drivers/input/evdev.c

   1 /*
   2  * Event char devices, giving access to raw input device events.
   3  *
   4  * Copyright (c) 1999-2002 Vojtech Pavlik
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License version 2 as published by
   8  * the Free Software Foundation.
   9  */
  10
  11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  12
  13 #define EVDEV_MINOR_BASE        64
  14 #define EVDEV_MINORS            32
  15 #define EVDEV_MIN_BUFFER_SIZE   64U
  16 #define EVDEV_BUF_PACKETS       8
  17
  18 #include <linux/poll.h>
  19 #include <linux/sched.h>
  20 #include <linux/slab.h>
  21 #include <linux/vmalloc.h>
  22 #include <linux/mm.h>
  23 #include <linux/module.h>
  24 #include <linux/init.h>
  25 #include <linux/input/mt.h>
  26 #include <linux/major.h>
  27 #include <linux/device.h>
  28 #include <linux/cdev.h>
  29 #include <linux/wakelock.h>
  30 #include "input-compat.h"
  31
  32 struct evdev {
  33         int open;
  34         struct input_handle handle;
  35         wait_queue_head_t wait;
  36         struct evdev_client __rcu *grab;
  37         struct list_head client_list;
  38         spinlock_t client_lock; /* protects client_list */
  39         struct mutex mutex;
  40         struct device dev;
  41         struct cdev cdev;
  42         bool exist;
  43 };
  44
  45 struct evdev_client {
  46         unsigned int head;
  47         unsigned int tail;
  48         unsigned int packet_head; /* [future] position of the first element of next packet */
  49         spinlock_t buffer_lock; /* protects access to buffer, head and tail */
  50         struct wake_lock wake_lock;
  51         bool use_wake_lock;
  52         char name[28];
  53         struct fasync_struct *fasync;
  54         struct evdev *evdev;
  55         struct list_head node;
  56         int clkid;
  57         unsigned int bufsize;
  58         struct input_event buffer[];
  59 };
  60
  61 static void __pass_event(struct evdev_client *client,
  62                          const struct input_event *event)
  63 {
  64         client->buffer[client->head++] = *event;
  65         client->head &= client->bufsize - 1;
  66
  67         if (unlikely(client->head == client->tail)) {
  68                 /*
  69                  * This effectively "drops" all unconsumed events, leaving
  70                  * EV_SYN/SYN_DROPPED plus the newest event in the queue.
  71                  */
  72                 client->tail = (client->head - 2) & (client->bufsize - 1);
  73
  74                 client->buffer[client->tail].time = event->time;
  75                 client->buffer[client->tail].type = EV_SYN;
  76                 client->buffer[client->tail].code = SYN_DROPPED;
  77                 client->buffer[client->tail].value = 0;
  78
  79                 client->packet_head = client->tail;
  80                 if (client->use_wake_lock)
  81                         wake_unlock(&client->wake_lock);
  82         }
  83
  84         if (event->type == EV_SYN && event->code == SYN_REPORT) {
  85                 client->packet_head = client->head;
  86                 if (client->use_wake_lock)
  87                         wake_lock(&client->wake_lock);
  88                 kill_fasync(&client->fasync, SIGIO, POLL_IN);
  89         }
  90 }
  91
  92 static void evdev_pass_values(struct evdev_client *client,
  93                         const struct input_value *vals, unsigned int count,
  94                         ktime_t mono, ktime_t real)
  95 {
  96         struct evdev *evdev = client->evdev;
  97         const struct input_value *v;
  98         struct input_event event;
  99         bool wakeup = false;
 100
 101         event.time = ktime_to_timeval(client->clkid == CLOCK_MONOTONIC ?
 102                                       mono : real);
 103
 104         /* Interrupts are disabled, just acquire the lock. */
 105         spin_lock(&client->buffer_lock);
 106
 107         for (v = vals; v != vals + count; v++) {
 108                 event.type = v->type;
 109                 event.code = v->code;
 110                 event.value = v->value;
 111                 __pass_event(client, &event);
 112                 if (v->type == EV_SYN && v->code == SYN_REPORT)
 113                         wakeup = true;
 114         }
 115
 116         spin_unlock(&client->buffer_lock);
 117
 118         if (wakeup)
 119                 wake_up_interruptible(&evdev->wait);
 120 }
 121
 122 /*
 123  * Pass incoming events to all connected clients.
 124  */
 125 static void evdev_events(struct input_handle *handle,
 126                          const struct input_value *vals, unsigned int count)
 127 {
 128         struct evdev *evdev = handle->private;
 129         struct evdev_client *client;
 130         ktime_t time_mono, time_real;
 131
 132         time_mono = ktime_get();
 133         time_real = ktime_sub(time_mono, ktime_get_monotonic_offset());
 134
 135         rcu_read_lock();
 136
 137         client = rcu_dereference(evdev->grab);
 138
 139         if (client)
 140                 evdev_pass_values(client, vals, count, time_mono, time_real);
 141         else
 142                 list_for_each_entry_rcu(client, &evdev->client_list, node)
 143                         evdev_pass_values(client, vals, count,
 144                                           time_mono, time_real);
 145
 146         rcu_read_unlock();
 147 }
 148
 149 /*
 150  * Pass incoming event to all connected clients.
