xref: /netbsd-src/sys/dev/usb/uhid.c (revision 2718af68c3efc72c9769069b5c7f9ed36f6b9def)
1 /*	$NetBSD: uhid.c,v 1.125 2022/03/31 17:43:50 christos Exp $	*/
2 
3 /*
4  * Copyright (c) 1998, 2004, 2008, 2012 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Lennart Augustsson (lennart@augustsson.net) at
9  * Carlstedt Research & Technology and Matthew R. Green (mrg@eterna.com.au).
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * HID spec: http://www.usb.org/developers/devclass_docs/HID1_11.pdf
35  */
36 
37 #include <sys/cdefs.h>
38 __KERNEL_RCSID(0, "$NetBSD: uhid.c,v 1.125 2022/03/31 17:43:50 christos Exp $");
39 
40 #ifdef _KERNEL_OPT
41 #include "opt_compat_netbsd.h"
42 #include "opt_usb.h"
43 #endif
44 
45 #include <sys/param.h>
46 #include <sys/types.h>
47 
48 #include <sys/atomic.h>
49 #include <sys/compat_stub.h>
50 #include <sys/conf.h>
51 #include <sys/device.h>
52 #include <sys/file.h>
53 #include <sys/intr.h>
54 #include <sys/ioctl.h>
55 #include <sys/kernel.h>
56 #include <sys/kmem.h>
57 #include <sys/poll.h>
58 #include <sys/proc.h>
59 #include <sys/select.h>
60 #include <sys/signalvar.h>
61 #include <sys/systm.h>
62 #include <sys/tty.h>
63 #include <sys/vnode.h>
64 
65 #include <dev/usb/usb.h>
66 #include <dev/usb/usbhid.h>
67 
68 #include <dev/usb/usbdevs.h>
69 #include <dev/usb/usbdi.h>
70 #include <dev/usb/usbdi_util.h>
71 #include <dev/usb/usb_quirks.h>
72 #include <dev/hid/hid.h>
73 
74 #include <dev/usb/uhidev.h>
75 
76 #include "ioconf.h"
77 
78 #ifdef UHID_DEBUG
79 #define DPRINTF(x)	if (uhiddebug) printf x
80 #define DPRINTFN(n,x)	if (uhiddebug>(n)) printf x
81 int	uhiddebug = 0;
82 #else
83 #define DPRINTF(x)
84 #define DPRINTFN(n,x)
85 #endif
86 
87 struct uhid_softc {
88 	device_t sc_dev;
89 	struct uhidev *sc_hdev;
90 	struct usbd_device *sc_udev;
91 	uint8_t sc_report_id;
92 
93 	kmutex_t sc_lock;
94 	kcondvar_t sc_cv;
95 
96 	int sc_isize;
97 	int sc_osize;
98 	int sc_fsize;
99 
100 	u_char *sc_obuf;
101 
102 	struct clist sc_q;	/* protected by sc_lock */
103 	struct selinfo sc_rsel;
104 	proc_t *sc_async;	/* process that wants SIGIO */
105 	void *sc_sih;
106 	volatile uint32_t sc_state;	/* driver state */
107 #define UHID_IMMED	0x02	/* return read data immediately */
108 
109 	int sc_raw;
110 	enum {
111 		UHID_CLOSED,
112 		UHID_OPENING,
113 		UHID_OPEN,
114 	} sc_open;
115 	bool sc_closing;
116 };
117 
118 #define	UHIDUNIT(dev)	(minor(dev))
119 #define	UHID_CHUNK	128	/* chunk size for read */
120 #define	UHID_BSIZE	1020	/* buffer size */
121 
122 static dev_type_open(uhidopen);
123 static dev_type_cancel(uhidcancel);
124 static dev_type_close(uhidclose);
125 static dev_type_read(uhidread);
126 static dev_type_write(uhidwrite);
127 static dev_type_ioctl(uhidioctl);
128 static dev_type_poll(uhidpoll);
129 static dev_type_kqfilter(uhidkqfilter);
130 
131 const struct cdevsw uhid_cdevsw = {
132 	.d_open = uhidopen,
133 	.d_cancel = uhidcancel,
134 	.d_close = uhidclose,
135 	.d_read = uhidread,
136 	.d_write = uhidwrite,
137 	.d_ioctl = uhidioctl,
