xref: /onnv/onnv-gate/usr/src/uts/common/io/conskbd.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */


/*
 * Console kbd multiplexor driver for Sun.
 * The console "zs" port is linked under us, with the "kbd" module pushed
 * on top of it.
 * Minor device 0 is what programs normally use.
 * Minor device 1 is used to feed predigested keystrokes to the "workstation
 * console" driver, which it is linked beneath.
 *
 *
 *     This module can support multiple keyboards to be used simultaneously.
 * and enable users to use at a time multiple keyboards connected to the
 * same system. All the keyboards are linked under conskbd, and act as a
 * keyboard with replicated keys.
 *
 *     The DIN keyboards of SUN, for exmple , type 3/4/5,  are supported via
 * a two-level architecure. The lower one is one of serialport drivers, such
 * as zs, se, and the upper is  "kb" STREAMS module. Currenly, the serialport
 * drivers don't support polled I/O interfaces, we couldn't group the keyboard
 * of this kind under conskbd. So we do as the follows:
 *
 *         A new ioctl CONSSETKBDTYPE interface between conskbd and lower
 *     keyboard drivers is added. When conskbd receives I_LINK or I_PLINK
 *     ioctl, it will send a CONSSETKBDTYPE ioctl to the driver which is
 *     requesting to be linked under conskbd. If the lower driver does't
 *     recognize this ioctl, the virtual keyboard will be disabled so that
 *     only one keyboard instance could be linked under conskbd.
 */
#define	KEYMAP_SIZE_VARIABLE

#include <sys/types.h>
#include <sys/param.h>
#include <sys/stropts.h>
#include <sys/stream.h>
#include <sys/strsubr.h>
#include <sys/strsun.h>
#include <sys/conf.h>
#include <sys/stat.h>
#include <sys/errno.h>
#include <sys/modctl.h>
#include <sys/kbio.h>
#include <sys/ddi.h>
#include <sys/sunddi.h>
#include <sys/consdev.h>
#include <sys/note.h>
#include <sys/kmem.h>
#include <sys/kstat.h>
#include <sys/policy.h>
#include <sys/kbd.h>
#include <sys/kbtrans.h>
#include <sys/promif.h>
#include <sys/vuid_event.h>
#include <sys/conskbd.h>
#include <sys/beep.h>

extern struct keyboard *kbtrans_usbkb_maptab_init(void);
extern void kbtrans_usbkb_maptab_fini(struct keyboard **);
extern int ddi_create_internal_pathname(dev_info_t *, char *, int, minor_t);

/*
 * Module linkage routines for the kernel
 */
static int conskbd_attach(dev_info_t *, ddi_attach_cmd_t);
static int conskbd_detach(dev_info_t *, ddi_detach_cmd_t);
static int conskbd_info(dev_info_t *, ddi_info_cmd_t, void *, void **);

/*
 * STREAMS queue processing procedures
 */
static void	conskbduwsrv(queue_t *);
static void	conskbdlwserv(queue_t *);
static void	conskbdlrput(queue_t *, mblk_t *);
static int	conskbdclose(queue_t *, int, cred_t *);
static int	conskbdopen(queue_t *, dev_t *, int, int, cred_t *);


/* STREAMS driver id and limit value struct */
static struct module_info conskbdm_info = {
	0,		/* mi_idnum */
	"conskbd",	/* mi_idname */
	0,		/* mi_minpsz */
	1024,		/* mi_maxpsz */
	2048,		/* mi_hiwat */
	128		/* mi_lowat */
};

/*
 * STREAMS queue processing procedure structures
 */
/* upper read queue processing procedure structures */
static struct qinit conskbdurinit = {
	NULL,			/* qi_putp */
	(int (*)())NULL,	/* qi_srvp */
	conskbdopen,		/* qi_qopen */
	conskbdclose,		/* qi_qclose */
	(int (*)())NULL,	/* qi_qadmin */
	&conskbdm_info,		/* qi_minfo */
	NULL			/* qi_mstat */
};

/* upper write queue processing procedures structuresi */
static struct qinit conskbduwinit = {
	(int (*)())putq,		/* qi_putp */
	(int (*)())conskbduwsrv,	/* qi_srvp */
	conskbdopen,			/* qi_qopen */
	conskbdclose,			/* qi_qclose */
	(int (*)())NULL,		/* qi_qadmin */
	&conskbdm_info,			/* qi_minfo */
	NULL				/* qi_mstat */
};

/* lower read queue processing procedures structures */
static struct qinit conskbdlrinit = {
	(int (*)())conskbdlrput,	/* qi_putp */
	(int (*)())NULL,		/* qi_srvp */
	(int (*)())NULL,		/* qi_qopen */
	(int (*)())NULL,		/* qi_qclose */
	(int (*)())NULL,		/* qi_qadmin */
	&conskbdm_info,			/* qi_minfo */
	NULL				/* qi_mstat */
};

