Home | History | Annotate | Line # | Download | only in usb
uhid.c revision 1.114
      1 /*	$NetBSD: uhid.c,v 1.114 2020/05/23 23:42:42 ad Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 1998, 2004, 2008, 2012 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Lennart Augustsson (lennart (at) augustsson.net) at
      9  * Carlstedt Research & Technology and Matthew R. Green (mrg (at) eterna.com.au).
     10  *
     11  * Redistribution and use in source and binary forms, with or without
     12  * modification, are permitted provided that the following conditions
     13  * are met:
     14  * 1. Redistributions of source code must retain the above copyright
     15  *    notice, this list of conditions and the following disclaimer.
     16  * 2. Redistributions in binary form must reproduce the above copyright
     17  *    notice, this list of conditions and the following disclaimer in the
     18  *    documentation and/or other materials provided with the distribution.
     19  *
     20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     30  * POSSIBILITY OF SUCH DAMAGE.
     31  */
     32 
     33 /*
     34  * HID spec: http://www.usb.org/developers/devclass_docs/HID1_11.pdf
     35  */
     36 
     37 #include <sys/cdefs.h>
     38 __KERNEL_RCSID(0, "$NetBSD: uhid.c,v 1.114 2020/05/23 23:42:42 ad Exp $");
     39 
     40 #ifdef _KERNEL_OPT
     41 #include "opt_compat_netbsd.h"
     42 #include "opt_usb.h"
     43 #endif
     44 
     45 #include <sys/param.h>
     46 #include <sys/systm.h>
     47 #include <sys/kernel.h>
     48 #include <sys/kmem.h>
     49 #include <sys/signalvar.h>
     50 #include <sys/device.h>
     51 #include <sys/ioctl.h>
     52 #include <sys/conf.h>
     53 #include <sys/tty.h>
     54 #include <sys/file.h>
     55 #include <sys/select.h>
     56 #include <sys/proc.h>
     57 #include <sys/vnode.h>
     58 #include <sys/poll.h>
     59 #include <sys/intr.h>
     60 #include <sys/compat_stub.h>
     61 
     62 #include <dev/usb/usb.h>
     63 #include <dev/usb/usbhid.h>
     64 
     65 #include <dev/usb/usbdevs.h>
     66 #include <dev/usb/usbdi.h>
     67 #include <dev/usb/usbdi_util.h>
     68 #include <dev/usb/usb_quirks.h>
     69 #include <dev/hid/hid.h>
     70 
     71 #include <dev/usb/uhidev.h>
     72 
     73 #include "ioconf.h"
     74 
     75 #ifdef UHID_DEBUG
     76 #define DPRINTF(x)	if (uhiddebug) printf x
     77 #define DPRINTFN(n,x)	if (uhiddebug>(n)) printf x
     78 int	uhiddebug = 0;
     79 #else
     80 #define DPRINTF(x)
     81 #define DPRINTFN(n,x)
     82 #endif
     83 
     84 struct uhid_softc {
     85 	struct uhidev sc_hdev;
     86 
     87 	kmutex_t sc_access_lock; /* serialises syscall accesses */
     88 	kmutex_t sc_lock;	/* protects refcnt, others */
     89 	kcondvar_t sc_cv;
     90 	kcondvar_t sc_detach_cv;
     91 
     92 	int sc_isize;
     93 	int sc_osize;
     94 	int sc_fsize;
     95 
     96 	u_char *sc_obuf;
     97 
     98 	struct clist sc_q;	/* protected by sc_lock */
     99 	struct selinfo sc_rsel;
    100 	proc_t *sc_async;	/* process that wants SIGIO */
    101 	void *sc_sih;
    102 	u_char sc_state;	/* driver state */
    103 #define	UHID_ASLP	0x01	/* waiting for device data */
    104 #define UHID_IMMED	0x02	/* return read data immediately */
    105 
    106 	int sc_refcnt;
    107 	int sc_raw;
    108 	u_char sc_dying;
    109 };
    110 
    111 #define	UHIDUNIT(dev)	(minor(dev))
    112 #define	UHID_CHUNK	128	/* chunk size for read */
