GNU Linux-libre 4.19.264-gnu1
[releases.git] / drivers / input / evdev.c
1 /*
2  * Event char devices, giving access to raw input device events.
3  *
4  * Copyright (c) 1999-2002 Vojtech Pavlik
5  *
6  * This program is free software; you can redistribute it and/or modify it
7  * under the terms of the GNU General Public License version 2 as published by
8  * the Free Software Foundation.
9  */
10
11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12
13 #define EVDEV_MINOR_BASE        64
14 #define EVDEV_MINORS            32
15 #define EVDEV_MIN_BUFFER_SIZE   64U
16 #define EVDEV_BUF_PACKETS       8
17
18 #include <linux/poll.h>
19 #include <linux/sched.h>
20 #include <linux/slab.h>
21 #include <linux/vmalloc.h>
22 #include <linux/mm.h>
23 #include <linux/module.h>
24 #include <linux/init.h>
25 #include <linux/input/mt.h>
26 #include <linux/major.h>
27 #include <linux/device.h>
28 #include <linux/cdev.h>
29 #include "input-compat.h"
30
31 enum evdev_clock_type {
32         EV_CLK_REAL = 0,
33         EV_CLK_MONO,
34         EV_CLK_BOOT,
35         EV_CLK_MAX
36 };
37
38 struct evdev {
39         int open;
40         struct input_handle handle;
41         wait_queue_head_t wait;
42         struct evdev_client __rcu *grab;
43         struct list_head client_list;
44         spinlock_t client_lock; /* protects client_list */
45         struct mutex mutex;
46         struct device dev;
47         struct cdev cdev;
48         bool exist;
49 };
50
51 struct evdev_client {
52         unsigned int head;
53         unsigned int tail;
54         unsigned int packet_head; /* [future] position of the first element of next packet */
55         spinlock_t buffer_lock; /* protects access to buffer, head and tail */
56         struct fasync_struct *fasync;
57         struct evdev *evdev;
58         struct list_head node;
59         unsigned int clk_type;
60         bool revoked;
61         unsigned long *evmasks[EV_CNT];
62         unsigned int bufsize;
63         struct input_event buffer[];
64 };
65
66 static size_t evdev_get_mask_cnt(unsigned int type)
67 {
68         static const size_t counts[EV_CNT] = {
69                 /* EV_SYN==0 is EV_CNT, _not_ SYN_CNT, see EVIOCGBIT */
70                 [EV_SYN]        = EV_CNT,
71                 [EV_KEY]        = KEY_CNT,
72                 [EV_REL]        = REL_CNT,
73                 [EV_ABS]        = ABS_CNT,
74                 [EV_MSC]        = MSC_CNT,
75                 [EV_SW]         = SW_CNT,
76                 [EV_LED]        = LED_CNT,
77                 [EV_SND]        = SND_CNT,
78                 [EV_FF]         = FF_CNT,
79         };
80
81         return (type < EV_CNT) ? counts[type] : 0;
82 }
83
84 /* requires the buffer lock to be held */
85 static bool __evdev_is_filtered(struct evdev_client *client,
86                                 unsigned int type,
87                                 unsigned int code)
88 {
89         unsigned long *mask;
90         size_t cnt;
91
92         /* EV_SYN and unknown codes are never filtered */
93         if (type == EV_SYN || type >= EV_CNT)
94                 return false;
95
96         /* first test whether the type is filtered */
97         mask = client->evmasks[0];
98         if (mask && !test_bit(type, mask))
99                 return true;
100
101         /* unknown values are never filtered */
102         cnt = evdev_get_mask_cnt(type);
103         if (!cnt || code >= cnt)
104                 return false;
105
106         mask = client->evmasks[type];
107         return mask && !test_bit(code, mask);
108 }
109
110 /* flush queued events of type @type, caller must hold client->buffer_lock */
111 static void __evdev_flush_queue(struct evdev_client *client, unsigned int type)
112 {
113         unsigned int i, head, num;
114         unsigned int mask = client->bufsize - 1;
115         bool is_report;
116         struct input_event *ev;
117
118         BUG_ON(type == EV_SYN);
119
120         head = client->tail;
121         client->packet_head = client->tail;
122
123         /* init to 1 so a leading SYN_REPORT will not be dropped */
124         num = 1;
125
126         for (i = client->tail; i != client->head; i = (i + 1) & mask) {
127                 ev = &client->buffer[i];
128                 is_report = ev->type == EV_SYN && ev->code == SYN_REPORT;
129
130                 if (ev->type == type) {
131                         /* drop matched entry */
132                         continue;
133                 } else if (is_report && !num) {
134                         /* drop empty SYN_REPORT groups */
135                         continue;
136                 } else if (head != i) {
137                         /* move entry to fill the gap */
138                         client->buffer[head] = *ev;
139                 }
140
141                 num++;
142                 head = (head + 1) & mask;
143
144                 if (is_report) {
145                         num = 0;
146                         client->packet_head = head;
147                 }
148         }
149
150         client->head = head;
151 }
152
153 static void __evdev_queue_syn_dropped(struct evdev_client *client)
154 {
155         struct input_event ev;
156         ktime_t time;
157         struct timespec64 ts;
158
159         time = client->clk_type == EV_CLK_REAL ?
160                         ktime_get_real() :
161                         client->clk_type == EV_CLK_MONO ?
