2 * User-space I/O driver support for HID subsystem
3 * Copyright (c) 2012 David Herrmann
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the Free
9 * Software Foundation; either version 2 of the License, or (at your option)
13 #include <linux/atomic.h>
14 #include <linux/compat.h>
15 #include <linux/device.h>
17 #include <linux/hid.h>
18 #include <linux/input.h>
19 #include <linux/miscdevice.h>
20 #include <linux/module.h>
21 #include <linux/mutex.h>
22 #include <linux/poll.h>
23 #include <linux/sched.h>
24 #include <linux/spinlock.h>
25 #include <linux/uhid.h>
26 #include <linux/wait.h>
28 #define UHID_NAME "uhid"
29 #define UHID_BUFSIZE 32
38 struct hid_device
*hid
;
39 struct uhid_event input_buf
;
41 wait_queue_head_t waitq
;
45 struct uhid_event
*outq
[UHID_BUFSIZE
];
47 struct mutex report_lock
;
48 wait_queue_head_t report_wait
;
51 struct uhid_event report_buf
;
54 static struct miscdevice uhid_misc
;
56 static void uhid_queue(struct uhid_device
*uhid
, struct uhid_event
*ev
)
60 newhead
= (uhid
->head
+ 1) % UHID_BUFSIZE
;
62 if (newhead
!= uhid
->tail
) {
63 uhid
->outq
[uhid
->head
] = ev
;
65 wake_up_interruptible(&uhid
->waitq
);
67 hid_warn(uhid
->hid
, "Output queue is full\n");
72 static int uhid_queue_event(struct uhid_device
*uhid
, __u32 event
)
75 struct uhid_event
*ev
;
77 ev
= kzalloc(sizeof(*ev
), GFP_KERNEL
);
83 spin_lock_irqsave(&uhid
->qlock
, flags
);
85 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
90 static int uhid_hid_start(struct hid_device
*hid
)
92 struct uhid_device
*uhid
= hid
->driver_data
;
94 return uhid_queue_event(uhid
, UHID_START
);
97 static void uhid_hid_stop(struct hid_device
*hid
)
99 struct uhid_device
*uhid
= hid
->driver_data
;
102 uhid_queue_event(uhid
, UHID_STOP
);
105 static int uhid_hid_open(struct hid_device
*hid
)
107 struct uhid_device
*uhid
= hid
->driver_data
;
109 return uhid_queue_event(uhid
, UHID_OPEN
);
112 static void uhid_hid_close(struct hid_device
*hid
)
114 struct uhid_device
*uhid
= hid
->driver_data
;
116 uhid_queue_event(uhid
, UHID_CLOSE
);
119 static int uhid_hid_parse(struct hid_device
*hid
)
121 struct uhid_device
*uhid
= hid
->driver_data
;
123 return hid_parse_report(hid
, uhid
->rd_data
, uhid
->rd_size
);
126 static int uhid_hid_get_raw(struct hid_device
*hid
, unsigned char rnum
,
127 __u8
*buf
, size_t count
, unsigned char rtype
)
129 struct uhid_device
*uhid
= hid
->driver_data
;
131 struct uhid_event
*ev
;
134 size_t uninitialized_var(len
);
135 struct uhid_feature_answer_req
*req
;
141 case HID_FEATURE_REPORT
:
142 report_type
= UHID_FEATURE_REPORT
;
144 case HID_OUTPUT_REPORT
:
145 report_type
= UHID_OUTPUT_REPORT
;
147 case HID_INPUT_REPORT
:
148 report_type
= UHID_INPUT_REPORT
;
154 ret
= mutex_lock_interruptible(&uhid
->report_lock
);
158 ev
= kzalloc(sizeof(*ev
), GFP_KERNEL
);
164 spin_lock_irqsave(&uhid
->qlock
, flags
);
165 ev
->type
= UHID_FEATURE
;
166 ev
->u
.feature
.id
= atomic_inc_return(&uhid
->report_id
);
167 ev
->u
.feature
.rnum
= rnum
;
168 ev
->u
.feature
.rtype
= report_type
;
170 atomic_set(&uhid
->report_done
, 0);
171 uhid_queue(uhid
, ev
);
172 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
174 ret
= wait_event_interruptible_timeout(uhid
->report_wait
,
175 atomic_read(&uhid
->report_done
), 5 * HZ
);
178 * Make sure "uhid->running" is cleared on shutdown before
179 * "uhid->report_done" is set.
