1 /*
2  *  HIDPP protocol for Logitech Unifying receivers
3  *
4  *  Copyright (c) 2011 Logitech (c)
5  *  Copyright (c) 2012-2013 Google (c)
6  *  Copyright (c) 2013-2014 Red Hat Inc.
7  */
8 
9 /*
10  * This program is free software; you can redistribute it and/or modify it
11  * under the terms of the GNU General Public License as published by the Free
12  * Software Foundation; version 2 of the License.
13  */
14 
15 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
16 
17 #include <linux/device.h>
18 #include <linux/input.h>
19 #include <linux/usb.h>
20 #include <linux/hid.h>
21 #include <linux/module.h>
22 #include <linux/slab.h>
23 #include <linux/sched.h>
24 #include <linux/kfifo.h>
25 #include <linux/input/mt.h>
26 #include <linux/workqueue.h>
27 #include <linux/atomic.h>
28 #include <linux/fixp-arith.h>
29 #include <asm/unaligned.h>
30 #include "usbhid/usbhid.h"
31 #include "hid-ids.h"
32 
33 MODULE_LICENSE("GPL");
34 MODULE_AUTHOR("Benjamin Tissoires <benjamin.tissoires@gmail.com>");
35 MODULE_AUTHOR("Nestor Lopez Casado <nlopezcasad@logitech.com>");
36 
37 static bool disable_raw_mode;
38 module_param(disable_raw_mode, bool, 0644);
39 MODULE_PARM_DESC(disable_raw_mode,
40 	"Disable Raw mode reporting for touchpads and keep firmware gestures.");
41 
42 static bool disable_tap_to_click;
43 module_param(disable_tap_to_click, bool, 0644);
44 MODULE_PARM_DESC(disable_tap_to_click,
45 	"Disable Tap-To-Click mode reporting for touchpads (only on the K400 currently).");
46 
47 #define REPORT_ID_HIDPP_SHORT			0x10
48 #define REPORT_ID_HIDPP_LONG			0x11
49 #define REPORT_ID_HIDPP_VERY_LONG		0x12
50 
51 #define HIDPP_REPORT_SHORT_LENGTH		7
52 #define HIDPP_REPORT_LONG_LENGTH		20
53 #define HIDPP_REPORT_VERY_LONG_LENGTH		64
54 
55 #define HIDPP_QUIRK_CLASS_WTP			BIT(0)
56 #define HIDPP_QUIRK_CLASS_M560			BIT(1)
57 #define HIDPP_QUIRK_CLASS_K400			BIT(2)
58 #define HIDPP_QUIRK_CLASS_G920			BIT(3)
59 
60 /* bits 2..20 are reserved for classes */
61 #define HIDPP_QUIRK_CONNECT_EVENTS		BIT(21)
62 #define HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS	BIT(22)
63 #define HIDPP_QUIRK_NO_HIDINPUT			BIT(23)
64 #define HIDPP_QUIRK_FORCE_OUTPUT_REPORTS	BIT(24)
65 
66 #define HIDPP_QUIRK_DELAYED_INIT		(HIDPP_QUIRK_NO_HIDINPUT | \
67 						 HIDPP_QUIRK_CONNECT_EVENTS)
68 
69 /*
70  * There are two hidpp protocols in use, the first version hidpp10 is known
71  * as register access protocol or RAP, the second version hidpp20 is known as
72  * feature access protocol or FAP
73  *
74  * Most older devices (including the Unifying usb receiver) use the RAP protocol
75  * where as most newer devices use the FAP protocol. Both protocols are
76  * compatible with the underlying transport, which could be usb, Unifiying, or
77  * bluetooth. The message lengths are defined by the hid vendor specific report
78  * descriptor for the HIDPP_SHORT report type (total message lenth 7 bytes) and
79  * the HIDPP_LONG report type (total message length 20 bytes)
80  *
81  * The RAP protocol uses both report types, whereas the FAP only uses HIDPP_LONG
82  * messages. The Unifying receiver itself responds to RAP messages (device index
83  * is 0xFF for the receiver), and all messages (short or long) with a device
84  * index between 1 and 6 are passed untouched to the corresponding paired
85  * Unifying device.
86  *
87  * The paired device can be RAP or FAP, it will receive the message untouched
88  * from the Unifiying receiver.
89  */
90 
91 struct fap {
92 	u8 feature_index;
93 	u8 funcindex_clientid;
94 	u8 params[HIDPP_REPORT_VERY_LONG_LENGTH - 4U];
95 };
96 
97 struct rap {
98 	u8 sub_id;
99 	u8 reg_address;
100 	u8 params[HIDPP_REPORT_VERY_LONG_LENGTH - 4U];
101 };
102 
103 struct hidpp_report {
104 	u8 report_id;
105 	u8 device_index;
106 	union {
107 		struct fap fap;
108 		struct rap rap;
109 		u8 rawbytes[sizeof(struct fap)];
110 	};
111 } __packed;
112 
113 struct hidpp_device {
114 	struct hid_device *hid_dev;
115 	struct mutex send_mutex;
116 	void *send_receive_buf;
117 	char *name;		/* will never be NULL and should not be freed */
118 	wait_queue_head_t wait;
119 	bool answer_available;
120 	u8 protocol_major;
121 	u8 protocol_minor;
122 
123 	void *private_data;
124 
125 	struct work_struct work;
126 	struct kfifo delayed_work_fifo;
127 	atomic_t connected;
128 	struct input_dev *delayed_input;
129 
130 	unsigned long quirks;
131 };
132 
133 
134 /* HID++ 1.0 error codes */
135 #define HIDPP_ERROR				0x8f
136 #define HIDPP_ERROR_SUCCESS			0x00
137 #define HIDPP_ERROR_INVALID_SUBID		0x01
138 #define HIDPP_ERROR_INVALID_ADRESS		0x02
139 #define HIDPP_ERROR_INVALID_VALUE		0x03
140 #define HIDPP_ERROR_CONNECT_FAIL		0x04
141 #define HIDPP_ERROR_TOO_MANY_DEVICES		0x05
142 #define HIDPP_ERROR_ALREADY_EXISTS		0x06
143 #define HIDPP_ERROR_BUSY			0x07
144 #define HIDPP_ERROR_UNKNOWN_DEVICE		0x08
145 #define HIDPP_ERROR_RESOURCE_ERROR		0x09
146 #define HIDPP_ERROR_REQUEST_UNAVAILABLE		0x0a
147 #define HIDPP_ERROR_INVALID_PARAM_VALUE		0x0b
148 #define HIDPP_ERROR_WRONG_PIN_CODE		0x0c
149 /* HID++ 2.0 error codes */
150 #define HIDPP20_ERROR				0xff
151 
152 static void hidpp_connect_event(struct hidpp_device *hidpp_dev);
153 
154 static int __hidpp_send_report(struct hid_device *hdev,
155 				struct hidpp_report *hidpp_report)
156 {
157 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
158 	int fields_count, ret;
159 
160 	hidpp = hid_get_drvdata(hdev);
161 
162 	switch (hidpp_report->report_id) {
163 	case REPORT_ID_HIDPP_SHORT:
164 		fields_count = HIDPP_REPORT_SHORT_LENGTH;
165 		break;
166 	case REPORT_ID_HIDPP_LONG:
167 		fields_count = HIDPP_REPORT_LONG_LENGTH;
168 		break;
169 	case REPORT_ID_HIDPP_VERY_LONG:
170 		fields_count = HIDPP_REPORT_VERY_LONG_LENGTH;
171 		break;
172 	default:
173 		return -ENODEV;
174 	}
175 
176 	/*
177 	 * set the device_index as the receiver, it will be overwritten by
178 	 * hid_hw_request if needed
179 	 */
180 	hidpp_report->device_index = 0xff;
181 
182 	if (hidpp->quirks & HIDPP_QUIRK_FORCE_OUTPUT_REPORTS) {
183 		ret = hid_hw_output_report(hdev, (u8 *)hidpp_report, fields_count);
184 	} else {
185 		ret = hid_hw_raw_request(hdev, hidpp_report->report_id,
186 			(u8 *)hidpp_report, fields_count, HID_OUTPUT_REPORT,
187 			HID_REQ_SET_REPORT);
188 	}
189 
190 	return ret == fields_count ? 0 : -1;
191 }
192 
193 /**
194  * hidpp_send_message_sync() returns 0 in case of success, and something else
195  * in case of a failure.
196  * - If ' something else' is positive, that means that an error has been raised
197  *   by the protocol itself.
198  * - If ' something else' is negative, that means that we had a classic error
199  *   (-ENOMEM, -EPIPE, etc...)
200  */
201 static int hidpp_send_message_sync(struct hidpp_device *hidpp,
202 	struct hidpp_report *message,
203 	struct hidpp_report *response)
204 {
205 	int ret;
206 
207 	mutex_lock(&hidpp->send_mutex);
208 
209 	hidpp->send_receive_buf = response;
210 	hidpp->answer_available = false;
211 
212 	/*
213 	 * So that we can later validate the answer when it arrives
214 	 * in hidpp_raw_event
215 	 */
216 	*response = *message;
217 
218 	ret = __hidpp_send_report(hidpp->hid_dev, message);
219 
220 	if (ret) {
221 		dbg_hid("__hidpp_send_report returned err: %d\n", ret);
222 		memset(response, 0, sizeof(struct hidpp_report));
223 		goto exit;
224 	}
225 
226 	if (!wait_event_timeout(hidpp->wait, hidpp->answer_available,
227 				5*HZ)) {
228 		dbg_hid("%s:timeout waiting for response\n", __func__);
229 		memset(response, 0, sizeof(struct hidpp_report));
230 		ret = -ETIMEDOUT;
231 	}
232 
233 	if (response->report_id == REPORT_ID_HIDPP_SHORT &&
234 	    response->rap.sub_id == HIDPP_ERROR) {
235 		ret = response->rap.params[1];
236 		dbg_hid("%s:got hidpp error %02X\n", __func__, ret);
237 		goto exit;
238 	}
239 
240 	if ((response->report_id == REPORT_ID_HIDPP_LONG ||
241 			response->report_id == REPORT_ID_HIDPP_VERY_LONG) &&
242 			response->fap.feature_index == HIDPP20_ERROR) {
243 		ret = response->fap.params[1];
244 		dbg_hid("%s:got hidpp 2.0 error %02X\n", __func__, ret);
245 		goto exit;
246 	}
247 
248 exit:
249 	mutex_unlock(&hidpp->send_mutex);
250 	return ret;
251 
252 }
253 
254 static int hidpp_send_fap_command_sync(struct hidpp_device *hidpp,
255 	u8 feat_index, u8 funcindex_clientid, u8 *params, int param_count,
256 	struct hidpp_report *response)
257 {
258 	struct hidpp_report *message;
259 	int ret;
260 
261 	if (param_count > sizeof(message->fap.params))
262 		return -EINVAL;
263 
264 	message = kzalloc(sizeof(struct hidpp_report), GFP_KERNEL);
265 	if (!message)
266 		return -ENOMEM;
267 
268 	if (param_count > (HIDPP_REPORT_LONG_LENGTH - 4))
269 		message->report_id = REPORT_ID_HIDPP_VERY_LONG;
270 	else
271 		message->report_id = REPORT_ID_HIDPP_LONG;
272 	message->fap.feature_index = feat_index;
273 	message->fap.funcindex_clientid = funcindex_clientid;
274 	memcpy(&message->fap.params, params, param_count);
275 
276 	ret = hidpp_send_message_sync(hidpp, message, response);
277 	kfree(message);
278 	return ret;
279 }
280 
281 static int hidpp_send_rap_command_sync(struct hidpp_device *hidpp_dev,
282 	u8 report_id, u8 sub_id, u8 reg_address, u8 *params, int param_count,
283 	struct hidpp_report *response)
284 {
285 	struct hidpp_report *message;
286 	int ret, max_count;
287 
288 	switch (report_id) {
289 	case REPORT_ID_HIDPP_SHORT:
290 		max_count = HIDPP_REPORT_SHORT_LENGTH - 4;
291 		break;
292 	case REPORT_ID_HIDPP_LONG:
293 		max_count = HIDPP_REPORT_LONG_LENGTH - 4;
294 		break;
295 	case REPORT_ID_HIDPP_VERY_LONG:
296 		max_count = HIDPP_REPORT_VERY_LONG_LENGTH - 4;
297 		break;
298 	default:
299 		return -EINVAL;
300 	}
301 
302 	if (param_count > max_count)
303 		return -EINVAL;
304 
305 	message = kzalloc(sizeof(struct hidpp_report), GFP_KERNEL);
306 	if (!message)
307 		return -ENOMEM;
308 	message->report_id = report_id;
309 	message->rap.sub_id = sub_id;
310 	message->rap.reg_address = reg_address;
311 	memcpy(&message->rap.params, params, param_count);
312 
313 	ret = hidpp_send_message_sync(hidpp_dev, message, response);
314 	kfree(message);
315 	return ret;
316 }
317 
318 static void delayed_work_cb(struct work_struct *work)
319 {
320 	struct hidpp_device *hidpp = container_of(work, struct hidpp_device,
321 							work);
322 	hidpp_connect_event(hidpp);
323 }
324 
325 static inline bool hidpp_match_answer(struct hidpp_report *question,
326 		struct hidpp_report *answer)
327 {
328 	return (answer->fap.feature_index == question->fap.feature_index) &&
329 	   (answer->fap.funcindex_clientid == question->fap.funcindex_clientid);
330 }
331 
332 static inline bool hidpp_match_error(struct hidpp_report *question,
333 		struct hidpp_report *answer)
334 {
335 	return ((answer->rap.sub_id == HIDPP_ERROR) ||
336 	    (answer->fap.feature_index == HIDPP20_ERROR)) &&
337 	    (answer->fap.funcindex_clientid == question->fap.feature_index) &&
338 	    (answer->fap.params[0] == question->fap.funcindex_clientid);
339 }
340 
341 static inline bool hidpp_report_is_connect_event(struct hidpp_report *report)
342 {
343 	return (report->report_id == REPORT_ID_HIDPP_SHORT) &&
344 		(report->rap.sub_id == 0x41);
345 }
346 
347 /**
348  * hidpp_prefix_name() prefixes the current given name with "Logitech ".