162                                 ktime_get() :
163                                 ktime_get_boottime();
164
165         ts = ktime_to_timespec64(time);
166         ev.input_event_sec = ts.tv_sec;
167         ev.input_event_usec = ts.tv_nsec / NSEC_PER_USEC;
168         ev.type = EV_SYN;
169         ev.code = SYN_DROPPED;
170         ev.value = 0;
171
172         client->buffer[client->head++] = ev;
173         client->head &= client->bufsize - 1;
174
175         if (unlikely(client->head == client->tail)) {
176                 /* drop queue but keep our SYN_DROPPED event */
177                 client->tail = (client->head - 1) & (client->bufsize - 1);
178                 client->packet_head = client->tail;
179         }
180 }
181
182 static void evdev_queue_syn_dropped(struct evdev_client *client)
183 {
184         unsigned long flags;
185
186         spin_lock_irqsave(&client->buffer_lock, flags);
187         __evdev_queue_syn_dropped(client);
188         spin_unlock_irqrestore(&client->buffer_lock, flags);
189 }
190
191 static int evdev_set_clk_type(struct evdev_client *client, unsigned int clkid)
192 {
193         unsigned long flags;
194         unsigned int clk_type;
195
196         switch (clkid) {
197
198         case CLOCK_REALTIME:
199                 clk_type = EV_CLK_REAL;
200                 break;
201         case CLOCK_MONOTONIC:
202                 clk_type = EV_CLK_MONO;
203                 break;
204         case CLOCK_BOOTTIME:
205                 clk_type = EV_CLK_BOOT;
206                 break;
207         default:
208                 return -EINVAL;
209         }
210
211         if (client->clk_type != clk_type) {
212                 client->clk_type = clk_type;
213
214                 /*
215                  * Flush pending events and queue SYN_DROPPED event,
216                  * but only if the queue is not empty.
217                  */
218                 spin_lock_irqsave(&client->buffer_lock, flags);
219
220                 if (client->head != client->tail) {
221                         client->packet_head = client->head = client->tail;
222                         __evdev_queue_syn_dropped(client);
223                 }
224
225                 spin_unlock_irqrestore(&client->buffer_lock, flags);
226         }
227
228         return 0;
229 }
230
231 static void __pass_event(struct evdev_client *client,
232                          const struct input_event *event)
233 {
234         client->buffer[client->head++] = *event;
235         client->head &= client->bufsize - 1;
236
237         if (unlikely(client->head == client->tail)) {
238                 /*
239                  * This effectively "drops" all unconsumed events, leaving
240                  * EV_SYN/SYN_DROPPED plus the newest event in the queue.
241                  */
242                 client->tail = (client->head - 2) & (client->bufsize - 1);
243
244                 client->buffer[client->tail] = (struct input_event) {
245                         .input_event_sec = event->input_event_sec,
246                         .input_event_usec = event->input_event_usec,
247                         .type = EV_SYN,
248                         .code = SYN_DROPPED,
249                         .value = 0,
250                 };
251
252                 client->packet_head = client->tail;
253         }
254
255         if (event->type == EV_SYN && event->code == SYN_REPORT) {
256                 client->packet_head = client->head;
257                 kill_fasync(&client->fasync, SIGIO, POLL_IN);
258         }
259 }
260
261 static void evdev_pass_values(struct evdev_client *client,
262                         const struct input_value *vals, unsigned int count,
263                         ktime_t *ev_time)
264 {
265         struct evdev *evdev = client->evdev;
266         const struct input_value *v;
267         struct input_event event;
268         struct timespec64 ts;
269         bool wakeup = false;
270
271         if (client->revoked)
272                 return;
273
274         ts = ktime_to_timespec64(ev_time[client->clk_type]);
275         event.input_event_sec = ts.tv_sec;
276         event.input_event_usec = ts.tv_nsec / NSEC_PER_USEC;
277
278         /* Interrupts are disabled, just acquire the lock. */
279         spin_lock(&client->buffer_lock);
280
281         for (v = vals; v != vals + count; v++) {
282                 if (__evdev_is_filtered(client, v->type, v->code))
283                         continue;
284
285                 if (v->type == EV_SYN && v->code == SYN_REPORT) {
286                         /* drop empty SYN_REPORT */
287                         if (client->packet_head == client->head)
288                                 continue;
289
290                         wakeup = true;
291                 }
292
293                 event.type = v->type;
294                 event.code = v->code;
295                 event.value = v->value;
296                 __pass_event(client, &event);
297         }
298
299         spin_unlock(&client->buffer_lock);
300
301         if (wakeup)
302                 wake_up_interruptible(&evdev->wait);
303 }
304
305 /*
306  * Pass incoming events to all connected clients.
307  */
308 static void evdev_events(struct input_handle *handle,
309                          const struct input_value *vals, unsigned int count)
310 {
311         struct evdev *evdev = handle->private;
312         struct evdev_client *client;
313         ktime_t ev_time[EV_CLK_MAX];
314
315         ev_time[EV_CLK_MONO] = ktime_get();
316         ev_time[EV_CLK_REAL] = ktime_mono_to_real(ev_time[EV_CLK_MONO]);
317         ev_time[EV_CLK_BOOT] = ktime_mono_to_any(ev_time[EV_CLK_MONO],
318                                                  TK_OFFS_BOOT);
319
320         rcu_read_lock();
321
322         client = rcu_dereference(evdev->grab);
323
324         if (client)
325                 evdev_pass_values(client, vals, count, ev_time);
326         else
327                 list_for_each_entry_rcu(client, &evdev->client_list, node)
328                         evdev_pass_values(client, vals, count, ev_time);
329
330         rcu_read_unlock();
331 }
332
333 /*
334  * Pass incoming event to all connected clients.
335  */
336 static void evdev_event(struct input_handle *handle,
337                         unsigned int type, unsigned int code, int value)
338 {
339         struct input_value vals[] = { { type, code, value } };
340
341         evdev_events(handle, vals, 1);
342 }
343
344 static int evdev_fasync(int fd, struct file *file, int on)
345 {
346         struct evdev_client *client = file->private_data;
347
348         return fasync_helper(fd, file, on, &client->fasync);
349 }
350
351 static void evdev_free(struct device *dev)
352 {
353         struct evdev *evdev = container_of(dev, struct evdev, dev);
354
355         input_put_device(evdev->handle.dev);
356         kfree(evdev);
357 }
358
359 /*
360  * Grabs an event device (along with underlying input device).
361  * This function is called with evdev->mutex taken.
