xref: /netbsd-src/sys/dev/usb/uhid.c (revision 154bfe8e089c1a0a4e9ed8414f08d3da90949162)
1 /*	$NetBSD: uhid.c,v 1.114 2020/05/23 23:42:42 ad Exp $	*/
2 
3 /*
4  * Copyright (c) 1998, 2004, 2008, 2012 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Lennart Augustsson (lennart@augustsson.net) at
9  * Carlstedt Research & Technology and Matthew R. Green (mrg@eterna.com.au).
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * HID spec: http://www.usb.org/developers/devclass_docs/HID1_11.pdf
35  */
36 
37 #include <sys/cdefs.h>
38 __KERNEL_RCSID(0, "$NetBSD: uhid.c,v 1.114 2020/05/23 23:42:42 ad Exp $");
39 
40 #ifdef _KERNEL_OPT
41 #include "opt_compat_netbsd.h"
42 #include "opt_usb.h"
43 #endif
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/kernel.h>
48 #include <sys/kmem.h>
49 #include <sys/signalvar.h>
50 #include <sys/device.h>
51 #include <sys/ioctl.h>
52 #include <sys/conf.h>
53 #include <sys/tty.h>
54 #include <sys/file.h>
55 #include <sys/select.h>
56 #include <sys/proc.h>
57 #include <sys/vnode.h>
58 #include <sys/poll.h>
59 #include <sys/intr.h>
60 #include <sys/compat_stub.h>
61 
62 #include <dev/usb/usb.h>
63 #include <dev/usb/usbhid.h>
64 
65 #include <dev/usb/usbdevs.h>
66 #include <dev/usb/usbdi.h>
67 #include <dev/usb/usbdi_util.h>
68 #include <dev/usb/usb_quirks.h>
69 #include <dev/hid/hid.h>
70 
71 #include <dev/usb/uhidev.h>
72 
73 #include "ioconf.h"
74 
75 #ifdef UHID_DEBUG
76 #define DPRINTF(x)	if (uhiddebug) printf x
77 #define DPRINTFN(n,x)	if (uhiddebug>(n)) printf x
78 int	uhiddebug = 0;
79 #else
80 #define DPRINTF(x)
81 #define DPRINTFN(n,x)
82 #endif
83 
84 struct uhid_softc {
85 	struct uhidev sc_hdev;
86 
87 	kmutex_t sc_access_lock; /* serialises syscall accesses */
88 	kmutex_t sc_lock;	/* protects refcnt, others */
89 	kcondvar_t sc_cv;
90 	kcondvar_t sc_detach_cv;
91 
92 	int sc_isize;
93 	int sc_osize;
94 	int sc_fsize;
95 
96 	u_char *sc_obuf;
97 
98 	struct clist sc_q;	/* protected by sc_lock */
99 	struct selinfo sc_rsel;
100 	proc_t *sc_async;	/* process that wants SIGIO */
101 	void *sc_sih;
102 	u_char sc_state;	/* driver state */
103 #define	UHID_ASLP	0x01	/* waiting for device data */
104 #define UHID_IMMED	0x02	/* return read data immediately */
105 
106 	int sc_refcnt;
107 	int sc_raw;
108 	u_char sc_dying;
109 };
110 
111 #define	UHIDUNIT(dev)	(minor(dev))
112 #define	UHID_CHUNK	128	/* chunk size for read */
113 #define	UHID_BSIZE	1020	/* buffer size */
114 
115 static dev_type_open(uhidopen);
116 static dev_type_close(uhidclose);
117 static dev_type_read(uhidread);
118 static dev_type_write(uhidwrite);
119 static dev_type_ioctl(uhidioctl);
120 static dev_type_poll(uhidpoll);
121 static dev_type_kqfilter(uhidkqfilter);
122 
123 const struct cdevsw uhid_cdevsw = {
124 	.d_open = uhidopen,
125 	.d_close = uhidclose,
126 	.d_read = uhidread,
127 	.d_write = uhidwrite,
