HID: logitech: perform bounds checking on device_id early enough
[pandora-kernel.git] / drivers / hid / hid-logitech-dj.c
1 /*
2  *  HID driver for Logitech Unifying receivers
3  *
4  *  Copyright (c) 2011 Logitech
5  */
6
7 /*
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License version 2 as
10  * published by the Free Software Foundation.
11
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the Free Software
20  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21  *
22  */
23
24
25 #include <linux/device.h>
26 #include <linux/hid.h>
27 #include <linux/module.h>
28 #include <linux/usb.h>
29 #include <asm/unaligned.h>
30 #include "usbhid/usbhid.h"
31 #include "hid-ids.h"
32 #include "hid-logitech-dj.h"
33
34 /* Keyboard descriptor (1) */
35 static const char kbd_descriptor[] = {
36         0x05, 0x01,             /* USAGE_PAGE (generic Desktop)     */
37         0x09, 0x06,             /* USAGE (Keyboard)         */
38         0xA1, 0x01,             /* COLLECTION (Application)     */
39         0x85, 0x01,             /* REPORT_ID (1)            */
40         0x95, 0x08,             /*   REPORT_COUNT (8)           */
41         0x75, 0x01,             /*   REPORT_SIZE (1)            */
42         0x15, 0x00,             /*   LOGICAL_MINIMUM (0)        */
43         0x25, 0x01,             /*   LOGICAL_MAXIMUM (1)        */
44         0x05, 0x07,             /*   USAGE_PAGE (Keyboard)      */
45         0x19, 0xE0,             /*   USAGE_MINIMUM (Left Control)   */
46         0x29, 0xE7,             /*   USAGE_MAXIMUM (Right GUI)      */
47         0x81, 0x02,             /*   INPUT (Data,Var,Abs)       */
48         0x95, 0x05,             /*   REPORT COUNT (5)           */
49         0x05, 0x08,             /*   USAGE PAGE (LED page)      */
50         0x19, 0x01,             /*   USAGE MINIMUM (1)          */
51         0x29, 0x05,             /*   USAGE MAXIMUM (5)          */
52         0x91, 0x02,             /*   OUTPUT (Data, Variable, Absolute)  */
53         0x95, 0x01,             /*   REPORT COUNT (1)           */
54         0x75, 0x03,             /*   REPORT SIZE (3)            */
55         0x91, 0x01,             /*   OUTPUT (Constant)          */
56         0x95, 0x06,             /*   REPORT_COUNT (6)           */
57         0x75, 0x08,             /*   REPORT_SIZE (8)            */
58         0x15, 0x00,             /*   LOGICAL_MINIMUM (0)        */
59         0x26, 0xFF, 0x00,       /*   LOGICAL_MAXIMUM (255)      */
60         0x05, 0x07,             /*   USAGE_PAGE (Keyboard)      */
61         0x19, 0x00,             /*   USAGE_MINIMUM (no event)       */
62         0x2A, 0xFF, 0x00,       /*   USAGE_MAXIMUM (reserved)       */
63         0x81, 0x00,             /*   INPUT (Data,Ary,Abs)       */
64         0xC0
65 };
66
67 /* Mouse descriptor (2)     */
68 static const char mse_descriptor[] = {
69         0x05, 0x01,             /*  USAGE_PAGE (Generic Desktop)        */
70         0x09, 0x02,             /*  USAGE (Mouse)                       */
71         0xA1, 0x01,             /*  COLLECTION (Application)            */
72         0x85, 0x02,             /*    REPORT_ID = 2                     */
73         0x09, 0x01,             /*    USAGE (pointer)                   */
74         0xA1, 0x00,             /*    COLLECTION (physical)             */
75         0x05, 0x09,             /*      USAGE_PAGE (buttons)            */
76         0x19, 0x01,             /*      USAGE_MIN (1)                   */
77         0x29, 0x10,             /*      USAGE_MAX (16)                  */
78         0x15, 0x00,             /*      LOGICAL_MIN (0)                 */
79         0x25, 0x01,             /*      LOGICAL_MAX (1)                 */
80         0x95, 0x10,             /*      REPORT_COUNT (16)               */
81         0x75, 0x01,             /*      REPORT_SIZE (1)                 */
82         0x81, 0x02,             /*      INPUT (data var abs)            */
83         0x05, 0x01,             /*      USAGE_PAGE (generic desktop)    */
84         0x16, 0x01, 0xF8,       /*      LOGICAL_MIN (-2047)             */
85         0x26, 0xFF, 0x07,       /*      LOGICAL_MAX (2047)              */
86         0x75, 0x0C,             /*      REPORT_SIZE (12)                */
87         0x95, 0x02,             /*      REPORT_COUNT (2)                */
88         0x09, 0x30,             /*      USAGE (X)                       */
89         0x09, 0x31,             /*      USAGE (Y)                       */
90         0x81, 0x06,             /*      INPUT                           */
91         0x15, 0x81,             /*      LOGICAL_MIN (-127)              */
92         0x25, 0x7F,             /*      LOGICAL_MAX (127)               */
93         0x75, 0x08,             /*      REPORT_SIZE (8)                 */
94         0x95, 0x01,             /*      REPORT_COUNT (1)                */
