]> git.karo-electronics.de Git - karo-tx-linux.git/blob - drivers/input/misc/ims-pcu.c
Input: ims-pcu - fix a memory leak on error
[karo-tx-linux.git] / drivers / input / misc / ims-pcu.c
1 /*
2  * Driver for IMS Passenger Control Unit Devices
3  *
4  * Copyright (C) 2013 The IMS Company
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License version 2
8  * as published by the Free Software Foundation.
9  */
10
11 #include <linux/completion.h>
12 #include <linux/device.h>
13 #include <linux/firmware.h>
14 #include <linux/ihex.h>
15 #include <linux/input.h>
16 #include <linux/kernel.h>
17 #include <linux/leds.h>
18 #include <linux/module.h>
19 #include <linux/slab.h>
20 #include <linux/types.h>
21 #include <linux/usb/input.h>
22 #include <linux/usb/cdc.h>
23 #include <asm/unaligned.h>
24
25 #define IMS_PCU_KEYMAP_LEN              32
26
27 struct ims_pcu_buttons {
28         struct input_dev *input;
29         char name[32];
30         char phys[32];
31         unsigned short keymap[IMS_PCU_KEYMAP_LEN];
32 };
33
34 struct ims_pcu_gamepad {
35         struct input_dev *input;
36         char name[32];
37         char phys[32];
38 };
39
40 struct ims_pcu_backlight {
41         struct led_classdev cdev;
42         struct work_struct work;
43         enum led_brightness desired_brightness;
44         char name[32];
45 };
46
47 #define IMS_PCU_PART_NUMBER_LEN         15
48 #define IMS_PCU_SERIAL_NUMBER_LEN       8
49 #define IMS_PCU_DOM_LEN                 8
50 #define IMS_PCU_FW_VERSION_LEN          (9 + 1)
51 #define IMS_PCU_BL_VERSION_LEN          (9 + 1)
52 #define IMS_PCU_BL_RESET_REASON_LEN     (2 + 1)
53
54 #define IMS_PCU_BUF_SIZE                128
55
56 struct ims_pcu {
57         struct usb_device *udev;
58         struct device *dev; /* control interface's device, used for logging */
59
60         unsigned int device_no;
61
62         bool bootloader_mode;
63
64         char part_number[IMS_PCU_PART_NUMBER_LEN];
65         char serial_number[IMS_PCU_SERIAL_NUMBER_LEN];
66         char date_of_manufacturing[IMS_PCU_DOM_LEN];
67         char fw_version[IMS_PCU_FW_VERSION_LEN];
68         char bl_version[IMS_PCU_BL_VERSION_LEN];
69         char reset_reason[IMS_PCU_BL_RESET_REASON_LEN];
70         int update_firmware_status;
71
72         struct usb_interface *ctrl_intf;
73
74         struct usb_endpoint_descriptor *ep_ctrl;
75         struct urb *urb_ctrl;
76         u8 *urb_ctrl_buf;
77         dma_addr_t ctrl_dma;
78         size_t max_ctrl_size;
79
80         struct usb_interface *data_intf;
81
82         struct usb_endpoint_descriptor *ep_in;
83         struct urb *urb_in;
84         u8 *urb_in_buf;
85         dma_addr_t read_dma;
86         size_t max_in_size;
87
88         struct usb_endpoint_descriptor *ep_out;
89         u8 *urb_out_buf;
90         size_t max_out_size;
91
92         u8 read_buf[IMS_PCU_BUF_SIZE];
93         u8 read_pos;
94         u8 check_sum;
95         bool have_stx;
96         bool have_dle;
97
98         u8 cmd_buf[IMS_PCU_BUF_SIZE];
99         u8 ack_id;
100         u8 expected_response;
101         u8 cmd_buf_len;
102         struct completion cmd_done;
103         struct mutex cmd_mutex;
104
105         u32 fw_start_addr;
106         u32 fw_end_addr;
107         struct completion async_firmware_done;
108
109         struct ims_pcu_buttons buttons;
110         struct ims_pcu_gamepad *gamepad;
111         struct ims_pcu_backlight backlight;
112
113         bool setup_complete; /* Input and LED devices have been created */
114 };
115
116
117 /*********************************************************************
118  *             Buttons Input device support                          *
119  *********************************************************************/
120
121 static const unsigned short ims_pcu_keymap_1[] = {
122         [1] = KEY_ATTENDANT_OFF,
123         [2] = KEY_ATTENDANT_ON,
124         [3] = KEY_LIGHTS_TOGGLE,
125         [4] = KEY_VOLUMEUP,
126         [5] = KEY_VOLUMEDOWN,
127         [6] = KEY_INFO,
128 };
129
130 static const unsigned short ims_pcu_keymap_2[] = {
131         [4] = KEY_VOLUMEUP,
132         [5] = KEY_VOLUMEDOWN,
133         [6] = KEY_INFO,
134 };
135
136 static const unsigned short ims_pcu_keymap_3[] = {
137         [1] = KEY_HOMEPAGE,
138         [2] = KEY_ATTENDANT_TOGGLE,
139         [3] = KEY_LIGHTS_TOGGLE,
140         [4] = KEY_VOLUMEUP,
141         [5] = KEY_VOLUMEDOWN,
142         [6] = KEY_DISPLAYTOGGLE,
143         [18] = KEY_PLAYPAUSE,
144 };
145
146 static const unsigned short ims_pcu_keymap_4[] = {
147         [1] = KEY_ATTENDANT_OFF,
148         [2] = KEY_ATTENDANT_ON,
149         [3] = KEY_LIGHTS_TOGGLE,
150         [4] = KEY_VOLUMEUP,
151         [5] = KEY_VOLUMEDOWN,
152         [6] = KEY_INFO,
153         [18] = KEY_PLAYPAUSE,
154 };
155
156 static const unsigned short ims_pcu_keymap_5[] = {
157         [1] = KEY_ATTENDANT_OFF,
158         [2] = KEY_ATTENDANT_ON,
159         [3] = KEY_LIGHTS_TOGGLE,
160 };
161
162 struct ims_pcu_device_info {
163         const unsigned short *keymap;
164         size_t keymap_len;
165         bool has_gamepad;
166 };
167
168 #define IMS_PCU_DEVINFO(_n, _gamepad)                           \
169         [_n] = {                                                \
170                 .keymap = ims_pcu_keymap_##_n,                  \
171                 .keymap_len = ARRAY_SIZE(ims_pcu_keymap_##_n),  \
172                 .has_gamepad = _gamepad,                        \
173         }
174
175 static const struct ims_pcu_device_info ims_pcu_device_info[] = {
176         IMS_PCU_DEVINFO(1, true),
177         IMS_PCU_DEVINFO(2, true),
178         IMS_PCU_DEVINFO(3, true),
179         IMS_PCU_DEVINFO(4, true),
180         IMS_PCU_DEVINFO(5, false),
181 };
182
183 static void ims_pcu_buttons_report(struct ims_pcu *pcu, u32 data)
184 {
185         struct ims_pcu_buttons *buttons = &pcu->buttons;
186         struct input_dev *input = buttons->input;
187         int i;
188
189         for (i = 0; i < 32; i++) {
190                 unsigned short keycode = buttons->keymap[i];
191
192                 if (keycode != KEY_RESERVED)
193                         input_report_key(input, keycode, data & (1UL << i));
194         }
195
196         input_sync(input);
197 }
198
199 static int ims_pcu_setup_buttons(struct ims_pcu *pcu,
200                                  const unsigned short *keymap,
201                                  size_t keymap_len)
202 {
203         struct ims_pcu_buttons *buttons = &pcu->buttons;
204         struct input_dev *input;
205         int i;
206         int error;
207
208         input = input_allocate_device();
209         if (!input) {
210                 dev_err(pcu->dev,
211                         "Not enough memory for input input device\n");
212                 return -ENOMEM;
213         }
214
215         snprintf(buttons->name, sizeof(buttons->name),
216                  "IMS PCU#%d Button Interface", pcu->device_no);
217
218         usb_make_path(pcu->udev, buttons->phys, sizeof(buttons->phys));
219         strlcat(buttons->phys, "/input0", sizeof(buttons->phys));
220
221         memcpy(buttons->keymap, keymap, sizeof(*keymap) * keymap_len);
222
223         input->name = buttons->name;
224         input->phys = buttons->phys;
225         usb_to_input_id(pcu->udev, &input->id);
226         input->dev.parent = &pcu->ctrl_intf->dev;
227
228         input->keycode = buttons->keymap;
229         input->keycodemax = ARRAY_SIZE(buttons->keymap);
