1443 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2/*3 * Event char devices, giving access to raw input device events.4 *5 * Copyright (c) 1999-2002 Vojtech Pavlik6 */7 8#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt9 10#define EVDEV_MINOR_BASE 6411#define EVDEV_MINORS 3212#define EVDEV_MIN_BUFFER_SIZE 64U13#define EVDEV_BUF_PACKETS 814 15#include <linux/poll.h>16#include <linux/sched.h>17#include <linux/slab.h>18#include <linux/vmalloc.h>19#include <linux/mm.h>20#include <linux/module.h>21#include <linux/init.h>22#include <linux/input/mt.h>23#include <linux/major.h>24#include <linux/device.h>25#include <linux/cdev.h>26#include "input-compat.h"27 28struct evdev {29 int open;30 struct input_handle handle;31 struct evdev_client __rcu *grab;32 struct list_head client_list;33 spinlock_t client_lock; /* protects client_list */34 struct mutex mutex;35 struct device dev;36 struct cdev cdev;37 bool exist;38};39 40struct evdev_client {41 unsigned int head;42 unsigned int tail;43 unsigned int packet_head; /* [future] position of the first element of next packet */44 spinlock_t buffer_lock; /* protects access to buffer, head and tail */45 wait_queue_head_t wait;46 struct fasync_struct *fasync;47 struct evdev *evdev;48 struct list_head node;49 enum input_clock_type clk_type;50 bool revoked;51 unsigned long *evmasks[EV_CNT];52 unsigned int bufsize;53 struct input_event buffer[] __counted_by(bufsize);54};55 56static size_t evdev_get_mask_cnt(unsigned int type)57{58 static const size_t counts[EV_CNT] = {59 /* EV_SYN==0 is EV_CNT, _not_ SYN_CNT, see EVIOCGBIT */60 [EV_SYN] = EV_CNT,61 [EV_KEY] = KEY_CNT,62 [EV_REL] = REL_CNT,63 [EV_ABS] = ABS_CNT,64 [EV_MSC] = MSC_CNT,65 [EV_SW] = SW_CNT,66 [EV_LED] = LED_CNT,67 [EV_SND] = SND_CNT,68 [EV_FF] = FF_CNT,69 };70 71 return (type < EV_CNT) ? counts[type] : 0;72}73 74/* requires the buffer lock to be held */75static bool __evdev_is_filtered(struct evdev_client *client,76 unsigned int type,77 unsigned int code)78{79 unsigned long *mask;80 size_t cnt;81 82 /* EV_SYN and unknown codes are never filtered */83 if (type == EV_SYN || type >= EV_CNT)84 return false;85 86 /* first test whether the type is filtered */87 mask = client->evmasks[0];88 if (mask && !test_bit(type, mask))89 return true;90 91 /* unknown values are never filtered */92 cnt = evdev_get_mask_cnt(type);93 if (!cnt || code >= cnt)94 return false;95 96 mask = client->evmasks[type];97 return mask && !test_bit(code, mask);98}99 100/* flush queued events of type @type, caller must hold client->buffer_lock */101static void __evdev_flush_queue(struct evdev_client *client, unsigned int type)102{103 unsigned int i, head, num;104 unsigned int mask = client->bufsize - 1;105 bool is_report;106 struct input_event *ev;107 108 BUG_ON(type == EV_SYN);109 110 head = client->tail;111 client->packet_head = client->tail;112 113 /* init to 1 so a leading SYN_REPORT will not be dropped */114 num = 1;115 116 for (i = client->tail; i != client->head; i = (i + 1) & mask) {117 ev = &client->buffer[i];118 is_report = ev->type == EV_SYN && ev->code == SYN_REPORT;119 120 if (ev->type == type) {121 /* drop matched entry */122 continue;123 } else if (is_report && !num) {124 /* drop empty SYN_REPORT groups */125 continue;126 } else if (head != i) {127 /* move entry to fill the gap */128 client->buffer[head] = *ev;129 }130 131 num++;132 head = (head + 1) & mask;133 134 if (is_report) {135 num = 0;136 client->packet_head = head;137 }138 }139 140 client->head = head;141}142 143static void __evdev_queue_syn_dropped(struct evdev_client *client)144{145 ktime_t *ev_time = input_get_timestamp(client->evdev->handle.dev);146 struct timespec64 ts = ktime_to_timespec64(ev_time[client->clk_type]);147 struct input_event ev;148 149 ev.input_event_sec = ts.tv_sec;150 ev.input_event_usec = ts.tv_nsec / NSEC_PER_USEC;151 ev.type = EV_SYN;152 ev.code = SYN_DROPPED;153 ev.value = 0;154 155 client->buffer[client->head++] = ev;156 client->head &= client->bufsize - 1;157 158 if (unlikely(client->head == client->tail)) {159 /* drop queue but keep our SYN_DROPPED event */160 client->tail = (client->head - 1) & (client->bufsize - 1);161 client->packet_head = client->tail;162 }163}164 165static void evdev_queue_syn_dropped(struct evdev_client *client)166{167 unsigned long flags;168 169 spin_lock_irqsave(&client->buffer_lock, flags);170 __evdev_queue_syn_dropped(client);171 spin_unlock_irqrestore(&client->buffer_lock, flags);172}173 174static int