transport stack creates a physical device object (PDO) for each HID device attached and loads the appropriate HID transport driver, which in turn loads the HID Class Driver.The HID class driver creates a PDO for each keyboard or mouse TLC. Complex HID devices (more than one TLC) are exposed as multiple PDOs created by HID class driver. For example, a keyboard with an integrated mouse might have one collection for the standard keyboard controls and a different collection for the mouse.The keyboard or mouse HID client mapper drivers are loaded on the appropriate FDO.The HID mapper drivers create FDOs for keyboard and mouse, and load the class drivers.Important notesVendor drivers aren't required for keyboards and mice that are compliant with the supported HID Usages and top level collections.Vendors optionally provide filter drivers in the HID stack to alter/enhance the functionality of these specific TLC.Vendors should create separate, vendor specific, TLCs to exchange proprietary data between their HID client and the device. Avoid using filter drivers unless critical.The system opens all keyboard and mouse collections for its exclusive use.The system prevents disable/enabling a keyboard.The system provides support for horizontal/vertical wheels with smooth scrolling capabilities.Driver Guidance

Microsoft provides this guidance for IHVs writing drivers:

Driver developers are allowed to add more drivers in the form of a filter driver or a new HID client driver.

Filters drivers: Driver developers should ensure that their value-add driver is a filter driver and doesn't replace (or be used in place of) existing Windows HID drivers in the input stack.

Filter drivers are allowed in these scenarios:As an upper filter to kbdhid/mouhidAs an upper filter to kbdclass/mouclassFilter drivers aren't recommended as a filter between HIDCLASS and HID transport minidrivers

Function drivers: Alternatively vendors can create a function driver (instead of a filter driver) but only for vendor specific HID PDOs (with a user mode service if necessary).

Function drivers are allowed in these scenarios:

Only load on the specific vendor's hardware

Transport drivers: Windows team doesn't recommend creating more HID transport minidrivers. They're complex drivers to write and maintain. If a partner is creating a new HID transport minidriver, especially on SoC systems, we recommend a detailed architectural review to understand the reasoning and ensure that the driver is developed correctly.

Driver developers should use driver frameworks (KMDF or UMDF) and not rely on WDM for their filter drivers.

Driver developers should reduce the number of kernel-user transitions between their service and the driver stack.

Driver developers should ensure ability to wake the system via both keyboard and touchpad functionality (adjustable by the end user (device manager) or the PC manufacturer). In addition on SoC systems, these devices must be able to wake themselves from a lower powered state while the system is in a working S0 state.

Driver developers should ensure that their hardware is power managed efficiently.

Device can go into its lowest power state when the device is idle.Device is in the lowest power state when the system is in a low power state (for example, standby (S3) or connected standby).Keyboard layout

A keyboard layout fully describes a keyboard's input characteristics for Microsoft Windows 2000 and later versions. For example, a keyboard layout specifies the language, keyboard type and version, modifiers, scan codes, and so on.

See these resources for information about keyboard layouts:

Keyboard header file, kdb.h, in the Windows Driver Development Kit (DDK), which documents general information about keyboard layouts.

Sample keyboard layouts.

To visualize the layout of a specific keyboard, see Windows Keyboard Layouts.

For more details around the keyboard layout, visit Control Panel\Clock, Language, and Region\Language.

Supported buttons and wheels on mice

The following table identifies the features supported across different client versions of the Windows operating system.

FeatureWindows XPWindows VistaWindows 7Windows 8 and laterButtons 1-5Supported (P/2 & HID)Supported (PS/2 & HID)Supported (PS/2 & HID)Supported (PS/2 & HID)Vertical Scroll WheelSupported (PS/2 & HID)Supported (PS/2 & HID)Supported (PS/2 & HID)Supported (PS/2 & HID)Horizontal Scroll WheelNot SupportedSupported(HID only)Supported(HID only)Supported(HID only)Smooth Scroll Wheel Support (Horizontal and Vertical)Not SupportedPartly SupportedSupported (HID only)Supported (HID only)Activating buttons 4-5 and wheel on PS/2 mice

The method used by Windows to activate the new four and five-button and wheel mode is an extension of the method used to activate the third button and the wheel in IntelliMouse-compatible mice:

The mouse is set to the three-button wheel mode by setting the report rate to 200 reports per second, then to 100 reports per second, then to 80 reports per second. Then, reading the ID from the mouse. The mouse should report an ID of 3 when this sequence is completed.

Next, the mouse is set to the five-button wheel mode by setting the report rate to 200 reports per second, then to 200 reports per second again, then to 80 reports per second. Then, reading the ID from the mouse. Once the sequence is completed, a five-button wheel mouse should report an ID of 4 (whereas an IntelliMouse-compatible three-button wheel mouse would still report an ID of 3).

