drivers/input/misc/uinput.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *  User level driver support for input subsystem
   4  *
   5  * Heavily based on evdev.c by Vojtech Pavlik
   6  *
   7  * Author: Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org>
   8  *
   9  * Changes/Revisions:
  10  *      0.4     01/09/2014 (Benjamin Tissoires <benjamin.tissoires@redhat.com>)
  11  *              - add UI_GET_SYSNAME ioctl
  12  *      0.3     09/04/2006 (Anssi Hannula <anssi.hannula@gmail.com>)
  13  *              - updated ff support for the changes in kernel interface
  14  *              - added MODULE_VERSION
  15  *      0.2     16/10/2004 (Micah Dowty <micah@navi.cx>)
  16  *              - added force feedback support
  17  *              - added UI_SET_PHYS
  18  *      0.1     20/06/2002
  19  *              - first public version
  20  */
  21 #include <uapi/linux/uinput.h>
  22 #include <linux/poll.h>
  23 #include <linux/sched.h>
  24 #include <linux/slab.h>
  25 #include <linux/module.h>
  26 #include <linux/init.h>
  27 #include <linux/fs.h>
  28 #include <linux/miscdevice.h>
  29 #include <linux/overflow.h>
  30 #include <linux/input/mt.h>
  31 #include "../input-compat.h"
  32
  33 #define UINPUT_NAME             "uinput"
  34 #define UINPUT_BUFFER_SIZE      16
  35 #define UINPUT_NUM_REQUESTS     16
  36 #define UINPUT_TIMESTAMP_ALLOWED_OFFSET_SECS 10
  37
  38 enum uinput_state { UIST_NEW_DEVICE, UIST_SETUP_COMPLETE, UIST_CREATED };
  39
  40 struct uinput_request {
  41         unsigned int            id;
  42         unsigned int            code;   /* UI_FF_UPLOAD, UI_FF_ERASE */
  43
  44         int                     retval;
  45         struct completion       done;
  46
  47         union {
  48                 unsigned int    effect_id;
  49                 struct {
  50                         struct ff_effect *effect;
  51                         struct ff_effect *old;
  52                 } upload;
  53         } u;
  54 };
  55
  56 struct uinput_device {
  57         struct input_dev        *dev;
  58         struct mutex            mutex;
  59         enum uinput_state       state;
  60         wait_queue_head_t       waitq;
  61         unsigned char           ready;
  62         unsigned char           head;
  63         unsigned char           tail;
  64         struct input_event      buff[UINPUT_BUFFER_SIZE];
  65         unsigned int            ff_effects_max;
  66
  67         struct uinput_request   *requests[UINPUT_NUM_REQUESTS];
  68         wait_queue_head_t       requests_waitq;
  69         spinlock_t              requests_lock;
  70 };
  71
  72 static int uinput_dev_event(struct input_dev *dev,
  73                             unsigned int type, unsigned int code, int value)
  74 {
  75         struct uinput_device    *udev = input_get_drvdata(dev);
  76         struct timespec64       ts;
  77
  78         ktime_get_ts64(&ts);
  79
  80         udev->buff[udev->head] = (struct input_event) {
  81                 .input_event_sec = ts.tv_sec,
  82                 .input_event_usec = ts.tv_nsec / NSEC_PER_USEC,
  83                 .type = type,
  84                 .code = code,
  85                 .value = value,
  86         };
  87
  88         udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE;
  89
  90         wake_up_interruptible(&udev->waitq);
  91
  92         return 0;
  93 }
  94
  95 /* Atomically allocate an ID for the given request. Returns 0 on success. */
  96 static bool uinput_request_alloc_id(struct uinput_device *udev,
  97                                     struct uinput_request *request)
  98 {
  99         unsigned int id;
 100         bool reserved = false;
 101
 102         spin_lock(&udev->requests_lock);
 103
 104         for (id = 0; id < UINPUT_NUM_REQUESTS; id++) {
 105                 if (!udev->requests[id]) {
 106                         request->id = id;
 107                         udev->requests[id] = request;
 108                         reserved = true;
 109                         break;
 110                 }
 111         }
 112
 113         spin_unlock(&udev->requests_lock);
 114         return reserved;
 115 }
 116
 117 static struct uinput_request *uinput_request_find(struct uinput_device *udev,
 118                                                   unsigned int id)
 119 {
 120         /* Find an input request, by ID. Returns NULL if the ID isn't valid. */
 121         if (id >= UINPUT_NUM_REQUESTS)
 122                 return NULL;
 123
 124         return udev->requests[id];
 125 }
 126
 127 static int uinput_request_reserve_slot(struct uinput_device *udev,
 128                                        struct uinput_request *request)
 129 {
 130         /* Allocate slot. If none are available right away, wait. */
 131         return wait_event_interruptible(udev->requests_waitq,
 132                                         uinput_request_alloc_id(udev, request));
 133 }
 134
 135 static void uinput_request_release_slot(struct uinput_device *udev,
 136                                         unsigned int id)
 137 {
 138         /* Mark slot as available */
 139         spin_lock(&udev->requests_lock);
 140         udev->requests[id] = NULL;
 141         spin_unlock(&udev->requests_lock);
 142
 143         wake_up(&udev->requests_waitq);
 144 }
 145
 146 static int uinput_request_send(struct uinput_device *udev,
 147                                struct uinput_request *request)
 148 {
 149         int retval;
 150
 151         retval = mutex_lock_interruptible(&udev->mutex);
 152         if (retval)
 153                 return retval;
 154
 155         if (udev->state != UIST_CREATED) {
 156                 retval = -ENODEV;
 157                 goto out;
 158         }
 159
 160         init_completion(&request->done);
 161
 162         /*
 163          * Tell our userspace application about this new request
 164          * by queueing an input event.
