1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * Copyright (c) 2013 Andrew Duggan <aduggan@synaptics.com>
4 * Copyright (c) 2013 Synaptics Incorporated
5 * Copyright (c) 2014 Benjamin Tissoires <benjamin.tissoires@gmail.com>
6 * Copyright (c) 2014 Red Hat, Inc
9 #include <linux/kernel.h>
10 #include <linux/hid.h>
11 #include <linux/input.h>
12 #include <linux/input/mt.h>
13 #include <linux/irq.h>
14 #include <linux/irqdomain.h>
15 #include <linux/module.h>
17 #include <linux/slab.h>
18 #include <linux/wait.h>
19 #include <linux/sched.h>
20 #include <linux/rmi.h>
23 #define RMI_MOUSE_REPORT_ID 0x01 /* Mouse emulation Report */
24 #define RMI_WRITE_REPORT_ID 0x09 /* Output Report */
25 #define RMI_READ_ADDR_REPORT_ID 0x0a /* Output Report */
26 #define RMI_READ_DATA_REPORT_ID 0x0b /* Input Report */
27 #define RMI_ATTN_REPORT_ID 0x0c /* Input Report */
28 #define RMI_SET_RMI_MODE_REPORT_ID 0x0f /* Feature Report */
31 #define RMI_READ_REQUEST_PENDING 0
32 #define RMI_READ_DATA_PENDING 1
36 #define RMI_DEVICE BIT(0)
37 #define RMI_DEVICE_HAS_PHYS_BUTTONS BIT(1)
38 #define RMI_DEVICE_OUTPUT_SET_REPORT BIT(2)
41 * retrieve the ctrl registers
42 * the ctrl register has a size of 20 but a fw bug split it into 16 + 4,
43 * and there is no way to know if the first 20 bytes are here or not.
44 * We use only the first 12 bytes, so get only them.
46 #define RMI_F11_CTRL_REG_COUNT 12
50 RMI_MODE_ATTN_REPORTS
= 1,
51 RMI_MODE_NO_PACKED_ATTN_REPORTS
= 2,
55 * struct rmi_data - stores information for hid communication
57 * @page_mutex: Locks current page to avoid changing pages in unexpected ways.
58 * @page: Keeps track of the current virtual page
59 * @xport: transport device to be registered with the RMI4 core.
61 * @wait: Used for waiting for read data
63 * @writeReport: output buffer when writing RMI registers
64 * @readReport: input buffer when reading RMI registers
66 * @input_report_size: size of an input report (advertised by HID)
67 * @output_report_size: size of an output report (advertised by HID)
69 * @flags: flags for the current device (started, reading, etc...)
71 * @reset_work: worker which will be called in case of a mouse report
72 * @hdev: pointer to the struct hid_device
74 * @device_flags: flags which describe the device
76 * @domain: the IRQ domain allocated for this RMI4 device
77 * @rmi_irq: the irq that will be used to generate events to rmi-core
80 struct mutex page_mutex
;
82 struct rmi_transport_dev xport
;
84 wait_queue_head_t wait
;
89 u32 input_report_size
;
90 u32 output_report_size
;
94 struct work_struct reset_work
;
95 struct hid_device
*hdev
;
97 unsigned long device_flags
;
99 struct irq_domain
*domain
;
103 #define RMI_PAGE(addr) (((addr) >> 8) & 0xff)
105 static int rmi_write_report(struct hid_device
*hdev
, u8
*report
, int len
);
108 * rmi_set_page - Set RMI page
109 * @hdev: The pointer to the hid_device struct
110 * @page: The new page address.
112 * RMI devices have 16-bit addressing, but some of the physical
113 * implementations (like SMBus) only have 8-bit addressing. So RMI implements
114 * a page address at 0xff of every page so we can reliable page addresses
115 * every 256 registers.
117 * The page_mutex lock must be held when this function is entered.
119 * Returns zero on success, non-zero on failure.
