projects/linux·blob master · refs

1171 lines · 26.5 KiB

1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * User level driver support for input subsystem
4 *
5 * Heavily based on evdev.c by Vojtech Pavlik
6 *
7 * Author: Aristeu Sergio Rozanski Filho <[email protected]>
8 *
9 * Changes/Revisions:
10 * 0.4 01/09/2014 (Benjamin Tissoires <[email protected]>)
11 * - add UI_GET_SYSNAME ioctl
12 * 0.3 09/04/2006 (Anssi Hannula <[email protected]>)
13 * - updated ff support for the changes in kernel interface
14 * - added MODULE_VERSION
15 * 0.2 16/10/2004 (Micah Dowty <[email protected]>)
16 * - added force feedback support
17 * - added UI_SET_PHYS
18 * 0.1 20/06/2002
19 * - first public version
20 */
21#include <uapi/linux/uinput.h>
22#include <linux/poll.h>
23#include <linux/sched.h>
24#include <linux/slab.h>
25#include <linux/module.h>
26#include <linux/init.h>
27#include <linux/fs.h>
28#include <linux/lockdep.h>
29#include <linux/miscdevice.h>
30#include <linux/overflow.h>
31#include <linux/spinlock.h>
32#include <linux/input/mt.h>
33#include "../input-compat.h"
34
35#define UINPUT_NAME "uinput"
36#define UINPUT_BUFFER_SIZE 16
37#define UINPUT_NUM_REQUESTS 16
38#define UINPUT_TIMESTAMP_ALLOWED_OFFSET_SECS 10
39
40enum uinput_state { UIST_NEW_DEVICE, UIST_SETUP_COMPLETE, UIST_CREATED };
41
42struct uinput_request {
43 unsigned int id;
44 unsigned int code; /* UI_FF_UPLOAD, UI_FF_ERASE */
45
46 int retval;
47 struct completion done;
48
49 union {
50 unsigned int effect_id;
51 struct {
52 struct ff_effect *effect;
53 struct ff_effect *old;
54 } upload;
55 } u;
56};
57
58struct uinput_device {
59 struct input_dev *dev;
60 struct mutex mutex;
61 enum uinput_state state;
62 spinlock_t state_lock;
63 wait_queue_head_t waitq;
64 unsigned char ready;
65 unsigned char head;
66 unsigned char tail;
67 struct input_event buff[UINPUT_BUFFER_SIZE];
68 unsigned int ff_effects_max;
69
70 struct uinput_request *requests[UINPUT_NUM_REQUESTS];
71 wait_queue_head_t requests_waitq;
72 spinlock_t requests_lock;
73};
74
75static int uinput_dev_event(struct input_dev *dev,
76 unsigned int type, unsigned int code, int value)
77{
78 struct uinput_device *udev = input_get_drvdata(dev);
79 struct timespec64 ts;
80
81 lockdep_assert_held(&dev->event_lock);
82
83 ktime_get_ts64(&ts);
84
85 udev->buff[udev->head] = (struct input_event) {
86 .input_event_sec = ts.tv_sec,
87 .input_event_usec = ts.tv_nsec / NSEC_PER_USEC,
88 .type = type,
89 .code = code,
90 .value = value,
91 };
92
93 udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE;
94
95 wake_up_interruptible(&udev->waitq);
96
97 return 0;
98}
99
100/* Atomically allocate an ID for the given request. Returns 0 on success. */
101static bool uinput_request_alloc_id(struct uinput_device *udev,
102 struct uinput_request *request)
103{
104 unsigned int id;
105 bool reserved = false;
106
107 spin_lock(&udev->requests_lock);
108
109 for (id = 0; id < UINPUT_NUM_REQUESTS; id++) {
110 if (!udev->requests[id]) {
111 request->id = id;
112 udev->requests[id] = request;
113 reserved = true;
114 break;
115 }
116 }
117
118 spin_unlock(&udev->requests_lock);
119 return reserved;
120}
121
122static struct uinput_request *uinput_request_find(struct uinput_device *udev,
123 unsigned int id)
124{
125 /* Find an input request, by ID. Returns NULL if the ID isn't valid. */
126 if (id >= UINPUT_NUM_REQUESTS)
127 return NULL;
128
129 return udev->requests[id];
130}
131
132static int uinput_request_reserve_slot(struct uinput_device *udev,
133 struct uinput_request *request)
134{
135 /* Allocate slot. If none are available right away, wait. */
136 return wait_event_interruptible(udev->requests_waitq,
137 uinput_request_alloc_id(udev, request));
138}
139
140static void uinput_request_release_slot(struct uinput_device *udev,
141 unsigned int id)
142{
143 /* Mark slot as available */
144 spin_lock(&udev->requests_lock);
145 udev->requests[id] = NULL;
146 spin_unlock(&udev->requests_lock);
147
148 wake_up(&udev->requests_waitq);
149}
150
151static int uinput_request_send(struct uinput_device *udev,
152 struct uinput_request *request)
153{
154 unsigned long flags;
155 int retval = 0;
156
157 spin_lock(&udev->state_lock);
158
159 if (udev->state != UIST_CREATED) {
160 retval = -ENODEV;
161 goto out;
162 }
163
164 /*
165 * Tell our userspace application about this new request
166 * by queueing an input event.