 165          */
 166         uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id);
 167
 168  out:
 169         mutex_unlock(&udev->mutex);
 170         return retval;
 171 }
 172
 173 static int uinput_request_submit(struct uinput_device *udev,
 174                                  struct uinput_request *request)
 175 {
 176         int retval;
 177
 178         retval = uinput_request_reserve_slot(udev, request);
 179         if (retval)
 180                 return retval;
 181
 182         retval = uinput_request_send(udev, request);
 183         if (retval)
 184                 goto out;
 185
 186         if (!wait_for_completion_timeout(&request->done, 30 * HZ)) {
 187                 retval = -ETIMEDOUT;
 188                 goto out;
 189         }
 190
 191         retval = request->retval;
 192
 193  out:
 194         uinput_request_release_slot(udev, request->id);
 195         return retval;
 196 }
 197
 198 /*
 199  * Fail all outstanding requests so handlers don't wait for the userspace
 200  * to finish processing them.
 201  */
 202 static void uinput_flush_requests(struct uinput_device *udev)
 203 {
 204         struct uinput_request *request;
 205         int i;
 206
 207         spin_lock(&udev->requests_lock);
 208
 209         for (i = 0; i < UINPUT_NUM_REQUESTS; i++) {
 210                 request = udev->requests[i];
 211                 if (request) {
 212                         request->retval = -ENODEV;
 213                         complete(&request->done);
 214                 }
 215         }
 216
 217         spin_unlock(&udev->requests_lock);
 218 }
 219
 220 static void uinput_dev_set_gain(struct input_dev *dev, u16 gain)
 221 {
 222         uinput_dev_event(dev, EV_FF, FF_GAIN, gain);
 223 }
 224
 225 static void uinput_dev_set_autocenter(struct input_dev *dev, u16 magnitude)
 226 {
 227         uinput_dev_event(dev, EV_FF, FF_AUTOCENTER, magnitude);
 228 }
 229
 230 static int uinput_dev_playback(struct input_dev *dev, int effect_id, int value)
 231 {
 232         return uinput_dev_event(dev, EV_FF, effect_id, value);
 233 }
 234
 235 static int uinput_dev_upload_effect(struct input_dev *dev,
 236                                     struct ff_effect *effect,
 237                                     struct ff_effect *old)
 238 {
 239         struct uinput_device *udev = input_get_drvdata(dev);
 240         struct uinput_request request;
 241
 242         /*
 243          * uinput driver does not currently support periodic effects with
 244          * custom waveform since it does not have a way to pass buffer of
 245          * samples (custom_data) to userspace. If ever there is a device
 246          * supporting custom waveforms we would need to define an additional
 247          * ioctl (UI_UPLOAD_SAMPLES) but for now we just bail out.
 248          */
 249         if (effect->type == FF_PERIODIC &&
 250                         effect->u.periodic.waveform == FF_CUSTOM)
 251                 return -EINVAL;
 252
 253         request.code = UI_FF_UPLOAD;
 254         request.u.upload.effect = effect;
 255         request.u.upload.old = old;
 256
 257         return uinput_request_submit(udev, &request);
 258 }
 259
 260 static int uinput_dev_erase_effect(struct input_dev *dev, int effect_id)
 261 {
 262         struct uinput_device *udev = input_get_drvdata(dev);
 263         struct uinput_request request;
 264
 265         if (!test_bit(EV_FF, dev->evbit))
 266                 return -ENOSYS;
 267
 268         request.code = UI_FF_ERASE;
 269         request.u.effect_id = effect_id;
 270
 271         return uinput_request_submit(udev, &request);
 272 }
 273
 274 static int uinput_dev_flush(struct input_dev *dev, struct file *file)
 275 {
 276         /*
 277          * If we are called with file == NULL that means we are tearing
 278          * down the device, and therefore we can not handle FF erase
 279          * requests: either we are handling UI_DEV_DESTROY (and holding
 280          * the udev->mutex), or the file descriptor is closed and there is
 281          * nobody on the other side anymore.