230         input->keycodesize = sizeof(buttons->keymap[0]);
231
232         __set_bit(EV_KEY, input->evbit);
233         for (i = 0; i < IMS_PCU_KEYMAP_LEN; i++)
234                 __set_bit(buttons->keymap[i], input->keybit);
235         __clear_bit(KEY_RESERVED, input->keybit);
236
237         error = input_register_device(input);
238         if (error) {
239                 dev_err(pcu->dev,
240                         "Failed to register buttons input device: %d\n",
241                         error);
242                 input_free_device(input);
243                 return error;
244         }
245
246         buttons->input = input;
247         return 0;
248 }
249
250 static void ims_pcu_destroy_buttons(struct ims_pcu *pcu)
251 {
252         struct ims_pcu_buttons *buttons = &pcu->buttons;
253
254         input_unregister_device(buttons->input);
255 }
256
257
258 /*********************************************************************
259  *             Gamepad Input device support                          *
260  *********************************************************************/
261
262 static void ims_pcu_gamepad_report(struct ims_pcu *pcu, u32 data)
263 {
264         struct ims_pcu_gamepad *gamepad = pcu->gamepad;
265         struct input_dev *input = gamepad->input;
266         int x, y;
267
268         x = !!(data & (1 << 14)) - !!(data & (1 << 13));
269         y = !!(data & (1 << 12)) - !!(data & (1 << 11));
270
271         input_report_abs(input, ABS_X, x);
272         input_report_abs(input, ABS_Y, y);
273
274         input_report_key(input, BTN_A, data & (1 << 7));
275         input_report_key(input, BTN_B, data & (1 << 8));
276         input_report_key(input, BTN_X, data & (1 << 9));
277         input_report_key(input, BTN_Y, data & (1 << 10));
278         input_report_key(input, BTN_START, data & (1 << 15));
279         input_report_key(input, BTN_SELECT, data & (1 << 16));
280
281         input_sync(input);
282 }
283
284 static int ims_pcu_setup_gamepad(struct ims_pcu *pcu)
285 {
286         struct ims_pcu_gamepad *gamepad;
287         struct input_dev *input;
288         int error;
289
290         gamepad = kzalloc(sizeof(struct ims_pcu_gamepad), GFP_KERNEL);
291         input = input_allocate_device();
292         if (!gamepad || !input) {
293                 dev_err(pcu->dev,
294                         "Not enough memory for gamepad device\n");
295                 error = -ENOMEM;
296                 goto err_free_mem;
297         }
298
299         gamepad->input = input;
300
301         snprintf(gamepad->name, sizeof(gamepad->name),
302                  "IMS PCU#%d Gamepad Interface", pcu->device_no);
303
304         usb_make_path(pcu->udev, gamepad->phys, sizeof(gamepad->phys));
305         strlcat(gamepad->phys, "/input1", sizeof(gamepad->phys));
306
307         input->name = gamepad->name;
308         input->phys = gamepad->phys;
309         usb_to_input_id(pcu->udev, &input->id);
310         input->dev.parent = &pcu->ctrl_intf->dev;
311
312         __set_bit(EV_KEY, input->evbit);
313         __set_bit(BTN_A, input->keybit);
314         __set_bit(BTN_B, input->keybit);
315         __set_bit(BTN_X, input->keybit);
316         __set_bit(BTN_Y, input->keybit);
317         __set_bit(BTN_START, input->keybit);
318         __set_bit(BTN_SELECT, input->keybit);
319
320         __set_bit(EV_ABS, input->evbit);
321         input_set_abs_params(input, ABS_X, -1, 1, 0, 0);
322         input_set_abs_params(input, ABS_Y, -1, 1, 0, 0);
323
324         error = input_register_device(input);
325         if (error) {
326                 dev_err(pcu->dev,
327                         "Failed to register gamepad input device: %d\n",
328                         error);
329                 goto err_free_mem;
330         }
331
332         pcu->gamepad = gamepad;
333         return 0;
334
335 err_free_mem:
336         input_free_device(input);
337         kfree(gamepad);
338         return -ENOMEM;
339 }
340
341 static void ims_pcu_destroy_gamepad(struct ims_pcu *pcu)
342 {
343         struct ims_pcu_gamepad *gamepad = pcu->gamepad;
344
345         input_unregister_device(gamepad->input);
346         kfree(gamepad);
347 }
348
349
350 /*********************************************************************
351  *             PCU Communication protocol handling                   *
352  *********************************************************************/
353
354 #define IMS_PCU_PROTOCOL_STX            0x02
355 #define IMS_PCU_PROTOCOL_ETX            0x03
356 #define IMS_PCU_PROTOCOL_DLE            0x10
357
358 /* PCU commands */
359 #define IMS_PCU_CMD_STATUS              0xa0
360 #define IMS_PCU_CMD_PCU_RESET           0xa1
361 #define IMS_PCU_CMD_RESET_REASON        0xa2
362 #define IMS_PCU_CMD_SEND_BUTTONS        0xa3
363 #define IMS_PCU_CMD_JUMP_TO_BTLDR       0xa4
364 #define IMS_PCU_CMD_GET_INFO            0xa5
365 #define IMS_PCU_CMD_SET_BRIGHTNESS      0xa6
366 #define IMS_PCU_CMD_EEPROM              0xa7
367 #define IMS_PCU_CMD_GET_FW_VERSION      0xa8
368 #define IMS_PCU_CMD_GET_BL_VERSION      0xa9
369 #define IMS_PCU_CMD_SET_INFO            0xab
370 #define IMS_PCU_CMD_GET_BRIGHTNESS      0xac
371 #define IMS_PCU_CMD_GET_DEVICE_ID       0xae
372 #define IMS_PCU_CMD_SPECIAL_INFO        0xb0
373 #define IMS_PCU_CMD_BOOTLOADER          0xb1    /* Pass data to bootloader */
374
375 /* PCU responses */
376 #define IMS_PCU_RSP_STATUS              0xc0
377 #define IMS_PCU_RSP_PCU_RESET           0       /* Originally 0xc1 */
378 #define IMS_PCU_RSP_RESET_REASON        0xc2
379 #define IMS_PCU_RSP_SEND_BUTTONS        0xc3
380 #define IMS_PCU_RSP_JUMP_TO_BTLDR       0       /* Originally 0xc4 */
381 #define IMS_PCU_RSP_GET_INFO            0xc5
382 #define IMS_PCU_RSP_SET_BRIGHTNESS      0xc6
383 #define IMS_PCU_RSP_EEPROM              0xc7
384 #define IMS_PCU_RSP_GET_FW_VERSION      0xc8
385 #define IMS_PCU_RSP_GET_BL_VERSION      0xc9
386 #define IMS_PCU_RSP_SET_INFO            0xcb
387 #define IMS_PCU_RSP_GET_BRIGHTNESS      0xcc
388 #define IMS_PCU_RSP_CMD_INVALID         0xcd
389 #define IMS_PCU_RSP_GET_DEVICE_ID       0xce
390 #define IMS_PCU_RSP_SPECIAL_INFO        0xd0
391 #define IMS_PCU_RSP_BOOTLOADER          0xd1    /* Bootloader response */
392
393 #define IMS_PCU_RSP_EVNT_BUTTONS        0xe0    /* Unsolicited, button state */
394 #define IMS_PCU_GAMEPAD_MASK            0x0001ff80UL    /* Bits 7 through 16 */
395
396
397 #define IMS_PCU_MIN_PACKET_LEN          3
398 #define IMS_PCU_DATA_OFFSET             2
399
400 #define IMS_PCU_CMD_WRITE_TIMEOUT       100 /* msec */
401 #define IMS_PCU_CMD_RESPONSE_TIMEOUT    500 /* msec */
402
403 static void ims_pcu_report_events(struct ims_pcu *pcu)
404 {
405         u32 data = get_unaligned_be32(&pcu->read_buf[3]);
406
407         ims_pcu_buttons_report(pcu, data & ~IMS_PCU_GAMEPAD_MASK);
408         if (pcu->gamepad)
409                 ims_pcu_gamepad_report(pcu, data);
410 }
411
412 static void ims_pcu_handle_response(struct ims_pcu *pcu)
413 {
414         switch (pcu->read_buf[0]) {
415         case IMS_PCU_RSP_EVNT_BUTTONS:
416                 if (likely(pcu->setup_complete))
417                         ims_pcu_report_events(pcu);
418                 break;
419
420         default:
421                 /*
422                  * See if we got command completion.
423                  * If both the sequence and response code match save
424                  * the data and signal completion.
