Home | History | Annotate | Line # | Download | only in usb
uhid.c revision 1.125
      1 /*	$NetBSD: uhid.c,v 1.125 2022/03/31 17:43:50 christos Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 1998, 2004, 2008, 2012 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Lennart Augustsson (lennart (at) augustsson.net) at
      9  * Carlstedt Research & Technology and Matthew R. Green (mrg (at) eterna.com.au).
     10  *
     11  * Redistribution and use in source and binary forms, with or without
     12  * modification, are permitted provided that the following conditions
     13  * are met:
     14  * 1. Redistributions of source code must retain the above copyright
     15  *    notice, this list of conditions and the following disclaimer.
     16  * 2. Redistributions in binary form must reproduce the above copyright
     17  *    notice, this list of conditions and the following disclaimer in the
     18  *    documentation and/or other materials provided with the distribution.
     19  *
     20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     30  * POSSIBILITY OF SUCH DAMAGE.
     31  */
     32 
     33 /*
     34  * HID spec: http://www.usb.org/developers/devclass_docs/HID1_11.pdf
     35  */
     36 
     37 #include <sys/cdefs.h>
     38 __KERNEL_RCSID(0, "$NetBSD: uhid.c,v 1.125 2022/03/31 17:43:50 christos Exp $");
     39 
     40 #ifdef _KERNEL_OPT
     41 #include "opt_compat_netbsd.h"
     42 #include "opt_usb.h"
     43 #endif
     44 
     45 #include <sys/param.h>
     46 #include <sys/types.h>
     47 
     48 #include <sys/atomic.h>
     49 #include <sys/compat_stub.h>
     50 #include <sys/conf.h>
     51 #include <sys/device.h>
     52 #include <sys/file.h>
     53 #include <sys/intr.h>
     54 #include <sys/ioctl.h>
     55 #include <sys/kernel.h>
     56 #include <sys/kmem.h>
     57 #include <sys/poll.h>
     58 #include <sys/proc.h>
     59 #include <sys/select.h>
     60 #include <sys/signalvar.h>
     61 #include <sys/systm.h>
     62 #include <sys/tty.h>
     63 #include <sys/vnode.h>
     64 
     65 #include <dev/usb/usb.h>
     66 #include <dev/usb/usbhid.h>
     67 
     68 #include <dev/usb/usbdevs.h>
     69 #include <dev/usb/usbdi.h>
     70 #include <dev/usb/usbdi_util.h>
     71 #include <dev/usb/usb_quirks.h>
     72 #include <dev/hid/hid.h>
     73 
     74 #include <dev/usb/uhidev.h>
     75 
     76 #include "ioconf.h"
     77 
     78 #ifdef UHID_DEBUG
     79 #define DPRINTF(x)	if (uhiddebug) printf x
     80 #define DPRINTFN(n,x)	if (uhiddebug>(n)) printf x
     81 int	uhiddebug = 0;
     82 #else
     83 #define DPRINTF(x)
     84 #define DPRINTFN(n,x)
     85 #endif
     86 
     87 struct uhid_softc {
     88 	device_t sc_dev;
     89 	struct uhidev *sc_hdev;
     90 	struct usbd_device *sc_udev;
     91 	uint8_t sc_report_id;
     92 
     93 	kmutex_t sc_lock;
     94 	kcondvar_t sc_cv;
     95 
     96 	int sc_isize;
     97 	int sc_osize;
     98 	int sc_fsize;
     99 
    100 	u_char *sc_obuf;
    101 
    102 	struct clist sc_q;	/* protected by sc_lock */
    103 	struct selinfo sc_rsel;
    104 	proc_t *sc_async;	/* process that wants SIGIO */
    105 	void *sc_sih;
    106 	volatile uint32_t sc_state;	/* driver state */
    107 #define UHID_IMMED	0x02	/* return read data immediately */
    108 
    109 	int sc_raw;
    110 	enum {
    111 		UHID_CLOSED,
    112 		UHID_OPENING,
    113 		UHID_OPEN,
    114 	} sc_open;
    115 	bool sc_closing;
    116 };
    117 
    118 #define	UHIDUNIT(dev)	(minor(dev))
    119 #define	UHID_CHUNK	128	/* chunk size for read */
    120 #define	UHID_BSIZE	1020	/* buffer size */
    121 
    122 static dev_type_open(uhidopen);
