xref: /netbsd-src/sys/dev/i2c/ihidev.c (revision bdc22b2e01993381dcefeff2bc9b56ca75a4235c)
1 /* $NetBSD: ihidev.c,v 1.5 2018/06/26 06:03:57 thorpej Exp $ */
2 /* $OpenBSD ihidev.c,v 1.13 2017/04/08 02:57:23 deraadt Exp $ */
3 
4 /*-
5  * Copyright (c) 2017 The NetBSD Foundation, Inc.
6  * All rights reserved.
7  *
8  * This code is derived from software contributed to The NetBSD Foundation
9  * by Manuel Bouyer.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 2015, 2016 joshua stein <jcs@openbsd.org>
35  *
36  * Permission to use, copy, modify, and distribute this software for any
37  * purpose with or without fee is hereby granted, provided that the above
38  * copyright notice and this permission notice appear in all copies.
39  *
40  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
41  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
42  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
43  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
44  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
45  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
46  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
47  */
48 
49 /*
50  * HID-over-i2c driver
51  *
52  * https://msdn.microsoft.com/en-us/library/windows/hardware/dn642101%28v=vs.85%29.aspx
53  *
54  */
55 
56 #include <sys/cdefs.h>
57 __KERNEL_RCSID(0, "$NetBSD: ihidev.c,v 1.5 2018/06/26 06:03:57 thorpej Exp $");
58 
59 #include <sys/param.h>
60 #include <sys/systm.h>
61 #include <sys/device.h>
62 #include <sys/kmem.h>
63 
64 
65 #include <dev/i2c/i2cvar.h>
66 #include <dev/i2c/ihidev.h>
67 
68 #include <dev/hid/hid.h>
69 
70 #if defined(__i386__) || defined(__amd64__)
71 #  include "acpica.h"
72 #endif
73 #if NACPICA > 0
74 #include <dev/acpi/acpi_intr.h>
75 #endif
76 
77 #include "locators.h"
78 
79 /* #define IHIDEV_DEBUG */
80 
81 #ifdef IHIDEV_DEBUG
82 #define DPRINTF(x) printf x
83 #else
84 #define DPRINTF(x)
85 #endif
86 
87 /* 7.2 */
88 enum {
89 	I2C_HID_CMD_DESCR	= 0x0,
90 	I2C_HID_CMD_RESET	= 0x1,
91 	I2C_HID_CMD_GET_REPORT	= 0x2,
92 	I2C_HID_CMD_SET_REPORT	= 0x3,
93 	I2C_HID_CMD_GET_IDLE	= 0x4,
94 	I2C_HID_CMD_SET_IDLE	= 0x5,
95 	I2C_HID_CMD_GET_PROTO	= 0x6,
96 	I2C_HID_CMD_SET_PROTO	= 0x7,
97 	I2C_HID_CMD_SET_POWER	= 0x8,
98 
99 	/* pseudo commands */
100 	I2C_HID_REPORT_DESCR	= 0x100,
101 };
102 
103 static int I2C_HID_POWER_ON	= 0x0;
104 static int I2C_HID_POWER_OFF	= 0x1;
105 
106 static int	ihidev_match(device_t, cfdata_t, void *);
107 static void	ihidev_attach(device_t, device_t, void *);
108 static int	ihidev_detach(device_t, int);
109 CFATTACH_DECL_NEW(ihidev, sizeof(struct ihidev_softc),
110     ihidev_match, ihidev_attach, ihidev_detach, NULL);
111 
112 static bool	ihidev_suspend(device_t, const pmf_qual_t *);
113 static bool	ihidev_resume(device_t, const pmf_qual_t *);
114 static int	ihidev_hid_command(struct ihidev_softc *, int, void *, bool);
115 static unsigned int ihidev_intr(void *);
116 static int	ihidev_reset(struct ihidev_softc *, bool);
117 static int	ihidev_hid_desc_parse(struct ihidev_softc *);
118 
