xref: /openbsd-src/sys/dev/usb/uhidev.c (revision adb06565acb8061f0e1ddb764fb29f86eadeb2f6)
1 /*	$OpenBSD: uhidev.c,v 1.94 2021/09/10 05:47:38 anton Exp $	*/
2 /*	$NetBSD: uhidev.c,v 1.14 2003/03/11 16:44:00 augustss Exp $	*/
3 
4 /*
5  * Copyright (c) 2001 The NetBSD Foundation, Inc.
6  * All rights reserved.
7  *
8  * This code is derived from software contributed to The NetBSD Foundation
9  * by Lennart Augustsson (lennart@augustsson.net) at
10  * Carlstedt Research & Technology.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
25  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 /*
35  * HID spec: https://www.usb.org/sites/default/files/hid1_11.pdf
36  */
37 
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/kernel.h>
41 #include <sys/malloc.h>
42 #include <sys/signalvar.h>
43 #include <sys/device.h>
44 #include <sys/ioctl.h>
45 #include <sys/conf.h>
46 
47 #include <machine/bus.h>
48 
49 #include <dev/usb/usb.h>
50 #include <dev/usb/usbhid.h>
51 
52 #include <dev/usb/usbdevs.h>
53 #include <dev/usb/usbdi.h>
54 #include <dev/usb/usbdi_util.h>
55 #include <dev/usb/usbdivar.h>
56 #include <dev/usb/usb_mem.h>
57 #include <dev/usb/usb_quirks.h>
58 
59 #include <dev/usb/uhidev.h>
60 
61 #ifndef SMALL_KERNEL
62 /* Replacement report descriptors for devices shipped with broken ones */
63 #include <dev/usb/uhid_rdesc.h>
64 int uhidev_use_rdesc(struct uhidev_softc *, usb_interface_descriptor_t *,
65 		int, int, void **, int *);
66 #define UISUBCLASS_XBOX360_CONTROLLER 0x5d
67 #define UIPROTO_XBOX360_GAMEPAD 0x01
68 #endif /* !SMALL_KERNEL */
69 
70 #define DEVNAME(sc)		((sc)->sc_dev.dv_xname)
71 
72 #ifdef UHIDEV_DEBUG
73 #define DPRINTF(x)	do { if (uhidevdebug) printf x; } while (0)
74 #define DPRINTFN(n,x)	do { if (uhidevdebug>(n)) printf x; } while (0)
75 int	uhidevdebug = 0;
76 #else
77 #define DPRINTF(x)
78 #define DPRINTFN(n,x)
79 #endif
80 
81 struct uhidev_async_info {
82 	void (*callback)(void *priv, int id, void *data, int len);
83 	void *priv;
84 	void *data;
85 	int id;
86 };
87 
88 void uhidev_intr(struct usbd_xfer *, void *, usbd_status);
89 
90 int uhidev_maxrepid(void *buf, int len);
91 int uhidevprint(void *aux, const char *pnp);
92 int uhidevsubmatch(struct device *parent, void *cf, void *aux);
93 
94 int uhidev_match(struct device *, void *, void *);
95 void uhidev_attach(struct device *, struct device *, void *);
96 int uhidev_detach(struct device *, int);
97 int uhidev_activate(struct device *, int);
98 
99 void uhidev_get_report_async_cb(struct usbd_xfer *, void *, usbd_status);
100 void uhidev_set_report_async_cb(struct usbd_xfer *, void *, usbd_status);
101 
102 struct cfdriver uhidev_cd = {
103 	NULL, "uhidev", DV_DULL
104 };
105 
106 const struct cfattach uhidev_ca = {
107 	sizeof(struct uhidev_softc), uhidev_match, uhidev_attach,
108 	uhidev_detach, uhidev_activate,
109 };
110 
111 int
112 uhidev_match(struct device *parent, void *match, void *aux)
113 {
114 	struct usb_attach_arg *uaa = aux;
115 	usb_interface_descriptor_t *id;
116 
117 	if (uaa->iface == NULL)
118 		return (UMATCH_NONE);
119 	id = usbd_get_interface_descriptor(uaa->iface);
120 	if (id == NULL)
121 		return (UMATCH_NONE);
122 #ifndef SMALL_KERNEL
123 	if (id->bInterfaceClass == UICLASS_VENDOR &&
124 	    id->bInterfaceSubClass == UISUBCLASS_XBOX360_CONTROLLER &&
125 	    id->bInterfaceProtocol == UIPROTO_XBOX360_GAMEPAD)
126 		return (UMATCH_IFACECLASS_IFACESUBCLASS_IFACEPROTO);
127 #endif /* !SMALL_KERNEL */
128 	if (id->bInterfaceClass != UICLASS_HID)
129 		return (UMATCH_NONE);
130 	if (usbd_get_quirks(uaa->device)->uq_flags & UQ_BAD_HID)
131 		return (UMATCH_NONE);
132 
133 	return (UMATCH_IFACECLASS_GENERIC);
134 }
135 
136 void
137 uhidev_attach(struct device *parent, struct device *self, void *aux)
138 {
139 	struct uhidev_softc *sc = (struct uhidev_softc *)self;
140 	struct usb_attach_arg *uaa = aux;
141 	usb_interface_descriptor_t *id;
142 	usb_endpoint_descriptor_t *ed;
143 	struct uhidev_attach_arg uha;
