drivers/input/misc/uinput.c

   1 /*
   2  *  User level driver support for input subsystem
   3  *
   4  * Heavily based on evdev.c by Vojtech Pavlik
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  19  *
  20  * Author: Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org>
  21  *
  22  * Changes/Revisions:
  23  *      0.4     01/09/2014 (Benjamin Tissoires <benjamin.tissoires@redhat.com>)
  24  *              - add UI_GET_SYSNAME ioctl
  25  *      0.3     09/04/2006 (Anssi Hannula <anssi.hannula@gmail.com>)
  26  *              - updated ff support for the changes in kernel interface
  27  *              - added MODULE_VERSION
  28  *      0.2     16/10/2004 (Micah Dowty <micah@navi.cx>)
  29  *              - added force feedback support
  30  *              - added UI_SET_PHYS
  31  *      0.1     20/06/2002
  32  *              - first public version
  33  */
  34 #include <linux/poll.h>
  35 #include <linux/sched.h>
  36 #include <linux/slab.h>
  37 #include <linux/module.h>
  38 #include <linux/init.h>
  39 #include <linux/fs.h>
  40 #include <linux/miscdevice.h>
  41 #include <linux/uinput.h>
  42 #include <linux/overflow.h>
  43 #include <linux/input/mt.h>
  44 #include "../input-compat.h"
  45
  46 static int uinput_dev_event(struct input_dev *dev,
  47                             unsigned int type, unsigned int code, int value)
  48 {
  49         struct uinput_device    *udev = input_get_drvdata(dev);
  50
  51         udev->buff[udev->head].type = type;
  52         udev->buff[udev->head].code = code;
  53         udev->buff[udev->head].value = value;
  54         do_gettimeofday(&udev->buff[udev->head].time);
  55         udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE;
  56
  57         wake_up_interruptible(&udev->waitq);
  58
  59         return 0;
  60 }
  61
  62 /* Atomically allocate an ID for the given request. Returns 0 on success. */
  63 static bool uinput_request_alloc_id(struct uinput_device *udev,
  64                                     struct uinput_request *request)
  65 {
  66         unsigned int id;
  67         bool reserved = false;
  68
  69         spin_lock(&udev->requests_lock);
  70
  71         for (id = 0; id < UINPUT_NUM_REQUESTS; id++) {
  72                 if (!udev->requests[id]) {
  73                         request->id = id;
  74                         udev->requests[id] = request;
  75                         reserved = true;
  76                         break;
  77                 }
  78         }
  79
  80         spin_unlock(&udev->requests_lock);
  81         return reserved;
  82 }
  83
  84 static struct uinput_request *uinput_request_find(struct uinput_device *udev,
  85                                                   unsigned int id)
  86 {
  87         /* Find an input request, by ID. Returns NULL if the ID isn't valid. */
  88         if (id >= UINPUT_NUM_REQUESTS)
  89                 return NULL;
  90
  91         return udev->requests[id];
  92 }
  93
  94 static int uinput_request_reserve_slot(struct uinput_device *udev,
  95                                        struct uinput_request *request)
  96 {
  97         /* Allocate slot. If none are available right away, wait. */
  98         return wait_event_interruptible(udev->requests_waitq,
  99                                         uinput_request_alloc_id(udev, request));
 100 }
 101
 102 static void uinput_request_done(struct uinput_device *udev,
 103                                 struct uinput_request *request)
 104 {
 105         /* Mark slot as available */
 106         udev->requests[request->id] = NULL;
 107         wake_up(&udev->requests_waitq);
 108
 109         complete(&request->done);
 110 }
 111
 112 static int uinput_request_send(struct uinput_device *udev,
 113                                struct uinput_request *request)
 114 {
 115         int retval;
 116
 117         retval = mutex_lock_interruptible(&udev->mutex);
 118         if (retval)
 119                 return retval;
 120
 121         if (udev->state != UIST_CREATED) {
 122                 retval = -ENODEV;
 123                 goto out;
 124         }
 125
 126         init_completion(&request->done);
 127
 128         /*
 129          * Tell our userspace application about this new request
 130          * by queueing an input event.
 131          */
 132         uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id);
 133
 134  out:
 135         mutex_unlock(&udev->mutex);
 136         return retval;
 137 }
 138
 139 static int uinput_request_submit(struct uinput_device *udev,
 140                                  struct uinput_request *request)
 141 {
 142         int error;
 143
 144         error = uinput_request_reserve_slot(udev, request);
 145         if (error)
 146                 return error;
 147
 148         error = uinput_request_send(udev, request);
 149         if (error) {
 150                 uinput_request_done(udev, request);
 151                 return error;
 152         }
 153
 154         wait_for_completion(&request->done);
 155         return request->retval;
 156 }
 157
 158 /*
 159  * Fail all outstanding requests so handlers don't wait for the userspace
 160  * to finish processing them.
