xref: /openbmc/linux/drivers/hid/hidraw.c (revision 54a55b63)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * HID raw devices, giving access to raw HID events.
4  *
5  * In comparison to hiddev, this device does not process the
6  * hid events at all (no parsing, no lookups). This lets applications
7  * to work on raw hid events as they want to, and avoids a need to
8  * use a transport-specific userspace libhid/libusb libraries.
9  *
10  *  Copyright (c) 2007-2014 Jiri Kosina
11  */
12 
13 
14 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
15 
16 #include <linux/fs.h>
17 #include <linux/module.h>
18 #include <linux/errno.h>
19 #include <linux/kernel.h>
20 #include <linux/init.h>
21 #include <linux/cdev.h>
22 #include <linux/poll.h>
23 #include <linux/device.h>
24 #include <linux/major.h>
25 #include <linux/slab.h>
26 #include <linux/hid.h>
27 #include <linux/mutex.h>
28 #include <linux/sched/signal.h>
29 #include <linux/string.h>
30 
31 #include <linux/hidraw.h>
32 
33 static int hidraw_major;
34 static struct cdev hidraw_cdev;
35 static const struct class hidraw_class = {
36 	.name = "hidraw",
37 };
38 static struct hidraw *hidraw_table[HIDRAW_MAX_DEVICES];
39 static DECLARE_RWSEM(minors_rwsem);
40 
hidraw_read(struct file * file,char __user * buffer,size_t count,loff_t * ppos)41 static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
42 {
43 	struct hidraw_list *list = file->private_data;
44 	int ret = 0, len;
45 	DECLARE_WAITQUEUE(wait, current);
46 
47 	mutex_lock(&list->read_mutex);
48 
49 	while (ret == 0) {
50 		if (list->head == list->tail) {
51 			add_wait_queue(&list->hidraw->wait, &wait);
52 			set_current_state(TASK_INTERRUPTIBLE);
53 
54 			while (list->head == list->tail) {
55 				if (signal_pending(current)) {
56 					ret = -ERESTARTSYS;
57 					break;
58 				}
59 				if (!list->hidraw->exist) {
60 					ret = -EIO;
61 					break;
62 				}
63 				if (file->f_flags & O_NONBLOCK) {
64 					ret = -EAGAIN;
65 					break;
66 				}
67 
68 				/* allow O_NONBLOCK to work well from other threads */
69 				mutex_unlock(&list->read_mutex);
70 				schedule();
71 				mutex_lock(&list->read_mutex);
72 				set_current_state(TASK_INTERRUPTIBLE);
73 			}
74 
75 			set_current_state(TASK_RUNNING);
76 			remove_wait_queue(&list->hidraw->wait, &wait);
77 		}
78 
79 		if (ret)
80 			goto out;
81 
82 		len = list->buffer[list->tail].len > count ?
83 			count : list->buffer[list->tail].len;
84 
85 		if (list->buffer[list->tail].value) {
86 			if (copy_to_user(buffer, list->buffer[list->tail].value, len)) {
87 				ret = -EFAULT;
88 				goto out;
89 			}
90 			ret = len;
91 		}
92 
93 		kfree(list->buffer[list->tail].value);
94 		list->buffer[list->tail].value = NULL;
95 		list->tail = (list->tail + 1) & (HIDRAW_BUFFER_SIZE - 1);
96 	}
97 out:
98 	mutex_unlock(&list->read_mutex);
99 	return ret;
100 }
101 
102 /*
103  * The first byte of the report buffer is expected to be a report number.
104  */
hidraw_send_report(struct file * file,const char __user * buffer,size_t count,unsigned char report_type)105 static ssize_t hidraw_send_report(struct file *file, const char __user *buffer, size_t count, unsigned char report_type)
106 {
107 	unsigned int minor = iminor(file_inode(file));
108 	struct hid_device *dev;
109 	__u8 *buf;
110 	int ret = 0;
111 
112 	lockdep_assert_held(&minors_rwsem);
113 
114 	if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
115 		ret = -ENODEV;
116 		goto out;
117 	}
118 
119 	dev = hidraw_table[minor]->hid;
120 
121 	if (count > HID_MAX_BUFFER_SIZE) {
122 		hid_warn(dev, "pid %d passed too large report\n",
123 			 task_pid_nr(current));
124 		ret = -EINVAL;
125 		goto out;
126 	}
127 
128 	if (count < 2) {
129 		hid_warn(dev, "pid %d passed too short report\n",
130 			 task_pid_nr(current));
131 		ret = -EINVAL;
132 		goto out;
133 	}
134 
135 	buf = memdup_user(buffer, count);
136 	if (IS_ERR(buf)) {
137 		ret = PTR_ERR(buf);
138 		goto out;
139 	}
140 
141 	if ((report_type == HID_OUTPUT_REPORT) &&
142 	    !(dev->quirks & HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP)) {
143 		ret = hid_hw_output_report(dev, buf, count);
144 		/*
145 		 * compatibility with old implementation of USB-HID and I2C-HID:
146 		 * if the device does not support receiving output reports,
147 		 * on an interrupt endpoint, fallback to SET_REPORT HID command.
