1/*
2 *  Copyright (c) 2013 Andrew Duggan <aduggan@synaptics.com>
3 *  Copyright (c) 2013 Synaptics Incorporated
4 *  Copyright (c) 2014 Benjamin Tissoires <benjamin.tissoires@gmail.com>
5 *  Copyright (c) 2014 Red Hat, Inc
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the Free
9 * Software Foundation; either version 2 of the License, or (at your option)
10 * any later version.
11 */
12
13#include <linux/kernel.h>
14#include <linux/hid.h>
15#include <linux/input.h>
16#include <linux/input/mt.h>
17#include <linux/module.h>
18#include <linux/pm.h>
19#include <linux/slab.h>
20#include <linux/wait.h>
21#include <linux/sched.h>
22#include "hid-ids.h"
23
24#define RMI_MOUSE_REPORT_ID		0x01 /* Mouse emulation Report */
25#define RMI_WRITE_REPORT_ID		0x09 /* Output Report */
26#define RMI_READ_ADDR_REPORT_ID		0x0a /* Output Report */
27#define RMI_READ_DATA_REPORT_ID		0x0b /* Input Report */
28#define RMI_ATTN_REPORT_ID		0x0c /* Input Report */
29#define RMI_SET_RMI_MODE_REPORT_ID	0x0f /* Feature Report */
30
31/* flags */
32#define RMI_READ_REQUEST_PENDING	0
33#define RMI_READ_DATA_PENDING		1
34#define RMI_STARTED			2
35
36#define RMI_SLEEP_NORMAL		0x0
37#define RMI_SLEEP_DEEP_SLEEP		0x1
38
39/* device flags */
40#define RMI_DEVICE			BIT(0)
41#define RMI_DEVICE_HAS_PHYS_BUTTONS	BIT(1)
42
43/*
44 * retrieve the ctrl registers
45 * the ctrl register has a size of 20 but a fw bug split it into 16 + 4,
46 * and there is no way to know if the first 20 bytes are here or not.
47 * We use only the first 12 bytes, so get only them.
48 */
49#define RMI_F11_CTRL_REG_COUNT		12
50
51enum rmi_mode_type {
52	RMI_MODE_OFF			= 0,
53	RMI_MODE_ATTN_REPORTS		= 1,
54	RMI_MODE_NO_PACKED_ATTN_REPORTS	= 2,
55};
56
57struct rmi_function {
58	unsigned page;			/* page of the function */
59	u16 query_base_addr;		/* base address for queries */
60	u16 command_base_addr;		/* base address for commands */
61	u16 control_base_addr;		/* base address for controls */
62	u16 data_base_addr;		/* base address for datas */
63	unsigned int interrupt_base;	/* cross-function interrupt number
64					 * (uniq in the device)*/
65	unsigned int interrupt_count;	/* number of interrupts */
66	unsigned int report_size;	/* size of a report */
67	unsigned long irq_mask;		/* mask of the interrupts
68					 * (to be applied against ATTN IRQ) */
69};
70
71/**
72 * struct rmi_data - stores information for hid communication
73 *
74 * @page_mutex: Locks current page to avoid changing pages in unexpected ways.
75 * @page: Keeps track of the current virtual page
76 *
77 * @wait: Used for waiting for read data
78 *
79 * @writeReport: output buffer when writing RMI registers
80 * @readReport: input buffer when reading RMI registers
81 *
82 * @input_report_size: size of an input report (advertised by HID)
83 * @output_report_size: size of an output report (advertised by HID)
84 *
85 * @flags: flags for the current device (started, reading, etc...)
86 *
87 * @f11: placeholder of internal RMI function F11 description
88 * @f30: placeholder of internal RMI function F30 description
89 *
90 * @max_fingers: maximum finger count reported by the device
91 * @max_x: maximum x value reported by the device
92 * @max_y: maximum y value reported by the device
93 *
94 * @gpio_led_count: count of GPIOs + LEDs reported by F30
95 * @button_count: actual physical buttons count
96 * @button_mask: button mask used to decode GPIO ATTN reports
97 * @button_state_mask: pull state of the buttons
98 *
99 * @input: pointer to the kernel input device
100 *
101 * @reset_work: worker which will be called in case of a mouse report
102 * @hdev: pointer to the struct hid_device
103 */
104struct rmi_data {
105	struct mutex page_mutex;
106	int page;
107
108	wait_queue_head_t wait;
109
110	u8 *writeReport;
111	u8 *readReport;
112
113	int input_report_size;
114	int output_report_size;
115
116	unsigned long flags;
117
118	struct rmi_function f01;
119	struct rmi_function f11;
120	struct rmi_function f30;
121
122	unsigned int max_fingers;
123	unsigned int max_x;
124	unsigned int max_y;
125	unsigned int x_size_mm;
126	unsigned int y_size_mm;
127	bool read_f11_ctrl_regs;
128	u8 f11_ctrl_regs[RMI_F11_CTRL_REG_COUNT];
129
130	unsigned int gpio_led_count;
131	unsigned int button_count;
132	unsigned long button_mask;
133	unsigned long button_state_mask;
134
135	struct input_dev *input;
136
137	struct work_struct reset_work;
138	struct hid_device *hdev;
139
140	unsigned long device_flags;
141	unsigned long firmware_id;
142
143	u8 f01_ctrl0;
144	u8 interrupt_enable_mask;
145	bool restore_interrupt_mask;
146};
147
148#define RMI_PAGE(addr) (((addr) >> 8) & 0xff)
149
150static int rmi_write_report(struct hid_device *hdev, u8 *report, int len);
151
152/**
153 * rmi_set_page - Set RMI page
154 * @hdev: The pointer to the hid_device struct
155 * @page: The new page address.
156 *
157 * RMI devices have 16-bit addressing, but some of the physical
158 * implementations (like SMBus) only have 8-bit addressing. So RMI implements
159 * a page address at 0xff of every page so we can reliable page addresses
160 * every 256 registers.
161 *
162 * The page_mutex lock must be held when this function is entered.
163 *
164 * Returns zero on success, non-zero on failure.
