drivers/input/evdev.c

   1 /*
   2  * Event char devices, giving access to raw input device events.
   3  *
   4  * Copyright (c) 1999-2002 Vojtech Pavlik
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License version 2 as published by
   8  * the Free Software Foundation.
   9  */
  10
  11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  12
  13 #define EVDEV_MINOR_BASE        64
  14 #define EVDEV_MINORS            32
  15 #define EVDEV_MIN_BUFFER_SIZE   64U
  16 #define EVDEV_BUF_PACKETS       8
  17
  18 #include <linux/poll.h>
  19 #include <linux/sched.h>
  20 #include <linux/slab.h>
  21 #include <linux/vmalloc.h>
  22 #include <linux/mm.h>
  23 #include <linux/module.h>
  24 #include <linux/init.h>
  25 #include <linux/input/mt.h>
  26 #include <linux/major.h>
  27 #include <linux/device.h>
  28 #include <linux/cdev.h>
  29 #include "input-compat.h"
  30
  31 struct evdev {
  32         int open;
  33         struct input_handle handle;
  34         wait_queue_head_t wait;
  35         struct evdev_client __rcu *grab;
  36         struct list_head client_list;
  37         spinlock_t client_lock; /* protects client_list */
  38         struct mutex mutex;
  39         struct device dev;
  40         struct cdev cdev;
  41         bool exist;
  42 };
  43
  44 struct evdev_client {
  45         unsigned int head;
  46         unsigned int tail;
  47         unsigned int packet_head; /* [future] position of the first element of next packet */
  48         spinlock_t buffer_lock; /* protects access to buffer, head and tail */
  49         struct fasync_struct *fasync;
  50         struct evdev *evdev;
  51         struct list_head node;
  52         int clkid;
  53         unsigned int bufsize;
  54         struct input_event buffer[];
  55 };
  56
  57 static void __pass_event(struct evdev_client *client,
  58                          const struct input_event *event)
  59 {
  60         client->buffer[client->head++] = *event;
  61         client->head &= client->bufsize - 1;
  62
  63         if (unlikely(client->head == client->tail)) {
  64                 /*
  65                  * This effectively "drops" all unconsumed events, leaving
  66                  * EV_SYN/SYN_DROPPED plus the newest event in the queue.
  67                  */
  68                 client->tail = (client->head - 2) & (client->bufsize - 1);
  69
  70                 client->buffer[client->tail].time = event->time;
  71                 client->buffer[client->tail].type = EV_SYN;
  72                 client->buffer[client->tail].code = SYN_DROPPED;
  73                 client->buffer[client->tail].value = 0;
  74
  75                 client->packet_head = client->tail;
  76         }
  77
  78         if (event->type == EV_SYN && event->code == SYN_REPORT) {
  79                 client->packet_head = client->head;
  80                 kill_fasync(&client->fasync, SIGIO, POLL_IN);
  81         }
  82 }
  83
  84 static void evdev_pass_values(struct evdev_client *client,
  85                         const struct input_value *vals, unsigned int count,
  86                         ktime_t mono, ktime_t real)
  87 {
  88         struct evdev *evdev = client->evdev;
  89         const struct input_value *v;
  90         struct input_event event;
  91         bool wakeup = false;
  92
  93         event.time = ktime_to_timeval(client->clkid == CLOCK_MONOTONIC ?
  94                                       mono : real);
  95
  96         /* Interrupts are disabled, just acquire the lock. */
  97         spin_lock(&client->buffer_lock);
  98
  99         for (v = vals; v != vals + count; v++) {
 100                 event.type = v->type;
 101                 event.code = v->code;
 102                 event.value = v->value;
 103                 __pass_event(client, &event);
 104                 if (v->type == EV_SYN && v->code == SYN_REPORT)
 105                         wakeup = true;
 106         }
 107
 108         spin_unlock(&client->buffer_lock);
 109
 110         if (wakeup)
 111                 wake_up_interruptible(&evdev->wait);
 112 }
 113
 114 /*
 115  * Pass incoming events to all connected clients.
 116  */
 117 static void evdev_events(struct input_handle *handle,
 118                          const struct input_value *vals, unsigned int count)
 119 {
 120         struct evdev *evdev = handle->private;
 121         struct evdev_client *client;
 122         ktime_t time_mono, time_real;
 123
 124         time_mono = ktime_get();
 125         time_real = ktime_sub(time_mono, ktime_get_monotonic_offset());
 126
 127         rcu_read_lock();
 128
 129         client = rcu_dereference(evdev->grab);
 130
 131         if (client)
 132                 evdev_pass_values(client, vals, count, time_mono, time_real);
 133         else
 134                 list_for_each_entry_rcu(client, &evdev->client_list, node)
 135                         evdev_pass_values(client, vals, count,
 136                                           time_mono, time_real);
 137
 138         rcu_read_unlock();
 139 }
 140
 141 /*
 142  * Pass incoming event to all connected clients.