425                  */
426                 if (pcu->read_buf[0] == pcu->expected_response &&
427                     pcu->read_buf[1] == pcu->ack_id - 1) {
428
429                         memcpy(pcu->cmd_buf, pcu->read_buf, pcu->read_pos);
430                         pcu->cmd_buf_len = pcu->read_pos;
431                         complete(&pcu->cmd_done);
432                 }
433                 break;
434         }
435 }
436
437 static void ims_pcu_process_data(struct ims_pcu *pcu, struct urb *urb)
438 {
439         int i;
440
441         for (i = 0; i < urb->actual_length; i++) {
442                 u8 data = pcu->urb_in_buf[i];
443
444                 /* Skip everything until we get Start Xmit */
445                 if (!pcu->have_stx && data != IMS_PCU_PROTOCOL_STX)
446                         continue;
447
448                 if (pcu->have_dle) {
449                         pcu->have_dle = false;
450                         pcu->read_buf[pcu->read_pos++] = data;
451                         pcu->check_sum += data;
452                         continue;
453                 }
454
455                 switch (data) {
456                 case IMS_PCU_PROTOCOL_STX:
457                         if (pcu->have_stx)
458                                 dev_warn(pcu->dev,
459                                          "Unexpected STX at byte %d, discarding old data\n",
460                                          pcu->read_pos);
461                         pcu->have_stx = true;
462                         pcu->have_dle = false;
463                         pcu->read_pos = 0;
464                         pcu->check_sum = 0;
465                         break;
466
467                 case IMS_PCU_PROTOCOL_DLE:
468                         pcu->have_dle = true;
469                         break;
470
471                 case IMS_PCU_PROTOCOL_ETX:
472                         if (pcu->read_pos < IMS_PCU_MIN_PACKET_LEN) {
473                                 dev_warn(pcu->dev,
474                                          "Short packet received (%d bytes), ignoring\n",
475                                          pcu->read_pos);
476                         } else if (pcu->check_sum != 0) {
477                                 dev_warn(pcu->dev,
478                                          "Invalid checksum in packet (%d bytes), ignoring\n",
479                                          pcu->read_pos);
480                         } else {
481                                 ims_pcu_handle_response(pcu);
482                         }
483
484                         pcu->have_stx = false;
485                         pcu->have_dle = false;
486                         pcu->read_pos = 0;
487                         break;
488
489                 default:
490                         pcu->read_buf[pcu->read_pos++] = data;
491                         pcu->check_sum += data;
492                         break;
493                 }
494         }
495 }
496
497 static bool ims_pcu_byte_needs_escape(u8 byte)
498 {
499         return byte == IMS_PCU_PROTOCOL_STX ||
500                byte == IMS_PCU_PROTOCOL_ETX ||
501                byte == IMS_PCU_PROTOCOL_DLE;
502 }
503
504 static int ims_pcu_send_cmd_chunk(struct ims_pcu *pcu,
505                                   u8 command, int chunk, int len)
506 {
507         int error;
508
509         error = usb_bulk_msg(pcu->udev,
510                              usb_sndbulkpipe(pcu->udev,
511                                              pcu->ep_out->bEndpointAddress),
512                              pcu->urb_out_buf, len,
513                              NULL, IMS_PCU_CMD_WRITE_TIMEOUT);
514         if (error < 0) {
515                 dev_dbg(pcu->dev,
516                         "Sending 0x%02x command failed at chunk %d: %d\n",
517                         command, chunk, error);
518                 return error;
519         }
520
521         return 0;
522 }
523
524 static int ims_pcu_send_command(struct ims_pcu *pcu,
525                                 u8 command, const u8 *data, int len)
526 {
527         int count = 0;
528         int chunk = 0;
529         int delta;
530         int i;
531         int error;
532         u8 csum = 0;
533         u8 ack_id;
534
535         pcu->urb_out_buf[count++] = IMS_PCU_PROTOCOL_STX;
536
537         /* We know the command need not be escaped */
538         pcu->urb_out_buf[count++] = command;
539         csum += command;
540
541         ack_id = pcu->ack_id++;
542         if (ack_id == 0xff)
543                 ack_id = pcu->ack_id++;
544
545         if (ims_pcu_byte_needs_escape(ack_id))
546                 pcu->urb_out_buf[count++] = IMS_PCU_PROTOCOL_DLE;
547
548         pcu->urb_out_buf[count++] = ack_id;
549         csum += ack_id;
550
551         for (i = 0; i < len; i++) {
552
553                 delta = ims_pcu_byte_needs_escape(data[i]) ? 2 : 1;
554                 if (count + delta >= pcu->max_out_size) {
555                         error = ims_pcu_send_cmd_chunk(pcu, command,
556                                                        ++chunk, count);
557                         if (error)
558                                 return error;
559
560                         count = 0;
561                 }
562
563                 if (delta == 2)
564                         pcu->urb_out_buf[count++] = IMS_PCU_PROTOCOL_DLE;
565
566                 pcu->urb_out_buf[count++] = data[i];
567                 csum += data[i];
568         }
569
570         csum = 1 + ~csum;
571
572         delta = ims_pcu_byte_needs_escape(csum) ? 3 : 2;
573         if (count + delta >= pcu->max_out_size) {
574                 error = ims_pcu_send_cmd_chunk(pcu, command, ++chunk, count);
575                 if (error)
576                         return error;
577
578                 count = 0;
579         }
580
581         if (delta == 3)
582                 pcu->urb_out_buf[count++] = IMS_PCU_PROTOCOL_DLE;
583
584         pcu->urb_out_buf[count++] = csum;
585         pcu->urb_out_buf[count++] = IMS_PCU_PROTOCOL_ETX;
586
587         return ims_pcu_send_cmd_chunk(pcu, command, ++chunk, count);
588 }
589
590 static int __ims_pcu_execute_command(struct ims_pcu *pcu,
591                                      u8 command, const void *data, size_t len,
592                                      u8 expected_response, int response_time)
593 {
594         int error;
595
596         pcu->expected_response = expected_response;
597         init_completion(&pcu->cmd_done);
598
599         error = ims_pcu_send_command(pcu, command, data, len);
600         if (error)
601                 return error;
602
603         if (expected_response &&
604             !wait_for_completion_timeout(&pcu->cmd_done,
605                                          msecs_to_jiffies(response_time))) {
606                 dev_dbg(pcu->dev, "Command 0x%02x timed out\n", command);
607                 return -ETIMEDOUT;
608         }
609
610         return 0;
611 }
612
613 #define ims_pcu_execute_command(pcu, code, data, len)                   \
614         __ims_pcu_execute_command(pcu,                                  \
615                                   IMS_PCU_CMD_##code, data, len,        \
616                                   IMS_PCU_RSP_##code,                   \
617                                   IMS_PCU_CMD_RESPONSE_TIMEOUT)
618
619 #define ims_pcu_execute_query(pcu, code)                                \
620         ims_pcu_execute_command(pcu, code, NULL, 0)
621
622 /* Bootloader commands */
623 #define IMS_PCU_BL_CMD_QUERY_DEVICE     0xa1
624 #define IMS_PCU_BL_CMD_UNLOCK_CONFIG    0xa2
625 #define IMS_PCU_BL_CMD_ERASE_APP        0xa3
626 #define IMS_PCU_BL_CMD_PROGRAM_DEVICE   0xa4
627 #define IMS_PCU_BL_CMD_PROGRAM_COMPLETE 0xa5
628 #define IMS_PCU_BL_CMD_READ_APP         0xa6
629 #define IMS_PCU_BL_CMD_RESET_DEVICE     0xa7
630 #define IMS_PCU_BL_CMD_LAUNCH_APP       0xa8
631
632 /* Bootloader commands */
633 #define IMS_PCU_BL_RSP_QUERY_DEVICE     0xc1
634 #define IMS_PCU_BL_RSP_UNLOCK_CONFIG    0xc2
635 #define IMS_PCU_BL_RSP_ERASE_APP        0xc3
636 #define IMS_PCU_BL_RSP_PROGRAM_DEVICE   0xc4
637 #define IMS_PCU_BL_RSP_PROGRAM_COMPLETE 0xc5
638 #define IMS_PCU_BL_RSP_READ_APP         0xc6
639 #define IMS_PCU_BL_RSP_RESET_DEVICE     0       /* originally 0xa7 */
640 #define IMS_PCU_BL_RSP_LAUNCH_APP       0       /* originally 0xa8 */
641
642 #define IMS_PCU_BL_DATA_OFFSET          3
643
644 static int __ims_pcu_execute_bl_command(struct ims_pcu *pcu,
645                                         u8 command, const void *data, size_t len,
646                                         u8 expected_response, int response_time)
647 {
648         int error;
649
650         pcu->cmd_buf[0] = command;
651         if (data)
652                 memcpy(&pcu->cmd_buf[1], data, len);
653
654         error = __ims_pcu_execute_command(pcu,
655                                 IMS_PCU_CMD_BOOTLOADER, pcu->cmd_buf, len + 1,
656                                 expected_response ? IMS_PCU_RSP_BOOTLOADER : 0,
657                                 response_time);
658         if (error) {
659                 dev_err(pcu->dev,
660                         "Failure when sending 0x%02x command to bootloader, error: %d\n",
661                         pcu->cmd_buf[0], error);
662                 return error;
663         }
664
665         if (expected_response && pcu->cmd_buf[2] != expected_response) {
666                 dev_err(pcu->dev,
667                         "Unexpected response from bootloader: 0x%02x, wanted 0x%02x\n",
668                         pcu->cmd_buf[2], expected_response);
669                 return -EINVAL;
670         }
671
672         return 0;
673 }
674