 161  */
 162 static void uinput_flush_requests(struct uinput_device *udev)
 163 {
 164         struct uinput_request *request;
 165         int i;
 166
 167         spin_lock(&udev->requests_lock);
 168
 169         for (i = 0; i < UINPUT_NUM_REQUESTS; i++) {
 170                 request = udev->requests[i];
 171                 if (request) {
 172                         request->retval = -ENODEV;
 173                         uinput_request_done(udev, request);
 174                 }
 175         }
 176
 177         spin_unlock(&udev->requests_lock);
 178 }
 179
 180 static void uinput_dev_set_gain(struct input_dev *dev, u16 gain)
 181 {
 182         uinput_dev_event(dev, EV_FF, FF_GAIN, gain);
 183 }
 184
 185 static void uinput_dev_set_autocenter(struct input_dev *dev, u16 magnitude)
 186 {
 187         uinput_dev_event(dev, EV_FF, FF_AUTOCENTER, magnitude);
 188 }
 189
 190 static int uinput_dev_playback(struct input_dev *dev, int effect_id, int value)
 191 {
 192         return uinput_dev_event(dev, EV_FF, effect_id, value);
 193 }
 194
 195 static int uinput_dev_upload_effect(struct input_dev *dev,
 196                                     struct ff_effect *effect,
 197                                     struct ff_effect *old)
 198 {
 199         struct uinput_device *udev = input_get_drvdata(dev);
 200         struct uinput_request request;
 201
 202         /*
 203          * uinput driver does not currently support periodic effects with
 204          * custom waveform since it does not have a way to pass buffer of
 205          * samples (custom_data) to userspace. If ever there is a device
 206          * supporting custom waveforms we would need to define an additional
 207          * ioctl (UI_UPLOAD_SAMPLES) but for now we just bail out.
 208          */
 209         if (effect->type == FF_PERIODIC &&
 210                         effect->u.periodic.waveform == FF_CUSTOM)
 211                 return -EINVAL;
 212
 213         request.code = UI_FF_UPLOAD;
 214         request.u.upload.effect = effect;
 215         request.u.upload.old = old;
 216
 217         return uinput_request_submit(udev, &request);
 218 }
 219
 220 static int uinput_dev_erase_effect(struct input_dev *dev, int effect_id)
 221 {
 222         struct uinput_device *udev = input_get_drvdata(dev);
 223         struct uinput_request request;
 224
 225         if (!test_bit(EV_FF, dev->evbit))
 226                 return -ENOSYS;
 227
 228         request.code = UI_FF_ERASE;
 229         request.u.effect_id = effect_id;
 230
 231         return uinput_request_submit(udev, &request);
 232 }
 233
 234 static int uinput_dev_flush(struct input_dev *dev, struct file *file)
 235 {
 236         /*
 237          * If we are called with file == NULL that means we are tearing
 238          * down the device, and therefore we can not handle FF erase
 239          * requests: either we are handling UI_DEV_DESTROY (and holding
 240          * the udev->mutex), or the file descriptor is closed and there is
 241          * nobody on the other side anymore.