 143  */
 144 static void evdev_event(struct input_handle *handle,
 145                         unsigned int type, unsigned int code, int value)
 146 {
 147         struct input_value vals[] = { { type, code, value } };
 148
 149         evdev_events(handle, vals, 1);
 150 }
 151
 152 static int evdev_fasync(int fd, struct file *file, int on)
 153 {
 154         struct evdev_client *client = file->private_data;
 155
 156         return fasync_helper(fd, file, on, &client->fasync);
 157 }
 158
 159 static int evdev_flush(struct file *file, fl_owner_t id)
 160 {
 161         struct evdev_client *client = file->private_data;
 162         struct evdev *evdev = client->evdev;
 163         int retval;
 164
 165         retval = mutex_lock_interruptible(&evdev->mutex);
 166         if (retval)
 167                 return retval;
 168
 169         if (!evdev->exist)
 170                 retval = -ENODEV;
 171         else
 172                 retval = input_flush_device(&evdev->handle, file);
 173
 174         mutex_unlock(&evdev->mutex);
 175         return retval;
 176 }
 177
 178 static void evdev_free(struct device *dev)
 179 {
 180         struct evdev *evdev = container_of(dev, struct evdev, dev);
 181
 182         input_put_device(evdev->handle.dev);
 183         kfree(evdev);
 184 }
 185
 186 /*
 187  * Grabs an event device (along with underlying input device).
 188  * This function is called with evdev->mutex taken.
 189  */
 190 static int evdev_grab(struct evdev *evdev, struct evdev_client *client)
 191 {
 192         int error;
 193
 194         if (evdev->grab)
 195                 return -EBUSY;
 196
 197         error = input_grab_device(&evdev->handle);
 198         if (error)
 199                 return error;
 200
 201         rcu_assign_pointer(evdev->grab, client);
 202
 203         return 0;
 204 }
 205
 206 static int evdev_ungrab(struct evdev *evdev, struct evdev_client *client)
 207 {
 208         struct evdev_client *grab = rcu_dereference_protected(evdev->grab,
 209                                         lockdep_is_held(&evdev->mutex));
 210
 211         if (grab != client)
 212                 return  -EINVAL;
 213
 214         rcu_assign_pointer(evdev->grab, NULL);
 215         synchronize_rcu();
 216         input_release_device(&evdev->handle);
 217
 218         return 0;
 219 }
 220
 221 static void evdev_attach_client(struct evdev *evdev,
 222                                 struct evdev_client *client)
 223 {
 224         spin_lock(&evdev->client_lock);
 225         list_add_tail_rcu(&client->node, &evdev->client_list);
 226         spin_unlock(&evdev->client_lock);
 227 }
 228
 229 static void evdev_detach_client(struct evdev *evdev,
 230                                 struct evdev_client *client)
 231 {
 232         spin_lock(&evdev->client_lock);
 233         list_del_rcu(&client->node);
 234         spin_unlock(&evdev->client_lock);
 235         synchronize_rcu();
 236 }
 237
 238 static int evdev_open_device(struct evdev *evdev)
 239 {
 240         int retval;
 241
 242         retval = mutex_lock_interruptible(&evdev->mutex);
 243         if (retval)
 244                 return retval;
 245
 246         if (!evdev->exist)
 247                 retval = -ENODEV;
 248         else if (!evdev->open++) {
 249                 retval = input_open_device(&evdev->handle);
 250                 if (retval)
 251                         evdev->open--;
 252         }
 253
 254         mutex_unlock(&evdev->mutex);
 255         return retval;
 256 }
 257
 258 static void evdev_close_device(struct evdev *evdev)
 259 {
 260         mutex_lock(&evdev->mutex);
 261
 262         if (evdev->exist && !--evdev->open)
 263                 input_close_device(&evdev->handle);
 264
 265         mutex_unlock(&evdev->mutex);
 266 }
 267
 268 /*
 269  * Wake up users waiting for IO so they can disconnect from
 270  * dead device.
