xref: /openbmc/linux/drivers/hid/usbhid/hiddev.c (revision e5c86679)
1 /*
2  *  Copyright (c) 2001 Paul Stewart
3  *  Copyright (c) 2001 Vojtech Pavlik
4  *
5  *  HID char devices, giving access to raw HID device events.
6  *
7  */
8 
9 /*
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License as published by
12  * the Free Software Foundation; either version 2 of the License, or
13  * (at your option) any later version.
14  *
15  * This program is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18  * GNU General Public License for more details.
19  *
20  * You should have received a copy of the GNU General Public License
21  * along with this program; if not, write to the Free Software
22  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
23  *
24  * Should you need to contact me, the author, you can do so either by
25  * e-mail - mail your message to Paul Stewart <stewart@wetlogic.net>
26  */
27 
28 #include <linux/poll.h>
29 #include <linux/slab.h>
30 #include <linux/sched/signal.h>
31 #include <linux/module.h>
32 #include <linux/init.h>
33 #include <linux/input.h>
34 #include <linux/usb.h>
35 #include <linux/hid.h>
36 #include <linux/hiddev.h>
37 #include <linux/compat.h>
38 #include <linux/vmalloc.h>
39 #include "usbhid.h"
40 
41 #ifdef CONFIG_USB_DYNAMIC_MINORS
42 #define HIDDEV_MINOR_BASE	0
43 #define HIDDEV_MINORS		256
44 #else
45 #define HIDDEV_MINOR_BASE	96
46 #define HIDDEV_MINORS		16
47 #endif
48 #define HIDDEV_BUFFER_SIZE	2048
49 
50 struct hiddev {
51 	int exist;
52 	int open;
53 	struct mutex existancelock;
54 	wait_queue_head_t wait;
55 	struct hid_device *hid;
56 	struct list_head list;
57 	spinlock_t list_lock;
58 };
59 
60 struct hiddev_list {
61 	struct hiddev_usage_ref buffer[HIDDEV_BUFFER_SIZE];
62 	int head;
63 	int tail;
64 	unsigned flags;
65 	struct fasync_struct *fasync;
66 	struct hiddev *hiddev;
67 	struct list_head node;
68 	struct mutex thread_lock;
69 };
70 
71 /*
72  * Find a report, given the report's type and ID.  The ID can be specified
73  * indirectly by REPORT_ID_FIRST (which returns the first report of the given
74  * type) or by (REPORT_ID_NEXT | old_id), which returns the next report of the
75  * given type which follows old_id.
76  */
77 static struct hid_report *
78 hiddev_lookup_report(struct hid_device *hid, struct hiddev_report_info *rinfo)
79 {
80 	unsigned int flags = rinfo->report_id & ~HID_REPORT_ID_MASK;
81 	unsigned int rid = rinfo->report_id & HID_REPORT_ID_MASK;
82 	struct hid_report_enum *report_enum;
83 	struct hid_report *report;
84 	struct list_head *list;
85 
86 	if (rinfo->report_type < HID_REPORT_TYPE_MIN ||
87 	    rinfo->report_type > HID_REPORT_TYPE_MAX)
88 		return NULL;
89 
90 	report_enum = hid->report_enum +
91 		(rinfo->report_type - HID_REPORT_TYPE_MIN);
92 
93 	switch (flags) {
94 	case 0: /* Nothing to do -- report_id is already set correctly */
95 		break;
96 
97 	case HID_REPORT_ID_FIRST:
98 		if (list_empty(&report_enum->report_list))
99 			return NULL;
100 
101 		list = report_enum->report_list.next;
102 		report = list_entry(list, struct hid_report, list);
103 		rinfo->report_id = report->id;
104 		break;
105 
106 	case HID_REPORT_ID_NEXT:
107 		report = report_enum->report_id_hash[rid];
108 		if (!report)
109 			return NULL;
110 
111 		list = report->list.next;
112 		if (list == &report_enum->report_list)
113 			return NULL;
114 
115 		report = list_entry(list, struct hid_report, list);
116 		rinfo->report_id = report->id;
117 		break;
118 
119 	default:
120 		return NULL;
121 	}
122 
123 	return report_enum->report_id_hash[rinfo->report_id];
124 }
125 
126 /*
127  * Perform an exhaustive search of the report table for a usage, given its
128  * type and usage id.
