sys/dev/misc/cmx/cmx.c

   1 /*-
   2  * Copyright (c) 2006-2007 Daniel Roethlisberger <daniel@roe.ch>
   3  * Copyright (c) 2000-2004 OMNIKEY GmbH (www.omnikey.com)
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice unmodified, this list of conditions, and the following
  11  *    disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  19  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  26  * SUCH DAMAGE.
  27  *
  28  * $FreeBSD: src/sys/dev/cmx/cmx.c,v 1.1 2008/03/06 08:09:45 rink Exp $
  29  * $DragonFly: src/sys/dev/misc/cmx/cmx.c,v 1.2 2008/08/08 18:33:11 hasso Exp $
  30  */
  31
  32 /*
  33  * OMNIKEY CardMan 4040 a.k.a. CardMan eXtended (cmx) driver.
  34  * This is a PCMCIA based smartcard reader which seems to work
  35  * like an I/O port mapped USB CCID smartcard device.
  36  *
  37  * I/O originally based on Linux driver version 1.1.0 by OMNIKEY.
  38  * Dual GPL/BSD.  Almost all of the code has been rewritten.
  39  * $Omnikey: cm4040_cs.c,v 1.7 2004/10/04 09:08:50 jp Exp $
  40  */
  41
  42 #include <sys/param.h>
  43 #include <sys/systm.h>
  44 #include <sys/kernel.h>
  45 #include <sys/sockio.h>
  46 #include <sys/mbuf.h>
  47 #include <sys/poll.h>
  48 #include <sys/event.h>
  49 #include <sys/conf.h>
  50 #include <sys/fcntl.h>
  51 #include <sys/uio.h>
  52 #include <sys/selinfo.h>
  53 #include <sys/types.h>
  54 #include <sys/lock.h>
  55 #include <sys/device.h>
  56 #include <sys/thread2.h>
  57
  58 #include <sys/module.h>
  59 #include <sys/bus.h>
  60 #include <sys/resource.h>
  61 #include <sys/rman.h>
  62
  63 #include "cmxvar.h"
  64 #include "cmxreg.h"
  65
  66 #ifdef CMX_DEBUG
  67 #define DEBUG_printf(dev, fmt, args...) \
  68         device_printf(dev, "%s: " fmt, __FUNCTION__, ##args)
  69 #else
  70 #define DEBUG_printf(dev, fmt, args...)
  71 #endif
  72
  73 #define SPIN_COUNT                              1000
  74 #define WAIT_TICKS                              (hz/100)
  75 #define POLL_TICKS                              (hz/10)
  76
  77 /* possibly bogus */
  78 #define CCID_DRIVER_BULK_DEFAULT_TIMEOUT        (150*hz)
  79 #define CCID_DRIVER_ASYNC_POWERUP_TIMEOUT       (35*hz)
  80 #define CCID_DRIVER_MINIMUM_TIMEOUT             (3*hz)
  81
  82 #ifdef CMX_DEBUG
  83 static char     BSRBITS[] = "\020"
  84         "\01BULK_OUT_FULL"              /* 0x01 */
  85         "\02BULK_IN_FULL"               /* 0x02 */
  86         "\03(0x04)";                    /* 0x04 */
  87 #ifdef CMX_INTR
  88 static char     SCRBITS[] = "\020"
  89         "\01POWER_DOWN"                 /* 0x01 */
  90         "\02PULSE_INTERRUPT"            /* 0x02 */
  91         "\03HOST_TO_READER_DONE"        /* 0x04 */
  92         "\04READER_TO_HOST_DONE"        /* 0x08 */
  93         "\05ACK_NOTIFY"                 /* 0x10 */
  94         "\06EN_NOTIFY"                  /* 0x20 */
  95         "\07ABORT"                      /* 0x40 */
  96         "\10HOST_TO_READER_START";      /* 0x80 */
  97 #endif /* CMX_INTR */
  98 static char     POLLBITS[] = "\020"
  99         "\01POLLIN"                     /* 0x0001 */
