uinput.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 *  User level driver support for input subsystem
   4 *
   5 * Heavily based on evdev.c by Vojtech Pavlik
   6 *
   7 * Author: Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org>
   8 *
   9 * Changes/Revisions:
  10 *	0.4	01/09/2014 (Benjamin Tissoires <benjamin.tissoires@redhat.com>)
  11 *		- add UI_GET_SYSNAME ioctl
  12 *	0.3	09/04/2006 (Anssi Hannula <anssi.hannula@gmail.com>)
  13 *		- updated ff support for the changes in kernel interface
  14 *		- added MODULE_VERSION
  15 *	0.2	16/10/2004 (Micah Dowty <micah@navi.cx>)
  16 *		- added force feedback support
  17 *              - added UI_SET_PHYS
  18 *	0.1	20/06/2002
  19 *		- first public version
  20 */
  21#include <uapi/linux/uinput.h>
  22#include <linux/poll.h>
  23#include <linux/sched.h>
  24#include <linux/slab.h>
  25#include <linux/module.h>
  26#include <linux/init.h>
  27#include <linux/fs.h>
  28#include <linux/lockdep.h>
  29#include <linux/miscdevice.h>
  30#include <linux/overflow.h>
  31#include <linux/spinlock.h>
  32#include <linux/input/mt.h>
  33#include "../input-compat.h"
  34
  35#define UINPUT_NAME		"uinput"
  36#define UINPUT_BUFFER_SIZE	16
  37#define UINPUT_NUM_REQUESTS	16
  38#define UINPUT_TIMESTAMP_ALLOWED_OFFSET_SECS 10
  39
  40enum uinput_state { UIST_NEW_DEVICE, UIST_SETUP_COMPLETE, UIST_CREATED };
  41
  42struct uinput_request {
  43	unsigned int		id;
  44	unsigned int		code;	/* UI_FF_UPLOAD, UI_FF_ERASE */
  45
  46	int			retval;
  47	struct completion	done;
  48
  49	union {
  50		unsigned int	effect_id;
  51		struct {
  52			struct ff_effect *effect;
  53			struct ff_effect *old;
  54		} upload;
  55	} u;
  56};
  57
  58struct uinput_device {
  59	struct input_dev	*dev;
  60	struct mutex		mutex;
  61	enum uinput_state	state;
  62	spinlock_t		state_lock;
  63	wait_queue_head_t	waitq;
  64	unsigned char		ready;
  65	unsigned char		head;
  66	unsigned char		tail;
  67	struct input_event	buff[UINPUT_BUFFER_SIZE];
  68	unsigned int		ff_effects_max;
  69
  70	struct uinput_request	*requests[UINPUT_NUM_REQUESTS];
  71	wait_queue_head_t	requests_waitq;
  72	spinlock_t		requests_lock;
  73};
  74
  75static int uinput_dev_event(struct input_dev *dev,
  76			    unsigned int type, unsigned int code, int value)
  77{
  78	struct uinput_device	*udev = input_get_drvdata(dev);
  79	struct timespec64	ts;
  80
  81	lockdep_assert_held(&dev->event_lock);
  82
  83	ktime_get_ts64(&ts);
  84
  85	udev->buff[udev->head] = (struct input_event) {
  86		.input_event_sec = ts.tv_sec,
  87		.input_event_usec = ts.tv_nsec / NSEC_PER_USEC,
  88		.type = type,
  89		.code = code,
  90		.value = value,
  91	};
  92
  93	udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE;
  94
  95	wake_up_interruptible(&udev->waitq);
  96
  97	return 0;
  98}
  99
 100/* Atomically allocate an ID for the given request. Returns 0 on success. */
 101static bool uinput_request_alloc_id(struct uinput_device *udev,
 102				    struct uinput_request *request)
 103{
 104	unsigned int id;
 105	bool reserved = false;
 106
 107	spin_lock(&udev->requests_lock);
 108
 109	for (id = 0; id < UINPUT_NUM_REQUESTS; id++) {
 110		if (!udev->requests[id]) {
 111			request->id = id;
 112			udev->requests[id] = request;
 113			reserved = true;
 114			break;
 115		}
 116	}
 117
 118	spin_unlock(&udev->requests_lock);
 119	return reserved;
 120}
 121
 122static struct uinput_request *uinput_request_find(struct uinput_device *udev,
 123						  unsigned int id)
 124{
 125	/* Find an input request, by ID. Returns NULL if the ID isn't valid. */
 126	if (id >= UINPUT_NUM_REQUESTS)
 127		return NULL;
 128
 129	return udev->requests[id];
 130}
 131
 132static int uinput_request_reserve_slot(struct uinput_device *udev,
 133				       struct uinput_request *request)
 134{
 135	/* Allocate slot. If none are available right away, wait. */
 136	return wait_event_interruptible(udev->requests_waitq,
 137					uinput_request_alloc_id(udev, request));
 138}
 139
 140static void uinput_request_release_slot(struct uinput_device *udev,
 141					unsigned int id)
 142{
 143	/* Mark slot as available */
 144	spin_lock(&udev->requests_lock);
 145	udev->requests[id] = NULL;
 146	spin_unlock(&udev->requests_lock);
 147
 148	wake_up(&udev->requests_waitq);
 149}
 150
 151static int uinput_request_send(struct uinput_device *udev,
 152			       struct uinput_request *request)
 153{
 154	unsigned long flags;
 155	int retval = 0;
 156
 157	spin_lock(&udev->state_lock);
 158
 159	if (udev->state != UIST_CREATED) {
 160		retval = -ENODEV;
 161		goto out;
 162	}
 163
 164	/*
 165	 * Tell our userspace application about this new request
 166	 * by queueing an input event.
