HID: picoLCD: prevent NULL pointer dereferences
[deliverable/linux.git] / drivers / hid / hid-picolcd_fb.c
CommitLineData
fabdbf2f
BP
1/***************************************************************************
2 * Copyright (C) 2010-2012 by Bruno Prémont <bonbons@linux-vserver.org> *
3 * *
4 * Based on Logitech G13 driver (v0.4) *
5 * Copyright (C) 2009 by Rick L. Vinyard, Jr. <rvinyard@cs.nmsu.edu> *
6 * *
7 * This program is free software: you can redistribute it and/or modify *
8 * it under the terms of the GNU General Public License as published by *
9 * the Free Software Foundation, version 2 of the License. *
10 * *
11 * This driver is distributed in the hope that it will be useful, but *
12 * WITHOUT ANY WARRANTY; without even the implied warranty of *
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU *
14 * General Public License for more details. *
15 * *
16 * You should have received a copy of the GNU General Public License *
17 * along with this software. If not see <http://www.gnu.org/licenses/>. *
18 ***************************************************************************/
19
20#include <linux/hid.h>
d1c60a03 21#include <linux/vmalloc.h>
fabdbf2f
BP
22#include "usbhid/usbhid.h"
23#include <linux/usb.h>
24
25#include <linux/fb.h>
26#include <linux/module.h>
27
28#include "hid-picolcd.h"
29
30/* Framebuffer
31 *
32 * The PicoLCD use a Topway LCD module of 256x64 pixel
33 * This display area is tiled over 4 controllers with 8 tiles
34 * each. Each tile has 8x64 pixel, each data byte representing
35 * a 1-bit wide vertical line of the tile.
36 *
37 * The display can be updated at a tile granularity.
38 *
39 * Chip 1 Chip 2 Chip 3 Chip 4
40 * +----------------+----------------+----------------+----------------+
41 * | Tile 1 | Tile 1 | Tile 1 | Tile 1 |
42 * +----------------+----------------+----------------+----------------+
43 * | Tile 2 | Tile 2 | Tile 2 | Tile 2 |
44 * +----------------+----------------+----------------+----------------+
45 * ...
46 * +----------------+----------------+----------------+----------------+
47 * | Tile 8 | Tile 8 | Tile 8 | Tile 8 |
48 * +----------------+----------------+----------------+----------------+
49 */
50#define PICOLCDFB_NAME "picolcdfb"
51#define PICOLCDFB_WIDTH (256)
52#define PICOLCDFB_HEIGHT (64)
53#define PICOLCDFB_SIZE (PICOLCDFB_WIDTH * PICOLCDFB_HEIGHT / 8)
54
55#define PICOLCDFB_UPDATE_RATE_LIMIT 10
56#define PICOLCDFB_UPDATE_RATE_DEFAULT 2
57
58/* Framebuffer visual structures */
59static const struct fb_fix_screeninfo picolcdfb_fix = {
60 .id = PICOLCDFB_NAME,
61 .type = FB_TYPE_PACKED_PIXELS,
62 .visual = FB_VISUAL_MONO01,
63 .xpanstep = 0,
64 .ypanstep = 0,
65 .ywrapstep = 0,
66 .line_length = PICOLCDFB_WIDTH / 8,
67 .accel = FB_ACCEL_NONE,
68};
69
70static const struct fb_var_screeninfo picolcdfb_var = {
71 .xres = PICOLCDFB_WIDTH,
72 .yres = PICOLCDFB_HEIGHT,
73 .xres_virtual = PICOLCDFB_WIDTH,
74 .yres_virtual = PICOLCDFB_HEIGHT,
75 .width = 103,
76 .height = 26,
77 .bits_per_pixel = 1,
78 .grayscale = 1,
79 .red = {