 100         "\02POLLPRI"                    /* 0x0002 */
 101         "\03POLLOUT"                    /* 0x0004 */
 102         "\04POLLERR"                    /* 0x0008 */
 103         "\05POLLHUP"                    /* 0x0010 */
 104         "\06POLLINVAL"                  /* 0x0020 */
 105         "\07POLLRDNORM"                 /* 0x0040 */
 106         "\10POLLRDBAND"                 /* 0x0080 */
 107         "\11POLLWRBAND";                /* 0x0100 */
 108 static char     MODEBITS[] = "\020"
 109         "\01READ"                       /* 0x0001 */
 110         "\02WRITE"                      /* 0x0002 */
 111         "\03NONBLOCK"                   /* 0x0004 */
 112         "\04APPEND"                     /* 0x0008 */
 113         "\05SHLOCK"                     /* 0x0010 */
 114         "\06EXLOCK"                     /* 0x0020 */
 115         "\07ASYNC"                      /* 0x0040 */
 116         "\10FSYNC"                      /* 0x0080 */
 117         "\11NOFOLLOW"                   /* 0x0100 */
 118         "\12CREAT"                      /* 0x0200 */
 119         "\13TRUNK"                      /* 0x0400 */
 120         "\14EXCL"                       /* 0x0800 */
 121         "\15(0x1000)"                   /* 0x1000 */
 122         "\16(0x2000)"                   /* 0x2000 */
 123         "\17HASLOCK"                    /* 0x4000 */
 124         "\20NOCTTY"                     /* 0x8000 */
 125         "\21DIRECT";                    /* 0x00010000 */
 126 #endif /* CMX_DEBUG */
 127
 128 devclass_t cmx_devclass;
 129
 130 static d_open_t         cmx_open;
 131 static d_close_t        cmx_close;
 132 static d_read_t         cmx_read;
 133 static d_write_t        cmx_write;
 134 static d_poll_t         cmx_poll;
 135 static d_kqfilter_t     cmx_kqfilter;
 136 #ifdef CMX_INTR
 137 static void             cmx_intr(void *arg);
 138 #endif
 139
 140 static void cmx_filter_detach(struct knote *);
 141 static int cmx_filter_read(struct knote *, long);
 142 static int cmx_filter_write(struct knote *, long);
 143
 144 #define CDEV_MAJOR      185
 145 static struct dev_ops cmx_ops = {
 146         { "cmx", CDEV_MAJOR, D_KQFILTER },
 147         .d_open =       cmx_open,
 148         .d_close =      cmx_close,
 149         .d_read =       cmx_read,
 150         .d_write =      cmx_write,
 151         .d_poll =       cmx_poll,
 152         .d_kqfilter =   cmx_kqfilter
 153 };
 154
 155 /*
 156  * Initialize the softc structure.  Must be called from
 157  * the bus specific device allocation routine.
 158  */
 159 void
 160 cmx_init_softc(device_t dev)
 161 {
 162         struct cmx_softc *sc = device_get_softc(dev);
 163         sc->dev = dev;
 164         sc->timeout = CCID_DRIVER_MINIMUM_TIMEOUT;
 165 }
 166
 167 /*
 168  * Allocate driver resources.  Must be called from the
 169  * bus specific device allocation routine.  Caller must
 170  * ensure to call cmx_release_resources to free the
 171  * resources when detaching.
 172  * Return zero if successful, and ENOMEM if the resources
 173  * could not be allocated.