 242          */
 243         return file ? input_ff_flush(dev, file) : 0;
 244 }
 245
 246 static void uinput_destroy_device(struct uinput_device *udev)
 247 {
 248         const char *name, *phys;
 249         struct input_dev *dev = udev->dev;
 250         enum uinput_state old_state = udev->state;
 251
 252         udev->state = UIST_NEW_DEVICE;
 253
 254         if (dev) {
 255                 name = dev->name;
 256                 phys = dev->phys;
 257                 if (old_state == UIST_CREATED) {
 258                         uinput_flush_requests(udev);
 259                         input_unregister_device(dev);
 260                 } else {
 261                         input_free_device(dev);
 262                 }
 263                 kfree(name);
 264                 kfree(phys);
 265                 udev->dev = NULL;
 266         }
 267 }
 268
 269 static int uinput_create_device(struct uinput_device *udev)
 270 {
 271         struct input_dev *dev = udev->dev;
 272         int error, nslot;
 273
 274         if (udev->state != UIST_SETUP_COMPLETE) {
 275                 printk(KERN_DEBUG "%s: write device info first\n", UINPUT_NAME);
 276                 return -EINVAL;
 277         }
 278
 279         if (test_bit(EV_ABS, dev->evbit)) {
 280                 input_alloc_absinfo(dev);
 281                 if (!dev->absinfo) {
 282                         error = -EINVAL;
 283                         goto fail1;
 284                 }
 285
 286                 if (test_bit(ABS_MT_SLOT, dev->absbit)) {
 287                         nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
 288                         error = input_mt_init_slots(dev, nslot, 0);
 289                         if (error)
 290                                 goto fail1;
 291                 } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
 292                         input_set_events_per_packet(dev, 60);
 293                 }
 294         }
 295
 296         if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) {
 297                 printk(KERN_DEBUG "%s: ff_effects_max should be non-zero when FF_BIT is set\n",
 298                         UINPUT_NAME);
 299                 error = -EINVAL;
 300                 goto fail1;
 301         }
 302
 303         if (udev->ff_effects_max) {
 304                 error = input_ff_create(dev, udev->ff_effects_max);
 305                 if (error)
 306                         goto fail1;
 307
 308                 dev->ff->upload = uinput_dev_upload_effect;
 309                 dev->ff->erase = uinput_dev_erase_effect;
 310                 dev->ff->playback = uinput_dev_playback;
 311                 dev->ff->set_gain = uinput_dev_set_gain;
 312                 dev->ff->set_autocenter = uinput_dev_set_autocenter;
 313                 /*
 314                  * The standard input_ff_flush() implementation does
 315                  * not quite work for uinput as we can't reasonably
 316                  * handle FF requests during device teardown.
 317                  */
 318                 dev->flush = uinput_dev_flush;
 319         }
 320
 321         error = input_register_device(udev->dev);
 322         if (error)
 323                 goto fail2;
 324
 325         udev->state = UIST_CREATED;
 326
 327         return 0;
 328
 329  fail2: input_ff_destroy(dev);
 330  fail1: uinput_destroy_device(udev);
 331         return error;
 332 }
 333
 334 static int uinput_open(struct inode *inode, struct file *file)
 335 {
 336         struct uinput_device *newdev;
 337
 338         newdev = kzalloc(sizeof(struct uinput_device), GFP_KERNEL);
 339         if (!newdev)
 340                 return -ENOMEM;
 341
 342         mutex_init(&newdev->mutex);
 343         spin_lock_init(&newdev->requests_lock);
 344         init_waitqueue_head(&newdev->requests_waitq);
 345         init_waitqueue_head(&newdev->waitq);
 346         newdev->state = UIST_NEW_DEVICE;
 347
 348         file->private_data = newdev;
 349         nonseekable_open(inode, file);
 350
 351         return 0;
 352 }
 353
 354 static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
 355                                    const struct input_absinfo *abs)
 356 {
 357         int min, max, range;
 358
 359         min = abs->minimum;
 360         max = abs->maximum;
 361
 362         if ((min != 0 || max != 0) && max <= min) {
 363                 printk(KERN_DEBUG
 364                        "%s: invalid abs[%02x] min:%d max:%d\n",
 365                        UINPUT_NAME, code, min, max);
 366                 return -EINVAL;
 367         }
 368
 369         if (!check_sub_overflow(max, min, &range) && abs->flat > range) {
 370                 printk(KERN_DEBUG
 371                        "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n",
 372                        UINPUT_NAME, code, abs->flat, min, max);
 373                 return -EINVAL;
 374         }
 375
 376         return 0;
 377 }
 378
 379 static int uinput_validate_absbits(struct input_dev *dev)
 380 {
 381         unsigned int cnt;
 382         int error;
 383
 384         if (!test_bit(EV_ABS, dev->evbit))
 385                 return 0;
 386
 387         /*
 388          * Check if absmin/absmax/absfuzz/absflat are sane.