675 #define ims_pcu_execute_bl_command(pcu, code, data, len, timeout)       \
676         __ims_pcu_execute_bl_command(pcu,                               \
677                                      IMS_PCU_BL_CMD_##code, data, len,  \
678                                      IMS_PCU_BL_RSP_##code, timeout)    \
679
680 #define IMS_PCU_INFO_PART_OFFSET        2
681 #define IMS_PCU_INFO_DOM_OFFSET         17
682 #define IMS_PCU_INFO_SERIAL_OFFSET      25
683
684 #define IMS_PCU_SET_INFO_SIZE           31
685
686 static int ims_pcu_get_info(struct ims_pcu *pcu)
687 {
688         int error;
689
690         error = ims_pcu_execute_query(pcu, GET_INFO);
691         if (error) {
692                 dev_err(pcu->dev,
693                         "GET_INFO command failed, error: %d\n", error);
694                 return error;
695         }
696
697         memcpy(pcu->part_number,
698                &pcu->cmd_buf[IMS_PCU_INFO_PART_OFFSET],
699                sizeof(pcu->part_number));
700         memcpy(pcu->date_of_manufacturing,
701                &pcu->cmd_buf[IMS_PCU_INFO_DOM_OFFSET],
702                sizeof(pcu->date_of_manufacturing));
703         memcpy(pcu->serial_number,
704                &pcu->cmd_buf[IMS_PCU_INFO_SERIAL_OFFSET],
705                sizeof(pcu->serial_number));
706
707         return 0;
708 }
709
710 static int ims_pcu_set_info(struct ims_pcu *pcu)
711 {
712         int error;
713
714         memcpy(&pcu->cmd_buf[IMS_PCU_INFO_PART_OFFSET],
715                pcu->part_number, sizeof(pcu->part_number));
716         memcpy(&pcu->cmd_buf[IMS_PCU_INFO_DOM_OFFSET],
717                pcu->date_of_manufacturing, sizeof(pcu->date_of_manufacturing));
718         memcpy(&pcu->cmd_buf[IMS_PCU_INFO_SERIAL_OFFSET],
719                pcu->serial_number, sizeof(pcu->serial_number));
720
721         error = ims_pcu_execute_command(pcu, SET_INFO,
722                                         &pcu->cmd_buf[IMS_PCU_DATA_OFFSET],
723                                         IMS_PCU_SET_INFO_SIZE);
724         if (error) {
725                 dev_err(pcu->dev,
726                         "Failed to update device information, error: %d\n",
727                         error);
728                 return error;
729         }
730
731         return 0;
732 }
733
734 static int ims_pcu_switch_to_bootloader(struct ims_pcu *pcu)
735 {
736         int error;
737
738         /* Execute jump to the bootoloader */
739         error = ims_pcu_execute_command(pcu, JUMP_TO_BTLDR, NULL, 0);
740         if (error) {
741                 dev_err(pcu->dev,
742                         "Failure when sending JUMP TO BOOLTLOADER command, error: %d\n",
743                         error);
744                 return error;
745         }
746
747         return 0;
748 }
749
750 /*********************************************************************
751  *             Firmware Update handling                              *
752  *********************************************************************/
753
754 #define IMS_PCU_FIRMWARE_NAME   "imspcu.fw"
755
756 struct ims_pcu_flash_fmt {
757         __le32 addr;
758         u8 len;
759         u8 data[];
760 };
761
762 static unsigned int ims_pcu_count_fw_records(const struct firmware *fw)
763 {
764         const struct ihex_binrec *rec = (const struct ihex_binrec *)fw->data;
765         unsigned int count = 0;
766
767         while (rec) {
768                 count++;
769                 rec = ihex_next_binrec(rec);
770         }
771
772         return count;
773 }
774
775 static int ims_pcu_verify_block(struct ims_pcu *pcu,
776                                 u32 addr, u8 len, const u8 *data)
777 {
778         struct ims_pcu_flash_fmt *fragment;
779         int error;
780
781         fragment = (void *)&pcu->cmd_buf[1];
782         put_unaligned_le32(addr, &fragment->addr);
783         fragment->len = len;
784
785         error = ims_pcu_execute_bl_command(pcu, READ_APP, NULL, 5,
786                                         IMS_PCU_CMD_RESPONSE_TIMEOUT);
787         if (error) {
788                 dev_err(pcu->dev,
789                         "Failed to retrieve block at 0x%08x, len %d, error: %d\n",
790                         addr, len, error);
791                 return error;
792         }
793
794         fragment = (void *)&pcu->cmd_buf[IMS_PCU_BL_DATA_OFFSET];
795         if (get_unaligned_le32(&fragment->addr) != addr ||
796             fragment->len != len) {
797                 dev_err(pcu->dev,
798                         "Wrong block when retrieving 0x%08x (0x%08x), len %d (%d)\n",
799                         addr, get_unaligned_le32(&fragment->addr),
800                         len, fragment->len);
801                 return -EINVAL;
802         }
803
804         if (memcmp(fragment->data, data, len)) {
805                 dev_err(pcu->dev,
806                         "Mismatch in block at 0x%08x, len %d\n",
807                         addr, len);
808                 return -EINVAL;
809         }
810
811         return 0;
812 }
813
814 static int ims_pcu_flash_firmware(struct ims_pcu *pcu,
815                                   const struct firmware *fw,
816                                   unsigned int n_fw_records)
817 {
818         const struct ihex_binrec *rec = (const struct ihex_binrec *)fw->data;
819         struct ims_pcu_flash_fmt *fragment;
820         unsigned int count = 0;
821         u32 addr;
822         u8 len;
823         int error;
824
825         error = ims_pcu_execute_bl_command(pcu, ERASE_APP, NULL, 0, 2000);
826         if (error) {
827                 dev_err(pcu->dev,
828                         "Failed to erase application image, error: %d\n",
829                         error);
830                 return error;
831         }
832
833         while (rec) {
834                 /*
835                  * The firmware format is messed up for some reason.
836                  * The address twice that of what is needed for some
837                  * reason and we end up overwriting half of the data
838                  * with the next record.
839                  */
840                 addr = be32_to_cpu(rec->addr) / 2;
841                 len = be16_to_cpu(rec->len);
842
843                 fragment = (void *)&pcu->cmd_buf[1];
844                 put_unaligned_le32(addr, &fragment->addr);
845                 fragment->len = len;
846                 memcpy(fragment->data, rec->data, len);
847
848                 error = ims_pcu_execute_bl_command(pcu, PROGRAM_DEVICE,
849                                                 NULL, len + 5,
850                                                 IMS_PCU_CMD_RESPONSE_TIMEOUT);
851                 if (error) {
852                         dev_err(pcu->dev,
853                                 "Failed to write block at 0x%08x, len %d, error: %d\n",
854                                 addr, len, error);
855                         return error;
856                 }
857
858                 if (addr >= pcu->fw_start_addr && addr < pcu->fw_end_addr) {
859                         error = ims_pcu_verify_block(pcu, addr, len, rec->data);
860                         if (error)
861                                 return error;
862                 }
863
864                 count++;
865                 pcu->update_firmware_status = (count * 100) / n_fw_records;
866
867                 rec = ihex_next_binrec(rec);
868         }
869
870         error = ims_pcu_execute_bl_command(pcu, PROGRAM_COMPLETE,
871                                             NULL, 0, 2000);
872         if (error)
873                 dev_err(pcu->dev,
874                         "Failed to send PROGRAM_COMPLETE, error: %d\n",
875                         error);
876
877         return 0;
878 }
879
880 static int ims_pcu_handle_firmware_update(struct ims_pcu *pcu,
881                                           const struct firmware *fw)
882 {
883         unsigned int n_fw_records;
884         int retval;
885
886         dev_info(pcu->dev, "Updating firmware %s, size: %zu\n",
887                  IMS_PCU_FIRMWARE_NAME, fw->size);
888
889         n_fw_records = ims_pcu_count_fw_records(fw);
890
891         retval = ims_pcu_flash_firmware(pcu, fw, n_fw_records);
892         if (retval)
893                 goto out;
894
895         retval = ims_pcu_execute_bl_command(pcu, LAUNCH_APP, NULL, 0, 0);
896         if (retval)
897                 dev_err(pcu->dev,
898                         "Failed to start application image, error: %d\n",
899                         retval);
900
901 out:
902         pcu->update_firmware_status = retval;
903         sysfs_notify(&pcu->dev->kobj, NULL, "update_firmware_status");
904         return retval;
905 }
906
907 static void ims_pcu_process_async_firmware(const struct firmware *fw,
908                                            void *context)
909 {
910         struct ims_pcu *pcu = context;
911         int error;
912
913         if (!fw) {
914                 dev_err(pcu->dev, "Failed to get firmware %s\n",
915                         IMS_PCU_FIRMWARE_NAME);
916                 goto out;
917         }
918
919         error = ihex_validate_fw(fw);
920         if (error) {
921                 dev_err(pcu->dev, "Firmware %s is invalid\n",
922                         IMS_PCU_FIRMWARE_NAME);
923                 goto out;
924         }
925
926         mutex_lock(&pcu->cmd_mutex);
927         ims_pcu_handle_firmware_update(pcu, fw);
928         mutex_unlock(&pcu->cmd_mutex);
929
930         release_firmware(fw);
931
932 out:
933         complete(&pcu->async_firmware_done);
934 }
935
936 /*********************************************************************
937  *             Backlight LED device support                          *
938  *********************************************************************/
