1 files changed, 393 insertions, 297 deletions

diff --git a/drivers/acpi/hotkey.c b/drivers/acpi/hotkey.c
index babdf762ead..1f76a40bade 100644
--- a/drivers/acpi/hotkey.c
+++ b/drivers/acpi/hotkey.c
@@ -1,5 +1,5 @@
-/* 
- *  hotkey.c - ACPI Hotkey Driver ($Revision:$)
+/*
+ *  hotkey.c - ACPI Hotkey Driver ($Revision: 0.2 $)
  *
  *  Copyright (C) 2004 Luming Yu <luming.yu@intel.com>
  *
@@ -51,17 +51,18 @@
 #define ACPI_HOTKEY_POLLING 0x2
 #define ACPI_UNDEFINED_EVENT    0xf
 
-#define MAX_CONFIG_RECORD_LEN   80
-#define MAX_NAME_PATH_LEN   80
-#define MAX_CALL_PARM       80
+#define RESULT_STR_LEN	    80
 
-#define IS_EVENT(e)       0xff	/* ((e) & 0x40000000)  */
-#define IS_POLL(e)      0xff	/* (~((e) & 0x40000000))  */
+#define ACTION_METHOD	0
+#define POLL_METHOD	1
 
+#define IS_EVENT(e)       	((e) <= 10000 && (e) >0)
+#define IS_POLL(e)      	((e) > 10000)
+#define IS_OTHERS(e)		((e)<=0 || (e)>=20000)
 #define _COMPONENT              ACPI_HOTKEY_COMPONENT
 ACPI_MODULE_NAME("acpi_hotkey")
 
-    MODULE_AUTHOR("luming.yu@intel.com");
+MODULE_AUTHOR("luming.yu@intel.com");
 MODULE_DESCRIPTION(ACPI_HOTK_NAME);
 MODULE_LICENSE("GPL");
 
@@ -114,7 +115,7 @@ struct acpi_event_hotkey {
 	char *action_method;	/* action method */
 };
 
-/* 
+/*
  * There are two ways to poll status
  * 1. directy call read_xxx method, without any arguments passed in
  * 2. call write_xxx method, with arguments passed in, you need
@@ -131,7 +132,7 @@ struct acpi_polling_hotkey {
 	char *poll_method;	/* poll method */
 	acpi_handle action_handle;	/* acpi handle attached action method */
 	char *action_method;	/* action method */
-	void *poll_result;	/* polling_result */
+	union acpi_object *poll_result;	/* polling_result */
 	struct proc_dir_entry *proc;
 };
 
@@ -162,20 +163,25 @@ static struct acpi_driver hotkey_driver = {
 		},
 };
 
+static void free_hotkey_device(union acpi_hotkey *key);
+static void free_hotkey_buffer(union acpi_hotkey *key);
+static void free_poll_hotkey_buffer(union acpi_hotkey *key);
 static int hotkey_open_config(struct inode *inode, struct file *file);
+static int hotkey_poll_open_config(struct inode *inode, struct file *file);
 static ssize_t hotkey_write_config(struct file *file,
 				   const char __user * buffer,
 				   size_t count, loff_t * data);
-static ssize_t hotkey_write_poll_config(struct file *file,
-					const char __user * buffer,
-					size_t count, loff_t * data);
 static int hotkey_info_open_fs(struct inode *inode, struct file *file);
 static int hotkey_action_open_fs(struct inode *inode, struct file *file);
 static ssize_t hotkey_execute_aml_method(struct file *file,
 					 const char __user * buffer,
 					 size_t count, loff_t * data);
 static int hotkey_config_seq_show(struct seq_file *seq, void *offset);
+static int hotkey_poll_config_seq_show(struct seq_file *seq, void *offset);
 static int hotkey_polling_open_fs(struct inode *inode, struct file *file);
+static union acpi_hotkey *get_hotkey_by_event(struct
+			      acpi_hotkey_list
+			      *hotkey_list, int event);
 
 /* event based config */
 static struct file_operations hotkey_config_fops = {
@@ -188,9 +194,9 @@ static struct file_operations hotkey_config_fops = {
 
 /* polling based config */
 static struct file_operations hotkey_poll_config_fops = {
-	.open = hotkey_open_config,
+	.open = hotkey_poll_open_config,
 	.read = seq_read,
-	.write = hotkey_write_poll_config,
+	.write = hotkey_write_config,
 	.llseek = seq_lseek,
 	.release = single_release,
 };
@@ -227,7 +233,7 @@ static int hotkey_info_seq_show(struct seq_file *seq, void *offset)
 {
 	ACPI_FUNCTION_TRACE("hotkey_info_seq_show");
 
-	seq_printf(seq, "Hotkey generic driver ver: %s", HOTKEY_ACPI_VERSION);
+	seq_printf(seq, "Hotkey generic driver ver: %s\n", HOTKEY_ACPI_VERSION);
 
 	return_VALUE(0);
 }
@@ -239,27 +245,35 @@ static int hotkey_info_open_fs(struct inode *inode, struct file *file)
 
 static char *format_result(union acpi_object *object)
 {
-	char *buf = (char *)kmalloc(sizeof(union acpi_object), GFP_KERNEL);
-
-	memset(buf, 0, sizeof(union acpi_object));
+	char *buf = NULL;
+	
+	buf = (char *)kmalloc(RESULT_STR_LEN, GFP_KERNEL);
+	if (buf)
+		memset(buf, 0, RESULT_STR_LEN);
+	else
+		goto do_fail;
 
