2 * User-space I/O driver support for HID subsystem
3 * Copyright (c) 2012 David Herrmann
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the Free
9 * Software Foundation; either version 2 of the License, or (at your option)
13 #include <linux/atomic.h>
14 #include <linux/compat.h>
15 #include <linux/device.h>
17 #include <linux/hid.h>
18 #include <linux/input.h>
19 #include <linux/miscdevice.h>
20 #include <linux/module.h>
21 #include <linux/mutex.h>
22 #include <linux/poll.h>
23 #include <linux/sched.h>
24 #include <linux/spinlock.h>
25 #include <linux/uhid.h>
26 #include <linux/wait.h>
28 #define UHID_NAME "uhid"
29 #define UHID_BUFSIZE 32
38 struct hid_device
*hid
;
39 struct uhid_event input_buf
;
41 wait_queue_head_t waitq
;
45 struct uhid_event
*outq
[UHID_BUFSIZE
];
47 /* blocking GET_REPORT support; state changes protected by qlock */
48 struct mutex report_lock
;
49 wait_queue_head_t report_wait
;
53 struct uhid_event report_buf
;
54 struct work_struct worker
;
57 static struct miscdevice uhid_misc
;
59 static void uhid_device_add_worker(struct work_struct
*work
)
61 struct uhid_device
*uhid
= container_of(work
, struct uhid_device
, worker
);
64 ret
= hid_add_device(uhid
->hid
);
66 hid_err(uhid
->hid
, "Cannot register HID device: error %d\n", ret
);
68 hid_destroy_device(uhid
->hid
);
70 uhid
->running
= false;
74 static void uhid_queue(struct uhid_device
*uhid
, struct uhid_event
*ev
)
78 newhead
= (uhid
->head
+ 1) % UHID_BUFSIZE
;
80 if (newhead
!= uhid
->tail
) {
81 uhid
->outq
[uhid
->head
] = ev
;
83 wake_up_interruptible(&uhid
->waitq
);
85 hid_warn(uhid
->hid
, "Output queue is full\n");
90 static int uhid_queue_event(struct uhid_device
*uhid
, __u32 event
)
93 struct uhid_event
*ev
;
95 ev
= kzalloc(sizeof(*ev
), GFP_KERNEL
);
101 spin_lock_irqsave(&uhid
->qlock
, flags
);
102 uhid_queue(uhid
, ev
);
103 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
108 static int uhid_hid_start(struct hid_device
*hid
)
110 struct uhid_device
*uhid
= hid
->driver_data
;
111 struct uhid_event
*ev
;
114 ev
= kzalloc(sizeof(*ev
), GFP_KERNEL
);
118 ev
->type
= UHID_START
;
120 if (hid
->report_enum
[HID_FEATURE_REPORT
].numbered
)
121 ev
->u
.start
.dev_flags
|= UHID_DEV_NUMBERED_FEATURE_REPORTS
;
122 if (hid
->report_enum
[HID_OUTPUT_REPORT
].numbered
)
123 ev
->u
.start
.dev_flags
|= UHID_DEV_NUMBERED_OUTPUT_REPORTS
;
124 if (hid
->report_enum
[HID_INPUT_REPORT
].numbered
)
125 ev
->u
.start
.dev_flags
|= UHID_DEV_NUMBERED_INPUT_REPORTS
;
127 spin_lock_irqsave(&uhid
->qlock
, flags
);
128 uhid_queue(uhid
, ev
);
129 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
134 static void uhid_hid_stop(struct hid_device
*hid
)
136 struct uhid_device
*uhid
= hid
->driver_data
;
139 uhid_queue_event(uhid
, UHID_STOP
);
142 static int uhid_hid_open(struct hid_device
*hid
)
144 struct uhid_device
*uhid
= hid
->driver_data
;
146 return uhid_queue_event(uhid
, UHID_OPEN
);
149 static void uhid_hid_close(struct hid_device
*hid
)
151 struct uhid_device
*uhid
= hid
->driver_data
;
153 uhid_queue_event(uhid
, UHID_CLOSE
);
156 static int uhid_hid_parse(struct hid_device
*hid
)
158 struct uhid_device
*uhid
= hid
->driver_data
;
160 return hid_parse_report(hid
, uhid
->rd_data
, uhid
->rd_size
);
163 /* must be called with report_lock held */
164 static int __uhid_report_queue_and_wait(struct uhid_device
*uhid
,
165 struct uhid_event
*ev
,
171 spin_lock_irqsave(&uhid
->qlock
, flags
);
172 *report_id
= ++uhid
->report_id
;
173 uhid
->report_type
= ev
->type
+ 1;
174 uhid
->report_running
= true;
