cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

keyspan_remote.c (15344B)


      1// SPDX-License-Identifier: GPL-2.0-only
      2/*
      3 * keyspan_remote: USB driver for the Keyspan DMR
      4 *
      5 * Copyright (C) 2005 Zymeta Corporation - Michael Downey (downey@zymeta.com)
      6 *
      7 * This driver has been put together with the support of Innosys, Inc.
      8 * and Keyspan, Inc the manufacturers of the Keyspan USB DMR product.
      9 */
     10
     11#include <linux/kernel.h>
     12#include <linux/errno.h>
     13#include <linux/slab.h>
     14#include <linux/module.h>
     15#include <linux/usb/input.h>
     16
     17/* Parameters that can be passed to the driver. */
     18static int debug;
     19module_param(debug, int, 0444);
     20MODULE_PARM_DESC(debug, "Enable extra debug messages and information");
     21
     22/* Vendor and product ids */
     23#define USB_KEYSPAN_VENDOR_ID		0x06CD
     24#define USB_KEYSPAN_PRODUCT_UIA11	0x0202
     25
     26/* Defines for converting the data from the remote. */
     27#define ZERO		0x18
     28#define ZERO_MASK	0x1F	/* 5 bits for a 0 */
     29#define ONE		0x3C
     30#define ONE_MASK	0x3F	/* 6 bits for a 1 */
     31#define SYNC		0x3F80
     32#define SYNC_MASK	0x3FFF	/* 14 bits for a SYNC sequence */
     33#define STOP		0x00
     34#define STOP_MASK	0x1F	/* 5 bits for the STOP sequence */
     35#define GAP		0xFF
     36
     37#define RECV_SIZE	8	/* The UIA-11 type have a 8 byte limit. */
     38
     39/*
     40 * Table that maps the 31 possible keycodes to input keys.
     41 * Currently there are 15 and 17 button models so RESERVED codes
     42 * are blank areas in the mapping.
     43 */
     44static const unsigned short keyspan_key_table[] = {
     45	KEY_RESERVED,		/* 0 is just a place holder. */
     46	KEY_RESERVED,
     47	KEY_STOP,
     48	KEY_PLAYCD,
     49	KEY_RESERVED,
     50	KEY_PREVIOUSSONG,
     51	KEY_REWIND,
     52	KEY_FORWARD,
     53	KEY_NEXTSONG,
     54	KEY_RESERVED,
     55	KEY_RESERVED,
     56	KEY_RESERVED,
     57	KEY_PAUSE,
     58	KEY_VOLUMEUP,
     59	KEY_RESERVED,
     60	KEY_RESERVED,
     61	KEY_RESERVED,
     62	KEY_VOLUMEDOWN,
     63	KEY_RESERVED,
     64	KEY_UP,
     65	KEY_RESERVED,
     66	KEY_MUTE,
     67	KEY_LEFT,
     68	KEY_ENTER,
     69	KEY_RIGHT,
     70	KEY_RESERVED,
     71	KEY_RESERVED,
     72	KEY_DOWN,
     73	KEY_RESERVED,
     74	KEY_KPASTERISK,
     75	KEY_RESERVED,
     76	KEY_MENU
     77};
     78
     79/* table of devices that work with this driver */
     80static const struct usb_device_id keyspan_table[] = {
     81	{ USB_DEVICE(USB_KEYSPAN_VENDOR_ID, USB_KEYSPAN_PRODUCT_UIA11) },
     82	{ }					/* Terminating entry */
     83};
     84
     85/* Structure to store all the real stuff that a remote sends to us. */
     86struct keyspan_message {
     87	u16	system;
     88	u8	button;
     89	u8	toggle;
     90};
     91
     92/* Structure used for all the bit testing magic needed to be done. */
     93struct bit_tester {
     94	u32	tester;
     95	int	len;
     96	int	pos;
     97	int	bits_left;
     98	u8	buffer[32];
     99};
    100
    101/* Structure to hold all of our driver specific stuff */
    102struct usb_keyspan {
    103	char				name[128];
    104	char				phys[64];
    105	unsigned short			keymap[ARRAY_SIZE(keyspan_key_table)];
    106	struct usb_device		*udev;
    107	struct input_dev		*input;
    108	struct usb_interface		*interface;
    109	struct usb_endpoint_descriptor	*in_endpoint;
    110	struct urb*			irq_urb;
    111	int				open;
    112	dma_addr_t			in_dma;
    113	unsigned char			*in_buffer;
    114
    115	/* variables used to parse messages from remote. */
    116	struct bit_tester		data;
    117	int				stage;
    118	int				toggle;
    119};
    120
    121static struct usb_driver keyspan_driver;
    122
    123/*
    124 * Debug routine that prints out what we've received from the remote.
