2 * User-space I/O driver support for HID subsystem
3 * Copyright (c) 2012 David Herrmann
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the Free
9 * Software Foundation; either version 2 of the License, or (at your option)
13 #include <linux/atomic.h>
14 #include <linux/compat.h>
15 #include <linux/device.h>
17 #include <linux/hid.h>
18 #include <linux/input.h>
19 #include <linux/miscdevice.h>
20 #include <linux/module.h>
21 #include <linux/mutex.h>
22 #include <linux/poll.h>
23 #include <linux/sched.h>
24 #include <linux/spinlock.h>
25 #include <linux/uhid.h>
26 #include <linux/wait.h>
28 #define UHID_NAME "uhid"
29 #define UHID_BUFSIZE 32
38 struct hid_device
*hid
;
39 struct uhid_event input_buf
;
41 wait_queue_head_t waitq
;
45 struct uhid_event
*outq
[UHID_BUFSIZE
];
47 struct mutex report_lock
;
48 wait_queue_head_t report_wait
;
51 struct uhid_event report_buf
;
54 static struct miscdevice uhid_misc
;
56 static void uhid_queue(struct uhid_device
*uhid
, struct uhid_event
*ev
)
60 newhead
= (uhid
->head
+ 1) % UHID_BUFSIZE
;
62 if (newhead
!= uhid
->tail
) {
63 uhid
->outq
[uhid
->head
] = ev
;
65 wake_up_interruptible(&uhid
->waitq
);
67 hid_warn(uhid
->hid
, "Output queue is full\n");
72 static int uhid_queue_event(struct uhid_device
*uhid
, __u32 event
)
75 struct uhid_event
*ev
;
77 ev
= kzalloc(sizeof(*ev
), GFP_KERNEL
);
83 spin_lock_irqsave(&uhid
->qlock
, flags
);
85 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
90 static int uhid_hid_start(struct hid_device
*hid
)
92 struct uhid_device
*uhid
= hid
->driver_data
;
94 return uhid_queue_event(uhid
, UHID_START
);
97 static void uhid_hid_stop(struct hid_device
*hid
)
99 struct uhid_device
*uhid
= hid
->driver_data
;
102 uhid_queue_event(uhid
, UHID_STOP
);
105 static int uhid_hid_open(struct hid_device
*hid
)
107 struct uhid_device
*uhid
= hid
->driver_data
;
109 return uhid_queue_event(uhid
, UHID_OPEN
);
112 static void uhid_hid_close(struct hid_device
*hid
)
114 struct uhid_device
*uhid
= hid
->driver_data
;
116 uhid_queue_event(uhid
, UHID_CLOSE
);
119 static int uhid_hid_parse(struct hid_device
*hid
)
121 struct uhid_device
*uhid
= hid
->driver_data
;
123 return hid_parse_report(hid
, uhid
->rd_data
, uhid
->rd_size
);
126 static int uhid_hid_get_raw(struct hid_device
*hid
, unsigned char rnum
,
127 __u8
*buf
, size_t count
, unsigned char rtype
)
129 struct uhid_device
*uhid
= hid
->driver_data
;
131 struct uhid_event
*ev
;
134 size_t uninitialized_var(len
);
135 struct uhid_feature_answer_req
*req
;
141 case HID_FEATURE_REPORT
:
142 report_type
= UHID_FEATURE_REPORT
;
144 case HID_OUTPUT_REPORT
:
145 report_type
= UHID_OUTPUT_REPORT
;
147 case HID_INPUT_REPORT
:
148 report_type
= UHID_INPUT_REPORT
;
154 ret
= mutex_lock_interruptible(&uhid
->report_lock
);
158 ev
= kzalloc(sizeof(*ev
), GFP_KERNEL
);
164 spin_lock_irqsave(&uhid
->qlock
, flags
);
165 ev
->type
= UHID_FEATURE
;
166 ev
->u
.feature
.id
= atomic_inc_return(&uhid
->report_id
);
167 ev
->u
.feature
.rnum
= rnum
;
168 ev
->u
.feature
.rtype
= report_type
;
170 atomic_set(&uhid
->report_done
, 0);
171 uhid_queue(uhid
, ev
);
172 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
174 ret
= wait_event_interruptible_timeout(uhid
->report_wait
,
175 atomic_read(&uhid
->report_done
), 5 * HZ
);
178 * Make sure "uhid->running" is cleared on shutdown before
179 * "uhid->report_done" is set.