349  */
350 static void hidpp_prefix_name(char **name, int name_length)
351 {
352 #define PREFIX_LENGTH 9 /* "Logitech " */
353 
354 	int new_length;
355 	char *new_name;
356 
357 	if (name_length > PREFIX_LENGTH &&
358 	    strncmp(*name, "Logitech ", PREFIX_LENGTH) == 0)
359 		/* The prefix has is already in the name */
360 		return;
361 
362 	new_length = PREFIX_LENGTH + name_length;
363 	new_name = kzalloc(new_length, GFP_KERNEL);
364 	if (!new_name)
365 		return;
366 
367 	snprintf(new_name, new_length, "Logitech %s", *name);
368 
369 	kfree(*name);
370 
371 	*name = new_name;
372 }
373 
374 /* -------------------------------------------------------------------------- */
375 /* HIDP++ 1.0 commands                                                        */
376 /* -------------------------------------------------------------------------- */
377 
378 #define HIDPP_SET_REGISTER				0x80
379 #define HIDPP_GET_REGISTER				0x81
380 #define HIDPP_SET_LONG_REGISTER				0x82
381 #define HIDPP_GET_LONG_REGISTER				0x83
382 
383 #define HIDPP_REG_PAIRING_INFORMATION			0xB5
384 #define DEVICE_NAME					0x40
385 
386 static char *hidpp_get_unifying_name(struct hidpp_device *hidpp_dev)
387 {
388 	struct hidpp_report response;
389 	int ret;
390 	/* hid-logitech-dj is in charge of setting the right device index */
391 	u8 params[1] = { DEVICE_NAME };
392 	char *name;
393 	int len;
394 
395 	ret = hidpp_send_rap_command_sync(hidpp_dev,
396 					REPORT_ID_HIDPP_SHORT,
397 					HIDPP_GET_LONG_REGISTER,
398 					HIDPP_REG_PAIRING_INFORMATION,
399 					params, 1, &response);
400 	if (ret)
401 		return NULL;
402 
403 	len = response.rap.params[1];
404 
405 	if (2 + len > sizeof(response.rap.params))
406 		return NULL;
407 
408 	name = kzalloc(len + 1, GFP_KERNEL);
409 	if (!name)
410 		return NULL;
411 
412 	memcpy(name, &response.rap.params[2], len);
413 
414 	/* include the terminating '\0' */
415 	hidpp_prefix_name(&name, len + 1);
416 
417 	return name;
418 }
419 
420 /* -------------------------------------------------------------------------- */
421 /* 0x0000: Root                                                               */
422 /* -------------------------------------------------------------------------- */
423 
424 #define HIDPP_PAGE_ROOT					0x0000
425 #define HIDPP_PAGE_ROOT_IDX				0x00
426 
427 #define CMD_ROOT_GET_FEATURE				0x01
428 #define CMD_ROOT_GET_PROTOCOL_VERSION			0x11
429 
430 static int hidpp_root_get_feature(struct hidpp_device *hidpp, u16 feature,
431 	u8 *feature_index, u8 *feature_type)
432 {
433 	struct hidpp_report response;
434 	int ret;
435 	u8 params[2] = { feature >> 8, feature & 0x00FF };
436 
437 	ret = hidpp_send_fap_command_sync(hidpp,
438 			HIDPP_PAGE_ROOT_IDX,
439 			CMD_ROOT_GET_FEATURE,
440 			params, 2, &response);
441 	if (ret)
442 		return ret;
443 
444 	*feature_index = response.fap.params[0];
445 	*feature_type = response.fap.params[1];
446 
447 	return ret;
448 }
449 
450 static int hidpp_root_get_protocol_version(struct hidpp_device *hidpp)
451 {
452 	struct hidpp_report response;
453 	int ret;
454 
455 	ret = hidpp_send_fap_command_sync(hidpp,
456 			HIDPP_PAGE_ROOT_IDX,
457 			CMD_ROOT_GET_PROTOCOL_VERSION,
458 			NULL, 0, &response);
459 
460 	if (ret == HIDPP_ERROR_INVALID_SUBID) {
461 		hidpp->protocol_major = 1;
462 		hidpp->protocol_minor = 0;
463 		return 0;
464 	}
465 
466 	/* the device might not be connected */
467 	if (ret == HIDPP_ERROR_RESOURCE_ERROR)
468 		return -EIO;
469 
470 	if (ret > 0) {
471 		hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
472 			__func__, ret);
473 		return -EPROTO;
474 	}
475 	if (ret)
476 		return ret;
477 
478 	hidpp->protocol_major = response.fap.params[0];
479 	hidpp->protocol_minor = response.fap.params[1];
480 
481 	return ret;
482 }
483 
484 static bool hidpp_is_connected(struct hidpp_device *hidpp)
485 {
486 	int ret;
487 
488 	ret = hidpp_root_get_protocol_version(hidpp);
489 	if (!ret)
490 		hid_dbg(hidpp->hid_dev, "HID++ %u.%u device connected.\n",
491 			hidpp->protocol_major, hidpp->protocol_minor);
492 	return ret == 0;
493 }
494 
495 /* -------------------------------------------------------------------------- */
496 /* 0x0005: GetDeviceNameType                                                  */
497 /* -------------------------------------------------------------------------- */
498 
499 #define HIDPP_PAGE_GET_DEVICE_NAME_TYPE			0x0005
500 
501 #define CMD_GET_DEVICE_NAME_TYPE_GET_COUNT		0x01
502 #define CMD_GET_DEVICE_NAME_TYPE_GET_DEVICE_NAME	0x11
503 #define CMD_GET_DEVICE_NAME_TYPE_GET_TYPE		0x21
504 
505 static int hidpp_devicenametype_get_count(struct hidpp_device *hidpp,
506 	u8 feature_index, u8 *nameLength)
507 {
508 	struct hidpp_report response;
509 	int ret;
510 
511 	ret = hidpp_send_fap_command_sync(hidpp, feature_index,
512 		CMD_GET_DEVICE_NAME_TYPE_GET_COUNT, NULL, 0, &response);
513 
514 	if (ret > 0) {
515 		hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
516 			__func__, ret);
517 		return -EPROTO;
518 	}
519 	if (ret)
520 		return ret;
521 
522 	*nameLength = response.fap.params[0];
523 
524 	return ret;
525 }
526 
527 static int hidpp_devicenametype_get_device_name(struct hidpp_device *hidpp,
528 	u8 feature_index, u8 char_index, char *device_name, int len_buf)
529 {
530 	struct hidpp_report response;
531 	int ret, i;
532 	int count;
533 
534 	ret = hidpp_send_fap_command_sync(hidpp, feature_index,
535 		CMD_GET_DEVICE_NAME_TYPE_GET_DEVICE_NAME, &char_index, 1,
536 		&response);
537 
538 	if (ret > 0) {
539 		hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
540 			__func__, ret);
541 		return -EPROTO;
542 	}
543 	if (ret)
544 		return ret;
545 
546 	switch (response.report_id) {
547 	case REPORT_ID_HIDPP_VERY_LONG:
548 		count = HIDPP_REPORT_VERY_LONG_LENGTH - 4;
549 		break;
550 	case REPORT_ID_HIDPP_LONG:
551 		count = HIDPP_REPORT_LONG_LENGTH - 4;
552 		break;
553 	case REPORT_ID_HIDPP_SHORT:
554 		count = HIDPP_REPORT_SHORT_LENGTH - 4;
555 		break;
556 	default:
557 		return -EPROTO;
558 	}
559 
560 	if (len_buf < count)
561 		count = len_buf;
562 
563 	for (i = 0; i < count; i++)
564 		device_name[i] = response.fap.params[i];
565 
566 	return count;
567 }
568 
569 static char *hidpp_get_device_name(struct hidpp_device *hidpp)
570 {
571 	u8 feature_type;
572 	u8 feature_index;
573 	u8 __name_length;
574 	char *name;
575 	unsigned index = 0;
576 	int ret;
577 
578 	ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_GET_DEVICE_NAME_TYPE,
579 		&feature_index, &feature_type);
580 	if (ret)
581 		return NULL;
582 
583 	ret = hidpp_devicenametype_get_count(hidpp, feature_index,
584 		&__name_length);
585 	if (ret)
586 		return NULL;
587 
588 	name = kzalloc(__name_length + 1, GFP_KERNEL);
589 	if (!name)
590 		return NULL;
591 
592 	while (index < __name_length) {
593 		ret = hidpp_devicenametype_get_device_name(hidpp,
594 			feature_index, index, name + index,
595 			__name_length - index);
596 		if (ret <= 0) {
597 			kfree(name);
598 			return NULL;
599 		}
600 		index += ret;
601 	}
602 
603 	/* include the terminating '\0' */
604 	hidpp_prefix_name(&name, __name_length + 1);
605 
606 	return name;
607 }
608 
609 /* -------------------------------------------------------------------------- */
610 /* 0x6010: Touchpad FW items                                                  */
611 /* -------------------------------------------------------------------------- */
612 
613 #define HIDPP_PAGE_TOUCHPAD_FW_ITEMS			0x6010
614 
615 #define CMD_TOUCHPAD_FW_ITEMS_SET			0x10
616 
617 struct hidpp_touchpad_fw_items {
618 	uint8_t presence;
619 	uint8_t desired_state;
620 	uint8_t state;
621 	uint8_t persistent;
622 };
623 
624 /**
625  * send a set state command to the device by reading the current items->state
626  * field. items is then filled with the current state.
