Fedora kernel-2.6.17-1.2142_FC4 patched with stable patch-2.6.17.4-vs2.0.2-rc26.diff
[linux-2.6.git] / drivers / input / misc / uinput.c
index 158c8e8..d723e9a 100644 (file)
 #include <linux/miscdevice.h>
 #include <linux/uinput.h>
 
-static int uinput_dev_open(struct input_dev *dev)
-{
-       return 0;
-}
-
-static void uinput_dev_close(struct input_dev *dev)
-{
-
-}
-
 static int uinput_dev_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
 {
        struct uinput_device    *udev;
@@ -63,22 +53,24 @@ static int uinput_dev_event(struct input_dev *dev, unsigned int type, unsigned i
        return 0;
 }
 
-static int uinput_request_alloc_id(struct input_dev *dev, struct uinput_request *request)
+static int uinput_request_alloc_id(struct uinput_device *udev, struct uinput_request *request)
 {
        /* Atomically allocate an ID for the given request. Returns 0 on success. */
-       struct uinput_device *udev = dev->private;
        int id;
+       int err = -1;
 
-       down(&udev->requests_sem);
-       for (id=0; id<UINPUT_NUM_REQUESTS; id++)
+       spin_lock(&udev->requests_lock);
+
+       for (id = 0; id < UINPUT_NUM_REQUESTS; id++)
                if (!udev->requests[id]) {
-                       udev->requests[id] = request;
                        request->id = id;
-                       up(&udev->requests_sem);
-                       return 0;
+                       udev->requests[id] = request;
+                       err = 0;
+                       break;
                }
-       up(&udev->requests_sem);
-       return -1;
+
+       spin_unlock(&udev->requests_lock);
+       return err;
 }
 
 static struct uinput_request* uinput_request_find(struct uinput_device *udev, int id)
@@ -86,135 +78,131 @@ static struct uinput_request* uinput_request_find(struct uinput_device *udev, in
        /* Find an input request, by ID. Returns NULL if the ID isn't valid. */
        if (id >= UINPUT_NUM_REQUESTS || id < 0)
                return NULL;
-       if (udev->requests[id]->completed)
-               return NULL;
        return udev->requests[id];
 }
 
-static void uinput_request_init(struct input_dev *dev, struct uinput_request *request, int code)
+static inline int uinput_request_reserve_slot(struct uinput_device *udev, struct uinput_request *request)
 {
-       struct uinput_device *udev = dev->private;
+       /* Allocate slot. If none are available right away, wait. */
+       return wait_event_interruptible(udev->requests_waitq,
+                                       !uinput_request_alloc_id(udev, request));
+}
 
-       memset(request, 0, sizeof(struct uinput_request));
-       request->code = code;
-       init_waitqueue_head(&request->waitq);
+static void uinput_request_done(struct uinput_device *udev, struct uinput_request *request)
+{
+       /* Mark slot as available */
+       udev->requests[request->id] = NULL;
+       wake_up(&udev->requests_waitq);
 
-       /* Allocate an ID. If none are available right away, wait. */
-       request->retval = wait_event_interruptible(udev->requests_waitq,
-                                      !uinput_request_alloc_id(dev, request));
+       complete(&request->done);
 }
 
-static void uinput_request_submit(struct input_dev *dev, struct uinput_request *request)
+static int uinput_request_submit(struct input_dev *dev, struct uinput_request *request)
 {
-       struct uinput_device *udev = dev->private;
-       int retval;
-
        /* Tell our userspace app about this new request by queueing an input event */
        uinput_dev_event(dev, EV_UINPUT, request->code, request->id);
 
        /* Wait for the request to complete */
-       retval = wait_event_interruptible(request->waitq, request->completed);
-       if (retval)
-               request->retval = retval;
-
-       /* Release this request's ID, let others know it's available */
-       udev->requests[request->id] = NULL;
-       wake_up_interruptible(&udev->requests_waitq);
+       wait_for_completion(&request->done);
+       return request->retval;
 }
 
 static int uinput_dev_upload_effect(struct input_dev *dev, struct ff_effect *effect)
 {
        struct uinput_request request;
+       int retval;
 
        if (!test_bit(EV_FF, dev->evbit))
                return -ENOSYS;
 
