1 /* 2 * HID over I2C protocol implementation 3 * 4 * Copyright (c) 2012 Benjamin Tissoires <benjamin.tissoires@gmail.com> 5 * Copyright (c) 2012 Ecole Nationale de l'Aviation Civile, France 6 * Copyright (c) 2012 Red Hat, Inc 7 * 8 * This code is partly based on "USB HID support for Linux": 9 * 10 * Copyright (c) 1999 Andreas Gal 11 * Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz> 12 * Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc 13 * Copyright (c) 2007-2008 Oliver Neukum 14 * Copyright (c) 2006-2010 Jiri Kosina 15 * 16 * This file is subject to the terms and conditions of the GNU General Public 17 * License. See the file COPYING in the main directory of this archive for 18 * more details. 19 */ 20 21 #include <linux/module.h> 22 #include <linux/i2c.h> 23 #include <linux/interrupt.h> 24 #include <linux/input.h> 25 #include <linux/irq.h> 26 #include <linux/delay.h> 27 #include <linux/slab.h> 28 #include <linux/pm.h> 29 #include <linux/pm_wakeirq.h> 30 #include <linux/device.h> 31 #include <linux/wait.h> 32 #include <linux/err.h> 33 #include <linux/string.h> 34 #include <linux/list.h> 35 #include <linux/jiffies.h> 36 #include <linux/kernel.h> 37 #include <linux/hid.h> 38 #include <linux/mutex.h> 39 #include <asm/unaligned.h> 40 41 #include <drm/drm_panel.h> 42 43 #include "../hid-ids.h" 44 #include "i2c-hid.h" 45 46 /* quirks to control the device */ 47 #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET BIT(0) 48 #define I2C_HID_QUIRK_BOGUS_IRQ BIT(1) 49 #define I2C_HID_QUIRK_RESET_ON_RESUME BIT(2) 50 #define I2C_HID_QUIRK_BAD_INPUT_SIZE BIT(3) 51 #define I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET BIT(4) 52 53 /* Command opcodes */ 54 #define I2C_HID_OPCODE_RESET 0x01 55 #define I2C_HID_OPCODE_GET_REPORT 0x02 56 #define I2C_HID_OPCODE_SET_REPORT 0x03 57 #define I2C_HID_OPCODE_GET_IDLE 0x04 58 #define I2C_HID_OPCODE_SET_IDLE 0x05 59 #define I2C_HID_OPCODE_GET_PROTOCOL 0x06 60 #define I2C_HID_OPCODE_SET_PROTOCOL 0x07 61 #define I2C_HID_OPCODE_SET_POWER 0x08 62 63 /* flags */ 64 #define I2C_HID_STARTED 0 65 #define I2C_HID_RESET_PENDING 1 66 #define I2C_HID_READ_PENDING 2 67 68 #define I2C_HID_PWR_ON 0x00 69 #define I2C_HID_PWR_SLEEP 0x01 70 71 #define i2c_hid_dbg(ihid, ...) dev_dbg(&(ihid)->client->dev, __VA_ARGS__) 72 73 struct i2c_hid_desc { 74 __le16 wHIDDescLength; 75 __le16 bcdVersion; 76 __le16 wReportDescLength; 77 __le16 wReportDescRegister; 78 __le16 wInputRegister; 79 __le16 wMaxInputLength; 80 __le16 wOutputRegister; 81 __le16 wMaxOutputLength; 82 __le16 wCommandRegister; 83 __le16 wDataRegister; 84 __le16 wVendorID; 85 __le16 wProductID; 86 __le16 wVersionID; 87 __le32 reserved; 88 } __packed; 89 90 /* The main device structure */ 91 struct i2c_hid { 92 struct i2c_client *client; /* i2c client */ 93 struct hid_device *hid; /* pointer to corresponding HID dev */ 94 struct i2c_hid_desc hdesc; /* the HID Descriptor */ 95 __le16 wHIDDescRegister; /* location of the i2c 96 * register of the HID 97 * descriptor. */ 98 unsigned int bufsize; /* i2c buffer size */ 99 u8 *inbuf; /* Input buffer */ 100 u8 *rawbuf; /* Raw Input buffer */ 101 u8 *cmdbuf; /* Command buffer */ 102 103 unsigned long flags; /* device flags */ 104 unsigned long quirks; /* Various quirks */ 105 106 wait_queue_head_t wait; /* For waiting the interrupt */ 107 108 struct mutex reset_lock; 109 110 struct i2chid_ops *ops; 111 struct drm_panel_follower panel_follower; 112 struct work_struct panel_follower_prepare_work; 113 bool is_panel_follower; 114 bool prepare_work_finished; 115 }; 116 117 static const struct i2c_hid_quirks { 118 __u16 idVendor; 119 __u16 idProduct; 120 __u32 quirks; 121 } i2c_hid_quirks[] = { 122 { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288, 123 I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, 124 { I2C_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_VOYO_WINPAD_A15, 125 I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, 126 { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118, 127 I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, 128 { USB_VENDOR_ID_ALPS_JP, HID_ANY_ID, 129 I2C_HID_QUIRK_RESET_ON_RESUME }, 130 { I2C_VENDOR_ID_SYNAPTICS, I2C_PRODUCT_ID_SYNAPTICS_SYNA2393, 131 I2C_HID_QUIRK_RESET_ON_RESUME }, 132 { USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720, 133 I2C_HID_QUIRK_BAD_INPUT_SIZE }, 134 /* 135 * Sending the wakeup after reset actually break ELAN touchscreen controller 136 */ 137 { USB_VENDOR_ID_ELAN, HID_ANY_ID, 138 I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET | 139 I2C_HID_QUIRK_BOGUS_IRQ }, 140 { 0, 0 } 141 }; 142 143 /* 144 * i2c_hid_lookup_quirk: return any quirks associated with a I2C HID device 145 * @idVendor: the 16-bit vendor ID 146 * @idProduct: the 16-bit product ID 147 * 148 * Returns: a u32 quirks value. 