sch_tbf: fix two null pointer dereferences on init failure
[linux-2.6/btrfs-unstable.git] / drivers / staging / greybus / hid.c
blob465101bbab697e420f868df204ca47bd22c278f7
1 /*
2 * HID class driver for the Greybus.
4 * Copyright 2014 Google Inc.
5 * Copyright 2014 Linaro Ltd.
7 * Released under the GPLv2 only.
8 */
10 #include <linux/bitops.h>
11 #include <linux/hid.h>
12 #include <linux/kernel.h>
13 #include <linux/module.h>
14 #include <linux/mutex.h>
15 #include <linux/slab.h>
17 #include "greybus.h"
19 /* Greybus HID device's structure */
20 struct gb_hid {
21 struct gb_bundle *bundle;
22 struct gb_connection *connection;
24 struct hid_device *hid;
25 struct gb_hid_desc_response hdesc;
27 unsigned long flags;
28 #define GB_HID_STARTED 0x01
29 #define GB_HID_READ_PENDING 0x04
31 unsigned int bufsize;
32 char *inbuf;
35 /* Routines to get controller's information over greybus */
37 /* Operations performed on greybus */
38 static int gb_hid_get_desc(struct gb_hid *ghid)
40 return gb_operation_sync(ghid->connection, GB_HID_TYPE_GET_DESC, NULL,
41 0, &ghid->hdesc, sizeof(ghid->hdesc));
44 static int gb_hid_get_report_desc(struct gb_hid *ghid, char *rdesc)
46 int ret;
48 ret = gb_pm_runtime_get_sync(ghid->bundle);
49 if (ret)
50 return ret;
52 ret = gb_operation_sync(ghid->connection, GB_HID_TYPE_GET_REPORT_DESC,
53 NULL, 0, rdesc,
54 le16_to_cpu(ghid->hdesc.wReportDescLength));
56 gb_pm_runtime_put_autosuspend(ghid->bundle);
58 return ret;
61 static int gb_hid_set_power(struct gb_hid *ghid, int type)
63 int ret;
65 ret = gb_pm_runtime_get_sync(ghid->bundle);
66 if (ret)
67 return ret;
69 ret = gb_operation_sync(ghid->connection, type, NULL, 0, NULL, 0);
71 gb_pm_runtime_put_autosuspend(ghid->bundle);
73 return ret;
76 static int gb_hid_get_report(struct gb_hid *ghid, u8 report_type, u8 report_id,
77 unsigned char *buf, int len)
79 struct gb_hid_get_report_request request;
80 int ret;
82 ret = gb_pm_runtime_get_sync(ghid->bundle);
83 if (ret)
84 return ret;
86 request.report_type = report_type;
87 request.report_id = report_id;
89 ret = gb_operation_sync(ghid->connection, GB_HID_TYPE_GET_REPORT,
90 &request, sizeof(request), buf, len);
92 gb_pm_runtime_put_autosuspend(ghid->bundle);
94 return ret;
97 static int gb_hid_set_report(struct gb_hid *ghid, u8 report_type, u8 report_id,
98 unsigned char *buf, int len)
100 struct gb_hid_set_report_request *request;
101 struct gb_operation *operation;
102 int ret, size = sizeof(*request) + len - 1;
104 ret = gb_pm_runtime_get_sync(ghid->bundle);
105 if (ret)
106 return ret;
108 operation = gb_operation_create(ghid->connection,
109 GB_HID_TYPE_SET_REPORT, size, 0,
110 GFP_KERNEL);
111 if (!operation) {
112 gb_pm_runtime_put_autosuspend(ghid->bundle);
113 return -ENOMEM;
116 request = operation->request->payload;
117 request->report_type = report_type;
118 request->report_id = report_id;
119 memcpy(request->report, buf, len);
121 ret = gb_operation_request_send_sync(operation);
122 if (ret) {
123 dev_err(&operation->connection->bundle->dev,
124 "failed to set report: %d\n", ret);
125 } else {
126 ret = len;
129 gb_operation_put(operation);
