hidraw.c 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * HID raw devices, giving access to raw HID events.
  4. *
  5. * In comparison to hiddev, this device does not process the
  6. * hid events at all (no parsing, no lookups). This lets applications
  7. * to work on raw hid events as they want to, and avoids a need to
  8. * use a transport-specific userspace libhid/libusb libraries.
  9. *
  10. * Copyright (c) 2007-2014 Jiri Kosina
  11. */
  12. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  13. #include <linux/fs.h>
  14. #include <linux/module.h>
  15. #include <linux/errno.h>
  16. #include <linux/kernel.h>
  17. #include <linux/init.h>
  18. #include <linux/cdev.h>
  19. #include <linux/poll.h>
  20. #include <linux/device.h>
  21. #include <linux/major.h>
  22. #include <linux/slab.h>
  23. #include <linux/hid.h>
  24. #include <linux/mutex.h>
  25. #include <linux/sched/signal.h>
  26. #include <linux/string.h>
  27. #include <linux/hidraw.h>
  28. static int hidraw_major;
  29. static struct cdev hidraw_cdev;
  30. static struct class *hidraw_class;
  31. static struct hidraw *hidraw_table[HIDRAW_MAX_DEVICES];
  32. static DECLARE_RWSEM(minors_rwsem);
  33. static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
  34. {
  35. struct hidraw_list *list = file->private_data;
  36. int ret = 0, len;
  37. DECLARE_WAITQUEUE(wait, current);
  38. mutex_lock(&list->read_mutex);
  39. while (ret == 0) {
  40. if (list->head == list->tail) {
  41. add_wait_queue(&list->hidraw->wait, &wait);
  42. set_current_state(TASK_INTERRUPTIBLE);
  43. while (list->head == list->tail) {
  44. if (signal_pending(current)) {
  45. ret = -ERESTARTSYS;
  46. break;
  47. }
  48. if (!list->hidraw->exist) {
  49. ret = -EIO;
  50. break;
  51. }
  52. if (file->f_flags & O_NONBLOCK) {
  53. ret = -EAGAIN;
  54. break;
  55. }
  56. /* allow O_NONBLOCK to work well from other threads */
  57. mutex_unlock(&list->read_mutex);
  58. schedule();
  59. mutex_lock(&list->read_mutex);
  60. set_current_state(TASK_INTERRUPTIBLE);
  61. }
  62. set_current_state(TASK_RUNNING);
  63. remove_wait_queue(&list->hidraw->wait, &wait);
  64. }
  65. if (ret)
  66. goto out;
  67. len = list->buffer[list->tail].len > count ?
  68. count : list->buffer[list->tail].len;
  69. if (list->buffer[list->tail].value) {
  70. if (copy_to_user(buffer, list->buffer[list->tail].value, len)) {
  71. ret = -EFAULT;
  72. goto out;
  73. }
  74. ret = len;
  75. }
  76. kfree(list->buffer[list->tail].value);
  77. list->buffer[list->tail].value = NULL;
  78. list->tail = (list->tail + 1) & (HIDRAW_BUFFER_SIZE - 1);
  79. }
  80. out:
  81. mutex_unlock(&list->read_mutex);
  82. return ret;
  83. }
  84. /*
  85. * The first byte of the report buffer is expected to be a report number.
  86. */
  87. static ssize_t hidraw_send_report(struct file *file, const char __user *buffer, size_t count, unsigned char report_type)
  88. {
  89. unsigned int minor = iminor(file_inode(file));
  90. struct hid_device *dev;
  91. __u8 *buf;
  92. int ret = 0;
  93. lockdep_assert_held(&minors_rwsem);
  94. if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
  95. ret = -ENODEV;
  96. goto out;
  97. }
  98. dev = hidraw_table[minor]->hid;
  99. if (count > HID_MAX_BUFFER_SIZE) {
  100. hid_warn(dev, "pid %d passed too large report\n",
  101. task_pid_nr(current));
  102. ret = -EINVAL;
  103. goto out;
  104. }
  105. if (count < 2) {
  106. hid_warn(dev, "pid %d passed too short report\n",
  107. task_pid_nr(current));
  108. ret = -EINVAL;
  109. goto out;
  110. }
  111. buf = memdup_user(buffer, count);
  112. if (IS_ERR(buf)) {
  113. ret = PTR_ERR(buf);
  114. goto out;
  115. }
  116. if ((report_type == HID_OUTPUT_REPORT) &&
  117. !(dev->quirks & HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP)) {
  118. ret = hid_hw_output_report(dev, buf, count);
  119. /*
  120. * compatibility with old implementation of USB-HID and I2C-HID:
  121. * if the device does not support receiving output reports,
  122. * on an interrupt endpoint, fallback to SET_REPORT HID command.
