1 /*
2  *  HIDPP protocol for Logitech Unifying receivers
3  *
4  *  Copyright (c) 2011 Logitech (c)
5  *  Copyright (c) 2012-2013 Google (c)
6  *  Copyright (c) 2013-2014 Red Hat Inc.
7  */
8 
9 /*
10  * This program is free software; you can redistribute it and/or modify it
11  * under the terms of the GNU General Public License as published by the Free
12  * Software Foundation; version 2 of the License.
13  */
14 
15 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
16 
17 #include <linux/device.h>
18 #include <linux/hid.h>
19 #include <linux/module.h>
20 #include <linux/slab.h>
21 #include <linux/sched.h>
22 #include <linux/kfifo.h>
23 #include <linux/input/mt.h>
24 #include <asm/unaligned.h>
25 #include "hid-ids.h"
26 
27 MODULE_LICENSE("GPL");
28 MODULE_AUTHOR("Benjamin Tissoires <benjamin.tissoires@gmail.com>");
29 MODULE_AUTHOR("Nestor Lopez Casado <nlopezcasad@logitech.com>");
30 
31 static bool disable_raw_mode;
32 module_param(disable_raw_mode, bool, 0644);
33 MODULE_PARM_DESC(disable_raw_mode,
34 	"Disable Raw mode reporting for touchpads and keep firmware gestures.");
35 
36 static bool disable_tap_to_click;
37 module_param(disable_tap_to_click, bool, 0644);
38 MODULE_PARM_DESC(disable_tap_to_click,
39 	"Disable Tap-To-Click mode reporting for touchpads (only on the K400 currently).");
40 
41 #define REPORT_ID_HIDPP_SHORT			0x10
42 #define REPORT_ID_HIDPP_LONG			0x11
43 
44 #define HIDPP_REPORT_SHORT_LENGTH		7
45 #define HIDPP_REPORT_LONG_LENGTH		20
46 
47 #define HIDPP_QUIRK_CLASS_WTP			BIT(0)
48 #define HIDPP_QUIRK_CLASS_M560			BIT(1)
49 #define HIDPP_QUIRK_CLASS_K400			BIT(2)
50 
51 /* bits 2..20 are reserved for classes */
52 #define HIDPP_QUIRK_CONNECT_EVENTS		BIT(21)
53 #define HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS	BIT(22)
54 #define HIDPP_QUIRK_NO_HIDINPUT			BIT(23)
55 
56 #define HIDPP_QUIRK_DELAYED_INIT		(HIDPP_QUIRK_NO_HIDINPUT | \
57 						 HIDPP_QUIRK_CONNECT_EVENTS)
58 
59 /*
60  * There are two hidpp protocols in use, the first version hidpp10 is known
61  * as register access protocol or RAP, the second version hidpp20 is known as
62  * feature access protocol or FAP
63  *
64  * Most older devices (including the Unifying usb receiver) use the RAP protocol
65  * where as most newer devices use the FAP protocol. Both protocols are
66  * compatible with the underlying transport, which could be usb, Unifiying, or
67  * bluetooth. The message lengths are defined by the hid vendor specific report
68  * descriptor for the HIDPP_SHORT report type (total message lenth 7 bytes) and
69  * the HIDPP_LONG report type (total message length 20 bytes)
70  *
71  * The RAP protocol uses both report types, whereas the FAP only uses HIDPP_LONG
72  * messages. The Unifying receiver itself responds to RAP messages (device index
73  * is 0xFF for the receiver), and all messages (short or long) with a device
74  * index between 1 and 6 are passed untouched to the corresponding paired
75  * Unifying device.
76  *
77  * The paired device can be RAP or FAP, it will receive the message untouched
78  * from the Unifiying receiver.
79  */
80 
81 struct fap {
82 	u8 feature_index;
83 	u8 funcindex_clientid;
84 	u8 params[HIDPP_REPORT_LONG_LENGTH - 4U];
85 };
86 
87 struct rap {
88 	u8 sub_id;
89 	u8 reg_address;
90 	u8 params[HIDPP_REPORT_LONG_LENGTH - 4U];
91 };
92 
93 struct hidpp_report {
94 	u8 report_id;
95 	u8 device_index;
96 	union {
97 		struct fap fap;
98 		struct rap rap;
99 		u8 rawbytes[sizeof(struct fap)];
100 	};
101 } __packed;
102 
103 struct hidpp_device {
104 	struct hid_device *hid_dev;
105 	struct mutex send_mutex;
106 	void *send_receive_buf;
107 	char *name;		/* will never be NULL and should not be freed */
108 	wait_queue_head_t wait;
109 	bool answer_available;
110 	u8 protocol_major;
111 	u8 protocol_minor;
112 
113 	void *private_data;
114 
115 	struct work_struct work;
116 	struct kfifo delayed_work_fifo;
117 	atomic_t connected;
118 	struct input_dev *delayed_input;
119 
120 	unsigned long quirks;
121 };
122 
123 
124 /* HID++ 1.0 error codes */
125 #define HIDPP_ERROR				0x8f
126 #define HIDPP_ERROR_SUCCESS			0x00
127 #define HIDPP_ERROR_INVALID_SUBID		0x01
128 #define HIDPP_ERROR_INVALID_ADRESS		0x02
129 #define HIDPP_ERROR_INVALID_VALUE		0x03
130 #define HIDPP_ERROR_CONNECT_FAIL		0x04
131 #define HIDPP_ERROR_TOO_MANY_DEVICES		0x05
132 #define HIDPP_ERROR_ALREADY_EXISTS		0x06
133 #define HIDPP_ERROR_BUSY			0x07
134 #define HIDPP_ERROR_UNKNOWN_DEVICE		0x08
135 #define HIDPP_ERROR_RESOURCE_ERROR		0x09
136 #define HIDPP_ERROR_REQUEST_UNAVAILABLE		0x0a
137 #define HIDPP_ERROR_INVALID_PARAM_VALUE		0x0b
138 #define HIDPP_ERROR_WRONG_PIN_CODE		0x0c
139 /* HID++ 2.0 error codes */
140 #define HIDPP20_ERROR				0xff
141 
142 static void hidpp_connect_event(struct hidpp_device *hidpp_dev);
143 
144 static int __hidpp_send_report(struct hid_device *hdev,
145 				struct hidpp_report *hidpp_report)
146 {
147 	int fields_count, ret;
148 
149 	switch (hidpp_report->report_id) {
150 	case REPORT_ID_HIDPP_SHORT:
151 		fields_count = HIDPP_REPORT_SHORT_LENGTH;
152 		break;
153 	case REPORT_ID_HIDPP_LONG:
154 		fields_count = HIDPP_REPORT_LONG_LENGTH;
155 		break;
156 	default:
157 		return -ENODEV;
158 	}
159 
160 	/*
161 	 * set the device_index as the receiver, it will be overwritten by
162 	 * hid_hw_request if needed
163 	 */
164 	hidpp_report->device_index = 0xff;
165 
166 	ret = hid_hw_raw_request(hdev, hidpp_report->report_id,
167 		(u8 *)hidpp_report, fields_count, HID_OUTPUT_REPORT,
168 		HID_REQ_SET_REPORT);
169 
170 	return ret == fields_count ? 0 : -1;
171 }
172 
173 /**
174  * hidpp_send_message_sync() returns 0 in case of success, and something else
175  * in case of a failure.
176  * - If ' something else' is positive, that means that an error has been raised
177  *   by the protocol itself.
178  * - If ' something else' is negative, that means that we had a classic error
179  *   (-ENOMEM, -EPIPE, etc...)
