]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - drivers/media/rc/iguanair.c
media: venus: core: Fix a potential NULL pointer dereference in an error handling...
[mirror_ubuntu-jammy-kernel.git] / drivers / media / rc / iguanair.c
CommitLineData
c942fddf 1// SPDX-License-Identifier: GPL-2.0-or-later
26ff6313
SY
2/*
3 * IguanaWorks USB IR Transceiver support
4 *
5 * Copyright (C) 2012 Sean Young <sean@mess.org>
26ff6313
SY
6 */
7
8#include <linux/device.h>
9#include <linux/kernel.h>
10#include <linux/module.h>
11#include <linux/usb.h>
12#include <linux/usb/input.h>
13#include <linux/slab.h>
14#include <linux/completion.h>
15#include <media/rc-core.h>
16
48b0fa6a 17#define BUF_SIZE 152
26ff6313
SY
18
19struct iguanair {
20 struct rc_dev *rc;
21
22 struct device *dev;
23 struct usb_device *udev;
24
0797b480 25 uint16_t version;
26ff6313 26 uint8_t bufsize;
48b0fa6a 27 uint8_t cycle_overhead;
26ff6313 28
26ff6313
SY
29 /* receiver support */
30 bool receiver_on;
48b0fa6a 31 dma_addr_t dma_in, dma_out;
26ff6313 32 uint8_t *buf_in;
48b0fa6a 33 struct urb *urb_in, *urb_out;
26ff6313
SY
34 struct completion completion;
35
36 /* transmit support */
37 bool tx_overflow;
38 uint32_t carrier;
48b0fa6a 39 struct send_packet *packet;
26ff6313
SY
40
41 char name[64];
42 char phys[64];
43};
44
c6a3ea57 45#define CMD_NOP 0x00
26ff6313
SY
46#define CMD_GET_VERSION 0x01
47#define CMD_GET_BUFSIZE 0x11
48#define CMD_GET_FEATURES 0x10
49#define CMD_SEND 0x15
50#define CMD_EXECUTE 0x1f
51#define CMD_RX_OVERFLOW 0x31
52#define CMD_TX_OVERFLOW 0x32
53#define CMD_RECEIVER_ON 0x12
54#define CMD_RECEIVER_OFF 0x14
55
56#define DIR_IN 0xdc
57#define DIR_OUT 0xcd
58
48b0fa6a
SY
59#define MAX_IN_PACKET 8u
60#define MAX_OUT_PACKET (sizeof(struct send_packet) + BUF_SIZE)
26ff6313 61#define TIMEOUT 1000
528222d8 62#define RX_RESOLUTION 21
26ff6313
SY
63
64struct packet {
65 uint16_t start;
66 uint8_t direction;
67 uint8_t cmd;
68};
69
26ff6313
SY
70struct send_packet {
71 struct packet header;
72 uint8_t length;
73 uint8_t channels;
74 uint8_t busy7;
75 uint8_t busy4;
c8efa2c8 76 uint8_t payload[];
26ff6313
SY
77};
78
79static void process_ir_data(struct iguanair *ir, unsigned len)
80{
81 if (len >= 4 && ir->buf_in[0] == 0 && ir->buf_in[1] == 0) {
82 switch (ir->buf_in[3]) {
e99a7cfe
SY
83 case CMD_GET_VERSION:
84 if (len == 6) {
0797b480
SY
85 ir->version = (ir->buf_in[5] << 8) |
86 ir->buf_in[4];
e99a7cfe
SY
87 complete(&ir->completion);
88 }
89 break;
90 case CMD_GET_BUFSIZE:
91 if (len >= 5) {
92 ir->bufsize = ir->buf_in[4];
93 complete(&ir->completion);
94 }
95 break;
96 case CMD_GET_FEATURES:
97 if (len > 5) {
0797b480 98 ir->cycle_overhead = ir->buf_in[5];
e99a7cfe
SY
99 complete(&ir->completion);
100 }
101 break;
26ff6313
SY
102 case CMD_TX_OVERFLOW:
103 ir->tx_overflow = true;
1771e9fb 104 fallthrough;
