HID: fix data access in implement()
[linux-3.10.git] / drivers / hid / hid-logitech-dj.c
1 /*
2  *  HID driver for Logitech Unifying receivers
3  *
4  *  Copyright (c) 2011 Logitech
5  */
6
7 /*
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License version 2 as
10  * published by the Free Software Foundation.
11
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the Free Software
20  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21  *
22  */
23
24
25 #include <linux/device.h>
26 #include <linux/hid.h>
27 #include <linux/module.h>
28 #include <linux/usb.h>
29 #include <asm/unaligned.h>
30 #include "hid-ids.h"
31 #include "hid-logitech-dj.h"
32
33 /* Keyboard descriptor (1) */
34 static const char kbd_descriptor[] = {
35         0x05, 0x01,             /* USAGE_PAGE (generic Desktop)     */
36         0x09, 0x06,             /* USAGE (Keyboard)         */
37         0xA1, 0x01,             /* COLLECTION (Application)     */
38         0x85, 0x01,             /* REPORT_ID (1)            */
39         0x95, 0x08,             /*   REPORT_COUNT (8)           */
40         0x75, 0x01,             /*   REPORT_SIZE (1)            */
41         0x15, 0x00,             /*   LOGICAL_MINIMUM (0)        */
42         0x25, 0x01,             /*   LOGICAL_MAXIMUM (1)        */
43         0x05, 0x07,             /*   USAGE_PAGE (Keyboard)      */
44         0x19, 0xE0,             /*   USAGE_MINIMUM (Left Control)   */
45         0x29, 0xE7,             /*   USAGE_MAXIMUM (Right GUI)      */
46         0x81, 0x02,             /*   INPUT (Data,Var,Abs)       */
47         0x95, 0x05,             /*   REPORT COUNT (5)           */
48         0x05, 0x08,             /*   USAGE PAGE (LED page)      */
49         0x19, 0x01,             /*   USAGE MINIMUM (1)          */
50         0x29, 0x05,             /*   USAGE MAXIMUM (5)          */
51         0x91, 0x02,             /*   OUTPUT (Data, Variable, Absolute)  */
52         0x95, 0x01,             /*   REPORT COUNT (1)           */
53         0x75, 0x03,             /*   REPORT SIZE (3)            */
54         0x91, 0x01,             /*   OUTPUT (Constant)          */
55         0x95, 0x06,             /*   REPORT_COUNT (6)           */
56         0x75, 0x08,             /*   REPORT_SIZE (8)            */
57         0x15, 0x00,             /*   LOGICAL_MINIMUM (0)        */
58         0x26, 0xFF, 0x00,       /*   LOGICAL_MAXIMUM (255)      */
59         0x05, 0x07,             /*   USAGE_PAGE (Keyboard)      */
60         0x19, 0x00,             /*   USAGE_MINIMUM (no event)       */
61         0x2A, 0xFF, 0x00,       /*   USAGE_MAXIMUM (reserved)       */
62         0x81, 0x00,             /*   INPUT (Data,Ary,Abs)       */
63         0xC0
64 };
65
66 /* Mouse descriptor (2)     */
67 static const char mse_descriptor[] = {
68         0x05, 0x01,             /*  USAGE_PAGE (Generic Desktop)        */
69         0x09, 0x02,             /*  USAGE (Mouse)                       */
70         0xA1, 0x01,             /*  COLLECTION (Application)            */
71         0x85, 0x02,             /*    REPORT_ID = 2                     */
72         0x09, 0x01,             /*    USAGE (pointer)                   */
73         0xA1, 0x00,             /*    COLLECTION (physical)             */
74         0x05, 0x09,             /*      USAGE_PAGE (buttons)            */
75         0x19, 0x01,             /*      USAGE_MIN (1)                   */
76         0x29, 0x10,             /*      USAGE_MAX (16)                  */
77         0x15, 0x00,             /*      LOGICAL_MIN (0)                 */
78         0x25, 0x01,             /*      LOGICAL_MAX (1)                 */
79         0x95, 0x10,             /*      REPORT_COUNT (16)               */
80         0x75, 0x01,             /*      REPORT_SIZE (1)                 */
81         0x81, 0x02,             /*      INPUT (data var abs)            */
82         0x05, 0x01,             /*      USAGE_PAGE (generic desktop)    */
83         0x16, 0x01, 0xF8,       /*      LOGICAL_MIN (-2047)             */
84         0x26, 0xFF, 0x07,       /*      LOGICAL_MAX (2047)              */
85         0x75, 0x0C,             /*      REPORT_SIZE (12)                */
86         0x95, 0x02,             /*      REPORT_COUNT (2)                */
87         0x09, 0x30,             /*      USAGE (X)                       */
88         0x09, 0x31,             /*      USAGE (Y)                       */
89         0x81, 0x06,             /*      INPUT                           */
90         0x15, 0x81,             /*      LOGICAL_MIN (-127)              */
91         0x25, 0x7F,             /*      LOGICAL_MAX (127)               */
92         0x75, 0x08,             /*      REPORT_SIZE (8)                 */
