[linux-block.git] / drivers / hid / hidraw.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * HID raw devices, giving access to raw HID events.
 *
 * In comparison to hiddev, this device does not process the
 * hid events at all (no parsing, no lookups). This lets applications
 * to work on raw hid events as they want to, and avoids a need to
 * use a transport-specific userspace libhid/libusb libraries.
 *
 *  Copyright (c) 2007-2014 Jiri Kosina
 */


#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/fs.h>
#include <linux/module.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/cdev.h>
#include <linux/poll.h>
#include <linux/device.h>
#include <linux/major.h>
#include <linux/slab.h>
#include <linux/hid.h>
#include <linux/mutex.h>
#include <linux/sched/signal.h>
#include <linux/string.h>

#include <linux/hidraw.h>

static int hidraw_major;
static struct cdev hidraw_cdev;
static struct class *hidraw_class;
static struct hidraw *hidraw_table[HIDRAW_MAX_DEVICES];
static DECLARE_RWSEM(minors_rwsem);

static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
{
	struct hidraw_list *list = file->private_data;
	int ret = 0, len;
	DECLARE_WAITQUEUE(wait, current);

	mutex_lock(&list->read_mutex);

	while (ret == 0) {
		if (list->head == list->tail) {
			add_wait_queue(&list->hidraw->wait, &wait);
			set_current_state(TASK_INTERRUPTIBLE);

			while (list->head == list->tail) {
				if (signal_pending(current)) {
					ret = -ERESTARTSYS;
					break;
				}
				if (!list->hidraw->exist) {
					ret = -EIO;
					break;
				}
				if (file->f_flags & O_NONBLOCK) {
					ret = -EAGAIN;
					break;
				}

				/* allow O_NONBLOCK to work well from other threads */
				mutex_unlock(&list->read_mutex);
				schedule();
				mutex_lock(&list->read_mutex);
				set_current_state(TASK_INTERRUPTIBLE);
			}

			set_current_state(TASK_RUNNING);
			remove_wait_queue(&list->hidraw->wait, &wait);
		}

		if (ret)
			goto out;

		len = list->buffer[list->tail].len > count ?
			count : list->buffer[list->tail].len;

		if (list->buffer[list->tail].value) {
			if (copy_to_user(buffer, list->buffer[list->tail].value, len)) {
				ret = -EFAULT;
				goto out;
			}
			ret = len;
		}

		kfree(list->buffer[list->tail].value);
		list->buffer[list->tail].value = NULL;
		list->tail = (list->tail + 1) & (HIDRAW_BUFFER_SIZE - 1);
	}
out:
	mutex_unlock(&list->read_mutex);
	return ret;
}

/*
 * The first byte of the report buffer is expected to be a report number.
 */
static ssize_t hidraw_send_report(struct file *file, const char __user *buffer, size_t count, unsigned char report_type)
{
	unsigned int minor = iminor(file_inode(file));
	struct hid_device *dev;
	__u8 *buf;
	int ret = 0;

	lockdep_assert_held(&minors_rwsem);

	if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
		ret = -ENODEV;
		goto out;
	}

	dev = hidraw_table[minor]->hid;

	if (count > HID_MAX_BUFFER_SIZE) {
		hid_warn(dev, "pid %d passed too large report\n",
			 task_pid_nr(current));
		ret = -EINVAL;
		goto out;
	}

	if (count < 2) {
		hid_warn(dev, "pid %d passed too short report\n",
			 task_pid_nr(current));
		ret = -EINVAL;
		goto out;
	}

	buf = memdup_user(buffer, count);
	if (IS_ERR(buf)) {
		ret = PTR_ERR(buf);
		goto out;
	}

	if ((report_type == HID_OUTPUT_REPORT) &&
	    !(dev->quirks & HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP)) {
		ret = hid_hw_output_report(dev, buf, count);
		/*
		 * compatibility with old implementation of USB-HID and I2C-HID:
		 * if the device does not support receiving output reports,
		 * on an interrupt endpoint, fallback to SET_REPORT HID command.
		 */
		if (ret != -ENOSYS)
			goto out_free;
	}

	ret = hid_hw_raw_request(dev, buf[0], buf, count, report_type,
				HID_REQ_SET_REPORT);

out_free:
	kfree(buf);
out:
	return ret;
}

static ssize_t hidraw_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
{
	ssize_t ret;
	down_read(&minors_rwsem);
	ret = hidraw_send_report(file, buffer, count, HID_OUTPUT_REPORT);
	up_read(&minors_rwsem);
	return ret;
}


/*
 * This function performs a Get_Report transfer over the control endpoint
 * per section 7.2.1 of the HID specification, version 1.1.  The first byte
 * of buffer is the report number to request, or 0x0 if the device does not
 * use numbered reports. The report_type parameter can be HID_FEATURE_REPORT
 * or HID_INPUT_REPORT.
 */
static ssize_t hidraw_get_report(struct file *file, char __user *buffer, size_t count, unsigned char report_type)
{
	unsigned int minor = iminor(file_inode(file));
	struct hid_device *dev;
	__u8 *buf;
	int ret = 0, len;
	unsigned char report_number;

	lockdep_assert_held(&minors_rwsem);

	if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
		ret = -ENODEV;
		goto out;
	}

	dev = hidraw_table[minor]->hid;

	if (!dev->ll_driver->raw_request) {
		ret = -ENODEV;
		goto out;
	}

	if (count > HID_MAX_BUFFER_SIZE) {
		hid_warn(dev, "pid %d passed too large report\n",
			task_pid_nr(current));
		ret = -EINVAL;
		goto out;
	}

