drivers/hid/hid-rmi.c

   1 /*
   2  *  Copyright (c) 2013 Andrew Duggan <aduggan@synaptics.com>
   3  *  Copyright (c) 2013 Synaptics Incorporated
   4  *  Copyright (c) 2014 Benjamin Tissoires <benjamin.tissoires@gmail.com>
   5  *  Copyright (c) 2014 Red Hat, Inc
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the Free
   9  * Software Foundation; either version 2 of the License, or (at your option)
  10  * any later version.
  11  */
  12
  13 #include <linux/kernel.h>
  14 #include <linux/hid.h>
  15 #include <linux/input.h>
  16 #include <linux/input/mt.h>
  17 #include <linux/module.h>
  18 #include <linux/pm.h>
  19 #include <linux/slab.h>
  20 #include <linux/wait.h>
  21 #include <linux/sched.h>
  22 #include "hid-ids.h"
  23
  24 #define RMI_MOUSE_REPORT_ID             0x01 /* Mouse emulation Report */
  25 #define RMI_WRITE_REPORT_ID             0x09 /* Output Report */
  26 #define RMI_READ_ADDR_REPORT_ID         0x0a /* Output Report */
  27 #define RMI_READ_DATA_REPORT_ID         0x0b /* Input Report */
  28 #define RMI_ATTN_REPORT_ID              0x0c /* Input Report */
  29 #define RMI_SET_RMI_MODE_REPORT_ID      0x0f /* Feature Report */
  30
  31 /* flags */
  32 #define RMI_READ_REQUEST_PENDING        BIT(0)
  33 #define RMI_READ_DATA_PENDING           BIT(1)
  34 #define RMI_STARTED                     BIT(2)
  35
  36 /* device flags */
  37 #define RMI_DEVICE                      BIT(0)
  38 #define RMI_DEVICE_HAS_PHYS_BUTTONS     BIT(1)
  39
  40 enum rmi_mode_type {
  41         RMI_MODE_OFF                    = 0,
  42         RMI_MODE_ATTN_REPORTS           = 1,
  43         RMI_MODE_NO_PACKED_ATTN_REPORTS = 2,
  44 };
  45
  46 struct rmi_function {
  47         unsigned page;                  /* page of the function */
  48         u16 query_base_addr;            /* base address for queries */
  49         u16 command_base_addr;          /* base address for commands */
  50         u16 control_base_addr;          /* base address for controls */
  51         u16 data_base_addr;             /* base address for datas */
  52         unsigned int interrupt_base;    /* cross-function interrupt number
  53                                          * (uniq in the device)*/
  54         unsigned int interrupt_count;   /* number of interrupts */
  55         unsigned int report_size;       /* size of a report */
  56         unsigned long irq_mask;         /* mask of the interrupts
  57                                          * (to be applied against ATTN IRQ) */
  58 };
  59
  60 /**
  61  * struct rmi_data - stores information for hid communication
  62  *
  63  * @page_mutex: Locks current page to avoid changing pages in unexpected ways.
  64  * @page: Keeps track of the current virtual page
  65  *
  66  * @wait: Used for waiting for read data
  67  *
  68  * @writeReport: output buffer when writing RMI registers
  69  * @readReport: input buffer when reading RMI registers
  70  *
  71  * @input_report_size: size of an input report (advertised by HID)
  72  * @output_report_size: size of an output report (advertised by HID)
  73  *
  74  * @flags: flags for the current device (started, reading, etc...)
  75  *
  76  * @f11: placeholder of internal RMI function F11 description
  77  * @f30: placeholder of internal RMI function F30 description
  78  *
  79  * @max_fingers: maximum finger count reported by the device
  80  * @max_x: maximum x value reported by the device
  81  * @max_y: maximum y value reported by the device
  82  *
  83  * @gpio_led_count: count of GPIOs + LEDs reported by F30
  84  * @button_count: actual physical buttons count
  85  * @button_mask: button mask used to decode GPIO ATTN reports
  86  * @button_state_mask: pull state of the buttons
  87  *
  88  * @input: pointer to the kernel input device
  89  *
  90  * @reset_work: worker which will be called in case of a mouse report
  91  * @hdev: pointer to the struct hid_device
  92  */
  93 struct rmi_data {
  94         struct mutex page_mutex;
  95         int page;
  96
  97         wait_queue_head_t wait;
  98
  99         u8 *writeReport;
 100         u8 *readReport;
 101
 102         int input_report_size;
 103         int output_report_size;
 104
 105         unsigned long flags;
 106
 107         struct rmi_function f11;
 108         struct rmi_function f30;
 109
 110         unsigned int max_fingers;
 111         unsigned int max_x;
 112         unsigned int max_y;
 113         unsigned int x_size_mm;
 114         unsigned int y_size_mm;
 115
 116         unsigned int gpio_led_count;
 117         unsigned int button_count;
 118         unsigned long button_mask;
 119         unsigned long button_state_mask;
 120
 121         struct input_dev *input;
 122
 123         struct work_struct reset_work;
 124         struct hid_device *hdev;
 125
 126         unsigned long device_flags;
 127 };
 128
 129 #define RMI_PAGE(addr) (((addr) >> 8) & 0xff)
 130
 131 static int rmi_write_report(struct hid_device *hdev, u8 *report, int len);
 132
 133 /**
 134  * rmi_set_page - Set RMI page
 135  * @hdev: The pointer to the hid_device struct
 136  * @page: The new page address.