119 static int	ihidev_maxrepid(void *, int);
120 static int	ihidev_print(void *, const char *);
121 static int	ihidev_submatch(device_t, cfdata_t, const int *, void *);
122 
123 static const struct device_compatible_entry compat_data[] = {
124 	{ "hid-over-i2c",		0 },
125 	{ NULL,				0 }
126 };
127 
128 static int
129 ihidev_match(device_t parent, cfdata_t match, void *aux)
130 {
131 	struct i2c_attach_args * const ia = aux;
132 	int match_result;
133 
134 	if (iic_use_direct_match(ia, match, compat_data, &match_result))
135 		return I2C_MATCH_DIRECT_COMPATIBLE;
136 
137 	return 0;
138 }
139 
140 static void
141 ihidev_attach(device_t parent, device_t self, void *aux)
142 {
143 	struct ihidev_softc *sc = device_private(self);
144 	struct i2c_attach_args *ia = aux;
145 	struct ihidev_attach_arg iha;
146 	device_t dev;
147 	int repid, repsz;
148 	int isize;
149 	uint32_t v;
150 	int locs[IHIDBUSCF_NLOCS];
151 
152 
153 	sc->sc_dev = self;
154 	sc->sc_tag = ia->ia_tag;
155 	sc->sc_addr = ia->ia_addr;
156 	sc->sc_phandle = ia->ia_cookie;
157 	mutex_init(&sc->sc_intr_lock, MUTEX_DEFAULT, IPL_VM);
158 
159 	if (!prop_dictionary_get_uint32(ia->ia_prop, "hid-descr-addr", &v)) {
160 		aprint_error(": no hid-descr-addr value\n");
161 		return;
162 	}
163 
164 	sc->sc_hid_desc_addr = v;
165 
166 	if (ihidev_hid_command(sc, I2C_HID_CMD_DESCR, NULL, false) ||
167 	    ihidev_hid_desc_parse(sc)) {
168 		aprint_error(": failed fetching initial HID descriptor\n");
169 		return;
170 	}
171 
172 	aprint_naive("\n");
173 	aprint_normal(": vendor 0x%x product 0x%x, %s\n",
174 	    le16toh(sc->hid_desc.wVendorID), le16toh(sc->hid_desc.wProductID),
175 	    ia->ia_name);
176 
177 	sc->sc_nrepid = ihidev_maxrepid(sc->sc_report, sc->sc_reportlen);
178 	if (sc->sc_nrepid < 0)
179 		return;
180 
181 	aprint_normal_dev(self, "%d report id%s\n", sc->sc_nrepid,
182 	    sc->sc_nrepid > 1 ? "s" : "");
183 
184 	sc->sc_nrepid++;
185 	sc->sc_subdevs = kmem_zalloc(sc->sc_nrepid * sizeof(struct ihidev *),
186 	    KM_NOSLEEP);
187 	if (sc->sc_subdevs == NULL) {
188 		aprint_error_dev(self, "failed allocating memory\n");
189 		return;
190 	}
191 
192 	/* find largest report size and allocate memory for input buffer */
193 	sc->sc_isize = le16toh(sc->hid_desc.wMaxInputLength);
194 	for (repid = 0; repid < sc->sc_nrepid; repid++) {
195 		repsz = hid_report_size(sc->sc_report, sc->sc_reportlen,
196 		    hid_input, repid);
197 
198 		isize = repsz + 2; /* two bytes for the length */
199 		isize += (sc->sc_nrepid != 1); /* one byte for the report ID */
200 		if (isize > sc->sc_isize)
201 			sc->sc_isize = isize;
202 
203 		DPRINTF(("%s: repid %d size %d\n", sc->sc_dev.dv_xname, repid,
204 		    repsz));
205 	}
206 	sc->sc_ibuf = kmem_zalloc(sc->sc_isize, KM_NOSLEEP);
207 #if NACPICA > 0
208 	{
209 		char buf[100];
210 
211 		sc->sc_ih = acpi_intr_establish(self,
212 		    sc->sc_phandle, ihidev_intr, sc, device_xname(self));
213 		if (sc->sc_ih == NULL)
214 			aprint_error_dev(self, "can't establish interrupt\n");
215 		aprint_normal_dev(self, "interrupting at %s\n",