129  */
130 static struct hid_field *
131 hiddev_lookup_usage(struct hid_device *hid, struct hiddev_usage_ref *uref)
132 {
133 	int i, j;
134 	struct hid_report *report;
135 	struct hid_report_enum *report_enum;
136 	struct hid_field *field;
137 
138 	if (uref->report_type < HID_REPORT_TYPE_MIN ||
139 	    uref->report_type > HID_REPORT_TYPE_MAX)
140 		return NULL;
141 
142 	report_enum = hid->report_enum +
143 		(uref->report_type - HID_REPORT_TYPE_MIN);
144 
145 	list_for_each_entry(report, &report_enum->report_list, list) {
146 		for (i = 0; i < report->maxfield; i++) {
147 			field = report->field[i];
148 			for (j = 0; j < field->maxusage; j++) {
149 				if (field->usage[j].hid == uref->usage_code) {
150 					uref->report_id = report->id;
151 					uref->field_index = i;
152 					uref->usage_index = j;
153 					return field;
154 				}
155 			}
156 		}
157 	}
158 
159 	return NULL;
160 }
161 
162 static void hiddev_send_event(struct hid_device *hid,
163 			      struct hiddev_usage_ref *uref)
164 {
165 	struct hiddev *hiddev = hid->hiddev;
166 	struct hiddev_list *list;
167 	unsigned long flags;
168 
169 	spin_lock_irqsave(&hiddev->list_lock, flags);
170 	list_for_each_entry(list, &hiddev->list, node) {
171 		if (uref->field_index != HID_FIELD_INDEX_NONE ||
172 		    (list->flags & HIDDEV_FLAG_REPORT) != 0) {
173 			list->buffer[list->head] = *uref;
174 			list->head = (list->head + 1) &
175 				(HIDDEV_BUFFER_SIZE - 1);
176 			kill_fasync(&list->fasync, SIGIO, POLL_IN);
177 		}
178 	}
179 	spin_unlock_irqrestore(&hiddev->list_lock, flags);
180 
181 	wake_up_interruptible(&hiddev->wait);
182 }
183 
184 /*
185  * This is where hid.c calls into hiddev to pass an event that occurred over
186  * the interrupt pipe
187  */
188 void hiddev_hid_event(struct hid_device *hid, struct hid_field *field,
189 		      struct hid_usage *usage, __s32 value)
190 {
191 	unsigned type = field->report_type;
192 	struct hiddev_usage_ref uref;
193 
194 	uref.report_type =
195 	  (type == HID_INPUT_REPORT) ? HID_REPORT_TYPE_INPUT :
196 	  ((type == HID_OUTPUT_REPORT) ? HID_REPORT_TYPE_OUTPUT :
197 	   ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE : 0));
198 	uref.report_id = field->report->id;
199 	uref.field_index = field->index;
200 	uref.usage_index = (usage - field->usage);
201 	uref.usage_code = usage->hid;
202 	uref.value = value;
203 
204 	hiddev_send_event(hid, &uref);
205 }
206 EXPORT_SYMBOL_GPL(hiddev_hid_event);
207 
208 void hiddev_report_event(struct hid_device *hid, struct hid_report *report)
209 {
210 	unsigned type = report->type;
211 	struct hiddev_usage_ref uref;
212 
213 	memset(&uref, 0, sizeof(uref));
214 	uref.report_type =
215 	  (type == HID_INPUT_REPORT) ? HID_REPORT_TYPE_INPUT :
216 	  ((type == HID_OUTPUT_REPORT) ? HID_REPORT_TYPE_OUTPUT :
217 	   ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE : 0));
218 	uref.report_id = report->id;
219 	uref.field_index = HID_FIELD_INDEX_NONE;
220 
221 	hiddev_send_event(hid, &uref);
222 }
223 
224 /*
225  * fasync file op
226  */
227 static int hiddev_fasync(int fd, struct file *file, int on)
