Merge branch 'uhid' into for-linus

      UHID - User-space I/O driver support for HID subsystem

     ========================================================

The HID subsystem needs two kinds of drivers. In this document we call them:

 1. The "HID I/O Driver" is the driver that performs raw data I/O to the

    low-level device. Internally, they register an hid_ll_driver structure with

    the HID core. They perform device setup, read raw data from the device and

    push it into the HID subsystem and they provide a callback so the HID

    subsystem can send data to the device.

 2. The "HID Device Driver" is the driver that parses HID reports and reacts on

    them. There are generic drivers like "generic-usb" and "generic-bluetooth"

    which adhere to the HID specification and provide the standardizes features.

    But there may be special drivers and quirks for each non-standard device out

    there. Internally, they use the hid_driver structure.

Historically, the USB stack was the first subsystem to provide an HID I/O

Driver. However, other standards like Bluetooth have adopted the HID specs and

may provide HID I/O Drivers, too. The UHID driver allows to implement HID I/O

Drivers in user-space and feed the data into the kernel HID-subsystem.

This allows user-space to operate on the same level as USB-HID, Bluetooth-HID

and similar. It does not provide a way to write HID Device Drivers, though. Use

hidraw for this purpose.

There is an example user-space application in ./samples/uhid/uhid-example.c

The UHID API

------------

UHID is accessed through a character misc-device. The minor-number is allocated

dynamically so you need to rely on udev (or similar) to create the device node.

This is /dev/uhid by default.

If a new device is detected by your HID I/O Driver and you want to register this

device with the HID subsystem, then you need to open /dev/uhid once for each

device you want to register. All further communication is done by read()'ing or

write()'ing "struct uhid_event" objects. Non-blocking operations are supported

by setting O_NONBLOCK.

struct uhid_event {

        __u32 type;

        union {

                struct uhid_create_req create;

                struct uhid_data_req data;

                ...

        } u;

};

The "type" field contains the ID of the event. Depending on the ID different

payloads are sent. You must not split a single event across multiple read()'s or

multiple write()'s. A single event must always be sent as a whole. Furthermore,

only a single event can be sent per read() or write(). Pending data is ignored.

If you want to handle multiple events in a single syscall, then use vectored

I/O with readv()/writev().

The first thing you should do is sending an UHID_CREATE event. This will

register the device. UHID will respond with an UHID_START event. You can now

start sending data to and reading data from UHID. However, unless UHID sends the

UHID_OPEN event, the internally attached HID Device Driver has no user attached.

That is, you might put your device asleep unless you receive the UHID_OPEN

event. If you receive the UHID_OPEN event, you should start I/O. If the last

user closes the HID device, you will receive an UHID_CLOSE event. This may be

followed by an UHID_OPEN event again and so on. There is no need to perform

reference-counting in user-space. That is, you will never receive multiple

UHID_OPEN events without an UHID_CLOSE event. The HID subsystem performs

ref-counting for you.

You may decide to ignore UHID_OPEN/UHID_CLOSE, though. I/O is allowed even

though the device may have no users.

If you want to send data to the HID subsystem, you send an HID_INPUT event with

your raw data payload. If the kernel wants to send data to the device, you will

read an UHID_OUTPUT or UHID_OUTPUT_EV event.

If your device disconnects, you should send an UHID_DESTROY event. This will

unregister the device. You can now send UHID_CREATE again to register a new

device.

If you close() the fd, the device is automatically unregistered and destroyed

internally.

write()

-------

write() allows you to modify the state of the device and feed input data into

the kernel. The following types are supported: UHID_CREATE, UHID_DESTROY and

UHID_INPUT. The kernel will parse the event immediately and if the event ID is

not supported, it will return -EOPNOTSUPP. If the payload is invalid, then

-EINVAL is returned, otherwise, the amount of data that was read is returned and

the request was handled successfully.

  UHID_CREATE:

  This creates the internal HID device. No I/O is possible until you send this

  event to the kernel. The payload is of type struct uhid_create_req and

  contains information about your device. You can start I/O now.

