Back to home page

OSCL-LXR
 
 

     

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /*
0003  * User-space I/O driver support for HID subsystem
0004  * Copyright (c) 2012 David Herrmann
0005  */
0006 
0007 /*
0008  */
0009 
0010 #include <linux/atomic.h>
0011 #include <linux/compat.h>
0012 #include <linux/cred.h>
0013 #include <linux/device.h>
0014 #include <linux/fs.h>
0015 #include <linux/hid.h>
0016 #include <linux/input.h>
0017 #include <linux/miscdevice.h>
0018 #include <linux/module.h>
0019 #include <linux/mutex.h>
0020 #include <linux/poll.h>
0021 #include <linux/sched.h>
0022 #include <linux/spinlock.h>
0023 #include <linux/uhid.h>
0024 #include <linux/wait.h>
0025 
0026 #define UHID_NAME   "uhid"
0027 #define UHID_BUFSIZE    32
0028 
0029 struct uhid_device {
0030     struct mutex devlock;
0031 
0032     /* This flag tracks whether the HID device is usable for commands from
0033      * userspace. The flag is already set before hid_add_device(), which
0034      * runs in workqueue context, to allow hid_add_device() to communicate
0035      * with userspace.
0036      * However, if hid_add_device() fails, the flag is cleared without
0037      * holding devlock.
0038      * We guarantee that if @running changes from true to false while you're
0039      * holding @devlock, it's still fine to access @hid.
0040      */
0041     bool running;
0042 
0043     __u8 *rd_data;
0044     uint rd_size;
0045 
0046     /* When this is NULL, userspace may use UHID_CREATE/UHID_CREATE2. */
0047     struct hid_device *hid;
0048     struct uhid_event input_buf;
0049 
0050     wait_queue_head_t waitq;
0051     spinlock_t qlock;
0052     __u8 head;
0053     __u8 tail;
0054     struct uhid_event *outq[UHID_BUFSIZE];
0055 
0056     /* blocking GET_REPORT support; state changes protected by qlock */
0057     struct mutex report_lock;
0058     wait_queue_head_t report_wait;
0059     bool report_running;
0060     u32 report_id;
0061     u32 report_type;
0062     struct uhid_event report_buf;
0063     struct work_struct worker;
0064 };
0065 
0066 static struct miscdevice uhid_misc;
0067 
0068 static void uhid_device_add_worker(struct work_struct *work)
0069 {
0070     struct uhid_device *uhid = container_of(work, struct uhid_device, worker);
0071     int ret;
0072 
0073     ret = hid_add_device(uhid->hid);
0074     if (ret) {
0075         hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret);
0076 
0077         /* We used to call hid_destroy_device() here, but that's really
0078          * messy to get right because we have to coordinate with
0079          * concurrent writes from userspace that might be in the middle
0080          * of using uhid->hid.
0081          * Just leave uhid->hid as-is for now, and clean it up when
0082          * userspace tries to close or reinitialize the uhid instance.
0083          *
0084          * However, we do have to clear the ->running flag and do a
0085          * wakeup to make sure userspace knows that the device is gone.
