[deliverable/linux.git] / drivers / hid / uhid.c

/*
 * User-space I/O driver support for HID subsystem
 * Copyright (c) 2012 David Herrmann
 */

/*
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the Free
 * Software Foundation; either version 2 of the License, or (at your option)
 * any later version.
 */

#include <linux/atomic.h>
#include <linux/compat.h>
#include <linux/device.h>
#include <linux/fs.h>
#include <linux/hid.h>
#include <linux/input.h>
#include <linux/miscdevice.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/poll.h>
#include <linux/sched.h>
#include <linux/spinlock.h>
#include <linux/uhid.h>
#include <linux/wait.h>

#define UHID_NAME	"uhid"
#define UHID_BUFSIZE	32

struct uhid_device {
	struct mutex devlock;
	bool running;

	__u8 *rd_data;
	uint rd_size;

	struct hid_device *hid;
	struct uhid_event input_buf;

	wait_queue_head_t waitq;
	spinlock_t qlock;
	__u8 head;
	__u8 tail;
	struct uhid_event *outq[UHID_BUFSIZE];

	struct mutex report_lock;
	wait_queue_head_t report_wait;
	atomic_t report_done;
	atomic_t report_id;
	struct uhid_event report_buf;
};

static struct miscdevice uhid_misc;

static void uhid_queue(struct uhid_device *uhid, struct uhid_event *ev)
{
	__u8 newhead;

	newhead = (uhid->head + 1) % UHID_BUFSIZE;

	if (newhead != uhid->tail) {
		uhid->outq[uhid->head] = ev;
		uhid->head = newhead;
		wake_up_interruptible(&uhid->waitq);
	} else {
		hid_warn(uhid->hid, "Output queue is full\n");
		kfree(ev);
	}
}

static int uhid_queue_event(struct uhid_device *uhid, __u32 event)
{
	unsigned long flags;
	struct uhid_event *ev;

	ev = kzalloc(sizeof(*ev), GFP_KERNEL);
	if (!ev)
		return -ENOMEM;

	ev->type = event;

	spin_lock_irqsave(&uhid->qlock, flags);
	uhid_queue(uhid, ev);
	spin_unlock_irqrestore(&uhid->qlock, flags);

	return 0;
}

static int uhid_hid_start(struct hid_device *hid)
{
	struct uhid_device *uhid = hid->driver_data;

	return uhid_queue_event(uhid, UHID_START);
}

static void uhid_hid_stop(struct hid_device *hid)
{
	struct uhid_device *uhid = hid->driver_data;

	hid->claimed = 0;
	uhid_queue_event(uhid, UHID_STOP);
}

static int uhid_hid_open(struct hid_device *hid)
{
	struct uhid_device *uhid = hid->driver_data;

	return uhid_queue_event(uhid, UHID_OPEN);
}

static void uhid_hid_close(struct hid_device *hid)
{
	struct uhid_device *uhid = hid->driver_data;

	uhid_queue_event(uhid, UHID_CLOSE);
}

static int uhid_hid_parse(struct hid_device *hid)
{
	struct uhid_device *uhid = hid->driver_data;

	return hid_parse_report(hid, uhid->rd_data, uhid->rd_size);
}

static int uhid_hid_get_raw(struct hid_device *hid, unsigned char rnum,
			    __u8 *buf, size_t count, unsigned char rtype)
{
	struct uhid_device *uhid = hid->driver_data;
	__u8 report_type;
	struct uhid_event *ev;
	unsigned long flags;
	int ret;
	size_t uninitialized_var(len);
	struct uhid_feature_answer_req *req;

	if (!uhid->running)
		return -EIO;

	switch (rtype) {
	case HID_FEATURE_REPORT:
		report_type = UHID_FEATURE_REPORT;
		break;
	case HID_OUTPUT_REPORT:
		report_type = UHID_OUTPUT_REPORT;
		break;
	case HID_INPUT_REPORT:
		report_type = UHID_INPUT_REPORT;
		break;
	default:
		return -EINVAL;
	}

	ret = mutex_lock_interruptible(&uhid->report_lock);
	if (ret)
		return ret;

	ev = kzalloc(sizeof(*ev), GFP_KERNEL);
	if (!ev) {
		ret = -ENOMEM;
		goto unlock;
	}

	spin_lock_irqsave(&uhid->qlock, flags);
	ev->type = UHID_FEATURE;
	ev->u.feature.id = atomic_inc_return(&uhid->report_id);
	ev->u.feature.rnum = rnum;
	ev->u.feature.rtype = report_type;

	atomic_set(&uhid->report_done, 0);
	uhid_queue(uhid, ev);
	spin_unlock_irqrestore(&uhid->qlock, flags);

	ret = wait_event_interruptible_timeout(uhid->report_wait,
				atomic_read(&uhid->report_done), 5 * HZ);

	/*
	 * Make sure "uhid->running" is cleared on shutdown before
	 * "uhid->report_done" is set.
	 */
	smp_rmb();
	if (!ret || !uhid->running) {
		ret = -EIO;
	} else if (ret < 0) {
		ret = -ERESTARTSYS;
	} else {
		spin_lock_irqsave(&uhid->qlock, flags);
		req = &uhid->report_buf.u.feature_answer;

		if (req->err) {
			ret = -EIO;
		} else {
			ret = 0;
			len = min(count,
				min_t(size_t, req->size, UHID_DATA_MAX));
			memcpy(buf, req->data, len);
		}

		spin_unlock_irqrestore(&uhid->qlock, flags);
	}

	atomic_set(&uhid->report_done, 1);

unlock:
	mutex_unlock(&uhid->report_lock);
	return ret ? ret : len;
}

static int uhid_hid_output_raw(struct hid_device *hid, __u8 *buf, size_t count,
			       unsigned char report_type)
{
	struct uhid_device *uhid = hid->driver_data;
	__u8 rtype;
	unsigned long flags;
	struct uhid_event *ev;