93         0x95, 0x01,             /*      REPORT_COUNT (1)                */
94         0x09, 0x38,             /*      USAGE (wheel)                   */
95         0x81, 0x06,             /*      INPUT                           */
96         0x05, 0x0C,             /*      USAGE_PAGE(consumer)            */
97         0x0A, 0x38, 0x02,       /*      USAGE(AC Pan)                   */
98         0x95, 0x01,             /*      REPORT_COUNT (1)                */
99         0x81, 0x06,             /*      INPUT                           */
100         0xC0,                   /*    END_COLLECTION                    */
101         0xC0,                   /*  END_COLLECTION                      */
102 };
103
104 /* Consumer Control descriptor (3) */
105 static const char consumer_descriptor[] = {
106         0x05, 0x0C,             /* USAGE_PAGE (Consumer Devices)       */
107         0x09, 0x01,             /* USAGE (Consumer Control)            */
108         0xA1, 0x01,             /* COLLECTION (Application)            */
109         0x85, 0x03,             /* REPORT_ID = 3                       */
110         0x75, 0x10,             /* REPORT_SIZE (16)                    */
111         0x95, 0x02,             /* REPORT_COUNT (2)                    */
112         0x15, 0x01,             /* LOGICAL_MIN (1)                     */
113         0x26, 0x8C, 0x02,       /* LOGICAL_MAX (652)                   */
114         0x19, 0x01,             /* USAGE_MIN (1)                       */
115         0x2A, 0x8C, 0x02,       /* USAGE_MAX (652)                     */
116         0x81, 0x00,             /* INPUT (Data Ary Abs)                */
117         0xC0,                   /* END_COLLECTION                      */
118 };                              /*                                     */
119
120 /* System control descriptor (4) */
121 static const char syscontrol_descriptor[] = {
122         0x05, 0x01,             /*   USAGE_PAGE (Generic Desktop)      */
123         0x09, 0x80,             /*   USAGE (System Control)            */
124         0xA1, 0x01,             /*   COLLECTION (Application)          */
125         0x85, 0x04,             /*   REPORT_ID = 4                     */
126         0x75, 0x02,             /*   REPORT_SIZE (2)                   */
127         0x95, 0x01,             /*   REPORT_COUNT (1)                  */
128         0x15, 0x01,             /*   LOGICAL_MIN (1)                   */
129         0x25, 0x03,             /*   LOGICAL_MAX (3)                   */
130         0x09, 0x82,             /*   USAGE (System Sleep)              */
131         0x09, 0x81,             /*   USAGE (System Power Down)         */
132         0x09, 0x83,             /*   USAGE (System Wake Up)            */
133         0x81, 0x60,             /*   INPUT (Data Ary Abs NPrf Null)    */
134         0x75, 0x06,             /*   REPORT_SIZE (6)                   */
135         0x81, 0x03,             /*   INPUT (Cnst Var Abs)              */
136         0xC0,                   /*   END_COLLECTION                    */
137 };
138
139 /* Media descriptor (8) */
140 static const char media_descriptor[] = {
141         0x06, 0xbc, 0xff,       /* Usage Page 0xffbc                   */
142         0x09, 0x88,             /* Usage 0x0088                        */
143         0xa1, 0x01,             /* BeginCollection                     */
144         0x85, 0x08,             /*   Report ID 8                       */
145         0x19, 0x01,             /*   Usage Min 0x0001                  */
146         0x29, 0xff,             /*   Usage Max 0x00ff                  */
147         0x15, 0x01,             /*   Logical Min 1                     */
148         0x26, 0xff, 0x00,       /*   Logical Max 255                   */
149         0x75, 0x08,             /*   Report Size 8                     */
150         0x95, 0x01,             /*   Report Count 1                    */
151         0x81, 0x00,             /*   Input                             */
152         0xc0,                   /* EndCollection                       */
153 };                              /*                                     */
154
155 /* Maximum size of all defined hid reports in bytes (including report id) */
156 #define MAX_REPORT_SIZE 8
157
158 /* Make sure all descriptors are present here */
159 #define MAX_RDESC_SIZE                          \
160         (sizeof(kbd_descriptor) +               \
161          sizeof(mse_descriptor) +               \
162          sizeof(consumer_descriptor) +          \
163          sizeof(syscontrol_descriptor) +        \
164          sizeof(media_descriptor))
165
166 /* Number of possible hid report types that can be created by this driver.
