[deliverable/linux.git] / drivers / hid / uhid.c

/*
 * User-space I/O driver support for HID subsystem
 * Copyright (c) 2012 David Herrmann
 */

/*
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the Free
 * Software Foundation; either version 2 of the License, or (at your option)
 * any later version.
 */

#include <linux/atomic.h>
#include <linux/device.h>
#include <linux/fs.h>
#include <linux/hid.h>
#include <linux/input.h>
#include <linux/miscdevice.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/poll.h>
#include <linux/sched.h>
#include <linux/spinlock.h>
#include <linux/uhid.h>
#include <linux/wait.h>

#define UHID_NAME	"uhid"
#define UHID_BUFSIZE	32

struct uhid_device {
	struct mutex devlock;
	bool running;

	__u8 *rd_data;
	uint rd_size;

	struct hid_device *hid;
	struct uhid_event input_buf;

	wait_queue_head_t waitq;
	spinlock_t qlock;
	__u8 head;
	__u8 tail;
	struct uhid_event *outq[UHID_BUFSIZE];
};

static struct miscdevice uhid_misc;

static void uhid_queue(struct uhid_device *uhid, struct uhid_event *ev)
{
	__u8 newhead;

	newhead = (uhid->head + 1) % UHID_BUFSIZE;

	if (newhead != uhid->tail) {
		uhid->outq[uhid->head] = ev;
		uhid->head = newhead;
		wake_up_interruptible(&uhid->waitq);
	} else {
		hid_warn(uhid->hid, "Output queue is full\n");
		kfree(ev);
	}
}

static int uhid_queue_event(struct uhid_device *uhid, __u32 event)
{
	unsigned long flags;
	struct uhid_event *ev;

	ev = kzalloc(sizeof(*ev), GFP_KERNEL);
	if (!ev)
		return -ENOMEM;

	ev->type = event;

	spin_lock_irqsave(&uhid->qlock, flags);
	uhid_queue(uhid, ev);
	spin_unlock_irqrestore(&uhid->qlock, flags);

	return 0;
}

static int uhid_hid_start(struct hid_device *hid)
{
	struct uhid_device *uhid = hid->driver_data;

	return uhid_queue_event(uhid, UHID_START);
}

static void uhid_hid_stop(struct hid_device *hid)
{
	struct uhid_device *uhid = hid->driver_data;

	hid->claimed = 0;
	uhid_queue_event(uhid, UHID_STOP);
}

static int uhid_hid_open(struct hid_device *hid)
{
	struct uhid_device *uhid = hid->driver_data;

	return uhid_queue_event(uhid, UHID_OPEN);
}

static void uhid_hid_close(struct hid_device *hid)
{
	struct uhid_device *uhid = hid->driver_data;

	uhid_queue_event(uhid, UHID_CLOSE);
}

static int uhid_hid_input(struct input_dev *input, unsigned int type,
			  unsigned int code, int value)
{
	struct hid_device *hid = input_get_drvdata(input);
	struct uhid_device *uhid = hid->driver_data;
	unsigned long flags;
	struct uhid_event *ev;

	ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
	if (!ev)
		return -ENOMEM;

	ev->type = UHID_OUTPUT_EV;
	ev->u.output_ev.type = type;
	ev->u.output_ev.code = code;
	ev->u.output_ev.value = value;

	spin_lock_irqsave(&uhid->qlock, flags);
	uhid_queue(uhid, ev);
	spin_unlock_irqrestore(&uhid->qlock, flags);

	return 0;
}

static int uhid_hid_parse(struct hid_device *hid)
{
	struct uhid_device *uhid = hid->driver_data;

	return hid_parse_report(hid, uhid->rd_data, uhid->rd_size);
}

static int uhid_hid_get_raw(struct hid_device *hid, unsigned char rnum,
			    __u8 *buf, size_t count, unsigned char rtype)
{
	return 0;
}

static int uhid_hid_output_raw(struct hid_device *hid, __u8 *buf, size_t count,
			       unsigned char report_type)
{
	struct uhid_device *uhid = hid->driver_data;
	__u8 rtype;
	unsigned long flags;
	struct uhid_event *ev;