26ff6313
SY
105 case CMD_RECEIVER_OFF:
106 case CMD_RECEIVER_ON:
107 case CMD_SEND:
108 complete(&ir->completion);
109 break;
110 case CMD_RX_OVERFLOW:
111 dev_warn(ir->dev, "receive overflow\n");
116e4f59 112 ir_raw_event_reset(ir->rc);
26ff6313
SY
113 break;
114 default:
115 dev_warn(ir->dev, "control code %02x received\n",
116 ir->buf_in[3]);
117 break;
118 }
119 } else if (len >= 7) {
183e19f5 120 struct ir_raw_event rawir = {};
26ff6313 121 unsigned i;
b83bfd1b 122 bool event = false;
26ff6313 123
26ff6313
SY
124 for (i = 0; i < 7; i++) {
125 if (ir->buf_in[i] == 0x80) {
126 rawir.pulse = false;
528222d8 127 rawir.duration = 21845;
26ff6313
SY
128 } else {
129 rawir.pulse = (ir->buf_in[i] & 0x80) == 0;
130 rawir.duration = ((ir->buf_in[i] & 0x7f) + 1) *
2eec676c 131 RX_RESOLUTION;
26ff6313
SY
132 }
133
b83bfd1b
SY
134 if (ir_raw_event_store_with_filter(ir->rc, &rawir))
135 event = true;
26ff6313
SY
136 }
137
b83bfd1b
SY
138 if (event)
139 ir_raw_event_handle(ir->rc);
26ff6313
SY
140 }
141}
142
143static void iguanair_rx(struct urb *urb)
144{
145 struct iguanair *ir;
7c0bd96b 146 int rc;
26ff6313
SY
147
148 if (!urb)
149 return;
150
151 ir = urb->context;
152 if (!ir) {
153 usb_unlink_urb(urb);
154 return;
155 }
156
157 switch (urb->status) {
158 case 0:
159 process_ir_data(ir, urb->actual_length);
160 break;
161 case -ECONNRESET:
162 case -ENOENT:
163 case -ESHUTDOWN:
164 usb_unlink_urb(urb);
165 return;
166 case -EPIPE:
167 default:
168 dev_dbg(ir->dev, "Error: urb status = %d\n", urb->status);
169 break;
170 }
171
7c0bd96b
SY
172 rc = usb_submit_urb(urb, GFP_ATOMIC);
173 if (rc && rc != -ENODEV)
174 dev_warn(ir->dev, "failed to resubmit urb: %d\n", rc);
26ff6313
SY
175}
176
48b0fa6a 177static void iguanair_irq_out(struct urb *urb)
26ff6313 178{
48b0fa6a
SY
179 struct iguanair *ir = urb->context;
180
181 if (urb->status)
182 dev_dbg(ir->dev, "Error: out urb status = %d\n", urb->status);
c6a3ea57
SY
183
184 /* if we sent an nop packet, do not expect a response */
185 if (urb->status == 0 && ir->packet->header.cmd == CMD_NOP)
186 complete(&ir->completion);
48b0fa6a
SY
187}
188
189static int iguanair_send(struct iguanair *ir, unsigned size)
190{
191 int rc;
26ff6313 192
16735d02 193 reinit_completion(&ir->completion);
26ff6313 194
48b0fa6a
SY
195 ir->urb_out->transfer_buffer_length = size;
196 rc = usb_submit_urb(ir->urb_out, GFP_KERNEL);
e99a7cfe
SY
197 if (rc)
198 return rc;
26ff6313 199
e99a7cfe
SY
200 if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0)
201 return -ETIMEDOUT;
26ff6313
SY
202
203 return rc;
204}
205
206static int iguanair_get_features(struct iguanair *ir)
207{
e99a7cfe 208 int rc;
26ff6313 209
c6a3ea57
SY
210 /*
211 * On cold boot, the iguanair initializes on the first packet
212 * received but does not process that packet. Send an empty
213 * packet.
