OMAPDSS: VENC: fix NULL pointer dereference in DSS2 VENC sysfs debug attr on OMAP4
[zen-stable.git] / drivers / input / serio / serio_raw.c
blob4494233d331ac4689eef8ca58366c7138904627d
1 /*
2 * Raw serio device providing access to a raw byte stream from underlying
3 * serio port. Closely emulates behavior of pre-2.6 /dev/psaux device
5 * Copyright (c) 2004 Dmitry Torokhov
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License version 2 as published by
9 * the Free Software Foundation.
12 #include <linux/kref.h>
13 #include <linux/sched.h>
14 #include <linux/slab.h>
15 #include <linux/poll.h>
16 #include <linux/module.h>
17 #include <linux/serio.h>
18 #include <linux/init.h>
19 #include <linux/major.h>
20 #include <linux/device.h>
21 #include <linux/miscdevice.h>
22 #include <linux/wait.h>
23 #include <linux/mutex.h>
25 #define DRIVER_DESC "Raw serio driver"
27 MODULE_AUTHOR("Dmitry Torokhov <dtor@mail.ru>");
28 MODULE_DESCRIPTION(DRIVER_DESC);
29 MODULE_LICENSE("GPL");
31 #define SERIO_RAW_QUEUE_LEN 64
32 struct serio_raw {
33 unsigned char queue[SERIO_RAW_QUEUE_LEN];
34 unsigned int tail, head;
36 char name[16];
37 struct kref kref;
38 struct serio *serio;
39 struct miscdevice dev;
40 wait_queue_head_t wait;
41 struct list_head client_list;
42 struct list_head node;
43 bool dead;
46 struct serio_raw_client {
47 struct fasync_struct *fasync;
48 struct serio_raw *serio_raw;
49 struct list_head node;
52 static DEFINE_MUTEX(serio_raw_mutex);
53 static LIST_HEAD(serio_raw_list);
55 /*********************************************************************
56 * Interface with userspace (file operations) *
57 *********************************************************************/
59 static int serio_raw_fasync(int fd, struct file *file, int on)
61 struct serio_raw_client *client = file->private_data;
63 return fasync_helper(fd, file, on, &client->fasync);
66 static struct serio_raw *serio_raw_locate(int minor)
68 struct serio_raw *serio_raw;
70 list_for_each_entry(serio_raw, &serio_raw_list, node) {
71 if (serio_raw->dev.minor == minor)
72 return serio_raw;
75 return NULL;
78 static int serio_raw_open(struct inode *inode, struct file *file)
80 struct serio_raw *serio_raw;
81 struct serio_raw_client *client;
82 int retval;
84 retval = mutex_lock_interruptible(&serio_raw_mutex);
85 if (retval)
86 return retval;
88 serio_raw = serio_raw_locate(iminor(inode));
89 if (!serio_raw) {
90 retval = -ENODEV;
91 goto out;
94 if (serio_raw->dead) {
95 retval = -ENODEV;
96 goto out;
99 client = kzalloc(sizeof(struct serio_raw_client), GFP_KERNEL);
100 if (!client) {
101 retval = -ENOMEM;
102 goto out;
105 client->serio_raw = serio_raw;
106 file->private_data = client;
108 kref_get(&serio_raw->kref);
110 serio_pause_rx(serio_raw->serio);
111 list_add_tail(&client->node, &serio_raw->client_list);
112 serio_continue_rx(serio_raw->serio);
114 out:
115 mutex_unlock(&serio_raw_mutex);
116 return retval;
119 static void serio_raw_free(struct kref *kref)
121 struct serio_raw *serio_raw =
122 container_of(kref, struct serio_raw, kref);
124 put_device(&serio_raw->serio->dev);
125 kfree(serio_raw);
128 static int serio_raw_release(struct inode *inode, struct file *file)
130 struct serio_raw_client *client = file->private_data;
131 struct serio_raw *serio_raw = client->serio_raw;
133 serio_pause_rx(serio_raw->serio);
134 list_del(&client->node);
135 serio_continue_rx(serio_raw->serio);
137 kfree(client);
139 kref_put(&serio_raw->kref, serio_raw_free);
141 return 0;
144 static bool serio_raw_fetch_byte(struct serio_raw *serio_raw, char *c)
146 bool empty;