627  */
628 static int hidpp_touchpad_fw_items_set(struct hidpp_device *hidpp,
629 				       u8 feature_index,
630 				       struct hidpp_touchpad_fw_items *items)
631 {
632 	struct hidpp_report response;
633 	int ret;
634 	u8 *params = (u8 *)response.fap.params;
635 
636 	ret = hidpp_send_fap_command_sync(hidpp, feature_index,
637 		CMD_TOUCHPAD_FW_ITEMS_SET, &items->state, 1, &response);
638 
639 	if (ret > 0) {
640 		hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
641 			__func__, ret);
642 		return -EPROTO;
643 	}
644 	if (ret)
645 		return ret;
646 
647 	items->presence = params[0];
648 	items->desired_state = params[1];
649 	items->state = params[2];
650 	items->persistent = params[3];
651 
652 	return 0;
653 }
654 
655 /* -------------------------------------------------------------------------- */
656 /* 0x6100: TouchPadRawXY                                                      */
657 /* -------------------------------------------------------------------------- */
658 
659 #define HIDPP_PAGE_TOUCHPAD_RAW_XY			0x6100
660 
661 #define CMD_TOUCHPAD_GET_RAW_INFO			0x01
662 #define CMD_TOUCHPAD_SET_RAW_REPORT_STATE		0x21
663 
664 #define EVENT_TOUCHPAD_RAW_XY				0x00
665 
666 #define TOUCHPAD_RAW_XY_ORIGIN_LOWER_LEFT		0x01
667 #define TOUCHPAD_RAW_XY_ORIGIN_UPPER_LEFT		0x03
668 
669 struct hidpp_touchpad_raw_info {
670 	u16 x_size;
671 	u16 y_size;
672 	u8 z_range;
673 	u8 area_range;
674 	u8 timestamp_unit;
675 	u8 maxcontacts;
676 	u8 origin;
677 	u16 res;
678 };
679 
680 struct hidpp_touchpad_raw_xy_finger {
681 	u8 contact_type;
682 	u8 contact_status;
683 	u16 x;
684 	u16 y;
685 	u8 z;
686 	u8 area;
687 	u8 finger_id;
688 };
689 
690 struct hidpp_touchpad_raw_xy {
691 	u16 timestamp;
692 	struct hidpp_touchpad_raw_xy_finger fingers[2];
693 	u8 spurious_flag;
694 	u8 end_of_frame;
695 	u8 finger_count;
696 	u8 button;
697 };
698 
699 static int hidpp_touchpad_get_raw_info(struct hidpp_device *hidpp,
700 	u8 feature_index, struct hidpp_touchpad_raw_info *raw_info)
701 {
702 	struct hidpp_report response;
703 	int ret;
704 	u8 *params = (u8 *)response.fap.params;
705 
706 	ret = hidpp_send_fap_command_sync(hidpp, feature_index,
707 		CMD_TOUCHPAD_GET_RAW_INFO, NULL, 0, &response);
708 
709 	if (ret > 0) {
710 		hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
711 			__func__, ret);
712 		return -EPROTO;
713 	}
714 	if (ret)
715 		return ret;
716 
717 	raw_info->x_size = get_unaligned_be16(&params[0]);
718 	raw_info->y_size = get_unaligned_be16(&params[2]);
719 	raw_info->z_range = params[4];
720 	raw_info->area_range = params[5];
721 	raw_info->maxcontacts = params[7];
722 	raw_info->origin = params[8];
723 	/* res is given in unit per inch */
724 	raw_info->res = get_unaligned_be16(&params[13]) * 2 / 51;
725 
726 	return ret;
727 }
728 
729 static int hidpp_touchpad_set_raw_report_state(struct hidpp_device *hidpp_dev,
730 		u8 feature_index, bool send_raw_reports,
731 		bool sensor_enhanced_settings)
732 {
733 	struct hidpp_report response;
734 
735 	/*
736 	 * Params:
737 	 *   bit 0 - enable raw
738 	 *   bit 1 - 16bit Z, no area
739 	 *   bit 2 - enhanced sensitivity
740 	 *   bit 3 - width, height (4 bits each) instead of area
741 	 *   bit 4 - send raw + gestures (degrades smoothness)
742 	 *   remaining bits - reserved
743 	 */
744 	u8 params = send_raw_reports | (sensor_enhanced_settings << 2);
745 
746 	return hidpp_send_fap_command_sync(hidpp_dev, feature_index,
747 		CMD_TOUCHPAD_SET_RAW_REPORT_STATE, &params, 1, &response);
748 }
749 
750 static void hidpp_touchpad_touch_event(u8 *data,
751 	struct hidpp_touchpad_raw_xy_finger *finger)
752 {
753 	u8 x_m = data[0] << 2;
754 	u8 y_m = data[2] << 2;
755 
756 	finger->x = x_m << 6 | data[1];
757 	finger->y = y_m << 6 | data[3];
758 
759 	finger->contact_type = data[0] >> 6;
760 	finger->contact_status = data[2] >> 6;
761 
762 	finger->z = data[4];
763 	finger->area = data[5];
764 	finger->finger_id = data[6] >> 4;
765 }
766 
767 static void hidpp_touchpad_raw_xy_event(struct hidpp_device *hidpp_dev,
768 		u8 *data, struct hidpp_touchpad_raw_xy *raw_xy)
769 {
770 	memset(raw_xy, 0, sizeof(struct hidpp_touchpad_raw_xy));
771 	raw_xy->end_of_frame = data[8] & 0x01;
772 	raw_xy->spurious_flag = (data[8] >> 1) & 0x01;
773 	raw_xy->finger_count = data[15] & 0x0f;
774 	raw_xy->button = (data[8] >> 2) & 0x01;
775 
776 	if (raw_xy->finger_count) {
777 		hidpp_touchpad_touch_event(&data[2], &raw_xy->fingers[0]);
778 		hidpp_touchpad_touch_event(&data[9], &raw_xy->fingers[1]);
779 	}
780 }
781 
782 /* -------------------------------------------------------------------------- */
783 /* 0x8123: Force feedback support                                             */
784 /* -------------------------------------------------------------------------- */
785 
786 #define HIDPP_FF_GET_INFO		0x01
787 #define HIDPP_FF_RESET_ALL		0x11
788 #define HIDPP_FF_DOWNLOAD_EFFECT	0x21
789 #define HIDPP_FF_SET_EFFECT_STATE	0x31
790 #define HIDPP_FF_DESTROY_EFFECT		0x41
791 #define HIDPP_FF_GET_APERTURE		0x51
792 #define HIDPP_FF_SET_APERTURE		0x61
793 #define HIDPP_FF_GET_GLOBAL_GAINS	0x71
794 #define HIDPP_FF_SET_GLOBAL_GAINS	0x81
795 
796 #define HIDPP_FF_EFFECT_STATE_GET	0x00
797 #define HIDPP_FF_EFFECT_STATE_STOP	0x01
798 #define HIDPP_FF_EFFECT_STATE_PLAY	0x02
799 #define HIDPP_FF_EFFECT_STATE_PAUSE	0x03
800 
801 #define HIDPP_FF_EFFECT_CONSTANT	0x00
802 #define HIDPP_FF_EFFECT_PERIODIC_SINE		0x01
803 #define HIDPP_FF_EFFECT_PERIODIC_SQUARE		0x02
804 #define HIDPP_FF_EFFECT_PERIODIC_TRIANGLE	0x03
805 #define HIDPP_FF_EFFECT_PERIODIC_SAWTOOTHUP	0x04
806 #define HIDPP_FF_EFFECT_PERIODIC_SAWTOOTHDOWN	0x05
807 #define HIDPP_FF_EFFECT_SPRING		0x06
808 #define HIDPP_FF_EFFECT_DAMPER		0x07
809 #define HIDPP_FF_EFFECT_FRICTION	0x08
810 #define HIDPP_FF_EFFECT_INERTIA		0x09
811 #define HIDPP_FF_EFFECT_RAMP		0x0A
812 
813 #define HIDPP_FF_EFFECT_AUTOSTART	0x80
814 
815 #define HIDPP_FF_EFFECTID_NONE		-1
816 #define HIDPP_FF_EFFECTID_AUTOCENTER	-2
817 
818 #define HIDPP_FF_MAX_PARAMS	20
819 #define HIDPP_FF_RESERVED_SLOTS	1
820 
821 struct hidpp_ff_private_data {
822 	struct hidpp_device *hidpp;
823 	u8 feature_index;
824 	u8 version;
825 	u16 gain;
826 	s16 range;
827 	u8 slot_autocenter;
828 	u8 num_effects;
829 	int *effect_ids;
830 	struct workqueue_struct *wq;
831 	atomic_t workqueue_size;
832 };
833 
834 struct hidpp_ff_work_data {
835 	struct work_struct work;
836 	struct hidpp_ff_private_data *data;
837 	int effect_id;
838 	u8 command;
839 	u8 params[HIDPP_FF_MAX_PARAMS];
840 	u8 size;
841 };
842 
843 static const signed short hiddpp_ff_effects[] = {
844 	FF_CONSTANT,
845 	FF_PERIODIC,
846 	FF_SINE,
847 	FF_SQUARE,
848 	FF_SAW_UP,
849 	FF_SAW_DOWN,
850 	FF_TRIANGLE,
851 	FF_SPRING,
852 	FF_DAMPER,
853 	FF_AUTOCENTER,
854 	FF_GAIN,
855 	-1
856 };
857 
858 static const signed short hiddpp_ff_effects_v2[] = {
859 	FF_RAMP,
860 	FF_FRICTION,
861 	FF_INERTIA,
862 	-1
863 };
864 
865 static const u8 HIDPP_FF_CONDITION_CMDS[] = {
866 	HIDPP_FF_EFFECT_SPRING,
867 	HIDPP_FF_EFFECT_FRICTION,
868 	HIDPP_FF_EFFECT_DAMPER,
869 	HIDPP_FF_EFFECT_INERTIA
870 };
871 
872 static const char *HIDPP_FF_CONDITION_NAMES[] = {
873 	"spring",
874 	"friction",
875 	"damper",
876 	"inertia"
877 };
878 
879 
880 static u8 hidpp_ff_find_effect(struct hidpp_ff_private_data *data, int effect_id)
881 {
882 	int i;
883 
884 	for (i = 0; i < data->num_effects; i++)
885 		if (data->effect_ids[i] == effect_id)
886 			return i+1;
887 
888 	return 0;
889 }
890 
891 static void hidpp_ff_work_handler(struct work_struct *w)
892 {
893 	struct hidpp_ff_work_data *wd = container_of(w, struct hidpp_ff_work_data, work);
894 	struct hidpp_ff_private_data *data = wd->data;
895 	struct hidpp_report response;
896 	u8 slot;
897 	int ret;
898 
899 	/* add slot number if needed */
900 	switch (wd->effect_id) {
901 	case HIDPP_FF_EFFECTID_AUTOCENTER:
902 		wd->params[0] = data->slot_autocenter;
903 		break;
904 	case HIDPP_FF_EFFECTID_NONE:
905 		/* leave slot as zero */
906 		break;
907 	default:
908 		/* find current slot for effect */
909 		wd->params[0] = hidpp_ff_find_effect(data, wd->effect_id);
910 		break;
911 	}
912 
913 	/* send command and wait for reply */
914 	ret = hidpp_send_fap_command_sync(data->hidpp, data->feature_index,
915 		wd->command, wd->params, wd->size, &response);
916 
917 	if (ret) {
918 		hid_err(data->hidpp->hid_dev, "Failed to send command to device!\n");
919 		goto out;
920 	}
921 
922 	/* parse return data */
923 	switch (wd->command) {
924 	case HIDPP_FF_DOWNLOAD_EFFECT:
925 		slot = response.fap.params[0];
926 		if (slot > 0 && slot <= data->num_effects) {
927 			if (wd->effect_id >= 0)
928 				/* regular effect uploaded */
929 				data->effect_ids[slot-1] = wd->effect_id;
930 			else if (wd->effect_id >= HIDPP_FF_EFFECTID_AUTOCENTER)
931 				/* autocenter spring uploaded */
932 				data->slot_autocenter = slot;
933 		}
934 		break;
935 	case HIDPP_FF_DESTROY_EFFECT:
936 		if (wd->effect_id >= 0)
937 			/* regular effect destroyed */
938 			data->effect_ids[wd->params[0]-1] = -1;
939 		else if (wd->effect_id >= HIDPP_FF_EFFECTID_AUTOCENTER)
940 			/* autocenter spring destoyed */
941 			data->slot_autocenter = 0;
942 		break;
943 	case HIDPP_FF_SET_GLOBAL_GAINS:
944 		data->gain = (wd->params[0] << 8) + wd->params[1];
945 		break;
946 	case HIDPP_FF_SET_APERTURE:
947 		data->range = (wd->params[0] << 8) + wd->params[1];
948 		break;
949 	default:
950 		/* no action needed */
951 		break;
952 	}
953 
954 out:
955 	atomic_dec(&data->workqueue_size);
956 	kfree(wd);
957 }
958 
959 static int hidpp_ff_queue_work(struct hidpp_ff_private_data *data, int effect_id, u8 command, u8 *params, u8 size)
960 {
961 	struct hidpp_ff_work_data *wd = kzalloc(sizeof(*wd), GFP_KERNEL);
962 	int s;
963 
964 	if (!wd)
965 		return -ENOMEM;
966 
967 	INIT_WORK(&wd->work, hidpp_ff_work_handler);
968 
969 	wd->data = data;
970 	wd->effect_id = effect_id;
971 	wd->command = command;
972 	wd->size = size;
973 	memcpy(wd->params, params, size);
974 
975 	atomic_inc(&data->workqueue_size);
976 	queue_work(data->wq, &wd->work);