	switch (report_type) {
	case HID_FEATURE_REPORT:
		rtype = UHID_FEATURE_REPORT;
		break;
	case HID_OUTPUT_REPORT:
		rtype = UHID_OUTPUT_REPORT;
		break;
	default:
		return -EINVAL;
	}

	if (count < 1 || count > UHID_DATA_MAX)
		return -EINVAL;

	ev = kzalloc(sizeof(*ev), GFP_KERNEL);
	if (!ev)
		return -ENOMEM;

	ev->type = UHID_OUTPUT;
	ev->u.output.size = count;
	ev->u.output.rtype = rtype;
	memcpy(ev->u.output.data, buf, count);

	spin_lock_irqsave(&uhid->qlock, flags);
	uhid_queue(uhid, ev);
	spin_unlock_irqrestore(&uhid->qlock, flags);

	return count;
}

static struct hid_ll_driver uhid_hid_driver = {
	.start = uhid_hid_start,
	.stop = uhid_hid_stop,
	.open = uhid_hid_open,
	.close = uhid_hid_close,
	.hidinput_input_event = uhid_hid_input,
	.parse = uhid_hid_parse,
};

static int uhid_dev_create(struct uhid_device *uhid,
			   const struct uhid_event *ev)
{
	struct hid_device *hid;
	int ret;

	if (uhid->running)
		return -EALREADY;

	uhid->rd_size = ev->u.create.rd_size;
	if (uhid->rd_size <= 0 || uhid->rd_size > HID_MAX_DESCRIPTOR_SIZE)
		return -EINVAL;

	uhid->rd_data = kmalloc(uhid->rd_size, GFP_KERNEL);
	if (!uhid->rd_data)
		return -ENOMEM;

	if (copy_from_user(uhid->rd_data, ev->u.create.rd_data,
			   uhid->rd_size)) {
		ret = -EFAULT;
		goto err_free;
	}

	hid = hid_allocate_device();
	if (IS_ERR(hid)) {
		ret = PTR_ERR(hid);
		goto err_free;
	}

	strncpy(hid->name, ev->u.create.name, 127);
	hid->name[127] = 0;
	strncpy(hid->phys, ev->u.create.phys, 63);
	hid->phys[63] = 0;
	strncpy(hid->uniq, ev->u.create.uniq, 63);
	hid->uniq[63] = 0;

	hid->ll_driver = &uhid_hid_driver;
	hid->hid_get_raw_report = uhid_hid_get_raw;
	hid->hid_output_raw_report = uhid_hid_output_raw;
	hid->bus = ev->u.create.bus;
	hid->vendor = ev->u.create.vendor;
	hid->product = ev->u.create.product;
	hid->version = ev->u.create.version;
	hid->country = ev->u.create.country;
	hid->driver_data = uhid;
	hid->dev.parent = uhid_misc.this_device;

	uhid->hid = hid;
	uhid->running = true;

	ret = hid_add_device(hid);
	if (ret) {
		hid_err(hid, "Cannot register HID device\n");
		goto err_hid;
	}

	return 0;

err_hid:
	hid_destroy_device(hid);
	uhid->hid = NULL;
	uhid->running = false;
err_free:
	kfree(uhid->rd_data);
	return ret;
}

static int uhid_dev_destroy(struct uhid_device *uhid)
{
	if (!uhid->running)
		return -EINVAL;

	uhid->running = false;

	hid_destroy_device(uhid->hid);
	kfree(uhid->rd_data);

	return 0;
}

static int uhid_dev_input(struct uhid_device *uhid, struct uhid_event *ev)
{
	if (!uhid->running)
		return -EINVAL;

	hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input.data,
			 min_t(size_t, ev->u.input.size, UHID_DATA_MAX), 0);

	return 0;
}

static int uhid_char_open(struct inode *inode, struct file *file)
{
	struct uhid_device *uhid;

	uhid = kzalloc(sizeof(*uhid), GFP_KERNEL);
	if (!uhid)
		return -ENOMEM;

