projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Input: synaptics-rmi4 - fix possible double free
[linux-2.6-block.git] / drivers / input / rmi4 / rmi_driver.c
CommitLineData
2b6a321d
AD		 1/*
2 * Copyright (c) 2011-2016 Synaptics Incorporated
3 * Copyright (c) 2011 Unixphere
4 *
5 * This driver provides the core support for a single RMI4-based device.
6 *
7 * The RMI4 specification can be found here (URL split for line length):
8 *
9 * http://www.synaptics.com/sites/default/files/
10 * 511-000136-01-Rev-E-RMI4-Interfacing-Guide.pdf
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License version 2 as published by
14 * the Free Software Foundation.
15 */
16
17#include <linux/bitmap.h>
18#include <linux/delay.h>
19#include <linux/fs.h>
3aeed5b5 20#include <linux/irq.h>
2b6a321d
AD		 21#include <linux/pm.h>
22#include <linux/slab.h>
d8a8b3ed 23#include <linux/of.h>
24d28e4f 24#include <linux/irqdomain.h>
2b6a321d
AD		 25#include <uapi/linux/input.h>
26#include <linux/rmi.h>
27#include "rmi_bus.h"
28#include "rmi_driver.h"
29
30#define HAS_NONSTANDARD_PDT_MASK 0x40
31#define RMI4_MAX_PAGE 0xff
32#define RMI4_PAGE_SIZE 0x100
33#define RMI4_PAGE_MASK 0xFF00
34
35#define RMI_DEVICE_RESET_CMD 0x01
36#define DEFAULT_RESET_DELAY_MS 100
37
29fd0ec2 38void rmi_free_function_list(struct rmi_device *rmi_dev)
2b6a321d
AD		 39{
40 struct rmi_function *fn, *tmp;
41 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
42
6bd0dcfa
ND		 43 rmi_dbg(RMI_DEBUG_CORE, &rmi_dev->dev, "Freeing function list\n");
44
a1ab6902
DT		 45 /* Doing it in the reverse order so F01 will be removed last */
46 list_for_each_entry_safe_reverse(fn, tmp,
47 &data->function_list, node) {
48 list_del(&fn->node);
49 rmi_unregister_function(fn);
50 }
51
29fd0ec2
ND		 52 devm_kfree(&rmi_dev->dev, data->irq_memory);
53 data->irq_memory = NULL;
54 data->irq_status = NULL;
55 data->fn_irq_bits = NULL;
56 data->current_irq_mask = NULL;
57 data->new_irq_mask = NULL;
58
2b6a321d 59 data->f01_container = NULL;
29fd0ec2 60 data->f34_container = NULL;
2b6a321d
AD		 61}
62
63static int reset_one_function(struct rmi_function *fn)
64{
65 struct rmi_function_handler *fh;
66 int retval = 0;
67
68 if (!fn || !fn->dev.driver)
69 return 0;
70
71 fh = to_rmi_function_handler(fn->dev.driver);
72 if (fh->reset) {
73 retval = fh->reset(fn);
74 if (retval < 0)
75 dev_err(&fn->dev, "Reset failed with code %d.\n",
76 retval);
77 }
78
79 return retval;
80}
81
82static int configure_one_function(struct rmi_function *fn)
83{
84 struct rmi_function_handler *fh;
85 int retval = 0;
86
87 if (!fn || !fn->dev.driver)
88 return 0;
89
90 fh = to_rmi_function_handler(fn->dev.driver);
91 if (fh->config) {
92 retval = fh->config(fn);
93 if (retval < 0)
94 dev_err(&fn->dev, "Config failed with code %d.\n",
95 retval);
96 }
97
98 return retval;
99}
100
101static int rmi_driver_process_reset_requests(struct rmi_device *rmi_dev)
102{
103 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
104 struct rmi_function *entry;
105 int retval;
106
107 list_for_each_entry(entry, &data->function_list, node) {
108 retval = reset_one_function(entry);
109 if (retval < 0)
110 return retval;
111 }
112
113 return 0;
114}
115
116static int rmi_driver_process_config_requests(struct rmi_device *rmi_dev)
117{
118 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
119 struct rmi_function *entry;
120 int retval;
121
122 list_for_each_entry(entry, &data->function_list, node) {
123 retval = configure_one_function(entry);
124 if (retval < 0)
125 return retval;
126 }
127
128 return 0;
129}
130
3aeed5b5 131static int rmi_process_interrupt_requests(struct rmi_device *rmi_dev)
2b6a321d
AD		 132{
133 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
134 struct device *dev = &rmi_dev->dev;
24d28e4f 135 int i;
2b6a321d
AD		 136 int error;
137
138 if (!data)
139 return 0;
140
ae9979c3 141 if (!data->attn_data.data) {
2b6a321d
AD		 142 error = rmi_read_block(rmi_dev,
143 data->f01_container->fd.data_base_addr + 1,
144 data->irq_status, data->num_of_irq_regs);
145 if (error < 0) {
146 dev_err(dev, "Failed to read irqs, code=%d\n", error);
147 return error;
148 }
149 }
150
151 mutex_lock(&data->irq_mutex);
152 bitmap_and(data->irq_status, data->irq_status, data->current_irq_mask,
153 data->irq_count);
154 /*
155 * At this point, irq_status has all bits that are set in the
156 * interrupt status register and are enabled.
