]>
Commit | Line | Data |
---|---|---|
1a59d1b8 | 1 | // SPDX-License-Identifier: GPL-2.0-or-later |
1da177e4 LT |
2 | /* |
3 | * User level driver support for input subsystem | |
4 | * | |
5 | * Heavily based on evdev.c by Vojtech Pavlik | |
6 | * | |
1da177e4 LT |
7 | * Author: Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org> |
8 | * | |
9 | * Changes/Revisions: | |
e3480a61 BT |
10 | * 0.4 01/09/2014 (Benjamin Tissoires <benjamin.tissoires@redhat.com>) |
11 | * - add UI_GET_SYSNAME ioctl | |
ff462551 AH |
12 | * 0.3 09/04/2006 (Anssi Hannula <anssi.hannula@gmail.com>) |
13 | * - updated ff support for the changes in kernel interface | |
14 | * - added MODULE_VERSION | |
1da177e4 LT |
15 | * 0.2 16/10/2004 (Micah Dowty <micah@navi.cx>) |
16 | * - added force feedback support | |
17 | * - added UI_SET_PHYS | |
18 | * 0.1 20/06/2002 | |
19 | * - first public version | |
20 | */ | |
a11bc476 | 21 | #include <uapi/linux/uinput.h> |
1da177e4 | 22 | #include <linux/poll.h> |
a99bbaf5 | 23 | #include <linux/sched.h> |
1da177e4 LT |
24 | #include <linux/slab.h> |
25 | #include <linux/module.h> | |
26 | #include <linux/init.h> | |
1da177e4 LT |
27 | #include <linux/fs.h> |
28 | #include <linux/miscdevice.h> | |
d77651a2 | 29 | #include <linux/overflow.h> |
47c78e89 | 30 | #include <linux/input/mt.h> |
2d56f3a3 | 31 | #include "../input-compat.h" |
1da177e4 | 32 | |
a11bc476 DT |
33 | #define UINPUT_NAME "uinput" |
34 | #define UINPUT_BUFFER_SIZE 16 | |
35 | #define UINPUT_NUM_REQUESTS 16 | |
36 | ||
37 | enum uinput_state { UIST_NEW_DEVICE, UIST_SETUP_COMPLETE, UIST_CREATED }; | |
38 | ||
39 | struct uinput_request { | |
40 | unsigned int id; | |
41 | unsigned int code; /* UI_FF_UPLOAD, UI_FF_ERASE */ | |
42 | ||
43 | int retval; | |
44 | struct completion done; | |
45 | ||
46 | union { | |
47 | unsigned int effect_id; | |
48 | struct { | |
49 | struct ff_effect *effect; | |
50 | struct ff_effect *old; | |
51 | } upload; | |
52 | } u; | |
53 | }; | |
54 | ||
55 | struct uinput_device { | |
56 | struct input_dev *dev; | |
57 | struct mutex mutex; | |
58 | enum uinput_state state; | |
59 | wait_queue_head_t waitq; | |
60 | unsigned char ready; | |
61 | unsigned char head; | |
62 | unsigned char tail; | |
63 | struct input_event buff[UINPUT_BUFFER_SIZE]; | |
64 | unsigned int ff_effects_max; | |
65 | ||
66 | struct uinput_request *requests[UINPUT_NUM_REQUESTS]; | |
67 | wait_queue_head_t requests_waitq; | |
68 | spinlock_t requests_lock; | |
69 | }; | |
70 | ||
54ce165e DT |
71 | static int uinput_dev_event(struct input_dev *dev, |
72 | unsigned int type, unsigned int code, int value) | |
1da177e4 | 73 | { |
373f9713 | 74 | struct uinput_device *udev = input_get_drvdata(dev); |
b3495cec | 75 | struct timespec64 ts; |
1da177e4 LT |
76 | |
77 | udev->buff[udev->head].type = type; | |
78 | udev->buff[udev->head].code = code; | |
79 | udev->buff[udev->head].value = value; | |
b3495cec | 80 | ktime_get_ts64(&ts); |
152194fe DD |
81 | udev->buff[udev->head].input_event_sec = ts.tv_sec; |
82 | udev->buff[udev->head].input_event_usec = ts.tv_nsec / NSEC_PER_USEC; | |
1da177e4 LT |
83 | udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE; |
84 | ||
85 | wake_up_interruptible(&udev->waitq); | |
86 | ||
87 | return 0; | |
88 | } | |
89 | ||
05cebd38 | 90 | /* Atomically allocate an ID for the given request. Returns 0 on success. */ |
00ce756c DT |
91 | static bool uinput_request_alloc_id(struct uinput_device *udev, |
92 | struct uinput_request *request) | |
1da177e4 | 93 | { |
c5b3533a | 94 | unsigned int id; |
00ce756c | 95 | bool reserved = false; |
1da177e4 | 96 | |
0048e603 | 97 | spin_lock(&udev->requests_lock); |
152c12f5 | 98 | |
05cebd38 | 99 | for (id = 0; id < UINPUT_NUM_REQUESTS; id++) { |
1da177e4 | 100 | if (!udev->requests[id]) { |
1da177e4 | 101 | request->id = id; |
0048e603 | 102 | udev->requests[id] = request; |
00ce756c | 103 | reserved = true; |
152c12f5 | 104 | break; |
1da177e4 | 105 | } |
05cebd38 | 106 | } |
152c12f5 | 107 | |
0048e603 | 108 | spin_unlock(&udev->requests_lock); |
00ce756c | 109 | return reserved; |
1da177e4 LT |
110 | } |
111 | ||
c5b3533a DT |
112 | static struct uinput_request *uinput_request_find(struct uinput_device *udev, |
113 | unsigned int id) | |
1da177e4 LT |
114 | { |
115 | /* Find an input request, by ID. Returns NULL if the ID isn't valid. */ | |
c5b3533a | 116 | if (id >= UINPUT_NUM_REQUESTS) |
1da177e4 | 117 | return NULL; |
2d56f3a3 | 118 | |
1da177e4 LT |
119 | return udev->requests[id]; |
120 | } | |
121 | ||
00ce756c DT |
122 | static int uinput_request_reserve_slot(struct uinput_device *udev, |
123 | struct uinput_request *request) | |
