drivers/media/cec/cec-adap.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * cec-adap.c - HDMI Consumer Electronics Control framework - CEC adapter
   4  *
   5  * Copyright 2016 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
   6  */
   7
   8 #include <linux/errno.h>
   9 #include <linux/init.h>
  10 #include <linux/module.h>
  11 #include <linux/kernel.h>
  12 #include <linux/kmod.h>
  13 #include <linux/ktime.h>
  14 #include <linux/slab.h>
  15 #include <linux/mm.h>
  16 #include <linux/string.h>
  17 #include <linux/types.h>
  18
  19 #include <drm/drm_edid.h>
  20
  21 #include "cec-priv.h"
  22
  23 static void cec_fill_msg_report_features(struct cec_adapter *adap,
  24                                          struct cec_msg *msg,
  25                                          unsigned int la_idx);
  26
  27 /*
  28  * 400 ms is the time it takes for one 16 byte message to be
  29  * transferred and 5 is the maximum number of retries. Add
  30  * another 100 ms as a margin. So if the transmit doesn't
  31  * finish before that time something is really wrong and we
  32  * have to time out.
  33  *
  34  * This is a sign that something it really wrong and a warning
  35  * will be issued.
  36  */
  37 #define CEC_XFER_TIMEOUT_MS (5 * 400 + 100)
  38
  39 #define call_op(adap, op, arg...) \
  40         (adap->ops->op ? adap->ops->op(adap, ## arg) : 0)
  41
  42 #define call_void_op(adap, op, arg...)                  \
  43         do {                                            \
  44                 if (adap->ops->op)                      \
  45                         adap->ops->op(adap, ## arg);    \
  46         } while (0)
  47
  48 static int cec_log_addr2idx(const struct cec_adapter *adap, u8 log_addr)
  49 {
  50         int i;
  51
  52         for (i = 0; i < adap->log_addrs.num_log_addrs; i++)
  53                 if (adap->log_addrs.log_addr[i] == log_addr)
  54                         return i;
  55         return -1;
  56 }
  57
  58 static unsigned int cec_log_addr2dev(const struct cec_adapter *adap, u8 log_addr)
  59 {
  60         int i = cec_log_addr2idx(adap, log_addr);
  61
  62         return adap->log_addrs.primary_device_type[i < 0 ? 0 : i];
  63 }
  64
  65 u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
  66                            unsigned int *offset)
  67 {
  68         unsigned int loc = cec_get_edid_spa_location(edid, size);
  69
  70         if (offset)
  71                 *offset = loc;
  72         if (loc == 0)
  73                 return CEC_PHYS_ADDR_INVALID;
  74         return (edid[loc] << 8) | edid[loc + 1];
  75 }
  76 EXPORT_SYMBOL_GPL(cec_get_edid_phys_addr);
  77
  78 /*
  79  * Queue a new event for this filehandle. If ts == 0, then set it
  80  * to the current time.
  81  *
  82  * We keep a queue of at most max_event events where max_event differs
  83  * per event. If the queue becomes full, then drop the oldest event and
  84  * keep track of how many events we've dropped.
  85  */
  86 void cec_queue_event_fh(struct cec_fh *fh,
  87                         const struct cec_event *new_ev, u64 ts)
  88 {
  89         static const u16 max_events[CEC_NUM_EVENTS] = {
  90                 1, 1, 800, 800, 8, 8, 8, 8
  91         };
  92         struct cec_event_entry *entry;
  93         unsigned int ev_idx = new_ev->event - 1;
  94
  95         if (WARN_ON(ev_idx >= ARRAY_SIZE(fh->events)))
  96                 return;
  97
  98         if (ts == 0)
  99                 ts = ktime_get_ns();
 100
 101         mutex_lock(&fh->lock);
 102         if (ev_idx < CEC_NUM_CORE_EVENTS)
 103                 entry = &fh->core_events[ev_idx];
 104         else
 105                 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
 106         if (entry) {
 107                 if (new_ev->event == CEC_EVENT_LOST_MSGS &&
 108                     fh->queued_events[ev_idx]) {
 109                         entry->ev.lost_msgs.lost_msgs +=
 110                                 new_ev->lost_msgs.lost_msgs;
 111                         goto unlock;
 112                 }
 113                 entry->ev = *new_ev;
 114                 entry->ev.ts = ts;
 115
 116                 if (fh->queued_events[ev_idx] < max_events[ev_idx]) {
 117                         /* Add new msg at the end of the queue */
 118                         list_add_tail(&entry->list, &fh->events[ev_idx]);
 119                         fh->queued_events[ev_idx]++;
 120                         fh->total_queued_events++;
 121                         goto unlock;
 122                 }
 123
 124                 if (ev_idx >= CEC_NUM_CORE_EVENTS) {
 125                         list_add_tail(&entry->list, &fh->events[ev_idx]);
 126                         /* drop the oldest event */
 127                         entry = list_first_entry(&fh->events[ev_idx],
 128                                                  struct cec_event_entry, list);
 129                         list_del(&entry->list);
 130                         kfree(entry);
 131                 }
 132         }
 133         /* Mark that events were lost */
 134         entry = list_first_entry_or_null(&fh->events[ev_idx],
 135                                          struct cec_event_entry, list);
 136         if (entry)
 137                 entry->ev.flags |= CEC_EVENT_FL_DROPPED_EVENTS;
 138
 139 unlock:
 140         mutex_unlock(&fh->lock);
 141         wake_up_interruptible(&fh->wait);
 142 }
 143
 144 /* Queue a new event for all open filehandles. */
 145 static void cec_queue_event(struct cec_adapter *adap,
 146                             const struct cec_event *ev)
 147 {
 148         u64 ts = ktime_get_ns();
 149         struct cec_fh *fh;
 150
 151         mutex_lock(&adap->devnode.lock);
 152         list_for_each_entry(fh, &adap->devnode.fhs, list)
 153                 cec_queue_event_fh(fh, ev, ts);
 154         mutex_unlock(&adap->devnode.lock);
 155 }
 156
 157 /* Notify userspace that the CEC pin changed state at the given time. */
 158 void cec_queue_pin_cec_event(struct cec_adapter *adap, bool is_high,
 159                              bool dropped_events, ktime_t ts)
 160 {
 161         struct cec_event ev = {
 162                 .event = is_high ? CEC_EVENT_PIN_CEC_HIGH :
 163                                    CEC_EVENT_PIN_CEC_LOW,
 164                 .flags = dropped_events ? CEC_EVENT_FL_DROPPED_EVENTS : 0,
 165         };
 166         struct cec_fh *fh;
 167
 168         mutex_lock(&adap->devnode.lock);
 169         list_for_each_entry(fh, &adap->devnode.fhs, list)
 170                 if (fh->mode_follower == CEC_MODE_MONITOR_PIN)
 171                         cec_queue_event_fh(fh, &ev, ktime_to_ns(ts));
 172         mutex_unlock(&adap->devnode.lock);
 173 }
 174 EXPORT_SYMBOL_GPL(cec_queue_pin_cec_event);
 175
 176 /* Notify userspace that the HPD pin changed state at the given time. */
 177 void cec_queue_pin_hpd_event(struct cec_adapter *adap, bool is_high, ktime_t ts)
 178 {
 179         struct cec_event ev = {
 180                 .event = is_high ? CEC_EVENT_PIN_HPD_HIGH :
 181                                    CEC_EVENT_PIN_HPD_LOW,
 182         };
 183         struct cec_fh *fh;
 184
 185         mutex_lock(&adap->devnode.lock);
 186         list_for_each_entry(fh, &adap->devnode.fhs, list)
 187                 cec_queue_event_fh(fh, &ev, ktime_to_ns(ts));
 188         mutex_unlock(&adap->devnode.lock);
 189 }
 190 EXPORT_SYMBOL_GPL(cec_queue_pin_hpd_event);
 191
 192 /* Notify userspace that the 5V pin changed state at the given time. */
 193 void cec_queue_pin_5v_event(struct cec_adapter *adap, bool is_high, ktime_t ts)
 194 {
 195         struct cec_event ev = {
 196                 .event = is_high ? CEC_EVENT_PIN_5V_HIGH :
 197                                    CEC_EVENT_PIN_5V_LOW,
 198         };
 199         struct cec_fh *fh;
 200
 201         mutex_lock(&adap->devnode.lock);
 202         list_for_each_entry(fh, &adap->devnode.fhs, list)
 203                 cec_queue_event_fh(fh, &ev, ktime_to_ns(ts));
 204         mutex_unlock(&adap->devnode.lock);
 205 }
 206 EXPORT_SYMBOL_GPL(cec_queue_pin_5v_event);
 207
 208 /*
 209  * Queue a new message for this filehandle.
 210  *
 211  * We keep a queue of at most CEC_MAX_MSG_RX_QUEUE_SZ messages. If the
 212  * queue becomes full, then drop the oldest message and keep track
 213  * of how many messages we've dropped.
 214  */
 215 static void cec_queue_msg_fh(struct cec_fh *fh, const struct cec_msg *msg)
 216 {
 217         static const struct cec_event ev_lost_msgs = {
 218                 .event = CEC_EVENT_LOST_MSGS,
 219                 .flags = 0,
 220                 {
 221                         .lost_msgs = { 1 },
 222                 },
 223         };
 224         struct cec_msg_entry *entry;
 225
 226         mutex_lock(&fh->lock);
 227         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
 228         if (entry) {
 229                 entry->msg = *msg;
 230                 /* Add new msg at the end of the queue */
 231                 list_add_tail(&entry->list, &fh->msgs);
 232
 233                 if (fh->queued_msgs < CEC_MAX_MSG_RX_QUEUE_SZ) {
 234                         /* All is fine if there is enough room */
 235                         fh->queued_msgs++;
 236                         mutex_unlock(&fh->lock);
 237                         wake_up_interruptible(&fh->wait);
 238                         return;
 239                 }
 240
 241                 /*
 242                  * if the message queue is full, then drop the oldest one and
 243                  * send a lost message event.
 244                  */
 245                 entry = list_first_entry(&fh->msgs, struct cec_msg_entry, list);
 246                 list_del(&entry->list);
 247                 kfree(entry);
 248         }
 249         mutex_unlock(&fh->lock);
 250
 251         /*
 252          * We lost a message, either because kmalloc failed or the queue
 253          * was full.
 254          */
 255         cec_queue_event_fh(fh, &ev_lost_msgs, ktime_get_ns());
 256 }
 257
 258 /*
 259  * Queue the message for those filehandles that are in monitor mode.
 260  * If valid_la is true (this message is for us or was sent by us),
 261  * then pass it on to any monitoring filehandle. If this message
 262  * isn't for us or from us, then only give it to filehandles that
 263  * are in MONITOR_ALL mode.
 264  *
 265  * This can only happen if the CEC_CAP_MONITOR_ALL capability is
 266  * set and the CEC adapter was placed in 'monitor all' mode.
 267  */
 268 static void cec_queue_msg_monitor(struct cec_adapter *adap,
 269                                   const struct cec_msg *msg,
 270                                   bool valid_la)
 271 {
 272         struct cec_fh *fh;
 273         u32 monitor_mode = valid_la ? CEC_MODE_MONITOR :
 274                                       CEC_MODE_MONITOR_ALL;
 275
 276         mutex_lock(&adap->devnode.lock);
 277         list_for_each_entry(fh, &adap->devnode.fhs, list) {
 278                 if (fh->mode_follower >= monitor_mode)
 279                         cec_queue_msg_fh(fh, msg);
 280         }
 281         mutex_unlock(&adap->devnode.lock);
 282 }
 283
 284 /*
 285  * Queue the message for follower filehandles.