216 		    acpi_intr_string(sc->sc_ih, buf, sizeof(buf)));
217 	}
218 #endif
219 
220 	iha.iaa = ia;
221 	iha.parent = sc;
222 
223 	/* Look for a driver claiming all report IDs first. */
224 	iha.reportid = IHIDEV_CLAIM_ALLREPORTID;
225 	locs[IHIDBUSCF_REPORTID] = IHIDEV_CLAIM_ALLREPORTID;
226 	dev = config_found_sm_loc(self, "ihidbus", locs, &iha,
227 	    ihidev_print, ihidev_submatch);
228 	if (dev != NULL) {
229 		for (repid = 0; repid < sc->sc_nrepid; repid++)
230 			sc->sc_subdevs[repid] = device_private(dev);
231 		return;
232 	}
233 
234 	for (repid = 0; repid < sc->sc_nrepid; repid++) {
235 		if (hid_report_size(sc->sc_report, sc->sc_reportlen, hid_input,
236 		    repid) == 0 &&
237 		    hid_report_size(sc->sc_report, sc->sc_reportlen,
238 		    hid_output, repid) == 0 &&
239 		    hid_report_size(sc->sc_report, sc->sc_reportlen,
240 		    hid_feature, repid) == 0)
241 			continue;
242 
243 		iha.reportid = repid;
244 		locs[IHIDBUSCF_REPORTID] = repid;
245 		dev = config_found_sm_loc(self, "ihidbus", locs,
246 		    &iha, ihidev_print, ihidev_submatch);
247 		sc->sc_subdevs[repid] = device_private(dev);
248 	}
249 
250 	/* power down until we're opened */
251 	if (ihidev_hid_command(sc, I2C_HID_CMD_SET_POWER, &I2C_HID_POWER_OFF, false)) {
252 		aprint_error_dev(sc->sc_dev, "failed to power down\n");
253 		return;
254 	}
255 	if (!pmf_device_register(self, ihidev_suspend, ihidev_resume))
256 		aprint_error_dev(self, "couldn't establish power handler\n");
257 }
258 
259 static int
260 ihidev_detach(device_t self, int flags)
261 {
262 	struct ihidev_softc *sc = device_private(self);
263 
264 	mutex_enter(&sc->sc_intr_lock);
265 #if NACPICA > 0
266 	if (sc->sc_ih != NULL)
267 		acpi_intr_disestablish(sc->sc_ih, ihidev_intr);
268 #endif
269 	if (ihidev_hid_command(sc, I2C_HID_CMD_SET_POWER,
270 	    &I2C_HID_POWER_OFF, true))
271 	aprint_error_dev(sc->sc_dev, "failed to power down\n");
272 	mutex_exit(&sc->sc_intr_lock);
273 	if (sc->sc_ibuf != NULL) {
274 		kmem_free(sc->sc_ibuf, sc->sc_isize);
275 		sc->sc_ibuf = NULL;
276 	}
277 
278 	if (sc->sc_report != NULL)
279 		kmem_free(sc->sc_report, sc->sc_reportlen);
280 
281 	pmf_device_deregister(self);
282 	return (0);
283 }
284 
285 static bool
286 ihidev_suspend(device_t self, const pmf_qual_t *q)
287 {
288 	struct ihidev_softc *sc = device_private(self);
289 
290 	mutex_enter(&sc->sc_intr_lock);
291 	if (sc->sc_refcnt > 0) {
292 		printf("ihidev power off\n");
293 		if (ihidev_hid_command(sc, I2C_HID_CMD_SET_POWER,
294 		    &I2C_HID_POWER_OFF, true))
295 		aprint_error_dev(sc->sc_dev, "failed to power down\n");
296 	}
297 	mutex_exit(&sc->sc_intr_lock);
298 	return true;
299 }
300 
301 static bool
302 ihidev_resume(device_t self, const pmf_qual_t *q)
303 {
304 	struct ihidev_softc *sc = device_private(self);
305 
306 	mutex_enter(&sc->sc_intr_lock);
307 	if (sc->sc_refcnt > 0) {
308 		printf("ihidev power reset\n");
309 		ihidev_reset(sc, true);
310 	}
311 	mutex_exit(&sc->sc_intr_lock);
312 	return true;
313 }
314 
315 static int
