Linux hidraw hotplug: optional monitor auto-recovery after a udev-monitor failure #828

New issue

Open

opened 2026-07-15 07:06:22 -05:00 by Youw · 0 comments

Youw commented

2026-07-15 07:06:22 -05:00

(Migrated from github.com)

When the linux/hidraw hotplug monitor's udev netlink socket fails unrecoverably (POLLERR/POLLHUP/POLLNVAL beyond the ENOBUFS retry bound), the backend (#822) now stops cleanly: it marks the monitor dead, fabricates no DEVICE_LEFT, leaves the device cache and the application's open handles intact, and refuses new registrations. Existing callbacks simply stop receiving events. Losing the event transport is not evidence that the devices left, so this is the safe, honest behavior.

An earlier attempt to instead auto-recover (rebuild the monitor, re-enumerate, diff against the cache, emit only real deltas) was dropped because it could not be made correct. During the outage window a cached device A can be unplugged and a different device B plugged into the same /dev/hidrawN; the reconcile has no stable per-connection identity to tell "A still present" from "A gone, B arrived", so for serial-less devices both LEFT(A) and ARRIVED(B) are lost. The re-enumeration also has to be strictly all-or-nothing, or a partial scan fabricates spurious LEFTs.

Recording as a possible future enhancement: auto-recovery would need (1) a stable per-connection identity that survives an outage (e.g. from sysfs/udev properties) and (2) an all-or-nothing re-enumeration before it could emit deltas safely. Until then, stop-cleanly is correct.

Drafted with Claude Code.

When the linux/hidraw hotplug monitor's udev netlink socket fails unrecoverably (`POLLERR`/`POLLHUP`/`POLLNVAL` beyond the `ENOBUFS` retry bound), the backend (#822) now **stops cleanly**: it marks the monitor dead, fabricates no `DEVICE_LEFT`, leaves the device cache and the application's open handles intact, and refuses new registrations. Existing callbacks simply stop receiving events. Losing the event transport is not evidence that the devices left, so this is the safe, honest behavior. An earlier attempt to instead **auto-recover** (rebuild the monitor, re-enumerate, diff against the cache, emit only real deltas) was dropped because it could not be made correct. During the outage window a cached device `A` can be unplugged and a different device `B` plugged into the same `/dev/hidrawN`; the reconcile has no stable per-connection identity to tell "`A` still present" from "`A` gone, `B` arrived", so for serial-less devices both `LEFT(A)` and `ARRIVED(B)` are lost. The re-enumeration also has to be strictly all-or-nothing, or a partial scan fabricates spurious `LEFT`s. Recording as a possible future enhancement: auto-recovery would need (1) a stable per-connection identity that survives an outage (e.g. from sysfs/udev properties) and (2) an all-or-nothing re-enumeration before it could emit deltas safely. Until then, stop-cleanly is correct. _Drafted with Claude Code._