This method is applicable to PS/2 mice only, not HID mice. HID mice must report accurate usages in their report descriptor.

Standard PS/2-compatible mouse data packet format (two buttons)ByteD7D6D5D4D3D2D1D0Comment1YoverXoverYsignXsignTagMRLX/Y overflows and signs, buttons2X7X6X5X4X3X2X1X0X data byte3Y7Y6Y5Y4Y3Y2Y1Y0Y data bytes

Note

Windows mouse drivers do not check the overflow bits. In case of overflow, the mouse should simply send the maximal signed displacement value.

Standard PS/2-compatible mouse data packet format (three buttons + vertical wheel)ByteD7D6D5D4D3D2D1D0Comment100YsignXsign1MRLX/Y signs and R/L/M buttons2X7X6X5X4X3X2X1X0X data byte3Y7Y6Y5Y4Y3Y2Y1Y0Y data bytes4Z7Z6Z5Z4Z3Z2Z1Z0Z/wheel data byteStandard PS/2-compatible mouse data packet format (five buttons + vertical wheel)ByteD7D6D5D4D3D2D1D0Comment100YsignXsign1MRLX/Y signs and R/L/M buttons2X7X6X5X4X3X2X1X0X data byte3Y7Y6Y5Y4Y3Y2Y1Y0Y data bytes400B5B4Z3Z2Z1Z0Z/wheel data and buttons 4 and 5

Important

Notice that the Z/wheel data for a five-button wheel mouse has been reduced to four bits instead of the 8 bits used in the IntelliMouse-compatible three-button wheel mode. This reduction is made possible by the fact that the wheel typically cannot generate values beyond the range +7/-8 during any given interrupt period. Windows mouse drivers will sign extend the four Z/wheel data bits when the mouse is in the five-button wheel mode, and the full Z/wheel data byte when the mouse operates in the three-button wheel mode.

Buttons 4 & 5 on are mapped to WM_APPCOMMAND messages and correspond to App_Back and App_Forward.

Devices not requiring vendor drivers

Vendor drivers aren't required for the following devices:

Devices that comply with the HID Standard.Keyboard, mouse, or game port devices operated by the system-supplied non-HIDClass drivers.Kbfiltr sample

Kbfiltr is used with Kbdclass, the system class driver for keyboard devices and I8042prt, the function driver for a PS/2-style keyboard. Kbfiltr demonstrates how to filter I/O requests and how to add callback routines that modify the operation of Kbdclass and I8042prt.

For more information about Kbfiltr operation, see:

The ntddkbd.h WDK header file.

The sample Kbfiltr source code.

Kbfiltr IO control codes

The following IOCTLs are used by Kbfiltr.

IOCTL_INTERNAL_I8042_HOOK_KEYBOARD

The IOCTL_INTERNAL_I8042_HOOK_KEYBOARD request:

Adds an initialization callback routine to the I8042prt keyboard initialization routine.Adds an ISR callback routine to the I8042prt keyboard ISR.

The initialization and ISR callbacks are optional and are provided by an upper-level filter driver for a PS/2-style keyboard device.

After I8042prt receives an IOCTL_INTERNAL_KEYBOARD_CONNECT request, it sends a synchronous IOCTL_INTERNAL_I8042_HOOK_KEYBOARD request to the top of the keyboard device stack.

After Kbfiltr receives the hook keyboard request, Kbfiltr filters the request in the following way:

Saves the upper-level information passed to Kbfiltr, which includes the context of an upper-level device object, a pointer to an initialization callback, and a pointer to an ISR callback.Replaces the upper-level information with its own.Saves the context of I8042prt and pointers to callbacks that the Kbfiltr ISR callback can use.IOCTL_INTERNAL_KEYBOARD_CONNECT

The IOCTL_INTERNAL_KEYBOARD_CONNECT request connects the Kbdclass service to the keyboard device. Kbdclass sends this request down the keyboard device stack before it opens the keyboard device.

After Kbfiltr received the keyboard connect request, Kbfiltr filters the connect request in the following way:

Saves a copy of Kbdclass's CONNECT_DATA (Kbdclass) structure that is passed to the filter driver by Kbdclass.Substitutes its own connect information for the class driver connect information.Sends the IOCTL_INTERNAL_KEYBOARD_CONNECT request down the device stack.

If the request isn't successful, Kbfiltr completes the request with an appropriate error status.

Kbfiltr provides a template for a filter service callback routine that can supplement the operation of KeyboardClassServiceCallback, the Kbdclass class service callback routine. The filter service callback can filter the input data that is transferred from the device input buffer to the class data queue.