 271  */
 272 static void evdev_hangup(struct evdev *evdev)
 273 {
 274         struct evdev_client *client;
 275
 276         spin_lock(&evdev->client_lock);
 277         list_for_each_entry(client, &evdev->client_list, node)
 278                 kill_fasync(&client->fasync, SIGIO, POLL_HUP);
 279         spin_unlock(&evdev->client_lock);
 280
 281         wake_up_interruptible(&evdev->wait);
 282 }
 283
 284 static int evdev_release(struct inode *inode, struct file *file)
 285 {
 286         struct evdev_client *client = file->private_data;
 287         struct evdev *evdev = client->evdev;
 288
 289         mutex_lock(&evdev->mutex);
 290         evdev_ungrab(evdev, client);
 291         mutex_unlock(&evdev->mutex);
 292
 293         evdev_detach_client(evdev, client);
 294
 295         if (is_vmalloc_addr(client))
 296                 vfree(client);
 297         else
 298                 kfree(client);
 299
 300         evdev_close_device(evdev);
 301
 302         return 0;
 303 }
 304
 305 static unsigned int evdev_compute_buffer_size(struct input_dev *dev)
 306 {
 307         unsigned int n_events =
 308                 max(dev->hint_events_per_packet * EVDEV_BUF_PACKETS,
 309                     EVDEV_MIN_BUFFER_SIZE);
 310
 311         return roundup_pow_of_two(n_events);
 312 }
 313
 314 static int evdev_open(struct inode *inode, struct file *file)
 315 {
 316         struct evdev *evdev = container_of(inode->i_cdev, struct evdev, cdev);
 317         unsigned int bufsize = evdev_compute_buffer_size(evdev->handle.dev);
 318         unsigned int size = sizeof(struct evdev_client) +
 319                                         bufsize * sizeof(struct input_event);
 320         struct evdev_client *client;
 321         int error;
 322
 323         client = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
 324         if (!client)
 325                 client = vzalloc(size);
 326         if (!client)
 327                 return -ENOMEM;
 328
 329         client->bufsize = bufsize;
 330         spin_lock_init(&client->buffer_lock);
 331         client->evdev = evdev;
 332         evdev_attach_client(evdev, client);
 333
 334         error = evdev_open_device(evdev);
 335         if (error)
 336                 goto err_free_client;
 337
 338         file->private_data = client;
 339         nonseekable_open(inode, file);
 340
 341         return 0;
 342
 343  err_free_client:
 344         evdev_detach_client(evdev, client);
 345         kfree(client);
 346         return error;
 347 }
 348
 349 static ssize_t evdev_write(struct file *file, const char __user *buffer,
 350                            size_t count, loff_t *ppos)
 351 {
 352         struct evdev_client *client = file->private_data;
 353         struct evdev *evdev = client->evdev;
 354         struct input_event event;
 355         int retval = 0;
 356
 357         if (count != 0 && count < input_event_size())
 358                 return -EINVAL;
 359
 360         retval = mutex_lock_interruptible(&evdev->mutex);
 361         if (retval)
 362                 return retval;
 363
 364         if (!evdev->exist) {
 365                 retval = -ENODEV;
 366                 goto out;
 367         }
 368
 369         while (retval + input_event_size() <= count) {
 370
 371                 if (input_event_from_user(buffer + retval, &event)) {
 372                         retval = -EFAULT;
 373                         goto out;
 374                 }
 375                 retval += input_event_size();
 376
 377                 input_inject_event(&evdev->handle,
 378                                    event.type, event.code, event.value);
 379         }
 380
 381  out:
 382         mutex_unlock(&evdev->mutex);
 383         return retval;
 384 }
 385
 386 static int evdev_fetch_next_event(struct evdev_client *client,
 387                                   struct input_event *event)
 388 {
 389         int have_event;
 390
 391         spin_lock_irq(&client->buffer_lock);
 392
 393         have_event = client->packet_head != client->tail;
 394         if (have_event) {
 395                 *event = client->buffer[client->tail++];
 396                 client->tail &= client->bufsize - 1;
 397         }
 398
 399         spin_unlock_irq(&client->buffer_lock);
 400
 401         return have_event;
 402 }
 403
 404 static ssize_t evdev_read(struct file *file, char __user *buffer,
 405                           size_t count, loff_t *ppos)
 406 {
 407         struct evdev_client *client = file->private_data;
 408         struct evdev *evdev = client->evdev;
 409         struct input_event event;
 410         size_t read = 0;
 411         int error;
 412
 413         if (count != 0 && count < input_event_size())
 414                 return -EINVAL;
 415
 416         for (;;) {
 417                 if (!evdev->exist)
 418                         return -ENODEV;
 419
 420                 if (client->packet_head == client->tail &&
 421                     (file->f_flags & O_NONBLOCK))
 422                         return -EAGAIN;
 423
 424                 /*
 425                  * count == 0 is special - no IO is done but we check
 426                  * for error conditions (see above).