939
940 #define IMS_PCU_MAX_BRIGHTNESS          31998
941
942 static void ims_pcu_backlight_work(struct work_struct *work)
943 {
944         struct ims_pcu_backlight *backlight =
945                         container_of(work, struct ims_pcu_backlight, work);
946         struct ims_pcu *pcu =
947                         container_of(backlight, struct ims_pcu, backlight);
948         int desired_brightness = backlight->desired_brightness;
949         __le16 br_val = cpu_to_le16(desired_brightness);
950         int error;
951
952         mutex_lock(&pcu->cmd_mutex);
953
954         error = ims_pcu_execute_command(pcu, SET_BRIGHTNESS,
955                                         &br_val, sizeof(br_val));
956         if (error && error != -ENODEV)
957                 dev_warn(pcu->dev,
958                          "Failed to set desired brightness %u, error: %d\n",
959                          desired_brightness, error);
960
961         mutex_unlock(&pcu->cmd_mutex);
962 }
963
964 static void ims_pcu_backlight_set_brightness(struct led_classdev *cdev,
965                                              enum led_brightness value)
966 {
967         struct ims_pcu_backlight *backlight =
968                         container_of(cdev, struct ims_pcu_backlight, cdev);
969
970         backlight->desired_brightness = value;
971         schedule_work(&backlight->work);
972 }
973
974 static enum led_brightness
975 ims_pcu_backlight_get_brightness(struct led_classdev *cdev)
976 {
977         struct ims_pcu_backlight *backlight =
978                         container_of(cdev, struct ims_pcu_backlight, cdev);
979         struct ims_pcu *pcu =
980                         container_of(backlight, struct ims_pcu, backlight);
981         int brightness;
982         int error;
983
984         mutex_lock(&pcu->cmd_mutex);
985
986         error = ims_pcu_execute_query(pcu, GET_BRIGHTNESS);
987         if (error) {
988                 dev_warn(pcu->dev,
989                          "Failed to get current brightness, error: %d\n",
990                          error);
991                 /* Assume the LED is OFF */
992                 brightness = LED_OFF;
993         } else {
994                 brightness =
995                         get_unaligned_le16(&pcu->cmd_buf[IMS_PCU_DATA_OFFSET]);
996         }
997
998         mutex_unlock(&pcu->cmd_mutex);
999
1000         return brightness;
1001 }
1002
1003 static int ims_pcu_setup_backlight(struct ims_pcu *pcu)
1004 {
1005         struct ims_pcu_backlight *backlight = &pcu->backlight;
1006         int error;
1007
1008         INIT_WORK(&backlight->work, ims_pcu_backlight_work);
1009         snprintf(backlight->name, sizeof(backlight->name),
1010                  "pcu%d::kbd_backlight", pcu->device_no);
1011
1012         backlight->cdev.name = backlight->name;
1013         backlight->cdev.max_brightness = IMS_PCU_MAX_BRIGHTNESS;
1014         backlight->cdev.brightness_get = ims_pcu_backlight_get_brightness;
1015         backlight->cdev.brightness_set = ims_pcu_backlight_set_brightness;
1016
1017         error = led_classdev_register(pcu->dev, &backlight->cdev);
1018         if (error) {
1019                 dev_err(pcu->dev,
1020                         "Failed to register backlight LED device, error: %d\n",
1021                         error);
1022                 return error;
1023         }
1024
1025         return 0;
1026 }
1027
1028 static void ims_pcu_destroy_backlight(struct ims_pcu *pcu)
1029 {
1030         struct ims_pcu_backlight *backlight = &pcu->backlight;
1031
1032         led_classdev_unregister(&backlight->cdev);
1033         cancel_work_sync(&backlight->work);
1034 }
1035
1036
1037 /*********************************************************************
1038  *             Sysfs attributes handling                             *
1039  *********************************************************************/
1040
1041 struct ims_pcu_attribute {
1042         struct device_attribute dattr;
1043         size_t field_offset;
1044         int field_length;
1045 };
1046
1047 static ssize_t ims_pcu_attribute_show(struct device *dev,
1048                                       struct device_attribute *dattr,
1049                                       char *buf)
1050 {
1051         struct usb_interface *intf = to_usb_interface(dev);
1052         struct ims_pcu *pcu = usb_get_intfdata(intf);
1053         struct ims_pcu_attribute *attr =
1054                         container_of(dattr, struct ims_pcu_attribute, dattr);
1055         char *field = (char *)pcu + attr->field_offset;
1056
1057         return scnprintf(buf, PAGE_SIZE, "%.*s\n", attr->field_length, field);
1058 }
1059
1060 static ssize_t ims_pcu_attribute_store(struct device *dev,
1061                                        struct device_attribute *dattr,
1062                                        const char *buf, size_t count)
1063 {
1064
1065         struct usb_interface *intf = to_usb_interface(dev);
1066         struct ims_pcu *pcu = usb_get_intfdata(intf);
1067         struct ims_pcu_attribute *attr =
1068                         container_of(dattr, struct ims_pcu_attribute, dattr);
1069         char *field = (char *)pcu + attr->field_offset;
1070         size_t data_len;
1071         int error;
1072
1073         if (count > attr->field_length)
1074                 return -EINVAL;
1075
1076         data_len = strnlen(buf, attr->field_length);
1077         if (data_len > attr->field_length)
1078                 return -EINVAL;
1079
1080         error = mutex_lock_interruptible(&pcu->cmd_mutex);
1081         if (error)
1082                 return error;
1083
1084         memset(field, 0, attr->field_length);
1085         memcpy(field, buf, data_len);
1086
1087         error = ims_pcu_set_info(pcu);
1088
1089         /*
1090          * Even if update failed, let's fetch the info again as we just
1091          * clobbered one of the fields.
1092          */
1093         ims_pcu_get_info(pcu);
1094
1095         mutex_unlock(&pcu->cmd_mutex);
1096
1097         return error < 0 ? error : count;
1098 }
1099
1100 #define IMS_PCU_ATTR(_field, _mode)                                     \
1101 struct ims_pcu_attribute ims_pcu_attr_##_field = {                      \
1102         .dattr = __ATTR(_field, _mode,                                  \
1103                         ims_pcu_attribute_show,                         \
1104                         ims_pcu_attribute_store),                       \
1105         .field_offset = offsetof(struct ims_pcu, _field),               \
1106         .field_length = sizeof(((struct ims_pcu *)NULL)->_field),       \
1107 }
1108
1109 #define IMS_PCU_RO_ATTR(_field)                                         \
1110                 IMS_PCU_ATTR(_field, S_IRUGO)
1111 #define IMS_PCU_RW_ATTR(_field)                                         \
1112                 IMS_PCU_ATTR(_field, S_IRUGO | S_IWUSR)
1113
1114 static IMS_PCU_RW_ATTR(part_number);
1115 static IMS_PCU_RW_ATTR(serial_number);
1116 static IMS_PCU_RW_ATTR(date_of_manufacturing);
1117
1118 static IMS_PCU_RO_ATTR(fw_version);
1119 static IMS_PCU_RO_ATTR(bl_version);
1120 static IMS_PCU_RO_ATTR(reset_reason);
1121
1122 static ssize_t ims_pcu_reset_device(struct device *dev,
1123                                     struct device_attribute *dattr,
1124                                     const char *buf, size_t count)
1125 {
1126         static const u8 reset_byte = 1;
1127         struct usb_interface *intf = to_usb_interface(dev);
1128         struct ims_pcu *pcu = usb_get_intfdata(intf);
1129         int value;
1130         int error;
1131
1132         error = kstrtoint(buf, 0, &value);
1133         if (error)
1134                 return error;
1135
1136         if (value != 1)
1137                 return -EINVAL;
1138
1139         dev_info(pcu->dev, "Attempting to reset device\n");
1140
1141         error = ims_pcu_execute_command(pcu, PCU_RESET, &reset_byte, 1);
1142         if (error) {
1143                 dev_info(pcu->dev,
1144                          "Failed to reset device, error: %d\n",
1145                          error);
1146                 return error;
1147         }
1148
1149         return count;
1150 }
1151
1152 static DEVICE_ATTR(reset_device, S_IWUSR, NULL, ims_pcu_reset_device);
1153
1154 static ssize_t ims_pcu_update_firmware_store(struct device *dev,
1155                                              struct device_attribute *dattr,
1156                                              const char *buf, size_t count)
1157 {
1158         struct usb_interface *intf = to_usb_interface(dev);
1159         struct ims_pcu *pcu = usb_get_intfdata(intf);
1160         const struct firmware *fw = NULL;
1161         int value;
1162         int error;
1163
1164         error = kstrtoint(buf, 0, &value);
1165         if (error)
1166                 return error;
1167
1168         if (value != 1)
1169                 return -EINVAL;
1170
1171         error = mutex_lock_interruptible(&pcu->cmd_mutex);
1172         if (error)
1173                 return error;
1174
1175         error = request_ihex_firmware(&fw, IMS_PCU_FIRMWARE_NAME, pcu->dev);
1176         if (error) {
1177                 dev_err(pcu->dev, "Failed to request firmware %s, error: %d\n",
1178                         IMS_PCU_FIRMWARE_NAME, error);
1179                 goto out;
1180         }
1181
1182         /*
1183          * If we are already in bootloader mode we can proceed with
1184          * flashing the firmware.
1185          *
1186          * If we are in application mode, then we need to switch into
1187          * bootloader mode, which will cause the device to disconnect
1188          * and reconnect as different device.