 151  */
 152 static void evdev_event(struct input_handle *handle,
 153                         unsigned int type, unsigned int code, int value)
 154 {
 155         struct input_value vals[] = { { type, code, value } };
 156
 157         evdev_events(handle, vals, 1);
 158 }
 159
 160 static int evdev_fasync(int fd, struct file *file, int on)
 161 {
 162         struct evdev_client *client = file->private_data;
 163
 164         return fasync_helper(fd, file, on, &client->fasync);
 165 }
 166
 167 static int evdev_flush(struct file *file, fl_owner_t id)
 168 {
 169         struct evdev_client *client = file->private_data;
 170         struct evdev *evdev = client->evdev;
 171         int retval;
 172
 173         retval = mutex_lock_interruptible(&evdev->mutex);
 174         if (retval)
 175                 return retval;
 176
 177         if (!evdev->exist)
 178                 retval = -ENODEV;
 179         else
 180                 retval = input_flush_device(&evdev->handle, file);
 181
 182         mutex_unlock(&evdev->mutex);
 183         return retval;
 184 }
 185
 186 static void evdev_free(struct device *dev)
 187 {
 188         struct evdev *evdev = container_of(dev, struct evdev, dev);
 189
 190         input_put_device(evdev->handle.dev);
 191         kfree(evdev);
 192 }
 193
 194 /*
 195  * Grabs an event device (along with underlying input device).
 196  * This function is called with evdev->mutex taken.
 197  */
 198 static int evdev_grab(struct evdev *evdev, struct evdev_client *client)
 199 {
 200         int error;
 201
 202         if (evdev->grab)
 203                 return -EBUSY;
 204
 205         error = input_grab_device(&evdev->handle);
 206         if (error)
 207                 return error;
 208
 209         rcu_assign_pointer(evdev->grab, client);
 210
 211         return 0;
 212 }
 213
 214 static int evdev_ungrab(struct evdev *evdev, struct evdev_client *client)
 215 {
 216         struct evdev_client *grab = rcu_dereference_protected(evdev->grab,
 217                                         lockdep_is_held(&evdev->mutex));
 218
 219         if (grab != client)
 220                 return  -EINVAL;
 221
 222         rcu_assign_pointer(evdev->grab, NULL);
 223         synchronize_rcu();
 224         input_release_device(&evdev->handle);
 225
 226         return 0;
 227 }
 228
 229 static void evdev_attach_client(struct evdev *evdev,
 230                                 struct evdev_client *client)
 231 {
 232         spin_lock(&evdev->client_lock);
 233         list_add_tail_rcu(&client->node, &evdev->client_list);
 234         spin_unlock(&evdev->client_lock);
 235 }
 236
 237 static void evdev_detach_client(struct evdev *evdev,
 238                                 struct evdev_client *client)
 239 {
 240         spin_lock(&evdev->client_lock);
 241         list_del_rcu(&client->node);
 242         spin_unlock(&evdev->client_lock);
 243         synchronize_rcu();
 244 }
 245
 246 static int evdev_open_device(struct evdev *evdev)
 247 {
 248         int retval;
 249
 250         retval = mutex_lock_interruptible(&evdev->mutex);
 251         if (retval)
 252                 return retval;
 253
 254         if (!evdev->exist)
 255                 retval = -ENODEV;
 256         else if (!evdev->open++) {
 257                 retval = input_open_device(&evdev->handle);
 258                 if (retval)
 259                         evdev->open--;
 260         }
 261
 262         mutex_unlock(&evdev->mutex);
 263         return retval;
 264 }
 265
 266 static void evdev_close_device(struct evdev *evdev)
 267 {
 268         mutex_lock(&evdev->mutex);
 269
 270         if (evdev->exist && !--evdev->open)
 271                 input_close_device(&evdev->handle);
 272
 273         mutex_unlock(&evdev->mutex);
 274 }
 275
 276 /*
 277  * Wake up users waiting for IO so they can disconnect from
 278  * dead device.
