2 * User-space I/O driver support for HID subsystem
3 * Copyright (c) 2012 David Herrmann
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the Free
9 * Software Foundation; either version 2 of the License, or (at your option)
13 #include <linux/atomic.h>
14 #include <linux/compat.h>
15 #include <linux/device.h>
17 #include <linux/hid.h>
18 #include <linux/input.h>
19 #include <linux/miscdevice.h>
20 #include <linux/module.h>
21 #include <linux/mutex.h>
22 #include <linux/poll.h>
23 #include <linux/sched.h>
24 #include <linux/spinlock.h>
25 #include <linux/uhid.h>
26 #include <linux/wait.h>
28 #define UHID_NAME "uhid"
29 #define UHID_BUFSIZE 32
38 struct hid_device
*hid
;
39 struct uhid_event input_buf
;
41 wait_queue_head_t waitq
;
45 struct uhid_event
*outq
[UHID_BUFSIZE
];
47 struct mutex report_lock
;
48 wait_queue_head_t report_wait
;
51 struct uhid_event report_buf
;
54 static struct miscdevice uhid_misc
;
56 static void uhid_queue(struct uhid_device
*uhid
, struct uhid_event
*ev
)
60 newhead
= (uhid
->head
+ 1) % UHID_BUFSIZE
;
62 if (newhead
!= uhid
->tail
) {
63 uhid
->outq
[uhid
->head
] = ev
;
65 wake_up_interruptible(&uhid
->waitq
);
67 hid_warn(uhid
->hid
, "Output queue is full\n");
72 static int uhid_queue_event(struct uhid_device
*uhid
, __u32 event
)
75 struct uhid_event
*ev
;
77 ev
= kzalloc(sizeof(*ev
), GFP_KERNEL
);
83 spin_lock_irqsave(&uhid
->qlock
, flags
);
85 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
90 static int uhid_hid_start(struct hid_device
*hid
)
92 struct uhid_device
*uhid
= hid
->driver_data
;
94 return uhid_queue_event(uhid
, UHID_START
);
97 static void uhid_hid_stop(struct hid_device
*hid
)
99 struct uhid_device
*uhid
= hid
->driver_data
;
102 uhid_queue_event(uhid
, UHID_STOP
);
105 static int uhid_hid_open(struct hid_device
*hid
)
107 struct uhid_device
*uhid
= hid
->driver_data
;
109 return uhid_queue_event(uhid
, UHID_OPEN
);
112 static void uhid_hid_close(struct hid_device
*hid
)
114 struct uhid_device
*uhid
= hid
->driver_data
;
116 uhid_queue_event(uhid
, UHID_CLOSE
);
119 static int uhid_hid_parse(struct hid_device
*hid
)
121 struct uhid_device
*uhid
= hid
->driver_data
;
123 return hid_parse_report(hid
, uhid
->rd_data
, uhid
->rd_size
);
126 static int uhid_hid_get_raw(struct hid_device
*hid
, unsigned char rnum
,
127 __u8
*buf
, size_t count
, unsigned char rtype
)
129 struct uhid_device
*uhid
= hid
->driver_data
;
131 struct uhid_event
*ev
;
134 size_t uninitialized_var(len
);
135 struct uhid_feature_answer_req
*req
;
141 case HID_FEATURE_REPORT
:
142 report_type
= UHID_FEATURE_REPORT
;
144 case HID_OUTPUT_REPORT
:
145 report_type
= UHID_OUTPUT_REPORT
;
147 case HID_INPUT_REPORT
:
148 report_type
= UHID_INPUT_REPORT
;
154 ret
= mutex_lock_interruptible(&uhid
->report_lock
);
158 ev
= kzalloc(sizeof(*ev
), GFP_KERNEL
);
164 spin_lock_irqsave(&uhid
->qlock
, flags
);
165 ev
->type
= UHID_FEATURE
;
166 ev
->u
.feature
.id
= atomic_inc_return(&uhid
->report_id
);
167 ev
->u
.feature
.rnum
= rnum
;
168 ev
->u
.feature
.rtype
= report_type
;
170 atomic_set(&uhid
->report_done
, 0);
171 uhid_queue(uhid
, ev
);
172 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
174 ret
= wait_event_interruptible_timeout(uhid
->report_wait
,
175 atomic_read(&uhid
->report_done
) || !uhid
->running
,
178 if (!ret
|| !uhid
->running
) {
180 } else if (ret
< 0) {
183 spin_lock_irqsave(&uhid
