xref: /openbsd-src/sys/dev/usb/uhidev.c (revision 99fd087599a8791921855f21bd7e36130f39aadc)
1 /*	$OpenBSD: uhidev.c,v 1.79 2020/02/22 14:01:34 jasper Exp $	*/
2 /*	$NetBSD: uhidev.c,v 1.14 2003/03/11 16:44:00 augustss Exp $	*/
3 
4 /*
5  * Copyright (c) 2001 The NetBSD Foundation, Inc.
6  * All rights reserved.
7  *
8  * This code is derived from software contributed to The NetBSD Foundation
9  * by Lennart Augustsson (lennart@augustsson.net) at
10  * Carlstedt Research & Technology.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
25  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 /*
35  * HID spec: http://www.usb.org/developers/devclass_docs/HID1_11.pdf
36  */
37 
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/kernel.h>
41 #include <sys/malloc.h>
42 #include <sys/signalvar.h>
43 #include <sys/device.h>
44 #include <sys/ioctl.h>
45 #include <sys/conf.h>
46 
47 #include <machine/bus.h>
48 
49 #include <dev/usb/usb.h>
50 #include <dev/usb/usbhid.h>
51 
52 #include <dev/usb/usbdevs.h>
53 #include <dev/usb/usbdi.h>
54 #include <dev/usb/usbdi_util.h>
55 #include <dev/usb/usbdivar.h>
56 #include <dev/usb/usb_mem.h>
57 #include <dev/usb/usb_quirks.h>
58 
59 #include <dev/usb/uhidev.h>
60 
61 #ifndef SMALL_KERNEL
62 /* Replacement report descriptors for devices shipped with broken ones */
63 #include <dev/usb/uhid_rdesc.h>
64 int uhidev_use_rdesc(struct uhidev_softc *, usb_interface_descriptor_t *,
65 		int, int, void **, int *);
66 #define UISUBCLASS_XBOX360_CONTROLLER 0x5d
67 #define UIPROTO_XBOX360_GAMEPAD 0x01
68 #endif /* !SMALL_KERNEL */
69 
70 #define DEVNAME(sc)		((sc)->sc_dev.dv_xname)
71 
72 #ifdef UHIDEV_DEBUG
73 #define DPRINTF(x)	do { if (uhidevdebug) printf x; } while (0)
74 #define DPRINTFN(n,x)	do { if (uhidevdebug>(n)) printf x; } while (0)
75 int	uhidevdebug = 0;
76 #else
77 #define DPRINTF(x)
78 #define DPRINTFN(n,x)
79 #endif
80 
81 struct uhidev_async_info {
82 	void (*callback)(void *priv, int id, void *data, int len);
83 	void *priv;
84 	void *data;
85 	int id;
86 };
87 
88 void uhidev_intr(struct usbd_xfer *, void *, usbd_status);
89 
90 int uhidev_maxrepid(void *buf, int len);
91 int uhidevprint(void *aux, const char *pnp);
92 int uhidevsubmatch(struct device *parent, void *cf, void *aux);
93 
94 int uhidev_match(struct device *, void *, void *);
95 void uhidev_attach(struct device *, struct device *, void *);
96 int uhidev_detach(struct device *, int);
97 int uhidev_activate(struct device *, int);
98 
99 void uhidev_get_report_async_cb(struct usbd_xfer *, void *, usbd_status);
100 void uhidev_set_report_async_cb(struct usbd_xfer *, void *, usbd_status);
101 
102 struct cfdriver uhidev_cd = {
103 	NULL, "uhidev", DV_DULL
104 };
105 
106 const struct cfattach uhidev_ca = {
107 	sizeof(struct uhidev_softc), uhidev_match, uhidev_attach,
108 	uhidev_detach, uhidev_activate,
109 };
110 
111 int
112 uhidev_match(struct device *parent, void *match, void *aux)
113 {
114 	struct usb_attach_arg *uaa = aux;
115 	usb_interface_descriptor_t *id;
116 
117 	if (uaa->iface == NULL)
118 		return (UMATCH_NONE);
119 	id = usbd_get_interface_descriptor(uaa->iface);