 137  *
 138  * RMI devices have 16-bit addressing, but some of the physical
 139  * implementations (like SMBus) only have 8-bit addressing. So RMI implements
 140  * a page address at 0xff of every page so we can reliable page addresses
 141  * every 256 registers.
 142  *
 143  * The page_mutex lock must be held when this function is entered.
 144  *
 145  * Returns zero on success, non-zero on failure.
 146  */
 147 static int rmi_set_page(struct hid_device *hdev, u8 page)
 148 {
 149         struct rmi_data *data = hid_get_drvdata(hdev);
 150         int retval;
 151
 152         data->writeReport[0] = RMI_WRITE_REPORT_ID;
 153         data->writeReport[1] = 1;
 154         data->writeReport[2] = 0xFF;
 155         data->writeReport[4] = page;
 156
 157         retval = rmi_write_report(hdev, data->writeReport,
 158                         data->output_report_size);
 159         if (retval != data->output_report_size) {
 160                 dev_err(&hdev->dev,
 161                         "%s: set page failed: %d.", __func__, retval);
 162                 return retval;
 163         }
 164
 165         data->page = page;
 166         return 0;
 167 }
 168
 169 static int rmi_set_mode(struct hid_device *hdev, u8 mode)
 170 {
 171         int ret;
 172         u8 txbuf[2] = {RMI_SET_RMI_MODE_REPORT_ID, mode};
 173
 174         ret = hid_hw_raw_request(hdev, RMI_SET_RMI_MODE_REPORT_ID, txbuf,
 175                         sizeof(txbuf), HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
 176         if (ret < 0) {
 177                 dev_err(&hdev->dev, "unable to set rmi mode to %d (%d)\n", mode,
 178                         ret);
 179                 return ret;
 180         }
 181
 182         return 0;
 183 }
 184
 185 static int rmi_write_report(struct hid_device *hdev, u8 *report, int len)
 186 {
 187         int ret;
 188
 189         ret = hid_hw_output_report(hdev, (void *)report, len);
 190         if (ret < 0) {
 191                 dev_err(&hdev->dev, "failed to write hid report (%d)\n", ret);
 192                 return ret;
 193         }
 194
 195         return ret;
 196 }
 197
 198 static int rmi_read_block(struct hid_device *hdev, u16 addr, void *buf,
 199                 const int len)
 200 {
 201         struct rmi_data *data = hid_get_drvdata(hdev);
 202         int ret;
 203         int bytes_read;
 204         int bytes_needed;
 205         int retries;
 206         int read_input_count;
 207
 208         mutex_lock(&data->page_mutex);
 209
 210         if (RMI_PAGE(addr) != data->page) {
 211                 ret = rmi_set_page(hdev, RMI_PAGE(addr));
 212                 if (ret < 0)
 213                         goto exit;
 214         }
 215
 216         for (retries = 5; retries > 0; retries--) {
 217                 data->writeReport[0] = RMI_READ_ADDR_REPORT_ID;
 218                 data->writeReport[1] = 0; /* old 1 byte read count */
 219                 data->writeReport[2] = addr & 0xFF;
 220                 data->writeReport[3] = (addr >> 8) & 0xFF;
 221                 data->writeReport[4] = len  & 0xFF;
 222                 data->writeReport[5] = (len >> 8) & 0xFF;
 223
 224                 set_bit(RMI_READ_REQUEST_PENDING, &data->flags);
 225
 226                 ret = rmi_write_report(hdev, data->writeReport,
 227                                                 data->output_report_size);
 228                 if (ret != data->output_report_size) {
 229                         clear_bit(RMI_READ_REQUEST_PENDING, &data->flags);
 230                         dev_err(&hdev->dev,
 231                                 "failed to write request output report (%d)\n",
 232                                 ret);
 233                         goto exit;
 234                 }
 235
 236                 bytes_read = 0;
 237                 bytes_needed = len;
 238                 while (bytes_read < len) {
 239                         if (!wait_event_timeout(data->wait,
 240                                 test_bit(RMI_READ_DATA_PENDING, &data->flags),
 241                                         msecs_to_jiffies(1000))) {
 242                                 hid_warn(hdev, "%s: timeout elapsed\n",
 243                                          __func__);
 244                                 ret = -EAGAIN;
 245                                 break;
 246                         }
 247
 248                         read_input_count = data->readReport[1];
 249                         memcpy(buf + bytes_read, &data->readReport[2],
 250                                 read_input_count < bytes_needed ?
