OMAPDSS: VENC: fix NULL pointer dereference in DSS2 VENC sysfs debug attr on OMAP4
[zen-stable.git] / drivers / hid / hid-roccat.c
blobb685b04dbf9dec295c3842930df65a6a542d8193
1 /*
2 * Roccat driver for Linux
4 * Copyright (c) 2010 Stefan Achatz <erazor_de@users.sourceforge.net>
5 */
7 /*
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the Free
10 * Software Foundation; either version 2 of the License, or (at your option)
11 * any later version.
15 * Module roccat is a char device used to report special events of roccat
16 * hardware to userland. These events include requests for on-screen-display of
17 * profile or dpi settings or requests for execution of macro sequences that are
18 * not stored in device. The information in these events depends on hid device
19 * implementation and contains data that is not available in a single hid event
20 * or else hidraw could have been used.
21 * It is inspired by hidraw, but uses only one circular buffer for all readers.
24 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
26 #include <linux/cdev.h>
27 #include <linux/poll.h>
28 #include <linux/sched.h>
29 #include <linux/hid-roccat.h>
30 #include <linux/module.h>
32 #define ROCCAT_FIRST_MINOR 0
33 #define ROCCAT_MAX_DEVICES 8
35 /* should be a power of 2 for performance reason */
36 #define ROCCAT_CBUF_SIZE 16
38 struct roccat_report {
39 uint8_t *value;
42 struct roccat_device {
43 unsigned int minor;
44 int report_size;
45 int open;
46 int exist;
47 wait_queue_head_t wait;
48 struct device *dev;
49 struct hid_device *hid;
50 struct list_head readers;
51 /* protects modifications of readers list */
52 struct mutex readers_lock;
55 * circular_buffer has one writer and multiple readers with their own
56 * read pointers
58 struct roccat_report cbuf[ROCCAT_CBUF_SIZE];
59 int cbuf_end;
60 struct mutex cbuf_lock;
63 struct roccat_reader {
64 struct list_head node;
65 struct roccat_device *device;
66 int cbuf_start;
69 static int roccat_major;
70 static struct cdev roccat_cdev;
72 static struct roccat_device *devices[ROCCAT_MAX_DEVICES];
73 /* protects modifications of devices array */
74 static DEFINE_MUTEX(devices_lock);
76 static ssize_t roccat_read(struct file *file, char __user *buffer,
77 size_t count, loff_t *ppos)
79 struct roccat_reader *reader = file->private_data;
80 struct roccat_device *device = reader->device;
81 struct roccat_report *report;
82 ssize_t retval = 0, len;
83 DECLARE_WAITQUEUE(wait, current);
85 mutex_lock(&device->cbuf_lock);
87 /* no data? */
88 if (reader->cbuf_start == device->cbuf_end) {
89 add_wait_queue(&device->wait, &wait);
90 set_current_state(TASK_INTERRUPTIBLE);
92 /* wait for data */
93 while (reader->cbuf_start == device->cbuf_end) {
94 if (file->f_flags & O_NONBLOCK) {
95 retval = -EAGAIN;
96 break;
98 if (signal_pending(current)) {
99 retval = -ERESTARTSYS;
100 break;
102 if (!device->exist) {
103 retval = -EIO;
104 break;
107 mutex_unlock(&device->cbuf_lock);
108 schedule();
109 mutex_lock(&device->cbuf_lock);
110 set_current_state(TASK_INTERRUPTIBLE);
113 set_current_state(TASK_RUNNING);
114 remove_wait_queue(&device->wait, &wait);
117 /* here we either have data or a reason to return if retval is set */
118 if (retval)
119 goto exit_unlock;
121 report = &device->cbuf[reader->cbuf_start];
123 * If report is larger than requested amount of data, rest of report
124 * is lost!
