audit: catch possible NULL audit buffers
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / drivers / hid / hid-sensor-hub.c
blob0bc58bd8d4f5a9e496187310326aff7e031e74f0
1 /*
2 * HID Sensors Driver
3 * Copyright (c) 2012, Intel Corporation.
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms and conditions of the GNU General Public License,
7 * version 2, as published by the Free Software Foundation.
9 * This program is distributed in the hope it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
12 * more details.
14 * You should have received a copy of the GNU General Public License along with
15 * this program; if not, write to the Free Software Foundation, Inc.,
16 * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
19 #include <linux/device.h>
20 #include <linux/hid.h>
21 #include <linux/usb.h>
22 #include "usbhid/usbhid.h"
23 #include <linux/module.h>
24 #include <linux/slab.h>
25 #include <linux/mfd/core.h>
26 #include <linux/list.h>
27 #include <linux/hid-sensor-ids.h>
28 #include <linux/hid-sensor-hub.h>
29 #include "hid-ids.h"
31 /**
32 * struct sensor_hub_pending - Synchronous read pending information
33 * @status: Pending status true/false.
34 * @ready: Completion synchronization data.
35 * @usage_id: Usage id for physical device, E.g. Gyro usage id.
36 * @attr_usage_id: Usage Id of a field, E.g. X-AXIS for a gyro.
37 * @raw_size: Response size for a read request.
38 * @raw_data: Place holder for received response.
40 struct sensor_hub_pending {
41 bool status;
42 struct completion ready;
43 u32 usage_id;
44 u32 attr_usage_id;
45 int raw_size;
46 u8 *raw_data;
49 /**
50 * struct sensor_hub_data - Hold a instance data for a HID hub device
51 * @hsdev: Stored hid instance for current hub device.
52 * @mutex: Mutex to serialize synchronous request.
53 * @lock: Spin lock to protect pending request structure.
54 * @pending: Holds information of pending sync read request.
55 * @dyn_callback_list: Holds callback function
56 * @dyn_callback_lock: spin lock to protect callback list
57 * @hid_sensor_hub_client_devs: Stores all MFD cells for a hub instance.
58 * @hid_sensor_client_cnt: Number of MFD cells, (no of sensors attached).
60 struct sensor_hub_data {
61 struct hid_sensor_hub_device *hsdev;
62 struct mutex mutex;
63 spinlock_t lock;
64 struct sensor_hub_pending pending;
65 struct list_head dyn_callback_list;
66 spinlock_t dyn_callback_lock;
67 struct mfd_cell *hid_sensor_hub_client_devs;
68 int hid_sensor_client_cnt;
71 /**
72 * struct hid_sensor_hub_callbacks_list - Stores callback list
73 * @list: list head.
74 * @usage_id: usage id for a physical device.
75 * @usage_callback: Stores registered callback functions.
76 * @priv: Private data for a physical device.
78 struct hid_sensor_hub_callbacks_list {
79 struct list_head list;
80 u32 usage_id;
81 struct hid_sensor_hub_callbacks *usage_callback;
82 void *priv;
85 static struct hid_report *sensor_hub_report(int id, struct hid_device *hdev,
86 int dir)
88 struct hid_report *report;
90 list_for_each_entry(report, &hdev->report_enum[dir].report_list, list) {
91 if (report->id == id)
92 return report;
94 hid_warn(hdev, "No report with id 0x%x found\n", id);
96 return NULL;
99 static int sensor_hub_get_physical_device_count(
100 struct hid_report_enum *report_enum)
102 struct hid_report *report;
103 struct hid_field *field;
104 int cnt = 0;
106 list_for_each_entry(report, &report_enum->report_list, list) {
107 field = report->field[0];
108 if (report->maxfield && field &&
109 field->physical)
110 cnt++;
113 return cnt;
116 static void sensor_hub_fill_attr_info(
117 struct hid_sensor_hub_attribute_info *info,
118 s32 index, s32 report_id, s32 units, s32 unit_expo, s32 size)