  123. */
  124. if (ret != -ENOSYS)
  125. goto out_free;
  126. }
  127. ret = hid_hw_raw_request(dev, buf[0], buf, count, report_type,
  128. HID_REQ_SET_REPORT);
  129. out_free:
  130. kfree(buf);
  131. out:
  132. return ret;
  133. }
  134. static ssize_t hidraw_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
  135. {
  136. ssize_t ret;
  137. down_read(&minors_rwsem);
  138. ret = hidraw_send_report(file, buffer, count, HID_OUTPUT_REPORT);
  139. up_read(&minors_rwsem);
  140. return ret;
  141. }
  142. /*
  143. * This function performs a Get_Report transfer over the control endpoint
  144. * per section 7.2.1 of the HID specification, version 1.1. The first byte
  145. * of buffer is the report number to request, or 0x0 if the device does not
  146. * use numbered reports. The report_type parameter can be HID_FEATURE_REPORT
  147. * or HID_INPUT_REPORT.
  148. */
  149. static ssize_t hidraw_get_report(struct file *file, char __user *buffer, size_t count, unsigned char report_type)
  150. {
  151. unsigned int minor = iminor(file_inode(file));
  152. struct hid_device *dev;
  153. __u8 *buf;
  154. int ret = 0, len;
  155. unsigned char report_number;
  156. lockdep_assert_held(&minors_rwsem);
  157. if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
  158. ret = -ENODEV;
  159. goto out;
  160. }
  161. dev = hidraw_table[minor]->hid;
  162. if (!dev->ll_driver->raw_request) {
  163. ret = -ENODEV;
  164. goto out;
  165. }
  166. if (count > HID_MAX_BUFFER_SIZE) {
  167. hid_warn(dev, "pid %d passed too large report\n",
  168. task_pid_nr(current));
  169. ret = -EINVAL;
  170. goto out;
  171. }
  172. if (count < 2) {
  173. hid_warn(dev, "pid %d passed too short report\n",
  174. task_pid_nr(current));
  175. ret = -EINVAL;
  176. goto out;
  177. }
  178. buf = kmalloc(count, GFP_KERNEL);
  179. if (!buf) {
  180. ret = -ENOMEM;
  181. goto out;
  182. }
  183. /*
  184. * Read the first byte from the user. This is the report number,
  185. * which is passed to hid_hw_raw_request().
  186. */
  187. if (copy_from_user(&report_number, buffer, 1)) {
  188. ret = -EFAULT;
  189. goto out_free;
  190. }
  191. ret = hid_hw_raw_request(dev, report_number, buf, count, report_type,
  192. HID_REQ_GET_REPORT);
  193. if (ret < 0)
  194. goto out_free;
  195. len = (ret < count) ? ret : count;
  196. if (copy_to_user(buffer, buf, len)) {
  197. ret = -EFAULT;
  198. goto out_free;
  199. }
  200. ret = len;
  201. out_free:
  202. kfree(buf);
  203. out:
  204. return ret;
  205. }
  206. static __poll_t hidraw_poll(struct file *file, poll_table *wait)
  207. {
  208. struct hidraw_list *list = file->private_data;
  209. __poll_t mask = EPOLLOUT | EPOLLWRNORM; /* hidraw is always writable */
  210. poll_wait(file, &list->hidraw->wait, wait);
  211. if (list->head != list->tail)
  212. mask |= EPOLLIN | EPOLLRDNORM;
  213. if (!list->hidraw->exist)
  214. mask |= EPOLLERR | EPOLLHUP;
  215. return mask;
  216. }
  217. static int hidraw_open(struct inode *inode, struct file *file)
  218. {
  219. unsigned int minor = iminor(inode);
  220. struct hidraw *dev;
  221. struct hidraw_list *list;
  222. unsigned long flags;
  223. int err = 0;
  224. if (!(list = kzalloc(sizeof(struct hidraw_list), GFP_KERNEL))) {
  225. err = -ENOMEM;
  226. goto out;
  227. }
  228. /*
  229. * Technically not writing to the hidraw_table but a write lock is
  230. * required to protect the device refcount. This is symmetrical to
  231. * hidraw_release().
