1 /*
2 * User-space I/O driver support for HID subsystem
3 * Copyright (c) 2012 David Herrmann
4 */
5
6 /*
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the Free
9 * Software Foundation; either version 2 of the License, or (at your option)
10 * any later version.
11 */
12
13 #include <linux/atomic.h>
14 #include <linux/compat.h>
15 #include <linux/device.h>
16 #include <linux/fs.h>
17 #include <linux/hid.h>
18 #include <linux/input.h>
19 #include <linux/miscdevice.h>
20 #include <linux/module.h>
21 #include <linux/mutex.h>
22 #include <linux/poll.h>
23 #include <linux/sched.h>
24 #include <linux/spinlock.h>
25 #include <linux/uhid.h>
26 #include <linux/wait.h>
27
28 #define UHID_NAME "uhid"
29 #define UHID_BUFSIZE 32
30
31 static DEFINE_MUTEX(uhid_open_mutex);
32
33 struct uhid_device {
34 struct mutex devlock;
35 bool running;
36
37 __u8 *rd_data;
38 uint rd_size;
39
40 struct hid_device *hid;
41 struct uhid_event input_buf;
42
43 wait_queue_head_t waitq;
44 spinlock_t qlock;
45 __u8 head;
46 __u8 tail;
47 struct uhid_event *outq[UHID_BUFSIZE];
48
49 struct mutex report_lock;
50 wait_queue_head_t report_wait;
51 atomic_t report_done;
52 atomic_t report_id;
53 struct uhid_event report_buf;
54 };
55
56 static struct miscdevice uhid_misc;
57
uhid_queue(struct uhid_device * uhid,struct uhid_event * ev)58 static void uhid_queue(struct uhid_device *uhid, struct uhid_event *ev)
59 {
60 __u8 newhead;
61
62 newhead = (uhid->head + 1) % UHID_BUFSIZE;
63
64 if (newhead != uhid->tail) {
65 uhid->outq[uhid->head] = ev;
66 uhid->head = newhead;
67 wake_up_interruptible(&uhid->waitq);
68 } else {
69 hid_warn(uhid->hid, "Output queue is full\n");
70 kfree(ev);
71 }
72 }
73
uhid_queue_event(struct uhid_device * uhid,__u32 event)74 static int uhid_queue_event(struct uhid_device *uhid, __u32 event)
75 {
76 unsigned long flags;
77 struct uhid_event *ev;
78
79 ev = kzalloc(sizeof(*ev), GFP_KERNEL);
80 if (!ev)
81 return -ENOMEM;
82
83 ev->type = event;
84
85 spin_lock_irqsave(&uhid->qlock, flags);
86 uhid_queue(uhid, ev);
87 spin_unlock_irqrestore(&uhid->qlock, flags);
88
89 return 0;
90 }
91
uhid_hid_start(struct hid_device * hid)92 static int uhid_hid_start(struct hid_device *hid)
93 {
94 struct uhid_device *uhid = hid->driver_data;
95
96 return uhid_queue_event(uhid, UHID_START);
97 }
98
uhid_hid_stop(struct hid_device * hid)99 static void uhid_hid_stop(struct hid_device *hid)
100 {
101 struct uhid_device *uhid = hid->driver_data;
102
103 hid->claimed = 0;
104 uhid_queue_event(uhid, UHID_STOP);
105 }
106
uhid_hid_open(struct hid_device * hid)107 static int uhid_hid_open(struct hid_device *hid)
108 {
109 struct uhid_device *uhid = hid->driver_data;
110 int retval = 0;
111
112 mutex_lock(&uhid_open_mutex);
113 if (!hid->open++) {
114 retval = uhid_queue_event(uhid, UHID_OPEN);
115 if (retval)
116 hid->open--;
117 }
118 mutex_unlock(&uhid_open_mutex);
119 return retval;
120 }
121
uhid_hid_close(struct hid_device * hid)122 static void uhid_hid_close(struct hid_device *hid)
123 {
124 struct uhid_device *uhid = hid->driver_data;
125
126 mutex_lock(&uhid_open_mutex);
127 if (!--hid->open)
128 uhid_queue_event(uhid, UHID_CLOSE);
129 mutex_unlock(&uhid_open_mutex);
130 }
131
uhid_hid_parse(struct hid_device * hid)132 static int uhid_hid_parse(struct hid_device *hid)
133 {
134 struct uhid_device *uhid = hid->driver_data;
135
136 return hid_parse_report(hid, uhid->rd_data, uhid->rd_size);
137 }
138
uhid_hid_get_raw(struct hid_device * hid,unsigned char rnum,__u8 * buf,size_t count,unsigned char rtype)139 static int uhid_hid_get_raw(struct hid_device *hid, unsigned char rnum,
140 __u8 *buf, size_t count, unsigned char rtype)
141 {
142 struct uhid_device *uhid = hid->driver_data;
143 __u8 report_type;
