drivers/hid/uhid.c

   1 /*
   2  * User-space I/O driver support for HID subsystem
   3  * Copyright (c) 2012 David Herrmann
   4  */
   5
   6 /*
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the Free
   9  * Software Foundation; either version 2 of the License, or (at your option)
  10  * any later version.
  11  */
  12
  13 #include <linux/atomic.h>
  14 #include <linux/compat.h>
  15 #include <linux/device.h>
  16 #include <linux/fs.h>
  17 #include <linux/hid.h>
  18 #include <linux/input.h>
  19 #include <linux/miscdevice.h>
  20 #include <linux/module.h>
  21 #include <linux/mutex.h>
  22 #include <linux/poll.h>
  23 #include <linux/sched.h>
  24 #include <linux/spinlock.h>
  25 #include <linux/uhid.h>
  26 #include <linux/wait.h>
  27
  28 #define UHID_NAME       "uhid"
  29 #define UHID_BUFSIZE    32
  30
  31 struct uhid_device {
  32         struct mutex devlock;
  33         bool running;
  34
  35         __u8 *rd_data;
  36         uint rd_size;
  37
  38         struct hid_device *hid;
  39         struct uhid_event input_buf;
  40
  41         wait_queue_head_t waitq;
  42         spinlock_t qlock;
  43         __u8 head;
  44         __u8 tail;
  45         struct uhid_event *outq[UHID_BUFSIZE];
  46
  47         struct mutex report_lock;
  48         wait_queue_head_t report_wait;
  49         atomic_t report_done;
  50         atomic_t report_id;
  51         struct uhid_event report_buf;
  52 };
  53
  54 static struct miscdevice uhid_misc;
  55
  56 static void uhid_queue(struct uhid_device *uhid, struct uhid_event *ev)
  57 {
  58         __u8 newhead;
  59
  60         newhead = (uhid->head + 1) % UHID_BUFSIZE;
  61
  62         if (newhead != uhid->tail) {
  63                 uhid->outq[uhid->head] = ev;
  64                 uhid->head = newhead;
  65                 wake_up_interruptible(&uhid->waitq);
  66         } else {
  67                 hid_warn(uhid->hid, "Output queue is full\n");
  68                 kfree(ev);
  69         }
  70 }
  71
  72 static int uhid_queue_event(struct uhid_device *uhid, __u32 event)
  73 {
  74         unsigned long flags;
  75         struct uhid_event *ev;
  76
  77         ev = kzalloc(sizeof(*ev), GFP_KERNEL);
  78         if (!ev)
  79                 return -ENOMEM;
  80
  81         ev->type = event;
  82
  83         spin_lock_irqsave(&uhid->qlock, flags);
  84         uhid_queue(uhid, ev);
  85         spin_unlock_irqrestore(&uhid->qlock, flags);
  86
  87         return 0;
  88 }
  89
  90 static int uhid_hid_start(struct hid_device *hid)
  91 {
  92         struct uhid_device *uhid = hid->driver_data;
  93
  94         return uhid_queue_event(uhid, UHID_START);
  95 }
  96
  97 static void uhid_hid_stop(struct hid_device *hid)
  98 {
  99         struct uhid_device *uhid = hid->driver_data;
 100
 101         hid->claimed = 0;
 102         uhid_queue_event(uhid, UHID_STOP);
 103 }
 104
 105 static int uhid_hid_open(struct hid_device *hid)
 106 {
 107         struct uhid_device *uhid = hid->driver_data;
 108
 109         return uhid_queue_event(uhid, UHID_OPEN);
 110 }
 111
 112 static void uhid_hid_close(struct hid_device *hid)
 113 {
 114         struct uhid_device *uhid = hid->driver_data;
 115
 116         uhid_queue_event(uhid, UHID_CLOSE);
 117 }
 118
 119 static int uhid_hid_parse(struct hid_device *hid)
 120 {
 121         struct uhid_device *uhid = hid->driver_data;
 122
 123         return hid_parse_report(hid, uhid->rd_data, uhid->rd_size);
 124 }
 125
 126 static int uhid_hid_get_raw(struct hid_device *hid, unsigned char rnum,
 127                             __u8 *buf, size_t count, unsigned char rtype)
 128 {
 129         struct uhid_device *uhid = hid->driver_data;
 130         __u8 report_type;
 131         struct uhid_event *ev;
 132         unsigned long flags;
 133         int ret;
 134         size_t uninitialized_var(len);
 135         struct uhid_feature_answer_req *req;
 136
 137         if (!uhid->running)
 138                 return -EIO;
 139
 140         switch (rtype) {
 141         case HID_FEATURE_REPORT:
 142                 report_type = UHID_FEATURE_REPORT;
 143                 break;
 144         case HID_OUTPUT_REPORT:
 145                 report_type = UHID_OUTPUT_REPORT;
 146                 break;
 147         case HID_INPUT_REPORT:
 148                 report_type = UHID_INPUT_REPORT;
 149                 break;
