1/*
2 * HID driver for Nintendo Wii / Wii U peripherals
3 * Copyright (c) 2011-2013 David Herrmann <dh.herrmann@gmail.com>
4 */
5
6/*
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the Free
9 * Software Foundation; either version 2 of the License, or (at your option)
10 * any later version.
11 */
12
13#include <linux/completion.h>
14#include <linux/device.h>
15#include <linux/hid.h>
16#include <linux/input.h>
17#include <linux/module.h>
18#include <linux/mutex.h>
19#include <linux/spinlock.h>
20#include "hid-ids.h"
21#include "hid-wiimote.h"
22
23/* output queue handling */
24
25static int wiimote_hid_send(struct hid_device *hdev, __u8 *buffer,
26			    size_t count)
27{
28	__u8 *buf;
29	int ret;
30
31	if (!hdev->ll_driver->output_report)
32		return -ENODEV;
33
34	buf = kmemdup(buffer, count, GFP_KERNEL);
35	if (!buf)
36		return -ENOMEM;
37
38	ret = hid_hw_output_report(hdev, buf, count);
39
40	kfree(buf);
41	return ret;
42}
43
44static void wiimote_queue_worker(struct work_struct *work)
45{
46	struct wiimote_queue *queue = container_of(work, struct wiimote_queue,
47						   worker);
48	struct wiimote_data *wdata = container_of(queue, struct wiimote_data,
49						  queue);
50	unsigned long flags;
51	int ret;
52
53	spin_lock_irqsave(&wdata->queue.lock, flags);
54
55	while (wdata->queue.head != wdata->queue.tail) {
56		spin_unlock_irqrestore(&wdata->queue.lock, flags);
57		ret = wiimote_hid_send(wdata->hdev,
58				 wdata->queue.outq[wdata->queue.tail].data,
59				 wdata->queue.outq[wdata->queue.tail].size);
60		if (ret < 0) {
61			spin_lock_irqsave(&wdata->state.lock, flags);
62			wiimote_cmd_abort(wdata);
63			spin_unlock_irqrestore(&wdata->state.lock, flags);
64		}
65		spin_lock_irqsave(&wdata->queue.lock, flags);
66
67		wdata->queue.tail = (wdata->queue.tail + 1) % WIIMOTE_BUFSIZE;
68	}
69
70	spin_unlock_irqrestore(&wdata->queue.lock, flags);
71}
72
73static void wiimote_queue(struct wiimote_data *wdata, const __u8 *buffer,
74								size_t count)
75{
76	unsigned long flags;
77	__u8 newhead;
78
79	if (count > HID_MAX_BUFFER_SIZE) {
80		hid_warn(wdata->hdev, "Sending too large output report\n");
81
82		spin_lock_irqsave(&wdata->queue.lock, flags);
83		goto out_error;
84	}
85
86	/*
87	 * Copy new request into our output queue and check whether the
88	 * queue is full. If it is full, discard this request.
89	 * If it is empty we need to start a new worker that will
90	 * send out the buffer to the hid device.
91	 * If the queue is not empty, then there must be a worker
92	 * that is currently sending out our buffer and this worker
93	 * will reschedule itself until the queue is empty.
94	 */
95
96	spin_lock_irqsave(&wdata->queue.lock, flags);
97
98	memcpy(wdata->queue.outq[wdata->queue.head].data, buffer, count);
99	wdata->queue.outq[wdata->queue.head].size = count;
100	newhead = (wdata->queue.head + 1) % WIIMOTE_BUFSIZE;
101
102	if (wdata->queue.head == wdata->queue.tail) {
103		wdata->queue.head = newhead;
104		schedule_work(&wdata->queue.worker);
105	} else if (newhead != wdata->queue.tail) {
106		wdata->queue.head = newhead;
107	} else {
108		hid_warn(wdata->hdev, "Output queue is full");
109		goto out_error;
110	}
111
112	goto out_unlock;
113
114out_error:
115	wiimote_cmd_abort(wdata);
116out_unlock:
117	spin_unlock_irqrestore(&wdata->queue.lock, flags);
118}
119
120/*
121 * This sets the rumble bit on the given output report if rumble is
122 * currently enabled.
123 * \cmd1 must point to the second byte in the output report => &cmd[1]
124 * This must be called on nearly every output report before passing it
125 * into the output queue!
126 */
127static inline void wiiproto_keep_rumble(struct wiimote_data *wdata, __u8 *cmd1)
128{
129	if (wdata->state.flags & WIIPROTO_FLAG_RUMBLE)
130		*cmd1 |= 0x01;
131}
132
133void wiiproto_req_rumble(struct wiimote_data *wdata, __u8 rumble)
134{
135	__u8 cmd[2];
136
137	rumble = !!rumble;
138	if (rumble == !!(wdata->state.flags & WIIPROTO_FLAG_RUMBLE))
139		return;
140
141	if (rumble)
142		wdata->state.flags |= WIIPROTO_FLAG_RUMBLE;
143	else
144		wdata->state.flags &= ~WIIPROTO_FLAG_RUMBLE;
145
146	cmd[0] = WIIPROTO_REQ_RUMBLE;
147	cmd[1] = 0;
148
149	wiiproto_keep_rumble(wdata, &cmd[1]);
150	wiimote_queue(wdata, cmd, sizeof(cmd));
151}
152
153void wiiproto_req_leds(struct wiimote_data *wdata, int leds)
154{
155	__u8 cmd[2];
156
157	leds &= WIIPROTO_FLAGS_LEDS;
158	if ((wdata->state.flags & WIIPROTO_FLAGS_LEDS) == leds)
159		return;
160	wdata->state.flags = (wdata->state.flags & ~WIIPROTO_FLAGS_LEDS) | leds;
161
162	cmd[0] = WIIPROTO_REQ_LED;
163	cmd[1] = 0;
164
165	if (leds & WIIPROTO_FLAG_LED1)
166		cmd[1] |= 0x10;
167	if (leds & WIIPROTO_FLAG_LED2)
168		cmd[1] |= 0x20;
169	if (leds & WIIPROTO_FLAG_LED3)
170		cmd[1] |= 0x40;
171	if (leds & WIIPROTO_FLAG_LED4)
172		cmd[1] |= 0x80;
173
174	wiiproto_keep_rumble(wdata, &cmd[1]);
175	wiimote_queue(wdata, cmd, sizeof(cmd));
176}
177
178/*
179 * Check what peripherals of the wiimote are currently
180 * active and select a proper DRM that supports all of
181 * the requested data inputs.
182 *
183 * Not all combinations are actually supported. The following
184 * combinations work only with limitations:
185 *  - IR cam in extended or full mode disables any data transmission
186 *    of extension controllers. There is no DRM mode that supports
187 *    extension bytes plus extended/full IR.
188 *  - IR cam with accelerometer and extension *_EXT8 is not supported.
189 *    However, all extensions that need *_EXT8 are devices that don't
190 *    support IR cameras. Hence, this shouldn't happen under normal
191 *    operation.
192 *  - *_EXT16 is only supported in combination with buttons and
193 *    accelerometer. No IR or similar can be active simultaneously. As
194 *    above, all modules that require it are mutually exclusive with
195 *    IR/etc. so this doesn't matter.
196 */
197static __u8 select_drm(struct wiimote_data *wdata)
198{
199	__u8 ir = wdata->state.flags & WIIPROTO_FLAGS_IR;
200	bool ext;
201
202	ext = (wdata->state.flags & WIIPROTO_FLAG_EXT_USED) ||
203	      (wdata->state.flags & WIIPROTO_FLAG_MP_USED);
204
205	/* some 3rd-party balance-boards are hard-coded to KEE, *sigh* */
206	if (wdata->state.devtype == WIIMOTE_DEV_BALANCE_BOARD) {
207		if (ext)
208			return WIIPROTO_REQ_DRM_KEE;
209		else
210			return WIIPROTO_REQ_DRM_K;
211	}
212
213	if (ir == WIIPROTO_FLAG_IR_BASIC) {
214		if (wdata->state.flags & WIIPROTO_FLAG_ACCEL) {
215			/* GEN10 and ealier devices bind IR formats to DRMs.
