1 /* $NetBSD: uhidev.c,v 1.93 2022/03/28 12:44:45 riastradh Exp $ */ 2 3 /* 4 * Copyright (c) 2001, 2012 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Lennart Augustsson (lennart@augustsson.net) at 9 * Carlstedt Research & Technology and Matthew R. Green (mrg@eterna.com.au). 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 /* 34 * HID spec: http://www.usb.org/developers/devclass_docs/HID1_11.pdf 35 */ 36 37 #include <sys/cdefs.h> 38 __KERNEL_RCSID(0, "$NetBSD: uhidev.c,v 1.93 2022/03/28 12:44:45 riastradh Exp $"); 39 40 #ifdef _KERNEL_OPT 41 #include "opt_usb.h" 42 #endif 43 44 #include <sys/param.h> 45 #include <sys/types.h> 46 47 #include <sys/atomic.h> 48 #include <sys/conf.h> 49 #include <sys/device.h> 50 #include <sys/ioctl.h> 51 #include <sys/kernel.h> 52 #include <sys/kmem.h> 53 #include <sys/lwp.h> 54 #include <sys/rndsource.h> 55 #include <sys/signalvar.h> 56 #include <sys/systm.h> 57 #include <sys/xcall.h> 58 59 #include <dev/usb/usb.h> 60 #include <dev/usb/usbhid.h> 61 62 #include <dev/usb/usbdevs.h> 63 #include <dev/usb/usbdi.h> 64 #include <dev/usb/usbdi_util.h> 65 #include <dev/usb/usb_quirks.h> 66 67 #include <dev/usb/uhidev.h> 68 #include <dev/hid/hid.h> 69 70 /* Report descriptor for broken Wacom Graphire */ 71 #include <dev/usb/ugraphire_rdesc.h> 72 /* Report descriptor for game controllers in "XInput" mode */ 73 #include <dev/usb/xinput_rdesc.h> 74 /* Report descriptor for Xbox One controllers */ 75 #include <dev/usb/x1input_rdesc.h> 76 77 #include "locators.h" 78 79 struct uhidev_softc { 80 device_t sc_dev; /* base device */ 81 struct usbd_device *sc_udev; 82 struct usbd_interface *sc_iface; /* interface */ 83 int sc_iep_addr; 84 int sc_oep_addr; 85 u_int sc_isize; 86 87 int sc_repdesc_size; 88 void *sc_repdesc; 89 90 u_int sc_nrepid; 91 struct uhidev { 92 struct uhidev_softc *sc_parent; 93 device_t sc_dev; 94 void (*sc_intr)(void *, void *, u_int); 95 void *sc_cookie; 96 krndsource_t sc_rndsource; 97 int sc_in_rep_size; 98 uint8_t sc_report_id; 99 uint8_t sc_state; 100 #define UHIDEV_OPEN 0x01 /* device is open */ 101 #define UHIDEV_STOPPED 0x02 /* xfers are stopped */ 102 } *sc_subdevs; 103 104 kmutex_t sc_lock; 105 kcondvar_t sc_cv; 106 107 /* Read/written under sc_lock. */ 108 struct lwp *sc_writelock; 109 struct lwp *sc_configlock; 110 int sc_refcnt; 111 int sc_writereportid; 112 int sc_stopreportid; 113 114 /* 115 * - Read under sc_lock, provided sc_refcnt > 0. 116 * - Written under sc_configlock only when transitioning to and 117 * from sc_refcnt = 0. 118 */ 119 u_char *sc_ibuf; 120 struct usbd_pipe *sc_ipipe; /* input interrupt pipe */ 121 struct usbd_pipe *sc_opipe; /* output interrupt pipe */ 122 struct usbd_xfer *sc_oxfer; /* write request */ 123 usbd_callback sc_writecallback; /* async write request callback */ 124 void *sc_writecookie; 125 126 u_int sc_flags; 127 #define UHIDEV_F_XB1 0x0001 /* Xbox 1 controller */ 128 }; 129 130 #ifdef UHIDEV_DEBUG 131 #define DPRINTF(x) if (uhidevdebug) printf x 132 #define DPRINTFN(n,x) if (uhidevdebug>(n)) printf x 133 int uhidevdebug = 0; 134 #else 135 #define DPRINTF(x) 136 #define DPRINTFN(n,x) 137 #endif 138 139 static void uhidev_intr(struct usbd_xfer *, void *, usbd_status); 140 141 static int uhidev_maxrepid(void *, int); 142 static int uhidevprint(void *, const char *); 143 144 static int uhidev_match(device_t, cfdata_t, void *); 145 static void uhidev_attach(device_t, device_t, void *); 146 static void uhidev_childdet(device_t, device_t); 147 static int uhidev_detach(device_t, int); 148 149 CFATTACH_DECL2_NEW(uhidev, sizeof(struct uhidev_softc), uhidev_match, 150 uhidev_attach, uhidev_detach, NULL, NULL, uhidev_childdet); 151 152 static int 153 uhidev_match(device_t parent, cfdata_t match, void *aux) 154 { 155 struct usbif_attach_arg *uiaa = aux; 156 157 /* Game controllers in "XInput" mode */ 158 if (USBIF_IS_XINPUT(uiaa)) 159 return UMATCH_IFACECLASS_IFACESUBCLASS_IFACEPROTO; 160 /* Xbox One controllers */ 161 if (USBIF_IS_X1INPUT(uiaa) && uiaa->uiaa_ifaceno == 0) 162 return UMATCH_IFACECLASS_IFACESUBCLASS_IFACEPROTO; 163 164 if (uiaa->uiaa_class != UICLASS_HID) 165 return UMATCH_NONE; 166 if (usbd_get_quirks(uiaa->uiaa_device)->uq_flags & UQ_HID_IGNORE) 167 return UMATCH_NONE; 168 return UMATCH_IFACECLASS_GENERIC; 