drivers/media/cec/cec-adap.c

   1 /*
   2  * cec-adap.c - HDMI Consumer Electronics Control framework - CEC adapter
   3  *
   4  * Copyright 2016 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
   5  *
   6  * This program is free software; you may redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; version 2 of the License.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  11  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  12  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  13  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  14  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  15  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  16  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  17  * SOFTWARE.
  18  */
  19
  20 #include <linux/errno.h>
  21 #include <linux/init.h>
  22 #include <linux/module.h>
  23 #include <linux/kernel.h>
  24 #include <linux/kmod.h>
  25 #include <linux/ktime.h>
  26 #include <linux/slab.h>
  27 #include <linux/mm.h>
  28 #include <linux/string.h>
  29 #include <linux/types.h>
  30
  31 #include "cec-priv.h"
  32
  33 static void cec_fill_msg_report_features(struct cec_adapter *adap,
  34                                          struct cec_msg *msg,
  35                                          unsigned int la_idx);
  36
  37 /*
  38  * 400 ms is the time it takes for one 16 byte message to be
  39  * transferred and 5 is the maximum number of retries. Add
  40  * another 100 ms as a margin. So if the transmit doesn't
  41  * finish before that time something is really wrong and we
  42  * have to time out.
  43  *
  44  * This is a sign that something it really wrong and a warning
  45  * will be issued.
  46  */
  47 #define CEC_XFER_TIMEOUT_MS (5 * 400 + 100)
  48
  49 #define call_op(adap, op, arg...) \
  50         (adap->ops->op ? adap->ops->op(adap, ## arg) : 0)
  51
  52 #define call_void_op(adap, op, arg...)                  \
  53         do {                                            \
  54                 if (adap->ops->op)                      \
  55                         adap->ops->op(adap, ## arg);    \
  56         } while (0)
  57
  58 static int cec_log_addr2idx(const struct cec_adapter *adap, u8 log_addr)
  59 {
  60         int i;
  61
  62         for (i = 0; i < adap->log_addrs.num_log_addrs; i++)
  63                 if (adap->log_addrs.log_addr[i] == log_addr)
  64                         return i;
  65         return -1;
  66 }
  67
  68 static unsigned int cec_log_addr2dev(const struct cec_adapter *adap, u8 log_addr)
  69 {
  70         int i = cec_log_addr2idx(adap, log_addr);
  71
  72         return adap->log_addrs.primary_device_type[i < 0 ? 0 : i];
  73 }
  74
  75 /*
  76  * Queue a new event for this filehandle. If ts == 0, then set it
  77  * to the current time.
  78  *
  79  * The two events that are currently defined do not need to keep track
  80  * of intermediate events, so no actual queue of events is needed,
  81  * instead just store the latest state and the total number of lost
  82  * messages.
  83  *
  84  * Should new events be added in the future that require intermediate
  85  * results to be queued as well, then a proper queue data structure is
  86  * required. But until then, just keep it simple.
  87  */
  88 void cec_queue_event_fh(struct cec_fh *fh,
  89                         const struct cec_event *new_ev, u64 ts)
  90 {
  91         struct cec_event *ev = &fh->events[new_ev->event - 1];
  92
  93         if (ts == 0)
  94                 ts = ktime_get_ns();
  95
  96         mutex_lock(&fh->lock);
  97         if (new_ev->event == CEC_EVENT_LOST_MSGS &&
  98             fh->pending_events & (1 << new_ev->event)) {
  99                 /*
 100                  * If there is already a lost_msgs event, then just
 101                  * update the lost_msgs count. This effectively
 102                  * merges the old and new events into one.
 103                  */
 104                 ev->lost_msgs.lost_msgs += new_ev->lost_msgs.lost_msgs;
 105                 goto unlock;
 106         }
 107
 108         /*
 109          * Intermediate states are not interesting, so just
 110          * overwrite any older event.
 111          */
 112         *ev = *new_ev;
 113         ev->ts = ts;
 114         fh->pending_events |= 1 << new_ev->event;
 115
 116 unlock:
 117         mutex_unlock(&fh->lock);
 118         wake_up_interruptible(&fh->wait);
 119 }
 120
 121 /* Queue a new event for all open filehandles. */
 122 static void cec_queue_event(struct cec_adapter *adap,
 123                             const struct cec_event *ev)
 124 {
 125         u64 ts = ktime_get_ns();
 126         struct cec_fh *fh;
 127
 128         mutex_lock(&adap->devnode.lock);
 129         list_for_each_entry(fh, &adap->devnode.fhs, list)
 130                 cec_queue_event_fh(fh, ev, ts);
 131         mutex_unlock(&adap->devnode.lock);
 132 }
 133
 134 /*
 135  * Queue a new message for this filehandle. If there is no more room
 136  * in the queue, then send the LOST_MSGS event instead.
 137  */
 138 static void cec_queue_msg_fh(struct cec_fh *fh, const struct cec_msg *msg)
 139 {
 140         static const struct cec_event ev_lost_msg = {
 141                 .ts = 0,
 142                 .event = CEC_EVENT_LOST_MSGS,
 143                 .flags = 0,
 144                 {
 145                         .lost_msgs.lost_msgs = 1,
 146                 },
 147         };
 148         struct cec_msg_entry *entry;
 149
 150         mutex_lock(&fh->lock);
 151         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
 152         if (!entry)
 153                 goto lost_msgs;
 154
 155         entry->msg = *msg;
 156         /* Add new msg at the end of the queue */
 157         list_add_tail(&entry->list, &fh->msgs);
 158
 159         /*
 160          * if the queue now has more than CEC_MAX_MSG_RX_QUEUE_SZ
 161          * messages, drop the oldest one and send a lost message event.
 162          */
 163         if (fh->queued_msgs == CEC_MAX_MSG_RX_QUEUE_SZ) {
 164                 list_del(&entry->list);
 165                 goto lost_msgs;
 166         }
 167         fh->queued_msgs++;
 168         mutex_unlock(&fh->lock);
 169         wake_up_interruptible(&fh->wait);
 170         return;
 171
 172 lost_msgs:
 173         mutex_unlock(&fh->lock);
 174         cec_queue_event_fh(fh, &ev_lost_msg, 0);
 175 }
 176
 177 /*
 178  * Queue the message for those filehandles that are in monitor mode.
 179  * If valid_la is true (this message is for us or was sent by us),
 180  * then pass it on to any monitoring filehandle. If this message
 181  * isn't for us or from us, then only give it to filehandles that
 182  * are in MONITOR_ALL mode.
 183  *
 184  * This can only happen if the CEC_CAP_MONITOR_ALL capability is
 185  * set and the CEC adapter was placed in 'monitor all' mode.
 186  */
 187 static void cec_queue_msg_monitor(struct cec_adapter *adap,
 188                                   const struct cec_msg *msg,
 189                                   bool valid_la)
 190 {
 191         struct cec_fh *fh;
 192         u32 monitor_mode = valid_la ? CEC_MODE_MONITOR :
 193                                       CEC_MODE_MONITOR_ALL;
 194
 195         mutex_lock(&adap->devnode.lock);
 196         list_for_each_entry(fh, &adap->devnode.fhs, list) {
 197                 if (fh->mode_follower >= monitor_mode)
 198                         cec_queue_msg_fh(fh, msg);
 199         }
 200         mutex_unlock(&adap->devnode.lock);
 201 }
 202
 203 /*
 204  * Queue the message for follower filehandles.
 205  */
 206 static void cec_queue_msg_followers(struct cec_adapter *adap,
 207                                     const struct cec_msg *msg)
 208 {
 209         struct cec_fh *fh;
 210
 211         mutex_lock(&adap->devnode.lock);
 212         list_for_each_entry(fh, &adap->devnode.fhs, list) {
 213                 if (fh->mode_follower == CEC_MODE_FOLLOWER)
 214                         cec_queue_msg_fh(fh, msg);
 215         }
 216         mutex_unlock(&adap->devnode.lock);
 217 }
 218
 219 /* Notify userspace of an adapter state change. */
 220 static void cec_post_state_event(struct cec_adapter *adap)
 221 {
 222         struct cec_event ev = {
 223                 .event = CEC_EVENT_STATE_CHANGE,
 224         };
 225
 226         ev.state_change.phys_addr = adap->phys_addr;
 227         ev.state_change.log_addr_mask = adap->log_addrs.log_addr_mask;
 228         cec_queue_event(adap, &ev);
 229 }
 230
 231 /*
 232  * A CEC transmit (and a possible wait for reply) completed.
 233  * If this was in blocking mode, then complete it, otherwise
 234  * queue the message for userspace to dequeue later.
 235  *
 236  * This function is called with adap->lock held.
 237  */
 238 static void cec_data_completed(struct cec_data *data)
 239 {
 240         /*
 241          * Delete this transmit from the filehandle's xfer_list since
 242          * we're done with it.
 243          *
 244          * Note that if the filehandle is closed before this transmit
 245          * finished, then the release() function will set data->fh to NULL.
 246          * Without that we would be referring to a closed filehandle.
 247          */
 248         if (data->fh)
 249                 list_del(&data->xfer_list);
 250
 251         if (data->blocking) {
 252                 /*
 253                  * Someone is blocking so mark the message as completed
 254                  * and call complete.
 255                  */
 256                 data->completed = true;
 257                 complete(&data->c);
 258         } else {
 259                 /*
 260                  * No blocking, so just queue the message if needed and
 261                  * free the memory.
 262                  */
 263                 if (data->fh)
 264                         cec_queue_msg_fh(data->fh, &data->msg);
 265                 kfree(data);
 266         }
 267 }
 268
 269 /*
 270  * A pending CEC transmit needs to be cancelled, either because the CEC
 271  * adapter is disabled or the transmit takes an impossibly long time to
 272  * finish.
 273  *
 274  * This function is called with adap->lock held.
 275  */
 276 static void cec_data_cancel(struct cec_data *data)
 277 {
 278         /*
 279          * It's either the current transmit, or it is a pending
 280          * transmit. Take the appropriate action to clear it.
