xref: /openbmc/linux/drivers/hid/hid-cp2112.c (revision 827634ad)
1 /*
2  * hid-cp2112.c - Silicon Labs HID USB to SMBus master bridge
3  * Copyright (c) 2013,2014 Uplogix, Inc.
4  * David Barksdale <dbarksdale@uplogix.com>
5  *
6  * This program is free software; you can redistribute it and/or modify it
7  * under the terms and conditions of the GNU General Public License,
8  * version 2, as published by the Free Software Foundation.
9  *
10  * This program is distributed in the hope it will be useful, but WITHOUT
11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
13  * more details.
14  */
15 
16 /*
17  * The Silicon Labs CP2112 chip is a USB HID device which provides an
18  * SMBus controller for talking to slave devices and 8 GPIO pins. The
19  * host communicates with the CP2112 via raw HID reports.
20  *
21  * Data Sheet:
22  *   http://www.silabs.com/Support%20Documents/TechnicalDocs/CP2112.pdf
23  * Programming Interface Specification:
24  *   http://www.silabs.com/Support%20Documents/TechnicalDocs/AN495.pdf
25  */
26 
27 #include <linux/gpio.h>
28 #include <linux/hid.h>
29 #include <linux/i2c.h>
30 #include <linux/module.h>
31 #include <linux/nls.h>
32 #include <linux/usb/ch9.h>
33 #include "hid-ids.h"
34 
35 enum {
36 	CP2112_GPIO_CONFIG		= 0x02,
37 	CP2112_GPIO_GET			= 0x03,
38 	CP2112_GPIO_SET			= 0x04,
39 	CP2112_GET_VERSION_INFO		= 0x05,
40 	CP2112_SMBUS_CONFIG		= 0x06,
41 	CP2112_DATA_READ_REQUEST	= 0x10,
42 	CP2112_DATA_WRITE_READ_REQUEST	= 0x11,
43 	CP2112_DATA_READ_FORCE_SEND	= 0x12,
44 	CP2112_DATA_READ_RESPONSE	= 0x13,
45 	CP2112_DATA_WRITE_REQUEST	= 0x14,
46 	CP2112_TRANSFER_STATUS_REQUEST	= 0x15,
47 	CP2112_TRANSFER_STATUS_RESPONSE	= 0x16,
48 	CP2112_CANCEL_TRANSFER		= 0x17,
49 	CP2112_LOCK_BYTE		= 0x20,
50 	CP2112_USB_CONFIG		= 0x21,
51 	CP2112_MANUFACTURER_STRING	= 0x22,
52 	CP2112_PRODUCT_STRING		= 0x23,
53 	CP2112_SERIAL_STRING		= 0x24,
54 };
55 
56 enum {
57 	STATUS0_IDLE		= 0x00,
58 	STATUS0_BUSY		= 0x01,
59 	STATUS0_COMPLETE	= 0x02,
60 	STATUS0_ERROR		= 0x03,
61 };
62 
63 enum {
64 	STATUS1_TIMEOUT_NACK		= 0x00,
65 	STATUS1_TIMEOUT_BUS		= 0x01,
66 	STATUS1_ARBITRATION_LOST	= 0x02,
67 	STATUS1_READ_INCOMPLETE		= 0x03,
68 	STATUS1_WRITE_INCOMPLETE	= 0x04,
69 	STATUS1_SUCCESS			= 0x05,
70 };
71 
72 struct cp2112_smbus_config_report {
73 	u8 report;		/* CP2112_SMBUS_CONFIG */
74 	__be32 clock_speed;	/* Hz */
75 	u8 device_address;	/* Stored in the upper 7 bits */
76 	u8 auto_send_read;	/* 1 = enabled, 0 = disabled */
77 	__be16 write_timeout;	/* ms, 0 = no timeout */
78 	__be16 read_timeout;	/* ms, 0 = no timeout */
79 	u8 scl_low_timeout;	/* 1 = enabled, 0 = disabled */
80 	__be16 retry_time;	/* # of retries, 0 = no limit */
81 } __packed;
82 
83 struct cp2112_usb_config_report {
84 	u8 report;	/* CP2112_USB_CONFIG */
85 	__le16 vid;	/* Vendor ID */
86 	__le16 pid;	/* Product ID */
87 	u8 max_power;	/* Power requested in 2mA units */
88 	u8 power_mode;	/* 0x00 = bus powered
89 			   0x01 = self powered & regulator off
90 			   0x02 = self powered & regulator on */
91 	u8 release_major;
92 	u8 release_minor;
93 	u8 mask;	/* What fields to program */
94 } __packed;
95 
96 struct cp2112_read_req_report {
97 	u8 report;	/* CP2112_DATA_READ_REQUEST */
98 	u8 slave_address;
99 	__be16 length;
100 } __packed;
101 
102 struct cp2112_write_read_req_report {
103 	u8 report;	/* CP2112_DATA_WRITE_READ_REQUEST */
104 	u8 slave_address;
105 	__be16 length;
106 	u8 target_address_length;
107 	u8 target_address[16];
108 } __packed;
109 
110 struct cp2112_write_req_report {
111 	u8 report;	/* CP2112_DATA_WRITE_REQUEST */
112 	u8 slave_address;
113 	u8 length;
114 	u8 data[61];
115 } __packed;
116 
117 struct cp2112_force_read_report {
118 	u8 report;	/* CP2112_DATA_READ_FORCE_SEND */
119 	__be16 length;
120 } __packed;
121 
122 struct cp2112_xfer_status_report {
123 	u8 report;	/* CP2112_TRANSFER_STATUS_RESPONSE */
124 	u8 status0;	/* STATUS0_* */
125 	u8 status1;	/* STATUS1_* */
126 	__be16 retries;
127 	__be16 length;
128 } __packed;
129 
130 struct cp2112_string_report {
131 	u8 dummy;		/* force .string to be aligned */
132 	u8 report;		/* CP2112_*_STRING */
133 	u8 length;		/* length in bytes of everyting after .report */
134 	u8 type;		/* USB_DT_STRING */
135 	wchar_t string[30];	/* UTF16_LITTLE_ENDIAN string */
136 } __packed;
137 
138 /* Number of times to request transfer status before giving up waiting for a
139    transfer to complete. This may need to be changed if SMBUS clock, retries,
140    or read/write/scl_low timeout settings are changed. */
141 static const int XFER_STATUS_RETRIES = 10;
142 
143 /* Time in ms to wait for a CP2112_DATA_READ_RESPONSE or
144    CP2112_TRANSFER_STATUS_RESPONSE. */
145 static const int RESPONSE_TIMEOUT = 50;
146 
147 static const struct hid_device_id cp2112_devices[] = {
148 	{ HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_CP2112) },
149 	{ }
150 };
151 MODULE_DEVICE_TABLE(hid, cp2112_devices);
152 
153 struct cp2112_device {