1da177e4 | 124 | { |
0048e603 DT |
125 | /* Allocate slot. If none are available right away, wait. */ |
126 | return wait_event_interruptible(udev->requests_waitq, | |
00ce756c | 127 | uinput_request_alloc_id(udev, request)); |
0048e603 | 128 | } |
1da177e4 | 129 | |
6b4877c7 DT |
130 | static void uinput_request_release_slot(struct uinput_device *udev, |
131 | unsigned int id) | |
0048e603 | 132 | { |
0048e603 | 133 | /* Mark slot as available */ |
6b4877c7 DT |
134 | spin_lock(&udev->requests_lock); |
135 | udev->requests[id] = NULL; | |
136 | spin_unlock(&udev->requests_lock); | |
e7507ed9 | 137 | |
6b4877c7 | 138 | wake_up(&udev->requests_waitq); |
1da177e4 LT |
139 | } |
140 | ||
00ce756c DT |
141 | static int uinput_request_send(struct uinput_device *udev, |
142 | struct uinput_request *request) | |
1da177e4 | 143 | { |
05cebd38 ASRF |
144 | int retval; |
145 | ||
05cebd38 ASRF |
146 | retval = mutex_lock_interruptible(&udev->mutex); |
147 | if (retval) | |
148 | return retval; | |
149 | ||
150 | if (udev->state != UIST_CREATED) { | |
151 | retval = -ENODEV; | |
152 | goto out; | |
153 | } | |
154 | ||
00ce756c DT |
155 | init_completion(&request->done); |
156 | ||
157 | /* | |
158 | * Tell our userspace application about this new request | |
159 | * by queueing an input event. | |
160 | */ | |
05cebd38 ASRF |
161 | uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id); |
162 | ||
163 | out: | |
164 | mutex_unlock(&udev->mutex); | |
165 | return retval; | |
166 | } | |
167 | ||
00ce756c DT |
168 | static int uinput_request_submit(struct uinput_device *udev, |
169 | struct uinput_request *request) | |
170 | { | |
6b4877c7 | 171 | int retval; |
00ce756c | 172 | |
6b4877c7 DT |
173 | retval = uinput_request_reserve_slot(udev, request); |
174 | if (retval) | |
175 | return retval; | |
00ce756c | 176 | |
6b4877c7 DT |
177 | retval = uinput_request_send(udev, request); |
178 | if (retval) | |
179 | goto out; | |
00ce756c | 180 | |
8e009118 DT |
181 | if (!wait_for_completion_timeout(&request->done, 30 * HZ)) { |
182 | retval = -ETIMEDOUT; | |
183 | goto out; | |
184 | } | |
185 | ||
6b4877c7 DT |
186 | retval = request->retval; |
187 | ||
188 | out: | |
189 | uinput_request_release_slot(udev, request->id); | |
190 | return retval; | |
00ce756c DT |
191 | } |
192 | ||
05cebd38 | 193 | /* |
54ce165e | 194 | * Fail all outstanding requests so handlers don't wait for the userspace |
05cebd38 ASRF |
195 | * to finish processing them. |
196 | */ | |
197 | static void uinput_flush_requests(struct uinput_device *udev) | |
198 | { | |
199 | struct uinput_request *request; | |
200 | int i; | |
1da177e4 | 201 | |
05cebd38 ASRF |
202 | spin_lock(&udev->requests_lock); |
203 | ||
204 | for (i = 0; i < UINPUT_NUM_REQUESTS; i++) { | |
205 | request = udev->requests[i]; | |
206 | if (request) { | |
207 | request->retval = -ENODEV; | |
6b4877c7 | 208 | complete(&request->done); |
05cebd38 ASRF |
209 | } |
210 | } | |
211 | ||
212 | spin_unlock(&udev->requests_lock); | |
1da177e4 LT |
213 | } |
214 | ||
ff462551 AH |
215 | static void uinput_dev_set_gain(struct input_dev *dev, u16 gain) |
216 | { | |
217 | uinput_dev_event(dev, EV_FF, FF_GAIN, gain); | |
218 | } | |
219 | ||
220 | static void uinput_dev_set_autocenter(struct input_dev *dev, u16 magnitude) | |
221 | { | |
222 | uinput_dev_event(dev, EV_FF, FF_AUTOCENTER, magnitude); | |
223 | } | |
224 | ||
225 | static int uinput_dev_playback(struct input_dev *dev, int effect_id, int value) | |
226 | { | |
227 | return uinput_dev_event(dev, EV_FF, effect_id, value); | |
228 | } | |
229 | ||
54ce165e DT |
230 | static int uinput_dev_upload_effect(struct input_dev *dev, |
231 | struct ff_effect *effect, | |
232 | struct ff_effect *old) | |
1da177e4 | 233 | { |
05cebd38 | 234 | struct uinput_device *udev = input_get_drvdata(dev); |
1da177e4 LT |
235 | struct uinput_request request; |
236 | ||
2d56f3a3 PL |
237 | /* |
238 | * uinput driver does not currently support periodic effects with | |
239 | * custom waveform since it does not have a way to pass buffer of | |
240 | * samples (custom_data) to userspace. If ever there is a device | |
241 | * supporting custom waveforms we would need to define an additional | |
242 | * ioctl (UI_UPLOAD_SAMPLES) but for now we just bail out. | |
243 | */ | |
244 | if (effect->type == FF_PERIODIC && | |
245 | effect->u.periodic.waveform == FF_CUSTOM) | |
246 | return -EINVAL; | |
247 | ||
0048e603 | 248 | request.code = UI_FF_UPLOAD; |
ff462551 AH |
249 | request.u.upload.effect = effect; |
250 | request.u.upload.old = old; | |
0048e603 | 251 | |
00ce756c | 252 | return uinput_request_submit(udev, &request); |
1da177e4 LT |
253 | } |
254 | ||