0086          */
0087         WRITE_ONCE(uhid->running, false);
0088         wake_up_interruptible(&uhid->report_wait);
0089     }
0090 }
0091 
0092 static void uhid_queue(struct uhid_device *uhid, struct uhid_event *ev)
0093 {
0094     __u8 newhead;
0095 
0096     newhead = (uhid->head + 1) % UHID_BUFSIZE;
0097 
0098     if (newhead != uhid->tail) {
0099         uhid->outq[uhid->head] = ev;
0100         uhid->head = newhead;
0101         wake_up_interruptible(&uhid->waitq);
0102     } else {
0103         hid_warn(uhid->hid, "Output queue is full\n");
0104         kfree(ev);
0105     }
0106 }
0107 
0108 static int uhid_queue_event(struct uhid_device *uhid, __u32 event)
0109 {
0110     unsigned long flags;
0111     struct uhid_event *ev;
0112 
0113     ev = kzalloc(sizeof(*ev), GFP_KERNEL);
0114     if (!ev)
0115         return -ENOMEM;
0116 
0117     ev->type = event;
0118 
0119     spin_lock_irqsave(&uhid->qlock, flags);
0120     uhid_queue(uhid, ev);
0121     spin_unlock_irqrestore(&uhid->qlock, flags);
0122 
0123     return 0;
0124 }
0125 
0126 static int uhid_hid_start(struct hid_device *hid)
0127 {
0128     struct uhid_device *uhid = hid->driver_data;
0129     struct uhid_event *ev;
0130     unsigned long flags;
0131 
0132     ev = kzalloc(sizeof(*ev), GFP_KERNEL);
0133     if (!ev)
0134         return -ENOMEM;
0135 
0136     ev->type = UHID_START;
0137 
0138     if (hid->report_enum[HID_FEATURE_REPORT].numbered)
0139         ev->u.start.dev_flags |= UHID_DEV_NUMBERED_FEATURE_REPORTS;
0140     if (hid->report_enum[HID_OUTPUT_REPORT].numbered)
0141         ev->u.start.dev_flags |= UHID_DEV_NUMBERED_OUTPUT_REPORTS;
0142     if (hid->report_enum[HID_INPUT_REPORT].numbered)
0143         ev->u.start.dev_flags |= UHID_DEV_NUMBERED_INPUT_REPORTS;
0144 
0145     spin_lock_irqsave(&uhid->qlock, flags);
0146     uhid_queue(uhid, ev);
0147     spin_unlock_irqrestore(&uhid->qlock, flags);
0148 
0149     return 0;
0150 }
0151 
0152 static void uhid_hid_stop(struct hid_device *hid)
0153 {
0154     struct uhid_device *uhid = hid->driver_data;
0155 
0156     hid->claimed = 0;
0157     uhid_queue_event(uhid, UHID_STOP);
0158 }
0159 
0160 static int uhid_hid_open(struct hid_device *hid)
0161 {
0162     struct uhid_device *uhid = hid->driver_data;
0163 
0164     return uhid_queue_event(uhid, UHID_OPEN);
0165 }
0166 
0167 static void uhid_hid_close(struct hid_device *hid)
0168 {
0169     struct uhid_device *uhid = hid->driver_data;
0170 
0171     uhid_queue_event(uhid, UHID_CLOSE);
0172 }
0173 
0174 static int uhid_hid_parse(struct hid_device *hid)
0175 {
0176     struct uhid_device *uhid = hid->driver_data;
0177 
0178     return hid_parse_report(hid, uhid->rd_data, uhid->rd_size);
0179 }
0180 
0181 /* must be called with report_lock held */
0182 static int __uhid_report_queue_and_wait(struct uhid_device *uhid,
0183                     struct uhid_event *ev,
0184                     __u32 *report_id)
0185 {
0186     unsigned long flags;
0187     int ret;
0188 
0189     spin_lock_irqsave(&uhid->qlock, flags);
0190     *report_id = ++uhid->report_id;
0191     uhid->report_type = ev->type + 1;
0192     uhid->report_running = true;
0193     uhid_queue(uhid, ev);
0194     spin_unlock_irqrestore(&uhid->qlock, flags);
0195 
0196     ret = wait_event_interruptible_timeout(uhid->report_wait,
0197                 !uhid->report_running || !READ_ONCE(uhid->running),
0198                 5 * HZ);
0199     if (!ret || !READ_ONCE(uhid->running) || uhid->report_running)
0200         ret = -EIO;
0201     else if (ret < 0)
0202         ret = -ERESTARTSYS;
0203     else
0204         ret = 0;
0205 
0206     uhid->report_running = false;
0207 
0208     return ret;
0209 }
0210 
0211 static void uhid_report_wake_up(struct uhid_device *uhid, u32 id,
0212                 const struct uhid_event *ev)
0213 {
0214     unsigned long flags;