120 info->index = index;
121 info->report_id = report_id;
122 info->units = units;
123 info->unit_expo = unit_expo;
124 info->size = size/8;
127 static struct hid_sensor_hub_callbacks *sensor_hub_get_callback(
128 struct hid_device *hdev,
129 u32 usage_id, void **priv)
131 struct hid_sensor_hub_callbacks_list *callback;
132 struct sensor_hub_data *pdata = hid_get_drvdata(hdev);
134 spin_lock(&pdata->dyn_callback_lock);
135 list_for_each_entry(callback, &pdata->dyn_callback_list, list)
136 if (callback->usage_id == usage_id) {
137 *priv = callback->priv;
138 spin_unlock(&pdata->dyn_callback_lock);
139 return callback->usage_callback;
141 spin_unlock(&pdata->dyn_callback_lock);
143 return NULL;
146 int sensor_hub_register_callback(struct hid_sensor_hub_device *hsdev,
147 u32 usage_id,
148 struct hid_sensor_hub_callbacks *usage_callback)
150 struct hid_sensor_hub_callbacks_list *callback;
151 struct sensor_hub_data *pdata = hid_get_drvdata(hsdev->hdev);
153 spin_lock(&pdata->dyn_callback_lock);
154 list_for_each_entry(callback, &pdata->dyn_callback_list, list)
155 if (callback->usage_id == usage_id) {
156 spin_unlock(&pdata->dyn_callback_lock);
157 return -EINVAL;
159 callback = kzalloc(sizeof(*callback), GFP_ATOMIC);
160 if (!callback) {
161 spin_unlock(&pdata->dyn_callback_lock);
162 return -ENOMEM;
164 callback->usage_callback = usage_callback;
165 callback->usage_id = usage_id;
166 callback->priv = NULL;
167 list_add_tail(&callback->list, &pdata->dyn_callback_list);
168 spin_unlock(&pdata->dyn_callback_lock);
170 return 0;
172 EXPORT_SYMBOL_GPL(sensor_hub_register_callback);
174 int sensor_hub_remove_callback(struct hid_sensor_hub_device *hsdev,
175 u32 usage_id)
177 struct hid_sensor_hub_callbacks_list *callback;
178 struct sensor_hub_data *pdata = hid_get_drvdata(hsdev->hdev);
180 spin_lock(&pdata->dyn_callback_lock);
181 list_for_each_entry(callback, &pdata->dyn_callback_list, list)
182 if (callback->usage_id == usage_id) {
183 list_del(&callback->list);
184 kfree(callback);
185 break;
187 spin_unlock(&pdata->dyn_callback_lock);
189 return 0;
191 EXPORT_SYMBOL_GPL(sensor_hub_remove_callback);
193 int sensor_hub_set_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
194 u32 field_index, s32 value)
196 struct hid_report *report;
197 struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev);
198 int ret = 0;
200 mutex_lock(&data->mutex);
201 report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
202 if (!report || (field_index >= report->maxfield)) {
203 ret = -EINVAL;
204 goto done_proc;
206 hid_set_field(report->field[field_index], 0, value);
207 usbhid_submit_report(hsdev->hdev, report, USB_DIR_OUT);
208 usbhid_wait_io(hsdev->hdev);
210 done_proc:
211 mutex_unlock(&data->mutex);
213 return ret;
215 EXPORT_SYMBOL_GPL(sensor_hub_set_feature);
217 int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
218 u32 field_index, s32 *value)
220 struct hid_report *report;
221 struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev);
222 int ret = 0;
224 mutex_lock(&data->mutex);
225 report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
226 if (!report || (field_index >= report->maxfield)) {
227 ret = -EINVAL;
228 goto done_proc;
230 usbhid_submit_report(hsdev->hdev, report, USB_DIR_IN);
231 usbhid_wait_io(hsdev->hdev);
232 *value = report->field[field_index]->value[0];
234 done_proc:
235 mutex_unlock(&data->mutex);
237 return ret;
239 EXPORT_SYMBOL_GPL(sensor_hub_get_feature);
242 int sensor_hub_input_attr_get_raw_value(struct hid_sensor_hub_device *hsdev,
243 u32 usage_id,
244 u32 attr_usage_id, u32 report_id)
246 struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev);
