1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * keyspan_remote: USB driver for the Keyspan DMR
4  *
5  * Copyright (C) 2005 Zymeta Corporation - Michael Downey (downey@zymeta.com)
6  *
7  * This driver has been put together with the support of Innosys, Inc.
8  * and Keyspan, Inc the manufacturers of the Keyspan USB DMR product.
9  */
10 
11 #include <linux/kernel.h>
12 #include <linux/errno.h>
13 #include <linux/slab.h>
14 #include <linux/module.h>
15 #include <linux/usb/input.h>
16 
17 /* Parameters that can be passed to the driver. */
18 static int debug;
19 module_param(debug, int, 0444);
20 MODULE_PARM_DESC(debug, "Enable extra debug messages and information");
21 
22 /* Vendor and product ids */
23 #define USB_KEYSPAN_VENDOR_ID		0x06CD
24 #define USB_KEYSPAN_PRODUCT_UIA11	0x0202
25 
26 /* Defines for converting the data from the remote. */
27 #define ZERO		0x18
28 #define ZERO_MASK	0x1F	/* 5 bits for a 0 */
29 #define ONE		0x3C
30 #define ONE_MASK	0x3F	/* 6 bits for a 1 */
31 #define SYNC		0x3F80
32 #define SYNC_MASK	0x3FFF	/* 14 bits for a SYNC sequence */
33 #define STOP		0x00
34 #define STOP_MASK	0x1F	/* 5 bits for the STOP sequence */
35 #define GAP		0xFF
36 
37 #define RECV_SIZE	8	/* The UIA-11 type have a 8 byte limit. */
38 
39 /*
40  * Table that maps the 31 possible keycodes to input keys.
41  * Currently there are 15 and 17 button models so RESERVED codes
42  * are blank areas in the mapping.
43  */
44 static const unsigned short keyspan_key_table[] = {
45 	KEY_RESERVED,		/* 0 is just a place holder. */
46 	KEY_RESERVED,
47 	KEY_STOP,
48 	KEY_PLAYCD,
49 	KEY_RESERVED,
50 	KEY_PREVIOUSSONG,
51 	KEY_REWIND,
52 	KEY_FORWARD,
53 	KEY_NEXTSONG,
54 	KEY_RESERVED,
55 	KEY_RESERVED,
56 	KEY_RESERVED,
57 	KEY_PAUSE,
58 	KEY_VOLUMEUP,
59 	KEY_RESERVED,
60 	KEY_RESERVED,
61 	KEY_RESERVED,
62 	KEY_VOLUMEDOWN,
63 	KEY_RESERVED,
64 	KEY_UP,
65 	KEY_RESERVED,
66 	KEY_MUTE,
67 	KEY_LEFT,
68 	KEY_ENTER,
69 	KEY_RIGHT,
70 	KEY_RESERVED,
71 	KEY_RESERVED,
72 	KEY_DOWN,
73 	KEY_RESERVED,
74 	KEY_KPASTERISK,
75 	KEY_RESERVED,
76 	KEY_MENU
77 };
78 
79 /* table of devices that work with this driver */
80 static const struct usb_device_id keyspan_table[] = {
81 	{ USB_DEVICE(USB_KEYSPAN_VENDOR_ID, USB_KEYSPAN_PRODUCT_UIA11) },
82 	{ }					/* Terminating entry */
83 };
84 
85 /* Structure to store all the real stuff that a remote sends to us. */
86 struct keyspan_message {
87 	u16	system;
88 	u8	button;
89 	u8	toggle;
90 };
91 
92 /* Structure used for all the bit testing magic needed to be done. */
93 struct bit_tester {
94 	u32	tester;
95 	int	len;
96 	int	pos;
97 	int	bits_left;
98 	u8	buffer[32];
99 };
100 
101 /* Structure to hold all of our driver specific stuff */
102 struct usb_keyspan {
103 	char				name[128];
104 	char				phys[64];
105 	unsigned short			keymap[ARRAY_SIZE(keyspan_key_table)];
106 	struct usb_device		*udev;
107 	struct input_dev		*input;
108 	struct usb_interface		*interface;
109 	struct usb_endpoint_descriptor	*in_endpoint;
110 	struct urb*			irq_urb;
111 	int				open;
112 	dma_addr_t			in_dma;
113 	unsigned char			*in_buffer;
114 
115 	/* variables used to parse messages from remote. */
116 	struct bit_tester		data;
117 	int				stage;
118 	int				toggle;
119 };
120 
121 static struct usb_driver keyspan_driver;
122 
123 /*
124  * Debug routine that prints out what we've received from the remote.