182 if (!ret
|| !uhid
->running
) {
184 } else if (ret
< 0) {
187 spin_lock_irqsave(&uhid
->qlock
, flags
);
188 req
= &uhid
->report_buf
.u
.feature_answer
;
195 min_t(size_t, req
->size
, UHID_DATA_MAX
));
196 memcpy(buf
, req
->data
, len
);
199 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
202 atomic_set(&uhid
->report_done
, 1);
205 mutex_unlock(&uhid
->report_lock
);
206 return ret
? ret
: len
;
209 static int uhid_hid_output_raw(struct hid_device
*hid
, __u8
*buf
, size_t count
,
210 unsigned char report_type
)
212 struct uhid_device
*uhid
= hid
->driver_data
;
215 struct uhid_event
*ev
;
217 switch (report_type
) {
218 case HID_FEATURE_REPORT
:
219 rtype
= UHID_FEATURE_REPORT
;
221 case HID_OUTPUT_REPORT
:
222 rtype
= UHID_OUTPUT_REPORT
;
228 if (count
< 1 || count
> UHID_DATA_MAX
)
231 ev
= kzalloc(sizeof(*ev
), GFP_KERNEL
);
235 ev
->type
= UHID_OUTPUT
;
236 ev
->u
.output
.size
= count
;
237 ev
->u
.output
.rtype
= rtype
;
238 memcpy(ev
->u
.output
.data
, buf
, count
);
240 spin_lock_irqsave(&uhid
->qlock
, flags
);
241 uhid_queue(uhid
, ev
);
242 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
247 static int uhid_hid_output_report(struct hid_device
*hid
, __u8
*buf
,
250 return uhid_hid_output_raw(hid
, buf
, count
, HID_OUTPUT_REPORT
);
253 static int uhid_raw_request(struct hid_device
*hid
, unsigned char reportnum
,
254 __u8
*buf
, size_t len
, unsigned char rtype
,
258 case HID_REQ_GET_REPORT
:
259 return uhid_hid_get_raw(hid
, reportnum
, buf
, len
, rtype
);
260 case HID_REQ_SET_REPORT
:
261 /* TODO: implement proper SET_REPORT functionality */
268 static struct hid_ll_driver uhid_hid_driver
= {
269 .start
= uhid_hid_start
,
270 .stop
= uhid_hid_stop
,
271 .open
= uhid_hid_open
,
272 .close
= uhid_hid_close
,
273 .parse
= uhid_hid_parse
,
274 .output_report
= uhid_hid_output_report
,
275 .raw_request
= uhid_raw_request
,
280 /* Apparently we haven't stepped on these rakes enough times yet. */
281 struct uhid_create_req_compat
{
286 compat_uptr_t rd_data
;
294 } __attribute__((__packed__
));
296 static int uhid_event_from_user(const char __user
*buffer
, size_t len
,
297 struct uhid_event
*event
)
299 if (is_compat_task()) {
302 if (get_user(type
, buffer
))
305 if (type
== UHID_CREATE
) {
307 * This is our messed up request with compat pointer.
308 * It is largish (more than 256 bytes) so we better
309 * allocate it from the heap.
311 struct uhid_create_req_compat
*compat
;
313 compat
= kzalloc(sizeof(*compat
), GFP_KERNEL
);
317 buffer
+= sizeof(type
);
319 if (copy_from_user(compat
, buffer
,
320 min(len
, sizeof(*compat
)))) {
325 /* Shuffle the data over to proper structure */
328 memcpy(event
->u
.create
.name
, compat
->name
,
329 sizeof(compat
->name
));
330 memcpy(event
->u
.create
.phys
, compat
->phys
,
331 sizeof(compat
->phys
));
332 memcpy(event
->u
.create
.uniq
, compat
->uniq
,
333 sizeof(compat
->uniq
));
335 event
->u
.create
.rd_data
= compat_ptr(compat
->rd_data
);
336 event
->u
.create
.rd_size
= compat
->rd_size
;
338 event
->u
.create
.bus
= compat
->bus
;
339 event
->u
.create
.vendor
= compat
->vendor
;
340 event
->u
.create
.product
= compat
->product
;
341 event
->u
.create
.version
= compat
->version
;
342 event
->u
.create
.country
= compat
->country
;
347 /* All others can be copied directly */
350 if (copy_from_user(event
, buffer
, min(len
, sizeof(*event
))))
356 static int uhid_event_from_user(const char __user
*buffer
, size_t len
,
357 struct uhid_event
*event
)
359 if (copy_from_user(event
, buffer
, min(len
