drivers/hid/hid-logitech-hidpp.c

   1 /*
   2  *  HIDPP protocol for Logitech Unifying receivers
   3  *
   4  *  Copyright (c) 2011 Logitech (c)
   5  *  Copyright (c) 2012-2013 Google (c)
   6  *  Copyright (c) 2013-2014 Red Hat Inc.
   7  */
   8
   9 /*
  10  * This program is free software; you can redistribute it and/or modify it
  11  * under the terms of the GNU General Public License as published by the Free
  12  * Software Foundation; version 2 of the License.
  13  */
  14
  15 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  16
  17 #include <linux/device.h>
  18 #include <linux/input.h>
  19 #include <linux/usb.h>
  20 #include <linux/hid.h>
  21 #include <linux/module.h>
  22 #include <linux/slab.h>
  23 #include <linux/sched.h>
  24 #include <linux/kfifo.h>
  25 #include <linux/input/mt.h>
  26 #include <linux/workqueue.h>
  27 #include <linux/atomic.h>
  28 #include <linux/fixp-arith.h>
  29 #include <asm/unaligned.h>
  30 #include "usbhid/usbhid.h"
  31 #include "hid-ids.h"
  32
  33 MODULE_LICENSE("GPL");
  34 MODULE_AUTHOR("Benjamin Tissoires <benjamin.tissoires@gmail.com>");
  35 MODULE_AUTHOR("Nestor Lopez Casado <nlopezcasad@logitech.com>");
  36
  37 static bool disable_raw_mode;
  38 module_param(disable_raw_mode, bool, 0644);
  39 MODULE_PARM_DESC(disable_raw_mode,
  40         "Disable Raw mode reporting for touchpads and keep firmware gestures.");
  41
  42 static bool disable_tap_to_click;
  43 module_param(disable_tap_to_click, bool, 0644);
  44 MODULE_PARM_DESC(disable_tap_to_click,
  45         "Disable Tap-To-Click mode reporting for touchpads (only on the K400 currently).");
  46
  47 #define REPORT_ID_HIDPP_SHORT                   0x10
  48 #define REPORT_ID_HIDPP_LONG                    0x11
  49 #define REPORT_ID_HIDPP_VERY_LONG               0x12
  50
  51 #define HIDPP_REPORT_SHORT_LENGTH               7
  52 #define HIDPP_REPORT_LONG_LENGTH                20
  53 #define HIDPP_REPORT_VERY_LONG_LENGTH           64
  54
  55 #define HIDPP_QUIRK_CLASS_WTP                   BIT(0)
  56 #define HIDPP_QUIRK_CLASS_M560                  BIT(1)
  57 #define HIDPP_QUIRK_CLASS_K400                  BIT(2)
  58 #define HIDPP_QUIRK_CLASS_G920                  BIT(3)
  59
  60 /* bits 2..20 are reserved for classes */
  61 #define HIDPP_QUIRK_CONNECT_EVENTS              BIT(21)
  62 #define HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS        BIT(22)
  63 #define HIDPP_QUIRK_NO_HIDINPUT                 BIT(23)
  64 #define HIDPP_QUIRK_FORCE_OUTPUT_REPORTS        BIT(24)
  65
  66 #define HIDPP_QUIRK_DELAYED_INIT                (HIDPP_QUIRK_NO_HIDINPUT | \
  67                                                  HIDPP_QUIRK_CONNECT_EVENTS)
  68
  69 /*
  70  * There are two hidpp protocols in use, the first version hidpp10 is known
  71  * as register access protocol or RAP, the second version hidpp20 is known as
  72  * feature access protocol or FAP
  73  *
  74  * Most older devices (including the Unifying usb receiver) use the RAP protocol
  75  * where as most newer devices use the FAP protocol. Both protocols are
  76  * compatible with the underlying transport, which could be usb, Unifiying, or
  77  * bluetooth. The message lengths are defined by the hid vendor specific report
  78  * descriptor for the HIDPP_SHORT report type (total message lenth 7 bytes) and
  79  * the HIDPP_LONG report type (total message length 20 bytes)
  80  *
  81  * The RAP protocol uses both report types, whereas the FAP only uses HIDPP_LONG
  82  * messages. The Unifying receiver itself responds to RAP messages (device index
  83  * is 0xFF for the receiver), and all messages (short or long) with a device
  84  * index between 1 and 6 are passed untouched to the corresponding paired
  85  * Unifying device.
  86  *
  87  * The paired device can be RAP or FAP, it will receive the message untouched
  88  * from the Unifiying receiver.
  89  */
  90
  91 struct fap {
  92         u8 feature_index;
  93         u8 funcindex_clientid;
  94         u8 params[HIDPP_REPORT_VERY_LONG_LENGTH - 4U];
  95 };
  96
  97 struct rap {
  98         u8 sub_id;
  99         u8 reg_address;
 100         u8 params[HIDPP_REPORT_VERY_LONG_LENGTH - 4U];
 101 };
 102
 103 struct hidpp_report {
 104         u8 report_id;
 105         u8 device_index;
 106         union {
 107                 struct fap fap;
 108                 struct rap rap;
 109                 u8 rawbytes[sizeof(struct fap)];
 110         };
 111 } __packed;
 112
 113 struct hidpp_device {
 114         struct hid_device *hid_dev;
 115         struct mutex send_mutex;
 116         void *send_receive_buf;
 117         char *name;             /* will never be NULL and should not be freed */
 118         wait_queue_head_t wait;
 119         bool answer_available;
 120         u8 protocol_major;
 121         u8 protocol_minor;
 122
 123         void *private_data;
 124
 125         struct work_struct work;
 126         struct kfifo delayed_work_fifo;
 127         atomic_t connected;
 128         struct input_dev *delayed_input;
 129
 130         unsigned long quirks;
 131 };
 132
 133
 134 /* HID++ 1.0 error codes */
 135 #define HIDPP_ERROR                             0x8f
 136 #define HIDPP_ERROR_SUCCESS                     0x00
 137 #define HIDPP_ERROR_INVALID_SUBID               0x01
 138 #define HIDPP_ERROR_INVALID_ADRESS              0x02
 139 #define HIDPP_ERROR_INVALID_VALUE               0x03
 140 #define HIDPP_ERROR_CONNECT_FAIL                0x04
 141 #define HIDPP_ERROR_TOO_MANY_DEVICES            0x05
 142 #define HIDPP_ERROR_ALREADY_EXISTS              0x06
 143 #define HIDPP_ERROR_BUSY                        0x07
 144 #define HIDPP_ERROR_UNKNOWN_DEVICE              0x08
 145 #define HIDPP_ERROR_RESOURCE_ERROR              0x09
 146 #define HIDPP_ERROR_REQUEST_UNAVAILABLE         0x0a
 147 #define HIDPP_ERROR_INVALID_PARAM_VALUE         0x0b
 148 #define HIDPP_ERROR_WRONG_PIN_CODE              0x0c
 149 /* HID++ 2.0 error codes */
 150 #define HIDPP20_ERROR                           0xff
 151
 152 static void hidpp_connect_event(struct hidpp_device *hidpp_dev);
 153
 154 static int __hidpp_send_report(struct hid_device *hdev,
 155                                 struct hidpp_report *hidpp_report)
 156 {
 157         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
 158         int fields_count, ret;
 159
 160         hidpp = hid_get_drvdata(hdev);
 161
 162         switch (hidpp_report->report_id) {
 163         case REPORT_ID_HIDPP_SHORT:
 164                 fields_count = HIDPP_REPORT_SHORT_LENGTH;
 165                 break;
 166         case REPORT_ID_HIDPP_LONG:
 167                 fields_count = HIDPP_REPORT_LONG_LENGTH;
 168                 break;
 169         case REPORT_ID_HIDPP_VERY_LONG:
 170                 fields_count = HIDPP_REPORT_VERY_LONG_LENGTH;
 171                 break;
 172         default:
 173                 return -ENODEV;
 174         }
 175
 176         /*
 177          * set the device_index as the receiver, it will be overwritten by
 178          * hid_hw_request if needed
 179          */
 180         hidpp_report->device_index = 0xff;
 181
 182         if (hidpp->quirks & HIDPP_QUIRK_FORCE_OUTPUT_REPORTS) {
 183                 ret = hid_hw_output_report(hdev, (u8 *)hidpp_report, fields_count);
 184         } else {
 185                 ret = hid_hw_raw_request(hdev, hidpp_report->report_id,
 186                         (u8 *)hidpp_report, fields_count, HID_OUTPUT_REPORT,
 187                         HID_REQ_SET_REPORT);
 188         }
 189
 190         return ret == fields_count ? 0 : -1;
 191 }
 192
 193 /**
 194  * hidpp_send_message_sync() returns 0 in case of success, and something else
 195  * in case of a failure.
 196  * - If ' something else' is positive, that means that an error has been raised
 197  *   by the protocol itself.
 198  * - If ' something else' is negative, that means that we had a classic error
 199  *   (-ENOMEM, -EPIPE, etc...)