  UHID_DESTROY:

  This destroys the internal HID device. No further I/O will be accepted. There

  may still be pending messages that you can receive with read() but no further

  UHID_INPUT events can be sent to the kernel.

  You can create a new device by sending UHID_CREATE again. There is no need to

  reopen the character device.

  UHID_INPUT:

  You must send UHID_CREATE before sending input to the kernel! This event

  contains a data-payload. This is the raw data that you read from your device.

  The kernel will parse the HID reports and react on it.

  UHID_FEATURE_ANSWER:

  If you receive a UHID_FEATURE request you must answer with this request. You

  must copy the "id" field from the request into the answer. Set the "err" field

  to 0 if no error occured or to EIO if an I/O error occurred.

  If "err" is 0 then you should fill the buffer of the answer with the results

  of the feature request and set "size" correspondingly.

read()

------

read() will return a queued ouput report. These output reports can be of type

UHID_START, UHID_STOP, UHID_OPEN, UHID_CLOSE, UHID_OUTPUT or UHID_OUTPUT_EV. No

reaction is required to any of them but you should handle them according to your

needs. Only UHID_OUTPUT and UHID_OUTPUT_EV have payloads.

  UHID_START:

  This is sent when the HID device is started. Consider this as an answer to

  UHID_CREATE. This is always the first event that is sent.

  UHID_STOP:

  This is sent when the HID device is stopped. Consider this as an answer to

  UHID_DESTROY.

  If the kernel HID device driver closes the device manually (that is, you

  didn't send UHID_DESTROY) then you should consider this device closed and send

  an UHID_DESTROY event. You may want to reregister your device, though. This is

  always the last message that is sent to you unless you reopen the device with

  UHID_CREATE.

  UHID_OPEN:

  This is sent when the HID device is opened. That is, the data that the HID

  device provides is read by some other process. You may ignore this event but

  it is useful for power-management. As long as you haven't received this event

  there is actually no other process that reads your data so there is no need to

  send UHID_INPUT events to the kernel.

  UHID_CLOSE:

  This is sent when there are no more processes which read the HID data. It is

  the counterpart of UHID_OPEN and you may as well ignore this event.

  UHID_OUTPUT:

  This is sent if the HID device driver wants to send raw data to the I/O

  device. You should read the payload and forward it to the device. The payload

  is of type "struct uhid_data_req".

  This may be received even though you haven't received UHID_OPEN, yet.

  UHID_OUTPUT_EV:

  Same as UHID_OUTPUT but this contains a "struct input_event" as payload. This

  is called for force-feedback, LED or similar events which are received through

  an input device by the HID subsystem. You should convert this into raw reports

  and send them to your device similar to events of type UHID_OUTPUT.

  UHID_FEATURE:

  This event is sent if the kernel driver wants to perform a feature request as

  described in the HID specs. The report-type and report-number are available in

  the payload.

  The kernel serializes feature requests so there will never be two in parallel.

  However, if you fail to respond with a UHID_FEATURE_ANSWER in a time-span of 5

  seconds, then the requests will be dropped and a new one might be sent.

  Therefore, the payload also contains an "id" field that identifies every

  request.

Document by:

  David Herrmann <dh.herrmann@googlemail.com>

F:	Documentation/filesystems/ufs.txt

F:	fs/ufs/

UHID USERSPACE HID IO DRIVER:

M:	David Herrmann <dh.herrmann@googlemail.com>

L:	linux-input@vger.kernel.org

S:	Maintained

F:	drivers/hid/uhid.c

F:	include/linux/uhid.h

ULTRA-WIDEBAND (UWB) SUBSYSTEM:

L:	linux-usb@vger.kernel.org

S:	Orphan

	If unsure, say Y.

config UHID

	tristate "User-space I/O driver support for HID subsystem"

	depends on HID

	default n

	---help---

	Say Y here if you want to provide HID I/O Drivers from user-space.

	This allows to write I/O drivers in user-space and feed the data from

	the device into the kernel. The kernel parses the HID reports, loads the

	corresponding HID Device Driver or provides input devices on top of your

	user-space device.