154 	struct i2c_adapter adap;
155 	struct hid_device *hdev;
156 	wait_queue_head_t wait;
157 	u8 read_data[61];
158 	u8 read_length;
159 	int xfer_status;
160 	atomic_t read_avail;
161 	atomic_t xfer_avail;
162 	struct gpio_chip gc;
163 };
164 
165 static int gpio_push_pull = 0xFF;
166 module_param(gpio_push_pull, int, S_IRUGO | S_IWUSR);
167 MODULE_PARM_DESC(gpio_push_pull, "GPIO push-pull configuration bitmask");
168 
169 static int cp2112_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
170 {
171 	struct cp2112_device *dev = container_of(chip, struct cp2112_device,
172 						 gc);
173 	struct hid_device *hdev = dev->hdev;
174 	u8 buf[5];
175 	int ret;
176 
177 	ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
178 				       sizeof(buf), HID_FEATURE_REPORT,
179 				       HID_REQ_GET_REPORT);
180 	if (ret != sizeof(buf)) {
181 		hid_err(hdev, "error requesting GPIO config: %d\n", ret);
182 		return ret;
183 	}
184 
185 	buf[1] &= ~(1 << offset);
186 	buf[2] = gpio_push_pull;
187 
188 	ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf, sizeof(buf),
189 				 HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
190 	if (ret < 0) {
191 		hid_err(hdev, "error setting GPIO config: %d\n", ret);
192 		return ret;
193 	}
194 
195 	return 0;
196 }
197 
198 static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
199 {
200 	struct cp2112_device *dev = container_of(chip, struct cp2112_device,
201 						 gc);
202 	struct hid_device *hdev = dev->hdev;
203 	u8 buf[3];
204 	int ret;
205 
206 	buf[0] = CP2112_GPIO_SET;
207 	buf[1] = value ? 0xff : 0;
208 	buf[2] = 1 << offset;
209 
210 	ret = hid_hw_raw_request(hdev, CP2112_GPIO_SET, buf, sizeof(buf),
211 				 HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
212 	if (ret < 0)
213 		hid_err(hdev, "error setting GPIO values: %d\n", ret);
214 }
215 
216 static int cp2112_gpio_get(struct gpio_chip *chip, unsigned offset)
217 {
218 	struct cp2112_device *dev = container_of(chip, struct cp2112_device,
219 						 gc);
220 	struct hid_device *hdev = dev->hdev;
221 	u8 buf[2];
222 	int ret;
223 
224 	ret = hid_hw_raw_request(hdev, CP2112_GPIO_GET, buf, sizeof(buf),
225 				       HID_FEATURE_REPORT, HID_REQ_GET_REPORT);
226 	if (ret != sizeof(buf)) {
227 		hid_err(hdev, "error requesting GPIO values: %d\n", ret);
228 		return ret;
229 	}
230 
231 	return (buf[1] >> offset) & 1;
232 }
233 
234 static int cp2112_gpio_direction_output(struct gpio_chip *chip,
235 					unsigned offset, int value)
236 {
237 	struct cp2112_device *dev = container_of(chip, struct cp2112_device,
238 						 gc);
239 	struct hid_device *hdev = dev->hdev;
240 	u8 buf[5];
241 	int ret;
242 
243 	ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
244 				       sizeof(buf), HID_FEATURE_REPORT,
245 				       HID_REQ_GET_REPORT);
246 	if (ret != sizeof(buf)) {
247 		hid_err(hdev, "error requesting GPIO config: %d\n", ret);
248 		return ret;
249 	}
250 
251 	buf[1] |= 1 << offset;
252 	buf[2] = gpio_push_pull;
253 
254 	ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf, sizeof(buf),
255 				 HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
256 	if (ret < 0) {
257 		hid_err(hdev, "error setting GPIO config: %d\n", ret);
258 		return ret;
259 	}
260 
261 	/*
262 	 * Set gpio value when output direction is already set,
263 	 * as specified in AN495, Rev. 0.2, cpt. 4.4
264 	 */
265 	cp2112_gpio_set(chip, offset, value);
266 
267 	return 0;
268 }
269 
270 static int cp2112_hid_get(struct hid_device *hdev, unsigned char report_number,
271 			  u8 *data, size_t count, unsigned char report_type)
272 {
273 	u8 *buf;
274 	int ret;
275 
276 	buf = kmalloc(count, GFP_KERNEL);
277 	if (!buf)
278 		return -ENOMEM;
279 
280 	ret = hid_hw_raw_request(hdev, report_number, buf, count,
281 				       report_type, HID_REQ_GET_REPORT);
282 	memcpy(data, buf, count);
283 	kfree(buf);
284 	return ret;
285 }
286 
287 static int cp2112_hid_output(struct hid_device *hdev, u8 *data, size_t count,
288 			     unsigned char report_type)
289 {
290 	u8 *buf;
291 	int ret;
292 
293 	buf = kmemdup(data, count, GFP_KERNEL);
294 	if (!buf)
295 		return -ENOMEM;
296 
297 	if (report_type == HID_OUTPUT_REPORT)
298 		ret = hid_hw_output_report(hdev, buf, count);
299 	else
300 		ret = hid_hw_raw_request(hdev, buf[0], buf, count, report_type,
301 				HID_REQ_SET_REPORT);
302 
303 	kfree(buf);
304 	return ret;
305 }
306 
307 static int cp2112_wait(struct cp2112_device *dev, atomic_t *avail)
308 {
309 	int ret = 0;
310 
311 	/* We have sent either a CP2112_TRANSFER_STATUS_REQUEST or a
312 	 * CP2112_DATA_READ_FORCE_SEND and we are waiting for the response to
313 	 * come in cp2112_raw_event or timeout. There will only be one of these
314 	 * in flight at any one time. The timeout is extremely large and is a
315 	 * last resort if the CP2112 has died. If we do timeout we don't expect
316 	 * to receive the response which would cause data races, it's not like
317 	 * we can do anything about it anyway.
