evdev.c 21.0 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12
/*
 * Event char devices, giving access to raw input device events.
 *
 * Copyright (c) 1999-2002 Vojtech Pavlik
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 as published by
 * the Free Software Foundation.
 */

#define EVDEV_MINOR_BASE	64
#define EVDEV_MINORS		32
13 14
#define EVDEV_MIN_BUFFER_SIZE	64U
#define EVDEV_BUF_PACKETS	8
L
Linus Torvalds 已提交
15 16

#include <linux/poll.h>
17
#include <linux/sched.h>
L
Linus Torvalds 已提交
18 19 20 21 22 23
#include <linux/slab.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/input.h>
#include <linux/major.h>
#include <linux/device.h>
24
#include "input-compat.h"
L
Linus Torvalds 已提交
25 26 27 28 29 30

struct evdev {
	int open;
	int minor;
	struct input_handle handle;
	wait_queue_head_t wait;
31 32
	struct evdev_client *grab;
	struct list_head client_list;
33 34
	spinlock_t client_lock; /* protects client_list */
	struct mutex mutex;
35
	struct device dev;
36
	bool exist;
L
Linus Torvalds 已提交
37 38
};

39
struct evdev_client {
L
Linus Torvalds 已提交
40 41
	int head;
	int tail;
42
	spinlock_t buffer_lock; /* protects access to buffer, head and tail */
L
Linus Torvalds 已提交
43 44 45
	struct fasync_struct *fasync;
	struct evdev *evdev;
	struct list_head node;
46 47
	int bufsize;
	struct input_event buffer[];
L
Linus Torvalds 已提交
48 49 50
};

static struct evdev *evdev_table[EVDEV_MINORS];
51
static DEFINE_MUTEX(evdev_table_mutex);
L
Linus Torvalds 已提交
52

53 54 55 56
static void evdev_pass_event(struct evdev_client *client,
			     struct input_event *event)
{
	/*
57 58 59
	 * Interrupts are disabled, just acquire the lock.
	 * Make sure we don't leave with the client buffer
	 * "empty" by having client->head == client->tail.
60 61
	 */
	spin_lock(&client->buffer_lock);
62 63 64 65
	do {
		client->buffer[client->head++] = *event;
		client->head &= client->bufsize - 1;
	} while (client->head == client->tail);
66 67
	spin_unlock(&client->buffer_lock);

68 69
	if (event->type == EV_SYN)
		kill_fasync(&client->fasync, SIGIO, POLL_IN);
70 71 72
}

/*
D
Dmitry Torokhov 已提交
73
 * Pass incoming event to all connected clients.
74 75 76
 */
static void evdev_event(struct input_handle *handle,
			unsigned int type, unsigned int code, int value)
L
Linus Torvalds 已提交
77 78
{
	struct evdev *evdev = handle->private;
79
	struct evdev_client *client;
80
	struct input_event event;
L
Linus Torvalds 已提交
81

82 83 84 85
	do_gettimeofday(&event.time);
	event.type = type;
	event.code = code;
	event.value = value;
L
Linus Torvalds 已提交
86

D
Dmitry Torokhov 已提交
87 88
	rcu_read_lock();

89 90 91 92 93 94
	client = rcu_dereference(evdev->grab);
	if (client)
		evdev_pass_event(client, &event);
	else
		list_for_each_entry_rcu(client, &evdev->client_list, node)
			evdev_pass_event(client, &event);
L
Linus Torvalds 已提交
95

D
Dmitry Torokhov 已提交
96 97
	rcu_read_unlock();

L
Linus Torvalds 已提交
98 99 100 101 102
	wake_up_interruptible(&evdev->wait);
}

static int evdev_fasync(int fd, struct file *file, int on)
{
103
	struct evdev_client *client = file->private_data;
104

105
	return fasync_helper(fd, file, on, &client->fasync);
L
Linus Torvalds 已提交
106 107
}

108
static int evdev_flush(struct file *file, fl_owner_t id)
L
Linus Torvalds 已提交
109
{
110 111
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
112 113 114 115 116
	int retval;

	retval = mutex_lock_interruptible(&evdev->mutex);
	if (retval)
		return retval;
117

