1 /* 2 * User level driver support for input subsystem 3 * 4 * Heavily based on evdev.c by Vojtech Pavlik 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 2 of the License, or 9 * (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, write to the Free Software 18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19 * 20 * Author: Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org> 21 * 22 * Changes/Revisions: 23 * 0.3 09/04/2006 (Anssi Hannula <anssi.hannula@gmail.com>) 24 * - updated ff support for the changes in kernel interface 25 * - added MODULE_VERSION 26 * 0.2 16/10/2004 (Micah Dowty <micah@navi.cx>) 27 * - added force feedback support 28 * - added UI_SET_PHYS 29 * 0.1 20/06/2002 30 * - first public version 31 */ 32 #include <linux/poll.h> 33 #include <linux/slab.h> 34 #include <linux/module.h> 35 #include <linux/init.h> 36 #include <linux/smp_lock.h> 37 #include <linux/fs.h> 38 #include <linux/miscdevice.h> 39 #include <linux/uinput.h> 40 #include "../input-compat.h" 41 42 static int uinput_dev_event(struct input_dev *dev, unsigned int type, unsigned int code, int value) 43 { 44 struct uinput_device *udev = input_get_drvdata(dev); 45 46 udev->buff[udev->head].type = type; 47 udev->buff[udev->head].code = code; 48 udev->buff[udev->head].value = value; 49 do_gettimeofday(&udev->buff[udev->head].time); 50 udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE; 51 52 wake_up_interruptible(&udev->waitq); 53 54 return 0; 55 } 56 57 static int uinput_request_alloc_id(struct uinput_device *udev, struct uinput_request *request) 58 { 59 /* Atomically allocate an ID for the given request. Returns 0 on success. */ 60 int id; 61 int err = -1; 62 63 spin_lock(&udev->requests_lock); 64 65 for (id = 0; id < UINPUT_NUM_REQUESTS; id++) 66 if (!udev->requests[id]) { 67 request->id = id; 68 udev->requests[id] = request; 69 err = 0; 70 break; 71 } 72 73 spin_unlock(&udev->requests_lock); 74 return err; 75 } 76 77 static struct uinput_request* uinput_request_find(struct uinput_device *udev, int id) 78 { 79 /* Find an input request, by ID. Returns NULL if the ID isn't valid. */ 80 if (id >= UINPUT_NUM_REQUESTS || id < 0) 81 return NULL; 82 83 return udev->requests[id]; 84 } 85 86 static inline int uinput_request_reserve_slot(struct uinput_device *udev, struct uinput_request *request) 87 { 88 /* Allocate slot. If none are available right away, wait. */ 89 return wait_event_interruptible(udev->requests_waitq, 90 !uinput_request_alloc_id(udev, request)); 91 } 92 93 static void uinput_request_done(struct uinput_device *udev, struct uinput_request *request) 94 { 95 /* Mark slot as available */ 96 udev->requests[request->id] = NULL; 97 wake_up(&udev->requests_waitq); 98 99 complete(&request->done); 100 } 101 102 static int uinput_request_submit(struct input_dev *dev, struct uinput_request *request) 103 { 104 /* Tell our userspace app about this new request by queueing an input event */ 105 uinput_dev_event(dev, EV_UINPUT, request->code, request->id); 106 107 /* Wait for the request to complete */ 108 wait_for_completion(&request->done); 109 return request->retval; 110 } 111 112 static void uinput_dev_set_gain(struct input_dev *dev, u16 gain) 113 { 114 uinput_dev_event(dev, EV_FF, FF_GAIN, gain); 115 } 116 117 static void uinput_dev_set_autocenter(struct