1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2013 Andrew Duggan <aduggan@synaptics.com>
4 * Copyright (c) 2013 Synaptics Incorporated
5 * Copyright (c) 2014 Benjamin Tissoires <benjamin.tissoires@gmail.com>
6 * Copyright (c) 2014 Red Hat, Inc
7 */
8
9 #include <linux/kernel.h>
10 #include <linux/hid.h>
11 #include <linux/input.h>
12 #include <linux/input/mt.h>
13 #include <linux/irq.h>
14 #include <linux/irqdomain.h>
15 #include <linux/module.h>
16 #include <linux/pm.h>
17 #include <linux/slab.h>
18 #include <linux/wait.h>
19 #include <linux/sched.h>
20 #include <linux/rmi.h>
21 #include "hid-ids.h"
22
23 #define RMI_MOUSE_REPORT_ID 0x01 /* Mouse emulation Report */
24 #define RMI_WRITE_REPORT_ID 0x09 /* Output Report */
25 #define RMI_READ_ADDR_REPORT_ID 0x0a /* Output Report */
26 #define RMI_READ_DATA_REPORT_ID 0x0b /* Input Report */
27 #define RMI_ATTN_REPORT_ID 0x0c /* Input Report */
28 #define RMI_SET_RMI_MODE_REPORT_ID 0x0f /* Feature Report */
29
30 /* flags */
31 #define RMI_READ_REQUEST_PENDING 0
32 #define RMI_READ_DATA_PENDING 1
33 #define RMI_STARTED 2
34
35 /* device flags */
36 #define RMI_DEVICE BIT(0)
37 #define RMI_DEVICE_HAS_PHYS_BUTTONS BIT(1)
38 #define RMI_DEVICE_OUTPUT_SET_REPORT BIT(2)
39
40 /*
41 * retrieve the ctrl registers
42 * the ctrl register has a size of 20 but a fw bug split it into 16 + 4,
43 * and there is no way to know if the first 20 bytes are here or not.
44 * We use only the first 12 bytes, so get only them.
45 */
46 #define RMI_F11_CTRL_REG_COUNT 12
47
48 enum rmi_mode_type {
49 RMI_MODE_OFF = 0,
50 RMI_MODE_ATTN_REPORTS = 1,
51 RMI_MODE_NO_PACKED_ATTN_REPORTS = 2,
52 };
53
54 /**
55 * struct rmi_data - stores information for hid communication
56 *
57 * @page_mutex: Locks current page to avoid changing pages in unexpected ways.
58 * @page: Keeps track of the current virtual page
59 * @xport: transport device to be registered with the RMI4 core.
60 *
61 * @wait: Used for waiting for read data
62 *
63 * @writeReport: output buffer when writing RMI registers
64 * @readReport: input buffer when reading RMI registers
65 *
66 * @input_report_size: size of an input report (advertised by HID)
67 * @output_report_size: size of an output report (advertised by HID)
68 *
69 * @flags: flags for the current device (started, reading, etc...)
70 *
71 * @reset_work: worker which will be called in case of a mouse report
72 * @hdev: pointer to the struct hid_device
73 *
74 * @device_flags: flags which describe the device
75 *
76 * @domain: the IRQ domain allocated for this RMI4 device
77 * @rmi_irq: the irq that will be used to generate events to rmi-core
78 */
79 struct rmi_data {
80 struct mutex page_mutex;
81 int page;
82 struct rmi_transport_dev xport;
83
84 wait_queue_head_t wait;
85
86 u8 *writeReport;
87 u8 *readReport;
88
89 u32 input_report_size;
90 u32 output_report_size;
91
92 unsigned long flags;
93
94 struct work_struct reset_work;
95 struct hid_device *hdev;
96
97 unsigned long device_flags;
98
99 struct irq_domain *domain;
100 int rmi_irq;
101 };
102
103 #define RMI_PAGE(addr) (((addr) >> 8) & 0xff)
104
105 static int rmi_write_report(struct hid_device *hdev, u8 *report, int len);
106
107 /**
108 * rmi_set_page - Set RMI page
109 * @hdev: The pointer to the hid_device struct
110 * @page: The new page address.
111 *
112 * RMI devices have 16-bit addressing, but some of the physical
113 * implementations (like SMBus) only have 8-bit addressing. So RMI implements
114 * a page address at 0xff of every page so we can reliable page addresses
115 * every 256 registers.