977 
978 	/* warn about excessive queue size */
979 	s = atomic_read(&data->workqueue_size);
980 	if (s >= 20 && s % 20 == 0)
981 		hid_warn(data->hidpp->hid_dev, "Force feedback command queue contains %d commands, causing substantial delays!", s);
982 
983 	return 0;
984 }
985 
986 static int hidpp_ff_upload_effect(struct input_dev *dev, struct ff_effect *effect, struct ff_effect *old)
987 {
988 	struct hidpp_ff_private_data *data = dev->ff->private;
989 	u8 params[20];
990 	u8 size;
991 	int force;
992 
993 	/* set common parameters */
994 	params[2] = effect->replay.length >> 8;
995 	params[3] = effect->replay.length & 255;
996 	params[4] = effect->replay.delay >> 8;
997 	params[5] = effect->replay.delay & 255;
998 
999 	switch (effect->type) {
1000 	case FF_CONSTANT:
1001 		force = (effect->u.constant.level * fixp_sin16((effect->direction * 360) >> 16)) >> 15;
1002 		params[1] = HIDPP_FF_EFFECT_CONSTANT;
1003 		params[6] = force >> 8;
1004 		params[7] = force & 255;
1005 		params[8] = effect->u.constant.envelope.attack_level >> 7;
1006 		params[9] = effect->u.constant.envelope.attack_length >> 8;
1007 		params[10] = effect->u.constant.envelope.attack_length & 255;
1008 		params[11] = effect->u.constant.envelope.fade_level >> 7;
1009 		params[12] = effect->u.constant.envelope.fade_length >> 8;
1010 		params[13] = effect->u.constant.envelope.fade_length & 255;
1011 		size = 14;
1012 		dbg_hid("Uploading constant force level=%d in dir %d = %d\n",
1013 				effect->u.constant.level,
1014 				effect->direction, force);
1015 		dbg_hid("          envelope attack=(%d, %d ms) fade=(%d, %d ms)\n",
1016 				effect->u.constant.envelope.attack_level,
1017 				effect->u.constant.envelope.attack_length,
1018 				effect->u.constant.envelope.fade_level,
1019 				effect->u.constant.envelope.fade_length);
1020 		break;
1021 	case FF_PERIODIC:
1022 	{
1023 		switch (effect->u.periodic.waveform) {
1024 		case FF_SINE:
1025 			params[1] = HIDPP_FF_EFFECT_PERIODIC_SINE;
1026 			break;
1027 		case FF_SQUARE:
1028 			params[1] = HIDPP_FF_EFFECT_PERIODIC_SQUARE;
1029 			break;
1030 		case FF_SAW_UP:
1031 			params[1] = HIDPP_FF_EFFECT_PERIODIC_SAWTOOTHUP;
1032 			break;
1033 		case FF_SAW_DOWN:
1034 			params[1] = HIDPP_FF_EFFECT_PERIODIC_SAWTOOTHDOWN;
1035 			break;
1036 		case FF_TRIANGLE:
1037 			params[1] = HIDPP_FF_EFFECT_PERIODIC_TRIANGLE;
1038 			break;
1039 		default:
1040 			hid_err(data->hidpp->hid_dev, "Unexpected periodic waveform type %i!\n", effect->u.periodic.waveform);
1041 			return -EINVAL;
1042 		}
1043 		force = (effect->u.periodic.magnitude * fixp_sin16((effect->direction * 360) >> 16)) >> 15;
1044 		params[6] = effect->u.periodic.magnitude >> 8;
1045 		params[7] = effect->u.periodic.magnitude & 255;
1046 		params[8] = effect->u.periodic.offset >> 8;
1047 		params[9] = effect->u.periodic.offset & 255;
1048 		params[10] = effect->u.periodic.period >> 8;
1049 		params[11] = effect->u.periodic.period & 255;
1050 		params[12] = effect->u.periodic.phase >> 8;
1051 		params[13] = effect->u.periodic.phase & 255;
1052 		params[14] = effect->u.periodic.envelope.attack_level >> 7;
1053 		params[15] = effect->u.periodic.envelope.attack_length >> 8;
1054 		params[16] = effect->u.periodic.envelope.attack_length & 255;
1055 		params[17] = effect->u.periodic.envelope.fade_level >> 7;
1056 		params[18] = effect->u.periodic.envelope.fade_length >> 8;
1057 		params[19] = effect->u.periodic.envelope.fade_length & 255;
1058 		size = 20;
1059 		dbg_hid("Uploading periodic force mag=%d/dir=%d, offset=%d, period=%d ms, phase=%d\n",
1060 				effect->u.periodic.magnitude, effect->direction,
1061 				effect->u.periodic.offset,
1062 				effect->u.periodic.period,
1063 				effect->u.periodic.phase);
1064 		dbg_hid("          envelope attack=(%d, %d ms) fade=(%d, %d ms)\n",
1065 				effect->u.periodic.envelope.attack_level,
1066 				effect->u.periodic.envelope.attack_length,
1067 				effect->u.periodic.envelope.fade_level,
1068 				effect->u.periodic.envelope.fade_length);
1069 		break;
1070 	}
1071 	case FF_RAMP:
1072 		params[1] = HIDPP_FF_EFFECT_RAMP;
1073 		force = (effect->u.ramp.start_level * fixp_sin16((effect->direction * 360) >> 16)) >> 15;
1074 		params[6] = force >> 8;
1075 		params[7] = force & 255;
1076 		force = (effect->u.ramp.end_level * fixp_sin16((effect->direction * 360) >> 16)) >> 15;
1077 		params[8] = force >> 8;
1078 		params[9] = force & 255;
1079 		params[10] = effect->u.ramp.envelope.attack_level >> 7;
1080 		params[11] = effect->u.ramp.envelope.attack_length >> 8;
1081 		params[12] = effect->u.ramp.envelope.attack_length & 255;
1082 		params[13] = effect->u.ramp.envelope.fade_level >> 7;
1083 		params[14] = effect->u.ramp.envelope.fade_length >> 8;
1084 		params[15] = effect->u.ramp.envelope.fade_length & 255;
1085 		size = 16;
1086 		dbg_hid("Uploading ramp force level=%d -> %d in dir %d = %d\n",
1087 				effect->u.ramp.start_level,
1088 				effect->u.ramp.end_level,
1089 				effect->direction, force);
1090 		dbg_hid("          envelope attack=(%d, %d ms) fade=(%d, %d ms)\n",
1091 				effect->u.ramp.envelope.attack_level,
1092 				effect->u.ramp.envelope.attack_length,
1093 				effect->u.ramp.envelope.fade_level,
1094 				effect->u.ramp.envelope.fade_length);
1095 		break;
1096 	case FF_FRICTION:
1097 	case FF_INERTIA:
1098 	case FF_SPRING:
1099 	case FF_DAMPER:
1100 		params[1] = HIDPP_FF_CONDITION_CMDS[effect->type - FF_SPRING];
1101 		params[6] = effect->u.condition[0].left_saturation >> 9;
1102 		params[7] = (effect->u.condition[0].left_saturation >> 1) & 255;
1103 		params[8] = effect->u.condition[0].left_coeff >> 8;
1104 		params[9] = effect->u.condition[0].left_coeff & 255;
1105 		params[10] = effect->u.condition[0].deadband >> 9;
1106 		params[11] = (effect->u.condition[0].deadband >> 1) & 255;
1107 		params[12] = effect->u.condition[0].center >> 8;
1108 		params[13] = effect->u.condition[0].center & 255;
1109 		params[14] = effect->u.condition[0].right_coeff >> 8;
1110 		params[15] = effect->u.condition[0].right_coeff & 255;
1111 		params[16] = effect->u.condition[0].right_saturation >> 9;
1112 		params[17] = (effect->u.condition[0].right_saturation >> 1) & 255;
1113 		size = 18;
1114 		dbg_hid("Uploading %s force left coeff=%d, left sat=%d, right coeff=%d, right sat=%d\n",
1115 				HIDPP_FF_CONDITION_NAMES[effect->type - FF_SPRING],
1116 				effect->u.condition[0].left_coeff,
1117 				effect->u.condition[0].left_saturation,
1118 				effect->u.condition[0].right_coeff,
1119 				effect->u.condition[0].right_saturation);
1120 		dbg_hid("          deadband=%d, center=%d\n",
1121 				effect->u.condition[0].deadband,
1122 				effect->u.condition[0].center);
1123 		break;
1124 	default:
1125 		hid_err(data->hidpp->hid_dev, "Unexpected force type %i!\n", effect->type);
1126 		return -EINVAL;
1127 	}
1128 
1129 	return hidpp_ff_queue_work(data, effect->id, HIDPP_FF_DOWNLOAD_EFFECT, params, size);
1130 }
1131 
1132 static int hidpp_ff_playback(struct input_dev *dev, int effect_id, int value)
1133 {
1134 	struct hidpp_ff_private_data *data = dev->ff->private;
1135 	u8 params[2];
1136 
1137 	params[1] = value ? HIDPP_FF_EFFECT_STATE_PLAY : HIDPP_FF_EFFECT_STATE_STOP;
1138 
1139 	dbg_hid("St%sing playback of effect %d.\n", value?"art":"opp", effect_id);
1140 
1141 	return hidpp_ff_queue_work(data, effect_id, HIDPP_FF_SET_EFFECT_STATE, params, ARRAY_SIZE(params));
1142 }
1143 
1144 static int hidpp_ff_erase_effect(struct input_dev *dev, int effect_id)
1145 {
1146 	struct hidpp_ff_private_data *data = dev->ff->private;
1147 	u8 slot = 0;
1148 
1149 	dbg_hid("Erasing effect %d.\n", effect_id);
1150 
1151 	return hidpp_ff_queue_work(data, effect_id, HIDPP_FF_DESTROY_EFFECT, &slot, 1);
1152 }
1153 
1154 static void hidpp_ff_set_autocenter(struct input_dev *dev, u16 magnitude)
1155 {
1156 	struct hidpp_ff_private_data *data = dev->ff->private;
1157 	u8 params[18];
1158 
1159 	dbg_hid("Setting autocenter to %d.\n", magnitude);
1160 
1161 	/* start a standard spring effect */
1162 	params[1] = HIDPP_FF_EFFECT_SPRING | HIDPP_FF_EFFECT_AUTOSTART;
1163 	/* zero delay and duration */
1164 	params[2] = params[3] = params[4] = params[5] = 0;
1165 	/* set coeff to 25% of saturation */
1166 	params[8] = params[14] = magnitude >> 11;
1167 	params[9] = params[15] = (magnitude >> 3) & 255;
1168 	params[6] = params[16] = magnitude >> 9;
1169 	params[7] = params[17] = (magnitude >> 1) & 255;
1170 	/* zero deadband and center */
1171 	params[10] = params[11] = params[12] = params[13] = 0;
1172 
1173 	hidpp_ff_queue_work(data, HIDPP_FF_EFFECTID_AUTOCENTER, HIDPP_FF_DOWNLOAD_EFFECT, params, ARRAY_SIZE(params));
1174 }
1175 
1176 static void hidpp_ff_set_gain(struct input_dev *dev, u16 gain)
1177 {
1178 	struct hidpp_ff_private_data *data = dev->ff->private;
1179 	u8 params[4];
1180 
1181 	dbg_hid("Setting gain to %d.\n", gain);
1182 
1183 	params[0] = gain >> 8;
1184 	params[1] = gain & 255;
1185 	params[2] = 0; /* no boost */
1186 	params[3] = 0;
1187 
1188 	hidpp_ff_queue_work(data, HIDPP_FF_EFFECTID_NONE, HIDPP_FF_SET_GLOBAL_GAINS, params, ARRAY_SIZE(params));
1189 }
1190 
1191 static ssize_t hidpp_ff_range_show(struct device *dev, struct device_attribute *attr, char *buf)
1192 {
1193 	struct hid_device *hid = to_hid_device(dev);
1194 	struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
1195 	struct input_dev *idev = hidinput->input;
1196 	struct hidpp_ff_private_data *data = idev->ff->private;
1197 
1198 	return scnprintf(buf, PAGE_SIZE, "%u\n", data->range);
1199 }
1200 
1201 static ssize_t hidpp_ff_range_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
1202 {
1203 	struct hid_device *hid = to_hid_device(dev);
1204 	struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
1205 	struct input_dev *idev = hidinput->input;
1206 	struct hidpp_ff_private_data *data = idev->ff->private;
1207 	u8 params[2];
1208 	int range = simple_strtoul(buf, NULL, 10);
1209 
1210 	range = clamp(range, 180, 900);
1211 
1212 	params[0] = range >> 8;
1213 	params[1] = range & 0x00FF;
1214 
1215 	hidpp_ff_queue_work(data, -1, HIDPP_FF_SET_APERTURE, params, ARRAY_SIZE(params));