216			 * Hence, we cannot use DRM_KAI here as it might be
217			 * bound to IR_EXT. Use DRM_KAIE unconditionally so we
218			 * work with all devices and our parsers can use the
219			 * fixed formats, too. */
220			return WIIPROTO_REQ_DRM_KAIE;
221		} else {
222			return WIIPROTO_REQ_DRM_KIE;
223		}
224	} else if (ir == WIIPROTO_FLAG_IR_EXT) {
225		return WIIPROTO_REQ_DRM_KAI;
226	} else if (ir == WIIPROTO_FLAG_IR_FULL) {
227		return WIIPROTO_REQ_DRM_SKAI1;
228	} else {
229		if (wdata->state.flags & WIIPROTO_FLAG_ACCEL) {
230			if (ext)
231				return WIIPROTO_REQ_DRM_KAE;
232			else
233				return WIIPROTO_REQ_DRM_KA;
234		} else {
235			if (ext)
236				return WIIPROTO_REQ_DRM_KEE;
237			else
238				return WIIPROTO_REQ_DRM_K;
239		}
240	}
241}
242
243void wiiproto_req_drm(struct wiimote_data *wdata, __u8 drm)
244{
245	__u8 cmd[3];
246
247	if (wdata->state.flags & WIIPROTO_FLAG_DRM_LOCKED)
248		drm = wdata->state.drm;
249	else if (drm == WIIPROTO_REQ_NULL)
250		drm = select_drm(wdata);
251
252	cmd[0] = WIIPROTO_REQ_DRM;
253	cmd[1] = 0;
254	cmd[2] = drm;
255
256	wdata->state.drm = drm;
257	wiiproto_keep_rumble(wdata, &cmd[1]);
258	wiimote_queue(wdata, cmd, sizeof(cmd));
259}
260
261void wiiproto_req_status(struct wiimote_data *wdata)
262{
263	__u8 cmd[2];
264
265	cmd[0] = WIIPROTO_REQ_SREQ;
266	cmd[1] = 0;
267
268	wiiproto_keep_rumble(wdata, &cmd[1]);
269	wiimote_queue(wdata, cmd, sizeof(cmd));
270}
271
272void wiiproto_req_accel(struct wiimote_data *wdata, __u8 accel)
273{
274	accel = !!accel;
275	if (accel == !!(wdata->state.flags & WIIPROTO_FLAG_ACCEL))
276		return;
277
278	if (accel)
279		wdata->state.flags |= WIIPROTO_FLAG_ACCEL;
280	else
281		wdata->state.flags &= ~WIIPROTO_FLAG_ACCEL;
282
283	wiiproto_req_drm(wdata, WIIPROTO_REQ_NULL);
284}
285
286void wiiproto_req_ir1(struct wiimote_data *wdata, __u8 flags)
287{
288	__u8 cmd[2];
289
290	cmd[0] = WIIPROTO_REQ_IR1;
291	cmd[1] = flags;
292
293	wiiproto_keep_rumble(wdata, &cmd[1]);
294	wiimote_queue(wdata, cmd, sizeof(cmd));
295}
296
297void wiiproto_req_ir2(struct wiimote_data *wdata, __u8 flags)
298{
299	__u8 cmd[2];
300
301	cmd[0] = WIIPROTO_REQ_IR2;
302	cmd[1] = flags;
303
304	wiiproto_keep_rumble(wdata, &cmd[1]);
305	wiimote_queue(wdata, cmd, sizeof(cmd));
306}
307
308#define wiiproto_req_wreg(wdata, os, buf, sz) \
309			wiiproto_req_wmem((wdata), false, (os), (buf), (sz))
310
311#define wiiproto_req_weeprom(wdata, os, buf, sz) \
312			wiiproto_req_wmem((wdata), true, (os), (buf), (sz))
313
314static void wiiproto_req_wmem(struct wiimote_data *wdata, bool eeprom,
315				__u32 offset, const __u8 *buf, __u8 size)
316{
317	__u8 cmd[22];
318
319	if (size > 16 || size == 0) {
320		hid_warn(wdata->hdev, "Invalid length %d wmem request\n", size);
321		return;
322	}
323
324	memset(cmd, 0, sizeof(cmd));
325	cmd[0] = WIIPROTO_REQ_WMEM;
326	cmd[2] = (offset >> 16) & 0xff;
327	cmd[3] = (offset >> 8) & 0xff;
328	cmd[4] = offset & 0xff;
329	cmd[5] = size;
330	memcpy(&cmd[6], buf, size);
331
332	if (!eeprom)
333		cmd[1] |= 0x04;
334
335	wiiproto_keep_rumble(wdata, &cmd[1]);
336	wiimote_queue(wdata, cmd, sizeof(cmd));
337}
338
339void wiiproto_req_rmem(struct wiimote_data *wdata, bool eeprom, __u32 offset,
340								__u16 size)
341{
342	__u8 cmd[7];
343
344	if (size == 0) {
345		hid_warn(wdata->hdev, "Invalid length %d rmem request\n", size);
346		return;
347	}
348
349	cmd[0] = WIIPROTO_REQ_RMEM;
350	cmd[1] = 0;
351	cmd[2] = (offset >> 16) & 0xff;
352	cmd[3] = (offset >> 8) & 0xff;
353	cmd[4] = offset & 0xff;
354	cmd[5] = (size >> 8) & 0xff;
355	cmd[6] = size & 0xff;
356
357	if (!eeprom)
358		cmd[1] |= 0x04;
359
360	wiiproto_keep_rumble(wdata, &cmd[1]);
361	wiimote_queue(wdata, cmd, sizeof(cmd));
362}
363
364/* requries the cmd-mutex to be held */
365int wiimote_cmd_write(struct wiimote_data *wdata, __u32 offset,
366						const __u8 *wmem, __u8 size)
367{
368	unsigned long flags;
369	int ret;
370
371	spin_lock_irqsave(&wdata->state.lock, flags);
372	wiimote_cmd_set(wdata, WIIPROTO_REQ_WMEM, 0);
373	wiiproto_req_wreg(wdata, offset, wmem, size);
374	spin_unlock_irqrestore(&wdata->state.lock, flags);
375
376	ret = wiimote_cmd_wait(wdata);
377	if (!ret && wdata->state.cmd_err)
378		ret = -EIO;
379
380	return ret;
381}
382
383/* requries the cmd-mutex to be held */
384ssize_t wiimote_cmd_read(struct wiimote_data *wdata, __u32 offset, __u8 *rmem,
385								__u8 size)
386{
387	unsigned long flags;
388	ssize_t ret;
389
390	spin_lock_irqsave(&wdata->state.lock, flags);
391	wdata->state.cmd_read_size = size;
392	wdata->state.cmd_read_buf = rmem;
393	wiimote_cmd_set(wdata, WIIPROTO_REQ_RMEM, offset & 0xffff);
394	wiiproto_req_rreg(wdata, offset, size);
395	spin_unlock_irqrestore(&wdata->state.lock, flags);
396
397	ret = wiimote_cmd_wait(wdata);
398
399	spin_lock_irqsave(&wdata->state.lock, flags);
400	wdata->state.cmd_read_buf = NULL;
401	spin_unlock_irqrestore(&wdata->state.lock, flags);
402
403	if (!ret) {
404		if (wdata->state.cmd_read_size == 0)
405			ret = -EIO;
406		else
407			ret = wdata->state.cmd_read_size;
408	}
409
410	return ret;
411}
412
413/* requires the cmd-mutex to be held */
414static int wiimote_cmd_init_ext(struct wiimote_data *wdata)
415{
416	__u8 wmem;
417	int ret;
418
419	/* initialize extension */
420	wmem = 0x55;
421	ret = wiimote_cmd_write(wdata, 0xa400f0, &wmem, sizeof(wmem));
422	if (ret)
423		return ret;
424
425	/* disable default encryption */
426	wmem = 0x0;
427	ret = wiimote_cmd_write(wdata, 0xa400fb, &wmem, sizeof(wmem));
428	if (ret)
429		return ret;
430
431	return 0;
432}
433
434/* requires the cmd-mutex to be held */
435static __u8 wiimote_cmd_read_ext(struct wiimote_data *wdata, __u8 *rmem)
436{
437	int ret;
438
439	/* read extension ID */
440	ret = wiimote_cmd_read(wdata, 0xa400fa, rmem, 6);
441	if (ret != 6)
442		return WIIMOTE_EXT_NONE;
443
444	hid_dbg(wdata->hdev, "extension ID: %6phC\n", rmem);
445
446	if (rmem[0] == 0xff && rmem[1] == 0xff && rmem[2] == 0xff &&
447	    rmem[3] == 0xff && rmem[4] == 0xff && rmem[5] == 0xff)
448		return WIIMOTE_EXT_NONE;
449
450	if (rmem[4] == 0x00 && rmem[5] == 0x00)
451		return WIIMOTE_EXT_NUNCHUK;
452	if (rmem[4] == 0x01 && rmem[5] == 0x01)
453		return WIIMOTE_EXT_CLASSIC_CONTROLLER;
454	if (rmem[4] == 0x04 && rmem[5] == 0x02)
455		return WIIMOTE_EXT_BALANCE_BOARD;
456	if (rmem[4] == 0x01 && rmem[5] == 0x20)
457		return WIIMOTE_EXT_PRO_CONTROLLER;
458
459	return WIIMOTE_EXT_UNKNOWN;
460}
461
462/* requires the cmd-mutex to be held */
463static int wiimote_cmd_init_mp(struct wiimote_data *wdata)
464{
465	__u8 wmem;
466	int ret;
467
468	/* initialize MP */
469	wmem = 0x55;
470	ret = wiimote_cmd_write(wdata, 0xa600f0, &wmem, sizeof(wmem));
471	if (ret)
472		return ret;
473
474	/* disable default encryption */
475	wmem = 0x0;
476	ret = wiimote_cmd_write(wdata, 0xa600fb, &wmem, sizeof(wmem));
477	if (ret)
478		return ret;
479
480	return 0;
481}
482
483/* requires the cmd-mutex to be held */
484static bool wiimote_cmd_map_mp(struct wiimote_data *wdata, __u8 exttype)
485{
486	__u8 wmem;
487
488	/* map MP with correct pass-through mode */
489	switch (exttype) {
490	case WIIMOTE_EXT_CLASSIC_CONTROLLER:
491		wmem = 0x07;
492		break;
493	case WIIMOTE_EXT_NUNCHUK:
494		wmem = 0x05;
495		break;
496	default:
497		wmem = 0x04;
498		break;
499	}
500
501	return wiimote_cmd_write(wdata, 0xa600fe, &wmem, sizeof(wmem));
502}
503
504/* requires the cmd-mutex to be held */
505static bool wiimote_cmd_read_mp(struct wiimote_data *wdata, __u8 *rmem)
506{
507	int ret;
508
509	/* read motion plus ID */
510	ret = wiimote_cmd_read(wdata, 0xa600fa, rmem, 6);
511	if (ret != 6)
512		return false;
513
514	hid_dbg(wdata->hdev, "motion plus ID: %6phC\n", rmem);
515
516	if (rmem[5] == 0x05)
517		return true;
518
519	hid_info(wdata->hdev, "unknown motion plus ID: %6phC\n", rmem);
520
521	return false;
522}
523
524/* requires the cmd-mutex to be held */
525static __u8 wiimote_cmd_read_mp_mapped(struct wiimote_data *wdata)
526{
527	int ret;
528	__u8 rmem[6];
529
530	/* read motion plus ID */
531	ret = wiimote_cmd_read(wdata, 0xa400fa, rmem, 6);
532	if (ret != 6)
533		return WIIMOTE_MP_NONE;
534
535	hid_dbg(wdata->hdev, "mapped motion plus ID: %6phC\n", rmem);
536
537	if (rmem[0] == 0xff && rmem[1] == 0xff && rmem[2] == 0xff &&
538	    rmem[3] == 0xff && rmem[4] == 0xff && rmem[5] == 0xff)
539		return WIIMOTE_MP_NONE;
540
541	if (rmem[4] == 0x04 && rmem[5] == 0x05)
542		return WIIMOTE_MP_SINGLE;
543	else if (rmem[4] == 0x05 && rmem[5] == 0x05)
544		return WIIMOTE_MP_PASSTHROUGH_NUNCHUK;
545	else if (rmem[4] == 0x07 && rmem[5] == 0x05)
546		return WIIMOTE_MP_PASSTHROUGH_CLASSIC;
547
548	return WIIMOTE_MP_UNKNOWN;
549}
550
551/* device module handling */
552
553static const __u8 * const wiimote_devtype_mods[WIIMOTE_DEV_NUM] = {
554	[WIIMOTE_DEV_PENDING] = (const __u8[]){
555		WIIMOD_NULL,
556	},
557	[WIIMOTE_DEV_UNKNOWN] = (const __u8[]){
558		WIIMOD_NO_MP,
559		WIIMOD_NULL,
560	},
561	[WIIMOTE_DEV_GENERIC] = (const __u8[]){
562		WIIMOD_KEYS,
563		WIIMOD_RUMBLE,
564		WIIMOD_BATTERY,
565		WIIMOD_LED1,
566		WIIMOD_LED2,
567		WIIMOD_LED3,
568		WIIMOD_LED4,
569		WIIMOD_ACCEL,
570		WIIMOD_IR,
571		WIIMOD_NULL,
572	},
573	[WIIMOTE_DEV_GEN10] = (const __u8[]){
574		WIIMOD_KEYS,
575		WIIMOD_RUMBLE,
576		WIIMOD_BATTERY,
577		WIIMOD_LED1,
578		WIIMOD_LED2,
579		WIIMOD_LED3,
580		WIIMOD_LED4,
581		WIIMOD_ACCEL,
582		WIIMOD_IR,
583		WIIMOD_NULL,
584	},
585	[WIIMOTE_DEV_GEN20] = (const __u8[]){
586		WIIMOD_KEYS,
587		WIIMOD_RUMBLE,
588		WIIMOD_BATTERY,
589		WIIMOD_LED1,
590		WIIMOD_LED2,
591		WIIMOD_LED3,
592		WIIMOD_LED4,
593		WIIMOD_ACCEL,
594		WIIMOD_IR,
595		WIIMOD_BUILTIN_MP,
596		WIIMOD_NULL,
597	},
598	[WIIMOTE_DEV_BALANCE_BOARD] = (const __u8[]) {
599		WIIMOD_BATTERY,
600		WIIMOD_LED1,
601		WIIMOD_NO_MP,
602		WIIMOD_NULL,
603	},
604	[WIIMOTE_DEV_PRO_CONTROLLER] = (const __u8[]) {
605		WIIMOD_BATTERY,
606		WIIMOD_LED1,
607		WIIMOD_LED2,
608		WIIMOD_LED3,
609		WIIMOD_LED4,
610		WIIMOD_NO_MP,
611		WIIMOD_NULL,
612	},
613};
614
615static void wiimote_modules_load(struct wiimote_data *wdata,
616				 unsigned int devtype)
617{
618	bool need_input = false;
619	const __u8 *mods, *iter;
620	const struct wiimod_ops *ops;
621	int ret;
622
623	mods = wiimote_devtype_mods[devtype];
624
625	for (iter = mods; *iter != WIIMOD_NULL; ++iter) {
626		if (wiimod_table[*iter]->flags & WIIMOD_FLAG_INPUT) {
627			need_input = true;
628			break;
629		}
630	}
631
632	if (need_input) {
633		wdata->input = input_allocate_device();
634		if (!wdata->input)
635			return;
636
637		input_set_drvdata(wdata->input, wdata);
638		wdata->input->dev.parent = &wdata->hdev->dev;
639		wdata->input->id.bustype = wdata->hdev->bus;
640		wdata->input->id.vendor = wdata->hdev->vendor;
641		wdata->input->id.product = wdata->hdev->product;
642		wdata->input->id.version = wdata->hdev->version;
643		wdata->input->name = WIIMOTE_NAME;
644	}
645
646	for (iter = mods; *iter != WIIMOD_NULL; ++iter) {
647		ops = wiimod_table[*iter];
648		if (!ops->probe)
649			continue;
650
651		ret = ops->probe(ops, wdata);
652		if (ret)
653			goto error;
654	}
655
656	if (wdata->input) {
657		ret = input_register_device(wdata->input);
658		if (ret)
659			goto error;
660	}
661
662	spin_lock_irq(&wdata->state.lock);
663	wdata->state.devtype = devtype;
664	spin_unlock_irq(&wdata->state.lock);
665	return;
666
667error:
668	for ( ; iter-- != mods; ) {
669		ops = wiimod_table[*iter];
670		if (ops->remove)
671			ops->remove(ops, wdata);
672	}
673
674	if (wdata->input) {
675		input_free_device(wdata->input);
676		wdata->input = NULL;
677	}
678}
679
680static void wiimote_modules_unload(struct wiimote_data *wdata)
681{
682	const __u8 *mods, *iter;
683	const struct wiimod_ops *ops;
684	unsigned long flags;
685
686	mods = wiimote_devtype_mods[wdata->state.devtype];
687
688	spin_lock_irqsave(&wdata->state.lock, flags);
689	wdata->state.devtype = WIIMOTE_DEV_UNKNOWN;
690	spin_unlock_irqrestore(&wdata->state.lock, flags);
691
692	/* find end of list */
693	for (iter = mods; *iter != WIIMOD_NULL; ++iter)
694		/* empty */ ;
695
696	if (wdata->input) {
697		input_get_device(wdata->input);
698		input_unregister_device(wdata->input);
699	}
700
701	for ( ; iter-- != mods; ) {
702		ops = wiimod_table[*iter];
703		if (ops->remove)
704			ops->remove(ops, wdata);
705	}
706
707	if (wdata->input) {
708		input_put_device(wdata->input);
709		wdata->input = NULL;
710	}
711}
712
713/* device extension handling */
714
715static void wiimote_ext_load(struct wiimote_data *wdata, unsigned int ext)
716{
717	unsigned long flags;
718	const struct wiimod_ops *ops;
719	int ret;
720
721	ops = wiimod_ext_table[ext];
722
723	if (ops->probe) {
724		ret = ops->probe(ops, wdata);
725		if (ret)
726			ext = WIIMOTE_EXT_UNKNOWN;
727	}
728
729	spin_lock_irqsave(&wdata->state.lock, flags);
730	wdata->state.exttype = ext;
731	spin_unlock_irqrestore(&wdata->state.lock, flags);
732}
733
734static void wiimote_ext_unload(struct wiimote_data *wdata)
735{
736	unsigned long flags;
737	const struct wiimod_ops *ops;
738
739	ops = wiimod_ext_table[wdata->state.exttype];
740
741	spin_lock_irqsave(&wdata->state.lock, flags);
742	wdata->state.exttype = WIIMOTE_EXT_UNKNOWN;
743	wdata->state.flags &= ~WIIPROTO_FLAG_EXT_USED;
744	spin_unlock_irqrestore(&wdata->state.lock, flags);
745
746	if (ops->remove)
747		ops->remove(ops, wdata);
748}
749
750static void wiimote_mp_load(struct wiimote_data *wdata)
751{
752	unsigned long flags;
753	const struct wiimod_ops *ops;
754	int ret;
755	__u8 mode = 2;
756
757	ops = &wiimod_mp;
758	if (ops->probe) {
759		ret = ops->probe(ops, wdata);
760		if (ret)
761			mode = 1;
762	}
763
764	spin_lock_irqsave(&wdata->state.lock, flags);
765	wdata->state.mp = mode;
766	spin_unlock_irqrestore(&wdata->state.lock, flags);
767}
768
769static void wiimote_mp_unload(struct wiimote_data *wdata)
770{
771	unsigned long flags;
772	const struct wiimod_ops *ops;
773
774	if (wdata->state.mp < 2)
775		return;
776
777	ops = &wiimod_mp;
778
779	spin_lock_irqsave(&wdata->state.lock, flags);
780	wdata->state.mp = 0;
781	wdata->state.flags &= ~WIIPROTO_FLAG_MP_USED;
782	spin_unlock_irqrestore(&wdata->state.lock, flags);
783
784	if (ops->remove)
785		ops->remove(ops, wdata);
786}
787
788/* device (re-)initialization and detection */
789
790static const char *wiimote_devtype_names[WIIMOTE_DEV_NUM] = {
791	[WIIMOTE_DEV_PENDING] = "Pending",
792	[WIIMOTE_DEV_UNKNOWN] = "Unknown",