 200  */
 201 static int hidpp_send_message_sync(struct hidpp_device *hidpp,
 202         struct hidpp_report *message,
 203         struct hidpp_report *response)
 204 {
 205         int ret;
 206
 207         mutex_lock(&hidpp->send_mutex);
 208
 209         hidpp->send_receive_buf = response;
 210         hidpp->answer_available = false;
 211
 212         /*
 213          * So that we can later validate the answer when it arrives
 214          * in hidpp_raw_event
 215          */
 216         *response = *message;
 217
 218         ret = __hidpp_send_report(hidpp->hid_dev, message);
 219
 220         if (ret) {
 221                 dbg_hid("__hidpp_send_report returned err: %d\n", ret);
 222                 memset(response, 0, sizeof(struct hidpp_report));
 223                 goto exit;
 224         }
 225
 226         if (!wait_event_timeout(hidpp->wait, hidpp->answer_available,
 227                                 5*HZ)) {
 228                 dbg_hid("%s:timeout waiting for response\n", __func__);
 229                 memset(response, 0, sizeof(struct hidpp_report));
 230                 ret = -ETIMEDOUT;
 231         }
 232
 233         if (response->report_id == REPORT_ID_HIDPP_SHORT &&
 234             response->rap.sub_id == HIDPP_ERROR) {
 235                 ret = response->rap.params[1];
 236                 dbg_hid("%s:got hidpp error %02X\n", __func__, ret);
 237                 goto exit;
 238         }
 239
 240         if ((response->report_id == REPORT_ID_HIDPP_LONG ||
 241                         response->report_id == REPORT_ID_HIDPP_VERY_LONG) &&
 242                         response->fap.feature_index == HIDPP20_ERROR) {
 243                 ret = response->fap.params[1];
 244                 dbg_hid("%s:got hidpp 2.0 error %02X\n", __func__, ret);
 245                 goto exit;
 246         }
 247
 248 exit:
 249         mutex_unlock(&hidpp->send_mutex);
 250         return ret;
 251
 252 }
 253
 254 static int hidpp_send_fap_command_sync(struct hidpp_device *hidpp,
 255         u8 feat_index, u8 funcindex_clientid, u8 *params, int param_count,
 256         struct hidpp_report *response)
 257 {
 258         struct hidpp_report *message;
 259         int ret;
 260
 261         if (param_count > sizeof(message->fap.params))
 262                 return -EINVAL;
 263
 264         message = kzalloc(sizeof(struct hidpp_report), GFP_KERNEL);
 265         if (!message)
 266                 return -ENOMEM;
 267
 268         if (param_count > (HIDPP_REPORT_LONG_LENGTH - 4))
 269                 message->report_id = REPORT_ID_HIDPP_VERY_LONG;
 270         else
 271                 message->report_id = REPORT_ID_HIDPP_LONG;
 272         message->fap.feature_index = feat_index;
 273         message->fap.funcindex_clientid = funcindex_clientid;
 274         memcpy(&message->fap.params, params, param_count);
 275
 276         ret = hidpp_send_message_sync(hidpp, message, response);
 277         kfree(message);
 278         return ret;
 279 }
 280
 281 static int hidpp_send_rap_command_sync(struct hidpp_device *hidpp_dev,
 282         u8 report_id, u8 sub_id, u8 reg_address, u8 *params, int param_count,
 283         struct hidpp_report *response)
 284 {
 285         struct hidpp_report *message;
 286         int ret, max_count;
 287
 288         switch (report_id) {
 289         case REPORT_ID_HIDPP_SHORT:
 290                 max_count = HIDPP_REPORT_SHORT_LENGTH - 4;
 291                 break;
 292         case REPORT_ID_HIDPP_LONG:
 293                 max_count = HIDPP_REPORT_LONG_LENGTH - 4;
 294                 break;
 295         case REPORT_ID_HIDPP_VERY_LONG:
 296                 max_count = HIDPP_REPORT_VERY_LONG_LENGTH - 4;
 297                 break;
 298         default:
 299                 return -EINVAL;
 300         }
 301
 302         if (param_count > max_count)
 303                 return -EINVAL;
 304
 305         message = kzalloc(sizeof(struct hidpp_report), GFP_KERNEL);
 306         if (!message)
 307                 return -ENOMEM;
 308         message->report_id = report_id;
 309         message->rap.sub_id = sub_id;
 310         message->rap.reg_address = reg_address;
 311         memcpy(&message->rap.params, params, param_count);
 312
 313         ret = hidpp_send_message_sync(hidpp_dev, message, response);
 314         kfree(message);
 315         return ret;
 316 }
 317
 318 static void delayed_work_cb(struct work_struct *work)
 319 {
 320         struct hidpp_device *hidpp = container_of(work, struct hidpp_device,
 321                                                         work);
 322         hidpp_connect_event(hidpp);
 323 }
 324
 325 static inline bool hidpp_match_answer(struct hidpp_report *question,
 326                 struct hidpp_report *answer)
 327 {
 328         return (answer->fap.feature_index == question->fap.feature_index) &&
 329            (answer->fap.funcindex_clientid == question->fap.funcindex_clientid);
 330 }
 331
 332 static inline bool hidpp_match_error(struct hidpp_report *question,
 333                 struct hidpp_report *answer)
 334 {
 335         return ((answer->rap.sub_id == HIDPP_ERROR) ||
 336             (answer->fap.feature_index == HIDPP20_ERROR)) &&
 337             (answer->fap.funcindex_clientid == question->fap.feature_index) &&
 338             (answer->fap.params[0] == question->fap.funcindex_clientid);
 339 }
 340
 341 static inline bool hidpp_report_is_connect_event(struct hidpp_report *report)
 342 {
 343         return (report->report_id == REPORT_ID_HIDPP_SHORT) &&
 344                 (report->rap.sub_id == 0x41);
 345 }
 346
 347 /**
 348  * hidpp_prefix_name() prefixes the current given name with "Logitech ".
 349  */
 350 static void hidpp_prefix_name(char **name, int name_length)
 351 {
 352 #define PREFIX_LENGTH 9 /* "Logitech " */
 353
 354         int new_length;
 355         char *new_name;
 356
 357         if (name_length > PREFIX_LENGTH &&
 358             strncmp(*name, "Logitech ", PREFIX_LENGTH) == 0)
 359                 /* The prefix has is already in the name */
 360                 return;
 361
 362         new_length = PREFIX_LENGTH + name_length;
 363         new_name = kzalloc(new_length, GFP_KERNEL);
 364         if (!new_name)
 365                 return;
 366
 367         snprintf(new_name, new_length, "Logitech %s", *name);
 368
 369         kfree(*name);
 370
 371         *name = new_name;
 372 }
 373
 374 /* -------------------------------------------------------------------------- */
 375 /* HIDP++ 1.0 commands                                                        */
 376 /* -------------------------------------------------------------------------- */
 377
 378 #define HIDPP_SET_REGISTER                              0x80
 379 #define HIDPP_GET_REGISTER                              0x81
 380 #define HIDPP_SET_LONG_REGISTER                         0x82
 381 #define HIDPP_GET_LONG_REGISTER                         0x83
 382
 383 #define HIDPP_REG_PAIRING_INFORMATION                   0xB5
 384 #define DEVICE_NAME                                     0x40
 385
 386 static char *hidpp_get_unifying_name(struct hidpp_device *hidpp_dev)
 387 {
 388         struct hidpp_report response;
 389         int ret;
 390         /* hid-logitech-dj is in charge of setting the right device index */
 391         u8 params[1] = { DEVICE_NAME };
 392         char *name;
 393         int len;
 394
 395         ret = hidpp_send_rap_command_sync(hidpp_dev,
 396                                         REPORT_ID_HIDPP_SHORT,
 397                                         HIDPP_GET_LONG_REGISTER,
 398                                         HIDPP_REG_PAIRING_INFORMATION,
 399                                         params, 1, &response);
 400         if (ret)
 401                 return NULL;
 402
 403         len = response.rap.params[1];
 404
 405         if (2 + len > sizeof(response.rap.params))
 406                 return NULL;
 407
 408         name = kzalloc(len + 1, GFP_KERNEL);
 409         if (!name)
 410                 return NULL;
 411
 412         memcpy(name, &response.rap.params[2], len);
 413
 414         /* include the terminating '\0' */
 415         hidpp_prefix_name(&name, len + 1);
 416
 417         return name;
 418 }
 419
 420 /* -------------------------------------------------------------------------- */
 421 /* 0x0000: Root                                                               */
 422 /* -------------------------------------------------------------------------- */
 423
 424 #define HIDPP_PAGE_ROOT                                 0x0000
 425 #define HIDPP_PAGE_ROOT_IDX                             0x00
 426
 427 #define CMD_ROOT_GET_FEATURE                            0x01
 428 #define CMD_ROOT_GET_PROTOCOL_VERSION                   0x11
 429
 430 static int hidpp_root_get_feature(struct hidpp_device *hidpp, u16 feature,
 431         u8 *feature_index, u8 *feature_type)
 432 {
 433         struct hidpp_report response;
 434         int ret;
 435         u8 params[2] = { feature >> 8, feature & 0x00FF };
 436
 437         ret = hidpp_send_fap_command_sync(hidpp,
 438                         HIDPP_PAGE_ROOT_IDX,
 439                         CMD_ROOT_GET_FEATURE,
 440                         params, 2, &response);
 441         if (ret)
 442                 return ret;
 443
 444         *feature_index = response.fap.params[0];
 445         *feature_type = response.fap.params[1];
 446
 447         return ret;
 448 }
 449
 450 static int hidpp_root_get_protocol_version(struct hidpp_device *hidpp)
 451 {
 452         struct hidpp_report response;
 453         int ret;
 454
 455         ret = hidpp_send_fap_command_sync(hidpp,
 456                         HIDPP_PAGE_ROOT_IDX,
 457                         CMD_ROOT_GET_PROTOCOL_VERSION,
 458                         NULL, 0, &response);
 459
 460         if (ret == HIDPP_ERROR_INVALID_SUBID) {
 461                 hidpp->protocol_major = 1;
 462                 hidpp->protocol_minor = 0;
 463                 return 0;
 464         }
 465
 466         /* the device might not be connected */
 467         if (ret == HIDPP_ERROR_RESOURCE_ERROR)
 468                 return -EIO;
 469
 470         if (ret > 0) {
 471                 hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
 472                         __func__, ret);
 473                 return -EPROTO;
 474         }
 475         if (ret)
 476                 return ret;
 477
 478         hidpp->protocol_major = response.fap.params[0];
 479         hidpp->protocol_minor = response.fap.params[1];
 480
 481         return ret;
 482 }
 483
 484 static bool hidpp_is_connected(struct hidpp_device *hidpp)
 485 {
 486         int ret;
 487
 488         ret = hidpp_root_get_protocol_version(hidpp);
 489         if (!ret)
 490                 hid_dbg(hidpp->hid_dev, "HID++ %u.%u device connected.\n",
 491                         hidpp->protocol_major, hidpp->protocol_minor);
 492         return ret == 0;
 493 }
 494
 495 /* -------------------------------------------------------------------------- */
 496 /* 0x0005: GetDeviceNameType                                                  */
 497 /* -------------------------------------------------------------------------- */
 498
 499 #define HIDPP_PAGE_GET_DEVICE_NAME_TYPE                 0x0005
 500
 501 #define CMD_GET_DEVICE_NAME_TYPE_GET_COUNT              0x01
 502 #define CMD_GET_DEVICE_NAME_TYPE_GET_DEVICE_NAME        0x11
 503 #define CMD_GET_DEVICE_NAME_TYPE_GET_TYPE               0x21
 504
 505 static int hidpp_devicenametype_get_count(struct hidpp_device *hidpp,
 506         u8 feature_index, u8 *nameLength)
 507 {
 508         struct hidpp_report response;
 509         int ret;
 510
 511         ret = hidpp_send_fap_command_sync(hidpp, feature_index,
 512                 CMD_GET_DEVICE_NAME_TYPE_GET_COUNT, NULL, 0, &response);
 513
 514         if (ret > 0) {
 515                 hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
 516                         __func__, ret);
 517                 return -EPROTO;
 518         }
 519         if (ret)
 520                 return ret;
 521
 522         *nameLength = response.fap.params[0];
 523
 524         return ret;
 525 }
 526
 527 static int hidpp_devicenametype_get_device_name(struct hidpp_device *hidpp,
 528         u8 feature_index, u8 char_index, char *device_name, int len_buf)
 529 {
 530         struct hidpp_report response;
 531         int ret, i;
 532         int count;
 533
 534         ret = hidpp_send_fap_command_sync(hidpp, feature_index,
 535                 CMD_GET_DEVICE_NAME_TYPE_GET_DEVICE_NAME, &char_index, 1,
 536                 &response);
 537
 538         if (ret > 0) {
 539                 hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
 540                         __func__, ret);
 541                 return -EPROTO;
 542         }
 543         if (ret)
 544                 return ret;
 545
 546         switch (response.report_id) {
 547         case REPORT_ID_HIDPP_VERY_LONG:
 548                 count = HIDPP_REPORT_VERY_LONG_LENGTH - 4;
 549                 break;
 550         case REPORT_ID_HIDPP_LONG:
 551                 count = HIDPP_REPORT_LONG_LENGTH - 4;
 552                 break;
 553         case REPORT_ID_HIDPP_SHORT:
 554                 count = HIDPP_REPORT_SHORT_LENGTH - 4;
 555                 break;
 556         default:
 557                 return -EPROTO;
 558         }
 559
 560         if (len_buf < count)
 561                 count = len_buf;
 562
 563         for (i = 0; i < count; i++)
 564                 device_name[i] = response.fap.params[i];
 565
 566         return count;
 567 }
 568
 569 static char *hidpp_get_device_name(struct hidpp_device *hidpp)
 570 {
 571         u8 feature_type;
 572         u8 feature_index;
 573         u8 __name_length;
 574         char *name;
 575         unsigned index = 0;
 576         int ret;
 577
 578         ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_GET_DEVICE_NAME_TYPE,
 579                 &feature_index, &feature_type);
 580         if (ret)
 581                 return NULL;
 582
 583         ret = hidpp_devicenametype_get_count(hidpp, feature_index,
 584                 &__name_length);
 585         if (ret)
 586                 return NULL;
 587
 588         name = kzalloc(__name_length + 1, GFP_KERNEL);
 589         if (!name)
 590                 return NULL;
 591
 592         while (index < __name_length) {
 593                 ret = hidpp_devicenametype_get_device_name(hidpp,
 594                         feature_index, index, name + index,
 595                         __name_length - index);
 596                 if (ret <= 0) {
 597                         kfree(name);
 598                         return NULL;
 599                 }
 600                 index += ret;
 601         }
 602
 603         /* include the terminating '\0' */
 604         hidpp_prefix_name(&name, __name_length + 1);
 605
 606         return name;
 607 }
 608
 609 /* -------------------------------------------------------------------------- */
 610 /* 0x6010: Touchpad FW items                                                  */
 611 /* -------------------------------------------------------------------------- */
 612
 613 #define HIDPP_PAGE_TOUCHPAD_FW_ITEMS                    0x6010
 614
 615 #define CMD_TOUCHPAD_FW_ITEMS_SET                       0x10
 616
 617 struct hidpp_touchpad_fw_items {
 618         uint8_t presence;
 619         uint8_t desired_state;
 620         uint8_t state;
 621         uint8_t persistent;
 622 };
 623
 624 /**
 625  * send a set state command to the device by reading the current items->state
 626  * field. items is then filled with the current state.