 	/* Now, just support integer type */
 	if (object->type == ACPI_TYPE_INTEGER)
-		sprintf(buf, "%d", (u32) object->integer.value);
-
-	return buf;
+		sprintf(buf, "%d\n", (u32) object->integer.value);
+do_fail:
+	return (buf);
 }
 
 static int hotkey_polling_seq_show(struct seq_file *seq, void *offset)
 {
 	struct acpi_polling_hotkey *poll_hotkey =
 	    (struct acpi_polling_hotkey *)seq->private;
+	char *buf;
 
 	ACPI_FUNCTION_TRACE("hotkey_polling_seq_show");
 
-	if (poll_hotkey->poll_result)
-		seq_printf(seq, "%s", format_result(poll_hotkey->poll_result));
-
+	if (poll_hotkey->poll_result){
+		buf = format_result(poll_hotkey->poll_result);
+		if(buf)
+			seq_printf(seq, "%s", buf);
+		kfree(buf);
+	}
 	return_VALUE(0);
 }
 
@@ -276,19 +290,19 @@ static int hotkey_action_open_fs(struct inode *inode, struct file *file)
 /* Mapping external hotkey number to standardized hotkey event num */
 static int hotkey_get_internal_event(int event, struct acpi_hotkey_list *list)
 {
-	struct list_head *entries, *next;
-	int val = 0;
+	struct list_head *entries;
+	int val = -1;
 
 	ACPI_FUNCTION_TRACE("hotkey_get_internal_event");
 
-	list_for_each_safe(entries, next, list->entries) {
+	list_for_each(entries, list->entries) {
 		union acpi_hotkey *key =
 		    container_of(entries, union acpi_hotkey, entries);
 		if (key->link.hotkey_type == ACPI_HOTKEY_EVENT
-		    && key->event_hotkey.external_hotkey_num == event)
+		    && key->event_hotkey.external_hotkey_num == event){
 			val = key->link.hotkey_standard_num;
-		else
-			val = -1;
+			break;
+		}
 	}
 
 	return_VALUE(val);
@@ -306,7 +320,7 @@ acpi_hotkey_notify_handler(acpi_handle handle, u32 event, void *data)
 		return_VOID;
 
 	internal_event = hotkey_get_internal_event(event, &global_hotkey_list);
-	acpi_bus_generate_event(device, event, 0);
+	acpi_bus_generate_event(device, internal_event, 0);
 
 	return_VOID;
 }
@@ -329,13 +343,17 @@ static int auto_hotkey_remove(struct acpi_device *device, int type)
 static int create_polling_proc(union acpi_hotkey *device)
 {
 	struct proc_dir_entry *proc;
+	char  proc_name[80];
 	mode_t mode;
 
 	ACPI_FUNCTION_TRACE("create_polling_proc");
 	mode = S_IFREG | S_IRUGO | S_IWUGO;
 
-	proc = create_proc_entry(device->poll_hotkey.action_method,
-				 mode, hotkey_proc_dir);
+	sprintf(proc_name, "%d", device->link.hotkey_standard_num);
+	/*
+	strcat(proc_name, device->poll_hotkey.poll_method);
+	*/
+	proc = create_proc_entry(proc_name, mode, hotkey_proc_dir);
 
 	if (!proc) {
 		ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
@@ -353,23 +371,6 @@ static int create_polling_proc(union acpi_hotkey *device)
 	return_VALUE(0);
 }
 
-static int is_valid_acpi_path(const char *pathname)
-{
-	acpi_handle handle;
-	acpi_status status;
-	ACPI_FUNCTION_TRACE("is_valid_acpi_path");
-
-	status = acpi_get_handle(NULL, (char *)pathname, &handle);
-	return_VALUE(!ACPI_FAILURE(status));
-}
-
-static int is_valid_hotkey(union acpi_hotkey *device)
-{
-	ACPI_FUNCTION_TRACE("is_valid_hotkey");
-	/* Implement valid check */
-	return_VALUE(1);
-}
-
 static int hotkey_add(union acpi_hotkey *device)
 {
 	int status = 0;
@@ -378,15 +379,11 @@ static int hotkey_add(union acpi_hotkey *device)
 	ACPI_FUNCTION_TRACE("hotkey_add");
 
 	if (device->link.hotkey_type == ACPI_HOTKEY_EVENT) {
-		status =
-		    acpi_bus_get_device(device->event_hotkey.bus_handle, &dev);
-		if (status)
-			return_VALUE(status);
-
+		acpi_bus_get_device(device->event_hotkey.bus_handle, &dev);
 		status = acpi_install_notify_handler(dev->handle,
-						     ACPI_SYSTEM_NOTIFY,
+						     ACPI_DEVICE_NOTIFY,
 						     acpi_hotkey_notify_handler,
-						     device);
+						     dev);
 	} else			/* Add polling hotkey */
 		create_polling_proc(device);
 
@@ -409,84 +406,143 @@ static int hotkey_remove(union acpi_hotkey *device)
 		if (key->link.hotkey_standard_num ==
 		    device->link.hotkey_standard_num) {
 			list_del(&key->link.entries);
-			remove_proc_entry(key->poll_hotkey.action_method,
-					  hotkey_proc_dir);
+			free_hotkey_device(key);
 			global_hotkey_list.count--;
 			break;
 		}
 	}
+	kfree(device);
 	return_VALUE(0);
 }
 