	if (count < 2) {
		hid_warn(dev, "pid %d passed too short report\n",
			task_pid_nr(current));
		ret = -EINVAL;
		goto out;
	}

	buf = kmalloc(count, GFP_KERNEL);
	if (!buf) {
		ret = -ENOMEM;
		goto out;
	}

	/*
	 * Read the first byte from the user. This is the report number,
	 * which is passed to hid_hw_raw_request().
	 */
	if (copy_from_user(&report_number, buffer, 1)) {
		ret = -EFAULT;
		goto out_free;
	}

	ret = hid_hw_raw_request(dev, report_number, buf, count, report_type,
				 HID_REQ_GET_REPORT);

	if (ret < 0)
		goto out_free;

	len = (ret < count) ? ret : count;

	if (copy_to_user(buffer, buf, len)) {
		ret = -EFAULT;
		goto out_free;
	}

	ret = len;

out_free:
	kfree(buf);
out:
	return ret;
}

static __poll_t hidraw_poll(struct file *file, poll_table *wait)
{
	struct hidraw_list *list = file->private_data;
	__poll_t mask = EPOLLOUT | EPOLLWRNORM; /* hidraw is always writable */

	poll_wait(file, &list->hidraw->wait, wait);
	if (list->head != list->tail)
		mask |= EPOLLIN | EPOLLRDNORM;
	if (!list->hidraw->exist)
		mask |= EPOLLERR | EPOLLHUP;
	return mask;
}

static int hidraw_open(struct inode *inode, struct file *file)
{
	unsigned int minor = iminor(inode);
	struct hidraw *dev;
	struct hidraw_list *list;
	unsigned long flags;
	int err = 0;

	if (!(list = kzalloc(sizeof(struct hidraw_list), GFP_KERNEL))) {
		err = -ENOMEM;
		goto out;
	}

	down_read(&minors_rwsem);
	if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
		err = -ENODEV;
		goto out_unlock;
	}

	dev = hidraw_table[minor];
	if (!dev->open++) {
		err = hid_hw_power(dev->hid, PM_HINT_FULLON);
		if (err < 0) {
			dev->open--;
			goto out_unlock;
		}

		err = hid_hw_open(dev->hid);
		if (err < 0) {
			hid_hw_power(dev->hid, PM_HINT_NORMAL);
			dev->open--;
			goto out_unlock;
		}
	}

	list->hidraw = hidraw_table[minor];
	mutex_init(&list->read_mutex);
	spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
	list_add_tail(&list->node, &hidraw_table[minor]->list);
	spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
	file->private_data = list;
out_unlock:
	up_read(&minors_rwsem);
out:
	if (err < 0)
		kfree(list);
	return err;

}

static int hidraw_fasync(int fd, struct file *file, int on)
{
	struct hidraw_list *list = file->private_data;

	return fasync_helper(fd, file, on, &list->fasync);
}

static void drop_ref(struct hidraw *hidraw, int exists_bit)
{
	if (exists_bit) {
		hidraw->exist = 0;
		if (hidraw->open) {
			hid_hw_close(hidraw->hid);
			wake_up_interruptible(&hidraw->wait);
		}
		device_destroy(hidraw_class,
			       MKDEV(hidraw_major, hidraw->minor));
	} else {
		--hidraw->open;
	}
	if (!hidraw->open) {
		if (!hidraw->exist) {
			hidraw_table[hidraw->minor] = NULL;
			kfree(hidraw);
		} else {
			/* close device for last reader */
			hid_hw_close(hidraw->hid);
			hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
		}
	}
}

static int hidraw_release(struct inode * inode, struct file * file)
{
	unsigned int minor = iminor(inode);
	struct hidraw_list *list = file->private_data;
	unsigned long flags;

	down_write(&minors_rwsem);

	spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
	for (int i = list->tail; i < list->head; i++)
		kfree(list->buffer[i].value);
	list_del(&list->node);
	spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
	kfree(list);

	drop_ref(hidraw_table[minor], 0);

	up_write(&minors_rwsem);
	return 0;
}

static long hidraw_ioctl(struct file *file, unsigned int cmd,
							unsigned long arg)
{
	struct inode *inode = file_inode(file);
	unsigned int minor = iminor(inode);
	long ret = 0;
	struct hidraw *dev;
	void __user *user_arg = (void __user*) arg;

	down_read(&minors_rwsem);
	dev = hidraw_table[minor];
	if (!dev || !dev->exist) {
		ret = -ENODEV;
		goto out;
	}

	switch (cmd) {
		case HIDIOCGRDESCSIZE:
			if (put_user(dev->hid->rsize, (int __user *)arg))
				ret = -EFAULT;
			break;

		case HIDIOCGRDESC:
			{
				__u32 len;

				if (get_user(len, (int __user *)arg))
					ret = -EFAULT;
				else if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
					ret = -EINVAL;
				else if (copy_to_user(user_arg + offsetof(
					struct hidraw_report_descriptor,
					value[0]),
					dev->hid->rdesc,
					min(dev->hid->rsize, len)))
					ret = -EFAULT;
				break;
			}
		case HIDIOCGRAWINFO:
			{
				struct hidraw_devinfo dinfo;

				dinfo.bustype = dev->hid->bus;
				dinfo.vendor = dev->hid->vendor;
				dinfo.product = dev->hid->product;
				if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))
					ret = -EFAULT;
				break;
			}
		default:
			{
				struct hid_device *hid = dev->hid;
				if (_IOC_TYPE(cmd) != 'H') {
					ret = -EINVAL;
					break;
				}