 281          */
 282         if (data->adap->transmitting == data) {
 283                 data->adap->transmitting = NULL;
 284         } else {
 285                 list_del_init(&data->list);
 286                 if (!(data->msg.tx_status & CEC_TX_STATUS_OK))
 287                         data->adap->transmit_queue_sz--;
 288         }
 289
 290         /* Mark it as an error */
 291         data->msg.tx_ts = ktime_get_ns();
 292         data->msg.tx_status |= CEC_TX_STATUS_ERROR |
 293                                CEC_TX_STATUS_MAX_RETRIES;
 294         data->msg.tx_error_cnt++;
 295         data->attempts = 0;
 296         /* Queue transmitted message for monitoring purposes */
 297         cec_queue_msg_monitor(data->adap, &data->msg, 1);
 298
 299         cec_data_completed(data);
 300 }
 301
 302 /*
 303  * Flush all pending transmits and cancel any pending timeout work.
 304  *
 305  * This function is called with adap->lock held.
 306  */
 307 static void cec_flush(struct cec_adapter *adap)
 308 {
 309         struct cec_data *data, *n;
 310
 311         /*
 312          * If the adapter is disabled, or we're asked to stop,
 313          * then cancel any pending transmits.
 314          */
 315         while (!list_empty(&adap->transmit_queue)) {
 316                 data = list_first_entry(&adap->transmit_queue,
 317                                         struct cec_data, list);
 318                 cec_data_cancel(data);
 319         }
 320         if (adap->transmitting)
 321                 cec_data_cancel(adap->transmitting);
 322
 323         /* Cancel the pending timeout work. */
 324         list_for_each_entry_safe(data, n, &adap->wait_queue, list) {
 325                 if (cancel_delayed_work(&data->work))
 326                         cec_data_cancel(data);
 327                 /*
 328                  * If cancel_delayed_work returned false, then
 329                  * the cec_wait_timeout function is running,
 330                  * which will call cec_data_completed. So no
 331                  * need to do anything special in that case.
 332                  */
 333         }
 334 }
 335
 336 /*
 337  * Main CEC state machine
 338  *
 339  * Wait until the thread should be stopped, or we are not transmitting and
 340  * a new transmit message is queued up, in which case we start transmitting
 341  * that message. When the adapter finished transmitting the message it will
 342  * call cec_transmit_done().
 343  *
 344  * If the adapter is disabled, then remove all queued messages instead.
 345  *
 346  * If the current transmit times out, then cancel that transmit.
 347  */
 348 int cec_thread_func(void *_adap)
 349 {
 350         struct cec_adapter *adap = _adap;
 351
 352         for (;;) {
 353                 unsigned int signal_free_time;
 354                 struct cec_data *data;
 355                 bool timeout = false;
 356                 u8 attempts;
 357
 358                 if (adap->transmitting) {
 359                         int err;
 360
 361                         /*
 362                          * We are transmitting a message, so add a timeout
 363                          * to prevent the state machine to get stuck waiting
 364                          * for this message to finalize and add a check to
 365                          * see if the adapter is disabled in which case the
 366                          * transmit should be canceled.
 367                          */
 368                         err = wait_event_interruptible_timeout(adap->kthread_waitq,
 369                                 kthread_should_stop() ||
 370                                 (!adap->transmitting &&
 371                                  !list_empty(&adap->transmit_queue)),
 372                                 msecs_to_jiffies(CEC_XFER_TIMEOUT_MS));
 373                         timeout = err == 0;
 374                 } else {
 375                         /* Otherwise we just wait for something to happen. */
 376                         wait_event_interruptible(adap->kthread_waitq,
 377                                 kthread_should_stop() ||
 378                                 (!adap->transmitting &&
 379                                  !list_empty(&adap->transmit_queue)));
 380                 }
 381
 382                 mutex_lock(&adap->lock);
 383
 384                 if (kthread_should_stop()) {
 385                         cec_flush(adap);
 386                         goto unlock;
 387                 }
 388
 389                 if (adap->transmitting && timeout) {
 390                         /*
 391                          * If we timeout, then log that. This really shouldn't
 392                          * happen and is an indication of a faulty CEC adapter
 393                          * driver, or the CEC bus is in some weird state.
 394                          */
 395                         dprintk(0, "message %*ph timed out!\n",
 396                                 adap->transmitting->msg.len,
 397                                 adap->transmitting->msg.msg);
 398                         /* Just give up on this. */
 399                         cec_data_cancel(adap->transmitting);
 400                         goto unlock;
 401                 }
 402
 403                 /*
 404                  * If we are still transmitting, or there is nothing new to
 405                  * transmit, then just continue waiting.
 406                  */
 407                 if (adap->transmitting || list_empty(&adap->transmit_queue))
 408                         goto unlock;
 409
 410                 /* Get a new message to transmit */
 411                 data = list_first_entry(&adap->transmit_queue,
 412                                         struct cec_data, list);
 413                 list_del_init(&data->list);
 414                 adap->transmit_queue_sz--;
 415
 416                 /* Make this the current transmitting message */
 417                 adap->transmitting = data;
 418
 419                 /*
 420                  * Suggested number of attempts as per the CEC 2.0 spec:
 421                  * 4 attempts is the default, except for 'secondary poll
 422                  * messages', i.e. poll messages not sent during the adapter
 423                  * configuration phase when it allocates logical addresses.
 424                  */
 425                 if (data->msg.len == 1 && adap->is_configured)
 426                         attempts = 2;
 427                 else
 428                         attempts = 4;
 429
 430                 /* Set the suggested signal free time */
 431                 if (data->attempts) {
 432                         /* should be >= 3 data bit periods for a retry */
 433                         signal_free_time = CEC_SIGNAL_FREE_TIME_RETRY;
 434                 } else if (data->new_initiator) {
 435                         /* should be >= 5 data bit periods for new initiator */
 436                         signal_free_time = CEC_SIGNAL_FREE_TIME_NEW_INITIATOR;
 437                 } else {
 438                         /*
 439                          * should be >= 7 data bit periods for sending another
 440                          * frame immediately after another.
 441                          */
 442                         signal_free_time = CEC_SIGNAL_FREE_TIME_NEXT_XFER;
 443                 }
 444                 if (data->attempts == 0)
 445                         data->attempts = attempts;
 446
 447                 /* Tell the adapter to transmit, cancel on error */
 448                 if (adap->ops->adap_transmit(adap, data->attempts,
 449                                              signal_free_time, &data->msg))
 450                         cec_data_cancel(data);
 451
 452 unlock:
 453                 mutex_unlock(&adap->lock);
 454
 455                 if (kthread_should_stop())
 456                         break;
 457         }
 458         return 0;
 459 }
 460
 461 /*
 462  * Called by the CEC adapter if a transmit finished.
 463  */
 464 void cec_transmit_done(struct cec_adapter *adap, u8 status, u8 arb_lost_cnt,
 465                        u8 nack_cnt, u8 low_drive_cnt, u8 error_cnt)
 466 {
 467         struct cec_data *data;
 468         struct cec_msg *msg;
 469         u64 ts = ktime_get_ns();
 470
 471         dprintk(2, "cec_transmit_done %02x\n", status);
 472         mutex_lock(&adap->lock);
 473         data = adap->transmitting;
 474         if (!data) {
 475                 /*
 476                  * This can happen if a transmit was issued and the cable is
 477                  * unplugged while the transmit is ongoing. Ignore this
 478                  * transmit in that case.
 479                  */
 480                 dprintk(1, "cec_transmit_done without an ongoing transmit!\n");
 481                 goto unlock;
 482         }
 483
 484         msg = &data->msg;
 485
 486         /* Drivers must fill in the status! */
 487         WARN_ON(status == 0);
 488         msg->tx_ts = ts;
 489         msg->tx_status |= status;
 490         msg->tx_arb_lost_cnt += arb_lost_cnt;
 491         msg->tx_nack_cnt += nack_cnt;
 492         msg->tx_low_drive_cnt += low_drive_cnt;
 493         msg->tx_error_cnt += error_cnt;
 494
 495         /* Mark that we're done with this transmit */
 496         adap->transmitting = NULL;
 497
 498         /*
 499          * If there are still retry attempts left and there was an error and
 500          * the hardware didn't signal that it retried itself (by setting
 501          * CEC_TX_STATUS_MAX_RETRIES), then we will retry ourselves.
 502          */
 503         if (data->attempts > 1 &&
 504             !(status & (CEC_TX_STATUS_MAX_RETRIES | CEC_TX_STATUS_OK))) {
 505                 /* Retry this message */
 506                 data->attempts--;
 507                 /* Add the message in front of the transmit queue */
 508                 list_add(&data->list, &adap->transmit_queue);
 509                 adap->transmit_queue_sz++;
 510                 goto wake_thread;
 511         }
 512
 513         data->attempts = 0;
 514
 515         /* Always set CEC_TX_STATUS_MAX_RETRIES on error */
 516         if (!(status & CEC_TX_STATUS_OK))
 517                 msg->tx_status |= CEC_TX_STATUS_MAX_RETRIES;
 518
 519         /* Queue transmitted message for monitoring purposes */
 520         cec_queue_msg_monitor(adap, msg, 1);
 521
 522         if ((status & CEC_TX_STATUS_OK) && adap->is_configured &&
 523             msg->timeout) {
 524                 /*
 525                  * Queue the message into the wait queue if we want to wait
 526                  * for a reply.
 527                  */
 528                 list_add_tail(&data->list, &adap->wait_queue);
 529                 schedule_delayed_work(&data->work,
 530                                       msecs_to_jiffies(msg->timeout));
 531         } else {
 532                 /* Otherwise we're done */
 533                 cec_data_completed(data);
 534         }
 535
 536 wake_thread:
 537         /*
 538          * Wake up the main thread to see if another message is ready
 539          * for transmitting or to retry the current message.
 540          */
 541         wake_up_interruptible(&adap->kthread_waitq);
 542 unlock:
 543         mutex_unlock(&adap->lock);
 544 }
 545 EXPORT_SYMBOL_GPL(cec_transmit_done);
 546
 547 /*
 548  * Called when waiting for a reply times out.
 549  */
 550 static void cec_wait_timeout(struct work_struct *work)
 551 {
 552         struct cec_data *data = container_of(work, struct cec_data, work.work);
 553         struct cec_adapter *adap = data->adap;
 554
 555         mutex_lock(&adap->lock);
 556         /*
 557          * Sanity check in case the timeout and the arrival of the message
 558          * happened at the same time.