-static void hotkey_update(union acpi_hotkey *key)
+static int  hotkey_update(union acpi_hotkey *key)
 {
-	struct list_head *entries, *next;
+	struct list_head *entries;
 
 	ACPI_FUNCTION_TRACE("hotkey_update");
 
-	list_for_each_safe(entries, next, global_hotkey_list.entries) {
-		union acpi_hotkey *key =
+	list_for_each(entries, global_hotkey_list.entries) {
+		union acpi_hotkey *tmp=
 		    container_of(entries, union acpi_hotkey, entries);
-		if (key->link.hotkey_standard_num ==
+		if (tmp->link.hotkey_standard_num ==
 		    key->link.hotkey_standard_num) {
-			key->event_hotkey.bus_handle =
-			    key->event_hotkey.bus_handle;
-			key->event_hotkey.external_hotkey_num =
-			    key->event_hotkey.external_hotkey_num;
-			key->event_hotkey.action_handle =
-			    key->event_hotkey.action_handle;
-			key->event_hotkey.action_method =
-			    key->event_hotkey.action_method;
+			if (key->link.hotkey_type == ACPI_HOTKEY_EVENT) {
+				free_hotkey_buffer(tmp);
+				tmp->event_hotkey.bus_handle =
+			    		key->event_hotkey.bus_handle;
+				tmp->event_hotkey.external_hotkey_num =
+			    		key->event_hotkey.external_hotkey_num;
+				tmp->event_hotkey.action_handle =
+			    		key->event_hotkey.action_handle;
+				tmp->event_hotkey.action_method =
+			    		key->event_hotkey.action_method;
+				kfree(key);
+			} else {
+				/*
+				char  proc_name[80];
+
+				sprintf(proc_name, "%d", tmp->link.hotkey_standard_num);
+				strcat(proc_name, tmp->poll_hotkey.poll_method);
+				remove_proc_entry(proc_name,hotkey_proc_dir);
+				*/
+				free_poll_hotkey_buffer(tmp);
+				tmp->poll_hotkey.poll_handle =
+					key->poll_hotkey.poll_handle;
+				tmp->poll_hotkey.poll_method =
+					key->poll_hotkey.poll_method;
+				tmp->poll_hotkey.action_handle =
+					key->poll_hotkey.action_handle;
+				tmp->poll_hotkey.action_method =
+					key->poll_hotkey.action_method;
+				tmp->poll_hotkey.poll_result =
+					key->poll_hotkey.poll_result;
+				/*
+				create_polling_proc(tmp);
+				*/
+				kfree(key);
+			}
+			return_VALUE(0);
 			break;
 		}
 	}
 
-	return_VOID;
+	return_VALUE(-ENODEV);
 }
 
 static void free_hotkey_device(union acpi_hotkey *key)
 {
 	struct acpi_device *dev;
-	int status;
 
 	ACPI_FUNCTION_TRACE("free_hotkey_device");
 
 	if (key->link.hotkey_type == ACPI_HOTKEY_EVENT) {
-		status =
-		    acpi_bus_get_device(key->event_hotkey.bus_handle, &dev);
+		acpi_bus_get_device(key->event_hotkey.bus_handle, &dev);
 		if (dev->handle)
 			acpi_remove_notify_handler(dev->handle,
-						   ACPI_SYSTEM_NOTIFY,
+						   ACPI_DEVICE_NOTIFY,
 						   acpi_hotkey_notify_handler);
-	} else
-		remove_proc_entry(key->poll_hotkey.action_method,
-				  hotkey_proc_dir);
+		free_hotkey_buffer(key);
+	} else {
+		char  proc_name[80];
+
+		sprintf(proc_name, "%d", key->link.hotkey_standard_num);
+		/*
+		strcat(proc_name, key->poll_hotkey.poll_method);
+		*/
+		remove_proc_entry(proc_name,hotkey_proc_dir);
+		free_poll_hotkey_buffer(key);
+	}
 	kfree(key);
 	return_VOID;
 }
 
+static void
+free_hotkey_buffer(union acpi_hotkey *key)
+{
+	kfree(key->event_hotkey.action_method);
+}
+
+static void
+free_poll_hotkey_buffer(union acpi_hotkey *key)
+{
+	kfree(key->poll_hotkey.action_method);
+	kfree(key->poll_hotkey.poll_method);
+	kfree(key->poll_hotkey.poll_result);
+}
 static int
 init_hotkey_device(union acpi_hotkey *key, char *bus_str, char *action_str,
 		   char *method, int std_num, int external_num)
 {
+	acpi_handle	tmp_handle;
+	acpi_status status = AE_OK;
+
 	ACPI_FUNCTION_TRACE("init_hotkey_device");
 
+	if(std_num < 0 || IS_POLL(std_num) || !key )
+		goto do_fail;
+
+	if(!bus_str || !action_str || !method)
+		goto do_fail;
+
 	key->link.hotkey_type = ACPI_HOTKEY_EVENT;
 	key->link.hotkey_standard_num = std_num;
 	key->event_hotkey.flag = 0;
-	if (is_valid_acpi_path(bus_str))
-		acpi_get_handle((acpi_handle) 0,
-				bus_str, &(key->event_hotkey.bus_handle));
-	else
-		return_VALUE(-ENODEV);
-	key->event_hotkey.external_hotkey_num = external_num;
-	if (is_valid_acpi_path(action_str))
-		acpi_get_handle((acpi_handle) 0,
-				action_str, &(key->event_hotkey.action_handle));
-	key->event_hotkey.action_method = kmalloc(sizeof(method), GFP_KERNEL);
-	strcpy(key->event_hotkey.action_method, method);
+	key->event_hotkey.action_method = method;
 
