1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* |
3 | * User level driver support for input subsystem |
4 | * |
5 | * Heavily based on evdev.c by Vojtech Pavlik |
6 | * |
7 | * Author: Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org> |
8 | * |
9 | * Changes/Revisions: |
10 | * 0.4 01/09/2014 (Benjamin Tissoires <benjamin.tissoires@redhat.com>) |
11 | * - add UI_GET_SYSNAME ioctl |
12 | * 0.3 09/04/2006 (Anssi Hannula <anssi.hannula@gmail.com>) |
13 | * - updated ff support for the changes in kernel interface |
14 | * - added MODULE_VERSION |
15 | * 0.2 16/10/2004 (Micah Dowty <micah@navi.cx>) |
16 | * - added force feedback support |
17 | * - added UI_SET_PHYS |
18 | * 0.1 20/06/2002 |
19 | * - first public version |
20 | */ |
21 | #include <uapi/linux/uinput.h> |
22 | #include <linux/poll.h> |
23 | #include <linux/sched.h> |
24 | #include <linux/slab.h> |
25 | #include <linux/module.h> |
26 | #include <linux/init.h> |
27 | #include <linux/fs.h> |
28 | #include <linux/miscdevice.h> |
29 | #include <linux/overflow.h> |
30 | #include <linux/input/mt.h> |
31 | #include "../input-compat.h" |
32 | |
33 | #define UINPUT_NAME "uinput" |
34 | #define UINPUT_BUFFER_SIZE 16 |
35 | #define UINPUT_NUM_REQUESTS 16 |
36 | #define UINPUT_TIMESTAMP_ALLOWED_OFFSET_SECS 10 |
37 | |
38 | enum uinput_state { UIST_NEW_DEVICE, UIST_SETUP_COMPLETE, UIST_CREATED }; |
39 | |
40 | struct uinput_request { |
41 | unsigned int id; |
42 | unsigned int code; /* UI_FF_UPLOAD, UI_FF_ERASE */ |
43 | |
44 | int retval; |
45 | struct completion done; |
46 | |
47 | union { |
48 | unsigned int effect_id; |
49 | struct { |
50 | struct ff_effect *effect; |
51 | struct ff_effect *old; |
52 | } upload; |
53 | } u; |
54 | }; |
55 | |
56 | struct uinput_device { |
57 | struct input_dev *dev; |
58 | struct mutex mutex; |
59 | enum uinput_state state; |
60 | wait_queue_head_t waitq; |
61 | unsigned char ready; |
62 | unsigned char head; |
63 | unsigned char tail; |
64 | struct input_event buff[UINPUT_BUFFER_SIZE]; |
65 | unsigned int ff_effects_max; |
66 | |
67 | struct uinput_request *requests[UINPUT_NUM_REQUESTS]; |
68 | wait_queue_head_t requests_waitq; |
69 | spinlock_t requests_lock; |
70 | }; |
71 | |
72 | static int uinput_dev_event(struct input_dev *dev, |
73 | unsigned int type, unsigned int code, int value) |
74 | { |
75 | struct uinput_device *udev = input_get_drvdata(dev); |
76 | struct timespec64 ts; |
77 | |
78 | ktime_get_ts64(ts: &ts); |
79 | |
80 | udev->buff[udev->head] = (struct input_event) { |
81 | .input_event_sec = ts.tv_sec, |
82 | .input_event_usec = ts.tv_nsec / NSEC_PER_USEC, |
83 | .type = type, |
84 | .code = code, |
85 | .value = value, |
86 | }; |
87 | |
88 | udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE; |
89 | |
90 | wake_up_interruptible(&udev->waitq); |
91 | |
92 | return 0; |
93 | } |
94 | |
95 | /* Atomically allocate an ID for the given request. Returns 0 on success. */ |
96 | static bool uinput_request_alloc_id(struct uinput_device *udev, |
97 | struct uinput_request *request) |
98 | { |
99 | unsigned int id; |
100 | bool reserved = false; |
101 | |
102 | spin_lock(lock: &udev->requests_lock); |
103 | |
104 | for (id = 0; id < UINPUT_NUM_REQUESTS; id++) { |
105 | if (!udev->requests[id]) { |
106 | request->id = id; |
107 | udev->requests[id] = request; |
108 | reserved = true; |
109 | break; |
110 | } |
111 | } |
112 | |
113 | spin_unlock(lock: &udev->requests_lock); |
114 | return reserved; |
115 | } |
116 | |
117 | static struct uinput_request *uinput_request_find(struct uinput_device *udev, |
118 | unsigned int id) |
119 | { |
120 | /* Find an input request, by ID. Returns NULL if the ID isn't valid. */ |
121 | if (id >= UINPUT_NUM_REQUESTS) |
122 | return NULL; |
123 | |
124 | return udev->requests[id]; |
125 | } |
126 | |
127 | static int uinput_request_reserve_slot(struct uinput_device *udev, |
128 | struct uinput_request *request) |
129 | { |
130 | /* Allocate slot. If none are available right away, wait. */ |
131 | return wait_event_interruptible(udev->requests_waitq, |
132 | uinput_request_alloc_id(udev, request)); |
133 | } |
134 | |
135 | static void uinput_request_release_slot(struct uinput_device *udev, |
136 | unsigned int id) |
137 | { |