175 uhid_queue(uhid
, ev
);
176 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
178 ret
= wait_event_interruptible_timeout(uhid
->report_wait
,
179 !uhid
->report_running
|| !uhid
->running
,
181 if (!ret
|| !uhid
->running
|| uhid
->report_running
)
188 uhid
->report_running
= false;
193 static void uhid_report_wake_up(struct uhid_device
*uhid
, u32 id
,
194 const struct uhid_event
*ev
)
198 spin_lock_irqsave(&uhid
->qlock
, flags
);
200 /* id for old report; drop it silently */
201 if (uhid
->report_type
!= ev
->type
|| uhid
->report_id
!= id
)
203 if (!uhid
->report_running
)
206 memcpy(&uhid
->report_buf
, ev
, sizeof(*ev
));
207 uhid
->report_running
= false;
208 wake_up_interruptible(&uhid
->report_wait
);
211 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
214 static int uhid_hid_get_report(struct hid_device
*hid
, unsigned char rnum
,
215 u8
*buf
, size_t count
, u8 rtype
)
217 struct uhid_device
*uhid
= hid
->driver_data
;
218 struct uhid_get_report_reply_req
*req
;
219 struct uhid_event
*ev
;
225 ev
= kzalloc(sizeof(*ev
), GFP_KERNEL
);
229 ev
->type
= UHID_GET_REPORT
;
230 ev
->u
.get_report
.rnum
= rnum
;
231 ev
->u
.get_report
.rtype
= rtype
;
233 ret
= mutex_lock_interruptible(&uhid
->report_lock
);
239 /* this _always_ takes ownership of @ev */
240 ret
= __uhid_report_queue_and_wait(uhid
, ev
, &ev
->u
.get_report
.id
);
244 req
= &uhid
->report_buf
.u
.get_report_reply
;
248 ret
= min3(count
, (size_t)req
->size
, (size_t)UHID_DATA_MAX
);
249 memcpy(buf
, req
->data
, ret
);
253 mutex_unlock(&uhid
->report_lock
);
257 static int uhid_hid_set_report(struct hid_device
*hid
, unsigned char rnum
,
258 const u8
*buf
, size_t count
, u8 rtype
)
260 struct uhid_device
*uhid
= hid
->driver_data
;
261 struct uhid_event
*ev
;
264 if (!uhid
->running
|| count
> UHID_DATA_MAX
)
267 ev
= kzalloc(sizeof(*ev
), GFP_KERNEL
);
271 ev
->type
= UHID_SET_REPORT
;
272 ev
->u
.set_report
.rnum
= rnum
;
273 ev
->u
.set_report
.rtype
= rtype
;
274 ev
->u
.set_report
.size
= count
;
275 memcpy(ev
->u
.set_report
.data
, buf
, count
);
277 ret
= mutex_lock_interruptible(&uhid
->report_lock
);
283 /* this _always_ takes ownership of @ev */
284 ret
= __uhid_report_queue_and_wait(uhid
, ev
, &ev
->u
.set_report
.id
);
288 if (uhid
->report_buf
.u
.set_report_reply
.err
)
294 mutex_unlock(&uhid
->report_lock
);
298 static int uhid_hid_raw_request(struct hid_device
*hid
, unsigned char reportnum
,
299 __u8
*buf
, size_t len
, unsigned char rtype
,
305 case HID_FEATURE_REPORT
:
306 u_rtype
= UHID_FEATURE_REPORT
;
308 case HID_OUTPUT_REPORT
:
309 u_rtype
= UHID_OUTPUT_REPORT
;
311 case HID_INPUT_REPORT
:
312 u_rtype
= UHID_INPUT_REPORT
;
319 case HID_REQ_GET_REPORT
:
320 return uhid_hid_get_report(hid
, reportnum
, buf
, len
, u_rtype
);
321 case HID_REQ_SET_REPORT
:
322 return uhid_hid_set_report(hid
, reportnum
, buf
, len
, u_rtype
);
328 static int uhid_hid_output_raw(struct hid_device
*hid
, __u8
*buf
, size_t count
,
329 unsigned char report_type
)
331 struct uhid_device
*uhid
= hid
->driver_data
;
334 struct uhid_event
*ev
;
336 switch (report_type
) {
337 case HID_FEATURE_REPORT
:
338 rtype
= UHID_FEATURE_REPORT
;
340 case HID_OUTPUT_REPORT
:
341 rtype
= UHID_OUTPUT_REPORT
;
347 if (count
< 1 || count
> UHID_DATA_MAX
)
350 ev
= kzalloc(sizeof(*ev
), GFP_KERNEL
);
354 ev
->type
= UHID_OUTPUT
;
355 ev
->u
.output
.size
= count
;
356 ev
->u
.output
.rtype
= rtype
;
357 memcpy(ev
->u
.output
.data
, buf
, count
);
359 spin_lock_irqsave(&uhid
->qlock
, flags
);
360 uhid_queue(uhid
, ev
);
