drivers/hid/hid-rmi.c

   1 /*
   2  *  Copyright (c) 2013 Andrew Duggan <aduggan@synaptics.com>
   3  *  Copyright (c) 2013 Synaptics Incorporated
   4  *  Copyright (c) 2014 Benjamin Tissoires <benjamin.tissoires@gmail.com>
   5  *  Copyright (c) 2014 Red Hat, Inc
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the Free
   9  * Software Foundation; either version 2 of the License, or (at your option)
  10  * any later version.
  11  */
  12
  13 #include <linux/kernel.h>
  14 #include <linux/hid.h>
  15 #include <linux/input.h>
  16 #include <linux/input/mt.h>
  17 #include <linux/module.h>
  18 #include <linux/pm.h>
  19 #include <linux/slab.h>
  20 #include <linux/wait.h>
  21 #include <linux/sched.h>
  22 #include "hid-ids.h"
  23
  24 #define RMI_MOUSE_REPORT_ID             0x01 /* Mouse emulation Report */
  25 #define RMI_WRITE_REPORT_ID             0x09 /* Output Report */
  26 #define RMI_READ_ADDR_REPORT_ID         0x0a /* Output Report */
  27 #define RMI_READ_DATA_REPORT_ID         0x0b /* Input Report */
  28 #define RMI_ATTN_REPORT_ID              0x0c /* Input Report */
  29 #define RMI_SET_RMI_MODE_REPORT_ID      0x0f /* Feature Report */
  30
  31 /* flags */
  32 #define RMI_READ_REQUEST_PENDING        BIT(0)
  33 #define RMI_READ_DATA_PENDING           BIT(1)
  34 #define RMI_STARTED                     BIT(2)
  35
  36 enum rmi_mode_type {
  37         RMI_MODE_OFF                    = 0,
  38         RMI_MODE_ATTN_REPORTS           = 1,
  39         RMI_MODE_NO_PACKED_ATTN_REPORTS = 2,
  40 };
  41
  42 struct rmi_function {
  43         unsigned page;                  /* page of the function */
  44         u16 query_base_addr;            /* base address for queries */
  45         u16 command_base_addr;          /* base address for commands */
  46         u16 control_base_addr;          /* base address for controls */
  47         u16 data_base_addr;             /* base address for datas */
  48         unsigned int interrupt_base;    /* cross-function interrupt number
  49                                          * (uniq in the device)*/
  50         unsigned int interrupt_count;   /* number of interrupts */
  51         unsigned int report_size;       /* size of a report */
  52         unsigned long irq_mask;         /* mask of the interrupts
  53                                          * (to be applied against ATTN IRQ) */
  54 };
  55
  56 /**
  57  * struct rmi_data - stores information for hid communication
  58  *
  59  * @page_mutex: Locks current page to avoid changing pages in unexpected ways.
  60  * @page: Keeps track of the current virtual page
  61  *
  62  * @wait: Used for waiting for read data
  63  *
  64  * @writeReport: output buffer when writing RMI registers
  65  * @readReport: input buffer when reading RMI registers
  66  *
  67  * @input_report_size: size of an input report (advertised by HID)
  68  * @output_report_size: size of an output report (advertised by HID)
  69  *
  70  * @flags: flags for the current device (started, reading, etc...)
  71  *
  72  * @f11: placeholder of internal RMI function F11 description
  73  * @f30: placeholder of internal RMI function F30 description
  74  *
  75  * @max_fingers: maximum finger count reported by the device
  76  * @max_x: maximum x value reported by the device
  77  * @max_y: maximum y value reported by the device
  78  *
  79  * @gpio_led_count: count of GPIOs + LEDs reported by F30
  80  * @button_count: actual physical buttons count
  81  * @button_mask: button mask used to decode GPIO ATTN reports
  82  * @button_state_mask: pull state of the buttons
  83  *
  84  * @input: pointer to the kernel input device
  85  *
  86  * @reset_work: worker which will be called in case of a mouse report
  87  * @hdev: pointer to the struct hid_device
  88  */
  89 struct rmi_data {
  90         struct mutex page_mutex;
  91         int page;
  92
  93         wait_queue_head_t wait;
  94
  95         u8 *writeReport;
  96         u8 *readReport;
  97
  98         int input_report_size;
  99         int output_report_size;
 100
 101         unsigned long flags;
 102
 103         struct rmi_function f11;
 104         struct rmi_function f30;
 105
 106         unsigned int max_fingers;
 107         unsigned int max_x;
 108         unsigned int max_y;
 109         unsigned int x_size_mm;
 110         unsigned int y_size_mm;
 111
 112         unsigned int gpio_led_count;
 113         unsigned int button_count;
 114         unsigned long button_mask;
 115         unsigned long button_state_mask;
 116
 117         struct input_dev *input;
 118
 119         struct work_struct reset_work;
 120         struct hid_device *hdev;
 121 };
 122
 123 #define RMI_PAGE(addr) (((addr) >> 8) & 0xff)
 124
 125 static int rmi_write_report(struct hid_device *hdev, u8 *report, int len);
 126
 127 /**
 128  * rmi_set_page - Set RMI page
 129  * @hdev: The pointer to the hid_device struct
 130  * @page: The new page address.