125  */
126 static void keyspan_print(struct usb_keyspan* dev) /*unsigned char* data)*/
127 {
128 	char codes[4 * RECV_SIZE];
129 	int i;
130 
131 	for (i = 0; i < RECV_SIZE; i++)
132 		snprintf(codes + i * 3, 4, "%02x ", dev->in_buffer[i]);
133 
134 	dev_info(&dev->udev->dev, "%s\n", codes);
135 }
136 
137 /*
138  * Routine that manages the bit_tester structure.  It makes sure that there are
139  * at least bits_needed bits loaded into the tester.
140  */
141 static int keyspan_load_tester(struct usb_keyspan* dev, int bits_needed)
142 {
143 	if (dev->data.bits_left >= bits_needed)
144 		return 0;
145 
146 	/*
147 	 * Somehow we've missed the last message. The message will be repeated
148 	 * though so it's not too big a deal
149 	 */
150 	if (dev->data.pos >= dev->data.len) {
151 		dev_dbg(&dev->interface->dev,
152 			"%s - Error ran out of data. pos: %d, len: %d\n",
153 			__func__, dev->data.pos, dev->data.len);
154 		return -1;
155 	}
156 
157 	/* Load as much as we can into the tester. */
158 	while ((dev->data.bits_left + 7 < (sizeof(dev->data.tester) * 8)) &&
159 	       (dev->data.pos < dev->data.len)) {
160 		dev->data.tester += (dev->data.buffer[dev->data.pos++] << dev->data.bits_left);
161 		dev->data.bits_left += 8;
162 	}
163 
164 	return 0;
165 }
166 
167 static void keyspan_report_button(struct usb_keyspan *remote, int button, int press)
168 {
169 	struct input_dev *input = remote->input;
170 
171 	input_event(input, EV_MSC, MSC_SCAN, button);
172 	input_report_key(input, remote->keymap[button], press);
173 	input_sync(input);
174 }
175 
176 /*
177  * Routine that handles all the logic needed to parse out the message from the remote.
178  */
179 static void keyspan_check_data(struct usb_keyspan *remote)
180 {
181 	int i;
182 	int found = 0;
183 	struct keyspan_message message;
184 
185 	switch(remote->stage) {
186 	case 0:
187 		/*
188 		 * In stage 0 we want to find the start of a message.  The remote sends a 0xFF as filler.
189 		 * So the first byte that isn't a FF should be the start of a new message.
190 		 */
191 		for (i = 0; i < RECV_SIZE && remote->in_buffer[i] == GAP; ++i);
192 
193 		if (i < RECV_SIZE) {
194 			memcpy(remote->data.buffer, remote->in_buffer, RECV_SIZE);
195 			remote->data.len = RECV_SIZE;
196 			remote->data.pos = 0;
197 			remote->data.tester = 0;
198 			remote->data.bits_left = 0;
199 			remote->stage = 1;
200 		}
201 		break;
202 
203 	case 1:
204 		/*
205 		 * Stage 1 we should have 16 bytes and should be able to detect a
206 		 * SYNC.  The SYNC is 14 bits, 7 0's and then 7 1's.
207 		 */
208 		memcpy(remote->data.buffer + remote->data.len, remote->in_buffer, RECV_SIZE);
209 		remote->data.len += RECV_SIZE;
210 
211 		found = 0;
212 		while ((remote->data.bits_left >= 14 || remote->data.pos < remote->data.len) && !found) {
213 			for (i = 0; i < 8; ++i) {
214 				if (keyspan_load_tester(remote, 14) != 0) {
215 					remote->stage = 0;
216 					return;
217 				}
218 
219 				if ((remote->data.tester & SYNC_MASK) == SYNC) {
220 					remote->data.tester = remote->data.tester >> 14;
221 					remote->data.bits_left -= 14;
222 					found = 1;
223 					break;
224 				} else {
225 					remote->data.tester = remote->data.tester >> 1;
226 					--remote->data.bits_left;
227 				}
228 			}
229 		}
230 
231 		if (!found) {
232 			remote->stage = 0;
233 			remote->data.len = 0;
234 		} else {
235 			remote->stage = 2;
236 		}
237 		break;
238 
239 	case 2:
240 		/*
241 		 * Stage 2 we should have 24 bytes which will be enough for a full
242 		 * message.  We need to parse out the system code, button code,
243 		 * toggle code, and stop.
