xref: /openbsd-src/sys/dev/usb/uhidev.c (revision ef70a379631ec7e97481e1d0e500e21496e6c4aa)
1 /*	$OpenBSD: uhidev.c,v 1.101 2021/11/17 06:20:30 anton Exp $	*/
2 /*	$NetBSD: uhidev.c,v 1.14 2003/03/11 16:44:00 augustss Exp $	*/
3 
4 /*
5  * Copyright (c) 2001 The NetBSD Foundation, Inc.
6  * All rights reserved.
7  *
8  * This code is derived from software contributed to The NetBSD Foundation
9  * by Lennart Augustsson (lennart@augustsson.net) at
10  * Carlstedt Research & Technology.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
25  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 /*
35  * HID spec: https://www.usb.org/sites/default/files/hid1_11.pdf
36  */
37 
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/kernel.h>
41 #include <sys/malloc.h>
42 #include <sys/signalvar.h>
43 #include <sys/device.h>
44 #include <sys/ioctl.h>
45 #include <sys/conf.h>
46 
47 #include <machine/bus.h>
48 
49 #include <dev/usb/usb.h>
50 #include <dev/usb/usbhid.h>
51 
52 #include <dev/usb/usbdevs.h>
53 #include <dev/usb/usbdi.h>
54 #include <dev/usb/usbdi_util.h>
55 #include <dev/usb/usbdivar.h>
56 #include <dev/usb/usb_mem.h>
57 #include <dev/usb/usb_quirks.h>
58 
59 #include <dev/usb/uhidev.h>
60 
61 #ifndef SMALL_KERNEL
62 /* Replacement report descriptors for devices shipped with broken ones */
63 #include <dev/usb/uhid_rdesc.h>
64 int uhidev_use_rdesc(struct uhidev_softc *, usb_interface_descriptor_t *,
65 		int, int, void **, int *);
66 #define UISUBCLASS_XBOX360_CONTROLLER 0x5d
67 #define UIPROTO_XBOX360_GAMEPAD 0x01
68 #endif /* !SMALL_KERNEL */
69 
70 #define DEVNAME(sc)		((sc)->sc_dev.dv_xname)
71 
72 #ifdef UHIDEV_DEBUG
73 #define DPRINTF(x)	do { if (uhidevdebug) printf x; } while (0)
74 #define DPRINTFN(n,x)	do { if (uhidevdebug>(n)) printf x; } while (0)
75 int	uhidevdebug = 0;
76 #else
77 #define DPRINTF(x)
78 #define DPRINTFN(n,x)
79 #endif
80 
81 struct uhidev_async_info {
82 	void (*callback)(void *priv, int id, void *data, int len);
83 	void *priv;
84 	void *data;
85 	int id;
86 };
87 
88 void uhidev_intr(struct usbd_xfer *, void *, usbd_status);
89 
90 int uhidev_maxrepid(void *buf, int len);
91 int uhidevprint(void *aux, const char *pnp);
92 
93 int uhidev_match(struct device *, void *, void *);
94 void uhidev_attach(struct device *, struct device *, void *);
95 int uhidev_detach(struct device *, int);
96 int uhidev_activate(struct device *, int);
97 
98 void uhidev_get_report_async_cb(struct usbd_xfer *, void *, usbd_status);
99 void uhidev_set_report_async_cb(struct usbd_xfer *, void *, usbd_status);
100 
101 struct cfdriver uhidev_cd = {
102 	NULL, "uhidev", DV_DULL
103 };
104 
105 const struct cfattach uhidev_ca = {
106 	sizeof(struct uhidev_softc), uhidev_match, uhidev_attach,
107 	uhidev_detach, uhidev_activate,
108 };
109 
110 int
111 uhidev_match(struct device *parent, void *match, void *aux)
112 {
113 	struct usb_attach_arg *uaa = aux;
114 	usb_interface_descriptor_t *id;
115 
116 	if (uaa->iface == NULL)
117 		return (UMATCH_NONE);
118 	id = usbd_get_interface_descriptor(uaa->iface);
119 	if (id == NULL)
120 		return (UMATCH_NONE);
121 #ifndef SMALL_KERNEL
122 	if (id->bInterfaceClass == UICLASS_VENDOR &&
123 	    id->bInterfaceSubClass == UISUBCLASS_XBOX360_CONTROLLER &&
124 	    id->bInterfaceProtocol == UIPROTO_XBOX360_GAMEPAD)
125 		return (UMATCH_IFACECLASS_IFACESUBCLASS_IFACEPROTO);
126 #endif /* !SMALL_KERNEL */
127 	if (id->bInterfaceClass != UICLASS_HID)
128 		return (UMATCH_NONE);
129 	if (usbd_get_quirks(uaa->device)->uq_flags & UQ_BAD_HID)
130 		return (UMATCH_NONE);
131 
132 	return (UMATCH_IFACECLASS_GENERIC);
133 }
134 
135 void
136 uhidev_attach(struct device *parent, struct device *self, void *aux)
137 {
138 	struct uhidev_softc *sc = (struct uhidev_softc *)self;
139 	struct usb_attach_arg *uaa = aux;
140 	usb_interface_descriptor_t *id;
141 	usb_endpoint_descriptor_t *ed;
142 	struct uhidev_attach_arg uha;