255 | static int uinput_dev_erase_effect(struct input_dev *dev, int effect_id) | |
256 | { | |
05cebd38 | 257 | struct uinput_device *udev = input_get_drvdata(dev); |
1da177e4 LT |
258 | struct uinput_request request; |
259 | ||
260 | if (!test_bit(EV_FF, dev->evbit)) | |
261 | return -ENOSYS; | |
262 | ||
0048e603 | 263 | request.code = UI_FF_ERASE; |
1da177e4 | 264 | request.u.effect_id = effect_id; |
0048e603 | 265 | |
00ce756c | 266 | return uinput_request_submit(udev, &request); |
1da177e4 LT |
267 | } |
268 | ||
e8b95728 DT |
269 | static int uinput_dev_flush(struct input_dev *dev, struct file *file) |
270 | { | |
271 | /* | |
272 | * If we are called with file == NULL that means we are tearing | |
273 | * down the device, and therefore we can not handle FF erase | |
274 | * requests: either we are handling UI_DEV_DESTROY (and holding | |
275 | * the udev->mutex), or the file descriptor is closed and there is | |
276 | * nobody on the other side anymore. | |
277 | */ | |
278 | return file ? input_ff_flush(dev, file) : 0; | |
279 | } | |
280 | ||
29506415 | 281 | static void uinput_destroy_device(struct uinput_device *udev) |
1da177e4 | 282 | { |
29506415 | 283 | const char *name, *phys; |
05cebd38 ASRF |
284 | struct input_dev *dev = udev->dev; |
285 | enum uinput_state old_state = udev->state; | |
286 | ||
287 | udev->state = UIST_NEW_DEVICE; | |
29506415 | 288 | |
05cebd38 ASRF |
289 | if (dev) { |
290 | name = dev->name; | |
291 | phys = dev->phys; | |
292 | if (old_state == UIST_CREATED) { | |
293 | uinput_flush_requests(udev); | |
294 | input_unregister_device(dev); | |
295 | } else { | |
296 | input_free_device(dev); | |
297 | } | |
29506415 DT |
298 | kfree(name); |
299 | kfree(phys); | |
300 | udev->dev = NULL; | |
1da177e4 | 301 | } |
1da177e4 LT |
302 | } |
303 | ||
29506415 | 304 | static int uinput_create_device(struct uinput_device *udev) |
1da177e4 | 305 | { |
ff462551 | 306 | struct input_dev *dev = udev->dev; |
fbae10db | 307 | int error, nslot; |
29506415 DT |
308 | |
309 | if (udev->state != UIST_SETUP_COMPLETE) { | |
310 | printk(KERN_DEBUG "%s: write device info first\n", UINPUT_NAME); | |
1da177e4 LT |
311 | return -EINVAL; |
312 | } | |
313 | ||
601bbbe0 DT |
314 | if (test_bit(EV_ABS, dev->evbit)) { |
315 | input_alloc_absinfo(dev); | |
316 | if (!dev->absinfo) { | |
317 | error = -EINVAL; | |
fbae10db | 318 | goto fail1; |
601bbbe0 DT |
319 | } |
320 | ||
321 | if (test_bit(ABS_MT_SLOT, dev->absbit)) { | |
322 | nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1; | |
323 | error = input_mt_init_slots(dev, nslot, 0); | |
324 | if (error) | |
325 | goto fail1; | |
326 | } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) { | |
327 | input_set_events_per_packet(dev, 60); | |
328 | } | |
fbae10db DH |
329 | } |
330 | ||
daf6cd0c EV |
331 | if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) { |
332 | printk(KERN_DEBUG "%s: ff_effects_max should be non-zero when FF_BIT is set\n", | |
333 | UINPUT_NAME); | |
334 | error = -EINVAL; | |
335 | goto fail1; | |
336 | } | |
337 | ||
ff462551 AH |
338 | if (udev->ff_effects_max) { |
339 | error = input_ff_create(dev, udev->ff_effects_max); | |
340 | if (error) | |
341 | goto fail1; | |
342 | ||
343 | dev->ff->upload = uinput_dev_upload_effect; | |
344 | dev->ff->erase = uinput_dev_erase_effect; | |
345 | dev->ff->playback = uinput_dev_playback; | |
346 | dev->ff->set_gain = uinput_dev_set_gain; | |
347 | dev->ff->set_autocenter = uinput_dev_set_autocenter; | |
e8b95728 DT |
348 | /* |
349 | * The standard input_ff_flush() implementation does | |
350 | * not quite work for uinput as we can't reasonably | |
351 | * handle FF requests during device teardown. | |
352 | */ | |
353 | dev->flush = uinput_dev_flush; | |
29506415 | 354 | } |
1da177e4 | 355 | |
04ce40a6 DT |
356 | dev->event = uinput_dev_event; |
357 | ||
358 | input_set_drvdata(udev->dev, udev); | |
359 | ||
ff462551 AH |
360 | error = input_register_device(udev->dev); |
361 | if (error) | |
362 | goto fail2; | |
363 | ||
29506415 | 364 | udev->state = UIST_CREATED; |
1da177e4 LT |
365 | |
366 | return 0; | |
ff462551 AH |
367 | |
368 | fail2: input_ff_destroy(dev); | |
369 | fail1: uinput_destroy_device(udev); | |
370 | return error; | |
1da177e4 LT |
371 | } |
372 | ||
373 | static int uinput_open(struct inode *inode, struct file *file) | |
374 | { | |
29506415 | 375 | struct uinput_device *newdev; |
1da177e4 | 376 | |
29506415 | 377 | newdev = kzalloc(sizeof(struct uinput_device), GFP_KERNEL); |
1da177e4 | 378 | if (!newdev) |
29506415 DT |
379 | return -ENOMEM; |
380 | ||
221979aa | 381 | mutex_init(&newdev->mutex); |
0048e603 | 382 | spin_lock_init(&newdev->requests_lock); |