318 	 */
319 	ret = wait_event_interruptible_timeout(dev->wait,
320 		atomic_read(avail), msecs_to_jiffies(RESPONSE_TIMEOUT));
321 	if (-ERESTARTSYS == ret)
322 		return ret;
323 	if (!ret)
324 		return -ETIMEDOUT;
325 
326 	atomic_set(avail, 0);
327 	return 0;
328 }
329 
330 static int cp2112_xfer_status(struct cp2112_device *dev)
331 {
332 	struct hid_device *hdev = dev->hdev;
333 	u8 buf[2];
334 	int ret;
335 
336 	buf[0] = CP2112_TRANSFER_STATUS_REQUEST;
337 	buf[1] = 0x01;
338 	atomic_set(&dev->xfer_avail, 0);
339 
340 	ret = cp2112_hid_output(hdev, buf, 2, HID_OUTPUT_REPORT);
341 	if (ret < 0) {
342 		hid_warn(hdev, "Error requesting status: %d\n", ret);
343 		return ret;
344 	}
345 
346 	ret = cp2112_wait(dev, &dev->xfer_avail);
347 	if (ret)
348 		return ret;
349 
350 	return dev->xfer_status;
351 }
352 
353 static int cp2112_read(struct cp2112_device *dev, u8 *data, size_t size)
354 {
355 	struct hid_device *hdev = dev->hdev;
356 	struct cp2112_force_read_report report;
357 	int ret;
358 
359 	report.report = CP2112_DATA_READ_FORCE_SEND;
360 	report.length = cpu_to_be16(size);
361 
362 	atomic_set(&dev->read_avail, 0);
363 
364 	ret = cp2112_hid_output(hdev, &report.report, sizeof(report),
365 				HID_OUTPUT_REPORT);
366 	if (ret < 0) {
367 		hid_warn(hdev, "Error requesting data: %d\n", ret);
368 		return ret;
369 	}
370 
371 	ret = cp2112_wait(dev, &dev->read_avail);
372 	if (ret)
373 		return ret;
374 
375 	hid_dbg(hdev, "read %d of %zd bytes requested\n",
376 		dev->read_length, size);
377 
378 	if (size > dev->read_length)
379 		size = dev->read_length;
380 
381 	memcpy(data, dev->read_data, size);
382 	return dev->read_length;
383 }
384 
385 static int cp2112_read_req(void *buf, u8 slave_address, u16 length)
386 {
387 	struct cp2112_read_req_report *report = buf;
388 
389 	if (length < 1 || length > 512)
390 		return -EINVAL;
391 
392 	report->report = CP2112_DATA_READ_REQUEST;
393 	report->slave_address = slave_address << 1;
394 	report->length = cpu_to_be16(length);
395 	return sizeof(*report);
396 }
397 
398 static int cp2112_write_read_req(void *buf, u8 slave_address, u16 length,
399 				 u8 command, u8 *data, u8 data_length)
400 {
401 	struct cp2112_write_read_req_report *report = buf;
402 
403 	if (length < 1 || length > 512
404 	    || data_length > sizeof(report->target_address) - 1)
405 		return -EINVAL;
406 
407 	report->report = CP2112_DATA_WRITE_READ_REQUEST;
408 	report->slave_address = slave_address << 1;
409 	report->length = cpu_to_be16(length);
410 	report->target_address_length = data_length + 1;
411 	report->target_address[0] = command;
412 	memcpy(&report->target_address[1], data, data_length);
413 	return data_length + 6;
414 }
415 
416 static int cp2112_write_req(void *buf, u8 slave_address, u8 command, u8 *data,
417 			    u8 data_length)
418 {
419 	struct cp2112_write_req_report *report = buf;
420 
421 	if (data_length > sizeof(report->data) - 1)
422 		return -EINVAL;
423 
424 	report->report = CP2112_DATA_WRITE_REQUEST;
425 	report->slave_address = slave_address << 1;
426 	report->length = data_length + 1;
427 	report->data[0] = command;
428 	memcpy(&report->data[1], data, data_length);
429 	return data_length + 4;
430 }
431 
432 static int cp2112_i2c_write_req(void *buf, u8 slave_address, u8 *data,
433 				u8 data_length)
434 {
435 	struct cp2112_write_req_report *report = buf;
436 
437 	if (data_length > sizeof(report->data))
438 		return -EINVAL;
439 
440 	report->report = CP2112_DATA_WRITE_REQUEST;
441 	report->slave_address = slave_address << 1;
442 	report->length = data_length;
443 	memcpy(report->data, data, data_length);
444 	return data_length + 3;
445 }
446 
447 static int cp2112_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
448 			   int num)
449 {
450 	struct cp2112_device *dev = (struct cp2112_device *)adap->algo_data;
451 	struct hid_device *hdev = dev->hdev;
452 	u8 buf[64];
453 	ssize_t count;
454 	unsigned int retries;
455 	int ret;
456 
457 	hid_dbg(hdev, "I2C %d messages\n", num);
458 
459 	if (num != 1) {
460 		hid_err(hdev,
461 			"Multi-message I2C transactions not supported\n");
462 		return -EOPNOTSUPP;
463 	}
464 
465 	if (msgs->flags & I2C_M_RD)
466 		count = cp2112_read_req(buf, msgs->addr, msgs->len);
467 	else
468 		count = cp2112_i2c_write_req(buf, msgs->addr, msgs->buf,
469 					     msgs->len);
470 