214 */
48b0fa6a
SY
215 ir->packet->header.start = 0;
216 ir->packet->header.direction = DIR_OUT;
c6a3ea57
SY
217 ir->packet->header.cmd = CMD_NOP;
218 iguanair_send(ir, sizeof(ir->packet->header));
26ff6313 219
c6a3ea57 220 ir->packet->header.cmd = CMD_GET_VERSION;
48b0fa6a 221 rc = iguanair_send(ir, sizeof(ir->packet->header));
26ff6313
SY
222 if (rc) {
223 dev_info(ir->dev, "failed to get version\n");
224 goto out;
225 }
226
0797b480
SY
227 if (ir->version < 0x205) {
228 dev_err(ir->dev, "firmware 0x%04x is too old\n", ir->version);
229 rc = -ENODEV;
230 goto out;
231 }
232
26ff6313
SY
233 ir->bufsize = 150;
234 ir->cycle_overhead = 65;
235
48b0fa6a 236 ir->packet->header.cmd = CMD_GET_BUFSIZE;
26ff6313 237
48b0fa6a 238 rc = iguanair_send(ir, sizeof(ir->packet->header));
26ff6313
SY
239 if (rc) {
240 dev_info(ir->dev, "failed to get buffer size\n");
241 goto out;
242 }
243
48b0fa6a
SY
244 if (ir->bufsize > BUF_SIZE) {
245 dev_info(ir->dev, "buffer size %u larger than expected\n",
246 ir->bufsize);
247 ir->bufsize = BUF_SIZE;
248 }
249
250 ir->packet->header.cmd = CMD_GET_FEATURES;
26ff6313 251
48b0fa6a 252 rc = iguanair_send(ir, sizeof(ir->packet->header));
c6a3ea57 253 if (rc)
26ff6313 254 dev_info(ir->dev, "failed to get features\n");
26ff6313
SY
255out:
256 return rc;
257}
258
259static int iguanair_receiver(struct iguanair *ir, bool enable)
260{
48b0fa6a
SY
261 ir->packet->header.start = 0;
262 ir->packet->header.direction = DIR_OUT;
263 ir->packet->header.cmd = enable ? CMD_RECEIVER_ON : CMD_RECEIVER_OFF;
26ff6313 264
116e4f59
SY
265 if (enable)
266 ir_raw_event_reset(ir->rc);
267
c6a3ea57 268 return iguanair_send(ir, sizeof(ir->packet->header));
26ff6313
SY
269}
270
271/*
dd3a5a1e
SY
272 * The iguanair creates the carrier by busy spinning after each half period.
273 * This is counted in CPU cycles, with the CPU running at 24MHz. It is
26ff6313 274 * broken down into 7-cycles and 4-cyles delays, with a preference for
dd3a5a1e 275 * 4-cycle delays, minus the overhead of the loop itself (cycle_overhead).
26ff6313
SY
276 */
277static int iguanair_set_tx_carrier(struct rc_dev *dev, uint32_t carrier)
278{
279 struct iguanair *ir = dev->priv;
280
281 if (carrier < 25000 || carrier > 150000)
282 return -EINVAL;
283
26ff6313
SY
284 if (carrier != ir->carrier) {
285 uint32_t cycles, fours, sevens;
286
287 ir->carrier = carrier;
288
289 cycles = DIV_ROUND_CLOSEST(24000000, carrier * 2) -
290 ir->cycle_overhead;
291
9bd766b7
SY
292 /*
293 * Calculate minimum number of 7 cycles needed so
294 * we are left with a multiple of 4; so we want to have
295 * (sevens * 7) & 3 == cycles & 3
296 */
297 sevens = (4 - cycles) & 3;
26ff6313
SY
298 fours = (cycles - sevens * 7) / 4;
299
dd3a5a1e
SY
300 /*
301 * The firmware interprets these values as a relative offset
302 * for a branch. Immediately following the branches, there
303 * 4 instructions of 7 cycles (2 bytes each) and 110
304 * instructions of 4 cycles (1 byte each). A relative branch
305 * of 0 will execute all of them, branch further for less
306 * cycle burning.