-	return_VALUE(!is_valid_hotkey(key));
+	status = acpi_get_handle(NULL,bus_str, &(key->event_hotkey.bus_handle));
+	if(ACPI_FAILURE(status))
+		goto do_fail;
+	key->event_hotkey.external_hotkey_num = external_num;
+	status = acpi_get_handle(NULL,action_str, &(key->event_hotkey.action_handle));
+	if(ACPI_FAILURE(status))
+		goto do_fail;
+	status = acpi_get_handle(key->event_hotkey.action_handle,
+				method, &tmp_handle);
+	if (ACPI_FAILURE(status))
+		goto do_fail;
+	return_VALUE(AE_OK);
+do_fail:
+	return_VALUE(-ENODEV);
 }
 
 static int
@@ -495,34 +551,46 @@ init_poll_hotkey_device(union acpi_hotkey *key,
 			char *poll_method,
 			char *action_str, char *action_method, int std_num)
 {
+	acpi_status status = AE_OK;
+	acpi_handle	tmp_handle;
+
 	ACPI_FUNCTION_TRACE("init_poll_hotkey_device");
 
+	if(std_num < 0 || IS_EVENT(std_num) || !key)
+		goto do_fail;
+
+	if(!poll_str || !poll_method || !action_str || !action_method)
+		goto do_fail;
+
 	key->link.hotkey_type = ACPI_HOTKEY_POLLING;
 	key->link.hotkey_standard_num = std_num;
 	key->poll_hotkey.flag = 0;
-	if (is_valid_acpi_path(poll_str))
-		acpi_get_handle((acpi_handle) 0,
-				poll_str, &(key->poll_hotkey.poll_handle));
-	else
-		return_VALUE(-ENODEV);
 	key->poll_hotkey.poll_method = poll_method;
-	if (is_valid_acpi_path(action_str))
-		acpi_get_handle((acpi_handle) 0,
-				action_str, &(key->poll_hotkey.action_handle));
-	key->poll_hotkey.action_method =
-	    kmalloc(sizeof(action_method), GFP_KERNEL);
-	strcpy(key->poll_hotkey.action_method, action_method);
+	key->poll_hotkey.action_method = action_method;
+
+	status = acpi_get_handle(NULL,poll_str, &(key->poll_hotkey.poll_handle));
+	if(ACPI_FAILURE(status))
+		goto do_fail;
+	status = acpi_get_handle(key->poll_hotkey.poll_handle,
+				poll_method, &tmp_handle);
+        if (ACPI_FAILURE(status))
+       		goto do_fail;
+	status = acpi_get_handle(NULL,action_str, &(key->poll_hotkey.action_handle));
+	if (ACPI_FAILURE(status))
+		goto do_fail;
+	status = acpi_get_handle(key->poll_hotkey.action_handle,
+				action_method, &tmp_handle);
+	if (ACPI_FAILURE(status))
+		goto do_fail;
 	key->poll_hotkey.poll_result =
 	    (union acpi_object *)kmalloc(sizeof(union acpi_object), GFP_KERNEL);
-	return_VALUE(is_valid_hotkey(key));
+	if(!key->poll_hotkey.poll_result)
+		goto do_fail;
+	return_VALUE(AE_OK);
+do_fail:
+	return_VALUE(-ENODEV);
 }
 
-static int check_hotkey_valid(union acpi_hotkey *key,
-			      struct acpi_hotkey_list *list)
-{
-	ACPI_FUNCTION_TRACE("check_hotkey_valid");
-	return_VALUE(0);
-}
 
 static int hotkey_open_config(struct inode *inode, struct file *file)
 {
@@ -531,10 +599,17 @@ static int hotkey_open_config(struct inode *inode, struct file *file)
 		     (file, hotkey_config_seq_show, PDE(inode)->data));
 }
 
+static int hotkey_poll_open_config(struct inode *inode, struct file *file)
+{
+	ACPI_FUNCTION_TRACE("hotkey_poll_open_config");
+	return_VALUE(single_open
+		     (file, hotkey_poll_config_seq_show, PDE(inode)->data));
+}
+
 static int hotkey_config_seq_show(struct seq_file *seq, void *offset)
 {
 	struct acpi_hotkey_list *hotkey_list = &global_hotkey_list;
-	struct list_head *entries, *next;
+	struct list_head *entries;
 	char bus_name[ACPI_PATHNAME_MAX] = { 0 };
 	char action_name[ACPI_PATHNAME_MAX] = { 0 };
 	struct acpi_buffer bus = { ACPI_PATHNAME_MAX, bus_name };
@@ -542,10 +617,7 @@ static int hotkey_config_seq_show(struct seq_file *seq, void *offset)
 
 	ACPI_FUNCTION_TRACE(("hotkey_config_seq_show"));
 
