2 * User-space I/O driver support for HID subsystem
3 * Copyright (c) 2012 David Herrmann
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the Free
9 * Software Foundation; either version 2 of the License, or (at your option)
13 #include <linux/atomic.h>
14 #include <linux/compat.h>
15 #include <linux/cred.h>
16 #include <linux/device.h>
18 #include <linux/hid.h>
19 #include <linux/input.h>
20 #include <linux/miscdevice.h>
21 #include <linux/module.h>
22 #include <linux/mutex.h>
23 #include <linux/poll.h>
24 #include <linux/sched.h>
25 #include <linux/spinlock.h>
26 #include <linux/uhid.h>
27 #include <linux/wait.h>
28 #include <linux/eventpoll.h>
30 #define UHID_NAME "uhid"
31 #define UHID_BUFSIZE 32
40 struct hid_device *hid;
41 struct uhid_event input_buf;
43 wait_queue_head_t waitq;
47 struct uhid_event *outq[UHID_BUFSIZE];
49 /* blocking GET_REPORT support; state changes protected by qlock */
50 struct mutex report_lock;
51 wait_queue_head_t report_wait;
55 struct uhid_event report_buf;
56 struct work_struct worker;
59 static struct miscdevice uhid_misc;
61 static void uhid_device_add_worker(struct work_struct *work)
63 struct uhid_device *uhid = container_of(work, struct uhid_device, worker);
66 ret = hid_add_device(uhid->hid);
68 hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret);
70 hid_destroy_device(uhid->hid);
72 uhid->running = false;
76 static void uhid_queue(struct uhid_device *uhid, struct uhid_event *ev)
80 newhead = (uhid->head + 1) % UHID_BUFSIZE;
82 if (newhead != uhid->tail) {
83 uhid->outq[uhid->head] = ev;
85 wake_up_interruptible(&uhid->waitq);
87 hid_warn(uhid->hid, "Output queue is full\n");
92 static int uhid_queue_event(struct uhid_device *uhid, __u32 event)
95 struct uhid_event *ev;
97 ev = kzalloc(sizeof(*ev), GFP_KERNEL);
103 spin_lock_irqsave(&uhid->qlock, flags);
104 uhid_queue(uhid, ev);
105 spin_unlock_irqrestore(&uhid->qlock, flags);
110 static int uhid_hid_start(struct hid_device *hid)
112 struct uhid_device *uhid = hid->driver_data;
113 struct uhid_event *ev;
116 ev = kzalloc(sizeof(*ev), GFP_KERNEL);
120 ev->type = UHID_START;
122 if (hid->report_enum[HID_FEATURE_REPORT].numbered)
123 ev->u.start.dev_flags |= UHID_DEV_NUMBERED_FEATURE_REPORTS;
124 if (hid->report_enum[HID_OUTPUT_REPORT].numbered)
125 ev->u.start.dev_flags |= UHID_DEV_NUMBERED_OUTPUT_REPORTS;
126 if (hid->report_enum[HID_INPUT_REPORT].numbered)
127 ev->u.start.dev_flags |= UHID_DEV_NUMBERED_INPUT_REPORTS;
129 spin_lock_irqsave(&uhid->qlock, flags);
130 uhid_queue(uhid, ev);
131 spin_unlock_irqrestore(&uhid->qlock, flags);
136 static void uhid_hid_stop(struct hid_device *hid)
138 struct uhid_device *uhid = hid->driver_data;
141 uhid_queue_event(uhid, UHID_STOP);
144 static int uhid_hid_open(struct hid_device *hid)
146 struct uhid_device *uhid = hid->driver_data;
148 return uhid_queue_event(uhid, UHID_OPEN);
151 static void uhid_hid_close(struct hid_device *hid)
153 struct uhid_device *uhid = hid->driver_data;
155 uhid_queue_event(uhid, UHID_CLOSE);
158 static int uhid_hid_parse(struct hid_device *hid)
160 struct uhid_device *uhid = hid->driver_data;
162 return hid_parse_report(hid, uhid->rd_data, uhid->rd_size);
165 /* must be called with report_lock held */
166 static int __uhid_report_queue_and_wait(struct uhid_device *uhid,
167 struct uhid_event *ev,
173 spin_lock_irqsave(&uhid->qlock, flags);
174 *report_id = ++uhid->report_id;
