si4713-i2c: avoid potential buffer overflow on si4713
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / drivers / hid / hid-roccat.c
blob5666e7587b185300c113ff4d4878df25ce027a85
1 /*
2 * Roccat driver for Linux
4 * Copyright (c) 2010 Stefan Achatz <erazor_de@users.sourceforge.net>
5 */
7 /*
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the Free
10 * Software Foundation; either version 2 of the License, or (at your option)
11 * any later version.
15 * Module roccat is a char device used to report special events of roccat
16 * hardware to userland. These events include requests for on-screen-display of
17 * profile or dpi settings or requests for execution of macro sequences that are
18 * not stored in device. The information in these events depends on hid device
19 * implementation and contains data that is not available in a single hid event
20 * or else hidraw could have been used.
21 * It is inspired by hidraw, but uses only one circular buffer for all readers.
24 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
26 #include <linux/cdev.h>
27 #include <linux/poll.h>
28 #include <linux/sched.h>
29 #include <linux/hid-roccat.h>
31 #define ROCCAT_FIRST_MINOR 0
32 #define ROCCAT_MAX_DEVICES 8
34 /* should be a power of 2 for performance reason */
35 #define ROCCAT_CBUF_SIZE 16
37 struct roccat_report {
38 uint8_t *value;
41 struct roccat_device {
42 unsigned int minor;
43 int report_size;
44 int open;
45 int exist;
46 wait_queue_head_t wait;
47 struct device *dev;
48 struct hid_device *hid;
49 struct list_head readers;
50 /* protects modifications of readers list */
51 struct mutex readers_lock;
54 * circular_buffer has one writer and multiple readers with their own
55 * read pointers
57 struct roccat_report cbuf[ROCCAT_CBUF_SIZE];
58 int cbuf_end;
59 struct mutex cbuf_lock;
62 struct roccat_reader {
63 struct list_head node;
64 struct roccat_device *device;
65 int cbuf_start;
68 static int roccat_major;
69 static struct cdev roccat_cdev;
71 static struct roccat_device *devices[ROCCAT_MAX_DEVICES];
72 /* protects modifications of devices array */
73 static DEFINE_MUTEX(devices_lock);
75 static ssize_t roccat_read(struct file *file, char __user *buffer,
76 size_t count, loff_t *ppos)
78 struct roccat_reader *reader = file->private_data;
79 struct roccat_device *device = reader->device;
80 struct roccat_report *report;
81 ssize_t retval = 0, len;
82 DECLARE_WAITQUEUE(wait, current);
84 mutex_lock(&device->cbuf_lock);
86 /* no data? */
87 if (reader->cbuf_start == device->cbuf_end) {
88 add_wait_queue(&device->wait, &wait);
89 set_current_state(TASK_INTERRUPTIBLE);
91 /* wait for data */
92 while (reader->cbuf_start == device->cbuf_end) {
93 if (file->f_flags & O_NONBLOCK) {
94 retval = -EAGAIN;
95 break;
97 if (signal_pending(current)) {
98 retval = -ERESTARTSYS;
99 break;
101 if (!device->exist) {
102 retval = -EIO;
103 break;
106 mutex_unlock(&device->cbuf_lock);
107 schedule();
108 mutex_lock(&device->cbuf_lock);
109 set_current_state(TASK_INTERRUPTIBLE);
112 set_current_state(TASK_RUNNING);
113 remove_wait_queue(&device->wait, &wait);
116 /* here we either have data or a reason to return if retval is set */
117 if (retval)
118 goto exit_unlock;
120 report = &device->cbuf[reader->cbuf_start];
122 * If report is larger than requested amount of data, rest of report
123 * is lost!