 167	 */
 168	spin_lock_irqsave(&udev->dev->event_lock, flags);
 169	uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id);
 170	spin_unlock_irqrestore(&udev->dev->event_lock, flags);
 171
 172 out:
 173	spin_unlock(&udev->state_lock);
 174	return retval;
 175}
 176
 177static int uinput_request_submit(struct uinput_device *udev,
 178				 struct uinput_request *request)
 179{
 180	int retval;
 181
 182	/*
 183	 * Initialize completion before allocating the request slot.
 184	 * Once the slot is allocated, uinput_flush_requests() may
 185	 * complete it at any time, so it must be initialized first.
 186	 */
 187	init_completion(&request->done);
 188
 189	retval = uinput_request_reserve_slot(udev, request);
 190	if (retval)
 191		return retval;
 192
 193	retval = uinput_request_send(udev, request);
 194	if (retval)
 195		goto out;
 196
 197	if (!wait_for_completion_timeout(&request->done, 30 * HZ)) {
 198		retval = -ETIMEDOUT;
 199		goto out;
 200	}
 201
 202	retval = request->retval;
 203
 204 out:
 205	uinput_request_release_slot(udev, request->id);
 206	return retval;
 207}
 208
 209/*
 210 * Fail all outstanding requests so handlers don't wait for the userspace
 211 * to finish processing them.
 212 */
 213static void uinput_flush_requests(struct uinput_device *udev)
 214{
 215	struct uinput_request *request;
 216	int i;
 217
 218	spin_lock(&udev->requests_lock);
 219
 220	for (i = 0; i < UINPUT_NUM_REQUESTS; i++) {
 221		request = udev->requests[i];
 222		if (request) {
 223			request->retval = -ENODEV;
 224			complete(&request->done);
 225		}
 226	}
 227
 228	spin_unlock(&udev->requests_lock);
 229}
 230
 231static void uinput_dev_set_gain(struct input_dev *dev, u16 gain)
 232{
 233	uinput_dev_event(dev, EV_FF, FF_GAIN, gain);
 234}
 235
 236static void uinput_dev_set_autocenter(struct input_dev *dev, u16 magnitude)
 237{
 238	uinput_dev_event(dev, EV_FF, FF_AUTOCENTER, magnitude);
 239}
 240
 241static int uinput_dev_playback(struct input_dev *dev, int effect_id, int value)
 242{
 243	return uinput_dev_event(dev, EV_FF, effect_id, value);
 244}
 245
 246static int uinput_dev_upload_effect(struct input_dev *dev,
 247				    struct ff_effect *effect,
 248				    struct ff_effect *old)
 249{
 250	struct uinput_device *udev = input_get_drvdata(dev);
 251	struct uinput_request request;
 252
 253	/*
 254	 * uinput driver does not currently support periodic effects with
 255	 * custom waveform since it does not have a way to pass buffer of
 256	 * samples (custom_data) to userspace. If ever there is a device
 257	 * supporting custom waveforms we would need to define an additional
 258	 * ioctl (UI_UPLOAD_SAMPLES) but for now we just bail out.
 259	 */
 260	if (effect->type == FF_PERIODIC &&
 261			effect->u.periodic.waveform == FF_CUSTOM)
 262		return -EINVAL;
 263
 264	request.code = UI_FF_UPLOAD;
 265	request.u.upload.effect = effect;
 266	request.u.upload.old = old;
 267
 268	return uinput_request_submit(udev, &request);
 269}
 270
 271static int uinput_dev_erase_effect(struct input_dev *dev, int effect_id)
 272{
 273	struct uinput_device *udev = input_get_drvdata(dev);
 274	struct uinput_request request;
 275
 276	if (!test_bit(EV_FF, dev->evbit))
 277		return -ENOSYS;
 278
 279	request.code = UI_FF_ERASE;
 280	request.u.effect_id = effect_id;
 281
 282	return uinput_request_submit(udev, &request);
 283}
 284
 285static int uinput_dev_flush(struct input_dev *dev, struct file *file)
 286{
 287	/*
 288	 * If we are called with file == NULL that means we are tearing
 289	 * down the device, and therefore we can not handle FF erase
 290	 * requests: either we are handling UI_DEV_DESTROY (and holding
 291	 * the udev->mutex), or the file descriptor is closed and there is
 292	 * nobody on the other side anymore.
