xref: /titanic_50/usr/src/uts/common/io/conskbd.c (revision 99d47a0478e1bda86b6a320497f83f08035987aa)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /*
30  * Console kbd multiplexor driver for Sun.
31  * The console "zs" port is linked under us, with the "kbd" module pushed
32  * on top of it.
33  * Minor device 0 is what programs normally use.
34  * Minor device 1 is used to feed predigested keystrokes to the "workstation
35  * console" driver, which it is linked beneath.
36  *
37  *
38  *     This module can support multiple keyboards to be used simultaneously.
39  * and enable users to use at a time multiple keyboards connected to the
40  * same system. All the keyboards are linked under conskbd, and act as a
41  * keyboard with replicated keys.
42  *
43  *     The DIN keyboards of SUN, for exmple , type 3/4/5,  are supported via
44  * a two-level architecure. The lower one is one of serialport drivers, such
45  * as zs, se, and the upper is  "kb" STREAMS module. Currenly, the serialport
46  * drivers don't support polled I/O interfaces, we couldn't group the keyboard
47  * of this kind under conskbd. So we do as the follows:
48  *
49  *         A new ioctl CONSSETKBDTYPE interface between conskbd and lower
50  *     keyboard drivers is added. When conskbd receives I_LINK or I_PLINK
51  *     ioctl, it will send a CONSSETKBDTYPE ioctl to the driver which is
52  *     requesting to be linked under conskbd. If the lower driver does't
53  *     recognize this ioctl, the virtual keyboard will be disabled so that
54  *     only one keyboard instance could be linked under conskbd.
55  */
56 #define	KEYMAP_SIZE_VARIABLE
57 
58 #include <sys/types.h>
59 #include <sys/param.h>
60 #include <sys/stropts.h>
61 #include <sys/stream.h>
62 #include <sys/strsubr.h>
63 #include <sys/strsun.h>
64 #include <sys/conf.h>
65 #include <sys/stat.h>
66 #include <sys/errno.h>
67 #include <sys/modctl.h>
68 #include <sys/kbio.h>
69 #include <sys/ddi.h>
70 #include <sys/sunddi.h>
71 #include <sys/consdev.h>
72 #include <sys/note.h>
73 #include <sys/kmem.h>
74 #include <sys/kstat.h>
75 #include <sys/policy.h>
76 #include <sys/kbd.h>
77 #include <sys/kbtrans.h>
78 #include <sys/promif.h>
79 #include <sys/vuid_event.h>
80 #include <sys/conskbd.h>
81 
82 extern struct keyboard *kbtrans_usbkb_maptab_init(void);
83 extern void kbtrans_usbkb_maptab_fini(struct keyboard **);
84 extern int ddi_create_internal_pathname(dev_info_t *, char *, int, minor_t);
85 
86 /*
87  * Module linkage routines for the kernel
88  */
89 static int conskbd_attach(dev_info_t *, ddi_attach_cmd_t);
90 static int conskbd_detach(dev_info_t *, ddi_detach_cmd_t);
91 static int conskbd_info(dev_info_t *, ddi_info_cmd_t, void *, void **);
92 
93 /*
94  * STREAMS queue processing procedures
95  */
96 static void	conskbduwsrv(queue_t *);
97 static void	conskbdlwserv(queue_t *);
98 static void	conskbdlrput(queue_t *, mblk_t *);
99 static void	conskbdioctl(queue_t *, mblk_t *);
100 static int	conskbdclose(queue_t *, int, cred_t *);
101 static int	conskbdopen(queue_t *, dev_t *, int, int, cred_t *);
102 
103 
104 /* STREAMS driver id and limit value struct */
105 static struct module_info conskbdm_info = {
106 	0,		/* mi_idnum */
107 	"conskbd",	/* mi_idname */
108 	0,		/* mi_minpsz */
109 	1024,		/* mi_maxpsz */
110 	2048,		/* mi_hiwat */
111 	128		/* mi_lowat */
112 };
113 
114 /*
115  * STREAMS queue processing procedure structures
116  */
117 /* upper read queue processing procedure structures */
118 static struct qinit conskbdurinit = {
119 	NULL,			/* qi_putp */
120 	(int (*)())NULL,	/* qi_srvp */
121 	conskbdopen,		/* qi_qopen */
122 	conskbdclose,		/* qi_qclose */
123 	(int (*)())NULL,	/* qi_qadmin */
124 	&conskbdm_info,		/* qi_minfo */
125 	NULL			/* qi_mstat */
126 };
127 
128 /* upper write queue processing procedures structuresi */
129 static struct qinit conskbduwinit = {
130 	(int (*)())putq,		/* qi_putp */
131 	(int (*)())conskbduwsrv,	/* qi_srvp */
132 	conskbdopen,			/* qi_qopen */
133 	conskbdclose,			/* qi_qclose */
134 	(int (*)())NULL,		/* qi_qadmin */
135 	&conskbdm_info,			/* qi_minfo */
136 	NULL				/* qi_mstat */
137 };
138 
139 /* lower read queue processing procedures structures */
140 static struct qinit conskbdlrinit = {
141 	(int (*)())conskbdlrput,	/* qi_putp */
142 	(int (*)())NULL,		/* qi_srvp */
143 	(int (*)())NULL,		/* qi_qopen */
144 	(int (*)())NULL,		/* qi_qclose */
145 	(int (*)())NULL,		/* qi_qadmin */
146 	&conskbdm_info,			/* qi_minfo */
147 	NULL				/* qi_mstat */
148 };
149 
150 /* lower write processing procedures structures */
151 static struct qinit conskbdlwinit = {
152 	putq,				/* qi_putp */
153 	(int (*)())conskbdlwserv,	/* qi_srvp */
154 	(int (*)())NULL,		/* qi_qopen */
155 	(int (*)())NULL,		/* qi_qclose */
156 	(int (*)())NULL,		/* qi_qadmin */
157 	&conskbdm_info,			/* qi_minfo */
158 	NULL				/* qi_mstat */
159 };
160 
161 /* STREAMS entity declaration structure */
162 static struct streamtab conskbd_str_info = {
163 	&conskbdurinit,		/* st_rdinit */
164 	&conskbduwinit,		/* st_wrinit */
165 	&conskbdlrinit,		/* st_muxrinit */
166 	&conskbdlwinit,		/* st_muxwinit */
167 };
168 
169 
170 /* Entry points structure */
171 static 	struct cb_ops cb_conskbd_ops = {
172 	nulldev,		/* cb_open */
173 	nulldev,		/* cb_close */
174 	nodev,			/* cb_strategy */
175 	nodev,			/* cb_print */
176 	nodev,			/* cb_dump */
177 	nodev,			/* cb_read */
178 	nodev,			/* cb_write */
179 	nodev,			/* cb_ioctl */
180 	nodev,			/* cb_devmap */
181 	nodev,			/* cb_mmap */
182 	nodev,			/* cb_segmap */
183 	nochpoll,		/* cb_chpoll */
184 	ddi_prop_op,		/* cb_prop_op */
185 	&conskbd_str_info,	/* cb_stream */
186 	D_MP | D_MTOUTPERIM	/* cb_flag */
187 };
188 
189 
190 /*
191  * Device operations structure
192  */
193 static struct dev_ops conskbd_ops = {
194 	DEVO_REV,		/* devo_rev */
195 	0,			/* devo_refcnt */
196 	conskbd_info,		/* devo_getinfo */
197 	nulldev,		/* devo_identify */
198 	nulldev,		/* devo_probe */
199 	conskbd_attach,		/* devo_attach */
200 	conskbd_detach,		/* devo_detach */
201 	nodev,			/* devo_reset */
202 	&(cb_conskbd_ops),	/* devo_cb_ops */
203 	(struct bus_ops *)NULL,	/* devo_bus_ops */
204 	NULL			/* devo_power */
205 };
206 
207 /*
208  * Module linkage information for the kernel.
209  */
210 static struct modldrv modldrv = {
211 	&mod_driverops, /* Type of module.  This one is a pseudo driver */
212 	"Console kbd Multiplexer driver 'conskbd' %I%",
213 	&conskbd_ops,	/* driver ops */
214 };
215 
216 /*
217  * Module linkage structure
218  */
219 static struct modlinkage modlinkage = {
220 	MODREV_1,	/* ml_rev */
221 	&modldrv,	/* ml_linkage */
222 	NULL		/* NULL terminates the list */
223 };
224 
225 /*
226  * Debug printing
227  */
228 #ifndef DPRINTF
229 #ifdef DEBUG
230 void	conskbd_dprintf(const char *fmt, ...);
231 #define	DPRINTF(l, m, args) \
232 	(((l) >= conskbd_errlevel) && ((m) & conskbd_errmask) ?	\
233 		conskbd_dprintf args :				\
234 		(void) 0)
235 
236 /*
237  * Severity levels for printing
238  */
239 #define	PRINT_L0	0	/* print every message */
240 #define	PRINT_L1	1	/* debug */
241 #define	PRINT_L2	2	/* quiet */
242 
243 /*
244  * Masks
245  */
246 #define	PRINT_MASK_ALL		0xFFFFFFFFU
247 uint_t	conskbd_errmask = PRINT_MASK_ALL;
248 uint_t	conskbd_errlevel = PRINT_L2;
249 
250 #else
251 #define	DPRINTF(l, m, args)	/* NOTHING */
252 #endif
253 #endif
254 
255 /*
256  * Module global data are protected by the per-module inner perimeter
257  */
258 static	queue_t	*conskbd_regqueue; /* regular keyboard queue above us */
259 static	queue_t	*conskbd_consqueue; /* console queue above us */
260 
261 
262 static dev_info_t *conskbd_dip;		/* private copy of devinfo pointer */
263 static long	conskbd_idle_stamp;	/* seconds tstamp of latest keystroke */
264 static struct keyboard *conskbd_keyindex;
265 
266 /*
267  * Normally, kstats of type KSTAT_TYPE_NAMED have multiple elements.  In
268  * this case we use this type for a single element because the ioctl code
269  * for it knows how to handle mixed kernel/user data models.  Also, it
270  * will be easier to add new statistics later.
