1 /* 2 * User level driver support for input subsystem 3 * 4 * Heavily based on evdev.c by Vojtech Pavlik 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 2 of the License, or 9 * (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, write to the Free Software 18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19 * 20 * Author: Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org> 21 * 22 * Changes/Revisions: 23 * 0.2 16/10/2004 (Micah Dowty <micah@navi.cx>) 24 * - added force feedback support 25 * - added UI_SET_PHYS 26 * 0.1 20/06/2002 27 * - first public version 28 */ 29 #include <linux/poll.h> 30 #include <linux/slab.h> 31 #include <linux/module.h> 32 #include <linux/init.h> 33 #include <linux/input.h> 34 #include <linux/smp_lock.h> 35 #include <linux/fs.h> 36 #include <linux/miscdevice.h> 37 #include <linux/uinput.h> 38 39 static int uinput_dev_event(struct input_dev *dev, unsigned int type, unsigned int code, int value) 40 { 41 struct uinput_device *udev; 42 43 udev = dev->private; 44 45 udev->buff[udev->head].type = type; 46 udev->buff[udev->head].code = code; 47 udev->buff[udev->head].value = value; 48 do_gettimeofday(&udev->buff[udev->head].time); 49 udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE; 50 51 wake_up_interruptible(&udev->waitq); 52 53 return 0; 54 } 55 56 static int uinput_request_alloc_id(struct uinput_device *udev, struct uinput_request *request) 57 { 58 /* Atomically allocate an ID for the given request. Returns 0 on success. */ 59 int id; 60 int err = -1; 61 62 spin_lock(&udev->requests_lock); 63 64 for (id = 0; id < UINPUT_NUM_REQUESTS; id++) 65 if (!udev->requests[id]) { 66 request->id = id; 67 udev->requests[id] = request; 68 err = 0; 69 break; 70 } 71 72 spin_unlock(&udev->requests_lock); 73 return err; 74 } 75 76 static struct uinput_request* uinput_request_find(struct uinput_device *udev, int id) 77 { 78 /* Find an input request, by ID. Returns NULL if the ID isn't valid. */ 79 if (id >= UINPUT_NUM_REQUESTS || id < 0) 80 return NULL; 81 return udev->requests[id]; 82 } 83 84 static inline int uinput_request_reserve_slot(struct uinput_device *udev, struct uinput_request *request) 85 { 86 /* Allocate slot. If none are available right away, wait. */ 87 return wait_event_interruptible(udev->requests_waitq, 88 !uinput_request_alloc_id(udev, request)); 89 } 90 91 static void uinput_request_done(struct uinput_device *udev, struct uinput_request *request) 92 { 93 /* Mark slot as available */ 94 udev->requests[request->id] = NULL; 95 wake_up(&udev->requests_waitq); 96 97 complete(&request->done); 98 } 99 100 static int uinput_request_submit(struct input_dev *dev, struct uinput_request *request) 101 { 102 /* Tell our userspace app about this new request by queueing an input event */ 103 uinput_dev_event(dev, EV_UINPUT, request->code, request->id); 104 105 /* Wait for the request to complete */ 106 wait_for_completion(&request->done); 107 return request->retval; 108 } 109 110 static int uinput_dev_upload_effect(struct input_dev *dev, struct ff_effect *effect) 111 { 112 struct uinput_request request; 113 int retval; 114 115 if (!test_bit(EV_FF, dev->evbit)) 116 return -ENOSYS; 117 118 request.id = -1; 119 init_completion(&request.done); 120 request.code = UI_FF_UPLOAD; 121 request.u.effect = effect; 122 123 retval = uinput_request_reserve_slot(dev->private, &request); 124 if (!retval) 125 retval = uinput_request_submit(dev, &request); 126 127 return retval; 128 } 129 130 static int uinput_dev_erase_effect(struct input_dev *dev, int effect_id) 131 { 132 struct uinput_request request; 133 int retval; 134 135 if (!test_bit(EV_FF, dev->evbit)) 136 return -ENOSYS; 137 138 request.id = -1; 139 init_completion(&request.done); 140 request.code = UI_FF_ERASE; 141 request.u.effect_id = effect_id; 142 143 retval = uinput_request_reserve_slot(dev->private, &request); 144 if (!retval) 