116 *
117 * The page_mutex lock must be held when this function is entered.
118 *
119 * Returns zero on success, non-zero on failure.
120 */
rmi_set_page(struct hid_device * hdev,u8 page)121 static int rmi_set_page(struct hid_device *hdev, u8 page)
122 {
123 struct rmi_data *data = hid_get_drvdata(hdev);
124 int retval;
125
126 data->writeReport[0] = RMI_WRITE_REPORT_ID;
127 data->writeReport[1] = 1;
128 data->writeReport[2] = 0xFF;
129 data->writeReport[4] = page;
130
131 retval = rmi_write_report(hdev, data->writeReport,
132 data->output_report_size);
133 if (retval != data->output_report_size) {
134 dev_err(&hdev->dev,
135 "%s: set page failed: %d.", __func__, retval);
136 return retval;
137 }
138
139 data->page = page;
140 return 0;
141 }
142
rmi_set_mode(struct hid_device * hdev,u8 mode)143 static int rmi_set_mode(struct hid_device *hdev, u8 mode)
144 {
145 int ret;
146 const u8 txbuf[2] = {RMI_SET_RMI_MODE_REPORT_ID, mode};
147 u8 *buf;
148
149 buf = kmemdup(txbuf, sizeof(txbuf), GFP_KERNEL);
150 if (!buf)
151 return -ENOMEM;
152
153 ret = hid_hw_raw_request(hdev, RMI_SET_RMI_MODE_REPORT_ID, buf,
154 sizeof(txbuf), HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
155 kfree(buf);
156 if (ret < 0) {
157 dev_err(&hdev->dev, "unable to set rmi mode to %d (%d)\n", mode,
158 ret);
159 return ret;
160 }
161
162 return 0;
163 }
164
rmi_write_report(struct hid_device * hdev,u8 * report,int len)165 static int rmi_write_report(struct hid_device *hdev, u8 *report, int len)
166 {
167 struct rmi_data *data = hid_get_drvdata(hdev);
168 int ret;
169
170 if (data->device_flags & RMI_DEVICE_OUTPUT_SET_REPORT) {
171 /*
172 * Talk to device by using SET_REPORT requests instead.
173 */
174 ret = hid_hw_raw_request(hdev, report[0], report,
175 len, HID_OUTPUT_REPORT, HID_REQ_SET_REPORT);
176 } else {
177 ret = hid_hw_output_report(hdev, (void *)report, len);
178 }
179
180 if (ret < 0) {
181 dev_err(&hdev->dev, "failed to write hid report (%d)\n", ret);
182 return ret;
183 }
184
185 return ret;
186 }
187
rmi_hid_read_block(struct rmi_transport_dev * xport,u16 addr,void * buf,size_t len)188 static int rmi_hid_read_block(struct rmi_transport_dev *xport, u16 addr,
189 void *buf, size_t len)
190 {
191 struct rmi_data *data = container_of(xport, struct rmi_data, xport);
192 struct hid_device *hdev = data->hdev;
193 int ret;
194 int bytes_read;
195 int bytes_needed;
196 int retries;
197 int read_input_count;
198
199 mutex_lock(&data->page_mutex);
200
201 if (RMI_PAGE(addr) != data->page) {
202 ret = rmi_set_page(hdev, RMI_PAGE(addr));
203 if (ret < 0)
204 goto exit;
205 }
206
207 for (retries = 5; retries > 0; retries--) {
208 data->writeReport[0] = RMI_READ_ADDR_REPORT_ID;
209 data->writeReport[1] = 0; /* old 1 byte read count */
210 data->writeReport[2] = addr & 0xFF;
211 data->writeReport[3] = (addr >> 8) & 0xFF;
212 data->writeReport[4] = len & 0xFF;
213 data->writeReport[5] = (len >> 8) & 0xFF;
214
215 set_bit(RMI_READ_REQUEST_PENDING, &data->flags);
216
217 ret = rmi_write_report(hdev, data->writeReport,
218 data->output_report_size);
219 if (ret != data->output_report_size) {
220 dev_err(&hdev->dev,
221 "failed to write request output report (%d)\n",
222 ret);
223 goto exit;
224 }
225
226 bytes_read = 0;
227 bytes_needed = len;
228 while (bytes_read < len) {
229 if (!wait_event_timeout(data->wait,
230 test_bit(RMI_READ_DATA_PENDING, &data->flags),
231 msecs_to_jiffies(1000))) {
232 hid_warn(hdev, "%s: timeout elapsed\n",
233 __func__);
234 ret = -EAGAIN;
235 break;
236 }
237
238 read_input_count = min_t(int, data->readReport[1],
239 data->input_report_size - 2);
240 if (!read_input_count) {
241 /*
242 * A zero length reply advances neither
243 * bytes_read nor bytes_needed, and because a
244 * reply did arrive the wait above does not
245 * time out either, so a device answering 0
246 * forever would spin here indefinitely with
247 * page_mutex held.