307 */
48b0fa6a
SY
308 ir->packet->busy7 = (4 - sevens) * 2;
309 ir->packet->busy4 = 110 - fours;
26ff6313
SY
310 }
311
14d8188a 312 return 0;
26ff6313
SY
313}
314
315static int iguanair_set_tx_mask(struct rc_dev *dev, uint32_t mask)
316{
317 struct iguanair *ir = dev->priv;
318
319 if (mask > 15)
320 return 4;
321
48b0fa6a 322 ir->packet->channels = mask << 4;
26ff6313
SY
323
324 return 0;
325}
326
327static int iguanair_tx(struct rc_dev *dev, unsigned *txbuf, unsigned count)
328{
329 struct iguanair *ir = dev->priv;
b996157d 330 unsigned int i, size, p, periods;
3920631c 331 int rc;
26ff6313 332
26ff6313 333 /* convert from us to carrier periods */
b996157d 334 for (i = size = 0; i < count; i++) {
3920631c 335 periods = DIV_ROUND_CLOSEST(txbuf[i] * ir->carrier, 1000000);
776eced0 336 while (periods) {
b996157d
SY
337 p = min(periods, 127u);
338 if (size >= ir->bufsize) {
339 rc = -EINVAL;
340 goto out;
341 }
342 ir->packet->payload[size++] = p | ((i & 1) ? 0x80 : 0);
776eced0 343 periods -= p;
3920631c 344 }
26ff6313
SY
345 }
346
48b0fa6a
SY
347 ir->packet->header.start = 0;
348 ir->packet->header.direction = DIR_OUT;
349 ir->packet->header.cmd = CMD_SEND;
350 ir->packet->length = size;
26ff6313
SY
351
352 ir->tx_overflow = false;
353
48b0fa6a 354 rc = iguanair_send(ir, sizeof(*ir->packet) + size);
26ff6313 355
e99a7cfe
SY
356 if (rc == 0 && ir->tx_overflow)
357 rc = -EOVERFLOW;
26ff6313 358
26ff6313 359out:
884bfd08 360 return rc ? rc : count;
26ff6313
SY
361}
362
363static int iguanair_open(struct rc_dev *rdev)
364{
365 struct iguanair *ir = rdev->priv;
366 int rc;
367
26ff6313
SY
368 rc = iguanair_receiver(ir, true);
369 if (rc == 0)
370 ir->receiver_on = true;
371
26ff6313
SY
372 return rc;
373}
374
375static void iguanair_close(struct rc_dev *rdev)
376{
377 struct iguanair *ir = rdev->priv;
378 int rc;
379
26ff6313
SY
380 rc = iguanair_receiver(ir, false);
381 ir->receiver_on = false;
7c0bd96b 382 if (rc && rc != -ENODEV)
26ff6313 383 dev_warn(ir->dev, "failed to disable receiver: %d\n", rc);
26ff6313
SY
384}
385
4c62e976
GKH
386static int iguanair_probe(struct usb_interface *intf,
387 const struct usb_device_id *id)
26ff6313
SY
388{
389 struct usb_device *udev = interface_to_usbdev(intf);
390 struct iguanair *ir;
391 struct rc_dev *rc;
48b0fa6a 392 int ret, pipein, pipeout;
26ff6313
SY
393 struct usb_host_interface *idesc;
394
1b257870 395 idesc = intf->cur_altsetting;
ab1cbdf1
ON
396 if (idesc->desc.bNumEndpoints < 2)
397 return -ENODEV;
398
26ff6313 399 ir = kzalloc(sizeof(*ir), GFP_KERNEL);
0f7499fd 400 rc = rc_allocate_device(RC_DRIVER_IR_RAW);
26ff6313 401 if (!ir || !rc) {
884bfd08 402 ret = -ENOMEM;
26ff6313
SY
403 goto out;
404 }
405
48b0fa6a 406 ir->buf_in = usb_alloc_coherent(udev, MAX_IN_PACKET, GFP_KERNEL,
