1// SPDX-License-Identifier: GPL-2.0-or-later
  2/*
  3 *  Copyright (c) 2001 Paul Stewart
  4 *  Copyright (c) 2001 Vojtech Pavlik
  5 *
  6 *  HID char devices, giving access to raw HID device events.
  7 */
  8
  9/*
 10 *
 11 * Should you need to contact me, the author, you can do so either by
 12 * e-mail - mail your message to Paul Stewart <stewart@wetlogic.net>
 13 */
 14
 15#include <linux/poll.h>
 16#include <linux/slab.h>
 17#include <linux/sched/signal.h>
 18#include <linux/module.h>
 19#include <linux/init.h>
 20#include <linux/input.h>
 21#include <linux/usb.h>
 22#include <linux/hid.h>
 23#include <linux/hiddev.h>
 24#include <linux/compat.h>
 25#include <linux/vmalloc.h>
 26#include <linux/nospec.h>
 27#include "usbhid.h"
 28
 29#ifdef CONFIG_USB_DYNAMIC_MINORS
 30#define HIDDEV_MINOR_BASE	0
 31#define HIDDEV_MINORS		256
 32#else
 33#define HIDDEV_MINOR_BASE	96
 34#define HIDDEV_MINORS		16
 35#endif
 36#define HIDDEV_BUFFER_SIZE	2048
 37
 38struct hiddev_list {
 39	struct hiddev_usage_ref buffer[HIDDEV_BUFFER_SIZE];
 40	int head;
 41	int tail;
 42	unsigned flags;
 43	struct fasync_struct *fasync;
 44	struct hiddev *hiddev;
 45	struct list_head node;
 46	struct mutex thread_lock;
 47};
 48
 49/*
 50 * Find a report, given the report's type and ID.  The ID can be specified
 51 * indirectly by REPORT_ID_FIRST (which returns the first report of the given
 52 * type) or by (REPORT_ID_NEXT | old_id), which returns the next report of the
 53 * given type which follows old_id.
 54 */
 55static struct hid_report *
 56hiddev_lookup_report(struct hid_device *hid, struct hiddev_report_info *rinfo)
 57{
 58	unsigned int flags = rinfo->report_id & ~HID_REPORT_ID_MASK;
 59	unsigned int rid = rinfo->report_id & HID_REPORT_ID_MASK;
 60	struct hid_report_enum *report_enum;
 61	struct hid_report *report;
 62	struct list_head *list;
 63
 64	if (rinfo->report_type < HID_REPORT_TYPE_MIN ||
 65	    rinfo->report_type > HID_REPORT_TYPE_MAX)
 66		return NULL;
 67
 68	report_enum = hid->report_enum +
 69		(rinfo->report_type - HID_REPORT_TYPE_MIN);
 70
 71	switch (flags) {
 72	case 0: /* Nothing to do -- report_id is already set correctly */
 73		break;
 74
 75	case HID_REPORT_ID_FIRST:
 76		if (list_empty(&report_enum->report_list))
 77			return NULL;
 78
 79		list = report_enum->report_list.next;
 80		report = list_entry(list, struct hid_report, list);
 81		rinfo->report_id = report->id;
 82		break;
 83
 84	case HID_REPORT_ID_NEXT:
 85		report = report_enum->report_id_hash[rid];
 86		if (!report)
 87			return NULL;
 88
 89		list = report->list.next;
 90		if (list == &report_enum->report_list)
 91			return NULL;
 92
 93		report = list_entry(list, struct hid_report, list);
 94		rinfo->report_id = report->id;
 95		break;
 96
 97	default:
 98		return NULL;
 99	}
100
101	return report_enum->report_id_hash[rinfo->report_id];
102}
103
104/*
105 * Perform an exhaustive search of the report table for a usage, given its
106 * type and usage id.
