drivers/hid/uhid.c

   1 /*
   2  * User-space I/O driver support for HID subsystem
   3  * Copyright (c) 2012 David Herrmann
   4  */
   5
   6 /*
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the Free
   9  * Software Foundation; either version 2 of the License, or (at your option)
  10  * any later version.
  11  */
  12
  13 #include <linux/atomic.h>
  14 #include <linux/device.h>
  15 #include <linux/fs.h>
  16 #include <linux/hid.h>
  17 #include <linux/input.h>
  18 #include <linux/miscdevice.h>
  19 #include <linux/module.h>
  20 #include <linux/mutex.h>
  21 #include <linux/poll.h>
  22 #include <linux/sched.h>
  23 #include <linux/spinlock.h>
  24 #include <linux/uhid.h>
  25 #include <linux/wait.h>
  26
  27 #define UHID_NAME       "uhid"
  28 #define UHID_BUFSIZE    32
  29
  30 struct uhid_device {
  31         struct mutex devlock;
  32         bool running;
  33
  34         __u8 *rd_data;
  35         uint rd_size;
  36
  37         struct hid_device *hid;
  38         struct uhid_event input_buf;
  39
  40         wait_queue_head_t waitq;
  41         spinlock_t qlock;
  42         __u8 head;
  43         __u8 tail;
  44         struct uhid_event *outq[UHID_BUFSIZE];
  45
  46         struct mutex report_lock;
  47         wait_queue_head_t report_wait;
  48         atomic_t report_done;
  49         atomic_t report_id;
  50         struct uhid_event report_buf;
  51 };
  52
  53 static struct miscdevice uhid_misc;
  54
  55 static void uhid_queue(struct uhid_device *uhid, struct uhid_event *ev)
  56 {
  57         __u8 newhead;
  58
  59         newhead = (uhid->head + 1) % UHID_BUFSIZE;
  60
  61         if (newhead != uhid->tail) {
  62                 uhid->outq[uhid->head] = ev;
  63                 uhid->head = newhead;
  64                 wake_up_interruptible(&uhid->waitq);
  65         } else {
  66                 hid_warn(uhid->hid, "Output queue is full\n");
  67                 kfree(ev);
  68         }
  69 }
  70
  71 static int uhid_queue_event(struct uhid_device *uhid, __u32 event)
  72 {
  73         unsigned long flags;
  74         struct uhid_event *ev;
  75
  76         ev = kzalloc(sizeof(*ev), GFP_KERNEL);
  77         if (!ev)
  78                 return -ENOMEM;
  79
  80         ev->type = event;
  81
  82         spin_lock_irqsave(&uhid->qlock, flags);
  83         uhid_queue(uhid, ev);
  84         spin_unlock_irqrestore(&uhid->qlock, flags);
  85
  86         return 0;
  87 }
  88
  89 static int uhid_hid_start(struct hid_device *hid)
  90 {
  91         struct uhid_device *uhid = hid->driver_data;
  92
  93         return uhid_queue_event(uhid, UHID_START);
  94 }
  95
  96 static void uhid_hid_stop(struct hid_device *hid)
  97 {
  98         struct uhid_device *uhid = hid->driver_data;
  99
 100         hid->claimed = 0;
 101         uhid_queue_event(uhid, UHID_STOP);
 102 }
 103
 104 static int uhid_hid_open(struct hid_device *hid)
 105 {
 106         struct uhid_device *uhid = hid->driver_data;
 107
 108         return uhid_queue_event(uhid, UHID_OPEN);
 109 }
 110
 111 static void uhid_hid_close(struct hid_device *hid)