IOCTL_INTERNAL_KEYBOARD_DISCONNECT

The IOCTL_INTERNAL_KEYBOARD_DISCONNECT request is completed with a status of STATUS_NOT_IMPLEMENTED. The Plug and Play manager can add or remove a Plug and Play keyboard.

For all other device control requests, Kbfiltr skips the current IRP stack and sends the request down the device stack without further processing.

Callback routines implemented by Kbfiltr

Kbfiltr implements the following callback routines.

KbFilter_InitializationRoutine

See PI8042_KEYBOARD_INITIALIZATION_ROUTINE

The KbFilter_InitializationRoutine isn't needed if the I8042prt default initialization of a keyboard is sufficient.

I8042prt calls KbFilter_InitializationRoutine when it initializes the keyboard. Default keyboard initialization includes the following operations:

reset the keyboardset the typematic rate and delayset the light-emitting diodes (LED)/*ParametersDeviceObject [in]Pointer to the device object that is the context for this callback.SynchFuncContext [in]Pointer to the context for the routines pointed to by ReadPort and Writeport.ReadPort [in]Pointer to the system-supplied PI8042_SYNCH_READ_PORT callback that reads from the port.WritePort [in]Pointer to the system-supplied PI8042_SYNCH_WRITE_PORT callback that writes to the port.TurnTranslationOn [out]Specifies, if TRUE, to turn translation on. Otherwise, translation is turned off.Return valueKbFilter_InitializationRoutine returns an appropriate NTSTATUS code.*/NTSTATUS KbFilter_InitializationRoutine( In PDEVICE_OBJECT DeviceObject, In PVOIDSynchFuncContext, In PI8042_SYNCH_READ_PORT ReadPort, In PI8042_SYNCH_WRITE_PORT WritePort, Out PBOOLEANTurnTranslationOn);KbFilter_IsrHook

See PI8042_KEYBOARD_ISR. This callback isn't needed if the default operation of I8042prt is sufficient.

The I8042prt keyboard ISR calls KbFilter_IsrHook after it validates the interrupt and reads the scan code.

KbFilter_IsrHook runs in kernel mode at the IRQL of the I8042prt keyboard.

/*ParametersDeviceObject [in]Pointer to the filter device object of the driver that supplies this callback.CurrentInput [in]Pointer to the input KEYBOARD_INPUT_DATA structure that is being constructed by the ISR.CurrentOutput [in]Pointer to an OUTPUT_PACKET structure that specifies the bytes that are being written to the hardware device.StatusByte [in, out]Specifies the status byte that is read from I/O port 60 when an interrupt occurs.DataByte [in]Specifies the data byte that is read from I/O port 64 when an interrupt occurs.ContinueProcessing [out]Specifies, if TRUE, to continue processing in the I8042prt keyboard ISR after this callback returns; otherwise, processing is not continued.ScanState [in]Pointer to a KEYBOARD_SCAN_STATE structure that specifies the keyboard scan state.Return valueKbFilter_IsrHook returns TRUE if the interrupt service routine should continue; otherwise it returns FALSE.*/KbFilter_IsrHook KbFilter_IsrHook( InPDEVICE_OBJECTDeviceObject, InPKEYBOARD_INPUT_DATA CurrentInput, InPOUTPUT_PACKETCurrentOutput, Inout UCHARStatusByte, InPUCHARDataByte, OutPBOOLEAN ContinueProcessing, InPKEYBOARD_SCAN_STATE ScanState);KbFilter_ServiceCallback

See PSERVICE_CALLBACK_ROUTINE.

The ISR dispatch completion routine of the function driver calls KbFilter_ServiceCallback, which then calls the keyboard class driver's implementation of PSERVICE_CALLBACK_ROUTINE. A vendor can implement a filter service callback to modify the input data that is transferred from the device's input buffer to the class data queue. For example, the callback can delete, transform, or insert data.

/*ParametersDeviceObject [in]Pointer to the class device object.InputDataStart [in]Pointer to the first keyboard input data packet in the input data buffer of the port device.InputDataEnd [in]Pointer to the keyboard input data packet that immediately follows the last data packet in the input data buffer of the port device.InputDataConsumed [in, out]Pointer to the number of keyboard input data packets that are transferred by the routine.Return valueNone*/VOID KbFilter_ServiceCallback( InPDEVICE_OBJECTDeviceObject, InPKEYBOARD_INPUT_DATA InputDataStart, InPKEYBOARD_INPUT_DATA InputDataEnd, Inout PULONGInputDataConsumed);Moufiltr sample

Moufiltr is used with Mouclass, the system class driver for mouse devices used with Windows 2000 and later versions, and I8042prt, the function driver for a PS/2-style mouse used with Windows 2000 and later. Moufiltr demonstrates how to filter I/O requests and add callback routines that modify the operation of Mouclass and I8042prt.