143 	int size, nrepid, repid, repsz;
144 	int i;
145 	void *desc = NULL;
146 	struct device *dev;
147 
148 	sc->sc_udev = uaa->device;
149 	sc->sc_iface = uaa->iface;
150 	sc->sc_ifaceno = uaa->ifaceno;
151 	id = usbd_get_interface_descriptor(sc->sc_iface);
152 
153 	sc->sc_iep_addr = sc->sc_oep_addr = -1;
154 	for (i = 0; i < id->bNumEndpoints; i++) {
155 		ed = usbd_interface2endpoint_descriptor(sc->sc_iface, i);
156 		if (ed == NULL) {
157 			printf("%s: could not read endpoint descriptor\n",
158 			    DEVNAME(sc));
159 			return;
160 		}
161 
162 		DPRINTFN(10,("uhidev_attach: bLength=%d bDescriptorType=%d "
163 		    "bEndpointAddress=%d-%s bmAttributes=%d wMaxPacketSize=%d"
164 		    " bInterval=%d\n",
165 		    ed->bLength, ed->bDescriptorType,
166 		    ed->bEndpointAddress & UE_ADDR,
167 		    UE_GET_DIR(ed->bEndpointAddress)==UE_DIR_IN? "in" : "out",
168 		    UE_GET_XFERTYPE(ed->bmAttributes),
169 		    UGETW(ed->wMaxPacketSize), ed->bInterval));
170 
171 		if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN &&
172 		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT) {
173 			sc->sc_iep_addr = ed->bEndpointAddress;
174 		} else if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT &&
175 		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_INTERRUPT) {
176 			sc->sc_oep_addr = ed->bEndpointAddress;
177 		} else {
178 			printf("%s: unexpected endpoint\n", DEVNAME(sc));
179 			return;
180 		}
181 	}
182 
183 	/*
184 	 * Check that we found an input interrupt endpoint.
185 	 * The output interrupt endpoint is optional
186 	 */
187 	if (sc->sc_iep_addr == -1) {
188 		printf("%s: no input interrupt endpoint\n", DEVNAME(sc));
189 		return;
190 	}
191 
192 #ifndef SMALL_KERNEL
193 	if (uhidev_use_rdesc(sc, id, uaa->vendor, uaa->product, &desc, &size))
194 		return;
195 #endif /* !SMALL_KERNEL */
196 
197 	if (desc == NULL) {
198 		struct usb_hid_descriptor *hid;
199 
200 		hid = usbd_get_hid_descriptor(sc->sc_udev, id);
201 		if (hid == NULL) {
202 			printf("%s: no HID descriptor\n", DEVNAME(sc));
203 			return;
204 		}
205 		size = UGETW(hid->descrs[0].wDescriptorLength);
206 		desc = malloc(size, M_USBDEV, M_NOWAIT);
207 		if (desc == NULL) {
208 			printf("%s: no memory\n", DEVNAME(sc));
209 			return;
210 		}
211 		if (usbd_get_report_descriptor(sc->sc_udev, sc->sc_ifaceno,
212 		    desc, size)) {
213 			printf("%s: no report descriptor\n", DEVNAME(sc));
214 			free(desc, M_USBDEV, size);
215 			return;
216 		}
217 	}
218 
219 	sc->sc_repdesc = desc;
220 	sc->sc_repdesc_size = size;
221 
222 	nrepid = uhidev_maxrepid(desc, size);
223 	if (nrepid < 0)
224 		return;
225 	printf("%s: iclass %d/%d", DEVNAME(sc), id->bInterfaceClass,
226 	    id->bInterfaceSubClass);
227 	if (nrepid > 0)
228 		printf(", %d report id%s", nrepid, nrepid > 1 ? "s" : "");
229 	printf("\n");
230 	nrepid++;
231 	sc->sc_subdevs = mallocarray(nrepid, sizeof(struct uhidev *),
232 	    M_USBDEV, M_NOWAIT | M_ZERO);
233 	if (sc->sc_subdevs == NULL) {
234 		printf("%s: no memory\n", DEVNAME(sc));
235 		return;
236 	}
237 	sc->sc_nrepid = nrepid;
238 	sc->sc_isize = 0;
239 
240 	for (repid = 0; repid < nrepid; repid++) {
241 		repsz = hid_report_size(desc, size, hid_input, repid);
242 		DPRINTF(("uhidev_match: repid=%d, repsz=%d\n", repid, repsz));
243 		if (repsz > sc->sc_isize)
244 			sc->sc_isize = repsz;
245 	}
246 	sc->sc_isize += (nrepid != 1);	/* one byte for the report ID */
247 	DPRINTF(("uhidev_attach: isize=%d\n", sc->sc_isize));
248 
249 	uha.uaa = uaa;
250 	uha.parent = sc;
251 	uha.reportid = __UHIDEV_CLAIM_MULTIPLE_REPORTID;
252 	uha.nreports = nrepid;
253 	uha.claimed = malloc(nrepid, M_TEMP, M_WAITOK|M_ZERO);
254 
255 	/* Look for a driver claiming multiple report IDs first. */
256 	dev = config_found_sm(self, &uha, NULL, NULL);
257 	if (dev != NULL) {
258 		for (repid = 0; repid < nrepid; repid++) {
259 			/*
260 			 * Could already be assigned by uhidev_set_report_dev().