80 .offset = 0,
81 .length = 1,
82 .msb_right = 0,
83 },
84 .green = {
85 .offset = 0,
86 .length = 1,
87 .msb_right = 0,
88 },
89 .blue = {
90 .offset = 0,
91 .length = 1,
92 .msb_right = 0,
93 },
94 .transp = {
95 .offset = 0,
96 .length = 0,
97 .msb_right = 0,
98 },
99};
100
101/* Send a given tile to PicoLCD */
102static int picolcd_fb_send_tile(struct hid_device *hdev, int chip, int tile)
103{
104 struct picolcd_data *data = hid_get_drvdata(hdev);
105 struct hid_report *report1 = picolcd_out_report(REPORT_LCD_CMD_DATA, hdev);
106 struct hid_report *report2 = picolcd_out_report(REPORT_LCD_DATA, hdev);
107 unsigned long flags;
108 u8 *tdata;
109 int i;
110
111 if (!report1 || report1->maxfield != 1 || !report2 || report2->maxfield != 1)
112 return -ENODEV;
113
114 spin_lock_irqsave(&data->lock, flags);
115 hid_set_field(report1->field[0], 0, chip << 2);
116 hid_set_field(report1->field[0], 1, 0x02);
117 hid_set_field(report1->field[0], 2, 0x00);
118 hid_set_field(report1->field[0], 3, 0x00);
119 hid_set_field(report1->field[0], 4, 0xb8 | tile);
120 hid_set_field(report1->field[0], 5, 0x00);
121 hid_set_field(report1->field[0], 6, 0x00);
122 hid_set_field(report1->field[0], 7, 0x40);
123 hid_set_field(report1->field[0], 8, 0x00);
124 hid_set_field(report1->field[0], 9, 0x00);
125 hid_set_field(report1->field[0], 10, 32);
126
127 hid_set_field(report2->field[0], 0, (chip << 2) | 0x01);
128 hid_set_field(report2->field[0], 1, 0x00);
129 hid_set_field(report2->field[0], 2, 0x00);
130 hid_set_field(report2->field[0], 3, 32);
131
132 tdata = data->fb_vbitmap + (tile * 4 + chip) * 64;
133 for (i = 0; i < 64; i++)
134 if (i < 32)
135 hid_set_field(report1->field[0], 11 + i, tdata[i]);
136 else
137 hid_set_field(report2->field[0], 4 + i - 32, tdata[i]);
138
139 usbhid_submit_report(data->hdev, report1, USB_DIR_OUT);
140 usbhid_submit_report(data->hdev, report2, USB_DIR_OUT);
141 spin_unlock_irqrestore(&data->lock, flags);
142 return 0;
143}
144
145/* Translate a single tile*/
146static int picolcd_fb_update_tile(u8 *vbitmap, const u8 *bitmap, int bpp,
147 int chip, int tile)
148{
149 int i, b, changed = 0;
150 u8 tdata[64];
151 u8 *vdata = vbitmap + (tile * 4 + chip) * 64;
152
153 if (bpp == 1) {
154 for (b = 7; b >= 0; b--) {
155 const u8 *bdata = bitmap + tile * 256 + chip * 8 + b * 32;
156 for (i = 0; i < 64; i++) {
157 tdata[i] <<= 1;
158 tdata[i] |= (bdata[i/8] >> (i % 8)) & 0x01;
159 }
160 }
161 } else if (bpp == 8) {
162 for (b = 7; b >= 0; b--) {
163 const u8 *bdata = bitmap + (tile * 256 + chip * 8 + b * 32) * 8;
164 for (i = 0; i < 64; i++) {
165 tdata[i] <<= 1;
166 tdata[i] |= (bdata[i] & 0x80) ? 0x01 : 0x00;
167 }
168 }
169 } else {
170 /* Oops, we should never get here! */
171 WARN_ON(1);
172 return 0;
173 }
174
175 for (i = 0; i < 64; i++)
176 if (tdata[i] != vdata[i]) {
177 changed = 1;
178 vdata[i] = tdata[i];
179 }
180 return changed;
181}
182
183void picolcd_fb_refresh(struct picolcd_data *data)
184{
185 if (data->fb_info)
186 schedule_delayed_work(&data->fb_info->deferred_work, 0);
187}
188