    123 static dev_type_cancel(uhidcancel);
    124 static dev_type_close(uhidclose);
    125 static dev_type_read(uhidread);
    126 static dev_type_write(uhidwrite);
    127 static dev_type_ioctl(uhidioctl);
    128 static dev_type_poll(uhidpoll);
    129 static dev_type_kqfilter(uhidkqfilter);
    130 
    131 const struct cdevsw uhid_cdevsw = {
    132 	.d_open = uhidopen,
    133 	.d_cancel = uhidcancel,
    134 	.d_close = uhidclose,
    135 	.d_read = uhidread,
    136 	.d_write = uhidwrite,
    137 	.d_ioctl = uhidioctl,
    138 	.d_stop = nostop,
    139 	.d_tty = notty,
    140 	.d_poll = uhidpoll,
    141 	.d_mmap = nommap,
    142 	.d_kqfilter = uhidkqfilter,
    143 	.d_discard = nodiscard,
    144 	.d_cfdriver = &uhid_cd,
    145 	.d_devtounit = dev_minor_unit,
    146 	.d_flag = D_OTHER
    147 };
    148 
    149 static void uhid_intr(void *, void *, u_int);
    150 
    151 static int	uhid_match(device_t, cfdata_t, void *);
    152 static void	uhid_attach(device_t, device_t, void *);
    153 static int	uhid_detach(device_t, int);
    154 
    155 CFATTACH_DECL_NEW(uhid, sizeof(struct uhid_softc), uhid_match, uhid_attach,
    156     uhid_detach, NULL);
    157 
    158 static int
    159 uhid_match(device_t parent, cfdata_t match, void *aux)
    160 {
    161 #ifdef UHID_DEBUG
    162 	struct uhidev_attach_arg *uha = aux;
    163 #endif
    164 
    165 	DPRINTF(("uhid_match: report=%d\n", uha->reportid));
    166 
    167 	if (match->cf_flags & 1)
    168 		return UMATCH_HIGHEST;
    169 	else
    170 		return UMATCH_IFACECLASS_GENERIC;
    171 }
    172 
    173 static void
    174 uhid_attach(device_t parent, device_t self, void *aux)
    175 {
    176 	struct uhid_softc *sc = device_private(self);
    177 	struct uhidev_attach_arg *uha = aux;
    178 	int size, repid;
    179 	void *desc;
    180 
    181 	sc->sc_dev = self;
    182 	sc->sc_hdev = uha->parent;
    183 	sc->sc_udev = uha->uiaa->uiaa_device;
    184 	sc->sc_report_id = uha->reportid;
    185 
    186 	selinit(&sc->sc_rsel);
    187 
    188 	uhidev_get_report_desc(uha->parent, &desc, &size);
    189 	repid = uha->reportid;
    190 	sc->sc_isize = hid_report_size(desc, size, hid_input,   repid);
    191 	sc->sc_osize = hid_report_size(desc, size, hid_output,  repid);
    192 	sc->sc_fsize = hid_report_size(desc, size, hid_feature, repid);
    193 	sc->sc_raw =  hid_is_collection(desc, size, uha->reportid,
    194 	    HID_USAGE2(HUP_FIDO, HUF_U2FHID));
    195 
    196 	aprint_naive("\n");
    197 	aprint_normal(": input=%d, output=%d, feature=%d\n",
    198 	       sc->sc_isize, sc->sc_osize, sc->sc_fsize);
    199 
    200 	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_SOFTUSB);
    201 	cv_init(&sc->sc_cv, "uhidrea");
    202 
    203 	if (!pmf_device_register(self, NULL, NULL))
    204 		aprint_error_dev(self, "couldn't establish power handler\n");
    205 
    206 	return;
    207 }
    208 
    209 static int
    210 uhid_detach(device_t self, int flags)
    211 {
    212 	struct uhid_softc *sc = device_private(self);
    213 	int maj, mn;
    214 
    215 	DPRINTF(("uhid_detach: sc=%p flags=%d\n", sc, flags));
    216 
    217 	pmf_device_deregister(self);
    218 
    219 	/* locate the major number */
    220 	maj = cdevsw_lookup_major(&uhid_cdevsw);
    221 
    222 	/* Nuke the vnodes for any open instances (calls close). */
    223 	mn = device_unit(self);
    224 	vdevgone(maj, mn, mn, VCHR);
    225 
    226 	KASSERTMSG(sc->sc_open == UHID_CLOSED, "open=%d", (int)sc->sc_open);
    227 
    228 	cv_destroy(&sc->sc_cv);
    229 	mutex_destroy(&sc->sc_lock);
    230 	seldestroy(&sc->sc_rsel);
    231 
    232 	return 0;
    233 }
    234 
    235 static void