  232. */
  233. down_write(&minors_rwsem);
  234. if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
  235. err = -ENODEV;
  236. goto out_unlock;
  237. }
  238. dev = hidraw_table[minor];
  239. if (!dev->open++) {
  240. err = hid_hw_power(dev->hid, PM_HINT_FULLON);
  241. if (err < 0) {
  242. dev->open--;
  243. goto out_unlock;
  244. }
  245. err = hid_hw_open(dev->hid);
  246. if (err < 0) {
  247. hid_hw_power(dev->hid, PM_HINT_NORMAL);
  248. dev->open--;
  249. goto out_unlock;
  250. }
  251. }
  252. list->hidraw = hidraw_table[minor];
  253. mutex_init(&list->read_mutex);
  254. spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
  255. list_add_tail(&list->node, &hidraw_table[minor]->list);
  256. spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
  257. file->private_data = list;
  258. out_unlock:
  259. up_write(&minors_rwsem);
  260. out:
  261. if (err < 0)
  262. kfree(list);
  263. return err;
  264. }
  265. static int hidraw_fasync(int fd, struct file *file, int on)
  266. {
  267. struct hidraw_list *list = file->private_data;
  268. return fasync_helper(fd, file, on, &list->fasync);
  269. }
  270. static void drop_ref(struct hidraw *hidraw, int exists_bit)
  271. {
  272. if (exists_bit) {
  273. hidraw->exist = 0;
  274. if (hidraw->open) {
  275. hid_hw_close(hidraw->hid);
  276. wake_up_interruptible(&hidraw->wait);
  277. }
  278. device_destroy(hidraw_class,
  279. MKDEV(hidraw_major, hidraw->minor));
  280. } else {
  281. --hidraw->open;
  282. }
  283. if (!hidraw->open) {
  284. if (!hidraw->exist) {
  285. hidraw_table[hidraw->minor] = NULL;
  286. kfree(hidraw);
  287. } else {
  288. /* close device for last reader */
  289. hid_hw_close(hidraw->hid);
  290. hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
  291. }
  292. }
  293. }
  294. static int hidraw_release(struct inode * inode, struct file * file)
  295. {
  296. unsigned int minor = iminor(inode);
  297. struct hidraw_list *list = file->private_data;
  298. unsigned long flags;
  299. down_write(&minors_rwsem);
  300. spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
  301. for (int i = list->tail; i < list->head; i++)
  302. kfree(list->buffer[i].value);
  303. list_del(&list->node);
  304. spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
  305. kfree(list);
  306. drop_ref(hidraw_table[minor], 0);
  307. up_write(&minors_rwsem);
  308. return 0;
  309. }
  310. static long hidraw_ioctl(struct file *file, unsigned int cmd,
  311. unsigned long arg)
  312. {
  313. struct inode *inode = file_inode(file);
  314. unsigned int minor = iminor(inode);
  315. long ret = 0;
  316. struct hidraw *dev;
  317. void __user *user_arg = (void __user*) arg;
  318. down_read(&minors_rwsem);
  319. dev = hidraw_table[minor];
  320. if (!dev || !dev->exist) {
  321. ret = -ENODEV;
  322. goto out;
  323. }
  324. switch (cmd) {
  325. case HIDIOCGRDESCSIZE:
  326. if (put_user(dev->hid->rsize, (int __user *)arg))