361 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
366 static int uhid_hid_output_report(struct hid_device
*hid
, __u8
*buf
,
369 return uhid_hid_output_raw(hid
, buf
, count
, HID_OUTPUT_REPORT
);
372 struct hid_ll_driver uhid_hid_driver
= {
373 .start
= uhid_hid_start
,
374 .stop
= uhid_hid_stop
,
375 .open
= uhid_hid_open
,
376 .close
= uhid_hid_close
,
377 .parse
= uhid_hid_parse
,
378 .raw_request
= uhid_hid_raw_request
,
379 .output_report
= uhid_hid_output_report
,
381 EXPORT_SYMBOL_GPL(uhid_hid_driver
);
385 /* Apparently we haven't stepped on these rakes enough times yet. */
386 struct uhid_create_req_compat
{
391 compat_uptr_t rd_data
;
399 } __attribute__((__packed__
));
401 static int uhid_event_from_user(const char __user
*buffer
, size_t len
,
402 struct uhid_event
*event
)
404 if (in_compat_syscall()) {
407 if (get_user(type
, buffer
))
410 if (type
== UHID_CREATE
) {
412 * This is our messed up request with compat pointer.
413 * It is largish (more than 256 bytes) so we better
414 * allocate it from the heap.
416 struct uhid_create_req_compat
*compat
;
418 compat
= kzalloc(sizeof(*compat
), GFP_KERNEL
);
422 buffer
+= sizeof(type
);
424 if (copy_from_user(compat
, buffer
,
425 min(len
, sizeof(*compat
)))) {
430 /* Shuffle the data over to proper structure */
433 memcpy(event
->u
.create
.name
, compat
->name
,
434 sizeof(compat
->name
));
435 memcpy(event
->u
.create
.phys
, compat
->phys
,
436 sizeof(compat
->phys
));
437 memcpy(event
->u
.create
.uniq
, compat
->uniq
,
438 sizeof(compat
->uniq
));
440 event
->u
.create
.rd_data
= compat_ptr(compat
->rd_data
);
441 event
->u
.create
.rd_size
= compat
->rd_size
;
443 event
->u
.create
.bus
= compat
->bus
;
444 event
->u
.create
.vendor
= compat
->vendor
;
445 event
->u
.create
.product
= compat
->product
;
446 event
->u
.create
.version
= compat
->version
;
447 event
->u
.create
.country
= compat
->country
;
452 /* All others can be copied directly */
455 if (copy_from_user(event
, buffer
, min(len
, sizeof(*event
))))
461 static int uhid_event_from_user(const char __user
*buffer
, size_t len
,
462 struct uhid_event
*event
)
464 if (copy_from_user(event
, buffer
, min(len
, sizeof(*event
))))
471 static int uhid_dev_create2(struct uhid_device
*uhid
,
472 const struct uhid_event
*ev
)
474 struct hid_device
*hid
;
482 rd_size
= ev
->u
.create2
.rd_size
;
483 if (rd_size
<= 0 || rd_size
> HID_MAX_DESCRIPTOR_SIZE
)
486 rd_data
= kmemdup(ev
->u
.create2
.rd_data
, rd_size
, GFP_KERNEL
);
490 uhid
->rd_size
= rd_size
;
491 uhid
->rd_data
= rd_data
;
493 hid
= hid_allocate_device();
499 len
= min(sizeof(hid
->name
), sizeof(ev
->u
.create2
.name
)) - 1;
500 strncpy(hid
->name
, ev
->u
.create2
.name
, len
);
501 len
= min(sizeof(hid
->phys
), sizeof(ev
->u
.create2
.phys
)) - 1;
502 strncpy(hid
->phys
, ev
->u
.create2
.phys
, len
);
503 len
= min(sizeof(hid
->uniq
), sizeof(ev
->u
.create2
.uniq
)) - 1;
504 strncpy(hid
->uniq
, ev
->u
.create2
.uniq
, len
);
506 hid
->ll_driver
= &uhid_hid_driver
;
507 hid
->bus
= ev
->u
.create2
.bus
;
508 hid
->vendor
= ev
->u
.create2
.vendor
;
509 hid
->product
= ev
->u
.create2
.product
;
510 hid
->version
= ev
->u
.create2
.version
;
511 hid
->country
= ev
->u
.create2
.country
;
512 hid
->driver_data
= uhid
;
513 hid
->dev
.parent
= uhid_misc
.this_device
;
516 uhid
->running
= true;
518 /* Adding of a HID device is done through a worker, to allow HID drivers
519 * which use feature requests during .probe to work, without they would
520 * be blocked on devlock, which is held by uhid_char_write.