247 unsigned long flags;
248 struct hid_report *report;
249 int ret_val = 0;
251 mutex_lock(&data->mutex);
252 memset(&data->pending, 0, sizeof(data->pending));
253 init_completion(&data->pending.ready);
254 data->pending.usage_id = usage_id;
255 data->pending.attr_usage_id = attr_usage_id;
256 data->pending.raw_size = 0;
258 spin_lock_irqsave(&data->lock, flags);
259 data->pending.status = true;
260 report = sensor_hub_report(report_id, hsdev->hdev, HID_INPUT_REPORT);
261 if (!report) {
262 spin_unlock_irqrestore(&data->lock, flags);
263 goto err_free;
265 usbhid_submit_report(hsdev->hdev, report, USB_DIR_IN);
266 spin_unlock_irqrestore(&data->lock, flags);
267 wait_for_completion_interruptible_timeout(&data->pending.ready, HZ*5);
268 switch (data->pending.raw_size) {
269 case 1:
270 ret_val = *(u8 *)data->pending.raw_data;
271 break;
272 case 2:
273 ret_val = *(u16 *)data->pending.raw_data;
274 break;
275 case 4:
276 ret_val = *(u32 *)data->pending.raw_data;
277 break;
278 default:
279 ret_val = 0;
281 kfree(data->pending.raw_data);
283 err_free:
284 data->pending.status = false;
285 mutex_unlock(&data->mutex);
287 return ret_val;
289 EXPORT_SYMBOL_GPL(sensor_hub_input_attr_get_raw_value);
291 int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
292 u8 type,
293 u32 usage_id,
294 u32 attr_usage_id,
295 struct hid_sensor_hub_attribute_info *info)
297 int ret = -1;
298 int i, j;
299 int collection_index = -1;
300 struct hid_report *report;
301 struct hid_field *field;
302 struct hid_report_enum *report_enum;
303 struct hid_device *hdev = hsdev->hdev;
305 /* Initialize with defaults */
306 info->usage_id = usage_id;
307 info->attrib_id = attr_usage_id;
308 info->report_id = -1;
309 info->index = -1;
310 info->units = -1;
311 info->unit_expo = -1;
313 for (i = 0; i < hdev->maxcollection; ++i) {
314 struct hid_collection *collection = &hdev->collection[i];
315 if (usage_id == collection->usage) {
316 collection_index = i;
317 break;
320 if (collection_index == -1)
321 goto err_ret;
323 report_enum = &hdev->report_enum[type];
324 list_for_each_entry(report, &report_enum->report_list, list) {
325 for (i = 0; i < report->maxfield; ++i) {
326 field = report->field[i];
327 if (field->physical == usage_id &&
328 field->logical == attr_usage_id) {
329 sensor_hub_fill_attr_info(info, i, report->id,
330 field->unit, field->unit_exponent,
331 field->report_size);
332 ret = 0;
333 } else {
334 for (j = 0; j < field->maxusage; ++j) {
335 if (field->usage[j].hid ==
336 attr_usage_id &&
337 field->usage[j].collection_index ==
338 collection_index) {
339 sensor_hub_fill_attr_info(info,
340 i, report->id,
341 field->unit,
342 field->unit_exponent,
343 field->report_size);
344 ret = 0;
345 break;
349 if (ret == 0)
350 break;
354 err_ret:
355 return ret;
357 EXPORT_SYMBOL_GPL(sensor_hub_input_get_attribute_info);
359 #ifdef CONFIG_PM
360 static int sensor_hub_suspend(struct hid_device *hdev, pm_message_t message)
362 struct sensor_hub_data *pdata = hid_get_drvdata(hdev);
363 struct hid_sensor_hub_callbacks_list *callback;
365 hid_dbg(hdev, " sensor_hub_suspend\n");
366 spin_lock(&pdata->dyn_callback_lock);
367 list_for_each_entry(callback, &pdata->dyn_callback_list, list) {
368 if (callback->usage_callback->suspend)
369 callback->usage_callback->suspend(
370 pdata->hsdev, callback->priv);
372 spin_unlock(&pdata->dyn_callback_lock);
374 return 0;
377 static int sensor_hub_resume(struct hid_device *hdev)
379 struct sensor_hub_data *pdata = hid_get_drvdata(hdev);
380 struct hid_sensor_hub_callbacks_list *callback;
382 hid_dbg(hdev, " sensor_hub_resume\n");
383 spin_lock(&pdata->dyn_callback_lock);
384 list_for_each_entry(callback, &pdata->dyn_callback_list, list) {