128 	.d_ioctl = uhidioctl,
129 	.d_stop = nostop,
130 	.d_tty = notty,
131 	.d_poll = uhidpoll,
132 	.d_mmap = nommap,
133 	.d_kqfilter = uhidkqfilter,
134 	.d_discard = nodiscard,
135 	.d_flag = D_OTHER
136 };
137 
138 Static void uhid_intr(struct uhidev *, void *, u_int);
139 Static void uhid_softintr(void *);
140 
141 Static int uhid_do_read(struct uhid_softc *, struct uio *, int);
142 Static int uhid_do_write(struct uhid_softc *, struct uio *, int);
143 Static int uhid_do_ioctl(struct uhid_softc*, u_long, void *, int, struct lwp *);
144 
145 static int	uhid_match(device_t, cfdata_t, void *);
146 static void	uhid_attach(device_t, device_t, void *);
147 static int	uhid_detach(device_t, int);
148 static int	uhid_activate(device_t, enum devact);
149 
150 CFATTACH_DECL_NEW(uhid, sizeof(struct uhid_softc), uhid_match, uhid_attach,
151     uhid_detach, uhid_activate);
152 
153 static int
154 uhid_match(device_t parent, cfdata_t match, void *aux)
155 {
156 #ifdef UHID_DEBUG
157 	struct uhidev_attach_arg *uha = aux;
158 #endif
159 
160 	DPRINTF(("uhid_match: report=%d\n", uha->reportid));
161 
162 	if (match->cf_flags & 1)
163 		return UMATCH_HIGHEST;
164 	else
165 		return UMATCH_IFACECLASS_GENERIC;
166 }
167 
168 static void
169 uhid_attach(device_t parent, device_t self, void *aux)
170 {
171 	struct uhid_softc *sc = device_private(self);
172 	struct uhidev_attach_arg *uha = aux;
173 	int size, repid;
174 	void *desc;
175 
176 	sc->sc_hdev.sc_dev = self;
177 	selinit(&sc->sc_rsel);
178 	sc->sc_hdev.sc_intr = uhid_intr;
179 	sc->sc_hdev.sc_parent = uha->parent;
180 	sc->sc_hdev.sc_report_id = uha->reportid;
181 	sc->sc_sih = softint_establish(SOFTINT_CLOCK, uhid_softintr, sc);
182 
183 	uhidev_get_report_desc(uha->parent, &desc, &size);
184 	repid = uha->reportid;
185 	sc->sc_isize = hid_report_size(desc, size, hid_input,   repid);
186 	sc->sc_osize = hid_report_size(desc, size, hid_output,  repid);
187 	sc->sc_fsize = hid_report_size(desc, size, hid_feature, repid);
188 	sc->sc_raw =  hid_is_collection(desc, size, uha->reportid,
189 	    HID_USAGE2(HUP_FIDO, HUF_U2FHID));
190 
191 	aprint_naive("\n");
192 	aprint_normal(": input=%d, output=%d, feature=%d\n",
193 	       sc->sc_isize, sc->sc_osize, sc->sc_fsize);
194 
195 	mutex_init(&sc->sc_access_lock, MUTEX_DEFAULT, IPL_NONE);
196 	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_SOFTUSB);
197 	cv_init(&sc->sc_cv, "uhidrea");
198 	cv_init(&sc->sc_detach_cv, "uhiddet");
199 
200 	if (!pmf_device_register(self, NULL, NULL))
201 		aprint_error_dev(self, "couldn't establish power handler\n");
202 
203 	return;
204 }
205 
206 static int
207 uhid_activate(device_t self, enum devact act)
208 {
209 	struct uhid_softc *sc = device_private(self);
210 
211 	switch (act) {
212 	case DVACT_DEACTIVATE:
213 		sc->sc_dying = 1;
214 		return 0;
215 	default:
216 		return EOPNOTSUPP;
217 	}
218 }
219 
220 static int
221 uhid_detach(device_t self, int flags)
222 {
223 	struct uhid_softc *sc = device_private(self);
224 	int maj, mn;
225 
226 	DPRINTF(("uhid_detach: sc=%p flags=%d\n", sc, flags));
227 
228 	sc->sc_dying = 1;
229 
230 	pmf_device_deregister(self);
231 
232 	mutex_enter(&sc->sc_lock);
233 	if (sc->sc_hdev.sc_state & UHIDEV_OPEN) {
234 		if (--sc->sc_refcnt >= 0) {
235 			/* Wake everyone */
236 			cv_broadcast(&sc->sc_cv);
237 			/* Wait for processes to go away. */
238 			if (cv_timedwait(&sc->sc_detach_cv, &sc->sc_lock, hz * 60))
239 				aprint_error_dev(self, ": didn't detach\n");
240 		}
241 	}
242 	mutex_exit(&sc->sc_lock);
243 
244 	/* locate the major number */
245 	maj = cdevsw_lookup_major(&uhid_cdevsw);
246 
247 	/* Nuke the vnodes for any open instances (calls close). */
248 	mn = device_unit(self);
249 	vdevgone(maj, mn, mn, VCHR);
250 
251 #if 0
252 	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH,
253 	    sc->sc_hdev.sc_parent->sc_udev, sc->sc_hdev.sc_dev);
254 #endif
255 	cv_destroy(&sc->sc_cv);
256 	cv_destroy(&sc->sc_detach_cv);
257 	mutex_destroy(&sc->sc_lock);
258 	mutex_destroy(&sc->sc_access_lock);
259 	seldestroy(&sc->sc_rsel);
260 	softint_disestablish(sc->sc_sih);
261 
262 	return 0;
263 }
264 
265 void
266 uhid_intr(struct uhidev *addr, void *data, u_int len)
267 {
268 	struct uhid_softc *sc = (struct uhid_softc *)addr;
269 
270 #ifdef UHID_DEBUG
271 	if (uhiddebug > 5) {
272 		uint32_t i;
273 
274 		DPRINTF(("uhid_intr: data ="));
275 		for (i = 0; i < len; i++)
276 			DPRINTF((" %02x", ((u_char *)data)[i]));
277 		DPRINTF(("\n"));
278 	}
279 #endif
280 
281 	mutex_enter(&sc->sc_lock);
282 	(void)b_to_q(data, len, &sc->sc_q);
283 
284 	if (sc->sc_state & UHID_ASLP) {
285 		sc->sc_state &= ~UHID_ASLP;
286 		DPRINTFN(5, ("uhid_intr: waking %p\n", &sc->sc_q));
287 		cv_broadcast(&sc->sc_cv);
288 	}
289 	selnotify(&sc->sc_rsel, 0, 0);
290 	if (sc->sc_async != NULL) {
291 		DPRINTFN(3, ("uhid_intr: sending SIGIO %p\n", sc->sc_async));
292 		softint_schedule(sc->sc_sih);
293 	}
294 	mutex_exit(&sc->sc_lock);
295 }
296 
297 void
298 uhid_softintr(void *cookie)
299 {
300 	struct uhid_softc *sc;
301 
302 	sc = cookie;
303 
304 	mutex_enter(&proc_lock);
305 	if (sc->sc_async != NULL)
306 		 psignal(sc->sc_async, SIGIO);
307 	mutex_exit(&proc_lock);
308 }
309 
310 static int
311 uhidopen(dev_t dev, int flag, int mode, struct lwp *l)
312 {
313 	struct uhid_softc *sc;
314 	int error;
315 
316 	sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
317 	if (sc == NULL)
318 		return ENXIO;
319 
320 	DPRINTF(("uhidopen: sc=%p\n", sc));
321 
322 	if (sc->sc_dying)
323 		return ENXIO;
324 
325 	mutex_enter(&sc->sc_lock);
326 
327 	/*
328 	 * uhid interrupts aren't enabled yet, so setup sc_q now, as
329 	 * long as they're not already allocated.