 286  */
 287 static void cec_queue_msg_followers(struct cec_adapter *adap,
 288                                     const struct cec_msg *msg)
 289 {
 290         struct cec_fh *fh;
 291
 292         mutex_lock(&adap->devnode.lock);
 293         list_for_each_entry(fh, &adap->devnode.fhs, list) {
 294                 if (fh->mode_follower == CEC_MODE_FOLLOWER)
 295                         cec_queue_msg_fh(fh, msg);
 296         }
 297         mutex_unlock(&adap->devnode.lock);
 298 }
 299
 300 /* Notify userspace of an adapter state change. */
 301 static void cec_post_state_event(struct cec_adapter *adap)
 302 {
 303         struct cec_event ev = {
 304                 .event = CEC_EVENT_STATE_CHANGE,
 305         };
 306
 307         ev.state_change.phys_addr = adap->phys_addr;
 308         ev.state_change.log_addr_mask = adap->log_addrs.log_addr_mask;
 309         cec_queue_event(adap, &ev);
 310 }
 311
 312 /*
 313  * A CEC transmit (and a possible wait for reply) completed.
 314  * If this was in blocking mode, then complete it, otherwise
 315  * queue the message for userspace to dequeue later.
 316  *
 317  * This function is called with adap->lock held.
 318  */
 319 static void cec_data_completed(struct cec_data *data)
 320 {
 321         /*
 322          * Delete this transmit from the filehandle's xfer_list since
 323          * we're done with it.
 324          *
 325          * Note that if the filehandle is closed before this transmit
 326          * finished, then the release() function will set data->fh to NULL.
 327          * Without that we would be referring to a closed filehandle.
 328          */
 329         if (data->fh)
 330                 list_del(&data->xfer_list);
 331
 332         if (data->blocking) {
 333                 /*
 334                  * Someone is blocking so mark the message as completed
 335                  * and call complete.
 336                  */
 337                 data->completed = true;
 338                 complete(&data->c);
 339         } else {
 340                 /*
 341                  * No blocking, so just queue the message if needed and
 342                  * free the memory.
 343                  */
 344                 if (data->fh)
 345                         cec_queue_msg_fh(data->fh, &data->msg);
 346                 kfree(data);
 347         }
 348 }
 349
 350 /*
 351  * A pending CEC transmit needs to be cancelled, either because the CEC
 352  * adapter is disabled or the transmit takes an impossibly long time to
 353  * finish.
 354  *
 355  * This function is called with adap->lock held.
 356  */
 357 static void cec_data_cancel(struct cec_data *data, u8 tx_status)
 358 {
 359         /*
 360          * It's either the current transmit, or it is a pending
 361          * transmit. Take the appropriate action to clear it.
 362          */
 363         if (data->adap->transmitting == data) {
 364                 data->adap->transmitting = NULL;
 365         } else {
 366                 list_del_init(&data->list);
 367                 if (!(data->msg.tx_status & CEC_TX_STATUS_OK))
 368                         data->adap->transmit_queue_sz--;
 369         }
 370
 371         if (data->msg.tx_status & CEC_TX_STATUS_OK) {
 372                 data->msg.rx_ts = ktime_get_ns();
 373                 data->msg.rx_status = CEC_RX_STATUS_ABORTED;
 374         } else {
 375                 data->msg.tx_ts = ktime_get_ns();
 376                 data->msg.tx_status |= tx_status |
 377                                        CEC_TX_STATUS_MAX_RETRIES;
 378                 data->msg.tx_error_cnt++;
 379                 data->attempts = 0;
 380         }
 381
 382         /* Queue transmitted message for monitoring purposes */
 383         cec_queue_msg_monitor(data->adap, &data->msg, 1);
 384
 385         cec_data_completed(data);
 386 }
 387
 388 /*
 389  * Flush all pending transmits and cancel any pending timeout work.
 390  *
 391  * This function is called with adap->lock held.
 392  */
 393 static void cec_flush(struct cec_adapter *adap)
 394 {
 395         struct cec_data *data, *n;
 396
 397         /*
 398          * If the adapter is disabled, or we're asked to stop,
 399          * then cancel any pending transmits.
 400          */
 401         while (!list_empty(&adap->transmit_queue)) {
 402                 data = list_first_entry(&adap->transmit_queue,
 403                                         struct cec_data, list);
 404                 cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
 405         }
 406         if (adap->transmitting)
 407                 cec_data_cancel(adap->transmitting, CEC_TX_STATUS_ABORTED);
 408
 409         /* Cancel the pending timeout work. */
 410         list_for_each_entry_safe(data, n, &adap->wait_queue, list) {
 411                 if (cancel_delayed_work(&data->work))
 412                         cec_data_cancel(data, CEC_TX_STATUS_OK);
 413                 /*
 414                  * If cancel_delayed_work returned false, then
 415                  * the cec_wait_timeout function is running,
 416                  * which will call cec_data_completed. So no
 417                  * need to do anything special in that case.
 418                  */
 419         }
 420 }
 421
 422 /*
 423  * Main CEC state machine
 424  *
 425  * Wait until the thread should be stopped, or we are not transmitting and
 426  * a new transmit message is queued up, in which case we start transmitting
 427  * that message. When the adapter finished transmitting the message it will
 428  * call cec_transmit_done().
 429  *
 430  * If the adapter is disabled, then remove all queued messages instead.
 431  *
 432  * If the current transmit times out, then cancel that transmit.
 433  */
 434 int cec_thread_func(void *_adap)
 435 {
 436         struct cec_adapter *adap = _adap;
 437
 438         for (;;) {
 439                 unsigned int signal_free_time;
 440                 struct cec_data *data;
 441                 bool timeout = false;
 442                 u8 attempts;
 443
 444                 if (adap->transmitting) {
 445                         int err;
 446
 447                         /*
 448                          * We are transmitting a message, so add a timeout
 449                          * to prevent the state machine to get stuck waiting
 450                          * for this message to finalize and add a check to
 451                          * see if the adapter is disabled in which case the
 452                          * transmit should be canceled.
 453                          */
 454                         err = wait_event_interruptible_timeout(adap->kthread_waitq,
 455                                 (adap->needs_hpd &&
 456                                  (!adap->is_configured && !adap->is_configuring)) ||
 457                                 kthread_should_stop() ||
 458                                 (!adap->transmitting &&
 459                                  !list_empty(&adap->transmit_queue)),
 460                                 msecs_to_jiffies(CEC_XFER_TIMEOUT_MS));
 461                         timeout = err == 0;
 462                 } else {
 463                         /* Otherwise we just wait for something to happen. */
 464                         wait_event_interruptible(adap->kthread_waitq,
 465                                 kthread_should_stop() ||
 466                                 (!adap->transmitting &&
 467                                  !list_empty(&adap->transmit_queue)));
 468                 }
 469
 470                 mutex_lock(&adap->lock);
 471
 472                 if ((adap->needs_hpd &&
 473                      (!adap->is_configured && !adap->is_configuring)) ||
 474                     kthread_should_stop()) {
 475                         cec_flush(adap);
 476                         goto unlock;
 477                 }
 478
 479                 if (adap->transmitting && timeout) {
 480                         /*
 481                          * If we timeout, then log that. Normally this does
 482                          * not happen and it is an indication of a faulty CEC
 483                          * adapter driver, or the CEC bus is in some weird
 484                          * state. On rare occasions it can happen if there is
 485                          * so much traffic on the bus that the adapter was
 486                          * unable to transmit for CEC_XFER_TIMEOUT_MS (2.1s).
 487                          */
 488                         pr_warn("cec-%s: message %*ph timed out\n", adap->name,
 489                                 adap->transmitting->msg.len,
 490                                 adap->transmitting->msg.msg);
 491                         adap->tx_timeouts++;
 492                         /* Just give up on this. */
 493                         cec_data_cancel(adap->transmitting,
 494                                         CEC_TX_STATUS_TIMEOUT);
 495                         goto unlock;
 496                 }
 497
 498                 /*
 499                  * If we are still transmitting, or there is nothing new to
 500                  * transmit, then just continue waiting.
 501                  */
 502                 if (adap->transmitting || list_empty(&adap->transmit_queue))
 503                         goto unlock;
 504
 505                 /* Get a new message to transmit */
 506                 data = list_first_entry(&adap->transmit_queue,
 507                                         struct cec_data, list);
 508                 list_del_init(&data->list);
 509                 adap->transmit_queue_sz--;
 510
 511                 /* Make this the current transmitting message */
 512                 adap->transmitting = data;
 513
 514                 /*
 515                  * Suggested number of attempts as per the CEC 2.0 spec:
 516                  * 4 attempts is the default, except for 'secondary poll
 517                  * messages', i.e. poll messages not sent during the adapter
 518                  * configuration phase when it allocates logical addresses.
 519                  */
 520                 if (data->msg.len == 1 && adap->is_configured)
 521                         attempts = 2;
 522                 else
 523                         attempts = 4;
 524
 525                 /* Set the suggested signal free time */
 526                 if (data->attempts) {
 527                         /* should be >= 3 data bit periods for a retry */
 528                         signal_free_time = CEC_SIGNAL_FREE_TIME_RETRY;
 529                 } else if (adap->last_initiator !=
 530                            cec_msg_initiator(&data->msg)) {
 531                         /* should be >= 5 data bit periods for new initiator */
 532                         signal_free_time = CEC_SIGNAL_FREE_TIME_NEW_INITIATOR;
 533                         adap->last_initiator = cec_msg_initiator(&data->msg);
 534                 } else {
 535                         /*
 536                          * should be >= 7 data bit periods for sending another
 537                          * frame immediately after another.
 538                          */
 539                         signal_free_time = CEC_SIGNAL_FREE_TIME_NEXT_XFER;
 540                 }
 541                 if (data->attempts == 0)
 542                         data->attempts = attempts;
 543
 544                 /* Tell the adapter to transmit, cancel on error */
 545                 if (adap->ops->adap_transmit(adap, data->attempts,
 546                                              signal_free_time, &data->msg))
 547                         cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
 548
 549 unlock:
 550                 mutex_unlock(&adap->lock);
 551
 552                 if (kthread_should_stop())
 553                         break;
 554         }
 555         return 0;
 556 }
 557
 558 /*
 559  * Called by the CEC adapter if a transmit finished.
 560  */
 561 void cec_transmit_done_ts(struct cec_adapter *adap, u8 status,
 562                           u8 arb_lost_cnt, u8 nack_cnt, u8 low_drive_cnt,
 563                           u8 error_cnt, ktime_t ts)
 564 {
 565         struct cec_data *data;
 566         struct cec_msg *msg;
 567         unsigned int attempts_made = arb_lost_cnt + nack_cnt +
 568                                      low_drive_cnt + error_cnt;
 569
 570         dprintk(2, "%s: status 0x%02x\n", __func__, status);
 571         if (attempts_made < 1)
 572                 attempts_made = 1;
 573
 574         mutex_lock(&adap->lock);
 575         data = adap->transmitting;
 576         if (!data) {
 577                 /*
 578                  * This can happen if a transmit was issued and the cable is
 579                  * unplugged while the transmit is ongoing. Ignore this
 580                  * transmit in that case.
