projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
HID: core: Avoid uninitialized buffer access
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / hid / hid-logitech-dj.c
CommitLineData
534a7b8e
NLC		 1/*
2 * HID driver for Logitech Unifying receivers
3 *
4 * Copyright (c) 2011 Logitech
5 */
6
7/*
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
11
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
24
25#include <linux/device.h>
26#include <linux/hid.h>
27#include <linux/module.h>
28#include <linux/usb.h>
44d27f7d 29#include <asm/unaligned.h>
534a7b8e
NLC		 30#include "hid-ids.h"
31#include "hid-logitech-dj.h"
32
33/* Keyboard descriptor (1) */
34static const char kbd_descriptor[] = {
35 0x05, 0x01, /* USAGE_PAGE (generic Desktop) */
36 0x09, 0x06, /* USAGE (Keyboard) */
37 0xA1, 0x01, /* COLLECTION (Application) */
38 0x85, 0x01, /* REPORT_ID (1) */
39 0x95, 0x08, /* REPORT_COUNT (8) */
40 0x75, 0x01, /* REPORT_SIZE (1) */
41 0x15, 0x00, /* LOGICAL_MINIMUM (0) */
42 0x25, 0x01, /* LOGICAL_MAXIMUM (1) */
43 0x05, 0x07, /* USAGE_PAGE (Keyboard) */
44 0x19, 0xE0, /* USAGE_MINIMUM (Left Control) */
45 0x29, 0xE7, /* USAGE_MAXIMUM (Right GUI) */
46 0x81, 0x02, /* INPUT (Data,Var,Abs) */
47 0x95, 0x05, /* REPORT COUNT (5) */
48 0x05, 0x08, /* USAGE PAGE (LED page) */
49 0x19, 0x01, /* USAGE MINIMUM (1) */
50 0x29, 0x05, /* USAGE MAXIMUM (5) */
51 0x91, 0x02, /* OUTPUT (Data, Variable, Absolute) */
52 0x95, 0x01, /* REPORT COUNT (1) */
53 0x75, 0x03, /* REPORT SIZE (3) */
54 0x91, 0x01, /* OUTPUT (Constant) */
55 0x95, 0x06, /* REPORT_COUNT (6) */
56 0x75, 0x08, /* REPORT_SIZE (8) */
57 0x15, 0x00, /* LOGICAL_MINIMUM (0) */
58 0x26, 0xFF, 0x00, /* LOGICAL_MAXIMUM (255) */
59 0x05, 0x07, /* USAGE_PAGE (Keyboard) */
60 0x19, 0x00, /* USAGE_MINIMUM (no event) */
61 0x2A, 0xFF, 0x00, /* USAGE_MAXIMUM (reserved) */
62 0x81, 0x00, /* INPUT (Data,Ary,Abs) */
63 0xC0
64};
65
66/* Mouse descriptor (2) */
67static const char mse_descriptor[] = {
68 0x05, 0x01, /* USAGE_PAGE (Generic Desktop) */
69 0x09, 0x02, /* USAGE (Mouse) */
70 0xA1, 0x01, /* COLLECTION (Application) */
71 0x85, 0x02, /* REPORT_ID = 2 */
72 0x09, 0x01, /* USAGE (pointer) */
73 0xA1, 0x00, /* COLLECTION (physical) */
74 0x05, 0x09, /* USAGE_PAGE (buttons) */
75 0x19, 0x01, /* USAGE_MIN (1) */
76 0x29, 0x10, /* USAGE_MAX (16) */
77 0x15, 0x00, /* LOGICAL_MIN (0) */
78 0x25, 0x01, /* LOGICAL_MAX (1) */
79 0x95, 0x10, /* REPORT_COUNT (16) */
80 0x75, 0x01, /* REPORT_SIZE (1) */
81 0x81, 0x02, /* INPUT (data var abs) */
82 0x05, 0x01, /* USAGE_PAGE (generic desktop) */
83 0x16, 0x01, 0xF8, /* LOGICAL_MIN (-2047) */
84 0x26, 0xFF, 0x07, /* LOGICAL_MAX (2047) */
85 0x75, 0x0C, /* REPORT_SIZE (12) */
86 0x95, 0x02, /* REPORT_COUNT (2) */
87 0x09, 0x30, /* USAGE (X) */
88 0x09, 0x31, /* USAGE (Y) */
89 0x81, 0x06, /* INPUT */
90 0x15, 0x81, /* LOGICAL_MIN (-127) */
91 0x25, 0x7F, /* LOGICAL_MAX (127) */
92 0x75, 0x08, /* REPORT_SIZE (8) */
93 0x95, 0x01, /* REPORT_COUNT (1) */
94 0x09, 0x38, /* USAGE (wheel) */
95 0x81, 0x06, /* INPUT */
96 0x05, 0x0C, /* USAGE_PAGE(consumer) */