180  */
181 static int hidpp_send_message_sync(struct hidpp_device *hidpp,
182 	struct hidpp_report *message,
183 	struct hidpp_report *response)
184 {
185 	int ret;
186 
187 	mutex_lock(&hidpp->send_mutex);
188 
189 	hidpp->send_receive_buf = response;
190 	hidpp->answer_available = false;
191 
192 	/*
193 	 * So that we can later validate the answer when it arrives
194 	 * in hidpp_raw_event
195 	 */
196 	*response = *message;
197 
198 	ret = __hidpp_send_report(hidpp->hid_dev, message);
199 
200 	if (ret) {
201 		dbg_hid("__hidpp_send_report returned err: %d\n", ret);
202 		memset(response, 0, sizeof(struct hidpp_report));
203 		goto exit;
204 	}
205 
206 	if (!wait_event_timeout(hidpp->wait, hidpp->answer_available,
207 				5*HZ)) {
208 		dbg_hid("%s:timeout waiting for response\n", __func__);
209 		memset(response, 0, sizeof(struct hidpp_report));
210 		ret = -ETIMEDOUT;
211 	}
212 
213 	if (response->report_id == REPORT_ID_HIDPP_SHORT &&
214 	    response->rap.sub_id == HIDPP_ERROR) {
215 		ret = response->rap.params[1];
216 		dbg_hid("%s:got hidpp error %02X\n", __func__, ret);
217 		goto exit;
218 	}
219 
220 	if (response->report_id == REPORT_ID_HIDPP_LONG &&
221 	    response->fap.feature_index == HIDPP20_ERROR) {
222 		ret = response->fap.params[1];
223 		dbg_hid("%s:got hidpp 2.0 error %02X\n", __func__, ret);
224 		goto exit;
225 	}
226 
227 exit:
228 	mutex_unlock(&hidpp->send_mutex);
229 	return ret;
230 
231 }
232 
233 static int hidpp_send_fap_command_sync(struct hidpp_device *hidpp,
234 	u8 feat_index, u8 funcindex_clientid, u8 *params, int param_count,
235 	struct hidpp_report *response)
236 {
237 	struct hidpp_report *message;
238 	int ret;
239 
240 	if (param_count > sizeof(message->fap.params))
241 		return -EINVAL;
242 
243 	message = kzalloc(sizeof(struct hidpp_report), GFP_KERNEL);
244 	if (!message)
245 		return -ENOMEM;
246 	message->report_id = REPORT_ID_HIDPP_LONG;
247 	message->fap.feature_index = feat_index;
248 	message->fap.funcindex_clientid = funcindex_clientid;
249 	memcpy(&message->fap.params, params, param_count);
250 
251 	ret = hidpp_send_message_sync(hidpp, message, response);
252 	kfree(message);
253 	return ret;
254 }
255 
256 static int hidpp_send_rap_command_sync(struct hidpp_device *hidpp_dev,
257 	u8 report_id, u8 sub_id, u8 reg_address, u8 *params, int param_count,
258 	struct hidpp_report *response)
259 {
260 	struct hidpp_report *message;
261 	int ret;
262 
263 	if ((report_id != REPORT_ID_HIDPP_SHORT) &&
264 	    (report_id != REPORT_ID_HIDPP_LONG))
265 		return -EINVAL;
266 
267 	if (param_count > sizeof(message->rap.params))
268 		return -EINVAL;
269 
270 	message = kzalloc(sizeof(struct hidpp_report), GFP_KERNEL);
271 	if (!message)
272 		return -ENOMEM;
273 	message->report_id = report_id;
274 	message->rap.sub_id = sub_id;
275 	message->rap.reg_address = reg_address;
276 	memcpy(&message->rap.params, params, param_count);
277 
278 	ret = hidpp_send_message_sync(hidpp_dev, message, response);
279 	kfree(message);
280 	return ret;
281 }
282 
283 static void delayed_work_cb(struct work_struct *work)
284 {
285 	struct hidpp_device *hidpp = container_of(work, struct hidpp_device,
286 							work);
287 	hidpp_connect_event(hidpp);
288 }
289 
290 static inline bool hidpp_match_answer(struct hidpp_report *question,
291 		struct hidpp_report *answer)
292 {
293 	return (answer->fap.feature_index == question->fap.feature_index) &&
294 	   (answer->fap.funcindex_clientid == question->fap.funcindex_clientid);
295 }
296 
297 static inline bool hidpp_match_error(struct hidpp_report *question,
298 		struct hidpp_report *answer)
299 {
300 	return ((answer->rap.sub_id == HIDPP_ERROR) ||
301 	    (answer->fap.feature_index == HIDPP20_ERROR)) &&
302 	    (answer->fap.funcindex_clientid == question->fap.feature_index) &&
303 	    (answer->fap.params[0] == question->fap.funcindex_clientid);
304 }
305 
306 static inline bool hidpp_report_is_connect_event(struct hidpp_report *report)
307 {
308 	return (report->report_id == REPORT_ID_HIDPP_SHORT) &&
309 		(report->rap.sub_id == 0x41);
310 }
311 
312 /**
313  * hidpp_prefix_name() prefixes the current given name with "Logitech ".
314  */
315 static void hidpp_prefix_name(char **name, int name_length)
316 {
317 #define PREFIX_LENGTH 9 /* "Logitech " */
318 
319 	int new_length;
320 	char *new_name;
321 
322 	if (name_length > PREFIX_LENGTH &&
323 	    strncmp(*name, "Logitech ", PREFIX_LENGTH) == 0)
324 		/* The prefix has is already in the name */
325 		return;
326 
327 	new_length = PREFIX_LENGTH + name_length;
328 	new_name = kzalloc(new_length, GFP_KERNEL);
329 	if (!new_name)
330 		return;
331 
332 	snprintf(new_name, new_length, "Logitech %s", *name);
333 
334 	kfree(*name);
335 
336 	*name = new_name;
337 }
338 
339 /* -------------------------------------------------------------------------- */
340 /* HIDP++ 1.0 commands                                                        */
341 /* -------------------------------------------------------------------------- */
342 
343 #define HIDPP_SET_REGISTER				0x80
344 #define HIDPP_GET_REGISTER				0x81
345 #define HIDPP_SET_LONG_REGISTER				0x82
346 #define HIDPP_GET_LONG_REGISTER				0x83
347 
348 #define HIDPP_REG_PAIRING_INFORMATION			0xB5
349 #define DEVICE_NAME					0x40
350 
351 static char *hidpp_get_unifying_name(struct hidpp_device *hidpp_dev)
352 {
353 	struct hidpp_report response;
354 	int ret;
355 	/* hid-logitech-dj is in charge of setting the right device index */
356 	u8 params[1] = { DEVICE_NAME };
357 	char *name;
358 	int len;
359 
360 	ret = hidpp_send_rap_command_sync(hidpp_dev,
361 					REPORT_ID_HIDPP_SHORT,
362 					HIDPP_GET_LONG_REGISTER,
363 					HIDPP_REG_PAIRING_INFORMATION,
364 					params, 1, &response);
365 	if (ret)
366 		return NULL;
367 
368 	len = response.rap.params[1];
369 
370 	if (2 + len > sizeof(response.rap.params))
371 		return NULL;
