Commit 8006479c9b75fb6594a7b746af3d7f1fbb68f18f

Authored by Dmitry Torokhov
1 parent 501cc54c4d

Input: implement proper locking in input core

Also add some kerneldoc documentation to input.h

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Showing 2 changed files with 595 additions and 183 deletions Side-by-side Diff

drivers/input/input.c
Changes suppressed. Click to show
... ... @@ -17,10 +17,10 @@
17 17 #include <linux/major.h>
18 18 #include <linux/proc_fs.h>
19 19 #include <linux/seq_file.h>
20   -#include <linux/interrupt.h>
21 20 #include <linux/poll.h>
22 21 #include <linux/device.h>
23 22 #include <linux/mutex.h>
  23 +#include <linux/rcupdate.h>
24 24  
25 25 MODULE_AUTHOR("Vojtech Pavlik <vojtech@suse.cz>");
26 26 MODULE_DESCRIPTION("Input core");
27 27  
28 28  
29 29  
30 30  
31 31  
32 32  
33 33  
34 34  
35 35  
36 36  
37 37  
38 38  
39 39  
40 40  
41 41  
42 42  
43 43  
44 44  
45 45  
46 46  
47 47  
48 48  
49 49  
50 50  
51 51  
52 52  
53 53  
54 54  
55 55  
56 56  
57 57  
58 58  
59 59  
60 60  
61 61  
62 62  
63 63  
64 64  
65 65  
66 66  
67 67  
68 68  
69 69  
70 70  
71 71  
72 72  
73 73  
74 74  
75 75  
... ... @@ -31,167 +31,244 @@
31 31 static LIST_HEAD(input_dev_list);
32 32 static LIST_HEAD(input_handler_list);
33 33  
  34 +/*
  35 + * input_mutex protects access to both input_dev_list and input_handler_list.
  36 + * This also causes input_[un]register_device and input_[un]register_handler
  37 + * be mutually exclusive which simplifies locking in drivers implementing
  38 + * input handlers.
  39 + */
  40 +static DEFINE_MUTEX(input_mutex);
  41 +
34 42 static struct input_handler *input_table[8];
35 43  
36   -/**
37   - * input_event() - report new input event
38   - * @dev: device that generated the event
39   - * @type: type of the event
40   - * @code: event code
41   - * @value: value of the event
42   - *
43   - * This function should be used by drivers implementing various input devices
44   - * See also input_inject_event()
45   - */
46   -void input_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
  44 +static inline int is_event_supported(unsigned int code,
  45 + unsigned long *bm, unsigned int max)
47 46 {
48   - struct input_handle *handle;
  47 + return code <= max && test_bit(code, bm);
  48 +}
49 49  
50   - if (type > EV_MAX || !test_bit(type, dev->evbit))
51   - return;
  50 +static int input_defuzz_abs_event(int value, int old_val, int fuzz)
  51 +{
  52 + if (fuzz) {
  53 + if (value > old_val - fuzz / 2 && value < old_val + fuzz / 2)
  54 + return old_val;
52 55  
53   - add_input_randomness(type, code, value);
  56 + if (value > old_val - fuzz && value < old_val + fuzz)
  57 + return (old_val * 3 + value) / 4;
54 58  
55   - switch (type) {
  59 + if (value > old_val - fuzz * 2 && value < old_val + fuzz * 2)
  60 + return (old_val + value) / 2;
  61 + }
56 62  
57   - case EV_SYN:
58   - switch (code) {
59   - case SYN_CONFIG:
60   - if (dev->event)
61   - dev->event(dev, type, code, value);
62   - break;
  63 + return value;
  64 +}
63 65  
64   - case SYN_REPORT:
65   - if (dev->sync)
66   - return;
67   - dev->sync = 1;
68   - break;
69   - }
70   - break;
  66 +/*
  67 + * Pass event through all open handles. This function is called with
  68 + * dev->event_lock held and interrupts disabled. Because of that we
  69 + * do not need to use rcu_read_lock() here although we are using RCU
  70 + * to access handle list. Note that because of that write-side uses
  71 + * synchronize_sched() instead of synchronize_ru().
  72 + */
  73 +static void input_pass_event(struct input_dev *dev,
  74 + unsigned int type, unsigned int code, int value)
  75 +{
  76 + struct input_handle *handle = rcu_dereference(dev->grab);
71 77  
72   - case EV_KEY:
  78 + if (handle)
  79 + handle->handler->event(handle, type, code, value);
  80 + else
  81 + list_for_each_entry_rcu(handle, &dev->h_list, d_node)
  82 + if (handle->open)
  83 + handle->handler->event(handle,
  84 + type, code, value);
  85 +}
73 86  
74   - if (code > KEY_MAX || !test_bit(code, dev->keybit) || !!test_bit(code, dev->key) == value)
75   - return;
  87 +/*
  88 + * Generate software autorepeat event. Note that we take
  89 + * dev->event_lock here to avoid racing with input_event
  90 + * which may cause keys get "stuck".
  91 + */
  92 +static void input_repeat_key(unsigned long data)
  93 +{
  94 + struct input_dev *dev = (void *) data;
  95 + unsigned long flags;
76 96  
77   - if (value == 2)
78   - break;
  97 + spin_lock_irqsave(&dev->event_lock, flags);
79 98  
80   - change_bit(code, dev->key);
  99 + if (test_bit(dev->repeat_key, dev->key) &&
  100 + is_event_supported(dev->repeat_key, dev->keybit, KEY_MAX)) {
81 101  
82   - if (test_bit(EV_REP, dev->evbit) && dev->rep[REP_PERIOD] && dev->rep[REP_DELAY] && dev->timer.data && value) {
83   - dev->repeat_key = code;
84   - mod_timer(&dev->timer, jiffies + msecs_to_jiffies(dev->rep[REP_DELAY]));
85   - }
  102 + input_pass_event(dev, EV_KEY, dev->repeat_key, 2);
86 103  
87   - break;
  104 + if (dev->sync) {
  105 + /*
  106 + * Only send SYN_REPORT if we are not in a middle
  107 + * of driver parsing a new hardware packet.