 627  */
 628 static int hidpp_touchpad_fw_items_set(struct hidpp_device *hidpp,
 629                                        u8 feature_index,
 630                                        struct hidpp_touchpad_fw_items *items)
 631 {
 632         struct hidpp_report response;
 633         int ret;
 634         u8 *params = (u8 *)response.fap.params;
 635
 636         ret = hidpp_send_fap_command_sync(hidpp, feature_index,
 637                 CMD_TOUCHPAD_FW_ITEMS_SET, &items->state, 1, &response);
 638
 639         if (ret > 0) {
 640                 hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
 641                         __func__, ret);
 642                 return -EPROTO;
 643         }
 644         if (ret)
 645                 return ret;
 646
 647         items->presence = params[0];
 648         items->desired_state = params[1];
 649         items->state = params[2];
 650         items->persistent = params[3];
 651
 652         return 0;
 653 }
 654
 655 /* -------------------------------------------------------------------------- */
 656 /* 0x6100: TouchPadRawXY                                                      */
 657 /* -------------------------------------------------------------------------- */
 658
 659 #define HIDPP_PAGE_TOUCHPAD_RAW_XY                      0x6100
 660
 661 #define CMD_TOUCHPAD_GET_RAW_INFO                       0x01
 662 #define CMD_TOUCHPAD_SET_RAW_REPORT_STATE               0x21
 663
 664 #define EVENT_TOUCHPAD_RAW_XY                           0x00
 665
 666 #define TOUCHPAD_RAW_XY_ORIGIN_LOWER_LEFT               0x01
 667 #define TOUCHPAD_RAW_XY_ORIGIN_UPPER_LEFT               0x03
 668
 669 struct hidpp_touchpad_raw_info {
 670         u16 x_size;
 671         u16 y_size;
 672         u8 z_range;
 673         u8 area_range;
 674         u8 timestamp_unit;
 675         u8 maxcontacts;
 676         u8 origin;
 677         u16 res;
 678 };
 679
 680 struct hidpp_touchpad_raw_xy_finger {
 681         u8 contact_type;
 682         u8 contact_status;
 683         u16 x;
 684         u16 y;
 685         u8 z;
 686         u8 area;
 687         u8 finger_id;
 688 };
 689
 690 struct hidpp_touchpad_raw_xy {
 691         u16 timestamp;
 692         struct hidpp_touchpad_raw_xy_finger fingers[2];
 693         u8 spurious_flag;
 694         u8 end_of_frame;
 695         u8 finger_count;
 696         u8 button;
 697 };
 698
 699 static int hidpp_touchpad_get_raw_info(struct hidpp_device *hidpp,
 700         u8 feature_index, struct hidpp_touchpad_raw_info *raw_info)
 701 {
 702         struct hidpp_report response;
 703         int ret;
 704         u8 *params = (u8 *)response.fap.params;
 705
 706         ret = hidpp_send_fap_command_sync(hidpp, feature_index,
 707                 CMD_TOUCHPAD_GET_RAW_INFO, NULL, 0, &response);
 708
 709         if (ret > 0) {
 710                 hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
 711                         __func__, ret);
 712                 return -EPROTO;
 713         }
 714         if (ret)
 715                 return ret;
 716
 717         raw_info->x_size = get_unaligned_be16(&params[0]);
 718         raw_info->y_size = get_unaligned_be16(&params[2]);
 719         raw_info->z_range = params[4];
 720         raw_info->area_range = params[5];
 721         raw_info->maxcontacts = params[7];
 722         raw_info->origin = params[8];
 723         /* res is given in unit per inch */
 724         raw_info->res = get_unaligned_be16(&params[13]) * 2 / 51;
 725
 726         return ret;
 727 }
 728
 729 static int hidpp_touchpad_set_raw_report_state(struct hidpp_device *hidpp_dev,
 730                 u8 feature_index, bool send_raw_reports,
 731                 bool sensor_enhanced_settings)
 732 {
 733         struct hidpp_report response;
 734
 735         /*
 736          * Params:
 737          *   bit 0 - enable raw
 738          *   bit 1 - 16bit Z, no area
 739          *   bit 2 - enhanced sensitivity
 740          *   bit 3 - width, height (4 bits each) instead of area
 741          *   bit 4 - send raw + gestures (degrades smoothness)
 742          *   remaining bits - reserved
 743          */
 744         u8 params = send_raw_reports | (sensor_enhanced_settings << 2);
 745
 746         return hidpp_send_fap_command_sync(hidpp_dev, feature_index,
 747                 CMD_TOUCHPAD_SET_RAW_REPORT_STATE, &params, 1, &response);
 748 }
 749
 750 static void hidpp_touchpad_touch_event(u8 *data,
 751         struct hidpp_touchpad_raw_xy_finger *finger)
 752 {
 753         u8 x_m = data[0] << 2;
 754         u8 y_m = data[2] << 2;
 755
 756         finger->x = x_m << 6 | data[1];
 757         finger->y = y_m << 6 | data[3];
 758
 759         finger->contact_type = data[0] >> 6;
 760         finger->contact_status = data[2] >> 6;
 761
 762         finger->z = data[4];
 763         finger->area = data[5];
 764         finger->finger_id = data[6] >> 4;
 765 }
 766
 767 static void hidpp_touchpad_raw_xy_event(struct hidpp_device *hidpp_dev,
 768                 u8 *data, struct hidpp_touchpad_raw_xy *raw_xy)
 769 {
 770         memset(raw_xy, 0, sizeof(struct hidpp_touchpad_raw_xy));
 771         raw_xy->end_of_frame = data[8] & 0x01;
 772         raw_xy->spurious_flag = (data[8] >> 1) & 0x01;
 773         raw_xy->finger_count = data[15] & 0x0f;
 774         raw_xy->button = (data[8] >> 2) & 0x01;
 775
 776         if (raw_xy->finger_count) {
 777                 hidpp_touchpad_touch_event(&data[2], &raw_xy->fingers[0]);
 778                 hidpp_touchpad_touch_event(&data[9], &raw_xy->fingers[1]);
 779         }
 780 }
 781
 782 /* -------------------------------------------------------------------------- */
 783 /* 0x8123: Force feedback support                                             */
 784 /* -------------------------------------------------------------------------- */
 785
 786 #define HIDPP_FF_GET_INFO               0x01
 787 #define HIDPP_FF_RESET_ALL              0x11
 788 #define HIDPP_FF_DOWNLOAD_EFFECT        0x21
 789 #define HIDPP_FF_SET_EFFECT_STATE       0x31
 790 #define HIDPP_FF_DESTROY_EFFECT         0x41
 791 #define HIDPP_FF_GET_APERTURE           0x51
 792 #define HIDPP_FF_SET_APERTURE           0x61
 793 #define HIDPP_FF_GET_GLOBAL_GAINS       0x71
 794 #define HIDPP_FF_SET_GLOBAL_GAINS       0x81
 795
 796 #define HIDPP_FF_EFFECT_STATE_GET       0x00
 797 #define HIDPP_FF_EFFECT_STATE_STOP      0x01
 798 #define HIDPP_FF_EFFECT_STATE_PLAY      0x02
 799 #define HIDPP_FF_EFFECT_STATE_PAUSE     0x03
 800
 801 #define HIDPP_FF_EFFECT_CONSTANT        0x00
 802 #define HIDPP_FF_EFFECT_PERIODIC_SINE           0x01
 803 #define HIDPP_FF_EFFECT_PERIODIC_SQUARE         0x02
 804 #define HIDPP_FF_EFFECT_PERIODIC_TRIANGLE       0x03
 805 #define HIDPP_FF_EFFECT_PERIODIC_SAWTOOTHUP     0x04
 806 #define HIDPP_FF_EFFECT_PERIODIC_SAWTOOTHDOWN   0x05
 807 #define HIDPP_FF_EFFECT_SPRING          0x06
 808 #define HIDPP_FF_EFFECT_DAMPER          0x07
 809 #define HIDPP_FF_EFFECT_FRICTION        0x08
 810 #define HIDPP_FF_EFFECT_INERTIA         0x09
 811 #define HIDPP_FF_EFFECT_RAMP            0x0A
 812
 813 #define HIDPP_FF_EFFECT_AUTOSTART       0x80
 814
 815 #define HIDPP_FF_EFFECTID_NONE          -1
 816 #define HIDPP_FF_EFFECTID_AUTOCENTER    -2
 817
 818 #define HIDPP_FF_MAX_PARAMS     20
 819 #define HIDPP_FF_RESERVED_SLOTS 1
 820
 821 struct hidpp_ff_private_data {
 822         struct hidpp_device *hidpp;
 823         u8 feature_index;
 824         u8 version;
 825         u16 gain;
 826         s16 range;
 827         u8 slot_autocenter;
 828         u8 num_effects;
 829         int *effect_ids;
 830         struct workqueue_struct *wq;
 831         atomic_t workqueue_size;
 832 };
 833
 834 struct hidpp_ff_work_data {
 835         struct work_struct work;
 836         struct hidpp_ff_private_data *data;
 837         int effect_id;
 838         u8 command;
 839         u8 params[HIDPP_FF_MAX_PARAMS];
 840         u8 size;
 841 };
 842
 843 static const signed short hiddpp_ff_effects[] = {
 844         FF_CONSTANT,
 845         FF_PERIODIC,
 846         FF_SINE,
 847         FF_SQUARE,
 848         FF_SAW_UP,
 849         FF_SAW_DOWN,
 850         FF_TRIANGLE,
 851         FF_SPRING,
 852         FF_DAMPER,
 853         FF_AUTOCENTER,
 854         FF_GAIN,
 855         -1
 856 };
 857
 858 static const signed short hiddpp_ff_effects_v2[] = {
 859         FF_RAMP,
 860         FF_FRICTION,
 861         FF_INERTIA,
 862         -1
 863 };
 864
 865 static const u8 HIDPP_FF_CONDITION_CMDS[] = {
 866         HIDPP_FF_EFFECT_SPRING,
 867         HIDPP_FF_EFFECT_FRICTION,
 868         HIDPP_FF_EFFECT_DAMPER,
 869         HIDPP_FF_EFFECT_INERTIA
 870 };
 871
 872 static const char *HIDPP_FF_CONDITION_NAMES[] = {
 873         "spring",
 874         "friction",
 875         "damper",
 876         "inertia"
 877 };
 878
 879
 880 static u8 hidpp_ff_find_effect(struct hidpp_ff_private_data *data, int effect_id)
 881 {
 882         int i;
 883
 884         for (i = 0; i < data->num_effects; i++)
 885                 if (data->effect_ids[i] == effect_id)
 886                         return i+1;
 887
 888         return 0;
 889 }
 890
 891 static void hidpp_ff_work_handler(struct work_struct *w)
 892 {
 893         struct hidpp_ff_work_data *wd = container_of(w, struct hidpp_ff_work_data, work);
 894         struct hidpp_ff_private_data *data = wd->data;
 895         struct hidpp_report response;
 896         u8 slot;
 897         int ret;
 898
 899         /* add slot number if needed */
 900         switch (wd->effect_id) {
 901         case HIDPP_FF_EFFECTID_AUTOCENTER:
 902                 wd->params[0] = data->slot_autocenter;
 903                 break;
 904         case HIDPP_FF_EFFECTID_NONE:
 905                 /* leave slot as zero */
 906                 break;
 907         default:
 908                 /* find current slot for effect */
 909                 wd->params[0] = hidpp_ff_find_effect(data, wd->effect_id);
 910                 break;
 911         }
 912
 913         /* send command and wait for reply */
 914         ret = hidpp_send_fap_command_sync(data->hidpp, data->feature_index,
 915                 wd->command, wd->params, wd->size, &response);
 916
 917         if (ret) {
 918                 hid_err(data->hidpp->hid_dev, "Failed to send command to device!\n");
 919                 goto out;
 920         }
 921
 922         /* parse return data */
 923         switch (wd->command) {
 924         case HIDPP_FF_DOWNLOAD_EFFECT:
 925                 slot = response.fap.params[0];
 926                 if (slot > 0 && slot <= data->num_effects) {
 927                         if (wd->effect_id >= 0)
 928                                 /* regular effect uploaded */
 929                                 data->effect_ids[slot-1] = wd->effect_id;