138 | /* Mark slot as available */ |
139 | spin_lock(lock: &udev->requests_lock); |
140 | udev->requests[id] = NULL; |
141 | spin_unlock(lock: &udev->requests_lock); |
142 | |
143 | wake_up(&udev->requests_waitq); |
144 | } |
145 | |
146 | static int uinput_request_send(struct uinput_device *udev, |
147 | struct uinput_request *request) |
148 | { |
149 | int retval; |
150 | |
151 | retval = mutex_lock_interruptible(&udev->mutex); |
152 | if (retval) |
153 | return retval; |
154 | |
155 | if (udev->state != UIST_CREATED) { |
156 | retval = -ENODEV; |
157 | goto out; |
158 | } |
159 | |
160 | init_completion(x: &request->done); |
161 | |
162 | /* |
163 | * Tell our userspace application about this new request |
164 | * by queueing an input event. |
165 | */ |
166 | uinput_dev_event(dev: udev->dev, EV_UINPUT, code: request->code, value: request->id); |
167 | |
168 | out: |
169 | mutex_unlock(lock: &udev->mutex); |
170 | return retval; |
171 | } |
172 | |
173 | static int uinput_request_submit(struct uinput_device *udev, |
174 | struct uinput_request *request) |
175 | { |
176 | int retval; |
177 | |
178 | retval = uinput_request_reserve_slot(udev, request); |
179 | if (retval) |
180 | return retval; |
181 | |
182 | retval = uinput_request_send(udev, request); |
183 | if (retval) |
184 | goto out; |
185 | |
186 | if (!wait_for_completion_timeout(x: &request->done, timeout: 30 * HZ)) { |
187 | retval = -ETIMEDOUT; |
188 | goto out; |
189 | } |
190 | |
191 | retval = request->retval; |
192 | |
193 | out: |
194 | uinput_request_release_slot(udev, id: request->id); |
195 | return retval; |
196 | } |
197 | |
198 | /* |
199 | * Fail all outstanding requests so handlers don't wait for the userspace |
200 | * to finish processing them. |
201 | */ |
202 | static void uinput_flush_requests(struct uinput_device *udev) |
203 | { |
204 | struct uinput_request *request; |
205 | int i; |
206 | |
207 | spin_lock(lock: &udev->requests_lock); |
208 | |
209 | for (i = 0; i < UINPUT_NUM_REQUESTS; i++) { |
210 | request = udev->requests[i]; |
211 | if (request) { |
212 | request->retval = -ENODEV; |
213 | complete(&request->done); |
214 | } |
215 | } |
216 | |
217 | spin_unlock(lock: &udev->requests_lock); |
218 | } |
219 | |
220 | static void uinput_dev_set_gain(struct input_dev *dev, u16 gain) |
221 | { |
222 | uinput_dev_event(dev, EV_FF, FF_GAIN, value: gain); |
223 | } |
224 | |
225 | static void uinput_dev_set_autocenter(struct input_dev *dev, u16 magnitude) |
226 | { |
227 | uinput_dev_event(dev, EV_FF, FF_AUTOCENTER, value: magnitude); |
228 | } |
229 | |
230 | static int uinput_dev_playback(struct input_dev *dev, int effect_id, int value) |
231 | { |
232 | return uinput_dev_event(dev, EV_FF, code: effect_id, value); |
233 | } |
234 | |
235 | static int uinput_dev_upload_effect(struct input_dev *dev, |
236 | struct ff_effect *effect, |
237 | struct ff_effect *old) |
238 | { |
239 | struct uinput_device *udev = input_get_drvdata(dev); |
240 | struct uinput_request request; |
241 | |
242 | /* |
243 | * uinput driver does not currently support periodic effects with |
244 | * custom waveform since it does not have a way to pass buffer of |
245 | * samples (custom_data) to userspace. If ever there is a device |
246 | * supporting custom waveforms we would need to define an additional |
247 | * ioctl (UI_UPLOAD_SAMPLES) but for now we just bail out. |
248 | */ |
249 | if (effect->type == FF_PERIODIC && |
250 | effect->u.periodic.waveform == FF_CUSTOM) |
251 | return -EINVAL; |
252 | |
253 | request.code = UI_FF_UPLOAD; |
254 | request.u.upload.effect = effect; |
255 | request.u.upload.old = old; |
256 | |
257 | return uinput_request_submit(udev, request: &request); |
258 | } |
259 | |
260 | static int uinput_dev_erase_effect(struct input_dev *dev, int effect_id) |
261 | { |
262 | struct uinput_device *udev = input_get_drvdata(dev); |
263 | struct uinput_request request; |
264 | |
265 | if (!test_bit(EV_FF, dev->evbit)) |
266 | return -ENOSYS; |
267 | |
268 | request.code = UI_FF_ERASE; |
269 | request.u.effect_id = effect_id; |
270 | |
271 | return uinput_request_submit(udev, request: &request); |
272 | } |
273 | |
274 | static int uinput_dev_flush(struct input_dev *dev, struct file *file) |
275 | { |
276 | /* |