118
	if (!evdev->exist)
119 120 121
		retval = -ENODEV;
	else
		retval = input_flush_device(&evdev->handle, file);
122

123 124
	mutex_unlock(&evdev->mutex);
	return retval;
L
Linus Torvalds 已提交
125 126
}

127
static void evdev_free(struct device *dev)
L
Linus Torvalds 已提交
128
{
129 130
	struct evdev *evdev = container_of(dev, struct evdev, dev);

131
	input_put_device(evdev->handle.dev);
L
Linus Torvalds 已提交
132 133 134
	kfree(evdev);
}

135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150
/*
 * Grabs an event device (along with underlying input device).
 * This function is called with evdev->mutex taken.
 */
static int evdev_grab(struct evdev *evdev, struct evdev_client *client)
{
	int error;

	if (evdev->grab)
		return -EBUSY;

	error = input_grab_device(&evdev->handle);
	if (error)
		return error;

	rcu_assign_pointer(evdev->grab, client);
D
Dmitry Torokhov 已提交
151
	synchronize_rcu();
152 153 154 155 156 157 158 159 160 161

	return 0;
}

static int evdev_ungrab(struct evdev *evdev, struct evdev_client *client)
{
	if (evdev->grab != client)
		return  -EINVAL;

	rcu_assign_pointer(evdev->grab, NULL);
D
Dmitry Torokhov 已提交
162
	synchronize_rcu();
163 164 165 166 167 168 169 170 171 172 173
	input_release_device(&evdev->handle);

	return 0;
}

static void evdev_attach_client(struct evdev *evdev,
				struct evdev_client *client)
{
	spin_lock(&evdev->client_lock);
	list_add_tail_rcu(&client->node, &evdev->client_list);
	spin_unlock(&evdev->client_lock);
D
Dmitry Torokhov 已提交
174
	synchronize_rcu();
175 176 177 178 179 180 181 182
}

static void evdev_detach_client(struct evdev *evdev,
				struct evdev_client *client)
{
	spin_lock(&evdev->client_lock);
	list_del_rcu(&client->node);
	spin_unlock(&evdev->client_lock);
D
Dmitry Torokhov 已提交
183
	synchronize_rcu();
184 185 186 187 188 189 190 191 192 193 194 195
}

static int evdev_open_device(struct evdev *evdev)
{
	int retval;

	retval = mutex_lock_interruptible(&evdev->mutex);
	if (retval)
		return retval;

	if (!evdev->exist)
		retval = -ENODEV;
196
	else if (!evdev->open++) {
197
		retval = input_open_device(&evdev->handle);
198 199 200
		if (retval)
			evdev->open--;
	}
201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231

	mutex_unlock(&evdev->mutex);
	return retval;
}

static void evdev_close_device(struct evdev *evdev)
{
	mutex_lock(&evdev->mutex);

	if (evdev->exist && !--evdev->open)
		input_close_device(&evdev->handle);

	mutex_unlock(&evdev->mutex);
}

/*
 * Wake up users waiting for IO so they can disconnect from
 * dead device.
 */
static void evdev_hangup(struct evdev *evdev)
{
	struct evdev_client *client;

	spin_lock(&evdev->client_lock);
	list_for_each_entry(client, &evdev->client_list, node)
		kill_fasync(&client->fasync, SIGIO, POLL_HUP);
	spin_unlock(&evdev->client_lock);

	wake_up_interruptible(&evdev->wait);
}

232
static int evdev_release(struct inode *inode, struct file *file)
L
Linus Torvalds 已提交
233
{
234 235
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
L
Linus Torvalds 已提交
236

237 238 239 240
	mutex_lock(&evdev->mutex);
	if (evdev->grab == client)
		evdev_ungrab(evdev, client);
	mutex_unlock(&evdev->mutex);
L
Linus Torvalds 已提交
241

242
	evdev_detach_client(evdev, client);
243
	kfree(client);
L
Linus Torvalds 已提交
244