793	[WIIMOTE_DEV_GENERIC] = "Generic",
794	[WIIMOTE_DEV_GEN10] = "Nintendo Wii Remote (Gen 1)",
795	[WIIMOTE_DEV_GEN20] = "Nintendo Wii Remote Plus (Gen 2)",
796	[WIIMOTE_DEV_BALANCE_BOARD] = "Nintendo Wii Balance Board",
797	[WIIMOTE_DEV_PRO_CONTROLLER] = "Nintendo Wii U Pro Controller",
798};
799
800/* Try to guess the device type based on all collected information. We
801 * first try to detect by static extension types, then VID/PID and the
802 * device name. If we cannot detect the device, we use
803 * WIIMOTE_DEV_GENERIC so all modules will get probed on the device. */
804static void wiimote_init_set_type(struct wiimote_data *wdata,
805				  __u8 exttype)
806{
807	__u8 devtype = WIIMOTE_DEV_GENERIC;
808	__u16 vendor, product;
809	const char *name;
810
811	vendor = wdata->hdev->vendor;
812	product = wdata->hdev->product;
813	name = wdata->hdev->name;
814
815	if (exttype == WIIMOTE_EXT_BALANCE_BOARD) {
816		devtype = WIIMOTE_DEV_BALANCE_BOARD;
817		goto done;
818	} else if (exttype == WIIMOTE_EXT_PRO_CONTROLLER) {
819		devtype = WIIMOTE_DEV_PRO_CONTROLLER;
820		goto done;
821	}
822
823	if (!strcmp(name, "Nintendo RVL-CNT-01")) {
824		devtype = WIIMOTE_DEV_GEN10;
825		goto done;
826	} else if (!strcmp(name, "Nintendo RVL-CNT-01-TR")) {
827		devtype = WIIMOTE_DEV_GEN20;
828		goto done;
829	} else if (!strcmp(name, "Nintendo RVL-WBC-01")) {
830		devtype = WIIMOTE_DEV_BALANCE_BOARD;
831		goto done;
832	} else if (!strcmp(name, "Nintendo RVL-CNT-01-UC")) {
833		devtype = WIIMOTE_DEV_PRO_CONTROLLER;
834		goto done;
835	}
836
837	if (vendor == USB_VENDOR_ID_NINTENDO) {
838		if (product == USB_DEVICE_ID_NINTENDO_WIIMOTE) {
839			devtype = WIIMOTE_DEV_GEN10;
840			goto done;
841		} else if (product == USB_DEVICE_ID_NINTENDO_WIIMOTE2) {
842			devtype = WIIMOTE_DEV_GEN20;
843			goto done;
844		}
845	}
846
847done:
848	if (devtype == WIIMOTE_DEV_GENERIC)
849		hid_info(wdata->hdev, "cannot detect device; NAME: %s VID: %04x PID: %04x EXT: %04x\n",
850			name, vendor, product, exttype);
851	else
852		hid_info(wdata->hdev, "detected device: %s\n",
853			 wiimote_devtype_names[devtype]);
854
855	wiimote_modules_load(wdata, devtype);
856}
857
858static void wiimote_init_detect(struct wiimote_data *wdata)
859{
860	__u8 exttype = WIIMOTE_EXT_NONE, extdata[6];
861	bool ext;
862	int ret;
863
864	wiimote_cmd_acquire_noint(wdata);
865
866	spin_lock_irq(&wdata->state.lock);
867	wdata->state.devtype = WIIMOTE_DEV_UNKNOWN;
868	wiimote_cmd_set(wdata, WIIPROTO_REQ_SREQ, 0);
869	wiiproto_req_status(wdata);
870	spin_unlock_irq(&wdata->state.lock);
871
872	ret = wiimote_cmd_wait_noint(wdata);
873	if (ret)
874		goto out_release;
875
876	spin_lock_irq(&wdata->state.lock);
877	ext = wdata->state.flags & WIIPROTO_FLAG_EXT_PLUGGED;
878	spin_unlock_irq(&wdata->state.lock);
879
880	if (!ext)
881		goto out_release;
882
883	wiimote_cmd_init_ext(wdata);
884	exttype = wiimote_cmd_read_ext(wdata, extdata);
885
886out_release:
887	wiimote_cmd_release(wdata);
888	wiimote_init_set_type(wdata, exttype);
889
890	/* schedule MP timer */
891	spin_lock_irq(&wdata->state.lock);
892	if (!(wdata->state.flags & WIIPROTO_FLAG_BUILTIN_MP) &&
893	    !(wdata->state.flags & WIIPROTO_FLAG_NO_MP))
894		mod_timer(&wdata->timer, jiffies + HZ * 4);
895	spin_unlock_irq(&wdata->state.lock);
896}
897
898/*
899 * MP hotplug events are not generated by the wiimote. Therefore, we need
900 * polling to detect it. We use a 4s interval for polling MP registers. This
901 * seems reasonable considering applications can trigger it manually via
902 * sysfs requests.
903 */
904static void wiimote_init_poll_mp(struct wiimote_data *wdata)
905{
906	bool mp;
907	__u8 mpdata[6];
908
909	wiimote_cmd_acquire_noint(wdata);
910	wiimote_cmd_init_mp(wdata);
911	mp = wiimote_cmd_read_mp(wdata, mpdata);
912	wiimote_cmd_release(wdata);
913
914	/* load/unload MP module if it changed */
915	if (mp) {
916		if (!wdata->state.mp) {
917			hid_info(wdata->hdev, "detected extension: Nintendo Wii Motion Plus\n");
918			wiimote_mp_load(wdata);
919		}
920	} else if (wdata->state.mp) {
921		wiimote_mp_unload(wdata);
922	}
923
924	mod_timer(&wdata->timer, jiffies + HZ * 4);
925}
926
927/*
928 * Check whether the wiimote is in the expected state. The extension registers
929 * may change during hotplug and initialization so we might get hotplug events
930 * that we caused by remapping some memory.
931 * We use some heuristics here to check known states. If the wiimote is in the
932 * expected state, we can ignore the hotplug event.
933 *
934 * Returns "true" if the device is in expected state, "false" if we should
935 * redo hotplug handling and extension initialization.
936 */
937static bool wiimote_init_check(struct wiimote_data *wdata)
938{
939	__u32 flags;
940	__u8 type, data[6];
941	bool ret, poll_mp;
942
943	spin_lock_irq(&wdata->state.lock);
944	flags = wdata->state.flags;
945	spin_unlock_irq(&wdata->state.lock);
946
947	wiimote_cmd_acquire_noint(wdata);
948
949	/* If MP is used and active, but the extension is not, we expect:
950	 *   read_mp_mapped() == WIIMOTE_MP_SINGLE
951	 *   state.flags == !EXT_ACTIVE && !MP_PLUGGED && MP_ACTIVE
952	 * We do not check EXT_PLUGGED because it might change during
953	 * initialization of MP without extensions.
954	 *  - If MP is unplugged/replugged, read_mp_mapped() fails
955	 *  - If EXT is plugged, MP_PLUGGED will get set */
956	if (wdata->state.exttype == WIIMOTE_EXT_NONE &&
957	    wdata->state.mp > 0 && (flags & WIIPROTO_FLAG_MP_USED)) {
958		type = wiimote_cmd_read_mp_mapped(wdata);
959		ret = type == WIIMOTE_MP_SINGLE;
960
961		spin_lock_irq(&wdata->state.lock);
962		ret = ret && !(wdata->state.flags & WIIPROTO_FLAG_EXT_ACTIVE);
963		ret = ret && !(wdata->state.flags & WIIPROTO_FLAG_MP_PLUGGED);
964		ret = ret && (wdata->state.flags & WIIPROTO_FLAG_MP_ACTIVE);
965		spin_unlock_irq(&wdata->state.lock);
966
967		if (!ret)
968			hid_dbg(wdata->hdev, "state left: !EXT && MP\n");
969
970		/* while MP is mapped, we get EXT_PLUGGED events */
971		poll_mp = false;
972
973		goto out_release;
974	}
975
976	/* If MP is unused, but the extension port is used, we expect:
977	 *   read_ext == state.exttype
978	 *   state.flags == !MP_ACTIVE && EXT_ACTIVE
979	 * - If MP is plugged/unplugged, our timer detects it
980	 * - If EXT is unplugged/replugged, EXT_ACTIVE will become unset */
981	if (!(flags & WIIPROTO_FLAG_MP_USED) &&
982	    wdata->state.exttype != WIIMOTE_EXT_NONE) {
983		type = wiimote_cmd_read_ext(wdata, data);
984		ret = type == wdata->state.exttype;
985
986		spin_lock_irq(&wdata->state.lock);
987		ret = ret && !(wdata->state.flags & WIIPROTO_FLAG_MP_ACTIVE);
988		ret = ret && (wdata->state.flags & WIIPROTO_FLAG_EXT_ACTIVE);
989		spin_unlock_irq(&wdata->state.lock);
990
991		if (!ret)
992			hid_dbg(wdata->hdev, "state left: EXT && !MP\n");
993
994		/* poll MP for hotplug events */
995		poll_mp = true;
996
997		goto out_release;
998	}
999
1000	/* If neither MP nor an extension are used, we expect:
1001	 *   read_ext() == WIIMOTE_EXT_NONE
1002	 *   state.flags == !MP_ACTIVE && !EXT_ACTIVE && !EXT_PLUGGED
1003	 * No need to perform any action in this case as everything is
1004	 * disabled already.