107 */
108static struct hid_field *
109hiddev_lookup_usage(struct hid_device *hid, struct hiddev_usage_ref *uref)
110{
111	int i, j;
112	struct hid_report *report;
113	struct hid_report_enum *report_enum;
114	struct hid_field *field;
115
116	if (uref->report_type < HID_REPORT_TYPE_MIN ||
117	    uref->report_type > HID_REPORT_TYPE_MAX)
118		return NULL;
119
120	report_enum = hid->report_enum +
121		(uref->report_type - HID_REPORT_TYPE_MIN);
122
123	list_for_each_entry(report, &report_enum->report_list, list) {
124		for (i = 0; i < report->maxfield; i++) {
125			field = report->field[i];
126			for (j = 0; j < field->maxusage; j++) {
127				if (field->usage[j].hid == uref->usage_code) {
128					uref->report_id = report->id;
129					uref->field_index = i;
130					uref->usage_index = j;
131					return field;
132				}
133			}
134		}
135	}
136
137	return NULL;
138}
139
140static void hiddev_send_event(struct hid_device *hid,
141			      struct hiddev_usage_ref *uref)
142{
143	struct hiddev *hiddev = hid->hiddev;
144	struct hiddev_list *list;
145	unsigned long flags;
146
147	spin_lock_irqsave(&hiddev->list_lock, flags);
148	list_for_each_entry(list, &hiddev->list, node) {
149		if (uref->field_index != HID_FIELD_INDEX_NONE ||
150		    (list->flags & HIDDEV_FLAG_REPORT) != 0) {
151			list->buffer[list->head] = *uref;
152			list->head = (list->head + 1) &
153				(HIDDEV_BUFFER_SIZE - 1);
154			kill_fasync(&list->fasync, SIGIO, POLL_IN);
155		}
156	}
157	spin_unlock_irqrestore(&hiddev->list_lock, flags);
158
159	wake_up_interruptible(&hiddev->wait);
160}
161
162/*
163 * This is where hid.c calls into hiddev to pass an event that occurred over
164 * the interrupt pipe
165 */
166void hiddev_hid_event(struct hid_device *hid, struct hid_field *field,
167		      struct hid_usage *usage, __s32 value)
168{
169	unsigned type = field->report_type;
170	struct hiddev_usage_ref uref;
171
172	uref.report_type =
173	  (type == HID_INPUT_REPORT) ? HID_REPORT_TYPE_INPUT :
174	  ((type == HID_OUTPUT_REPORT) ? HID_REPORT_TYPE_OUTPUT :
175	   ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE : 0));
176	uref.report_id = field->report->id;
177	uref.field_index = field->index;
178	uref.usage_index = (usage - field->usage);
179	uref.usage_code = usage->hid;
180	uref.value = value;
181
182	hiddev_send_event(hid, &uref);
183}
184EXPORT_SYMBOL_GPL(hiddev_hid_event);
185
186void hiddev_report_event(struct hid_device *hid, struct hid_report *report)
187{
188	unsigned type = report->type;
189	struct hiddev_usage_ref uref;
190
191	memset(&uref, 0, sizeof(uref));
192	uref.report_type =
193	  (type == HID_INPUT_REPORT) ? HID_REPORT_TYPE_INPUT :
194	  ((type == HID_OUTPUT_REPORT) ? HID_REPORT_TYPE_OUTPUT :
195	   ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE : 0));
196	uref.report_id = report->id;
197	uref.field_index = HID_FIELD_INDEX_NONE;
198
199	hiddev_send_event(hid, &uref);
200}
201