    125 */
    126static void keyspan_print(struct usb_keyspan* dev) /*unsigned char* data)*/
    127{
    128	char codes[4 * RECV_SIZE];
    129	int i;
    130
    131	for (i = 0; i < RECV_SIZE; i++)
    132		snprintf(codes + i * 3, 4, "%02x ", dev->in_buffer[i]);
    133
    134	dev_info(&dev->udev->dev, "%s\n", codes);
    135}
    136
    137/*
    138 * Routine that manages the bit_tester structure.  It makes sure that there are
    139 * at least bits_needed bits loaded into the tester.
    140 */
    141static int keyspan_load_tester(struct usb_keyspan* dev, int bits_needed)
    142{
    143	if (dev->data.bits_left >= bits_needed)
    144		return 0;
    145
    146	/*
    147	 * Somehow we've missed the last message. The message will be repeated
    148	 * though so it's not too big a deal
    149	 */
    150	if (dev->data.pos >= dev->data.len) {
    151		dev_dbg(&dev->interface->dev,
    152			"%s - Error ran out of data. pos: %d, len: %d\n",
    153			__func__, dev->data.pos, dev->data.len);
    154		return -1;
    155	}
    156
    157	/* Load as much as we can into the tester. */
    158	while ((dev->data.bits_left + 7 < (sizeof(dev->data.tester) * 8)) &&
    159	       (dev->data.pos < dev->data.len)) {
    160		dev->data.tester += (dev->data.buffer[dev->data.pos++] << dev->data.bits_left);
    161		dev->data.bits_left += 8;
    162	}
    163
    164	return 0;
    165}
    166
    167static void keyspan_report_button(struct usb_keyspan *remote, int button, int press)
    168{
    169	struct input_dev *input = remote->input;
    170
    171	input_event(input, EV_MSC, MSC_SCAN, button);
    172	input_report_key(input, remote->keymap[button], press);
    173	input_sync(input);
    174}
    175
    176/*
    177 * Routine that handles all the logic needed to parse out the message from the remote.
    178 */
    179static void keyspan_check_data(struct usb_keyspan *remote)
    180{
    181	int i;
    182	int found = 0;
    183	struct keyspan_message message;
    184
    185	switch(remote->stage) {
    186	case 0:
    187		/*
    188		 * In stage 0 we want to find the start of a message.  The remote sends a 0xFF as filler.
    189		 * So the first byte that isn't a FF should be the start of a new message.
    190		 */
    191		for (i = 0; i < RECV_SIZE && remote->in_buffer[i] == GAP; ++i);
    192
    193		if (i < RECV_SIZE) {
    194			memcpy(remote->data.buffer, remote->in_buffer, RECV_SIZE);
    195			remote->data.len = RECV_SIZE;
    196			remote->data.pos = 0;
    197			remote->data.tester = 0;
    198			remote->data.bits_left = 0;
    199			remote->stage = 1;
    200		}
    201		break;
    202
    203	case 1:
    204		/*
    205		 * Stage 1 we should have 16 bytes and should be able to detect a
    206		 * SYNC.  The SYNC is 14 bits, 7 0's and then 7 1's.
    207		 */
    208		memcpy(remote->data.buffer + remote->data.len, remote->in_buffer, RECV_SIZE);
    209		remote->data.len += RECV_SIZE;
    210
    211		found = 0;
    212		while ((remote->data.bits_left >= 14 || remote->data.pos < remote->data.len) && !found) {
    213			for (i = 0; i < 8; ++i) {
    214				if (keyspan_load_tester(remote, 14) != 0) {
    215					remote->stage = 0;
    216					return;
    217				}
    218
    219				if ((remote->data.tester & SYNC_MASK) == SYNC) {
    220					remote->data.tester = remote->data.tester >> 14;
    221					remote->data.bits_left -= 14;
    222					found = 1;
    223					break;
    224				} else {
    225					remote->data.tester = remote->data.tester >> 1;
    226					--remote->data.bits_left;
    227				}
    228			}
    229		}
    230
    231		if (!found) {
    232			remote->stage = 0;
    233			remote->data.len = 0;
    234		} else {
    235			remote->stage = 2;
    236		}
    237		break;
    238
    239	case 2:
    240		/*
    241		 * Stage 2 we should have 24 bytes which will be enough for a full
    242		 * message.  We need to parse out the system code, button code,
    243		 * toggle code, and stop.