 150         default:
 151                 return -EINVAL;
 152         }
 153
 154         ret = mutex_lock_interruptible(&uhid->report_lock);
 155         if (ret)
 156                 return ret;
 157
 158         ev = kzalloc(sizeof(*ev), GFP_KERNEL);
 159         if (!ev) {
 160                 ret = -ENOMEM;
 161                 goto unlock;
 162         }
 163
 164         spin_lock_irqsave(&uhid->qlock, flags);
 165         ev->type = UHID_FEATURE;
 166         ev->u.feature.id = atomic_inc_return(&uhid->report_id);
 167         ev->u.feature.rnum = rnum;
 168         ev->u.feature.rtype = report_type;
 169
 170         atomic_set(&uhid->report_done, 0);
 171         uhid_queue(uhid, ev);
 172         spin_unlock_irqrestore(&uhid->qlock, flags);
 173
 174         ret = wait_event_interruptible_timeout(uhid->report_wait,
 175                                 atomic_read(&uhid->report_done), 5 * HZ);
 176
 177         /*
 178          * Make sure "uhid->running" is cleared on shutdown before
 179          * "uhid->report_done" is set.
 180          */
 181         smp_rmb();
 182         if (!ret || !uhid->running) {
 183                 ret = -EIO;
 184         } else if (ret < 0) {
 185                 ret = -ERESTARTSYS;
 186         } else {
 187                 spin_lock_irqsave(&uhid->qlock, flags);
 188                 req = &uhid->report_buf.u.feature_answer;
 189
 190                 if (req->err) {
 191                         ret = -EIO;
 192                 } else {
 193                         ret = 0;
 194                         len = min(count,
 195                                 min_t(size_t, req->size, UHID_DATA_MAX));
 196                         memcpy(buf, req->data, len);
 197                 }
 198
 199                 spin_unlock_irqrestore(&uhid->qlock, flags);
 200         }
 201
 202         atomic_set(&uhid->report_done, 1);
 203
 204 unlock:
 205         mutex_unlock(&uhid->report_lock);
 206         return ret ? ret : len;
 207 }
 208
 209 static int uhid_hid_output_raw(struct hid_device *hid, __u8 *buf, size_t count,
 210                                unsigned char report_type)
 211 {
 212         struct uhid_device *uhid = hid->driver_data;
 213         __u8 rtype;
 214         unsigned long flags;
 215         struct uhid_event *ev;
 216
 217         switch (report_type) {
 218         case HID_FEATURE_REPORT:
 219                 rtype = UHID_FEATURE_REPORT;
 220                 break;
 221         case HID_OUTPUT_REPORT:
 222                 rtype = UHID_OUTPUT_REPORT;
 223                 break;
 224         default:
 225                 return -EINVAL;
 226         }
 227
 228         if (count < 1 || count > UHID_DATA_MAX)
 229                 return -EINVAL;
 230
 231         ev = kzalloc(sizeof(*ev), GFP_KERNEL);
 232         if (!ev)
 233                 return -ENOMEM;
 234
 235         ev->type = UHID_OUTPUT;
 236         ev->u.output.size = count;
 237         ev->u.output.rtype = rtype;
 238         memcpy(ev->u.output.data, buf, count);
 239
 240         spin_lock_irqsave(&uhid->qlock, flags);
 241         uhid_queue(uhid, ev);
 242         spin_unlock_irqrestore(&uhid->qlock, flags);
 243
 244         return count;
 245 }
 246
 247 static int uhid_hid_output_report(struct hid_device *hid, __u8 *buf,
 248                                   size_t count)
 249 {
 250         struct uhid_device *uhid = hid->driver_data;
 251         unsigned long flags;
 252         struct uhid_event *ev;
 253
 254         if (count < 1 || count > UHID_DATA_MAX)
 255                 return -EINVAL;
 256
 257         ev = kzalloc(sizeof(*ev), GFP_KERNEL);
 258         if (!ev)
 259                 return -ENOMEM;
 260
 261         ev->type = UHID_OUTPUT;
 262         ev->u.output.size = count;
 263         ev->u.output.rtype = UHID_OUTPUT_REPORT;
 264         memcpy(ev->u.output.data, buf, count);
 265
 266         spin_lock_irqsave(&uhid->qlock, flags);
 267         uhid_queue(uhid, ev);
 268         spin_unlock_irqrestore(&uhid->qlock, flags);
 269
 270         return count;
 271 }
 272
 273 static struct hid_ll_driver uhid_hid_driver = {
 274         .start = uhid_hid_start,
 275         .stop = uhid_hid_stop,
 276         .open = uhid_hid_open,
 277         .close = uhid_hid_close,
 278         .parse = uhid_hid_parse,
 279         .output_report = uhid_hid_output_report,
 280 };
 281
 282 #ifdef CONFIG_COMPAT