202/*
203 * fasync file op
204 */
205static int hiddev_fasync(int fd, struct file *file, int on)
206{
207	struct hiddev_list *list = file->private_data;
208
209	return fasync_helper(fd, file, on, &list->fasync);
210}
211
212
213/*
214 * release file op
215 */
216static int hiddev_release(struct inode * inode, struct file * file)
217{
218	struct hiddev_list *list = file->private_data;
219	unsigned long flags;
220
221	spin_lock_irqsave(&list->hiddev->list_lock, flags);
222	list_del(&list->node);
223	spin_unlock_irqrestore(&list->hiddev->list_lock, flags);
224
225	mutex_lock(&list->hiddev->existancelock);
226	if (!--list->hiddev->open) {
227		if (list->hiddev->exist) {
228			hid_hw_close(list->hiddev->hid);
229			hid_hw_power(list->hiddev->hid, PM_HINT_NORMAL);
230		} else {
231			mutex_unlock(&list->hiddev->existancelock);
232			kfree(list->hiddev);
233			vfree(list);
234			return 0;
235		}
236	}
237
238	mutex_unlock(&list->hiddev->existancelock);
239	vfree(list);
240
241	return 0;
242}
243
244static int __hiddev_open(struct hiddev *hiddev, struct file *file)
245{
246	struct hiddev_list *list;
247	int error;
248
249	lockdep_assert_held(&hiddev->existancelock);
250
251	list = vzalloc(sizeof(*list));
252	if (!list)
253		return -ENOMEM;
254
255	mutex_init(&list->thread_lock);
256	list->hiddev = hiddev;
257
258	if (!hiddev->open++) {
259		error = hid_hw_power(hiddev->hid, PM_HINT_FULLON);
260		if (error < 0)
261			goto err_drop_count;
262
263		error = hid_hw_open(hiddev->hid);
264		if (error < 0)
265			goto err_normal_power;
266	}
267
268	spin_lock_irq(&hiddev->list_lock);
269	list_add_tail(&list->node, &hiddev->list);
270	spin_unlock_irq(&hiddev->list_lock);
271
272	file->private_data = list;
273
274	return 0;
275
276err_normal_power:
277	hid_hw_power(hiddev->hid, PM_HINT_NORMAL);
278err_drop_count:
279	hiddev->open--;
280	vfree(list);
281	return error;
282}
283
284/*
285 * open file op
286 */
287static int hiddev_open(struct inode *inode, struct file *file)
288{
289	struct usb_interface *intf;
290	struct hid_device *hid;
291	struct hiddev *hiddev;
292	int res;
293
294	intf = usbhid_find_interface(iminor(inode));
295	if (!intf)
296		return -ENODEV;
297
298	hid = usb_get_intfdata(intf);
299	hiddev = hid->hiddev;
300
301	mutex_lock(&hiddev->existancelock);
302	res = hiddev->exist ? __hiddev_open(hiddev, file) : -ENODEV;
303	mutex_unlock(&hiddev->existancelock);
304
305	return res;
306}
307
308/*
309 * "write" file op
310 */
311static ssize_t hiddev_write(struct file * file, const char __user * buffer, size_t count, loff_t *ppos)
312{
313	return -EINVAL;
314}
315
316/*
317 * "read" file op
318 */
319static ssize_t hiddev_read(struct file * file, char __user * buffer, size_t count, loff_t *ppos)
320{
321	DEFINE_WAIT(wait);
322	struct hiddev_list *list = file->private_data;
323	int event_size;
324	int retval;
325
326	event_size = ((list->flags & HIDDEV_FLAG_UREF) != 0) ?