 293	 */
 294	return file ? input_ff_flush(dev, file) : 0;
 295}
 296
 297static void uinput_destroy_device(struct uinput_device *udev)
 298{
 299	const char *name, *phys;
 300	struct input_dev *dev = udev->dev;
 301	enum uinput_state old_state = udev->state;
 302
 303	/*
 304	 * Update state under state_lock so that concurrent
 305	 * uinput_request_send() sees the state change before we
 306	 * flush pending requests and tear down the device.
 307	 */
 308	spin_lock(&udev->state_lock);
 309	udev->state = UIST_NEW_DEVICE;
 310	spin_unlock(&udev->state_lock);
 311
 312	if (dev) {
 313		name = dev->name;
 314		phys = dev->phys;
 315		if (old_state == UIST_CREATED) {
 316			uinput_flush_requests(udev);
 317			input_unregister_device(dev);
 318		} else {
 319			input_free_device(dev);
 320		}
 321		kfree(name);
 322		kfree(phys);
 323		udev->dev = NULL;
 324	}
 325}
 326
 327static int uinput_create_device(struct uinput_device *udev)
 328{
 329	struct input_dev *dev = udev->dev;
 330	int error, nslot;
 331
 332	if (udev->state != UIST_SETUP_COMPLETE) {
 333		printk(KERN_DEBUG "%s: write device info first\n", UINPUT_NAME);
 334		return -EINVAL;
 335	}
 336
 337	if (test_bit(EV_ABS, dev->evbit)) {
 338		input_alloc_absinfo(dev);
 339		if (!dev->absinfo) {
 340			error = -EINVAL;
 341			goto fail1;
 342		}
 343
 344		if (test_bit(ABS_MT_SLOT, dev->absbit)) {
 345			nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
 346			error = input_mt_init_slots(dev, nslot, 0);
 347			if (error)
 348				goto fail1;
 349		} else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
 350			input_set_events_per_packet(dev, 60);
 351		}
 352	}
 353
 354	if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) {
 355		printk(KERN_DEBUG "%s: ff_effects_max should be non-zero when FF_BIT is set\n",
 356			UINPUT_NAME);
 357		error = -EINVAL;
 358		goto fail1;
 359	}
 360
 361	if (udev->ff_effects_max) {
 362		error = input_ff_create(dev, udev->ff_effects_max);
 363		if (error)
 364			goto fail1;
 365
 366		dev->ff->upload = uinput_dev_upload_effect;
 367		dev->ff->erase = uinput_dev_erase_effect;
 368		dev->ff->playback = uinput_dev_playback;
 369		dev->ff->set_gain = uinput_dev_set_gain;
 370		dev->ff->set_autocenter = uinput_dev_set_autocenter;
 371		/*
 372		 * The standard input_ff_flush() implementation does
 373		 * not quite work for uinput as we can't reasonably
 374		 * handle FF requests during device teardown.
 375		 */
 376		dev->flush = uinput_dev_flush;
 377	}
 378
 379	dev->event = uinput_dev_event;
 380
 381	input_set_drvdata(udev->dev, udev);
 382
 383	error = input_register_device(udev->dev);
 384	if (error)
 385		goto fail2;
 386
 387	spin_lock(&udev->state_lock);
 388	udev->state = UIST_CREATED;
 389	spin_unlock(&udev->state_lock);
 390
 391	return 0;
 392
 393 fail2:	input_ff_destroy(dev);
 394 fail1: uinput_destroy_device(udev);
 395	return error;
 396}
 397
 398static int uinput_open(struct inode *inode, struct file *file)
 399{
 400	struct uinput_device *newdev;
 401
 402	newdev = kzalloc(sizeof(*newdev), GFP_KERNEL);
 403	if (!newdev)
 404		return -ENOMEM;
 405
 406	mutex_init(&newdev->mutex);
 407	spin_lock_init(&newdev->state_lock);
 408	spin_lock_init(&newdev->requests_lock);
 409	init_waitqueue_head(&newdev->requests_waitq);
 410	init_waitqueue_head(&newdev->waitq);
 411	newdev->state = UIST_NEW_DEVICE;
 412
 413	file->private_data = newdev;
 414	stream_open(inode, file);
 415
 416	return 0;
 417}
 418
 419static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
 420				   const struct input_absinfo *abs)
 421{
 422	int min, max, range;
 423
 424	min = abs->minimum;
 425	max = abs->maximum;
 426
 427	if ((min != 0 || max != 0) && max < min) {
 428		printk(KERN_DEBUG
 429		       "%s: invalid abs[%02x] min:%d max:%d\n",
 430		       UINPUT_NAME, code, min, max);
 431		return -EINVAL;
 432	}
 433
 434	if (!check_sub_overflow(max, min, &range) && abs->flat > range) {
 435		printk(KERN_DEBUG
 436		       "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n",
 437		       UINPUT_NAME, code, abs->flat, min, max);
 438		return -EINVAL;
 439	}
 440
 441	/*
 442	 * Limit number of contacts to a reasonable value (100). This
 443	 * ensures that we need less than 2 pages for struct input_mt
 444	 * (we are not using in-kernel slot assignment so not going to
 445	 * allocate memory for the "red" table), and we should have no
 446	 * trouble getting this much memory.
