1 /* 2 * Event char devices, giving access to raw input device events. 3 * 4 * Copyright (c) 1999-2002 Vojtech Pavlik 5 * 6 * This program is free software; you can redistribute it and/or modify it 7 * under the terms of the GNU General Public License version 2 as published by 8 * the Free Software Foundation. 9 */ 10 11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 12 13 #define EVDEV_MINOR_BASE 64 14 #define EVDEV_MINORS 32 15 #define EVDEV_MIN_BUFFER_SIZE 64U 16 #define EVDEV_BUF_PACKETS 8 17 18 #include <linux/poll.h> 19 #include <linux/sched.h> 20 #include <linux/slab.h> 21 #include <linux/vmalloc.h> 22 #include <linux/mm.h> 23 #include <linux/module.h> 24 #include <linux/init.h> 25 #include <linux/input/mt.h> 26 #include <linux/major.h> 27 #include <linux/device.h> 28 #include <linux/cdev.h> 29 #include "input-compat.h" 30 31 enum evdev_clock_type { 32 EV_CLK_REAL = 0, 33 EV_CLK_MONO, 34 EV_CLK_BOOT, 35 EV_CLK_MAX 36 }; 37 38 struct evdev { 39 int open; 40 struct input_handle handle; 41 wait_queue_head_t wait; 42 struct evdev_client __rcu *grab; 43 struct list_head client_list; 44 spinlock_t client_lock; /* protects client_list */ 45 struct mutex mutex; 46 struct device dev; 47 struct cdev cdev; 48 bool exist; 49 }; 50 51 struct evdev_client { 52 unsigned int head; 53 unsigned int tail; 54 unsigned int packet_head; /* [future] position of the first element of next packet */ 55 spinlock_t buffer_lock; /* protects access to buffer, head and tail */ 56 struct fasync_struct *fasync; 57 struct evdev *evdev; 58 struct list_head node; 59 unsigned int clk_type; 60 bool revoked; 61 unsigned long *evmasks[EV_CNT]; 62 unsigned int bufsize; 63 struct input_event buffer[]; 64 }; 65 66 static size_t evdev_get_mask_cnt(unsigned int type) 67 { 68 static const size_t counts[EV_CNT] = { 69 /* EV_SYN==0 is EV_CNT, _not_ SYN_CNT, see EVIOCGBIT */ 70 [EV_SYN] = EV_CNT, 71 [EV_KEY] = KEY_CNT, 72 [EV_REL] = REL_CNT, 73 [EV_ABS] = ABS_CNT, 74 [EV_MSC] = MSC_CNT, 75 [EV_SW] = SW_CNT, 76 [EV_LED] = LED_CNT, 77 [EV_SND] = SND_CNT, 78 [EV_FF] = FF_CNT, 79 }; 80 81 return (type < EV_CNT) ? counts[type] : 0; 82 } 83 84 /* requires the buffer lock to be held */ 85 static bool __evdev_is_filtered(struct evdev_client *client, 86 unsigned int type, 87 unsigned int code) 88 { 89 unsigned long *mask; 90 size_t cnt; 91 92 /* EV_SYN and unknown codes are never filtered */ 93 if (type == EV_SYN || type >= EV_CNT) 94 return false; 95 96 /* first test whether the type is filtered */ 97 mask = client->evmasks[0]; 98 if (mask && !test_bit(type, mask)) 99 return true; 100 101 /* unknown values are never filtered */ 102 cnt = evdev_get_mask_cnt(type); 103 if (!cnt || code >= cnt) 104 return false; 105 106 mask = client->evmasks[type]; 107 return mask && !test_bit(code, mask); 108 } 109 110 /* flush queued events of type @type, caller must hold client->buffer_lock */ 111 static void __evdev_flush_queue(struct evdev_client *client, unsigned int type) 112 { 113 unsigned int i, head, num; 114 unsigned int mask = client->bufsize - 1; 115 bool is_report; 116 struct input_event *ev; 117 118 BUG_ON(type == EV_SYN); 119 120 head = client->tail; 121 client->packet_head = client->tail; 122 123 /* init to 1 so a leading SYN_REPORT will not be dropped */ 124 num = 1; 125 126 for (i = client->tail; i != client->head; i = (i + 1) & mask) { 127 ev = &client->buffer[i]; 128 is_report = ev->type == EV_SYN && ev->code == SYN_REPORT; 129 130 if (ev->type == type) { 131 /* drop matched entry */ 132 continue; 133 } else if (is_report && !num) { 134 /* drop empty SYN_REPORT groups */ 135 continue; 136 } else if (head != i) { 137 /* move entry to fill the gap */ 138 client->buffer[head] = *ev; 139 } 140 141 num++; 142 head = (head + 1) & mask; 143 144 if (is_report) { 145 num = 0; 146 client->packet_head = head; 147 } 148 } 149 150 client->head = head; 151 } 152 153 static void __evdev_queue_syn_dropped(struct evdev_client *client) 154 { 155 struct input_event ev; 156 ktime_t time; 157 struct timespec64 ts; 158 159 time = client->clk_type == EV_CLK_REAL ? 160 ktime_get_real() : 161 client->clk_type == EV_CLK_MONO ? 