  108 + * Otherwise assume that the driver will send
  109 + * SYN_REPORT once it's done.
  110 + */
  111 + input_pass_event(dev, EV_SYN, SYN_REPORT, 1);
  112 + }
88 113  
89   - case EV_SW:
  114 + if (dev->rep[REP_PERIOD])
  115 + mod_timer(&dev->timer, jiffies +
  116 + msecs_to_jiffies(dev->rep[REP_PERIOD]));
  117 + }
90 118  
91   - if (code > SW_MAX || !test_bit(code, dev->swbit) || !!test_bit(code, dev->sw) == value)
92   - return;
  119 + spin_unlock_irqrestore(&dev->event_lock, flags);
  120 +}
93 121  
94   - change_bit(code, dev->sw);
  122 +static void input_start_autorepeat(struct input_dev *dev, int code)
  123 +{
  124 + if (test_bit(EV_REP, dev->evbit) &&
  125 + dev->rep[REP_PERIOD] && dev->rep[REP_DELAY] &&
  126 + dev->timer.data) {
  127 + dev->repeat_key = code;
  128 + mod_timer(&dev->timer,
  129 + jiffies + msecs_to_jiffies(dev->rep[REP_DELAY]));
  130 + }
  131 +}
95 132  
96   - break;
  133 +#define INPUT_IGNORE_EVENT 0
  134 +#define INPUT_PASS_TO_HANDLERS 1
  135 +#define INPUT_PASS_TO_DEVICE 2
  136 +#define INPUT_PASS_TO_ALL (INPUT_PASS_TO_HANDLERS | INPUT_PASS_TO_DEVICE)
97 137  
98   - case EV_ABS:
  138 +static void input_handle_event(struct input_dev *dev,
  139 + unsigned int type, unsigned int code, int value)
  140 +{
  141 + int disposition = INPUT_IGNORE_EVENT;
99 142  
100   - if (code > ABS_MAX || !test_bit(code, dev->absbit))
101   - return;
  143 + switch (type) {
102 144  
103   - if (dev->absfuzz[code]) {
104   - if ((value > dev->abs[code] - (dev->absfuzz[code] >> 1)) &&
105   - (value < dev->abs[code] + (dev->absfuzz[code] >> 1)))
106   - return;
  145 + case EV_SYN:
  146 + switch (code) {
  147 + case SYN_CONFIG:
  148 + disposition = INPUT_PASS_TO_ALL;
  149 + break;
107 150  
108   - if ((value > dev->abs[code] - dev->absfuzz[code]) &&
109   - (value < dev->abs[code] + dev->absfuzz[code]))
110   - value = (dev->abs[code] * 3 + value) >> 2;
111   -
112   - if ((value > dev->abs[code] - (dev->absfuzz[code] << 1)) &&
113   - (value < dev->abs[code] + (dev->absfuzz[code] << 1)))
114   - value = (dev->abs[code] + value) >> 1;
  151 + case SYN_REPORT:
  152 + if (!dev->sync) {
  153 + dev->sync = 1;
  154 + disposition = INPUT_PASS_TO_HANDLERS;
115 155 }
116   -
117   - if (dev->abs[code] == value)
118   - return;
119   -
120   - dev->abs[code] = value;
121 156 break;
  157 + }
  158 + break;
122 159  
123   - case EV_REL:
  160 + case EV_KEY:
  161 + if (is_event_supported(code, dev->keybit, KEY_MAX) &&
  162 + !!test_bit(code, dev->key) != value) {
124 163  
125   - if (code > REL_MAX || !test_bit(code, dev->relbit) || (value == 0))
126   - return;
  164 + if (value != 2) {
  165 + __change_bit(code, dev->key);
  166 + if (value)
  167 + input_start_autorepeat(dev, code);
  168 + }
127 169  
128   - break;
  170 + disposition = INPUT_PASS_TO_HANDLERS;
  171 + }
  172 + break;
129 173  
130   - case EV_MSC:
  174 + case EV_SW:
  175 + if (is_event_supported(code, dev->swbit, SW_MAX) &&
  176 + !!test_bit(code, dev->sw) != value) {
131 177  
132   - if (code > MSC_MAX || !test_bit(code, dev->mscbit))
133   - return;
  178 + __change_bit(code, dev->sw);
  179 + disposition = INPUT_PASS_TO_HANDLERS;
  180 + }
  181 + break;
134 182  
135   - if (dev->event)
136   - dev->event(dev, type, code, value);
  183 + case EV_ABS:
  184 + if (is_event_supported(code, dev->absbit, ABS_MAX)) {
137 185  
138   - break;
  186 + value = input_defuzz_abs_event(value,
  187 + dev->abs[code], dev->absfuzz[code]);
139 188  
140   - case EV_LED:
  189 + if (dev->abs[code] != value) {
  190 + dev->abs[code] = value;
  191 + disposition = INPUT_PASS_TO_HANDLERS;
  192 + }
  193 + }
  194 + break;
141 195  
142   - if (code > LED_MAX || !test_bit(code, dev->ledbit) || !!test_bit(code, dev->led) == value)
143   - return;
  196 + case EV_REL:
  197 + if (is_event_supported(code, dev->relbit, REL_MAX) && value)
  198 + disposition = INPUT_PASS_TO_HANDLERS;
144 199  
145   - change_bit(code, dev->led);
  200 + break;
146 201  
147   - if (dev->event)
148   - dev->event(dev, type, code, value);
  202 + case EV_MSC:
  203 + if (is_event_supported(code, dev->mscbit, MSC_MAX))
  204 + disposition = INPUT_PASS_TO_ALL;
149 205  
150   - break;
  206 + break;
151 207  
152   - case EV_SND:
  208 + case EV_LED:
  209 + if (is_event_supported(code, dev->ledbit, LED_MAX) &&
  210 + !!test_bit(code, dev->led) != value) {
153 211  
154   - if (code > SND_MAX || !test_bit(code, dev->sndbit))
155   - return;
  212 + __change_bit(code, dev->led);
  213 + disposition = INPUT_PASS_TO_ALL;
  214 + }
  215 + break;
156 216  
  217 + case EV_SND:
  218 + if (is_event_supported(code, dev->sndbit, SND_MAX)) {
  219 +
157 220 if (!!test_bit(code, dev->snd) != !!value)