 279  */
 280 static void evdev_hangup(struct evdev *evdev)
 281 {
 282         struct evdev_client *client;
 283
 284         spin_lock(&evdev->client_lock);
 285         list_for_each_entry(client, &evdev->client_list, node)
 286                 kill_fasync(&client->fasync, SIGIO, POLL_HUP);
 287         spin_unlock(&evdev->client_lock);
 288
 289         wake_up_interruptible(&evdev->wait);
 290 }
 291
 292 static int evdev_release(struct inode *inode, struct file *file)
 293 {
 294         struct evdev_client *client = file->private_data;
 295         struct evdev *evdev = client->evdev;
 296
 297         mutex_lock(&evdev->mutex);
 298         evdev_ungrab(evdev, client);
 299         mutex_unlock(&evdev->mutex);
 300
 301         evdev_detach_client(evdev, client);
 302         if (client->use_wake_lock)
 303                 wake_lock_destroy(&client->wake_lock);
 304
 305         if (is_vmalloc_addr(client))
 306                 vfree(client);
 307         else
 308                 kfree(client);
 309
 310         evdev_close_device(evdev);
 311
 312         return 0;
 313 }
 314
 315 static unsigned int evdev_compute_buffer_size(struct input_dev *dev)
 316 {
 317         unsigned int n_events =
 318                 max(dev->hint_events_per_packet * EVDEV_BUF_PACKETS,
 319                     EVDEV_MIN_BUFFER_SIZE);
 320
 321         return roundup_pow_of_two(n_events);
 322 }
 323
 324 static int evdev_open(struct inode *inode, struct file *file)
 325 {
 326         struct evdev *evdev = container_of(inode->i_cdev, struct evdev, cdev);
 327         unsigned int bufsize = evdev_compute_buffer_size(evdev->handle.dev);
 328         unsigned int size = sizeof(struct evdev_client) +
 329                                         bufsize * sizeof(struct input_event);
 330         struct evdev_client *client;
 331         int error;
 332
 333         client = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
 334         if (!client)
 335                 client = vzalloc(size);
 336         if (!client)
 337                 return -ENOMEM;
 338
 339         client->bufsize = bufsize;
 340         spin_lock_init(&client->buffer_lock);
 341         snprintf(client->name, sizeof(client->name), "%s-%d",
 342                         dev_name(&evdev->dev), task_tgid_vnr(current));
 343         client->evdev = evdev;
 344         evdev_attach_client(evdev, client);
 345
 346         error = evdev_open_device(evdev);
 347         if (error)
 348                 goto err_free_client;
 349
 350         file->private_data = client;
 351         nonseekable_open(inode, file);
 352
 353         return 0;
 354
 355  err_free_client:
 356         evdev_detach_client(evdev, client);
 357         kfree(client);
 358         return error;
 359 }
 360
 361 static ssize_t evdev_write(struct file *file, const char __user *buffer,
 362                            size_t count, loff_t *ppos)
 363 {
 364         struct evdev_client *client = file->private_data;
 365         struct evdev *evdev = client->evdev;
 366         struct input_event event;
 367         int retval = 0;
 368
 369         if (count != 0 && count < input_event_size())
 370                 return -EINVAL;
 371
 372         retval = mutex_lock_interruptible(&evdev->mutex);
 373         if (retval)
 374                 return retval;
 375
 376         if (!evdev->exist) {
 377                 retval = -ENODEV;
 378                 goto out;
 379         }
 380
 381         while (retval + input_event_size() <= count) {
 382
 383                 if (input_event_from_user(buffer + retval, &event)) {
 384                         retval = -EFAULT;
 385                         goto out;
 386                 }
 387                 retval += input_event_size();
 388
 389                 input_inject_event(&evdev->handle,
 390                                    event.type, event.code, event.value);
 391         }
 392
 393  out:
 394         mutex_unlock(&evdev->mutex);
 395         return retval;
 396 }
 397
 398 static int evdev_fetch_next_event(struct evdev_client *client,
 399                                   struct input_event *event)
 400 {
 401         int have_event;
 402
 403         spin_lock_irq(&client->buffer_lock);
 404
 405         have_event = client->packet_head != client->tail;
 406         if (have_event) {
 407                 *event = client->buffer[client->tail++];
 408                 client->tail &= client->bufsize - 1;
 409                 if (client->use_wake_lock &&
 410                     client->packet_head == client->tail)
 411                         wake_unlock(&client->wake_lock);
 412         }
 413
 414         spin_unlock_irq(&client->buffer_lock);
 415
 416         return have_event;
 417 }
 418
 419 static ssize_t evdev_read(struct file *file, char __user *buffer,
 420                           size_t count, loff_t *ppos)
 421 {
 422         struct evdev_client *client = file->private_data;
 423         struct evdev *evdev = client->evdev;
 424         struct input_event event;
 425         size_t read = 0;
 426         int error;
 427
 428         if (count != 0 && count < input_event_size())
 429                 return -EINVAL;
 430
 431         for (;;) {
 432                 if (!evdev->exist)
 433                         return -ENODEV;
 434
 435                 if (client->packet_head == client->tail &&
 436                     (file->f_flags & O_NONBLOCK))
 437                         return -EAGAIN;
 438
 439                 /*
 440                  * count == 0 is special - no IO is done but we check
 441                  * for error conditions (see above).