228 {
229 	struct hiddev_list *list = file->private_data;
230 
231 	return fasync_helper(fd, file, on, &list->fasync);
232 }
233 
234 
235 /*
236  * release file op
237  */
238 static int hiddev_release(struct inode * inode, struct file * file)
239 {
240 	struct hiddev_list *list = file->private_data;
241 	unsigned long flags;
242 
243 	spin_lock_irqsave(&list->hiddev->list_lock, flags);
244 	list_del(&list->node);
245 	spin_unlock_irqrestore(&list->hiddev->list_lock, flags);
246 
247 	mutex_lock(&list->hiddev->existancelock);
248 	if (!--list->hiddev->open) {
249 		if (list->hiddev->exist) {
250 			usbhid_close(list->hiddev->hid);
251 			usbhid_put_power(list->hiddev->hid);
252 		} else {
253 			mutex_unlock(&list->hiddev->existancelock);
254 			kfree(list->hiddev);
255 			vfree(list);
256 			return 0;
257 		}
258 	}
259 
260 	mutex_unlock(&list->hiddev->existancelock);
261 	vfree(list);
262 
263 	return 0;
264 }
265 
266 /*
267  * open file op
268  */
269 static int hiddev_open(struct inode *inode, struct file *file)
270 {
271 	struct hiddev_list *list;
272 	struct usb_interface *intf;
273 	struct hid_device *hid;
274 	struct hiddev *hiddev;
275 	int res;
276 
277 	intf = usbhid_find_interface(iminor(inode));
278 	if (!intf)
279 		return -ENODEV;
280 	hid = usb_get_intfdata(intf);
281 	hiddev = hid->hiddev;
282 
283 	if (!(list = vzalloc(sizeof(struct hiddev_list))))
284 		return -ENOMEM;
285 	mutex_init(&list->thread_lock);
286 	list->hiddev = hiddev;
287 	file->private_data = list;
288 
289 	/*
290 	 * no need for locking because the USB major number
291 	 * is shared which usbcore guards against disconnect
292 	 */
293 	if (list->hiddev->exist) {
294 		if (!list->hiddev->open++) {
295 			res = usbhid_open(hiddev->hid);
296 			if (res < 0) {
297 				res = -EIO;
298 				goto bail;
299 			}
300 		}
301 	} else {
302 		res = -ENODEV;
303 		goto bail;
304 	}
305 
306 	spin_lock_irq(&list->hiddev->list_lock);
307 	list_add_tail(&list->node, &hiddev->list);
308 	spin_unlock_irq(&list->hiddev->list_lock);
309 
310 	mutex_lock(&hiddev->existancelock);
311 	if (!list->hiddev->open++)
312 		if (list->hiddev->exist) {
313 			struct hid_device *hid = hiddev->hid;
314 			res = usbhid_get_power(hid);
315 			if (res < 0) {
316 				res = -EIO;
317 				goto bail_unlock;
318 			}
319 			usbhid_open(hid);
320 		}
321 	mutex_unlock(&hiddev->existancelock);
322 	return 0;
323 bail_unlock:
324 	mutex_unlock(&hiddev->existancelock);
325 bail:
326 	file->private_data = NULL;
327 	vfree(list);
328 	return res;
329 }
330 
331 /*
332  * "write" file op
333  */
334 static ssize_t hiddev_write(struct file * file, const char __user * buffer, size_t count, loff_t *ppos)
335 {
336 	return -EINVAL;
337 }
338 
339 /*
340  * "read" file op
341  */
342 static ssize_t hiddev_read(struct file * file, char __user * buffer, size_t count, loff_t *ppos)
343 {
344 	DEFINE_WAIT(wait);
345 	struct hiddev_list *list = file->private_data;
346 	int event_size;
347 	int retval;
348 
349 	event_size = ((list->flags & HIDDEV_FLAG_UREF) != 0) ?