				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSFEATURE(0))) {
					int len = _IOC_SIZE(cmd);
					ret = hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
					break;
				}
				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGFEATURE(0))) {
					int len = _IOC_SIZE(cmd);
					ret = hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
					break;
				}

				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSINPUT(0))) {
					int len = _IOC_SIZE(cmd);
					ret = hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
					break;
				}
				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGINPUT(0))) {
					int len = _IOC_SIZE(cmd);
					ret = hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
					break;
				}

				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSOUTPUT(0))) {
					int len = _IOC_SIZE(cmd);
					ret = hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
					break;
				}
				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGOUTPUT(0))) {
					int len = _IOC_SIZE(cmd);
					ret = hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
					break;
				}

				/* Begin Read-only ioctls. */
				if (_IOC_DIR(cmd) != _IOC_READ) {
					ret = -EINVAL;
					break;
				}

				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) {
					int len = strlen(hid->name) + 1;
					if (len > _IOC_SIZE(cmd))
						len = _IOC_SIZE(cmd);
					ret = copy_to_user(user_arg, hid->name, len) ?
						-EFAULT : len;
					break;
				}

				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) {
					int len = strlen(hid->phys) + 1;
					if (len > _IOC_SIZE(cmd))
						len = _IOC_SIZE(cmd);
					ret = copy_to_user(user_arg, hid->phys, len) ?
						-EFAULT : len;
					break;
				}

				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWUNIQ(0))) {
					int len = strlen(hid->uniq) + 1;
					if (len > _IOC_SIZE(cmd))
						len = _IOC_SIZE(cmd);
					ret = copy_to_user(user_arg, hid->uniq, len) ?
						-EFAULT : len;
					break;
				}
			}

		ret = -ENOTTY;
	}
out:
	up_read(&minors_rwsem);
	return ret;
}

static const struct file_operations hidraw_ops = {
	.owner =        THIS_MODULE,
	.read =         hidraw_read,
	.write =        hidraw_write,
	.poll =         hidraw_poll,
	.open =         hidraw_open,
	.release =      hidraw_release,
	.unlocked_ioctl = hidraw_ioctl,
	.fasync =	hidraw_fasync,
	.compat_ioctl   = compat_ptr_ioctl,
	.llseek =	noop_llseek,
};

int hidraw_report_event(struct hid_device *hid, u8 *data, int len)
{
	struct hidraw *dev = hid->hidraw;
	struct hidraw_list *list;
	int ret = 0;
	unsigned long flags;

	spin_lock_irqsave(&dev->list_lock, flags);
	list_for_each_entry(list, &dev->list, node) {
		int new_head = (list->head + 1) & (HIDRAW_BUFFER_SIZE - 1);

		if (new_head == list->tail)
			continue;

		if (!(list->buffer[list->head].value = kmemdup(data, len, GFP_ATOMIC))) {
			ret = -ENOMEM;
			break;
		}
		list->buffer[list->head].len = len;
		list->head = new_head;
		kill_fasync(&list->fasync, SIGIO, POLL_IN);
	}
	spin_unlock_irqrestore(&dev->list_lock, flags);

	wake_up_interruptible(&dev->wait);
	return ret;
}
EXPORT_SYMBOL_GPL(hidraw_report_event);

int hidraw_connect(struct hid_device *hid)
{
	int minor, result;
	struct hidraw *dev;

	/* we accept any HID device, all applications */

	dev = kzalloc(sizeof(struct hidraw), GFP_KERNEL);
	if (!dev)
		return -ENOMEM;

	result = -EINVAL;

	down_write(&minors_rwsem);

	for (minor = 0; minor < HIDRAW_MAX_DEVICES; minor++) {
		if (hidraw_table[minor])
			continue;
		hidraw_table[minor] = dev;
		result = 0;
		break;
	}

	if (result) {
		up_write(&minors_rwsem);
		kfree(dev);
		goto out;
	}

	dev->dev = device_create(hidraw_class, &hid->dev, MKDEV(hidraw_major, minor),
				 NULL, "%s%d", "hidraw", minor);

	if (IS_ERR(dev->dev)) {
		hidraw_table[minor] = NULL;
		up_write(&minors_rwsem);
		result = PTR_ERR(dev->dev);
		kfree(dev);
		goto out;
	}

	init_waitqueue_head(&dev->wait);
	spin_lock_init(&dev->list_lock);
	INIT_LIST_HEAD(&dev->list);

	dev->hid = hid;
	dev->minor = minor;

	dev->exist = 1;
	hid->hidraw = dev;

	up_write(&minors_rwsem);
out:
	return result;