  327. ret = -EFAULT;
  328. break;
  329. case HIDIOCGRDESC:
  330. {
  331. __u32 len;
  332. if (get_user(len, (int __user *)arg))
  333. ret = -EFAULT;
  334. else if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
  335. ret = -EINVAL;
  336. else if (copy_to_user(user_arg + offsetof(
  337. struct hidraw_report_descriptor,
  338. value[0]),
  339. dev->hid->rdesc,
  340. min(dev->hid->rsize, len)))
  341. ret = -EFAULT;
  342. break;
  343. }
  344. case HIDIOCGRAWINFO:
  345. {
  346. struct hidraw_devinfo dinfo;
  347. dinfo.bustype = dev->hid->bus;
  348. dinfo.vendor = dev->hid->vendor;
  349. dinfo.product = dev->hid->product;
  350. if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))
  351. ret = -EFAULT;
  352. break;
  353. }
  354. default:
  355. {
  356. struct hid_device *hid = dev->hid;
  357. if (_IOC_TYPE(cmd) != 'H') {
  358. ret = -EINVAL;
  359. break;
  360. }
  361. if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSFEATURE(0))) {
  362. int len = _IOC_SIZE(cmd);
  363. ret = hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
  364. break;
  365. }
  366. if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGFEATURE(0))) {
  367. int len = _IOC_SIZE(cmd);
  368. ret = hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
  369. break;
  370. }
  371. if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSINPUT(0))) {
  372. int len = _IOC_SIZE(cmd);
  373. ret = hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
  374. break;
  375. }
  376. if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGINPUT(0))) {
  377. int len = _IOC_SIZE(cmd);
  378. ret = hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
  379. break;
  380. }
  381. if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSOUTPUT(0))) {
  382. int len = _IOC_SIZE(cmd);
  383. ret = hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
  384. break;
  385. }
  386. if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGOUTPUT(0))) {
  387. int len = _IOC_SIZE(cmd);
  388. ret = hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
  389. break;
  390. }
  391. /* Begin Read-only ioctls. */
  392. if (_IOC_DIR(cmd) != _IOC_READ) {
  393. ret = -EINVAL;
  394. break;
  395. }
  396. if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) {
  397. int len = strlen(hid->name) + 1;
  398. if (len > _IOC_SIZE(cmd))
  399. len = _IOC_SIZE(cmd);
  400. ret = copy_to_user(user_arg, hid->name, len) ?
  401. -EFAULT : len;
  402. break;
  403. }
  404. if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) {
  405. int len = strlen(hid->phys) + 1;
  406. if (len > _IOC_SIZE(cmd))
  407. len = _IOC_SIZE(cmd);
  408. ret = copy_to_user(user_arg, hid->phys, len) ?
  409. -EFAULT : len;
  410. break;
  411. }
  412. if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWUNIQ(0))) {
  413. int len = strlen(hid->uniq) + 1;
  414. if (len > _IOC_SIZE(cmd))
  415. len = _IOC_SIZE(cmd);
  416. ret = copy_to_user(user_arg, hid->uniq, len) ?