125 len = device->report_size > count ? count : device->report_size;
127 if (copy_to_user(buffer, report->value, len)) {
128 retval = -EFAULT;
129 goto exit_unlock;
131 retval += len;
132 reader->cbuf_start = (reader->cbuf_start + 1) % ROCCAT_CBUF_SIZE;
134 exit_unlock:
135 mutex_unlock(&device->cbuf_lock);
136 return retval;
139 static unsigned int roccat_poll(struct file *file, poll_table *wait)
141 struct roccat_reader *reader = file->private_data;
142 poll_wait(file, &reader->device->wait, wait);
143 if (reader->cbuf_start != reader->device->cbuf_end)
144 return POLLIN | POLLRDNORM;
145 if (!reader->device->exist)
146 return POLLERR | POLLHUP;
147 return 0;
150 static int roccat_open(struct inode *inode, struct file *file)
152 unsigned int minor = iminor(inode);
153 struct roccat_reader *reader;
154 struct roccat_device *device;
155 int error = 0;
157 reader = kzalloc(sizeof(struct roccat_reader), GFP_KERNEL);
158 if (!reader)
159 return -ENOMEM;
161 mutex_lock(&devices_lock);
163 device = devices[minor];
165 mutex_lock(&device->readers_lock);
167 if (!device) {
168 pr_emerg("roccat device with minor %d doesn't exist\n", minor);
169 error = -ENODEV;
170 goto exit_err;
173 if (!device->open++) {
174 /* power on device on adding first reader */
175 error = hid_hw_power(device->hid, PM_HINT_FULLON);
176 if (error < 0) {
177 --device->open;
178 goto exit_err;
181 error = hid_hw_open(device->hid);
182 if (error < 0) {
183 hid_hw_power(device->hid, PM_HINT_NORMAL);
184 --device->open;
185 goto exit_err;
189 reader->device = device;
190 /* new reader doesn't get old events */
191 reader->cbuf_start = device->cbuf_end;
193 list_add_tail(&reader->node, &device->readers);
194 file->private_data = reader;
196 exit_unlock:
197 mutex_unlock(&device->readers_lock);
198 mutex_unlock(&devices_lock);
199 return error;
200 exit_err:
201 kfree(reader);
202 goto exit_unlock;
205 static int roccat_release(struct inode *inode, struct file *file)
207 unsigned int minor = iminor(inode);
208 struct roccat_reader *reader = file->private_data;
209 struct roccat_device *device;
211 mutex_lock(&devices_lock);
213 device = devices[minor];
214 if (!device) {
215 mutex_unlock(&devices_lock);
216 pr_emerg("roccat device with minor %d doesn't exist\n", minor);
217 return -ENODEV;
220 mutex_lock(&device->readers_lock);
221 list_del(&reader->node);
222 mutex_unlock(&device->readers_lock);
223 kfree(reader);
225 if (!--device->open) {
226 /* removing last reader */
227 if (device->exist) {
228 hid_hw_power(device->hid, PM_HINT_NORMAL);
229 hid_hw_close(device->hid);
230 } else {
231 kfree(device);
235 mutex_unlock(&devices_lock);
237 return 0;
241 * roccat_report_event() - output data to readers
242 * @minor: minor device number returned by roccat_connect()
243 * @data: pointer to data
244 * @len: size of data
246 * Return value is zero on success, a negative error code on failure.
248 * This is called from interrupt handler.
250 int roccat_report_event(int minor, u8 const *data)
252 struct roccat_device *device;
253 struct roccat_reader *reader;
254 struct roccat_report *report;
255 uint8_t *new_value;
257 device = devices[minor];
259 new_value = kmemdup(data, device->report_size, GFP_ATOMIC);
260 if (!new_value)
261 return -ENOMEM;
263 report = &device->cbuf[device->cbuf_end];
265 /* passing NULL is safe */
266 kfree(report->value);
268 report->value = new_value;
269 device->cbuf_end = (device->cbuf_end + 1) % ROCCAT_CBUF_SIZE;
271 list_for_each_entry(reader, &device->readers, node) {
273 * As we already inserted one element, the buffer can't be
274 * empty. If start and end are equal, buffer is full and we
275 * increase start, so that slow reader misses one event, but
276 * gets the newer ones in the right order.
278 if (reader->cbuf_start == device->cbuf_end)
279 reader->cbuf_start = (reader->cbuf_start + 1) % ROCCAT_CBUF_SIZE;
282 wake_up_interruptible(&device->wait);
283 return 0;
285 EXPORT_SYMBOL_GPL(roccat_report_event);
288 * roccat_connect() - create a char device for special event output
289 * @class: the class thats used to create the device. Meant to hold device
290 * specific sysfs attributes.
291 * @hid: the hid device the char device should be connected to.
293 * Return value is minor device number in Range [0, ROCCAT_MAX_DEVICES] on
294 * success, a negative error code on failure.