    244		 */
    245		memcpy(remote->data.buffer + remote->data.len, remote->in_buffer, RECV_SIZE);
    246		remote->data.len += RECV_SIZE;
    247
    248		message.system = 0;
    249		for (i = 0; i < 9; i++) {
    250			keyspan_load_tester(remote, 6);
    251
    252			if ((remote->data.tester & ZERO_MASK) == ZERO) {
    253				message.system = message.system << 1;
    254				remote->data.tester = remote->data.tester >> 5;
    255				remote->data.bits_left -= 5;
    256			} else if ((remote->data.tester & ONE_MASK) == ONE) {
    257				message.system = (message.system << 1) + 1;
    258				remote->data.tester = remote->data.tester >> 6;
    259				remote->data.bits_left -= 6;
    260			} else {
    261				dev_err(&remote->interface->dev,
    262					"%s - Unknown sequence found in system data.\n",
    263					__func__);
    264				remote->stage = 0;
    265				return;
    266			}
    267		}
    268
    269		message.button = 0;
    270		for (i = 0; i < 5; i++) {
    271			keyspan_load_tester(remote, 6);
    272
    273			if ((remote->data.tester & ZERO_MASK) == ZERO) {
    274				message.button = message.button << 1;
    275				remote->data.tester = remote->data.tester >> 5;
    276				remote->data.bits_left -= 5;
    277			} else if ((remote->data.tester & ONE_MASK) == ONE) {
    278				message.button = (message.button << 1) + 1;
    279				remote->data.tester = remote->data.tester >> 6;
    280				remote->data.bits_left -= 6;
    281			} else {
    282				dev_err(&remote->interface->dev,
    283					"%s - Unknown sequence found in button data.\n",
    284					__func__);
    285				remote->stage = 0;
    286				return;
    287			}
    288		}
    289
    290		keyspan_load_tester(remote, 6);
    291		if ((remote->data.tester & ZERO_MASK) == ZERO) {
    292			message.toggle = 0;
    293			remote->data.tester = remote->data.tester >> 5;
    294			remote->data.bits_left -= 5;
    295		} else if ((remote->data.tester & ONE_MASK) == ONE) {
    296			message.toggle = 1;
    297			remote->data.tester = remote->data.tester >> 6;
    298			remote->data.bits_left -= 6;
    299		} else {
    300			dev_err(&remote->interface->dev,
    301				"%s - Error in message, invalid toggle.\n",
    302				__func__);
    303			remote->stage = 0;
    304			return;
    305		}
    306
    307		keyspan_load_tester(remote, 5);
    308		if ((remote->data.tester & STOP_MASK) == STOP) {
    309			remote->data.tester = remote->data.tester >> 5;
    310			remote->data.bits_left -= 5;
    311		} else {
    312			dev_err(&remote->interface->dev,
    313				"Bad message received, no stop bit found.\n");
    314		}
    315
    316		dev_dbg(&remote->interface->dev,
    317			"%s found valid message: system: %d, button: %d, toggle: %d\n",
    318			__func__, message.system, message.button, message.toggle);
    319
    320		if (message.toggle != remote->toggle) {
    321			keyspan_report_button(remote, message.button, 1);
    322			keyspan_report_button(remote, message.button, 0);
    323			remote->toggle = message.toggle;
    324		}
    325
    326		remote->stage = 0;
    327		break;
    328	}
    329}
    330
    331/*
    332 * Routine for sending all the initialization messages to the remote.
    333 */
    334static int keyspan_setup(struct usb_device* dev)
    335{
    336	int retval = 0;
    337
    338	retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
    339				 0x11, 0x40, 0x5601, 0x0, NULL, 0,
    340				 USB_CTRL_SET_TIMEOUT);
    341	if (retval) {
    342		dev_dbg(&dev->dev, "%s - failed to set bit rate due to error: %d\n",
    343			__func__, retval);
    344		return(retval);
    345	}
    346
    347	retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
    348				 0x44, 0x40, 0x0, 0x0, NULL, 0,
    349				 USB_CTRL_SET_TIMEOUT);
    350	if (retval) {
    351		dev_dbg(&dev->dev, "%s - failed to set resume sensitivity due to error: %d\n",
    352			__func__, retval);
    353		return(retval);
    354	}
    355
    356	retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
    357				 0x22, 0x40, 0x0, 0x0, NULL, 0,
    358				 USB_CTRL_SET_TIMEOUT);
    359	if (retval) {
    360		dev_dbg(&dev->dev, "%s - failed to turn receive on due to error: %d\n",
    361			__func__, retval);
    362		return(retval);
    363	}
    364
    365	dev_dbg(&dev->dev, "%s - Setup complete.\n", __func__);
    366	return(retval);
    367}
    368
    369/*
    370 * Routine used to handle a new message that has come in.