    236 uhid_intr(void *cookie, void *data, u_int len)
    237 {
    238 	struct uhid_softc *sc = cookie;
    239 
    240 #ifdef UHID_DEBUG
    241 	if (uhiddebug > 5) {
    242 		uint32_t i;
    243 
    244 		DPRINTF(("uhid_intr: data ="));
    245 		for (i = 0; i < len; i++)
    246 			DPRINTF((" %02x", ((u_char *)data)[i]));
    247 		DPRINTF(("\n"));
    248 	}
    249 #endif
    250 
    251 	mutex_enter(&sc->sc_lock);
    252 	(void)b_to_q(data, len, &sc->sc_q);
    253 
    254 	DPRINTFN(5, ("uhid_intr: waking %p\n", &sc->sc_q));
    255 	cv_broadcast(&sc->sc_cv);
    256 	selnotify(&sc->sc_rsel, 0, NOTE_SUBMIT);
    257 	if (atomic_load_relaxed(&sc->sc_async) != NULL) {
    258 		mutex_enter(&proc_lock);
    259 		if (sc->sc_async != NULL) {
    260 			DPRINTFN(3, ("uhid_intr: sending SIGIO to %jd\n",
    261 				(intmax_t)sc->sc_async->p_pid));
    262 			psignal(sc->sc_async, SIGIO);
    263 		}
    264 		mutex_exit(&proc_lock);
    265 	}
    266 	mutex_exit(&sc->sc_lock);
    267 }
    268 
    269 static int
    270 uhidopen(dev_t dev, int flag, int mode, struct lwp *l)
    271 {
    272 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    273 	int error;
    274 
    275 	DPRINTF(("uhidopen: sc=%p\n", sc));
    276 	if (sc == NULL)
    277 		return ENXIO;
    278 
    279 	/*
    280 	 * Try to open.  If closing in progress, give up.  If already
    281 	 * open (or opening), fail -- opens are exclusive.
    282 	 */
    283 	mutex_enter(&sc->sc_lock);
    284 	if (sc->sc_open != UHID_CLOSED || sc->sc_closing) {
    285 		mutex_exit(&sc->sc_lock);
    286 		return EBUSY;
    287 	}
    288 	sc->sc_open = UHID_OPENING;
    289 	atomic_store_relaxed(&sc->sc_state, 0);
    290 	mutex_exit(&sc->sc_lock);
    291 
    292 	/* uhid interrupts aren't enabled yet, so setup sc_q now */
    293 	if (clalloc(&sc->sc_q, UHID_BSIZE, 0) == -1) {
    294 		error = ENOMEM;
    295 		goto fail0;
    296 	}
    297 
    298 	/* Allocate an output buffer if needed.  */
    299 	if (sc->sc_osize > 0)
    300 		sc->sc_obuf = kmem_alloc(sc->sc_osize, KM_SLEEP);
    301 	else
    302 		sc->sc_obuf = NULL;
    303 
    304 	/* Paranoia: reset SIGIO before enabling interrputs.  */
    305 	mutex_enter(&proc_lock);
    306 	atomic_store_relaxed(&sc->sc_async, NULL);
    307 	mutex_exit(&proc_lock);
    308 
    309 	/* Open the uhidev -- after this point we can get interrupts.  */
    310 	error = uhidev_open(sc->sc_hdev, &uhid_intr, sc);
    311 	if (error)
    312 		goto fail1;
    313 
    314 	/* We are open for business.  */
    315 	mutex_enter(&sc->sc_lock);
    316 	sc->sc_open = UHID_OPEN;
    317 	cv_broadcast(&sc->sc_cv);
    318 	mutex_exit(&sc->sc_lock);
    319 
    320 	return 0;
    321 
    322 fail1:	selnotify(&sc->sc_rsel, POLLHUP, 0);
    323 	mutex_enter(&proc_lock);
    324 	atomic_store_relaxed(&sc->sc_async, NULL);
    325 	mutex_exit(&proc_lock);
    326 	if (sc->sc_osize > 0) {
    327 		kmem_free(sc->sc_obuf, sc->sc_osize);
    328 		sc->sc_obuf = NULL;
    329 	}
    330 	clfree(&sc->sc_q);
    331 fail0:	mutex_enter(&sc->sc_lock);
    332 	KASSERT(sc->sc_open == UHID_OPENING);
    333 	sc->sc_open = UHID_CLOSED;
    334 	cv_broadcast(&sc->sc_cv);
    335 	atomic_store_relaxed(&sc->sc_state, 0);
    336 	mutex_exit(&sc->sc_lock);
    337 	return error;
    338 }
    339 
    340 static int
    341 uhidcancel(dev_t dev, int flag, int mode, struct lwp *l)
    342 {
    343 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    344 
    345 	DPRINTF(("uhidcancel: sc=%p\n", sc));
    346 	if (sc == NULL)
    347 		return 0;
    348 
    349 	/*
    350 	 * Mark it closing, wake any waiters, and suspend output.