1da177e4 | 383 | init_waitqueue_head(&newdev->requests_waitq); |
29506415 DT |
384 | init_waitqueue_head(&newdev->waitq); |
385 | newdev->state = UIST_NEW_DEVICE; | |
1da177e4 LT |
386 | |
387 | file->private_data = newdev; | |
c5bf68fe | 388 | stream_open(inode, file); |
1da177e4 LT |
389 | |
390 | return 0; | |
1da177e4 LT |
391 | } |
392 | ||
fbae10db DH |
393 | static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code, |
394 | const struct input_absinfo *abs) | |
395 | { | |
d77651a2 | 396 | int min, max, range; |
fbae10db DH |
397 | |
398 | min = abs->minimum; | |
399 | max = abs->maximum; | |
400 | ||
4fef1250 | 401 | if ((min != 0 || max != 0) && max < min) { |
fbae10db DH |
402 | printk(KERN_DEBUG |
403 | "%s: invalid abs[%02x] min:%d max:%d\n", | |
404 | UINPUT_NAME, code, min, max); | |
405 | return -EINVAL; | |
406 | } | |
407 | ||
d77651a2 | 408 | if (!check_sub_overflow(max, min, &range) && abs->flat > range) { |
fbae10db DH |
409 | printk(KERN_DEBUG |
410 | "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n", | |
411 | UINPUT_NAME, code, abs->flat, min, max); | |
412 | return -EINVAL; | |
413 | } | |
414 | ||
415 | return 0; | |
416 | } | |
417 | ||
1da177e4 LT |
418 | static int uinput_validate_absbits(struct input_dev *dev) |
419 | { | |
420 | unsigned int cnt; | |
fbae10db | 421 | int error; |
bcb898e5 DH |
422 | |
423 | if (!test_bit(EV_ABS, dev->evbit)) | |
424 | return 0; | |
425 | ||
426 | /* | |
427 | * Check if absmin/absmax/absfuzz/absflat are sane. | |
428 | */ | |
1da177e4 | 429 | |
b6d30968 | 430 | for_each_set_bit(cnt, dev->absbit, ABS_CNT) { |
fbae10db | 431 | if (!dev->absinfo) |
bcb898e5 | 432 | return -EINVAL; |
bcb898e5 | 433 | |
fbae10db DH |
434 | error = uinput_validate_absinfo(dev, cnt, &dev->absinfo[cnt]); |
435 | if (error) | |
436 | return error; | |
bcb898e5 DH |
437 | } |
438 | ||
439 | return 0; | |
1da177e4 LT |
440 | } |
441 | ||
052876f8 BT |
442 | static int uinput_dev_setup(struct uinput_device *udev, |
443 | struct uinput_setup __user *arg) | |
444 | { | |
445 | struct uinput_setup setup; | |
446 | struct input_dev *dev; | |
052876f8 BT |
447 | |
448 | if (udev->state == UIST_CREATED) | |
449 | return -EINVAL; | |
450 | ||
451 | if (copy_from_user(&setup, arg, sizeof(setup))) | |
452 | return -EFAULT; | |
453 | ||
454 | if (!setup.name[0]) | |
455 | return -EINVAL; | |
456 | ||
457 | dev = udev->dev; | |
458 | dev->id = setup.id; | |
459 | udev->ff_effects_max = setup.ff_effects_max; | |
460 | ||
461 | kfree(dev->name); | |
462 | dev->name = kstrndup(setup.name, UINPUT_MAX_NAME_SIZE, GFP_KERNEL); | |
463 | if (!dev->name) | |
464 | return -ENOMEM; | |
465 | ||
052876f8 BT |
466 | udev->state = UIST_SETUP_COMPLETE; |
467 | return 0; | |
468 | } | |
469 | ||
470 | static int uinput_abs_setup(struct uinput_device *udev, | |
471 | struct uinput_setup __user *arg, size_t size) | |
472 | { | |
473 | struct uinput_abs_setup setup = {}; | |
474 | struct input_dev *dev; | |
fbae10db | 475 | int error; |
052876f8 BT |
476 | |
477 | if (size > sizeof(setup)) | |
478 | return -E2BIG; | |
479 | ||
480 | if (udev->state == UIST_CREATED) | |
481 | return -EINVAL; | |
482 | ||
483 | if (copy_from_user(&setup, arg, size)) | |
484 | return -EFAULT; | |
485 | ||
486 | if (setup.code > ABS_MAX) | |
487 | return -ERANGE; | |
488 | ||
489 | dev = udev->dev; | |
490 | ||
fbae10db DH |
491 | error = uinput_validate_absinfo(dev, setup.code, &setup.absinfo); |
492 | if (error) | |
493 | return error; | |
494 | ||
052876f8 BT |
495 | input_alloc_absinfo(dev); |
496 | if (!dev->absinfo) | |
497 | return -ENOMEM; | |
498 | ||
499 | set_bit(setup.code, dev->absbit); | |
500 | dev->absinfo[setup.code] = setup.absinfo; | |
052876f8 BT |
501 | return 0; |
502 | } | |
503 | ||
504 | /* legacy setup via write() */ | |
505 | static int uinput_setup_device_legacy(struct uinput_device *udev, | |
506 | const char __user *buffer, size_t count) | |
1da177e4 LT |
507 | { |
508 | struct uinput_user_dev *user_dev; | |
509 | struct input_dev *dev; | |
5d9d6e91 | 510 | int i; |
152c12f5 | 511 | int retval; |
1da177e4 | 512 | |
29506415 DT |
513 | if (count != sizeof(struct uinput_user_dev)) |
514 | return -EINVAL; | |
515 | ||
516 | if (!udev->dev) { | |
04ce40a6 DT |
517 | udev->dev = input_allocate_device(); |
518 | if (!udev->dev) | |
519 | return -ENOMEM; | |
29506415 | 520 | } |
1da177e4 | 521 | |
1da177e4 LT |
522 | dev = udev->dev; |
523 | ||
4dfcc271 | 524 | user_dev = memdup_user(buffer, sizeof(struct uinput_user_dev)); |
163d2770 | 525 | if (IS_ERR(user_dev)) |
4dfcc271 | 526 | return PTR_ERR(user_dev); |
1da177e4 | 527 | |
ff462551 AH |