157 */
158 mutex_unlock(&data->irq_mutex);
159
24d28e4f
ND		 160 for_each_set_bit(i, data->irq_status, data->irq_count)
161 handle_nested_irq(irq_find_mapping(data->irqdomain, i));
2b6a321d
AD		 162
163 if (data->input)
164 input_sync(data->input);
165
166 return 0;
167}
3aeed5b5 168
b908d3cd
BT		 169void rmi_set_attn_data(struct rmi_device *rmi_dev, unsigned long irq_status,
170 void *data, size_t size)
171{
172 struct rmi_driver_data *drvdata = dev_get_drvdata(&rmi_dev->dev);
173 struct rmi4_attn_data attn_data;
174 void *fifo_data;
175
176 if (!drvdata->enabled)
177 return;
178
179 fifo_data = kmemdup(data, size, GFP_ATOMIC);
180 if (!fifo_data)
181 return;
182
183 attn_data.irq_status = irq_status;
184 attn_data.size = size;
185 attn_data.data = fifo_data;
186
187 kfifo_put(&drvdata->attn_fifo, attn_data);
188}
189EXPORT_SYMBOL_GPL(rmi_set_attn_data);
190
3aeed5b5
BA		 191static irqreturn_t rmi_irq_fn(int irq, void *dev_id)
192{
193 struct rmi_device *rmi_dev = dev_id;
b908d3cd
BT		 194 struct rmi_driver_data *drvdata = dev_get_drvdata(&rmi_dev->dev);
195 struct rmi4_attn_data attn_data = {0};
196 int ret, count;
197
198 count = kfifo_get(&drvdata->attn_fifo, &attn_data);
199 if (count) {
200 *(drvdata->irq_status) = attn_data.irq_status;
ae9979c3 201 drvdata->attn_data = attn_data;
b908d3cd 202 }
3aeed5b5
BA		 203
204 ret = rmi_process_interrupt_requests(rmi_dev);
205 if (ret)
206 rmi_dbg(RMI_DEBUG_CORE, &rmi_dev->dev,
207 "Failed to process interrupt request: %d\n", ret);
208
55edde9f 209 if (count) {
b908d3cd 210 kfree(attn_data.data);
55edde9f
ND		 211 attn_data.data = NULL;
212 }
b908d3cd
BT		 213
214 if (!kfifo_is_empty(&drvdata->attn_fifo))
215 return rmi_irq_fn(irq, dev_id);
216
3aeed5b5
BA		 217 return IRQ_HANDLED;
218}
219
220static int rmi_irq_init(struct rmi_device *rmi_dev)
221{
222 struct rmi_device_platform_data *pdata = rmi_get_platform_data(rmi_dev);
a64ea311 223 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
3aeed5b5
BA		 224 int irq_flags = irq_get_trigger_type(pdata->irq);
225 int ret;
226
227 if (!irq_flags)
228 irq_flags = IRQF_TRIGGER_LOW;
229
230 ret = devm_request_threaded_irq(&rmi_dev->dev, pdata->irq, NULL,
231 rmi_irq_fn, irq_flags | IRQF_ONESHOT,
72fe3870 232 dev_driver_string(rmi_dev->xport->dev),
3aeed5b5
BA		 233 rmi_dev);
234 if (ret < 0) {
235 dev_err(&rmi_dev->dev, "Failed to register interrupt %d\n",
236 pdata->irq);
237
238 return ret;
239 }
240
a64ea311
BT		 241 data->enabled = true;
242
3aeed5b5
BA		 243 return 0;
244}
2b6a321d 245
f32361b7
BT		 246struct rmi_function *rmi_find_function(struct rmi_device *rmi_dev, u8 number)
247{
248 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
249 struct rmi_function *entry;
250
251 list_for_each_entry(entry, &data->function_list, node) {
252 if (entry->fd.function_number == number)
253 return entry;
254 }
255
256 return NULL;
257}
258
2b6a321d
AD		 259static int suspend_one_function(struct rmi_function *fn)
260{
261 struct rmi_function_handler *fh;
262 int retval = 0;
263
264 if (!fn || !fn->dev.driver)
265 return 0;
266
267 fh = to_rmi_function_handler(fn->dev.driver);
268 if (fh->suspend) {
269 retval = fh->suspend(fn);
270 if (retval < 0)
271 dev_err(&fn->dev, "Suspend failed with code %d.\n",
272 retval);
273 }
274
275 return retval;
276}
277
278static int rmi_suspend_functions(struct rmi_device *rmi_dev)
279{
280 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
281 struct rmi_function *entry;
282 int retval;
283
284 list_for_each_entry(entry, &data->function_list, node) {
285 retval = suspend_one_function(entry);
286 if (retval < 0)
287 return retval;
288 }
289
290 return 0;
291}
292
293static int resume_one_function(struct rmi_function *fn)
294{
295 struct rmi_function_handler *fh;
296 int retval = 0;
297
298 if (!fn || !fn->dev.driver)
299 return 0;
300
301 fh = to_rmi_function_handler(fn->dev.driver);
302 if (fh->resume) {
303 retval = fh->resume(fn);
304 if (retval < 0)
305 dev_err(&fn->dev, "Resume failed with code %d.\n",
306 retval);
307 }
308
309 return retval;
310}
311
312static int rmi_resume_functions(struct rmi_device *rmi_dev)
313{
314 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
315 struct rmi_function *entry;
316 int retval;
317
318 list_for_each_entry(entry, &data->function_list, node) {
319 retval = resume_one_function(entry);
320 if (retval < 0)
321 return retval;
322 }
323
324 return 0;
325}
326
29fd0ec2 327int rmi_enable_sensor(struct rmi_device *rmi_dev)
2b6a321d
AD		 328{
329 int retval = 0;
330
331 retval = rmi_driver_process_config_requests(rmi_dev);
332 if (retval < 0)
333 return retval;
334
335 return rmi_process_interrupt_requests(rmi_dev);
336}
337
338/**
339 * rmi_driver_set_input_params - set input device id and other data.
