evdev.c 20.6 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12
/*
 * Event char devices, giving access to raw input device events.
 *
 * Copyright (c) 1999-2002 Vojtech Pavlik
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 as published by
 * the Free Software Foundation.
 */

#define EVDEV_MINOR_BASE	64
#define EVDEV_MINORS		32
13 14
#define EVDEV_MIN_BUFFER_SIZE	64U
#define EVDEV_BUF_PACKETS	8
L
Linus Torvalds 已提交
15 16

#include <linux/poll.h>
17
#include <linux/sched.h>
L
Linus Torvalds 已提交
18 19 20 21 22 23
#include <linux/slab.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/input.h>
#include <linux/major.h>
#include <linux/device.h>
24
#include "input-compat.h"
L
Linus Torvalds 已提交
25 26 27 28 29 30 31

struct evdev {
	int exist;
	int open;
	int minor;
	struct input_handle handle;
	wait_queue_head_t wait;
32 33
	struct evdev_client *grab;
	struct list_head client_list;
34 35
	spinlock_t client_lock; /* protects client_list */
	struct mutex mutex;
36
	struct device dev;
L
Linus Torvalds 已提交
37 38
};

39
struct evdev_client {
L
Linus Torvalds 已提交
40 41
	int head;
	int tail;
42
	spinlock_t buffer_lock; /* protects access to buffer, head and tail */
L
Linus Torvalds 已提交
43 44 45
	struct fasync_struct *fasync;
	struct evdev *evdev;
	struct list_head node;
46 47
	int bufsize;
	struct input_event buffer[];
L
Linus Torvalds 已提交
48 49 50
};

static struct evdev *evdev_table[EVDEV_MINORS];
51
static DEFINE_MUTEX(evdev_table_mutex);
L
Linus Torvalds 已提交
52

53 54 55 56 57 58 59 60
static void evdev_pass_event(struct evdev_client *client,
			     struct input_event *event)
{
	/*
	 * Interrupts are disabled, just acquire the lock
	 */
	spin_lock(&client->buffer_lock);
	client->buffer[client->head++] = *event;
61
	client->head &= client->bufsize - 1;
62 63
	spin_unlock(&client->buffer_lock);

64 65
	if (event->type == EV_SYN)
		kill_fasync(&client->fasync, SIGIO, POLL_IN);
66 67 68
}

/*
D
Dmitry Torokhov 已提交
69
 * Pass incoming event to all connected clients.
70 71 72
 */
static void evdev_event(struct input_handle *handle,
			unsigned int type, unsigned int code, int value)
L
Linus Torvalds 已提交
73 74
{
	struct evdev *evdev = handle->private;
75
	struct evdev_client *client;
76
	struct input_event event;
L
Linus Torvalds 已提交
77

78 79 80 81
	do_gettimeofday(&event.time);
	event.type = type;
	event.code = code;
	event.value = value;
L
Linus Torvalds 已提交
82

D
Dmitry Torokhov 已提交
83 84
	rcu_read_lock();

85 86 87 88 89 90
	client = rcu_dereference(evdev->grab);
	if (client)
		evdev_pass_event(client, &event);
	else
		list_for_each_entry_rcu(client, &evdev->client_list, node)
			evdev_pass_event(client, &event);
L
Linus Torvalds 已提交
91

D
Dmitry Torokhov 已提交
92 93
	rcu_read_unlock();

L
Linus Torvalds 已提交
94 95 96 97 98
	wake_up_interruptible(&evdev->wait);
}

static int evdev_fasync(int fd, struct file *file, int on)
{
99
	struct evdev_client *client = file->private_data;
100

101
	return fasync_helper(fd, file, on, &client->fasync);
L
Linus Torvalds 已提交
102 103
}

104
static int evdev_flush(struct file *file, fl_owner_t id)
L
Linus Torvalds 已提交
105
{
106 107
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
108 109 110 111 112
	int retval;

	retval = mutex_lock_interruptible(&evdev->mutex);
	if (retval)
		return retval;
113

114
	if (!evdev->exist)
115 116 117
		retval = -ENODEV;
	else
		retval = input_flush_device(&evdev->handle, file);
118