149 */ 150 static u32 i2c_hid_lookup_quirk(const u16 idVendor, const u16 idProduct) 151 { 152 u32 quirks = 0; 153 int n; 154 155 for (n = 0; i2c_hid_quirks[n].idVendor; n++) 156 if (i2c_hid_quirks[n].idVendor == idVendor && 157 (i2c_hid_quirks[n].idProduct == (__u16)HID_ANY_ID || 158 i2c_hid_quirks[n].idProduct == idProduct)) 159 quirks = i2c_hid_quirks[n].quirks; 160 161 return quirks; 162 } 163 164 static int i2c_hid_xfer(struct i2c_hid *ihid, 165 u8 *send_buf, int send_len, u8 *recv_buf, int recv_len) 166 { 167 struct i2c_client *client = ihid->client; 168 struct i2c_msg msgs[2] = { 0 }; 169 int n = 0; 170 int ret; 171 172 if (send_len) { 173 i2c_hid_dbg(ihid, "%s: cmd=%*ph\n", 174 __func__, send_len, send_buf); 175 176 msgs[n].addr = client->addr; 177 msgs[n].flags = (client->flags & I2C_M_TEN) | I2C_M_DMA_SAFE; 178 msgs[n].len = send_len; 179 msgs[n].buf = send_buf; 180 n++; 181 } 182 183 if (recv_len) { 184 msgs[n].addr = client->addr; 185 msgs[n].flags = (client->flags & I2C_M_TEN) | 186 I2C_M_RD | I2C_M_DMA_SAFE; 187 msgs[n].len = recv_len; 188 msgs[n].buf = recv_buf; 189 n++; 190 191 set_bit(I2C_HID_READ_PENDING, &ihid->flags); 192 } 193 194 ret = i2c_transfer(client->adapter, msgs, n); 195 196 if (recv_len) 197 clear_bit(I2C_HID_READ_PENDING, &ihid->flags); 198 199 if (ret != n) 200 return ret < 0 ? ret : -EIO; 201 202 return 0; 203 } 204 205 static int i2c_hid_read_register(struct i2c_hid *ihid, __le16 reg, 206 void *buf, size_t len) 207 { 208 *(__le16 *)ihid->cmdbuf = reg; 209 210 return i2c_hid_xfer(ihid, ihid->cmdbuf, sizeof(__le16), buf, len); 211 } 212 213 static size_t i2c_hid_encode_command(u8 *buf, u8 opcode, 214 int report_type, int report_id) 215 { 216 size_t length = 0; 217 218 if (report_id < 0x0F) { 219 buf[length++] = report_type << 4 | report_id; 220 buf[length++] = opcode; 221 } else { 222 buf[length++] = report_type << 4 | 0x0F; 223 buf[length++] = opcode; 224 buf[length++] = report_id; 225 } 226 227 return length; 228 } 229 230 static int i2c_hid_get_report(struct i2c_hid *ihid, 231 u8 report_type, u8 report_id, 232 u8 *recv_buf, size_t recv_len) 233 { 234 size_t length = 0; 235 size_t ret_count; 236 int error; 237 238 i2c_hid_dbg(ihid, "%s\n", __func__); 239 240 /* Command register goes first */ 241 *(__le16 *)ihid->cmdbuf = ihid->hdesc.wCommandRegister; 242 length += sizeof(__le16); 243 /* Next is GET_REPORT command */ 244 length += i2c_hid_encode_command(ihid->cmdbuf + length, 245 I2C_HID_OPCODE_GET_REPORT, 246 report_type, report_id); 247 /* 248 * Device will send report data through data register. Because 249 * command can be either 2 or 3 bytes destination for the data 250 * register may be not aligned. 251 */ 252 put_unaligned_le16(le16_to_cpu(ihid->hdesc.wDataRegister), 253 ihid->cmdbuf + length); 254 length += sizeof(__le16); 255 256 /* 257 * In addition to report data device will supply data length 258 * in the first 2 bytes of the response, so adjust . 259 */ 260 error = i2c_hid_xfer(ihid, ihid->cmdbuf, length, 261 ihid->rawbuf, recv_len + sizeof(__le16)); 262 if (error) { 263 dev_err(&ihid->client->dev, 264 "failed to set a report to device: %d\n", error); 265 return error; 266 } 267 268 /* The buffer is sufficiently aligned */ 269 ret_count = le16_to_cpup((__le16 *)ihid->rawbuf); 270 271 /* Check for empty report response */ 272 if (ret_count <= sizeof(__le16)) 273 return 0; 274 275 recv_len = min(recv_len, ret_count - sizeof(__le16)); 276 memcpy(recv_buf, ihid->rawbuf + sizeof(__le16), recv_len); 277 278 if (report_id && recv_len != 0 && recv_buf[0] != report_id) { 279 dev_err(&ihid->client->dev, 280 "device returned incorrect report (%d vs %d expected)\n", 281 recv_buf[0], report_id); 282 return -EINVAL; 283 } 284 285 return recv_len; 286 } 287 288 static size_t i2c_hid_format_report(u8 *buf, int report_id, 289 const u8 *data, size_t size) 290 { 291 size_t length = sizeof(__le16); /* reserve space to store size */ 292 293 if (report_id) 294 buf[length++] = report_id; 295 296 memcpy(buf + length, data, size); 297 length += size; 298 299 /* Store overall size in the beginning of the buffer */ 300 put_unaligned_le16(length, buf); 301 302 return length; 303 } 304 305 /** 306 * i2c_hid_set_or_send_report: forward an incoming report to the device 307 * @ihid: the i2c hid device 308 * @report_type: 0x03 for HID_FEATURE_REPORT ; 0x02 for HID_OUTPUT_REPORT 309 * @report_id: the report ID 310 * @buf: the actual data to transfer, without the report ID 311 * @data_len: size of buf 312 * @do_set: true: use SET_REPORT HID command, false: send plain OUTPUT report 313 */ 314 static int i2c_hid_set_or_send_report(struct i2c_hid *ihid, 315 u8 report_type, u8 report_id, 316 const u8 *buf, size_t data_len, 317 bool do_set) 318 { 319 size_t length = 0; 320 int error; 321 322 i2c_hid_dbg(ihid, "%s\n", __func__); 323 324 if (data_len > ihid->bufsize) 325 return -EINVAL; 326 327 if (!do_set && le16_to_cpu(ihid->hdesc.wMaxOutputLength) == 0) 328 return -ENOSYS; 329 330 if (do_set) { 331 /* Command register goes first */ 332 *(__le16 *)ihid->cmdbuf = ihid->hdesc.wCommandRegister; 333 length += sizeof(__le16); 334 /* Next is SET_REPORT command */ 335 length += i2c_hid_encode_command(ihid->cmdbuf + length, 336 I2C_HID_OPCODE_SET_REPORT, 337 report_type, report_id); 338 /* 339 * Report data will go into the data register. Because 340 * command can be either 2 or 3 bytes destination for 341 * the data register may be not aligned. 