271  */
272 static struct {
273 	kstat_named_t idle_sec;		/* seconds since last keystroke */
274 } conskbd_kstat = {
275 	{ "idle_sec", KSTAT_DATA_LONG, }
276 };
277 
278 /*
279  * Local routines prototypes
280  */
281 static int conskbd_kstat_update(kstat_t *, int);
282 
283 static void conskbd_ioc_plink(queue_t *, mblk_t *);
284 static void conskbd_legacy_kbd_ioctl(queue_t *, mblk_t *);
285 static void conskbd_virtual_kbd_ioctl(queue_t *, mblk_t *);
286 
287 static conskbd_pending_msg_t *conskbd_mux_find_msg(mblk_t *);
288 static void conskbd_mux_enqueue_msg(conskbd_pending_msg_t *);
289 static void conskbd_mux_dequeue_msg(conskbd_pending_msg_t *);
290 static void conskbd_link_lower_queue(conskbd_lower_queue_t *);
291 
292 static void conskbd_handle_downstream_msg(queue_t *, mblk_t *);
293 static void conskbd_kioctype_complete(conskbd_lower_queue_t *, mblk_t *);
294 static void conskbd_kioctrans_complete(conskbd_lower_queue_t *, mblk_t *);
295 static void conskbd_kioclayout_complete(conskbd_lower_queue_t *, mblk_t *);
296 static void conskbd_kiocsled_complete(conskbd_lower_queue_t *, mblk_t *);
297 static void conskbd_mux_upstream_msg(conskbd_lower_queue_t *, mblk_t *);
298 static void conskbd_legacy_upstream_msg(conskbd_lower_queue_t *, mblk_t *);
299 static void conskbd_lqs_ack_complete(conskbd_lower_queue_t *, mblk_t *);
300 
301 static void conskbd_polledio_enter(struct cons_polledio_arg *);
302 static void conskbd_polledio_exit(struct cons_polledio_arg *);
303 static int  conskbd_polledio_ischar(struct cons_polledio_arg *);
304 static int  conskbd_polledio_getchar(struct cons_polledio_arg *);
305 static void conskbd_polledio_setled(struct kbtrans_hardware *, int);
306 
307 static void conskbd_streams_setled(struct kbtrans_hardware *, int);
308 static boolean_t conskbd_override_kbtrans(queue_t *, mblk_t *);
309 static boolean_t
310 conskbd_polled_keycheck(struct kbtrans_hardware *,
311 		kbtrans_key_t *, enum keystate *);
312 
313 /*
314  * Callbacks needed by kbtrans
315  */
316 static struct kbtrans_callbacks conskbd_callbacks = {
317 	conskbd_streams_setled,
318 	conskbd_polledio_setled,
319 	conskbd_polled_keycheck,
320 };
321 
322 /*
323  * Single private "global" lock for the few rare conditions
324  * we want single-threaded.
325  */
326 static	kmutex_t	conskbd_lq_lock;
327 static	kmutex_t	conskbd_msgq_lock;
328 static	conskbd_pending_msg_t	*conskbd_msg_queue;
329 
330 /*
331  * The software state structure of virtual keyboard.
332  * Currently, only one virtual keyboard is support.
333  */
334 static conskbd_state_t	conskbd = { 0 };
335 
336 /*
337  * _init()
338  *
339  * Description:
340  *      Driver initialization, called when driver is first loaded.
341  *      This is how access is initially given to all the static structures.
342  *
343  * Arguments:
344  *      None
345  *
346  * Returns:
347  *      ddi_soft_state_init() status, see ddi_soft_state_init(9f), or
348  *      mod_install() status, see mod_install(9f)
349  */
350 int
351 _init(void)
352 {
353 	int	error;
354 
355 	error = mod_install(&modlinkage);
356 	if (error != 0) {
357 		return (error);
358 	}
359 
360 	conskbd_keyindex = kbtrans_usbkb_maptab_init();
361 
362 	mutex_init(&conskbd_lq_lock, NULL, MUTEX_DRIVER, NULL);
363 	mutex_init(&conskbd_msgq_lock, NULL, MUTEX_DRIVER, NULL);
364 
365 	return (error);
366 
367 }	/* _init() */
368 
369 /*
370  * _fini()
371  *
372  * Description:
373  *      Module de-initialization, called when the driver is to be unloaded.
374  *
375  * Arguments:
376  *      None
377  *
378  * Returns:
379  *      mod_remove() status, see mod_remove(9f)
380  */
381 int
382 _fini(void)
383 {
384 	int	error;
385 
386 	error = mod_remove(&modlinkage);
387 	if (error != 0)
388 		return (error);
389 	mutex_destroy(&conskbd_lq_lock);
390 	mutex_destroy(&conskbd_msgq_lock);
391 	kbtrans_usbkb_maptab_fini(&conskbd_keyindex);
392 
393 	return (0);
394 
395 }	/* _fini() */
396 
397 /*
398  * _info()
399  *
400  * Description:
401  *      Module information, returns information about the driver.
402  *
403  * Arguments:
404  *      modinfo         *modinfop       Pointer to the opaque modinfo structure
405  *
406  * Returns:
407  *      mod_info() status, see mod_info(9f)
408  */
409 int
410 _info(struct modinfo *modinfop)
411 {
412 	return (mod_info(&modlinkage, modinfop));
413 
414 }	/* _info() */
415 
416 
417 /*
418  * conskbd_attach()
419  *
420  * Description:
421  * 	This routine creates two device nodes. One is the "kbd" node, which
422  * is used by user application programs(such as Xserver).The other is the
423  * "conskbd" node, which is an internal node. consconfig_dacf module will
424  * open this internal node, and link the conskbd under the wc (workstaion
425  * console).
426  *
427  * Arguments:
428  *      dev_info_t      *dip    Pointer to the device's dev_info struct
429  *      ddi_attach_cmd_t cmd    Attach command
430  *
431  * Returns:
432  *      DDI_SUCCESS             The driver was initialized properly
433  *      DDI_FAILURE             The driver couldn't be initialized properly
434  */
435 /*ARGSUSED*/
436 static int
437 conskbd_attach(dev_info_t *devi, ddi_attach_cmd_t cmd)
438 {
439 	kstat_t	*ksp;
440 
441 	switch (cmd) {
442 	case DDI_ATTACH:
443 		break;
444 
445 	default:
446 		return (DDI_FAILURE);
447 
448 	}
449 	if ((ddi_create_minor_node(devi, "kbd", S_IFCHR,
450 	    0, DDI_PSEUDO, NULL) == DDI_FAILURE) ||
451 	    (ddi_create_internal_pathname(devi, "conskbd", S_IFCHR,
452 	    1) == DDI_FAILURE)) {
453 		ddi_remove_minor_node(devi, NULL);
454 		return (DDI_FAILURE);
455 	}
456 	conskbd_dip = devi;
457 
458 	ksp = kstat_create("conskbd", 0, "activity", "misc", KSTAT_TYPE_NAMED,
459 	    sizeof (conskbd_kstat) / sizeof (kstat_named_t),
460 	    KSTAT_FLAG_VIRTUAL);
461 	if (ksp) {
462 		ksp->ks_data = (void *) &conskbd_kstat;
463 		ksp->ks_update = conskbd_kstat_update;
464 		kstat_install(ksp);
465 		conskbd_idle_stamp = gethrestime_sec();	/* initial value */
466 	}
467 
468 	conskbd.conskbd_layout = -1;	/* invalid layout */
469 	conskbd.conskbd_led_state = -1;
470 	conskbd.conskbd_bypassed = B_FALSE;
471 
472 	return (DDI_SUCCESS);
473 
474 }	/* conskbd_attach() */
475 
476 /*
477  * conskbd_detach()
478  *
479  * Description:
480  *      Detach an instance of the conskbd driver. In fact, the driver can not
481  * be detached.
482  *
483  * Arguments:
484  *      dev_info_t              *dip    Pointer to the device's dev_info struct
485  *      ddi_detach_cmd_t        cmd     Detach command
486  *
487  * Returns:
488  *      DDI_SUCCESS     The driver was detached
489  *      DDI_FAILURE     The driver couldn't be detached
490  */
491 /*ARGSUSED*/
492 static int
493 conskbd_detach(dev_info_t *devi, ddi_detach_cmd_t cmd)
494 {
495 	return (DDI_FAILURE);
496 
497 }	/* conskbd_detach() */
498 
499 /* ARGSUSED */
500 static int
501 conskbd_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg,
502 	void **result)
503 {
504 	register int error;
505 
506 	switch (infocmd) {
507 	case DDI_INFO_DEVT2DEVINFO:
508 		if (conskbd_dip == NULL) {
509 			error = DDI_FAILURE;
510 		} else {
511 			*result = (void *) conskbd_dip;
512 			error = DDI_SUCCESS;
513 		}
514 		break;
515 	case DDI_INFO_DEVT2INSTANCE:
516 		*result = (void *)0;
517 		error = DDI_SUCCESS;
518 		break;
519 	default:
520 		error = DDI_FAILURE;
521 	}
522 	return (error);
523 
524 }	/* conskbd_info() */
525 
526 /*ARGSUSED*/
527 static int
528 conskbdopen(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *crp)
529 {
530 	dev_t	unit;
531 	int	err;
532 
533 	unit = getminor(*devp);
534 
535 	if (unit == 0) {
536 		/*
537 		 * Opening "/dev/kbd".
538 		 */
539 		conskbd_regqueue = q;
540 		qprocson(q);
541 		return (0);
542 	} else if (unit != 1) {
543 		/* we don't do that under Bozo's Big Tent */
544 		return (ENODEV);
545 	}
546 
547 	/*
548 	 * Opening the device to be linked under the console.
549 	 */
550 	conskbd_consqueue = q;
551 
552 	/*
553 	 * initialize kbtrans module for conskbd
554 	 */
555 	err = kbtrans_streams_init(q, sflag, crp, (struct kbtrans_hardware *)
556 	    &conskbd, &conskbd_callbacks, &conskbd.conskbd_kbtrans, 0, 0);
557 	if (err != 0)
558 		return (err);
559 	kbtrans_streams_set_keyboard(conskbd.conskbd_kbtrans, KB_USB,
560 	    conskbd_keyindex);
561 
562 	conskbd.conskbd_polledio.cons_polledio_version = CONSPOLLEDIO_V1;
563 	conskbd.conskbd_polledio.cons_polledio_argument =
564 	    (struct cons_polledio_arg *)&conskbd;
565 	conskbd.conskbd_polledio.cons_polledio_putchar = NULL;
566 	conskbd.conskbd_polledio.cons_polledio_getchar =
567 	    (int (*)(struct cons_polledio_arg *)) conskbd_polledio_getchar;
568 	conskbd.conskbd_polledio.cons_polledio_ischar =
569 	    (boolean_t (*)(struct cons_polledio_arg *))conskbd_polledio_ischar;
570 	conskbd.conskbd_polledio.cons_polledio_enter = conskbd_polledio_enter;
571 	conskbd.conskbd_polledio.cons_polledio_exit = conskbd_polledio_exit;
572 	qprocson(q);
573 
574 	return (0);
575 
576 }	/* conskbd_open() */
577 
578 
579 /*ARGSUSED*/
580 static int
581 conskbdclose(queue_t *q, int flag, cred_t *crp)
582 {
583 	if (q == conskbd_regqueue) {
584 
585 		/* switch the input stream back to conskbd_consqueue */
586 		conskbd.conskbd_directio = B_FALSE;
587 
588 		kbtrans_streams_untimeout(conskbd.conskbd_kbtrans);
589 		kbtrans_streams_set_queue(conskbd.conskbd_kbtrans,
590 		    conskbd_consqueue);
591 		qprocsoff(q);
592 		conskbd_regqueue = NULL;
593 	} else if (q == conskbd_consqueue) {
594 		/*
595 		 * Well, this is probably a mistake, but we will permit you
596 		 * to close the path to the console if you really insist.
597 		 */
598 		qprocsoff(q);
599 		conskbd_consqueue = NULL;
600 	}
601 
602 	return (0);
603 
604 }	/* conskbd_close() */
605 
606 /*
607  * Service procedure for upper write queue.