119 120
	mutex_unlock(&evdev->mutex);
	return retval;
L
Linus Torvalds 已提交
121 122
}

123
static void evdev_free(struct device *dev)
L
Linus Torvalds 已提交
124
{
125 126
	struct evdev *evdev = container_of(dev, struct evdev, dev);

127
	input_put_device(evdev->handle.dev);
L
Linus Torvalds 已提交
128 129 130
	kfree(evdev);
}

131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146
/*
 * Grabs an event device (along with underlying input device).
 * This function is called with evdev->mutex taken.
 */
static int evdev_grab(struct evdev *evdev, struct evdev_client *client)
{
	int error;

	if (evdev->grab)
		return -EBUSY;

	error = input_grab_device(&evdev->handle);
	if (error)
		return error;

	rcu_assign_pointer(evdev->grab, client);
D
Dmitry Torokhov 已提交
147
	synchronize_rcu();
148 149 150 151 152 153 154 155 156 157

	return 0;
}

static int evdev_ungrab(struct evdev *evdev, struct evdev_client *client)
{
	if (evdev->grab != client)
		return  -EINVAL;

	rcu_assign_pointer(evdev->grab, NULL);
D
Dmitry Torokhov 已提交
158
	synchronize_rcu();
159 160 161 162 163 164 165 166 167 168 169
	input_release_device(&evdev->handle);

	return 0;
}

static void evdev_attach_client(struct evdev *evdev,
				struct evdev_client *client)
{
	spin_lock(&evdev->client_lock);
	list_add_tail_rcu(&client->node, &evdev->client_list);
	spin_unlock(&evdev->client_lock);
D
Dmitry Torokhov 已提交
170
	synchronize_rcu();
171 172 173 174 175 176 177 178
}

static void evdev_detach_client(struct evdev *evdev,
				struct evdev_client *client)
{
	spin_lock(&evdev->client_lock);
	list_del_rcu(&client->node);
	spin_unlock(&evdev->client_lock);
D
Dmitry Torokhov 已提交
179
	synchronize_rcu();
180 181 182 183 184 185 186 187 188 189 190 191
}

static int evdev_open_device(struct evdev *evdev)
{
	int retval;

	retval = mutex_lock_interruptible(&evdev->mutex);
	if (retval)
		return retval;

	if (!evdev->exist)
		retval = -ENODEV;
192
	else if (!evdev->open++) {
193
		retval = input_open_device(&evdev->handle);
194 195 196
		if (retval)
			evdev->open--;
	}
197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227

	mutex_unlock(&evdev->mutex);
	return retval;
}

static void evdev_close_device(struct evdev *evdev)
{
	mutex_lock(&evdev->mutex);

	if (evdev->exist && !--evdev->open)
		input_close_device(&evdev->handle);

	mutex_unlock(&evdev->mutex);
}

/*
 * Wake up users waiting for IO so they can disconnect from
 * dead device.
 */
static void evdev_hangup(struct evdev *evdev)
{
	struct evdev_client *client;

	spin_lock(&evdev->client_lock);
	list_for_each_entry(client, &evdev->client_list, node)
		kill_fasync(&client->fasync, SIGIO, POLL_HUP);
	spin_unlock(&evdev->client_lock);

	wake_up_interruptible(&evdev->wait);
}

228
static int evdev_release(struct inode *inode, struct file *file)
L
Linus Torvalds 已提交
229
{
230 231
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
L
Linus Torvalds 已提交
232

233 234 235 236
	mutex_lock(&evdev->mutex);
	if (evdev->grab == client)
		evdev_ungrab(evdev, client);
	mutex_unlock(&evdev->mutex);
L
Linus Torvalds 已提交
237

238
	evdev_detach_client(evdev, client);
239
	kfree(client);
L
Linus Torvalds 已提交
240