182 if (!ret
|| !uhid
->running
) {
184 } else if (ret
< 0) {
187 spin_lock_irqsave(&uhid
->qlock
, flags
);
188 req
= &uhid
->report_buf
.u
.feature_answer
;
195 min_t(size_t, req
->size
, UHID_DATA_MAX
));
196 memcpy(buf
, req
->data
, len
);
199 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
202 atomic_set(&uhid
->report_done
, 1);
205 mutex_unlock(&uhid
->report_lock
);
206 return ret
? ret
: len
;
209 static int uhid_hid_output_raw(struct hid_device
*hid
, __u8
*buf
, size_t count
,
210 unsigned char report_type
)
212 struct uhid_device
*uhid
= hid
->driver_data
;
215 struct uhid_event
*ev
;
217 switch (report_type
) {
218 case HID_FEATURE_REPORT
:
219 rtype
= UHID_FEATURE_REPORT
;
221 case HID_OUTPUT_REPORT
:
222 rtype
= UHID_OUTPUT_REPORT
;
228 if (count
< 1 || count
> UHID_DATA_MAX
)
231 ev
= kzalloc(sizeof(*ev
), GFP_KERNEL
);
235 ev
->type
= UHID_OUTPUT
;
236 ev
->u
.output
.size
= count
;
237 ev
->u
.output
.rtype
= rtype
;
238 memcpy(ev
->u
.output
.data
, buf
, count
);
240 spin_lock_irqsave(&uhid
->qlock
, flags
);
241 uhid_queue(uhid
, ev
);
242 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
247 static int uhid_hid_output_report(struct hid_device
*hid
, __u8
*buf
,
250 return uhid_hid_output_raw(hid
, buf
, count
, HID_OUTPUT_REPORT
);
253 static int uhid_raw_request(struct hid_device
*hid
, unsigned char reportnum
,
254 __u8
*buf
, size_t len
, unsigned char rtype
,
258 case HID_REQ_GET_REPORT
:
259 return uhid_hid_get_raw(hid
, reportnum
, buf
, len
, rtype
);
260 case HID_REQ_SET_REPORT
:
261 /* TODO: implement proper SET_REPORT functionality */
268 static struct hid_ll_driver uhid_hid_driver
= {
269 .start
= uhid_hid_start
,
270 .stop
= uhid_hid_stop
,
271 .open
= uhid_hid_open
,
272 .close
= uhid_hid_close
,
273 .parse
= uhid_hid_parse
,
274 .output_report
= uhid_hid_output_report
,
275 .raw_request
= uhid_raw_request
,
280 /* Apparently we haven't stepped on these rakes enough times yet. */
281 struct uhid_create_req_compat
{
286 compat_uptr_t rd_data
;
294 } __attribute__((__packed__
));
296 static int uhid_event_from_user(const char __user
*buffer
, size_t len
,
297 struct uhid_event
*event
)
299 if (is_compat_task()) {
302 if (get_user(type
, buffer
))
305 if (type
== UHID_CREATE
) {
307 * This is our messed up request with compat pointer.
308 * It is largish (more than 256 bytes) so we better
309 * allocate it from the heap.
311 struct uhid_create_req_compat
*compat
;
313 compat
= kzalloc(sizeof(*compat
), GFP_KERNEL
);
317 buffer
+= sizeof(type
);
319 if (copy_from_user(compat
, buffer
,
320 min(len
, sizeof(*compat
)))) {
325 /* Shuffle the data over to proper structure */
328 memcpy(event
->u
.create
.name
, compat
->name
,
329 sizeof(compat
->name
));
330 memcpy(event
->u
.create
.phys
, compat
->phys
,
331 sizeof(compat
->phys
));
332 memcpy(event
->u
.create
.uniq
, compat
->uniq
,
333 sizeof(compat
->uniq
));
335 event
->u
.create
.rd_data
= compat_ptr(compat
->rd_data
);
336 event
->u
.create
.rd_size
= compat
->rd_size
;
338 event
->u
.create
.bus
= compat
->bus
;
339 event
->u
.create
.vendor
= compat
->vendor
;
340 event
->u
.create
.product
= compat
->product
;
341 event
->u
.create
.version
= compat
->version
;
342 event
->u
.create
.country
= compat
->country
;
347 /* All others can be copied directly */
350 if (copy_from_user(event
, buffer
, min(len
, sizeof(*event
))))
356 static int uhid_event_from_user(const char __user
*buffer
, size_t len
,
357 struct uhid_event
*event
)
359 if (copy_from_user(event