97 0x0A, 0x38, 0x02, /* USAGE(AC Pan) */
98 0x95, 0x01, /* REPORT_COUNT (1) */
99 0x81, 0x06, /* INPUT */
100 0xC0, /* END_COLLECTION */
101 0xC0, /* END_COLLECTION */
102};
103
104/* Consumer Control descriptor (3) */
105static const char consumer_descriptor[] = {
106 0x05, 0x0C, /* USAGE_PAGE (Consumer Devices) */
107 0x09, 0x01, /* USAGE (Consumer Control) */
108 0xA1, 0x01, /* COLLECTION (Application) */
109 0x85, 0x03, /* REPORT_ID = 3 */
110 0x75, 0x10, /* REPORT_SIZE (16) */
111 0x95, 0x02, /* REPORT_COUNT (2) */
112 0x15, 0x01, /* LOGICAL_MIN (1) */
113 0x26, 0x8C, 0x02, /* LOGICAL_MAX (652) */
114 0x19, 0x01, /* USAGE_MIN (1) */
115 0x2A, 0x8C, 0x02, /* USAGE_MAX (652) */
116 0x81, 0x00, /* INPUT (Data Ary Abs) */
117 0xC0, /* END_COLLECTION */
118}; /* */
119
120/* System control descriptor (4) */
121static const char syscontrol_descriptor[] = {
122 0x05, 0x01, /* USAGE_PAGE (Generic Desktop) */
123 0x09, 0x80, /* USAGE (System Control) */
124 0xA1, 0x01, /* COLLECTION (Application) */
125 0x85, 0x04, /* REPORT_ID = 4 */
126 0x75, 0x02, /* REPORT_SIZE (2) */
127 0x95, 0x01, /* REPORT_COUNT (1) */
128 0x15, 0x01, /* LOGICAL_MIN (1) */
129 0x25, 0x03, /* LOGICAL_MAX (3) */
130 0x09, 0x82, /* USAGE (System Sleep) */
131 0x09, 0x81, /* USAGE (System Power Down) */
132 0x09, 0x83, /* USAGE (System Wake Up) */
133 0x81, 0x60, /* INPUT (Data Ary Abs NPrf Null) */
134 0x75, 0x06, /* REPORT_SIZE (6) */
135 0x81, 0x03, /* INPUT (Cnst Var Abs) */
136 0xC0, /* END_COLLECTION */
137};
138
139/* Media descriptor (8) */
140static const char media_descriptor[] = {
141 0x06, 0xbc, 0xff, /* Usage Page 0xffbc */
142 0x09, 0x88, /* Usage 0x0088 */
143 0xa1, 0x01, /* BeginCollection */
144 0x85, 0x08, /* Report ID 8 */
145 0x19, 0x01, /* Usage Min 0x0001 */
146 0x29, 0xff, /* Usage Max 0x00ff */
147 0x15, 0x01, /* Logical Min 1 */
148 0x26, 0xff, 0x00, /* Logical Max 255 */
149 0x75, 0x08, /* Report Size 8 */
150 0x95, 0x01, /* Report Count 1 */
151 0x81, 0x00, /* Input */
152 0xc0, /* EndCollection */
153}; /* */
154
155/* Maximum size of all defined hid reports in bytes (including report id) */
156#define MAX_REPORT_SIZE 8
157
2a039bf5
HR		 158/* Make sure all descriptors are present here */
159#define MAX_RDESC_SIZE \
160 (sizeof(kbd_descriptor) + \
161 sizeof(mse_descriptor) + \
162 sizeof(consumer_descriptor) + \
163 sizeof(syscontrol_descriptor) + \
164 sizeof(media_descriptor))
165
534a7b8e
NLC		 166/* Number of possible hid report types that can be created by this driver.
167 *
168 * Right now, RF report types have the same report types (or report id's)
169 * than the hid report created from those RF reports. In the future
170 * this doesnt have to be true.
171 *
172 * For instance, RF report type 0x01 which has a size of 8 bytes, corresponds
173 * to hid report id 0x01, this is standard keyboard. Same thing applies to mice
174 * reports and consumer control, etc. If a new RF report is created, it doesn't
175 * has to have the same report id as its corresponding hid report, so an
176 * translation may have to take place for future report types.