26ff6313 407 &ir->dma_in);
48b0fa6a
SY
408 ir->packet = usb_alloc_coherent(udev, MAX_OUT_PACKET, GFP_KERNEL,
409 &ir->dma_out);
26ff6313 410 ir->urb_in = usb_alloc_urb(0, GFP_KERNEL);
48b0fa6a 411 ir->urb_out = usb_alloc_urb(0, GFP_KERNEL);
26ff6313 412
ab1cbdf1
ON
413 if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out ||
414 !usb_endpoint_is_int_in(&idesc->endpoint[0].desc) ||
415 !usb_endpoint_is_int_out(&idesc->endpoint[1].desc)) {
884bfd08 416 ret = -ENOMEM;
26ff6313
SY
417 goto out;
418 }
419
26ff6313
SY
420 ir->rc = rc;
421 ir->dev = &intf->dev;
422 ir->udev = udev;
48b0fa6a 423
26ff6313 424 init_completion(&ir->completion);
48b0fa6a
SY
425 pipeout = usb_sndintpipe(udev,
426 idesc->endpoint[1].desc.bEndpointAddress);
427 usb_fill_int_urb(ir->urb_out, udev, pipeout, ir->packet, MAX_OUT_PACKET,
428 iguanair_irq_out, ir, 1);
429 ir->urb_out->transfer_dma = ir->dma_out;
430 ir->urb_out->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
26ff6313 431
e99a7cfe 432 pipein = usb_rcvintpipe(udev, idesc->endpoint[0].desc.bEndpointAddress);
48b0fa6a 433 usb_fill_int_urb(ir->urb_in, udev, pipein, ir->buf_in, MAX_IN_PACKET,
64058383 434 iguanair_rx, ir, 1);
26ff6313
SY
435 ir->urb_in->transfer_dma = ir->dma_in;
436 ir->urb_in->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
437
e99a7cfe
SY
438 ret = usb_submit_urb(ir->urb_in, GFP_KERNEL);
439 if (ret) {
440 dev_warn(&intf->dev, "failed to submit urb: %d\n", ret);
441 goto out;
442 }
443
444 ret = iguanair_get_features(ir);
445 if (ret)
446 goto out2;
447
26ff6313 448 snprintf(ir->name, sizeof(ir->name),
0797b480 449 "IguanaWorks USB IR Transceiver version 0x%04x", ir->version);
26ff6313
SY
450
451 usb_make_path(ir->udev, ir->phys, sizeof(ir->phys));
452
518f4b26 453 rc->device_name = ir->name;
26ff6313
SY
454 rc->input_phys = ir->phys;
455 usb_to_input_id(ir->udev, &rc->input_id);
456 rc->dev.parent = &intf->dev;
6d741bfe 457 rc->allowed_protocols = RC_PROTO_BIT_ALL_IR_DECODER;
26ff6313
SY
458 rc->priv = ir;
459 rc->open = iguanair_open;
460 rc->close = iguanair_close;
461 rc->s_tx_mask = iguanair_set_tx_mask;
462 rc->s_tx_carrier = iguanair_set_tx_carrier;
463 rc->tx_ir = iguanair_tx;
fdb9e30e 464 rc->driver_name = KBUILD_MODNAME;
2eec676c 465 rc->map_name = RC_MAP_RC6_MCE;
56a6036c
SY
466 rc->min_timeout = 1;
467 rc->timeout = IR_DEFAULT_TIMEOUT;
468 rc->max_timeout = 10 * IR_DEFAULT_TIMEOUT;
2eec676c 469 rc->rx_resolution = RX_RESOLUTION;
26ff6313
SY
470
471 iguanair_set_tx_carrier(rc, 38000);
d0aab656 472 iguanair_set_tx_mask(rc, 0);
26ff6313
SY
473
474 ret = rc_register_device(rc);
475 if (ret < 0) {
476 dev_err(&intf->dev, "failed to register rc device %d", ret);
e99a7cfe 477 goto out2;
26ff6313
SY