340 *
341 * @rmi_dev: Pointer to an RMI device
342 * @input: Pointer to input device
343 *
344 */
345static int rmi_driver_set_input_params(struct rmi_device *rmi_dev,
346 struct input_dev *input)
347{
348 input->name = SYNAPTICS_INPUT_DEVICE_NAME;
349 input->id.vendor = SYNAPTICS_VENDOR_ID;
350 input->id.bustype = BUS_RMI;
351 return 0;
352}
353
354static void rmi_driver_set_input_name(struct rmi_device *rmi_dev,
355 struct input_dev *input)
356{
357 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
ce363f0d 358 const char *device_name = rmi_f01_get_product_ID(data->f01_container);
2b6a321d
AD		 359 char *name;
360
361 name = devm_kasprintf(&rmi_dev->dev, GFP_KERNEL,
362 "Synaptics %s", device_name);
363 if (!name)
364 return;
365
366 input->name = name;
367}
368
369static int rmi_driver_set_irq_bits(struct rmi_device *rmi_dev,
370 unsigned long *mask)
371{
372 int error = 0;
373 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
374 struct device *dev = &rmi_dev->dev;
375
376 mutex_lock(&data->irq_mutex);
377 bitmap_or(data->new_irq_mask,
378 data->current_irq_mask, mask, data->irq_count);
379
380 error = rmi_write_block(rmi_dev,
381 data->f01_container->fd.control_base_addr + 1,
382 data->new_irq_mask, data->num_of_irq_regs);
383 if (error < 0) {
384 dev_err(dev, "%s: Failed to change enabled interrupts!",
385 __func__);
386 goto error_unlock;
387 }
388 bitmap_copy(data->current_irq_mask, data->new_irq_mask,
389 data->num_of_irq_regs);
390
391error_unlock:
392 mutex_unlock(&data->irq_mutex);
393 return error;
394}
395
396static int rmi_driver_clear_irq_bits(struct rmi_device *rmi_dev,
397 unsigned long *mask)
398{
399 int error = 0;
400 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
401 struct device *dev = &rmi_dev->dev;
402
403 mutex_lock(&data->irq_mutex);
404 bitmap_andnot(data->new_irq_mask,
405 data->current_irq_mask, mask, data->irq_count);
406
407 error = rmi_write_block(rmi_dev,
408 data->f01_container->fd.control_base_addr + 1,
409 data->new_irq_mask, data->num_of_irq_regs);
410 if (error < 0) {
411 dev_err(dev, "%s: Failed to change enabled interrupts!",
412 __func__);
413 goto error_unlock;
414 }
415 bitmap_copy(data->current_irq_mask, data->new_irq_mask,
416 data->num_of_irq_regs);
417
418error_unlock:
419 mutex_unlock(&data->irq_mutex);
420 return error;
421}
422
423static int rmi_driver_reset_handler(struct rmi_device *rmi_dev)
424{
425 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
426 int error;
427
428 /*
429 * Can get called before the driver is fully ready to deal with
430 * this situation.
431 */
432 if (!data || !data->f01_container) {
433 dev_warn(&rmi_dev->dev,
434 "Not ready to handle reset yet!\n");
435 return 0;
436 }
437
438 error = rmi_read_block(rmi_dev,
439 data->f01_container->fd.control_base_addr + 1,
440 data->current_irq_mask, data->num_of_irq_regs);
441 if (error < 0) {
442 dev_err(&rmi_dev->dev, "%s: Failed to read current IRQ mask.\n",
443 __func__);
444 return error;
445 }
446
447 error = rmi_driver_process_reset_requests(rmi_dev);
448 if (error < 0)
449 return error;
450
451 error = rmi_driver_process_config_requests(rmi_dev);
452 if (error < 0)
453 return error;
454
455 return 0;
456}
457
e9dade41
BT		 458static int rmi_read_pdt_entry(struct rmi_device *rmi_dev,
459 struct pdt_entry *entry, u16 pdt_address)
2b6a321d
AD		 460{
461 u8 buf[RMI_PDT_ENTRY_SIZE];
462 int error;
463
464 error = rmi_read_block(rmi_dev, pdt_address, buf, RMI_PDT_ENTRY_SIZE);
465 if (error) {
466 dev_err(&rmi_dev->dev, "Read PDT entry at %#06x failed, code: %d.\n",
467 pdt_address, error);
468 return error;
469 }
470
471 entry->page_start = pdt_address & RMI4_PAGE_MASK;
472 entry->query_base_addr = buf[0];
473 entry->command_base_addr = buf[1];
474 entry->control_base_addr = buf[2];
475 entry->data_base_addr = buf[3];
476 entry->interrupt_source_count = buf[4] & RMI_PDT_INT_SOURCE_COUNT_MASK;
477 entry->function_version = (buf[4] & RMI_PDT_FUNCTION_VERSION_MASK) >> 5;
478 entry->function_number = buf[5];
479
480 return 0;
481}
2b6a321d
AD		 482
483static void rmi_driver_copy_pdt_to_fd(const struct pdt_entry *pdt,
484 struct rmi_function_descriptor *fd)
485{
486 fd->query_base_addr = pdt->query_base_addr + pdt->page_start;
487 fd->command_base_addr = pdt->command_base_addr + pdt->page_start;
488 fd->control_base_addr = pdt->control_base_addr + pdt->page_start;
489 fd->data_base_addr = pdt->data_base_addr + pdt->page_start;
490 fd->function_number = pdt->function_number;
491 fd->interrupt_source_count = pdt->interrupt_source_count;
492 fd->function_version = pdt->function_version;
493}
494
495#define RMI_SCAN_CONTINUE 0
496#define RMI_SCAN_DONE 1
497
498static int rmi_scan_pdt_page(struct rmi_device *rmi_dev,
499 int page,
ad338e8b 500 int *empty_pages,
2b6a321d
AD		 501 void *ctx,
502 int (*callback)(struct rmi_device *rmi_dev,
503 void *ctx,
504 const struct pdt_entry *entry))
505{
506 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
507 struct pdt_entry pdt_entry;
508 u16 page_start = RMI4_PAGE_SIZE * page;
509 u16 pdt_start = page_start + PDT_START_SCAN_LOCATION;
510 u16 pdt_end = page_start + PDT_END_SCAN_LOCATION;
511 u16 addr;
512 int error;
513 int retval;
514
515 for (addr = pdt_start; addr >= pdt_end; addr -= RMI_PDT_ENTRY_SIZE) {
516 error = rmi_read_pdt_entry(rmi_dev, &pdt_entry, addr);
517 if (error)
518 return error;
519
520 if (RMI4_END_OF_PDT(pdt_entry.function_number))
521 break;
522
523 retval = callback(rmi_dev, ctx, &pdt_entry);
524 if (retval != RMI_SCAN_CONTINUE)
525 return retval;
526 }
527
ad338e8b
ND		 528 /*
529 * Count number of empty PDT pages. If a gap of two pages
530 * or more is found, stop scanning.