-	if (!hotkey_list)
-		goto end;
-
-	list_for_each_safe(entries, next, hotkey_list->entries) {
+	list_for_each(entries, hotkey_list->entries) {
 		union acpi_hotkey *key =
 		    container_of(entries, union acpi_hotkey, entries);
 		if (key->link.hotkey_type == ACPI_HOTKEY_EVENT) {
@@ -553,18 +625,37 @@ static int hotkey_config_seq_show(struct seq_file *seq, void *offset)
 				      ACPI_NAME_TYPE_MAX, &bus);
 			acpi_get_name(key->event_hotkey.action_handle,
 				      ACPI_NAME_TYPE_MAX, &act);
-			seq_printf(seq, "%s:%s:%s:%d:%d", bus_name,
+			seq_printf(seq, "%s:%s:%s:%d:%d\n", bus_name,
 				   action_name,
 				   key->event_hotkey.action_method,
 				   key->link.hotkey_standard_num,
 				   key->event_hotkey.external_hotkey_num);
-		} /* ACPI_HOTKEY_POLLING */
-		else {
+		}
+	}
+	seq_puts(seq, "\n");
+	return_VALUE(0);
+}
+
+static int hotkey_poll_config_seq_show(struct seq_file *seq, void *offset)
+{
+	struct acpi_hotkey_list *hotkey_list = &global_hotkey_list;
+	struct list_head *entries;
+	char bus_name[ACPI_PATHNAME_MAX] = { 0 };
+	char action_name[ACPI_PATHNAME_MAX] = { 0 };
+	struct acpi_buffer bus = { ACPI_PATHNAME_MAX, bus_name };
+	struct acpi_buffer act = { ACPI_PATHNAME_MAX, action_name };
+
+	ACPI_FUNCTION_TRACE(("hotkey_config_seq_show"));
+
+	list_for_each(entries, hotkey_list->entries) {
+		union acpi_hotkey *key =
+		    container_of(entries, union acpi_hotkey, entries);
+		if (key->link.hotkey_type == ACPI_HOTKEY_POLLING) {
 			acpi_get_name(key->poll_hotkey.poll_handle,
 				      ACPI_NAME_TYPE_MAX, &bus);
 			acpi_get_name(key->poll_hotkey.action_handle,
 				      ACPI_NAME_TYPE_MAX, &act);
-			seq_printf(seq, "%s:%s:%s:%s:%d", bus_name,
+			seq_printf(seq, "%s:%s:%s:%s:%d\n", bus_name,
 				   key->poll_hotkey.poll_method,
 				   action_name,
 				   key->poll_hotkey.action_method,
@@ -572,49 +663,83 @@ static int hotkey_config_seq_show(struct seq_file *seq, void *offset)
 		}
 	}
 	seq_puts(seq, "\n");
-      end:
 	return_VALUE(0);
 }
 
 static int
 get_parms(char *config_record,
 	  int *cmd,
-	  char *bus_handle,
-	  char *bus_method,
-	  char *action_handle,
-	  char *method, int *internal_event_num, int *external_event_num)
+	  char **bus_handle,
+	  char **bus_method,
+	  char **action_handle,
+	  char **method, int *internal_event_num, int *external_event_num)
 {
-	char *tmp, *tmp1;
+	char *tmp, *tmp1, count;
 	ACPI_FUNCTION_TRACE(("get_parms"));
 
 	sscanf(config_record, "%d", cmd);
 
+	if(*cmd == 1){
+		if(sscanf(config_record, "%d:%d", cmd, internal_event_num)!=2)
+			goto do_fail;
+		else
+			return (6);
+	}
 	tmp = strchr(config_record, ':');
+	if (!tmp)
+		goto do_fail;
 	tmp++;
 	tmp1 = strchr(tmp, ':');
-	strncpy(bus_handle, tmp, tmp1 - tmp);
-	bus_handle[tmp1 - tmp] = 0;
+	if (!tmp1)
+		goto do_fail;
+
+	count = tmp1 - tmp;
+	*bus_handle = (char *) kmalloc(count+1, GFP_KERNEL);
+	if(!*bus_handle)
+		goto do_fail;
+	strncpy(*bus_handle, tmp, count);
+	*(*bus_handle + count) = 0;
 
 	tmp = tmp1;
 	tmp++;
 	tmp1 = strchr(tmp, ':');
-	strncpy(bus_method, tmp, tmp1 - tmp);
-	bus_method[tmp1 - tmp] = 0;
+	if (!tmp1)
+		goto do_fail;
+	count = tmp1 - tmp;
+	*bus_method = (char *) kmalloc(count+1, GFP_KERNEL);
+	if(!*bus_method)
+		goto do_fail;
+	strncpy(*bus_method, tmp, count);
+	*(*bus_method + count) = 0;
 
 	tmp = tmp1;
 	tmp++;
 	tmp1 = strchr(tmp, ':');
-	strncpy(action_handle, tmp, tmp1 - tmp);
-	action_handle[tmp1 - tmp] = 0;
+	if (!tmp1)
+		goto do_fail;
+	count = tmp1 - tmp;
+	*action_handle = (char *) kmalloc(count+1, GFP_KERNEL);
+	strncpy(*action_handle, tmp, count);
+	*(*action_handle + count) = 0;
 
 	tmp = tmp1;
 	tmp++;
 	tmp1 = strchr(tmp, ':');
-	strncpy(method, tmp, tmp1 - tmp);
-	method[tmp1 - tmp] = 0;
+	if (!tmp1)
+		goto do_fail;
+	count = tmp1 - tmp;
+	*method = (char *) kmalloc(count+1, GFP_KERNEL);
+	if(!*method)
+		goto do_fail;
+	strncpy(*method, tmp, count);
+	*(*method + count) = 0;
+
+	if(sscanf(tmp1 + 1, "%d:%d", internal_event_num, external_event_num)<=0)
+		goto do_fail;
 