120 	if (id == NULL)
121 		return (UMATCH_NONE);
122 #ifndef SMALL_KERNEL
123 	if (id->bInterfaceClass == UICLASS_VENDOR &&
124 	    id->bInterfaceSubClass == UISUBCLASS_XBOX360_CONTROLLER &&
125 	    id->bInterfaceProtocol == UIPROTO_XBOX360_GAMEPAD)
126 		return (UMATCH_IFACECLASS_IFACESUBCLASS_IFACEPROTO);
127 #endif /* !SMALL_KERNEL */
128 	if (id->bInterfaceClass != UICLASS_HID)
129 		return (UMATCH_NONE);
130 	if (usbd_get_quirks(uaa->device)->uq_flags & UQ_BAD_HID)
131 		return (UMATCH_NONE);
132 
133 	return (UMATCH_IFACECLASS_GENERIC);
134 }
135 
136 void
137 uhidev_attach(struct device *parent, struct device *self, void *aux)
138 {
139 	struct uhidev_softc *sc = (struct uhidev_softc *)self;
140 	struct usb_attach_arg *uaa = aux;
141 	usb_interface_descriptor_t *id;
142 	usb_endpoint_descriptor_t *ed;
143 	struct uhidev_attach_arg uha;
144 	int size, nrepid, repid, repsz;
145 	int i, repsizes[256];
146 	void *desc = NULL;
147 	struct device *dev;
148 
149 	sc->sc_udev = uaa->device;
150 	sc->sc_iface = uaa->iface;
151 	sc->sc_ifaceno = uaa->ifaceno;
152 	id = usbd_get_interface_descriptor(sc->sc_iface);
153 
154 	usbd_set_idle(sc->sc_udev, sc->sc_ifaceno, 0, 0);
155 
156 	sc->sc_iep_addr = sc->sc_oep_addr = -1;
157 	for (i = 0; i < id->bNumEndpoints; i++) {
158 		ed = usbd_interface2endpoint_descriptor(sc->sc_iface, i);
159 		if (ed == NULL) {
160 			printf("%s: could not read endpoint descriptor\n",
161 			    DEVNAME(sc));
162 			return;
163 		}
164 
165 		DPRINTFN(10,("uhidev_attach: bLength=%d bDescriptorType=%d "
166 		    "bEndpointAddress=%d-%s bmAttributes=%d wMaxPacketSize=%d"
167 		    " bInterval=%d\n",
168 		    ed->bLength, ed->bDescriptorType,
169 		    ed->bEndpointAddress & UE_ADDR,
170 		    UE_GET_DIR(ed->bEndpointAddress)==UE_DIR_IN? "in" : "out",
171 		    UE_GET_XFERTYPE(ed->bmAttributes),
172 		    UGETW(ed->wMaxPacketSize), ed->bInterval));
173 
174 		if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN &&
175 		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT) {
176 			sc->sc_iep_addr = ed->bEndpointAddress;
177 		} else if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT &&
178 		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT) {
179 			sc->sc_oep_addr = ed->bEndpointAddress;
180 		} else {
181 			printf("%s: unexpected endpoint\n", DEVNAME(sc));
182 			return;
183 		}
184 	}
185 
186 	/*
187 	 * Check that we found an input interrupt endpoint.
188 	 * The output interrupt endpoint is optional
189 	 */
190 	if (sc->sc_iep_addr == -1) {
191 		printf("%s: no input interrupt endpoint\n", DEVNAME(sc));
192 		return;
193 	}
194 
195 #ifndef SMALL_KERNEL
196 	if (uhidev_use_rdesc(sc, id, uaa->vendor, uaa->product, &desc, &size))
197 		return;
198 #endif /* !SMALL_KERNEL */
199 
200 	if (desc == NULL) {
201 		struct usb_hid_descriptor *hid;
202 
203 		hid = usbd_get_hid_descriptor(sc->sc_udev, id);
204 		if (hid == NULL) {
205 			printf("%s: no HID descriptor\n", DEVNAME(sc));
206 			return;
207 		}
208 		size = UGETW(hid->descrs[0].wDescriptorLength);
209 		desc = malloc(size, M_USBDEV, M_NOWAIT);