167 */
168 spin_lock_irqsave(&udev->dev->event_lock, flags);
169 uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id);
170 spin_unlock_irqrestore(&udev->dev->event_lock, flags);
171
172 out:
173 spin_unlock(&udev->state_lock);
174 return retval;
175}
176
177static int uinput_request_submit(struct uinput_device *udev,
178 struct uinput_request *request)
179{
180 int retval;
181
182 /*
183 * Initialize completion before allocating the request slot.
184 * Once the slot is allocated, uinput_flush_requests() may
185 * complete it at any time, so it must be initialized first.
186 */
187 init_completion(&request->done);
188
189 retval = uinput_request_reserve_slot(udev, request);
190 if (retval)
191 return retval;
192
193 retval = uinput_request_send(udev, request);
194 if (retval)
195 goto out;
196
197 if (!wait_for_completion_timeout(&request->done, 30 * HZ)) {
198 retval = -ETIMEDOUT;
199 goto out;
200 }
201
202 retval = request->retval;
203
204 out:
205 uinput_request_release_slot(udev, request->id);
206 return retval;
207}
208
209/*
210 * Fail all outstanding requests so handlers don't wait for the userspace
211 * to finish processing them.
212 */
213static void uinput_flush_requests(struct uinput_device *udev)
214{
215 struct uinput_request *request;
216 int i;
217
218 spin_lock(&udev->requests_lock);
219
220 for (i = 0; i < UINPUT_NUM_REQUESTS; i++) {
221 request = udev->requests[i];
222 if (request) {
223 request->retval = -ENODEV;
224 complete(&request->done);
225 }
226 }
227
228 spin_unlock(&udev->requests_lock);
229}
230
231static void uinput_dev_set_gain(struct input_dev *dev, u16 gain)
232{
233 uinput_dev_event(dev, EV_FF, FF_GAIN, gain);
234}
235
236static void uinput_dev_set_autocenter(struct input_dev *dev, u16 magnitude)
237{
238 uinput_dev_event(dev, EV_FF, FF_AUTOCENTER, magnitude);
239}
240
241static int uinput_dev_playback(struct input_dev *dev, int effect_id, int value)
242{
243 return uinput_dev_event(dev, EV_FF, effect_id, value);
244}
245
246static int uinput_dev_upload_effect(struct input_dev *dev,
247 struct ff_effect *effect,
248 struct ff_effect *old)
249{
250 struct uinput_device *udev = input_get_drvdata(dev);
251 struct uinput_request request;
252
253 /*
254 * uinput driver does not currently support periodic effects with
255 * custom waveform since it does not have a way to pass buffer of
256 * samples (custom_data) to userspace. If ever there is a device
257 * supporting custom waveforms we would need to define an additional
258 * ioctl (UI_UPLOAD_SAMPLES) but for now we just bail out.
259 */
260 if (effect->type == FF_PERIODIC &&
261 effect->u.periodic.waveform == FF_CUSTOM)
262 return -EINVAL;
263
264 request.code = UI_FF_UPLOAD;
265 request.u.upload.effect = effect;
266 request.u.upload.old = old;
267
268 return uinput_request_submit(udev, &request);
269}
270
271static int uinput_dev_erase_effect(struct input_dev *dev, int effect_id)
272{
273 struct uinput_device *udev = input_get_drvdata(dev);
274 struct uinput_request request;
275
276 if (!test_bit(EV_FF, dev->evbit))
277 return -ENOSYS;
278
279 request.code = UI_FF_ERASE;
280 request.u.effect_id = effect_id;
281
282 return uinput_request_submit(udev, &request);
283}
284
285static int uinput_dev_flush(struct input_dev *dev, struct file *file)
286{
287 /*
288 * If we are called with file == NULL that means we are tearing
289 * down the device, and therefore we can not handle FF erase
290 * requests: either we are handling UI_DEV_DESTROY (and holding
291 * the udev->mutex), or the file descriptor is closed and there is
292 * nobody on the other side anymore.