0215 
0216     spin_lock_irqsave(&uhid->qlock, flags);
0217 
0218     /* id for old report; drop it silently */
0219     if (uhid->report_type != ev->type || uhid->report_id != id)
0220         goto unlock;
0221     if (!uhid->report_running)
0222         goto unlock;
0223 
0224     memcpy(&uhid->report_buf, ev, sizeof(*ev));
0225     uhid->report_running = false;
0226     wake_up_interruptible(&uhid->report_wait);
0227 
0228 unlock:
0229     spin_unlock_irqrestore(&uhid->qlock, flags);
0230 }
0231 
0232 static int uhid_hid_get_report(struct hid_device *hid, unsigned char rnum,
0233                    u8 *buf, size_t count, u8 rtype)
0234 {
0235     struct uhid_device *uhid = hid->driver_data;
0236     struct uhid_get_report_reply_req *req;
0237     struct uhid_event *ev;
0238     int ret;
0239 
0240     if (!READ_ONCE(uhid->running))
0241         return -EIO;
0242 
0243     ev = kzalloc(sizeof(*ev), GFP_KERNEL);
0244     if (!ev)
0245         return -ENOMEM;
0246 
0247     ev->type = UHID_GET_REPORT;
0248     ev->u.get_report.rnum = rnum;
0249     ev->u.get_report.rtype = rtype;
0250 
0251     ret = mutex_lock_interruptible(&uhid->report_lock);
0252     if (ret) {
0253         kfree(ev);
0254         return ret;
0255     }
0256 
0257     /* this _always_ takes ownership of @ev */
0258     ret = __uhid_report_queue_and_wait(uhid, ev, &ev->u.get_report.id);
0259     if (ret)
0260         goto unlock;
0261 
0262     req = &uhid->report_buf.u.get_report_reply;
0263     if (req->err) {
0264         ret = -EIO;
0265     } else {
0266         ret = min3(count, (size_t)req->size, (size_t)UHID_DATA_MAX);
0267         memcpy(buf, req->data, ret);
0268     }
0269 
0270 unlock:
0271     mutex_unlock(&uhid->report_lock);
0272     return ret;
0273 }
0274 
0275 static int uhid_hid_set_report(struct hid_device *hid, unsigned char rnum,
0276                    const u8 *buf, size_t count, u8 rtype)
0277 {
0278     struct uhid_device *uhid = hid->driver_data;
0279     struct uhid_event *ev;
0280     int ret;
0281 
0282     if (!READ_ONCE(uhid->running) || count > UHID_DATA_MAX)
0283         return -EIO;
0284 
0285     ev = kzalloc(sizeof(*ev), GFP_KERNEL);
0286     if (!ev)
0287         return -ENOMEM;
0288 
0289     ev->type = UHID_SET_REPORT;
0290     ev->u.set_report.rnum = rnum;
0291     ev->u.set_report.rtype = rtype;
0292     ev->u.set_report.size = count;
0293     memcpy(ev->u.set_report.data, buf, count);
0294 
0295     ret = mutex_lock_interruptible(&uhid->report_lock);
0296     if (ret) {
0297         kfree(ev);
0298         return ret;
0299     }
0300 
0301     /* this _always_ takes ownership of @ev */
0302     ret = __uhid_report_queue_and_wait(uhid, ev, &ev->u.set_report.id);
0303     if (ret)
0304         goto unlock;
0305 
0306     if (uhid->report_buf.u.set_report_reply.err)
0307         ret = -EIO;
0308     else
0309         ret = count;
0310 
0311 unlock:
0312     mutex_unlock(&uhid->report_lock);
0313     return ret;
0314 }
0315 
0316 static int uhid_hid_raw_request(struct hid_device *hid, unsigned char reportnum,
0317                 __u8 *buf, size_t len, unsigned char rtype,
0318                 int reqtype)
0319 {
0320     u8 u_rtype;
0321 
0322     switch (rtype) {
0323     case HID_FEATURE_REPORT:
0324         u_rtype = UHID_FEATURE_REPORT;
0325         break;
0326     case HID_OUTPUT_REPORT:
0327         u_rtype = UHID_OUTPUT_REPORT;
0328         break;
0329     case HID_INPUT_REPORT:
0330         u_rtype = UHID_INPUT_REPORT;
0331         break;
0332     default:
0333         return -EINVAL;
0334     }
0335 
0336     switch (reqtype) {
0337     case HID_REQ_GET_REPORT:
0338         return uhid_hid_get_report(hid, reportnum, buf, len, u_rtype);
0339     case HID_REQ_SET_REPORT:
0340         return uhid_hid_set_report(hid, reportnum, buf, len, u_rtype);
0341     default:
0342         return -EIO;
0343     }
0344 }
0345 
0346 static int uhid_hid_output_raw(struct hid_device *hid, __u8 *buf, size_t count,
0347                    unsigned char report_type)
0348 {
0349     struct uhid_device *uhid = hid->driver_data;
0350     __u8 rtype;
0351     unsigned long flags;
0352     struct uhid_event *ev;
0353 
0354     switch (report_type) {
0355     case HID_FEATURE_REPORT:
0356         rtype = UHID_FEATURE_REPORT;
0357         break;
0358     case HID_OUTPUT_REPORT:
0359         rtype = UHID_OUTPUT_REPORT;
0360         break;
0361     default:
0362         return -EINVAL;
0363     }
0364 
0365     if (count < 1 || count > UHID_DATA_MAX)
0366         return -EINVAL;
0367 
0368     ev = kzalloc(sizeof(*ev), GFP_KERNEL);
0369     if (!ev)
0370         return -ENOMEM;
0371 
0372     ev->type = UHID_OUTPUT;
0373     ev->u.output.size = count;
0374     ev->u.output.rtype = rtype;
0375     memcpy(ev->u.output.data, buf, count);
0376 
0377     spin_lock_irqsave(&uhid->qlock, flags);
0378     uhid_queue(uhid, ev);
0379     spin_unlock_irqrestore(&uhid->qlock, flags);
0380 
0381     return count;
0382 }
0383 
0384 static int uhid_hid_output_report(struct hid_device *hid, __u8 *buf,
0385                   size_t count)
0386 {
0387     return uhid_hid_output_raw(hid, buf, count, HID_OUTPUT_REPORT);
0388 }
0389 
0390 struct hid_ll_driver uhid_hid_driver = {
0391     .start = uhid_hid_start,
0392     .stop = uhid_hid_stop,
0393     .open = uhid_hid_open,
0394     .close = uhid_hid_close,
0395     .parse = uhid_hid_parse,
0396     .raw_request = uhid_hid_raw_request,
0397     .output_report = uhid_hid_output_report,
0398 };
0399 EXPORT_SYMBOL_GPL(uhid_hid_driver);
0400 
0401 #ifdef CONFIG_COMPAT
0402 
0403 /* Apparently we haven't stepped on these rakes enough times yet. */
0404 struct uhid_create_req_compat {
0405     __u8 name[128];
0406     __u8 phys[64];
0407     __u8 uniq[64];
0408 
0409     compat_uptr_t rd_data;
0410     __u16 rd_size;
0411 
0412     __u16 bus;
0413     __u32 vendor;
0414     __u32 product;
0415     __u32 version;
0416     __u32 country;
0417 } __attribute__((__packed__));
0418 
0419 static int uhid_event_from_user(const char __user *buffer, size_t len,
0420                 struct uhid_event *event)
0421 {
0422     if (in_compat_syscall()) {
0423         u32 type;
0424 
0425         if (get_user(type, buffer))
0426             return -EFAULT;
0427 
0428         if (type == UHID_CREATE) {
0429             /*
0430              * This is our messed up request with compat pointer.
0431              * It is largish (more than 256 bytes) so we better
0432              * allocate it from the heap.
0433              */
0434             struct uhid_create_req_compat *compat;
0435 
0436             compat = kzalloc(sizeof(*compat), GFP_KERNEL);
0437             if (!compat)
0438                 return -ENOMEM;
0439 
0440             buffer += sizeof(type);
0441             len -= sizeof(type);
0442             if (copy_from_user(compat, buffer,
0443                        min(len, sizeof(*compat)))) {
0444                 kfree(compat);
0445                 return -EFAULT;
0446             }
0447 
0448             /* Shuffle the data over to proper structure */
0449             event->type = type;
0450 
0451             memcpy(event->u.create.name, compat->name,
0452                 sizeof(compat->name));
0453             memcpy(event->u.create.phys, compat->phys,
0454                 sizeof(compat->phys));
0455             memcpy(event->u.create.uniq, compat->uniq,
0456                 sizeof(compat->uniq));
0457 
0458             event->u.create.rd_data = compat_ptr(compat->rd_data);
0459             event->u.create.rd_size = compat->rd_size;
0460 
0461             event->u.create.bus = compat->bus;
0462             event->u.create.vendor = compat->vendor;