evdev_set_clk_type(struct evdev_client *client, unsigned int clkid)175{176 unsigned long flags;177 enum input_clock_type clk_type;178 179 switch (clkid) {180 181 case CLOCK_REALTIME:182 clk_type = INPUT_CLK_REAL;183 break;184 case CLOCK_MONOTONIC:185 clk_type = INPUT_CLK_MONO;186 break;187 case CLOCK_BOOTTIME:188 clk_type = INPUT_CLK_BOOT;189 break;190 default:191 return -EINVAL;192 }193 194 if (client->clk_type != clk_type) {195 client->clk_type = clk_type;196 197 /*198 * Flush pending events and queue SYN_DROPPED event,199 * but only if the queue is not empty.200 */201 spin_lock_irqsave(&client->buffer_lock, flags);202 203 if (client->head != client->tail) {204 client->packet_head = client->head = client->tail;205 __evdev_queue_syn_dropped(client);206 }207 208 spin_unlock_irqrestore(&client->buffer_lock, flags);209 }210 211 return 0;212}213 214static void __pass_event(struct evdev_client *client,215 const struct input_event *event)216{217 client->buffer[client->head++] = *event;218 client->head &= client->bufsize - 1;219 220 if (unlikely(client->head == client->tail)) {221 /*222 * This effectively "drops" all unconsumed events, leaving223 * EV_SYN/SYN_DROPPED plus the newest event in the queue.224 */225 client->tail = (client->head - 2) & (client->bufsize - 1);226 227 client->buffer[client->tail] = (struct input_event) {228 .input_event_sec = event->input_event_sec,229 .input_event_usec = event->input_event_usec,230 .type = EV_SYN,231 .code = SYN_DROPPED,232 .value = 0,233 };234 235 client->packet_head = client->tail;236 }237 238 if (event->type == EV_SYN && event->code == SYN_REPORT) {239 client->packet_head = client->head;240 kill_fasync(&client->fasync, SIGIO, POLL_IN);241 }242}243 244static void evdev_pass_values(struct evdev_client *client,245 const struct input_value *vals, unsigned int count,246 ktime_t *ev_time)247{248 const struct input_value *v;249 struct input_event event;250 struct timespec64 ts;251 bool wakeup = false;252 253 if (client->revoked)254 return;255 256 ts = ktime_to_timespec64(ev_time[client->clk_type]);257 event.input_event_sec = ts.tv_sec;258 event.input_event_usec = ts.tv_nsec / NSEC_PER_USEC;259 260 /* Interrupts are disabled, just acquire the lock. */261 spin_lock(&client->buffer_lock);262 263 for (v = vals; v != vals + count; v++) {264 if (__evdev_is_filtered(client, v->type, v->code))265 continue;266 267 if (v->type == EV_SYN && v->code == SYN_REPORT) {268 /* drop empty SYN_REPORT */269 if (client->packet_head == client->head)270 continue;271 272 wakeup = true;273 }274 275 event.type = v->type;276 event.code = v->code;277 event.value = v->value;278 __pass_event(client, &event);279 }280 281 spin_unlock(&client->buffer_lock);282 283 if (wakeup)284 wake_up_interruptible_poll(&client->wait,285 EPOLLIN | EPOLLOUT | EPOLLRDNORM | EPOLLWRNORM);286}287 288/*289 * Pass incoming events to all connected clients.290 */291static unsigned int evdev_events(struct input_handle *handle,292 struct input_value *vals, unsigned int count)293{294 struct evdev *evdev = handle->private;295 struct evdev_client *client;296 ktime_t *ev_time = input_get_timestamp(handle->dev);297 298 rcu_read_lock();299 300 client = rcu_dereference(evdev->grab);301 302 if (client)303 evdev_pass_values(client, vals, count, ev_time);304 else305 list_for_each_entry_rcu(client, &evdev->client_list, node)306 evdev_pass_values(client, vals, count, ev_time);307 308 rcu_read_unlock();309 310 return count;311}312 313static int evdev_fasync(int fd, struct file *file, int on)314{315 struct evdev_client *client = file->private_data;316 317 return fasync_helper(fd, file, on, &client->fasync);318}319 320static void evdev_free(struct device *dev)321{322 struct evdev *evdev = container_of(dev, struct evdev, dev);323 324 input_put_device(evdev->handle.dev);325 kfree(evdev);326}327 328/*329 * Grabs an event device (along with underlying input device).330 * This function is called with evdev->mutex taken.331 */332static int evdev_grab(struct evdev *evdev, struct evdev_client *client)333{334 int error;335 336 if (evdev->grab)337 return -EBUSY;338 339 error = input_grab_device(&evdev->handle);340 if (error)341 return error;342 343 rcu_assign_pointer(evdev->grab, client);344 345 return 0;346}347 348static int evdev_ungrab(struct evdev *evdev, struct evdev_client *client)349{350 struct evdev_client *grab = rcu_dereference_protected(evdev->grab,351 lockdep_is_held(&evdev->mutex));352 353 if (grab != client)354 return -EINVAL;355 356 