 581                  */
 582                 dprintk(1, "%s was called without an ongoing transmit!\n",
 583                         __func__);
 584                 goto unlock;
 585         }
 586
 587         msg = &data->msg;
 588
 589         /* Drivers must fill in the status! */
 590         WARN_ON(status == 0);
 591         msg->tx_ts = ktime_to_ns(ts);
 592         msg->tx_status |= status;
 593         msg->tx_arb_lost_cnt += arb_lost_cnt;
 594         msg->tx_nack_cnt += nack_cnt;
 595         msg->tx_low_drive_cnt += low_drive_cnt;
 596         msg->tx_error_cnt += error_cnt;
 597
 598         /* Mark that we're done with this transmit */
 599         adap->transmitting = NULL;
 600
 601         /*
 602          * If there are still retry attempts left and there was an error and
 603          * the hardware didn't signal that it retried itself (by setting
 604          * CEC_TX_STATUS_MAX_RETRIES), then we will retry ourselves.
 605          */
 606         if (data->attempts > attempts_made &&
 607             !(status & (CEC_TX_STATUS_MAX_RETRIES | CEC_TX_STATUS_OK))) {
 608                 /* Retry this message */
 609                 data->attempts -= attempts_made;
 610                 if (msg->timeout)
 611                         dprintk(2, "retransmit: %*ph (attempts: %d, wait for 0x%02x)\n",
 612                                 msg->len, msg->msg, data->attempts, msg->reply);
 613                 else
 614                         dprintk(2, "retransmit: %*ph (attempts: %d)\n",
 615                                 msg->len, msg->msg, data->attempts);
 616                 /* Add the message in front of the transmit queue */
 617                 list_add(&data->list, &adap->transmit_queue);
 618                 adap->transmit_queue_sz++;
 619                 goto wake_thread;
 620         }
 621
 622         data->attempts = 0;
 623
 624         /* Always set CEC_TX_STATUS_MAX_RETRIES on error */
 625         if (!(status & CEC_TX_STATUS_OK))
 626                 msg->tx_status |= CEC_TX_STATUS_MAX_RETRIES;
 627
 628         /* Queue transmitted message for monitoring purposes */
 629         cec_queue_msg_monitor(adap, msg, 1);
 630
 631         if ((status & CEC_TX_STATUS_OK) && adap->is_configured &&
 632             msg->timeout) {
 633                 /*
 634                  * Queue the message into the wait queue if we want to wait
 635                  * for a reply.
 636                  */
 637                 list_add_tail(&data->list, &adap->wait_queue);
 638                 schedule_delayed_work(&data->work,
 639                                       msecs_to_jiffies(msg->timeout));
 640         } else {
 641                 /* Otherwise we're done */
 642                 cec_data_completed(data);
 643         }
 644
 645 wake_thread:
 646         /*
 647          * Wake up the main thread to see if another message is ready
 648          * for transmitting or to retry the current message.
 649          */
 650         wake_up_interruptible(&adap->kthread_waitq);
 651 unlock:
 652         mutex_unlock(&adap->lock);
 653 }
 654 EXPORT_SYMBOL_GPL(cec_transmit_done_ts);
 655
 656 void cec_transmit_attempt_done_ts(struct cec_adapter *adap,
 657                                   u8 status, ktime_t ts)
 658 {
 659         switch (status & ~CEC_TX_STATUS_MAX_RETRIES) {
 660         case CEC_TX_STATUS_OK:
 661                 cec_transmit_done_ts(adap, status, 0, 0, 0, 0, ts);
 662                 return;
 663         case CEC_TX_STATUS_ARB_LOST:
 664                 cec_transmit_done_ts(adap, status, 1, 0, 0, 0, ts);
 665                 return;
 666         case CEC_TX_STATUS_NACK:
 667                 cec_transmit_done_ts(adap, status, 0, 1, 0, 0, ts);
 668                 return;
 669         case CEC_TX_STATUS_LOW_DRIVE:
 670                 cec_transmit_done_ts(adap, status, 0, 0, 1, 0, ts);
 671                 return;
 672         case CEC_TX_STATUS_ERROR:
 673                 cec_transmit_done_ts(adap, status, 0, 0, 0, 1, ts);
 674                 return;
 675         default:
 676                 /* Should never happen */
 677                 WARN(1, "cec-%s: invalid status 0x%02x\n", adap->name, status);
 678                 return;
 679         }
 680 }
 681 EXPORT_SYMBOL_GPL(cec_transmit_attempt_done_ts);
 682
 683 /*
 684  * Called when waiting for a reply times out.
 685  */
 686 static void cec_wait_timeout(struct work_struct *work)
 687 {
 688         struct cec_data *data = container_of(work, struct cec_data, work.work);
 689         struct cec_adapter *adap = data->adap;
 690
 691         mutex_lock(&adap->lock);
 692         /*
 693          * Sanity check in case the timeout and the arrival of the message
 694          * happened at the same time.
 695          */
 696         if (list_empty(&data->list))
 697                 goto unlock;
 698
 699         /* Mark the message as timed out */
 700         list_del_init(&data->list);
 701         data->msg.rx_ts = ktime_get_ns();
 702         data->msg.rx_status = CEC_RX_STATUS_TIMEOUT;
 703         cec_data_completed(data);
 704 unlock:
 705         mutex_unlock(&adap->lock);
 706 }
 707
 708 /*
 709  * Transmit a message. The fh argument may be NULL if the transmit is not
 710  * associated with a specific filehandle.
 711  *
 712  * This function is called with adap->lock held.
 713  */
 714 int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
 715                         struct cec_fh *fh, bool block)
 716 {
 717         struct cec_data *data;
 718
 719         msg->rx_ts = 0;
 720         msg->tx_ts = 0;
 721         msg->rx_status = 0;
 722         msg->tx_status = 0;
 723         msg->tx_arb_lost_cnt = 0;
 724         msg->tx_nack_cnt = 0;
 725         msg->tx_low_drive_cnt = 0;
 726         msg->tx_error_cnt = 0;
 727         msg->sequence = 0;
 728
 729         if (msg->reply && msg->timeout == 0) {
 730                 /* Make sure the timeout isn't 0. */
 731                 msg->timeout = 1000;
 732         }
 733         if (msg->timeout)
 734                 msg->flags &= CEC_MSG_FL_REPLY_TO_FOLLOWERS;
 735         else
 736                 msg->flags = 0;
 737
 738         if (msg->len > 1 && msg->msg[1] == CEC_MSG_CDC_MESSAGE) {
 739                 msg->msg[2] = adap->phys_addr >> 8;
 740                 msg->msg[3] = adap->phys_addr & 0xff;
 741         }
 742
 743         /* Sanity checks */
 744         if (msg->len == 0 || msg->len > CEC_MAX_MSG_SIZE) {
 745                 dprintk(1, "%s: invalid length %d\n", __func__, msg->len);
 746                 return -EINVAL;
 747         }
 748
 749         memset(msg->msg + msg->len, 0, sizeof(msg->msg) - msg->len);
 750
 751         if (msg->timeout)
 752                 dprintk(2, "%s: %*ph (wait for 0x%02x%s)\n",
 753                         __func__, msg->len, msg->msg, msg->reply,
 754                         !block ? ", nb" : "");
 755         else
 756                 dprintk(2, "%s: %*ph%s\n",
 757                         __func__, msg->len, msg->msg, !block ? " (nb)" : "");
 758
 759         if (msg->timeout && msg->len == 1) {
 760                 dprintk(1, "%s: can't reply to poll msg\n", __func__);
 761                 return -EINVAL;
 762         }
 763         if (msg->len == 1) {
 764                 if (cec_msg_destination(msg) == 0xf) {
 765                         dprintk(1, "%s: invalid poll message\n", __func__);
 766                         return -EINVAL;
 767                 }
 768                 if (cec_has_log_addr(adap, cec_msg_destination(msg))) {
 769                         /*
 770                          * If the destination is a logical address our adapter
 771                          * has already claimed, then just NACK this.
 772                          * It depends on the hardware what it will do with a
 773                          * POLL to itself (some OK this), so it is just as
 774                          * easy to handle it here so the behavior will be
 775                          * consistent.
 776                          */
 777                         msg->tx_ts = ktime_get_ns();
 778                         msg->tx_status = CEC_TX_STATUS_NACK |
 779                                          CEC_TX_STATUS_MAX_RETRIES;
 780                         msg->tx_nack_cnt = 1;
 781                         msg->sequence = ++adap->sequence;
 782                         if (!msg->sequence)
 783                                 msg->sequence = ++adap->sequence;
 784                         return 0;
 785                 }
 786         }
 787         if (msg->len > 1 && !cec_msg_is_broadcast(msg) &&
 788             cec_has_log_addr(adap, cec_msg_destination(msg))) {
 789                 dprintk(1, "%s: destination is the adapter itself\n", __func__);
 790                 return -EINVAL;
 791         }
 792         if (msg->len > 1 && adap->is_configured &&
 793             !cec_has_log_addr(adap, cec_msg_initiator(msg))) {
 794                 dprintk(1, "%s: initiator has unknown logical address %d\n",
 795                         __func__, cec_msg_initiator(msg));
 796                 return -EINVAL;
 797         }
 798         if (!adap->is_configured && !adap->is_configuring) {
 799                 if (adap->needs_hpd || msg->msg[0] != 0xf0) {
 800                         dprintk(1, "%s: adapter is unconfigured\n", __func__);
 801                         return -ENONET;
 802                 }
 803                 if (msg->reply) {
 804                         dprintk(1, "%s: invalid msg->reply\n", __func__);
 805                         return -EINVAL;
 806                 }
 807         }
 808
 809         if (adap->transmit_queue_sz >= CEC_MAX_MSG_TX_QUEUE_SZ) {
 810                 dprintk(1, "%s: transmit queue full\n", __func__);
 811                 return -EBUSY;
 812         }
 813
 814         data = kzalloc(sizeof(*data), GFP_KERNEL);
 815         if (!data)
 816                 return -ENOMEM;
 817
 818         msg->sequence = ++adap->sequence;
 819         if (!msg->sequence)
 820                 msg->sequence = ++adap->sequence;
 821
 822         data->msg = *msg;
 823         data->fh = fh;
 824         data->adap = adap;
 825         data->blocking = block;
 826
 827         init_completion(&data->c);
 828         INIT_DELAYED_WORK(&data->work, cec_wait_timeout);
 829
 830         if (fh)
 831                 list_add_tail(&data->xfer_list, &fh->xfer_list);
 832
 833         list_add_tail(&data->list, &adap->transmit_queue);
 834         adap->transmit_queue_sz++;
 835         if (!adap->transmitting)
 836                 wake_up_interruptible(&adap->kthread_waitq);
 837
 838         /* All done if we don't need to block waiting for completion */
 839         if (!block)
 840                 return 0;
 841
 842         /*
 843          * Release the lock and wait, retake the lock afterwards.