 251                                         read_input_count : bytes_needed);
 252
 253                         bytes_read += read_input_count;
 254                         bytes_needed -= read_input_count;
 255                         clear_bit(RMI_READ_DATA_PENDING, &data->flags);
 256                 }
 257
 258                 if (ret >= 0) {
 259                         ret = 0;
 260                         break;
 261                 }
 262         }
 263
 264 exit:
 265         clear_bit(RMI_READ_REQUEST_PENDING, &data->flags);
 266         mutex_unlock(&data->page_mutex);
 267         return ret;
 268 }
 269
 270 static inline int rmi_read(struct hid_device *hdev, u16 addr, void *buf)
 271 {
 272         return rmi_read_block(hdev, addr, buf, 1);
 273 }
 274
 275 static void rmi_f11_process_touch(struct rmi_data *hdata, int slot,
 276                 u8 finger_state, u8 *touch_data)
 277 {
 278         int x, y, wx, wy;
 279         int wide, major, minor;
 280         int z;
 281
 282         input_mt_slot(hdata->input, slot);
 283         input_mt_report_slot_state(hdata->input, MT_TOOL_FINGER,
 284                         finger_state == 0x01);
 285         if (finger_state == 0x01) {
 286                 x = (touch_data[0] << 4) | (touch_data[2] & 0x0F);
 287                 y = (touch_data[1] << 4) | (touch_data[2] >> 4);
 288                 wx = touch_data[3] & 0x0F;
 289                 wy = touch_data[3] >> 4;
 290                 wide = (wx > wy);
 291                 major = max(wx, wy);
 292                 minor = min(wx, wy);
 293                 z = touch_data[4];
 294
 295                 /* y is inverted */
 296                 y = hdata->max_y - y;
 297
 298                 input_event(hdata->input, EV_ABS, ABS_MT_POSITION_X, x);
 299                 input_event(hdata->input, EV_ABS, ABS_MT_POSITION_Y, y);
 300                 input_event(hdata->input, EV_ABS, ABS_MT_ORIENTATION, wide);
 301                 input_event(hdata->input, EV_ABS, ABS_MT_PRESSURE, z);
 302                 input_event(hdata->input, EV_ABS, ABS_MT_TOUCH_MAJOR, major);
 303                 input_event(hdata->input, EV_ABS, ABS_MT_TOUCH_MINOR, minor);
 304         }
 305 }
 306
 307 static void rmi_reset_work(struct work_struct *work)
 308 {
 309         struct rmi_data *hdata = container_of(work, struct rmi_data,
 310                                                 reset_work);
 311
 312         /* switch the device to RMI if we receive a generic mouse report */
 313         rmi_set_mode(hdata->hdev, RMI_MODE_ATTN_REPORTS);
 314 }
 315
 316 static inline int rmi_schedule_reset(struct hid_device *hdev)
 317 {
 318         struct rmi_data *hdata = hid_get_drvdata(hdev);
 319         return schedule_work(&hdata->reset_work);
 320 }
 321
 322 static int rmi_f11_input_event(struct hid_device *hdev, u8 irq, u8 *data,
 323                 int size)
 324 {
 325         struct rmi_data *hdata = hid_get_drvdata(hdev);
 326         int offset;
 327         int i;
 328
 329         if (!(irq & hdata->f11.irq_mask) || size <= 0)
 330                 return 0;
 331
 332         offset = (hdata->max_fingers >> 2) + 1;
 333         for (i = 0; i < hdata->max_fingers; i++) {
 334                 int fs_byte_position = i >> 2;
 335                 int fs_bit_position = (i & 0x3) << 1;
 336                 int finger_state = (data[fs_byte_position] >> fs_bit_position) &
 337                                         0x03;
 338                 int position = offset + 5 * i;
 339
 340                 if (position + 5 > size) {
 341                         /* partial report, go on with what we received */
 342                         printk_once(KERN_WARNING
 343                                 "%s %s: Detected incomplete finger report. Finger reports may occasionally get dropped on this platform.\n",
 344                                  dev_driver_string(&hdev->dev),
 345                                  dev_name(&hdev->dev));
 346                         hid_dbg(hdev, "Incomplete finger report\n");
 347                         break;
 348                 }
 349
 350                 rmi_f11_process_touch(hdata, i, finger_state, &data[position]);
 351         }
 352         input_mt_sync_frame(hdata->input);
 353         input_sync(hdata->input);
 354         return hdata->f11.report_size;
 355 }
 356
 357 static int rmi_f30_input_event(struct hid_device *hdev, u8 irq, u8 *data,
 358                 int size)
 359 {
 360         struct rmi_data *hdata = hid_get_drvdata(hdev);
 361         int i;
 362         int button = 0;
 363         bool value;
 364
 365         if (!(irq & hdata->f30.irq_mask))
 366                 return 0;
 367
 368         if (size < (int)hdata->f30.report_size) {
 369                 hid_warn(hdev, "Click Button pressed, but the click data is missing\n");
 370                 return 0;
 371         }
 372
 373         for (i = 0; i < hdata->gpio_led_count; i++) {
 374                 if (test_bit(i, &hdata->button_mask)) {
 375                         value = (data[i / 8] >> (i & 0x07)) & BIT(0);
 376                         if (test_bit(i, &hdata->button_state_mask))
 377                                 value = !value;
 378                         input_event(hdata->input, EV_KEY, BTN_LEFT + button++,
 379                                         value);
 380                 }
 381         }
 382         return hdata->f30.report_size;
 383 }
 384
 385 static int rmi_input_event(struct hid_device *hdev, u8 *data, int size)
 386 {
 387         struct rmi_data *hdata = hid_get_drvdata(hdev);
 388         unsigned long irq_mask = 0;
 389         unsigned index = 2;
 390
 391         if (!(test_bit(RMI_STARTED, &hdata->flags)))
 392                 return 0;
 393
 394         irq_mask |= hdata->f11.irq_mask;
 395         irq_mask |= hdata->f30.irq_mask;
 396
 397         if (data[1] & ~irq_mask)
 398                 hid_dbg(hdev, "unknown intr source:%02lx %s:%d\n",
 399                         data[1] & ~irq_mask, __FILE__, __LINE__);
 400
 401         if (hdata->f11.interrupt_base < hdata->f30.interrupt_base) {
 402                 index += rmi_f11_input_event(hdev, data[1], &data[index],
 403                                 size - index);
 404                 index += rmi_f30_input_event(hdev, data[1], &data[index],
 405                                 size - index);
 406         } else {
 407                 index += rmi_f30_input_event(hdev, data[1], &data[index],
 408                                 size - index);
 409                 index += rmi_f11_input_event(hdev, data[1], &data[index],
 410                                 size - index);
 411         }
 412
 413         return 1;
 414 }
 415
 416 static int rmi_read_data_event(struct hid_device *hdev, u8 *data, int size)
 417 {
 418         struct rmi_data *hdata = hid_get_drvdata(hdev);
 419
 420         if (!test_bit(RMI_READ_REQUEST_PENDING, &hdata->flags)) {
 421                 hid_dbg(hdev, "no read request pending\n");
 422                 return 0;
 423         }
 424
 425         memcpy(hdata->readReport, data, size < hdata->input_report_size ?