 174  */
 175 int
 176 cmx_alloc_resources(device_t dev)
 177 {
 178         struct cmx_softc *sc = device_get_softc(dev);
 179 #ifdef CMX_INTR
 180         int rv;
 181 #endif
 182
 183         sc->ioport = bus_alloc_resource_any(dev, SYS_RES_IOPORT,
 184                         &sc->ioport_rid, RF_ACTIVE);
 185         if (!sc->ioport) {
 186                 device_printf(dev, "failed to allocate io port\n");
 187                 return ENOMEM;
 188         }
 189         sc->bst = rman_get_bustag(sc->ioport);
 190         sc->bsh = rman_get_bushandle(sc->ioport);
 191
 192 #ifdef CMX_INTR
 193         sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ,
 194                         &sc->irq_rid, RF_ACTIVE);
 195         if (!sc->irq) {
 196                 device_printf(dev, "failed to allocate irq\n");
 197                 return ENOMEM;
 198         }
 199         if ((rv = bus_setup_intr(dev, sc->irq, 0, cmx_intr, sc,
 200                         &sc->ih, NULL)) != 0) {
 201                 device_printf(dev, "failed to set up irq\n");
 202                 return ENOMEM;
 203         }
 204 #endif
 205
 206         lockinit(&sc->mtx, "cmx softc lock", 0, LK_CANRECURSE);
 207         callout_init(&sc->ch);
 208
 209         return 0;
 210 }
 211
 212 /*
 213  * Release the resources allocated by cmx_allocate_resources.
 214  */
 215 void
 216 cmx_release_resources(device_t dev)
 217 {
 218         struct cmx_softc *sc = device_get_softc(dev);
 219
 220         lockuninit(&sc->mtx);
 221
 222 #ifdef CMX_INTR
 223         if (sc->ih) {
 224                 bus_teardown_intr(dev, sc->irq, sc->ih);
 225                 sc->ih = NULL;
 226         }
 227         if (sc->irq) {
 228                 bus_release_resource(dev, SYS_RES_IRQ,
 229                                 sc->irq_rid, sc->irq);
 230                 sc->irq = NULL;
 231         }
 232 #endif
 233
 234         if (sc->ioport) {
 235                 bus_deactivate_resource(dev, SYS_RES_IOPORT,
 236                                 sc->ioport_rid, sc->ioport);
 237                 bus_release_resource(dev, SYS_RES_IOPORT,
 238                                 sc->ioport_rid, sc->ioport);
 239                 sc->ioport = NULL;
 240         }
 241         return;
 242 }
 243
 244 /*
 245  * Bus independant device attachment routine.  Creates the
 246  * character device node.
 247  */
 248 int
 249 cmx_attach(device_t dev)
 250 {
 251         struct cmx_softc *sc = device_get_softc(dev);
 252
 253         if (!sc || sc->dying)
 254                 return ENXIO;
 255
 256         sc->cdev = make_dev(&cmx_ops, 0, UID_ROOT, GID_WHEEL, 0600,
 257                             "cmx%d", device_get_unit(dev));
 258         if (!sc->cdev) {
 259                 device_printf(dev, "failed to create character device\n");
 260                 return ENOMEM;
 261         }
 262         sc->cdev->si_drv1 = sc;
 263
 264         return 0;
 265 }
 266
 267 /*
 268  * Bus independant device detachment routine.  Makes sure all
 269  * allocated resources are freed, callouts disabled and waiting
 270  * processes unblocked.
 271  */
 272 int
 273 cmx_detach(device_t dev)
 274 {
 275         struct cmx_softc *sc = device_get_softc(dev);
 276
 277         DEBUG_printf(dev, "called\n");
 278
 279         sc->dying = 1;
 280
 281         CMX_LOCK(sc);
 282         if (sc->polling) {
 283                 DEBUG_printf(sc->dev, "disabling polling\n");
 284                 callout_stop(&sc->ch);
 285                 sc->polling = 0;
 286                 CMX_UNLOCK(sc);
 287                 selwakeup(&sc->sel);
 288         } else {
 289                 CMX_UNLOCK(sc);
 290         }
 291
 292         wakeup(sc);
 293         DEBUG_printf(dev, "releasing resources\n");
 294         cmx_release_resources(dev);
 295         dev_ops_remove_minor(&cmx_ops, device_get_unit(dev));
 296
 297         return 0;
 298 }
 299
 300 /*
 301  * Wait for buffer status register events.  If test is non-zero,
 302  * wait until flags are set, otherwise wait until flags are unset.