162 ktime_get() : 163 ktime_get_boottime(); 164 165 ts = ktime_to_timespec64(time); 166 ev.input_event_sec = ts.tv_sec; 167 ev.input_event_usec = ts.tv_nsec / NSEC_PER_USEC; 168 ev.type = EV_SYN; 169 ev.code = SYN_DROPPED; 170 ev.value = 0; 171 172 client->buffer[client->head++] = ev; 173 client->head &= client->bufsize - 1; 174 175 if (unlikely(client->head == client->tail)) { 176 /* drop queue but keep our SYN_DROPPED event */ 177 client->tail = (client->head - 1) & (client->bufsize - 1); 178 client->packet_head = client->tail; 179 } 180 } 181 182 static void evdev_queue_syn_dropped(struct evdev_client *client) 183 { 184 unsigned long flags; 185 186 spin_lock_irqsave(&client->buffer_lock, flags); 187 __evdev_queue_syn_dropped(client); 188 spin_unlock_irqrestore(&client->buffer_lock, flags); 189 } 190 191 static int evdev_set_clk_type(struct evdev_client *client, unsigned int clkid) 192 { 193 unsigned long flags; 194 unsigned int clk_type; 195 196 switch (clkid) { 197 198 case CLOCK_REALTIME: 199 clk_type = EV_CLK_REAL; 200 break; 201 case CLOCK_MONOTONIC: 202 clk_type = EV_CLK_MONO; 203 break; 204 case CLOCK_BOOTTIME: 205 clk_type = EV_CLK_BOOT; 206 break; 207 default: 208 return -EINVAL; 209 } 210 211 if (client->clk_type != clk_type) { 212 client->clk_type = clk_type; 213 214 /* 215 * Flush pending events and queue SYN_DROPPED event, 216 * but only if the queue is not empty. 217 */ 218 spin_lock_irqsave(&client->buffer_lock, flags); 219 220 if (client->head != client->tail) { 221 client->packet_head = client->head = client->tail; 222 __evdev_queue_syn_dropped(client); 223 } 224 225 spin_unlock_irqrestore(&client->buffer_lock, flags); 226 } 227 228 return 0; 229 } 230 231 static void __pass_event(struct evdev_client *client, 232 const struct input_event *event) 233 { 234 client->buffer[client->head++] = *event; 235 client->head &= client->bufsize - 1; 236 237 if (unlikely(client->head == client->tail)) { 238 /* 239 * This effectively "drops" all unconsumed events, leaving 240 * EV_SYN/SYN_DROPPED plus the newest event in the queue. 241 */ 242 client->tail = (client->head - 2) & (client->bufsize - 1); 243 244 client->buffer[client->tail].input_event_sec = 245 event->input_event_sec; 246 client->buffer[client->tail].input_event_usec = 247 event->input_event_usec; 248 client->buffer[client->tail].type = EV_SYN; 249 client->buffer[client->tail].code = SYN_DROPPED; 250 client->buffer[client->tail].value = 0; 251 252 client->packet_head = client->tail; 253 } 254 255 if (event->type == EV_SYN && event->code == SYN_REPORT) { 256 client->packet_head = client->head; 257 kill_fasync(&client->fasync, SIGIO, POLL_IN); 258 } 259 } 260 261 static void evdev_pass_values(struct evdev_client *client, 262 const struct input_value *vals, unsigned int count, 263 ktime_t *ev_time) 264 { 265 struct evdev *evdev = client->evdev; 266 const struct input_value *v; 267 struct input_event event; 268 struct timespec64 ts; 269 bool wakeup = false; 270 271 if (client->revoked) 272 return; 273 274 ts = ktime_to_timespec64(ev_time[client->clk_type]); 275 event.input_event_sec = ts.tv_sec; 276 event.input_event_usec = ts.tv_nsec / NSEC_PER_USEC; 277 278 /* Interrupts are disabled, just acquire the lock. */ 279 spin_lock(&client->buffer_lock); 280 281 for (v = vals; v != vals + count; v++) { 282 if (__evdev_is_filtered(client, v->type, v->code)) 283 continue; 284 285 if (v->type == EV_SYN && v->code == SYN_REPORT) { 286 /* drop empty SYN_REPORT */ 287 if (client->packet_head == client->head) 288 continue; 289 290 wakeup = true; 291 } 292 293 event.type = v->type; 294 event.code = v->code; 295 event.value = v->value; 296 __pass_event(client, &event); 297 } 298 299 spin_unlock(&client->buffer_lock); 300 301 if (wakeup) 302 wake_up_interruptible(&evdev->wait); 303 } 304 305 /* 306 * Pass incoming events to all connected clients. 307 */ 308 static void evdev_events(struct input_handle *handle, 309 const struct input_value *vals, unsigned int count) 310 { 311 struct evdev *evdev = handle->private; 312 struct evdev_client *client; 313 ktime_t ev_time[EV_CLK_MAX]; 314 315 ev_time[EV_CLK_MONO] = ktime_get(); 316 ev_time[EV_CLK_REAL] = ktime_mono_to_real(ev_time[EV_CLK_MONO]); 317 ev_time[EV_CLK_BOOT] = ktime_mono_to_any(ev_time[EV_CLK_MONO], 318 TK_OFFS_BOOT); 319 320 rcu_read_lock(); 321 322 client = rcu_dereference(evdev->grab); 323 324 if (client) 325 evdev_pass_values(client, vals, count, ev_time); 326 else 327 list_for_each_entry_rcu(client, &evdev->client_list, node) 328 evdev_pass_values(client, vals, count, ev_time); 329 330 rcu_read_unlock(); 331 } 332 333 /* 334 * Pass incoming event to all connected clients. 335 */ 336 static void evdev_event(struct input_handle *handle, 337 unsigned int type, unsigned int code, int value) 338 { 339 struct input_value vals[] = { { type, code, value } }; 340 341 evdev_events(handle, vals, 1); 342 } 343 344 static int evdev_fasync(int fd, struct file *file, int on) 345 { 346 struct evdev_client *client = file->private_data; 347 348 return fasync_helper(fd, file, on, &client->fasync); 349 } 350 351 static int evdev_flush(struct file *file, fl_owner_t id) 352 { 353 struct evdev_client *client = file->private_data; 354 struct evdev *evdev = client->evdev; 355 356 mutex_lock(&evdev->mutex); 357 358 if (evdev->exist && !client->revoked) 359 input_flush_device(&evdev->handle, file); 360 361 mutex_unlock(&evdev->mutex); 362 return 0; 363 } 364 365 static void evdev_free(struct device *dev) 366 { 367 struct evdev *evdev = container_of(dev, struct evdev, dev); 368 369 input_put_device(evdev->handle.dev); 370 kfree(evdev); 371 } 372 373 /* 374 * Grabs an event device (along with underlying input device). 