	switch (report_type) {
	case HID_FEATURE_REPORT:
		rtype = UHID_FEATURE_REPORT;
		break;
	case HID_OUTPUT_REPORT:
		rtype = UHID_OUTPUT_REPORT;
		break;
	default:
		return -EINVAL;
	}

	if (count < 1 || count > UHID_DATA_MAX)
		return -EINVAL;

	ev = kzalloc(sizeof(*ev), GFP_KERNEL);
	if (!ev)
		return -ENOMEM;

	ev->type = UHID_OUTPUT;
	ev->u.output.size = count;
	ev->u.output.rtype = rtype;
	memcpy(ev->u.output.data, buf, count);

	spin_lock_irqsave(&uhid->qlock, flags);
	uhid_queue(uhid, ev);
	spin_unlock_irqrestore(&uhid->qlock, flags);

	return count;
}

static int uhid_hid_output_report(struct hid_device *hid, __u8 *buf,
				  size_t count)
{
	return uhid_hid_output_raw(hid, buf, count, HID_OUTPUT_REPORT);
}

static int uhid_raw_request(struct hid_device *hid, unsigned char reportnum,
			    __u8 *buf, size_t len, unsigned char rtype,
			    int reqtype)
{
	switch (reqtype) {
	case HID_REQ_GET_REPORT:
		return uhid_hid_get_raw(hid, reportnum, buf, len, rtype);
	case HID_REQ_SET_REPORT:
		/* TODO: implement proper SET_REPORT functionality */
		return -ENOSYS;
	default:
		return -EIO;
	}
}

static struct hid_ll_driver uhid_hid_driver = {
	.start = uhid_hid_start,
	.stop = uhid_hid_stop,
	.open = uhid_hid_open,
	.close = uhid_hid_close,
	.parse = uhid_hid_parse,
	.output_report = uhid_hid_output_report,
	.raw_request = uhid_raw_request,
};

#ifdef CONFIG_COMPAT

/* Apparently we haven't stepped on these rakes enough times yet. */
struct uhid_create_req_compat {
	__u8 name[128];
	__u8 phys[64];
	__u8 uniq[64];

	compat_uptr_t rd_data;
	__u16 rd_size;

	__u16 bus;
	__u32 vendor;
	__u32 product;
	__u32 version;
	__u32 country;
} __attribute__((__packed__));

static int uhid_event_from_user(const char __user *buffer, size_t len,
				struct uhid_event *event)
{
	if (is_compat_task()) {
		u32 type;

		if (get_user(type, buffer))
			return -EFAULT;

		if (type == UHID_CREATE) {
			/*
			 * This is our messed up request with compat pointer.
			 * It is largish (more than 256 bytes) so we better
			 * allocate it from the heap.
			 */
			struct uhid_create_req_compat *compat;

			compat = kzalloc(sizeof(*compat), GFP_KERNEL);
			if (!compat)
				return -ENOMEM;

			buffer += sizeof(type);
			len -= sizeof(type);
			if (copy_from_user(compat, buffer,
					   min(len, sizeof(*compat)))) {
				kfree(compat);
				return -EFAULT;
			}

			/* Shuffle the data over to proper structure */
			event->type = type;

			memcpy(event->u.create.name, compat->name,
				sizeof(compat->name));
			memcpy(event->u.create.phys, compat->phys,
				sizeof(compat->phys));
			memcpy(event->u.create.uniq, compat->uniq,
				sizeof(compat->uniq));

			event->u.create.rd_data = compat_ptr(compat->rd_data);
			event->u.create.rd_size = compat->rd_size;

			event->u.create.bus = compat->bus;
			event->u.create.vendor = compat->vendor;
			event->u.create.product = compat->product;
			event->u.create.version = compat->version;
			event->u.create.country = compat->country;

			kfree(compat);
			return 0;
		}
		/* All others can be copied directly */
	}

	if (copy_from_user(event, buffer, min(len, sizeof(*event))))
		return -EFAULT;

	return 0;
}
#else
static int uhid_event_from_user(const char __user *buffer, size_t len,
				struct uhid_event *event)
{
	if (copy_from_user(event, buffer, min(len, sizeof(*event))))
		return -EFAULT;

	return 0;
}
#endif

static int uhid_dev_create(struct uhid_device *uhid,
			   const struct uhid_event *ev)
{
	struct hid_device *hid;
	int ret;

	if (uhid->running)
		return -EALREADY;

	uhid->rd_size = ev->u.create.rd_size;
	if (uhid->rd_size <= 0 || uhid->rd_size > HID_MAX_DESCRIPTOR_SIZE)
		return -EINVAL;

	uhid->rd_data = kmalloc(uhid->rd_size, GFP_KERNEL);
	if (!uhid->rd_data)
		return -ENOMEM;

	if (copy_from_user(uhid->rd_data, ev->u.create.rd_data,
			   uhid->rd_size)) {
		ret = -EFAULT;
		goto err_free;
	}

	hid = hid_allocate_device();
	if (IS_ERR(hid)) {
		ret = PTR_ERR(hid);
		goto err_free;
	}

	strncpy(hid->name, ev->u.create.name, 127);
	hid->name[127] = 0;
	strncpy(hid->phys, ev->u.create.phys, 63);
	hid->phys[63] = 0;
	strncpy(hid->uniq, ev->u.create.uniq, 63);
	hid->uniq[63] = 0;

	hid->ll_driver = &uhid_hid_driver;
	hid->bus = ev->u.create.bus;
	hid->vendor = ev->u.create.vendor;
	hid->product = ev->u.create.product;
	hid->version = ev->u.create.version;
	hid->country = ev->u.create.country;
	hid->driver_data = uhid;
	hid->dev.parent = uhid_misc.this_device;

	uhid->hid = hid;
	uhid->running = true;

	ret = hid_add_device(hid);
	if (ret) {
		hid_err(hid, "Cannot register HID device\n");
		goto err_hid;
	}

	return 0;