    113 #define	UHID_BSIZE	1020	/* buffer size */
    114 
    115 static dev_type_open(uhidopen);
    116 static dev_type_close(uhidclose);
    117 static dev_type_read(uhidread);
    118 static dev_type_write(uhidwrite);
    119 static dev_type_ioctl(uhidioctl);
    120 static dev_type_poll(uhidpoll);
    121 static dev_type_kqfilter(uhidkqfilter);
    122 
    123 const struct cdevsw uhid_cdevsw = {
    124 	.d_open = uhidopen,
    125 	.d_close = uhidclose,
    126 	.d_read = uhidread,
    127 	.d_write = uhidwrite,
    128 	.d_ioctl = uhidioctl,
    129 	.d_stop = nostop,
    130 	.d_tty = notty,
    131 	.d_poll = uhidpoll,
    132 	.d_mmap = nommap,
    133 	.d_kqfilter = uhidkqfilter,
    134 	.d_discard = nodiscard,
    135 	.d_flag = D_OTHER
    136 };
    137 
    138 Static void uhid_intr(struct uhidev *, void *, u_int);
    139 Static void uhid_softintr(void *);
    140 
    141 Static int uhid_do_read(struct uhid_softc *, struct uio *, int);
    142 Static int uhid_do_write(struct uhid_softc *, struct uio *, int);
    143 Static int uhid_do_ioctl(struct uhid_softc*, u_long, void *, int, struct lwp *);
    144 
    145 static int	uhid_match(device_t, cfdata_t, void *);
    146 static void	uhid_attach(device_t, device_t, void *);
    147 static int	uhid_detach(device_t, int);
    148 static int	uhid_activate(device_t, enum devact);
    149 
    150 CFATTACH_DECL_NEW(uhid, sizeof(struct uhid_softc), uhid_match, uhid_attach,
    151     uhid_detach, uhid_activate);
    152 
    153 static int
    154 uhid_match(device_t parent, cfdata_t match, void *aux)
    155 {
    156 #ifdef UHID_DEBUG
    157 	struct uhidev_attach_arg *uha = aux;
    158 #endif
    159 
    160 	DPRINTF(("uhid_match: report=%d\n", uha->reportid));
    161 
    162 	if (match->cf_flags & 1)
    163 		return UMATCH_HIGHEST;
    164 	else
    165 		return UMATCH_IFACECLASS_GENERIC;
    166 }
    167 
    168 static void
    169 uhid_attach(device_t parent, device_t self, void *aux)
    170 {
    171 	struct uhid_softc *sc = device_private(self);
    172 	struct uhidev_attach_arg *uha = aux;
    173 	int size, repid;
    174 	void *desc;
    175 
    176 	sc->sc_hdev.sc_dev = self;
    177 	selinit(&sc->sc_rsel);
    178 	sc->sc_hdev.sc_intr = uhid_intr;
    179 	sc->sc_hdev.sc_parent = uha->parent;
    180 	sc->sc_hdev.sc_report_id = uha->reportid;
    181 	sc->sc_sih = softint_establish(SOFTINT_CLOCK, uhid_softintr, sc);
    182 
    183 	uhidev_get_report_desc(uha->parent, &desc, &size);
    184 	repid = uha->reportid;
    185 	sc->sc_isize = hid_report_size(desc, size, hid_input,   repid);
    186 	sc->sc_osize = hid_report_size(desc, size, hid_output,  repid);
    187 	sc->sc_fsize = hid_report_size(desc, size, hid_feature, repid);
    188 	sc->sc_raw =  hid_is_collection(desc, size, uha->reportid,
    189 	    HID_USAGE2(HUP_FIDO, HUF_U2FHID));
    190 
    191 	aprint_naive("\n");
    192 	aprint_normal(": input=%d, output=%d, feature=%d\n",
    193 	       sc->sc_isize, sc->sc_osize, sc->sc_fsize);
    194 
    195 	mutex_init(&sc->sc_access_lock, MUTEX_DEFAULT, IPL_NONE);
    196 	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_SOFTUSB);
    197 	cv_init(&sc->sc_cv, "uhidrea");
    198 	cv_init(&sc->sc_detach_cv, "uhiddet");
    199 
    200 	if (!pmf_device_register(self, NULL, NULL))
    201 		aprint_error_dev(self, "couldn't establish power handler\n");
    202 
    203 	return;
    204 }
    205 
    206 static int
    207 uhid_activate(device_t self, enum devact act)