 559          */
 560         if (list_empty(&data->list))
 561                 goto unlock;
 562
 563         /* Mark the message as timed out */
 564         list_del_init(&data->list);
 565         data->msg.rx_ts = ktime_get_ns();
 566         data->msg.rx_status = CEC_RX_STATUS_TIMEOUT;
 567         cec_data_completed(data);
 568 unlock:
 569         mutex_unlock(&adap->lock);
 570 }
 571
 572 /*
 573  * Transmit a message. The fh argument may be NULL if the transmit is not
 574  * associated with a specific filehandle.
 575  *
 576  * This function is called with adap->lock held.
 577  */
 578 int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
 579                         struct cec_fh *fh, bool block)
 580 {
 581         struct cec_data *data;
 582         u8 last_initiator = 0xff;
 583         unsigned int timeout;
 584         int res = 0;
 585
 586         msg->rx_ts = 0;
 587         msg->tx_ts = 0;
 588         msg->rx_status = 0;
 589         msg->tx_status = 0;
 590         msg->tx_arb_lost_cnt = 0;
 591         msg->tx_nack_cnt = 0;
 592         msg->tx_low_drive_cnt = 0;
 593         msg->tx_error_cnt = 0;
 594         msg->sequence = ++adap->sequence;
 595         if (!msg->sequence)
 596                 msg->sequence = ++adap->sequence;
 597
 598         if (msg->reply && msg->timeout == 0) {
 599                 /* Make sure the timeout isn't 0. */
 600                 msg->timeout = 1000;
 601         }
 602         if (msg->timeout)
 603                 msg->flags &= CEC_MSG_FL_REPLY_TO_FOLLOWERS;
 604         else
 605                 msg->flags = 0;
 606
 607         /* Sanity checks */
 608         if (msg->len == 0 || msg->len > CEC_MAX_MSG_SIZE) {
 609                 dprintk(1, "%s: invalid length %d\n", __func__, msg->len);
 610                 return -EINVAL;
 611         }
 612         if (msg->timeout && msg->len == 1) {
 613                 dprintk(1, "%s: can't reply for poll msg\n", __func__);
 614                 return -EINVAL;
 615         }
 616         memset(msg->msg + msg->len, 0, sizeof(msg->msg) - msg->len);
 617         if (msg->len == 1) {
 618                 if (cec_msg_destination(msg) == 0xf) {
 619                         dprintk(1, "%s: invalid poll message\n", __func__);
 620                         return -EINVAL;
 621                 }
 622                 if (cec_has_log_addr(adap, cec_msg_destination(msg))) {
 623                         /*
 624                          * If the destination is a logical address our adapter
 625                          * has already claimed, then just NACK this.
 626                          * It depends on the hardware what it will do with a
 627                          * POLL to itself (some OK this), so it is just as
 628                          * easy to handle it here so the behavior will be
 629                          * consistent.
 630                          */
 631                         msg->tx_ts = ktime_get_ns();
 632                         msg->tx_status = CEC_TX_STATUS_NACK |
 633                                          CEC_TX_STATUS_MAX_RETRIES;
 634                         msg->tx_nack_cnt = 1;
 635                         return 0;
 636                 }
 637         }
 638         if (msg->len > 1 && !cec_msg_is_broadcast(msg) &&
 639             cec_has_log_addr(adap, cec_msg_destination(msg))) {
 640                 dprintk(1, "%s: destination is the adapter itself\n", __func__);
 641                 return -EINVAL;
 642         }
 643         if (msg->len > 1 && adap->is_configured &&
 644             !cec_has_log_addr(adap, cec_msg_initiator(msg))) {
 645                 dprintk(1, "%s: initiator has unknown logical address %d\n",
 646                         __func__, cec_msg_initiator(msg));
 647                 return -EINVAL;
 648         }
 649         if (!adap->is_configured && !adap->is_configuring) {
 650                 if (msg->msg[0] != 0xf0) {
 651                         dprintk(1, "%s: adapter is unconfigured\n", __func__);
 652                         return -ENONET;
 653                 }
 654                 if (msg->reply) {
 655                         dprintk(1, "%s: invalid msg->reply\n", __func__);
 656                         return -EINVAL;
 657                 }
 658         }
 659
 660         if (adap->transmit_queue_sz >= CEC_MAX_MSG_TX_QUEUE_SZ) {
 661                 dprintk(1, "%s: transmit queue full\n", __func__);
 662                 return -EBUSY;
 663         }
 664
 665         data = kzalloc(sizeof(*data), GFP_KERNEL);
 666         if (!data)
 667                 return -ENOMEM;
 668
 669         if (msg->len > 1 && msg->msg[1] == CEC_MSG_CDC_MESSAGE) {
 670                 msg->msg[2] = adap->phys_addr >> 8;
 671                 msg->msg[3] = adap->phys_addr & 0xff;
 672         }
 673
 674         if (msg->timeout)
 675                 dprintk(2, "%s: %*ph (wait for 0x%02x%s)\n",
 676                         __func__, msg->len, msg->msg, msg->reply, !block ? ", nb" : "");
 677         else
 678                 dprintk(2, "%s: %*ph%s\n",
 679                         __func__, msg->len, msg->msg, !block ? " (nb)" : "");
 680
 681         data->msg = *msg;
 682         data->fh = fh;
 683         data->adap = adap;
 684         data->blocking = block;
 685
 686         /*
 687          * Determine if this message follows a message from the same
 688          * initiator. Needed to determine the free signal time later on.
 689          */
 690         if (msg->len > 1) {
 691                 if (!(list_empty(&adap->transmit_queue))) {
 692                         const struct cec_data *last;
 693
 694                         last = list_last_entry(&adap->transmit_queue,
 695                                                const struct cec_data, list);
 696                         last_initiator = cec_msg_initiator(&last->msg);
 697                 } else if (adap->transmitting) {
 698                         last_initiator =
 699                                 cec_msg_initiator(&adap->transmitting->msg);
 700                 }
 701         }
 702         data->new_initiator = last_initiator != cec_msg_initiator(msg);
 703         init_completion(&data->c);
 704         INIT_DELAYED_WORK(&data->work, cec_wait_timeout);
 705
 706         if (fh)
 707                 list_add_tail(&data->xfer_list, &fh->xfer_list);
 708
 709         list_add_tail(&data->list, &adap->transmit_queue);
 710         adap->transmit_queue_sz++;
 711         if (!adap->transmitting)
 712                 wake_up_interruptible(&adap->kthread_waitq);
 713
 714         /* All done if we don't need to block waiting for completion */
 715         if (!block)
 716                 return 0;
 717
 718         /*
 719          * If we don't get a completion before this time something is really
 720          * wrong and we time out.
 721          */
 722         timeout = CEC_XFER_TIMEOUT_MS;
 723         /* Add the requested timeout if we have to wait for a reply as well */
 724         if (msg->timeout)
 725                 timeout += msg->timeout;
 726
 727         /*
 728          * Release the lock and wait, retake the lock afterwards.
 729          */
 730         mutex_unlock(&adap->lock);
 731         res = wait_for_completion_killable_timeout(&data->c,
 732                                                    msecs_to_jiffies(timeout));
 733         mutex_lock(&adap->lock);
 734
 735         if (data->completed) {
 736                 /* The transmit completed (possibly with an error) */
 737                 *msg = data->msg;
 738                 kfree(data);
 739                 return 0;
 740         }
 741         /*
 742          * The wait for completion timed out or was interrupted, so mark this
 743          * as non-blocking and disconnect from the filehandle since it is
 744          * still 'in flight'. When it finally completes it will just drop the
 745          * result silently.
 746          */
 747         data->blocking = false;
 748         if (data->fh)
 749                 list_del(&data->xfer_list);
 750         data->fh = NULL;
 751
 752         if (res == 0) { /* timed out */
 753                 /* Check if the reply or the transmit failed */
 754                 if (msg->timeout && (msg->tx_status & CEC_TX_STATUS_OK))
 755                         msg->rx_status = CEC_RX_STATUS_TIMEOUT;
 756                 else
 757                         msg->tx_status = CEC_TX_STATUS_MAX_RETRIES;
 758         }
 759         return res > 0 ? 0 : res;
 760 }
 761
 762 /* Helper function to be used by drivers and this framework. */
 763 int cec_transmit_msg(struct cec_adapter *adap, struct cec_msg *msg,
 764                      bool block)
 765 {
 766         int ret;
 767
 768         mutex_lock(&adap->lock);
 769         ret = cec_transmit_msg_fh(adap, msg, NULL, block);
 770         mutex_unlock(&adap->lock);
 771         return ret;
 772 }
 773 EXPORT_SYMBOL_GPL(cec_transmit_msg);
 774
 775 /*
 776  * I don't like forward references but without this the low-level
 777  * cec_received_msg() function would come after a bunch of high-level
 778  * CEC protocol handling functions. That was very confusing.
 779  */
 780 static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
 781                               bool is_reply);
 782
 783 #define DIRECTED        0x80
 784 #define BCAST1_4        0x40
 785 #define BCAST2_0        0x20    /* broadcast only allowed for >= 2.0 */
 786 #define BCAST           (BCAST1_4 | BCAST2_0)
 787 #define BOTH            (BCAST | DIRECTED)
 788
 789 /*
 790  * Specify minimum length and whether the message is directed, broadcast
 791  * or both. Messages that do not match the criteria are ignored as per
 792  * the CEC specification.