1216 
1217 	return count;
1218 }
1219 
1220 static DEVICE_ATTR(range, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH, hidpp_ff_range_show, hidpp_ff_range_store);
1221 
1222 static void hidpp_ff_destroy(struct ff_device *ff)
1223 {
1224 	struct hidpp_ff_private_data *data = ff->private;
1225 
1226 	kfree(data->effect_ids);
1227 }
1228 
1229 static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
1230 {
1231 	struct hid_device *hid = hidpp->hid_dev;
1232 	struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
1233 	struct input_dev *dev = hidinput->input;
1234 	const struct usb_device_descriptor *udesc = &(hid_to_usb_dev(hid)->descriptor);
1235 	const u16 bcdDevice = le16_to_cpu(udesc->bcdDevice);
1236 	struct ff_device *ff;
1237 	struct hidpp_report response;
1238 	struct hidpp_ff_private_data *data;
1239 	int error, j, num_slots;
1240 	u8 version;
1241 
1242 	if (!dev) {
1243 		hid_err(hid, "Struct input_dev not set!\n");
1244 		return -EINVAL;
1245 	}
1246 
1247 	/* Get firmware release */
1248 	version = bcdDevice & 255;
1249 
1250 	/* Set supported force feedback capabilities */
1251 	for (j = 0; hiddpp_ff_effects[j] >= 0; j++)
1252 		set_bit(hiddpp_ff_effects[j], dev->ffbit);
1253 	if (version > 1)
1254 		for (j = 0; hiddpp_ff_effects_v2[j] >= 0; j++)
1255 			set_bit(hiddpp_ff_effects_v2[j], dev->ffbit);
1256 
1257 	/* Read number of slots available in device */
1258 	error = hidpp_send_fap_command_sync(hidpp, feature_index,
1259 		HIDPP_FF_GET_INFO, NULL, 0, &response);
1260 	if (error) {
1261 		if (error < 0)
1262 			return error;
1263 		hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
1264 			__func__, error);
1265 		return -EPROTO;
1266 	}
1267 
1268 	num_slots = response.fap.params[0] - HIDPP_FF_RESERVED_SLOTS;
1269 
1270 	error = input_ff_create(dev, num_slots);
1271 
1272 	if (error) {
1273 		hid_err(dev, "Failed to create FF device!\n");
1274 		return error;
1275 	}
1276 
1277 	data = kzalloc(sizeof(*data), GFP_KERNEL);
1278 	if (!data)
1279 		return -ENOMEM;
1280 	data->effect_ids = kcalloc(num_slots, sizeof(int), GFP_KERNEL);
1281 	if (!data->effect_ids) {
1282 		kfree(data);
1283 		return -ENOMEM;
1284 	}
1285 	data->hidpp = hidpp;
1286 	data->feature_index = feature_index;
1287 	data->version = version;
1288 	data->slot_autocenter = 0;
1289 	data->num_effects = num_slots;
1290 	for (j = 0; j < num_slots; j++)
1291 		data->effect_ids[j] = -1;
1292 
1293 	ff = dev->ff;
1294 	ff->private = data;
1295 
1296 	ff->upload = hidpp_ff_upload_effect;
1297 	ff->erase = hidpp_ff_erase_effect;
1298 	ff->playback = hidpp_ff_playback;
1299 	ff->set_gain = hidpp_ff_set_gain;
1300 	ff->set_autocenter = hidpp_ff_set_autocenter;
1301 	ff->destroy = hidpp_ff_destroy;
1302 
1303 
1304 	/* reset all forces */
1305 	error = hidpp_send_fap_command_sync(hidpp, feature_index,
1306 		HIDPP_FF_RESET_ALL, NULL, 0, &response);
1307 
1308 	/* Read current Range */
1309 	error = hidpp_send_fap_command_sync(hidpp, feature_index,
1310 		HIDPP_FF_GET_APERTURE, NULL, 0, &response);
1311 	if (error)
1312 		hid_warn(hidpp->hid_dev, "Failed to read range from device!\n");
1313 	data->range = error ? 900 : get_unaligned_be16(&response.fap.params[0]);
1314 
1315 	/* Create sysfs interface */
1316 	error = device_create_file(&(hidpp->hid_dev->dev), &dev_attr_range);
1317 	if (error)
1318 		hid_warn(hidpp->hid_dev, "Unable to create sysfs interface for \"range\", errno %d!\n", error);
1319 
1320 	/* Read the current gain values */
1321 	error = hidpp_send_fap_command_sync(hidpp, feature_index,
1322 		HIDPP_FF_GET_GLOBAL_GAINS, NULL, 0, &response);
1323 	if (error)
1324 		hid_warn(hidpp->hid_dev, "Failed to read gain values from device!\n");
1325 	data->gain = error ? 0xffff : get_unaligned_be16(&response.fap.params[0]);
1326 	/* ignore boost value at response.fap.params[2] */
1327 
1328 	/* init the hardware command queue */
1329 	data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue");
1330 	atomic_set(&data->workqueue_size, 0);
1331 
1332 	/* initialize with zero autocenter to get wheel in usable state */
1333 	hidpp_ff_set_autocenter(dev, 0);
1334 
1335 	hid_info(hid, "Force feeback support loaded (firmware release %d).\n", version);
1336 
1337 	return 0;
1338 }
1339 
1340 static int hidpp_ff_deinit(struct hid_device *hid)
1341 {
1342 	struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
1343 	struct input_dev *dev = hidinput->input;
1344 	struct hidpp_ff_private_data *data;
1345 
1346 	if (!dev) {
1347 		hid_err(hid, "Struct input_dev not found!\n");
1348 		return -EINVAL;
1349 	}
1350 
1351 	hid_info(hid, "Unloading HID++ force feedback.\n");
1352 	data = dev->ff->private;
1353 	if (!data) {
1354 		hid_err(hid, "Private data not found!\n");
1355 		return -EINVAL;
1356 	}
1357 
1358 	destroy_workqueue(data->wq);
1359 	device_remove_file(&hid->dev, &dev_attr_range);
1360 
1361 	return 0;
1362 }
1363 
1364 
1365 /* ************************************************************************** */
1366 /*                                                                            */
1367 /* Device Support                                                             */
1368 /*                                                                            */
1369 /* ************************************************************************** */
1370 
1371 /* -------------------------------------------------------------------------- */
1372 /* Touchpad HID++ devices                                                     */
1373 /* -------------------------------------------------------------------------- */
1374 
1375 #define WTP_MANUAL_RESOLUTION				39
1376 
1377 struct wtp_data {
1378 	struct input_dev *input;
1379 	u16 x_size, y_size;
1380 	u8 finger_count;
1381 	u8 mt_feature_index;
1382 	u8 button_feature_index;
1383 	u8 maxcontacts;
1384 	bool flip_y;
1385 	unsigned int resolution;
1386 };
1387 
1388 static int wtp_input_mapping(struct hid_device *hdev, struct hid_input *hi,
1389 		struct hid_field *field, struct hid_usage *usage,
1390 		unsigned long **bit, int *max)
1391 {
1392 	return -1;
1393 }
1394 
1395 static void wtp_populate_input(struct hidpp_device *hidpp,
1396 		struct input_dev *input_dev, bool origin_is_hid_core)
1397 {
1398 	struct wtp_data *wd = hidpp->private_data;
1399 
1400 	__set_bit(EV_ABS, input_dev->evbit);
1401 	__set_bit(EV_KEY, input_dev->evbit);
1402 	__clear_bit(EV_REL, input_dev->evbit);
1403 	__clear_bit(EV_LED, input_dev->evbit);
1404 
1405 	input_set_abs_params(input_dev, ABS_MT_POSITION_X, 0, wd->x_size, 0, 0);
1406 	input_abs_set_res(input_dev, ABS_MT_POSITION_X, wd->resolution);
1407 	input_set_abs_params(input_dev, ABS_MT_POSITION_Y, 0, wd->y_size, 0, 0);
1408 	input_abs_set_res(input_dev, ABS_MT_POSITION_Y, wd->resolution);
1409 
1410 	/* Max pressure is not given by the devices, pick one */
1411 	input_set_abs_params(input_dev, ABS_MT_PRESSURE, 0, 50, 0, 0);
1412 
1413 	input_set_capability(input_dev, EV_KEY, BTN_LEFT);
1414 
1415 	if (hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS)
1416 		input_set_capability(input_dev, EV_KEY, BTN_RIGHT);
1417 	else
1418 		__set_bit(INPUT_PROP_BUTTONPAD, input_dev->propbit);
1419 
1420 	input_mt_init_slots(input_dev, wd->maxcontacts, INPUT_MT_POINTER |
1421 		INPUT_MT_DROP_UNUSED);
1422 
1423 	wd->input = input_dev;
1424 }
1425 
1426 static void wtp_touch_event(struct wtp_data *wd,
1427 	struct hidpp_touchpad_raw_xy_finger *touch_report)
1428 {
1429 	int slot;
1430 
1431 	if (!touch_report->finger_id || touch_report->contact_type)
1432 		/* no actual data */
1433 		return;
1434 
1435 	slot = input_mt_get_slot_by_key(wd->input, touch_report->finger_id);
1436 
1437 	input_mt_slot(wd->input, slot);
1438 	input_mt_report_slot_state(wd->input, MT_TOOL_FINGER,
1439 					touch_report->contact_status);
1440 	if (touch_report->contact_status) {
1441 		input_event(wd->input, EV_ABS, ABS_MT_POSITION_X,
1442 				touch_report->x);
1443 		input_event(wd->input, EV_ABS, ABS_MT_POSITION_Y,
1444 				wd->flip_y ? wd->y_size - touch_report->y :
1445 					     touch_report->y);
1446 		input_event(wd->input, EV_ABS, ABS_MT_PRESSURE,
1447 				touch_report->area);
1448 	}
1449 }
1450 
1451 static void wtp_send_raw_xy_event(struct hidpp_device *hidpp,
1452 		struct hidpp_touchpad_raw_xy *raw)
1453 {
1454 	struct wtp_data *wd = hidpp->private_data;
1455 	int i;
1456 
1457 	for (i = 0; i < 2; i++)
1458 		wtp_touch_event(wd, &(raw->fingers[i]));
1459 
1460 	if (raw->end_of_frame &&
1461 	    !(hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS))
1462 		input_event(wd->input, EV_KEY, BTN_LEFT, raw->button);
1463 
1464 	if (raw->end_of_frame || raw->finger_count <= 2) {
1465 		input_mt_sync_frame(wd->input);
1466 		input_sync(wd->input);
1467 	}
1468 }
1469 
1470 static int wtp_mouse_raw_xy_event(struct hidpp_device *hidpp, u8 *data)
1471 {
1472 	struct wtp_data *wd = hidpp->private_data;
1473 	u8 c1_area = ((data[7] & 0xf) * (data[7] & 0xf) +
1474 		      (data[7] >> 4) * (data[7] >> 4)) / 2;
1475 	u8 c2_area = ((data[13] & 0xf) * (data[13] & 0xf) +
1476 		      (data[13] >> 4) * (data[13] >> 4)) / 2;
1477 	struct hidpp_touchpad_raw_xy raw = {
1478 		.timestamp = data[1],
1479 		.fingers = {
1480 			{
1481 				.contact_type = 0,
1482 				.contact_status = !!data[7],
1483 				.x = get_unaligned_le16(&data[3]),
1484 				.y = get_unaligned_le16(&data[5]),
1485 				.z = c1_area,
1486 				.area = c1_area,
1487 				.finger_id = data[2],
1488 			}, {
1489 				.contact_type = 0,
1490 				.contact_status = !!data[13],
1491 				.x = get_unaligned_le16(&data[9]),
1492 				.y = get_unaligned_le16(&data[11]),
1493 				.z = c2_area,
1494 				.area = c2_area,
1495 				.finger_id = data[8],
1496 			}
1497 		},
1498 		.finger_count = wd->maxcontacts,
1499 		.spurious_flag = 0,
1500 		.end_of_frame = (data[0] >> 7) == 0,
1501 		.button = data[0] & 0x01,
1502 	};
1503 
1504 	wtp_send_raw_xy_event(hidpp, &raw);
1505 
1506 	return 1;
1507 }
1508 
1509 static int wtp_raw_event(struct hid_device *hdev, u8 *data, int size)
1510 {