165 */
166static int rmi_set_page(struct hid_device *hdev, u8 page)
167{
168	struct rmi_data *data = hid_get_drvdata(hdev);
169	int retval;
170
171	data->writeReport[0] = RMI_WRITE_REPORT_ID;
172	data->writeReport[1] = 1;
173	data->writeReport[2] = 0xFF;
174	data->writeReport[4] = page;
175
176	retval = rmi_write_report(hdev, data->writeReport,
177			data->output_report_size);
178	if (retval != data->output_report_size) {
179		dev_err(&hdev->dev,
180			"%s: set page failed: %d.", __func__, retval);
181		return retval;
182	}
183
184	data->page = page;
185	return 0;
186}
187
188static int rmi_set_mode(struct hid_device *hdev, u8 mode)
189{
190	int ret;
191	u8 txbuf[2] = {RMI_SET_RMI_MODE_REPORT_ID, mode};
192
193	ret = hid_hw_raw_request(hdev, RMI_SET_RMI_MODE_REPORT_ID, txbuf,
194			sizeof(txbuf), HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
195	if (ret < 0) {
196		dev_err(&hdev->dev, "unable to set rmi mode to %d (%d)\n", mode,
197			ret);
198		return ret;
199	}
200
201	return 0;
202}
203
204static int rmi_write_report(struct hid_device *hdev, u8 *report, int len)
205{
206	int ret;
207
208	ret = hid_hw_output_report(hdev, (void *)report, len);
209	if (ret < 0) {
210		dev_err(&hdev->dev, "failed to write hid report (%d)\n", ret);
211		return ret;
212	}
213
214	return ret;
215}
216
217static int rmi_read_block(struct hid_device *hdev, u16 addr, void *buf,
218		const int len)
219{
220	struct rmi_data *data = hid_get_drvdata(hdev);
221	int ret;
222	int bytes_read;
223	int bytes_needed;
224	int retries;
225	int read_input_count;
226
227	mutex_lock(&data->page_mutex);
228
229	if (RMI_PAGE(addr) != data->page) {
230		ret = rmi_set_page(hdev, RMI_PAGE(addr));
231		if (ret < 0)
232			goto exit;
233	}
234
235	for (retries = 5; retries > 0; retries--) {
236		data->writeReport[0] = RMI_READ_ADDR_REPORT_ID;
237		data->writeReport[1] = 0; /* old 1 byte read count */
238		data->writeReport[2] = addr & 0xFF;
239		data->writeReport[3] = (addr >> 8) & 0xFF;
240		data->writeReport[4] = len  & 0xFF;
241		data->writeReport[5] = (len >> 8) & 0xFF;
242
243		set_bit(RMI_READ_REQUEST_PENDING, &data->flags);
244
245		ret = rmi_write_report(hdev, data->writeReport,
246						data->output_report_size);
247		if (ret != data->output_report_size) {
248			clear_bit(RMI_READ_REQUEST_PENDING, &data->flags);
249			dev_err(&hdev->dev,
250				"failed to write request output report (%d)\n",
251				ret);
252			goto exit;
253		}
254
255		bytes_read = 0;
256		bytes_needed = len;
257		while (bytes_read < len) {
258			if (!wait_event_timeout(data->wait,
259				test_bit(RMI_READ_DATA_PENDING, &data->flags),
260					msecs_to_jiffies(1000))) {
261				hid_warn(hdev, "%s: timeout elapsed\n",
262					 __func__);
263				ret = -EAGAIN;
264				break;
265			}
266
267			read_input_count = data->readReport[1];
268			memcpy(buf + bytes_read, &data->readReport[2],
269				read_input_count < bytes_needed ?
270					read_input_count : bytes_needed);
271
272			bytes_read += read_input_count;
273			bytes_needed -= read_input_count;
274			clear_bit(RMI_READ_DATA_PENDING, &data->flags);
275		}
276
277		if (ret >= 0) {
278			ret = 0;
279			break;
280		}
281	}
282
283exit:
284	clear_bit(RMI_READ_REQUEST_PENDING, &data->flags);
285	mutex_unlock(&data->page_mutex);
286	return ret;
287}
288
289static inline int rmi_read(struct hid_device *hdev, u16 addr, void *buf)
290{
291	return rmi_read_block(hdev, addr, buf, 1);
292}
293
294static int rmi_write_block(struct hid_device *hdev, u16 addr, void *buf,
295		const int len)
296{
297	struct rmi_data *data = hid_get_drvdata(hdev);
298	int ret;
299
300	mutex_lock(&data->page_mutex);
301
302	if (RMI_PAGE(addr) != data->page) {
303		ret = rmi_set_page(hdev, RMI_PAGE(addr));
304		if (ret < 0)
305			goto exit;
306	}
307
308	data->writeReport[0] = RMI_WRITE_REPORT_ID;
309	data->writeReport[1] = len;
310	data->writeReport[2] = addr & 0xFF;
311	data->writeReport[3] = (addr >> 8) & 0xFF;
312	memcpy(&data->writeReport[4], buf, len);
313
314	ret = rmi_write_report(hdev, data->writeReport,
315					data->output_report_size);
316	if (ret < 0) {
317		dev_err(&hdev->dev,
318			"failed to write request output report (%d)\n",
319			ret);
320		goto exit;
321	}
322	ret = 0;
323
324exit:
325	mutex_unlock(&data->page_mutex);
326	return ret;
327}
328
329static inline int rmi_write(struct hid_device *hdev, u16 addr, void *buf)
330{
331	return rmi_write_block(hdev, addr, buf, 1);
332}
333
334static void rmi_f11_process_touch(struct rmi_data *hdata, int slot,
335		u8 finger_state, u8 *touch_data)
336{
337	int x, y, wx, wy;
338	int wide, major, minor;
339	int z;
340
341	input_mt_slot(hdata->input, slot);
342	input_mt_report_slot_state(hdata->input, MT_TOOL_FINGER,
343			finger_state == 0x01);
344	if (finger_state == 0x01) {
345		x = (touch_data[0] << 4) | (touch_data[2] & 0x0F);
346		y = (touch_data[1] << 4) | (touch_data[2] >> 4);
347		wx = touch_data[3] & 0x0F;
348		wy = touch_data[3] >> 4;
349		wide = (wx > wy);
350		major = max(wx, wy);
351		minor = min(wx, wy);
352		z = touch_data[4];
353