175 uhid->report_type = ev->type + 1;
176 uhid->report_running = true;
177 uhid_queue(uhid, ev);
178 spin_unlock_irqrestore(&uhid->qlock, flags);
180 ret = wait_event_interruptible_timeout(uhid->report_wait,
181 !uhid->report_running || !uhid->running,
183 if (!ret || !uhid->running || uhid->report_running)
190 uhid->report_running = false;
195 static void uhid_report_wake_up(struct uhid_device *uhid, u32 id,
196 const struct uhid_event *ev)
200 spin_lock_irqsave(&uhid->qlock, flags);
202 /* id for old report; drop it silently */
203 if (uhid->report_type != ev->type || uhid->report_id != id)
205 if (!uhid->report_running)
208 memcpy(&uhid->report_buf, ev, sizeof(*ev));
209 uhid->report_running = false;
210 wake_up_interruptible(&uhid->report_wait);
213 spin_unlock_irqrestore(&uhid->qlock, flags);
216 static int uhid_hid_get_report(struct hid_device *hid, unsigned char rnum,
217 u8 *buf, size_t count, u8 rtype)
219 struct uhid_device *uhid = hid->driver_data;
220 struct uhid_get_report_reply_req *req;
221 struct uhid_event *ev;
227 ev = kzalloc(sizeof(*ev), GFP_KERNEL);
231 ev->type = UHID_GET_REPORT;
232 ev->u.get_report.rnum = rnum;
233 ev->u.get_report.rtype = rtype;
235 ret = mutex_lock_interruptible(&uhid->report_lock);
241 /* this _always_ takes ownership of @ev */
242 ret = __uhid_report_queue_and_wait(uhid, ev, &ev->u.get_report.id);
246 req = &uhid->report_buf.u.get_report_reply;
250 ret = min3(count, (size_t)req->size, (size_t)UHID_DATA_MAX);
251 memcpy(buf, req->data, ret);
255 mutex_unlock(&uhid->report_lock);
259 static int uhid_hid_set_report(struct hid_device *hid, unsigned char rnum,
260 const u8 *buf, size_t count, u8 rtype)
262 struct uhid_device *uhid = hid->driver_data;
263 struct uhid_event *ev;
266 if (!uhid->running || count > UHID_DATA_MAX)
269 ev = kzalloc(sizeof(*ev), GFP_KERNEL);
273 ev->type = UHID_SET_REPORT;
274 ev->u.set_report.rnum = rnum;
275 ev->u.set_report.rtype = rtype;
276 ev->u.set_report.size = count;
277 memcpy(ev->u.set_report.data, buf, count);
279 ret = mutex_lock_interruptible(&uhid->report_lock);
285 /* this _always_ takes ownership of @ev */
286 ret = __uhid_report_queue_and_wait(uhid, ev, &ev->u.set_report.id);
290 if (uhid->report_buf.u.set_report_reply.err)
296 mutex_unlock(&uhid->report_lock);
300 static int uhid_hid_raw_request(struct hid_device *hid, unsigned char reportnum,
301 __u8 *buf, size_t len, unsigned char rtype,
307 case HID_FEATURE_REPORT:
308 u_rtype = UHID_FEATURE_REPORT;
310 case HID_OUTPUT_REPORT:
311 u_rtype = UHID_OUTPUT_REPORT;
313 case HID_INPUT_REPORT:
314 u_rtype = UHID_INPUT_REPORT;
321 case HID_REQ_GET_REPORT:
322 return uhid_hid_get_report(hid, reportnum, buf, len, u_rtype);
323 case HID_REQ_SET_REPORT:
324 return uhid_hid_set_report(hid, reportnum, buf, len, u_rtype);
330 static int uhid_hid_output_raw(struct hid_device *hid, __u8 *buf, size_t count,
331 unsigned char report_type)
333 struct uhid_device *uhid = hid->driver_data;
336 struct uhid_event *ev;
338 switch (report_type) {
339 case HID_FEATURE_REPORT:
340 rtype = UHID_FEATURE_REPORT;
342 case HID_OUTPUT_REPORT:
343 rtype = UHID_OUTPUT_REPORT;
349 if (count < 1 || count > UHID_DATA_MAX)
352 ev = kzalloc(sizeof(*ev), GFP_KERNEL);
356 ev->type = UHID_OUTPUT;
357 ev->u.output.size = count;
358 ev->u.output.rtype = rtype;
359 memcpy(ev->u.output.data, buf, count);
361 spin_lock_irqsave(&uhid->qlock, flags);