	This driver cannot be used to parse HID-reports in user-space and write

	special HID-drivers. You should use hidraw for that.

	Instead, this driver allows to write the transport-layer driver in

	user-space like USB-HID and Bluetooth-HID do in kernel-space.

	If unsure, say N.

	To compile this driver as a module, choose M here: the

	module will be called uhid.

config HID_GENERIC

	tristate "Generic HID driver"

	depends on HID

endif

obj-$(CONFIG_HID)		+= hid.o

obj-$(CONFIG_UHID)		+= uhid.o

obj-$(CONFIG_HID_GENERIC)	+= hid-generic.o

/*

 * User-space I/O driver support for HID subsystem

 * Copyright (c) 2012 David Herrmann

 */

/*

 * This program is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License as published by the Free

 * Software Foundation; either version 2 of the License, or (at your option)

 * any later version.

 */

#include <linux/atomic.h>

#include <linux/device.h>

#include <linux/fs.h>

#include <linux/hid.h>

#include <linux/input.h>

#include <linux/miscdevice.h>

#include <linux/module.h>

#include <linux/mutex.h>

#include <linux/poll.h>

#include <linux/sched.h>

#include <linux/spinlock.h>

#include <linux/uhid.h>

#include <linux/wait.h>

#define UHID_NAME	"uhid"

#define UHID_BUFSIZE	32

struct uhid_device {

	struct mutex devlock;

	bool running;

	__u8 *rd_data;

	uint rd_size;

	struct hid_device *hid;

	struct uhid_event input_buf;

	wait_queue_head_t waitq;

	spinlock_t qlock;

	__u8 head;

	__u8 tail;

	struct uhid_event *outq[UHID_BUFSIZE];

	struct mutex report_lock;

	wait_queue_head_t report_wait;

	atomic_t report_done;

	atomic_t report_id;

	struct uhid_event report_buf;

};

static struct miscdevice uhid_misc;

static void uhid_queue(struct uhid_device *uhid, struct uhid_event *ev)

{

	__u8 newhead;

	newhead = (uhid->head + 1) % UHID_BUFSIZE;

	if (newhead != uhid->tail) {

		uhid->outq[uhid->head] = ev;

		uhid->head = newhead;

		wake_up_interruptible(&uhid->waitq);

	} else {

		hid_warn(uhid->hid, "Output queue is full\n");

		kfree(ev);

	}

}

static int uhid_queue_event(struct uhid_device *uhid, __u32 event)

{

	unsigned long flags;

	struct uhid_event *ev;

	ev = kzalloc(sizeof(*ev), GFP_KERNEL);

	if (!ev)

		return -ENOMEM;

	ev->type = event;

	spin_lock_irqsave(&uhid->qlock, flags);

	uhid_queue(uhid, ev);

	spin_unlock_irqrestore(&uhid->qlock, flags);

	return 0;

}

static int uhid_hid_start(struct hid_device *hid)

{

	struct uhid_device *uhid = hid->driver_data;

	return uhid_queue_event(uhid, UHID_START);

}

static void uhid_hid_stop(struct hid_device *hid)

{

	struct uhid_device *uhid = hid->driver_data;

	hid->claimed = 0;

	uhid_queue_event(uhid, UHID_STOP);

}

static int uhid_hid_open(struct hid_device *hid)

{

	struct uhid_device *uhid = hid->driver_data;

	return uhid_queue_event(uhid, UHID_OPEN);

}

static void uhid_hid_close(struct hid_device *hid)

{

	struct uhid_device *uhid = hid->driver_data;

	uhid_queue_event(uhid, UHID_CLOSE);

}

static int uhid_hid_input(struct input_dev *input, unsigned int type,

			  unsigned int code, int value)