261 			 */
262 			if (sc->sc_subdevs[repid] != NULL)
263 				continue;
264 
265 			if (uha.claimed[repid])
266 				sc->sc_subdevs[repid] = (struct uhidev *)dev;
267 		}
268 	}
269 
270 	free(uha.claimed, M_TEMP, nrepid);
271 	uha.claimed = NULL;
272 
273 	for (repid = 0; repid < nrepid; repid++) {
274 		DPRINTF(("%s: try repid=%d\n", __func__, repid));
275 		if (hid_report_size(desc, size, hid_input, repid) == 0 &&
276 		    hid_report_size(desc, size, hid_output, repid) == 0 &&
277 		    hid_report_size(desc, size, hid_feature, repid) == 0)
278 			continue;
279 
280 		/* Could already be assigned by uhidev_set_report_dev(). */
281 		if (sc->sc_subdevs[repid] != NULL)
282 			continue;
283 
284 		uha.reportid = repid;
285 		dev = config_found_sm(self, &uha, uhidevprint, NULL);
286 		sc->sc_subdevs[repid] = (struct uhidev *)dev;
287 	}
288 }
289 
290 #ifndef SMALL_KERNEL
291 int
292 uhidev_use_rdesc(struct uhidev_softc *sc, usb_interface_descriptor_t *id,
293 		int vendor, int product, void **descp, int *sizep)
294 {
295 	static uByte reportbuf[] = {2, 2};
296 	const void *descptr = NULL;
297 	void *desc;
298 	int size;
299 
300 	if (vendor == USB_VENDOR_WACOM) {
301 		/* The report descriptor for the Wacom Graphire is broken. */
302 		switch (product) {
303 		case USB_PRODUCT_WACOM_GRAPHIRE:
304 			size = sizeof(uhid_graphire_report_descr);
305 			descptr = uhid_graphire_report_descr;
306 			break;
307 		case USB_PRODUCT_WACOM_GRAPHIRE3_4X5:
308 		case USB_PRODUCT_WACOM_GRAPHIRE4_4X5:
309 			uhidev_set_report(sc, UHID_FEATURE_REPORT,
310 			    2, &reportbuf, sizeof(reportbuf));
311 			size = sizeof(uhid_graphire3_4x5_report_descr);
312 			descptr = uhid_graphire3_4x5_report_descr;
313 			break;
314 		default:
315 			break;
316 		}
317 	} else if ((id->bInterfaceClass == UICLASS_VENDOR &&
318 		   id->bInterfaceSubClass == UISUBCLASS_XBOX360_CONTROLLER &&
319 		   id->bInterfaceProtocol == UIPROTO_XBOX360_GAMEPAD)) {
320 		/* The Xbox 360 gamepad has no report descriptor. */
321 		size = sizeof(uhid_xb360gp_report_descr);
322 		descptr = uhid_xb360gp_report_descr;
323 	}
324 
325 	if (descptr) {
326 		desc = malloc(size, M_USBDEV, M_NOWAIT);
327 		if (desc == NULL)
328 			return (ENOMEM);
329 
330 		memcpy(desc, descptr, size);
331 
332 		*descp = desc;
333 		*sizep = size;
334 	}
335 
336 	return (0);
337 }
338 #endif /* !SMALL_KERNEL */
339 
340 int
341 uhidev_maxrepid(void *buf, int len)
342 {
343 	struct hid_data *d;
344 	struct hid_item h;
345 	int maxid;
346 
347 	maxid = -1;
348 	h.report_ID = 0;
349 	for (d = hid_start_parse(buf, len, hid_none); hid_get_item(d, &h); )
350 		if (h.report_ID > maxid)
351 			maxid = h.report_ID;
352 	hid_end_parse(d);
353 	return (maxid);
354 }
355 
356 int
357 uhidevprint(void *aux, const char *pnp)
358 {
359 	struct uhidev_attach_arg *uha = aux;
360 
361 	if (pnp)
362 		printf("uhid at %s", pnp);
363 	if (uha->reportid != 0 && uha->reportid != __UHIDEV_CLAIM_MULTIPLE_REPORTID)
364 		printf(" reportid %d", uha->reportid);
365 	return (UNCONF);
366 }
367 
368 int
369 uhidev_activate(struct device *self, int act)
370 {
371 	struct uhidev_softc *sc = (struct uhidev_softc *)self;
372 	int i, j, already, rv = 0, r;
373 
374 	switch (act) {
375 	case DVACT_DEACTIVATE:
376 		for (i = 0; i < sc->sc_nrepid; i++) {
377 			if (sc->sc_subdevs[i] == NULL)
378 				continue;
379 
380 			/*
381 			 * Only notify devices attached to multiple report ids
382 			 * once.