385 if (callback->usage_callback->resume)
386 callback->usage_callback->resume(
387 pdata->hsdev, callback->priv);
389 spin_unlock(&pdata->dyn_callback_lock);
391 return 0;
394 static int sensor_hub_reset_resume(struct hid_device *hdev)
396 return 0;
398 #endif
400 * Handle raw report as sent by device
402 static int sensor_hub_raw_event(struct hid_device *hdev,
403 struct hid_report *report, u8 *raw_data, int size)
405 int i;
406 u8 *ptr;
407 int sz;
408 struct sensor_hub_data *pdata = hid_get_drvdata(hdev);
409 unsigned long flags;
410 struct hid_sensor_hub_callbacks *callback = NULL;
411 struct hid_collection *collection = NULL;
412 void *priv = NULL;
414 hid_dbg(hdev, "sensor_hub_raw_event report id:0x%x size:%d type:%d\n",
415 report->id, size, report->type);
416 hid_dbg(hdev, "maxfield:%d\n", report->maxfield);
417 if (report->type != HID_INPUT_REPORT)
418 return 1;
420 ptr = raw_data;
421 ptr++; /*Skip report id*/
423 spin_lock_irqsave(&pdata->lock, flags);
425 for (i = 0; i < report->maxfield; ++i) {
427 hid_dbg(hdev, "%d collection_index:%x hid:%x sz:%x\n",
428 i, report->field[i]->usage->collection_index,
429 report->field[i]->usage->hid,
430 report->field[i]->report_size/8);
432 sz = report->field[i]->report_size/8;
433 if (pdata->pending.status && pdata->pending.attr_usage_id ==
434 report->field[i]->usage->hid) {
435 hid_dbg(hdev, "data was pending ...\n");
436 pdata->pending.raw_data = kmalloc(sz, GFP_ATOMIC);
437 if (pdata->pending.raw_data) {
438 memcpy(pdata->pending.raw_data, ptr, sz);
439 pdata->pending.raw_size = sz;
440 } else
441 pdata->pending.raw_size = 0;
442 complete(&pdata->pending.ready);
444 collection = &hdev->collection[
445 report->field[i]->usage->collection_index];
446 hid_dbg(hdev, "collection->usage %x\n",
447 collection->usage);
448 callback = sensor_hub_get_callback(pdata->hsdev->hdev,
449 report->field[i]->physical,
450 &priv);
451 if (callback && callback->capture_sample) {
452 if (report->field[i]->logical)
453 callback->capture_sample(pdata->hsdev,
454 report->field[i]->logical, sz, ptr,
455 callback->pdev);
456 else
457 callback->capture_sample(pdata->hsdev,
458 report->field[i]->usage->hid, sz, ptr,
459 callback->pdev);
461 ptr += sz;
463 if (callback && collection && callback->send_event)
464 callback->send_event(pdata->hsdev, collection->usage,
465 callback->pdev);
466 spin_unlock_irqrestore(&pdata->lock, flags);
468 return 1;
471 static int sensor_hub_probe(struct hid_device *hdev,
472 const struct hid_device_id *id)
474 int ret;
475 struct sensor_hub_data *sd;
476 int i;
477 char *name;
478 struct hid_report *report;
479 struct hid_report_enum *report_enum;
480 struct hid_field *field;
481 int dev_cnt;
483 sd = kzalloc(sizeof(struct sensor_hub_data), GFP_KERNEL);
484 if (!sd) {
485 hid_err(hdev, "cannot allocate Sensor data\n");
486 return -ENOMEM;
488 sd->hsdev = kzalloc(sizeof(struct hid_sensor_hub_device), GFP_KERNEL);
489 if (!sd->hsdev) {
490 hid_err(hdev, "cannot allocate hid_sensor_hub_device\n");
491 ret = -ENOMEM;
492 goto err_free_hub;
494 hid_set_drvdata(hdev, sd);
495 sd->hsdev->hdev = hdev;
496 sd->hsdev->vendor_id = hdev->vendor;
497 sd->hsdev->product_id = hdev->product;
498 spin_lock_init(&sd->lock);
499 spin_lock_init(&sd->dyn_callback_lock);
500 mutex_init(&sd->mutex);
501 ret = hid_parse(hdev);
502 if (ret) {
503 hid_err(hdev, "parse failed\n");
504 goto err_free;
506 INIT_LIST_HEAD(&hdev->inputs);
508 ret = hid_hw_start(hdev, 0);
509 if (ret) {
510 hid_err(hdev, "hw start failed\n");
511 goto err_free;
513 ret = hid_hw_open(hdev);
514 if (ret) {
515 hid_err(hdev, "failed to open input interrupt pipe\n");
516 goto err_stop_hw;