    351 	 * After this point, no new xfers can be submitted.
    352 	 */
    353 	mutex_enter(&sc->sc_lock);
    354 	sc->sc_closing = true;
    355 	cv_broadcast(&sc->sc_cv);
    356 	mutex_exit(&sc->sc_lock);
    357 
    358 	uhidev_stop(sc->sc_hdev);
    359 
    360 	return 0;
    361 }
    362 
    363 static int
    364 uhidclose(dev_t dev, int flag, int mode, struct lwp *l)
    365 {
    366 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    367 
    368 	DPRINTF(("uhidclose: sc=%p\n", sc));
    369 	if (sc == NULL)
    370 		return 0;
    371 
    372 	mutex_enter(&sc->sc_lock);
    373 	KASSERT(sc->sc_closing);
    374 	KASSERTMSG(sc->sc_open == UHID_OPEN || sc->sc_open == UHID_CLOSED,
    375 	    "sc_open=%d", sc->sc_open);
    376 	if (sc->sc_open == UHID_CLOSED)
    377 		goto out;
    378 
    379 	/* Release the lock while we free things.  */
    380 	mutex_exit(&sc->sc_lock);
    381 
    382 	/* Prevent further interrupts.  */
    383 	uhidev_close(sc->sc_hdev);
    384 
    385 	/* Hang up all select/poll.  */
    386 	selnotify(&sc->sc_rsel, POLLHUP, 0);
    387 
    388 	/* Reset SIGIO.  */
    389 	mutex_enter(&proc_lock);
    390 	atomic_store_relaxed(&sc->sc_async, NULL);
    391 	mutex_exit(&proc_lock);
    392 
    393 	/* Free the buffer and queue.  */
    394 	if (sc->sc_osize > 0) {
    395 		kmem_free(sc->sc_obuf, sc->sc_osize);
    396 		sc->sc_obuf = NULL;
    397 	}
    398 	clfree(&sc->sc_q);
    399 
    400 	mutex_enter(&sc->sc_lock);
    401 
    402 	/* All set.  We are now closed.  */
    403 	sc->sc_open = UHID_CLOSED;
    404 out:	KASSERT(sc->sc_open == UHID_CLOSED);
    405 	sc->sc_closing = false;
    406 	cv_broadcast(&sc->sc_cv);
    407 	atomic_store_relaxed(&sc->sc_state, 0);
    408 	mutex_exit(&sc->sc_lock);
    409 
    410 	return 0;
    411 }
    412 
    413 static int
    414 uhidread(dev_t dev, struct uio *uio, int flag)
    415 {
    416 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    417 	int error = 0;
    418 	int extra;
    419 	size_t length;
    420 	u_char buffer[UHID_CHUNK];
    421 	usbd_status err;
    422 
    423 	DPRINTFN(1, ("uhidread\n"));
    424 	if (atomic_load_relaxed(&sc->sc_state) & UHID_IMMED) {
    425 		DPRINTFN(1, ("uhidread immed\n"));
    426 		extra = sc->sc_report_id != 0;
    427 		if (sc->sc_isize + extra > sizeof(buffer))
    428 			return ENOBUFS;
    429 		err = uhidev_get_report(sc->sc_hdev, UHID_INPUT_REPORT,
    430 					buffer, sc->sc_isize + extra);
    431 		if (err)
    432 			return EIO;
    433 		return uiomove(buffer+extra, sc->sc_isize, uio);
    434 	}
    435 
    436 	mutex_enter(&sc->sc_lock);
    437 	while (sc->sc_q.c_cc == 0) {
    438 		if (flag & IO_NDELAY) {
    439 			mutex_exit(&sc->sc_lock);
    440 			return EWOULDBLOCK;
    441 		}
    442 		if (sc->sc_closing) {
    443 			mutex_exit(&sc->sc_lock);
    444 			return EIO;
    445 		}
    446 		DPRINTFN(5, ("uhidread: sleep on %p\n", &sc->sc_q));
    447 		error = cv_wait_sig(&sc->sc_cv, &sc->sc_lock);
    448 		DPRINTFN(5, ("uhidread: woke, error=%d\n", error));
    449 		if (error) {
    450 			break;
    451 		}
    452 	}
    453 
    454 	/* Transfer as many chunks as possible. */