rcu_assign_pointer(evdev->grab, NULL);357 synchronize_rcu();358 input_release_device(&evdev->handle);359 360 return 0;361}362 363static void evdev_attach_client(struct evdev *evdev,364 struct evdev_client *client)365{366 spin_lock(&evdev->client_lock);367 list_add_tail_rcu(&client->node, &evdev->client_list);368 spin_unlock(&evdev->client_lock);369}370 371static void evdev_detach_client(struct evdev *evdev,372 struct evdev_client *client)373{374 spin_lock(&evdev->client_lock);375 list_del_rcu(&client->node);376 spin_unlock(&evdev->client_lock);377 synchronize_rcu();378}379 380static int evdev_open_device(struct evdev *evdev)381{382 int retval;383 384 retval = mutex_lock_interruptible(&evdev->mutex);385 if (retval)386 return retval;387 388 if (!evdev->exist)389 retval = -ENODEV;390 else if (!evdev->open++) {391 retval = input_open_device(&evdev->handle);392 if (retval)393 evdev->open--;394 }395 396 mutex_unlock(&evdev->mutex);397 return retval;398}399 400static void evdev_close_device(struct evdev *evdev)401{402 mutex_lock(&evdev->mutex);403 404 if (evdev->exist && !--evdev->open)405 input_close_device(&evdev->handle);406 407 mutex_unlock(&evdev->mutex);408}409 410/*411 * Wake up users waiting for IO so they can disconnect from412 * dead device.413 */414static void evdev_hangup(struct evdev *evdev)415{416 struct evdev_client *client;417 418 spin_lock(&evdev->client_lock);419 list_for_each_entry(client, &evdev->client_list, node) {420 kill_fasync(&client->fasync, SIGIO, POLL_HUP);421 wake_up_interruptible_poll(&client->wait, EPOLLHUP | EPOLLERR);422 }423 spin_unlock(&evdev->client_lock);424}425 426static int evdev_release(struct inode *inode, struct file *file)427{428 struct evdev_client *client = file->private_data;429 struct evdev *evdev = client->evdev;430 unsigned int i;431 432 mutex_lock(&evdev->mutex);433 434 if (evdev->exist && !client->revoked)435 input_flush_device(&evdev->handle, file);436 437 evdev_ungrab(evdev, client);438 mutex_unlock(&evdev->mutex);439 440 evdev_detach_client(evdev, client);441 442 for (i = 0; i < EV_CNT; ++i)443 bitmap_free(client->evmasks[i]);444 445 kvfree(client);446 447 evdev_close_device(evdev);448 449 return 0;450}451 452static unsigned int evdev_compute_buffer_size(struct input_dev *dev)453{454 unsigned int n_events =455 max(dev->hint_events_per_packet * EVDEV_BUF_PACKETS,456 EVDEV_MIN_BUFFER_SIZE);457 458 return roundup_pow_of_two(n_events);459}460 461static int evdev_open(struct inode *inode, struct file *file)462{463 struct evdev *evdev = container_of(inode->i_cdev, struct evdev, cdev);464 unsigned int bufsize = evdev_compute_buffer_size(evdev->handle.dev);465 struct evdev_client *client;466 int error;467 468 client = kvzalloc(struct_size(client, buffer, bufsize), GFP_KERNEL);469 if (!client)470 return -ENOMEM;471 472 init_waitqueue_head(&client->wait);473 client->bufsize = bufsize;474 spin_lock_init(&client->buffer_lock);475 client->evdev = evdev;476 evdev_attach_client(evdev, client);477 478 error = evdev_open_device(evdev);479 if (error)480 goto err_free_client;481 482 file->private_data = client;483 stream_open(inode, file);484 485 return 0;486 487 err_free_client:488 evdev_detach_client(evdev, client);489 kvfree(client);490 return error;491}492 493static ssize_t evdev_write(struct file *file, const char __user *buffer,494 size_t count, loff_t *ppos)495{496 struct evdev_client *client = file->private_data;497 struct evdev *evdev = client->evdev;498 struct input_event event;499 int retval = 0;500 501 /*502 * Limit amount of data we inject into the input subsystem so that503 * we do not hold evdev->mutex for too long. 4096 bytes corresponds504 * to 170 input events.505 */506 count = min(count, 4096);507 508 if (count != 0 && count < input_event_size())509 return -EINVAL;510 511 retval = mutex_lock_interruptible(&evdev->mutex);512 if (retval)513 return retval;514 515 if (!evdev->exist || client->revoked) {516 retval = -ENODEV;517 goto out;518 }519 520 while (retval + input_event_size() <= count) {521 522 if (input_event_from_user(buffer + retval, &event)) {523 retval = -EFAULT;524 goto out;525 }526 retval += input_event_size();527 528 input_inject_event(&evdev->handle,529 event.type, event.code, event.value);530 cond_resched();531 }532 533 out:534 mutex_unlock(&evdev->mutex);535 return retval;536}537 538static int evdev_fetch_next_event(struct evdev_client *client,539 struct input_event *event)540{541 int have_event;542 543 spin_lock_irq(&client->buffer_lock);544 545 have_event = client->packet_head != client->tail;546 if (have_event) {547 *event = client->buffer[client->tail++];548 client->tail &= client->bufsize - 1;549 }550 551 spin_unlock_irq(&client->buffer_lock);552 553 return have_event;554}555 556static ssize_t evdev_read(struct file *file, char __user *buffer,557 size_t count, loff_t *ppos)558{559 struct evdev_client *client = file->private_data;560 struct evdev *evdev = client->evdev;561 struct input_event event;562 size_t read = 0;563 int error;564 565 if (count != 0 && count < input_event_size())566 return -EINVAL;567 568 for (;;) {569 if (!evdev->exist || client->revoked)570 return -ENODEV;571 572 if (client->packet_head == client->tail &&573 (file->f_flags & O_NONBLOCK))574 return -EAGAIN;575 576 /*577 * count == 0 is special - no IO is done but we check578 * for error conditions (see above).579 */580 if (count == 0)581 break;582 583 while (read + input_event_size() <= count &&584 evdev_fetch_next_event(client, &event)) {585 586 if (input_event_to_user(buffer + read, &event))587 return -EFAULT;588 589 read += input_event_size();590 }591 592 if (read)593 break;594 595 if (!(file->f_flags & O_NONBLOCK)) {596 error = wait_event_interruptible(client->wait,597 client->packet_head != client->tail ||598 !evdev->exist || client->revoked);599 if (error)600 return error;601 }602 }603 604 return read;605}606 607/* No kernel lock - fine */608static __poll_t evdev_poll(struct file *file, poll_table *wait)609{610 struct evdev_client *client = file->private_data;611 struct evdev *evdev = client->evdev;612 __poll_t mask;613 614 poll_wait(file, &client->wait, wait);615 616 if (evdev->exist && !client->revoked)617 mask = EPOLLOUT | EPOLLWRNORM;618 else619 mask = EPOLLHUP | EPOLLERR;620 621 if (client->packet_head != client->tail)622 mask |= EPOLLIN | EPOLLRDNORM;623 624 return mask;625}626 627#ifdef CONFIG_COMPAT628 629#define BITS_PER_LONG_COMPAT (sizeof(compat_long_t) * 8)630#define BITS_TO_LONGS_COMPAT(x) ((((x) - 1) / BITS_PER_LONG_COMPAT) + 1)631 632#ifdef __BIG_ENDIAN633static int bits_to_user(unsigned long *bits, unsigned int maxbit,634 unsigned int maxlen, void __user *p, int compat)635{636 int len, i;637 638 if (compat) {639 len = BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t);640 if (len > maxlen)641 len = maxlen;642 643 for (i = 0; i < len / sizeof(compat_long_t); i++)644 if (copy_to_user((compat_long_t __user *) p + i,645 (compat_long_t *) bits +646 i + 1 - ((i % 2) << 1),647 sizeof(compat_long_t)))648 return -EFAULT;649 } else {650 len = BITS_TO_LONGS(maxbit) * sizeof(long);651 if (len > maxlen)652 len = maxlen;653 654 if (copy_to_user(p, bits, len))655 return -EFAULT;656 }657 658 return len;659}660 661static int bits_from_user(unsigned long *bits, unsigned int maxbit,662 unsigned int maxlen, const void __user *p, int compat)663{664 int len, i;665 666 if (compat) {667 if (maxlen % sizeof(compat_long_t))668 return -EINVAL;669 670 len = BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t);671 if (len > maxlen)672 len = maxlen;673 674 for (i = 0; i < len / sizeof(compat_long_t); i++)675 if (copy_from_user((compat_long_t *) bits +676 i + 1 - ((i % 2) << 1),677 (compat_long_t __user *) p + i,678 sizeof(compat_long_t)))679 return -EFAULT;680 if (i % 2)681 *((compat_long_t *) bits + i - 1) = 0;682 683 } else {684 if (maxlen % sizeof(long))685 return -EINVAL;686 687 len = BITS_TO_LONGS(maxbit) * sizeof(long);688 if (len > maxlen)689 len = maxlen;690 691 if (copy_from_user(bits, p, len))692 return -EFAULT;693 }694 695 return len;696}697 698#else699 700static int bits_to_user(unsigned long *bits, unsigned int maxbit,701 unsigned int maxlen, void __user *p, int compat)702{703 int len = compat ?704 BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t) :705 BITS_TO_LONGS(maxbit) * sizeof(long);706 707 if (len > maxlen)708 len = maxlen;709 710 return copy_to_user(p, bits, len) ? -EFAULT : len;711}712 713static int bits_from_user(unsigned long *bits, unsigned int maxbit,714 unsigned int maxlen, const void __user *p, int compat)715{716 size_t chunk_size = compat ? sizeof(compat_long_t) : sizeof(long);717 int len;718 719 if (maxlen % chunk_size)720 return -EINVAL;721 722 len = compat ? BITS_TO_LONGS_COMPAT(maxbit) : BITS_TO_LONGS(maxbit);723 len *= chunk_size;724 if (len > maxlen)725 len = maxlen;726 727 return copy_from_user(bits, p, len) ? -EFAULT : len;728}729 730#endif /* __BIG_ENDIAN */731 732#else733 734static int bits_to_user(unsigned long *bits, unsigned int maxbit,735 