375 * This function is called with evdev->mutex taken. 376 */ 377 static int evdev_grab(struct evdev *evdev, struct evdev_client *client) 378 { 379 int error; 380 381 if (evdev->grab) 382 return -EBUSY; 383 384 error = input_grab_device(&evdev->handle); 385 if (error) 386 return error; 387 388 rcu_assign_pointer(evdev->grab, client); 389 390 return 0; 391 } 392 393 static int evdev_ungrab(struct evdev *evdev, struct evdev_client *client) 394 { 395 struct evdev_client *grab = rcu_dereference_protected(evdev->grab, 396 lockdep_is_held(&evdev->mutex)); 397 398 if (grab != client) 399 return -EINVAL; 400 401 rcu_assign_pointer(evdev->grab, NULL); 402 synchronize_rcu(); 403 input_release_device(&evdev->handle); 404 405 return 0; 406 } 407 408 static void evdev_attach_client(struct evdev *evdev, 409 struct evdev_client *client) 410 { 411 spin_lock(&evdev->client_lock); 412 list_add_tail_rcu(&client->node, &evdev->client_list); 413 spin_unlock(&evdev->client_lock); 414 } 415 416 static void evdev_detach_client(struct evdev *evdev, 417 struct evdev_client *client) 418 { 419 spin_lock(&evdev->client_lock); 420 list_del_rcu(&client->node); 421 spin_unlock(&evdev->client_lock); 422 synchronize_rcu(); 423 } 424 425 static int evdev_open_device(struct evdev *evdev) 426 { 427 int retval; 428 429 retval = mutex_lock_interruptible(&evdev->mutex); 430 if (retval) 431 return retval; 432 433 if (!evdev->exist) 434 retval = -ENODEV; 435 else if (!evdev->open++) { 436 retval = input_open_device(&evdev->handle); 437 if (retval) 438 evdev->open--; 439 } 440 441 mutex_unlock(&evdev->mutex); 442 return retval; 443 } 444 445 static void evdev_close_device(struct evdev *evdev) 446 { 447 mutex_lock(&evdev->mutex); 448 449 if (evdev->exist && !--evdev->open) 450 input_close_device(&evdev->handle); 451 452 mutex_unlock(&evdev->mutex); 453 } 454 455 /* 456 * Wake up users waiting for IO so they can disconnect from 457 * dead device. 458 */ 459 static void evdev_hangup(struct evdev *evdev) 460 { 461 struct evdev_client *client; 462 463 spin_lock(&evdev->client_lock); 464 list_for_each_entry(client, &evdev->client_list, node) 465 kill_fasync(&client->fasync, SIGIO, POLL_HUP); 466 spin_unlock(&evdev->client_lock); 467 468 wake_up_interruptible(&evdev->wait); 469 } 470 471 static int evdev_release(struct inode *inode, struct file *file) 472 { 473 struct evdev_client *client = file->private_data; 474 struct evdev *evdev = client->evdev; 475 unsigned int i; 476 477 mutex_lock(&evdev->mutex); 478 evdev_ungrab(evdev, client); 479 mutex_unlock(&evdev->mutex); 480 481 evdev_detach_client(evdev, client); 482 483 for (i = 0; i < EV_CNT; ++i) 484 bitmap_free(client->evmasks[i]); 485 486 kvfree(client); 487 488 evdev_close_device(evdev); 489 490 return 0; 491 } 492 493 static unsigned int evdev_compute_buffer_size(struct input_dev *dev) 494 { 495 unsigned int n_events = 496 max(dev->hint_events_per_packet * EVDEV_BUF_PACKETS, 497 EVDEV_MIN_BUFFER_SIZE); 498 499 return roundup_pow_of_two(n_events); 500 } 501 502 static int evdev_open(struct inode *inode, struct file *file) 503 { 504 struct evdev *evdev = container_of(inode->i_cdev, struct evdev, cdev); 505 unsigned int bufsize = evdev_compute_buffer_size(evdev->handle.dev); 506 struct evdev_client *client; 507 int error; 508 509 client = kzalloc(struct_size(client, buffer, bufsize), 510 GFP_KERNEL | __GFP_NOWARN); 511 if (!client) 512 client = vzalloc(struct_size(client, buffer, bufsize)); 513 if (!client) 514 return -ENOMEM; 515 516 client->bufsize = bufsize; 517 spin_lock_init(&client->buffer_lock); 518 client->evdev = evdev; 519 evdev_attach_client(evdev, client); 520 521 error = evdev_open_device(evdev); 522 if (error) 523 goto err_free_client; 524 525 file->private_data = client; 526 stream_open(inode, file); 527 528 return 0; 529 530 err_free_client: 531 evdev_detach_client(evdev, client); 532 kvfree(client); 533 return error; 534 } 535 536 static ssize_t evdev_write(struct file *file, const char __user *buffer, 537 size_t count, loff_t *ppos) 538 { 539 struct evdev_client *client = file->private_data; 540 struct evdev *evdev = client->evdev; 541 struct input_event event; 542 int retval = 0; 543 544 if (count != 0 && count < input_event_size()) 545 return -EINVAL; 546 547 retval = mutex_lock_interruptible(&evdev->mutex); 548 if (retval) 549 return retval; 550 551 if (!evdev->exist || client->revoked) { 552 retval = -ENODEV; 553 goto out; 554 } 555 556 while (retval + input_event_size() <= count) { 557 558 