}
EXPORT_SYMBOL_GPL(hidraw_connect);

void hidraw_disconnect(struct hid_device *hid)
{
	struct hidraw *hidraw = hid->hidraw;

	down_write(&minors_rwsem);

	drop_ref(hidraw, 1);

	up_write(&minors_rwsem);
}
EXPORT_SYMBOL_GPL(hidraw_disconnect);

int __init hidraw_init(void)
{
	int result;
	dev_t dev_id;

	result = alloc_chrdev_region(&dev_id, HIDRAW_FIRST_MINOR,
			HIDRAW_MAX_DEVICES, "hidraw");
	if (result < 0) {
		pr_warn("can't get major number\n");
		goto out;
	}

	hidraw_major = MAJOR(dev_id);

	hidraw_class = class_create("hidraw");
	if (IS_ERR(hidraw_class)) {
		result = PTR_ERR(hidraw_class);
		goto error_cdev;
	}

        cdev_init(&hidraw_cdev, &hidraw_ops);
	result = cdev_add(&hidraw_cdev, dev_id, HIDRAW_MAX_DEVICES);
	if (result < 0)
		goto error_class;

	pr_info("raw HID events driver (C) Jiri Kosina\n");
out:
	return result;

error_class:
	class_destroy(hidraw_class);
error_cdev:
	unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
	goto out;
}

void hidraw_exit(void)
{
	dev_t dev_id = MKDEV(hidraw_major, 0);

	cdev_del(&hidraw_cdev);
	class_destroy(hidraw_class);
	unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);