 793  */
 794 static const u8 cec_msg_size[256] = {
 795         [CEC_MSG_ACTIVE_SOURCE] = 4 | BCAST,
 796         [CEC_MSG_IMAGE_VIEW_ON] = 2 | DIRECTED,
 797         [CEC_MSG_TEXT_VIEW_ON] = 2 | DIRECTED,
 798         [CEC_MSG_INACTIVE_SOURCE] = 4 | DIRECTED,
 799         [CEC_MSG_REQUEST_ACTIVE_SOURCE] = 2 | BCAST,
 800         [CEC_MSG_ROUTING_CHANGE] = 6 | BCAST,
 801         [CEC_MSG_ROUTING_INFORMATION] = 4 | BCAST,
 802         [CEC_MSG_SET_STREAM_PATH] = 4 | BCAST,
 803         [CEC_MSG_STANDBY] = 2 | BOTH,
 804         [CEC_MSG_RECORD_OFF] = 2 | DIRECTED,
 805         [CEC_MSG_RECORD_ON] = 3 | DIRECTED,
 806         [CEC_MSG_RECORD_STATUS] = 3 | DIRECTED,
 807         [CEC_MSG_RECORD_TV_SCREEN] = 2 | DIRECTED,
 808         [CEC_MSG_CLEAR_ANALOGUE_TIMER] = 13 | DIRECTED,
 809         [CEC_MSG_CLEAR_DIGITAL_TIMER] = 16 | DIRECTED,
 810         [CEC_MSG_CLEAR_EXT_TIMER] = 13 | DIRECTED,
 811         [CEC_MSG_SET_ANALOGUE_TIMER] = 13 | DIRECTED,
 812         [CEC_MSG_SET_DIGITAL_TIMER] = 16 | DIRECTED,
 813         [CEC_MSG_SET_EXT_TIMER] = 13 | DIRECTED,
 814         [CEC_MSG_SET_TIMER_PROGRAM_TITLE] = 2 | DIRECTED,
 815         [CEC_MSG_TIMER_CLEARED_STATUS] = 3 | DIRECTED,
 816         [CEC_MSG_TIMER_STATUS] = 3 | DIRECTED,
 817         [CEC_MSG_CEC_VERSION] = 3 | DIRECTED,
 818         [CEC_MSG_GET_CEC_VERSION] = 2 | DIRECTED,
 819         [CEC_MSG_GIVE_PHYSICAL_ADDR] = 2 | DIRECTED,
 820         [CEC_MSG_GET_MENU_LANGUAGE] = 2 | DIRECTED,
 821         [CEC_MSG_REPORT_PHYSICAL_ADDR] = 5 | BCAST,
 822         [CEC_MSG_SET_MENU_LANGUAGE] = 5 | BCAST,
 823         [CEC_MSG_REPORT_FEATURES] = 6 | BCAST,
 824         [CEC_MSG_GIVE_FEATURES] = 2 | DIRECTED,
 825         [CEC_MSG_DECK_CONTROL] = 3 | DIRECTED,
 826         [CEC_MSG_DECK_STATUS] = 3 | DIRECTED,
 827         [CEC_MSG_GIVE_DECK_STATUS] = 3 | DIRECTED,
 828         [CEC_MSG_PLAY] = 3 | DIRECTED,
 829         [CEC_MSG_GIVE_TUNER_DEVICE_STATUS] = 3 | DIRECTED,
 830         [CEC_MSG_SELECT_ANALOGUE_SERVICE] = 6 | DIRECTED,
 831         [CEC_MSG_SELECT_DIGITAL_SERVICE] = 9 | DIRECTED,
 832         [CEC_MSG_TUNER_DEVICE_STATUS] = 7 | DIRECTED,
 833         [CEC_MSG_TUNER_STEP_DECREMENT] = 2 | DIRECTED,
 834         [CEC_MSG_TUNER_STEP_INCREMENT] = 2 | DIRECTED,
 835         [CEC_MSG_DEVICE_VENDOR_ID] = 5 | BCAST,
 836         [CEC_MSG_GIVE_DEVICE_VENDOR_ID] = 2 | DIRECTED,
 837         [CEC_MSG_VENDOR_COMMAND] = 2 | DIRECTED,
 838         [CEC_MSG_VENDOR_COMMAND_WITH_ID] = 5 | BOTH,
 839         [CEC_MSG_VENDOR_REMOTE_BUTTON_DOWN] = 2 | BOTH,
 840         [CEC_MSG_VENDOR_REMOTE_BUTTON_UP] = 2 | BOTH,
 841         [CEC_MSG_SET_OSD_STRING] = 3 | DIRECTED,
 842         [CEC_MSG_GIVE_OSD_NAME] = 2 | DIRECTED,
 843         [CEC_MSG_SET_OSD_NAME] = 2 | DIRECTED,
 844         [CEC_MSG_MENU_REQUEST] = 3 | DIRECTED,
 845         [CEC_MSG_MENU_STATUS] = 3 | DIRECTED,
 846         [CEC_MSG_USER_CONTROL_PRESSED] = 3 | DIRECTED,
 847         [CEC_MSG_USER_CONTROL_RELEASED] = 2 | DIRECTED,
 848         [CEC_MSG_GIVE_DEVICE_POWER_STATUS] = 2 | DIRECTED,
 849         [CEC_MSG_REPORT_POWER_STATUS] = 3 | DIRECTED | BCAST2_0,
 850         [CEC_MSG_FEATURE_ABORT] = 4 | DIRECTED,
 851         [CEC_MSG_ABORT] = 2 | DIRECTED,
 852         [CEC_MSG_GIVE_AUDIO_STATUS] = 2 | DIRECTED,
 853         [CEC_MSG_GIVE_SYSTEM_AUDIO_MODE_STATUS] = 2 | DIRECTED,
 854         [CEC_MSG_REPORT_AUDIO_STATUS] = 3 | DIRECTED,
 855         [CEC_MSG_REPORT_SHORT_AUDIO_DESCRIPTOR] = 2 | DIRECTED,
 856         [CEC_MSG_REQUEST_SHORT_AUDIO_DESCRIPTOR] = 2 | DIRECTED,
 857         [CEC_MSG_SET_SYSTEM_AUDIO_MODE] = 3 | BOTH,
 858         [CEC_MSG_SYSTEM_AUDIO_MODE_REQUEST] = 2 | DIRECTED,
 859         [CEC_MSG_SYSTEM_AUDIO_MODE_STATUS] = 3 | DIRECTED,
 860         [CEC_MSG_SET_AUDIO_RATE] = 3 | DIRECTED,
 861         [CEC_MSG_INITIATE_ARC] = 2 | DIRECTED,
 862         [CEC_MSG_REPORT_ARC_INITIATED] = 2 | DIRECTED,
 863         [CEC_MSG_REPORT_ARC_TERMINATED] = 2 | DIRECTED,
 864         [CEC_MSG_REQUEST_ARC_INITIATION] = 2 | DIRECTED,
 865         [CEC_MSG_REQUEST_ARC_TERMINATION] = 2 | DIRECTED,
 866         [CEC_MSG_TERMINATE_ARC] = 2 | DIRECTED,
 867         [CEC_MSG_REQUEST_CURRENT_LATENCY] = 4 | BCAST,
 868         [CEC_MSG_REPORT_CURRENT_LATENCY] = 6 | BCAST,
 869         [CEC_MSG_CDC_MESSAGE] = 2 | BCAST,
 870 };
 871
 872 /* Called by the CEC adapter if a message is received */
 873 void cec_received_msg(struct cec_adapter *adap, struct cec_msg *msg)
 874 {
 875         struct cec_data *data;
 876         u8 msg_init = cec_msg_initiator(msg);
 877         u8 msg_dest = cec_msg_destination(msg);
 878         u8 cmd = msg->msg[1];
 879         bool is_reply = false;
 880         bool valid_la = true;
 881         u8 min_len = 0;
 882
 883         if (WARN_ON(!msg->len || msg->len > CEC_MAX_MSG_SIZE))
 884                 return;
 885
 886         /*
 887          * Some CEC adapters will receive the messages that they transmitted.
 888          * This test filters out those messages by checking if we are the
 889          * initiator, and just returning in that case.
 890          *
 891          * Note that this won't work if this is an Unregistered device.
 892          *
 893          * It is bad practice if the hardware receives the message that it
 894          * transmitted and luckily most CEC adapters behave correctly in this
 895          * respect.
 896          */
 897         if (msg_init != CEC_LOG_ADDR_UNREGISTERED &&
 898             cec_has_log_addr(adap, msg_init))
 899                 return;
 900
 901         msg->rx_ts = ktime_get_ns();
 902         msg->rx_status = CEC_RX_STATUS_OK;
 903         msg->sequence = msg->reply = msg->timeout = 0;
 904         msg->tx_status = 0;
 905         msg->tx_ts = 0;
 906         msg->tx_arb_lost_cnt = 0;
 907         msg->tx_nack_cnt = 0;
 908         msg->tx_low_drive_cnt = 0;
 909         msg->tx_error_cnt = 0;
 910         msg->flags = 0;
 911         memset(msg->msg + msg->len, 0, sizeof(msg->msg) - msg->len);
 912
 913         mutex_lock(&adap->lock);
 914         dprintk(2, "cec_received_msg: %*ph\n", msg->len, msg->msg);
 915
 916         /* Check if this message was for us (directed or broadcast). */
 917         if (!cec_msg_is_broadcast(msg))
 918                 valid_la = cec_has_log_addr(adap, msg_dest);
 919
 920         /*
 921          * Check if the length is not too short or if the message is a
 922          * broadcast message where a directed message was expected or
 923          * vice versa. If so, then the message has to be ignored (according
 924          * to section CEC 7.3 and CEC 12.2).
 925          */
 926         if (valid_la && msg->len > 1 && cec_msg_size[cmd]) {
 927                 u8 dir_fl = cec_msg_size[cmd] & BOTH;
 928
 929                 min_len = cec_msg_size[cmd] & 0x1f;
 930                 if (msg->len < min_len)
 931                         valid_la = false;
 932                 else if (!cec_msg_is_broadcast(msg) && !(dir_fl & DIRECTED))
 933                         valid_la = false;
 934                 else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST1_4))
 935                         valid_la = false;
 936                 else if (cec_msg_is_broadcast(msg) &&
 937                          adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0 &&
 938                          !(dir_fl & BCAST2_0))
 939                         valid_la = false;
 940         }
 941         if (valid_la && min_len) {
 942                 /* These messages have special length requirements */
 943                 switch (cmd) {
 944                 case CEC_MSG_TIMER_STATUS:
 945                         if (msg->msg[2] & 0x10) {
 946                                 switch (msg->msg[2] & 0xf) {
 947                                 case CEC_OP_PROG_INFO_NOT_ENOUGH_SPACE:
 948                                 case CEC_OP_PROG_INFO_MIGHT_NOT_BE_ENOUGH_SPACE:
 949                                         if (msg->len < 5)
 950                                                 valid_la = false;
 951                                         break;
 952                                 }
 953                         } else if ((msg->msg[2] & 0xf) == CEC_OP_PROG_ERROR_DUPLICATE) {
 954                                 if (msg->len < 5)
 955                                         valid_la = false;
 956                         }
 957                         break;
 958                 case CEC_MSG_RECORD_ON:
 959                         switch (msg->msg[2]) {
 960                         case CEC_OP_RECORD_SRC_OWN:
 961                                 break;
 962                         case CEC_OP_RECORD_SRC_DIGITAL:
 963                                 if (msg->len < 10)
 964                                         valid_la = false;
 965                                 break;
 966                         case CEC_OP_RECORD_SRC_ANALOG:
 967                                 if (msg->len < 7)
 968                                         valid_la = false;
 969                                 break;
 970                         case CEC_OP_RECORD_SRC_EXT_PLUG:
 971                                 if (msg->len < 4)
 972                                         valid_la = false;
 973                                 break;
 974                         case CEC_OP_RECORD_SRC_EXT_PHYS_ADDR:
 975                                 if (msg->len < 5)
 976                                         valid_la = false;
 977                                 break;
 978                         }
 979                         break;
 980                 }
 981         }
 982
 983         /* It's a valid message and not a poll or CDC message */
 984         if (valid_la && msg->len > 1 && cmd != CEC_MSG_CDC_MESSAGE) {
 985                 bool abort = cmd == CEC_MSG_FEATURE_ABORT;
 986
 987                 /* The aborted command is in msg[2] */
 988                 if (abort)
 989                         cmd = msg->msg[2];
 990
 991                 /*
 992                  * Walk over all transmitted messages that are waiting for a
 993                  * reply.