 930                         else if (wd->effect_id >= HIDPP_FF_EFFECTID_AUTOCENTER)
 931                                 /* autocenter spring uploaded */
 932                                 data->slot_autocenter = slot;
 933                 }
 934                 break;
 935         case HIDPP_FF_DESTROY_EFFECT:
 936                 if (wd->effect_id >= 0)
 937                         /* regular effect destroyed */
 938                         data->effect_ids[wd->params[0]-1] = -1;
 939                 else if (wd->effect_id >= HIDPP_FF_EFFECTID_AUTOCENTER)
 940                         /* autocenter spring destoyed */
 941                         data->slot_autocenter = 0;
 942                 break;
 943         case HIDPP_FF_SET_GLOBAL_GAINS:
 944                 data->gain = (wd->params[0] << 8) + wd->params[1];
 945                 break;
 946         case HIDPP_FF_SET_APERTURE:
 947                 data->range = (wd->params[0] << 8) + wd->params[1];
 948                 break;
 949         default:
 950                 /* no action needed */
 951                 break;
 952         }
 953
 954 out:
 955         atomic_dec(&data->workqueue_size);
 956         kfree(wd);
 957 }
 958
 959 static int hidpp_ff_queue_work(struct hidpp_ff_private_data *data, int effect_id, u8 command, u8 *params, u8 size)
 960 {
 961         struct hidpp_ff_work_data *wd = kzalloc(sizeof(*wd), GFP_KERNEL);
 962         int s;
 963
 964         if (!wd)
 965                 return -ENOMEM;
 966
 967         INIT_WORK(&wd->work, hidpp_ff_work_handler);
 968
 969         wd->data = data;
 970         wd->effect_id = effect_id;
 971         wd->command = command;
 972         wd->size = size;
 973         memcpy(wd->params, params, size);
 974
 975         atomic_inc(&data->workqueue_size);
 976         queue_work(data->wq, &wd->work);
 977
 978         /* warn about excessive queue size */
 979         s = atomic_read(&data->workqueue_size);
 980         if (s >= 20 && s % 20 == 0)
 981                 hid_warn(data->hidpp->hid_dev, "Force feedback command queue contains %d commands, causing substantial delays!", s);
 982
 983         return 0;
 984 }
 985
 986 static int hidpp_ff_upload_effect(struct input_dev *dev, struct ff_effect *effect, struct ff_effect *old)
 987 {
 988         struct hidpp_ff_private_data *data = dev->ff->private;
 989         u8 params[20];
 990         u8 size;
 991         int force;
 992
 993         /* set common parameters */
 994         params[2] = effect->replay.length >> 8;
 995         params[3] = effect->replay.length & 255;
 996         params[4] = effect->replay.delay >> 8;
 997         params[5] = effect->replay.delay & 255;
 998
 999         switch (effect->type) {
1000         case FF_CONSTANT:
1001                 force = (effect->u.constant.level * fixp_sin16((effect->direction * 360) >> 16)) >> 15;
1002                 params[1] = HIDPP_FF_EFFECT_CONSTANT;
1003                 params[6] = force >> 8;
1004                 params[7] = force & 255;
1005                 params[8] = effect->u.constant.envelope.attack_level >> 7;
1006                 params[9] = effect->u.constant.envelope.attack_length >> 8;
1007                 params[10] = effect->u.constant.envelope.attack_length & 255;
1008                 params[11] = effect->u.constant.envelope.fade_level >> 7;
1009                 params[12] = effect->u.constant.envelope.fade_length >> 8;
1010                 params[13] = effect->u.constant.envelope.fade_length & 255;
1011                 size = 14;
1012                 dbg_hid("Uploading constant force level=%d in dir %d = %d\n",
1013                                 effect->u.constant.level,
1014                                 effect->direction, force);
1015                 dbg_hid("          envelope attack=(%d, %d ms) fade=(%d, %d ms)\n",
1016                                 effect->u.constant.envelope.attack_level,
1017                                 effect->u.constant.envelope.attack_length,
1018                                 effect->u.constant.envelope.fade_level,
1019                                 effect->u.constant.envelope.fade_length);
1020                 break;
1021         case FF_PERIODIC:
1022         {
1023                 switch (effect->u.periodic.waveform) {
1024                 case FF_SINE:
1025                         params[1] = HIDPP_FF_EFFECT_PERIODIC_SINE;
1026                         break;
1027                 case FF_SQUARE:
1028                         params[1] = HIDPP_FF_EFFECT_PERIODIC_SQUARE;
1029                         break;
1030                 case FF_SAW_UP:
1031                         params[1] = HIDPP_FF_EFFECT_PERIODIC_SAWTOOTHUP;
1032                         break;
1033                 case FF_SAW_DOWN:
1034                         params[1] = HIDPP_FF_EFFECT_PERIODIC_SAWTOOTHDOWN;
1035                         break;
1036                 case FF_TRIANGLE:
1037                         params[1] = HIDPP_FF_EFFECT_PERIODIC_TRIANGLE;
1038                         break;
1039                 default:
1040                         hid_err(data->hidpp->hid_dev, "Unexpected periodic waveform type %i!\n", effect->u.periodic.waveform);
1041                         return -EINVAL;
1042                 }
1043                 force = (effect->u.periodic.magnitude * fixp_sin16((effect->direction * 360) >> 16)) >> 15;
1044                 params[6] = effect->u.periodic.magnitude >> 8;
1045                 params[7] = effect->u.periodic.magnitude & 255;
1046                 params[8] = effect->u.periodic.offset >> 8;
1047                 params[9] = effect->u.periodic.offset & 255;
1048                 params[10] = effect->u.periodic.period >> 8;
1049                 params[11] = effect->u.periodic.period & 255;
1050                 params[12] = effect->u.periodic.phase >> 8;
1051                 params[13] = effect->u.periodic.phase & 255;
1052                 params[14] = effect->u.periodic.envelope.attack_level >> 7;
1053                 params[15] = effect->u.periodic.envelope.attack_length >> 8;
1054                 params[16] = effect->u.periodic.envelope.attack_length & 255;
1055                 params[17] = effect->u.periodic.envelope.fade_level >> 7;
1056                 params[18] = effect->u.periodic.envelope.fade_length >> 8;
1057                 params[19] = effect->u.periodic.envelope.fade_length & 255;
1058                 size = 20;
1059                 dbg_hid("Uploading periodic force mag=%d/dir=%d, offset=%d, period=%d ms, phase=%d\n",
1060                                 effect->u.periodic.magnitude, effect->direction,
1061                                 effect->u.periodic.offset,
1062                                 effect->u.periodic.period,
1063                                 effect->u.periodic.phase);
1064                 dbg_hid("          envelope attack=(%d, %d ms) fade=(%d, %d ms)\n",
1065                                 effect->u.periodic.envelope.attack_level,
1066                                 effect->u.periodic.envelope.attack_length,
1067                                 effect->u.periodic.envelope.fade_level,
1068                                 effect->u.periodic.envelope.fade_length);
1069                 break;
1070         }
1071         case FF_RAMP:
1072                 params[1] = HIDPP_FF_EFFECT_RAMP;
1073                 force = (effect->u.ramp.start_level * fixp_sin16((effect->direction * 360) >> 16)) >> 15;
1074                 params[6] = force >> 8;
1075                 params[7] = force & 255;
1076                 force = (effect->u.ramp.end_level * fixp_sin16((effect->direction * 360) >> 16)) >> 15;
1077                 params[8] = force >> 8;
1078                 params[9] = force & 255;
1079                 params[10] = effect->u.ramp.envelope.attack_level >> 7;
1080                 params[11] = effect->u.ramp.envelope.attack_length >> 8;
1081                 params[12] = effect->u.ramp.envelope.attack_length & 255;
1082                 params[13] = effect->u.ramp.envelope.fade_level >> 7;
1083                 params[14] = effect->u.ramp.envelope.fade_length >> 8;
1084                 params[15] = effect->u.ramp.envelope.fade_length & 255;
1085                 size = 16;
1086                 dbg_hid("Uploading ramp force level=%d -> %d in dir %d = %d\n",
1087                                 effect->u.ramp.start_level,
1088                                 effect->u.ramp.end_level,
1089                                 effect->direction, force);
1090                 dbg_hid("          envelope attack=(%d, %d ms) fade=(%d, %d ms)\n",
1091                                 effect->u.ramp.envelope.attack_level,
1092                                 effect->u.ramp.envelope.attack_length,
1093                                 effect->u.ramp.envelope.fade_level,
1094                                 effect->u.ramp.envelope.fade_length);
1095                 break;
1096         case FF_FRICTION:
1097         case FF_INERTIA:
1098         case FF_SPRING:
1099         case FF_DAMPER:
1100                 params[1] = HIDPP_FF_CONDITION_CMDS[effect->type - FF_SPRING];
1101                 params[6] = effect->u.condition[0].left_saturation >> 9;
1102                 params[7] = (effect->u.condition[0].left_saturation >> 1) & 255;
1103                 params[8] = effect->u.condition[0].left_coeff >> 8;
1104                 params[9] = effect->u.condition[0].left_coeff & 255;
1105                 params[10] = effect->u.condition[0].deadband >> 9;
1106                 params[11] = (effect->u.condition[0].deadband >> 1) & 255;
1107                 params[12] = effect->u.condition[0].center >> 8;
1108                 params[13] = effect->u.condition[0].center & 255;
1109                 params[14] = effect->u.condition[0].right_coeff >> 8;
1110                 params[15] = effect->u.condition[0].right_coeff & 255;
1111                 params[16] = effect->u.condition[0].right_saturation >> 9;
1112                 params[17] = (effect->u.condition[0].right_saturation >> 1) & 255;
1113                 size = 18;
1114                 dbg_hid("Uploading %s force left coeff=%d, left sat=%d, right coeff=%d, right sat=%d\n",
1115                                 HIDPP_FF_CONDITION_NAMES[effect->type - FF_SPRING],
1116                                 effect->u.condition[0].left_coeff,
1117                                 effect->u.condition[0].left_saturation,
1118                                 effect->u.condition[0].right_coeff,
1119                                 effect->u.condition[0].right_saturation);
1120                 dbg_hid("          deadband=%d, center=%d\n",
1121                                 effect->u.condition[0].deadband,
1122                                 effect->u.condition[0].center);
1123                 break;
1124         default:
1125                 hid_err(data->hidpp->hid_dev, "Unexpected force type %i!\n", effect->type);
1126                 return -EINVAL;
1127         }
1128
1129         return hidpp_ff_queue_work(data, effect->id, HIDPP_FF_DOWNLOAD_EFFECT, params, size);
1130 }
1131
1132 static int hidpp_ff_playback(struct input_dev *dev, int effect_id, int value)
1133 {
1134         struct hidpp_ff_private_data *data = dev->ff->private;
1135         u8 params[2];
1136
1137         params[1] = value ? HIDPP_FF_EFFECT_STATE_PLAY : HIDPP_FF_EFFECT_STATE_STOP;
1138
1139         dbg_hid("St%sing playback of effect %d.\n", value?"art":"opp", effect_id);
1140
1141         return hidpp_ff_queue_work(data, effect_id, HIDPP_FF_SET_EFFECT_STATE, params, ARRAY_SIZE(params));
1142 }
1143
1144 static int hidpp_ff_erase_effect(struct input_dev *dev, int effect_id)
1145 {
1146         struct hidpp_ff_private_data *data = dev->ff->private;
1147         u8 slot = 0;
1148
1149         dbg_hid("Erasing effect %d.\n", effect_id);
1150
1151         return hidpp_ff_queue_work(data, effect_id, HIDPP_FF_DESTROY_EFFECT, &slot, 1);
1152 }
1153
1154 static void hidpp_ff_set_autocenter(struct input_dev *dev, u16 magnitude)
1155 {
1156         struct hidpp_ff_private_data *data = dev->ff->private;
1157         u8 params[18];
1158
1159         dbg_hid("Setting autocenter to %d.\n", magnitude);
1160
1161         /* start a standard spring effect */
1162         params[1] = HIDPP_FF_EFFECT_SPRING | HIDPP_FF_EFFECT_AUTOSTART;
1163         /* zero delay and duration */
1164         params[2] = params[3] = params[4] = params[5] = 0;
1165         /* set coeff to 25% of saturation */
1166         params[8] = params[14] = magnitude >> 11;
1167         params[9] = params[15] = (magnitude >> 3) & 255;
1168         params[6] = params[16] = magnitude >> 9;
1169         params[7] = params[17] = (magnitude >> 1) & 255;
1170         /* zero deadband and center */
1171         params[10] = params[11] = params[12] = params[13] = 0;
1172
1173         hidpp_ff_queue_work(data, HIDPP_FF_EFFECTID_AUTOCENTER, HIDPP_FF_DOWNLOAD_EFFECT, params, ARRAY_SIZE(params));
1174 }
1175
1176 static void hidpp_ff_set_gain(struct input_dev *dev, u16 gain)
1177 {
1178         struct hidpp_ff_private_data *data = dev->ff->private;
1179         u8 params[4];
1180
1181         dbg_hid("Setting gain to %d.\n", gain);
1182
1183         params[0] = gain >> 8;
1184         params[1] = gain & 255;
1185         params[2] = 0; /* no boost */
1186         params[3] = 0;
1187
1188         hidpp_ff_queue_work(data, HIDPP_FF_EFFECTID_NONE, HIDPP_FF_SET_GLOBAL_GAINS, params, ARRAY_SIZE(params));
1189 }
1190
1191 static ssize_t hidpp_ff_range_show(struct device *dev, struct device_attribute *attr, char *buf)
1192 {
1193         struct hid_device *hid = to_hid_device(dev);
1194         struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
1195         struct input_dev *idev = hidinput->input;
1196         struct hidpp_ff_private_data *data = idev->ff->private;
1197
1198         return scnprintf(buf, PAGE_SIZE, "%u\n", data->range);
1199 }
1200
1201 static ssize_t hidpp_ff_range_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
1202 {
1203         struct hid_device *hid = to_hid_device(dev);
1204         struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
1205         struct input_dev *idev = hidinput->input;
1206         struct hidpp_ff_private_data *data = idev->ff->private;
1207         u8 params[2];
1208         int range = simple_strtoul(buf, NULL, 10);
1209
1210         range = clamp(range, 180, 900);
1211
1212         params[0] = range >> 8;
1213         params[1] = range & 0x00FF;
1214
1215         hidpp_ff_queue_work(data, -1, HIDPP_FF_SET_APERTURE, params, ARRAY_SIZE(params));
1216
1217         return count;
1218 }
1219
1220 static DEVICE_ATTR(range, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH, hidpp_ff_range_show, hidpp_ff_range_store);
1221
1222 static void hidpp_ff_destroy(struct ff_device *ff)
1223 {
1224         struct hidpp_ff_private_data *data = ff->private;
1225
1226         kfree(data->effect_ids);
1227 }
1228
1229 static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
1230 {
1231         struct hid_device *hid = hidpp->hid_dev;
1232         struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
1233         struct input_dev *dev = hidinput->input;
1234         const struct usb_device_descriptor *udesc = &(hid_to_usb_dev(hid)->descriptor);
1235         const u16 bcdDevice = le16_to_cpu(udesc->bcdDevice);
1236         struct ff_device *ff;
1237         struct hidpp_report response;
1238         struct hidpp_ff_private_data *data;
1239         int error, j, num_slots;
1240         u8 version;
1241
1242         if (!dev) {
1243                 hid_err(hid, "Struct input_dev not set!\n");
1244                 return -EINVAL;
1245         }
1246
1247         /* Get firmware release */
1248         version = bcdDevice & 255;
1249
1250         /* Set supported force feedback capabilities */
1251         for (j = 0; hiddpp_ff_effects[j] >= 0; j++)
1252                 set_bit(hiddpp_ff_effects[j], dev->ffbit);
1253         if (version > 1)
1254                 for (j = 0; hiddpp_ff_effects_v2[j] >= 0; j++)
1255                         set_bit(hiddpp_ff_effects_v2[j], dev->ffbit);
1256
1257         /* Read number of slots available in device */
1258         error = hidpp_send_fap_command_sync(hidpp, feature_index,
1259                 HIDPP_FF_GET_INFO, NULL, 0, &response);
1260         if (error) {
1261                 if (error < 0)
1262                         return error;
1263                 hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
1264                         __func__, error);
1265                 return -EPROTO;
1266         }
1267
1268         num_slots = response.fap.params[0] - HIDPP_FF_RESERVED_SLOTS;
1269
1270         error = input_ff_create(dev, num_slots);
1271
1272         if (error) {
1273                 hid_err(dev, "Failed to create FF device!\n");
1274                 return error;
1275         }
1276
1277         data = kzalloc(sizeof(*data), GFP_KERNEL);
1278         if (!data)
1279                 return -ENOMEM;
1280         data->effect_ids = kcalloc(num_slots, sizeof(int), GFP_KERNEL);
1281         if (!data->effect_ids) {
1282                 kfree(data);
1283                 return -ENOMEM;
1284         }
1285         data->hidpp = hidpp;
1286         data->feature_index = feature_index;
1287         data->version = version;
1288         data->slot_autocenter = 0;
1289         data->num_effects = num_slots;
1290         for (j = 0; j < num_slots; j++)
1291                 data->effect_ids[j] = -1;
1292
1293         ff = dev->ff;
1294         ff->private = data;
1295
1296         ff->upload = hidpp_ff_upload_effect;
1297         ff->erase = hidpp_ff_erase_effect;
1298         ff->playback = hidpp_ff_playback;
1299         ff->set_gain = hidpp_ff_set_gain;
1300         ff->set_autocenter = hidpp_ff_set_autocenter;
1301         ff->destroy = hidpp_ff_destroy;
1302
1303
1304         /* reset all forces */
1305         error = hidpp_send_fap_command_sync(hidpp, feature_index,
1306                 HIDPP_FF_RESET_ALL, NULL, 0, &response);
1307
1308         /* Read current Range */
1309         error = hidpp_send_fap_command_sync(hidpp, feature_index,
1310                 HIDPP_FF_GET_APERTURE, NULL, 0, &response);
1311         if (error)
1312                 hid_warn(hidpp->hid_dev, "Failed to read range from device!\n");
1313         data->range = error ? 900 : get_unaligned_be16(&response.fap.params[0]);
1314
1315         /* Create sysfs interface */
1316         error = device_create_file(&(hidpp->hid_dev->dev), &dev_attr_range);
1317         if (error)
1318                 hid_warn(hidpp->hid_dev, "Unable to create sysfs interface for \"range\", errno %d!\n", error);
1319
1320         /* Read the current gain values */
1321         error = hidpp_send_fap_command_sync(hidpp, feature_index,
1322                 HIDPP_FF_GET_GLOBAL_GAINS, NULL, 0, &response);
1323         if (error)
1324                 hid_warn(hidpp->hid_dev, "Failed to read gain values from device!\n");
1325         data->gain = error ? 0xffff : get_unaligned_be16(&response.fap.params[0]);
1326         /* ignore boost value at response.fap.params[2] */
1327
1328         /* init the hardware command queue */
1329         data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue");
1330         atomic_set(&data->workqueue_size, 0);
1331
1332         /* initialize with zero autocenter to get wheel in usable state */
1333         hidpp_ff_set_autocenter(dev, 0);
1334
1335         hid_info(hid, "Force feeback support loaded (firmware release %d).\n", version);
1336
1337         return 0;
1338 }
1339
1340 static int hidpp_ff_deinit(struct hid_device *hid)
1341 {
1342         struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
1343         struct input_dev *dev = hidinput->input;
1344         struct hidpp_ff_private_data *data;
1345
1346         if (!dev) {
1347                 hid_err(hid, "Struct input_dev not found!\n");
1348                 return -EINVAL;
1349         }
1350
1351         hid_info(hid, "Unloading HID++ force feedback.\n");
1352         data = dev->ff->private;
1353         if (!data) {
1354                 hid_err(hid, "Private data not found!\n");
1355                 return -EINVAL;
1356         }
1357
1358         destroy_workqueue(data->wq);
1359         device_remove_file(&hid->dev, &dev_attr_range);
1360
1361         return 0;
1362 }
1363
1364
1365 /* ************************************************************************** */
1366 /*                                                                            */
1367 /* Device Support                                                             */
1368 /*                                                                            */
1369 /* ************************************************************************** */
1370
1371 /* -------------------------------------------------------------------------- */
1372 /* Touchpad HID++ devices                                                     */
1373 /* -------------------------------------------------------------------------- */
1374
1375 #define WTP_MANUAL_RESOLUTION                           39
1376
1377 struct wtp_data {
1378         struct input_dev *input;
1379         u16 x_size, y_size;
1380         u8 finger_count;
1381         u8 mt_feature_index;
1382         u8 button_feature_index;
1383         u8 maxcontacts;
1384         bool flip_y;
1385         unsigned int resolution;
1386 };
1387
1388 static int wtp_input_mapping(struct hid_device *hdev, struct hid_input *hi,
1389                 struct hid_field *field, struct hid_usage *usage,