 283
 284 /* Apparently we haven't stepped on these rakes enough times yet. */
 285 struct uhid_create_req_compat {
 286         __u8 name[128];
 287         __u8 phys[64];
 288         __u8 uniq[64];
 289
 290         compat_uptr_t rd_data;
 291         __u16 rd_size;
 292
 293         __u16 bus;
 294         __u32 vendor;
 295         __u32 product;
 296         __u32 version;
 297         __u32 country;
 298 } __attribute__((__packed__));
 299
 300 static int uhid_event_from_user(const char __user *buffer, size_t len,
 301                                 struct uhid_event *event)
 302 {
 303         if (is_compat_task()) {
 304                 u32 type;
 305
 306                 if (get_user(type, buffer))
 307                         return -EFAULT;
 308
 309                 if (type == UHID_CREATE) {
 310                         /*
 311                          * This is our messed up request with compat pointer.
 312                          * It is largish (more than 256 bytes) so we better
 313                          * allocate it from the heap.
 314                          */
 315                         struct uhid_create_req_compat *compat;
 316
 317                         compat = kzalloc(sizeof(*compat), GFP_KERNEL);
 318                         if (!compat)
 319                                 return -ENOMEM;
 320
 321                         buffer += sizeof(type);
 322                         len -= sizeof(type);
 323                         if (copy_from_user(compat, buffer,
 324                                            min(len, sizeof(*compat)))) {
 325                                 kfree(compat);
 326                                 return -EFAULT;
 327                         }
 328
 329                         /* Shuffle the data over to proper structure */
 330                         event->type = type;
 331
 332                         memcpy(event->u.create.name, compat->name,
 333                                 sizeof(compat->name));
 334                         memcpy(event->u.create.phys, compat->phys,
 335                                 sizeof(compat->phys));
 336                         memcpy(event->u.create.uniq, compat->uniq,
 337                                 sizeof(compat->uniq));
 338
 339                         event->u.create.rd_data = compat_ptr(compat->rd_data);
 340                         event->u.create.rd_size = compat->rd_size;
 341
 342                         event->u.create.bus = compat->bus;
 343                         event->u.create.vendor = compat->vendor;
 344                         event->u.create.product = compat->product;
 345                         event->u.create.version = compat->version;
 346                         event->u.create.country = compat->country;
 347
 348                         kfree(compat);
 349                         return 0;
 350                 }
 351                 /* All others can be copied directly */
 352         }
 353
 354         if (copy_from_user(event, buffer, min(len, sizeof(*event))))
 355                 return -EFAULT;
 356
 357         return 0;
 358 }
 359 #else
 360 static int uhid_event_from_user(const char __user *buffer, size_t len,
 361                                 struct uhid_event *event)
 362 {
 363         if (copy_from_user(event, buffer, min(len, sizeof(*event))))
 364                 return -EFAULT;
 365
 366         return 0;
 367 }
 368 #endif
 369
 370 static int uhid_dev_create(struct uhid_device *uhid,
 371                            const struct uhid_event *ev)
 372 {
 373         struct hid_device *hid;
 374         int ret;
 375
 376         if (uhid->running)
 377                 return -EALREADY;
 378
 379         uhid->rd_size = ev->u.create.rd_size;
 380         if (uhid->rd_size <= 0 || uhid->rd_size > HID_MAX_DESCRIPTOR_SIZE)
 381                 return -EINVAL;
 382
 383         uhid->rd_data = kmalloc(uhid->rd_size, GFP_KERNEL);
 384         if (!uhid->rd_data)
 385                 return -ENOMEM;
 386
 387         if (copy_from_user(uhid->rd_data, ev->u.create.rd_data,
 388                            uhid->rd_size)) {
 389                 ret = -EFAULT;
 390                 goto err_free;
 391         }
 392
 393         hid = hid_allocate_device();
 394         if (IS_ERR(hid)) {
 395                 ret = PTR_ERR(hid);
 396                 goto err_free;
 397         }
 398