350 		sizeof(struct hiddev_usage_ref) : sizeof(struct hiddev_event);
351 
352 	if (count < event_size)
353 		return 0;
354 
355 	/* lock against other threads */
356 	retval = mutex_lock_interruptible(&list->thread_lock);
357 	if (retval)
358 		return -ERESTARTSYS;
359 
360 	while (retval == 0) {
361 		if (list->head == list->tail) {
362 			prepare_to_wait(&list->hiddev->wait, &wait, TASK_INTERRUPTIBLE);
363 
364 			while (list->head == list->tail) {
365 				if (signal_pending(current)) {
366 					retval = -ERESTARTSYS;
367 					break;
368 				}
369 				if (!list->hiddev->exist) {
370 					retval = -EIO;
371 					break;
372 				}
373 				if (file->f_flags & O_NONBLOCK) {
374 					retval = -EAGAIN;
375 					break;
376 				}
377 
378 				/* let O_NONBLOCK tasks run */
379 				mutex_unlock(&list->thread_lock);
380 				schedule();
381 				if (mutex_lock_interruptible(&list->thread_lock)) {
382 					finish_wait(&list->hiddev->wait, &wait);
383 					return -EINTR;
384 				}
385 				set_current_state(TASK_INTERRUPTIBLE);
386 			}
387 			finish_wait(&list->hiddev->wait, &wait);
388 
389 		}
390 
391 		if (retval) {
392 			mutex_unlock(&list->thread_lock);
393 			return retval;
394 		}
395 
396 
397 		while (list->head != list->tail &&
398 		       retval + event_size <= count) {
399 			if ((list->flags & HIDDEV_FLAG_UREF) == 0) {
400 				if (list->buffer[list->tail].field_index != HID_FIELD_INDEX_NONE) {
401 					struct hiddev_event event;
402 
403 					event.hid = list->buffer[list->tail].usage_code;
404 					event.value = list->buffer[list->tail].value;
405 					if (copy_to_user(buffer + retval, &event, sizeof(struct hiddev_event))) {
406 						mutex_unlock(&list->thread_lock);
407 						return -EFAULT;
408 					}
409 					retval += sizeof(struct hiddev_event);
410 				}
411 			} else {
412 				if (list->buffer[list->tail].field_index != HID_FIELD_INDEX_NONE ||
413 				    (list->flags & HIDDEV_FLAG_REPORT) != 0) {
414 
415 					if (copy_to_user(buffer + retval, list->buffer + list->tail, sizeof(struct hiddev_usage_ref))) {
416 						mutex_unlock(&list->thread_lock);
417 						return -EFAULT;
418 					}
419 					retval += sizeof(struct hiddev_usage_ref);
420 				}
421 			}
422 			list->tail = (list->tail + 1) & (HIDDEV_BUFFER_SIZE - 1);
423 		}
424 
425 	}
426 	mutex_unlock(&list->thread_lock);
427 
428 	return retval;
429 }
430 
431 /*
432  * "poll" file op
433  * No kernel lock - fine
434  */
435 static unsigned int hiddev_poll(struct file *file, poll_table *wait)
436 {
437 	struct hiddev_list *list = file->private_data;
438 
439 	poll_wait(file, &list->hiddev->wait, wait);
440 	if (list->head != list->tail)
441 		return POLLIN | POLLRDNORM;
442 	if (!list->hiddev->exist)
443 		return POLLERR | POLLHUP;
444 	return 0;
445 }
446 
447 /*
448  * "ioctl" file op
449  */
450 static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, void __user *user_arg)
451 {
452 	struct hid_device *hid = hiddev->hid;
453 	struct hiddev_report_info rinfo;
454 	struct hiddev_usage_ref_multi *uref_multi = NULL;
455 	struct hiddev_usage_ref *uref;
456 	struct hid_report *report;
457 	struct hid_field *field;
458 	int i;
459 
460 	uref_multi = kmalloc(sizeof(struct hiddev_usage_ref_multi), GFP_KERNEL);
461 	if (!uref_multi)
462 		return -ENOMEM;
463 	uref = &uref_multi->uref;
464 	if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
465 		if (copy_from_user(uref_multi, user_arg,
466 				   sizeof(*uref_multi)))
467 			goto fault;
468 	} else {
469 		if (copy_from_user(uref, user_arg, sizeof(*uref)))
470 			goto fault;
471 	}
472 
473 	switch (cmd) {
474 	case HIDIOCGUCODE:
475 		rinfo.report_type = uref->report_type;
476 		rinfo.report_id = uref->report_id;
477 		if ((report = hiddev_lookup_report(hid, &rinfo)) == NULL)
478 			goto inval;
479 
480 		if (uref->field_index >= report->maxfield)
481 			goto inval;
482 
483 		field = report->field[uref->field_index];