}
Commit	Line	Data
a32dd67d	1	// SPDX-License-Identifier: GPL-2.0-only
86166b7b JK	2	/*
	3	* HID raw devices, giving access to raw HID events.
	4	*
	5	* In comparison to hiddev, this device does not process the
	6	* hid events at all (no parsing, no lookups). This lets applications
	7	* to work on raw hid events as they want to, and avoids a need to
	8	* use a transport-specific userspace libhid/libusb libraries.
	9	*
61834535	10	* Copyright (c) 2007-2014 Jiri Kosina
86166b7b JK	11	*/
86166b7b JK	12
86166b7b	13
4291ee30 JP	14	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
4291ee30 JP	15
86166b7b JK	16	#include <linux/fs.h>
	17	#include <linux/module.h>
	18	#include <linux/errno.h>
	19	#include <linux/kernel.h>
	20	#include <linux/init.h>
	21	#include <linux/cdev.h>
	22	#include <linux/poll.h>
	23	#include <linux/device.h>
	24	#include <linux/major.h>
5a0e3ad6	25	#include <linux/slab.h>
86166b7b JK	26	#include <linux/hid.h>
86166b7b JK	27	#include <linux/mutex.h>
174cd4b1	28	#include <linux/sched/signal.h>
8f507c8b	29	#include <linux/string.h>
86166b7b JK	30
	31	#include <linux/hidraw.h>
	32
	33	static int hidraw_major;
	34	static struct cdev hidraw_cdev;
	35	static struct class *hidraw_class;
	36	static struct hidraw *hidraw_table[HIDRAW_MAX_DEVICES];
8590222e	37	static DECLARE_RWSEM(minors_rwsem);
86166b7b JK	38
	39	static ssize_t hidraw_read(struct file file, char __user buffer, size_t count, loff_t *ppos)
	40	{
	41	struct hidraw_list *list = file->private_data;
	42	int ret = 0, len;
86166b7b JK	43	DECLARE_WAITQUEUE(wait, current);
86166b7b JK	44
b0e14951	45	mutex_lock(&list->read_mutex);
86166b7b	46
b0e14951	47	while (ret == 0) {
86166b7b JK	48	if (list->head == list->tail) {
	49	add_wait_queue(&list->hidraw->wait, &wait);
	50	set_current_state(TASK_INTERRUPTIBLE);
	51
	52	while (list->head == list->tail) {
86166b7b JK	53	if (signal_pending(current)) {
	54	ret = -ERESTARTSYS;
	55	break;
	56	}
	57	if (!list->hidraw->exist) {
	58	ret = -EIO;
	59	break;
	60	}
7611e8d2 FF	61	if (file->f_flags & O_NONBLOCK) {
	62	ret = -EAGAIN;
	63	break;
	64	}
86166b7b JK	65
	66	/* allow O_NONBLOCK to work well from other threads */
	67	mutex_unlock(&list->read_mutex);
	68	schedule();
	69	mutex_lock(&list->read_mutex);
	70	set_current_state(TASK_INTERRUPTIBLE);
	71	}
	72
	73	set_current_state(TASK_RUNNING);
	74	remove_wait_queue(&list->hidraw->wait, &wait);
	75	}
	76
	77	if (ret)
	78	goto out;
	79
86166b7b JK	80	len = list->buffer[list->tail].len > count ?
	81	count : list->buffer[list->tail].len;
	82
b6787242 JK	83	if (list->buffer[list->tail].value) {
	84	if (copy_to_user(buffer, list->buffer[list->tail].value, len)) {
	85	ret = -EFAULT;
	86	goto out;
	87	}
	88	ret = len;
86166b7b	89	}
86166b7b JK	90
86166b7b JK	91	kfree(list->buffer[list->tail].value);
4c7b417e	92	list->buffer[list->tail].value = NULL;
86166b7b JK	93	list->tail = (list->tail + 1) & (HIDRAW_BUFFER_SIZE - 1);
	94	}
	95	out:
	96	mutex_unlock(&list->read_mutex);
	97	return ret;
	98	}
	99
61834535 JK	100	/*
61834535 JK	101	* The first byte of the report buffer is expected to be a report number.
61834535	102	*/
b4dbde9d	103	static ssize_t hidraw_send_report(struct file file, const char __user buffer, size_t count, unsigned char report_type)
86166b7b	104	{
496ad9aa	105	unsigned int minor = iminor(file_inode(file));
2e57480b	106	struct hid_device *dev;
86166b7b JK	107	__u8 *buf;
	108	int ret = 0;
	109
8590222e	110	lockdep_assert_held(&minors_rwsem);
cc7ed49a	111
212a871a	112	if (!hidraw_table[minor] \|\| !hidraw_table[minor]->exist) {
e42dee9a AO	113	ret = -ENODEV;
	114	goto out;
	115	}
	116
2e57480b JK	117	dev = hidraw_table[minor]->hid;
2e57480b JK	118
2b107d62	119	if (count > HID_MAX_BUFFER_SIZE) {
4291ee30 JP	120	hid_warn(dev, "pid %d passed too large report\n",
4291ee30 JP	121	task_pid_nr(current));
2e57480b JK	122	ret = -EINVAL;
2e57480b JK	123	goto out;
86166b7b JK	124	}
	125
	126	if (count < 2) {
4291ee30 JP	127	hid_warn(dev, "pid %d passed too short report\n",
4291ee30 JP	128	task_pid_nr(current));
2e57480b JK	129	ret = -EINVAL;
2e57480b JK	130	goto out;
86166b7b JK	131	}
86166b7b JK	132
8f507c8b DT	133	buf = memdup_user(buffer, count);
	134	if (IS_ERR(buf)) {
	135	ret = PTR_ERR(buf);
2e57480b JK	136	goto out;
2e57480b JK	137	}
86166b7b	138
e534a935 BT	139	if ((report_type == HID_OUTPUT_REPORT) &&
e534a935 BT	140	!(dev->quirks & HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP)) {
3a75b249 BT	141	ret = hid_hw_output_report(dev, buf, count);
	142	/*
	143	* compatibility with old implementation of USB-HID and I2C-HID:
	144	* if the device does not support receiving output reports,
	145	* on an interrupt endpoint, fallback to SET_REPORT HID command.
	146	*/
	147	if (ret != -ENOSYS)
	148	goto out_free;
	149	}
	150
	151	ret = hid_hw_raw_request(dev, buf[0], buf, count, report_type,
	152	HID_REQ_SET_REPORT);
	153
2e57480b	154	out_free:
86166b7b	155	kfree(buf);
2e57480b	156	out:
b4dbde9d AO	157	return ret;
	158	}
	159