 426                         size : hdata->input_report_size);
 427         set_bit(RMI_READ_DATA_PENDING, &hdata->flags);
 428         wake_up(&hdata->wait);
 429
 430         return 1;
 431 }
 432
 433 static int rmi_check_sanity(struct hid_device *hdev, u8 *data, int size)
 434 {
 435         int valid_size = size;
 436         /*
 437          * On the Dell XPS 13 9333, the bus sometimes get confused and fills
 438          * the report with a sentinel value "ff". Synaptics told us that such
 439          * behavior does not comes from the touchpad itself, so we filter out
 440          * such reports here.
 441          */
 442
 443         while ((data[valid_size - 1] == 0xff) && valid_size > 0)
 444                 valid_size--;
 445
 446         return valid_size;
 447 }
 448
 449 static int rmi_raw_event(struct hid_device *hdev,
 450                 struct hid_report *report, u8 *data, int size)
 451 {
 452         size = rmi_check_sanity(hdev, data, size);
 453         if (size < 2)
 454                 return 0;
 455
 456         switch (data[0]) {
 457         case RMI_READ_DATA_REPORT_ID:
 458                 return rmi_read_data_event(hdev, data, size);
 459         case RMI_ATTN_REPORT_ID:
 460                 return rmi_input_event(hdev, data, size);
 461         default:
 462                 return 1;
 463         }
 464
 465         return 0;
 466 }
 467
 468 static int rmi_event(struct hid_device *hdev, struct hid_field *field,
 469                         struct hid_usage *usage, __s32 value)
 470 {
 471         struct rmi_data *data = hid_get_drvdata(hdev);
 472
 473         if ((data->device_flags & RMI_DEVICE) &&
 474             (field->application == HID_GD_POINTER ||
 475             field->application == HID_GD_MOUSE)) {
 476                 if (data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS) {
 477                         if ((usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON)
 478                                 return 0;
 479
 480                         if ((usage->hid == HID_GD_X || usage->hid == HID_GD_Y)
 481                             && !value)
 482                                 return 1;
 483                 }
 484
 485                 rmi_schedule_reset(hdev);
 486                 return 1;
 487         }
 488
 489         return 0;
 490 }
 491
 492 #ifdef CONFIG_PM
 493 static int rmi_post_reset(struct hid_device *hdev)
 494 {
 495         return rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
 496 }
 497
 498 static int rmi_post_resume(struct hid_device *hdev)
 499 {
 500         return rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
 501 }
 502 #endif /* CONFIG_PM */
 503
 504 #define RMI4_MAX_PAGE 0xff
 505 #define RMI4_PAGE_SIZE 0x0100
 506
 507 #define PDT_START_SCAN_LOCATION 0x00e9
 508 #define PDT_END_SCAN_LOCATION   0x0005
 509 #define RMI4_END_OF_PDT(id) ((id) == 0x00 || (id) == 0xff)
 510
 511 struct pdt_entry {
 512         u8 query_base_addr:8;
 513         u8 command_base_addr:8;
 514         u8 control_base_addr:8;
 515         u8 data_base_addr:8;
 516         u8 interrupt_source_count:3;
 517         u8 bits3and4:2;
 518         u8 function_version:2;
 519         u8 bit7:1;
 520         u8 function_number:8;
 521 } __attribute__((__packed__));
 522
 523 static inline unsigned long rmi_gen_mask(unsigned irq_base, unsigned irq_count)
 524 {
 525         return GENMASK(irq_count + irq_base - 1, irq_base);
 526 }
 527
 528 static void rmi_register_function(struct rmi_data *data,
 529         struct pdt_entry *pdt_entry, int page, unsigned interrupt_count)
 530 {
 531         struct rmi_function *f = NULL;
 532         u16 page_base = page << 8;
 533
 534         switch (pdt_entry->function_number) {
 535         case 0x11:
 536                 f = &data->f11;
 537                 break;
 538         case 0x30:
 539                 f = &data->f30;
 540                 break;
 541         }
 542
 543         if (f) {
 544                 f->page = page;
 545                 f->query_base_addr = page_base | pdt_entry->query_base_addr;
 546                 f->command_base_addr = page_base | pdt_entry->command_base_addr;
 547                 f->control_base_addr = page_base | pdt_entry->control_base_addr;
 548                 f->data_base_addr = page_base | pdt_entry->data_base_addr;
 549                 f->interrupt_base = interrupt_count;
 550                 f->interrupt_count = pdt_entry->interrupt_source_count;