138 	.d_stop = nostop,
139 	.d_tty = notty,
140 	.d_poll = uhidpoll,
141 	.d_mmap = nommap,
142 	.d_kqfilter = uhidkqfilter,
143 	.d_discard = nodiscard,
144 	.d_cfdriver = &uhid_cd,
145 	.d_devtounit = dev_minor_unit,
146 	.d_flag = D_OTHER
147 };
148 
149 static void uhid_intr(void *, void *, u_int);
150 
151 static int	uhid_match(device_t, cfdata_t, void *);
152 static void	uhid_attach(device_t, device_t, void *);
153 static int	uhid_detach(device_t, int);
154 
155 CFATTACH_DECL_NEW(uhid, sizeof(struct uhid_softc), uhid_match, uhid_attach,
156     uhid_detach, NULL);
157 
158 static int
159 uhid_match(device_t parent, cfdata_t match, void *aux)
160 {
161 #ifdef UHID_DEBUG
162 	struct uhidev_attach_arg *uha = aux;
163 #endif
164 
165 	DPRINTF(("uhid_match: report=%d\n", uha->reportid));
166 
167 	if (match->cf_flags & 1)
168 		return UMATCH_HIGHEST;
169 	else
170 		return UMATCH_IFACECLASS_GENERIC;
171 }
172 
173 static void
174 uhid_attach(device_t parent, device_t self, void *aux)
175 {
176 	struct uhid_softc *sc = device_private(self);
177 	struct uhidev_attach_arg *uha = aux;
178 	int size, repid;
179 	void *desc;
180 
181 	sc->sc_dev = self;
182 	sc->sc_hdev = uha->parent;
183 	sc->sc_udev = uha->uiaa->uiaa_device;
184 	sc->sc_report_id = uha->reportid;
185 
186 	selinit(&sc->sc_rsel);
187 
188 	uhidev_get_report_desc(uha->parent, &desc, &size);
189 	repid = uha->reportid;
190 	sc->sc_isize = hid_report_size(desc, size, hid_input,   repid);
191 	sc->sc_osize = hid_report_size(desc, size, hid_output,  repid);
192 	sc->sc_fsize = hid_report_size(desc, size, hid_feature, repid);
193 	sc->sc_raw =  hid_is_collection(desc, size, uha->reportid,
194 	    HID_USAGE2(HUP_FIDO, HUF_U2FHID));
195 
196 	aprint_naive("\n");
197 	aprint_normal(": input=%d, output=%d, feature=%d\n",
198 	       sc->sc_isize, sc->sc_osize, sc->sc_fsize);
199 
200 	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_SOFTUSB);
201 	cv_init(&sc->sc_cv, "uhidrea");
202 
203 	if (!pmf_device_register(self, NULL, NULL))
204 		aprint_error_dev(self, "couldn't establish power handler\n");
205 
206 	return;
207 }
208 
209 static int
210 uhid_detach(device_t self, int flags)
211 {
212 	struct uhid_softc *sc = device_private(self);
213 	int maj, mn;
214 
215 	DPRINTF(("uhid_detach: sc=%p flags=%d\n", sc, flags));
216 
217 	pmf_device_deregister(self);
218 
219 	/* locate the major number */
220 	maj = cdevsw_lookup_major(&uhid_cdevsw);
221 
222 	/* Nuke the vnodes for any open instances (calls close). */
223 	mn = device_unit(self);
224 	vdevgone(maj, mn, mn, VCHR);
225 
226 	KASSERTMSG(sc->sc_open == UHID_CLOSED, "open=%d", (int)sc->sc_open);
227 
228 	cv_destroy(&sc->sc_cv);
229 	mutex_destroy(&sc->sc_lock);
230 	seldestroy(&sc->sc_rsel);
231 
232 	return 0;
233 }
234 
235 static void
236 uhid_intr(void *cookie, void *data, u_int len)
237 {
238 	struct uhid_softc *sc = cookie;
239 
240 #ifdef UHID_DEBUG
241 	if (uhiddebug > 5) {
242 		uint32_t i;
243 
244 		DPRINTF(("uhid_intr: data ="));
