bridge: fix a possible use after free
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / drivers / input / joystick / warrior.c
blobf72c83e15e6020ddfa288558011ef8918efaa3d3
1 /*
2 * Copyright (c) 1999-2001 Vojtech Pavlik
3 */
5 /*
6 * Logitech WingMan Warrior joystick driver for Linux
7 */
9 /*
10 * This program is free warftware; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
24 * Should you need to contact me, the author, you can do so either by
25 * e-mail - mail your message to <vojtech@ucw.cz>, or by paper mail:
26 * Vojtech Pavlik, Simunkova 1594, Prague 8, 182 00 Czech Republic
29 #include <linux/kernel.h>
30 #include <linux/module.h>
31 #include <linux/slab.h>
32 #include <linux/input.h>
33 #include <linux/serio.h>
34 #include <linux/init.h>
36 #define DRIVER_DESC "Logitech WingMan Warrior joystick driver"
38 MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
39 MODULE_DESCRIPTION(DRIVER_DESC);
40 MODULE_LICENSE("GPL");
43 * Constants.
46 #define WARRIOR_MAX_LENGTH 16
47 static char warrior_lengths[] = { 0, 4, 12, 3, 4, 4, 0, 0 };
50 * Per-Warrior data.
53 struct warrior {
54 struct input_dev *dev;
55 int idx, len;
56 unsigned char data[WARRIOR_MAX_LENGTH];
57 char phys[32];
61 * warrior_process_packet() decodes packets the driver receives from the
62 * Warrior. It updates the data accordingly.
65 static void warrior_process_packet(struct warrior *warrior)
67 struct input_dev *dev = warrior->dev;
68 unsigned char *data = warrior->data;
70 if (!warrior->idx) return;
72 switch ((data[0] >> 4) & 7) {
73 case 1: /* Button data */
74 input_report_key(dev, BTN_TRIGGER, data[3] & 1);
75 input_report_key(dev, BTN_THUMB, (data[3] >> 1) & 1);
76 input_report_key(dev, BTN_TOP, (data[3] >> 2) & 1);
77 input_report_key(dev, BTN_TOP2, (data[3] >> 3) & 1);
78 break;
79 case 3: /* XY-axis info->data */
80 input_report_abs(dev, ABS_X, ((data[0] & 8) << 5) - (data[2] | ((data[0] & 4) << 5)));
81 input_report_abs(dev, ABS_Y, (data[1] | ((data[0] & 1) << 7)) - ((data[0] & 2) << 7));
82 break;
83 case 5: /* Throttle, spinner, hat info->data */
84 input_report_abs(dev, ABS_THROTTLE, (data[1] | ((data[0] & 1) << 7)) - ((data[0] & 2) << 7));
85 input_report_abs(dev, ABS_HAT0X, (data[3] & 2 ? 1 : 0) - (data[3] & 1 ? 1 : 0));
86 input_report_abs(dev, ABS_HAT0Y, (data[3] & 8 ? 1 : 0) - (data[3] & 4 ? 1 : 0));
87 input_report_rel(dev, REL_DIAL, (data[2] | ((data[0] & 4) << 5)) - ((data[0] & 8) << 5));
88 break;
90 input_sync(dev);
94 * warrior_interrupt() is called by the low level driver when characters
95 * are ready for us. We then buffer them for further processing, or call the
96 * packet processing routine.
99 static irqreturn_t warrior_interrupt(struct serio *serio,
100 unsigned char data, unsigned int flags)
102 struct warrior *warrior = serio_get_drvdata(serio);
104 if (data & 0x80) {
105 if (warrior->idx) warrior_process_packet(warrior);
106 warrior->idx = 0;
107 warrior->len = warrior_lengths[(data >> 4) & 7];
110 if (warrior->idx < warrior->len)
111 warrior->data[warrior->idx++] = data;
113 if (warrior->idx == warrior->len) {
114 if (warrior->idx) warrior_process_packet(warrior);
115 warrior->idx = 0;
116 warrior->len = 0;
118 return IRQ_HANDLED;
122 * warrior_disconnect() is the opposite of warrior_connect()
125 static void warrior_disconnect(struct serio *serio)
127 struct warrior *warrior = serio_get_drvdata(serio);
129 serio_close(serio);
130 serio_set_drvdata(serio, NULL);
131 input_unregister_device(warrior->dev);
132 kfree(warrior);
136 * warrior_connect() is the routine that is called when someone adds a
137 * new serio device. It looks for the Warrior, and if found, registers
138 * it as an input device.
141 static int warrior_connect(struct serio *serio, struct serio_driver *drv)
143 struct warrior *warrior;
144 struct input_dev *input_dev;
145 int err = -ENOMEM;
147 warrior = kzalloc(sizeof(struct warrior), GFP_KERNEL);
148 input_dev = input_allocate_device();
149 if (!warrior || !input_dev)
150 goto fail1;
152 warrior->dev = input_dev;
153 snprintf(warrior->phys, sizeof(warrior->phys), "%s/input0", serio->phys);
155 input_dev->name = "Logitech WingMan Warrior";
156 input_dev->phys = warrior->phys;
157 input_dev->id.bustype = BUS_RS232;
158 input_dev->id.vendor = SERIO_WARRIOR;
159 input_dev->id.product = 0x0001;
160 input_dev->id.version = 0x0100;
161 input_dev->dev.parent = &serio->dev;
163 input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL) |
164 BIT_MASK(EV_ABS);
165 input_dev->keybit[BIT_WORD(BTN_TRIGGER)] = BIT_MASK(BTN_TRIGGER) |
166 BIT_MASK(BTN_THUMB) | BIT_MASK(BTN_TOP) | BIT_MASK(BTN_TOP2);
167 input_dev->relbit[0] = BIT_MASK(REL_DIAL);
168 input_set_abs_params(input_dev, ABS_X, -64, 64, 0, 8);
169 input_set_abs_params(input_dev, ABS_Y, -64, 64, 0, 8);
170 input_set_abs_params(input_dev, ABS_THROTTLE, -112, 112, 0, 0);
171 input_set_abs_params(input_dev, ABS_HAT0X, -1, 1, 0, 0);
172 input_set_abs_params(input_dev, ABS_HAT0Y, -1, 1, 0, 0);
174 serio_set_drvdata(serio, warrior);
176 err = serio_open(serio, drv);
177 if (err)
178 goto fail2;
180 err = input_register_device(warrior->dev);
181 if (err)
182 goto fail3;
184 return 0;
186 fail3: serio_close(serio);
187 fail2: serio_set_drvdata(serio, NULL);
188 fail1: input_free_device(input_dev);
189 kfree(warrior);
190 return err;
194 * The serio driver structure.
197 static struct serio_device_id warrior_serio_ids[] = {
199 .type = SERIO_RS232,
200 .proto = SERIO_WARRIOR,
201 .id = SERIO_ANY,
202 .extra = SERIO_ANY,
204 { 0 }
207 MODULE_DEVICE_TABLE(serio, warrior_serio_ids);
209 static struct serio_driver warrior_drv = {
210 .driver = {
211 .name = "warrior",
213 .description = DRIVER_DESC,
214 .id_table = warrior_serio_ids,
215 .interrupt = warrior_interrupt,
216 .connect = warrior_connect,
217 .disconnect = warrior_disconnect,
221 * The functions for inserting/removing us as a module.
224 static int __init warrior_init(void)
226 return serio_register_driver(&warrior_drv);
229 static void __exit warrior_exit(void)
231 serio_unregister_driver(&warrior_drv);
234 module_init(warrior_init);
235 module_exit(warrior_exit);