372 
373 	name = kzalloc(len + 1, GFP_KERNEL);
374 	if (!name)
375 		return NULL;
376 
377 	memcpy(name, &response.rap.params[2], len);
378 
379 	/* include the terminating '\0' */
380 	hidpp_prefix_name(&name, len + 1);
381 
382 	return name;
383 }
384 
385 /* -------------------------------------------------------------------------- */
386 /* 0x0000: Root                                                               */
387 /* -------------------------------------------------------------------------- */
388 
389 #define HIDPP_PAGE_ROOT					0x0000
390 #define HIDPP_PAGE_ROOT_IDX				0x00
391 
392 #define CMD_ROOT_GET_FEATURE				0x01
393 #define CMD_ROOT_GET_PROTOCOL_VERSION			0x11
394 
395 static int hidpp_root_get_feature(struct hidpp_device *hidpp, u16 feature,
396 	u8 *feature_index, u8 *feature_type)
397 {
398 	struct hidpp_report response;
399 	int ret;
400 	u8 params[2] = { feature >> 8, feature & 0x00FF };
401 
402 	ret = hidpp_send_fap_command_sync(hidpp,
403 			HIDPP_PAGE_ROOT_IDX,
404 			CMD_ROOT_GET_FEATURE,
405 			params, 2, &response);
406 	if (ret)
407 		return ret;
408 
409 	*feature_index = response.fap.params[0];
410 	*feature_type = response.fap.params[1];
411 
412 	return ret;
413 }
414 
415 static int hidpp_root_get_protocol_version(struct hidpp_device *hidpp)
416 {
417 	struct hidpp_report response;
418 	int ret;
419 
420 	ret = hidpp_send_fap_command_sync(hidpp,
421 			HIDPP_PAGE_ROOT_IDX,
422 			CMD_ROOT_GET_PROTOCOL_VERSION,
423 			NULL, 0, &response);
424 
425 	if (ret == HIDPP_ERROR_INVALID_SUBID) {
426 		hidpp->protocol_major = 1;
427 		hidpp->protocol_minor = 0;
428 		return 0;
429 	}
430 
431 	/* the device might not be connected */
432 	if (ret == HIDPP_ERROR_RESOURCE_ERROR)
433 		return -EIO;
434 
435 	if (ret > 0) {
436 		hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
437 			__func__, ret);
438 		return -EPROTO;
439 	}
440 	if (ret)
441 		return ret;
442 
443 	hidpp->protocol_major = response.fap.params[0];
444 	hidpp->protocol_minor = response.fap.params[1];
445 
446 	return ret;
447 }
448 
449 static bool hidpp_is_connected(struct hidpp_device *hidpp)
450 {
451 	int ret;
452 
453 	ret = hidpp_root_get_protocol_version(hidpp);
454 	if (!ret)
455 		hid_dbg(hidpp->hid_dev, "HID++ %u.%u device connected.\n",
456 			hidpp->protocol_major, hidpp->protocol_minor);
457 	return ret == 0;
458 }
459 
460 /* -------------------------------------------------------------------------- */
461 /* 0x0005: GetDeviceNameType                                                  */
462 /* -------------------------------------------------------------------------- */
463 
464 #define HIDPP_PAGE_GET_DEVICE_NAME_TYPE			0x0005
465 
466 #define CMD_GET_DEVICE_NAME_TYPE_GET_COUNT		0x01
467 #define CMD_GET_DEVICE_NAME_TYPE_GET_DEVICE_NAME	0x11
468 #define CMD_GET_DEVICE_NAME_TYPE_GET_TYPE		0x21
469 
470 static int hidpp_devicenametype_get_count(struct hidpp_device *hidpp,
471 	u8 feature_index, u8 *nameLength)
472 {
473 	struct hidpp_report response;
474 	int ret;
475 
476 	ret = hidpp_send_fap_command_sync(hidpp, feature_index,
477 		CMD_GET_DEVICE_NAME_TYPE_GET_COUNT, NULL, 0, &response);
478 
479 	if (ret > 0) {
480 		hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
481 			__func__, ret);
482 		return -EPROTO;
483 	}
484 	if (ret)
485 		return ret;
486 
487 	*nameLength = response.fap.params[0];
488 
489 	return ret;
490 }
491 
492 static int hidpp_devicenametype_get_device_name(struct hidpp_device *hidpp,
493 	u8 feature_index, u8 char_index, char *device_name, int len_buf)
494 {
495 	struct hidpp_report response;
496 	int ret, i;
497 	int count;
498 
499 	ret = hidpp_send_fap_command_sync(hidpp, feature_index,
500 		CMD_GET_DEVICE_NAME_TYPE_GET_DEVICE_NAME, &char_index, 1,
501 		&response);
502 
503 	if (ret > 0) {
504 		hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
505 			__func__, ret);
506 		return -EPROTO;
507 	}
508 	if (ret)
509 		return ret;
510 
511 	if (response.report_id == REPORT_ID_HIDPP_LONG)
512 		count = HIDPP_REPORT_LONG_LENGTH - 4;
513 	else
514 		count = HIDPP_REPORT_SHORT_LENGTH - 4;
515 
516 	if (len_buf < count)
517 		count = len_buf;
518 
519 	for (i = 0; i < count; i++)
520 		device_name[i] = response.fap.params[i];
521 
522 	return count;
523 }
524 
525 static char *hidpp_get_device_name(struct hidpp_device *hidpp)
526 {
527 	u8 feature_type;
528 	u8 feature_index;
529 	u8 __name_length;
530 	char *name;
531 	unsigned index = 0;
532 	int ret;
533 
534 	ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_GET_DEVICE_NAME_TYPE,
535 		&feature_index, &feature_type);
536 	if (ret)
537 		return NULL;
538 
539 	ret = hidpp_devicenametype_get_count(hidpp, feature_index,
540 		&__name_length);
541 	if (ret)
542 		return NULL;
543 
544 	name = kzalloc(__name_length + 1, GFP_KERNEL);
545 	if (!name)
546 		return NULL;
547 
548 	while (index < __name_length) {
549 		ret = hidpp_devicenametype_get_device_name(hidpp,
550 			feature_index, index, name + index,
551 			__name_length - index);
552 		if (ret <= 0) {
553 			kfree(name);
554 			return NULL;
555 		}
556 		index += ret;
557 	}
558 
559 	/* include the terminating '\0' */
560 	hidpp_prefix_name(&name, __name_length + 1);
561 
562 	return name;
563 }
564 
565 /* -------------------------------------------------------------------------- */
566 /* 0x6010: Touchpad FW items                                                  */
567 /* -------------------------------------------------------------------------- */
568 
569 #define HIDPP_PAGE_TOUCHPAD_FW_ITEMS			0x6010
570 
571 #define CMD_TOUCHPAD_FW_ITEMS_SET			0x10
572 
573 struct hidpp_touchpad_fw_items {
574 	uint8_t presence;
575 	uint8_t desired_state;
576 	uint8_t state;
577 	uint8_t persistent;
578 };
579 
580 /**
581  * send a set state command to the device by reading the current items->state
582  * field. items is then filled with the current state.