169 } 170 171 static void 172 uhidev_attach(device_t parent, device_t self, void *aux) 173 { 174 struct uhidev_softc *sc = device_private(self); 175 struct usbif_attach_arg *uiaa = aux; 176 struct usbd_interface *iface = uiaa->uiaa_iface; 177 usb_interface_descriptor_t *id; 178 usb_endpoint_descriptor_t *ed; 179 struct uhidev_attach_arg uha; 180 device_t dev; 181 int maxinpktsize, size, nrepid, repid, repsz; 182 int *repsizes; 183 int i; 184 void *desc; 185 const void *descptr; 186 usbd_status err; 187 char *devinfop; 188 int locs[UHIDBUSCF_NLOCS]; 189 190 sc->sc_dev = self; 191 sc->sc_udev = uiaa->uiaa_device; 192 sc->sc_iface = iface; 193 194 aprint_naive("\n"); 195 aprint_normal("\n"); 196 197 mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_SOFTUSB); 198 cv_init(&sc->sc_cv, "uhidev"); 199 sc->sc_writelock = NULL; 200 sc->sc_configlock = NULL; 201 sc->sc_refcnt = 0; 202 sc->sc_writereportid = -1; 203 sc->sc_stopreportid = -1; 204 205 id = usbd_get_interface_descriptor(iface); 206 207 devinfop = usbd_devinfo_alloc(uiaa->uiaa_device, 0); 208 aprint_normal_dev(self, "%s, iclass %d/%d\n", 209 devinfop, id->bInterfaceClass, id->bInterfaceSubClass); 210 usbd_devinfo_free(devinfop); 211 212 if (!pmf_device_register(self, NULL, NULL)) 213 aprint_error_dev(self, "couldn't establish power handler\n"); 214 215 if (uiaa->uiaa_vendor == USB_VENDOR_WACOM) { 216 if (uiaa->uiaa_product == USB_PRODUCT_WACOM_XD0912U) { 217 /* 218 * Wacom Intuos2 (XD-0912-U) requires longer idle time to 219 * initialize the device with 0x0202. 220 */ 221 DELAY(500000); 222 } 223 } 224 (void)usbd_set_idle(iface, 0, 0); 225 226 #if 0 227 /* 228 * HID 1.11 says we should do this, but the device firmware is 229 * supposed to come up in Report Protocol after reset anyway, and 230 * apparently explicitly requesting it confuses some devices. 231 */ 232 if ((usbd_get_quirks(sc->sc_udev)->uq_flags & UQ_NO_SET_PROTO) == 0 && 233 id->bInterfaceSubClass == UISUBCLASS_BOOT) 234 (void)usbd_set_protocol(iface, 1); 235 #endif 236 237 maxinpktsize = 0; 238 sc->sc_iep_addr = sc->sc_oep_addr = -1; 239 for (i = 0; i < id->bNumEndpoints; i++) { 240 ed = usbd_interface2endpoint_descriptor(iface, i); 241 if (ed == NULL) { 242 aprint_error_dev(self, 243 "could not read endpoint descriptor\n"); 244 return; 245 } 246 247 DPRINTFN(10,("uhidev_attach: bLength=%d bDescriptorType=%d " 248 "bEndpointAddress=%d-%s bmAttributes=%d wMaxPacketSize=%d" 249 " bInterval=%d\n", 250 ed->bLength, ed->bDescriptorType, 251 ed->bEndpointAddress & UE_ADDR, 252 UE_GET_DIR(ed->bEndpointAddress)==UE_DIR_IN? "in" : "out", 253 ed->bmAttributes & UE_XFERTYPE, 254 UGETW(ed->wMaxPacketSize), ed->bInterval)); 255 256 if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN && 257 (ed->bmAttributes & UE_XFERTYPE) == UE_INTERRUPT) { 258 maxinpktsize = UGETW(ed->wMaxPacketSize); 259 sc->sc_iep_addr = ed->bEndpointAddress; 260 } else if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT && 261 (ed->bmAttributes & UE_XFERTYPE) == UE_INTERRUPT) { 262 sc->sc_oep_addr = ed->bEndpointAddress; 263 } else { 264 aprint_verbose_dev(self, "endpoint %d: ignored\n", i); 265 } 266 } 267 268 /* 269 * Check that we found an input interrupt endpoint. The output interrupt 270 * endpoint is optional 271 */ 272 if (sc->sc_iep_addr == -1) { 273 aprint_error_dev(self, "no input interrupt endpoint\n"); 274 return; 275 } 276 277 /* XXX need to extend this */ 278 descptr = NULL; 279 if (uiaa->uiaa_vendor == USB_VENDOR_WACOM) { 280 static uByte reportbuf[3]; 281 282 /* The report descriptor for the Wacom Graphire is broken. */ 283 switch (uiaa->uiaa_product) { 284 case USB_PRODUCT_WACOM_GRAPHIRE3_4X5: 285 case USB_PRODUCT_WACOM_GRAPHIRE3_6X8: 286 case USB_PRODUCT_WACOM_GRAPHIRE4_4X5: /* The 6x8 too? */ 287 /* 288 * The Graphire3 needs 0x0202 to be written to 289 * feature report ID 2 before it'll start 290 * returning digitizer data. 291 */ 292 reportbuf[0] = 0x02; 293 reportbuf[1] = 0x02; 294 usbd_set_report(uiaa->uiaa_iface, UHID_FEATURE_REPORT, 2, 295 &reportbuf, 2); 296 297 size = sizeof(uhid_graphire3_4x5_report_descr); 298 descptr = uhid_graphire3_4x5_report_descr; 299 break; 300 case USB_PRODUCT_WACOM_GRAPHIRE: 301 case USB_PRODUCT_WACOM_GRAPHIRE2: 302 case USB_PRODUCT_WACOM_XD0912U: 303 case