519 INIT_LIST_HEAD(&sd->dyn_callback_list);
520 sd->hid_sensor_client_cnt = 0;
521 report_enum = &hdev->report_enum[HID_INPUT_REPORT];
523 dev_cnt = sensor_hub_get_physical_device_count(report_enum);
524 if (dev_cnt > HID_MAX_PHY_DEVICES) {
525 hid_err(hdev, "Invalid Physical device count\n");
526 ret = -EINVAL;
527 goto err_close;
529 sd->hid_sensor_hub_client_devs = kzalloc(dev_cnt *
530 sizeof(struct mfd_cell),
531 GFP_KERNEL);
532 if (sd->hid_sensor_hub_client_devs == NULL) {
533 hid_err(hdev, "Failed to allocate memory for mfd cells\n");
534 ret = -ENOMEM;
535 goto err_close;
537 list_for_each_entry(report, &report_enum->report_list, list) {
538 hid_dbg(hdev, "Report id:%x\n", report->id);
539 field = report->field[0];
540 if (report->maxfield && field &&
541 field->physical) {
542 name = kasprintf(GFP_KERNEL, "HID-SENSOR-%x",
543 field->physical);
544 if (name == NULL) {
545 hid_err(hdev, "Failed MFD device name\n");
546 ret = -ENOMEM;
547 goto err_free_names;
549 sd->hid_sensor_hub_client_devs[
550 sd->hid_sensor_client_cnt].name = name;
551 sd->hid_sensor_hub_client_devs[
552 sd->hid_sensor_client_cnt].platform_data =
553 sd->hsdev;
554 sd->hid_sensor_hub_client_devs[
555 sd->hid_sensor_client_cnt].pdata_size =
556 sizeof(*sd->hsdev);
557 hid_dbg(hdev, "Adding %s:%p\n", name, sd);
558 sd->hid_sensor_client_cnt++;
561 ret = mfd_add_devices(&hdev->dev, 0, sd->hid_sensor_hub_client_devs,
562 sd->hid_sensor_client_cnt, NULL, 0, NULL);
563 if (ret < 0)
564 goto err_free_names;
566 return ret;
568 err_free_names:
569 for (i = 0; i < sd->hid_sensor_client_cnt ; ++i)
570 kfree(sd->hid_sensor_hub_client_devs[i].name);
571 kfree(sd->hid_sensor_hub_client_devs);
572 err_close:
573 hid_hw_close(hdev);
574 err_stop_hw:
575 hid_hw_stop(hdev);
576 err_free:
577 kfree(sd->hsdev);
578 err_free_hub:
579 kfree(sd);
581 return ret;
584 static void sensor_hub_remove(struct hid_device *hdev)
586 struct sensor_hub_data *data = hid_get_drvdata(hdev);
587 unsigned long flags;
588 int i;
590 hid_dbg(hdev, " hardware removed\n");
591 hid_hw_close(hdev);
592 hid_hw_stop(hdev);
593 spin_lock_irqsave(&data->lock, flags);
594 if (data->pending.status)
595 complete(&data->pending.ready);
596 spin_unlock_irqrestore(&data->lock, flags);
597 mfd_remove_devices(&hdev->dev);
598 for (i = 0; i < data->hid_sensor_client_cnt ; ++i)
599 kfree(data->hid_sensor_hub_client_devs[i].name);
600 kfree(data->hid_sensor_hub_client_devs);
601 hid_set_drvdata(hdev, NULL);
602 mutex_destroy(&data->mutex);
603 kfree(data->hsdev);
604 kfree(data);
607 static const struct hid_device_id sensor_hub_devices[] = {
608 { HID_DEVICE(BUS_USB, HID_GROUP_SENSOR_HUB, HID_ANY_ID, HID_ANY_ID) },
611 MODULE_DEVICE_TABLE(hid, sensor_hub_devices);
613 static const struct hid_usage_id sensor_hub_grabbed_usages[] = {
614 { HID_ANY_ID, HID_ANY_ID, HID_ANY_ID },
615 { HID_ANY_ID - 1, HID_ANY_ID - 1, HID_ANY_ID - 1 }
618 static struct hid_driver sensor_hub_driver = {
619 .name = "hid-sensor-hub",
620 .id_table = sensor_hub_devices,
621 .probe = sensor_hub_probe,
622 .remove = sensor_hub_remove,
623 .raw_event = sensor_hub_raw_event,
624 #ifdef CONFIG_PM
625 .suspend = sensor_hub_suspend,
626 .resume = sensor_hub_resume,
627 .reset_resume = sensor_hub_reset_resume,
628 #endif
631 static int __init sensor_hub_init(void)
633 return hid_register_driver(&sensor_hub_driver);
636 static void __exit sensor_hub_exit(void)
638 hid_unregister_driver(&sensor_hub_driver);
641 module_init(sensor_hub_init);
642 module_exit(sensor_hub_exit);
644 MODULE_DESCRIPTION("HID Sensor Hub driver");
645 MODULE_AUTHOR("Srinivas Pandruvada <srinivas.pandruvada@intel.com>");
646 MODULE_LICENSE("GPL");