    371 */
    372static void keyspan_irq_recv(struct urb *urb)
    373{
    374	struct usb_keyspan *dev = urb->context;
    375	int retval;
    376
    377	/* Check our status in case we need to bail out early. */
    378	switch (urb->status) {
    379	case 0:
    380		break;
    381
    382	/* Device went away so don't keep trying to read from it. */
    383	case -ECONNRESET:
    384	case -ENOENT:
    385	case -ESHUTDOWN:
    386		return;
    387
    388	default:
    389		goto resubmit;
    390	}
    391
    392	if (debug)
    393		keyspan_print(dev);
    394
    395	keyspan_check_data(dev);
    396
    397resubmit:
    398	retval = usb_submit_urb(urb, GFP_ATOMIC);
    399	if (retval)
    400		dev_err(&dev->interface->dev,
    401			"%s - usb_submit_urb failed with result: %d\n",
    402			__func__, retval);
    403}
    404
    405static int keyspan_open(struct input_dev *dev)
    406{
    407	struct usb_keyspan *remote = input_get_drvdata(dev);
    408
    409	remote->irq_urb->dev = remote->udev;
    410	if (usb_submit_urb(remote->irq_urb, GFP_KERNEL))
    411		return -EIO;
    412
    413	return 0;
    414}
    415
    416static void keyspan_close(struct input_dev *dev)
    417{
    418	struct usb_keyspan *remote = input_get_drvdata(dev);
    419
    420	usb_kill_urb(remote->irq_urb);
    421}
    422
    423static struct usb_endpoint_descriptor *keyspan_get_in_endpoint(struct usb_host_interface *iface)
    424{
    425
    426	struct usb_endpoint_descriptor *endpoint;
    427	int i;
    428
    429	for (i = 0; i < iface->desc.bNumEndpoints; ++i) {
    430		endpoint = &iface->endpoint[i].desc;
    431
    432		if (usb_endpoint_is_int_in(endpoint)) {
    433			/* we found our interrupt in endpoint */
    434			return endpoint;
    435		}
    436	}
    437
    438	return NULL;
    439}
    440
    441/*
    442 * Routine that sets up the driver to handle a specific USB device detected on the bus.
    443 */
    444static int keyspan_probe(struct usb_interface *interface, const struct usb_device_id *id)
    445{
    446	struct usb_device *udev = interface_to_usbdev(interface);
    447	struct usb_endpoint_descriptor *endpoint;
    448	struct usb_keyspan *remote;
    449	struct input_dev *input_dev;
    450	int i, error;
    451
    452	endpoint = keyspan_get_in_endpoint(interface->cur_altsetting);
    453	if (!endpoint)
    454		return -ENODEV;
    455
    456	remote = kzalloc(sizeof(*remote), GFP_KERNEL);
    457	input_dev = input_allocate_device();
    458	if (!remote || !input_dev) {
    459		error = -ENOMEM;
    460		goto fail1;
    461	}
    462
    463	remote->udev = udev;
    464	remote->input = input_dev;
    465	remote->interface = interface;
    466	remote->in_endpoint = endpoint;
    467	remote->toggle = -1;	/* Set to -1 so we will always not match the toggle from the first remote message. */
    468
    469	remote->in_buffer = usb_alloc_coherent(udev, RECV_SIZE, GFP_KERNEL, &remote->in_dma);
    470	if (!remote->in_buffer) {
    471		error = -ENOMEM;
    472		goto fail1;
    473	}
    474
    475	remote->irq_urb = usb_alloc_urb(0, GFP_KERNEL);
    476	if (!remote->irq_urb) {
    477		error = -ENOMEM;
    478		goto fail2;
    479	}
    480
    481	error = keyspan_setup(udev);
    482	if (error) {
    483		error = -ENODEV;
    484		goto fail3;
    485	}
    486
    487	if (udev->manufacturer)
    488		strlcpy(remote->name, udev->manufacturer, sizeof(remote->name));
    489
    490	if (udev->product) {
    491		if (udev->manufacturer)
    492			strlcat(remote->name, " ", sizeof(remote->name));
