mic: vop: Fix use-after-free on remove
[linux/fpc-iii.git] / drivers / input / ff-core.c
blob66a46c84e28f543bc27f91479d5da669984e0d89
1 /*
2 * Force feedback support for Linux input subsystem
4 * Copyright (c) 2006 Anssi Hannula <anssi.hannula@gmail.com>
5 * Copyright (c) 2006 Dmitry Torokhov <dtor@mail.ru>
6 */
8 /*
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
24 /* #define DEBUG */
26 #include <linux/input.h>
27 #include <linux/module.h>
28 #include <linux/mutex.h>
29 #include <linux/sched.h>
30 #include <linux/slab.h>
33 * Check that the effect_id is a valid effect and whether the user
34 * is the owner
36 static int check_effect_access(struct ff_device *ff, int effect_id,
37 struct file *file)
39 if (effect_id < 0 || effect_id >= ff->max_effects ||
40 !ff->effect_owners[effect_id])
41 return -EINVAL;
43 if (file && ff->effect_owners[effect_id] != file)
44 return -EACCES;
46 return 0;
50 * Checks whether 2 effects can be combined together
52 static inline int check_effects_compatible(struct ff_effect *e1,
53 struct ff_effect *e2)
55 return e1->type == e2->type &&
56 (e1->type != FF_PERIODIC ||
57 e1->u.periodic.waveform == e2->u.periodic.waveform);
61 * Convert an effect into compatible one
63 static int compat_effect(struct ff_device *ff, struct ff_effect *effect)
65 int magnitude;
67 switch (effect->type) {
68 case FF_RUMBLE:
69 if (!test_bit(FF_PERIODIC, ff->ffbit))
70 return -EINVAL;
73 * calculate magnitude of sine wave as average of rumble's
74 * 2/3 of strong magnitude and 1/3 of weak magnitude
76 magnitude = effect->u.rumble.strong_magnitude / 3 +
77 effect->u.rumble.weak_magnitude / 6;
79 effect->type = FF_PERIODIC;
80 effect->u.periodic.waveform = FF_SINE;
81 effect->u.periodic.period = 50;
82 effect->u.periodic.magnitude = max(magnitude, 0x7fff);
83 effect->u.periodic.offset = 0;
84 effect->u.periodic.phase = 0;
85 effect->u.periodic.envelope.attack_length = 0;
86 effect->u.periodic.envelope.attack_level = 0;
87 effect->u.periodic.envelope.fade_length = 0;
88 effect->u.periodic.envelope.fade_level = 0;
90 return 0;
92 default:
93 /* Let driver handle conversion */
94 return 0;
98 /**
99 * input_ff_upload() - upload effect into force-feedback device
100 * @dev: input device
101 * @effect: effect to be uploaded
102 * @file: owner of the effect
104 int input_ff_upload(struct input_dev *dev, struct ff_effect *effect,
105 struct file *file)
107 struct ff_device *ff = dev->ff;
108 struct ff_effect *old;
109 int ret = 0;
110 int id;
112 if (!test_bit(EV_FF, dev->evbit))
113 return -ENOSYS;
115 if (effect->type < FF_EFFECT_MIN || effect->type > FF_EFFECT_MAX ||
116 !test_bit(effect->type, dev->ffbit)) {
117 dev_dbg(&dev->dev, "invalid or not supported effect type in upload\n");
118 return -EINVAL;
121 if (effect->type == FF_PERIODIC &&
122 (effect->u.periodic.waveform < FF_WAVEFORM_MIN ||
123 effect->u.periodic.waveform > FF_WAVEFORM_MAX ||
124 !test_bit(effect->u.periodic.waveform, dev->ffbit))) {
125 dev_dbg(&dev->dev, "invalid or not supported wave form in upload\n");
126 return -EINVAL;
129 if (!test_bit(effect->type, ff->ffbit)) {
130 ret = compat_effect(ff, effect);
131 if (ret)
132 return ret;
135 mutex_lock(&ff->mutex);
137 if (effect->id == -1) {
138 for (id = 0; id < ff->max_effects; id++)
139 if (!ff->effect_owners[id])
140 break;
142 if (id >= ff->max_effects) {
143 ret = -ENOSPC;
144 goto out;
147 effect->id = id;
148 old = NULL;
150 } else {
151 id = effect->id;
153 ret = check_effect_access(ff, id, file);
154 if (ret)
155 goto out;
157 old = &ff->effects[id];
159 if (!check_effects_compatible(effect, old)) {
160 ret = -EINVAL;
161 goto out;
165 ret = ff->upload(dev, effect, old);
166 if (ret)
167 goto out;
169 spin_lock_irq(&dev->event_lock);
170 ff->effects[id] = *effect;
171 ff->effect_owners[id] = file;
172 spin_unlock_irq(&dev->event_lock);
174 out:
175 mutex_unlock(&ff->mutex);
176 return ret;
178 EXPORT_SYMBOL_GPL(input_ff_upload);
181 * Erases the effect if the requester is also the effect owner. The mutex
182 * should already be locked before calling this function.
184 static int erase_effect(struct input_dev *dev, int effect_id,
185 struct file *file)
187 struct ff_device *ff = dev->ff;
188 int error;
190 error = check_effect_access(ff, effect_id, file);
191 if (error)
192 return error;
194 spin_lock_irq(&dev->event_lock);
195 ff->playback(dev, effect_id, 0);
196 ff->effect_owners[effect_id] = NULL;
197 spin_unlock_irq(&dev->event_lock);
199 if (ff->erase) {
200 error = ff->erase(dev, effect_id);
201 if (error) {
202 spin_lock_irq(&dev->event_lock);
203 ff->effect_owners[effect_id] = file;
204 spin_unlock_irq(&dev->event_lock);
206 return error;
210 return 0;
214 * input_ff_erase - erase a force-feedback effect from device
215 * @dev: input device to erase effect from
216 * @effect_id: id of the effect to be erased
217 * @file: purported owner of the request
219 * This function erases a force-feedback effect from specified device.