 994                  */
 995                 list_for_each_entry(data, &adap->wait_queue, list) {
 996                         struct cec_msg *dst = &data->msg;
 997
 998                         /*
 999                          * The *only* CEC message that has two possible replies
1000                          * is CEC_MSG_INITIATE_ARC.
1001                          * In this case allow either of the two replies.
1002                          */
1003                         if (!abort && dst->msg[1] == CEC_MSG_INITIATE_ARC &&
1004                             (cmd == CEC_MSG_REPORT_ARC_INITIATED ||
1005                              cmd == CEC_MSG_REPORT_ARC_TERMINATED) &&
1006                             (dst->reply == CEC_MSG_REPORT_ARC_INITIATED ||
1007                              dst->reply == CEC_MSG_REPORT_ARC_TERMINATED))
1008                                 dst->reply = cmd;
1009
1010                         /* Does the command match? */
1011                         if ((abort && cmd != dst->msg[1]) ||
1012                             (!abort && cmd != dst->reply))
1013                                 continue;
1014
1015                         /* Does the addressing match? */
1016                         if (msg_init != cec_msg_destination(dst) &&
1017                             !cec_msg_is_broadcast(dst))
1018                                 continue;
1019
1020                         /* We got a reply */
1021                         memcpy(dst->msg, msg->msg, msg->len);
1022                         dst->len = msg->len;
1023                         dst->rx_ts = msg->rx_ts;
1024                         dst->rx_status = msg->rx_status;
1025                         if (abort)
1026                                 dst->rx_status |= CEC_RX_STATUS_FEATURE_ABORT;
1027                         msg->flags = dst->flags;
1028                         /* Remove it from the wait_queue */
1029                         list_del_init(&data->list);
1030
1031                         /* Cancel the pending timeout work */
1032                         if (!cancel_delayed_work(&data->work)) {
1033                                 mutex_unlock(&adap->lock);
1034                                 flush_scheduled_work();
1035                                 mutex_lock(&adap->lock);
1036                         }
1037                         /*
1038                          * Mark this as a reply, provided someone is still
1039                          * waiting for the answer.
1040                          */
1041                         if (data->fh)
1042                                 is_reply = true;
1043                         cec_data_completed(data);
1044                         break;
1045                 }
1046         }
1047         mutex_unlock(&adap->lock);
1048
1049         /* Pass the message on to any monitoring filehandles */
1050         cec_queue_msg_monitor(adap, msg, valid_la);
1051
1052         /* We're done if it is not for us or a poll message */
1053         if (!valid_la || msg->len <= 1)
1054                 return;
1055
1056         if (adap->log_addrs.log_addr_mask == 0)
1057                 return;
1058
1059         /*
1060          * Process the message on the protocol level. If is_reply is true,
1061          * then cec_receive_notify() won't pass on the reply to the listener(s)
1062          * since that was already done by cec_data_completed() above.
1063          */
1064         cec_receive_notify(adap, msg, is_reply);
1065 }
1066 EXPORT_SYMBOL_GPL(cec_received_msg);
1067
1068 /* Logical Address Handling */
1069
1070 /*
1071  * Attempt to claim a specific logical address.
1072  *
1073  * This function is called with adap->lock held.
1074  */
1075 static int cec_config_log_addr(struct cec_adapter *adap,
1076                                unsigned int idx,
1077                                unsigned int log_addr)
1078 {
1079         struct cec_log_addrs *las = &adap->log_addrs;
1080         struct cec_msg msg = { };
1081         int err;
1082
1083         if (cec_has_log_addr(adap, log_addr))
1084                 return 0;
1085
1086         /* Send poll message */
1087         msg.len = 1;
1088         msg.msg[0] = (log_addr << 4) | log_addr;
1089         err = cec_transmit_msg_fh(adap, &msg, NULL, true);
1090
1091         /*
1092          * While trying to poll the physical address was reset
1093          * and the adapter was unconfigured, so bail out.
1094          */
1095         if (!adap->is_configuring)
1096                 return -EINTR;
1097
1098         if (err)
1099                 return err;
1100
1101         if (msg.tx_status & CEC_TX_STATUS_OK)
1102                 return 0;
1103
1104         /*
1105          * Message not acknowledged, so this logical
1106          * address is free to use.
1107          */
1108         err = adap->ops->adap_log_addr(adap, log_addr);
1109         if (err)
1110                 return err;
1111
1112         las->log_addr[idx] = log_addr;
1113         las->log_addr_mask |= 1 << log_addr;
1114         adap->phys_addrs[log_addr] = adap->phys_addr;
1115
1116         dprintk(2, "claimed addr %d (%d)\n", log_addr,
1117                 las->primary_device_type[idx]);
1118         return 1;
1119 }
1120
1121 /*
1122  * Unconfigure the adapter: clear all logical addresses and send
1123  * the state changed event.
1124  *
1125  * This function is called with adap->lock held.
1126  */
1127 static void cec_adap_unconfigure(struct cec_adapter *adap)
1128 {
1129         WARN_ON(adap->ops->adap_log_addr(adap, CEC_LOG_ADDR_INVALID));
1130         adap->log_addrs.log_addr_mask = 0;
1131         adap->is_configuring = false;
1132         adap->is_configured = false;
1133         memset(adap->phys_addrs, 0xff, sizeof(adap->phys_addrs));
1134         cec_flush(adap);
1135         wake_up_interruptible(&adap->kthread_waitq);
1136         cec_post_state_event(adap);
1137 }
1138
1139 /*
1140  * Attempt to claim the required logical addresses.
1141  */
1142 static int cec_config_thread_func(void *arg)
1143 {
1144         /* The various LAs for each type of device */
1145         static const u8 tv_log_addrs[] = {
1146                 CEC_LOG_ADDR_TV, CEC_LOG_ADDR_SPECIFIC,
1147                 CEC_LOG_ADDR_INVALID
1148         };
1149         static const u8 record_log_addrs[] = {
1150                 CEC_LOG_ADDR_RECORD_1, CEC_LOG_ADDR_RECORD_2,
1151                 CEC_LOG_ADDR_RECORD_3,
1152                 CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1153                 CEC_LOG_ADDR_INVALID
1154         };
1155         static const u8 tuner_log_addrs[] = {
1156                 CEC_LOG_ADDR_TUNER_1, CEC_LOG_ADDR_TUNER_2,
1157                 CEC_LOG_ADDR_TUNER_3, CEC_LOG_ADDR_TUNER_4,
1158                 CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1159                 CEC_LOG_ADDR_INVALID
1160         };
1161         static const u8 playback_log_addrs[] = {
1162                 CEC_LOG_ADDR_PLAYBACK_1, CEC_LOG_ADDR_PLAYBACK_2,
1163                 CEC_LOG_ADDR_PLAYBACK_3,
1164                 CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1165                 CEC_LOG_ADDR_INVALID
1166         };
1167         static const u8 audiosystem_log_addrs[] = {
1168                 CEC_LOG_ADDR_AUDIOSYSTEM,
1169                 CEC_LOG_ADDR_INVALID
1170         };
1171         static const u8 specific_use_log_addrs[] = {
1172                 CEC_LOG_ADDR_SPECIFIC,
1173                 CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1174                 CEC_LOG_ADDR_INVALID
1175         };
1176         static const u8 *type2addrs[6] = {
1177                 [CEC_LOG_ADDR_TYPE_TV] = tv_log_addrs,
1178                 [CEC_LOG_ADDR_TYPE_RECORD] = record_log_addrs,
1179                 [CEC_LOG_ADDR_TYPE_TUNER] = tuner_log_addrs,
1180                 [CEC_LOG_ADDR_TYPE_PLAYBACK] = playback_log_addrs,
1181                 [CEC_LOG_ADDR_TYPE_AUDIOSYSTEM] = audiosystem_log_addrs,
1182                 [CEC_LOG_ADDR_TYPE_SPECIFIC] = specific_use_log_addrs,
1183         };
1184         static const u16 type2mask[] = {
1185                 [CEC_LOG_ADDR_TYPE_TV] = CEC_LOG_ADDR_MASK_TV,
1186                 [CEC_LOG_ADDR_TYPE_RECORD] = CEC_LOG_ADDR_MASK_RECORD,
1187                 [CEC_LOG_ADDR_TYPE_TUNER] = CEC_LOG_ADDR_MASK_TUNER,
1188                 [CEC_LOG_ADDR_TYPE_PLAYBACK] = CEC_LOG_ADDR_MASK_PLAYBACK,
1189                 [CEC_LOG_ADDR_TYPE_AUDIOSYSTEM] = CEC_LOG_ADDR_MASK_AUDIOSYSTEM,
1190                 [CEC_LOG_ADDR_TYPE_SPECIFIC] = CEC_LOG_ADDR_MASK_SPECIFIC,
1191         };
1192         struct cec_adapter *adap = arg;
1193         struct cec_log_addrs *las = &adap->log_addrs;
1194         int err;
1195         int i, j;
1196
1197         mutex_lock(&adap->lock);
1198         dprintk(1, "physical address: %x.%x.%x.%x, claim %d logical addresses\n",
1199                 cec_phys_addr_exp(adap->phys_addr), las->num_log_addrs);
1200         las->log_addr_mask = 0;
1201
1202         if (las->log_addr_type[0] == CEC_LOG_ADDR_TYPE_UNREGISTERED)
1203                 goto configured;
1204
1205         for (i = 0; i < las->num_log_addrs; i++) {
1206                 unsigned int type = las->log_addr_type[i];
1207                 const u8 *la_list;
1208                 u8 last_la;
1209
1210                 /*
1211                  * The TV functionality can only map to physical address 0.