583  */
584 static int hidpp_touchpad_fw_items_set(struct hidpp_device *hidpp,
585 				       u8 feature_index,
586 				       struct hidpp_touchpad_fw_items *items)
587 {
588 	struct hidpp_report response;
589 	int ret;
590 	u8 *params = (u8 *)response.fap.params;
591 
592 	ret = hidpp_send_fap_command_sync(hidpp, feature_index,
593 		CMD_TOUCHPAD_FW_ITEMS_SET, &items->state, 1, &response);
594 
595 	if (ret > 0) {
596 		hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
597 			__func__, ret);
598 		return -EPROTO;
599 	}
600 	if (ret)
601 		return ret;
602 
603 	items->presence = params[0];
604 	items->desired_state = params[1];
605 	items->state = params[2];
606 	items->persistent = params[3];
607 
608 	return 0;
609 }
610 
611 /* -------------------------------------------------------------------------- */
612 /* 0x6100: TouchPadRawXY                                                      */
613 /* -------------------------------------------------------------------------- */
614 
615 #define HIDPP_PAGE_TOUCHPAD_RAW_XY			0x6100
616 
617 #define CMD_TOUCHPAD_GET_RAW_INFO			0x01
618 #define CMD_TOUCHPAD_SET_RAW_REPORT_STATE		0x21
619 
620 #define EVENT_TOUCHPAD_RAW_XY				0x00
621 
622 #define TOUCHPAD_RAW_XY_ORIGIN_LOWER_LEFT		0x01
623 #define TOUCHPAD_RAW_XY_ORIGIN_UPPER_LEFT		0x03
624 
625 struct hidpp_touchpad_raw_info {
626 	u16 x_size;
627 	u16 y_size;
628 	u8 z_range;
629 	u8 area_range;
630 	u8 timestamp_unit;
631 	u8 maxcontacts;
632 	u8 origin;
633 	u16 res;
634 };
635 
636 struct hidpp_touchpad_raw_xy_finger {
637 	u8 contact_type;
638 	u8 contact_status;
639 	u16 x;
640 	u16 y;
641 	u8 z;
642 	u8 area;
643 	u8 finger_id;
644 };
645 
646 struct hidpp_touchpad_raw_xy {
647 	u16 timestamp;
648 	struct hidpp_touchpad_raw_xy_finger fingers[2];
649 	u8 spurious_flag;
650 	u8 end_of_frame;
651 	u8 finger_count;
652 	u8 button;
653 };
654 
655 static int hidpp_touchpad_get_raw_info(struct hidpp_device *hidpp,
656 	u8 feature_index, struct hidpp_touchpad_raw_info *raw_info)
657 {
658 	struct hidpp_report response;
659 	int ret;
660 	u8 *params = (u8 *)response.fap.params;
661 
662 	ret = hidpp_send_fap_command_sync(hidpp, feature_index,
663 		CMD_TOUCHPAD_GET_RAW_INFO, NULL, 0, &response);
664 
665 	if (ret > 0) {
666 		hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
667 			__func__, ret);
668 		return -EPROTO;
669 	}
670 	if (ret)
671 		return ret;
672 
673 	raw_info->x_size = get_unaligned_be16(&params[0]);
674 	raw_info->y_size = get_unaligned_be16(&params[2]);
675 	raw_info->z_range = params[4];
676 	raw_info->area_range = params[5];
677 	raw_info->maxcontacts = params[7];
678 	raw_info->origin = params[8];
679 	/* res is given in unit per inch */
680 	raw_info->res = get_unaligned_be16(&params[13]) * 2 / 51;
681 
682 	return ret;
683 }
684 
685 static int hidpp_touchpad_set_raw_report_state(struct hidpp_device *hidpp_dev,
686 		u8 feature_index, bool send_raw_reports,
687 		bool sensor_enhanced_settings)
688 {
689 	struct hidpp_report response;
690 
691 	/*
692 	 * Params:
693 	 *   bit 0 - enable raw
694 	 *   bit 1 - 16bit Z, no area
695 	 *   bit 2 - enhanced sensitivity
696 	 *   bit 3 - width, height (4 bits each) instead of area
697 	 *   bit 4 - send raw + gestures (degrades smoothness)
698 	 *   remaining bits - reserved
699 	 */
700 	u8 params = send_raw_reports | (sensor_enhanced_settings << 2);
701 
702 	return hidpp_send_fap_command_sync(hidpp_dev, feature_index,
703 		CMD_TOUCHPAD_SET_RAW_REPORT_STATE, &params, 1, &response);
704 }
705 
706 static void hidpp_touchpad_touch_event(u8 *data,
707 	struct hidpp_touchpad_raw_xy_finger *finger)
708 {
709 	u8 x_m = data[0] << 2;
710 	u8 y_m = data[2] << 2;
711 
712 	finger->x = x_m << 6 | data[1];
713 	finger->y = y_m << 6 | data[3];
714 
715 	finger->contact_type = data[0] >> 6;
716 	finger->contact_status = data[2] >> 6;
717 
718 	finger->z = data[4];
719 	finger->area = data[5];
720 	finger->finger_id = data[6] >> 4;
721 }
722 
723 static void hidpp_touchpad_raw_xy_event(struct hidpp_device *hidpp_dev,
724 		u8 *data, struct hidpp_touchpad_raw_xy *raw_xy)
725 {
726 	memset(raw_xy, 0, sizeof(struct hidpp_touchpad_raw_xy));
727 	raw_xy->end_of_frame = data[8] & 0x01;
728 	raw_xy->spurious_flag = (data[8] >> 1) & 0x01;
729 	raw_xy->finger_count = data[15] & 0x0f;
730 	raw_xy->button = (data[8] >> 2) & 0x01;
731 
732 	if (raw_xy->finger_count) {
733 		hidpp_touchpad_touch_event(&data[2], &raw_xy->fingers[0]);
734 		hidpp_touchpad_touch_event(&data[9], &raw_xy->fingers[1]);
735 	}
736 }
737 
738 /* ************************************************************************** */
739 /*                                                                            */
740 /* Device Support                                                             */
741 /*                                                                            */
742 /* ************************************************************************** */
743 
744 /* -------------------------------------------------------------------------- */
745 /* Touchpad HID++ devices                                                     */
746 /* -------------------------------------------------------------------------- */
747 
748 #define WTP_MANUAL_RESOLUTION				39
749 
750 struct wtp_data {
751 	struct input_dev *input;
752 	u16 x_size, y_size;
753 	u8 finger_count;
754 	u8 mt_feature_index;
755 	u8 button_feature_index;
756 	u8 maxcontacts;
757 	bool flip_y;
758 	unsigned int resolution;
759 };
760 
761 static int wtp_input_mapping(struct hid_device *hdev, struct hid_input *hi,
762 		struct hid_field *field, struct hid_usage *usage,
763 		unsigned long **bit, int *max)
764 {
765 	return -1;
766 }
767 
768 static void wtp_populate_input(struct hidpp_device *hidpp,
769 		struct input_dev *input_dev, bool origin_is_hid_core)
770 {
771 	struct wtp_data *wd = hidpp->private_data;
772 
773 	__set_bit(EV_ABS, input_dev->evbit);
774 	__set_bit(EV_KEY, input_dev->evbit);
775 	__clear_bit(EV_REL, input_dev->evbit);
776 	__clear_bit(EV_LED, input_dev->evbit);
777 
778 	input_set_abs_params(input_dev, ABS_MT_POSITION_X, 0, wd->x_size, 0, 0);
779 	input_abs_set_res(input_dev, ABS_MT_POSITION_X, wd->resolution);
780 	input_set_abs_params(input_dev, ABS_MT_POSITION_Y, 0, wd->y_size, 0, 0);
781 	input_abs_set_res(input_dev, ABS_MT_POSITION_Y, wd->resolution);
782 
783 	/* Max pressure is not given by the devices, pick one */
784 	input_set_abs_params(input_dev, ABS_MT_PRESSURE, 0, 50, 0, 0);
785 
786 	input_set_capability(input_dev, EV_KEY, BTN_LEFT);
787 
788 	if (hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS)
789 		input_set_capability(input_dev, EV_KEY, BTN_RIGHT);
790 	else
791 		__set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
792 
793 	input_mt_init_slots(input_dev, wd->maxcontacts, INPUT_MT_POINTER |
794 		INPUT_MT_DROP_UNUSED);
795 
796 	wd->input = input_dev;
797 }
798 
799 static void wtp_touch_event(struct wtp_data *wd,
800 	struct hidpp_touchpad_raw_xy_finger *touch_report)
801 {