126 len = device->report_size > count ? count : device->report_size;
128 if (copy_to_user(buffer, report->value, len)) {
129 retval = -EFAULT;
130 goto exit_unlock;
132 retval += len;
133 reader->cbuf_start = (reader->cbuf_start + 1) % ROCCAT_CBUF_SIZE;
135 exit_unlock:
136 mutex_unlock(&device->cbuf_lock);
137 return retval;
140 static unsigned int roccat_poll(struct file *file, poll_table *wait)
142 struct roccat_reader *reader = file->private_data;
143 poll_wait(file, &reader->device->wait, wait);
144 if (reader->cbuf_start != reader->device->cbuf_end)
145 return POLLIN | POLLRDNORM;
146 if (!reader->device->exist)
147 return POLLERR | POLLHUP;
148 return 0;
151 static int roccat_open(struct inode *inode, struct file *file)
153 unsigned int minor = iminor(inode);
154 struct roccat_reader *reader;
155 struct roccat_device *device;
156 int error = 0;
158 reader = kzalloc(sizeof(struct roccat_reader), GFP_KERNEL);
159 if (!reader)
160 return -ENOMEM;
162 mutex_lock(&devices_lock);
164 device = devices[minor];
166 if (!device) {
167 pr_emerg("roccat device with minor %d doesn't exist\n", minor);
168 error = -ENODEV;
169 goto exit_err_devices;
172 mutex_lock(&device->readers_lock);
174 if (!device->open++) {
175 /* power on device on adding first reader */
176 error = hid_hw_power(device->hid, PM_HINT_FULLON);
177 if (error < 0) {
178 --device->open;
179 goto exit_err_readers;
182 error = hid_hw_open(device->hid);
183 if (error < 0) {
184 hid_hw_power(device->hid, PM_HINT_NORMAL);
185 --device->open;
186 goto exit_err_readers;
190 reader->device = device;
191 /* new reader doesn't get old events */
192 reader->cbuf_start = device->cbuf_end;
194 list_add_tail(&reader->node, &device->readers);
195 file->private_data = reader;
197 exit_err_readers:
198 mutex_unlock(&device->readers_lock);
199 exit_err_devices:
200 mutex_unlock(&devices_lock);
201 if (error)
202 kfree(reader);
203 return error;
206 static int roccat_release(struct inode *inode, struct file *file)
208 unsigned int minor = iminor(inode);
209 struct roccat_reader *reader = file->private_data;
210 struct roccat_device *device;
212 mutex_lock(&devices_lock);
214 device = devices[minor];
215 if (!device) {
216 mutex_unlock(&devices_lock);
217 pr_emerg("roccat device with minor %d doesn't exist\n", minor);
218 return -ENODEV;
221 mutex_lock(&device->readers_lock);
222 list_del(&reader->node);
223 mutex_unlock(&device->readers_lock);
224 kfree(reader);
226 if (!--device->open) {
227 /* removing last reader */
228 if (device->exist) {
229 hid_hw_power(device->hid, PM_HINT_NORMAL);
230 hid_hw_close(device->hid);
231 } else {
232 kfree(device);
236 mutex_unlock(&devices_lock);
238 return 0;
242 * roccat_report_event() - output data to readers
243 * @minor: minor device number returned by roccat_connect()
244 * @data: pointer to data
245 * @len: size of data
247 * Return value is zero on success, a negative error code on failure.
249 * This is called from interrupt handler.
251 int roccat_report_event(int minor, u8 const *data)
253 struct roccat_device *device;
254 struct roccat_reader *reader;
255 struct roccat_report *report;
256 uint8_t *new_value;
258 device = devices[minor];
260 new_value = kmemdup(data, device->report_size, GFP_ATOMIC);
261 if (!new_value)
262 return -ENOMEM;
264 report = &device->cbuf[device->cbuf_end];
266 /* passing NULL is safe */
267 kfree(report->value);
269 report->value = new_value;
270 device->cbuf_end = (device->cbuf_end + 1) % ROCCAT_CBUF_SIZE;
272 list_for_each_entry(reader, &device->readers, node) {
274 * As we already inserted one element, the buffer can't be
275 * empty. If start and end are equal, buffer is full and we
276 * increase start, so that slow reader misses one event, but
277 * gets the newer ones in the right order.
279 if (reader->cbuf_start == device->cbuf_end)
280 reader->cbuf_start = (reader->cbuf_start + 1) % ROCCAT_CBUF_SIZE;
283 wake_up_interruptible(&device->wait);
284 return 0;
286 EXPORT_SYMBOL_GPL(roccat_report_event);
289 * roccat_connect() - create a char device for special event output
290 * @class: the class thats used to create the device. Meant to hold device
291 * specific sysfs attributes.
292 * @hid: the hid device the char device should be connected to.
294 * Return value is minor device number in Range [0, ROCCAT_MAX_DEVICES] on
295 * success, a negative error code on failure.