245
	evdev_close_device(evdev);
246
	put_device(&evdev->dev);
L
Linus Torvalds 已提交
247 248 249 250

	return 0;
}

251 252
static unsigned int evdev_compute_buffer_size(struct input_dev *dev)
{
253 254 255 256 257
	unsigned int n_events =
		max(dev->hint_events_per_packet * EVDEV_BUF_PACKETS,
		    EVDEV_MIN_BUFFER_SIZE);

	return roundup_pow_of_two(n_events);
258 259
}

260
static int evdev_open(struct inode *inode, struct file *file)
L
Linus Torvalds 已提交
261
{
262
	struct evdev *evdev;
263
	struct evdev_client *client;
L
Linus Torvalds 已提交
264
	int i = iminor(inode) - EVDEV_MINOR_BASE;
265
	unsigned int bufsize;
266
	int error;
L
Linus Torvalds 已提交
267

268
	if (i >= EVDEV_MINORS)
L
Linus Torvalds 已提交
269 270
		return -ENODEV;

271 272 273
	error = mutex_lock_interruptible(&evdev_table_mutex);
	if (error)
		return error;
274
	evdev = evdev_table[i];
275 276 277
	if (evdev)
		get_device(&evdev->dev);
	mutex_unlock(&evdev_table_mutex);
278

279
	if (!evdev)
L
Linus Torvalds 已提交
280 281
		return -ENODEV;

282 283 284 285 286
	bufsize = evdev_compute_buffer_size(evdev->handle.dev);

	client = kzalloc(sizeof(struct evdev_client) +
				bufsize * sizeof(struct input_event),
			 GFP_KERNEL);
287 288 289 290
	if (!client) {
		error = -ENOMEM;
		goto err_put_evdev;
	}
L
Linus Torvalds 已提交
291

292
	client->bufsize = bufsize;
293
	spin_lock_init(&client->buffer_lock);
294
	client->evdev = evdev;
295
	evdev_attach_client(evdev, client);
L
Linus Torvalds 已提交
296

297 298 299
	error = evdev_open_device(evdev);
	if (error)
		goto err_free_client;
L
Linus Torvalds 已提交
300

301
	file->private_data = client;
302 303
	nonseekable_open(inode, file);

L
Linus Torvalds 已提交
304
	return 0;
305 306

 err_free_client:
307
	evdev_detach_client(evdev, client);
308 309 310 311
	kfree(client);
 err_put_evdev:
	put_device(&evdev->dev);
	return error;
L
Linus Torvalds 已提交
312 313
}

314 315
static ssize_t evdev_write(struct file *file, const char __user *buffer,
			   size_t count, loff_t *ppos)
316
{
317 318
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
319
	struct input_event event;
320
	int retval;
321

322 323 324 325 326 327 328 329
	retval = mutex_lock_interruptible(&evdev->mutex);
	if (retval)
		return retval;

	if (!evdev->exist) {
		retval = -ENODEV;
		goto out;
	}
330

331 332
	while (retval < count) {

333
		if (input_event_from_user(buffer + retval, &event)) {
334 335 336 337 338 339
			retval = -EFAULT;
			goto out;
		}

		input_inject_event(&evdev->handle,
				   event.type, event.code, event.value);
340
		retval += input_event_size();
341 342
	}

343 344
 out:
	mutex_unlock(&evdev->mutex);
345 346 347
	return retval;
}

348 349 350 351 352 353 354 355 356 357
static int evdev_fetch_next_event(struct evdev_client *client,
				  struct input_event *event)
{
	int have_event;

	spin_lock_irq(&client->buffer_lock);

	have_event = client->head != client->tail;
	if (have_event) {
		*event = client->buffer[client->tail++];
358
		client->tail &= client->bufsize - 1;
359 360 361 362 363 364 365 366 367
	}

	spin_unlock_irq(&client->buffer_lock);

	return have_event;
}

static ssize_t evdev_read(struct file *file, char __user *buffer,
			  size_t count, loff_t *ppos)
L
Linus Torvalds 已提交
368
{
369 370
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
371
	struct input_event event;
L
Linus Torvalds 已提交
372 373
	int retval;

374
	if (count < input_event_size())
L
Linus Torvalds 已提交
375 376
		return -EINVAL;

377 378
	if (client->head == client->tail && evdev->exist &&
	    (file->f_flags & O_NONBLOCK))
L
Linus Torvalds 已提交
379 380
		return -EAGAIN;