189/* Reconfigure LCD display */
190int picolcd_fb_reset(struct picolcd_data *data, int clear)
191{
192 struct hid_report *report = picolcd_out_report(REPORT_LCD_CMD, data->hdev);
193 int i, j;
194 unsigned long flags;
195 static const u8 mapcmd[8] = { 0x00, 0x02, 0x00, 0x64, 0x3f, 0x00, 0x64, 0xc0 };
196
197 if (!report || report->maxfield != 1)
198 return -ENODEV;
199
200 spin_lock_irqsave(&data->lock, flags);
201 for (i = 0; i < 4; i++) {
202 for (j = 0; j < report->field[0]->maxusage; j++)
203 if (j == 0)
204 hid_set_field(report->field[0], j, i << 2);
205 else if (j < sizeof(mapcmd))
206 hid_set_field(report->field[0], j, mapcmd[j]);
207 else
208 hid_set_field(report->field[0], j, 0);
209 usbhid_submit_report(data->hdev, report, USB_DIR_OUT);
210 }
211
212 data->status |= PICOLCD_READY_FB;
213 spin_unlock_irqrestore(&data->lock, flags);
214
215 if (data->fb_bitmap) {
216 if (clear) {
217 memset(data->fb_vbitmap, 0, PICOLCDFB_SIZE);
218 memset(data->fb_bitmap, 0, PICOLCDFB_SIZE*data->fb_bpp);
219 }
220 data->fb_force = 1;
221 }
222
223 /* schedule first output of framebuffer */
224 picolcd_fb_refresh(data);
225
226 return 0;
227}
228
229/* Update fb_vbitmap from the screen_base and send changed tiles to device */
a93ab849 230static void picolcd_fb_update(struct fb_info *info)
fabdbf2f
BP
231{
232 int chip, tile, n;
233 unsigned long flags;
a93ab849 234 struct picolcd_data *data;
fabdbf2f 235
a93ab849
BP
236 mutex_lock(&info->lock);
237 data = info->par;
fabdbf2f 238 if (!data)
a93ab849 239 goto out;
fabdbf2f
BP
240
241 spin_lock_irqsave(&data->lock, flags);
242 if (!(data->status & PICOLCD_READY_FB)) {
243 spin_unlock_irqrestore(&data->lock, flags);
244 picolcd_fb_reset(data, 0);
245 } else {
246 spin_unlock_irqrestore(&data->lock, flags);
247 }
248
249 /*
250 * Translate the framebuffer into the format needed by the PicoLCD.
251 * See display layout above.
252 * Do this one tile after the other and push those tiles that changed.
253 *
254 * Wait for our IO to complete as otherwise we might flood the queue!
255 */
256 n = 0;
257 for (chip = 0; chip < 4; chip++)
258 for (tile = 0; tile < 8; tile++)
259 if (picolcd_fb_update_tile(data->fb_vbitmap,
260 data->fb_bitmap, data->fb_bpp, chip, tile) ||
261 data->fb_force) {
262 n += 2;
fabdbf2f 263 if (n >= HID_OUTPUT_FIFO_SIZE / 2) {
a93ab849 264 mutex_unlock(&info->lock);
fabdbf2f 265 usbhid_wait_io(data->hdev);
a93ab849
BP
266 mutex_lock(&info->lock);
267 data = info->par;
268 if (!data)
269 goto out;
270 spin_lock_irqsave(&data->lock, flags);
271 if (data->status & PICOLCD_FAILED) {
272 spin_unlock_irqrestore(&data->lock, flags);
273 goto out;
274 }
275 spin_unlock_irqrestore(&data->lock, flags);
fabdbf2f
BP
276 n = 0;
277 }
278 picolcd_fb_send_tile(data->hdev, chip, tile);
279 }
280 data->fb_force = false;
a93ab849
BP
281 if (n) {
282 mutex_unlock(&info->lock);
fabdbf2f 283 usbhid_wait_io(data->hdev);
a93ab849
BP
284 return;
285 }
286out:
287 mutex_unlock(&info->lock);
fabdbf2f
BP
288}
289
290/* Stub to call the system default and update the image on the picoLCD */