248 */
249 hid_warn(hdev, "%s: zero-length read reply\n",
250 __func__);
251 clear_bit(RMI_READ_DATA_PENDING, &data->flags);
252 ret = -EIO;
253 break;
254 }
255 memcpy(buf + bytes_read, &data->readReport[2],
256 min(read_input_count, bytes_needed));
257
258 bytes_read += read_input_count;
259 bytes_needed -= read_input_count;
260 clear_bit(RMI_READ_DATA_PENDING, &data->flags);
261 }
262
263 if (ret >= 0) {
264 ret = 0;
265 break;
266 }
267 }
268
269 exit:
270 clear_bit(RMI_READ_REQUEST_PENDING, &data->flags);
271 mutex_unlock(&data->page_mutex);
272 return ret;
273 }
274
rmi_hid_write_block(struct rmi_transport_dev * xport,u16 addr,const void * buf,size_t len)275 static int rmi_hid_write_block(struct rmi_transport_dev *xport, u16 addr,
276 const void *buf, size_t len)
277 {
278 struct rmi_data *data = container_of(xport, struct rmi_data, xport);
279 struct hid_device *hdev = data->hdev;
280 int ret;
281
282 mutex_lock(&data->page_mutex);
283
284 if (RMI_PAGE(addr) != data->page) {
285 ret = rmi_set_page(hdev, RMI_PAGE(addr));
286 if (ret < 0)
287 goto exit;
288 }
289
290 if (len + 4 > data->output_report_size) {
291 ret = -EINVAL;
292 goto exit;
293 }
294
295 data->writeReport[0] = RMI_WRITE_REPORT_ID;
296 data->writeReport[1] = len;
297 data->writeReport[2] = addr & 0xFF;
298 data->writeReport[3] = (addr >> 8) & 0xFF;
299 memcpy(&data->writeReport[4], buf, len);
300
301 ret = rmi_write_report(hdev, data->writeReport,
302 data->output_report_size);
303 if (ret < 0) {
304 dev_err(&hdev->dev,
305 "failed to write request output report (%d)\n",
306 ret);
307 goto exit;
308 }
309 ret = 0;
310
311 exit:
312 mutex_unlock(&data->page_mutex);
313 return ret;
314 }
315
rmi_reset_attn_mode(struct hid_device * hdev)316 static int rmi_reset_attn_mode(struct hid_device *hdev)
317 {
318 struct rmi_data *data = hid_get_drvdata(hdev);
319 struct rmi_device *rmi_dev = data->xport.rmi_dev;
320 int ret;
321
322 ret = rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
323 if (ret)
324 return ret;
325
326 if (test_bit(RMI_STARTED, &data->flags))
327 ret = rmi_dev->driver->reset_handler(rmi_dev);
328
329 return ret;
330 }
331
rmi_reset_work(struct work_struct * work)332 static void rmi_reset_work(struct work_struct *work)
333 {
334 struct rmi_data *hdata = container_of(work, struct rmi_data,
335 reset_work);
336
337 /* switch the device to RMI if we receive a generic mouse report */
338 rmi_reset_attn_mode(hdata->hdev);
339 }
340
rmi_input_event(struct hid_device * hdev,u8 * data,int size)341 static int rmi_input_event(struct hid_device *hdev, u8 *data, int size)
342 {
343 struct rmi_data *hdata = hid_get_drvdata(hdev);
344 struct rmi_device *rmi_dev = hdata->xport.rmi_dev;
345 unsigned long flags;
346
347 if (!(test_bit(RMI_STARTED, &hdata->flags)))
348 return 0;
349
350 pm_wakeup_event(hdev->dev.parent, 0);
351
352 local_irq_save(flags);
353
354 rmi_set_attn_data(rmi_dev, data[1], &data[2], size - 2);
355
356 generic_handle_irq(hdata->rmi_irq);
357
358 local_irq_restore(flags);
359
360 return 1;
361 }
362
rmi_read_data_event(struct hid_device * hdev,u8 * data,int size)363 static int rmi_read_data_event(struct hid_device *hdev, u8 *data, int size)
364 {
365 struct rmi_data *hdata = hid_get_drvdata(hdev);