	mutex_init(&uhid->devlock);
	spin_lock_init(&uhid->qlock);
	init_waitqueue_head(&uhid->waitq);
	uhid->running = false;

	file->private_data = uhid;
	nonseekable_open(inode, file);

	return 0;
}

static int uhid_char_release(struct inode *inode, struct file *file)
{
	struct uhid_device *uhid = file->private_data;
	unsigned int i;

	uhid_dev_destroy(uhid);

	for (i = 0; i < UHID_BUFSIZE; ++i)
		kfree(uhid->outq[i]);

	kfree(uhid);

	return 0;
}

static ssize_t uhid_char_read(struct file *file, char __user *buffer,
				size_t count, loff_t *ppos)
{
	struct uhid_device *uhid = file->private_data;
	int ret;
	unsigned long flags;
	size_t len;

	/* they need at least the "type" member of uhid_event */
	if (count < sizeof(__u32))
		return -EINVAL;

try_again:
	if (file->f_flags & O_NONBLOCK) {
		if (uhid->head == uhid->tail)
			return -EAGAIN;
	} else {
		ret = wait_event_interruptible(uhid->waitq,
						uhid->head != uhid->tail);
		if (ret)
			return ret;
	}

	ret = mutex_lock_interruptible(&uhid->devlock);
	if (ret)
		return ret;

	if (uhid->head == uhid->tail) {
		mutex_unlock(&uhid->devlock);
		goto try_again;
	} else {
		len = min(count, sizeof(**uhid->outq));
		if (copy_to_user(buffer, &uhid->outq[uhid->tail], len)) {
			ret = -EFAULT;
		} else {
			kfree(uhid->outq[uhid->tail]);
			uhid->outq[uhid->tail] = NULL;

			spin_lock_irqsave(&uhid->qlock, flags);
			uhid->tail = (uhid->tail + 1) % UHID_BUFSIZE;
			spin_unlock_irqrestore(&uhid->qlock, flags);
		}
	}

	mutex_unlock(&uhid->devlock);
	return ret ? ret : len;
}

static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
				size_t count, loff_t *ppos)
{
	struct uhid_device *uhid = file->private_data;
	int ret;
	size_t len;

	/* we need at least the "type" member of uhid_event */
	if (count < sizeof(__u32))
		return -EINVAL;

	ret = mutex_lock_interruptible(&uhid->devlock);
	if (ret)
		return ret;

	memset(&uhid->input_buf, 0, sizeof(uhid->input_buf));
	len = min(count, sizeof(uhid->input_buf));
	if (copy_from_user(&uhid->input_buf, buffer, len)) {
		ret = -EFAULT;
		goto unlock;
	}

	switch (uhid->input_buf.type) {
	case UHID_CREATE:
		ret = uhid_dev_create(uhid, &uhid->input_buf);
		break;
	case UHID_DESTROY:
		ret = uhid_dev_destroy(uhid);
		break;
	case UHID_INPUT:
		ret = uhid_dev_input(uhid, &uhid->input_buf);
		break;
	default:
		ret = -EOPNOTSUPP;
	}

unlock:
	mutex_unlock(&uhid->devlock);

	/* return "count" not "len" to not confuse the caller */
	return ret ? ret : count;
}

static unsigned int uhid_char_poll(struct file *file, poll_table *wait)
{
	struct uhid_device *uhid = file->private_data;

	poll_wait(file, &uhid->waitq, wait);

	if (uhid->head != uhid->tail)
		return POLLIN | POLLRDNORM;

	return 0;
}

static const struct file_operations uhid_fops = {
	.owner		= THIS_MODULE,
	.open		= uhid_char_open,
	.release	= uhid_char_release,
	.read		= uhid_char_read,
	.write		= uhid_char_write,
	.poll		= uhid_char_poll,
	.llseek		= no_llseek,
};

static struct miscdevice uhid_misc = {
	.fops		= &uhid_fops,
	.minor		= MISC_DYNAMIC_MINOR,
	.name		= UHID_NAME,
};