 399         strncpy(hid->name, ev->u.create.name, 127);
 400         hid->name[127] = 0;
 401         strncpy(hid->phys, ev->u.create.phys, 63);
 402         hid->phys[63] = 0;
 403         strncpy(hid->uniq, ev->u.create.uniq, 63);
 404         hid->uniq[63] = 0;
 405
 406         hid->ll_driver = &uhid_hid_driver;
 407         hid->hid_get_raw_report = uhid_hid_get_raw;
 408         hid->hid_output_raw_report = uhid_hid_output_raw;
 409         hid->bus = ev->u.create.bus;
 410         hid->vendor = ev->u.create.vendor;
 411         hid->product = ev->u.create.product;
 412         hid->version = ev->u.create.version;
 413         hid->country = ev->u.create.country;
 414         hid->driver_data = uhid;
 415         hid->dev.parent = uhid_misc.this_device;
 416
 417         uhid->hid = hid;
 418         uhid->running = true;
 419
 420         ret = hid_add_device(hid);
 421         if (ret) {
 422                 hid_err(hid, "Cannot register HID device\n");
 423                 goto err_hid;
 424         }
 425
 426         return 0;
 427
 428 err_hid:
 429         hid_destroy_device(hid);
 430         uhid->hid = NULL;
 431         uhid->running = false;
 432 err_free:
 433         kfree(uhid->rd_data);
 434         return ret;
 435 }
 436
 437 static int uhid_dev_destroy(struct uhid_device *uhid)
 438 {
 439         if (!uhid->running)
 440                 return -EINVAL;
 441
 442         /* clear "running" before setting "report_done" */
 443         uhid->running = false;
 444         smp_wmb();
 445         atomic_set(&uhid->report_done, 1);
 446         wake_up_interruptible(&uhid->report_wait);
 447
 448         hid_destroy_device(uhid->hid);
 449         kfree(uhid->rd_data);
 450
 451         return 0;
 452 }
 453
 454 static int uhid_dev_input(struct uhid_device *uhid, struct uhid_event *ev)
 455 {
 456         if (!uhid->running)
 457                 return -EINVAL;
 458
 459         hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input.data,
 460                          min_t(size_t, ev->u.input.size, UHID_DATA_MAX), 0);
 461
 462         return 0;
 463 }
 464
 465 static int uhid_dev_feature_answer(struct uhid_device *uhid,
 466                                    struct uhid_event *ev)
 467 {
 468         unsigned long flags;
 469
 470         if (!uhid->running)
 471                 return -EINVAL;
 472
 473         spin_lock_irqsave(&uhid->qlock, flags);
 474
 475         /* id for old report; drop it silently */
 476         if (atomic_read(&uhid->report_id) != ev->u.feature_answer.id)
 477                 goto unlock;
 478         if (atomic_read(&uhid->report_done))
 479                 goto unlock;
 480
 481         memcpy(&uhid->report_buf, ev, sizeof(*ev));
 482         atomic_set(&uhid->report_done, 1);
 483         wake_up_interruptible(&uhid->report_wait);
 484
 485 unlock:
 486         spin_unlock_irqrestore(&uhid->qlock, flags);
 487         return 0;
 488 }
 489
 490 static int uhid_char_open(struct inode *inode, struct file *file)
 491 {
 492         struct uhid_device *uhid;
 493
 494         uhid = kzalloc(sizeof(*uhid), GFP_KERNEL);
 495         if (!uhid)
 496                 return -ENOMEM;
 497
 498         mutex_init(&uhid->devlock);
 499         mutex_init(&uhid->report_lock);
 500         spin_lock_init(&uhid->qlock);
 501         init_waitqueue_head(&uhid->waitq);
 502         init_waitqueue_head(&uhid->report_wait);
 503         uhid->running = false;
 504         atomic_set(&uhid->report_done, 1);
 505
 506         file->private_data = uhid;
 507         nonseekable_open(inode, file);
 508
 509         return 0;
 510 }
 511
 512 static int uhid_char_release(struct inode *inode, struct file *file)
 513 {
 514         struct uhid_device *uhid = file->private_data;
 515         unsigned int i;
 516
 517         uhid_dev_destroy(uhid);
 518
 519         for (i = 0; i < UHID_BUFSIZE; ++i)
 520                 kfree(uhid->outq[i]);
 521
 522         kfree(uhid);
 523
 524         return 0;
 525 }
 526
 527 static ssize_t uhid_char_read(struct file *file, char __user *buffer,
 528                                 size_t count, loff_t *ppos)
 529 {
 530         struct uhid_device *uhid = file->private_data;
 531         int ret;
 532         unsigned long flags;
 533         size_t len;
 534
 535         /* they need at least the "type" member of uhid_event */
 536         if (count < sizeof(__u32))