    455 	while (sc->sc_q.c_cc > 0 && uio->uio_resid > 0 && !error) {
    456 		length = uimin(sc->sc_q.c_cc, uio->uio_resid);
    457 		if (length > sizeof(buffer))
    458 			length = sizeof(buffer);
    459 
    460 		/* Remove a small chunk from the input queue. */
    461 		(void) q_to_b(&sc->sc_q, buffer, length);
    462 		DPRINTFN(5, ("uhidread: got %lu chars\n", (u_long)length));
    463 
    464 		/* Copy the data to the user process. */
    465 		mutex_exit(&sc->sc_lock);
    466 		if ((error = uiomove(buffer, length, uio)) != 0)
    467 			return error;
    468 		mutex_enter(&sc->sc_lock);
    469 	}
    470 
    471 	mutex_exit(&sc->sc_lock);
    472 	return error;
    473 }
    474 
    475 static int
    476 uhidwrite(dev_t dev, struct uio *uio, int flag)
    477 {
    478 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    479 	int error;
    480 	int size;
    481 	usbd_status err;
    482 
    483 	DPRINTFN(1, ("uhidwrite\n"));
    484 
    485 	size = sc->sc_osize;
    486 	if (uio->uio_resid != size || size == 0)
    487 		return EINVAL;
    488 	error = uiomove(sc->sc_obuf, size, uio);
    489 #ifdef UHID_DEBUG
    490 	if (uhiddebug > 5) {
    491 		uint32_t i;
    492 
    493 		DPRINTF(("%s: outdata[%d] =", device_xname(sc->sc_dev),
    494 		    error));
    495 		for (i = 0; i < size; i++)
    496 			DPRINTF((" %02x", sc->sc_obuf[i]));
    497 		DPRINTF(("\n"));
    498 	}
    499 #endif
    500 	if (!error) {
    501 		if (sc->sc_raw)
    502 			err = uhidev_write(sc->sc_hdev, sc->sc_obuf, size);
    503 		else
    504 			err = uhidev_set_report(sc->sc_hdev,
    505 			    UHID_OUTPUT_REPORT, sc->sc_obuf, size);
    506 		if (err) {
    507 			DPRINTF(("%s: err = %d\n",
    508 			    device_xname(sc->sc_dev), err));
    509 			error = EIO;
    510 		}
    511 	}
    512 
    513 	return error;
    514 }
    515 
    516 static int
    517 uhidioctl(dev_t dev, u_long cmd, void *addr, int flag, struct lwp *l)
    518 {
    519 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    520 	struct usb_ctl_report_desc *rd;
    521 	struct usb_ctl_report *re;
    522 	u_char buffer[UHID_CHUNK];
    523 	int size, extra;
    524 	usbd_status err;
    525 	void *desc;
    526 
    527 	DPRINTFN(2, ("uhidioctl: cmd=%lx\n", cmd));
    528 
    529 	switch (cmd) {
    530 	case FIONBIO:
    531 		/* All handled in the upper FS layer. */
    532 		break;
    533 
    534 	case FIOASYNC:
    535 		mutex_enter(&proc_lock);
    536 		if (*(int *)addr) {
    537 			if (sc->sc_async != NULL) {
    538 				mutex_exit(&proc_lock);
    539 				return EBUSY;
    540 			}
    541 			atomic_store_relaxed(&sc->sc_async, l->l_proc);
    542 			DPRINTF(("uhid_do_ioctl: FIOASYNC %p\n", l->l_proc));
    543 		} else
    544 			atomic_store_relaxed(&sc->sc_async, NULL);
    545 		mutex_exit(&proc_lock);
    546 		break;
    547 
    548 	/* XXX this is not the most general solution. */
    549 	case TIOCSPGRP:
    550 		mutex_enter(&proc_lock);
    551 		if (sc->sc_async == NULL) {
    552 			mutex_exit(&proc_lock);
    553 			return EINVAL;
    554 		}
    555 		if (*(int *)addr != sc->sc_async->p_pgid) {
