cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

cec-pin.c (37849B)


      1// SPDX-License-Identifier: GPL-2.0-only
      2/*
      3 * Copyright 2017 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
      4 */
      5
      6#include <linux/delay.h>
      7#include <linux/slab.h>
      8#include <linux/sched/types.h>
      9
     10#include <media/cec-pin.h>
     11#include "cec-pin-priv.h"
     12
     13/* All timings are in microseconds */
     14
     15/* start bit timings */
     16#define CEC_TIM_START_BIT_LOW		3700
     17#define CEC_TIM_START_BIT_LOW_MIN	3500
     18#define CEC_TIM_START_BIT_LOW_MAX	3900
     19#define CEC_TIM_START_BIT_TOTAL		4500
     20#define CEC_TIM_START_BIT_TOTAL_MIN	4300
     21#define CEC_TIM_START_BIT_TOTAL_MAX	4700
     22
     23/* data bit timings */
     24#define CEC_TIM_DATA_BIT_0_LOW		1500
     25#define CEC_TIM_DATA_BIT_0_LOW_MIN	1300
     26#define CEC_TIM_DATA_BIT_0_LOW_MAX	1700
     27#define CEC_TIM_DATA_BIT_1_LOW		600
     28#define CEC_TIM_DATA_BIT_1_LOW_MIN	400
     29#define CEC_TIM_DATA_BIT_1_LOW_MAX	800
     30#define CEC_TIM_DATA_BIT_TOTAL		2400
     31#define CEC_TIM_DATA_BIT_TOTAL_MIN	2050
     32#define CEC_TIM_DATA_BIT_TOTAL_MAX	2750
     33/* earliest safe time to sample the bit state */
     34#define CEC_TIM_DATA_BIT_SAMPLE		850
     35/* earliest time the bit is back to 1 (T7 + 50) */
     36#define CEC_TIM_DATA_BIT_HIGH		1750
     37
     38/* when idle, sample once per millisecond */
     39#define CEC_TIM_IDLE_SAMPLE		1000
     40/* when processing the start bit, sample twice per millisecond */
     41#define CEC_TIM_START_BIT_SAMPLE	500
     42/* when polling for a state change, sample once every 50 microseconds */
     43#define CEC_TIM_SAMPLE			50
     44
     45#define CEC_TIM_LOW_DRIVE_ERROR		(1.5 * CEC_TIM_DATA_BIT_TOTAL)
     46
     47/*
     48 * Total data bit time that is too short/long for a valid bit,
     49 * used for error injection.
     50 */
     51#define CEC_TIM_DATA_BIT_TOTAL_SHORT	1800
     52#define CEC_TIM_DATA_BIT_TOTAL_LONG	2900
     53
     54/*
     55 * Total start bit time that is too short/long for a valid bit,
     56 * used for error injection.
     57 */
     58#define CEC_TIM_START_BIT_TOTAL_SHORT	4100
     59#define CEC_TIM_START_BIT_TOTAL_LONG	5000
     60
     61/* Data bits are 0-7, EOM is bit 8 and ACK is bit 9 */
     62#define EOM_BIT				8
     63#define ACK_BIT				9
     64
     65struct cec_state {
     66	const char * const name;
     67	unsigned int usecs;
     68};
     69
     70static const struct cec_state states[CEC_PIN_STATES] = {
     71	{ "Off",		   0 },
     72	{ "Idle",		   CEC_TIM_IDLE_SAMPLE },
     73	{ "Tx Wait",		   CEC_TIM_SAMPLE },
     74	{ "Tx Wait for High",	   CEC_TIM_IDLE_SAMPLE },
     75	{ "Tx Start Bit Low",	   CEC_TIM_START_BIT_LOW },
     76	{ "Tx Start Bit High",	   CEC_TIM_START_BIT_TOTAL - CEC_TIM_START_BIT_LOW },