 303  * Will spin SPIN_COUNT times, then sleep until timeout is reached.
 304  * Returns zero if event happened, EIO if the timeout was reached,
 305  * and ENXIO if the device was detached in the meantime.  When that
 306  * happens, the caller must quit immediately, since a detach is
 307  * in progress.
 308  */
 309 static inline int
 310 cmx_wait_BSR(struct cmx_softc *sc, uint8_t flags, int test)
 311 {
 312         int rv;
 313
 314         for (int i = 0; i < SPIN_COUNT; i++) {
 315                 if (cmx_test_BSR(sc, flags, test))
 316                         return 0;
 317         }
 318
 319         for (int i = 0; i * WAIT_TICKS < sc->timeout; i++) {
 320                 if (cmx_test_BSR(sc, flags, test))
 321                         return 0;
 322                 rv = tsleep(sc, PCATCH, "cmx", WAIT_TICKS);
 323                 /*
 324                  * Currently, the only reason for waking up with
 325                  * rv == 0 is when we are detaching, in which
 326                  * case sc->dying is always 1.
 327                  */
 328                 if (sc->dying)
 329                         return ENXIO;
 330                 if (rv != EAGAIN)
 331                         return rv;
 332         }
 333
 334         /* timeout */
 335         return EIO;
 336 }
 337
 338 /*
 339  * Set the sync control register to val.  Before and after writing
 340  * to the SCR, we wait for the BSR to not signal BULK_OUT_FULL.
 341  * Returns zero if successful, or whatever errors cmx_wait_BSR can
 342  * return.  ENXIO signals that the device has been detached in the
 343  * meantime, and that we should leave the kernel immediately.
 344  */
 345 static inline int
 346 cmx_sync_write_SCR(struct cmx_softc *sc, uint8_t val)
 347 {
 348         int rv = 0;
 349
 350         if ((rv = cmx_wait_BSR(sc, BSR_BULK_OUT_FULL, 0)) != 0) {
 351                 return rv;
 352         }
 353
 354         cmx_write_SCR(sc, val);
 355
 356         if ((rv = cmx_wait_BSR(sc, BSR_BULK_OUT_FULL, 0)) != 0) {
 357                 return rv;
 358         }
 359
 360         return 0;
 361 }
 362
 363 /*
 364  * Returns a suitable timeout value based on the given command byte.
 365  * Some commands appear to need longer timeout values than others.
 366  */
 367 static inline unsigned long
 368 cmx_timeout_by_cmd(uint8_t cmd)
 369 {
 370         switch (cmd) {
 371         case CMD_PC_TO_RDR_XFRBLOCK:
 372         case CMD_PC_TO_RDR_SECURE:
 373         case CMD_PC_TO_RDR_TEST_SECURE:
 374         case CMD_PC_TO_RDR_OK_SECURE:
 375                 return CCID_DRIVER_BULK_DEFAULT_TIMEOUT;
 376
 377         case CMD_PC_TO_RDR_ICCPOWERON:
 378                 return CCID_DRIVER_ASYNC_POWERUP_TIMEOUT;
 379
 380         case CMD_PC_TO_RDR_GETSLOTSTATUS:
 381         case CMD_PC_TO_RDR_ICCPOWEROFF:
 382         case CMD_PC_TO_RDR_GETPARAMETERS:
 383         case CMD_PC_TO_RDR_RESETPARAMETERS:
 384         case CMD_PC_TO_RDR_SETPARAMETERS:
 385         case CMD_PC_TO_RDR_ESCAPE:
 386         case CMD_PC_TO_RDR_ICCCLOCK:
 387         default:
 388                 return CCID_DRIVER_MINIMUM_TIMEOUT;
 389         }
 390 }
 391
 392 /*
 393  * Periodical callout routine, polling the reader for data
 394  * availability.  If the reader signals data ready for reading,
 395  * wakes up the processes which are waiting in select()/poll().