144 struct uhid_event *ev;
145 unsigned long flags;
146 int ret;
147 size_t uninitialized_var(len);
148 struct uhid_feature_answer_req *req;
149
150 if (!uhid->running)
151 return -EIO;
152
153 switch (rtype) {
154 case HID_FEATURE_REPORT:
155 report_type = UHID_FEATURE_REPORT;
156 break;
157 case HID_OUTPUT_REPORT:
158 report_type = UHID_OUTPUT_REPORT;
159 break;
160 case HID_INPUT_REPORT:
161 report_type = UHID_INPUT_REPORT;
162 break;
163 default:
164 return -EINVAL;
165 }
166
167 ret = mutex_lock_interruptible(&uhid->report_lock);
168 if (ret)
169 return ret;
170
171 ev = kzalloc(sizeof(*ev), GFP_KERNEL);
172 if (!ev) {
173 ret = -ENOMEM;
174 goto unlock;
175 }
176
177 spin_lock_irqsave(&uhid->qlock, flags);
178 ev->type = UHID_FEATURE;
179 ev->u.feature.id = atomic_inc_return(&uhid->report_id);
180 ev->u.feature.rnum = rnum;
181 ev->u.feature.rtype = report_type;
182
183 atomic_set(&uhid->report_done, 0);
184 uhid_queue(uhid, ev);
185 spin_unlock_irqrestore(&uhid->qlock, flags);
186
187 ret = wait_event_interruptible_timeout(uhid->report_wait,
188 atomic_read(&uhid->report_done), 5 * HZ);
189
190 /*
191 * Make sure "uhid->running" is cleared on shutdown before
192 * "uhid->report_done" is set.
193 */
194 smp_rmb();
195 if (!ret || !uhid->running) {
196 ret = -EIO;
197 } else if (ret < 0) {
198 ret = -ERESTARTSYS;
199 } else {
200 spin_lock_irqsave(&uhid->qlock, flags);
201 req = &uhid->report_buf.u.feature_answer;
202
203 if (req->err) {
204 ret = -EIO;
205 } else {
206 ret = 0;
207 len = min(count,
208 min_t(size_t, req->size, UHID_DATA_MAX));
209 memcpy(buf, req->data, len);
210 }
211
212 spin_unlock_irqrestore(&uhid->qlock, flags);
213 }
214
215 atomic_set(&uhid->report_done, 1);
216
217 unlock:
218 mutex_unlock(&uhid->report_lock);
219 return ret ? ret : len;
220 }
221
uhid_hid_output_raw(struct hid_device * hid,__u8 * buf,size_t count,unsigned char report_type)222 static int uhid_hid_output_raw(struct hid_device *hid, __u8 *buf, size_t count,
223 unsigned char report_type)
224 {
225 struct uhid_device *uhid = hid->driver_data;
226 __u8 rtype;
227 unsigned long flags;
228 struct uhid_event *ev;
229
230 switch (report_type) {
231 case HID_FEATURE_REPORT:
232 rtype = UHID_FEATURE_REPORT;
233 break;
234 case HID_OUTPUT_REPORT:
235 rtype = UHID_OUTPUT_REPORT;
236 break;
237 default:
238 return -EINVAL;
239 }
240
241 if (count < 1 || count > UHID_DATA_MAX)
242 return -EINVAL;
243
244 ev = kzalloc(sizeof(*ev), GFP_KERNEL);
245 if (!ev)
246 return -ENOMEM;
247
248 ev->type = UHID_OUTPUT;
249 ev->u.output.size = count;
250 ev->u.output.rtype = rtype;
251 memcpy(ev->u.output.data, buf, count);
252
253 spin_lock_irqsave(&uhid->qlock, flags);
254 uhid_queue(uhid, ev);
255 spin_unlock_irqrestore(&uhid->qlock, flags);
256
257 return count;
258 }
259
260 static struct hid_ll_driver uhid_hid_driver = {
261 .start = uhid_hid_start,
262 .stop = uhid_hid_stop,
263 .open = uhid_hid_open,
264 .close = uhid_hid_close,
265 .parse = uhid_hid_parse,
266 };
267
268 #ifdef CONFIG_COMPAT
269
270 /* Apparently we haven't stepped on these rakes enough times yet. */
271 struct uhid_create_req_compat {
272 __u8 name[128];
273 __u8 phys[64];
274 __u8 uniq[64];
275
276 compat_uptr_t rd_data;
277 __u16 rd_size;
278
279 __u16 bus;
280 __u32 vendor;
281 __u32 product;
282 __u32 version;
283 __u32 country;
284 } __attribute__((__packed__));
285
uhid_event_from_user(const char __user * buffer,size_t len,struct uhid_event * event)286 static int uhid_event_from_user(const char __user *buffer, size_t len,
287 struct uhid_event *event)
288 {
289 if (is_compat_task()) {
290 u32 type;
291
292 if (get_user(type, buffer))
293 return -EFAULT;
294
295 if (type == UHID_CREATE) {
296 /*
297 * This is our messed up request with compat pointer.