471 	if (count < 0)
472 		return count;
473 
474 	ret = hid_hw_power(hdev, PM_HINT_FULLON);
475 	if (ret < 0) {
476 		hid_err(hdev, "power management error: %d\n", ret);
477 		return ret;
478 	}
479 
480 	ret = cp2112_hid_output(hdev, buf, count, HID_OUTPUT_REPORT);
481 	if (ret < 0) {
482 		hid_warn(hdev, "Error starting transaction: %d\n", ret);
483 		goto power_normal;
484 	}
485 
486 	for (retries = 0; retries < XFER_STATUS_RETRIES; ++retries) {
487 		ret = cp2112_xfer_status(dev);
488 		if (-EBUSY == ret)
489 			continue;
490 		if (ret < 0)
491 			goto power_normal;
492 		break;
493 	}
494 
495 	if (XFER_STATUS_RETRIES <= retries) {
496 		hid_warn(hdev, "Transfer timed out, cancelling.\n");
497 		buf[0] = CP2112_CANCEL_TRANSFER;
498 		buf[1] = 0x01;
499 
500 		ret = cp2112_hid_output(hdev, buf, 2, HID_OUTPUT_REPORT);
501 		if (ret < 0)
502 			hid_warn(hdev, "Error cancelling transaction: %d\n",
503 				 ret);
504 
505 		ret = -ETIMEDOUT;
506 		goto power_normal;
507 	}
508 
509 	if (!(msgs->flags & I2C_M_RD))
510 		goto finish;
511 
512 	ret = cp2112_read(dev, msgs->buf, msgs->len);
513 	if (ret < 0)
514 		goto power_normal;
515 	if (ret != msgs->len) {
516 		hid_warn(hdev, "short read: %d < %d\n", ret, msgs->len);
517 		ret = -EIO;
518 		goto power_normal;
519 	}
520 
521 finish:
522 	/* return the number of transferred messages */
523 	ret = 1;
524 
525 power_normal:
526 	hid_hw_power(hdev, PM_HINT_NORMAL);
527 	hid_dbg(hdev, "I2C transfer finished: %d\n", ret);
528 	return ret;
529 }
530 
531 static int cp2112_xfer(struct i2c_adapter *adap, u16 addr,
532 		       unsigned short flags, char read_write, u8 command,
533 		       int size, union i2c_smbus_data *data)
534 {
535 	struct cp2112_device *dev = (struct cp2112_device *)adap->algo_data;
536 	struct hid_device *hdev = dev->hdev;
537 	u8 buf[64];
538 	__be16 word;
539 	ssize_t count;
540 	size_t read_length = 0;
541 	unsigned int retries;
542 	int ret;
543 
544 	hid_dbg(hdev, "%s addr 0x%x flags 0x%x cmd 0x%x size %d\n",
545 		read_write == I2C_SMBUS_WRITE ? "write" : "read",
546 		addr, flags, command, size);
547 
548 	switch (size) {
549 	case I2C_SMBUS_BYTE:
550 		read_length = 1;
551 
552 		if (I2C_SMBUS_READ == read_write)
553 			count = cp2112_read_req(buf, addr, read_length);
554 		else
555 			count = cp2112_write_req(buf, addr, data->byte, NULL,
556 						 0);
557 		break;
558 	case I2C_SMBUS_BYTE_DATA:
559 		read_length = 1;
560 
561 		if (I2C_SMBUS_READ == read_write)
562 			count = cp2112_write_read_req(buf, addr, read_length,
563 						      command, NULL, 0);
564 		else
565 			count = cp2112_write_req(buf, addr, command,
566 						 &data->byte, 1);
567 		break;
568 	case I2C_SMBUS_WORD_DATA:
569 		read_length = 2;
570 		word = cpu_to_be16(data->word);
571 
572 		if (I2C_SMBUS_READ == read_write)
573 			count = cp2112_write_read_req(buf, addr, read_length,
574 						      command, NULL, 0);
575 		else
576 			count = cp2112_write_req(buf, addr, command,
577 						 (u8 *)&word, 2);
578 		break;
579 	case I2C_SMBUS_PROC_CALL:
580 		size = I2C_SMBUS_WORD_DATA;
581 		read_write = I2C_SMBUS_READ;
582 		read_length = 2;
583 		word = cpu_to_be16(data->word);
584 
585 		count = cp2112_write_read_req(buf, addr, read_length, command,
586 					      (u8 *)&word, 2);
587 		break;
588 	case I2C_SMBUS_I2C_BLOCK_DATA:
589 		size = I2C_SMBUS_BLOCK_DATA;
590 		/* fallthrough */
591 	case I2C_SMBUS_BLOCK_DATA:
592 		if (I2C_SMBUS_READ == read_write) {
593 			count = cp2112_write_read_req(buf, addr,
594 						      I2C_SMBUS_BLOCK_MAX,
595 						      command, NULL, 0);
596 		} else {
597 			count = cp2112_write_req(buf, addr, command,
598 						 data->block,
599 						 data->block[0] + 1);
600 		}
601 		break;
602 	case I2C_SMBUS_BLOCK_PROC_CALL:
603 		size = I2C_SMBUS_BLOCK_DATA;
604 		read_write = I2C_SMBUS_READ;
605 
606 		count = cp2112_write_read_req(buf, addr, I2C_SMBUS_BLOCK_MAX,
607 					      command, data->block,
608 					      data->block[0] + 1);
609 		break;
610 	default:
611 		hid_warn(hdev, "Unsupported transaction %d\n", size);
612 		return -EOPNOTSUPP;
613 	}
614 
615 	if (count < 0)
616 		return count;
617 
618 	ret = hid_hw_power(hdev, PM_HINT_FULLON);
619 	if (ret < 0) {
620 		hid_err(hdev, "power management error: %d\n", ret);
621 		return ret;
622 	}
623 
624 	ret = cp2112_hid_output(hdev, buf, count, HID_OUTPUT_REPORT);