 112 {
 113         struct uhid_device *uhid = hid->driver_data;
 114
 115         uhid_queue_event(uhid, UHID_CLOSE);
 116 }
 117
 118 static int uhid_hid_input(struct input_dev *input, unsigned int type,
 119                           unsigned int code, int value)
 120 {
 121         struct hid_device *hid = input_get_drvdata(input);
 122         struct uhid_device *uhid = hid->driver_data;
 123         unsigned long flags;
 124         struct uhid_event *ev;
 125
 126         ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
 127         if (!ev)
 128                 return -ENOMEM;
 129
 130         ev->type = UHID_OUTPUT_EV;
 131         ev->u.output_ev.type = type;
 132         ev->u.output_ev.code = code;
 133         ev->u.output_ev.value = value;
 134
 135         spin_lock_irqsave(&uhid->qlock, flags);
 136         uhid_queue(uhid, ev);
 137         spin_unlock_irqrestore(&uhid->qlock, flags);
 138
 139         return 0;
 140 }
 141
 142 static int uhid_hid_parse(struct hid_device *hid)
 143 {
 144         struct uhid_device *uhid = hid->driver_data;
 145
 146         return hid_parse_report(hid, uhid->rd_data, uhid->rd_size);
 147 }
 148
 149 static int uhid_hid_get_raw(struct hid_device *hid, unsigned char rnum,
 150                             __u8 *buf, size_t count, unsigned char rtype)
 151 {
 152         struct uhid_device *uhid = hid->driver_data;
 153         __u8 report_type;
 154         struct uhid_event *ev;
 155         unsigned long flags;
 156         int ret;
 157         size_t uninitialized_var(len);
 158         struct uhid_feature_answer_req *req;
 159
 160         if (!uhid->running)
 161                 return -EIO;
 162
 163         switch (rtype) {
 164         case HID_FEATURE_REPORT:
 165                 report_type = UHID_FEATURE_REPORT;
 166                 break;
 167         case HID_OUTPUT_REPORT:
 168                 report_type = UHID_OUTPUT_REPORT;
 169                 break;
 170         case HID_INPUT_REPORT:
 171                 report_type = UHID_INPUT_REPORT;
 172                 break;
 173         default:
 174                 return -EINVAL;
 175         }
 176
 177         ret = mutex_lock_interruptible(&uhid->report_lock);
 178         if (ret)
 179                 return ret;
 180
 181         ev = kzalloc(sizeof(*ev), GFP_KERNEL);
 182         if (!ev) {
 183                 ret = -ENOMEM;
 184                 goto unlock;
 185         }
 186
 187         spin_lock_irqsave(&uhid->qlock, flags);
 188         ev->type = UHID_FEATURE;
 189         ev->u.feature.id = atomic_inc_return(&uhid->report_id);
 190         ev->u.feature.rnum = rnum;
 191         ev->u.feature.rtype = report_type;
 192
 193         atomic_set(&uhid->report_done, 0);
 194         uhid_queue(uhid, ev);
 195         spin_unlock_irqrestore(&uhid->qlock, flags);
 196
 197         ret = wait_event_interruptible_timeout(uhid->report_wait,
 198                                 atomic_read(&uhid->report_done), 5 * HZ);
 199
 200         /*
 201          * Make sure "uhid->running" is cleared on shutdown before
 202          * "uhid->report_done" is set.