-       uinput_request_init(dev, &request, UI_FF_UPLOAD);
-       if (request.retval)
-               return request.retval;
+       request.id = -1;
+       init_completion(&request.done);
+       request.code = UI_FF_UPLOAD;
        request.u.effect = effect;
-       uinput_request_submit(dev, &request);
-       return request.retval;
+
+       retval = uinput_request_reserve_slot(dev->private, &request);
+       if (!retval)
+               retval = uinput_request_submit(dev, &request);
+
+       return retval;
 }
 
 static int uinput_dev_erase_effect(struct input_dev *dev, int effect_id)
 {
        struct uinput_request request;
+       int retval;
 
        if (!test_bit(EV_FF, dev->evbit))
                return -ENOSYS;
 
-       uinput_request_init(dev, &request, UI_FF_ERASE);
-       if (request.retval)
-               return request.retval;
+       request.id = -1;
+       init_completion(&request.done);
+       request.code = UI_FF_ERASE;
        request.u.effect_id = effect_id;
-       uinput_request_submit(dev, &request);
-       return request.retval;
+
+       retval = uinput_request_reserve_slot(dev->private, &request);
+       if (!retval)
+               retval = uinput_request_submit(dev, &request);
+
+       return retval;
 }
 
-static int uinput_create_device(struct uinput_device *udev)
+static void uinput_destroy_device(struct uinput_device *udev)
 {
-       if (!udev->dev->name) {
-               printk(KERN_DEBUG "%s: write device info first\n", UINPUT_NAME);
-               return -EINVAL;
+       const char *name, *phys;
+
+       if (udev->dev) {
+               name = udev->dev->name;
+               phys = udev->dev->phys;
+               if (udev->state == UIST_CREATED)
+                       input_unregister_device(udev->dev);
+               else
+                       input_free_device(udev->dev);
+               kfree(name);
+               kfree(phys);
+               udev->dev = NULL;
        }
 
-       udev->dev->open = uinput_dev_open;
-       udev->dev->close = uinput_dev_close;
-       udev->dev->event = uinput_dev_event;
-       udev->dev->upload_effect = uinput_dev_upload_effect;
-       udev->dev->erase_effect = uinput_dev_erase_effect;
-       udev->dev->private = udev;
-
-       init_waitqueue_head(&(udev->waitq));
-
-       input_register_device(udev->dev);
-
-       set_bit(UIST_CREATED, &(udev->state));
-
-       return 0;
+       udev->state = UIST_NEW_DEVICE;
 }
 
-static int uinput_destroy_device(struct uinput_device *udev)
+static int uinput_create_device(struct uinput_device *udev)
 {
-       if (!test_bit(UIST_CREATED, &(udev->state))) {
-               printk(KERN_WARNING "%s: create the device first\n", UINPUT_NAME);
+       int error;
+
+       if (udev->state != UIST_SETUP_COMPLETE) {
+               printk(KERN_DEBUG "%s: write device info first\n", UINPUT_NAME);
                return -EINVAL;
        }
 
-       input_unregister_device(udev->dev);
+       error = input_register_device(udev->dev);
+       if (error) {
+               uinput_destroy_device(udev);
+               return error;
+       }
 
-       clear_bit(UIST_CREATED, &(udev->state));
+       udev->state = UIST_CREATED;
 
        return 0;
 }
 
 static int uinput_open(struct inode *inode, struct file *file)
 {
-       struct uinput_device    *newdev;
-       struct input_dev        *newinput;
+       struct uinput_device *newdev;
 
-       newdev = kmalloc(sizeof(struct uinput_device), GFP_KERNEL);
+       newdev = kzalloc(sizeof(struct uinput_device), GFP_KERNEL);
        if (!newdev)
-               goto error;
-       memset(newdev, 0, sizeof(struct uinput_device));
-       init_MUTEX(&newdev->requests_sem);
-       init_waitqueue_head(&newdev->requests_waitq);
-
-       newinput = kmalloc(sizeof(struct input_dev), GFP_KERNEL);
-       if (!newinput)
-               goto cleanup;
-       memset(newinput, 0, sizeof(struct input_dev));
+               return -ENOMEM;
 