383 			 */
384 			for (already = 0, j = 0; j < i; j++) {
385 				if (sc->sc_subdevs[i] == sc->sc_subdevs[j]) {
386 					already = 1;
387 					break;
388 				}
389 			}
390 
391 			if (!already) {
392 				r = config_deactivate(
393 				    &sc->sc_subdevs[i]->sc_dev);
394 				if (r && r != EOPNOTSUPP)
395 					rv = r;
396 			}
397 		}
398 		usbd_deactivate(sc->sc_udev);
399 		break;
400 	}
401 	return (rv);
402 }
403 
404 int
405 uhidev_detach(struct device *self, int flags)
406 {
407 	struct uhidev_softc *sc = (struct uhidev_softc *)self;
408 	int i, j, rv = 0;
409 
410 	DPRINTF(("uhidev_detach: sc=%p flags=%d\n", sc, flags));
411 
412 	if (sc->sc_opipe != NULL) {
413 		usbd_close_pipe(sc->sc_opipe);
414 		sc->sc_opipe = NULL;
415 	}
416 
417 	if (sc->sc_ipipe != NULL) {
418 		usbd_close_pipe(sc->sc_ipipe);
419 		sc->sc_ipipe = NULL;
420 	}
421 
422 	if (sc->sc_repdesc != NULL)
423 		free(sc->sc_repdesc, M_USBDEV, sc->sc_repdesc_size);
424 
425 	for (i = 0; i < sc->sc_nrepid; i++) {
426 		if (sc->sc_subdevs[i] == NULL)
427 			continue;
428 
429 		rv |= config_detach(&sc->sc_subdevs[i]->sc_dev, flags);
430 
431 		/*
432 		 * Nullify without detaching any other instances of this device
433 		 * found on other report ids.
434 		 */
435 		for (j = i + 1; j < sc->sc_nrepid; j++) {
436 			if (sc->sc_subdevs[i] == sc->sc_subdevs[j])
437 				sc->sc_subdevs[j] = NULL;
438 		}
439 
440 		sc->sc_subdevs[i] = NULL;
441 	}
442 	free(sc->sc_subdevs, M_USBDEV, sc->sc_nrepid * sizeof(struct uhidev *));
443 
444 	return (rv);
445 }
446 
447 void
448 uhidev_intr(struct usbd_xfer *xfer, void *addr, usbd_status status)
449 {
450 	struct uhidev_softc *sc = addr;
451 	struct uhidev *scd;
452 	u_char *p;
453 	u_int rep;
454 	u_int32_t cc;
455 
456 	if (usbd_is_dying(sc->sc_udev))
457 		return;
458 
459 	usbd_get_xfer_status(xfer, NULL, NULL, &cc, NULL);
460 
461 #ifdef UHIDEV_DEBUG
462 	if (uhidevdebug > 5) {
463 		u_int32_t i;
464 
465 		DPRINTF(("uhidev_intr: status=%d cc=%d\n", status, cc));
466 		DPRINTF(("uhidev_intr: data ="));
467 		for (i = 0; i < cc; i++)
468 			DPRINTF((" %02x", sc->sc_ibuf[i]));
469 		DPRINTF(("\n"));
470 	}
471 #endif
472 
473 	if (status == USBD_CANCELLED || status == USBD_IOERROR)
474 		return;
475 
476 	if (status != USBD_NORMAL_COMPLETION) {
477 		DPRINTF(("%s: interrupt status=%d\n", DEVNAME(sc), status));
478 		usbd_clear_endpoint_stall_async(sc->sc_ipipe);
479 		return;
480 	}
481 
482 	p = sc->sc_ibuf;
483 	if (sc->sc_nrepid != 1)
484 		rep = *p++, cc--;
485 	else
486 		rep = 0;
487 	if (rep >= sc->sc_nrepid) {
488 		printf("uhidev_intr: bad repid %d\n", rep);
489 		return;
490 	}
491 	scd = sc->sc_subdevs[rep];
492 	DPRINTFN(5,("uhidev_intr: rep=%d, scd=%p state=0x%x\n",
493 		    rep, scd, scd ? scd->sc_state : 0));
494 	if (scd == NULL || !(scd->sc_state & UHIDEV_OPEN))
495 		return;
496 
497 	scd->sc_intr(scd, p, cc);
498 }
499 
500 void
501 uhidev_get_report_desc(struct uhidev_softc *sc, void **desc, int *size)
502 {
503 	*desc = sc->sc_repdesc;
504 	*size = sc->sc_repdesc_size;
505 }