167  *
168  * Right now, RF report types have the same report types (or report id's)
169  * than the hid report created from those RF reports. In the future
170  * this doesnt have to be true.
171  *
172  * For instance, RF report type 0x01 which has a size of 8 bytes, corresponds
173  * to hid report id 0x01, this is standard keyboard. Same thing applies to mice
174  * reports and consumer control, etc. If a new RF report is created, it doesn't
175  * has to have the same report id as its corresponding hid report, so an
176  * translation may have to take place for future report types.
177  */
178 #define NUMBER_OF_HID_REPORTS 32
179 static const u8 hid_reportid_size_map[NUMBER_OF_HID_REPORTS] = {
180         [1] = 8,                /* Standard keyboard */
181         [2] = 8,                /* Standard mouse */
182         [3] = 5,                /* Consumer control */
183         [4] = 2,                /* System control */
184         [8] = 2,                /* Media Center */
185 };
186
187
188 #define LOGITECH_DJ_INTERFACE_NUMBER 0x02
189
190 static struct hid_ll_driver logi_dj_ll_driver;
191
192 static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
193                                         size_t count,
194                                         unsigned char report_type);
195
196 static void logi_dj_recv_destroy_djhid_device(struct dj_receiver_dev *djrcv_dev,
197                                                 struct dj_report *dj_report)
198 {
199         /* Called in delayed work context */
200         struct dj_device *dj_dev;
201         unsigned long flags;
202
203         spin_lock_irqsave(&djrcv_dev->lock, flags);
204         dj_dev = djrcv_dev->paired_dj_devices[dj_report->device_index];
205         djrcv_dev->paired_dj_devices[dj_report->device_index] = NULL;
206         spin_unlock_irqrestore(&djrcv_dev->lock, flags);
207
208         if (dj_dev != NULL) {
209                 hid_destroy_device(dj_dev->hdev);
210                 kfree(dj_dev);
211         } else {
212                 dev_err(&djrcv_dev->hdev->dev, "%s: can't destroy a NULL device\n",
213                         __func__);
214         }
215 }
216
217 static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
218                                           struct dj_report *dj_report)
219 {
220         /* Called in delayed work context */
221         struct hid_device *djrcv_hdev = djrcv_dev->hdev;
222         struct usb_interface *intf = to_usb_interface(djrcv_hdev->dev.parent);
223         struct usb_device *usbdev = interface_to_usbdev(intf);
224         struct hid_device *dj_hiddev;
225         struct dj_device *dj_dev;
226
227         /* Device index goes from 1 to 6, we need 3 bytes to store the
228          * semicolon, the index, and a null terminator
229          */
230         unsigned char tmpstr[3];
231
232         if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION] &
233             SPFUNCTION_DEVICE_LIST_EMPTY) {
234                 dbg_hid("%s: device list is empty\n", __func__);
235                 return;
236         }
237
238         if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
239             (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
240                 dev_err(&djrcv_hdev->dev, "%s: invalid device index:%d\n",
241                         __func__, dj_report->device_index);
242                 return;
243         }
244
245         dj_hiddev = hid_allocate_device();
246         if (IS_ERR(dj_hiddev)) {
247                 dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n",
248                         __func__);
249                 return;
250         }
251
252         dj_hiddev->ll_driver = &logi_dj_ll_driver;
253         dj_hiddev->hid_output_raw_report = logi_dj_output_hidraw_report;
254
255         dj_hiddev->dev.parent = &djrcv_hdev->dev;
256         dj_hiddev->bus = BUS_USB;
257         dj_hiddev->vendor = le16_to_cpu(usbdev->descriptor.idVendor);
258         dj_hiddev->product = le16_to_cpu(usbdev->descriptor.idProduct);
259         snprintf(dj_hiddev->name, sizeof(dj_hiddev->name),
260                 "Logitech Unifying Device. Wireless PID:%02x%02x",
261                 dj_report->report_params[DEVICE_PAIRED_PARAM_EQUAD_ID_MSB],
262                 dj_report->report_params[DEVICE_PAIRED_PARAM_EQUAD_ID_LSB]);
263
264         usb_make_path(usbdev, dj_hiddev->phys, sizeof(dj_hiddev->phys));
265         snprintf(tmpstr, sizeof(tmpstr), ":%d", dj_report->device_index);
266         strlcat(dj_hiddev->phys, tmpstr, sizeof(dj_hiddev->phys));
267
268         dj_dev = kzalloc(sizeof(struct dj_device), GFP_KERNEL);
269
270         if (!dj_dev) {
271                 dev_err(&djrcv_hdev->dev, "%s: failed allocating dj_device\n",
272                         __func__);
273                 goto dj_device_allocate_fail;
274         }
275
276         dj_dev->reports_supported = get_unaligned_le32(
277                 dj_report->report_params + DEVICE_PAIRED_RF_REPORT_TYPE);
278         dj_dev->hdev = dj_hiddev;
279         dj_dev->dj_receiver_dev = djrcv_dev;