802 	int slot;
803 
804 	if (!touch_report->finger_id || touch_report->contact_type)
805 		/* no actual data */
806 		return;
807 
808 	slot = input_mt_get_slot_by_key(wd->input, touch_report->finger_id);
809 
810 	input_mt_slot(wd->input, slot);
811 	input_mt_report_slot_state(wd->input, MT_TOOL_FINGER,
812 					touch_report->contact_status);
813 	if (touch_report->contact_status) {
814 		input_event(wd->input, EV_ABS, ABS_MT_POSITION_X,
815 				touch_report->x);
816 		input_event(wd->input, EV_ABS, ABS_MT_POSITION_Y,
817 				wd->flip_y ? wd->y_size - touch_report->y :
818 					     touch_report->y);
819 		input_event(wd->input, EV_ABS, ABS_MT_PRESSURE,
820 				touch_report->area);
821 	}
822 }
823 
824 static void wtp_send_raw_xy_event(struct hidpp_device *hidpp,
825 		struct hidpp_touchpad_raw_xy *raw)
826 {
827 	struct wtp_data *wd = hidpp->private_data;
828 	int i;
829 
830 	for (i = 0; i < 2; i++)
831 		wtp_touch_event(wd, &(raw->fingers[i]));
832 
833 	if (raw->end_of_frame &&
834 	    !(hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS))
835 		input_event(wd->input, EV_KEY, BTN_LEFT, raw->button);
836 
837 	if (raw->end_of_frame || raw->finger_count <= 2) {
838 		input_mt_sync_frame(wd->input);
839 		input_sync(wd->input);
840 	}
841 }
842 
843 static int wtp_mouse_raw_xy_event(struct hidpp_device *hidpp, u8 *data)
844 {
845 	struct wtp_data *wd = hidpp->private_data;
846 	u8 c1_area = ((data[7] & 0xf) * (data[7] & 0xf) +
847 		      (data[7] >> 4) * (data[7] >> 4)) / 2;
848 	u8 c2_area = ((data[13] & 0xf) * (data[13] & 0xf) +
849 		      (data[13] >> 4) * (data[13] >> 4)) / 2;
850 	struct hidpp_touchpad_raw_xy raw = {
851 		.timestamp = data[1],
852 		.fingers = {
853 			{
854 				.contact_type = 0,
855 				.contact_status = !!data[7],
856 				.x = get_unaligned_le16(&data[3]),
857 				.y = get_unaligned_le16(&data[5]),
858 				.z = c1_area,
859 				.area = c1_area,
860 				.finger_id = data[2],
861 			}, {
862 				.contact_type = 0,
863 				.contact_status = !!data[13],
864 				.x = get_unaligned_le16(&data[9]),
865 				.y = get_unaligned_le16(&data[11]),
866 				.z = c2_area,
867 				.area = c2_area,
868 				.finger_id = data[8],
869 			}
870 		},
871 		.finger_count = wd->maxcontacts,
872 		.spurious_flag = 0,
873 		.end_of_frame = (data[0] >> 7) == 0,
874 		.button = data[0] & 0x01,
875 	};
876 
877 	wtp_send_raw_xy_event(hidpp, &raw);
878 
879 	return 1;
880 }
881 
882 static int wtp_raw_event(struct hid_device *hdev, u8 *data, int size)
883 {
884 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
885 	struct wtp_data *wd = hidpp->private_data;
886 	struct hidpp_report *report = (struct hidpp_report *)data;
887 	struct hidpp_touchpad_raw_xy raw;
888 
889 	if (!wd || !wd->input)
890 		return 1;
891 
892 	switch (data[0]) {
893 	case 0x02:
894 		if (size < 2) {
895 			hid_err(hdev, "Received HID report of bad size (%d)",
896 				size);
897 			return 1;
898 		}
899 		if (hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS) {
900 			input_event(wd->input, EV_KEY, BTN_LEFT,
901 					!!(data[1] & 0x01));
902 			input_event(wd->input, EV_KEY, BTN_RIGHT,
903 					!!(data[1] & 0x02));
904 			input_sync(wd->input);
905 			return 0;
906 		} else {
907 			if (size < 21)
908 				return 1;
909 			return wtp_mouse_raw_xy_event(hidpp, &data[7]);
910 		}
911 	case REPORT_ID_HIDPP_LONG:
912 		/* size is already checked in hidpp_raw_event. */
913 		if ((report->fap.feature_index != wd->mt_feature_index) ||
914 		    (report->fap.funcindex_clientid != EVENT_TOUCHPAD_RAW_XY))
915 			return 1;
916 		hidpp_touchpad_raw_xy_event(hidpp, data + 4, &raw);
917 
918 		wtp_send_raw_xy_event(hidpp, &raw);
919 		return 0;
920 	}
921 
922 	return 0;
923 }
924 
925 static int wtp_get_config(struct hidpp_device *hidpp)
926 {
927 	struct wtp_data *wd = hidpp->private_data;
928 	struct hidpp_touchpad_raw_info raw_info = {0};
929 	u8 feature_type;
930 	int ret;
931 
932 	ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_TOUCHPAD_RAW_XY,
933 		&wd->mt_feature_index, &feature_type);
934 	if (ret)
935 		/* means that the device is not powered up */
936 		return ret;
937 
938 	ret = hidpp_touchpad_get_raw_info(hidpp, wd->mt_feature_index,
939 		&raw_info);
940 	if (ret)
941 		return ret;
942 
943 	wd->x_size = raw_info.x_size;
944 	wd->y_size = raw_info.y_size;
945 	wd->maxcontacts = raw_info.maxcontacts;
946 	wd->flip_y = raw_info.origin == TOUCHPAD_RAW_XY_ORIGIN_LOWER_LEFT;
947 	wd->resolution = raw_info.res;
948 	if (!wd->resolution)
949 		wd->resolution = WTP_MANUAL_RESOLUTION;
950 
951 	return 0;
952 }
953 
954 static int wtp_allocate(struct hid_device *hdev, const struct hid_device_id *id)
955 {
956 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
957 	struct wtp_data *wd;
958 
959 	wd = devm_kzalloc(&hdev->dev, sizeof(struct wtp_data),
960 			GFP_KERNEL);
961 	if (!wd)
962 		return -ENOMEM;
963 
964 	hidpp->private_data = wd;
965 
966 	return 0;
967 };
968 
969 static int wtp_connect(struct hid_device *hdev, bool connected)
970 {
971 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
972 	struct wtp_data *wd = hidpp->private_data;
973 	int ret;
974 
975 	if (!connected)
976 		return 0;
977 
978 	if (!wd->x_size) {
979 		ret = wtp_get_config(hidpp);
980 		if (ret) {
981 			hid_err(hdev, "Can not get wtp config: %d\n", ret);
982 			return ret;
983 		}
984 	}
985 
986 	return hidpp_touchpad_set_raw_report_state(hidpp, wd->mt_feature_index,
987 			true, true);
988 }
989 
990 /* ------------------------------------------------------------------------- */
991 /* Logitech M560 devices                                                     */
992 /* ------------------------------------------------------------------------- */
993 
994 /*
995  * Logitech M560 protocol overview
996  *
997  * The Logitech M560 mouse, is designed for windows 8. When the middle and/or
998  * the sides buttons are pressed, it sends some keyboard keys events
999  * instead of buttons ones.
1000  * To complicate things further, the middle button keys sequence
1001  * is different from the odd press and the even press.
1002  *
1003  * forward button -> Super_R
1004  * backward button -> Super_L+'d' (press only)
1005  * middle button -> 1st time: Alt_L+SuperL+XF86TouchpadOff (press only)
1006  *                  2nd time: left-click (press only)
1007  * NB: press-only means that when the button is pressed, the
1008  * KeyPress/ButtonPress and KeyRelease/ButtonRelease events are generated
1009  * together sequentially; instead when the button is released, no event is
1010  * generated !
1011  *
1012  * With the command
1013  *	10<xx>0a 3500af03 (where <xx> is the mouse id),
1014  * the mouse reacts differently:
1015  * - it never sends a keyboard key event
1016  * - for the three mouse button it sends:
1017  *	middle button               press   11<xx>0a 3500af00...
1018  *	side 1 button (forward)     press   11<xx>0a 3500b000...
1019  *	side 2 button (backward)    press   11<xx>0a 3500ae00...
1020  *	middle/side1/side2 button   release 11<xx>0a 35000000...