95         0x09, 0x38,             /*      USAGE (wheel)                   */
96         0x81, 0x06,             /*      INPUT                           */
97         0x05, 0x0C,             /*      USAGE_PAGE(consumer)            */
98         0x0A, 0x38, 0x02,       /*      USAGE(AC Pan)                   */
99         0x95, 0x01,             /*      REPORT_COUNT (1)                */
100         0x81, 0x06,             /*      INPUT                           */
101         0xC0,                   /*    END_COLLECTION                    */
102         0xC0,                   /*  END_COLLECTION                      */
103 };
104
105 /* Consumer Control descriptor (3) */
106 static const char consumer_descriptor[] = {
107         0x05, 0x0C,             /* USAGE_PAGE (Consumer Devices)       */
108         0x09, 0x01,             /* USAGE (Consumer Control)            */
109         0xA1, 0x01,             /* COLLECTION (Application)            */
110         0x85, 0x03,             /* REPORT_ID = 3                       */
111         0x75, 0x10,             /* REPORT_SIZE (16)                    */
112         0x95, 0x02,             /* REPORT_COUNT (2)                    */
113         0x15, 0x01,             /* LOGICAL_MIN (1)                     */
114         0x26, 0x8C, 0x02,       /* LOGICAL_MAX (652)                   */
115         0x19, 0x01,             /* USAGE_MIN (1)                       */
116         0x2A, 0x8C, 0x02,       /* USAGE_MAX (652)                     */
117         0x81, 0x00,             /* INPUT (Data Ary Abs)                */
118         0xC0,                   /* END_COLLECTION                      */
119 };                              /*                                     */
120
121 /* System control descriptor (4) */
122 static const char syscontrol_descriptor[] = {
123         0x05, 0x01,             /*   USAGE_PAGE (Generic Desktop)      */
124         0x09, 0x80,             /*   USAGE (System Control)            */
125         0xA1, 0x01,             /*   COLLECTION (Application)          */
126         0x85, 0x04,             /*   REPORT_ID = 4                     */
127         0x75, 0x02,             /*   REPORT_SIZE (2)                   */
128         0x95, 0x01,             /*   REPORT_COUNT (1)                  */
129         0x15, 0x01,             /*   LOGICAL_MIN (1)                   */
130         0x25, 0x03,             /*   LOGICAL_MAX (3)                   */
131         0x09, 0x82,             /*   USAGE (System Sleep)              */
132         0x09, 0x81,             /*   USAGE (System Power Down)         */
133         0x09, 0x83,             /*   USAGE (System Wake Up)            */
134         0x81, 0x60,             /*   INPUT (Data Ary Abs NPrf Null)    */
135         0x75, 0x06,             /*   REPORT_SIZE (6)                   */
136         0x81, 0x03,             /*   INPUT (Cnst Var Abs)              */
137         0xC0,                   /*   END_COLLECTION                    */
138 };
139
140 /* Media descriptor (8) */
141 static const char media_descriptor[] = {
142         0x06, 0xbc, 0xff,       /* Usage Page 0xffbc                   */
143         0x09, 0x88,             /* Usage 0x0088                        */
144         0xa1, 0x01,             /* BeginCollection                     */
145         0x85, 0x08,             /*   Report ID 8                       */
146         0x19, 0x01,             /*   Usage Min 0x0001                  */
147         0x29, 0xff,             /*   Usage Max 0x00ff                  */
148         0x15, 0x01,             /*   Logical Min 1                     */
149         0x26, 0xff, 0x00,       /*   Logical Max 255                   */
150         0x75, 0x08,             /*   Report Size 8                     */
151         0x95, 0x01,             /*   Report Count 1                    */
152         0x81, 0x00,             /*   Input                             */
153         0xc0,                   /* EndCollection                       */
154 };                              /*                                     */
155
156 /* Maximum size of all defined hid reports in bytes (including report id) */
157 #define MAX_REPORT_SIZE 8
158
159 /* Number of possible hid report types that can be created by this driver.
160  *
161  * Right now, RF report types have the same report types (or report id's)
162  * than the hid report created from those RF reports. In the future
163  * this doesnt have to be true.
164  *
165  * For instance, RF report type 0x01 which has a size of 8 bytes, corresponds
166  * to hid report id 0x01, this is standard keyboard. Same thing applies to mice
167  * reports and consumer control, etc. If a new RF report is created, it doesn't
168  * has to have the same report id as its corresponding hid report, so an
169  * translation may have to take place for future report types.