, buffer
, min(len
, sizeof(*event
))))
366 static int uhid_dev_create(struct uhid_device
*uhid
,
367 const struct uhid_event
*ev
)
369 struct hid_device
*hid
;
375 uhid
->rd_size
= ev
->u
.create
.rd_size
;
376 if (uhid
->rd_size
<= 0 || uhid
->rd_size
> HID_MAX_DESCRIPTOR_SIZE
)
379 uhid
->rd_data
= kmalloc(uhid
->rd_size
, GFP_KERNEL
);
383 if (copy_from_user(uhid
->rd_data
, ev
->u
.create
.rd_data
,
389 hid
= hid_allocate_device();
395 strncpy(hid
->name
, ev
->u
.create
.name
, 127);
397 strncpy(hid
->phys
, ev
->u
.create
.phys
, 63);
399 strncpy(hid
->uniq
, ev
->u
.create
.uniq
, 63);
402 hid
->ll_driver
= &uhid_hid_driver
;
403 hid
->bus
= ev
->u
.create
.bus
;
404 hid
->vendor
= ev
->u
.create
.vendor
;
405 hid
->product
= ev
->u
.create
.product
;
406 hid
->version
= ev
->u
.create
.version
;
407 hid
->country
= ev
->u
.create
.country
;
408 hid
->driver_data
= uhid
;
409 hid
->dev
.parent
= uhid_misc
.this_device
;
412 uhid
->running
= true;
414 ret
= hid_add_device(hid
);
416 hid_err(hid
, "Cannot register HID device\n");
423 hid_destroy_device(hid
);
425 uhid
->running
= false;
427 kfree(uhid
->rd_data
);
431 static int uhid_dev_create2(struct uhid_device
*uhid
,
432 const struct uhid_event
*ev
)
434 struct hid_device
*hid
;
440 uhid
->rd_size
= ev
->u
.create2
.rd_size
;
441 if (uhid
->rd_size
<= 0 || uhid
->rd_size
> HID_MAX_DESCRIPTOR_SIZE
)
444 uhid
->rd_data
= kmemdup(ev
->u
.create2
.rd_data
, uhid
->rd_size
,
449 hid
= hid_allocate_device();
455 strncpy(hid
->name
, ev
->u
.create2
.name
, 127);
457 strncpy(hid
->phys
, ev
->u
.create2
.phys
, 63);
459 strncpy(hid
->uniq
, ev
->u
.create2
.uniq
, 63);
462 hid
->ll_driver
= &uhid_hid_driver
;
463 hid
->bus
= ev
->u
.create2
.bus
;
464 hid
->vendor
= ev
->u
.create2
.vendor
;
465 hid
->product
= ev
->u
.create2
.product
;
466 hid
->version
= ev
->u
.create2
.version
;
467 hid
->country
= ev
->u
.create2
.country
;
468 hid
->driver_data
= uhid
;
469 hid
->dev
.parent
= uhid_misc
.this_device
;
472 uhid
->running
= true;
474 ret
= hid_add_device(hid
);
476 hid_err(hid
, "Cannot register HID device\n");
483 hid_destroy_device(hid
);
485 uhid
->running
= false;
487 kfree(uhid
->rd_data
);
491 static int uhid_dev_destroy(struct uhid_device
*uhid
)
496 /* clear "running" before setting "report_done" */
497 uhid
->running
= false;
499 atomic_set(&uhid
->report_done
, 1);
500 wake_up_interruptible(&uhid
->report_wait
);
502 hid_destroy_device(uhid
->hid
);
503 kfree(uhid
->rd_data
);
508 static int uhid_dev_input(struct uhid_device
*uhid
, struct uhid_event
*ev
)
513 hid_input_report(uhid
->hid
, HID_INPUT_REPORT
, ev
->u
.input
.data
,
514 min_t(size_t, ev
->u
.input
.size
, UHID_DATA_MAX
), 0);
519 static int uhid_dev_input2(struct uhid_device
*uhid
, struct uhid_event
*ev
)
524 hid_input_report(uhid
->hid
, HID_INPUT_REPORT
, ev
->u
.input2
.data
,
525 min_t(size_t, ev
->u
.input2
.size
, UHID_DATA_MAX
), 0);
530 static int uhid_dev_feature_answer(struct uhid_device
*uhid
,
531 struct uhid_event
*ev
)
538 spin_lock_irqsave(&uhid
->qlock
, flags
);
540 /* id for old report; drop it silently */
541 if (atomic_read(&uhid
->report_id
) != ev
->u
.feature_answer
.id
)
543 if (atomic_read(&uhid
->report_done
))
546 memcpy(&uhid
->report_buf
, ev
, sizeof(*ev
));
547 atomic_set(&uhid
->report_done
, 1);
548 wake_up_interruptible(&uhid
->report_wait
);
551 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
555 static int uhid_char_open(struct inode
*inode
, struct file
*file
)
557 struct uhid_device
*uhid