, sizeof(*event
))))
366 static int uhid_dev_create(struct uhid_device
*uhid
,
367 const struct uhid_event
*ev
)
369 struct hid_device
*hid
;
375 uhid
->rd_size
= ev
->u
.create
.rd_size
;
376 if (uhid
->rd_size
<= 0 || uhid
->rd_size
> HID_MAX_DESCRIPTOR_SIZE
)
379 uhid
->rd_data
= kmalloc(uhid
->rd_size
, GFP_KERNEL
);
383 if (copy_from_user(uhid
->rd_data
, ev
->u
.create
.rd_data
,
389 hid
= hid_allocate_device();
395 strncpy(hid
->name
, ev
->u
.create
.name
, 127);
397 strncpy(hid
->phys
, ev
->u
.create
.phys
, 63);
399 strncpy(hid
->uniq
, ev
->u
.create
.uniq
, 63);
402 hid
->ll_driver
= &uhid_hid_driver
;
403 hid
->bus
= ev
->u
.create
.bus
;
404 hid
->vendor
= ev
->u
.create
.vendor
;
405 hid
->product
= ev
->u
.create
.product
;
406 hid
->version
= ev
->u
.create
.version
;
407 hid
->country
= ev
->u
.create
.country
;
408 hid
->driver_data
= uhid
;
409 hid
->dev
.parent
= uhid_misc
.this_device
;
412 uhid
->running
= true;
414 ret
= hid_add_device(hid
);
416 hid_err(hid
, "Cannot register HID device\n");
423 hid_destroy_device(hid
);
425 uhid
->running
= false;
427 kfree(uhid
->rd_data
);
431 static int uhid_dev_create2(struct uhid_device
*uhid
,
432 const struct uhid_event
*ev
)
434 struct hid_device
*hid
;
440 uhid
->rd_size
= ev
->u
.create2
.rd_size
;
441 if (uhid
->rd_size
<= 0 || uhid
->rd_size
> HID_MAX_DESCRIPTOR_SIZE
)
444 uhid
->rd_data
= kmalloc(uhid
->rd_size
, GFP_KERNEL
);
448 memcpy(uhid
->rd_data
, ev
->u
.create2
.rd_data
, uhid
->rd_size
);
450 hid
= hid_allocate_device();
456 strncpy(hid
->name
, ev
->u
.create2
.name
, 127);
458 strncpy(hid
->phys
, ev
->u
.create2
.phys
, 63);
460 strncpy(hid
->uniq
, ev
->u
.create2
.uniq
, 63);
463 hid
->ll_driver
= &uhid_hid_driver
;
464 hid
->bus
= ev
->u
.create2
.bus
;
465 hid
->vendor
= ev
->u
.create2
.vendor
;
466 hid
->product
= ev
->u
.create2
.product
;
467 hid
->version
= ev
->u
.create2
.version
;
468 hid
->country
= ev
->u
.create2
.country
;
469 hid
->driver_data
= uhid
;
470 hid
->dev
.parent
= uhid_misc
.this_device
;
473 uhid
->running
= true;
475 ret
= hid_add_device(hid
);
477 hid_err(hid
, "Cannot register HID device\n");
484 hid_destroy_device(hid
);
486 uhid
->running
= false;
488 kfree(uhid
->rd_data
);
492 static int uhid_dev_destroy(struct uhid_device
*uhid
)
497 /* clear "running" before setting "report_done" */
498 uhid
->running
= false;
500 atomic_set(&uhid
->report_done
, 1);
501 wake_up_interruptible(&uhid
->report_wait
);
503 hid_destroy_device(uhid
->hid
);
504 kfree(uhid
->rd_data
);
509 static int uhid_dev_input(struct uhid_device
*uhid
, struct uhid_event
*ev
)
514 hid_input_report(uhid
->hid
, HID_INPUT_REPORT
, ev
->u
.input
.data
,
515 min_t(size_t, ev
->u
.input
.size
, UHID_DATA_MAX
), 0);
520 static int uhid_dev_input2(struct uhid_device
*uhid
, struct uhid_event
*ev
)
525 hid_input_report(uhid
->hid
, HID_INPUT_REPORT
, ev
->u
.input2
.data
,
526 min_t(size_t, ev
->u
.input2
.size
, UHID_DATA_MAX
), 0);
531 static int uhid_dev_feature_answer(struct uhid_device
*uhid
,
532 struct uhid_event
*ev
)
539 spin_lock_irqsave(&uhid
->qlock
, flags
);
541 /* id for old report; drop it silently */
542 if (atomic_read(&uhid
->report_id
) != ev
->u
.feature_answer
.id
)
544 if (atomic_read(&uhid
->report_done
))
547 memcpy(&uhid
->report_buf
, ev
, sizeof(*ev
));
548 atomic_set(&uhid
->report_done
, 1);
549 wake_up_interruptible(&uhid
->report_wait
);
552 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
556 static int uhid_char_open(struct inode
*inode
, struct file
*file
)
558 struct uhid_device