362  */
363 static int evdev_grab(struct evdev *evdev, struct evdev_client *client)
364 {
365         int error;
366
367         if (evdev->grab)
368                 return -EBUSY;
369
370         error = input_grab_device(&evdev->handle);
371         if (error)
372                 return error;
373
374         rcu_assign_pointer(evdev->grab, client);
375
376         return 0;
377 }
378
379 static int evdev_ungrab(struct evdev *evdev, struct evdev_client *client)
380 {
381         struct evdev_client *grab = rcu_dereference_protected(evdev->grab,
382                                         lockdep_is_held(&evdev->mutex));
383
384         if (grab != client)
385                 return  -EINVAL;
386
387         rcu_assign_pointer(evdev->grab, NULL);
388         synchronize_rcu();
389         input_release_device(&evdev->handle);
390
391         return 0;
392 }
393
394 static void evdev_attach_client(struct evdev *evdev,
395                                 struct evdev_client *client)
396 {
397         spin_lock(&evdev->client_lock);
398         list_add_tail_rcu(&client->node, &evdev->client_list);
399         spin_unlock(&evdev->client_lock);
400 }
401
402 static void evdev_detach_client(struct evdev *evdev,
403                                 struct evdev_client *client)
404 {
405         spin_lock(&evdev->client_lock);
406         list_del_rcu(&client->node);
407         spin_unlock(&evdev->client_lock);
408         synchronize_rcu();
409 }
410
411 static int evdev_open_device(struct evdev *evdev)
412 {
413         int retval;
414
415         retval = mutex_lock_interruptible(&evdev->mutex);
416         if (retval)
417                 return retval;
418
419         if (!evdev->exist)
420                 retval = -ENODEV;
421         else if (!evdev->open++) {
422                 retval = input_open_device(&evdev->handle);
423                 if (retval)
424                         evdev->open--;
425         }
426
427         mutex_unlock(&evdev->mutex);
428         return retval;
429 }
430
431 static void evdev_close_device(struct evdev *evdev)
432 {
433         mutex_lock(&evdev->mutex);
434
435         if (evdev->exist && !--evdev->open)
436                 input_close_device(&evdev->handle);
437
438         mutex_unlock(&evdev->mutex);
439 }
440
441 /*
442  * Wake up users waiting for IO so they can disconnect from
443  * dead device.
444  */
445 static void evdev_hangup(struct evdev *evdev)
446 {
447         struct evdev_client *client;
448
449         spin_lock(&evdev->client_lock);
450         list_for_each_entry(client, &evdev->client_list, node)
451                 kill_fasync(&client->fasync, SIGIO, POLL_HUP);
452         spin_unlock(&evdev->client_lock);
453
454         wake_up_interruptible(&evdev->wait);
455 }
456
457 static int evdev_release(struct inode *inode, struct file *file)
458 {
459         struct evdev_client *client = file->private_data;
460         struct evdev *evdev = client->evdev;
461         unsigned int i;
462
463         mutex_lock(&evdev->mutex);
464
465         if (evdev->exist && !client->revoked)
466                 input_flush_device(&evdev->handle, file);
467
468         evdev_ungrab(evdev, client);
469         mutex_unlock(&evdev->mutex);
470
471         evdev_detach_client(evdev, client);
472
473         for (i = 0; i < EV_CNT; ++i)
474                 bitmap_free(client->evmasks[i]);
475
476         kvfree(client);
477
478         evdev_close_device(evdev);
479
480         return 0;
481 }
482
483 static unsigned int evdev_compute_buffer_size(struct input_dev *dev)
484 {
485         unsigned int n_events =
486                 max(dev->hint_events_per_packet * EVDEV_BUF_PACKETS,
487                     EVDEV_MIN_BUFFER_SIZE);
488
489         return roundup_pow_of_two(n_events);
490 }
491
492 static int evdev_open(struct inode *inode, struct file *file)
493 {
494         struct evdev *evdev = container_of(inode->i_cdev, struct evdev, cdev);
495         unsigned int bufsize = evdev_compute_buffer_size(evdev->handle.dev);
496         unsigned int size = sizeof(struct evdev_client) +
497                                         bufsize * sizeof(struct input_event);
498         struct evdev_client *client;
499         int error;
500
501         client = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
502         if (!client)
503                 client = vzalloc(size);
504         if (!client)
505                 return -ENOMEM;
506
507         client->bufsize = bufsize;
508         spin_lock_init(&client->buffer_lock);
509         client->evdev = evdev;
510         evdev_attach_client(evdev, client);
511
512         error = evdev_open_device(evdev);
513         if (error)
514                 goto err_free_client;
515
516         file->private_data = client;
517         nonseekable_open(inode, file);
518
519         return 0;
520
521  err_free_client:
522         evdev_detach_client(evdev, client);
523         kvfree(client);
524         return error;
525 }
526
527 static ssize_t evdev_write(struct file *file, const char __user *buffer,
528                            size_t count, loff_t *ppos)
529 {
530         struct evdev_client *client = file->private_data;
531         struct evdev *evdev = client->evdev;
532         struct input_event event;
533         int retval = 0;
534
535         if (count != 0 && count < input_event_size())
536                 return -EINVAL;
537
538         retval = mutex_lock_interruptible(&evdev->mutex);
539         if (retval)
540                 return retval;
541
542         if (!evdev->exist || client->revoked) {
543                 retval = -ENODEV;
544                 goto out;
545         }
546
547         while (retval + input_event_size() <= count) {
548
549                 if (input_event_from_user(buffer + retval, &event)) {
550                         retval = -EFAULT;
551                         goto out;
552                 }
553                 retval += input_event_size();
554
555                 input_inject_event(&evdev->handle,
556                                    event.type, event.code, event.value);
557                 cond_resched();
558         }
559
560  out:
561         mutex_unlock(&evdev->mutex);
562         return retval;
563 }
564
565 static int evdev_fetch_next_event(struct evdev_client *client,
566                                   struct input_event *event)
567 {
568         int have_event;
569
570         spin_lock_irq(&client->buffer_lock);
571
572         have_event = client->packet_head != client->tail;
573         if (have_event) {
574                 *event = client->buffer[client->tail++];
575                 client->tail &= client->bufsize - 1;
576         }
577
578         spin_unlock_irq(&client->buffer_lock);
579
580         return have_event;
581 }
582
583 static ssize_t evdev_read(struct file *file, char __user *buffer,
584                           size_t count, loff_t *ppos)
585 {
586         struct evdev_client *client = file->private_data;
587         struct evdev *evdev = client->evdev;
588         struct input_event event;
589         size_t read = 0;
590         int error;
591
592         if (count != 0 && count < input_event_size())
593                 return -EINVAL;
594
595         for (;;) {
596                 if (!evdev->exist || client->revoked)
597                         return -ENODEV;
598
599                 if (client->packet_head == client->tail &&
600                     (file->f_flags & O_NONBLOCK))
601                         return -EAGAIN;
602
603                 /*
604                  * count == 0 is special - no IO is done but we check
605                  * for error conditions (see above).
