drivers/hid/hid-rmi.c

   1 /*
   2  *  Copyright (c) 2013 Andrew Duggan <aduggan@synaptics.com>
   3  *  Copyright (c) 2013 Synaptics Incorporated
   4  *  Copyright (c) 2014 Benjamin Tissoires <benjamin.tissoires@gmail.com>
   5  *  Copyright (c) 2014 Red Hat, Inc
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the Free
   9  * Software Foundation; either version 2 of the License, or (at your option)
  10  * any later version.
  11  */
  12
  13 #include <linux/kernel.h>
  14 #include <linux/hid.h>
  15 #include <linux/input.h>
  16 #include <linux/input/mt.h>
  17 #include <linux/module.h>
  18 #include <linux/pm.h>
  19 #include <linux/slab.h>
  20 #include <linux/wait.h>
  21 #include <linux/sched.h>
  22 #include "hid-ids.h"
  23
  24 #define RMI_MOUSE_REPORT_ID             0x01 /* Mouse emulation Report */
  25 #define RMI_WRITE_REPORT_ID             0x09 /* Output Report */
  26 #define RMI_READ_ADDR_REPORT_ID         0x0a /* Output Report */
  27 #define RMI_READ_DATA_REPORT_ID         0x0b /* Input Report */
  28 #define RMI_ATTN_REPORT_ID              0x0c /* Input Report */
  29 #define RMI_SET_RMI_MODE_REPORT_ID      0x0f /* Feature Report */
  30
  31 /* flags */
  32 #define RMI_READ_REQUEST_PENDING        0
  33 #define RMI_READ_DATA_PENDING           1
  34 #define RMI_STARTED                     2
  35
  36 /* device flags */
  37 #define RMI_DEVICE                      BIT(0)
  38 #define RMI_DEVICE_HAS_PHYS_BUTTONS     BIT(1)
  39
  40 enum rmi_mode_type {
  41         RMI_MODE_OFF                    = 0,
  42         RMI_MODE_ATTN_REPORTS           = 1,
  43         RMI_MODE_NO_PACKED_ATTN_REPORTS = 2,
  44 };
  45
  46 struct rmi_function {
  47         unsigned page;                  /* page of the function */
  48         u16 query_base_addr;            /* base address for queries */
  49         u16 command_base_addr;          /* base address for commands */
  50         u16 control_base_addr;          /* base address for controls */
  51         u16 data_base_addr;             /* base address for datas */
  52         unsigned int interrupt_base;    /* cross-function interrupt number
  53                                          * (uniq in the device)*/
  54         unsigned int interrupt_count;   /* number of interrupts */
  55         unsigned int report_size;       /* size of a report */
  56         unsigned long irq_mask;         /* mask of the interrupts
  57                                          * (to be applied against ATTN IRQ) */
  58 };
  59
  60 /**
  61  * struct rmi_data - stores information for hid communication
  62  *
  63  * @page_mutex: Locks current page to avoid changing pages in unexpected ways.
  64  * @page: Keeps track of the current virtual page
  65  *
  66  * @wait: Used for waiting for read data
  67  *
  68  * @writeReport: output buffer when writing RMI registers
  69  * @readReport: input buffer when reading RMI registers
  70  *
  71  * @input_report_size: size of an input report (advertised by HID)
  72  * @output_report_size: size of an output report (advertised by HID)
  73  *
  74  * @flags: flags for the current device (started, reading, etc...)
  75  *
  76  * @f11: placeholder of internal RMI function F11 description
  77  * @f30: placeholder of internal RMI function F30 description
  78  *
  79  * @max_fingers: maximum finger count reported by the device
  80  * @max_x: maximum x value reported by the device
  81  * @max_y: maximum y value reported by the device
  82  *
  83  * @gpio_led_count: count of GPIOs + LEDs reported by F30
  84  * @button_count: actual physical buttons count
  85  * @button_mask: button mask used to decode GPIO ATTN reports
  86  * @button_state_mask: pull state of the buttons
  87  *
  88  * @input: pointer to the kernel input device
  89  *
  90  * @reset_work: worker which will be called in case of a mouse report
  91  * @hdev: pointer to the struct hid_device
  92  */
  93 struct rmi_data {
  94         struct mutex page_mutex;
  95         int page;
  96
  97         wait_queue_head_t wait;
  98
  99         u8 *writeReport;
 100         u8 *readReport;
 101
 102         int input_report_size;
 103         int output_report_size;
 104
 105         unsigned long flags;
 106
 107         struct rmi_function f01;
 108         struct rmi_function f11;
 109         struct rmi_function f30;
 110
 111         unsigned int max_fingers;
 112         unsigned int max_x;
 113         unsigned int max_y;
 114         unsigned int x_size_mm;
 115         unsigned int y_size_mm;
 116
 117         unsigned int gpio_led_count;
 118         unsigned int button_count;
 119         unsigned long button_mask;
 120         unsigned long button_state_mask;
 121
 122         struct input_dev *input;
 123
 124         struct work_struct reset_work;
 125         struct hid_device *hdev;
 126
 127         unsigned long device_flags;
 128         unsigned long firmware_id;
 129 };
 130
 131 #define RMI_PAGE(addr) (((addr) >> 8) & 0xff)
 132
 133 static int rmi_write_report(struct hid_device *hdev, u8 *report, int len);
 134
 135 /**
 136  * rmi_set_page - Set RMI page
 137  * @hdev: The pointer to the hid_device struct
 138  * @page: The new page address.
 139  *
 140  * RMI devices have 16-bit addressing, but some of the physical
 141  * implementations (like SMBus) only have 8-bit addressing. So RMI implements
 142  * a page address at 0xff of every page so we can reliable page addresses
 143  * every 256 registers.
 144  *
 145  * The page_mutex lock must be held when this function is entered.
 146  *
 147  * Returns zero on success, non-zero on failure.