->qlock
, flags
);
184 req
= &uhid
->report_buf
.u
.feature_answer
;
191 min_t(size_t, req
->size
, UHID_DATA_MAX
));
192 memcpy(buf
, req
->data
, len
);
195 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
198 atomic_set(&uhid
->report_done
, 1);
201 mutex_unlock(&uhid
->report_lock
);
202 return ret
? ret
: len
;
205 static int uhid_hid_output_raw(struct hid_device
*hid
, __u8
*buf
, size_t count
,
206 unsigned char report_type
)
208 struct uhid_device
*uhid
= hid
->driver_data
;
211 struct uhid_event
*ev
;
213 switch (report_type
) {
214 case HID_FEATURE_REPORT
:
215 rtype
= UHID_FEATURE_REPORT
;
217 case HID_OUTPUT_REPORT
:
218 rtype
= UHID_OUTPUT_REPORT
;
224 if (count
< 1 || count
> UHID_DATA_MAX
)
227 ev
= kzalloc(sizeof(*ev
), GFP_KERNEL
);
231 ev
->type
= UHID_OUTPUT
;
232 ev
->u
.output
.size
= count
;
233 ev
->u
.output
.rtype
= rtype
;
234 memcpy(ev
->u
.output
.data
, buf
, count
);
236 spin_lock_irqsave(&uhid
->qlock
, flags
);
237 uhid_queue(uhid
, ev
);
238 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
243 static int uhid_hid_output_report(struct hid_device
*hid
, __u8
*buf
,
246 return uhid_hid_output_raw(hid
, buf
, count
, HID_OUTPUT_REPORT
);
249 static int uhid_raw_request(struct hid_device
*hid
, unsigned char reportnum
,
250 __u8
*buf
, size_t len
, unsigned char rtype
,
254 case HID_REQ_GET_REPORT
:
255 return uhid_hid_get_raw(hid
, reportnum
, buf
, len
, rtype
);
256 case HID_REQ_SET_REPORT
:
257 /* TODO: implement proper SET_REPORT functionality */
264 static struct hid_ll_driver uhid_hid_driver
= {
265 .start
= uhid_hid_start
,
266 .stop
= uhid_hid_stop
,
267 .open
= uhid_hid_open
,
268 .close
= uhid_hid_close
,
269 .parse
= uhid_hid_parse
,
270 .output_report
= uhid_hid_output_report
,
271 .raw_request
= uhid_raw_request
,
276 /* Apparently we haven't stepped on these rakes enough times yet. */
277 struct uhid_create_req_compat
{
282 compat_uptr_t rd_data
;
290 } __attribute__((__packed__
));
292 static int uhid_event_from_user(const char __user
*buffer
, size_t len
,
293 struct uhid_event
*event
)
295 if (is_compat_task()) {
298 if (get_user(type
, buffer
))
301 if (type
== UHID_CREATE
) {
303 * This is our messed up request with compat pointer.
304 * It is largish (more than 256 bytes) so we better
305 * allocate it from the heap.
307 struct uhid_create_req_compat
*compat
;
309 compat
= kzalloc(sizeof(*compat
), GFP_KERNEL
);
313 buffer
+= sizeof(type
);
315 if (copy_from_user(compat
, buffer
,
316 min(len
, sizeof(*compat
)))) {
321 /* Shuffle the data over to proper structure */
324 memcpy(event
->u
.create
.name
, compat
->name
,
325 sizeof(compat
->name
));
326 memcpy(event
->u
.create
.phys
, compat
->phys
,
327 sizeof(compat
->phys
));
328 memcpy(event
->u
.create
.uniq
, compat
->uniq
,
329 sizeof(compat
->uniq
));
331 event
->u
.create
.rd_data
= compat_ptr(compat
->rd_data
);
332 event
->u
.create
.rd_size
= compat
->rd_size
;
334 event
->u
.create
.bus
= compat
->bus
;
335 event
->u
.create
.vendor
= compat
->vendor
;
336 event
->u
.create
.product
= compat
->product
;
337 event
->u
.create
.version
= compat
->version
;
338 event
->u
.create
.country
= compat
->country
;
343 /* All others can be copied directly */
346 if (copy_from_user(event
, buffer
, min(len
, sizeof(*event
))))
352 static int uhid_event_from_user(const char __user
*buffer
, size_t len
,
353 struct uhid_event