608  *	To make sure the order of messages, we don't process any
609  * message in qi_putq() routine of upper write queue, instead the
610  * qi_putq() routine, which is a standard putq() routine, puts all
611  * messages into a queue, and lets the following service procedure
612  * deal with all messages.
613  * 	This routine is invoked when ioctl commands are send down
614  * by a consumer of the keyboard device, eg, when the keyboard
615  * consumer tries to determine the keyboard layout type, or sets
616  * the led states.
617  */
618 static void
619 conskbduwsrv(queue_t *q)
620 {
621 	mblk_t	*mp;
622 	queue_t	*oldq;
623 	enum kbtrans_message_response ret;
624 
625 	while ((mp = getq(q)) != NULL) {
626 
627 		/*
628 		 * if the virtual keyboard is supported
629 		 */
630 		if (conskbd.conskbd_bypassed == B_FALSE) {
631 
632 			if (conskbd_override_kbtrans(q, mp) == B_TRUE)
633 				continue;
634 			/*
635 			 * The conskbd driver is a psaudo driver. It has two
636 			 * devcice nodes, one is used by kernel, and the other
637 			 * is used by end-users. There are two STREAMS queues
638 			 * corresponding to the two device nodes, console queue
639 			 * and regular queue.
640 			 * In conskbd_override_kbtrans() routine, when receives
641 			 * KIOCSDIRECT ioctl, we need change the direction of
642 			 * keyboard input messages, and direct the input stream
643 			 * from keyboard into right queue. It causes this queue
644 			 * to be switched between regular queue and console
645 			 * queue. And here, in this routine, the in-parameter
646 			 * "q" can be any one of the two. Moreover, this module
647 			 * is executed in multithreaded environment, even if the
648 			 * q is switched to regular queue, it is possible that
649 			 * the in-parameter is still the console queue, and we
650 			 * need to return response to right queue.
651 			 * The response is sent to upstream by the kbtrans
652 			 * module. so we need to save the old queue, and wait
653 			 * kbtrans to proces message and to send response out,
654 			 * and then switch back to old queue.
655 			 */
656 			oldq = kbtrans_streams_get_queue(
657 			    conskbd.conskbd_kbtrans);
658 			kbtrans_streams_set_queue(
659 			    conskbd.conskbd_kbtrans, RD(q));
660 			ret = kbtrans_streams_message(
661 			    conskbd.conskbd_kbtrans, mp);
662 			kbtrans_streams_set_queue(
663 			    conskbd.conskbd_kbtrans, oldq);
664 
665 			switch (ret) {
666 				case KBTRANS_MESSAGE_HANDLED:
667 					continue;
668 				case KBTRANS_MESSAGE_NOT_HANDLED:
669 					break;
670 			}
671 		}
672 
673 		switch (mp->b_datap->db_type) {
674 
675 		case M_IOCTL:
676 			conskbdioctl(q, mp);
677 			break;
678 
679 		case M_FLUSH:
680 			if (*mp->b_rptr & FLUSHW) {
681 				flushq(q, FLUSHDATA);
682 			}
683 			/*
684 			 * here, if flush read queue, some key-up messages
685 			 * may be lost so that upper module or applications
686 			 * treat corresponding keys as being held down for
687 			 * ever.
688 			 */
689 			freemsg(mp);
690 			break;
691 
692 		case M_DATA:
693 			/*
694 			 * virtual keyboard doesn't support this interface.
695 			 * only when it is disabled, we pass the message
696 			 * down to lower queue.
697 			 */
698 			if ((conskbd.conskbd_bypassed) &&
699 			    (conskbd.conskbd_lqueue_nums > 0)) {
700 				if (putq(conskbd.conskbd_lqueue_list->
701 				    lqs_queue, mp) != 1)
702 					freemsg(mp);
703 			} else {
704 				freemsg(mp);
705 			}
706 			break;
707 
708 		default:
709 			/*
710 			 * Pass an error message up.
711 			 */
712 			mp->b_datap->db_type = M_ERROR;
713 			if (mp->b_cont) {
714 				freemsg(mp->b_cont);
715 				mp->b_cont = NULL;
716 			}
717 			mp->b_rptr = mp->b_datap->db_base;
718 			mp->b_wptr = mp->b_rptr + sizeof (char);
719 			*mp->b_rptr = EINVAL;
720 			qreply(q, mp);
721 		}
722 	}	/* end of while */
723 
724 }	/* conskbduwsrv() */
725 
726 static void
727 conskbdioctl(queue_t *q, mblk_t *mp)
728 {
729 	conskbd_lower_queue_t		*prev;
730 	conskbd_lower_queue_t		*lqs;
731 	struct	iocblk			*iocp;
732 	struct	linkblk			*linkp;
733 	int	index;
734 	int	error = 0;
735 
736 	iocp = (struct iocblk *)mp->b_rptr;
737 
738 	switch (iocp->ioc_cmd) {
739 
740 	case I_LINK:
741 	case I_PLINK:
742 		if (conskbd.conskbd_bypassed == B_TRUE) {
743 		/*
744 		 * A legacy keyboard can NOT be connected to conskbd together
745 		 * with other keyboards. So when a legacy keyboard is already
746 		 * linked under conkbd, we just reject all others.
747 		 */
748 			miocnak(q, mp, 0, EAGAIN);
749 			break;
750 		}
751 
752 		mutex_enter(&conskbd_lq_lock);
753 		conskbd_ioc_plink(q, mp);
754 		mutex_exit(&conskbd_lq_lock);
755 		break;
756 
757 	case I_UNLINK:
758 	case I_PUNLINK:
759 		mutex_enter(&conskbd_lq_lock);
760 		linkp = (struct linkblk *)mp->b_cont->b_rptr;
761 		prev = conskbd.conskbd_lqueue_list;
762 		for (lqs = prev; lqs; lqs = lqs->lqs_next) {
763 			if (lqs->lqs_queue == linkp->l_qbot) {
764 				if (prev == lqs)
765 					conskbd.conskbd_lqueue_list =
766 					    lqs->lqs_next;
767 				else
768 					prev->lqs_next = lqs->lqs_next;
769 
770 				lqs->lqs_queue->q_ptr =  NULL;
771 				conskbd.conskbd_lqueue_nums --;
772 				if (conskbd.conskbd_lqueue_nums == 0)
773 					conskbd.conskbd_layout = -1;
774 
775 				mutex_exit(&conskbd_lq_lock);
776 
777 				for (index = 0; index < KBTRANS_KEYNUMS_MAX;
778 				    index ++) {
779 					if (lqs->lqs_key_state[index] ==
780 					    KEY_PRESSED)
781 						kbtrans_streams_key(
782 						    conskbd.conskbd_kbtrans,
783 						    index,
784 						    KEY_RELEASED);
785 				}
786 
787 				kmem_free(lqs, sizeof (*lqs));
788 				miocack(q, mp, 0, 0);
789 				return;
790 			}
791 			prev = lqs;
792 		}
793 		mutex_exit(&conskbd_lq_lock);
794 		miocnak(q, mp, 0, EINVAL);
795 		break;
796 
797 	case KIOCSKABORTEN:
798 		/*
799 		 * Check if privileged
800 		 */
801 		if ((error = secpolicy_sys_config(iocp->ioc_cr, B_FALSE))) {
802 			miocnak(q, mp, 0, error);
803 			return;
804 		}
805 
806 		error = miocpullup(mp, sizeof (int));
807 		if (error != 0) {
808 			miocnak(q, mp, 0, error);
809 			return;
810 		}
811 
812 		abort_enable = *(int *)mp->b_cont->b_rptr;
813 		miocack(q, mp, 0, 0);
814 		break;
815 
816 	default:
817 		if (conskbd.conskbd_bypassed == B_TRUE) {
818 			conskbd_legacy_kbd_ioctl(q, mp);
819 		} else {
820 			conskbd_virtual_kbd_ioctl(q, mp);
821 		}
822 	}
823 
824 }	/* conskbdioctl() */
825 
826 
827 static void
828 conskbd_virtual_kbd_ioctl(queue_t *q, mblk_t *mp)
829 {
830 	struct iocblk		*iocp;
831 	mblk_t			*datap;
832 	int			cmd;
833 	int			error = 0;
834 
835 	iocp = (struct iocblk *)mp->b_rptr;
836 
837 	switch (iocp->ioc_cmd) {
838 	case KIOCLAYOUT:
839 		if ((datap = allocb(sizeof (int), BPRI_HI)) == NULL) {
840 			miocnak(q, mp, 0, ENOMEM);
841 			break;
842 		}
843 
844 		if (conskbd.conskbd_layout == -1)
845 			*(int *)datap->b_wptr = KBTRANS_USBKB_DEFAULT_LAYOUT;
846 		else
847 			*(int *)datap->b_wptr = conskbd.conskbd_layout;
848 
849 		datap->b_wptr += sizeof (int);
850 		if (mp->b_cont)
851 			freemsg(mp->b_cont);
852 		mp->b_cont = datap;
853 		miocack(q, mp, sizeof (int), 0);
854 		break;
855 
856 	case KIOCSLAYOUT:
857 		if (iocp->ioc_count != TRANSPARENT) {
858 			miocnak(q, mp, 0, EINVAL);
859 			break;
860 		}
861 		conskbd.conskbd_layout = *(intptr_t *)(mp->b_cont->b_rptr);
862 		miocack(q, mp, 0, 0);
863 		break;
864 
865 	case CONSOPENPOLLEDIO:
866 		error = miocpullup(mp, sizeof (struct cons_polledio *));
867 		if (error != 0) {
868 			miocnak(q, mp, 0, error);
869 			break;
870 		}
871 		if (conskbd.conskbd_lqueue_list == NULL) {
872 			miocnak(q, mp, 0, EINVAL);
873 			break;
874 		}
875 		conskbd_handle_downstream_msg(q, mp);
876 		break;
877 
878 	case CONSCLOSEPOLLEDIO:
879 		if (conskbd.conskbd_lqueue_list == NULL) {
880 			miocnak(q, mp, 0, EINVAL);
881 			break;
882 		}
883 		conskbd_handle_downstream_msg(q, mp);
884 		break;
885 
886 	case CONSSETABORTENABLE:
887 		/*
888 		 * To enable combined STOP-A(or F1-A) to trap into kmdb,
889 		 * the lower physical keyboard drivers are always told not
890 		 * to parse abort sequence(refer to consconfig_dacf module).
891 		 * Instead, lower drivers always send all keydown & keyup
892 		 * messages up to conskbd, so that when key STOP(or F1) is
893 		 * pressed on one keyboard and key A is pressed on another
894 		 * keyboard, the system could trap into kmdb.
895 		 *
896 		 * When we by kbtrans_streams_message() invoked kbtrans to
897 		 * handle ioctls in conskbduwsrv() routine, kbtrans module
898 		 * already handle the message though it returned to us a
899 		 * KBTRANS_MESSAGE_NOT_HANDLED. For virtual keyboard, no
900 		 * special initialization or un-initialization is needed.
901 		 * So we just return ACK to upper module.