 427                  */
 428                 if (count == 0)
 429                         break;
 430
 431                 while (read + input_event_size() <= count &&
 432                        evdev_fetch_next_event(client, &event)) {
 433
 434                         if (input_event_to_user(buffer + read, &event))
 435                                 return -EFAULT;
 436
 437                         read += input_event_size();
 438                 }
 439
 440                 if (read)
 441                         break;
 442
 443                 if (!(file->f_flags & O_NONBLOCK)) {
 444                         error = wait_event_interruptible(evdev->wait,
 445                                         client->packet_head != client->tail ||
 446                                         !evdev->exist);
 447                         if (error)
 448                                 return error;
 449                 }
 450         }
 451
 452         return read;
 453 }
 454
 455 /* No kernel lock - fine */
 456 static unsigned int evdev_poll(struct file *file, poll_table *wait)
 457 {
 458         struct evdev_client *client = file->private_data;
 459         struct evdev *evdev = client->evdev;
 460         unsigned int mask;
 461
 462         poll_wait(file, &evdev->wait, wait);
 463
 464         mask = evdev->exist ? POLLOUT | POLLWRNORM : POLLHUP | POLLERR;
 465         if (client->packet_head != client->tail)
 466                 mask |= POLLIN | POLLRDNORM;
 467
 468         return mask;
 469 }
 470
 471 #ifdef CONFIG_COMPAT
 472
 473 #define BITS_PER_LONG_COMPAT (sizeof(compat_long_t) * 8)
 474 #define BITS_TO_LONGS_COMPAT(x) ((((x) - 1) / BITS_PER_LONG_COMPAT) + 1)
 475
 476 #ifdef __BIG_ENDIAN
 477 static int bits_to_user(unsigned long *bits, unsigned int maxbit,
 478                         unsigned int maxlen, void __user *p, int compat)
 479 {
 480         int len, i;
 481
 482         if (compat) {
 483                 len = BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t);
 484                 if (len > maxlen)
 485                         len = maxlen;
 486
 487                 for (i = 0; i < len / sizeof(compat_long_t); i++)
 488                         if (copy_to_user((compat_long_t __user *) p + i,
 489                                          (compat_long_t *) bits +
 490                                                 i + 1 - ((i % 2) << 1),
 491                                          sizeof(compat_long_t)))
 492                                 return -EFAULT;
 493         } else {
 494                 len = BITS_TO_LONGS(maxbit) * sizeof(long);
 495                 if (len > maxlen)
 496                         len = maxlen;
 497
 498                 if (copy_to_user(p, bits, len))
 499                         return -EFAULT;
 500         }
 501
 502         return len;
 503 }
 504 #else
 505 static int bits_to_user(unsigned long *bits, unsigned int maxbit,
 506                         unsigned int maxlen, void __user *p, int compat)
 507 {
 508         int len = compat ?
 509                         BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t) :
 510                         BITS_TO_LONGS(maxbit) * sizeof(long);
 511
 512         if (len > maxlen)
 513                 len = maxlen;
 514
 515         return copy_to_user(p, bits, len) ? -EFAULT : len;
 516 }
 517 #endif /* __BIG_ENDIAN */
 518
 519 #else
 520
 521 static int bits_to_user(unsigned long *bits, unsigned int maxbit,
 522                         unsigned int maxlen, void __user *p, int compat)
 523 {
 524         int len = BITS_TO_LONGS(maxbit) * sizeof(long);
 525
 526         if (len > maxlen)
 527                 len = maxlen;
 528
 529         return copy_to_user(p, bits, len) ? -EFAULT : len;
 530 }
 531
 532 #endif /* CONFIG_COMPAT */
 533
 534 static int str_to_user(const char *str, unsigned int maxlen, void __user *p)
 535 {
 536         int len;
 537
 538         if (!str)
 539                 return -ENOENT;
 540
 541         len = strlen(str) + 1;
 542         if (len > maxlen)
 543                 len = maxlen;
 544
 545         return copy_to_user(p, str, len) ? -EFAULT : len;
 546 }
 547
 548 #define OLD_KEY_MAX     0x1ff
 549 static int handle_eviocgbit(struct input_dev *dev,
 550                             unsigned int type, unsigned int size,
 551                             void __user *p, int compat_mode)
 552 {
 553         static unsigned long keymax_warn_time;
 554         unsigned long *bits;
 555         int len;
 556
 557         switch (type) {
 558
 559         case      0: bits = dev->evbit;  len = EV_MAX;  break;
 560         case EV_KEY: bits = dev->keybit; len = KEY_MAX; break;
 561         case EV_REL: bits = dev->relbit; len = REL_MAX; break;
 562         case EV_ABS: bits = dev->absbit; len = ABS_MAX; break;
 563         case EV_MSC: bits = dev->mscbit; len = MSC_MAX; break;
 564         case EV_LED: bits = dev->ledbit; len = LED_MAX; break;
 565         case EV_SND: bits = dev->sndbit; len = SND_MAX; break;
 566         case EV_FF:  bits = dev->ffbit;  len = FF_MAX;  break;
 567         case EV_SW:  bits = dev->swbit;  len = SW_MAX;  break;
 568         default: return -EINVAL;
 569         }
 570
 571         /*
 572          * Work around bugs in userspace programs that like to do
 573          * EVIOCGBIT(EV_KEY, KEY_MAX) and not realize that 'len'
 574          * should be in bytes, not in bits.