316 ihidev_hid_command(struct ihidev_softc *sc, int hidcmd, void *arg, bool poll)
317 {
318 	int i, res = 1;
319 	int flags = poll ? I2C_F_POLL : 0;
320 
321 	iic_acquire_bus(sc->sc_tag, flags);
322 
323 	switch (hidcmd) {
324 	case I2C_HID_CMD_DESCR: {
325 		/*
326 		 * 5.2.2 - HID Descriptor Retrieval
327 		 * register is passed from the controller
328 		 */
329 		uint8_t cmd[] = {
330 			htole16(sc->sc_hid_desc_addr) & 0xff,
331 			htole16(sc->sc_hid_desc_addr) >> 8,
332 		};
333 
334 		DPRINTF(("%s: HID command I2C_HID_CMD_DESCR at 0x%x\n",
335 		    sc->sc_dev.dv_xname, htole16(sc->sc_hid_desc_addr)));
336 
337 		/* 20 00 */
338 		res = iic_exec(sc->sc_tag, I2C_OP_READ_WITH_STOP, sc->sc_addr,
339 		    &cmd, sizeof(cmd), &sc->hid_desc_buf,
340 		    sizeof(struct i2c_hid_desc), flags);
341 
342 		DPRINTF(("%s: HID descriptor:", sc->sc_dev.dv_xname));
343 		for (i = 0; i < sizeof(struct i2c_hid_desc); i++)
344 			DPRINTF((" %.2x", sc->hid_desc_buf[i]));
345 		DPRINTF(("\n"));
346 
347 		break;
348 	}
349 	case I2C_HID_CMD_RESET: {
350 		uint8_t cmd[] = {
351 			htole16(sc->hid_desc.wCommandRegister) & 0xff,
352 			htole16(sc->hid_desc.wCommandRegister) >> 8,
353 			0,
354 			I2C_HID_CMD_RESET,
355 		};
356 
357 		DPRINTF(("%s: HID command I2C_HID_CMD_RESET\n",
358 		    sc->sc_dev.dv_xname));
359 
360 		/* 22 00 00 01 */
361 		res = iic_exec(sc->sc_tag, I2C_OP_WRITE_WITH_STOP, sc->sc_addr,
362 		    &cmd, sizeof(cmd), NULL, 0, flags);
363 
364 		break;
365 	}
366 	case I2C_HID_CMD_GET_REPORT: {
367 		struct i2c_hid_report_request *rreq =
368 		    (struct i2c_hid_report_request *)arg;
369 
370 		uint8_t cmd[] = {
371 			htole16(sc->hid_desc.wCommandRegister) & 0xff,
372 			htole16(sc->hid_desc.wCommandRegister) >> 8,
373 			0,
374 			I2C_HID_CMD_GET_REPORT,
375 			0, 0, 0,
376 		};
377 		int cmdlen = 7;
378 		int dataoff = 4;
379 		int report_id = rreq->id;
380 		int report_id_len = 1;
381 		int report_len = rreq->len + 2;
382 		int d;
383 		uint8_t *tmprep;
384 
385 		DPRINTF(("%s: HID command I2C_HID_CMD_GET_REPORT %d "
386 		    "(type %d, len %d)\n", sc->sc_dev.dv_xname, report_id,
387 		    rreq->type, rreq->len));
388 
389 		/*
390 		 * 7.2.2.4 - "The protocol is optimized for Report < 15.  If a
391 		 * report ID >= 15 is necessary, then the Report ID in the Low
392 		 * Byte must be set to 1111 and a Third Byte is appended to the
393 		 * protocol.  This Third Byte contains the entire/actual report
394 		 * ID."
395 		 */
396 		if (report_id >= 15) {
397 			cmd[dataoff++] = report_id;
398 			report_id = 15;
399 			report_id_len = 2;
400 		} else
401 			cmdlen--;
402 
403 		cmd[2] = report_id | rreq->type << 4;
404 
405 		cmd[dataoff++] = sc->hid_desc.wDataRegister & 0xff;
406 		cmd[dataoff] = sc->hid_desc.wDataRegister >> 8;
407 
408 		/*
409 		 * 7.2.2.2 - Response will be a 2-byte length value, the report
410 		 * id with length determined above, and then the report.
411 		 * Allocate rreq->len + 2 + 2 bytes, read into that temporary
412 		 * buffer, and then copy only the report back out to
413 		 * rreq->data.