506 
507 int
508 uhidev_open(struct uhidev *scd)
509 {
510 	struct uhidev_softc *sc = scd->sc_parent;
511 	usbd_status err;
512 	int error;
513 
514 	DPRINTF(("uhidev_open: open pipe, state=%d refcnt=%d\n",
515 		 scd->sc_state, sc->sc_refcnt));
516 
517 	if (scd->sc_state & UHIDEV_OPEN)
518 		return (EBUSY);
519 	scd->sc_state |= UHIDEV_OPEN;
520 	if (sc->sc_refcnt++)
521 		return (0);
522 
523 	if (sc->sc_isize == 0)
524 		return (0);
525 
526 	sc->sc_ibuf = malloc(sc->sc_isize, M_USBDEV, M_WAITOK);
527 
528 	/* Set up input interrupt pipe. */
529 	DPRINTF(("uhidev_open: isize=%d, ep=0x%02x\n", sc->sc_isize,
530 	    sc->sc_iep_addr));
531 
532 	err = usbd_open_pipe_intr(sc->sc_iface, sc->sc_iep_addr,
533 		  USBD_SHORT_XFER_OK, &sc->sc_ipipe, sc, sc->sc_ibuf,
534 		  sc->sc_isize, uhidev_intr, USBD_DEFAULT_INTERVAL);
535 	if (err != USBD_NORMAL_COMPLETION) {
536 		DPRINTF(("uhidopen: usbd_open_pipe_intr failed, "
537 		    "error=%d\n", err));
538 		error = EIO;
539 		goto out1;
540 	}
541 
542 	DPRINTF(("uhidev_open: sc->sc_ipipe=%p\n", sc->sc_ipipe));
543 
544 	sc->sc_ixfer = usbd_alloc_xfer(sc->sc_udev);
545 	if (sc->sc_ixfer == NULL) {
546 		DPRINTF(("uhidev_open: couldn't allocate an xfer\n"));
547 		error = ENOMEM;
548 		goto out1; // xxxx
549 	}
550 
551 	/*
552 	 * Set up output interrupt pipe if an output interrupt endpoint
553 	 * exists.
554 	 */
555 	if (sc->sc_oep_addr != -1) {
556 		DPRINTF(("uhidev_open: oep=0x%02x\n", sc->sc_oep_addr));
557 
558 		err = usbd_open_pipe(sc->sc_iface, sc->sc_oep_addr,
559 		    0, &sc->sc_opipe);
560 		if (err != USBD_NORMAL_COMPLETION) {
561 			DPRINTF(("uhidev_open: usbd_open_pipe failed, "
562 			    "error=%d\n", err));
563 			error = EIO;
564 			goto out2;
565 		}
566 
567 		DPRINTF(("uhidev_open: sc->sc_opipe=%p\n", sc->sc_opipe));
568 
569 		sc->sc_oxfer = usbd_alloc_xfer(sc->sc_udev);
570 		if (sc->sc_oxfer == NULL) {
571 			DPRINTF(("uhidev_open: couldn't allocate an xfer\n"));
572 			error = ENOMEM;
573 			goto out3;
574 		}
575 
576 		sc->sc_owxfer = usbd_alloc_xfer(sc->sc_udev);
577 		if (sc->sc_owxfer == NULL) {
578 			DPRINTF(("uhidev_open: couldn't allocate owxfer\n"));
579 			error = ENOMEM;
580 			goto out3;
581 		}
582 	}
583 
584 	return (0);
585 
586 out3:
587 	/* Abort output pipe */
588 	usbd_close_pipe(sc->sc_opipe);
589 out2:
590 	/* Abort input pipe */
591 	usbd_close_pipe(sc->sc_ipipe);
592 out1:
593 	DPRINTF(("uhidev_open: failed in someway"));
594 	free(sc->sc_ibuf, M_USBDEV, sc->sc_isize);
595 	sc->sc_ibuf = NULL;
596 	scd->sc_state &= ~UHIDEV_OPEN;
597 	sc->sc_refcnt = 0;
598 	sc->sc_ipipe = NULL;
599 	sc->sc_opipe = NULL;
600 	if (sc->sc_oxfer != NULL) {
601 		usbd_free_xfer(sc->sc_oxfer);
602 		sc->sc_oxfer = NULL;
603 	}
604 	if (sc->sc_owxfer != NULL) {
605 		usbd_free_xfer(sc->sc_owxfer);
606 		sc->sc_owxfer = NULL;
607 	}
608 	if (sc->sc_ixfer != NULL) {
609 		usbd_free_xfer(sc->sc_ixfer);
610 		sc->sc_ixfer = NULL;
611 	}
612 	return (error);
613 }
614 
615 void
616 uhidev_close(struct uhidev *scd)
617 {