 148  */
 149 static int rmi_set_page(struct hid_device *hdev, u8 page)
 150 {
 151         struct rmi_data *data = hid_get_drvdata(hdev);
 152         int retval;
 153
 154         data->writeReport[0] = RMI_WRITE_REPORT_ID;
 155         data->writeReport[1] = 1;
 156         data->writeReport[2] = 0xFF;
 157         data->writeReport[4] = page;
 158
 159         retval = rmi_write_report(hdev, data->writeReport,
 160                         data->output_report_size);
 161         if (retval != data->output_report_size) {
 162                 dev_err(&hdev->dev,
 163                         "%s: set page failed: %d.", __func__, retval);
 164                 return retval;
 165         }
 166
 167         data->page = page;
 168         return 0;
 169 }
 170
 171 static int rmi_set_mode(struct hid_device *hdev, u8 mode)
 172 {
 173         int ret;
 174         u8 txbuf[2] = {RMI_SET_RMI_MODE_REPORT_ID, mode};
 175
 176         ret = hid_hw_raw_request(hdev, RMI_SET_RMI_MODE_REPORT_ID, txbuf,
 177                         sizeof(txbuf), HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
 178         if (ret < 0) {
 179                 dev_err(&hdev->dev, "unable to set rmi mode to %d (%d)\n", mode,
 180                         ret);
 181                 return ret;
 182         }
 183
 184         return 0;
 185 }
 186
 187 static int rmi_write_report(struct hid_device *hdev, u8 *report, int len)
 188 {
 189         int ret;
 190
 191         ret = hid_hw_output_report(hdev, (void *)report, len);
 192         if (ret < 0) {
 193                 dev_err(&hdev->dev, "failed to write hid report (%d)\n", ret);
 194                 return ret;
 195         }
 196
 197         return ret;
 198 }
 199
 200 static int rmi_read_block(struct hid_device *hdev, u16 addr, void *buf,
 201                 const int len)
 202 {
 203         struct rmi_data *data = hid_get_drvdata(hdev);
 204         int ret;
 205         int bytes_read;
 206         int bytes_needed;
 207         int retries;
 208         int read_input_count;
 209
 210         mutex_lock(&data->page_mutex);
 211
 212         if (RMI_PAGE(addr) != data->page) {
 213                 ret = rmi_set_page(hdev, RMI_PAGE(addr));
 214                 if (ret < 0)
 215                         goto exit;
 216         }
 217
 218         for (retries = 5; retries > 0; retries--) {
 219                 data->writeReport[0] = RMI_READ_ADDR_REPORT_ID;
 220                 data->writeReport[1] = 0; /* old 1 byte read count */
 221                 data->writeReport[2] = addr & 0xFF;
 222                 data->writeReport[3] = (addr >> 8) & 0xFF;
 223                 data->writeReport[4] = len  & 0xFF;
 224                 data->writeReport[5] = (len >> 8) & 0xFF;
 225
 226                 set_bit(RMI_READ_REQUEST_PENDING, &data->flags);
 227
 228                 ret = rmi_write_report(hdev, data->writeReport,
 229                                                 data->output_report_size);
 230                 if (ret != data->output_report_size) {
 231                         clear_bit(RMI_READ_REQUEST_PENDING, &data->flags);
 232                         dev_err(&hdev->dev,
 233                                 "failed to write request output report (%d)\n",
 234                                 ret);
 235                         goto exit;
 236                 }
 237
 238                 bytes_read = 0;
 239                 bytes_needed = len;
 240                 while (bytes_read < len) {
 241                         if (!wait_event_timeout(data->wait,
 242                                 test_bit(RMI_READ_DATA_PENDING, &data->flags),
 243                                         msecs_to_jiffies(1000))) {
 244                                 hid_warn(hdev, "%s: timeout elapsed\n",
 245                                          __func__);
 246                                 ret = -EAGAIN;
 247                                 break;
 248                         }
 249
 250                         read_input_count = data->readReport[1];
 251                         memcpy(buf + bytes_read, &data->readReport[2],
 252                                 read_input_count < bytes_needed ?
 253                                         read_input_count : bytes_needed);
 254
 255                         bytes_read += read_input_count;
 256                         bytes_needed -= read_input_count;
 257                         clear_bit(RMI_READ_DATA_PENDING, &data->flags);
 258                 }
 259
 260                 if (ret >= 0) {
 261                         ret = 0;
 262                         break;
 263                 }
 264         }
 265
 266 exit:
 267         clear_bit(RMI_READ_REQUEST_PENDING, &data->flags);
 268         mutex_unlock(&data->page_mutex);
 269         return ret;
 270 }
 271
 272 static inline int rmi_read(struct hid_device *hdev, u16 addr, void *buf)
 273 {
 274         return rmi_read_block(hdev, addr, buf, 1);
 275 }
 276
 277 static int rmi_write_block(struct hid_device *hdev, u16 addr, void *buf,
 278                 const int len)
 279 {
 280         struct rmi_data *data = hid_get_drvdata(hdev);
 281         int ret;
 282
 283         mutex_lock(&data->page_mutex);
 284
 285         if (RMI_PAGE(addr) != data->page) {
 286                 ret = rmi_set_page(hdev, RMI_PAGE(addr));
 287                 if (ret < 0)
 288                         goto exit;
 289         }
 290
 291         data->writeReport[0] = RMI_WRITE_REPORT_ID;
 292         data->writeReport[1] = len;
 293         data->writeReport[2] = addr & 0xFF;
 294         data->writeReport[3] = (addr >> 8) & 0xFF;
 295         memcpy(&data->writeReport[4], buf, len);
 296
 297         ret = rmi_write_report(hdev, data->writeReport,
 298                                         data->output_report_size);
 299         if (ret < 0) {
 300                 dev_err(&hdev->dev,
 301                         "failed to write request output report (%d)\n",
 302                         ret);
 303                 goto exit;
 304         }
 305         ret = 0;
 306
 307 exit:
 308         mutex_unlock(&data->page_mutex);
 309         return ret;
 310 }
 311
 312 static inline int rmi_write(struct hid_device *hdev, u16 addr, void *buf)
 313 {
 314         return rmi_write_block(hdev, addr, buf, 1);
 315 }
 316