381 382
	retval = wait_event_interruptible(evdev->wait,
		client->head != client->tail || !evdev->exist);
L
Linus Torvalds 已提交
383 384 385
	if (retval)
		return retval;

386
	if (!evdev->exist)
L
Linus Torvalds 已提交
387 388
		return -ENODEV;

389
	while (retval + input_event_size() <= count &&
390
	       evdev_fetch_next_event(client, &event)) {
391

392
		if (input_event_to_user(buffer + retval, &event))
393 394
			return -EFAULT;

395
		retval += input_event_size();
L
Linus Torvalds 已提交
396 397 398 399 400 401 402 403
	}

	return retval;
}

/* No kernel lock - fine */
static unsigned int evdev_poll(struct file *file, poll_table *wait)
{
404 405
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
406
	unsigned int mask;
407

408
	poll_wait(file, &evdev->wait, wait);
409 410 411 412 413 414

	mask = evdev->exist ? POLLOUT | POLLWRNORM : POLLHUP | POLLERR;
	if (client->head != client->tail)
		mask |= POLLIN | POLLRDNORM;

	return mask;
L
Linus Torvalds 已提交
415 416
}

417 418 419
#ifdef CONFIG_COMPAT

#define BITS_PER_LONG_COMPAT (sizeof(compat_long_t) * 8)
420
#define BITS_TO_LONGS_COMPAT(x) ((((x) - 1) / BITS_PER_LONG_COMPAT) + 1)
421 422 423 424 425 426 427 428

#ifdef __BIG_ENDIAN
static int bits_to_user(unsigned long *bits, unsigned int maxbit,
			unsigned int maxlen, void __user *p, int compat)
{
	int len, i;

	if (compat) {
429
		len = BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t);
430
		if (len > maxlen)
431 432 433 434 435 436 437 438 439
			len = maxlen;

		for (i = 0; i < len / sizeof(compat_long_t); i++)
			if (copy_to_user((compat_long_t __user *) p + i,
					 (compat_long_t *) bits +
						i + 1 - ((i % 2) << 1),
					 sizeof(compat_long_t)))
				return -EFAULT;
	} else {
440
		len = BITS_TO_LONGS(maxbit) * sizeof(long);
441 442 443 444 445 446 447 448 449 450 451 452 453 454
		if (len > maxlen)
			len = maxlen;

		if (copy_to_user(p, bits, len))
			return -EFAULT;
	}

	return len;
}
#else
static int bits_to_user(unsigned long *bits, unsigned int maxbit,
			unsigned int maxlen, void __user *p, int compat)
{
	int len = compat ?
455 456
			BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t) :
			BITS_TO_LONGS(maxbit) * sizeof(long);
457 458 459 460 461 462 463 464 465 466 467 468 469

	if (len > maxlen)
		len = maxlen;

	return copy_to_user(p, bits, len) ? -EFAULT : len;
}
#endif /* __BIG_ENDIAN */

#else

static int bits_to_user(unsigned long *bits, unsigned int maxbit,
			unsigned int maxlen, void __user *p, int compat)
{
470
	int len = BITS_TO_LONGS(maxbit) * sizeof(long);
471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493

	if (len > maxlen)
		len = maxlen;

	return copy_to_user(p, bits, len) ? -EFAULT : len;
}

#endif /* CONFIG_COMPAT */

static int str_to_user(const char *str, unsigned int maxlen, void __user *p)
{
	int len;

	if (!str)
		return -ENOENT;

	len = strlen(str) + 1;
	if (len > maxlen)
		len = maxlen;

	return copy_to_user(p, str, len) ? -EFAULT : len;
}

494
#define OLD_KEY_MAX	0x1ff
495 496
static int handle_eviocgbit(struct input_dev *dev, unsigned int cmd, void __user *p, int compat_mode)
{
497
	static unsigned long keymax_warn_time;
498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513
	unsigned long *bits;
	int len;

