drivers/hid/uhid.c

   1 /*
   2  * User-space I/O driver support for HID subsystem
   3  * Copyright (c) 2012 David Herrmann
   4  */
   5
   6 /*
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the Free
   9  * Software Foundation; either version 2 of the License, or (at your option)
  10  * any later version.
  11  */
  12
  13 #include <linux/atomic.h>
  14 #include <linux/compat.h>
  15 #include <linux/device.h>
  16 #include <linux/fs.h>
  17 #include <linux/hid.h>
  18 #include <linux/input.h>
  19 #include <linux/miscdevice.h>
  20 #include <linux/module.h>
  21 #include <linux/mutex.h>
  22 #include <linux/poll.h>
  23 #include <linux/sched.h>
  24 #include <linux/spinlock.h>
  25 #include <linux/uhid.h>
  26 #include <linux/wait.h>
  27
  28 #define UHID_NAME       "uhid"
  29 #define UHID_BUFSIZE    32
  30
  31 struct uhid_device {
  32         struct mutex devlock;
  33         bool running;
  34
  35         __u8 *rd_data;
  36         uint rd_size;
  37
  38         struct hid_device *hid;
  39         struct uhid_event input_buf;
  40
  41         wait_queue_head_t waitq;
  42         spinlock_t qlock;
  43         __u8 head;
  44         __u8 tail;
  45         struct uhid_event *outq[UHID_BUFSIZE];
  46
  47         struct mutex report_lock;
  48         wait_queue_head_t report_wait;
  49         atomic_t report_done;
  50         atomic_t report_id;
  51         struct uhid_event report_buf;
  52 };
  53
  54 static struct miscdevice uhid_misc;
  55
  56 static void uhid_queue(struct uhid_device *uhid, struct uhid_event *ev)
  57 {
  58         __u8 newhead;
  59
  60         newhead = (uhid->head + 1) % UHID_BUFSIZE;
  61
  62         if (newhead != uhid->tail) {
  63                 uhid->outq[uhid->head] = ev;
  64                 uhid->head = newhead;
  65                 wake_up_interruptible(&uhid->waitq);
  66         } else {
  67                 hid_warn(uhid->hid, "Output queue is full\n");
  68                 kfree(ev);
  69         }
  70 }
  71
  72 static int uhid_queue_event(struct uhid_device *uhid, __u32 event)
  73 {
  74         unsigned long flags;
  75         struct uhid_event *ev;
  76
  77         ev = kzalloc(sizeof(*ev), GFP_KERNEL);
  78         if (!ev)
  79                 return -ENOMEM;
  80
  81         ev->type = event;
  82
  83         spin_lock_irqsave(&uhid->qlock, flags);
  84         uhid_queue(uhid, ev);
  85         spin_unlock_irqrestore(&uhid->qlock, flags);
  86
  87         return 0;
  88 }
  89
  90 static int uhid_hid_start(struct hid_device *hid)
  91 {
  92         struct uhid_device *uhid = hid->driver_data;
  93
  94         return uhid_queue_event(uhid, UHID_START);
  95 }
  96
  97 static void uhid_hid_stop(struct hid_device *hid)
  98 {
  99         struct uhid_device *uhid = hid->driver_data;
 100
 101         hid->claimed = 0;
 102         uhid_queue_event(uhid, UHID_STOP);
 103 }
 104
 105 static int uhid_hid_open(struct hid_device *hid)
 106 {
 107         struct uhid_device *uhid = hid->driver_data;
 108
 109         return uhid_queue_event(uhid, UHID_OPEN);
 110 }
 111
 112 static void uhid_hid_close(struct hid_device *hid)
 113 {
 114         struct uhid_device *uhid = hid->driver_data;
 115
 116         uhid_queue_event(uhid, UHID_CLOSE);
 117 }
 118
 119 static int uhid_hid_parse(struct hid_device *hid)
 120 {
 121         struct uhid_device *uhid = hid->driver_data;
 122
 123         return hid_parse_report(hid, uhid->rd_data, uhid->rd_size);
 124 }
 125
 126 static int uhid_hid_get_raw(struct hid_device *hid, unsigned char rnum,
 127                             __u8 *buf, size_t count, unsigned char rtype)
 128 {
 129         struct uhid_device *uhid = hid->driver_data;
 130         __u8 report_type;
 131         struct uhid_event *ev;
 132         unsigned long flags;
 133         int ret;
 134         size_t uninitialized_var(len);