297 int roccat_connect(struct class *klass, struct hid_device *hid, int report_size)
299 unsigned int minor;
300 struct roccat_device *device;
301 int temp;
303 device = kzalloc(sizeof(struct roccat_device), GFP_KERNEL);
304 if (!device)
305 return -ENOMEM;
307 mutex_lock(&devices_lock);
309 for (minor = 0; minor < ROCCAT_MAX_DEVICES; ++minor) {
310 if (devices[minor])
311 continue;
312 break;
315 if (minor < ROCCAT_MAX_DEVICES) {
316 devices[minor] = device;
317 } else {
318 mutex_unlock(&devices_lock);
319 kfree(device);
320 return -EINVAL;
323 device->dev = device_create(klass, &hid->dev,
324 MKDEV(roccat_major, minor), NULL,
325 "%s%s%d", "roccat", hid->driver->name, minor);
327 if (IS_ERR(device->dev)) {
328 devices[minor] = NULL;
329 mutex_unlock(&devices_lock);
330 temp = PTR_ERR(device->dev);
331 kfree(device);
332 return temp;
335 mutex_unlock(&devices_lock);
337 init_waitqueue_head(&device->wait);
338 INIT_LIST_HEAD(&device->readers);
339 mutex_init(&device->readers_lock);
340 mutex_init(&device->cbuf_lock);
341 device->minor = minor;
342 device->hid = hid;
343 device->exist = 1;
344 device->cbuf_end = 0;
345 device->report_size = report_size;
347 return minor;
349 EXPORT_SYMBOL_GPL(roccat_connect);
351 /* roccat_disconnect() - remove char device from hid device
352 * @minor: the minor device number returned by roccat_connect()
354 void roccat_disconnect(int minor)
356 struct roccat_device *device;
358 mutex_lock(&devices_lock);
359 device = devices[minor];
360 mutex_unlock(&devices_lock);
362 device->exist = 0; /* TODO exist maybe not needed */
364 device_destroy(device->dev->class, MKDEV(roccat_major, minor));
366 mutex_lock(&devices_lock);
367 devices[minor] = NULL;
368 mutex_unlock(&devices_lock);
370 if (device->open) {
371 hid_hw_close(device->hid);
372 wake_up_interruptible(&device->wait);
373 } else {
374 kfree(device);
377 EXPORT_SYMBOL_GPL(roccat_disconnect);
379 static long roccat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
381 struct inode *inode = file->f_path.dentry->d_inode;
382 struct roccat_device *device;
383 unsigned int minor = iminor(inode);
384 long retval = 0;
386 mutex_lock(&devices_lock);
388 device = devices[minor];
389 if (!device) {
390 retval = -ENODEV;
391 goto out;
394 switch (cmd) {
395 case ROCCATIOCGREPSIZE:
396 if (put_user(device->report_size, (int __user *)arg))
397 retval = -EFAULT;
398 break;
399 default:
400 retval = -ENOTTY;
402 out:
403 mutex_unlock(&devices_lock);
404 return retval;
407 static const struct file_operations roccat_ops = {
408 .owner = THIS_MODULE,
409 .read = roccat_read,
410 .poll = roccat_poll,
411 .open = roccat_open,
412 .release = roccat_release,
413 .llseek = noop_llseek,
414 .unlocked_ioctl = roccat_ioctl,
417 static int __init roccat_init(void)
419 int retval;
420 dev_t dev_id;
422 retval = alloc_chrdev_region(&dev_id, ROCCAT_FIRST_MINOR,
423 ROCCAT_MAX_DEVICES, "roccat");
425 roccat_major = MAJOR(dev_id);
427 if (retval < 0) {
428 pr_warn("can't get major number\n");
429 return retval;
432 cdev_init(&roccat_cdev, &roccat_ops);
433 cdev_add(&roccat_cdev, dev_id, ROCCAT_MAX_DEVICES);
435 return 0;
438 static void __exit roccat_exit(void)
440 dev_t dev_id = MKDEV(roccat_major, 0);
442 cdev_del(&roccat_cdev);
443 unregister_chrdev_region(dev_id, ROCCAT_MAX_DEVICES);
446 module_init(roccat_init);
447 module_exit(roccat_exit);
449 MODULE_AUTHOR("Stefan Achatz");
450 MODULE_DESCRIPTION("USB Roccat char device");
451 MODULE_LICENSE("GPL v2");