148 serio_pause_rx(serio_raw->serio);
150 empty = serio_raw->head == serio_raw->tail;
151 if (!empty) {
152 *c = serio_raw->queue[serio_raw->tail];
153 serio_raw->tail = (serio_raw->tail + 1) % SERIO_RAW_QUEUE_LEN;
156 serio_continue_rx(serio_raw->serio);
158 return !empty;
161 static ssize_t serio_raw_read(struct file *file, char __user *buffer,
162 size_t count, loff_t *ppos)
164 struct serio_raw_client *client = file->private_data;
165 struct serio_raw *serio_raw = client->serio_raw;
166 char uninitialized_var(c);
167 ssize_t read = 0;
168 int retval;
170 if (serio_raw->dead)
171 return -ENODEV;
173 if (serio_raw->head == serio_raw->tail && (file->f_flags & O_NONBLOCK))
174 return -EAGAIN;
176 retval = wait_event_interruptible(serio_raw->wait,
177 serio_raw->head != serio_raw->tail || serio_raw->dead);
178 if (retval)
179 return retval;
181 if (serio_raw->dead)
182 return -ENODEV;
184 while (read < count && serio_raw_fetch_byte(serio_raw, &c)) {
185 if (put_user(c, buffer++)) {
186 retval = -EFAULT;
187 break;
189 read++;
192 return read ?: retval;
195 static ssize_t serio_raw_write(struct file *file, const char __user *buffer,
196 size_t count, loff_t *ppos)
198 struct serio_raw_client *client = file->private_data;
199 struct serio_raw *serio_raw = client->serio_raw;
200 ssize_t written = 0;
201 int retval;
202 unsigned char c;
204 retval = mutex_lock_interruptible(&serio_raw_mutex);
205 if (retval)
206 return retval;
208 if (serio_raw->dead) {
209 retval = -ENODEV;
210 goto out;
213 if (count > 32)
214 count = 32;
216 while (count--) {
217 if (get_user(c, buffer++)) {
218 retval = -EFAULT;
219 goto out;
221 if (serio_write(serio_raw->serio, c)) {
222 retval = -EIO;
223 goto out;
225 written++;
228 out:
229 mutex_unlock(&serio_raw_mutex);
230 return written ?: retval;
233 static unsigned int serio_raw_poll(struct file *file, poll_table *wait)
235 struct serio_raw_client *client = file->private_data;
236 struct serio_raw *serio_raw = client->serio_raw;
237 unsigned int mask;
239 poll_wait(file, &serio_raw->wait, wait);
241 mask = serio_raw->dead ? POLLHUP | POLLERR : POLLOUT | POLLWRNORM;
242 if (serio_raw->head != serio_raw->tail)
243 mask |= POLLIN | POLLRDNORM;
245 return mask;
248 static const struct file_operations serio_raw_fops = {
249 .owner = THIS_MODULE,
250 .open = serio_raw_open,
251 .release = serio_raw_release,
252 .read = serio_raw_read,
253 .write = serio_raw_write,
254 .poll = serio_raw_poll,
255 .fasync = serio_raw_fasync,
256 .llseek = noop_llseek,
260 /*********************************************************************
261 * Interface with serio port *
262 *********************************************************************/
264 static irqreturn_t serio_raw_interrupt(struct serio *serio, unsigned char data,
265 unsigned int dfl)
267 struct serio_raw *serio_raw = serio_get_drvdata(serio);
268 struct serio_raw_client *client;
269 unsigned int head = serio_raw->head;
271 /* we are holding serio->lock here so we are protected */
272 serio_raw->queue[head] = data;
273 head = (head + 1) % SERIO_RAW_QUEUE_LEN;
274 if (likely(head != serio_raw->tail)) {
275 serio_raw->head = head;
276 list_for_each_entry(client, &serio_raw->client_list, node)
277 kill_fasync(&client->fasync, SIGIO, POLL_IN);
278 wake_up_interruptible(&serio_raw->wait);
281 return IRQ_HANDLED;
284 static int serio_raw_connect(struct serio *serio, struct serio_driver *drv)
286 static atomic_t serio_raw_no = ATOMIC_INIT(0);
287 struct serio_raw *serio_raw;
288 int err;
290 serio_raw = kzalloc(sizeof(struct serio_raw), GFP_KERNEL);
291 if (!serio_raw) {
