91df0df15e685f813db27d822b50bc2a43ca1f4d
[muen/linux.git] / drivers / input / misc / uinput.c
1 /*
2  *  User level driver support for input subsystem
3  *
4  * Heavily based on evdev.c by Vojtech Pavlik
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 2 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, write to the Free Software
18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
19  *
20  * Author: Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org>
21  *
22  * Changes/Revisions:
23  *      0.4     01/09/2014 (Benjamin Tissoires <benjamin.tissoires@redhat.com>)
24  *              - add UI_GET_SYSNAME ioctl
25  *      0.3     09/04/2006 (Anssi Hannula <anssi.hannula@gmail.com>)
26  *              - updated ff support for the changes in kernel interface
27  *              - added MODULE_VERSION
28  *      0.2     16/10/2004 (Micah Dowty <micah@navi.cx>)
29  *              - added force feedback support
30  *              - added UI_SET_PHYS
31  *      0.1     20/06/2002
32  *              - first public version
33  */
34 #include <uapi/linux/uinput.h>
35 #include <linux/poll.h>
36 #include <linux/sched.h>
37 #include <linux/slab.h>
38 #include <linux/module.h>
39 #include <linux/init.h>
40 #include <linux/fs.h>
41 #include <linux/miscdevice.h>
42 #include <linux/input/mt.h>
43 #include "../input-compat.h"
44
45 #define UINPUT_NAME             "uinput"
46 #define UINPUT_BUFFER_SIZE      16
47 #define UINPUT_NUM_REQUESTS     16
48
49 enum uinput_state { UIST_NEW_DEVICE, UIST_SETUP_COMPLETE, UIST_CREATED };
50
51 struct uinput_request {
52         unsigned int            id;
53         unsigned int            code;   /* UI_FF_UPLOAD, UI_FF_ERASE */
54
55         int                     retval;
56         struct completion       done;
57
58         union {
59                 unsigned int    effect_id;
60                 struct {
61                         struct ff_effect *effect;
62                         struct ff_effect *old;
63                 } upload;
64         } u;
65 };
66
67 struct uinput_device {
68         struct input_dev        *dev;
69         struct mutex            mutex;
70         enum uinput_state       state;
71         wait_queue_head_t       waitq;
72         unsigned char           ready;
73         unsigned char           head;
74         unsigned char           tail;
75         struct input_event      buff[UINPUT_BUFFER_SIZE];
76         unsigned int            ff_effects_max;
77
78         struct uinput_request   *requests[UINPUT_NUM_REQUESTS];
79         wait_queue_head_t       requests_waitq;
80         spinlock_t              requests_lock;
81 };
82
83 static int uinput_dev_event(struct input_dev *dev,
84                             unsigned int type, unsigned int code, int value)
85 {
86         struct uinput_device    *udev = input_get_drvdata(dev);
87
88         udev->buff[udev->head].type = type;
89         udev->buff[udev->head].code = code;
90         udev->buff[udev->head].value = value;
91         do_gettimeofday(&udev->buff[udev->head].time);
92         udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE;
93
94         wake_up_interruptible(&udev->waitq);
95
96         return 0;
97 }
98
99 /* Atomically allocate an ID for the given request. Returns 0 on success. */
100 static bool uinput_request_alloc_id(struct uinput_device *udev,
101                                     struct uinput_request *request)
102 {
103         unsigned int id;
104         bool reserved = false;
105
106         spin_lock(&udev->requests_lock);
107
108         for (id = 0; id < UINPUT_NUM_REQUESTS; id++) {
109                 if (!udev->requests[id]) {
110                         request->id = id;
111                         udev->requests[id] = request;
112                         reserved = true;
113                         break;
114                 }
115         }
116
117         spin_unlock(&udev->requests_lock);
118         return reserved;
119 }
120
121 static struct uinput_request *uinput_request_find(struct uinput_device *udev,
122                                                   unsigned int id)
123 {
124         /* Find an input request, by ID. Returns NULL if the ID isn't valid. */
125         if (id >= UINPUT_NUM_REQUESTS)
126                 return NULL;
127
128         return udev->requests[id];
129 }
130
131 static int uinput_request_reserve_slot(struct uinput_device *udev,
132                                        struct uinput_request *request)
133 {
134         /* Allocate slot. If none are available right away, wait. */
135         return wait_event_interruptible(udev->requests_waitq,
136                                         uinput_request_alloc_id(udev, request));
137 }
138
139 static void uinput_request_release_slot(struct uinput_device *udev,
140                                         unsigned int id)
141 {
142         /* Mark slot as available */
143         spin_lock(&udev->requests_lock);
144         udev->requests[id] = NULL;
145         spin_unlock(&udev->requests_lock);
146
147         wake_up(&udev->requests_waitq);
148 }
149
150 static int uinput_request_send(struct uinput_device *udev,
151                                struct uinput_request *request)
152 {
153         int retval;
154
155         retval = mutex_lock_interruptible(&udev->mutex);
156         if (retval)
157                 return retval;
158
159         if (udev->state != UIST_CREATED) {
160                 retval = -ENODEV;
161                 goto out;
162         }
163
164         init_completion(&request->done);
165
166         /*
167          * Tell our userspace application about this new request
168          * by queueing an input event.