277 | * If we are called with file == NULL that means we are tearing |
278 | * down the device, and therefore we can not handle FF erase |
279 | * requests: either we are handling UI_DEV_DESTROY (and holding |
280 | * the udev->mutex), or the file descriptor is closed and there is |
281 | * nobody on the other side anymore. |
282 | */ |
283 | return file ? input_ff_flush(dev, file) : 0; |
284 | } |
285 | |
286 | static void uinput_destroy_device(struct uinput_device *udev) |
287 | { |
288 | const char *name, *phys; |
289 | struct input_dev *dev = udev->dev; |
290 | enum uinput_state old_state = udev->state; |
291 | |
292 | udev->state = UIST_NEW_DEVICE; |
293 | |
294 | if (dev) { |
295 | name = dev->name; |
296 | phys = dev->phys; |
297 | if (old_state == UIST_CREATED) { |
298 | uinput_flush_requests(udev); |
299 | input_unregister_device(dev); |
300 | } else { |
301 | input_free_device(dev); |
302 | } |
303 | kfree(objp: name); |
304 | kfree(objp: phys); |
305 | udev->dev = NULL; |
306 | } |
307 | } |
308 | |
309 | static int uinput_create_device(struct uinput_device *udev) |
310 | { |
311 | struct input_dev *dev = udev->dev; |
312 | int error, nslot; |
313 | |
314 | if (udev->state != UIST_SETUP_COMPLETE) { |
315 | printk(KERN_DEBUG "%s: write device info first\n" , UINPUT_NAME); |
316 | return -EINVAL; |
317 | } |
318 | |
319 | if (test_bit(EV_ABS, dev->evbit)) { |
320 | input_alloc_absinfo(dev); |
321 | if (!dev->absinfo) { |
322 | error = -EINVAL; |
323 | goto fail1; |
324 | } |
325 | |
326 | if (test_bit(ABS_MT_SLOT, dev->absbit)) { |
327 | nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1; |
328 | error = input_mt_init_slots(dev, num_slots: nslot, flags: 0); |
329 | if (error) |
330 | goto fail1; |
331 | } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) { |
332 | input_set_events_per_packet(dev, n_events: 60); |
333 | } |
334 | } |
335 | |
336 | if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) { |
337 | printk(KERN_DEBUG "%s: ff_effects_max should be non-zero when FF_BIT is set\n" , |
338 | UINPUT_NAME); |
339 | error = -EINVAL; |
340 | goto fail1; |
341 | } |
342 | |
343 | if (udev->ff_effects_max) { |
344 | error = input_ff_create(dev, max_effects: udev->ff_effects_max); |
345 | if (error) |
346 | goto fail1; |
347 | |
348 | dev->ff->upload = uinput_dev_upload_effect; |
349 | dev->ff->erase = uinput_dev_erase_effect; |
350 | dev->ff->playback = uinput_dev_playback; |
351 | dev->ff->set_gain = uinput_dev_set_gain; |
352 | dev->ff->set_autocenter = uinput_dev_set_autocenter; |
353 | /* |
354 | * The standard input_ff_flush() implementation does |
355 | * not quite work for uinput as we can't reasonably |
356 | * handle FF requests during device teardown. |
357 | */ |
358 | dev->flush = uinput_dev_flush; |
359 | } |
360 | |
361 | dev->event = uinput_dev_event; |
362 | |
363 | input_set_drvdata(dev: udev->dev, data: udev); |
364 | |
365 | error = input_register_device(udev->dev); |
366 | if (error) |
367 | goto fail2; |
368 | |
369 | udev->state = UIST_CREATED; |
370 | |
371 | return 0; |
372 | |
373 | fail2: input_ff_destroy(dev); |
374 | fail1: uinput_destroy_device(udev); |
375 | return error; |
376 | } |
377 | |
378 | static int uinput_open(struct inode *inode, struct file *file) |
379 | { |
380 | struct uinput_device *newdev; |
381 | |
382 | newdev = kzalloc(size: sizeof(struct uinput_device), GFP_KERNEL); |
383 | if (!newdev) |
384 | return -ENOMEM; |
385 | |
386 | mutex_init(&newdev->mutex); |
387 | spin_lock_init(&newdev->requests_lock); |
388 | init_waitqueue_head(&newdev->requests_waitq); |
389 | init_waitqueue_head(&newdev->waitq); |
390 | newdev->state = UIST_NEW_DEVICE; |
391 | |
392 | file->private_data = newdev; |
393 | stream_open(inode, filp: file); |
394 | |
395 | return 0; |
396 | } |
397 | |
398 | static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code, |
399 | const struct input_absinfo *abs) |
400 | { |
401 | int min, max, range; |
402 | |
403 | min = abs->minimum; |
404 | max = abs->maximum; |
405 | |
406 | if ((min != 0 || max != 0) && max < min) { |
407 | printk(KERN_DEBUG |
408 | "%s: invalid abs[%02x] min:%d max:%d\n" , |
409 | UINPUT_NAME, code, min, max); |
410 | return -EINVAL; |
411 | } |
412 | |