145 retval = uinput_request_submit(dev, &request); 146 147 return retval; 148 } 149 150 static void uinput_destroy_device(struct uinput_device *udev) 151 { 152 const char *name, *phys; 153 154 if (udev->dev) { 155 name = udev->dev->name; 156 phys = udev->dev->phys; 157 if (udev->state == UIST_CREATED) 158 input_unregister_device(udev->dev); 159 else 160 input_free_device(udev->dev); 161 kfree(name); 162 kfree(phys); 163 udev->dev = NULL; 164 } 165 166 udev->state = UIST_NEW_DEVICE; 167 } 168 169 static int uinput_create_device(struct uinput_device *udev) 170 { 171 int error; 172 173 if (udev->state != UIST_SETUP_COMPLETE) { 174 printk(KERN_DEBUG "%s: write device info first\n", UINPUT_NAME); 175 return -EINVAL; 176 } 177 178 error = input_register_device(udev->dev); 179 if (error) { 180 uinput_destroy_device(udev); 181 return error; 182 } 183 184 udev->state = UIST_CREATED; 185 186 return 0; 187 } 188 189 static int uinput_open(struct inode *inode, struct file *file) 190 { 191 struct uinput_device *newdev; 192 193 newdev = kzalloc(sizeof(struct uinput_device), GFP_KERNEL); 194 if (!newdev) 195 return -ENOMEM; 196 197 mutex_init(&newdev->mutex); 198 spin_lock_init(&newdev->requests_lock); 199 init_waitqueue_head(&newdev->requests_waitq); 200 init_waitqueue_head(&newdev->waitq); 201 newdev->state = UIST_NEW_DEVICE; 202 203 file->private_data = newdev; 204 205 return 0; 206 } 207 208 static int uinput_validate_absbits(struct input_dev *dev) 209 { 210 unsigned int cnt; 211 int retval = 0; 212 213 for (cnt = 0; cnt < ABS_MAX + 1; cnt++) { 214 if (!test_bit(cnt, dev->absbit)) 215 continue; 216 217 if ((dev->absmax[cnt] <= dev->absmin[cnt])) { 218 printk(KERN_DEBUG 219 "%s: invalid abs[%02x] min:%d max:%d\n", 220 UINPUT_NAME, cnt, 221 dev->absmin[cnt], dev->absmax[cnt]); 222 retval = -EINVAL; 223 break; 224 } 225 226 if (dev->absflat[cnt] > (dev->absmax[cnt] - dev->absmin[cnt])) { 227 printk(KERN_DEBUG 228 "%s: absflat[%02x] out of range: %d " 229 "(min:%d/max:%d)\n", 230 UINPUT_NAME, cnt, dev->absflat[cnt], 231 dev->absmin[cnt], dev->absmax[cnt]); 232 retval = -EINVAL; 233 break; 234 } 235 } 236 return retval; 237 } 238 239 static int uinput_allocate_device(struct uinput_device *udev) 240 { 241 udev->dev = input_allocate_device(); 242 if (!udev->dev) 243 return -ENOMEM; 244 245 udev->dev->event = uinput_dev_event; 246 udev->dev->upload_effect = uinput_dev_upload_effect; 247 udev->dev->erase_effect = uinput_dev_erase_effect; 248 udev->dev->private = udev; 249 250 return 0; 251 } 252 253 static int uinput_setup_device(struct uinput_device *udev, const char __user *buffer, size_t count) 254 { 255 struct uinput_user_dev *user_dev; 256 struct input_dev *dev; 257 char *name; 258 int size; 259 int retval; 260 261 if (count != sizeof(struct uinput_user_dev)) 262 return -EINVAL; 263 264 if (!udev->dev) { 265 retval = uinput_allocate_device(udev); 266 if (retval) 267 return retval; 268 } 269 270 dev = udev->dev; 271 272 user_dev = kmalloc(sizeof(struct uinput_user_dev), GFP_KERNEL); 273 if (!user_dev) 274 return -ENOMEM; 275 276 if (copy_from_user(user_dev, buffer, sizeof(struct uinput_user_dev))) { 277 retval = -EFAULT; 278 goto exit; 279 } 280 281 size = strnlen(user_dev->name, UINPUT_MAX_NAME_SIZE) + 1; 282 if (!size) { 283 retval = -EINVAL; 284 goto exit; 285 } 286 287 kfree(dev->name); 288 dev->name = name = kmalloc(size, GFP_KERNEL); 289 if (!name) { 290 retval = -ENOMEM; 291 goto exit; 292 } 293 strlcpy(name, user_dev->name, size); 294 295 dev->id.bustype = user_dev->id.bustype; 296 dev->id.vendor = user_dev->id.vendor; 297 dev->id.product = user_dev->id.product; 298 dev->id.version = user_dev->id.version; 299 dev->ff_effects_max = user_dev->ff_effects_max; 300 301 size = sizeof(int) * (ABS_MAX + 1); 302 memcpy(dev->absmax, user_dev->absmax, size); 303 memcpy(dev->absmin, user_dev->absmin, size); 304 memcpy(dev->absfuzz, user_dev->absfuzz, size); 