 396  * Otherwise, reschedules itself with a delay of POLL_TICKS.
 397  */
 398 static void
 399 cmx_tick(void *xsc)
 400 {
 401         struct cmx_softc *sc = xsc;
 402         uint8_t bsr;
 403
 404         CMX_LOCK(sc);
 405         if (sc->polling && !sc->dying) {
 406                 bsr = cmx_read_BSR(sc);
 407                 DEBUG_printf(sc->dev, "BSR=%b\n", bsr, BSRBITS);
 408                 if (cmx_test(bsr, BSR_BULK_IN_FULL, 1)) {
 409                         sc->polling = 0;
 410                         selwakeup(&sc->sel);
 411                 } else {
 412                         callout_reset(&sc->ch, POLL_TICKS, cmx_tick, sc);
 413                 }
 414         }
 415         CMX_UNLOCK(sc);
 416 }
 417
 418 /*
 419  * Open the character device.  Only a single process may open the
 420  * device at a time.
 421  */
 422 static int
 423 cmx_open(struct dev_open_args *ap)
 424 {
 425         cdev_t dev = ap->a_head.a_dev;
 426         struct cmx_softc *sc;
 427
 428         sc = devclass_get_softc(cmx_devclass, minor(dev));
 429         if (sc == NULL || sc->dying)
 430                 return ENXIO;
 431
 432         CMX_LOCK(sc);
 433         if (sc->open) {
 434                 CMX_UNLOCK(sc);
 435                 return EBUSY;
 436         }
 437         sc->open = 1;
 438         CMX_UNLOCK(sc);
 439
 440         DEBUG_printf(sc->dev, "open (flags=%b thread=%p)\n",
 441                         ap->a_oflags, MODEBITS, curthread);
 442         return 0;
 443 }
 444
 445 /*
 446  * Close the character device.
 447  */
 448 static int
 449 cmx_close(struct dev_close_args *ap)
 450 {
 451         cdev_t dev = ap->a_head.a_dev;
 452         struct cmx_softc *sc;
 453
 454         sc = devclass_get_softc(cmx_devclass, minor(dev));
 455         if (sc == NULL || sc->dying)
 456                 return ENXIO;
 457
 458         CMX_LOCK(sc);
 459         if (!sc->open) {
 460                 CMX_UNLOCK(sc);
 461                 return EINVAL;
 462         }
 463         if (sc->polling) {
 464                 DEBUG_printf(sc->dev, "disabling polling\n");
 465                 callout_stop(&sc->ch);
 466                 sc->polling = 0;
 467                 CMX_UNLOCK(sc);
 468                 selwakeup(&sc->sel);
 469                 CMX_LOCK(sc);
 470         }
 471         sc->open = 0;
 472         CMX_UNLOCK(sc);
 473
 474         DEBUG_printf(sc->dev, "close (flags=%b thread=%p)\n",
 475                         ap->a_fflag, MODEBITS, curthread);
 476         return 0;
 477 }
 478
 479 /*
 480  * Read from the character device.
 481  * Returns zero if successful, ENXIO if dying, EINVAL if an attempt
 482  * was made to read less than CMX_MIN_RDLEN bytes or less than the
 483  * device has available, or any of the errors that cmx_sync_write_SCR
 484  * can return.  Partial reads are not supported.