1390                 unsigned long **bit, int *max)
1391 {
1392         return -1;
1393 }
1394
1395 static void wtp_populate_input(struct hidpp_device *hidpp,
1396                 struct input_dev *input_dev, bool origin_is_hid_core)
1397 {
1398         struct wtp_data *wd = hidpp->private_data;
1399
1400         __set_bit(EV_ABS, input_dev->evbit);
1401         __set_bit(EV_KEY, input_dev->evbit);
1402         __clear_bit(EV_REL, input_dev->evbit);
1403         __clear_bit(EV_LED, input_dev->evbit);
1404
1405         input_set_abs_params(input_dev, ABS_MT_POSITION_X, 0, wd->x_size, 0, 0);
1406         input_abs_set_res(input_dev, ABS_MT_POSITION_X, wd->resolution);
1407         input_set_abs_params(input_dev, ABS_MT_POSITION_Y, 0, wd->y_size, 0, 0);
1408         input_abs_set_res(input_dev, ABS_MT_POSITION_Y, wd->resolution);
1409
1410         /* Max pressure is not given by the devices, pick one */
1411         input_set_abs_params(input_dev, ABS_MT_PRESSURE, 0, 50, 0, 0);
1412
1413         input_set_capability(input_dev, EV_KEY, BTN_LEFT);
1414
1415         if (hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS)
1416                 input_set_capability(input_dev, EV_KEY, BTN_RIGHT);
1417         else
1418                 __set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
1419
1420         input_mt_init_slots(input_dev, wd->maxcontacts, INPUT_MT_POINTER |
1421                 INPUT_MT_DROP_UNUSED);
1422
1423         wd->input = input_dev;
1424 }
1425
1426 static void wtp_touch_event(struct wtp_data *wd,
1427         struct hidpp_touchpad_raw_xy_finger *touch_report)
1428 {
1429         int slot;
1430
1431         if (!touch_report->finger_id || touch_report->contact_type)
1432                 /* no actual data */
1433                 return;
1434
1435         slot = input_mt_get_slot_by_key(wd->input, touch_report->finger_id);
1436
1437         input_mt_slot(wd->input, slot);
1438         input_mt_report_slot_state(wd->input, MT_TOOL_FINGER,
1439                                         touch_report->contact_status);
1440         if (touch_report->contact_status) {
1441                 input_event(wd->input, EV_ABS, ABS_MT_POSITION_X,
1442                                 touch_report->x);
1443                 input_event(wd->input, EV_ABS, ABS_MT_POSITION_Y,
1444                                 wd->flip_y ? wd->y_size - touch_report->y :
1445                                              touch_report->y);
1446                 input_event(wd->input, EV_ABS, ABS_MT_PRESSURE,
1447                                 touch_report->area);
1448         }
1449 }
1450
1451 static void wtp_send_raw_xy_event(struct hidpp_device *hidpp,
1452                 struct hidpp_touchpad_raw_xy *raw)
1453 {
1454         struct wtp_data *wd = hidpp->private_data;
1455         int i;
1456
1457         for (i = 0; i < 2; i++)
1458                 wtp_touch_event(wd, &(raw->fingers[i]));
1459
1460         if (raw->end_of_frame &&
1461             !(hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS))
1462                 input_event(wd->input, EV_KEY, BTN_LEFT, raw->button);
1463
1464         if (raw->end_of_frame || raw->finger_count <= 2) {
1465                 input_mt_sync_frame(wd->input);
1466                 input_sync(wd->input);
1467         }
1468 }
1469
1470 static int wtp_mouse_raw_xy_event(struct hidpp_device *hidpp, u8 *data)
1471 {
1472         struct wtp_data *wd = hidpp->private_data;
1473         u8 c1_area = ((data[7] & 0xf) * (data[7] & 0xf) +
1474                       (data[7] >> 4) * (data[7] >> 4)) / 2;
1475         u8 c2_area = ((data[13] & 0xf) * (data[13] & 0xf) +
1476                       (data[13] >> 4) * (data[13] >> 4)) / 2;
1477         struct hidpp_touchpad_raw_xy raw = {
1478                 .timestamp = data[1],
1479                 .fingers = {
1480                         {
1481                                 .contact_type = 0,
1482                                 .contact_status = !!data[7],
1483                                 .x = get_unaligned_le16(&data[3]),
1484                                 .y = get_unaligned_le16(&data[5]),
1485                                 .z = c1_area,
1486                                 .area = c1_area,
1487                                 .finger_id = data[2],
1488                         }, {
1489                                 .contact_type = 0,
1490                                 .contact_status = !!data[13],
1491                                 .x = get_unaligned_le16(&data[9]),
1492                                 .y = get_unaligned_le16(&data[11]),
1493                                 .z = c2_area,
1494                                 .area = c2_area,
1495                                 .finger_id = data[8],
1496                         }
1497                 },
1498                 .finger_count = wd->maxcontacts,
1499                 .spurious_flag = 0,
1500                 .end_of_frame = (data[0] >> 7) == 0,
1501                 .button = data[0] & 0x01,
1502         };
1503
1504         wtp_send_raw_xy_event(hidpp, &raw);
1505
1506         return 1;
1507 }
1508
1509 static int wtp_raw_event(struct hid_device *hdev, u8 *data, int size)
1510 {
1511         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1512         struct wtp_data *wd = hidpp->private_data;
1513         struct hidpp_report *report = (struct hidpp_report *)data;
1514         struct hidpp_touchpad_raw_xy raw;
1515
1516         if (!wd || !wd->input)
1517                 return 1;
1518
1519         switch (data[0]) {
1520         case 0x02:
1521                 if (size < 2) {
1522                         hid_err(hdev, "Received HID report of bad size (%d)",
1523                                 size);
1524                         return 1;
1525                 }
1526                 if (hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS) {
1527                         input_event(wd->input, EV_KEY, BTN_LEFT,
1528                                         !!(data[1] & 0x01));
1529                         input_event(wd->input, EV_KEY, BTN_RIGHT,
1530                                         !!(data[1] & 0x02));
1531                         input_sync(wd->input);
1532                         return 0;
1533                 } else {
1534                         if (size < 21)
1535                                 return 1;
1536                         return wtp_mouse_raw_xy_event(hidpp, &data[7]);
1537                 }
1538         case REPORT_ID_HIDPP_LONG:
1539                 /* size is already checked in hidpp_raw_event. */
1540                 if ((report->fap.feature_index != wd->mt_feature_index) ||
1541                     (report->fap.funcindex_clientid != EVENT_TOUCHPAD_RAW_XY))
1542                         return 1;
1543                 hidpp_touchpad_raw_xy_event(hidpp, data + 4, &raw);
1544
1545                 wtp_send_raw_xy_event(hidpp, &raw);
1546                 return 0;
1547         }
1548
1549         return 0;
1550 }
1551
1552 static int wtp_get_config(struct hidpp_device *hidpp)
1553 {
1554         struct wtp_data *wd = hidpp->private_data;
1555         struct hidpp_touchpad_raw_info raw_info = {0};
1556         u8 feature_type;
1557         int ret;
1558
1559         ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_TOUCHPAD_RAW_XY,
1560                 &wd->mt_feature_index, &feature_type);
1561         if (ret)
1562                 /* means that the device is not powered up */
1563                 return ret;
1564
1565         ret = hidpp_touchpad_get_raw_info(hidpp, wd->mt_feature_index,
1566                 &raw_info);
1567         if (ret)
1568                 return ret;
1569
1570         wd->x_size = raw_info.x_size;
1571         wd->y_size = raw_info.y_size;
1572         wd->maxcontacts = raw_info.maxcontacts;
1573         wd->flip_y = raw_info.origin == TOUCHPAD_RAW_XY_ORIGIN_LOWER_LEFT;
1574         wd->resolution = raw_info.res;
1575         if (!wd->resolution)
1576                 wd->resolution = WTP_MANUAL_RESOLUTION;
1577
1578         return 0;
1579 }
1580
1581 static int wtp_allocate(struct hid_device *hdev, const struct hid_device_id *id)
1582 {
1583         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1584         struct wtp_data *wd;
1585
1586         wd = devm_kzalloc(&hdev->dev, sizeof(struct wtp_data),
1587                         GFP_KERNEL);
1588         if (!wd)
1589                 return -ENOMEM;
1590
1591         hidpp->private_data = wd;
1592
1593         return 0;
1594 };
1595
1596 static int wtp_connect(struct hid_device *hdev, bool connected)
1597 {
1598         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1599         struct wtp_data *wd = hidpp->private_data;
1600         int ret;
1601
1602         if (!connected)
1603                 return 0;
1604
1605         if (!wd->x_size) {
1606                 ret = wtp_get_config(hidpp);
1607                 if (ret) {
1608                         hid_err(hdev, "Can not get wtp config: %d\n", ret);
1609                         return ret;
1610                 }
1611         }
1612
1613         return hidpp_touchpad_set_raw_report_state(hidpp, wd->mt_feature_index,
1614                         true, true);
1615 }
1616
1617 /* ------------------------------------------------------------------------- */
1618 /* Logitech M560 devices                                                     */
1619 /* ------------------------------------------------------------------------- */
1620
1621 /*
1622  * Logitech M560 protocol overview
1623  *
1624  * The Logitech M560 mouse, is designed for windows 8. When the middle and/or
1625  * the sides buttons are pressed, it sends some keyboard keys events
1626  * instead of buttons ones.
1627  * To complicate things further, the middle button keys sequence
1628  * is different from the odd press and the even press.
1629  *
1630  * forward button -> Super_R
1631  * backward button -> Super_L+'d' (press only)
1632  * middle button -> 1st time: Alt_L+SuperL+XF86TouchpadOff (press only)
1633  *                  2nd time: left-click (press only)
1634  * NB: press-only means that when the button is pressed, the
1635  * KeyPress/ButtonPress and KeyRelease/ButtonRelease events are generated
1636  * together sequentially; instead when the button is released, no event is
1637  * generated !
1638  *
1639  * With the command
1640  *      10<xx>0a 3500af03 (where <xx> is the mouse id),
1641  * the mouse reacts differently:
1642  * - it never sends a keyboard key event
1643  * - for the three mouse button it sends:
1644  *      middle button               press   11<xx>0a 3500af00...
1645  *      side 1 button (forward)     press   11<xx>0a 3500b000...
1646  *      side 2 button (backward)    press   11<xx>0a 3500ae00...
1647  *      middle/side1/side2 button   release 11<xx>0a 35000000...