	switch (_IOC_NR(cmd) & EV_MAX) {

	case      0: bits = dev->evbit;  len = EV_MAX;  break;
	case EV_KEY: bits = dev->keybit; len = KEY_MAX; break;
	case EV_REL: bits = dev->relbit; len = REL_MAX; break;
	case EV_ABS: bits = dev->absbit; len = ABS_MAX; break;
	case EV_MSC: bits = dev->mscbit; len = MSC_MAX; break;
	case EV_LED: bits = dev->ledbit; len = LED_MAX; break;
	case EV_SND: bits = dev->sndbit; len = SND_MAX; break;
	case EV_FF:  bits = dev->ffbit;  len = FF_MAX;  break;
	case EV_SW:  bits = dev->swbit;  len = SW_MAX;  break;
	default: return -EINVAL;
	}
514 515 516 517 518 519 520 521 522 523

	/*
	 * Work around bugs in userspace programs that like to do
	 * EVIOCGBIT(EV_KEY, KEY_MAX) and not realize that 'len'
	 * should be in bytes, not in bits.
	 */
	if ((_IOC_NR(cmd) & EV_MAX) == EV_KEY && _IOC_SIZE(cmd) == OLD_KEY_MAX) {
		len = OLD_KEY_MAX;
		if (printk_timed_ratelimit(&keymax_warn_time, 10 * 1000))
			printk(KERN_WARNING
524 525
				"evdev.c(EVIOCGBIT): Suspicious buffer size %u, "
				"limiting output to %zu bytes. See "
526 527 528 529 530
				"http://userweb.kernel.org/~dtor/eviocgbit-bug.html\n",
				OLD_KEY_MAX,
				BITS_TO_LONGS(OLD_KEY_MAX) * sizeof(long));
	}

531 532
	return bits_to_user(bits, len, _IOC_SIZE(cmd), p, compat_mode);
}
533
#undef OLD_KEY_MAX
534

535 536
static long evdev_do_ioctl(struct file *file, unsigned int cmd,
			   void __user *p, int compat_mode)
L
Linus Torvalds 已提交
537
{
538 539
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
L
Linus Torvalds 已提交
540 541
	struct input_dev *dev = evdev->handle.dev;
	struct input_absinfo abs;
542
	struct ff_effect effect;
543
	int __user *ip = (int __user *)p;
544
	unsigned int i, t, u, v;
545
	int error;
L
Linus Torvalds 已提交
546 547 548

	switch (cmd) {

549 550
	case EVIOCGVERSION:
		return put_user(EV_VERSION, ip);
L
Linus Torvalds 已提交
551

552 553 554 555
	case EVIOCGID:
		if (copy_to_user(p, &dev->id, sizeof(struct input_id)))
			return -EFAULT;
		return 0;
556

557 558 559 560 561 562 563 564
	case EVIOCGREP:
		if (!test_bit(EV_REP, dev->evbit))
			return -ENOSYS;
		if (put_user(dev->rep[REP_DELAY], ip))
			return -EFAULT;
		if (put_user(dev->rep[REP_PERIOD], ip + 1))
			return -EFAULT;
		return 0;
565

566 567 568 569 570 571 572
	case EVIOCSREP:
		if (!test_bit(EV_REP, dev->evbit))
			return -ENOSYS;
		if (get_user(u, ip))
			return -EFAULT;
		if (get_user(v, ip + 1))
			return -EFAULT;
573

574 575
		input_inject_event(&evdev->handle, EV_REP, REP_DELAY, u);
		input_inject_event(&evdev->handle, EV_REP, REP_PERIOD, v);
576

577
		return 0;
L
Linus Torvalds 已提交
578

579 580 581
	case EVIOCGKEYCODE:
		if (get_user(t, ip))
			return -EFAULT;
582

583
		error = input_get_keycode(dev, t, &v);
584 585
		if (error)
			return error;
586

587 588
		if (put_user(v, ip + 1))
			return -EFAULT;
589

590
		return 0;
L
Linus Torvalds 已提交
591

592 593 594
	case EVIOCSKEYCODE:
		if (get_user(t, ip) || get_user(v, ip + 1))
			return -EFAULT;
595

596
		return input_set_keycode(dev, t, v);
L
Linus Torvalds 已提交
597

598 599
	case EVIOCRMFF:
		return input_ff_erase(dev, (int)(unsigned long) p, file);
L
Linus Torvalds 已提交
600