606                  */
607                 if (count == 0)
608                         break;
609
610                 while (read + input_event_size() <= count &&
611                        evdev_fetch_next_event(client, &event)) {
612
613                         if (input_event_to_user(buffer + read, &event))
614                                 return -EFAULT;
615
616                         read += input_event_size();
617                 }
618
619                 if (read)
620                         break;
621
622                 if (!(file->f_flags & O_NONBLOCK)) {
623                         error = wait_event_interruptible(evdev->wait,
624                                         client->packet_head != client->tail ||
625                                         !evdev->exist || client->revoked);
626                         if (error)
627                                 return error;
628                 }
629         }
630
631         return read;
632 }
633
634 /* No kernel lock - fine */
635 static __poll_t evdev_poll(struct file *file, poll_table *wait)
636 {
637         struct evdev_client *client = file->private_data;
638         struct evdev *evdev = client->evdev;
639         __poll_t mask;
640
641         poll_wait(file, &evdev->wait, wait);
642
643         if (evdev->exist && !client->revoked)
644                 mask = EPOLLOUT | EPOLLWRNORM;
645         else
646                 mask = EPOLLHUP | EPOLLERR;
647
648         if (client->packet_head != client->tail)
649                 mask |= EPOLLIN | EPOLLRDNORM;
650
651         return mask;
652 }
653
654 #ifdef CONFIG_COMPAT
655
656 #define BITS_PER_LONG_COMPAT (sizeof(compat_long_t) * 8)
657 #define BITS_TO_LONGS_COMPAT(x) ((((x) - 1) / BITS_PER_LONG_COMPAT) + 1)
658
659 #ifdef __BIG_ENDIAN
660 static int bits_to_user(unsigned long *bits, unsigned int maxbit,
661                         unsigned int maxlen, void __user *p, int compat)
662 {
663         int len, i;
664
665         if (compat) {
666                 len = BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t);
667                 if (len > maxlen)
668                         len = maxlen;
669
670                 for (i = 0; i < len / sizeof(compat_long_t); i++)
671                         if (copy_to_user((compat_long_t __user *) p + i,
672                                          (compat_long_t *) bits +
673                                                 i + 1 - ((i % 2) << 1),
674                                          sizeof(compat_long_t)))
675                                 return -EFAULT;
676         } else {
677                 len = BITS_TO_LONGS(maxbit) * sizeof(long);
678                 if (len > maxlen)
679                         len = maxlen;
680
681                 if (copy_to_user(p, bits, len))
682                         return -EFAULT;
683         }
684
685         return len;
686 }
687
688 static int bits_from_user(unsigned long *bits, unsigned int maxbit,
689                           unsigned int maxlen, const void __user *p, int compat)
690 {
691         int len, i;
692
693         if (compat) {
694                 if (maxlen % sizeof(compat_long_t))
695                         return -EINVAL;
696
697                 len = BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t);
698                 if (len > maxlen)
699                         len = maxlen;
700
701                 for (i = 0; i < len / sizeof(compat_long_t); i++)
702                         if (copy_from_user((compat_long_t *) bits +
703                                                 i + 1 - ((i % 2) << 1),
704                                            (compat_long_t __user *) p + i,
705                                            sizeof(compat_long_t)))
706                                 return -EFAULT;
707                 if (i % 2)
708                         *((compat_long_t *) bits + i - 1) = 0;
709
710         } else {
711                 if (maxlen % sizeof(long))
712                         return -EINVAL;
713
714                 len = BITS_TO_LONGS(maxbit) * sizeof(long);
715                 if (len > maxlen)
716                         len = maxlen;
717
718                 if (copy_from_user(bits, p, len))
719                         return -EFAULT;
720         }
721
722         return len;
723 }
724
725 #else
726
727 static int bits_to_user(unsigned long *bits, unsigned int maxbit,
728                         unsigned int maxlen, void __user *p, int compat)
729 {
730         int len = compat ?