210 		if (desc == NULL) {
211 			printf("%s: no memory\n", DEVNAME(sc));
212 			return;
213 		}
214 		if (usbd_get_report_descriptor(sc->sc_udev, sc->sc_ifaceno,
215 		    desc, size)) {
216 			printf("%s: no report descriptor\n", DEVNAME(sc));
217 			free(desc, M_USBDEV, size);
218 			return;
219 		}
220 	}
221 
222 	sc->sc_repdesc = desc;
223 	sc->sc_repdesc_size = size;
224 
225 	nrepid = uhidev_maxrepid(desc, size);
226 	if (nrepid < 0)
227 		return;
228 	printf("%s: iclass %d/%d", DEVNAME(sc), id->bInterfaceClass,
229 	    id->bInterfaceSubClass);
230 	if (nrepid > 0)
231 		printf(", %d report id%s", nrepid, nrepid > 1 ? "s" : "");
232 	printf("\n");
233 	nrepid++;
234 	sc->sc_subdevs = mallocarray(nrepid, sizeof(struct uhidev *),
235 	    M_USBDEV, M_NOWAIT | M_ZERO);
236 	if (sc->sc_subdevs == NULL) {
237 		printf("%s: no memory\n", DEVNAME(sc));
238 		return;
239 	}
240 	sc->sc_nrepid = nrepid;
241 	sc->sc_isize = 0;
242 
243 	for (repid = 0; repid < nrepid; repid++) {
244 		repsz = hid_report_size(desc, size, hid_input, repid);
245 		DPRINTF(("uhidev_match: repid=%d, repsz=%d\n", repid, repsz));
246 		repsizes[repid] = repsz;
247 		if (repsz > sc->sc_isize)
248 			sc->sc_isize = repsz;
249 	}
250 	sc->sc_isize += (nrepid != 1);	/* one byte for the report ID */
251 	DPRINTF(("uhidev_attach: isize=%d\n", sc->sc_isize));
252 
253 	uha.uaa = uaa;
254 	uha.parent = sc;
255 	uha.reportid = UHIDEV_CLAIM_ALLREPORTID;
256 
257 	/* Look for a driver claiming all report IDs first. */
258 	dev = config_found_sm(self, &uha, NULL, uhidevsubmatch);
259 	if (dev != NULL) {
260 		for (repid = 0; repid < nrepid; repid++)
261 			sc->sc_subdevs[repid] = (struct uhidev *)dev;
262 		return;
263 	}
264 
265 	for (repid = 0; repid < nrepid; repid++) {
266 		DPRINTF(("%s: try repid=%d\n", __func__, repid));
267 		if (hid_report_size(desc, size, hid_input, repid) == 0 &&
268 		    hid_report_size(desc, size, hid_output, repid) == 0 &&
269 		    hid_report_size(desc, size, hid_feature, repid) == 0)
270 			continue;
271 
272 		uha.reportid = repid;
273 		dev = config_found_sm(self, &uha, uhidevprint, uhidevsubmatch);
274 		sc->sc_subdevs[repid] = (struct uhidev *)dev;
275 	}
276 }
277 
278 #ifndef SMALL_KERNEL
279 int
280 uhidev_use_rdesc(struct uhidev_softc *sc, usb_interface_descriptor_t *id,
281 		int vendor, int product, void **descp, int *sizep)
282 {
283 	static uByte reportbuf[] = {2, 2};
284 	const void *descptr = NULL;
285 	void *desc;
286 	int size;
287 
288 	if (vendor == USB_VENDOR_WACOM) {
289 		/* The report descriptor for the Wacom Graphire is broken. */
290 		switch (product) {
291 		case USB_PRODUCT_WACOM_GRAPHIRE:
292 			size = sizeof(uhid_graphire_report_descr);
293 			descptr = uhid_graphire_report_descr;
294 			break;
295 		case USB_PRODUCT_WACOM_GRAPHIRE3_4X5:
296 		case USB_PRODUCT_WACOM_GRAPHIRE4_4X5:
297 			uhidev_set_report(sc, UHID_FEATURE_REPORT,
298 			    2, &reportbuf, sizeof(reportbuf));
299 			size = sizeof(uhid_graphire3_4x5_report_descr);
300 			descptr = uhid_graphire3_4x5_report_descr;
301 			break;
302 		default:
303 			break;