902 		 */
903 		miocack(q, mp, 0, 0);
904 		break;
905 
906 	case KIOCCMD:
907 		if (conskbd.conskbd_lqueue_list == NULL ||
908 		    mp->b_cont == NULL) {
909 			miocnak(q, mp, 0, EINVAL);
910 			break;
911 		}
912 		cmd = *(int *)mp->b_cont->b_rptr;
913 		if (cmd == KBD_CMD_GETLAYOUT) {
914 			freemsg(mp->b_cont);
915 			datap = allocb(sizeof (int), BPRI_HI);
916 			if (datap == NULL) {
917 				miocnak(q, mp, 0, ENOMEM);
918 				return;
919 			}
920 			if (conskbd.conskbd_layout == -1)
921 				*(int *)datap->b_wptr =
922 				    KBTRANS_USBKB_DEFAULT_LAYOUT;
923 			else
924 				*(int *)datap->b_wptr = conskbd.conskbd_layout;
925 
926 			mp->b_cont = datap;
927 			miocack(q, mp, sizeof (int), 0);
928 			return;
929 		}
930 
931 		conskbd_handle_downstream_msg(q, mp);
932 		break;
933 
934 	default:
935 		miocnak(q, mp, 0, EINVAL);
936 		break;
937 	}
938 
939 }	/* conskbd_virtual_kbd_ioctl() */
940 
941 static void
942 conskbd_legacy_kbd_ioctl(queue_t *q, mblk_t *mp)
943 {
944 	conskbd_lower_queue_t	*lq;
945 	struct	iocblk		*iocp;
946 	int	error = 0;
947 
948 	iocp = (struct iocblk *)mp->b_rptr;
949 
950 	ASSERT(conskbd.conskbd_lqueue_nums == 1);
951 	switch (iocp->ioc_cmd) {
952 
953 	case KIOCGDIRECT: {
954 		mblk_t *datap;
955 
956 		if ((datap = allocb(sizeof (int), BPRI_MED)) == NULL) {
957 			miocnak(q, mp, 0, ENOMEM);
958 			break;
959 		}
960 
961 		*(int *)datap->b_wptr = conskbd.conskbd_directio;
962 		datap->b_wptr += sizeof (int);
963 		if (mp->b_cont != NULL) {
964 			freemsg(mp->b_cont);
965 			mp->b_cont = NULL;
966 		}
967 		mp->b_cont = datap;
968 		miocack(q, mp, sizeof (int), 0);
969 		break;
970 	}
971 
972 	case KIOCSDIRECT:
973 		error = miocpullup(mp, sizeof (int));
974 		if (error != 0) {
975 			miocnak(q, mp, 0, error);
976 			break;
977 		}
978 		conskbd.conskbd_directio = *(int *)mp->b_cont->b_rptr;
979 
980 		/*
981 		 * Pass this through, if there's something to pass
982 		 * it through to, so the system keyboard can reset
983 		 * itself.
984 		 */
985 		if (conskbd.conskbd_lqueue_nums > 0) {
986 			lq = conskbd.conskbd_lqueue_list;
987 			ASSERT(lq && lq->lqs_next == NULL);
988 			if (putq(lq->lqs_queue, mp) != 1) {
989 				miocnak(q, mp, 0, ENOMEM);
990 				return;
991 			}
992 			break;
993 		}
994 
995 		miocack(q, mp, 0, 0);
996 		break;
997 
998 	default:
999 		/*
1000 		 * Pass this through, if there's something to pass it
1001 		 * through to; otherwise, reject it.
1002 		 */
1003 		if (conskbd.conskbd_lqueue_nums > 0) {
1004 			lq = conskbd.conskbd_lqueue_list;
1005 			ASSERT(lq && lq->lqs_next == NULL);
1006 			if (putq(lq->lqs_queue, mp) != 1) {
1007 				miocnak(q, mp, 0, ENOMEM);
1008 				return;
1009 			}
1010 			break;
1011 		}
1012 
1013 		/* nobody below us; reject it */
1014 		miocnak(q, mp, 0, EINVAL);
1015 		break;
1016 	}
1017 
1018 }	/* conskbd_legacy_kbd_ioctl() */
1019 
1020 
1021 /*
1022  * Service procedure for lower write queue.
1023  * Puts things on the queue below us, if it lets us.
1024  */
1025 static void
1026 conskbdlwserv(queue_t *q)
1027 {
1028 	register mblk_t *mp;
1029 
1030 	while (canput(q->q_next) && (mp = getq(q)) != NULL)
1031 		putnext(q, mp);
1032 
1033 }	/* conskbdlwserv() */
1034 
1035 /*
1036  * Put procedure for lower read queue.
1037  * Pass everything up to minor device 0 if "directio" set, otherwise to minor
1038  * device 1.
1039  */
1040 static void
1041 conskbdlrput(queue_t *q, mblk_t *mp)
1042 {
1043 	conskbd_lower_queue_t	*lqs;
1044 	struct iocblk 	*iocp;
1045 	Firm_event	*fe;
1046 
1047 	DPRINTF(PRINT_L1, PRINT_MASK_ALL, ("conskbdlrput\n"));
1048 
1049 	switch (mp->b_datap->db_type) {
1050 
1051 	case M_FLUSH:
1052 		if (*mp->b_rptr == FLUSHR) {
1053 			flushq(q, FLUSHDATA);	/* XXX doesn't flush M_DELAY */
1054 			*mp->b_rptr &= ~FLUSHR;	/* it has been flushed */
1055 		}
1056 		if (*mp->b_rptr == FLUSHW) {
1057 			flushq(WR(q), FLUSHDATA);
1058 			qreply(q, mp);	/* give the read queues a crack at it */
1059 		} else
1060 			freemsg(mp);
1061 		break;
1062 
1063 	case M_DATA:
1064 		if (conskbd.conskbd_bypassed == B_FALSE) {
1065 
1066 			fe = (Firm_event *)mp->b_rptr;
1067 
1068 			/*
1069 			 * This is a workaround.
1070 			 *
1071 			 * According to HID specification, there are the
1072 			 * following keycode mapping between PS2 and USB,
1073 			 *
1074 			 *	PS2 AT-101 keycode(29)  --->    USB(49)
1075 			 *	PS2 AT-102 keycode(42)  --->    USB(50)
1076 			 *
1077 			 * However, the two keys, AT-101(29) and AT-102(42),
1078 			 * have the same scancode,0x2B, in PS2 scancode SET1
1079 			 * which we are using. The Kb8042 driver always
1080 			 * recognizes the two keys as PS2(29) so that we could
1081 			 * not know which is being pressed or released when we
1082 			 * receive scancode 0x2B. Fortunately, the two keys can
1083 			 * not co-exist in a specific layout. In other words,
1084 			 * in the table of keycode-to-symbol mapping, either
1085 			 * entry 49 or 50 is a hole. So, if we're processing a
1086 			 * keycode 49, we look at the entry for 49.  If it's
1087 			 * HOLE, remap the key to 50; If we're processing a 50,
1088 			 * look at the entry for 50.  If it's HOLE, we remap
1089 			 * the key to 49.
1090 			 */
1091 			if (fe->id == 49 || fe->id == 50) {
1092 				if (conskbd_keyindex->k_normal[50] == HOLE)
1093 					fe->id = 49;
1094 				else
1095 					fe->id = 50;
1096 			}
1097 
1098 			/*
1099 			 * Remember key state of each key of lower physical
1100 			 * keyboard. When a keyboard is umplumbed from conskbd,
1101 			 * we will check all key states. By then,  we will fake
1102 			 * a KEY_RELEASED message for each key in KEY_PRESSED
1103 			 * state. Otherwise, upper module will treat these keys
1104 			 * as held-down for ever.
1105 			 */
1106 			iocp = (struct iocblk *)mp->b_rptr;
1107 			lqs = (conskbd_lower_queue_t *)q->q_ptr;
1108 			if (fe->value)
1109 				lqs->lqs_key_state[fe->id] = KEY_PRESSED;
1110 			else
1111 				lqs->lqs_key_state[fe->id] = KEY_RELEASED;
1112 
1113 			kbtrans_streams_key(conskbd.conskbd_kbtrans,
1114 			    fe->id, fe->value ? KEY_PRESSED : KEY_RELEASED);
1115 			freemsg(mp);
1116 		} else {
1117 			if (conskbd.conskbd_directio)
1118 				putnext(conskbd_regqueue, mp);
1119 			else if (conskbd_consqueue != NULL)
1120 				putnext(conskbd_consqueue, mp);
1121 			else
1122 				freemsg(mp);
1123 		}
1124 		conskbd_idle_stamp = gethrestime_sec();
1125 		break;
1126 
1127 	case M_IOCACK:
1128 	case M_IOCNAK:
1129 		iocp = (struct iocblk *)mp->b_rptr;
1130 		lqs = (conskbd_lower_queue_t *)q->q_ptr;
1131 
1132 		DPRINTF(PRINT_L1, PRINT_MASK_ALL, ("conskbdlrput: "
1133 		    "ACK/NAK - cmd 0x%x\n", iocp->ioc_cmd));
1134 
1135 		conskbd_lqs_ack_complete(lqs, mp);
1136 		break;
1137 
1138 	case M_ERROR:
1139 	case M_HANGUP:
1140 	default:
1141 		freemsg(mp);	/* anything useful here? */
1142 		break;
1143 	}
1144 
1145 }	/* conskbdlrput() */
1146 
1147 
1148 /* ARGSUSED */
1149 static int
1150 conskbd_kstat_update(kstat_t *ksp, int rw)
1151 {
1152 	if (rw == KSTAT_WRITE)
1153 		return (EACCES);
1154 
1155 	conskbd_kstat.idle_sec.value.l = gethrestime_sec() - conskbd_idle_stamp;
1156 
1157 	return (0);
1158 
1159 }	/* conskbd_kstat_update() */
1160 
1161 /*
1162  * STREAMS architecuture provides guarantee that the ID of each
1163  * message, iocblk.ioc_id, in a stream is unique. The following
1164  * routine performes the task: When receive request from upstream,
1165  * it saves the request in a global link list, clones the request,
1166  * and then sends a copy of the request to each of lower queues
1167  * which are plumbed into conskbd. And then, when receives responses
1168  * from lower queues in conskbdlrput() routine, we can know the
1169  * request matching received responses by searching the global linked
1170  * list to find the request which has the same message ID of the
1171  * response. Then, when all lower queues response this request, we
1172  * give a response to upstreams based the following policy:
1173  * If any one of lower queues acks our reuqest, then we return ack
1174  * to upstreams; only if all lower queues nak our request, we return
1175  * nak to upstreams. If all responses are nak, the error number of
1176  * the first response is sent to upstream.