1212                  * For any other address, try the Specific functionality
1213                  * instead as per the spec.
1214                  */
1215                 if (adap->phys_addr && type == CEC_LOG_ADDR_TYPE_TV)
1216                         type = CEC_LOG_ADDR_TYPE_SPECIFIC;
1217
1218                 la_list = type2addrs[type];
1219                 last_la = las->log_addr[i];
1220                 las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1221                 if (last_la == CEC_LOG_ADDR_INVALID ||
1222                     last_la == CEC_LOG_ADDR_UNREGISTERED ||
1223                     !((1 << last_la) & type2mask[type]))
1224                         last_la = la_list[0];
1225
1226                 err = cec_config_log_addr(adap, i, last_la);
1227                 if (err > 0) /* Reused last LA */
1228                         continue;
1229
1230                 if (err < 0)
1231                         goto unconfigure;
1232
1233                 for (j = 0; la_list[j] != CEC_LOG_ADDR_INVALID; j++) {
1234                         /* Tried this one already, skip it */
1235                         if (la_list[j] == last_la)
1236                                 continue;
1237                         /* The backup addresses are CEC 2.0 specific */
1238                         if ((la_list[j] == CEC_LOG_ADDR_BACKUP_1 ||
1239                              la_list[j] == CEC_LOG_ADDR_BACKUP_2) &&
1240                             las->cec_version < CEC_OP_CEC_VERSION_2_0)
1241                                 continue;
1242
1243                         err = cec_config_log_addr(adap, i, la_list[j]);
1244                         if (err == 0) /* LA is in use */
1245                                 continue;
1246                         if (err < 0)
1247                                 goto unconfigure;
1248                         /* Done, claimed an LA */
1249                         break;
1250                 }
1251
1252                 if (la_list[j] == CEC_LOG_ADDR_INVALID)
1253                         dprintk(1, "could not claim LA %d\n", i);
1254         }
1255
1256         if (adap->log_addrs.log_addr_mask == 0 &&
1257             !(las->flags & CEC_LOG_ADDRS_FL_ALLOW_UNREG_FALLBACK))
1258                 goto unconfigure;
1259
1260 configured:
1261         if (adap->log_addrs.log_addr_mask == 0) {
1262                 /* Fall back to unregistered */
1263                 las->log_addr[0] = CEC_LOG_ADDR_UNREGISTERED;
1264                 las->log_addr_mask = 1 << las->log_addr[0];
1265                 for (i = 1; i < las->num_log_addrs; i++)
1266                         las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1267         }
1268         for (i = las->num_log_addrs; i < CEC_MAX_LOG_ADDRS; i++)
1269                 las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1270         adap->is_configured = true;
1271         adap->is_configuring = false;
1272         cec_post_state_event(adap);
1273
1274         /*
1275          * Now post the Report Features and Report Physical Address broadcast
1276          * messages. Note that these are non-blocking transmits, meaning that
1277          * they are just queued up and once adap->lock is unlocked the main
1278          * thread will kick in and start transmitting these.
1279          *
1280          * If after this function is done (but before one or more of these
1281          * messages are actually transmitted) the CEC adapter is unconfigured,
1282          * then any remaining messages will be dropped by the main thread.
1283          */
1284         for (i = 0; i < las->num_log_addrs; i++) {
1285                 struct cec_msg msg = {};
1286
1287                 if (las->log_addr[i] == CEC_LOG_ADDR_INVALID ||
1288                     (las->flags & CEC_LOG_ADDRS_FL_CDC_ONLY))
1289                         continue;
1290
1291                 msg.msg[0] = (las->log_addr[i] << 4) | 0x0f;
1292
1293                 /* Report Features must come first according to CEC 2.0 */
1294                 if (las->log_addr[i] != CEC_LOG_ADDR_UNREGISTERED &&
1295                     adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0) {
1296                         cec_fill_msg_report_features(adap, &msg, i);
1297                         cec_transmit_msg_fh(adap, &msg, NULL, false);
1298                 }
1299
1300                 /* Report Physical Address */
1301                 cec_msg_report_physical_addr(&msg, adap->phys_addr,
1302                                              las->primary_device_type[i]);
1303                 dprintk(2, "config: la %d pa %x.%x.%x.%x\n",
1304                         las->log_addr[i],
1305                         cec_phys_addr_exp(adap->phys_addr));
1306                 cec_transmit_msg_fh(adap, &msg, NULL, false);
1307         }
1308         adap->kthread_config = NULL;
1309         complete(&adap->config_completion);
1310         mutex_unlock(&adap->lock);
1311         return 0;
1312
1313 unconfigure:
1314         for (i = 0; i < las->num_log_addrs; i++)
1315                 las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1316         cec_adap_unconfigure(adap);
1317         adap->kthread_config = NULL;
1318         mutex_unlock(&adap->lock);
1319         complete(&adap->config_completion);
1320         return 0;
1321 }
1322
1323 /*
1324  * Called from either __cec_s_phys_addr or __cec_s_log_addrs to claim the
1325  * logical addresses.
1326  *
1327  * This function is called with adap->lock held.
1328  */
1329 static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
1330 {
1331         if (WARN_ON(adap->is_configuring || adap->is_configured))
1332                 return;
1333
1334         init_completion(&adap->config_completion);
1335
1336         /* Ready to kick off the thread */
1337         adap->is_configuring = true;
1338         adap->kthread_config = kthread_run(cec_config_thread_func, adap,
1339                                            "ceccfg-%s", adap->name);
1340         if (IS_ERR(adap->kthread_config)) {
1341                 adap->kthread_config = NULL;
1342         } else if (block) {
1343                 mutex_unlock(&adap->lock);
1344                 wait_for_completion(&adap->config_completion);
1345                 mutex_lock(&adap->lock);
1346         }
1347 }
1348
1349 /* Set a new physical address and send an event notifying userspace of this.
1350  *
1351  * This function is called with adap->lock held.
1352  */
1353 void __cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)
1354 {
1355         if (phys_addr == adap->phys_addr || adap->devnode.unregistered)
1356                 return;
1357
1358         if (phys_addr == CEC_PHYS_ADDR_INVALID ||
1359             adap->phys_addr != CEC_PHYS_ADDR_INVALID) {
1360                 adap->phys_addr = CEC_PHYS_ADDR_INVALID;
1361                 cec_post_state_event(adap);
1362                 cec_adap_unconfigure(adap);
1363                 /* Disabling monitor all mode should always succeed */
1364                 if (adap->monitor_all_cnt)
1365                         WARN_ON(call_op(adap, adap_monitor_all_enable, false));
1366                 mutex_lock(&adap->devnode.lock);
1367                 if (list_empty(&adap->devnode.fhs))
1368                         WARN_ON(adap->ops->adap_enable(adap, false));
1369                 mutex_unlock(&adap->devnode.lock);
1370                 if (phys_addr == CEC_PHYS_ADDR_INVALID)
1371                         return;
1372         }
1373
1374         mutex_lock(&adap->devnode.lock);
1375         if (list_empty(&adap->devnode.fhs) &&
1376             adap->ops->adap_enable(adap, true)) {
1377                 mutex_unlock(&adap->devnode.lock);
1378                 return;
1379         }
1380
1381         if (adap->monitor_all_cnt &&
1382             call_op(adap, adap_monitor_all_enable, true)) {
1383                 if (list_empty(&adap->devnode.fhs))
1384                         WARN_ON(adap->ops->adap_enable(adap, false));
1385                 mutex_unlock(&adap->devnode.lock);
1386                 return;
1387         }
1388         mutex_unlock(&adap->devnode.lock);
1389
1390         adap->phys_addr = phys_addr;
1391         cec_post_state_event(adap);
1392         if (adap->log_addrs.num_log_addrs)
1393                 cec_claim_log_addrs(adap, block);
1394 }
1395
1396 void cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)
1397 {
1398         if (IS_ERR_OR_NULL(adap))
1399                 return;
1400
1401         mutex_lock(&adap->lock);
1402         __cec_s_phys_addr(adap, phys_addr, block);
1403         mutex_unlock(&adap->lock);
1404 }
1405 EXPORT_SYMBOL_GPL(cec_s_phys_addr);
1406
1407 /*
1408  * Called from either the ioctl or a driver to set the logical addresses.
1409  *
1410  * This function is called with adap->lock held.
1411  */
1412 int __cec_s_log_addrs(struct cec_adapter *adap,
1413                       struct cec_log_addrs *log_addrs, bool block)
1414 {
1415         u16 type_mask = 0;
1416         int i;
1417
1418         if (adap->devnode.unregistered)
1419                 return -ENODEV;
1420
1421         if (!log_addrs || log_addrs->num_log_addrs == 0) {
1422                 adap->log_addrs.num_log_addrs = 0;
1423                 cec_adap_unconfigure(adap);
1424                 return 0;
1425         }
1426
1427         if (log_addrs->flags & CEC_LOG_ADDRS_FL_CDC_ONLY) {
1428                 /*
1429                  * Sanitize log_addrs fields if a CDC-Only device is
1430                  * requested.
1431                  */
1432                 log_addrs->num_log_addrs = 1;
1433                 log_addrs->osd_name[0] = '\0';
1434                 log_addrs->vendor_id = CEC_VENDOR_ID_NONE;
1435                 log_addrs->log_addr_type[0] = CEC_LOG_ADDR_TYPE_UNREGISTERED;
1436                 /*
1437                  * This is just an internal convention since a CDC-Only device
1438                  * doesn't have to be a switch. But switches already use
1439                  * unregistered, so it makes some kind of sense to pick this
1440                  * as the primary device. Since a CDC-Only device never sends
1441                  * any 'normal' CEC messages this primary device type is never
1442                  * sent over the CEC bus.
1443                  */
1444                 log_addrs->primary_device_type[0] = CEC_OP_PRIM_DEVTYPE_SWITCH;
1445                 log_addrs->all_device_types[0] = 0;
1446                 log_addrs->features[0][0] = 0;
1447                 log_addrs->features[0][1] = 0;
1448         }
1449
1450         /* Ensure the osd name is 0-terminated */
1451         log_addrs->osd_name[sizeof(log_addrs->osd_name) - 1] = '\0';
1452
1453         /* Sanity checks */
1454         if (log_addrs->num_log_addrs > adap->available_log_addrs) {
1455                 dprintk(1, "num_log_addrs > %d\n", adap->available_log_addrs);
1456                 return -EINVAL;
1457         }
1458
1459         /*
1460          * Vendor ID is a 24 bit number, so check if the value is
1461          * within the correct range.