304 		}
305 	} else if ((id->bInterfaceClass == UICLASS_VENDOR &&
306 		   id->bInterfaceSubClass == UISUBCLASS_XBOX360_CONTROLLER &&
307 		   id->bInterfaceProtocol == UIPROTO_XBOX360_GAMEPAD)) {
308 		/* The Xbox 360 gamepad has no report descriptor. */
309 		size = sizeof(uhid_xb360gp_report_descr);
310 		descptr = uhid_xb360gp_report_descr;
311 	}
312 
313 	if (descptr) {
314 		desc = malloc(size, M_USBDEV, M_NOWAIT);
315 		if (desc == NULL)
316 			return (ENOMEM);
317 
318 		memcpy(desc, descptr, size);
319 
320 		*descp = desc;
321 		*sizep = size;
322 	}
323 
324 	return (0);
325 }
326 #endif /* !SMALL_KERNEL */
327 
328 int
329 uhidev_maxrepid(void *buf, int len)
330 {
331 	struct hid_data *d;
332 	struct hid_item h;
333 	int maxid;
334 
335 	maxid = -1;
336 	h.report_ID = 0;
337 	for (d = hid_start_parse(buf, len, hid_none); hid_get_item(d, &h); )
338 		if (h.report_ID > maxid)
339 			maxid = h.report_ID;
340 	hid_end_parse(d);
341 	return (maxid);
342 }
343 
344 int
345 uhidevprint(void *aux, const char *pnp)
346 {
347 	struct uhidev_attach_arg *uha = aux;
348 
349 	if (pnp)
350 		printf("uhid at %s", pnp);
351 	if (uha->reportid != 0 && uha->reportid != UHIDEV_CLAIM_ALLREPORTID)
352 		printf(" reportid %d", uha->reportid);
353 	return (UNCONF);
354 }
355 
356 int uhidevsubmatch(struct device *parent, void *match, void *aux)
357 {
358 	struct uhidev_attach_arg *uha = aux;
359         struct cfdata *cf = match;
360 
361 	if (cf->uhidevcf_reportid != UHIDEV_UNK_REPORTID &&
362 	    cf->uhidevcf_reportid != uha->reportid)
363 		return (0);
364 	return ((*cf->cf_attach->ca_match)(parent, cf, aux));
365 }
366 
367 int
368 uhidev_activate(struct device *self, int act)
369 {
370 	struct uhidev_softc *sc = (struct uhidev_softc *)self;
371 	int i, rv = 0, r;
372 
373 	switch (act) {
374 	case DVACT_DEACTIVATE:
375 		for (i = 0; i < sc->sc_nrepid; i++)
376 			if (sc->sc_subdevs[i] != NULL) {
377 				r = config_deactivate(
378 				    &sc->sc_subdevs[i]->sc_dev);
379 				if (r && r != EOPNOTSUPP)
380 					rv = r;
381 			}
382 		usbd_deactivate(sc->sc_udev);
383 		break;
384 	}
385 	return (rv);
386 }
387 
388 int
389 uhidev_detach(struct device *self, int flags)
390 {
391 	struct uhidev_softc *sc = (struct uhidev_softc *)self;
392 	int i, rv = 0;
393 
394 	DPRINTF(("uhidev_detach: sc=%p flags=%d\n", sc, flags));
395 
396 	if (sc->sc_opipe != NULL) {
397 		usbd_abort_pipe(sc->sc_opipe);
398 		usbd_close_pipe(sc->sc_opipe);
399 		sc->sc_opipe = NULL;
400 	}
401 
402 	if (sc->sc_ipipe != NULL) {
403 		usbd_abort_pipe(sc->sc_ipipe);
404 		usbd_close_pipe(sc->sc_ipipe);
405 		sc->sc_ipipe = NULL;
406 	}
407 
408 	if (sc->sc_repdesc != NULL)
409 		free(sc->sc_repdesc, M_USBDEV, sc->sc_repdesc_size);
410 
411 	/*
412 	 * XXX Check if we have only one children claiming all the Report
413 	 * IDs, this is a hack since we need a dev -> Report ID mapping
414 	 * for uhidev_intr().
415 	 */
416 	if (sc->sc_nrepid > 1 && sc->sc_subdevs[0] != NULL &&
417 	    sc->sc_subdevs[0] == sc->sc_subdevs[1])
418 		return (config_detach(&sc->sc_subdevs[0]->sc_dev, flags));
419 