{

	struct hid_device *hid = input_get_drvdata(input);

	struct uhid_device *uhid = hid->driver_data;

	unsigned long flags;

	struct uhid_event *ev;

	ev = kzalloc(sizeof(*ev), GFP_ATOMIC);

	if (!ev)

		return -ENOMEM;

	ev->type = UHID_OUTPUT_EV;

	ev->u.output_ev.type = type;

	ev->u.output_ev.code = code;

	ev->u.output_ev.value = value;

	spin_lock_irqsave(&uhid->qlock, flags);

	uhid_queue(uhid, ev);

	spin_unlock_irqrestore(&uhid->qlock, flags);

	return 0;

}

static int uhid_hid_parse(struct hid_device *hid)

{

	struct uhid_device *uhid = hid->driver_data;

	return hid_parse_report(hid, uhid->rd_data, uhid->rd_size);

}

static int uhid_hid_get_raw(struct hid_device *hid, unsigned char rnum,

			    __u8 *buf, size_t count, unsigned char rtype)

{

	struct uhid_device *uhid = hid->driver_data;

	__u8 report_type;

	struct uhid_event *ev;

	unsigned long flags;

	int ret;

	size_t uninitialized_var(len);

	struct uhid_feature_answer_req *req;

	if (!uhid->running)

		return -EIO;

	switch (rtype) {

	case HID_FEATURE_REPORT:

		report_type = UHID_FEATURE_REPORT;

		break;

	case HID_OUTPUT_REPORT:

		report_type = UHID_OUTPUT_REPORT;

		break;

	case HID_INPUT_REPORT:

		report_type = UHID_INPUT_REPORT;

		break;

	default:

		return -EINVAL;

	}

	ret = mutex_lock_interruptible(&uhid->report_lock);

	if (ret)

		return ret;

	ev = kzalloc(sizeof(*ev), GFP_KERNEL);

	if (!ev) {

		ret = -ENOMEM;

		goto unlock;

	}

	spin_lock_irqsave(&uhid->qlock, flags);

	ev->type = UHID_FEATURE;

	ev->u.feature.id = atomic_inc_return(&uhid->report_id);

	ev->u.feature.rnum = rnum;

	ev->u.feature.rtype = report_type;

	atomic_set(&uhid->report_done, 0);

	uhid_queue(uhid, ev);

	spin_unlock_irqrestore(&uhid->qlock, flags);

	ret = wait_event_interruptible_timeout(uhid->report_wait,

				atomic_read(&uhid->report_done), 5 * HZ);

	/*

	 * Make sure "uhid->running" is cleared on shutdown before

	 * "uhid->report_done" is set.

	 */

	smp_rmb();

	if (!ret || !uhid->running) {

		ret = -EIO;

	} else if (ret < 0) {

		ret = -ERESTARTSYS;

	} else {

		spin_lock_irqsave(&uhid->qlock, flags);

		req = &uhid->report_buf.u.feature_answer;

		if (req->err) {

			ret = -EIO;

		} else {

			ret = 0;

			len = min(count,

				min_t(size_t, req->size, UHID_DATA_MAX));

			memcpy(buf, req->data, len);

		}

		spin_unlock_irqrestore(&uhid->qlock, flags);

	}

	atomic_set(&uhid->report_done, 1);

unlock:

	mutex_unlock(&uhid->report_lock);

	return ret ? ret : len;

}

static int uhid_hid_output_raw(struct hid_device *hid, __u8 *buf, size_t count,

			       unsigned char report_type)

{

	struct uhid_device *uhid = hid->driver_data;

	__u8 rtype;

	unsigned long flags;

	struct uhid_event *ev;

	switch (report_type) {

	case HID_FEATURE_REPORT:

		rtype = UHID_FEATURE_REPORT;

		break;

	case HID_OUTPUT_REPORT:

		rtype = UHID_OUTPUT_REPORT;

		break;

	default:

		return -EINVAL;

	}

	if (count < 1 || count > UHID_DATA_MAX)

		return -EINVAL;

	ev = kzalloc(sizeof(*ev), GFP_KERNEL);

	if (!ev)

		return -ENOMEM;

	ev->type = UHID_OUTPUT;

	ev->u.output.size = count;

	ev->u.output.rtype = rtype;

	memcpy(ev->u.output.data, buf, count);

	spin_lock_irqsave(&uhid->qlock, flags);

	uhid_queue(uhid, ev);

	spin_unlock_irqrestore(&uhid->qlock, flags);

	return count;