148 		 */
149 		if (ret != -ENOSYS)
150 			goto out_free;
151 	}
152 
153 	ret = hid_hw_raw_request(dev, buf[0], buf, count, report_type,
154 				HID_REQ_SET_REPORT);
155 
156 out_free:
157 	kfree(buf);
158 out:
159 	return ret;
160 }
161 
hidraw_write(struct file * file,const char __user * buffer,size_t count,loff_t * ppos)162 static ssize_t hidraw_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
163 {
164 	ssize_t ret;
165 	down_read(&minors_rwsem);
166 	ret = hidraw_send_report(file, buffer, count, HID_OUTPUT_REPORT);
167 	up_read(&minors_rwsem);
168 	return ret;
169 }
170 
171 
172 /*
173  * This function performs a Get_Report transfer over the control endpoint
174  * per section 7.2.1 of the HID specification, version 1.1.  The first byte
175  * of buffer is the report number to request, or 0x0 if the device does not
176  * use numbered reports. The report_type parameter can be HID_FEATURE_REPORT
177  * or HID_INPUT_REPORT.
178  */
hidraw_get_report(struct file * file,char __user * buffer,size_t count,unsigned char report_type)179 static ssize_t hidraw_get_report(struct file *file, char __user *buffer, size_t count, unsigned char report_type)
180 {
181 	unsigned int minor = iminor(file_inode(file));
182 	struct hid_device *dev;
183 	__u8 *buf;
184 	int ret = 0, len;
185 	unsigned char report_number;
186 
187 	lockdep_assert_held(&minors_rwsem);
188 
189 	if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
190 		ret = -ENODEV;
191 		goto out;
192 	}
193 
194 	dev = hidraw_table[minor]->hid;
195 
196 	if (!dev->ll_driver->raw_request) {
197 		ret = -ENODEV;
198 		goto out;
199 	}
200 
201 	if (count > HID_MAX_BUFFER_SIZE) {
202 		hid_warn(dev, "pid %d passed too large report\n",
203 			task_pid_nr(current));
204 		ret = -EINVAL;
205 		goto out;
206 	}
207 
208 	if (count < 2) {
209 		hid_warn(dev, "pid %d passed too short report\n",
210 			task_pid_nr(current));
211 		ret = -EINVAL;
212 		goto out;
213 	}
214 
215 	buf = kmalloc(count, GFP_KERNEL);
216 	if (!buf) {
217 		ret = -ENOMEM;
218 		goto out;
219 	}
220 
221 	/*
222 	 * Read the first byte from the user. This is the report number,
223 	 * which is passed to hid_hw_raw_request().
224 	 */
225 	if (copy_from_user(&report_number, buffer, 1)) {
226 		ret = -EFAULT;
227 		goto out_free;
228 	}
229 
230 	ret = hid_hw_raw_request(dev, report_number, buf, count, report_type,
231 				 HID_REQ_GET_REPORT);
232 
233 	if (ret < 0)
234 		goto out_free;
235 
236 	len = (ret < count) ? ret : count;
237 
238 	if (copy_to_user(buffer, buf, len)) {
239 		ret = -EFAULT;
240 		goto out_free;
241 	}
242 
243 	ret = len;
244 
245 out_free:
246 	kfree(buf);
247 out:
248 	return ret;
249 }
250 
hidraw_poll(struct file * file,poll_table * wait)251 static __poll_t hidraw_poll(struct file *file, poll_table *wait)
252 {
253 	struct hidraw_list *list = file->private_data;
254 	__poll_t mask = EPOLLOUT | EPOLLWRNORM; /* hidraw is always writable */
255 
256 	poll_wait(file, &list->hidraw->wait, wait);
257 	if (list->head != list->tail)
258 		mask |= EPOLLIN | EPOLLRDNORM;
259 	if (!list->hidraw->exist)
260 		mask |= EPOLLERR | EPOLLHUP;
261 	return mask;
262 }
263 
hidraw_open(struct inode * inode,struct file * file)264 static int hidraw_open(struct inode *inode, struct file *file)
265 {
266 	unsigned int minor = iminor(inode);
267 	struct hidraw *dev;
268 	struct hidraw_list *list;
269 	unsigned long flags;
270 	int err = 0;
271 
272 	if (!(list = kzalloc(sizeof(struct hidraw_list), GFP_KERNEL))) {
273 		err = -ENOMEM;
274 		goto out;
275 	}
276 
277 	/*
278 	 * Technically not writing to the hidraw_table but a write lock is
279 	 * required to protect the device refcount. This is symmetrical to
280 	 * hidraw_release().