528 | udev->ff_effects_max = user_dev->ff_effects_max; |
529 | ||
5d9d6e91 DH |
530 | /* Ensure name is filled in */ |
531 | if (!user_dev->name[0]) { | |
29506415 DT |
532 | retval = -EINVAL; |
533 | goto exit; | |
534 | } | |
535 | ||
536 | kfree(dev->name); | |
5d9d6e91 DH |
537 | dev->name = kstrndup(user_dev->name, UINPUT_MAX_NAME_SIZE, |
538 | GFP_KERNEL); | |
539 | if (!dev->name) { | |
1da177e4 LT |
540 | retval = -ENOMEM; |
541 | goto exit; | |
542 | } | |
543 | ||
1da177e4 LT |
544 | dev->id.bustype = user_dev->id.bustype; |
545 | dev->id.vendor = user_dev->id.vendor; | |
546 | dev->id.product = user_dev->id.product; | |
547 | dev->id.version = user_dev->id.version; | |
1da177e4 | 548 | |
72d47362 | 549 | for (i = 0; i < ABS_CNT; i++) { |
987a6c02 DM |
550 | input_abs_set_max(dev, i, user_dev->absmax[i]); |
551 | input_abs_set_min(dev, i, user_dev->absmin[i]); | |
552 | input_abs_set_fuzz(dev, i, user_dev->absfuzz[i]); | |
553 | input_abs_set_flat(dev, i, user_dev->absflat[i]); | |
554 | } | |
1da177e4 | 555 | |
bcb898e5 DH |
556 | retval = uinput_validate_absbits(dev); |
557 | if (retval < 0) | |
558 | goto exit; | |
1da177e4 | 559 | |
29506415 DT |
560 | udev->state = UIST_SETUP_COMPLETE; |
561 | retval = count; | |
562 | ||
563 | exit: | |
1da177e4 LT |
564 | kfree(user_dev); |
565 | return retval; | |
566 | } | |
567 | ||
cbf05413 RM |
568 | static ssize_t uinput_inject_events(struct uinput_device *udev, |
569 | const char __user *buffer, size_t count) | |
29506415 DT |
570 | { |
571 | struct input_event ev; | |
cbf05413 | 572 | size_t bytes = 0; |
29506415 | 573 | |
cbf05413 | 574 | if (count != 0 && count < input_event_size()) |
29506415 DT |
575 | return -EINVAL; |
576 | ||
cbf05413 RM |
577 | while (bytes + input_event_size() <= count) { |
578 | /* | |
579 | * Note that even if some events were fetched successfully | |
580 | * we are still going to return EFAULT instead of partial | |
581 | * count to let userspace know that it got it's buffers | |
582 | * all wrong. | |
583 | */ | |
584 | if (input_event_from_user(buffer + bytes, &ev)) | |
585 | return -EFAULT; | |
29506415 | 586 | |
cbf05413 RM |
587 | input_event(udev->dev, ev.type, ev.code, ev.value); |
588 | bytes += input_event_size(); | |
cecf1070 | 589 | cond_resched(); |
cbf05413 | 590 | } |
29506415 | 591 | |
cbf05413 | 592 | return bytes; |
29506415 DT |
593 | } |
594 | ||
54ce165e DT |
595 | static ssize_t uinput_write(struct file *file, const char __user *buffer, |
596 | size_t count, loff_t *ppos) | |
1da177e4 LT |
597 | { |
598 | struct uinput_device *udev = file->private_data; | |
29506415 | 599 | int retval; |
1da177e4 | 600 | |
22ae19c6 DT |
601 | if (count == 0) |
602 | return 0; | |
603 | ||
221979aa | 604 | retval = mutex_lock_interruptible(&udev->mutex); |
29506415 DT |
605 | if (retval) |
606 | return retval; | |
607 | ||
608 | retval = udev->state == UIST_CREATED ? | |
cbf05413 | 609 | uinput_inject_events(udev, buffer, count) : |
052876f8 | 610 | uinput_setup_device_legacy(udev, buffer, count); |
1da177e4 | 611 | |
221979aa | 612 | mutex_unlock(&udev->mutex); |
1da177e4 | 613 | |
29506415 | 614 | return retval; |
1da177e4 LT |
615 | } |
616 | ||
929d1af5 DT |
617 | static bool uinput_fetch_next_event(struct uinput_device *udev, |
618 | struct input_event *event) | |
619 | { | |
620 | bool have_event; | |
621 | ||
622 | spin_lock_irq(&udev->dev->event_lock); | |
623 | ||
624 | have_event = udev->head != udev->tail; | |
625 | if (have_event) { | |
626 | *event = udev->buff[udev->tail]; | |
627 | udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE; | |
628 | } | |
629 | ||
630 | spin_unlock_irq(&udev->dev->event_lock); | |
631 | ||
632 | return have_event; | |
633 | } | |
634 | ||
22ae19c6 DT |
635 | static ssize_t uinput_events_to_user(struct uinput_device *udev, |
636 | char __user *buffer, size_t count) | |
1da177e4 | 637 | { |
929d1af5 | 638 | struct input_event event; |
22ae19c6 | 639 | size_t read = 0; |
1da177e4 | 640 | |
22ae19c6 DT |
641 | while (read + input_event_size() <= count && |
642 | uinput_fetch_next_event(udev, &event)) { | |
f40033ac | 643 | |
00ce756c DT |
644 | if (input_event_to_user(buffer + read, &event)) |
645 | return -EFAULT; | |
1da177e4 | 646 | |
22ae19c6 DT |
647 | read += input_event_size(); |
648 | } | |
1da177e4 | 649 | |
00ce756c | 650 | return read; |
22ae19c6 | 651 | } |
1da177e4 | 652 | |
22ae19c6 DT |
653 | static ssize_t uinput_read(struct file *file, char __user *buffer, |
654 | size_t count, loff_t *ppos) | |
655 | { | |
656 | struct uinput_device *udev = file->private_data; | |
657 | ssize_t retval; | |
29506415 | 658 | |
22ae19c6 DT |
659 | if (count != 0 && count < input_event_size()) |