 844          */
 845         mutex_unlock(&adap->lock);
 846         wait_for_completion_killable(&data->c);
 847         if (!data->completed)
 848                 cancel_delayed_work_sync(&data->work);
 849         mutex_lock(&adap->lock);
 850
 851         /* Cancel the transmit if it was interrupted */
 852         if (!data->completed)
 853                 cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
 854
 855         /* The transmit completed (possibly with an error) */
 856         *msg = data->msg;
 857         kfree(data);
 858         return 0;
 859 }
 860
 861 /* Helper function to be used by drivers and this framework. */
 862 int cec_transmit_msg(struct cec_adapter *adap, struct cec_msg *msg,
 863                      bool block)
 864 {
 865         int ret;
 866
 867         mutex_lock(&adap->lock);
 868         ret = cec_transmit_msg_fh(adap, msg, NULL, block);
 869         mutex_unlock(&adap->lock);
 870         return ret;
 871 }
 872 EXPORT_SYMBOL_GPL(cec_transmit_msg);
 873
 874 /*
 875  * I don't like forward references but without this the low-level
 876  * cec_received_msg() function would come after a bunch of high-level
 877  * CEC protocol handling functions. That was very confusing.
 878  */
 879 static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
 880                               bool is_reply);
 881
 882 #define DIRECTED        0x80
 883 #define BCAST1_4        0x40
 884 #define BCAST2_0        0x20    /* broadcast only allowed for >= 2.0 */
 885 #define BCAST           (BCAST1_4 | BCAST2_0)
 886 #define BOTH            (BCAST | DIRECTED)
 887
 888 /*
 889  * Specify minimum length and whether the message is directed, broadcast
 890  * or both. Messages that do not match the criteria are ignored as per
 891  * the CEC specification.
 892  */
 893 static const u8 cec_msg_size[256] = {
 894         [CEC_MSG_ACTIVE_SOURCE] = 4 | BCAST,
 895         [CEC_MSG_IMAGE_VIEW_ON] = 2 | DIRECTED,
 896         [CEC_MSG_TEXT_VIEW_ON] = 2 | DIRECTED,
 897         [CEC_MSG_INACTIVE_SOURCE] = 4 | DIRECTED,
 898         [CEC_MSG_REQUEST_ACTIVE_SOURCE] = 2 | BCAST,
 899         [CEC_MSG_ROUTING_CHANGE] = 6 | BCAST,
 900         [CEC_MSG_ROUTING_INFORMATION] = 4 | BCAST,
 901         [CEC_MSG_SET_STREAM_PATH] = 4 | BCAST,
 902         [CEC_MSG_STANDBY] = 2 | BOTH,
 903         [CEC_MSG_RECORD_OFF] = 2 | DIRECTED,
 904         [CEC_MSG_RECORD_ON] = 3 | DIRECTED,
 905         [CEC_MSG_RECORD_STATUS] = 3 | DIRECTED,
 906         [CEC_MSG_RECORD_TV_SCREEN] = 2 | DIRECTED,
 907         [CEC_MSG_CLEAR_ANALOGUE_TIMER] = 13 | DIRECTED,
 908         [CEC_MSG_CLEAR_DIGITAL_TIMER] = 16 | DIRECTED,
 909         [CEC_MSG_CLEAR_EXT_TIMER] = 13 | DIRECTED,
 910         [CEC_MSG_SET_ANALOGUE_TIMER] = 13 | DIRECTED,
 911         [CEC_MSG_SET_DIGITAL_TIMER] = 16 | DIRECTED,
 912         [CEC_MSG_SET_EXT_TIMER] = 13 | DIRECTED,
 913         [CEC_MSG_SET_TIMER_PROGRAM_TITLE] = 2 | DIRECTED,
 914         [CEC_MSG_TIMER_CLEARED_STATUS] = 3 | DIRECTED,
 915         [CEC_MSG_TIMER_STATUS] = 3 | DIRECTED,
 916         [CEC_MSG_CEC_VERSION] = 3 | DIRECTED,
 917         [CEC_MSG_GET_CEC_VERSION] = 2 | DIRECTED,
 918         [CEC_MSG_GIVE_PHYSICAL_ADDR] = 2 | DIRECTED,
 919         [CEC_MSG_GET_MENU_LANGUAGE] = 2 | DIRECTED,
 920         [CEC_MSG_REPORT_PHYSICAL_ADDR] = 5 | BCAST,
 921         [CEC_MSG_SET_MENU_LANGUAGE] = 5 | BCAST,
 922         [CEC_MSG_REPORT_FEATURES] = 6 | BCAST,
 923         [CEC_MSG_GIVE_FEATURES] = 2 | DIRECTED,
 924         [CEC_MSG_DECK_CONTROL] = 3 | DIRECTED,
 925         [CEC_MSG_DECK_STATUS] = 3 | DIRECTED,
 926         [CEC_MSG_GIVE_DECK_STATUS] = 3 | DIRECTED,
 927         [CEC_MSG_PLAY] = 3 | DIRECTED,
 928         [CEC_MSG_GIVE_TUNER_DEVICE_STATUS] = 3 | DIRECTED,
 929         [CEC_MSG_SELECT_ANALOGUE_SERVICE] = 6 | DIRECTED,
 930         [CEC_MSG_SELECT_DIGITAL_SERVICE] = 9 | DIRECTED,
 931         [CEC_MSG_TUNER_DEVICE_STATUS] = 7 | DIRECTED,
 932         [CEC_MSG_TUNER_STEP_DECREMENT] = 2 | DIRECTED,
 933         [CEC_MSG_TUNER_STEP_INCREMENT] = 2 | DIRECTED,
 934         [CEC_MSG_DEVICE_VENDOR_ID] = 5 | BCAST,
 935         [CEC_MSG_GIVE_DEVICE_VENDOR_ID] = 2 | DIRECTED,
 936         [CEC_MSG_VENDOR_COMMAND] = 2 | DIRECTED,
 937         [CEC_MSG_VENDOR_COMMAND_WITH_ID] = 5 | BOTH,
 938         [CEC_MSG_VENDOR_REMOTE_BUTTON_DOWN] = 2 | BOTH,
 939         [CEC_MSG_VENDOR_REMOTE_BUTTON_UP] = 2 | BOTH,
 940         [CEC_MSG_SET_OSD_STRING] = 3 | DIRECTED,
 941         [CEC_MSG_GIVE_OSD_NAME] = 2 | DIRECTED,
 942         [CEC_MSG_SET_OSD_NAME] = 2 | DIRECTED,
 943         [CEC_MSG_MENU_REQUEST] = 3 | DIRECTED,
 944         [CEC_MSG_MENU_STATUS] = 3 | DIRECTED,
 945         [CEC_MSG_USER_CONTROL_PRESSED] = 3 | DIRECTED,
 946         [CEC_MSG_USER_CONTROL_RELEASED] = 2 | DIRECTED,
 947         [CEC_MSG_GIVE_DEVICE_POWER_STATUS] = 2 | DIRECTED,
 948         [CEC_MSG_REPORT_POWER_STATUS] = 3 | DIRECTED | BCAST2_0,
 949         [CEC_MSG_FEATURE_ABORT] = 4 | DIRECTED,
 950         [CEC_MSG_ABORT] = 2 | DIRECTED,
 951         [CEC_MSG_GIVE_AUDIO_STATUS] = 2 | DIRECTED,
 952         [CEC_MSG_GIVE_SYSTEM_AUDIO_MODE_STATUS] = 2 | DIRECTED,
 953         [CEC_MSG_REPORT_AUDIO_STATUS] = 3 | DIRECTED,
 954         [CEC_MSG_REPORT_SHORT_AUDIO_DESCRIPTOR] = 2 | DIRECTED,
 955         [CEC_MSG_REQUEST_SHORT_AUDIO_DESCRIPTOR] = 2 | DIRECTED,
 956         [CEC_MSG_SET_SYSTEM_AUDIO_MODE] = 3 | BOTH,
 957         [CEC_MSG_SYSTEM_AUDIO_MODE_REQUEST] = 2 | DIRECTED,
 958         [CEC_MSG_SYSTEM_AUDIO_MODE_STATUS] = 3 | DIRECTED,
 959         [CEC_MSG_SET_AUDIO_RATE] = 3 | DIRECTED,
 960         [CEC_MSG_INITIATE_ARC] = 2 | DIRECTED,
 961         [CEC_MSG_REPORT_ARC_INITIATED] = 2 | DIRECTED,
 962         [CEC_MSG_REPORT_ARC_TERMINATED] = 2 | DIRECTED,
 963         [CEC_MSG_REQUEST_ARC_INITIATION] = 2 | DIRECTED,
 964         [CEC_MSG_REQUEST_ARC_TERMINATION] = 2 | DIRECTED,
 965         [CEC_MSG_TERMINATE_ARC] = 2 | DIRECTED,
 966         [CEC_MSG_REQUEST_CURRENT_LATENCY] = 4 | BCAST,
 967         [CEC_MSG_REPORT_CURRENT_LATENCY] = 6 | BCAST,
 968         [CEC_MSG_CDC_MESSAGE] = 2 | BCAST,
 969 };
 970
 971 /* Called by the CEC adapter if a message is received */
 972 void cec_received_msg_ts(struct cec_adapter *adap,
 973                          struct cec_msg *msg, ktime_t ts)
 974 {
 975         struct cec_data *data;
 976         u8 msg_init = cec_msg_initiator(msg);
 977         u8 msg_dest = cec_msg_destination(msg);
 978         u8 cmd = msg->msg[1];
 979         bool is_reply = false;
 980         bool valid_la = true;
 981         u8 min_len = 0;
 982
 983         if (WARN_ON(!msg->len || msg->len > CEC_MAX_MSG_SIZE))
 984                 return;
 985
 986         /*
 987          * Some CEC adapters will receive the messages that they transmitted.
 988          * This test filters out those messages by checking if we are the
 989          * initiator, and just returning in that case.
 990          *
 991          * Note that this won't work if this is an Unregistered device.
 992          *
 993          * It is bad practice if the hardware receives the message that it
 994          * transmitted and luckily most CEC adapters behave correctly in this
 995          * respect.
 996          */
 997         if (msg_init != CEC_LOG_ADDR_UNREGISTERED &&
 998             cec_has_log_addr(adap, msg_init))
 999                 return;
1000
1001         msg->rx_ts = ktime_to_ns(ts);
1002         msg->rx_status = CEC_RX_STATUS_OK;
1003         msg->sequence = msg->reply = msg->timeout = 0;
1004         msg->tx_status = 0;
1005         msg->tx_ts = 0;
1006         msg->tx_arb_lost_cnt = 0;
1007         msg->tx_nack_cnt = 0;
1008         msg->tx_low_drive_cnt = 0;
1009         msg->tx_error_cnt = 0;
1010         msg->flags = 0;
1011         memset(msg->msg + msg->len, 0, sizeof(msg->msg) - msg->len);
1012
1013         mutex_lock(&adap->lock);
1014         dprintk(2, "%s: %*ph\n", __func__, msg->len, msg->msg);
1015
1016         adap->last_initiator = 0xff;
1017
1018         /* Check if this message was for us (directed or broadcast). */
1019         if (!cec_msg_is_broadcast(msg))
1020                 valid_la = cec_has_log_addr(adap, msg_dest);
1021
1022         /*
1023          * Check if the length is not too short or if the message is a
1024          * broadcast message where a directed message was expected or
1025          * vice versa. If so, then the message has to be ignored (according
1026          * to section CEC 7.3 and CEC 12.2).