1462          */
1463         if (log_addrs->vendor_id != CEC_VENDOR_ID_NONE &&
1464             (log_addrs->vendor_id & 0xff000000) != 0) {
1465                 dprintk(1, "invalid vendor ID\n");
1466                 return -EINVAL;
1467         }
1468
1469         if (log_addrs->cec_version != CEC_OP_CEC_VERSION_1_4 &&
1470             log_addrs->cec_version != CEC_OP_CEC_VERSION_2_0) {
1471                 dprintk(1, "invalid CEC version\n");
1472                 return -EINVAL;
1473         }
1474
1475         if (log_addrs->num_log_addrs > 1)
1476                 for (i = 0; i < log_addrs->num_log_addrs; i++)
1477                         if (log_addrs->log_addr_type[i] ==
1478                                         CEC_LOG_ADDR_TYPE_UNREGISTERED) {
1479                                 dprintk(1, "num_log_addrs > 1 can't be combined with unregistered LA\n");
1480                                 return -EINVAL;
1481                         }
1482
1483         for (i = 0; i < log_addrs->num_log_addrs; i++) {
1484                 const u8 feature_sz = ARRAY_SIZE(log_addrs->features[0]);
1485                 u8 *features = log_addrs->features[i];
1486                 bool op_is_dev_features = false;
1487                 unsigned j;
1488
1489                 log_addrs->log_addr[i] = CEC_LOG_ADDR_INVALID;
1490                 if (type_mask & (1 << log_addrs->log_addr_type[i])) {
1491                         dprintk(1, "duplicate logical address type\n");
1492                         return -EINVAL;
1493                 }
1494                 type_mask |= 1 << log_addrs->log_addr_type[i];
1495                 if ((type_mask & (1 << CEC_LOG_ADDR_TYPE_RECORD)) &&
1496                     (type_mask & (1 << CEC_LOG_ADDR_TYPE_PLAYBACK))) {
1497                         /* Record already contains the playback functionality */
1498                         dprintk(1, "invalid record + playback combination\n");
1499                         return -EINVAL;
1500                 }
1501                 if (log_addrs->primary_device_type[i] >
1502                                         CEC_OP_PRIM_DEVTYPE_PROCESSOR) {
1503                         dprintk(1, "unknown primary device type\n");
1504                         return -EINVAL;
1505                 }
1506                 if (log_addrs->primary_device_type[i] == 2) {
1507                         dprintk(1, "invalid primary device type\n");
1508                         return -EINVAL;
1509                 }
1510                 if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) {
1511                         dprintk(1, "unknown logical address type\n");
1512                         return -EINVAL;
1513                 }
1514                 for (j = 0; j < feature_sz; j++) {
1515                         if ((features[j] & 0x80) == 0) {
1516                                 if (op_is_dev_features)
1517                                         break;
1518                                 op_is_dev_features = true;
1519                         }
1520                 }
1521                 if (!op_is_dev_features || j == feature_sz) {
1522                         dprintk(1, "malformed features\n");
1523                         return -EINVAL;
1524                 }
1525                 /* Zero unused part of the feature array */
1526                 memset(features + j + 1, 0, feature_sz - j - 1);
1527         }
1528
1529         if (log_addrs->cec_version >= CEC_OP_CEC_VERSION_2_0) {
1530                 if (log_addrs->num_log_addrs > 2) {
1531                         dprintk(1, "CEC 2.0 allows no more than 2 logical addresses\n");
1532                         return -EINVAL;
1533                 }
1534                 if (log_addrs->num_log_addrs == 2) {
1535                         if (!(type_mask & ((1 << CEC_LOG_ADDR_TYPE_AUDIOSYSTEM) |
1536                                            (1 << CEC_LOG_ADDR_TYPE_TV)))) {
1537                                 dprintk(1, "Two LAs is only allowed for audiosystem and TV\n");
1538                                 return -EINVAL;
1539                         }
1540                         if (!(type_mask & ((1 << CEC_LOG_ADDR_TYPE_PLAYBACK) |
1541                                            (1 << CEC_LOG_ADDR_TYPE_RECORD)))) {
1542                                 dprintk(1, "An audiosystem/TV can only be combined with record or playback\n");
1543                                 return -EINVAL;
1544                         }
1545                 }
1546         }
1547
1548         /* Zero unused LAs */
1549         for (i = log_addrs->num_log_addrs; i < CEC_MAX_LOG_ADDRS; i++) {
1550                 log_addrs->primary_device_type[i] = 0;
1551                 log_addrs->log_addr_type[i] = 0;
1552                 log_addrs->all_device_types[i] = 0;
1553                 memset(log_addrs->features[i], 0,
1554                        sizeof(log_addrs->features[i]));
1555         }
1556
1557         log_addrs->log_addr_mask = adap->log_addrs.log_addr_mask;
1558         adap->log_addrs = *log_addrs;
1559         if (adap->phys_addr != CEC_PHYS_ADDR_INVALID)
1560                 cec_claim_log_addrs(adap, block);
1561         return 0;
1562 }
1563
1564 int cec_s_log_addrs(struct cec_adapter *adap,
1565                     struct cec_log_addrs *log_addrs, bool block)
1566 {
1567         int err;
1568
1569         mutex_lock(&adap->lock);
1570         err = __cec_s_log_addrs(adap, log_addrs, block);
1571         mutex_unlock(&adap->lock);
1572         return err;
1573 }
1574 EXPORT_SYMBOL_GPL(cec_s_log_addrs);
1575
1576 /* High-level core CEC message handling */
1577
1578 /* Fill in the Report Features message */
1579 static void cec_fill_msg_report_features(struct cec_adapter *adap,
1580                                          struct cec_msg *msg,
1581                                          unsigned int la_idx)
1582 {
1583         const struct cec_log_addrs *las = &adap->log_addrs;
1584         const u8 *features = las->features[la_idx];
1585         bool op_is_dev_features = false;
1586         unsigned int idx;
1587
1588         /* Report Features */
1589         msg->msg[0] = (las->log_addr[la_idx] << 4) | 0x0f;
1590         msg->len = 4;
1591         msg->msg[1] = CEC_MSG_REPORT_FEATURES;
1592         msg->msg[2] = adap->log_addrs.cec_version;
1593         msg->msg[3] = las->all_device_types[la_idx];
1594
1595         /* Write RC Profiles first, then Device Features */
1596         for (idx = 0; idx < ARRAY_SIZE(las->features[0]); idx++) {
1597                 msg->msg[msg->len++] = features[idx];
1598                 if ((features[idx] & CEC_OP_FEAT_EXT) == 0) {
1599                         if (op_is_dev_features)
1600                                 break;
1601                         op_is_dev_features = true;
1602                 }
1603         }
1604 }
1605
1606 /* Transmit the Feature Abort message */
1607 static int cec_feature_abort_reason(struct cec_adapter *adap,
1608                                     struct cec_msg *msg, u8 reason)
1609 {
1610         struct cec_msg tx_msg = { };
1611
1612         /*
1613          * Don't reply with CEC_MSG_FEATURE_ABORT to a CEC_MSG_FEATURE_ABORT
1614          * message!
1615          */
1616         if (msg->msg[1] == CEC_MSG_FEATURE_ABORT)
1617                 return 0;
1618         /* Don't Feature Abort messages from 'Unregistered' */
1619         if (cec_msg_initiator(msg) == CEC_LOG_ADDR_UNREGISTERED)
1620                 return 0;
1621         cec_msg_set_reply_to(&tx_msg, msg);
1622         cec_msg_feature_abort(&tx_msg, msg->msg[1], reason);
1623         return cec_transmit_msg(adap, &tx_msg, false);
1624 }
1625
1626 static int cec_feature_abort(struct cec_adapter *adap, struct cec_msg *msg)
1627 {
1628         return cec_feature_abort_reason(adap, msg,
1629                                         CEC_OP_ABORT_UNRECOGNIZED_OP);
1630 }
1631
1632 static int cec_feature_refused(struct cec_adapter *adap, struct cec_msg *msg)
1633 {
1634         return cec_feature_abort_reason(adap, msg,
1635                                         CEC_OP_ABORT_REFUSED);
1636 }
1637
1638 /*
1639  * Called when a CEC message is received. This function will do any
1640  * necessary core processing. The is_reply bool is true if this message
1641  * is a reply to an earlier transmit.
1642  *
1643  * The message is either a broadcast message or a valid directed message.
1644  */
1645 static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
1646                               bool is_reply)
1647 {
1648         bool is_broadcast = cec_msg_is_broadcast(msg);
1649         u8 dest_laddr = cec_msg_destination(msg);
1650         u8 init_laddr = cec_msg_initiator(msg);
1651         u8 devtype = cec_log_addr2dev(adap, dest_laddr);
1652         int la_idx = cec_log_addr2idx(adap, dest_laddr);
1653         bool from_unregistered = init_laddr == 0xf;
1654         struct cec_msg tx_cec_msg = { };
1655
1656         dprintk(1, "cec_receive_notify: %*ph\n", msg->len, msg->msg);
1657
1658         /* If this is a CDC-Only device, then ignore any non-CDC messages */
1659         if (cec_is_cdc_only(&adap->log_addrs) &&
1660             msg->msg[1] != CEC_MSG_CDC_MESSAGE)
1661                 return 0;
1662
1663         if (adap->ops->received) {
1664                 /* Allow drivers to process the message first */
1665                 if (adap->ops->received(adap, msg) != -ENOMSG)
1666                         return 0;
1667         }
1668
1669         /*
1670          * REPORT_PHYSICAL_ADDR, CEC_MSG_USER_CONTROL_PRESSED and
1671          * CEC_MSG_USER_CONTROL_RELEASED messages always have to be
1672          * handled by the CEC core, even if the passthrough mode is on.
1673          * The others are just ignored if passthrough mode is on.