1005	 * - If MP is plugged/unplugged, our timer detects it
1006	 * - If EXT is plugged, EXT_PLUGGED will be set */
1007	if (!(flags & WIIPROTO_FLAG_MP_USED) &&
1008	    wdata->state.exttype == WIIMOTE_EXT_NONE) {
1009		type = wiimote_cmd_read_ext(wdata, data);
1010		ret = type == wdata->state.exttype;
1011
1012		spin_lock_irq(&wdata->state.lock);
1013		ret = ret && !(wdata->state.flags & WIIPROTO_FLAG_EXT_ACTIVE);
1014		ret = ret && !(wdata->state.flags & WIIPROTO_FLAG_MP_ACTIVE);
1015		ret = ret && !(wdata->state.flags & WIIPROTO_FLAG_EXT_PLUGGED);
1016		spin_unlock_irq(&wdata->state.lock);
1017
1018		if (!ret)
1019			hid_dbg(wdata->hdev, "state left: !EXT && !MP\n");
1020
1021		/* poll MP for hotplug events */
1022		poll_mp = true;
1023
1024		goto out_release;
1025	}
1026
1027	/* The trickiest part is if both EXT and MP are active. We cannot read
1028	 * the EXT ID, anymore, because MP is mapped over it. However, we use
1029	 * a handy trick here:
1030	 *   - EXT_ACTIVE is unset whenever !MP_PLUGGED is sent
1031	 * MP_PLUGGED might be re-sent again before we are scheduled, but
1032	 * EXT_ACTIVE will stay unset.
1033	 * So it is enough to check for mp_mapped() and MP_ACTIVE and
1034	 * EXT_ACTIVE. EXT_PLUGGED is a sanity check. */
1035	if (wdata->state.exttype != WIIMOTE_EXT_NONE &&
1036	    wdata->state.mp > 0 && (flags & WIIPROTO_FLAG_MP_USED)) {
1037		type = wiimote_cmd_read_mp_mapped(wdata);
1038		ret = type != WIIMOTE_MP_NONE;
1039		ret = ret && type != WIIMOTE_MP_UNKNOWN;
1040		ret = ret && type != WIIMOTE_MP_SINGLE;
1041
1042		spin_lock_irq(&wdata->state.lock);
1043		ret = ret && (wdata->state.flags & WIIPROTO_FLAG_EXT_PLUGGED);
1044		ret = ret && (wdata->state.flags & WIIPROTO_FLAG_EXT_ACTIVE);
1045		ret = ret && (wdata->state.flags & WIIPROTO_FLAG_MP_ACTIVE);
1046		spin_unlock_irq(&wdata->state.lock);
1047
1048		if (!ret)
1049			hid_dbg(wdata->hdev, "state left: EXT && MP\n");
1050
1051		/* while MP is mapped, we get EXT_PLUGGED events */
1052		poll_mp = false;
1053
1054		goto out_release;
1055	}
1056
1057	/* unknown state */
1058	ret = false;
1059
1060out_release:
1061	wiimote_cmd_release(wdata);
1062
1063	/* only poll for MP if requested and if state didn't change */
1064	if (ret && poll_mp && !(flags & WIIPROTO_FLAG_BUILTIN_MP) &&
1065	    !(flags & WIIPROTO_FLAG_NO_MP))
1066		wiimote_init_poll_mp(wdata);
1067
1068	return ret;
1069}
1070
1071static const char *wiimote_exttype_names[WIIMOTE_EXT_NUM] = {
1072	[WIIMOTE_EXT_NONE] = "None",
1073	[WIIMOTE_EXT_UNKNOWN] = "Unknown",
1074	[WIIMOTE_EXT_NUNCHUK] = "Nintendo Wii Nunchuk",
1075	[WIIMOTE_EXT_CLASSIC_CONTROLLER] = "Nintendo Wii Classic Controller",
1076	[WIIMOTE_EXT_BALANCE_BOARD] = "Nintendo Wii Balance Board",
1077	[WIIMOTE_EXT_PRO_CONTROLLER] = "Nintendo Wii U Pro Controller",
1078};
1079
1080/*
1081 * Handle hotplug events
1082 * If we receive an hotplug event and the device-check failed, we deinitialize
1083 * the extension ports, re-read all extension IDs and set the device into
1084 * the desired state. This involves mapping MP into the main extension
1085 * registers, setting up extension passthrough modes and initializing the
1086 * requested extensions.
1087 */
1088static void wiimote_init_hotplug(struct wiimote_data *wdata)
1089{
1090	__u8 exttype, extdata[6], mpdata[6];
1091	__u32 flags;
1092	bool mp;
1093
1094	hid_dbg(wdata->hdev, "detect extensions..\n");
1095
1096	wiimote_cmd_acquire_noint(wdata);
1097
1098	spin_lock_irq(&wdata->state.lock);
1099
1100	/* get state snapshot that we will then work on */
1101	flags = wdata->state.flags;
1102
1103	/* disable event forwarding temporarily */
1104	wdata->state.flags &= ~WIIPROTO_FLAG_EXT_ACTIVE;
1105	wdata->state.flags &= ~WIIPROTO_FLAG_MP_ACTIVE;
1106
1107	spin_unlock_irq(&wdata->state.lock);
1108
1109	/* init extension and MP (deactivates current extension or MP) */
1110	wiimote_cmd_init_ext(wdata);
1111	if (flags & WIIPROTO_FLAG_NO_MP) {
1112		mp = false;
1113	} else {
1114		wiimote_cmd_init_mp(wdata);
1115		mp = wiimote_cmd_read_mp(wdata, mpdata);
1116	}
1117	exttype = wiimote_cmd_read_ext(wdata, extdata);
1118
1119	wiimote_cmd_release(wdata);
1120
1121	/* load/unload extension module if it changed */
1122	if (exttype != wdata->state.exttype) {
1123		/* unload previous extension */
1124		wiimote_ext_unload(wdata);
1125
1126		if (exttype == WIIMOTE_EXT_UNKNOWN) {
1127			hid_info(wdata->hdev, "cannot detect extension; %6phC\n",
1128				 extdata);
1129		} else if (exttype == WIIMOTE_EXT_NONE) {
1130			spin_lock_irq(&wdata->state.lock);
1131			wdata->state.exttype = WIIMOTE_EXT_NONE;
1132			spin_unlock_irq(&wdata->state.lock);
1133		} else {
1134			hid_info(wdata->hdev, "detected extension: %s\n",
1135				 wiimote_exttype_names[exttype]);
1136			/* try loading new extension */
1137			wiimote_ext_load(wdata, exttype);
1138		}
1139	}
1140
1141	/* load/unload MP module if it changed */
1142	if (mp) {
1143		if (!wdata->state.mp) {
1144			hid_info(wdata->hdev, "detected extension: Nintendo Wii Motion Plus\n");
1145			wiimote_mp_load(wdata);
1146		}
1147	} else if (wdata->state.mp) {
1148		wiimote_mp_unload(wdata);
1149	}
1150
1151	/* if MP is not used, do not map or activate it */
1152	if (!(flags & WIIPROTO_FLAG_MP_USED))
1153		mp = false;
1154
1155	/* map MP into main extension registers if used */
1156	if (mp) {
1157		wiimote_cmd_acquire_noint(wdata);
1158		wiimote_cmd_map_mp(wdata, exttype);
1159		wiimote_cmd_release(wdata);
1160
1161		/* delete MP hotplug timer */
1162		del_timer_sync(&wdata->timer);
1163	} else {
1164		/* reschedule MP hotplug timer */
1165		if (!(flags & WIIPROTO_FLAG_BUILTIN_MP) &&
1166		    !(flags & WIIPROTO_FLAG_NO_MP))
1167			mod_timer(&wdata->timer, jiffies + HZ * 4);
1168	}
1169
1170	spin_lock_irq(&wdata->state.lock);
1171
1172	/* enable data forwarding again and set expected hotplug state */
1173	if (mp) {
1174		wdata->state.flags |= WIIPROTO_FLAG_MP_ACTIVE;
1175		if (wdata->state.exttype == WIIMOTE_EXT_NONE) {
1176			wdata->state.flags &= ~WIIPROTO_FLAG_EXT_PLUGGED;
1177			wdata->state.flags &= ~WIIPROTO_FLAG_MP_PLUGGED;
1178		} else {
1179			wdata->state.flags &= ~WIIPROTO_FLAG_EXT_PLUGGED;
1180			wdata->state.flags |= WIIPROTO_FLAG_MP_PLUGGED;
1181			wdata->state.flags |= WIIPROTO_FLAG_EXT_ACTIVE;
1182		}
1183	} else if (wdata->state.exttype != WIIMOTE_EXT_NONE) {
1184		wdata->state.flags |= WIIPROTO_FLAG_EXT_ACTIVE;
1185	}
1186
1187	/* request status report for hotplug state updates */
1188	wiiproto_req_status(wdata);
1189
1190	spin_unlock_irq(&wdata->state.lock);
1191
1192	hid_dbg(wdata->hdev, "detected extensions: MP: %d EXT: %d\n",
1193		wdata->state.mp, wdata->state.exttype);
1194}
1195
1196static void wiimote_init_worker(struct work_struct *work)
1197{
1198	struct wiimote_data *wdata = container_of(work, struct wiimote_data,
1199						  init_worker);
1200	bool changed = false;
1201