     77	{ "Tx Start Bit High Short", CEC_TIM_START_BIT_TOTAL_SHORT - CEC_TIM_START_BIT_LOW },
     78	{ "Tx Start Bit High Long", CEC_TIM_START_BIT_TOTAL_LONG - CEC_TIM_START_BIT_LOW },
     79	{ "Tx Start Bit Low Custom", 0 },
     80	{ "Tx Start Bit High Custom", 0 },
     81	{ "Tx Data 0 Low",	   CEC_TIM_DATA_BIT_0_LOW },
     82	{ "Tx Data 0 High",	   CEC_TIM_DATA_BIT_TOTAL - CEC_TIM_DATA_BIT_0_LOW },
     83	{ "Tx Data 0 High Short",  CEC_TIM_DATA_BIT_TOTAL_SHORT - CEC_TIM_DATA_BIT_0_LOW },
     84	{ "Tx Data 0 High Long",   CEC_TIM_DATA_BIT_TOTAL_LONG - CEC_TIM_DATA_BIT_0_LOW },
     85	{ "Tx Data 1 Low",	   CEC_TIM_DATA_BIT_1_LOW },
     86	{ "Tx Data 1 High",	   CEC_TIM_DATA_BIT_TOTAL - CEC_TIM_DATA_BIT_1_LOW },
     87	{ "Tx Data 1 High Short",  CEC_TIM_DATA_BIT_TOTAL_SHORT - CEC_TIM_DATA_BIT_1_LOW },
     88	{ "Tx Data 1 High Long",   CEC_TIM_DATA_BIT_TOTAL_LONG - CEC_TIM_DATA_BIT_1_LOW },
     89	{ "Tx Data 1 High Pre Sample", CEC_TIM_DATA_BIT_SAMPLE - CEC_TIM_DATA_BIT_1_LOW },
     90	{ "Tx Data 1 High Post Sample", CEC_TIM_DATA_BIT_TOTAL - CEC_TIM_DATA_BIT_SAMPLE },
     91	{ "Tx Data 1 High Post Sample Short", CEC_TIM_DATA_BIT_TOTAL_SHORT - CEC_TIM_DATA_BIT_SAMPLE },
     92	{ "Tx Data 1 High Post Sample Long", CEC_TIM_DATA_BIT_TOTAL_LONG - CEC_TIM_DATA_BIT_SAMPLE },
     93	{ "Tx Data Bit Low Custom", 0 },
     94	{ "Tx Data Bit High Custom", 0 },
     95	{ "Tx Pulse Low Custom",   0 },
     96	{ "Tx Pulse High Custom",  0 },
     97	{ "Tx Low Drive",	   CEC_TIM_LOW_DRIVE_ERROR },
     98	{ "Rx Start Bit Low",	   CEC_TIM_SAMPLE },
     99	{ "Rx Start Bit High",	   CEC_TIM_SAMPLE },
    100	{ "Rx Data Sample",	   CEC_TIM_DATA_BIT_SAMPLE },
    101	{ "Rx Data Post Sample",   CEC_TIM_DATA_BIT_HIGH - CEC_TIM_DATA_BIT_SAMPLE },
    102	{ "Rx Data Wait for Low",  CEC_TIM_SAMPLE },
    103	{ "Rx Ack Low",		   CEC_TIM_DATA_BIT_0_LOW },
    104	{ "Rx Ack Low Post",	   CEC_TIM_DATA_BIT_HIGH - CEC_TIM_DATA_BIT_0_LOW },
    105	{ "Rx Ack High Post",	   CEC_TIM_DATA_BIT_HIGH },
    106	{ "Rx Ack Finish",	   CEC_TIM_DATA_BIT_TOTAL_MIN - CEC_TIM_DATA_BIT_HIGH },
    107	{ "Rx Low Drive",	   CEC_TIM_LOW_DRIVE_ERROR },
    108	{ "Rx Irq",		   0 },
    109};
    110
    111static void cec_pin_update(struct cec_pin *pin, bool v, bool force)
    112{
    113	if (!force && v == pin->adap->cec_pin_is_high)
    114		return;
    115
    116	pin->adap->cec_pin_is_high = v;
    117	if (atomic_read(&pin->work_pin_num_events) < CEC_NUM_PIN_EVENTS) {
    118		u8 ev = v;
    119
    120		if (pin->work_pin_events_dropped) {
    121			pin->work_pin_events_dropped = false;
    122			ev |= CEC_PIN_EVENT_FL_DROPPED;
    123		}
    124		pin->work_pin_events[pin->work_pin_events_wr] = ev;
    125		pin->work_pin_ts[pin->work_pin_events_wr] = ktime_get();
    126		pin->work_pin_events_wr =
    127			(pin->work_pin_events_wr + 1) % CEC_NUM_PIN_EVENTS;
    128		atomic_inc(&pin->work_pin_num_events);
    129	} else {