169          */
170         uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id);
171
172  out:
173         mutex_unlock(&udev->mutex);
174         return retval;
175 }
176
177 static int uinput_request_submit(struct uinput_device *udev,
178                                  struct uinput_request *request)
179 {
180         int retval;
181
182         retval = uinput_request_reserve_slot(udev, request);
183         if (retval)
184                 return retval;
185
186         retval = uinput_request_send(udev, request);
187         if (retval)
188                 goto out;
189
190         if (!wait_for_completion_timeout(&request->done, 30 * HZ)) {
191                 retval = -ETIMEDOUT;
192                 goto out;
193         }
194
195         retval = request->retval;
196
197  out:
198         uinput_request_release_slot(udev, request->id);
199         return retval;
200 }
201
202 /*
203  * Fail all outstanding requests so handlers don't wait for the userspace
204  * to finish processing them.
205  */
206 static void uinput_flush_requests(struct uinput_device *udev)
207 {
208         struct uinput_request *request;
209         int i;
210
211         spin_lock(&udev->requests_lock);
212
213         for (i = 0; i < UINPUT_NUM_REQUESTS; i++) {
214                 request = udev->requests[i];
215                 if (request) {
216                         request->retval = -ENODEV;
217                         complete(&request->done);
218                 }
219         }
220
221         spin_unlock(&udev->requests_lock);
222 }
223
224 static void uinput_dev_set_gain(struct input_dev *dev, u16 gain)
225 {
226         uinput_dev_event(dev, EV_FF, FF_GAIN, gain);
227 }
228
229 static void uinput_dev_set_autocenter(struct input_dev *dev, u16 magnitude)
230 {
231         uinput_dev_event(dev, EV_FF, FF_AUTOCENTER, magnitude);
232 }
233
234 static int uinput_dev_playback(struct input_dev *dev, int effect_id, int value)
235 {
236         return uinput_dev_event(dev, EV_FF, effect_id, value);
237 }
238
239 static int uinput_dev_upload_effect(struct input_dev *dev,
240                                     struct ff_effect *effect,
241                                     struct ff_effect *old)
242 {
243         struct uinput_device *udev = input_get_drvdata(dev);
244         struct uinput_request request;
245
246         /*
247          * uinput driver does not currently support periodic effects with
248          * custom waveform since it does not have a way to pass buffer of
249          * samples (custom_data) to userspace. If ever there is a device
250          * supporting custom waveforms we would need to define an additional
251          * ioctl (UI_UPLOAD_SAMPLES) but for now we just bail out.
252          */
253         if (effect->type == FF_PERIODIC &&
254                         effect->u.periodic.waveform == FF_CUSTOM)
255                 return -EINVAL;
256
257         request.code = UI_FF_UPLOAD;
258         request.u.upload.effect = effect;
259         request.u.upload.old = old;
260
261         return uinput_request_submit(udev, &request);
262 }
263
264 static int uinput_dev_erase_effect(struct input_dev *dev, int effect_id)
265 {
266         struct uinput_device *udev = input_get_drvdata(dev);
267         struct uinput_request request;
268
269         if (!test_bit(EV_FF, dev->evbit))
270                 return -ENOSYS;
271
272         request.code = UI_FF_ERASE;
273         request.u.effect_id = effect_id;
274
275         return uinput_request_submit(udev, &request);
276 }
277
278 static int uinput_dev_flush(struct input_dev *dev, struct file *file)
279 {
280         /*
281          * If we are called with file == NULL that means we are tearing
282          * down the device, and therefore we can not handle FF erase
283          * requests: either we are handling UI_DEV_DESTROY (and holding
284          * the udev->mutex), or the file descriptor is closed and there is
285          * nobody on the other side anymore.