522 schedule_work(&uhid
->worker
);
527 kfree(uhid
->rd_data
);
528 uhid
->rd_data
= NULL
;
533 static int uhid_dev_create(struct uhid_device
*uhid
,
534 struct uhid_event
*ev
)
536 struct uhid_create_req orig
;
540 if (orig
.rd_size
<= 0 || orig
.rd_size
> HID_MAX_DESCRIPTOR_SIZE
)
542 if (copy_from_user(&ev
->u
.create2
.rd_data
, orig
.rd_data
, orig
.rd_size
))
545 memcpy(ev
->u
.create2
.name
, orig
.name
, sizeof(orig
.name
));
546 memcpy(ev
->u
.create2
.phys
, orig
.phys
, sizeof(orig
.phys
));
547 memcpy(ev
->u
.create2
.uniq
, orig
.uniq
, sizeof(orig
.uniq
));
548 ev
->u
.create2
.rd_size
= orig
.rd_size
;
549 ev
->u
.create2
.bus
= orig
.bus
;
550 ev
->u
.create2
.vendor
= orig
.vendor
;
551 ev
->u
.create2
.product
= orig
.product
;
552 ev
->u
.create2
.version
= orig
.version
;
553 ev
->u
.create2
.country
= orig
.country
;
555 return uhid_dev_create2(uhid
, ev
);
558 static int uhid_dev_destroy(struct uhid_device
*uhid
)
563 uhid
->running
= false;
564 wake_up_interruptible(&uhid
->report_wait
);
566 cancel_work_sync(&uhid
->worker
);
568 hid_destroy_device(uhid
->hid
);
569 kfree(uhid
->rd_data
);
574 static int uhid_dev_input(struct uhid_device
*uhid
, struct uhid_event
*ev
)
579 hid_input_report(uhid
->hid
, HID_INPUT_REPORT
, ev
->u
.input
.data
,
580 min_t(size_t, ev
->u
.input
.size
, UHID_DATA_MAX
), 0);
585 static int uhid_dev_input2(struct uhid_device
*uhid
, struct uhid_event
*ev
)
590 hid_input_report(uhid
->hid
, HID_INPUT_REPORT
, ev
->u
.input2
.data
,
591 min_t(size_t, ev
->u
.input2
.size
, UHID_DATA_MAX
), 0);
596 static int uhid_dev_get_report_reply(struct uhid_device
*uhid
,
597 struct uhid_event
*ev
)
602 uhid_report_wake_up(uhid
, ev
->u
.get_report_reply
.id
, ev
);
606 static int uhid_dev_set_report_reply(struct uhid_device
*uhid
,
607 struct uhid_event
*ev
)
612 uhid_report_wake_up(uhid
, ev
->u
.set_report_reply
.id
, ev
);
616 static int uhid_char_open(struct inode
*inode
, struct file
*file
)
618 struct uhid_device
*uhid
;
620 uhid
= kzalloc(sizeof(*uhid
), GFP_KERNEL
);
624 mutex_init(&uhid
->devlock
);
625 mutex_init(&uhid
->report_lock
);
626 spin_lock_init(&uhid
->qlock
);
627 init_waitqueue_head(&uhid
->waitq
);
628 init_waitqueue_head(&uhid
->report_wait
);
629 uhid
->running
= false;
630 INIT_WORK(&uhid
->worker
, uhid_device_add_worker
);
632 file
->private_data
= uhid
;
633 nonseekable_open(inode
, file
);
638 static int uhid_char_release(struct inode
*inode
, struct file
*file
)
640 struct uhid_device
*uhid
= file
->private_data
;
643 uhid_dev_destroy(uhid
);
645 for (i
= 0; i
< UHID_BUFSIZE
; ++i
)
646 kfree(uhid
->outq
[i
]);
653 static ssize_t
uhid_char_read(struct file
*file
, char __user
*buffer
,
654 size_t count
, loff_t
*ppos
)