    130		pin->work_pin_events_dropped = true;
    131		pin->work_pin_events_dropped_cnt++;
    132	}
    133	wake_up_interruptible(&pin->kthread_waitq);
    134}
    135
    136static bool cec_pin_read(struct cec_pin *pin)
    137{
    138	bool v = call_pin_op(pin, read);
    139
    140	cec_pin_update(pin, v, false);
    141	return v;
    142}
    143
    144static void cec_pin_low(struct cec_pin *pin)
    145{
    146	call_void_pin_op(pin, low);
    147	cec_pin_update(pin, false, false);
    148}
    149
    150static bool cec_pin_high(struct cec_pin *pin)
    151{
    152	call_void_pin_op(pin, high);
    153	return cec_pin_read(pin);
    154}
    155
    156static bool rx_error_inj(struct cec_pin *pin, unsigned int mode_offset,
    157			 int arg_idx, u8 *arg)
    158{
    159#ifdef CONFIG_CEC_PIN_ERROR_INJ
    160	u16 cmd = cec_pin_rx_error_inj(pin);
    161	u64 e = pin->error_inj[cmd];
    162	unsigned int mode = (e >> mode_offset) & CEC_ERROR_INJ_MODE_MASK;
    163
    164	if (arg_idx >= 0) {
    165		u8 pos = pin->error_inj_args[cmd][arg_idx];
    166
    167		if (arg)
    168			*arg = pos;
    169		else if (pos != pin->rx_bit)
    170			return false;
    171	}
    172
    173	switch (mode) {
    174	case CEC_ERROR_INJ_MODE_ONCE:
    175		pin->error_inj[cmd] &=
    176			~(CEC_ERROR_INJ_MODE_MASK << mode_offset);
    177		return true;
    178	case CEC_ERROR_INJ_MODE_ALWAYS:
    179		return true;
    180	case CEC_ERROR_INJ_MODE_TOGGLE:
    181		return pin->rx_toggle;
    182	default:
    183		return false;
    184	}
    185#else
    186	return false;
    187#endif
    188}
    189
    190static bool rx_nack(struct cec_pin *pin)
    191{
    192	return rx_error_inj(pin, CEC_ERROR_INJ_RX_NACK_OFFSET, -1, NULL);
    193}
    194
    195static bool rx_low_drive(struct cec_pin *pin)
    196{
    197	return rx_error_inj(pin, CEC_ERROR_INJ_RX_LOW_DRIVE_OFFSET,
    198			    CEC_ERROR_INJ_RX_LOW_DRIVE_ARG_IDX, NULL);
    199}
    200
    201static bool rx_add_byte(struct cec_pin *pin)
    202{
    203	return rx_error_inj(pin, CEC_ERROR_INJ_RX_ADD_BYTE_OFFSET, -1, NULL);
    204}
    205
    206static bool rx_remove_byte(struct cec_pin *pin)
    207{
    208	return rx_error_inj(pin, CEC_ERROR_INJ_RX_REMOVE_BYTE_OFFSET, -1, NULL);
    209}
    210
    211static bool rx_arb_lost(struct cec_pin *pin, u8 *poll)
    212{
    213	return pin->tx_msg.len == 0 &&
    214		rx_error_inj(pin, CEC_ERROR_INJ_RX_ARB_LOST_OFFSET,
    215			     CEC_ERROR_INJ_RX_ARB_LOST_ARG_IDX, poll);
    216}
    217
    218static bool tx_error_inj(struct cec_pin *pin, unsigned int mode_offset,
    219			 int arg_idx, u8 *arg)
    220{
    221#ifdef CONFIG_CEC_PIN_ERROR_INJ
    222	u16 cmd = cec_pin_tx_error_inj(pin);
    223	u64 e = pin->error_inj[cmd];
    224	unsigned int mode = (e >> mode_offset) & CEC_ERROR_INJ_MODE_MASK;
    225
    226	if (arg_idx >= 0) {
    227		u8 pos = pin->error_inj_args[cmd][arg_idx];
    228
    229		if (arg)