1021  */
1022 
1023 static const u8 m560_config_parameter[] = {0x00, 0xaf, 0x03};
1024 
1025 struct m560_private_data {
1026 	struct input_dev *input;
1027 };
1028 
1029 /* how buttons are mapped in the report */
1030 #define M560_MOUSE_BTN_LEFT		0x01
1031 #define M560_MOUSE_BTN_RIGHT		0x02
1032 #define M560_MOUSE_BTN_WHEEL_LEFT	0x08
1033 #define M560_MOUSE_BTN_WHEEL_RIGHT	0x10
1034 
1035 #define M560_SUB_ID			0x0a
1036 #define M560_BUTTON_MODE_REGISTER	0x35
1037 
1038 static int m560_send_config_command(struct hid_device *hdev, bool connected)
1039 {
1040 	struct hidpp_report response;
1041 	struct hidpp_device *hidpp_dev;
1042 
1043 	hidpp_dev = hid_get_drvdata(hdev);
1044 
1045 	if (!connected)
1046 		return -ENODEV;
1047 
1048 	return hidpp_send_rap_command_sync(
1049 		hidpp_dev,
1050 		REPORT_ID_HIDPP_SHORT,
1051 		M560_SUB_ID,
1052 		M560_BUTTON_MODE_REGISTER,
1053 		(u8 *)m560_config_parameter,
1054 		sizeof(m560_config_parameter),
1055 		&response
1056 	);
1057 }
1058 
1059 static int m560_allocate(struct hid_device *hdev)
1060 {
1061 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1062 	struct m560_private_data *d;
1063 
1064 	d = devm_kzalloc(&hdev->dev, sizeof(struct m560_private_data),
1065 			GFP_KERNEL);
1066 	if (!d)
1067 		return -ENOMEM;
1068 
1069 	hidpp->private_data = d;
1070 
1071 	return 0;
1072 };
1073 
1074 static int m560_raw_event(struct hid_device *hdev, u8 *data, int size)
1075 {
1076 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1077 	struct m560_private_data *mydata = hidpp->private_data;
1078 
1079 	/* sanity check */
1080 	if (!mydata || !mydata->input) {
1081 		hid_err(hdev, "error in parameter\n");
1082 		return -EINVAL;
1083 	}
1084 
1085 	if (size < 7) {
1086 		hid_err(hdev, "error in report\n");
1087 		return 0;
1088 	}
1089 
1090 	if (data[0] == REPORT_ID_HIDPP_LONG &&
1091 	    data[2] == M560_SUB_ID && data[6] == 0x00) {
1092 		/*
1093 		 * m560 mouse report for middle, forward and backward button
1094 		 *
1095 		 * data[0] = 0x11
1096 		 * data[1] = device-id
1097 		 * data[2] = 0x0a
1098 		 * data[5] = 0xaf -> middle
1099 		 *	     0xb0 -> forward
1100 		 *	     0xae -> backward
1101 		 *	     0x00 -> release all
1102 		 * data[6] = 0x00
1103 		 */
1104 
1105 		switch (data[5]) {
1106 		case 0xaf:
1107 			input_report_key(mydata->input, BTN_MIDDLE, 1);
1108 			break;
1109 		case 0xb0:
1110 			input_report_key(mydata->input, BTN_FORWARD, 1);
1111 			break;
1112 		case 0xae:
1113 			input_report_key(mydata->input, BTN_BACK, 1);
1114 			break;
1115 		case 0x00:
1116 			input_report_key(mydata->input, BTN_BACK, 0);
1117 			input_report_key(mydata->input, BTN_FORWARD, 0);
1118 			input_report_key(mydata->input, BTN_MIDDLE, 0);
1119 			break;
1120 		default:
1121 			hid_err(hdev, "error in report\n");
1122 			return 0;
1123 		}
1124 		input_sync(mydata->input);
1125 
1126 	} else if (data[0] == 0x02) {
1127 		/*
1128 		 * Logitech M560 mouse report
1129 		 *
1130 		 * data[0] = type (0x02)
1131 		 * data[1..2] = buttons
1132 		 * data[3..5] = xy
1133 		 * data[6] = wheel
1134 		 */
1135 
1136 		int v;
1137 
1138 		input_report_key(mydata->input, BTN_LEFT,
1139 			!!(data[1] & M560_MOUSE_BTN_LEFT));
1140 		input_report_key(mydata->input, BTN_RIGHT,
1141 			!!(data[1] & M560_MOUSE_BTN_RIGHT));
1142 
1143 		if (data[1] & M560_MOUSE_BTN_WHEEL_LEFT)
1144 			input_report_rel(mydata->input, REL_HWHEEL, -1);
1145 		else if (data[1] & M560_MOUSE_BTN_WHEEL_RIGHT)
1146 			input_report_rel(mydata->input, REL_HWHEEL, 1);
1147 
1148 		v = hid_snto32(hid_field_extract(hdev, data+3, 0, 12), 12);
1149 		input_report_rel(mydata->input, REL_X, v);
1150 
1151 		v = hid_snto32(hid_field_extract(hdev, data+3, 12, 12), 12);
1152 		input_report_rel(mydata->input, REL_Y, v);
1153 
1154 		v = hid_snto32(data[6], 8);
1155 		input_report_rel(mydata->input, REL_WHEEL, v);
1156 
1157 		input_sync(mydata->input);
1158 	}
1159 
1160 	return 1;
1161 }
1162 
1163 static void m560_populate_input(struct hidpp_device *hidpp,
1164 		struct input_dev *input_dev, bool origin_is_hid_core)
1165 {
1166 	struct m560_private_data *mydata = hidpp->private_data;
1167 
1168 	mydata->input = input_dev;
1169 
1170 	__set_bit(EV_KEY, mydata->input->evbit);
1171 	__set_bit(BTN_MIDDLE, mydata->input->keybit);
1172 	__set_bit(BTN_RIGHT, mydata->input->keybit);
1173 	__set_bit(BTN_LEFT, mydata->input->keybit);
1174 	__set_bit(BTN_BACK, mydata->input->keybit);
1175 	__set_bit(BTN_FORWARD, mydata->input->keybit);
1176 
1177 	__set_bit(EV_REL, mydata->input->evbit);
1178 	__set_bit(REL_X, mydata->input->relbit);
1179 	__set_bit(REL_Y, mydata->input->relbit);
1180 	__set_bit(REL_WHEEL, mydata->input->relbit);
1181 	__set_bit(REL_HWHEEL, mydata->input->relbit);
1182 }
1183 
1184 static int m560_input_mapping(struct hid_device *hdev, struct hid_input *hi,
1185 		struct hid_field *field, struct hid_usage *usage,
1186 		unsigned long **bit, int *max)
1187 {
1188 	return -1;
1189 }
1190 
1191 /* ------------------------------------------------------------------------- */
1192 /* Logitech K400 devices                                                     */
1193 /* ------------------------------------------------------------------------- */
1194 
1195 /*
1196  * The Logitech K400 keyboard has an embedded touchpad which is seen
1197  * as a mouse from the OS point of view. There is a hardware shortcut to disable
1198  * tap-to-click but the setting is not remembered accross reset, annoying some
1199  * users.