144 	int size, nrepid, repid, repsz;
145 	int i;
146 	void *desc = NULL;
147 	struct device *dev;
148 
149 	sc->sc_udev = uaa->device;
150 	sc->sc_iface = uaa->iface;
151 	sc->sc_ifaceno = uaa->ifaceno;
152 	id = usbd_get_interface_descriptor(sc->sc_iface);
153 
154 	sc->sc_iep_addr = sc->sc_oep_addr = -1;
155 	for (i = 0; i < id->bNumEndpoints; i++) {
156 		ed = usbd_interface2endpoint_descriptor(sc->sc_iface, i);
157 		if (ed == NULL) {
158 			printf("%s: could not read endpoint descriptor\n",
159 			    DEVNAME(sc));
160 			return;
161 		}
162 
163 		DPRINTFN(10,("uhidev_attach: bLength=%d bDescriptorType=%d "
164 		    "bEndpointAddress=%d-%s bmAttributes=%d wMaxPacketSize=%d"
165 		    " bInterval=%d\n",
166 		    ed->bLength, ed->bDescriptorType,
167 		    ed->bEndpointAddress & UE_ADDR,
168 		    UE_GET_DIR(ed->bEndpointAddress)==UE_DIR_IN? "in" : "out",
169 		    UE_GET_XFERTYPE(ed->bmAttributes),
170 		    UGETW(ed->wMaxPacketSize), ed->bInterval));
171 
172 		if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN &&
173 		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT) {
174 			sc->sc_iep_addr = ed->bEndpointAddress;
175 		} else if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT &&
176 		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT) {
177 			sc->sc_oep_addr = ed->bEndpointAddress;
178 		} else {
179 			printf("%s: unexpected endpoint\n", DEVNAME(sc));
180 			return;
181 		}
182 	}
183 
184 	/*
185 	 * Check that we found an input interrupt endpoint.
186 	 * The output interrupt endpoint is optional
187 	 */
188 	if (sc->sc_iep_addr == -1) {
189 		printf("%s: no input interrupt endpoint\n", DEVNAME(sc));
190 		return;
191 	}
192 
193 #ifndef SMALL_KERNEL
194 	if (uhidev_use_rdesc(sc, id, uaa->vendor, uaa->product, &desc, &size))
195 		return;
196 #endif /* !SMALL_KERNEL */
197 
198 	if (desc == NULL) {
199 		struct usb_hid_descriptor *hid;
200 
201 		hid = usbd_get_hid_descriptor(sc->sc_udev, id);
202 		if (hid == NULL) {
203 			printf("%s: no HID descriptor\n", DEVNAME(sc));
204 			return;
205 		}
206 		size = UGETW(hid->descrs[0].wDescriptorLength);
207 		desc = malloc(size, M_USBDEV, M_NOWAIT);
208 		if (desc == NULL) {
209 			printf("%s: no memory\n", DEVNAME(sc));
210 			return;
211 		}
212 		if (usbd_get_report_descriptor(sc->sc_udev, sc->sc_ifaceno,
213 		    desc, size)) {
214 			printf("%s: no report descriptor\n", DEVNAME(sc));
215 			free(desc, M_USBDEV, size);
216 			return;
217 		}
218 	}
219 
220 	sc->sc_repdesc = desc;
221 	sc->sc_repdesc_size = size;
222 
223 	nrepid = uhidev_maxrepid(desc, size);
224 	if (nrepid < 0)
225 		return;
226 	printf("%s: iclass %d/%d", DEVNAME(sc), id->bInterfaceClass,
227 	    id->bInterfaceSubClass);
228 	if (nrepid > 0)
229 		printf(", %d report id%s", nrepid, nrepid > 1 ? "s" : "");
230 	printf("\n");
231 	nrepid++;
232 	sc->sc_subdevs = mallocarray(nrepid, sizeof(struct uhidev *),
233 	    M_USBDEV, M_NOWAIT | M_ZERO);
234 	if (sc->sc_subdevs == NULL) {
235 		printf("%s: no memory\n", DEVNAME(sc));
236 		return;
237 	}
238 	sc->sc_nrepid = nrepid;
239 	sc->sc_isize = 0;
240 
241 	for (repid = 0; repid < nrepid; repid++) {
242 		repsz = hid_report_size(desc, size, hid_input, repid);
243 		DPRINTF(("uhidev_match: repid=%d, repsz=%d\n", repid, repsz));
244 		if (repsz > sc->sc_isize)
245 			sc->sc_isize = repsz;
246 	}
247 	sc->sc_isize += (nrepid != 1);	/* one byte for the report ID */
248 	DPRINTF(("uhidev_attach: isize=%d\n", sc->sc_isize));
249 
250 	uha.uaa = uaa;
251 	uha.parent = sc;
252 	uha.reportid = UHIDEV_CLAIM_MULTIPLE_REPORTID;
253 	uha.nreports = nrepid;
254 	uha.claimed = malloc(nrepid, M_TEMP, M_WAITOK|M_ZERO);
255 	uha.isize = uha.osize = uha.fsize = 0;
256 
257 	/* Look for a driver claiming multiple report IDs first. */
258 	dev = config_found_sm(self, &uha, NULL, uhidevsubmatch);
259 	if (dev != NULL) {
260 		for (repid = 0; repid < nrepid; repid++) {
261 			/*
262 			 * Could already be assigned by uhidev_set_report_dev().