 447	 */
 448	if (code == ABS_MT_SLOT && max > 99) {
 449		printk(KERN_DEBUG
 450		       "%s: unreasonably large number of slots requested: %d\n",
 451		       UINPUT_NAME, max);
 452		return -EINVAL;
 453	}
 454
 455	return 0;
 456}
 457
 458static int uinput_validate_absbits(struct input_dev *dev)
 459{
 460	unsigned int cnt;
 461	int error;
 462
 463	if (!test_bit(EV_ABS, dev->evbit))
 464		return 0;
 465
 466	/*
 467	 * Check if absmin/absmax/absfuzz/absflat are sane.
 468	 */
 469
 470	for_each_set_bit(cnt, dev->absbit, ABS_CNT) {
 471		if (!dev->absinfo)
 472			return -EINVAL;
 473
 474		error = uinput_validate_absinfo(dev, cnt, &dev->absinfo[cnt]);
 475		if (error)
 476			return error;
 477	}
 478
 479	return 0;
 480}
 481
 482static int uinput_dev_setup(struct uinput_device *udev,
 483			    struct uinput_setup __user *arg)
 484{
 485	struct uinput_setup setup;
 486	struct input_dev *dev;
 487
 488	if (udev->state == UIST_CREATED)
 489		return -EINVAL;
 490
 491	if (copy_from_user(&setup, arg, sizeof(setup)))
 492		return -EFAULT;
 493
 494	if (!setup.name[0])
 495		return -EINVAL;
 496
 497	dev = udev->dev;
 498	dev->id = setup.id;
 499	udev->ff_effects_max = setup.ff_effects_max;
 500
 501	kfree(dev->name);
 502	dev->name = kstrndup(setup.name, UINPUT_MAX_NAME_SIZE, GFP_KERNEL);
 503	if (!dev->name)
 504		return -ENOMEM;
 505
 506	udev->state = UIST_SETUP_COMPLETE;
 507	return 0;
 508}
 509
 510static int uinput_abs_setup(struct uinput_device *udev,
 511			    struct uinput_setup __user *arg, size_t size)
 512{
 513	struct uinput_abs_setup setup = {};
 514	struct input_dev *dev;
 515	int error;
 516
 517	if (size > sizeof(setup))
 518		return -E2BIG;
 519
 520	if (udev->state == UIST_CREATED)
 521		return -EINVAL;
 522
 523	if (copy_from_user(&setup, arg, size))
 524		return -EFAULT;
 525
 526	if (setup.code > ABS_MAX)
 527		return -ERANGE;
 528
 529	dev = udev->dev;
 530
 531	error = uinput_validate_absinfo(dev, setup.code, &setup.absinfo);
 532	if (error)
 533		return error;
 534
 535	input_alloc_absinfo(dev);
 536	if (!dev->absinfo)
 537		return -ENOMEM;
 538
 539	set_bit(setup.code, dev->absbit);
 540	dev->absinfo[setup.code] = setup.absinfo;
 541	return 0;
 542}
 543
 544/* legacy setup via write() */
 545static int uinput_setup_device_legacy(struct uinput_device *udev,
 546				      const char __user *buffer, size_t count)
 547{
 548	struct uinput_user_dev	*user_dev;
 549	struct input_dev	*dev;
 550	int			i;
 551	int			retval;
 552
 553	if (count != sizeof(struct uinput_user_dev))
 554		return -EINVAL;
 555
 556	if (!udev->dev) {
 557		udev->dev = input_allocate_device();
 558		if (!udev->dev)
 559			return -ENOMEM;
 560	}
 561
 562	dev = udev->dev;
 563
 564	user_dev = memdup_user(buffer, sizeof(struct uinput_user_dev));
 565	if (IS_ERR(user_dev))
 566		return PTR_ERR(user_dev);
 567
 568	udev->ff_effects_max = user_dev->ff_effects_max;
 569
 570	/* Ensure name is filled in */
 571	if (!user_dev->name[0]) {
 572		retval = -EINVAL;
 573		goto exit;
 574	}
 575
 576	kfree(dev->name);
 577	dev->name = kstrndup(user_dev->name, UINPUT_MAX_NAME_SIZE,
 578			     GFP_KERNEL);
 579	if (!dev->name) {
 580		retval = -ENOMEM;
 581		goto exit;
 582	}
 583
 584	dev->id.bustype	= user_dev->id.bustype;
 585	dev->id.vendor	= user_dev->id.vendor;
 586	dev->id.product	= user_dev->id.product;
 587	dev->id.version	= user_dev->id.version;
 588
 589	for (i = 0; i < ABS_CNT; i++) {
 590		input_abs_set_max(dev, i, user_dev->absmax[i]);
 591		input_abs_set_min(dev, i, user_dev->absmin[i]);
 592		input_abs_set_fuzz(dev, i, user_dev->absfuzz[i]);
 593		input_abs_set_flat(dev, i, user_dev->absflat[i]);
 594	}
 595
 596	retval = uinput_validate_absbits(dev);
 597	if (retval < 0)
 598		goto exit;
 599
 600	udev->state = UIST_SETUP_COMPLETE;
 601	retval = count;
 602
 603 exit:
 604	kfree(user_dev);
 605	return retval;
 606}
 607
 608/*
 609 * Returns true if the given timestamp is valid (i.e., if all the following
 610 * conditions are satisfied), false otherwise.