414 		 */
415 		report_len += report_id_len;
416 		tmprep = kmem_zalloc(report_len, KM_NOSLEEP);
417 
418 		/* type 3 id 8: 22 00 38 02 23 00 */
419 		res = iic_exec(sc->sc_tag, I2C_OP_READ_WITH_STOP, sc->sc_addr,
420 		    &cmd, cmdlen, tmprep, report_len, flags);
421 
422 		d = tmprep[0] | tmprep[1] << 8;
423 		if (d != report_len) {
424 			DPRINTF(("%s: response size %d != expected length %d\n",
425 			    sc->sc_dev.dv_xname, d, report_len));
426 		}
427 
428 		if (report_id_len == 2)
429 			d = tmprep[2] | tmprep[3] << 8;
430 		else
431 			d = tmprep[2];
432 
433 		if (d != rreq->id) {
434 			DPRINTF(("%s: response report id %d != %d\n",
435 			    sc->sc_dev.dv_xname, d, rreq->id));
436 			iic_release_bus(sc->sc_tag, 0);
437 			kmem_free(tmprep, report_len);
438 			return (1);
439 		}
440 
441 		DPRINTF(("%s: response:", sc->sc_dev.dv_xname));
442 		for (i = 0; i < report_len; i++)
443 			DPRINTF((" %.2x", tmprep[i]));
444 		DPRINTF(("\n"));
445 
446 		memcpy(rreq->data, tmprep + 2 + report_id_len, rreq->len);
447 		kmem_free(tmprep, report_len);
448 
449 		break;
450 	}
451 	case I2C_HID_CMD_SET_REPORT: {
452 		struct i2c_hid_report_request *rreq =
453 		    (struct i2c_hid_report_request *)arg;
454 
455 		uint8_t cmd[] = {
456 			htole16(sc->hid_desc.wCommandRegister) & 0xff,
457 			htole16(sc->hid_desc.wCommandRegister) >> 8,
458 			0,
459 			I2C_HID_CMD_SET_REPORT,
460 			0, 0, 0, 0, 0, 0,
461 		};
462 		int cmdlen = 10;
463 		int report_id = rreq->id;
464 		int report_len = 2 + (report_id ? 1 : 0) + rreq->len;
465 		int dataoff;
466 		uint8_t *finalcmd;
467 
468 		DPRINTF(("%s: HID command I2C_HID_CMD_SET_REPORT %d "
469 		    "(type %d, len %d):", sc->sc_dev.dv_xname, report_id,
470 		    rreq->type, rreq->len));
471 		for (i = 0; i < rreq->len; i++)
472 			DPRINTF((" %.2x", ((uint8_t *)rreq->data)[i]));
473 		DPRINTF(("\n"));
474 
475 		/*
476 		 * 7.2.2.4 - "The protocol is optimized for Report < 15.  If a
477 		 * report ID >= 15 is necessary, then the Report ID in the Low
478 		 * Byte must be set to 1111 and a Third Byte is appended to the
479 		 * protocol.  This Third Byte contains the entire/actual report
480 		 * ID."
481 		 */
482 		dataoff = 4;
483 		if (report_id >= 15) {
484 			cmd[dataoff++] = report_id;
485 			report_id = 15;
486 		} else
487 			cmdlen--;
488 
489 		cmd[2] = report_id | rreq->type << 4;
490 
491 		if (rreq->type == I2C_HID_REPORT_TYPE_FEATURE) {
492 			cmd[dataoff++] = htole16(sc->hid_desc.wDataRegister)
493 			    & 0xff;
494 			cmd[dataoff++] = htole16(sc->hid_desc.wDataRegister)
495 			    >> 8;
496 		} else {
497 			cmd[dataoff++] = htole16(sc->hid_desc.wOutputRegister)
498 			    & 0xff;
499 			cmd[dataoff++] = htole16(sc->hid_desc.wOutputRegister)
500 			    >> 8;
501 		}
502 
503 		cmd[dataoff++] = report_len & 0xff;
504 		cmd[dataoff++] = report_len >> 8;
505 		cmd[dataoff] = rreq->id;
506 
507 		finalcmd = kmem_zalloc(cmdlen + rreq->len, KM_NOSLEEP);
508 
509 		memcpy(finalcmd, cmd, cmdlen);
510 		memcpy(finalcmd + cmdlen, rreq->data, rreq->len);
511 
512 		/* type 3 id 4: 22 00 34 03 23 00 04 00 04 03 */