625 	if (ret < 0) {
626 		hid_warn(hdev, "Error starting transaction: %d\n", ret);
627 		goto power_normal;
628 	}
629 
630 	for (retries = 0; retries < XFER_STATUS_RETRIES; ++retries) {
631 		ret = cp2112_xfer_status(dev);
632 		if (-EBUSY == ret)
633 			continue;
634 		if (ret < 0)
635 			goto power_normal;
636 		break;
637 	}
638 
639 	if (XFER_STATUS_RETRIES <= retries) {
640 		hid_warn(hdev, "Transfer timed out, cancelling.\n");
641 		buf[0] = CP2112_CANCEL_TRANSFER;
642 		buf[1] = 0x01;
643 
644 		ret = cp2112_hid_output(hdev, buf, 2, HID_OUTPUT_REPORT);
645 		if (ret < 0)
646 			hid_warn(hdev, "Error cancelling transaction: %d\n",
647 				 ret);
648 
649 		ret = -ETIMEDOUT;
650 		goto power_normal;
651 	}
652 
653 	if (I2C_SMBUS_WRITE == read_write) {
654 		ret = 0;
655 		goto power_normal;
656 	}
657 
658 	if (I2C_SMBUS_BLOCK_DATA == size)
659 		read_length = ret;
660 
661 	ret = cp2112_read(dev, buf, read_length);
662 	if (ret < 0)
663 		goto power_normal;
664 	if (ret != read_length) {
665 		hid_warn(hdev, "short read: %d < %zd\n", ret, read_length);
666 		ret = -EIO;
667 		goto power_normal;
668 	}
669 
670 	switch (size) {
671 	case I2C_SMBUS_BYTE:
672 	case I2C_SMBUS_BYTE_DATA:
673 		data->byte = buf[0];
674 		break;
675 	case I2C_SMBUS_WORD_DATA:
676 		data->word = be16_to_cpup((__be16 *)buf);
677 		break;
678 	case I2C_SMBUS_BLOCK_DATA:
679 		if (read_length > I2C_SMBUS_BLOCK_MAX) {
680 			ret = -EPROTO;
681 			goto power_normal;
682 		}
683 
684 		memcpy(data->block, buf, read_length);
685 		break;
686 	}
687 
688 	ret = 0;
689 power_normal:
690 	hid_hw_power(hdev, PM_HINT_NORMAL);
691 	hid_dbg(hdev, "transfer finished: %d\n", ret);
692 	return ret;
693 }
694 
695 static u32 cp2112_functionality(struct i2c_adapter *adap)
696 {
697 	return I2C_FUNC_I2C |
698 		I2C_FUNC_SMBUS_BYTE |
699 		I2C_FUNC_SMBUS_BYTE_DATA |
700 		I2C_FUNC_SMBUS_WORD_DATA |
701 		I2C_FUNC_SMBUS_BLOCK_DATA |
702 		I2C_FUNC_SMBUS_I2C_BLOCK |
703 		I2C_FUNC_SMBUS_PROC_CALL |
704 		I2C_FUNC_SMBUS_BLOCK_PROC_CALL;
705 }
706 
707 static const struct i2c_algorithm smbus_algorithm = {
708 	.master_xfer	= cp2112_i2c_xfer,
709 	.smbus_xfer	= cp2112_xfer,
710 	.functionality	= cp2112_functionality,
711 };
712 
713 static int cp2112_get_usb_config(struct hid_device *hdev,
714 				 struct cp2112_usb_config_report *cfg)
715 {
716 	int ret;
717 
718 	ret = cp2112_hid_get(hdev, CP2112_USB_CONFIG, (u8 *)cfg, sizeof(*cfg),
719 			     HID_FEATURE_REPORT);
720 	if (ret != sizeof(*cfg)) {
721 		hid_err(hdev, "error reading usb config: %d\n", ret);
722 		if (ret < 0)
723 			return ret;
724 		return -EIO;
725 	}
726 
727 	return 0;
728 }
729 
730 static int cp2112_set_usb_config(struct hid_device *hdev,
731 				 struct cp2112_usb_config_report *cfg)
732 {
733 	int ret;
734 
735 	BUG_ON(cfg->report != CP2112_USB_CONFIG);
736 
737 	ret = cp2112_hid_output(hdev, (u8 *)cfg, sizeof(*cfg),
738 				HID_FEATURE_REPORT);
739 	if (ret != sizeof(*cfg)) {
740 		hid_err(hdev, "error writing usb config: %d\n", ret);
741 		if (ret < 0)
742 			return ret;
743 		return -EIO;
744 	}
745 
746 	return 0;
747 }
748 
749 static void chmod_sysfs_attrs(struct hid_device *hdev);
750 
751 #define CP2112_CONFIG_ATTR(name, store, format, ...) \
752 static ssize_t name##_store(struct device *kdev, \
753 			    struct device_attribute *attr, const char *buf, \
754 			    size_t count) \
755 { \
756 	struct hid_device *hdev = container_of(kdev, struct hid_device, dev); \
757 	struct cp2112_usb_config_report cfg; \
758 	int ret = cp2112_get_usb_config(hdev, &cfg); \
759 	if (ret) \
760 		return ret; \
761 	store; \
762 	ret = cp2112_set_usb_config(hdev, &cfg); \
763 	if (ret) \
764 		return ret; \
765 	chmod_sysfs_attrs(hdev); \
766 	return count; \
767 } \
768 static ssize_t name##_show(struct device *kdev, \
769 			   struct device_attribute *attr, char *buf) \
770 { \
771 	struct hid_device *hdev = container_of(kdev, struct hid_device, dev); \
772 	struct cp2112_usb_config_report cfg; \
773 	int ret = cp2112_get_usb_config(hdev, &cfg); \
774 	if (ret) \
775 		return ret; \
776 	return scnprintf(buf, PAGE_SIZE, format, ##__VA_ARGS__); \
777 } \
778 static DEVICE_ATTR_RW(name);
779 
780 CP2112_CONFIG_ATTR(vendor_id, ({
781 	u16 vid;
782 
783 	if (sscanf(buf, "%hi", &vid) != 1)
784 		return -EINVAL;
785 
786 	cfg.vid = cpu_to_le16(vid);
787 	cfg.mask = 0x01;