281 	 */
282 	down_write(&minors_rwsem);
283 	if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
284 		err = -ENODEV;
285 		goto out_unlock;
286 	}
287 
288 	dev = hidraw_table[minor];
289 	if (!dev->open++) {
290 		err = hid_hw_power(dev->hid, PM_HINT_FULLON);
291 		if (err < 0) {
292 			dev->open--;
293 			goto out_unlock;
294 		}
295 
296 		err = hid_hw_open(dev->hid);
297 		if (err < 0) {
298 			hid_hw_power(dev->hid, PM_HINT_NORMAL);
299 			dev->open--;
300 			goto out_unlock;
301 		}
302 	}
303 
304 	list->hidraw = hidraw_table[minor];
305 	mutex_init(&list->read_mutex);
306 	spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
307 	list_add_tail(&list->node, &hidraw_table[minor]->list);
308 	spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
309 	file->private_data = list;
310 out_unlock:
311 	up_write(&minors_rwsem);
312 out:
313 	if (err < 0)
314 		kfree(list);
315 	return err;
316 
317 }
318 
hidraw_fasync(int fd,struct file * file,int on)319 static int hidraw_fasync(int fd, struct file *file, int on)
320 {
321 	struct hidraw_list *list = file->private_data;
322 
323 	return fasync_helper(fd, file, on, &list->fasync);
324 }
325 
drop_ref(struct hidraw * hidraw,int exists_bit)326 static void drop_ref(struct hidraw *hidraw, int exists_bit)
327 {
328 	if (exists_bit) {
329 		hidraw->exist = 0;
330 		if (hidraw->open) {
331 			hid_hw_close(hidraw->hid);
332 			wake_up_interruptible(&hidraw->wait);
333 		}
334 		device_destroy(&hidraw_class,
335 			       MKDEV(hidraw_major, hidraw->minor));
336 	} else {
337 		--hidraw->open;
338 	}
339 	if (!hidraw->open) {
340 		if (!hidraw->exist) {
341 			hidraw_table[hidraw->minor] = NULL;
342 			kfree(hidraw);
343 		} else {
344 			/* close device for last reader */
345 			hid_hw_close(hidraw->hid);
346 			hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
347 		}
348 	}
349 }
350 
hidraw_release(struct inode * inode,struct file * file)351 static int hidraw_release(struct inode * inode, struct file * file)
352 {
353 	unsigned int minor = iminor(inode);
354 	struct hidraw_list *list = file->private_data;
355 	unsigned long flags;
356 
357 	down_write(&minors_rwsem);
358 
359 	spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
360 	while (list->tail != list->head) {
361 		kfree(list->buffer[list->tail].value);
362 		list->buffer[list->tail].value = NULL;
363 		list->tail = (list->tail + 1) & (HIDRAW_BUFFER_SIZE - 1);
364 	}
365 	list_del(&list->node);
366 	spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
367 	kfree(list);
368 
369 	drop_ref(hidraw_table[minor], 0);
370 
371 	up_write(&minors_rwsem);
372 	return 0;
373 }
374 
hidraw_ioctl(struct file * file,unsigned int cmd,unsigned long arg)375 static long hidraw_ioctl(struct file *file, unsigned int cmd,
376 							unsigned long arg)
377 {
378 	struct inode *inode = file_inode(file);
379 	unsigned int minor = iminor(inode);
380 	long ret = 0;
381 	struct hidraw *dev;
382 	void __user *user_arg = (void __user*) arg;
383 
384 	down_read(&minors_rwsem);
385 	dev = hidraw_table[minor];
386 	if (!dev || !dev->exist) {
387 		ret = -ENODEV;
388 		goto out;
389 	}
390 
391 	switch (cmd) {
392 		case HIDIOCGRDESCSIZE:
393 			if (put_user(dev->hid->rsize, (int __user *)arg))
394 				ret = -EFAULT;
395 			break;
396 
397 		case HIDIOCGRDESC:
398 			{
399 				__u32 len;
400 
401 				if (get_user(len, (int __user *)arg))
402 					ret = -EFAULT;
403 				else if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
404 					ret = -EINVAL;
405 				else if (copy_to_user(user_arg + offsetof(
406 					struct hidraw_report_descriptor,
407 					value[0]),
408 					dev->hid->rdesc,
409 					min(dev->hid->rsize, len)))
410 					ret = -EFAULT;
411 				break;
412 			}
413 		case HIDIOCGRAWINFO:
414 			{
415 				struct hidraw_devinfo dinfo;
416 
417 				dinfo.bustype = dev->hid->bus;
418 				dinfo.vendor = dev->hid->vendor;
419 				dinfo.product = dev->hid->product;
420 				if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))
421 					ret = -EFAULT;
422 				break;
423 			}
424 		default:
425 			{
426 				struct hid_device *hid = dev->hid;
427 				if (_IOC_TYPE(cmd) != 'H') {
428 					ret = -EINVAL;
429 					break;
430 				}
431 
432 				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSFEATURE(0))) {
433 					int len = _IOC_SIZE(cmd);
434 					ret = hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
435 					break;
436 				}
437 				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGFEATURE(0))) {
438 					int len = _IOC_SIZE(cmd);
439 					ret = hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
440 					break;
441 				}
442 
443 				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSINPUT(0))) {
444 					int len = _IOC_SIZE(cmd);
445 					ret = hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
446 					break;
447 				}
448 				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGINPUT(0))) {
449 					int len = _IOC_SIZE(cmd);
450 					ret = hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
451 					break;
452 				}
453 
454 				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSOUTPUT(0))) {
455 					int len = _IOC_SIZE(cmd);
456 					ret = hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
457 					break;
458 				}
459 				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGOUTPUT(0))) {
460 					int len = _IOC_SIZE(cmd);
461 					ret = hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
462 					break;
463 				}
464 
465 				/* Begin Read-only ioctls. */
466 				if (_IOC_DIR(cmd) != _IOC_READ) {
467 					ret = -EINVAL;
468 					break;
469 				}
470 
471 				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) {
472 					int len = strlen(hid->name) + 1;
473 					if (len > _IOC_SIZE(cmd))
474 						len = _IOC_SIZE(cmd);
475 					ret = copy_to_user(user_arg, hid->name, len) ?
476 						-EFAULT : len;
477 					break;
478 				}
479 
480 				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) {
481 					int len = strlen(hid->phys) + 1;
482 					if (len > _IOC_SIZE(cmd))
483 						len = _IOC_SIZE(cmd);
484 					ret = copy_to_user(user_arg, hid->phys, len) ?
485 						-EFAULT : len;
486 					break;
487 				}
488 
489 				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWUNIQ(0))) {
490 					int len = strlen(hid->uniq) + 1;
491 					if (len > _IOC_SIZE(cmd))
492 						len = _IOC_SIZE(cmd);
493 					ret = copy_to_user(user_arg, hid->uniq, len) ?