 389          */
 390
 391         for_each_set_bit(cnt, dev->absbit, ABS_CNT) {
 392                 if (!dev->absinfo)
 393                         return -EINVAL;
 394
 395                 error = uinput_validate_absinfo(dev, cnt, &dev->absinfo[cnt]);
 396                 if (error)
 397                         return error;
 398         }
 399
 400         return 0;
 401 }
 402
 403 static int uinput_allocate_device(struct uinput_device *udev)
 404 {
 405         udev->dev = input_allocate_device();
 406         if (!udev->dev)
 407                 return -ENOMEM;
 408
 409         udev->dev->event = uinput_dev_event;
 410         input_set_drvdata(udev->dev, udev);
 411
 412         return 0;
 413 }
 414
 415 static int uinput_dev_setup(struct uinput_device *udev,
 416                             struct uinput_setup __user *arg)
 417 {
 418         struct uinput_setup setup;
 419         struct input_dev *dev;
 420
 421         if (udev->state == UIST_CREATED)
 422                 return -EINVAL;
 423
 424         if (copy_from_user(&setup, arg, sizeof(setup)))
 425                 return -EFAULT;
 426
 427         if (!setup.name[0])
 428                 return -EINVAL;
 429
 430         dev = udev->dev;
 431         dev->id = setup.id;
 432         udev->ff_effects_max = setup.ff_effects_max;
 433
 434         kfree(dev->name);
 435         dev->name = kstrndup(setup.name, UINPUT_MAX_NAME_SIZE, GFP_KERNEL);
 436         if (!dev->name)
 437                 return -ENOMEM;
 438
 439         udev->state = UIST_SETUP_COMPLETE;
 440         return 0;
 441 }
 442
 443 static int uinput_abs_setup(struct uinput_device *udev,
 444                             struct uinput_setup __user *arg, size_t size)
 445 {
 446         struct uinput_abs_setup setup = {};
 447         struct input_dev *dev;
 448         int error;
 449
 450         if (size > sizeof(setup))
 451                 return -E2BIG;
 452
 453         if (udev->state == UIST_CREATED)
 454                 return -EINVAL;
 455
 456         if (copy_from_user(&setup, arg, size))
 457                 return -EFAULT;
 458
 459         if (setup.code > ABS_MAX)
 460                 return -ERANGE;
 461
 462         dev = udev->dev;
 463
 464         error = uinput_validate_absinfo(dev, setup.code, &setup.absinfo);
 465         if (error)
 466                 return error;
 467
 468         input_alloc_absinfo(dev);
 469         if (!dev->absinfo)
 470                 return -ENOMEM;
 471
 472         set_bit(setup.code, dev->absbit);
 473         dev->absinfo[setup.code] = setup.absinfo;
 474         return 0;
 475 }
 476
 477 /* legacy setup via write() */
 478 static int uinput_setup_device_legacy(struct uinput_device *udev,
 479                                       const char __user *buffer, size_t count)
 480 {
 481         struct uinput_user_dev  *user_dev;
 482         struct input_dev        *dev;
 483         int                     i;
 484         int                     retval;
 485
 486         if (count != sizeof(struct uinput_user_dev))
 487                 return -EINVAL;
 488
 489         if (!udev->dev) {
 490                 retval = uinput_allocate_device(udev);
 491                 if (retval)
 492                         return retval;
 493         }
 494
 495         dev = udev->dev;
 496
 497         user_dev = memdup_user(buffer, sizeof(struct uinput_user_dev));
 498         if (IS_ERR(user_dev))
 499                 return PTR_ERR(user_dev);
 500
 501         udev->ff_effects_max = user_dev->ff_effects_max;
 502
 503         /* Ensure name is filled in */
 504         if (!user_dev->name[0]) {
 505                 retval = -EINVAL;
 506                 goto exit;
 507         }
 508
 509         kfree(dev->name);
 510         dev->name = kstrndup(user_dev->name, UINPUT_MAX_NAME_SIZE,
 511                              GFP_KERNEL);
 512         if (!dev->name) {
 513                 retval = -ENOMEM;
 514                 goto exit;
 515         }
 516
 517         dev->id.bustype = user_dev->id.bustype;
 518         dev->id.vendor  = user_dev->id.vendor;
 519         dev->id.product = user_dev->id.product;
 520         dev->id.version = user_dev->id.version;
 521
 522         for (i = 0; i < ABS_CNT; i++) {
 523                 input_abs_set_max(dev, i, user_dev->absmax[i]);
 524                 input_abs_set_min(dev, i, user_dev->absmin[i]);
 525                 input_abs_set_fuzz(dev, i, user_dev->absfuzz[i]);
 526                 input_abs_set_flat(dev, i, user_dev->absflat[i]);
 527         }
 528
 529         retval = uinput_validate_absbits(dev);
 530         if (retval < 0)
 531                 goto exit;
 532
 533         udev->state = UIST_SETUP_COMPLETE;
 534         retval = count;
 535
 536  exit:
 537         kfree(user_dev);
 538         return retval;
 539 }
 540
 541 static ssize_t uinput_inject_events(struct uinput_device *udev,
 542                                     const char __user *buffer, size_t count)
 543 {
 544         struct input_event ev;
 545         size_t bytes = 0;
 546
 547         if (count != 0 && count < input_event_size())
 548                 return -EINVAL;
 549
 550         while (bytes + input_event_size() <= count) {
 551                 /*
 552                  * Note that even if some events were fetched successfully
 553                  * we are still going to return EFAULT instead of partial
 554                  * count to let userspace know that it got it's buffers
 555                  * all wrong.