 317 static void rmi_f11_process_touch(struct rmi_data *hdata, int slot,
 318                 u8 finger_state, u8 *touch_data)
 319 {
 320         int x, y, wx, wy;
 321         int wide, major, minor;
 322         int z;
 323
 324         input_mt_slot(hdata->input, slot);
 325         input_mt_report_slot_state(hdata->input, MT_TOOL_FINGER,
 326                         finger_state == 0x01);
 327         if (finger_state == 0x01) {
 328                 x = (touch_data[0] << 4) | (touch_data[2] & 0x0F);
 329                 y = (touch_data[1] << 4) | (touch_data[2] >> 4);
 330                 wx = touch_data[3] & 0x0F;
 331                 wy = touch_data[3] >> 4;
 332                 wide = (wx > wy);
 333                 major = max(wx, wy);
 334                 minor = min(wx, wy);
 335                 z = touch_data[4];
 336
 337                 /* y is inverted */
 338                 y = hdata->max_y - y;
 339
 340                 input_event(hdata->input, EV_ABS, ABS_MT_POSITION_X, x);
 341                 input_event(hdata->input, EV_ABS, ABS_MT_POSITION_Y, y);
 342                 input_event(hdata->input, EV_ABS, ABS_MT_ORIENTATION, wide);
 343                 input_event(hdata->input, EV_ABS, ABS_MT_PRESSURE, z);
 344                 input_event(hdata->input, EV_ABS, ABS_MT_TOUCH_MAJOR, major);
 345                 input_event(hdata->input, EV_ABS, ABS_MT_TOUCH_MINOR, minor);
 346         }
 347 }
 348
 349 static void rmi_reset_work(struct work_struct *work)
 350 {
 351         struct rmi_data *hdata = container_of(work, struct rmi_data,
 352                                                 reset_work);
 353
 354         /* switch the device to RMI if we receive a generic mouse report */
 355         rmi_set_mode(hdata->hdev, RMI_MODE_ATTN_REPORTS);
 356 }
 357
 358 static inline int rmi_schedule_reset(struct hid_device *hdev)
 359 {
 360         struct rmi_data *hdata = hid_get_drvdata(hdev);
 361         return schedule_work(&hdata->reset_work);
 362 }
 363
 364 static int rmi_f11_input_event(struct hid_device *hdev, u8 irq, u8 *data,
 365                 int size)
 366 {
 367         struct rmi_data *hdata = hid_get_drvdata(hdev);
 368         int offset;
 369         int i;
 370
 371         if (!(irq & hdata->f11.irq_mask) || size <= 0)
 372                 return 0;
 373
 374         offset = (hdata->max_fingers >> 2) + 1;
 375         for (i = 0; i < hdata->max_fingers; i++) {
 376                 int fs_byte_position = i >> 2;
 377                 int fs_bit_position = (i & 0x3) << 1;
 378                 int finger_state = (data[fs_byte_position] >> fs_bit_position) &
 379                                         0x03;
 380                 int position = offset + 5 * i;
 381
 382                 if (position + 5 > size) {
 383                         /* partial report, go on with what we received */
 384                         printk_once(KERN_WARNING
 385                                 "%s %s: Detected incomplete finger report. Finger reports may occasionally get dropped on this platform.\n",
 386                                  dev_driver_string(&hdev->dev),
 387                                  dev_name(&hdev->dev));
 388                         hid_dbg(hdev, "Incomplete finger report\n");
 389                         break;
 390                 }
 391
 392                 rmi_f11_process_touch(hdata, i, finger_state, &data[position]);
 393         }
 394         input_mt_sync_frame(hdata->input);
 395         input_sync(hdata->input);
 396         return hdata->f11.report_size;
 397 }
 398
 399 static int rmi_f30_input_event(struct hid_device *hdev, u8 irq, u8 *data,
 400                 int size)
 401 {
 402         struct rmi_data *hdata = hid_get_drvdata(hdev);
 403         int i;
 404         int button = 0;
 405         bool value;
 406
 407         if (!(irq & hdata->f30.irq_mask))
 408                 return 0;
 409
 410         if (size < (int)hdata->f30.report_size) {
 411                 hid_warn(hdev, "Click Button pressed, but the click data is missing\n");
 412                 return 0;
 413         }
 414
 415         for (i = 0; i < hdata->gpio_led_count; i++) {
 416                 if (test_bit(i, &hdata->button_mask)) {
 417                         value = (data[i / 8] >> (i & 0x07)) & BIT(0);
 418                         if (test_bit(i, &hdata->button_state_mask))
 419                                 value = !value;
 420                         input_event(hdata->input, EV_KEY, BTN_LEFT + button++,
 421                                         value);
 422                 }
 423         }
 424         return hdata->f30.report_size;
 425 }
 426
 427 static int rmi_input_event(struct hid_device *hdev, u8 *data, int size)
 428 {
 429         struct rmi_data *hdata = hid_get_drvdata(hdev);
 430         unsigned long irq_mask = 0;
 431         unsigned index = 2;
 432
 433         if (!(test_bit(RMI_STARTED, &hdata->flags)))
 434                 return 0;
 435
 436         irq_mask |= hdata->f11.irq_mask;
 437         irq_mask |= hdata->f30.irq_mask;
 438
 439         if (data[1] & ~irq_mask)
 440                 hid_dbg(hdev, "unknown intr source:%02lx %s:%d\n",
 441                         data[1] & ~irq_mask, __FILE__, __LINE__);
 442
 443         if (hdata->f11.interrupt_base < hdata->f30.interrupt_base) {
 444                 index += rmi_f11_input_event(hdev, data[1], &data[index],
 445                                 size - index);
 446                 index += rmi_f30_input_event(hdev, data[1], &data[index],
 447                                 size - index);
 448         } else {
 449                 index += rmi_f30_input_event(hdev, data[1], &data[index],
 450                                 size - index);
 451                 index += rmi_f11_input_event(hdev, data[1], &data[index],
 452                                 size - index);
 453         }
 454
 455         return 1;
 456 }
 457
 458 static int rmi_read_data_event(struct hid_device *hdev, u8 *data, int size)
 459 {
 460         struct rmi_data *hdata = hid_get_drvdata(hdev);
 461
 462         if (!test_bit(RMI_READ_REQUEST_PENDING, &hdata->flags)) {
 463                 hid_dbg(hdev, "no read request pending\n");
 464                 return 0;
 465         }
 466
 467         memcpy(hdata->readReport, data, size < hdata->input_report_size ?