177 */
178#define NUMBER_OF_HID_REPORTS 32
179static const u8 hid_reportid_size_map[NUMBER_OF_HID_REPORTS] = {
180 [1] = 8, /* Standard keyboard */
181 [2] = 8, /* Standard mouse */
182 [3] = 5, /* Consumer control */
183 [4] = 2, /* System control */
184 [8] = 2, /* Media Center */
185};
186
187
188#define LOGITECH_DJ_INTERFACE_NUMBER 0x02
189
534a7b8e
NLC		 190static struct hid_ll_driver logi_dj_ll_driver;
191
192static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
193 size_t count,
194 unsigned char report_type);
ac847139 195static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev);
534a7b8e
NLC		 196
197static void logi_dj_recv_destroy_djhid_device(struct dj_receiver_dev *djrcv_dev,
198 struct dj_report *dj_report)
199{
200 /* Called in delayed work context */
201 struct dj_device *dj_dev;
202 unsigned long flags;
203
204 spin_lock_irqsave(&djrcv_dev->lock, flags);
205 dj_dev = djrcv_dev->paired_dj_devices[dj_report->device_index];
206 djrcv_dev->paired_dj_devices[dj_report->device_index] = NULL;
207 spin_unlock_irqrestore(&djrcv_dev->lock, flags);
208
209 if (dj_dev != NULL) {
210 hid_destroy_device(dj_dev->hdev);
211 kfree(dj_dev);
212 } else {
213 dev_err(&djrcv_dev->hdev->dev, "%s: can't destroy a NULL device\n",
214 __func__);
215 }
216}
217
218static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
219 struct dj_report *dj_report)
220{
221 /* Called in delayed work context */
222 struct hid_device *djrcv_hdev = djrcv_dev->hdev;
223 struct usb_interface *intf = to_usb_interface(djrcv_hdev->dev.parent);
224 struct usb_device *usbdev = interface_to_usbdev(intf);
225 struct hid_device *dj_hiddev;
226 struct dj_device *dj_dev;
227
228 /* Device index goes from 1 to 6, we need 3 bytes to store the
229 * semicolon, the index, and a null terminator
230 */
231 unsigned char tmpstr[3];
232
233 if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION] &
234 SPFUNCTION_DEVICE_LIST_EMPTY) {
235 dbg_hid("%s: device list is empty\n", __func__);
ac847139 236 djrcv_dev->querying_devices = false;
534a7b8e
NLC		 237 return;
238 }
239
ac847139
NLC		 240 if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
241 /* The device is already known. No need to reallocate it. */
242 dbg_hid("%s: device is already known\n", __func__);
243 return;
244 }
245
534a7b8e
NLC		 246 dj_hiddev = hid_allocate_device();
247 if (IS_ERR(dj_hiddev)) {
248 dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n",
249 __func__);
250 return;
251 }
252
253 dj_hiddev->ll_driver = &logi_dj_ll_driver;
254 dj_hiddev->hid_output_raw_report = logi_dj_output_hidraw_report;
255
256 dj_hiddev->dev.parent = &djrcv_hdev->dev;
257 dj_hiddev->bus = BUS_USB;
258 dj_hiddev->vendor = le16_to_cpu(usbdev->descriptor.idVendor);
259 dj_hiddev->product = le16_to_cpu(usbdev->descriptor.idProduct);
260 snprintf(dj_hiddev->name, sizeof(dj_hiddev->name),
261 "Logitech Unifying Device. Wireless PID:%02x%02x",
262 dj_report->report_params[DEVICE_PAIRED_PARAM_EQUAD_ID_MSB],
263 dj_report->report_params[DEVICE_PAIRED_PARAM_EQUAD_ID_LSB]);
264
265 usb_make_path(usbdev, dj_hiddev->phys, sizeof(dj_hiddev->phys));
266 snprintf(tmpstr, sizeof(tmpstr), ":%d", dj_report->device_index);
267 strlcat(dj_hiddev->phys, tmpstr, sizeof(dj_hiddev->phys));
268
269 dj_dev = kzalloc(sizeof(struct dj_device), GFP_KERNEL);
270
271 if (!dj_dev) {
272 dev_err(&djrcv_hdev->dev, "%s: failed allocating dj_device\n",
273 __func__);
274 goto dj_device_allocate_fail;
275 }
276
44d27f7d
JN		 277 dj_dev->reports_supported = get_unaligned_le32(
278 dj_report->report_params + DEVICE_PAIRED_RF_REPORT_TYPE);
534a7b8e
NLC		 279 dj_dev->hdev = dj_hiddev;
280 dj_dev->dj_receiver_dev = djrcv_dev;
281 dj_dev->device_index = dj_report->device_index;
282 dj_hiddev->driver_data = dj_dev;
283
284 djrcv_dev->paired_dj_devices[dj_report->device_index] = dj_dev;
285
286 if (hid_add_device(dj_hiddev)) {
287 dev_err(&djrcv_hdev->dev, "%s: failed adding dj_device\n",
288 __func__);
289 goto hid_add_device_fail;
290 }
291
292 return;
293
294hid_add_device_fail:
295 djrcv_dev->paired_dj_devices[dj_report->device_index] = NULL;
296 kfree(dj_dev);
297dj_device_allocate_fail:
298 hid_destroy_device(dj_hiddev);
299}
300
301static void delayedwork_callback(struct work_struct *work)
302{
303 struct dj_receiver_dev *djrcv_dev =
304 container_of(work, struct dj_receiver_dev, work);
305
306 struct dj_report dj_report;
307 unsigned long flags;
308 int count;
ac847139 309 int retval;