420 	for (i = 0; i < sc->sc_nrepid; i++) {
421 		if (sc->sc_subdevs[i] != NULL) {
422 			rv |= config_detach(&sc->sc_subdevs[i]->sc_dev, flags);
423 			sc->sc_subdevs[i] = NULL;
424 		}
425 	}
426 
427 	return (rv);
428 }
429 
430 void
431 uhidev_intr(struct usbd_xfer *xfer, void *addr, usbd_status status)
432 {
433 	struct uhidev_softc *sc = addr;
434 	struct uhidev *scd;
435 	u_char *p;
436 	u_int rep;
437 	u_int32_t cc;
438 
439 	if (usbd_is_dying(sc->sc_udev))
440 		return;
441 
442 	usbd_get_xfer_status(xfer, NULL, NULL, &cc, NULL);
443 
444 #ifdef UHIDEV_DEBUG
445 	if (uhidevdebug > 5) {
446 		u_int32_t i;
447 
448 		DPRINTF(("uhidev_intr: status=%d cc=%d\n", status, cc));
449 		DPRINTF(("uhidev_intr: data ="));
450 		for (i = 0; i < cc; i++)
451 			DPRINTF((" %02x", sc->sc_ibuf[i]));
452 		DPRINTF(("\n"));
453 	}
454 #endif
455 
456 	if (status == USBD_CANCELLED || status == USBD_IOERROR)
457 		return;
458 
459 	if (status != USBD_NORMAL_COMPLETION) {
460 		DPRINTF(("%s: interrupt status=%d\n", DEVNAME(sc), status));
461 		usbd_clear_endpoint_stall_async(sc->sc_ipipe);
462 		return;
463 	}
464 
465 	p = sc->sc_ibuf;
466 	if (sc->sc_nrepid != 1)
467 		rep = *p++, cc--;
468 	else
469 		rep = 0;
470 	if (rep >= sc->sc_nrepid) {
471 		printf("uhidev_intr: bad repid %d\n", rep);
472 		return;
473 	}
474 	scd = sc->sc_subdevs[rep];
475 	DPRINTFN(5,("uhidev_intr: rep=%d, scd=%p state=0x%x\n",
476 		    rep, scd, scd ? scd->sc_state : 0));
477 	if (scd == NULL || !(scd->sc_state & UHIDEV_OPEN))
478 		return;
479 
480 	scd->sc_intr(scd, p, cc);
481 }
482 
483 void
484 uhidev_get_report_desc(struct uhidev_softc *sc, void **desc, int *size)
485 {
486 	*desc = sc->sc_repdesc;
487 	*size = sc->sc_repdesc_size;
488 }
489 
490 int
491 uhidev_open(struct uhidev *scd)
492 {
493 	struct uhidev_softc *sc = scd->sc_parent;
494 	usbd_status err;
495 	int error;
496 
497 	DPRINTF(("uhidev_open: open pipe, state=%d refcnt=%d\n",
498 		 scd->sc_state, sc->sc_refcnt));
499 
500 	if (scd->sc_state & UHIDEV_OPEN)
501 		return (EBUSY);
502 	scd->sc_state |= UHIDEV_OPEN;
503 	if (sc->sc_refcnt++)
504 		return (0);
505 
506 	if (sc->sc_isize == 0)
507 		return (0);
508 
509 	sc->sc_ibuf = malloc(sc->sc_isize, M_USBDEV, M_WAITOK);
510 
511 	/* Set up input interrupt pipe. */
512 	DPRINTF(("uhidev_open: isize=%d, ep=0x%02x\n", sc->sc_isize,
513 	    sc->sc_iep_addr));
514 
515 	err = usbd_open_pipe_intr(sc->sc_iface, sc->sc_iep_addr,
516 		  USBD_SHORT_XFER_OK, &sc->sc_ipipe, sc, sc->sc_ibuf,
517 		  sc->sc_isize, uhidev_intr, USBD_DEFAULT_INTERVAL);
518 	if (err != USBD_NORMAL_COMPLETION) {
519 		DPRINTF(("uhidopen: usbd_open_pipe_intr failed, "
520 		    "error=%d\n", err));
521 		error = EIO;
522 		goto out1;
523 	}
524 
525 	DPRINTF(("uhidev_open: sc->sc_ipipe=%p\n", sc->sc_ipipe));
526 
527 	sc->sc_ixfer = usbd_alloc_xfer(sc->sc_udev);
528 	if (sc->sc_ixfer == NULL) {
529 		DPRINTF(("uhidev_open: couldn't allocate an xfer\n"));
530 		error = ENOMEM;
531 		goto out1; // xxxx
532 	}
533 
534 	/*
535 	 * Set up output interrupt pipe if an output interrupt endpoint
536 	 * exists.