366
367 if (!test_bit(RMI_READ_REQUEST_PENDING, &hdata->flags)) {
368 hid_dbg(hdev, "no read request pending\n");
369 return 0;
370 }
371
372 memcpy(hdata->readReport, data, min((u32)size, hdata->input_report_size));
373 set_bit(RMI_READ_DATA_PENDING, &hdata->flags);
374 wake_up(&hdata->wait);
375
376 return 1;
377 }
378
rmi_check_sanity(struct hid_device * hdev,u8 * data,int size)379 static int rmi_check_sanity(struct hid_device *hdev, u8 *data, int size)
380 {
381 int valid_size = size;
382 /*
383 * On the Dell XPS 13 9333, the bus sometimes get confused and fills
384 * the report with a sentinel value "ff". Synaptics told us that such
385 * behavior does not comes from the touchpad itself, so we filter out
386 * such reports here.
387 */
388
389 while (valid_size > 0 && data[valid_size - 1] == 0xff)
390 valid_size--;
391
392 return valid_size;
393 }
394
rmi_raw_event(struct hid_device * hdev,struct hid_report * report,u8 * data,int size)395 static int rmi_raw_event(struct hid_device *hdev,
396 struct hid_report *report, u8 *data, int size)
397 {
398 struct rmi_data *hdata = hid_get_drvdata(hdev);
399
400 if (!(hdata->device_flags & RMI_DEVICE))
401 return 0;
402
403 size = rmi_check_sanity(hdev, data, size);
404 if (size < 2)
405 return 0;
406
407 switch (data[0]) {
408 case RMI_READ_DATA_REPORT_ID:
409 return rmi_read_data_event(hdev, data, size);
410 case RMI_ATTN_REPORT_ID:
411 return rmi_input_event(hdev, data, size);
412 default:
413 return 1;
414 }
415
416 return 0;
417 }
418
rmi_event(struct hid_device * hdev,struct hid_field * field,struct hid_usage * usage,__s32 value)419 static int rmi_event(struct hid_device *hdev, struct hid_field *field,
420 struct hid_usage *usage, __s32 value)
421 {
422 struct rmi_data *data = hid_get_drvdata(hdev);
423
424 if ((data->device_flags & RMI_DEVICE) &&
425 (field->application == HID_GD_POINTER ||
426 field->application == HID_GD_MOUSE)) {
427 if (data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS) {
428 if ((usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON)
429 return 0;
430
431 if ((usage->hid == HID_GD_X || usage->hid == HID_GD_Y)
432 && !value)
433 return 1;
434 }
435
436 schedule_work(&data->reset_work);
437 return 1;
438 }
439
440 return 0;
441 }
442
rmi_report(struct hid_device * hid,struct hid_report * report)443 static void rmi_report(struct hid_device *hid, struct hid_report *report)
444 {
445 struct hid_field *field = report->field[0];
446
447 if (!(hid->claimed & HID_CLAIMED_INPUT))
448 return;
449
450 switch (report->id) {
451 case RMI_READ_DATA_REPORT_ID:
452 case RMI_ATTN_REPORT_ID:
453 return;
454 }
455
456 if (field && field->hidinput && field->hidinput->input)
457 input_sync(field->hidinput->input);
458 }
459
rmi_suspend(struct hid_device * hdev,pm_message_t message)460 static int rmi_suspend(struct hid_device *hdev, pm_message_t message)
461 {
462 struct rmi_data *data = hid_get_drvdata(hdev);
463 struct rmi_device *rmi_dev = data->xport.rmi_dev;
464 int ret;
465
466 if (!(data->device_flags & RMI_DEVICE))
467 return 0;
468
469 ret = rmi_driver_suspend(rmi_dev, false);
470 if (ret) {
471 hid_warn(hdev, "Failed to suspend device: %d\n", ret);
472 return ret;
473 }