130 gb_pm_runtime_put_autosuspend(ghid->bundle);
132 return ret;
135 static int gb_hid_request_handler(struct gb_operation *op)
137 struct gb_connection *connection = op->connection;
138 struct gb_hid *ghid = gb_connection_get_data(connection);
139 struct gb_hid_input_report_request *request = op->request->payload;
141 if (op->type != GB_HID_TYPE_IRQ_EVENT) {
142 dev_err(&connection->bundle->dev,
143 "unsupported unsolicited request\n");
144 return -EINVAL;
147 if (test_bit(GB_HID_STARTED, &ghid->flags))
148 hid_input_report(ghid->hid, HID_INPUT_REPORT,
149 request->report, op->request->payload_size, 1);
151 return 0;
154 static int gb_hid_report_len(struct hid_report *report)
156 return ((report->size - 1) >> 3) + 1 +
157 report->device->report_enum[report->type].numbered;
160 static void gb_hid_find_max_report(struct hid_device *hid, unsigned int type,
161 unsigned int *max)
163 struct hid_report *report;
164 unsigned int size;
166 list_for_each_entry(report, &hid->report_enum[type].report_list, list) {
167 size = gb_hid_report_len(report);
168 if (*max < size)
169 *max = size;
173 static void gb_hid_free_buffers(struct gb_hid *ghid)
175 kfree(ghid->inbuf);
176 ghid->inbuf = NULL;
177 ghid->bufsize = 0;
180 static int gb_hid_alloc_buffers(struct gb_hid *ghid, size_t bufsize)
182 ghid->inbuf = kzalloc(bufsize, GFP_KERNEL);
183 if (!ghid->inbuf)
184 return -ENOMEM;
186 ghid->bufsize = bufsize;
188 return 0;
191 /* Routines dealing with reports */
192 static void gb_hid_init_report(struct gb_hid *ghid, struct hid_report *report)
194 unsigned int size;
196 size = gb_hid_report_len(report);
197 if (gb_hid_get_report(ghid, report->type, report->id, ghid->inbuf,
198 size))
199 return;
202 * hid->driver_lock is held as we are in probe function,
203 * we just need to setup the input fields, so using
204 * hid_report_raw_event is safe.
206 hid_report_raw_event(ghid->hid, report->type, ghid->inbuf, size, 1);
209 static void gb_hid_init_reports(struct gb_hid *ghid)
211 struct hid_device *hid = ghid->hid;
212 struct hid_report *report;
214 list_for_each_entry(report,
215 &hid->report_enum[HID_INPUT_REPORT].report_list, list)
216 gb_hid_init_report(ghid, report);
218 list_for_each_entry(report,
219 &hid->report_enum[HID_FEATURE_REPORT].report_list, list)
220 gb_hid_init_report(ghid, report);
223 static int __gb_hid_get_raw_report(struct hid_device *hid,
224 unsigned char report_number, __u8 *buf, size_t count,
225 unsigned char report_type)
227 struct gb_hid *ghid = hid->driver_data;
228 int ret;
230 if (report_type == HID_OUTPUT_REPORT)
231 return -EINVAL;
233 ret = gb_hid_get_report(ghid, report_type, report_number, buf, count);
234 if (!ret)
235 ret = count;
237 return ret;
240 static int __gb_hid_output_raw_report(struct hid_device *hid, __u8 *buf,
241 size_t len, unsigned char report_type)
243 struct gb_hid *ghid = hid->driver_data;
244 int report_id = buf[0];
245 int ret;
247 if (report_type == HID_INPUT_REPORT)
248 return -EINVAL;
250 if (report_id) {
251 buf++;
252 len--;
255 ret = gb_hid_set_report(ghid, report_type, report_id, buf, len);
256 if (report_id && ret >= 0)