286          */
287         return file ? input_ff_flush(dev, file) : 0;
288 }
289
290 static void uinput_destroy_device(struct uinput_device *udev)
291 {
292         const char *name, *phys;
293         struct input_dev *dev = udev->dev;
294         enum uinput_state old_state = udev->state;
295
296         udev->state = UIST_NEW_DEVICE;
297
298         if (dev) {
299                 name = dev->name;
300                 phys = dev->phys;
301                 if (old_state == UIST_CREATED) {
302                         uinput_flush_requests(udev);
303                         input_unregister_device(dev);
304                 } else {
305                         input_free_device(dev);
306                 }
307                 kfree(name);
308                 kfree(phys);
309                 udev->dev = NULL;
310         }
311 }
312
313 static int uinput_create_device(struct uinput_device *udev)
314 {
315         struct input_dev *dev = udev->dev;
316         int error, nslot;
317
318         if (udev->state != UIST_SETUP_COMPLETE) {
319                 printk(KERN_DEBUG "%s: write device info first\n", UINPUT_NAME);
320                 return -EINVAL;
321         }
322
323         if (test_bit(EV_ABS, dev->evbit)) {
324                 input_alloc_absinfo(dev);
325                 if (!dev->absinfo) {
326                         error = -EINVAL;
327                         goto fail1;
328                 }
329
330                 if (test_bit(ABS_MT_SLOT, dev->absbit)) {
331                         nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
332                         error = input_mt_init_slots(dev, nslot, 0);
333                         if (error)
334                                 goto fail1;
335                 } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
336                         input_set_events_per_packet(dev, 60);
337                 }
338         }
339
340         if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) {
341                 printk(KERN_DEBUG "%s: ff_effects_max should be non-zero when FF_BIT is set\n",
342                         UINPUT_NAME);
343                 error = -EINVAL;
344                 goto fail1;
345         }
346
347         if (udev->ff_effects_max) {
348                 error = input_ff_create(dev, udev->ff_effects_max);
349                 if (error)
350                         goto fail1;
351
352                 dev->ff->upload = uinput_dev_upload_effect;
353                 dev->ff->erase = uinput_dev_erase_effect;
354                 dev->ff->playback = uinput_dev_playback;
355                 dev->ff->set_gain = uinput_dev_set_gain;
356                 dev->ff->set_autocenter = uinput_dev_set_autocenter;
357                 /*
358                  * The standard input_ff_flush() implementation does
359                  * not quite work for uinput as we can't reasonably
360                  * handle FF requests during device teardown.
361                  */
362                 dev->flush = uinput_dev_flush;
363         }
364
365         dev->event = uinput_dev_event;
366
367         input_set_drvdata(udev->dev, udev);
368
369         error = input_register_device(udev->dev);
370         if (error)
371                 goto fail2;
372
373         udev->state = UIST_CREATED;
374
375         return 0;
376
377  fail2: input_ff_destroy(dev);
378  fail1: uinput_destroy_device(udev);
379         return error;
380 }
381
382 static int uinput_open(struct inode *inode, struct file *file)
383 {
384         struct uinput_device *newdev;
385
386         newdev = kzalloc(sizeof(struct uinput_device), GFP_KERNEL);
387         if (!newdev)
388                 return -ENOMEM;
389
390         mutex_init(&newdev->mutex);
391         spin_lock_init(&newdev->requests_lock);
392         init_waitqueue_head(&newdev->requests_waitq);
393         init_waitqueue_head(&newdev->waitq);
394         newdev->state = UIST_NEW_DEVICE;
395
396         file->private_data = newdev;
397         nonseekable_open(inode, file);
398
399         return 0;
400 }
401
402 static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
403                                    const struct input_absinfo *abs)
404 {
405         int min, max;
406
407         min = abs->minimum;
408         max = abs->maximum;
409
410         if ((min != 0 || max != 0) && max <= min) {
411                 printk(KERN_DEBUG
412                        "%s: invalid abs[%02x] min:%d max:%d\n",
413                        UINPUT_NAME, code, min, max);
414                 return -EINVAL;
415         }
416
417         if (abs->flat > max - min) {
418                 printk(KERN_DEBUG
419                        "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n",
420                        UINPUT_NAME, code, abs->flat, min, max);
421                 return -EINVAL;
422         }
423
424         return 0;
425 }
426
427 static int uinput_validate_absbits(struct input_dev *dev)
428 {
429         unsigned int cnt;
430         int error;
431
432         if (!test_bit(EV_ABS, dev->evbit))
433                 return 0;
434
435         /*
436          * Check if absmin/absmax/absfuzz/absflat are sane.