342 */ 343 put_unaligned_le16(le16_to_cpu(ihid->hdesc.wDataRegister), 344 ihid->cmdbuf + length); 345 length += sizeof(__le16); 346 } else { 347 /* 348 * With simple "send report" all data goes into the output 349 * register. 350 */ 351 *(__le16 *)ihid->cmdbuf = ihid->hdesc.wOutputRegister; 352 length += sizeof(__le16); 353 } 354 355 length += i2c_hid_format_report(ihid->cmdbuf + length, 356 report_id, buf, data_len); 357 358 error = i2c_hid_xfer(ihid, ihid->cmdbuf, length, NULL, 0); 359 if (error) { 360 dev_err(&ihid->client->dev, 361 "failed to set a report to device: %d\n", error); 362 return error; 363 } 364 365 return data_len; 366 } 367 368 static int i2c_hid_set_power_command(struct i2c_hid *ihid, int power_state) 369 { 370 size_t length; 371 372 /* SET_POWER uses command register */ 373 *(__le16 *)ihid->cmdbuf = ihid->hdesc.wCommandRegister; 374 length = sizeof(__le16); 375 376 /* Now the command itself */ 377 length += i2c_hid_encode_command(ihid->cmdbuf + length, 378 I2C_HID_OPCODE_SET_POWER, 379 0, power_state); 380 381 return i2c_hid_xfer(ihid, ihid->cmdbuf, length, NULL, 0); 382 } 383 384 static int i2c_hid_set_power(struct i2c_hid *ihid, int power_state) 385 { 386 int ret; 387 388 i2c_hid_dbg(ihid, "%s\n", __func__); 389 390 /* 391 * Some devices require to send a command to wakeup before power on. 392 * The call will get a return value (EREMOTEIO) but device will be 393 * triggered and activated. After that, it goes like a normal device. 394 */ 395 if (power_state == I2C_HID_PWR_ON) { 396 ret = i2c_hid_set_power_command(ihid, I2C_HID_PWR_ON); 397 398 /* Device was already activated */ 399 if (!ret) 400 goto set_pwr_exit; 401 } 402 403 ret = i2c_hid_set_power_command(ihid, power_state); 404 if (ret) 405 dev_err(&ihid->client->dev, 406 "failed to change power setting.\n"); 407 408 set_pwr_exit: 409 410 /* 411 * The HID over I2C specification states that if a DEVICE needs time 412 * after the PWR_ON request, it should utilise CLOCK stretching. 413 * However, it has been observered that the Windows driver provides a 414 * 1ms sleep between the PWR_ON and RESET requests. 415 * According to Goodix Windows even waits 60 ms after (other?) 416 * PWR_ON requests. Testing has confirmed that several devices 417 * will not work properly without a delay after a PWR_ON request. 418 */ 419 if (!ret && power_state == I2C_HID_PWR_ON) 420 msleep(60); 421 422 return ret; 423 } 424 425 static int i2c_hid_start_hwreset(struct i2c_hid *ihid) 426 { 427 size_t length = 0; 428 int ret; 429 430 i2c_hid_dbg(ihid, "%s\n", __func__); 431 432 /* 433 * This prevents sending feature reports while the device is 434 * being reset. Otherwise we may lose the reset complete 435 * interrupt. 436 */ 437 lockdep_assert_held(&ihid->reset_lock); 438 439 ret = i2c_hid_set_power(ihid, I2C_HID_PWR_ON); 440 if (ret) 441 return ret; 442 443 /* Prepare reset command. Command register goes first. */ 444 *(__le16 *)ihid->cmdbuf = ihid->hdesc.wCommandRegister; 445 length += sizeof(__le16); 446 /* Next is RESET command itself */ 447 length += i2c_hid_encode_command(ihid->cmdbuf + length, 448 I2C_HID_OPCODE_RESET, 0, 0); 449 450 set_bit(I2C_HID_RESET_PENDING, &ihid->flags); 451 452 ret = i2c_hid_xfer(ihid, ihid->cmdbuf, length, NULL, 0); 453 if (ret) { 454 dev_err(&ihid->client->dev, 455 "failed to reset device: %d\n", ret); 456 goto err_clear_reset; 457 } 458 459 return 0; 460 461 err_clear_reset: 462 clear_bit(I2C_HID_RESET_PENDING, &ihid->flags); 463 i2c_hid_set_power(ihid, I2C_HID_PWR_SLEEP); 464 return ret; 465 } 466 467 static int i2c_hid_finish_hwreset(struct i2c_hid *ihid) 468 { 469 int ret = 0; 470 471 i2c_hid_dbg(ihid, "%s: waiting...\n", __func__); 472 473 if (ihid->quirks & I2C_HID_QUIRK_NO_IRQ_AFTER_RESET) { 474 msleep(100); 475 clear_bit(I2C_HID_RESET_PENDING, &ihid->flags); 476 } else if (!wait_event_timeout(ihid->wait, 477 !test_bit(I2C_HID_RESET_PENDING, &ihid->flags), 478 msecs_to_jiffies(1000))) { 479 dev_warn(&ihid->client->dev, "device did not ack reset within 1000 ms\n"); 480 clear_bit(I2C_HID_RESET_PENDING, &ihid->flags); 481 } 482 i2c_hid_dbg(ihid, "%s: finished.