err_hid:
	hid_destroy_device(hid);
	uhid->hid = NULL;
	uhid->running = false;
err_free:
	kfree(uhid->rd_data);
	return ret;
}

static int uhid_dev_create2(struct uhid_device *uhid,
			    const struct uhid_event *ev)
{
	struct hid_device *hid;
	int ret;

	if (uhid->running)
		return -EALREADY;

	uhid->rd_size = ev->u.create2.rd_size;
	if (uhid->rd_size <= 0 || uhid->rd_size > HID_MAX_DESCRIPTOR_SIZE)
		return -EINVAL;

	uhid->rd_data = kmalloc(uhid->rd_size, GFP_KERNEL);
	if (!uhid->rd_data)
		return -ENOMEM;

	memcpy(uhid->rd_data, ev->u.create2.rd_data, uhid->rd_size);

	hid = hid_allocate_device();
	if (IS_ERR(hid)) {
		ret = PTR_ERR(hid);
		goto err_free;
	}

	strncpy(hid->name, ev->u.create2.name, 127);
	hid->name[127] = 0;
	strncpy(hid->phys, ev->u.create2.phys, 63);
	hid->phys[63] = 0;
	strncpy(hid->uniq, ev->u.create2.uniq, 63);
	hid->uniq[63] = 0;

	hid->ll_driver = &uhid_hid_driver;
	hid->bus = ev->u.create2.bus;
	hid->vendor = ev->u.create2.vendor;
	hid->product = ev->u.create2.product;
	hid->version = ev->u.create2.version;
	hid->country = ev->u.create2.country;
	hid->driver_data = uhid;
	hid->dev.parent = uhid_misc.this_device;

	uhid->hid = hid;
	uhid->running = true;

	ret = hid_add_device(hid);
	if (ret) {
		hid_err(hid, "Cannot register HID device\n");
		goto err_hid;
	}

	return 0;

err_hid:
	hid_destroy_device(hid);
	uhid->hid = NULL;
	uhid->running = false;
err_free:
	kfree(uhid->rd_data);
	return ret;
}

static int uhid_dev_destroy(struct uhid_device *uhid)
{
	if (!uhid->running)
		return -EINVAL;

	/* clear "running" before setting "report_done" */
	uhid->running = false;
	smp_wmb();
	atomic_set(&uhid->report_done, 1);
	wake_up_interruptible(&uhid->report_wait);

	hid_destroy_device(uhid->hid);
	kfree(uhid->rd_data);

	return 0;
}

static int uhid_dev_input(struct uhid_device *uhid, struct uhid_event *ev)
{
	if (!uhid->running)
		return -EINVAL;

	hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input.data,
			 min_t(size_t, ev->u.input.size, UHID_DATA_MAX), 0);

	return 0;
}

static int uhid_dev_input2(struct uhid_device *uhid, struct uhid_event *ev)
{
	if (!uhid->running)
		return -EINVAL;

	hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input2.data,
			 min_t(size_t, ev->u.input2.size, UHID_DATA_MAX), 0);

	return 0;
}

static int uhid_dev_feature_answer(struct uhid_device *uhid,
				   struct uhid_event *ev)
{
	unsigned long flags;

	if (!uhid->running)
		return -EINVAL;

	spin_lock_irqsave(&uhid->qlock, flags);

	/* id for old report; drop it silently */
	if (atomic_read(&uhid->report_id) != ev->u.feature_answer.id)
		goto unlock;
	if (atomic_read(&uhid->report_done))
		goto unlock;

	memcpy(&uhid->report_buf, ev, sizeof(*ev));
	atomic_set(&uhid->report_done, 1);
	wake_up_interruptible(&uhid->report_wait);

unlock:
	spin_unlock_irqrestore(&uhid->qlock, flags);
	return 0;
}

static int uhid_char_open(struct inode *inode, struct file *file)
{
	struct uhid_device *uhid;

	uhid = kzalloc(sizeof(*uhid), GFP_KERNEL);
	if (!uhid)
		return -ENOMEM;

	mutex_init(&uhid->devlock);
	mutex_init(&uhid->report_lock);
	spin_lock_init(&uhid->qlock);
	init_waitqueue_head(&uhid->waitq);
	init_waitqueue_head(&uhid->report_wait);
	uhid->running = false;
	atomic_set(&uhid->report_done, 1);

	file->private_data = uhid;
	nonseekable_open(inode, file);

	return 0;
}

static int uhid_char_release(struct inode *inode, struct file *file)
{
	struct uhid_device *uhid = file->private_data;
	unsigned int i;

	uhid_dev_destroy(uhid);

	for (i = 0; i < UHID_BUFSIZE; ++i)
		kfree(uhid->outq[i]);

	kfree(uhid);

	return 0;
}

static ssize_t uhid_char_read(struct file *file, char __user *buffer,
				size_t count, loff_t *ppos)
{
	struct uhid_device *uhid = file->private_data;
	int ret;
	unsigned long flags;
	size_t len;

	/* they need at least the "type" member of uhid_event */
	if (count < sizeof(__u32))
		return -EINVAL;

try_again:
	if (file->f_flags & O_NONBLOCK) {
		if (uhid->head == uhid->tail)
			return -EAGAIN;
	} else {
		ret = wait_event_interruptible(uhid->waitq,
						uhid->head != uhid->tail);
		if (ret)
			return ret;
	}

	ret = mutex_lock_interruptible(&uhid->devlock);
	if (ret)
		return ret;

	if (uhid->head == uhid->tail) {
		mutex_unlock(&uhid->devlock);
		goto try_again;
	} else {
		len = min(count, sizeof(**uhid->outq));
		if (copy_to_user(buffer, uhid->outq[uhid->tail], len)) {
			ret = -EFAULT;
		} else {
			kfree(uhid->outq[uhid->tail]);
			uhid->outq[uhid->tail] = NULL;

			spin_lock_irqsave(&uhid->qlock, flags);
			uhid->tail = (uhid->tail + 1) % UHID_BUFSIZE;
			spin_unlock_irqrestore(&uhid->qlock, flags);
		}
	}

	mutex_unlock(&uhid->devlock);
	return ret ? ret : len;
}

static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
				size_t count, loff_t *ppos)
{
	struct uhid_device *uhid = file->private_data;
	int ret;
	size_t len;