244 		 */
245 		memcpy(remote->data.buffer + remote->data.len, remote->in_buffer, RECV_SIZE);
246 		remote->data.len += RECV_SIZE;
247 
248 		message.system = 0;
249 		for (i = 0; i < 9; i++) {
250 			keyspan_load_tester(remote, 6);
251 
252 			if ((remote->data.tester & ZERO_MASK) == ZERO) {
253 				message.system = message.system << 1;
254 				remote->data.tester = remote->data.tester >> 5;
255 				remote->data.bits_left -= 5;
256 			} else if ((remote->data.tester & ONE_MASK) == ONE) {
257 				message.system = (message.system << 1) + 1;
258 				remote->data.tester = remote->data.tester >> 6;
259 				remote->data.bits_left -= 6;
260 			} else {
261 				dev_err(&remote->interface->dev,
262 					"%s - Unknown sequence found in system data.\n",
263 					__func__);
264 				remote->stage = 0;
265 				return;
266 			}
267 		}
268 
269 		message.button = 0;
270 		for (i = 0; i < 5; i++) {
271 			keyspan_load_tester(remote, 6);
272 
273 			if ((remote->data.tester & ZERO_MASK) == ZERO) {
274 				message.button = message.button << 1;
275 				remote->data.tester = remote->data.tester >> 5;
276 				remote->data.bits_left -= 5;
277 			} else if ((remote->data.tester & ONE_MASK) == ONE) {
278 				message.button = (message.button << 1) + 1;
279 				remote->data.tester = remote->data.tester >> 6;
280 				remote->data.bits_left -= 6;
281 			} else {
282 				dev_err(&remote->interface->dev,
283 					"%s - Unknown sequence found in button data.\n",
284 					__func__);
285 				remote->stage = 0;
286 				return;
287 			}
288 		}
289 
290 		keyspan_load_tester(remote, 6);
291 		if ((remote->data.tester & ZERO_MASK) == ZERO) {
292 			message.toggle = 0;
293 			remote->data.tester = remote->data.tester >> 5;
294 			remote->data.bits_left -= 5;
295 		} else if ((remote->data.tester & ONE_MASK) == ONE) {
296 			message.toggle = 1;
297 			remote->data.tester = remote->data.tester >> 6;
298 			remote->data.bits_left -= 6;
299 		} else {
300 			dev_err(&remote->interface->dev,
301 				"%s - Error in message, invalid toggle.\n",
302 				__func__);
303 			remote->stage = 0;
304 			return;
305 		}
306 
307 		keyspan_load_tester(remote, 5);
308 		if ((remote->data.tester & STOP_MASK) == STOP) {
309 			remote->data.tester = remote->data.tester >> 5;
310 			remote->data.bits_left -= 5;
311 		} else {
312 			dev_err(&remote->interface->dev,
313 				"Bad message received, no stop bit found.\n");
314 		}
315 
316 		dev_dbg(&remote->interface->dev,
317 			"%s found valid message: system: %d, button: %d, toggle: %d\n",
318 			__func__, message.system, message.button, message.toggle);
319 
320 		if (message.toggle != remote->toggle) {
321 			keyspan_report_button(remote, message.button, 1);
322 			keyspan_report_button(remote, message.button, 0);
323 			remote->toggle = message.toggle;
324 		}
325 
326 		remote->stage = 0;
327 		break;
328 	}
329 }
330 
331 /*
332  * Routine for sending all the initialization messages to the remote.
333  */
334 static int keyspan_setup(struct usb_device* dev)
335 {
336 	int retval = 0;
337 
338 	retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
339 				 0x11, 0x40, 0x5601, 0x0, NULL, 0,
340 				 USB_CTRL_SET_TIMEOUT);
341 	if (retval) {
342 		dev_dbg(&dev->dev, "%s - failed to set bit rate due to error: %d\n",
343 			__func__, retval);
344 		return(retval);
345 	}
346 
347 	retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
348 				 0x44, 0x40, 0x0, 0x0, NULL, 0,
349 				 USB_CTRL_SET_TIMEOUT);
350 	if (retval) {
351 		dev_dbg(&dev->dev, "%s - failed to set resume sensitivity due to error: %d\n",
352 			__func__, retval);
353 		return(retval);
354 	}
355 
356 	retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
357 				 0x22, 0x40, 0x0, 0x0, NULL, 0,
358 				 USB_CTRL_SET_TIMEOUT);
359 	if (retval) {
360 		dev_dbg(&dev->dev, "%s - failed to turn receive on due to error: %d\n",
361 			__func__, retval);
362 		return(retval);
363 	}
364 
365 	dev_dbg(&dev->dev, "%s - Setup complete.\n", __func__);
366 	return(retval);
367 }
368 
369 /*
370  * Routine used to handle a new message that has come in.