537 	 */
538 	if (sc->sc_oep_addr != -1) {
539 		DPRINTF(("uhidev_open: oep=0x%02x\n", sc->sc_oep_addr));
540 
541 		err = usbd_open_pipe(sc->sc_iface, sc->sc_oep_addr,
542 		    0, &sc->sc_opipe);
543 
544 		if (err != USBD_NORMAL_COMPLETION) {
545 			DPRINTF(("uhidev_open: usbd_open_pipe failed, "
546 			    "error=%d\n", err));
547 			error = EIO;
548 			goto out2;
549 		}
550 		DPRINTF(("uhidev_open: sc->sc_opipe=%p\n", sc->sc_opipe));
551 
552 		sc->sc_oxfer = usbd_alloc_xfer(sc->sc_udev);
553 		if (sc->sc_oxfer == NULL) {
554 			DPRINTF(("uhidev_open: couldn't allocate an xfer\n"));
555 			error = ENOMEM;
556 			goto out3;
557 		}
558 
559 		sc->sc_owxfer = usbd_alloc_xfer(sc->sc_udev);
560 		if (sc->sc_owxfer == NULL) {
561 			DPRINTF(("uhidev_open: couldn't allocate owxfer\n"));
562 			error = ENOMEM;
563 			goto out3;
564 		}
565 	}
566 
567 	return (0);
568 
569 out3:
570 	/* Abort output pipe */
571 	usbd_close_pipe(sc->sc_opipe);
572 out2:
573 	/* Abort input pipe */
574 	usbd_close_pipe(sc->sc_ipipe);
575 out1:
576 	DPRINTF(("uhidev_open: failed in someway"));
577 	free(sc->sc_ibuf, M_USBDEV, sc->sc_isize);
578 	scd->sc_state &= ~UHIDEV_OPEN;
579 	sc->sc_refcnt = 0;
580 	sc->sc_ipipe = NULL;
581 	sc->sc_opipe = NULL;
582 	if (sc->sc_oxfer != NULL) {
583 		usbd_free_xfer(sc->sc_oxfer);
584 		sc->sc_oxfer = NULL;
585 	}
586 	if (sc->sc_owxfer != NULL) {
587 		usbd_free_xfer(sc->sc_owxfer);
588 		sc->sc_owxfer = NULL;
589 	}
590 	if (sc->sc_ixfer != NULL) {
591 		usbd_free_xfer(sc->sc_ixfer);
592 		sc->sc_ixfer = NULL;
593 	}
594 	return (error);
595 }
596 
597 void
598 uhidev_close(struct uhidev *scd)
599 {
600 	struct uhidev_softc *sc = scd->sc_parent;
601 
602 	if (!(scd->sc_state & UHIDEV_OPEN))
603 		return;
604 	scd->sc_state &= ~UHIDEV_OPEN;
605 	if (--sc->sc_refcnt)
606 		return;
607 	DPRINTF(("uhidev_close: close pipe\n"));
608 
609 	/* Disable interrupts. */
610 	if (sc->sc_opipe != NULL) {
611 		usbd_abort_pipe(sc->sc_opipe);
612 		usbd_close_pipe(sc->sc_opipe);
613 		sc->sc_opipe = NULL;
614 	}
615 
616 	if (sc->sc_ipipe != NULL) {
617 		usbd_abort_pipe(sc->sc_ipipe);
618 		usbd_close_pipe(sc->sc_ipipe);
619 		sc->sc_ipipe = NULL;
620 	}
621 
622 	if (sc->sc_oxfer != NULL) {
623 		usbd_free_xfer(sc->sc_oxfer);
624 		sc->sc_oxfer = NULL;
625 	}
626 
627 	if (sc->sc_owxfer != NULL) {
628 		usbd_free_xfer(sc->sc_owxfer);
629 		sc->sc_owxfer = NULL;
630 	}
631 
632 	if (sc->sc_ixfer != NULL) {
633 		usbd_free_xfer(sc->sc_ixfer);
634 		sc->sc_ixfer = NULL;
635 	}
636 
637 	if (sc->sc_ibuf != NULL) {
638 		free(sc->sc_ibuf, M_USBDEV, sc->sc_isize);
639 		sc->sc_ibuf = NULL;
640 	}
641 }
642 
643 int
644 uhidev_report_type_conv(int hid_type_id)
645 {
646 	switch (hid_type_id) {
647 	case hid_input:
648 		return UHID_INPUT_REPORT;
649 	case hid_output:
650 		return UHID_OUTPUT_REPORT;
651 	case hid_feature:
652 		return UHID_FEATURE_REPORT;
653 	default:
654 		return -1;
655 	}
656 }
657 
658 int
659 uhidev_set_report(struct uhidev_softc *sc, int type, int id, void *data,
660     int len)
661 {
662 	usb_device_request_t req;
663 	char *buf = data;
664 	int actlen = len;
665 
666 	/* Prepend the reportID. */
667 	if (id > 0) {
668 		len++;
669 		buf = malloc(len, M_TEMP, M_WAITOK);
670 		buf[0] = id;
671 		memcpy(buf + 1, data, len - 1);
672 	}
673 
674 	if (sc->sc_opipe != NULL) {
675 		usbd_setup_xfer(sc->sc_owxfer, sc->sc_opipe, 0, buf, len,
676 		    USBD_SYNCHRONOUS | USBD_CATCH, 0, NULL);
677 		if (usbd_transfer(sc->sc_owxfer)) {
678 			usbd_clear_endpoint_stall(sc->sc_opipe);