330 	 */
331 	if (sc->sc_hdev.sc_state & UHIDEV_OPEN) {
332 		mutex_exit(&sc->sc_lock);
333 		return EBUSY;
334 	}
335 	mutex_exit(&sc->sc_lock);
336 
337 	if (clalloc(&sc->sc_q, UHID_BSIZE, 0) == -1) {
338 		return ENOMEM;
339 	}
340 
341 	mutex_enter(&sc->sc_access_lock);
342 	error = uhidev_open(&sc->sc_hdev);
343 	if (error) {
344 		clfree(&sc->sc_q);
345 		mutex_exit(&sc->sc_access_lock);
346 		return error;
347 	}
348 	mutex_exit(&sc->sc_access_lock);
349 
350 	if (sc->sc_osize > 0)
351 		sc->sc_obuf = kmem_alloc(sc->sc_osize, KM_SLEEP);
352 	else
353 		sc->sc_obuf = NULL;
354 	sc->sc_state &= ~UHID_IMMED;
355 
356 	mutex_enter(&proc_lock);
357 	sc->sc_async = NULL;
358 	mutex_exit(&proc_lock);
359 
360 	return 0;
361 }
362 
363 static int
364 uhidclose(dev_t dev, int flag, int mode, struct lwp *l)
365 {
366 	struct uhid_softc *sc;
367 
368 	sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
369 
370 	DPRINTF(("uhidclose: sc=%p\n", sc));
371 
372 	mutex_enter(&proc_lock);
373 	sc->sc_async = NULL;
374 	mutex_exit(&proc_lock);
375 
376 	mutex_enter(&sc->sc_access_lock);
377 
378 	uhidev_stop(&sc->sc_hdev);
379 
380 	clfree(&sc->sc_q);
381 	if (sc->sc_osize > 0)
382 		kmem_free(sc->sc_obuf, sc->sc_osize);
383 
384 	uhidev_close(&sc->sc_hdev);
385 
386 	mutex_exit(&sc->sc_access_lock);
387 
388 	return 0;
389 }
390 
391 Static int
392 uhid_do_read(struct uhid_softc *sc, struct uio *uio, int flag)
393 {
394 	int error = 0;
395 	int extra;
396 	size_t length;
397 	u_char buffer[UHID_CHUNK];
398 	usbd_status err;
399 
400 	DPRINTFN(1, ("uhidread\n"));
401 	if (sc->sc_state & UHID_IMMED) {
402 		DPRINTFN(1, ("uhidread immed\n"));
403 		extra = sc->sc_hdev.sc_report_id != 0;
404 		if (sc->sc_isize + extra > sizeof(buffer))
405 			return ENOBUFS;
406 		err = uhidev_get_report(&sc->sc_hdev, UHID_INPUT_REPORT,
407 					buffer, sc->sc_isize + extra);
408 		if (err)
409 			return EIO;
410 		return uiomove(buffer+extra, sc->sc_isize, uio);
411 	}
412 
413 	mutex_enter(&sc->sc_lock);
414 	while (sc->sc_q.c_cc == 0) {
415 		if (flag & IO_NDELAY) {
416 			mutex_exit(&sc->sc_lock);
417 			return EWOULDBLOCK;
418 		}
419 		sc->sc_state |= UHID_ASLP;
420 		DPRINTFN(5, ("uhidread: sleep on %p\n", &sc->sc_q));
421 		error = cv_wait_sig(&sc->sc_cv, &sc->sc_lock);
422 		DPRINTFN(5, ("uhidread: woke, error=%d\n", error));
423 		if (sc->sc_dying)
424 			error = EIO;
425 		if (error) {
426 			sc->sc_state &= ~UHID_ASLP;
427 			break;
428 		}
429 	}
430 
431 	/* Transfer as many chunks as possible. */
432 	while (sc->sc_q.c_cc > 0 && uio->uio_resid > 0 && !error) {
433 		length = uimin(sc->sc_q.c_cc, uio->uio_resid);
434 		if (length > sizeof(buffer))
435 			length = sizeof(buffer);
436 
437 		/* Remove a small chunk from the input queue. */
438 		(void) q_to_b(&sc->sc_q, buffer, length);
439 		DPRINTFN(5, ("uhidread: got %lu chars\n", (u_long)length));
440 
441 		/* Copy the data to the user process. */
442 		mutex_exit(&sc->sc_lock);
443 		if ((error = uiomove(buffer, length, uio)) != 0)
444 			return error;
445 		mutex_enter(&sc->sc_lock);
446 	}
447 
448 	mutex_exit(&sc->sc_lock);
449 	return error;
450 }
451 
452 static int
453 uhidread(dev_t dev, struct uio *uio, int flag)
454 {
455 	struct uhid_softc *sc;