 282          */
 283         return file ? input_ff_flush(dev, file) : 0;
 284 }
 285
 286 static void uinput_destroy_device(struct uinput_device *udev)
 287 {
 288         const char *name, *phys;
 289         struct input_dev *dev = udev->dev;
 290         enum uinput_state old_state = udev->state;
 291
 292         udev->state = UIST_NEW_DEVICE;
 293
 294         if (dev) {
 295                 name = dev->name;
 296                 phys = dev->phys;
 297                 if (old_state == UIST_CREATED) {
 298                         uinput_flush_requests(udev);
 299                         input_unregister_device(dev);
 300                 } else {
 301                         input_free_device(dev);
 302                 }
 303                 kfree(name);
 304                 kfree(phys);
 305                 udev->dev = NULL;
 306         }
 307 }
 308
 309 static int uinput_create_device(struct uinput_device *udev)
 310 {
 311         struct input_dev *dev = udev->dev;
 312         int error, nslot;
 313
 314         if (udev->state != UIST_SETUP_COMPLETE) {
 315                 printk(KERN_DEBUG "%s: write device info first\n", UINPUT_NAME);
 316                 return -EINVAL;
 317         }
 318
 319         if (test_bit(EV_ABS, dev->evbit)) {
 320                 input_alloc_absinfo(dev);
 321                 if (!dev->absinfo) {
 322                         error = -EINVAL;
 323                         goto fail1;
 324                 }
 325
 326                 if (test_bit(ABS_MT_SLOT, dev->absbit)) {
 327                         nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
 328                         error = input_mt_init_slots(dev, nslot, 0);
 329                         if (error)
 330                                 goto fail1;
 331                 } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
 332                         input_set_events_per_packet(dev, 60);
 333                 }
 334         }
 335
 336         if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) {
 337                 printk(KERN_DEBUG "%s: ff_effects_max should be non-zero when FF_BIT is set\n",
 338                         UINPUT_NAME);
 339                 error = -EINVAL;
 340                 goto fail1;
 341         }
 342
 343         if (udev->ff_effects_max) {
 344                 error = input_ff_create(dev, udev->ff_effects_max);
 345                 if (error)
 346                         goto fail1;
 347
 348                 dev->ff->upload = uinput_dev_upload_effect;
 349                 dev->ff->erase = uinput_dev_erase_effect;
 350                 dev->ff->playback = uinput_dev_playback;
 351                 dev->ff->set_gain = uinput_dev_set_gain;
 352                 dev->ff->set_autocenter = uinput_dev_set_autocenter;
 353                 /*
 354                  * The standard input_ff_flush() implementation does
 355                  * not quite work for uinput as we can't reasonably
 356                  * handle FF requests during device teardown.
 357                  */
 358                 dev->flush = uinput_dev_flush;
 359         }
 360
 361         dev->event = uinput_dev_event;
 362
 363         input_set_drvdata(udev->dev, udev);
 364
 365         error = input_register_device(udev->dev);
 366         if (error)
 367                 goto fail2;
 368
 369         udev->state = UIST_CREATED;
 370
 371         return 0;
 372
 373  fail2: input_ff_destroy(dev);
 374  fail1: uinput_destroy_device(udev);
 375         return error;
 376 }
 377
 378 static int uinput_open(struct inode *inode, struct file *file)
 379 {
 380         struct uinput_device *newdev;
 381
 382         newdev = kzalloc(sizeof(struct uinput_device), GFP_KERNEL);
 383         if (!newdev)
 384                 return -ENOMEM;
 385
 386         mutex_init(&newdev->mutex);
 387         spin_lock_init(&newdev->requests_lock);
 388         init_waitqueue_head(&newdev->requests_waitq);
 389         init_waitqueue_head(&newdev->waitq);
 390         newdev->state = UIST_NEW_DEVICE;
 391
 392         file->private_data = newdev;
 393         stream_open(inode, file);
 394
 395         return 0;
 396 }
 397
 398 static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
 399                                    const struct input_absinfo *abs)
 400 {
 401         int min, max, range;
 402
 403         min = abs->minimum;
 404         max = abs->maximum;
 405
 406         if ((min != 0 || max != 0) && max < min) {
 407                 printk(KERN_DEBUG
 408                        "%s: invalid abs[%02x] min:%d max:%d\n",
 409                        UINPUT_NAME, code, min, max);
 410                 return -EINVAL;
 411         }
 412
 413         if (!check_sub_overflow(max, min, &range) && abs->flat > range) {
 414                 printk(KERN_DEBUG
 415                        "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n",
 416                        UINPUT_NAME, code, abs->flat, min, max);
 417                 return -EINVAL;
 418         }
 419
 420         return 0;
 421 }
 422
 423 static int uinput_validate_absbits(struct input_dev *dev)
 424 {
 425         unsigned int cnt;
 426         int error;
 427
 428         if (!test_bit(EV_ABS, dev->evbit))
 429                 return 0;
 430
 431         /*
 432          * Check if absmin/absmax/absfuzz/absflat are sane.