 485  */
 486 static int
 487 cmx_read(struct dev_read_args *ap)
 488 {
 489         cdev_t dev = ap->a_head.a_dev;
 490         struct cmx_softc *sc;
 491         struct uio *uio = ap->a_uio;
 492         unsigned long bytes_left;
 493         uint8_t uc;
 494         int rv, amnt, offset;
 495
 496         sc = devclass_get_softc(cmx_devclass, minor(dev));
 497         if (sc == NULL || sc->dying)
 498                 return ENXIO;
 499
 500         DEBUG_printf(sc->dev, "called (len=%d flag=%b)\n",
 501                 uio->uio_resid, ap->a_ioflag, MODEBITS);
 502
 503         CMX_LOCK(sc);
 504         if (sc->polling) {
 505                 DEBUG_printf(sc->dev, "disabling polling\n");
 506                 callout_stop(&sc->ch);
 507                 sc->polling = 0;
 508                 CMX_UNLOCK(sc);
 509                 selwakeup(&sc->sel);
 510         } else {
 511                 CMX_UNLOCK(sc);
 512         }
 513
 514         if (uio->uio_resid == 0) {
 515                 return 0;
 516         }
 517
 518         if (uio->uio_resid < CMX_MIN_RDLEN) {
 519                 return EINVAL;
 520         }
 521
 522         if (ap->a_ioflag & O_NONBLOCK) {
 523                 if (cmx_test_BSR(sc, BSR_BULK_IN_FULL, 0)) {
 524                         return EAGAIN;
 525                 }
 526         }
 527
 528         for (int i = 0; i < 5; i++) {
 529                 if ((rv = cmx_wait_BSR(sc, BSR_BULK_IN_FULL, 1)) != 0) {
 530                         return rv;
 531                 }
 532                 sc->buf[i] = cmx_read_DTR(sc);
 533                 DEBUG_printf(sc->dev, "buf[%02x]=%02x\n", i, sc->buf[i]);
 534         }
 535
 536         bytes_left = CMX_MIN_RDLEN +
 537                         (0x000000FF&((char)sc->buf[1])) +
 538                         (0x0000FF00&((char)sc->buf[2] << 8)) +
 539                         (0x00FF0000&((char)sc->buf[3] << 16)) +
 540                         (0xFF000000&((char)sc->buf[4] << 24));
 541         DEBUG_printf(sc->dev, "msgsz=%lu\n", bytes_left);
 542
 543         if (uio->uio_resid < bytes_left) {
 544                 return EINVAL;
 545         }
 546
 547         offset = 5; /* prefetched header */
 548         while (bytes_left > 0) {
 549                 amnt = MIN(bytes_left, sizeof(sc->buf));
 550
 551                 for (int i = offset; i < amnt; i++) {
 552                         if ((rv = cmx_wait_BSR(sc, BSR_BULK_IN_FULL, 1))!=0) {
 553                                 return rv;
 554                         }
 555                         sc->buf[i] = cmx_read_DTR(sc);
 556                         DEBUG_printf(sc->dev, "buf[%02x]=%02x\n",
 557                                         i, sc->buf[i]);
 558                 }
 559
 560                 if ((rv = uiomove(sc->buf, amnt, uio)) != 0) {
 561                         DEBUG_printf(sc->dev, "uiomove failed (%d)\n", rv);
 562                         return rv;
 563                 }
 564
 565                 if (offset)
 566                         offset = 0;
 567                 bytes_left -= amnt;
 568         }
 569
 570         if ((rv = cmx_wait_BSR(sc, BSR_BULK_IN_FULL, 1)) != 0) {
 571                 return rv;
 572         }
 573
 574         if ((rv = cmx_sync_write_SCR(sc, SCR_READER_TO_HOST_DONE)) != 0) {
 575                 return rv;
 576         }
 577
 578         uc = cmx_read_DTR(sc);
 579         DEBUG_printf(sc->dev, "success (DTR=%02x)\n", uc);
 580         return 0;
 581 }
 582
 583 /*
 584  * Write to the character device.
 585  * Returns zero if successful, NXIO if dying, EINVAL if less data
 586  * written than CMX_MIN_WRLEN, or any of the errors that cmx_sync_SCR
 587  * can return.