618 	struct uhidev_softc *sc = scd->sc_parent;
619 
620 	if (!(scd->sc_state & UHIDEV_OPEN))
621 		return;
622 	scd->sc_state &= ~UHIDEV_OPEN;
623 	if (--sc->sc_refcnt)
624 		return;
625 	DPRINTF(("uhidev_close: close pipe\n"));
626 
627 	/* Disable interrupts. */
628 	if (sc->sc_opipe != NULL) {
629 		usbd_close_pipe(sc->sc_opipe);
630 		sc->sc_opipe = NULL;
631 	}
632 
633 	if (sc->sc_ipipe != NULL) {
634 		usbd_close_pipe(sc->sc_ipipe);
635 		sc->sc_ipipe = NULL;
636 	}
637 
638 	if (sc->sc_oxfer != NULL) {
639 		usbd_free_xfer(sc->sc_oxfer);
640 		sc->sc_oxfer = NULL;
641 	}
642 
643 	if (sc->sc_owxfer != NULL) {
644 		usbd_free_xfer(sc->sc_owxfer);
645 		sc->sc_owxfer = NULL;
646 	}
647 
648 	if (sc->sc_ixfer != NULL) {
649 		usbd_free_xfer(sc->sc_ixfer);
650 		sc->sc_ixfer = NULL;
651 	}
652 
653 	if (sc->sc_ibuf != NULL) {
654 		free(sc->sc_ibuf, M_USBDEV, sc->sc_isize);
655 		sc->sc_ibuf = NULL;
656 	}
657 }
658 
659 int
660 uhidev_report_type_conv(int hid_type_id)
661 {
662 	switch (hid_type_id) {
663 	case hid_input:
664 		return UHID_INPUT_REPORT;
665 	case hid_output:
666 		return UHID_OUTPUT_REPORT;
667 	case hid_feature:
668 		return UHID_FEATURE_REPORT;
669 	default:
670 		return -1;
671 	}
672 }
673 
674 int
675 uhidev_set_report(struct uhidev_softc *sc, int type, int id, void *data,
676     int len)
677 {
678 	usb_device_request_t req;
679 	char *buf = data;
680 	int actlen = len;
681 
682 	/* Prepend the reportID. */
683 	if (id > 0) {
684 		len++;
685 		buf = malloc(len, M_TEMP, M_WAITOK);
686 		buf[0] = id;
687 		memcpy(buf + 1, data, len - 1);
688 	}
689 
690 	if (sc->sc_opipe != NULL) {
691 		usbd_setup_xfer(sc->sc_owxfer, sc->sc_opipe, 0, buf, len,
692 		    USBD_SYNCHRONOUS | USBD_CATCH, 0, NULL);
693 		if (usbd_transfer(sc->sc_owxfer)) {
694 			usbd_clear_endpoint_stall(sc->sc_opipe);
695 			actlen = -1;
696 		}
697 	} else {
698 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
699 		req.bRequest = UR_SET_REPORT;
700 		USETW2(req.wValue, type, id);
701 		USETW(req.wIndex, sc->sc_ifaceno);
702 		USETW(req.wLength, len);
703 
704 		if (usbd_do_request(sc->sc_udev, &req, buf))
705 			actlen = -1;
706 	}
707 
708 	if (id > 0)
709 		free(buf, M_TEMP, len);
710 
711 	return (actlen);
712 }
713 
714 void
715 uhidev_set_report_async_cb(struct usbd_xfer *xfer, void *priv, usbd_status err)
716 {
717 	struct uhidev_softc *sc = priv;
718 
719 	if (err == USBD_STALLED)
720 		usbd_clear_endpoint_stall_async(sc->sc_opipe);
721 	usbd_free_xfer(xfer);
722 }
723 
724 int
725 uhidev_set_report_async(struct uhidev_softc *sc, int type, int id, void *data,
726     int len)
727 {
728 	struct usbd_xfer *xfer;
729 	usb_device_request_t req;
730 	int actlen = len;
731 	char *buf;
732 
733 	xfer = usbd_alloc_xfer(sc->sc_udev);
734 	if (xfer == NULL)
735 		return (-1);
736 
737 	if (id > 0)
738 		len++;
739 
740 	buf = usbd_alloc_buffer(xfer, len);
741 	if (buf == NULL) {
742 		usbd_free_xfer(xfer);
743 		return (-1);
744 	}
745 
746 	/* Prepend the reportID. */
747 	if (id > 0) {
748 		buf[0] = id;