 131  *
 132  * RMI devices have 16-bit addressing, but some of the physical
 133  * implementations (like SMBus) only have 8-bit addressing. So RMI implements
 134  * a page address at 0xff of every page so we can reliable page addresses
 135  * every 256 registers.
 136  *
 137  * The page_mutex lock must be held when this function is entered.
 138  *
 139  * Returns zero on success, non-zero on failure.
 140  */
 141 static int rmi_set_page(struct hid_device *hdev, u8 page)
 142 {
 143         struct rmi_data *data = hid_get_drvdata(hdev);
 144         int retval;
 145
 146         data->writeReport[0] = RMI_WRITE_REPORT_ID;
 147         data->writeReport[1] = 1;
 148         data->writeReport[2] = 0xFF;
 149         data->writeReport[4] = page;
 150
 151         retval = rmi_write_report(hdev, data->writeReport,
 152                         data->output_report_size);
 153         if (retval != data->output_report_size) {
 154                 dev_err(&hdev->dev,
 155                         "%s: set page failed: %d.", __func__, retval);
 156                 return retval;
 157         }
 158
 159         data->page = page;
 160         return 0;
 161 }
 162
 163 static int rmi_set_mode(struct hid_device *hdev, u8 mode)
 164 {
 165         int ret;
 166         u8 txbuf[2] = {RMI_SET_RMI_MODE_REPORT_ID, mode};
 167
 168         ret = hid_hw_raw_request(hdev, RMI_SET_RMI_MODE_REPORT_ID, txbuf,
 169                         sizeof(txbuf), HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
 170         if (ret < 0) {
 171                 dev_err(&hdev->dev, "unable to set rmi mode to %d (%d)\n", mode,
 172                         ret);
 173                 return ret;
 174         }
 175
 176         return 0;
 177 }
 178
 179 static int rmi_write_report(struct hid_device *hdev, u8 *report, int len)
 180 {
 181         int ret;
 182
 183         ret = hid_hw_output_report(hdev, (void *)report, len);
 184         if (ret < 0) {
 185                 dev_err(&hdev->dev, "failed to write hid report (%d)\n", ret);
 186                 return ret;
 187         }
 188
 189         return ret;
 190 }
 191
 192 static int rmi_read_block(struct hid_device *hdev, u16 addr, void *buf,
 193                 const int len)
 194 {
 195         struct rmi_data *data = hid_get_drvdata(hdev);
 196         int ret;
 197         int bytes_read;
 198         int bytes_needed;
 199         int retries;
 200         int read_input_count;
 201
 202         mutex_lock(&data->page_mutex);
 203
 204         if (RMI_PAGE(addr) != data->page) {
 205                 ret = rmi_set_page(hdev, RMI_PAGE(addr));
 206                 if (ret < 0)
 207                         goto exit;
 208         }
 209
 210         for (retries = 5; retries > 0; retries--) {
 211                 data->writeReport[0] = RMI_READ_ADDR_REPORT_ID;
 212                 data->writeReport[1] = 0; /* old 1 byte read count */
 213                 data->writeReport[2] = addr & 0xFF;
 214                 data->writeReport[3] = (addr >> 8) & 0xFF;
 215                 data->writeReport[4] = len  & 0xFF;
 216                 data->writeReport[5] = (len >> 8) & 0xFF;
 217
 218                 set_bit(RMI_READ_REQUEST_PENDING, &data->flags);
 219
 220                 ret = rmi_write_report(hdev, data->writeReport,
 221                                                 data->output_report_size);
 222                 if (ret != data->output_report_size) {
 223                         clear_bit(RMI_READ_REQUEST_PENDING, &data->flags);
 224                         dev_err(&hdev->dev,
 225                                 "failed to write request output report (%d)\n",
 226                                 ret);
 227                         goto exit;
 228                 }
 229
 230                 bytes_read = 0;
 231                 bytes_needed = len;
 232                 while (bytes_read < len) {
 233                         if (!wait_event_timeout(data->wait,
 234                                 test_bit(RMI_READ_DATA_PENDING, &data->flags),
 235                                         msecs_to_jiffies(1000))) {
 236                                 hid_warn(hdev, "%s: timeout elapsed\n",
 237                                          __func__);
 238                                 ret = -EAGAIN;
 239                                 break;
 240                         }
 241
 242                         read_input_count = data->readReport[1];
 243                         memcpy(buf + bytes_read, &data->readReport[2],
 244                                 read_input_count < bytes_needed ?