170  */
171 #define NUMBER_OF_HID_REPORTS 32
172 static const u8 hid_reportid_size_map[NUMBER_OF_HID_REPORTS] = {
173         [1] = 8,                /* Standard keyboard */
174         [2] = 8,                /* Standard mouse */
175         [3] = 5,                /* Consumer control */
176         [4] = 2,                /* System control */
177         [8] = 2,                /* Media Center */
178 };
179
180
181 #define LOGITECH_DJ_INTERFACE_NUMBER 0x02
182
183 static struct hid_ll_driver logi_dj_ll_driver;
184
185 static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
186                                         size_t count,
187                                         unsigned char report_type);
188 static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev);
189
190 static void logi_dj_recv_destroy_djhid_device(struct dj_receiver_dev *djrcv_dev,
191                                                 struct dj_report *dj_report)
192 {
193         /* Called in delayed work context */
194         struct dj_device *dj_dev;
195         unsigned long flags;
196
197         spin_lock_irqsave(&djrcv_dev->lock, flags);
198         dj_dev = djrcv_dev->paired_dj_devices[dj_report->device_index];
199         djrcv_dev->paired_dj_devices[dj_report->device_index] = NULL;
200         spin_unlock_irqrestore(&djrcv_dev->lock, flags);
201
202         if (dj_dev != NULL) {
203                 hid_destroy_device(dj_dev->hdev);
204                 kfree(dj_dev);
205         } else {
206                 dev_err(&djrcv_dev->hdev->dev, "%s: can't destroy a NULL device\n",
207                         __func__);
208         }
209 }
210
211 static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
212                                           struct dj_report *dj_report)
213 {
214         /* Called in delayed work context */
215         struct hid_device *djrcv_hdev = djrcv_dev->hdev;
216         struct usb_interface *intf = to_usb_interface(djrcv_hdev->dev.parent);
217         struct usb_device *usbdev = interface_to_usbdev(intf);
218         struct hid_device *dj_hiddev;
219         struct dj_device *dj_dev;
220
221         /* Device index goes from 1 to 6, we need 3 bytes to store the
222          * semicolon, the index, and a null terminator
223          */
224         unsigned char tmpstr[3];
225
226         if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION] &
227             SPFUNCTION_DEVICE_LIST_EMPTY) {
228                 dbg_hid("%s: device list is empty\n", __func__);
229                 djrcv_dev->querying_devices = false;
230                 return;
231         }
232
233         if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
234                 /* The device is already known. No need to reallocate it. */
235                 dbg_hid("%s: device is already known\n", __func__);
236                 return;
237         }
238
239         dj_hiddev = hid_allocate_device();
240         if (IS_ERR(dj_hiddev)) {
241                 dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n",
242                         __func__);
243                 return;
244         }
245
246         dj_hiddev->ll_driver = &logi_dj_ll_driver;
247         dj_hiddev->hid_output_raw_report = logi_dj_output_hidraw_report;
248
249         dj_hiddev->dev.parent = &djrcv_hdev->dev;
250         dj_hiddev->bus = BUS_USB;
251         dj_hiddev->vendor = le16_to_cpu(usbdev->descriptor.idVendor);
252         dj_hiddev->product = le16_to_cpu(usbdev->descriptor.idProduct);
253         snprintf(dj_hiddev->name, sizeof(dj_hiddev->name),
254                 "Logitech Unifying Device. Wireless PID:%02x%02x",
255                 dj_report->report_params[DEVICE_PAIRED_PARAM_EQUAD_ID_MSB],
256                 dj_report->report_params[DEVICE_PAIRED_PARAM_EQUAD_ID_LSB]);
257
258         usb_make_path(usbdev, dj_hiddev->phys, sizeof(dj_hiddev->phys));
259         snprintf(tmpstr, sizeof(tmpstr), ":%d", dj_report->device_index);
260         strlcat(dj_hiddev->phys, tmpstr, sizeof(dj_hiddev->phys));
261
262         dj_dev = kzalloc(sizeof(struct dj_device), GFP_KERNEL);
263
264         if (!dj_dev) {
265                 dev_err(&djrcv_hdev->dev, "%s: failed allocating dj_device\n",
266                         __func__);
267                 goto dj_device_allocate_fail;
268         }
269
270         dj_dev->reports_supported = get_unaligned_le32(
271                 dj_report->report_params + DEVICE_PAIRED_RF_REPORT_TYPE);
272         dj_dev->hdev = dj_hiddev;
273         dj_dev->dj_receiver_dev = djrcv_dev;
274         dj_dev->device_index = dj_report->device_index;
275         dj_hiddev->driver_data = dj_dev;
276
277         djrcv_dev->paired_dj_devices[dj_report->device_index] = dj_dev;
278
279         if (hid_add_device(dj_hiddev)) {
280                 dev_err(&djrcv_hdev->dev, "%s: failed adding dj_device\n",
281                         __func__);
282                 goto hid_add_device_fail;
283         }
284
285         return;
286
287 hid_add_device_fail:
288         djrcv_dev->paired_dj_devices[dj_report->device_index] = NULL;
289         kfree(dj_dev);
290 dj_device_allocate_fail:
291         hid_destroy_device(dj_hiddev);
292 }
293
294 static void delayedwork_callback(struct work_struct *work)
295 {
296         struct dj_receiver_dev *djrcv_dev =
297                 container_of(work, struct dj_receiver_dev, work);
298
299         struct dj_report dj_report;
300         unsigned long flags;
301         int count;
302         int retval;
303
304         dbg_hid("%s\n", __func__);
305
306         spin_lock_irqsave(&djrcv_dev->lock, flags);