241
	evdev_close_device(evdev);
242
	put_device(&evdev->dev);
L
Linus Torvalds 已提交
243 244 245 246

	return 0;
}

247 248
static unsigned int evdev_compute_buffer_size(struct input_dev *dev)
{
249 250 251 252 253
	unsigned int n_events =
		max(dev->hint_events_per_packet * EVDEV_BUF_PACKETS,
		    EVDEV_MIN_BUFFER_SIZE);

	return roundup_pow_of_two(n_events);
254 255
}

256
static int evdev_open(struct inode *inode, struct file *file)
L
Linus Torvalds 已提交
257
{
258
	struct evdev *evdev;
259
	struct evdev_client *client;
L
Linus Torvalds 已提交
260
	int i = iminor(inode) - EVDEV_MINOR_BASE;
261
	unsigned int bufsize;
262
	int error;
L
Linus Torvalds 已提交
263

264
	if (i >= EVDEV_MINORS)
L
Linus Torvalds 已提交
265 266
		return -ENODEV;

267 268 269
	error = mutex_lock_interruptible(&evdev_table_mutex);
	if (error)
		return error;
270
	evdev = evdev_table[i];
271 272 273
	if (evdev)
		get_device(&evdev->dev);
	mutex_unlock(&evdev_table_mutex);
274

275
	if (!evdev)
L
Linus Torvalds 已提交
276 277
		return -ENODEV;

278 279 280 281 282
	bufsize = evdev_compute_buffer_size(evdev->handle.dev);

	client = kzalloc(sizeof(struct evdev_client) +
				bufsize * sizeof(struct input_event),
			 GFP_KERNEL);
283 284 285 286
	if (!client) {
		error = -ENOMEM;
		goto err_put_evdev;
	}
L
Linus Torvalds 已提交
287

288
	client->bufsize = bufsize;
289
	spin_lock_init(&client->buffer_lock);
290
	client->evdev = evdev;
291
	evdev_attach_client(evdev, client);
L
Linus Torvalds 已提交
292

293 294 295
	error = evdev_open_device(evdev);
	if (error)
		goto err_free_client;
L
Linus Torvalds 已提交
296

297
	file->private_data = client;
298 299
	nonseekable_open(inode, file);

L
Linus Torvalds 已提交
300
	return 0;
301 302

 err_free_client:
303
	evdev_detach_client(evdev, client);
304 305 306 307
	kfree(client);
 err_put_evdev:
	put_device(&evdev->dev);
	return error;
L
Linus Torvalds 已提交
308 309
}

310 311
static ssize_t evdev_write(struct file *file, const char __user *buffer,
			   size_t count, loff_t *ppos)
312
{
313 314
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
315
	struct input_event event;
316
	int retval;
317

318 319 320 321 322 323 324 325
	retval = mutex_lock_interruptible(&evdev->mutex);
	if (retval)
		return retval;

	if (!evdev->exist) {
		retval = -ENODEV;
		goto out;
	}
326

327 328
	while (retval < count) {

329
		if (input_event_from_user(buffer + retval, &event)) {
330 331 332 333 334 335
			retval = -EFAULT;
			goto out;
		}

		input_inject_event(&evdev->handle,
				   event.type, event.code, event.value);
336
		retval += input_event_size();
337 338
	}

339 340
 out:
	mutex_unlock(&evdev->mutex);
341 342 343
	return retval;
}

344 345 346 347 348 349 350 351 352 353
static int evdev_fetch_next_event(struct evdev_client *client,
				  struct input_event *event)
{
	int have_event;

	spin_lock_irq(&client->buffer_lock);

	have_event = client->head != client->tail;
	if (have_event) {
		*event = client->buffer[client->tail++];
354
		client->tail &= client->bufsize - 1;
355 356 357 358 359 360 361 362 363
	}

	spin_unlock_irq(&client->buffer_lock);

	return have_event;
}

static ssize_t evdev_read(struct file *file, char __user *buffer,
			  size_t count, loff_t *ppos)
L
Linus Torvalds 已提交
364
{
365 366
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
367
	struct input_event event;
L
Linus Torvalds 已提交
368 369
	int retval;

370
	if (count < input_event_size())
L
Linus Torvalds 已提交
371 372
		return -EINVAL;

373 374
	if (client->head == client->tail && evdev->exist &&
	    (file->f_flags & O_NONBLOCK))
L
Linus Torvalds 已提交
375 376
		return -EAGAIN;