601 602 603 604 605 606 607 608 609 610 611 612
	case EVIOCGEFFECTS:
		i = test_bit(EV_FF, dev->evbit) ?
				dev->ff->max_effects : 0;
		if (put_user(i, ip))
			return -EFAULT;
		return 0;

	case EVIOCGRAB:
		if (p)
			return evdev_grab(evdev, client);
		else
			return evdev_ungrab(evdev, client);
L
Linus Torvalds 已提交
613

614
	default:
L
Linus Torvalds 已提交
615

616 617
		if (_IOC_TYPE(cmd) != 'E')
			return -EINVAL;
L
Linus Torvalds 已提交
618

619
		if (_IOC_DIR(cmd) == _IOC_READ) {
620

621 622
			if ((_IOC_NR(cmd) & ~EV_MAX) == _IOC_NR(EVIOCGBIT(0, 0)))
				return handle_eviocgbit(dev, cmd, p, compat_mode);
L
Linus Torvalds 已提交
623

624 625 626
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCGKEY(0)))
				return bits_to_user(dev->key, KEY_MAX, _IOC_SIZE(cmd),
						    p, compat_mode);
L
Linus Torvalds 已提交
627

628 629 630
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCGLED(0)))
				return bits_to_user(dev->led, LED_MAX, _IOC_SIZE(cmd),
						    p, compat_mode);
L
Linus Torvalds 已提交
631

632 633 634
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCGSND(0)))
				return bits_to_user(dev->snd, SND_MAX, _IOC_SIZE(cmd),
						    p, compat_mode);
635

636 637 638
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCGSW(0)))
				return bits_to_user(dev->sw, SW_MAX, _IOC_SIZE(cmd),
						    p, compat_mode);
L
Linus Torvalds 已提交
639

640
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCGNAME(0)))
641
				return str_to_user(dev->name, _IOC_SIZE(cmd), p);
L
Linus Torvalds 已提交
642

643 644
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCGPHYS(0)))
				return str_to_user(dev->phys, _IOC_SIZE(cmd), p);
L
Linus Torvalds 已提交
645

646 647
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCGUNIQ(0)))
				return str_to_user(dev->uniq, _IOC_SIZE(cmd), p);
L
Linus Torvalds 已提交
648

649
			if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) {
L
Linus Torvalds 已提交
650

651
				t = _IOC_NR(cmd) & ABS_MAX;
L
Linus Torvalds 已提交
652

653 654 655 656 657 658
				abs.value = input_abs_get_val(dev, t);
				abs.minimum = input_abs_get_min(dev, t);
				abs.maximum = input_abs_get_max(dev, t);
				abs.fuzz = input_abs_get_fuzz(dev, t);
				abs.flat = input_abs_get_flat(dev, t);
				abs.resolution = input_abs_get_res(dev, t);
659

660 661 662
				if (copy_to_user(p, &abs, min_t(size_t,
								_IOC_SIZE(cmd),
								sizeof(struct input_absinfo))))
663
					return -EFAULT;
L
Linus Torvalds 已提交
664

665
				return 0;
L
Linus Torvalds 已提交
666 667
			}

668 669 670
		}

		if (_IOC_DIR(cmd) == _IOC_WRITE) {
L
Linus Torvalds 已提交
671

672 673
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCSFF)) {

674
				if (input_ff_effect_from_user(p, _IOC_SIZE(cmd), &effect))
675 676 677 678 679 680 681 682 683 684
					return -EFAULT;

				error = input_ff_upload(dev, &effect, file);

				if (put_user(effect.id, &(((struct ff_effect __user *)p)->id)))
					return -EFAULT;

				return error;
			}

685
			if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) {
L
Linus Torvalds 已提交
686

687
				t = _IOC_NR(cmd) & ABS_MAX;
688

689 690 691
				if (copy_from_user(&abs, p, min_t(size_t,
								  _IOC_SIZE(cmd),
								  sizeof(struct input_absinfo))))
692
					return -EFAULT;
L
Linus Torvalds 已提交
693

H
Henrik Rydberg 已提交
694 695 696 697
				/* We can't change number of reserved MT slots */
				if (t == ABS_MT_SLOT)
					return -EINVAL;