	/* we need at least the "type" member of uhid_event */
	if (count < sizeof(__u32))
		return -EINVAL;

	ret = mutex_lock_interruptible(&uhid->devlock);
	if (ret)
		return ret;

	memset(&uhid->input_buf, 0, sizeof(uhid->input_buf));
	len = min(count, sizeof(uhid->input_buf));

	ret = uhid_event_from_user(buffer, len, &uhid->input_buf);
	if (ret)
		goto unlock;

	switch (uhid->input_buf.type) {
	case UHID_CREATE:
		ret = uhid_dev_create(uhid, &uhid->input_buf);
		break;
	case UHID_CREATE2:
		ret = uhid_dev_create2(uhid, &uhid->input_buf);
		break;
	case UHID_DESTROY:
		ret = uhid_dev_destroy(uhid);
		break;
	case UHID_INPUT:
		ret = uhid_dev_input(uhid, &uhid->input_buf);
		break;
	case UHID_INPUT2:
		ret = uhid_dev_input2(uhid, &uhid->input_buf);
		break;
	case UHID_FEATURE_ANSWER:
		ret = uhid_dev_feature_answer(uhid, &uhid->input_buf);
		break;
	default:
		ret = -EOPNOTSUPP;
	}

unlock:
	mutex_unlock(&uhid->devlock);

	/* return "count" not "len" to not confuse the caller */
	return ret ? ret : count;
}

static unsigned int uhid_char_poll(struct file *file, poll_table *wait)
{
	struct uhid_device *uhid = file->private_data;

	poll_wait(file, &uhid->waitq, wait);

	if (uhid->head != uhid->tail)
		return POLLIN | POLLRDNORM;

	return 0;
}

static const struct file_operations uhid_fops = {
	.owner		= THIS_MODULE,
	.open		= uhid_char_open,
	.release	= uhid_char_release,
	.read		= uhid_char_read,
	.write		= uhid_char_write,
	.poll		= uhid_char_poll,
	.llseek		= no_llseek,
};

static struct miscdevice uhid_misc = {
	.fops		= &uhid_fops,
	.minor		= UHID_MINOR,
	.name		= UHID_NAME,
};