531 */
532 if (addr == pdt_start)
533 ++*empty_pages;
534 else
535 *empty_pages = 0;
536
5191d88a 537 return (data->bootloader_mode || *empty_pages >= 2) ?
2b6a321d
AD		 538 RMI_SCAN_DONE : RMI_SCAN_CONTINUE;
539}
540
29fd0ec2
ND		 541int rmi_scan_pdt(struct rmi_device *rmi_dev, void *ctx,
542 int (*callback)(struct rmi_device *rmi_dev,
543 void *ctx, const struct pdt_entry *entry))
2b6a321d
AD		 544{
545 int page;
ad338e8b 546 int empty_pages = 0;
2b6a321d
AD		 547 int retval = RMI_SCAN_DONE;
548
549 for (page = 0; page <= RMI4_MAX_PAGE; page++) {
ad338e8b
ND		 550 retval = rmi_scan_pdt_page(rmi_dev, page, &empty_pages,
551 ctx, callback);
2b6a321d
AD		 552 if (retval != RMI_SCAN_CONTINUE)
553 break;
554 }
555
556 return retval < 0 ? retval : 0;
557}
558
559int rmi_read_register_desc(struct rmi_device *d, u16 addr,
560 struct rmi_register_descriptor *rdesc)
561{
562 int ret;
563 u8 size_presence_reg;
564 u8 buf[35];
565 int presense_offset = 1;
566 u8 *struct_buf;
567 int reg;
568 int offset = 0;
569 int map_offset = 0;
570 int i;
571 int b;
572
573 /*
574 * The first register of the register descriptor is the size of
575 * the register descriptor's presense register.
576 */
577 ret = rmi_read(d, addr, &size_presence_reg);
578 if (ret)
579 return ret;
580 ++addr;
581
582 if (size_presence_reg < 0 || size_presence_reg > 35)
583 return -EIO;
584
585 memset(buf, 0, sizeof(buf));
586
587 /*
588 * The presence register contains the size of the register structure
589 * and a bitmap which identified which packet registers are present
590 * for this particular register type (ie query, control, or data).
591 */
592 ret = rmi_read_block(d, addr, buf, size_presence_reg);
593 if (ret)
594 return ret;
595 ++addr;
596
597 if (buf[0] == 0) {
598 presense_offset = 3;
599 rdesc->struct_size = buf[1] | (buf[2] << 8);
600 } else {
601 rdesc->struct_size = buf[0];
602 }
603
604 for (i = presense_offset; i < size_presence_reg; i++) {
605 for (b = 0; b < 8; b++) {
606 if (buf[i] & (0x1 << b))
607 bitmap_set(rdesc->presense_map, map_offset, 1);
608 ++map_offset;
609 }
610 }
611
612 rdesc->num_registers = bitmap_weight(rdesc->presense_map,
613 RMI_REG_DESC_PRESENSE_BITS);
614
a86854d0
KC		 615 rdesc->registers = devm_kcalloc(&d->dev,
616 rdesc->num_registers,
617 sizeof(struct rmi_register_desc_item),
618 GFP_KERNEL);
2b6a321d
AD		 619 if (!rdesc->registers)
620 return -ENOMEM;
621
622 /*
623 * Allocate a temporary buffer to hold the register structure.
624 * I'm not using devm_kzalloc here since it will not be retained
625 * after exiting this function
626 */
627 struct_buf = kzalloc(rdesc->struct_size, GFP_KERNEL);
628 if (!struct_buf)
629 return -ENOMEM;
630
631 /*
632 * The register structure contains information about every packet
633 * register of this type. This includes the size of the packet
634 * register and a bitmap of all subpackets contained in the packet
635 * register.