263 			 */
264 			if (sc->sc_subdevs[repid] != NULL)
265 				continue;
266 
267 			if (uha.claimed[repid])
268 				sc->sc_subdevs[repid] = (struct uhidev *)dev;
269 		}
270 	}
271 
272 	free(uha.claimed, M_TEMP, nrepid);
273 	uha.claimed = NULL;
274 
275 	for (repid = 0; repid < nrepid; repid++) {
276 		int isize, osize, fsize;
277 
278 		DPRINTF(("%s: try repid=%d\n", __func__, repid));
279 		if ((isize = hid_report_size(desc, size, hid_input, repid)) == 0 &&
280 		    (osize = hid_report_size(desc, size, hid_output, repid)) == 0 &&
281 		    (fsize = hid_report_size(desc, size, hid_feature, repid)) == 0)
282 			continue;
283 
284 		/* Could already be assigned by uhidev_set_report_dev(). */
285 		if (sc->sc_subdevs[repid] != NULL)
286 			continue;
287 
288 		uha.reportid = repid;
289 		uha.isize = isize;
290 		uha.osize = osize;
291 		uha.fsize = fsize;
292 		dev = config_found_sm(self, &uha, uhidevprint, uhidevsubmatch);
293 		sc->sc_subdevs[repid] = (struct uhidev *)dev;
294 	}
295 }
296 
297 #ifndef SMALL_KERNEL
298 int
299 uhidev_use_rdesc(struct uhidev_softc *sc, usb_interface_descriptor_t *id,
300 		int vendor, int product, void **descp, int *sizep)
301 {
302 	static uByte reportbuf[] = {2, 2};
303 	const void *descptr = NULL;
304 	void *desc;
305 	int size;
306 
307 	if (vendor == USB_VENDOR_WACOM) {
308 		/* The report descriptor for the Wacom Graphire is broken. */
309 		switch (product) {
310 		case USB_PRODUCT_WACOM_GRAPHIRE:
311 			size = sizeof(uhid_graphire_report_descr);
312 			descptr = uhid_graphire_report_descr;
313 			break;
314 		case USB_PRODUCT_WACOM_GRAPHIRE3_4X5:
315 		case USB_PRODUCT_WACOM_GRAPHIRE4_4X5:
316 			uhidev_set_report(sc, UHID_FEATURE_REPORT,
317 			    2, &reportbuf, sizeof(reportbuf));
318 			size = sizeof(uhid_graphire3_4x5_report_descr);
319 			descptr = uhid_graphire3_4x5_report_descr;
320 			break;
321 		default:
322 			break;
323 		}
324 	} else if ((id->bInterfaceClass == UICLASS_VENDOR &&
325 		   id->bInterfaceSubClass == UISUBCLASS_XBOX360_CONTROLLER &&
326 		   id->bInterfaceProtocol == UIPROTO_XBOX360_GAMEPAD)) {
327 		/* The Xbox 360 gamepad has no report descriptor. */
328 		size = sizeof(uhid_xb360gp_report_descr);
329 		descptr = uhid_xb360gp_report_descr;
330 	}
331 
332 	if (descptr) {
333 		desc = malloc(size, M_USBDEV, M_NOWAIT);
334 		if (desc == NULL)
335 			return (ENOMEM);
336 
337 		memcpy(desc, descptr, size);
338 
339 		*descp = desc;
340 		*sizep = size;
341 	}
342 
343 	return (0);
344 }
345 #endif /* !SMALL_KERNEL */
346 
347 int
348 uhidev_maxrepid(void *buf, int len)
349 {