if (input_event_from_user(buffer + retval, &event)) { 559 retval = -EFAULT; 560 goto out; 561 } 562 retval += input_event_size(); 563 564 input_inject_event(&evdev->handle, 565 event.type, event.code, event.value); 566 cond_resched(); 567 } 568 569 out: 570 mutex_unlock(&evdev->mutex); 571 return retval; 572 } 573 574 static int evdev_fetch_next_event(struct evdev_client *client, 575 struct input_event *event) 576 { 577 int have_event; 578 579 spin_lock_irq(&client->buffer_lock); 580 581 have_event = client->packet_head != client->tail; 582 if (have_event) { 583 *event = client->buffer[client->tail++]; 584 client->tail &= client->bufsize - 1; 585 } 586 587 spin_unlock_irq(&client->buffer_lock); 588 589 return have_event; 590 } 591 592 static ssize_t evdev_read(struct file *file, char __user *buffer, 593 size_t count, loff_t *ppos) 594 { 595 struct evdev_client *client = file->private_data; 596 struct evdev *evdev = client->evdev; 597 struct input_event event; 598 size_t read = 0; 599 int error; 600 601 if (count != 0 && count < input_event_size()) 602 return -EINVAL; 603 604 for (;;) { 605 if (!evdev->exist || client->revoked) 606 return -ENODEV; 607 608 if (client->packet_head == client->tail && 609 (file->f_flags & O_NONBLOCK)) 610 return -EAGAIN; 611 612 /* 613 * count == 0 is special - no IO is done but we check 614 * for error conditions (see above). 615 */ 616 if (count == 0) 617 break; 618 619 while (read + input_event_size() <= count && 620 evdev_fetch_next_event(client, &event)) { 621 622 if (input_event_to_user(buffer + read, &event)) 623 return -EFAULT; 624 625 read += input_event_size(); 626 } 627 628 if (read) 629 break; 630 631 if (!(file->f_flags & O_NONBLOCK)) { 632 error = wait_event_interruptible(evdev->wait, 633 client->packet_head != client->tail || 634 !evdev->exist || client->revoked); 635 if (error) 636 return error; 637 } 638 } 639 640 return read; 641 } 642 643 /* No kernel lock - fine */ 644 static __poll_t evdev_poll(struct file *file, poll_table *wait) 645 { 646 struct evdev_client *client = file->private_data; 647 struct evdev *evdev = client->evdev; 648 __poll_t mask; 649 650 poll_wait(file, &evdev->wait, wait); 651 652 if (evdev->exist && !client->revoked) 653 mask = EPOLLOUT | EPOLLWRNORM; 654 else 655 mask = EPOLLHUP | EPOLLERR; 656 657 if (client->packet_head != client->tail) 658 mask |= EPOLLIN | EPOLLRDNORM; 659 660 return mask; 661 } 662 663 #ifdef CONFIG_COMPAT 664 665 #define BITS_PER_LONG_COMPAT (sizeof(compat_long_t) * 8) 666 #define BITS_TO_LONGS_COMPAT(x) ((((x) - 1) / BITS_PER_LONG_COMPAT) + 1) 667 668 #ifdef __BIG_ENDIAN 669 static int bits_to_user(unsigned long *bits, unsigned int maxbit, 670 unsigned int maxlen, void __user *p, int compat) 671 { 672 int len, i; 673 674 if (compat) { 675 len = BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t); 676 if (len > maxlen) 677 len = maxlen; 678 679 for (i = 0; i < len / sizeof(compat_long_t); i++) 680 if (copy_to_user((compat_long_t __user *) p + i, 681 (compat_long_t *) bits + 682 i + 1 - ((i % 2) << 1), 683 sizeof(compat_long_t))) 684 return -EFAULT; 685 } else { 686 len = BITS_TO_LONGS(maxbit) * sizeof(long); 687 if (len > maxlen) 688 len = maxlen; 689 690 if (copy_to_user(p, bits, len)) 691 return -EFAULT; 692 } 693 694 return len; 695 } 696 697 static int bits_from_user(unsigned long *bits, unsigned int maxbit, 698 unsigned int maxlen, const void __user *p, int compat) 699 { 700 int len, i; 701 702 if (compat) { 703 if (maxlen % sizeof(compat_long_t)) 704 return -EINVAL; 705 706 len = BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t); 707 if (len > maxlen) 708 len = maxlen; 709 710 for (i = 0; i < len / sizeof(compat_long_t); i++) 711 if (copy_from_user((compat_long_t *) bits + 712 i + 1 - ((i % 2) << 1), 713 (compat_long_t __user *) p + i, 714 sizeof(compat_long_t))) 715 return -EFAULT; 716 if (i % 2) 717 *((compat_long_t *) bits + i - 1) = 0; 718 719 } else { 720 if (maxlen % sizeof(long)) 721 return -EINVAL; 722 723 len = BITS_TO_LONGS(maxbit) * sizeof(long); 724 if (len > maxlen) 725 len = maxlen; 726 727 if (copy_from_user(bits, p, len)) 728 return -EFAULT; 729 } 730 731 return len; 732 } 733 734 #else 735 736 static int bits_to_user(unsigned long *bits, unsigned int maxbit, 737 unsigned int maxlen, void __user *p, int compat) 738 { 739 int len = compat ? 