mic: vop: Fix use-after-free on remove
[linux/fpc-iii.git] / drivers / input / tablet / hanwang.c
blob4042c41160f4aaada9b7b04bef3e6c93465e6f12
1 /*
2 * USB Hanwang tablet support
4 * Copyright (c) 2010 Xing Wei <weixing@hanwang.com.cn>
6 */
8 /*
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
25 #include <linux/types.h>
26 #include <linux/kernel.h>
27 #include <linux/slab.h>
28 #include <linux/module.h>
29 #include <linux/usb/input.h>
31 MODULE_AUTHOR("Xing Wei <weixing@hanwang.com.cn>");
32 MODULE_DESCRIPTION("USB Hanwang tablet driver");
33 MODULE_LICENSE("GPL");
35 #define USB_VENDOR_ID_HANWANG 0x0b57
36 #define HANWANG_TABLET_INT_CLASS 0x0003
37 #define HANWANG_TABLET_INT_SUB_CLASS 0x0001
38 #define HANWANG_TABLET_INT_PROTOCOL 0x0002
40 #define ART_MASTER_PKGLEN_MAX 10
42 /* device IDs */
43 #define STYLUS_DEVICE_ID 0x02
44 #define TOUCH_DEVICE_ID 0x03
45 #define CURSOR_DEVICE_ID 0x06
46 #define ERASER_DEVICE_ID 0x0A
47 #define PAD_DEVICE_ID 0x0F
49 /* match vendor and interface info */
50 #define HANWANG_TABLET_DEVICE(vend, cl, sc, pr) \
51 .match_flags = USB_DEVICE_ID_MATCH_VENDOR \
52 | USB_DEVICE_ID_MATCH_INT_INFO, \
53 .idVendor = (vend), \
54 .bInterfaceClass = (cl), \
55 .bInterfaceSubClass = (sc), \
56 .bInterfaceProtocol = (pr)
58 enum hanwang_tablet_type {
59 HANWANG_ART_MASTER_III,
60 HANWANG_ART_MASTER_HD,
61 HANWANG_ART_MASTER_II,
64 struct hanwang {
65 unsigned char *data;
66 dma_addr_t data_dma;
67 struct input_dev *dev;
68 struct usb_device *usbdev;
69 struct urb *irq;
70 const struct hanwang_features *features;
71 unsigned int current_tool;
72 unsigned int current_id;
73 char name[64];
74 char phys[32];
77 struct hanwang_features {
78 unsigned short pid;
79 char *name;
80 enum hanwang_tablet_type type;
81 int pkg_len;
82 int max_x;
83 int max_y;
84 int max_tilt_x;
85 int max_tilt_y;
86 int max_pressure;
89 static const struct hanwang_features features_array[] = {
90 { 0x8528, "Hanwang Art Master III 0906", HANWANG_ART_MASTER_III,
91 ART_MASTER_PKGLEN_MAX, 0x5757, 0x3692, 0x3f, 0x7f, 2048 },
92 { 0x8529, "Hanwang Art Master III 0604", HANWANG_ART_MASTER_III,
93 ART_MASTER_PKGLEN_MAX, 0x3d84, 0x2672, 0x3f, 0x7f, 2048 },
94 { 0x852a, "Hanwang Art Master III 1308", HANWANG_ART_MASTER_III,
95 ART_MASTER_PKGLEN_MAX, 0x7f00, 0x4f60, 0x3f, 0x7f, 2048 },
96 { 0x8401, "Hanwang Art Master HD 5012", HANWANG_ART_MASTER_HD,
97 ART_MASTER_PKGLEN_MAX, 0x678e, 0x4150, 0x3f, 0x7f, 1024 },
98 { 0x8503, "Hanwang Art Master II", HANWANG_ART_MASTER_II,
99 ART_MASTER_PKGLEN_MAX, 0x27de, 0x1cfe, 0x3f, 0x7f, 1024 },
102 static const int hw_eventtypes[] = {
103 EV_KEY, EV_ABS, EV_MSC,
106 static const int hw_absevents[] = {
107 ABS_X, ABS_Y, ABS_TILT_X, ABS_TILT_Y, ABS_WHEEL,
108 ABS_RX, ABS_RY, ABS_PRESSURE, ABS_MISC,
111 static const int hw_btnevents[] = {
112 BTN_STYLUS, BTN_STYLUS2, BTN_TOOL_PEN, BTN_TOOL_RUBBER,
113 BTN_TOOL_MOUSE, BTN_TOOL_FINGER,
114 BTN_0, BTN_1, BTN_2, BTN_3, BTN_4, BTN_5, BTN_6, BTN_7, BTN_8,
117 static const int hw_mscevents[] = {