788 }), "0x%04x\n", le16_to_cpu(cfg.vid));
789 
790 CP2112_CONFIG_ATTR(product_id, ({
791 	u16 pid;
792 
793 	if (sscanf(buf, "%hi", &pid) != 1)
794 		return -EINVAL;
795 
796 	cfg.pid = cpu_to_le16(pid);
797 	cfg.mask = 0x02;
798 }), "0x%04x\n", le16_to_cpu(cfg.pid));
799 
800 CP2112_CONFIG_ATTR(max_power, ({
801 	int mA;
802 
803 	if (sscanf(buf, "%i", &mA) != 1)
804 		return -EINVAL;
805 
806 	cfg.max_power = (mA + 1) / 2;
807 	cfg.mask = 0x04;
808 }), "%u mA\n", cfg.max_power * 2);
809 
810 CP2112_CONFIG_ATTR(power_mode, ({
811 	if (sscanf(buf, "%hhi", &cfg.power_mode) != 1)
812 		return -EINVAL;
813 
814 	cfg.mask = 0x08;
815 }), "%u\n", cfg.power_mode);
816 
817 CP2112_CONFIG_ATTR(release_version, ({
818 	if (sscanf(buf, "%hhi.%hhi", &cfg.release_major, &cfg.release_minor)
819 	    != 2)
820 		return -EINVAL;
821 
822 	cfg.mask = 0x10;
823 }), "%u.%u\n", cfg.release_major, cfg.release_minor);
824 
825 #undef CP2112_CONFIG_ATTR
826 
827 struct cp2112_pstring_attribute {
828 	struct device_attribute attr;
829 	unsigned char report;
830 };
831 
832 static ssize_t pstr_store(struct device *kdev,
833 			  struct device_attribute *kattr, const char *buf,
834 			  size_t count)
835 {
836 	struct hid_device *hdev = container_of(kdev, struct hid_device, dev);
837 	struct cp2112_pstring_attribute *attr =
838 		container_of(kattr, struct cp2112_pstring_attribute, attr);
839 	struct cp2112_string_report report;
840 	int ret;
841 
842 	memset(&report, 0, sizeof(report));
843 
844 	ret = utf8s_to_utf16s(buf, count, UTF16_LITTLE_ENDIAN,
845 			      report.string, ARRAY_SIZE(report.string));
846 	report.report = attr->report;
847 	report.length = ret * sizeof(report.string[0]) + 2;
848 	report.type = USB_DT_STRING;
849 
850 	ret = cp2112_hid_output(hdev, &report.report, report.length + 1,
851 				HID_FEATURE_REPORT);
852 	if (ret != report.length + 1) {
853 		hid_err(hdev, "error writing %s string: %d\n", kattr->attr.name,
854 			ret);
855 		if (ret < 0)
856 			return ret;
857 		return -EIO;
858 	}
859 
860 	chmod_sysfs_attrs(hdev);
861 	return count;
862 }
863 
864 static ssize_t pstr_show(struct device *kdev,
865 			 struct device_attribute *kattr, char *buf)
866 {
867 	struct hid_device *hdev = container_of(kdev, struct hid_device, dev);
868 	struct cp2112_pstring_attribute *attr =
869 		container_of(kattr, struct cp2112_pstring_attribute, attr);
870 	struct cp2112_string_report report;
871 	u8 length;
872 	int ret;
873 
874 	ret = cp2112_hid_get(hdev, attr->report, &report.report,
875 			     sizeof(report) - 1, HID_FEATURE_REPORT);
876 	if (ret < 3) {
877 		hid_err(hdev, "error reading %s string: %d\n", kattr->attr.name,
878 			ret);
879 		if (ret < 0)
880 			return ret;
881 		return -EIO;
882 	}
883 
884 	if (report.length < 2) {
885 		hid_err(hdev, "invalid %s string length: %d\n",
886 			kattr->attr.name, report.length);
887 		return -EIO;
888 	}
889 
890 	length = report.length > ret - 1 ? ret - 1 : report.length;
891 	length = (length - 2) / sizeof(report.string[0]);
892 	ret = utf16s_to_utf8s(report.string, length, UTF16_LITTLE_ENDIAN, buf,
893 			      PAGE_SIZE - 1);
894 	buf[ret++] = '\n';
895 	return ret;
896 }
897 
898 #define CP2112_PSTR_ATTR(name, _report) \
899 static struct cp2112_pstring_attribute dev_attr_##name = { \
900 	.attr = __ATTR(name, (S_IWUSR | S_IRUGO), pstr_show, pstr_store), \
901 	.report = _report, \
902 };
903 
904 CP2112_PSTR_ATTR(manufacturer,	CP2112_MANUFACTURER_STRING);
905 CP2112_PSTR_ATTR(product,	CP2112_PRODUCT_STRING);
906 CP2112_PSTR_ATTR(serial,	CP2112_SERIAL_STRING);
907 
908 #undef CP2112_PSTR_ATTR
909 
910 static const struct attribute_group cp2112_attr_group = {
911 	.attrs = (struct attribute *[]){
912 		&dev_attr_vendor_id.attr,
913 		&dev_attr_product_id.attr,
914 		&dev_attr_max_power.attr,
915 		&dev_attr_power_mode.attr,
916 		&dev_attr_release_version.attr,
917 		&dev_attr_manufacturer.attr.attr,
918 		&dev_attr_product.attr.attr,
919 		&dev_attr_serial.attr.attr,
920 		NULL
921 	}
922 };
923 
924 /* Chmoding our sysfs attributes is simply a way to expose which fields in the
925  * PROM have already been programmed. We do not depend on this preventing
926  * writing to these attributes since the CP2112 will simply ignore writes to
927  * already-programmed fields. This is why there is no sense in fixing this
928  * racy behaviour.