293 */
294 return file ? input_ff_flush(dev, file) : 0;
295}
296
297static void uinput_destroy_device(struct uinput_device *udev)
298{
299 const char *name, *phys;
300 struct input_dev *dev = udev->dev;
301 enum uinput_state old_state = udev->state;
302
303 /*
304 * Update state under state_lock so that concurrent
305 * uinput_request_send() sees the state change before we
306 * flush pending requests and tear down the device.
307 */
308 spin_lock(&udev->state_lock);
309 udev->state = UIST_NEW_DEVICE;
310 spin_unlock(&udev->state_lock);
311
312 if (dev) {
313 name = dev->name;
314 phys = dev->phys;
315 if (old_state == UIST_CREATED) {
316 uinput_flush_requests(udev);
317 input_unregister_device(dev);
318 } else {
319 input_free_device(dev);
320 }
321 kfree(name);
322 kfree(phys);
323 udev->dev = NULL;
324 }
325}
326
327static int uinput_create_device(struct uinput_device *udev)
328{
329 struct input_dev *dev = udev->dev;
330 int error, nslot;
331
332 if (udev->state != UIST_SETUP_COMPLETE) {
333 printk(KERN_DEBUG "%s: write device info first\n", UINPUT_NAME);
334 return -EINVAL;
335 }
336
337 if (test_bit(EV_ABS, dev->evbit)) {
338 input_alloc_absinfo(dev);
339 if (!dev->absinfo) {
340 error = -EINVAL;
341 goto fail1;
342 }
343
344 if (test_bit(ABS_MT_SLOT, dev->absbit)) {
345 nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
346 error = input_mt_init_slots(dev, nslot, 0);
347 if (error)
348 goto fail1;
349 } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
350 input_set_events_per_packet(dev, 60);
351 }
352 }
353
354 if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) {
355 printk(KERN_DEBUG "%s: ff_effects_max should be non-zero when FF_BIT is set\n",
356 UINPUT_NAME);
357 error = -EINVAL;
358 goto fail1;
359 }
360
361 if (udev->ff_effects_max) {
362 error = input_ff_create(dev, udev->ff_effects_max);
363 if (error)
364 goto fail1;
365
366 dev->ff->upload = uinput_dev_upload_effect;
367 dev->ff->erase = uinput_dev_erase_effect;
368 dev->ff->playback = uinput_dev_playback;
369 dev->ff->set_gain = uinput_dev_set_gain;
370 dev->ff->set_autocenter = uinput_dev_set_autocenter;
371 /*
372 * The standard input_ff_flush() implementation does
373 * not quite work for uinput as we can't reasonably
374 * handle FF requests during device teardown.
375 */
376 dev->flush = uinput_dev_flush;
377 }
378
379 dev->event = uinput_dev_event;
380
381 input_set_drvdata(udev->dev, udev);
382
383 error = input_register_device(udev->dev);
384 if (error)
385 goto fail2;
386
387 spin_lock(&udev->state_lock);
388 udev->state = UIST_CREATED;
389 spin_unlock(&udev->state_lock);
390
391 return 0;
392
393 fail2: input_ff_destroy(dev);
394 fail1: uinput_destroy_device(udev);
395 return error;
396}
397
398static int uinput_open(struct inode *inode, struct file *file)
399{
400 struct uinput_device *newdev;
401
402 newdev = kzalloc_obj(*newdev);
403 if (!newdev)
404 return -ENOMEM;
405
406 mutex_init(&newdev->mutex);
407 spin_lock_init(&newdev->state_lock);
408 spin_lock_init(&newdev->requests_lock);
409 init_waitqueue_head(&newdev->requests_waitq);
410 init_waitqueue_head(&newdev->waitq);
411 newdev->state = UIST_NEW_DEVICE;
412
413 file->private_data = newdev;
414 stream_open(inode, file);
415
416 return 0;
417}
418
419static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
420 const struct input_absinfo *abs)
421{
422 int min, max, range;
423
424 min = abs->minimum;
425 max = abs->maximum;
426
427 if ((min != 0 || max != 0) && max < min) {
428 printk(KERN_DEBUG
429 "%s: invalid abs[%02x] min:%d max:%d\n",
430 UINPUT_NAME, code, min, max);
431 return -EINVAL;
432 }
433
434 if (!check_sub_overflow(max, min, &range) && abs->flat > range) {
435 printk(KERN_DEBUG
436 "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n",
437 UINPUT_NAME, code, abs->flat, min, max);
438 return -EINVAL;
439 }
440
441 /*
442 * Limit number of contacts to a reasonable value (100). This
443 * ensures that we need less than 2 pages for struct input_mt
444 * (we are not using in-kernel slot assignment so not going to
445 * allocate memory for the "red" table), and we should have no
446 * trouble getting this much memory.