static int __init uhid_init(void)
{
	return misc_register(&uhid_misc);
}

static void __exit uhid_exit(void)
{
	misc_deregister(&uhid_misc);
}

module_init(uhid_init);
module_exit(uhid_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
MODULE_ALIAS_MISCDEV(UHID_MINOR);
MODULE_ALIAS("devname:" UHID_NAME);
Commit	Line	Data
1ccd7a2a DH	1	/*
	2	* User-space I/O driver support for HID subsystem
	3	* Copyright (c) 2012 David Herrmann
	4	*/
	5
	6	/*
	7	* This program is free software; you can redistribute it and/or modify it
	8	* under the terms of the GNU General Public License as published by the Free
	9	* Software Foundation; either version 2 of the License, or (at your option)
	10	* any later version.
	11	*/
	12
	13	#include <linux/atomic.h>
befde022	14	#include <linux/compat.h>
1ccd7a2a DH	15	#include <linux/device.h>
	16	#include <linux/fs.h>
	17	#include <linux/hid.h>
	18	#include <linux/input.h>
	19	#include <linux/miscdevice.h>
	20	#include <linux/module.h>
	21	#include <linux/mutex.h>
	22	#include <linux/poll.h>
	23	#include <linux/sched.h>
	24	#include <linux/spinlock.h>
	25	#include <linux/uhid.h>
	26	#include <linux/wait.h>
	27
	28	#define UHID_NAME "uhid"
ace3d861 DH	29	#define UHID_BUFSIZE 32
	30
	31	struct uhid_device {
d937ae5f	32	struct mutex devlock;
d365c6cf DH	33	bool running;
	34
	35	__u8 *rd_data;
	36	uint rd_size;
	37
ace3d861	38	struct hid_device *hid;
6664ef72	39	struct uhid_event input_buf;
ace3d861 DH	40
	41	wait_queue_head_t waitq;
	42	spinlock_t qlock;
	43	__u8 head;
	44	__u8 tail;
	45	struct uhid_event *outq[UHID_BUFSIZE];
fcfcf0de DH	46
	47	struct mutex report_lock;
	48	wait_queue_head_t report_wait;
	49	atomic_t report_done;
	50	atomic_t report_id;
	51	struct uhid_event report_buf;
ace3d861	52	};
1ccd7a2a DH	53
	54	static struct miscdevice uhid_misc;
	55
ace3d861 DH	56	static void uhid_queue(struct uhid_device uhid, struct uhid_event ev)
	57	{
	58	__u8 newhead;
	59
	60	newhead = (uhid->head + 1) % UHID_BUFSIZE;
	61
	62	if (newhead != uhid->tail) {
	63	uhid->outq[uhid->head] = ev;
	64	uhid->head = newhead;
	65	wake_up_interruptible(&uhid->waitq);
	66	} else {
	67	hid_warn(uhid->hid, "Output queue is full\n");
	68	kfree(ev);
	69	}
	70	}
	71
	72	static int uhid_queue_event(struct uhid_device *uhid, __u32 event)
	73	{
	74	unsigned long flags;
	75	struct uhid_event *ev;
	76
	77	ev = kzalloc(sizeof(*ev), GFP_KERNEL);
	78	if (!ev)
	79	return -ENOMEM;
	80
	81	ev->type = event;
	82
	83	spin_lock_irqsave(&uhid->qlock, flags);
	84	uhid_queue(uhid, ev);
	85	spin_unlock_irqrestore(&uhid->qlock, flags);
	86
	87	return 0;
	88	}
	89
d365c6cf DH	90	static int uhid_hid_start(struct hid_device *hid)
d365c6cf DH	91	{
ec4b7dea DH	92	struct uhid_device *uhid = hid->driver_data;
	93
	94	return uhid_queue_event(uhid, UHID_START);
d365c6cf DH	95	}
	96
	97	static void uhid_hid_stop(struct hid_device *hid)
	98	{
ec4b7dea DH	99	struct uhid_device *uhid = hid->driver_data;
	100
	101	hid->claimed = 0;
	102	uhid_queue_event(uhid, UHID_STOP);
d365c6cf DH	103	}
	104
	105	static int uhid_hid_open(struct hid_device *hid)
	106	{
e7191474 DH	107	struct uhid_device *uhid = hid->driver_data;
	108
	109	return uhid_queue_event(uhid, UHID_OPEN);
d365c6cf DH	110	}
	111
	112	static void uhid_hid_close(struct hid_device *hid)
	113	{
e7191474 DH	114	struct uhid_device *uhid = hid->driver_data;
	115
	116	uhid_queue_event(uhid, UHID_CLOSE);
d365c6cf DH	117	}
d365c6cf DH	118
d365c6cf DH	119	static int uhid_hid_parse(struct hid_device *hid)
d365c6cf DH	120	{
037c061b DH	121	struct uhid_device *uhid = hid->driver_data;
	122
	123	return hid_parse_report(hid, uhid->rd_data, uhid->rd_size);
d365c6cf DH	124	}
d365c6cf DH	125
289a7162 JK	126	static int uhid_hid_get_raw(struct hid_device *hid, unsigned char rnum,
	127	__u8 *buf, size_t count, unsigned char rtype)
	128	{
	129	struct uhid_device *uhid = hid->driver_data;
	130	__u8 report_type;
	131	struct uhid_event *ev;
	132	unsigned long flags;
	133	int ret;
	134	size_t uninitialized_var(len);
	135	struct uhid_feature_answer_req *req;
	136
	137	if (!uhid->running)
	138	return -EIO;
	139
	140	switch (rtype) {
	141	case HID_FEATURE_REPORT:
	142	report_type = UHID_FEATURE_REPORT;
	143	break;
	144	case HID_OUTPUT_REPORT:
	145	report_type = UHID_OUTPUT_REPORT;
	146	break;
	147	case HID_INPUT_REPORT:
	148	report_type = UHID_INPUT_REPORT;
	149	break;
	150	default:
	151	return -EINVAL;
	152	}
	153
	154	ret = mutex_lock_interruptible(&uhid->report_lock);
	155	if (ret)
	156	return ret;
	157
	158	ev = kzalloc(sizeof(*ev), GFP_KERNEL);
	159	if (!ev) {
	160	ret = -ENOMEM;
	161	goto unlock;
	162	}
	163
	164	spin_lock_irqsave(&uhid->qlock, flags);
	165	ev->type = UHID_FEATURE;
	166	ev->u.feature.id = atomic_inc_return(&uhid->report_id);
	167	ev->u.feature.rnum = rnum;
	168	ev->u.feature.rtype = report_type;
	169
	170	atomic_set(&uhid->report_done, 0);
	171	uhid_queue(uhid, ev);
	172	spin_unlock_irqrestore(&uhid->qlock, flags);
	173
	174	ret = wait_event_interruptible_timeout(uhid->report_wait,
	175	atomic_read(&uhid->report_done), 5 * HZ);