    208 {
    209 	struct uhid_softc *sc = device_private(self);
    210 
    211 	switch (act) {
    212 	case DVACT_DEACTIVATE:
    213 		sc->sc_dying = 1;
    214 		return 0;
    215 	default:
    216 		return EOPNOTSUPP;
    217 	}
    218 }
    219 
    220 static int
    221 uhid_detach(device_t self, int flags)
    222 {
    223 	struct uhid_softc *sc = device_private(self);
    224 	int maj, mn;
    225 
    226 	DPRINTF(("uhid_detach: sc=%p flags=%d\n", sc, flags));
    227 
    228 	sc->sc_dying = 1;
    229 
    230 	pmf_device_deregister(self);
    231 
    232 	mutex_enter(&sc->sc_lock);
    233 	if (sc->sc_hdev.sc_state & UHIDEV_OPEN) {
    234 		if (--sc->sc_refcnt >= 0) {
    235 			/* Wake everyone */
    236 			cv_broadcast(&sc->sc_cv);
    237 			/* Wait for processes to go away. */
    238 			if (cv_timedwait(&sc->sc_detach_cv, &sc->sc_lock, hz * 60))
    239 				aprint_error_dev(self, ": didn't detach\n");
    240 		}
    241 	}
    242 	mutex_exit(&sc->sc_lock);
    243 
    244 	/* locate the major number */
    245 	maj = cdevsw_lookup_major(&uhid_cdevsw);
    246 
    247 	/* Nuke the vnodes for any open instances (calls close). */
    248 	mn = device_unit(self);
    249 	vdevgone(maj, mn, mn, VCHR);
    250 
    251 #if 0
    252 	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH,
    253 	    sc->sc_hdev.sc_parent->sc_udev, sc->sc_hdev.sc_dev);
    254 #endif
    255 	cv_destroy(&sc->sc_cv);
    256 	cv_destroy(&sc->sc_detach_cv);
    257 	mutex_destroy(&sc->sc_lock);
    258 	mutex_destroy(&sc->sc_access_lock);
    259 	seldestroy(&sc->sc_rsel);
    260 	softint_disestablish(sc->sc_sih);
    261 
    262 	return 0;
    263 }
    264 
    265 void
    266 uhid_intr(struct uhidev *addr, void *data, u_int len)
    267 {
    268 	struct uhid_softc *sc = (struct uhid_softc *)addr;
    269 
    270 #ifdef UHID_DEBUG
    271 	if (uhiddebug > 5) {
    272 		uint32_t i;
    273 
    274 		DPRINTF(("uhid_intr: data ="));
    275 		for (i = 0; i < len; i++)
    276 			DPRINTF((" %02x", ((u_char *)data)[i]));
    277 		DPRINTF(("\n"));
    278 	}
    279 #endif
    280 
    281 	mutex_enter(&sc->sc_lock);
    282 	(void)b_to_q(data, len, &sc->sc_q);
    283 
    284 	if (sc->sc_state & UHID_ASLP) {
    285 		sc->sc_state &= ~UHID_ASLP;
    286 		DPRINTFN(5, ("uhid_intr: waking %p\n", &sc->sc_q));
    287 		cv_broadcast(&sc->sc_cv);
    288 	}
    289 	selnotify(&sc->sc_rsel, 0, 0);
    290 	if (sc->sc_async != NULL) {
    291 		DPRINTFN(3, ("uhid_intr: sending SIGIO %p\n", sc->sc_async));
    292 		softint_schedule(sc->sc_sih);
    293 	}
    294 	mutex_exit(&sc->sc_lock);
    295 }
    296 
    297 void
    298 uhid_softintr(void *cookie)
    299 {
    300 	struct uhid_softc *sc;
    301 
    302 	sc = cookie;
    303 
    304 	mutex_enter(&proc_lock);
    305 	if (sc->sc_async != NULL)
    306 		 psignal(sc->sc_async, SIGIO);
    307 	mutex_exit(&proc_lock);
    308 }
    309 
    310 static int
    311 uhidopen(dev_t dev, int flag, int mode, struct lwp *l)
    312 {
    313 	struct uhid_softc *sc;
    314 	int error;
    315 
    316 	sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    317 	if (sc == NULL)
    318 		return ENXIO;
    319 
    320 	DPRINTF(("uhidopen: sc=%p\n", sc));
    321 
    322 	if (sc->sc_dying)
    323 		return ENXIO;
    324 
    325 	mutex_enter(&sc->sc_lock);
    326 
    327 	/*
    328 	 * uhid interrupts aren't enabled yet, so setup sc_q now, as
    329 	 * long as they're not already allocated.