118 MSC_SERIAL,
121 static void hanwang_parse_packet(struct hanwang *hanwang)
123 unsigned char *data = hanwang->data;
124 struct input_dev *input_dev = hanwang->dev;
125 struct usb_device *dev = hanwang->usbdev;
126 enum hanwang_tablet_type type = hanwang->features->type;
127 int i;
128 u16 p;
130 if (type == HANWANG_ART_MASTER_II) {
131 hanwang->current_tool = BTN_TOOL_PEN;
132 hanwang->current_id = STYLUS_DEVICE_ID;
135 switch (data[0]) {
136 case 0x02: /* data packet */
137 switch (data[1]) {
138 case 0x80: /* tool prox out */
139 if (type != HANWANG_ART_MASTER_II) {
140 hanwang->current_id = 0;
141 input_report_key(input_dev,
142 hanwang->current_tool, 0);
144 break;
146 case 0x00: /* artmaster ii pen leave */
147 if (type == HANWANG_ART_MASTER_II) {
148 hanwang->current_id = 0;
149 input_report_key(input_dev,
150 hanwang->current_tool, 0);
152 break;
154 case 0xc2: /* first time tool prox in */
155 switch (data[3] & 0xf0) {
156 case 0x20: /* art_master III */
157 case 0x30: /* art_master_HD */
158 hanwang->current_id = STYLUS_DEVICE_ID;
159 hanwang->current_tool = BTN_TOOL_PEN;
160 input_report_key(input_dev, BTN_TOOL_PEN, 1);
161 break;
162 case 0xa0: /* art_master III */
163 case 0xb0: /* art_master_HD */
164 hanwang->current_id = ERASER_DEVICE_ID;
165 hanwang->current_tool = BTN_TOOL_RUBBER;
166 input_report_key(input_dev, BTN_TOOL_RUBBER, 1);
167 break;
168 default:
169 hanwang->current_id = 0;
170 dev_dbg(&dev->dev,
171 "unknown tablet tool %02x\n", data[0]);
172 break;
174 break;
176 default: /* tool data packet */
177 switch (type) {
178 case HANWANG_ART_MASTER_III:
179 p = (data[6] << 3) |
180 ((data[7] & 0xc0) >> 5) |
181 (data[1] & 0x01);
182 break;
184 case HANWANG_ART_MASTER_HD:
185 case HANWANG_ART_MASTER_II:
186 p = (data[7] >> 6) | (data[6] << 2);
187 break;
189 default:
190 p = 0;
191 break;
194 input_report_abs(input_dev, ABS_X,
195 be16_to_cpup((__be16 *)&data[2]));
196 input_report_abs(input_dev, ABS_Y,
197 be16_to_cpup((__be16 *)&data[4]));
198 input_report_abs(input_dev, ABS_PRESSURE, p);
199 input_report_abs(input_dev, ABS_TILT_X, data[7] & 0x3f);
200 input_report_abs(input_dev, ABS_TILT_Y, data[8] & 0x7f);
201 input_report_key(input_dev, BTN_STYLUS, data[1] & 0x02);
203 if (type != HANWANG_ART_MASTER_II)
204 input_report_key(input_dev, BTN_STYLUS2,
205 data[1] & 0x04);
206 else
207 input_report_key(input_dev, BTN_TOOL_PEN, 1);
209 break;
212 input_report_abs(input_dev, ABS_MISC, hanwang->current_id);
213 input_event(input_dev, EV_MSC, MSC_SERIAL,
214 hanwang->features->pid);
215 break;
217 case 0x0c:
218 /* roll wheel */
219 hanwang->current_id = PAD_DEVICE_ID;
221 switch (type) {
222 case HANWANG_ART_MASTER_III:
223 input_report_key(input_dev, BTN_TOOL_FINGER,
224 data[1] || data[2] || data[3]);
225 input_report_abs(input_dev, ABS_WHEEL, data[1]);
226 input_report_key(input_dev, BTN_0, data[2]);
227 for (i = 0; i < 8; i++)
228 input_report_key(input_dev,
229 BTN_1 + i, data[3] & (1 << i));
230 break;
232 case HANWANG_ART_MASTER_HD:
233 input_report_key(input_dev, BTN_TOOL_FINGER, data[1] ||
234 data[2] || data[3] || data[4] ||
235 data[5] || data[6]);
236 input_report_abs(input_dev, ABS_RX,
237 ((data[1] & 0x1f) << 8) | data[2]);
238 input_report_abs(input_dev, ABS_RY,
239 ((data[3] & 0x1f) << 8) | data[4]);
240 input_report_key(input_dev, BTN_0, data[5] & 0x01);
241 for (i = 0; i < 4; i++) {
242 input_report_key(input_dev,
243 BTN_1 + i, data[5] & (1 << i));
244 input_report_key(input_dev,
245 BTN_5 + i, data[6] & (1 << i));
247 break;
249 case HANWANG_ART_MASTER_II:
250 dev_dbg(&dev->dev, "error packet %02x\n", data[0]);
251 return;
254 input_report_abs(input_dev, ABS_MISC, hanwang->current_id);
255 input_event(input_dev, EV_MSC, MSC_SERIAL, 0xffffffff);
256 break;
258 default:
259 dev_dbg(&dev->dev, "error packet %02x\n", data[0]);
260 break;
263 input_sync(input_dev);
266 static void hanwang_irq(struct urb *urb)
268 struct hanwang *hanwang = urb->context;
269 struct usb_device *dev = hanwang->usbdev;
270 int retval;
272 switch (urb->status) {
273 case 0:
274 /* success */;
275 hanwang_parse_packet(hanwang);
276 break;
277 case -ECONNRESET:
278 case -ENOENT:
279 case -ESHUTDOWN:
280 /* this urb is terminated, clean up */
281 dev_err(&dev->dev, "%s - urb shutting down with status: %d",
282 __func__, urb->status);
283 return;
284 default:
285 dev_err(&dev->dev, "%s - nonzero urb status received: %d",
286 __func__, urb->status);
287 break;
290 retval = usb_submit_urb(urb, GFP_ATOMIC);
291 if (retval)
292 dev_err(&dev->dev, "%s - usb_submit_urb failed with result %d",
293 __func__, retval);
296 static int hanwang_open(struct input_dev *dev)
298 struct hanwang *hanwang = input_get_drvdata(dev);
300 hanwang->irq->dev = hanwang->usbdev;
301 if (usb_submit_urb(hanwang->irq, GFP_KERNEL))
302 return -EIO;
304 return 0;
307 static void hanwang_close(struct input_dev *dev)
309 struct hanwang *hanwang = input_get_drvdata(dev);
311 usb_kill_urb(hanwang->irq);
314 static bool get_features(struct usb_device *dev, struct hanwang *hanwang)
316 int i;
318 for (i = 0; i < ARRAY_SIZE(features_array); i++) {
319 if (le16_to_cpu(dev->descriptor.idProduct) ==
320 features_array[i].pid) {
321 hanwang->features = &features_array[i];
322 return true;
326 return false;
330 static int hanwang_probe(struct usb_interface *intf, const struct usb_device_id *id)
332 struct usb_device *dev = interface_to_usbdev(intf);
333 struct usb_endpoint_descriptor *endpoint;
334 struct hanwang *hanwang;
335 struct input_dev *input_dev;
336 int error;
337 int i;
339 if (intf->cur_altsetting->desc.bNumEndpoints < 1)
340 return -ENODEV;
342 hanwang = kzalloc(sizeof(struct hanwang), GFP_KERNEL);
343 input_dev = input_allocate_device();
344 if (!hanwang || !input_dev) {
345 error = -ENOMEM;
346 goto fail1;
349 if (!get_features(dev, hanwang)) {
350 error = -ENXIO;
351 goto fail1;
354 hanwang->data = usb_alloc_coherent(dev, hanwang->features->pkg_len,
355 GFP_KERNEL, &hanwang->data_dma);
356 if (!hanwang->data) {
357 error = -ENOMEM;
358 goto fail1;