input_dev *dev, u16 magnitude) 118 { 119 uinput_dev_event(dev, EV_FF, FF_AUTOCENTER, magnitude); 120 } 121 122 static int uinput_dev_playback(struct input_dev *dev, int effect_id, int value) 123 { 124 return uinput_dev_event(dev, EV_FF, effect_id, value); 125 } 126 127 static int uinput_dev_upload_effect(struct input_dev *dev, struct ff_effect *effect, struct ff_effect *old) 128 { 129 struct uinput_request request; 130 int retval; 131 132 /* 133 * uinput driver does not currently support periodic effects with 134 * custom waveform since it does not have a way to pass buffer of 135 * samples (custom_data) to userspace. If ever there is a device 136 * supporting custom waveforms we would need to define an additional 137 * ioctl (UI_UPLOAD_SAMPLES) but for now we just bail out. 138 */ 139 if (effect->type == FF_PERIODIC && 140 effect->u.periodic.waveform == FF_CUSTOM) 141 return -EINVAL; 142 143 request.id = -1; 144 init_completion(&request.done); 145 request.code = UI_FF_UPLOAD; 146 request.u.upload.effect = effect; 147 request.u.upload.old = old; 148 149 retval = uinput_request_reserve_slot(input_get_drvdata(dev), &request); 150 if (!retval) 151 retval = uinput_request_submit(dev, &request); 152 153 return retval; 154 } 155 156 static int uinput_dev_erase_effect(struct input_dev *dev, int effect_id) 157 { 158 struct uinput_request request; 159 int retval; 160 161 if (!test_bit(EV_FF, dev->evbit)) 162 return -ENOSYS; 163 164 request.id = -1; 165 init_completion(&request.done); 166 request.code = UI_FF_ERASE; 167 request.u.effect_id = effect_id; 168 169 retval = uinput_request_reserve_slot(input_get_drvdata(dev), &request); 170 if (!retval) 171 retval = uinput_request_submit(dev, &request); 172 173 return retval; 174 } 175 176 static void uinput_destroy_device(struct uinput_device *udev) 177 { 178 const char *name, *phys; 179 180 if (udev->dev) { 181 name = udev->dev->name; 182 phys = udev->dev->phys; 183 if (udev->state == UIST_CREATED) 184 input_unregister_device(udev->dev); 185 else 186 input_free_device(udev->dev); 187 kfree(name); 188 kfree(phys); 189 udev->dev = NULL; 190 } 191 192 udev->state = UIST_NEW_DEVICE; 193 } 194 195 static int uinput_create_device(struct uinput_device *udev) 196 { 197 struct input_dev *dev = udev->dev; 198 int error; 199 200 if (udev->state != UIST_SETUP_COMPLETE) { 201 printk(KERN_DEBUG "%s: write device info first\n", UINPUT_NAME); 202 return -EINVAL; 203 } 204 205 if (udev->ff_effects_max) { 206 error = input_ff_create(dev, udev->ff_effects_max); 207 if (error) 208 goto fail1; 209 210 dev->ff->upload = uinput_dev_upload_effect; 211 dev->ff->erase = uinput_dev_erase_effect; 212 dev->ff->playback = uinput_dev_playback; 213 dev->ff->set_gain = uinput_dev_set_gain; 214 dev->ff->set_autocenter = uinput_dev_set_autocenter; 215 } 216 217 error = input_register_device(udev->dev); 218 if (error) 219 goto fail2; 220 221 udev->state = UIST_CREATED; 222 223 return 0; 224 225 fail2: input_ff_destroy(dev); 226 fail1: uinput_destroy_device(udev); 227 return error; 228 } 229 230 static int uinput_open(struct inode *inode, struct file *file) 231 { 232 struct uinput_device *newdev; 233 234 newdev = kzalloc(sizeof(struct uinput_device), GFP_KERNEL); 235 if (!newdev) 236 return -ENOMEM; 237 238 lock_kernel(); 