 556                  */
 557                 if (input_event_from_user(buffer + bytes, &ev))
 558                         return -EFAULT;
 559
 560                 input_event(udev->dev, ev.type, ev.code, ev.value);
 561                 bytes += input_event_size();
 562         }
 563
 564         return bytes;
 565 }
 566
 567 static ssize_t uinput_write(struct file *file, const char __user *buffer,
 568                             size_t count, loff_t *ppos)
 569 {
 570         struct uinput_device *udev = file->private_data;
 571         int retval;
 572
 573         if (count == 0)
 574                 return 0;
 575
 576         retval = mutex_lock_interruptible(&udev->mutex);
 577         if (retval)
 578                 return retval;
 579
 580         retval = udev->state == UIST_CREATED ?
 581                         uinput_inject_events(udev, buffer, count) :
 582                         uinput_setup_device_legacy(udev, buffer, count);
 583
 584         mutex_unlock(&udev->mutex);
 585
 586         return retval;
 587 }
 588
 589 static bool uinput_fetch_next_event(struct uinput_device *udev,
 590                                     struct input_event *event)
 591 {
 592         bool have_event;
 593
 594         spin_lock_irq(&udev->dev->event_lock);
 595
 596         have_event = udev->head != udev->tail;
 597         if (have_event) {
 598                 *event = udev->buff[udev->tail];
 599                 udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE;
 600         }
 601
 602         spin_unlock_irq(&udev->dev->event_lock);
 603
 604         return have_event;
 605 }
 606
 607 static ssize_t uinput_events_to_user(struct uinput_device *udev,
 608                                      char __user *buffer, size_t count)
 609 {
 610         struct input_event event;
 611         size_t read = 0;
 612
 613         while (read + input_event_size() <= count &&
 614                uinput_fetch_next_event(udev, &event)) {
 615
 616                 if (input_event_to_user(buffer + read, &event))
 617                         return -EFAULT;
 618
 619                 read += input_event_size();
 620         }
 621
 622         return read;
 623 }
 624
 625 static ssize_t uinput_read(struct file *file, char __user *buffer,
 626                            size_t count, loff_t *ppos)
 627 {
 628         struct uinput_device *udev = file->private_data;
 629         ssize_t retval;
 630
 631         if (count != 0 && count < input_event_size())
 632                 return -EINVAL;
 633
 634         do {
 635                 retval = mutex_lock_interruptible(&udev->mutex);
 636                 if (retval)
 637                         return retval;
 638
 639                 if (udev->state != UIST_CREATED)
 640                         retval = -ENODEV;
 641                 else if (udev->head == udev->tail &&
 642                          (file->f_flags & O_NONBLOCK))
 643                         retval = -EAGAIN;
 644                 else
 645                         retval = uinput_events_to_user(udev, buffer, count);
 646
 647                 mutex_unlock(&udev->mutex);
 648
 649                 if (retval || count == 0)
 650                         break;
 651
 652                 if (!(file->f_flags & O_NONBLOCK))
 653                         retval = wait_event_interruptible(udev->waitq,
 654                                                   udev->head != udev->tail ||
 655                                                   udev->state != UIST_CREATED);
 656         } while (retval == 0);
 657
 658         return retval;
 659 }
 660
 661 static unsigned int uinput_poll(struct file *file, poll_table *wait)
 662 {
 663         struct uinput_device *udev = file->private_data;
 664
 665         poll_wait(file, &udev->waitq, wait);
 666
 667         if (udev->head != udev->tail)
 668                 return POLLIN | POLLRDNORM;
 669
 670         return 0;
 671 }
 672
 673 static int uinput_release(struct inode *inode, struct file *file)
 674 {
 675         struct uinput_device *udev = file->private_data;
 676
 677         uinput_destroy_device(udev);
 678         kfree(udev);
 679
 680         return 0;
 681 }
 682
 683 #ifdef CONFIG_COMPAT
 684 struct uinput_ff_upload_compat {
 685         __u32                   request_id;
 686         __s32                   retval;
 687         struct ff_effect_compat effect;
 688         struct ff_effect_compat old;
 689 };
 690
 691 static int uinput_ff_upload_to_user(char __user *buffer,
 692                                     const struct uinput_ff_upload *ff_up)
 693 {
 694         if (in_compat_syscall()) {
 695                 struct uinput_ff_upload_compat ff_up_compat;
 696
 697                 ff_up_compat.request_id = ff_up->request_id;
 698                 ff_up_compat.retval = ff_up->retval;
 699                 /*
 700                  * It so happens that the pointer that gives us the trouble
 701                  * is the last field in the structure. Since we don't support
 702                  * custom waveforms in uinput anyway we can just copy the whole
 703                  * thing (to the compat size) and ignore the pointer.