361 hanwang->irq = usb_alloc_urb(0, GFP_KERNEL);
362 if (!hanwang->irq) {
363 error = -ENOMEM;
364 goto fail2;
367 hanwang->usbdev = dev;
368 hanwang->dev = input_dev;
370 usb_make_path(dev, hanwang->phys, sizeof(hanwang->phys));
371 strlcat(hanwang->phys, "/input0", sizeof(hanwang->phys));
373 strlcpy(hanwang->name, hanwang->features->name, sizeof(hanwang->name));
374 input_dev->name = hanwang->name;
375 input_dev->phys = hanwang->phys;
376 usb_to_input_id(dev, &input_dev->id);
377 input_dev->dev.parent = &intf->dev;
379 input_set_drvdata(input_dev, hanwang);
381 input_dev->open = hanwang_open;
382 input_dev->close = hanwang_close;
384 for (i = 0; i < ARRAY_SIZE(hw_eventtypes); ++i)
385 __set_bit(hw_eventtypes[i], input_dev->evbit);
387 for (i = 0; i < ARRAY_SIZE(hw_absevents); ++i)
388 __set_bit(hw_absevents[i], input_dev->absbit);
390 for (i = 0; i < ARRAY_SIZE(hw_btnevents); ++i)
391 __set_bit(hw_btnevents[i], input_dev->keybit);
393 for (i = 0; i < ARRAY_SIZE(hw_mscevents); ++i)
394 __set_bit(hw_mscevents[i], input_dev->mscbit);
396 input_set_abs_params(input_dev, ABS_X,
397 0, hanwang->features->max_x, 4, 0);
398 input_set_abs_params(input_dev, ABS_Y,
399 0, hanwang->features->max_y, 4, 0);
400 input_set_abs_params(input_dev, ABS_TILT_X,
401 0, hanwang->features->max_tilt_x, 0, 0);
402 input_set_abs_params(input_dev, ABS_TILT_Y,
403 0, hanwang->features->max_tilt_y, 0, 0);
404 input_set_abs_params(input_dev, ABS_PRESSURE,
405 0, hanwang->features->max_pressure, 0, 0);
407 endpoint = &intf->cur_altsetting->endpoint[0].desc;
408 usb_fill_int_urb(hanwang->irq, dev,
409 usb_rcvintpipe(dev, endpoint->bEndpointAddress),
410 hanwang->data, hanwang->features->pkg_len,
411 hanwang_irq, hanwang, endpoint->bInterval);
412 hanwang->irq->transfer_dma = hanwang->data_dma;
413 hanwang->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
415 error = input_register_device(hanwang->dev);
416 if (error)
417 goto fail3;
419 usb_set_intfdata(intf, hanwang);
421 return 0;
423 fail3: usb_free_urb(hanwang->irq);
424 fail2: usb_free_coherent(dev, hanwang->features->pkg_len,
425 hanwang->data, hanwang->data_dma);
426 fail1: input_free_device(input_dev);
427 kfree(hanwang);
428 return error;
432 static void hanwang_disconnect(struct usb_interface *intf)
434 struct hanwang *hanwang = usb_get_intfdata(intf);
436 input_unregister_device(hanwang->dev);
437 usb_free_urb(hanwang->irq);
438 usb_free_coherent(interface_to_usbdev(intf),
439 hanwang->features->pkg_len, hanwang->data,
440 hanwang->data_dma);
441 kfree(hanwang);
442 usb_set_intfdata(intf, NULL);
445 static const struct usb_device_id hanwang_ids[] = {
446 { HANWANG_TABLET_DEVICE(USB_VENDOR_ID_HANWANG, HANWANG_TABLET_INT_CLASS,
447 HANWANG_TABLET_INT_SUB_CLASS, HANWANG_TABLET_INT_PROTOCOL) },
451 MODULE_DEVICE_TABLE(usb, hanwang_ids);
453 static struct usb_driver hanwang_driver = {
454 .name = "hanwang",
455 .probe = hanwang_probe,
456 .disconnect = hanwang_disconnect,
457 .id_table = hanwang_ids,
460 module_usb_driver(hanwang_driver);