474
475 return 0;
476 }
477
rmi_post_resume(struct hid_device * hdev)478 static int rmi_post_resume(struct hid_device *hdev)
479 {
480 struct rmi_data *data = hid_get_drvdata(hdev);
481 struct rmi_device *rmi_dev = data->xport.rmi_dev;
482 int ret;
483
484 if (!(data->device_flags & RMI_DEVICE))
485 return 0;
486
487 /* Make sure the HID device is ready to receive events */
488 ret = hid_hw_open(hdev);
489 if (ret)
490 return ret;
491
492 ret = rmi_reset_attn_mode(hdev);
493 if (ret)
494 goto out;
495
496 ret = rmi_driver_resume(rmi_dev, false);
497 if (ret) {
498 hid_warn(hdev, "Failed to resume device: %d\n", ret);
499 goto out;
500 }
501
502 out:
503 hid_hw_close(hdev);
504 return ret;
505 }
506
rmi_hid_reset(struct rmi_transport_dev * xport,u16 reset_addr)507 static int rmi_hid_reset(struct rmi_transport_dev *xport, u16 reset_addr)
508 {
509 struct rmi_data *data = container_of(xport, struct rmi_data, xport);
510 struct hid_device *hdev = data->hdev;
511
512 return rmi_reset_attn_mode(hdev);
513 }
514
rmi_input_configured(struct hid_device * hdev,struct hid_input * hi)515 static int rmi_input_configured(struct hid_device *hdev, struct hid_input *hi)
516 {
517 struct rmi_data *data = hid_get_drvdata(hdev);
518 struct input_dev *input = hi->input;
519 int ret = 0;
520
521 if (!(data->device_flags & RMI_DEVICE))
522 return 0;
523
524 data->xport.input = input;
525
526 hid_dbg(hdev, "Opening low level driver\n");
527 ret = hid_hw_open(hdev);
528 if (ret)
529 return ret;
530
531 /* Allow incoming hid reports */
532 hid_device_io_start(hdev);
533
534 ret = rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
535 if (ret < 0) {
536 dev_err(&hdev->dev, "failed to set rmi mode\n");
537 goto exit;
538 }
539
540 ret = rmi_set_page(hdev, 0);
541 if (ret < 0) {
542 dev_err(&hdev->dev, "failed to set page select to 0.\n");
543 goto exit;
544 }
545
546 ret = rmi_register_transport_device(&data->xport);
547 if (ret < 0) {
548 dev_err(&hdev->dev, "failed to register transport driver\n");
549 goto exit;
550 }
551
552 set_bit(RMI_STARTED, &data->flags);
553
554 exit:
555 hid_device_io_stop(hdev);
556 hid_hw_close(hdev);
557 return ret;
558 }
559
rmi_input_mapping(struct hid_device * hdev,struct hid_input * hi,struct hid_field * field,struct hid_usage * usage,unsigned long ** bit,int * max)560 static int rmi_input_mapping(struct hid_device *hdev,
561 struct hid_input *hi, struct hid_field *field,
562 struct hid_usage *usage, unsigned long **bit, int *max)
563 {
564 struct rmi_data *data = hid_get_drvdata(hdev);
565
566 /*
567 * we want to make HID ignore the advertised HID collection
568 * for RMI deivces
569 */
570 if (data->device_flags & RMI_DEVICE) {
571 if ((data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS) &&
572 ((usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON))
573 return 0;
574
575 return -1;
576 }
577
578 return 0;
579 }
580
rmi_check_valid_report_id(struct hid_device * hdev,unsigned type,unsigned id,struct hid_report ** report)581 static int rmi_check_valid_report_id(struct hid_device *hdev, unsigned type,
582 unsigned id, struct hid_report **report)
583 {
584 int i;
585
586 *report = hdev->report_enum[type].report_id_hash[id];
587 if (*report) {