unsigned int maxlen, void __user *p, int compat)736{737 int len = BITS_TO_LONGS(maxbit) * sizeof(long);738 739 if (len > maxlen)740 len = maxlen;741 742 return copy_to_user(p, bits, len) ? -EFAULT : len;743}744 745static int bits_from_user(unsigned long *bits, unsigned int maxbit,746 unsigned int maxlen, const void __user *p, int compat)747{748 int len;749 750 if (maxlen % sizeof(long))751 return -EINVAL;752 753 len = BITS_TO_LONGS(maxbit) * sizeof(long);754 if (len > maxlen)755 len = maxlen;756 757 return copy_from_user(bits, p, len) ? -EFAULT : len;758}759 760#endif /* CONFIG_COMPAT */761 762static int str_to_user(const char *str, unsigned int maxlen, void __user *p)763{764 int len;765 766 if (!str)767 return -ENOENT;768 769 len = strlen(str) + 1;770 if (len > maxlen)771 len = maxlen;772 773 return copy_to_user(p, str, len) ? -EFAULT : len;774}775 776static int handle_eviocgbit(struct input_dev *dev,777 unsigned int type, unsigned int size,778 void __user *p, int compat_mode)779{780 unsigned long *bits;781 int len;782 783 switch (type) {784 785 case 0: bits = dev->evbit; len = EV_MAX; break;786 case EV_KEY: bits = dev->keybit; len = KEY_MAX; break;787 case EV_REL: bits = dev->relbit; len = REL_MAX; break;788 case EV_ABS: bits = dev->absbit; len = ABS_MAX; break;789 case EV_MSC: bits = dev->mscbit; len = MSC_MAX; break;790 case EV_LED: bits = dev->ledbit; len = LED_MAX; break;791 case EV_SND: bits = dev->sndbit; len = SND_MAX; break;792 case EV_FF: bits = dev->ffbit; len = FF_MAX; break;793 case EV_SW: bits = dev->swbit; len = SW_MAX; break;794 default: return -EINVAL;795 }796 797 return bits_to_user(bits, len, size, p, compat_mode);798}799 800static int evdev_handle_get_keycode(struct input_dev *dev, void __user *p)801{802 struct input_keymap_entry ke = {803 .len = sizeof(unsigned int),804 .flags = 0,805 };806 int __user *ip = (int __user *)p;807 int error;808 809 /* legacy case */810 if (copy_from_user(ke.scancode, p, sizeof(unsigned int)))811 return -EFAULT;812 813 error = input_get_keycode(dev, &ke);814 if (error)815 return error;816 817 if (put_user(ke.keycode, ip + 1))818 return -EFAULT;819 820 return 0;821}822 823static int evdev_handle_get_keycode_v2(struct input_dev *dev, void __user *p)824{825 struct input_keymap_entry ke;826 int error;827 828 if (copy_from_user(&ke, p, sizeof(ke)))829 return -EFAULT;830 831 error = input_get_keycode(dev, &ke);832 if (error)833 return error;834 835 if (copy_to_user(p, &ke, sizeof(ke)))836 return -EFAULT;837 838 return 0;839}840 841static int evdev_handle_set_keycode(struct input_dev *dev, void __user *p)842{843 struct input_keymap_entry ke = {844 .len = sizeof(unsigned int),845 .flags = 0,846 };847 int __user *ip = (int __user *)p;848 849 if (copy_from_user(ke.scancode, p, sizeof(unsigned int)))850 return -EFAULT;851 852 if (get_user(ke.keycode, ip + 1))853 return -EFAULT;854 855 return input_set_keycode(dev, &ke);856}857 858static int evdev_handle_set_keycode_v2(struct input_dev *dev, void __user *p)859{860 struct input_keymap_entry ke;861 862 if (copy_from_user(&ke, p, sizeof(ke)))863 return -EFAULT;864 865 if (ke.len > sizeof(ke.scancode))866 return -EINVAL;867 868 return input_set_keycode(dev, &ke);869}870 871/*872 * If we transfer state to the user, we should flush all pending events873 * of the same type from the client's queue. Otherwise, they might end up874 * with duplicate events, which can screw up client's state tracking.875 * If bits_to_user fails after flushing the queue, we queue a SYN_DROPPED876 * event so user-space will notice missing events.877 *878 * LOCKING:879 * We need to take event_lock before buffer_lock to avoid dead-locks. But we880 * need the even_lock only to guarantee consistent state. We can safely release881 * it while flushing the queue. This allows input-core to handle filters while882 * we flush the queue.883 */884static int evdev_handle_get_val(struct evdev_client *client,885 struct input_dev *dev, unsigned int type,886 unsigned long *bits, unsigned int maxbit,887 unsigned int maxlen, void __user *p,888 int compat)889{890 int ret;891 unsigned long *mem;892 893 mem = bitmap_alloc(maxbit, GFP_KERNEL);894 if (!mem)895 return -ENOMEM;896 897 spin_lock_irq(&dev->event_lock);898 spin_lock(&client->buffer_lock);899 900 bitmap_copy(mem, bits, maxbit);901 902 spin_unlock(&dev->event_lock);903 904 __evdev_flush_queue(client, type);905 906 spin_unlock_irq(&client->buffer_lock);907 908 ret = bits_to_user(mem, maxbit, maxlen, p, compat);909 