656 struct uhid_device
*uhid
= file
->private_data
;
661 /* they need at least the "type" member of uhid_event */
662 if (count
< sizeof(__u32
))
666 if (file
->f_flags
& O_NONBLOCK
) {
667 if (uhid
->head
== uhid
->tail
)
670 ret
= wait_event_interruptible(uhid
->waitq
,
671 uhid
->head
!= uhid
->tail
);
676 ret
= mutex_lock_interruptible(&uhid
->devlock
);
680 if (uhid
->head
== uhid
->tail
) {
681 mutex_unlock(&uhid
->devlock
);
684 len
= min(count
, sizeof(**uhid
->outq
));
685 if (copy_to_user(buffer
, uhid
->outq
[uhid
->tail
], len
)) {
688 kfree(uhid
->outq
[uhid
->tail
]);
689 uhid
->outq
[uhid
->tail
] = NULL
;
691 spin_lock_irqsave(&uhid
->qlock
, flags
);
692 uhid
->tail
= (uhid
->tail
+ 1) % UHID_BUFSIZE
;
693 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
697 mutex_unlock(&uhid
->devlock
);
698 return ret
? ret
: len
;
701 static ssize_t
uhid_char_write(struct file
*file
, const char __user
*buffer
,
702 size_t count
, loff_t
*ppos
)
704 struct uhid_device
*uhid
= file
->private_data
;
708 /* we need at least the "type" member of uhid_event */
709 if (count
< sizeof(__u32
))
712 ret
= mutex_lock_interruptible(&uhid
->devlock
);
716 memset(&uhid
->input_buf
, 0, sizeof(uhid
->input_buf
));
717 len
= min(count
, sizeof(uhid
->input_buf
));
719 ret
= uhid_event_from_user(buffer
, len
, &uhid
->input_buf
);
723 switch (uhid
->input_buf
.type
) {
725 ret
= uhid_dev_create(uhid
, &uhid
->input_buf
);
728 ret
= uhid_dev_create2(uhid
, &uhid
->input_buf
);
731 ret
= uhid_dev_destroy(uhid
);
734 ret
= uhid_dev_input(uhid
, &uhid
->input_buf
);
737 ret
= uhid_dev_input2(uhid
, &uhid
->input_buf
);
739 case UHID_GET_REPORT_REPLY
:
740 ret
= uhid_dev_get_report_reply(uhid
, &uhid
->input_buf
);
742 case UHID_SET_REPORT_REPLY
:
743 ret
= uhid_dev_set_report_reply(uhid
, &uhid
->input_buf
);
750 mutex_unlock(&uhid
->devlock
);
752 /* return "count" not "len" to not confuse the caller */
753 return ret
? ret
: count
;
756 static __poll_t
uhid_char_poll(struct file
*file
, poll_table
*wait
)
758 struct uhid_device
*uhid
= file
->private_data
;
760 poll_wait(file
, &uhid
->waitq
, wait
);
762 if (uhid
->head
!= uhid
->tail
)
763 return EPOLLIN
| EPOLLRDNORM
;
768 static const struct file_operations uhid_fops
= {
769 .owner
= THIS_MODULE
,
770 .open
= uhid_char_open
,
771 .release
= uhid_char_release
,
772 .read
= uhid_char_read
,
773 .write
= uhid_char_write
,
774 .poll
= uhid_char_poll
,
778 static struct miscdevice uhid_misc
= {
783 module_misc_device(uhid_misc
);
785 MODULE_LICENSE("GPL");
786 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
787 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
788 MODULE_ALIAS_MISCDEV(UHID_MINOR
);
789 MODULE_ALIAS("devname:" UHID_NAME
);