 245                                         read_input_count : bytes_needed);
 246
 247                         bytes_read += read_input_count;
 248                         bytes_needed -= read_input_count;
 249                         clear_bit(RMI_READ_DATA_PENDING, &data->flags);
 250                 }
 251
 252                 if (ret >= 0) {
 253                         ret = 0;
 254                         break;
 255                 }
 256         }
 257
 258 exit:
 259         clear_bit(RMI_READ_REQUEST_PENDING, &data->flags);
 260         mutex_unlock(&data->page_mutex);
 261         return ret;
 262 }
 263
 264 static inline int rmi_read(struct hid_device *hdev, u16 addr, void *buf)
 265 {
 266         return rmi_read_block(hdev, addr, buf, 1);
 267 }
 268
 269 static void rmi_f11_process_touch(struct rmi_data *hdata, int slot,
 270                 u8 finger_state, u8 *touch_data)
 271 {
 272         int x, y, wx, wy;
 273         int wide, major, minor;
 274         int z;
 275
 276         input_mt_slot(hdata->input, slot);
 277         input_mt_report_slot_state(hdata->input, MT_TOOL_FINGER,
 278                         finger_state == 0x01);
 279         if (finger_state == 0x01) {
 280                 x = (touch_data[0] << 4) | (touch_data[2] & 0x0F);
 281                 y = (touch_data[1] << 4) | (touch_data[2] >> 4);
 282                 wx = touch_data[3] & 0x0F;
 283                 wy = touch_data[3] >> 4;
 284                 wide = (wx > wy);
 285                 major = max(wx, wy);
 286                 minor = min(wx, wy);
 287                 z = touch_data[4];
 288
 289                 /* y is inverted */
 290                 y = hdata->max_y - y;
 291
 292                 input_event(hdata->input, EV_ABS, ABS_MT_POSITION_X, x);
 293                 input_event(hdata->input, EV_ABS, ABS_MT_POSITION_Y, y);
 294                 input_event(hdata->input, EV_ABS, ABS_MT_ORIENTATION, wide);
 295                 input_event(hdata->input, EV_ABS, ABS_MT_PRESSURE, z);
 296                 input_event(hdata->input, EV_ABS, ABS_MT_TOUCH_MAJOR, major);
 297                 input_event(hdata->input, EV_ABS, ABS_MT_TOUCH_MINOR, minor);
 298         }
 299 }
 300
 301 static void rmi_reset_work(struct work_struct *work)
 302 {
 303         struct rmi_data *hdata = container_of(work, struct rmi_data,
 304                                                 reset_work);
 305
 306         /* switch the device to RMI if we receive a generic mouse report */
 307         rmi_set_mode(hdata->hdev, RMI_MODE_ATTN_REPORTS);
 308 }
 309
 310 static inline int rmi_schedule_reset(struct hid_device *hdev)
 311 {
 312         struct rmi_data *hdata = hid_get_drvdata(hdev);
 313         return schedule_work(&hdata->reset_work);
 314 }
 315
 316 static int rmi_f11_input_event(struct hid_device *hdev, u8 irq, u8 *data,
 317                 int size)
 318 {
 319         struct rmi_data *hdata = hid_get_drvdata(hdev);
 320         int offset;
 321         int i;
 322
 323         if (!(irq & hdata->f11.irq_mask) || size <= 0)
 324                 return 0;
 325
 326         offset = (hdata->max_fingers >> 2) + 1;
 327         for (i = 0; i < hdata->max_fingers; i++) {
 328                 int fs_byte_position = i >> 2;
 329                 int fs_bit_position = (i & 0x3) << 1;
 330                 int finger_state = (data[fs_byte_position] >> fs_bit_position) &
 331                                         0x03;
 332                 int position = offset + 5 * i;
 333
 334                 if (position + 5 > size) {
 335                         /* partial report, go on with what we received */
 336                         printk_once(KERN_WARNING
 337                                 "%s %s: Detected incomplete finger report. Finger reports may occasionally get dropped on this platform.\n",
 338                                  dev_driver_string(&hdev->dev),
 339                                  dev_name(&hdev->dev));
 340                         hid_dbg(hdev, "Incomplete finger report\n");
 341                         break;
 342                 }
 343
 344                 rmi_f11_process_touch(hdata, i, finger_state, &data[position]);
 345         }
 346         input_mt_sync_frame(hdata->input);
 347         input_sync(hdata->input);
 348         return hdata->f11.report_size;
 349 }
 350
 351 static int rmi_f30_input_event(struct hid_device *hdev, u8 irq, u8 *data,
 352                 int size)
 353 {
 354         struct rmi_data *hdata = hid_get_drvdata(hdev);
 355         int i;
 356         int button = 0;
 357         bool value;
 358
 359         if (!(irq & hdata->f30.irq_mask))
 360                 return 0;
 361
 362         if (size < (int)hdata->f30.report_size) {
 363                 hid_warn(hdev, "Click Button pressed, but the click data is missing\n");
 364                 return 0;
 365         }
 366
 367         for (i = 0; i < hdata->gpio_led_count; i++) {
 368                 if (test_bit(i, &hdata->button_mask)) {
 369                         value = (data[i / 8] >> (i & 0x07)) & BIT(0);