298 * It is largish (more than 256 bytes) so we better
299 * allocate it from the heap.
300 */
301 struct uhid_create_req_compat *compat;
302
303 compat = kmalloc(sizeof(*compat), GFP_KERNEL);
304 if (!compat)
305 return -ENOMEM;
306
307 buffer += sizeof(type);
308 len -= sizeof(type);
309 if (copy_from_user(compat, buffer,
310 min(len, sizeof(*compat)))) {
311 kfree(compat);
312 return -EFAULT;
313 }
314
315 /* Shuffle the data over to proper structure */
316 event->type = type;
317
318 memcpy(event->u.create.name, compat->name,
319 sizeof(compat->name));
320 memcpy(event->u.create.phys, compat->phys,
321 sizeof(compat->phys));
322 memcpy(event->u.create.uniq, compat->uniq,
323 sizeof(compat->uniq));
324
325 event->u.create.rd_data = compat_ptr(compat->rd_data);
326 event->u.create.rd_size = compat->rd_size;
327
328 event->u.create.bus = compat->bus;
329 event->u.create.vendor = compat->vendor;
330 event->u.create.product = compat->product;
331 event->u.create.version = compat->version;
332 event->u.create.country = compat->country;
333
334 kfree(compat);
335 return 0;
336 }
337 /* All others can be copied directly */
338 }
339
340 if (copy_from_user(event, buffer, min(len, sizeof(*event))))
341 return -EFAULT;
342
343 return 0;
344 }
345 #else
uhid_event_from_user(const char __user * buffer,size_t len,struct uhid_event * event)346 static int uhid_event_from_user(const char __user *buffer, size_t len,
347 struct uhid_event *event)
348 {
349 if (copy_from_user(event, buffer, min(len, sizeof(*event))))
350 return -EFAULT;
351
352 return 0;
353 }
354 #endif
355
uhid_dev_create(struct uhid_device * uhid,const struct uhid_event * ev)356 static int uhid_dev_create(struct uhid_device *uhid,
357 const struct uhid_event *ev)
358 {
359 struct hid_device *hid;
360 int ret;
361
362 if (uhid->running)
363 return -EALREADY;
364
365 uhid->rd_size = ev->u.create.rd_size;
366 if (uhid->rd_size <= 0 || uhid->rd_size > HID_MAX_DESCRIPTOR_SIZE)
367 return -EINVAL;
368
369 uhid->rd_data = kmalloc(uhid->rd_size, GFP_KERNEL);
370 if (!uhid->rd_data)
371 return -ENOMEM;
372
373 if (copy_from_user(uhid->rd_data, ev->u.create.rd_data,
374 uhid->rd_size)) {
375 ret = -EFAULT;
376 goto err_free;
377 }
378
379 hid = hid_allocate_device();
380 if (IS_ERR(hid)) {
381 ret = PTR_ERR(hid);
382 goto err_free;
383 }
384
385 strncpy(hid->name, ev->u.create.name, 127);
386 hid->name[127] = 0;
387 strncpy(hid->phys, ev->u.create.phys, 63);
388 hid->phys[63] = 0;
389 strncpy(hid->uniq, ev->u.create.uniq, 63);
390 hid->uniq[63] = 0;
391
392 hid->ll_driver = &uhid_hid_driver;
393 hid->hid_get_raw_report = uhid_hid_get_raw;
394 hid->hid_output_raw_report = uhid_hid_output_raw;
395 hid->bus = ev->u.create.bus;
396 hid->vendor = ev->u.create.vendor;
397 hid->product = ev->u.create.product;
398 hid->version = ev->u.create.version;
399 hid->country = ev->u.create.country;
400 hid->driver_data = uhid;
401 hid->dev.parent = uhid_misc.this_device;
402
403 uhid->hid = hid;
404 uhid->running = true;
405
406 ret = hid_add_device(hid);
407 if (ret) {
408 hid_err(hid, "Cannot register HID device\n");
409 goto err_hid;
410 }
411
412 return 0;