371  */
372 static void keyspan_irq_recv(struct urb *urb)
373 {
374 	struct usb_keyspan *dev = urb->context;
375 	int retval;
376 
377 	/* Check our status in case we need to bail out early. */
378 	switch (urb->status) {
379 	case 0:
380 		break;
381 
382 	/* Device went away so don't keep trying to read from it. */
383 	case -ECONNRESET:
384 	case -ENOENT:
385 	case -ESHUTDOWN:
386 		return;
387 
388 	default:
389 		goto resubmit;
390 	}
391 
392 	if (debug)
393 		keyspan_print(dev);
394 
395 	keyspan_check_data(dev);
396 
397 resubmit:
398 	retval = usb_submit_urb(urb, GFP_ATOMIC);
399 	if (retval)
400 		dev_err(&dev->interface->dev,
401 			"%s - usb_submit_urb failed with result: %d\n",
402 			__func__, retval);
403 }
404 
405 static int keyspan_open(struct input_dev *dev)
406 {
407 	struct usb_keyspan *remote = input_get_drvdata(dev);
408 
409 	remote->irq_urb->dev = remote->udev;
410 	if (usb_submit_urb(remote->irq_urb, GFP_KERNEL))
411 		return -EIO;
412 
413 	return 0;
414 }
415 
416 static void keyspan_close(struct input_dev *dev)
417 {
418 	struct usb_keyspan *remote = input_get_drvdata(dev);
419 
420 	usb_kill_urb(remote->irq_urb);
421 }
422 
423 static struct usb_endpoint_descriptor *keyspan_get_in_endpoint(struct usb_host_interface *iface)
424 {
425 
426 	struct usb_endpoint_descriptor *endpoint;
427 	int i;
428 
429 	for (i = 0; i < iface->desc.bNumEndpoints; ++i) {
430 		endpoint = &iface->endpoint[i].desc;
431 
432 		if (usb_endpoint_is_int_in(endpoint)) {
433 			/* we found our interrupt in endpoint */
434 			return endpoint;
435 		}
436 	}
437 
438 	return NULL;
439 }
440 
441 /*
442  * Routine that sets up the driver to handle a specific USB device detected on the bus.
443  */
444 static int keyspan_probe(struct usb_interface *interface, const struct usb_device_id *id)
445 {
446 	struct usb_device *udev = interface_to_usbdev(interface);
447 	struct usb_endpoint_descriptor *endpoint;
448 	struct usb_keyspan *remote;
449 	struct input_dev *input_dev;
450 	int i, error;
451 
452 	endpoint = keyspan_get_in_endpoint(interface->cur_altsetting);
453 	if (!endpoint)
454 		return -ENODEV;
455 
456 	remote = kzalloc(sizeof(*remote), GFP_KERNEL);
457 	input_dev = input_allocate_device();
458 	if (!remote || !input_dev) {
459 		error = -ENOMEM;
460 		goto fail1;
461 	}
462 
463 	remote->udev = udev;
464 	remote->input = input_dev;
465 	remote->interface = interface;
466 	remote->in_endpoint = endpoint;
467 	remote->toggle = -1;	/* Set to -1 so we will always not match the toggle from the first remote message. */
468 
469 	remote->in_buffer = usb_alloc_coherent(udev, RECV_SIZE, GFP_KERNEL, &remote->in_dma);
470 	if (!remote->in_buffer) {
471 		error = -ENOMEM;
472 		goto fail1;
473 	}
474 
475 	remote->irq_urb = usb_alloc_urb(0, GFP_KERNEL);
476 	if (!remote->irq_urb) {
477 		error = -ENOMEM;
478 		goto fail2;
479 	}
480 
481 	error = keyspan_setup(udev);
482 	if (error) {
483 		error = -ENODEV;
484 		goto fail3;
485 	}
486 
487 	if (udev->manufacturer)
488 		strlcpy(remote->name, udev->manufacturer, sizeof(remote->name));
489 
490 	if (udev->product) {
491 		if (udev->manufacturer)
492 			strlcat(remote->name, " ", sizeof(remote->name));
493 		strlcat(remote->name, udev->product, sizeof(remote->name));