698 699 700 701 702 703
				/*
				 * Take event lock to ensure that we are not
				 * changing device parameters in the middle
				 * of event.
				 */
				spin_lock_irq(&dev->event_lock);
L
Linus Torvalds 已提交
704

705 706 707 708 709 710 711
				input_abs_set_val(dev, t, abs.value);
				input_abs_set_min(dev, t, abs.minimum);
				input_abs_set_max(dev, t, abs.maximum);
				input_abs_set_fuzz(dev, t, abs.fuzz);
				input_abs_set_flat(dev, t, abs.flat);
				input_abs_set_res(dev, t, _IOC_SIZE(cmd) < sizeof(struct input_absinfo) ?
								0 : abs.resolution);
712 713 714 715

				spin_unlock_irq(&dev->event_lock);

				return 0;
L
Linus Torvalds 已提交
716
			}
717
		}
L
Linus Torvalds 已提交
718 719 720 721
	}
	return -EINVAL;
}

722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744
static long evdev_ioctl_handler(struct file *file, unsigned int cmd,
				void __user *p, int compat_mode)
{
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
	int retval;

	retval = mutex_lock_interruptible(&evdev->mutex);
	if (retval)
		return retval;

	if (!evdev->exist) {
		retval = -ENODEV;
		goto out;
	}

	retval = evdev_do_ioctl(file, cmd, p, compat_mode);

 out:
	mutex_unlock(&evdev->mutex);
	return retval;
}

745 746 747 748
static long evdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
	return evdev_ioctl_handler(file, cmd, (void __user *)arg, 0);
}
749

750
#ifdef CONFIG_COMPAT
751 752
static long evdev_ioctl_compat(struct file *file,
				unsigned int cmd, unsigned long arg)
753
{
754
	return evdev_ioctl_handler(file, cmd, compat_ptr(arg), 1);
L
Linus Torvalds 已提交
755
}
756
#endif
L
Linus Torvalds 已提交
757

D
Dmitry Torokhov 已提交
758
static const struct file_operations evdev_fops = {
759 760 761 762 763 764 765
	.owner		= THIS_MODULE,
	.read		= evdev_read,
	.write		= evdev_write,
	.poll		= evdev_poll,
	.open		= evdev_open,
	.release	= evdev_release,
	.unlocked_ioctl	= evdev_ioctl,
766
#ifdef CONFIG_COMPAT
767
	.compat_ioctl	= evdev_ioctl_compat,
768
#endif
769 770
	.fasync		= evdev_fasync,
	.flush		= evdev_flush
L
Linus Torvalds 已提交
771 772
};

773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800
static int evdev_install_chrdev(struct evdev *evdev)
{
	/*
	 * No need to do any locking here as calls to connect and
	 * disconnect are serialized by the input core
	 */
	evdev_table[evdev->minor] = evdev;
	return 0;
}

static void evdev_remove_chrdev(struct evdev *evdev)
{
	/*
	 * Lock evdev table to prevent race with evdev_open()
	 */
	mutex_lock(&evdev_table_mutex);
	evdev_table[evdev->minor] = NULL;
	mutex_unlock(&evdev_table_mutex);
}

/*
 * Mark device non-existent. This disables writes, ioctls and
 * prevents new users from opening the device. Already posted
 * blocking reads will stay, however new ones will fail.
 */
static void evdev_mark_dead(struct evdev *evdev)
{
	mutex_lock(&evdev->mutex);
801
	evdev->exist = false;
802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823
	mutex_unlock(&evdev->mutex);
}

static void evdev_cleanup(struct evdev *evdev)
{
	struct input_handle *handle = &evdev->handle;

	evdev_mark_dead(evdev);
	evdev_hangup(evdev);
	evdev_remove_chrdev(evdev);

	/* evdev is marked dead so no one else accesses evdev->open */
	if (evdev->open) {
		input_flush_device(handle, NULL);
		input_close_device(handle);
	}
}