257 ret++; /* add report_id to the number of transfered bytes */
259 return 0;
262 static int gb_hid_raw_request(struct hid_device *hid, unsigned char reportnum,
263 __u8 *buf, size_t len, unsigned char rtype,
264 int reqtype)
266 switch (reqtype) {
267 case HID_REQ_GET_REPORT:
268 return __gb_hid_get_raw_report(hid, reportnum, buf, len, rtype);
269 case HID_REQ_SET_REPORT:
270 if (buf[0] != reportnum)
271 return -EINVAL;
272 return __gb_hid_output_raw_report(hid, buf, len, rtype);
273 default:
274 return -EIO;
278 /* HID Callbacks */
279 static int gb_hid_parse(struct hid_device *hid)
281 struct gb_hid *ghid = hid->driver_data;
282 unsigned int rsize;
283 char *rdesc;
284 int ret;
286 rsize = le16_to_cpu(ghid->hdesc.wReportDescLength);
287 if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) {
288 dbg_hid("weird size of report descriptor (%u)\n", rsize);
289 return -EINVAL;
292 rdesc = kzalloc(rsize, GFP_KERNEL);
293 if (!rdesc) {
294 dbg_hid("couldn't allocate rdesc memory\n");
295 return -ENOMEM;
298 ret = gb_hid_get_report_desc(ghid, rdesc);
299 if (ret) {
300 hid_err(hid, "reading report descriptor failed\n");
301 goto free_rdesc;
304 ret = hid_parse_report(hid, rdesc, rsize);
305 if (ret)
306 dbg_hid("parsing report descriptor failed\n");
308 free_rdesc:
309 kfree(rdesc);
311 return ret;
314 static int gb_hid_start(struct hid_device *hid)
316 struct gb_hid *ghid = hid->driver_data;
317 unsigned int bufsize = HID_MIN_BUFFER_SIZE;
318 int ret;
320 gb_hid_find_max_report(hid, HID_INPUT_REPORT, &bufsize);
321 gb_hid_find_max_report(hid, HID_OUTPUT_REPORT, &bufsize);
322 gb_hid_find_max_report(hid, HID_FEATURE_REPORT, &bufsize);
324 if (bufsize > HID_MAX_BUFFER_SIZE)
325 bufsize = HID_MAX_BUFFER_SIZE;
327 ret = gb_hid_alloc_buffers(ghid, bufsize);
328 if (ret)
329 return ret;
331 if (!(hid->quirks & HID_QUIRK_NO_INIT_REPORTS))
332 gb_hid_init_reports(ghid);
334 return 0;
337 static void gb_hid_stop(struct hid_device *hid)
339 struct gb_hid *ghid = hid->driver_data;
341 gb_hid_free_buffers(ghid);
344 static int gb_hid_open(struct hid_device *hid)
346 struct gb_hid *ghid = hid->driver_data;
347 int ret;
349 ret = gb_hid_set_power(ghid, GB_HID_TYPE_PWR_ON);
350 if (ret < 0)
351 return ret;
353 set_bit(GB_HID_STARTED, &ghid->flags);
354 return 0;
357 static void gb_hid_close(struct hid_device *hid)
359 struct gb_hid *ghid = hid->driver_data;
360 int ret;
362 clear_bit(GB_HID_STARTED, &ghid->flags);
364 /* Save some power */
365 ret = gb_hid_set_power(ghid, GB_HID_TYPE_PWR_OFF);
366 if (ret)
367 dev_err(&ghid->connection->bundle->dev,
368 "failed to power off (%d)\n", ret);
371 static int gb_hid_power(struct hid_device *hid, int lvl)
373 struct gb_hid *ghid = hid->driver_data;
375 switch (lvl) {
376 case PM_HINT_FULLON:
377 return gb_hid_set_power(ghid, GB_HID_TYPE_PWR_ON);
378 case PM_HINT_NORMAL:
379 return gb_hid_set_power(ghid, GB_HID_TYPE_PWR_OFF);
382 return 0;
385 /* HID structure to pass callbacks */
386 static struct hid_ll_driver gb_hid_ll_driver = {
387 .parse = gb_hid_parse,
388 .start = gb_hid_start,
389 .stop = gb_hid_stop,
390 .open = gb_hid_open,
391 .close = gb_hid_close,