588 for (i = 0; i < (*report)->maxfield; i++) {
589 unsigned app = (*report)->field[i]->application;
590 if ((app & HID_USAGE_PAGE) >= HID_UP_MSVENDOR)
591 return 1;
592 }
593 }
594
595 return 0;
596 }
597
598 static struct rmi_device_platform_data rmi_hid_pdata = {
599 .sensor_pdata = {
600 .sensor_type = rmi_sensor_touchpad,
601 .axis_align.flip_y = true,
602 .dribble = RMI_REG_STATE_ON,
603 .palm_detect = RMI_REG_STATE_OFF,
604 },
605 };
606
607 static const struct rmi_transport_ops hid_rmi_ops = {
608 .write_block = rmi_hid_write_block,
609 .read_block = rmi_hid_read_block,
610 .reset = rmi_hid_reset,
611 };
612
rmi_irq_teardown(void * data)613 static void rmi_irq_teardown(void *data)
614 {
615 struct rmi_data *hdata = data;
616 struct irq_domain *domain = hdata->domain;
617
618 if (!domain)
619 return;
620
621 irq_dispose_mapping(irq_find_mapping(domain, 0));
622
623 irq_domain_remove(domain);
624 hdata->domain = NULL;
625 hdata->rmi_irq = 0;
626 }
627
rmi_irq_map(struct irq_domain * h,unsigned int virq,irq_hw_number_t hw_irq_num)628 static int rmi_irq_map(struct irq_domain *h, unsigned int virq,
629 irq_hw_number_t hw_irq_num)
630 {
631 irq_set_chip_and_handler(virq, &dummy_irq_chip, handle_simple_irq);
632
633 return 0;
634 }
635
636 static const struct irq_domain_ops rmi_irq_ops = {
637 .map = rmi_irq_map,
638 };
639
rmi_setup_irq_domain(struct hid_device * hdev)640 static int rmi_setup_irq_domain(struct hid_device *hdev)
641 {
642 struct rmi_data *hdata = hid_get_drvdata(hdev);
643 int ret;
644
645 hdata->domain = irq_domain_create_linear(hdev->dev.fwnode, 1,
646 &rmi_irq_ops, hdata);
647 if (!hdata->domain)
648 return -ENOMEM;
649
650 ret = devm_add_action_or_reset(&hdev->dev, &rmi_irq_teardown, hdata);
651 if (ret)
652 return ret;
653
654 hdata->rmi_irq = irq_create_mapping(hdata->domain, 0);
655 if (hdata->rmi_irq <= 0) {
656 hid_err(hdev, "Can't allocate an IRQ\n");
657 return hdata->rmi_irq < 0 ? hdata->rmi_irq : -ENXIO;
658 }
659
660 return 0;
661 }
662
rmi_probe(struct hid_device * hdev,const struct hid_device_id * id)663 static int rmi_probe(struct hid_device *hdev, const struct hid_device_id *id)
664 {
665 struct rmi_data *data = NULL;
666 int ret;
667 size_t alloc_size;
668 struct hid_report *input_report;
669 struct hid_report *output_report;
670 struct hid_report *feature_report;
671
672 data = devm_kzalloc(&hdev->dev, sizeof(struct rmi_data), GFP_KERNEL);
673 if (!data)
674 return -ENOMEM;
675
676 INIT_WORK(&data->reset_work, rmi_reset_work);
677 data->hdev = hdev;
678
679 hid_set_drvdata(hdev, data);
680
681 hdev->quirks |= HID_QUIRK_NO_INIT_REPORTS;
682 hdev->quirks |= HID_QUIRK_NO_INPUT_SYNC;
683
684 ret = hid_parse(hdev);
685 if (ret) {
686 hid_err(hdev, "parse failed\n");
687 return ret;
688 }
689
690 /*
691 * RMI_DEVICE can only mean "this probe validated the RMI reports and
692 * allocated writeReport": every bail-out to start below skips that
693 * allocation, and device_flags left carrying RMI_DEVICE from
694 * driver_data would send rmi_input_configured() into rmi_set_page()
695 * with writeReport still NULL. A bind through the new_id sysfs
696 * attribute can supply driver_data with the bit set, so do not let
697 * driver_data grant it.