 611 * 1) given timestamp is positive
 612 * 2) it's within the allowed offset before the current time
 613 * 3) it's not in the future
 614 */
 615static bool is_valid_timestamp(const ktime_t timestamp)
 616{
 617	ktime_t zero_time;
 618	ktime_t current_time;
 619	ktime_t min_time;
 620	ktime_t offset;
 621
 622	zero_time = ktime_set(0, 0);
 623	if (ktime_compare(zero_time, timestamp) >= 0)
 624		return false;
 625
 626	current_time = ktime_get();
 627	offset = ktime_set(UINPUT_TIMESTAMP_ALLOWED_OFFSET_SECS, 0);
 628	min_time = ktime_sub(current_time, offset);
 629
 630	if (ktime_after(min_time, timestamp) || ktime_after(timestamp, current_time))
 631		return false;
 632
 633	return true;
 634}
 635
 636static ssize_t uinput_inject_events(struct uinput_device *udev,
 637				    const char __user *buffer, size_t count)
 638{
 639	struct input_event ev;
 640	size_t bytes = 0;
 641	ktime_t timestamp;
 642
 643	if (count != 0 && count < input_event_size())
 644		return -EINVAL;
 645
 646	while (bytes + input_event_size() <= count) {
 647		/*
 648		 * Note that even if some events were fetched successfully
 649		 * we are still going to return EFAULT instead of partial
 650		 * count to let userspace know that it got it's buffers
 651		 * all wrong.
 652		 */
 653		if (input_event_from_user(buffer + bytes, &ev))
 654			return -EFAULT;
 655
 656		timestamp = ktime_set(ev.input_event_sec, ev.input_event_usec * NSEC_PER_USEC);
 657		if (is_valid_timestamp(timestamp))
 658			input_set_timestamp(udev->dev, timestamp);
 659
 660		input_event(udev->dev, ev.type, ev.code, ev.value);
 661		bytes += input_event_size();
 662		cond_resched();
 663	}
 664
 665	return bytes;
 666}
 667
 668static ssize_t uinput_write(struct file *file, const char __user *buffer,
 669			    size_t count, loff_t *ppos)
 670{
 671	struct uinput_device *udev = file->private_data;
 672	int retval;
 673
 674	if (count == 0)
 675		return 0;
 676
 677	retval = mutex_lock_interruptible(&udev->mutex);
 678	if (retval)
 679		return retval;
 680
 681	retval = udev->state == UIST_CREATED ?
 682			uinput_inject_events(udev, buffer, count) :
 683			uinput_setup_device_legacy(udev, buffer, count);
 684
 685	mutex_unlock(&udev->mutex);
 686
 687	return retval;
 688}
 689
 690static bool uinput_fetch_next_event(struct uinput_device *udev,
 691				    struct input_event *event)
 692{
 693	bool have_event;
 694
 695	spin_lock_irq(&udev->dev->event_lock);
 696
 697	have_event = udev->head != udev->tail;
 698	if (have_event) {
 699		*event = udev->buff[udev->tail];
 700		udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE;
 701	}
 702
 703	spin_unlock_irq(&udev->dev->event_lock);
 704
 705	return have_event;
 706}
 707
 708static ssize_t uinput_events_to_user(struct uinput_device *udev,
 709				     char __user *buffer, size_t count)
 710{
 711	struct input_event event;
 712	size_t read = 0;
 713
 714	while (read + input_event_size() <= count &&
 715	       uinput_fetch_next_event(udev, &event)) {
 716
 717		if (input_event_to_user(buffer + read, &event))
 718			return -EFAULT;
 719
 720		read += input_event_size();
 721	}
 722
 723	return read;
 724}
 725
 726static ssize_t uinput_read(struct file *file, char __user *buffer,
 727			   size_t count, loff_t *ppos)
 728{
 729	struct uinput_device *udev = file->private_data;
 730	ssize_t retval;
 731
 732	if (count != 0 && count < input_event_size())
 733		return -EINVAL;
 734
 735	do {
 736		retval = mutex_lock_interruptible(&udev->mutex);
 737		if (retval)
 738			return retval;
 739
 740		if (udev->state != UIST_CREATED)
 741			retval = -ENODEV;
 742		else if (udev->head == udev->tail &&
 743			 (file->f_flags & O_NONBLOCK))
 744			retval = -EAGAIN;