245 		for (i = 0; i < len; i++)
246 			DPRINTF((" %02x", ((u_char *)data)[i]));
247 		DPRINTF(("\n"));
248 	}
249 #endif
250 
251 	mutex_enter(&sc->sc_lock);
252 	(void)b_to_q(data, len, &sc->sc_q);
253 
254 	DPRINTFN(5, ("uhid_intr: waking %p\n", &sc->sc_q));
255 	cv_broadcast(&sc->sc_cv);
256 	selnotify(&sc->sc_rsel, 0, NOTE_SUBMIT);
257 	if (atomic_load_relaxed(&sc->sc_async) != NULL) {
258 		mutex_enter(&proc_lock);
259 		if (sc->sc_async != NULL) {
260 			DPRINTFN(3, ("uhid_intr: sending SIGIO to %jd\n",
261 				(intmax_t)sc->sc_async->p_pid));
262 			psignal(sc->sc_async, SIGIO);
263 		}
264 		mutex_exit(&proc_lock);
265 	}
266 	mutex_exit(&sc->sc_lock);
267 }
268 
269 static int
270 uhidopen(dev_t dev, int flag, int mode, struct lwp *l)
271 {
272 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
273 	int error;
274 
275 	DPRINTF(("uhidopen: sc=%p\n", sc));
276 	if (sc == NULL)
277 		return ENXIO;
278 
279 	/*
280 	 * Try to open.  If closing in progress, give up.  If already
281 	 * open (or opening), fail -- opens are exclusive.
282 	 */
283 	mutex_enter(&sc->sc_lock);
284 	if (sc->sc_open != UHID_CLOSED || sc->sc_closing) {
285 		mutex_exit(&sc->sc_lock);
286 		return EBUSY;
287 	}
288 	sc->sc_open = UHID_OPENING;
289 	atomic_store_relaxed(&sc->sc_state, 0);
290 	mutex_exit(&sc->sc_lock);
291 
292 	/* uhid interrupts aren't enabled yet, so setup sc_q now */
293 	if (clalloc(&sc->sc_q, UHID_BSIZE, 0) == -1) {
294 		error = ENOMEM;
295 		goto fail0;
296 	}
297 
298 	/* Allocate an output buffer if needed.  */
299 	if (sc->sc_osize > 0)
300 		sc->sc_obuf = kmem_alloc(sc->sc_osize, KM_SLEEP);
301 	else
302 		sc->sc_obuf = NULL;
303 
304 	/* Paranoia: reset SIGIO before enabling interrputs.  */
305 	mutex_enter(&proc_lock);
306 	atomic_store_relaxed(&sc->sc_async, NULL);
307 	mutex_exit(&proc_lock);
308 
309 	/* Open the uhidev -- after this point we can get interrupts.  */
310 	error = uhidev_open(sc->sc_hdev, &uhid_intr, sc);
311 	if (error)
312 		goto fail1;
313 
314 	/* We are open for business.  */
315 	mutex_enter(&sc->sc_lock);
316 	sc->sc_open = UHID_OPEN;
317 	cv_broadcast(&sc->sc_cv);
318 	mutex_exit(&sc->sc_lock);
319 
320 	return 0;
321 
322 fail1:	selnotify(&sc->sc_rsel, POLLHUP, 0);
323 	mutex_enter(&proc_lock);
324 	atomic_store_relaxed(&sc->sc_async, NULL);
325 	mutex_exit(&proc_lock);
326 	if (sc->sc_osize > 0) {
327 		kmem_free(sc->sc_obuf, sc->sc_osize);
328 		sc->sc_obuf = NULL;
329 	}
330 	clfree(&sc->sc_q);
331 fail0:	mutex_enter(&sc->sc_lock);
332 	KASSERT(sc->sc_open == UHID_OPENING);
333 	sc->sc_open = UHID_CLOSED;
334 	cv_broadcast(&sc->sc_cv);
335 	atomic_store_relaxed(&sc->sc_state, 0);
336 	mutex_exit(&sc->sc_lock);
337 	return error;
338 }
339 
340 static int
341 uhidcancel(dev_t dev, int flag, int mode, struct lwp *l)
342 {
343 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
344 
345 	DPRINTF(("uhidcancel: sc=%p\n", sc));
346 	if (sc == NULL)
347 		return 0;
348 
349 	/*
350 	 * Mark it closing, wake any waiters, and suspend output.