327		sizeof(struct hiddev_usage_ref) : sizeof(struct hiddev_event);
328
329	if (count < event_size)
330		return 0;
331
332	/* lock against other threads */
333	retval = mutex_lock_interruptible(&list->thread_lock);
334	if (retval)
335		return -ERESTARTSYS;
336
337	while (retval == 0) {
338		if (list->head == list->tail) {
339			prepare_to_wait(&list->hiddev->wait, &wait, TASK_INTERRUPTIBLE);
340
341			while (list->head == list->tail) {
342				if (signal_pending(current)) {
343					retval = -ERESTARTSYS;
344					break;
345				}
346				if (!list->hiddev->exist) {
347					retval = -EIO;
348					break;
349				}
350				if (file->f_flags & O_NONBLOCK) {
351					retval = -EAGAIN;
352					break;
353				}
354
355				/* let O_NONBLOCK tasks run */
356				mutex_unlock(&list->thread_lock);
357				schedule();
358				if (mutex_lock_interruptible(&list->thread_lock)) {
359					finish_wait(&list->hiddev->wait, &wait);
360					return -EINTR;
361				}
362				set_current_state(TASK_INTERRUPTIBLE);
363			}
364			finish_wait(&list->hiddev->wait, &wait);
365
366		}
367
368		if (retval) {
369			mutex_unlock(&list->thread_lock);
370			return retval;
371		}
372
373
374		while (list->head != list->tail &&
375		       retval + event_size <= count) {
376			if ((list->flags & HIDDEV_FLAG_UREF) == 0) {
377				if (list->buffer[list->tail].field_index != HID_FIELD_INDEX_NONE) {
378					struct hiddev_event event;
379
380					event.hid = list->buffer[list->tail].usage_code;
381					event.value = list->buffer[list->tail].value;
382					if (copy_to_user(buffer + retval, &event, sizeof(struct hiddev_event))) {
383						mutex_unlock(&list->thread_lock);
384						return -EFAULT;
385					}
386					retval += sizeof(struct hiddev_event);
387				}
388			} else {
389				if (list->buffer[list->tail].field_index != HID_FIELD_INDEX_NONE ||
390				    (list->flags & HIDDEV_FLAG_REPORT) != 0) {
391
392					if (copy_to_user(buffer + retval, list->buffer + list->tail, sizeof(struct hiddev_usage_ref))) {
393						mutex_unlock(&list->thread_lock);
394						return -EFAULT;
395					}
396					retval += sizeof(struct hiddev_usage_ref);
397				}
398			}
399			list->tail = (list->tail + 1) & (HIDDEV_BUFFER_SIZE - 1);
400		}
401
402	}
403	mutex_unlock(&list->thread_lock);
404
405	return retval;
406}
407
408/*
409 * "poll" file op
410 * No kernel lock - fine
411 */
412static __poll_t hiddev_poll(struct file *file, poll_table *wait)
413{
414	struct hiddev_list *list = file->private_data;
415
416	poll_wait(file, &list->hiddev->wait, wait);
417	if (list->head != list->tail)
418		return EPOLLIN | EPOLLRDNORM | EPOLLOUT;
419	if (!list->hiddev->exist)
420		return EPOLLERR | EPOLLHUP;
421	return 0;
422}
423
424/*
425 * "ioctl" file op
426 */
427static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, void __user *user_arg)
428{
429	struct hid_device *hid = hiddev->hid;
430	struct hiddev_report_info rinfo;
431	struct hiddev_usage_ref_multi *uref_multi = NULL;
432	struct hiddev_usage_ref *uref;
433	struct hid_report *report;
434	struct hid_field *field;
435	int i;
436
437	uref_multi = kmalloc(sizeof(struct hiddev_usage_ref_multi), GFP_KERNEL);
438	if (!uref_multi)
439		return -ENOMEM;
440	uref = &uref_multi->uref;
441	if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
442		if (copy_from_user(uref_multi, user_arg,
443				   sizeof(*uref_multi)))
444			goto fault;
445	} else {
446		if (copy_from_user(uref, user_arg, sizeof(*uref)))
447			goto fault;
448	}
449
450	switch (cmd) {
451	case HIDIOCGUCODE:
452		rinfo.report_type = uref->report_type;
453		rinfo.report_id = uref->report_id;
454		if ((report = hiddev_lookup_report(hid, &rinfo)) == NULL)
455			goto inval;
456
457		if (uref->field_index >= report->maxfield)
458			goto inval;
459		uref->field_index = array_index_nospec(uref->field_index,
460						       report->maxfield);
461
462		field = report->field[uref->field_index];
463		if (uref->usage_index >= field->maxusage)
464			goto inval;
465		uref->usage_index = array_index_nospec(uref->usage_index,
466						       field->maxusage);
467
468		uref->usage_code = field->usage[uref->usage_index].hid;
469