437          */
438
439         for_each_set_bit(cnt, dev->absbit, ABS_CNT) {
440                 if (!dev->absinfo)
441                         return -EINVAL;
442
443                 error = uinput_validate_absinfo(dev, cnt, &dev->absinfo[cnt]);
444                 if (error)
445                         return error;
446         }
447
448         return 0;
449 }
450
451 static int uinput_dev_setup(struct uinput_device *udev,
452                             struct uinput_setup __user *arg)
453 {
454         struct uinput_setup setup;
455         struct input_dev *dev;
456
457         if (udev->state == UIST_CREATED)
458                 return -EINVAL;
459
460         if (copy_from_user(&setup, arg, sizeof(setup)))
461                 return -EFAULT;
462
463         if (!setup.name[0])
464                 return -EINVAL;
465
466         dev = udev->dev;
467         dev->id = setup.id;
468         udev->ff_effects_max = setup.ff_effects_max;
469
470         kfree(dev->name);
471         dev->name = kstrndup(setup.name, UINPUT_MAX_NAME_SIZE, GFP_KERNEL);
472         if (!dev->name)
473                 return -ENOMEM;
474
475         udev->state = UIST_SETUP_COMPLETE;
476         return 0;
477 }
478
479 static int uinput_abs_setup(struct uinput_device *udev,
480                             struct uinput_setup __user *arg, size_t size)
481 {
482         struct uinput_abs_setup setup = {};
483         struct input_dev *dev;
484         int error;
485
486         if (size > sizeof(setup))
487                 return -E2BIG;
488
489         if (udev->state == UIST_CREATED)
490                 return -EINVAL;
491
492         if (copy_from_user(&setup, arg, size))
493                 return -EFAULT;
494
495         if (setup.code > ABS_MAX)
496                 return -ERANGE;
497
498         dev = udev->dev;
499
500         error = uinput_validate_absinfo(dev, setup.code, &setup.absinfo);
501         if (error)
502                 return error;
503
504         input_alloc_absinfo(dev);
505         if (!dev->absinfo)
506                 return -ENOMEM;
507
508         set_bit(setup.code, dev->absbit);
509         dev->absinfo[setup.code] = setup.absinfo;
510         return 0;
511 }
512
513 /* legacy setup via write() */
514 static int uinput_setup_device_legacy(struct uinput_device *udev,
515                                       const char __user *buffer, size_t count)
516 {
517         struct uinput_user_dev  *user_dev;
518         struct input_dev        *dev;
519         int                     i;
520         int                     retval;
521
522         if (count != sizeof(struct uinput_user_dev))
523                 return -EINVAL;
524
525         if (!udev->dev) {
526                 udev->dev = input_allocate_device();
527                 if (!udev->dev)
528                         return -ENOMEM;
529         }
530
531         dev = udev->dev;
532
533         user_dev = memdup_user(buffer, sizeof(struct uinput_user_dev));
534         if (IS_ERR(user_dev))
535                 return PTR_ERR(user_dev);
536
537         udev->ff_effects_max = user_dev->ff_effects_max;
538
539         /* Ensure name is filled in */
540         if (!user_dev->name[0]) {
541                 retval = -EINVAL;
542                 goto exit;
543         }
544
545         kfree(dev->name);
546         dev->name = kstrndup(user_dev->name, UINPUT_MAX_NAME_SIZE,
547                              GFP_KERNEL);
548         if (!dev->name) {
549                 retval = -ENOMEM;
550                 goto exit;
551         }
552
553         dev->id.bustype = user_dev->id.bustype;
554         dev->id.vendor  = user_dev->id.vendor;
555         dev->id.product = user_dev->id.product;
556         dev->id.version = user_dev->id.version;
557
558         for (i = 0; i < ABS_CNT; i++) {
559                 input_abs_set_max(dev, i, user_dev->absmax[i]);
560                 input_abs_set_min(dev, i, user_dev->absmin[i]);
561                 input_abs_set_fuzz(dev, i, user_dev->absfuzz[i]);
562                 input_abs_set_flat(dev, i, user_dev->absflat[i]);
563         }
564
565         retval = uinput_validate_absbits(dev);
566         if (retval < 0)
567                 goto exit;
568
569         udev->state = UIST_SETUP_COMPLETE;
570         retval = count;
571
572  exit:
573         kfree(user_dev);
574         return retval;
575 }
576
577 static ssize_t uinput_inject_events(struct uinput_device *udev,
578                                     const char __user *buffer, size_t count)
579 {
580         struct input_event ev;
581         size_t bytes = 0;
582
583         if (count != 0 && count < input_event_size())
584                 return -EINVAL;
585
586         while (bytes + input_event_size() <= count) {
587                 /*
588                  * Note that even if some events were fetched successfully
589                  * we are still going to return EFAULT instead of partial
590                  * count to let userspace know that it got it's buffers
591                  * all wrong.