1189          */
1190         if (pcu->bootloader_mode)
1191                 error = ims_pcu_handle_firmware_update(pcu, fw);
1192         else
1193                 error = ims_pcu_switch_to_bootloader(pcu);
1194
1195         release_firmware(fw);
1196
1197 out:
1198         mutex_unlock(&pcu->cmd_mutex);
1199         return error ?: count;
1200 }
1201
1202 static DEVICE_ATTR(update_firmware, S_IWUSR,
1203                    NULL, ims_pcu_update_firmware_store);
1204
1205 static ssize_t
1206 ims_pcu_update_firmware_status_show(struct device *dev,
1207                                     struct device_attribute *dattr,
1208                                     char *buf)
1209 {
1210         struct usb_interface *intf = to_usb_interface(dev);
1211         struct ims_pcu *pcu = usb_get_intfdata(intf);
1212
1213         return scnprintf(buf, PAGE_SIZE, "%d\n", pcu->update_firmware_status);
1214 }
1215
1216 static DEVICE_ATTR(update_firmware_status, S_IRUGO,
1217                    ims_pcu_update_firmware_status_show, NULL);
1218
1219 static struct attribute *ims_pcu_attrs[] = {
1220         &ims_pcu_attr_part_number.dattr.attr,
1221         &ims_pcu_attr_serial_number.dattr.attr,
1222         &ims_pcu_attr_date_of_manufacturing.dattr.attr,
1223         &ims_pcu_attr_fw_version.dattr.attr,
1224         &ims_pcu_attr_bl_version.dattr.attr,
1225         &ims_pcu_attr_reset_reason.dattr.attr,
1226         &dev_attr_reset_device.attr,
1227         &dev_attr_update_firmware.attr,
1228         &dev_attr_update_firmware_status.attr,
1229         NULL
1230 };
1231
1232 static umode_t ims_pcu_is_attr_visible(struct kobject *kobj,
1233                                        struct attribute *attr, int n)
1234 {
1235         struct device *dev = container_of(kobj, struct device, kobj);
1236         struct usb_interface *intf = to_usb_interface(dev);
1237         struct ims_pcu *pcu = usb_get_intfdata(intf);
1238         umode_t mode = attr->mode;
1239
1240         if (pcu->bootloader_mode) {
1241                 if (attr != &dev_attr_update_firmware_status.attr &&
1242                     attr != &dev_attr_update_firmware.attr &&
1243                     attr != &dev_attr_reset_device.attr) {
1244                         mode = 0;
1245                 }
1246         } else {
1247                 if (attr == &dev_attr_update_firmware_status.attr)
1248                         mode = 0;
1249         }
1250
1251         return mode;
1252 }
1253
1254 static struct attribute_group ims_pcu_attr_group = {
1255         .is_visible     = ims_pcu_is_attr_visible,
1256         .attrs          = ims_pcu_attrs,
1257 };
1258
1259 static void ims_pcu_irq(struct urb *urb)
1260 {
1261         struct ims_pcu *pcu = urb->context;
1262         int retval, status;
1263
1264         status = urb->status;
1265
1266         switch (status) {
1267         case 0:
1268                 /* success */
1269                 break;
1270         case -ECONNRESET:
1271         case -ENOENT:
1272         case -ESHUTDOWN:
1273                 /* this urb is terminated, clean up */
1274                 dev_dbg(pcu->dev, "%s - urb shutting down with status: %d\n",
1275                         __func__, status);
1276                 return;
1277         default:
1278                 dev_dbg(pcu->dev, "%s - nonzero urb status received: %d\n",
1279                         __func__, status);
1280                 goto exit;
1281         }
1282
1283         dev_dbg(pcu->dev, "%s: received %d: %*ph\n", __func__,
1284                 urb->actual_length, urb->actual_length, pcu->urb_in_buf);
1285
1286         if (urb == pcu->urb_in)
1287                 ims_pcu_process_data(pcu, urb);
1288
1289 exit:
1290         retval = usb_submit_urb(urb, GFP_ATOMIC);
1291         if (retval && retval != -ENODEV)
1292                 dev_err(pcu->dev, "%s - usb_submit_urb failed with result %d\n",
1293                         __func__, retval);
1294 }
1295
1296 static int ims_pcu_buffers_alloc(struct ims_pcu *pcu)
1297 {
1298         int error;
1299
1300         pcu->urb_in_buf = usb_alloc_coherent(pcu->udev, pcu->max_in_size,
1301                                              GFP_KERNEL, &pcu->read_dma);
1302         if (!pcu->urb_in_buf) {
1303                 dev_err(pcu->dev,
1304                         "Failed to allocate memory for read buffer\n");
1305                 return -ENOMEM;
1306         }
1307
1308         pcu->urb_in = usb_alloc_urb(0, GFP_KERNEL);
1309         if (!pcu->urb_in) {
1310                 dev_err(pcu->dev, "Failed to allocate input URB\n");
1311                 error = -ENOMEM;
1312                 goto err_free_urb_in_buf;
1313         }
1314
1315         pcu->urb_in->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1316         pcu->urb_in->transfer_dma = pcu->read_dma;
1317
1318         usb_fill_bulk_urb(pcu->urb_in, pcu->udev,
1319                           usb_rcvbulkpipe(pcu->udev,
1320                                           pcu->ep_in->bEndpointAddress),
1321                           pcu->urb_in_buf, pcu->max_in_size,
1322                           ims_pcu_irq, pcu);
1323
1324         /*
1325          * We are using usb_bulk_msg() for sending so there is no point
1326          * in allocating memory with usb_alloc_coherent().
1327          */
1328         pcu->urb_out_buf = kmalloc(pcu->max_out_size, GFP_KERNEL);
1329         if (!pcu->urb_out_buf) {
1330                 dev_err(pcu->dev, "Failed to allocate memory for write buffer\n");
1331                 error = -ENOMEM;
1332                 goto err_free_in_urb;
1333         }
1334
1335         pcu->urb_ctrl_buf = usb_alloc_coherent(pcu->udev, pcu->max_ctrl_size,
1336                                                GFP_KERNEL, &pcu->ctrl_dma);
1337         if (!pcu->urb_ctrl_buf) {
1338                 dev_err(pcu->dev,
1339                         "Failed to allocate memory for read buffer\n");
1340                 goto err_free_urb_out_buf;
1341         }
1342
1343         pcu->urb_ctrl = usb_alloc_urb(0, GFP_KERNEL);
1344         if (!pcu->urb_ctrl) {
1345                 dev_err(pcu->dev, "Failed to allocate input URB\n");
1346                 error = -ENOMEM;
1347                 goto err_free_urb_ctrl_buf;
1348         }
1349
1350         pcu->urb_ctrl->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
1351         pcu->urb_ctrl->transfer_dma = pcu->ctrl_dma;
1352
1353         usb_fill_int_urb(pcu->urb_ctrl, pcu->udev,
1354                           usb_rcvintpipe(pcu->udev,
1355                                          pcu->ep_ctrl->bEndpointAddress),
1356                           pcu->urb_ctrl_buf, pcu->max_ctrl_size,
1357                           ims_pcu_irq, pcu, pcu->ep_ctrl->bInterval);
1358
1359         return 0;
1360
1361 err_free_urb_ctrl_buf:
1362         usb_free_coherent(pcu->udev, pcu->max_ctrl_size,
1363                           pcu->urb_ctrl_buf, pcu->ctrl_dma);
1364 err_free_urb_out_buf:
1365         kfree(pcu->urb_out_buf);
1366 err_free_in_urb:
1367         usb_free_urb(pcu->urb_in);
1368 err_free_urb_in_buf:
1369         usb_free_coherent(pcu->udev, pcu->max_in_size,
1370                           pcu->urb_in_buf, pcu->read_dma);
1371         return error;
1372 }
1373
1374 static void ims_pcu_buffers_free(struct ims_pcu *pcu)
1375 {
1376         usb_kill_urb(pcu->urb_in);
1377         usb_free_urb(pcu->urb_in);
1378
1379         usb_free_coherent(pcu->udev, pcu->max_out_size,
1380                           pcu->urb_in_buf, pcu->read_dma);
1381
1382         kfree(pcu->urb_out_buf);
1383
1384         usb_kill_urb(pcu->urb_ctrl);
1385         usb_free_urb(pcu->urb_ctrl);
1386
1387         usb_free_coherent(pcu->udev, pcu->max_ctrl_size,
1388                           pcu->urb_ctrl_buf, pcu->ctrl_dma);
1389 }
1390
1391 static const struct usb_cdc_union_desc *
1392 ims_pcu_get_cdc_union_desc(struct usb_interface *intf)
1393 {
1394         const void *buf = intf->altsetting->extra;
1395         size_t buflen = intf->altsetting->extralen;
1396         struct usb_cdc_union_desc *union_desc;
1397
1398         if (!buf) {
1399                 dev_err(&intf->dev, "Missing descriptor data\n");
1400                 return NULL;
1401         }
1402
1403         if (!buflen) {
1404                 dev_err(&intf->dev, "Zero length descriptor\n");
1405                 return NULL;
1406         }
1407
1408         while (buflen > 0) {
1409                 union_desc = (struct usb_cdc_union_desc *)buf;
1410
1411                 if (union_desc->bDescriptorType == USB_DT_CS_INTERFACE &&
1412                     union_desc->bDescriptorSubType == USB_CDC_UNION_TYPE) {
1413                         dev_dbg(&intf->dev, "Found union header\n");