350 	struct hid_data *d;
351 	struct hid_item h;
352 	int maxid;
353 
354 	maxid = -1;
355 	h.report_ID = 0;
356 	for (d = hid_start_parse(buf, len, hid_none); hid_get_item(d, &h); )
357 		if (h.report_ID > maxid)
358 			maxid = h.report_ID;
359 	hid_end_parse(d);
360 	return (maxid);
361 }
362 
363 int
364 uhidevprint(void *aux, const char *pnp)
365 {
366 	struct uhidev_attach_arg *uha = aux;
367 
368 	if (pnp)
369 		printf("uhid at %s", pnp);
370 	if (uha->reportid != 0 && uha->reportid != UHIDEV_CLAIM_MULTIPLE_REPORTID)
371 		printf(" reportid %d", uha->reportid);
372 	return (UNCONF);
373 }
374 
375 int uhidevsubmatch(struct device *parent, void *match, void *aux)
376 {
377 	struct uhidev_attach_arg *uha = aux;
378         struct cfdata *cf = match;
379 
380 	if (cf->uhidevcf_reportid != UHIDEV_UNK_REPORTID &&
381 	    cf->uhidevcf_reportid != uha->reportid)
382 		return (0);
383 	return ((*cf->cf_attach->ca_match)(parent, cf, aux));
384 }
385 
386 int
387 uhidev_activate(struct device *self, int act)
388 {
389 	struct uhidev_softc *sc = (struct uhidev_softc *)self;
390 	int i, j, already, rv = 0, r;
391 
392 	switch (act) {
393 	case DVACT_DEACTIVATE:
394 		for (i = 0; i < sc->sc_nrepid; i++) {
395 			if (sc->sc_subdevs[i] == NULL)
396 				continue;
397 
398 			/*
399 			 * Only notify devices attached to multiple report ids
400 			 * once.
401 			 */
402 			for (already = 0, j = 0; j < i; j++) {
403 				if (sc->sc_subdevs[i] == sc->sc_subdevs[j]) {
404 					already = 1;
405 					break;
406 				}
407 			}
408 
409 			if (!already) {
410 				r = config_deactivate(
411 				    &sc->sc_subdevs[i]->sc_dev);
412 				if (r && r != EOPNOTSUPP)
413 					rv = r;
414 			}
415 		}
416 		usbd_deactivate(sc->sc_udev);
417 		break;
418 	}
419 	return (rv);
420 }
421 
422 int
423 uhidev_detach(struct device *self, int flags)
424 {
425 	struct uhidev_softc *sc = (struct uhidev_softc *)self;
426 	int i, j, rv = 0;
427 
428 	DPRINTF(("uhidev_detach: sc=%p flags=%d\n", sc, flags));
429 
430 	if (sc->sc_opipe != NULL) {
431 		usbd_close_pipe(sc->sc_opipe);
432 		sc->sc_opipe = NULL;
433 	}
434 
435 	if (sc->sc_ipipe != NULL) {
436 		usbd_close_pipe(sc->sc_ipipe);
437 		sc->sc_ipipe = NULL;
438 	}
439 
440 	if (sc->sc_repdesc != NULL)
441 		free(sc->sc_repdesc, M_USBDEV, sc->sc_repdesc_size);
442 
443 	for (i = 0; i < sc->sc_nrepid; i++) {
444 		if (sc->sc_subdevs[i] == NULL)
445 			continue;
446 
447 		rv |= config_detach(&sc->sc_subdevs[i]->sc_dev, flags);
448 
449 		/*
450 		 * Nullify without detaching any other instances of this device
451 		 * found on other report ids.