/*
 * Create new evdev device. Note that input core serializes calls
 * to connect and disconnect so we don't need to lock evdev_table here.
 */
824 825
static int evdev_connect(struct input_handler *handler, struct input_dev *dev,
			 const struct input_device_id *id)
L
Linus Torvalds 已提交
826 827 828
{
	struct evdev *evdev;
	int minor;
829
	int error;
L
Linus Torvalds 已提交
830

831 832 833 834
	for (minor = 0; minor < EVDEV_MINORS; minor++)
		if (!evdev_table[minor])
			break;

L
Linus Torvalds 已提交
835 836
	if (minor == EVDEV_MINORS) {
		printk(KERN_ERR "evdev: no more free evdev devices\n");
837
		return -ENFILE;
L
Linus Torvalds 已提交
838 839
	}

840 841 842
	evdev = kzalloc(sizeof(struct evdev), GFP_KERNEL);
	if (!evdev)
		return -ENOMEM;
L
Linus Torvalds 已提交
843

844
	INIT_LIST_HEAD(&evdev->client_list);
845 846
	spin_lock_init(&evdev->client_lock);
	mutex_init(&evdev->mutex);
L
Linus Torvalds 已提交
847 848
	init_waitqueue_head(&evdev->wait);

849
	dev_set_name(&evdev->dev, "event%d", minor);
850
	evdev->exist = true;
L
Linus Torvalds 已提交
851
	evdev->minor = minor;
852

853
	evdev->handle.dev = input_get_device(dev);
854
	evdev->handle.name = dev_name(&evdev->dev);
L
Linus Torvalds 已提交
855 856 857
	evdev->handle.handler = handler;
	evdev->handle.private = evdev;

858
	evdev->dev.devt = MKDEV(INPUT_MAJOR, EVDEV_MINOR_BASE + minor);
859 860 861 862
	evdev->dev.class = &input_class;
	evdev->dev.parent = &dev->dev;
	evdev->dev.release = evdev_free;
	device_initialize(&evdev->dev);
863

864
	error = input_register_handle(&evdev->handle);
865
	if (error)
866
		goto err_free_evdev;
867

868 869 870 871 872
	error = evdev_install_chrdev(evdev);
	if (error)
		goto err_unregister_handle;

	error = device_add(&evdev->dev);
873
	if (error)
874
		goto err_cleanup_evdev;
L
Linus Torvalds 已提交
875

876
	return 0;
L
Linus Torvalds 已提交
877

878 879 880 881
 err_cleanup_evdev:
	evdev_cleanup(evdev);
 err_unregister_handle:
	input_unregister_handle(&evdev->handle);
882
 err_free_evdev:
883
	put_device(&evdev->dev);
884
	return error;
L
Linus Torvalds 已提交
885 886 887 888 889 890
}

static void evdev_disconnect(struct input_handle *handle)
{
	struct evdev *evdev = handle->private;

891
	device_del(&evdev->dev);
892 893
	evdev_cleanup(evdev);
	input_unregister_handle(handle);
894
	put_device(&evdev->dev);
L
Linus Torvalds 已提交
895 896
}

D
Dmitry Torokhov 已提交
897
static const struct input_device_id evdev_ids[] = {
L
Linus Torvalds 已提交
898 899 900 901 902 903 904
	{ .driver_info = 1 },	/* Matches all devices */
	{ },			/* Terminating zero entry */
};

MODULE_DEVICE_TABLE(input, evdev_ids);

static struct input_handler evdev_handler = {
905 906 907 908 909 910 911
	.event		= evdev_event,
	.connect	= evdev_connect,
	.disconnect	= evdev_disconnect,
	.fops		= &evdev_fops,
	.minor		= EVDEV_MINOR_BASE,
	.name		= "evdev",
	.id_table	= evdev_ids,
L
Linus Torvalds 已提交
912 913 914 915
};

static int __init evdev_init(void)
{
916
	return input_register_handler(&evdev_handler);
L
Linus Torvalds 已提交
917 918 919 920 921 922 923 924 925 926 927 928 929
}

static void __exit evdev_exit(void)
{
	input_unregister_handler(&evdev_handler);
}

module_init(evdev_init);
module_exit(evdev_exit);

MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
MODULE_DESCRIPTION("Input driver event char devices");
MODULE_LICENSE("GPL");