 468                         size : hdata->input_report_size);
 469         set_bit(RMI_READ_DATA_PENDING, &hdata->flags);
 470         wake_up(&hdata->wait);
 471
 472         return 1;
 473 }
 474
 475 static int rmi_check_sanity(struct hid_device *hdev, u8 *data, int size)
 476 {
 477         int valid_size = size;
 478         /*
 479          * On the Dell XPS 13 9333, the bus sometimes get confused and fills
 480          * the report with a sentinel value "ff". Synaptics told us that such
 481          * behavior does not comes from the touchpad itself, so we filter out
 482          * such reports here.
 483          */
 484
 485         while ((data[valid_size - 1] == 0xff) && valid_size > 0)
 486                 valid_size--;
 487
 488         return valid_size;
 489 }
 490
 491 static int rmi_raw_event(struct hid_device *hdev,
 492                 struct hid_report *report, u8 *data, int size)
 493 {
 494         size = rmi_check_sanity(hdev, data, size);
 495         if (size < 2)
 496                 return 0;
 497
 498         switch (data[0]) {
 499         case RMI_READ_DATA_REPORT_ID:
 500                 return rmi_read_data_event(hdev, data, size);
 501         case RMI_ATTN_REPORT_ID:
 502                 return rmi_input_event(hdev, data, size);
 503         default:
 504                 return 1;
 505         }
 506
 507         return 0;
 508 }
 509
 510 static int rmi_event(struct hid_device *hdev, struct hid_field *field,
 511                         struct hid_usage *usage, __s32 value)
 512 {
 513         struct rmi_data *data = hid_get_drvdata(hdev);
 514
 515         if ((data->device_flags & RMI_DEVICE) &&
 516             (field->application == HID_GD_POINTER ||
 517             field->application == HID_GD_MOUSE)) {
 518                 if (data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS) {
 519                         if ((usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON)
 520                                 return 0;
 521
 522                         if ((usage->hid == HID_GD_X || usage->hid == HID_GD_Y)
 523                             && !value)
 524                                 return 1;
 525                 }
 526
 527                 rmi_schedule_reset(hdev);
 528                 return 1;
 529         }
 530
 531         return 0;
 532 }
 533
 534 #ifdef CONFIG_PM
 535 static int rmi_post_reset(struct hid_device *hdev)
 536 {
 537         return rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
 538 }
 539
 540 static int rmi_post_resume(struct hid_device *hdev)
 541 {
 542         return rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
 543 }
 544 #endif /* CONFIG_PM */
 545
 546 #define RMI4_MAX_PAGE 0xff
 547 #define RMI4_PAGE_SIZE 0x0100
 548
 549 #define PDT_START_SCAN_LOCATION 0x00e9
 550 #define PDT_END_SCAN_LOCATION   0x0005
 551 #define RMI4_END_OF_PDT(id) ((id) == 0x00 || (id) == 0xff)
 552
 553 struct pdt_entry {
 554         u8 query_base_addr:8;
 555         u8 command_base_addr:8;
 556         u8 control_base_addr:8;
 557         u8 data_base_addr:8;
 558         u8 interrupt_source_count:3;
 559         u8 bits3and4:2;
 560         u8 function_version:2;
 561         u8 bit7:1;
 562         u8 function_number:8;
 563 } __attribute__((__packed__));
 564
 565 static inline unsigned long rmi_gen_mask(unsigned irq_base, unsigned irq_count)
 566 {
 567         return GENMASK(irq_count + irq_base - 1, irq_base);
 568 }
 569
 570 static void rmi_register_function(struct rmi_data *data,
 571         struct pdt_entry *pdt_entry, int page, unsigned interrupt_count)
 572 {
 573         struct rmi_function *f = NULL;
 574         u16 page_base = page << 8;
 575
 576         switch (pdt_entry->function_number) {
 577         case 0x01:
 578                 f = &data->f01;
 579                 break;
 580         case 0x11:
 581                 f = &data->f11;
 582                 break;
 583         case 0x30:
 584                 f = &data->f30;
 585                 break;
 586         }
 587
 588         if (f) {
 589                 f->page = page;
 590                 f->query_base_addr = page_base | pdt_entry->query_base_addr;
 591                 f->command_base_addr = page_base | pdt_entry->command_base_addr;
 592                 f->control_base_addr = page_base | pdt_entry->control_base_addr;
 593                 f->data_base_addr = page_base | pdt_entry->data_base_addr;
 594                 f->interrupt_base = interrupt_count;
 595                 f->interrupt_count = pdt_entry->interrupt_source_count;
 596                 f->irq_mask = rmi_gen_mask(f->interrupt_base,
 597                                                 f->interrupt_count);
 598         }
 599 }
 600
 601 static int rmi_scan_pdt(struct hid_device *hdev)
 602 {
 603         struct rmi_data *data = hid_get_drvdata(hdev);
 604         struct pdt_entry entry;
 605         int page;
 606         bool page_has_function;
 607         int i;
 608         int retval;
 609         int interrupt = 0;
 610         u16 page_start, pdt_start , pdt_end;
 611
 612         hid_info(hdev, "Scanning PDT...\n");
 613
 614         for (page = 0; (page <= RMI4_MAX_PAGE); page++) {
 615                 page_start = RMI4_PAGE_SIZE * page;
 616                 pdt_start = page_start + PDT_START_SCAN_LOCATION;
 617                 pdt_end = page_start + PDT_END_SCAN_LOCATION;
 618
 619                 page_has_function = false;
 620                 for (i = pdt_start; i >= pdt_end; i -= sizeof(entry)) {
 621                         retval = rmi_read_block(hdev, i, &entry, sizeof(entry));
 622                         if (retval) {
 623                                 hid_err(hdev,
 624                                         "Read of PDT entry at %#06x failed.\n",
 625                                         i);
 626                                 goto error_exit;
 627                         }
 628
 629                         if (RMI4_END_OF_PDT(entry.function_number))
 630                                 break;
 631
 632                         page_has_function = true;
 633
 634                         hid_info(hdev, "Found F%02X on page %#04x\n",
 635                                         entry.function_number, page);
 636