	176
	177	/*
	178	* Make sure "uhid->running" is cleared on shutdown before
	179	* "uhid->report_done" is set.
	180	*/
	181	smp_rmb();
	182	if (!ret \|\| !uhid->running) {
	183	ret = -EIO;
	184	} else if (ret < 0) {
	185	ret = -ERESTARTSYS;
	186	} else {
	187	spin_lock_irqsave(&uhid->qlock, flags);
	188	req = &uhid->report_buf.u.feature_answer;
	189
190	if (req->err) {
191	ret = -EIO;
192	} else {
193	ret = 0;
194	len = min(count,
195	min_t(size_t, req->size, UHID_DATA_MAX));
196	memcpy(buf, req->data, len);
197	}
198
199	spin_unlock_irqrestore(&uhid->qlock, flags);
200	}
201
202	atomic_set(&uhid->report_done, 1);
203
204	unlock:
205	mutex_unlock(&uhid->report_lock);
206	return ret ? ret : len;
207	}
208
d365c6cf DH	209	static int uhid_hid_output_raw(struct hid_device hid, __u8 buf, size_t count,
	210	unsigned char report_type)
	211	{
3b3baa82 DH	212	struct uhid_device *uhid = hid->driver_data;
	213	__u8 rtype;
	214	unsigned long flags;
	215	struct uhid_event *ev;
	216
	217	switch (report_type) {
	218	case HID_FEATURE_REPORT:
	219	rtype = UHID_FEATURE_REPORT;
	220	break;
	221	case HID_OUTPUT_REPORT:
	222	rtype = UHID_OUTPUT_REPORT;
	223	break;
	224	default:
	225	return -EINVAL;
	226	}
	227
	228	if (count < 1 \|\| count > UHID_DATA_MAX)
	229	return -EINVAL;
	230
	231	ev = kzalloc(sizeof(*ev), GFP_KERNEL);
	232	if (!ev)
	233	return -ENOMEM;
	234
	235	ev->type = UHID_OUTPUT;
	236	ev->u.output.size = count;
	237	ev->u.output.rtype = rtype;
	238	memcpy(ev->u.output.data, buf, count);
	239
	240	spin_lock_irqsave(&uhid->qlock, flags);
	241	uhid_queue(uhid, ev);
	242	spin_unlock_irqrestore(&uhid->qlock, flags);
	243
	244	return count;
d365c6cf DH	245	}
d365c6cf DH	246
596cfdd8 FP	247	static int uhid_hid_output_report(struct hid_device hid, __u8 buf,
	248	size_t count)
	249	{
41abfb36	250	return uhid_hid_output_raw(hid, buf, count, HID_OUTPUT_REPORT);
596cfdd8 FP	251	}
596cfdd8 FP	252
706daeff BT	253	static int uhid_raw_request(struct hid_device *hid, unsigned char reportnum,
	254	__u8 *buf, size_t len, unsigned char rtype,
	255	int reqtype)
	256	{
	257	switch (reqtype) {
	258	case HID_REQ_GET_REPORT:
	259	return uhid_hid_get_raw(hid, reportnum, buf, len, rtype);
	260	case HID_REQ_SET_REPORT:
	261	/* TODO: implement proper SET_REPORT functionality */
	262	return -ENOSYS;
	263	default:
	264	return -EIO;
	265	}
	266	}
	267
d365c6cf DH	268	static struct hid_ll_driver uhid_hid_driver = {
	269	.start = uhid_hid_start,
	270	.stop = uhid_hid_stop,
	271	.open = uhid_hid_open,
	272	.close = uhid_hid_close,
d365c6cf	273	.parse = uhid_hid_parse,
596cfdd8	274	.output_report = uhid_hid_output_report,
706daeff	275	.raw_request = uhid_raw_request,
d365c6cf DH	276	};
d365c6cf DH	277
befde022 DT	278	#ifdef CONFIG_COMPAT
	279
	280	/* Apparently we haven't stepped on these rakes enough times yet. */
	281	struct uhid_create_req_compat {
	282	__u8 name[128];
	283	__u8 phys[64];
	284	__u8 uniq[64];
	285
	286	compat_uptr_t rd_data;
	287	__u16 rd_size;
	288
	289	__u16 bus;
	290	__u32 vendor;
	291	__u32 product;
	292	__u32 version;
	293	__u32 country;
	294	} __attribute__((__packed__));
	295
	296	static int uhid_event_from_user(const char __user *buffer, size_t len,
	297	struct uhid_event *event)
	298	{
	299	if (is_compat_task()) {
	300	u32 type;
	301
	302	if (get_user(type, buffer))
	303	return -EFAULT;
	304
	305	if (type == UHID_CREATE) {
	306	/*
	307	* This is our messed up request with compat pointer.
	308	* It is largish (more than 256 bytes) so we better
	309	* allocate it from the heap.
	310	*/
	311	struct uhid_create_req_compat *compat;
	312
80897aa7	313	compat = kzalloc(sizeof(*compat), GFP_KERNEL);
befde022 DT	314	if (!compat)
	315	return -ENOMEM;
	316
	317	buffer += sizeof(type);
	318	len -= sizeof(type);
	319	if (copy_from_user(compat, buffer,
	320	min(len, sizeof(*compat)))) {
	321	kfree(compat);
	322	return -EFAULT;
	323	}
	324
	325	/* Shuffle the data over to proper structure */
	326	event->type = type;
	327
	328	memcpy(event->u.create.name, compat->name,
	329	sizeof(compat->name));
	330	memcpy(event->u.create.phys, compat->phys,
	331	sizeof(compat->phys));
	332	memcpy(event->u.create.uniq, compat->uniq,
	333	sizeof(compat->uniq));
	334
	335	event->u.create.rd_data = compat_ptr(compat->rd_data);
	336	event->u.create.rd_size = compat->rd_size;
	337
	338	event->u.create.bus = compat->bus;
	339	event->u.create.vendor = compat->vendor;
	340	event->u.create.product = compat->product;
	341	event->u.create.version = compat->version;
	342	event->u.create.country = compat->country;
	343
	344	kfree(compat);
	345	return 0;
	346	}
	347	/* All others can be copied directly */
	348	}
	349
	350	if (copy_from_user(event, buffer, min(len, sizeof(*event))))
	351	return -EFAULT;
	352
	353	return 0;
	354	}
	355	#else
	356	static int uhid_event_from_user(const char __user *buffer, size_t len,
	357	struct uhid_event *event)
	358	{
	359	if (copy_from_user(event, buffer, min(len, sizeof(*event))))
	360	return -EFAULT;
	361
	362	return 0;
	363	}
	364	#endif
	365