158   - change_bit(code, dev->snd);
  221 + __change_bit(code, dev->snd);
  222 + disposition = INPUT_PASS_TO_ALL;
  223 + }
  224 + break;
159 225  
160   - if (dev->event)
161   - dev->event(dev, type, code, value);
  226 + case EV_REP:
  227 + if (code <= REP_MAX && value >= 0 && dev->rep[code] != value) {
  228 + dev->rep[code] = value;
  229 + disposition = INPUT_PASS_TO_ALL;
  230 + }
  231 + break;
162 232  
163   - break;
  233 + case EV_FF:
  234 + if (value >= 0)
  235 + disposition = INPUT_PASS_TO_ALL;
  236 + break;
  237 + }
164 238  
165   - case EV_REP:
  239 + if (type != EV_SYN)
  240 + dev->sync = 0;
166 241  
167   - if (code > REP_MAX || value < 0 || dev->rep[code] == value)
168   - return;
  242 + if ((disposition & INPUT_PASS_TO_DEVICE) && dev->event)
  243 + dev->event(dev, type, code, value);
169 244  
170   - dev->rep[code] = value;
171   - if (dev->event)
172   - dev->event(dev, type, code, value);
  245 + if (disposition & INPUT_PASS_TO_HANDLERS)
  246 + input_pass_event(dev, type, code, value);
  247 +}
173 248  
174   - break;
  249 +/**
  250 + * input_event() - report new input event
  251 + * @dev: device that generated the event
  252 + * @type: type of the event
  253 + * @code: event code
  254 + * @value: value of the event
  255 + *
  256 + * This function should be used by drivers implementing various input
  257 + * devices. See also input_inject_event().
  258 + */
175 259  
176   - case EV_FF:
  260 +void input_event(struct input_dev *dev,
  261 + unsigned int type, unsigned int code, int value)
  262 +{
  263 + unsigned long flags;
177 264  
178   - if (value < 0)
179   - return;
  265 + if (is_event_supported(type, dev->evbit, EV_MAX)) {
180 266  
181   - if (dev->event)
182   - dev->event(dev, type, code, value);
183   - break;
  267 + spin_lock_irqsave(&dev->event_lock, flags);
  268 + add_input_randomness(type, code, value);
  269 + input_handle_event(dev, type, code, value);
  270 + spin_unlock_irqrestore(&dev->event_lock, flags);
184 271 }
185   -
186   - if (type != EV_SYN)
187   - dev->sync = 0;
188   -
189   - if (dev->grab)
190   - dev->grab->handler->event(dev->grab, type, code, value);
191   - else
192   - list_for_each_entry(handle, &dev->h_list, d_node)
193   - if (handle->open)
194   - handle->handler->event(handle, type, code, value);
195 272 }
196 273 EXPORT_SYMBOL(input_event);
197 274  
198 275  
199 276  
200 277  
201 278  
202 279  
203 280  
204 281  
205 282  
206 283  
207 284  
208 285  
209 286  
210 287  
211 288  
212 289  
213 290  
214 291  
215 292  
216 293  
217 294  
218 295  
219 296  
220 297  
221 298  
222 299  
223 300  
224 301  
225 302  
226 303  
227 304  
... ... @@ -202,102 +279,230 @@
202 279 * @code: event code
203 280 * @value: value of the event
204 281 *
205   - * Similar to input_event() but will ignore event if device is "grabbed" and handle
206   - * injecting event is not the one that owns the device.
  282 + * Similar to input_event() but will ignore event if device is
  283 + * "grabbed" and handle injecting event is not the one that owns
  284 + * the device.
207 285 */
208   -void input_inject_event(struct input_handle *handle, unsigned int type, unsigned int code, int value)
  286 +void input_inject_event(struct input_handle *handle,
  287 + unsigned int type, unsigned int code, int value)
209 288 {
210   - if (!handle->dev->grab || handle->dev->grab == handle)
211   - input_event(handle->dev, type, code, value);
212   -}
213   -EXPORT_SYMBOL(input_inject_event);
  289 + struct input_dev *dev = handle->dev;
  290 + struct input_handle *grab;
  291 + unsigned long flags;
214 292  
215   -static void input_repeat_key(unsigned long data)
216   -{
217   - struct input_dev *dev = (void *) data;
  293 + if (is_event_supported(type, dev->evbit, EV_MAX)) {
  294 + spin_lock_irqsave(&dev->event_lock, flags);
218 295  
219   - if (!test_bit(dev->repeat_key, dev->key))
220   - return;
  296 + grab = rcu_dereference(dev->grab);
  297 + if (!grab || grab == handle)
  298 + input_handle_event(dev, type, code, value);
221 299  
222   - input_event(dev, EV_KEY, dev->repeat_key, 2);
223   - input_sync(dev);
224   -
225   - if (dev->rep[REP_PERIOD])
226   - mod_timer(&dev->timer, jiffies + msecs_to_jiffies(dev->rep[REP_PERIOD]));
  300 + spin_unlock_irqrestore(&dev->event_lock, flags);
  301 + }
227 302 }
  303 +EXPORT_SYMBOL(input_inject_event);
228 304  
  305 +/**
  306 + * input_grab_device - grabs device for exclusive use
  307 + * @handle: input handle that wants to own the device
  308 + *
  309 + * When a device is grabbed by an input handle all events generated by
  310 + * the device are delivered only to this handle. Also events injected
  311 + * by other input handles are ignored while device is grabbed.