636 */
637 ret = rmi_read_block(d, addr, struct_buf, rdesc->struct_size);
638 if (ret)
639 goto free_struct_buff;
640
641 reg = find_first_bit(rdesc->presense_map, RMI_REG_DESC_PRESENSE_BITS);
2b6a321d
AD		 642 for (i = 0; i < rdesc->num_registers; i++) {
643 struct rmi_register_desc_item *item = &rdesc->registers[i];
644 int reg_size = struct_buf[offset];
645
646 ++offset;
647 if (reg_size == 0) {
648 reg_size = struct_buf[offset] |
649 (struct_buf[offset + 1] << 8);
650 offset += 2;
651 }
652
653 if (reg_size == 0) {
654 reg_size = struct_buf[offset] |
655 (struct_buf[offset + 1] << 8) |
656 (struct_buf[offset + 2] << 16) |
657 (struct_buf[offset + 3] << 24);
658 offset += 4;
659 }
660
661 item->reg = reg;
662 item->reg_size = reg_size;
663
3e29d6bb
AD		 664 map_offset = 0;
665
2b6a321d
AD		 666 do {
667 for (b = 0; b < 7; b++) {
668 if (struct_buf[offset] & (0x1 << b))
669 bitmap_set(item->subpacket_map,
670 map_offset, 1);
671 ++map_offset;
672 }
673 } while (struct_buf[offset++] & 0x80);
674
675 item->num_subpackets = bitmap_weight(item->subpacket_map,
676 RMI_REG_DESC_SUBPACKET_BITS);
677
678 rmi_dbg(RMI_DEBUG_CORE, &d->dev,
679 "%s: reg: %d reg size: %ld subpackets: %d\n", __func__,
680 item->reg, item->reg_size, item->num_subpackets);
681
682 reg = find_next_bit(rdesc->presense_map,
683 RMI_REG_DESC_PRESENSE_BITS, reg + 1);
684 }
685
686free_struct_buff:
687 kfree(struct_buf);
688 return ret;
689}
2b6a321d
AD		 690
691const struct rmi_register_desc_item *rmi_get_register_desc_item(
692 struct rmi_register_descriptor *rdesc, u16 reg)
693{
694 const struct rmi_register_desc_item *item;
695 int i;
696
697 for (i = 0; i < rdesc->num_registers; i++) {
698 item = &rdesc->registers[i];
699 if (item->reg == reg)
700 return item;
701 }
702
703 return NULL;
704}
2b6a321d
AD		 705
706size_t rmi_register_desc_calc_size(struct rmi_register_descriptor *rdesc)
707{
708 const struct rmi_register_desc_item *item;
709 int i;
710 size_t size = 0;
711
712 for (i = 0; i < rdesc->num_registers; i++) {
713 item = &rdesc->registers[i];
714 size += item->reg_size;
715 }
716 return size;
717}
2b6a321d
AD		 718
719/* Compute the register offset relative to the base address */
720int rmi_register_desc_calc_reg_offset(
721 struct rmi_register_descriptor *rdesc, u16 reg)
722{
723 const struct rmi_register_desc_item *item;
724 int offset = 0;
725 int i;
726
727 for (i = 0; i < rdesc->num_registers; i++) {
728 item = &rdesc->registers[i];
729 if (item->reg == reg)
730 return offset;
731 ++offset;
732 }
733 return -1;
734}
2b6a321d
AD		 735
736bool rmi_register_desc_has_subpacket(const struct rmi_register_desc_item *item,
737 u8 subpacket)
738{
739 return find_next_bit(item->subpacket_map, RMI_REG_DESC_PRESENSE_BITS,
740 subpacket) == subpacket;
741}
742
2b6a321d
AD		 743static int rmi_check_bootloader_mode(struct rmi_device *rmi_dev,
744 const struct pdt_entry *pdt)
745{
5191d88a
ND		 746 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
747 int ret;
748 u8 status;
2b6a321d 749
5191d88a
ND		 750 if (pdt->function_number == 0x34 && pdt->function_version > 1) {
751 ret = rmi_read(rmi_dev, pdt->data_base_addr, &status);
752 if (ret) {
753 dev_err(&rmi_dev->dev,
754 "Failed to read F34 status: %d.\n", ret);
755 return ret;
756 }
757
758 if (status & BIT(7))
759 data->bootloader_mode = true;
760 } else if (pdt->function_number == 0x01) {
761 ret = rmi_read(rmi_dev, pdt->data_base_addr, &status);
762 if (ret) {
763 dev_err(&rmi_dev->dev,
764 "Failed to read F01 status: %d.\n", ret);
765 return ret;
766 }
767
768 if (status & BIT(6))
769 data->bootloader_mode = true;
2b6a321d
AD		 770 }
771
5191d88a 772 return 0;
2b6a321d
AD		 773}
774
775static int rmi_count_irqs(struct rmi_device *rmi_dev,
776 void *ctx, const struct pdt_entry *pdt)
777{
2b6a321d 778 int *irq_count = ctx;
5191d88a 779 int ret;
2b6a321d
AD		 780
781 *irq_count += pdt->interrupt_source_count;
5191d88a
ND		 782
783 ret = rmi_check_bootloader_mode(rmi_dev, pdt);
784 if (ret < 0)
785 return ret;
2b6a321d
AD		 786
787 return RMI_SCAN_CONTINUE;
788}
789
29fd0ec2
ND		 790int rmi_initial_reset(struct rmi_device *rmi_dev, void *ctx,
791 const struct pdt_entry *pdt)
2b6a321d
AD		 792{
793 int error;
794
795 if (pdt->function_number == 0x01) {
796 u16 cmd_addr = pdt->page_start + pdt->command_base_addr;
797 u8 cmd_buf = RMI_DEVICE_RESET_CMD;
798 const struct rmi_device_platform_data *pdata =
799 rmi_get_platform_data(rmi_dev);
800
801 if (rmi_dev->xport->ops->reset) {
802 error = rmi_dev->xport->ops->reset(rmi_dev->xport,
803 cmd_addr);
804 if (error)
805 return error;
806
807 return RMI_SCAN_DONE;
808 }
809
8029a283 810 rmi_dbg(RMI_DEBUG_CORE, &rmi_dev->dev, "Sending reset\n");
2b6a321d
AD		 811 error = rmi_write_block(rmi_dev, cmd_addr, &cmd_buf, 1);
812 if (error) {
813 dev_err(&rmi_dev->dev,
814 "Initial reset failed. Code = %d.\n", error);
815 return error;
816 }
817
818 mdelay(pdata->reset_delay_ms ?: DEFAULT_RESET_DELAY_MS);
819
820 return RMI_SCAN_DONE;
821 }
822
823 /* F01 should always be on page 0. If we don't find it there, fail. */
824 return pdt->page_start == 0 ? RMI_SCAN_CONTINUE : -ENODEV;
825}
826
827static int rmi_create_function(struct rmi_device *rmi_dev,
828 void *ctx, const struct pdt_entry *pdt)
829{
830 struct device *dev = &rmi_dev->dev;
ed77bdf4 831 struct rmi_driver_data *data = dev_get_drvdata(dev);
2b6a321d
AD		 832 int *current_irq_count = ctx;
833 struct rmi_function *fn;
834 int i;
835 int error;
836