 575          */
 576         if (type == EV_KEY && size == OLD_KEY_MAX) {
 577                 len = OLD_KEY_MAX;
 578                 if (printk_timed_ratelimit(&keymax_warn_time, 10 * 1000))
 579                         pr_warning("(EVIOCGBIT): Suspicious buffer size %u, "
 580                                    "limiting output to %zu bytes. See "
 581                                    "http://userweb.kernel.org/~dtor/eviocgbit-bug.html\n",
 582                                    OLD_KEY_MAX,
 583                                    BITS_TO_LONGS(OLD_KEY_MAX) * sizeof(long));
 584         }
 585
 586         return bits_to_user(bits, len, size, p, compat_mode);
 587 }
 588 #undef OLD_KEY_MAX
 589
 590 static int evdev_handle_get_keycode(struct input_dev *dev, void __user *p)
 591 {
 592         struct input_keymap_entry ke = {
 593                 .len    = sizeof(unsigned int),
 594                 .flags  = 0,
 595         };
 596         int __user *ip = (int __user *)p;
 597         int error;
 598
 599         /* legacy case */
 600         if (copy_from_user(ke.scancode, p, sizeof(unsigned int)))
 601                 return -EFAULT;
 602
 603         error = input_get_keycode(dev, &ke);
 604         if (error)
 605                 return error;
 606
 607         if (put_user(ke.keycode, ip + 1))
 608                 return -EFAULT;
 609
 610         return 0;
 611 }
 612
 613 static int evdev_handle_get_keycode_v2(struct input_dev *dev, void __user *p)
 614 {
 615         struct input_keymap_entry ke;
 616         int error;
 617
 618         if (copy_from_user(&ke, p, sizeof(ke)))
 619                 return -EFAULT;
 620
 621         error = input_get_keycode(dev, &ke);
 622         if (error)
 623                 return error;
 624
 625         if (copy_to_user(p, &ke, sizeof(ke)))
 626                 return -EFAULT;
 627
 628         return 0;
 629 }
 630
 631 static int evdev_handle_set_keycode(struct input_dev *dev, void __user *p)
 632 {
 633         struct input_keymap_entry ke = {
 634                 .len    = sizeof(unsigned int),
 635                 .flags  = 0,
 636         };
 637         int __user *ip = (int __user *)p;
 638
 639         if (copy_from_user(ke.scancode, p, sizeof(unsigned int)))
 640                 return -EFAULT;
 641
 642         if (get_user(ke.keycode, ip + 1))
 643                 return -EFAULT;
 644
 645         return input_set_keycode(dev, &ke);
 646 }
 647
 648 static int evdev_handle_set_keycode_v2(struct input_dev *dev, void __user *p)
 649 {
 650         struct input_keymap_entry ke;
 651
 652         if (copy_from_user(&ke, p, sizeof(ke)))
 653                 return -EFAULT;
 654
 655         if (ke.len > sizeof(ke.scancode))
 656                 return -EINVAL;
 657
 658         return input_set_keycode(dev, &ke);
 659 }
 660
 661 static int evdev_handle_mt_request(struct input_dev *dev,
 662                                    unsigned int size,
 663                                    int __user *ip)
 664 {
 665         const struct input_mt *mt = dev->mt;
 666         unsigned int code;
 667         int max_slots;
 668         int i;
 669
 670         if (get_user(code, &ip[0]))
 671                 return -EFAULT;
 672         if (!mt || !input_is_mt_value(code))
 673                 return -EINVAL;
 674
 675         max_slots = (size - sizeof(__u32)) / sizeof(__s32);
 676         for (i = 0; i < mt->num_slots && i < max_slots; i++) {
 677                 int value = input_mt_get_value(&mt->slots[i], code);
 678                 if (put_user(value, &ip[1 + i]))
 679                         return -EFAULT;
 680         }
 681
 682         return 0;
 683 }
 684
 685 static long evdev_do_ioctl(struct file *file, unsigned int cmd,
 686                            void __user *p, int compat_mode)
 687 {
 688         struct evdev_client *client = file->private_data;
 689         struct evdev *evdev = client->evdev;
 690         struct input_dev *dev = evdev->handle.dev;
 691         struct input_absinfo abs;
 692         struct ff_effect effect;
 693         int __user *ip = (int __user *)p;
 694         unsigned int i, t, u, v;
 695         unsigned int size;
 696         int error;
 697
 698         /* First we check for fixed-length commands */
 699         switch (cmd) {
 700