354		/* y is inverted */
355		y = hdata->max_y - y;
356
357		input_event(hdata->input, EV_ABS, ABS_MT_POSITION_X, x);
358		input_event(hdata->input, EV_ABS, ABS_MT_POSITION_Y, y);
359		input_event(hdata->input, EV_ABS, ABS_MT_ORIENTATION, wide);
360		input_event(hdata->input, EV_ABS, ABS_MT_PRESSURE, z);
361		input_event(hdata->input, EV_ABS, ABS_MT_TOUCH_MAJOR, major);
362		input_event(hdata->input, EV_ABS, ABS_MT_TOUCH_MINOR, minor);
363	}
364}
365
366static int rmi_reset_attn_mode(struct hid_device *hdev)
367{
368	struct rmi_data *data = hid_get_drvdata(hdev);
369	int ret;
370
371	ret = rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
372	if (ret)
373		return ret;
374
375	if (data->restore_interrupt_mask) {
376		ret = rmi_write(hdev, data->f01.control_base_addr + 1,
377				&data->interrupt_enable_mask);
378		if (ret) {
379			hid_err(hdev, "can not write F01 control register\n");
380			return ret;
381		}
382	}
383
384	return 0;
385}
386
387static void rmi_reset_work(struct work_struct *work)
388{
389	struct rmi_data *hdata = container_of(work, struct rmi_data,
390						reset_work);
391
392	/* switch the device to RMI if we receive a generic mouse report */
393	rmi_reset_attn_mode(hdata->hdev);
394}
395
396static inline int rmi_schedule_reset(struct hid_device *hdev)
397{
398	struct rmi_data *hdata = hid_get_drvdata(hdev);
399	return schedule_work(&hdata->reset_work);
400}
401
402static int rmi_f11_input_event(struct hid_device *hdev, u8 irq, u8 *data,
403		int size)
404{
405	struct rmi_data *hdata = hid_get_drvdata(hdev);
406	int offset;
407	int i;
408
409	if (!(irq & hdata->f11.irq_mask) || size <= 0)
410		return 0;
411
412	offset = (hdata->max_fingers >> 2) + 1;
413	for (i = 0; i < hdata->max_fingers; i++) {
414		int fs_byte_position = i >> 2;
415		int fs_bit_position = (i & 0x3) << 1;
416		int finger_state = (data[fs_byte_position] >> fs_bit_position) &
417					0x03;
418		int position = offset + 5 * i;
419
420		if (position + 5 > size) {
421			/* partial report, go on with what we received */
422			printk_once(KERN_WARNING
423				"%s %s: Detected incomplete finger report. Finger reports may occasionally get dropped on this platform.\n",
424				 dev_driver_string(&hdev->dev),
425				 dev_name(&hdev->dev));
426			hid_dbg(hdev, "Incomplete finger report\n");
427			break;
428		}
429
430		rmi_f11_process_touch(hdata, i, finger_state, &data[position]);
431	}
432	input_mt_sync_frame(hdata->input);
433	input_sync(hdata->input);
434	return hdata->f11.report_size;
435}
436
437static int rmi_f30_input_event(struct hid_device *hdev, u8 irq, u8 *data,
438		int size)
439{
440	struct rmi_data *hdata = hid_get_drvdata(hdev);
441	int i;
442	int button = 0;
443	bool value;
444
445	if (!(irq & hdata->f30.irq_mask))
446		return 0;
447
448	if (size < (int)hdata->f30.report_size) {
449		hid_warn(hdev, "Click Button pressed, but the click data is missing\n");
450		return 0;
451	}
452
453	for (i = 0; i < hdata->gpio_led_count; i++) {
454		if (test_bit(i, &hdata->button_mask)) {
455			value = (data[i / 8] >> (i & 0x07)) & BIT(0);
456			if (test_bit(i, &hdata->button_state_mask))
457				value = !value;
458			input_event(hdata->input, EV_KEY, BTN_LEFT + button++,
459					value);
460		}
461	}
462	return hdata->f30.report_size;
463}
464
465static int rmi_input_event(struct hid_device *hdev, u8 *data, int size)
466{
467	struct rmi_data *hdata = hid_get_drvdata(hdev);
468	unsigned long irq_mask = 0;
469	unsigned index = 2;
470
471	if (!(test_bit(RMI_STARTED, &hdata->flags)))
472		return 0;
473
474	irq_mask |= hdata->f11.irq_mask;
475	irq_mask |= hdata->f30.irq_mask;
476
477	if (data[1] & ~irq_mask)
478		hid_dbg(hdev, "unknown intr source:%02lx %s:%d\n",
479			data[1] & ~irq_mask, __FILE__, __LINE__);
480
481	if (hdata->f11.interrupt_base < hdata->f30.interrupt_base) {
482		index += rmi_f11_input_event(hdev, data[1], &data[index],
483				size - index);
484		index += rmi_f30_input_event(hdev, data[1], &data[index],
485				size - index);
486	} else {
487		index += rmi_f30_input_event(hdev, data[1], &data[index],
488				size - index);
489		index += rmi_f11_input_event(hdev, data[1], &data[index],
490				size - index);
491	}
492
493	return 1;
494}
495
496static int rmi_read_data_event(struct hid_device *hdev, u8 *data, int size)
497{
498	struct rmi_data *hdata = hid_get_drvdata(hdev);
499
500	if (!test_bit(RMI_READ_REQUEST_PENDING, &hdata->flags)) {
501		hid_dbg(hdev, "no read request pending\n");
502		return 0;
503	}
504
505	memcpy(hdata->readReport, data, size < hdata->input_report_size ?
506			size : hdata->input_report_size);
507	set_bit(RMI_READ_DATA_PENDING, &hdata->flags);
508	wake_up(&hdata->wait);
509
510	return 1;
511}
512
513static int rmi_check_sanity(struct hid_device *hdev, u8 *data, int size)
514{
515	int valid_size = size;
516	/*
517	 * On the Dell XPS 13 9333, the bus sometimes get confused and fills
518	 * the report with a sentinel value "ff". Synaptics told us that such
519	 * behavior does not comes from the touchpad itself, so we filter out
520	 * such reports here.