1511 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1512 	struct wtp_data *wd = hidpp->private_data;
1513 	struct hidpp_report *report = (struct hidpp_report *)data;
1514 	struct hidpp_touchpad_raw_xy raw;
1515 
1516 	if (!wd || !wd->input)
1517 		return 1;
1518 
1519 	switch (data[0]) {
1520 	case 0x02:
1521 		if (size < 2) {
1522 			hid_err(hdev, "Received HID report of bad size (%d)",
1523 				size);
1524 			return 1;
1525 		}
1526 		if (hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS) {
1527 			input_event(wd->input, EV_KEY, BTN_LEFT,
1528 					!!(data[1] & 0x01));
1529 			input_event(wd->input, EV_KEY, BTN_RIGHT,
1530 					!!(data[1] & 0x02));
1531 			input_sync(wd->input);
1532 			return 0;
1533 		} else {
1534 			if (size < 21)
1535 				return 1;
1536 			return wtp_mouse_raw_xy_event(hidpp, &data[7]);
1537 		}
1538 	case REPORT_ID_HIDPP_LONG:
1539 		/* size is already checked in hidpp_raw_event. */
1540 		if ((report->fap.feature_index != wd->mt_feature_index) ||
1541 		    (report->fap.funcindex_clientid != EVENT_TOUCHPAD_RAW_XY))
1542 			return 1;
1543 		hidpp_touchpad_raw_xy_event(hidpp, data + 4, &raw);
1544 
1545 		wtp_send_raw_xy_event(hidpp, &raw);
1546 		return 0;
1547 	}
1548 
1549 	return 0;
1550 }
1551 
1552 static int wtp_get_config(struct hidpp_device *hidpp)
1553 {
1554 	struct wtp_data *wd = hidpp->private_data;
1555 	struct hidpp_touchpad_raw_info raw_info = {0};
1556 	u8 feature_type;
1557 	int ret;
1558 
1559 	ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_TOUCHPAD_RAW_XY,
1560 		&wd->mt_feature_index, &feature_type);
1561 	if (ret)
1562 		/* means that the device is not powered up */
1563 		return ret;
1564 
1565 	ret = hidpp_touchpad_get_raw_info(hidpp, wd->mt_feature_index,
1566 		&raw_info);
1567 	if (ret)
1568 		return ret;
1569 
1570 	wd->x_size = raw_info.x_size;
1571 	wd->y_size = raw_info.y_size;
1572 	wd->maxcontacts = raw_info.maxcontacts;
1573 	wd->flip_y = raw_info.origin == TOUCHPAD_RAW_XY_ORIGIN_LOWER_LEFT;
1574 	wd->resolution = raw_info.res;
1575 	if (!wd->resolution)
1576 		wd->resolution = WTP_MANUAL_RESOLUTION;
1577 
1578 	return 0;
1579 }
1580 
1581 static int wtp_allocate(struct hid_device *hdev, const struct hid_device_id *id)
1582 {
1583 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1584 	struct wtp_data *wd;
1585 
1586 	wd = devm_kzalloc(&hdev->dev, sizeof(struct wtp_data),
1587 			GFP_KERNEL);
1588 	if (!wd)
1589 		return -ENOMEM;
1590 
1591 	hidpp->private_data = wd;
1592 
1593 	return 0;
1594 };
1595 
1596 static int wtp_connect(struct hid_device *hdev, bool connected)
1597 {
1598 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1599 	struct wtp_data *wd = hidpp->private_data;
1600 	int ret;
1601 
1602 	if (!connected)
1603 		return 0;
1604 
1605 	if (!wd->x_size) {
1606 		ret = wtp_get_config(hidpp);
1607 		if (ret) {
1608 			hid_err(hdev, "Can not get wtp config: %d\n", ret);
1609 			return ret;
1610 		}
1611 	}
1612 
1613 	return hidpp_touchpad_set_raw_report_state(hidpp, wd->mt_feature_index,
1614 			true, true);
1615 }
1616 
1617 /* ------------------------------------------------------------------------- */
1618 /* Logitech M560 devices                                                     */
1619 /* ------------------------------------------------------------------------- */
1620 
1621 /*
1622  * Logitech M560 protocol overview
1623  *
1624  * The Logitech M560 mouse, is designed for windows 8. When the middle and/or
1625  * the sides buttons are pressed, it sends some keyboard keys events
1626  * instead of buttons ones.
1627  * To complicate things further, the middle button keys sequence
1628  * is different from the odd press and the even press.
1629  *
1630  * forward button -> Super_R
1631  * backward button -> Super_L+'d' (press only)
1632  * middle button -> 1st time: Alt_L+SuperL+XF86TouchpadOff (press only)
1633  *                  2nd time: left-click (press only)
1634  * NB: press-only means that when the button is pressed, the
1635  * KeyPress/ButtonPress and KeyRelease/ButtonRelease events are generated
1636  * together sequentially; instead when the button is released, no event is
1637  * generated !
1638  *
1639  * With the command
1640  *	10<xx>0a 3500af03 (where <xx> is the mouse id),
1641  * the mouse reacts differently:
1642  * - it never sends a keyboard key event
1643  * - for the three mouse button it sends:
1644  *	middle button               press   11<xx>0a 3500af00...
1645  *	side 1 button (forward)     press   11<xx>0a 3500b000...
1646  *	side 2 button (backward)    press   11<xx>0a 3500ae00...
1647  *	middle/side1/side2 button   release 11<xx>0a 35000000...
1648  */
1649 
1650 static const u8 m560_config_parameter[] = {0x00, 0xaf, 0x03};
1651 
1652 struct m560_private_data {
1653 	struct input_dev *input;
1654 };
1655 
1656 /* how buttons are mapped in the report */
1657 #define M560_MOUSE_BTN_LEFT		0x01
1658 #define M560_MOUSE_BTN_RIGHT		0x02
1659 #define M560_MOUSE_BTN_WHEEL_LEFT	0x08
1660 #define M560_MOUSE_BTN_WHEEL_RIGHT	0x10
1661 
1662 #define M560_SUB_ID			0x0a
1663 #define M560_BUTTON_MODE_REGISTER	0x35
1664 
1665 static int m560_send_config_command(struct hid_device *hdev, bool connected)
1666 {
1667 	struct hidpp_report response;
1668 	struct hidpp_device *hidpp_dev;
1669 
1670 	hidpp_dev = hid_get_drvdata(hdev);
1671 
1672 	if (!connected)
1673 		return -ENODEV;
1674 
1675 	return hidpp_send_rap_command_sync(
1676 		hidpp_dev,
1677 		REPORT_ID_HIDPP_SHORT,
1678 		M560_SUB_ID,
1679 		M560_BUTTON_MODE_REGISTER,
1680 		(u8 *)m560_config_parameter,
1681 		sizeof(m560_config_parameter),
1682 		&response
1683 	);
1684 }
1685 
1686 static int m560_allocate(struct hid_device *hdev)
1687 {
1688 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1689 	struct m560_private_data *d;
1690 
1691 	d = devm_kzalloc(&hdev->dev, sizeof(struct m560_private_data),
1692 			GFP_KERNEL);
1693 	if (!d)
1694 		return -ENOMEM;
1695 
1696 	hidpp->private_data = d;
1697 
1698 	return 0;
1699 };
1700 
1701 static int m560_raw_event(struct hid_device *hdev, u8 *data, int size)
1702 {
1703 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1704 	struct m560_private_data *mydata = hidpp->private_data;
1705 
1706 	/* sanity check */
1707 	if (!mydata || !mydata->input) {
1708 		hid_err(hdev, "error in parameter\n");
1709 		return -EINVAL;
1710 	}
1711 
1712 	if (size < 7) {
1713 		hid_err(hdev, "error in report\n");
1714 		return 0;
1715 	}
1716 
1717 	if (data[0] == REPORT_ID_HIDPP_LONG &&
1718 	    data[2] == M560_SUB_ID && data[6] == 0x00) {
1719 		/*
1720 		 * m560 mouse report for middle, forward and backward button
1721 		 *
1722 		 * data[0] = 0x11
1723 		 * data[1] = device-id
1724 		 * data[2] = 0x0a
1725 		 * data[5] = 0xaf -> middle
1726 		 *	     0xb0 -> forward
1727 		 *	     0xae -> backward
1728 		 *	     0x00 -> release all
1729 		 * data[6] = 0x00
1730 		 */
1731 
1732 		switch (data[5]) {
1733 		case 0xaf:
1734 			input_report_key(mydata->input, BTN_MIDDLE, 1);
1735 			break;
1736 		case 0xb0:
1737 			input_report_key(mydata->input, BTN_FORWARD, 1);
1738 			break;
1739 		case 0xae:
1740 			input_report_key(mydata->input, BTN_BACK, 1);
1741 			break;
1742 		case 0x00:
1743 			input_report_key(mydata->input, BTN_BACK, 0);
1744 			input_report_key(mydata->input, BTN_FORWARD, 0);
1745 			input_report_key(mydata->input, BTN_MIDDLE, 0);
1746 			break;
1747 		default:
1748 			hid_err(hdev, "error in report\n");
1749 			return 0;
1750 		}
1751 		input_sync(mydata->input);
1752 
1753 	} else if (data[0] == 0x02) {
1754 		/*
1755 		 * Logitech M560 mouse report
1756 		 *
1757 		 * data[0] = type (0x02)
1758 		 * data[1..2] = buttons
1759 		 * data[3..5] = xy
1760 		 * data[6] = wheel
1761 		 */
1762 
1763 		int v;
1764 
1765 		input_report_key(mydata->input, BTN_LEFT,
1766 			!!(data[1] & M560_MOUSE_BTN_LEFT));
1767 		input_report_key(mydata->input, BTN_RIGHT,
1768 			!!(data[1] & M560_MOUSE_BTN_RIGHT));
1769 
1770 		if (data[1] & M560_MOUSE_BTN_WHEEL_LEFT)
1771 			input_report_rel(mydata->input, REL_HWHEEL, -1);
1772 		else if (data[1] & M560_MOUSE_BTN_WHEEL_RIGHT)
1773 			input_report_rel(mydata->input, REL_HWHEEL, 1);
1774 
1775 		v = hid_snto32(hid_field_extract(hdev, data+3, 0, 12), 12);
1776 		input_report_rel(mydata->input, REL_X, v);
1777 
1778 		v = hid_snto32(hid_field_extract(hdev, data+3, 12, 12), 12);
1779 		input_report_rel(mydata->input, REL_Y, v);
1780 
1781 		v = hid_snto32(data[6], 8);
1782 		input_report_rel(mydata->input, REL_WHEEL, v);
1783 
1784 		input_sync(mydata->input);
1785 	}
1786 
1787 	return 1;
1788 }
1789 
1790 static void m560_populate_input(struct hidpp_device *hidpp,
1791 		struct input_dev *input_dev, bool origin_is_hid_core)
1792 {
1793 	struct m560_private_data *mydata = hidpp->private_data;
1794 
1795 	mydata->input = input_dev;
1796 
1797 	__set_bit(EV_KEY, mydata->input->evbit);
1798 	__set_bit(BTN_MIDDLE, mydata->input->keybit);
1799 	__set_bit(BTN_RIGHT, mydata->input->keybit);
1800 	__set_bit(BTN_LEFT, mydata->input->keybit);
1801 	__set_bit(BTN_BACK, mydata->input->keybit);
1802 	__set_bit(BTN_FORWARD, mydata->input->keybit);
1803 
1804 	__set_bit(EV_REL, mydata->input->evbit);
1805 	__set_bit(REL_X, mydata->input->relbit);
1806 	__set_bit(REL_Y, mydata->input->relbit);
1807 	__set_bit(REL_WHEEL, mydata->input->relbit);
1808 	__set_bit(REL_HWHEEL, mydata->input->relbit);
1809 }
1810 
1811 static int m560_input_mapping(struct hid_device *hdev, struct hid_input *hi,
1812 		struct hid_field *field, struct hid_usage *usage,
1813 		unsigned long **bit, int *max)
1814 {
1815 	return -1;
1816 }
1817 
1818 /* ------------------------------------------------------------------------- */
1819 /* Logitech K400 devices                                                     */
1820 /* ------------------------------------------------------------------------- */
1821 
1822 /*
1823  * The Logitech K400 keyboard has an embedded touchpad which is seen
1824  * as a mouse from the OS point of view. There is a hardware shortcut to disable
1825  * tap-to-click but the setting is not remembered accross reset, annoying some
1826  * users.