929  */
930 static void chmod_sysfs_attrs(struct hid_device *hdev)
931 {
932 	struct attribute **attr;
933 	u8 buf[2];
934 	int ret;
935 
936 	ret = cp2112_hid_get(hdev, CP2112_LOCK_BYTE, buf, sizeof(buf),
937 			     HID_FEATURE_REPORT);
938 	if (ret != sizeof(buf)) {
939 		hid_err(hdev, "error reading lock byte: %d\n", ret);
940 		return;
941 	}
942 
943 	for (attr = cp2112_attr_group.attrs; *attr; ++attr) {
944 		umode_t mode = (buf[1] & 1) ? S_IWUSR | S_IRUGO : S_IRUGO;
945 		ret = sysfs_chmod_file(&hdev->dev.kobj, *attr, mode);
946 		if (ret < 0)
947 			hid_err(hdev, "error chmoding sysfs file %s\n",
948 				(*attr)->name);
949 		buf[1] >>= 1;
950 	}
951 }
952 
953 static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
954 {
955 	struct cp2112_device *dev;
956 	u8 buf[3];
957 	struct cp2112_smbus_config_report config;
958 	int ret;
959 
960 	ret = hid_parse(hdev);
961 	if (ret) {
962 		hid_err(hdev, "parse failed\n");
963 		return ret;
964 	}
965 
966 	ret = hid_hw_start(hdev, HID_CONNECT_HIDRAW);
967 	if (ret) {
968 		hid_err(hdev, "hw start failed\n");
969 		return ret;
970 	}
971 
972 	ret = hid_hw_open(hdev);
973 	if (ret) {
974 		hid_err(hdev, "hw open failed\n");
975 		goto err_hid_stop;
976 	}
977 
978 	ret = hid_hw_power(hdev, PM_HINT_FULLON);
979 	if (ret < 0) {
980 		hid_err(hdev, "power management error: %d\n", ret);
981 		goto err_hid_close;
982 	}
983 
984 	ret = cp2112_hid_get(hdev, CP2112_GET_VERSION_INFO, buf, sizeof(buf),
985 			     HID_FEATURE_REPORT);
986 	if (ret != sizeof(buf)) {
987 		hid_err(hdev, "error requesting version\n");
988 		if (ret >= 0)
989 			ret = -EIO;
990 		goto err_power_normal;
991 	}
992 
993 	hid_info(hdev, "Part Number: 0x%02X Device Version: 0x%02X\n",
994 		 buf[1], buf[2]);
995 
996 	ret = cp2112_hid_get(hdev, CP2112_SMBUS_CONFIG, (u8 *)&config,
997 			     sizeof(config), HID_FEATURE_REPORT);
998 	if (ret != sizeof(config)) {
999 		hid_err(hdev, "error requesting SMBus config\n");
1000 		if (ret >= 0)
1001 			ret = -EIO;
1002 		goto err_power_normal;
1003 	}
1004 
1005 	config.retry_time = cpu_to_be16(1);
1006 
1007 	ret = cp2112_hid_output(hdev, (u8 *)&config, sizeof(config),
1008 				HID_FEATURE_REPORT);
1009 	if (ret != sizeof(config)) {
1010 		hid_err(hdev, "error setting SMBus config\n");
1011 		if (ret >= 0)
1012 			ret = -EIO;
1013 		goto err_power_normal;
1014 	}
1015 
1016 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
1017 	if (!dev) {
1018 		ret = -ENOMEM;
1019 		goto err_power_normal;
1020 	}
1021 
1022 	hid_set_drvdata(hdev, (void *)dev);
1023 	dev->hdev		= hdev;
1024 	dev->adap.owner		= THIS_MODULE;
1025 	dev->adap.class		= I2C_CLASS_HWMON;
1026 	dev->adap.algo		= &smbus_algorithm;
1027 	dev->adap.algo_data	= dev;
1028 	dev->adap.dev.parent	= &hdev->dev;
1029 	snprintf(dev->adap.name, sizeof(dev->adap.name),
1030 		 "CP2112 SMBus Bridge on hiddev%d", hdev->minor);
1031 	init_waitqueue_head(&dev->wait);
1032 
1033 	hid_device_io_start(hdev);
1034 	ret = i2c_add_adapter(&dev->adap);
1035 	hid_device_io_stop(hdev);
1036 
1037 	if (ret) {
1038 		hid_err(hdev, "error registering i2c adapter\n");
1039 		goto err_free_dev;
1040 	}
1041 
1042 	hid_dbg(hdev, "adapter registered\n");
1043 
1044 	dev->gc.label			= "cp2112_gpio";
1045 	dev->gc.direction_input		= cp2112_gpio_direction_input;
1046 	dev->gc.direction_output	= cp2112_gpio_direction_output;
1047 	dev->gc.set			= cp2112_gpio_set;
1048 	dev->gc.get			= cp2112_gpio_get;
1049 	dev->gc.base			= -1;
1050 	dev->gc.ngpio			= 8;
1051 	dev->gc.can_sleep		= 1;
1052 	dev->gc.dev			= &hdev->dev;
1053 
1054 	ret = gpiochip_add(&dev->gc);