 442                  */
 443                 if (count == 0)
 444                         break;
 445
 446                 while (read + input_event_size() <= count &&
 447                        evdev_fetch_next_event(client, &event)) {
 448
 449                         if (input_event_to_user(buffer + read, &event))
 450                                 return -EFAULT;
 451
 452                         read += input_event_size();
 453                 }
 454
 455                 if (read)
 456                         break;
 457
 458                 if (!(file->f_flags & O_NONBLOCK)) {
 459                         error = wait_event_interruptible(evdev->wait,
 460                                         client->packet_head != client->tail ||
 461                                         !evdev->exist);
 462                         if (error)
 463                                 return error;
 464                 }
 465         }
 466
 467         return read;
 468 }
 469
 470 /* No kernel lock - fine */
 471 static unsigned int evdev_poll(struct file *file, poll_table *wait)
 472 {
 473         struct evdev_client *client = file->private_data;
 474         struct evdev *evdev = client->evdev;
 475         unsigned int mask;
 476
 477         poll_wait(file, &evdev->wait, wait);
 478
 479         mask = evdev->exist ? POLLOUT | POLLWRNORM : POLLHUP | POLLERR;
 480         if (client->packet_head != client->tail)
 481                 mask |= POLLIN | POLLRDNORM;
 482
 483         return mask;
 484 }
 485
 486 #ifdef CONFIG_COMPAT
 487
 488 #define BITS_PER_LONG_COMPAT (sizeof(compat_long_t) * 8)
 489 #define BITS_TO_LONGS_COMPAT(x) ((((x) - 1) / BITS_PER_LONG_COMPAT) + 1)
 490
 491 #ifdef __BIG_ENDIAN
 492 static int bits_to_user(unsigned long *bits, unsigned int maxbit,
 493                         unsigned int maxlen, void __user *p, int compat)
 494 {
 495         int len, i;
 496
 497         if (compat) {
 498                 len = BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t);
 499                 if (len > maxlen)
 500                         len = maxlen;
 501
 502                 for (i = 0; i < len / sizeof(compat_long_t); i++)
 503                         if (copy_to_user((compat_long_t __user *) p + i,
 504                                          (compat_long_t *) bits +
 505                                                 i + 1 - ((i % 2) << 1),
 506                                          sizeof(compat_long_t)))
 507                                 return -EFAULT;
 508         } else {
 509                 len = BITS_TO_LONGS(maxbit) * sizeof(long);
 510                 if (len > maxlen)
 511                         len = maxlen;
 512
 513                 if (copy_to_user(p, bits, len))
 514                         return -EFAULT;
 515         }
 516
 517         return len;
 518 }
 519 #else
 520 static int bits_to_user(unsigned long *bits, unsigned int maxbit,
 521                         unsigned int maxlen, void __user *p, int compat)
 522 {
 523         int len = compat ?
 524                         BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t) :
 525                         BITS_TO_LONGS(maxbit) * sizeof(long);
 526
 527         if (len > maxlen)
 528                 len = maxlen;
 529
 530         return copy_to_user(p, bits, len) ? -EFAULT : len;
 531 }
 532 #endif /* __BIG_ENDIAN */
 533
 534 #else
 535
 536 static int bits_to_user(unsigned long *bits, unsigned int maxbit,
 537                         unsigned int maxlen, void __user *p, int compat)
 538 {
 539         int len = BITS_TO_LONGS(maxbit) * sizeof(long);
 540
 541         if (len > maxlen)
 542                 len = maxlen;
 543
 544         return copy_to_user(p, bits, len) ? -EFAULT : len;
 545 }
 546
 547 #endif /* CONFIG_COMPAT */
 548
 549 static int str_to_user(const char *str, unsigned int maxlen, void __user *p)
 550 {
 551         int len;
 552
 553         if (!str)
 554                 return -ENOENT;
 555
 556         len = strlen(str) + 1;
 557         if (len > maxlen)
 558                 len = maxlen;
 559
 560         return copy_to_user(p, str, len) ? -EFAULT : len;
 561 }
 562
 563 #define OLD_KEY_MAX     0x1ff
 564 static int handle_eviocgbit(struct input_dev *dev,
 565                             unsigned int type, unsigned int size,
 566                             void __user *p, int compat_mode)
 567 {
 568         static unsigned long keymax_warn_time;
 569         unsigned long *bits;
 570         int len;
 571
 572         switch (type) {
 573
 574         case      0: bits = dev->evbit;  len = EV_MAX;  break;
 575         case EV_KEY: bits = dev->keybit; len = KEY_MAX; break;
 576         case EV_REL: bits = dev->relbit; len = REL_MAX; break;
 577         case EV_ABS: bits = dev->absbit; len = ABS_MAX; break;
 578         case EV_MSC: bits = dev->mscbit; len = MSC_MAX; break;
 579         case EV_LED: bits = dev->ledbit; len = LED_MAX; break;
 580         case EV_SND: bits = dev->sndbit; len = SND_MAX; break;
 581         case EV_FF:  bits = dev->ffbit;  len = FF_MAX;  break;
 582         case EV_SW:  bits = dev->swbit;  len = SW_MAX;  break;
 583         default: return -EINVAL;
 584         }
 585
 586         /*
 587          * Work around bugs in userspace programs that like to do
 588          * EVIOCGBIT(EV_KEY, KEY_MAX) and not realize that 'len'
 589          * should be in bytes, not in bits.