 370                         if (test_bit(i, &hdata->button_state_mask))
 371                                 value = !value;
 372                         input_event(hdata->input, EV_KEY, BTN_LEFT + button++,
 373                                         value);
 374                 }
 375         }
 376         return hdata->f30.report_size;
 377 }
 378
 379 static int rmi_input_event(struct hid_device *hdev, u8 *data, int size)
 380 {
 381         struct rmi_data *hdata = hid_get_drvdata(hdev);
 382         unsigned long irq_mask = 0;
 383         unsigned index = 2;
 384
 385         if (!(test_bit(RMI_STARTED, &hdata->flags)))
 386                 return 0;
 387
 388         irq_mask |= hdata->f11.irq_mask;
 389         irq_mask |= hdata->f30.irq_mask;
 390
 391         if (data[1] & ~irq_mask)
 392                 hid_dbg(hdev, "unknown intr source:%02lx %s:%d\n",
 393                         data[1] & ~irq_mask, __FILE__, __LINE__);
 394
 395         if (hdata->f11.interrupt_base < hdata->f30.interrupt_base) {
 396                 index += rmi_f11_input_event(hdev, data[1], &data[index],
 397                                 size - index);
 398                 index += rmi_f30_input_event(hdev, data[1], &data[index],
 399                                 size - index);
 400         } else {
 401                 index += rmi_f30_input_event(hdev, data[1], &data[index],
 402                                 size - index);
 403                 index += rmi_f11_input_event(hdev, data[1], &data[index],
 404                                 size - index);
 405         }
 406
 407         return 1;
 408 }
 409
 410 static int rmi_read_data_event(struct hid_device *hdev, u8 *data, int size)
 411 {
 412         struct rmi_data *hdata = hid_get_drvdata(hdev);
 413
 414         if (!test_bit(RMI_READ_REQUEST_PENDING, &hdata->flags)) {
 415                 hid_dbg(hdev, "no read request pending\n");
 416                 return 0;
 417         }
 418
 419         memcpy(hdata->readReport, data, size < hdata->input_report_size ?
 420                         size : hdata->input_report_size);
 421         set_bit(RMI_READ_DATA_PENDING, &hdata->flags);
 422         wake_up(&hdata->wait);
 423
 424         return 1;
 425 }
 426
 427 static int rmi_check_sanity(struct hid_device *hdev, u8 *data, int size)
 428 {
 429         int valid_size = size;
 430         /*
 431          * On the Dell XPS 13 9333, the bus sometimes get confused and fills
 432          * the report with a sentinel value "ff". Synaptics told us that such
 433          * behavior does not comes from the touchpad itself, so we filter out
 434          * such reports here.
 435          */
 436
 437         while ((data[valid_size - 1] == 0xff) && valid_size > 0)
 438                 valid_size--;
 439
 440         return valid_size;
 441 }
 442
 443 static int rmi_raw_event(struct hid_device *hdev,
 444                 struct hid_report *report, u8 *data, int size)
 445 {
 446         size = rmi_check_sanity(hdev, data, size);
 447         if (size < 2)
 448                 return 0;
 449
 450         switch (data[0]) {
 451         case RMI_READ_DATA_REPORT_ID:
 452                 return rmi_read_data_event(hdev, data, size);
 453         case RMI_ATTN_REPORT_ID:
 454                 return rmi_input_event(hdev, data, size);
 455         case RMI_MOUSE_REPORT_ID:
 456                 rmi_schedule_reset(hdev);
 457                 break;
 458         }
 459
 460         return 0;
 461 }
 462
 463 #ifdef CONFIG_PM
 464 static int rmi_post_reset(struct hid_device *hdev)
 465 {
 466         return rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
 467 }
 468
 469 static int rmi_post_resume(struct hid_device *hdev)
 470 {
 471         return rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
 472 }
 473 #endif /* CONFIG_PM */
 474
 475 #define RMI4_MAX_PAGE 0xff
 476 #define RMI4_PAGE_SIZE 0x0100
 477
 478 #define PDT_START_SCAN_LOCATION 0x00e9
 479 #define PDT_END_SCAN_LOCATION   0x0005
 480 #define RMI4_END_OF_PDT(id) ((id) == 0x00 || (id) == 0xff)
 481
 482 struct pdt_entry {
 483         u8 query_base_addr:8;
 484         u8 command_base_addr:8;
 485         u8 control_base_addr:8;
 486         u8 data_base_addr:8;
 487         u8 interrupt_source_count:3;
 488         u8 bits3and4:2;
 489         u8 function_version:2;
 490         u8 bit7:1;
 491         u8 function_number:8;
 492 } __attribute__((__packed__));
 493
 494 static inline unsigned long rmi_gen_mask(unsigned irq_base, unsigned irq_count)
 495 {
 496         return GENMASK(irq_count + irq_base - 1, irq_base);
 497 }
 498
 499 static void rmi_register_function(struct rmi_data *data,
 500         struct pdt_entry *pdt_entry, int page, unsigned interrupt_count)
 501 {
 502         struct rmi_function *f = NULL;
 503         u16 page_base = page << 8;
 504
 505         switch (pdt_entry->function_number) {
 506         case 0x11:
 507                 f = &data->f11;
 508                 break;
 509         case 0x30:
 510                 f = &data->f30;