0463             event->u.create.product = compat->product;
0464             event->u.create.version = compat->version;
0465             event->u.create.country = compat->country;
0466 
0467             kfree(compat);
0468             return 0;
0469         }
0470         /* All others can be copied directly */
0471     }
0472 
0473     if (copy_from_user(event, buffer, min(len, sizeof(*event))))
0474         return -EFAULT;
0475 
0476     return 0;
0477 }
0478 #else
0479 static int uhid_event_from_user(const char __user *buffer, size_t len,
0480                 struct uhid_event *event)
0481 {
0482     if (copy_from_user(event, buffer, min(len, sizeof(*event))))
0483         return -EFAULT;
0484 
0485     return 0;
0486 }
0487 #endif
0488 
0489 static int uhid_dev_create2(struct uhid_device *uhid,
0490                 const struct uhid_event *ev)
0491 {
0492     struct hid_device *hid;
0493     size_t rd_size, len;
0494     void *rd_data;
0495     int ret;
0496 
0497     if (uhid->hid)
0498         return -EALREADY;
0499 
0500     rd_size = ev->u.create2.rd_size;
0501     if (rd_size <= 0 || rd_size > HID_MAX_DESCRIPTOR_SIZE)
0502         return -EINVAL;
0503 
0504     rd_data = kmemdup(ev->u.create2.rd_data, rd_size, GFP_KERNEL);
0505     if (!rd_data)
0506         return -ENOMEM;
0507 
0508     uhid->rd_size = rd_size;
0509     uhid->rd_data = rd_data;
0510 
0511     hid = hid_allocate_device();
0512     if (IS_ERR(hid)) {
0513         ret = PTR_ERR(hid);
0514         goto err_free;
0515     }
0516 
0517     /* @hid is zero-initialized, strncpy() is correct, strlcpy() not */
0518     len = min(sizeof(hid->name), sizeof(ev->u.create2.name)) - 1;
0519     strncpy(hid->name, ev->u.create2.name, len);
0520     len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys)) - 1;
0521     strncpy(hid->phys, ev->u.create2.phys, len);
0522     len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq)) - 1;
0523     strncpy(hid->uniq, ev->u.create2.uniq, len);
0524 
0525     hid->ll_driver = &uhid_hid_driver;
0526     hid->bus = ev->u.create2.bus;
0527     hid->vendor = ev->u.create2.vendor;
0528     hid->product = ev->u.create2.product;
0529     hid->version = ev->u.create2.version;
0530     hid->country = ev->u.create2.country;
0531     hid->driver_data = uhid;
0532     hid->dev.parent = uhid_misc.this_device;
0533 
0534     uhid->hid = hid;
0535     uhid->running = true;
0536 
0537     /* Adding of a HID device is done through a worker, to allow HID drivers
0538      * which use feature requests during .probe to work, without they would
0539      * be blocked on devlock, which is held by uhid_char_write.
0540      */
0541     schedule_work(&uhid->worker);
0542 
0543     return 0;
0544 
0545 err_free:
0546     kfree(uhid->rd_data);
0547     uhid->rd_data = NULL;
0548     uhid->rd_size = 0;
0549     return ret;
0550 }
0551 
0552 static int uhid_dev_create(struct uhid_device *uhid,
0553                struct uhid_event *ev)
0554 {
0555     struct uhid_create_req orig;
0556 
0557     orig = ev->u.create;
0558 
0559     if (orig.rd_size <= 0 || orig.rd_size > HID_MAX_DESCRIPTOR_SIZE)
0560         return -EINVAL;
0561     if (copy_from_user(&ev->u.create2.rd_data, orig.rd_data, orig.rd_size))
0562         return -EFAULT;
0563 
0564     memcpy(ev->u.create2.name, orig.name, sizeof(orig.name));
0565     memcpy(ev->u.create2.phys, orig.phys, sizeof(orig.phys));
0566     memcpy(ev->u.create2.uniq, orig.uniq, sizeof(orig.uniq));
0567     ev->u.create2.rd_size = orig.rd_size;
0568     ev->u.create2.bus = orig.bus;
0569     ev->u.create2.vendor = orig.vendor;
0570     ev->u.create2.product = orig.product;
0571     ev->u.create2.version = orig.version;
0572     ev->u.create2.country = orig.country;
0573 
0574     return uhid_dev_create2(uhid, ev);
0575 }
0576 
0577 static int uhid_dev_destroy(struct uhid_device *uhid)