USB_PRODUCT_WACOM_CTH690K0: 304 reportbuf[0] = 0x02; 305 reportbuf[1] = 0x02; 306 usbd_set_report(uiaa->uiaa_iface, UHID_FEATURE_REPORT, 2, 307 &reportbuf, 2); 308 break; 309 default: 310 /* Keep descriptor */ 311 break; 312 } 313 } 314 if (USBIF_IS_XINPUT(uiaa)) { 315 size = sizeof(uhid_xinput_report_descr); 316 descptr = uhid_xinput_report_descr; 317 } 318 if (USBIF_IS_X1INPUT(uiaa)) { 319 sc->sc_flags |= UHIDEV_F_XB1; 320 size = sizeof(uhid_x1input_report_descr); 321 descptr = uhid_x1input_report_descr; 322 } 323 324 if (descptr) { 325 desc = kmem_alloc(size, KM_SLEEP); 326 err = USBD_NORMAL_COMPLETION; 327 memcpy(desc, descptr, size); 328 } else { 329 desc = NULL; 330 err = usbd_read_report_desc(uiaa->uiaa_iface, &desc, &size); 331 } 332 if (err) { 333 aprint_error_dev(self, "no report descriptor\n"); 334 return; 335 } 336 337 if (uiaa->uiaa_vendor == USB_VENDOR_HOSIDEN && 338 uiaa->uiaa_product == USB_PRODUCT_HOSIDEN_PPP) { 339 static uByte reportbuf[] = { 1 }; 340 /* 341 * This device was sold by Konami with its ParaParaParadise 342 * game for PlayStation2. It needs to be "turned on" 343 * before it will send any reports. 344 */ 345 346 usbd_set_report(uiaa->uiaa_iface, UHID_FEATURE_REPORT, 0, 347 &reportbuf, sizeof(reportbuf)); 348 } 349 350 if (uiaa->uiaa_vendor == USB_VENDOR_LOGITECH && 351 uiaa->uiaa_product == USB_PRODUCT_LOGITECH_CBT44 && size == 0xb1) { 352 uint8_t *data = desc; 353 /* 354 * This device has a odd USAGE_MINIMUM value that would 355 * cause the multimedia keys to have their usage number 356 * shifted up one usage. Adjust so the usages are sane. 357 */ 358 359 if (data[0x56] == 0x19 && data[0x57] == 0x01 && 360 data[0x58] == 0x2a && data[0x59] == 0x8c) 361 data[0x57] = 0x00; 362 } 363 364 /* 365 * Enable the Six Axis and DualShock 3 controllers. 366 * See http://ps3.jim.sh/sixaxis/usb/ 367 */ 368 if (uiaa->uiaa_vendor == USB_VENDOR_SONY && 369 uiaa->uiaa_product == USB_PRODUCT_SONY_PS3CONTROLLER) { 370 usb_device_request_t req; 371 char data[17]; 372 int actlen; 373 374 req.bmRequestType = UT_READ_CLASS_INTERFACE; 375 req.bRequest = 1; 376 USETW(req.wValue, 0x3f2); 377 USETW(req.wIndex, 0); 378 USETW(req.wLength, sizeof(data)); 379 380 usbd_do_request_flags(sc->sc_udev, &req, data, 381 USBD_SHORT_XFER_OK, &actlen, USBD_DEFAULT_TIMEOUT); 382 } 383 384 sc->sc_repdesc = desc; 385 sc->sc_repdesc_size = size; 386 387 uha.uiaa = uiaa; 388 nrepid = uhidev_maxrepid(desc, size); 389 if (nrepid < 0) 390 return; 391 if (nrepid > 0) 392 aprint_normal_dev(self, "%d report ids\n", nrepid); 393 nrepid++; 394 repsizes = kmem_alloc(nrepid * sizeof(*repsizes), KM_SLEEP); 395 sc->sc_subdevs = kmem_zalloc(nrepid * sizeof(sc->sc_subdevs[0]), 396 KM_SLEEP); 397 398 /* Just request max packet size for the interrupt pipe */ 399 sc->sc_isize = maxinpktsize; 400 sc->sc_nrepid = nrepid; 401 402 usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev, sc->sc_dev); 403 404 for (repid = 0; repid < nrepid; repid++) { 405 repsz = hid_report_size(desc, size, hid_input, repid); 406 DPRINTF(("uhidev_match: repid=%d, repsz=%d\n", repid, repsz)); 407 repsizes[repid] = repsz; 408 } 409 410 DPRINTF(("uhidev_attach: isize=%d\n", sc->sc_isize)); 411 412 for (repid = 0; repid < nrepid; repid++) { 413 struct uhidev *scd = &sc->sc_subdevs[repid]; 414 415 scd->sc_parent = sc; 416 scd->sc_report_id = repid; 417 scd->sc_in_rep_size = repsizes[repid]; 418 419 DPRINTF(("uhidev_match: try repid=%d\n", repid)); 420 if (hid_report_size(desc, size, hid_input, repid) == 0 && 421 hid_report_size(desc, size, hid_output, repid) == 0 && 422 hid_report_size(desc, size, hid_feature, repid) == 0) { 423 ; /* already NULL in sc->sc_subdevs[repid] */ 424 } else { 425 uha.parent = scd; 426 uha.reportid = repid; 427 locs[UHIDBUSCF_REPORTID] = repid; 428 429 dev = config_found(self, &uha, uhidevprint, 430 CFARGS(.submatch = config_stdsubmatch, 431 .locators = locs)); 432 sc->sc_subdevs[repid].sc_dev = dev; 433 if (dev == NULL) 434 continue; 435 /* 436 * XXXSMP -- could be detached in the middle of 437 * sleeping for allocation in rnd_attach_source 438 */ 439 rnd_attach_source(&scd->sc_rndsource, 440 device_xname(dev), RND_TYPE_TTY, RND_FLAG_DEFAULT); 441 } 442 } 443 kmem_free(repsizes, nrepid * sizeof(*repsizes)); 444 445 return; 446 } 447 448 static