377 378
	retval = wait_event_interruptible(evdev->wait,
		client->head != client->tail || !evdev->exist);
L
Linus Torvalds 已提交
379 380 381
	if (retval)
		return retval;

382
	if (!evdev->exist)
L
Linus Torvalds 已提交
383 384
		return -ENODEV;

385
	while (retval + input_event_size() <= count &&
386
	       evdev_fetch_next_event(client, &event)) {
387

388
		if (input_event_to_user(buffer + retval, &event))
389 390
			return -EFAULT;

391
		retval += input_event_size();
L
Linus Torvalds 已提交
392 393 394 395 396 397 398 399
	}

	return retval;
}

/* No kernel lock - fine */
static unsigned int evdev_poll(struct file *file, poll_table *wait)
{
400 401
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
402

403 404 405
	poll_wait(file, &evdev->wait, wait);
	return ((client->head == client->tail) ? 0 : (POLLIN | POLLRDNORM)) |
		(evdev->exist ? 0 : (POLLHUP | POLLERR));
L
Linus Torvalds 已提交
406 407
}

408 409 410
#ifdef CONFIG_COMPAT

#define BITS_PER_LONG_COMPAT (sizeof(compat_long_t) * 8)
411
#define BITS_TO_LONGS_COMPAT(x) ((((x) - 1) / BITS_PER_LONG_COMPAT) + 1)
412 413 414 415 416 417 418 419

#ifdef __BIG_ENDIAN
static int bits_to_user(unsigned long *bits, unsigned int maxbit,
			unsigned int maxlen, void __user *p, int compat)
{
	int len, i;

	if (compat) {
420
		len = BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t);
421
		if (len > maxlen)
422 423 424 425 426 427 428 429 430
			len = maxlen;

		for (i = 0; i < len / sizeof(compat_long_t); i++)
			if (copy_to_user((compat_long_t __user *) p + i,
					 (compat_long_t *) bits +
						i + 1 - ((i % 2) << 1),
					 sizeof(compat_long_t)))
				return -EFAULT;
	} else {
431
		len = BITS_TO_LONGS(maxbit) * sizeof(long);
432 433 434 435 436 437 438 439 440 441 442 443 444 445
		if (len > maxlen)
			len = maxlen;

		if (copy_to_user(p, bits, len))
			return -EFAULT;
	}

	return len;
}
#else
static int bits_to_user(unsigned long *bits, unsigned int maxbit,
			unsigned int maxlen, void __user *p, int compat)
{
	int len = compat ?
446 447
			BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t) :
			BITS_TO_LONGS(maxbit) * sizeof(long);
448 449 450 451 452 453 454 455 456 457 458 459 460

	if (len > maxlen)
		len = maxlen;

	return copy_to_user(p, bits, len) ? -EFAULT : len;
}
#endif /* __BIG_ENDIAN */

#else

static int bits_to_user(unsigned long *bits, unsigned int maxbit,
			unsigned int maxlen, void __user *p, int compat)
{
461
	int len = BITS_TO_LONGS(maxbit) * sizeof(long);
462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484

	if (len > maxlen)
		len = maxlen;

	return copy_to_user(p, bits, len) ? -EFAULT : len;
}

#endif /* CONFIG_COMPAT */

static int str_to_user(const char *str, unsigned int maxlen, void __user *p)
{
	int len;

	if (!str)
		return -ENOENT;

	len = strlen(str) + 1;
	if (len > maxlen)
		len = maxlen;

	return copy_to_user(p, str, len) ? -EFAULT : len;
}

485
#define OLD_KEY_MAX	0x1ff
486 487
static int handle_eviocgbit(struct input_dev *dev, unsigned int cmd, void __user *p, int compat_mode)
{
488
	static unsigned long keymax_warn_time;
489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504
	unsigned long *bits;
	int len;