470		if (copy_to_user(user_arg, uref, sizeof(*uref)))
471			goto fault;
472
473		goto goodreturn;
474
475	default:
476		if (cmd != HIDIOCGUSAGE &&
477		    cmd != HIDIOCGUSAGES &&
478		    uref->report_type == HID_REPORT_TYPE_INPUT)
479			goto inval;
480
481		if (uref->report_id == HID_REPORT_ID_UNKNOWN) {
482			field = hiddev_lookup_usage(hid, uref);
483			if (field == NULL)
484				goto inval;
485		} else {
486			rinfo.report_type = uref->report_type;
487			rinfo.report_id = uref->report_id;
488			if ((report = hiddev_lookup_report(hid, &rinfo)) == NULL)
489				goto inval;
490
491			if (uref->field_index >= report->maxfield)
492				goto inval;
493			uref->field_index = array_index_nospec(uref->field_index,
494							       report->maxfield);
495
496			field = report->field[uref->field_index];
497
498			if (cmd == HIDIOCGCOLLECTIONINDEX) {
499				if (uref->usage_index >= field->maxusage)
500					goto inval;
501				uref->usage_index =
502					array_index_nospec(uref->usage_index,
503							   field->maxusage);
504			} else if (uref->usage_index >= field->report_count)
505				goto inval;
506		}
507
508		if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
509			if (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
510			    uref->usage_index + uref_multi->num_values >
511			    field->report_count)
512				goto inval;
513
514			uref->usage_index =
515				array_index_nospec(uref->usage_index,
516						   field->report_count -
517						   uref_multi->num_values);
518		}
519
520		switch (cmd) {
521		case HIDIOCGUSAGE:
522			if (uref->usage_index >= field->report_count)
523				goto inval;
524			uref->value = field->value[uref->usage_index];
525			if (copy_to_user(user_arg, uref, sizeof(*uref)))
526				goto fault;
527			goto goodreturn;
528
529		case HIDIOCSUSAGE:
530			if (uref->usage_index >= field->report_count)
531				goto inval;
532			field->value[uref->usage_index] = uref->value;
533			goto goodreturn;
534
535		case HIDIOCGCOLLECTIONINDEX:
536			i = field->usage[uref->usage_index].collection_index;
537			kfree(uref_multi);
538			return i;
539		case HIDIOCGUSAGES:
540			for (i = 0; i < uref_multi->num_values; i++)
541				uref_multi->values[i] =
542				    field->value[uref->usage_index + i];
543			if (copy_to_user(user_arg, uref_multi,
544					 sizeof(*uref_multi)))
545				goto fault;
546			goto goodreturn;
547		case HIDIOCSUSAGES:
548			for (i = 0; i < uref_multi->num_values; i++)
549				field->value[uref->usage_index + i] =
550				    uref_multi->values[i];
551			goto goodreturn;
552		}
553
554goodreturn:
555		kfree(uref_multi);
556		return 0;
557fault:
558		kfree(uref_multi);
559		return -EFAULT;
560inval:
561		kfree(uref_multi);
562		return -EINVAL;
563	}
564}
565
566static noinline int hiddev_ioctl_string(struct hiddev *hiddev, unsigned int cmd, void __user *user_arg)
567{
568	struct hid_device *hid = hiddev->hid;
569	struct usb_device *dev = hid_to_usb_dev(hid);
570	int idx, len;
571	char *buf;
572
573	if (get_user(idx, (int __user *)user_arg))
574		return -EFAULT;
575
576	if ((buf = kmalloc(HID_STRING_SIZE, GFP_KERNEL)) == NULL)
577		return -ENOMEM;
578
579	if ((len = usb_string(dev, idx, buf, HID_STRING_SIZE-1)) < 0) {
580		kfree(buf);
581		return -EINVAL;
582	}
583
584	if (copy_to_user(user_arg+sizeof(int), buf, len+1)) {
585		kfree(buf);
586		return -EFAULT;
587	}
588
589	kfree(buf);
590
591	return len;
592}
593
594static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
595{
596	struct hiddev_list *list = file->private_data;
597	struct hiddev *hiddev = list->hiddev;
598	struct hid_device *hid;
599	struct hiddev_collection_info cinfo;
600	struct hiddev_report_info rinfo;
601	struct hiddev_field_info finfo;
602	struct hiddev_devinfo dinfo;
603	struct hid_report *report;
604	struct hid_field *field;
605	void __user *user_arg = (void __user *)arg;
606	int i, r = -EINVAL;
607
608	/* Called without BKL by compat methods so no BKL taken */
609
610	mutex_lock(&hiddev->existancelock);
611	if (!hiddev->exist) {
612		r = -ENODEV;
613		goto ret_unlock;
614	}
615
616	hid = hiddev->hid;
617
618	switch (cmd) {
619
620	case HIDIOCGVERSION:
621		r = put_user(HID_VERSION, (int __user *)arg) ?