 745		else
 746			retval = uinput_events_to_user(udev, buffer, count);
 747
 748		mutex_unlock(&udev->mutex);
 749
 750		if (retval || count == 0)
 751			break;
 752
 753		if (!(file->f_flags & O_NONBLOCK))
 754			retval = wait_event_interruptible(udev->waitq,
 755						  udev->head != udev->tail ||
 756						  udev->state != UIST_CREATED);
 757	} while (retval == 0);
 758
 759	return retval;
 760}
 761
 762static __poll_t uinput_poll(struct file *file, poll_table *wait)
 763{
 764	struct uinput_device *udev = file->private_data;
 765	__poll_t mask = EPOLLOUT | EPOLLWRNORM; /* uinput is always writable */
 766
 767	poll_wait(file, &udev->waitq, wait);
 768
 769	if (udev->head != udev->tail)
 770		mask |= EPOLLIN | EPOLLRDNORM;
 771
 772	return mask;
 773}
 774
 775static int uinput_release(struct inode *inode, struct file *file)
 776{
 777	struct uinput_device *udev = file->private_data;
 778
 779	uinput_destroy_device(udev);
 780	kfree(udev);
 781
 782	return 0;
 783}
 784
 785#ifdef CONFIG_COMPAT
 786struct uinput_ff_upload_compat {
 787	__u32			request_id;
 788	__s32			retval;
 789	struct ff_effect_compat	effect;
 790	struct ff_effect_compat	old;
 791};
 792
 793static int uinput_ff_upload_to_user(char __user *buffer,
 794				    const struct uinput_ff_upload *ff_up)
 795{
 796	if (in_compat_syscall()) {
 797		struct uinput_ff_upload_compat ff_up_compat;
 798
 799		memset(&ff_up_compat, 0, sizeof(ff_up_compat));
 800		ff_up_compat.request_id = ff_up->request_id;
 801		ff_up_compat.retval = ff_up->retval;
 802		/*
 803		 * It so happens that the pointer that gives us the trouble
 804		 * is the last field in the structure. Since we don't support
 805		 * custom waveforms in uinput anyway we can just copy the whole
 806		 * thing (to the compat size) and ignore the pointer.
 807		 */
 808		memcpy(&ff_up_compat.effect, &ff_up->effect,
 809			sizeof(struct ff_effect_compat));
 810		memcpy(&ff_up_compat.old, &ff_up->old,
 811			sizeof(struct ff_effect_compat));
 812
 813		if (copy_to_user(buffer, &ff_up_compat,
 814				 sizeof(struct uinput_ff_upload_compat)))
 815			return -EFAULT;
 816	} else {
 817		if (copy_to_user(buffer, ff_up,
 818				 sizeof(struct uinput_ff_upload)))
 819			return -EFAULT;
 820	}
 821
 822	return 0;
 823}
 824
 825static int uinput_ff_upload_from_user(const char __user *buffer,
 826				      struct uinput_ff_upload *ff_up)
 827{
 828	if (in_compat_syscall()) {
 829		struct uinput_ff_upload_compat ff_up_compat;
 830
 831		if (copy_from_user(&ff_up_compat, buffer,
 832				   sizeof(struct uinput_ff_upload_compat)))
 833			return -EFAULT;
 834
 835		ff_up->request_id = ff_up_compat.request_id;
 836		ff_up->retval = ff_up_compat.retval;
 837		memcpy(&ff_up->effect, &ff_up_compat.effect,
 838			sizeof(struct ff_effect_compat));
 839		memcpy(&ff_up->old, &ff_up_compat.old,
 840			sizeof(struct ff_effect_compat));
 841
 842	} else {
 843		if (copy_from_user(ff_up, buffer,
 844				   sizeof(struct uinput_ff_upload)))
 845			return -EFAULT;
 846	}
 847
 848	return 0;
 849}
 850
 851#else
 852
 853static int uinput_ff_upload_to_user(char __user *buffer,
 854				    const struct uinput_ff_upload *ff_up)
 855{
 856	if (copy_to_user(buffer, ff_up, sizeof(struct uinput_ff_upload)))
 857		return -EFAULT;
 858
 859	return 0;
 860}
 861
 862static int uinput_ff_upload_from_user(const char __user *buffer,
 863				      struct uinput_ff_upload *ff_up)
 864{
 865	if (copy_from_user(ff_up, buffer, sizeof(struct uinput_ff_upload)))
 866		return -EFAULT;
 867
 868	return 0;
 869}
 870
 871#endif
 872
 873#define uinput_set_bit(_arg, _bit, _max)		\
 874({							\
 875	int __ret = 0;					\
 876	if (udev->state == UIST_CREATED)		\