413 | if (!check_sub_overflow(max, min, &range) && abs->flat > range) { |
414 | printk(KERN_DEBUG |
415 | "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n" , |
416 | UINPUT_NAME, code, abs->flat, min, max); |
417 | return -EINVAL; |
418 | } |
419 | |
420 | return 0; |
421 | } |
422 | |
423 | static int uinput_validate_absbits(struct input_dev *dev) |
424 | { |
425 | unsigned int cnt; |
426 | int error; |
427 | |
428 | if (!test_bit(EV_ABS, dev->evbit)) |
429 | return 0; |
430 | |
431 | /* |
432 | * Check if absmin/absmax/absfuzz/absflat are sane. |
433 | */ |
434 | |
435 | for_each_set_bit(cnt, dev->absbit, ABS_CNT) { |
436 | if (!dev->absinfo) |
437 | return -EINVAL; |
438 | |
439 | error = uinput_validate_absinfo(dev, code: cnt, abs: &dev->absinfo[cnt]); |
440 | if (error) |
441 | return error; |
442 | } |
443 | |
444 | return 0; |
445 | } |
446 | |
447 | static int uinput_dev_setup(struct uinput_device *udev, |
448 | struct uinput_setup __user *arg) |
449 | { |
450 | struct uinput_setup setup; |
451 | struct input_dev *dev; |
452 | |
453 | if (udev->state == UIST_CREATED) |
454 | return -EINVAL; |
455 | |
456 | if (copy_from_user(to: &setup, from: arg, n: sizeof(setup))) |
457 | return -EFAULT; |
458 | |
459 | if (!setup.name[0]) |
460 | return -EINVAL; |
461 | |
462 | dev = udev->dev; |
463 | dev->id = setup.id; |
464 | udev->ff_effects_max = setup.ff_effects_max; |
465 | |
466 | kfree(objp: dev->name); |
467 | dev->name = kstrndup(s: setup.name, UINPUT_MAX_NAME_SIZE, GFP_KERNEL); |
468 | if (!dev->name) |
469 | return -ENOMEM; |
470 | |
471 | udev->state = UIST_SETUP_COMPLETE; |
472 | return 0; |
473 | } |
474 | |
475 | static int uinput_abs_setup(struct uinput_device *udev, |
476 | struct uinput_setup __user *arg, size_t size) |
477 | { |
478 | struct uinput_abs_setup setup = {}; |
479 | struct input_dev *dev; |
480 | int error; |
481 | |
482 | if (size > sizeof(setup)) |
483 | return -E2BIG; |
484 | |
485 | if (udev->state == UIST_CREATED) |
486 | return -EINVAL; |
487 | |
488 | if (copy_from_user(to: &setup, from: arg, n: size)) |
489 | return -EFAULT; |
490 | |
491 | if (setup.code > ABS_MAX) |
492 | return -ERANGE; |
493 | |
494 | dev = udev->dev; |
495 | |
496 | error = uinput_validate_absinfo(dev, code: setup.code, abs: &setup.absinfo); |
497 | if (error) |
498 | return error; |
499 | |
500 | input_alloc_absinfo(dev); |
501 | if (!dev->absinfo) |
502 | return -ENOMEM; |
503 | |
504 | set_bit(nr: setup.code, addr: dev->absbit); |
505 | dev->absinfo[setup.code] = setup.absinfo; |
506 | return 0; |
507 | } |
508 | |
509 | /* legacy setup via write() */ |
510 | static int uinput_setup_device_legacy(struct uinput_device *udev, |
511 | const char __user *buffer, size_t count) |
512 | { |
513 | struct uinput_user_dev *user_dev; |
514 | struct input_dev *dev; |
515 | int i; |
516 | int retval; |
517 | |
518 | if (count != sizeof(struct uinput_user_dev)) |
519 | return -EINVAL; |
520 | |
521 | if (!udev->dev) { |
522 | udev->dev = input_allocate_device(); |
523 | if (!udev->dev) |
524 | return -ENOMEM; |
525 | } |
526 | |
527 | dev = udev->dev; |
528 | |
529 | user_dev = memdup_user(buffer, sizeof(struct uinput_user_dev)); |
530 | if (IS_ERR(ptr: user_dev)) |
531 | return PTR_ERR(ptr: user_dev); |
532 | |
533 | udev->ff_effects_max = user_dev->ff_effects_max; |
534 | |
535 | /* Ensure name is filled in */ |
536 | if (!user_dev->name[0]) { |
537 | retval = -EINVAL; |
538 | goto exit; |
539 | } |
540 | |
541 | kfree(objp: dev->name); |
542 | dev->name = kstrndup(s: user_dev->name, UINPUT_MAX_NAME_SIZE, |
543 | GFP_KERNEL); |
544 | if (!dev->name) { |
545 | retval = -ENOMEM; |
546 | goto exit; |
547 | } |
548 | |
549 | dev->id.bustype = user_dev->id.bustype; |
550 | dev->id.vendor = user_dev->id.vendor; |
551 | dev->id.product = user_dev->id.product; |
552 | dev->id.version = user_dev->id.version; |
553 | |
554 | for (i = 0; i < ABS_CNT; i++) { |
555 | input_abs_set_max(dev, axis: i, val: user_dev->absmax[i]); |
556 | input_abs_set_min(dev, axis: i, val: user_dev->absmin[i]); |
557 | input_abs_set_fuzz(dev, axis: i, val: user_dev->absfuzz[i]); |
558 | input_abs_set_flat(dev, axis: i, val: user_dev->absflat[i]); |
559 | } |
560 | |
561 | retval = uinput_validate_absbits(dev); |