    230			*arg = pos;
    231		else if (pos != pin->tx_bit)
    232			return false;
    233	}
    234
    235	switch (mode) {
    236	case CEC_ERROR_INJ_MODE_ONCE:
    237		pin->error_inj[cmd] &=
    238			~(CEC_ERROR_INJ_MODE_MASK << mode_offset);
    239		return true;
    240	case CEC_ERROR_INJ_MODE_ALWAYS:
    241		return true;
    242	case CEC_ERROR_INJ_MODE_TOGGLE:
    243		return pin->tx_toggle;
    244	default:
    245		return false;
    246	}
    247#else
    248	return false;
    249#endif
    250}
    251
    252static bool tx_no_eom(struct cec_pin *pin)
    253{
    254	return tx_error_inj(pin, CEC_ERROR_INJ_TX_NO_EOM_OFFSET, -1, NULL);
    255}
    256
    257static bool tx_early_eom(struct cec_pin *pin)
    258{
    259	return tx_error_inj(pin, CEC_ERROR_INJ_TX_EARLY_EOM_OFFSET, -1, NULL);
    260}
    261
    262static bool tx_short_bit(struct cec_pin *pin)
    263{
    264	return tx_error_inj(pin, CEC_ERROR_INJ_TX_SHORT_BIT_OFFSET,
    265			    CEC_ERROR_INJ_TX_SHORT_BIT_ARG_IDX, NULL);
    266}
    267
    268static bool tx_long_bit(struct cec_pin *pin)
    269{
    270	return tx_error_inj(pin, CEC_ERROR_INJ_TX_LONG_BIT_OFFSET,
    271			    CEC_ERROR_INJ_TX_LONG_BIT_ARG_IDX, NULL);
    272}
    273
    274static bool tx_custom_bit(struct cec_pin *pin)
    275{
    276	return tx_error_inj(pin, CEC_ERROR_INJ_TX_CUSTOM_BIT_OFFSET,
    277			    CEC_ERROR_INJ_TX_CUSTOM_BIT_ARG_IDX, NULL);
    278}
    279
    280static bool tx_short_start(struct cec_pin *pin)
    281{
    282	return tx_error_inj(pin, CEC_ERROR_INJ_TX_SHORT_START_OFFSET, -1, NULL);
    283}
    284
    285static bool tx_long_start(struct cec_pin *pin)
    286{
    287	return tx_error_inj(pin, CEC_ERROR_INJ_TX_LONG_START_OFFSET, -1, NULL);
    288}
    289
    290static bool tx_custom_start(struct cec_pin *pin)
    291{
    292	return tx_error_inj(pin, CEC_ERROR_INJ_TX_CUSTOM_START_OFFSET,
    293			    -1, NULL);
    294}
    295
    296static bool tx_last_bit(struct cec_pin *pin)
    297{
    298	return tx_error_inj(pin, CEC_ERROR_INJ_TX_LAST_BIT_OFFSET,
    299			    CEC_ERROR_INJ_TX_LAST_BIT_ARG_IDX, NULL);
    300}
    301
    302static u8 tx_add_bytes(struct cec_pin *pin)
    303{
    304	u8 bytes;
    305
    306	if (tx_error_inj(pin, CEC_ERROR_INJ_TX_ADD_BYTES_OFFSET,
    307			 CEC_ERROR_INJ_TX_ADD_BYTES_ARG_IDX, &bytes))
    308		return bytes;
    309	return 0;
    310}
    311
    312static bool tx_remove_byte(struct cec_pin *pin)
    313{
    314	return tx_error_inj(pin, CEC_ERROR_INJ_TX_REMOVE_BYTE_OFFSET, -1, NULL);
    315}
    316
    317static bool tx_low_drive(struct cec_pin *pin)
    318{
    319	return tx_error_inj(pin, CEC_ERROR_INJ_TX_LOW_DRIVE_OFFSET,
    320			    CEC_ERROR_INJ_TX_LOW_DRIVE_ARG_IDX, NULL);
    321}
    322
    323static void cec_pin_to_idle(struct cec_pin *pin)
    324{
    325	/*
    326	 * Reset all status fields, release the bus and
    327	 * go to idle state.