d365c6cf DH	366	static int uhid_dev_create(struct uhid_device *uhid,
	367	const struct uhid_event *ev)
	368	{
	369	struct hid_device *hid;
	370	int ret;
	371
	372	if (uhid->running)
	373	return -EALREADY;
	374
	375	uhid->rd_size = ev->u.create.rd_size;
	376	if (uhid->rd_size <= 0 \|\| uhid->rd_size > HID_MAX_DESCRIPTOR_SIZE)
	377	return -EINVAL;
	378
	379	uhid->rd_data = kmalloc(uhid->rd_size, GFP_KERNEL);
	380	if (!uhid->rd_data)
	381	return -ENOMEM;
	382
	383	if (copy_from_user(uhid->rd_data, ev->u.create.rd_data,
	384	uhid->rd_size)) {
	385	ret = -EFAULT;
	386	goto err_free;
	387	}
	388
	389	hid = hid_allocate_device();
	390	if (IS_ERR(hid)) {
	391	ret = PTR_ERR(hid);
	392	goto err_free;
	393	}
	394
	395	strncpy(hid->name, ev->u.create.name, 127);
	396	hid->name[127] = 0;
	397	strncpy(hid->phys, ev->u.create.phys, 63);
	398	hid->phys[63] = 0;
	399	strncpy(hid->uniq, ev->u.create.uniq, 63);
	400	hid->uniq[63] = 0;
	401
	402	hid->ll_driver = &uhid_hid_driver;
d365c6cf DH	403	hid->bus = ev->u.create.bus;
	404	hid->vendor = ev->u.create.vendor;
	405	hid->product = ev->u.create.product;
	406	hid->version = ev->u.create.version;
	407	hid->country = ev->u.create.country;
	408	hid->driver_data = uhid;
	409	hid->dev.parent = uhid_misc.this_device;
	410
	411	uhid->hid = hid;
	412	uhid->running = true;
	413
	414	ret = hid_add_device(hid);
	415	if (ret) {
	416	hid_err(hid, "Cannot register HID device\n");
	417	goto err_hid;
	418	}
	419
	420	return 0;
	421
	422	err_hid:
	423	hid_destroy_device(hid);
	424	uhid->hid = NULL;
	425	uhid->running = false;
	426	err_free:
	427	kfree(uhid->rd_data);
	428	return ret;
	429	}
	430
4522643a PG	431	static int uhid_dev_create2(struct uhid_device *uhid,
	432	const struct uhid_event *ev)
	433	{
	434	struct hid_device *hid;
	435	int ret;
	436
	437	if (uhid->running)
	438	return -EALREADY;
	439
	440	uhid->rd_size = ev->u.create2.rd_size;
	441	if (uhid->rd_size <= 0 \|\| uhid->rd_size > HID_MAX_DESCRIPTOR_SIZE)
	442	return -EINVAL;
	443
	444	uhid->rd_data = kmalloc(uhid->rd_size, GFP_KERNEL);
	445	if (!uhid->rd_data)
	446	return -ENOMEM;
	447
	448	memcpy(uhid->rd_data, ev->u.create2.rd_data, uhid->rd_size);
	449
	450	hid = hid_allocate_device();
	451	if (IS_ERR(hid)) {
	452	ret = PTR_ERR(hid);
	453	goto err_free;
	454	}
	455
	456	strncpy(hid->name, ev->u.create2.name, 127);
	457	hid->name[127] = 0;
	458	strncpy(hid->phys, ev->u.create2.phys, 63);
	459	hid->phys[63] = 0;
	460	strncpy(hid->uniq, ev->u.create2.uniq, 63);
	461	hid->uniq[63] = 0;
	462
	463	hid->ll_driver = &uhid_hid_driver;
	464	hid->bus = ev->u.create2.bus;
	465	hid->vendor = ev->u.create2.vendor;
	466	hid->product = ev->u.create2.product;
	467	hid->version = ev->u.create2.version;
	468	hid->country = ev->u.create2.country;
	469	hid->driver_data = uhid;
	470	hid->dev.parent = uhid_misc.this_device;
	471
	472	uhid->hid = hid;
	473	uhid->running = true;
	474
	475	ret = hid_add_device(hid);
	476	if (ret) {
	477	hid_err(hid, "Cannot register HID device\n");
	478	goto err_hid;
	479	}
	480
	481	return 0;
	482
	483	err_hid:
	484	hid_destroy_device(hid);
	485	uhid->hid = NULL;
	486	uhid->running = false;
	487	err_free:
	488	kfree(uhid->rd_data);
	489	return ret;
	490	}
	491
d365c6cf DH	492	static int uhid_dev_destroy(struct uhid_device *uhid)
	493	{
	494	if (!uhid->running)
	495	return -EINVAL;
	496
fcfcf0de	497	/* clear "running" before setting "report_done" */
d365c6cf	498	uhid->running = false;
fcfcf0de DH	499	smp_wmb();
	500	atomic_set(&uhid->report_done, 1);
	501	wake_up_interruptible(&uhid->report_wait);
d365c6cf DH	502
	503	hid_destroy_device(uhid->hid);
	504	kfree(uhid->rd_data);
	505
	506	return 0;
	507	}
	508
5e87a36a DH	509	static int uhid_dev_input(struct uhid_device uhid, struct uhid_event ev)
	510	{
	511	if (!uhid->running)
	512	return -EINVAL;
	513
	514	hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input.data,
	515	min_t(size_t, ev->u.input.size, UHID_DATA_MAX), 0);
	516
	517	return 0;
	518	}
	519
4522643a PG	520	static int uhid_dev_input2(struct uhid_device uhid, struct uhid_event ev)
	521	{
	522	if (!uhid->running)
	523	return -EINVAL;
	524
	525	hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input2.data,
	526	min_t(size_t, ev->u.input2.size, UHID_DATA_MAX), 0);
	527
	528	return 0;
	529	}
	530
fcfcf0de DH	531	static int uhid_dev_feature_answer(struct uhid_device *uhid,
	532	struct uhid_event *ev)
	533	{
	534	unsigned long flags;
	535
	536	if (!uhid->running)
	537	return -EINVAL;
	538
	539	spin_lock_irqsave(&uhid->qlock, flags);
	540
	541	/* id for old report; drop it silently */
	542	if (atomic_read(&uhid->report_id) != ev->u.feature_answer.id)
	543	goto unlock;
	544	if (atomic_read(&uhid->report_done))
	545	goto unlock;
	546
	547	memcpy(&uhid->report_buf, ev, sizeof(*ev));
	548	atomic_set(&uhid->report_done, 1);
	549	wake_up_interruptible(&uhid->report_wait);
	550
	551	unlock:
	552	spin_unlock_irqrestore(&uhid->qlock, flags);
	553	return 0;
	554	}
	555
1ccd7a2a DH	556	static int uhid_char_open(struct inode inode, struct file file)