*event
)
355 if (copy_from_user(event
, buffer
, min(len
, sizeof(*event
))))
362 static int uhid_dev_create2(struct uhid_device
*uhid
,
363 const struct uhid_event
*ev
)
365 struct hid_device
*hid
;
373 rd_size
= ev
->u
.create2
.rd_size
;
374 if (rd_size
<= 0 || rd_size
> HID_MAX_DESCRIPTOR_SIZE
)
377 rd_data
= kmemdup(ev
->u
.create2
.rd_data
, rd_size
, GFP_KERNEL
);
381 uhid
->rd_size
= rd_size
;
382 uhid
->rd_data
= rd_data
;
384 hid
= hid_allocate_device();
390 strncpy(hid
->name
, ev
->u
.create2
.name
, 127);
392 strncpy(hid
->phys
, ev
->u
.create2
.phys
, 63);
394 strncpy(hid
->uniq
, ev
->u
.create2
.uniq
, 63);
397 hid
->ll_driver
= &uhid_hid_driver
;
398 hid
->bus
= ev
->u
.create2
.bus
;
399 hid
->vendor
= ev
->u
.create2
.vendor
;
400 hid
->product
= ev
->u
.create2
.product
;
401 hid
->version
= ev
->u
.create2
.version
;
402 hid
->country
= ev
->u
.create2
.country
;
403 hid
->driver_data
= uhid
;
404 hid
->dev
.parent
= uhid_misc
.this_device
;
407 uhid
->running
= true;
409 ret
= hid_add_device(hid
);
411 hid_err(hid
, "Cannot register HID device\n");
418 hid_destroy_device(hid
);
420 uhid
->running
= false;
422 kfree(uhid
->rd_data
);
423 uhid
->rd_data
= NULL
;
428 static int uhid_dev_create(struct uhid_device
*uhid
,
429 struct uhid_event
*ev
)
431 struct uhid_create_req orig
;
435 if (orig
.rd_size
<= 0 || orig
.rd_size
> HID_MAX_DESCRIPTOR_SIZE
)
437 if (copy_from_user(&ev
->u
.create2
.rd_data
, orig
.rd_data
, orig
.rd_size
))
440 memcpy(ev
->u
.create2
.name
, orig
.name
, sizeof(orig
.name
));
441 memcpy(ev
->u
.create2
.phys
, orig
.phys
, sizeof(orig
.phys
));
442 memcpy(ev
->u
.create2
.uniq
, orig
.uniq
, sizeof(orig
.uniq
));
443 ev
->u
.create2
.rd_size
= orig
.rd_size
;
444 ev
->u
.create2
.bus
= orig
.bus
;
445 ev
->u
.create2
.vendor
= orig
.vendor
;
446 ev
->u
.create2
.product
= orig
.product
;
447 ev
->u
.create2
.version
= orig
.version
;
448 ev
->u
.create2
.country
= orig
.country
;
450 return uhid_dev_create2(uhid
, ev
);
453 static int uhid_dev_destroy(struct uhid_device
*uhid
)
458 uhid
->running
= false;
459 wake_up_interruptible(&uhid
->report_wait
);
461 hid_destroy_device(uhid
->hid
);
462 kfree(uhid
->rd_data
);
467 static int uhid_dev_input(struct uhid_device
*uhid
, struct uhid_event
*ev
)
472 hid_input_report(uhid
->hid
, HID_INPUT_REPORT
, ev
->u
.input
.data
,
473 min_t(size_t, ev
->u
.input
.size
, UHID_DATA_MAX
), 0);
478 static int uhid_dev_input2(struct uhid_device
*uhid
, struct uhid_event
*ev
)
483 hid_input_report(uhid
->hid
, HID_INPUT_REPORT
, ev
->u
.input2
.data
,
484 min_t(size_t, ev
->u
.input2
.size
, UHID_DATA_MAX
), 0);
489 static int uhid_dev_feature_answer(struct uhid_device
*uhid
,
490 struct uhid_event
*ev
)
497 spin_lock_irqsave(&uhid
->qlock
, flags
);
499 /* id for old report; drop it silently */
500 if (atomic_read(&uhid
->report_id
) != ev
->u
.feature_answer
.id
)
502 if (atomic_read(&uhid
->report_done
))
505 memcpy(&uhid
->report_buf
, ev
, sizeof(*ev
));
506 atomic_set(&uhid
->report_done
, 1);
507 wake_up_interruptible(&uhid
->report_wait
);
510 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
514 static int uhid_char_open(struct inode
*inode
, struct file
*file
)
516 struct uhid_device
*uhid
;
518 uhid
= kzalloc(sizeof(*uhid
), GFP_KERNEL
);
522 mutex_init(&uhid
->devlock
);
523 mutex_init(&uhid
->report_lock
);
524 spin_lock_init(&uhid