740 BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t) : 741 BITS_TO_LONGS(maxbit) * sizeof(long); 742 743 if (len > maxlen) 744 len = maxlen; 745 746 return copy_to_user(p, bits, len) ? -EFAULT : len; 747 } 748 749 static int bits_from_user(unsigned long *bits, unsigned int maxbit, 750 unsigned int maxlen, const void __user *p, int compat) 751 { 752 size_t chunk_size = compat ? sizeof(compat_long_t) : sizeof(long); 753 int len; 754 755 if (maxlen % chunk_size) 756 return -EINVAL; 757 758 len = compat ? BITS_TO_LONGS_COMPAT(maxbit) : BITS_TO_LONGS(maxbit); 759 len *= chunk_size; 760 if (len > maxlen) 761 len = maxlen; 762 763 return copy_from_user(bits, p, len) ? -EFAULT : len; 764 } 765 766 #endif /* __BIG_ENDIAN */ 767 768 #else 769 770 static int bits_to_user(unsigned long *bits, unsigned int maxbit, 771 unsigned int maxlen, void __user *p, int compat) 772 { 773 int len = BITS_TO_LONGS(maxbit) * sizeof(long); 774 775 if (len > maxlen) 776 len = maxlen; 777 778 return copy_to_user(p, bits, len) ? -EFAULT : len; 779 } 780 781 static int bits_from_user(unsigned long *bits, unsigned int maxbit, 782 unsigned int maxlen, const void __user *p, int compat) 783 { 784 int len; 785 786 if (maxlen % sizeof(long)) 787 return -EINVAL; 788 789 len = BITS_TO_LONGS(maxbit) * sizeof(long); 790 if (len > maxlen) 791 len = maxlen; 792 793 return copy_from_user(bits, p, len) ? -EFAULT : len; 794 } 795 796 #endif /* CONFIG_COMPAT */ 797 798 static int str_to_user(const char *str, unsigned int maxlen, void __user *p) 799 { 800 int len; 801 802 if (!str) 803 return -ENOENT; 804 805 len = strlen(str) + 1; 806 if (len > maxlen) 807 len = maxlen; 808 809 return copy_to_user(p, str, len) ? -EFAULT : len; 810 } 811 812 static int handle_eviocgbit(struct input_dev *dev, 813 unsigned int type, unsigned int size, 814 void __user *p, int compat_mode) 815 { 816 unsigned long *bits; 817 int len; 818 819 switch (type) { 820 821 case 0: bits = dev->evbit; len = EV_MAX; break; 822 case EV_KEY: bits = dev->keybit; len = KEY_MAX; break; 823 case EV_REL: bits = dev->relbit; len = REL_MAX; break; 824 case EV_ABS: bits = dev->absbit; len = ABS_MAX; break; 825 case EV_MSC: bits = dev->mscbit; len = MSC_MAX; break; 826 case EV_LED: bits = dev->ledbit; len = LED_MAX; break; 827 case EV_SND: bits = dev->sndbit; len = SND_MAX; break; 828 case EV_FF: bits = dev->ffbit; len = FF_MAX; break; 829 case EV_SW: bits = dev->swbit; len = SW_MAX; break; 830 default: return -EINVAL; 831 } 832 833 return bits_to_user(bits, len, size, p, compat_mode); 834 } 835 836 static int evdev_handle_get_keycode(struct input_dev *dev, void __user *p) 837 { 838 struct input_keymap_entry ke = { 839 .len = sizeof(unsigned int), 840 .flags = 0, 841 }; 842 int __user *ip = (int __user *)p; 843 int error; 844 845 /* legacy case */ 846 if (copy_from_user(ke.scancode, p, sizeof(unsigned int))) 847 return -EFAULT; 848 849 error = input_get_keycode(dev, &ke); 850 if (error) 851 return error; 852 853 if (put_user(ke.keycode, ip + 1)) 854 return -EFAULT; 855 856 return 0; 857 } 858 859 static int evdev_handle_get_keycode_v2(struct input_dev *dev, void __user *p) 860 { 861 struct input_keymap_entry ke; 862 int error; 863 864 if (copy_from_user(&ke, p, sizeof(ke))) 865 return -EFAULT; 866 867 error = input_get_keycode(dev, &ke); 868 if (error) 869 return error; 870 871 if (copy_to_user(p, &ke, sizeof(ke))) 872 return -EFAULT; 873 874 return 0; 875 } 876 877 static int evdev_handle_set_keycode(struct input_dev *dev, void __user *p) 878 { 879 struct input_keymap_entry ke = { 880 .len = sizeof(unsigned int), 881 .flags = 0, 882 }; 883 int __user *ip = (int __user *)p; 884 885 if (copy_from_user(ke.scancode, p, sizeof(unsigned int))) 886 return -EFAULT; 887 888 if (get_user(ke.keycode, ip + 1)) 889 return -EFAULT; 890 891 return input_set_keycode(dev, &ke); 892 } 893 894 static int evdev_handle_set_keycode_v2(struct input_dev *dev, void __user *p) 895 { 896 struct input_keymap_entry ke; 897 898 if (copy_from_user(&ke, p, sizeof(ke))) 899 return -EFAULT; 900 901 if (ke.len > sizeof(ke.scancode)) 902 return -EINVAL; 903 904 return input_set_keycode(dev, &ke); 905 } 906 907 /* 908 * If we transfer state to the user, we should flush all pending events 909 * of the same type from the client's queue. Otherwise, they might end up 910 * with duplicate events, which can screw up client's state tracking. 911 * If bits_to_user fails after flushing the queue, we queue a SYN_DROPPED 912 * event so user-space will notice missing events. 913 * 914 * LOCKING: 915 * We need to take event_lock before buffer_lock to avoid dead-locks. But we 916 * need the even_lock only to guarantee consistent state. We can safely release 917 * it while flushing the queue. This allows input-core to handle filters while 918 * we flush the queue. 