 433          */
 434
 435         for_each_set_bit(cnt, dev->absbit, ABS_CNT) {
 436                 if (!dev->absinfo)
 437                         return -EINVAL;
 438
 439                 error = uinput_validate_absinfo(dev, cnt, &dev->absinfo[cnt]);
 440                 if (error)
 441                         return error;
 442         }
 443
 444         return 0;
 445 }
 446
 447 static int uinput_dev_setup(struct uinput_device *udev,
 448                             struct uinput_setup __user *arg)
 449 {
 450         struct uinput_setup setup;
 451         struct input_dev *dev;
 452
 453         if (udev->state == UIST_CREATED)
 454                 return -EINVAL;
 455
 456         if (copy_from_user(&setup, arg, sizeof(setup)))
 457                 return -EFAULT;
 458
 459         if (!setup.name[0])
 460                 return -EINVAL;
 461
 462         dev = udev->dev;
 463         dev->id = setup.id;
 464         udev->ff_effects_max = setup.ff_effects_max;
 465
 466         kfree(dev->name);
 467         dev->name = kstrndup(setup.name, UINPUT_MAX_NAME_SIZE, GFP_KERNEL);
 468         if (!dev->name)
 469                 return -ENOMEM;
 470
 471         udev->state = UIST_SETUP_COMPLETE;
 472         return 0;
 473 }
 474
 475 static int uinput_abs_setup(struct uinput_device *udev,
 476                             struct uinput_setup __user *arg, size_t size)
 477 {
 478         struct uinput_abs_setup setup = {};
 479         struct input_dev *dev;
 480         int error;
 481
 482         if (size > sizeof(setup))
 483                 return -E2BIG;
 484
 485         if (udev->state == UIST_CREATED)
 486                 return -EINVAL;
 487
 488         if (copy_from_user(&setup, arg, size))
 489                 return -EFAULT;
 490
 491         if (setup.code > ABS_MAX)
 492                 return -ERANGE;
 493
 494         dev = udev->dev;
 495
 496         error = uinput_validate_absinfo(dev, setup.code, &setup.absinfo);
 497         if (error)
 498                 return error;
 499
 500         input_alloc_absinfo(dev);
 501         if (!dev->absinfo)
 502                 return -ENOMEM;
 503
 504         set_bit(setup.code, dev->absbit);
 505         dev->absinfo[setup.code] = setup.absinfo;
 506         return 0;
 507 }
 508
 509 /* legacy setup via write() */
 510 static int uinput_setup_device_legacy(struct uinput_device *udev,
 511                                       const char __user *buffer, size_t count)
 512 {
 513         struct uinput_user_dev  *user_dev;
 514         struct input_dev        *dev;
 515         int                     i;
 516         int                     retval;
 517
 518         if (count != sizeof(struct uinput_user_dev))
 519                 return -EINVAL;
 520
 521         if (!udev->dev) {
 522                 udev->dev = input_allocate_device();
 523                 if (!udev->dev)
 524                         return -ENOMEM;
 525         }
 526
 527         dev = udev->dev;
 528
 529         user_dev = memdup_user(buffer, sizeof(struct uinput_user_dev));
 530         if (IS_ERR(user_dev))
 531                 return PTR_ERR(user_dev);
 532
 533         udev->ff_effects_max = user_dev->ff_effects_max;
 534
 535         /* Ensure name is filled in */
 536         if (!user_dev->name[0]) {
 537                 retval = -EINVAL;
 538                 goto exit;
 539         }
 540
 541         kfree(dev->name);
 542         dev->name = kstrndup(user_dev->name, UINPUT_MAX_NAME_SIZE,
 543                              GFP_KERNEL);
 544         if (!dev->name) {
 545                 retval = -ENOMEM;
 546                 goto exit;
 547         }
 548
 549         dev->id.bustype = user_dev->id.bustype;
 550         dev->id.vendor  = user_dev->id.vendor;
 551         dev->id.product = user_dev->id.product;
 552         dev->id.version = user_dev->id.version;
 553
 554         for (i = 0; i < ABS_CNT; i++) {
 555                 input_abs_set_max(dev, i, user_dev->absmax[i]);
 556                 input_abs_set_min(dev, i, user_dev->absmin[i]);
 557                 input_abs_set_fuzz(dev, i, user_dev->absfuzz[i]);
 558                 input_abs_set_flat(dev, i, user_dev->absflat[i]);
 559         }
 560
 561         retval = uinput_validate_absbits(dev);
 562         if (retval < 0)
 563                 goto exit;
 564
 565         udev->state = UIST_SETUP_COMPLETE;
 566         retval = count;
 567
 568  exit:
 569         kfree(user_dev);
 570         return retval;
 571 }
 572
 573 /*
 574  * Returns true if the given timestamp is valid (i.e., if all the following
 575  * conditions are satisfied), false otherwise.