static int __init uhid_init(void)
{
	return misc_register(&uhid_misc);
}

static void __exit uhid_exit(void)
{
	misc_deregister(&uhid_misc);
}

module_init(uhid_init);
module_exit(uhid_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
Commit	Line	Data
1ccd7a2a DH	1	/*
	2	* User-space I/O driver support for HID subsystem
	3	* Copyright (c) 2012 David Herrmann
	4	*/
	5
	6	/*
	7	* This program is free software; you can redistribute it and/or modify it
	8	* under the terms of the GNU General Public License as published by the Free
	9	* Software Foundation; either version 2 of the License, or (at your option)
	10	* any later version.
	11	*/
	12
	13	#include <linux/atomic.h>
	14	#include <linux/device.h>
	15	#include <linux/fs.h>
	16	#include <linux/hid.h>
	17	#include <linux/input.h>
	18	#include <linux/miscdevice.h>
	19	#include <linux/module.h>
	20	#include <linux/mutex.h>
	21	#include <linux/poll.h>
	22	#include <linux/sched.h>
	23	#include <linux/spinlock.h>
	24	#include <linux/uhid.h>
	25	#include <linux/wait.h>
	26
	27	#define UHID_NAME "uhid"
ace3d861 DH	28	#define UHID_BUFSIZE 32
	29
	30	struct uhid_device {
d937ae5f	31	struct mutex devlock;
d365c6cf DH	32	bool running;
	33
	34	__u8 *rd_data;
	35	uint rd_size;
	36
ace3d861	37	struct hid_device *hid;
6664ef72	38	struct uhid_event input_buf;
ace3d861 DH	39
	40	wait_queue_head_t waitq;
	41	spinlock_t qlock;
	42	__u8 head;
	43	__u8 tail;
	44	struct uhid_event *outq[UHID_BUFSIZE];
	45	};
1ccd7a2a DH	46
	47	static struct miscdevice uhid_misc;
	48
ace3d861 DH	49	static void uhid_queue(struct uhid_device uhid, struct uhid_event ev)
	50	{
	51	__u8 newhead;
	52
	53	newhead = (uhid->head + 1) % UHID_BUFSIZE;
	54
	55	if (newhead != uhid->tail) {
	56	uhid->outq[uhid->head] = ev;
	57	uhid->head = newhead;
	58	wake_up_interruptible(&uhid->waitq);
	59	} else {
	60	hid_warn(uhid->hid, "Output queue is full\n");
	61	kfree(ev);
	62	}
	63	}
	64
	65	static int uhid_queue_event(struct uhid_device *uhid, __u32 event)
	66	{
	67	unsigned long flags;
	68	struct uhid_event *ev;
	69
	70	ev = kzalloc(sizeof(*ev), GFP_KERNEL);
	71	if (!ev)
	72	return -ENOMEM;
	73
	74	ev->type = event;
	75
	76	spin_lock_irqsave(&uhid->qlock, flags);
	77	uhid_queue(uhid, ev);
	78	spin_unlock_irqrestore(&uhid->qlock, flags);
	79
	80	return 0;
	81	}
	82
d365c6cf DH	83	static int uhid_hid_start(struct hid_device *hid)
d365c6cf DH	84	{
ec4b7dea DH	85	struct uhid_device *uhid = hid->driver_data;
	86
	87	return uhid_queue_event(uhid, UHID_START);
d365c6cf DH	88	}
	89
	90	static void uhid_hid_stop(struct hid_device *hid)
	91	{
ec4b7dea DH	92	struct uhid_device *uhid = hid->driver_data;
	93
	94	hid->claimed = 0;
	95	uhid_queue_event(uhid, UHID_STOP);
d365c6cf DH	96	}
	97
	98	static int uhid_hid_open(struct hid_device *hid)
	99	{
e7191474 DH	100	struct uhid_device *uhid = hid->driver_data;
	101
	102	return uhid_queue_event(uhid, UHID_OPEN);
d365c6cf DH	103	}
	104
	105	static void uhid_hid_close(struct hid_device *hid)
	106	{
e7191474 DH	107	struct uhid_device *uhid = hid->driver_data;