 135         struct uhid_feature_answer_req *req;
 136
 137         if (!uhid->running)
 138                 return -EIO;
 139
 140         switch (rtype) {
 141         case HID_FEATURE_REPORT:
 142                 report_type = UHID_FEATURE_REPORT;
 143                 break;
 144         case HID_OUTPUT_REPORT:
 145                 report_type = UHID_OUTPUT_REPORT;
 146                 break;
 147         case HID_INPUT_REPORT:
 148                 report_type = UHID_INPUT_REPORT;
 149                 break;
 150         default:
 151                 return -EINVAL;
 152         }
 153
 154         ret = mutex_lock_interruptible(&uhid->report_lock);
 155         if (ret)
 156                 return ret;
 157
 158         ev = kzalloc(sizeof(*ev), GFP_KERNEL);
 159         if (!ev) {
 160                 ret = -ENOMEM;
 161                 goto unlock;
 162         }
 163
 164         spin_lock_irqsave(&uhid->qlock, flags);
 165         ev->type = UHID_FEATURE;
 166         ev->u.feature.id = atomic_inc_return(&uhid->report_id);
 167         ev->u.feature.rnum = rnum;
 168         ev->u.feature.rtype = report_type;
 169
 170         atomic_set(&uhid->report_done, 0);
 171         uhid_queue(uhid, ev);
 172         spin_unlock_irqrestore(&uhid->qlock, flags);
 173
 174         ret = wait_event_interruptible_timeout(uhid->report_wait,
 175                         atomic_read(&uhid->report_done) || !uhid->running,
 176                         5 * HZ);
 177
 178         if (!ret || !uhid->running) {
 179                 ret = -EIO;
 180         } else if (ret < 0) {
 181                 ret = -ERESTARTSYS;
 182         } else {
 183                 spin_lock_irqsave(&uhid->qlock, flags);
 184                 req = &uhid->report_buf.u.feature_answer;
 185
 186                 if (req->err) {
 187                         ret = -EIO;
 188                 } else {
 189                         ret = 0;
 190                         len = min(count,
 191                                 min_t(size_t, req->size, UHID_DATA_MAX));
 192                         memcpy(buf, req->data, len);
 193                 }
 194
 195                 spin_unlock_irqrestore(&uhid->qlock, flags);
 196         }
 197
 198         atomic_set(&uhid->report_done, 1);
 199
 200 unlock:
 201         mutex_unlock(&uhid->report_lock);
 202         return ret ? ret : len;
 203 }
 204
 205 static int uhid_hid_output_raw(struct hid_device *hid, __u8 *buf, size_t count,
 206                                unsigned char report_type)
 207 {
 208         struct uhid_device *uhid = hid->driver_data;
 209         __u8 rtype;
 210         unsigned long flags;
 211         struct uhid_event *ev;
 212
 213         switch (report_type) {
 214         case HID_FEATURE_REPORT:
 215                 rtype = UHID_FEATURE_REPORT;
 216                 break;
 217         case HID_OUTPUT_REPORT:
 218                 rtype = UHID_OUTPUT_REPORT;
 219                 break;
 220         default:
 221                 return -EINVAL;
 222         }
 223
 224         if (count < 1 || count > UHID_DATA_MAX)
 225                 return -EINVAL;
 226
 227         ev = kzalloc(sizeof(*ev), GFP_KERNEL);
 228         if (!ev)
 229                 return -ENOMEM;
 230
 231         ev->type = UHID_OUTPUT;
 232         ev->u.output.size = count;
 233         ev->u.output.rtype = rtype;
 234         memcpy(ev->u.output.data, buf, count);
 235
 236         spin_lock_irqsave(&uhid->qlock, flags);
 237         uhid_queue(uhid, ev);
 238         spin_unlock_irqrestore(&uhid->qlock, flags);
 239
 240         return count;
 241 }
 242
 243 static int uhid_hid_output_report(struct hid_device *hid, __u8 *buf,
 244                                   size_t count)
 245 {
 246         return uhid_hid_output_raw(hid, buf, count, HID_OUTPUT_REPORT);
 247 }
 248
 249 static int uhid_raw_request(struct hid_device *hid, unsigned char reportnum,