484 		if (uref->usage_index >= field->maxusage)
485 			goto inval;
486 
487 		uref->usage_code = field->usage[uref->usage_index].hid;
488 
489 		if (copy_to_user(user_arg, uref, sizeof(*uref)))
490 			goto fault;
491 
492 		goto goodreturn;
493 
494 	default:
495 		if (cmd != HIDIOCGUSAGE &&
496 		    cmd != HIDIOCGUSAGES &&
497 		    uref->report_type == HID_REPORT_TYPE_INPUT)
498 			goto inval;
499 
500 		if (uref->report_id == HID_REPORT_ID_UNKNOWN) {
501 			field = hiddev_lookup_usage(hid, uref);
502 			if (field == NULL)
503 				goto inval;
504 		} else {
505 			rinfo.report_type = uref->report_type;
506 			rinfo.report_id = uref->report_id;
507 			if ((report = hiddev_lookup_report(hid, &rinfo)) == NULL)
508 				goto inval;
509 
510 			if (uref->field_index >= report->maxfield)
511 				goto inval;
512 
513 			field = report->field[uref->field_index];
514 
515 			if (cmd == HIDIOCGCOLLECTIONINDEX) {
516 				if (uref->usage_index >= field->maxusage)
517 					goto inval;
518 			} else if (uref->usage_index >= field->report_count)
519 				goto inval;
520 		}
521 
522 		if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
523 		    (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
524 		     uref->usage_index + uref_multi->num_values > field->report_count))
525 			goto inval;
526 
527 		switch (cmd) {
528 		case HIDIOCGUSAGE:
529 			uref->value = field->value[uref->usage_index];
530 			if (copy_to_user(user_arg, uref, sizeof(*uref)))
531 				goto fault;
532 			goto goodreturn;
533 
534 		case HIDIOCSUSAGE:
535 			field->value[uref->usage_index] = uref->value;
536 			goto goodreturn;
537 
538 		case HIDIOCGCOLLECTIONINDEX:
539 			i = field->usage[uref->usage_index].collection_index;
540 			kfree(uref_multi);
541 			return i;
542 		case HIDIOCGUSAGES:
543 			for (i = 0; i < uref_multi->num_values; i++)
544 				uref_multi->values[i] =
545 				    field->value[uref->usage_index + i];
546 			if (copy_to_user(user_arg, uref_multi,
547 					 sizeof(*uref_multi)))
548 				goto fault;
549 			goto goodreturn;
550 		case HIDIOCSUSAGES:
551 			for (i = 0; i < uref_multi->num_values; i++)
552 				field->value[uref->usage_index + i] =
553 				    uref_multi->values[i];
554 			goto goodreturn;
555 		}
556 
557 goodreturn:
558 		kfree(uref_multi);
559 		return 0;
560 fault:
561 		kfree(uref_multi);
562 		return -EFAULT;
563 inval:
564 		kfree(uref_multi);
565 		return -EINVAL;
566 	}
567 }
568 
569 static noinline int hiddev_ioctl_string(struct hiddev *hiddev, unsigned int cmd, void __user *user_arg)
570 {
571 	struct hid_device *hid = hiddev->hid;
572 	struct usb_device *dev = hid_to_usb_dev(hid);
573 	int idx, len;
574 	char *buf;
575 
576 	if (get_user(idx, (int __user *)user_arg))
577 		return -EFAULT;
578 
579 	if ((buf = kmalloc(HID_STRING_SIZE, GFP_KERNEL)) == NULL)
580 		return -ENOMEM;
581 
582 	if ((len = usb_string(dev, idx, buf, HID_STRING_SIZE-1)) < 0) {
583 		kfree(buf);
584 		return -EINVAL;
585 	}
586 
587 	if (copy_to_user(user_arg+sizeof(int), buf, len+1)) {
588 		kfree(buf);
589 		return -EFAULT;
590 	}
591 
592 	kfree(buf);
593 
594 	return len;
595 }
596 
597 static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
598 {
599 	struct hiddev_list *list = file->private_data;
600 	struct hiddev *hiddev = list->hiddev;
601 	struct hid_device *hid;
602 	struct hiddev_collection_info cinfo;
603 	struct hiddev_report_info rinfo;
604 	struct hiddev_field_info finfo;
605 	struct hiddev_devinfo dinfo;
606 	struct hid_report *report;
607 	struct hid_field *field;
608 	void __user *user_arg = (void __user *)arg;
609 	int i, r = -EINVAL;
610 
611 	/* Called without BKL by compat methods so no BKL taken */
612 
613 	mutex_lock(&hiddev->existancelock);
614 	if (!hiddev->exist) {
615 		r = -ENODEV;
616 		goto ret_unlock;
617 	}
618 
619 	hid = hiddev->hid;
620 
621 	switch (cmd) {
622 
623 	case HIDIOCGVERSION:
624 		r = put_user(HID_VERSION, (int __user *)arg) ?