452 		 */
453 		for (j = i + 1; j < sc->sc_nrepid; j++) {
454 			if (sc->sc_subdevs[i] == sc->sc_subdevs[j])
455 				sc->sc_subdevs[j] = NULL;
456 		}
457 
458 		sc->sc_subdevs[i] = NULL;
459 	}
460 
461 	return (rv);
462 }
463 
464 void
465 uhidev_intr(struct usbd_xfer *xfer, void *addr, usbd_status status)
466 {
467 	struct uhidev_softc *sc = addr;
468 	struct uhidev *scd;
469 	u_char *p;
470 	u_int rep;
471 	u_int32_t cc;
472 
473 	if (usbd_is_dying(sc->sc_udev))
474 		return;
475 
476 	usbd_get_xfer_status(xfer, NULL, NULL, &cc, NULL);
477 
478 #ifdef UHIDEV_DEBUG
479 	if (uhidevdebug > 5) {
480 		u_int32_t i;
481 
482 		DPRINTF(("uhidev_intr: status=%d cc=%d\n", status, cc));
483 		DPRINTF(("uhidev_intr: data ="));
484 		for (i = 0; i < cc; i++)
485 			DPRINTF((" %02x", sc->sc_ibuf[i]));
486 		DPRINTF(("\n"));
487 	}
488 #endif
489 
490 	if (status == USBD_CANCELLED || status == USBD_IOERROR)
491 		return;
492 
493 	if (status != USBD_NORMAL_COMPLETION) {
494 		DPRINTF(("%s: interrupt status=%d\n", DEVNAME(sc), status));
495 		usbd_clear_endpoint_stall_async(sc->sc_ipipe);
496 		return;
497 	}
498 
499 	p = sc->sc_ibuf;
500 	if (sc->sc_nrepid != 1)
501 		rep = *p++, cc--;
502 	else
503 		rep = 0;
504 	if (rep >= sc->sc_nrepid) {
505 		printf("uhidev_intr: bad repid %d\n", rep);
506 		return;
507 	}
508 	scd = sc->sc_subdevs[rep];
509 	DPRINTFN(5,("uhidev_intr: rep=%d, scd=%p state=0x%x\n",
510 		    rep, scd, scd ? scd->sc_state : 0));
511 	if (scd == NULL || !(scd->sc_state & UHIDEV_OPEN))
512 		return;
513 
514 	scd->sc_intr(scd, p, cc);
515 }
516 
517 void
518 uhidev_get_report_desc(struct uhidev_softc *sc, void **desc, int *size)
519 {
520 	*desc = sc->sc_repdesc;
521 	*size = sc->sc_repdesc_size;
522 }
523 
524 int
525 uhidev_open(struct uhidev *scd)
526 {
527 	struct uhidev_softc *sc = scd->sc_parent;
528 	usbd_status err;
529 	int error;
530 
531 	DPRINTF(("uhidev_open: open pipe, state=%d refcnt=%d\n",
532 		 scd->sc_state, sc->sc_refcnt));
533 
534 	if (scd->sc_state & UHIDEV_OPEN)
535 		return (EBUSY);
536 	scd->sc_state |= UHIDEV_OPEN;
537 	if (sc->sc_refcnt++)
538 		return (0);
539 
540 	if (sc->sc_isize == 0)
541 		return (0);
542 
543 	sc->sc_ibuf = malloc(sc->sc_isize, M_USBDEV, M_WAITOK);
544 
545 	/* Set up input interrupt pipe. */
546 	DPRINTF(("uhidev_open: isize=%d, ep=0x%02x\n", sc->sc_isize,
547 	    sc->sc_iep_addr));
548 
549 	err = usbd_open_pipe_intr(sc->sc_iface, sc->sc_iep_addr,
550 		  USBD_SHORT_XFER_OK, &sc->sc_ipipe, sc, sc->sc_ibuf,
551 		  sc->sc_isize, uhidev_intr, USBD_DEFAULT_INTERVAL);
552 	if (err != USBD_NORMAL_COMPLETION) {
553 		DPRINTF(("uhidopen: usbd_open_pipe_intr failed, "
554 		    "error=%d\n", err));
555 		error = EIO;
556 		goto out1;
557 	}
558 
559 	DPRINTF(("uhidev_open: sc->sc_ipipe=%p\n", sc->sc_ipipe));
560 
561 	sc->sc_ixfer = usbd_alloc_xfer(sc->sc_udev);
562 	if (sc->sc_ixfer == NULL) {
563 		DPRINTF(("uhidev_open: couldn't allocate an xfer\n"));
564 		error = ENOMEM;
565 		goto out1; // xxxx
566 	}
567 
568 	/*
569 	 * Set up output interrupt pipe if an output interrupt endpoint
570 	 * exists.