1027          */
1028         if (valid_la && msg->len > 1 && cec_msg_size[cmd]) {
1029                 u8 dir_fl = cec_msg_size[cmd] & BOTH;
1030
1031                 min_len = cec_msg_size[cmd] & 0x1f;
1032                 if (msg->len < min_len)
1033                         valid_la = false;
1034                 else if (!cec_msg_is_broadcast(msg) && !(dir_fl & DIRECTED))
1035                         valid_la = false;
1036                 else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST1_4))
1037                         valid_la = false;
1038                 else if (cec_msg_is_broadcast(msg) &&
1039                          adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0 &&
1040                          !(dir_fl & BCAST2_0))
1041                         valid_la = false;
1042         }
1043         if (valid_la && min_len) {
1044                 /* These messages have special length requirements */
1045                 switch (cmd) {
1046                 case CEC_MSG_TIMER_STATUS:
1047                         if (msg->msg[2] & 0x10) {
1048                                 switch (msg->msg[2] & 0xf) {
1049                                 case CEC_OP_PROG_INFO_NOT_ENOUGH_SPACE:
1050                                 case CEC_OP_PROG_INFO_MIGHT_NOT_BE_ENOUGH_SPACE:
1051                                         if (msg->len < 5)
1052                                                 valid_la = false;
1053                                         break;
1054                                 }
1055                         } else if ((msg->msg[2] & 0xf) == CEC_OP_PROG_ERROR_DUPLICATE) {
1056                                 if (msg->len < 5)
1057                                         valid_la = false;
1058                         }
1059                         break;
1060                 case CEC_MSG_RECORD_ON:
1061                         switch (msg->msg[2]) {
1062                         case CEC_OP_RECORD_SRC_OWN:
1063                                 break;
1064                         case CEC_OP_RECORD_SRC_DIGITAL:
1065                                 if (msg->len < 10)
1066                                         valid_la = false;
1067                                 break;
1068                         case CEC_OP_RECORD_SRC_ANALOG:
1069                                 if (msg->len < 7)
1070                                         valid_la = false;
1071                                 break;
1072                         case CEC_OP_RECORD_SRC_EXT_PLUG:
1073                                 if (msg->len < 4)
1074                                         valid_la = false;
1075                                 break;
1076                         case CEC_OP_RECORD_SRC_EXT_PHYS_ADDR:
1077                                 if (msg->len < 5)
1078                                         valid_la = false;
1079                                 break;
1080                         }
1081                         break;
1082                 }
1083         }
1084
1085         /* It's a valid message and not a poll or CDC message */
1086         if (valid_la && msg->len > 1 && cmd != CEC_MSG_CDC_MESSAGE) {
1087                 bool abort = cmd == CEC_MSG_FEATURE_ABORT;
1088
1089                 /* The aborted command is in msg[2] */
1090                 if (abort)
1091                         cmd = msg->msg[2];
1092
1093                 /*
1094                  * Walk over all transmitted messages that are waiting for a
1095                  * reply.
1096                  */
1097                 list_for_each_entry(data, &adap->wait_queue, list) {
1098                         struct cec_msg *dst = &data->msg;
1099
1100                         /*
1101                          * The *only* CEC message that has two possible replies
1102                          * is CEC_MSG_INITIATE_ARC.
1103                          * In this case allow either of the two replies.
1104                          */
1105                         if (!abort && dst->msg[1] == CEC_MSG_INITIATE_ARC &&
1106                             (cmd == CEC_MSG_REPORT_ARC_INITIATED ||
1107                              cmd == CEC_MSG_REPORT_ARC_TERMINATED) &&
1108                             (dst->reply == CEC_MSG_REPORT_ARC_INITIATED ||
1109                              dst->reply == CEC_MSG_REPORT_ARC_TERMINATED))
1110                                 dst->reply = cmd;
1111
1112                         /* Does the command match? */
1113                         if ((abort && cmd != dst->msg[1]) ||
1114                             (!abort && cmd != dst->reply))
1115                                 continue;
1116
1117                         /* Does the addressing match? */
1118                         if (msg_init != cec_msg_destination(dst) &&
1119                             !cec_msg_is_broadcast(dst))
1120                                 continue;
1121
1122                         /* We got a reply */
1123                         memcpy(dst->msg, msg->msg, msg->len);
1124                         dst->len = msg->len;
1125                         dst->rx_ts = msg->rx_ts;
1126                         dst->rx_status = msg->rx_status;
1127                         if (abort)
1128                                 dst->rx_status |= CEC_RX_STATUS_FEATURE_ABORT;
1129                         msg->flags = dst->flags;
1130                         /* Remove it from the wait_queue */
1131                         list_del_init(&data->list);
1132
1133                         /* Cancel the pending timeout work */
1134                         if (!cancel_delayed_work(&data->work)) {
1135                                 mutex_unlock(&adap->lock);
1136                                 flush_scheduled_work();
1137                                 mutex_lock(&adap->lock);
1138                         }
1139                         /*
1140                          * Mark this as a reply, provided someone is still
1141                          * waiting for the answer.
1142                          */
1143                         if (data->fh)
1144                                 is_reply = true;
1145                         cec_data_completed(data);
1146                         break;
1147                 }
1148         }
1149         mutex_unlock(&adap->lock);
1150
1151         /* Pass the message on to any monitoring filehandles */
1152         cec_queue_msg_monitor(adap, msg, valid_la);
1153
1154         /* We're done if it is not for us or a poll message */
1155         if (!valid_la || msg->len <= 1)
1156                 return;
1157
1158         if (adap->log_addrs.log_addr_mask == 0)
1159                 return;
1160
1161         /*
1162          * Process the message on the protocol level. If is_reply is true,
1163          * then cec_receive_notify() won't pass on the reply to the listener(s)
1164          * since that was already done by cec_data_completed() above.
1165          */
1166         cec_receive_notify(adap, msg, is_reply);
1167 }
1168 EXPORT_SYMBOL_GPL(cec_received_msg_ts);
1169
1170 /* Logical Address Handling */
1171
1172 /*
1173  * Attempt to claim a specific logical address.
1174  *
1175  * This function is called with adap->lock held.
1176  */
1177 static int cec_config_log_addr(struct cec_adapter *adap,
1178                                unsigned int idx,
1179                                unsigned int log_addr)
1180 {
1181         struct cec_log_addrs *las = &adap->log_addrs;
1182         struct cec_msg msg = { };
1183         int err;
1184
1185         if (cec_has_log_addr(adap, log_addr))
1186                 return 0;
1187
1188         /* Send poll message */
1189         msg.len = 1;
1190         msg.msg[0] = (log_addr << 4) | log_addr;
1191         err = cec_transmit_msg_fh(adap, &msg, NULL, true);
1192
1193         /*
1194          * While trying to poll the physical address was reset
1195          * and the adapter was unconfigured, so bail out.
1196          */
1197         if (!adap->is_configuring)
1198                 return -EINTR;
1199
1200         if (err)
1201                 return err;
1202
1203         if (msg.tx_status & CEC_TX_STATUS_OK)
1204                 return 0;
1205
1206         /*
1207          * Message not acknowledged, so this logical
1208          * address is free to use.
1209          */
1210         err = adap->ops->adap_log_addr(adap, log_addr);
1211         if (err)
1212                 return err;
1213
1214         las->log_addr[idx] = log_addr;
1215         las->log_addr_mask |= 1 << log_addr;
1216         adap->phys_addrs[log_addr] = adap->phys_addr;
1217         return 1;
1218 }
1219
1220 /*
1221  * Unconfigure the adapter: clear all logical addresses and send
1222  * the state changed event.
1223  *
1224  * This function is called with adap->lock held.
1225  */
1226 static void cec_adap_unconfigure(struct cec_adapter *adap)
1227 {
1228         if (!adap->needs_hpd ||
1229             adap->phys_addr != CEC_PHYS_ADDR_INVALID)
1230                 WARN_ON(adap->ops->adap_log_addr(adap, CEC_LOG_ADDR_INVALID));
1231         adap->log_addrs.log_addr_mask = 0;
1232         adap->is_configuring = false;
1233         adap->is_configured = false;
1234         memset(adap->phys_addrs, 0xff, sizeof(adap->phys_addrs));
1235         cec_flush(adap);
1236         wake_up_interruptible(&adap->kthread_waitq);
1237         cec_post_state_event(adap);
1238 }
1239
1240 /*
1241  * Attempt to claim the required logical addresses.
1242  */
1243 static int cec_config_thread_func(void *arg)
1244 {
1245         /* The various LAs for each type of device */
1246         static const u8 tv_log_addrs[] = {
1247                 CEC_LOG_ADDR_TV, CEC_LOG_ADDR_SPECIFIC,
1248                 CEC_LOG_ADDR_INVALID
1249         };
1250         static const u8 record_log_addrs[] = {
1251                 CEC_LOG_ADDR_RECORD_1, CEC_LOG_ADDR_RECORD_2,
1252                 CEC_LOG_ADDR_RECORD_3,
1253                 CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1254                 CEC_LOG_ADDR_INVALID
1255         };
1256         static const u8 tuner_log_addrs[] = {
1257                 CEC_LOG_ADDR_TUNER_1, CEC_LOG_ADDR_TUNER_2,
1258                 CEC_LOG_ADDR_TUNER_3, CEC_LOG_ADDR_TUNER_4,
1259                 CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1260                 CEC_LOG_ADDR_INVALID
1261         };
1262         static const u8 playback_log_addrs[] = {
1263                 CEC_LOG_ADDR_PLAYBACK_1, CEC_LOG_ADDR_PLAYBACK_2,
1264                 CEC_LOG_ADDR_PLAYBACK_3,
1265                 CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1266                 CEC_LOG_ADDR_INVALID
1267         };
1268         static const u8 audiosystem_log_addrs[] = {
1269                 CEC_LOG_ADDR_AUDIOSYSTEM,
1270                 CEC_LOG_ADDR_INVALID
1271         };
1272         static const u8 specific_use_log_addrs[] = {
1273                 CEC_LOG_ADDR_SPECIFIC,
1274                 CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1275                 CEC_LOG_ADDR_INVALID
1276         };
1277         static const u8 *type2addrs[6] = {
1278                 [CEC_LOG_ADDR_TYPE_TV] = tv_log_addrs,
1279                 [CEC_LOG_ADDR_TYPE_RECORD] = record_log_addrs,
1280                 [CEC_LOG_ADDR_TYPE_TUNER] = tuner_log_addrs,
1281                 [CEC_LOG_ADDR_TYPE_PLAYBACK] = playback_log_addrs,
1282                 [CEC_LOG_ADDR_TYPE_AUDIOSYSTEM] = audiosystem_log_addrs,
1283                 [CEC_LOG_ADDR_TYPE_SPECIFIC] = specific_use_log_addrs,
1284         };
1285         static const u16 type2mask[] = {
1286                 [CEC_LOG_ADDR_TYPE_TV] = CEC_LOG_ADDR_MASK_TV,
1287                 [CEC_LOG_ADDR_TYPE_RECORD] = CEC_LOG_ADDR_MASK_RECORD,
1288                 [CEC_LOG_ADDR_TYPE_TUNER] = CEC_LOG_ADDR_MASK_TUNER,
1289                 [CEC_LOG_ADDR_TYPE_PLAYBACK] = CEC_LOG_ADDR_MASK_PLAYBACK,
1290                 [CEC_LOG_ADDR_TYPE_AUDIOSYSTEM] = CEC_LOG_ADDR_MASK_AUDIOSYSTEM,
1291                 [CEC_LOG_ADDR_TYPE_SPECIFIC] = CEC_LOG_ADDR_MASK_SPECIFIC,
1292         };
1293         struct cec_adapter *adap = arg;
1294         struct cec_log_addrs *las = &adap->log_addrs;
1295         int err;
1296         int i, j;
1297
1298         mutex_lock(&adap->lock);
1299         dprintk(1, "physical address: %x.%x.%x.%x, claim %d logical addresses\n",
1300                 cec_phys_addr_exp(adap->phys_addr), las->num_log_addrs);
1301         las->log_addr_mask = 0;
1302
1303         if (las->log_addr_type[0] == CEC_LOG_ADDR_TYPE_UNREGISTERED)
1304                 goto configured;
1305
1306         for (i = 0; i < las->num_log_addrs; i++) {
1307                 unsigned int type = las->log_addr_type[i];
1308                 const u8 *la_list;
1309                 u8 last_la;
1310
1311                 /*
1312                  * The TV functionality can only map to physical address 0.