;
559 uhid
= kzalloc(sizeof(*uhid
), GFP_KERNEL
);
563 mutex_init(&uhid
->devlock
);
564 mutex_init(&uhid
->report_lock
);
565 spin_lock_init(&uhid
->qlock
);
566 init_waitqueue_head(&uhid
->waitq
);
567 init_waitqueue_head(&uhid
->report_wait
);
568 uhid
->running
= false;
569 atomic_set(&uhid
->report_done
, 1);
571 file
->private_data
= uhid
;
572 nonseekable_open(inode
, file
);
577 static int uhid_char_release(struct inode
*inode
, struct file
*file
)
579 struct uhid_device
*uhid
= file
->private_data
;
582 uhid_dev_destroy(uhid
);
584 for (i
= 0; i
< UHID_BUFSIZE
; ++i
)
585 kfree(uhid
->outq
[i
]);
592 static ssize_t
uhid_char_read(struct file
*file
, char __user
*buffer
,
593 size_t count
, loff_t
*ppos
)
595 struct uhid_device
*uhid
= file
->private_data
;
600 /* they need at least the "type" member of uhid_event */
601 if (count
< sizeof(__u32
))
605 if (file
->f_flags
& O_NONBLOCK
) {
606 if (uhid
->head
== uhid
->tail
)
609 ret
= wait_event_interruptible(uhid
->waitq
,
610 uhid
->head
!= uhid
->tail
);
615 ret
= mutex_lock_interruptible(&uhid
->devlock
);
619 if (uhid
->head
== uhid
->tail
) {
620 mutex_unlock(&uhid
->devlock
);
623 len
= min(count
, sizeof(**uhid
->outq
));
624 if (copy_to_user(buffer
, uhid
->outq
[uhid
->tail
], len
)) {
627 kfree(uhid
->outq
[uhid
->tail
]);
628 uhid
->outq
[uhid
->tail
] = NULL
;
630 spin_lock_irqsave(&uhid
->qlock
, flags
);
631 uhid
->tail
= (uhid
->tail
+ 1) % UHID_BUFSIZE
;
632 spin_unlock_irqrestore(&uhid
->qlock
, flags
);
636 mutex_unlock(&uhid
->devlock
);
637 return ret
? ret
: len
;
640 static ssize_t
uhid_char_write(struct file
*file
, const char __user
*buffer
,
641 size_t count
, loff_t
*ppos
)
643 struct uhid_device
*uhid
= file
->private_data
;
647 /* we need at least the "type" member of uhid_event */
648 if (count
< sizeof(__u32
))
651 ret
= mutex_lock_interruptible(&uhid
->devlock
);
655 memset(&uhid
->input_buf
, 0, sizeof(uhid
->input_buf
));
656 len
= min(count
, sizeof(uhid
->input_buf
));
658 ret
= uhid_event_from_user(buffer
, len
, &uhid
->input_buf
);
662 switch (uhid
->input_buf
.type
) {
664 ret
= uhid_dev_create(uhid
, &uhid
->input_buf
);
667 ret
= uhid_dev_create2(uhid
, &uhid
->input_buf
);
670 ret
= uhid_dev_destroy(uhid
);
673 ret
= uhid_dev_input(uhid
, &uhid
->input_buf
);
676 ret
= uhid_dev_input2(uhid
, &uhid
->input_buf
);
678 case UHID_FEATURE_ANSWER
:
679 ret
= uhid_dev_feature_answer(uhid
, &uhid
->input_buf
);
686 mutex_unlock(&uhid
->devlock
);
688 /* return "count" not "len" to not confuse the caller */
689 return ret
? ret
: count
;
692 static unsigned int uhid_char_poll(struct file
*file
, poll_table
*wait
)
694 struct uhid_device
*uhid
= file
->private_data
;
696 poll_wait(file
, &uhid
->waitq
, wait
);
698 if (uhid
->head
!= uhid
->tail
)
699 return POLLIN
| POLLRDNORM
;
704 static const struct file_operations uhid_fops
= {
705 .owner
= THIS_MODULE
,
706 .open
= uhid_char_open
,
707 .release
= uhid_char_release
,
708 .read
= uhid_char_read
,
709 .write
= uhid_char_write
,
710 .poll
= uhid_char_poll
,
714 static struct miscdevice uhid_misc
= {
720 static int __init
uhid_init(void)
722 return misc_register(&uhid_misc
);
725 static void __exit
uhid_exit(void)
727 misc_deregister(&uhid_misc
);
730 module_init(uhid_init
);
731 module_exit(uhid_exit
);
732 MODULE_LICENSE("GPL");
733 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
734 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
735 MODULE_ALIAS_MISCDEV(UHID_MINOR
);
736 MODULE_ALIAS("devname:" UHID_NAME
);