    556 			mutex_exit(&proc_lock);
    557 			return EPERM;
    558 		}
    559 		mutex_exit(&proc_lock);
    560 		break;
    561 
    562 	case FIOSETOWN:
    563 		mutex_enter(&proc_lock);
    564 		if (sc->sc_async == NULL) {
    565 			mutex_exit(&proc_lock);
    566 			return EINVAL;
    567 		}
    568 		if (-*(int *)addr != sc->sc_async->p_pgid
    569 		    && *(int *)addr != sc->sc_async->p_pid) {
    570 			mutex_exit(&proc_lock);
    571 			return EPERM;
    572 		}
    573 		mutex_exit(&proc_lock);
    574 		break;
    575 
    576 	case USB_HID_GET_RAW:
    577 		*(int *)addr = sc->sc_raw;
    578 		break;
    579 
    580 	case USB_HID_SET_RAW:
    581 		sc->sc_raw = *(int *)addr;
    582 		break;
    583 
    584 	case USB_GET_REPORT_DESC:
    585 		uhidev_get_report_desc(sc->sc_hdev, &desc, &size);
    586 		rd = (struct usb_ctl_report_desc *)addr;
    587 		size = uimin(size, sizeof(rd->ucrd_data));
    588 		rd->ucrd_size = size;
    589 		memcpy(rd->ucrd_data, desc, size);
    590 		break;
    591 
    592 	case USB_SET_IMMED:
    593 		if (*(int *)addr) {
    594 			extra = sc->sc_report_id != 0;
    595 			if (sc->sc_isize + extra > sizeof(buffer))
    596 				return ENOBUFS;
    597 			err = uhidev_get_report(sc->sc_hdev, UHID_INPUT_REPORT,
    598 						buffer, sc->sc_isize + extra);
    599 			if (err)
    600 				return EOPNOTSUPP;
    601 
    602 			atomic_or_32(&sc->sc_state, UHID_IMMED);
    603 		} else
    604 			atomic_and_32(&sc->sc_state, ~UHID_IMMED);
    605 		break;
    606 
    607 	case USB_GET_REPORT:
    608 		re = (struct usb_ctl_report *)addr;
    609 		switch (re->ucr_report) {
    610 		case UHID_INPUT_REPORT:
    611 			size = sc->sc_isize;
    612 			break;
    613 		case UHID_OUTPUT_REPORT:
    614 			size = sc->sc_osize;
    615 			break;
    616 		case UHID_FEATURE_REPORT:
    617 			size = sc->sc_fsize;
    618 			break;
    619 		default:
    620 			return EINVAL;
    621 		}
    622 		extra = sc->sc_report_id != 0;
    623 		if (size + extra > sizeof(re->ucr_data))
    624 			return ENOBUFS;
    625 		err = uhidev_get_report(sc->sc_hdev, re->ucr_report,
    626 		    re->ucr_data, size + extra);
    627 		if (extra)
    628 			memmove(re->ucr_data, re->ucr_data+1, size);
    629 		if (err)
    630 			return EIO;
    631 		break;
    632 
    633 	case USB_SET_REPORT:
    634 		re = (struct usb_ctl_report *)addr;
    635 		switch (re->ucr_report) {
    636 		case UHID_INPUT_REPORT:
    637 			size = sc->sc_isize;
    638 			break;
    639 		case UHID_OUTPUT_REPORT:
    640 			size = sc->sc_osize;
    641 			break;
    642 		case UHID_FEATURE_REPORT:
    643 			size = sc->sc_fsize;
    644 			break;
    645 		default:
    646 			return EINVAL;
    647 		}
    648 		if (size > sizeof(re->ucr_data))
    649 			return ENOBUFS;
    650 		err = uhidev_set_report(sc->sc_hdev, re->ucr_report,
    651 		    re->ucr_data, size);
    652 		if (err)
    653 			return EIO;
    654 		break;
    655 
    656 	case USB_GET_REPORT_ID:
    657 		*(int *)addr = sc->sc_report_id;
    658 		break;
    659 
    660 	case USB_GET_DEVICE_DESC:
    661 		*(usb_device_descriptor_t *)addr =
    662 			*usbd_get_device_descriptor(sc->sc_udev);