239 mutex_init(&newdev->mutex); 240 spin_lock_init(&newdev->requests_lock); 241 init_waitqueue_head(&newdev->requests_waitq); 242 init_waitqueue_head(&newdev->waitq); 243 newdev->state = UIST_NEW_DEVICE; 244 245 file->private_data = newdev; 246 unlock_kernel(); 247 248 return 0; 249 } 250 251 static int uinput_validate_absbits(struct input_dev *dev) 252 { 253 unsigned int cnt; 254 int retval = 0; 255 256 for (cnt = 0; cnt < ABS_MAX + 1; cnt++) { 257 if (!test_bit(cnt, dev->absbit)) 258 continue; 259 260 if ((dev->absmax[cnt] <= dev->absmin[cnt])) { 261 printk(KERN_DEBUG 262 "%s: invalid abs[%02x] min:%d max:%d\n", 263 UINPUT_NAME, cnt, 264 dev->absmin[cnt], dev->absmax[cnt]); 265 retval = -EINVAL; 266 break; 267 } 268 269 if (dev->absflat[cnt] > (dev->absmax[cnt] - dev->absmin[cnt])) { 270 printk(KERN_DEBUG 271 "%s: absflat[%02x] out of range: %d " 272 "(min:%d/max:%d)\n", 273 UINPUT_NAME, cnt, dev->absflat[cnt], 274 dev->absmin[cnt], dev->absmax[cnt]); 275 retval = -EINVAL; 276 break; 277 } 278 } 279 return retval; 280 } 281 282 static int uinput_allocate_device(struct uinput_device *udev) 283 { 284 udev->dev = input_allocate_device(); 285 if (!udev->dev) 286 return -ENOMEM; 287 288 udev->dev->event = uinput_dev_event; 289 input_set_drvdata(udev->dev, udev); 290 291 return 0; 292 } 293 294 static int uinput_setup_device(struct uinput_device *udev, const char __user *buffer, size_t count) 295 { 296 struct uinput_user_dev *user_dev; 297 struct input_dev *dev; 298 char *name; 299 int size; 300 int retval; 301 302 if (count != sizeof(struct uinput_user_dev)) 303 return -EINVAL; 304 305 if (!udev->dev) { 306 retval = uinput_allocate_device(udev); 307 if (retval) 308 return retval; 309 } 310 311 dev = udev->dev; 312 313 user_dev = kmalloc(sizeof(struct uinput_user_dev), GFP_KERNEL); 314 if (!user_dev) 315 return -ENOMEM; 316 317 if (copy_from_user(user_dev, buffer, sizeof(struct uinput_user_dev))) { 318 retval = -EFAULT; 319 goto exit; 320 } 321 322 udev->ff_effects_max = user_dev->ff_effects_max; 323 324 size = strnlen(user_dev->name, UINPUT_MAX_NAME_SIZE) + 1; 325 if (!size) { 326 retval = -EINVAL; 327 goto exit; 328 } 329 330 kfree(dev->name); 331 dev->name = name = kmalloc(size, GFP_KERNEL); 332 if (!name) { 333 retval = -ENOMEM; 334 goto exit; 335 } 336 strlcpy(name, user_dev->name, size); 337 338 dev->id.bustype = user_dev->id.bustype; 339 dev->id.vendor = user_dev->id.vendor; 340 dev->id.product = user_dev->id.product; 341 dev->id.version = user_dev->id.version; 342 343 size = sizeof(int) * (ABS_MAX + 1); 344 memcpy(dev->absmax, user_dev->absmax, size); 345 memcpy(dev->absmin, user_dev->absmin, size); 346 memcpy(dev->absfuzz, user_dev->absfuzz, size); 347 memcpy(dev->absflat, user_dev->absflat, size); 348 349 /* check if absmin/absmax/absfuzz/absflat are filled as 350 * told in Documentation/input/input-programming.txt */ 351 if (test_bit(EV_ABS, dev->evbit)) { 352 retval = uinput_validate_absbits(dev); 353 if (retval < 0) 354 goto exit; 355 } 356 357 udev->state = UIST_SETUP_COMPLETE; 358 retval = count; 359 360 exit: 361 kfree(user_dev); 362 return retval; 363 } 364 365 static inline ssize_t uinput_inject_event(struct uinput_device *udev, const char __user *buffer, size_t count) 366 { 367 struct input_event ev; 368 369 if (count < input_event_size()) 370 return -EINVAL; 371 372 if (input_event_from_user(buffer, &ev)) 373 return -EFAULT; 374 375 input_event(udev->dev, ev.type, ev.code, ev.value); 376 377 return input_event_size(); 378 } 379 380 static ssize_t uinput_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos) 381 { 382 struct uinput_device *udev = file->private_data; 383 int retval; 384 385 retval = mutex_lock_interruptible(&udev->mutex); 386 if (retval) 387 return retval; 388 389 retval = udev->state == UIST_CREATED ? 390 uinput_inject_event(udev, buffer, count) : 391 uinput_setup_device(udev, buffer, count); 392 393 mutex_unlock(&udev->mutex); 394 395 return retval; 396 } 397 398 static ssize_t uinput_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos) 399 { 400 struct uinput_device *udev = file->private_data; 401 int retval = 0; 402 403 if (udev->state != UIST_CREATED) 404 return -ENODEV; 405 406 if (udev->head == udev->tail && (file->f_flags & O_NONBLOCK)) 407 return -EAGAIN; 408 409 retval = wait_event_interruptible(udev->waitq, 410 udev->head != udev->tail || udev->state != UIST_CREATED); 411 if (retval) 412 return retval; 413 414 retval = mutex_lock_interruptible(&udev->mutex); 415 if (retval) 416 return retval; 417 418 if (udev->state != UIST_CREATED) { 419 retval = -ENODEV; 420 goto out; 421 } 422 423 while (udev->head != udev->tail && retval + input_event_size() <= count) { 424 if (input_event_to_user(buffer + retval, &udev->buff[udev->tail])) { 425 retval = -EFAULT; 426 goto out; 427 } 428 udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE; 429 retval += input_event_size(); 430 } 431 432 out: 433 mutex_unlock(&udev->mutex); 434 435 return retval; 436 } 437 438 static unsigned int uinput_poll(struct file *file, poll_table *wait) 439 { 440 struct uinput_device *udev = file->private_data; 441 442 poll_wait(file, &udev->waitq, wait); 443 444 if (udev->head != udev->tail) 445 return POLLIN | POLLRDNORM; 446 447 return 0; 448 } 449 450 static int uinput_release(struct inode *inode, struct file *file) 451 { 452 struct uinput_device *udev = file->private_data; 453 454 uinput_destroy_device(udev); 455 kfree(udev); 456 457 return 0; 458 } 459 460 #ifdef CONFIG_COMPAT 461 struct uinput_ff_upload_compat { 462 int request_id; 463 int retval; 464 struct ff_effect_compat effect; 465 struct ff_effect_compat old; 466 }; 467 468 static int uinput_ff_upload_to_user(char __user *buffer, 469 const struct uinput_ff_upload *ff_up) 470 { 471 if (INPUT_COMPAT_TEST) { 472 struct uinput_ff_upload_compat ff_up_compat; 473 474 ff_up_compat.request_id = ff_up->request_id; 475 ff_up_compat.retval = ff_up->retval; 476 /* 477 * It so happens that the pointer that gives us the trouble 478 * is the last field in the structure. Since we don't support 479 * custom waveforms in uinput anyway we can just copy the whole 480 * thing (to the compat size) and ignore the pointer. 