456 	int error;
457 
458 	sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
459 
460 	mutex_enter(&sc->sc_lock);
461 	sc->sc_refcnt++;
462 	mutex_exit(&sc->sc_lock);
463 
464 	mutex_enter(&sc->sc_access_lock);
465 	error = uhid_do_read(sc, uio, flag);
466 	mutex_exit(&sc->sc_access_lock);
467 
468 	mutex_enter(&sc->sc_lock);
469 	if (--sc->sc_refcnt < 0)
470 		cv_broadcast(&sc->sc_detach_cv);
471 	mutex_exit(&sc->sc_lock);
472 	return error;
473 }
474 
475 Static int
476 uhid_do_write(struct uhid_softc *sc, struct uio *uio, int flag)
477 {
478 	int error;
479 	int size;
480 	usbd_status err;
481 
482 	DPRINTFN(1, ("uhidwrite\n"));
483 
484 	if (sc->sc_dying)
485 		return EIO;
486 
487 	size = sc->sc_osize;
488 	if (uio->uio_resid != size || size == 0)
489 		return EINVAL;
490 	error = uiomove(sc->sc_obuf, size, uio);
491 #ifdef UHID_DEBUG
492 	if (uhiddebug > 5) {
493 		uint32_t i;
494 
495 		DPRINTF(("%s: outdata[%d] =", device_xname(sc->sc_hdev.sc_dev),
496 		    error));
497 		for (i = 0; i < size; i++)
498 			DPRINTF((" %02x", sc->sc_obuf[i]));
499 		DPRINTF(("\n"));
500 	}
501 #endif
502 	if (!error) {
503 		if (sc->sc_raw)
504 			err = uhidev_write(sc->sc_hdev.sc_parent, sc->sc_obuf,
505 			    size);
506 		else
507 			err = uhidev_set_report(&sc->sc_hdev,
508 			    UHID_OUTPUT_REPORT, sc->sc_obuf, size);
509 		if (err) {
510 			DPRINTF(("%s: err = %d\n",
511 			    device_xname(sc->sc_hdev.sc_dev), err));
512 			error = EIO;
513 		}
514 	}
515 
516 	return error;
517 }
518 
519 int
520 uhidwrite(dev_t dev, struct uio *uio, int flag)
521 {
522 	struct uhid_softc *sc;
523 	int error;
524 
525 	sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
526 
527 	mutex_enter(&sc->sc_lock);
528 	sc->sc_refcnt++;
529 	mutex_exit(&sc->sc_lock);
530 
531 	mutex_enter(&sc->sc_access_lock);
532 	error = uhid_do_write(sc, uio, flag);
533 	mutex_exit(&sc->sc_access_lock);
534 
535 	mutex_enter(&sc->sc_lock);
536 	if (--sc->sc_refcnt < 0)
537 		cv_broadcast(&sc->sc_detach_cv);
538 	mutex_exit(&sc->sc_lock);
539 	return error;
540 }
541 
542 int
543 uhid_do_ioctl(struct uhid_softc *sc, u_long cmd, void *addr,
544     int flag, struct lwp *l)
545 {
546 	struct usb_ctl_report_desc *rd;
547 	struct usb_ctl_report *re;
548 	u_char buffer[UHID_CHUNK];
549 	int size, extra;
550 	usbd_status err;
551 	void *desc;
552 
553 	DPRINTFN(2, ("uhidioctl: cmd=%lx\n", cmd));
554 
555 	if (sc->sc_dying)
556 		return EIO;
557 
558 	switch (cmd) {
559 	case FIONBIO:
560 		/* All handled in the upper FS layer. */
561 		break;
562 
563 	case FIOASYNC:
564 		mutex_enter(&proc_lock);
565 		if (*(int *)addr) {
566 			if (sc->sc_async != NULL) {
567 				mutex_exit(&proc_lock);
568 				return EBUSY;
569 			}
570 			sc->sc_async = l->l_proc;
571 			DPRINTF(("uhid_do_ioctl: FIOASYNC %p\n", l->l_proc));
572 		} else
573 			sc->sc_async = NULL;
574 		mutex_exit(&proc_lock);
575 		break;
576 
577 	/* XXX this is not the most general solution. */
578 	case TIOCSPGRP:
579 		mutex_enter(&proc_lock);
580 		if (sc->sc_async == NULL) {
581 			mutex_exit(&proc_lock);
582 			return EINVAL;
583 		}
584 		if (*(int *)addr != sc->sc_async->p_pgid) {
585 			mutex_exit(&proc_lock);
586 			return EPERM;
587 		}
588 		mutex_exit(&proc_lock);