534a7b8e
NLC		 310
311 dbg_hid("%s\n", __func__);
312
313 spin_lock_irqsave(&djrcv_dev->lock, flags);
314
315 count = kfifo_out(&djrcv_dev->notif_fifo, &dj_report,
316 sizeof(struct dj_report));
317
318 if (count != sizeof(struct dj_report)) {
319 dev_err(&djrcv_dev->hdev->dev, "%s: workitem triggered without "
320 "notifications available\n", __func__);
321 spin_unlock_irqrestore(&djrcv_dev->lock, flags);
322 return;
323 }
324
325 if (!kfifo_is_empty(&djrcv_dev->notif_fifo)) {
326 if (schedule_work(&djrcv_dev->work) == 0) {
327 dbg_hid("%s: did not schedule the work item, was "
328 "already queued\n", __func__);
329 }
330 }
331
332 spin_unlock_irqrestore(&djrcv_dev->lock, flags);
333
334 switch (dj_report.report_type) {
335 case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
336 logi_dj_recv_add_djhid_device(djrcv_dev, &dj_report);
337 break;
338 case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
339 logi_dj_recv_destroy_djhid_device(djrcv_dev, &dj_report);
340 break;
341 default:
ac847139
NLC		 342 /* A normal report (i. e. not belonging to a pair/unpair notification)
343 * arriving here, means that the report arrived but we did not have a
344 * paired dj_device associated to the report's device_index, this
345 * means that the original "device paired" notification corresponding
346 * to this dj_device never arrived to this driver. The reason is that
347 * hid-core discards all packets coming from a device while probe() is
348 * executing. */
349 if (!djrcv_dev->paired_dj_devices[dj_report.device_index]) {
350 /* ok, we don't know the device, just re-ask the
351 * receiver for the list of connected devices. */
352 retval = logi_dj_recv_query_paired_devices(djrcv_dev);
353 if (!retval) {
354 /* everything went fine, so just leave */
355 break;
356 }
357 dev_err(&djrcv_dev->hdev->dev,
358 "%s:logi_dj_recv_query_paired_devices "
359 "error:%d\n", __func__, retval);
360 }
534a7b8e
NLC		 361 dbg_hid("%s: unexpected report type\n", __func__);
362 }
363}
364
365static void logi_dj_recv_queue_notification(struct dj_receiver_dev *djrcv_dev,
366 struct dj_report *dj_report)
367{
368 /* We are called from atomic context (tasklet && djrcv->lock held) */
369
370 kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
371
372 if (schedule_work(&djrcv_dev->work) == 0) {
373 dbg_hid("%s: did not schedule the work item, was already "
374 "queued\n", __func__);
375 }
376}
377
378static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,
379 struct dj_report *dj_report)
380{
381 /* We are called from atomic context (tasklet && djrcv->lock held) */
382 unsigned int i;
383 u8 reportbuffer[MAX_REPORT_SIZE];
384 struct dj_device *djdev;
385
386 djdev = djrcv_dev->paired_dj_devices[dj_report->device_index];
387
388 if (!djdev) {
389 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
390 " is NULL, index %d\n", dj_report->device_index);
ac847139
NLC		 391 kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
392
393 if (schedule_work(&djrcv_dev->work) == 0) {
394 dbg_hid("%s: did not schedule the work item, was already "
395 "queued\n", __func__);
396 }
534a7b8e
NLC		 397 return;
398 }
399
400 memset(reportbuffer, 0, sizeof(reportbuffer));
401
402 for (i = 0; i < NUMBER_OF_HID_REPORTS; i++) {
403 if (djdev->reports_supported & (1 << i)) {
404 reportbuffer[0] = i;
405 if (hid_input_report(djdev->hdev,
406 HID_INPUT_REPORT,
407 reportbuffer,
408 hid_reportid_size_map[i], 1)) {
409 dbg_hid("hid_input_report error sending null "
410 "report\n");
411 }
412 }
413 }
414}
415
416static void logi_dj_recv_forward_report(struct dj_receiver_dev *djrcv_dev,
417 struct dj_report *dj_report)
418{
419 /* We are called from atomic context (tasklet && djrcv->lock held) */
420 struct dj_device *dj_device;
421
422 dj_device = djrcv_dev->paired_dj_devices[dj_report->device_index];
423
424 if (dj_device == NULL) {
425 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
426 " is NULL, index %d\n", dj_report->device_index);
ac847139
NLC		 427 kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
428
429 if (schedule_work(&djrcv_dev->work) == 0) {
430 dbg_hid("%s: did not schedule the work item, was already "
431 "queued\n", __func__);
432 }
534a7b8e
NLC		 433 return;
434 }
435
436 if ((dj_report->report_type > ARRAY_SIZE(hid_reportid_size_map) - 1) ||
437 (hid_reportid_size_map[dj_report->report_type] == 0)) {
438 dbg_hid("invalid report type:%x\n", dj_report->report_type);
439 return;
440 }
441