351 	 * After this point, no new xfers can be submitted.
352 	 */
353 	mutex_enter(&sc->sc_lock);
354 	sc->sc_closing = true;
355 	cv_broadcast(&sc->sc_cv);
356 	mutex_exit(&sc->sc_lock);
357 
358 	uhidev_stop(sc->sc_hdev);
359 
360 	return 0;
361 }
362 
363 static int
364 uhidclose(dev_t dev, int flag, int mode, struct lwp *l)
365 {
366 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
367 
368 	DPRINTF(("uhidclose: sc=%p\n", sc));
369 	if (sc == NULL)
370 		return 0;
371 
372 	mutex_enter(&sc->sc_lock);
373 	KASSERT(sc->sc_closing);
374 	KASSERTMSG(sc->sc_open == UHID_OPEN || sc->sc_open == UHID_CLOSED,
375 	    "sc_open=%d", sc->sc_open);
376 	if (sc->sc_open == UHID_CLOSED)
377 		goto out;
378 
379 	/* Release the lock while we free things.  */
380 	mutex_exit(&sc->sc_lock);
381 
382 	/* Prevent further interrupts.  */
383 	uhidev_close(sc->sc_hdev);
384 
385 	/* Hang up all select/poll.  */
386 	selnotify(&sc->sc_rsel, POLLHUP, 0);
387 
388 	/* Reset SIGIO.  */
389 	mutex_enter(&proc_lock);
390 	atomic_store_relaxed(&sc->sc_async, NULL);
391 	mutex_exit(&proc_lock);
392 
393 	/* Free the buffer and queue.  */
394 	if (sc->sc_osize > 0) {
395 		kmem_free(sc->sc_obuf, sc->sc_osize);
396 		sc->sc_obuf = NULL;
397 	}
398 	clfree(&sc->sc_q);
399 
400 	mutex_enter(&sc->sc_lock);
401 
402 	/* All set.  We are now closed.  */
403 	sc->sc_open = UHID_CLOSED;
404 out:	KASSERT(sc->sc_open == UHID_CLOSED);
405 	sc->sc_closing = false;
406 	cv_broadcast(&sc->sc_cv);
407 	atomic_store_relaxed(&sc->sc_state, 0);
408 	mutex_exit(&sc->sc_lock);
409 
410 	return 0;
411 }
412 
413 static int
414 uhidread(dev_t dev, struct uio *uio, int flag)
415 {
416 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
417 	int error = 0;
418 	int extra;
419 	size_t length;
420 	u_char buffer[UHID_CHUNK];
421 	usbd_status err;
422 
423 	DPRINTFN(1, ("uhidread\n"));
424 	if (atomic_load_relaxed(&sc->sc_state) & UHID_IMMED) {
425 		DPRINTFN(1, ("uhidread immed\n"));
426 		extra = sc->sc_report_id != 0;
427 		if (sc->sc_isize + extra > sizeof(buffer))
428 			return ENOBUFS;
429 		err = uhidev_get_report(sc->sc_hdev, UHID_INPUT_REPORT,
430 					buffer, sc->sc_isize + extra);
431 		if (err)
432 			return EIO;
433 		return uiomove(buffer+extra, sc->sc_isize, uio);
434 	}
435 
436 	mutex_enter(&sc->sc_lock);
437 	while (sc->sc_q.c_cc == 0) {
438 		if (flag & IO_NDELAY) {
439 			mutex_exit(&sc->sc_lock);
440 			return EWOULDBLOCK;
441 		}
442 		if (sc->sc_closing) {
443 			mutex_exit(&sc->sc_lock);
444 			return EIO;
445 		}
446 		DPRINTFN(5, ("uhidread: sleep on %p\n", &sc->sc_q));
447 		error = cv_wait_sig(&sc->sc_cv, &sc->sc_lock);
448 		DPRINTFN(5, ("uhidread: woke, error=%d\n", error));
449 		if (error) {
450 			break;
451 		}
452 	}
453 