521	 */
522
523	while ((data[valid_size - 1] == 0xff) && valid_size > 0)
524		valid_size--;
525
526	return valid_size;
527}
528
529static int rmi_raw_event(struct hid_device *hdev,
530		struct hid_report *report, u8 *data, int size)
531{
532	size = rmi_check_sanity(hdev, data, size);
533	if (size < 2)
534		return 0;
535
536	switch (data[0]) {
537	case RMI_READ_DATA_REPORT_ID:
538		return rmi_read_data_event(hdev, data, size);
539	case RMI_ATTN_REPORT_ID:
540		return rmi_input_event(hdev, data, size);
541	default:
542		return 1;
543	}
544
545	return 0;
546}
547
548static int rmi_event(struct hid_device *hdev, struct hid_field *field,
549			struct hid_usage *usage, __s32 value)
550{
551	struct rmi_data *data = hid_get_drvdata(hdev);
552
553	if ((data->device_flags & RMI_DEVICE) &&
554	    (field->application == HID_GD_POINTER ||
555	    field->application == HID_GD_MOUSE)) {
556		if (data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS) {
557			if ((usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON)
558				return 0;
559
560			if ((usage->hid == HID_GD_X || usage->hid == HID_GD_Y)
561			    && !value)
562				return 1;
563		}
564
565		rmi_schedule_reset(hdev);
566		return 1;
567	}
568
569	return 0;
570}
571
572#ifdef CONFIG_PM
573static int rmi_set_sleep_mode(struct hid_device *hdev, int sleep_mode)
574{
575	struct rmi_data *data = hid_get_drvdata(hdev);
576	int ret;
577	u8 f01_ctrl0;
578
579	f01_ctrl0 = (data->f01_ctrl0 & ~0x3) | sleep_mode;
580
581	ret = rmi_write(hdev, data->f01.control_base_addr,
582			&f01_ctrl0);
583	if (ret) {
584		hid_err(hdev, "can not write sleep mode\n");
585		return ret;
586	}
587
588	return 0;
589}
590
591static int rmi_suspend(struct hid_device *hdev, pm_message_t message)
592{
593	struct rmi_data *data = hid_get_drvdata(hdev);
594	int ret;
595	u8 buf[RMI_F11_CTRL_REG_COUNT];
596
597	ret = rmi_read_block(hdev, data->f11.control_base_addr, buf,
598				RMI_F11_CTRL_REG_COUNT);
599	if (ret)
600		hid_warn(hdev, "can not read F11 control registers\n");
601	else
602		memcpy(data->f11_ctrl_regs, buf, RMI_F11_CTRL_REG_COUNT);
603
604
605	if (!device_may_wakeup(hdev->dev.parent))
606		return rmi_set_sleep_mode(hdev, RMI_SLEEP_DEEP_SLEEP);
607
608	return 0;
609}
610
611static int rmi_post_reset(struct hid_device *hdev)
612{
613	struct rmi_data *data = hid_get_drvdata(hdev);
614	int ret;
615
616	ret = rmi_reset_attn_mode(hdev);
617	if (ret) {
618		hid_err(hdev, "can not set rmi mode\n");
619		return ret;
620	}
621
622	if (data->read_f11_ctrl_regs) {
623		ret = rmi_write_block(hdev, data->f11.control_base_addr,
624				data->f11_ctrl_regs, RMI_F11_CTRL_REG_COUNT);
625		if (ret)
626			hid_warn(hdev,
627				"can not write F11 control registers after reset\n");
628	}
629
630	if (!device_may_wakeup(hdev->dev.parent)) {
631		ret = rmi_set_sleep_mode(hdev, RMI_SLEEP_NORMAL);
632		if (ret) {
633			hid_err(hdev, "can not write sleep mode\n");
634			return ret;
635		}
636	}
637
638	return ret;
639}
640
641static int rmi_post_resume(struct hid_device *hdev)
642{
643	return rmi_reset_attn_mode(hdev);
644}
645#endif /* CONFIG_PM */
646
647#define RMI4_MAX_PAGE 0xff
648#define RMI4_PAGE_SIZE 0x0100
649
650#define PDT_START_SCAN_LOCATION 0x00e9
651#define PDT_END_SCAN_LOCATION	0x0005
652#define RMI4_END_OF_PDT(id) ((id) == 0x00 || (id) == 0xff)
653
654struct pdt_entry {
655	u8 query_base_addr:8;
656	u8 command_base_addr:8;
657	u8 control_base_addr:8;
658	u8 data_base_addr:8;
659	u8 interrupt_source_count:3;
660	u8 bits3and4:2;
661	u8 function_version:2;
662	u8 bit7:1;
663	u8 function_number:8;
664} __attribute__((__packed__));
665
666static inline unsigned long rmi_gen_mask(unsigned irq_base, unsigned irq_count)
667{
668	return GENMASK(irq_count + irq_base - 1, irq_base);
669}
670
671static void rmi_register_function(struct rmi_data *data,
672	struct pdt_entry *pdt_entry, int page, unsigned interrupt_count)
673{
674	struct rmi_function *f = NULL;
675	u16 page_base = page << 8;
676
677	switch (pdt_entry->function_number) {
678	case 0x01:
679		f = &data->f01;
680		break;
681	case 0x11:
682		f = &data->f11;
683		break;
684	case 0x30:
685		f = &data->f30;
686		break;
687	}
688
689	if (f) {
690		f->page = page;
691		f->query_base_addr = page_base | pdt_entry->query_base_addr;
692		f->command_base_addr = page_base | pdt_entry->command_base_addr;
693		f->control_base_addr = page_base | pdt_entry->control_base_addr;
694		f->data_base_addr = page_base | pdt_entry->data_base_addr;
695		f->interrupt_base = interrupt_count;
696		f->interrupt_count = pdt_entry->interrupt_source_count;
697		f->irq_mask = rmi_gen_mask(f->interrupt_base,
698						f->interrupt_count);
699		data->interrupt_enable_mask |= f->irq_mask;
700	}
701}
702
703static int rmi_scan_pdt(struct hid_device *hdev)
704{
705	struct rmi_data *data = hid_get_drvdata(hdev);
706	struct pdt_entry entry;
707	int page;
708	bool page_has_function;
709	int i;
710	int retval;
711	int interrupt = 0;
712	u16 page_start, pdt_start , pdt_end;
713
714	hid_info(hdev, "Scanning PDT...\n");
715
716	for (page = 0; (page <= RMI4_MAX_PAGE); page++) {
717		page_start = RMI4_PAGE_SIZE * page;
718		pdt_start = page_start + PDT_START_SCAN_LOCATION;
719		pdt_end = page_start + PDT_END_SCAN_LOCATION;
720
721		page_has_function = false;
722		for (i = pdt_start; i >= pdt_end; i -= sizeof(entry)) {
723			retval = rmi_read_block(hdev, i, &entry, sizeof(entry));
724			if (retval) {
725				hid_err(hdev,
726					"Read of PDT entry at %#06x failed.\n",
727					i);
728				goto error_exit;
729			}
730