/* lower write processing procedures structures */
static struct qinit conskbdlwinit = {
	putq,				/* qi_putp */
	(int (*)())conskbdlwserv,	/* qi_srvp */
	(int (*)())NULL,		/* qi_qopen */
	(int (*)())NULL,		/* qi_qclose */
	(int (*)())NULL,		/* qi_qadmin */
	&conskbdm_info,			/* qi_minfo */
	NULL				/* qi_mstat */
};

/* STREAMS entity declaration structure */
static struct streamtab conskbd_str_info = {
	&conskbdurinit,		/* st_rdinit */
	&conskbduwinit,		/* st_wrinit */
	&conskbdlrinit,		/* st_muxrinit */
	&conskbdlwinit,		/* st_muxwinit */
};


/* Entry points structure */
static 	struct cb_ops cb_conskbd_ops = {
	nulldev,		/* cb_open */
	nulldev,		/* cb_close */
	nodev,			/* cb_strategy */
	nodev,			/* cb_print */
	nodev,			/* cb_dump */
	nodev,			/* cb_read */
	nodev,			/* cb_write */
	nodev,			/* cb_ioctl */
	nodev,			/* cb_devmap */
	nodev,			/* cb_mmap */
	nodev,			/* cb_segmap */
	nochpoll,		/* cb_chpoll */
	ddi_prop_op,		/* cb_prop_op */
	&conskbd_str_info,	/* cb_stream */
	D_MP | D_MTOUTPERIM | D_MTOCEXCL	/* cb_flag */
};


/*
 * Device operations structure
 */
static struct dev_ops conskbd_ops = {
	DEVO_REV,		/* devo_rev */
	0,			/* devo_refcnt */
	conskbd_info,		/* devo_getinfo */
	nulldev,		/* devo_identify */
	nulldev,		/* devo_probe */
	conskbd_attach,		/* devo_attach */
	conskbd_detach,		/* devo_detach */
	nodev,			/* devo_reset */
	&(cb_conskbd_ops),	/* devo_cb_ops */
	(struct bus_ops *)NULL,	/* devo_bus_ops */
	NULL,			/* devo_power */
	ddi_quiesce_not_needed,		/* quiesce */
};

/*
 * Module linkage information for the kernel.
 */
static struct modldrv modldrv = {
	&mod_driverops, /* Type of module.  This one is a pseudo driver */
	"conskbd multiplexer driver",
	&conskbd_ops,	/* driver ops */
};

/*
 * Module linkage structure
 */
static struct modlinkage modlinkage = {
	MODREV_1,	/* ml_rev */
	&modldrv,	/* ml_linkage */
	NULL		/* NULL terminates the list */
};

/*
 * Debug printing
 */
#ifndef DPRINTF
#ifdef DEBUG
void	conskbd_dprintf(const char *fmt, ...);
#define	DPRINTF(l, m, args) \
	(((l) >= conskbd_errlevel) && ((m) & conskbd_errmask) ?	\
		conskbd_dprintf args :				\
		(void) 0)

/*
 * Severity levels for printing
 */
#define	PRINT_L0	0	/* print every message */
#define	PRINT_L1	1	/* debug */
#define	PRINT_L2	2	/* quiet */

/*
 * Masks
 */
#define	PRINT_MASK_ALL		0xFFFFFFFFU
uint_t	conskbd_errmask = PRINT_MASK_ALL;
uint_t	conskbd_errlevel = PRINT_L2;

#else
#define	DPRINTF(l, m, args)	/* NOTHING */
#endif
#endif

/*
 * Module global data are protected by outer perimeter. Modifying
 * these global data is executed in outer perimeter exclusively.
 * Except in conskbdopen() and conskbdclose(), which are entered
 * exclusively (Refer to D_MTOCEXCL flag), all changes for the
 * global variables are protected by qwriter().
 */
static	queue_t	*conskbd_regqueue; /* regular keyboard queue above us */
static	queue_t	*conskbd_consqueue; /* console queue above us */


static dev_info_t *conskbd_dip;		/* private copy of devinfo pointer */
static long	conskbd_idle_stamp;	/* seconds tstamp of latest keystroke */
static struct keyboard *conskbd_keyindex;

/*
 * Normally, kstats of type KSTAT_TYPE_NAMED have multiple elements.  In
 * this case we use this type for a single element because the ioctl code
 * for it knows how to handle mixed kernel/user data models.  Also, it
 * will be easier to add new statistics later.
 */
static struct {
	kstat_named_t idle_sec;		/* seconds since last keystroke */
} conskbd_kstat = {
	{ "idle_sec", KSTAT_DATA_LONG, }
};