731                         BITS_TO_LONGS_COMPAT(maxbit) * sizeof(compat_long_t) :
732                         BITS_TO_LONGS(maxbit) * sizeof(long);
733
734         if (len > maxlen)
735                 len = maxlen;
736
737         return copy_to_user(p, bits, len) ? -EFAULT : len;
738 }
739
740 static int bits_from_user(unsigned long *bits, unsigned int maxbit,
741                           unsigned int maxlen, const void __user *p, int compat)
742 {
743         size_t chunk_size = compat ? sizeof(compat_long_t) : sizeof(long);
744         int len;
745
746         if (maxlen % chunk_size)
747                 return -EINVAL;
748
749         len = compat ? BITS_TO_LONGS_COMPAT(maxbit) : BITS_TO_LONGS(maxbit);
750         len *= chunk_size;
751         if (len > maxlen)
752                 len = maxlen;
753
754         return copy_from_user(bits, p, len) ? -EFAULT : len;
755 }
756
757 #endif /* __BIG_ENDIAN */
758
759 #else
760
761 static int bits_to_user(unsigned long *bits, unsigned int maxbit,
762                         unsigned int maxlen, void __user *p, int compat)
763 {
764         int len = BITS_TO_LONGS(maxbit) * sizeof(long);
765
766         if (len > maxlen)
767                 len = maxlen;
768
769         return copy_to_user(p, bits, len) ? -EFAULT : len;
770 }
771
772 static int bits_from_user(unsigned long *bits, unsigned int maxbit,
773                           unsigned int maxlen, const void __user *p, int compat)
774 {
775         int len;
776
777         if (maxlen % sizeof(long))
778                 return -EINVAL;
779
780         len = BITS_TO_LONGS(maxbit) * sizeof(long);
781         if (len > maxlen)
782                 len = maxlen;
783
784         return copy_from_user(bits, p, len) ? -EFAULT : len;
785 }
786
787 #endif /* CONFIG_COMPAT */
788
789 static int str_to_user(const char *str, unsigned int maxlen, void __user *p)
790 {
791         int len;
792
793         if (!str)
794                 return -ENOENT;
795
796         len = strlen(str) + 1;
797         if (len > maxlen)
798                 len = maxlen;
799
800         return copy_to_user(p, str, len) ? -EFAULT : len;
801 }
802
803 static int handle_eviocgbit(struct input_dev *dev,
804                             unsigned int type, unsigned int size,
805                             void __user *p, int compat_mode)
806 {
807         unsigned long *bits;
808         int len;
809
810         switch (type) {
811
812         case      0: bits = dev->evbit;  len = EV_MAX;  break;
813         case EV_KEY: bits = dev->keybit; len = KEY_MAX; break;
814         case EV_REL: bits = dev->relbit; len = REL_MAX; break;
815         case EV_ABS: bits = dev->absbit; len = ABS_MAX; break;
816         case EV_MSC: bits = dev->mscbit; len = MSC_MAX; break;
817         case EV_LED: bits = dev->ledbit; len = LED_MAX; break;
818         case EV_SND: bits = dev->sndbit; len = SND_MAX; break;
819         case EV_FF:  bits = dev->ffbit;  len = FF_MAX;  break;
820         case EV_SW:  bits = dev->swbit;  len = SW_MAX;  break;
821         default: return -EINVAL;
822         }
823
824         return bits_to_user(bits, len, size, p, compat_mode);
825 }
826
827 static int evdev_handle_get_keycode(struct input_dev *dev, void __user *p)
828 {
829         struct input_keymap_entry ke = {
830                 .len    = sizeof(unsigned int),
831                 .flags  = 0,
832         };
833         int __user *ip = (int __user *)p;
834         int error;
835
836         /* legacy case */
837         if (copy_from_user(ke.scancode, p, sizeof(unsigned int)))
838                 return -EFAULT;
839
840         error = input_get_keycode(dev, &ke);
841         if (error)
842                 return error;
843
844         if (put_user(ke.keycode, ip + 1))
845                 return -EFAULT;
846
847         return 0;
848 }
849
850 static int evdev_handle_get_keycode_v2(struct input_dev *dev, void __user *p)
851 {
852         struct input_keymap_entry ke;
853         int error;
854
855         if (copy_from_user(&ke, p, sizeof(ke)))
856                 return -EFAULT;
857
858         error = input_get_keycode(dev, &ke);
859         if (error)
860                 return error;
861
862         if (copy_to_user(p, &ke, sizeof(ke)))
863                 return -EFAULT;
864
865         return 0;
866 }
867
868 static int evdev_handle_set_keycode(struct input_dev *dev, void __user *p)
869 {
870         struct input_keymap_entry ke = {
871                 .len    = sizeof(unsigned int),
872                 .flags  = 0,
873         };
874         int __user *ip = (int __user *)p;
875
876         if (copy_from_user(ke.scancode, p, sizeof(unsigned int)))
877                 return -EFAULT;
878
879         if (get_user(ke.keycode, ip + 1))
880                 return -EFAULT;
881
882         return input_set_keycode(dev, &ke);
883 }
884
885 static int evdev_handle_set_keycode_v2(struct input_dev *dev, void __user *p)
886 {
887         struct input_keymap_entry ke;
888
889         if (copy_from_user(&ke, p, sizeof(ke)))
890                 return -EFAULT;
891
892         if (ke.len > sizeof(ke.scancode))
893                 return -EINVAL;
894
895         return input_set_keycode(dev, &ke);
896 }
897
898 /*
899  * If we transfer state to the user, we should flush all pending events
900  * of the same type from the client's queue. Otherwise, they might end up
901  * with duplicate events, which can screw up client's state tracking.
902  * If bits_to_user fails after flushing the queue, we queue a SYN_DROPPED
903  * event so user-space will notice missing events.
904  *
905  * LOCKING:
906  * We need to take event_lock before buffer_lock to avoid dead-locks. But we
907  * need the even_lock only to guarantee consistent state. We can safely release
908  * it while flushing the queue. This allows input-core to handle filters while
909  * we flush the queue.