121 static int rmi_set_page(struct hid_device
*hdev
, u8 page
)
123 struct rmi_data
*data
= hid_get_drvdata(hdev
);
126 data
->writeReport
[0] = RMI_WRITE_REPORT_ID
;
127 data
->writeReport
[1] = 1;
128 data
->writeReport
[2] = 0xFF;
129 data
->writeReport
[4] = page
;
131 retval
= rmi_write_report(hdev
, data
->writeReport
,
132 data
->output_report_size
);
133 if (retval
!= data
->output_report_size
) {
135 "%s: set page failed: %d.", __func__
, retval
);
143 static int rmi_set_mode(struct hid_device
*hdev
, u8 mode
)
146 const u8 txbuf
[2] = {RMI_SET_RMI_MODE_REPORT_ID
, mode
};
149 buf
= kmemdup(txbuf
, sizeof(txbuf
), GFP_KERNEL
);
153 ret
= hid_hw_raw_request(hdev
, RMI_SET_RMI_MODE_REPORT_ID
, buf
,
154 sizeof(txbuf
), HID_FEATURE_REPORT
, HID_REQ_SET_REPORT
);
157 dev_err(&hdev
->dev
, "unable to set rmi mode to %d (%d)\n", mode
,
165 static int rmi_write_report(struct hid_device
*hdev
, u8
*report
, int len
)
167 struct rmi_data
*data
= hid_get_drvdata(hdev
);
170 if (data
->device_flags
& RMI_DEVICE_OUTPUT_SET_REPORT
) {
172 * Talk to device by using SET_REPORT requests instead.
174 ret
= hid_hw_raw_request(hdev
, report
[0], report
,
175 len
, HID_OUTPUT_REPORT
, HID_REQ_SET_REPORT
);
177 ret
= hid_hw_output_report(hdev
, (void *)report
, len
);
181 dev_err(&hdev
->dev
, "failed to write hid report (%d)\n", ret
);
188 static int rmi_hid_read_block(struct rmi_transport_dev
*xport
, u16 addr
,
189 void *buf
, size_t len
)
191 struct rmi_data
*data
= container_of(xport
, struct rmi_data
, xport
);
192 struct hid_device
*hdev
= data
->hdev
;
197 int read_input_count
;
199 mutex_lock(&data
->page_mutex
);
201 if (RMI_PAGE(addr
) != data
->page
) {
202 ret
= rmi_set_page(hdev
, RMI_PAGE(addr
));
207 for (retries
= 5; retries
> 0; retries
--) {
208 data
->writeReport
[0] = RMI_READ_ADDR_REPORT_ID
;
209 data
->writeReport
[1] = 0; /* old 1 byte read count */
210 data
->writeReport
[2] = addr
& 0xFF;
211 data
->writeReport
[3] = (addr
>> 8) & 0xFF;
212 data
->writeReport
[4] = len
& 0xFF;
213 data
->writeReport
[5] = (len
>> 8) & 0xFF;
215 set_bit(RMI_READ_REQUEST_PENDING
, &data
->flags
);
217 ret
= rmi_write_report(hdev
, data
->writeReport
,
218 data
->output_report_size
);
219 if (ret
!= data
->output_report_size
) {
220 clear_bit(RMI_READ_REQUEST_PENDING
, &data
->flags
);
222 "failed to write request output report (%d)\n",
229 while (bytes_read
< len
) {
230 if (!wait_event_timeout(data
->wait
,
231 test_bit(RMI_READ_DATA_PENDING
, &data
->flags
),
232 msecs_to_jiffies(1000))) {
233 hid_warn(hdev
, "%s: timeout elapsed\n",
239 read_input_count
= data
->readReport
[1];
240 memcpy(buf
+ bytes_read
, &data
->readReport
[2],
241 read_input_count
< bytes_needed
?