392 .power = gb_hid_power,
393 .raw_request = gb_hid_raw_request,
396 static int gb_hid_init(struct gb_hid *ghid)
398 struct hid_device *hid = ghid->hid;
399 int ret;
401 ret = gb_hid_get_desc(ghid);
402 if (ret)
403 return ret;
405 hid->version = le16_to_cpu(ghid->hdesc.bcdHID);
406 hid->vendor = le16_to_cpu(ghid->hdesc.wVendorID);
407 hid->product = le16_to_cpu(ghid->hdesc.wProductID);
408 hid->country = ghid->hdesc.bCountryCode;
410 hid->driver_data = ghid;
411 hid->ll_driver = &gb_hid_ll_driver;
412 hid->dev.parent = &ghid->connection->bundle->dev;
413 // hid->bus = BUS_GREYBUS; /* Need a bustype for GREYBUS in <linux/input.h> */
415 /* Set HID device's name */
416 snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X",
417 dev_name(&ghid->connection->bundle->dev),
418 hid->vendor, hid->product);
420 return 0;
423 static int gb_hid_probe(struct gb_bundle *bundle,
424 const struct greybus_bundle_id *id)
426 struct greybus_descriptor_cport *cport_desc;
427 struct gb_connection *connection;
428 struct hid_device *hid;
429 struct gb_hid *ghid;
430 int ret;
432 if (bundle->num_cports != 1)
433 return -ENODEV;
435 cport_desc = &bundle->cport_desc[0];
436 if (cport_desc->protocol_id != GREYBUS_PROTOCOL_HID)
437 return -ENODEV;
439 ghid = kzalloc(sizeof(*ghid), GFP_KERNEL);
440 if (!ghid)
441 return -ENOMEM;
443 connection = gb_connection_create(bundle, le16_to_cpu(cport_desc->id),
444 gb_hid_request_handler);
445 if (IS_ERR(connection)) {
446 ret = PTR_ERR(connection);
447 goto err_free_ghid;
450 gb_connection_set_data(connection, ghid);
451 ghid->connection = connection;
453 hid = hid_allocate_device();
454 if (IS_ERR(hid)) {
455 ret = PTR_ERR(hid);
456 goto err_connection_destroy;
459 ghid->hid = hid;
460 ghid->bundle = bundle;
462 greybus_set_drvdata(bundle, ghid);
464 ret = gb_connection_enable(connection);
465 if (ret)
466 goto err_destroy_hid;
468 ret = gb_hid_init(ghid);
469 if (ret)
470 goto err_connection_disable;
472 ret = hid_add_device(hid);
473 if (ret) {
474 hid_err(hid, "can't add hid device: %d\n", ret);
475 goto err_connection_disable;
478 gb_pm_runtime_put_autosuspend(bundle);
480 return 0;
482 err_connection_disable:
483 gb_connection_disable(connection);
484 err_destroy_hid:
485 hid_destroy_device(hid);
486 err_connection_destroy:
487 gb_connection_destroy(connection);
488 err_free_ghid:
489 kfree(ghid);
491 return ret;
494 static void gb_hid_disconnect(struct gb_bundle *bundle)
496 struct gb_hid *ghid = greybus_get_drvdata(bundle);
498 if (gb_pm_runtime_get_sync(bundle))
499 gb_pm_runtime_get_noresume(bundle);
501 hid_destroy_device(ghid->hid);
502 gb_connection_disable(ghid->connection);
503 gb_connection_destroy(ghid->connection);
504 kfree(ghid);
507 static const struct greybus_bundle_id gb_hid_id_table[] = {
508 { GREYBUS_DEVICE_CLASS(GREYBUS_CLASS_HID) },
511 MODULE_DEVICE_TABLE(greybus, gb_hid_id_table);
513 static struct greybus_driver gb_hid_driver = {
514 .name = "hid",
515 .probe = gb_hid_probe,
516 .disconnect = gb_hid_disconnect,
517 .id_table = gb_hid_id_table,
519 module_greybus_driver(gb_hid_driver);
521 MODULE_LICENSE("GPL v2");