1202	if (wdata->state.devtype == WIIMOTE_DEV_PENDING) {
1203		wiimote_init_detect(wdata);
1204		changed = true;
1205	}
1206
1207	if (changed || !wiimote_init_check(wdata))
1208		wiimote_init_hotplug(wdata);
1209
1210	if (changed)
1211		kobject_uevent(&wdata->hdev->dev.kobj, KOBJ_CHANGE);
1212}
1213
1214void __wiimote_schedule(struct wiimote_data *wdata)
1215{
1216	if (!(wdata->state.flags & WIIPROTO_FLAG_EXITING))
1217		schedule_work(&wdata->init_worker);
1218}
1219
1220static void wiimote_schedule(struct wiimote_data *wdata)
1221{
1222	unsigned long flags;
1223
1224	spin_lock_irqsave(&wdata->state.lock, flags);
1225	__wiimote_schedule(wdata);
1226	spin_unlock_irqrestore(&wdata->state.lock, flags);
1227}
1228
1229static void wiimote_init_timeout(unsigned long arg)
1230{
1231	struct wiimote_data *wdata = (void*)arg;
1232
1233	wiimote_schedule(wdata);
1234}
1235
1236/* protocol handlers */
1237
1238static void handler_keys(struct wiimote_data *wdata, const __u8 *payload)
1239{
1240	const __u8 *iter, *mods;
1241	const struct wiimod_ops *ops;
1242
1243	ops = wiimod_ext_table[wdata->state.exttype];
1244	if (ops->in_keys) {
1245		ops->in_keys(wdata, payload);
1246		return;
1247	}
1248
1249	mods = wiimote_devtype_mods[wdata->state.devtype];
1250	for (iter = mods; *iter != WIIMOD_NULL; ++iter) {
1251		ops = wiimod_table[*iter];
1252		if (ops->in_keys) {
1253			ops->in_keys(wdata, payload);
1254			break;
1255		}
1256	}
1257}
1258
1259static void handler_accel(struct wiimote_data *wdata, const __u8 *payload)
1260{
1261	const __u8 *iter, *mods;
1262	const struct wiimod_ops *ops;
1263
1264	ops = wiimod_ext_table[wdata->state.exttype];
1265	if (ops->in_accel) {
1266		ops->in_accel(wdata, payload);
1267		return;
1268	}
1269
1270	mods = wiimote_devtype_mods[wdata->state.devtype];
1271	for (iter = mods; *iter != WIIMOD_NULL; ++iter) {
1272		ops = wiimod_table[*iter];
1273		if (ops->in_accel) {
1274			ops->in_accel(wdata, payload);
1275			break;
1276		}
1277	}
1278}
1279
1280static bool valid_ext_handler(const struct wiimod_ops *ops, size_t len)
1281{
1282	if (!ops->in_ext)
1283		return false;
1284	if ((ops->flags & WIIMOD_FLAG_EXT8) && len < 8)
1285		return false;
1286	if ((ops->flags & WIIMOD_FLAG_EXT16) && len < 16)
1287		return false;
1288
1289	return true;
1290}
1291
1292static void handler_ext(struct wiimote_data *wdata, const __u8 *payload,
1293			size_t len)
1294{
1295	static const __u8 invalid[21] = { 0xff, 0xff, 0xff, 0xff,
1296					  0xff, 0xff, 0xff, 0xff,
1297					  0xff, 0xff, 0xff, 0xff,
1298					  0xff, 0xff, 0xff, 0xff,
1299					  0xff, 0xff, 0xff, 0xff,
1300					  0xff };
1301	const __u8 *iter, *mods;
1302	const struct wiimod_ops *ops;
1303	bool is_mp;
1304
1305	if (len > 21)
1306		len = 21;
1307	if (len < 6 || !memcmp(payload, invalid, len))
1308		return;
1309
1310	/* if MP is active, track MP slot hotplugging */
1311	if (wdata->state.flags & WIIPROTO_FLAG_MP_ACTIVE) {
1312		/* this bit is set for invalid events (eg. during hotplug) */
1313		if (payload[5] & 0x01)
1314			return;
1315
1316		if (payload[4] & 0x01) {
1317			if (!(wdata->state.flags & WIIPROTO_FLAG_MP_PLUGGED)) {
1318				hid_dbg(wdata->hdev, "MP hotplug: 1\n");
1319				wdata->state.flags |= WIIPROTO_FLAG_MP_PLUGGED;
1320				__wiimote_schedule(wdata);
1321			}
1322		} else {
1323			if (wdata->state.flags & WIIPROTO_FLAG_MP_PLUGGED) {
1324				hid_dbg(wdata->hdev, "MP hotplug: 0\n");
1325				wdata->state.flags &= ~WIIPROTO_FLAG_MP_PLUGGED;
1326				wdata->state.flags &= ~WIIPROTO_FLAG_EXT_ACTIVE;
1327				__wiimote_schedule(wdata);
1328			}
1329		}
1330
1331		/* detect MP data that is sent interleaved with EXT data */
1332		is_mp = payload[5] & 0x02;
1333	} else {
1334		is_mp = false;
1335	}
1336
1337	/* ignore EXT events if no extension is active */
1338	if (!(wdata->state.flags & WIIPROTO_FLAG_EXT_ACTIVE) && !is_mp)
1339		return;
1340
1341	/* try forwarding to extension handler, first */
1342	ops = wiimod_ext_table[wdata->state.exttype];
1343	if (is_mp && ops->in_mp) {
1344		ops->in_mp(wdata, payload);
1345		return;
1346	} else if (!is_mp && valid_ext_handler(ops, len)) {
1347		ops->in_ext(wdata, payload);
1348		return;
1349	}
1350
1351	/* try forwarding to MP handler */
1352	ops = &wiimod_mp;
1353	if (is_mp && ops->in_mp) {
1354		ops->in_mp(wdata, payload);
1355		return;
1356	} else if (!is_mp && valid_ext_handler(ops, len)) {
1357		ops->in_ext(wdata, payload);
1358		return;
1359	}
1360
1361	/* try forwarding to loaded modules */
1362	mods = wiimote_devtype_mods[wdata->state.devtype];
1363	for (iter = mods; *iter != WIIMOD_NULL; ++iter) {
1364		ops = wiimod_table[*iter];
1365		if (is_mp && ops->in_mp) {
1366			ops->in_mp(wdata, payload);
1367			return;
1368		} else if (!is_mp && valid_ext_handler(ops, len)) {
1369			ops->in_ext(wdata, payload);
1370			return;
1371		}
1372	}
1373}
1374
1375#define ir_to_input0(wdata, ir, packed) handler_ir((wdata), (ir), (packed), 0)
1376#define ir_to_input1(wdata, ir, packed) handler_ir((wdata), (ir), (packed), 1)
1377#define ir_to_input2(wdata, ir, packed) handler_ir((wdata), (ir), (packed), 2)
1378#define ir_to_input3(wdata, ir, packed) handler_ir((wdata), (ir), (packed), 3)
1379
1380static void handler_ir(struct wiimote_data *wdata, const __u8 *payload,
1381		       bool packed, unsigned int id)
1382{
1383	const __u8 *iter, *mods;
1384	const struct wiimod_ops *ops;
1385
1386	ops = wiimod_ext_table[wdata->state.exttype];
1387	if (ops->in_ir) {
1388		ops->in_ir(wdata, payload, packed, id);
1389		return;
1390	}
1391
1392	mods = wiimote_devtype_mods[wdata->state.devtype];
1393	for (iter = mods; *iter != WIIMOD_NULL; ++iter) {
1394		ops = wiimod_table[*iter];
1395		if (ops->in_ir) {
1396			ops->in_ir(wdata, payload, packed, id);
1397			break;
1398		}
1399	}
1400}
1401
1402/* reduced status report with "BB BB" key data only */
1403static void handler_status_K(struct wiimote_data *wdata,
1404			     const __u8 *payload)
1405{
1406	handler_keys(wdata, payload);
1407
1408	/* on status reports the drm is reset so we need to resend the drm */
1409	wiiproto_req_drm(wdata, WIIPROTO_REQ_NULL);
1410}
1411
1412/* extended status report with "BB BB LF 00 00 VV" data */
1413static void handler_status(struct wiimote_data *wdata, const __u8 *payload)
1414{
1415	handler_status_K(wdata, payload);
1416
1417	/* update extension status */
1418	if (payload[2] & 0x02) {
1419		if (!(wdata->state.flags & WIIPROTO_FLAG_EXT_PLUGGED)) {
1420			hid_dbg(wdata->hdev, "EXT hotplug: 1\n");
1421			wdata->state.flags |= WIIPROTO_FLAG_EXT_PLUGGED;
1422			__wiimote_schedule(wdata);
1423		}
1424	} else {
1425		if (wdata->state.flags & WIIPROTO_FLAG_EXT_PLUGGED) {
1426			hid_dbg(wdata->hdev, "EXT hotplug: 0\n");
1427			wdata->state.flags &= ~WIIPROTO_FLAG_EXT_PLUGGED;
1428			wdata->state.flags &= ~WIIPROTO_FLAG_MP_PLUGGED;
1429			wdata->state.flags &= ~WIIPROTO_FLAG_EXT_ACTIVE;
1430			wdata->state.flags &= ~WIIPROTO_FLAG_MP_ACTIVE;