494 	}
495 
496 	if (!strlen(remote->name))
497 		snprintf(remote->name, sizeof(remote->name),
498 			 "USB Keyspan Remote %04x:%04x",
499 			 le16_to_cpu(udev->descriptor.idVendor),
500 			 le16_to_cpu(udev->descriptor.idProduct));
501 
502 	usb_make_path(udev, remote->phys, sizeof(remote->phys));
503 	strlcat(remote->phys, "/input0", sizeof(remote->phys));
504 	memcpy(remote->keymap, keyspan_key_table, sizeof(remote->keymap));
505 
506 	input_dev->name = remote->name;
507 	input_dev->phys = remote->phys;
508 	usb_to_input_id(udev, &input_dev->id);
509 	input_dev->dev.parent = &interface->dev;
510 	input_dev->keycode = remote->keymap;
511 	input_dev->keycodesize = sizeof(unsigned short);
512 	input_dev->keycodemax = ARRAY_SIZE(remote->keymap);
513 
514 	input_set_capability(input_dev, EV_MSC, MSC_SCAN);
515 	__set_bit(EV_KEY, input_dev->evbit);
516 	for (i = 0; i < ARRAY_SIZE(keyspan_key_table); i++)
517 		__set_bit(keyspan_key_table[i], input_dev->keybit);
518 	__clear_bit(KEY_RESERVED, input_dev->keybit);
519 
520 	input_set_drvdata(input_dev, remote);
521 
522 	input_dev->open = keyspan_open;
523 	input_dev->close = keyspan_close;
524 
525 	/*
526 	 * Initialize the URB to access the device.
527 	 * The urb gets sent to the device in keyspan_open()
528 	 */
529 	usb_fill_int_urb(remote->irq_urb,
530 			 remote->udev,
531 			 usb_rcvintpipe(remote->udev, endpoint->bEndpointAddress),
532 			 remote->in_buffer, RECV_SIZE, keyspan_irq_recv, remote,
533 			 endpoint->bInterval);
534 	remote->irq_urb->transfer_dma = remote->in_dma;
535 	remote->irq_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
536 
537 	/* we can register the device now, as it is ready */
538 	error = input_register_device(remote->input);
539 	if (error)
540 		goto fail3;
541 
542 	/* save our data pointer in this interface device */
543 	usb_set_intfdata(interface, remote);
544 
545 	return 0;
546 
547  fail3:	usb_free_urb(remote->irq_urb);
548  fail2:	usb_free_coherent(udev, RECV_SIZE, remote->in_buffer, remote->in_dma);
549  fail1:	kfree(remote);
550 	input_free_device(input_dev);
551 
552 	return error;
553 }
554 
555 /*
556  * Routine called when a device is disconnected from the USB.
557  */
558 static void keyspan_disconnect(struct usb_interface *interface)
559 {
560 	struct usb_keyspan *remote;
561 
562 	remote = usb_get_intfdata(interface);
563 	usb_set_intfdata(interface, NULL);
564 
565 	if (remote) {	/* We have a valid driver structure so clean up everything we allocated. */
566 		input_unregister_device(remote->input);
567 		usb_kill_urb(remote->irq_urb);
568 		usb_free_urb(remote->irq_urb);
569 		usb_free_coherent(remote->udev, RECV_SIZE, remote->in_buffer, remote->in_dma);
570 		kfree(remote);
571 	}
572 }
573 
574 /*
575  * Standard driver set up sections
576  */
577 static struct usb_driver keyspan_driver =
578 {
579 	.name =		"keyspan_remote",
580 	.probe =	keyspan_probe,
581 	.disconnect =	keyspan_disconnect,
582 	.id_table =	keyspan_table
583 };
584 
585 module_usb_driver(keyspan_driver);
586 
587 MODULE_DEVICE_TABLE(usb, keyspan_table);
588 MODULE_AUTHOR("Michael Downey <downey@zymeta.com>");
589 MODULE_DESCRIPTION("Driver for the USB Keyspan remote control.");
590 MODULE_LICENSE("GPL");
591