    493		strlcat(remote->name, udev->product, sizeof(remote->name));
    494	}
    495
    496	if (!strlen(remote->name))
    497		snprintf(remote->name, sizeof(remote->name),
    498			 "USB Keyspan Remote %04x:%04x",
    499			 le16_to_cpu(udev->descriptor.idVendor),
    500			 le16_to_cpu(udev->descriptor.idProduct));
    501
    502	usb_make_path(udev, remote->phys, sizeof(remote->phys));
    503	strlcat(remote->phys, "/input0", sizeof(remote->phys));
    504	memcpy(remote->keymap, keyspan_key_table, sizeof(remote->keymap));
    505
    506	input_dev->name = remote->name;
    507	input_dev->phys = remote->phys;
    508	usb_to_input_id(udev, &input_dev->id);
    509	input_dev->dev.parent = &interface->dev;
    510	input_dev->keycode = remote->keymap;
    511	input_dev->keycodesize = sizeof(unsigned short);
    512	input_dev->keycodemax = ARRAY_SIZE(remote->keymap);
    513
    514	input_set_capability(input_dev, EV_MSC, MSC_SCAN);
    515	__set_bit(EV_KEY, input_dev->evbit);
    516	for (i = 0; i < ARRAY_SIZE(keyspan_key_table); i++)
    517		__set_bit(keyspan_key_table[i], input_dev->keybit);
    518	__clear_bit(KEY_RESERVED, input_dev->keybit);
    519
    520	input_set_drvdata(input_dev, remote);
    521
    522	input_dev->open = keyspan_open;
    523	input_dev->close = keyspan_close;
    524
    525	/*
    526	 * Initialize the URB to access the device.
    527	 * The urb gets sent to the device in keyspan_open()
    528	 */
    529	usb_fill_int_urb(remote->irq_urb,
    530			 remote->udev,
    531			 usb_rcvintpipe(remote->udev, endpoint->bEndpointAddress),
    532			 remote->in_buffer, RECV_SIZE, keyspan_irq_recv, remote,
    533			 endpoint->bInterval);
    534	remote->irq_urb->transfer_dma = remote->in_dma;
    535	remote->irq_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
    536
    537	/* we can register the device now, as it is ready */
    538	error = input_register_device(remote->input);
    539	if (error)
    540		goto fail3;
    541
    542	/* save our data pointer in this interface device */
    543	usb_set_intfdata(interface, remote);
    544
    545	return 0;
    546
    547 fail3:	usb_free_urb(remote->irq_urb);
    548 fail2:	usb_free_coherent(udev, RECV_SIZE, remote->in_buffer, remote->in_dma);
    549 fail1:	kfree(remote);
    550	input_free_device(input_dev);
    551
    552	return error;
    553}
    554
    555/*
    556 * Routine called when a device is disconnected from the USB.
    557 */
    558static void keyspan_disconnect(struct usb_interface *interface)
    559{
    560	struct usb_keyspan *remote;
    561
    562	remote = usb_get_intfdata(interface);
    563	usb_set_intfdata(interface, NULL);
    564
    565	if (remote) {	/* We have a valid driver structure so clean up everything we allocated. */
    566		input_unregister_device(remote->input);
    567		usb_kill_urb(remote->irq_urb);
    568		usb_free_urb(remote->irq_urb);
    569		usb_free_coherent(remote->udev, RECV_SIZE, remote->in_buffer, remote->in_dma);
    570		kfree(remote);
    571	}
    572}
    573
    574/*
    575 * Standard driver set up sections
    576 */
    577static struct usb_driver keyspan_driver =
    578{
    579	.name =		"keyspan_remote",
    580	.probe =	keyspan_probe,
    581	.disconnect =	keyspan_disconnect,
    582	.id_table =	keyspan_table
    583};
    584
    585module_usb_driver(keyspan_driver);
    586
    587MODULE_DEVICE_TABLE(usb, keyspan_table);
    588MODULE_AUTHOR("Michael Downey <downey@zymeta.com>");
    589MODULE_DESCRIPTION("Driver for the USB Keyspan remote control.");
    590MODULE_LICENSE("GPL");