 877		__ret =  -EINVAL;			\
 878	else if ((_arg) > (_max))			\
 879		__ret = -EINVAL;			\
 880	else set_bit((_arg), udev->dev->_bit);		\
 881	__ret;						\
 882})
 883
 884static int uinput_str_to_user(void __user *dest, const char *str,
 885			      unsigned int maxlen)
 886{
 887	char __user *p = dest;
 888	int len, ret;
 889
 890	if (!str)
 891		return -ENOENT;
 892
 893	if (maxlen == 0)
 894		return -EINVAL;
 895
 896	len = strlen(str) + 1;
 897	if (len > maxlen)
 898		len = maxlen;
 899
 900	ret = copy_to_user(p, str, len);
 901	if (ret)
 902		return -EFAULT;
 903
 904	/* force terminating '\0' */
 905	ret = put_user(0, p + len - 1);
 906	return ret ? -EFAULT : len;
 907}
 908
 909static long uinput_ioctl_handler(struct file *file, unsigned int cmd,
 910				 unsigned long arg, void __user *p)
 911{
 912	int			retval;
 913	struct uinput_device	*udev = file->private_data;
 914	struct uinput_ff_upload ff_up;
 915	struct uinput_ff_erase  ff_erase;
 916	struct uinput_request   *req;
 917	char			*phys;
 918	const char		*name;
 919	unsigned int		size;
 920
 921	retval = mutex_lock_interruptible(&udev->mutex);
 922	if (retval)
 923		return retval;
 924
 925	if (!udev->dev) {
 926		udev->dev = input_allocate_device();
 927		if (!udev->dev) {
 928			retval = -ENOMEM;
 929			goto out;
 930		}
 931	}
 932
 933	switch (cmd) {
 934	case UI_GET_VERSION:
 935		if (put_user(UINPUT_VERSION, (unsigned int __user *)p))
 936			retval = -EFAULT;
 937		goto out;
 938
 939	case UI_DEV_CREATE:
 940		retval = uinput_create_device(udev);
 941		goto out;
 942
 943	case UI_DEV_DESTROY:
 944		uinput_destroy_device(udev);
 945		goto out;
 946
 947	case UI_DEV_SETUP:
 948		retval = uinput_dev_setup(udev, p);
 949		goto out;
 950
 951	/* UI_ABS_SETUP is handled in the variable size ioctls */
 952
 953	case UI_SET_EVBIT:
 954		retval = uinput_set_bit(arg, evbit, EV_MAX);
 955		goto out;
 956
 957	case UI_SET_KEYBIT:
 958		retval = uinput_set_bit(arg, keybit, KEY_MAX);
 959		goto out;
 960
 961	case UI_SET_RELBIT:
 962		retval = uinput_set_bit(arg, relbit, REL_MAX);
 963		goto out;
 964
 965	case UI_SET_ABSBIT:
 966		retval = uinput_set_bit(arg, absbit, ABS_MAX);
 967		goto out;
 968
 969	case UI_SET_MSCBIT:
 970		retval = uinput_set_bit(arg, mscbit, MSC_MAX);
 971		goto out;
 972
 973	case UI_SET_LEDBIT:
 974		retval = uinput_set_bit(arg, ledbit, LED_MAX);
 975		goto out;
 976
 977	case UI_SET_SNDBIT:
 978		retval = uinput_set_bit(arg, sndbit, SND_MAX);
 979		goto out;
 980
 981	case UI_SET_FFBIT:
 982		retval = uinput_set_bit(arg, ffbit, FF_MAX);
 983		goto out;
 984
 985	case UI_SET_SWBIT:
 986		retval = uinput_set_bit(arg, swbit, SW_MAX);
 987		goto out;
 988
 989	case UI_SET_PROPBIT:
 990		retval = uinput_set_bit(arg, propbit, INPUT_PROP_MAX);
 991		goto out;
 992
 993	case UI_SET_PHYS:
 994		if (udev->state == UIST_CREATED) {
 995			retval = -EINVAL;
 996			goto out;
 997		}
 998
 999		phys = strndup_user(p, 1024);
1000		if (IS_ERR(phys)) {
1001			retval = PTR_ERR(phys);
1002			goto out;
1003		}
1004
1005		kfree(udev->dev->phys);
1006		udev->dev->phys = phys;
1007		goto out;
1008
1009	case UI_BEGIN_FF_UPLOAD:
1010		retval = uinput_ff_upload_from_user(p, &ff_up);
1011		if (retval)
1012			goto out;
1013
1014		req = uinput_request_find(udev, ff_up.request_id);
1015		if (!req || req->code != UI_FF_UPLOAD ||
1016		    !req->u.upload.effect) {
1017			retval = -EINVAL;
1018			goto out;
1019		}
1020
1021		ff_up.retval = 0;
1022		ff_up.effect = *req->u.upload.effect;
1023		if (req->u.upload.old)
1024			ff_up.old = *req->u.upload.old;
1025		else
1026			memset(&ff_up.old, 0, sizeof(struct ff_effect));
1027
1028		retval = uinput_ff_upload_to_user(p, &ff_up);
1029		goto out;