513 		res = iic_exec(sc->sc_tag, I2C_OP_WRITE_WITH_STOP, sc->sc_addr,
514 		    finalcmd, cmdlen + rreq->len, NULL, 0, flags);
515 		kmem_free(finalcmd, cmdlen + rreq->len);
516 
517  		break;
518  	}
519 
520 	case I2C_HID_CMD_SET_POWER: {
521 		int power = *(int *)arg;
522 		uint8_t cmd[] = {
523 			htole16(sc->hid_desc.wCommandRegister) & 0xff,
524 			htole16(sc->hid_desc.wCommandRegister) >> 8,
525 			power,
526 			I2C_HID_CMD_SET_POWER,
527 		};
528 
529 		DPRINTF(("%s: HID command I2C_HID_CMD_SET_POWER(%d)\n",
530 		    sc->sc_dev.dv_xname, power));
531 
532 		/* 22 00 00 08 */
533 		res = iic_exec(sc->sc_tag, I2C_OP_WRITE_WITH_STOP, sc->sc_addr,
534 		    &cmd, sizeof(cmd), NULL, 0, flags);
535 
536 		break;
537 	}
538 	case I2C_HID_REPORT_DESCR: {
539 		uint8_t cmd[] = {
540 			htole16(sc->hid_desc.wReportDescRegister) & 0xff,
541 			htole16(sc->hid_desc.wReportDescRegister) >> 8,
542 		};
543 
544 		DPRINTF(("%s: HID command I2C_HID_REPORT_DESCR at 0x%x with "
545 		    "size %d\n", sc->sc_dev.dv_xname, cmd[0],
546 		    sc->sc_reportlen));
547 
548 		/* 20 00 */
549 		res = iic_exec(sc->sc_tag, I2C_OP_READ_WITH_STOP, sc->sc_addr,
550 		    &cmd, sizeof(cmd), sc->sc_report, sc->sc_reportlen, flags);
551 
552 		DPRINTF(("%s: HID report descriptor:", sc->sc_dev.dv_xname));
553 		for (i = 0; i < sc->sc_reportlen; i++)
554 			DPRINTF((" %.2x", sc->sc_report[i]));
555 		DPRINTF(("\n"));
556 
557 		break;
558 	}
559 	default:
560 		aprint_error_dev(sc->sc_dev, "unknown command %d\n",
561 		    hidcmd);
562 	}
563 
564 	iic_release_bus(sc->sc_tag, flags);
565 
566 	return (res);
567 }
568 
569 static int
570 ihidev_reset(struct ihidev_softc *sc, bool poll)
571 {
572 	DPRINTF(("%s: resetting\n", sc->sc_dev.dv_xname));
573 
574 	if (ihidev_hid_command(sc, I2C_HID_CMD_SET_POWER,
575 	    &I2C_HID_POWER_ON, poll)) {
576 		aprint_error_dev(sc->sc_dev, "failed to power on\n");
577 		return (1);
578 	}
579 
580 	DELAY(1000);
581 
582 	if (ihidev_hid_command(sc, I2C_HID_CMD_RESET, 0, poll)) {
583 		aprint_error_dev(sc->sc_dev, "failed to reset hardware\n");
584 
585 		ihidev_hid_command(sc, I2C_HID_CMD_SET_POWER,
586 		    &I2C_HID_POWER_OFF, poll);
587 
588 		return (1);
589 	}
590 
591 	DELAY(1000);
592 
593 	return (0);
594 }
595 
596 /*
597  * 5.2.2 - HID Descriptor Retrieval
598  *
599  * parse HID Descriptor that has already been read into hid_desc with
600  * I2C_HID_CMD_DESCR
601  */
602 static int
603 ihidev_hid_desc_parse(struct ihidev_softc *sc)
604 {
605 	int retries = 3;
606 
607 	/* must be v01.00 */
608 	if (le16toh(sc->hid_desc.bcdVersion) != 0x0100) {
609 		aprint_error_dev(sc->sc_dev,
610 		    "bad HID descriptor bcdVersion (0x%x)\n",
611 		    le16toh(sc->hid_desc.bcdVersion));
612 		return (1);
613 	}
614 
615 	/* must be 30 bytes for v1.00 */
616 	if (le16toh(sc->hid_desc.wHIDDescLength !=
617 	    sizeof(struct i2c_hid_desc))) {
618 		aprint_error_dev(sc->sc_dev,
619 		    "bad HID descriptor size (%d != %zu)\n",
620 		    le16toh(sc->hid_desc.wHIDDescLength),
621 		    sizeof(struct i2c_hid_desc));
622 		return (1);
623 	}
624 