	switch (_IOC_NR(cmd) & EV_MAX) {

	case      0: bits = dev->evbit;  len = EV_MAX;  break;
	case EV_KEY: bits = dev->keybit; len = KEY_MAX; break;
	case EV_REL: bits = dev->relbit; len = REL_MAX; break;
	case EV_ABS: bits = dev->absbit; len = ABS_MAX; break;
	case EV_MSC: bits = dev->mscbit; len = MSC_MAX; break;
	case EV_LED: bits = dev->ledbit; len = LED_MAX; break;
	case EV_SND: bits = dev->sndbit; len = SND_MAX; break;
	case EV_FF:  bits = dev->ffbit;  len = FF_MAX;  break;
	case EV_SW:  bits = dev->swbit;  len = SW_MAX;  break;
	default: return -EINVAL;
	}
505 506 507 508 509 510 511 512 513 514

	/*
	 * Work around bugs in userspace programs that like to do
	 * EVIOCGBIT(EV_KEY, KEY_MAX) and not realize that 'len'
	 * should be in bytes, not in bits.
	 */
	if ((_IOC_NR(cmd) & EV_MAX) == EV_KEY && _IOC_SIZE(cmd) == OLD_KEY_MAX) {
		len = OLD_KEY_MAX;
		if (printk_timed_ratelimit(&keymax_warn_time, 10 * 1000))
			printk(KERN_WARNING
515 516
				"evdev.c(EVIOCGBIT): Suspicious buffer size %u, "
				"limiting output to %zu bytes. See "
517 518 519 520 521
				"http://userweb.kernel.org/~dtor/eviocgbit-bug.html\n",
				OLD_KEY_MAX,
				BITS_TO_LONGS(OLD_KEY_MAX) * sizeof(long));
	}

522 523
	return bits_to_user(bits, len, _IOC_SIZE(cmd), p, compat_mode);
}
524
#undef OLD_KEY_MAX
525

526 527
static long evdev_do_ioctl(struct file *file, unsigned int cmd,
			   void __user *p, int compat_mode)
L
Linus Torvalds 已提交
528
{
529 530
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
L
Linus Torvalds 已提交
531 532
	struct input_dev *dev = evdev->handle.dev;
	struct input_absinfo abs;
533
	struct ff_effect effect;
534
	int __user *ip = (int __user *)p;
535
	unsigned int i, t, u, v;
536
	int error;
L
Linus Torvalds 已提交
537 538 539

	switch (cmd) {

540 541
	case EVIOCGVERSION:
		return put_user(EV_VERSION, ip);
L
Linus Torvalds 已提交
542

543 544 545 546
	case EVIOCGID:
		if (copy_to_user(p, &dev->id, sizeof(struct input_id)))
			return -EFAULT;
		return 0;
547

548 549 550 551 552 553 554 555
	case EVIOCGREP:
		if (!test_bit(EV_REP, dev->evbit))
			return -ENOSYS;
		if (put_user(dev->rep[REP_DELAY], ip))
			return -EFAULT;
		if (put_user(dev->rep[REP_PERIOD], ip + 1))
			return -EFAULT;
		return 0;
556

557 558 559 560 561 562 563
	case EVIOCSREP:
		if (!test_bit(EV_REP, dev->evbit))
			return -ENOSYS;
		if (get_user(u, ip))
			return -EFAULT;
		if (get_user(v, ip + 1))
			return -EFAULT;
564

565 566
		input_inject_event(&evdev->handle, EV_REP, REP_DELAY, u);
		input_inject_event(&evdev->handle, EV_REP, REP_PERIOD, v);
567

568
		return 0;
L
Linus Torvalds 已提交
569

570 571 572
	case EVIOCGKEYCODE:
		if (get_user(t, ip))
			return -EFAULT;
573

574
		error = input_get_keycode(dev, t, &v);
575 576
		if (error)
			return error;
577

578 579
		if (put_user(v, ip + 1))
			return -EFAULT;
580

581
		return 0;
L
Linus Torvalds 已提交
582

583 584 585
	case EVIOCSKEYCODE:
		if (get_user(t, ip) || get_user(v, ip + 1))
			return -EFAULT;
586

587
		return input_set_keycode(dev, t, v);
L
Linus Torvalds 已提交
588

589 590
	case EVIOCRMFF:
		return input_ff_erase(dev, (int)(unsigned long) p, file);
L
Linus Torvalds 已提交
591