660 | return -EINVAL; | |
1da177e4 | 661 | |
22ae19c6 DT |
662 | do { |
663 | retval = mutex_lock_interruptible(&udev->mutex); | |
664 | if (retval) | |
665 | return retval; | |
929d1af5 | 666 | |
22ae19c6 DT |
667 | if (udev->state != UIST_CREATED) |
668 | retval = -ENODEV; | |
669 | else if (udev->head == udev->tail && | |
670 | (file->f_flags & O_NONBLOCK)) | |
671 | retval = -EAGAIN; | |
672 | else | |
673 | retval = uinput_events_to_user(udev, buffer, count); | |
929d1af5 | 674 | |
22ae19c6 | 675 | mutex_unlock(&udev->mutex); |
1da177e4 | 676 | |
22ae19c6 DT |
677 | if (retval || count == 0) |
678 | break; | |
679 | ||
680 | if (!(file->f_flags & O_NONBLOCK)) | |
681 | retval = wait_event_interruptible(udev->waitq, | |
682 | udev->head != udev->tail || | |
683 | udev->state != UIST_CREATED); | |
684 | } while (retval == 0); | |
29506415 | 685 | |
1da177e4 LT |
686 | return retval; |
687 | } | |
688 | ||
afc9a42b | 689 | static __poll_t uinput_poll(struct file *file, poll_table *wait) |
1da177e4 LT |
690 | { |
691 | struct uinput_device *udev = file->private_data; | |
692 | ||
693 | poll_wait(file, &udev->waitq, wait); | |
694 | ||
695 | if (udev->head != udev->tail) | |
a9a08845 | 696 | return EPOLLIN | EPOLLRDNORM; |
1da177e4 LT |
697 | |
698 | return 0; | |
699 | } | |
700 | ||
29506415 | 701 | static int uinput_release(struct inode *inode, struct file *file) |
1da177e4 | 702 | { |
29506415 | 703 | struct uinput_device *udev = file->private_data; |
1da177e4 | 704 | |
29506415 | 705 | uinput_destroy_device(udev); |
1da177e4 LT |
706 | kfree(udev); |
707 | ||
708 | return 0; | |
709 | } | |
710 | ||
2d56f3a3 PL |
711 | #ifdef CONFIG_COMPAT |
712 | struct uinput_ff_upload_compat { | |
c5b3533a DT |
713 | __u32 request_id; |
714 | __s32 retval; | |
2d56f3a3 PL |
715 | struct ff_effect_compat effect; |
716 | struct ff_effect_compat old; | |
717 | }; | |
718 | ||
719 | static int uinput_ff_upload_to_user(char __user *buffer, | |
720 | const struct uinput_ff_upload *ff_up) | |
721 | { | |
b8b4ead1 | 722 | if (in_compat_syscall()) { |
2d56f3a3 PL |
723 | struct uinput_ff_upload_compat ff_up_compat; |
724 | ||
725 | ff_up_compat.request_id = ff_up->request_id; | |
726 | ff_up_compat.retval = ff_up->retval; | |
727 | /* | |
728 | * It so happens that the pointer that gives us the trouble | |
729 | * is the last field in the structure. Since we don't support | |
730 | * custom waveforms in uinput anyway we can just copy the whole | |
731 | * thing (to the compat size) and ignore the pointer. | |
732 | */ | |
733 | memcpy(&ff_up_compat.effect, &ff_up->effect, | |
734 | sizeof(struct ff_effect_compat)); | |
735 | memcpy(&ff_up_compat.old, &ff_up->old, | |
736 | sizeof(struct ff_effect_compat)); | |
737 | ||
738 | if (copy_to_user(buffer, &ff_up_compat, | |
739 | sizeof(struct uinput_ff_upload_compat))) | |
740 | return -EFAULT; | |
741 | } else { | |
742 | if (copy_to_user(buffer, ff_up, | |
743 | sizeof(struct uinput_ff_upload))) | |
744 | return -EFAULT; | |
745 | } | |
746 | ||
747 | return 0; | |
748 | } | |
749 | ||
750 | static int uinput_ff_upload_from_user(const char __user *buffer, | |
751 | struct uinput_ff_upload *ff_up) | |
752 | { | |
b8b4ead1 | 753 | if (in_compat_syscall()) { |
2d56f3a3 PL |
754 | struct uinput_ff_upload_compat ff_up_compat; |
755 | ||
756 | if (copy_from_user(&ff_up_compat, buffer, | |
757 | sizeof(struct uinput_ff_upload_compat))) | |
758 | return -EFAULT; | |
759 | ||
760 | ff_up->request_id = ff_up_compat.request_id; | |
761 | ff_up->retval = ff_up_compat.retval; | |
762 | memcpy(&ff_up->effect, &ff_up_compat.effect, | |
763 | sizeof(struct ff_effect_compat)); | |
764 | memcpy(&ff_up->old, &ff_up_compat.old, | |
765 | sizeof(struct ff_effect_compat)); | |
766 | ||
767 | } else { | |
768 | if (copy_from_user(ff_up, buffer, | |
769 | sizeof(struct uinput_ff_upload))) | |
770 | return -EFAULT; | |
771 | } | |
772 | ||
773 | return 0; | |
774 | } | |
775 | ||
776 | #else | |
777 | ||
778 | static int uinput_ff_upload_to_user(char __user *buffer, | |
779 | const struct uinput_ff_upload *ff_up) | |
780 | { | |
781 | if (copy_to_user(buffer, ff_up, sizeof(struct uinput_ff_upload))) | |
782 | return -EFAULT; | |
783 | ||
784 | return 0; | |
785 | } | |
786 | ||
787 | static int uinput_ff_upload_from_user(const char __user *buffer, | |
788 | struct uinput_ff_upload *ff_up) | |
789 | { | |
790 | if (copy_from_user(ff_up, buffer, sizeof(struct uinput_ff_upload))) | |
791 | return -EFAULT; | |
792 | ||
793 | return 0; | |
794 | } | |
795 | ||
796 | #endif | |
797 | ||
29506415 DT |
798 | #define uinput_set_bit(_arg, _bit, _max) \ |
799 | ({ \ | |
800 | int __ret = 0; \ | |