280         dj_dev->device_index = dj_report->device_index;
281         dj_hiddev->driver_data = dj_dev;
282
283         djrcv_dev->paired_dj_devices[dj_report->device_index] = dj_dev;
284
285         if (hid_add_device(dj_hiddev)) {
286                 dev_err(&djrcv_hdev->dev, "%s: failed adding dj_device\n",
287                         __func__);
288                 goto hid_add_device_fail;
289         }
290
291         return;
292
293 hid_add_device_fail:
294         djrcv_dev->paired_dj_devices[dj_report->device_index] = NULL;
295         kfree(dj_dev);
296 dj_device_allocate_fail:
297         hid_destroy_device(dj_hiddev);
298 }
299
300 static void delayedwork_callback(struct work_struct *work)
301 {
302         struct dj_receiver_dev *djrcv_dev =
303                 container_of(work, struct dj_receiver_dev, work);
304
305         struct dj_report dj_report;
306         unsigned long flags;
307         int count;
308
309         dbg_hid("%s\n", __func__);
310
311         spin_lock_irqsave(&djrcv_dev->lock, flags);
312
313         count = kfifo_out(&djrcv_dev->notif_fifo, &dj_report,
314                                 sizeof(struct dj_report));
315
316         if (count != sizeof(struct dj_report)) {
317                 dev_err(&djrcv_dev->hdev->dev, "%s: workitem triggered without "
318                         "notifications available\n", __func__);
319                 spin_unlock_irqrestore(&djrcv_dev->lock, flags);
320                 return;
321         }
322
323         if (!kfifo_is_empty(&djrcv_dev->notif_fifo)) {
324                 if (schedule_work(&djrcv_dev->work) == 0) {
325                         dbg_hid("%s: did not schedule the work item, was "
326                                 "already queued\n", __func__);
327                 }
328         }
329
330         spin_unlock_irqrestore(&djrcv_dev->lock, flags);
331
332         switch (dj_report.report_type) {
333         case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
334                 logi_dj_recv_add_djhid_device(djrcv_dev, &dj_report);
335                 break;
336         case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
337                 logi_dj_recv_destroy_djhid_device(djrcv_dev, &dj_report);
338                 break;
339         default:
340                 dbg_hid("%s: unexpected report type\n", __func__);
341         }
342 }
343
344 static void logi_dj_recv_queue_notification(struct dj_receiver_dev *djrcv_dev,
345                                            struct dj_report *dj_report)
346 {
347         /* We are called from atomic context (tasklet && djrcv->lock held) */
348
349         kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
350
351         if (schedule_work(&djrcv_dev->work) == 0) {
352                 dbg_hid("%s: did not schedule the work item, was already "
353                         "queued\n", __func__);
354         }
355 }
356
357 static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,
358                                              struct dj_report *dj_report)
359 {
360         /* We are called from atomic context (tasklet && djrcv->lock held) */
361         unsigned int i;
362         u8 reportbuffer[MAX_REPORT_SIZE];
363         struct dj_device *djdev;
364
365         djdev = djrcv_dev->paired_dj_devices[dj_report->device_index];
366
367         if (!djdev) {
368                 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
369                         " is NULL, index %d\n", dj_report->device_index);
370                 return;
371         }
372
373         memset(reportbuffer, 0, sizeof(reportbuffer));
374
375         for (i = 0; i < NUMBER_OF_HID_REPORTS; i++) {
376                 if (djdev->reports_supported & (1 << i)) {
377                         reportbuffer[0] = i;
378                         if (hid_input_report(djdev->hdev,
379                                              HID_INPUT_REPORT,
380                                              reportbuffer,
381                                              hid_reportid_size_map[i], 1)) {
382                                 dbg_hid("hid_input_report error sending null "
383                                         "report\n");
384                         }
385                 }
386         }
387 }
388
389 static void logi_dj_recv_forward_report(struct dj_receiver_dev *djrcv_dev,
390                                         struct dj_report *dj_report)
391 {
392         /* We are called from atomic context (tasklet && djrcv->lock held) */
393         struct dj_device *dj_device;
394
395         dj_device = djrcv_dev->paired_dj_devices[dj_report->device_index];
396
397         if (dj_device == NULL) {
398                 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
399                         " is NULL, index %d\n", dj_report->device_index);
400                 return;
401         }
402
403         if ((dj_report->report_type > ARRAY_SIZE(hid_reportid_size_map) - 1) ||
404             (hid_reportid_size_map[dj_report->report_type] == 0)) {
405                 dbg_hid("invalid report type:%x\n", dj_report->report_type);