478 }
479
480 usb_set_intfdata(intf, ir);
481
26ff6313 482 return 0;
e99a7cfe
SY
483out2:
484 usb_kill_urb(ir->urb_in);
48b0fa6a 485 usb_kill_urb(ir->urb_out);
26ff6313
SY
486out:
487 if (ir) {
488 usb_free_urb(ir->urb_in);
48b0fa6a
SY
489 usb_free_urb(ir->urb_out);
490 usb_free_coherent(udev, MAX_IN_PACKET, ir->buf_in, ir->dma_in);
491 usb_free_coherent(udev, MAX_OUT_PACKET, ir->packet,
492 ir->dma_out);
26ff6313
SY
493 }
494 rc_free_device(rc);
495 kfree(ir);
496 return ret;
497}
498
4c62e976 499static void iguanair_disconnect(struct usb_interface *intf)
26ff6313
SY
500{
501 struct iguanair *ir = usb_get_intfdata(intf);
502
7c0bd96b 503 rc_unregister_device(ir->rc);
26ff6313 504 usb_set_intfdata(intf, NULL);
26ff6313 505 usb_kill_urb(ir->urb_in);
48b0fa6a 506 usb_kill_urb(ir->urb_out);
26ff6313 507 usb_free_urb(ir->urb_in);
48b0fa6a
SY
508 usb_free_urb(ir->urb_out);
509 usb_free_coherent(ir->udev, MAX_IN_PACKET, ir->buf_in, ir->dma_in);
510 usb_free_coherent(ir->udev, MAX_OUT_PACKET, ir->packet, ir->dma_out);
26ff6313
SY
511 kfree(ir);
512}
513
514static int iguanair_suspend(struct usb_interface *intf, pm_message_t message)
515{
516 struct iguanair *ir = usb_get_intfdata(intf);
517 int rc = 0;
518
26ff6313
SY
519 if (ir->receiver_on) {
520 rc = iguanair_receiver(ir, false);
521 if (rc)
522 dev_warn(ir->dev, "failed to disable receiver for suspend\n");
523 }
524
7c0bd96b 525 usb_kill_urb(ir->urb_in);
48b0fa6a 526 usb_kill_urb(ir->urb_out);
7c0bd96b 527
26ff6313
SY
528 return rc;
529}
530
531static int iguanair_resume(struct usb_interface *intf)
532{
533 struct iguanair *ir = usb_get_intfdata(intf);
fdb9e30e 534 int rc;
26ff6313 535
7c0bd96b
SY
536 rc = usb_submit_urb(ir->urb_in, GFP_KERNEL);
537 if (rc)
538 dev_warn(&intf->dev, "failed to submit urb: %d\n", rc);
539
26ff6313
SY
540 if (ir->receiver_on) {
541 rc = iguanair_receiver(ir, true);
542 if (rc)
543 dev_warn(ir->dev, "failed to enable receiver after resume\n");
544 }
545
26ff6313
SY
546 return rc;
547}
548
549static const struct usb_device_id iguanair_table[] = {
550 { USB_DEVICE(0x1781, 0x0938) },
551 { }
552};
553
554static struct usb_driver iguanair_driver = {
fdb9e30e 555 .name = KBUILD_MODNAME,
26ff6313 556 .probe = iguanair_probe,
4c62e976 557 .disconnect = iguanair_disconnect,
26ff6313
SY
558 .suspend = iguanair_suspend,
559 .resume = iguanair_resume,
560 .reset_resume = iguanair_resume,
7c0bd96b
SY
561 .id_table = iguanair_table,
562 .soft_unbind = 1 /* we want to disable receiver on unbind */
26ff6313
SY
563};
564
565module_usb_driver(iguanair_driver);
566
567MODULE_DESCRIPTION("IguanaWorks USB IR Transceiver");
568MODULE_AUTHOR("Sean Young <sean@mess.org>");
569MODULE_LICENSE("GPL");
570MODULE_DEVICE_TABLE(usb, iguanair_table);
571