/*
 * Local routines prototypes
 */
static int conskbd_kstat_update(kstat_t *, int);

static void conskbd_ioctl(queue_t *, mblk_t *);
static void conskbd_ioc_plink(queue_t *, mblk_t *);
static void conskbd_ioc_punlink(queue_t *, mblk_t *);
static void conskbd_legacy_kbd_ioctl(queue_t *, mblk_t *);
static void conskbd_virtual_kbd_ioctl(queue_t *, mblk_t *);
static mblk_t *conskbd_alloc_firm_event(ushort_t, int);

static conskbd_pending_msg_t *conskbd_mux_find_msg(mblk_t *);
static void conskbd_mux_enqueue_msg(conskbd_pending_msg_t *);
static void conskbd_mux_dequeue_msg(conskbd_pending_msg_t *);
static void conskbd_link_lowque_virt(queue_t *, mblk_t *);
static void conskbd_link_lowque_legacy(queue_t *, mblk_t *);

static void conskbd_handle_downstream_msg(queue_t *, mblk_t *);
static void conskbd_kioctype_complete(conskbd_lower_queue_t *, mblk_t *);
static void conskbd_kioctrans_complete(conskbd_lower_queue_t *, mblk_t *);
static void conskbd_kioclayout_complete(conskbd_lower_queue_t *, mblk_t *);
static void conskbd_kiocsled_complete(conskbd_lower_queue_t *, mblk_t *);
static void conskbd_mux_upstream_msg(conskbd_lower_queue_t *, mblk_t *);
static void conskbd_legacy_upstream_msg(conskbd_lower_queue_t *, mblk_t *);
static void conskbd_lqs_ack_complete(conskbd_lower_queue_t *, mblk_t *);

static void conskbd_polledio_enter(cons_polledio_arg_t);
static void conskbd_polledio_exit(cons_polledio_arg_t);
static int  conskbd_polledio_ischar(cons_polledio_arg_t);
static int  conskbd_polledio_getchar(cons_polledio_arg_t);
static void conskbd_polledio_setled(struct kbtrans_hardware *, int);

static void conskbd_streams_setled(struct kbtrans_hardware *, int);
static boolean_t conskbd_override_kbtrans(queue_t *, mblk_t *);
static boolean_t
conskbd_polled_keycheck(struct kbtrans_hardware *,
		kbtrans_key_t *, enum keystate *);

/*
 * Callbacks needed by kbtrans
 */
static struct kbtrans_callbacks conskbd_callbacks = {
	conskbd_streams_setled,
	conskbd_polledio_setled,
	conskbd_polled_keycheck,
};

/*
 * Single private "global" lock for the few rare conditions
 * we want single-threaded.
 */
static	kmutex_t	conskbd_msgq_lock;
static	conskbd_pending_msg_t	*conskbd_msg_queue;

/*
 * The software state structure of virtual keyboard.
 * Currently, only one virtual keyboard is supported.
 */
static conskbd_state_t	conskbd = { 0 };

/* This variable backs up the layout state for non-self-ID keyboards */
static int kbd_layout_bak = 0;

/*
 * _init()
 *
 * Description:
 *      Driver initialization, called when driver is first loaded.
 *      This is how access is initially given to all the static structures.
 *
 * Arguments:
 *      None
 *
 * Returns:
 *      ddi_soft_state_init() status, see ddi_soft_state_init(9f), or
 *      mod_install() status, see mod_install(9f)
 */
int
_init(void)
{
	int	error;

	error = mod_install(&modlinkage);
	if (error != 0) {
		return (error);
	}

	conskbd_keyindex = kbtrans_usbkb_maptab_init();

	mutex_init(&conskbd_msgq_lock, NULL, MUTEX_DRIVER, NULL);

	return (error);

}	/* _init() */

/*
 * _fini()
 *
 * Description:
 *      Module de-initialization, called when the driver is to be unloaded.
 *
 * Arguments:
 *      None
 *
 * Returns:
 *      mod_remove() status, see mod_remove(9f)
 */
int
_fini(void)
{
	int	error;

	error = mod_remove(&modlinkage);
	if (error != 0)
		return (error);
	mutex_destroy(&conskbd_msgq_lock);
	kbtrans_usbkb_maptab_fini(&conskbd_keyindex);

	return (0);

}	/* _fini() */

/*
 * _info()
 *
 * Description:
 *      Module information, returns information about the driver.
 *
 * Arguments:
 *      modinfo         *modinfop       Pointer to the opaque modinfo structure
 *
 * Returns:
 *      mod_info() status, see mod_info(9f)
 */
int
_info(struct modinfo *modinfop)
{
	return (mod_info(&modlinkage, modinfop));