837 rmi_dbg(RMI_DEBUG_CORE, dev, "Initializing F%02X.\n",
838 pdt->function_number);
839
840 fn = kzalloc(sizeof(struct rmi_function) +
841 BITS_TO_LONGS(data->irq_count) * sizeof(unsigned long),
842 GFP_KERNEL);
843 if (!fn) {
844 dev_err(dev, "Failed to allocate memory for F%02X\n",
845 pdt->function_number);
846 return -ENOMEM;
847 }
848
849 INIT_LIST_HEAD(&fn->node);
850 rmi_driver_copy_pdt_to_fd(pdt, &fn->fd);
851
852 fn->rmi_dev = rmi_dev;
853
854 fn->num_of_irqs = pdt->interrupt_source_count;
855 fn->irq_pos = *current_irq_count;
856 *current_irq_count += fn->num_of_irqs;
857
858 for (i = 0; i < fn->num_of_irqs; i++)
859 set_bit(fn->irq_pos + i, fn->irq_mask);
860
861 error = rmi_register_function(fn);
862 if (error)
bce1a784 863 return error;
2b6a321d
AD		 864
865 if (pdt->function_number == 0x01)
866 data->f01_container = fn;
29fd0ec2
ND		 867 else if (pdt->function_number == 0x34)
868 data->f34_container = fn;
2b6a321d
AD		 869
870 list_add_tail(&fn->node, &data->function_list);
871
872 return RMI_SCAN_CONTINUE;
2b6a321d
AD		 873}
874
a64ea311 875void rmi_enable_irq(struct rmi_device *rmi_dev, bool clear_wake)
2b6a321d 876{
3aeed5b5 877 struct rmi_device_platform_data *pdata = rmi_get_platform_data(rmi_dev);
a64ea311 878 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
3aeed5b5 879 int irq = pdata->irq;
a64ea311
BT		 880 int irq_flags;
881 int retval;
2b6a321d 882
a64ea311
BT		 883 mutex_lock(&data->enabled_mutex);
884
885 if (data->enabled)
886 goto out;
887
888 enable_irq(irq);
889 data->enabled = true;
890 if (clear_wake && device_may_wakeup(rmi_dev->xport->dev)) {
891 retval = disable_irq_wake(irq);
05e0be7c 892 if (retval)
a64ea311
BT		 893 dev_warn(&rmi_dev->dev,
894 "Failed to disable irq for wake: %d\n",
895 retval);
896 }
897
898 /*
899 * Call rmi_process_interrupt_requests() after enabling irq,
900 * otherwise we may lose interrupt on edge-triggered systems.
901 */
902 irq_flags = irq_get_trigger_type(pdata->irq);
903 if (irq_flags & IRQ_TYPE_EDGE_BOTH)
904 rmi_process_interrupt_requests(rmi_dev);
905
906out:
907 mutex_unlock(&data->enabled_mutex);
908}
909
910void rmi_disable_irq(struct rmi_device *rmi_dev, bool enable_wake)
911{
912 struct rmi_device_platform_data *pdata = rmi_get_platform_data(rmi_dev);
913 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
b908d3cd 914 struct rmi4_attn_data attn_data = {0};
a64ea311 915 int irq = pdata->irq;
b908d3cd 916 int retval, count;
a64ea311
BT		 917
918 mutex_lock(&data->enabled_mutex);
919
920 if (!data->enabled)
921 goto out;
2b6a321d 922
a64ea311 923 data->enabled = false;
3aeed5b5
BA		 924 disable_irq(irq);
925 if (enable_wake && device_may_wakeup(rmi_dev->xport->dev)) {
926 retval = enable_irq_wake(irq);
05e0be7c 927 if (retval)
3aeed5b5
BA		 928 dev_warn(&rmi_dev->dev,
929 "Failed to enable irq for wake: %d\n",
930 retval);
931 }
a64ea311 932
b908d3cd
BT		 933 /* make sure the fifo is clean */
934 while (!kfifo_is_empty(&data->attn_fifo)) {
935 count = kfifo_get(&data->attn_fifo, &attn_data);
936 if (count)
937 kfree(attn_data.data);
938 }
939
a64ea311
BT		 940out:
941 mutex_unlock(&data->enabled_mutex);
942}
943
944int rmi_driver_suspend(struct rmi_device *rmi_dev, bool enable_wake)
945{
946 int retval;
2b6a321d
AD		 947
948 retval = rmi_suspend_functions(rmi_dev);
949 if (retval)
950 dev_warn(&rmi_dev->dev, "Failed to suspend functions: %d\n",
951 retval);
952
a64ea311 953 rmi_disable_irq(rmi_dev, enable_wake);
2b6a321d
AD		 954 return retval;
955}
956EXPORT_SYMBOL_GPL(rmi_driver_suspend);
957
3aeed5b5 958int rmi_driver_resume(struct rmi_device *rmi_dev, bool clear_wake)
2b6a321d
AD		 959{
960 int retval;
961
a64ea311 962 rmi_enable_irq(rmi_dev, clear_wake);
3aeed5b5 963
2b6a321d
AD		 964 retval = rmi_resume_functions(rmi_dev);
965 if (retval)
966 dev_warn(&rmi_dev->dev, "Failed to suspend functions: %d\n",
967 retval);
968
969 return retval;
970}
971EXPORT_SYMBOL_GPL(rmi_driver_resume);
972
973static int rmi_driver_remove(struct device *dev)
974{
975 struct rmi_device *rmi_dev = to_rmi_device(dev);
24d28e4f 976 struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
2b6a321d 977
a64ea311 978 rmi_disable_irq(rmi_dev, false);
2b6a321d 979
24d28e4f
ND		 980 irq_domain_remove(data->irqdomain);
981 data->irqdomain = NULL;
982
29fd0ec2 983 rmi_f34_remove_sysfs(rmi_dev);
2b6a321d
AD		 984 rmi_free_function_list(rmi_dev);
985
986 return 0;
987}
988
d8a8b3ed
AD		 989#ifdef CONFIG_OF
990static int rmi_driver_of_probe(struct device *dev,
991 struct rmi_device_platform_data *pdata)
992{
993 int retval;
994
995 retval = rmi_of_property_read_u32(dev, &pdata->reset_delay_ms,
996 "syna,reset-delay-ms", 1);
997 if (retval)
998 return retval;
999
1000 return 0;
1001}
1002#else
1003static inline int rmi_driver_of_probe(struct device *dev,
1004 struct rmi_device_platform_data *pdata)
1005{
1006 return -ENODEV;
1007}
1008#endif
1009
29fd0ec2 1010int rmi_probe_interrupts(struct rmi_driver_data *data)
6bd0dcfa
ND		 1011{
1012 struct rmi_device *rmi_dev = data->rmi_dev;
1013 struct device *dev = &rmi_dev->dev;
24d28e4f
ND		 1014 struct fwnode_handle *fwnode = rmi_dev->xport->dev->fwnode;
1015 int irq_count = 0;
6bd0dcfa 1016 size_t size;
6bd0dcfa
ND		 1017 int retval;
1018
1019 /*
1020 * We need to count the IRQs and allocate their storage before scanning
1021 * the PDT and creating the function entries, because adding a new
1022 * function can trigger events that result in the IRQ related storage
1023 * being accessed.