 203          */
 204         smp_rmb();
 205         if (!ret || !uhid->running) {
 206                 ret = -EIO;
 207         } else if (ret < 0) {
 208                 ret = -ERESTARTSYS;
 209         } else {
 210                 spin_lock_irqsave(&uhid->qlock, flags);
 211                 req = &uhid->report_buf.u.feature_answer;
 212
 213                 if (req->err) {
 214                         ret = -EIO;
 215                 } else {
 216                         ret = 0;
 217                         len = min(count,
 218                                 min_t(size_t, req->size, UHID_DATA_MAX));
 219                         memcpy(buf, req->data, len);
 220                 }
 221
 222                 spin_unlock_irqrestore(&uhid->qlock, flags);
 223         }
 224
 225         atomic_set(&uhid->report_done, 1);
 226
 227 unlock:
 228         mutex_unlock(&uhid->report_lock);
 229         return ret ? ret : len;
 230 }
 231
 232 static int uhid_hid_output_raw(struct hid_device *hid, __u8 *buf, size_t count,
 233                                unsigned char report_type)
 234 {
 235         struct uhid_device *uhid = hid->driver_data;
 236         __u8 rtype;
 237         unsigned long flags;
 238         struct uhid_event *ev;
 239
 240         switch (report_type) {
 241         case HID_FEATURE_REPORT:
 242                 rtype = UHID_FEATURE_REPORT;
 243                 break;
 244         case HID_OUTPUT_REPORT:
 245                 rtype = UHID_OUTPUT_REPORT;
 246                 break;
 247         default:
 248                 return -EINVAL;
 249         }
 250
 251         if (count < 1 || count > UHID_DATA_MAX)
 252                 return -EINVAL;
 253
 254         ev = kzalloc(sizeof(*ev), GFP_KERNEL);
 255         if (!ev)
 256                 return -ENOMEM;
 257
 258         ev->type = UHID_OUTPUT;
 259         ev->u.output.size = count;
 260         ev->u.output.rtype = rtype;
 261         memcpy(ev->u.output.data, buf, count);
 262
 263         spin_lock_irqsave(&uhid->qlock, flags);
 264         uhid_queue(uhid, ev);
 265         spin_unlock_irqrestore(&uhid->qlock, flags);
 266
 267         return count;
 268 }
 269
 270 static struct hid_ll_driver uhid_hid_driver = {
 271         .start = uhid_hid_start,
 272         .stop = uhid_hid_stop,
 273         .open = uhid_hid_open,
 274         .close = uhid_hid_close,
 275         .hidinput_input_event = uhid_hid_input,
 276         .parse = uhid_hid_parse,
 277 };
 278
 279 static int uhid_dev_create(struct uhid_device *uhid,
 280                            const struct uhid_event *ev)
 281 {
 282         struct hid_device *hid;
 283         int ret;
 284
 285         if (uhid->running)
 286                 return -EALREADY;
 287
 288         uhid->rd_size = ev->u.create.rd_size;
 289         if (uhid->rd_size <= 0 || uhid->rd_size > HID_MAX_DESCRIPTOR_SIZE)
 290                 return -EINVAL;
 291
 292         uhid->rd_data = kmalloc(uhid->rd_size, GFP_KERNEL);
 293         if (!uhid->rd_data)
 294                 return -ENOMEM;
 295
 296         if (copy_from_user(uhid->rd_data, ev->u.create.rd_data,
 297                            uhid->rd_size)) {
 298                 ret = -EFAULT;
 299                 goto err_free;
 300         }
 301
 302         hid = hid_allocate_device();
 303         if (IS_ERR(hid)) {
 304                 ret = PTR_ERR(hid);
 305                 goto err_free;
 306         }
 307
 308         strncpy(hid->name, ev->u.create.name, 127);
 309         hid->name[127] = 0;
 310         strncpy(hid->phys, ev->u.create.phys, 63);
 311         hid->phys[63] = 0;
 312         strncpy(hid->uniq, ev->u.create.uniq, 63);
 313         hid->uniq[63] = 0;
 314
 315         hid->ll_driver = &uhid_hid_driver;
 316         hid->hid_get_raw_report = uhid_hid_get_raw;
 317         hid->hid_output_raw_report = uhid_hid_output_raw;
 318         hid->bus = ev->u.create.bus;
 319         hid->vendor = ev->u.create.vendor;
 320         hid->product = ev->u.create.product;
 321         hid->version = ev->u.create.version;