292 dev_dbg(&serio->dev, "can't allocate memory for a device\n");
293 return -ENOMEM;
296 snprintf(serio_raw->name, sizeof(serio_raw->name),
297 "serio_raw%ld", (long)atomic_inc_return(&serio_raw_no) - 1);
298 kref_init(&serio_raw->kref);
299 INIT_LIST_HEAD(&serio_raw->client_list);
300 init_waitqueue_head(&serio_raw->wait);
302 serio_raw->serio = serio;
303 get_device(&serio->dev);
305 serio_set_drvdata(serio, serio_raw);
307 err = serio_open(serio, drv);
308 if (err)
309 goto err_free;
311 err = mutex_lock_killable(&serio_raw_mutex);
312 if (err)
313 goto err_close;
315 list_add_tail(&serio_raw->node, &serio_raw_list);
316 mutex_unlock(&serio_raw_mutex);
318 serio_raw->dev.minor = PSMOUSE_MINOR;
319 serio_raw->dev.name = serio_raw->name;
320 serio_raw->dev.parent = &serio->dev;
321 serio_raw->dev.fops = &serio_raw_fops;
323 err = misc_register(&serio_raw->dev);
324 if (err) {
325 serio_raw->dev.minor = MISC_DYNAMIC_MINOR;
326 err = misc_register(&serio_raw->dev);
329 if (err) {
330 dev_err(&serio->dev,
331 "failed to register raw access device for %s\n",
332 serio->phys);
333 goto err_unlink;
336 dev_info(&serio->dev, "raw access enabled on %s (%s, minor %d)\n",
337 serio->phys, serio_raw->name, serio_raw->dev.minor);
338 return 0;
340 err_unlink:
341 list_del_init(&serio_raw->node);
342 err_close:
343 serio_close(serio);
344 err_free:
345 serio_set_drvdata(serio, NULL);
346 kref_put(&serio_raw->kref, serio_raw_free);
347 return err;
350 static int serio_raw_reconnect(struct serio *serio)
352 struct serio_raw *serio_raw = serio_get_drvdata(serio);
353 struct serio_driver *drv = serio->drv;
355 if (!drv || !serio_raw) {
356 dev_dbg(&serio->dev,
357 "reconnect request, but serio is disconnected, ignoring...\n");
358 return -1;
362 * Nothing needs to be done here, we just need this method to
363 * keep the same device.
365 return 0;
369 * Wake up users waiting for IO so they can disconnect from
370 * dead device.
372 static void serio_raw_hangup(struct serio_raw *serio_raw)
374 struct serio_raw_client *client;
376 serio_pause_rx(serio_raw->serio);
377 list_for_each_entry(client, &serio_raw->client_list, node)
378 kill_fasync(&client->fasync, SIGIO, POLL_HUP);
379 serio_continue_rx(serio_raw->serio);
381 wake_up_interruptible(&serio_raw->wait);
385 static void serio_raw_disconnect(struct serio *serio)
387 struct serio_raw *serio_raw = serio_get_drvdata(serio);
389 misc_deregister(&serio_raw->dev);
391 mutex_lock(&serio_raw_mutex);
392 serio_raw->dead = true;
393 list_del_init(&serio_raw->node);
394 mutex_unlock(&serio_raw_mutex);
396 serio_raw_hangup(serio_raw);
398 serio_close(serio);
399 kref_put(&serio_raw->kref, serio_raw_free);
401 serio_set_drvdata(serio, NULL);
404 static struct serio_device_id serio_raw_serio_ids[] = {
406 .type = SERIO_8042,
407 .proto = SERIO_ANY,
408 .id = SERIO_ANY,
409 .extra = SERIO_ANY,
412 .type = SERIO_8042_XL,
413 .proto = SERIO_ANY,
414 .id = SERIO_ANY,
415 .extra = SERIO_ANY,
417 { 0 }
420 MODULE_DEVICE_TABLE(serio, serio_raw_serio_ids);
422 static struct serio_driver serio_raw_drv = {
423 .driver = {
424 .name = "serio_raw",
426 .description = DRIVER_DESC,
427 .id_table = serio_raw_serio_ids,
428 .interrupt = serio_raw_interrupt,
429 .connect = serio_raw_connect,
430 .reconnect = serio_raw_reconnect,
431 .disconnect = serio_raw_disconnect,
432 .manual_bind = true,
435 static int __init serio_raw_init(void)
437 return serio_register_driver(&serio_raw_drv);
440 static void __exit serio_raw_exit(void)
442 serio_unregister_driver(&serio_raw_drv);
445 module_init(serio_raw_init);
446 module_exit(serio_raw_exit);