749 		memcpy(buf + 1, data, len - 1);
750 	} else {
751 		memcpy(buf, data, len);
752 	}
753 
754 	if (sc->sc_opipe != NULL) {
755 		usbd_setup_xfer(xfer, sc->sc_opipe, sc, buf, len,
756 		    USBD_NO_COPY, USBD_DEFAULT_TIMEOUT,
757 		    uhidev_set_report_async_cb);
758 		if (usbd_transfer(xfer)) {
759 			usbd_clear_endpoint_stall_async(sc->sc_opipe);
760 			actlen = -1;
761 		}
762 	} else {
763 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
764 		req.bRequest = UR_SET_REPORT;
765 		USETW2(req.wValue, type, id);
766 		USETW(req.wIndex, sc->sc_ifaceno);
767 		USETW(req.wLength, len);
768 		if (usbd_request_async(xfer, &req, NULL, NULL))
769 			actlen = -1;
770 	}
771 
772 	return (actlen);
773 }
774 
775 int
776 uhidev_get_report(struct uhidev_softc *sc, int type, int id, void *data,
777     int len)
778 {
779 	usb_device_request_t req;
780 	char *buf = data;
781 	usbd_status err;
782 	int actlen;
783 
784 	if (id > 0) {
785 		len++;
786 		buf = malloc(len, M_TEMP, M_WAITOK|M_ZERO);
787 	}
788 
789 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
790 	req.bRequest = UR_GET_REPORT;
791 	USETW2(req.wValue, type, id);
792 	USETW(req.wIndex, sc->sc_ifaceno);
793 	USETW(req.wLength, len);
794 
795 	err = usbd_do_request_flags(sc->sc_udev, &req, buf, 0, &actlen,
796 	    USBD_DEFAULT_TIMEOUT);
797 	if (err != USBD_NORMAL_COMPLETION && err != USBD_SHORT_XFER)
798 		actlen = -1;
799 
800 	/* Skip the reportID. */
801 	if (id > 0) {
802 		memcpy(data, buf + 1, len - 1);
803 		free(buf, M_TEMP, len);
804 	}
805 
806 	return (actlen);
807 }
808 
809 void
810 uhidev_get_report_async_cb(struct usbd_xfer *xfer, void *priv, usbd_status err)
811 {
812 	struct uhidev_async_info *info = priv;
813 	char *buf;
814 	int len = -1;
815 
816 	if (!usbd_is_dying(xfer->pipe->device)) {
817 		if (err == USBD_NORMAL_COMPLETION || err == USBD_SHORT_XFER) {
818 			len = xfer->actlen;
819 			buf = KERNADDR(&xfer->dmabuf, 0);
820 			if (info->id > 0) {
821 				len--;
822 				memcpy(info->data, buf + 1, len);
823 			} else {
824 				memcpy(info->data, buf, len);
825 			}
826 		}
827 		info->callback(info->priv, info->id, info->data, len);
828 	}
829 	free(info, M_TEMP, sizeof(*info));
830 	usbd_free_xfer(xfer);
831 }
832 
833 int
834 uhidev_get_report_async(struct uhidev_softc *sc, int type, int id, void *data,
835     int len, void *priv, void (*callback)(void *, int, void *, int))
836 {
837 	struct usbd_xfer *xfer;
838 	usb_device_request_t req;
839 	struct uhidev_async_info *info;
840 	int actlen = len;
841 	char *buf;
842 
843 	xfer = usbd_alloc_xfer(sc->sc_udev);
844 	if (xfer == NULL)
845 		return (-1);
846 
847 	if (id > 0)
848 		len++;
849 
850 	buf = usbd_alloc_buffer(xfer, len);
851 	if (buf == NULL) {
852 		usbd_free_xfer(xfer);
853 		return (-1);
854 	}
855 
856 	info = malloc(sizeof(*info), M_TEMP, M_NOWAIT);
857 	if (info == NULL) {
858 		usbd_free_xfer(xfer);
859 		return (-1);
860 	}
861 
862 	info->callback = callback;
863 	info->priv = priv;
864 	info->data = data;
865 	info->id = id;
866 
867 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