447 */
448 if (code == ABS_MT_SLOT && max > 99) {
449 printk(KERN_DEBUG
450 "%s: unreasonably large number of slots requested: %d\n",
451 UINPUT_NAME, max);
452 return -EINVAL;
453 }
454
455 return 0;
456}
457
458static int uinput_validate_absbits(struct input_dev *dev)
459{
460 unsigned int cnt;
461 int error;
462
463 if (!test_bit(EV_ABS, dev->evbit))
464 return 0;
465
466 /*
467 * Check if absmin/absmax/absfuzz/absflat are sane.
468 */
469
470 for_each_set_bit(cnt, dev->absbit, ABS_CNT) {
471 if (!dev->absinfo)
472 return -EINVAL;
473
474 error = uinput_validate_absinfo(dev, cnt, &dev->absinfo[cnt]);
475 if (error)
476 return error;
477 }
478
479 return 0;
480}
481
482static int uinput_dev_setup(struct uinput_device *udev,
483 struct uinput_setup __user *arg)
484{
485 struct uinput_setup setup;
486 struct input_dev *dev;
487
488 if (udev->state == UIST_CREATED)
489 return -EINVAL;
490
491 if (copy_from_user(&setup, arg, sizeof(setup)))
492 return -EFAULT;
493
494 if (!setup.name[0])
495 return -EINVAL;
496
497 dev = udev->dev;
498 dev->id = setup.id;
499 udev->ff_effects_max = setup.ff_effects_max;
500
501 kfree(dev->name);
502 dev->name = kstrndup(setup.name, UINPUT_MAX_NAME_SIZE, GFP_KERNEL);
503 if (!dev->name)
504 return -ENOMEM;
505
506 udev->state = UIST_SETUP_COMPLETE;
507 return 0;
508}
509
510static int uinput_abs_setup(struct uinput_device *udev,
511 struct uinput_setup __user *arg, size_t size)
512{
513 struct uinput_abs_setup setup = {};
514 struct input_dev *dev;
515 int error;
516
517 if (size > sizeof(setup))
518 return -E2BIG;
519
520 if (udev->state == UIST_CREATED)
521 return -EINVAL;
522
523 if (copy_from_user(&setup, arg, size))
524 return -EFAULT;
525
526 if (setup.code > ABS_MAX)
527 return -ERANGE;
528
529 dev = udev->dev;
530
531 error = uinput_validate_absinfo(dev, setup.code, &setup.absinfo);
532 if (error)
533 return error;
534
535 input_alloc_absinfo(dev);
536 if (!dev->absinfo)
537 return -ENOMEM;
538
539 set_bit(setup.code, dev->absbit);
540 dev->absinfo[setup.code] = setup.absinfo;
541 return 0;
542}
543
544/* legacy setup via write() */
545static int uinput_setup_device_legacy(struct uinput_device *udev,
546 const char __user *buffer, size_t count)
547{
548 struct uinput_user_dev *user_dev;
549 struct input_dev *dev;
550 int i;
551 int retval;
552
553 if (count != sizeof(struct uinput_user_dev))
554 return -EINVAL;
555
556 if (!udev->dev) {
557 udev->dev = input_allocate_device();
558 if (!udev->dev)
559 return -ENOMEM;
560 }
561
562 dev = udev->dev;
563
564 user_dev = memdup_user(buffer, sizeof(struct uinput_user_dev));
565 if (IS_ERR(user_dev))
566 return PTR_ERR(user_dev);
567
568 udev->ff_effects_max = user_dev->ff_effects_max;
569
570 /* Ensure name is filled in */
571 if (!user_dev->name[0]) {
572 retval = -EINVAL;
573 goto exit;
574 }
575
576 kfree(dev->name);
577 dev->name = kstrndup(user_dev->name, UINPUT_MAX_NAME_SIZE,
578 GFP_KERNEL);
579 if (!dev->name) {
580 retval = -ENOMEM;
581 goto exit;
582 }
583
584 dev->id.bustype = user_dev->id.bustype;
585 dev->id.vendor = user_dev->id.vendor;
586 dev->id.product = user_dev->id.product;
587 dev->id.version = user_dev->id.version;
588
589 for (i = 0; i < ABS_CNT; i++) {
590 input_abs_set_max(dev, i, user_dev->absmax[i]);
591 input_abs_set_min(dev, i, user_dev->absmin[i]);
592 input_abs_set_fuzz(dev, i, user_dev->absfuzz[i]);
593 input_abs_set_flat(dev, i, user_dev->absflat[i]);
594 }
595
596 retval = uinput_validate_absbits(dev);
597 if (retval < 0)
598 goto exit;
599
600 udev->state = UIST_SETUP_COMPLETE;
601 retval = count;
602
603 exit:
604 kfree(user_dev);
605 return retval;
606}
607
608/*
609 * Returns true if the given timestamp is valid (i.e., if all the following
610 * conditions are satisfied), false otherwise.