 551                 f->irq_mask = rmi_gen_mask(f->interrupt_base,
 552                                                 f->interrupt_count);
 553         }
 554 }
 555
 556 static int rmi_scan_pdt(struct hid_device *hdev)
 557 {
 558         struct rmi_data *data = hid_get_drvdata(hdev);
 559         struct pdt_entry entry;
 560         int page;
 561         bool page_has_function;
 562         int i;
 563         int retval;
 564         int interrupt = 0;
 565         u16 page_start, pdt_start , pdt_end;
 566
 567         hid_info(hdev, "Scanning PDT...\n");
 568
 569         for (page = 0; (page <= RMI4_MAX_PAGE); page++) {
 570                 page_start = RMI4_PAGE_SIZE * page;
 571                 pdt_start = page_start + PDT_START_SCAN_LOCATION;
 572                 pdt_end = page_start + PDT_END_SCAN_LOCATION;
 573
 574                 page_has_function = false;
 575                 for (i = pdt_start; i >= pdt_end; i -= sizeof(entry)) {
 576                         retval = rmi_read_block(hdev, i, &entry, sizeof(entry));
 577                         if (retval) {
 578                                 hid_err(hdev,
 579                                         "Read of PDT entry at %#06x failed.\n",
 580                                         i);
 581                                 goto error_exit;
 582                         }
 583
 584                         if (RMI4_END_OF_PDT(entry.function_number))
 585                                 break;
 586
 587                         page_has_function = true;
 588
 589                         hid_info(hdev, "Found F%02X on page %#04x\n",
 590                                         entry.function_number, page);
 591
 592                         rmi_register_function(data, &entry, page, interrupt);
 593                         interrupt += entry.interrupt_source_count;
 594                 }
 595
 596                 if (!page_has_function)
 597                         break;
 598         }
 599
 600         hid_info(hdev, "%s: Done with PDT scan.\n", __func__);
 601         retval = 0;
 602
 603 error_exit:
 604         return retval;
 605 }
 606
 607 static int rmi_populate_f11(struct hid_device *hdev)
 608 {
 609         struct rmi_data *data = hid_get_drvdata(hdev);
 610         u8 buf[20];
 611         int ret;
 612         bool has_query9;
 613         bool has_query10 = false;
 614         bool has_query11;
 615         bool has_query12;
 616         bool has_query27;
 617         bool has_query28;
 618         bool has_query36 = false;
 619         bool has_physical_props;
 620         bool has_gestures;
 621         bool has_rel;
 622         bool has_data40 = false;
 623         unsigned x_size, y_size;
 624         u16 query_offset;
 625
 626         if (!data->f11.query_base_addr) {
 627                 hid_err(hdev, "No 2D sensor found, giving up.\n");
 628                 return -ENODEV;
 629         }
 630
 631         /* query 0 contains some useful information */
 632         ret = rmi_read(hdev, data->f11.query_base_addr, buf);
 633         if (ret) {
 634                 hid_err(hdev, "can not get query 0: %d.\n", ret);
 635                 return ret;
 636         }
 637         has_query9 = !!(buf[0] & BIT(3));
 638         has_query11 = !!(buf[0] & BIT(4));
 639         has_query12 = !!(buf[0] & BIT(5));
 640         has_query27 = !!(buf[0] & BIT(6));
 641         has_query28 = !!(buf[0] & BIT(7));
 642
 643         /* query 1 to get the max number of fingers */
 644         ret = rmi_read(hdev, data->f11.query_base_addr + 1, buf);
 645         if (ret) {
 646                 hid_err(hdev, "can not get NumberOfFingers: %d.\n", ret);
 647                 return ret;
 648         }
 649         data->max_fingers = (buf[0] & 0x07) + 1;
 650         if (data->max_fingers > 5)
 651                 data->max_fingers = 10;
 652
 653         data->f11.report_size = data->max_fingers * 5 +
 654                                 DIV_ROUND_UP(data->max_fingers, 4);
 655
 656         if (!(buf[0] & BIT(4))) {
 657                 hid_err(hdev, "No absolute events, giving up.\n");
 658                 return -ENODEV;
 659         }
 660
 661         has_rel = !!(buf[0] & BIT(3));
 662         has_gestures = !!(buf[0] & BIT(5));
 663
 664         /*
 665          * At least 4 queries are guaranteed to be present in F11
 666          * +1 for query 5 which is present since absolute events are
 667          * reported and +1 for query 12.