307
308         count = kfifo_out(&djrcv_dev->notif_fifo, &dj_report,
309                                 sizeof(struct dj_report));
310
311         if (count != sizeof(struct dj_report)) {
312                 dev_err(&djrcv_dev->hdev->dev, "%s: workitem triggered without "
313                         "notifications available\n", __func__);
314                 spin_unlock_irqrestore(&djrcv_dev->lock, flags);
315                 return;
316         }
317
318         if (!kfifo_is_empty(&djrcv_dev->notif_fifo)) {
319                 if (schedule_work(&djrcv_dev->work) == 0) {
320                         dbg_hid("%s: did not schedule the work item, was "
321                                 "already queued\n", __func__);
322                 }
323         }
324
325         spin_unlock_irqrestore(&djrcv_dev->lock, flags);
326
327         switch (dj_report.report_type) {
328         case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
329                 logi_dj_recv_add_djhid_device(djrcv_dev, &dj_report);
330                 break;
331         case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
332                 logi_dj_recv_destroy_djhid_device(djrcv_dev, &dj_report);
333                 break;
334         default:
335         /* A normal report (i. e. not belonging to a pair/unpair notification)
336          * arriving here, means that the report arrived but we did not have a
337          * paired dj_device associated to the report's device_index, this
338          * means that the original "device paired" notification corresponding
339          * to this dj_device never arrived to this driver. The reason is that
340          * hid-core discards all packets coming from a device while probe() is
341          * executing. */
342         if (!djrcv_dev->paired_dj_devices[dj_report.device_index]) {
343                 /* ok, we don't know the device, just re-ask the
344                  * receiver for the list of connected devices. */
345                 retval = logi_dj_recv_query_paired_devices(djrcv_dev);
346                 if (!retval) {
347                         /* everything went fine, so just leave */
348                         break;
349                 }
350                 dev_err(&djrcv_dev->hdev->dev,
351                         "%s:logi_dj_recv_query_paired_devices "
352                         "error:%d\n", __func__, retval);
353                 }
354                 dbg_hid("%s: unexpected report type\n", __func__);
355         }
356 }
357
358 static void logi_dj_recv_queue_notification(struct dj_receiver_dev *djrcv_dev,
359                                            struct dj_report *dj_report)
360 {
361         /* We are called from atomic context (tasklet && djrcv->lock held) */
362
363         kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
364
365         if (schedule_work(&djrcv_dev->work) == 0) {
366                 dbg_hid("%s: did not schedule the work item, was already "
367                         "queued\n", __func__);
368         }
369 }
370
371 static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,
372                                              struct dj_report *dj_report)
373 {
374         /* We are called from atomic context (tasklet && djrcv->lock held) */
375         unsigned int i;
376         u8 reportbuffer[MAX_REPORT_SIZE];
377         struct dj_device *djdev;
378
379         djdev = djrcv_dev->paired_dj_devices[dj_report->device_index];
380
381         if (!djdev) {
382                 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
383                         " is NULL, index %d\n", dj_report->device_index);
384                 kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
385
386                 if (schedule_work(&djrcv_dev->work) == 0) {
387                         dbg_hid("%s: did not schedule the work item, was already "
388                         "queued\n", __func__);
389                 }
390                 return;
391         }
392
393         memset(reportbuffer, 0, sizeof(reportbuffer));
394
395         for (i = 0; i < NUMBER_OF_HID_REPORTS; i++) {
396                 if (djdev->reports_supported & (1 << i)) {
397                         reportbuffer[0] = i;
398                         if (hid_input_report(djdev->hdev,
399                                              HID_INPUT_REPORT,
400                                              reportbuffer,
401                                              hid_reportid_size_map[i], 1)) {
402                                 dbg_hid("hid_input_report error sending null "
403                                         "report\n");
404                         }
405                 }
406         }
407 }
408
409 static void logi_dj_recv_forward_report(struct dj_receiver_dev *djrcv_dev,
410                                         struct dj_report *dj_report)
411 {
412         /* We are called from atomic context (tasklet && djrcv->lock held) */
413         struct dj_device *dj_device;
414
415         dj_device = djrcv_dev->paired_dj_devices[dj_report->device_index];
416
417         if (dj_device == NULL) {
418                 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
419                         " is NULL, index %d\n", dj_report->device_index);
420                 kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
421
422                 if (schedule_work(&djrcv_dev->work) == 0) {
423                         dbg_hid("%s: did not schedule the work item, was already "
424                         "queued\n", __func__);
425                 }
426                 return;
427         }
428