442 if (hid_input_report(dj_device->hdev,
443 HID_INPUT_REPORT, &dj_report->report_type,
444 hid_reportid_size_map[dj_report->report_type], 1)) {
445 dbg_hid("hid_input_report error\n");
446 }
447}
448
449
450static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev,
451 struct dj_report *dj_report)
452{
453 struct hid_device *hdev = djrcv_dev->hdev;
dcd9006b
BT		 454 struct hid_report *report;
455 struct hid_report_enum *output_report_enum;
456 u8 *data = (u8 *)(&dj_report->device_index);
76611073 457 unsigned int i;
534a7b8e 458
dcd9006b
BT		 459 output_report_enum = &hdev->report_enum[HID_OUTPUT_REPORT];
460 report = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT];
461
462 if (!report) {
463 dev_err(&hdev->dev, "%s: unable to find dj report\n", __func__);
534a7b8e
NLC		 464 return -ENODEV;
465 }
466
76611073 467 for (i = 0; i < DJREPORT_SHORT_LENGTH - 1; i++)
dcd9006b
BT		 468 report->field[0]->value[i] = data[i];
469
83a44ac8 470 hid_hw_request(hdev, report, HID_REQ_SET_REPORT);
534a7b8e 471
dcd9006b 472 return 0;
534a7b8e
NLC		 473}
474
475static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
476{
d8dc3494
MD		 477 struct dj_report *dj_report;
478 int retval;
534a7b8e 479
ac847139
NLC		 480 /* no need to protect djrcv_dev->querying_devices */
481 if (djrcv_dev->querying_devices)
482 return 0;
483
8a55ade7 484 dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
d8dc3494
MD		 485 if (!dj_report)
486 return -ENOMEM;
487 dj_report->report_id = REPORT_ID_DJ_SHORT;
488 dj_report->device_index = 0xFF;
489 dj_report->report_type = REPORT_TYPE_CMD_GET_PAIRED_DEVICES;
490 retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
491 kfree(dj_report);
492 return retval;
534a7b8e
NLC		 493}
494
ac847139 495
534a7b8e
NLC		 496static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
497 unsigned timeout)
498{
d8dc3494
MD		 499 struct dj_report *dj_report;
500 int retval;
534a7b8e 501
8a55ade7 502 dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
d8dc3494
MD		 503 if (!dj_report)
504 return -ENOMEM;
505 dj_report->report_id = REPORT_ID_DJ_SHORT;
506 dj_report->device_index = 0xFF;
507 dj_report->report_type = REPORT_TYPE_CMD_SWITCH;
508 dj_report->report_params[CMD_SWITCH_PARAM_DEVBITFIELD] = 0x3F;
509 dj_report->report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS] = (u8)timeout;
510 retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
511 kfree(dj_report);
512 return retval;
534a7b8e
NLC		 513}
514
515
516static int logi_dj_ll_open(struct hid_device *hid)
517{
518 dbg_hid("%s:%s\n", __func__, hid->phys);
519 return 0;
520
521}
522
523static void logi_dj_ll_close(struct hid_device *hid)
524{
525 dbg_hid("%s:%s\n", __func__, hid->phys);
526}
527
528static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
529 size_t count,
530 unsigned char report_type)
531{
532 /* Called by hid raw to send data */
533 dbg_hid("%s\n", __func__);
534
535 return 0;
536}
537
2a039bf5
HR		 538static void rdcat(char **rdesc, unsigned int *rsize, const char *data, unsigned int size)
539{
540 memcpy(*rdesc + *rsize, data, size);
541 *rsize += size;
542}
543
534a7b8e
NLC		 544static int logi_dj_ll_parse(struct hid_device *hid)
545{
546 struct dj_device *djdev = hid->driver_data;
2a039bf5
HR		 547 unsigned int rsize = 0;
548 char *rdesc;
534a7b8e
NLC		 549 int retval;
550
551 dbg_hid("%s\n", __func__);
552
553 djdev->hdev->version = 0x0111;
554 djdev->hdev->country = 0x00;
555
2a039bf5
HR		 556 rdesc = kmalloc(MAX_RDESC_SIZE, GFP_KERNEL);
557 if (!rdesc)
558 return -ENOMEM;
559
534a7b8e
NLC		 560 if (djdev->reports_supported & STD_KEYBOARD) {
561 dbg_hid("%s: sending a kbd descriptor, reports_supported: %x\n",
562 __func__, djdev->reports_supported);
2a039bf5 563 rdcat(&rdesc, &rsize, kbd_descriptor, sizeof(kbd_descriptor));
534a7b8e
NLC		 564 }
565
566 if (djdev->reports_supported & STD_MOUSE) {
567 dbg_hid("%s: sending a mouse descriptor, reports_supported: "
568 "%x\n", __func__, djdev->reports_supported);
2a039bf5 569 rdcat(&rdesc, &rsize, mse_descriptor, sizeof(mse_descriptor));
534a7b8e
NLC		 570 }
571
572 if (djdev->reports_supported & MULTIMEDIA) {
573 dbg_hid("%s: sending a multimedia report descriptor: %x\n",
574 __func__, djdev->reports_supported);
2a039bf5 575 rdcat(&rdesc, &rsize, consumer_descriptor, sizeof(consumer_descriptor));
534a7b8e
NLC		 576 }
577
578 if (djdev->reports_supported & POWER_KEYS) {
579 dbg_hid("%s: sending a power keys report descriptor: %x\n",