571 	 */
572 	if (sc->sc_oep_addr != -1) {
573 		DPRINTF(("uhidev_open: oep=0x%02x\n", sc->sc_oep_addr));
574 
575 		err = usbd_open_pipe(sc->sc_iface, sc->sc_oep_addr,
576 		    0, &sc->sc_opipe);
577 		if (err != USBD_NORMAL_COMPLETION) {
578 			DPRINTF(("uhidev_open: usbd_open_pipe failed, "
579 			    "error=%d\n", err));
580 			error = EIO;
581 			goto out2;
582 		}
583 
584 		DPRINTF(("uhidev_open: sc->sc_opipe=%p\n", sc->sc_opipe));
585 
586 		sc->sc_oxfer = usbd_alloc_xfer(sc->sc_udev);
587 		if (sc->sc_oxfer == NULL) {
588 			DPRINTF(("uhidev_open: couldn't allocate an xfer\n"));
589 			error = ENOMEM;
590 			goto out3;
591 		}
592 
593 		sc->sc_owxfer = usbd_alloc_xfer(sc->sc_udev);
594 		if (sc->sc_owxfer == NULL) {
595 			DPRINTF(("uhidev_open: couldn't allocate owxfer\n"));
596 			error = ENOMEM;
597 			goto out3;
598 		}
599 	}
600 
601 	return (0);
602 
603 out3:
604 	/* Abort output pipe */
605 	usbd_close_pipe(sc->sc_opipe);
606 out2:
607 	/* Abort input pipe */
608 	usbd_close_pipe(sc->sc_ipipe);
609 out1:
610 	DPRINTF(("uhidev_open: failed in someway"));
611 	free(sc->sc_ibuf, M_USBDEV, sc->sc_isize);
612 	scd->sc_state &= ~UHIDEV_OPEN;
613 	sc->sc_refcnt = 0;
614 	sc->sc_ipipe = NULL;
615 	sc->sc_opipe = NULL;
616 	if (sc->sc_oxfer != NULL) {
617 		usbd_free_xfer(sc->sc_oxfer);
618 		sc->sc_oxfer = NULL;
619 	}
620 	if (sc->sc_owxfer != NULL) {
621 		usbd_free_xfer(sc->sc_owxfer);
622 		sc->sc_owxfer = NULL;
623 	}
624 	if (sc->sc_ixfer != NULL) {
625 		usbd_free_xfer(sc->sc_ixfer);
626 		sc->sc_ixfer = NULL;
627 	}
628 	return (error);
629 }
630 
631 void
632 uhidev_close(struct uhidev *scd)
633 {
634 	struct uhidev_softc *sc = scd->sc_parent;
635 
636 	if (!(scd->sc_state & UHIDEV_OPEN))
637 		return;
638 	scd->sc_state &= ~UHIDEV_OPEN;
639 	if (--sc->sc_refcnt)
640 		return;
641 	DPRINTF(("uhidev_close: close pipe\n"));
642 
643 	/* Disable interrupts. */
644 	if (sc->sc_opipe != NULL) {
645 		usbd_close_pipe(sc->sc_opipe);
646 		sc->sc_opipe = NULL;
647 	}
648 
649 	if (sc->sc_ipipe != NULL) {
650 		usbd_close_pipe(sc->sc_ipipe);
651 		sc->sc_ipipe = NULL;
652 	}
653 
654 	if (sc->sc_oxfer != NULL) {
655 		usbd_free_xfer(sc->sc_oxfer);
656 		sc->sc_oxfer = NULL;
657 	}
658 
659 	if (sc->sc_owxfer != NULL) {
660 		usbd_free_xfer(sc->sc_owxfer);
661 		sc->sc_owxfer = NULL;
662 	}
663 
664 	if (sc->sc_ixfer != NULL) {
665 		usbd_free_xfer(sc->sc_ixfer);
666 		sc->sc_ixfer = NULL;
667 	}
668 
669 	if (sc->sc_ibuf != NULL) {
670 		free(sc->sc_ibuf, M_USBDEV, sc->sc_isize);
671 		sc->sc_ibuf = NULL;
672 	}
673 }
674 
675 int
676 uhidev_report_type_conv(int hid_type_id)
677 {
678 	switch (hid_type_id) {
679 	case hid_input:
680 		return UHID_INPUT_REPORT;
681 	case hid_output:
682 		return UHID_OUTPUT_REPORT;
683 	case hid_feature:
684 		return UHID_FEATURE_REPORT;
685 	default:
686 		return -1;
687 	}
688 }
689 
690 int
691 uhidev_set_report(struct uhidev_softc *sc, int type, int id, void *data,
692     int len)
693 {
694 	usb_device_request_t req;
695 	char *buf = data;
696 	int actlen = len;
697 
698 	/* Prepend the reportID. */
699 	if (id > 0) {
700 		len++;
701 		buf = malloc(len, M_TEMP, M_WAITOK);
702 		buf[0] = id;
703 		memcpy(buf + 1, data, len - 1);
704 	}
705 
706 	if (sc->sc_opipe != NULL) {
707 		usbd_setup_xfer(sc->sc_owxfer, sc->sc_opipe, 0, buf, len,
708 		    USBD_SYNCHRONOUS | USBD_CATCH, 0, NULL);
709 		if (usbd_transfer(sc->sc_owxfer)) {
710 			usbd_clear_endpoint_stall(sc->sc_opipe);
711 			actlen = -1;
712 		}
713 	} else {
714 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
715 		req.bRequest = UR_SET_REPORT;