622			-EFAULT : 0;
623		break;
624
625	case HIDIOCAPPLICATION:
626		if (arg >= hid->maxapplication)
627			break;
628
629		for (i = 0; i < hid->maxcollection; i++)
630			if (hid->collection[i].type ==
631			    HID_COLLECTION_APPLICATION && arg-- == 0)
632				break;
633
634		if (i < hid->maxcollection)
635			r = hid->collection[i].usage;
636		break;
637
638	case HIDIOCGDEVINFO:
639		{
640			struct usb_device *dev = hid_to_usb_dev(hid);
641			struct usbhid_device *usbhid = hid->driver_data;
642
643			memset(&dinfo, 0, sizeof(dinfo));
644
645			dinfo.bustype = BUS_USB;
646			dinfo.busnum = dev->bus->busnum;
647			dinfo.devnum = dev->devnum;
648			dinfo.ifnum = usbhid->ifnum;
649			dinfo.vendor = le16_to_cpu(dev->descriptor.idVendor);
650			dinfo.product = le16_to_cpu(dev->descriptor.idProduct);
651			dinfo.version = le16_to_cpu(dev->descriptor.bcdDevice);
652			dinfo.num_applications = hid->maxapplication;
653
654			r = copy_to_user(user_arg, &dinfo, sizeof(dinfo)) ?
655				-EFAULT : 0;
656			break;
657		}
658
659	case HIDIOCGFLAG:
660		r = put_user(list->flags, (int __user *)arg) ?
661			-EFAULT : 0;
662		break;
663
664	case HIDIOCSFLAG:
665		{
666			int newflags;
667
668			if (get_user(newflags, (int __user *)arg)) {
669				r = -EFAULT;
670				break;
671			}
672
673			if ((newflags & ~HIDDEV_FLAGS) != 0 ||
674			    ((newflags & HIDDEV_FLAG_REPORT) != 0 &&
675			     (newflags & HIDDEV_FLAG_UREF) == 0))
676				break;
677
678			list->flags = newflags;
679
680			r = 0;
681			break;
682		}
683
684	case HIDIOCGSTRING:
685		r = hiddev_ioctl_string(hiddev, cmd, user_arg);
686		break;
687
688	case HIDIOCINITREPORT:
689		usbhid_init_reports(hid);
690		hiddev->initialized = true;
691		r = 0;
692		break;
693
694	case HIDIOCGREPORT:
695		if (copy_from_user(&rinfo, user_arg, sizeof(rinfo))) {
696			r = -EFAULT;
697			break;
698		}
699
700		if (rinfo.report_type == HID_REPORT_TYPE_OUTPUT)
701			break;
702
703		report = hiddev_lookup_report(hid, &rinfo);
704		if (report == NULL)
705			break;
706
707		hid_hw_request(hid, report, HID_REQ_GET_REPORT);
708		hid_hw_wait(hid);
709
710		r = 0;
711		break;
712
713	case HIDIOCSREPORT:
714		if (copy_from_user(&rinfo, user_arg, sizeof(rinfo))) {
715			r = -EFAULT;
716			break;
717		}
718
719		if (rinfo.report_type == HID_REPORT_TYPE_INPUT)
720			break;
721
722		report = hiddev_lookup_report(hid, &rinfo);
723		if (report == NULL)
724			break;
725
726		hid_hw_request(hid, report, HID_REQ_SET_REPORT);
727		hid_hw_wait(hid);
728
729		r = 0;
730		break;
731
732	case HIDIOCGREPORTINFO:
733		if (copy_from_user(&rinfo, user_arg, sizeof(rinfo))) {
734			r = -EFAULT;
735			break;
736		}
737
738		report = hiddev_lookup_report(hid, &rinfo);
739		if (report == NULL)
740			break;
741
742		rinfo.num_fields = report->maxfield;
743
744		r = copy_to_user(user_arg, &rinfo, sizeof(rinfo)) ?