\n", __func__); 483 484 /* At least some SIS devices need this after reset */ 485 if (!(ihid->quirks & I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET)) 486 ret = i2c_hid_set_power(ihid, I2C_HID_PWR_ON); 487 488 return ret; 489 } 490 491 static void i2c_hid_get_input(struct i2c_hid *ihid) 492 { 493 u16 size = le16_to_cpu(ihid->hdesc.wMaxInputLength); 494 u16 ret_size; 495 int ret; 496 497 if (size > ihid->bufsize) 498 size = ihid->bufsize; 499 500 ret = i2c_master_recv(ihid->client, ihid->inbuf, size); 501 if (ret != size) { 502 if (ret < 0) 503 return; 504 505 dev_err(&ihid->client->dev, "%s: got %d data instead of %d\n", 506 __func__, ret, size); 507 return; 508 } 509 510 /* Receiving buffer is properly aligned */ 511 ret_size = le16_to_cpup((__le16 *)ihid->inbuf); 512 if (!ret_size) { 513 /* host or device initiated RESET completed */ 514 if (test_and_clear_bit(I2C_HID_RESET_PENDING, &ihid->flags)) 515 wake_up(&ihid->wait); 516 return; 517 } 518 519 if ((ihid->quirks & I2C_HID_QUIRK_BOGUS_IRQ) && ret_size == 0xffff) { 520 dev_warn_once(&ihid->client->dev, 521 "%s: IRQ triggered but there's no data\n", 522 __func__); 523 return; 524 } 525 526 if (ret_size > size || ret_size < sizeof(__le16)) { 527 if (ihid->quirks & I2C_HID_QUIRK_BAD_INPUT_SIZE) { 528 *(__le16 *)ihid->inbuf = cpu_to_le16(size); 529 ret_size = size; 530 } else { 531 dev_err(&ihid->client->dev, 532 "%s: incomplete report (%d/%d)\n", 533 __func__, size, ret_size); 534 return; 535 } 536 } 537 538 i2c_hid_dbg(ihid, "input: %*ph\n", ret_size, ihid->inbuf); 539 540 if (test_bit(I2C_HID_STARTED, &ihid->flags)) { 541 if (ihid->hid->group != HID_GROUP_RMI) 542 pm_wakeup_event(&ihid->client->dev, 0); 543 544 hid_input_report(ihid->hid, HID_INPUT_REPORT, 545 ihid->inbuf + sizeof(__le16), 546 ret_size - sizeof(__le16), 1); 547 } 548 549 return; 550 } 551 552 static irqreturn_t i2c_hid_irq(int irq, void *dev_id) 553 { 554 struct i2c_hid *ihid = dev_id; 555 556 if (test_bit(I2C_HID_READ_PENDING, &ihid->flags)) 557 return IRQ_HANDLED; 558 559 i2c_hid_get_input(ihid); 560 561 return IRQ_HANDLED; 562 } 563 564 static int i2c_hid_get_report_length(struct hid_report *report) 565 { 566 return ((report->size - 1) >> 3) + 1 + 567 report->device->report_enum[report->type].numbered + 2; 568 } 569 570 /* 571 * Traverse the supplied list of reports and find the longest 572 */ 573 static void i2c_hid_find_max_report(struct hid_device *hid, unsigned int type, 574 unsigned int *max) 575 { 576 struct hid_report *report; 577 unsigned int size; 578 579 /* We should not rely on wMaxInputLength, as some devices may set it to 580 * a wrong length. */ 581 list_for_each_entry(report, &hid->report_enum[type].report_list, list) { 582 size = i2c_hid_get_report_length(report); 583 if (*max < size) 584 *max = size; 585 } 586 } 587 588 static void i2c_hid_free_buffers(struct i2c_hid *ihid) 589 { 590 kfree(ihid->inbuf); 591 kfree(ihid->rawbuf); 592 kfree(ihid->cmdbuf); 593 ihid->inbuf = NULL; 594 ihid->rawbuf = NULL; 595 ihid->cmdbuf = NULL; 596 ihid->bufsize = 0; 597 } 598 599 static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size) 600 { 601 /* 602 * The worst case is computed from the set_report command with a 603 * reportID > 15 and the maximum report length. 604 */ 605 int cmd_len = sizeof(__le16) + /* command register */ 606 sizeof(u8) + /* encoded report type/ID */ 607 sizeof(u8) + /* opcode */ 608 sizeof(u8) + /* optional 3rd byte report ID */ 609 sizeof(__le16) + /* data register */ 610 sizeof(__le16) + /* report data size */ 611 sizeof(u8) + /* report ID if numbered report */ 612 report_size; 613 614 ihid->inbuf = kzalloc(report_size, GFP_KERNEL); 615 ihid->rawbuf = kzalloc(report_size, GFP_KERNEL); 616 ihid->cmdbuf = kzalloc(cmd_len, GFP_KERNEL); 617 618 if (!ihid->inbuf || !ihid->rawbuf || !ihid->cmdbuf) { 619 i2c_hid_free_buffers(ihid); 620 return -ENOMEM; 621 } 622 623 ihid->bufsize = report_size; 624 625 return 0; 626 } 627 628 static int i2c_hid_get_raw_report(struct hid_device *hid, 629 u8 report_type, u8 report_id, 630 u8 *buf, size_t count) 631 { 632 struct i2c_client *client = hid->driver_data; 633 struct i2c_hid *ihid = i2c_get_clientdata(client); 634 int ret_count; 635 636 if (report_type == HID_OUTPUT_REPORT) 637 return -EINVAL; 638 639 /* 640 * In case of unnumbered reports the response from the device will 641 * not have the report ID that the upper layers expect, so we need 642 * to stash it the buffer ourselves and adjust the data size. 643 */ 644 if (!report_id) { 645 buf[0] = 0; 646 buf++; 647 count--; 648 } 649 650 ret_count = i2c_hid_get_report(ihid, 651 report_type == HID_FEATURE_REPORT ? 