 576  * 1) given timestamp is positive
 577  * 2) it's within the allowed offset before the current time
 578  * 3) it's not in the future
 579  */
 580 static bool is_valid_timestamp(const ktime_t timestamp)
 581 {
 582         ktime_t zero_time;
 583         ktime_t current_time;
 584         ktime_t min_time;
 585         ktime_t offset;
 586
 587         zero_time = ktime_set(0, 0);
 588         if (ktime_compare(zero_time, timestamp) >= 0)
 589                 return false;
 590
 591         current_time = ktime_get();
 592         offset = ktime_set(UINPUT_TIMESTAMP_ALLOWED_OFFSET_SECS, 0);
 593         min_time = ktime_sub(current_time, offset);
 594
 595         if (ktime_after(min_time, timestamp) || ktime_after(timestamp, current_time))
 596                 return false;
 597
 598         return true;
 599 }
 600
 601 static ssize_t uinput_inject_events(struct uinput_device *udev,
 602                                     const char __user *buffer, size_t count)
 603 {
 604         struct input_event ev;
 605         size_t bytes = 0;
 606         ktime_t timestamp;
 607
 608         if (count != 0 && count < input_event_size())
 609                 return -EINVAL;
 610
 611         while (bytes + input_event_size() <= count) {
 612                 /*
 613                  * Note that even if some events were fetched successfully
 614                  * we are still going to return EFAULT instead of partial
 615                  * count to let userspace know that it got it's buffers
 616                  * all wrong.
 617                  */
 618                 if (input_event_from_user(buffer + bytes, &ev))
 619                         return -EFAULT;
 620
 621                 timestamp = ktime_set(ev.input_event_sec, ev.input_event_usec * NSEC_PER_USEC);
 622                 if (is_valid_timestamp(timestamp))
 623                         input_set_timestamp(udev->dev, timestamp);
 624
 625                 input_event(udev->dev, ev.type, ev.code, ev.value);
 626                 bytes += input_event_size();
 627                 cond_resched();
 628         }
 629
 630         return bytes;
 631 }
 632
 633 static ssize_t uinput_write(struct file *file, const char __user *buffer,
 634                             size_t count, loff_t *ppos)
 635 {
 636         struct uinput_device *udev = file->private_data;
 637         int retval;
 638
 639         if (count == 0)
 640                 return 0;
 641
 642         retval = mutex_lock_interruptible(&udev->mutex);
 643         if (retval)
 644                 return retval;
 645
 646         retval = udev->state == UIST_CREATED ?
 647                         uinput_inject_events(udev, buffer, count) :
 648                         uinput_setup_device_legacy(udev, buffer, count);
 649
 650         mutex_unlock(&udev->mutex);
 651
 652         return retval;
 653 }
 654
 655 static bool uinput_fetch_next_event(struct uinput_device *udev,
 656                                     struct input_event *event)
 657 {
 658         bool have_event;
 659
 660         spin_lock_irq(&udev->dev->event_lock);
 661
 662         have_event = udev->head != udev->tail;
 663         if (have_event) {
 664                 *event = udev->buff[udev->tail];
 665                 udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE;
 666         }
 667
 668         spin_unlock_irq(&udev->dev->event_lock);
 669
 670         return have_event;
 671 }
 672
 673 static ssize_t uinput_events_to_user(struct uinput_device *udev,
 674                                      char __user *buffer, size_t count)
 675 {
 676         struct input_event event;
 677         size_t read = 0;
 678
 679         while (read + input_event_size() <= count &&
 680                uinput_fetch_next_event(udev, &event)) {
 681
 682                 if (input_event_to_user(buffer + read, &event))
 683                         return -EFAULT;
 684
 685                 read += input_event_size();
 686         }
 687
 688         return read;
 689 }
 690
 691 static ssize_t uinput_read(struct file *file, char __user *buffer,
 692                            size_t count, loff_t *ppos)
 693 {
 694         struct uinput_device *udev = file->private_data;
 695         ssize_t retval;
 696
 697         if (count != 0 && count < input_event_size())
 698                 return -EINVAL;
 699
 700         do {
 701                 retval = mutex_lock_interruptible(&udev->mutex);
 702                 if (retval)
 703                         return retval;
 704
 705                 if (udev->state != UIST_CREATED)
 706                         retval = -ENODEV;
 707                 else if (udev->head == udev->tail &&
 708                          (file->f_flags & O_NONBLOCK))
 709                         retval = -EAGAIN;
 710                 else
 711                         retval = uinput_events_to_user(udev, buffer, count);
 712
 713                 mutex_unlock(&udev->mutex);
 714
 715                 if (retval || count == 0)
 716                         break;
 717