625 			-EFAULT : 0;
626 		break;
627 
628 	case HIDIOCAPPLICATION:
629 		if (arg >= hid->maxapplication)
630 			break;
631 
632 		for (i = 0; i < hid->maxcollection; i++)
633 			if (hid->collection[i].type ==
634 			    HID_COLLECTION_APPLICATION && arg-- == 0)
635 				break;
636 
637 		if (i < hid->maxcollection)
638 			r = hid->collection[i].usage;
639 		break;
640 
641 	case HIDIOCGDEVINFO:
642 		{
643 			struct usb_device *dev = hid_to_usb_dev(hid);
644 			struct usbhid_device *usbhid = hid->driver_data;
645 
646 			memset(&dinfo, 0, sizeof(dinfo));
647 
648 			dinfo.bustype = BUS_USB;
649 			dinfo.busnum = dev->bus->busnum;
650 			dinfo.devnum = dev->devnum;
651 			dinfo.ifnum = usbhid->ifnum;
652 			dinfo.vendor = le16_to_cpu(dev->descriptor.idVendor);
653 			dinfo.product = le16_to_cpu(dev->descriptor.idProduct);
654 			dinfo.version = le16_to_cpu(dev->descriptor.bcdDevice);
655 			dinfo.num_applications = hid->maxapplication;
656 
657 			r = copy_to_user(user_arg, &dinfo, sizeof(dinfo)) ?
658 				-EFAULT : 0;
659 			break;
660 		}
661 
662 	case HIDIOCGFLAG:
663 		r = put_user(list->flags, (int __user *)arg) ?
664 			-EFAULT : 0;
665 		break;
666 
667 	case HIDIOCSFLAG:
668 		{
669 			int newflags;
670 
671 			if (get_user(newflags, (int __user *)arg)) {
672 				r = -EFAULT;
673 				break;
674 			}
675 
676 			if ((newflags & ~HIDDEV_FLAGS) != 0 ||
677 			    ((newflags & HIDDEV_FLAG_REPORT) != 0 &&
678 			     (newflags & HIDDEV_FLAG_UREF) == 0))
679 				break;
680 
681 			list->flags = newflags;
682 
683 			r = 0;
684 			break;
685 		}
686 
687 	case HIDIOCGSTRING:
688 		r = hiddev_ioctl_string(hiddev, cmd, user_arg);
689 		break;
690 
691 	case HIDIOCINITREPORT:
692 		usbhid_init_reports(hid);
693 		r = 0;
694 		break;
695 
696 	case HIDIOCGREPORT:
697 		if (copy_from_user(&rinfo, user_arg, sizeof(rinfo))) {
698 			r = -EFAULT;
699 			break;
700 		}
701 
702 		if (rinfo.report_type == HID_REPORT_TYPE_OUTPUT)
703 			break;
704 
705 		report = hiddev_lookup_report(hid, &rinfo);
706 		if (report == NULL)
707 			break;
708 
709 		hid_hw_request(hid, report, HID_REQ_GET_REPORT);
710 		hid_hw_wait(hid);
711 
712 		r = 0;
713 		break;
714 
715 	case HIDIOCSREPORT:
716 		if (copy_from_user(&rinfo, user_arg, sizeof(rinfo))) {
717 			r = -EFAULT;
718 			break;
719 		}
720 
721 		if (rinfo.report_type == HID_REPORT_TYPE_INPUT)
722 			break;
723 
724 		report = hiddev_lookup_report(hid, &rinfo);
725 		if (report == NULL)
726 			break;
727 
728 		hid_hw_request(hid, report, HID_REQ_SET_REPORT);
729 		hid_hw_wait(hid);
730 
731 		r = 0;
732 		break;
733 
734 	case HIDIOCGREPORTINFO:
735 		if (copy_from_user(&rinfo, user_arg, sizeof(rinfo))) {
736 			r = -EFAULT;
737 			break;
738 		}
739 
740 		report = hiddev_lookup_report(hid, &rinfo);
741 		if (report == NULL)
742 			break;
743 
744 		rinfo.num_fields = report->maxfield;
745 
746 		r = copy_to_user(user_arg, &rinfo, sizeof(rinfo)) ?