494 						-EFAULT : len;
495 					break;
496 				}
497 			}
498 
499 		ret = -ENOTTY;
500 	}
501 out:
502 	up_read(&minors_rwsem);
503 	return ret;
504 }
505 
506 static const struct file_operations hidraw_ops = {
507 	.owner =        THIS_MODULE,
508 	.read =         hidraw_read,
509 	.write =        hidraw_write,
510 	.poll =         hidraw_poll,
511 	.open =         hidraw_open,
512 	.release =      hidraw_release,
513 	.unlocked_ioctl = hidraw_ioctl,
514 	.fasync =	hidraw_fasync,
515 	.compat_ioctl   = compat_ptr_ioctl,
516 	.llseek =	noop_llseek,
517 };
518 
hidraw_report_event(struct hid_device * hid,u8 * data,int len)519 int hidraw_report_event(struct hid_device *hid, u8 *data, int len)
520 {
521 	struct hidraw *dev = hid->hidraw;
522 	struct hidraw_list *list;
523 	int ret = 0;
524 	unsigned long flags;
525 
526 	spin_lock_irqsave(&dev->list_lock, flags);
527 	list_for_each_entry(list, &dev->list, node) {
528 		int new_head = (list->head + 1) & (HIDRAW_BUFFER_SIZE - 1);
529 
530 		if (new_head == list->tail)
531 			continue;
532 
533 		if (!(list->buffer[list->head].value = kmemdup(data, len, GFP_ATOMIC))) {
534 			ret = -ENOMEM;
535 			break;
536 		}
537 		list->buffer[list->head].len = len;
538 		list->head = new_head;
539 		kill_fasync(&list->fasync, SIGIO, POLL_IN);
540 	}
541 	spin_unlock_irqrestore(&dev->list_lock, flags);
542 
543 	wake_up_interruptible(&dev->wait);
544 	return ret;
545 }
546 EXPORT_SYMBOL_GPL(hidraw_report_event);
547 
hidraw_connect(struct hid_device * hid)548 int hidraw_connect(struct hid_device *hid)
549 {
550 	int minor, result;
551 	struct hidraw *dev;
552 
553 	/* we accept any HID device, all applications */
554 
555 	dev = kzalloc(sizeof(struct hidraw), GFP_KERNEL);
556 	if (!dev)
557 		return -ENOMEM;
558 
559 	result = -EINVAL;
560 
561 	down_write(&minors_rwsem);
562 
563 	for (minor = 0; minor < HIDRAW_MAX_DEVICES; minor++) {
564 		if (hidraw_table[minor])
565 			continue;
566 		hidraw_table[minor] = dev;
567 		result = 0;
568 		break;
569 	}
570 
571 	if (result) {
572 		up_write(&minors_rwsem);
573 		kfree(dev);
574 		goto out;
575 	}
576 
577 	dev->dev = device_create(&hidraw_class, &hid->dev, MKDEV(hidraw_major, minor),
578 				 NULL, "%s%d", "hidraw", minor);
579 
580 	if (IS_ERR(dev->dev)) {
581 		hidraw_table[minor] = NULL;
582 		up_write(&minors_rwsem);
583 		result = PTR_ERR(dev->dev);
584 		kfree(dev);
585 		goto out;
586 	}
587 
588 	init_waitqueue_head(&dev->wait);
589 	spin_lock_init(&dev->list_lock);
590 	INIT_LIST_HEAD(&dev->list);
591 
592 	dev->hid = hid;
593 	dev->minor = minor;
594 
595 	dev->exist = 1;
596 	hid->hidraw = dev;
597 
598 	up_write(&minors_rwsem);
599 out:
600 	return result;
601 
602 }
603 EXPORT_SYMBOL_GPL(hidraw_connect);
604 
hidraw_disconnect(struct hid_device * hid)605 void hidraw_disconnect(struct hid_device *hid)
606 {
607 	struct hidraw *hidraw = hid->hidraw;
608 
609 	down_write(&minors_rwsem);
610 
611 	drop_ref(hidraw, 1);
612 
613 	up_write(&minors_rwsem);
614 }
615 EXPORT_SYMBOL_GPL(hidraw_disconnect);
616 
hidraw_init(void)617 int __init hidraw_init(void)
618 {
619 	int result;
620 	dev_t dev_id;
621 
622 	result = alloc_chrdev_region(&dev_id, HIDRAW_FIRST_MINOR,
623 			HIDRAW_MAX_DEVICES, "hidraw");
624 	if (result < 0) {
625 		pr_warn("can't get major number\n");
626 		goto out;
627 	}
628 
629 	hidraw_major = MAJOR(dev_id);
630 
631 	result = class_register(&hidraw_class);
632 	if (result)
633 		goto error_cdev;
634 
635         cdev_init(&hidraw_cdev, &hidraw_ops);
636 	result = cdev_add(&hidraw_cdev, dev_id, HIDRAW_MAX_DEVICES);
637 	if (result < 0)
638 		goto error_class;
639 
640 	pr_info("raw HID events driver (C) Jiri Kosina\n");
641 out:
642 	return result;
643 
644 error_class:
645 	class_unregister(&hidraw_class);
646 error_cdev:
647 	unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
648 	goto out;
649 }
650 
hidraw_exit(void)651 void hidraw_exit(void)
652 {
653 	dev_t dev_id = MKDEV(hidraw_major, 0);
654 
655 	cdev_del(&hidraw_cdev);
656 	class_unregister(&hidraw_class);
657 	unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
658 
659 }
660