305 memcpy(dev->absflat, user_dev->absflat, size); 306 307 /* check if absmin/absmax/absfuzz/absflat are filled as 308 * told in Documentation/input/input-programming.txt */ 309 if (test_bit(EV_ABS, dev->evbit)) { 310 retval = uinput_validate_absbits(dev); 311 if (retval < 0) 312 goto exit; 313 } 314 315 udev->state = UIST_SETUP_COMPLETE; 316 retval = count; 317 318 exit: 319 kfree(user_dev); 320 return retval; 321 } 322 323 static inline ssize_t uinput_inject_event(struct uinput_device *udev, const char __user *buffer, size_t count) 324 { 325 struct input_event ev; 326 327 if (count != sizeof(struct input_event)) 328 return -EINVAL; 329 330 if (copy_from_user(&ev, buffer, sizeof(struct input_event))) 331 return -EFAULT; 332 333 input_event(udev->dev, ev.type, ev.code, ev.value); 334 335 return sizeof(struct input_event); 336 } 337 338 static ssize_t uinput_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos) 339 { 340 struct uinput_device *udev = file->private_data; 341 int retval; 342 343 retval = mutex_lock_interruptible(&udev->mutex); 344 if (retval) 345 return retval; 346 347 retval = udev->state == UIST_CREATED ? 348 uinput_inject_event(udev, buffer, count) : 349 uinput_setup_device(udev, buffer, count); 350 351 mutex_unlock(&udev->mutex); 352 353 return retval; 354 } 355 356 static ssize_t uinput_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos) 357 { 358 struct uinput_device *udev = file->private_data; 359 int retval = 0; 360 361 if (udev->state != UIST_CREATED) 362 return -ENODEV; 363 364 if (udev->head == udev->tail && (file->f_flags & O_NONBLOCK)) 365 return -EAGAIN; 366 367 retval = wait_event_interruptible(udev->waitq, 368 udev->head != udev->tail || udev->state != UIST_CREATED); 369 if (retval) 370 return retval; 371 372 retval = mutex_lock_interruptible(&udev->mutex); 373 if (retval) 374 return retval; 375 376 if (udev->state != UIST_CREATED) { 377 retval = -ENODEV; 378 goto out; 379 } 380 381 while (udev->head != udev->tail && retval + sizeof(struct input_event) <= count) { 382 if (copy_to_user(buffer + retval, &udev->buff[udev->tail], sizeof(struct input_event))) { 383 retval = -EFAULT; 384 goto out; 385 } 386 udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE; 387 retval += sizeof(struct input_event); 388 } 389 390 out: 391 mutex_unlock(&udev->mutex); 392 393 return retval; 394 } 395 396 static unsigned int uinput_poll(struct file *file, poll_table *wait) 397 { 398 struct uinput_device *udev = file->private_data; 399 400 poll_wait(file, &udev->waitq, wait); 401 402 if (udev->head != udev->tail) 403 return POLLIN | POLLRDNORM; 404 405 return 0; 406 } 407 408 static int uinput_release(struct inode *inode, struct file *file) 409 { 410 struct uinput_device *udev = file->private_data; 411 412 uinput_destroy_device(udev); 413 kfree(udev); 414 415 return 0; 416 } 417 418 #define uinput_set_bit(_arg, _bit, _max) \ 419 ({ \ 420 int __ret = 0; \ 421 if (udev->state == UIST_CREATED) \ 422 __ret = -EINVAL; \ 423 else if ((_arg) > (_max)) \ 424 __ret = -EINVAL; \ 425 else set_bit((_arg), udev->dev->_bit); \ 426 __ret; \ 427 }) 428 429 static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 430 { 431 int retval; 432 struct uinput_device *udev; 433 void __user *p = (void __user *)arg; 434 struct uinput_ff_upload ff_up; 435 struct uinput_ff_erase ff_erase; 436 struct uinput_request *req; 437 int length; 438 char *phys; 439 440 udev = file->private_data; 441 442 retval = mutex_lock_interruptible(&udev->mutex); 443 if (retval) 444 return retval; 445 446 if (!udev->dev) { 447 retval = uinput_allocate_device(udev); 448 if (retval) 449 goto out; 450 } 451 452 switch (cmd) { 453 case UI_DEV_CREATE: 454 retval = uinput_create_device(udev); 455 break; 456 457 case UI_DEV_DESTROY: 458 uinput_destroy_device(udev); 459 break; 460 461 case UI_SET_EVBIT: 462 retval = uinput_set_bit(arg, evbit, EV_MAX); 463 break; 464 465 case UI_SET_KEYBIT: 466 retval = uinput_set_bit(arg, keybit, KEY_MAX); 467 break; 468 469 case UI_SET_RELBIT: 470 retval = uinput_set_bit(arg, relbit, REL_MAX); 471 break; 472 473 case UI_SET_ABSBIT: 474 retval = uinput_set_bit(arg, absbit, ABS_MAX); 475 break; 476 477 case UI_SET_MSCBIT: 478 retval = uinput_set_bit(arg, mscbit, MSC_MAX); 479 break; 480 481 case UI_SET_LEDBIT: 482 retval = uinput_set_bit(arg, ledbit, LED_MAX); 483 break; 484 485 case UI_SET_SNDBIT: 486 retval = uinput_set_bit(arg, sndbit, SND_MAX); 487 break; 488 489 case UI_SET_FFBIT: 490 retval = uinput_set_bit(arg, ffbit, FF_MAX); 491 break; 492 493 case UI_SET_SWBIT: 494 retval = uinput_set_bit(arg, swbit, SW_MAX); 495 break; 496 497 case UI_SET_PHYS: 498 if (udev->state == UIST_CREATED) { 499 retval = -EINVAL; 500 goto out; 501 } 502 length = strnlen_user(p, 1024); 503 if (length <= 0) { 504 retval = -EFAULT; 505 break; 506 } 507 kfree(udev->dev->phys); 508 udev->dev->phys = phys = kmalloc(length, GFP_KERNEL); 509 if (!phys) { 510 retval = -ENOMEM; 511 break; 512 } 513 if (copy_from_user(phys, p, length)) { 514 udev->dev->phys = NULL; 515 kfree(phys); 516 retval = -EFAULT; 517 break; 518 } 519 phys[length - 1] = '\0'; 520 break; 521 522 case UI_BEGIN_FF_UPLOAD: 523 if (copy_from_user(&ff_up, p, sizeof(ff_up))) { 524 retval = -EFAULT; 525 break; 526 } 527 req = uinput_request_find(udev, ff_up.request_id); 528 if (!(req && req->code == UI_FF_UPLOAD && req->u.effect)) { 529 retval = -EINVAL; 530 break; 531 } 532 ff_up.retval = 0; 533 memcpy(&ff_up.effect, req->u.effect, sizeof(struct ff_effect)); 534 if (copy_to_user(p, &ff_up, sizeof(ff_up))) { 535 retval = -EFAULT; 536 break; 537 } 538 break; 539 540 case UI_BEGIN_FF_ERASE: 541 if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) { 542 retval = -EFAULT; 543 break; 544 } 545 req = uinput_request_find(udev, ff_erase.request_id); 546 if (!(req && req->code == UI_FF_ERASE)) { 547 retval = -EINVAL; 548 break; 549 } 550 ff_erase.retval = 0; 551 ff_erase.effect_id = req->u.effect_id; 552 if (copy_to_user(p, &ff_erase, sizeof(ff_erase))) { 553 retval = -EFAULT; 554 break; 555 } 556 break; 557 558 case UI_END_FF_UPLOAD: 559 if (copy_from_user(&ff_up, p, sizeof(ff_up))) { 560 retval = -EFAULT; 561 break; 562 } 563 req = uinput_request_find(udev, ff_up.request_id); 564 if (!(req && req->code == UI_FF_UPLOAD && req->u.effect)) { 565 retval = -EINVAL; 566 break; 567 } 568 req->retval = ff_up.retval; 569 memcpy(req->u.effect, &ff_up.effect, sizeof(struct ff_effect)); 570 uinput_request_done(udev, req); 571 break; 572 573 case UI_END_FF_ERASE: 574 if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) { 575 retval = -EFAULT; 576 break; 577 } 578 req = uinput_request_find(udev, ff_erase.request_id); 579 if (!(req && req->code == UI_FF_ERASE)) { 580 retval = -EINVAL; 581 break; 582 } 583 req->retval = ff_erase.retval; 584 uinput_request_done(udev, req); 585 break; 586 587 default: 588 retval = -EINVAL; 589 } 590 591 out: 592 mutex_unlock(&udev->mutex); 593 return retval; 594 } 595 596 static struct file_operations uinput_fops = { 597 .owner = THIS_MODULE, 598 .open = uinput_open, 599 .release = uinput_release, 600 .read = uinput_read, 601 .write = uinput_write, 602 .poll = uinput_poll, 603 .unlocked_ioctl = uinput_ioctl, 604 }; 605 606 static struct miscdevice uinput_misc = { 607 .fops = &uinput_fops, 608 .minor = UINPUT_MINOR, 609 .name = UINPUT_NAME, 610 }; 611 612 static int __init uinput_init(void) 613 { 614 return misc_register(&uinput_misc); 615 } 616 617 static void __exit uinput_exit(void) 618 { 619 misc_deregister(&uinput_misc); 620 } 621 622 MODULE_AUTHOR("Aristeu Sergio Rozanski Filho"); 623 MODULE_DESCRIPTION("User level driver support for input subsystem"); 624 MODULE_LICENSE("GPL"); 625 626 module_init(uinput_init); 627 module_exit(uinput_exit); 628 629