1177  */
1178 static void
1179 conskbd_handle_downstream_msg(queue_t *q, mblk_t *mp)
1180 {
1181 	conskbd_pending_msg_t	*msg;
1182 	conskbd_lower_queue_t	*lqs;
1183 	struct iocblk	*iocp;
1184 	mblk_t		*clonemp;
1185 	int		retry;
1186 
1187 	if (conskbd.conskbd_lqueue_nums == 0) {
1188 		miocnak(q, mp, 0, EINVAL);
1189 		return;
1190 	}
1191 
1192 	msg = (conskbd_pending_msg_t *)
1193 	    kmem_zalloc(sizeof (conskbd_pending_msg_t), KM_SLEEP);
1194 	mutex_init(&msg->kpm_lock, NULL, MUTEX_DRIVER, NULL);
1195 	lqs = conskbd.conskbd_lqueue_list;
1196 	iocp = (struct iocblk *)mp->b_rptr;
1197 
1198 	ASSERT(iocp->ioc_cmd == CONSOPENPOLLEDIO ||
1199 	    iocp->ioc_cmd == CONSCLOSEPOLLEDIO ||
1200 	    iocp->ioc_cmd == KIOCCMD);
1201 
1202 	msg->kpm_upper_queue = q;
1203 	msg->kpm_req_msg = mp;
1204 	msg->kpm_req_id = iocp->ioc_id;
1205 	msg->kpm_req_cmd = iocp->ioc_cmd;
1206 	msg->kpm_req_nums = conskbd.conskbd_lqueue_nums;
1207 	conskbd_mux_enqueue_msg(msg);
1208 
1209 	for (retry = 0, lqs = conskbd.conskbd_lqueue_list; lqs; ) {
1210 
1211 		/*
1212 		 * if a lower physical keyboard is not in polled I/O
1213 		 * mode, we couldn't send CONSCLOSEPOLLEDIO to it,
1214 		 * otherwise, system will panic.
1215 		 */
1216 		if (iocp->ioc_cmd == CONSCLOSEPOLLEDIO &&
1217 		    lqs->lqs_polledio == NULL) {
1218 			lqs = lqs->lqs_next;
1219 			msg->kpm_req_nums --;
1220 			retry = 0;
1221 			continue;
1222 		}
1223 
1224 		clonemp = copymsg(mp);
1225 		if (clonemp != NULL) {
1226 			if (putq(lqs->lqs_queue, clonemp) == 1) {
1227 				lqs = lqs->lqs_next;
1228 				retry = 0;
1229 				continue;
1230 			}
1231 
1232 			/*
1233 			 * failed to invoke putq(), retry.
1234 			 */
1235 			freemsg(clonemp);
1236 		}
1237 
1238 		/*
1239 		 * During testing it was observed that occasionally
1240 		 * copymsg() would fail during boot. The reason for
1241 		 * these failures is unknown. Since we really want
1242 		 * to successfully plumb up all the attached keyboards
1243 		 * during boot we do a best effort here by retrying
1244 		 * the copymsg() call in the hopes that it will
1245 		 * succeeded upon subsequent invocations.
1246 		 *
1247 		 * If all the calls to copymsg() fails, it will cause
1248 		 * the corresponding keyboard to be unavailable, or
1249 		 * or behave weirdly,
1250 		 *
1251 		 * 1) for CONSOPENPOLLEDIO
1252 		 *	if copymsg()fails, the corresponding keyboard
1253 		 *	is not available in polled I/O mode once
1254 		 *	entering kmdb;
1255 		 * 2) for CONSCLOSEPOLLEDIO
1256 		 *	if copymsg() fails, the corresponding keyboard
1257 		 *	is not available in normal mode once returning
1258 		 *	from kmdb;
1259 		 * 3) for KIOCCMD
1260 		 * 	3.1) for KBD_CMD_NOBELL
1261 		 * 		there's no beep in USB and PS2 keyboard,
1262 		 * 		this ioctl actually disables the beep on
1263 		 * 		system mainboard. Note that all the cloned
1264 		 * 		messages sent down to lower queues do the
1265 		 * 		same job for system mainboard. Therefore,
1266 		 * 		even if we fail to send this ioctl to most
1267 		 * 		of lower queues, the beep still would be
1268 		 * 		disabled. So, no trouble exists here.
1269 		 *	3.2) for others
1270 		 *		nothing;
1271 		 *
1272 		 * However, all cases could be resume next time when the
1273 		 * same request comes again.
1274 		 */
1275 		if (retry ++ >= 5) {
1276 			dev_t	devt;
1277 			char	path[MAXPATHLEN + 1];
1278 
1279 			devt = lqs->lqs_queue->q_stream->sd_vnode->v_rdev;
1280 			switch (iocp->ioc_cmd) {
1281 			case CONSOPENPOLLEDIO:
1282 				if (ddi_dev_pathname(devt, S_IFCHR,
1283 				    path) == DDI_SUCCESS)
1284 					cmn_err(CE_WARN, "conskbd: "
1285 					    "keyboard is not available"
1286 					    " for system debugging: %s",
1287 					    path);
1288 				break;
1289 
1290 			case CONSCLOSEPOLLEDIO:
1291 				if (ddi_dev_pathname(devt, S_IFCHR,
1292 				    path) == DDI_SUCCESS)
1293 					cmn_err(CE_WARN, "conskbd: "
1294 					    "keyboard is not available:"
1295 					    " %s", path);
1296 				break;
1297 
1298 			default:
1299 				break;
1300 			}
1301 			msg->kpm_req_nums --;
1302 			lqs = lqs->lqs_next;
1303 			retry = 0;
1304 		}
1305 	}
1306 
1307 	if (msg->kpm_req_nums == 0) {
1308 		conskbd_mux_dequeue_msg(msg);
1309 		kmem_free(msg, sizeof (*msg));
1310 		miocnak(q, mp, 0, ENOMEM);
1311 	}
1312 
1313 }	/* conskbd_handle_downstream_msg() */
1314 
1315 
1316 static void
1317 conskbd_ioc_plink(queue_t *q, mblk_t *mp)
1318 {
1319 	mblk_t		*req;
1320 	queue_t		*lowque;
1321 	struct iocblk		*iocp;
1322 	struct linkblk		*linkp;
1323 	conskbd_lower_queue_t	*lqs;
1324 
1325 	ASSERT(mutex_owned(&conskbd_lq_lock));
1326 
1327 	lqs = kmem_zalloc(sizeof (*lqs), KM_SLEEP);
1328 	ASSERT(lqs->lqs_state == LQS_UNINITIALIZED);
1329 
1330 	iocp = (struct iocblk *)mp->b_rptr;
1331 	linkp = (struct linkblk *)mp->b_cont->b_rptr;
1332 	lowque = linkp->l_qbot;
1333 
1334 	lowque->q_ptr = (void *)lqs;
1335 	OTHERQ(lowque)->q_ptr = (void *)lqs;
1336 
1337 	lqs->lqs_queue = lowque;
1338 	lqs->lqs_pending_plink = mp;
1339 	lqs->lqs_pending_queue = q;
1340 
1341 	req = mkiocb(CONSSETKBDTYPE);
1342 	if (req == NULL) {
1343 		miocnak(q, mp, 0, ENOMEM);
1344 		lowque->q_ptr = NULL;
1345 		kmem_free(lqs, sizeof (*lqs));
1346 		return;
1347 	}
1348 
1349 	req->b_cont = allocb(sizeof (int), BPRI_MED);
1350 	if (req->b_cont == NULL) {
1351 		freemsg(req);
1352 		miocnak(q, mp, 0, ENOMEM);
1353 		lowque->q_ptr = NULL;
1354 		kmem_free(lqs, sizeof (*lqs));
1355 		return;
1356 	}
1357 
1358 	iocp->ioc_count = 0;
1359 	iocp->ioc_rval = 0;
1360 
1361 	*(int *)req->b_cont->b_wptr = KB_USB;
1362 	req->b_cont->b_wptr += sizeof (int);
1363 
1364 	lqs->lqs_state = LQS_KIOCTYPE_ACK_PENDING;
1365 
1366 	if (putq(lowque, req) != 1) {
1367 		freemsg(req);
1368 		miocnak(lqs->lqs_pending_queue,
1369 		    lqs->lqs_pending_plink, 0, ENOMEM);
1370 		lowque->q_ptr = NULL;
1371 		kmem_free(lqs, sizeof (*lqs));
1372 	}
1373 
1374 }	/* conskbd_ioc_plink() */
1375 
1376 
1377 /*
1378  * Every physical keyboard has a corresponding STREAMS queue. We call this
1379  * queue lower queue. Every lower queue has a state, refer to conskbd.h file
1380  * about "enum conskbd_lqs_state".
1381  * The following routine is used to handle response messages from lower queue.
1382  * When receiving ack/nak message from lower queue(s), the routine determines
1383  * the passage for it according to the current state of this lower queue.
1384  */
1385 static void
1386 conskbd_lqs_ack_complete(conskbd_lower_queue_t *lqs, mblk_t *mp)
1387 {
1388 	switch (lqs->lqs_state) {
1389 
1390 	/* S6: working in virtual keyboard mode, multi-keyboards are usable */
1391 	case LQS_INITIALIZED:
1392 		conskbd_mux_upstream_msg(lqs, mp);
1393 		break;
1394 
1395 	/* S5: working in legacy mode, only one keyboard is usable */
1396 	case LQS_INITIALIZED_LEGACY:
1397 		conskbd_legacy_upstream_msg(lqs, mp);
1398 		break;
1399 
1400 	/* S4: wait lower queue to acknowledge KIOCSLED/KIOCGLED  message */
1401 	case LQS_KIOCSLED_ACK_PENDING:
1402 		conskbd_kiocsled_complete(lqs, mp);
1403 		break;
1404 
1405 	/* S3: wait lower queue to acknowledge KIOCLAYOUT  message */
1406 	case LQS_KIOCLAYOUT_ACK_PENDING:
1407 		conskbd_kioclayout_complete(lqs, mp);
1408 		break;
1409 
1410 	/* S2: wait lower queue to acknowledge KIOCTRANS  message */
1411 	case LQS_KIOCTRANS_ACK_PENDING:
1412 		conskbd_kioctrans_complete(lqs, mp);
1413 		break;
1414 
1415 	/* S1: wait lower queue to acknowledge KIOCTYPE  message */
1416 	case LQS_KIOCTYPE_ACK_PENDING:
1417 		conskbd_kioctype_complete(lqs, mp);
1418 		break;
1419 
1420 	/* if reaching here, there must be a error */
1421 	default:
1422 		freemsg(mp);
1423 		cmn_err(CE_WARN, "conskbd: lqs_ack_complete() state error");
1424 		break;
1425 	}
1426 
1427 }	/* conskbd_lqs_ack_complete() */
1428 
1429 
1430 static void
1431 conskbd_kioctype_complete(conskbd_lower_queue_t *lqs, mblk_t *mp)
1432 {
1433 	struct iocblk	*iocp;
1434 	mblk_t		*msg;
1435 	mblk_t		*req;
1436 	queue_t		*lowerque;
1437 
1438 	ASSERT(lqs->lqs_pending_plink);
1439 	ASSERT(lqs->lqs_state == LQS_KIOCTYPE_ACK_PENDING);
1440 
1441 	lowerque = lqs->lqs_queue;
1442 
1443 	switch (mp->b_datap->db_type) {
1444 	case M_IOCACK:
1445 		req = mkiocb(KIOCTRANS);
1446 		if (req == NULL) {
1447 			miocnak(lqs->lqs_pending_queue, lqs->lqs_pending_plink,
1448 			    0, ENOMEM);
1449 			lowerque->q_ptr = NULL;
1450 			kmem_free(lqs, sizeof (*lqs));
1451 			freemsg(mp);
1452 			return;
1453 		}
1454 
1455 		req->b_cont = allocb(sizeof (int), BPRI_MED);
1456 		if (req->b_cont == NULL) {
1457 			miocnak(lqs->lqs_pending_queue, lqs->lqs_pending_plink,
1458 			    0, ENOMEM);
1459 			lowerque->q_ptr = NULL;
1460 			kmem_free(lqs, sizeof (*lqs));
1461 			freemsg(req);
1462 			freemsg(mp);
1463 			return;
1464 		}
1465 
1466 		/* Set the translate mode to TR_UNTRANS_EVENT */
1467 		*(int *)req->b_cont->b_wptr = TR_UNTRANS_EVENT;
1468 		req->b_cont->b_wptr += sizeof (int);
1469 
1470 		/* Ready to handle the response to KIOCTRANS */
1471 		lqs->lqs_state = LQS_KIOCTRANS_ACK_PENDING;
1472 
1473 		if (putq(lowerque, req) != 1) {
1474 			freemsg(req);
1475 			miocnak(lqs->lqs_pending_queue,
1476 			    lqs->lqs_pending_plink, 0, ENOMEM);
1477 			lowerque->q_ptr = NULL;
1478 			kmem_free(lqs, sizeof (*lqs));
1479 		}
1480 		break;
1481 
1482 	case M_IOCNAK:
1483 		/*
1484 		 * The lower keyboard driver can't mimic USB keyboard,
1485 		 * that's say, the physical keyboard is an old one, such
1486 		 * as TYPE 3/4/5 one. In this case, the virtual keyboard
1487 		 * is disabled, and the data from lower keyboard driver
1488 		 * will bypass the conskbd module.