1674          */
1675         switch (msg->msg[1]) {
1676         case CEC_MSG_GET_CEC_VERSION:
1677         case CEC_MSG_GIVE_DEVICE_VENDOR_ID:
1678         case CEC_MSG_ABORT:
1679         case CEC_MSG_GIVE_DEVICE_POWER_STATUS:
1680         case CEC_MSG_GIVE_PHYSICAL_ADDR:
1681         case CEC_MSG_GIVE_OSD_NAME:
1682         case CEC_MSG_GIVE_FEATURES:
1683                 /*
1684                  * Skip processing these messages if the passthrough mode
1685                  * is on.
1686                  */
1687                 if (adap->passthrough)
1688                         goto skip_processing;
1689                 /* Ignore if addressing is wrong */
1690                 if (is_broadcast || from_unregistered)
1691                         return 0;
1692                 break;
1693
1694         case CEC_MSG_USER_CONTROL_PRESSED:
1695         case CEC_MSG_USER_CONTROL_RELEASED:
1696                 /* Wrong addressing mode: don't process */
1697                 if (is_broadcast || from_unregistered)
1698                         goto skip_processing;
1699                 break;
1700
1701         case CEC_MSG_REPORT_PHYSICAL_ADDR:
1702                 /*
1703                  * This message is always processed, regardless of the
1704                  * passthrough setting.
1705                  *
1706                  * Exception: don't process if wrong addressing mode.
1707                  */
1708                 if (!is_broadcast)
1709                         goto skip_processing;
1710                 break;
1711
1712         default:
1713                 break;
1714         }
1715
1716         cec_msg_set_reply_to(&tx_cec_msg, msg);
1717
1718         switch (msg->msg[1]) {
1719         /* The following messages are processed but still passed through */
1720         case CEC_MSG_REPORT_PHYSICAL_ADDR: {
1721                 u16 pa = (msg->msg[2] << 8) | msg->msg[3];
1722
1723                 if (!from_unregistered)
1724                         adap->phys_addrs[init_laddr] = pa;
1725                 dprintk(1, "Reported physical address %x.%x.%x.%x for logical address %d\n",
1726                         cec_phys_addr_exp(pa), init_laddr);
1727                 break;
1728         }
1729
1730         case CEC_MSG_USER_CONTROL_PRESSED:
1731                 if (!(adap->capabilities & CEC_CAP_RC) ||
1732                     !(adap->log_addrs.flags & CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU))
1733                         break;
1734
1735 #ifdef CONFIG_MEDIA_CEC_RC
1736                 switch (msg->msg[2]) {
1737                 /*
1738                  * Play function, this message can have variable length
1739                  * depending on the specific play function that is used.
1740                  */
1741                 case 0x60:
1742                         if (msg->len == 2)
1743                                 rc_keydown(adap->rc, RC_TYPE_CEC,
1744                                            msg->msg[2], 0);
1745                         else
1746                                 rc_keydown(adap->rc, RC_TYPE_CEC,
1747                                            msg->msg[2] << 8 | msg->msg[3], 0);
1748                         break;
1749                 /*
1750                  * Other function messages that are not handled.
1751                  * Currently the RC framework does not allow to supply an
1752                  * additional parameter to a keypress. These "keys" contain
1753                  * other information such as channel number, an input number
1754                  * etc.
1755                  * For the time being these messages are not processed by the
1756                  * framework and are simply forwarded to the user space.
1757                  */
1758                 case 0x56: case 0x57:
1759                 case 0x67: case 0x68: case 0x69: case 0x6a:
1760                         break;
1761                 default:
1762                         rc_keydown(adap->rc, RC_TYPE_CEC, msg->msg[2], 0);
1763                         break;
1764                 }
1765 #endif
1766                 break;
1767
1768         case CEC_MSG_USER_CONTROL_RELEASED:
1769                 if (!(adap->capabilities & CEC_CAP_RC) ||
1770                     !(adap->log_addrs.flags & CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU))
1771                         break;
1772 #ifdef CONFIG_MEDIA_CEC_RC
1773                 rc_keyup(adap->rc);
1774 #endif
1775                 break;
1776
1777         /*
1778          * The remaining messages are only processed if the passthrough mode
1779          * is off.
1780          */
1781         case CEC_MSG_GET_CEC_VERSION:
1782                 cec_msg_cec_version(&tx_cec_msg, adap->log_addrs.cec_version);
1783                 return cec_transmit_msg(adap, &tx_cec_msg, false);
1784
1785         case CEC_MSG_GIVE_PHYSICAL_ADDR:
1786                 /* Do nothing for CEC switches using addr 15 */
1787                 if (devtype == CEC_OP_PRIM_DEVTYPE_SWITCH && dest_laddr == 15)
1788                         return 0;
1789                 cec_msg_report_physical_addr(&tx_cec_msg, adap->phys_addr, devtype);
1790                 return cec_transmit_msg(adap, &tx_cec_msg, false);
1791
1792         case CEC_MSG_GIVE_DEVICE_VENDOR_ID:
1793                 if (adap->log_addrs.vendor_id == CEC_VENDOR_ID_NONE)
1794                         return cec_feature_abort(adap, msg);
1795                 cec_msg_device_vendor_id(&tx_cec_msg, adap->log_addrs.vendor_id);
1796                 return cec_transmit_msg(adap, &tx_cec_msg, false);
1797
1798         case CEC_MSG_ABORT:
1799                 /* Do nothing for CEC switches */
1800                 if (devtype == CEC_OP_PRIM_DEVTYPE_SWITCH)
1801                         return 0;
1802                 return cec_feature_refused(adap, msg);
1803
1804         case CEC_MSG_GIVE_OSD_NAME: {
1805                 if (adap->log_addrs.osd_name[0] == 0)
1806                         return cec_feature_abort(adap, msg);
1807                 cec_msg_set_osd_name(&tx_cec_msg, adap->log_addrs.osd_name);
1808                 return cec_transmit_msg(adap, &tx_cec_msg, false);
1809         }
1810
1811         case CEC_MSG_GIVE_FEATURES:
1812                 if (adap->log_addrs.cec_version < CEC_OP_CEC_VERSION_2_0)
1813                         return cec_feature_abort(adap, msg);
1814                 cec_fill_msg_report_features(adap, &tx_cec_msg, la_idx);
1815                 return cec_transmit_msg(adap, &tx_cec_msg, false);
1816
1817         default:
1818                 /*
1819                  * Unprocessed messages are aborted if userspace isn't doing
1820                  * any processing either.
1821                  */
1822                 if (!is_broadcast && !is_reply && !adap->follower_cnt &&
1823                     !adap->cec_follower && msg->msg[1] != CEC_MSG_FEATURE_ABORT)
1824                         return cec_feature_abort(adap, msg);
1825                 break;
1826         }
1827
1828 skip_processing:
1829         /* If this was a reply, then we're done, unless otherwise specified */
1830         if (is_reply && !(msg->flags & CEC_MSG_FL_REPLY_TO_FOLLOWERS))
1831                 return 0;
1832
1833         /*
1834          * Send to the exclusive follower if there is one, otherwise send
1835          * to all followers.
1836          */
1837         if (adap->cec_follower)
1838                 cec_queue_msg_fh(adap->cec_follower, msg);
1839         else
1840                 cec_queue_msg_followers(adap, msg);
1841         return 0;
1842 }
1843
1844 /*
1845  * Helper functions to keep track of the 'monitor all' use count.
1846  *
1847  * These functions are called with adap->lock held.
1848  */
1849 int cec_monitor_all_cnt_inc(struct cec_adapter *adap)
1850 {
1851         int ret = 0;
1852
1853         if (adap->monitor_all_cnt == 0)
1854                 ret = call_op(adap, adap_monitor_all_enable, 1);
1855         if (ret == 0)
1856                 adap->monitor_all_cnt++;
1857         return ret;
1858 }
1859
1860 void cec_monitor_all_cnt_dec(struct cec_adapter *adap)
1861 {
1862         adap->monitor_all_cnt--;
1863         if (adap->monitor_all_cnt == 0)
1864                 WARN_ON(call_op(adap, adap_monitor_all_enable, 0));
1865 }
1866
1867 #ifdef CONFIG_DEBUG_FS
1868 /*
1869  * Log the current state of the CEC adapter.
1870  * Very useful for debugging.
1871  */
1872 int cec_adap_status(struct seq_file *file, void *priv)
1873 {
1874         struct cec_adapter *adap = dev_get_drvdata(file->private);
1875         struct cec_data *data;
1876
1877         mutex_lock(&adap->lock);
1878         seq_printf(file, "configured: %d\n", adap->is_configured);
1879         seq_printf(file, "configuring: %d\n", adap->is_configuring);
1880         seq_printf(file, "phys_addr: %x.%x.%x.%x\n",
1881                    cec_phys_addr_exp(adap->phys_addr));
1882         seq_printf(file, "number of LAs: %d\n", adap->log_addrs.num_log_addrs);
1883         seq_printf(file, "LA mask: 0x%04x\n", adap->log_addrs.log_addr_mask);
1884         if (adap->cec_follower)
1885                 seq_printf(file, "has CEC follower%s\n",
1886                            adap->passthrough ? " (in passthrough mode)" : "");
1887         if (adap->cec_initiator)
1888                 seq_puts(file, "has CEC initiator\n");
1889         if (adap->monitor_all_cnt)
1890                 seq_printf(file, "file handles in Monitor All mode: %u\n",
1891                            adap->monitor_all_cnt);
1892         data = adap->transmitting;
1893         if (data)
1894                 seq_printf(file, "transmitting message: %*ph (reply: %02x, timeout: %ums)\n",
1895                            data->msg.len, data->msg.msg, data->msg.reply,
1896                            data->msg.timeout);
1897         seq_printf(file, "pending transmits: %u\n", adap->transmit_queue_sz);
1898         list_for_each_entry(data, &adap->transmit_queue, list) {
1899                 seq_printf(file, "queued tx message: %*ph (reply: %02x, timeout: %ums)\n",
1900                            data->msg.len, data->msg.msg, data->msg.reply,
1901                            data->msg.timeout);
1902         }
1903         list_for_each_entry(data, &adap->wait_queue, list) {
1904                 seq_printf(file, "message waiting for reply: %*ph (reply: %02x, timeout: %ums)\n",
1905                            data->msg.len, data->msg.msg, data->msg.reply,
1906                            data->msg.timeout);
1907         }
1908
1909         call_void_op(adap, adap_status, file);
1910         mutex_unlock(&adap->lock);
1911         return 0;
1912 }
1913 #endif