 588  */
 589 static int
 590 cmx_write(struct dev_write_args *ap)
 591 {
 592         cdev_t dev = ap->a_head.a_dev;
 593         struct cmx_softc *sc;
 594         struct uio *uio = ap->a_uio;
 595         int rv, amnt;
 596
 597         sc = devclass_get_softc(cmx_devclass, minor(dev));
 598         if (sc == NULL || sc->dying)
 599                 return ENXIO;
 600
 601         DEBUG_printf(sc->dev, "called (len=%d flag=%b)\n",
 602                         uio->uio_resid, ap->a_ioflag, MODEBITS);
 603
 604         if (uio->uio_resid == 0) {
 605                 return 0;
 606         }
 607
 608         if (uio->uio_resid < CMX_MIN_WRLEN) {
 609                 return EINVAL;
 610         }
 611
 612         if ((rv = cmx_sync_write_SCR(sc, SCR_HOST_TO_READER_START)) != 0) {
 613                 return rv;
 614         }
 615
 616         sc->timeout = 0;
 617         while (uio->uio_resid > 0) {
 618                 amnt = MIN(uio->uio_resid, sizeof(sc->buf));
 619
 620                 if ((rv = uiomove(sc->buf, amnt, uio)) != 0) {
 621                         DEBUG_printf(sc->dev, "uiomove failed (%d)\n", rv);
 622                         /* wildly guessed attempt to notify device */
 623                         sc->timeout = CCID_DRIVER_MINIMUM_TIMEOUT;
 624                         cmx_sync_write_SCR(sc, SCR_HOST_TO_READER_DONE);
 625                         return rv;
 626                 }
 627
 628                 if (sc->timeout == 0) {
 629                         sc->timeout = cmx_timeout_by_cmd(sc->buf[0]);
 630                         DEBUG_printf(sc->dev, "cmd=%02x timeout=%lu\n",
 631                                         sc->buf[0], sc->timeout);
 632                 }
 633
 634                 for (int i = 0; i < amnt; i++) {
 635                         if ((rv = cmx_wait_BSR(sc, BSR_BULK_OUT_FULL, 0))!=0) {
 636                                 return rv;
 637                         }
 638                         cmx_write_DTR(sc, sc->buf[i]);
 639                         DEBUG_printf(sc->dev, "buf[%02x]=%02x\n",
 640                                         i, sc->buf[i]);
 641                 }
 642         }
 643
 644         if ((rv = cmx_sync_write_SCR(sc, SCR_HOST_TO_READER_DONE)) != 0) {
 645                 return rv;
 646         }
 647
 648         DEBUG_printf(sc->dev, "success\n");
 649         return 0;
 650 }
 651
 652 /*
 653  * Poll handler.  Writing is always possible, reading is only possible
 654  * if BSR_BULK_IN_FULL is set.  Will start the cmx_tick callout and
 655  * set sc->polling.
 656  */
 657 static int
 658 cmx_poll(struct dev_poll_args *ap)
 659 {
 660         cdev_t dev = ap->a_head.a_dev;
 661         struct cmx_softc *sc;
 662         int revents = 0;
 663         uint8_t bsr = 0;
 664
 665         sc = devclass_get_softc(cmx_devclass, minor(dev));
 666         if (sc == NULL || sc->dying)
 667                 return ENXIO;
 668
 669         bsr = cmx_read_BSR(sc);
 670         DEBUG_printf(sc->dev, "called (events=%b BSR=%b)\n",
 671                         ap->a_events, POLLBITS, bsr, BSRBITS);
 672
 673         revents = ap->a_events & (POLLOUT | POLLWRNORM);
 674         if (ap->a_events & (POLLIN | POLLRDNORM)) {
 675                 if (cmx_test(bsr, BSR_BULK_IN_FULL, 1)) {
 676                         revents |= ap->a_events & (POLLIN | POLLRDNORM);
 677                 } else {
 678                         selrecord(curthread, &sc->sel);
 679                         CMX_LOCK(sc);
 680                         if (!sc->polling) {
 681                                 DEBUG_printf(sc->dev, "enabling polling\n");
 682                                 sc->polling = 1;
 683                                 callout_reset(&sc->ch, POLL_TICKS,
 684                                                 cmx_tick, sc);
 685                         } else {
 686                                 DEBUG_printf(sc->dev, "already polling\n");
 687                         }
 688                         CMX_UNLOCK(sc);
 689                 }
 690         }
 691
 692         DEBUG_printf(sc->dev, "success (revents=%b)\n", revents, POLLBITS);
 693
 694         return revents;
 695 }
 696
 697 static struct filterops cmx_read_filterops =
 698         { 1, NULL, cmx_filter_detach, cmx_filter_read };
 699 static struct filterops cmx_write_filterops =
 700         { 1, NULL, cmx_filter_detach, cmx_filter_write };
 701
 702 /*
 703  * Kevent handler.  Writing is always possible, reading is only possible
 704  * if BSR_BULK_IN_FULL is set.  Will start the cmx_tick callout and
 705  * set sc->polling.