}	/* _info() */


/*
 * conskbd_attach()
 *
 * Description:
 * 	This routine creates two device nodes. One is the "kbd" node, which
 * is used by user application programs(such as Xserver).The other is the
 * "conskbd" node, which is an internal node. consconfig_dacf module will
 * open this internal node, and link the conskbd under the wc (workstaion
 * console).
 *
 * Arguments:
 *      dev_info_t      *dip    Pointer to the device's dev_info struct
 *      ddi_attach_cmd_t cmd    Attach command
 *
 * Returns:
 *      DDI_SUCCESS             The driver was initialized properly
 *      DDI_FAILURE             The driver couldn't be initialized properly
 */
/*ARGSUSED*/
static int
conskbd_attach(dev_info_t *devi, ddi_attach_cmd_t cmd)
{
	kstat_t	*ksp;

	switch (cmd) {
	case DDI_ATTACH:
		break;

	default:
		return (DDI_FAILURE);

	}
	if ((ddi_create_minor_node(devi, "kbd", S_IFCHR,
	    0, DDI_PSEUDO, NULL) == DDI_FAILURE) ||
	    (ddi_create_internal_pathname(devi, "conskbd", S_IFCHR,
	    1) == DDI_FAILURE)) {
		ddi_remove_minor_node(devi, NULL);
		return (DDI_FAILURE);
	}
	conskbd_dip = devi;

	ksp = kstat_create("conskbd", 0, "activity", "misc", KSTAT_TYPE_NAMED,
	    sizeof (conskbd_kstat) / sizeof (kstat_named_t),
	    KSTAT_FLAG_VIRTUAL);
	if (ksp) {
		ksp->ks_data = (void *) &conskbd_kstat;
		ksp->ks_update = conskbd_kstat_update;
		kstat_install(ksp);
		conskbd_idle_stamp = gethrestime_sec();	/* initial value */
	}

	conskbd.conskbd_layout = -1;	/* invalid layout */
	conskbd.conskbd_led_state = -1;
	conskbd.conskbd_bypassed = B_FALSE;

	return (DDI_SUCCESS);

}	/* conskbd_attach() */

/*
 * conskbd_detach()
 *
 * Description:
 *      Detach an instance of the conskbd driver. In fact, the driver can not
 * be detached.
 *
 * Arguments:
 *      dev_info_t              *dip    Pointer to the device's dev_info struct
 *      ddi_detach_cmd_t        cmd     Detach command
 *
 * Returns:
 *      DDI_SUCCESS     The driver was detached
 *      DDI_FAILURE     The driver couldn't be detached
 */
/*ARGSUSED*/
static int
conskbd_detach(dev_info_t *devi, ddi_detach_cmd_t cmd)
{
	return (DDI_FAILURE);

}	/* conskbd_detach() */

/* ARGSUSED */
static int
conskbd_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg,
	void **result)
{
	register int error;

	switch (infocmd) {
	case DDI_INFO_DEVT2DEVINFO:
		if (conskbd_dip == NULL) {
			error = DDI_FAILURE;
		} else {
			*result = (void *) conskbd_dip;
			error = DDI_SUCCESS;
		}
		break;
	case DDI_INFO_DEVT2INSTANCE:
		*result = (void *)0;
		error = DDI_SUCCESS;
		break;
	default:
		error = DDI_FAILURE;
	}
	return (error);

}	/* conskbd_info() */

/*ARGSUSED*/
static int
conskbdopen(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *crp)
{
	dev_t	unit;
	int	err;

	unit = getminor(*devp);

	if (unit == 0) {
		/*
		 * Opening "/dev/kbd".
		 */
		conskbd_regqueue = q;
		qprocson(q);
		return (0);
	} else if (unit != 1) {
		/* we don't do that under Bozo's Big Tent */
		return (ENODEV);
	}

	/*
	 * Check if already initialized
	 */
	if (conskbd_consqueue != NULL)
		return (0);

	/*
	 * Opening the device to be linked under the console.
	 */
	conskbd_consqueue = q;

	/*
	 * initialize kbtrans module for conskbd
	 */
	err = kbtrans_streams_init(q, sflag, crp, (struct kbtrans_hardware *)
	    &conskbd, &conskbd_callbacks, &conskbd.conskbd_kbtrans, 0, 0);
	if (err != 0)
		return (err);
	kbtrans_streams_set_keyboard(conskbd.conskbd_kbtrans, KB_USB,
	    conskbd_keyindex);

	conskbd.conskbd_polledio.cons_polledio_version = CONSPOLLEDIO_V1;
	conskbd.conskbd_polledio.cons_polledio_argument =
	    (cons_polledio_arg_t)&conskbd;
	conskbd.conskbd_polledio.cons_polledio_putchar = NULL;
	conskbd.conskbd_polledio.cons_polledio_getchar =
	    (int (*)(cons_polledio_arg_t)) conskbd_polledio_getchar;
	conskbd.conskbd_polledio.cons_polledio_ischar =
	    (boolean_t (*)(cons_polledio_arg_t))conskbd_polledio_ischar;
	conskbd.conskbd_polledio.cons_polledio_enter = conskbd_polledio_enter;
	conskbd.conskbd_polledio.cons_polledio_exit = conskbd_polledio_exit;
	qprocson(q);

	return (0);