745			-EFAULT : 0;
746		break;
747
748	case HIDIOCGFIELDINFO:
749		if (copy_from_user(&finfo, user_arg, sizeof(finfo))) {
750			r = -EFAULT;
751			break;
752		}
753
754		rinfo.report_type = finfo.report_type;
755		rinfo.report_id = finfo.report_id;
756
757		report = hiddev_lookup_report(hid, &rinfo);
758		if (report == NULL)
759			break;
760
761		if (finfo.field_index >= report->maxfield)
762			break;
763		finfo.field_index = array_index_nospec(finfo.field_index,
764						       report->maxfield);
765
766		field = report->field[finfo.field_index];
767		memset(&finfo, 0, sizeof(finfo));
768		finfo.report_type = rinfo.report_type;
769		finfo.report_id = rinfo.report_id;
770		finfo.field_index = field->report_count - 1;
771		finfo.maxusage = field->maxusage;
772		finfo.flags = field->flags;
773		finfo.physical = field->physical;
774		finfo.logical = field->logical;
775		finfo.application = field->application;
776		finfo.logical_minimum = field->logical_minimum;
777		finfo.logical_maximum = field->logical_maximum;
778		finfo.physical_minimum = field->physical_minimum;
779		finfo.physical_maximum = field->physical_maximum;
780		finfo.unit_exponent = field->unit_exponent;
781		finfo.unit = field->unit;
782
783		r = copy_to_user(user_arg, &finfo, sizeof(finfo)) ?
784			-EFAULT : 0;
785		break;
786
787	case HIDIOCGUCODE:
788	case HIDIOCGUSAGE:
789	case HIDIOCSUSAGE:
790	case HIDIOCGUSAGES:
791	case HIDIOCSUSAGES:
792	case HIDIOCGCOLLECTIONINDEX:
793		if (!hiddev->initialized) {
794			usbhid_init_reports(hid);
795			hiddev->initialized = true;
796		}
797		r = hiddev_ioctl_usage(hiddev, cmd, user_arg);
798		break;
799
800	case HIDIOCGCOLLECTIONINFO:
801		if (copy_from_user(&cinfo, user_arg, sizeof(cinfo))) {
802			r = -EFAULT;
803			break;
804		}
805
806		if (cinfo.index >= hid->maxcollection)
807			break;
808		cinfo.index = array_index_nospec(cinfo.index,
809						 hid->maxcollection);
810
811		cinfo.type = hid->collection[cinfo.index].type;
812		cinfo.usage = hid->collection[cinfo.index].usage;
813		cinfo.level = hid->collection[cinfo.index].level;
814
815		r = copy_to_user(user_arg, &cinfo, sizeof(cinfo)) ?
816			-EFAULT : 0;
817		break;
818
819	default:
820		if (_IOC_TYPE(cmd) != 'H' || _IOC_DIR(cmd) != _IOC_READ)
821			break;
822
823		if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGNAME(0))) {
824			int len = strlen(hid->name) + 1;
825			if (len > _IOC_SIZE(cmd))
826				 len = _IOC_SIZE(cmd);
827			r = copy_to_user(user_arg, hid->name, len) ?