 637                         rmi_register_function(data, &entry, page, interrupt);
 638                         interrupt += entry.interrupt_source_count;
 639                 }
 640
 641                 if (!page_has_function)
 642                         break;
 643         }
 644
 645         hid_info(hdev, "%s: Done with PDT scan.\n", __func__);
 646         retval = 0;
 647
 648 error_exit:
 649         return retval;
 650 }
 651
 652 #define RMI_DEVICE_F01_BASIC_QUERY_LEN  11
 653
 654 static int rmi_populate_f01(struct hid_device *hdev)
 655 {
 656         struct rmi_data *data = hid_get_drvdata(hdev);
 657         u8 basic_queries[RMI_DEVICE_F01_BASIC_QUERY_LEN];
 658         u8 info[3];
 659         int ret;
 660         bool has_query42;
 661         bool has_lts;
 662         bool has_sensor_id;
 663         bool has_ds4_queries = false;
 664         bool has_build_id_query = false;
 665         bool has_package_id_query = false;
 666         u16 query_offset = data->f01.query_base_addr;
 667         u16 prod_info_addr;
 668         u8 ds4_query_len;
 669
 670         ret = rmi_read_block(hdev, query_offset, basic_queries,
 671                                 RMI_DEVICE_F01_BASIC_QUERY_LEN);
 672         if (ret) {
 673                 hid_err(hdev, "Can not read basic queries from Function 0x1.\n");
 674                 return ret;
 675         }
 676
 677         has_lts = !!(basic_queries[0] & BIT(2));
 678         has_sensor_id = !!(basic_queries[1] & BIT(3));
 679         has_query42 = !!(basic_queries[1] & BIT(7));
 680
 681         query_offset += 11;
 682         prod_info_addr = query_offset + 6;
 683         query_offset += 10;
 684
 685         if (has_lts)
 686                 query_offset += 20;
 687
 688         if (has_sensor_id)
 689                 query_offset++;
 690
 691         if (has_query42) {
 692                 ret = rmi_read(hdev, query_offset, info);
 693                 if (ret) {
 694                         hid_err(hdev, "Can not read query42.\n");
 695                         return ret;
 696                 }
 697                 has_ds4_queries = !!(info[0] & BIT(0));
 698                 query_offset++;
 699         }
 700
 701         if (has_ds4_queries) {
 702                 ret = rmi_read(hdev, query_offset, &ds4_query_len);
 703                 if (ret) {
 704                         hid_err(hdev, "Can not read DS4 Query length.\n");
 705                         return ret;
 706                 }
 707                 query_offset++;
 708
 709                 if (ds4_query_len > 0) {
 710                         ret = rmi_read(hdev, query_offset, info);
 711                         if (ret) {
 712                                 hid_err(hdev, "Can not read DS4 query.\n");
 713                                 return ret;
 714                         }
 715
 716                         has_package_id_query = !!(info[0] & BIT(0));
 717                         has_build_id_query = !!(info[0] & BIT(1));
 718                 }
 719         }
 720
 721         if (has_package_id_query)
 722                 prod_info_addr++;
 723
 724         if (has_build_id_query) {
 725                 ret = rmi_read_block(hdev, prod_info_addr, info, 3);
 726                 if (ret) {
 727                         hid_err(hdev, "Can not read product info.\n");
 728                         return ret;
 729                 }
 730
 731                 data->firmware_id = info[1] << 8 | info[0];
 732                 data->firmware_id += info[2] * 65536;
 733         }
 734
 735         return 0;
 736 }
 737
 738 static int rmi_populate_f11(struct hid_device *hdev)
 739 {
 740         struct rmi_data *data = hid_get_drvdata(hdev);
 741         u8 buf[20];
 742         int ret;
 743         bool has_query9;
 744         bool has_query10 = false;
 745         bool has_query11;
 746         bool has_query12;
 747         bool has_query27;
 748         bool has_query28;
 749         bool has_query36 = false;
 750         bool has_physical_props;
 751         bool has_gestures;
 752         bool has_rel;
 753         bool has_data40 = false;
 754         bool has_dribble = false;
 755         bool has_palm_detect = false;
 756         unsigned x_size, y_size;
 757         u16 query_offset;
 758
 759         if (!data->f11.query_base_addr) {
 760                 hid_err(hdev, "No 2D sensor found, giving up.\n");
 761                 return -ENODEV;
 762         }
 763
 764         /* query 0 contains some useful information */
 765         ret = rmi_read(hdev, data->f11.query_base_addr, buf);
 766         if (ret) {
 767                 hid_err(hdev, "can not get query 0: %d.\n", ret);
 768                 return ret;
 769         }
 770         has_query9 = !!(buf[0] & BIT(3));
 771         has_query11 = !!(buf[0] & BIT(4));
 772         has_query12 = !!(buf[0] & BIT(5));
 773         has_query27 = !!(buf[0] & BIT(6));
 774         has_query28 = !!(buf[0] & BIT(7));
 775
 776         /* query 1 to get the max number of fingers */
 777         ret = rmi_read(hdev, data->f11.query_base_addr + 1, buf);
 778         if (ret) {
 779                 hid_err(hdev, "can not get NumberOfFingers: %d.\n", ret);
 780                 return ret;
 781         }
 782         data->max_fingers = (buf[0] & 0x07) + 1;
 783         if (data->max_fingers > 5)
 784                 data->max_fingers = 10;
 785
 786         data->f11.report_size = data->max_fingers * 5 +
 787                                 DIV_ROUND_UP(data->max_fingers, 4);
 788
 789         if (!(buf[0] & BIT(4))) {
 790                 hid_err(hdev, "No absolute events, giving up.\n");
 791                 return -ENODEV;
 792         }
 793
 794         has_rel = !!(buf[0] & BIT(3));
 795         has_gestures = !!(buf[0] & BIT(5));
 796
 797         ret = rmi_read(hdev, data->f11.query_base_addr + 5, buf);
 798         if (ret) {
 799                 hid_err(hdev, "can not get absolute data sources: %d.\n", ret);
 800                 return ret;
 801         }
 802
 803         has_dribble = !!(buf[0] & BIT(4));
 804
 805         /*
 806          * At least 4 queries are guaranteed to be present in F11
 807          * +1 for query 5 which is present since absolute events are
 808          * reported and +1 for query 12.