1030
1031	case UI_BEGIN_FF_ERASE:
1032		if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) {
1033			retval = -EFAULT;
1034			goto out;
1035		}
1036
1037		req = uinput_request_find(udev, ff_erase.request_id);
1038		if (!req || req->code != UI_FF_ERASE) {
1039			retval = -EINVAL;
1040			goto out;
1041		}
1042
1043		ff_erase.retval = 0;
1044		ff_erase.effect_id = req->u.effect_id;
1045		if (copy_to_user(p, &ff_erase, sizeof(ff_erase))) {
1046			retval = -EFAULT;
1047			goto out;
1048		}
1049
1050		goto out;
1051
1052	case UI_END_FF_UPLOAD:
1053		retval = uinput_ff_upload_from_user(p, &ff_up);
1054		if (retval)
1055			goto out;
1056
1057		req = uinput_request_find(udev, ff_up.request_id);
1058		if (!req || req->code != UI_FF_UPLOAD ||
1059		    !req->u.upload.effect) {
1060			retval = -EINVAL;
1061			goto out;
1062		}
1063
1064		req->retval = ff_up.retval;
1065		complete(&req->done);
1066		goto out;
1067
1068	case UI_END_FF_ERASE:
1069		if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) {
1070			retval = -EFAULT;
1071			goto out;
1072		}
1073
1074		req = uinput_request_find(udev, ff_erase.request_id);
1075		if (!req || req->code != UI_FF_ERASE) {
1076			retval = -EINVAL;
1077			goto out;
1078		}
1079
1080		req->retval = ff_erase.retval;
1081		complete(&req->done);
1082		goto out;
1083	}
1084
1085	size = _IOC_SIZE(cmd);
1086
1087	/* Now check variable-length commands */
1088	switch (cmd & ~IOCSIZE_MASK) {
1089	case UI_GET_SYSNAME(0):
1090		if (udev->state != UIST_CREATED) {
1091			retval = -ENOENT;
1092			goto out;
1093		}
1094		name = dev_name(&udev->dev->dev);
1095		retval = uinput_str_to_user(p, name, size);
1096		goto out;
1097
1098	case UI_ABS_SETUP & ~IOCSIZE_MASK:
1099		retval = uinput_abs_setup(udev, p, size);
1100		goto out;
1101	}
1102
1103	retval = -EINVAL;
1104 out:
1105	mutex_unlock(&udev->mutex);
1106	return retval;
1107}
1108
1109static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1110{
1111	return uinput_ioctl_handler(file, cmd, arg, (void __user *)arg);
1112}
1113
1114#ifdef CONFIG_COMPAT
1115
1116/*
1117 * These IOCTLs change their size and thus their numbers between
1118 * 32 and 64 bits.
1119 */
1120#define UI_SET_PHYS_COMPAT		\
1121	_IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t)
1122#define UI_BEGIN_FF_UPLOAD_COMPAT	\
1123	_IOWR(UINPUT_IOCTL_BASE, 200, struct uinput_ff_upload_compat)
1124#define UI_END_FF_UPLOAD_COMPAT		\
1125	_IOW(UINPUT_IOCTL_BASE, 201, struct uinput_ff_upload_compat)
1126
1127static long uinput_compat_ioctl(struct file *file,
1128				unsigned int cmd, unsigned long arg)
1129{
1130	switch (cmd) {
1131	case UI_SET_PHYS_COMPAT:
1132		cmd = UI_SET_PHYS;
1133		break;
1134	case UI_BEGIN_FF_UPLOAD_COMPAT:
1135		cmd = UI_BEGIN_FF_UPLOAD;
1136		break;
1137	case UI_END_FF_UPLOAD_COMPAT:
1138		cmd = UI_END_FF_UPLOAD;
1139		break;
1140	}
1141
1142	return uinput_ioctl_handler(file, cmd, arg, compat_ptr(arg));
1143}
1144#endif
1145
1146static const struct file_operations uinput_fops = {
1147	.owner		= THIS_MODULE,
1148	.open		= uinput_open,
1149	.release	= uinput_release,
1150	.read		= uinput_read,
1151	.write		= uinput_write,
1152	.poll		= uinput_poll,
1153	.unlocked_ioctl	= uinput_ioctl,
1154#ifdef CONFIG_COMPAT
1155	.compat_ioctl	= uinput_compat_ioctl,
1156#endif
1157};
1158
1159static struct miscdevice uinput_misc = {
1160	.fops		= &uinput_fops,
1161	.minor		= UINPUT_MINOR,
1162	.name		= UINPUT_NAME,
1163};
1164module_misc_device(uinput_misc);
1165
1166MODULE_ALIAS_MISCDEV(UINPUT_MINOR);
1167MODULE_ALIAS("devname:" UINPUT_NAME);
1168
1169MODULE_AUTHOR("Aristeu Sergio Rozanski Filho");
1170MODULE_DESCRIPTION("User level driver support for input subsystem");
1171MODULE_LICENSE("GPL");