413
414 err_hid:
415 hid_destroy_device(hid);
416 uhid->hid = NULL;
417 uhid->running = false;
418 err_free:
419 kfree(uhid->rd_data);
420 return ret;
421 }
422
uhid_dev_destroy(struct uhid_device * uhid)423 static int uhid_dev_destroy(struct uhid_device *uhid)
424 {
425 if (!uhid->running)
426 return -EINVAL;
427
428 /* clear "running" before setting "report_done" */
429 uhid->running = false;
430 smp_wmb();
431 atomic_set(&uhid->report_done, 1);
432 wake_up_interruptible(&uhid->report_wait);
433
434 hid_destroy_device(uhid->hid);
435 kfree(uhid->rd_data);
436
437 return 0;
438 }
439
uhid_dev_input(struct uhid_device * uhid,struct uhid_event * ev)440 static int uhid_dev_input(struct uhid_device *uhid, struct uhid_event *ev)
441 {
442 if (!uhid->running)
443 return -EINVAL;
444
445 hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input.data,
446 min_t(size_t, ev->u.input.size, UHID_DATA_MAX), 0);
447
448 return 0;
449 }
450
uhid_dev_feature_answer(struct uhid_device * uhid,struct uhid_event * ev)451 static int uhid_dev_feature_answer(struct uhid_device *uhid,
452 struct uhid_event *ev)
453 {
454 unsigned long flags;
455
456 if (!uhid->running)
457 return -EINVAL;
458
459 spin_lock_irqsave(&uhid->qlock, flags);
460
461 /* id for old report; drop it silently */
462 if (atomic_read(&uhid->report_id) != ev->u.feature_answer.id)
463 goto unlock;
464 if (atomic_read(&uhid->report_done))
465 goto unlock;
466
467 memcpy(&uhid->report_buf, ev, sizeof(*ev));
468 atomic_set(&uhid->report_done, 1);
469 wake_up_interruptible(&uhid->report_wait);
470
471 unlock:
472 spin_unlock_irqrestore(&uhid->qlock, flags);
473 return 0;
474 }
475
uhid_char_open(struct inode * inode,struct file * file)476 static int uhid_char_open(struct inode *inode, struct file *file)
477 {
478 struct uhid_device *uhid;
479
480 uhid = kzalloc(sizeof(*uhid), GFP_KERNEL);
481 if (!uhid)
482 return -ENOMEM;
483
484 mutex_init(&uhid->devlock);
485 mutex_init(&uhid->report_lock);
486 spin_lock_init(&uhid->qlock);
487 init_waitqueue_head(&uhid->waitq);
488 init_waitqueue_head(&uhid->report_wait);
489 uhid->running = false;
490 atomic_set(&uhid->report_done, 1);
491
492 file->private_data = uhid;
493 nonseekable_open(inode, file);
494
495 return 0;
496 }
497
uhid_char_release(struct inode * inode,struct file * file)498 static int uhid_char_release(struct inode *inode, struct file *file)
499 {
500 struct uhid_device *uhid = file->private_data;
501 unsigned int i;
502
503 uhid_dev_destroy(uhid);
504
505 for (i = 0; i < UHID_BUFSIZE; ++i)
506 kfree(uhid->outq[i]);
507
508 kfree(uhid);
509
510 return 0;
511 }
512
uhid_char_read(struct file * file,char __user * buffer,size_t count,loff_t * ppos)513 static ssize_t uhid_char_read(struct file *file, char __user *buffer,
514 size_t count, loff_t *ppos)
515 {
516 struct uhid_device *uhid = file->private_data;
517 int ret;
518 unsigned long flags;
519 size_t len;
520
521 /* they need at least the "type" member of uhid_event */
522 if (count < sizeof(__u32))
523 return -EINVAL;
524
525 try_again:
526 if (file->f_flags & O_NONBLOCK) {
527 if (uhid->head == uhid->tail)
528 return -EAGAIN;