910  */
911 static int evdev_handle_get_val(struct evdev_client *client,
912                                 struct input_dev *dev, unsigned int type,
913                                 unsigned long *bits, unsigned int maxbit,
914                                 unsigned int maxlen, void __user *p,
915                                 int compat)
916 {
917         int ret;
918         unsigned long *mem;
919
920         mem = bitmap_alloc(maxbit, GFP_KERNEL);
921         if (!mem)
922                 return -ENOMEM;
923
924         spin_lock_irq(&dev->event_lock);
925         spin_lock(&client->buffer_lock);
926
927         bitmap_copy(mem, bits, maxbit);
928
929         spin_unlock(&dev->event_lock);
930
931         __evdev_flush_queue(client, type);
932
933         spin_unlock_irq(&client->buffer_lock);
934
935         ret = bits_to_user(mem, maxbit, maxlen, p, compat);
936         if (ret < 0)
937                 evdev_queue_syn_dropped(client);
938
939         bitmap_free(mem);
940
941         return ret;
942 }
943
944 static int evdev_handle_mt_request(struct input_dev *dev,
945                                    unsigned int size,
946                                    int __user *ip)
947 {
948         const struct input_mt *mt = dev->mt;
949         unsigned int code;
950         int max_slots;
951         int i;
952
953         if (get_user(code, &ip[0]))
954                 return -EFAULT;
955         if (!mt || !input_is_mt_value(code))
956                 return -EINVAL;
957
958         max_slots = (size - sizeof(__u32)) / sizeof(__s32);
959         for (i = 0; i < mt->num_slots && i < max_slots; i++) {
960                 int value = input_mt_get_value(&mt->slots[i], code);
961                 if (put_user(value, &ip[1 + i]))
962                         return -EFAULT;
963         }
964
965         return 0;
966 }
967
968 static int evdev_revoke(struct evdev *evdev, struct evdev_client *client,
969                         struct file *file)
970 {
971         client->revoked = true;
972         evdev_ungrab(evdev, client);
973         input_flush_device(&evdev->handle, file);
974         wake_up_interruptible(&evdev->wait);
975
976         return 0;
977 }
978
979 /* must be called with evdev-mutex held */
980 static int evdev_set_mask(struct evdev_client *client,
981                           unsigned int type,
982                           const void __user *codes,
983                           u32 codes_size,
984                           int compat)
985 {
986         unsigned long flags, *mask, *oldmask;
987         size_t cnt;
988         int error;
989
990         /* we allow unknown types and 'codes_size > size' for forward-compat */
991         cnt = evdev_get_mask_cnt(type);
992         if (!cnt)
993                 return 0;
994
995         mask = bitmap_zalloc(cnt, GFP_KERNEL);
996         if (!mask)
997                 return -ENOMEM;
998
999         error = bits_from_user(mask, cnt - 1, codes_size, codes, compat);
1000         if (error < 0) {
1001                 bitmap_free(mask);
1002                 return error;
1003         }
1004
1005         spin_lock_irqsave(&client->buffer_lock, flags);
1006         oldmask = client->evmasks[type];
1007         client->evmasks[type] = mask;
1008         spin_unlock_irqrestore(&client->buffer_lock, flags);
1009
1010         bitmap_free(oldmask);
1011
1012         return 0;
1013 }
1014
1015 /* must be called with evdev-mutex held */
1016 static int evdev_get_mask(struct evdev_client *client,
1017                           unsigned int type,
1018                           void __user *codes,
1019                           u32 codes_size,
1020                           int compat)
1021 {
1022         unsigned long *mask;
1023         size_t cnt, size, xfer_size;
1024         int i;
1025         int error;
1026
1027         /* we allow unknown types and 'codes_size > size' for forward-compat */
1028         cnt = evdev_get_mask_cnt(type);
1029         size = sizeof(unsigned long) * BITS_TO_LONGS(cnt);
1030         xfer_size = min_t(size_t, codes_size, size);
1031
1032         if (cnt > 0) {
1033                 mask = client->evmasks[type];
1034                 if (mask) {
1035                         error = bits_to_user(mask, cnt - 1,
1036                                              xfer_size, codes, compat);
1037                         if (error < 0)
1038                                 return error;
1039                 } else {
1040                         /* fake mask with all bits set */
1041                         for (i = 0; i < xfer_size; i++)
1042                                 if (put_user(0xffU, (u8 __user *)codes + i))
1043                                         return -EFAULT;
1044                 }
1045         }
1046
1047         if (xfer_size < codes_size)
1048                 if (clear_user(codes + xfer_size, codes_size - xfer_size))
1049                         return -EFAULT;
1050
1051         return 0;
1052 }
1053
1054 static long evdev_do_ioctl(struct file *file, unsigned int cmd,
1055                            void __user *p, int compat_mode)
1056 {
1057         struct evdev_client *client = file->private_data;
1058         struct evdev *evdev = client->evdev;
1059         struct input_dev *dev = evdev->handle.dev;
1060         struct input_absinfo abs;
1061         struct input_mask mask;
1062         struct ff_effect effect;
1063         int __user *ip = (int __user *)p;
1064         unsigned int i, t, u, v;
1065         unsigned int size;
1066         int error;
1067
1068         /* First we check for fixed-length commands */
1069         switch (cmd) {
1070
1071         case EVIOCGVERSION:
1072                 return put_user(EV_VERSION, ip);
1073
1074         case EVIOCGID:
1075                 if (copy_to_user(p, &dev->id, sizeof(struct input_id)))
1076                         return -EFAULT;
1077                 return 0;
1078
1079         case EVIOCGREP:
1080                 if (!test_bit(EV_REP, dev->evbit))
1081                         return -ENOSYS;
1082                 if (put_user(dev->rep[REP_DELAY], ip))
1083                         return -EFAULT;
1084                 if (put_user(dev->rep[REP_PERIOD], ip + 1))
1085                         return -EFAULT;
1086                 return 0;
1087
1088         case EVIOCSREP:
1089                 if (!test_bit(EV_REP, dev->evbit))
1090                         return -ENOSYS;
1091                 if (get_user(u, ip))
1092                         return -EFAULT;
1093                 if (get_user(v, ip + 1))
1094                         return -EFAULT;
1095
1096                 input_inject_event(&evdev->handle, EV_REP, REP_DELAY, u);
1097                 input_inject_event(&evdev->handle, EV_REP, REP_PERIOD, v);
1098
1099                 return 0;
1100
1101         case EVIOCRMFF:
1102                 return input_ff_erase(dev, (int)(unsigned long) p, file);
1103
1104         case EVIOCGEFFECTS:
1105                 i = test_bit(EV_FF, dev->evbit) ?