592 593 594 595 596 597 598 599 600 601 602 603
	case EVIOCGEFFECTS:
		i = test_bit(EV_FF, dev->evbit) ?
				dev->ff->max_effects : 0;
		if (put_user(i, ip))
			return -EFAULT;
		return 0;

	case EVIOCGRAB:
		if (p)
			return evdev_grab(evdev, client);
		else
			return evdev_ungrab(evdev, client);
L
Linus Torvalds 已提交
604

605
	default:
L
Linus Torvalds 已提交
606

607 608
		if (_IOC_TYPE(cmd) != 'E')
			return -EINVAL;
L
Linus Torvalds 已提交
609

610
		if (_IOC_DIR(cmd) == _IOC_READ) {
611

612 613
			if ((_IOC_NR(cmd) & ~EV_MAX) == _IOC_NR(EVIOCGBIT(0, 0)))
				return handle_eviocgbit(dev, cmd, p, compat_mode);
L
Linus Torvalds 已提交
614

615 616 617
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCGKEY(0)))
				return bits_to_user(dev->key, KEY_MAX, _IOC_SIZE(cmd),
						    p, compat_mode);
L
Linus Torvalds 已提交
618

619 620 621
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCGLED(0)))
				return bits_to_user(dev->led, LED_MAX, _IOC_SIZE(cmd),
						    p, compat_mode);
L
Linus Torvalds 已提交
622

623 624 625
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCGSND(0)))
				return bits_to_user(dev->snd, SND_MAX, _IOC_SIZE(cmd),
						    p, compat_mode);
626

627 628 629
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCGSW(0)))
				return bits_to_user(dev->sw, SW_MAX, _IOC_SIZE(cmd),
						    p, compat_mode);
L
Linus Torvalds 已提交
630

631
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCGNAME(0)))
632
				return str_to_user(dev->name, _IOC_SIZE(cmd), p);
L
Linus Torvalds 已提交
633

634 635
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCGPHYS(0)))
				return str_to_user(dev->phys, _IOC_SIZE(cmd), p);
L
Linus Torvalds 已提交
636

637 638
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCGUNIQ(0)))
				return str_to_user(dev->uniq, _IOC_SIZE(cmd), p);
L
Linus Torvalds 已提交
639

640
			if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) {
L
Linus Torvalds 已提交
641

642
				t = _IOC_NR(cmd) & ABS_MAX;
L
Linus Torvalds 已提交
643

644 645 646 647 648
				abs.value = dev->abs[t];
				abs.minimum = dev->absmin[t];
				abs.maximum = dev->absmax[t];
				abs.fuzz = dev->absfuzz[t];
				abs.flat = dev->absflat[t];
649
				abs.resolution = dev->absres[t];
650

651 652 653
				if (copy_to_user(p, &abs, min_t(size_t,
								_IOC_SIZE(cmd),
								sizeof(struct input_absinfo))))
654
					return -EFAULT;
L
Linus Torvalds 已提交
655

656
				return 0;
L
Linus Torvalds 已提交
657 658
			}

659 660 661
		}

		if (_IOC_DIR(cmd) == _IOC_WRITE) {
L
Linus Torvalds 已提交
662

663 664
			if (_IOC_NR(cmd) == _IOC_NR(EVIOCSFF)) {

665
				if (input_ff_effect_from_user(p, _IOC_SIZE(cmd), &effect))
666 667 668 669 670 671 672 673 674 675
					return -EFAULT;

				error = input_ff_upload(dev, &effect, file);

				if (put_user(effect.id, &(((struct ff_effect __user *)p)->id)))
					return -EFAULT;

				return error;
			}

676
			if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) {
L
Linus Torvalds 已提交
677

678
				t = _IOC_NR(cmd) & ABS_MAX;
679

680 681 682
				if (copy_from_user(&abs, p, min_t(size_t,
								  _IOC_SIZE(cmd),
								  sizeof(struct input_absinfo))))
683
					return -EFAULT;
L
Linus Torvalds 已提交
684