716 		USETW2(req.wValue, type, id);
717 		USETW(req.wIndex, sc->sc_ifaceno);
718 		USETW(req.wLength, len);
719 
720 		if (usbd_do_request(sc->sc_udev, &req, buf))
721 			actlen = -1;
722 	}
723 
724 	if (id > 0)
725 		free(buf, M_TEMP, len);
726 
727 	return (actlen);
728 }
729 
730 void
731 uhidev_set_report_async_cb(struct usbd_xfer *xfer, void *priv, usbd_status err)
732 {
733 	struct uhidev_softc *sc = priv;
734 
735 	if (err == USBD_STALLED)
736 		usbd_clear_endpoint_stall_async(sc->sc_opipe);
737 	usbd_free_xfer(xfer);
738 }
739 
740 int
741 uhidev_set_report_async(struct uhidev_softc *sc, int type, int id, void *data,
742     int len)
743 {
744 	struct usbd_xfer *xfer;
745 	usb_device_request_t req;
746 	int actlen = len;
747 	char *buf;
748 
749 	xfer = usbd_alloc_xfer(sc->sc_udev);
750 	if (xfer == NULL)
751 		return (-1);
752 
753 	if (id > 0)
754 		len++;
755 
756 	buf = usbd_alloc_buffer(xfer, len);
757 	if (buf == NULL) {
758 		usbd_free_xfer(xfer);
759 		return (-1);
760 	}
761 
762 	/* Prepend the reportID. */
763 	if (id > 0) {
764 		buf[0] = id;
765 		memcpy(buf + 1, data, len - 1);
766 	} else {
767 		memcpy(buf, data, len);
768 	}
769 
770 	if (sc->sc_opipe != NULL) {
771 		usbd_setup_xfer(xfer, sc->sc_opipe, sc, buf, len,
772 		    USBD_NO_COPY, USBD_DEFAULT_TIMEOUT,
773 		    uhidev_set_report_async_cb);
774 		if (usbd_transfer(xfer)) {
775 			usbd_clear_endpoint_stall_async(sc->sc_opipe);
776 			actlen = -1;
777 		}
778 	} else {
779 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
780 		req.bRequest = UR_SET_REPORT;
781 		USETW2(req.wValue, type, id);
782 		USETW(req.wIndex, sc->sc_ifaceno);
783 		USETW(req.wLength, len);
784 		if (usbd_request_async(xfer, &req, NULL, NULL))
785 			actlen = -1;
786 	}
787 
788 	return (actlen);
789 }
790 
791 int
792 uhidev_get_report(struct uhidev_softc *sc, int type, int id, void *data,
793     int len)
794 {
795 	usb_device_request_t req;
796 	char *buf = data;
797 	usbd_status err;
798 	int actlen;
799 
800 	if (id > 0) {
801 		len++;
802 		buf = malloc(len, M_TEMP, M_WAITOK|M_ZERO);
803 	}
804 
805 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
806 	req.bRequest = UR_GET_REPORT;
807 	USETW2(req.wValue, type, id);
808 	USETW(req.wIndex, sc->sc_ifaceno);
809 	USETW(req.wLength, len);
810 
811 	err = usbd_do_request_flags(sc->sc_udev, &req, buf, 0, &actlen,
812 	    USBD_DEFAULT_TIMEOUT);
813 	if (err != USBD_NORMAL_COMPLETION && err != USBD_SHORT_XFER)
814 		actlen = -1;
815 
816 	/* Skip the reportID. */
817 	if (id > 0) {
818 		memcpy(data, buf + 1, len - 1);
819 		free(buf, M_TEMP, len);
820 	}
821 
822 	return (actlen);
823 }
824 
825 void
826 uhidev_get_report_async_cb(struct usbd_xfer *xfer, void *priv, usbd_status err)
827 {
828 	struct uhidev_async_info *info = priv;
829 	char *buf;
830 	int len = -1;
831 
832 	if (!usbd_is_dying(xfer->pipe->device)) {
833 		if (err == USBD_NORMAL_COMPLETION || err == USBD_SHORT_XFER) {
834 			len = xfer->actlen;
835 			buf = KERNADDR(&xfer->dmabuf, 0);
836 			if (info->id > 0) {
837 				len--;
838 				memcpy(info->data, buf + 1, len);
839 			} else {
840 				memcpy(info->data, buf, len);
841 			}
842 		}
843 		info->callback(info->priv, info->id, info->data, len);
844 	}
845 	free(info, M_TEMP, sizeof(*info));
846 	usbd_free_xfer(xfer);
847 }
848 
849 int
850 uhidev_get_report_async(struct uhidev_softc *sc, int type, int id, void *data,
851     int len, void *priv, void (*callback)(void *, int, void *, int))
852 {
853 	struct usbd_xfer *xfer;
854 	usb_device_request_t req;
855 	struct uhidev_async_info *info;
856 	int actlen = len;