291static void picolcd_fb_fillrect(struct fb_info *info,
292 const struct fb_fillrect *rect)
293{
294 if (!info->par)
295 return;
296 sys_fillrect(info, rect);
297
298 schedule_delayed_work(&info->deferred_work, 0);
299}
300
301/* Stub to call the system default and update the image on the picoLCD */
302static void picolcd_fb_copyarea(struct fb_info *info,
303 const struct fb_copyarea *area)
304{
305 if (!info->par)
306 return;
307 sys_copyarea(info, area);
308
309 schedule_delayed_work(&info->deferred_work, 0);
310}
311
312/* Stub to call the system default and update the image on the picoLCD */
313static void picolcd_fb_imageblit(struct fb_info *info, const struct fb_image *image)
314{
315 if (!info->par)
316 return;
317 sys_imageblit(info, image);
318
319 schedule_delayed_work(&info->deferred_work, 0);
320}
321
322/*
323 * this is the slow path from userspace. they can seek and write to
324 * the fb. it's inefficient to do anything less than a full screen draw
325 */
326static ssize_t picolcd_fb_write(struct fb_info *info, const char __user *buf,
327 size_t count, loff_t *ppos)
328{
329 ssize_t ret;
330 if (!info->par)
331 return -ENODEV;
332 ret = fb_sys_write(info, buf, count, ppos);
333 if (ret >= 0)
334 schedule_delayed_work(&info->deferred_work, 0);
335 return ret;
336}
337
338static int picolcd_fb_blank(int blank, struct fb_info *info)
339{
340 if (!info->par)
341 return -ENODEV;
342 /* We let fb notification do this for us via lcd/backlight device */
343 return 0;
344}
345
346static void picolcd_fb_destroy(struct fb_info *info)
347{
9966c37c 348 /* make sure no work is deferred */
a93ab849 349 fb_deferred_io_cleanup(info);
fabdbf2f 350
9966c37c
BP
351 vfree((u8 *)info->fix.smem_start);
352 framebuffer_release(info);
a93ab849 353 printk(KERN_DEBUG "picolcd_fb_destroy(%p)\n", info);
fabdbf2f
BP
354}
355
356static int picolcd_fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
357{
358 __u32 bpp = var->bits_per_pixel;
359 __u32 activate = var->activate;
360
361 /* only allow 1/8 bit depth (8-bit is grayscale) */
362 *var = picolcdfb_var;
363 var->activate = activate;
364 if (bpp >= 8) {
365 var->bits_per_pixel = 8;
366 var->red.length = 8;
367 var->green.length = 8;
368 var->blue.length = 8;
369 } else {
370 var->bits_per_pixel = 1;
371 var->red.length = 1;
372 var->green.length = 1;
373 var->blue.length = 1;
374 }
375 return 0;
376}
377
378static int picolcd_set_par(struct fb_info *info)
379{
380 struct picolcd_data *data = info->par;
381 u8 *tmp_fb, *o_fb;
382 if (!data)
383 return -ENODEV;
384 if (info->var.bits_per_pixel == data->fb_bpp)
385 return 0;
386 /* switch between 1/8 bit depths */
387 if (info->var.bits_per_pixel != 1 && info->var.bits_per_pixel != 8)
388 return -EINVAL;
389
390 o_fb = data->fb_bitmap;
391 tmp_fb = kmalloc(PICOLCDFB_SIZE*info->var.bits_per_pixel, GFP_KERNEL);
392 if (!tmp_fb)
393 return -ENOMEM;
394
395 /* translate FB content to new bits-per-pixel */
396 if (info->var.bits_per_pixel == 1) {
397 int i, b;
398 for (i = 0; i < PICOLCDFB_SIZE; i++) {