  312 + */
229 313 int input_grab_device(struct input_handle *handle)
230 314 {
231   - if (handle->dev->grab)
232   - return -EBUSY;
  315 + struct input_dev *dev = handle->dev;
  316 + int retval;
233 317  
234   - handle->dev->grab = handle;
235   - return 0;
  318 + retval = mutex_lock_interruptible(&dev->mutex);
  319 + if (retval)
  320 + return retval;
  321 +
  322 + if (dev->grab) {
  323 + retval = -EBUSY;
  324 + goto out;
  325 + }
  326 +
  327 + rcu_assign_pointer(dev->grab, handle);
  328 + /*
  329 + * Not using synchronize_rcu() because read-side is protected
  330 + * by a spinlock with interrupts off instead of rcu_read_lock().
  331 + */
  332 + synchronize_sched();
  333 +
  334 + out:
  335 + mutex_unlock(&dev->mutex);
  336 + return retval;
236 337 }
237 338 EXPORT_SYMBOL(input_grab_device);
238 339  
239   -void input_release_device(struct input_handle *handle)
  340 +static void __input_release_device(struct input_handle *handle)
240 341 {
241 342 struct input_dev *dev = handle->dev;
242 343  
243 344 if (dev->grab == handle) {
244   - dev->grab = NULL;
  345 + rcu_assign_pointer(dev->grab, NULL);
  346 + /* Make sure input_pass_event() notices that grab is gone */
  347 + synchronize_sched();
245 348  
246 349 list_for_each_entry(handle, &dev->h_list, d_node)
247   - if (handle->handler->start)
  350 + if (handle->open && handle->handler->start)
248 351 handle->handler->start(handle);
249 352 }
250 353 }
  354 +
  355 +/**
  356 + * input_release_device - release previously grabbed device
  357 + * @handle: input handle that owns the device
  358 + *
  359 + * Releases previously grabbed device so that other input handles can
  360 + * start receiving input events. Upon release all handlers attached
  361 + * to the device have their start() method called so they have a change
  362 + * to synchronize device state with the rest of the system.
  363 + */
  364 +void input_release_device(struct input_handle *handle)
  365 +{
  366 + struct input_dev *dev = handle->dev;
  367 +
  368 + mutex_lock(&dev->mutex);
  369 + __input_release_device(handle);
  370 + mutex_unlock(&dev->mutex);
  371 +}
251 372 EXPORT_SYMBOL(input_release_device);
252 373  
  374 +/**
  375 + * input_open_device - open input device
  376 + * @handle: handle through which device is being accessed
  377 + *
  378 + * This function should be called by input handlers when they
  379 + * want to start receive events from given input device.
  380 + */
253 381 int input_open_device(struct input_handle *handle)
254 382 {
255 383 struct input_dev *dev = handle->dev;
256   - int err;
  384 + int retval;
257 385  
258   - err = mutex_lock_interruptible(&dev->mutex);
259   - if (err)
260   - return err;
  386 + retval = mutex_lock_interruptible(&dev->mutex);
  387 + if (retval)
  388 + return retval;
261 389  
  390 + if (dev->going_away) {
  391 + retval = -ENODEV;
  392 + goto out;
  393 + }
  394 +
262 395 handle->open++;
263 396  
264 397 if (!dev->users++ && dev->open)
265   - err = dev->open(dev);
  398 + retval = dev->open(dev);
266 399  
267   - if (err)
268   - handle->open--;
  400 + if (retval) {
  401 + dev->users--;
  402 + if (!--handle->open) {
  403 + /*
  404 + * Make sure we are not delivering any more events
  405 + * through this handle
  406 + */
  407 + synchronize_sched();
  408 + }
  409 + }
269 410  
  411 + out:
270 412 mutex_unlock(&dev->mutex);
271   -
272   - return err;
  413 + return retval;
273 414 }
274 415 EXPORT_SYMBOL(input_open_device);
275 416  
276   -int input_flush_device(struct input_handle* handle, struct file* file)
  417 +int input_flush_device(struct input_handle *handle, struct file *file)
277 418 {
278   - if (handle->dev->flush)
279   - return handle->dev->flush(handle->dev, file);
  419 + struct input_dev *dev = handle->dev;
  420 + int retval;
280 421  
281   - return 0;
  422 + retval = mutex_lock_interruptible(&dev->mutex);
  423 + if (retval)
  424 + return retval;
  425 +
  426 + if (dev->flush)
  427 + retval = dev->flush(dev, file);
  428 +
  429 + mutex_unlock(&dev->mutex);
  430 + return retval;
282 431 }
283 432 EXPORT_SYMBOL(input_flush_device);
284 433  
  434 +/**
  435 + * input_close_device - close input device
  436 + * @handle: handle through which device is being accessed
  437 + *
  438 + * This function should be called by input handlers when they
  439 + * want to stop receive events from given input device.