242 read_input_count
: bytes_needed
);
244 bytes_read
+= read_input_count
;
245 bytes_needed
-= read_input_count
;
246 clear_bit(RMI_READ_DATA_PENDING
, &data
->flags
);
256 clear_bit(RMI_READ_REQUEST_PENDING
, &data
->flags
);
257 mutex_unlock(&data
->page_mutex
);
261 static int rmi_hid_write_block(struct rmi_transport_dev
*xport
, u16 addr
,
262 const void *buf
, size_t len
)
264 struct rmi_data
*data
= container_of(xport
, struct rmi_data
, xport
);
265 struct hid_device
*hdev
= data
->hdev
;
268 mutex_lock(&data
->page_mutex
);
270 if (RMI_PAGE(addr
) != data
->page
) {
271 ret
= rmi_set_page(hdev
, RMI_PAGE(addr
));
276 data
->writeReport
[0] = RMI_WRITE_REPORT_ID
;
277 data
->writeReport
[1] = len
;
278 data
->writeReport
[2] = addr
& 0xFF;
279 data
->writeReport
[3] = (addr
>> 8) & 0xFF;
280 memcpy(&data
->writeReport
[4], buf
, len
);
282 ret
= rmi_write_report(hdev
, data
->writeReport
,
283 data
->output_report_size
);
286 "failed to write request output report (%d)\n",
293 mutex_unlock(&data
->page_mutex
);
297 static int rmi_reset_attn_mode(struct hid_device
*hdev
)
299 struct rmi_data
*data
= hid_get_drvdata(hdev
);
300 struct rmi_device
*rmi_dev
= data
->xport
.rmi_dev
;
303 ret
= rmi_set_mode(hdev
, RMI_MODE_ATTN_REPORTS
);
307 if (test_bit(RMI_STARTED
, &data
->flags
))
308 ret
= rmi_dev
->driver
->reset_handler(rmi_dev
);
313 static void rmi_reset_work(struct work_struct
*work
)
315 struct rmi_data
*hdata
= container_of(work
, struct rmi_data
,
318 /* switch the device to RMI if we receive a generic mouse report */
319 rmi_reset_attn_mode(hdata
->hdev
);
322 static int rmi_input_event(struct hid_device
*hdev
, u8
*data
, int size
)
324 struct rmi_data
*hdata
= hid_get_drvdata(hdev
);
325 struct rmi_device
*rmi_dev
= hdata
->xport
.rmi_dev
;
328 if (!(test_bit(RMI_STARTED
, &hdata
->flags
)))
331 local_irq_save(flags
);
333 rmi_set_attn_data(rmi_dev
, data
[1], &data
[2], size
- 2);
335 generic_handle_irq(hdata
->rmi_irq
);
337 local_irq_restore(flags
);
342 static int rmi_read_data_event(struct hid_device
*hdev
, u8
*data
, int size
)
344 struct rmi_data
*hdata
= hid_get_drvdata(hdev
);
346 if (!test_bit(RMI_READ_REQUEST_PENDING
, &hdata
->flags
)) {
347 hid_dbg(hdev
, "no read request pending\n");
351 memcpy(hdata
->readReport
, data
, size
< hdata
->input_report_size
?