592                  */
593                 if (input_event_from_user(buffer + bytes, &ev))
594                         return -EFAULT;
595
596                 input_event(udev->dev, ev.type, ev.code, ev.value);
597                 bytes += input_event_size();
598         }
599
600         return bytes;
601 }
602
603 static ssize_t uinput_write(struct file *file, const char __user *buffer,
604                             size_t count, loff_t *ppos)
605 {
606         struct uinput_device *udev = file->private_data;
607         int retval;
608
609         if (count == 0)
610                 return 0;
611
612         retval = mutex_lock_interruptible(&udev->mutex);
613         if (retval)
614                 return retval;
615
616         retval = udev->state == UIST_CREATED ?
617                         uinput_inject_events(udev, buffer, count) :
618                         uinput_setup_device_legacy(udev, buffer, count);
619
620         mutex_unlock(&udev->mutex);
621
622         return retval;
623 }
624
625 static bool uinput_fetch_next_event(struct uinput_device *udev,
626                                     struct input_event *event)
627 {
628         bool have_event;
629
630         spin_lock_irq(&udev->dev->event_lock);
631
632         have_event = udev->head != udev->tail;
633         if (have_event) {
634                 *event = udev->buff[udev->tail];
635                 udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE;
636         }
637
638         spin_unlock_irq(&udev->dev->event_lock);
639
640         return have_event;
641 }
642
643 static ssize_t uinput_events_to_user(struct uinput_device *udev,
644                                      char __user *buffer, size_t count)
645 {
646         struct input_event event;
647         size_t read = 0;
648
649         while (read + input_event_size() <= count &&
650                uinput_fetch_next_event(udev, &event)) {
651
652                 if (input_event_to_user(buffer + read, &event))
653                         return -EFAULT;
654
655                 read += input_event_size();
656         }
657
658         return read;
659 }
660
661 static ssize_t uinput_read(struct file *file, char __user *buffer,
662                            size_t count, loff_t *ppos)
663 {
664         struct uinput_device *udev = file->private_data;
665         ssize_t retval;
666
667         if (count != 0 && count < input_event_size())
668                 return -EINVAL;
669
670         do {
671                 retval = mutex_lock_interruptible(&udev->mutex);
672                 if (retval)
673                         return retval;
674
675                 if (udev->state != UIST_CREATED)
676                         retval = -ENODEV;
677                 else if (udev->head == udev->tail &&
678                          (file->f_flags & O_NONBLOCK))
679                         retval = -EAGAIN;
680                 else
681                         retval = uinput_events_to_user(udev, buffer, count);
682
683                 mutex_unlock(&udev->mutex);
684
685                 if (retval || count == 0)
686                         break;
687
688                 if (!(file->f_flags & O_NONBLOCK))
689                         retval = wait_event_interruptible(udev->waitq,
690                                                   udev->head != udev->tail ||
691                                                   udev->state != UIST_CREATED);
692         } while (retval == 0);
693
694         return retval;
695 }
696
697 static __poll_t uinput_poll(struct file *file, poll_table *wait)
698 {
699         struct uinput_device *udev = file->private_data;
700
701         poll_wait(file, &udev->waitq, wait);
702
703         if (udev->head != udev->tail)
704                 return POLLIN | POLLRDNORM;
705
706         return 0;
707 }
708
709 static int uinput_release(struct inode *inode, struct file *file)
710 {
711         struct uinput_device *udev = file->private_data;
712
713         uinput_destroy_device(udev);
714         kfree(udev);
715
716         return 0;
717 }
718
719 #ifdef CONFIG_COMPAT
720 struct uinput_ff_upload_compat {
721         __u32                   request_id;
722         __s32                   retval;
723         struct ff_effect_compat effect;
724         struct ff_effect_compat old;
725 };
726
727 static int uinput_ff_upload_to_user(char __user *buffer,
728                                     const struct uinput_ff_upload *ff_up)
729 {
730         if (in_compat_syscall()) {
731                 struct uinput_ff_upload_compat ff_up_compat;
732
733                 ff_up_compat.request_id = ff_up->request_id;
734                 ff_up_compat.retval = ff_up->retval;
735                 /*
736                  * It so happens that the pointer that gives us the trouble
737                  * is the last field in the structure. Since we don't support
738                  * custom waveforms in uinput anyway we can just copy the whole
739                  * thing (to the compat size) and ignore the pointer.