  440 + */
285 441 void input_close_device(struct input_handle *handle)
286 442 {
287 443 struct input_dev *dev = handle->dev;
288 444  
289   - input_release_device(handle);
290   -
291 445 mutex_lock(&dev->mutex);
292 446  
  447 + __input_release_device(handle);
  448 +
293 449 if (!--dev->users && dev->close)
294 450 dev->close(dev);
295   - handle->open--;
296 451  
  452 + if (!--handle->open) {
  453 + /*
  454 + * synchronize_sched() makes sure that input_pass_event()
  455 + * completed and that no more input events are delivered
  456 + * through this handle
  457 + */
  458 + synchronize_sched();
  459 + }
  460 +
297 461 mutex_unlock(&dev->mutex);
298 462 }
299 463 EXPORT_SYMBOL(input_close_device);
300 464  
  465 +/*
  466 + * Prepare device for unregistering
  467 + */
  468 +static void input_disconnect_device(struct input_dev *dev)
  469 +{
  470 + struct input_handle *handle;
  471 + int code;
  472 +
  473 + /*
  474 + * Mark device as going away. Note that we take dev->mutex here
  475 + * not to protect access to dev->going_away but rather to ensure
  476 + * that there are no threads in the middle of input_open_device()
  477 + */
  478 + mutex_lock(&dev->mutex);
  479 + dev->going_away = 1;
  480 + mutex_unlock(&dev->mutex);
  481 +
  482 + spin_lock_irq(&dev->event_lock);
  483 +
  484 + /*
  485 + * Simulate keyup events for all pressed keys so that handlers
  486 + * are not left with "stuck" keys. The driver may continue
  487 + * generate events even after we done here but they will not
  488 + * reach any handlers.
  489 + */
  490 + if (is_event_supported(EV_KEY, dev->evbit, EV_MAX)) {
  491 + for (code = 0; code <= KEY_MAX; code++) {
  492 + if (is_event_supported(code, dev->keybit, KEY_MAX) &&
  493 + test_bit(code, dev->key)) {
  494 + input_pass_event(dev, EV_KEY, code, 0);
  495 + }
  496 + }
  497 + input_pass_event(dev, EV_SYN, SYN_REPORT, 1);
  498 + }
  499 +
  500 + list_for_each_entry(handle, &dev->h_list, d_node)
  501 + handle->open = 0;
  502 +
  503 + spin_unlock_irq(&dev->event_lock);
  504 +}
  505 +
301 506 static int input_fetch_keycode(struct input_dev *dev, int scancode)
302 507 {
303 508 switch (dev->keycodesize) {
... ... @@ -473,7 +678,8 @@
473 678  
474 679 static void *input_devices_seq_start(struct seq_file *seq, loff_t *pos)
475 680 {
476   - /* acquire lock here ... Yes, we do need locking, I knowi, I know... */
  681 + if (mutex_lock_interruptible(&input_mutex))
  682 + return NULL;
477 683  
478 684 return seq_list_start(&input_dev_list, *pos);
479 685 }
... ... @@ -485,7 +691,7 @@
485 691  
486 692 static void input_devices_seq_stop(struct seq_file *seq, void *v)
487 693 {
488   - /* release lock here */
  694 + mutex_unlock(&input_mutex);
489 695 }
490 696  
491 697 static void input_seq_print_bitmap(struct seq_file *seq, const char *name,
... ... @@ -569,7 +775,9 @@
569 775  
570 776 static void *input_handlers_seq_start(struct seq_file *seq, loff_t *pos)
571 777 {
572   - /* acquire lock here ... Yes, we do need locking, I knowi, I know... */
  778 + if (mutex_lock_interruptible(&input_mutex))
  779 + return NULL;
  780 +
573 781 seq->private = (void *)(unsigned long)*pos;
574 782 return seq_list_start(&input_handler_list, *pos);
575 783 }
... ... @@ -582,7 +790,7 @@
582 790  
583 791 static void input_handlers_seq_stop(struct seq_file *seq, void *v)
584 792 {
585   - /* release lock here */
  793 + mutex_unlock(&input_mutex);
586 794 }
587 795  
588 796 static int input_handlers_seq_show(struct seq_file *seq, void *v)
... ... @@ -1005,6 +1213,7 @@
1005 1213 dev->dev.class = &input_class;
1006 1214 device_initialize(&dev->dev);
1007 1215 mutex_init(&dev->mutex);
  1216 + spin_lock_init(&dev->event_lock);
1008 1217 INIT_LIST_HEAD(&dev->h_list);
1009 1218 INIT_LIST_HEAD(&dev->node);
1010 1219  
... ... @@ -1022,7 +1231,7 @@
1022 1231 * This function should only be used if input_register_device()
1023 1232 * was not called yet or if it failed. Once device was registered
1024 1233 * use input_unregister_device() and memory will be freed once last
1025   - * refrence to the device is dropped.
  1234 + * reference to the device is dropped.
1026 1235 *
1027 1236 * Device should be allocated by input_allocate_device().
1028 1237 *
... ... @@ -1092,6 +1301,18 @@
1092 1301 }
1093 1302 EXPORT_SYMBOL(input_set_capability);
1094 1303  
  1304 +/**
  1305 + * input_register_device - register device with input core
  1306 + * @dev: device to be registered
  1307 + *
  1308 + * This function registers device with input core. The device must be
  1309 + * allocated with input_allocate_device() and all it's capabilities
  1310 + * set up before registering.
  1311 + * If function fails the device must be freed with input_free_device().
  1312 + * Once device has been successfully registered it can be unregistered
  1313 + * with input_unregister_device(); input_free_device() should not be
  1314 + * called in this case.