429         if ((dj_report->report_type > ARRAY_SIZE(hid_reportid_size_map) - 1) ||
430             (hid_reportid_size_map[dj_report->report_type] == 0)) {
431                 dbg_hid("invalid report type:%x\n", dj_report->report_type);
432                 return;
433         }
434
435         if (hid_input_report(dj_device->hdev,
436                         HID_INPUT_REPORT, &dj_report->report_type,
437                         hid_reportid_size_map[dj_report->report_type], 1)) {
438                 dbg_hid("hid_input_report error\n");
439         }
440 }
441
442
443 static int logi_dj_recv_send_report(struct dj_receiver_dev *djrcv_dev,
444                                     struct dj_report *dj_report)
445 {
446         struct hid_device *hdev = djrcv_dev->hdev;
447         int sent_bytes;
448
449         if (!hdev->hid_output_raw_report) {
450                 dev_err(&hdev->dev, "%s:"
451                         "hid_output_raw_report is null\n", __func__);
452                 return -ENODEV;
453         }
454
455         sent_bytes = hdev->hid_output_raw_report(hdev, (u8 *) dj_report,
456                                                  sizeof(struct dj_report),
457                                                  HID_OUTPUT_REPORT);
458
459         return (sent_bytes < 0) ? sent_bytes : 0;
460 }
461
462 static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
463 {
464         struct dj_report *dj_report;
465         int retval;
466
467         /* no need to protect djrcv_dev->querying_devices */
468         if (djrcv_dev->querying_devices)
469                 return 0;
470
471         dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
472         if (!dj_report)
473                 return -ENOMEM;
474         dj_report->report_id = REPORT_ID_DJ_SHORT;
475         dj_report->device_index = 0xFF;
476         dj_report->report_type = REPORT_TYPE_CMD_GET_PAIRED_DEVICES;
477         retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
478         kfree(dj_report);
479         return retval;
480 }
481
482
483 static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
484                                           unsigned timeout)
485 {
486         struct dj_report *dj_report;
487         int retval;
488
489         dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
490         if (!dj_report)
491                 return -ENOMEM;
492         dj_report->report_id = REPORT_ID_DJ_SHORT;
493         dj_report->device_index = 0xFF;
494         dj_report->report_type = REPORT_TYPE_CMD_SWITCH;
495         dj_report->report_params[CMD_SWITCH_PARAM_DEVBITFIELD] = 0x3F;
496         dj_report->report_params[CMD_SWITCH_PARAM_TIMEOUT_SECONDS] = (u8)timeout;
497         retval = logi_dj_recv_send_report(djrcv_dev, dj_report);
498         kfree(dj_report);
499         return retval;
500 }
501
502
503 static int logi_dj_ll_open(struct hid_device *hid)
504 {
505         dbg_hid("%s:%s\n", __func__, hid->phys);
506         return 0;
507
508 }
509
510 static void logi_dj_ll_close(struct hid_device *hid)
511 {
512         dbg_hid("%s:%s\n", __func__, hid->phys);
513 }
514
515 static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
516                                         size_t count,
517                                         unsigned char report_type)
518 {
519         /* Called by hid raw to send data */
520         dbg_hid("%s\n", __func__);
521
522         return 0;
523 }
524
525 static int logi_dj_ll_parse(struct hid_device *hid)
526 {
527         struct dj_device *djdev = hid->driver_data;
528         int retval;
529
530         dbg_hid("%s\n", __func__);
531
532         djdev->hdev->version = 0x0111;
533         djdev->hdev->country = 0x00;
534
535         if (djdev->reports_supported & STD_KEYBOARD) {
536                 dbg_hid("%s: sending a kbd descriptor, reports_supported: %x\n",
537                         __func__, djdev->reports_supported);
538                 retval = hid_parse_report(hid,
539                                           (u8 *) kbd_descriptor,
540                                           sizeof(kbd_descriptor));
541                 if (retval) {
542                         dbg_hid("%s: sending a kbd descriptor, hid_parse failed"
543                                 " error: %d\n", __func__, retval);
544                         return retval;
545                 }
546         }
547
548         if (djdev->reports_supported & STD_MOUSE) {
549                 dbg_hid("%s: sending a mouse descriptor, reports_supported: "
550                         "%x\n", __func__, djdev->reports_supported);
551                 retval = hid_parse_report(hid,
552                                           (u8 *) mse_descriptor,
553                                           sizeof(mse_descriptor));
554                 if (retval) {
555                         dbg_hid("%s: sending a mouse descriptor, hid_parse "
556                                 "failed error: %d\n", __func__, retval);
557                         return retval;
558                 }
559         }
560
561         if (djdev->reports_supported & MULTIMEDIA) {
562                 dbg_hid("%s: sending a multimedia report descriptor: %x\n",
563                         __func__, djdev->reports_supported);
564                 retval = hid_parse_report(hid,
565                                           (u8 *) consumer_descriptor,
566                                           sizeof(consumer_descriptor));
567                 if (retval) {
568                         dbg_hid("%s: sending a consumer_descriptor, hid_parse "