1200  *
1201  * We can toggle this feature from the host by using the feature 0x6010:
1202  * Touchpad FW items
1203  */
1204 
1205 struct k400_private_data {
1206 	u8 feature_index;
1207 };
1208 
1209 static int k400_disable_tap_to_click(struct hidpp_device *hidpp)
1210 {
1211 	struct k400_private_data *k400 = hidpp->private_data;
1212 	struct hidpp_touchpad_fw_items items = {};
1213 	int ret;
1214 	u8 feature_type;
1215 
1216 	if (!k400->feature_index) {
1217 		ret = hidpp_root_get_feature(hidpp,
1218 			HIDPP_PAGE_TOUCHPAD_FW_ITEMS,
1219 			&k400->feature_index, &feature_type);
1220 		if (ret)
1221 			/* means that the device is not powered up */
1222 			return ret;
1223 	}
1224 
1225 	ret = hidpp_touchpad_fw_items_set(hidpp, k400->feature_index, &items);
1226 	if (ret)
1227 		return ret;
1228 
1229 	return 0;
1230 }
1231 
1232 static int k400_allocate(struct hid_device *hdev)
1233 {
1234 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1235 	struct k400_private_data *k400;
1236 
1237 	k400 = devm_kzalloc(&hdev->dev, sizeof(struct k400_private_data),
1238 			    GFP_KERNEL);
1239 	if (!k400)
1240 		return -ENOMEM;
1241 
1242 	hidpp->private_data = k400;
1243 
1244 	return 0;
1245 };
1246 
1247 static int k400_connect(struct hid_device *hdev, bool connected)
1248 {
1249 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1250 
1251 	if (!connected)
1252 		return 0;
1253 
1254 	if (!disable_tap_to_click)
1255 		return 0;
1256 
1257 	return k400_disable_tap_to_click(hidpp);
1258 }
1259 
1260 /* -------------------------------------------------------------------------- */
1261 /* Generic HID++ devices                                                      */
1262 /* -------------------------------------------------------------------------- */
1263 
1264 static int hidpp_input_mapping(struct hid_device *hdev, struct hid_input *hi,
1265 		struct hid_field *field, struct hid_usage *usage,
1266 		unsigned long **bit, int *max)
1267 {
1268 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1269 
1270 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
1271 		return wtp_input_mapping(hdev, hi, field, usage, bit, max);
1272 	else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560 &&
1273 			field->application != HID_GD_MOUSE)
1274 		return m560_input_mapping(hdev, hi, field, usage, bit, max);
1275 
1276 	return 0;
1277 }
1278 
1279 static void hidpp_populate_input(struct hidpp_device *hidpp,
1280 		struct input_dev *input, bool origin_is_hid_core)
1281 {
1282 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
1283 		wtp_populate_input(hidpp, input, origin_is_hid_core);
1284 	else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560)
1285 		m560_populate_input(hidpp, input, origin_is_hid_core);
1286 }
1287 
1288 static int hidpp_input_configured(struct hid_device *hdev,
1289 				struct hid_input *hidinput)
1290 {
1291 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1292 	struct input_dev *input = hidinput->input;
1293 
1294 	hidpp_populate_input(hidpp, input, true);
1295 
1296 	return 0;
1297 }
1298 
1299 static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,
1300 		int size)
1301 {
1302 	struct hidpp_report *question = hidpp->send_receive_buf;
1303 	struct hidpp_report *answer = hidpp->send_receive_buf;
1304 	struct hidpp_report *report = (struct hidpp_report *)data;
1305 
1306 	/*
1307 	 * If the mutex is locked then we have a pending answer from a
1308 	 * previously sent command.
1309 	 */
1310 	if (unlikely(mutex_is_locked(&hidpp->send_mutex))) {
1311 		/*
1312 		 * Check for a correct hidpp20 answer or the corresponding
1313 		 * error
1314 		 */
1315 		if (hidpp_match_answer(question, report) ||
1316 				hidpp_match_error(question, report)) {
1317 			*answer = *report;
1318 			hidpp->answer_available = true;
1319 			wake_up(&hidpp->wait);
1320 			/*
1321 			 * This was an answer to a command that this driver sent
1322 			 * We return 1 to hid-core to avoid forwarding the
1323 			 * command upstream as it has been treated by the driver
1324 			 */
1325 
1326 			return 1;
1327 		}
1328 	}
1329 
1330 	if (unlikely(hidpp_report_is_connect_event(report))) {
1331 		atomic_set(&hidpp->connected,
1332 				!(report->rap.params[0] & (1 << 6)));
1333 		if ((hidpp->quirks & HIDPP_QUIRK_CONNECT_EVENTS) &&
1334 		    (schedule_work(&hidpp->work) == 0))
1335 			dbg_hid("%s: connect event already queued\n", __func__);
1336 		return 1;
1337 	}
1338 
1339 	return 0;
1340 }
1341 
1342 static int hidpp_raw_event(struct hid_device *hdev, struct hid_report *report,
1343 		u8 *data, int size)
1344 {
1345 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1346 	int ret = 0;
1347 
1348 	/* Generic HID++ processing. */
1349 	switch (data[0]) {
1350 	case REPORT_ID_HIDPP_LONG:
1351 		if (size != HIDPP_REPORT_LONG_LENGTH) {
1352 			hid_err(hdev, "received hid++ report of bad size (%d)",
1353 				size);
1354 			return 1;
1355 		}
1356 		ret = hidpp_raw_hidpp_event(hidpp, data, size);
1357 		break;
1358 	case REPORT_ID_HIDPP_SHORT:
1359 		if (size != HIDPP_REPORT_SHORT_LENGTH) {
1360 			hid_err(hdev, "received hid++ report of bad size (%d)",
1361 				size);
1362 			return 1;
1363 		}
1364 		ret = hidpp_raw_hidpp_event(hidpp, data, size);
1365 		break;
1366 	}
1367 
1368 	/* If no report is available for further processing, skip calling
1369 	 * raw_event of subclasses. */
1370 	if (ret != 0)
1371 		return ret;
1372 
1373 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
1374 		return wtp_raw_event(hdev, data, size);
1375 	else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560)
1376 		return m560_raw_event(hdev, data, size);
1377 
1378 	return 0;
1379 }
1380 
1381 static void hidpp_overwrite_name(struct hid_device *hdev, bool use_unifying)
1382 {
1383 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1384 	char *name;
1385 
1386 	if (use_unifying)
1387 		/*
1388 		 * the device is connected through an Unifying receiver, and
1389 		 * might not be already connected.
1390 		 * Ask the receiver for its name.
1391 		 */
1392 		name = hidpp_get_unifying_name(hidpp);
1393 	else
1394 		name = hidpp_get_device_name(hidpp);
1395 
1396 	if (!name)
1397 		hid_err(hdev, "unable to retrieve the name of the device");
1398 	else
1399 		snprintf(hdev->name, sizeof(hdev->name), "%s", name);
1400 
1401 	kfree(name);
1402 }
1403 
1404 static int hidpp_input_open(struct input_dev *dev)
1405 {
1406 	struct hid_device *hid = input_get_drvdata(dev);
1407 
1408 	return hid_hw_open(hid);
1409 }
1410 
1411 static void hidpp_input_close(struct input_dev *dev)
1412 {
1413 	struct hid_device *hid = input_get_drvdata(dev);
1414 
1415 	hid_hw_close(hid);
1416 }
1417 
1418 static struct input_dev *hidpp_allocate_input(struct hid_device *hdev)
1419 {
1420 	struct input_dev *input_dev = devm_input_allocate_device(&hdev->dev);
1421 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1422 
1423 	if (!input_dev)
1424 		return NULL;
1425 
1426 	input_set_drvdata(input_dev, hdev);
1427 	input_dev->open = hidpp_input_open;
1428 	input_dev->close = hidpp_input_close;
1429 
1430 	input_dev->name = hidpp->name;
1431 	input_dev->phys = hdev->phys;
1432 	input_dev->uniq = hdev->uniq;
1433 	input_dev->id.bustype = hdev->bus;