406                 return;
407         }
408
409         if (hid_input_report(dj_device->hdev,
410                         HID_INPUT_REPORT, &dj_report->report_type,
411                         hid_reportid_size_map[dj_report->report_type], 1)) {
412                 dbg_hid("hid_input_report error\n");
413         }
414 }
415
416
417 static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev,
418                                     struct dj_report *dj_report)
419 {
420         struct hid_device *hdev = djrcv_dev->hdev;
421         struct hid_report *report;
422         struct hid_report_enum *output_report_enum;
423         u8 *data = (u8 *)(&dj_report->device_index);
424         unsigned int i;
425
426         output_report_enum = &hdev->report_enum[HID_OUTPUT_REPORT];
427         report = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT];
428
429         if (!report) {
430                 dev_err(&hdev->dev, "%s: unable to find dj report\n", __func__);
431                 return -ENODEV;
432         }
433
434         for (i = 0; i < DJREPORT_SHORT_LENGTH - 1; i++)
435                 report->field[0]->value[i] = data[i];
436
437         hid_hw_request(hdev, report, HID_REQ_SET_REPORT);
438
439         return 0;
440 }
441
442 static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
443 {
444         struct dj_report *dj_report;
445         int retval;
446
447         dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
448         if (!dj_report)
449                 return -ENOMEM;
450         dj_report->report_id = REPORT_ID_DJ_SHORT;
451         dj_report->device_index = 0xFF;
452         dj_report->report_type = REPORT_TYPE_CMD_GET_PAIRED_DEVICES;
453         retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
454         kfree(dj_report);
455         return retval;
456 }
457
458 static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
459                                           unsigned timeout)
460 {
461         struct dj_report *dj_report;
462         int retval;
463
464         dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
465         if (!dj_report)
466                 return -ENOMEM;
467         dj_report->report_id = REPORT_ID_DJ_SHORT;
468         dj_report->device_index = 0xFF;
469         dj_report->report_type = REPORT_TYPE_CMD_SWITCH;
470         dj_report->report_params[CMD_SWITCH_PARAM_DEVBITFIELD] = 0x3F;
471         dj_report->report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS] = (u8)timeout;
472         retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
473         kfree(dj_report);
474         return retval;
475 }
476
477
478 static int logi_dj_ll_open(struct hid_device *hid)
479 {
480         dbg_hid("%s:%s\n", __func__, hid->phys);
481         return 0;
482
483 }
484
485 static void logi_dj_ll_close(struct hid_device *hid)
486 {
487         dbg_hid("%s:%s\n", __func__, hid->phys);
488 }
489
490 static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
491                                         size_t count,
492                                         unsigned char report_type)
493 {
494         /* Called by hid raw to send data */
495         dbg_hid("%s\n", __func__);
496
497         return 0;
498 }
499
500 static void rdcat(char **rdesc, unsigned int *rsize, const char *data, unsigned int size)
501 {
502         memcpy(*rdesc + *rsize, data, size);
503         *rsize += size;
504 }
505
506 static int logi_dj_ll_parse(struct hid_device *hid)
507 {
508         struct dj_device *djdev = hid->driver_data;
509         unsigned int rsize = 0;
510         char *rdesc;
511         int retval;
512
513         dbg_hid("%s\n", __func__);
514
515         djdev->hdev->version = 0x0111;
516         djdev->hdev->country = 0x00;
517
518         rdesc = kmalloc(MAX_RDESC_SIZE, GFP_KERNEL);
519         if (!rdesc)
520                 return -ENOMEM;
521
522         if (djdev->reports_supported & STD_KEYBOARD) {
523                 dbg_hid("%s: sending a kbd descriptor, reports_supported: %x\n",
524                         __func__, djdev->reports_supported);
525                 rdcat(&rdesc, &rsize, kbd_descriptor, sizeof(kbd_descriptor));
526         }
527
528         if (djdev->reports_supported & STD_MOUSE) {
529                 dbg_hid("%s: sending a mouse descriptor, reports_supported: "
530                         "%x\n", __func__, djdev->reports_supported);
531                 rdcat(&rdesc, &rsize, mse_descriptor, sizeof(mse_descriptor));
532         }
533
534         if (djdev->reports_supported & MULTIMEDIA) {
535                 dbg_hid("%s: sending a multimedia report descriptor: %x\n",
536                         __func__, djdev->reports_supported);
537                 rdcat(&rdesc, &rsize, consumer_descriptor, sizeof(consumer_descriptor));
538         }
539
540         if (djdev->reports_supported & POWER_KEYS) {
541                 dbg_hid("%s: sending a power keys report descriptor: %x\n",
542                         __func__, djdev->reports_supported);
543                 rdcat(&rdesc, &rsize, syscontrol_descriptor, sizeof(syscontrol_descriptor));