1106                                 dev->ff->max_effects : 0;
1107                 if (put_user(i, ip))
1108                         return -EFAULT;
1109                 return 0;
1110
1111         case EVIOCGRAB:
1112                 if (p)
1113                         return evdev_grab(evdev, client);
1114                 else
1115                         return evdev_ungrab(evdev, client);
1116
1117         case EVIOCREVOKE:
1118                 if (p)
1119                         return -EINVAL;
1120                 else
1121                         return evdev_revoke(evdev, client, file);
1122
1123         case EVIOCGMASK: {
1124                 void __user *codes_ptr;
1125
1126                 if (copy_from_user(&mask, p, sizeof(mask)))
1127                         return -EFAULT;
1128
1129                 codes_ptr = (void __user *)(unsigned long)mask.codes_ptr;
1130                 return evdev_get_mask(client,
1131                                       mask.type, codes_ptr, mask.codes_size,
1132                                       compat_mode);
1133         }
1134
1135         case EVIOCSMASK: {
1136                 const void __user *codes_ptr;
1137
1138                 if (copy_from_user(&mask, p, sizeof(mask)))
1139                         return -EFAULT;
1140
1141                 codes_ptr = (const void __user *)(unsigned long)mask.codes_ptr;
1142                 return evdev_set_mask(client,
1143                                       mask.type, codes_ptr, mask.codes_size,
1144                                       compat_mode);
1145         }
1146
1147         case EVIOCSCLOCKID:
1148                 if (copy_from_user(&i, p, sizeof(unsigned int)))
1149                         return -EFAULT;
1150
1151                 return evdev_set_clk_type(client, i);
1152
1153         case EVIOCGKEYCODE:
1154                 return evdev_handle_get_keycode(dev, p);
1155
1156         case EVIOCSKEYCODE:
1157                 return evdev_handle_set_keycode(dev, p);
1158
1159         case EVIOCGKEYCODE_V2:
1160                 return evdev_handle_get_keycode_v2(dev, p);
1161
1162         case EVIOCSKEYCODE_V2:
1163                 return evdev_handle_set_keycode_v2(dev, p);
1164         }
1165
1166         size = _IOC_SIZE(cmd);
1167
1168         /* Now check variable-length commands */
1169 #define EVIOC_MASK_SIZE(nr)     ((nr) & ~(_IOC_SIZEMASK << _IOC_SIZESHIFT))
1170         switch (EVIOC_MASK_SIZE(cmd)) {
1171
1172         case EVIOCGPROP(0):
1173                 return bits_to_user(dev->propbit, INPUT_PROP_MAX,
1174                                     size, p, compat_mode);
1175
1176         case EVIOCGMTSLOTS(0):
1177                 return evdev_handle_mt_request(dev, size, ip);
1178
1179         case EVIOCGKEY(0):
1180                 return evdev_handle_get_val(client, dev, EV_KEY, dev->key,
1181                                             KEY_MAX, size, p, compat_mode);
1182
1183         case EVIOCGLED(0):
1184                 return evdev_handle_get_val(client, dev, EV_LED, dev->led,
1185                                             LED_MAX, size, p, compat_mode);
1186
1187         case EVIOCGSND(0):
1188                 return evdev_handle_get_val(client, dev, EV_SND, dev->snd,
1189                                             SND_MAX, size, p, compat_mode);
1190
1191         case EVIOCGSW(0):
1192                 return evdev_handle_get_val(client, dev, EV_SW, dev->sw,
1193                                             SW_MAX, size, p, compat_mode);
1194
1195         case EVIOCGNAME(0):
1196                 return str_to_user(dev->name, size, p);
1197
1198         case EVIOCGPHYS(0):
1199                 return str_to_user(dev->phys, size, p);
1200
1201         case EVIOCGUNIQ(0):
1202                 return str_to_user(dev->uniq, size, p);
1203
1204         case EVIOC_MASK_SIZE(EVIOCSFF):
1205                 if (input_ff_effect_from_user(p, size, &effect))
1206                         return -EFAULT;
1207
1208                 error = input_ff_upload(dev, &effect, file);
1209                 if (error)
1210                         return error;
1211
1212                 if (put_user(effect.id, &(((struct ff_effect __user *)p)->id)))
1213                         return -EFAULT;
1214
1215                 return 0;
1216         }
1217
1218         /* Multi-number variable-length handlers */
1219         if (_IOC_TYPE(cmd) != 'E')
1220                 return -EINVAL;
1221
1222         if (_IOC_DIR(cmd) == _IOC_READ) {
1223
1224                 if ((_IOC_NR(cmd) & ~EV_MAX) == _IOC_NR(EVIOCGBIT(0, 0)))
1225                         return handle_eviocgbit(dev,
1226                                                 _IOC_NR(cmd) & EV_MAX, size,
1227                                                 p, compat_mode);
1228
1229                 if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) {
1230
1231                         if (!dev->absinfo)
1232                                 return -EINVAL;
1233
1234                         t = _IOC_NR(cmd) & ABS_MAX;
1235                         abs = dev->absinfo[t];
1236
1237                         if (copy_to_user(p, &abs, min_t(size_t,
1238                                         size, sizeof(struct input_absinfo))))
1239                                 return -EFAULT;
1240
1241                         return 0;
1242                 }
1243         }
1244
1245         if (_IOC_DIR(cmd) == _IOC_WRITE) {
1246
1247                 if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) {
1248
1249                         if (!dev->absinfo)
1250                                 return -EINVAL;
1251
1252                         t = _IOC_NR(cmd) & ABS_MAX;
1253
1254                         if (copy_from_user(&abs, p, min_t(size_t,
1255                                         size, sizeof(struct input_absinfo))))
1256                                 return -EFAULT;
1257
1258                         if (size < sizeof(struct input_absinfo))
1259                                 abs.resolution = 0;
1260
1261                         /* We can't change number of reserved MT slots */
1262                         if (t == ABS_MT_SLOT)
1263                                 return -EINVAL;
1264
1265                         /*
1266                          * Take event lock to ensure that we are not
1267                          * changing device parameters in the middle
1268                          * of event.