1313                  * For any other address, try the Specific functionality
1314                  * instead as per the spec.
1315                  */
1316                 if (adap->phys_addr && type == CEC_LOG_ADDR_TYPE_TV)
1317                         type = CEC_LOG_ADDR_TYPE_SPECIFIC;
1318
1319                 la_list = type2addrs[type];
1320                 last_la = las->log_addr[i];
1321                 las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1322                 if (last_la == CEC_LOG_ADDR_INVALID ||
1323                     last_la == CEC_LOG_ADDR_UNREGISTERED ||
1324                     !((1 << last_la) & type2mask[type]))
1325                         last_la = la_list[0];
1326
1327                 err = cec_config_log_addr(adap, i, last_la);
1328                 if (err > 0) /* Reused last LA */
1329                         continue;
1330
1331                 if (err < 0)
1332                         goto unconfigure;
1333
1334                 for (j = 0; la_list[j] != CEC_LOG_ADDR_INVALID; j++) {
1335                         /* Tried this one already, skip it */
1336                         if (la_list[j] == last_la)
1337                                 continue;
1338                         /* The backup addresses are CEC 2.0 specific */
1339                         if ((la_list[j] == CEC_LOG_ADDR_BACKUP_1 ||
1340                              la_list[j] == CEC_LOG_ADDR_BACKUP_2) &&
1341                             las->cec_version < CEC_OP_CEC_VERSION_2_0)
1342                                 continue;
1343
1344                         err = cec_config_log_addr(adap, i, la_list[j]);
1345                         if (err == 0) /* LA is in use */
1346                                 continue;
1347                         if (err < 0)
1348                                 goto unconfigure;
1349                         /* Done, claimed an LA */
1350                         break;
1351                 }
1352
1353                 if (la_list[j] == CEC_LOG_ADDR_INVALID)
1354                         dprintk(1, "could not claim LA %d\n", i);
1355         }
1356
1357         if (adap->log_addrs.log_addr_mask == 0 &&
1358             !(las->flags & CEC_LOG_ADDRS_FL_ALLOW_UNREG_FALLBACK))
1359                 goto unconfigure;
1360
1361 configured:
1362         if (adap->log_addrs.log_addr_mask == 0) {
1363                 /* Fall back to unregistered */
1364                 las->log_addr[0] = CEC_LOG_ADDR_UNREGISTERED;
1365                 las->log_addr_mask = 1 << las->log_addr[0];
1366                 for (i = 1; i < las->num_log_addrs; i++)
1367                         las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1368         }
1369         for (i = las->num_log_addrs; i < CEC_MAX_LOG_ADDRS; i++)
1370                 las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1371         adap->is_configured = true;
1372         adap->is_configuring = false;
1373         cec_post_state_event(adap);
1374
1375         /*
1376          * Now post the Report Features and Report Physical Address broadcast
1377          * messages. Note that these are non-blocking transmits, meaning that
1378          * they are just queued up and once adap->lock is unlocked the main
1379          * thread will kick in and start transmitting these.
1380          *
1381          * If after this function is done (but before one or more of these
1382          * messages are actually transmitted) the CEC adapter is unconfigured,
1383          * then any remaining messages will be dropped by the main thread.
1384          */
1385         for (i = 0; i < las->num_log_addrs; i++) {
1386                 struct cec_msg msg = {};
1387
1388                 if (las->log_addr[i] == CEC_LOG_ADDR_INVALID ||
1389                     (las->flags & CEC_LOG_ADDRS_FL_CDC_ONLY))
1390                         continue;
1391
1392                 msg.msg[0] = (las->log_addr[i] << 4) | 0x0f;
1393
1394                 /* Report Features must come first according to CEC 2.0 */
1395                 if (las->log_addr[i] != CEC_LOG_ADDR_UNREGISTERED &&
1396                     adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0) {
1397                         cec_fill_msg_report_features(adap, &msg, i);
1398                         cec_transmit_msg_fh(adap, &msg, NULL, false);
1399                 }
1400
1401                 /* Report Physical Address */
1402                 cec_msg_report_physical_addr(&msg, adap->phys_addr,
1403                                              las->primary_device_type[i]);
1404                 dprintk(1, "config: la %d pa %x.%x.%x.%x\n",
1405                         las->log_addr[i],
1406                         cec_phys_addr_exp(adap->phys_addr));
1407                 cec_transmit_msg_fh(adap, &msg, NULL, false);
1408         }
1409         adap->kthread_config = NULL;
1410         complete(&adap->config_completion);
1411         mutex_unlock(&adap->lock);
1412         return 0;
1413
1414 unconfigure:
1415         for (i = 0; i < las->num_log_addrs; i++)
1416                 las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1417         cec_adap_unconfigure(adap);
1418         adap->kthread_config = NULL;
1419         mutex_unlock(&adap->lock);
1420         complete(&adap->config_completion);
1421         return 0;
1422 }
1423
1424 /*
1425  * Called from either __cec_s_phys_addr or __cec_s_log_addrs to claim the
1426  * logical addresses.
1427  *
1428  * This function is called with adap->lock held.
1429  */
1430 static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
1431 {
1432         if (WARN_ON(adap->is_configuring || adap->is_configured))
1433                 return;
1434
1435         init_completion(&adap->config_completion);
1436
1437         /* Ready to kick off the thread */
1438         adap->is_configuring = true;
1439         adap->kthread_config = kthread_run(cec_config_thread_func, adap,
1440                                            "ceccfg-%s", adap->name);
1441         if (IS_ERR(adap->kthread_config)) {
1442                 adap->kthread_config = NULL;
1443         } else if (block) {
1444                 mutex_unlock(&adap->lock);
1445                 wait_for_completion(&adap->config_completion);
1446                 mutex_lock(&adap->lock);
1447         }
1448 }
1449
1450 /* Set a new physical address and send an event notifying userspace of this.
1451  *
1452  * This function is called with adap->lock held.
1453  */
1454 void __cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)
1455 {
1456         if (phys_addr == adap->phys_addr)
1457                 return;
1458         if (phys_addr != CEC_PHYS_ADDR_INVALID && adap->devnode.unregistered)
1459                 return;
1460
1461         dprintk(1, "new physical address %x.%x.%x.%x\n",
1462                 cec_phys_addr_exp(phys_addr));
1463         if (phys_addr == CEC_PHYS_ADDR_INVALID ||
1464             adap->phys_addr != CEC_PHYS_ADDR_INVALID) {
1465                 adap->phys_addr = CEC_PHYS_ADDR_INVALID;
1466                 cec_post_state_event(adap);
1467                 cec_adap_unconfigure(adap);
1468                 /* Disabling monitor all mode should always succeed */
1469                 if (adap->monitor_all_cnt)
1470                         WARN_ON(call_op(adap, adap_monitor_all_enable, false));
1471                 mutex_lock(&adap->devnode.lock);
1472                 if (adap->needs_hpd || list_empty(&adap->devnode.fhs))
1473                         WARN_ON(adap->ops->adap_enable(adap, false));
1474                 mutex_unlock(&adap->devnode.lock);
1475                 if (phys_addr == CEC_PHYS_ADDR_INVALID)
1476                         return;
1477         }
1478
1479         mutex_lock(&adap->devnode.lock);
1480         adap->last_initiator = 0xff;
1481
1482         if ((adap->needs_hpd || list_empty(&adap->devnode.fhs)) &&
1483             adap->ops->adap_enable(adap, true)) {
1484                 mutex_unlock(&adap->devnode.lock);
1485                 return;
1486         }
1487
1488         if (adap->monitor_all_cnt &&
1489             call_op(adap, adap_monitor_all_enable, true)) {
1490                 if (adap->needs_hpd || list_empty(&adap->devnode.fhs))
1491                         WARN_ON(adap->ops->adap_enable(adap, false));
1492                 mutex_unlock(&adap->devnode.lock);
1493                 return;
1494         }
1495         mutex_unlock(&adap->devnode.lock);
1496
1497         adap->phys_addr = phys_addr;
1498         cec_post_state_event(adap);
1499         if (adap->log_addrs.num_log_addrs)
1500                 cec_claim_log_addrs(adap, block);
1501 }
1502
1503 void cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)
1504 {
1505         if (IS_ERR_OR_NULL(adap))
1506                 return;
1507
1508         mutex_lock(&adap->lock);
1509         __cec_s_phys_addr(adap, phys_addr, block);
1510         mutex_unlock(&adap->lock);
1511 }
1512 EXPORT_SYMBOL_GPL(cec_s_phys_addr);
1513
1514 void cec_s_phys_addr_from_edid(struct cec_adapter *adap,
1515                                const struct edid *edid)
1516 {
1517         u16 pa = CEC_PHYS_ADDR_INVALID;
1518
1519         if (edid && edid->extensions)
1520                 pa = cec_get_edid_phys_addr((const u8 *)edid,
1521                                 EDID_LENGTH * (edid->extensions + 1), NULL);
1522         cec_s_phys_addr(adap, pa, false);
1523 }
1524 EXPORT_SYMBOL_GPL(cec_s_phys_addr_from_edid);
1525
1526 /*
1527  * Called from either the ioctl or a driver to set the logical addresses.
1528  *
1529  * This function is called with adap->lock held.
1530  */
1531 int __cec_s_log_addrs(struct cec_adapter *adap,
1532                       struct cec_log_addrs *log_addrs, bool block)
1533 {
1534         u16 type_mask = 0;
1535         int i;
1536
1537         if (adap->devnode.unregistered)
1538                 return -ENODEV;
1539
1540         if (!log_addrs || log_addrs->num_log_addrs == 0) {
1541                 cec_adap_unconfigure(adap);
1542                 adap->log_addrs.num_log_addrs = 0;
1543                 for (i = 0; i < CEC_MAX_LOG_ADDRS; i++)
1544                         adap->log_addrs.log_addr[i] = CEC_LOG_ADDR_INVALID;
1545                 adap->log_addrs.osd_name[0] = '\0';
1546                 adap->log_addrs.vendor_id = CEC_VENDOR_ID_NONE;
1547                 adap->log_addrs.cec_version = CEC_OP_CEC_VERSION_2_0;
1548                 return 0;
1549         }
1550
1551         if (log_addrs->flags & CEC_LOG_ADDRS_FL_CDC_ONLY) {
1552                 /*
1553                  * Sanitize log_addrs fields if a CDC-Only device is
1554                  * requested.