0x03 : 0x01, 652 report_id, buf, count); 653 654 if (ret_count > 0 && !report_id) 655 ret_count++; 656 657 return ret_count; 658 } 659 660 static int i2c_hid_output_raw_report(struct hid_device *hid, u8 report_type, 661 const u8 *buf, size_t count, bool do_set) 662 { 663 struct i2c_client *client = hid->driver_data; 664 struct i2c_hid *ihid = i2c_get_clientdata(client); 665 int report_id = buf[0]; 666 int ret; 667 668 if (report_type == HID_INPUT_REPORT) 669 return -EINVAL; 670 671 mutex_lock(&ihid->reset_lock); 672 673 /* 674 * Note that both numbered and unnumbered reports passed here 675 * are supposed to have report ID stored in the 1st byte of the 676 * buffer, so we strip it off unconditionally before passing payload 677 * to i2c_hid_set_or_send_report which takes care of encoding 678 * everything properly. 679 */ 680 ret = i2c_hid_set_or_send_report(ihid, 681 report_type == HID_FEATURE_REPORT ? 0x03 : 0x02, 682 report_id, buf + 1, count - 1, do_set); 683 684 if (ret >= 0) 685 ret++; /* add report_id to the number of transferred bytes */ 686 687 mutex_unlock(&ihid->reset_lock); 688 689 return ret; 690 } 691 692 static int i2c_hid_output_report(struct hid_device *hid, u8 *buf, size_t count) 693 { 694 return i2c_hid_output_raw_report(hid, HID_OUTPUT_REPORT, buf, count, 695 false); 696 } 697 698 static int i2c_hid_raw_request(struct hid_device *hid, unsigned char reportnum, 699 __u8 *buf, size_t len, unsigned char rtype, 700 int reqtype) 701 { 702 switch (reqtype) { 703 case HID_REQ_GET_REPORT: 704 return i2c_hid_get_raw_report(hid, rtype, reportnum, buf, len); 705 case HID_REQ_SET_REPORT: 706 if (buf[0] != reportnum) 707 return -EINVAL; 708 return i2c_hid_output_raw_report(hid, rtype, buf, len, true); 709 default: 710 return -EIO; 711 } 712 } 713 714 static int i2c_hid_parse(struct hid_device *hid) 715 { 716 struct i2c_client *client = hid->driver_data; 717 struct i2c_hid *ihid = i2c_get_clientdata(client); 718 struct i2c_hid_desc *hdesc = &ihid->hdesc; 719 char *rdesc = NULL, *use_override = NULL; 720 unsigned int rsize; 721 int ret; 722 int tries = 3; 723 724 i2c_hid_dbg(ihid, "entering %s\n", __func__); 725 726 rsize = le16_to_cpu(hdesc->wReportDescLength); 727 if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) { 728 dbg_hid("weird size of report descriptor (%u)\n", rsize); 729 return -EINVAL; 730 } 731 732 mutex_lock(&ihid->reset_lock); 733 do { 734 ret = i2c_hid_start_hwreset(ihid); 735 if (ret) 736 msleep(1000); 737 } while (tries-- > 0 && ret); 738 739 if (ret) 740 goto abort_reset; 741 742 use_override = i2c_hid_get_dmi_hid_report_desc_override(client->name, 743 &rsize); 744 745 if (use_override) { 746 rdesc = use_override; 747 i2c_hid_dbg(ihid, "Using a HID report descriptor override\n"); 748 } else { 749 rdesc = kzalloc(rsize, GFP_KERNEL); 750 751 if (!rdesc) { 752 ret = -ENOMEM; 753 goto abort_reset; 754 } 755 756 i2c_hid_dbg(ihid, "asking HID report descriptor\n"); 757 758 ret = i2c_hid_read_register(ihid, 759 ihid->hdesc.wReportDescRegister, 760 rdesc, rsize); 761 if (ret) { 762 hid_err(hid, "reading report descriptor failed\n"); 763 goto abort_reset; 764 } 765 } 766 767 /* 768 * Windows directly reads the report-descriptor after sending reset 769 * and then waits for resets completion afterwards. Some touchpads 770 * actually wait for the report-descriptor to be read before signalling 771 * reset completion. 772 */ 773 ret = i2c_hid_finish_hwreset(ihid); 774 abort_reset: 775 clear_bit(I2C_HID_RESET_PENDING, &ihid->flags); 776 mutex_unlock(&ihid->reset_lock); 777 if (ret) 778 goto out; 779 780 i2c_hid_dbg(ihid, "Report Descriptor: %*ph\n", rsize, rdesc); 781 782 ret = hid_parse_report(hid, rdesc, rsize); 783 if (ret) 784 dbg_hid("parsing report descriptor failed\n"); 785 786 out: 787 if (!use_override) 788 kfree(rdesc); 789 790 return ret; 791 } 792 793 static int i2c_hid_start(struct hid_device *hid) 794 { 795 struct i2c_client *client = hid->driver_data; 796 struct i2c_hid *ihid = i2c_get_clientdata(client); 797 int ret; 798 unsigned int bufsize = HID_MIN_BUFFER_SIZE; 799 800 i2c_hid_find_max_report(hid, HID_INPUT_REPORT, &bufsize); 801 i2c_hid_find_max_report(hid, HID_OUTPUT_REPORT, &bufsize); 802 i2c_hid_find_max_report(hid, HID_FEATURE_REPORT, &bufsize); 803 804 if (bufsize > ihid->bufsize) { 805 disable_irq(client->irq); 806 i2c_hid_free_buffers(ihid); 807 808 ret = i2c_hid_alloc_buffers(ihid, bufsize); 809 enable_irq(client->irq); 810 811 if (ret) 812 return ret; 813 } 814 815 return 0; 816 } 817 818 static void i2c_hid_stop(struct hid_device *hid) 819 { 820 hid->claimed = 0; 821 } 822 823 static int i2c_hid_open(struct hid_device *hid) 824 { 825 struct i2c_client *client = hid->driver_data; 826 struct i2c_hid *ihid = i2c_get_clientdata(client); 827 828 set_bit(I2C_HID_STARTED, &ihid->flags); 829 return 0; 830 } 831 832 static void i2c_hid_close(struct hid_device *hid) 833 { 834 struct i2c_client *client = hid->driver_data; 835 struct i2c_hid *ihid = i2c_get_clientdata(client); 