 511                 break;
 512         }
 513
 514         if (f) {
 515                 f->page = page;
 516                 f->query_base_addr = page_base | pdt_entry->query_base_addr;
 517                 f->command_base_addr = page_base | pdt_entry->command_base_addr;
 518                 f->control_base_addr = page_base | pdt_entry->control_base_addr;
 519                 f->data_base_addr = page_base | pdt_entry->data_base_addr;
 520                 f->interrupt_base = interrupt_count;
 521                 f->interrupt_count = pdt_entry->interrupt_source_count;
 522                 f->irq_mask = rmi_gen_mask(f->interrupt_base,
 523                                                 f->interrupt_count);
 524         }
 525 }
 526
 527 static int rmi_scan_pdt(struct hid_device *hdev)
 528 {
 529         struct rmi_data *data = hid_get_drvdata(hdev);
 530         struct pdt_entry entry;
 531         int page;
 532         bool page_has_function;
 533         int i;
 534         int retval;
 535         int interrupt = 0;
 536         u16 page_start, pdt_start , pdt_end;
 537
 538         hid_info(hdev, "Scanning PDT...\n");
 539
 540         for (page = 0; (page <= RMI4_MAX_PAGE); page++) {
 541                 page_start = RMI4_PAGE_SIZE * page;
 542                 pdt_start = page_start + PDT_START_SCAN_LOCATION;
 543                 pdt_end = page_start + PDT_END_SCAN_LOCATION;
 544
 545                 page_has_function = false;
 546                 for (i = pdt_start; i >= pdt_end; i -= sizeof(entry)) {
 547                         retval = rmi_read_block(hdev, i, &entry, sizeof(entry));
 548                         if (retval) {
 549                                 hid_err(hdev,
 550                                         "Read of PDT entry at %#06x failed.\n",
 551                                         i);
 552                                 goto error_exit;
 553                         }
 554
 555                         if (RMI4_END_OF_PDT(entry.function_number))
 556                                 break;
 557
 558                         page_has_function = true;
 559
 560                         hid_info(hdev, "Found F%02X on page %#04x\n",
 561                                         entry.function_number, page);
 562
 563                         rmi_register_function(data, &entry, page, interrupt);
 564                         interrupt += entry.interrupt_source_count;
 565                 }
 566
 567                 if (!page_has_function)
 568                         break;
 569         }
 570
 571         hid_info(hdev, "%s: Done with PDT scan.\n", __func__);
 572         retval = 0;
 573
 574 error_exit:
 575         return retval;
 576 }
 577
 578 static int rmi_populate_f11(struct hid_device *hdev)
 579 {
 580         struct rmi_data *data = hid_get_drvdata(hdev);
 581         u8 buf[20];
 582         int ret;
 583         bool has_query9;
 584         bool has_query10 = false;
 585         bool has_query11;
 586         bool has_query12;
 587         bool has_query27;
 588         bool has_query28;
 589         bool has_query36 = false;
 590         bool has_physical_props;
 591         bool has_gestures;
 592         bool has_rel;
 593         bool has_data40 = false;
 594         unsigned x_size, y_size;
 595         u16 query_offset;
 596
 597         if (!data->f11.query_base_addr) {
 598                 hid_err(hdev, "No 2D sensor found, giving up.\n");
 599                 return -ENODEV;
 600         }
 601
 602         /* query 0 contains some useful information */
 603         ret = rmi_read(hdev, data->f11.query_base_addr, buf);
 604         if (ret) {
 605                 hid_err(hdev, "can not get query 0: %d.\n", ret);
 606                 return ret;
 607         }
 608         has_query9 = !!(buf[0] & BIT(3));
 609         has_query11 = !!(buf[0] & BIT(4));
 610         has_query12 = !!(buf[0] & BIT(5));
 611         has_query27 = !!(buf[0] & BIT(6));
 612         has_query28 = !!(buf[0] & BIT(7));
 613
 614         /* query 1 to get the max number of fingers */
 615         ret = rmi_read(hdev, data->f11.query_base_addr + 1, buf);
 616         if (ret) {
 617                 hid_err(hdev, "can not get NumberOfFingers: %d.\n", ret);
 618                 return ret;
 619         }
 620         data->max_fingers = (buf[0] & 0x07) + 1;
 621         if (data->max_fingers > 5)
 622                 data->max_fingers = 10;
 623
 624         data->f11.report_size = data->max_fingers * 5 +
 625                                 DIV_ROUND_UP(data->max_fingers, 4);
 626
 627         if (!(buf[0] & BIT(4))) {
 628                 hid_err(hdev, "No absolute events, giving up.\n");
 629                 return -ENODEV;
 630         }
 631
 632         has_rel = !!(buf[0] & BIT(3));
 633         has_gestures = !!(buf[0] & BIT(5));
 634
 635         /*
 636          * At least 4 queries are guaranteed to be present in F11
 637          * +1 for query 5 which is present since absolute events are
 638          * reported and +1 for query 12.