1055 	if (ret < 0) {
1056 		hid_err(hdev, "error registering gpio chip\n");
1057 		goto err_free_i2c;
1058 	}
1059 
1060 	ret = sysfs_create_group(&hdev->dev.kobj, &cp2112_attr_group);
1061 	if (ret < 0) {
1062 		hid_err(hdev, "error creating sysfs attrs\n");
1063 		goto err_gpiochip_remove;
1064 	}
1065 
1066 	chmod_sysfs_attrs(hdev);
1067 	hid_hw_power(hdev, PM_HINT_NORMAL);
1068 
1069 	return ret;
1070 
1071 err_gpiochip_remove:
1072 	gpiochip_remove(&dev->gc);
1073 err_free_i2c:
1074 	i2c_del_adapter(&dev->adap);
1075 err_free_dev:
1076 	kfree(dev);
1077 err_power_normal:
1078 	hid_hw_power(hdev, PM_HINT_NORMAL);
1079 err_hid_close:
1080 	hid_hw_close(hdev);
1081 err_hid_stop:
1082 	hid_hw_stop(hdev);
1083 	return ret;
1084 }
1085 
1086 static void cp2112_remove(struct hid_device *hdev)
1087 {
1088 	struct cp2112_device *dev = hid_get_drvdata(hdev);
1089 
1090 	sysfs_remove_group(&hdev->dev.kobj, &cp2112_attr_group);
1091 	gpiochip_remove(&dev->gc);
1092 	i2c_del_adapter(&dev->adap);
1093 	/* i2c_del_adapter has finished removing all i2c devices from our
1094 	 * adapter. Well behaved devices should no longer call our cp2112_xfer
1095 	 * and should have waited for any pending calls to finish. It has also
1096 	 * waited for device_unregister(&adap->dev) to complete. Therefore we
1097 	 * can safely free our struct cp2112_device.
1098 	 */
1099 	hid_hw_close(hdev);
1100 	hid_hw_stop(hdev);
1101 	kfree(dev);
1102 }
1103 
1104 static int cp2112_raw_event(struct hid_device *hdev, struct hid_report *report,
1105 			    u8 *data, int size)
1106 {
1107 	struct cp2112_device *dev = hid_get_drvdata(hdev);
1108 	struct cp2112_xfer_status_report *xfer = (void *)data;
1109 
1110 	switch (data[0]) {
1111 	case CP2112_TRANSFER_STATUS_RESPONSE:
1112 		hid_dbg(hdev, "xfer status: %02x %02x %04x %04x\n",
1113 			xfer->status0, xfer->status1,
1114 			be16_to_cpu(xfer->retries), be16_to_cpu(xfer->length));
1115 
1116 		switch (xfer->status0) {
1117 		case STATUS0_IDLE:
1118 			dev->xfer_status = -EAGAIN;
1119 			break;
1120 		case STATUS0_BUSY:
1121 			dev->xfer_status = -EBUSY;
1122 			break;
1123 		case STATUS0_COMPLETE:
1124 			dev->xfer_status = be16_to_cpu(xfer->length);
1125 			break;
1126 		case STATUS0_ERROR:
1127 			switch (xfer->status1) {
1128 			case STATUS1_TIMEOUT_NACK:
1129 			case STATUS1_TIMEOUT_BUS:
1130 				dev->xfer_status = -ETIMEDOUT;
1131 				break;
1132 			default:
1133 				dev->xfer_status = -EIO;
1134 				break;
1135 			}
1136 			break;
1137 		default:
1138 			dev->xfer_status = -EINVAL;
1139 			break;
1140 		}
1141 
1142 		atomic_set(&dev->xfer_avail, 1);
1143 		break;
1144 	case CP2112_DATA_READ_RESPONSE:
1145 		hid_dbg(hdev, "read response: %02x %02x\n", data[1], data[2]);
1146 
1147 		dev->read_length = data[2];
1148 		if (dev->read_length > sizeof(dev->read_data))
1149 			dev->read_length = sizeof(dev->read_data);
1150 
1151 		memcpy(dev->read_data, &data[3], dev->read_length);
1152 		atomic_set(&dev->read_avail, 1);
1153 		break;
1154 	default:
1155 		hid_err(hdev, "unknown report\n");
1156 
1157 		return 0;
1158 	}
1159 
1160 	wake_up_interruptible(&dev->wait);
1161 	return 1;
1162 }
1163 
1164 static struct hid_driver cp2112_driver = {
1165 	.name		= "cp2112",
1166 	.id_table	= cp2112_devices,
1167 	.probe		= cp2112_probe,
1168 	.remove		= cp2112_remove,
1169 	.raw_event	= cp2112_raw_event,
1170 };
1171 
1172 module_hid_driver(cp2112_driver);
1173 MODULE_DESCRIPTION("Silicon Labs HID USB to SMBus master bridge");
1174 MODULE_AUTHOR("David Barksdale <dbarksdale@uplogix.com>");
1175 MODULE_LICENSE("GPL");
1176 
1177