 809          */
 810         query_offset = 6;
 811
 812         if (has_rel)
 813                 ++query_offset; /* query 6 is present */
 814
 815         if (has_gestures) {
 816                 /* query 8 to find out if query 10 exists */
 817                 ret = rmi_read(hdev,
 818                         data->f11.query_base_addr + query_offset + 1, buf);
 819                 if (ret) {
 820                         hid_err(hdev, "can not read gesture information: %d.\n",
 821                                 ret);
 822                         return ret;
 823                 }
 824                 has_palm_detect = !!(buf[0] & BIT(0));
 825                 has_query10 = !!(buf[0] & BIT(2));
 826
 827                 query_offset += 2; /* query 7 and 8 are present */
 828         }
 829
 830         if (has_query9)
 831                 ++query_offset;
 832
 833         if (has_query10)
 834                 ++query_offset;
 835
 836         if (has_query11)
 837                 ++query_offset;
 838
 839         /* query 12 to know if the physical properties are reported */
 840         if (has_query12) {
 841                 ret = rmi_read(hdev, data->f11.query_base_addr
 842                                 + query_offset, buf);
 843                 if (ret) {
 844                         hid_err(hdev, "can not get query 12: %d.\n", ret);
 845                         return ret;
 846                 }
 847                 has_physical_props = !!(buf[0] & BIT(5));
 848
 849                 if (has_physical_props) {
 850                         query_offset += 1;
 851                         ret = rmi_read_block(hdev,
 852                                         data->f11.query_base_addr
 853                                                 + query_offset, buf, 4);
 854                         if (ret) {
 855                                 hid_err(hdev, "can not read query 15-18: %d.\n",
 856                                         ret);
 857                                 return ret;
 858                         }
 859
 860                         x_size = buf[0] | (buf[1] << 8);
 861                         y_size = buf[2] | (buf[3] << 8);
 862
 863                         data->x_size_mm = DIV_ROUND_CLOSEST(x_size, 10);
 864                         data->y_size_mm = DIV_ROUND_CLOSEST(y_size, 10);
 865
 866                         hid_info(hdev, "%s: size in mm: %d x %d\n",
 867                                  __func__, data->x_size_mm, data->y_size_mm);
 868
 869                         /*
 870                          * query 15 - 18 contain the size of the sensor
 871                          * and query 19 - 26 contain bezel dimensions
 872                          */
 873                         query_offset += 12;
 874                 }
 875         }
 876
 877         if (has_query27)
 878                 ++query_offset;
 879
 880         if (has_query28) {
 881                 ret = rmi_read(hdev, data->f11.query_base_addr
 882                                 + query_offset, buf);
 883                 if (ret) {
 884                         hid_err(hdev, "can not get query 28: %d.\n", ret);
 885                         return ret;
 886                 }
 887
 888                 has_query36 = !!(buf[0] & BIT(6));
 889         }
 890
 891         if (has_query36) {
 892                 query_offset += 2;
 893                 ret = rmi_read(hdev, data->f11.query_base_addr
 894                                 + query_offset, buf);
 895                 if (ret) {
 896                         hid_err(hdev, "can not get query 36: %d.\n", ret);
 897                         return ret;
 898                 }
 899
 900                 has_data40 = !!(buf[0] & BIT(5));
 901         }
 902
 903
 904         if (has_data40)
 905                 data->f11.report_size += data->max_fingers * 2;
 906
 907         /*
 908          * retrieve the ctrl registers
 909          * the ctrl register has a size of 20 but a fw bug split it into 16 + 4,
 910          * and there is no way to know if the first 20 bytes are here or not.
 911          * We use only the first 12 bytes, so get only them.
 912          */
 913         ret = rmi_read_block(hdev, data->f11.control_base_addr, buf, 12);
 914         if (ret) {
 915                 hid_err(hdev, "can not read ctrl block of size 11: %d.\n", ret);
 916                 return ret;
 917         }
 918
 919         data->max_x = buf[6] | (buf[7] << 8);
 920         data->max_y = buf[8] | (buf[9] << 8);
 921
 922         if (has_dribble) {
 923                 buf[0] = buf[0] & ~BIT(6);
 924                 ret = rmi_write(hdev, data->f11.control_base_addr, buf);
 925                 if (ret) {
 926                         hid_err(hdev, "can not write to control reg 0: %d.\n",
 927                                 ret);
 928                         return ret;
 929                 }
 930         }
 931
 932         if (has_palm_detect) {
 933                 buf[11] = buf[11] & ~BIT(0);
 934                 ret = rmi_write(hdev, data->f11.control_base_addr + 11,
 935                                 &buf[11]);
 936                 if (ret) {
 937                         hid_err(hdev, "can not write to control reg 11: %d.\n",
 938                                 ret);
 939                         return ret;
 940                 }
 941         }
 942
 943         return 0;
 944 }
 945
 946 static int rmi_populate_f30(struct hid_device *hdev)
 947 {
 948         struct rmi_data *data = hid_get_drvdata(hdev);
 949         u8 buf[20];
 950         int ret;
 951         bool has_gpio, has_led;
 952         unsigned bytes_per_ctrl;
 953         u8 ctrl2_addr;
 954         int ctrl2_3_length;
 955         int i;
 956
 957         /* function F30 is for physical buttons */
 958         if (!data->f30.query_base_addr) {
 959                 hid_err(hdev, "No GPIO/LEDs found, giving up.\n");
 960                 return -ENODEV;
 961         }
 962
 963         ret = rmi_read_block(hdev, data->f30.query_base_addr, buf, 2);