    330 	 */
    331 	if (sc->sc_hdev.sc_state & UHIDEV_OPEN) {
    332 		mutex_exit(&sc->sc_lock);
    333 		return EBUSY;
    334 	}
    335 	mutex_exit(&sc->sc_lock);
    336 
    337 	if (clalloc(&sc->sc_q, UHID_BSIZE, 0) == -1) {
    338 		return ENOMEM;
    339 	}
    340 
    341 	mutex_enter(&sc->sc_access_lock);
    342 	error = uhidev_open(&sc->sc_hdev);
    343 	if (error) {
    344 		clfree(&sc->sc_q);
    345 		mutex_exit(&sc->sc_access_lock);
    346 		return error;
    347 	}
    348 	mutex_exit(&sc->sc_access_lock);
    349 
    350 	if (sc->sc_osize > 0)
    351 		sc->sc_obuf = kmem_alloc(sc->sc_osize, KM_SLEEP);
    352 	else
    353 		sc->sc_obuf = NULL;
    354 	sc->sc_state &= ~UHID_IMMED;
    355 
    356 	mutex_enter(&proc_lock);
    357 	sc->sc_async = NULL;
    358 	mutex_exit(&proc_lock);
    359 
    360 	return 0;
    361 }
    362 
    363 static int
    364 uhidclose(dev_t dev, int flag, int mode, struct lwp *l)
    365 {
    366 	struct uhid_softc *sc;
    367 
    368 	sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    369 
    370 	DPRINTF(("uhidclose: sc=%p\n", sc));
    371 
    372 	mutex_enter(&proc_lock);
    373 	sc->sc_async = NULL;
    374 	mutex_exit(&proc_lock);
    375 
    376 	mutex_enter(&sc->sc_access_lock);
    377 
    378 	uhidev_stop(&sc->sc_hdev);
    379 
    380 	clfree(&sc->sc_q);
    381 	if (sc->sc_osize > 0)
    382 		kmem_free(sc->sc_obuf, sc->sc_osize);
    383 
    384 	uhidev_close(&sc->sc_hdev);
    385 
    386 	mutex_exit(&sc->sc_access_lock);
    387 
    388 	return 0;
    389 }
    390 
    391 Static int
    392 uhid_do_read(struct uhid_softc *sc, struct uio *uio, int flag)
    393 {
    394 	int error = 0;
    395 	int extra;
    396 	size_t length;
    397 	u_char buffer[UHID_CHUNK];
    398 	usbd_status err;
    399 
    400 	DPRINTFN(1, ("uhidread\n"));
    401 	if (sc->sc_state & UHID_IMMED) {
    402 		DPRINTFN(1, ("uhidread immed\n"));
    403 		extra = sc->sc_hdev.sc_report_id != 0;
    404 		if (sc->sc_isize + extra > sizeof(buffer))
    405 			return ENOBUFS;
    406 		err = uhidev_get_report(&sc->sc_hdev, UHID_INPUT_REPORT,
    407 					buffer, sc->sc_isize + extra);
    408 		if (err)
    409 			return EIO;
    410 		return uiomove(buffer+extra, sc->sc_isize, uio);
    411 	}
    412 
    413 	mutex_enter(&sc->sc_lock);
    414 	while (sc->sc_q.c_cc == 0) {
    415 		if (flag & IO_NDELAY) {
    416 			mutex_exit(&sc->sc_lock);
    417 			return EWOULDBLOCK;
    418 		}
    419 		sc->sc_state |= UHID_ASLP;
    420 		DPRINTFN(5, ("uhidread: sleep on %p\n", &sc->sc_q));
    421 		error = cv_wait_sig(&sc->sc_cv, &sc->sc_lock);
    422 		DPRINTFN(5, ("uhidread: woke, error=%d\n", error));
    423 		if (sc->sc_dying)
    424 			error = EIO;
    425 		if (error) {
    426 			sc->sc_state &= ~UHID_ASLP;
    427 			break;
    428 		}
    429 	}
    430 
    431 	/* Transfer as many chunks as possible. */
    432 	while (sc->sc_q.c_cc > 0 && uio->uio_resid > 0 && !error) {