	108
	109	uhid_queue_event(uhid, UHID_CLOSE);
d365c6cf DH	110	}
	111
	112	static int uhid_hid_input(struct input_dev *input, unsigned int type,
	113	unsigned int code, int value)
	114	{
f80e1360 DH	115	struct hid_device *hid = input_get_drvdata(input);
	116	struct uhid_device *uhid = hid->driver_data;
	117	unsigned long flags;
	118	struct uhid_event *ev;
	119
	120	ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
	121	if (!ev)
	122	return -ENOMEM;
	123
	124	ev->type = UHID_OUTPUT_EV;
	125	ev->u.output_ev.type = type;
	126	ev->u.output_ev.code = code;
	127	ev->u.output_ev.value = value;
	128
	129	spin_lock_irqsave(&uhid->qlock, flags);
	130	uhid_queue(uhid, ev);
	131	spin_unlock_irqrestore(&uhid->qlock, flags);
	132
d365c6cf DH	133	return 0;
	134	}
	135
	136	static int uhid_hid_parse(struct hid_device *hid)
	137	{
037c061b DH	138	struct uhid_device *uhid = hid->driver_data;
	139
	140	return hid_parse_report(hid, uhid->rd_data, uhid->rd_size);
d365c6cf DH	141	}
	142
	143	static int uhid_hid_get_raw(struct hid_device *hid, unsigned char rnum,
	144	__u8 *buf, size_t count, unsigned char rtype)
	145	{
	146	return 0;
	147	}
	148
	149	static int uhid_hid_output_raw(struct hid_device hid, __u8 buf, size_t count,
	150	unsigned char report_type)
	151	{
3b3baa82 DH	152	struct uhid_device *uhid = hid->driver_data;
	153	__u8 rtype;
	154	unsigned long flags;
	155	struct uhid_event *ev;
	156
	157	switch (report_type) {
	158	case HID_FEATURE_REPORT:
	159	rtype = UHID_FEATURE_REPORT;
	160	break;
	161	case HID_OUTPUT_REPORT:
	162	rtype = UHID_OUTPUT_REPORT;
	163	break;
	164	default:
	165	return -EINVAL;
	166	}
	167
	168	if (count < 1 \|\| count > UHID_DATA_MAX)
	169	return -EINVAL;
	170
	171	ev = kzalloc(sizeof(*ev), GFP_KERNEL);
	172	if (!ev)
	173	return -ENOMEM;
	174
	175	ev->type = UHID_OUTPUT;
	176	ev->u.output.size = count;
	177	ev->u.output.rtype = rtype;
	178	memcpy(ev->u.output.data, buf, count);
	179
	180	spin_lock_irqsave(&uhid->qlock, flags);
	181	uhid_queue(uhid, ev);
	182	spin_unlock_irqrestore(&uhid->qlock, flags);
	183
	184	return count;
d365c6cf DH	185	}
	186
	187	static struct hid_ll_driver uhid_hid_driver = {
	188	.start = uhid_hid_start,
	189	.stop = uhid_hid_stop,
	190	.open = uhid_hid_open,
	191	.close = uhid_hid_close,
	192	.hidinput_input_event = uhid_hid_input,
	193	.parse = uhid_hid_parse,
	194	};
	195
	196	static int uhid_dev_create(struct uhid_device *uhid,
	197	const struct uhid_event *ev)
	198	{
	199	struct hid_device *hid;
	200	int ret;
	201
	202	if (uhid->running)
	203	return -EALREADY;
	204
	205	uhid->rd_size = ev->u.create.rd_size;
	206	if (uhid->rd_size <= 0 \|\| uhid->rd_size > HID_MAX_DESCRIPTOR_SIZE)
	207	return -EINVAL;
	208
	209	uhid->rd_data = kmalloc(uhid->rd_size, GFP_KERNEL);
	210	if (!uhid->rd_data)
	211	return -ENOMEM;
	212
	213	if (copy_from_user(uhid->rd_data, ev->u.create.rd_data,
	214	uhid->rd_size)) {
	215	ret = -EFAULT;
	216	goto err_free;
	217	}
	218
	219	hid = hid_allocate_device();
	220	if (IS_ERR(hid)) {
	221	ret = PTR_ERR(hid);