611 * 1) given timestamp is positive
612 * 2) it's within the allowed offset before the current time
613 * 3) it's not in the future
614 */
615static bool is_valid_timestamp(const ktime_t timestamp)
616{
617 ktime_t zero_time;
618 ktime_t current_time;
619 ktime_t min_time;
620 ktime_t offset;
621
622 zero_time = ktime_set(0, 0);
623 if (ktime_compare(zero_time, timestamp) >= 0)
624 return false;
625
626 current_time = ktime_get();
627 offset = ktime_set(UINPUT_TIMESTAMP_ALLOWED_OFFSET_SECS, 0);
628 min_time = ktime_sub(current_time, offset);
629
630 if (ktime_after(min_time, timestamp) || ktime_after(timestamp, current_time))
631 return false;
632
633 return true;
634}
635
636static ssize_t uinput_inject_events(struct uinput_device *udev,
637 const char __user *buffer, size_t count)
638{
639 struct input_event ev;
640 size_t bytes = 0;
641 ktime_t timestamp;
642
643 if (count != 0 && count < input_event_size())
644 return -EINVAL;
645
646 while (bytes + input_event_size() <= count) {
647 /*
648 * Note that even if some events were fetched successfully
649 * we are still going to return EFAULT instead of partial
650 * count to let userspace know that it got it's buffers
651 * all wrong.
652 */
653 if (input_event_from_user(buffer + bytes, &ev))
654 return -EFAULT;
655
656 timestamp = ktime_set(ev.input_event_sec, ev.input_event_usec * NSEC_PER_USEC);
657 if (is_valid_timestamp(timestamp))
658 input_set_timestamp(udev->dev, timestamp);
659
660 input_event(udev->dev, ev.type, ev.code, ev.value);
661 bytes += input_event_size();
662 cond_resched();
663 }
664
665 return bytes;
666}
667
668static ssize_t uinput_write(struct file *file, const char __user *buffer,
669 size_t count, loff_t *ppos)
670{
671 struct uinput_device *udev = file->private_data;
672 int retval;
673
674 if (count == 0)
675 return 0;
676
677 retval = mutex_lock_interruptible(&udev->mutex);
678 if (retval)
679 return retval;
680
681 retval = udev->state == UIST_CREATED ?
682 uinput_inject_events(udev, buffer, count) :
683 uinput_setup_device_legacy(udev, buffer, count);
684
685 mutex_unlock(&udev->mutex);
686
687 return retval;
688}
689
690static bool uinput_fetch_next_event(struct uinput_device *udev,
691 struct input_event *event)
692{
693 bool have_event;
694
695 spin_lock_irq(&udev->dev->event_lock);
696
697 have_event = udev->head != udev->tail;
698 if (have_event) {
699 *event = udev->buff[udev->tail];
700 udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE;
701 }
702
703 spin_unlock_irq(&udev->dev->event_lock);
704
705 return have_event;
706}
707
708static ssize_t uinput_events_to_user(struct uinput_device *udev,
709 char __user *buffer, size_t count)
710{
711 struct input_event event;
712 size_t read = 0;
713
714 while (read + input_event_size() <= count &&
715 uinput_fetch_next_event(udev, &event)) {
716
717 if (input_event_to_user(buffer + read, &event))
718 return -EFAULT;
719
720 read += input_event_size();
721 }
722
723 return read;
724}
725
726static ssize_t uinput_read(struct file *file, char __user *buffer,
727 size_t count, loff_t *ppos)
728{
729 struct uinput_device *udev = file->private_data;
730 ssize_t retval;
731
732 if (count != 0 && count < input_event_size())
733 return -EINVAL;
734
735 do {
736 retval = mutex_lock_interruptible(&udev->mutex);
737 if (retval)
738 return retval;
739
740 if (udev->state != UIST_CREATED)
741 retval = -ENODEV;
742 else if (udev->head == udev->tail &&
743 (file->f_flags & O_NONBLOCK))
744 retval = -EAGAIN;
745 else