698 */
699 data->device_flags = id->driver_data & ~RMI_DEVICE;
700
701 /*
702 * Check for the RMI specific report ids. If they are misisng
703 * simply return and let the events be processed by hid-input
704 */
705 if (!rmi_check_valid_report_id(hdev, HID_FEATURE_REPORT,
706 RMI_SET_RMI_MODE_REPORT_ID, &feature_report)) {
707 hid_dbg(hdev, "device does not have set mode feature report\n");
708 goto start;
709 }
710
711 if (!rmi_check_valid_report_id(hdev, HID_INPUT_REPORT,
712 RMI_ATTN_REPORT_ID, &input_report)) {
713 hid_dbg(hdev, "device does not have attention input report\n");
714 goto start;
715 }
716
717 data->input_report_size = hid_report_len(input_report);
718
719 if (!rmi_check_valid_report_id(hdev, HID_OUTPUT_REPORT,
720 RMI_WRITE_REPORT_ID, &output_report)) {
721 hid_dbg(hdev,
722 "device does not have rmi write output report\n");
723 goto start;
724 }
725
726 data->output_report_size = hid_report_len(output_report);
727
728 /*
729 * The write reports built by this driver occupy 6 bytes and the read
730 * handshake looks at the first 3 bytes of an input report, so refuse
731 * to drive a device whose reports cannot hold them.
732 */
733 if (data->output_report_size < 6 || data->input_report_size < 3) {
734 hid_err(hdev, "rmi reports too small (out=%u in=%u)\n",
735 data->output_report_size, data->input_report_size);
736 goto start;
737 }
738
739 data->device_flags |= RMI_DEVICE;
740 alloc_size = data->output_report_size + data->input_report_size;
741
742 data->writeReport = devm_kzalloc(&hdev->dev, alloc_size, GFP_KERNEL);
743 if (!data->writeReport) {
744 hid_err(hdev, "failed to allocate buffer for HID reports\n");
745 return -ENOMEM;
746 }
747
748 data->readReport = data->writeReport + data->output_report_size;
749
750 init_waitqueue_head(&data->wait);
751
752 mutex_init(&data->page_mutex);
753
754 ret = rmi_setup_irq_domain(hdev);
755 if (ret) {
756 hid_err(hdev, "failed to allocate IRQ domain\n");
757 return ret;
758 }
759
760 if (data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS)
761 rmi_hid_pdata.gpio_data.disable = true;
762
763 data->xport.dev = hdev->dev.parent;
764 data->xport.pdata = rmi_hid_pdata;
765 data->xport.pdata.irq = data->rmi_irq;
766 data->xport.proto_name = "hid";
767 data->xport.ops = &hid_rmi_ops;
768
769 start:
770 ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
771 if (ret) {
772 hid_err(hdev, "hw start failed\n");
773 return ret;
774 }
775
776 return 0;
777 }
778
rmi_remove(struct hid_device * hdev)779 static void rmi_remove(struct hid_device *hdev)
780 {
781 struct rmi_data *hdata = hid_get_drvdata(hdev);
782
783 if ((hdata->device_flags & RMI_DEVICE)
784 && test_bit(RMI_STARTED, &hdata->flags)) {
785 clear_bit(RMI_STARTED, &hdata->flags);
786 cancel_work_sync(&hdata->reset_work);
787 rmi_unregister_transport_device(&hdata->xport);
788 }
789
790 hid_hw_stop(hdev);
791 }
792
793 static const struct hid_device_id rmi_id[] = {
794 { HID_USB_DEVICE(USB_VENDOR_ID_RAZER, USB_DEVICE_ID_RAZER_BLADE_14),
795 .driver_data = RMI_DEVICE_HAS_PHYS_BUTTONS },
796 { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_COVER) },
797 { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_REZEL) },
798 { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5),
799 .driver_data = RMI_DEVICE_OUTPUT_SET_REPORT },
800 { HID_DEVICE(HID_BUS_ANY, HID_GROUP_RMI, HID_ANY_ID, HID_ANY_ID) },
801 { }
802 };
803 MODULE_DEVICE_TABLE(hid, rmi_id);
804
805 static struct hid_driver rmi_driver = {
806 .name = "hid-rmi",
807 .id_table = rmi_id,
808 .probe = rmi_probe,
809 .remove = rmi_remove,
810 .event = rmi_event,
811 .raw_event = rmi_raw_event,
812 .report = rmi_report,
813 .input_mapping = rmi_input_mapping,
814 .input_configured = rmi_input_configured,
815 .suspend = pm_ptr(rmi_suspend),
816 .resume = pm_ptr(rmi_post_resume),
817 .reset_resume = pm_ptr(rmi_post_resume),
818 };
819
820 module_hid_driver(rmi_driver);
821
822 MODULE_AUTHOR("Andrew Duggan <aduggan@synaptics.com>");
823 MODULE_DESCRIPTION("RMI HID driver");
824 MODULE_LICENSE("GPL");
825