352 size
: hdata
->input_report_size
);
353 set_bit(RMI_READ_DATA_PENDING
, &hdata
->flags
);
354 wake_up(&hdata
->wait
);
359 static int rmi_check_sanity(struct hid_device
*hdev
, u8
*data
, int size
)
361 int valid_size
= size
;
363 * On the Dell XPS 13 9333, the bus sometimes get confused and fills
364 * the report with a sentinel value "ff". Synaptics told us that such
365 * behavior does not comes from the touchpad itself, so we filter out
369 while ((data
[valid_size
- 1] == 0xff) && valid_size
> 0)
375 static int rmi_raw_event(struct hid_device
*hdev
,
376 struct hid_report
*report
, u8
*data
, int size
)
378 struct rmi_data
*hdata
= hid_get_drvdata(hdev
);
380 if (!(hdata
->device_flags
& RMI_DEVICE
))
383 size
= rmi_check_sanity(hdev
, data
, size
);
388 case RMI_READ_DATA_REPORT_ID
:
389 return rmi_read_data_event(hdev
, data
, size
);
390 case RMI_ATTN_REPORT_ID
:
391 return rmi_input_event(hdev
, data
, size
);
399 static int rmi_event(struct hid_device
*hdev
, struct hid_field
*field
,
400 struct hid_usage
*usage
, __s32 value
)
402 struct rmi_data
*data
= hid_get_drvdata(hdev
);
404 if ((data
->device_flags
& RMI_DEVICE
) &&
405 (field
->application
== HID_GD_POINTER
||
406 field
->application
== HID_GD_MOUSE
)) {
407 if (data
->device_flags
& RMI_DEVICE_HAS_PHYS_BUTTONS
) {
408 if ((usage
->hid
& HID_USAGE_PAGE
) == HID_UP_BUTTON
)
411 if ((usage
->hid
== HID_GD_X
|| usage
->hid
== HID_GD_Y
)
416 schedule_work(&data
->reset_work
);
423 static void rmi_report(struct hid_device
*hid
, struct hid_report
*report
)
425 struct hid_field
*field
= report
->field
[0];
427 if (!(hid
->claimed
& HID_CLAIMED_INPUT
))
430 switch (report
->id
) {
431 case RMI_READ_DATA_REPORT_ID
:
433 case RMI_ATTN_REPORT_ID
:
437 if (field
&& field
->hidinput
&& field
->hidinput
->input
)
438 input_sync(field
->hidinput
->input
);
442 static int rmi_suspend(struct hid_device
*hdev
, pm_message_t message
)
444 struct rmi_data
*data
= hid_get_drvdata(hdev
);
445 struct rmi_device
*rmi_dev
= data
->xport
.rmi_dev
;
448 if (!(data
->device_flags
& RMI_DEVICE
))
451 ret
= rmi_driver_suspend(rmi_dev
, false);
453 hid_warn(hdev
, "Failed to suspend device: %d\n", ret
);
460 static int rmi_post_resume(struct hid_device
*hdev
)
462 struct rmi_data
*data
= hid_get_drvdata(hdev
);
463 struct rmi_device
*rmi_dev
= data
->xport
.rmi_dev
;
466 if (!(data
->device_flags
& RMI_DEVICE
))
469 /* Make sure the HID device is ready to receive events */
470 ret
= hid_hw_open(hdev
);
474 ret
= rmi_reset_attn_mode(hdev
);
478 ret
= rmi_driver_resume(rmi_dev
, false);
480 hid_warn(hdev
, "Failed to resume device: %d\n", ret
);
488 #endif /* CONFIG_PM */
490 static int rmi_hid_reset(struct rmi_transport_dev
*xport
, u16 reset_addr
)
492 struct rmi_data
*data
= container_of(xport
, struct rmi_data
, xport
);
493 struct hid_device
*hdev
= data
->hdev
;
495 return rmi_reset_attn_mode(hdev
);
498 static int rmi_input_configured(struct hid_device
*hdev
, struct hid_input
*hi
)
500 struct rmi_data
*data
= hid_get_drvdata(hdev
);
501 struct input_dev
*input
= hi
->input
;
504 if (!(data
->device_flags
& RMI_DEVICE
))
507 data
->xport
.input
= input
;
509 hid_dbg(hdev
, "Opening low level driver\n");
510 ret
= hid_hw_open(hdev