}	/* conskbdopen() */


/*ARGSUSED*/
static int
conskbdclose(queue_t *q, int flag, cred_t *crp)
{
	if (q == conskbd_regqueue) {

		conskbd_pending_msg_t	*pmsg, *prev, *next;
		mblk_t		*mp;

		/* switch the input stream back to conskbd_consqueue */
		conskbd.conskbd_directio = B_FALSE;

		kbtrans_streams_untimeout(conskbd.conskbd_kbtrans);
		kbtrans_streams_set_queue(conskbd.conskbd_kbtrans,
		    conskbd_consqueue);
		qprocsoff(q);
		conskbd_regqueue = NULL;

		/*
		 * If there are any pending ioctls which conskbd hasn't
		 * responded to yet, remove them from conskbd_msg_queue.
		 * Otherwise, we might send the response to a nonexistent
		 * closed queue. Refer to: conskbd_mux_upstream_msg().
		 */
		for (prev = NULL, pmsg = conskbd_msg_queue; pmsg != NULL;
		    pmsg = next) {
			next = pmsg->kpm_next;
			if (pmsg->kpm_upper_queue == WR(q)) {
				if (prev == NULL)
					conskbd_msg_queue = next;
				else
					prev->kpm_next = next;

				while (pmsg->kpm_resp_list != NULL) {
					mp = pmsg->kpm_resp_list;
					pmsg->kpm_resp_list = mp->b_next;
					mp->b_next = mp->b_prev = NULL;
					freemsg(mp);
				}
				mutex_destroy(&pmsg->kpm_lock);
				kmem_free(pmsg, sizeof (*pmsg));
			} else {
				prev = pmsg;
			}
		}
	} else if (q == conskbd_consqueue) {
		/*
		 * Well, this is probably a mistake, but we will permit you
		 * to close the path to the console if you really insist.
		 */
		qprocsoff(q);
		conskbd_consqueue = NULL;
	}

	return (0);

}	/* conskbdclose() */

/*
 * Service procedure for upper write queue.
 *	To make sure the order of messages, we don't process any
 * message in qi_putq() routine of upper write queue, instead the
 * qi_putq() routine, which is a standard putq() routine, puts all
 * messages into a queue, and lets the following service procedure
 * deal with all messages.
 * 	This routine is invoked when ioctl commands are send down
 * by a consumer of the keyboard device, eg, when the keyboard
 * consumer tries to determine the keyboard layout type, or sets
 * the led states.
 */
static void
conskbduwsrv(queue_t *q)
{
	mblk_t	*mp;
	queue_t	*oldq;
	enum kbtrans_message_response ret;
	struct copyresp *csp;
	struct freq_request *frqp;
	int error;

	while ((mp = getq(q)) != NULL) {

		/*
		 * if the virtual keyboard is supported
		 */
		if (conskbd.conskbd_bypassed == B_FALSE) {

			if (conskbd_override_kbtrans(q, mp) == B_TRUE)
				continue;
			/*
			 * The conskbd driver is a psaudo driver. It has two
			 * devcice nodes, one is used by kernel, and the other
			 * is used by end-users. There are two STREAMS queues
			 * corresponding to the two device nodes, console queue
			 * and regular queue.
			 * In conskbd_override_kbtrans() routine, when receives
			 * KIOCSDIRECT ioctl, we need change the direction of
			 * keyboard input messages, and direct the input stream
			 * from keyboard into right queue. It causes this queue
			 * to be switched between regular queue and console
			 * queue. And here, in this routine, the in-parameter
			 * "q" can be any one of the two. Moreover, this module
			 * is executed in multithreaded environment, even if the
			 * q is switched to regular queue, it is possible that
			 * the in-parameter is still the console queue, and we
			 * need to return response to right queue.
			 * The response is sent to upstream by the kbtrans
			 * module. so we need to save the old queue, and wait
			 * kbtrans to proces message and to send response out,
			 * and then switch back to old queue.
			 */
			oldq = kbtrans_streams_get_queue(
			    conskbd.conskbd_kbtrans);
			kbtrans_streams_set_queue(
			    conskbd.conskbd_kbtrans, RD(q));
			ret = kbtrans_streams_message(
			    conskbd.conskbd_kbtrans, mp);
			kbtrans_streams_set_queue(
			    conskbd.conskbd_kbtrans, oldq);

			switch (ret) {
				case KBTRANS_MESSAGE_HANDLED:
					continue;
				case KBTRANS_MESSAGE_NOT_HANDLED:
					break;
			}
		}

		switch (mp->b_datap->db_type) {

		case M_IOCTL:
			conskbd_ioctl(q, mp);
			break;