0578 {
0579     if (!uhid->hid)
0580         return -EINVAL;
0581 
0582     WRITE_ONCE(uhid->running, false);
0583     wake_up_interruptible(&uhid->report_wait);
0584 
0585     cancel_work_sync(&uhid->worker);
0586 
0587     hid_destroy_device(uhid->hid);
0588     uhid->hid = NULL;
0589     kfree(uhid->rd_data);
0590 
0591     return 0;
0592 }
0593 
0594 static int uhid_dev_input(struct uhid_device *uhid, struct uhid_event *ev)
0595 {
0596     if (!READ_ONCE(uhid->running))
0597         return -EINVAL;
0598 
0599     hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input.data,
0600              min_t(size_t, ev->u.input.size, UHID_DATA_MAX), 0);
0601 
0602     return 0;
0603 }
0604 
0605 static int uhid_dev_input2(struct uhid_device *uhid, struct uhid_event *ev)
0606 {
0607     if (!READ_ONCE(uhid->running))
0608         return -EINVAL;
0609 
0610     hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input2.data,
0611              min_t(size_t, ev->u.input2.size, UHID_DATA_MAX), 0);
0612 
0613     return 0;
0614 }
0615 
0616 static int uhid_dev_get_report_reply(struct uhid_device *uhid,
0617                      struct uhid_event *ev)
0618 {
0619     if (!READ_ONCE(uhid->running))
0620         return -EINVAL;
0621 
0622     uhid_report_wake_up(uhid, ev->u.get_report_reply.id, ev);
0623     return 0;
0624 }
0625 
0626 static int uhid_dev_set_report_reply(struct uhid_device *uhid,
0627                      struct uhid_event *ev)
0628 {
0629     if (!READ_ONCE(uhid->running))
0630         return -EINVAL;
0631 
0632     uhid_report_wake_up(uhid, ev->u.set_report_reply.id, ev);
0633     return 0;
0634 }
0635 
0636 static int uhid_char_open(struct inode *inode, struct file *file)
0637 {
0638     struct uhid_device *uhid;
0639 
0640     uhid = kzalloc(sizeof(*uhid), GFP_KERNEL);
0641     if (!uhid)
0642         return -ENOMEM;
0643 
0644     mutex_init(&uhid->devlock);
0645     mutex_init(&uhid->report_lock);
0646     spin_lock_init(&uhid->qlock);
0647     init_waitqueue_head(&uhid->waitq);
0648     init_waitqueue_head(&uhid->report_wait);
0649     uhid->running = false;
0650     INIT_WORK(&uhid->worker, uhid_device_add_worker);
0651 
0652     file->private_data = uhid;
0653     stream_open(inode, file);
0654 
0655     return 0;
0656 }
0657 
0658 static int uhid_char_release(struct inode *inode, struct file *file)
0659 {
0660     struct uhid_device *uhid = file->private_data;
0661     unsigned int i;
0662 
0663     uhid_dev_destroy(uhid);
0664 
0665     for (i = 0; i < UHID_BUFSIZE; ++i)
0666         kfree(uhid->outq[i]);
0667 
0668     kfree(uhid);
0669 
0670     return 0;
0671 }
0672 
0673 static ssize_t uhid_char_read(struct file *file, char __user *buffer,
0674                 size_t count, loff_t *ppos)
0675 {
0676     struct uhid_device *uhid = file->private_data;
0677     int ret;
0678     unsigned long flags;
0679     size_t len;
0680 
0681     /* they need at least the "type" member of uhid_event */
0682     if (count < sizeof(__u32))
0683         return -EINVAL;
0684 
0685 try_again:
0686     if (file->f_flags & O_NONBLOCK) {
0687         if (uhid->head == uhid->tail)
0688             return -EAGAIN;
0689     } else {
0690         ret = wait_event_interruptible(uhid->waitq,
0691                         uhid->head != uhid->tail);
0692         if (ret)
0693             return ret;
0694     }
0695 
0696     ret = mutex_lock_interruptible(&uhid->devlock);
0697     if (ret)
0698         return ret;
0699 
0700     if (uhid->head == uhid->tail) {
0701         mutex_unlock(&uhid->devlock);
0702         goto try_again;
0703     } else {
0704         len = min(count, sizeof(**uhid->outq));
0705         if (copy_to_user(buffer, uhid->outq[uhid->tail], len)) {
0706             ret = -EFAULT;
0707         } else {
0708             kfree(uhid->outq[uhid->tail]);
0709             uhid->outq[uhid->tail] = NULL;