	222	goto err_free;
	223	}
	224
	225	strncpy(hid->name, ev->u.create.name, 127);
	226	hid->name[127] = 0;
	227	strncpy(hid->phys, ev->u.create.phys, 63);
	228	hid->phys[63] = 0;
	229	strncpy(hid->uniq, ev->u.create.uniq, 63);
	230	hid->uniq[63] = 0;
	231
	232	hid->ll_driver = &uhid_hid_driver;
	233	hid->hid_get_raw_report = uhid_hid_get_raw;
	234	hid->hid_output_raw_report = uhid_hid_output_raw;
	235	hid->bus = ev->u.create.bus;
	236	hid->vendor = ev->u.create.vendor;
	237	hid->product = ev->u.create.product;
	238	hid->version = ev->u.create.version;
	239	hid->country = ev->u.create.country;
	240	hid->driver_data = uhid;
	241	hid->dev.parent = uhid_misc.this_device;
	242
	243	uhid->hid = hid;
	244	uhid->running = true;
	245
	246	ret = hid_add_device(hid);
	247	if (ret) {
	248	hid_err(hid, "Cannot register HID device\n");
249	goto err_hid;
250	}
251
252	return 0;
253
254	err_hid:
255	hid_destroy_device(hid);
256	uhid->hid = NULL;
257	uhid->running = false;
258	err_free:
259	kfree(uhid->rd_data);
260	return ret;
261	}
262
263	static int uhid_dev_destroy(struct uhid_device *uhid)
264	{
265	if (!uhid->running)
266	return -EINVAL;
267
268	uhid->running = false;
269
270	hid_destroy_device(uhid->hid);
271	kfree(uhid->rd_data);
272
273	return 0;
274	}
275
5e87a36a DH	276	static int uhid_dev_input(struct uhid_device uhid, struct uhid_event ev)
	277	{
	278	if (!uhid->running)
	279	return -EINVAL;
	280
	281	hid_input_report(uhid->hid, HID_INPUT_REPORT, ev->u.input.data,
	282	min_t(size_t, ev->u.input.size, UHID_DATA_MAX), 0);
	283
	284	return 0;
	285	}
	286
1ccd7a2a DH	287	static int uhid_char_open(struct inode inode, struct file file)
1ccd7a2a DH	288	{
ace3d861 DH	289	struct uhid_device *uhid;
	290
	291	uhid = kzalloc(sizeof(*uhid), GFP_KERNEL);
	292	if (!uhid)
	293	return -ENOMEM;
	294
d937ae5f	295	mutex_init(&uhid->devlock);
ace3d861 DH	296	spin_lock_init(&uhid->qlock);
ace3d861 DH	297	init_waitqueue_head(&uhid->waitq);
d365c6cf	298	uhid->running = false;
ace3d861 DH	299
	300	file->private_data = uhid;
	301	nonseekable_open(inode, file);
	302
1ccd7a2a DH	303	return 0;
	304	}
	305
	306	static int uhid_char_release(struct inode inode, struct file file)
	307	{
ace3d861 DH	308	struct uhid_device *uhid = file->private_data;
	309	unsigned int i;
	310
d365c6cf DH	311	uhid_dev_destroy(uhid);
d365c6cf DH	312
ace3d861 DH	313	for (i = 0; i < UHID_BUFSIZE; ++i)
	314	kfree(uhid->outq[i]);
	315
	316	kfree(uhid);
	317
1ccd7a2a DH	318	return 0;
	319	}
	320
	321	static ssize_t uhid_char_read(struct file file, char __user buffer,
	322	size_t count, loff_t *ppos)
	323	{
d937ae5f DH	324	struct uhid_device *uhid = file->private_data;
	325	int ret;
	326	unsigned long flags;
	327	size_t len;
	328
	329	/* they need at least the "type" member of uhid_event */
	330	if (count < sizeof(__u32))
	331	return -EINVAL;
	332
	333	try_again:
	334	if (file->f_flags & O_NONBLOCK) {
	335	if (uhid->head == uhid->tail)
	336	return -EAGAIN;
	337	} else {
	338	ret = wait_event_interruptible(uhid->waitq,