		case M_FLUSH:
			if (*mp->b_rptr & FLUSHW) {
				flushq(q, FLUSHDATA);
			}
			/*
			 * here, if flush read queue, some key-up messages
			 * may be lost so that upper module or applications
			 * treat corresponding keys as being held down for
			 * ever.
			 */
			freemsg(mp);
			break;

		case M_DATA:
			/*
			 * virtual keyboard doesn't support this interface.
			 * only when it is disabled, we pass the message
			 * down to lower queue.
			 */
			if ((conskbd.conskbd_bypassed) &&
			    (conskbd.conskbd_lqueue_nums > 0)) {
				if (putq(conskbd.conskbd_lqueue_list->
				    lqs_queue, mp) != 1)
					freemsg(mp);
			} else {
				freemsg(mp);
			}
			break;

		case M_IOCDATA:
			/*
			 * Only deal with copyresp to KIOCSETFREQ
			 * transparent ioctl now
			 */
			csp = (struct copyresp *)mp->b_rptr;
			if (csp->cp_rval) {
				miocnak(q, mp, 0, EINVAL);
				break;
			}

			error = 0;
			switch (csp->cp_cmd) {
			case KIOCSETFREQ:
				frqp = (struct freq_request *)mp->
				    b_cont->b_rptr;

				switch (frqp->type) {
				case CONSOLE_BEEP:
					error = beeper_freq(BEEP_CONSOLE,
					    (int)frqp->freq);
						break;

				case KBD_BEEP:
					error = beeper_freq(BEEP_TYPE4,
					    (int)frqp->freq);
						break;

				default:
					error = 1;
				} /* frqp->type */

				break;

			default:
				error = 1;
			} /* csp->cp_cmd */

			if (error == 0)
				miocack(q, mp, 0, 0);
			else
				miocnak(q, mp, 0, EINVAL);

			break;

		default:
			/*
			 * Pass an error message up.
			 */
			mp->b_datap->db_type = M_ERROR;
			if (mp->b_cont) {
				freemsg(mp->b_cont);
				mp->b_cont = NULL;
			}
			mp->b_rptr = mp->b_datap->db_base;
			mp->b_wptr = mp->b_rptr + sizeof (char);
			*mp->b_rptr = EINVAL;
			qreply(q, mp);
		}
	}	/* end of while */

}	/* conskbduwsrv() */

static void
conskbd_ioctl(queue_t *q, mblk_t *mp)
{
	struct	iocblk			*iocp;
	int	error = 0;

	iocp = (struct iocblk *)mp->b_rptr;

	switch (iocp->ioc_cmd) {

	case I_LINK:
	case I_PLINK:
		if (conskbd.conskbd_bypassed == B_TRUE) {
		/*
		 * A legacy keyboard can NOT be connected to conskbd together
		 * with other keyboards. So when a legacy keyboard is already
		 * linked under conkbd, we just reject all others.
		 */
			miocnak(q, mp, 0, EAGAIN);
			break;
		}
		qwriter(q, mp, conskbd_ioc_plink, PERIM_OUTER);
		break;

	case I_UNLINK:
	case I_PUNLINK:
		qwriter(q, mp, conskbd_ioc_punlink, PERIM_OUTER);
		break;

	case KIOCSKABORTEN:
		/*
		 * Check if privileged
		 */
		if ((error = secpolicy_sys_config(iocp->ioc_cr, B_FALSE))) {
			miocnak(q, mp, 0, error);
			return;
		}

		error = miocpullup(mp, sizeof (int));
		if (error != 0) {
			miocnak(q, mp, 0, error);
			return;
		}

		abort_enable = *(int *)mp->b_cont->b_rptr;
		miocack(q, mp, 0, 0);
		break;

	case KIOCSETFREQ:
		if (iocp->ioc_count != TRANSPARENT) {
			/*
			 * We don't support non-transparent ioctls,
			 * i.e. I_STR ioctls
			 */
			miocnak(q, mp, 0, EINVAL);
		} else {
			/* Transparent ioctl */
			mcopyin(mp, NULL, sizeof (struct freq_request), NULL);
			qreply(q, mp);
		}
		break;

	default:
		if (conskbd.conskbd_bypassed == B_TRUE) {
			conskbd_legacy_kbd_ioctl(q, mp);
		} else {
			conskbd_virtual_kbd_ioctl(q, mp);
		}
	}