569                                 "failed error: %d\n", __func__, retval);
570                         return retval;
571                 }
572         }
573
574         if (djdev->reports_supported & POWER_KEYS) {
575                 dbg_hid("%s: sending a power keys report descriptor: %x\n",
576                         __func__, djdev->reports_supported);
577                 retval = hid_parse_report(hid,
578                                           (u8 *) syscontrol_descriptor,
579                                           sizeof(syscontrol_descriptor));
580                 if (retval) {
581                         dbg_hid("%s: sending a syscontrol_descriptor, "
582                                 "hid_parse failed error: %d\n",
583                                 __func__, retval);
584                         return retval;
585                 }
586         }
587
588         if (djdev->reports_supported & MEDIA_CENTER) {
589                 dbg_hid("%s: sending a media center report descriptor: %x\n",
590                         __func__, djdev->reports_supported);
591                 retval = hid_parse_report(hid,
592                                           (u8 *) media_descriptor,
593                                           sizeof(media_descriptor));
594                 if (retval) {
595                         dbg_hid("%s: sending a media_descriptor, hid_parse "
596                                 "failed error: %d\n", __func__, retval);
597                         return retval;
598                 }
599         }
600
601         if (djdev->reports_supported & KBD_LEDS) {
602                 dbg_hid("%s: need to send kbd leds report descriptor: %x\n",
603                         __func__, djdev->reports_supported);
604         }
605
606         return 0;
607 }
608
609 static int logi_dj_ll_input_event(struct input_dev *dev, unsigned int type,
610                                   unsigned int code, int value)
611 {
612         /* Sent by the input layer to handle leds and Force Feedback */
613         struct hid_device *dj_hiddev = input_get_drvdata(dev);
614         struct dj_device *dj_dev = dj_hiddev->driver_data;
615
616         struct dj_receiver_dev *djrcv_dev =
617             dev_get_drvdata(dj_hiddev->dev.parent);
618         struct hid_device *dj_rcv_hiddev = djrcv_dev->hdev;
619         struct hid_report_enum *output_report_enum;
620
621         struct hid_field *field;
622         struct hid_report *report;
623         unsigned char data[8];
624         int offset;
625
626         dbg_hid("%s: %s, type:%d | code:%d | value:%d\n",
627                 __func__, dev->phys, type, code, value);
628
629         if (type != EV_LED)
630                 return -1;
631
632         offset = hidinput_find_field(dj_hiddev, type, code, &field);
633
634         if (offset == -1) {
635                 dev_warn(&dev->dev, "event field not found\n");
636                 return -1;
637         }
638         hid_set_field(field, offset, value);
639         hid_output_report(field->report, &data[0]);
640
641         output_report_enum = &dj_rcv_hiddev->report_enum[HID_OUTPUT_REPORT];
642         report = output_report_enum->report_id_hash[REPORT_ID_DJ_SHORT];
643         hid_set_field(report->field[0], 0, dj_dev->device_index);
644         hid_set_field(report->field[0], 1, REPORT_TYPE_LEDS);
645         hid_set_field(report->field[0], 2, data[1]);
646
647         usbhid_submit_report(dj_rcv_hiddev, report, USB_DIR_OUT);
648
649         return 0;
650
651 }
652
653 static int logi_dj_ll_start(struct hid_device *hid)
654 {
655         dbg_hid("%s\n", __func__);
656         return 0;
657 }
658
659 static void logi_dj_ll_stop(struct hid_device *hid)
660 {
661         dbg_hid("%s\n", __func__);
662 }
663
664
665 static struct hid_ll_driver logi_dj_ll_driver = {
666         .parse = logi_dj_ll_parse,
667         .start = logi_dj_ll_start,
668         .stop = logi_dj_ll_stop,
669         .open = logi_dj_ll_open,
670         .close = logi_dj_ll_close,
671         .hidinput_input_event = logi_dj_ll_input_event,
672 };
673
674
675 static int logi_dj_raw_event(struct hid_device *hdev,
676                              struct hid_report *report, u8 *data,
677                              int size)
678 {
679         struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
680         struct dj_report *dj_report = (struct dj_report *) data;
681         unsigned long flags;
682         bool report_processed = false;
683
684         dbg_hid("%s, size:%d\n", __func__, size);
685
686         /* Here we receive all data coming from iface 2, there are 4 cases:
687          *
688          * 1) Data should continue its normal processing i.e. data does not
689          * come from the DJ collection, in which case we do nothing and
690          * return 0, so hid-core can continue normal processing (will forward
691          * to associated hidraw device)
692          *
693          * 2) Data is from DJ collection, and is intended for this driver i. e.
694          * data contains arrival, departure, etc notifications, in which case
695          * we queue them for delayed processing by the work queue. We return 1
696          * to hid-core as no further processing is required from it.
697          *
698          * 3) Data is from DJ collection, and informs a connection change,
699          * if the change means rf link loss, then we must send a null report
700          * to the upper layer to discard potentially pressed keys that may be
701          * repeated forever by the input layer. Return 1 to hid-core as no
702          * further processing is required.