544         }
545
546         if (djdev->reports_supported & MEDIA_CENTER) {
547                 dbg_hid("%s: sending a media center report descriptor: %x\n",
548                         __func__, djdev->reports_supported);
549                 rdcat(&rdesc, &rsize, media_descriptor, sizeof(media_descriptor));
550         }
551
552         if (djdev->reports_supported & KBD_LEDS) {
553                 dbg_hid("%s: need to send kbd leds report descriptor: %x\n",
554                         __func__, djdev->reports_supported);
555         }
556
557         retval = hid_parse_report(hid, rdesc, rsize);
558         kfree(rdesc);
559
560         return retval;
561 }
562
563 static int logi_dj_ll_input_event(struct input_dev *dev, unsigned int type,
564                                   unsigned int code, int value)
565 {
566         /* Sent by the input layer to handle leds and Force Feedback */
567         struct hid_device *dj_hiddev = input_get_drvdata(dev);
568         struct dj_device *dj_dev = dj_hiddev->driver_data;
569
570         struct dj_receiver_dev *djrcv_dev =
571             dev_get_drvdata(dj_hiddev->dev.parent);
572         struct hid_device *dj_rcv_hiddev = djrcv_dev->hdev;
573         struct hid_report_enum *output_report_enum;
574
575         struct hid_field *field;
576         struct hid_report *report;
577         unsigned char *data;
578         int offset;
579
580         dbg_hid("%s: %s, type:%d | code:%d | value:%d\n",
581                 __func__, dev->phys, type, code, value);
582
583         if (type != EV_LED)
584                 return -1;
585
586         offset = hidinput_find_field(dj_hiddev, type, code, &field);
587
588         if (offset == -1) {
589                 dev_warn(&dev->dev, "event field not found\n");
590                 return -1;
591         }
592         hid_set_field(field, offset, value);
593
594         data = hid_alloc_report_buf(field->report, GFP_KERNEL);
595         if (!data) {
596                 dev_warn(&dev->dev, "failed to allocate report buf memory\n");
597                 return -1;
598         }
599
600         hid_output_report(field->report, &data[0]);
601
602         output_report_enum = &dj_rcv_hiddev->report_enum[HID_OUTPUT_REPORT];
603         report = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT];
604         hid_set_field(report->field[0], 0, dj_dev->device_index);
605         hid_set_field(report->field[0], 1, REPORT_TYPE_LEDS);
606         hid_set_field(report->field[0], 2, data[1]);
607
608         hid_hw_request(dj_rcv_hiddev, report, HID_REQ_SET_REPORT);
609
610         kfree(data);
611
612         return 0;
613 }
614
615 static int logi_dj_ll_start(struct hid_device *hid)
616 {
617         dbg_hid("%s\n", __func__);
618         return 0;
619 }
620
621 static void logi_dj_ll_stop(struct hid_device *hid)
622 {
623         dbg_hid("%s\n", __func__);
624 }
625
626
627 static struct hid_ll_driver logi_dj_ll_driver = {
628         .parse = logi_dj_ll_parse,
629         .start = logi_dj_ll_start,
630         .stop = logi_dj_ll_stop,
631         .open = logi_dj_ll_open,
632         .close = logi_dj_ll_close,
633         .hidinput_input_event = logi_dj_ll_input_event,
634 };
635
636
637 static int logi_dj_raw_event(struct hid_device *hdev,
638                              struct hid_report *report, u8 *data,
639                              int size)
640 {
641         struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
642         struct dj_report *dj_report = (struct dj_report *) data;
643         unsigned long flags;
644         bool report_processed = false;
645
646         dbg_hid("%s, size:%d\n", __func__, size);
647
648         /* Here we receive all data coming from iface 2, there are 4 cases:
649          *
650          * 1) Data should continue its normal processing i.e. data does not
651          * come from the DJ collection, in which case we do nothing and
652          * return 0, so hid-core can continue normal processing (will forward
653          * to associated hidraw device)
654          *
655          * 2) Data is from DJ collection, and is intended for this driver i. e.
656          * data contains arrival, departure, etc notifications, in which case
657          * we queue them for delayed processing by the work queue. We return 1
658          * to hid-core as no further processing is required from it.
659          *
660          * 3) Data is from DJ collection, and informs a connection change,
661          * if the change means rf link loss, then we must send a null report
662          * to the upper layer to discard potentially pressed keys that may be
663          * repeated forever by the input layer. Return 1 to hid-core as no
664          * further processing is required.
665          *
666          * 4) Data is from DJ collection and is an actual input event from
667          * a paired DJ device in which case we forward it to the correct hid
668          * device (via hid_input_report() ) and return 1 so hid-core does not do
669          * anything else with it.