562 | if (retval < 0) |
563 | goto exit; |
564 | |
565 | udev->state = UIST_SETUP_COMPLETE; |
566 | retval = count; |
567 | |
568 | exit: |
569 | kfree(objp: user_dev); |
570 | return retval; |
571 | } |
572 | |
573 | /* |
574 | * Returns true if the given timestamp is valid (i.e., if all the following |
575 | * conditions are satisfied), false otherwise. |
576 | * 1) given timestamp is positive |
577 | * 2) it's within the allowed offset before the current time |
578 | * 3) it's not in the future |
579 | */ |
580 | static bool is_valid_timestamp(const ktime_t timestamp) |
581 | { |
582 | ktime_t zero_time; |
583 | ktime_t current_time; |
584 | ktime_t min_time; |
585 | ktime_t offset; |
586 | |
587 | zero_time = ktime_set(secs: 0, nsecs: 0); |
588 | if (ktime_compare(cmp1: zero_time, cmp2: timestamp) >= 0) |
589 | return false; |
590 | |
591 | current_time = ktime_get(); |
592 | offset = ktime_set(UINPUT_TIMESTAMP_ALLOWED_OFFSET_SECS, nsecs: 0); |
593 | min_time = ktime_sub(current_time, offset); |
594 | |
595 | if (ktime_after(cmp1: min_time, cmp2: timestamp) || ktime_after(cmp1: timestamp, cmp2: current_time)) |
596 | return false; |
597 | |
598 | return true; |
599 | } |
600 | |
601 | static ssize_t uinput_inject_events(struct uinput_device *udev, |
602 | const char __user *buffer, size_t count) |
603 | { |
604 | struct input_event ev; |
605 | size_t bytes = 0; |
606 | ktime_t timestamp; |
607 | |
608 | if (count != 0 && count < input_event_size()) |
609 | return -EINVAL; |
610 | |
611 | while (bytes + input_event_size() <= count) { |
612 | /* |
613 | * Note that even if some events were fetched successfully |
614 | * we are still going to return EFAULT instead of partial |
615 | * count to let userspace know that it got it's buffers |
616 | * all wrong. |
617 | */ |
618 | if (input_event_from_user(buffer: buffer + bytes, event: &ev)) |
619 | return -EFAULT; |
620 | |
621 | timestamp = ktime_set(secs: ev.input_event_sec, nsecs: ev.input_event_usec * NSEC_PER_USEC); |
622 | if (is_valid_timestamp(timestamp)) |
623 | input_set_timestamp(dev: udev->dev, timestamp); |
624 | |
625 | input_event(dev: udev->dev, type: ev.type, code: ev.code, value: ev.value); |
626 | bytes += input_event_size(); |
627 | cond_resched(); |
628 | } |
629 | |
630 | return bytes; |
631 | } |
632 | |
633 | static ssize_t uinput_write(struct file *file, const char __user *buffer, |
634 | size_t count, loff_t *ppos) |
635 | { |
636 | struct uinput_device *udev = file->private_data; |
637 | int retval; |
638 | |
639 | if (count == 0) |
640 | return 0; |
641 | |
642 | retval = mutex_lock_interruptible(&udev->mutex); |
643 | if (retval) |
644 | return retval; |
645 | |
646 | retval = udev->state == UIST_CREATED ? |
647 | uinput_inject_events(udev, buffer, count) : |
648 | uinput_setup_device_legacy(udev, buffer, count); |
649 | |
650 | mutex_unlock(lock: &udev->mutex); |
651 | |
652 | return retval; |
653 | } |
654 | |
655 | static bool uinput_fetch_next_event(struct uinput_device *udev, |
656 | struct input_event *event) |
657 | { |
658 | bool have_event; |
659 | |
660 | spin_lock_irq(lock: &udev->dev->event_lock); |
661 | |
662 | have_event = udev->head != udev->tail; |
663 | if (have_event) { |
664 | *event = udev->buff[udev->tail]; |
665 | udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE; |
666 | } |
667 | |
668 | spin_unlock_irq(lock: &udev->dev->event_lock); |
669 | |
670 | return have_event; |
671 | } |
672 | |
673 | static ssize_t uinput_events_to_user(struct uinput_device *udev, |
674 | char __user *buffer, size_t count) |
675 | { |
676 | struct input_event event; |
677 | size_t read = 0; |
678 | |
679 | while (read + input_event_size() <= count && |
680 | uinput_fetch_next_event(udev, event: &event)) { |
681 | |
682 | if (input_event_to_user(buffer: buffer + read, event: &event)) |
683 | return -EFAULT; |
684 | |
685 | read += input_event_size(); |
686 | } |
687 | |
688 | return read; |
689 | } |
690 | |
691 | static ssize_t uinput_read(struct file *file, char __user *buffer, |
692 | size_t count, loff_t *ppos) |
693 | { |
694 | struct uinput_device *udev = file->private_data; |
695 | ssize_t retval; |
696 | |
697 | if (count != 0 && count < input_event_size()) |
698 | return -EINVAL; |
699 | |
700 | do { |