 668          */
 669         query_offset = 6;
 670
 671         if (has_rel)
 672                 ++query_offset; /* query 6 is present */
 673
 674         if (has_gestures) {
 675                 /* query 8 to find out if query 10 exists */
 676                 ret = rmi_read(hdev,
 677                         data->f11.query_base_addr + query_offset + 1, buf);
 678                 if (ret) {
 679                         hid_err(hdev, "can not read gesture information: %d.\n",
 680                                 ret);
 681                         return ret;
 682                 }
 683                 has_query10 = !!(buf[0] & BIT(2));
 684
 685                 query_offset += 2; /* query 7 and 8 are present */
 686         }
 687
 688         if (has_query9)
 689                 ++query_offset;
 690
 691         if (has_query10)
 692                 ++query_offset;
 693
 694         if (has_query11)
 695                 ++query_offset;
 696
 697         /* query 12 to know if the physical properties are reported */
 698         if (has_query12) {
 699                 ret = rmi_read(hdev, data->f11.query_base_addr
 700                                 + query_offset, buf);
 701                 if (ret) {
 702                         hid_err(hdev, "can not get query 12: %d.\n", ret);
 703                         return ret;
 704                 }
 705                 has_physical_props = !!(buf[0] & BIT(5));
 706
 707                 if (has_physical_props) {
 708                         query_offset += 1;
 709                         ret = rmi_read_block(hdev,
 710                                         data->f11.query_base_addr
 711                                                 + query_offset, buf, 4);
 712                         if (ret) {
 713                                 hid_err(hdev, "can not read query 15-18: %d.\n",
 714                                         ret);
 715                                 return ret;
 716                         }
 717
 718                         x_size = buf[0] | (buf[1] << 8);
 719                         y_size = buf[2] | (buf[3] << 8);
 720
 721                         data->x_size_mm = DIV_ROUND_CLOSEST(x_size, 10);
 722                         data->y_size_mm = DIV_ROUND_CLOSEST(y_size, 10);
 723
 724                         hid_info(hdev, "%s: size in mm: %d x %d\n",
 725                                  __func__, data->x_size_mm, data->y_size_mm);
 726
 727                         /*
 728                          * query 15 - 18 contain the size of the sensor
 729                          * and query 19 - 26 contain bezel dimensions
 730                          */
 731                         query_offset += 12;
 732                 }
 733         }
 734
 735         if (has_query27)
 736                 ++query_offset;
 737
 738         if (has_query28) {
 739                 ret = rmi_read(hdev, data->f11.query_base_addr
 740                                 + query_offset, buf);
 741                 if (ret) {
 742                         hid_err(hdev, "can not get query 28: %d.\n", ret);
 743                         return ret;
 744                 }
 745
 746                 has_query36 = !!(buf[0] & BIT(6));
 747         }
 748
 749         if (has_query36) {
 750                 query_offset += 2;
 751                 ret = rmi_read(hdev, data->f11.query_base_addr
 752                                 + query_offset, buf);
 753                 if (ret) {
 754                         hid_err(hdev, "can not get query 36: %d.\n", ret);
 755                         return ret;
 756                 }
 757
 758                 has_data40 = !!(buf[0] & BIT(5));
 759         }
 760
 761
 762         if (has_data40)
 763                 data->f11.report_size += data->max_fingers * 2;
 764
 765         /*
 766          * retrieve the ctrl registers
 767          * the ctrl register has a size of 20 but a fw bug split it into 16 + 4,
 768          * and there is no way to know if the first 20 bytes are here or not.
 769          * We use only the first 10 bytes, so get only them.
 770          */
 771         ret = rmi_read_block(hdev, data->f11.control_base_addr, buf, 10);
 772         if (ret) {
 773                 hid_err(hdev, "can not read ctrl block of size 10: %d.\n", ret);
 774                 return ret;
 775         }
 776
 777         data->max_x = buf[6] | (buf[7] << 8);
 778         data->max_y = buf[8] | (buf[9] << 8);
 779
 780         return 0;
 781 }
 782
 783 static int rmi_populate_f30(struct hid_device *hdev)
 784 {
 785         struct rmi_data *data = hid_get_drvdata(hdev);
 786         u8 buf[20];
 787         int ret;
 788         bool has_gpio, has_led;
 789         unsigned bytes_per_ctrl;
 790         u8 ctrl2_addr;
 791         int ctrl2_3_length;
 792         int i;
 793
 794         /* function F30 is for physical buttons */
 795         if (!data->f30.query_base_addr) {
 796                 hid_err(hdev, "No GPIO/LEDs found, giving up.\n");
 797                 return -ENODEV;
 798         }
 799
 800         ret = rmi_read_block(hdev, data->f30.query_base_addr, buf, 2);
 801         if (ret) {
 802                 hid_err(hdev, "can not get F30 query registers: %d.\n", ret);
 803                 return ret;
 804         }
 805
 806         has_gpio = !!(buf[0] & BIT(3));
 807         has_led = !!(buf[0] & BIT(2));
 808         data->gpio_led_count = buf[1] & 0x1f;
 809
 810         /* retrieve ctrl 2 & 3 registers */
 811         bytes_per_ctrl = (data->gpio_led_count + 7) / 8;