    433 		length = uimin(sc->sc_q.c_cc, uio->uio_resid);
    434 		if (length > sizeof(buffer))
    435 			length = sizeof(buffer);
    436 
    437 		/* Remove a small chunk from the input queue. */
    438 		(void) q_to_b(&sc->sc_q, buffer, length);
    439 		DPRINTFN(5, ("uhidread: got %lu chars\n", (u_long)length));
    440 
    441 		/* Copy the data to the user process. */
    442 		mutex_exit(&sc->sc_lock);
    443 		if ((error = uiomove(buffer, length, uio)) != 0)
    444 			return error;
    445 		mutex_enter(&sc->sc_lock);
    446 	}
    447 
    448 	mutex_exit(&sc->sc_lock);
    449 	return error;
    450 }
    451 
    452 static int
    453 uhidread(dev_t dev, struct uio *uio, int flag)
    454 {
    455 	struct uhid_softc *sc;
    456 	int error;
    457 
    458 	sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    459 
    460 	mutex_enter(&sc->sc_lock);
    461 	sc->sc_refcnt++;
    462 	mutex_exit(&sc->sc_lock);
    463 
    464 	mutex_enter(&sc->sc_access_lock);
    465 	error = uhid_do_read(sc, uio, flag);
    466 	mutex_exit(&sc->sc_access_lock);
    467 
    468 	mutex_enter(&sc->sc_lock);
    469 	if (--sc->sc_refcnt < 0)
    470 		cv_broadcast(&sc->sc_detach_cv);
    471 	mutex_exit(&sc->sc_lock);
    472 	return error;
    473 }
    474 
    475 Static int
    476 uhid_do_write(struct uhid_softc *sc, struct uio *uio, int flag)
    477 {
    478 	int error;
    479 	int size;
    480 	usbd_status err;
    481 
    482 	DPRINTFN(1, ("uhidwrite\n"));
    483 
    484 	if (sc->sc_dying)
    485 		return EIO;
    486 
    487 	size = sc->sc_osize;
    488 	if (uio->uio_resid != size || size == 0)
    489 		return EINVAL;
    490 	error = uiomove(sc->sc_obuf, size, uio);
    491 #ifdef UHID_DEBUG
    492 	if (uhiddebug > 5) {
    493 		uint32_t i;
    494 
    495 		DPRINTF(("%s: outdata[%d] =", device_xname(sc->sc_hdev.sc_dev),
    496 		    error));
    497 		for (i = 0; i < size; i++)
    498 			DPRINTF((" %02x", sc->sc_obuf[i]));
    499 		DPRINTF(("\n"));
    500 	}
    501 #endif
    502 	if (!error) {
    503 		if (sc->sc_raw)
    504 			err = uhidev_write(sc->sc_hdev.sc_parent, sc->sc_obuf,
    505 			    size);
    506 		else
    507 			err = uhidev_set_report(&sc->sc_hdev,
    508 			    UHID_OUTPUT_REPORT, sc->sc_obuf, size);
    509 		if (err) {
    510 			DPRINTF(("%s: err = %d\n",
    511 			    device_xname(sc->sc_hdev.sc_dev), err));
    512 			error = EIO;
    513 		}
    514 	}
    515 
    516 	return error;
    517 }
    518 
    519 int
    520 uhidwrite(dev_t dev, struct uio *uio, int flag)
    521 {
    522 	struct uhid_softc *sc;
    523 	int error;
    524 
    525 	sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    526 
    527 	mutex_enter(&sc->sc_lock);
    528 	sc->sc_refcnt++;
    529 	mutex_exit(&sc->sc_lock);
    530 
    531 	mutex_enter(&sc->sc_access_lock);
    532 	error = uhid_do_write(sc, uio, flag);
    533 	mutex_exit(&sc->sc_access_lock);
    534 
    535 	mutex_enter(&sc->sc_lock);