580 __func__, djdev->reports_supported);
2a039bf5 581 rdcat(&rdesc, &rsize, syscontrol_descriptor, sizeof(syscontrol_descriptor));
534a7b8e
NLC		 582 }
583
584 if (djdev->reports_supported & MEDIA_CENTER) {
585 dbg_hid("%s: sending a media center report descriptor: %x\n",
586 __func__, djdev->reports_supported);
2a039bf5 587 rdcat(&rdesc, &rsize, media_descriptor, sizeof(media_descriptor));
534a7b8e
NLC		 588 }
589
590 if (djdev->reports_supported & KBD_LEDS) {
591 dbg_hid("%s: need to send kbd leds report descriptor: %x\n",
592 __func__, djdev->reports_supported);
593 }
594
2a039bf5
HR		 595 retval = hid_parse_report(hid, rdesc, rsize);
596 kfree(rdesc);
597
598 return retval;
534a7b8e
NLC		 599}
600
601static int logi_dj_ll_input_event(struct input_dev *dev, unsigned int type,
602 unsigned int code, int value)
603{
604 /* Sent by the input layer to handle leds and Force Feedback */
605 struct hid_device *dj_hiddev = input_get_drvdata(dev);
606 struct dj_device *dj_dev = dj_hiddev->driver_data;
607
608 struct dj_receiver_dev *djrcv_dev =
609 dev_get_drvdata(dj_hiddev->dev.parent);
610 struct hid_device *dj_rcv_hiddev = djrcv_dev->hdev;
611 struct hid_report_enum *output_report_enum;
612
613 struct hid_field *field;
614 struct hid_report *report;
b2b6cada 615 unsigned char *data;
534a7b8e
NLC		 616 int offset;
617
618 dbg_hid("%s: %s, type:%d | code:%d | value:%d\n",
619 __func__, dev->phys, type, code, value);
620
621 if (type != EV_LED)
622 return -1;
623
624 offset = hidinput_find_field(dj_hiddev, type, code, &field);
625
626 if (offset == -1) {
627 dev_warn(&dev->dev, "event field not found\n");
628 return -1;
629 }
630 hid_set_field(field, offset, value);
b2b6cada
JK		 631
632 data = hid_alloc_report_buf(field->report, GFP_KERNEL);
633 if (!data) {
634 dev_warn(&dev->dev, "failed to allocate report buf memory\n");
635 return -1;
636 }
637
534a7b8e
NLC		 638 hid_output_report(field->report, &data[0]);
639
640 output_report_enum = &dj_rcv_hiddev->report_enum[HID_OUTPUT_REPORT];
641 report = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT];
642 hid_set_field(report->field[0], 0, dj_dev->device_index);
643 hid_set_field(report->field[0], 1, REPORT_TYPE_LEDS);
644 hid_set_field(report->field[0], 2, data[1]);
645
d8814272 646 hid_hw_request(dj_rcv_hiddev, report, HID_REQ_SET_REPORT);
534a7b8e 647
b2b6cada 648 kfree(data);
534a7b8e 649
b2b6cada 650 return 0;
534a7b8e
NLC		 651}
652
653static int logi_dj_ll_start(struct hid_device *hid)
654{
655 dbg_hid("%s\n", __func__);
656 return 0;
657}
658
659static void logi_dj_ll_stop(struct hid_device *hid)
660{
661 dbg_hid("%s\n", __func__);
662}
663
664
665static struct hid_ll_driver logi_dj_ll_driver = {
666 .parse = logi_dj_ll_parse,
667 .start = logi_dj_ll_start,
668 .stop = logi_dj_ll_stop,
669 .open = logi_dj_ll_open,
670 .close = logi_dj_ll_close,
671 .hidinput_input_event = logi_dj_ll_input_event,
672};
673
674
675static int logi_dj_raw_event(struct hid_device *hdev,
676 struct hid_report *report, u8 *data,
677 int size)
678{
679 struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
680 struct dj_report *dj_report = (struct dj_report *) data;
681 unsigned long flags;
534a7b8e
NLC		 682
683 dbg_hid("%s, size:%d\n", __func__, size);
684
685 /* Here we receive all data coming from iface 2, there are 4 cases:
686 *
687 * 1) Data should continue its normal processing i.e. data does not
688 * come from the DJ collection, in which case we do nothing and
689 * return 0, so hid-core can continue normal processing (will forward
690 * to associated hidraw device)
691 *
692 * 2) Data is from DJ collection, and is intended for this driver i. e.
693 * data contains arrival, departure, etc notifications, in which case
694 * we queue them for delayed processing by the work queue. We return 1
695 * to hid-core as no further processing is required from it.
696 *
697 * 3) Data is from DJ collection, and informs a connection change,
698 * if the change means rf link loss, then we must send a null report
699 * to the upper layer to discard potentially pressed keys that may be
700 * repeated forever by the input layer. Return 1 to hid-core as no
701 * further processing is required.
702 *
703 * 4) Data is from DJ collection and is an actual input event from
704 * a paired DJ device in which case we forward it to the correct hid
705 * device (via hid_input_report() ) and return 1 so hid-core does not do
706 * anything else with it.