int 449 uhidev_maxrepid(void *buf, int len) 450 { 451 struct hid_data *d; 452 struct hid_item h; 453 int maxid; 454 455 maxid = -1; 456 h.report_ID = 0; 457 for (d = hid_start_parse(buf, len, hid_none); hid_get_item(d, &h); ) 458 if ((int)h.report_ID > maxid) 459 maxid = h.report_ID; 460 hid_end_parse(d); 461 return MIN(maxid, UHIDEV_MAXREPID); 462 } 463 464 static int 465 uhidevprint(void *aux, const char *pnp) 466 { 467 struct uhidev_attach_arg *uha = aux; 468 469 if (pnp) 470 aprint_normal("uhid at %s", pnp); 471 if (uha->reportid != 0) 472 aprint_normal(" reportid %d", uha->reportid); 473 return UNCONF; 474 } 475 476 static void 477 uhidev_childdet(device_t self, device_t child) 478 { 479 int i; 480 struct uhidev_softc *sc = device_private(self); 481 482 for (i = 0; i < sc->sc_nrepid; i++) { 483 if (sc->sc_subdevs[i].sc_dev == child) 484 break; 485 } 486 KASSERT(i < sc->sc_nrepid); 487 sc->sc_subdevs[i].sc_dev = NULL; 488 /* 489 * XXXSMP -- could be reattached in the middle of sleeping for 490 * lock on sources to delete this in rnd_attach_source 491 * 492 * (Actually this can't happen right now because there's no 493 * rescan method, but if there were, it could.) 494 */ 495 rnd_detach_source(&sc->sc_subdevs[i].sc_rndsource); 496 } 497 498 static int 499 uhidev_detach(device_t self, int flags) 500 { 501 struct uhidev_softc *sc = device_private(self); 502 int rv; 503 504 DPRINTF(("uhidev_detach: sc=%p flags=%d\n", sc, flags)); 505 506 /* 507 * Try to detach all our children. If anything fails, bail. 508 * Failure can happen if this is from drvctl -d; of course, if 509 * this is a USB device being yanked, flags will have 510 * DETACH_FORCE and the children will not have the option of 511 * refusing detachment. If they do detach, the pipes can no 512 * longer be in use. 513 */ 514 rv = config_detach_children(self, flags); 515 if (rv) 516 return rv; 517 518 KASSERTMSG(sc->sc_refcnt == 0, 519 "%s: %d refs remain", device_xname(sc->sc_dev), sc->sc_refcnt); 520 KASSERT(sc->sc_opipe == NULL); 521 KASSERT(sc->sc_ipipe == NULL); 522 KASSERT(sc->sc_ibuf == NULL); 523 524 if (sc->sc_repdesc != NULL) { 525 kmem_free(sc->sc_repdesc, sc->sc_repdesc_size); 526 sc->sc_repdesc = NULL; 527 } 528 if (sc->sc_subdevs != NULL) { 529 int nrepid = sc->sc_nrepid; 530 kmem_free(sc->sc_subdevs, nrepid * sizeof(sc->sc_subdevs[0])); 531 sc->sc_subdevs = NULL; 532 } 533 534 usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev, sc->sc_dev); 535 536 pmf_device_deregister(self); 537 KASSERT(sc->sc_configlock == NULL); 538 KASSERT(sc->sc_writelock == NULL); 539 cv_destroy(&sc->sc_cv); 540 mutex_destroy(&sc->sc_lock); 541 542 return rv; 543 } 544 545 static void 546 uhidev_intr(struct usbd_xfer *xfer, void *addr, usbd_status status) 547 { 548 struct uhidev_softc *sc = addr; 549 struct uhidev *scd; 550 u_char *p; 551 u_int rep; 552 uint32_t cc; 553 554 usbd_get_xfer_status(xfer, NULL, NULL, &cc, NULL); 555 556 #ifdef UHIDEV_DEBUG 557 if (uhidevdebug > 5) { 558 uint32_t i; 559 560 DPRINTF(("uhidev_intr: status=%d cc=%d\n", status, cc)); 561 DPRINTF(("uhidev_intr: data =")); 562 for (i = 0; i < cc; i++) 563 DPRINTF((" %02x", sc->sc_ibuf[i])); 564 DPRINTF(("\n")); 565 } 566 #endif 567 568 if (status == USBD_CANCELLED) 569 return; 570 571 if (status != USBD_NORMAL_COMPLETION) { 572 DPRINTF(("%s: interrupt status=%d\n", device_xname(sc->sc_dev), 573 status)); 574 usbd_clear_endpoint_stall_async(sc->sc_ipipe); 575 return; 576 } 577 578 p = sc->sc_ibuf; 579 if (sc->sc_nrepid != 1) 580 rep = *p++, cc--; 581 else 582 rep = 0; 583 if (rep >= sc->sc_nrepid) { 584 printf("uhidev_intr: bad repid %d\n", rep); 585 return; 586 } 587 scd = &sc->sc_subdevs[rep]; 588 DPRINTFN(5,("uhidev_intr: rep=%d, scd=%p state=%#x\n", 589 rep, scd, scd->sc_state)); 590 if (!