1ccd7a2a DH	557	{
ace3d861 DH	558	struct uhid_device *uhid;
	559
	560	uhid = kzalloc(sizeof(*uhid), GFP_KERNEL);
	561	if (!uhid)
	562	return -ENOMEM;
	563
d937ae5f	564	mutex_init(&uhid->devlock);
fcfcf0de	565	mutex_init(&uhid->report_lock);
ace3d861 DH	566	spin_lock_init(&uhid->qlock);
ace3d861 DH	567	init_waitqueue_head(&uhid->waitq);
fcfcf0de	568	init_waitqueue_head(&uhid->report_wait);
d365c6cf	569	uhid->running = false;
fcfcf0de	570	atomic_set(&uhid->report_done, 1);
ace3d861 DH	571
	572	file->private_data = uhid;
	573	nonseekable_open(inode, file);
	574
1ccd7a2a DH	575	return 0;
	576	}
	577
	578	static int uhid_char_release(struct inode inode, struct file file)
	579	{
ace3d861 DH	580	struct uhid_device *uhid = file->private_data;
	581	unsigned int i;
	582
d365c6cf DH	583	uhid_dev_destroy(uhid);
d365c6cf DH	584
ace3d861 DH	585	for (i = 0; i < UHID_BUFSIZE; ++i)
	586	kfree(uhid->outq[i]);
	587
	588	kfree(uhid);
	589
1ccd7a2a DH	590	return 0;
	591	}
	592
	593	static ssize_t uhid_char_read(struct file file, char __user buffer,
	594	size_t count, loff_t *ppos)
	595	{
d937ae5f DH	596	struct uhid_device *uhid = file->private_data;
	597	int ret;
	598	unsigned long flags;
	599	size_t len;
	600
	601	/* they need at least the "type" member of uhid_event */
	602	if (count < sizeof(__u32))
	603	return -EINVAL;
	604
	605	try_again:
	606	if (file->f_flags & O_NONBLOCK) {
	607	if (uhid->head == uhid->tail)
	608	return -EAGAIN;
	609	} else {
	610	ret = wait_event_interruptible(uhid->waitq,
	611	uhid->head != uhid->tail);
	612	if (ret)
	613	return ret;
	614	}
	615
	616	ret = mutex_lock_interruptible(&uhid->devlock);
	617	if (ret)
	618	return ret;
	619
	620	if (uhid->head == uhid->tail) {
	621	mutex_unlock(&uhid->devlock);
	622	goto try_again;
	623	} else {
	624	len = min(count, sizeof(**uhid->outq));
adefb69b	625	if (copy_to_user(buffer, uhid->outq[uhid->tail], len)) {
d937ae5f DH	626	ret = -EFAULT;
	627	} else {
	628	kfree(uhid->outq[uhid->tail]);
	629	uhid->outq[uhid->tail] = NULL;
	630
	631	spin_lock_irqsave(&uhid->qlock, flags);
	632	uhid->tail = (uhid->tail + 1) % UHID_BUFSIZE;
	633	spin_unlock_irqrestore(&uhid->qlock, flags);
	634	}
	635	}
	636
	637	mutex_unlock(&uhid->devlock);
	638	return ret ? ret : len;
1ccd7a2a DH	639	}
	640
	641	static ssize_t uhid_char_write(struct file file, const char __user buffer,
	642	size_t count, loff_t *ppos)
	643	{
6664ef72 DH	644	struct uhid_device *uhid = file->private_data;
	645	int ret;
	646	size_t len;
	647
	648	/* we need at least the "type" member of uhid_event */
	649	if (count < sizeof(__u32))
	650	return -EINVAL;
	651
	652	ret = mutex_lock_interruptible(&uhid->devlock);
	653	if (ret)
	654	return ret;
	655
	656	memset(&uhid->input_buf, 0, sizeof(uhid->input_buf));
	657	len = min(count, sizeof(uhid->input_buf));
befde022 DT	658
	659	ret = uhid_event_from_user(buffer, len, &uhid->input_buf);
	660	if (ret)
6664ef72	661	goto unlock;
6664ef72 DH	662
6664ef72 DH	663	switch (uhid->input_buf.type) {
d365c6cf DH	664	case UHID_CREATE:
	665	ret = uhid_dev_create(uhid, &uhid->input_buf);
	666	break;
4522643a PG	667	case UHID_CREATE2:
	668	ret = uhid_dev_create2(uhid, &uhid->input_buf);
	669	break;
d365c6cf DH	670	case UHID_DESTROY:
	671	ret = uhid_dev_destroy(uhid);
	672	break;
5e87a36a DH	673	case UHID_INPUT:
	674	ret = uhid_dev_input(uhid, &uhid->input_buf);
	675	break;
4522643a PG	676	case UHID_INPUT2:
	677	ret = uhid_dev_input2(uhid, &uhid->input_buf);
	678	break;
fcfcf0de DH	679	case UHID_FEATURE_ANSWER:
	680	ret = uhid_dev_feature_answer(uhid, &uhid->input_buf);
	681	break;
6664ef72 DH	682	default:
	683	ret = -EOPNOTSUPP;
	684	}
	685
	686	unlock:
	687	mutex_unlock(&uhid->devlock);
	688
	689	/* return "count" not "len" to not confuse the caller */
	690	return ret ? ret : count;
1ccd7a2a DH	691	}
	692
	693	static unsigned int uhid_char_poll(struct file file, poll_table wait)
	694	{
1f9dec1e DH	695	struct uhid_device *uhid = file->private_data;
	696
	697	poll_wait(file, &uhid->waitq, wait);
	698
	699	if (uhid->head != uhid->tail)
	700	return POLLIN \| POLLRDNORM;
	701
1ccd7a2a DH	702	return 0;
	703	}
	704
	705	static const struct file_operations uhid_fops = {
	706	.owner = THIS_MODULE,
	707	.open = uhid_char_open,
	708	.release = uhid_char_release,
	709	.read = uhid_char_read,
	710	.write = uhid_char_write,
	711	.poll = uhid_char_poll,
	712	.llseek = no_llseek,
	713	};
	714
	715	static struct miscdevice uhid_misc = {
	716	.fops = &uhid_fops,
19872d20	717	.minor = UHID_MINOR,
1ccd7a2a DH	718	.name = UHID_NAME,
	719	};
	720
	721	static int __init uhid_init(void)
	722	{
	723	return misc_register(&uhid_misc);
	724	}
	725
	726	static void __exit uhid_exit(void)
	727	{
	728	misc_deregister(&uhid_misc);
	729	}
	730
	731	module_init(uhid_init);
	732	module_exit(uhid_exit);
	733	MODULE_LICENSE("GPL");
	734	MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
	735	MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
19872d20	736	MODULE_ALIAS_MISCDEV(UHID_MINOR);
60cbd53e	737	MODULE_ALIAS("devname:" UHID_NAME);