 639          */
 640         query_offset = 6;
 641
 642         if (has_rel)
 643                 ++query_offset; /* query 6 is present */
 644
 645         if (has_gestures) {
 646                 /* query 8 to find out if query 10 exists */
 647                 ret = rmi_read(hdev,
 648                         data->f11.query_base_addr + query_offset + 1, buf);
 649                 if (ret) {
 650                         hid_err(hdev, "can not read gesture information: %d.\n",
 651                                 ret);
 652                         return ret;
 653                 }
 654                 has_query10 = !!(buf[0] & BIT(2));
 655
 656                 query_offset += 2; /* query 7 and 8 are present */
 657         }
 658
 659         if (has_query9)
 660                 ++query_offset;
 661
 662         if (has_query10)
 663                 ++query_offset;
 664
 665         if (has_query11)
 666                 ++query_offset;
 667
 668         /* query 12 to know if the physical properties are reported */
 669         if (has_query12) {
 670                 ret = rmi_read(hdev, data->f11.query_base_addr
 671                                 + query_offset, buf);
 672                 if (ret) {
 673                         hid_err(hdev, "can not get query 12: %d.\n", ret);
 674                         return ret;
 675                 }
 676                 has_physical_props = !!(buf[0] & BIT(5));
 677
 678                 if (has_physical_props) {
 679                         query_offset += 1;
 680                         ret = rmi_read_block(hdev,
 681                                         data->f11.query_base_addr
 682                                                 + query_offset, buf, 4);
 683                         if (ret) {
 684                                 hid_err(hdev, "can not read query 15-18: %d.\n",
 685                                         ret);
 686                                 return ret;
 687                         }
 688
 689                         x_size = buf[0] | (buf[1] << 8);
 690                         y_size = buf[2] | (buf[3] << 8);
 691
 692                         data->x_size_mm = DIV_ROUND_CLOSEST(x_size, 10);
 693                         data->y_size_mm = DIV_ROUND_CLOSEST(y_size, 10);
 694
 695                         hid_info(hdev, "%s: size in mm: %d x %d\n",
 696                                  __func__, data->x_size_mm, data->y_size_mm);
 697
 698                         /*
 699                          * query 15 - 18 contain the size of the sensor
 700                          * and query 19 - 26 contain bezel dimensions
 701                          */
 702                         query_offset += 12;
 703                 }
 704         }
 705
 706         if (has_query27)
 707                 ++query_offset;
 708
 709         if (has_query28) {
 710                 ret = rmi_read(hdev, data->f11.query_base_addr
 711                                 + query_offset, buf);
 712                 if (ret) {
 713                         hid_err(hdev, "can not get query 28: %d.\n", ret);
 714                         return ret;
 715                 }
 716
 717                 has_query36 = !!(buf[0] & BIT(6));
 718         }
 719
 720         if (has_query36) {
 721                 query_offset += 2;
 722                 ret = rmi_read(hdev, data->f11.query_base_addr
 723                                 + query_offset, buf);
 724                 if (ret) {
 725                         hid_err(hdev, "can not get query 36: %d.\n", ret);
 726                         return ret;
 727                 }
 728
 729                 has_data40 = !!(buf[0] & BIT(5));
 730         }
 731
 732
 733         if (has_data40)
 734                 data->f11.report_size += data->max_fingers * 2;
 735
 736         /*
 737          * retrieve the ctrl registers
 738          * the ctrl register has a size of 20 but a fw bug split it into 16 + 4,
 739          * and there is no way to know if the first 20 bytes are here or not.
 740          * We use only the first 10 bytes, so get only them.