 812         /* Ctrl0 is present only if both has_gpio and has_led are set*/
 813         ctrl2_addr = (has_gpio && has_led) ? bytes_per_ctrl : 0;
 814         /* Ctrl1 is always be present */
 815         ctrl2_addr += bytes_per_ctrl;
 816         ctrl2_3_length = 2 * bytes_per_ctrl;
 817
 818         data->f30.report_size = bytes_per_ctrl;
 819
 820         ret = rmi_read_block(hdev, data->f30.control_base_addr + ctrl2_addr,
 821                                 buf, ctrl2_3_length);
 822         if (ret) {
 823                 hid_err(hdev, "can not read ctrl 2&3 block of size %d: %d.\n",
 824                         ctrl2_3_length, ret);
 825                 return ret;
 826         }
 827
 828         for (i = 0; i < data->gpio_led_count; i++) {
 829                 int byte_position = i >> 3;
 830                 int bit_position = i & 0x07;
 831                 u8 dir_byte = buf[byte_position];
 832                 u8 data_byte = buf[byte_position + bytes_per_ctrl];
 833                 bool dir = (dir_byte >> bit_position) & BIT(0);
 834                 bool dat = (data_byte >> bit_position) & BIT(0);
 835
 836                 if (dir == 0) {
 837                         /* input mode */
 838                         if (dat) {
 839                                 /* actual buttons have pull up resistor */
 840                                 data->button_count++;
 841                                 set_bit(i, &data->button_mask);
 842                                 set_bit(i, &data->button_state_mask);
 843                         }
 844                 }
 845
 846         }
 847
 848         return 0;
 849 }
 850
 851 static int rmi_populate(struct hid_device *hdev)
 852 {
 853         int ret;
 854
 855         ret = rmi_scan_pdt(hdev);
 856         if (ret) {
 857                 hid_err(hdev, "PDT scan failed with code %d.\n", ret);
 858                 return ret;
 859         }
 860
 861         ret = rmi_populate_f11(hdev);
 862         if (ret) {
 863                 hid_err(hdev, "Error while initializing F11 (%d).\n", ret);
 864                 return ret;
 865         }
 866
 867         ret = rmi_populate_f30(hdev);
 868         if (ret)
 869                 hid_warn(hdev, "Error while initializing F30 (%d).\n", ret);
 870
 871         return 0;
 872 }
 873
 874 static void rmi_input_configured(struct hid_device *hdev, struct hid_input *hi)
 875 {
 876         struct rmi_data *data = hid_get_drvdata(hdev);
 877         struct input_dev *input = hi->input;
 878         int ret;
 879         int res_x, res_y, i;
 880
 881         data->input = input;
 882
 883         hid_dbg(hdev, "Opening low level driver\n");
 884         ret = hid_hw_open(hdev);
 885         if (ret)
 886                 return;
 887
 888         if (!(data->device_flags & RMI_DEVICE))
 889                 return;
 890
 891         /* Allow incoming hid reports */
 892         hid_device_io_start(hdev);
 893
 894         ret = rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
 895         if (ret < 0) {
 896                 dev_err(&hdev->dev, "failed to set rmi mode\n");
 897                 goto exit;
 898         }
 899
 900         ret = rmi_set_page(hdev, 0);
 901         if (ret < 0) {
 902                 dev_err(&hdev->dev, "failed to set page select to 0.\n");
 903                 goto exit;
 904         }
 905
 906         ret = rmi_populate(hdev);
 907         if (ret)
 908                 goto exit;
 909
 910         __set_bit(EV_ABS, input->evbit);
 911         input_set_abs_params(input, ABS_MT_POSITION_X, 1, data->max_x, 0, 0);
 912         input_set_abs_params(input, ABS_MT_POSITION_Y, 1, data->max_y, 0, 0);
 913
 914         if (data->x_size_mm && data->y_size_mm) {
 915                 res_x = (data->max_x - 1) / data->x_size_mm;
 916                 res_y = (data->max_y - 1) / data->y_size_mm;
 917
 918                 input_abs_set_res(input, ABS_MT_POSITION_X, res_x);
 919                 input_abs_set_res(input, ABS_MT_POSITION_Y, res_y);
 920         }
 921
 922         input_set_abs_params(input, ABS_MT_ORIENTATION, 0, 1, 0, 0);
 923         input_set_abs_params(input, ABS_MT_PRESSURE, 0, 0xff, 0, 0);
 924         input_set_abs_params(input, ABS_MT_TOUCH_MAJOR, 0, 0x0f, 0, 0);
 925         input_set_abs_params(input, ABS_MT_TOUCH_MINOR, 0, 0x0f, 0, 0);
 926
 927         input_mt_init_slots(input, data->max_fingers, INPUT_MT_POINTER);
 928
 929         if (data->button_count) {
 930                 __set_bit(EV_KEY, input->evbit);
 931                 for (i = 0; i < data->button_count; i++)
 932                         __set_bit(BTN_LEFT + i, input->keybit);
 933
 934                 if (data->button_count == 1)
 935                         __set_bit(INPUT_PROP_BUTTONPAD, input->propbit);
 936         }
 937
 938         set_bit(RMI_STARTED, &data->flags);
 939
 940 exit:
 941         hid_device_io_stop(hdev);
 942         hid_hw_close(hdev);
 943 }
 944
 945 static int rmi_input_mapping(struct hid_device *hdev,
 946                 struct hid_input *hi, struct hid_field *field,
 947                 struct hid_usage *usage, unsigned long **bit, int *max)
 948 {
 949         struct rmi_data *data = hid_get_drvdata(hdev);
 950
 951         /*
 952          * we want to make HID ignore the advertised HID collection
 953          * for RMI deivces
 954          */
 955         if (data->device_flags & RMI_DEVICE) {
 956                 if ((data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS) &&
 957                     ((usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON))
 958                         return 0;