857 	char *buf;
858 
859 	xfer = usbd_alloc_xfer(sc->sc_udev);
860 	if (xfer == NULL)
861 		return (-1);
862 
863 	if (id > 0)
864 		len++;
865 
866 	buf = usbd_alloc_buffer(xfer, len);
867 	if (buf == NULL) {
868 		usbd_free_xfer(xfer);
869 		return (-1);
870 	}
871 
872 	info = malloc(sizeof(*info), M_TEMP, M_NOWAIT);
873 	if (info == NULL) {
874 		usbd_free_xfer(xfer);
875 		return (-1);
876 	}
877 
878 	info->callback = callback;
879 	info->priv = priv;
880 	info->data = data;
881 	info->id = id;
882 
883 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
884 	req.bRequest = UR_GET_REPORT;
885 	USETW2(req.wValue, type, id);
886 	USETW(req.wIndex, sc->sc_ifaceno);
887 	USETW(req.wLength, len);
888 
889 	if (usbd_request_async(xfer, &req, info, uhidev_get_report_async_cb)) {
890 		free(info, M_TEMP, sizeof(*info));
891 		actlen = -1;
892 	}
893 
894 	return (actlen);
895 }
896 
897 usbd_status
898 uhidev_write(struct uhidev_softc *sc, void *data, int len)
899 {
900 	usbd_status error;
901 
902 	DPRINTF(("uhidev_write: data=%p, len=%d\n", data, len));
903 
904 	if (sc->sc_opipe == NULL)
905 		return USBD_INVAL;
906 
907 #ifdef UHIDEV_DEBUG
908 	if (uhidevdebug > 50) {
909 
910 		u_int32_t i;
911 		u_int8_t *d = data;
912 
913 		DPRINTF(("uhidev_write: data ="));
914 		for (i = 0; i < len; i++)
915 			DPRINTF((" %02x", d[i]));
916 		DPRINTF(("\n"));
917 	}
918 #endif
919 	usbd_setup_xfer(sc->sc_owxfer, sc->sc_opipe, 0, data, len,
920 	    USBD_SYNCHRONOUS | USBD_CATCH, 0, NULL);
921 	error = usbd_transfer(sc->sc_owxfer);
922 	if (error)
923 		usbd_clear_endpoint_stall(sc->sc_opipe);
924 
925 	return (error);
926 }
927 
928 int
929 uhidev_ioctl(struct uhidev *sc, u_long cmd, caddr_t addr, int flag,
930     struct proc *p)
931 {
932 	struct usb_ctl_report_desc *rd;
933 	struct usb_ctl_report *re;
934 	int size;
935 	void *desc;
936 
937 	switch (cmd) {
938 	case USB_GET_REPORT_DESC:
939 		uhidev_get_report_desc(sc->sc_parent, &desc, &size);
940 		rd = (struct usb_ctl_report_desc *)addr;
941 		size = min(size, sizeof rd->ucrd_data);
942 		rd->ucrd_size = size;
943 		memcpy(rd->ucrd_data, desc, size);
944 		break;
945 	case USB_GET_REPORT:
946 		re = (struct usb_ctl_report *)addr;
947 		switch (re->ucr_report) {
948 		case UHID_INPUT_REPORT:
949 			size = sc->sc_isize;
950 			break;
951 		case UHID_OUTPUT_REPORT:
952 			size = sc->sc_osize;
953 			break;
954 		case UHID_FEATURE_REPORT:
955 			size = sc->sc_fsize;
956 			break;
957 		default:
958 			return EINVAL;
959 		}
960 		if (uhidev_get_report(sc->sc_parent, re->ucr_report,
961 		    sc->sc_report_id, re->ucr_data, size) != size)
962 			return EIO;
963 		break;
964 	case USB_SET_REPORT:
965 		re = (struct usb_ctl_report *)addr;
966 		switch (re->ucr_report) {
967 		case UHID_INPUT_REPORT:
968 			size = sc->sc_isize;
969 			break;
970 		case UHID_OUTPUT_REPORT:
971 			size = sc->sc_osize;
972 			break;
973 		case UHID_FEATURE_REPORT:
974 			size = sc->sc_fsize;
975 			break;
976 		default:
977 			return EINVAL;
978 		}
979 		if (uhidev_set_report(sc->sc_parent, re->ucr_report,
980 		    sc->sc_report_id, re->ucr_data, size) != size)
981 			return EIO;
982 		break;
983 	case USB_GET_REPORT_ID:
984 		*(int *)addr = sc->sc_report_id;
985 		break;
986 	default:
987 		return -1;
988 	}
989 	return 0;
990 }
991 
992 int
993 uhidev_set_report_dev(struct uhidev_softc *sc, struct uhidev *dev, int repid)
994 {
995 	if ((dev->sc_state & UHIDEV_OPEN) == 0)
996 		return ENODEV;
997 	if (repid >= sc->sc_nrepid)
998 		return EINVAL;
999 
1000 	sc->sc_subdevs[repid] = dev;
1001 	return 0;
1002 }
1003