	339	uhid->head != uhid->tail);
	340	if (ret)
	341	return ret;
	342	}
	343
	344	ret = mutex_lock_interruptible(&uhid->devlock);
	345	if (ret)
	346	return ret;
	347
	348	if (uhid->head == uhid->tail) {
	349	mutex_unlock(&uhid->devlock);
	350	goto try_again;
	351	} else {
	352	len = min(count, sizeof(**uhid->outq));
	353	if (copy_to_user(buffer, &uhid->outq[uhid->tail], len)) {
	354	ret = -EFAULT;
	355	} else {
	356	kfree(uhid->outq[uhid->tail]);
	357	uhid->outq[uhid->tail] = NULL;
	358
	359	spin_lock_irqsave(&uhid->qlock, flags);
	360	uhid->tail = (uhid->tail + 1) % UHID_BUFSIZE;
	361	spin_unlock_irqrestore(&uhid->qlock, flags);
	362	}
	363	}
	364
	365	mutex_unlock(&uhid->devlock);
	366	return ret ? ret : len;
1ccd7a2a DH	367	}
	368
	369	static ssize_t uhid_char_write(struct file file, const char __user buffer,
	370	size_t count, loff_t *ppos)
	371	{
6664ef72 DH	372	struct uhid_device *uhid = file->private_data;
	373	int ret;
	374	size_t len;
	375
	376	/* we need at least the "type" member of uhid_event */
	377	if (count < sizeof(__u32))
	378	return -EINVAL;
	379
	380	ret = mutex_lock_interruptible(&uhid->devlock);
	381	if (ret)
	382	return ret;
	383
	384	memset(&uhid->input_buf, 0, sizeof(uhid->input_buf));
	385	len = min(count, sizeof(uhid->input_buf));
	386	if (copy_from_user(&uhid->input_buf, buffer, len)) {
	387	ret = -EFAULT;
	388	goto unlock;
	389	}
	390
	391	switch (uhid->input_buf.type) {
d365c6cf DH	392	case UHID_CREATE:
	393	ret = uhid_dev_create(uhid, &uhid->input_buf);
	394	break;
	395	case UHID_DESTROY:
	396	ret = uhid_dev_destroy(uhid);
	397	break;
5e87a36a DH	398	case UHID_INPUT:
	399	ret = uhid_dev_input(uhid, &uhid->input_buf);
	400	break;
6664ef72 DH	401	default:
	402	ret = -EOPNOTSUPP;
	403	}
	404
	405	unlock:
	406	mutex_unlock(&uhid->devlock);
	407
	408	/* return "count" not "len" to not confuse the caller */
	409	return ret ? ret : count;
1ccd7a2a DH	410	}
	411
	412	static unsigned int uhid_char_poll(struct file file, poll_table wait)
	413	{
1f9dec1e DH	414	struct uhid_device *uhid = file->private_data;
	415
	416	poll_wait(file, &uhid->waitq, wait);
	417
	418	if (uhid->head != uhid->tail)
	419	return POLLIN \| POLLRDNORM;
	420
1ccd7a2a DH	421	return 0;
	422	}
	423
	424	static const struct file_operations uhid_fops = {
	425	.owner = THIS_MODULE,
	426	.open = uhid_char_open,
	427	.release = uhid_char_release,
	428	.read = uhid_char_read,
	429	.write = uhid_char_write,
	430	.poll = uhid_char_poll,
	431	.llseek = no_llseek,
	432	};
	433
	434	static struct miscdevice uhid_misc = {
	435	.fops = &uhid_fops,
	436	.minor = MISC_DYNAMIC_MINOR,
	437	.name = UHID_NAME,
	438	};
	439
	440	static int __init uhid_init(void)
	441	{
	442	return misc_register(&uhid_misc);
	443	}
	444
	445	static void __exit uhid_exit(void)
	446	{
	447	misc_deregister(&uhid_misc);
	448	}
	449
	450	module_init(uhid_init);
	451	module_exit(uhid_exit);
	452	MODULE_LICENSE("GPL");
	453	MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
	454	MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");