399 u8 p = 0;
400 for (b = 0; b < 8; b++) {
401 p <<= 1;
402 p |= o_fb[i*8+b] ? 0x01 : 0x00;
403 }
404 tmp_fb[i] = p;
405 }
406 memcpy(o_fb, tmp_fb, PICOLCDFB_SIZE);
407 info->fix.visual = FB_VISUAL_MONO01;
408 info->fix.line_length = PICOLCDFB_WIDTH / 8;
409 } else {
410 int i;
411 memcpy(tmp_fb, o_fb, PICOLCDFB_SIZE);
412 for (i = 0; i < PICOLCDFB_SIZE * 8; i++)
413 o_fb[i] = tmp_fb[i/8] & (0x01 << (7 - i % 8)) ? 0xff : 0x00;
414 info->fix.visual = FB_VISUAL_DIRECTCOLOR;
415 info->fix.line_length = PICOLCDFB_WIDTH;
416 }
417
418 kfree(tmp_fb);
419 data->fb_bpp = info->var.bits_per_pixel;
420 return 0;
421}
422
fabdbf2f
BP
423/* Note this can't be const because of struct fb_info definition */
424static struct fb_ops picolcdfb_ops = {
425 .owner = THIS_MODULE,
426 .fb_destroy = picolcd_fb_destroy,
fabdbf2f
BP
427 .fb_read = fb_sys_read,
428 .fb_write = picolcd_fb_write,
429 .fb_blank = picolcd_fb_blank,
430 .fb_fillrect = picolcd_fb_fillrect,
431 .fb_copyarea = picolcd_fb_copyarea,
432 .fb_imageblit = picolcd_fb_imageblit,
433 .fb_check_var = picolcd_fb_check_var,
434 .fb_set_par = picolcd_set_par,
435};
436
437
438/* Callback from deferred IO workqueue */
439static void picolcd_fb_deferred_io(struct fb_info *info, struct list_head *pagelist)
440{
a93ab849 441 picolcd_fb_update(info);
fabdbf2f
BP
442}
443
444static const struct fb_deferred_io picolcd_fb_defio = {
445 .delay = HZ / PICOLCDFB_UPDATE_RATE_DEFAULT,
446 .deferred_io = picolcd_fb_deferred_io,
447};
448
449
450/*
451 * The "fb_update_rate" sysfs attribute
452 */
453static ssize_t picolcd_fb_update_rate_show(struct device *dev,
454 struct device_attribute *attr, char *buf)
455{
456 struct picolcd_data *data = dev_get_drvdata(dev);
457 unsigned i, fb_update_rate = data->fb_update_rate;
458 size_t ret = 0;
459
460 for (i = 1; i <= PICOLCDFB_UPDATE_RATE_LIMIT; i++)
461 if (ret >= PAGE_SIZE)
462 break;
463 else if (i == fb_update_rate)
464 ret += snprintf(buf+ret, PAGE_SIZE-ret, "[%u] ", i);
465 else
466 ret += snprintf(buf+ret, PAGE_SIZE-ret, "%u ", i);
467 if (ret > 0)
468 buf[min(ret, (size_t)PAGE_SIZE)-1] = '\n';
469 return ret;
470}
471
472static ssize_t picolcd_fb_update_rate_store(struct device *dev,
473 struct device_attribute *attr, const char *buf, size_t count)
474{
475 struct picolcd_data *data = dev_get_drvdata(dev);
476 int i;
477 unsigned u;
478
479 if (count < 1 || count > 10)
480 return -EINVAL;
481
482 i = sscanf(buf, "%u", &u);
483 if (i != 1)
484 return -EINVAL;
485
486 if (u > PICOLCDFB_UPDATE_RATE_LIMIT)
487 return -ERANGE;
488 else if (u == 0)
489 u = PICOLCDFB_UPDATE_RATE_DEFAULT;
490
491 data->fb_update_rate = u;
9966c37c 492 data->fb_info->fbdefio->delay = HZ / data->fb_update_rate;
fabdbf2f
BP
493 return count;
494}
495
496static DEVICE_ATTR(fb_update_rate, 0666, picolcd_fb_update_rate_show,
497 picolcd_fb_update_rate_store);
498
499/* initialize Framebuffer device */
500int picolcd_init_framebuffer(struct picolcd_data *data)
501{
502 struct device *dev = &data->hdev->dev;
503 struct fb_info *info = NULL;