1489 		 */
1490 
1491 		/*
1492 		 * if there is any other keyborad already linked under the
1493 		 * conskbd, we reject the current one.
1494 		 */
1495 		if (conskbd.conskbd_lqueue_nums > 0) {
1496 			iocp = (struct iocblk *)mp->b_rptr;
1497 			miocnak(lqs->lqs_pending_queue, lqs->lqs_pending_plink,
1498 			    0, iocp->ioc_error);
1499 			lowerque->q_ptr = NULL;
1500 			kmem_free(lqs, sizeof (*lqs));
1501 			break;
1502 		}
1503 
1504 		/*
1505 		 * Bypass the virutal keyboard for old hardware
1506 		 */
1507 		conskbd.conskbd_bypassed = B_TRUE;
1508 
1509 		msg = lqs->lqs_pending_plink;
1510 		msg->b_datap->db_type = M_IOCACK;
1511 		iocp = (struct iocblk *)msg->b_rptr;
1512 		iocp->ioc_error = 0;
1513 
1514 		/*
1515 		 * link this keyboard under conskbd
1516 		 */
1517 		mutex_enter(&conskbd_lq_lock);
1518 		lqs->lqs_next = conskbd.conskbd_lqueue_list;
1519 		conskbd.conskbd_lqueue_list = lqs;
1520 		conskbd.conskbd_lqueue_nums++;
1521 		mutex_exit(&conskbd_lq_lock);
1522 
1523 		lqs->lqs_state = LQS_INITIALIZED_LEGACY;
1524 
1525 		qreply(lqs->lqs_pending_queue, lqs->lqs_pending_plink);
1526 		break;
1527 	}
1528 
1529 	freemsg(mp);
1530 
1531 }	/* conskbd_kioctype_complete() */
1532 
1533 static void
1534 conskbd_kioctrans_complete(conskbd_lower_queue_t *lqs, mblk_t *mp)
1535 {
1536 	struct iocblk 	*iocp;
1537 	mblk_t		*req;
1538 	queue_t		*lowerque;
1539 
1540 	ASSERT(lqs->lqs_pending_plink != NULL);
1541 	ASSERT(lqs->lqs_state == LQS_KIOCTRANS_ACK_PENDING);
1542 
1543 	lowerque = lqs->lqs_queue;
1544 
1545 	switch (mp->b_datap->db_type) {
1546 	case M_IOCACK:
1547 		req = mkiocb(KIOCLAYOUT);
1548 		if (req == NULL) {
1549 			miocnak(lqs->lqs_pending_queue, lqs->lqs_pending_plink,
1550 			    0, ENOMEM);
1551 			lowerque->q_ptr = NULL;
1552 			kmem_free(lqs, sizeof (*lqs));
1553 			freemsg(mp);
1554 			return;
1555 		}
1556 
1557 		req->b_cont = allocb(sizeof (int), BPRI_MED);
1558 		if (req->b_cont == NULL) {
1559 			miocnak(lqs->lqs_pending_queue, lqs->lqs_pending_plink,
1560 			    0, ENOMEM);
1561 			kmem_free(lqs, sizeof (*lqs));
1562 			freemsg(req);
1563 			freemsg(mp);
1564 			return;
1565 		}
1566 
1567 		/* waiting for response to KIOCLAYOUT */
1568 		lqs->lqs_state = LQS_KIOCLAYOUT_ACK_PENDING;
1569 		if (putq(lqs->lqs_queue, req) != 1) {
1570 			freemsg(req);
1571 			miocnak(lqs->lqs_pending_queue,
1572 			    lqs->lqs_pending_plink, 0, ENOMEM);
1573 			lowerque->q_ptr = NULL;
1574 			kmem_free(lqs, sizeof (*lqs));
1575 		}
1576 		break;
1577 
1578 	case M_IOCNAK:
1579 		iocp = (struct iocblk *)mp->b_rptr;
1580 		miocnak(lqs->lqs_pending_queue, lqs->lqs_pending_plink,
1581 		    0, iocp->ioc_error);
1582 		lowerque->q_ptr = NULL;
1583 		kmem_free(lqs, sizeof (*lqs));
1584 		break;
1585 	}
1586 
1587 	freemsg(mp);
1588 
1589 }	/* conskbd_kioctrans_complete() */
1590 
1591 static void
1592 conskbd_kioclayout_complete(conskbd_lower_queue_t *lqs, mblk_t *mp)
1593 {
1594 	mblk_t		*req;
1595 	int		layout;
1596 	boolean_t	fail;
1597 
1598 	ASSERT(lqs->lqs_pending_plink != NULL);
1599 	ASSERT(lqs->lqs_state == LQS_KIOCLAYOUT_ACK_PENDING);
1600 
1601 	switch (mp->b_datap->db_type) {
1602 	case M_IOCACK:
1603 		if (miocpullup(mp, sizeof (int)) == 0) {
1604 			layout = *(int *)mp->b_cont->b_rptr;
1605 			/*
1606 			 * We just accept the layout of the first keyboard
1607 			 * requesting to be linked under conskbd. If current
1608 			 * keyboard is the first one, and if we get right
1609 			 * layout from it, we set conskbd's layout
1610 			 */
1611 			if (layout != -1 && conskbd.conskbd_layout == -1)
1612 				conskbd.conskbd_layout = layout;
1613 		}
1614 		break;
1615 
1616 
1617 	/* if fail, leave conskbd's layout as it is */
1618 	case M_IOCNAK:
1619 		break;
1620 	}
1621 
1622 	freemsg(mp);
1623 
1624 	fail = B_TRUE;
1625 
1626 	if (conskbd.conskbd_led_state == -1)
1627 		req = mkiocb(KIOCGLED);
1628 	else
1629 		req = mkiocb(KIOCSLED);
1630 
1631 	if (req) {
1632 		req->b_cont = allocb(sizeof (uchar_t), BPRI_MED);
1633 		if (req->b_cont) {
1634 			if (conskbd.conskbd_led_state != -1) {
1635 				*(uchar_t *)req->b_cont->b_wptr =
1636 				    conskbd.conskbd_led_state;
1637 				req->b_cont->b_wptr += sizeof (uchar_t);
1638 			}
1639 
1640 			/* waiting for response to KIOCSLED */
1641 			lqs->lqs_state = LQS_KIOCSLED_ACK_PENDING;
1642 			if (putq(lqs->lqs_queue, req) == 1) {
1643 				fail = B_FALSE;
1644 			} else {
1645 				freemsg(req);
1646 			}
1647 
1648 		} else {
1649 			freemsg(req);
1650 		}
1651 	}
1652 
1653 	if (fail) {
1654 		/*
1655 		 * If fail to allocate KIOCSLED/KIOCGLED message or put
1656 		 * the message into lower queue, we immediately link
1657 		 * current keyboard under conskbd. Thus, even if fails
1658 		 * to set/get LED, this keyboard could be available.
1659 		 */
1660 		conskbd_link_lower_queue(lqs);
1661 	}
1662 
1663 }	/* conskbd_kioclayout_complete() */
1664 
1665 
1666 static void
1667 conskbd_kiocsled_complete(conskbd_lower_queue_t *lqs, mblk_t *mp)
1668 {
1669 	int	led_state;
1670 
1671 	ASSERT(lqs->lqs_pending_plink != NULL);
1672 	ASSERT(lqs->lqs_state == LQS_KIOCSLED_ACK_PENDING);
1673 
1674 	if (conskbd.conskbd_led_state == -1) {
1675 		switch (mp->b_datap->db_type) {
1676 		case M_IOCACK:
1677 			if (miocpullup(mp, sizeof (uchar_t)) == 0) {
1678 				led_state = *(uchar_t *)mp->b_cont->b_rptr;
1679 				conskbd.conskbd_led_state = led_state;
1680 				kbtrans_streams_setled(conskbd.conskbd_kbtrans,
1681 				    led_state);
1682 			}
1683 			break;
1684 
1685 		/* if fail, leave conskbd's led_state as it is */
1686 		case M_IOCNAK:
1687 			break;
1688 		}
1689 	}
1690 
1691 	/*
1692 	 * Basically, failure of setting/getting LED is not a fatal
1693 	 * error, so we will plumb the lower queue into conskbd whether
1694 	 * setting/getting LED succeeds or fails.
1695 	 */
1696 	freemsg(mp);
1697 	conskbd_link_lower_queue(lqs);
1698 
1699 }	/* conskbd_kiocsled_complete() */
1700 
1701 
1702 static void
1703 conskbd_mux_upstream_msg(conskbd_lower_queue_t *lqs, mblk_t *mp)
1704 {
1705 	conskbd_pending_msg_t	*msg;
1706 	struct iocblk		*iocp;
1707 	int			error;
1708 	dev_t			devt;
1709 	char			path[MAXPATHLEN + 1];
1710 
1711 	ASSERT(lqs->lqs_state == LQS_INITIALIZED);
1712 	msg = conskbd_mux_find_msg(mp);
1713 
1714 	if (!msg) {
1715 		/*
1716 		 * Here, we just discard the responses to KIOCSLED request.
1717 		 * Please refer to conskbd_streams_setled().
1718 		 */
1719 		ASSERT(((struct iocblk *)mp->b_rptr)->ioc_cmd == KIOCSLED);
1720 		freemsg(mp);
1721 		return;
1722 	}
1723 
1724 	/*
1725 	 * We use the b_next field of mblk_t structure to link all
1726 	 * response coming from lower queues into a linkage list,
1727 	 * and make use of the b_prev field to save a pointer to
1728 	 * the lower queue from which the current response message
1729 	 * comes.