(atomic_load_acquire(&scd->sc_state) & UHIDEV_OPEN)) 591 return; 592 #ifdef UHIDEV_DEBUG 593 if (scd->sc_in_rep_size != cc) { 594 DPRINTF(("%s: expected %d bytes, got %d\n", 595 device_xname(sc->sc_dev), scd->sc_in_rep_size, cc)); 596 } 597 #endif 598 if (cc == 0) { 599 DPRINTF(("%s: 0-length input ignored\n", 600 device_xname(sc->sc_dev))); 601 return; 602 } 603 rnd_add_uint32(&scd->sc_rndsource, (uintptr_t)(sc->sc_ibuf)); 604 scd->sc_intr(scd->sc_cookie, p, cc); 605 } 606 607 void 608 uhidev_get_report_desc(struct uhidev *scd, void **desc, int *size) 609 { 610 struct uhidev_softc *sc = scd->sc_parent; 611 612 *desc = sc->sc_repdesc; 613 *size = sc->sc_repdesc_size; 614 } 615 616 static int 617 uhidev_config_enter(struct uhidev_softc *sc) 618 { 619 int error; 620 621 KASSERT(mutex_owned(&sc->sc_lock)); 622 623 for (;;) { 624 if (sc->sc_configlock == NULL) 625 break; 626 error = cv_wait_sig(&sc->sc_cv, &sc->sc_lock); 627 if (error) 628 return error; 629 } 630 631 sc->sc_configlock = curlwp; 632 return 0; 633 } 634 635 static void 636 uhidev_config_enter_nointr(struct uhidev_softc *sc) 637 { 638 639 KASSERT(mutex_owned(&sc->sc_lock)); 640 641 while (sc->sc_configlock) 642 cv_wait(&sc->sc_cv, &sc->sc_lock); 643 sc->sc_configlock = curlwp; 644 } 645 646 static void 647 uhidev_config_exit(struct uhidev_softc *sc) 648 { 649 650 KASSERT(mutex_owned(&sc->sc_lock)); 651 KASSERTMSG(sc->sc_configlock == curlwp, "%s: migrated from %p to %p", 652 device_xname(sc->sc_dev), curlwp, sc->sc_configlock); 653 654 sc->sc_configlock = NULL; 655 cv_broadcast(&sc->sc_cv); 656 } 657 658 /* 659 * uhidev_open_pipes(sc) 660 * 661 * Ensure the pipes of the softc are open. Caller must hold 662 * sc_lock, which may be released and reacquired. 663 */ 664 static int 665 uhidev_open_pipes(struct uhidev_softc *sc) 666 { 667 usbd_status err; 668 int error; 669 670 KASSERT(mutex_owned(&sc->sc_lock)); 671 672 /* 673 * If the pipes are already open, just increment the reference 674 * count. The reference count is limited by the number of 675 * report ids, so this can't overflow. 676 */ 677 if (sc->sc_refcnt) { 678 KASSERT(sc->sc_refcnt < UHIDEV_MAXREPID); 679 sc->sc_refcnt++; 680 return 0; 681 } 682 683 /* 684 * If there's no input data to prepare, don't bother with the 685 * pipes. We assume any device that does output also does 686 * input; if you have a device where this is wrong, then 687 * uhidev_write will fail gracefully (it checks sc->sc_opipe), 688 * and you can use that device to test the changes needed to 689 * open the output pipe here. 690 */ 691 if (sc->sc_isize == 0) 692 return 0; 693 694 /* 695 * Lock the configuration and release sc_lock -- we may sleep 696 * to allocate. If someone else got in first, we're done; 697 * otherwise open the pipes. 698 */ 699 error = uhidev_config_enter(sc); 700 if (error) 701 goto out; 702 if (sc->sc_refcnt) { 703 KASSERT(sc->sc_refcnt < UHIDEV_MAXREPID); 704 sc->sc_refcnt++; 705 error = 0; 706 goto out0; 707 } 708 mutex_exit(&sc->sc_lock); 709 710 /* Allocate an input buffer. */ 711 sc->sc_ibuf = kmem_alloc(sc->sc_isize, KM_SLEEP); 712 713 /* Set up input interrupt pipe. */ 714 DPRINTF(("%s: isize=%d, ep=0x%02x\n", __func__, sc->sc_isize, 715 sc->sc_iep_addr)); 716 717 err = usbd_open_pipe_intr(sc->sc_iface, sc->sc_iep_addr, 718 USBD_SHORT_XFER_OK, &sc->sc_ipipe, sc, sc->sc_ibuf, 719 sc->sc_isize, uhidev_intr, USBD_DEFAULT_INTERVAL); 720 if (err != USBD_NORMAL_COMPLETION) { 721 DPRINTF(("uhidopen: usbd_open_pipe_intr failed, " 722 "error=%d\n", err)); 723 error = EIO; 724 goto out1; 725 } 726 727 /* 728 * Set up output interrupt pipe if an output interrupt endpoint 729 * exists. 730 */ 731 if (sc->sc_oep_addr != -1) { 732 DPRINTF(("uhidev_open: oep=0x%02x\n", sc->sc_oep_addr)); 733 734 err = usbd_open_pipe(sc->sc_iface, sc->sc_oep_addr, 735 0, &sc->sc_opipe); 736 737 if (err != USBD_NORMAL_COMPLETION) { 738 DPRINTF(("uhidev_open: usbd_open_pipe failed, " 739 "error=%d\n", err)); 740 error = EIO; 741 goto out2; 742 } 743 DPRINTF(("uhidev_open: sc->sc_opipe=%p\n", sc->sc_opipe)); 744 745 error = usbd_create_xfer(sc->sc_opipe, UHIDEV_OSIZE, 0, 0, 746 &sc->sc_oxfer); 747 if (error) { 748 DPRINTF(("uhidev_open: couldn't allocate an xfer\n")); 749 goto out3; 750 } 751 752 if (sc->sc_flags & UHIDEV_F_XB1) { 753 uint8_t init_data[] = { 0x05, 0x20 }; 754 int init_data_len = sizeof(init_data); 755 err = usbd_intr_transfer(sc->sc_oxfer, sc->sc_opipe, 0, 756 USBD_NO_TIMEOUT, init_data, &init_data_len); 757 if (err != USBD_NORMAL_COMPLETION) { 758 DPRINTF(("uhidev_open: xb1 init failed, " 759 "error=%d\n", err)); 760 error = EIO; 761 goto out4; 762 } 763 } 764 } 765 766 /* Success! */ 767 mutex_enter(&sc->sc_lock); 768 KASSERTMSG(sc->sc_refcnt == 0, "%d refs spuriously acquired", 769 