1414                         return union_desc;
1415                 }
1416
1417                 buflen -= union_desc->bLength;
1418                 buf += union_desc->bLength;
1419         }
1420
1421         dev_err(&intf->dev, "Missing CDC union descriptor\n");
1422         return NULL;
1423 }
1424
1425 static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pcu)
1426 {
1427         const struct usb_cdc_union_desc *union_desc;
1428         struct usb_host_interface *alt;
1429
1430         union_desc = ims_pcu_get_cdc_union_desc(intf);
1431         if (!union_desc)
1432                 return -EINVAL;
1433
1434         pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev,
1435                                          union_desc->bMasterInterface0);
1436
1437         alt = pcu->ctrl_intf->cur_altsetting;
1438         pcu->ep_ctrl = &alt->endpoint[0].desc;
1439         pcu->max_ctrl_size = usb_endpoint_maxp(pcu->ep_ctrl);
1440
1441         pcu->data_intf = usb_ifnum_to_if(pcu->udev,
1442                                          union_desc->bSlaveInterface0);
1443
1444         alt = pcu->data_intf->cur_altsetting;
1445         if (alt->desc.bNumEndpoints != 2) {
1446                 dev_err(pcu->dev,
1447                         "Incorrect number of endpoints on data interface (%d)\n",
1448                         alt->desc.bNumEndpoints);
1449                 return -EINVAL;
1450         }
1451
1452         pcu->ep_out = &alt->endpoint[0].desc;
1453         if (!usb_endpoint_is_bulk_out(pcu->ep_out)) {
1454                 dev_err(pcu->dev,
1455                         "First endpoint on data interface is not BULK OUT\n");
1456                 return -EINVAL;
1457         }
1458
1459         pcu->max_out_size = usb_endpoint_maxp(pcu->ep_out);
1460         if (pcu->max_out_size < 8) {
1461                 dev_err(pcu->dev,
1462                         "Max OUT packet size is too small (%zd)\n",
1463                         pcu->max_out_size);
1464                 return -EINVAL;
1465         }
1466
1467         pcu->ep_in = &alt->endpoint[1].desc;
1468         if (!usb_endpoint_is_bulk_in(pcu->ep_in)) {
1469                 dev_err(pcu->dev,
1470                         "Second endpoint on data interface is not BULK IN\n");
1471                 return -EINVAL;
1472         }
1473
1474         pcu->max_in_size = usb_endpoint_maxp(pcu->ep_in);
1475         if (pcu->max_in_size < 8) {
1476                 dev_err(pcu->dev,
1477                         "Max IN packet size is too small (%zd)\n",
1478                         pcu->max_in_size);
1479                 return -EINVAL;
1480         }
1481
1482         return 0;
1483 }
1484
1485 static int ims_pcu_start_io(struct ims_pcu *pcu)
1486 {
1487         int error;
1488
1489         error = usb_submit_urb(pcu->urb_ctrl, GFP_KERNEL);
1490         if (error) {
1491                 dev_err(pcu->dev,
1492                         "Failed to start control IO - usb_submit_urb failed with result: %d\n",
1493                         error);
1494                 return -EIO;
1495         }
1496
1497         error = usb_submit_urb(pcu->urb_in, GFP_KERNEL);
1498         if (error) {
1499                 dev_err(pcu->dev,
1500                         "Failed to start IO - usb_submit_urb failed with result: %d\n",
1501                         error);
1502                 usb_kill_urb(pcu->urb_ctrl);
1503                 return -EIO;
1504         }
1505
1506         return 0;
1507 }
1508
1509 static void ims_pcu_stop_io(struct ims_pcu *pcu)
1510 {
1511         usb_kill_urb(pcu->urb_in);
1512         usb_kill_urb(pcu->urb_ctrl);
1513 }
1514
1515 static int ims_pcu_line_setup(struct ims_pcu *pcu)
1516 {
1517         struct usb_host_interface *interface = pcu->ctrl_intf->cur_altsetting;
1518         struct usb_cdc_line_coding *line = (void *)pcu->cmd_buf;
1519         int error;
1520
1521         memset(line, 0, sizeof(*line));
1522         line->dwDTERate = cpu_to_le32(57600);
1523         line->bDataBits = 8;
1524
1525         error = usb_control_msg(pcu->udev, usb_sndctrlpipe(pcu->udev, 0),
1526                                 USB_CDC_REQ_SET_LINE_CODING,
1527                                 USB_TYPE_CLASS | USB_RECIP_INTERFACE,
1528                                 0, interface->desc.bInterfaceNumber,
1529                                 line, sizeof(struct usb_cdc_line_coding),
1530                                 5000);
1531         if (error < 0) {
1532                 dev_err(pcu->dev, "Failed to set line coding, error: %d\n",
1533                         error);
1534                 return error;
1535         }
1536
1537         error = usb_control_msg(pcu->udev, usb_sndctrlpipe(pcu->udev, 0),
1538                                 USB_CDC_REQ_SET_CONTROL_LINE_STATE,
1539                                 USB_TYPE_CLASS | USB_RECIP_INTERFACE,
1540                                 0x03, interface->desc.bInterfaceNumber,
1541                                 NULL, 0, 5000);
1542         if (error < 0) {
1543                 dev_err(pcu->dev, "Failed to set line state, error: %d\n",
1544                         error);
1545                 return error;
1546         }
1547
1548         return 0;
1549 }
1550
1551 static int ims_pcu_get_device_info(struct ims_pcu *pcu)
1552 {
1553         int error;
1554
1555         error = ims_pcu_get_info(pcu);
1556         if (error)
1557                 return error;
1558
1559         error = ims_pcu_execute_query(pcu, GET_FW_VERSION);
1560         if (error) {
1561                 dev_err(pcu->dev,
1562                         "GET_FW_VERSION command failed, error: %d\n", error);
1563                 return error;
1564         }
1565
1566         snprintf(pcu->fw_version, sizeof(pcu->fw_version),
1567                  "%02d%02d%02d%02d.%c%c",
1568                  pcu->cmd_buf[2], pcu->cmd_buf[3], pcu->cmd_buf[4], pcu->cmd_buf[5],
1569                  pcu->cmd_buf[6], pcu->cmd_buf[7]);
1570
1571         error = ims_pcu_execute_query(pcu, GET_BL_VERSION);
1572         if (error) {
1573                 dev_err(pcu->dev,
1574                         "GET_BL_VERSION command failed, error: %d\n", error);
1575                 return error;
1576         }
1577
1578         snprintf(pcu->bl_version, sizeof(pcu->bl_version),
1579                  "%02d%02d%02d%02d.%c%c",
1580                  pcu->cmd_buf[2], pcu->cmd_buf[3], pcu->cmd_buf[4], pcu->cmd_buf[5],
1581                  pcu->cmd_buf[6], pcu->cmd_buf[7]);
1582
1583         error = ims_pcu_execute_query(pcu, RESET_REASON);
1584         if (error) {
1585                 dev_err(pcu->dev,
1586                         "RESET_REASON command failed, error: %d\n", error);
1587                 return error;
1588         }
1589
1590         snprintf(pcu->reset_reason, sizeof(pcu->reset_reason),
1591                  "%02x", pcu->cmd_buf[IMS_PCU_DATA_OFFSET]);
1592
1593         dev_dbg(pcu->dev,
1594                 "P/N: %s, MD: %s, S/N: %s, FW: %s, BL: %s, RR: %s\n",
1595                 pcu->part_number,
1596                 pcu->date_of_manufacturing,
1597                 pcu->serial_number,
1598                 pcu->fw_version,
1599                 pcu->bl_version,
1600                 pcu->reset_reason);
1601
1602         return 0;
1603 }
1604
1605 static int ims_pcu_identify_type(struct ims_pcu *pcu, u8 *device_id)
1606 {
1607         int error;
1608
1609         error = ims_pcu_execute_query(pcu, GET_DEVICE_ID);
1610         if (error) {
1611                 dev_err(pcu->dev,
1612                         "GET_DEVICE_ID command failed, error: %d\n", error);
1613                 return error;
1614         }
1615
1616         *device_id = pcu->cmd_buf[IMS_PCU_DATA_OFFSET];
1617         dev_dbg(pcu->dev, "Detected device ID: %d\n", *device_id);
1618
1619         return 0;
1620 }
1621
1622 static int ims_pcu_init_application_mode(struct ims_pcu *pcu)
1623 {
1624         static atomic_t device_no = ATOMIC_INIT(0);
1625
1626         const struct ims_pcu_device_info *info;
1627         u8 device_id;
1628         int error;
1629
1630         error = ims_pcu_get_device_info(pcu);
1631         if (error) {
1632                 /* Device does not respond to basic queries, hopeless */
1633                 return error;
1634         }
1635
1636         error = ims_pcu_identify_type(pcu, &device_id);
1637         if (error) {
1638                 dev_err(pcu->dev,
1639                         "Failed to identify device, error: %d\n", error);
1640                 /*
1641                  * Do not signal error, but do not create input nor
1642                  * backlight devices either, let userspace figure this
1643                  * out (flash a new firmware?).