-	sscanf(tmp1 + 1, "%d:%d", internal_event_num, external_event_num);
 	return_VALUE(6);
+do_fail:
+	return_VALUE(-1);
 }
 
 /*  count is length for one input record */
@@ -622,135 +747,117 @@ static ssize_t hotkey_write_config(struct file *file,
 				   const char __user * buffer,
 				   size_t count, loff_t * data)
 {
-	struct acpi_hotkey_list *hotkey_list = &global_hotkey_list;
-	char config_record[MAX_CONFIG_RECORD_LEN];
-	char bus_handle[MAX_NAME_PATH_LEN];
-	char bus_method[MAX_NAME_PATH_LEN];
-	char action_handle[MAX_NAME_PATH_LEN];
-	char method[20];
+	char *config_record = NULL;
+	char *bus_handle = NULL;
+	char *bus_method = NULL;
+	char *action_handle = NULL;
+	char *method = NULL;
 	int cmd, internal_event_num, external_event_num;
 	int ret = 0;
 	union acpi_hotkey *key = NULL;
 
 	ACPI_FUNCTION_TRACE(("hotkey_write_config"));
 
-	if (!hotkey_list || count > MAX_CONFIG_RECORD_LEN) {
-		ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid arguments\n"));
-		return_VALUE(-EINVAL);
-	}
+	config_record = (char *) kmalloc(count+1, GFP_KERNEL);
+	if(!config_record)
+		return_VALUE(-ENOMEM);
 
 	if (copy_from_user(config_record, buffer, count)) {
+		kfree(config_record);
 		ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid data \n"));
 		return_VALUE(-EINVAL);
 	}
-	config_record[count] = '\0';
+	config_record[count] = 0;
 
 	ret = get_parms(config_record,
 			&cmd,
-			bus_handle,
-			bus_method,
-			action_handle,
-			method, &internal_event_num, &external_event_num);
+			&bus_handle,
+			&bus_method,
+			&action_handle,
+			&method, &internal_event_num, &external_event_num);
+
+	kfree(config_record);
+	if(IS_OTHERS(internal_event_num))
+		goto do_fail;
 	if (ret != 6) {
+do_fail:	
+		kfree(bus_handle);
+		kfree(bus_method);
+		kfree(action_handle);
+		kfree(method);
 		ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
 				  "Invalid data format ret=%d\n", ret));
 		return_VALUE(-EINVAL);
 	}
 
 	key = kmalloc(sizeof(union acpi_hotkey), GFP_KERNEL);
-	ret = init_hotkey_device(key, bus_handle, action_handle, method,
+	if(!key)
+		goto do_fail;
+	memset(key, 0, sizeof(union acpi_hotkey));
+	if(cmd == 1) {
+		union acpi_hotkey *tmp = NULL;
+		tmp = get_hotkey_by_event(&global_hotkey_list,
+				internal_event_num);
+		if(!tmp)
+			ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid key"));
+		else
+			memcpy(key, tmp, sizeof(union acpi_hotkey));
+		goto cont_cmd;
+	}
+	if (IS_EVENT(internal_event_num)) {
+		kfree(bus_method);
+		ret = init_hotkey_device(key, bus_handle, action_handle, method,
 				 internal_event_num, external_event_num);
-
-	if (ret || check_hotkey_valid(key, hotkey_list)) {
+	} else
+		ret = init_poll_hotkey_device(key, bus_handle, bus_method,
+				      action_handle, method,
+				      internal_event_num);
+	if (ret) {
+		kfree(bus_handle);
+		kfree(action_handle);
+		if(IS_EVENT(internal_event_num))
+			free_hotkey_buffer(key);
+		else
+			free_poll_hotkey_buffer(key);
 		kfree(key);
 		ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid hotkey \n"));
 		return_VALUE(-EINVAL);
 	}
-	switch (cmd) {
-	case 0:
-		hotkey_add(key);
-		break;
-	case 1:
-		hotkey_remove(key);
-		free_hotkey_device(key);
-		break;
-	case 2:
-		hotkey_update(key);
-		break;
-	default:
-		break;
-	}
-	return_VALUE(count);
-}
-
-/*  count is length for one input record */
-static ssize_t hotkey_write_poll_config(struct file *file,
-					const char __user * buffer,
-					size_t count, loff_t * data)
-{
-	struct seq_file *m = (struct seq_file *)file->private_data;
-	struct acpi_hotkey_list *hotkey_list =
-	    (struct acpi_hotkey_list *)m->private;
-
-	char config_record[MAX_CONFIG_RECORD_LEN];
-	char polling_handle[MAX_NAME_PATH_LEN];
-	char action_handle[MAX_NAME_PATH_LEN];
-	char poll_method[20], action_method[20];
-	int ret, internal_event_num, cmd, external_event_num;
-	union acpi_hotkey *key = NULL;
-
-	ACPI_FUNCTION_TRACE("hotkey_write_poll_config");
-
-	if (!hotkey_list || count > MAX_CONFIG_RECORD_LEN) {
-		ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid arguments\n"));
-		return_VALUE(-EINVAL);
-	}
-
-	if (copy_from_user(config_record, buffer, count)) {
-		ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid data \n"));
-		return_VALUE(-EINVAL);
-	}
-	config_record[count] = '\0';
 