685 686 687 688 689 690
				/*
				 * Take event lock to ensure that we are not
				 * changing device parameters in the middle
				 * of event.
				 */
				spin_lock_irq(&dev->event_lock);
L
Linus Torvalds 已提交
691

692 693 694 695 696
				dev->abs[t] = abs.value;
				dev->absmin[t] = abs.minimum;
				dev->absmax[t] = abs.maximum;
				dev->absfuzz[t] = abs.fuzz;
				dev->absflat[t] = abs.flat;
697 698
				dev->absres[t] = _IOC_SIZE(cmd) < sizeof(struct input_absinfo) ?
							0 : abs.resolution;
699 700 701 702

				spin_unlock_irq(&dev->event_lock);

				return 0;
L
Linus Torvalds 已提交
703
			}
704
		}
L
Linus Torvalds 已提交
705 706 707 708
	}
	return -EINVAL;
}

709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731
static long evdev_ioctl_handler(struct file *file, unsigned int cmd,
				void __user *p, int compat_mode)
{
	struct evdev_client *client = file->private_data;
	struct evdev *evdev = client->evdev;
	int retval;

	retval = mutex_lock_interruptible(&evdev->mutex);
	if (retval)
		return retval;

	if (!evdev->exist) {
		retval = -ENODEV;
		goto out;
	}

	retval = evdev_do_ioctl(file, cmd, p, compat_mode);

 out:
	mutex_unlock(&evdev->mutex);
	return retval;
}

732 733 734 735
static long evdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
	return evdev_ioctl_handler(file, cmd, (void __user *)arg, 0);
}
736

737
#ifdef CONFIG_COMPAT
738 739
static long evdev_ioctl_compat(struct file *file,
				unsigned int cmd, unsigned long arg)
740
{
741
	return evdev_ioctl_handler(file, cmd, compat_ptr(arg), 1);
L
Linus Torvalds 已提交
742
}
743
#endif
L
Linus Torvalds 已提交
744

D
Dmitry Torokhov 已提交
745
static const struct file_operations evdev_fops = {
746 747 748 749 750 751 752
	.owner		= THIS_MODULE,
	.read		= evdev_read,
	.write		= evdev_write,
	.poll		= evdev_poll,
	.open		= evdev_open,
	.release	= evdev_release,
	.unlocked_ioctl	= evdev_ioctl,
753
#ifdef CONFIG_COMPAT
754
	.compat_ioctl	= evdev_ioctl_compat,
755
#endif
756 757
	.fasync		= evdev_fasync,
	.flush		= evdev_flush
L
Linus Torvalds 已提交
758 759
};

760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810
static int evdev_install_chrdev(struct evdev *evdev)
{
	/*
	 * No need to do any locking here as calls to connect and
	 * disconnect are serialized by the input core
	 */
	evdev_table[evdev->minor] = evdev;
	return 0;
}

static void evdev_remove_chrdev(struct evdev *evdev)
{
	/*
	 * Lock evdev table to prevent race with evdev_open()
	 */
	mutex_lock(&evdev_table_mutex);
	evdev_table[evdev->minor] = NULL;
	mutex_unlock(&evdev_table_mutex);
}

/*
 * Mark device non-existent. This disables writes, ioctls and
 * prevents new users from opening the device. Already posted
 * blocking reads will stay, however new ones will fail.
 */
static void evdev_mark_dead(struct evdev *evdev)
{
	mutex_lock(&evdev->mutex);
	evdev->exist = 0;
	mutex_unlock(&evdev->mutex);
}

static void evdev_cleanup(struct evdev *evdev)
{
	struct input_handle *handle = &evdev->handle;

	evdev_mark_dead(evdev);
	evdev_hangup(evdev);
	evdev_remove_chrdev(evdev);

	/* evdev is marked dead so no one else accesses evdev->open */
	if (evdev->open) {
		input_flush_device(handle, NULL);
		input_close_device(handle);
	}
}

/*
 * Create new evdev device. Note that input core serializes calls
 * to connect and disconnect so we don't need to lock evdev_table here.
 */
811 812
static int evdev_connect(struct input_handler *handler, struct input_dev *dev,
			 const struct input_device_id *id)
L
Linus Torvalds 已提交
813 814 815
{
	struct evdev *evdev;
	int minor;
816
	int error;
L
Linus Torvalds 已提交
817