801 | if (udev->state == UIST_CREATED) \ | |
802 | __ret = -EINVAL; \ | |
803 | else if ((_arg) > (_max)) \ | |
804 | __ret = -EINVAL; \ | |
805 | else set_bit((_arg), udev->dev->_bit); \ | |
806 | __ret; \ | |
807 | }) | |
808 | ||
e3480a61 BT |
809 | static int uinput_str_to_user(void __user *dest, const char *str, |
810 | unsigned int maxlen) | |
811 | { | |
812 | char __user *p = dest; | |
813 | int len, ret; | |
814 | ||
815 | if (!str) | |
816 | return -ENOENT; | |
817 | ||
818 | if (maxlen == 0) | |
819 | return -EINVAL; | |
820 | ||
821 | len = strlen(str) + 1; | |
822 | if (len > maxlen) | |
823 | len = maxlen; | |
824 | ||
825 | ret = copy_to_user(p, str, len); | |
826 | if (ret) | |
827 | return -EFAULT; | |
828 | ||
829 | /* force terminating '\0' */ | |
830 | ret = put_user(0, p + len - 1); | |
831 | return ret ? -EFAULT : len; | |
832 | } | |
833 | ||
2d56f3a3 PL |
834 | static long uinput_ioctl_handler(struct file *file, unsigned int cmd, |
835 | unsigned long arg, void __user *p) | |
1da177e4 | 836 | { |
29506415 | 837 | int retval; |
2d56f3a3 | 838 | struct uinput_device *udev = file->private_data; |
1da177e4 LT |
839 | struct uinput_ff_upload ff_up; |
840 | struct uinput_ff_erase ff_erase; | |
841 | struct uinput_request *req; | |
5b6271bd | 842 | char *phys; |
e3480a61 BT |
843 | const char *name; |
844 | unsigned int size; | |
1da177e4 | 845 | |
221979aa | 846 | retval = mutex_lock_interruptible(&udev->mutex); |
29506415 DT |
847 | if (retval) |
848 | return retval; | |
849 | ||
850 | if (!udev->dev) { | |
04ce40a6 | 851 | udev->dev = input_allocate_device(); |
781f2dd0 DC |
852 | if (!udev->dev) { |
853 | retval = -ENOMEM; | |
854 | goto out; | |
855 | } | |
1da177e4 LT |
856 | } |
857 | ||
858 | switch (cmd) { | |
c0661652 DT |
859 | case UI_GET_VERSION: |
860 | if (put_user(UINPUT_VERSION, (unsigned int __user *)p)) | |
861 | retval = -EFAULT; | |
862 | goto out; | |
ba4e9a61 | 863 | |
c0661652 DT |
864 | case UI_DEV_CREATE: |
865 | retval = uinput_create_device(udev); | |
866 | goto out; | |
1da177e4 | 867 | |
c0661652 DT |
868 | case UI_DEV_DESTROY: |
869 | uinput_destroy_device(udev); | |
870 | goto out; | |
1da177e4 | 871 | |
c0661652 DT |
872 | case UI_DEV_SETUP: |
873 | retval = uinput_dev_setup(udev, p); | |
874 | goto out; | |
052876f8 | 875 | |
c0661652 | 876 | /* UI_ABS_SETUP is handled in the variable size ioctls */ |
052876f8 | 877 | |
c0661652 DT |
878 | case UI_SET_EVBIT: |
879 | retval = uinput_set_bit(arg, evbit, EV_MAX); | |
880 | goto out; | |
1da177e4 | 881 | |
c0661652 DT |
882 | case UI_SET_KEYBIT: |
883 | retval = uinput_set_bit(arg, keybit, KEY_MAX); | |
884 | goto out; | |
1da177e4 | 885 | |
c0661652 DT |
886 | case UI_SET_RELBIT: |
887 | retval = uinput_set_bit(arg, relbit, REL_MAX); | |
888 | goto out; | |
1da177e4 | 889 | |
c0661652 DT |
890 | case UI_SET_ABSBIT: |
891 | retval = uinput_set_bit(arg, absbit, ABS_MAX); | |
892 | goto out; | |
1da177e4 | 893 | |
c0661652 DT |
894 | case UI_SET_MSCBIT: |
895 | retval = uinput_set_bit(arg, mscbit, MSC_MAX); | |
896 | goto out; | |
1da177e4 | 897 | |
c0661652 DT |
898 | case UI_SET_LEDBIT: |
899 | retval = uinput_set_bit(arg, ledbit, LED_MAX); | |
900 | goto out; | |
901 | ||
902 | case UI_SET_SNDBIT: | |
903 | retval = uinput_set_bit(arg, sndbit, SND_MAX); | |
904 | goto out; | |
905 | ||
906 | case UI_SET_FFBIT: | |
907 | retval = uinput_set_bit(arg, ffbit, FF_MAX); | |
908 | goto out; | |
909 | ||
910 | case UI_SET_SWBIT: | |
911 | retval = uinput_set_bit(arg, swbit, SW_MAX); | |
912 | goto out; | |
913 | ||
914 | case UI_SET_PROPBIT: | |
915 | retval = uinput_set_bit(arg, propbit, INPUT_PROP_MAX); | |
916 | goto out; | |
1da177e4 | 917 | |
c0661652 DT |
918 | case UI_SET_PHYS: |
919 | if (udev->state == UIST_CREATED) { | |
920 | retval = -EINVAL; | |
9d51e801 | 921 | goto out; |
c0661652 | 922 | } |
1da177e4 | 923 | |
c0661652 DT |
924 | phys = strndup_user(p, 1024); |
925 | if (IS_ERR(phys)) { | |
926 | retval = PTR_ERR(phys); | |
9d51e801 | 927 | goto out; |
c0661652 DT |
928 | } |
929 | ||
930 | kfree(udev->dev->phys); | |
931 | udev->dev->phys = phys; | |
932 | goto out; | |
1da177e4 | 933 | |
c0661652 DT |
934 | case UI_BEGIN_FF_UPLOAD: |
935 | retval = uinput_ff_upload_from_user(p, &ff_up); | |
936 | if (retval) | |
9d51e801 | 937 | goto out; |
59c7c037 | 938 | |
c0661652 DT |
939 | req = uinput_request_find(udev, ff_up.request_id); |
940 | if (!req || req->code != UI_FF_UPLOAD || | |
941 | !req->u.upload.effect) { | |
942 | retval = -EINVAL; | |
9d51e801 | 943 | goto out; |
c0661652 | 944 | } |
85b77200 | 945 | |
c0661652 DT |
946 | ff_up.retval = 0; |
947 | ff_up.effect = *req->u.upload.effect; | |