1827  *
1828  * We can toggle this feature from the host by using the feature 0x6010:
1829  * Touchpad FW items
1830  */
1831 
1832 struct k400_private_data {
1833 	u8 feature_index;
1834 };
1835 
1836 static int k400_disable_tap_to_click(struct hidpp_device *hidpp)
1837 {
1838 	struct k400_private_data *k400 = hidpp->private_data;
1839 	struct hidpp_touchpad_fw_items items = {};
1840 	int ret;
1841 	u8 feature_type;
1842 
1843 	if (!k400->feature_index) {
1844 		ret = hidpp_root_get_feature(hidpp,
1845 			HIDPP_PAGE_TOUCHPAD_FW_ITEMS,
1846 			&k400->feature_index, &feature_type);
1847 		if (ret)
1848 			/* means that the device is not powered up */
1849 			return ret;
1850 	}
1851 
1852 	ret = hidpp_touchpad_fw_items_set(hidpp, k400->feature_index, &items);
1853 	if (ret)
1854 		return ret;
1855 
1856 	return 0;
1857 }
1858 
1859 static int k400_allocate(struct hid_device *hdev)
1860 {
1861 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1862 	struct k400_private_data *k400;
1863 
1864 	k400 = devm_kzalloc(&hdev->dev, sizeof(struct k400_private_data),
1865 			    GFP_KERNEL);
1866 	if (!k400)
1867 		return -ENOMEM;
1868 
1869 	hidpp->private_data = k400;
1870 
1871 	return 0;
1872 };
1873 
1874 static int k400_connect(struct hid_device *hdev, bool connected)
1875 {
1876 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1877 
1878 	if (!connected)
1879 		return 0;
1880 
1881 	if (!disable_tap_to_click)
1882 		return 0;
1883 
1884 	return k400_disable_tap_to_click(hidpp);
1885 }
1886 
1887 /* ------------------------------------------------------------------------- */
1888 /* Logitech G920 Driving Force Racing Wheel for Xbox One                     */
1889 /* ------------------------------------------------------------------------- */
1890 
1891 #define HIDPP_PAGE_G920_FORCE_FEEDBACK			0x8123
1892 
1893 static int g920_get_config(struct hidpp_device *hidpp)
1894 {
1895 	u8 feature_type;
1896 	u8 feature_index;
1897 	int ret;
1898 
1899 	/* Find feature and store for later use */
1900 	ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_G920_FORCE_FEEDBACK,
1901 		&feature_index, &feature_type);
1902 	if (ret)
1903 		return ret;
1904 
1905 	ret = hidpp_ff_init(hidpp, feature_index);
1906 	if (ret)
1907 		hid_warn(hidpp->hid_dev, "Unable to initialize force feedback support, errno %d\n",
1908 				ret);
1909 
1910 	return 0;
1911 }
1912 
1913 /* -------------------------------------------------------------------------- */
1914 /* Generic HID++ devices                                                      */
1915 /* -------------------------------------------------------------------------- */
1916 
1917 static int hidpp_input_mapping(struct hid_device *hdev, struct hid_input *hi,
1918 		struct hid_field *field, struct hid_usage *usage,
1919 		unsigned long **bit, int *max)
1920 {
1921 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1922 
1923 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
1924 		return wtp_input_mapping(hdev, hi, field, usage, bit, max);
1925 	else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560 &&
1926 			field->application != HID_GD_MOUSE)
1927 		return m560_input_mapping(hdev, hi, field, usage, bit, max);
1928 
1929 	return 0;
1930 }
1931 
1932 static int hidpp_input_mapped(struct hid_device *hdev, struct hid_input *hi,
1933 		struct hid_field *field, struct hid_usage *usage,
1934 		unsigned long **bit, int *max)
1935 {
1936 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1937 
1938 	/* Ensure that Logitech G920 is not given a default fuzz/flat value */
1939 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {
1940 		if (usage->type == EV_ABS && (usage->code == ABS_X ||
1941 				usage->code == ABS_Y || usage->code == ABS_Z ||
1942 				usage->code == ABS_RZ)) {
1943 			field->application = HID_GD_MULTIAXIS;
1944 		}
1945 	}
1946 
1947 	return 0;
1948 }
1949 
1950 
1951 static void hidpp_populate_input(struct hidpp_device *hidpp,
1952 		struct input_dev *input, bool origin_is_hid_core)
1953 {
1954 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
1955 		wtp_populate_input(hidpp, input, origin_is_hid_core);
1956 	else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560)
1957 		m560_populate_input(hidpp, input, origin_is_hid_core);
1958 }
1959 
1960 static int hidpp_input_configured(struct hid_device *hdev,
1961 				struct hid_input *hidinput)
1962 {
1963 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
1964 	struct input_dev *input = hidinput->input;
1965 
1966 	hidpp_populate_input(hidpp, input, true);
1967 
1968 	return 0;
1969 }
1970 
1971 static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,
1972 		int size)
1973 {
1974 	struct hidpp_report *question = hidpp->send_receive_buf;
1975 	struct hidpp_report *answer = hidpp->send_receive_buf;
1976 	struct hidpp_report *report = (struct hidpp_report *)data;
1977 
1978 	/*
1979 	 * If the mutex is locked then we have a pending answer from a
1980 	 * previously sent command.
1981 	 */
1982 	if (unlikely(mutex_is_locked(&hidpp->send_mutex))) {
1983 		/*
1984 		 * Check for a correct hidpp20 answer or the corresponding
1985 		 * error
1986 		 */
1987 		if (hidpp_match_answer(question, report) ||
1988 				hidpp_match_error(question, report)) {
1989 			*answer = *report;
1990 			hidpp->answer_available = true;
1991 			wake_up(&hidpp->wait);
1992 			/*
1993 			 * This was an answer to a command that this driver sent
1994 			 * We return 1 to hid-core to avoid forwarding the
1995 			 * command upstream as it has been treated by the driver
1996 			 */
1997 
1998 			return 1;
1999 		}
2000 	}
2001 
2002 	if (unlikely(hidpp_report_is_connect_event(report))) {
2003 		atomic_set(&hidpp->connected,
2004 				!(report->rap.params[0] & (1 << 6)));
2005 		if ((hidpp->quirks & HIDPP_QUIRK_CONNECT_EVENTS) &&
2006 		    (schedule_work(&hidpp->work) == 0))
2007 			dbg_hid("%s: connect event already queued\n", __func__);
2008 		return 1;
2009 	}
2010 
2011 	return 0;
2012 }
2013 
2014 static int hidpp_raw_event(struct hid_device *hdev, struct hid_report *report,
2015 		u8 *data, int size)
2016 {
2017 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
2018 	int ret = 0;
2019 
2020 	/* Generic HID++ processing. */
2021 	switch (data[0]) {
2022 	case REPORT_ID_HIDPP_VERY_LONG:
2023 		if (size != HIDPP_REPORT_VERY_LONG_LENGTH) {
2024 			hid_err(hdev, "received hid++ report of bad size (%d)",
2025 				size);
2026 			return 1;
2027 		}
2028 		ret = hidpp_raw_hidpp_event(hidpp, data, size);
2029 		break;
2030 	case REPORT_ID_HIDPP_LONG:
2031 		if (size != HIDPP_REPORT_LONG_LENGTH) {
2032 			hid_err(hdev, "received hid++ report of bad size (%d)",
2033 				size);
2034 			return 1;
2035 		}
2036 		ret = hidpp_raw_hidpp_event(hidpp, data, size);
2037 		break;
2038 	case REPORT_ID_HIDPP_SHORT:
2039 		if (size != HIDPP_REPORT_SHORT_LENGTH) {
2040 			hid_err(hdev, "received hid++ report of bad size (%d)",
2041 				size);
2042 			return 1;
2043 		}
2044 		ret = hidpp_raw_hidpp_event(hidpp, data, size);
2045 		break;
2046 	}
2047 
2048 	/* If no report is available for further processing, skip calling
2049 	 * raw_event of subclasses. */
2050 	if (ret != 0)
2051 		return ret;
2052 
2053 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)
2054 		return wtp_raw_event(hdev, data, size);
2055 	else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560)
2056 		return m560_raw_event(hdev, data, size);
2057 
2058 	return 0;
2059 }
2060 
2061 static void hidpp_overwrite_name(struct hid_device *hdev, bool use_unifying)
2062 {
2063 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
2064 	char *name;
2065 
2066 	if (use_unifying)
2067 		/*
2068 		 * the device is connected through an Unifying receiver, and
2069 		 * might not be already connected.
2070 		 * Ask the receiver for its name.