sc->sc_refcnt); 770 sc->sc_refcnt++; 771 goto out0; 772 773 out4: if (sc->sc_oxfer) { 774 usbd_abort_pipe(sc->sc_opipe); 775 usbd_destroy_xfer(sc->sc_oxfer); 776 sc->sc_oxfer = NULL; 777 } 778 out3: if (sc->sc_opipe) { 779 usbd_close_pipe(sc->sc_opipe); 780 sc->sc_opipe = NULL; 781 } 782 out2: if (sc->sc_ipipe) { 783 usbd_abort_pipe(sc->sc_ipipe); 784 usbd_close_pipe(sc->sc_ipipe); 785 sc->sc_ipipe = NULL; 786 } 787 out1: kmem_free(sc->sc_ibuf, sc->sc_isize); 788 sc->sc_ibuf = NULL; 789 mutex_enter(&sc->sc_lock); 790 out0: KASSERT(mutex_owned(&sc->sc_lock)); 791 uhidev_config_exit(sc); 792 out: KASSERT(mutex_owned(&sc->sc_lock)); 793 return error; 794 } 795 796 static void 797 uhidev_close_pipes(struct uhidev_softc *sc) 798 { 799 800 KASSERT(mutex_owned(&sc->sc_lock)); 801 KASSERTMSG(sc->sc_refcnt > 0, "%s: refcnt fouled: %d", 802 device_xname(sc->sc_dev), sc->sc_refcnt); 803 804 /* If this isn't the last reference, just decrement. */ 805 if (sc->sc_refcnt > 1) { 806 sc->sc_refcnt--; 807 return; 808 } 809 810 /* 811 * Lock the configuration and release sc_lock so we may sleep 812 * to free memory. We're not waiting for anyone to allocate or 813 * free anything. 814 */ 815 uhidev_config_enter_nointr(sc); 816 817 /* 818 * If someone else acquired a reference while we were waiting 819 * for the config lock, nothing more for us to do. 820 */ 821 if (sc->sc_refcnt > 1) { 822 sc->sc_refcnt--; 823 uhidev_config_exit(sc); 824 return; 825 } 826 827 /* 828 * We're the last reference and committed to closing the pipes. 829 * Decrement the reference count before we release the lock -- 830 * access to the pipes is allowed as long as the reference 831 * count is positive, so this forces all new opens to wait 832 * until the config lock is released. 833 */ 834 KASSERTMSG(sc->sc_refcnt == 1, "%s: refcnt fouled: %d", 835 device_xname(sc->sc_dev), sc->sc_refcnt); 836 sc->sc_refcnt--; 837 mutex_exit(&sc->sc_lock); 838 839 if (sc->sc_oxfer) { 840 usbd_abort_pipe(sc->sc_opipe); 841 usbd_destroy_xfer(sc->sc_oxfer); 842 sc->sc_oxfer = NULL; 843 } 844 if (sc->sc_opipe) { 845 usbd_close_pipe(sc->sc_opipe); 846 sc->sc_opipe = NULL; 847 } 848 if (sc->sc_ipipe) { 849 usbd_abort_pipe(sc->sc_ipipe); 850 usbd_close_pipe(sc->sc_ipipe); 851 sc->sc_ipipe = NULL; 852 } 853 kmem_free(sc->sc_ibuf, sc->sc_isize); 854 sc->sc_ibuf = NULL; 855 856 mutex_enter(&sc->sc_lock); 857 uhidev_config_exit(sc); 858 KASSERTMSG(sc->sc_refcnt == 0, "%s: refcnt fouled: %d", 859 device_xname(sc->sc_dev), sc->sc_refcnt); 860 } 861 862 int 863 uhidev_open(struct uhidev *scd, void (*intr)(void *, void *, u_int), 864 void *cookie) 865 { 866 struct uhidev_softc *sc = scd->sc_parent; 867 int error; 868 869 mutex_enter(&sc->sc_lock); 870 871 DPRINTF(("uhidev_open(%s, report %d = %s): state=%x refcnt=%d\n", 872 device_xname(sc->sc_dev), 873 scd->sc_report_id, 874 device_xname(scd->sc_dev), 875 scd->sc_state, 876 sc->sc_refcnt)); 877 878 /* Mark the report id open. This is an exclusive lock. */ 879 if (scd->sc_state & UHIDEV_OPEN) { 880 error = EBUSY; 881 goto out; 882 } 883 scd->sc_intr = intr; 884 scd->sc_cookie = cookie; 885 atomic_store_release(&scd->sc_state, scd->sc_state | UHIDEV_OPEN); 886 887 /* Open the pipes which are shared by all report ids. */ 888 error = uhidev_open_pipes(sc); 889 if (error) 890 goto out; 891 892 /* Success! */ 893 error = 0; 894 895 out: if (error) { 896 KASSERTMSG(scd->sc_state & UHIDEV_OPEN, 897 "%s: report id %d: closed while opening", 898 device_xname(sc->sc_dev), scd->sc_report_id); 899 atomic_store_relaxed(&scd->sc_state, 900 scd->sc_state & ~UHIDEV_OPEN); 901 } 902 mutex_exit(&sc->sc_lock); 903 return error; 904 } 905 906 /* 907 * uhidev_stop(scd) 908 * 909 * Make all current and future output reports or xfers by scd to 910 * the output pipe to fail. Caller must then ensure no more will 911 * be submitted and then call uhidev_close. 912 * 913 * Side effect: If uhidev_write was in progress for this scd, 914 * blocks all other uhidev_writes until uhidev_close on this scd. 915 * 916 * May sleep but only for a short duration to wait for USB 917 * transfer completion callbacks to run. 918 */ 919 void 920 uhidev_stop(struct uhidev *scd) 921 { 922 struct uhidev_softc *sc = scd->sc_parent; 923 924 mutex_enter(&sc->sc_lock); 925 926 /* Prevent further writes on this report from starting. */ 927 atomic_store_relaxed(&scd->sc_state, scd->sc_state | UHIDEV_STOPPED); 928 929 /* If there's no output pipe at all, nothing to do. */ 930 if (sc->sc_opipe == NULL) 931 goto out; 932 933 /* 934 * If there's no write on this report in progress, nothing to 935 * do -- any subsequent attempts will be prevented by 936 * UHIDEV_STOPPED. 