731			if (RMI4_END_OF_PDT(entry.function_number))
732				break;
733
734			page_has_function = true;
735
736			hid_info(hdev, "Found F%02X on page %#04x\n",
737					entry.function_number, page);
738
739			rmi_register_function(data, &entry, page, interrupt);
740			interrupt += entry.interrupt_source_count;
741		}
742
743		if (!page_has_function)
744			break;
745	}
746
747	hid_info(hdev, "%s: Done with PDT scan.\n", __func__);
748	retval = 0;
749
750error_exit:
751	return retval;
752}
753
754#define RMI_DEVICE_F01_BASIC_QUERY_LEN	11
755
756static int rmi_populate_f01(struct hid_device *hdev)
757{
758	struct rmi_data *data = hid_get_drvdata(hdev);
759	u8 basic_queries[RMI_DEVICE_F01_BASIC_QUERY_LEN];
760	u8 info[3];
761	int ret;
762	bool has_query42;
763	bool has_lts;
764	bool has_sensor_id;
765	bool has_ds4_queries = false;
766	bool has_build_id_query = false;
767	bool has_package_id_query = false;
768	u16 query_offset = data->f01.query_base_addr;
769	u16 prod_info_addr;
770	u8 ds4_query_len;
771
772	ret = rmi_read_block(hdev, query_offset, basic_queries,
773				RMI_DEVICE_F01_BASIC_QUERY_LEN);
774	if (ret) {
775		hid_err(hdev, "Can not read basic queries from Function 0x1.\n");
776		return ret;
777	}
778
779	has_lts = !!(basic_queries[0] & BIT(2));
780	has_sensor_id = !!(basic_queries[1] & BIT(3));
781	has_query42 = !!(basic_queries[1] & BIT(7));
782
783	query_offset += 11;
784	prod_info_addr = query_offset + 6;
785	query_offset += 10;
786
787	if (has_lts)
788		query_offset += 20;
789
790	if (has_sensor_id)
791		query_offset++;
792
793	if (has_query42) {
794		ret = rmi_read(hdev, query_offset, info);
795		if (ret) {
796			hid_err(hdev, "Can not read query42.\n");
797			return ret;
798		}
799		has_ds4_queries = !!(info[0] & BIT(0));
800		query_offset++;
801	}
802
803	if (has_ds4_queries) {
804		ret = rmi_read(hdev, query_offset, &ds4_query_len);
805		if (ret) {
806			hid_err(hdev, "Can not read DS4 Query length.\n");
807			return ret;
808		}
809		query_offset++;
810
811		if (ds4_query_len > 0) {
812			ret = rmi_read(hdev, query_offset, info);
813			if (ret) {
814				hid_err(hdev, "Can not read DS4 query.\n");
815				return ret;
816			}
817
818			has_package_id_query = !!(info[0] & BIT(0));
819			has_build_id_query = !!(info[0] & BIT(1));
820		}
821	}
822
823	if (has_package_id_query)
824		prod_info_addr++;
825
826	if (has_build_id_query) {
827		ret = rmi_read_block(hdev, prod_info_addr, info, 3);
828		if (ret) {
829			hid_err(hdev, "Can not read product info.\n");
830			return ret;
831		}
832
833		data->firmware_id = info[1] << 8 | info[0];
834		data->firmware_id += info[2] * 65536;
835	}
836
837	ret = rmi_read_block(hdev, data->f01.control_base_addr, info,
838				2);
839
840	if (ret) {
841		hid_err(hdev, "can not read f01 ctrl registers\n");
842		return ret;
843	}
844
845	data->f01_ctrl0 = info[0];
846
847	if (!info[1]) {
848		/*
849		 * Do to a firmware bug in some touchpads the F01 interrupt
850		 * enable control register will be cleared on reset.
851		 * This will stop the touchpad from reporting data, so
852		 * if F01 CTRL1 is 0 then we need to explicitly enable
853		 * interrupts for the functions we want data for.
854		 */
855		data->restore_interrupt_mask = true;
856
857		ret = rmi_write(hdev, data->f01.control_base_addr + 1,
858				&data->interrupt_enable_mask);
859		if (ret) {
860			hid_err(hdev, "can not write to control reg 1: %d.\n",
861				ret);
862			return ret;
863		}
864	}
865
866	return 0;
867}
868
869static int rmi_populate_f11(struct hid_device *hdev)
870{
871	struct rmi_data *data = hid_get_drvdata(hdev);
872	u8 buf[20];
873	int ret;
874	bool has_query9;
875	bool has_query10 = false;
876	bool has_query11;
877	bool has_query12;
878	bool has_query27;
879	bool has_query28;
880	bool has_query36 = false;
881	bool has_physical_props;
882	bool has_gestures;
883	bool has_rel;
884	bool has_data40 = false;
885	bool has_dribble = false;
886	bool has_palm_detect = false;
887	unsigned x_size, y_size;
888	u16 query_offset;
889
890	if (!data->f11.query_base_addr) {
891		hid_err(hdev, "No 2D sensor found, giving up.\n");
892		return -ENODEV;
893	}
894
895	/* query 0 contains some useful information */
896	ret = rmi_read(hdev, data->f11.query_base_addr, buf);
897	if (ret) {
898		hid_err(hdev, "can not get query 0: %d.\n", ret);
899		return ret;
900	}
901	has_query9 = !!(buf[0] & BIT(3));
902	has_query11 = !!(buf[0] & BIT(4));
903	has_query12 = !!(buf[0] & BIT(5));
904	has_query27 = !!(buf[0] & BIT(6));
905	has_query28 = !!(buf[0] & BIT(7));
906
907	/* query 1 to get the max number of fingers */
908	ret = rmi_read(hdev, data->f11.query_base_addr + 1, buf);
909	if (ret) {
910		hid_err(hdev, "can not get NumberOfFingers: %d.\n", ret);
911		return ret;
912	}
913	data->max_fingers = (buf[0] & 0x07) + 1;
914	if (data->max_fingers > 5)
915		data->max_fingers = 10;
916
917	data->f11.report_size = data->max_fingers * 5 +
918				DIV_ROUND_UP(data->max_fingers, 4);
919
920	if (!(buf[0] & BIT(4))) {
921		hid_err(hdev, "No absolute events, giving up.\n");
922		return -ENODEV;
923	}
924
925	has_rel = !!(buf[0] & BIT(3));
926	has_gestures = !!(buf[0] & BIT(5));
927
928	ret = rmi_read(hdev, data->f11.query_base_addr + 5, buf);
929	if (ret) {
930		hid_err(hdev, "can not get absolute data sources: %d.\n", ret);
931		return ret;
932	}
933
934	has_dribble = !!(buf[0] & BIT(4));
935
936	/*
937	 * At least 4 queries are guaranteed to be present in F11
938	 * +1 for query 5 which is present since absolute events are
939	 * reported and +1 for query 12.