740                  */
741                 memcpy(&ff_up_compat.effect, &ff_up->effect,
742                         sizeof(struct ff_effect_compat));
743                 memcpy(&ff_up_compat.old, &ff_up->old,
744                         sizeof(struct ff_effect_compat));
745
746                 if (copy_to_user(buffer, &ff_up_compat,
747                                  sizeof(struct uinput_ff_upload_compat)))
748                         return -EFAULT;
749         } else {
750                 if (copy_to_user(buffer, ff_up,
751                                  sizeof(struct uinput_ff_upload)))
752                         return -EFAULT;
753         }
754
755         return 0;
756 }
757
758 static int uinput_ff_upload_from_user(const char __user *buffer,
759                                       struct uinput_ff_upload *ff_up)
760 {
761         if (in_compat_syscall()) {
762                 struct uinput_ff_upload_compat ff_up_compat;
763
764                 if (copy_from_user(&ff_up_compat, buffer,
765                                    sizeof(struct uinput_ff_upload_compat)))
766                         return -EFAULT;
767
768                 ff_up->request_id = ff_up_compat.request_id;
769                 ff_up->retval = ff_up_compat.retval;
770                 memcpy(&ff_up->effect, &ff_up_compat.effect,
771                         sizeof(struct ff_effect_compat));
772                 memcpy(&ff_up->old, &ff_up_compat.old,
773                         sizeof(struct ff_effect_compat));
774
775         } else {
776                 if (copy_from_user(ff_up, buffer,
777                                    sizeof(struct uinput_ff_upload)))
778                         return -EFAULT;
779         }
780
781         return 0;
782 }
783
784 #else
785
786 static int uinput_ff_upload_to_user(char __user *buffer,
787                                     const struct uinput_ff_upload *ff_up)
788 {
789         if (copy_to_user(buffer, ff_up, sizeof(struct uinput_ff_upload)))
790                 return -EFAULT;
791
792         return 0;
793 }
794
795 static int uinput_ff_upload_from_user(const char __user *buffer,
796                                       struct uinput_ff_upload *ff_up)
797 {
798         if (copy_from_user(ff_up, buffer, sizeof(struct uinput_ff_upload)))
799                 return -EFAULT;
800
801         return 0;
802 }
803
804 #endif
805
806 #define uinput_set_bit(_arg, _bit, _max)                \
807 ({                                                      \
808         int __ret = 0;                                  \
809         if (udev->state == UIST_CREATED)                \
810                 __ret =  -EINVAL;                       \
811         else if ((_arg) > (_max))                       \
812                 __ret = -EINVAL;                        \
813         else set_bit((_arg), udev->dev->_bit);          \
814         __ret;                                          \
815 })
816
817 static int uinput_str_to_user(void __user *dest, const char *str,
818                               unsigned int maxlen)
819 {
820         char __user *p = dest;
821         int len, ret;
822
823         if (!str)
824                 return -ENOENT;
825
826         if (maxlen == 0)
827                 return -EINVAL;
828
829         len = strlen(str) + 1;
830         if (len > maxlen)
831                 len = maxlen;
832
833         ret = copy_to_user(p, str, len);
834         if (ret)
835                 return -EFAULT;
836
837         /* force terminating '\0' */
838         ret = put_user(0, p + len - 1);
839         return ret ? -EFAULT : len;
840 }
841
842 static long uinput_ioctl_handler(struct file *file, unsigned int cmd,
843                                  unsigned long arg, void __user *p)
844 {
845         int                     retval;
846         struct uinput_device    *udev = file->private_data;
847         struct uinput_ff_upload ff_up;
848         struct uinput_ff_erase  ff_erase;
849         struct uinput_request   *req;
850         char                    *phys;
851         const char              *name;