707 */
0fbcd4c2
BT		 708
709 /* case 1) */
710 if (data[0] != REPORT_ID_DJ_SHORT)
711 return false;
712
4292001d
JK		 713 if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
714 (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
0fbcd4c2
BT		 715 /*
716 * Device index is wrong, bail out.
717 * This driver can ignore safely the receiver notifications,
718 * so ignore those reports too.
719 */
720 if (dj_report->device_index != DJ_RECEIVER_INDEX)
721 dev_err(&hdev->dev, "%s: invalid device index:%d\n",
4292001d
JK		 722 __func__, dj_report->device_index);
723 return false;
724 }
534a7b8e
NLC		 725
726 spin_lock_irqsave(&djrcv_dev->lock, flags);
0fbcd4c2
BT		 727 switch (dj_report->report_type) {
728 case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
729 case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
730 logi_dj_recv_queue_notification(djrcv_dev, dj_report);
731 break;
732 case REPORT_TYPE_NOTIF_CONNECTION_STATUS:
733 if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] ==
734 STATUS_LINKLOSS) {
735 logi_dj_recv_forward_null_report(djrcv_dev, dj_report);
534a7b8e 736 }
0fbcd4c2
BT		 737 break;
738 default:
739 logi_dj_recv_forward_report(djrcv_dev, dj_report);
534a7b8e
NLC		 740 }
741 spin_unlock_irqrestore(&djrcv_dev->lock, flags);
742
0fbcd4c2 743 return true;
534a7b8e
NLC		 744}
745
746static int logi_dj_probe(struct hid_device *hdev,
747 const struct hid_device_id *id)
748{
749 struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
750 struct dj_receiver_dev *djrcv_dev;
751 int retval;
752
753 if (is_dj_device((struct dj_device *)hdev->driver_data))
754 return -ENODEV;
755
756 dbg_hid("%s called for ifnum %d\n", __func__,
757 intf->cur_altsetting->desc.bInterfaceNumber);
758
759 /* Ignore interfaces 0 and 1, they will not carry any data, dont create
760 * any hid_device for them */
761 if (intf->cur_altsetting->desc.bInterfaceNumber !=
762 LOGITECH_DJ_INTERFACE_NUMBER) {
763 dbg_hid("%s: ignoring ifnum %d\n", __func__,
764 intf->cur_altsetting->desc.bInterfaceNumber);
765 return -ENODEV;
766 }
767
768 /* Treat interface 2 */
769
770 djrcv_dev = kzalloc(sizeof(struct dj_receiver_dev), GFP_KERNEL);
771 if (!djrcv_dev) {
772 dev_err(&hdev->dev,
773 "%s:failed allocating dj_receiver_dev\n", __func__);
774 return -ENOMEM;
775 }
776 djrcv_dev->hdev = hdev;
777 INIT_WORK(&djrcv_dev->work, delayedwork_callback);
778 spin_lock_init(&djrcv_dev->lock);
779 if (kfifo_alloc(&djrcv_dev->notif_fifo,
780 DJ_MAX_NUMBER_NOTIFICATIONS * sizeof(struct dj_report),
781 GFP_KERNEL)) {
782 dev_err(&hdev->dev,
783 "%s:failed allocating notif_fifo\n", __func__);
784 kfree(djrcv_dev);
785 return -ENOMEM;
786 }
787 hid_set_drvdata(hdev, djrcv_dev);
788
789 /* Call to usbhid to fetch the HID descriptors of interface 2 and
790 * subsequently call to the hid/hid-core to parse the fetched
791 * descriptors, this will in turn create the hidraw and hiddev nodes
792 * for interface 2 of the receiver */
793 retval = hid_parse(hdev);
794 if (retval) {
795 dev_err(&hdev->dev,
796 "%s:parse of interface 2 failed\n", __func__);
797 goto hid_parse_fail;
798 }
799
76611073
KC		 800 if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, REPORT_ID_DJ_SHORT,
801 0, DJREPORT_SHORT_LENGTH - 1)) {
802 retval = -ENODEV;
803 goto hid_parse_fail;
804 }
805
534a7b8e
NLC		 806 /* Starts the usb device and connects to upper interfaces hiddev and
807 * hidraw */
808 retval = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
809 if (retval) {
810 dev_err(&hdev->dev,
811 "%s:hid_hw_start returned error\n", __func__);
812 goto hid_hw_start_fail;
813 }
814
815 retval = logi_dj_recv_switch_to_dj_mode(djrcv_dev, 0);
816 if (retval < 0) {
817 dev_err(&hdev->dev,
818 "%s:logi_dj_recv_switch_to_dj_mode returned error:%d\n",
819 __func__, retval);
820 goto switch_to_dj_mode_fail;
821 }
822
823 /* This is enabling the polling urb on the IN endpoint */
824 retval = hdev->ll_driver->open(hdev);
825 if (retval < 0) {
826 dev_err(&hdev->dev, "%s:hdev->ll_driver->open returned "
827 "error:%d\n", __func__, retval);
828 goto llopen_failed;
829 }
830
a9dd22b7
AR		 831 /* Allow incoming packets to arrive: */
832 hid_device_io_start(hdev);
833
534a7b8e
NLC		 834 retval = logi_dj_recv_query_paired_devices(djrcv_dev);
835 if (retval < 0) {