679 			actlen = -1;
680 		}
681 	} else {
682 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
683 		req.bRequest = UR_SET_REPORT;
684 		USETW2(req.wValue, type, id);
685 		USETW(req.wIndex, sc->sc_ifaceno);
686 		USETW(req.wLength, len);
687 
688 		if (usbd_do_request(sc->sc_udev, &req, buf))
689 			actlen = -1;
690 	}
691 
692 	if (id > 0)
693 		free(buf, M_TEMP, len);
694 
695 	return (actlen);
696 }
697 
698 void
699 uhidev_set_report_async_cb(struct usbd_xfer *xfer, void *priv, usbd_status err)
700 {
701 	struct uhidev_softc *sc = priv;
702 
703 	if (err == USBD_STALLED)
704 		usbd_clear_endpoint_stall_async(sc->sc_opipe);
705 	usbd_free_xfer(xfer);
706 }
707 
708 int
709 uhidev_set_report_async(struct uhidev_softc *sc, int type, int id, void *data,
710     int len)
711 {
712 	struct usbd_xfer *xfer;
713 	usb_device_request_t req;
714 	int actlen = len;
715 	char *buf;
716 
717 	xfer = usbd_alloc_xfer(sc->sc_udev);
718 	if (xfer == NULL)
719 		return (-1);
720 
721 	if (id > 0)
722 		len++;
723 
724 	buf = usbd_alloc_buffer(xfer, len);
725 	if (buf == NULL) {
726 		usbd_free_xfer(xfer);
727 		return (-1);
728 	}
729 
730 	/* Prepend the reportID. */
731 	if (id > 0) {
732 		buf[0] = id;
733 		memcpy(buf + 1, data, len - 1);
734 	} else {
735 		memcpy(buf, data, len);
736 	}
737 
738 	if (sc->sc_opipe != NULL) {
739 		usbd_setup_xfer(xfer, sc->sc_opipe, sc, buf, len,
740 		    USBD_NO_COPY, USBD_DEFAULT_TIMEOUT,
741 		    uhidev_set_report_async_cb);
742 		if (usbd_transfer(xfer)) {
743 			usbd_clear_endpoint_stall_async(sc->sc_opipe);
744 			actlen = -1;
745 		}
746 	} else {
747 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
748 		req.bRequest = UR_SET_REPORT;
749 		USETW2(req.wValue, type, id);
750 		USETW(req.wIndex, sc->sc_ifaceno);
751 		USETW(req.wLength, len);
752 		if (usbd_request_async(xfer, &req, NULL, NULL))
753 			actlen = -1;
754 	}
755 
756 	return (actlen);
757 }
758 
759 int
760 uhidev_get_report(struct uhidev_softc *sc, int type, int id, void *data,
761     int len)
762 {
763 	usb_device_request_t req;
764 	char *buf = data;
765 	usbd_status err;
766 	int actlen;
767 
768 	if (id > 0) {
769 		len++;
770 		buf = malloc(len, M_TEMP, M_WAITOK|M_ZERO);
771 	}
772 
773 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
774 	req.bRequest = UR_GET_REPORT;
775 	USETW2(req.wValue, type, id);
776 	USETW(req.wIndex, sc->sc_ifaceno);
777 	USETW(req.wLength, len);
778 
779 	err = usbd_do_request_flags(sc->sc_udev, &req, buf, 0, &actlen,
780 	    USBD_DEFAULT_TIMEOUT);
781 	if (err != USBD_NORMAL_COMPLETION && err != USBD_SHORT_XFER)
782 		actlen = -1;
783 
784 	/* Skip the reportID. */
785 	if (id > 0) {
786 		memcpy(data, buf + 1, len - 1);
787 		free(buf, M_TEMP, len);
788 	}
789 
790 	return (actlen);
791 }
792 
793 void
794 uhidev_get_report_async_cb(struct usbd_xfer *xfer, void *priv, usbd_status err)
795 {
796 	struct uhidev_async_info *info = priv;
797 	char *buf;
798 	int len = -1;
799 
800 	if (!usbd_is_dying(xfer->pipe->device)) {
801 		if (err == USBD_NORMAL_COMPLETION || err == USBD_SHORT_XFER) {
802 			len = xfer->actlen;
803 			buf = KERNADDR(&xfer->dmabuf, 0);
804 			if (info->id > 0) {
805 				len--;
806 				memcpy(info->data, buf + 1, len);
807 			} else {
808 				memcpy(info->data, buf, len);
809 			}
810 		}
811 		info->callback(info->priv, info->id, info->data, len);
812 	}
813 	free(info, M_TEMP, sizeof(*info));
814 	usbd_free_xfer(xfer);
815 }
816 
817 int
818 uhidev_get_report_async(struct uhidev_softc *sc, int type, int id, void *data,