1730 	 */
1731 	ASSERT(mp->b_next == NULL && mp->b_prev == NULL);
1732 	mutex_enter(&msg->kpm_lock);
1733 	mp->b_next = msg->kpm_resp_list;
1734 	mp->b_prev = (mblk_t *)lqs;
1735 	msg->kpm_resp_list = mp;
1736 	msg->kpm_resp_nums ++;
1737 	mutex_exit(&msg->kpm_lock);
1738 
1739 	if (msg->kpm_resp_nums < msg->kpm_req_nums)
1740 		return;
1741 
1742 	ASSERT(msg->kpm_resp_nums == msg->kpm_req_nums);
1743 	ASSERT(mp == msg->kpm_resp_list);
1744 
1745 	conskbd_mux_dequeue_msg(msg);
1746 
1747 
1748 	/*
1749 	 * Here, we have the policy that, if any one lower queue ACK
1750 	 * our reuqest, then we return ACK to upstreams; only if all
1751 	 * lower queues NAK our request, we return NAK to upstreams.
1752 	 * if all responses are nak, the errno of the  first response
1753 	 * is sent to upstreams
1754 	 */
1755 	ASSERT(mp->b_rptr);
1756 	error = ((struct iocblk *)mp->b_rptr)->ioc_error;
1757 
1758 	switch (msg->kpm_req_cmd) {
1759 	case CONSOPENPOLLEDIO:
1760 		/*
1761 		 * Here, we can safely ignore the NAK message. If any one lower
1762 		 * queue returns NAK, the pointer to the corresponding polledio
1763 		 * structure will remain null, that's say lqs->lqs_polledio =
1764 		 * null. When we need to invoke polled I/O interface, we will
1765 		 * check if the pointer is null.
1766 		 */
1767 		for (mp = msg->kpm_resp_list; mp; ) {
1768 			cons_polledio_t		*polledio;
1769 
1770 			msg->kpm_resp_list = mp->b_next;
1771 			lqs = (conskbd_lower_queue_t *)mp->b_prev;
1772 			devt = lqs->lqs_queue->q_stream->sd_vnode->v_rdev;
1773 			if (mp->b_datap->db_type == M_IOCACK) {
1774 				polledio = *(struct cons_polledio **)
1775 				    mp->b_cont->b_rptr;
1776 				if (polledio->cons_polledio_version ==
1777 				    CONSPOLLEDIO_V1) {
1778 					lqs->lqs_polledio = polledio;
1779 					error = 0;
1780 				} else {
1781 					/*
1782 					 * USB and PS2 keyboard drivers should
1783 					 * use the same cons_polledio structure
1784 					 * as conskbd.
1785 					 */
1786 					if (ddi_dev_pathname(devt, S_IFCHR,
1787 					    path) == DDI_SUCCESS) {
1788 						cmn_err(CE_WARN, "keyboard "
1789 						    "driver does not support "
1790 						    "system debugging: %s",
1791 						    path);
1792 					}
1793 					error = EINVAL;
1794 				}
1795 			} else {
1796 				if (ddi_dev_pathname(devt, S_IFCHR, path) ==
1797 				    DDI_SUCCESS) {
1798 					cmn_err(CE_WARN, "conskbd: keyboard is"
1799 					    " not available for system"
1800 					    " debugging:  %s", path);
1801 				}
1802 			}
1803 			mp->b_next = NULL;
1804 			mp->b_prev = NULL;
1805 			freemsg(mp);
1806 			mp = msg->kpm_resp_list;
1807 		}
1808 
1809 		mp = msg->kpm_req_msg;
1810 		if (error == 0) {
1811 			*(struct cons_polledio **)mp->b_cont->b_rptr =
1812 			    &conskbd.conskbd_polledio;
1813 		}
1814 		break;
1815 
1816 	case CONSCLOSEPOLLEDIO:
1817 		for (mp = msg->kpm_resp_list; mp; ) {
1818 			msg->kpm_resp_list = mp->b_next;
1819 			lqs = (conskbd_lower_queue_t *)mp->b_prev;
1820 			if (mp->b_datap->db_type == M_IOCACK) {
1821 				lqs->lqs_polledio = NULL;
1822 				error = 0;
1823 			} else {
1824 				devt =
1825 				    lqs->lqs_queue->q_stream->sd_vnode->v_rdev;
1826 
1827 				if (ddi_dev_pathname(devt, S_IFCHR, path) ==
1828 				    DDI_SUCCESS) {
1829 					cmn_err(CE_WARN, "conskbd: keyboard is"
1830 					    " not available: %s", path);
1831 				}
1832 			}
1833 
1834 			mp->b_next = NULL;
1835 			mp->b_prev = NULL;
1836 			freemsg(mp);
1837 			mp = msg->kpm_resp_list;
1838 		}
1839 		break;
1840 
1841 	case KIOCCMD:
1842 		for (mp = msg->kpm_resp_list; mp; ) {
1843 			msg->kpm_resp_list = mp->b_next;
1844 
1845 			if (mp->b_datap->db_type == M_IOCACK)
1846 				error = 0;
1847 			mp->b_next = NULL;
1848 			mp->b_prev = NULL;
1849 			freemsg(mp);
1850 			mp = msg->kpm_resp_list;
1851 		}
1852 		break;
1853 
1854 	default:  /* it is impossible to reach here */
1855 		cmn_err(CE_WARN, "conskbd: unexpected ioctl reply");
1856 	}
1857 
1858 	mp = msg->kpm_req_msg;
1859 	if (error == 0) {
1860 		mp->b_datap->db_type = M_IOCACK;
1861 	} else {
1862 		mp->b_datap->db_type = M_IOCNAK;
1863 	}
1864 	iocp = (struct iocblk *)mp->b_rptr;
1865 	iocp->ioc_error = error;
1866 	qreply(msg->kpm_upper_queue, mp);
1867 	mutex_destroy(&msg->kpm_lock);
1868 	kmem_free(msg, sizeof (*msg));
1869 
1870 }	/* conskbd_mux_upstream_msg() */
1871 
1872 
1873 static void
1874 conskbd_link_lower_queue(conskbd_lower_queue_t *lqs)
1875 {
1876 	struct iocblk 	*iocp;
1877 	mblk_t		*msg;
1878 	int		index;
1879 
1880 	ASSERT(lqs->lqs_pending_plink != NULL);
1881 
1882 	msg = lqs->lqs_pending_plink;
1883 	msg->b_datap->db_type = M_IOCACK;
1884 	iocp = (struct iocblk *)msg->b_rptr;
1885 	iocp->ioc_error = 0;
1886 
1887 	/*
1888 	 * Now, link the lower queue under conskbd
1889 	 */
1890 	mutex_enter(&conskbd_lq_lock);
1891 	conskbd.conskbd_lqueue_nums++;
1892 	lqs->lqs_next = conskbd.conskbd_lqueue_list;
1893 	conskbd.conskbd_lqueue_list = lqs;
1894 	for (index = 0; index < KBTRANS_KEYNUMS_MAX; index ++) {
1895 		lqs->lqs_key_state[index] = KEY_RELEASED;
1896 	}
1897 	lqs->lqs_state = LQS_INITIALIZED;
1898 	mutex_exit(&conskbd_lq_lock);
1899 	qreply(lqs->lqs_pending_queue, lqs->lqs_pending_plink);
1900 
1901 }	/* conskbd_kiocsled_complete() */
1902 
1903 
1904 
1905 /*ARGSUSED*/
1906 static void
1907 conskbd_legacy_upstream_msg(conskbd_lower_queue_t *lqs, mblk_t *mp)
1908 {
1909 	struct iocblk	*iocp;
1910 
1911 	ASSERT(lqs && lqs->lqs_state == LQS_INITIALIZED_LEGACY);
1912 
1913 	/*
1914 	 * We assume that all of the ioctls are headed to the
1915 	 * conskbd_regqueue if it is open.  We are intercepting a few ioctls
1916 	 * that we know belong to conskbd_consqueue, and sending them there.
1917 	 * Any other, new ioctls that have to be routed to conskbd_consqueue
1918 	 * should be added to this list.
1919 	 */
1920 	iocp = (struct iocblk *)mp->b_rptr;
1921 
1922 	if ((iocp->ioc_cmd == CONSOPENPOLLEDIO) ||
1923 			(iocp->ioc_cmd == CONSCLOSEPOLLEDIO)) {
1924 
1925 		DPRINTF(PRINT_L1, PRINT_MASK_ALL,
1926 			("conskbd_legacy_upstream_msg: "
1927 			"CONSOPEN/CLOSEPOLLEDIO ACK/NAK\n"));
1928 		putnext(conskbd_consqueue, mp);
1929 
1930 	} else if (conskbd_regqueue != NULL) {
1931 		DPRINTF(PRINT_L1, PRINT_MASK_ALL,
1932 		    ("conskbd_legacy_upstream_msg: conskbd_regqueue != NULL"));
1933 
1934 		putnext(conskbd_regqueue, mp);
1935 
1936 	} else if (conskbd_consqueue != NULL) {
1937 		DPRINTF(PRINT_L1, PRINT_MASK_ALL,
1938 		    ("conskbd_legacy_upstream_msg: conskbd_consqueue != NULL"));
1939 		putnext(conskbd_consqueue, mp);
1940 	} else {
1941 		/* if reached here, it must be a error */
1942 		cmn_err(CE_WARN,
1943 		    "kb:  no destination for IOCACK/IOCNAK!");
1944 		freemsg(mp);
1945 	}
1946 
1947 }	/* conskbd_legacy_upstream_msg() */
1948 
1949 /*
1950  * This routine is a callback routine for kbtrans module to set LED.
1951  * Kbtrans will invoke it in two cases:
1952  *
1953  * 1) application initiated request
1954  * 	A KIOCSLED ioctl is sent by an application. The ioctl will be
1955  * 	be prcoessed by queue service procedure conskbduwsrv(), which
1956  * 	in turn calls kbtrans to process the ioctl. Then kbtrans invokes
1957  * 	conskbd_streams_setled() to set LED, after that,  kbtrans will
1958  * 	return an ACK message to upper module.
1959  *
1960  * 2) Kbtrans initiated the request
1961  *	When conskbd works in TR_ASCII translation mode, if anyone of
1962  *	CapsLock, NumberLock and Compose keys is pressed, kbtrans need
1963  *	to set LED. In this case, there is no ioctl from upper module.
1964  *	There is no requirement to send response to somebody.
1965  *
1966  * In first case, kbtrans will send response to upper module; and in the
1967  * second, we don't need to send response. So conskbd_streams_setled()
1968  * has no return value.
1969  */
1970 static void
1971 conskbd_streams_setled(struct kbtrans_hardware *hw, int led_state)
1972 {
1973 	conskbd_state_t  *conskbdp = (conskbd_state_t *)hw;
1974 	conskbd_lower_queue_t *lqs;
1975 	mblk_t		*req;
1976 
1977 	ASSERT(&conskbd == conskbdp);
1978 
1979 	if (led_state == -1)
1980 		return;
1981 
1982 	conskbdp->conskbd_led_state = led_state;
1983 
1984 	/*
1985 	 * Basically, failing to set LED is not a fatal error, we just skip
1986 	 * it if this happens.