-       newdev->dev = newinput;
+       mutex_init(&newdev->mutex);
+       spin_lock_init(&newdev->requests_lock);
+       init_waitqueue_head(&newdev->requests_waitq);
+       init_waitqueue_head(&newdev->waitq);
+       newdev->state = UIST_NEW_DEVICE;
 
        file->private_data = newdev;
 
        return 0;
-cleanup:
-       kfree(newdev);
-error:
-       return -ENOMEM;
 }
 
 static int uinput_validate_absbits(struct input_dev *dev)
@@ -248,41 +236,62 @@ static int uinput_validate_absbits(struct input_dev *dev)
        return retval;
 }
 
-static int uinput_alloc_device(struct file *file, const char __user *buffer, size_t count)
+static int uinput_allocate_device(struct uinput_device *udev)
+{
+       udev->dev = input_allocate_device();
+       if (!udev->dev)
+               return -ENOMEM;
+
+       udev->dev->event = uinput_dev_event;
+       udev->dev->upload_effect = uinput_dev_upload_effect;
+       udev->dev->erase_effect = uinput_dev_erase_effect;
+       udev->dev->private = udev;
+
+       return 0;
+}
+
+static int uinput_setup_device(struct uinput_device *udev, const char __user *buffer, size_t count)
 {
        struct uinput_user_dev  *user_dev;
        struct input_dev        *dev;
-       struct uinput_device    *udev;
-       int                     size,
-                               retval;
+       char                    *name;
+       int                     size;
+       int                     retval;
 
-       retval = count;
+       if (count != sizeof(struct uinput_user_dev))
+               return -EINVAL;
+
+       if (!udev->dev) {
+               retval = uinput_allocate_device(udev);
+               if (retval)
+                       return retval;
+       }
 
-       udev = file->private_data;
        dev = udev->dev;
 
-       user_dev = kmalloc(sizeof(*user_dev), GFP_KERNEL);
-       if (!user_dev) {
-               retval = -ENOMEM;
-               goto exit;
-       }
+       user_dev = kmalloc(sizeof(struct uinput_user_dev), GFP_KERNEL);
+       if (!user_dev)
+               return -ENOMEM;
 
        if (copy_from_user(user_dev, buffer, sizeof(struct uinput_user_dev))) {
                retval = -EFAULT;
                goto exit;
        }
 
-       if (NULL != dev->name)
-               kfree(dev->name);
-
        size = strnlen(user_dev->name, UINPUT_MAX_NAME_SIZE) + 1;
-       dev->name = kmalloc(size, GFP_KERNEL);
-       if (!dev->name) {
+       if (!size) {
+               retval = -EINVAL;
+               goto exit;
+       }
+
+       kfree(dev->name);
+       dev->name = name = kmalloc(size, GFP_KERNEL);
+       if (!name) {
                retval = -ENOMEM;
                goto exit;
        }
+       strlcpy(name, user_dev->name, size);
 
-       strlcpy(dev->name, user_dev->name, size);
        dev->id.bustype = user_dev->id.bustype;
        dev->id.vendor  = user_dev->id.vendor;
        dev->id.product = user_dev->id.product;
@@ -300,29 +309,48 @@ static int uinput_alloc_device(struct file *file, const char __user *buffer, siz
        if (test_bit(EV_ABS, dev->evbit)) {
                retval = uinput_validate_absbits(dev);
                if (retval < 0)
-                       kfree(dev->name);
+                       goto exit;
        }
 
-exit:
+       udev->state = UIST_SETUP_COMPLETE;
+       retval = count;
+
+ exit:
        kfree(user_dev);
        return retval;
 }
 
+static inline ssize_t uinput_inject_event(struct uinput_device *udev, const char __user *buffer, size_t count)
+{
+       struct input_event ev;
+
+       if (count != sizeof(struct input_event))
+               return -EINVAL;
+
+       if (copy_from_user(&ev, buffer, sizeof(struct input_event)))
+               return -EFAULT;
+
+       input_event(udev->dev, ev.type, ev.code, ev.value);
+
+       return sizeof(struct input_event);
+}
+
 static ssize_t uinput_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
 {
        struct uinput_device *udev = file->private_data;
+       int retval;
 