819     int len, void *priv, void (*callback)(void *, int, void *, int))
820 {
821 	struct usbd_xfer *xfer;
822 	usb_device_request_t req;
823 	struct uhidev_async_info *info;
824 	int actlen = len;
825 	char *buf;
826 
827 	xfer = usbd_alloc_xfer(sc->sc_udev);
828 	if (xfer == NULL)
829 		return (-1);
830 
831 	if (id > 0)
832 		len++;
833 
834 	buf = usbd_alloc_buffer(xfer, len);
835 	if (buf == NULL) {
836 		usbd_free_xfer(xfer);
837 		return (-1);
838 	}
839 
840 	info = malloc(sizeof(*info), M_TEMP, M_NOWAIT);
841 	if (info == NULL) {
842 		usbd_free_xfer(xfer);
843 		return (-1);
844 	}
845 
846 	info->callback = callback;
847 	info->priv = priv;
848 	info->data = data;
849 	info->id = id;
850 
851 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
852 	req.bRequest = UR_GET_REPORT;
853 	USETW2(req.wValue, type, id);
854 	USETW(req.wIndex, sc->sc_ifaceno);
855 	USETW(req.wLength, len);
856 
857 	if (usbd_request_async(xfer, &req, info, uhidev_get_report_async_cb)) {
858 		free(info, M_TEMP, sizeof(*info));
859 		actlen = -1;
860 	}
861 
862 	return (actlen);
863 }
864 
865 usbd_status
866 uhidev_write(struct uhidev_softc *sc, void *data, int len)
867 {
868 	usbd_status error;
869 
870 	DPRINTF(("uhidev_write: data=%p, len=%d\n", data, len));
871 
872 	if (sc->sc_opipe == NULL)
873 		return USBD_INVAL;
874 
875 #ifdef UHIDEV_DEBUG
876 	if (uhidevdebug > 50) {
877 
878 		u_int32_t i;
879 		u_int8_t *d = data;
880 
881 		DPRINTF(("uhidev_write: data ="));
882 		for (i = 0; i < len; i++)
883 			DPRINTF((" %02x", d[i]));
884 		DPRINTF(("\n"));
885 	}
886 #endif
887 	usbd_setup_xfer(sc->sc_owxfer, sc->sc_opipe, 0, data, len,
888 	    USBD_SYNCHRONOUS | USBD_CATCH, 0, NULL);
889 	error = usbd_transfer(sc->sc_owxfer);
890 	if (error)
891 		usbd_clear_endpoint_stall(sc->sc_opipe);
892 
893 	return (error);
894 }
895 
896 int
897 uhidev_ioctl(struct uhidev *sc, u_long cmd, caddr_t addr, int flag,
898     struct proc *p)
899 {
900 	struct usb_ctl_report_desc *rd;
901 	struct usb_ctl_report *re;
902 	int size;
903 	void *desc;
904 
905 	switch (cmd) {
906 	case USB_GET_REPORT_DESC:
907 		uhidev_get_report_desc(sc->sc_parent, &desc, &size);
908 		rd = (struct usb_ctl_report_desc *)addr;
909 		size = min(size, sizeof rd->ucrd_data);
910 		rd->ucrd_size = size;
911 		memcpy(rd->ucrd_data, desc, size);
912 		break;
913 	case USB_GET_REPORT:
914 		re = (struct usb_ctl_report *)addr;
915 		switch (re->ucr_report) {
916 		case UHID_INPUT_REPORT:
917 			size = sc->sc_isize;
918 			break;
919 		case UHID_OUTPUT_REPORT:
920 			size = sc->sc_osize;
921 			break;
922 		case UHID_FEATURE_REPORT:
923 			size = sc->sc_fsize;
924 			break;
925 		default:
926 			return EINVAL;
927 		}
928 		if (uhidev_get_report(sc->sc_parent, re->ucr_report,
929 		    sc->sc_report_id, re->ucr_data, size) != size)
930 			return EIO;
931 		break;
932 	case USB_SET_REPORT:
933 		re = (struct usb_ctl_report *)addr;
934 		switch (re->ucr_report) {
935 		case UHID_INPUT_REPORT:
936 			size = sc->sc_isize;
937 			break;
938 		case UHID_OUTPUT_REPORT:
939 			size = sc->sc_osize;
940 			break;
941 		case UHID_FEATURE_REPORT:
942 			size = sc->sc_fsize;
943 			break;
944 		default:
945 			return EINVAL;
946 		}
947 		if (uhidev_set_report(sc->sc_parent, re->ucr_report,
948 		    sc->sc_report_id, re->ucr_data, size) != size)
949 			return EIO;
950 		break;
951 	case USB_GET_REPORT_ID:
952 		*(int *)addr = sc->sc_report_id;
953 		break;
954 	default:
955 		return -1;
956 	}
957 	return 0;
958 }
959