 250                             __u8 *buf, size_t len, unsigned char rtype,
 251                             int reqtype)
 252 {
 253         switch (reqtype) {
 254         case HID_REQ_GET_REPORT:
 255                 return uhid_hid_get_raw(hid, reportnum, buf, len, rtype);
 256         case HID_REQ_SET_REPORT:
 257                 /* TODO: implement proper SET_REPORT functionality */
 258                 return -ENOSYS;
 259         default:
 260                 return -EIO;
 261         }
 262 }
 263
 264 static struct hid_ll_driver uhid_hid_driver = {
 265         .start = uhid_hid_start,
 266         .stop = uhid_hid_stop,
 267         .open = uhid_hid_open,
 268         .close = uhid_hid_close,
 269         .parse = uhid_hid_parse,
 270         .output_report = uhid_hid_output_report,
 271         .raw_request = uhid_raw_request,
 272 };
 273
 274 #ifdef CONFIG_COMPAT
 275
 276 /* Apparently we haven't stepped on these rakes enough times yet. */
 277 struct uhid_create_req_compat {
 278         __u8 name[128];
 279         __u8 phys[64];
 280         __u8 uniq[64];
 281
 282         compat_uptr_t rd_data;
 283         __u16 rd_size;
 284
 285         __u16 bus;
 286         __u32 vendor;
 287         __u32 product;
 288         __u32 version;
 289         __u32 country;
 290 } __attribute__((__packed__));
 291
 292 static int uhid_event_from_user(const char __user *buffer, size_t len,
 293                                 struct uhid_event *event)
 294 {
 295         if (is_compat_task()) {
 296                 u32 type;
 297
 298                 if (get_user(type, buffer))
 299                         return -EFAULT;
 300
 301                 if (type == UHID_CREATE) {
 302                         /*
 303                          * This is our messed up request with compat pointer.
 304                          * It is largish (more than 256 bytes) so we better
 305                          * allocate it from the heap.
 306                          */
 307                         struct uhid_create_req_compat *compat;
 308
 309                         compat = kzalloc(sizeof(*compat), GFP_KERNEL);
 310                         if (!compat)
 311                                 return -ENOMEM;
 312
 313                         buffer += sizeof(type);
 314                         len -= sizeof(type);
 315                         if (copy_from_user(compat, buffer,
 316                                            min(len, sizeof(*compat)))) {
 317                                 kfree(compat);
 318                                 return -EFAULT;
 319                         }
 320
 321                         /* Shuffle the data over to proper structure */
 322                         event->type = type;
 323
 324                         memcpy(event->u.create.name, compat->name,
 325                                 sizeof(compat->name));
 326                         memcpy(event->u.create.phys, compat->phys,
 327                                 sizeof(compat->phys));
 328                         memcpy(event->u.create.uniq, compat->uniq,
 329                                 sizeof(compat->uniq));
 330
 331                         event->u.create.rd_data = compat_ptr(compat->rd_data);
 332                         event->u.create.rd_size = compat->rd_size;
 333
 334                         event->u.create.bus = compat->bus;
 335                         event->u.create.vendor = compat->vendor;
 336                         event->u.create.product = compat->product;
 337                         event->u.create.version = compat->version;
 338                         event->u.create.country = compat->country;
 339
 340                         kfree(compat);
 341                         return 0;
 342                 }
 343                 /* All others can be copied directly */