-       if (test_bit(UIST_CREATED, &(udev->state))) {
-               struct input_event      ev;
+       retval = mutex_lock_interruptible(&udev->mutex);
+       if (retval)
+               return retval;
 
-               if (copy_from_user(&ev, buffer, sizeof(struct input_event)))
-                       return -EFAULT;
-               input_event(udev->dev, ev.type, ev.code, ev.value);
-       }
-       else
-               count = uinput_alloc_device(file, buffer, count);
+       retval = udev->state == UIST_CREATED ?
+                       uinput_inject_event(udev, buffer, count) :
+                       uinput_setup_device(udev, buffer, count);
 
-       return count;
+       mutex_unlock(&udev->mutex);
+
+       return retval;
 }
 
 static ssize_t uinput_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
@@ -330,30 +358,38 @@ static ssize_t uinput_read(struct file *file, char __user *buffer, size_t count,
        struct uinput_device *udev = file->private_data;
        int retval = 0;
 
-       if (!test_bit(UIST_CREATED, &(udev->state)))
+       if (udev->state != UIST_CREATED)
                return -ENODEV;
 
-       if ((udev->head == udev->tail) && (file->f_flags & O_NONBLOCK))
+       if (udev->head == udev->tail && (file->f_flags & O_NONBLOCK))
                return -EAGAIN;
 
        retval = wait_event_interruptible(udev->waitq,
-                       (udev->head != udev->tail) ||
-                       !test_bit(UIST_CREATED, &(udev->state)));
+                       udev->head != udev->tail || udev->state != UIST_CREATED);
+       if (retval)
+               return retval;
 
+       retval = mutex_lock_interruptible(&udev->mutex);
        if (retval)
                return retval;
 
-       if (!test_bit(UIST_CREATED, &(udev->state)))
-               return -ENODEV;
+       if (udev->state != UIST_CREATED) {
+               retval = -ENODEV;
+               goto out;
+       }
 
-       while ((udev->head != udev->tail) &&
-           (retval + sizeof(struct input_event) <= count)) {
-               if (copy_to_user(buffer + retval, &(udev->buff[udev->tail]),
-                   sizeof(struct input_event))) return -EFAULT;
+       while (udev->head != udev->tail && retval + sizeof(struct input_event) <= count) {
+               if (copy_to_user(buffer + retval, &udev->buff[udev->tail], sizeof(struct input_event))) {
+                       retval = -EFAULT;
+                       goto out;
+               }
                udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE;
                retval += sizeof(struct input_event);
        }
 
+ out:
+       mutex_unlock(&udev->mutex);
+
        return retval;
 }
 
@@ -369,52 +405,48 @@ static unsigned int uinput_poll(struct file *file, poll_table *wait)
        return 0;
 }
 
-static int uinput_burn_device(struct uinput_device *udev)
+static int uinput_release(struct inode *inode, struct file *file)
 {
-       if (test_bit(UIST_CREATED, &(udev->state)))
-               uinput_destroy_device(udev);
-
-       if (NULL != udev->dev->name)
-               kfree(udev->dev->name);
-       if (NULL != udev->dev->phys)
-               kfree(udev->dev->phys);
+       struct uinput_device *udev = file->private_data;
 
-       kfree(udev->dev);
+       uinput_destroy_device(udev);
        kfree(udev);
 
        return 0;
 }
 
-static int uinput_close(struct inode *inode, struct file *file)
-{
-       return uinput_burn_device(file->private_data);
-}
-
-static int uinput_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
+#define uinput_set_bit(_arg, _bit, _max)               \
+({                                                     \
+       int __ret = 0;                                  \
+       if (udev->state == UIST_CREATED)                \
+               __ret =  -EINVAL;                       \
+       else if ((_arg) > (_max))                       \
+               __ret = -EINVAL;                        \
+       else set_bit((_arg), udev->dev->_bit);          \
+       __ret;                                          \
+})
+
+static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
-       int                     retval = 0;
+       int                     retval;
        struct uinput_device    *udev;
        void __user             *p = (void __user *)arg;
        struct uinput_ff_upload ff_up;
        struct uinput_ff_erase  ff_erase;
        struct uinput_request   *req;
        int                     length;
+       char                    *phys;
 
        udev = file->private_data;
 