836 837 clear_bit(I2C_HID_STARTED, &ihid->flags); 838 } 839 840 static const struct hid_ll_driver i2c_hid_ll_driver = { 841 .parse = i2c_hid_parse, 842 .start = i2c_hid_start, 843 .stop = i2c_hid_stop, 844 .open = i2c_hid_open, 845 .close = i2c_hid_close, 846 .output_report = i2c_hid_output_report, 847 .raw_request = i2c_hid_raw_request, 848 }; 849 850 static int i2c_hid_init_irq(struct i2c_client *client) 851 { 852 struct i2c_hid *ihid = i2c_get_clientdata(client); 853 unsigned long irqflags = 0; 854 int ret; 855 856 i2c_hid_dbg(ihid, "Requesting IRQ: %d\n", client->irq); 857 858 if (!irq_get_trigger_type(client->irq)) 859 irqflags = IRQF_TRIGGER_LOW; 860 861 ret = request_threaded_irq(client->irq, NULL, i2c_hid_irq, 862 irqflags | IRQF_ONESHOT | IRQF_NO_AUTOEN, 863 client->name, ihid); 864 if (ret < 0) { 865 dev_warn(&client->dev, 866 "Could not register for %s interrupt, irq = %d," 867 " ret = %d\n", 868 client->name, client->irq, ret); 869 870 return ret; 871 } 872 873 return 0; 874 } 875 876 static int i2c_hid_fetch_hid_descriptor(struct i2c_hid *ihid) 877 { 878 struct i2c_client *client = ihid->client; 879 struct i2c_hid_desc *hdesc = &ihid->hdesc; 880 unsigned int dsize; 881 int error; 882 883 /* i2c hid fetch using a fixed descriptor size (30 bytes) */ 884 if (i2c_hid_get_dmi_i2c_hid_desc_override(client->name)) { 885 i2c_hid_dbg(ihid, "Using a HID descriptor override\n"); 886 ihid->hdesc = 887 *i2c_hid_get_dmi_i2c_hid_desc_override(client->name); 888 } else { 889 i2c_hid_dbg(ihid, "Fetching the HID descriptor\n"); 890 error = i2c_hid_read_register(ihid, 891 ihid->wHIDDescRegister, 892 &ihid->hdesc, 893 sizeof(ihid->hdesc)); 894 if (error) { 895 dev_err(&ihid->client->dev, 896 "failed to fetch HID descriptor: %d\n", 897 error); 898 return -ENODEV; 899 } 900 } 901 902 /* Validate the length of HID descriptor, the 4 first bytes: 903 * bytes 0-1 -> length 904 * bytes 2-3 -> bcdVersion (has to be 1.00) */ 905 /* check bcdVersion == 1.0 */ 906 if (le16_to_cpu(hdesc->bcdVersion) != 0x0100) { 907 dev_err(&ihid->client->dev, 908 "unexpected HID descriptor bcdVersion (0x%04hx)\n", 909 le16_to_cpu(hdesc->bcdVersion)); 910 return -ENODEV; 911 } 912 913 /* Descriptor length should be 30 bytes as per the specification */ 914 dsize = le16_to_cpu(hdesc->wHIDDescLength); 915 if (dsize != sizeof(struct i2c_hid_desc)) { 916 dev_err(&ihid->client->dev, 917 "weird size of HID descriptor (%u)\n", dsize); 918 return -ENODEV; 919 } 920 i2c_hid_dbg(ihid, "HID Descriptor: %*ph\n", dsize, &ihid->hdesc); 921 return 0; 922 } 923 924 static int i2c_hid_core_power_up(struct i2c_hid *ihid) 925 { 926 if (!ihid->ops->power_up) 927 return 0; 928 929 return ihid->ops->power_up(ihid->ops); 930 } 931 932 static void i2c_hid_core_power_down(struct i2c_hid *ihid) 933 { 934 if (!ihid->ops->power_down) 935 return; 936 937 ihid->ops->power_down(ihid->ops); 938 } 939 940 static void i2c_hid_core_shutdown_tail(struct i2c_hid *ihid) 941 { 942 if (!ihid->ops->shutdown_tail) 943 return; 944 945 ihid->ops->shutdown_tail(ihid->ops); 946 } 947 948 static int i2c_hid_core_suspend(struct i2c_hid *ihid, bool force_poweroff) 949 { 950 struct i2c_client *client = ihid->client; 951 struct hid_device *hid = ihid->hid; 952 int ret; 953 954 ret = hid_driver_suspend(hid, PMSG_SUSPEND); 955 if (ret < 0) 956 return ret; 957 958 /* Save some power */ 959 i2c_hid_set_power(ihid, I2C_HID_PWR_SLEEP); 960 961 disable_irq(client->irq); 962 963 if (force_poweroff || !device_may_wakeup(&client->dev)) 964 i2c_hid_core_power_down(ihid); 965 966 return 0; 967 } 968 969 static int i2c_hid_core_resume(struct i2c_hid *ihid) 970 { 971 struct i2c_client *client = ihid->client; 972 struct hid_device *hid = ihid->hid; 973 int ret; 974 975 if (!device_may_wakeup(&client->dev)) 976 i2c_hid_core_power_up(ihid); 977 978 enable_irq(client->irq); 979 980 /* Instead of resetting device, simply powers the device on. This 981 * solves "incomplete reports" on Raydium devices 2386:3118 and 982 * 2386:4B33 and fixes various SIS touchscreens no longer sending 983 * data after a suspend/resume. 984 * 985 * However some ALPS touchpads generate IRQ storm without reset, so 986 * let's still reset them here. 987 */ 988 if (ihid->quirks & I2C_HID_QUIRK_RESET_ON_RESUME) { 989 mutex_lock(&ihid->reset_lock); 990 ret = i2c_hid_start_hwreset(ihid); 991 if (ret == 0) 992 ret = i2c_hid_finish_hwreset(ihid); 993 mutex_unlock(&ihid->reset_lock); 994 } else { 995 ret = i2c_hid_set_power(ihid, I2C_HID_PWR_ON); 996 } 997 998 if (ret) 999 return ret; 1000 1001 return hid_driver_reset_resume(hid); 1002 } 1003 1004 /* 1005 * Check that the device exists and parse the HID descriptor. 