868 	req.bRequest = UR_GET_REPORT;
869 	USETW2(req.wValue, type, id);
870 	USETW(req.wIndex, sc->sc_ifaceno);
871 	USETW(req.wLength, len);
872 
873 	if (usbd_request_async(xfer, &req, info, uhidev_get_report_async_cb)) {
874 		free(info, M_TEMP, sizeof(*info));
875 		actlen = -1;
876 	}
877 
878 	return (actlen);
879 }
880 
881 usbd_status
882 uhidev_write(struct uhidev_softc *sc, void *data, int len)
883 {
884 	usbd_status error;
885 
886 	DPRINTF(("uhidev_write: data=%p, len=%d\n", data, len));
887 
888 	if (sc->sc_opipe == NULL)
889 		return USBD_INVAL;
890 
891 #ifdef UHIDEV_DEBUG
892 	if (uhidevdebug > 50) {
893 
894 		u_int32_t i;
895 		u_int8_t *d = data;
896 
897 		DPRINTF(("uhidev_write: data ="));
898 		for (i = 0; i < len; i++)
899 			DPRINTF((" %02x", d[i]));
900 		DPRINTF(("\n"));
901 	}
902 #endif
903 	usbd_setup_xfer(sc->sc_owxfer, sc->sc_opipe, 0, data, len,
904 	    USBD_SYNCHRONOUS | USBD_CATCH, 0, NULL);
905 	error = usbd_transfer(sc->sc_owxfer);
906 	if (error)
907 		usbd_clear_endpoint_stall(sc->sc_opipe);
908 
909 	return (error);
910 }
911 
912 int
913 uhidev_ioctl(struct uhidev *sc, u_long cmd, caddr_t addr, int flag,
914     struct proc *p)
915 {
916 	struct usb_ctl_report_desc *rd;
917 	struct usb_ctl_report *re;
918 	int size;
919 	void *desc;
920 
921 	switch (cmd) {
922 	case USB_GET_REPORT_DESC:
923 		uhidev_get_report_desc(sc->sc_parent, &desc, &size);
924 		rd = (struct usb_ctl_report_desc *)addr;
925 		size = min(size, sizeof rd->ucrd_data);
926 		rd->ucrd_size = size;
927 		memcpy(rd->ucrd_data, desc, size);
928 		break;
929 	case USB_GET_REPORT:
930 		re = (struct usb_ctl_report *)addr;
931 		switch (re->ucr_report) {
932 		case UHID_INPUT_REPORT:
933 			size = sc->sc_isize;
934 			break;
935 		case UHID_OUTPUT_REPORT:
936 			size = sc->sc_osize;
937 			break;
938 		case UHID_FEATURE_REPORT:
939 			size = sc->sc_fsize;
940 			break;
941 		default:
942 			return EINVAL;
943 		}
944 		if (uhidev_get_report(sc->sc_parent, re->ucr_report,
945 		    sc->sc_report_id, re->ucr_data, size) != size)
946 			return EIO;
947 		break;
948 	case USB_SET_REPORT:
949 		re = (struct usb_ctl_report *)addr;
950 		switch (re->ucr_report) {
951 		case UHID_INPUT_REPORT:
952 			size = sc->sc_isize;
953 			break;
954 		case UHID_OUTPUT_REPORT:
955 			size = sc->sc_osize;
956 			break;
957 		case UHID_FEATURE_REPORT:
958 			size = sc->sc_fsize;
959 			break;
960 		default:
961 			return EINVAL;
962 		}
963 		if (uhidev_set_report(sc->sc_parent, re->ucr_report,
964 		    sc->sc_report_id, re->ucr_data, size) != size)
965 			return EIO;
966 		break;
967 	case USB_GET_REPORT_ID:
968 		*(int *)addr = sc->sc_report_id;
969 		break;
970 	default:
971 		return -1;
972 	}
973 	return 0;
974 }
975 
976 int
977 uhidev_set_report_dev(struct uhidev_softc *sc, struct uhidev *dev, int repid)
978 {
979 	if ((dev->sc_state & UHIDEV_OPEN) == 0)
980 		return ENODEV;
981 	if (repid >= sc->sc_nrepid)
982 		return EINVAL;
983 
984 	sc->sc_subdevs[repid] = dev;
985 	return 0;
986 }
987