940	 */
941	query_offset = 6;
942
943	if (has_rel)
944		++query_offset; /* query 6 is present */
945
946	if (has_gestures) {
947		/* query 8 to find out if query 10 exists */
948		ret = rmi_read(hdev,
949			data->f11.query_base_addr + query_offset + 1, buf);
950		if (ret) {
951			hid_err(hdev, "can not read gesture information: %d.\n",
952				ret);
953			return ret;
954		}
955		has_palm_detect = !!(buf[0] & BIT(0));
956		has_query10 = !!(buf[0] & BIT(2));
957
958		query_offset += 2; /* query 7 and 8 are present */
959	}
960
961	if (has_query9)
962		++query_offset;
963
964	if (has_query10)
965		++query_offset;
966
967	if (has_query11)
968		++query_offset;
969
970	/* query 12 to know if the physical properties are reported */
971	if (has_query12) {
972		ret = rmi_read(hdev, data->f11.query_base_addr
973				+ query_offset, buf);
974		if (ret) {
975			hid_err(hdev, "can not get query 12: %d.\n", ret);
976			return ret;
977		}
978		has_physical_props = !!(buf[0] & BIT(5));
979
980		if (has_physical_props) {
981			query_offset += 1;
982			ret = rmi_read_block(hdev,
983					data->f11.query_base_addr
984						+ query_offset, buf, 4);
985			if (ret) {
986				hid_err(hdev, "can not read query 15-18: %d.\n",
987					ret);
988				return ret;
989			}
990
991			x_size = buf[0] | (buf[1] << 8);
992			y_size = buf[2] | (buf[3] << 8);
993
994			data->x_size_mm = DIV_ROUND_CLOSEST(x_size, 10);
995			data->y_size_mm = DIV_ROUND_CLOSEST(y_size, 10);
996
997			hid_info(hdev, "%s: size in mm: %d x %d\n",
998				 __func__, data->x_size_mm, data->y_size_mm);
999
1000			/*
1001			 * query 15 - 18 contain the size of the sensor
1002			 * and query 19 - 26 contain bezel dimensions
1003			 */
1004			query_offset += 12;
1005		}
1006	}
1007
1008	if (has_query27)
1009		++query_offset;
1010
1011	if (has_query28) {
1012		ret = rmi_read(hdev, data->f11.query_base_addr
1013				+ query_offset, buf);
1014		if (ret) {
1015			hid_err(hdev, "can not get query 28: %d.\n", ret);
1016			return ret;
1017		}
1018
1019		has_query36 = !!(buf[0] & BIT(6));
1020	}
1021
1022	if (has_query36) {
1023		query_offset += 2;
1024		ret = rmi_read(hdev, data->f11.query_base_addr
1025				+ query_offset, buf);
1026		if (ret) {
1027			hid_err(hdev, "can not get query 36: %d.\n", ret);
1028			return ret;
1029		}
1030
1031		has_data40 = !!(buf[0] & BIT(5));
1032	}
1033
1034
1035	if (has_data40)
1036		data->f11.report_size += data->max_fingers * 2;
1037
1038	ret = rmi_read_block(hdev, data->f11.control_base_addr,
1039			data->f11_ctrl_regs, RMI_F11_CTRL_REG_COUNT);
1040	if (ret) {
1041		hid_err(hdev, "can not read ctrl block of size 11: %d.\n", ret);
1042		return ret;
1043	}
1044
1045	/* data->f11_ctrl_regs now contains valid register data */
1046	data->read_f11_ctrl_regs = true;
1047
1048	data->max_x = data->f11_ctrl_regs[6] | (data->f11_ctrl_regs[7] << 8);
1049	data->max_y = data->f11_ctrl_regs[8] | (data->f11_ctrl_regs[9] << 8);
1050
1051	if (has_dribble) {
1052		data->f11_ctrl_regs[0] = data->f11_ctrl_regs[0] & ~BIT(6);
1053		ret = rmi_write(hdev, data->f11.control_base_addr,
1054				data->f11_ctrl_regs);
1055		if (ret) {
1056			hid_err(hdev, "can not write to control reg 0: %d.\n",
1057				ret);
1058			return ret;
1059		}
1060	}
1061
1062	if (has_palm_detect) {
1063		data->f11_ctrl_regs[11] = data->f11_ctrl_regs[11] & ~BIT(0);
1064		ret = rmi_write(hdev, data->f11.control_base_addr + 11,
1065				&data->f11_ctrl_regs[11]);
1066		if (ret) {
1067			hid_err(hdev, "can not write to control reg 11: %d.\n",
1068				ret);
1069			return ret;
1070		}
1071	}
1072
1073	return 0;
1074}
1075
1076static int rmi_populate_f30(struct hid_device *hdev)
1077{
1078	struct rmi_data *data = hid_get_drvdata(hdev);
1079	u8 buf[20];
1080	int ret;
1081	bool has_gpio, has_led;
1082	unsigned bytes_per_ctrl;
1083	u8 ctrl2_addr;
1084	int ctrl2_3_length;
1085	int i;
1086
1087	/* function F30 is for physical buttons */
1088	if (!data->f30.query_base_addr) {
1089		hid_err(hdev, "No GPIO/LEDs found, giving up.\n");
1090		return -ENODEV;
1091	}
1092
1093	ret = rmi_read_block(hdev, data->f30.query_base_addr, buf, 2);
1094	if (ret) {
1095		hid_err(hdev, "can not get F30 query registers: %d.\n", ret);
1096		return ret;
1097	}
1098
1099	has_gpio = !!(buf[0] & BIT(3));
1100	has_led = !!(buf[0] & BIT(2));
1101	data->gpio_led_count = buf[1] & 0x1f;
1102
1103	/* retrieve ctrl 2 & 3 registers */
1104	bytes_per_ctrl = (data->gpio_led_count + 7) / 8;
1105	/* Ctrl0 is present only if both has_gpio and has_led are set*/
1106	ctrl2_addr = (has_gpio && has_led) ? bytes_per_ctrl : 0;