 322         hid->country = ev->u.create.country;
 323         hid->driver_data = uhid;
 324         hid->dev.parent = uhid_misc.this_device;
 325
 326         uhid->hid = hid;
 327         uhid->running = true;
 328
 329         ret = hid_add_device(hid);
 330         if (ret) {
 331                 hid_err(hid, "Cannot register HID device\n");
 332                 goto err_hid;
 333         }
 334
 335         return 0;
 336
 337 err_hid:
 338         hid_destroy_device(hid);
 339         uhid->hid = NULL;
 340         uhid->running = false;
 341 err_free:
 342         kfree(uhid->rd_data);
 343         return ret;
 344 }
 345
 346 static int uhid_dev_destroy(struct uhid_device *uhid)
 347 {
 348         if (!uhid->running)
 349                 return -EINVAL;
 350
 351         /* clear "running" before setting "report_done" */
 352         uhid->running = false;
 353         smp_wmb();
 354         atomic_set(&uhid->report_done, 1);
 355         wake_up_interruptible(&uhid->report_wait);
 356
 357         hid_destroy_device(uhid->hid);
 358         kfree(uhid->rd_data);
 359
 360         return 0;
 361 }
 362
 363 static int uhid_dev_input(struct uhid_device *uhid, struct uhid_event *ev)
 364 {
 365         if (!uhid->running)
 366                 return -EINVAL;
 367
 368         hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input.data,
 369                          min_t(size_t, ev->u.input.size, UHID_DATA_MAX), 0);
 370
 371         return 0;
 372 }
 373
 374 static int uhid_dev_feature_answer(struct uhid_device *uhid,
 375                                    struct uhid_event *ev)
 376 {
 377         unsigned long flags;
 378
 379         if (!uhid->running)
 380                 return -EINVAL;
 381
 382         spin_lock_irqsave(&uhid->qlock, flags);
 383
 384         /* id for old report; drop it silently */
 385         if (atomic_read(&uhid->report_id) != ev->u.feature_answer.id)
 386                 goto unlock;
 387         if (atomic_read(&uhid->report_done))
 388                 goto unlock;
 389
 390         memcpy(&uhid->report_buf, ev, sizeof(*ev));
 391         atomic_set(&uhid->report_done, 1);
 392         wake_up_interruptible(&uhid->report_wait);
 393
 394 unlock:
 395         spin_unlock_irqrestore(&uhid->qlock, flags);
 396         return 0;
 397 }
 398
 399 static int uhid_char_open(struct inode *inode, struct file *file)
 400 {
 401         struct uhid_device *uhid;
 402
 403         uhid = kzalloc(sizeof(*uhid), GFP_KERNEL);
 404         if (!uhid)
 405                 return -ENOMEM;
 406
 407         mutex_init(&uhid->devlock);
 408         mutex_init(&uhid->report_lock);
 409         spin_lock_init(&uhid->qlock);
 410         init_waitqueue_head(&uhid->waitq);
 411         init_waitqueue_head(&uhid->report_wait);
 412         uhid->running = false;
 413         atomic_set(&uhid->report_done, 1);
 414
 415         file->private_data = uhid;
 416         nonseekable_open(inode, file);
 417
 418         return 0;
 419 }
 420
 421 static int uhid_char_release(struct inode *inode, struct file *file)
 422 {
 423         struct uhid_device *uhid = file->private_data;
 424         unsigned int i;
 425
 426         uhid_dev_destroy(uhid);
 427
 428         for (i = 0; i < UHID_BUFSIZE; ++i)
 429                 kfree(uhid->outq[i]);
 430
 431         kfree(uhid);
 432
 433         return 0;
 434 }
 435
 436 static ssize_t uhid_char_read(struct file *file, char __user *buffer,
 437                                 size_t count, loff_t *ppos)
 438 {
 439         struct uhid_device *uhid = file->private_data;
 440         int ret;
 441         unsigned long flags;
 442         size_t len;
 443
 444         /* they need at least the "type" member of uhid_event */
 445         if (count < sizeof(__u32))
 446                 return -EINVAL;
 447
 448 try_again:
 449         if (file->f_flags & O_NONBLOCK) {
 450                 if (uhid->head == uhid->tail)
 451                         return -EAGAIN;
 452         } else {
 453                 ret = wait_event_interruptible(uhid->waitq,