852         unsigned int            size;
853
854         retval = mutex_lock_interruptible(&udev->mutex);
855         if (retval)
856                 return retval;
857
858         if (!udev->dev) {
859                 udev->dev = input_allocate_device();
860                 if (!udev->dev) {
861                         retval = -ENOMEM;
862                         goto out;
863                 }
864         }
865
866         switch (cmd) {
867         case UI_GET_VERSION:
868                 if (put_user(UINPUT_VERSION, (unsigned int __user *)p))
869                         retval = -EFAULT;
870                 goto out;
871
872         case UI_DEV_CREATE:
873                 retval = uinput_create_device(udev);
874                 goto out;
875
876         case UI_DEV_DESTROY:
877                 uinput_destroy_device(udev);
878                 goto out;
879
880         case UI_DEV_SETUP:
881                 retval = uinput_dev_setup(udev, p);
882                 goto out;
883
884         /* UI_ABS_SETUP is handled in the variable size ioctls */
885
886         case UI_SET_EVBIT:
887                 retval = uinput_set_bit(arg, evbit, EV_MAX);
888                 goto out;
889
890         case UI_SET_KEYBIT:
891                 retval = uinput_set_bit(arg, keybit, KEY_MAX);
892                 goto out;
893
894         case UI_SET_RELBIT:
895                 retval = uinput_set_bit(arg, relbit, REL_MAX);
896                 goto out;
897
898         case UI_SET_ABSBIT:
899                 retval = uinput_set_bit(arg, absbit, ABS_MAX);
900                 goto out;
901
902         case UI_SET_MSCBIT:
903                 retval = uinput_set_bit(arg, mscbit, MSC_MAX);
904                 goto out;
905
906         case UI_SET_LEDBIT:
907                 retval = uinput_set_bit(arg, ledbit, LED_MAX);
908                 goto out;
909
910         case UI_SET_SNDBIT:
911                 retval = uinput_set_bit(arg, sndbit, SND_MAX);
912                 goto out;
913
914         case UI_SET_FFBIT:
915                 retval = uinput_set_bit(arg, ffbit, FF_MAX);
916                 goto out;
917
918         case UI_SET_SWBIT:
919                 retval = uinput_set_bit(arg, swbit, SW_MAX);
920                 goto out;
921
922         case UI_SET_PROPBIT:
923                 retval = uinput_set_bit(arg, propbit, INPUT_PROP_MAX);
924                 goto out;
925
926         case UI_SET_PHYS:
927                 if (udev->state == UIST_CREATED) {
928                         retval = -EINVAL;
929                         goto out;
930                 }
931
932                 phys = strndup_user(p, 1024);
933                 if (IS_ERR(phys)) {
934                         retval = PTR_ERR(phys);
935                         goto out;
936                 }
937
938                 kfree(udev->dev->phys);
939                 udev->dev->phys = phys;
940                 goto out;
941
942         case UI_BEGIN_FF_UPLOAD:
943                 retval = uinput_ff_upload_from_user(p, &ff_up);
944                 if (retval)
945                         goto out;
946
947                 req = uinput_request_find(udev, ff_up.request_id);
948                 if (!req || req->code != UI_FF_UPLOAD ||
949                     !req->u.upload.effect) {
950                         retval = -EINVAL;
951                         goto out;
952                 }
953
954                 ff_up.retval = 0;
955                 ff_up.effect = *req->u.upload.effect;
956                 if (req->u.upload.old)
957                         ff_up.old = *req->u.upload.old;
958                 else
959                         memset(&ff_up.old, 0, sizeof(struct ff_effect));
960
961                 retval = uinput_ff_upload_to_user(p, &ff_up);
962                 goto out;
963
964         case UI_BEGIN_FF_ERASE:
965                 if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) {
966                         retval = -EFAULT;
967                         goto out;
968                 }
969
970                 req = uinput_request_find(udev, ff_erase.request_id);