1644                  */
1645                 return 0;
1646         }
1647
1648         if (device_id >= ARRAY_SIZE(ims_pcu_device_info) ||
1649             !ims_pcu_device_info[device_id].keymap) {
1650                 dev_err(pcu->dev, "Device ID %d is not valid\n", device_id);
1651                 /* Same as above, punt to userspace */
1652                 return 0;
1653         }
1654
1655         /* Device appears to be operable, complete initialization */
1656         pcu->device_no = atomic_inc_return(&device_no) - 1;
1657
1658         error = ims_pcu_setup_backlight(pcu);
1659         if (error)
1660                 return error;
1661
1662         info = &ims_pcu_device_info[device_id];
1663         error = ims_pcu_setup_buttons(pcu, info->keymap, info->keymap_len);
1664         if (error)
1665                 goto err_destroy_backlight;
1666
1667         if (info->has_gamepad) {
1668                 error = ims_pcu_setup_gamepad(pcu);
1669                 if (error)
1670                         goto err_destroy_buttons;
1671         }
1672
1673         pcu->setup_complete = true;
1674
1675         return 0;
1676
1677 err_destroy_backlight:
1678         ims_pcu_destroy_backlight(pcu);
1679 err_destroy_buttons:
1680         ims_pcu_destroy_buttons(pcu);
1681         return error;
1682 }
1683
1684 static void ims_pcu_destroy_application_mode(struct ims_pcu *pcu)
1685 {
1686         if (pcu->setup_complete) {
1687                 pcu->setup_complete = false;
1688                 mb(); /* make sure flag setting is not reordered */
1689
1690                 if (pcu->gamepad)
1691                         ims_pcu_destroy_gamepad(pcu);
1692                 ims_pcu_destroy_buttons(pcu);
1693                 ims_pcu_destroy_backlight(pcu);
1694         }
1695 }
1696
1697 static int ims_pcu_init_bootloader_mode(struct ims_pcu *pcu)
1698 {
1699         int error;
1700
1701         error = ims_pcu_execute_bl_command(pcu, QUERY_DEVICE, NULL, 0,
1702                                            IMS_PCU_CMD_RESPONSE_TIMEOUT);
1703         if (error) {
1704                 dev_err(pcu->dev, "Bootloader does not respond, aborting\n");
1705                 return error;
1706         }
1707
1708         pcu->fw_start_addr =
1709                 get_unaligned_le32(&pcu->cmd_buf[IMS_PCU_DATA_OFFSET + 11]);
1710         pcu->fw_end_addr =
1711                 get_unaligned_le32(&pcu->cmd_buf[IMS_PCU_DATA_OFFSET + 15]);
1712
1713         dev_info(pcu->dev,
1714                  "Device is in bootloader mode (addr 0x%08x-0x%08x), requesting firmware\n",
1715                  pcu->fw_start_addr, pcu->fw_end_addr);
1716
1717         error = request_firmware_nowait(THIS_MODULE, true,
1718                                         IMS_PCU_FIRMWARE_NAME,
1719                                         pcu->dev, GFP_KERNEL, pcu,
1720                                         ims_pcu_process_async_firmware);
1721         if (error) {
1722                 /* This error is not fatal, let userspace have another chance */
1723                 complete(&pcu->async_firmware_done);
1724         }
1725
1726         return 0;
1727 }
1728
1729 static void ims_pcu_destroy_bootloader_mode(struct ims_pcu *pcu)
1730 {
1731         /* Make sure our initial firmware request has completed */
1732         wait_for_completion(&pcu->async_firmware_done);
1733 }
1734
1735 #define IMS_PCU_APPLICATION_MODE        0
1736 #define IMS_PCU_BOOTLOADER_MODE         1
1737
1738 static struct usb_driver ims_pcu_driver;
1739
1740 static int ims_pcu_probe(struct usb_interface *intf,
1741                          const struct usb_device_id *id)
1742 {
1743         struct usb_device *udev = interface_to_usbdev(intf);
1744         struct ims_pcu *pcu;
1745         int error;
1746
1747         pcu = kzalloc(sizeof(struct ims_pcu), GFP_KERNEL);
1748         if (!pcu)
1749                 return -ENOMEM;
1750
1751         pcu->dev = &intf->dev;
1752         pcu->udev = udev;
1753         pcu->bootloader_mode = id->driver_info == IMS_PCU_BOOTLOADER_MODE;
1754         mutex_init(&pcu->cmd_mutex);
1755         init_completion(&pcu->cmd_done);
1756         init_completion(&pcu->async_firmware_done);
1757
1758         error = ims_pcu_parse_cdc_data(intf, pcu);
1759         if (error)
1760                 goto err_free_mem;
1761
1762         error = usb_driver_claim_interface(&ims_pcu_driver,
1763                                            pcu->data_intf, pcu);
1764         if (error) {
1765                 dev_err(&intf->dev,
1766                         "Unable to claim corresponding data interface: %d\n",
1767                         error);
1768                 goto err_free_mem;
1769         }
1770
1771         usb_set_intfdata(pcu->ctrl_intf, pcu);
1772         usb_set_intfdata(pcu->data_intf, pcu);
1773
1774         error = ims_pcu_buffers_alloc(pcu);
1775         if (error)
1776                 goto err_unclaim_intf;
1777
1778         error = ims_pcu_start_io(pcu);
1779         if (error)
1780                 goto err_free_buffers;
1781
1782         error = ims_pcu_line_setup(pcu);
1783         if (error)
1784                 goto err_stop_io;
1785
1786         error = sysfs_create_group(&intf->dev.kobj, &ims_pcu_attr_group);
1787         if (error)
1788                 goto err_stop_io;
1789
1790         error = pcu->bootloader_mode ?
1791                         ims_pcu_init_bootloader_mode(pcu) :
1792                         ims_pcu_init_application_mode(pcu);
1793         if (error)
1794                 goto err_remove_sysfs;
1795
1796         return 0;
1797
1798 err_remove_sysfs:
1799         sysfs_remove_group(&intf->dev.kobj, &ims_pcu_attr_group);
1800 err_stop_io:
1801         ims_pcu_stop_io(pcu);
1802 err_free_buffers:
1803         ims_pcu_buffers_free(pcu);
1804 err_unclaim_intf:
1805         usb_driver_release_interface(&ims_pcu_driver, pcu->data_intf);
1806 err_free_mem:
1807         kfree(pcu);
1808         return error;
1809 }
1810
1811 static void ims_pcu_disconnect(struct usb_interface *intf)
1812 {
1813         struct ims_pcu *pcu = usb_get_intfdata(intf);
1814         struct usb_host_interface *alt = intf->cur_altsetting;
1815
1816         usb_set_intfdata(intf, NULL);
1817
1818         /*
1819          * See if we are dealing with control or data interface. The cleanup
1820          * happens when we unbind primary (control) interface.
1821          */
1822         if (alt->desc.bInterfaceClass != USB_CLASS_COMM)
1823                 return;
1824
1825         sysfs_remove_group(&intf->dev.kobj, &ims_pcu_attr_group);
1826
1827         ims_pcu_stop_io(pcu);
1828
1829         if (pcu->bootloader_mode)
1830                 ims_pcu_destroy_bootloader_mode(pcu);
1831         else
1832                 ims_pcu_destroy_application_mode(pcu);
1833
1834         ims_pcu_buffers_free(pcu);
1835         kfree(pcu);
1836 }
1837
1838 #ifdef CONFIG_PM
1839 static int ims_pcu_suspend(struct usb_interface *intf,
1840                            pm_message_t message)
1841 {
1842         struct ims_pcu *pcu = usb_get_intfdata(intf);
1843         struct usb_host_interface *alt = intf->cur_altsetting;
1844
1845         if (alt->desc.bInterfaceClass == USB_CLASS_COMM)
1846                 ims_pcu_stop_io(pcu);
1847
1848         return 0;
1849 }
1850
1851 static int ims_pcu_resume(struct usb_interface *intf)
1852 {
1853         struct ims_pcu *pcu = usb_get_intfdata(intf);
1854         struct usb_host_interface *alt = intf->cur_altsetting;
1855         int retval = 0;
1856
1857         if (alt->desc.bInterfaceClass == USB_CLASS_COMM) {
1858                 retval = ims_pcu_start_io(pcu);
1859                 if (retval == 0)
1860                         retval = ims_pcu_line_setup(pcu);
1861         }
1862
1863         return retval;
1864 }
1865 #endif
1866
1867 static const struct usb_device_id ims_pcu_id_table[] = {
1868         {
1869                 USB_DEVICE_AND_INTERFACE_INFO(0x04d8, 0x0082,
1870                                         USB_CLASS_COMM,
1871                                         USB_CDC_SUBCLASS_ACM,
1872                                         USB_CDC_ACM_PROTO_AT_V25TER),
1873                 .driver_info = IMS_PCU_APPLICATION_MODE,
1874         },
1875         {
1876                 USB_DEVICE_AND_INTERFACE_INFO(0x04d8, 0x0083,
1877                                         USB_CLASS_COMM,
1878                                         USB_CDC_SUBCLASS_ACM,
1879                                         USB_CDC_ACM_PROTO_AT_V25TER),
1880                 .driver_info = IMS_PCU_BOOTLOADER_MODE,
1881         },
1882         { }
1883 };
1884
1885 static struct usb_driver ims_pcu_driver = {
1886         .name                   = "ims_pcu",
1887         .id_table               = ims_pcu_id_table,
1888         .probe                  = ims_pcu_probe,
1889         .disconnect             = ims_pcu_disconnect,
1890 #ifdef CONFIG_PM
1891         .suspend                = ims_pcu_suspend,
1892         .resume                 = ims_pcu_resume,
1893         .reset_resume           = ims_pcu_resume,
1894 #endif
1895 };
1896
1897 module_usb_driver(ims_pcu_driver);
1898
1899 MODULE_DESCRIPTION("IMS Passenger Control Unit driver");
1900 MODULE_AUTHOR("Dmitry Torokhov <dmitry.torokhov@gmail.com>");
1901 MODULE_LICENSE("GPL");