  417. -EFAULT : len;
  418. break;
  419. }
  420. }
  421. ret = -ENOTTY;
  422. }
  423. out:
  424. up_read(&minors_rwsem);
  425. return ret;
  426. }
  427. static const struct file_operations hidraw_ops = {
  428. .owner = THIS_MODULE,
  429. .read = hidraw_read,
  430. .write = hidraw_write,
  431. .poll = hidraw_poll,
  432. .open = hidraw_open,
  433. .release = hidraw_release,
  434. .unlocked_ioctl = hidraw_ioctl,
  435. .fasync = hidraw_fasync,
  436. .compat_ioctl = compat_ptr_ioctl,
  437. .llseek = noop_llseek,
  438. };
  439. int hidraw_report_event(struct hid_device *hid, u8 *data, int len)
  440. {
  441. struct hidraw *dev = hid->hidraw;
  442. struct hidraw_list *list;
  443. int ret = 0;
  444. unsigned long flags;
  445. spin_lock_irqsave(&dev->list_lock, flags);
  446. list_for_each_entry(list, &dev->list, node) {
  447. int new_head = (list->head + 1) & (HIDRAW_BUFFER_SIZE - 1);
  448. if (new_head == list->tail)
  449. continue;
  450. if (!(list->buffer[list->head].value = kmemdup(data, len, GFP_ATOMIC))) {
  451. ret = -ENOMEM;
  452. break;
  453. }
  454. list->buffer[list->head].len = len;
  455. list->head = new_head;
  456. kill_fasync(&list->fasync, SIGIO, POLL_IN);
  457. }
  458. spin_unlock_irqrestore(&dev->list_lock, flags);
  459. wake_up_interruptible(&dev->wait);
  460. return ret;
  461. }
  462. EXPORT_SYMBOL_GPL(hidraw_report_event);
  463. int hidraw_connect(struct hid_device *hid)
  464. {
  465. int minor, result;
  466. struct hidraw *dev;
  467. /* we accept any HID device, all applications */
  468. dev = kzalloc(sizeof(struct hidraw), GFP_KERNEL);
  469. if (!dev)
  470. return -ENOMEM;
  471. result = -EINVAL;
  472. down_write(&minors_rwsem);
  473. for (minor = 0; minor < HIDRAW_MAX_DEVICES; minor++) {
  474. if (hidraw_table[minor])
  475. continue;
  476. hidraw_table[minor] = dev;
  477. result = 0;
  478. break;
  479. }
  480. if (result) {
  481. up_write(&minors_rwsem);
  482. kfree(dev);
  483. goto out;
  484. }
  485. dev->dev = device_create(hidraw_class, &hid->dev, MKDEV(hidraw_major, minor),
  486. NULL, "%s%d", "hidraw", minor);
  487. if (IS_ERR(dev->dev)) {
  488. hidraw_table[minor] = NULL;
  489. up_write(&minors_rwsem);
  490. result = PTR_ERR(dev->dev);
  491. kfree(dev);
  492. goto out;
  493. }
  494. init_waitqueue_head(&dev->wait);
  495. spin_lock_init(&dev->list_lock);
  496. INIT_LIST_HEAD(&dev->list);
  497. dev->hid = hid;
  498. dev->minor = minor;
  499. dev->exist = 1;
  500. hid->hidraw = dev;
  501. up_write(&minors_rwsem);
  502. out:
  503. return result;
  504. }
  505. EXPORT_SYMBOL_GPL(hidraw_connect);
  506. void hidraw_disconnect(struct hid_device *hid)
  507. {
  508. struct hidraw *hidraw = hid->hidraw;
  509. down_write(&minors_rwsem);
  510. drop_ref(hidraw, 1);
  511. up_write(&minors_rwsem);
  512. }
  513. EXPORT_SYMBOL_GPL(hidraw_disconnect);
  514. int __init hidraw_init(void)
  515. {
  516. int result;
  517. dev_t dev_id;
  518. result = alloc_chrdev_region(&dev_id, HIDRAW_FIRST_MINOR,
  519. HIDRAW_MAX_DEVICES, "hidraw");
  520. if (result < 0) {
  521. pr_warn("can't get major number\n");
  522. goto out;
  523. }
  524. hidraw_major = MAJOR(dev_id);
  525. hidraw_class = class_create(THIS_MODULE, "hidraw");
  526. if (IS_ERR(hidraw_class)) {
  527. result = PTR_ERR(hidraw_class);
  528. goto error_cdev;
  529. }
  530. cdev_init(&hidraw_cdev, &hidraw_ops);
  531. result = cdev_add(&hidraw_cdev, dev_id, HIDRAW_MAX_DEVICES);
  532. if (result < 0)
  533. goto error_class;
  534. pr_info("raw HID events driver (C) Jiri Kosina\n");
  535. out:
  536. return result;
  537. error_class:
  538. class_destroy(hidraw_class);
  539. error_cdev:
  540. unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
  541. goto out;
  542. }
  543. void hidraw_exit(void)
  544. {
  545. dev_t dev_id = MKDEV(hidraw_major, 0);
  546. cdev_del(&hidraw_cdev);
  547. class_destroy(hidraw_class);
  548. unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
  549. }