589 		break;
590 
591 	case FIOSETOWN:
592 		mutex_enter(&proc_lock);
593 		if (sc->sc_async == NULL) {
594 			mutex_exit(&proc_lock);
595 			return EINVAL;
596 		}
597 		if (-*(int *)addr != sc->sc_async->p_pgid
598 		    && *(int *)addr != sc->sc_async->p_pid) {
599 			mutex_exit(&proc_lock);
600 			return EPERM;
601 		}
602 		mutex_exit(&proc_lock);
603 		break;
604 
605 	case USB_HID_GET_RAW:
606 		*(int *)addr = sc->sc_raw;
607 		break;
608 
609 	case USB_HID_SET_RAW:
610 		sc->sc_raw = *(int *)addr;
611 		break;
612 
613 	case USB_GET_REPORT_DESC:
614 		uhidev_get_report_desc(sc->sc_hdev.sc_parent, &desc, &size);
615 		rd = (struct usb_ctl_report_desc *)addr;
616 		size = uimin(size, sizeof(rd->ucrd_data));
617 		rd->ucrd_size = size;
618 		memcpy(rd->ucrd_data, desc, size);
619 		break;
620 
621 	case USB_SET_IMMED:
622 		if (*(int *)addr) {
623 			extra = sc->sc_hdev.sc_report_id != 0;
624 			if (sc->sc_isize + extra > sizeof(buffer))
625 				return ENOBUFS;
626 			err = uhidev_get_report(&sc->sc_hdev, UHID_INPUT_REPORT,
627 						buffer, sc->sc_isize + extra);
628 			if (err)
629 				return EOPNOTSUPP;
630 
631 			sc->sc_state |=  UHID_IMMED;
632 		} else
633 			sc->sc_state &= ~UHID_IMMED;
634 		break;
635 
636 	case USB_GET_REPORT:
637 		re = (struct usb_ctl_report *)addr;
638 		switch (re->ucr_report) {
639 		case UHID_INPUT_REPORT:
640 			size = sc->sc_isize;
641 			break;
642 		case UHID_OUTPUT_REPORT:
643 			size = sc->sc_osize;
644 			break;
645 		case UHID_FEATURE_REPORT:
646 			size = sc->sc_fsize;
647 			break;
648 		default:
649 			return EINVAL;
650 		}
651 		extra = sc->sc_hdev.sc_report_id != 0;
652 		if (size + extra > sizeof(re->ucr_data))
653 			return ENOBUFS;
654 		err = uhidev_get_report(&sc->sc_hdev, re->ucr_report,
655 		    re->ucr_data, size + extra);
656 		if (extra)
657 			memmove(re->ucr_data, re->ucr_data+1, size);
658 		if (err)
659 			return EIO;
660 		break;
661 
662 	case USB_SET_REPORT:
663 		re = (struct usb_ctl_report *)addr;
664 		switch (re->ucr_report) {
665 		case UHID_INPUT_REPORT:
666 			size = sc->sc_isize;
667 			break;
668 		case UHID_OUTPUT_REPORT:
669 			size = sc->sc_osize;
670 			break;
671 		case UHID_FEATURE_REPORT:
672 			size = sc->sc_fsize;
673 			break;
674 		default:
675 			return EINVAL;
676 		}
677 		if (size > sizeof(re->ucr_data))
678 			return ENOBUFS;
679 		err = uhidev_set_report(&sc->sc_hdev, re->ucr_report,
680 		    re->ucr_data, size);
681 		if (err)
682 			return EIO;
683 		break;
684 
685 	case USB_GET_REPORT_ID:
686 		*(int *)addr = sc->sc_hdev.sc_report_id;
687 		break;
688 
689 	case USB_GET_DEVICE_DESC:
690 		*(usb_device_descriptor_t *)addr =
691 			*usbd_get_device_descriptor(sc->sc_hdev.sc_parent->sc_udev);
692 		break;
693 
694 	case USB_GET_DEVICEINFO:
695 		usbd_fill_deviceinfo(sc->sc_hdev.sc_parent->sc_udev,
696 				     (struct usb_device_info *)addr, 0);
697 		break;
698 	case USB_GET_DEVICEINFO_OLD:
699 		MODULE_HOOK_CALL(usb_subr_fill_30_hook,
700                     (sc->sc_hdev.sc_parent->sc_udev,
701 		      (struct usb_device_info_old *)addr, 0,
702                       usbd_devinfo_vp, usbd_printBCD),
703                     enosys(), err);
704 		if (err == 0)
705 			return 0;