836 dev_err(&hdev->dev, "%s:logi_dj_recv_query_paired_devices "
837 "error:%d\n", __func__, retval);
838 goto logi_dj_recv_query_paired_devices_failed;
839 }
840
841 return retval;
842
843logi_dj_recv_query_paired_devices_failed:
844 hdev->ll_driver->close(hdev);
845
846llopen_failed:
847switch_to_dj_mode_fail:
848 hid_hw_stop(hdev);
849
850hid_hw_start_fail:
851hid_parse_fail:
852 kfifo_free(&djrcv_dev->notif_fifo);
853 kfree(djrcv_dev);
854 hid_set_drvdata(hdev, NULL);
855 return retval;
856
857}
858
859#ifdef CONFIG_PM
860static int logi_dj_reset_resume(struct hid_device *hdev)
861{
862 int retval;
863 struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
864
865 retval = logi_dj_recv_switch_to_dj_mode(djrcv_dev, 0);
866 if (retval < 0) {
867 dev_err(&hdev->dev,
868 "%s:logi_dj_recv_switch_to_dj_mode returned error:%d\n",
869 __func__, retval);
870 }
871
872 return 0;
873}
874#endif
875
876static void logi_dj_remove(struct hid_device *hdev)
877{
878 struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
879 struct dj_device *dj_dev;
880 int i;
881
882 dbg_hid("%s\n", __func__);
883
884 cancel_work_sync(&djrcv_dev->work);
885
886 hdev->ll_driver->close(hdev);
887 hid_hw_stop(hdev);
888
889 /* I suppose that at this point the only context that can access
890 * the djrecv_data is this thread as the work item is guaranteed to
891 * have finished and no more raw_event callbacks should arrive after
892 * the remove callback was triggered so no locks are put around the
893 * code below */
844580ff 894 for (i = 0; i < (DJ_MAX_PAIRED_DEVICES + DJ_DEVICE_INDEX_MIN); i++) {
534a7b8e
NLC		 895 dj_dev = djrcv_dev->paired_dj_devices[i];
896 if (dj_dev != NULL) {
897 hid_destroy_device(dj_dev->hdev);
898 kfree(dj_dev);
899 djrcv_dev->paired_dj_devices[i] = NULL;
900 }
901 }
902
903 kfifo_free(&djrcv_dev->notif_fifo);
904 kfree(djrcv_dev);
905 hid_set_drvdata(hdev, NULL);
906}
907
908static int logi_djdevice_probe(struct hid_device *hdev,
909 const struct hid_device_id *id)
910{
911 int ret;
912 struct dj_device *dj_dev = hdev->driver_data;
913
914 if (!is_dj_device(dj_dev))
915 return -ENODEV;
916
917 ret = hid_parse(hdev);
918 if (!ret)
919 ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
920
921 return ret;
922}
923
924static const struct hid_device_id logi_dj_receivers[] = {
925 {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
926 USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER)},
927 {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
928 USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2)},
929 {}
930};
931
932MODULE_DEVICE_TABLE(hid, logi_dj_receivers);
933
934static struct hid_driver logi_djreceiver_driver = {
935 .name = "logitech-djreceiver",
936 .id_table = logi_dj_receivers,
937 .probe = logi_dj_probe,
938 .remove = logi_dj_remove,
939 .raw_event = logi_dj_raw_event,
940#ifdef CONFIG_PM
941 .reset_resume = logi_dj_reset_resume,
942#endif
943};
944
945
946static const struct hid_device_id logi_dj_devices[] = {
947 {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
948 USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER)},
949 {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
950 USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2)},
951 {}
952};
953
954static struct hid_driver logi_djdevice_driver = {
955 .name = "logitech-djdevice",
956 .id_table = logi_dj_devices,
957 .probe = logi_djdevice_probe,
958};
959
960
961static int __init logi_dj_init(void)
962{
963 int retval;
964
965 dbg_hid("Logitech-DJ:%s\n", __func__);
966
967 retval = hid_register_driver(&logi_djreceiver_driver);
968 if (retval)
969 return retval;
970
971 retval = hid_register_driver(&logi_djdevice_driver);
972 if (retval)
973 hid_unregister_driver(&logi_djreceiver_driver);
974
975 return retval;
976
977}
978
979static void __exit logi_dj_exit(void)
980{
981 dbg_hid("Logitech-DJ:%s\n", __func__);
982
983 hid_unregister_driver(&logi_djdevice_driver);
984 hid_unregister_driver(&logi_djreceiver_driver);
985
986}
987
988module_init(logi_dj_init);
989module_exit(logi_dj_exit);
990MODULE_LICENSE("GPL");
991MODULE_AUTHOR("Logitech");
992MODULE_AUTHOR("Nestor Lopez Casado");
993MODULE_AUTHOR("nlopezcasad@logitech.com");
kernel source for telekom puls (alcatel/mediatek)