  1315 + */
1095 1316 int input_register_device(struct input_dev *dev)
1096 1317 {
1097 1318 static atomic_t input_no = ATOMIC_INIT(0);
... ... @@ -1099,7 +1320,7 @@
1099 1320 const char *path;
1100 1321 int error;
1101 1322  
1102   - set_bit(EV_SYN, dev->evbit);
  1323 + __set_bit(EV_SYN, dev->evbit);
1103 1324  
1104 1325 /*
1105 1326 * If delay and period are pre-set by the driver, then autorepeating
... ... @@ -1120,8 +1341,6 @@
1120 1341 if (!dev->setkeycode)
1121 1342 dev->setkeycode = input_default_setkeycode;
1122 1343  
1123   - list_add_tail(&dev->node, &input_dev_list);
1124   -
1125 1344 snprintf(dev->dev.bus_id, sizeof(dev->dev.bus_id),
1126 1345 "input%ld", (unsigned long) atomic_inc_return(&input_no) - 1);
1127 1346  
1128 1347  
1129 1348  
1130 1349  
1131 1350  
1132 1351  
1133 1352  
1134 1353  
1135 1354  
1136 1355  
1137 1356  
1138 1357  
1139 1358  
... ... @@ -1137,49 +1356,79 @@
1137 1356 dev->name ? dev->name : "Unspecified device", path ? path : "N/A");
1138 1357 kfree(path);
1139 1358  
  1359 + error = mutex_lock_interruptible(&input_mutex);
  1360 + if (error) {
  1361 + device_del(&dev->dev);
  1362 + return error;
  1363 + }
  1364 +
  1365 + list_add_tail(&dev->node, &input_dev_list);
  1366 +
1140 1367 list_for_each_entry(handler, &input_handler_list, node)
1141 1368 input_attach_handler(dev, handler);
1142 1369  
1143 1370 input_wakeup_procfs_readers();
1144 1371  
  1372 + mutex_unlock(&input_mutex);
  1373 +
1145 1374 return 0;
1146 1375 }
1147 1376 EXPORT_SYMBOL(input_register_device);
1148 1377  
  1378 +/**
  1379 + * input_unregister_device - unregister previously registered device
  1380 + * @dev: device to be unregistered
  1381 + *
  1382 + * This function unregisters an input device. Once device is unregistered
  1383 + * the caller should not try to access it as it may get freed at any moment.
  1384 + */
1149 1385 void input_unregister_device(struct input_dev *dev)
1150 1386 {
1151 1387 struct input_handle *handle, *next;
1152   - int code;
1153 1388  
1154   - for (code = 0; code <= KEY_MAX; code++)
1155   - if (test_bit(code, dev->key))
1156   - input_report_key(dev, code, 0);
1157   - input_sync(dev);
  1389 + input_disconnect_device(dev);
1158 1390  
1159   - del_timer_sync(&dev->timer);
  1391 + mutex_lock(&input_mutex);
1160 1392  
1161 1393 list_for_each_entry_safe(handle, next, &dev->h_list, d_node)
1162 1394 handle->handler->disconnect(handle);
1163 1395 WARN_ON(!list_empty(&dev->h_list));
1164 1396  
  1397 + del_timer_sync(&dev->timer);
1165 1398 list_del_init(&dev->node);
1166 1399  
1167   - device_unregister(&dev->dev);
1168   -
1169 1400 input_wakeup_procfs_readers();
  1401 +
  1402 + mutex_unlock(&input_mutex);
  1403 +
  1404 + device_unregister(&dev->dev);
1170 1405 }
1171 1406 EXPORT_SYMBOL(input_unregister_device);
1172 1407  
  1408 +/**
  1409 + * input_register_handler - register a new input handler
  1410 + * @handler: handler to be registered
  1411 + *
  1412 + * This function registers a new input handler (interface) for input
  1413 + * devices in the system and attaches it to all input devices that
  1414 + * are compatible with the handler.
  1415 + */
1173 1416 int input_register_handler(struct input_handler *handler)
1174 1417 {
1175 1418 struct input_dev *dev;
  1419 + int retval;
1176 1420  
  1421 + retval = mutex_lock_interruptible(&input_mutex);
  1422 + if (retval)
  1423 + return retval;
  1424 +
1177 1425 INIT_LIST_HEAD(&handler->h_list);
1178 1426  
1179 1427 if (handler->fops != NULL) {
1180   - if (input_table[handler->minor >> 5])
1181   - return -EBUSY;
1182   -
  1428 + if (input_table[handler->minor >> 5]) {
  1429 + retval = -EBUSY;
  1430 + goto out;
  1431 + }
1183 1432 input_table[handler->minor >> 5] = handler;
1184 1433 }
1185 1434  
1186 1435  
1187 1436  
... ... @@ -1189,14 +1438,26 @@
1189 1438 input_attach_handler(dev, handler);
1190 1439  
1191 1440 input_wakeup_procfs_readers();
1192   - return 0;
  1441 +
  1442 + out:
  1443 + mutex_unlock(&input_mutex);
  1444 + return retval;
1193 1445 }
1194 1446 EXPORT_SYMBOL(input_register_handler);
1195 1447  
  1448 +/**
  1449 + * input_unregister_handler - unregisters an input handler
  1450 + * @handler: handler to be unregistered
  1451 + *
  1452 + * This function disconnects a handler from its input devices and
  1453 + * removes it from lists of known handlers.
  1454 + */
1196 1455 void input_unregister_handler(struct input_handler *handler)
1197 1456 {
1198 1457 struct input_handle *handle, *next;
1199 1458  
  1459 + mutex_lock(&input_mutex);
  1460 +
1200 1461 list_for_each_entry_safe(handle, next, &handler->h_list, h_node)
1201 1462 handler->disconnect(handle);
1202 1463 WARN_ON(!list_empty(&handler->h_list));
1203 1464  
1204 1465  
1205 1466  
... ... @@ -1207,14 +1468,50 @@
1207 1468 input_table[handler->minor >> 5] = NULL;
1208 1469  
1209 1470 input_wakeup_procfs_readers();
  1471 +
  1472 + mutex_unlock(&input_mutex);
1210 1473 }
1211 1474 EXPORT_SYMBOL(input_unregister_handler);
1212 1475  
  1476 +/**
  1477 + * input_register_handle - register a new input handle
  1478 + * @handle: handle to register
  1479 + *
  1480 + * This function puts a new input handle onto device's
  1481 + * and handler's lists so that events can flow through
  1482 + * it once it is opened using input_open_device().