    663 		break;
    664 
    665 	case USB_GET_DEVICEINFO:
    666 		usbd_fill_deviceinfo(sc->sc_udev,
    667 				     (struct usb_device_info *)addr, 0);
    668 		break;
    669 	case USB_GET_DEVICEINFO_OLD:
    670 		MODULE_HOOK_CALL(usb_subr_fill_30_hook,
    671                     (sc->sc_udev,
    672 		      (struct usb_device_info_old *)addr, 0,
    673                       usbd_devinfo_vp, usbd_printBCD),
    674                     enosys(), err);
    675 		if (err == 0)
    676 			return 0;
    677 		break;
    678 	case USB_GET_STRING_DESC:
    679 	    {
    680 		struct usb_string_desc *si = (struct usb_string_desc *)addr;
    681 		err = usbd_get_string_desc(sc->sc_udev,
    682 			si->usd_string_index,
    683 			si->usd_language_id, &si->usd_desc, &size);
    684 		if (err)
    685 			return EINVAL;
    686 		break;
    687 	    }
    688 
    689 	default:
    690 		return EINVAL;
    691 	}
    692 	return 0;
    693 }
    694 
    695 static int
    696 uhidpoll(dev_t dev, int events, struct lwp *l)
    697 {
    698 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    699 	int revents = 0;
    700 
    701 	mutex_enter(&sc->sc_lock);
    702 	if (events & (POLLOUT | POLLWRNORM))
    703 		revents |= events & (POLLOUT | POLLWRNORM);
    704 	if (events & (POLLIN | POLLRDNORM)) {
    705 		if (sc->sc_q.c_cc > 0)
    706 			revents |= events & (POLLIN | POLLRDNORM);
    707 		else
    708 			selrecord(l, &sc->sc_rsel);
    709 	}
    710 	mutex_exit(&sc->sc_lock);
    711 
    712 	return revents;
    713 }
    714 
    715 static void
    716 filt_uhidrdetach(struct knote *kn)
    717 {
    718 	struct uhid_softc *sc = kn->kn_hook;
    719 
    720 	mutex_enter(&sc->sc_lock);
    721 	selremove_knote(&sc->sc_rsel, kn);
    722 	mutex_exit(&sc->sc_lock);
    723 }
    724 
    725 static int
    726 filt_uhidread(struct knote *kn, long hint)
    727 {
    728 	struct uhid_softc *sc = kn->kn_hook;
    729 
    730 	if (hint == NOTE_SUBMIT)
    731 		KASSERT(mutex_owned(&sc->sc_lock));
    732 	else
    733 		mutex_enter(&sc->sc_lock);
    734 
    735 	kn->kn_data = sc->sc_q.c_cc;
    736 
    737 	if (hint == NOTE_SUBMIT)
    738 		KASSERT(mutex_owned(&sc->sc_lock));
    739 	else
    740 		mutex_exit(&sc->sc_lock);
    741 
    742 	return kn->kn_data > 0;
    743 }
    744 
    745 static const struct filterops uhidread_filtops = {
    746 	.f_flags = FILTEROP_ISFD,
    747 	.f_attach = NULL,
    748 	.f_detach = filt_uhidrdetach,
    749 	.f_event = filt_uhidread,
    750 };
    751 
    752 static int
    753 uhidkqfilter(dev_t dev, struct knote *kn)
    754 {
    755 	struct uhid_softc *sc = device_lookup_private(&uhid_cd, UHIDUNIT(dev));
    756 
    757 	switch (kn->kn_filter) {
    758 	case EVFILT_READ:
    759 		kn->kn_fop = &uhidread_filtops;
    760 		kn->kn_hook = sc;
    761 		mutex_enter(&sc->sc_lock);
    762 		selrecord_knote(&sc->sc_rsel, kn);
    763 		mutex_exit(&sc->sc_lock);
    764 		return 0;
    765 
    766 	case EVFILT_WRITE:
    767 		kn->kn_fop = &seltrue_filtops;
    768 		return 0;
    769 
    770 	default:
    771 		return EINVAL;
    772 	}
    773 }
    774