 706  */
 707 static int
 708 cmx_kqfilter(struct dev_kqfilter_args *ap)
 709 {
 710         cdev_t dev = ap->a_head.a_dev;
 711         struct knote *kn = ap->a_kn;
 712         struct cmx_softc *sc;
 713         struct klist *klist;
 714
 715         ap->a_result = 0;
 716
 717         sc = devclass_get_softc(cmx_devclass, minor(dev));
 718
 719         switch (kn->kn_filter) {
 720         case EVFILT_READ:
 721                 kn->kn_fop = &cmx_read_filterops;
 722                 kn->kn_hook = (caddr_t)sc;
 723                 break;
 724         case EVFILT_WRITE:
 725                 kn->kn_fop = &cmx_write_filterops;
 726                 kn->kn_hook = (caddr_t)sc;
 727                 break;
 728         default:
 729                 ap->a_result = EOPNOTSUPP;
 730                 return (0);
 731         }
 732
 733         crit_enter();
 734         klist = &sc->sel.si_note;
 735         SLIST_INSERT_HEAD(klist, kn, kn_selnext);
 736         crit_exit();
 737
 738         return (0);
 739 }
 740
 741 static void
 742 cmx_filter_detach(struct knote *kn)
 743 {
 744         struct cmx_softc *sc = (struct cmx_softc *)kn->kn_hook;
 745         struct klist *klist;
 746
 747         crit_enter();
 748         klist = &sc->sel.si_note;
 749         SLIST_REMOVE(klist, kn, knote, kn_selnext);
 750         crit_exit();
 751 }
 752
 753 static int
 754 cmx_filter_read(struct knote *kn, long hint)
 755 {
 756         struct cmx_softc *sc = (struct cmx_softc *)kn->kn_hook;
 757         int ready = 0;
 758         uint8_t bsr = 0;
 759
 760         if (sc == NULL || sc->dying) {
 761                 kn->kn_flags |= EV_EOF;
 762                 return (1);
 763         }
 764
 765         bsr = cmx_read_BSR(sc);
 766         if (cmx_test(bsr, BSR_BULK_IN_FULL, 1)) {
 767                 ready = 1;
 768         } else {
 769                 CMX_LOCK(sc);
 770                 if (!sc->polling) {
 771                         sc->polling = 1;
 772                         callout_reset(&sc->ch, POLL_TICKS,
 773                                       cmx_tick, sc);
 774                 }
 775                 CMX_UNLOCK(sc);
 776         }
 777
 778         return (ready);
 779 }
 780
 781 static int
 782 cmx_filter_write(struct knote *kn, long hint)
 783 {
 784         return (1);
 785 }
 786
 787 #ifdef CMX_INTR
 788 /*
 789  * Interrupt handler.  Currently has no function except to
 790  * print register status (if debugging is also enabled).
 791  */
 792 static void
 793 cmx_intr(void *arg)
 794 {
 795         struct cmx_softc *sc = (struct cmx_softc *)arg;
 796
 797         if (sc == NULL || sc->dying)
 798                 return;
 799
 800         DEBUG_printf(sc->dev, "received interrupt (SCR=%b BSR=%b)\n",
 801                         cmx_read_SCR(sc), SCRBITS,
 802                         cmx_read_BSR(sc), BSRBITS);
 803
 804         return;
 805 }
 806 #endif
 807