}	/* conskbd_ioctl() */


static void
conskbd_virtual_kbd_ioctl(queue_t *q, mblk_t *mp)
{
	struct iocblk		*iocp;
	mblk_t			*datap;
	int			cmd;
	int			error = 0;

	iocp = (struct iocblk *)mp->b_rptr;

	switch (iocp->ioc_cmd) {
	case KIOCLAYOUT:
		if ((datap = allocb(sizeof (int), BPRI_HI)) == NULL) {
			miocnak(q, mp, 0, ENOMEM);
			break;
		}

		if (conskbd.conskbd_layout == -1)
			*(int *)datap->b_wptr = KBTRANS_USBKB_DEFAULT_LAYOUT;
		else
			*(int *)datap->b_wptr = conskbd.conskbd_layout;

		datap->b_wptr += sizeof (int);
		if (mp->b_cont)
			freemsg(mp->b_cont);
		mp->b_cont = datap;
		miocack(q, mp, sizeof (int), 0);
		break;

	case KIOCSLAYOUT:
		if (iocp->ioc_count != TRANSPARENT) {
			miocnak(q, mp, 0, EINVAL);
			break;
		}
		kbd_layout_bak = conskbd.conskbd_layout;
		conskbd.conskbd_layout = *(intptr_t *)(mp->b_cont->b_rptr);
		if (conskbd.conskbd_layout != kbd_layout_bak) {

			/* notify the upper of the change event */
			if ((datap = conskbd_alloc_firm_event(
			    KEYBOARD_LAYOUT_CHANGE,
			    conskbd.conskbd_layout)) != NULL) {
				if (conskbd.conskbd_directio) {
					putnext(conskbd_regqueue, datap);
				} else {
					freemsg(datap);
				}
			}
		}
		miocack(q, mp, 0, 0);
		break;

	case CONSOPENPOLLEDIO:
		error = miocpullup(mp, sizeof (struct cons_polledio *));
		if (error != 0) {
			miocnak(q, mp, 0, error);
			break;
		}
		if (conskbd.conskbd_lqueue_list == NULL) {
			miocnak(q, mp, 0, EINVAL);
			break;
		}
		conskbd_handle_downstream_msg(q, mp);
		break;

	case CONSCLOSEPOLLEDIO:
		if (conskbd.conskbd_lqueue_list == NULL) {
			miocnak(q, mp, 0, EINVAL);
			break;
		}
		conskbd_handle_downstream_msg(q, mp);
		break;

	case CONSSETABORTENABLE:
		/*
		 * To enable combined STOP-A(or F1-A) to trap into kmdb,
		 * the lower physical keyboard drivers are always told not
		 * to parse abort sequence(refer to consconfig_dacf module).
		 * Instead, lower drivers always send all keydown & keyup
		 * messages up to conskbd, so that when key STOP(or F1) is
		 * pressed on one keyboard and key A is pressed on another
		 * keyboard, the system could trap into kmdb.
		 *
		 * When we by kbtrans_streams_message() invoked kbtrans to
		 * handle ioctls in conskbduwsrv() routine, kbtrans module
		 * already handle the message though it returned to us a
		 * KBTRANS_MESSAGE_NOT_HANDLED. For virtual keyboard, no
		 * special initialization or un-initialization is needed.
		 * So we just return ACK to upper module.
		 */
		miocack(q, mp, 0, 0);
		break;

	case KIOCCMD:
	case KIOCMKTONE:
		if (conskbd.conskbd_lqueue_list == NULL ||
		    mp->b_cont == NULL) {
			miocnak(q, mp, 0, EINVAL);
			break;
		}
		cmd = *(int *)mp->b_cont->b_rptr;
		if (cmd == KBD_CMD_GETLAYOUT) {
			freemsg(mp->b_cont);
			datap = allocb(sizeof (int), BPRI_HI);
			if (datap == NULL) {
				miocnak(q, mp, 0, ENOMEM);
				return;
			}
			if (conskbd.conskbd_layout == -1)
				*(int *)datap->b_wptr =
				    KBTRANS_USBKB_DEFAULT_LAYOUT;
			else
				*(int *)datap->b_wptr = conskbd.conskbd_layout;

			mp->b_cont = datap;
			miocack(q, mp, sizeof (int), 0);
			return;
		}
		conskbd_handle_downstream_msg(q, mp);
		break;

	default:
		miocnak(q, mp, 0, EINVAL);
		break;
	}

}	/* conskbd_virtual_kbd_ioctl() */

static void
conskbd_legacy_kbd_ioctl(queue_t *q, mblk_t *mp)
{
	conskbd_lower_queue_t	*lq;
	struct	iocblk		*iocp;
	int	error = 0;

	iocp = (struct iocblk *)mp->b_rptr;

	ASSERT(conskbd.conskbd_lqueue_nums == 1);
	switch (iocp->ioc_cmd) {

	case KIOCGDIRECT: {
		mblk_t *datap;

		if ((datap = allocb(sizeof (int), BPRI_MED)) == NULL) {
			miocnak(q, mp, 0, ENOMEM);
			break;
		}

		*(int *)datap->b_wptr = conskbd.conskbd_directio;
		datap->b_wptr += sizeof (int);
		if (mp->b_cont != NULL) {
			freemsg(mp->b_cont);
			mp->b_cont = NULL;
		}
		mp->b_cont = datap;
		miocack(q, mp, sizeof (int), 0);
		break;
	}

	case KIOCSDIRECT:
		error = miocpullup(mp, sizeof (int));
		if (error != 0) {
			miocnak(q, mp, 0, error);
			break;
		}
		conskbd.conskbd_directio = *(int *)mp->b_cont->b_rptr;