362 uhid_queue(uhid, ev);
363 spin_unlock_irqrestore(&uhid->qlock, flags);
368 static int uhid_hid_output_report(struct hid_device *hid, __u8 *buf,
371 return uhid_hid_output_raw(hid, buf, count, HID_OUTPUT_REPORT);
374 struct hid_ll_driver uhid_hid_driver = {
375 .start = uhid_hid_start,
376 .stop = uhid_hid_stop,
377 .open = uhid_hid_open,
378 .close = uhid_hid_close,
379 .parse = uhid_hid_parse,
380 .raw_request = uhid_hid_raw_request,
381 .output_report = uhid_hid_output_report,
383 EXPORT_SYMBOL_GPL(uhid_hid_driver);
387 /* Apparently we haven't stepped on these rakes enough times yet. */
388 struct uhid_create_req_compat {
393 compat_uptr_t rd_data;
401 } __attribute__((__packed__));
403 static int uhid_event_from_user(const char __user *buffer, size_t len,
404 struct uhid_event *event)
406 if (in_compat_syscall()) {
409 if (get_user(type, buffer))
412 if (type == UHID_CREATE) {
414 * This is our messed up request with compat pointer.
415 * It is largish (more than 256 bytes) so we better
416 * allocate it from the heap.
418 struct uhid_create_req_compat *compat;
420 compat = kzalloc(sizeof(*compat), GFP_KERNEL);
424 buffer += sizeof(type);
426 if (copy_from_user(compat, buffer,
427 min(len, sizeof(*compat)))) {
432 /* Shuffle the data over to proper structure */
435 memcpy(event->u.create.name, compat->name,
436 sizeof(compat->name));
437 memcpy(event->u.create.phys, compat->phys,
438 sizeof(compat->phys));
439 memcpy(event->u.create.uniq, compat->uniq,
440 sizeof(compat->uniq));
442 event->u.create.rd_data = compat_ptr(compat->rd_data);
443 event->u.create.rd_size = compat->rd_size;
445 event->u.create.bus = compat->bus;
446 event->u.create.vendor = compat->vendor;
447 event->u.create.product = compat->product;
448 event->u.create.version = compat->version;
449 event->u.create.country = compat->country;
454 /* All others can be copied directly */
457 if (copy_from_user(event, buffer, min(len, sizeof(*event))))
463 static int uhid_event_from_user(const char __user *buffer, size_t len,
464 struct uhid_event *event)
466 if (copy_from_user(event, buffer, min(len, sizeof(*event))))
473 static int uhid_dev_create2(struct uhid_device *uhid,
474 const struct uhid_event *ev)
476 struct hid_device *hid;
484 rd_size = ev->u.create2.rd_size;
485 if (rd_size <= 0 || rd_size > HID_MAX_DESCRIPTOR_SIZE)
488 rd_data = kmemdup(ev->u.create2.rd_data, rd_size, GFP_KERNEL);
492 uhid->rd_size = rd_size;
493 uhid->rd_data = rd_data;
495 hid = hid_allocate_device();
501 len = min(sizeof(hid->name), sizeof(ev->u.create2.name)) - 1;
502 strncpy(hid->name, ev->u.create2.name, len);
503 len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys)) - 1;
504 strncpy(hid->phys, ev->u.create2.phys, len);
505 len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq)) - 1;
506 strncpy(hid->uniq, ev->u.create2.uniq, len);
508 hid->ll_driver = &uhid_hid_driver;
509 hid->bus = ev->u.create2.bus;
510 hid->vendor = ev->u.create2.vendor;
511 hid->product = ev->u.create2.product;
512 hid->version = ev->u.create2.version;
513 hid->country = ev->u.create2.country;
514 hid->driver_data = uhid;
515 hid->dev.parent = uhid_misc.this_device;
518 uhid->running = true;
520 /* Adding of a HID device is done through a worker, to allow HID drivers
521 * which use feature requests during .probe to work, without they would
522 * be blocked on devlock, which is held by uhid_char_write.