  1483 + *
  1484 + * This function is supposed to be called from handler's
  1485 + * connect() method.
  1486 + */
1213 1487 int input_register_handle(struct input_handle *handle)
1214 1488 {
1215 1489 struct input_handler *handler = handle->handler;
  1490 + struct input_dev *dev = handle->dev;
  1491 + int error;
1216 1492  
1217   - list_add_tail(&handle->d_node, &handle->dev->h_list);
  1493 + /*
  1494 + * We take dev->mutex here to prevent race with
  1495 + * input_release_device().
  1496 + */
  1497 + error = mutex_lock_interruptible(&dev->mutex);
  1498 + if (error)
  1499 + return error;
  1500 + list_add_tail_rcu(&handle->d_node, &dev->h_list);
  1501 + mutex_unlock(&dev->mutex);
  1502 + /*
  1503 + * We don't use synchronize_rcu() here because we rely
  1504 + * on dev->event_lock to protect read-side critical
  1505 + * section in input_pass_event().
  1506 + */
  1507 + synchronize_sched();
  1508 +
  1509 + /*
  1510 + * Since we are supposed to be called from ->connect()
  1511 + * which is mutually exclusive with ->disconnect()
  1512 + * we can't be racing with input_unregister_handle()
  1513 + * and so separate lock is not needed here.
  1514 + */
1218 1515 list_add_tail(&handle->h_node, &handler->h_list);
1219 1516  
1220 1517 if (handler->start)
1221 1518  
1222 1519  
... ... @@ -1224,10 +1521,29 @@
1224 1521 }
1225 1522 EXPORT_SYMBOL(input_register_handle);
1226 1523  
  1524 +/**
  1525 + * input_unregister_handle - unregister an input handle
  1526 + * @handle: handle to unregister
  1527 + *
  1528 + * This function removes input handle from device's
  1529 + * and handler's lists.
  1530 + *
  1531 + * This function is supposed to be called from handler's
  1532 + * disconnect() method.
  1533 + */
1227 1534 void input_unregister_handle(struct input_handle *handle)
1228 1535 {
  1536 + struct input_dev *dev = handle->dev;
  1537 +
1229 1538 list_del_init(&handle->h_node);
1230   - list_del_init(&handle->d_node);
  1539 +
  1540 + /*
  1541 + * Take dev->mutex to prevent race with input_release_device().
  1542 + */
  1543 + mutex_lock(&dev->mutex);
  1544 + list_del_rcu(&handle->d_node);
  1545 + mutex_unlock(&dev->mutex);
  1546 + synchronize_sched();
1231 1547 }
1232 1548 EXPORT_SYMBOL(input_unregister_handle);
1233 1549  
include/linux/input.h
... ... @@ -845,7 +845,7 @@
845 845 * defining effect parameters
846 846 *
847 847 * This structure is sent through ioctl from the application to the driver.
848   - * To create a new effect aplication should set its @id to -1; the kernel
  848 + * To create a new effect application should set its @id to -1; the kernel
849 849 * will return assigned @id which can later be used to update or delete
850 850 * this effect.
851 851 *
852 852  
... ... @@ -925,9 +925,82 @@
925 925 #define BIT(x) (1UL<<((x)%BITS_PER_LONG))
926 926 #define LONG(x) ((x)/BITS_PER_LONG)
927 927  
  928 +/**
  929 + * struct input_dev - represents an input device
  930 + * @name: name of the device
  931 + * @phys: physical path to the device in the system hierarchy
  932 + * @uniq: unique identification code for the device (if device has it)
  933 + * @id: id of the device (struct input_id)
  934 + * @evbit: bitmap of types of events supported by the device (EV_KEY,
  935 + * EV_REL, etc.)
  936 + * @keybit: bitmap of keys/buttons this device has
  937 + * @relbit: bitmap of relative axes for the device
  938 + * @absbit: bitmap of absolute axes for the device
  939 + * @mscbit: bitmap of miscellaneous events supported by the device
  940 + * @ledbit: bitmap of leds present on the device
  941 + * @sndbit: bitmap of sound effects supported by the device
  942 + * @ffbit: bitmap of force feedback effects supported by the device
  943 + * @swbit: bitmap of switches present on the device
  944 + * @keycodemax: size of keycode table
  945 + * @keycodesize: size of elements in keycode table
  946 + * @keycode: map of scancodes to keycodes for this device
  947 + * @setkeycode: optional method to alter current keymap, used to implement
  948 + * sparse keymaps. If not supplied default mechanism will be used
  949 + * @getkeycode: optional method to retrieve current keymap. If not supplied
  950 + * default mechanism will be used
  951 + * @ff: force feedback structure associated with the device if device
  952 + * supports force feedback effects
  953 + * @repeat_key: stores key code of the last key pressed; used to implement
  954 + * software autorepeat
  955 + * @timer: timer for software autorepeat
  956 + * @sync: set to 1 when there were no new events since last EV_SYNC
  957 + * @abs: current values for reports from absolute axes
  958 + * @rep: current values for autorepeat parameters (delay, rate)
  959 + * @key: reflects current state of device's keys/buttons
  960 + * @led: reflects current state of device's LEDs
  961 + * @snd: reflects current state of sound effects
  962 + * @sw: reflects current state of device's switches
  963 + * @absmax: maximum values for events coming from absolute axes
  964 + * @absmin: minimum values for events coming from absolute axes
  965 + * @absfuzz: describes noisiness for axes
  966 + * @absflat: size of the center flat position (used by joydev)
  967 + * @open: this method is called when the very first user calls
  968 + * input_open_device(). The driver must prepare the device
  969 + * to start generating events (start polling thread,
  970 + * request an IRQ, submit URB, etc.)