1024 */
1025 rmi_dbg(RMI_DEBUG_CORE, dev, "%s: Counting IRQs.\n", __func__);
5191d88a
ND		 1026 data->bootloader_mode = false;
1027
6bd0dcfa
ND		 1028 retval = rmi_scan_pdt(rmi_dev, &irq_count, rmi_count_irqs);
1029 if (retval < 0) {
1030 dev_err(dev, "IRQ counting failed with code %d.\n", retval);
1031 return retval;
1032 }
29fd0ec2 1033
5191d88a 1034 if (data->bootloader_mode)
ed77bdf4 1035 dev_warn(dev, "Device in bootloader mode.\n");
29fd0ec2 1036
24d28e4f
ND		 1037 /* Allocate and register a linear revmap irq_domain */
1038 data->irqdomain = irq_domain_create_linear(fwnode, irq_count,
1039 &irq_domain_simple_ops,
1040 data);
1041 if (!data->irqdomain) {
1042 dev_err(&rmi_dev->dev, "Failed to create IRQ domain\n");
fd629294 1043 return -ENOMEM;
24d28e4f
ND		 1044 }
1045
6bd0dcfa
ND		 1046 data->irq_count = irq_count;
1047 data->num_of_irq_regs = (data->irq_count + 7) / 8;
1048
1049 size = BITS_TO_LONGS(data->irq_count) * sizeof(unsigned long);
a86854d0 1050 data->irq_memory = devm_kcalloc(dev, size, 4, GFP_KERNEL);
29fd0ec2 1051 if (!data->irq_memory) {
6bd0dcfa 1052 dev_err(dev, "Failed to allocate memory for irq masks.\n");
e7839533 1053 return -ENOMEM;
6bd0dcfa
ND		 1054 }
1055
29fd0ec2
ND		 1056 data->irq_status = data->irq_memory + size * 0;
1057 data->fn_irq_bits = data->irq_memory + size * 1;
1058 data->current_irq_mask = data->irq_memory + size * 2;
1059 data->new_irq_mask = data->irq_memory + size * 3;
6bd0dcfa
ND		 1060
1061 return retval;
1062}
1063
29fd0ec2 1064int rmi_init_functions(struct rmi_driver_data *data)
6bd0dcfa
ND		 1065{
1066 struct rmi_device *rmi_dev = data->rmi_dev;
1067 struct device *dev = &rmi_dev->dev;
24d28e4f 1068 int irq_count = 0;
6bd0dcfa
ND		 1069 int retval;
1070
6bd0dcfa
ND		 1071 rmi_dbg(RMI_DEBUG_CORE, dev, "%s: Creating functions.\n", __func__);
1072 retval = rmi_scan_pdt(rmi_dev, &irq_count, rmi_create_function);
1073 if (retval < 0) {
1074 dev_err(dev, "Function creation failed with code %d.\n",
1075 retval);
1076 goto err_destroy_functions;
1077 }
1078
1079 if (!data->f01_container) {
1080 dev_err(dev, "Missing F01 container!\n");
1081 retval = -EINVAL;
1082 goto err_destroy_functions;
1083 }
1084
1085 retval = rmi_read_block(rmi_dev,
1086 data->f01_container->fd.control_base_addr + 1,
1087 data->current_irq_mask, data->num_of_irq_regs);
1088 if (retval < 0) {
1089 dev_err(dev, "%s: Failed to read current IRQ mask.\n",
1090 __func__);
1091 goto err_destroy_functions;
1092 }
1093
1094 return 0;
1095
1096err_destroy_functions:
1097 rmi_free_function_list(rmi_dev);
1098 return retval;
1099}
1100
2b6a321d
AD		 1101static int rmi_driver_probe(struct device *dev)
1102{
1103 struct rmi_driver *rmi_driver;
1104 struct rmi_driver_data *data;
1105 struct rmi_device_platform_data *pdata;
1106 struct rmi_device *rmi_dev;
2b6a321d
AD		 1107 int retval;
1108
1109 rmi_dbg(RMI_DEBUG_CORE, dev, "%s: Starting probe.\n",
1110 __func__);
1111
1112 if (!rmi_is_physical_device(dev)) {
1113 rmi_dbg(RMI_DEBUG_CORE, dev, "Not a physical device.\n");
1114 return -ENODEV;
1115 }
1116
1117 rmi_dev = to_rmi_device(dev);
1118 rmi_driver = to_rmi_driver(dev->driver);
1119 rmi_dev->driver = rmi_driver;
1120
1121 pdata = rmi_get_platform_data(rmi_dev);
1122
d8a8b3ed
AD		 1123 if (rmi_dev->xport->dev->of_node) {
1124 retval = rmi_driver_of_probe(rmi_dev->xport->dev, pdata);
1125 if (retval)
1126 return retval;
1127 }
1128
2b6a321d
AD		 1129 data = devm_kzalloc(dev, sizeof(struct rmi_driver_data), GFP_KERNEL);
1130 if (!data)
1131 return -ENOMEM;
1132
1133 INIT_LIST_HEAD(&data->function_list);
1134 data->rmi_dev = rmi_dev;
1135 dev_set_drvdata(&rmi_dev->dev, data);
1136
1137 /*
1138 * Right before a warm boot, the sensor might be in some unusual state,
1139 * such as F54 diagnostics, or F34 bootloader mode after a firmware
1140 * or configuration update. In order to clear the sensor to a known
1141 * state and/or apply any updates, we issue a initial reset to clear any
1142 * previous settings and force it into normal operation.