220 * The effect will only be erased if it was uploaded through the same
221 * file handle that is requesting erase.
223 int input_ff_erase(struct input_dev *dev, int effect_id, struct file *file)
225 struct ff_device *ff = dev->ff;
226 int ret;
228 if (!test_bit(EV_FF, dev->evbit))
229 return -ENOSYS;
231 mutex_lock(&ff->mutex);
232 ret = erase_effect(dev, effect_id, file);
233 mutex_unlock(&ff->mutex);
235 return ret;
237 EXPORT_SYMBOL_GPL(input_ff_erase);
240 * input_ff_flush - erase all effects owned by a file handle
241 * @dev: input device to erase effect from
242 * @file: purported owner of the effects
244 * This function erases all force-feedback effects associated with
245 * the given owner from specified device. Note that @file may be %NULL,
246 * in which case all effects will be erased.
248 int input_ff_flush(struct input_dev *dev, struct file *file)
250 struct ff_device *ff = dev->ff;
251 int i;
253 dev_dbg(&dev->dev, "flushing now\n");
255 mutex_lock(&ff->mutex);
257 for (i = 0; i < ff->max_effects; i++)
258 erase_effect(dev, i, file);
260 mutex_unlock(&ff->mutex);
262 return 0;
264 EXPORT_SYMBOL_GPL(input_ff_flush);
267 * input_ff_event() - generic handler for force-feedback events
268 * @dev: input device to send the effect to
269 * @type: event type (anything but EV_FF is ignored)
270 * @code: event code
271 * @value: event value
273 int input_ff_event(struct input_dev *dev, unsigned int type,
274 unsigned int code, int value)
276 struct ff_device *ff = dev->ff;
278 if (type != EV_FF)
279 return 0;
281 switch (code) {
282 case FF_GAIN:
283 if (!test_bit(FF_GAIN, dev->ffbit) || value > 0xffffU)
284 break;
286 ff->set_gain(dev, value);
287 break;
289 case FF_AUTOCENTER:
290 if (!test_bit(FF_AUTOCENTER, dev->ffbit) || value > 0xffffU)
291 break;
293 ff->set_autocenter(dev, value);
294 break;
296 default:
297 if (check_effect_access(ff, code, NULL) == 0)
298 ff->playback(dev, code, value);
299 break;
302 return 0;
304 EXPORT_SYMBOL_GPL(input_ff_event);
307 * input_ff_create() - create force-feedback device
308 * @dev: input device supporting force-feedback
309 * @max_effects: maximum number of effects supported by the device
311 * This function allocates all necessary memory for a force feedback
312 * portion of an input device and installs all default handlers.
313 * @dev->ffbit should be already set up before calling this function.
314 * Once ff device is created you need to setup its upload, erase,
315 * playback and other handlers before registering input device
317 int input_ff_create(struct input_dev *dev, unsigned int max_effects)
319 struct ff_device *ff;
320 size_t ff_dev_size;
321 int i;
323 if (!max_effects) {
324 dev_err(&dev->dev, "cannot allocate device without any effects\n");
325 return -EINVAL;
328 if (max_effects > FF_MAX_EFFECTS) {
329 dev_err(&dev->dev, "cannot allocate more than FF_MAX_EFFECTS effects\n");
330 return -EINVAL;
333 ff_dev_size = sizeof(struct ff_device) +
334 max_effects * sizeof(struct file *);
335 if (ff_dev_size < max_effects) /* overflow */
336 return -EINVAL;
338 ff = kzalloc(ff_dev_size, GFP_KERNEL);
339 if (!ff)
340 return -ENOMEM;
342 ff->effects = kcalloc(max_effects, sizeof(struct ff_effect),
343 GFP_KERNEL);
344 if (!ff->effects) {
345 kfree(ff);
346 return -ENOMEM;
349 ff->max_effects = max_effects;
350 mutex_init(&ff->mutex);
352 dev->ff = ff;
353 dev->flush = input_ff_flush;
354 dev->event = input_ff_event;
355 __set_bit(EV_FF, dev->evbit);
357 /* Copy "true" bits into ff device bitmap */
358 for_each_set_bit(i, dev->ffbit, FF_CNT)
359 __set_bit(i, ff->ffbit);
361 /* we can emulate RUMBLE with periodic effects */
362 if (test_bit(FF_PERIODIC, ff->ffbit))
363 __set_bit(FF_RUMBLE, dev->ffbit);
365 return 0;
367 EXPORT_SYMBOL_GPL(input_ff_create);
370 * input_ff_destroy() - frees force feedback portion of input device
371 * @dev: input device supporting force feedback
373 * This function is only needed in error path as input core will
374 * automatically free force feedback structures when device is
375 * destroyed.
377 void input_ff_destroy(struct input_dev *dev)
379 struct ff_device *ff = dev->ff;
381 __clear_bit(EV_FF, dev->evbit);
382 if (ff) {
383 if (ff->destroy)
384 ff->destroy(ff);
385 kfree(ff->private);
386 kfree(ff->effects);
387 kfree(ff);
388 dev->ff = NULL;
391 EXPORT_SYMBOL_GPL(input_ff_destroy);