b4dbde9d AO	160	static ssize_t hidraw_write(struct file file, const char __user buffer, size_t count, loff_t *ppos)
	161	{
	162	ssize_t ret;
8590222e	163	down_read(&minors_rwsem);
b4dbde9d	164	ret = hidraw_send_report(file, buffer, count, HID_OUTPUT_REPORT);
8590222e	165	up_read(&minors_rwsem);
86166b7b JK	166	return ret;
	167	}
	168
b4dbde9d	169
61834535 JK	170	/*
61834535 JK	171	* This function performs a Get_Report transfer over the control endpoint
d2a1cfeb	172	* per section 7.2.1 of the HID specification, version 1.1. The first byte
f43d3870	173	* of buffer is the report number to request, or 0x0 if the device does not
d2a1cfeb	174	* use numbered reports. The report_type parameter can be HID_FEATURE_REPORT
61834535	175	* or HID_INPUT_REPORT.
61834535	176	*/
b4dbde9d AO	177	static ssize_t hidraw_get_report(struct file file, char __user buffer, size_t count, unsigned char report_type)
b4dbde9d AO	178	{
496ad9aa	179	unsigned int minor = iminor(file_inode(file));
b4dbde9d AO	180	struct hid_device *dev;
	181	__u8 *buf;
	182	int ret = 0, len;
	183	unsigned char report_number;
	184
8590222e	185	lockdep_assert_held(&minors_rwsem);
cc7ed49a	186
a955358d RRC	187	if (!hidraw_table[minor] \|\| !hidraw_table[minor]->exist) {
	188	ret = -ENODEV;
	189	goto out;
	190	}
	191
b4dbde9d AO	192	dev = hidraw_table[minor]->hid;
b4dbde9d AO	193
cafebc05	194	if (!dev->ll_driver->raw_request) {
b4dbde9d AO	195	ret = -ENODEV;
	196	goto out;
	197	}
	198
	199	if (count > HID_MAX_BUFFER_SIZE) {
b05cec61 RG	200	hid_warn(dev, "pid %d passed too large report\n",
b05cec61 RG	201	task_pid_nr(current));
b4dbde9d AO	202	ret = -EINVAL;
	203	goto out;
	204	}
	205
	206	if (count < 2) {
b05cec61 RG	207	hid_warn(dev, "pid %d passed too short report\n",
b05cec61 RG	208	task_pid_nr(current));
b4dbde9d AO	209	ret = -EINVAL;
	210	goto out;
	211	}
	212
6da2ec56	213	buf = kmalloc(count, GFP_KERNEL);
b4dbde9d AO	214	if (!buf) {
	215	ret = -ENOMEM;
	216	goto out;
	217	}
	218
61834535 JK	219	/*
61834535 JK	220	* Read the first byte from the user. This is the report number,
cafebc05	221	* which is passed to hid_hw_raw_request().
61834535	222	*/
b4dbde9d AO	223	if (copy_from_user(&report_number, buffer, 1)) {
	224	ret = -EFAULT;
	225	goto out_free;
	226	}
	227
cafebc05 BT	228	ret = hid_hw_raw_request(dev, report_number, buf, count, report_type,
cafebc05 BT	229	HID_REQ_GET_REPORT);
b4dbde9d AO	230
	231	if (ret < 0)
	232	goto out_free;
	233
	234	len = (ret < count) ? ret : count;
	235
	236	if (copy_to_user(buffer, buf, len)) {
	237	ret = -EFAULT;
	238	goto out_free;
	239	}
	240
	241	ret = len;
	242
	243	out_free:
	244	kfree(buf);
	245	out:
	246	return ret;
	247	}
	248
afc9a42b	249	static __poll_t hidraw_poll(struct file file, poll_table wait)
86166b7b JK	250	{
86166b7b JK	251	struct hidraw_list *list = file->private_data;
9e635c28	252	__poll_t mask = EPOLLOUT \| EPOLLWRNORM; /* hidraw is always writable */
86166b7b JK	253
	254	poll_wait(file, &list->hidraw->wait, wait);
	255	if (list->head != list->tail)
9e635c28	256	mask \|= EPOLLIN \| EPOLLRDNORM;
86166b7b	257	if (!list->hidraw->exist)
9e635c28 JK	258	mask \|= EPOLLERR \| EPOLLHUP;
9e635c28 JK	259	return mask;
86166b7b JK	260	}
	261
	262	static int hidraw_open(struct inode inode, struct file file)
	263	{
	264	unsigned int minor = iminor(inode);
	265	struct hidraw *dev;
	266	struct hidraw_list *list;
277fe44d	267	unsigned long flags;
86166b7b JK	268	int err = 0;
	269
	270	if (!(list = kzalloc(sizeof(struct hidraw_list), GFP_KERNEL))) {
	271	err = -ENOMEM;
	272	goto out;
	273	}
	274
8590222e	275	down_read(&minors_rwsem);
212a871a	276	if (!hidraw_table[minor] \|\| !hidraw_table[minor]->exist) {
86166b7b JK	277	err = -ENODEV;
	278	goto out_unlock;
	279	}
	280
86166b7b	281	dev = hidraw_table[minor];
7d672cd7	282	if (!dev->open++) {
5bea7660	283	err = hid_hw_power(dev->hid, PM_HINT_FULLON);
f554ff80 AN	284	if (err < 0) {
f554ff80 AN	285	dev->open--;
5bea7660	286	goto out_unlock;
f554ff80	287	}
5bea7660 DT	288
5bea7660 DT	289	err = hid_hw_open(dev->hid);
0361a28d	290	if (err < 0) {
5bea7660	291	hid_hw_power(dev->hid, PM_HINT_NORMAL);
7d672cd7	292	dev->open--;
277fe44d	293	goto out_unlock;
0361a28d	294	}
7d672cd7	295	}
86166b7b	296
277fe44d YZ	297	list->hidraw = hidraw_table[minor];
	298	mutex_init(&list->read_mutex);
	299	spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
	300	list_add_tail(&list->node, &hidraw_table[minor]->list);
	301	spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
	302	file->private_data = list;
86166b7b	303	out_unlock:
8590222e	304	up_read(&minors_rwsem);
7d672cd7	305	out:
1a896231 AN	306	if (err < 0)
1a896231 AN	307	kfree(list);
86166b7b JK	308	return err;
	309
	310	}
	311
b5531318 AD	312	static int hidraw_fasync(int fd, struct file *file, int on)
	313	{
	314	struct hidraw_list *list = file->private_data;
	315
	316	return fasync_helper(fd, file, on, &list->fasync);
	317	}
	318
212a871a MC	319	static void drop_ref(struct hidraw *hidraw, int exists_bit)
	320	{
	321	if (exists_bit) {
212a871a	322	hidraw->exist = 0;