-       /* device attributes can not be changed after the device is created */
-       switch (cmd) {
-               case UI_SET_EVBIT:
-               case UI_SET_KEYBIT:
-               case UI_SET_RELBIT:
-               case UI_SET_ABSBIT:
-               case UI_SET_MSCBIT:
-               case UI_SET_LEDBIT:
-               case UI_SET_SNDBIT:
-               case UI_SET_FFBIT:
-               case UI_SET_PHYS:
-                       if (test_bit(UIST_CREATED, &(udev->state)))
-                               return -EINVAL;
+       retval = mutex_lock_interruptible(&udev->mutex);
+       if (retval)
+               return retval;
+
+       if (!udev->dev) {
+               retval = uinput_allocate_device(udev);
+               if (retval)
+                       goto out;
        }
 
        switch (cmd) {
@@ -423,93 +455,68 @@ static int uinput_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                        break;
 
                case UI_DEV_DESTROY:
-                       retval = uinput_destroy_device(udev);
+                       uinput_destroy_device(udev);
                        break;
 
                case UI_SET_EVBIT:
-                       if (arg > EV_MAX) {
-                               retval = -EINVAL;
-                               break;
-                       }
-                       set_bit(arg, udev->dev->evbit);
+                       retval = uinput_set_bit(arg, evbit, EV_MAX);
                        break;
 
                case UI_SET_KEYBIT:
-                       if (arg > KEY_MAX) {
-                               retval = -EINVAL;
-                               break;
-                       }
-                       set_bit(arg, udev->dev->keybit);
+                       retval = uinput_set_bit(arg, keybit, KEY_MAX);
                        break;
 
                case UI_SET_RELBIT:
-                       if (arg > REL_MAX) {
-                               retval = -EINVAL;
-                               break;
-                       }
-                       set_bit(arg, udev->dev->relbit);
+                       retval = uinput_set_bit(arg, relbit, REL_MAX);
                        break;
 
                case UI_SET_ABSBIT:
-                       if (arg > ABS_MAX) {
-                               retval = -EINVAL;
-                               break;
-                       }
-                       set_bit(arg, udev->dev->absbit);
+                       retval = uinput_set_bit(arg, absbit, ABS_MAX);
                        break;
 
                case UI_SET_MSCBIT:
-                       if (arg > MSC_MAX) {
-                               retval = -EINVAL;
-                               break;
-                       }
-                       set_bit(arg, udev->dev->mscbit);
+                       retval = uinput_set_bit(arg, mscbit, MSC_MAX);
                        break;
 
                case UI_SET_LEDBIT:
-                       if (arg > LED_MAX) {
-                               retval = -EINVAL;
-                               break;
-                       }
-                       set_bit(arg, udev->dev->ledbit);
+                       retval = uinput_set_bit(arg, ledbit, LED_MAX);
                        break;
 
                case UI_SET_SNDBIT:
-                       if (arg > SND_MAX) {
-                               retval = -EINVAL;
-                               break;
-                       }
-                       set_bit(arg, udev->dev->sndbit);
+                       retval = uinput_set_bit(arg, sndbit, SND_MAX);
                        break;
 
                case UI_SET_FFBIT:
-                       if (arg > FF_MAX) {
-                               retval = -EINVAL;
-                               break;
-                       }
-                       set_bit(arg, udev->dev->ffbit);
+                       retval = uinput_set_bit(arg, ffbit, FF_MAX);
+                       break;
+
+               case UI_SET_SWBIT:
+                       retval = uinput_set_bit(arg, swbit, SW_MAX);
                        break;
 