 964         if (ret) {
 965                 hid_err(hdev, "can not get F30 query registers: %d.\n", ret);
 966                 return ret;
 967         }
 968
 969         has_gpio = !!(buf[0] & BIT(3));
 970         has_led = !!(buf[0] & BIT(2));
 971         data->gpio_led_count = buf[1] & 0x1f;
 972
 973         /* retrieve ctrl 2 & 3 registers */
 974         bytes_per_ctrl = (data->gpio_led_count + 7) / 8;
 975         /* Ctrl0 is present only if both has_gpio and has_led are set*/
 976         ctrl2_addr = (has_gpio && has_led) ? bytes_per_ctrl : 0;
 977         /* Ctrl1 is always be present */
 978         ctrl2_addr += bytes_per_ctrl;
 979         ctrl2_3_length = 2 * bytes_per_ctrl;
 980
 981         data->f30.report_size = bytes_per_ctrl;
 982
 983         ret = rmi_read_block(hdev, data->f30.control_base_addr + ctrl2_addr,
 984                                 buf, ctrl2_3_length);
 985         if (ret) {
 986                 hid_err(hdev, "can not read ctrl 2&3 block of size %d: %d.\n",
 987                         ctrl2_3_length, ret);
 988                 return ret;
 989         }
 990
 991         for (i = 0; i < data->gpio_led_count; i++) {
 992                 int byte_position = i >> 3;
 993                 int bit_position = i & 0x07;
 994                 u8 dir_byte = buf[byte_position];
 995                 u8 data_byte = buf[byte_position + bytes_per_ctrl];
 996                 bool dir = (dir_byte >> bit_position) & BIT(0);
 997                 bool dat = (data_byte >> bit_position) & BIT(0);
 998
 999                 if (dir == 0) {
1000                         /* input mode */
1001                         if (dat) {
1002                                 /* actual buttons have pull up resistor */
1003                                 data->button_count++;
1004                                 set_bit(i, &data->button_mask);
1005                                 set_bit(i, &data->button_state_mask);
1006                         }
1007                 }
1008
1009         }
1010
1011         return 0;
1012 }
1013
1014 static int rmi_populate(struct hid_device *hdev)
1015 {
1016         struct rmi_data *data = hid_get_drvdata(hdev);
1017         int ret;
1018
1019         ret = rmi_scan_pdt(hdev);
1020         if (ret) {
1021                 hid_err(hdev, "PDT scan failed with code %d.\n", ret);
1022                 return ret;
1023         }
1024
1025         ret = rmi_populate_f01(hdev);
1026         if (ret) {
1027                 hid_err(hdev, "Error while initializing F01 (%d).\n", ret);
1028                 return ret;
1029         }
1030
1031         ret = rmi_populate_f11(hdev);
1032         if (ret) {
1033                 hid_err(hdev, "Error while initializing F11 (%d).\n", ret);
1034                 return ret;
1035         }
1036
1037         if (!(data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS)) {
1038                 ret = rmi_populate_f30(hdev);
1039                 if (ret)
1040                         hid_warn(hdev, "Error while initializing F30 (%d).\n", ret);
1041         }
1042
1043         return 0;
1044 }
1045
1046 static void rmi_input_configured(struct hid_device *hdev, struct hid_input *hi)
1047 {
1048         struct rmi_data *data = hid_get_drvdata(hdev);
1049         struct input_dev *input = hi->input;
1050         int ret;
1051         int res_x, res_y, i;
1052
1053         data->input = input;
1054
1055         hid_dbg(hdev, "Opening low level driver\n");
1056         ret = hid_hw_open(hdev);
1057         if (ret)
1058                 return;
1059
1060         if (!(data->device_flags & RMI_DEVICE))
1061                 return;
1062
1063         /* Allow incoming hid reports */
1064         hid_device_io_start(hdev);
1065
1066         ret = rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
1067         if (ret < 0) {
1068                 dev_err(&hdev->dev, "failed to set rmi mode\n");
1069                 goto exit;
1070         }
1071
1072         ret = rmi_set_page(hdev, 0);
1073         if (ret < 0) {
1074                 dev_err(&hdev->dev, "failed to set page select to 0.\n");
1075                 goto exit;
1076         }
1077
1078         ret = rmi_populate(hdev);
1079         if (ret)
1080                 goto exit;
1081
1082         hid_info(hdev, "firmware id: %ld\n", data->firmware_id);
1083
1084         __set_bit(EV_ABS, input->evbit);
1085         input_set_abs_params(input, ABS_MT_POSITION_X, 1, data->max_x, 0, 0);
1086         input_set_abs_params(input, ABS_MT_POSITION_Y, 1, data->max_y, 0, 0);
1087
1088         if (data->x_size_mm && data->y_size_mm) {
1089                 res_x = (data->max_x - 1) / data->x_size_mm;
1090                 res_y = (data->max_y - 1) / data->y_size_mm;
1091
1092                 input_abs_set_res(input, ABS_MT_POSITION_X, res_x);
1093                 input_abs_set_res(input, ABS_MT_POSITION_Y, res_y);
1094         }
1095
1096         input_set_abs_params(input, ABS_MT_ORIENTATION, 0, 1, 0, 0);
1097         input_set_abs_params(input, ABS_MT_PRESSURE, 0, 0xff, 0, 0);
1098         input_set_abs_params(input, ABS_MT_TOUCH_MAJOR, 0, 0x0f, 0, 0);
1099         input_set_abs_params(input, ABS_MT_TOUCH_MINOR, 0, 0x0f, 0, 0);
1100
1101         input_mt_init_slots(input, data->max_fingers, INPUT_MT_POINTER);
1102
1103         if (data->button_count) {
1104                 __set_bit(EV_KEY, input->evbit);
1105                 for (i = 0; i < data->button_count; i++)
1106                         __set_bit(BTN_LEFT + i, input->keybit);
1107
1108                 if (data->button_count == 1)
1109                         __set_bit(INPUT_PROP_BUTTONPAD, input->propbit);
1110         }
1111
1112         set_bit(RMI_STARTED, &data->flags);
1113
1114 exit:
1115         hid_device_io_stop(hdev);
1116         hid_hw_close(hdev);
1117 }
1118
1119 static int rmi_input_mapping(struct hid_device *hdev,
1120                 struct hid_input *hi, struct hid_field *field,
1121                 struct hid_usage *usage, unsigned long **bit, int *max)
1122 {