703          *
704          * 4) Data is from DJ collection and is an actual input event from
705          * a paired DJ device in which case we forward it to the correct hid
706          * device (via hid_input_report() ) and return 1 so hid-core does not do
707          * anything else with it.
708          */
709         if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
710             (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
711                 dev_err(&hdev->dev, "%s: invalid device index:%d\n",
712                                 __func__, dj_report->device_index);
713                 return false;
714         }
715
716         spin_lock_irqsave(&djrcv_dev->lock, flags);
717         if (dj_report->report_id == REPORT_ID_DJ_SHORT) {
718                 switch (dj_report->report_type) {
719                 case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
720                 case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
721                         logi_dj_recv_queue_notification(djrcv_dev, dj_report);
722                         break;
723                 case REPORT_TYPE_NOTIF_CONNECTION_STATUS:
724                         if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] ==
725                             STATUS_LINKLOSS) {
726                                 logi_dj_recv_forward_null_report(djrcv_dev, dj_report);
727                         }
728                         break;
729                 default:
730                         logi_dj_recv_forward_report(djrcv_dev, dj_report);
731                 }
732                 report_processed = true;
733         }
734         spin_unlock_irqrestore(&djrcv_dev->lock, flags);
735
736         return report_processed;
737 }
738
739 static int logi_dj_probe(struct hid_device *hdev,
740                          const struct hid_device_id *id)
741 {
742         struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
743         struct dj_receiver_dev *djrcv_dev;
744         int retval;
745
746         if (is_dj_device((struct dj_device *)hdev->driver_data))
747                 return -ENODEV;
748
749         dbg_hid("%s called for ifnum %d\n", __func__,
750                 intf->cur_altsetting->desc.bInterfaceNumber);
751
752         /* Ignore interfaces 0 and 1, they will not carry any data, dont create
753          * any hid_device for them */
754         if (intf->cur_altsetting->desc.bInterfaceNumber !=
755             LOGITECH_DJ_INTERFACE_NUMBER) {
756                 dbg_hid("%s: ignoring ifnum %d\n", __func__,
757                         intf->cur_altsetting->desc.bInterfaceNumber);
758                 return -ENODEV;
759         }
760
761         /* Treat interface 2 */
762
763         djrcv_dev = kzalloc(sizeof(struct dj_receiver_dev), GFP_KERNEL);
764         if (!djrcv_dev) {
765                 dev_err(&hdev->dev,
766                         "%s:failed allocating dj_receiver_dev\n", __func__);
767                 return -ENOMEM;
768         }
769         djrcv_dev->hdev = hdev;
770         INIT_WORK(&djrcv_dev->work, delayedwork_callback);
771         spin_lock_init(&djrcv_dev->lock);
772         if (kfifo_alloc(&djrcv_dev->notif_fifo,
773                         DJ_MAX_NUMBER_NOTIFICATIONS * sizeof(struct dj_report),
774                         GFP_KERNEL)) {
775                 dev_err(&hdev->dev,
776                         "%s:failed allocating notif_fifo\n", __func__);
777                 kfree(djrcv_dev);
778                 return -ENOMEM;
779         }
780         hid_set_drvdata(hdev, djrcv_dev);
781
782         /* Call  to usbhid to fetch the HID descriptors of interface 2 and
783          * subsequently call to the hid/hid-core to parse the fetched
784          * descriptors, this will in turn create the hidraw and hiddev nodes
785          * for interface 2 of the receiver */
786         retval = hid_parse(hdev);
787         if (retval) {
788                 dev_err(&hdev->dev,
789                         "%s:parse of interface 2 failed\n", __func__);
790                 goto hid_parse_fail;
791         }
792
793         if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, REPORT_ID_DJ_SHORT,
794                                  0, DJREPORT_SHORT_LENGTH - 1)) {
795                 retval = -ENODEV;
796                 goto hid_parse_fail;
797         }
798
799         /* Starts the usb device and connects to upper interfaces hiddev and
800          * hidraw */
801         retval = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
802         if (retval) {
803                 dev_err(&hdev->dev,
804                         "%s:hid_hw_start returned error\n", __func__);
805                 goto hid_hw_start_fail;
806         }
807
808         retval = logi_dj_recv_switch_to_dj_mode(djrcv_dev, 0);
809         if (retval < 0) {
810                 dev_err(&hdev->dev,
811                         "%s:logi_dj_recv_switch_to_dj_mode returned error:%d\n",
812                         __func__, retval);
813                 goto switch_to_dj_mode_fail;
814         }
815
816         /* This is enabling the polling urb on the IN endpoint */
817         retval = hdev->ll_driver->open(hdev);
818         if (retval < 0) {
819                 dev_err(&hdev->dev, "%s:hdev->ll_driver->open returned "