746 retval = uinput_events_to_user(udev, buffer, count);
747
748 mutex_unlock(&udev->mutex);
749
750 if (retval || count == 0)
751 break;
752
753 if (!(file->f_flags & O_NONBLOCK))
754 retval = wait_event_interruptible(udev->waitq,
755 udev->head != udev->tail ||
756 udev->state != UIST_CREATED);
757 } while (retval == 0);
758
759 return retval;
760}
761
762static __poll_t uinput_poll(struct file *file, poll_table *wait)
763{
764 struct uinput_device *udev = file->private_data;
765 __poll_t mask = EPOLLOUT | EPOLLWRNORM; /* uinput is always writable */
766
767 poll_wait(file, &udev->waitq, wait);
768
769 if (udev->head != udev->tail)
770 mask |= EPOLLIN | EPOLLRDNORM;
771
772 return mask;
773}
774
775static int uinput_release(struct inode *inode, struct file *file)
776{
777 struct uinput_device *udev = file->private_data;
778
779 uinput_destroy_device(udev);
780 kfree(udev);
781
782 return 0;
783}
784
785#ifdef CONFIG_COMPAT
786struct uinput_ff_upload_compat {
787 __u32 request_id;
788 __s32 retval;
789 struct ff_effect_compat effect;
790 struct ff_effect_compat old;
791};
792
793static int uinput_ff_upload_to_user(char __user *buffer,
794 const struct uinput_ff_upload *ff_up)
795{
796 if (in_compat_syscall()) {
797 struct uinput_ff_upload_compat ff_up_compat;
798
799 memset(&ff_up_compat, 0, sizeof(ff_up_compat));
800 ff_up_compat.request_id = ff_up->request_id;
801 ff_up_compat.retval = ff_up->retval;
802 /*
803 * It so happens that the pointer that gives us the trouble
804 * is the last field in the structure. Since we don't support
805 * custom waveforms in uinput anyway we can just copy the whole
806 * thing (to the compat size) and ignore the pointer.
807 */
808 memcpy(&ff_up_compat.effect, &ff_up->effect,
809 sizeof(struct ff_effect_compat));
810 memcpy(&ff_up_compat.old, &ff_up->old,
811 sizeof(struct ff_effect_compat));
812
813 if (copy_to_user(buffer, &ff_up_compat,
814 sizeof(struct uinput_ff_upload_compat)))
815 return -EFAULT;
816 } else {
817 if (copy_to_user(buffer, ff_up,
818 sizeof(struct uinput_ff_upload)))
819 return -EFAULT;
820 }
821
822 return 0;
823}
824
825static int uinput_ff_upload_from_user(const char __user *buffer,
826 struct uinput_ff_upload *ff_up)
827{
828 if (in_compat_syscall()) {
829 struct uinput_ff_upload_compat ff_up_compat;
830
831 if (copy_from_user(&ff_up_compat, buffer,
832 sizeof(struct uinput_ff_upload_compat)))
833 return -EFAULT;
834
835 ff_up->request_id = ff_up_compat.request_id;
836 ff_up->retval = ff_up_compat.retval;
837 memcpy(&ff_up->effect, &ff_up_compat.effect,
838 sizeof(struct ff_effect_compat));
839 memcpy(&ff_up->old, &ff_up_compat.old,
840 sizeof(struct ff_effect_compat));
841
842 } else {
843 if (copy_from_user(ff_up, buffer,
844 sizeof(struct uinput_ff_upload)))
845 return -EFAULT;
846 }
847
848 return 0;
849}
850
851#else
852
853static int uinput_ff_upload_to_user(char __user *buffer,
854 const struct uinput_ff_upload *ff_up)
855{
856 if (copy_to_user(buffer, ff_up, sizeof(struct uinput_ff_upload)))
857 return -EFAULT;
858
859 return 0;
860}
861
862static int uinput_ff_upload_from_user(const char __user *buffer,
863 struct uinput_ff_upload *ff_up)
864{
865 if (copy_from_user(ff_up, buffer, sizeof(struct uinput_ff_upload)))
866 return -EFAULT;
867
868 return 0;
869}
870
871#endif
872
873#define uinput_set_bit(_arg, _bit, _max) \
874({ \
875 int __ret = 0; \
876 if (udev->state == UIST_CREATED) \
877 __ret = -EINVAL; \
878 else if ((_arg) > (_max)) \
879 __ret = -EINVAL; \