828				-EFAULT : len;
829			break;
830		}
831
832		if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGPHYS(0))) {
833			int len = strlen(hid->phys) + 1;
834			if (len > _IOC_SIZE(cmd))
835				len = _IOC_SIZE(cmd);
836			r = copy_to_user(user_arg, hid->phys, len) ?
837				-EFAULT : len;
838			break;
839		}
840	}
841
842ret_unlock:
843	mutex_unlock(&hiddev->existancelock);
844	return r;
845}
846
847static const struct file_operations hiddev_fops = {
848	.owner =	THIS_MODULE,
849	.read =		hiddev_read,
850	.write =	hiddev_write,
851	.poll =		hiddev_poll,
852	.open =		hiddev_open,
853	.release =	hiddev_release,
854	.unlocked_ioctl =	hiddev_ioctl,
855	.fasync =	hiddev_fasync,
856	.compat_ioctl	= compat_ptr_ioctl,
857	.llseek		= noop_llseek,
858};
859
860static char *hiddev_devnode(const struct device *dev, umode_t *mode)
861{
862	return kasprintf(GFP_KERNEL, "usb/%s", dev_name(dev));
863}
864
865static struct usb_class_driver hiddev_class = {
866	.name =		"hiddev%d",
867	.devnode =	hiddev_devnode,
868	.fops =		&hiddev_fops,
869	.minor_base =	HIDDEV_MINOR_BASE,
870};
871
872/*
873 * This is where hid.c calls us to connect a hid device to the hiddev driver
874 */
875int hiddev_connect(struct hid_device *hid, unsigned int force)
876{
877	struct hiddev *hiddev;
878	struct usbhid_device *usbhid = hid->driver_data;
879	int retval;
880
881	if (!force) {
882		unsigned int i;
883		for (i = 0; i < hid->maxcollection; i++)
884			if (hid->collection[i].type ==
885			    HID_COLLECTION_APPLICATION &&
886			    !IS_INPUT_APPLICATION(hid->collection[i].usage))
887				break;
888
889		if (i == hid->maxcollection)
890			return -EINVAL;
891	}
892
893	if (!(hiddev = kzalloc(sizeof(struct hiddev), GFP_KERNEL)))
894		return -ENOMEM;
895
896	init_waitqueue_head(&hiddev->wait);
897	INIT_LIST_HEAD(&hiddev->list);
898	spin_lock_init(&hiddev->list_lock);
899	mutex_init(&hiddev->existancelock);
900	hid->hiddev = hiddev;
901	hiddev->hid = hid;
902	hiddev->exist = 1;
903	retval = usb_register_dev(usbhid->intf, &hiddev_class);
904	if (retval) {
905		hid_err(hid, "Not able to get a minor for this device\n");
906		hid->hiddev = NULL;
907		kfree(hiddev);
908		return retval;
909	}
910
911	/*
912	 * If HID_QUIRK_NO_INIT_REPORTS is set, make sure we don't initialize
913	 * the reports.
914	 */
915	hiddev->initialized = hid->quirks & HID_QUIRK_NO_INIT_REPORTS;
916
917	hiddev->minor = usbhid->intf->minor;
918
919	return 0;
920}
921
922/*
923 * This is where hid.c calls us to disconnect a hiddev device from the
924 * corresponding hid device (usually because the usb device has disconnected)
925 */
926static struct usb_class_driver hiddev_class;
927void hiddev_disconnect(struct hid_device *hid)
928{
929	struct hiddev *hiddev = hid->hiddev;
930	struct usbhid_device *usbhid = hid->driver_data;
931
932	usb_deregister_dev(usbhid->intf, &hiddev_class);
933
934	mutex_lock(&hiddev->existancelock);
935	hiddev->exist = 0;
936
937	if (hiddev->open) {
938		hid_hw_close(hiddev->hid);
939		wake_up_interruptible(&hiddev->wait);
940		mutex_unlock(&hiddev->existancelock);
941	} else {
942		mutex_unlock(&hiddev->existancelock);
943		kfree(hiddev);
944	}
945}