 718                 if (!(file->f_flags & O_NONBLOCK))
 719                         retval = wait_event_interruptible(udev->waitq,
 720                                                   udev->head != udev->tail ||
 721                                                   udev->state != UIST_CREATED);
 722         } while (retval == 0);
 723
 724         return retval;
 725 }
 726
 727 static __poll_t uinput_poll(struct file *file, poll_table *wait)
 728 {
 729         struct uinput_device *udev = file->private_data;
 730         __poll_t mask = EPOLLOUT | EPOLLWRNORM; /* uinput is always writable */
 731
 732         poll_wait(file, &udev->waitq, wait);
 733
 734         if (udev->head != udev->tail)
 735                 mask |= EPOLLIN | EPOLLRDNORM;
 736
 737         return mask;
 738 }
 739
 740 static int uinput_release(struct inode *inode, struct file *file)
 741 {
 742         struct uinput_device *udev = file->private_data;
 743
 744         uinput_destroy_device(udev);
 745         kfree(udev);
 746
 747         return 0;
 748 }
 749
 750 #ifdef CONFIG_COMPAT
 751 struct uinput_ff_upload_compat {
 752         __u32                   request_id;
 753         __s32                   retval;
 754         struct ff_effect_compat effect;
 755         struct ff_effect_compat old;
 756 };
 757
 758 static int uinput_ff_upload_to_user(char __user *buffer,
 759                                     const struct uinput_ff_upload *ff_up)
 760 {
 761         if (in_compat_syscall()) {
 762                 struct uinput_ff_upload_compat ff_up_compat;
 763
 764                 ff_up_compat.request_id = ff_up->request_id;
 765                 ff_up_compat.retval = ff_up->retval;
 766                 /*
 767                  * It so happens that the pointer that gives us the trouble
 768                  * is the last field in the structure. Since we don't support
 769                  * custom waveforms in uinput anyway we can just copy the whole
 770                  * thing (to the compat size) and ignore the pointer.
 771                  */
 772                 memcpy(&ff_up_compat.effect, &ff_up->effect,
 773                         sizeof(struct ff_effect_compat));
 774                 memcpy(&ff_up_compat.old, &ff_up->old,
 775                         sizeof(struct ff_effect_compat));
 776
 777                 if (copy_to_user(buffer, &ff_up_compat,
 778                                  sizeof(struct uinput_ff_upload_compat)))
 779                         return -EFAULT;
 780         } else {
 781                 if (copy_to_user(buffer, ff_up,
 782                                  sizeof(struct uinput_ff_upload)))
 783                         return -EFAULT;
 784         }
 785
 786         return 0;
 787 }
 788
 789 static int uinput_ff_upload_from_user(const char __user *buffer,
 790                                       struct uinput_ff_upload *ff_up)
 791 {
 792         if (in_compat_syscall()) {
 793                 struct uinput_ff_upload_compat ff_up_compat;
 794
 795                 if (copy_from_user(&ff_up_compat, buffer,
 796                                    sizeof(struct uinput_ff_upload_compat)))
 797                         return -EFAULT;
 798
 799                 ff_up->request_id = ff_up_compat.request_id;
 800                 ff_up->retval = ff_up_compat.retval;
 801                 memcpy(&ff_up->effect, &ff_up_compat.effect,
 802                         sizeof(struct ff_effect_compat));
 803                 memcpy(&ff_up->old, &ff_up_compat.old,
 804                         sizeof(struct ff_effect_compat));
 805
 806         } else {
 807                 if (copy_from_user(ff_up, buffer,
 808                                    sizeof(struct uinput_ff_upload)))
 809                         return -EFAULT;
 810         }
 811
 812         return 0;
 813 }
 814
 815 #else
 816
 817 static int uinput_ff_upload_to_user(char __user *buffer,
 818                                     const struct uinput_ff_upload *ff_up)
 819 {
 820         if (copy_to_user(buffer, ff_up, sizeof(struct uinput_ff_upload)))
 821                 return -EFAULT;
 822
 823         return 0;
 824 }
 825
 826 static int uinput_ff_upload_from_user(const char __user *buffer,
 827                                       struct uinput_ff_upload *ff_up)
 828 {
 829         if (copy_from_user(ff_up, buffer, sizeof(struct uinput_ff_upload)))
 830                 return -EFAULT;
 831
 832         return 0;
 833 }
 834
 835 #endif
 836
 837 #define uinput_set_bit(_arg, _bit, _max)                \
 838 ({                                                      \
 839         int __ret = 0;                                  \
 840         if (udev->state == UIST_CREATED)                \
 841                 __ret =  -EINVAL;                       \
 842         else if ((_arg) > (_max))                       \
 843                 __ret = -EINVAL;                        \
 844         else set_bit((_arg), udev->dev->_bit);          \
 845         __ret;                                          \
 846 })
 847