 741          */
 742         ret = rmi_read_block(hdev, data->f11.control_base_addr, buf, 10);
 743         if (ret) {
 744                 hid_err(hdev, "can not read ctrl block of size 10: %d.\n", ret);
 745                 return ret;
 746         }
 747
 748         data->max_x = buf[6] | (buf[7] << 8);
 749         data->max_y = buf[8] | (buf[9] << 8);
 750
 751         return 0;
 752 }
 753
 754 static int rmi_populate_f30(struct hid_device *hdev)
 755 {
 756         struct rmi_data *data = hid_get_drvdata(hdev);
 757         u8 buf[20];
 758         int ret;
 759         bool has_gpio, has_led;
 760         unsigned bytes_per_ctrl;
 761         u8 ctrl2_addr;
 762         int ctrl2_3_length;
 763         int i;
 764
 765         /* function F30 is for physical buttons */
 766         if (!data->f30.query_base_addr) {
 767                 hid_err(hdev, "No GPIO/LEDs found, giving up.\n");
 768                 return -ENODEV;
 769         }
 770
 771         ret = rmi_read_block(hdev, data->f30.query_base_addr, buf, 2);
 772         if (ret) {
 773                 hid_err(hdev, "can not get F30 query registers: %d.\n", ret);
 774                 return ret;
 775         }
 776
 777         has_gpio = !!(buf[0] & BIT(3));
 778         has_led = !!(buf[0] & BIT(2));
 779         data->gpio_led_count = buf[1] & 0x1f;
 780
 781         /* retrieve ctrl 2 & 3 registers */
 782         bytes_per_ctrl = (data->gpio_led_count + 7) / 8;
 783         /* Ctrl0 is present only if both has_gpio and has_led are set*/
 784         ctrl2_addr = (has_gpio && has_led) ? bytes_per_ctrl : 0;
 785         /* Ctrl1 is always be present */
 786         ctrl2_addr += bytes_per_ctrl;
 787         ctrl2_3_length = 2 * bytes_per_ctrl;
 788
 789         data->f30.report_size = bytes_per_ctrl;
 790
 791         ret = rmi_read_block(hdev, data->f30.control_base_addr + ctrl2_addr,
 792                                 buf, ctrl2_3_length);
 793         if (ret) {
 794                 hid_err(hdev, "can not read ctrl 2&3 block of size %d: %d.\n",
 795                         ctrl2_3_length, ret);
 796                 return ret;
 797         }
 798
 799         for (i = 0; i < data->gpio_led_count; i++) {
 800                 int byte_position = i >> 3;
 801                 int bit_position = i & 0x07;
 802                 u8 dir_byte = buf[byte_position];
 803                 u8 data_byte = buf[byte_position + bytes_per_ctrl];
 804                 bool dir = (dir_byte >> bit_position) & BIT(0);
 805                 bool dat = (data_byte >> bit_position) & BIT(0);
 806
 807                 if (dir == 0) {
 808                         /* input mode */
 809                         if (dat) {
 810                                 /* actual buttons have pull up resistor */
 811                                 data->button_count++;
 812                                 set_bit(i, &data->button_mask);
 813                                 set_bit(i, &data->button_state_mask);
 814                         }
 815                 }
 816
 817         }
 818
 819         return 0;
 820 }
 821
 822 static int rmi_populate(struct hid_device *hdev)
 823 {
 824         int ret;
 825
 826         ret = rmi_scan_pdt(hdev);
 827         if (ret) {
 828                 hid_err(hdev, "PDT scan failed with code %d.\n", ret);
 829                 return ret;
 830         }
 831
 832         ret = rmi_populate_f11(hdev);
 833         if (ret) {
 834                 hid_err(hdev, "Error while initializing F11 (%d).\n", ret);
 835                 return ret;
 836         }
 837
 838         ret = rmi_populate_f30(hdev);
 839         if (ret)
 840                 hid_warn(hdev, "Error while initializing F30 (%d).\n", ret);
 841
 842         return 0;
 843 }
 844
 845 static void rmi_input_configured(struct hid_device *hdev, struct hid_input *hi)
 846 {
 847         struct rmi_data *data = hid_get_drvdata(hdev);
 848         struct input_dev *input = hi->input;
 849         int ret;
 850         int res_x, res_y, i;
 851
 852         data->input = input;
 853
 854         hid_dbg(hdev, "Opening low level driver\n");
 855         ret = hid_hw_open(hdev);
 856         if (ret)
 857                 return;
 858
 859         /* Allow incoming hid reports */
 860         hid_device_io_start(hdev);
 861
 862         ret = rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
 863         if (ret < 0) {
 864                 dev_err(&hdev->dev, "failed to set rmi mode\n");
 865                 goto exit;
 866         }
 867
 868         ret = rmi_set_page(hdev, 0);
 869         if (ret < 0) {
 870                 dev_err(&hdev->dev, "failed to set page select to 0.\n");
 871                 goto exit;
 872         }
 873
 874         ret = rmi_populate(hdev);
 875         if (ret)
 876                 goto exit;
 877
 878         __set_bit(EV_ABS, input->evbit);
 879         input_set_abs_params(input, ABS_MT_POSITION_X, 1, data->max_x, 0, 0);
 880         input_set_abs_params(input, ABS_MT_POSITION_Y, 1, data->max_y, 0, 0);
 881
 882         if (data->x_size_mm && data->y_size_mm) {
 883                 res_x = (data->max_x - 1) / data->x_size_mm;
 884                 res_y = (data->max_y - 1) / data->y_size_mm;
 885
 886                 input_abs_set_res(input, ABS_MT_POSITION_X, res_x);
 887                 input_abs_set_res(input, ABS_MT_POSITION_Y, res_y);
 888         }