    328	 */
    329	pin->rx_bit = pin->tx_bit = 0;
    330	pin->rx_msg.len = 0;
    331	memset(pin->rx_msg.msg, 0, sizeof(pin->rx_msg.msg));
    332	pin->ts = ns_to_ktime(0);
    333	pin->tx_generated_poll = false;
    334	pin->tx_post_eom = false;
    335	if (pin->state >= CEC_ST_TX_WAIT &&
    336	    pin->state <= CEC_ST_TX_LOW_DRIVE)
    337		pin->tx_toggle ^= 1;
    338	if (pin->state >= CEC_ST_RX_START_BIT_LOW &&
    339	    pin->state <= CEC_ST_RX_LOW_DRIVE)
    340		pin->rx_toggle ^= 1;
    341	pin->state = CEC_ST_IDLE;
    342}
    343
    344/*
    345 * Handle Transmit-related states
    346 *
    347 * Basic state changes when transmitting:
    348 *
    349 * Idle -> Tx Wait (waiting for the end of signal free time) ->
    350 *	Tx Start Bit Low -> Tx Start Bit High ->
    351 *
    352 *   Regular data bits + EOM:
    353 *	Tx Data 0 Low -> Tx Data 0 High ->
    354 *   or:
    355 *	Tx Data 1 Low -> Tx Data 1 High ->
    356 *
    357 *   First 4 data bits or Ack bit:
    358 *	Tx Data 0 Low -> Tx Data 0 High ->
    359 *   or:
    360 *	Tx Data 1 Low -> Tx Data 1 High -> Tx Data 1 Pre Sample ->
    361 *		Tx Data 1 Post Sample ->
    362 *
    363 *   After the last Ack go to Idle.
    364 *
    365 * If it detects a Low Drive condition then:
    366 *	Tx Wait For High -> Idle
    367 *
    368 * If it loses arbitration, then it switches to state Rx Data Post Sample.
    369 */
    370static void cec_pin_tx_states(struct cec_pin *pin, ktime_t ts)
    371{
    372	bool v;
    373	bool is_ack_bit, ack;
    374
    375	switch (pin->state) {
    376	case CEC_ST_TX_WAIT_FOR_HIGH:
    377		if (cec_pin_read(pin))
    378			cec_pin_to_idle(pin);
    379		break;
    380
    381	case CEC_ST_TX_START_BIT_LOW:
    382		if (tx_short_start(pin)) {
    383			/*
    384			 * Error Injection: send an invalid (too short)
    385			 * start pulse.
    386			 */
    387			pin->state = CEC_ST_TX_START_BIT_HIGH_SHORT;
    388		} else if (tx_long_start(pin)) {
    389			/*
    390			 * Error Injection: send an invalid (too long)
    391			 * start pulse.
    392			 */
    393			pin->state = CEC_ST_TX_START_BIT_HIGH_LONG;
    394		} else {
    395			pin->state = CEC_ST_TX_START_BIT_HIGH;
    396		}
    397		/* Generate start bit */
    398		cec_pin_high(pin);
    399		break;
    400
    401	case CEC_ST_TX_START_BIT_LOW_CUSTOM:
    402		pin->state = CEC_ST_TX_START_BIT_HIGH_CUSTOM;
    403		/* Generate start bit */
    404		cec_pin_high(pin);
    405		break;
    406
    407	case CEC_ST_TX_DATA_BIT_1_HIGH_POST_SAMPLE:
    408	case CEC_ST_TX_DATA_BIT_1_HIGH_POST_SAMPLE_SHORT:
    409	case CEC_ST_TX_DATA_BIT_1_HIGH_POST_SAMPLE_LONG:
    410		if (pin->tx_nacked) {
    411			cec_pin_to_idle(pin);
    412			pin->tx_msg.len = 0;
    413			if (pin->tx_generated_poll)
    414				break;
    415			pin->work_tx_ts = ts;
    416			pin->work_tx_status = CEC_TX_STATUS_NACK;
    417			wake_up_interruptible(&pin->kthread_waitq);
    418			break;
    419		}
    420		fallthrough;
    421	case CEC_ST_TX_DATA_BIT_0_HIGH:
    422	case CEC_ST_TX_DATA_BIT_0_HIGH_SHORT:
    423	case CEC_ST_TX_DATA_BIT_0_HIGH_LONG:
    424	case CEC_ST_TX_DATA_BIT_1_HIGH:
    425	case CEC_ST_TX_DATA_BIT_1_HIGH_SHORT:
    426	case CEC_ST_TX_DATA_BIT_1_HIGH_LONG:
    427		/*
    428		 * If the read value is 1, then all is OK, otherwise we have a
    429		 * low drive condition.
    430		 *
    431		 * Special case: when we generate a poll message due to an
    432		 * Arbitration Lost error injection, then ignore this since
    433		 * the pin can actually be low in that case.
    434		 */
    435		if (!cec_pin_read(pin) && !pin->tx_generated_poll) {
    436			/*
    437			 * It's 0, so someone detected an error and pulled the
    438			 * line low for 1.5 times the nominal bit period.