747 			-EFAULT : 0;
748 		break;
749 
750 	case HIDIOCGFIELDINFO:
751 		if (copy_from_user(&finfo, user_arg, sizeof(finfo))) {
752 			r = -EFAULT;
753 			break;
754 		}
755 
756 		rinfo.report_type = finfo.report_type;
757 		rinfo.report_id = finfo.report_id;
758 
759 		report = hiddev_lookup_report(hid, &rinfo);
760 		if (report == NULL)
761 			break;
762 
763 		if (finfo.field_index >= report->maxfield)
764 			break;
765 
766 		field = report->field[finfo.field_index];
767 		memset(&finfo, 0, sizeof(finfo));
768 		finfo.report_type = rinfo.report_type;
769 		finfo.report_id = rinfo.report_id;
770 		finfo.field_index = field->report_count - 1;
771 		finfo.maxusage = field->maxusage;
772 		finfo.flags = field->flags;
773 		finfo.physical = field->physical;
774 		finfo.logical = field->logical;
775 		finfo.application = field->application;
776 		finfo.logical_minimum = field->logical_minimum;
777 		finfo.logical_maximum = field->logical_maximum;
778 		finfo.physical_minimum = field->physical_minimum;
779 		finfo.physical_maximum = field->physical_maximum;
780 		finfo.unit_exponent = field->unit_exponent;
781 		finfo.unit = field->unit;
782 
783 		r = copy_to_user(user_arg, &finfo, sizeof(finfo)) ?
784 			-EFAULT : 0;
785 		break;
786 
787 	case HIDIOCGUCODE:
788 		/* fall through */
789 	case HIDIOCGUSAGE:
790 	case HIDIOCSUSAGE:
791 	case HIDIOCGUSAGES:
792 	case HIDIOCSUSAGES:
793 	case HIDIOCGCOLLECTIONINDEX:
794 		r = hiddev_ioctl_usage(hiddev, cmd, user_arg);
795 		break;
796 
797 	case HIDIOCGCOLLECTIONINFO:
798 		if (copy_from_user(&cinfo, user_arg, sizeof(cinfo))) {
799 			r = -EFAULT;
800 			break;
801 		}
802 
803 		if (cinfo.index >= hid->maxcollection)
804 			break;
805 
806 		cinfo.type = hid->collection[cinfo.index].type;
807 		cinfo.usage = hid->collection[cinfo.index].usage;
808 		cinfo.level = hid->collection[cinfo.index].level;
809 
810 		r = copy_to_user(user_arg, &cinfo, sizeof(cinfo)) ?
811 			-EFAULT : 0;
812 		break;
813 
814 	default:
815 		if (_IOC_TYPE(cmd) != 'H' || _IOC_DIR(cmd) != _IOC_READ)
816 			break;
817 
818 		if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGNAME(0))) {
819 			int len = strlen(hid->name) + 1;
820 			if (len > _IOC_SIZE(cmd))
821 				 len = _IOC_SIZE(cmd);
822 			r = copy_to_user(user_arg, hid->name, len) ?