);
514 /* Allow incoming hid reports */
515 hid_device_io_start(hdev
);
517 ret
= rmi_set_mode(hdev
, RMI_MODE_ATTN_REPORTS
);
519 dev_err(&hdev
->dev
, "failed to set rmi mode\n");
523 ret
= rmi_set_page(hdev
, 0);
525 dev_err(&hdev
->dev
, "failed to set page select to 0.\n");
529 ret
= rmi_register_transport_device(&data
->xport
);
531 dev_err(&hdev
->dev
, "failed to register transport driver\n");
535 set_bit(RMI_STARTED
, &data
->flags
);
538 hid_device_io_stop(hdev
);
543 static int rmi_input_mapping(struct hid_device
*hdev
,
544 struct hid_input
*hi
, struct hid_field
*field
,
545 struct hid_usage
*usage
, unsigned long **bit
, int *max
)
547 struct rmi_data
*data
= hid_get_drvdata(hdev
);
550 * we want to make HID ignore the advertised HID collection
553 if (data
->device_flags
& RMI_DEVICE
) {
554 if ((data
->device_flags
& RMI_DEVICE_HAS_PHYS_BUTTONS
) &&
555 ((usage
->hid
& HID_USAGE_PAGE
) == HID_UP_BUTTON
))
564 static int rmi_check_valid_report_id(struct hid_device
*hdev
, unsigned type
,
565 unsigned id
, struct hid_report
**report
)
569 *report
= hdev
->report_enum
[type
].report_id_hash
[id
];
571 for (i
= 0; i
< (*report
)->maxfield
; i
++) {
572 unsigned app
= (*report
)->field
[i
]->application
;
573 if ((app
& HID_USAGE_PAGE
) >= HID_UP_MSVENDOR
)
581 static struct rmi_device_platform_data rmi_hid_pdata
= {
583 .sensor_type
= rmi_sensor_touchpad
,
584 .axis_align
.flip_y
= true,
585 .dribble
= RMI_REG_STATE_ON
,
586 .palm_detect
= RMI_REG_STATE_OFF
,
590 static const struct rmi_transport_ops hid_rmi_ops
= {
591 .write_block
= rmi_hid_write_block
,
592 .read_block
= rmi_hid_read_block
,
593 .reset
= rmi_hid_reset
,
596 static void rmi_irq_teardown(void *data
)
598 struct rmi_data
*hdata
= data
;
599 struct irq_domain
*domain
= hdata
->domain
;
604 irq_dispose_mapping(irq_find_mapping(domain
, 0));
606 irq_domain_remove(domain
);
607 hdata
->domain
= NULL
;
611 static int rmi_irq_map(struct irq_domain
*h
, unsigned int virq
,
612 irq_hw_number_t hw_irq_num
)
614 irq_set_chip_and_handler(virq
, &dummy_irq_chip
, handle_simple_irq
);
619 static const struct irq_domain_ops rmi_irq_ops
= {
623 static int rmi_setup_irq_domain(struct hid_device
*hdev
)
625 struct rmi_data
*hdata
= hid_get_drvdata(hdev
);
628 hdata
->domain
= irq_domain_create_linear(hdev
->dev
.fwnode
, 1,
629 &rmi_irq_ops
, hdata
);
633 ret
= devm_add_action_or_reset(&hdev
->dev
, &rmi_irq_teardown
, hdata
);
637 hdata
->rmi_irq
= irq_create_mapping(hdata
->domain
, 0);
638 if (hdata
->rmi_irq
<= 0) {
639 hid_err(hdev
, "Can't allocate an IRQ\n");
640 return hdata
->rmi_irq
< 0 ? hdata
->rmi_irq
: -ENXIO
;
646 static int rmi_probe(struct hid_device
*hdev
, const struct hid_device_id
*id
)
648 struct rmi_data
*data
= NULL
;
651 struct hid_report
*input_report
;
652 struct hid_report
*output_report
;
653 struct hid_report
*feature_report
;
655 data
= devm_kzalloc(&hdev
->dev
, sizeof(struct rmi_data
), GFP_KERNEL
);
659 INIT_WORK(&data
->reset_work
, rmi_reset_work
);
662 hid_set_drvdata(hdev
, data
);
664 hdev
->quirks
|= HID_QUIRK_NO_INIT_REPORTS
;
665 hdev
->quirks
|= HID_QUIRK_NO_INPUT_SYNC
;
667 ret
= hid_parse(hdev
);
669 hid_err(hdev
, "parse failed\n");
674 data
->device_flags