818 819 820 821
	for (minor = 0; minor < EVDEV_MINORS; minor++)
		if (!evdev_table[minor])
			break;

L
Linus Torvalds 已提交
822 823
	if (minor == EVDEV_MINORS) {
		printk(KERN_ERR "evdev: no more free evdev devices\n");
824
		return -ENFILE;
L
Linus Torvalds 已提交
825 826
	}

827 828 829
	evdev = kzalloc(sizeof(struct evdev), GFP_KERNEL);
	if (!evdev)
		return -ENOMEM;
L
Linus Torvalds 已提交
830

831
	INIT_LIST_HEAD(&evdev->client_list);
832 833
	spin_lock_init(&evdev->client_lock);
	mutex_init(&evdev->mutex);
L
Linus Torvalds 已提交
834 835
	init_waitqueue_head(&evdev->wait);

836
	dev_set_name(&evdev->dev, "event%d", minor);
L
Linus Torvalds 已提交
837 838
	evdev->exist = 1;
	evdev->minor = minor;
839

840
	evdev->handle.dev = input_get_device(dev);
841
	evdev->handle.name = dev_name(&evdev->dev);
L
Linus Torvalds 已提交
842 843 844
	evdev->handle.handler = handler;
	evdev->handle.private = evdev;

845
	evdev->dev.devt = MKDEV(INPUT_MAJOR, EVDEV_MINOR_BASE + minor);
846 847 848 849
	evdev->dev.class = &input_class;
	evdev->dev.parent = &dev->dev;
	evdev->dev.release = evdev_free;
	device_initialize(&evdev->dev);
850

851
	error = input_register_handle(&evdev->handle);
852
	if (error)
853
		goto err_free_evdev;
854

855 856 857 858 859
	error = evdev_install_chrdev(evdev);
	if (error)
		goto err_unregister_handle;

	error = device_add(&evdev->dev);
860
	if (error)
861
		goto err_cleanup_evdev;
L
Linus Torvalds 已提交
862

863
	return 0;
L
Linus Torvalds 已提交
864

865 866 867 868
 err_cleanup_evdev:
	evdev_cleanup(evdev);
 err_unregister_handle:
	input_unregister_handle(&evdev->handle);
869
 err_free_evdev:
870
	put_device(&evdev->dev);
871
	return error;
L
Linus Torvalds 已提交
872 873 874 875 876 877
}

static void evdev_disconnect(struct input_handle *handle)
{
	struct evdev *evdev = handle->private;

878
	device_del(&evdev->dev);
879 880
	evdev_cleanup(evdev);
	input_unregister_handle(handle);
881
	put_device(&evdev->dev);
L
Linus Torvalds 已提交
882 883
}

D
Dmitry Torokhov 已提交
884
static const struct input_device_id evdev_ids[] = {
L
Linus Torvalds 已提交
885 886 887 888 889 890 891
	{ .driver_info = 1 },	/* Matches all devices */
	{ },			/* Terminating zero entry */
};

MODULE_DEVICE_TABLE(input, evdev_ids);

static struct input_handler evdev_handler = {
892 893 894 895 896 897 898
	.event		= evdev_event,
	.connect	= evdev_connect,
	.disconnect	= evdev_disconnect,
	.fops		= &evdev_fops,
	.minor		= EVDEV_MINOR_BASE,
	.name		= "evdev",
	.id_table	= evdev_ids,
L
Linus Torvalds 已提交
899 900 901 902
};

static int __init evdev_init(void)
{
903
	return input_register_handler(&evdev_handler);
L
Linus Torvalds 已提交
904 905 906 907 908 909 910 911 912 913 914 915 916
}

static void __exit evdev_exit(void)
{
	input_unregister_handler(&evdev_handler);
}

module_init(evdev_init);
module_exit(evdev_exit);

MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
MODULE_DESCRIPTION("Input driver event char devices");
MODULE_LICENSE("GPL");