    536 	if (--sc->sc_refcnt < 0)
    537 		cv_broadcast(&sc->sc_detach_cv);
    538 	mutex_exit(&sc->sc_lock);
    539 	return error;
    540 }
    541 
    542 int
    543 uhid_do_ioctl(struct uhid_softc *sc, u_long cmd, void *addr,
    544     int flag, struct lwp *l)
    545 {
    546 	struct usb_ctl_report_desc *rd;
    547 	struct usb_ctl_report *re;
    548 	u_char buffer[UHID_CHUNK];
    549 	int size, extra;
    550 	usbd_status err;
    551 	void *desc;
    552 
    553 	DPRINTFN(2, ("uhidioctl: cmd=%lx\n", cmd));
    554 
    555 	if (sc->sc_dying)
    556 		return EIO;
    557 
    558 	switch (cmd) {
    559 	case FIONBIO:
    560 		/* All handled in the upper FS layer. */
    561 		break;
    562 
    563 	case FIOASYNC:
    564 		mutex_enter(&proc_lock);
    565 		if (*(int *)addr) {
    566 			if (sc->sc_async != NULL) {
    567 				mutex_exit(&proc_lock);
    568 				return EBUSY;
    569 			}
    570 			sc->sc_async = l->l_proc;
    571 			DPRINTF(("uhid_do_ioctl: FIOASYNC %p\n", l->l_proc));
    572 		} else
    573 			sc->sc_async = NULL;
    574 		mutex_exit(&proc_lock);
    575 		break;
    576 
    577 	/* XXX this is not the most general solution. */
    578 	case TIOCSPGRP:
    579 		mutex_enter(&proc_lock);
    580 		if (sc->sc_async == NULL) {
    581 			mutex_exit(&proc_lock);
    582 			return EINVAL;
    583 		}
    584 		if (*(int *)addr != sc->sc_async->p_pgid) {
    585 			mutex_exit(&proc_lock);
    586 			return EPERM;
    587 		}
    588 		mutex_exit(&proc_lock);
    589 		break;
    590 
    591 	case FIOSETOWN:
    592 		mutex_enter(&proc_lock);
    593 		if (sc->sc_async == NULL) {
    594 			mutex_exit(&proc_lock);
    595 			return EINVAL;
    596 		}
    597 		if (-*(int *)addr != sc->sc_async->p_pgid
    598 		    && *(int *)addr != sc->sc_async->p_pid) {
    599 			mutex_exit(&proc_lock);
    600 			return EPERM;
    601 		}
    602 		mutex_exit(&proc_lock);
    603 		break;
    604 
    605 	case USB_HID_GET_RAW:
    606 		*(int *)addr = sc->sc_raw;
    607 		break;
    608 
    609 	case USB_HID_SET_RAW:
    610 		sc->sc_raw = *(int *)addr;
    611 		break;
    612 
    613 	case USB_GET_REPORT_DESC:
    614 		uhidev_get_report_desc(sc->sc_hdev.sc_parent, &desc, &size);
    615 		rd = (struct usb_ctl_report_desc *)addr;
    616 		size = uimin(size, sizeof(rd->ucrd_data));
    617 		rd->ucrd_size = size;
    618 		memcpy(rd->ucrd_data, desc, size);
    619 		break;
    620 
    621 	case USB_SET_IMMED:
    622 		if (*(int *)addr) {
    623 			extra = sc->sc_hdev.sc_report_id != 0;
    624 			if (sc->sc_isize + extra > sizeof(buffer))
    625 				return ENOBUFS;
    626 			err = uhidev_get_report(&sc->sc_hdev, UHID_INPUT_REPORT,
    627 						buffer, sc->sc_isize + extra);
    628 			if (err)
    629 				return EOPNOTSUPP;
    630 
    631 			sc->sc_state |=  UHID_IMMED;
    632 		} else
    633 			sc->sc_state &= ~UHID_IMMED;
    634 		break;
    635 
    636 	case USB_GET_REPORT:
    637 		re = (struct usb_ctl_report *)addr;