670          */
671
672         spin_lock_irqsave(&djrcv_dev->lock, flags);
673         if (dj_report->report_id == REPORT_ID_DJ_SHORT) {
674                 switch (dj_report->report_type) {
675                 case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
676                 case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
677                         logi_dj_recv_queue_notification(djrcv_dev, dj_report);
678                         break;
679                 case REPORT_TYPE_NOTIF_CONNECTION_STATUS:
680                         if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] ==
681                             STATUS_LINKLOSS) {
682                                 logi_dj_recv_forward_null_report(djrcv_dev, dj_report);
683                         }
684                         break;
685                 default:
686                         logi_dj_recv_forward_report(djrcv_dev, dj_report);
687                 }
688                 report_processed = true;
689         }
690         spin_unlock_irqrestore(&djrcv_dev->lock, flags);
691
692         return report_processed;
693 }
694
695 static int logi_dj_probe(struct hid_device *hdev,
696                          const struct hid_device_id *id)
697 {
698         struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
699         struct dj_receiver_dev *djrcv_dev;
700         int retval;
701
702         if (is_dj_device((struct dj_device *)hdev->driver_data))
703                 return -ENODEV;
704
705         dbg_hid("%s called for ifnum %d\n", __func__,
706                 intf->cur_altsetting->desc.bInterfaceNumber);
707
708         /* Ignore interfaces 0 and 1, they will not carry any data, dont create
709          * any hid_device for them */
710         if (intf->cur_altsetting->desc.bInterfaceNumber !=
711             LOGITECH_DJ_INTERFACE_NUMBER) {
712                 dbg_hid("%s: ignoring ifnum %d\n", __func__,
713                         intf->cur_altsetting->desc.bInterfaceNumber);
714                 return -ENODEV;
715         }
716
717         /* Treat interface 2 */
718
719         djrcv_dev = kzalloc(sizeof(struct dj_receiver_dev), GFP_KERNEL);
720         if (!djrcv_dev) {
721                 dev_err(&hdev->dev,
722                         "%s:failed allocating dj_receiver_dev\n", __func__);
723                 return -ENOMEM;
724         }
725         djrcv_dev->hdev = hdev;
726         INIT_WORK(&djrcv_dev->work, delayedwork_callback);
727         spin_lock_init(&djrcv_dev->lock);
728         if (kfifo_alloc(&djrcv_dev->notif_fifo,
729                         DJ_MAX_NUMBER_NOTIFICATIONS * sizeof(struct dj_report),
730                         GFP_KERNEL)) {
731                 dev_err(&hdev->dev,
732                         "%s:failed allocating notif_fifo\n", __func__);
733                 kfree(djrcv_dev);
734                 return -ENOMEM;
735         }
736         hid_set_drvdata(hdev, djrcv_dev);
737
738         /* Call  to usbhid to fetch the HID descriptors of interface 2 and
739          * subsequently call to the hid/hid-core to parse the fetched
740          * descriptors, this will in turn create the hidraw and hiddev nodes
741          * for interface 2 of the receiver */
742         retval = hid_parse(hdev);
743         if (retval) {
744                 dev_err(&hdev->dev,
745                         "%s:parse of interface 2 failed\n", __func__);
746                 goto hid_parse_fail;
747         }
748
749         if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, REPORT_ID_DJ_SHORT,
750                                  0, DJREPORT_SHORT_LENGTH - 1)) {
751                 retval = -ENODEV;
752                 goto hid_parse_fail;
753         }
754
755         /* Starts the usb device and connects to upper interfaces hiddev and
756          * hidraw */
757         retval = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
758         if (retval) {
759                 dev_err(&hdev->dev,
760                         "%s:hid_hw_start returned error\n", __func__);
761                 goto hid_hw_start_fail;
762         }
763
764         retval = logi_dj_recv_switch_to_dj_mode(djrcv_dev, 0);
765         if (retval < 0) {
766                 dev_err(&hdev->dev,
767                         "%s:logi_dj_recv_switch_to_dj_mode returned error:%d\n",
768                         __func__, retval);
769                 goto switch_to_dj_mode_fail;
770         }
771
772         /* This is enabling the polling urb on the IN endpoint */
773         retval = hdev->ll_driver->open(hdev);
774         if (retval < 0) {
775                 dev_err(&hdev->dev, "%s:hdev->ll_driver->open returned "
776                         "error:%d\n", __func__, retval);
777                 goto llopen_failed;
778         }
779
780         /* Allow incoming packets to arrive: */
781         hid_device_io_start(hdev);
782
783         retval = logi_dj_recv_query_paired_devices(djrcv_dev);
784         if (retval < 0) {
785                 dev_err(&hdev->dev, "%s:logi_dj_recv_query_paired_devices "