 701         case EVIOCGVERSION:
 702                 return put_user(EV_VERSION, ip);
 703
 704         case EVIOCGID:
 705                 if (copy_to_user(p, &dev->id, sizeof(struct input_id)))
 706                         return -EFAULT;
 707                 return 0;
 708
 709         case EVIOCGREP:
 710                 if (!test_bit(EV_REP, dev->evbit))
 711                         return -ENOSYS;
 712                 if (put_user(dev->rep[REP_DELAY], ip))
 713                         return -EFAULT;
 714                 if (put_user(dev->rep[REP_PERIOD], ip + 1))
 715                         return -EFAULT;
 716                 return 0;
 717
 718         case EVIOCSREP:
 719                 if (!test_bit(EV_REP, dev->evbit))
 720                         return -ENOSYS;
 721                 if (get_user(u, ip))
 722                         return -EFAULT;
 723                 if (get_user(v, ip + 1))
 724                         return -EFAULT;
 725
 726                 input_inject_event(&evdev->handle, EV_REP, REP_DELAY, u);
 727                 input_inject_event(&evdev->handle, EV_REP, REP_PERIOD, v);
 728
 729                 return 0;
 730
 731         case EVIOCRMFF:
 732                 return input_ff_erase(dev, (int)(unsigned long) p, file);
 733
 734         case EVIOCGEFFECTS:
 735                 i = test_bit(EV_FF, dev->evbit) ?
 736                                 dev->ff->max_effects : 0;
 737                 if (put_user(i, ip))
 738                         return -EFAULT;
 739                 return 0;
 740
 741         case EVIOCGRAB:
 742                 if (p)
 743                         return evdev_grab(evdev, client);
 744                 else
 745                         return evdev_ungrab(evdev, client);
 746
 747         case EVIOCSCLOCKID:
 748                 if (copy_from_user(&i, p, sizeof(unsigned int)))
 749                         return -EFAULT;
 750                 if (i != CLOCK_MONOTONIC && i != CLOCK_REALTIME)
 751                         return -EINVAL;
 752                 client->clkid = i;
 753                 return 0;
 754
 755         case EVIOCGKEYCODE:
 756                 return evdev_handle_get_keycode(dev, p);
 757
 758         case EVIOCSKEYCODE:
 759                 return evdev_handle_set_keycode(dev, p);
 760
 761         case EVIOCGKEYCODE_V2:
 762                 return evdev_handle_get_keycode_v2(dev, p);
 763
 764         case EVIOCSKEYCODE_V2:
 765                 return evdev_handle_set_keycode_v2(dev, p);
 766         }
 767
 768         size = _IOC_SIZE(cmd);
 769
 770         /* Now check variable-length commands */
 771 #define EVIOC_MASK_SIZE(nr)     ((nr) & ~(_IOC_SIZEMASK << _IOC_SIZESHIFT))
 772         switch (EVIOC_MASK_SIZE(cmd)) {
 773
 774         case EVIOCGPROP(0):
 775                 return bits_to_user(dev->propbit, INPUT_PROP_MAX,
 776                                     size, p, compat_mode);
 777
 778         case EVIOCGMTSLOTS(0):
 779                 return evdev_handle_mt_request(dev, size, ip);
 780
 781         case EVIOCGKEY(0):
 782                 return bits_to_user(dev->key, KEY_MAX, size, p, compat_mode);
 783
 784         case EVIOCGLED(0):
 785                 return bits_to_user(dev->led, LED_MAX, size, p, compat_mode);
 786
 787         case EVIOCGSND(0):
 788                 return bits_to_user(dev->snd, SND_MAX, size, p, compat_mode);
 789
 790         case EVIOCGSW(0):
 791                 return bits_to_user(dev->sw, SW_MAX, size, p, compat_mode);
 792
 793         case EVIOCGNAME(0):
 794                 return str_to_user(dev->name, size, p);
 795
 796         case EVIOCGPHYS(0):
 797                 return str_to_user(dev->phys, size, p);
 798
 799         case EVIOCGUNIQ(0):
 800                 return str_to_user(dev->uniq, size, p);
 801
 802         case EVIOC_MASK_SIZE(EVIOCSFF):
 803                 if (input_ff_effect_from_user(p, size, &effect))
 804                         return -EFAULT;
 805
 806                 error = input_ff_upload(dev, &effect, file);
 807
 808                 if (put_user(effect.id, &(((struct ff_effect __user *)p)->id)))
 809                         return -EFAULT;
 810
 811                 return error;
 812         }
 813
 814         /* Multi-number variable-length handlers */
 815         if (_IOC_TYPE(cmd) != 'E')