529 } else {
530 ret = wait_event_interruptible(uhid->waitq,
531 uhid->head != uhid->tail);
532 if (ret)
533 return ret;
534 }
535
536 ret = mutex_lock_interruptible(&uhid->devlock);
537 if (ret)
538 return ret;
539
540 if (uhid->head == uhid->tail) {
541 mutex_unlock(&uhid->devlock);
542 goto try_again;
543 } else {
544 len = min(count, sizeof(**uhid->outq));
545 if (copy_to_user(buffer, uhid->outq[uhid->tail], len)) {
546 ret = -EFAULT;
547 } else {
548 kfree(uhid->outq[uhid->tail]);
549 uhid->outq[uhid->tail] = NULL;
550
551 spin_lock_irqsave(&uhid->qlock, flags);
552 uhid->tail = (uhid->tail + 1) % UHID_BUFSIZE;
553 spin_unlock_irqrestore(&uhid->qlock, flags);
554 }
555 }
556
557 mutex_unlock(&uhid->devlock);
558 return ret ? ret : len;
559 }
560
uhid_char_write(struct file * file,const char __user * buffer,size_t count,loff_t * ppos)561 static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
562 size_t count, loff_t *ppos)
563 {
564 struct uhid_device *uhid = file->private_data;
565 int ret;
566 size_t len;
567
568 /* we need at least the "type" member of uhid_event */
569 if (count < sizeof(__u32))
570 return -EINVAL;
571
572 ret = mutex_lock_interruptible(&uhid->devlock);
573 if (ret)
574 return ret;
575
576 memset(&uhid->input_buf, 0, sizeof(uhid->input_buf));
577 len = min(count, sizeof(uhid->input_buf));
578
579 ret = uhid_event_from_user(buffer, len, &uhid->input_buf);
580 if (ret)
581 goto unlock;
582
583 switch (uhid->input_buf.type) {
584 case UHID_CREATE:
585 ret = uhid_dev_create(uhid, &uhid->input_buf);
586 break;
587 case UHID_DESTROY:
588 ret = uhid_dev_destroy(uhid);
589 break;
590 case UHID_INPUT:
591 ret = uhid_dev_input(uhid, &uhid->input_buf);
592 break;
593 case UHID_FEATURE_ANSWER:
594 ret = uhid_dev_feature_answer(uhid, &uhid->input_buf);
595 break;
596 default:
597 ret = -EOPNOTSUPP;
598 }
599
600 unlock:
601 mutex_unlock(&uhid->devlock);
602
603 /* return "count" not "len" to not confuse the caller */
604 return ret ? ret : count;
605 }
606
uhid_char_poll(struct file * file,poll_table * wait)607 static unsigned int uhid_char_poll(struct file *file, poll_table *wait)
608 {
609 struct uhid_device *uhid = file->private_data;
610
611 poll_wait(file, &uhid->waitq, wait);
612
613 if (uhid->head != uhid->tail)
614 return POLLIN | POLLRDNORM;
615
616 return 0;
617 }
618
619 static const struct file_operations uhid_fops = {
620 .owner = THIS_MODULE,
621 .open = uhid_char_open,
622 .release = uhid_char_release,
623 .read = uhid_char_read,
624 .write = uhid_char_write,
625 .poll = uhid_char_poll,
626 .llseek = no_llseek,
627 };
628
629 static struct miscdevice uhid_misc = {
630 .fops = &uhid_fops,
631 .minor = MISC_DYNAMIC_MINOR,
632 .name = UHID_NAME,
633 };
634
uhid_init(void)635 static int __init uhid_init(void)
636 {
637 return misc_register(&uhid_misc);
638 }
639
uhid_exit(void)640 static void __exit uhid_exit(void)
641 {
642 misc_deregister(&uhid_misc);
643 }
644
645 module_init(uhid_init);
646 module_exit(uhid_exit);
647 MODULE_LICENSE("GPL");
648 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
649 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
650