  971 + * @close: this method is called when the very last user calls
  972 + * input_close_device().
  973 + * @flush: purges the device. Most commonly used to get rid of force
  974 + * feedback effects loaded into the device when disconnecting
  975 + * from it
  976 + * @event: event handler for events sent _to_ the device, like EV_LED
  977 + * or EV_SND. The device is expected to carry out the requested
  978 + * action (turn on a LED, play sound, etc.) The call is protected
  979 + * by @event_lock and must not sleep
  980 + * @grab: input handle that currently has the device grabbed (via
  981 + * EVIOCGRAB ioctl). When a handle grabs a device it becomes sole
  982 + * recipient for all input events coming from the device
  983 + * @event_lock: this spinlock is is taken when input core receives
  984 + * and processes a new event for the device (in input_event()).
  985 + * Code that accesses and/or modifies parameters of a device
  986 + * (such as keymap or absmin, absmax, absfuzz, etc.) after device
  987 + * has been registered with input core must take this lock.
  988 + * @mutex: serializes calls to open(), close() and flush() methods
  989 + * @users: stores number of users (input handlers) that opened this
  990 + * device. It is used by input_open_device() and input_close_device()
  991 + * to make sure that dev->open() is only called when the first
  992 + * user opens device and dev->close() is called when the very
  993 + * last user closes the device
  994 + * @going_away: marks devices that are in a middle of unregistering and
  995 + * causes input_open_device*() fail with -ENODEV.
  996 + * @dev: driver model's view of this device
  997 + * @h_list: list of input handles associated with the device. When
  998 + * accessing the list dev->mutex must be held
  999 + * @node: used to place the device onto input_dev_list
  1000 + */
928 1001 struct input_dev {
929 1002  
930   - void *private;
  1003 + void *private; /* do not use */
931 1004  
932 1005 const char *name;
933 1006 const char *phys;
... ... @@ -955,8 +1028,6 @@
955 1028 unsigned int repeat_key;
956 1029 struct timer_list timer;
957 1030  
958   - int state;
959   -
960 1031 int sync;
961 1032  
962 1033 int abs[ABS_MAX + 1];
963 1034  
... ... @@ -979,8 +1050,11 @@
979 1050  
980 1051 struct input_handle *grab;
981 1052  
982   - struct mutex mutex; /* serializes open and close operations */
  1053 + spinlock_t event_lock;
  1054 + struct mutex mutex;
  1055 +
983 1056 unsigned int users;
  1057 + int going_away;
984 1058  
985 1059 struct device dev;
986 1060 union { /* temporarily so while we switching to struct device */
... ... @@ -1046,7 +1120,9 @@
1046 1120 /**
1047 1121 * struct input_handler - implements one of interfaces for input devices
1048 1122 * @private: driver-specific data
1049   - * @event: event handler
  1123 + * @event: event handler. This method is being called by input core with
  1124 + * interrupts disabled and dev->event_lock spinlock held and so
  1125 + * it may not sleep
1050 1126 * @connect: called when attaching a handler to an input device
1051 1127 * @disconnect: disconnects a handler from input device
1052 1128 * @start: starts handler for given handle. This function is called by
1053 1129  
... ... @@ -1058,10 +1134,18 @@
1058 1134 * @name: name of the handler, to be shown in /proc/bus/input/handlers
1059 1135 * @id_table: pointer to a table of input_device_ids this driver can
1060 1136 * handle
1061   - * @blacklist: prointer to a table of input_device_ids this driver should
  1137 + * @blacklist: pointer to a table of input_device_ids this driver should
1062 1138 * ignore even if they match @id_table
1063 1139 * @h_list: list of input handles associated with the handler
1064 1140 * @node: for placing the driver onto input_handler_list
  1141 + *
  1142 + * Input handlers attach to input devices and create input handles. There
  1143 + * are likely several handlers attached to any given input device at the
  1144 + * same time. All of them will get their copy of input event generated by
  1145 + * the device.
  1146 + *
  1147 + * Note that input core serializes calls to connect() and disconnect()
  1148 + * methods.
1065 1149 */
1066 1150 struct input_handler {
1067 1151  
... ... @@ -1083,6 +1167,18 @@
1083 1167 struct list_head node;
1084 1168 };
1085 1169  
  1170 +/**
  1171 + * struct input_handle - links input device with an input handler
  1172 + * @private: handler-specific data
  1173 + * @open: counter showing whether the handle is 'open', i.e. should deliver
  1174 + * events from its device
  1175 + * @name: name given to the handle by handler that created it
  1176 + * @dev: input device the handle is attached to
  1177 + * @handler: handler that works with the device through this handle
  1178 + * @d_node: used to put the handle on device's list of attached handles
  1179 + * @h_node: used to put the handle on handler's list of handles from which
  1180 + * it gets events
  1181 + */
1086 1182 struct input_handle {
1087 1183  
1088 1184 void *private;
... ... @@ -1205,7 +1301,7 @@
1205 1301 * @max_effects: maximum number of effects supported by device
1206 1302 * @effects: pointer to an array of effects currently loaded into device
1207 1303 * @effect_owners: array of effect owners; when file handle owning
1208   - * an effect gets closed the effcet is automatically erased
  1304 + * an effect gets closed the effect is automatically erased
1209 1305 *
1210 1306 * Every force-feedback device must implement upload() and playback()
1211 1307 * methods; erase() is optional. set_gain() and set_autocenter() need