 590          */
 591         if (type == EV_KEY && size == OLD_KEY_MAX) {
 592                 len = OLD_KEY_MAX;
 593                 if (printk_timed_ratelimit(&keymax_warn_time, 10 * 1000))
 594                         pr_warning("(EVIOCGBIT): Suspicious buffer size %u, "
 595                                    "limiting output to %zu bytes. See "
 596                                    "http://userweb.kernel.org/~dtor/eviocgbit-bug.html\n",
 597                                    OLD_KEY_MAX,
 598                                    BITS_TO_LONGS(OLD_KEY_MAX) * sizeof(long));
 599         }
 600
 601         return bits_to_user(bits, len, size, p, compat_mode);
 602 }
 603 #undef OLD_KEY_MAX
 604
 605 static int evdev_handle_get_keycode(struct input_dev *dev, void __user *p)
 606 {
 607         struct input_keymap_entry ke = {
 608                 .len    = sizeof(unsigned int),
 609                 .flags  = 0,
 610         };
 611         int __user *ip = (int __user *)p;
 612         int error;
 613
 614         /* legacy case */
 615         if (copy_from_user(ke.scancode, p, sizeof(unsigned int)))
 616                 return -EFAULT;
 617
 618         error = input_get_keycode(dev, &ke);
 619         if (error)
 620                 return error;
 621
 622         if (put_user(ke.keycode, ip + 1))
 623                 return -EFAULT;
 624
 625         return 0;
 626 }
 627
 628 static int evdev_handle_get_keycode_v2(struct input_dev *dev, void __user *p)
 629 {
 630         struct input_keymap_entry ke;
 631         int error;
 632
 633         if (copy_from_user(&ke, p, sizeof(ke)))
 634                 return -EFAULT;
 635
 636         error = input_get_keycode(dev, &ke);
 637         if (error)
 638                 return error;
 639
 640         if (copy_to_user(p, &ke, sizeof(ke)))
 641                 return -EFAULT;
 642
 643         return 0;
 644 }
 645
 646 static int evdev_handle_set_keycode(struct input_dev *dev, void __user *p)
 647 {
 648         struct input_keymap_entry ke = {
 649                 .len    = sizeof(unsigned int),
 650                 .flags  = 0,
 651         };
 652         int __user *ip = (int __user *)p;
 653
 654         if (copy_from_user(ke.scancode, p, sizeof(unsigned int)))
 655                 return -EFAULT;
 656
 657         if (get_user(ke.keycode, ip + 1))
 658                 return -EFAULT;
 659
 660         return input_set_keycode(dev, &ke);
 661 }
 662
 663 static int evdev_handle_set_keycode_v2(struct input_dev *dev, void __user *p)
 664 {
 665         struct input_keymap_entry ke;
 666
 667         if (copy_from_user(&ke, p, sizeof(ke)))
 668                 return -EFAULT;
 669
 670         if (ke.len > sizeof(ke.scancode))
 671                 return -EINVAL;
 672
 673         return input_set_keycode(dev, &ke);
 674 }
 675
 676 static int evdev_handle_mt_request(struct input_dev *dev,
 677                                    unsigned int size,
 678                                    int __user *ip)
 679 {
 680         const struct input_mt *mt = dev->mt;
 681         unsigned int code;
 682         int max_slots;
 683         int i;
 684
 685         if (get_user(code, &ip[0]))
 686                 return -EFAULT;
 687         if (!mt || !input_is_mt_value(code))
 688                 return -EINVAL;
 689
 690         max_slots = (size - sizeof(__u32)) / sizeof(__s32);
 691         for (i = 0; i < mt->num_slots && i < max_slots; i++) {
 692                 int value = input_mt_get_value(&mt->slots[i], code);
 693                 if (put_user(value, &ip[1 + i]))
 694                         return -EFAULT;
 695         }
 696
 697         return 0;
 698 }
 699
 700 static int evdev_enable_suspend_block(struct evdev *evdev,
 701                                       struct evdev_client *client)
 702 {
 703         if (client->use_wake_lock)
 704                 return 0;
 705
 706         spin_lock_irq(&client->buffer_lock);
 707         wake_lock_init(&client->wake_lock, WAKE_LOCK_SUSPEND, client->name);
 708         client->use_wake_lock = true;
 709         if (client->packet_head != client->tail)
 710                 wake_lock(&client->wake_lock);
 711         spin_unlock_irq(&client->buffer_lock);
 712         return 0;
 713 }
 714
 715 static int evdev_disable_suspend_block(struct evdev *evdev,
 716                                        struct evdev_client *client)
 717 {
 718         if (!client->use_wake_lock)
 719                 return 0;
 720
 721         spin_lock_irq(&client->buffer_lock);
 722         client->use_wake_lock = false;
 723         wake_lock_destroy(&client->wake_lock);
 724         spin_unlock_irq(&client->buffer_lock);
 725
 726         return 0;
 727 }
 728
 729 static long evdev_do_ioctl(struct file *file, unsigned int cmd,