948 | if (req->u.upload.old) | |
949 | ff_up.old = *req->u.upload.old; | |
950 | else | |
951 | memset(&ff_up.old, 0, sizeof(struct ff_effect)); | |
4dfcc271 | 952 | |
c0661652 DT |
953 | retval = uinput_ff_upload_to_user(p, &ff_up); |
954 | goto out; | |
4dfcc271 | 955 | |
c0661652 DT |
956 | case UI_BEGIN_FF_ERASE: |
957 | if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) { | |
958 | retval = -EFAULT; | |
9d51e801 | 959 | goto out; |
c0661652 | 960 | } |
1da177e4 | 961 | |
c0661652 DT |
962 | req = uinput_request_find(udev, ff_erase.request_id); |
963 | if (!req || req->code != UI_FF_ERASE) { | |
964 | retval = -EINVAL; | |
9d51e801 | 965 | goto out; |
c0661652 | 966 | } |
1da177e4 | 967 | |
c0661652 DT |
968 | ff_erase.retval = 0; |
969 | ff_erase.effect_id = req->u.effect_id; | |
970 | if (copy_to_user(p, &ff_erase, sizeof(ff_erase))) { | |
971 | retval = -EFAULT; | |
9d51e801 | 972 | goto out; |
c0661652 | 973 | } |
1da177e4 | 974 | |
c0661652 | 975 | goto out; |
2d56f3a3 | 976 | |
c0661652 DT |
977 | case UI_END_FF_UPLOAD: |
978 | retval = uinput_ff_upload_from_user(p, &ff_up); | |
979 | if (retval) | |
980 | goto out; | |
2d56f3a3 | 981 | |
c0661652 DT |
982 | req = uinput_request_find(udev, ff_up.request_id); |
983 | if (!req || req->code != UI_FF_UPLOAD || | |
984 | !req->u.upload.effect) { | |
985 | retval = -EINVAL; | |
9d51e801 | 986 | goto out; |
c0661652 | 987 | } |
1da177e4 | 988 | |
c0661652 DT |
989 | req->retval = ff_up.retval; |
990 | complete(&req->done); | |
991 | goto out; | |
2d56f3a3 | 992 | |
c0661652 DT |
993 | case UI_END_FF_ERASE: |
994 | if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) { | |
995 | retval = -EFAULT; | |
996 | goto out; | |
997 | } | |
2d56f3a3 | 998 | |
c0661652 DT |
999 | req = uinput_request_find(udev, ff_erase.request_id); |
1000 | if (!req || req->code != UI_FF_ERASE) { | |
1001 | retval = -EINVAL; | |
9d51e801 | 1002 | goto out; |
c0661652 DT |
1003 | } |
1004 | ||
1005 | req->retval = ff_erase.retval; | |
1006 | complete(&req->done); | |
1007 | goto out; | |
1da177e4 | 1008 | } |
29506415 | 1009 | |
e3480a61 BT |
1010 | size = _IOC_SIZE(cmd); |
1011 | ||
1012 | /* Now check variable-length commands */ | |
1013 | switch (cmd & ~IOCSIZE_MASK) { | |
1014 | case UI_GET_SYSNAME(0): | |
1015 | if (udev->state != UIST_CREATED) { | |
1016 | retval = -ENOENT; | |
1017 | goto out; | |
1018 | } | |
1019 | name = dev_name(&udev->dev->dev); | |
1020 | retval = uinput_str_to_user(p, name, size); | |
1021 | goto out; | |
052876f8 BT |
1022 | |
1023 | case UI_ABS_SETUP & ~IOCSIZE_MASK: | |
1024 | retval = uinput_abs_setup(udev, p, size); | |
1025 | goto out; | |
e3480a61 BT |
1026 | } |
1027 | ||
9d51e801 | 1028 | retval = -EINVAL; |
29506415 | 1029 | out: |
221979aa | 1030 | mutex_unlock(&udev->mutex); |
1da177e4 LT |
1031 | return retval; |
1032 | } | |
1033 | ||
2d56f3a3 PL |
1034 | static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg) |
1035 | { | |
1036 | return uinput_ioctl_handler(file, cmd, arg, (void __user *)arg); | |
1037 | } | |
1038 | ||
1039 | #ifdef CONFIG_COMPAT | |
affa80bd RL |
1040 | |
1041 | #define UI_SET_PHYS_COMPAT _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t) | |
1042 | ||
54ce165e DT |
1043 | static long uinput_compat_ioctl(struct file *file, |
1044 | unsigned int cmd, unsigned long arg) | |
2d56f3a3 | 1045 | { |
affa80bd RL |
1046 | if (cmd == UI_SET_PHYS_COMPAT) |
1047 | cmd = UI_SET_PHYS; | |
1048 | ||
2d56f3a3 PL |
1049 | return uinput_ioctl_handler(file, cmd, arg, compat_ptr(arg)); |
1050 | } | |
1051 | #endif | |
1052 | ||
2b8693c0 | 1053 | static const struct file_operations uinput_fops = { |
29506415 DT |
1054 | .owner = THIS_MODULE, |
1055 | .open = uinput_open, | |
1056 | .release = uinput_release, | |
1057 | .read = uinput_read, | |
1058 | .write = uinput_write, | |
1059 | .poll = uinput_poll, | |
1060 | .unlocked_ioctl = uinput_ioctl, | |
2d56f3a3 PL |
1061 | #ifdef CONFIG_COMPAT |
1062 | .compat_ioctl = uinput_compat_ioctl, | |
1063 | #endif | |
6038f373 | 1064 | .llseek = no_llseek, |
1da177e4 LT |
1065 | }; |
1066 | ||
1067 | static struct miscdevice uinput_misc = { | |
29506415 DT |
1068 | .fops = &uinput_fops, |
1069 | .minor = UINPUT_MINOR, | |
1070 | .name = UINPUT_NAME, | |
1da177e4 | 1071 | }; |
ca75d601 PM |
1072 | module_misc_device(uinput_misc); |
1073 | ||
8905aaaf KS |
1074 | MODULE_ALIAS_MISCDEV(UINPUT_MINOR); |
1075 | MODULE_ALIAS("devname:" UINPUT_NAME); | |
1da177e4 | 1076 | |
1da177e4 LT |
1077 | MODULE_AUTHOR("Aristeu Sergio Rozanski Filho"); |
1078 | MODULE_DESCRIPTION("User level driver support for input subsystem"); | |
1079 | MODULE_LICENSE("GPL"); |