-	ret = get_parms(config_record,
-			&cmd,
-			polling_handle,
-			poll_method,
-			action_handle,
-			action_method,
-			&internal_event_num, &external_event_num);
-
-	if (ret != 6) {
-		ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid data format\n"));
-		return_VALUE(-EINVAL);
-	}
+cont_cmd:
+	kfree(bus_handle);
+	kfree(action_handle);
 
-	key = kmalloc(sizeof(union acpi_hotkey), GFP_KERNEL);
-	ret = init_poll_hotkey_device(key, polling_handle, poll_method,
-				      action_handle, action_method,
-				      internal_event_num);
-	if (ret || check_hotkey_valid(key, hotkey_list)) {
-		kfree(key);
-		ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid hotkey \n"));
-		return_VALUE(-EINVAL);
-	}
 	switch (cmd) {
 	case 0:
-		hotkey_add(key);
+		if(get_hotkey_by_event(&global_hotkey_list,key->link.hotkey_standard_num))
+			goto fail_out;
+		else
+			hotkey_add(key);
 		break;
 	case 1:
 		hotkey_remove(key);
 		break;
 	case 2:
-		hotkey_update(key);
+		if(hotkey_update(key))
+			goto fail_out;
 		break;
 	default:
+		goto fail_out;
 		break;
 	}
 	return_VALUE(count);
+fail_out:
+	if(IS_EVENT(internal_event_num))
+		free_hotkey_buffer(key);
+	else
+		free_poll_hotkey_buffer(key);
+	kfree(key);
+	ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "invalid key\n"));
+	return_VALUE(-EINVAL);
 }
 
-/*  
+/*
  * This function evaluates an ACPI method, given an int as parameter, the
  * method is searched within the scope of the handle, can be NULL. The output
  * of the method is written is output, which can also be NULL
@@ -775,7 +882,7 @@ static int write_acpi_int(acpi_handle handle, const char *method, int val,
 	return_VALUE(status == AE_OK);
 }
 
-static int read_acpi_int(acpi_handle handle, const char *method, int *val)
+static int read_acpi_int(acpi_handle handle, const char *method, union acpi_object *val)
 {
 	struct acpi_buffer output;
 	union acpi_object out_obj;
@@ -786,62 +893,32 @@ static int read_acpi_int(acpi_handle handle, const char *method, int *val)
 	output.pointer = &out_obj;
 
 	status = acpi_evaluate_object(handle, (char *)method, NULL, &output);
-	*val = out_obj.integer.value;
+	if(val){
+		val->integer.value = out_obj.integer.value;
+		val->type = out_obj.type;
+	} else
+		ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "null val pointer"));
 	return_VALUE((status == AE_OK)
 		     && (out_obj.type == ACPI_TYPE_INTEGER));
 }
 
-static acpi_handle
-get_handle_from_hotkeylist(struct acpi_hotkey_list *hotkey_list, int event_num)
+static union acpi_hotkey *get_hotkey_by_event(struct
+			      acpi_hotkey_list
+			      *hotkey_list, int event)
 {
-	struct list_head *entries, *next;
-
-	list_for_each_safe(entries, next, hotkey_list->entries) {
-		union acpi_hotkey *key =
-		    container_of(entries, union acpi_hotkey, entries);
-		if (key->link.hotkey_type == ACPI_HOTKEY_EVENT
-		    && key->link.hotkey_standard_num == event_num) {
-			return (key->event_hotkey.action_handle);
-		}
-	}
-	return (NULL);
-}
-
-static
-char *get_method_from_hotkeylist(struct acpi_hotkey_list *hotkey_list,
-				 int event_num)
-{
-	struct list_head *entries, *next;
-
-	list_for_each_safe(entries, next, hotkey_list->entries) {
-		union acpi_hotkey *key =
-		    container_of(entries, union acpi_hotkey, entries);
-
-		if (key->link.hotkey_type == ACPI_HOTKEY_EVENT &&
-		    key->link.hotkey_standard_num == event_num)
-			return (key->event_hotkey.action_method);
-	}
-	return (NULL);
-}
-
-static struct acpi_polling_hotkey *get_hotkey_by_event(struct
-						       acpi_hotkey_list
-						       *hotkey_list, int event)
-{
-	struct list_head *entries, *next;
+	struct list_head *entries;
 
-	list_for_each_safe(entries, next, hotkey_list->entries) {
+	list_for_each(entries, hotkey_list->entries) {
 		union acpi_hotkey *key =
 		    container_of(entries, union acpi_hotkey, entries);
-		if (key->link.hotkey_type == ACPI_HOTKEY_POLLING
-		    && key->link.hotkey_standard_num == event) {
-			return (&key->poll_hotkey);
+		if (key->link.hotkey_standard_num == event) {
+			return(key);
 		}
 	}
-	return (NULL);
+	return(NULL);
 }
 
-/*  
+/*
  * user call AML method interface:
  * Call convention:
  * echo "event_num: arg type : value"
@@ -854,48 +931,56 @@ static ssize_t hotkey_execute_aml_method(struct file *file,
 					 size_t count, loff_t * data)
 {
 	struct acpi_hotkey_list *hotkey_list = &global_hotkey_list;
-	char arg[MAX_CALL_PARM];
-	int event, type, value;
-
-	char *method;
-	acpi_handle handle;
+	char *arg;
+	int event,method_type,type, value;
+	union acpi_hotkey *key;
 
 	ACPI_FUNCTION_TRACE("hotkey_execte_aml_method");
 