880 else set_bit((_arg), udev->dev->_bit); \
881 __ret; \
882})
883
884static int uinput_str_to_user(void __user *dest, const char *str,
885 unsigned int maxlen)
886{
887 char __user *p = dest;
888 int len, ret;
889
890 if (!str)
891 return -ENOENT;
892
893 if (maxlen == 0)
894 return -EINVAL;
895
896 len = strlen(str) + 1;
897 if (len > maxlen)
898 len = maxlen;
899
900 ret = copy_to_user(p, str, len);
901 if (ret)
902 return -EFAULT;
903
904 /* force terminating '\0' */
905 ret = put_user(0, p + len - 1);
906 return ret ? -EFAULT : len;
907}
908
909static long uinput_ioctl_handler(struct file *file, unsigned int cmd,
910 unsigned long arg, void __user *p)
911{
912 int retval;
913 struct uinput_device *udev = file->private_data;
914 struct uinput_ff_upload ff_up;
915 struct uinput_ff_erase ff_erase;
916 struct uinput_request *req;
917 char *phys;
918 const char *name;
919 unsigned int size;
920
921 retval = mutex_lock_interruptible(&udev->mutex);
922 if (retval)
923 return retval;
924
925 if (!udev->dev) {
926 udev->dev = input_allocate_device();
927 if (!udev->dev) {
928 retval = -ENOMEM;
929 goto out;
930 }
931 }
932
933 switch (cmd) {
934 case UI_GET_VERSION:
935 if (put_user(UINPUT_VERSION, (unsigned int __user *)p))
936 retval = -EFAULT;
937 goto out;
938
939 case UI_DEV_CREATE:
940 retval = uinput_create_device(udev);
941 goto out;
942
943 case UI_DEV_DESTROY:
944 uinput_destroy_device(udev);
945 goto out;
946
947 case UI_DEV_SETUP:
948 retval = uinput_dev_setup(udev, p);
949 goto out;
950
951 /* UI_ABS_SETUP is handled in the variable size ioctls */
952
953 case UI_SET_EVBIT:
954 retval = uinput_set_bit(arg, evbit, EV_MAX);
955 goto out;
956
957 case UI_SET_KEYBIT:
958 retval = uinput_set_bit(arg, keybit, KEY_MAX);
959 goto out;
960
961 case UI_SET_RELBIT:
962 retval = uinput_set_bit(arg, relbit, REL_MAX);
963 goto out;
964
965 case UI_SET_ABSBIT:
966 retval = uinput_set_bit(arg, absbit, ABS_MAX);
967 goto out;
968
969 case UI_SET_MSCBIT:
970 retval = uinput_set_bit(arg, mscbit, MSC_MAX);
971 goto out;
972
973 case UI_SET_LEDBIT:
974 retval = uinput_set_bit(arg, ledbit, LED_MAX);
975 goto out;
976
977 case UI_SET_SNDBIT:
978 retval = uinput_set_bit(arg, sndbit, SND_MAX);
979 goto out;
980
981 case UI_SET_FFBIT:
982 retval = uinput_set_bit(arg, ffbit, FF_MAX);
983 goto out;
984
985 case UI_SET_SWBIT:
986 retval = uinput_set_bit(arg, swbit, SW_MAX);
987 goto out;
988
989 case UI_SET_PROPBIT:
990 retval = uinput_set_bit(arg, propbit, INPUT_PROP_MAX);
991 goto out;
992
993 case UI_SET_PHYS:
994 if (udev->state == UIST_CREATED) {
995 retval = -EINVAL;
996 goto out;
997 }
998
999 phys = strndup_user(p, 1024);
1000 if (IS_ERR(phys)) {
1001 retval = PTR_ERR(phys);
1002 goto out;
1003 }
1004
1005 kfree(udev->dev->phys);
1006 udev->dev->phys = phys;
1007 goto out;
1008
1009 case UI_BEGIN_FF_UPLOAD:
1010 retval = uinput_ff_upload_from_user(p, &ff_up);
1011 if (retval)
1012 goto out;
1013
1014 req = uinput_request_find(udev, ff_up.request_id);
1015 if (!req || req->code != UI_FF_UPLOAD ||
1016 !req->u.upload.effect) {
1017 retval = -EINVAL;
1018 goto out;
1019 }
1020
1021 ff_up.retval = 0;
1022 ff_up.effect = *req->u.upload.effect;
1023 if (req->u.upload.old)
1024 ff_up.old = *req->u.upload.old;
1025 else
1026 memset(&ff_up.old, 0, sizeof(struct ff_effect));
1027
1028 retval = uinput_ff_upload_to_user(p, &ff_up);
1029 goto out;
1030
1031 case UI_BEGIN_FF_ERASE:
1032 if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) {
1033 retval = -EFAULT;