524 schedule_work(&uhid->worker);
529 kfree(uhid->rd_data);
530 uhid->rd_data = NULL;
535 static int uhid_dev_create(struct uhid_device *uhid,
536 struct uhid_event *ev)
538 struct uhid_create_req orig;
542 if (orig.rd_size <= 0 || orig.rd_size > HID_MAX_DESCRIPTOR_SIZE)
544 if (copy_from_user(&ev->u.create2.rd_data, orig.rd_data, orig.rd_size))
547 memcpy(ev->u.create2.name, orig.name, sizeof(orig.name));
548 memcpy(ev->u.create2.phys, orig.phys, sizeof(orig.phys));
549 memcpy(ev->u.create2.uniq, orig.uniq, sizeof(orig.uniq));
550 ev->u.create2.rd_size = orig.rd_size;
551 ev->u.create2.bus = orig.bus;
552 ev->u.create2.vendor = orig.vendor;
553 ev->u.create2.product = orig.product;
554 ev->u.create2.version = orig.version;
555 ev->u.create2.country = orig.country;
557 return uhid_dev_create2(uhid, ev);
560 static int uhid_dev_destroy(struct uhid_device *uhid)
565 uhid->running = false;
566 wake_up_interruptible(&uhid->report_wait);
568 cancel_work_sync(&uhid->worker);
570 hid_destroy_device(uhid->hid);
571 kfree(uhid->rd_data);
576 static int uhid_dev_input(struct uhid_device *uhid, struct uhid_event *ev)
581 hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input.data,
582 min_t(size_t, ev->u.input.size, UHID_DATA_MAX), 0);
587 static int uhid_dev_input2(struct uhid_device *uhid, struct uhid_event *ev)
592 hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input2.data,
593 min_t(size_t, ev->u.input2.size, UHID_DATA_MAX), 0);
598 static int uhid_dev_get_report_reply(struct uhid_device *uhid,
599 struct uhid_event *ev)
604 uhid_report_wake_up(uhid, ev->u.get_report_reply.id, ev);
608 static int uhid_dev_set_report_reply(struct uhid_device *uhid,
609 struct uhid_event *ev)
614 uhid_report_wake_up(uhid, ev->u.set_report_reply.id, ev);
618 static int uhid_char_open(struct inode *inode, struct file *file)
620 struct uhid_device *uhid;
622 uhid = kzalloc(sizeof(*uhid), GFP_KERNEL);
626 mutex_init(&uhid->devlock);
627 mutex_init(&uhid->report_lock);
628 spin_lock_init(&uhid->qlock);
629 init_waitqueue_head(&uhid->waitq);
630 init_waitqueue_head(&uhid->report_wait);
631 uhid->running = false;
632 INIT_WORK(&uhid->worker, uhid_device_add_worker);
634 file->private_data = uhid;
635 nonseekable_open(inode, file);
640 static int uhid_char_release(struct inode *inode, struct file *file)
642 struct uhid_device *uhid = file->private_data;
645 uhid_dev_destroy(uhid);
647 for (i = 0; i < UHID_BUFSIZE; ++i)
648 kfree(uhid->outq[i]);
655 static ssize_t uhid_char_read(struct file *file, char __user *buffer,
656 size_t count, loff_t *ppos)
658 struct uhid_device *uhid = file->private_data;
663 /* they need at least the "type" member of uhid_event */
664 if (count < sizeof(__u32))
668 if (file->f_flags & O_NONBLOCK) {
669 if (uhid->head == uhid->tail)
672 ret = wait_event_interruptible(uhid->waitq,