1107	/* Ctrl1 is always be present */
1108	ctrl2_addr += bytes_per_ctrl;
1109	ctrl2_3_length = 2 * bytes_per_ctrl;
1110
1111	data->f30.report_size = bytes_per_ctrl;
1112
1113	ret = rmi_read_block(hdev, data->f30.control_base_addr + ctrl2_addr,
1114				buf, ctrl2_3_length);
1115	if (ret) {
1116		hid_err(hdev, "can not read ctrl 2&3 block of size %d: %d.\n",
1117			ctrl2_3_length, ret);
1118		return ret;
1119	}
1120
1121	for (i = 0; i < data->gpio_led_count; i++) {
1122		int byte_position = i >> 3;
1123		int bit_position = i & 0x07;
1124		u8 dir_byte = buf[byte_position];
1125		u8 data_byte = buf[byte_position + bytes_per_ctrl];
1126		bool dir = (dir_byte >> bit_position) & BIT(0);
1127		bool dat = (data_byte >> bit_position) & BIT(0);
1128
1129		if (dir == 0) {
1130			/* input mode */
1131			if (dat) {
1132				/* actual buttons have pull up resistor */
1133				data->button_count++;
1134				set_bit(i, &data->button_mask);
1135				set_bit(i, &data->button_state_mask);
1136			}
1137		}
1138
1139	}
1140
1141	return 0;
1142}
1143
1144static int rmi_populate(struct hid_device *hdev)
1145{
1146	struct rmi_data *data = hid_get_drvdata(hdev);
1147	int ret;
1148
1149	ret = rmi_scan_pdt(hdev);
1150	if (ret) {
1151		hid_err(hdev, "PDT scan failed with code %d.\n", ret);
1152		return ret;
1153	}
1154
1155	ret = rmi_populate_f01(hdev);
1156	if (ret) {
1157		hid_err(hdev, "Error while initializing F01 (%d).\n", ret);
1158		return ret;
1159	}
1160
1161	ret = rmi_populate_f11(hdev);
1162	if (ret) {
1163		hid_err(hdev, "Error while initializing F11 (%d).\n", ret);
1164		return ret;
1165	}
1166
1167	if (!(data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS)) {
1168		ret = rmi_populate_f30(hdev);
1169		if (ret)
1170			hid_warn(hdev, "Error while initializing F30 (%d).\n", ret);
1171	}
1172
1173	return 0;
1174}
1175
1176static int rmi_input_configured(struct hid_device *hdev, struct hid_input *hi)
1177{
1178	struct rmi_data *data = hid_get_drvdata(hdev);
1179	struct input_dev *input = hi->input;
1180	int ret;
1181	int res_x, res_y, i;
1182
1183	data->input = input;
1184
1185	hid_dbg(hdev, "Opening low level driver\n");
1186	ret = hid_hw_open(hdev);
1187	if (ret)
1188		return ret;
1189
1190	if (!(data->device_flags & RMI_DEVICE))
1191		return 0;
1192
1193	/* Allow incoming hid reports */
1194	hid_device_io_start(hdev);
1195
1196	ret = rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
1197	if (ret < 0) {
1198		dev_err(&hdev->dev, "failed to set rmi mode\n");
1199		goto exit;
1200	}
1201
1202	ret = rmi_set_page(hdev, 0);
1203	if (ret < 0) {
1204		dev_err(&hdev->dev, "failed to set page select to 0.\n");
1205		goto exit;
1206	}
1207
1208	ret = rmi_populate(hdev);
1209	if (ret)
1210		goto exit;
1211
1212	hid_info(hdev, "firmware id: %ld\n", data->firmware_id);
1213
1214	__set_bit(EV_ABS, input->evbit);
1215	input_set_abs_params(input, ABS_MT_POSITION_X, 1, data->max_x, 0, 0);
1216	input_set_abs_params(input, ABS_MT_POSITION_Y, 1, data->max_y, 0, 0);
1217
1218	if (data->x_size_mm && data->y_size_mm) {
1219		res_x = (data->max_x - 1) / data->x_size_mm;
1220		res_y = (data->max_y - 1) / data->y_size_mm;
1221
1222		input_abs_set_res(input, ABS_MT_POSITION_X, res_x);
1223		input_abs_set_res(input, ABS_MT_POSITION_Y, res_y);
1224	}
1225
1226	input_set_abs_params(input, ABS_MT_ORIENTATION, 0, 1, 0, 0);
1227	input_set_abs_params(input, ABS_MT_PRESSURE, 0, 0xff, 0, 0);
1228	input_set_abs_params(input, ABS_MT_TOUCH_MAJOR, 0, 0x0f, 0, 0);
1229	input_set_abs_params(input, ABS_MT_TOUCH_MINOR, 0, 0x0f, 0, 0);
1230
1231	ret = input_mt_init_slots(input, data->max_fingers, INPUT_MT_POINTER);
1232	if (ret < 0)
1233		goto exit;
1234
1235	if (data->button_count) {
1236		__set_bit(EV_KEY, input->evbit);
1237		for (i = 0; i < data->button_count; i++)
1238			__set_bit(BTN_LEFT + i, input->keybit);
1239
1240		if (data->button_count == 1)
1241			__set_bit(INPUT_PROP_BUTTONPAD, input->propbit);
1242	}
1243
1244	set_bit(RMI_STARTED, &data->flags);
1245
1246exit:
1247	hid_device_io_stop(hdev);
1248	hid_hw_close(hdev);
1249	return ret;
1250}
1251
1252static int rmi_input_mapping(struct hid_device *hdev,
1253		struct hid_input *hi, struct hid_field *field,
1254		struct hid_usage *usage, unsigned long **bit, int *max)
1255{
1256	struct rmi_data *data = hid_get_drvdata(hdev);
1257
1258	/*
1259	 * we want to make HID ignore the advertised HID collection
1260	 * for RMI deivces
1261	 */
1262	if (data->device_flags & RMI_DEVICE) {
1263		if ((data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS) &&