                case UI_SET_PHYS:
+                       if (udev->state == UIST_CREATED) {
+                               retval = -EINVAL;
+                               goto out;
+                       }
                        length = strnlen_user(p, 1024);
                        if (length <= 0) {
                                retval = -EFAULT;
                                break;
                        }
-                       if (NULL != udev->dev->phys)
-                               kfree(udev->dev->phys);
-                       udev->dev->phys = kmalloc(length, GFP_KERNEL);
-                       if (!udev->dev->phys) {
+                       kfree(udev->dev->phys);
+                       udev->dev->phys = phys = kmalloc(length, GFP_KERNEL);
+                       if (!phys) {
                                retval = -ENOMEM;
                                break;
                        }
-                       if (copy_from_user(udev->dev->phys, p, length)) {
-                               retval = -EFAULT;
-                               kfree(udev->dev->phys);
+                       if (copy_from_user(phys, p, length)) {
                                udev->dev->phys = NULL;
+                               kfree(phys);
+                               retval = -EFAULT;
                                break;
                        }
-                       udev->dev->phys[length-1] = '\0';
+                       phys[length - 1] = '\0';
                        break;
 
                case UI_BEGIN_FF_UPLOAD:
@@ -518,7 +525,7 @@ static int uinput_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                                break;
                        }
                        req = uinput_request_find(udev, ff_up.request_id);
-                       if (!(req && req->code==UI_FF_UPLOAD && req->u.effect)) {
+                       if (!(req && req->code == UI_FF_UPLOAD && req->u.effect)) {
                                retval = -EINVAL;
                                break;
                        }
@@ -536,7 +543,7 @@ static int uinput_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                                break;
                        }
                        req = uinput_request_find(udev, ff_erase.request_id);
-                       if (!(req && req->code==UI_FF_ERASE)) {
+                       if (!(req && req->code == UI_FF_ERASE)) {
                                retval = -EINVAL;
                                break;
                        }
@@ -554,14 +561,13 @@ static int uinput_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                                break;
                        }
                        req = uinput_request_find(udev, ff_up.request_id);
-                       if (!(req && req->code==UI_FF_UPLOAD && req->u.effect)) {
+                       if (!(req && req->code == UI_FF_UPLOAD && req->u.effect)) {
                                retval = -EINVAL;
                                break;
                        }
                        req->retval = ff_up.retval;
                        memcpy(req->u.effect, &ff_up.effect, sizeof(struct ff_effect));
-                       req->completed = 1;
-                       wake_up_interruptible(&req->waitq);
+                       uinput_request_done(udev, req);
                        break;
 
                case UI_END_FF_ERASE:
@@ -570,35 +576,37 @@ static int uinput_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                                break;
                        }
                        req = uinput_request_find(udev, ff_erase.request_id);
-                       if (!(req && req->code==UI_FF_ERASE)) {
+                       if (!(req && req->code == UI_FF_ERASE)) {
                                retval = -EINVAL;
                                break;
                        }
                        req->retval = ff_erase.retval;
-                       req->completed = 1;
-                       wake_up_interruptible(&req->waitq);
+                       uinput_request_done(udev, req);
                        break;
 
                default:
                        retval = -EINVAL;
        }
+
+ out:
+       mutex_unlock(&udev->mutex);
        return retval;
 }
 
 static struct file_operations uinput_fops = {
-       .owner =        THIS_MODULE,
-       .open =         uinput_open,
-       .release =      uinput_close,
-       .read =         uinput_read,
-       .write =        uinput_write,
-       .poll =         uinput_poll,
-       .ioctl =        uinput_ioctl,
+       .owner          = THIS_MODULE,
+       .open           = uinput_open,
+       .release        = uinput_release,
+       .read           = uinput_read,
+       .write          = uinput_write,
+       .poll           = uinput_poll,
+       .unlocked_ioctl = uinput_ioctl,
 };
 
 static struct miscdevice uinput_misc = {
-       .fops =         &uinput_fops,
-       .minor =        UINPUT_MINOR,
-       .name =         UINPUT_NAME,
+       .fops           = &uinput_fops,
+       .minor          = UINPUT_MINOR,
+       .name           = UINPUT_NAME,
 };
 
 static int __init uinput_init(void)