1648  */
1649
1650 static const u8 m560_config_parameter[] = {0x00, 0xaf, 0x03};
1651
1652 struct m560_private_data {
1653         struct input_dev *input;
1654 };
1655
1656 /* how buttons are mapped in the report */
1657 #define M560_MOUSE_BTN_LEFT             0x01
1658 #define M560_MOUSE_BTN_RIGHT            0x02
1659 #define M560_MOUSE_BTN_WHEEL_LEFT       0x08
1660 #define M560_MOUSE_BTN_WHEEL_RIGHT      0x10
1661
1662 #define M560_SUB_ID                     0x0a
1663 #define M560_BUTTON_MODE_REGISTER       0x35
1664
1665 static int m560_send_config_command(struct hid_device *hdev, bool connected)
1666 {
1667         struct hidpp_report response;
1668         struct hidpp_device *hidpp_dev;
1669
1670         hidpp_dev = hid_get_drvdata(hdev);
1671
1672         if (!connected)
1673                 return -ENODEV;
1674
1675         return hidpp_send_rap_command_sync(
1676                 hidpp_dev,
1677                 REPORT_ID_HIDPP_SHORT,
1678                 M560_SUB_ID,
1679                 M560_BUTTON_MODE_REGISTER,
1680                 (u8 *)m560_config_parameter,
1681                 sizeof(m560_config_parameter),
1682                 &response
1683         );
1684 }
1685
1686 static int m560_allocate(struct hid_device *hdev)
1687 {
1688         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1689         struct m560_private_data *d;
1690
1691         d = devm_kzalloc(&hdev->dev, sizeof(struct m560_private_data),
1692                         GFP_KERNEL);
1693         if (!d)
1694                 return -ENOMEM;
1695
1696         hidpp->private_data = d;
1697
1698         return 0;
1699 };
1700
1701 static int m560_raw_event(struct hid_device *hdev, u8 *data, int size)
1702 {
1703         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1704         struct m560_private_data *mydata = hidpp->private_data;
1705
1706         /* sanity check */
1707         if (!mydata || !mydata->input) {
1708                 hid_err(hdev, "error in parameter\n");
1709                 return -EINVAL;
1710         }
1711
1712         if (size < 7) {
1713                 hid_err(hdev, "error in report\n");
1714                 return 0;
1715         }
1716
1717         if (data[0] == REPORT_ID_HIDPP_LONG &&
1718             data[2] == M560_SUB_ID && data[6] == 0x00) {
1719                 /*
1720                  * m560 mouse report for middle, forward and backward button
1721                  *
1722                  * data[0] = 0x11
1723                  * data[1] = device-id
1724                  * data[2] = 0x0a
1725                  * data[5] = 0xaf -> middle
1726                  *           0xb0 -> forward
1727                  *           0xae -> backward
1728                  *           0x00 -> release all
1729                  * data[6] = 0x00
1730                  */
1731
1732                 switch (data[5]) {
1733                 case 0xaf:
1734                         input_report_key(mydata->input, BTN_MIDDLE, 1);
1735                         break;
1736                 case 0xb0:
1737                         input_report_key(mydata->input, BTN_FORWARD, 1);
1738                         break;
1739                 case 0xae:
1740                         input_report_key(mydata->input, BTN_BACK, 1);
1741                         break;
1742                 case 0x00:
1743                         input_report_key(mydata->input, BTN_BACK, 0);
1744                         input_report_key(mydata->input, BTN_FORWARD, 0);
1745                         input_report_key(mydata->input, BTN_MIDDLE, 0);
1746                         break;
1747                 default:
1748                         hid_err(hdev, "error in report\n");
1749                         return 0;
1750                 }
1751                 input_sync(mydata->input);
1752
1753         } else if (data[0] == 0x02) {
1754                 /*
1755                  * Logitech M560 mouse report
1756                  *
1757                  * data[0] = type (0x02)
1758                  * data[1..2] = buttons
1759                  * data[3..5] = xy
1760                  * data[6] = wheel
1761                  */
1762
1763                 int v;
1764
1765                 input_report_key(mydata->input, BTN_LEFT,
1766                         !!(data[1] & M560_MOUSE_BTN_LEFT));
1767                 input_report_key(mydata->input, BTN_RIGHT,
1768                         !!(data[1] & M560_MOUSE_BTN_RIGHT));
1769
1770                 if (data[1] & M560_MOUSE_BTN_WHEEL_LEFT)
1771                         input_report_rel(mydata->input, REL_HWHEEL, -1);
1772                 else if (data[1] & M560_MOUSE_BTN_WHEEL_RIGHT)
1773                         input_report_rel(mydata->input, REL_HWHEEL, 1);
1774
1775                 v = hid_snto32(hid_field_extract(hdev, data+3, 0, 12), 12);
1776                 input_report_rel(mydata->input, REL_X, v);
1777
1778                 v = hid_snto32(hid_field_extract(hdev, data+3, 12, 12), 12);
1779                 input_report_rel(mydata->input, REL_Y, v);
1780
1781                 v = hid_snto32(data[6], 8);
1782                 input_report_rel(mydata->input, REL_WHEEL, v);
1783
1784                 input_sync(mydata->input);
1785         }
1786
1787         return 1;
1788 }
1789
1790 static void m560_populate_input(struct hidpp_device *hidpp,
1791                 struct input_dev *input_dev, bool origin_is_hid_core)
1792 {
1793         struct m560_private_data *mydata = hidpp->private_data;
1794
1795         mydata->input = input_dev;
1796
1797         __set_bit(EV_KEY, mydata->input->evbit);
1798         __set_bit(BTN_MIDDLE, mydata->input->keybit);
1799         __set_bit(BTN_RIGHT, mydata->input->keybit);
1800         __set_bit(BTN_LEFT, mydata->input->keybit);
1801         __set_bit(BTN_BACK, mydata->input->keybit);
1802         __set_bit(BTN_FORWARD, mydata->input->keybit);
1803
1804         __set_bit(EV_REL, mydata->input->evbit);
1805         __set_bit(REL_X, mydata->input->relbit);
1806         __set_bit(REL_Y, mydata->input->relbit);
1807         __set_bit(REL_WHEEL, mydata->input->relbit);
1808         __set_bit(REL_HWHEEL, mydata->input->relbit);
1809 }
1810
1811 static int m560_input_mapping(struct hid_device *hdev, struct hid_input *hi,
1812                 struct hid_field *field, struct hid_usage *usage,
1813                 unsigned long **bit, int *max)
1814 {
1815         return -1;
1816 }
1817
1818 /* ------------------------------------------------------------------------- */
1819 /* Logitech K400 devices                                                     */
1820 /* ------------------------------------------------------------------------- */
1821
1822 /*
1823  * The Logitech K400 keyboard has an embedded touchpad which is seen
1824  * as a mouse from the OS point of view. There is a hardware shortcut to disable
1825  * tap-to-click but the setting is not remembered accross reset, annoying some
1826  * users.
1827  *
1828  * We can toggle this feature from the host by using the feature 0x6010:
1829  * Touchpad FW items
1830  */
1831
1832 struct k400_private_data {
1833         u8 feature_index;
1834 };
1835
1836 static int k400_disable_tap_to_click(struct hidpp_device *hidpp)
1837 {
1838         struct k400_private_data *k400 = hidpp->private_data;
1839         struct hidpp_touchpad_fw_items items = {};
1840         int ret;
1841         u8 feature_type;
1842
1843         if (!k400->feature_index) {
1844                 ret = hidpp_root_get_feature(hidpp,
1845                         HIDPP_PAGE_TOUCHPAD_FW_ITEMS,
1846                         &k400->feature_index, &feature_type);
1847                 if (ret)
1848                         /* means that the device is not powered up */
1849                         return ret;
1850         }
1851
1852         ret = hidpp_touchpad_fw_items_set(hidpp, k400->feature_index, &items);
1853         if (ret)
1854                 return ret;
1855
1856         return 0;
1857 }
1858
1859 static int k400_allocate(struct hid_device *hdev)
1860 {
1861         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1862         struct k400_private_data *k400;
1863
1864         k400 = devm_kzalloc(&hdev->dev, sizeof(struct k400_private_data),
1865                             GFP_KERNEL);
1866         if (!k400)
1867                 return -ENOMEM;
1868
1869         hidpp->private_data = k400;
1870
1871         return 0;
1872 };
1873
1874 static int k400_connect(struct hid_device *hdev, bool connected)
1875 {
1876         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1877
1878         if (!connected)
1879                 return 0;
1880
1881         if (!disable_tap_to_click)
1882                 return 0;
1883
1884         return k400_disable_tap_to_click(hidpp);
1885 }
1886
1887 /* ------------------------------------------------------------------------- */
1888 /* Logitech G920 Driving Force Racing Wheel for Xbox One                     */
1889 /* ------------------------------------------------------------------------- */
1890
1891 #define HIDPP_PAGE_G920_FORCE_FEEDBACK                  0x8123
1892
1893 static int g920_get_config(struct hidpp_device *hidpp)
1894 {
1895         u8 feature_type;
1896         u8 feature_index;
1897         int ret;
1898
1899         /* Find feature and store for later use */
1900         ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_G920_FORCE_FEEDBACK,
1901                 &feature_index, &feature_type);
1902         if (ret)
1903                 return ret;
1904
1905         ret = hidpp_ff_init(hidpp, feature_index);
1906         if (ret)
1907                 hid_warn(hidpp->hid_dev, "Unable to initialize force feedback support, errno %d\n",
1908                                 ret);
1909
1910         return 0;
1911 }
1912
1913 /* -------------------------------------------------------------------------- */
1914 /* Generic HID++ devices                                                      */
1915 /* -------------------------------------------------------------------------- */
1916
1917 static int hidpp_input_mapping(struct hid_device *hdev, struct hid_input *hi,
1918                 struct hid_field *field, struct hid_usage *usage,
1919                 unsigned long **bit, int *max)
1920 {
1921         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1922
1923         if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
1924                 return wtp_input_mapping(hdev, hi, field, usage, bit, max);
1925         else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560 &&
1926                         field->application != HID_GD_MOUSE)
1927                 return m560_input_mapping(hdev, hi, field, usage, bit, max);
1928
1929         return 0;
1930 }
1931
1932 static int hidpp_input_mapped(struct hid_device *hdev, struct hid_input *hi,
1933                 struct hid_field *field, struct hid_usage *usage,
1934                 unsigned long **bit, int *max)
1935 {
1936         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1937
1938         /* Ensure that Logitech G920 is not given a default fuzz/flat value */
1939         if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {
1940                 if (usage->type == EV_ABS && (usage->code == ABS_X ||
1941                                 usage->code == ABS_Y || usage->code == ABS_Z ||
1942                                 usage->code == ABS_RZ)) {
1943                         field->application = HID_GD_MULTIAXIS;
1944                 }
1945         }
1946
1947         return 0;
1948 }
1949
1950
1951 static void hidpp_populate_input(struct hidpp_device *hidpp,
1952                 struct input_dev *input, bool origin_is_hid_core)
1953 {
1954         if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
1955                 wtp_populate_input(hidpp, input, origin_is_hid_core);
1956         else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560)
1957                 m560_populate_input(hidpp, input, origin_is_hid_core);
1958 }
1959
1960 static int hidpp_input_configured(struct hid_device *hdev,
1961                                 struct hid_input *hidinput)
1962 {
1963         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1964         struct input_dev *input = hidinput->input;
1965
1966         hidpp_populate_input(hidpp, input, true);
1967
1968         return 0;
1969 }
1970
1971 static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,
1972                 int size)
1973 {
1974         struct hidpp_report *question = hidpp->send_receive_buf;
1975         struct hidpp_report *answer = hidpp->send_receive_buf;
1976         struct hidpp_report *report = (struct hidpp_report *)data;
1977
1978         /*
1979          * If the mutex is locked then we have a pending answer from a
1980          * previously sent command.
1981          */
1982         if (unlikely(mutex_is_locked(&hidpp->send_mutex))) {
1983                 /*
1984                  * Check for a correct hidpp20 answer or the corresponding
1985                  * error
1986                  */
1987                 if (hidpp_match_answer(question, report) ||
1988                                 hidpp_match_error(question, report)) {
1989                         *answer = *report;
1990                         hidpp->answer_available = true;
1991                         wake_up(&hidpp->wait);
1992                         /*
1993                          * This was an answer to a command that this driver sent
1994                          * We return 1 to hid-core to avoid forwarding the
1995                          * command upstream as it has been treated by the driver
1996                          */
1997
1998                         return 1;
1999                 }
2000         }
2001
2002         if (unlikely(hidpp_report_is_connect_event(report))) {
2003                 atomic_set(&hidpp->connected,
2004                                 !(report->rap.params[0] & (1 << 6)));
2005                 if ((hidpp->quirks & HIDPP_QUIRK_CONNECT_EVENTS) &&
2006                     (schedule_work(&hidpp->work) == 0))
2007                         dbg_hid("%s: connect event already queued\n", __func__);
2008                 return 1;
2009         }
2010
2011         return 0;
2012 }
2013
2014 static int hidpp_raw_event(struct hid_device *hdev, struct hid_report *report,
2015                 u8 *data, int size)
2016 {
2017         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
2018         int ret = 0;
2019
2020         /* Generic HID++ processing. */
2021         switch (data[0]) {
2022         case REPORT_ID_HIDPP_VERY_LONG:
2023                 if (size != HIDPP_REPORT_VERY_LONG_LENGTH) {
2024                         hid_err(hdev, "received hid++ report of bad size (%d)",
2025                                 size);
2026                         return 1;
2027                 }
2028                 ret = hidpp_raw_hidpp_event(hidpp, data, size);
2029                 break;
2030         case REPORT_ID_HIDPP_LONG:
2031                 if (size != HIDPP_REPORT_LONG_LENGTH) {
2032                         hid_err(hdev, "received hid++ report of bad size (%d)",
2033                                 size);
2034                         return 1;
2035                 }
2036                 ret = hidpp_raw_hidpp_event(hidpp, data, size);
2037                 break;
2038         case REPORT_ID_HIDPP_SHORT:
2039                 if (size != HIDPP_REPORT_SHORT_LENGTH) {
2040                         hid_err(hdev, "received hid++ report of bad size (%d)",
2041                                 size);
2042                         return 1;
2043                 }
2044                 ret = hidpp_raw_hidpp_event(hidpp, data, size);
2045                 break;
2046         }
2047
2048         /* If no report is available for further processing, skip calling
2049          * raw_event of subclasses. */
2050         if (ret != 0)
2051                 return ret;
2052
2053         if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
2054                 return wtp_raw_event(hdev, data, size);
2055         else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560)
2056                 return m560_raw_event(hdev, data, size);
2057
2058         return 0;
2059 }
2060
2061 static void hidpp_overwrite_name(struct hid_device *hdev, bool use_unifying)
2062 {
2063         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
2064         char *name;
2065
2066         if (use_unifying)
2067                 /*
2068                  * the device is connected through an Unifying receiver, and
2069                  * might not be already connected.