296 int roccat_connect(struct class *klass, struct hid_device *hid, int report_size)
298 unsigned int minor;
299 struct roccat_device *device;
300 int temp;
302 device = kzalloc(sizeof(struct roccat_device), GFP_KERNEL);
303 if (!device)
304 return -ENOMEM;
306 mutex_lock(&devices_lock);
308 for (minor = 0; minor < ROCCAT_MAX_DEVICES; ++minor) {
309 if (devices[minor])
310 continue;
311 break;
314 if (minor < ROCCAT_MAX_DEVICES) {
315 devices[minor] = device;
316 } else {
317 mutex_unlock(&devices_lock);
318 kfree(device);
319 return -EINVAL;
322 device->dev = device_create(klass, &hid->dev,
323 MKDEV(roccat_major, minor), NULL,
324 "%s%s%d", "roccat", hid->driver->name, minor);
326 if (IS_ERR(device->dev)) {
327 devices[minor] = NULL;
328 mutex_unlock(&devices_lock);
329 temp = PTR_ERR(device->dev);
330 kfree(device);
331 return temp;
334 mutex_unlock(&devices_lock);
336 init_waitqueue_head(&device->wait);
337 INIT_LIST_HEAD(&device->readers);
338 mutex_init(&device->readers_lock);
339 mutex_init(&device->cbuf_lock);
340 device->minor = minor;
341 device->hid = hid;
342 device->exist = 1;
343 device->cbuf_end = 0;
344 device->report_size = report_size;
346 return minor;
348 EXPORT_SYMBOL_GPL(roccat_connect);
350 /* roccat_disconnect() - remove char device from hid device
351 * @minor: the minor device number returned by roccat_connect()
353 void roccat_disconnect(int minor)
355 struct roccat_device *device;
357 mutex_lock(&devices_lock);
358 device = devices[minor];
359 mutex_unlock(&devices_lock);
361 device->exist = 0; /* TODO exist maybe not needed */
363 device_destroy(device->dev->class, MKDEV(roccat_major, minor));
365 mutex_lock(&devices_lock);
366 devices[minor] = NULL;
367 mutex_unlock(&devices_lock);
369 if (device->open) {
370 hid_hw_close(device->hid);
371 wake_up_interruptible(&device->wait);
372 } else {
373 kfree(device);
376 EXPORT_SYMBOL_GPL(roccat_disconnect);
378 static long roccat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
380 struct inode *inode = file->f_path.dentry->d_inode;
381 struct roccat_device *device;
382 unsigned int minor = iminor(inode);
383 long retval = 0;
385 mutex_lock(&devices_lock);
387 device = devices[minor];
388 if (!device) {
389 retval = -ENODEV;
390 goto out;
393 switch (cmd) {
394 case ROCCATIOCGREPSIZE:
395 if (put_user(device->report_size, (int __user *)arg))
396 retval = -EFAULT;
397 break;
398 default:
399 retval = -ENOTTY;
401 out:
402 mutex_unlock(&devices_lock);
403 return retval;
406 static const struct file_operations roccat_ops = {
407 .owner = THIS_MODULE,
408 .read = roccat_read,
409 .poll = roccat_poll,
410 .open = roccat_open,
411 .release = roccat_release,
412 .llseek = noop_llseek,
413 .unlocked_ioctl = roccat_ioctl,
416 static int __init roccat_init(void)
418 int retval;
419 dev_t dev_id;
421 retval = alloc_chrdev_region(&dev_id, ROCCAT_FIRST_MINOR,
422 ROCCAT_MAX_DEVICES, "roccat");
424 roccat_major = MAJOR(dev_id);
426 if (retval < 0) {
427 pr_warn("can't get major number\n");
428 return retval;
431 cdev_init(&roccat_cdev, &roccat_ops);
432 cdev_add(&roccat_cdev, dev_id, ROCCAT_MAX_DEVICES);
434 return 0;
437 static void __exit roccat_exit(void)
439 dev_t dev_id = MKDEV(roccat_major, 0);
441 cdev_del(&roccat_cdev);
442 unregister_chrdev_region(dev_id, ROCCAT_MAX_DEVICES);
445 module_init(roccat_init);
446 module_exit(roccat_exit);
448 MODULE_AUTHOR("Stefan Achatz");
449 MODULE_DESCRIPTION("USB Roccat char device");
450 MODULE_LICENSE("GPL v2");