1431			__wiimote_schedule(wdata);
1432		}
1433	}
1434
1435	wdata->state.cmd_battery = payload[5];
1436	if (wiimote_cmd_pending(wdata, WIIPROTO_REQ_SREQ, 0))
1437		wiimote_cmd_complete(wdata);
1438}
1439
1440/* reduced generic report with "BB BB" key data only */
1441static void handler_generic_K(struct wiimote_data *wdata, const __u8 *payload)
1442{
1443	handler_keys(wdata, payload);
1444}
1445
1446static void handler_data(struct wiimote_data *wdata, const __u8 *payload)
1447{
1448	__u16 offset = payload[3] << 8 | payload[4];
1449	__u8 size = (payload[2] >> 4) + 1;
1450	__u8 err = payload[2] & 0x0f;
1451
1452	handler_keys(wdata, payload);
1453
1454	if (wiimote_cmd_pending(wdata, WIIPROTO_REQ_RMEM, offset)) {
1455		if (err)
1456			size = 0;
1457		else if (size > wdata->state.cmd_read_size)
1458			size = wdata->state.cmd_read_size;
1459
1460		wdata->state.cmd_read_size = size;
1461		if (wdata->state.cmd_read_buf)
1462			memcpy(wdata->state.cmd_read_buf, &payload[5], size);
1463		wiimote_cmd_complete(wdata);
1464	}
1465}
1466
1467static void handler_return(struct wiimote_data *wdata, const __u8 *payload)
1468{
1469	__u8 err = payload[3];
1470	__u8 cmd = payload[2];
1471
1472	handler_keys(wdata, payload);
1473
1474	if (wiimote_cmd_pending(wdata, cmd, 0)) {
1475		wdata->state.cmd_err = err;
1476		wiimote_cmd_complete(wdata);
1477	} else if (err) {
1478		hid_warn(wdata->hdev, "Remote error %hhu on req %hhu\n", err,
1479									cmd);
1480	}
1481}
1482
1483static void handler_drm_KA(struct wiimote_data *wdata, const __u8 *payload)
1484{
1485	handler_keys(wdata, payload);
1486	handler_accel(wdata, payload);
1487}
1488
1489static void handler_drm_KE(struct wiimote_data *wdata, const __u8 *payload)
1490{
1491	handler_keys(wdata, payload);
1492	handler_ext(wdata, &payload[2], 8);
1493}
1494
1495static void handler_drm_KAI(struct wiimote_data *wdata, const __u8 *payload)
1496{
1497	handler_keys(wdata, payload);
1498	handler_accel(wdata, payload);
1499	ir_to_input0(wdata, &payload[5], false);
1500	ir_to_input1(wdata, &payload[8], false);
1501	ir_to_input2(wdata, &payload[11], false);
1502	ir_to_input3(wdata, &payload[14], false);
1503}
1504
1505static void handler_drm_KEE(struct wiimote_data *wdata, const __u8 *payload)
1506{
1507	handler_keys(wdata, payload);
1508	handler_ext(wdata, &payload[2], 19);
1509}
1510
1511static void handler_drm_KIE(struct wiimote_data *wdata, const __u8 *payload)
1512{
1513	handler_keys(wdata, payload);
1514	ir_to_input0(wdata, &payload[2], false);
1515	ir_to_input1(wdata, &payload[4], true);
1516	ir_to_input2(wdata, &payload[7], false);
1517	ir_to_input3(wdata, &payload[9], true);
1518	handler_ext(wdata, &payload[12], 9);
1519}
1520
1521static void handler_drm_KAE(struct wiimote_data *wdata, const __u8 *payload)
1522{
1523	handler_keys(wdata, payload);
1524	handler_accel(wdata, payload);
1525	handler_ext(wdata, &payload[5], 16);
1526}
1527
1528static void handler_drm_KAIE(struct wiimote_data *wdata, const __u8 *payload)
1529{
1530	handler_keys(wdata, payload);
1531	handler_accel(wdata, payload);
1532	ir_to_input0(wdata, &payload[5], false);
1533	ir_to_input1(wdata, &payload[7], true);
1534	ir_to_input2(wdata, &payload[10], false);
1535	ir_to_input3(wdata, &payload[12], true);
1536	handler_ext(wdata, &payload[15], 6);
1537}
1538
1539static void handler_drm_E(struct wiimote_data *wdata, const __u8 *payload)
1540{
1541	handler_ext(wdata, payload, 21);
1542}
1543
1544static void handler_drm_SKAI1(struct wiimote_data *wdata, const __u8 *payload)
1545{
1546	handler_keys(wdata, payload);
1547
1548	wdata->state.accel_split[0] = payload[2];
1549	wdata->state.accel_split[1] = (payload[0] >> 1) & (0x10 | 0x20);
1550	wdata->state.accel_split[1] |= (payload[1] << 1) & (0x40 | 0x80);
1551
1552	ir_to_input0(wdata, &payload[3], false);
1553	ir_to_input1(wdata, &payload[12], false);
1554}
1555
1556static void handler_drm_SKAI2(struct wiimote_data *wdata, const __u8 *payload)
1557{
1558	__u8 buf[5];
1559
1560	handler_keys(wdata, payload);
1561
1562	wdata->state.accel_split[1] |= (payload[0] >> 5) & (0x01 | 0x02);
1563	wdata->state.accel_split[1] |= (payload[1] >> 3) & (0x04 | 0x08);
1564
1565	buf[0] = 0;
1566	buf[1] = 0;
1567	buf[2] = wdata->state.accel_split[0];
1568	buf[3] = payload[2];
1569	buf[4] = wdata->state.accel_split[1];
1570	handler_accel(wdata, buf);
1571
1572	ir_to_input2(wdata, &payload[3], false);
1573	ir_to_input3(wdata, &payload[12], false);
1574}
1575
1576struct wiiproto_handler {
1577	__u8 id;
1578	size_t size;
1579	void (*func)(struct wiimote_data *wdata, const __u8 *payload);
1580};
1581
1582static struct wiiproto_handler handlers[] = {
1583	{ .id = WIIPROTO_REQ_STATUS, .size = 6, .func = handler_status },
1584	{ .id = WIIPROTO_REQ_STATUS, .size = 2, .func = handler_status_K },
1585	{ .id = WIIPROTO_REQ_DATA, .size = 21, .func = handler_data },
1586	{ .id = WIIPROTO_REQ_DATA, .size = 2, .func = handler_generic_K },
1587	{ .id = WIIPROTO_REQ_RETURN, .size = 4, .func = handler_return },
1588	{ .id = WIIPROTO_REQ_RETURN, .size = 2, .func = handler_generic_K },
1589	{ .id = WIIPROTO_REQ_DRM_K, .size = 2, .func = handler_keys },
1590	{ .id = WIIPROTO_REQ_DRM_KA, .size = 5, .func = handler_drm_KA },
1591	{ .id = WIIPROTO_REQ_DRM_KA, .size = 2, .func = handler_generic_K },
1592	{ .id = WIIPROTO_REQ_DRM_KE, .size = 10, .func = handler_drm_KE },
1593	{ .id = WIIPROTO_REQ_DRM_KE, .size = 2, .func = handler_generic_K },
1594	{ .id = WIIPROTO_REQ_DRM_KAI, .size = 17, .func = handler_drm_KAI },
1595	{ .id = WIIPROTO_REQ_DRM_KAI, .size = 2, .func = handler_generic_K },
1596	{ .id = WIIPROTO_REQ_DRM_KEE, .size = 21, .func = handler_drm_KEE },
1597	{ .id = WIIPROTO_REQ_DRM_KEE, .size = 2, .func = handler_generic_K },
1598	{ .id = WIIPROTO_REQ_DRM_KAE, .size = 21, .func = handler_drm_KAE },
1599	{ .id = WIIPROTO_REQ_DRM_KAE, .size = 2, .func = handler_generic_K },
1600	{ .id = WIIPROTO_REQ_DRM_KIE, .size = 21, .func = handler_drm_KIE },
1601	{ .id = WIIPROTO_REQ_DRM_KIE, .size = 2, .func = handler_generic_K },
1602	{ .id = WIIPROTO_REQ_DRM_KAIE, .size = 21, .func = handler_drm_KAIE },
1603	{ .id = WIIPROTO_REQ_DRM_KAIE, .size = 2, .func = handler_generic_K },
1604	{ .id = WIIPROTO_REQ_DRM_E, .size = 21, .func = handler_drm_E },
1605	{ .id = WIIPROTO_REQ_DRM_SKAI1, .size = 21, .func = handler_drm_SKAI1 },
1606	{ .id = WIIPROTO_REQ_DRM_SKAI2, .size = 21, .func = handler_drm_SKAI2 },
1607	{ .id = 0 }
1608};
1609
1610static int wiimote_hid_event(struct hid_device *hdev, struct hid_report *report,
1611							u8 *raw_data, int size)
1612{
1613	struct wiimote_data *wdata = hid_get_drvdata(hdev);
1614	struct wiiproto_handler *h;
1615	int i;
1616	unsigned long flags;
1617
1618	if (size < 1)
1619		return -EINVAL;
1620
1621	spin_lock_irqsave(&wdata->state.lock, flags);
1622
1623	for (i = 0; handlers[i].id; ++i) {
1624		h = &handlers[i];