454 	/* Transfer as many chunks as possible. */
455 	while (sc->sc_q.c_cc > 0 && uio->uio_resid > 0 && !error) {
456 		length = uimin(sc->sc_q.c_cc, uio->uio_resid);
457 		if (length > sizeof(buffer))
458 			length = sizeof(buffer);
459 
460 		/* Remove a small chunk from the input queue. */
461 		(void) q_to_b(&sc->sc_q, buffer, length);
462 		DPRINTFN(5, ("uhidread: got %lu chars\n", (u_long)length));
463 
464 		/* Copy the data to the user process. */
465 		mutex_exit(&sc->sc_lock);
466 		if ((error = uiomove(buffer, length, uio)) != 0)
467 			return error;
468 		mutex_enter(&sc->sc_lock);
469 	}
470 
471 	mutex_exit(&sc->sc_lock);
472 	return error;
473 }
474 
475 static int
476 uhidwrite(dev_t dev, struct uio *uio, int flag)
477 {
478 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
479 	int error;
480 	int size;
481 	usbd_status err;
482 
483 	DPRINTFN(1, ("uhidwrite\n"));
484 
485 	size = sc->sc_osize;
486 	if (uio->uio_resid != size || size == 0)
487 		return EINVAL;
488 	error = uiomove(sc->sc_obuf, size, uio);
489 #ifdef UHID_DEBUG
490 	if (uhiddebug > 5) {
491 		uint32_t i;
492 
493 		DPRINTF(("%s: outdata[%d] =", device_xname(sc->sc_dev),
494 		    error));
495 		for (i = 0; i < size; i++)
496 			DPRINTF((" %02x", sc->sc_obuf[i]));
497 		DPRINTF(("\n"));
498 	}
499 #endif
500 	if (!error) {
501 		if (sc->sc_raw)
502 			err = uhidev_write(sc->sc_hdev, sc->sc_obuf, size);
503 		else
504 			err = uhidev_set_report(sc->sc_hdev,
505 			    UHID_OUTPUT_REPORT, sc->sc_obuf, size);
506 		if (err) {
507 			DPRINTF(("%s: err = %d\n",
508 			    device_xname(sc->sc_dev), err));
509 			error = EIO;
510 		}
511 	}
512 
513 	return error;
514 }
515 
516 static int
517 uhidioctl(dev_t dev, u_long cmd, void *addr, int flag, struct lwp *l)
518 {
519 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
520 	struct usb_ctl_report_desc *rd;
521 	struct usb_ctl_report *re;
522 	u_char buffer[UHID_CHUNK];
523 	int size, extra;
524 	usbd_status err;
525 	void *desc;
526 
527 	DPRINTFN(2, ("uhidioctl: cmd=%lx\n", cmd));
528 
529 	switch (cmd) {
530 	case FIONBIO:
531 		/* All handled in the upper FS layer. */
532 		break;
533 
534 	case FIOASYNC:
535 		mutex_enter(&proc_lock);
536 		if (*(int *)addr) {
537 			if (sc->sc_async != NULL) {
538 				mutex_exit(&proc_lock);
539 				return EBUSY;
540 			}
541 			atomic_store_relaxed(&sc->sc_async, l->l_proc);
542 			DPRINTF(("uhid_do_ioctl: FIOASYNC %p\n", l->l_proc));
543 		} else
544 			atomic_store_relaxed(&sc->sc_async, NULL);
545 		mutex_exit(&proc_lock);
546 		break;
547 
548 	/* XXX this is not the most general solution. */
549 	case TIOCSPGRP:
550 		mutex_enter(&proc_lock);
551 		if (sc->sc_async == NULL) {
552 			mutex_exit(&proc_lock);
553 			return EINVAL;
554 		}