820                         "error:%d\n", __func__, retval);
821                 goto llopen_failed;
822         }
823
824         retval = logi_dj_recv_query_paired_devices(djrcv_dev);
825         if (retval < 0) {
826                 dev_err(&hdev->dev, "%s:logi_dj_recv_query_paired_devices "
827                         "error:%d\n", __func__, retval);
828                 goto logi_dj_recv_query_paired_devices_failed;
829         }
830
831         return retval;
832
833 logi_dj_recv_query_paired_devices_failed:
834         hdev->ll_driver->close(hdev);
835
836 llopen_failed:
837 switch_to_dj_mode_fail:
838         hid_hw_stop(hdev);
839
840 hid_hw_start_fail:
841 hid_parse_fail:
842         kfifo_free(&djrcv_dev->notif_fifo);
843         kfree(djrcv_dev);
844         hid_set_drvdata(hdev, NULL);
845         return retval;
846
847 }
848
849 #ifdef CONFIG_PM
850 static int logi_dj_reset_resume(struct hid_device *hdev)
851 {
852         int retval;
853         struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
854
855         retval = logi_dj_recv_switch_to_dj_mode(djrcv_dev, 0);
856         if (retval < 0) {
857                 dev_err(&hdev->dev,
858                         "%s:logi_dj_recv_switch_to_dj_mode returned error:%d\n",
859                         __func__, retval);
860         }
861
862         return 0;
863 }
864 #endif
865
866 static void logi_dj_remove(struct hid_device *hdev)
867 {
868         struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
869         struct dj_device *dj_dev;
870         int i;
871
872         dbg_hid("%s\n", __func__);
873
874         cancel_work_sync(&djrcv_dev->work);
875
876         hdev->ll_driver->close(hdev);
877         hid_hw_stop(hdev);
878
879         /* I suppose that at this point the only context that can access
880          * the djrecv_data is this thread as the work item is guaranteed to
881          * have finished and no more raw_event callbacks should arrive after
882          * the remove callback was triggered so no locks are put around the
883          * code below */
884         for (i = 0; i < (DJ_MAX_PAIRED_DEVICES + DJ_DEVICE_INDEX_MIN); i++) {
885                 dj_dev = djrcv_dev->paired_dj_devices[i];
886                 if (dj_dev != NULL) {
887                         hid_destroy_device(dj_dev->hdev);
888                         kfree(dj_dev);
889                         djrcv_dev->paired_dj_devices[i] = NULL;
890                 }
891         }
892
893         kfifo_free(&djrcv_dev->notif_fifo);
894         kfree(djrcv_dev);
895         hid_set_drvdata(hdev, NULL);
896 }
897
898 static int logi_djdevice_probe(struct hid_device *hdev,
899                          const struct hid_device_id *id)
900 {
901         int ret;
902         struct dj_device *dj_dev = hdev->driver_data;
903
904         if (!is_dj_device(dj_dev))
905                 return -ENODEV;
906
907         ret = hid_parse(hdev);
908         if (!ret)
909                 ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
910
911         return ret;
912 }
913
914 static const struct hid_device_id logi_dj_receivers[] = {
915         {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
916                 USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER)},
917         {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
918                 USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2)},
919         {}
920 };
921
922 MODULE_DEVICE_TABLE(hid, logi_dj_receivers);
923
924 static struct hid_driver logi_djreceiver_driver = {
925         .name = "logitech-djreceiver",
926         .id_table = logi_dj_receivers,
927         .probe = logi_dj_probe,
928         .remove = logi_dj_remove,
929         .raw_event = logi_dj_raw_event,
930 #ifdef CONFIG_PM
931         .reset_resume = logi_dj_reset_resume,
932 #endif
933 };
934
935
936 static const struct hid_device_id logi_dj_devices[] = {
937         {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
938                 USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER)},
939         {HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH,
940                 USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2)},
941         {}
942 };
943
944 static struct hid_driver logi_djdevice_driver = {
945         .name = "logitech-djdevice",
946         .id_table = logi_dj_devices,
947         .probe = logi_djdevice_probe,
948 };
949
950
951 static int __init logi_dj_init(void)
952 {
953         int retval;
954
955         dbg_hid("Logitech-DJ:%s\n", __func__);
956
957         retval = hid_register_driver(&logi_djreceiver_driver);
958         if (retval)
959                 return retval;
960
961         retval = hid_register_driver(&logi_djdevice_driver);
962         if (retval)
963                 hid_unregister_driver(&logi_djreceiver_driver);
964
965         return retval;
966
967 }
968
969 static void __exit logi_dj_exit(void)
970 {
971         dbg_hid("Logitech-DJ:%s\n", __func__);
972
973         hid_unregister_driver(&logi_djdevice_driver);
974         hid_unregister_driver(&logi_djreceiver_driver);
975
976 }
977
978 module_init(logi_dj_init);
979 module_exit(logi_dj_exit);
980 MODULE_LICENSE("GPL");
981 MODULE_AUTHOR("Logitech");
982 MODULE_AUTHOR("Nestor Lopez Casado");
983 MODULE_AUTHOR("nlopezcasad@logitech.com");