1434 	input_dev->id.vendor  = hdev->vendor;
1435 	input_dev->id.product = hdev->product;
1436 	input_dev->id.version = hdev->version;
1437 	input_dev->dev.parent = &hdev->dev;
1438 
1439 	return input_dev;
1440 }
1441 
1442 static void hidpp_connect_event(struct hidpp_device *hidpp)
1443 {
1444 	struct hid_device *hdev = hidpp->hid_dev;
1445 	int ret = 0;
1446 	bool connected = atomic_read(&hidpp->connected);
1447 	struct input_dev *input;
1448 	char *name, *devm_name;
1449 
1450 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {
1451 		ret = wtp_connect(hdev, connected);
1452 		if (ret)
1453 			return;
1454 	} else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560) {
1455 		ret = m560_send_config_command(hdev, connected);
1456 		if (ret)
1457 			return;
1458 	} else if (hidpp->quirks & HIDPP_QUIRK_CLASS_K400) {
1459 		ret = k400_connect(hdev, connected);
1460 		if (ret)
1461 			return;
1462 	}
1463 
1464 	if (!connected || hidpp->delayed_input)
1465 		return;
1466 
1467 	/* the device is already connected, we can ask for its name and
1468 	 * protocol */
1469 	if (!hidpp->protocol_major) {
1470 		ret = !hidpp_is_connected(hidpp);
1471 		if (ret) {
1472 			hid_err(hdev, "Can not get the protocol version.\n");
1473 			return;
1474 		}
1475 		hid_info(hdev, "HID++ %u.%u device connected.\n",
1476 			 hidpp->protocol_major, hidpp->protocol_minor);
1477 	}
1478 
1479 	if (!(hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT))
1480 		/* if HID created the input nodes for us, we can stop now */
1481 		return;
1482 
1483 	if (!hidpp->name || hidpp->name == hdev->name) {
1484 		name = hidpp_get_device_name(hidpp);
1485 		if (!name) {
1486 			hid_err(hdev,
1487 				"unable to retrieve the name of the device");
1488 			return;
1489 		}
1490 
1491 		devm_name = devm_kasprintf(&hdev->dev, GFP_KERNEL, "%s", name);
1492 		kfree(name);
1493 		if (!devm_name)
1494 			return;
1495 
1496 		hidpp->name = devm_name;
1497 	}
1498 
1499 	input = hidpp_allocate_input(hdev);
1500 	if (!input) {
1501 		hid_err(hdev, "cannot allocate new input device: %d\n", ret);
1502 		return;
1503 	}
1504 
1505 	hidpp_populate_input(hidpp, input, false);
1506 
1507 	ret = input_register_device(input);
1508 	if (ret)
1509 		input_free_device(input);
1510 
1511 	hidpp->delayed_input = input;
1512 }
1513 
1514 static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
1515 {
1516 	struct hidpp_device *hidpp;
1517 	int ret;
1518 	bool connected;
1519 	unsigned int connect_mask = HID_CONNECT_DEFAULT;
1520 
1521 	hidpp = devm_kzalloc(&hdev->dev, sizeof(struct hidpp_device),
1522 			GFP_KERNEL);
1523 	if (!hidpp)
1524 		return -ENOMEM;
1525 
1526 	hidpp->hid_dev = hdev;
1527 	hidpp->name = hdev->name;
1528 	hid_set_drvdata(hdev, hidpp);
1529 
1530 	hidpp->quirks = id->driver_data;
1531 
1532 	if (disable_raw_mode) {
1533 		hidpp->quirks &= ~HIDPP_QUIRK_CLASS_WTP;
1534 		hidpp->quirks &= ~HIDPP_QUIRK_CONNECT_EVENTS;
1535 		hidpp->quirks &= ~HIDPP_QUIRK_NO_HIDINPUT;
1536 	}
1537 
1538 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {
1539 		ret = wtp_allocate(hdev, id);
1540 		if (ret)
1541 			goto allocate_fail;
1542 	} else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560) {
1543 		ret = m560_allocate(hdev);
1544 		if (ret)
1545 			goto allocate_fail;
1546 	} else if (hidpp->quirks & HIDPP_QUIRK_CLASS_K400) {
1547 		ret = k400_allocate(hdev);
1548 		if (ret)
1549 			goto allocate_fail;
1550 	}
1551 
1552 	INIT_WORK(&hidpp->work, delayed_work_cb);
1553 	mutex_init(&hidpp->send_mutex);
1554 	init_waitqueue_head(&hidpp->wait);
1555 
1556 	ret = hid_parse(hdev);
1557 	if (ret) {
1558 		hid_err(hdev, "%s:parse failed\n", __func__);
1559 		goto hid_parse_fail;
1560 	}
1561 
1562 	/* Allow incoming packets */
1563 	hid_device_io_start(hdev);
1564 
1565 	connected = hidpp_is_connected(hidpp);
1566 	if (id->group != HID_GROUP_LOGITECH_DJ_DEVICE) {
1567 		if (!connected) {
1568 			ret = -ENODEV;
1569 			hid_err(hdev, "Device not connected");
1570 			hid_device_io_stop(hdev);
1571 			goto hid_parse_fail;
1572 		}
1573 
1574 		hid_info(hdev, "HID++ %u.%u device connected.\n",
1575 			 hidpp->protocol_major, hidpp->protocol_minor);
1576 	}
1577 
1578 	hidpp_overwrite_name(hdev, id->group == HID_GROUP_LOGITECH_DJ_DEVICE);
1579 	atomic_set(&hidpp->connected, connected);
1580 
1581 	if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)) {
1582 		ret = wtp_get_config(hidpp);
1583 		if (ret)
1584 			goto hid_parse_fail;
1585 	}
1586 
1587 	/* Block incoming packets */
1588 	hid_device_io_stop(hdev);
1589 
1590 	if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT)
1591 		connect_mask &= ~HID_CONNECT_HIDINPUT;
1592 
1593 	ret = hid_hw_start(hdev, connect_mask);
1594 	if (ret) {
1595 		hid_err(hdev, "%s:hid_hw_start returned error\n", __func__);
1596 		goto hid_hw_start_fail;
1597 	}
1598 
1599 	if (hidpp->quirks & HIDPP_QUIRK_CONNECT_EVENTS) {
1600 		/* Allow incoming packets */
1601 		hid_device_io_start(hdev);
1602 
1603 		hidpp_connect_event(hidpp);
1604 	}
1605 
1606 	return ret;
1607 
1608 hid_hw_start_fail:
1609 hid_parse_fail:
1610 	cancel_work_sync(&hidpp->work);
1611 	mutex_destroy(&hidpp->send_mutex);
1612 allocate_fail:
1613 	hid_set_drvdata(hdev, NULL);
1614 	return ret;
1615 }
1616 
1617 static void hidpp_remove(struct hid_device *hdev)
1618 {
1619 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1620 
1621 	cancel_work_sync(&hidpp->work);
1622 	mutex_destroy(&hidpp->send_mutex);
1623 	hid_hw_stop(hdev);
1624 }
1625 
1626 static const struct hid_device_id hidpp_devices[] = {
1627 	{ /* wireless touchpad */
1628 	  HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
1629 		USB_VENDOR_ID_LOGITECH, 0x4011),
1630 	  .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT |
1631 			 HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS },
1632 	{ /* wireless touchpad T650 */
1633 	  HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
1634 		USB_VENDOR_ID_LOGITECH, 0x4101),
1635 	  .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT },
1636 	{ /* wireless touchpad T651 */
1637 	  HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
1638 		USB_DEVICE_ID_LOGITECH_T651),
1639 	  .driver_data = HIDPP_QUIRK_CLASS_WTP },
1640 	{ /* Mouse logitech M560 */
1641 	  HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
1642 		USB_VENDOR_ID_LOGITECH, 0x402d),
1643 	  .driver_data = HIDPP_QUIRK_DELAYED_INIT | HIDPP_QUIRK_CLASS_M560 },
1644 	{ /* Keyboard logitech K400 */
1645 	  HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
1646 		USB_VENDOR_ID_LOGITECH, 0x4024),
1647 	  .driver_data = HIDPP_QUIRK_CONNECT_EVENTS | HIDPP_QUIRK_CLASS_K400 },
1648 
1649 	{ HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
1650 		USB_VENDOR_ID_LOGITECH, HID_ANY_ID)},
1651 	{}
1652 };
1653 
1654 MODULE_DEVICE_TABLE(hid, hidpp_devices);
1655 
1656 static struct hid_driver hidpp_driver = {
1657 	.name = "logitech-hidpp-device",
1658 	.id_table = hidpp_devices,
1659 	.probe = hidpp_probe,
1660 	.remove = hidpp_remove,
1661 	.raw_event = hidpp_raw_event,
1662 	.input_configured = hidpp_input_configured,
1663 	.input_mapping = hidpp_input_mapping,
1664 };
1665 
1666 module_hid_driver(hidpp_driver);
1667