 704                  */
 705                 memcpy(&ff_up_compat.effect, &ff_up->effect,
 706                         sizeof(struct ff_effect_compat));
 707                 memcpy(&ff_up_compat.old, &ff_up->old,
 708                         sizeof(struct ff_effect_compat));
 709
 710                 if (copy_to_user(buffer, &ff_up_compat,
 711                                  sizeof(struct uinput_ff_upload_compat)))
 712                         return -EFAULT;
 713         } else {
 714                 if (copy_to_user(buffer, ff_up,
 715                                  sizeof(struct uinput_ff_upload)))
 716                         return -EFAULT;
 717         }
 718
 719         return 0;
 720 }
 721
 722 static int uinput_ff_upload_from_user(const char __user *buffer,
 723                                       struct uinput_ff_upload *ff_up)
 724 {
 725         if (in_compat_syscall()) {
 726                 struct uinput_ff_upload_compat ff_up_compat;
 727
 728                 if (copy_from_user(&ff_up_compat, buffer,
 729                                    sizeof(struct uinput_ff_upload_compat)))
 730                         return -EFAULT;
 731
 732                 ff_up->request_id = ff_up_compat.request_id;
 733                 ff_up->retval = ff_up_compat.retval;
 734                 memcpy(&ff_up->effect, &ff_up_compat.effect,
 735                         sizeof(struct ff_effect_compat));
 736                 memcpy(&ff_up->old, &ff_up_compat.old,
 737                         sizeof(struct ff_effect_compat));
 738
 739         } else {
 740                 if (copy_from_user(ff_up, buffer,
 741                                    sizeof(struct uinput_ff_upload)))
 742                         return -EFAULT;
 743         }
 744
 745         return 0;
 746 }
 747
 748 #else
 749
 750 static int uinput_ff_upload_to_user(char __user *buffer,
 751                                     const struct uinput_ff_upload *ff_up)
 752 {
 753         if (copy_to_user(buffer, ff_up, sizeof(struct uinput_ff_upload)))
 754                 return -EFAULT;
 755
 756         return 0;
 757 }
 758
 759 static int uinput_ff_upload_from_user(const char __user *buffer,
 760                                       struct uinput_ff_upload *ff_up)
 761 {
 762         if (copy_from_user(ff_up, buffer, sizeof(struct uinput_ff_upload)))
 763                 return -EFAULT;
 764
 765         return 0;
 766 }
 767
 768 #endif
 769
 770 #define uinput_set_bit(_arg, _bit, _max)                \
 771 ({                                                      \
 772         int __ret = 0;                                  \
 773         if (udev->state == UIST_CREATED)                \
 774                 __ret =  -EINVAL;                       \
 775         else if ((_arg) > (_max))                       \
 776                 __ret = -EINVAL;                        \
 777         else set_bit((_arg), udev->dev->_bit);          \
 778         __ret;                                          \
 779 })
 780
 781 static int uinput_str_to_user(void __user *dest, const char *str,
 782                               unsigned int maxlen)
 783 {
 784         char __user *p = dest;
 785         int len, ret;
 786
 787         if (!str)
 788                 return -ENOENT;
 789
 790         if (maxlen == 0)
 791                 return -EINVAL;
 792
 793         len = strlen(str) + 1;
 794         if (len > maxlen)
 795                 len = maxlen;
 796
 797         ret = copy_to_user(p, str, len);
 798         if (ret)
 799                 return -EFAULT;
 800
 801         /* force terminating '\0' */
 802         ret = put_user(0, p + len - 1);
 803         return ret ? -EFAULT : len;
 804 }
 805
 806 static long uinput_ioctl_handler(struct file *file, unsigned int cmd,
 807                                  unsigned long arg, void __user *p)
 808 {
 809         int                     retval;
 810         struct uinput_device    *udev = file->private_data;
 811         struct uinput_ff_upload ff_up;
 812         struct uinput_ff_erase  ff_erase;
 813         struct uinput_request   *req;
 814         char                    *phys;
 815         const char              *name;
 816         unsigned int            size;
 817
 818         retval = mutex_lock_interruptible(&udev->mutex);
 819         if (retval)
 820                 return retval;
 821
 822         if (!udev->dev) {
 823                 retval = uinput_allocate_device(udev);
 824                 if (retval)
 825                         goto out;
 826         }
 827
 828         switch (cmd) {
 829                 case UI_GET_VERSION:
 830                         if (put_user(UINPUT_VERSION,