 730                            void __user *p, int compat_mode)
 731 {
 732         struct evdev_client *client = file->private_data;
 733         struct evdev *evdev = client->evdev;
 734         struct input_dev *dev = evdev->handle.dev;
 735         struct input_absinfo abs;
 736         struct ff_effect effect;
 737         int __user *ip = (int __user *)p;
 738         unsigned int i, t, u, v;
 739         unsigned int size;
 740         int error;
 741
 742         /* First we check for fixed-length commands */
 743         switch (cmd) {
 744
 745         case EVIOCGVERSION:
 746                 return put_user(EV_VERSION, ip);
 747
 748         case EVIOCGID:
 749                 if (copy_to_user(p, &dev->id, sizeof(struct input_id)))
 750                         return -EFAULT;
 751                 return 0;
 752
 753         case EVIOCGREP:
 754                 if (!test_bit(EV_REP, dev->evbit))
 755                         return -ENOSYS;
 756                 if (put_user(dev->rep[REP_DELAY], ip))
 757                         return -EFAULT;
 758                 if (put_user(dev->rep[REP_PERIOD], ip + 1))
 759                         return -EFAULT;
 760                 return 0;
 761
 762         case EVIOCSREP:
 763                 if (!test_bit(EV_REP, dev->evbit))
 764                         return -ENOSYS;
 765                 if (get_user(u, ip))
 766                         return -EFAULT;
 767                 if (get_user(v, ip + 1))
 768                         return -EFAULT;
 769
 770                 input_inject_event(&evdev->handle, EV_REP, REP_DELAY, u);
 771                 input_inject_event(&evdev->handle, EV_REP, REP_PERIOD, v);
 772
 773                 return 0;
 774
 775         case EVIOCRMFF:
 776                 return input_ff_erase(dev, (int)(unsigned long) p, file);
 777
 778         case EVIOCGEFFECTS:
 779                 i = test_bit(EV_FF, dev->evbit) ?
 780                                 dev->ff->max_effects : 0;
 781                 if (put_user(i, ip))
 782                         return -EFAULT;
 783                 return 0;
 784
 785         case EVIOCGRAB:
 786                 if (p)
 787                         return evdev_grab(evdev, client);
 788                 else
 789                         return evdev_ungrab(evdev, client);
 790
 791         case EVIOCSCLOCKID:
 792                 if (copy_from_user(&i, p, sizeof(unsigned int)))
 793                         return -EFAULT;
 794                 if (i != CLOCK_MONOTONIC && i != CLOCK_REALTIME)
 795                         return -EINVAL;
 796                 client->clkid = i;
 797                 return 0;
 798
 799         case EVIOCGKEYCODE:
 800                 return evdev_handle_get_keycode(dev, p);
 801
 802         case EVIOCSKEYCODE:
 803                 return evdev_handle_set_keycode(dev, p);
 804
 805         case EVIOCGKEYCODE_V2:
 806                 return evdev_handle_get_keycode_v2(dev, p);
 807
 808         case EVIOCSKEYCODE_V2:
 809                 return evdev_handle_set_keycode_v2(dev, p);
 810
 811         case EVIOCGSUSPENDBLOCK:
 812                 return put_user(client->use_wake_lock, ip);
 813
 814         case EVIOCSSUSPENDBLOCK:
 815                 if (p)
 816                         return evdev_enable_suspend_block(evdev, client);
 817                 else
 818                         return evdev_disable_suspend_block(evdev, client);
 819         }
 820
 821         size = _IOC_SIZE(cmd);
 822
 823         /* Now check variable-length commands */
 824 #define EVIOC_MASK_SIZE(nr)     ((nr) & ~(_IOC_SIZEMASK << _IOC_SIZESHIFT))
 825         switch (EVIOC_MASK_SIZE(cmd)) {
 826
 827         case EVIOCGPROP(0):
 828                 return bits_to_user(dev->propbit, INPUT_PROP_MAX,
 829                                     size, p, compat_mode);
 830
 831         case EVIOCGMTSLOTS(0):
 832                 return evdev_handle_mt_request(dev, size, ip);
 833
 834         case EVIOCGKEY(0):
 835                 return bits_to_user(dev->key, KEY_MAX, size, p, compat_mode);
 836
 837         case EVIOCGLED(0):
 838                 return bits_to_user(dev->led, LED_MAX, size, p, compat_mode);
 839
 840         case EVIOCGSND(0):
 841                 return bits_to_user(dev->snd, SND_MAX, size, p, compat_mode);
 842
 843         case EVIOCGSW(0):
 844                 return bits_to_user(dev->sw, SW_MAX, size, p, compat_mode);
 845
 846         case EVIOCGNAME(0):
 847                 return str_to_user(dev->name, size, p);
 848
 849         case EVIOCGPHYS(0):
 850                 return str_to_user(dev->phys, size, p);
 851
 852         case EVIOCGUNIQ(0):
 853                 return str_to_user(dev->uniq, size, p);
 854
 855         case EVIOC_MASK_SIZE(EVIOCSFF):