1625		if (h->id == raw_data[0] && h->size < size) {
1626			h->func(wdata, &raw_data[1]);
1627			break;
1628		}
1629	}
1630
1631	if (!handlers[i].id)
1632		hid_warn(hdev, "Unhandled report %hhu size %d\n", raw_data[0],
1633									size);
1634
1635	spin_unlock_irqrestore(&wdata->state.lock, flags);
1636
1637	return 0;
1638}
1639
1640static ssize_t wiimote_ext_show(struct device *dev,
1641				struct device_attribute *attr,
1642				char *buf)
1643{
1644	struct wiimote_data *wdata = dev_to_wii(dev);
1645	__u8 type;
1646	unsigned long flags;
1647
1648	spin_lock_irqsave(&wdata->state.lock, flags);
1649	type = wdata->state.exttype;
1650	spin_unlock_irqrestore(&wdata->state.lock, flags);
1651
1652	switch (type) {
1653	case WIIMOTE_EXT_NONE:
1654		return sprintf(buf, "none\n");
1655	case WIIMOTE_EXT_NUNCHUK:
1656		return sprintf(buf, "nunchuk\n");
1657	case WIIMOTE_EXT_CLASSIC_CONTROLLER:
1658		return sprintf(buf, "classic\n");
1659	case WIIMOTE_EXT_BALANCE_BOARD:
1660		return sprintf(buf, "balanceboard\n");
1661	case WIIMOTE_EXT_PRO_CONTROLLER:
1662		return sprintf(buf, "procontroller\n");
1663	case WIIMOTE_EXT_UNKNOWN:
1664		/* fallthrough */
1665	default:
1666		return sprintf(buf, "unknown\n");
1667	}
1668}
1669
1670static ssize_t wiimote_ext_store(struct device *dev,
1671				 struct device_attribute *attr,
1672				 const char *buf, size_t count)
1673{
1674	struct wiimote_data *wdata = dev_to_wii(dev);
1675
1676	if (!strcmp(buf, "scan")) {
1677		wiimote_schedule(wdata);
1678	} else {
1679		return -EINVAL;
1680	}
1681
1682	return strnlen(buf, PAGE_SIZE);
1683}
1684
1685static DEVICE_ATTR(extension, S_IRUGO | S_IWUSR | S_IWGRP, wiimote_ext_show,
1686		   wiimote_ext_store);
1687
1688static ssize_t wiimote_dev_show(struct device *dev,
1689				struct device_attribute *attr,
1690				char *buf)
1691{
1692	struct wiimote_data *wdata = dev_to_wii(dev);
1693	__u8 type;
1694	unsigned long flags;
1695
1696	spin_lock_irqsave(&wdata->state.lock, flags);
1697	type = wdata->state.devtype;
1698	spin_unlock_irqrestore(&wdata->state.lock, flags);
1699
1700	switch (type) {
1701	case WIIMOTE_DEV_GENERIC:
1702		return sprintf(buf, "generic\n");
1703	case WIIMOTE_DEV_GEN10:
1704		return sprintf(buf, "gen10\n");
1705	case WIIMOTE_DEV_GEN20:
1706		return sprintf(buf, "gen20\n");
1707	case WIIMOTE_DEV_BALANCE_BOARD:
1708		return sprintf(buf, "balanceboard\n");
1709	case WIIMOTE_DEV_PRO_CONTROLLER:
1710		return sprintf(buf, "procontroller\n");
1711	case WIIMOTE_DEV_PENDING:
1712		return sprintf(buf, "pending\n");
1713	case WIIMOTE_DEV_UNKNOWN:
1714		/* fallthrough */
1715	default:
1716		return sprintf(buf, "unknown\n");
1717	}
1718}
1719
1720static DEVICE_ATTR(devtype, S_IRUGO, wiimote_dev_show, NULL);
1721
1722static struct wiimote_data *wiimote_create(struct hid_device *hdev)
1723{
1724	struct wiimote_data *wdata;
1725
1726	wdata = kzalloc(sizeof(*wdata), GFP_KERNEL);
1727	if (!wdata)
1728		return NULL;
1729
1730	wdata->hdev = hdev;
1731	hid_set_drvdata(hdev, wdata);
1732
1733	spin_lock_init(&wdata->queue.lock);
1734	INIT_WORK(&wdata->queue.worker, wiimote_queue_worker);
1735
1736	spin_lock_init(&wdata->state.lock);
1737	init_completion(&wdata->state.ready);
1738	mutex_init(&wdata->state.sync);
1739	wdata->state.drm = WIIPROTO_REQ_DRM_K;
1740	wdata->state.cmd_battery = 0xff;
1741
1742	INIT_WORK(&wdata->init_worker, wiimote_init_worker);
1743	setup_timer(&wdata->timer, wiimote_init_timeout, (long)wdata);
1744
1745	return wdata;
1746}
1747
1748static void wiimote_destroy(struct wiimote_data *wdata)
1749{
1750	unsigned long flags;
1751
1752	wiidebug_deinit(wdata);
1753
1754	/* prevent init_worker from being scheduled again */
1755	spin_lock_irqsave(&wdata->state.lock, flags);
1756	wdata->state.flags |= WIIPROTO_FLAG_EXITING;
1757	spin_unlock_irqrestore(&wdata->state.lock, flags);
1758
1759	cancel_work_sync(&wdata->init_worker);
1760	del_timer_sync(&wdata->timer);
1761
1762	device_remove_file(&wdata->hdev->dev, &dev_attr_devtype);
1763	device_remove_file(&wdata->hdev->dev, &dev_attr_extension);
1764
1765	wiimote_mp_unload(wdata);
1766	wiimote_ext_unload(wdata);
1767	wiimote_modules_unload(wdata);
1768	cancel_work_sync(&wdata->queue.worker);
1769	hid_hw_close(wdata->hdev);
1770	hid_hw_stop(wdata->hdev);
1771
1772	kfree(wdata);
1773}
1774
1775static int wiimote_hid_probe(struct hid_device *hdev,
1776				const struct hid_device_id *id)
1777{
1778	struct wiimote_data *wdata;
1779	int ret;
1780
1781	hdev->quirks |= HID_QUIRK_NO_INIT_REPORTS;
1782
1783	wdata = wiimote_create(hdev);
1784	if (!wdata) {
1785		hid_err(hdev, "Can't alloc device\n");
1786		return -ENOMEM;
1787	}
1788
1789	ret = hid_parse(hdev);
1790	if (ret) {
1791		hid_err(hdev, "HID parse failed\n");
1792		goto err;
1793	}
1794
1795	ret = hid_hw_start(hdev, HID_CONNECT_HIDRAW);
1796	if (ret) {
1797		hid_err(hdev, "HW start failed\n");
1798		goto err;
1799	}
1800
1801	ret = hid_hw_open(hdev);
1802	if (ret) {
1803		hid_err(hdev, "cannot start hardware I/O\n");
1804		goto err_stop;
1805	}
1806
1807	ret = device_create_file(&hdev->dev, &dev_attr_extension);
1808	if (ret) {
1809		hid_err(hdev, "cannot create sysfs attribute\n");
1810		goto err_close;
1811	}
1812
1813	ret = device_create_file(&hdev->dev, &dev_attr_devtype);
1814	if (ret) {
1815		hid_err(hdev, "cannot create sysfs attribute\n");
1816		goto err_ext;
1817	}
1818
1819	ret = wiidebug_init(wdata);
1820	if (ret)
1821		goto err_free;
1822
1823	hid_info(hdev, "New device registered\n");
1824
1825	/* schedule device detection */
1826	wiimote_schedule(wdata);
1827
1828	return 0;
1829
1830err_free:
1831	wiimote_destroy(wdata);
1832	return ret;
1833
1834err_ext:
1835	device_remove_file(&wdata->hdev->dev, &dev_attr_extension);
1836err_close:
1837	hid_hw_close(hdev);
1838err_stop:
1839	hid_hw_stop(hdev);
1840err:
1841	input_free_device(wdata->ir);
1842	input_free_device(wdata->accel);
1843	kfree(wdata);
1844	return ret;
1845}
1846
1847static void wiimote_hid_remove(struct hid_device *hdev)
1848{
1849	struct wiimote_data *wdata = hid_get_drvdata(hdev);
1850
1851	hid_info(hdev, "Device removed\n");
1852	wiimote_destroy(wdata);
1853}
1854
1855static const struct hid_device_id wiimote_hid_devices[] = {
1856	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
1857				USB_DEVICE_ID_NINTENDO_WIIMOTE) },
1858	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
1859				USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
1860	{ }
1861};
1862MODULE_DEVICE_TABLE(hid, wiimote_hid_devices);
1863
1864static struct hid_driver wiimote_hid_driver = {
1865	.name = "wiimote",
1866	.id_table = wiimote_hid_devices,
1867	.probe = wiimote_hid_probe,
1868	.remove = wiimote_hid_remove,
1869	.raw_event = wiimote_hid_event,
1870};
1871module_hid_driver(wiimote_hid_driver);
1872
1873MODULE_LICENSE("GPL");
1874MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
1875MODULE_DESCRIPTION("Driver for Nintendo Wii / Wii U peripherals");
1876