->qlock
);
525 init_waitqueue_head(&uhid
->waitq
);
526 init_waitqueue_head(&uhid
->report_wait
);
527 uhid
->running
= false;
528 atomic_set(&uhid
->report_done
, 1);
530 file
->private_data
= uhid
;
531 nonseekable_open(inode
, file
);
536 static int uhid_char_release(struct inode
*inode
, struct file
*file
)
538 struct uhid_device
*uhid
= file
->private_data
;
541 uhid_dev_destroy(uhid
);
543 for (i
= 0; i
< UHID_BUFSIZE
; ++i
)
544 kfree(uhid
->outq
[i
]);
551 static ssize_t
uhid_char_read(struct file
*file
, char __user
*buffer
,
552 size_t count
, loff_t
*ppos
)
554 struct uhid_device
*uhid
= file
->private_data
;
559 /* they need at least the "type" member of uhid_event */
560 if (count
< sizeof(__u32
))
564 if (file
->f_flags
& O_NONBLOCK
) {
565 if (uhid
->head
== uhid
->tail
)
568 ret
= wait_event_interruptible(uhid
->waitq
,
569 uhid
->head
!= uhid
->tail
);
574 ret
= mutex_lock_interruptible(&uhid
->devlock
);
578 if (uhid
->head
== uhid
->tail
) {
579 mutex_unlock(&uhid
->devlock
);
582 len
= min(count
, sizeof(**uhid
->outq
));
583 if (copy_to_user(buffer
, uhid
->outq
[uhid
->tail
], len
)) {
586 kfree(uhid
->outq
[uhid
->tail
]);
587 uhid
->outq
[uhid
->tail
] = NULL
;
589 spin_lock_irqsave(&uhid
->qlock
, flags
);
590 uhid
->tail
= (uhid
->tail
+ 1) % UHID_BUFSIZE
;
591 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
595 mutex_unlock(&uhid
->devlock
);
596 return ret
? ret
: len
;
599 static ssize_t
uhid_char_write(struct file
*file
, const char __user
*buffer
,
600 size_t count
, loff_t
*ppos
)
602 struct uhid_device
*uhid
= file
->private_data
;
606 /* we need at least the "type" member of uhid_event */
607 if (count
< sizeof(__u32
))
610 ret
= mutex_lock_interruptible(&uhid
->devlock
);
614 memset(&uhid
->input_buf
, 0, sizeof(uhid
->input_buf
));
615 len
= min(count
, sizeof(uhid
->input_buf
));
617 ret
= uhid_event_from_user(buffer
, len
, &uhid
->input_buf
);
621 switch (uhid
->input_buf
.type
) {
623 ret
= uhid_dev_create(uhid
, &uhid
->input_buf
);
626 ret
= uhid_dev_create2(uhid
, &uhid
->input_buf
);
629 ret
= uhid_dev_destroy(uhid
);
632 ret
= uhid_dev_input(uhid
, &uhid
->input_buf
);
635 ret
= uhid_dev_input2(uhid
, &uhid
->input_buf
);
637 case UHID_FEATURE_ANSWER
:
638 ret
= uhid_dev_feature_answer(uhid
, &uhid
->input_buf
);
645 mutex_unlock(&uhid
->devlock
);
647 /* return "count" not "len" to not confuse the caller */
648 return ret
? ret
: count
;
651 static unsigned int uhid_char_poll(struct file
*file
, poll_table
*wait
)
653 struct uhid_device
*uhid
= file
->private_data
;
655 poll_wait(file
, &uhid
->waitq
, wait
);
657 if (uhid
->head
!= uhid
->tail
)
658 return POLLIN
| POLLRDNORM
;
663 static const struct file_operations uhid_fops
= {
664 .owner
= THIS_MODULE
,
665 .open
= uhid_char_open
,
666 .release
= uhid_char_release
,
667 .read
= uhid_char_read
,
668 .write
= uhid_char_write
,
669 .poll
= uhid_char_poll
,
673 static struct miscdevice uhid_misc
= {
679 static int __init
uhid_init(void)
681 return misc_register(&uhid_misc
);
684 static void __exit
uhid_exit(void)
686 misc_deregister(&uhid_misc
);
689 module_init(uhid_init
);
690 module_exit(uhid_exit
);
691 MODULE_LICENSE("GPL");
692 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
693 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
694 MODULE_ALIAS_MISCDEV(UHID_MINOR
);
695 MODULE_ALIAS("devname:" UHID_NAME
);