1269                          */
1270                         spin_lock_irq(&dev->event_lock);
1271                         dev->absinfo[t] = abs;
1272                         spin_unlock_irq(&dev->event_lock);
1273
1274                         return 0;
1275                 }
1276         }
1277
1278         return -EINVAL;
1279 }
1280
1281 static long evdev_ioctl_handler(struct file *file, unsigned int cmd,
1282                                 void __user *p, int compat_mode)
1283 {
1284         struct evdev_client *client = file->private_data;
1285         struct evdev *evdev = client->evdev;
1286         int retval;
1287
1288         retval = mutex_lock_interruptible(&evdev->mutex);
1289         if (retval)
1290                 return retval;
1291
1292         if (!evdev->exist || client->revoked) {
1293                 retval = -ENODEV;
1294                 goto out;
1295         }
1296
1297         retval = evdev_do_ioctl(file, cmd, p, compat_mode);
1298
1299  out:
1300         mutex_unlock(&evdev->mutex);
1301         return retval;
1302 }
1303
1304 static long evdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1305 {
1306         return evdev_ioctl_handler(file, cmd, (void __user *)arg, 0);
1307 }
1308
1309 #ifdef CONFIG_COMPAT
1310 static long evdev_ioctl_compat(struct file *file,
1311                                 unsigned int cmd, unsigned long arg)
1312 {
1313         return evdev_ioctl_handler(file, cmd, compat_ptr(arg), 1);
1314 }
1315 #endif
1316
1317 static const struct file_operations evdev_fops = {
1318         .owner          = THIS_MODULE,
1319         .read           = evdev_read,
1320         .write          = evdev_write,
1321         .poll           = evdev_poll,
1322         .open           = evdev_open,
1323         .release        = evdev_release,
1324         .unlocked_ioctl = evdev_ioctl,
1325 #ifdef CONFIG_COMPAT
1326         .compat_ioctl   = evdev_ioctl_compat,
1327 #endif
1328         .fasync         = evdev_fasync,
1329         .llseek         = no_llseek,
1330 };
1331
1332 /*
1333  * Mark device non-existent. This disables writes, ioctls and
1334  * prevents new users from opening the device. Already posted
1335  * blocking reads will stay, however new ones will fail.
1336  */
1337 static void evdev_mark_dead(struct evdev *evdev)
1338 {
1339         mutex_lock(&evdev->mutex);
1340         evdev->exist = false;
1341         mutex_unlock(&evdev->mutex);
1342 }
1343
1344 static void evdev_cleanup(struct evdev *evdev)
1345 {
1346         struct input_handle *handle = &evdev->handle;
1347
1348         evdev_mark_dead(evdev);
1349         evdev_hangup(evdev);
1350
1351         /* evdev is marked dead so no one else accesses evdev->open */
1352         if (evdev->open) {
1353                 input_flush_device(handle, NULL);
1354                 input_close_device(handle);
1355         }
1356 }
1357
1358 /*
1359  * Create new evdev device. Note that input core serializes calls
1360  * to connect and disconnect.
1361  */
1362 static int evdev_connect(struct input_handler *handler, struct input_dev *dev,
1363                          const struct input_device_id *id)
1364 {
1365         struct evdev *evdev;
1366         int minor;
1367         int dev_no;
1368         int error;
1369
1370         minor = input_get_new_minor(EVDEV_MINOR_BASE, EVDEV_MINORS, true);
1371         if (minor < 0) {
1372                 error = minor;
1373                 pr_err("failed to reserve new minor: %d\n", error);
1374                 return error;
1375         }
1376
1377         evdev = kzalloc(sizeof(struct evdev), GFP_KERNEL);
1378         if (!evdev) {
1379                 error = -ENOMEM;
1380                 goto err_free_minor;
1381         }
1382
1383         INIT_LIST_HEAD(&evdev->client_list);
1384         spin_lock_init(&evdev->client_lock);
1385         mutex_init(&evdev->mutex);
1386         init_waitqueue_head(&evdev->wait);
1387         evdev->exist = true;
1388
1389         dev_no = minor;
1390         /* Normalize device number if it falls into legacy range */
1391         if (dev_no < EVDEV_MINOR_BASE + EVDEV_MINORS)
1392                 dev_no -= EVDEV_MINOR_BASE;
1393         dev_set_name(&evdev->dev, "event%d", dev_no);
1394
1395         evdev->handle.dev = input_get_device(dev);
1396         evdev->handle.name = dev_name(&evdev->dev);
1397         evdev->handle.handler = handler;
1398         evdev->handle.private = evdev;
1399
1400         evdev->dev.devt = MKDEV(INPUT_MAJOR, minor);
1401         evdev->dev.class = &input_class;
1402         evdev->dev.parent = &dev->dev;
1403         evdev->dev.release = evdev_free;
1404         device_initialize(&evdev->dev);
1405
1406         error = input_register_handle(&evdev->handle);
1407         if (error)
1408                 goto err_free_evdev;
1409
1410         cdev_init(&evdev->cdev, &evdev_fops);
1411
1412         error = cdev_device_add(&evdev->cdev, &evdev->dev);
1413         if (error)
1414                 goto err_cleanup_evdev;
1415
1416         return 0;
1417
1418  err_cleanup_evdev:
1419         evdev_cleanup(evdev);
1420         input_unregister_handle(&evdev->handle);
1421  err_free_evdev:
1422         put_device(&evdev->dev);
1423  err_free_minor:
1424         input_free_minor(minor);
1425         return error;
1426 }
1427
1428 static void evdev_disconnect(struct input_handle *handle)
1429 {
1430         struct evdev *evdev = handle->private;
1431
1432         cdev_device_del(&evdev->cdev, &evdev->dev);
1433         evdev_cleanup(evdev);
1434         input_free_minor(MINOR(evdev->dev.devt));
1435         input_unregister_handle(handle);
1436         put_device(&evdev->dev);
1437 }
1438
1439 static const struct input_device_id evdev_ids[] = {
1440         { .driver_info = 1 },   /* Matches all devices */
1441         { },                    /* Terminating zero entry */
1442 };
1443
1444 MODULE_DEVICE_TABLE(input, evdev_ids);
1445
1446 static struct input_handler evdev_handler = {
1447         .event          = evdev_event,
1448         .events         = evdev_events,
1449         .connect        = evdev_connect,
1450         .disconnect     = evdev_disconnect,
1451         .legacy_minors  = true,
1452         .minor          = EVDEV_MINOR_BASE,
1453         .name           = "evdev",
1454         .id_table       = evdev_ids,
1455 };
1456
1457 static int __init evdev_init(void)
1458 {
1459         return input_register_handler(&evdev_handler);
1460 }
1461
1462 static void __exit evdev_exit(void)
1463 {
1464         input_unregister_handler(&evdev_handler);
1465 }
1466
1467 module_init(evdev_init);
1468 module_exit(evdev_exit);
1469
1470 MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
1471 MODULE_DESCRIPTION("Input driver event char devices");
1472 MODULE_LICENSE("GPL");