-	if (!hotkey_list || count > MAX_CALL_PARM) {
-		ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid argument 1"));
-		return_VALUE(-EINVAL);
-	}
+	arg = (char *) kmalloc(count+1, GFP_KERNEL);
+	if(!arg)
+		return_VALUE(-ENOMEM);
+	arg[count]=0;
 
 	if (copy_from_user(arg, buffer, count)) {
+		kfree(arg);
 		ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid argument 2"));
 		return_VALUE(-EINVAL);
 	}
 
-	arg[count] = '\0';
-
-	if (sscanf(arg, "%d:%d:%d", &event, &type, &value) != 3) {
+	if (sscanf(arg, "%d:%d:%d:%d", &event, &method_type, &type, &value) != 4) {
+		kfree(arg);
 		ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid argument 3"));
 		return_VALUE(-EINVAL);
 	}
-
+	kfree(arg);
 	if (type == ACPI_TYPE_INTEGER) {
-		handle = get_handle_from_hotkeylist(hotkey_list, event);
-		method = (char *)get_method_from_hotkeylist(hotkey_list, event);
+		key = get_hotkey_by_event(hotkey_list, event);
+		if(!key)
+			goto do_fail;
 		if (IS_EVENT(event))
-			write_acpi_int(handle, method, value, NULL);
+			write_acpi_int(key->event_hotkey.action_handle,
+					key->event_hotkey.action_method, value, NULL);
 		else if (IS_POLL(event)) {
-			struct acpi_polling_hotkey *key;
-			key = (struct acpi_polling_hotkey *)
-			    get_hotkey_by_event(hotkey_list, event);
-			read_acpi_int(handle, method, key->poll_result);
+			if ( method_type == POLL_METHOD )
+				read_acpi_int(key->poll_hotkey.poll_handle,
+					key->poll_hotkey.poll_method,
+					key->poll_hotkey.poll_result);
+			else if ( method_type == ACTION_METHOD )
+				write_acpi_int(key->poll_hotkey.action_handle,
+					key->poll_hotkey.action_method, value, NULL);
+			else
+				goto do_fail;
+
 		}
 	} else {
 		ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Not supported"));
 		return_VALUE(-EINVAL);
 	}
-
 	return_VALUE(count);
+do_fail:
+	return_VALUE(-EINVAL);
+
 }
 
 static int __init hotkey_init(void)
@@ -928,7 +1013,7 @@ static int __init hotkey_init(void)
 		ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
 				  "Hotkey: Unable to create %s entry\n",
 				  HOTKEY_EV_CONFIG));
-		return (-ENODEV);
+		goto do_fail1;
 	} else {
 		hotkey_config->proc_fops = &hotkey_config_fops;
 		hotkey_config->data = &global_hotkey_list;
@@ -943,7 +1028,8 @@ static int __init hotkey_init(void)
 		ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
 				  "Hotkey: Unable to create %s entry\n",
 				  HOTKEY_EV_CONFIG));
-		return (-ENODEV);
+
+		goto do_fail2;
 	} else {
 		hotkey_poll_config->proc_fops = &hotkey_poll_config_fops;
 		hotkey_poll_config->data = &global_hotkey_list;
@@ -957,7 +1043,7 @@ static int __init hotkey_init(void)
 		ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
 				  "Hotkey: Unable to create %s entry\n",
 				  HOTKEY_ACTION));
-		return (-ENODEV);
+		goto do_fail3;
 	} else {
 		hotkey_action->proc_fops = &hotkey_action_fops;
 		hotkey_action->owner = THIS_MODULE;
@@ -970,7 +1056,7 @@ static int __init hotkey_init(void)
 		ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
 				  "Hotkey: Unable to create %s entry\n",
 				  HOTKEY_INFO));
-		return (-ENODEV);
+		goto do_fail4;
 	} else {
 		hotkey_info->proc_fops = &hotkey_info_fops;
 		hotkey_info->owner = THIS_MODULE;
@@ -979,23 +1065,33 @@ static int __init hotkey_init(void)
 	}
 
 	result = acpi_bus_register_driver(&hotkey_driver);
-	if (result < 0) {
-		remove_proc_entry(HOTKEY_PROC, acpi_root_dir);
-		return (-ENODEV);
-	}
+	if (result < 0)
+		goto do_fail5;
 	global_hotkey_list.count = 0;
 	global_hotkey_list.entries = &hotkey_entries;
 
 	INIT_LIST_HEAD(&hotkey_entries);
 
 	return (0);
+
+do_fail5:
+	remove_proc_entry(HOTKEY_INFO, hotkey_proc_dir);
+do_fail4:
+	remove_proc_entry(HOTKEY_ACTION, hotkey_proc_dir);
+do_fail3:
+	remove_proc_entry(HOTKEY_PL_CONFIG, hotkey_proc_dir);
+do_fail2:
+	remove_proc_entry(HOTKEY_EV_CONFIG, hotkey_proc_dir);
+do_fail1:
+	remove_proc_entry(HOTKEY_PROC, acpi_root_dir);
+	return (-ENODEV);
 }
 
 static void __exit hotkey_exit(void)
 {
 	struct list_head *entries, *next;
 
-	ACPI_FUNCTION_TRACE("hotkey_remove");
+	ACPI_FUNCTION_TRACE("hotkey_exit");
 
 	list_for_each_safe(entries, next, global_hotkey_list.entries) {
 		union acpi_hotkey *key =