 344         }
 345
 346         if (copy_from_user(event, buffer, min(len, sizeof(*event))))
 347                 return -EFAULT;
 348
 349         return 0;
 350 }
 351 #else
 352 static int uhid_event_from_user(const char __user *buffer, size_t len,
 353                                 struct uhid_event *event)
 354 {
 355         if (copy_from_user(event, buffer, min(len, sizeof(*event))))
 356                 return -EFAULT;
 357
 358         return 0;
 359 }
 360 #endif
 361
 362 static int uhid_dev_create2(struct uhid_device *uhid,
 363                             const struct uhid_event *ev)
 364 {
 365         struct hid_device *hid;
 366         size_t rd_size;
 367         void *rd_data;
 368         int ret;
 369
 370         if (uhid->running)
 371                 return -EALREADY;
 372
 373         rd_size = ev->u.create2.rd_size;
 374         if (rd_size <= 0 || rd_size > HID_MAX_DESCRIPTOR_SIZE)
 375                 return -EINVAL;
 376
 377         rd_data = kmemdup(ev->u.create2.rd_data, rd_size, GFP_KERNEL);
 378         if (!rd_data)
 379                 return -ENOMEM;
 380
 381         uhid->rd_size = rd_size;
 382         uhid->rd_data = rd_data;
 383
 384         hid = hid_allocate_device();
 385         if (IS_ERR(hid)) {
 386                 ret = PTR_ERR(hid);
 387                 goto err_free;
 388         }
 389
 390         strncpy(hid->name, ev->u.create2.name, 127);
 391         hid->name[127] = 0;
 392         strncpy(hid->phys, ev->u.create2.phys, 63);
 393         hid->phys[63] = 0;
 394         strncpy(hid->uniq, ev->u.create2.uniq, 63);
 395         hid->uniq[63] = 0;
 396
 397         hid->ll_driver = &uhid_hid_driver;
 398         hid->bus = ev->u.create2.bus;
 399         hid->vendor = ev->u.create2.vendor;
 400         hid->product = ev->u.create2.product;
 401         hid->version = ev->u.create2.version;
 402         hid->country = ev->u.create2.country;
 403         hid->driver_data = uhid;
 404         hid->dev.parent = uhid_misc.this_device;
 405
 406         uhid->hid = hid;
 407         uhid->running = true;
 408
 409         ret = hid_add_device(hid);
 410         if (ret) {
 411                 hid_err(hid, "Cannot register HID device\n");
 412                 goto err_hid;
 413         }
 414
 415         return 0;
 416
 417 err_hid:
 418         hid_destroy_device(hid);
 419         uhid->hid = NULL;
 420         uhid->running = false;
 421 err_free:
 422         kfree(uhid->rd_data);
 423         uhid->rd_data = NULL;
 424         uhid->rd_size = 0;
 425         return ret;
 426 }
 427
 428 static int uhid_dev_create(struct uhid_device *uhid,
 429                            struct uhid_event *ev)
 430 {
 431         struct uhid_create_req orig;
 432
 433         orig = ev->u.create;
 434
 435         if (orig.rd_size <= 0 || orig.rd_size > HID_MAX_DESCRIPTOR_SIZE)
 436                 return -EINVAL;
 437         if (copy_from_user(&ev->u.create2.rd_data, orig.rd_data, orig.rd_size))
 438                 return -EFAULT;
 439
 440         memcpy(ev->u.create2.name, orig.name, sizeof(orig.name));
 441         memcpy(ev->u.create2.phys, orig.phys, sizeof(orig.phys));
 442         memcpy(ev->u.create2.uniq, orig.uniq, sizeof(orig.uniq));
 443         ev->u.create2.rd_size = orig.rd_size;
 444         ev->u.create2.bus = orig.bus;
 445         ev->u.create2.vendor = orig.vendor;
 446         ev->u.create2.product = orig.product;
 447         ev->u.create2.version = orig.version;
 448         ev->u.create2.country = orig.country;
 449
 450         return uhid_dev_create2(uhid, ev);
 451 }
 452
 453 static int uhid_dev_destroy(struct uhid_device *uhid)
 454 {
 455         if (!uhid->running)
 456                 return -EINVAL;
 457
 458         uhid->running = false;
 459         wake_up_interruptible(&uhid->report_wait);
 460
 461         hid_destroy_device(uhid->hid);