937 */ 938 if (sc->sc_writereportid != scd->sc_report_id) 939 goto out; 940 941 /* 942 * Caller must wait for uhidev_open to succeed before calling 943 * uhidev_write, and must wait for all uhidev_writes to return 944 * before calling uhidev_close, so neither on can be in flight 945 * right now. 946 * 947 * Suspend the pipe, but hold up uhidev_write from any report 948 * until we confirm this one has finished. We will resume the 949 * pipe only after all uhidev_writes on this report have 950 * finished -- when the caller calls uhidev_close. 951 */ 952 KASSERTMSG(sc->sc_stopreportid == -1, "%d", sc->sc_stopreportid); 953 sc->sc_stopreportid = scd->sc_report_id; 954 mutex_exit(&sc->sc_lock); 955 956 usbd_suspend_pipe(sc->sc_opipe); 957 958 mutex_enter(&sc->sc_lock); 959 KASSERT(sc->sc_stopreportid == scd->sc_report_id); 960 sc->sc_stopreportid = scd->sc_report_id; 961 cv_broadcast(&sc->sc_cv); 962 out: mutex_exit(&sc->sc_lock); 963 } 964 965 /* 966 * uhidev_close(scd) 967 * 968 * Close a uhidev previously opened with uhidev_open. If writes 969 * had been stopped with uhidev_stop, allow writes at other report 970 * ids again. 971 */ 972 void 973 uhidev_close(struct uhidev *scd) 974 { 975 struct uhidev_softc *sc = scd->sc_parent; 976 977 mutex_enter(&sc->sc_lock); 978 979 DPRINTF(("uhidev_close(%s, report %d = %s): state=%x refcnt=%d\n", 980 device_xname(sc->sc_dev), 981 scd->sc_report_id, 982 device_xname(scd->sc_dev), 983 scd->sc_state, 984 sc->sc_refcnt)); 985 986 KASSERTMSG(scd->sc_state & UHIDEV_OPEN, 987 "%s: report id %d: unpaired close", 988 device_xname(sc->sc_dev), scd->sc_report_id); 989 990 /* 991 * If the caller had issued uhidev_stop to interrupt a write 992 * for this report, then resume the pipe now that no further 993 * uhidev_write on the same report is possible, and wake anyone 994 * trying to write on other reports. 995 */ 996 if (sc->sc_stopreportid == scd->sc_report_id) { 997 KASSERT(scd->sc_state & UHIDEV_STOPPED); 998 mutex_exit(&sc->sc_lock); 999 1000 usbd_resume_pipe(sc->sc_opipe); 1001 1002 mutex_enter(&sc->sc_lock); 1003 KASSERT(sc->sc_stopreportid == scd->sc_report_id); 1004 KASSERT(scd->sc_state & UHIDEV_STOPPED); 1005 sc->sc_stopreportid = -1; 1006 cv_broadcast(&sc->sc_cv); 1007 } 1008 1009 /* 1010 * Close our reference to the pipes, and mark our report as no 1011 * longer open. If it was stopped, clear that too -- drivers 1012 * are forbidden from issuing writes after uhidev_close anyway. 1013 */ 1014 KASSERT(scd->sc_state & UHIDEV_OPEN); 1015 uhidev_close_pipes(sc); 1016 KASSERT(scd->sc_state & UHIDEV_OPEN); 1017 atomic_store_relaxed(&scd->sc_state, 1018 scd->sc_state & ~(UHIDEV_OPEN | UHIDEV_STOPPED)); 1019 1020 /* 1021 * Make sure the next uhidev_intr (which runs in softint, like 1022 * XC_HIGHPRI) notices that UHIDEV_OPEN is cleared, and wait 1023 * for any current one to finish, in case the pipe is still 1024 * open for other report ids. 1025 * 1026 * We must drop the lock while doing this, because 1027 * uhidev_write_callback takes the lock in softint context and 1028 * it could deadlock with the xcall softint. 1029 * 1030 * It is safe to drop the lock now before zeroing sc_intr and 1031 * sc_cookie because the driver is obligated not to reopen 1032 * until after uhidev_close returns. 