701 | retval = mutex_lock_interruptible(&udev->mutex); |
702 | if (retval) |
703 | return retval; |
704 | |
705 | if (udev->state != UIST_CREATED) |
706 | retval = -ENODEV; |
707 | else if (udev->head == udev->tail && |
708 | (file->f_flags & O_NONBLOCK)) |
709 | retval = -EAGAIN; |
710 | else |
711 | retval = uinput_events_to_user(udev, buffer, count); |
712 | |
713 | mutex_unlock(lock: &udev->mutex); |
714 | |
715 | if (retval || count == 0) |
716 | break; |
717 | |
718 | if (!(file->f_flags & O_NONBLOCK)) |
719 | retval = wait_event_interruptible(udev->waitq, |
720 | udev->head != udev->tail || |
721 | udev->state != UIST_CREATED); |
722 | } while (retval == 0); |
723 | |
724 | return retval; |
725 | } |
726 | |
727 | static __poll_t uinput_poll(struct file *file, poll_table *wait) |
728 | { |
729 | struct uinput_device *udev = file->private_data; |
730 | __poll_t mask = EPOLLOUT | EPOLLWRNORM; /* uinput is always writable */ |
731 | |
732 | poll_wait(filp: file, wait_address: &udev->waitq, p: wait); |
733 | |
734 | if (udev->head != udev->tail) |
735 | mask |= EPOLLIN | EPOLLRDNORM; |
736 | |
737 | return mask; |
738 | } |
739 | |
740 | static int uinput_release(struct inode *inode, struct file *file) |
741 | { |
742 | struct uinput_device *udev = file->private_data; |
743 | |
744 | uinput_destroy_device(udev); |
745 | kfree(objp: udev); |
746 | |
747 | return 0; |
748 | } |
749 | |
750 | #ifdef CONFIG_COMPAT |
751 | struct uinput_ff_upload_compat { |
752 | __u32 request_id; |
753 | __s32 retval; |
754 | struct ff_effect_compat effect; |
755 | struct ff_effect_compat old; |
756 | }; |
757 | |
758 | static int uinput_ff_upload_to_user(char __user *buffer, |
759 | const struct uinput_ff_upload *ff_up) |
760 | { |
761 | if (in_compat_syscall()) { |
762 | struct uinput_ff_upload_compat ff_up_compat; |
763 | |
764 | ff_up_compat.request_id = ff_up->request_id; |
765 | ff_up_compat.retval = ff_up->retval; |
766 | /* |
767 | * It so happens that the pointer that gives us the trouble |
768 | * is the last field in the structure. Since we don't support |
769 | * custom waveforms in uinput anyway we can just copy the whole |
770 | * thing (to the compat size) and ignore the pointer. |
771 | */ |
772 | memcpy(&ff_up_compat.effect, &ff_up->effect, |
773 | sizeof(struct ff_effect_compat)); |
774 | memcpy(&ff_up_compat.old, &ff_up->old, |
775 | sizeof(struct ff_effect_compat)); |
776 | |
777 | if (copy_to_user(to: buffer, from: &ff_up_compat, |
778 | n: sizeof(struct uinput_ff_upload_compat))) |
779 | return -EFAULT; |
780 | } else { |
781 | if (copy_to_user(to: buffer, from: ff_up, |
782 | n: sizeof(struct uinput_ff_upload))) |
783 | return -EFAULT; |
784 | } |
785 | |
786 | return 0; |
787 | } |
788 | |
789 | static int uinput_ff_upload_from_user(const char __user *buffer, |
790 | struct uinput_ff_upload *ff_up) |
791 | { |
792 | if (in_compat_syscall()) { |
793 | struct uinput_ff_upload_compat ff_up_compat; |
794 | |
795 | if (copy_from_user(to: &ff_up_compat, from: buffer, |
796 | n: sizeof(struct uinput_ff_upload_compat))) |
797 | return -EFAULT; |
798 | |
799 | ff_up->request_id = ff_up_compat.request_id; |
800 | ff_up->retval = ff_up_compat.retval; |
801 | memcpy(&ff_up->effect, &ff_up_compat.effect, |
802 | sizeof(struct ff_effect_compat)); |
803 | memcpy(&ff_up->old, &ff_up_compat.old, |
804 | sizeof(struct ff_effect_compat)); |
805 | |
806 | } else { |
807 | if (copy_from_user(to: ff_up, from: buffer, |
808 | n: sizeof(struct uinput_ff_upload))) |
809 | return -EFAULT; |
810 | } |
811 | |
812 | return 0; |
813 | } |
814 | |
815 | #else |
816 | |
817 | static int uinput_ff_upload_to_user(char __user *buffer, |
818 | const struct uinput_ff_upload *ff_up) |
819 | { |
820 | if (copy_to_user(buffer, ff_up, sizeof(struct uinput_ff_upload))) |
821 | return -EFAULT; |
822 | |
823 | return 0; |
824 | } |
825 | |
826 | static int uinput_ff_upload_from_user(const char __user *buffer, |
827 | struct uinput_ff_upload *ff_up) |
828 | { |
829 | if (copy_from_user(ff_up, buffer, sizeof(struct uinput_ff_upload))) |
830 | return -EFAULT; |
831 | |
832 | return 0; |
833 | } |
834 | |
835 | #endif |
836 | |
837 | #define uinput_set_bit(_arg, _bit, _max) \ |
838 | ({ \ |
839 | int __ret = 0; \ |