}

static struct hid_ll_driver uhid_hid_driver = {

	.start = uhid_hid_start,

	.stop = uhid_hid_stop,

	.open = uhid_hid_open,

	.close = uhid_hid_close,

	.hidinput_input_event = uhid_hid_input,

	.parse = uhid_hid_parse,

};

static int uhid_dev_create(struct uhid_device *uhid,

			   const struct uhid_event *ev)

{

	struct hid_device *hid;

	int ret;

	if (uhid->running)

		return -EALREADY;

	uhid->rd_size = ev->u.create.rd_size;

	if (uhid->rd_size <= 0 || uhid->rd_size > HID_MAX_DESCRIPTOR_SIZE)

		return -EINVAL;

	uhid->rd_data = kmalloc(uhid->rd_size, GFP_KERNEL);

	if (!uhid->rd_data)

		return -ENOMEM;

	if (copy_from_user(uhid->rd_data, ev->u.create.rd_data,

			   uhid->rd_size)) {

		ret = -EFAULT;

		goto err_free;

	}

	hid = hid_allocate_device();

	if (IS_ERR(hid)) {

		ret = PTR_ERR(hid);

		goto err_free;

	}

	strncpy(hid->name, ev->u.create.name, 127);

	hid->name[127] = 0;

	strncpy(hid->phys, ev->u.create.phys, 63);

	hid->phys[63] = 0;

	strncpy(hid->uniq, ev->u.create.uniq, 63);

	hid->uniq[63] = 0;

	hid->ll_driver = &uhid_hid_driver;

	hid->hid_get_raw_report = uhid_hid_get_raw;

	hid->hid_output_raw_report = uhid_hid_output_raw;

	hid->bus = ev->u.create.bus;

	hid->vendor = ev->u.create.vendor;

	hid->product = ev->u.create.product;

	hid->version = ev->u.create.version;

	hid->country = ev->u.create.country;

	hid->driver_data = uhid;

	hid->dev.parent = uhid_misc.this_device;

	uhid->hid = hid;

	uhid->running = true;

	ret = hid_add_device(hid);

	if (ret) {

		hid_err(hid, "Cannot register HID device\n");

		goto err_hid;

	}

	return 0;

err_hid:

	hid_destroy_device(hid);

	uhid->hid = NULL;

	uhid->running = false;

err_free:

	kfree(uhid->rd_data);

	return ret;

}

static int uhid_dev_destroy(struct uhid_device *uhid)

{

	if (!uhid->running)

		return -EINVAL;

	/* clear "running" before setting "report_done" */

	uhid->running = false;

	smp_wmb();

	atomic_set(&uhid->report_done, 1);

	wake_up_interruptible(&uhid->report_wait);

	hid_destroy_device(uhid->hid);

	kfree(uhid->rd_data);

	return 0;

}

static int uhid_dev_input(struct uhid_device *uhid, struct uhid_event *ev)

{

	if (!uhid->running)

		return -EINVAL;

	hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input.data,

			 min_t(size_t, ev->u.input.size, UHID_DATA_MAX), 0);

	return 0;

}

static int uhid_dev_feature_answer(struct uhid_device *uhid,

				   struct uhid_event *ev)

{

	unsigned long flags;

	if (!uhid->running)

		return -EINVAL;

	spin_lock_irqsave(&uhid->qlock, flags);

	/* id for old report; drop it silently */

	if (atomic_read(&uhid->report_id) != ev->u.feature_answer.id)

		goto unlock;

	if (atomic_read(&uhid->report_done))

		goto unlock;

	memcpy(&uhid->report_buf, ev, sizeof(*ev));

	atomic_set(&uhid->report_done, 1);

	wake_up_interruptible(&uhid->report_wait);

unlock:

	spin_unlock_irqrestore(&uhid->qlock, flags);

	return 0;