706 		break;
707 	case USB_GET_STRING_DESC:
708 	    {
709 		struct usb_string_desc *si = (struct usb_string_desc *)addr;
710 		err = usbd_get_string_desc(sc->sc_hdev.sc_parent->sc_udev,
711 			si->usd_string_index,
712 			si->usd_language_id, &si->usd_desc, &size);
713 		if (err)
714 			return EINVAL;
715 		break;
716 	    }
717 
718 	default:
719 		return EINVAL;
720 	}
721 	return 0;
722 }
723 
724 static int
725 uhidioctl(dev_t dev, u_long cmd, void *addr, int flag, struct lwp *l)
726 {
727 	struct uhid_softc *sc;
728 	int error;
729 
730 	sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
731 	if (sc == NULL)
732 		return ENXIO;
733 
734 	if (sc->sc_dying)
735 		return EIO;
736 
737 	mutex_enter(&sc->sc_lock);
738 	sc->sc_refcnt++;
739 	mutex_exit(&sc->sc_lock);
740 
741 	mutex_enter(&sc->sc_access_lock);
742 	error = uhid_do_ioctl(sc, cmd, addr, flag, l);
743 	mutex_exit(&sc->sc_access_lock);
744 
745 	mutex_enter(&sc->sc_lock);
746 	if (--sc->sc_refcnt < 0)
747 		cv_broadcast(&sc->sc_detach_cv);
748 	mutex_exit(&sc->sc_lock);
749 	return error;
750 }
751 
752 static int
753 uhidpoll(dev_t dev, int events, struct lwp *l)
754 {
755 	struct uhid_softc *sc;
756 	int revents = 0;
757 
758 	sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
759 	if (sc == NULL)
760 		return ENXIO;
761 
762 	if (sc->sc_dying)
763 		return EIO;
764 
765 	mutex_enter(&sc->sc_lock);
766 	if (events & (POLLOUT | POLLWRNORM))
767 		revents |= events & (POLLOUT | POLLWRNORM);
768 	if (events & (POLLIN | POLLRDNORM)) {
769 		if (sc->sc_q.c_cc > 0)
770 			revents |= events & (POLLIN | POLLRDNORM);
771 		else
772 			selrecord(l, &sc->sc_rsel);
773 	}
774 	mutex_exit(&sc->sc_lock);
775 
776 	return revents;
777 }
778 
779 static void
780 filt_uhidrdetach(struct knote *kn)
781 {
782 	struct uhid_softc *sc = kn->kn_hook;
783 
784 	mutex_enter(&sc->sc_lock);
785 	SLIST_REMOVE(&sc->sc_rsel.sel_klist, kn, knote, kn_selnext);
786 	mutex_exit(&sc->sc_lock);
787 }
788 
789 static int
790 filt_uhidread(struct knote *kn, long hint)
791 {
792 	struct uhid_softc *sc = kn->kn_hook;
793 
794 	kn->kn_data = sc->sc_q.c_cc;
795 	return kn->kn_data > 0;
796 }
797 
798 static const struct filterops uhidread_filtops = {
799 	.f_isfd = 1,
800 	.f_attach = NULL,
801 	.f_detach = filt_uhidrdetach,
802 	.f_event = filt_uhidread,
803 };
804 
805 static const struct filterops uhid_seltrue_filtops = {
806 	.f_isfd = 1,
807 	.f_attach = NULL,
808 	.f_detach = filt_uhidrdetach,
809 	.f_event = filt_seltrue,
810 };
811 
812 static int
813 uhidkqfilter(dev_t dev, struct knote *kn)
814 {
815 	struct uhid_softc *sc;
816 	struct klist *klist;
817 
818 	sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
819 
820 	if (sc->sc_dying)
821 		return ENXIO;
822 
823 	switch (kn->kn_filter) {
824 	case EVFILT_READ:
825 		klist = &sc->sc_rsel.sel_klist;
826 		kn->kn_fop = &uhidread_filtops;
827 		break;
828 
829 	case EVFILT_WRITE:
830 		klist = &sc->sc_rsel.sel_klist;
831 		kn->kn_fop = &uhid_seltrue_filtops;
832 		break;
833 
834 	default:
835 		return EINVAL;
836 	}
837 
838 	kn->kn_hook = sc;
839 
840 	mutex_enter(&sc->sc_lock);
841 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
842 	mutex_exit(&sc->sc_lock);
843 
844 	return 0;
845 }
846