481 */ 482 memcpy(&ff_up_compat.effect, &ff_up->effect, 483 sizeof(struct ff_effect_compat)); 484 memcpy(&ff_up_compat.old, &ff_up->old, 485 sizeof(struct ff_effect_compat)); 486 487 if (copy_to_user(buffer, &ff_up_compat, 488 sizeof(struct uinput_ff_upload_compat))) 489 return -EFAULT; 490 } else { 491 if (copy_to_user(buffer, ff_up, 492 sizeof(struct uinput_ff_upload))) 493 return -EFAULT; 494 } 495 496 return 0; 497 } 498 499 static int uinput_ff_upload_from_user(const char __user *buffer, 500 struct uinput_ff_upload *ff_up) 501 { 502 if (INPUT_COMPAT_TEST) { 503 struct uinput_ff_upload_compat ff_up_compat; 504 505 if (copy_from_user(&ff_up_compat, buffer, 506 sizeof(struct uinput_ff_upload_compat))) 507 return -EFAULT; 508 509 ff_up->request_id = ff_up_compat.request_id; 510 ff_up->retval = ff_up_compat.retval; 511 memcpy(&ff_up->effect, &ff_up_compat.effect, 512 sizeof(struct ff_effect_compat)); 513 memcpy(&ff_up->old, &ff_up_compat.old, 514 sizeof(struct ff_effect_compat)); 515 516 } else { 517 if (copy_from_user(ff_up, buffer, 518 sizeof(struct uinput_ff_upload))) 519 return -EFAULT; 520 } 521 522 return 0; 523 } 524 525 #else 526 527 static int uinput_ff_upload_to_user(char __user *buffer, 528 const struct uinput_ff_upload *ff_up) 529 { 530 if (copy_to_user(buffer, ff_up, sizeof(struct uinput_ff_upload))) 531 return -EFAULT; 532 533 return 0; 534 } 535 536 static int uinput_ff_upload_from_user(const char __user *buffer, 537 struct uinput_ff_upload *ff_up) 538 { 539 if (copy_from_user(ff_up, buffer, sizeof(struct uinput_ff_upload))) 540 return -EFAULT; 541 542 return 0; 543 } 544 545 #endif 546 547 #define uinput_set_bit(_arg, _bit, _max) \ 548 ({ \ 549 int __ret = 0; \ 550 if (udev->state == UIST_CREATED) \ 551 __ret = -EINVAL; \ 552 else if ((_arg) > (_max)) \ 553 __ret = -EINVAL; \ 554 else set_bit((_arg), udev->dev->_bit); \ 555 __ret; \ 556 }) 557 558 static long uinput_ioctl_handler(struct file *file, unsigned int cmd, 559 unsigned long arg, void __user *p) 560 { 561 int retval; 562 struct uinput_device *udev = file->private_data; 563 struct uinput_ff_upload ff_up; 564 struct uinput_ff_erase ff_erase; 565 struct uinput_request *req; 566 int length; 567 char *phys; 568 569 retval = mutex_lock_interruptible(&udev->mutex); 570 if (retval) 571 return retval; 572 573 if (!udev->dev) { 574 retval = uinput_allocate_device(udev); 575 if (retval) 576 goto out; 577 } 578 579 switch (cmd) { 580 case UI_DEV_CREATE: 581 retval = uinput_create_device(udev); 582 break; 583 584 case UI_DEV_DESTROY: 585 uinput_destroy_device(udev); 586 break; 587 588 case UI_SET_EVBIT: 589 retval = uinput_set_bit(arg, evbit, EV_MAX); 590 break; 591 592 case UI_SET_KEYBIT: 593 retval = uinput_set_bit(arg, keybit, KEY_MAX); 594 break; 595 596 case UI_SET_RELBIT: 597 retval = uinput_set_bit(arg, relbit, REL_MAX); 598 break; 599 600 case UI_SET_ABSBIT: 601 retval = uinput_set_bit(arg, absbit, ABS_MAX); 602 break; 603 604 case UI_SET_MSCBIT: 605 retval = uinput_set_bit(arg, mscbit, MSC_MAX); 606 break; 607 608 case UI_SET_LEDBIT: 609 retval = uinput_set_bit(arg, ledbit, LED_MAX); 610 break; 611 612 case UI_SET_SNDBIT: 613 retval = uinput_set_bit(arg, sndbit, SND_MAX); 614 break; 615 616 case UI_SET_FFBIT: 617 retval = uinput_set_bit(arg, ffbit, FF_MAX); 618 break; 619 620 case UI_SET_SWBIT: 621 retval = uinput_set_bit(arg, swbit, SW_MAX); 622 break; 623 624 case UI_SET_PHYS: 625 if (udev->state == UIST_CREATED) { 626 retval = -EINVAL; 627 goto out; 628 } 629 length = strnlen_user(p, 1024); 630 if (length <= 0) { 631 retval = -EFAULT; 632 break; 633 } 634 kfree(udev->dev->phys); 635 udev->dev->phys = phys = kmalloc(length, GFP_KERNEL); 636 if (!phys) { 637 