    638 		switch (re->ucr_report) {
    639 		case UHID_INPUT_REPORT:
    640 			size = sc->sc_isize;
    641 			break;
    642 		case UHID_OUTPUT_REPORT:
    643 			size = sc->sc_osize;
    644 			break;
    645 		case UHID_FEATURE_REPORT:
    646 			size = sc->sc_fsize;
    647 			break;
    648 		default:
    649 			return EINVAL;
    650 		}
    651 		extra = sc->sc_hdev.sc_report_id != 0;
    652 		if (size + extra > sizeof(re->ucr_data))
    653 			return ENOBUFS;
    654 		err = uhidev_get_report(&sc->sc_hdev, re->ucr_report,
    655 		    re->ucr_data, size + extra);
    656 		if (extra)
    657 			memmove(re->ucr_data, re->ucr_data+1, size);
    658 		if (err)
    659 			return EIO;
    660 		break;
    661 
    662 	case USB_SET_REPORT:
    663 		re = (struct usb_ctl_report *)addr;
    664 		switch (re->ucr_report) {
    665 		case UHID_INPUT_REPORT:
    666 			size = sc->sc_isize;
    667 			break;
    668 		case UHID_OUTPUT_REPORT:
    669 			size = sc->sc_osize;
    670 			break;
    671 		case UHID_FEATURE_REPORT:
    672 			size = sc->sc_fsize;
    673 			break;
    674 		default:
    675 			return EINVAL;
    676 		}
    677 		if (size > sizeof(re->ucr_data))
    678 			return ENOBUFS;
    679 		err = uhidev_set_report(&sc->sc_hdev, re->ucr_report,
    680 		    re->ucr_data, size);
    681 		if (err)
    682 			return EIO;
    683 		break;
    684 
    685 	case USB_GET_REPORT_ID:
    686 		*(int *)addr = sc->sc_hdev.sc_report_id;
    687 		break;
    688 
    689 	case USB_GET_DEVICE_DESC:
    690 		*(usb_device_descriptor_t *)addr =
    691 			*usbd_get_device_descriptor(sc->sc_hdev.sc_parent->sc_udev);
    692 		break;
    693 
    694 	case USB_GET_DEVICEINFO:
    695 		usbd_fill_deviceinfo(sc->sc_hdev.sc_parent->sc_udev,
    696 				     (struct usb_device_info *)addr, 0);
    697 		break;
    698 	case USB_GET_DEVICEINFO_OLD:
    699 		MODULE_HOOK_CALL(usb_subr_fill_30_hook,
    700                     (sc->sc_hdev.sc_parent->sc_udev,
    701 		      (struct usb_device_info_old *)addr, 0,
    702                       usbd_devinfo_vp, usbd_printBCD),
    703                     enosys(), err);
    704 		if (err == 0)
    705 			return 0;
    706 		break;
    707 	case USB_GET_STRING_DESC:
    708 	    {
    709 		struct usb_string_desc *si = (struct usb_string_desc *)addr;
    710 		err = usbd_get_string_desc(sc->sc_hdev.sc_parent->sc_udev,
    711 			si->usd_string_index,
    712 			si->usd_language_id, &si->usd_desc, &size);
    713 		if (err)
    714 			return EINVAL;
    715 		break;
    716 	    }
    717 
    718 	default:
    719 		return EINVAL;
    720 	}
    721 	return 0;
    722 }
    723 
    724 static int
    725 uhidioctl(dev_t dev, u_long cmd, void *addr, int flag, struct lwp *l)
    726 {
    727 	struct uhid_softc *sc;
    728 	int error;
    729 
    730 	sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    731 	if (sc == NULL)
    732 		return ENXIO;
    733 
    734 	if (sc->sc_dying)
    735 		return EIO;