0f5a24c6 MC	323	if (hidraw->open) {
0f5a24c6 MC	324	hid_hw_close(hidraw->hid);
212a871a	325	wake_up_interruptible(&hidraw->wait);
0f5a24c6	326	}
47587fc0 FLVC	327	device_destroy(hidraw_class,
47587fc0 FLVC	328	MKDEV(hidraw_major, hidraw->minor));
212a871a MC	329	} else {
	330	--hidraw->open;
	331	}
0f5a24c6 MC	332	if (!hidraw->open) {
0f5a24c6 MC	333	if (!hidraw->exist) {
0f5a24c6 MC	334	hidraw_table[hidraw->minor] = NULL;
	335	kfree(hidraw);
	336	} else {
	337	/* close device for last reader */
0f5a24c6	338	hid_hw_close(hidraw->hid);
814b6d17	339	hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
0f5a24c6	340	}
212a871a MC	341	}
	342	}
	343
86166b7b JK	344	static int hidraw_release(struct inode * inode, struct file * file)
	345	{
	346	unsigned int minor = iminor(inode);
86166b7b	347	struct hidraw_list *list = file->private_data;
277fe44d	348	unsigned long flags;
df0cfd69	349
8590222e	350	down_write(&minors_rwsem);
86166b7b	351
277fe44d	352	spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
a5623a20 KA	353	for (int i = list->tail; i < list->head; i++)
a5623a20 KA	354	kfree(list->buffer[i].value);
86166b7b	355	list_del(&list->node);
277fe44d	356	spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
4db1c62c	357	kfree(list);
df0cfd69	358
212a871a MC	359	drop_ref(hidraw_table[minor], 0);
212a871a MC	360
8590222e	361	up_write(&minors_rwsem);
212a871a	362	return 0;
86166b7b JK	363	}
86166b7b JK	364
979c407e AC	365	static long hidraw_ioctl(struct file *file, unsigned int cmd,
979c407e AC	366	unsigned long arg)
86166b7b	367	{
496ad9aa	368	struct inode *inode = file_inode(file);
86166b7b	369	unsigned int minor = iminor(inode);
979c407e	370	long ret = 0;
2e57480b	371	struct hidraw *dev;
86166b7b JK	372	void __user user_arg = (void __user) arg;
86166b7b JK	373
8590222e	374	down_read(&minors_rwsem);
2e57480b	375	dev = hidraw_table[minor];
416dacb8	376	if (!dev \|\| !dev->exist) {
d20d5ffa AO	377	ret = -ENODEV;
	378	goto out;
	379	}
2e57480b	380
86166b7b JK	381	switch (cmd) {
	382	case HIDIOCGRDESCSIZE:
	383	if (put_user(dev->hid->rsize, (int __user *)arg))
979c407e AC	384	ret = -EFAULT;
979c407e AC	385	break;
86166b7b JK	386
	387	case HIDIOCGRDESC:
	388	{
	389	__u32 len;
	390
	391	if (get_user(len, (int __user *)arg))
979c407e AC	392	ret = -EFAULT;
	393	else if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
	394	ret = -EINVAL;
	395	else if (copy_to_user(user_arg + offsetof(
	396	struct hidraw_report_descriptor,
	397	value[0]),
	398	dev->hid->rdesc,
	399	min(dev->hid->rsize, len)))
	400	ret = -EFAULT;
	401	break;
86166b7b JK	402	}
	403	case HIDIOCGRAWINFO:
	404	{
	405	struct hidraw_devinfo dinfo;
	406
	407	dinfo.bustype = dev->hid->bus;
	408	dinfo.vendor = dev->hid->vendor;
	409	dinfo.product = dev->hid->product;
	410	if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))
979c407e AC	411	ret = -EFAULT;
979c407e AC	412	break;
86166b7b JK	413	}
86166b7b JK	414	default:
9188e79e JK	415	{
9188e79e JK	416	struct hid_device *hid = dev->hid;
b4dbde9d AO	417	if (_IOC_TYPE(cmd) != 'H') {
	418	ret = -EINVAL;
	419	break;
	420	}
	421
	422	if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSFEATURE(0))) {
	423	int len = _IOC_SIZE(cmd);
	424	ret = hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
	425	break;
	426	}
	427	if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGFEATURE(0))) {
	428	int len = _IOC_SIZE(cmd);
	429	ret = hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
	430	break;
	431	}
	432
f43d3870 DC	433	if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSINPUT(0))) {
	434	int len = _IOC_SIZE(cmd);
	435	ret = hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
	436	break;
	437	}
	438	if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGINPUT(0))) {
	439	int len = _IOC_SIZE(cmd);
	440	ret = hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
	441	break;
	442	}
	443
	444	if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSOUTPUT(0))) {
	445	int len = _IOC_SIZE(cmd);
	446	ret = hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
	447	break;
	448	}
	449	if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGOUTPUT(0))) {
	450	int len = _IOC_SIZE(cmd);
	451	ret = hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
	452	break;
	453	}
	454
b4dbde9d AO	455	/* Begin Read-only ioctls. */
b4dbde9d AO	456	if (_IOC_DIR(cmd) != _IOC_READ) {
dfd395af DC	457	ret = -EINVAL;
	458	break;
	459	}
9188e79e JK	460
9188e79e JK	461	if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) {
dd2ed487	462	int len = strlen(hid->name) + 1;
9188e79e JK	463	if (len > _IOC_SIZE(cmd))
9188e79e JK	464	len = _IOC_SIZE(cmd);
dfd395af	465	ret = copy_to_user(user_arg, hid->name, len) ?
9188e79e	466	-EFAULT : len;
dfd395af	467	break;
9188e79e JK	468	}
	469
	470	if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) {
dd2ed487	471	int len = strlen(hid->phys) + 1;
9188e79e JK	472	if (len > _IOC_SIZE(cmd))
9188e79e JK	473	len = _IOC_SIZE(cmd);
dfd395af	474	ret = copy_to_user(user_arg, hid->phys, len) ?