retval = -ENOMEM; 638 break; 639 } 640 if (copy_from_user(phys, p, length)) { 641 udev->dev->phys = NULL; 642 kfree(phys); 643 retval = -EFAULT; 644 break; 645 } 646 phys[length - 1] = '\0'; 647 break; 648 649 case UI_BEGIN_FF_UPLOAD: 650 retval = uinput_ff_upload_from_user(p, &ff_up); 651 if (retval) 652 break; 653 654 req = uinput_request_find(udev, ff_up.request_id); 655 if (!req || req->code != UI_FF_UPLOAD || !req->u.upload.effect) { 656 retval = -EINVAL; 657 break; 658 } 659 660 ff_up.retval = 0; 661 ff_up.effect = *req->u.upload.effect; 662 if (req->u.upload.old) 663 ff_up.old = *req->u.upload.old; 664 else 665 memset(&ff_up.old, 0, sizeof(struct ff_effect)); 666 667 retval = uinput_ff_upload_to_user(p, &ff_up); 668 break; 669 670 case UI_BEGIN_FF_ERASE: 671 if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) { 672 retval = -EFAULT; 673 break; 674 } 675 676 req = uinput_request_find(udev, ff_erase.request_id); 677 if (!req || req->code != UI_FF_ERASE) { 678 retval = -EINVAL; 679 break; 680 } 681 682 ff_erase.retval = 0; 683 ff_erase.effect_id = req->u.effect_id; 684 if (copy_to_user(p, &ff_erase, sizeof(ff_erase))) { 685 retval = -EFAULT; 686 break; 687 } 688 689 break; 690 691 case UI_END_FF_UPLOAD: 692 retval = uinput_ff_upload_from_user(p, &ff_up); 693 if (retval) 694 break; 695 696 req = uinput_request_find(udev, ff_up.request_id); 697 if (!req || req->code != UI_FF_UPLOAD || 698 !req->u.upload.effect) { 699 retval = -EINVAL; 700 break; 701 } 702 703 req->retval = ff_up.retval; 704 uinput_request_done(udev, req); 705 break; 706 707 case UI_END_FF_ERASE: 708 if (copy_from_user(&ff_erase, p, sizeof(ff_erase))) { 709 retval = -EFAULT; 710 break; 711 } 712 713 req = uinput_request_find(udev, ff_erase.request_id); 714 if (!req || req->code != UI_FF_ERASE) { 715 retval = -EINVAL; 716 break; 717 } 718 719 req->retval = ff_erase.retval; 720 uinput_request_done(udev, req); 721 break; 722 723 default: 724 retval = -EINVAL; 725 } 726 727 out: 728 mutex_unlock(&udev->mutex); 729 return retval; 730 } 731 732 static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 733 { 734 return uinput_ioctl_handler(file, cmd, arg, (void __user *)arg); 735 } 736 737 #ifdef CONFIG_COMPAT 738 static long uinput_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 739 { 740 return uinput_ioctl_handler(file, cmd, arg, compat_ptr(arg)); 741 } 742 #endif 743 744 static const struct file_operations uinput_fops = { 745 .owner = THIS_MODULE, 746 .open = uinput_open, 747 .release = uinput_release, 748 .read = uinput_read, 749 .write = uinput_write, 750 .poll = uinput_poll, 751 .unlocked_ioctl = uinput_ioctl, 752 #ifdef CONFIG_COMPAT 753 .compat_ioctl = uinput_compat_ioctl, 754 #endif 755 }; 756 757 static struct miscdevice uinput_misc = { 758 .fops = &uinput_fops, 759 .minor = UINPUT_MINOR, 760 .name = UINPUT_NAME, 761 }; 762 763 static int __init uinput_init(void) 764 { 765 return misc_register(&uinput_misc); 766 } 767 768 static void __exit uinput_exit(void) 769 { 770 misc_deregister(&uinput_misc); 771 } 772 773 MODULE_AUTHOR("Aristeu Sergio Rozanski Filho"); 774 MODULE_DESCRIPTION("User level driver support for input subsystem"); 775 MODULE_LICENSE("GPL"); 776 MODULE_VERSION("0.3"); 777 778 module_init(uinput_init); 779 module_exit(uinput_exit); 780 781