1006 */ 1007 static int __i2c_hid_core_probe(struct i2c_hid *ihid) 1008 { 1009 struct i2c_client *client = ihid->client; 1010 struct hid_device *hid = ihid->hid; 1011 int ret; 1012 1013 /* Make sure there is something at this address */ 1014 ret = i2c_smbus_read_byte(client); 1015 if (ret < 0) { 1016 i2c_hid_dbg(ihid, "nothing at this address: %d\n", ret); 1017 return -ENXIO; 1018 } 1019 1020 ret = i2c_hid_fetch_hid_descriptor(ihid); 1021 if (ret < 0) { 1022 dev_err(&client->dev, 1023 "Failed to fetch the HID Descriptor\n"); 1024 return ret; 1025 } 1026 1027 hid->version = le16_to_cpu(ihid->hdesc.bcdVersion); 1028 hid->vendor = le16_to_cpu(ihid->hdesc.wVendorID); 1029 hid->product = le16_to_cpu(ihid->hdesc.wProductID); 1030 1031 hid->initial_quirks |= i2c_hid_get_dmi_quirks(hid->vendor, 1032 hid->product); 1033 1034 snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", 1035 client->name, (u16)hid->vendor, (u16)hid->product); 1036 strscpy(hid->phys, dev_name(&client->dev), sizeof(hid->phys)); 1037 1038 ihid->quirks = i2c_hid_lookup_quirk(hid->vendor, hid->product); 1039 1040 return 0; 1041 } 1042 1043 static int i2c_hid_core_register_hid(struct i2c_hid *ihid) 1044 { 1045 struct i2c_client *client = ihid->client; 1046 struct hid_device *hid = ihid->hid; 1047 int ret; 1048 1049 enable_irq(client->irq); 1050 1051 ret = hid_add_device(hid); 1052 if (ret) { 1053 if (ret != -ENODEV) 1054 hid_err(client, "can't add hid device: %d\n", ret); 1055 disable_irq(client->irq); 1056 return ret; 1057 } 1058 1059 return 0; 1060 } 1061 1062 static int i2c_hid_core_probe_panel_follower(struct i2c_hid *ihid) 1063 { 1064 int ret; 1065 1066 ret = i2c_hid_core_power_up(ihid); 1067 if (ret) 1068 return ret; 1069 1070 ret = __i2c_hid_core_probe(ihid); 1071 if (ret) 1072 goto err_power_down; 1073 1074 ret = i2c_hid_core_register_hid(ihid); 1075 if (ret) 1076 goto err_power_down; 1077 1078 return 0; 1079 1080 err_power_down: 1081 i2c_hid_core_power_down(ihid); 1082 1083 return ret; 1084 } 1085 1086 static void ihid_core_panel_prepare_work(struct work_struct *work) 1087 { 1088 struct i2c_hid *ihid = container_of(work, struct i2c_hid, 1089 panel_follower_prepare_work); 1090 struct hid_device *hid = ihid->hid; 1091 int ret; 1092 1093 /* 1094 * hid->version is set on the first power up. If it's still zero then 1095 * this is the first power on so we should perform initial power up 1096 * steps. 1097 */ 1098 if (!hid->version) 1099 ret = i2c_hid_core_probe_panel_follower(ihid); 1100 else 1101 ret = i2c_hid_core_resume(ihid); 1102 1103 if (ret) 1104 dev_warn(&ihid->client->dev, "Power on failed: %d\n", ret); 1105 else 1106 WRITE_ONCE(ihid->prepare_work_finished, true); 1107 1108 /* 1109 * The work APIs provide a number of memory ordering guarantees 1110 * including one that says that memory writes before schedule_work() 1111 * are always visible to the work function, but they don't appear to 1112 * guarantee that a write that happened in the work is visible after 1113 * cancel_work_sync(). We'll add a write memory barrier here to match 1114 * with i2c_hid_core_panel_unpreparing() to ensure that our write to 1115 * prepare_work_finished is visible there. 1116 */ 1117 smp_wmb(); 1118 } 1119 1120 static int i2c_hid_core_panel_prepared(struct drm_panel_follower *follower) 1121 { 1122 struct i2c_hid *ihid = container_of(follower, struct i2c_hid, panel_follower); 1123 1124 /* 1125 * Powering on a touchscreen can be a slow process. Queue the work to 1126 * the system workqueue so we don't block the panel's power up. 1127 */ 1128 WRITE_ONCE(ihid->prepare_work_finished, false); 1129 schedule_work(&ihid->panel_follower_prepare_work); 1130 1131 return 0; 1132 } 1133 1134 static int i2c_hid_core_panel_unpreparing(struct drm_panel_follower *follower) 1135 { 1136 struct i2c_hid *ihid = container_of(follower, struct i2c_hid, panel_follower); 1137 1138 cancel_work_sync(&ihid->panel_follower_prepare_work); 1139 1140 /* Match with ihid_core_panel_prepare_work() */ 1141 smp_rmb(); 1142 if (!READ_ONCE(ihid->prepare_work_finished)) 1143 return 0; 1144 1145 return i2c_hid_core_suspend(ihid, true); 1146 } 1147 1148 static const struct drm_panel_follower_funcs i2c_hid_core_panel_follower_funcs = { 1149 .panel_prepared = i2c_hid_core_panel_prepared, 1150 .panel_unpreparing = i2c_hid_core_panel_unpreparing, 1151 }; 1152 1153 static int i2c_hid_core_register_panel_follower(struct i2c_hid *ihid) 1154 { 1155 struct device *dev = &ihid->client->dev; 1156 int ret; 1157 1158 ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_funcs; 1159 1160 /* 1161 * If we're not in control of our own power up/power down then we can't 1162 * do the logic to manage wakeups. Give a warning if a user thought 1163 * that was possible then force the capability off. 1164 */ 1165 if (device_can_wakeup(dev)) { 1166 dev_warn(dev, "Can't wakeup if following panel\n"); 1167 device_set_wakeup_capable(dev, false); 1168 } 1169 1170 ret = drm_panel_add_follower(dev, &ihid->panel_follower); 1171 if (ret) 1172 return ret; 1173 1174 return 0; 1175 } 1176 1177 int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops, 1178 u16 hid_descriptor_address, u32 quirks) 1179 { 1180 int ret; 1181 struct i2c_hid *ihid; 1182 struct hid_device *hid; 1183 1184 dbg_hid("HID probe called for i2c 0x%02x\n", client->addr); 1185 1186 if (!client->irq) { 1187 dev_err(&client->dev, 1188 "HID over i2c has not been provided an Int IRQ\n"); 1189 return -EINVAL; 1190 } 1191 1192 if (client->irq < 0) { 1193 if (client->irq != -EPROBE_DEFER) 1194 dev_err(&client->dev, 1195 "HID over i2c doesn't have a valid IRQ\n"); 1196 return client->irq; 1197 } 1198 1199 ihid = devm_kzalloc(&client->dev, sizeof(*ihid), GFP_KERNEL); 1200 if (!ihid) 1201 return -ENOMEM; 1202 1203 i2c_set_clientdata(client, ihid); 1204 1205 ihid->ops = ops; 1206 ihid->client = client; 1207 ihid->wHIDDescRegister = cpu_to_le16(hid_descriptor_address); 1208 ihid->is_panel_follower = drm_is_panel_follower(&client->dev); 1209 1210 init_waitqueue_head(&ihid->wait); 1211 mutex_init(&ihid->reset_lock); 1212 INIT_WORK(&ihid->panel_follower_prepare_work, ihid_core_panel_prepare_work); 1213 1214 /* we need to allocate the command buffer without knowing the maximum 1215 * size of the reports. Let's use HID_MIN_BUFFER_SIZE, then we do the 1216 * real computation later. */ 1217 ret = i2c_hid_alloc_buffers(ihid, HID_MIN_BUFFER_SIZE); 1218 if (ret < 0) 1219 return ret; 1220 device_enable_async_suspend(&client->dev); 1221 1222 hid = hid_allocate_device(); 1223 if (IS_ERR(hid)) { 1224 ret = PTR_ERR(hid); 1225 goto err_free_buffers; 1226 } 1227 1228 ihid->hid = hid; 1229 1230 hid->driver_data = client; 1231 hid->ll_driver = &i2c_hid_ll_driver; 1232 hid->dev.parent = &client->dev; 1233 hid->bus = BUS_I2C; 1234 hid->initial_quirks = quirks; 1235 1236 /* Power on and probe unless device is a panel follower. */ 1237 if (!ihid->is_panel_follower) { 1238 ret = i2c_hid_core_power_up(ihid); 1239 if (ret < 0) 1240 goto err_destroy_device; 1241 1242 ret = __i2c_hid_core_probe(ihid); 1243 if (ret < 0) 1244 goto err_power_down; 1245 } 1246 1247 ret = i2c_hid_init_irq(client); 1248 if (ret < 0) 1249 goto err_power_down; 1250 1251 /* 1252 * If we're a panel follower, we'll register when the panel turns on; 1253 * otherwise we do it right away. 1254 */ 1255 if (ihid->is_panel_follower) 1256 ret = i2c_hid_core_register_panel_follower(ihid); 1257 else 1258 ret = i2c_hid_core_register_hid(ihid); 1259 if (ret) 1260 goto err_free_irq; 1261 1262 return 0; 1263 1264 err_free_irq: 1265 free_irq(client->irq, ihid); 1266 err_power_down: 1267 if (!ihid->is_panel_follower) 1268 i2c_hid_core_power_down(ihid); 1269 err_destroy_device: 1270 hid_destroy_device(hid); 1271 err_free_buffers: 1272 i2c_hid_free_buffers(ihid); 1273 1274 return ret; 1275 } 1276 EXPORT_SYMBOL_GPL(i2c_hid_core_probe); 1277 1278 void i2c_hid_core_remove(struct i2c_client *client) 1279 { 1280 struct i2c_hid *ihid = i2c_get_clientdata(client); 1281 struct hid_device *hid; 1282 1283 /* 1284 * If we're a follower, the act of unfollowing will cause us to be 1285 * powered down. Otherwise we need to manually do it. 1286 */ 1287 if (ihid->is_panel_follower) 1288 drm_panel_remove_follower(&ihid->panel_follower); 1289 else 1290 i2c_hid_core_suspend(ihid, true); 1291 1292 hid = ihid->hid; 1293 hid_destroy_device(hid); 1294 1295 free_irq(client->irq, ihid); 1296 1297 if (ihid->bufsize) 1298 i2c_hid_free_buffers(ihid); 1299 } 1300 EXPORT_SYMBOL_GPL(i2c_hid_core_remove); 1301 1302 void i2c_hid_core_shutdown(struct i2c_client *client) 1303 { 1304 struct i2c_hid *ihid = i2c_get_clientdata(client); 1305 1306 i2c_hid_set_power(ihid, I2C_HID_PWR_SLEEP); 1307 free_irq(client->irq, ihid); 1308 1309 i2c_hid_core_shutdown_tail(ihid); 1310 } 1311 EXPORT_SYMBOL_GPL(i2c_hid_core_shutdown); 1312 1313 static int i2c_hid_core_pm_suspend(struct device *dev) 1314 { 1315 struct i2c_client *client = to_i2c_client(dev); 1316 struct i2c_hid *ihid = i2c_get_clientdata(client); 1317 1318 if (ihid->is_panel_follower) 1319 return 0; 1320 1321 return i2c_hid_core_suspend(ihid, false); 1322 } 1323 1324 static int i2c_hid_core_pm_resume(struct device *dev) 1325 { 1326 struct i2c_client *client = to_i2c_client(dev); 1327 struct i2c_hid *ihid = i2c_get_clientdata(client); 1328 1329 if (ihid->is_panel_follower) 1330 return 0; 1331 1332 return i2c_hid_core_resume(ihid); 1333 } 1334 1335 const struct dev_pm_ops i2c_hid_core_pm = { 1336 SYSTEM_SLEEP_PM_OPS(i2c_hid_core_pm_suspend, i2c_hid_core_pm_resume) 1337 }; 1338 EXPORT_SYMBOL_GPL(i2c_hid_core_pm); 1339 1340 MODULE_DESCRIPTION("HID over I2C core driver"); 1341 MODULE_AUTHOR("Benjamin Tissoires <benjamin.tissoires@gmail.com>"); 1342 MODULE_LICENSE("GPL"); 1343