For more information about Moufiltr operation, see these resources:

The ntddmou.h WDK header file.

The sample Moufiltr source code.

Moufiltr IO control codes

The following IOCTLs are used by Moufiltr.

IOCTL_INTERNAL_I8042_HOOK_MOUSE

The IOCTL_INTERNAL_I8042_HOOK_MOUSE request adds an ISR callback routine to the I8042prt mouse ISR. The ISR callback is optional and is provided by an upper-level mouse filter driver.

I8042prt sends this request after it receives an IOCTL_INTERNAL_MOUSE_CONNECT request. I8042prt sends a synchronous IOCTL_INTERNAL_I8042_HOOK_MOUSE request to the top of the mouse device stack.

After Moufiltr receives the hook mouse request, it filters the request in the following way:

Saves the upper-level information passed to Moufiltr, which includes the context of an upper-level device object and a pointer to an ISR callback.Replaces the upper-level information with its own.Saves the context of I8042prt and pointers to callbacks that the Moufiltr ISR callbacks can use.IOCTL_INTERNAL_MOUSE_CONNECT

The IOCTL_INTERNAL_MOUSE_CONNECT request connects Mouclass service to a mouse device.

IOCTL_INTERNAL_MOUSE_DISCONNECT

Moufiltr completes the IOCTL_INTERNAL_MOUSE_DISCONNECT request with an error status of STATUS_NOT_IMPLEMENTED.

For all other requests, Moufiltr skips the current IRP stack and sends the request down the device stack without further processing.

Moufiltr Callback Routines

The following callback routines are implemented by MouFiltr.

MouFilter_IsrHook

See PI8042_MOUSE_ISR.

/*ParametersDeviceObjectPointer to the filter device object of the driver that supplies this callback.CurrentInputPointer to the input MOUSE_INPUT_DATA structure being constructed by the ISR.CurrentOutputPointer to the OUTPUT_PACKET structure that specifies the bytes being written to the hardware device.StatusByteSpecifies a status byte that is read from I/O port 60 when the interrupt occurs.DataByteSpecifies a data byte that is read from I/O port 64 when the interrupt occurs.ContinueProcessingSpecifies, if TRUE, that the I8042prt mouse ISR continues processing after this callback returns. Otherwise, processing is not continued.MouseStatePointer to a MOUSE_STATE enumeration value, which identifies the state of mouse input.ResetSubStatePointer to MOUSE_RESET_SUBSTATE enumeration value, which identifies the mouse reset substate. See the Remarks section.Return valueMouFilter_IsrHook returns TRUE if the interrupt service routine should continue; otherwise it returns FALSE.*/BOOLEAN MouFilter_IsrHook(PDEVICE_OBJECTDeviceObject,PMOUSE_INPUT_DATA CurrentInput,POUTPUT_PACKETCurrentOutput,UCHAR StatusByte,PUCHARDataByte,PBOOLEAN ContinueProcessing,PMOUSE_STATE MouseState,PMOUSE_RESET_SUBSTATE ResetSubState);

A MouFilter_IsrHook callback isn't needed if the default operation of I8042prt is sufficient.

The I8042prt mouse ISR calls MouFilter_IsrHook after it validates the interrupt.

To reset a mouse, I8042prt goes through a sequence of operational substates. A MOUSE_RESET_SUBSTATE enumeration value identifies each substate. For more information about how I8042prt resets a mouse and the corresponding mouse reset substates, see the documentation of MOUSE_RESET_SUBSTATE in ntdd8042.h.

MouFilter_IsrHook runs in kernel mode at the IRQL of the I8042prt mouse ISR.

MouFilter_ServiceCallback

See PSERVICE_CALLBACK_ROUTINE

/*ParametersDeviceObject [in]Pointer to the class device object.InputDataStart [in]Pointer to the first mouse input data packet in the input data buffer of the port device.InputDataEnd [in]Pointer to the mouse input data packet immediately following the last data packet in the port device's input data buffer.InputDataConsumed [in, out]Pointer to the number of mouse input data packets that are transferred by the routine.Return valueNone*/VOID MouFilter_ServiceCallback( _In_PDEVICE_OBJECTDeviceObject, _In_PMOUSE_INPUT_DATA InputDataStart, _In_PMOUSE_INPUT_DATA InputDataEnd, _Inout_ PULONGInputDataConsumed);

The ISR DPC of I8042prt calls MouFilter_ServiceCallback, which then calls MouseClassServiceCallback. A filter service callback can be configured to modify the input data that is transferred from the device's input buffer to the class data queue. For example, the callback can delete, transform, or insert data.