625 	if (le16toh(sc->hid_desc.wReportDescLength) <= 0) {
626 		aprint_error_dev(sc->sc_dev,
627 		    "bad HID report descriptor size (%d)\n",
628 		    le16toh(sc->hid_desc.wReportDescLength));
629 		return (1);
630 	}
631 
632 	while (retries-- > 0) {
633 		if (ihidev_reset(sc, false)) {
634 			if (retries == 0)
635 				return(1);
636 
637 			DELAY(1000);
638 		}
639 		else
640 			break;
641 	}
642 
643 	sc->sc_reportlen = le16toh(sc->hid_desc.wReportDescLength);
644 	sc->sc_report = kmem_zalloc(sc->sc_reportlen, KM_NOSLEEP);
645 
646 	if (ihidev_hid_command(sc, I2C_HID_REPORT_DESCR, 0, false)) {
647 		aprint_error_dev(sc->sc_dev, "failed fetching HID report\n");
648 		return (1);
649 	}
650 
651 	return (0);
652 }
653 
654 static unsigned int
655 ihidev_intr(void *arg)
656 {
657 	struct ihidev_softc *sc = arg;
658 	struct ihidev *scd;
659 	u_int psize;
660 	int res, i;
661 	u_char *p;
662 	u_int rep = 0;
663 
664 	/*
665 	 * XXX: force I2C_F_POLL for now to avoid dwiic interrupting
666 	 * while we are interrupting
667 	 */
668 
669 	mutex_enter(&sc->sc_intr_lock);
670 	iic_acquire_bus(sc->sc_tag, I2C_F_POLL);
671 
672 	res = iic_exec(sc->sc_tag, I2C_OP_READ_WITH_STOP, sc->sc_addr, NULL, 0,
673 	    sc->sc_ibuf, sc->sc_isize, I2C_F_POLL);
674 
675 	iic_release_bus(sc->sc_tag, I2C_F_POLL);
676 	mutex_exit(&sc->sc_intr_lock);
677 	if (res != 0)
678 		return 1;
679 
680 	/*
681 	 * 6.1.1 - First two bytes are the packet length, which must be less
682 	 * than or equal to wMaxInputLength
683 	 */
684 	psize = sc->sc_ibuf[0] | sc->sc_ibuf[1] << 8;
685 	if (!psize || psize > sc->sc_isize) {
686 		DPRINTF(("%s: %s: invalid packet size (%d vs. %d)\n",
687 		    sc->sc_dev.dv_xname, __func__, psize, sc->sc_isize));
688 		return (1);
689 	}
690 
691 	/* 3rd byte is the report id */
692 	p = sc->sc_ibuf + 2;
693 	psize -= 2;
694 	if (sc->sc_nrepid != 1)
695 		rep = *p++, psize--;
696 
697 	if (rep >= sc->sc_nrepid) {
698 		aprint_error_dev(sc->sc_dev, "%s: bad report id %d\n",
699 		    __func__, rep);
700 		return (1);
701 	}
702 
703 	DPRINTF(("%s: ihidev_intr: hid input (rep %d):", sc->sc_dev.dv_xname,
704 	    rep));
705 	for (i = 0; i < sc->sc_isize; i++)
706 		DPRINTF((" %.2x", sc->sc_ibuf[i]));
707 	DPRINTF(("\n"));
708 
709 	scd = sc->sc_subdevs[rep];
710 	if (scd == NULL || !(scd->sc_state & IHIDEV_OPEN))
711 		return (1);
712 
713 	scd->sc_intr(scd, p, psize);
714 
715 	return 1;
716 }
717 
718 static int
719 ihidev_maxrepid(void *buf, int len)
720 {
721 	struct hid_data *d;
722 	struct hid_item h;
723 	int maxid;
724 
725 	maxid = -1;
726 	h.report_ID = 0;
727 	for (d = hid_start_parse(buf, len, hid_none); hid_get_item(d, &h); )
728 		if (h.report_ID > maxid)
729 			maxid = h.report_ID;
730 	hid_end_parse(d);
731 
732 	return (maxid);
733 }
734 
735 static int
736 ihidev_print(void *aux, const char *pnp)
737 {
738 	struct ihidev_attach_arg *iha = aux;
739 
740 	if (iha->reportid == IHIDEV_CLAIM_ALLREPORTID)
741 		return (QUIET);
742 
743 	if (pnp)
744 		aprint_normal("hid at %s", pnp);
745 
746 	if (iha->reportid != 0)
747 		aprint_normal(" reportid %d", iha->reportid);