if (ret < 0)910 evdev_queue_syn_dropped(client);911 912 bitmap_free(mem);913 914 return ret;915}916 917static int evdev_handle_mt_request(struct input_dev *dev,918 unsigned int size,919 int __user *ip)920{921 const struct input_mt *mt = dev->mt;922 unsigned int code;923 int max_slots;924 int i;925 926 if (get_user(code, &ip[0]))927 return -EFAULT;928 if (!mt || !input_is_mt_value(code))929 return -EINVAL;930 931 max_slots = (size - sizeof(__u32)) / sizeof(__s32);932 for (i = 0; i < mt->num_slots && i < max_slots; i++) {933 int value = input_mt_get_value(&mt->slots[i], code);934 if (put_user(value, &ip[1 + i]))935 return -EFAULT;936 }937 938 return 0;939}940 941static int evdev_revoke(struct evdev *evdev, struct evdev_client *client,942 struct file *file)943{944 client->revoked = true;945 evdev_ungrab(evdev, client);946 input_flush_device(&evdev->handle, file);947 wake_up_interruptible_poll(&client->wait, EPOLLHUP | EPOLLERR);948 949 return 0;950}951 952/* must be called with evdev-mutex held */953static int evdev_set_mask(struct evdev_client *client,954 unsigned int type,955 const void __user *codes,956 u32 codes_size,957 int compat)958{959 unsigned long flags, *mask, *oldmask;960 size_t cnt;961 int error;962 963 /* we allow unknown types and 'codes_size > size' for forward-compat */964 cnt = evdev_get_mask_cnt(type);965 if (!cnt)966 return 0;967 968 mask = bitmap_zalloc(cnt, GFP_KERNEL);969 if (!mask)970 return -ENOMEM;971 972 error = bits_from_user(mask, cnt - 1, codes_size, codes, compat);973 if (error < 0) {974 bitmap_free(mask);975 return error;976 }977 978 spin_lock_irqsave(&client->buffer_lock, flags);979 oldmask = client->evmasks[type];980 client->evmasks[type] = mask;981 spin_unlock_irqrestore(&client->buffer_lock, flags);982 983 bitmap_free(oldmask);984 985 return 0;986}987 988/* must be called with evdev-mutex held */989static int evdev_get_mask(struct evdev_client *client,990 unsigned int type,991 void __user *codes,992 u32 codes_size,993 int compat)994{995 unsigned long *mask;996 size_t cnt, size, xfer_size;997 int i;998 int error;999 1000 /* we allow unknown types and 'codes_size > size' for forward-compat */1001 cnt = evdev_get_mask_cnt(type);1002 size = sizeof(unsigned long) * BITS_TO_LONGS(cnt);1003 xfer_size = min_t(size_t, codes_size, size);1004 1005 if (cnt > 0) {1006 mask = client->evmasks[type];1007 if (mask) {1008 error = bits_to_user(mask, cnt - 1,1009 xfer_size, codes, compat);1010 if (error < 0)1011 return error;1012 } else {1013 /* fake mask with all bits set */1014 for (i = 0; i < xfer_size; i++)1015 if (put_user(0xffU, (u8 __user *)codes + i))1016 return -EFAULT;1017 }1018 }1019 1020 if (xfer_size < codes_size)1021 if (clear_user(codes + xfer_size, codes_size - xfer_size))1022 return -EFAULT;1023 1024 return 0;1025}1026 1027static long evdev_do_ioctl(struct file *file, unsigned int cmd,1028 void __user *p, int compat_mode)1029{1030 struct evdev_client *client = file->private_data;1031 struct evdev *evdev = client->evdev;1032 struct input_dev *dev = evdev->handle.dev;1033 struct input_absinfo abs;1034 struct input_mask mask;1035 struct ff_effect effect;1036 int __user *ip = (int __user *)p;1037 unsigned int i, t, u, v;1038 unsigned int size;1039 int error;1040 1041 /* First we check for fixed-length commands */1042 switch (cmd) {1043 1044 case EVIOCGVERSION:1045 return put_user(EV_VERSION, ip);1046 1047 case EVIOCGID:1048 if (copy_to_user(p, &dev->id, sizeof(struct input_id)))1049 return -EFAULT;1050 return 0;1051 1052 case EVIOCGREP:1053 if (!test_bit(EV_REP, dev->evbit))1054 return -ENOSYS;1055 if (put_user(dev->rep[REP_DELAY], ip))1056 return -EFAULT;1057 if (put_user(dev->rep[REP_PERIOD], ip + 1))1058 return -EFAULT;1059 return 0;1060 1061 case EVIOCSREP:1062 if (!test_bit(EV_REP, dev->evbit))1063 return -ENOSYS;1064 if (get_user(u, ip))1065 return -EFAULT;1066 if (get_user(v, ip + 1))1067 return -EFAULT;1068 1069 input_inject_event(&evdev->handle, EV_REP, REP_DELAY, u);1070 input_inject_event(&evdev->handle, EV_REP, REP_PERIOD, v);1071 1072 return 0;1073 1074 case EVIOCRMFF:1075 return input_ff_erase(dev, (int)(unsigned long) p, file);1076 1077 case EVIOCGEFFECTS:1078 i = test_bit(EV_FF, dev->evbit) ?1079 dev->ff->max_effects : 0;1080 if (put_user(i, ip))1081 return -EFAULT;1082 return 0;1083 1084 case EVIOCGRAB:1085 if (p)1086 return evdev_grab(evdev, client);1087 else1088 return evdev_ungrab(evdev, client);1089 1090 case EVIOCREVOKE:1091 if (p)1092 return -EINVAL;1093 