919 */ 920 static int evdev_handle_get_val(struct evdev_client *client, 921 struct input_dev *dev, unsigned int type, 922 unsigned long *bits, unsigned int maxbit, 923 unsigned int maxlen, void __user *p, 924 int compat) 925 { 926 int ret; 927 unsigned long *mem; 928 929 mem = bitmap_alloc(maxbit, GFP_KERNEL); 930 if (!mem) 931 return -ENOMEM; 932 933 spin_lock_irq(&dev->event_lock); 934 spin_lock(&client->buffer_lock); 935 936 bitmap_copy(mem, bits, maxbit); 937 938 spin_unlock(&dev->event_lock); 939 940 __evdev_flush_queue(client, type); 941 942 spin_unlock_irq(&client->buffer_lock); 943 944 ret = bits_to_user(mem, maxbit, maxlen, p, compat); 945 if (ret < 0) 946 evdev_queue_syn_dropped(client); 947 948 bitmap_free(mem); 949 950 return ret; 951 } 952 953 static int evdev_handle_mt_request(struct input_dev *dev, 954 unsigned int size, 955 int __user *ip) 956 { 957 const struct input_mt *mt = dev->mt; 958 unsigned int code; 959 int max_slots; 960 int i; 961 962 if (get_user(code, &ip[0])) 963 return -EFAULT; 964 if (!mt || !input_is_mt_value(code)) 965 return -EINVAL; 966 967 max_slots = (size - sizeof(__u32)) / sizeof(__s32); 968 for (i = 0; i < mt->num_slots && i < max_slots; i++) { 969 int value = input_mt_get_value(&mt->slots[i], code); 970 if (put_user(value, &ip[1 + i])) 971 return -EFAULT; 972 } 973 974 return 0; 975 } 976 977 static int evdev_revoke(struct evdev *evdev, struct evdev_client *client, 978 struct file *file) 979 { 980 client->revoked = true; 981 evdev_ungrab(evdev, client); 982 input_flush_device(&evdev->handle, file); 983 wake_up_interruptible(&evdev->wait); 984 985 return 0; 986 } 987 988 /* must be called with evdev-mutex held */ 989 static int evdev_set_mask(struct evdev_client *client, 990 unsigned int type, 991 const void __user *codes, 992 u32 codes_size, 993 int compat) 994 { 995 unsigned long flags, *mask, *oldmask; 996 size_t cnt; 997 int error; 998 999 /* we allow unknown types and 'codes_size > size' for forward-compat */ 1000 cnt = evdev_get_mask_cnt(type); 1001 if (!cnt) 1002 return 0; 1003 1004 mask = bitmap_zalloc(cnt, GFP_KERNEL); 1005 if (!mask) 1006 return -ENOMEM; 1007 1008 error = bits_from_user(mask, cnt - 1, codes_size, codes, compat); 1009 if (error < 0) { 1010 bitmap_free(mask); 1011 return error; 1012 } 1013 1014 spin_lock_irqsave(&client->buffer_lock, flags); 1015 oldmask = client->evmasks[type]; 1016 client->evmasks[type] = mask; 1017 spin_unlock_irqrestore(&client->buffer_lock, flags); 1018 1019 bitmap_free(oldmask); 1020 1021 return 0; 1022 } 1023 1024 /* must be called with evdev-mutex held */ 1025 static int evdev_get_mask(struct evdev_client *client, 1026 unsigned int type, 1027 void __user *codes, 1028 u32 codes_size, 1029 int compat) 1030 { 1031 unsigned long *mask; 1032 size_t cnt, size, xfer_size; 1033 int i; 1034 int error; 1035 1036 /* we allow unknown types and 'codes_size > size' for forward-compat */ 1037 cnt = evdev_get_mask_cnt(type); 1038 size = sizeof(unsigned long) * BITS_TO_LONGS(cnt); 1039 xfer_size = min_t(size_t, codes_size, size); 1040 1041 if (cnt > 0) { 1042 mask = client->evmasks[type]; 1043 if (mask) { 1044 error = bits_to_user(mask, cnt - 1, 1045 xfer_size, codes, compat); 1046 if (error < 0) 1047 return error; 1048 } else { 1049 /* fake mask with all bits set */ 1050 for (i = 0; i < xfer_size; i++) 1051 if (put_user(0xffU, (u8 __user *)codes + i)) 1052 return -EFAULT; 1053 } 1054 } 1055 1056 if (xfer_size < codes_size) 1057 if (clear_user(codes + xfer_size, codes_size - xfer_size)) 1058 return -EFAULT; 1059 1060 return 0; 1061 } 1062 1063 static long evdev_do_ioctl(struct file *file, unsigned int cmd, 1064 void __user *p, int compat_mode) 1065 { 1066 struct evdev_client *client = file->private_data; 1067 struct evdev *evdev = client->evdev; 1068 struct input_dev *dev = evdev->handle.dev; 1069 struct input_absinfo abs; 1070 struct input_mask mask; 1071 struct ff_effect effect; 1072 int __user *ip = (int __user *)p; 1073 unsigned int i, t, u, v; 1074 unsigned int size; 1075 int error; 1076 1077 /* First we check for fixed-length commands */ 1078 switch (cmd) { 1079 1080 case EVIOCGVERSION: 1081 return put_user(EV_VERSION, ip); 1082 1083 case EVIOCGID: 1084 if (copy_to_user(p, &dev->id, sizeof(struct input_id))) 1085 return -EFAULT; 1086 return 0; 1087 1088 case EVIOCGREP: 1089 if (!test_bit(EV_REP, dev->evbit)) 1090 return -ENOSYS; 1091 if (put_user(dev->rep[REP_DELAY], ip)) 1092 return -EFAULT; 1093 if (put_user(dev->rep[REP_PERIOD], ip + 1)) 1094 return -EFAULT; 1095 return 0; 1096 1097 case EVIOCSREP: 1098 if (!test_bit(EV_REP, dev->evbit)) 1099 return -ENOSYS; 1100 if (get_user(u, ip)) 1101 return -EFAULT; 1102 if (get_user(v, ip + 1)) 1103 return -EFAULT; 1104 1105 input_inject_event(&evdev->handle, EV_REP, REP_DELAY, u); 1106 input_inject_event(&evdev->handle, EV_REP, REP_PERIOD, v); 1107 1108 return 0; 1109 1110 case EVIOCRMFF: 1111 return input_ff_erase(dev, (int)(unsigned long) p, file); 1112 1113 case EVIOCGEFFECTS: 1114 i = test_bit(EV_FF, dev->evbit) ? 