971                 if (!req || req->code != UI_FF_ERASE) {
972                         retval = -EINVAL;
973                         goto out;
974                 }
975
976                 ff_erase.retval = 0;
977                 ff_erase.effect_id = req->u.effect_id;
978                 if (copy_to_user(p, &ff_erase, sizeof(ff_erase))) {
979                         retval = -EFAULT;
980                         goto out;
981                 }
982
983                 goto out;
984
985         case UI_END_FF_UPLOAD:
986                 retval = uinput_ff_upload_from_user(p, &ff_up);
987                 if (retval)
988                         goto out;
989
990                 req = uinput_request_find(udev, ff_up.request_id);
991                 if (!req || req->code != UI_FF_UPLOAD ||
992                     !req->u.upload.effect) {
993                         retval = -EINVAL;
994                         goto out;
995                 }
996
997                 req->retval = ff_up.retval;
998                 complete(&req->done);
999                 goto out;
1000
1001         case UI_END_FF_ERASE:
1002                 if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) {
1003                         retval = -EFAULT;
1004                         goto out;
1005                 }
1006
1007                 req = uinput_request_find(udev, ff_erase.request_id);
1008                 if (!req || req->code != UI_FF_ERASE) {
1009                         retval = -EINVAL;
1010                         goto out;
1011                 }
1012
1013                 req->retval = ff_erase.retval;
1014                 complete(&req->done);
1015                 goto out;
1016         }
1017
1018         size = _IOC_SIZE(cmd);
1019
1020         /* Now check variable-length commands */
1021         switch (cmd & ~IOCSIZE_MASK) {
1022         case UI_GET_SYSNAME(0):
1023                 if (udev->state != UIST_CREATED) {
1024                         retval = -ENOENT;
1025                         goto out;
1026                 }
1027                 name = dev_name(&udev->dev->dev);
1028                 retval = uinput_str_to_user(p, name, size);
1029                 goto out;
1030
1031         case UI_ABS_SETUP & ~IOCSIZE_MASK:
1032                 retval = uinput_abs_setup(udev, p, size);
1033                 goto out;
1034         }
1035
1036         retval = -EINVAL;
1037  out:
1038         mutex_unlock(&udev->mutex);
1039         return retval;
1040 }
1041
1042 static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1043 {
1044         return uinput_ioctl_handler(file, cmd, arg, (void __user *)arg);
1045 }
1046
1047 #ifdef CONFIG_COMPAT
1048
1049 #define UI_SET_PHYS_COMPAT      _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t)
1050
1051 static long uinput_compat_ioctl(struct file *file,
1052                                 unsigned int cmd, unsigned long arg)
1053 {
1054         if (cmd == UI_SET_PHYS_COMPAT)
1055                 cmd = UI_SET_PHYS;
1056
1057         return uinput_ioctl_handler(file, cmd, arg, compat_ptr(arg));
1058 }
1059 #endif
1060
1061 static const struct file_operations uinput_fops = {
1062         .owner          = THIS_MODULE,
1063         .open           = uinput_open,
1064         .release        = uinput_release,
1065         .read           = uinput_read,
1066         .write          = uinput_write,
1067         .poll           = uinput_poll,
1068         .unlocked_ioctl = uinput_ioctl,
1069 #ifdef CONFIG_COMPAT
1070         .compat_ioctl   = uinput_compat_ioctl,
1071 #endif
1072         .llseek         = no_llseek,
1073 };
1074
1075 static struct miscdevice uinput_misc = {
1076         .fops           = &uinput_fops,
1077         .minor          = UINPUT_MINOR,
1078         .name           = UINPUT_NAME,
1079 };
1080 module_misc_device(uinput_misc);
1081
1082 MODULE_ALIAS_MISCDEV(UINPUT_MINOR);
1083 MODULE_ALIAS("devname:" UINPUT_NAME);
1084
1085 MODULE_AUTHOR("Aristeu Sergio Rozanski Filho");
1086 MODULE_DESCRIPTION("User level driver support for input subsystem");
1087 MODULE_LICENSE("GPL");
1088 MODULE_VERSION("0.3");