else1094 return evdev_revoke(evdev, client, file);1095 1096 case EVIOCGMASK: {1097 void __user *codes_ptr;1098 1099 if (copy_from_user(&mask, p, sizeof(mask)))1100 return -EFAULT;1101 1102 codes_ptr = (void __user *)(unsigned long)mask.codes_ptr;1103 return evdev_get_mask(client,1104 mask.type, codes_ptr, mask.codes_size,1105 compat_mode);1106 }1107 1108 case EVIOCSMASK: {1109 const void __user *codes_ptr;1110 1111 if (copy_from_user(&mask, p, sizeof(mask)))1112 return -EFAULT;1113 1114 codes_ptr = (const void __user *)(unsigned long)mask.codes_ptr;1115 return evdev_set_mask(client,1116 mask.type, codes_ptr, mask.codes_size,1117 compat_mode);1118 }1119 1120 case EVIOCSCLOCKID:1121 if (copy_from_user(&i, p, sizeof(unsigned int)))1122 return -EFAULT;1123 1124 return evdev_set_clk_type(client, i);1125 1126 case EVIOCGKEYCODE:1127 return evdev_handle_get_keycode(dev, p);1128 1129 case EVIOCSKEYCODE:1130 return evdev_handle_set_keycode(dev, p);1131 1132 case EVIOCGKEYCODE_V2:1133 return evdev_handle_get_keycode_v2(dev, p);1134 1135 case EVIOCSKEYCODE_V2:1136 return evdev_handle_set_keycode_v2(dev, p);1137 }1138 1139 size = _IOC_SIZE(cmd);1140 1141 /* Now check variable-length commands */1142#define EVIOC_MASK_SIZE(nr) ((nr) & ~(_IOC_SIZEMASK << _IOC_SIZESHIFT))1143 switch (EVIOC_MASK_SIZE(cmd)) {1144 1145 case EVIOCGPROP(0):1146 return bits_to_user(dev->propbit, INPUT_PROP_MAX,1147 size, p, compat_mode);1148 1149 case EVIOCGMTSLOTS(0):1150 return evdev_handle_mt_request(dev, size, ip);1151 1152 case EVIOCGKEY(0):1153 return evdev_handle_get_val(client, dev, EV_KEY, dev->key,1154 KEY_MAX, size, p, compat_mode);1155 1156 case EVIOCGLED(0):1157 return evdev_handle_get_val(client, dev, EV_LED, dev->led,1158 LED_MAX, size, p, compat_mode);1159 1160 case EVIOCGSND(0):1161 return evdev_handle_get_val(client, dev, EV_SND, dev->snd,1162 SND_MAX, size, p, compat_mode);1163 1164 case EVIOCGSW(0):1165 return evdev_handle_get_val(client, dev, EV_SW, dev->sw,1166 SW_MAX, size, p, compat_mode);1167 1168 case EVIOCGNAME(0):1169 return str_to_user(dev->name, size, p);1170 1171 case EVIOCGPHYS(0):1172 return str_to_user(dev->phys, size, p);1173 1174 case EVIOCGUNIQ(0):1175 return str_to_user(dev->uniq, size, p);1176 1177 case EVIOC_MASK_SIZE(EVIOCSFF):1178 if (input_ff_effect_from_user(p, size, &effect))1179 return -EFAULT;1180 1181 error = input_ff_upload(dev, &effect, file);1182 if (error)1183 return error;1184 1185 if (put_user(effect.id, &(((struct ff_effect __user *)p)->id)))1186 return -EFAULT;1187 1188 return 0;1189 }1190 1191 /* Multi-number variable-length handlers */1192 if (_IOC_TYPE(cmd) != 'E')1193 return -EINVAL;1194 1195 if (_IOC_DIR(cmd) == _IOC_READ) {1196 1197 if ((_IOC_NR(cmd) & ~EV_MAX) == _IOC_NR(EVIOCGBIT(0, 0)))1198 return handle_eviocgbit(dev,1199 _IOC_NR(cmd) & EV_MAX, size,1200 p, compat_mode);1201 1202 if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) {1203 1204 if (!dev->absinfo)1205 return -EINVAL;1206 1207 t = _IOC_NR(cmd) & ABS_MAX;1208 abs = dev->absinfo[t];1209 1210 if (copy_to_user(p, &abs, min_t(size_t,1211 size, sizeof(struct input_absinfo))))1212 return -EFAULT;1213 1214 return 0;1215 }1216 }1217 1218 if (_IOC_DIR(cmd) == _IOC_WRITE) {1219 1220 if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) {1221 1222 if (!dev->absinfo)1223 return -EINVAL;1224 1225 t = _IOC_NR(cmd) & ABS_MAX;1226 1227 if (copy_from_user(&abs, p, min_t(size_t,1228 size, sizeof(struct input_absinfo))))1229 return -EFAULT;1230 1231 if (size < sizeof(struct input_absinfo))1232 abs.resolution = 0;1233 1234 /* We can't change number of reserved MT slots */1235 if (t == ABS_MT_SLOT)1236 return -EINVAL;1237 1238 /*1239 * Take event lock to ensure that we are not1240 * changing device parameters in the middle1241 * of event.1242 */1243 spin_lock_irq(&dev->event_lock);1244 dev->absinfo[t] = abs;1245 spin_unlock_irq(&dev->event_lock);1246 1247 return 0;1248 }1249 }1250 1251 return -EINVAL;1252}1253 1254static long evdev_ioctl_handler(struct file *file, unsigned int cmd,1255 void __user *p, int compat_mode)1256{1257 struct evdev_client *client = file->private_data;1258 struct evdev *evdev = client->evdev;1259 int retval;1260 1261 retval = mutex_lock_interruptible(&evdev->mutex);1262 if (retval)1263 return retval;1264 1265 if (!evdev->exist || client->revoked) {1266 retval = -ENODEV;1267 goto out;1268 }1269 1270 retval = evdev_do_ioctl(file, cmd, p, compat_mode);1271 1272 out:1273 mutex_unlock(&evdev->mutex);1274 return