    736 
    737 	mutex_enter(&sc->sc_lock);
    738 	sc->sc_refcnt++;
    739 	mutex_exit(&sc->sc_lock);
    740 
    741 	mutex_enter(&sc->sc_access_lock);
    742 	error = uhid_do_ioctl(sc, cmd, addr, flag, l);
    743 	mutex_exit(&sc->sc_access_lock);
    744 
    745 	mutex_enter(&sc->sc_lock);
    746 	if (--sc->sc_refcnt < 0)
    747 		cv_broadcast(&sc->sc_detach_cv);
    748 	mutex_exit(&sc->sc_lock);
    749 	return error;
    750 }
    751 
    752 static int
    753 uhidpoll(dev_t dev, int events, struct lwp *l)
    754 {
    755 	struct uhid_softc *sc;
    756 	int revents = 0;
    757 
    758 	sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    759 	if (sc == NULL)
    760 		return ENXIO;
    761 
    762 	if (sc->sc_dying)
    763 		return EIO;
    764 
    765 	mutex_enter(&sc->sc_lock);
    766 	if (events & (POLLOUT | POLLWRNORM))
    767 		revents |= events & (POLLOUT | POLLWRNORM);
    768 	if (events & (POLLIN | POLLRDNORM)) {
    769 		if (sc->sc_q.c_cc > 0)
    770 			revents |= events & (POLLIN | POLLRDNORM);
    771 		else
    772 			selrecord(l, &sc->sc_rsel);
    773 	}
    774 	mutex_exit(&sc->sc_lock);
    775 
    776 	return revents;
    777 }
    778 
    779 static void
    780 filt_uhidrdetach(struct knote *kn)
    781 {
    782 	struct uhid_softc *sc = kn->kn_hook;
    783 
    784 	mutex_enter(&sc->sc_lock);
    785 	SLIST_REMOVE(&sc->sc_rsel.sel_klist, kn, knote, kn_selnext);
    786 	mutex_exit(&sc->sc_lock);
    787 }
    788 
    789 static int
    790 filt_uhidread(struct knote *kn, long hint)
    791 {
    792 	struct uhid_softc *sc = kn->kn_hook;
    793 
    794 	kn->kn_data = sc->sc_q.c_cc;
    795 	return kn->kn_data > 0;
    796 }
    797 
    798 static const struct filterops uhidread_filtops = {
    799 	.f_isfd = 1,
    800 	.f_attach = NULL,
    801 	.f_detach = filt_uhidrdetach,
    802 	.f_event = filt_uhidread,
    803 };
    804 
    805 static const struct filterops uhid_seltrue_filtops = {
    806 	.f_isfd = 1,
    807 	.f_attach = NULL,
    808 	.f_detach = filt_uhidrdetach,
    809 	.f_event = filt_seltrue,
    810 };
    811 
    812 static int
    813 uhidkqfilter(dev_t dev, struct knote *kn)
    814 {
    815 	struct uhid_softc *sc;
    816 	struct klist *klist;
    817 
    818 	sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    819 
    820 	if (sc->sc_dying)
    821 		return ENXIO;
    822 
    823 	switch (kn->kn_filter) {
    824 	case EVFILT_READ:
    825 		klist = &sc->sc_rsel.sel_klist;
    826 		kn->kn_fop = &uhidread_filtops;
    827 		break;
    828 
    829 	case EVFILT_WRITE:
    830 		klist = &sc->sc_rsel.sel_klist;
    831 		kn->kn_fop = &uhid_seltrue_filtops;
    832 		break;
    833 
    834 	default:
    835 		return EINVAL;
    836 	}
    837 
    838 	kn->kn_hook = sc;
    839 
    840 	mutex_enter(&sc->sc_lock);
    841 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
    842 	mutex_exit(&sc->sc_lock);
    843 
    844 	return 0;
    845 }
    846