 462         kfree(uhid->rd_data);
 463
 464         return 0;
 465 }
 466
 467 static int uhid_dev_input(struct uhid_device *uhid, struct uhid_event *ev)
 468 {
 469         if (!uhid->running)
 470                 return -EINVAL;
 471
 472         hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input.data,
 473                          min_t(size_t, ev->u.input.size, UHID_DATA_MAX), 0);
 474
 475         return 0;
 476 }
 477
 478 static int uhid_dev_input2(struct uhid_device *uhid, struct uhid_event *ev)
 479 {
 480         if (!uhid->running)
 481                 return -EINVAL;
 482
 483         hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input2.data,
 484                          min_t(size_t, ev->u.input2.size, UHID_DATA_MAX), 0);
 485
 486         return 0;
 487 }
 488
 489 static int uhid_dev_feature_answer(struct uhid_device *uhid,
 490                                    struct uhid_event *ev)
 491 {
 492         unsigned long flags;
 493
 494         if (!uhid->running)
 495                 return -EINVAL;
 496
 497         spin_lock_irqsave(&uhid->qlock, flags);
 498
 499         /* id for old report; drop it silently */
 500         if (atomic_read(&uhid->report_id) != ev->u.feature_answer.id)
 501                 goto unlock;
 502         if (atomic_read(&uhid->report_done))
 503                 goto unlock;
 504
 505         memcpy(&uhid->report_buf, ev, sizeof(*ev));
 506         atomic_set(&uhid->report_done, 1);
 507         wake_up_interruptible(&uhid->report_wait);
 508
 509 unlock:
 510         spin_unlock_irqrestore(&uhid->qlock, flags);
 511         return 0;
 512 }
 513
 514 static int uhid_char_open(struct inode *inode, struct file *file)
 515 {
 516         struct uhid_device *uhid;
 517
 518         uhid = kzalloc(sizeof(*uhid), GFP_KERNEL);
 519         if (!uhid)
 520                 return -ENOMEM;
 521
 522         mutex_init(&uhid->devlock);
 523         mutex_init(&uhid->report_lock);
 524         spin_lock_init(&uhid->qlock);
 525         init_waitqueue_head(&uhid->waitq);
 526         init_waitqueue_head(&uhid->report_wait);
 527         uhid->running = false;
 528         atomic_set(&uhid->report_done, 1);
 529
 530         file->private_data = uhid;
 531         nonseekable_open(inode, file);
 532
 533         return 0;
 534 }
 535
 536 static int uhid_char_release(struct inode *inode, struct file *file)
 537 {
 538         struct uhid_device *uhid = file->private_data;
 539         unsigned int i;
 540
 541         uhid_dev_destroy(uhid);
 542
 543         for (i = 0; i < UHID_BUFSIZE; ++i)
 544                 kfree(uhid->outq[i]);
 545
 546         kfree(uhid);
 547
 548         return 0;
 549 }
 550
 551 static ssize_t uhid_char_read(struct file *file, char __user *buffer,
 552                                 size_t count, loff_t *ppos)
 553 {
 554         struct uhid_device *uhid = file->private_data;
 555         int ret;
 556         unsigned long flags;
 557         size_t len;
 558
 559         /* they need at least the "type" member of uhid_event */
 560         if (count < sizeof(__u32))
 561                 return -EINVAL;
 562
 563 try_again:
 564         if (file->f_flags & O_NONBLOCK) {
 565                 if (uhid->head == uhid->tail)
 566                         return -EAGAIN;
 567         } else {
 568                 ret = wait_event_interruptible(uhid->waitq,
 569                                                 uhid->head != uhid->tail);
 570                 if (ret)
 571                         return ret;
 572         }
 573
 574         ret = mutex_lock_interruptible(&uhid->devlock);
 575         if (ret)
 576                 return ret;
 577
 578         if (uhid->head == uhid->tail) {
 579                 mutex_unlock(&uhid->devlock);
 580                 goto try_again;
 581         } else {
 582                 len = min(count, sizeof(**uhid->outq));