555 		if (*(int *)addr != sc->sc_async->p_pgid) {
556 			mutex_exit(&proc_lock);
557 			return EPERM;
558 		}
559 		mutex_exit(&proc_lock);
560 		break;
561 
562 	case FIOSETOWN:
563 		mutex_enter(&proc_lock);
564 		if (sc->sc_async == NULL) {
565 			mutex_exit(&proc_lock);
566 			return EINVAL;
567 		}
568 		if (-*(int *)addr != sc->sc_async->p_pgid
569 		    && *(int *)addr != sc->sc_async->p_pid) {
570 			mutex_exit(&proc_lock);
571 			return EPERM;
572 		}
573 		mutex_exit(&proc_lock);
574 		break;
575 
576 	case USB_HID_GET_RAW:
577 		*(int *)addr = sc->sc_raw;
578 		break;
579 
580 	case USB_HID_SET_RAW:
581 		sc->sc_raw = *(int *)addr;
582 		break;
583 
584 	case USB_GET_REPORT_DESC:
585 		uhidev_get_report_desc(sc->sc_hdev, &desc, &size);
586 		rd = (struct usb_ctl_report_desc *)addr;
587 		size = uimin(size, sizeof(rd->ucrd_data));
588 		rd->ucrd_size = size;
589 		memcpy(rd->ucrd_data, desc, size);
590 		break;
591 
592 	case USB_SET_IMMED:
593 		if (*(int *)addr) {
594 			extra = sc->sc_report_id != 0;
595 			if (sc->sc_isize + extra > sizeof(buffer))
596 				return ENOBUFS;
597 			err = uhidev_get_report(sc->sc_hdev, UHID_INPUT_REPORT,
598 						buffer, sc->sc_isize + extra);
599 			if (err)
600 				return EOPNOTSUPP;
601 
602 			atomic_or_32(&sc->sc_state, UHID_IMMED);
603 		} else
604 			atomic_and_32(&sc->sc_state, ~UHID_IMMED);
605 		break;
606 
607 	case USB_GET_REPORT:
608 		re = (struct usb_ctl_report *)addr;
609 		switch (re->ucr_report) {
610 		case UHID_INPUT_REPORT:
611 			size = sc->sc_isize;
612 			break;
613 		case UHID_OUTPUT_REPORT:
614 			size = sc->sc_osize;
615 			break;
616 		case UHID_FEATURE_REPORT:
617 			size = sc->sc_fsize;
618 			break;
619 		default:
620 			return EINVAL;
621 		}
622 		extra = sc->sc_report_id != 0;
623 		if (size + extra > sizeof(re->ucr_data))
624 			return ENOBUFS;
625 		err = uhidev_get_report(sc->sc_hdev, re->ucr_report,
626 		    re->ucr_data, size + extra);
627 		if (extra)
628 			memmove(re->ucr_data, re->ucr_data+1, size);
629 		if (err)
630 			return EIO;
631 		break;
632 
633 	case USB_SET_REPORT:
634 		re = (struct usb_ctl_report *)addr;
635 		switch (re->ucr_report) {
636 		case UHID_INPUT_REPORT:
637 			size = sc->sc_isize;
638 			break;
639 		case UHID_OUTPUT_REPORT:
640 			size = sc->sc_osize;
641 			break;
642 		case UHID_FEATURE_REPORT:
643 			size = sc->sc_fsize;
644 			break;
645 		default:
646 			return EINVAL;
647 		}
648 		if (size > sizeof(re->ucr_data))
649 			return ENOBUFS;
650 		err = uhidev_set_report(sc->sc_hdev, re->ucr_report,
651 		    re->ucr_data, size);
652 		if (err)
653 			return EIO;
654 		break;
655 
656 	case USB_GET_REPORT_ID:
657 		*(int *)addr = sc->sc_report_id;
658 		break;
659 
660 	case USB_GET_DEVICE_DESC:
661 		*(usb_device_descriptor_t *)addr =