1123         struct rmi_data *data = hid_get_drvdata(hdev);
1124
1125         /*
1126          * we want to make HID ignore the advertised HID collection
1127          * for RMI deivces
1128          */
1129         if (data->device_flags & RMI_DEVICE) {
1130                 if ((data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS) &&
1131                     ((usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON))
1132                         return 0;
1133
1134                 return -1;
1135         }
1136
1137         return 0;
1138 }
1139
1140 static int rmi_check_valid_report_id(struct hid_device *hdev, unsigned type,
1141                 unsigned id, struct hid_report **report)
1142 {
1143         int i;
1144
1145         *report = hdev->report_enum[type].report_id_hash[id];
1146         if (*report) {
1147                 for (i = 0; i < (*report)->maxfield; i++) {
1148                         unsigned app = (*report)->field[i]->application;
1149                         if ((app & HID_USAGE_PAGE) >= HID_UP_MSVENDOR)
1150                                 return 1;
1151                 }
1152         }
1153
1154         return 0;
1155 }
1156
1157 static int rmi_probe(struct hid_device *hdev, const struct hid_device_id *id)
1158 {
1159         struct rmi_data *data = NULL;
1160         int ret;
1161         size_t alloc_size;
1162         struct hid_report *input_report;
1163         struct hid_report *output_report;
1164         struct hid_report *feature_report;
1165
1166         data = devm_kzalloc(&hdev->dev, sizeof(struct rmi_data), GFP_KERNEL);
1167         if (!data)
1168                 return -ENOMEM;
1169
1170         INIT_WORK(&data->reset_work, rmi_reset_work);
1171         data->hdev = hdev;
1172
1173         hid_set_drvdata(hdev, data);
1174
1175         hdev->quirks |= HID_QUIRK_NO_INIT_REPORTS;
1176
1177         ret = hid_parse(hdev);
1178         if (ret) {
1179                 hid_err(hdev, "parse failed\n");
1180                 return ret;
1181         }
1182
1183         if (id->driver_data)
1184                 data->device_flags = id->driver_data;
1185
1186         /*
1187          * Check for the RMI specific report ids. If they are misisng
1188          * simply return and let the events be processed by hid-input
1189          */
1190         if (!rmi_check_valid_report_id(hdev, HID_FEATURE_REPORT,
1191             RMI_SET_RMI_MODE_REPORT_ID, &feature_report)) {
1192                 hid_dbg(hdev, "device does not have set mode feature report\n");
1193                 goto start;
1194         }
1195
1196         if (!rmi_check_valid_report_id(hdev, HID_INPUT_REPORT,
1197             RMI_ATTN_REPORT_ID, &input_report)) {
1198                 hid_dbg(hdev, "device does not have attention input report\n");
1199                 goto start;
1200         }
1201
1202         data->input_report_size = hid_report_len(input_report);
1203
1204         if (!rmi_check_valid_report_id(hdev, HID_OUTPUT_REPORT,
1205             RMI_WRITE_REPORT_ID, &output_report)) {
1206                 hid_dbg(hdev,
1207                         "device does not have rmi write output report\n");
1208                 goto start;
1209         }
1210
1211         data->output_report_size = hid_report_len(output_report);
1212
1213         data->device_flags |= RMI_DEVICE;
1214         alloc_size = data->output_report_size + data->input_report_size;
1215
1216         data->writeReport = devm_kzalloc(&hdev->dev, alloc_size, GFP_KERNEL);
1217         if (!data->writeReport) {
1218                 ret = -ENOMEM;
1219                 return ret;
1220         }
1221
1222         data->readReport = data->writeReport + data->output_report_size;
1223
1224         init_waitqueue_head(&data->wait);
1225
1226         mutex_init(&data->page_mutex);
1227
1228 start:
1229         ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
1230         if (ret) {
1231                 hid_err(hdev, "hw start failed\n");
1232                 return ret;
1233         }
1234
1235         if ((data->device_flags & RMI_DEVICE) &&
1236             !test_bit(RMI_STARTED, &data->flags))
1237                 /*
1238                  * The device maybe in the bootloader if rmi_input_configured
1239                  * failed to find F11 in the PDT. Print an error, but don't
1240                  * return an error from rmi_probe so that hidraw will be
1241                  * accessible from userspace. That way a userspace tool
1242                  * can be used to reload working firmware on the touchpad.
1243                  */
1244                 hid_err(hdev, "Device failed to be properly configured\n");
1245
1246         return 0;
1247 }
1248
1249 static void rmi_remove(struct hid_device *hdev)
1250 {
1251         struct rmi_data *hdata = hid_get_drvdata(hdev);
1252
1253         clear_bit(RMI_STARTED, &hdata->flags);
1254
1255         hid_hw_stop(hdev);
1256 }
1257
1258 static const struct hid_device_id rmi_id[] = {
1259         { HID_USB_DEVICE(USB_VENDOR_ID_RAZER, USB_DEVICE_ID_RAZER_BLADE_14),
1260                 .driver_data = RMI_DEVICE_HAS_PHYS_BUTTONS },
1261         { HID_DEVICE(HID_BUS_ANY, HID_GROUP_RMI, HID_ANY_ID, HID_ANY_ID) },
1262         { }
1263 };
1264 MODULE_DEVICE_TABLE(hid, rmi_id);
1265
1266 static struct hid_driver rmi_driver = {
1267         .name = "hid-rmi",
1268         .id_table               = rmi_id,
1269         .probe                  = rmi_probe,
1270         .remove                 = rmi_remove,
1271         .event                  = rmi_event,
1272         .raw_event              = rmi_raw_event,
1273         .input_mapping          = rmi_input_mapping,
1274         .input_configured       = rmi_input_configured,
1275 #ifdef CONFIG_PM
1276         .resume                 = rmi_post_resume,
1277         .reset_resume           = rmi_post_reset,
1278 #endif
1279 };
1280
1281 module_hid_driver(rmi_driver);
1282
1283 MODULE_AUTHOR("Andrew Duggan <aduggan@synaptics.com>");
1284 MODULE_DESCRIPTION("RMI HID driver");
1285 MODULE_LICENSE("GPL");