 583                 if (copy_to_user(buffer, uhid->outq[uhid->tail], len)) {
 584                         ret = -EFAULT;
 585                 } else {
 586                         kfree(uhid->outq[uhid->tail]);
 587                         uhid->outq[uhid->tail] = NULL;
 588
 589                         spin_lock_irqsave(&uhid->qlock, flags);
 590                         uhid->tail = (uhid->tail + 1) % UHID_BUFSIZE;
 591                         spin_unlock_irqrestore(&uhid->qlock, flags);
 592                 }
 593         }
 594
 595         mutex_unlock(&uhid->devlock);
 596         return ret ? ret : len;
 597 }
 598
 599 static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
 600                                 size_t count, loff_t *ppos)
 601 {
 602         struct uhid_device *uhid = file->private_data;
 603         int ret;
 604         size_t len;
 605
 606         /* we need at least the "type" member of uhid_event */
 607         if (count < sizeof(__u32))
 608                 return -EINVAL;
 609
 610         ret = mutex_lock_interruptible(&uhid->devlock);
 611         if (ret)
 612                 return ret;
 613
 614         memset(&uhid->input_buf, 0, sizeof(uhid->input_buf));
 615         len = min(count, sizeof(uhid->input_buf));
 616
 617         ret = uhid_event_from_user(buffer, len, &uhid->input_buf);
 618         if (ret)
 619                 goto unlock;
 620
 621         switch (uhid->input_buf.type) {
 622         case UHID_CREATE:
 623                 ret = uhid_dev_create(uhid, &uhid->input_buf);
 624                 break;
 625         case UHID_CREATE2:
 626                 ret = uhid_dev_create2(uhid, &uhid->input_buf);
 627                 break;
 628         case UHID_DESTROY:
 629                 ret = uhid_dev_destroy(uhid);
 630                 break;
 631         case UHID_INPUT:
 632                 ret = uhid_dev_input(uhid, &uhid->input_buf);
 633                 break;
 634         case UHID_INPUT2:
 635                 ret = uhid_dev_input2(uhid, &uhid->input_buf);
 636                 break;
 637         case UHID_FEATURE_ANSWER:
 638                 ret = uhid_dev_feature_answer(uhid, &uhid->input_buf);
 639                 break;
 640         default:
 641                 ret = -EOPNOTSUPP;
 642         }
 643
 644 unlock:
 645         mutex_unlock(&uhid->devlock);
 646
 647         /* return "count" not "len" to not confuse the caller */
 648         return ret ? ret : count;
 649 }
 650
 651 static unsigned int uhid_char_poll(struct file *file, poll_table *wait)
 652 {
 653         struct uhid_device *uhid = file->private_data;
 654
 655         poll_wait(file, &uhid->waitq, wait);
 656
 657         if (uhid->head != uhid->tail)
 658                 return POLLIN | POLLRDNORM;
 659
 660         return 0;
 661 }
 662
 663 static const struct file_operations uhid_fops = {
 664         .owner          = THIS_MODULE,
 665         .open           = uhid_char_open,
 666         .release        = uhid_char_release,
 667         .read           = uhid_char_read,
 668         .write          = uhid_char_write,
 669         .poll           = uhid_char_poll,
 670         .llseek         = no_llseek,
 671 };
 672
 673 static struct miscdevice uhid_misc = {
 674         .fops           = &uhid_fops,
 675         .minor          = UHID_MINOR,
 676         .name           = UHID_NAME,
 677 };
 678
 679 static int __init uhid_init(void)
 680 {
 681         return misc_register(&uhid_misc);
 682 }
 683
 684 static void __exit uhid_exit(void)
 685 {
 686         misc_deregister(&uhid_misc);
 687 }
 688
 689 module_init(uhid_init);
 690 module_exit(uhid_exit);
 691 MODULE_LICENSE("GPL");
 692 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
 693 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
 694 MODULE_ALIAS_MISCDEV(UHID_MINOR);
 695 MODULE_ALIAS("devname:" UHID_NAME);