 454                                                 uhid->head != uhid->tail);
 455                 if (ret)
 456                         return ret;
 457         }
 458
 459         ret = mutex_lock_interruptible(&uhid->devlock);
 460         if (ret)
 461                 return ret;
 462
 463         if (uhid->head == uhid->tail) {
 464                 mutex_unlock(&uhid->devlock);
 465                 goto try_again;
 466         } else {
 467                 len = min(count, sizeof(**uhid->outq));
 468                 if (copy_to_user(buffer, uhid->outq[uhid->tail], len)) {
 469                         ret = -EFAULT;
 470                 } else {
 471                         kfree(uhid->outq[uhid->tail]);
 472                         uhid->outq[uhid->tail] = NULL;
 473
 474                         spin_lock_irqsave(&uhid->qlock, flags);
 475                         uhid->tail = (uhid->tail + 1) % UHID_BUFSIZE;
 476                         spin_unlock_irqrestore(&uhid->qlock, flags);
 477                 }
 478         }
 479
 480         mutex_unlock(&uhid->devlock);
 481         return ret ? ret : len;
 482 }
 483
 484 static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
 485                                 size_t count, loff_t *ppos)
 486 {
 487         struct uhid_device *uhid = file->private_data;
 488         int ret;
 489         size_t len;
 490
 491         /* we need at least the "type" member of uhid_event */
 492         if (count < sizeof(__u32))
 493                 return -EINVAL;
 494
 495         ret = mutex_lock_interruptible(&uhid->devlock);
 496         if (ret)
 497                 return ret;
 498
 499         memset(&uhid->input_buf, 0, sizeof(uhid->input_buf));
 500         len = min(count, sizeof(uhid->input_buf));
 501         if (copy_from_user(&uhid->input_buf, buffer, len)) {
 502                 ret = -EFAULT;
 503                 goto unlock;
 504         }
 505
 506         switch (uhid->input_buf.type) {
 507         case UHID_CREATE:
 508                 ret = uhid_dev_create(uhid, &uhid->input_buf);
 509                 break;
 510         case UHID_DESTROY:
 511                 ret = uhid_dev_destroy(uhid);
 512                 break;
 513         case UHID_INPUT:
 514                 ret = uhid_dev_input(uhid, &uhid->input_buf);
 515                 break;
 516         case UHID_FEATURE_ANSWER:
 517                 ret = uhid_dev_feature_answer(uhid, &uhid->input_buf);
 518                 break;
 519         default:
 520                 ret = -EOPNOTSUPP;
 521         }
 522
 523 unlock:
 524         mutex_unlock(&uhid->devlock);
 525
 526         /* return "count" not "len" to not confuse the caller */
 527         return ret ? ret : count;
 528 }
 529
 530 static unsigned int uhid_char_poll(struct file *file, poll_table *wait)
 531 {
 532         struct uhid_device *uhid = file->private_data;
 533
 534         poll_wait(file, &uhid->waitq, wait);
 535
 536         if (uhid->head != uhid->tail)
 537                 return POLLIN | POLLRDNORM;
 538
 539         return 0;
 540 }
 541
 542 static const struct file_operations uhid_fops = {
 543         .owner          = THIS_MODULE,
 544         .open           = uhid_char_open,
 545         .release        = uhid_char_release,
 546         .read           = uhid_char_read,
 547         .write          = uhid_char_write,
 548         .poll           = uhid_char_poll,
 549         .llseek         = no_llseek,
 550 };
 551
 552 static struct miscdevice uhid_misc = {
 553         .fops           = &uhid_fops,
 554         .minor          = MISC_DYNAMIC_MINOR,
 555         .name           = UHID_NAME,
 556 };
 557
 558 static int __init uhid_init(void)
 559 {
 560         return misc_register(&uhid_misc);
 561 }
 562
 563 static void __exit uhid_exit(void)
 564 {
 565         misc_deregister(&uhid_misc);
 566 }
 567
 568 module_init(uhid_init);
 569 module_exit(uhid_exit);
 570 MODULE_LICENSE("GPL");
 571 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
 572 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");