}

static int uhid_char_open(struct inode *inode, struct file *file)

{

	struct uhid_device *uhid;

	uhid = kzalloc(sizeof(*uhid), GFP_KERNEL);

	if (!uhid)

		return -ENOMEM;

	mutex_init(&uhid->devlock);

	mutex_init(&uhid->report_lock);

	spin_lock_init(&uhid->qlock);

	init_waitqueue_head(&uhid->waitq);

	init_waitqueue_head(&uhid->report_wait);

	uhid->running = false;

	atomic_set(&uhid->report_done, 1);

	file->private_data = uhid;

	nonseekable_open(inode, file);

	return 0;

}

static int uhid_char_release(struct inode *inode, struct file *file)

{

	struct uhid_device *uhid = file->private_data;

	unsigned int i;

	uhid_dev_destroy(uhid);

	for (i = 0; i < UHID_BUFSIZE; ++i)

		kfree(uhid->outq[i]);

	kfree(uhid);

	return 0;

}

static ssize_t uhid_char_read(struct file *file, char __user *buffer,

				size_t count, loff_t *ppos)

{

	struct uhid_device *uhid = file->private_data;

	int ret;

	unsigned long flags;

	size_t len;

	/* they need at least the "type" member of uhid_event */

	if (count < sizeof(__u32))

		return -EINVAL;

try_again:

	if (file->f_flags & O_NONBLOCK) {

		if (uhid->head == uhid->tail)

			return -EAGAIN;

	} else {

		ret = wait_event_interruptible(uhid->waitq,

						uhid->head != uhid->tail);

		if (ret)

			return ret;

	}

	ret = mutex_lock_interruptible(&uhid->devlock);

	if (ret)

		return ret;

	if (uhid->head == uhid->tail) {

		mutex_unlock(&uhid->devlock);

		goto try_again;

	} else {

		len = min(count, sizeof(**uhid->outq));

		if (copy_to_user(buffer, uhid->outq[uhid->tail], len)) {

			ret = -EFAULT;

		} else {

			kfree(uhid->outq[uhid->tail]);

			uhid->outq[uhid->tail] = NULL;

			spin_lock_irqsave(&uhid->qlock, flags);

			uhid->tail = (uhid->tail + 1) % UHID_BUFSIZE;

			spin_unlock_irqrestore(&uhid->qlock, flags);

		}

	}

	mutex_unlock(&uhid->devlock);

	return ret ? ret : len;

}

static ssize_t uhid_char_write(struct file *file, const char __user *buffer,

				size_t count, loff_t *ppos)

{

	struct uhid_device *uhid = file->private_data;

	int ret;

	size_t len;

	/* we need at least the "type" member of uhid_event */

	if (count < sizeof(__u32))

		return -EINVAL;

	ret = mutex_lock_interruptible(&uhid->devlock);

	if (ret)

		return ret;

	memset(&uhid->input_buf, 0, sizeof(uhid->input_buf));

	len = min(count, sizeof(uhid->input_buf));

	if (copy_from_user(&uhid->input_buf, buffer, len)) {

		ret = -EFAULT;

		goto unlock;

	}

	switch (uhid->input_buf.type) {

	case UHID_CREATE:

		ret = uhid_dev_create(uhid, &uhid->input_buf);

		break;

	case UHID_DESTROY:

		ret = uhid_dev_destroy(uhid);

		break;

	case UHID_INPUT:

		ret = uhid_dev_input(uhid, &uhid->input_buf);

		break;

	case UHID_FEATURE_ANSWER:

		ret = uhid_dev_feature_answer(uhid, &uhid->input_buf);

		break;

	default:

		ret = -EOPNOTSUPP;

	}

unlock:

	mutex_unlock(&uhid->devlock);

	/* return "count" not "len" to not confuse the caller */

	return ret ? ret : count;

}

static unsigned int uhid_char_poll(struct file *file, poll_table *wait)

{

	struct uhid_device *uhid = file->private_data;