1143 *
1144 * We have to do this before actually building the PDT because
1145 * the reflash updates (if any) might cause various registers to move
1146 * around.
1147 *
1148 * For a number of reasons, this initial reset may fail to return
1149 * within the specified time, but we'll still be able to bring up the
1150 * driver normally after that failure. This occurs most commonly in
1151 * a cold boot situation (where then firmware takes longer to come up
1152 * than from a warm boot) and the reset_delay_ms in the platform data
1153 * has been set too short to accommodate that. Since the sensor will
1154 * eventually come up and be usable, we don't want to just fail here
1155 * and leave the customer's device unusable. So we warn them, and
1156 * continue processing.
1157 */
1158 retval = rmi_scan_pdt(rmi_dev, NULL, rmi_initial_reset);
1159 if (retval < 0)
1160 dev_warn(dev, "RMI initial reset failed! Continuing in spite of this.\n");
1161
1162 retval = rmi_read(rmi_dev, PDT_PROPERTIES_LOCATION, &data->pdt_props);
1163 if (retval < 0) {
1164 /*
1165 * we'll print out a warning and continue since
1166 * failure to get the PDT properties is not a cause to fail
1167 */
1168 dev_warn(dev, "Could not read PDT properties from %#06x (code %d). Assuming 0x00.\n",
1169 PDT_PROPERTIES_LOCATION, retval);
1170 }
1171
2b6a321d 1172 mutex_init(&data->irq_mutex);
a64ea311 1173 mutex_init(&data->enabled_mutex);
2b6a321d 1174
6bd0dcfa
ND		 1175 retval = rmi_probe_interrupts(data);
1176 if (retval)
2b6a321d 1177 goto err;
2b6a321d
AD		 1178
1179 if (rmi_dev->xport->input) {
1180 /*
1181 * The transport driver already has an input device.
1182 * In some cases it is preferable to reuse the transport
1183 * devices input device instead of creating a new one here.
1184 * One example is some HID touchpads report "pass-through"
1185 * button events are not reported by rmi registers.
1186 */
1187 data->input = rmi_dev->xport->input;
1188 } else {
1189 data->input = devm_input_allocate_device(dev);
1190 if (!data->input) {
1191 dev_err(dev, "%s: Failed to allocate input device.\n",
1192 __func__);
1193 retval = -ENOMEM;
6bd0dcfa 1194 goto err;
2b6a321d
AD		 1195 }
1196 rmi_driver_set_input_params(rmi_dev, data->input);
1197 data->input->phys = devm_kasprintf(dev, GFP_KERNEL,
1198 "%s/input0", dev_name(dev));
1199 }
1200
6bd0dcfa
ND		 1201 retval = rmi_init_functions(data);
1202 if (retval)
1203 goto err;
2b6a321d 1204
29fd0ec2
ND		 1205 retval = rmi_f34_create_sysfs(rmi_dev);
1206 if (retval)
1207 goto err;
2b6a321d
AD		 1208
1209 if (data->input) {
1210 rmi_driver_set_input_name(rmi_dev, data->input);
1211 if (!rmi_dev->xport->input) {
1212 if (input_register_device(data->input)) {
1213 dev_err(dev, "%s: Failed to register input device.\n",
1214 __func__);
1215 goto err_destroy_functions;
1216 }
1217 }
1218 }
1219
3aeed5b5
BA		 1220 retval = rmi_irq_init(rmi_dev);
1221 if (retval < 0)
1222 goto err_destroy_functions;
1223
8cf0adf2 1224 if (data->f01_container->dev.driver) {
2b6a321d 1225 /* Driver already bound, so enable ATTN now. */
8cf0adf2
DT		 1226 retval = rmi_enable_sensor(rmi_dev);
1227 if (retval)
1228 goto err_disable_irq;
1229 }
2b6a321d
AD		 1230
1231 return 0;
1232
8cf0adf2
DT		 1233err_disable_irq:
1234 rmi_disable_irq(rmi_dev, false);
2b6a321d
AD		 1235err_destroy_functions:
1236 rmi_free_function_list(rmi_dev);
1237err:
8cf0adf2 1238 return retval;
2b6a321d
AD		 1239}
1240
1241static struct rmi_driver rmi_physical_driver = {
1242 .driver = {
1243 .owner = THIS_MODULE,
1244 .name = "rmi4_physical",
1245 .bus = &rmi_bus_type,
1246 .probe = rmi_driver_probe,
1247 .remove = rmi_driver_remove,
1248 },
1249 .reset_handler = rmi_driver_reset_handler,
1250 .clear_irq_bits = rmi_driver_clear_irq_bits,
1251 .set_irq_bits = rmi_driver_set_irq_bits,
1252 .set_input_params = rmi_driver_set_input_params,
1253};
1254
1255bool rmi_is_physical_driver(struct device_driver *drv)
1256{
1257 return drv == &rmi_physical_driver.driver;
1258}
1259
1260int __init rmi_register_physical_driver(void)
1261{
1262 int error;
1263
1264 error = driver_register(&rmi_physical_driver.driver);
1265 if (error) {
1266 pr_err("%s: driver register failed, code=%d.\n", __func__,
1267 error);
1268 return error;
1269 }
1270
1271 return 0;
1272}
1273
1274void __exit rmi_unregister_physical_driver(void)
1275{
1276 driver_unregister(&rmi_physical_driver.driver);
1277}
Linux 6.x block layer and io_uring tree(s)