 816                 return -EINVAL;
 817
 818         if (_IOC_DIR(cmd) == _IOC_READ) {
 819
 820                 if ((_IOC_NR(cmd) & ~EV_MAX) == _IOC_NR(EVIOCGBIT(0, 0)))
 821                         return handle_eviocgbit(dev,
 822                                                 _IOC_NR(cmd) & EV_MAX, size,
 823                                                 p, compat_mode);
 824
 825                 if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) {
 826
 827                         if (!dev->absinfo)
 828                                 return -EINVAL;
 829
 830                         t = _IOC_NR(cmd) & ABS_MAX;
 831                         abs = dev->absinfo[t];
 832
 833                         if (copy_to_user(p, &abs, min_t(size_t,
 834                                         size, sizeof(struct input_absinfo))))
 835                                 return -EFAULT;
 836
 837                         return 0;
 838                 }
 839         }
 840
 841         if (_IOC_DIR(cmd) == _IOC_WRITE) {
 842
 843                 if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) {
 844
 845                         if (!dev->absinfo)
 846                                 return -EINVAL;
 847
 848                         t = _IOC_NR(cmd) & ABS_MAX;
 849
 850                         if (copy_from_user(&abs, p, min_t(size_t,
 851                                         size, sizeof(struct input_absinfo))))
 852                                 return -EFAULT;
 853
 854                         if (size < sizeof(struct input_absinfo))
 855                                 abs.resolution = 0;
 856
 857                         /* We can't change number of reserved MT slots */
 858                         if (t == ABS_MT_SLOT)
 859                                 return -EINVAL;
 860
 861                         /*
 862                          * Take event lock to ensure that we are not
 863                          * changing device parameters in the middle
 864                          * of event.
 865                          */
 866                         spin_lock_irq(&dev->event_lock);
 867                         dev->absinfo[t] = abs;
 868                         spin_unlock_irq(&dev->event_lock);
 869
 870                         return 0;
 871                 }
 872         }
 873
 874         return -EINVAL;
 875 }
 876
 877 static long evdev_ioctl_handler(struct file *file, unsigned int cmd,
 878                                 void __user *p, int compat_mode)
 879 {
 880         struct evdev_client *client = file->private_data;
 881         struct evdev *evdev = client->evdev;
 882         int retval;
 883
 884         retval = mutex_lock_interruptible(&evdev->mutex);
 885         if (retval)
 886                 return retval;
 887
 888         if (!evdev->exist) {
 889                 retval = -ENODEV;
 890                 goto out;
 891         }
 892
 893         retval = evdev_do_ioctl(file, cmd, p, compat_mode);
 894
 895  out:
 896         mutex_unlock(&evdev->mutex);
 897         return retval;
 898 }
 899
 900 static long evdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 901 {
 902         return evdev_ioctl_handler(file, cmd, (void __user *)arg, 0);
 903 }
 904
 905 #ifdef CONFIG_COMPAT
 906 static long evdev_ioctl_compat(struct file *file,
 907                                 unsigned int cmd, unsigned long arg)
 908 {
 909         return evdev_ioctl_handler(file, cmd, compat_ptr(arg), 1);
 910 }
 911 #endif
 912
 913 static const struct file_operations evdev_fops = {
 914         .owner          = THIS_MODULE,
 915         .read           = evdev_read,
 916         .write          = evdev_write,
 917         .poll           = evdev_poll,
 918         .open           = evdev_open,
 919         .release        = evdev_release,
 920         .unlocked_ioctl = evdev_ioctl,
 921 #ifdef CONFIG_COMPAT
 922         .compat_ioctl   = evdev_ioctl_compat,
 923 #endif
 924         .fasync         = evdev_fasync,
 925         .flush          = evdev_flush,
 926         .llseek         = no_llseek,
 927 };
 928
 929 /*
 930  * Mark device non-existent. This disables writes, ioctls and
 931  * prevents new users from opening the device. Already posted
 932  * blocking reads will stay, however new ones will fail.