786                         "error:%d\n", __func__, retval);
787                 goto logi_dj_recv_query_paired_devices_failed;
788         }
789
790         return retval;
791
792 logi_dj_recv_query_paired_devices_failed:
793         hdev->ll_driver->close(hdev);
794
795 llopen_failed:
796 switch_to_dj_mode_fail:
797         hid_hw_stop(hdev);
798
799 hid_hw_start_fail:
800 hid_parse_fail:
801         kfifo_free(&djrcv_dev->notif_fifo);
802         kfree(djrcv_dev);
803         hid_set_drvdata(hdev, NULL);
804         return retval;
805
806 }
807
808 #ifdef CONFIG_PM
809 static int logi_dj_reset_resume(struct hid_device *hdev)
810 {
811         int retval;
812         struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
813
814         retval = logi_dj_recv_switch_to_dj_mode(djrcv_dev, 0);
815         if (retval < 0) {
816                 dev_err(&hdev->dev,
817                         "%s:logi_dj_recv_switch_to_dj_mode returned error:%d\n",
818                         __func__, retval);
819         }
820
821         return 0;
822 }
823 #endif
824
825 static void logi_dj_remove(struct hid_device *hdev)
826 {
827         struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
828         struct dj_device *dj_dev;
829         int i;
830
831         dbg_hid("%s\n", __func__);
832
833         cancel_work_sync(&djrcv_dev->work);
834
835         hdev->ll_driver->close(hdev);
836         hid_hw_stop(hdev);
837
838         /* I suppose that at this point the only context that can access
839          * the djrecv_data is this thread as the work item is guaranteed to
840          * have finished and no more raw_event callbacks should arrive after
841          * the remove callback was triggered so no locks are put around the
842          * code below */
843         for (i = 0; i < (DJ_MAX_PAIRED_DEVICES + DJ_DEVICE_INDEX_MIN); i++) {
844                 dj_dev = djrcv_dev->paired_dj_devices[i];
845                 if (dj_dev != NULL) {
846                         hid_destroy_device(dj_dev->hdev);
847                         kfree(dj_dev);
848                         djrcv_dev->paired_dj_devices[i] = NULL;
849                 }
850         }
851
852         kfifo_free(&djrcv_dev->notif_fifo);
853         kfree(djrcv_dev);
854         hid_set_drvdata(hdev, NULL);
855 }
856
857 static int logi_djdevice_probe(struct hid_device *hdev,
858                          const struct hid_device_id *id)
859 {
860         int ret;
861         struct dj_device *dj_dev = hdev->driver_data;
862
863         if (!is_dj_device(dj_dev))
864                 return -ENODEV;
865
866         ret = hid_parse(hdev);
867         if (!ret)
868                 ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
869
870         return ret;
871 }
872
873 static const struct hid_device_id logi_dj_receivers[] = {
874         {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
875                 USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER)},
876         {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
877                 USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2)},
878         {}
879 };
880
881 MODULE_DEVICE_TABLE(hid, logi_dj_receivers);
882
883 static struct hid_driver logi_djreceiver_driver = {
884         .name = "logitech-djreceiver",
885         .id_table = logi_dj_receivers,
886         .probe = logi_dj_probe,
887         .remove = logi_dj_remove,
888         .raw_event = logi_dj_raw_event,
889 #ifdef CONFIG_PM
890         .reset_resume = logi_dj_reset_resume,
891 #endif
892 };
893
894
895 static const struct hid_device_id logi_dj_devices[] = {
896         {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
897                 USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER)},
898         {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
899                 USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2)},
900         {}
901 };
902
903 static struct hid_driver logi_djdevice_driver = {
904         .name = "logitech-djdevice",
905         .id_table = logi_dj_devices,
906         .probe = logi_djdevice_probe,
907 };
908
909
910 static int __init logi_dj_init(void)
911 {
912         int retval;
913
914         dbg_hid("Logitech-DJ:%s\n", __func__);
915
916         retval = hid_register_driver(&logi_djreceiver_driver);
917         if (retval)
918                 return retval;
919
920         retval = hid_register_driver(&logi_djdevice_driver);
921         if (retval)
922                 hid_unregister_driver(&logi_djreceiver_driver);
923
924         return retval;
925
926 }
927
928 static void __exit logi_dj_exit(void)
929 {
930         dbg_hid("Logitech-DJ:%s\n", __func__);
931
932         hid_unregister_driver(&logi_djdevice_driver);
933         hid_unregister_driver(&logi_djreceiver_driver);
934
935 }
936
937 module_init(logi_dj_init);
938 module_exit(logi_dj_exit);
939 MODULE_LICENSE("GPL");
940 MODULE_AUTHOR("Logitech");
941 MODULE_AUTHOR("Nestor Lopez Casado");
942 MODULE_AUTHOR("nlopezcasad@logitech.com");