 856                 if (input_ff_effect_from_user(p, size, &effect))
 857                         return -EFAULT;
 858
 859                 error = input_ff_upload(dev, &effect, file);
 860
 861                 if (put_user(effect.id, &(((struct ff_effect __user *)p)->id)))
 862                         return -EFAULT;
 863
 864                 return error;
 865         }
 866
 867         /* Multi-number variable-length handlers */
 868         if (_IOC_TYPE(cmd) != 'E')
 869                 return -EINVAL;
 870
 871         if (_IOC_DIR(cmd) == _IOC_READ) {
 872
 873                 if ((_IOC_NR(cmd) & ~EV_MAX) == _IOC_NR(EVIOCGBIT(0, 0)))
 874                         return handle_eviocgbit(dev,
 875                                                 _IOC_NR(cmd) & EV_MAX, size,
 876                                                 p, compat_mode);
 877
 878                 if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) {
 879
 880                         if (!dev->absinfo)
 881                                 return -EINVAL;
 882
 883                         t = _IOC_NR(cmd) & ABS_MAX;
 884                         abs = dev->absinfo[t];
 885
 886                         if (copy_to_user(p, &abs, min_t(size_t,
 887                                         size, sizeof(struct input_absinfo))))
 888                                 return -EFAULT;
 889
 890                         return 0;
 891                 }
 892         }
 893
 894         if (_IOC_DIR(cmd) == _IOC_WRITE) {
 895
 896                 if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) {
 897
 898                         if (!dev->absinfo)
 899                                 return -EINVAL;
 900
 901                         t = _IOC_NR(cmd) & ABS_MAX;
 902
 903                         if (copy_from_user(&abs, p, min_t(size_t,
 904                                         size, sizeof(struct input_absinfo))))
 905                                 return -EFAULT;
 906
 907                         if (size < sizeof(struct input_absinfo))
 908                                 abs.resolution = 0;
 909
 910                         /* We can't change number of reserved MT slots */
 911                         if (t == ABS_MT_SLOT)
 912                                 return -EINVAL;
 913
 914                         /*
 915                          * Take event lock to ensure that we are not
 916                          * changing device parameters in the middle
 917                          * of event.
 918                          */
 919                         spin_lock_irq(&dev->event_lock);
 920                         dev->absinfo[t] = abs;
 921                         spin_unlock_irq(&dev->event_lock);
 922
 923                         return 0;
 924                 }
 925         }
 926
 927         return -EINVAL;
 928 }
 929
 930 static long evdev_ioctl_handler(struct file *file, unsigned int cmd,
 931                                 void __user *p, int compat_mode)
 932 {
 933         struct evdev_client *client = file->private_data;
 934         struct evdev *evdev = client->evdev;
 935         int retval;
 936
 937         retval = mutex_lock_interruptible(&evdev->mutex);
 938         if (retval)
 939                 return retval;
 940
 941         if (!evdev->exist) {
 942                 retval = -ENODEV;
 943                 goto out;
 944         }
 945
 946         retval = evdev_do_ioctl(file, cmd, p, compat_mode);
 947
 948  out:
 949         mutex_unlock(&evdev->mutex);
 950         return retval;
 951 }
 952
 953 static long evdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 954 {
 955         return evdev_ioctl_handler(file, cmd, (void __user *)arg, 0);
 956 }
 957
 958 #ifdef CONFIG_COMPAT
 959 static long evdev_ioctl_compat(struct file *file,
 960                                 unsigned int cmd, unsigned long arg)
 961 {
 962         return evdev_ioctl_handler(file, cmd, compat_ptr(arg), 1);
 963 }
 964 #endif
 965
 966 static const struct file_operations evdev_fops = {
 967         .owner          = THIS_MODULE,
 968         .read           = evdev_read,
 969         .write          = evdev_write,
 970         .poll           = evdev_poll,
 971         .open           = evdev_open,
 972         .release        = evdev_release,
 973         .unlocked_ioctl = evdev_ioctl,
 974 #ifdef CONFIG_COMPAT
 975         .compat_ioctl   = evdev_ioctl_compat,
 976 #endif
 977         .fasync         = evdev_fasync,
 978         .flush          = evdev_flush,
 979         .llseek         = no_llseek,
 980 };
 981
 982 /*
 983  * Mark device non-existent. This disables writes, ioctls and
 984  * prevents new users from opening the device. Already posted
 985  * blocking reads will stay, however new ones will fail.