0710 
0711             spin_lock_irqsave(&uhid->qlock, flags);
0712             uhid->tail = (uhid->tail + 1) % UHID_BUFSIZE;
0713             spin_unlock_irqrestore(&uhid->qlock, flags);
0714         }
0715     }
0716 
0717     mutex_unlock(&uhid->devlock);
0718     return ret ? ret : len;
0719 }
0720 
0721 static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
0722                 size_t count, loff_t *ppos)
0723 {
0724     struct uhid_device *uhid = file->private_data;
0725     int ret;
0726     size_t len;
0727 
0728     /* we need at least the "type" member of uhid_event */
0729     if (count < sizeof(__u32))
0730         return -EINVAL;
0731 
0732     ret = mutex_lock_interruptible(&uhid->devlock);
0733     if (ret)
0734         return ret;
0735 
0736     memset(&uhid->input_buf, 0, sizeof(uhid->input_buf));
0737     len = min(count, sizeof(uhid->input_buf));
0738 
0739     ret = uhid_event_from_user(buffer, len, &uhid->input_buf);
0740     if (ret)
0741         goto unlock;
0742 
0743     switch (uhid->input_buf.type) {
0744     case UHID_CREATE:
0745         /*
0746          * 'struct uhid_create_req' contains a __user pointer which is
0747          * copied from, so it's unsafe to allow this with elevated
0748          * privileges (e.g. from a setuid binary) or via kernel_write().
0749          */
0750         if (file->f_cred != current_cred()) {
0751             pr_err_once("UHID_CREATE from different security context by process %d (%s), this is not allowed.\n",
0752                     task_tgid_vnr(current), current->comm);
0753             ret = -EACCES;
0754             goto unlock;
0755         }
0756         ret = uhid_dev_create(uhid, &uhid->input_buf);
0757         break;
0758     case UHID_CREATE2:
0759         ret = uhid_dev_create2(uhid, &uhid->input_buf);
0760         break;
0761     case UHID_DESTROY:
0762         ret = uhid_dev_destroy(uhid);
0763         break;
0764     case UHID_INPUT:
0765         ret = uhid_dev_input(uhid, &uhid->input_buf);
0766         break;
0767     case UHID_INPUT2:
0768         ret = uhid_dev_input2(uhid, &uhid->input_buf);
0769         break;
0770     case UHID_GET_REPORT_REPLY:
0771         ret = uhid_dev_get_report_reply(uhid, &uhid->input_buf);
0772         break;
0773     case UHID_SET_REPORT_REPLY:
0774         ret = uhid_dev_set_report_reply(uhid, &uhid->input_buf);
0775         break;
0776     default:
0777         ret = -EOPNOTSUPP;
0778     }
0779 
0780 unlock:
0781     mutex_unlock(&uhid->devlock);
0782 
0783     /* return "count" not "len" to not confuse the caller */
0784     return ret ? ret : count;
0785 }
0786 
0787 static __poll_t uhid_char_poll(struct file *file, poll_table *wait)
0788 {
0789     struct uhid_device *uhid = file->private_data;
0790     __poll_t mask = EPOLLOUT | EPOLLWRNORM; /* uhid is always writable */
0791 
0792     poll_wait(file, &uhid->waitq, wait);
0793 
0794     if (uhid->head != uhid->tail)
0795         mask |= EPOLLIN | EPOLLRDNORM;
0796 
0797     return mask;
0798 }
0799 
0800 static const struct file_operations uhid_fops = {
0801     .owner      = THIS_MODULE,
0802     .open       = uhid_char_open,
0803     .release    = uhid_char_release,
0804     .read       = uhid_char_read,
0805     .write      = uhid_char_write,
0806     .poll       = uhid_char_poll,
0807     .llseek     = no_llseek,
0808 };
0809 
0810 static struct miscdevice uhid_misc = {
0811     .fops       = &uhid_fops,
0812     .minor      = UHID_MINOR,
0813     .name       = UHID_NAME,
0814 };
0815 module_misc_device(uhid_misc);
0816 
0817 MODULE_LICENSE("GPL");
0818 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
0819 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
0820 MODULE_ALIAS_MISCDEV(UHID_MINOR);
0821 MODULE_ALIAS("devname:" UHID_NAME);
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!