		/*
		 * Pass this through, if there's something to pass
		 * it through to, so the system keyboard can reset
		 * itself.
		 */
		if (conskbd.conskbd_lqueue_nums > 0) {
			lq = conskbd.conskbd_lqueue_list;
			ASSERT(lq && lq->lqs_next == NULL);
			if (putq(lq->lqs_queue, mp) != 1) {
				miocnak(q, mp, 0, ENOMEM);
				return;
			}
			break;
		}

		miocack(q, mp, 0, 0);
		break;

	default:
		/*
		 * Pass this through, if there's something to pass it
		 * through to; otherwise, reject it.
		 */
		if (conskbd.conskbd_lqueue_nums > 0) {
			lq = conskbd.conskbd_lqueue_list;
			ASSERT(lq && lq->lqs_next == NULL);
			if (putq(lq->lqs_queue, mp) != 1) {
				miocnak(q, mp, 0, ENOMEM);
				return;
			}
			break;
		}

		/* nobody below us; reject it */
		miocnak(q, mp, 0, EINVAL);
		break;
	}

}	/* conskbd_legacy_kbd_ioctl() */


/*
 * Service procedure for lower write queue.
 * Puts things on the queue below us, if it lets us.
 */
static void
conskbdlwserv(queue_t *q)
{
	register mblk_t *mp;

	while (canput(q->q_next) && (mp = getq(q)) != NULL)
		putnext(q, mp);

}	/* conskbdlwserv() */

/*
 * Put procedure for lower read queue.
 * Pass everything up to minor device 0 if "directio" set, otherwise to minor
 * device 1.
 */
static void
conskbdlrput(queue_t *q, mblk_t *mp)
{
	conskbd_lower_queue_t	*lqs;
	struct iocblk 	*iocp;
	Firm_event	*fe;

	DPRINTF(PRINT_L1, PRINT_MASK_ALL, ("conskbdlrput\n"));

	switch (mp->b_datap->db_type) {

	case M_FLUSH:
		if (*mp->b_rptr == FLUSHR) {
			flushq(q, FLUSHDATA);	/* XXX doesn't flush M_DELAY */
			*mp->b_rptr &= ~FLUSHR;	/* it has been flushed */
		}
		if (*mp->b_rptr == FLUSHW) {
			flushq(WR(q), FLUSHDATA);
			qreply(q, mp);	/* give the read queues a crack at it */
		} else
			freemsg(mp);
		break;

	case M_DATA:
		if (conskbd.conskbd_bypassed == B_FALSE) {

			fe = (Firm_event *)mp->b_rptr;

			/*
			 * This is a workaround.
			 *
			 * According to HID specification, there are the
			 * following keycode mapping between PS2 and USB,
			 *
			 *	PS2 AT-101 keycode(29)  --->    USB(49)
			 *	PS2 AT-102 keycode(42)  --->    USB(50)
			 *
			 * However, the two keys, AT-101(29) and AT-102(42),
			 * have the same scancode,0x2B, in PS2 scancode SET1
			 * which we are using. The Kb8042 driver always
			 * recognizes the two keys as PS2(29) so that we could
			 * not know which is being pressed or released when we
			 * receive scancode 0x2B. Fortunately, the two keys can
			 * not co-exist in a specific layout. In other words,
			 * in the table of keycode-to-symbol mapping, either
			 * entry 49 or 50 is a hole. So, if we're processing a
			 * keycode 49, we look at the entry for 49.  If it's
			 * HOLE, remap the key to 50; If we're processing a 50,
			 * look at the entry for 50.  If it's HOLE, we remap
			 * the key to 49.
			 */
			if (fe->id == 49 || fe->id == 50) {
				if (conskbd_keyindex->k_normal[50] == HOLE)
					fe->id = 49;
				else
					fe->id = 50;
			}

			/*
			 * Remember key state of each key of lower physical
			 * keyboard. When a keyboard is umplumbed from conskbd,
			 * we will check all key states. By then,  we will fake
			 * a KEY_RELEASED message for each key in KEY_PRESSED
			 * state. Otherwise, upper module will treat these keys
			 * as held-down for ever.
			 */
			iocp = (struct iocblk *)mp->b_rptr;
			lqs = (conskbd_lower_queue_t *)q->q_ptr;
			if (fe->value)
				lqs->lqs_key_state[fe->id] = KEY_PRESSED;
			else
				lqs->lqs_key_state[fe->id] = KEY_RELEASED;

			kbtrans_streams_key(conskbd.conskbd_kbtrans,
			    fe->id, fe->value ? KEY_PRESSED : KEY_RELEASED);