673 uhid->head != uhid->tail);
678 ret = mutex_lock_interruptible(&uhid->devlock);
682 if (uhid->head == uhid->tail) {
683 mutex_unlock(&uhid->devlock);
686 len = min(count, sizeof(**uhid->outq));
687 if (copy_to_user(buffer, uhid->outq[uhid->tail], len)) {
690 kfree(uhid->outq[uhid->tail]);
691 uhid->outq[uhid->tail] = NULL;
693 spin_lock_irqsave(&uhid->qlock, flags);
694 uhid->tail = (uhid->tail + 1) % UHID_BUFSIZE;
695 spin_unlock_irqrestore(&uhid->qlock, flags);
699 mutex_unlock(&uhid->devlock);
700 return ret ? ret : len;
703 static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
704 size_t count, loff_t *ppos)
706 struct uhid_device *uhid = file->private_data;
710 /* we need at least the "type" member of uhid_event */
711 if (count < sizeof(__u32))
714 ret = mutex_lock_interruptible(&uhid->devlock);
718 memset(&uhid->input_buf, 0, sizeof(uhid->input_buf));
719 len = min(count, sizeof(uhid->input_buf));
721 ret = uhid_event_from_user(buffer, len, &uhid->input_buf);
725 switch (uhid->input_buf.type) {
728 * 'struct uhid_create_req' contains a __user pointer which is
729 * copied from, so it's unsafe to allow this with elevated
730 * privileges (e.g. from a setuid binary) or via kernel_write().
732 if (file->f_cred != current_cred() || uaccess_kernel()) {
733 pr_err_once("UHID_CREATE from different security context by process %d (%s), this is not allowed.\n",
734 task_tgid_vnr(current), current->comm);
738 ret = uhid_dev_create(uhid, &uhid->input_buf);
741 ret = uhid_dev_create2(uhid, &uhid->input_buf);
744 ret = uhid_dev_destroy(uhid);
747 ret = uhid_dev_input(uhid, &uhid->input_buf);
750 ret = uhid_dev_input2(uhid, &uhid->input_buf);
752 case UHID_GET_REPORT_REPLY:
753 ret = uhid_dev_get_report_reply(uhid, &uhid->input_buf);
755 case UHID_SET_REPORT_REPLY:
756 ret = uhid_dev_set_report_reply(uhid, &uhid->input_buf);
763 mutex_unlock(&uhid->devlock);
765 /* return "count" not "len" to not confuse the caller */
766 return ret ? ret : count;
769 static unsigned int uhid_char_poll(struct file *file, poll_table *wait)
771 struct uhid_device *uhid = file->private_data;
772 unsigned int mask = POLLOUT | POLLWRNORM; /* uhid is always writable */
774 poll_wait(file, &uhid->waitq, wait);
776 if (uhid->head != uhid->tail)
777 mask |= POLLIN | POLLRDNORM;
782 static const struct file_operations uhid_fops = {
783 .owner = THIS_MODULE,
784 .open = uhid_char_open,
785 .release = uhid_char_release,
786 .read = uhid_char_read,
787 .write = uhid_char_write,
788 .poll = uhid_char_poll,
792 static struct miscdevice uhid_misc = {
797 module_misc_device(uhid_misc);
799 MODULE_LICENSE("GPL");
800 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
801 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
802 MODULE_ALIAS_MISCDEV(UHID_MINOR);
803 MODULE_ALIAS("devname:" UHID_NAME);