1033 */ 1034 mutex_exit(&sc->sc_lock); 1035 xc_barrier(XC_HIGHPRI); 1036 mutex_enter(&sc->sc_lock); 1037 KASSERT((scd->sc_state & UHIDEV_OPEN) == 0); 1038 scd->sc_intr = NULL; 1039 scd->sc_cookie = NULL; 1040 1041 mutex_exit(&sc->sc_lock); 1042 } 1043 1044 usbd_status 1045 uhidev_set_report(struct uhidev *scd, int type, void *data, int len) 1046 { 1047 char *buf; 1048 usbd_status retstat; 1049 1050 if (scd->sc_report_id == 0) 1051 return usbd_set_report(scd->sc_parent->sc_iface, type, 1052 scd->sc_report_id, data, len); 1053 1054 buf = kmem_alloc(len + 1, KM_SLEEP); 1055 buf[0] = scd->sc_report_id; 1056 memcpy(buf+1, data, len); 1057 1058 retstat = usbd_set_report(scd->sc_parent->sc_iface, type, 1059 scd->sc_report_id, buf, len + 1); 1060 1061 kmem_free(buf, len + 1); 1062 1063 return retstat; 1064 } 1065 1066 usbd_status 1067 uhidev_get_report(struct uhidev *scd, int type, void *data, int len) 1068 { 1069 return usbd_get_report(scd->sc_parent->sc_iface, type, 1070 scd->sc_report_id, data, len); 1071 } 1072 1073 usbd_status 1074 uhidev_write(struct uhidev *scd, void *data, int len) 1075 { 1076 struct uhidev_softc *sc = scd->sc_parent; 1077 usbd_status err; 1078 1079 DPRINTF(("uhidev_write: data=%p, len=%d\n", data, len)); 1080 1081 if (sc->sc_opipe == NULL) 1082 return USBD_INVAL; 1083 1084 mutex_enter(&sc->sc_lock); 1085 KASSERT(sc->sc_refcnt); 1086 KASSERT(scd->sc_state & UHIDEV_OPEN); 1087 for (;;) { 1088 if (scd->sc_state & UHIDEV_STOPPED) { 1089 err = USBD_CANCELLED; 1090 goto out; 1091 } 1092 if (sc->sc_writelock == NULL && sc->sc_stopreportid == -1) 1093 break; 1094 if (cv_wait_sig(&sc->sc_cv, &sc->sc_lock)) { 1095 err = USBD_INTERRUPTED; 1096 goto out; 1097 } 1098 } 1099 sc->sc_writelock = curlwp; 1100 sc->sc_writereportid = scd->sc_report_id; 1101 mutex_exit(&sc->sc_lock); 1102 1103 #ifdef UHIDEV_DEBUG 1104 if (uhidevdebug > 50) { 1105 1106 uint32_t i; 1107 uint8_t *d = data; 1108 1109 DPRINTF(("uhidev_write: data =")); 1110 for (i = 0; i < len; i++) 1111 DPRINTF((" %02x", d[i])); 1112 DPRINTF(("\n")); 1113 } 1114 #endif 1115 err = usbd_intr_transfer(sc->sc_oxfer, sc->sc_opipe, 0, 1116 USBD_NO_TIMEOUT, data, &len); 1117 1118 mutex_enter(&sc->sc_lock); 1119 KASSERT(sc->sc_refcnt); 1120 KASSERT(scd->sc_state & UHIDEV_OPEN); 1121 KASSERTMSG(sc->sc_writelock == curlwp, "%s: migrated from %p to %p", 1122 device_xname(sc->sc_dev), curlwp, sc->sc_writelock); 1123 KASSERTMSG(sc->sc_writereportid == scd->sc_report_id, 1124 "%s: changed write report ids from %d to %d", 1125 device_xname(sc->sc_dev), scd->sc_report_id, sc->sc_writereportid); 1126 sc->sc_writereportid = -1; 1127 sc->sc_writelock = NULL; 1128 cv_broadcast(&sc->sc_cv); 1129 out: mutex_exit(&sc->sc_lock); 1130 return err; 1131 } 1132 1133 static void 1134 uhidev_write_callback(struct usbd_xfer *xfer, void *cookie, usbd_status err) 1135 { 1136 struct uhidev_softc *sc = cookie; 1137 usbd_callback writecallback; 1138 void *writecookie; 1139 1140 if (err) { 1141 if (err != USBD_CANCELLED) 1142 usbd_clear_endpoint_stall_async(sc->sc_opipe); 1143 } 1144 1145 mutex_enter(&sc->sc_lock); 1146 KASSERT(sc->sc_writelock == (void *)1); 1147 writecallback = sc->sc_writecallback; 1148 writecookie = sc->sc_writecookie; 1149 sc->sc_writereportid = -1; 1150 sc->sc_writelock = NULL; 1151 sc->sc_writecallback = NULL; 1152 sc->sc_writecookie = NULL; 1153 cv_broadcast(&sc->sc_cv); 1154 mutex_exit(&sc->sc_lock); 1155 1156 (*writecallback)(xfer, writecookie, err); 1157 } 1158 1159 usbd_status 1160 uhidev_write_async(struct uhidev *scd, void *data, int len, int flags, 1161 int timo, usbd_callback writecallback, void *writecookie) 1162 { 1163 struct uhidev_softc *sc = scd->sc_parent; 1164 usbd_status err; 1165 1166 DPRINTF(("%s: data=%p, len=%d\n", __func__, data, len)); 1167 1168 if (sc->sc_opipe == NULL) 1169 return USBD_INVAL; 1170 1171 mutex_enter(&sc->sc_lock); 1172 KASSERT(sc->sc_refcnt); 1173 KASSERT(scd->sc_state & UHIDEV_OPEN); 1174 if (scd->sc_state & UHIDEV_STOPPED) { 1175 err = USBD_CANCELLED; 1176 goto out; 1177 } 1178 if (sc->sc_writelock != NULL || sc->sc_stopreportid != -1) { 1179 err = USBD_IN_USE; 1180 goto out; 1181 } 1182 sc->sc_writelock = (void *)1; /* XXX no lwp to attribute async xfer */ 1183 sc->sc_writereportid = scd->sc_report_id; 1184 sc->sc_writecallback = writecallback; 1185 sc->sc_writecookie = writecookie; 1186 usbd_setup_xfer(sc->sc_oxfer, sc, data, len, flags, timo, 1187 uhidev_write_callback); 1188 err = usbd_transfer(sc->sc_oxfer); 1189 switch (err) { 1190 case USBD_IN_PROGRESS: 1191 break; 1192 case USBD_NORMAL_COMPLETION: 1193 panic("unexpected normal completion of async xfer under lock"); 1194 default: /* error */ 1195 sc->sc_writelock = NULL; 1196 sc->sc_writereportid = -1; 1197 sc->sc_writecallback = NULL; 1198 sc->sc_writecookie = NULL; 1199 cv_broadcast(&sc->sc_cv); 1200 } 1201 out: mutex_exit(&sc->sc_lock); 1202 return err; 1203 } 1204