 959
 960                 return -1;
 961         }
 962
 963         return 0;
 964 }
 965
 966 static int rmi_check_valid_report_id(struct hid_device *hdev, unsigned type,
 967                 unsigned id, struct hid_report **report)
 968 {
 969         int i;
 970
 971         *report = hdev->report_enum[type].report_id_hash[id];
 972         if (*report) {
 973                 for (i = 0; i < (*report)->maxfield; i++) {
 974                         unsigned app = (*report)->field[i]->application;
 975                         if ((app & HID_USAGE_PAGE) >= HID_UP_MSVENDOR)
 976                                 return 1;
 977                 }
 978         }
 979
 980         return 0;
 981 }
 982
 983 static int rmi_probe(struct hid_device *hdev, const struct hid_device_id *id)
 984 {
 985         struct rmi_data *data = NULL;
 986         int ret;
 987         size_t alloc_size;
 988         struct hid_report *input_report;
 989         struct hid_report *output_report;
 990         struct hid_report *feature_report;
 991
 992         data = devm_kzalloc(&hdev->dev, sizeof(struct rmi_data), GFP_KERNEL);
 993         if (!data)
 994                 return -ENOMEM;
 995
 996         INIT_WORK(&data->reset_work, rmi_reset_work);
 997         data->hdev = hdev;
 998
 999         hid_set_drvdata(hdev, data);
1000
1001         hdev->quirks |= HID_QUIRK_NO_INIT_REPORTS;
1002
1003         ret = hid_parse(hdev);
1004         if (ret) {
1005                 hid_err(hdev, "parse failed\n");
1006                 return ret;
1007         }
1008
1009         if (id->driver_data)
1010                 data->device_flags = id->driver_data;
1011
1012         /*
1013          * Check for the RMI specific report ids. If they are misisng
1014          * simply return and let the events be processed by hid-input
1015          */
1016         if (!rmi_check_valid_report_id(hdev, HID_FEATURE_REPORT,
1017             RMI_SET_RMI_MODE_REPORT_ID, &feature_report)) {
1018                 hid_dbg(hdev, "device does not have set mode feature report\n");
1019                 goto start;
1020         }
1021
1022         if (!rmi_check_valid_report_id(hdev, HID_INPUT_REPORT,
1023             RMI_ATTN_REPORT_ID, &input_report)) {
1024                 hid_dbg(hdev, "device does not have attention input report\n");
1025                 goto start;
1026         }
1027
1028         data->input_report_size = hid_report_len(input_report);
1029
1030         if (!rmi_check_valid_report_id(hdev, HID_OUTPUT_REPORT,
1031             RMI_WRITE_REPORT_ID, &output_report)) {
1032                 hid_dbg(hdev,
1033                         "device does not have rmi write output report\n");
1034                 goto start;
1035         }
1036
1037         data->output_report_size = hid_report_len(output_report);
1038
1039         data->device_flags |= RMI_DEVICE;
1040         alloc_size = data->output_report_size + data->input_report_size;
1041
1042         data->writeReport = devm_kzalloc(&hdev->dev, alloc_size, GFP_KERNEL);
1043         if (!data->writeReport) {
1044                 ret = -ENOMEM;
1045                 return ret;
1046         }
1047
1048         data->readReport = data->writeReport + data->output_report_size;
1049
1050         init_waitqueue_head(&data->wait);
1051
1052         mutex_init(&data->page_mutex);
1053
1054 start:
1055         ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
1056         if (ret) {
1057                 hid_err(hdev, "hw start failed\n");
1058                 return ret;
1059         }
1060
1061         if ((data->device_flags & RMI_DEVICE) &&
1062             !test_bit(RMI_STARTED, &data->flags))
1063                 /*
1064                  * The device maybe in the bootloader if rmi_input_configured
1065                  * failed to find F11 in the PDT. Print an error, but don't
1066                  * return an error from rmi_probe so that hidraw will be
1067                  * accessible from userspace. That way a userspace tool
1068                  * can be used to reload working firmware on the touchpad.
1069                  */
1070                 hid_err(hdev, "Device failed to be properly configured\n");
1071
1072         return 0;
1073 }
1074
1075 static void rmi_remove(struct hid_device *hdev)
1076 {
1077         struct rmi_data *hdata = hid_get_drvdata(hdev);
1078
1079         clear_bit(RMI_STARTED, &hdata->flags);
1080
1081         hid_hw_stop(hdev);
1082 }
1083
1084 static const struct hid_device_id rmi_id[] = {
1085         { HID_USB_DEVICE(USB_VENDOR_ID_RAZER, USB_DEVICE_ID_RAZER_BLADE_14),
1086                 .driver_data = RMI_DEVICE_HAS_PHYS_BUTTONS },
1087         { HID_DEVICE(HID_BUS_ANY, HID_GROUP_RMI, HID_ANY_ID, HID_ANY_ID) },
1088         { }
1089 };
1090 MODULE_DEVICE_TABLE(hid, rmi_id);
1091
1092 static struct hid_driver rmi_driver = {
1093         .name = "hid-rmi",
1094         .id_table               = rmi_id,
1095         .probe                  = rmi_probe,
1096         .remove                 = rmi_remove,
1097         .event                  = rmi_event,
1098         .raw_event              = rmi_raw_event,
1099         .input_mapping          = rmi_input_mapping,
1100         .input_configured       = rmi_input_configured,
1101 #ifdef CONFIG_PM
1102         .resume                 = rmi_post_resume,
1103         .reset_resume           = rmi_post_reset,
1104 #endif
1105 };
1106
1107 module_hid_driver(rmi_driver);
1108
1109 MODULE_AUTHOR("Andrew Duggan <aduggan@synaptics.com>");
1110 MODULE_DESCRIPTION("RMI HID driver");
1111 MODULE_LICENSE("GPL");