1264		    ((usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON))
1265			return 0;
1266
1267		return -1;
1268	}
1269
1270	return 0;
1271}
1272
1273static int rmi_check_valid_report_id(struct hid_device *hdev, unsigned type,
1274		unsigned id, struct hid_report **report)
1275{
1276	int i;
1277
1278	*report = hdev->report_enum[type].report_id_hash[id];
1279	if (*report) {
1280		for (i = 0; i < (*report)->maxfield; i++) {
1281			unsigned app = (*report)->field[i]->application;
1282			if ((app & HID_USAGE_PAGE) >= HID_UP_MSVENDOR)
1283				return 1;
1284		}
1285	}
1286
1287	return 0;
1288}
1289
1290static int rmi_probe(struct hid_device *hdev, const struct hid_device_id *id)
1291{
1292	struct rmi_data *data = NULL;
1293	int ret;
1294	size_t alloc_size;
1295	struct hid_report *input_report;
1296	struct hid_report *output_report;
1297	struct hid_report *feature_report;
1298
1299	data = devm_kzalloc(&hdev->dev, sizeof(struct rmi_data), GFP_KERNEL);
1300	if (!data)
1301		return -ENOMEM;
1302
1303	INIT_WORK(&data->reset_work, rmi_reset_work);
1304	data->hdev = hdev;
1305
1306	hid_set_drvdata(hdev, data);
1307
1308	hdev->quirks |= HID_QUIRK_NO_INIT_REPORTS;
1309
1310	ret = hid_parse(hdev);
1311	if (ret) {
1312		hid_err(hdev, "parse failed\n");
1313		return ret;
1314	}
1315
1316	if (id->driver_data)
1317		data->device_flags = id->driver_data;
1318
1319	/*
1320	 * Check for the RMI specific report ids. If they are misisng
1321	 * simply return and let the events be processed by hid-input
1322	 */
1323	if (!rmi_check_valid_report_id(hdev, HID_FEATURE_REPORT,
1324	    RMI_SET_RMI_MODE_REPORT_ID, &feature_report)) {
1325		hid_dbg(hdev, "device does not have set mode feature report\n");
1326		goto start;
1327	}
1328
1329	if (!rmi_check_valid_report_id(hdev, HID_INPUT_REPORT,
1330	    RMI_ATTN_REPORT_ID, &input_report)) {
1331		hid_dbg(hdev, "device does not have attention input report\n");
1332		goto start;
1333	}
1334
1335	data->input_report_size = hid_report_len(input_report);
1336
1337	if (!rmi_check_valid_report_id(hdev, HID_OUTPUT_REPORT,
1338	    RMI_WRITE_REPORT_ID, &output_report)) {
1339		hid_dbg(hdev,
1340			"device does not have rmi write output report\n");
1341		goto start;
1342	}
1343
1344	data->output_report_size = hid_report_len(output_report);
1345
1346	data->device_flags |= RMI_DEVICE;
1347	alloc_size = data->output_report_size + data->input_report_size;
1348
1349	data->writeReport = devm_kzalloc(&hdev->dev, alloc_size, GFP_KERNEL);
1350	if (!data->writeReport) {
1351		ret = -ENOMEM;
1352		return ret;
1353	}
1354
1355	data->readReport = data->writeReport + data->output_report_size;
1356
1357	init_waitqueue_head(&data->wait);
1358
1359	mutex_init(&data->page_mutex);
1360
1361start:
1362	ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
1363	if (ret) {
1364		hid_err(hdev, "hw start failed\n");
1365		return ret;
1366	}
1367
1368	if ((data->device_flags & RMI_DEVICE) &&
1369	    !test_bit(RMI_STARTED, &data->flags))
1370		/*
1371		 * The device maybe in the bootloader if rmi_input_configured
1372		 * failed to find F11 in the PDT. Print an error, but don't
1373		 * return an error from rmi_probe so that hidraw will be
1374		 * accessible from userspace. That way a userspace tool
1375		 * can be used to reload working firmware on the touchpad.
1376		 */
1377		hid_err(hdev, "Device failed to be properly configured\n");
1378
1379	return 0;
1380}
1381
1382static void rmi_remove(struct hid_device *hdev)
1383{
1384	struct rmi_data *hdata = hid_get_drvdata(hdev);
1385
1386	clear_bit(RMI_STARTED, &hdata->flags);
1387
1388	hid_hw_stop(hdev);
1389}
1390
1391static const struct hid_device_id rmi_id[] = {
1392	{ HID_USB_DEVICE(USB_VENDOR_ID_RAZER, USB_DEVICE_ID_RAZER_BLADE_14),
1393		.driver_data = RMI_DEVICE_HAS_PHYS_BUTTONS },
1394	{ HID_DEVICE(HID_BUS_ANY, HID_GROUP_RMI, HID_ANY_ID, HID_ANY_ID) },
1395	{ }
1396};
1397MODULE_DEVICE_TABLE(hid, rmi_id);
1398
1399static struct hid_driver rmi_driver = {
1400	.name = "hid-rmi",
1401	.id_table		= rmi_id,
1402	.probe			= rmi_probe,
1403	.remove			= rmi_remove,
1404	.event			= rmi_event,
1405	.raw_event		= rmi_raw_event,
1406	.input_mapping		= rmi_input_mapping,
1407	.input_configured	= rmi_input_configured,
1408#ifdef CONFIG_PM
1409	.suspend		= rmi_suspend,
1410	.resume			= rmi_post_resume,
1411	.reset_resume		= rmi_post_reset,
1412#endif
1413};
1414
1415module_hid_driver(rmi_driver);
1416
1417MODULE_AUTHOR("Andrew Duggan <aduggan@synaptics.com>");
1418MODULE_DESCRIPTION("RMI HID driver");
1419MODULE_LICENSE("GPL");
1420