840 | if (udev->state == UIST_CREATED) \ |
841 | __ret = -EINVAL; \ |
842 | else if ((_arg) > (_max)) \ |
843 | __ret = -EINVAL; \ |
844 | else set_bit((_arg), udev->dev->_bit); \ |
845 | __ret; \ |
846 | }) |
847 | |
848 | static int uinput_str_to_user(void __user *dest, const char *str, |
849 | unsigned int maxlen) |
850 | { |
851 | char __user *p = dest; |
852 | int len, ret; |
853 | |
854 | if (!str) |
855 | return -ENOENT; |
856 | |
857 | if (maxlen == 0) |
858 | return -EINVAL; |
859 | |
860 | len = strlen(str) + 1; |
861 | if (len > maxlen) |
862 | len = maxlen; |
863 | |
864 | ret = copy_to_user(to: p, from: str, n: len); |
865 | if (ret) |
866 | return -EFAULT; |
867 | |
868 | /* force terminating '\0' */ |
869 | ret = put_user(0, p + len - 1); |
870 | return ret ? -EFAULT : len; |
871 | } |
872 | |
873 | static long uinput_ioctl_handler(struct file *file, unsigned int cmd, |
874 | unsigned long arg, void __user *p) |
875 | { |
876 | int retval; |
877 | struct uinput_device *udev = file->private_data; |
878 | struct uinput_ff_upload ff_up; |
879 | struct uinput_ff_erase ff_erase; |
880 | struct uinput_request *req; |
881 | char *phys; |
882 | const char *name; |
883 | unsigned int size; |
884 | |
885 | retval = mutex_lock_interruptible(&udev->mutex); |
886 | if (retval) |
887 | return retval; |
888 | |
889 | if (!udev->dev) { |
890 | udev->dev = input_allocate_device(); |
891 | if (!udev->dev) { |
892 | retval = -ENOMEM; |
893 | goto out; |
894 | } |
895 | } |
896 | |
897 | switch (cmd) { |
898 | case UI_GET_VERSION: |
899 | if (put_user(UINPUT_VERSION, (unsigned int __user *)p)) |
900 | retval = -EFAULT; |
901 | goto out; |
902 | |
903 | case UI_DEV_CREATE: |
904 | retval = uinput_create_device(udev); |
905 | goto out; |
906 | |
907 | case UI_DEV_DESTROY: |
908 | uinput_destroy_device(udev); |
909 | goto out; |
910 | |
911 | case UI_DEV_SETUP: |
912 | retval = uinput_dev_setup(udev, arg: p); |
913 | goto out; |
914 | |
915 | /* UI_ABS_SETUP is handled in the variable size ioctls */ |
916 | |
917 | case UI_SET_EVBIT: |
918 | retval = uinput_set_bit(arg, evbit, EV_MAX); |
919 | goto out; |
920 | |
921 | case UI_SET_KEYBIT: |
922 | retval = uinput_set_bit(arg, keybit, KEY_MAX); |
923 | goto out; |
924 | |
925 | case UI_SET_RELBIT: |
926 | retval = uinput_set_bit(arg, relbit, REL_MAX); |
927 | goto out; |
928 | |
929 | case UI_SET_ABSBIT: |
930 | retval = uinput_set_bit(arg, absbit, ABS_MAX); |
931 | goto out; |
932 | |
933 | case UI_SET_MSCBIT: |
934 | retval = uinput_set_bit(arg, mscbit, MSC_MAX); |
935 | goto out; |
936 | |
937 | case UI_SET_LEDBIT: |
938 | retval = uinput_set_bit(arg, ledbit, LED_MAX); |
939 | goto out; |
940 | |
941 | case UI_SET_SNDBIT: |
942 | retval = uinput_set_bit(arg, sndbit, SND_MAX); |
943 | goto out; |
944 | |
945 | case UI_SET_FFBIT: |
946 | retval = uinput_set_bit(arg, ffbit, FF_MAX); |
947 | goto out; |
948 | |
949 | case UI_SET_SWBIT: |
950 | retval = uinput_set_bit(arg, swbit, SW_MAX); |
951 | goto out; |
952 | |
953 | case UI_SET_PROPBIT: |
954 | retval = uinput_set_bit(arg, propbit, INPUT_PROP_MAX); |
955 | goto out; |
956 | |
957 | case UI_SET_PHYS: |
958 | if (udev->state == UIST_CREATED) { |
959 | retval = -EINVAL; |
960 | goto out; |
961 | } |
962 | |
963 | phys = strndup_user(p, 1024); |
964 | if (IS_ERR(ptr: phys)) { |
965 | retval = PTR_ERR(ptr: phys); |
966 | goto out; |
967 | } |
968 | |
969 | kfree(objp: udev->dev->phys); |
970 | udev->dev->phys = phys; |
971 | goto out; |
972 | |
973 | case UI_BEGIN_FF_UPLOAD: |
974 | retval = uinput_ff_upload_from_user(buffer: p, ff_up: &ff_up); |
975 | if (retval) |
976 | goto out; |
977 | |
978 | req = uinput_request_find(udev, id: ff_up.request_id); |
979 | if (!req || req->code != UI_FF_UPLOAD || |
980 | !req->u.upload.effect) { |
981 | retval = -EINVAL; |
982 | goto out; |
983 | } |
984 | |
985 | ff_up.retval = 0; |
986 | ff_up.effect = *req->u.upload.effect; |
987 | if (req->u.upload.old) |
988 | ff_up.old = *req->u.upload.old; |
989 | else |
990 | memset(&ff_up.old, 0, sizeof(struct ff_effect)); |
991 | |
992 | retval = uinput_ff_upload_to_user(buffer: p, ff_up: &ff_up); |
993 | goto out; |
994 | |
995 | case UI_BEGIN_FF_ERASE: |
996 | if (copy_from_user(to: &ff_erase, from: p, n: sizeof(ff_erase))) { |