662 			*usbd_get_device_descriptor(sc->sc_udev);
663 		break;
664 
665 	case USB_GET_DEVICEINFO:
666 		usbd_fill_deviceinfo(sc->sc_udev,
667 				     (struct usb_device_info *)addr, 0);
668 		break;
669 	case USB_GET_DEVICEINFO_OLD:
670 		MODULE_HOOK_CALL(usb_subr_fill_30_hook,
671                     (sc->sc_udev,
672 		      (struct usb_device_info_old *)addr, 0,
673                       usbd_devinfo_vp, usbd_printBCD),
674                     enosys(), err);
675 		if (err == 0)
676 			return 0;
677 		break;
678 	case USB_GET_STRING_DESC:
679 	    {
680 		struct usb_string_desc *si = (struct usb_string_desc *)addr;
681 		err = usbd_get_string_desc(sc->sc_udev,
682 			si->usd_string_index,
683 			si->usd_language_id, &si->usd_desc, &size);
684 		if (err)
685 			return EINVAL;
686 		break;
687 	    }
688 
689 	default:
690 		return EINVAL;
691 	}
692 	return 0;
693 }
694 
695 static int
696 uhidpoll(dev_t dev, int events, struct lwp *l)
697 {
698 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
699 	int revents = 0;
700 
701 	mutex_enter(&sc->sc_lock);
702 	if (events & (POLLOUT | POLLWRNORM))
703 		revents |= events & (POLLOUT | POLLWRNORM);
704 	if (events & (POLLIN | POLLRDNORM)) {
705 		if (sc->sc_q.c_cc > 0)
706 			revents |= events & (POLLIN | POLLRDNORM);
707 		else
708 			selrecord(l, &sc->sc_rsel);
709 	}
710 	mutex_exit(&sc->sc_lock);
711 
712 	return revents;
713 }
714 
715 static void
716 filt_uhidrdetach(struct knote *kn)
717 {
718 	struct uhid_softc *sc = kn->kn_hook;
719 
720 	mutex_enter(&sc->sc_lock);
721 	selremove_knote(&sc->sc_rsel, kn);
722 	mutex_exit(&sc->sc_lock);
723 }
724 
725 static int
726 filt_uhidread(struct knote *kn, long hint)
727 {
728 	struct uhid_softc *sc = kn->kn_hook;
729 
730 	if (hint == NOTE_SUBMIT)
731 		KASSERT(mutex_owned(&sc->sc_lock));
732 	else
733 		mutex_enter(&sc->sc_lock);
734 
735 	kn->kn_data = sc->sc_q.c_cc;
736 
737 	if (hint == NOTE_SUBMIT)
738 		KASSERT(mutex_owned(&sc->sc_lock));
739 	else
740 		mutex_exit(&sc->sc_lock);
741 
742 	return kn->kn_data > 0;
743 }
744 
745 static const struct filterops uhidread_filtops = {
746 	.f_flags = FILTEROP_ISFD,
747 	.f_attach = NULL,
748 	.f_detach = filt_uhidrdetach,
749 	.f_event = filt_uhidread,
750 };
751 
752 static int
753 uhidkqfilter(dev_t dev, struct knote *kn)
754 {
755 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
756 
757 	switch (kn->kn_filter) {
758 	case EVFILT_READ:
759 		kn->kn_fop = &uhidread_filtops;
760 		kn->kn_hook = sc;
761 		mutex_enter(&sc->sc_lock);
762 		selrecord_knote(&sc->sc_rsel, kn);
763 		mutex_exit(&sc->sc_lock);
764 		return 0;
765 
766 	case EVFILT_WRITE:
767 		kn->kn_fop = &seltrue_filtops;
768 		return 0;
769 
770 	default:
771 		return EINVAL;
772 	}
773 }
774