*uhid
;
560 uhid
= kzalloc(sizeof(*uhid
), GFP_KERNEL
);
564 mutex_init(&uhid
->devlock
);
565 mutex_init(&uhid
->report_lock
);
566 spin_lock_init(&uhid
->qlock
);
567 init_waitqueue_head(&uhid
->waitq
);
568 init_waitqueue_head(&uhid
->report_wait
);
569 uhid
->running
= false;
570 atomic_set(&uhid
->report_done
, 1);
572 file
->private_data
= uhid
;
573 nonseekable_open(inode
, file
);
578 static int uhid_char_release(struct inode
*inode
, struct file
*file
)
580 struct uhid_device
*uhid
= file
->private_data
;
583 uhid_dev_destroy(uhid
);
585 for (i
= 0; i
< UHID_BUFSIZE
; ++i
)
586 kfree(uhid
->outq
[i
]);
593 static ssize_t
uhid_char_read(struct file
*file
, char __user
*buffer
,
594 size_t count
, loff_t
*ppos
)
596 struct uhid_device
*uhid
= file
->private_data
;
601 /* they need at least the "type" member of uhid_event */
602 if (count
< sizeof(__u32
))
606 if (file
->f_flags
& O_NONBLOCK
) {
607 if (uhid
->head
== uhid
->tail
)
610 ret
= wait_event_interruptible(uhid
->waitq
,
611 uhid
->head
!= uhid
->tail
);
616 ret
= mutex_lock_interruptible(&uhid
->devlock
);
620 if (uhid
->head
== uhid
->tail
) {
621 mutex_unlock(&uhid
->devlock
);
624 len
= min(count
, sizeof(**uhid
->outq
));
625 if (copy_to_user(buffer
, uhid
->outq
[uhid
->tail
], len
)) {
628 kfree(uhid
->outq
[uhid
->tail
]);
629 uhid
->outq
[uhid
->tail
] = NULL
;
631 spin_lock_irqsave(&uhid
->qlock
, flags
);
632 uhid
->tail
= (uhid
->tail
+ 1) % UHID_BUFSIZE
;
633 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
637 mutex_unlock(&uhid
->devlock
);
638 return ret
? ret
: len
;
641 static ssize_t
uhid_char_write(struct file
*file
, const char __user
*buffer
,
642 size_t count
, loff_t
*ppos
)
644 struct uhid_device
*uhid
= file
->private_data
;
648 /* we need at least the "type" member of uhid_event */
649 if (count
< sizeof(__u32
))
652 ret
= mutex_lock_interruptible(&uhid
->devlock
);
656 memset(&uhid
->input_buf
, 0, sizeof(uhid
->input_buf
));
657 len
= min(count
, sizeof(uhid
->input_buf
));
659 ret
= uhid_event_from_user(buffer
, len
, &uhid
->input_buf
);
663 switch (uhid
->input_buf
.type
) {
665 ret
= uhid_dev_create(uhid
, &uhid
->input_buf
);
668 ret
= uhid_dev_create2(uhid
, &uhid
->input_buf
);
671 ret
= uhid_dev_destroy(uhid
);
674 ret
= uhid_dev_input(uhid
, &uhid
->input_buf
);
677 ret
= uhid_dev_input2(uhid
, &uhid
->input_buf
);
679 case UHID_FEATURE_ANSWER
:
680 ret
= uhid_dev_feature_answer(uhid
, &uhid
->input_buf
);
687 mutex_unlock(&uhid
->devlock
);
689 /* return "count" not "len" to not confuse the caller */
690 return ret
? ret
: count
;
693 static unsigned int uhid_char_poll(struct file
*file
, poll_table
*wait
)
695 struct uhid_device
*uhid
= file
->private_data
;
697 poll_wait(file
, &uhid
->waitq
, wait
);
699 if (uhid
->head
!= uhid
->tail
)
700 return POLLIN
| POLLRDNORM
;
705 static const struct file_operations uhid_fops
= {
706 .owner
= THIS_MODULE
,
707 .open
= uhid_char_open
,
708 .release
= uhid_char_release
,
709 .read
= uhid_char_read
,
710 .write
= uhid_char_write
,
711 .poll
= uhid_char_poll
,
715 static struct miscdevice uhid_misc
= {
721 static int __init
uhid_init(void)
723 return misc_register(&uhid_misc
);
726 static void __exit
uhid_exit(void)
728 misc_deregister(&uhid_misc
);
731 module_init(uhid_init
);
732 module_exit(uhid_exit
);
733 MODULE_LICENSE("GPL");
734 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
735 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
736 MODULE_ALIAS_MISCDEV(UHID_MINOR
);
737 MODULE_ALIAS("devname:" UHID_NAME
);