997 | retval = -EFAULT; |
998 | goto out; |
999 | } |
1000 | |
1001 | req = uinput_request_find(udev, id: ff_erase.request_id); |
1002 | if (!req || req->code != UI_FF_ERASE) { |
1003 | retval = -EINVAL; |
1004 | goto out; |
1005 | } |
1006 | |
1007 | ff_erase.retval = 0; |
1008 | ff_erase.effect_id = req->u.effect_id; |
1009 | if (copy_to_user(to: p, from: &ff_erase, n: sizeof(ff_erase))) { |
1010 | retval = -EFAULT; |
1011 | goto out; |
1012 | } |
1013 | |
1014 | goto out; |
1015 | |
1016 | case UI_END_FF_UPLOAD: |
1017 | retval = uinput_ff_upload_from_user(buffer: p, ff_up: &ff_up); |
1018 | if (retval) |
1019 | goto out; |
1020 | |
1021 | req = uinput_request_find(udev, id: ff_up.request_id); |
1022 | if (!req || req->code != UI_FF_UPLOAD || |
1023 | !req->u.upload.effect) { |
1024 | retval = -EINVAL; |
1025 | goto out; |
1026 | } |
1027 | |
1028 | req->retval = ff_up.retval; |
1029 | complete(&req->done); |
1030 | goto out; |
1031 | |
1032 | case UI_END_FF_ERASE: |
1033 | if (copy_from_user(to: &ff_erase, from: p, n: sizeof(ff_erase))) { |
1034 | retval = -EFAULT; |
1035 | goto out; |
1036 | } |
1037 | |
1038 | req = uinput_request_find(udev, id: ff_erase.request_id); |
1039 | if (!req || req->code != UI_FF_ERASE) { |
1040 | retval = -EINVAL; |
1041 | goto out; |
1042 | } |
1043 | |
1044 | req->retval = ff_erase.retval; |
1045 | complete(&req->done); |
1046 | goto out; |
1047 | } |
1048 | |
1049 | size = _IOC_SIZE(cmd); |
1050 | |
1051 | /* Now check variable-length commands */ |
1052 | switch (cmd & ~IOCSIZE_MASK) { |
1053 | case UI_GET_SYSNAME(0): |
1054 | if (udev->state != UIST_CREATED) { |
1055 | retval = -ENOENT; |
1056 | goto out; |
1057 | } |
1058 | name = dev_name(dev: &udev->dev->dev); |
1059 | retval = uinput_str_to_user(dest: p, str: name, maxlen: size); |
1060 | goto out; |
1061 | |
1062 | case UI_ABS_SETUP & ~IOCSIZE_MASK: |
1063 | retval = uinput_abs_setup(udev, arg: p, size); |
1064 | goto out; |
1065 | } |
1066 | |
1067 | retval = -EINVAL; |
1068 | out: |
1069 | mutex_unlock(lock: &udev->mutex); |
1070 | return retval; |
1071 | } |
1072 | |
1073 | static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg) |
1074 | { |
1075 | return uinput_ioctl_handler(file, cmd, arg, p: (void __user *)arg); |
1076 | } |
1077 | |
1078 | #ifdef CONFIG_COMPAT |
1079 | |
1080 | /* |
1081 | * These IOCTLs change their size and thus their numbers between |
1082 | * 32 and 64 bits. |
1083 | */ |
1084 | #define UI_SET_PHYS_COMPAT \ |
1085 | _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t) |
1086 | #define UI_BEGIN_FF_UPLOAD_COMPAT \ |
1087 | _IOWR(UINPUT_IOCTL_BASE, 200, struct uinput_ff_upload_compat) |
1088 | #define UI_END_FF_UPLOAD_COMPAT \ |
1089 | _IOW(UINPUT_IOCTL_BASE, 201, struct uinput_ff_upload_compat) |
1090 | |
1091 | static long uinput_compat_ioctl(struct file *file, |
1092 | unsigned int cmd, unsigned long arg) |
1093 | { |
1094 | switch (cmd) { |
1095 | case UI_SET_PHYS_COMPAT: |
1096 | cmd = UI_SET_PHYS; |
1097 | break; |
1098 | case UI_BEGIN_FF_UPLOAD_COMPAT: |
1099 | cmd = UI_BEGIN_FF_UPLOAD; |
1100 | break; |
1101 | case UI_END_FF_UPLOAD_COMPAT: |
1102 | cmd = UI_END_FF_UPLOAD; |
1103 | break; |
1104 | } |
1105 | |
1106 | return uinput_ioctl_handler(file, cmd, arg, p: compat_ptr(uptr: arg)); |
1107 | } |
1108 | #endif |
1109 | |
1110 | static const struct file_operations uinput_fops = { |
1111 | .owner = THIS_MODULE, |
1112 | .open = uinput_open, |
1113 | .release = uinput_release, |
1114 | .read = uinput_read, |
1115 | .write = uinput_write, |
1116 | .poll = uinput_poll, |
1117 | .unlocked_ioctl = uinput_ioctl, |
1118 | #ifdef CONFIG_COMPAT |
1119 | .compat_ioctl = uinput_compat_ioctl, |
1120 | #endif |
1121 | .llseek = no_llseek, |
1122 | }; |
1123 | |
1124 | static struct miscdevice uinput_misc = { |
1125 | .fops = &uinput_fops, |
1126 | .minor = UINPUT_MINOR, |
1127 | .name = UINPUT_NAME, |
1128 | }; |
1129 | module_misc_device(uinput_misc); |
1130 | |
1131 | MODULE_ALIAS_MISCDEV(UINPUT_MINOR); |
1132 | MODULE_ALIAS("devname:" UINPUT_NAME); |
1133 | |
1134 | MODULE_AUTHOR("Aristeu Sergio Rozanski Filho" ); |
1135 | MODULE_DESCRIPTION("User level driver support for input subsystem" ); |
1136 | MODULE_LICENSE("GPL" ); |
1137 | |