1555                  */
1556                 log_addrs->num_log_addrs = 1;
1557                 log_addrs->osd_name[0] = '\0';
1558                 log_addrs->vendor_id = CEC_VENDOR_ID_NONE;
1559                 log_addrs->log_addr_type[0] = CEC_LOG_ADDR_TYPE_UNREGISTERED;
1560                 /*
1561                  * This is just an internal convention since a CDC-Only device
1562                  * doesn't have to be a switch. But switches already use
1563                  * unregistered, so it makes some kind of sense to pick this
1564                  * as the primary device. Since a CDC-Only device never sends
1565                  * any 'normal' CEC messages this primary device type is never
1566                  * sent over the CEC bus.
1567                  */
1568                 log_addrs->primary_device_type[0] = CEC_OP_PRIM_DEVTYPE_SWITCH;
1569                 log_addrs->all_device_types[0] = 0;
1570                 log_addrs->features[0][0] = 0;
1571                 log_addrs->features[0][1] = 0;
1572         }
1573
1574         /* Ensure the osd name is 0-terminated */
1575         log_addrs->osd_name[sizeof(log_addrs->osd_name) - 1] = '\0';
1576
1577         /* Sanity checks */
1578         if (log_addrs->num_log_addrs > adap->available_log_addrs) {
1579                 dprintk(1, "num_log_addrs > %d\n", adap->available_log_addrs);
1580                 return -EINVAL;
1581         }
1582
1583         /*
1584          * Vendor ID is a 24 bit number, so check if the value is
1585          * within the correct range.
1586          */
1587         if (log_addrs->vendor_id != CEC_VENDOR_ID_NONE &&
1588             (log_addrs->vendor_id & 0xff000000) != 0) {
1589                 dprintk(1, "invalid vendor ID\n");
1590                 return -EINVAL;
1591         }
1592
1593         if (log_addrs->cec_version != CEC_OP_CEC_VERSION_1_4 &&
1594             log_addrs->cec_version != CEC_OP_CEC_VERSION_2_0) {
1595                 dprintk(1, "invalid CEC version\n");
1596                 return -EINVAL;
1597         }
1598
1599         if (log_addrs->num_log_addrs > 1)
1600                 for (i = 0; i < log_addrs->num_log_addrs; i++)
1601                         if (log_addrs->log_addr_type[i] ==
1602                                         CEC_LOG_ADDR_TYPE_UNREGISTERED) {
1603                                 dprintk(1, "num_log_addrs > 1 can't be combined with unregistered LA\n");
1604                                 return -EINVAL;
1605                         }
1606
1607         for (i = 0; i < log_addrs->num_log_addrs; i++) {
1608                 const u8 feature_sz = ARRAY_SIZE(log_addrs->features[0]);
1609                 u8 *features = log_addrs->features[i];
1610                 bool op_is_dev_features = false;
1611                 unsigned j;
1612
1613                 log_addrs->log_addr[i] = CEC_LOG_ADDR_INVALID;
1614                 if (type_mask & (1 << log_addrs->log_addr_type[i])) {
1615                         dprintk(1, "duplicate logical address type\n");
1616                         return -EINVAL;
1617                 }
1618                 type_mask |= 1 << log_addrs->log_addr_type[i];
1619                 if ((type_mask & (1 << CEC_LOG_ADDR_TYPE_RECORD)) &&
1620                     (type_mask & (1 << CEC_LOG_ADDR_TYPE_PLAYBACK))) {
1621                         /* Record already contains the playback functionality */
1622                         dprintk(1, "invalid record + playback combination\n");
1623                         return -EINVAL;
1624                 }
1625                 if (log_addrs->primary_device_type[i] >
1626                                         CEC_OP_PRIM_DEVTYPE_PROCESSOR) {
1627                         dprintk(1, "unknown primary device type\n");
1628                         return -EINVAL;
1629                 }
1630                 if (log_addrs->primary_device_type[i] == 2) {
1631                         dprintk(1, "invalid primary device type\n");
1632                         return -EINVAL;
1633                 }
1634                 if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) {
1635                         dprintk(1, "unknown logical address type\n");
1636                         return -EINVAL;
1637                 }
1638                 for (j = 0; j < feature_sz; j++) {
1639                         if ((features[j] & 0x80) == 0) {
1640                                 if (op_is_dev_features)
1641                                         break;
1642                                 op_is_dev_features = true;
1643                         }
1644                 }
1645                 if (!op_is_dev_features || j == feature_sz) {
1646                         dprintk(1, "malformed features\n");
1647                         return -EINVAL;
1648                 }
1649                 /* Zero unused part of the feature array */
1650                 memset(features + j + 1, 0, feature_sz - j - 1);
1651         }
1652
1653         if (log_addrs->cec_version >= CEC_OP_CEC_VERSION_2_0) {
1654                 if (log_addrs->num_log_addrs > 2) {
1655                         dprintk(1, "CEC 2.0 allows no more than 2 logical addresses\n");
1656                         return -EINVAL;
1657                 }
1658                 if (log_addrs->num_log_addrs == 2) {
1659                         if (!(type_mask & ((1 << CEC_LOG_ADDR_TYPE_AUDIOSYSTEM) |
1660                                            (1 << CEC_LOG_ADDR_TYPE_TV)))) {
1661                                 dprintk(1, "two LAs is only allowed for audiosystem and TV\n");
1662                                 return -EINVAL;
1663                         }
1664                         if (!(type_mask & ((1 << CEC_LOG_ADDR_TYPE_PLAYBACK) |
1665                                            (1 << CEC_LOG_ADDR_TYPE_RECORD)))) {
1666                                 dprintk(1, "an audiosystem/TV can only be combined with record or playback\n");
1667                                 return -EINVAL;
1668                         }
1669                 }
1670         }
1671
1672         /* Zero unused LAs */
1673         for (i = log_addrs->num_log_addrs; i < CEC_MAX_LOG_ADDRS; i++) {
1674                 log_addrs->primary_device_type[i] = 0;
1675                 log_addrs->log_addr_type[i] = 0;
1676                 log_addrs->all_device_types[i] = 0;
1677                 memset(log_addrs->features[i], 0,
1678                        sizeof(log_addrs->features[i]));
1679         }
1680
1681         log_addrs->log_addr_mask = adap->log_addrs.log_addr_mask;
1682         adap->log_addrs = *log_addrs;
1683         if (adap->phys_addr != CEC_PHYS_ADDR_INVALID)
1684                 cec_claim_log_addrs(adap, block);
1685         return 0;
1686 }
1687
1688 int cec_s_log_addrs(struct cec_adapter *adap,
1689                     struct cec_log_addrs *log_addrs, bool block)
1690 {
1691         int err;
1692
1693         mutex_lock(&adap->lock);
1694         err = __cec_s_log_addrs(adap, log_addrs, block);
1695         mutex_unlock(&adap->lock);
1696         return err;
1697 }
1698 EXPORT_SYMBOL_GPL(cec_s_log_addrs);
1699
1700 /* High-level core CEC message handling */
1701
1702 /* Fill in the Report Features message */
1703 static void cec_fill_msg_report_features(struct cec_adapter *adap,
1704                                          struct cec_msg *msg,
1705                                          unsigned int la_idx)
1706 {
1707         const struct cec_log_addrs *las = &adap->log_addrs;
1708         const u8 *features = las->features[la_idx];
1709         bool op_is_dev_features = false;
1710         unsigned int idx;
1711
1712         /* Report Features */
1713         msg->msg[0] = (las->log_addr[la_idx] << 4) | 0x0f;
1714         msg->len = 4;
1715         msg->msg[1] = CEC_MSG_REPORT_FEATURES;
1716         msg->msg[2] = adap->log_addrs.cec_version;
1717         msg->msg[3] = las->all_device_types[la_idx];
1718
1719         /* Write RC Profiles first, then Device Features */
1720         for (idx = 0; idx < ARRAY_SIZE(las->features[0]); idx++) {
1721                 msg->msg[msg->len++] = features[idx];
1722                 if ((features[idx] & CEC_OP_FEAT_EXT) == 0) {
1723                         if (op_is_dev_features)
1724                                 break;
1725                         op_is_dev_features = true;
1726                 }
1727         }
1728 }
1729
1730 /* Transmit the Feature Abort message */
1731 static int cec_feature_abort_reason(struct cec_adapter *adap,
1732                                     struct cec_msg *msg, u8 reason)
1733 {
1734         struct cec_msg tx_msg = { };
1735
1736         /*
1737          * Don't reply with CEC_MSG_FEATURE_ABORT to a CEC_MSG_FEATURE_ABORT
1738          * message!
1739          */
1740         if (msg->msg[1] == CEC_MSG_FEATURE_ABORT)
1741                 return 0;
1742         /* Don't Feature Abort messages from 'Unregistered' */
1743         if (cec_msg_initiator(msg) == CEC_LOG_ADDR_UNREGISTERED)
1744                 return 0;
1745         cec_msg_set_reply_to(&tx_msg, msg);
1746         cec_msg_feature_abort(&tx_msg, msg->msg[1], reason);
1747         return cec_transmit_msg(adap, &tx_msg, false);
1748 }
1749
1750 static int cec_feature_abort(struct cec_adapter *adap, struct cec_msg *msg)
1751 {
1752         return cec_feature_abort_reason(adap, msg,
1753                                         CEC_OP_ABORT_UNRECOGNIZED_OP);
1754 }
1755
1756 static int cec_feature_refused(struct cec_adapter *adap, struct cec_msg *msg)
1757 {
1758         return cec_feature_abort_reason(adap, msg,
1759                                         CEC_OP_ABORT_REFUSED);
1760 }
1761
1762 /*
1763  * Called when a CEC message is received. This function will do any
1764  * necessary core processing. The is_reply bool is true if this message
1765  * is a reply to an earlier transmit.
1766  *
1767  * The message is either a broadcast message or a valid directed message.
1768  */
1769 static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
1770                               bool is_reply)
1771 {
1772         bool is_broadcast = cec_msg_is_broadcast(msg);
1773         u8 dest_laddr = cec_msg_destination(msg);
1774         u8 init_laddr = cec_msg_initiator(msg);
1775         u8 devtype = cec_log_addr2dev(adap, dest_laddr);
1776         int la_idx = cec_log_addr2idx(adap, dest_laddr);
1777         bool from_unregistered = init_laddr == 0xf;
1778         struct cec_msg tx_cec_msg = { };
1779
1780         dprintk(2, "%s: %*ph\n", __func__, msg->len, msg->msg);
1781
1782         /* If this is a CDC-Only device, then ignore any non-CDC messages */
1783         if (cec_is_cdc_only(&adap->log_addrs) &&
1784             msg->msg[1] != CEC_MSG_CDC_MESSAGE)
1785                 return 0;
1786
1787         if (adap->ops->received) {
1788                 /* Allow drivers to process the message first */
1789                 if (adap->ops->received(adap, msg) != -ENOMSG)
1790                         return 0;
1791         }
1792
1793         /*
1794          * REPORT_PHYSICAL_ADDR, CEC_MSG_USER_CONTROL_PRESSED and
1795          * CEC_MSG_USER_CONTROL_RELEASED messages always have to be
1796          * handled by the CEC core, even if the passthrough mode is on.
1797          * The others are just ignored if passthrough mode is on.
1798          */
1799         switch (msg->msg[1]) {
1800         case CEC_MSG_GET_CEC_VERSION:
1801         case CEC_MSG_ABORT:
1802         case CEC_MSG_GIVE_DEVICE_POWER_STATUS:
1803         case CEC_MSG_GIVE_OSD_NAME:
1804                 /*
1805                  * These messages reply with a directed message, so ignore if
1806                  * the initiator is Unregistered.