2070                  * Ask the receiver for its name.
2071                  */
2072                 name = hidpp_get_unifying_name(hidpp);
2073         else
2074                 name = hidpp_get_device_name(hidpp);
2075
2076         if (!name) {
2077                 hid_err(hdev, "unable to retrieve the name of the device");
2078         } else {
2079                 dbg_hid("HID++: Got name: %s\n", name);
2080                 snprintf(hdev->name, sizeof(hdev->name), "%s", name);
2081         }
2082
2083         kfree(name);
2084 }
2085
2086 static int hidpp_input_open(struct input_dev *dev)
2087 {
2088         struct hid_device *hid = input_get_drvdata(dev);
2089
2090         return hid_hw_open(hid);
2091 }
2092
2093 static void hidpp_input_close(struct input_dev *dev)
2094 {
2095         struct hid_device *hid = input_get_drvdata(dev);
2096
2097         hid_hw_close(hid);
2098 }
2099
2100 static struct input_dev *hidpp_allocate_input(struct hid_device *hdev)
2101 {
2102         struct input_dev *input_dev = devm_input_allocate_device(&hdev->dev);
2103         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
2104
2105         if (!input_dev)
2106                 return NULL;
2107
2108         input_set_drvdata(input_dev, hdev);
2109         input_dev->open = hidpp_input_open;
2110         input_dev->close = hidpp_input_close;
2111
2112         input_dev->name = hidpp->name;
2113         input_dev->phys = hdev->phys;
2114         input_dev->uniq = hdev->uniq;
2115         input_dev->id.bustype = hdev->bus;
2116         input_dev->id.vendor  = hdev->vendor;
2117         input_dev->id.product = hdev->product;
2118         input_dev->id.version = hdev->version;
2119         input_dev->dev.parent = &hdev->dev;
2120
2121         return input_dev;
2122 }
2123
2124 static void hidpp_connect_event(struct hidpp_device *hidpp)
2125 {
2126         struct hid_device *hdev = hidpp->hid_dev;
2127         int ret = 0;
2128         bool connected = atomic_read(&hidpp->connected);
2129         struct input_dev *input;
2130         char *name, *devm_name;
2131
2132         if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {
2133                 ret = wtp_connect(hdev, connected);
2134                 if (ret)
2135                         return;
2136         } else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560) {
2137                 ret = m560_send_config_command(hdev, connected);
2138                 if (ret)
2139                         return;
2140         } else if (hidpp->quirks & HIDPP_QUIRK_CLASS_K400) {
2141                 ret = k400_connect(hdev, connected);
2142                 if (ret)
2143                         return;
2144         }
2145
2146         if (!connected || hidpp->delayed_input)
2147                 return;
2148
2149         /* the device is already connected, we can ask for its name and
2150          * protocol */
2151         if (!hidpp->protocol_major) {
2152                 ret = !hidpp_is_connected(hidpp);
2153                 if (ret) {
2154                         hid_err(hdev, "Can not get the protocol version.\n");
2155                         return;
2156                 }
2157                 hid_info(hdev, "HID++ %u.%u device connected.\n",
2158                          hidpp->protocol_major, hidpp->protocol_minor);
2159         }
2160
2161         if (!(hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT))
2162                 /* if HID created the input nodes for us, we can stop now */
2163                 return;
2164
2165         if (!hidpp->name || hidpp->name == hdev->name) {
2166                 name = hidpp_get_device_name(hidpp);
2167                 if (!name) {
2168                         hid_err(hdev,
2169                                 "unable to retrieve the name of the device");
2170                         return;
2171                 }
2172
2173                 devm_name = devm_kasprintf(&hdev->dev, GFP_KERNEL, "%s", name);
2174                 kfree(name);
2175                 if (!devm_name)
2176                         return;
2177
2178                 hidpp->name = devm_name;
2179         }
2180
2181         input = hidpp_allocate_input(hdev);
2182         if (!input) {
2183                 hid_err(hdev, "cannot allocate new input device: %d\n", ret);
2184                 return;
2185         }
2186
2187         hidpp_populate_input(hidpp, input, false);
2188
2189         ret = input_register_device(input);
2190         if (ret)
2191                 input_free_device(input);
2192
2193         hidpp->delayed_input = input;
2194 }
2195
2196 static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
2197 {
2198         struct hidpp_device *hidpp;
2199         int ret;
2200         bool connected;
2201         unsigned int connect_mask = HID_CONNECT_DEFAULT;
2202
2203         hidpp = devm_kzalloc(&hdev->dev, sizeof(struct hidpp_device),
2204                         GFP_KERNEL);
2205         if (!hidpp)
2206                 return -ENOMEM;
2207
2208         hidpp->hid_dev = hdev;
2209         hidpp->name = hdev->name;
2210         hid_set_drvdata(hdev, hidpp);
2211
2212         hidpp->quirks = id->driver_data;
2213
2214         if (disable_raw_mode) {
2215                 hidpp->quirks &= ~HIDPP_QUIRK_CLASS_WTP;
2216                 hidpp->quirks &= ~HIDPP_QUIRK_CONNECT_EVENTS;
2217                 hidpp->quirks &= ~HIDPP_QUIRK_NO_HIDINPUT;
2218         }
2219
2220         if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {
2221                 ret = wtp_allocate(hdev, id);
2222                 if (ret)
2223                         goto allocate_fail;
2224         } else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560) {
2225                 ret = m560_allocate(hdev);
2226                 if (ret)
2227                         goto allocate_fail;
2228         } else if (hidpp->quirks & HIDPP_QUIRK_CLASS_K400) {
2229                 ret = k400_allocate(hdev);
2230                 if (ret)
2231                         goto allocate_fail;
2232         }
2233
2234         INIT_WORK(&hidpp->work, delayed_work_cb);
2235         mutex_init(&hidpp->send_mutex);
2236         init_waitqueue_head(&hidpp->wait);
2237
2238         ret = hid_parse(hdev);
2239         if (ret) {
2240                 hid_err(hdev, "%s:parse failed\n", __func__);
2241                 goto hid_parse_fail;
2242         }
2243
2244         if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT)
2245                 connect_mask &= ~HID_CONNECT_HIDINPUT;
2246
2247         if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {
2248                 ret = hid_hw_start(hdev, connect_mask);
2249                 if (ret) {
2250                         hid_err(hdev, "hw start failed\n");
2251                         goto hid_hw_start_fail;
2252                 }
2253                 ret = hid_hw_open(hdev);
2254                 if (ret < 0) {
2255                         dev_err(&hdev->dev, "%s:hid_hw_open returned error:%d\n",
2256                                 __func__, ret);
2257                         hid_hw_stop(hdev);
2258                         goto hid_hw_start_fail;
2259                 }
2260         }
2261
2262
2263         /* Allow incoming packets */
2264         hid_device_io_start(hdev);
2265
2266         connected = hidpp_is_connected(hidpp);
2267         if (id->group != HID_GROUP_LOGITECH_DJ_DEVICE) {
2268                 if (!connected) {
2269                         ret = -ENODEV;
2270                         hid_err(hdev, "Device not connected");
2271                         goto hid_hw_open_failed;
2272                 }
2273
2274                 hid_info(hdev, "HID++ %u.%u device connected.\n",
2275                          hidpp->protocol_major, hidpp->protocol_minor);
2276         }
2277
2278         hidpp_overwrite_name(hdev, id->group == HID_GROUP_LOGITECH_DJ_DEVICE);
2279         atomic_set(&hidpp->connected, connected);
2280
2281         if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)) {
2282                 ret = wtp_get_config(hidpp);
2283                 if (ret)
2284                         goto hid_hw_open_failed;
2285         } else if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_G920)) {
2286                 ret = g920_get_config(hidpp);
2287                 if (ret)
2288                         goto hid_hw_open_failed;
2289         }
2290
2291         /* Block incoming packets */
2292         hid_device_io_stop(hdev);
2293
2294         if (!(hidpp->quirks & HIDPP_QUIRK_CLASS_G920)) {
2295                 ret = hid_hw_start(hdev, connect_mask);
2296                 if (ret) {
2297                         hid_err(hdev, "%s:hid_hw_start returned error\n", __func__);
2298                         goto hid_hw_start_fail;
2299                 }
2300         }
2301
2302         if (hidpp->quirks & HIDPP_QUIRK_CONNECT_EVENTS) {
2303                 /* Allow incoming packets */
2304                 hid_device_io_start(hdev);
2305
2306                 hidpp_connect_event(hidpp);
2307         }
2308
2309         return ret;
2310
2311 hid_hw_open_failed:
2312         hid_device_io_stop(hdev);
2313         if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {
2314                 hid_hw_close(hdev);
2315                 hid_hw_stop(hdev);
2316         }
2317 hid_hw_start_fail:
2318 hid_parse_fail:
2319         cancel_work_sync(&hidpp->work);
2320         mutex_destroy(&hidpp->send_mutex);
2321 allocate_fail:
2322         hid_set_drvdata(hdev, NULL);
2323         return ret;
2324 }
2325
2326 static void hidpp_remove(struct hid_device *hdev)
2327 {
2328         struct hidpp_device *hidpp = hid_get_drvdata(hdev);
2329
2330         if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {
2331                 hidpp_ff_deinit(hdev);
2332                 hid_hw_close(hdev);
2333         }
2334         hid_hw_stop(hdev);
2335         cancel_work_sync(&hidpp->work);
2336         mutex_destroy(&hidpp->send_mutex);
2337 }
2338
2339 static const struct hid_device_id hidpp_devices[] = {
2340         { /* wireless touchpad */
2341           HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
2342                 USB_VENDOR_ID_LOGITECH, 0x4011),
2343           .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT |
2344                          HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS },
2345         { /* wireless touchpad T650 */
2346           HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
2347                 USB_VENDOR_ID_LOGITECH, 0x4101),
2348           .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT },
2349         { /* wireless touchpad T651 */
2350           HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
2351                 USB_DEVICE_ID_LOGITECH_T651),
2352           .driver_data = HIDPP_QUIRK_CLASS_WTP },
2353         { /* Mouse logitech M560 */
2354           HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
2355                 USB_VENDOR_ID_LOGITECH, 0x402d),
2356           .driver_data = HIDPP_QUIRK_DELAYED_INIT | HIDPP_QUIRK_CLASS_M560 },
2357         { /* Keyboard logitech K400 */
2358           HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
2359                 USB_VENDOR_ID_LOGITECH, 0x4024),
2360           .driver_data = HIDPP_QUIRK_CONNECT_EVENTS | HIDPP_QUIRK_CLASS_K400 },
2361
2362         { HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
2363                 USB_VENDOR_ID_LOGITECH, HID_ANY_ID)},
2364
2365         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL),
2366                 .driver_data = HIDPP_QUIRK_CLASS_G920 | HIDPP_QUIRK_FORCE_OUTPUT_REPORTS},
2367         {}
2368 };
2369
2370 MODULE_DEVICE_TABLE(hid, hidpp_devices);
2371
2372 static struct hid_driver hidpp_driver = {
2373         .name = "logitech-hidpp-device",
2374         .id_table = hidpp_devices,
2375         .probe = hidpp_probe,
2376         .remove = hidpp_remove,
2377         .raw_event = hidpp_raw_event,
2378         .input_configured = hidpp_input_configured,
2379         .input_mapping = hidpp_input_mapping,
2380         .input_mapped = hidpp_input_mapped,
2381 };
2382
2383 module_hid_driver(hidpp_driver);