2071 		 */
2072 		name = hidpp_get_unifying_name(hidpp);
2073 	else
2074 		name = hidpp_get_device_name(hidpp);
2075 
2076 	if (!name) {
2077 		hid_err(hdev, "unable to retrieve the name of the device");
2078 	} else {
2079 		dbg_hid("HID++: Got name: %s\n", name);
2080 		snprintf(hdev->name, sizeof(hdev->name), "%s", name);
2081 	}
2082 
2083 	kfree(name);
2084 }
2085 
2086 static int hidpp_input_open(struct input_dev *dev)
2087 {
2088 	struct hid_device *hid = input_get_drvdata(dev);
2089 
2090 	return hid_hw_open(hid);
2091 }
2092 
2093 static void hidpp_input_close(struct input_dev *dev)
2094 {
2095 	struct hid_device *hid = input_get_drvdata(dev);
2096 
2097 	hid_hw_close(hid);
2098 }
2099 
2100 static struct input_dev *hidpp_allocate_input(struct hid_device *hdev)
2101 {
2102 	struct input_dev *input_dev = devm_input_allocate_device(&hdev->dev);
2103 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
2104 
2105 	if (!input_dev)
2106 		return NULL;
2107 
2108 	input_set_drvdata(input_dev, hdev);
2109 	input_dev->open = hidpp_input_open;
2110 	input_dev->close = hidpp_input_close;
2111 
2112 	input_dev->name = hidpp->name;
2113 	input_dev->phys = hdev->phys;
2114 	input_dev->uniq = hdev->uniq;
2115 	input_dev->id.bustype = hdev->bus;
2116 	input_dev->id.vendor  = hdev->vendor;
2117 	input_dev->id.product = hdev->product;
2118 	input_dev->id.version = hdev->version;
2119 	input_dev->dev.parent = &hdev->dev;
2120 
2121 	return input_dev;
2122 }
2123 
2124 static void hidpp_connect_event(struct hidpp_device *hidpp)
2125 {
2126 	struct hid_device *hdev = hidpp->hid_dev;
2127 	int ret = 0;
2128 	bool connected = atomic_read(&hidpp->connected);
2129 	struct input_dev *input;
2130 	char *name, *devm_name;
2131 
2132 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {
2133 		ret = wtp_connect(hdev, connected);
2134 		if (ret)
2135 			return;
2136 	} else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560) {
2137 		ret = m560_send_config_command(hdev, connected);
2138 		if (ret)
2139 			return;
2140 	} else if (hidpp->quirks & HIDPP_QUIRK_CLASS_K400) {
2141 		ret = k400_connect(hdev, connected);
2142 		if (ret)
2143 			return;
2144 	}
2145 
2146 	if (!connected || hidpp->delayed_input)
2147 		return;
2148 
2149 	/* the device is already connected, we can ask for its name and
2150 	 * protocol */
2151 	if (!hidpp->protocol_major) {
2152 		ret = !hidpp_is_connected(hidpp);
2153 		if (ret) {
2154 			hid_err(hdev, "Can not get the protocol version.\n");
2155 			return;
2156 		}
2157 		hid_info(hdev, "HID++ %u.%u device connected.\n",
2158 			 hidpp->protocol_major, hidpp->protocol_minor);
2159 	}
2160 
2161 	if (!(hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT))
2162 		/* if HID created the input nodes for us, we can stop now */
2163 		return;
2164 
2165 	if (!hidpp->name || hidpp->name == hdev->name) {
2166 		name = hidpp_get_device_name(hidpp);
2167 		if (!name) {
2168 			hid_err(hdev,
2169 				"unable to retrieve the name of the device");
2170 			return;
2171 		}
2172 
2173 		devm_name = devm_kasprintf(&hdev->dev, GFP_KERNEL, "%s", name);
2174 		kfree(name);
2175 		if (!devm_name)
2176 			return;
2177 
2178 		hidpp->name = devm_name;
2179 	}
2180 
2181 	input = hidpp_allocate_input(hdev);
2182 	if (!input) {
2183 		hid_err(hdev, "cannot allocate new input device: %d\n", ret);
2184 		return;
2185 	}
2186 
2187 	hidpp_populate_input(hidpp, input, false);
2188 
2189 	ret = input_register_device(input);
2190 	if (ret)
2191 		input_free_device(input);
2192 
2193 	hidpp->delayed_input = input;
2194 }
2195 
2196 static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
2197 {
2198 	struct hidpp_device *hidpp;
2199 	int ret;
2200 	bool connected;
2201 	unsigned int connect_mask = HID_CONNECT_DEFAULT;
2202 
2203 	hidpp = devm_kzalloc(&hdev->dev, sizeof(struct hidpp_device),
2204 			GFP_KERNEL);
2205 	if (!hidpp)
2206 		return -ENOMEM;
2207 
2208 	hidpp->hid_dev = hdev;
2209 	hidpp->name = hdev->name;
2210 	hid_set_drvdata(hdev, hidpp);
2211 
2212 	hidpp->quirks = id->driver_data;
2213 
2214 	if (disable_raw_mode) {
2215 		hidpp->quirks &= ~HIDPP_QUIRK_CLASS_WTP;
2216 		hidpp->quirks &= ~HIDPP_QUIRK_CONNECT_EVENTS;
2217 		hidpp->quirks &= ~HIDPP_QUIRK_NO_HIDINPUT;
2218 	}
2219 
2220 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {
2221 		ret = wtp_allocate(hdev, id);
2222 		if (ret)
2223 			goto allocate_fail;
2224 	} else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560) {
2225 		ret = m560_allocate(hdev);
2226 		if (ret)
2227 			goto allocate_fail;
2228 	} else if (hidpp->quirks & HIDPP_QUIRK_CLASS_K400) {
2229 		ret = k400_allocate(hdev);
2230 		if (ret)
2231 			goto allocate_fail;
2232 	}
2233 
2234 	INIT_WORK(&hidpp->work, delayed_work_cb);
2235 	mutex_init(&hidpp->send_mutex);
2236 	init_waitqueue_head(&hidpp->wait);
2237 
2238 	ret = hid_parse(hdev);
2239 	if (ret) {
2240 		hid_err(hdev, "%s:parse failed\n", __func__);
2241 		goto hid_parse_fail;
2242 	}
2243 
2244 	if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT)
2245 		connect_mask &= ~HID_CONNECT_HIDINPUT;
2246 
2247 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {
2248 		ret = hid_hw_start(hdev, connect_mask);
2249 		if (ret) {
2250 			hid_err(hdev, "hw start failed\n");
2251 			goto hid_hw_start_fail;
2252 		}
2253 		ret = hid_hw_open(hdev);
2254 		if (ret < 0) {
2255 			dev_err(&hdev->dev, "%s:hid_hw_open returned error:%d\n",
2256 				__func__, ret);
2257 			hid_hw_stop(hdev);
2258 			goto hid_hw_start_fail;
2259 		}
2260 	}
2261 
2262 
2263 	/* Allow incoming packets */
2264 	hid_device_io_start(hdev);
2265 
2266 	connected = hidpp_is_connected(hidpp);
2267 	if (id->group != HID_GROUP_LOGITECH_DJ_DEVICE) {
2268 		if (!connected) {
2269 			ret = -ENODEV;
2270 			hid_err(hdev, "Device not connected");
2271 			goto hid_hw_open_failed;
2272 		}
2273 
2274 		hid_info(hdev, "HID++ %u.%u device connected.\n",
2275 			 hidpp->protocol_major, hidpp->protocol_minor);
2276 	}
2277 
2278 	hidpp_overwrite_name(hdev, id->group == HID_GROUP_LOGITECH_DJ_DEVICE);
2279 	atomic_set(&hidpp->connected, connected);
2280 
2281 	if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)) {
2282 		ret = wtp_get_config(hidpp);
2283 		if (ret)
2284 			goto hid_hw_open_failed;
2285 	} else if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_G920)) {
2286 		ret = g920_get_config(hidpp);
2287 		if (ret)
2288 			goto hid_hw_open_failed;
2289 	}
2290 
2291 	/* Block incoming packets */
2292 	hid_device_io_stop(hdev);
2293 
2294 	if (!(hidpp->quirks & HIDPP_QUIRK_CLASS_G920)) {
2295 		ret = hid_hw_start(hdev, connect_mask);
2296 		if (ret) {
2297 			hid_err(hdev, "%s:hid_hw_start returned error\n", __func__);
2298 			goto hid_hw_start_fail;
2299 		}
2300 	}
2301 
2302 	if (hidpp->quirks & HIDPP_QUIRK_CONNECT_EVENTS) {
2303 		/* Allow incoming packets */
2304 		hid_device_io_start(hdev);
2305 
2306 		hidpp_connect_event(hidpp);
2307 	}
2308 
2309 	return ret;
2310 
2311 hid_hw_open_failed:
2312 	hid_device_io_stop(hdev);
2313 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {
2314 		hid_hw_close(hdev);
2315 		hid_hw_stop(hdev);
2316 	}
2317 hid_hw_start_fail:
2318 hid_parse_fail:
2319 	cancel_work_sync(&hidpp->work);
2320 	mutex_destroy(&hidpp->send_mutex);
2321 allocate_fail:
2322 	hid_set_drvdata(hdev, NULL);
2323 	return ret;
2324 }
2325 
2326 static void hidpp_remove(struct hid_device *hdev)
2327 {
2328 	struct hidpp_device *hidpp = hid_get_drvdata(hdev);
2329 
2330 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {
2331 		hidpp_ff_deinit(hdev);
2332 		hid_hw_close(hdev);
2333 	}
2334 	hid_hw_stop(hdev);
2335 	cancel_work_sync(&hidpp->work);
2336 	mutex_destroy(&hidpp->send_mutex);
2337 }
2338 
2339 static const struct hid_device_id hidpp_devices[] = {
2340 	{ /* wireless touchpad */
2341 	  HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
2342 		USB_VENDOR_ID_LOGITECH, 0x4011),
2343 	  .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT |
2344 			 HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS },
2345 	{ /* wireless touchpad T650 */
2346 	  HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
2347 		USB_VENDOR_ID_LOGITECH, 0x4101),
2348 	  .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT },
2349 	{ /* wireless touchpad T651 */
2350 	  HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
2351 		USB_DEVICE_ID_LOGITECH_T651),
2352 	  .driver_data = HIDPP_QUIRK_CLASS_WTP },
2353 	{ /* Mouse logitech M560 */
2354 	  HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
2355 		USB_VENDOR_ID_LOGITECH, 0x402d),
2356 	  .driver_data = HIDPP_QUIRK_DELAYED_INIT | HIDPP_QUIRK_CLASS_M560 },
2357 	{ /* Keyboard logitech K400 */
2358 	  HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
2359 		USB_VENDOR_ID_LOGITECH, 0x4024),
2360 	  .driver_data = HIDPP_QUIRK_CONNECT_EVENTS | HIDPP_QUIRK_CLASS_K400 },
2361 
2362 	{ HID_DEVICE(BUS_USB, HID_GROUP_LOGITECH_DJ_DEVICE,
2363 		USB_VENDOR_ID_LOGITECH, HID_ANY_ID)},
2364 
2365 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL),
2366 		.driver_data = HIDPP_QUIRK_CLASS_G920 | HIDPP_QUIRK_FORCE_OUTPUT_REPORTS},
2367 	{}
2368 };
2369 
2370 MODULE_DEVICE_TABLE(hid, hidpp_devices);
2371 
2372 static struct hid_driver hidpp_driver = {
2373 	.name = "logitech-hidpp-device",
2374 	.id_table = hidpp_devices,
2375 	.probe = hidpp_probe,
2376 	.remove = hidpp_remove,
2377 	.raw_event = hidpp_raw_event,
2378 	.input_configured = hidpp_input_configured,
2379 	.input_mapping = hidpp_input_mapping,
2380 	.input_mapped = hidpp_input_mapped,
2381 };
2382 
2383 module_hid_driver(hidpp_driver);
2384