1034 goto out;
1035 }
1036
1037 req = uinput_request_find(udev, ff_erase.request_id);
1038 if (!req || req->code != UI_FF_ERASE) {
1039 retval = -EINVAL;
1040 goto out;
1041 }
1042
1043 ff_erase.retval = 0;
1044 ff_erase.effect_id = req->u.effect_id;
1045 if (copy_to_user(p, &ff_erase, sizeof(ff_erase))) {
1046 retval = -EFAULT;
1047 goto out;
1048 }
1049
1050 goto out;
1051
1052 case UI_END_FF_UPLOAD:
1053 retval = uinput_ff_upload_from_user(p, &ff_up);
1054 if (retval)
1055 goto out;
1056
1057 req = uinput_request_find(udev, ff_up.request_id);
1058 if (!req || req->code != UI_FF_UPLOAD ||
1059 !req->u.upload.effect) {
1060 retval = -EINVAL;
1061 goto out;
1062 }
1063
1064 req->retval = ff_up.retval;
1065 complete(&req->done);
1066 goto out;
1067
1068 case UI_END_FF_ERASE:
1069 if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) {
1070 retval = -EFAULT;
1071 goto out;
1072 }
1073
1074 req = uinput_request_find(udev, ff_erase.request_id);
1075 if (!req || req->code != UI_FF_ERASE) {
1076 retval = -EINVAL;
1077 goto out;
1078 }
1079
1080 req->retval = ff_erase.retval;
1081 complete(&req->done);
1082 goto out;
1083 }
1084
1085 size = _IOC_SIZE(cmd);
1086
1087 /* Now check variable-length commands */
1088 switch (cmd & ~IOCSIZE_MASK) {
1089 case UI_GET_SYSNAME(0):
1090 if (udev->state != UIST_CREATED) {
1091 retval = -ENOENT;
1092 goto out;
1093 }
1094 name = dev_name(&udev->dev->dev);
1095 retval = uinput_str_to_user(p, name, size);
1096 goto out;
1097
1098 case UI_ABS_SETUP & ~IOCSIZE_MASK:
1099 retval = uinput_abs_setup(udev, p, size);
1100 goto out;
1101 }
1102
1103 retval = -EINVAL;
1104 out:
1105 mutex_unlock(&udev->mutex);
1106 return retval;
1107}
1108
1109static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1110{
1111 return uinput_ioctl_handler(file, cmd, arg, (void __user *)arg);
1112}
1113
1114#ifdef CONFIG_COMPAT
1115
1116/*
1117 * These IOCTLs change their size and thus their numbers between
1118 * 32 and 64 bits.
1119 */
1120#define UI_SET_PHYS_COMPAT \
1121 _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t)
1122#define UI_BEGIN_FF_UPLOAD_COMPAT \
1123 _IOWR(UINPUT_IOCTL_BASE, 200, struct uinput_ff_upload_compat)
1124#define UI_END_FF_UPLOAD_COMPAT \
1125 _IOW(UINPUT_IOCTL_BASE, 201, struct uinput_ff_upload_compat)
1126
1127static long uinput_compat_ioctl(struct file *file,
1128 unsigned int cmd, unsigned long arg)
1129{
1130 switch (cmd) {
1131 case UI_SET_PHYS_COMPAT:
1132 cmd = UI_SET_PHYS;
1133 break;
1134 case UI_BEGIN_FF_UPLOAD_COMPAT:
1135 cmd = UI_BEGIN_FF_UPLOAD;
1136 break;
1137 case UI_END_FF_UPLOAD_COMPAT:
1138 cmd = UI_END_FF_UPLOAD;
1139 break;
1140 }
1141
1142 return uinput_ioctl_handler(file, cmd, arg, compat_ptr(arg));
1143}
1144#endif
1145
1146static const struct file_operations uinput_fops = {
1147 .owner = THIS_MODULE,
1148 .open = uinput_open,
1149 .release = uinput_release,
1150 .read = uinput_read,
1151 .write = uinput_write,
1152 .poll = uinput_poll,
1153 .unlocked_ioctl = uinput_ioctl,
1154#ifdef CONFIG_COMPAT
1155 .compat_ioctl = uinput_compat_ioctl,
1156#endif
1157};
1158
1159static struct miscdevice uinput_misc = {
1160 .fops = &uinput_fops,
1161 .minor = UINPUT_MINOR,
1162 .name = UINPUT_NAME,
1163};
1164module_misc_device(uinput_misc);
1165
1166MODULE_ALIAS_MISCDEV(UINPUT_MINOR);
1167MODULE_ALIAS("devname:" UINPUT_NAME);
1168
1169MODULE_AUTHOR("Aristeu Sergio Rozanski Filho");
1170MODULE_DESCRIPTION("User level driver support for input subsystem");
1171MODULE_LICENSE("GPL");