 @@ -1,14 +1,14 @@
-/*	$NetBSD: uhidev.c,v 1.88 2022/03/28 12:43:58 riastradh Exp $	*/
+/*	$NetBSD: uhidev.c,v 1.89 2022/03/28 12:44:06 riastradh Exp $	*/
 /*
  * Copyright (c) 2001, 2012 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Lennart Augustsson (lennart@augustsson.net) at
  * Carlstedt Research & Technology and Matthew R. Green (mrg@eterna.com.au).
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
 @@ -25,44 +25,46 @@
  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
 /*
  * HID spec: http://www.usb.org/developers/devclass_docs/HID1_11.pdf
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uhidev.c,v 1.88 2022/03/28 12:43:58 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uhidev.c,v 1.89 2022/03/28 12:44:06 riastradh Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
 #endif
 #include <sys/param.h>
 #include <sys/types.h>
 #include <sys/atomic.h>
 #include <sys/conf.h>
 #include <sys/device.h>
 #include <sys/ioctl.h>
 #include <sys/kernel.h>
 #include <sys/kmem.h>
 #include <sys/lwp.h>
 #include <sys/rndsource.h>
 #include <sys/signalvar.h>
 #include <sys/systm.h>
 #include <sys/xcall.h>
 #include <dev/usb/usb.h>
 #include <dev/usb/usbhid.h>
 #include <dev/usb/usbdevs.h>
 #include <dev/usb/usbdi.h>
 #include <dev/usb/usbdi_util.h>
 #include <dev/usb/usb_quirks.h>
 #include <dev/usb/uhidev.h>
 #include <dev/hid/hid.h>
 /* Report descriptor for broken Wacom Graphire */
 @@ -612,27 +614,27 @@ uhidev_intr(struct usbd_xfer *xfer, void
 		rep = *p++, cc--;
 	else
 		rep = 0;
 	if (rep >= sc->sc_nrepid) {
 		printf("uhidev_intr: bad repid %d\n", rep);
 		return;
+	}
 	cdev = sc->sc_subdevs[rep];
 	if (!cdev)
 		return;
 	scd = device_private(cdev);
 	DPRINTFN(5,("uhidev_intr: rep=%d, scd=%p state=%#x\n",
 		    rep, scd, scd ? scd->sc_state : 0));
-	if (!(scd->sc_state & UHIDEV_OPEN))
+	if (!(atomic_load_acquire(&scd->sc_state) & UHIDEV_OPEN))
 		return;
 #ifdef UHIDEV_DEBUG
 	if (scd->sc_in_rep_size != cc) {
 		DPRINTF(("%s: expected %d bytes, got %d\n",
 		       device_xname(sc->sc_dev), scd->sc_in_rep_size, cc));
+	}
 #endif
 	if (cc == 0) {
 		DPRINTF(("%s: 0-length input ignored\n",
 			device_xname(sc->sc_dev)));
 		return;
+	}
 	rnd_add_uint32(&scd->rnd_source, (uintptr_t)(sc->sc_ibuf));
 @@ -911,68 +913,69 @@ uhidev_open(struct uhidev *scd)
 	DPRINTF(("uhidev_open(%s, report %d = %s): state=%x refcnt=%d\n",
 		device_xname(sc->sc_dev),
 		scd->sc_report_id,
 		device_xname(scd->sc_dev),
 		scd->sc_state,
 		sc->sc_refcnt));
 	/* Mark the report id open.  This is an exclusive lock.  */
 	if (scd->sc_state & UHIDEV_OPEN) {
 		error = EBUSY;
 		goto out;
+	}
-	scd->sc_state |= UHIDEV_OPEN;
+	atomic_store_release(&scd->sc_state, scd->sc_state | UHIDEV_OPEN);
 	/* Open the pipes which are shared by all report ids.  */
 	error = uhidev_open_pipes(sc);
 	if (error)
 		goto out;
 	/* Success!  */
 	error = 0;
 out:	if (error) {
 		KASSERTMSG(scd->sc_state & UHIDEV_OPEN,
 		    "%s: report id %d: closed while opening",
 		    device_xname(sc->sc_dev), scd->sc_report_id);
-		scd->sc_state &= ~UHIDEV_OPEN;
+		atomic_store_relaxed(&scd->sc_state,
 		    scd->sc_state & ~UHIDEV_OPEN);
+	}
 	mutex_exit(&sc->sc_lock);
 	return error;
+}
 /*
  * uhidev_stop(scd)
+ *
  *	Make all current and future output reports or xfers by scd to
  *	the output pipe to fail.  Caller must then ensure no more will
  *	be submitted and then call uhidev_close.
+ *
  *	Side effect: If uhidev_write was in progress for this scd,
  *	blocks all other uhidev_writes until uhidev_close on this scd.
+ *
  *	May sleep but only for a short duration to wait for USB
  *	transfer completion callbacks to run.
  */
 void
 uhidev_stop(struct uhidev *scd)
+{
 	struct uhidev_softc *sc = scd->sc_parent;
 	mutex_enter(&sc->sc_lock);
 	/* Prevent further writes on this report from starting.  */
-	scd->sc_state |= UHIDEV_STOPPED;
+	atomic_store_relaxed(&scd->sc_state, scd->sc_state | UHIDEV_STOPPED);
 	/* If there's no output pipe at all, nothing to do.  */
 	if (sc->sc_opipe == NULL)
 		goto out;
 	/*
 	 * If there's no write on this report in progress, nothing to
 	 * do -- any subsequent attempts will be prevented by
 	 * UHIDEV_STOPPED.
 	 */
 	if (sc->sc_writereportid != scd->sc_report_id)
 		goto out;
 @@ -1042,29 +1045,41 @@ uhidev_close(struct uhidev *scd)
 		KASSERT(scd->sc_state & UHIDEV_STOPPED);
 		sc->sc_stopreportid = -1;
 		cv_broadcast(&sc->sc_cv);
+	}
 	/*
 	 * Close our reference to the pipes, and mark our report as no
 	 * longer open.  If it was stopped, clear that too -- drivers
 	 * are forbidden from issuing writes after uhidev_close anyway.
 	 */
 	KASSERT(scd->sc_state & UHIDEV_OPEN);
 	uhidev_close_pipes(sc);
 	KASSERT(scd->sc_state & UHIDEV_OPEN);
-	scd->sc_state &= ~(UHIDEV_OPEN | UHIDEV_STOPPED);
+	atomic_store_relaxed(&scd->sc_state,
 	    scd->sc_state & ~(UHIDEV_OPEN | UHIDEV_STOPPED));
 	/*
 	 * Make sure the next uhidev_intr (which runs in softint, like
 	 * XC_HIGHPRI) notices that UHIDEV_OPEN is cleared, and wait
 	 * for any current one to finish, in case the pipe is still
 	 * open for other report ids.
+	 *
 	 * We must drop the lock while doing this, because
 	 * uhidev_write_callback takes the lock in softint context and
 	 * it could deadlock with the xcall softint.
 	 */
 	mutex_exit(&sc->sc_lock);
 	xc_barrier(XC_HIGHPRI);
+}
 usbd_status
 uhidev_set_report(struct uhidev *scd, int type, void *data, int len)
+{
 	char *buf;
 	usbd_status retstat;
 	if (scd->sc_report_id == 0)
 		return usbd_set_report(scd->sc_parent->sc_iface, type,
 				       scd->sc_report_id, data, len);
 	buf = kmem_alloc(len + 1, KM_SLEEP);