 831                                      (unsigned int __user *)p))
 832                                 retval = -EFAULT;
 833                         goto out;
 834
 835                 case UI_DEV_CREATE:
 836                         retval = uinput_create_device(udev);
 837                         goto out;
 838
 839                 case UI_DEV_DESTROY:
 840                         uinput_destroy_device(udev);
 841                         goto out;
 842
 843                 case UI_DEV_SETUP:
 844                         retval = uinput_dev_setup(udev, p);
 845                         goto out;
 846
 847                 /* UI_ABS_SETUP is handled in the variable size ioctls */
 848
 849                 case UI_SET_EVBIT:
 850                         retval = uinput_set_bit(arg, evbit, EV_MAX);
 851                         goto out;
 852
 853                 case UI_SET_KEYBIT:
 854                         retval = uinput_set_bit(arg, keybit, KEY_MAX);
 855                         goto out;
 856
 857                 case UI_SET_RELBIT:
 858                         retval = uinput_set_bit(arg, relbit, REL_MAX);
 859                         goto out;
 860
 861                 case UI_SET_ABSBIT:
 862                         retval = uinput_set_bit(arg, absbit, ABS_MAX);
 863                         goto out;
 864
 865                 case UI_SET_MSCBIT:
 866                         retval = uinput_set_bit(arg, mscbit, MSC_MAX);
 867                         goto out;
 868
 869                 case UI_SET_LEDBIT:
 870                         retval = uinput_set_bit(arg, ledbit, LED_MAX);
 871                         goto out;
 872
 873                 case UI_SET_SNDBIT:
 874                         retval = uinput_set_bit(arg, sndbit, SND_MAX);
 875                         goto out;
 876
 877                 case UI_SET_FFBIT:
 878                         retval = uinput_set_bit(arg, ffbit, FF_MAX);
 879                         goto out;
 880
 881                 case UI_SET_SWBIT:
 882                         retval = uinput_set_bit(arg, swbit, SW_MAX);
 883                         goto out;
 884
 885                 case UI_SET_PROPBIT:
 886                         retval = uinput_set_bit(arg, propbit, INPUT_PROP_MAX);
 887                         goto out;
 888
 889                 case UI_SET_PHYS:
 890                         if (udev->state == UIST_CREATED) {
 891                                 retval = -EINVAL;
 892                                 goto out;
 893                         }
 894
 895                         phys = strndup_user(p, 1024);
 896                         if (IS_ERR(phys)) {
 897                                 retval = PTR_ERR(phys);
 898                                 goto out;
 899                         }
 900
 901                         kfree(udev->dev->phys);
 902                         udev->dev->phys = phys;
 903                         goto out;
 904
 905                 case UI_BEGIN_FF_UPLOAD:
 906                         retval = uinput_ff_upload_from_user(p, &ff_up);
 907                         if (retval)
 908                                 goto out;
 909
 910                         req = uinput_request_find(udev, ff_up.request_id);
 911                         if (!req || req->code != UI_FF_UPLOAD ||
 912                             !req->u.upload.effect) {
 913                                 retval = -EINVAL;
 914                                 goto out;
 915                         }
 916
 917                         ff_up.retval = 0;
 918                         ff_up.effect = *req->u.upload.effect;
 919                         if (req->u.upload.old)
 920                                 ff_up.old = *req->u.upload.old;
 921                         else
 922                                 memset(&ff_up.old, 0, sizeof(struct ff_effect));
 923
 924                         retval = uinput_ff_upload_to_user(p, &ff_up);
 925                         goto out;
 926
 927                 case UI_BEGIN_FF_ERASE:
 928                         if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) {
 929                                 retval = -EFAULT;
 930                                 goto out;
 931                         }
 932
 933                         req = uinput_request_find(udev, ff_erase.request_id);
 934                         if (!req || req->code != UI_FF_ERASE) {
 935                                 retval = -EINVAL;
 936                                 goto out;
 937                         }
 938
 939                         ff_erase.retval = 0;
 940                         ff_erase.effect_id = req->u.effect_id;
 941                         if (copy_to_user(p, &ff_erase, sizeof(ff_erase))) {