 933  */
 934 static void evdev_mark_dead(struct evdev *evdev)
 935 {
 936         mutex_lock(&evdev->mutex);
 937         evdev->exist = false;
 938         mutex_unlock(&evdev->mutex);
 939 }
 940
 941 static void evdev_cleanup(struct evdev *evdev)
 942 {
 943         struct input_handle *handle = &evdev->handle;
 944
 945         evdev_mark_dead(evdev);
 946         evdev_hangup(evdev);
 947
 948         cdev_del(&evdev->cdev);
 949
 950         /* evdev is marked dead so no one else accesses evdev->open */
 951         if (evdev->open) {
 952                 input_flush_device(handle, NULL);
 953                 input_close_device(handle);
 954         }
 955 }
 956
 957 /*
 958  * Create new evdev device. Note that input core serializes calls
 959  * to connect and disconnect.
 960  */
 961 static int evdev_connect(struct input_handler *handler, struct input_dev *dev,
 962                          const struct input_device_id *id)
 963 {
 964         struct evdev *evdev;
 965         int minor;
 966         int dev_no;
 967         int error;
 968
 969         minor = input_get_new_minor(EVDEV_MINOR_BASE, EVDEV_MINORS, true);
 970         if (minor < 0) {
 971                 error = minor;
 972                 pr_err("failed to reserve new minor: %d\n", error);
 973                 return error;
 974         }
 975
 976         evdev = kzalloc(sizeof(struct evdev), GFP_KERNEL);
 977         if (!evdev) {
 978                 error = -ENOMEM;
 979                 goto err_free_minor;
 980         }
 981
 982         INIT_LIST_HEAD(&evdev->client_list);
 983         spin_lock_init(&evdev->client_lock);
 984         mutex_init(&evdev->mutex);
 985         init_waitqueue_head(&evdev->wait);
 986         evdev->exist = true;
 987
 988         dev_no = minor;
 989         /* Normalize device number if it falls into legacy range */
 990         if (dev_no < EVDEV_MINOR_BASE + EVDEV_MINORS)
 991                 dev_no -= EVDEV_MINOR_BASE;
 992         dev_set_name(&evdev->dev, "event%d", dev_no);
 993
 994         evdev->handle.dev = input_get_device(dev);
 995         evdev->handle.name = dev_name(&evdev->dev);
 996         evdev->handle.handler = handler;
 997         evdev->handle.private = evdev;
 998
 999         evdev->dev.devt = MKDEV(INPUT_MAJOR, minor);
1000         evdev->dev.class = &input_class;
1001         evdev->dev.parent = &dev->dev;
1002         evdev->dev.release = evdev_free;
1003         device_initialize(&evdev->dev);
1004
1005         error = input_register_handle(&evdev->handle);
1006         if (error)
1007                 goto err_free_evdev;
1008
1009         cdev_init(&evdev->cdev, &evdev_fops);
1010         evdev->cdev.kobj.parent = &evdev->dev.kobj;
1011         error = cdev_add(&evdev->cdev, evdev->dev.devt, 1);
1012         if (error)
1013                 goto err_unregister_handle;
1014
1015         error = device_add(&evdev->dev);
1016         if (error)
1017                 goto err_cleanup_evdev;
1018
1019         return 0;
1020
1021  err_cleanup_evdev:
1022         evdev_cleanup(evdev);
1023  err_unregister_handle:
1024         input_unregister_handle(&evdev->handle);
1025  err_free_evdev:
1026         put_device(&evdev->dev);
1027  err_free_minor:
1028         input_free_minor(minor);
1029         return error;
1030 }
1031
1032 static void evdev_disconnect(struct input_handle *handle)
1033 {
1034         struct evdev *evdev = handle->private;
1035
1036         device_del(&evdev->dev);
1037         evdev_cleanup(evdev);
1038         input_free_minor(MINOR(evdev->dev.devt));
1039         input_unregister_handle(handle);
1040         put_device(&evdev->dev);
1041 }
1042
1043 static const struct input_device_id evdev_ids[] = {
1044         { .driver_info = 1 },   /* Matches all devices */
1045         { },                    /* Terminating zero entry */
1046 };
1047
1048 MODULE_DEVICE_TABLE(input, evdev_ids);
1049
1050 static struct input_handler evdev_handler = {
1051         .event          = evdev_event,
1052         .events         = evdev_events,
1053         .connect        = evdev_connect,
1054         .disconnect     = evdev_disconnect,
1055         .legacy_minors  = true,
1056         .minor          = EVDEV_MINOR_BASE,
1057         .name           = "evdev",
1058         .id_table       = evdev_ids,
1059 };
1060
1061 static int __init evdev_init(void)
1062 {
1063         return input_register_handler(&evdev_handler);
1064 }
1065
1066 static void __exit evdev_exit(void)
1067 {
1068         input_unregister_handler(&evdev_handler);
1069 }
1070
1071 module_init(evdev_init);
1072 module_exit(evdev_exit);
1073
1074 MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
1075 MODULE_DESCRIPTION("Input driver event char devices");
1076 MODULE_LICENSE("GPL");