retval;1275}1276 1277static long evdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)1278{1279 return evdev_ioctl_handler(file, cmd, (void __user *)arg, 0);1280}1281 1282#ifdef CONFIG_COMPAT1283static long evdev_ioctl_compat(struct file *file,1284 unsigned int cmd, unsigned long arg)1285{1286 return evdev_ioctl_handler(file, cmd, compat_ptr(arg), 1);1287}1288#endif1289 1290static const struct file_operations evdev_fops = {1291 .owner = THIS_MODULE,1292 .read = evdev_read,1293 .write = evdev_write,1294 .poll = evdev_poll,1295 .open = evdev_open,1296 .release = evdev_release,1297 .unlocked_ioctl = evdev_ioctl,1298#ifdef CONFIG_COMPAT1299 .compat_ioctl = evdev_ioctl_compat,1300#endif1301 .fasync = evdev_fasync,1302};1303 1304/*1305 * Mark device non-existent. This disables writes, ioctls and1306 * prevents new users from opening the device. Already posted1307 * blocking reads will stay, however new ones will fail.1308 */1309static void evdev_mark_dead(struct evdev *evdev)1310{1311 mutex_lock(&evdev->mutex);1312 evdev->exist = false;1313 mutex_unlock(&evdev->mutex);1314}1315 1316static void evdev_cleanup(struct evdev *evdev)1317{1318 struct input_handle *handle = &evdev->handle;1319 1320 evdev_mark_dead(evdev);1321 evdev_hangup(evdev);1322 1323 /* evdev is marked dead so no one else accesses evdev->open */1324 if (evdev->open) {1325 input_flush_device(handle, NULL);1326 input_close_device(handle);1327 }1328}1329 1330/*1331 * Create new evdev device. Note that input core serializes calls1332 * to connect and disconnect.1333 */1334static int evdev_connect(struct input_handler *handler, struct input_dev *dev,1335 const struct input_device_id *id)1336{1337 struct evdev *evdev;1338 int minor;1339 int dev_no;1340 int error;1341 1342 minor = input_get_new_minor(EVDEV_MINOR_BASE, EVDEV_MINORS, true);1343 if (minor < 0) {1344 error = minor;1345 pr_err("failed to reserve new minor: %d\n", error);1346 return error;1347 }1348 1349 evdev = kzalloc(sizeof(struct evdev), GFP_KERNEL);1350 if (!evdev) {1351 error = -ENOMEM;1352 goto err_free_minor;1353 }1354 1355 INIT_LIST_HEAD(&evdev->client_list);1356 spin_lock_init(&evdev->client_lock);1357 mutex_init(&evdev->mutex);1358 evdev->exist = true;1359 1360 dev_no = minor;1361 /* Normalize device number if it falls into legacy range */1362 if (dev_no < EVDEV_MINOR_BASE + EVDEV_MINORS)1363 dev_no -= EVDEV_MINOR_BASE;1364 dev_set_name(&evdev->dev, "event%d", dev_no);1365 1366 evdev->handle.dev = input_get_device(dev);1367 evdev->handle.name = dev_name(&evdev->dev);1368 evdev->handle.handler = handler;1369 evdev->handle.private = evdev;1370 1371 evdev->dev.devt = MKDEV(INPUT_MAJOR, minor);1372 evdev->dev.class = &input_class;1373 evdev->dev.parent = &dev->dev;1374 evdev->dev.release = evdev_free;1375 device_initialize(&evdev->dev);1376 1377 error = input_register_handle(&evdev->handle);1378 if (error)1379 goto err_free_evdev;1380 1381 cdev_init(&evdev->cdev, &evdev_fops);1382 1383 error = cdev_device_add(&evdev->cdev, &evdev->dev);1384 if (error)1385 goto err_cleanup_evdev;1386 1387 return 0;1388 1389 err_cleanup_evdev:1390 evdev_cleanup(evdev);1391 input_unregister_handle(&evdev->handle);1392 err_free_evdev:1393 put_device(&evdev->dev);1394 err_free_minor:1395 input_free_minor(minor);1396 return error;1397}1398 1399static void evdev_disconnect(struct input_handle *handle)1400{1401 struct evdev *evdev = handle->private;1402 1403 cdev_device_del(&evdev->cdev, &evdev->dev);1404 evdev_cleanup(evdev);1405 input_free_minor(MINOR(evdev->dev.devt));1406 input_unregister_handle(handle);1407 put_device(&evdev->dev);1408}1409 1410static const struct input_device_id evdev_ids[] = {1411 { .driver_info = 1 }, /* Matches all devices */1412 { }, /* Terminating zero entry */1413};1414 1415MODULE_DEVICE_TABLE(input, evdev_ids);1416 1417static struct input_handler evdev_handler = {1418 .events = evdev_events,1419 .connect = evdev_connect,1420 .disconnect = evdev_disconnect,1421 .legacy_minors = true,1422 .minor = EVDEV_MINOR_BASE,1423 .name = "evdev",1424 .id_table = evdev_ids,1425};1426 1427static int __init evdev_init(void)1428{1429 return input_register_handler(&evdev_handler);1430}1431 1432static void __exit evdev_exit(void)1433{1434 input_unregister_handler(&evdev_handler);1435}1436 1437module_init(evdev_init);1438module_exit(evdev_exit);1439 1440MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");1441MODULE_DESCRIPTION("Input driver event char devices");1442MODULE_LICENSE("GPL");1443