1115 dev->ff->max_effects : 0; 1116 if (put_user(i, ip)) 1117 return -EFAULT; 1118 return 0; 1119 1120 case EVIOCGRAB: 1121 if (p) 1122 return evdev_grab(evdev, client); 1123 else 1124 return evdev_ungrab(evdev, client); 1125 1126 case EVIOCREVOKE: 1127 if (p) 1128 return -EINVAL; 1129 else 1130 return evdev_revoke(evdev, client, file); 1131 1132 case EVIOCGMASK: { 1133 void __user *codes_ptr; 1134 1135 if (copy_from_user(&mask, p, sizeof(mask))) 1136 return -EFAULT; 1137 1138 codes_ptr = (void __user *)(unsigned long)mask.codes_ptr; 1139 return evdev_get_mask(client, 1140 mask.type, codes_ptr, mask.codes_size, 1141 compat_mode); 1142 } 1143 1144 case EVIOCSMASK: { 1145 const void __user *codes_ptr; 1146 1147 if (copy_from_user(&mask, p, sizeof(mask))) 1148 return -EFAULT; 1149 1150 codes_ptr = (const void __user *)(unsigned long)mask.codes_ptr; 1151 return evdev_set_mask(client, 1152 mask.type, codes_ptr, mask.codes_size, 1153 compat_mode); 1154 } 1155 1156 case EVIOCSCLOCKID: 1157 if (copy_from_user(&i, p, sizeof(unsigned int))) 1158 return -EFAULT; 1159 1160 return evdev_set_clk_type(client, i); 1161 1162 case EVIOCGKEYCODE: 1163 return evdev_handle_get_keycode(dev, p); 1164 1165 case EVIOCSKEYCODE: 1166 return evdev_handle_set_keycode(dev, p); 1167 1168 case EVIOCGKEYCODE_V2: 1169 return evdev_handle_get_keycode_v2(dev, p); 1170 1171 case EVIOCSKEYCODE_V2: 1172 return evdev_handle_set_keycode_v2(dev, p); 1173 } 1174 1175 size = _IOC_SIZE(cmd); 1176 1177 /* Now check variable-length commands */ 1178 #define EVIOC_MASK_SIZE(nr) ((nr) & ~(_IOC_SIZEMASK << _IOC_SIZESHIFT)) 1179 switch (EVIOC_MASK_SIZE(cmd)) { 1180 1181 case EVIOCGPROP(0): 1182 return bits_to_user(dev->propbit, INPUT_PROP_MAX, 1183 size, p, compat_mode); 1184 1185 case EVIOCGMTSLOTS(0): 1186 return evdev_handle_mt_request(dev, size, ip); 1187 1188 case EVIOCGKEY(0): 1189 return evdev_handle_get_val(client, dev, EV_KEY, dev->key, 1190 KEY_MAX, size, p, compat_mode); 1191 1192 case EVIOCGLED(0): 1193 return evdev_handle_get_val(client, dev, EV_LED, dev->led, 1194 LED_MAX, size, p, compat_mode); 1195 1196 case EVIOCGSND(0): 1197 return evdev_handle_get_val(client, dev, EV_SND, dev->snd, 1198 SND_MAX, size, p, compat_mode); 1199 1200 case EVIOCGSW(0): 1201 return evdev_handle_get_val(client, dev, EV_SW, dev->sw, 1202 SW_MAX, size, p, compat_mode); 1203 1204 case EVIOCGNAME(0): 1205 return str_to_user(dev->name, size, p); 1206 1207 case EVIOCGPHYS(0): 1208 return str_to_user(dev->phys, size, p); 1209 1210 case EVIOCGUNIQ(0): 1211 return str_to_user(dev->uniq, size, p); 1212 1213 case EVIOC_MASK_SIZE(EVIOCSFF): 1214 if (input_ff_effect_from_user(p, size, &effect)) 1215 return -EFAULT; 1216 1217 error = input_ff_upload(dev, &effect, file); 1218 if (error) 1219 return error; 1220 1221 if (put_user(effect.id, &(((struct ff_effect __user *)p)->id))) 1222 return -EFAULT; 1223 1224 return 0; 1225 } 1226 1227 /* Multi-number variable-length handlers */ 1228 if (_IOC_TYPE(cmd) != 'E') 1229 return -EINVAL; 1230 1231 if (_IOC_DIR(cmd) == _IOC_READ) { 1232 1233 if ((_IOC_NR(cmd) & ~EV_MAX) == _IOC_NR(EVIOCGBIT(0, 0))) 1234 return handle_eviocgbit(dev, 1235 _IOC_NR(cmd) & EV_MAX, size, 1236 p, compat_mode); 1237 1238 if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) { 1239 1240 if (!dev->absinfo) 1241 return -EINVAL; 1242 1243 t = _IOC_NR(cmd) & ABS_MAX; 1244 abs = dev->absinfo[t]; 1245 1246 if (copy_to_user(p, &abs, min_t(size_t, 1247 size, sizeof(struct input_absinfo)))) 1248 return -EFAULT; 1249 1250 return 0; 1251 } 1252 } 1253 1254 if (_IOC_DIR(cmd) == _IOC_WRITE) { 1255 1256 if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) { 1257 1258 if (!dev->absinfo) 1259 return -EINVAL; 1260 1261 t = _IOC_NR(cmd) & ABS_MAX; 1262 1263 if (copy_from_user(&abs, p, min_t(size_t, 1264 size, sizeof(struct input_absinfo)))) 1265 return -EFAULT; 1266 1267 if (size < sizeof(struct input_absinfo)) 1268 abs.resolution = 0; 1269 1270 /* We can't change number of reserved MT slots */ 1271 if (t == ABS_MT_SLOT) 1272 return -EINVAL; 1273 1274 /* 1275 * Take event lock to ensure that we are not 1276 * changing device parameters in the middle 1277 * of event. 1278 */ 1279 spin_lock_irq(&dev->event_lock); 1280 dev->absinfo[t] = abs; 1281 spin_unlock_irq(&dev->event_lock); 1282 1283 return 0; 1284 } 1285 } 1286 1287 return -EINVAL; 1288 } 1289 1290 static long evdev_ioctl_handler(struct file *file, unsigned int cmd, 1291 void __user *p, int compat_mode) 1292 { 1293 struct evdev_client *client = file->private_data; 1294 struct evdev *evdev = client->evdev; 1295 int retval; 1296 1297 retval = mutex_lock_interruptible(&evdev->mutex); 1298 if (retval) 1299 return retval; 1300 1301 if (!evdev->exist || client->revoked) { 1302 retval = -ENODEV; 1303 goto out; 1304 } 1305 1306 retval = evdev_do_ioctl(file, cmd, p, compat_mode); 1307 1308 out: 1309 mutex_unlock(&evdev->mutex); 1310 return retval; 1311 } 1312 1313 static long evdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 1314 { 1315 return evdev_ioctl_handler(file, cmd, (void __user *)arg, 0); 1316 } 1317 1318 #ifdef CONFIG_COMPAT 1319 static long evdev_ioctl_compat(struct file *file, 1320 unsigned int cmd, unsigned long arg) 1321 { 1322 return evdev_ioctl_handler(file, cmd, compat_ptr(arg), 1); 1323 } 1324 #endif 1325 1326 static const struct file_operations evdev_fops = { 1327 .owner = THIS_MODULE, 1328 .read = evdev_read, 1329 .write = evdev_write, 1330 .poll = evdev_poll, 1331 .open = evdev_open, 1332 .release = evdev_release, 1333 .unlocked_ioctl = evdev_ioctl, 1334 #ifdef CONFIG_COMPAT 1335 .compat_ioctl = evdev_ioctl_compat, 1336 #endif 1337 .fasync = evdev_fasync, 1338 .flush = evdev_flush, 1339 .llseek = no_llseek, 1340 }; 1341 1342 /* 1343 * Mark device non-existent. This disables writes, ioctls and 1344 * prevents new users from opening the device. Already posted 1345 * blocking reads will stay, however new ones will fail. 1346 */ 1347 static void evdev_mark_dead(struct evdev *evdev) 1348 { 1349 mutex_lock(&evdev->mutex); 1350 evdev->exist = false; 1351 mutex_unlock(&evdev->mutex); 1352 } 1353 1354 static void evdev_cleanup(struct evdev *evdev) 1355 { 1356 struct input_handle *handle = &evdev->handle; 1357 1358 evdev_mark_dead(evdev); 1359 evdev_hangup(evdev); 1360 1361 /* evdev is marked dead so no one else accesses evdev->open */ 1362 if (evdev->open) { 1363 input_flush_device(handle, NULL); 1364 input_close_device(handle); 1365 } 1366 } 1367 1368 /* 1369 * Create new evdev device. Note that input core serializes calls 1370 * to connect and disconnect. 1371 */ 1372 static int evdev_connect(struct input_handler *handler, struct input_dev *dev, 1373 const struct input_device_id *id) 1374 { 1375 struct evdev *evdev; 1376 int minor; 1377 int dev_no; 1378 int error; 1379 1380 minor = input_get_new_minor(EVDEV_MINOR_BASE, EVDEV_MINORS, true); 1381 if (minor < 0) { 1382 error = minor; 1383 pr_err("failed to reserve new minor: %d\n", error); 1384 return error; 1385 } 1386 1387 evdev = kzalloc(sizeof(struct evdev), GFP_KERNEL); 1388 if (!evdev) { 1389 error = -ENOMEM; 1390 goto err_free_minor; 1391 } 1392 1393 INIT_LIST_HEAD(&evdev->client_list); 1394 spin_lock_init(&evdev->client_lock); 1395 mutex_init(&evdev->mutex); 1396 init_waitqueue_head(&evdev->wait); 1397 evdev->exist = true; 1398 1399 dev_no = minor; 1400 /* Normalize device number if it falls into legacy range */ 1401 if (dev_no < EVDEV_MINOR_BASE + EVDEV_MINORS) 1402 dev_no -= EVDEV_MINOR_BASE; 1403 dev_set_name(&evdev->dev, "event%d", dev_no); 1404 1405 evdev->handle.dev = input_get_device(dev); 1406 evdev->handle.name = dev_name(&evdev->dev); 1407 evdev->handle.handler = handler; 1408 evdev->handle.private = evdev; 1409 1410 evdev->dev.devt = MKDEV(INPUT_MAJOR, minor); 1411 evdev->dev.class = &input_class; 1412 evdev->dev.parent = &dev->dev; 1413 evdev->dev.release = evdev_free; 1414 device_initialize(&evdev->dev); 1415 1416 error = input_register_handle(&evdev->handle); 1417 if (error) 1418 goto err_free_evdev; 1419 1420 cdev_init(&evdev->cdev, &evdev_fops); 1421 1422 error = cdev_device_add(&evdev->cdev, &evdev->dev); 1423 if (error) 1424 goto err_cleanup_evdev; 1425 1426 return 0; 1427 1428 err_cleanup_evdev: 1429 evdev_cleanup(evdev); 1430 input_unregister_handle(&evdev->handle); 1431 err_free_evdev: 1432 put_device(&evdev->dev); 1433 err_free_minor: 1434 input_free_minor(minor); 1435 return error; 1436 } 1437 1438 static void evdev_disconnect(struct input_handle *handle) 1439 { 1440 struct evdev *evdev = handle->private; 1441 1442 cdev_device_del(&evdev->cdev, &evdev->dev); 1443 evdev_cleanup(evdev); 1444 input_free_minor(MINOR(evdev->dev.devt)); 1445 input_unregister_handle(handle); 1446 put_device(&evdev->dev); 1447 } 1448 1449 static const struct input_device_id evdev_ids[] = { 1450 { .driver_info = 1 }, /* Matches all devices */ 1451 { }, /* Terminating zero entry */ 1452 }; 1453 1454 MODULE_DEVICE_TABLE(input, evdev_ids); 1455 1456 static struct input_handler evdev_handler = { 1457 .event = evdev_event, 1458 .events = evdev_events, 1459 .connect = evdev_connect, 1460 .disconnect = evdev_disconnect, 1461 .legacy_minors = true, 1462 .minor = EVDEV_MINOR_BASE, 1463 .name = "evdev", 1464 .id_table = evdev_ids, 1465 }; 1466 1467 static int __init evdev_init(void) 1468 { 1469 return input_register_handler(&evdev_handler); 1470 } 1471 1472 static void __exit evdev_exit(void) 1473 { 1474 input_unregister_handler(&evdev_handler); 1475 } 1476 1477 module_init(evdev_init); 1478 module_exit(evdev_exit); 1479 1480 MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>"); 1481 MODULE_DESCRIPTION("Input driver event char devices"); 1482 MODULE_LICENSE("GPL"); 1483