1807                  */
1808                 if (!adap->passthrough && from_unregistered)
1809                         return 0;
1810                 /* Fall through */
1811         case CEC_MSG_GIVE_DEVICE_VENDOR_ID:
1812         case CEC_MSG_GIVE_FEATURES:
1813         case CEC_MSG_GIVE_PHYSICAL_ADDR:
1814                 /*
1815                  * Skip processing these messages if the passthrough mode
1816                  * is on.
1817                  */
1818                 if (adap->passthrough)
1819                         goto skip_processing;
1820                 /* Ignore if addressing is wrong */
1821                 if (is_broadcast)
1822                         return 0;
1823                 break;
1824
1825         case CEC_MSG_USER_CONTROL_PRESSED:
1826         case CEC_MSG_USER_CONTROL_RELEASED:
1827                 /* Wrong addressing mode: don't process */
1828                 if (is_broadcast || from_unregistered)
1829                         goto skip_processing;
1830                 break;
1831
1832         case CEC_MSG_REPORT_PHYSICAL_ADDR:
1833                 /*
1834                  * This message is always processed, regardless of the
1835                  * passthrough setting.
1836                  *
1837                  * Exception: don't process if wrong addressing mode.
1838                  */
1839                 if (!is_broadcast)
1840                         goto skip_processing;
1841                 break;
1842
1843         default:
1844                 break;
1845         }
1846
1847         cec_msg_set_reply_to(&tx_cec_msg, msg);
1848
1849         switch (msg->msg[1]) {
1850         /* The following messages are processed but still passed through */
1851         case CEC_MSG_REPORT_PHYSICAL_ADDR: {
1852                 u16 pa = (msg->msg[2] << 8) | msg->msg[3];
1853
1854                 if (!from_unregistered)
1855                         adap->phys_addrs[init_laddr] = pa;
1856                 dprintk(1, "reported physical address %x.%x.%x.%x for logical address %d\n",
1857                         cec_phys_addr_exp(pa), init_laddr);
1858                 break;
1859         }
1860
1861         case CEC_MSG_USER_CONTROL_PRESSED:
1862                 if (!(adap->capabilities & CEC_CAP_RC) ||
1863                     !(adap->log_addrs.flags & CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU))
1864                         break;
1865
1866 #ifdef CONFIG_MEDIA_CEC_RC
1867                 switch (msg->msg[2]) {
1868                 /*
1869                  * Play function, this message can have variable length
1870                  * depending on the specific play function that is used.
1871                  */
1872                 case 0x60:
1873                         if (msg->len == 2)
1874                                 rc_keydown(adap->rc, RC_PROTO_CEC,
1875                                            msg->msg[2], 0);
1876                         else
1877                                 rc_keydown(adap->rc, RC_PROTO_CEC,
1878                                            msg->msg[2] << 8 | msg->msg[3], 0);
1879                         break;
1880                 /*
1881                  * Other function messages that are not handled.
1882                  * Currently the RC framework does not allow to supply an
1883                  * additional parameter to a keypress. These "keys" contain
1884                  * other information such as channel number, an input number
1885                  * etc.
1886                  * For the time being these messages are not processed by the
1887                  * framework and are simply forwarded to the user space.
1888                  */
1889                 case 0x56: case 0x57:
1890                 case 0x67: case 0x68: case 0x69: case 0x6a:
1891                         break;
1892                 default:
1893                         rc_keydown(adap->rc, RC_PROTO_CEC, msg->msg[2], 0);
1894                         break;
1895                 }
1896 #endif
1897                 break;
1898
1899         case CEC_MSG_USER_CONTROL_RELEASED:
1900                 if (!(adap->capabilities & CEC_CAP_RC) ||
1901                     !(adap->log_addrs.flags & CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU))
1902                         break;
1903 #ifdef CONFIG_MEDIA_CEC_RC
1904                 rc_keyup(adap->rc);
1905 #endif
1906                 break;
1907
1908         /*
1909          * The remaining messages are only processed if the passthrough mode
1910          * is off.
1911          */
1912         case CEC_MSG_GET_CEC_VERSION:
1913                 cec_msg_cec_version(&tx_cec_msg, adap->log_addrs.cec_version);
1914                 return cec_transmit_msg(adap, &tx_cec_msg, false);
1915
1916         case CEC_MSG_GIVE_PHYSICAL_ADDR:
1917                 /* Do nothing for CEC switches using addr 15 */
1918                 if (devtype == CEC_OP_PRIM_DEVTYPE_SWITCH && dest_laddr == 15)
1919                         return 0;
1920                 cec_msg_report_physical_addr(&tx_cec_msg, adap->phys_addr, devtype);
1921                 return cec_transmit_msg(adap, &tx_cec_msg, false);
1922
1923         case CEC_MSG_GIVE_DEVICE_VENDOR_ID:
1924                 if (adap->log_addrs.vendor_id == CEC_VENDOR_ID_NONE)
1925                         return cec_feature_abort(adap, msg);
1926                 cec_msg_device_vendor_id(&tx_cec_msg, adap->log_addrs.vendor_id);
1927                 return cec_transmit_msg(adap, &tx_cec_msg, false);
1928
1929         case CEC_MSG_ABORT:
1930                 /* Do nothing for CEC switches */
1931                 if (devtype == CEC_OP_PRIM_DEVTYPE_SWITCH)
1932                         return 0;
1933                 return cec_feature_refused(adap, msg);
1934
1935         case CEC_MSG_GIVE_OSD_NAME: {
1936                 if (adap->log_addrs.osd_name[0] == 0)
1937                         return cec_feature_abort(adap, msg);
1938                 cec_msg_set_osd_name(&tx_cec_msg, adap->log_addrs.osd_name);
1939                 return cec_transmit_msg(adap, &tx_cec_msg, false);
1940         }
1941
1942         case CEC_MSG_GIVE_FEATURES:
1943                 if (adap->log_addrs.cec_version < CEC_OP_CEC_VERSION_2_0)
1944                         return cec_feature_abort(adap, msg);
1945                 cec_fill_msg_report_features(adap, &tx_cec_msg, la_idx);
1946                 return cec_transmit_msg(adap, &tx_cec_msg, false);
1947
1948         default:
1949                 /*
1950                  * Unprocessed messages are aborted if userspace isn't doing
1951                  * any processing either.
1952                  */
1953                 if (!is_broadcast && !is_reply && !adap->follower_cnt &&
1954                     !adap->cec_follower && msg->msg[1] != CEC_MSG_FEATURE_ABORT)
1955                         return cec_feature_abort(adap, msg);
1956                 break;
1957         }
1958
1959 skip_processing:
1960         /* If this was a reply, then we're done, unless otherwise specified */
1961         if (is_reply && !(msg->flags & CEC_MSG_FL_REPLY_TO_FOLLOWERS))
1962                 return 0;
1963
1964         /*
1965          * Send to the exclusive follower if there is one, otherwise send
1966          * to all followers.
1967          */
1968         if (adap->cec_follower)
1969                 cec_queue_msg_fh(adap->cec_follower, msg);
1970         else
1971                 cec_queue_msg_followers(adap, msg);
1972         return 0;
1973 }
1974
1975 /*
1976  * Helper functions to keep track of the 'monitor all' use count.
1977  *
1978  * These functions are called with adap->lock held.
1979  */
1980 int cec_monitor_all_cnt_inc(struct cec_adapter *adap)
1981 {
1982         int ret = 0;
1983
1984         if (adap->monitor_all_cnt == 0)
1985                 ret = call_op(adap, adap_monitor_all_enable, 1);
1986         if (ret == 0)
1987                 adap->monitor_all_cnt++;
1988         return ret;
1989 }
1990
1991 void cec_monitor_all_cnt_dec(struct cec_adapter *adap)
1992 {
1993         adap->monitor_all_cnt--;
1994         if (adap->monitor_all_cnt == 0)
1995                 WARN_ON(call_op(adap, adap_monitor_all_enable, 0));
1996 }
1997
1998 /*
1999  * Helper functions to keep track of the 'monitor pin' use count.
2000  *
2001  * These functions are called with adap->lock held.
2002  */
2003 int cec_monitor_pin_cnt_inc(struct cec_adapter *adap)
2004 {
2005         int ret = 0;
2006
2007         if (adap->monitor_pin_cnt == 0)
2008                 ret = call_op(adap, adap_monitor_pin_enable, 1);
2009         if (ret == 0)
2010                 adap->monitor_pin_cnt++;
2011         return ret;
2012 }
2013
2014 void cec_monitor_pin_cnt_dec(struct cec_adapter *adap)
2015 {
2016         adap->monitor_pin_cnt--;
2017         if (adap->monitor_pin_cnt == 0)
2018                 WARN_ON(call_op(adap, adap_monitor_pin_enable, 0));
2019 }
2020
2021 #ifdef CONFIG_DEBUG_FS
2022 /*
2023  * Log the current state of the CEC adapter.
2024  * Very useful for debugging.
2025  */
2026 int cec_adap_status(struct seq_file *file, void *priv)
2027 {
2028         struct cec_adapter *adap = dev_get_drvdata(file->private);
2029         struct cec_data *data;
2030
2031         mutex_lock(&adap->lock);
2032         seq_printf(file, "configured: %d\n", adap->is_configured);
2033         seq_printf(file, "configuring: %d\n", adap->is_configuring);
2034         seq_printf(file, "phys_addr: %x.%x.%x.%x\n",
2035                    cec_phys_addr_exp(adap->phys_addr));
2036         seq_printf(file, "number of LAs: %d\n", adap->log_addrs.num_log_addrs);
2037         seq_printf(file, "LA mask: 0x%04x\n", adap->log_addrs.log_addr_mask);
2038         if (adap->cec_follower)
2039                 seq_printf(file, "has CEC follower%s\n",
2040                            adap->passthrough ? " (in passthrough mode)" : "");
2041         if (adap->cec_initiator)
2042                 seq_puts(file, "has CEC initiator\n");
2043         if (adap->monitor_all_cnt)
2044                 seq_printf(file, "file handles in Monitor All mode: %u\n",
2045                            adap->monitor_all_cnt);
2046         if (adap->tx_timeouts) {
2047                 seq_printf(file, "transmit timeouts: %u\n",
2048                            adap->tx_timeouts);
2049                 adap->tx_timeouts = 0;
2050         }
2051         data = adap->transmitting;
2052         if (data)
2053                 seq_printf(file, "transmitting message: %*ph (reply: %02x, timeout: %ums)\n",
2054                            data->msg.len, data->msg.msg, data->msg.reply,
2055                            data->msg.timeout);
2056         seq_printf(file, "pending transmits: %u\n", adap->transmit_queue_sz);
2057         list_for_each_entry(data, &adap->transmit_queue, list) {
2058                 seq_printf(file, "queued tx message: %*ph (reply: %02x, timeout: %ums)\n",
2059                            data->msg.len, data->msg.msg, data->msg.reply,
2060                            data->msg.timeout);
2061         }
2062         list_for_each_entry(data, &adap->wait_queue, list) {
2063                 seq_printf(file, "message waiting for reply: %*ph (reply: %02x, timeout: %ums)\n",
2064                            data->msg.len, data->msg.msg, data->msg.reply,
2065                            data->msg.timeout);
2066         }
2067
2068         call_void_op(adap, adap_status, file);
2069         mutex_unlock(&adap->lock);
2070         return 0;
2071 }
2072 #endif