 848 static int uinput_str_to_user(void __user *dest, const char *str,
 849                               unsigned int maxlen)
 850 {
 851         char __user *p = dest;
 852         int len, ret;
 853
 854         if (!str)
 855                 return -ENOENT;
 856
 857         if (maxlen == 0)
 858                 return -EINVAL;
 859
 860         len = strlen(str) + 1;
 861         if (len > maxlen)
 862                 len = maxlen;
 863
 864         ret = copy_to_user(p, str, len);
 865         if (ret)
 866                 return -EFAULT;
 867
 868         /* force terminating '\0' */
 869         ret = put_user(0, p + len - 1);
 870         return ret ? -EFAULT : len;
 871 }
 872
 873 static long uinput_ioctl_handler(struct file *file, unsigned int cmd,
 874                                  unsigned long arg, void __user *p)
 875 {
 876         int                     retval;
 877         struct uinput_device    *udev = file->private_data;
 878         struct uinput_ff_upload ff_up;
 879         struct uinput_ff_erase  ff_erase;
 880         struct uinput_request   *req;
 881         char                    *phys;
 882         const char              *name;
 883         unsigned int            size;
 884
 885         retval = mutex_lock_interruptible(&udev->mutex);
 886         if (retval)
 887                 return retval;
 888
 889         if (!udev->dev) {
 890                 udev->dev = input_allocate_device();
 891                 if (!udev->dev) {
 892                         retval = -ENOMEM;
 893                         goto out;
 894                 }
 895         }
 896
 897         switch (cmd) {
 898         case UI_GET_VERSION:
 899                 if (put_user(UINPUT_VERSION, (unsigned int __user *)p))
 900                         retval = -EFAULT;
 901                 goto out;
 902
 903         case UI_DEV_CREATE:
 904                 retval = uinput_create_device(udev);
 905                 goto out;
 906
 907         case UI_DEV_DESTROY:
 908                 uinput_destroy_device(udev);
 909                 goto out;
 910
 911         case UI_DEV_SETUP:
 912                 retval = uinput_dev_setup(udev, p);
 913                 goto out;
 914
 915         /* UI_ABS_SETUP is handled in the variable size ioctls */
 916
 917         case UI_SET_EVBIT:
 918                 retval = uinput_set_bit(arg, evbit, EV_MAX);
 919                 goto out;
 920
 921         case UI_SET_KEYBIT:
 922                 retval = uinput_set_bit(arg, keybit, KEY_MAX);
 923                 goto out;
 924
 925         case UI_SET_RELBIT:
 926                 retval = uinput_set_bit(arg, relbit, REL_MAX);
 927                 goto out;
 928
 929         case UI_SET_ABSBIT:
 930                 retval = uinput_set_bit(arg, absbit, ABS_MAX);
 931                 goto out;
 932
 933         case UI_SET_MSCBIT:
 934                 retval = uinput_set_bit(arg, mscbit, MSC_MAX);
 935                 goto out;
 936
 937         case UI_SET_LEDBIT:
 938                 retval = uinput_set_bit(arg, ledbit, LED_MAX);
 939                 goto out;
 940
 941         case UI_SET_SNDBIT:
 942                 retval = uinput_set_bit(arg, sndbit, SND_MAX);
 943                 goto out;
 944
 945         case UI_SET_FFBIT:
 946                 retval = uinput_set_bit(arg, ffbit, FF_MAX);
 947                 goto out;
 948
 949         case UI_SET_SWBIT:
 950                 retval = uinput_set_bit(arg, swbit, SW_MAX);
 951                 goto out;
 952
 953         case UI_SET_PROPBIT:
 954                 retval = uinput_set_bit(arg, propbit, INPUT_PROP_MAX);
 955                 goto out;
 956
 957         case UI_SET_PHYS:
 958                 if (udev->state == UIST_CREATED) {
 959                         retval = -EINVAL;
 960                         goto out;
 961                 }
 962
 963                 phys = strndup_user(p, 1024);
 964                 if (IS_ERR(phys)) {
 965                         retval = PTR_ERR(phys);
 966                         goto out;
 967                 }
 968
 969                 kfree(udev->dev->phys);
 970                 udev->dev->phys = phys;
 971                 goto out;
 972
 973         case UI_BEGIN_FF_UPLOAD:
 974                 retval = uinput_ff_upload_from_user(p, &ff_up);
 975                 if (retval)
 976                         goto out;
 977
 978                 req = uinput_request_find(udev, ff_up.request_id);
 979                 if (!req || req->code != UI_FF_UPLOAD ||
 980                     !req->u.upload.effect) {
 981                         retval = -EINVAL;
 982                         goto out;
 983                 }
 984
 985                 ff_up.retval = 0;
 986                 ff_up.effect = *req->u.upload.effect;
 987                 if (req->u.upload.old)
 988                         ff_up.old = *req->u.upload.old;
 989                 else
 990                         memset(&ff_up.old, 0, sizeof(struct ff_effect));
 991
 992                 retval = uinput_ff_upload_to_user(p, &ff_up);
 993                 goto out;
 994
 995         case UI_BEGIN_FF_ERASE:
 996                 if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) {
 997                         retval = -EFAULT;
 998                         goto out;
 999                 }
1000
1001                 req = uinput_request_find(udev, ff_erase.request_id);
1002                 if (!req || req->code != UI_FF_ERASE) {
1003                         retval = -EINVAL;
1004                         goto out;
1005                 }
1006
1007                 ff_erase.retval = 0;
1008                 ff_erase.effect_id = req->u.effect_id;
1009                 if (copy_to_user(p, &ff_erase, sizeof(ff_erase))) {
1010                         retval = -EFAULT;
1011                         goto out;
1012                 }
1013
1014                 goto out;
1015
1016         case UI_END_FF_UPLOAD:
1017                 retval = uinput_ff_upload_from_user(p, &ff_up);
1018                 if (retval)
1019                         goto out;
1020
1021                 req = uinput_request_find(udev, ff_up.request_id);
1022                 if (!req || req->code != UI_FF_UPLOAD ||
1023                     !req->u.upload.effect) {
1024                         retval = -EINVAL;
1025                         goto out;
1026                 }
1027
1028                 req->retval = ff_up.retval;
1029                 complete(&req->done);
1030                 goto out;
1031
1032         case UI_END_FF_ERASE:
1033                 if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) {
1034                         retval = -EFAULT;
1035                         goto out;
1036                 }
1037
1038                 req = uinput_request_find(udev, ff_erase.request_id);
1039                 if (!req || req->code != UI_FF_ERASE) {
1040                         retval = -EINVAL;
1041                         goto out;
1042                 }
1043
1044                 req->retval = ff_erase.retval;
1045                 complete(&req->done);
1046                 goto out;
1047         }
1048
1049         size = _IOC_SIZE(cmd);
1050
1051         /* Now check variable-length commands */
1052         switch (cmd & ~IOCSIZE_MASK) {
1053         case UI_GET_SYSNAME(0):
1054                 if (udev->state != UIST_CREATED) {
1055                         retval = -ENOENT;
1056                         goto out;
1057                 }
1058                 name = dev_name(&udev->dev->dev);
1059                 retval = uinput_str_to_user(p, name, size);
1060                 goto out;
1061
1062         case UI_ABS_SETUP & ~IOCSIZE_MASK:
1063                 retval = uinput_abs_setup(udev, p, size);
1064                 goto out;
1065         }
1066
1067         retval = -EINVAL;
1068  out:
1069         mutex_unlock(&udev->mutex);
1070         return retval;
1071 }
1072
1073 static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1074 {
1075         return uinput_ioctl_handler(file, cmd, arg, (void __user *)arg);
1076 }
1077
1078 #ifdef CONFIG_COMPAT
1079
1080 /*
1081  * These IOCTLs change their size and thus their numbers between
1082  * 32 and 64 bits.
1083  */
1084 #define UI_SET_PHYS_COMPAT              \
1085         _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t)
1086 #define UI_BEGIN_FF_UPLOAD_COMPAT       \
1087         _IOWR(UINPUT_IOCTL_BASE, 200, struct uinput_ff_upload_compat)
1088 #define UI_END_FF_UPLOAD_COMPAT         \
1089         _IOW(UINPUT_IOCTL_BASE, 201, struct uinput_ff_upload_compat)
1090
1091 static long uinput_compat_ioctl(struct file *file,
1092                                 unsigned int cmd, unsigned long arg)
1093 {
1094         switch (cmd) {
1095         case UI_SET_PHYS_COMPAT:
1096                 cmd = UI_SET_PHYS;
1097                 break;
1098         case UI_BEGIN_FF_UPLOAD_COMPAT:
1099                 cmd = UI_BEGIN_FF_UPLOAD;
1100                 break;
1101         case UI_END_FF_UPLOAD_COMPAT:
1102                 cmd = UI_END_FF_UPLOAD;
1103                 break;
1104         }
1105
1106         return uinput_ioctl_handler(file, cmd, arg, compat_ptr(arg));
1107 }
1108 #endif
1109
1110 static const struct file_operations uinput_fops = {
1111         .owner          = THIS_MODULE,
1112         .open           = uinput_open,
1113         .release        = uinput_release,
1114         .read           = uinput_read,
1115         .write          = uinput_write,
1116         .poll           = uinput_poll,
1117         .unlocked_ioctl = uinput_ioctl,
1118 #ifdef CONFIG_COMPAT
1119         .compat_ioctl   = uinput_compat_ioctl,
1120 #endif
1121         .llseek         = no_llseek,
1122 };
1123
1124 static struct miscdevice uinput_misc = {
1125         .fops           = &uinput_fops,
1126         .minor          = UINPUT_MINOR,
1127         .name           = UINPUT_NAME,
1128 };
1129 module_misc_device(uinput_misc);
1130
1131 MODULE_ALIAS_MISCDEV(UINPUT_MINOR);
1132 MODULE_ALIAS("devname:" UINPUT_NAME);
1133
1134 MODULE_AUTHOR("Aristeu Sergio Rozanski Filho");
1135 MODULE_DESCRIPTION("User level driver support for input subsystem");
1136 MODULE_LICENSE("GPL");