 889
 890         input_set_abs_params(input, ABS_MT_ORIENTATION, 0, 1, 0, 0);
 891         input_set_abs_params(input, ABS_MT_PRESSURE, 0, 0xff, 0, 0);
 892         input_set_abs_params(input, ABS_MT_TOUCH_MAJOR, 0, 0x0f, 0, 0);
 893         input_set_abs_params(input, ABS_MT_TOUCH_MINOR, 0, 0x0f, 0, 0);
 894
 895         input_mt_init_slots(input, data->max_fingers, INPUT_MT_POINTER);
 896
 897         if (data->button_count) {
 898                 __set_bit(EV_KEY, input->evbit);
 899                 for (i = 0; i < data->button_count; i++)
 900                         __set_bit(BTN_LEFT + i, input->keybit);
 901
 902                 if (data->button_count == 1)
 903                         __set_bit(INPUT_PROP_BUTTONPAD, input->propbit);
 904         }
 905
 906         set_bit(RMI_STARTED, &data->flags);
 907
 908 exit:
 909         hid_device_io_stop(hdev);
 910         hid_hw_close(hdev);
 911 }
 912
 913 static int rmi_input_mapping(struct hid_device *hdev,
 914                 struct hid_input *hi, struct hid_field *field,
 915                 struct hid_usage *usage, unsigned long **bit, int *max)
 916 {
 917         /* we want to make HID ignore the advertised HID collection */
 918         return -1;
 919 }
 920
 921 static int rmi_probe(struct hid_device *hdev, const struct hid_device_id *id)
 922 {
 923         struct rmi_data *data = NULL;
 924         int ret;
 925         size_t alloc_size;
 926         struct hid_report *input_report;
 927         struct hid_report *output_report;
 928
 929         data = devm_kzalloc(&hdev->dev, sizeof(struct rmi_data), GFP_KERNEL);
 930         if (!data)
 931                 return -ENOMEM;
 932
 933         INIT_WORK(&data->reset_work, rmi_reset_work);
 934         data->hdev = hdev;
 935
 936         hid_set_drvdata(hdev, data);
 937
 938         hdev->quirks |= HID_QUIRK_NO_INIT_REPORTS;
 939
 940         ret = hid_parse(hdev);
 941         if (ret) {
 942                 hid_err(hdev, "parse failed\n");
 943                 return ret;
 944         }
 945
 946         input_report = hdev->report_enum[HID_INPUT_REPORT]
 947                         .report_id_hash[RMI_ATTN_REPORT_ID];
 948         if (!input_report) {
 949                 hid_err(hdev, "device does not have expected input report\n");
 950                 ret = -ENODEV;
 951                 return ret;
 952         }
 953
 954         data->input_report_size = (input_report->size >> 3) + 1 /* report id */;
 955
 956         output_report = hdev->report_enum[HID_OUTPUT_REPORT]
 957                         .report_id_hash[RMI_WRITE_REPORT_ID];
 958         if (!output_report) {
 959                 hid_err(hdev, "device does not have expected output report\n");
 960                 ret = -ENODEV;
 961                 return ret;
 962         }
 963
 964         data->output_report_size = (output_report->size >> 3)
 965                                         + 1 /* report id */;
 966
 967         alloc_size = data->output_report_size + data->input_report_size;
 968
 969         data->writeReport = devm_kzalloc(&hdev->dev, alloc_size, GFP_KERNEL);
 970         if (!data->writeReport) {
 971                 ret = -ENOMEM;
 972                 return ret;
 973         }
 974
 975         data->readReport = data->writeReport + data->output_report_size;
 976
 977         init_waitqueue_head(&data->wait);
 978
 979         mutex_init(&data->page_mutex);
 980
 981         ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
 982         if (ret) {
 983                 hid_err(hdev, "hw start failed\n");
 984                 return ret;
 985         }
 986
 987         if (!test_bit(RMI_STARTED, &data->flags))
 988                 /*
 989                  * The device maybe in the bootloader if rmi_input_configured
 990                  * failed to find F11 in the PDT. Print an error, but don't
 991                  * return an error from rmi_probe so that hidraw will be
 992                  * accessible from userspace. That way a userspace tool
 993                  * can be used to reload working firmware on the touchpad.
 994                  */
 995                 hid_err(hdev, "Device failed to be properly configured\n");
 996
 997         return 0;
 998 }
 999
1000 static void rmi_remove(struct hid_device *hdev)
1001 {
1002         struct rmi_data *hdata = hid_get_drvdata(hdev);
1003
1004         clear_bit(RMI_STARTED, &hdata->flags);
1005
1006         hid_hw_stop(hdev);
1007 }
1008
1009 static const struct hid_device_id rmi_id[] = {
1010         { HID_DEVICE(HID_BUS_ANY, HID_GROUP_RMI, HID_ANY_ID, HID_ANY_ID) },
1011         { }
1012 };
1013 MODULE_DEVICE_TABLE(hid, rmi_id);
1014
1015 static struct hid_driver rmi_driver = {
1016         .name = "hid-rmi",
1017         .id_table               = rmi_id,
1018         .probe                  = rmi_probe,
1019         .remove                 = rmi_remove,
1020         .raw_event              = rmi_raw_event,
1021         .input_mapping          = rmi_input_mapping,
1022         .input_configured       = rmi_input_configured,
1023 #ifdef CONFIG_PM
1024         .resume                 = rmi_post_resume,
1025         .reset_resume           = rmi_post_reset,
1026 #endif
1027 };
1028
1029 module_hid_driver(rmi_driver);
1030
1031 MODULE_AUTHOR("Andrew Duggan <aduggan@synaptics.com>");
1032 MODULE_DESCRIPTION("RMI HID driver");
1033 MODULE_LICENSE("GPL");