 942                                 retval = -EFAULT;
 943                                 goto out;
 944                         }
 945
 946                         goto out;
 947
 948                 case UI_END_FF_UPLOAD:
 949                         retval = uinput_ff_upload_from_user(p, &ff_up);
 950                         if (retval)
 951                                 goto out;
 952
 953                         req = uinput_request_find(udev, ff_up.request_id);
 954                         if (!req || req->code != UI_FF_UPLOAD ||
 955                             !req->u.upload.effect) {
 956                                 retval = -EINVAL;
 957                                 goto out;
 958                         }
 959
 960                         req->retval = ff_up.retval;
 961                         uinput_request_done(udev, req);
 962                         goto out;
 963
 964                 case UI_END_FF_ERASE:
 965                         if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) {
 966                                 retval = -EFAULT;
 967                                 goto out;
 968                         }
 969
 970                         req = uinput_request_find(udev, ff_erase.request_id);
 971                         if (!req || req->code != UI_FF_ERASE) {
 972                                 retval = -EINVAL;
 973                                 goto out;
 974                         }
 975
 976                         req->retval = ff_erase.retval;
 977                         uinput_request_done(udev, req);
 978                         goto out;
 979         }
 980
 981         size = _IOC_SIZE(cmd);
 982
 983         /* Now check variable-length commands */
 984         switch (cmd & ~IOCSIZE_MASK) {
 985         case UI_GET_SYSNAME(0):
 986                 if (udev->state != UIST_CREATED) {
 987                         retval = -ENOENT;
 988                         goto out;
 989                 }
 990                 name = dev_name(&udev->dev->dev);
 991                 retval = uinput_str_to_user(p, name, size);
 992                 goto out;
 993
 994         case UI_ABS_SETUP & ~IOCSIZE_MASK:
 995                 retval = uinput_abs_setup(udev, p, size);
 996                 goto out;
 997         }
 998
 999         retval = -EINVAL;
1000  out:
1001         mutex_unlock(&udev->mutex);
1002         return retval;
1003 }
1004
1005 static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1006 {
1007         return uinput_ioctl_handler(file, cmd, arg, (void __user *)arg);
1008 }
1009
1010 #ifdef CONFIG_COMPAT
1011
1012 /*
1013  * These IOCTLs change their size and thus their numbers between
1014  * 32 and 64 bits.
1015  */
1016 #define UI_SET_PHYS_COMPAT              \
1017         _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t)
1018 #define UI_BEGIN_FF_UPLOAD_COMPAT       \
1019         _IOWR(UINPUT_IOCTL_BASE, 200, struct uinput_ff_upload_compat)
1020 #define UI_END_FF_UPLOAD_COMPAT         \
1021         _IOW(UINPUT_IOCTL_BASE, 201, struct uinput_ff_upload_compat)
1022
1023 static long uinput_compat_ioctl(struct file *file,
1024                                 unsigned int cmd, unsigned long arg)
1025 {
1026         switch (cmd) {
1027         case UI_SET_PHYS_COMPAT:
1028                 cmd = UI_SET_PHYS;
1029                 break;
1030         case UI_BEGIN_FF_UPLOAD_COMPAT:
1031                 cmd = UI_BEGIN_FF_UPLOAD;
1032                 break;
1033         case UI_END_FF_UPLOAD_COMPAT:
1034                 cmd = UI_END_FF_UPLOAD;
1035                 break;
1036         }
1037
1038         return uinput_ioctl_handler(file, cmd, arg, compat_ptr(arg));
1039 }
1040 #endif
1041
1042 static const struct file_operations uinput_fops = {
1043         .owner          = THIS_MODULE,
1044         .open           = uinput_open,
1045         .release        = uinput_release,
1046         .read           = uinput_read,
1047         .write          = uinput_write,
1048         .poll           = uinput_poll,
1049         .unlocked_ioctl = uinput_ioctl,
1050 #ifdef CONFIG_COMPAT
1051         .compat_ioctl   = uinput_compat_ioctl,
1052 #endif
1053         .llseek         = no_llseek,
1054 };
1055
1056 static struct miscdevice uinput_misc = {
1057         .fops           = &uinput_fops,
1058         .minor          = UINPUT_MINOR,
1059         .name           = UINPUT_NAME,
1060 };
1061 module_misc_device(uinput_misc);
1062
1063 MODULE_ALIAS_MISCDEV(UINPUT_MINOR);
1064 MODULE_ALIAS("devname:" UINPUT_NAME);
1065
1066 MODULE_AUTHOR("Aristeu Sergio Rozanski Filho");
1067 MODULE_DESCRIPTION("User level driver support for input subsystem");
1068 MODULE_LICENSE("GPL");
1069 MODULE_VERSION("0.3");