823 				-EFAULT : len;
824 			break;
825 		}
826 
827 		if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGPHYS(0))) {
828 			int len = strlen(hid->phys) + 1;
829 			if (len > _IOC_SIZE(cmd))
830 				len = _IOC_SIZE(cmd);
831 			r = copy_to_user(user_arg, hid->phys, len) ?
832 				-EFAULT : len;
833 			break;
834 		}
835 	}
836 
837 ret_unlock:
838 	mutex_unlock(&hiddev->existancelock);
839 	return r;
840 }
841 
842 #ifdef CONFIG_COMPAT
843 static long hiddev_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
844 {
845 	return hiddev_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
846 }
847 #endif
848 
849 static const struct file_operations hiddev_fops = {
850 	.owner =	THIS_MODULE,
851 	.read =		hiddev_read,
852 	.write =	hiddev_write,
853 	.poll =		hiddev_poll,
854 	.open =		hiddev_open,
855 	.release =	hiddev_release,
856 	.unlocked_ioctl =	hiddev_ioctl,
857 	.fasync =	hiddev_fasync,
858 #ifdef CONFIG_COMPAT
859 	.compat_ioctl	= hiddev_compat_ioctl,
860 #endif
861 	.llseek		= noop_llseek,
862 };
863 
864 static char *hiddev_devnode(struct device *dev, umode_t *mode)
865 {
866 	return kasprintf(GFP_KERNEL, "usb/%s", dev_name(dev));
867 }
868 
869 static struct usb_class_driver hiddev_class = {
870 	.name =		"hiddev%d",
871 	.devnode =	hiddev_devnode,
872 	.fops =		&hiddev_fops,
873 	.minor_base =	HIDDEV_MINOR_BASE,
874 };
875 
876 /*
877  * This is where hid.c calls us to connect a hid device to the hiddev driver
878  */
879 int hiddev_connect(struct hid_device *hid, unsigned int force)
880 {
881 	struct hiddev *hiddev;
882 	struct usbhid_device *usbhid = hid->driver_data;
883 	int retval;
884 
885 	if (!force) {
886 		unsigned int i;
887 		for (i = 0; i < hid->maxcollection; i++)
888 			if (hid->collection[i].type ==
889 			    HID_COLLECTION_APPLICATION &&
890 			    !IS_INPUT_APPLICATION(hid->collection[i].usage))
891 				break;
892 
893 		if (i == hid->maxcollection)
894 			return -1;
895 	}
896 
897 	if (!(hiddev = kzalloc(sizeof(struct hiddev), GFP_KERNEL)))
898 		return -1;
899 
900 	init_waitqueue_head(&hiddev->wait);
901 	INIT_LIST_HEAD(&hiddev->list);
902 	spin_lock_init(&hiddev->list_lock);
903 	mutex_init(&hiddev->existancelock);
904 	hid->hiddev = hiddev;
905 	hiddev->hid = hid;
906 	hiddev->exist = 1;
907 	retval = usb_register_dev(usbhid->intf, &hiddev_class);
908 	if (retval) {
909 		hid_err(hid, "Not able to get a minor for this device\n");
910 		hid->hiddev = NULL;
911 		kfree(hiddev);
912 		return -1;
913 	}
914 	return 0;
915 }
916 
917 /*
918  * This is where hid.c calls us to disconnect a hiddev device from the
919  * corresponding hid device (usually because the usb device has disconnected)
920  */
921 static struct usb_class_driver hiddev_class;
922 void hiddev_disconnect(struct hid_device *hid)
923 {
924 	struct hiddev *hiddev = hid->hiddev;
925 	struct usbhid_device *usbhid = hid->driver_data;
926 
927 	usb_deregister_dev(usbhid->intf, &hiddev_class);
928 
929 	mutex_lock(&hiddev->existancelock);
930 	hiddev->exist = 0;
931 
932 	if (hiddev->open) {
933 		mutex_unlock(&hiddev->existancelock);
934 		usbhid_close(hiddev->hid);
935 		wake_up_interruptible(&hiddev->wait);
936 	} else {
937 		mutex_unlock(&hiddev->existancelock);
938 		kfree(hiddev);
939 	}
940 }
941