 537                 return -EINVAL;
 538
 539 try_again:
 540         if (file->f_flags & O_NONBLOCK) {
 541                 if (uhid->head == uhid->tail)
 542                         return -EAGAIN;
 543         } else {
 544                 ret = wait_event_interruptible(uhid->waitq,
 545                                                 uhid->head != uhid->tail);
 546                 if (ret)
 547                         return ret;
 548         }
 549
 550         ret = mutex_lock_interruptible(&uhid->devlock);
 551         if (ret)
 552                 return ret;
 553
 554         if (uhid->head == uhid->tail) {
 555                 mutex_unlock(&uhid->devlock);
 556                 goto try_again;
 557         } else {
 558                 len = min(count, sizeof(**uhid->outq));
 559                 if (copy_to_user(buffer, uhid->outq[uhid->tail], len)) {
 560                         ret = -EFAULT;
 561                 } else {
 562                         kfree(uhid->outq[uhid->tail]);
 563                         uhid->outq[uhid->tail] = NULL;
 564
 565                         spin_lock_irqsave(&uhid->qlock, flags);
 566                         uhid->tail = (uhid->tail + 1) % UHID_BUFSIZE;
 567                         spin_unlock_irqrestore(&uhid->qlock, flags);
 568                 }
 569         }
 570
 571         mutex_unlock(&uhid->devlock);
 572         return ret ? ret : len;
 573 }
 574
 575 static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
 576                                 size_t count, loff_t *ppos)
 577 {
 578         struct uhid_device *uhid = file->private_data;
 579         int ret;
 580         size_t len;
 581
 582         /* we need at least the "type" member of uhid_event */
 583         if (count < sizeof(__u32))
 584                 return -EINVAL;
 585
 586         ret = mutex_lock_interruptible(&uhid->devlock);
 587         if (ret)
 588                 return ret;
 589
 590         memset(&uhid->input_buf, 0, sizeof(uhid->input_buf));
 591         len = min(count, sizeof(uhid->input_buf));
 592
 593         ret = uhid_event_from_user(buffer, len, &uhid->input_buf);
 594         if (ret)
 595                 goto unlock;
 596
 597         switch (uhid->input_buf.type) {
 598         case UHID_CREATE:
 599                 ret = uhid_dev_create(uhid, &uhid->input_buf);
 600                 break;
 601         case UHID_DESTROY:
 602                 ret = uhid_dev_destroy(uhid);
 603                 break;
 604         case UHID_INPUT:
 605                 ret = uhid_dev_input(uhid, &uhid->input_buf);
 606                 break;
 607         case UHID_FEATURE_ANSWER:
 608                 ret = uhid_dev_feature_answer(uhid, &uhid->input_buf);
 609                 break;
 610         default:
 611                 ret = -EOPNOTSUPP;
 612         }
 613
 614 unlock:
 615         mutex_unlock(&uhid->devlock);
 616
 617         /* return "count" not "len" to not confuse the caller */
 618         return ret ? ret : count;
 619 }
 620
 621 static unsigned int uhid_char_poll(struct file *file, poll_table *wait)
 622 {
 623         struct uhid_device *uhid = file->private_data;
 624
 625         poll_wait(file, &uhid->waitq, wait);
 626
 627         if (uhid->head != uhid->tail)
 628                 return POLLIN | POLLRDNORM;
 629
 630         return 0;
 631 }
 632
 633 static const struct file_operations uhid_fops = {
 634         .owner          = THIS_MODULE,
 635         .open           = uhid_char_open,
 636         .release        = uhid_char_release,
 637         .read           = uhid_char_read,
 638         .write          = uhid_char_write,
 639         .poll           = uhid_char_poll,
 640         .llseek         = no_llseek,
 641 };
 642
 643 static struct miscdevice uhid_misc = {
 644         .fops           = &uhid_fops,
 645         .minor          = UHID_MINOR,
 646         .name           = UHID_NAME,
 647 };
 648
 649 static int __init uhid_init(void)
 650 {
 651         return misc_register(&uhid_misc);
 652 }
 653
 654 static void __exit uhid_exit(void)
 655 {
 656         misc_deregister(&uhid_misc);
 657 }
 658
 659 module_init(uhid_init);
 660 module_exit(uhid_exit);
 661 MODULE_LICENSE("GPL");
 662 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
 663 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
 664 MODULE_ALIAS_MISCDEV(UHID_MINOR);
 665 MODULE_ALIAS("devname:" UHID_NAME);