748 
749 	return (UNCONF);
750 }
751 
752 static int
753 ihidev_submatch(device_t parent, cfdata_t cf, const int *locs, void *aux)
754 {
755 	struct ihidev_attach_arg *iha = aux;
756 
757 	if (cf->ihidevcf_reportid != IHIDEV_UNK_REPORTID &&
758 	    cf->ihidevcf_reportid != iha->reportid)
759 		return (0);
760 
761 	return config_match(parent, cf, aux);
762 }
763 
764 int
765 ihidev_open(struct ihidev *scd)
766 {
767 	struct ihidev_softc *sc = scd->sc_parent;
768 
769 	DPRINTF(("%s: %s: state=%d refcnt=%d\n", sc->sc_dev.dv_xname,
770 	    __func__, scd->sc_state, sc->sc_refcnt));
771 
772 	if (scd->sc_state & IHIDEV_OPEN)
773 		return (EBUSY);
774 
775 	scd->sc_state |= IHIDEV_OPEN;
776 
777 	if (sc->sc_refcnt++ || sc->sc_isize == 0)
778 		return (0);
779 
780 	/* power on */
781 	ihidev_reset(sc, false);
782 
783 	return (0);
784 }
785 
786 void
787 ihidev_close(struct ihidev *scd)
788 {
789 	struct ihidev_softc *sc = scd->sc_parent;
790 
791 	DPRINTF(("%s: %s: state=%d refcnt=%d\n", sc->sc_dev.dv_xname,
792 	    __func__, scd->sc_state, sc->sc_refcnt));
793 
794 	if (!(scd->sc_state & IHIDEV_OPEN))
795 		return;
796 
797 	scd->sc_state &= ~IHIDEV_OPEN;
798 
799 	if (--sc->sc_refcnt)
800 		return;
801 
802 	if (ihidev_hid_command(sc, I2C_HID_CMD_SET_POWER,
803 	    &I2C_HID_POWER_OFF, false))
804 		aprint_error_dev(sc->sc_dev, "failed to power down\n");
805 }
806 
807 void
808 ihidev_get_report_desc(struct ihidev_softc *sc, void **desc, int *size)
809 {
810 	*desc = sc->sc_report;
811 	*size = sc->sc_reportlen;
812 }
813 
814 /* convert hid_* constants used throughout HID code to i2c HID equivalents */
815 int
816 ihidev_report_type_conv(int hid_type_id)
817 {
818 	switch (hid_type_id) {
819 	case hid_input:
820 		return I2C_HID_REPORT_TYPE_INPUT;
821 	case hid_output:
822 		return I2C_HID_REPORT_TYPE_OUTPUT;
823 	case hid_feature:
824 		return I2C_HID_REPORT_TYPE_FEATURE;
825 	default:
826 		return -1;
827 	}
828 }
829 
830 int
831 ihidev_get_report(struct device *dev, int type, int id, void *data, int len)
832 {
833 	struct ihidev_softc *sc = (struct ihidev_softc *)dev;
834 	struct i2c_hid_report_request rreq;
835 	int ctype;
836 
837 	if ((ctype = ihidev_report_type_conv(type)) < 0)
838 		return (1);
839 
840 	rreq.type = ctype;
841 	rreq.id = id;
842 	rreq.data = data;
843 	rreq.len = len;
844 
845 	if (ihidev_hid_command(sc, I2C_HID_CMD_GET_REPORT, &rreq, false)) {
846 		aprint_error_dev(sc->sc_dev, "failed fetching report\n");
847 		return (1);
848 	}
849 
850 	return 0;
851 }
852 
853 int
854 ihidev_set_report(struct device *dev, int type, int id, void *data,
855     int len)
856 {
857 	struct ihidev_softc *sc = (struct ihidev_softc *)dev;
858 	struct i2c_hid_report_request rreq;
859 	int ctype;
860 
861 	if ((ctype = ihidev_report_type_conv(type)) < 0)
862 		return (1);
863 
864 	rreq.type = ctype;
865 	rreq.id = id;
866 	rreq.data = data;
867 	rreq.len = len;
868 
869 	if (ihidev_hid_command(sc, I2C_HID_CMD_SET_REPORT, &rreq, false)) {
870 		aprint_error_dev(sc->sc_dev, "failed setting report\n");
871 		return (1);
872 	}
873 
874 	return 0;
875 }
876