 986  */
 987 static void evdev_mark_dead(struct evdev *evdev)
 988 {
 989         mutex_lock(&evdev->mutex);
 990         evdev->exist = false;
 991         mutex_unlock(&evdev->mutex);
 992 }
 993
 994 static void evdev_cleanup(struct evdev *evdev)
 995 {
 996         struct input_handle *handle = &evdev->handle;
 997
 998         evdev_mark_dead(evdev);
 999         evdev_hangup(evdev);
1000
1001         cdev_del(&evdev->cdev);
1002
1003         /* evdev is marked dead so no one else accesses evdev->open */
1004         if (evdev->open) {
1005                 input_flush_device(handle, NULL);
1006                 input_close_device(handle);
1007         }
1008 }
1009
1010 /*
1011  * Create new evdev device. Note that input core serializes calls
1012  * to connect and disconnect.
1013  */
1014 static int evdev_connect(struct input_handler *handler, struct input_dev *dev,
1015                          const struct input_device_id *id)
1016 {
1017         struct evdev *evdev;
1018         int minor;
1019         int dev_no;
1020         int error;
1021
1022         minor = input_get_new_minor(EVDEV_MINOR_BASE, EVDEV_MINORS, true);
1023         if (minor < 0) {
1024                 error = minor;
1025                 pr_err("failed to reserve new minor: %d\n", error);
1026                 return error;
1027         }
1028
1029         evdev = kzalloc(sizeof(struct evdev), GFP_KERNEL);
1030         if (!evdev) {
1031                 error = -ENOMEM;
1032                 goto err_free_minor;
1033         }
1034
1035         INIT_LIST_HEAD(&evdev->client_list);
1036         spin_lock_init(&evdev->client_lock);
1037         mutex_init(&evdev->mutex);
1038         init_waitqueue_head(&evdev->wait);
1039         evdev->exist = true;
1040
1041         dev_no = minor;
1042         /* Normalize device number if it falls into legacy range */
1043         if (dev_no < EVDEV_MINOR_BASE + EVDEV_MINORS)
1044                 dev_no -= EVDEV_MINOR_BASE;
1045         dev_set_name(&evdev->dev, "event%d", dev_no);
1046
1047         evdev->handle.dev = input_get_device(dev);
1048         evdev->handle.name = dev_name(&evdev->dev);
1049         evdev->handle.handler = handler;
1050         evdev->handle.private = evdev;
1051
1052         evdev->dev.devt = MKDEV(INPUT_MAJOR, minor);
1053         evdev->dev.class = &input_class;
1054         evdev->dev.parent = &dev->dev;
1055         evdev->dev.release = evdev_free;
1056         device_initialize(&evdev->dev);
1057
1058         error = input_register_handle(&evdev->handle);
1059         if (error)
1060                 goto err_free_evdev;
1061
1062         cdev_init(&evdev->cdev, &evdev_fops);
1063         evdev->cdev.kobj.parent = &evdev->dev.kobj;
1064         error = cdev_add(&evdev->cdev, evdev->dev.devt, 1);
1065         if (error)
1066                 goto err_unregister_handle;
1067
1068         error = device_add(&evdev->dev);
1069         if (error)
1070                 goto err_cleanup_evdev;
1071
1072         return 0;
1073
1074  err_cleanup_evdev:
1075         evdev_cleanup(evdev);
1076  err_unregister_handle:
1077         input_unregister_handle(&evdev->handle);
1078  err_free_evdev:
1079         put_device(&evdev->dev);
1080  err_free_minor:
1081         input_free_minor(minor);
1082         return error;
1083 }
1084
1085 static void evdev_disconnect(struct input_handle *handle)
1086 {
1087         struct evdev *evdev = handle->private;
1088
1089         device_del(&evdev->dev);
1090         evdev_cleanup(evdev);
1091         input_free_minor(MINOR(evdev->dev.devt));
1092         input_unregister_handle(handle);
1093         put_device(&evdev->dev);
1094 }
1095
1096 static const struct input_device_id evdev_ids[] = {
1097         { .driver_info = 1 },   /* Matches all devices */
1098         { },                    /* Terminating zero entry */
1099 };
1100
1101 MODULE_DEVICE_TABLE(input, evdev_ids);
1102
1103 static struct input_handler evdev_handler = {
1104         .event          = evdev_event,
1105         .events         = evdev_events,
1106         .connect        = evdev_connect,
1107         .disconnect     = evdev_disconnect,
1108         .legacy_minors  = true,
1109         .minor          = EVDEV_MINOR_BASE,
1110         .name           = "evdev",
1111         .id_table       = evdev_ids,
1112 };
1113
1114 static int __init evdev_init(void)
1115 {
1116         return input_register_handler(&evdev_handler);
1117 }
1118
1119 static void __exit evdev_exit(void)
1120 {
1121         input_unregister_handler(&evdev_handler);
1122 }
1123
1124 module_init(evdev_init);
1125 module_exit(evdev_exit);
1126
1127 MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
1128 MODULE_DESCRIPTION("Input driver event char devices");
1129 MODULE_LICENSE("GPL");