1987 	 */
1988 	for (lqs = conskbdp->conskbd_lqueue_list; lqs; lqs = lqs->lqs_next) {
1989 		req = mkiocb(KIOCSLED);
1990 
1991 		if (!req) {
1992 			continue;
1993 		}
1994 
1995 		req->b_cont = allocb(sizeof (uchar_t), BPRI_MED);
1996 		if (!req->b_cont) {
1997 			freemsg(req);
1998 			continue;
1999 		}
2000 		*(uchar_t *)req->b_cont->b_wptr = led_state;
2001 		req->b_cont->b_wptr += sizeof (uchar_t);
2002 		if (putq(lqs->lqs_queue, req) != 1)
2003 			freemsg(req);
2004 	}
2005 
2006 }	/* conskbd_streams_setled() */
2007 
2008 static void
2009 conskbd_polledio_setled(struct kbtrans_hardware *hw, int led_state)
2010 {
2011 	conskbd_state_t  *conskbdp = (conskbd_state_t *)hw;
2012 	struct cons_polledio		*cb;
2013 	conskbd_lower_queue_t	*lqs;
2014 
2015 	for (lqs = conskbdp->conskbd_lqueue_list; lqs; lqs = lqs->lqs_next) {
2016 		cb = lqs->lqs_polledio;
2017 		if ((cb != NULL) && (cb->cons_polledio_setled != NULL)) {
2018 			cb->cons_polledio_setled(cb->cons_polledio_argument,
2019 			    led_state);
2020 		}
2021 	}
2022 
2023 }	/* conskbd_polledio_setled() */
2024 
2025 static boolean_t
2026 conskbd_polled_keycheck(struct kbtrans_hardware *hw,
2027 		kbtrans_key_t *keycode, enum keystate *state)
2028 {
2029 	conskbd_state_t  *conskbdp = (conskbd_state_t *)hw;
2030 	struct cons_polledio 		*cb;
2031 	conskbd_lower_queue_t	*lqs;
2032 	boolean_t	ret = B_FALSE;
2033 
2034 	for (ret = B_FALSE, lqs = conskbdp->conskbd_lqueue_list; lqs != NULL;
2035 	    lqs = lqs->lqs_next) {
2036 		cb = lqs->lqs_polledio;
2037 		if ((cb != NULL) &&
2038 		    (cb->cons_polledio_keycheck != NULL)) {
2039 			ret = cb->cons_polledio_keycheck(
2040 			    cb->cons_polledio_argument, keycode, state);
2041 		}
2042 
2043 		/* Get a char from lower queue(hardware) ? */
2044 		if (ret == B_TRUE) {
2045 
2046 			/* A legacy keyboard ? */
2047 			if (conskbd.conskbd_bypassed == B_TRUE)
2048 				break;
2049 
2050 			/*
2051 			 * This is the PS2 scancode 0x2B -> USB(49) /
2052 			 * USB(50) keycode mapping workaround, for
2053 			 * polled mode.
2054 			 *
2055 			 * There are two possible USB keycode mappings
2056 			 * for PS2 scancode 0x2B and this workaround
2057 			 * makes sure that we use the USB keycode that
2058 			 * does not end up being mapped to a HOLE key
2059 			 * using the current keyboard translation
2060 			 * tables.
2061 			 *
2062 			 * See conskbdlrput() for a detailed
2063 			 * explanation of the problem.
2064 			 */
2065 			if (*keycode == 49 || *keycode == 50) {
2066 				if (conskbd_keyindex->k_normal[50] == HOLE)
2067 					*keycode = 49;
2068 				else
2069 					*keycode = 50;
2070 			}
2071 
2072 			break;
2073 		}
2074 	}
2075 
2076 	return (ret);
2077 
2078 }	/* conskbd_polled_keycheck() */
2079 
2080 static boolean_t
2081 conskbd_override_kbtrans(queue_t *q, mblk_t *mp)
2082 {
2083 	struct iocblk		*iocp;
2084 	int		directio;
2085 	int		error;
2086 
2087 	if (mp->b_datap->db_type != M_IOCTL)
2088 		return (B_FALSE);
2089 
2090 	iocp = (struct iocblk *)mp->b_rptr;
2091 
2092 	switch (iocp->ioc_cmd) {
2093 	case KIOCGDIRECT: {
2094 		/*
2095 		 * Don't let the kbtrans-based code see this; it will
2096 		 * respond incorrectly.
2097 		 */
2098 		register mblk_t *datap;
2099 
2100 		if ((datap = allocb((int)sizeof (int), BPRI_MED)) == NULL) {
2101 			miocnak(q, mp, 0, ENOMEM);
2102 			return (B_TRUE);
2103 		}
2104 
2105 		*(int *)datap->b_wptr = conskbd.conskbd_directio;
2106 		datap->b_wptr += sizeof (int);
2107 		if (mp->b_cont) {
2108 			freemsg(mp->b_cont);
2109 			mp->b_cont = NULL;
2110 		}
2111 		mp->b_cont = datap;
2112 		miocack(q, mp, sizeof (int), 0);
2113 		return (B_TRUE);
2114 	}
2115 
2116 	case KIOCSDIRECT:
2117 		/*
2118 		 * Peek at this, set our variables, and then let the kbtrans
2119 		 * based code see it and respond to it.
2120 		 */
2121 		error = miocpullup(mp, sizeof (int));
2122 		if (error != 0) {
2123 			return (B_FALSE);
2124 		}
2125 
2126 		directio = *(int *)mp->b_cont->b_rptr;
2127 		if (directio != 0 && directio != 1) {
2128 			miocnak(q, mp, 0, EINVAL);
2129 			return (B_TRUE);
2130 		}
2131 		conskbd.conskbd_directio = directio;
2132 
2133 		if (conskbd.conskbd_directio) {
2134 			kbtrans_streams_set_queue(
2135 			    conskbd.conskbd_kbtrans, conskbd_regqueue);
2136 		} else {
2137 			kbtrans_streams_set_queue(
2138 			    conskbd.conskbd_kbtrans, conskbd_consqueue);
2139 		}
2140 
2141 		/*
2142 		 * Let the kbtrans-based code see this and respond to it.
2143 		 */
2144 		return (B_FALSE);
2145 
2146 	default:
2147 		return (B_FALSE);
2148 	}
2149 
2150 }	/* conskbd_override_kbtrans() */
2151 
2152 
2153 static void
2154 conskbd_polledio_enter(struct cons_polledio_arg *arg)
2155 {
2156 	conskbd_state_t		*conskbdp;
2157 	struct cons_polledio		*cb;
2158 	conskbd_lower_queue_t	*lqs;
2159 
2160 	conskbdp = (conskbd_state_t *)arg;
2161 	for (lqs = conskbdp->conskbd_lqueue_list; lqs; lqs = lqs->lqs_next) {
2162 		cb = lqs->lqs_polledio;
2163 		if ((cb != NULL) && (cb->cons_polledio_enter != NULL)) {
2164 			cb->cons_polledio_enter(cb->cons_polledio_argument);
2165 		}
2166 	}
2167 
2168 }	/* conskbd_polledio_enter() */
2169 
2170 static void
2171 conskbd_polledio_exit(struct cons_polledio_arg *arg)
2172 {
2173 	conskbd_state_t		*conskbdp;
2174 	struct cons_polledio		*cb;
2175 	conskbd_lower_queue_t	*lqs;
2176 
2177 	conskbdp = (conskbd_state_t *)arg;
2178 	for (lqs = conskbdp->conskbd_lqueue_list; lqs; lqs = lqs->lqs_next) {
2179 		cb = lqs->lqs_polledio;
2180 		if ((cb != NULL) && (cb->cons_polledio_exit != NULL)) {
2181 			cb->cons_polledio_exit(cb->cons_polledio_argument);
2182 		}
2183 	}
2184 
2185 }	/* conskbd_polledio_exit() */
2186 
2187 static int
2188 conskbd_polledio_getchar(struct cons_polledio_arg *arg)
2189 {
2190 	conskbd_state_t  *conskbdp;
2191 
2192 	conskbdp = (conskbd_state_t *)arg;
2193 
2194 	return (kbtrans_getchar(conskbdp->conskbd_kbtrans));
2195 
2196 }	/* conskbd_polledio_getchar() */
2197 
2198 static int
2199 conskbd_polledio_ischar(struct cons_polledio_arg *arg)
2200 {
2201 	conskbd_state_t  *conskbdp;
2202 
2203 	conskbdp = (conskbd_state_t *)arg;
2204 
2205 	return (kbtrans_ischar(conskbdp->conskbd_kbtrans));
2206 
2207 }	/* conskbd_polledio_ischar() */
2208 
2209 
2210 static void
2211 conskbd_mux_enqueue_msg(conskbd_pending_msg_t *msg)
2212 {
2213 	mutex_enter(&conskbd_msgq_lock);
2214 	msg->kpm_next = conskbd_msg_queue;
2215 	conskbd_msg_queue = msg;
2216 	mutex_exit(&conskbd_msgq_lock);
2217 
2218 }	/* conskbd_mux_enqueue_msg() */
2219 
2220 /*
2221  * the messages in conskbd_msg_queue we just enqueue
2222  */
2223 static conskbd_pending_msg_t *
2224 conskbd_mux_find_msg(mblk_t *mp)
2225 {
2226 	conskbd_pending_msg_t	*msg;
2227 	struct iocblk		*iocp;
2228 	uint_t	id;
2229 
2230 	mutex_enter(&conskbd_msgq_lock);
2231 	msg = conskbd_msg_queue;
2232 
2233 	iocp = (struct iocblk *)mp->b_rptr;
2234 	ASSERT(iocp);
2235 	id = iocp->ioc_id;
2236 	while (msg && msg->kpm_req_id != id) {
2237 		msg = msg->kpm_next;
2238 	}
2239 	mutex_exit(&conskbd_msgq_lock);
2240 
2241 	return (msg);
2242 
2243 }	/* conskbd_mux_find_msg() */
2244 
2245 
2246 static void
2247 conskbd_mux_dequeue_msg(conskbd_pending_msg_t *msg)
2248 {
2249 	conskbd_pending_msg_t *prev;
2250 	conskbd_pending_msg_t *p;
2251 
2252 	mutex_enter(&conskbd_msgq_lock);
2253 	prev = conskbd_msg_queue;
2254 
2255 	for (p = prev; p != msg; p = p->kpm_next)
2256 		prev = p;
2257 	ASSERT(p && p == msg);
2258 	if (prev == p) {
2259 		conskbd_msg_queue = msg->kpm_next;
2260 	} else {
2261 		prev->kpm_next = p->kpm_next;
2262 	}
2263 	p->kpm_next = NULL;
2264 	mutex_exit(&conskbd_msgq_lock);
2265 
2266 }	/* conskbd_mux_dequeue_msg() */
2267 
2268 #ifdef DEBUG
2269 /*ARGSUSED*/
2270 void
2271 conskbd_dprintf(const char *fmt, ...)
2272 {
2273 	char buf[256];
2274 	va_list ap;
2275 
2276 	va_start(ap, fmt);
2277 	(void) vsprintf(buf, fmt, ap);
2278 	va_end(ap);
2279 
2280 	cmn_err(CE_CONT, "conskbd: %s", buf);
2281 
2282 }	/* conskbd_dprintf() */
2283 #endif
2284