9188e79e	475	-EFAULT : len;
dfd395af	476	break;
9188e79e	477	}
2f48865d MH	478
	479	if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWUNIQ(0))) {
	480	int len = strlen(hid->uniq) + 1;
	481	if (len > _IOC_SIZE(cmd))
	482	len = _IOC_SIZE(cmd);
	483	ret = copy_to_user(user_arg, hid->uniq, len) ?
	484	-EFAULT : len;
	485	break;
	486	}
b4dbde9d	487	}
9188e79e	488
dfd395af	489	ret = -ENOTTY;
86166b7b	490	}
d20d5ffa	491	out:
8590222e	492	up_read(&minors_rwsem);
979c407e	493	return ret;
86166b7b JK	494	}
	495
	496	static const struct file_operations hidraw_ops = {
	497	.owner = THIS_MODULE,
	498	.read = hidraw_read,
	499	.write = hidraw_write,
	500	.poll = hidraw_poll,
	501	.open = hidraw_open,
	502	.release = hidraw_release,
979c407e	503	.unlocked_ioctl = hidraw_ioctl,
b5531318	504	.fasync = hidraw_fasync,
1832f2d8	505	.compat_ioctl = compat_ptr_ioctl,
6038f373	506	.llseek = noop_llseek,
86166b7b JK	507	};
86166b7b JK	508
b6787242	509	int hidraw_report_event(struct hid_device hid, u8 data, int len)
86166b7b JK	510	{
	511	struct hidraw *dev = hid->hidraw;
	512	struct hidraw_list *list;
b6787242	513	int ret = 0;
277fe44d	514	unsigned long flags;
86166b7b	515
277fe44d	516	spin_lock_irqsave(&dev->list_lock, flags);
86166b7b	517	list_for_each_entry(list, &dev->list, node) {
4c7b417e MC	518	int new_head = (list->head + 1) & (HIDRAW_BUFFER_SIZE - 1);
	519
	520	if (new_head == list->tail)
	521	continue;
	522
b6787242 JK	523	if (!(list->buffer[list->head].value = kmemdup(data, len, GFP_ATOMIC))) {
	524	ret = -ENOMEM;
	525	break;
	526	}
86166b7b	527	list->buffer[list->head].len = len;
4c7b417e	528	list->head = new_head;
86166b7b JK	529	kill_fasync(&list->fasync, SIGIO, POLL_IN);
86166b7b JK	530	}
277fe44d	531	spin_unlock_irqrestore(&dev->list_lock, flags);
86166b7b JK	532
86166b7b JK	533	wake_up_interruptible(&dev->wait);
b6787242	534	return ret;
86166b7b JK	535	}
	536	EXPORT_SYMBOL_GPL(hidraw_report_event);
	537
	538	int hidraw_connect(struct hid_device *hid)
	539	{
709d27c0	540	int minor, result;
86166b7b JK	541	struct hidraw *dev;
86166b7b JK	542
61834535	543	/* we accept any HID device, all applications */
86166b7b	544
709d27c0 MK	545	dev = kzalloc(sizeof(struct hidraw), GFP_KERNEL);
	546	if (!dev)
	547	return -ENOMEM;
	548
	549	result = -EINVAL;
86166b7b	550
8590222e	551	down_write(&minors_rwsem);
86166b7b JK	552
	553	for (minor = 0; minor < HIDRAW_MAX_DEVICES; minor++) {
	554	if (hidraw_table[minor])
	555	continue;
	556	hidraw_table[minor] = dev;
	557	result = 0;
	558	break;
	559	}
	560
709d27c0	561	if (result) {
8590222e	562	up_write(&minors_rwsem);
709d27c0	563	kfree(dev);
86166b7b	564	goto out;
709d27c0	565	}
86166b7b	566
aae6c286	567	dev->dev = device_create(hidraw_class, &hid->dev, MKDEV(hidraw_major, minor),
a9b12619	568	NULL, "%s%d", "hidraw", minor);
86166b7b JK	569
86166b7b JK	570	if (IS_ERR(dev->dev)) {
86166b7b	571	hidraw_table[minor] = NULL;
8590222e	572	up_write(&minors_rwsem);
86166b7b	573	result = PTR_ERR(dev->dev);
709d27c0	574	kfree(dev);
86166b7b JK	575	goto out;
	576	}
	577
	578	init_waitqueue_head(&dev->wait);
277fe44d	579	spin_lock_init(&dev->list_lock);
86166b7b JK	580	INIT_LIST_HEAD(&dev->list);
	581
	582	dev->hid = hid;
	583	dev->minor = minor;
	584
	585	dev->exist = 1;
	586	hid->hidraw = dev;
	587
8590222e	588	up_write(&minors_rwsem);
86166b7b JK	589	out:
	590	return result;
	591
	592	}
	593	EXPORT_SYMBOL_GPL(hidraw_connect);
	594
	595	void hidraw_disconnect(struct hid_device *hid)
	596	{
	597	struct hidraw *hidraw = hid->hidraw;
df0cfd69	598
8590222e	599	down_write(&minors_rwsem);
df0cfd69	600
212a871a	601	drop_ref(hidraw, 1);
df0cfd69	602
8590222e	603	up_write(&minors_rwsem);
86166b7b JK	604	}
	605	EXPORT_SYMBOL_GPL(hidraw_disconnect);
	606
	607	int __init hidraw_init(void)
	608	{
	609	int result;
	610	dev_t dev_id;
	611
	612	result = alloc_chrdev_region(&dev_id, HIDRAW_FIRST_MINOR,
	613	HIDRAW_MAX_DEVICES, "hidraw");
86166b7b	614	if (result < 0) {
4291ee30	615	pr_warn("can't get major number\n");
86166b7b JK	616	goto out;
	617	}
	618
6edac6fd DC	619	hidraw_major = MAJOR(dev_id);
6edac6fd DC	620
1aaba11d	621	hidraw_class = class_create("hidraw");
86166b7b JK	622	if (IS_ERR(hidraw_class)) {
86166b7b JK	623	result = PTR_ERR(hidraw_class);
bcb4a75b	624	goto error_cdev;
86166b7b JK	625	}
	626
	627	cdev_init(&hidraw_cdev, &hidraw_ops);
bcb4a75b AK	628	result = cdev_add(&hidraw_cdev, dev_id, HIDRAW_MAX_DEVICES);
	629	if (result < 0)
	630	goto error_class;
	631
b05cec61	632	pr_info("raw HID events driver (C) Jiri Kosina\n");
86166b7b JK	633	out:
86166b7b JK	634	return result;
bcb4a75b AK	635
	636	error_class:
	637	class_destroy(hidraw_class);
	638	error_cdev:
	639	unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
	640	goto out;
86166b7b JK	641	}
86166b7b JK	642
140ae3eb	643	void hidraw_exit(void)
86166b7b JK	644	{
	645	dev_t dev_id = MKDEV(hidraw_major, 0);
	646
	647	cdev_del(&hidraw_cdev);
	648	class_destroy(hidraw_class);
	649	unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
	650
	651	}