504 int i, error = -ENOMEM;
505 u8 *fb_vbitmap = NULL;
506 u8 *fb_bitmap = NULL;
507 u32 *palette;
508
509 fb_bitmap = vmalloc(PICOLCDFB_SIZE*8);
510 if (fb_bitmap == NULL) {
511 dev_err(dev, "can't get a free page for framebuffer\n");
512 goto err_nomem;
513 }
514
515 fb_vbitmap = kmalloc(PICOLCDFB_SIZE, GFP_KERNEL);
516 if (fb_vbitmap == NULL) {
517 dev_err(dev, "can't alloc vbitmap image buffer\n");
518 goto err_nomem;
519 }
520
521 data->fb_update_rate = PICOLCDFB_UPDATE_RATE_DEFAULT;
fabdbf2f 522 /* The extra memory is:
fabdbf2f 523 * - 256*u32 for pseudo_palette
9966c37c 524 * - struct fb_deferred_io
fabdbf2f 525 */
9966c37c
BP
526 info = framebuffer_alloc(256 * sizeof(u32) +
527 sizeof(struct fb_deferred_io), dev);
fabdbf2f
BP
528 if (info == NULL) {
529 dev_err(dev, "failed to allocate a framebuffer\n");
530 goto err_nomem;
531 }
532
9966c37c
BP
533 info->fbdefio = info->par;
534 *info->fbdefio = picolcd_fb_defio;
535 palette = info->par + sizeof(struct fb_deferred_io);
fabdbf2f
BP
536 for (i = 0; i < 256; i++)
537 palette[i] = i > 0 && i < 16 ? 0xff : 0;
538 info->pseudo_palette = palette;
fabdbf2f
BP
539 info->screen_base = (char __force __iomem *)fb_bitmap;
540 info->fbops = &picolcdfb_ops;
541 info->var = picolcdfb_var;
542 info->fix = picolcdfb_fix;
543 info->fix.smem_len = PICOLCDFB_SIZE*8;
544 info->fix.smem_start = (unsigned long)fb_bitmap;
545 info->par = data;
546 info->flags = FBINFO_FLAG_DEFAULT;
547
548 data->fb_vbitmap = fb_vbitmap;
549 data->fb_bitmap = fb_bitmap;
550 data->fb_bpp = picolcdfb_var.bits_per_pixel;
551 error = picolcd_fb_reset(data, 1);
552 if (error) {
553 dev_err(dev, "failed to configure display\n");
554 goto err_cleanup;
555 }
556 error = device_create_file(dev, &dev_attr_fb_update_rate);
557 if (error) {
558 dev_err(dev, "failed to create sysfs attributes\n");
559 goto err_cleanup;
560 }
561 fb_deferred_io_init(info);
562 data->fb_info = info;
563 error = register_framebuffer(info);
564 if (error) {
565 dev_err(dev, "failed to register framebuffer\n");
566 goto err_sysfs;
567 }
568 /* schedule first output of framebuffer */
569 data->fb_force = 1;
570 schedule_delayed_work(&info->deferred_work, 0);
571 return 0;
572
573err_sysfs:
574 fb_deferred_io_cleanup(info);
575 device_remove_file(dev, &dev_attr_fb_update_rate);
576err_cleanup:
577 data->fb_vbitmap = NULL;
578 data->fb_bitmap = NULL;
579 data->fb_bpp = 0;
580 data->fb_info = NULL;
581
582err_nomem:
583 framebuffer_release(info);
584 vfree(fb_bitmap);
585 kfree(fb_vbitmap);
586 return error;
587}
588
589void picolcd_exit_framebuffer(struct picolcd_data *data)
590{
591 struct fb_info *info = data->fb_info;
592 u8 *fb_vbitmap = data->fb_vbitmap;
593
594 if (!info)
595 return;
596
597 device_remove_file(&data->hdev->dev, &dev_attr_fb_update_rate);
9966c37c 598 info->par = NULL;
fabdbf2f
BP
599 unregister_framebuffer(info);
600 data->fb_vbitmap = NULL;
601 data->fb_bitmap = NULL;
602 data->fb_bpp = 0;
603 data->fb_info = NULL;
604 kfree(fb_vbitmap);
605}
This page took 0.144704 seconds and 5 git commands to generate.