= id
->driver_data
;
677 * Check for the RMI specific report ids. If they are misisng
678 * simply return and let the events be processed by hid-input
680 if (!rmi_check_valid_report_id(hdev
, HID_FEATURE_REPORT
,
681 RMI_SET_RMI_MODE_REPORT_ID
, &feature_report
)) {
682 hid_dbg(hdev
, "device does not have set mode feature report\n");
686 if (!rmi_check_valid_report_id(hdev
, HID_INPUT_REPORT
,
687 RMI_ATTN_REPORT_ID
, &input_report
)) {
688 hid_dbg(hdev
, "device does not have attention input report\n");
692 data
->input_report_size
= hid_report_len(input_report
);
694 if (!rmi_check_valid_report_id(hdev
, HID_OUTPUT_REPORT
,
695 RMI_WRITE_REPORT_ID
, &output_report
)) {
697 "device does not have rmi write output report\n");
701 data
->output_report_size
= hid_report_len(output_report
);
703 data
->device_flags
|= RMI_DEVICE
;
704 alloc_size
= data
->output_report_size
+ data
->input_report_size
;
706 data
->writeReport
= devm_kzalloc(&hdev
->dev
, alloc_size
, GFP_KERNEL
);
707 if (!data
->writeReport
) {
708 hid_err(hdev
, "failed to allocate buffer for HID reports\n");
712 data
->readReport
= data
->writeReport
+ data
->output_report_size
;
714 init_waitqueue_head(&data
->wait
);
716 mutex_init(&data
->page_mutex
);
718 ret
= rmi_setup_irq_domain(hdev
);
720 hid_err(hdev
, "failed to allocate IRQ domain\n");
724 if (data
->device_flags
& RMI_DEVICE_HAS_PHYS_BUTTONS
)
725 rmi_hid_pdata
.f30_data
.disable
= true;
727 data
->xport
.dev
= hdev
->dev
.parent
;
728 data
->xport
.pdata
= rmi_hid_pdata
;
729 data
->xport
.pdata
.irq
= data
->rmi_irq
;
730 data
->xport
.proto_name
= "hid";
731 data
->xport
.ops
= &hid_rmi_ops
;
734 ret
= hid_hw_start(hdev
, HID_CONNECT_DEFAULT
);
736 hid_err(hdev
, "hw start failed\n");
743 static void rmi_remove(struct hid_device
*hdev
)
745 struct rmi_data
*hdata
= hid_get_drvdata(hdev
);
747 if ((hdata
->device_flags
& RMI_DEVICE
)
748 && test_bit(RMI_STARTED
, &hdata
->flags
)) {
749 clear_bit(RMI_STARTED
, &hdata
->flags
);
750 cancel_work_sync(&hdata
->reset_work
);
751 rmi_unregister_transport_device(&hdata
->xport
);
757 static const struct hid_device_id rmi_id
[] = {
758 { HID_USB_DEVICE(USB_VENDOR_ID_RAZER
, USB_DEVICE_ID_RAZER_BLADE_14
),
759 .driver_data
= RMI_DEVICE_HAS_PHYS_BUTTONS
},
760 { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO
, USB_DEVICE_ID_LENOVO_X1_COVER
) },
761 { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX
, USB_DEVICE_ID_PRIMAX_REZEL
) },
762 { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS
, USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5
),
763 .driver_data
= RMI_DEVICE_OUTPUT_SET_REPORT
},
764 { HID_DEVICE(HID_BUS_ANY
, HID_GROUP_RMI
, HID_ANY_ID
, HID_ANY_ID
) },
767 MODULE_DEVICE_TABLE(hid
, rmi_id
);
769 static struct hid_driver rmi_driver
= {
773 .remove
= rmi_remove
,
775 .raw_event
= rmi_raw_event
,
776 .report
= rmi_report
,
777 .input_mapping
= rmi_input_mapping
,
778 .input_configured
= rmi_input_configured
,
780 .suspend
= rmi_suspend
,
781 .resume
= rmi_post_resume
,
782 .reset_resume
= rmi_post_resume
,
786 module_hid_driver(rmi_driver
);
788 MODULE_AUTHOR("Andrew Duggan <aduggan@synaptics.com>");
789 MODULE_DESCRIPTION("RMI HID driver");
790 MODULE_LICENSE("GPL");