    439			 */
    440			pin->tx_msg.len = 0;
    441			pin->state = CEC_ST_TX_WAIT_FOR_HIGH;
    442			pin->work_tx_ts = ts;
    443			pin->work_tx_status = CEC_TX_STATUS_LOW_DRIVE;
    444			pin->tx_low_drive_cnt++;
    445			wake_up_interruptible(&pin->kthread_waitq);
    446			break;
    447		}
    448		fallthrough;
    449	case CEC_ST_TX_DATA_BIT_HIGH_CUSTOM:
    450		if (tx_last_bit(pin)) {
    451			/* Error Injection: just stop sending after this bit */
    452			cec_pin_to_idle(pin);
    453			pin->tx_msg.len = 0;
    454			if (pin->tx_generated_poll)
    455				break;
    456			pin->work_tx_ts = ts;
    457			pin->work_tx_status = CEC_TX_STATUS_OK;
    458			wake_up_interruptible(&pin->kthread_waitq);
    459			break;
    460		}
    461		pin->tx_bit++;
    462		fallthrough;
    463	case CEC_ST_TX_START_BIT_HIGH:
    464	case CEC_ST_TX_START_BIT_HIGH_SHORT:
    465	case CEC_ST_TX_START_BIT_HIGH_LONG:
    466	case CEC_ST_TX_START_BIT_HIGH_CUSTOM:
    467		if (tx_low_drive(pin)) {
    468			/* Error injection: go to low drive */
    469			cec_pin_low(pin);
    470			pin->state = CEC_ST_TX_LOW_DRIVE;
    471			pin->tx_msg.len = 0;
    472			if (pin->tx_generated_poll)
    473				break;
    474			pin->work_tx_ts = ts;
    475			pin->work_tx_status = CEC_TX_STATUS_LOW_DRIVE;
    476			pin->tx_low_drive_cnt++;
    477			wake_up_interruptible(&pin->kthread_waitq);
    478			break;
    479		}
    480		if (pin->tx_bit / 10 >= pin->tx_msg.len + pin->tx_extra_bytes) {
    481			cec_pin_to_idle(pin);
    482			pin->tx_msg.len = 0;
    483			if (pin->tx_generated_poll)
    484				break;
    485			pin->work_tx_ts = ts;
    486			pin->work_tx_status = CEC_TX_STATUS_OK;
    487			wake_up_interruptible(&pin->kthread_waitq);
    488			break;
    489		}
    490
    491		switch (pin->tx_bit % 10) {
    492		default: {
    493			/*
    494			 * In the CEC_ERROR_INJ_TX_ADD_BYTES case we transmit
    495			 * extra bytes, so pin->tx_bit / 10 can become >= 16.
    496			 * Generate bit values for those extra bytes instead
    497			 * of reading them from the transmit buffer.
    498			 */
    499			unsigned int idx = (pin->tx_bit / 10);
    500			u8 val = idx;
    501
    502			if (idx < pin->tx_msg.len)
    503				val = pin->tx_msg.msg[idx];
    504			v = val & (1 << (7 - (pin->tx_bit % 10)));
    505
    506			pin->state = v ? CEC_ST_TX_DATA_BIT_1_LOW :
    507					 CEC_ST_TX_DATA_BIT_0_LOW;
    508			break;
    509		}
    510		case EOM_BIT: {
    511			unsigned int tot_len = pin->tx_msg.len +
    512					       pin->tx_extra_bytes;
    513			unsigned int tx_byte_idx = pin->tx_bit / 10;
    514
    515			v = !pin->tx_post_eom && tx_byte_idx == tot_len - 1;
    516			if (tot_len > 1 && tx_byte_idx == tot_len - 2 &&
    517			    tx_early_eom(pin)) {
    518				/* Error injection: set EOM one byte early */
    519				v = true;
    520				pin->tx_post_eom = true;
    521			} else if (v && tx_no_eom(pin)) {
    522				/* Error injection: no EOM */
    523				v = false;
    524			}
    525			pin->state = v ? CEC_ST_TX_DATA_BIT_1_LOW :
    526					 CEC_ST_TX_DATA_BIT_0_LOW;
    527			break;
    528		}
    529		case ACK_BIT:
    530			pin->state = CEC_ST_TX_DATA_BIT_1_LOW;
    531			break;
    532		}
    533		if (tx_custom_bit(pin))
    534			pin->state = CEC_ST_TX_DATA_BIT_LOW_CUSTOM;
    535		cec_pin_low(pin);
    536		break;
    537
    538	case CEC_ST_TX_DATA_BIT_0_LOW:
    539	case CEC_ST_TX_DATA_BIT_1_LOW:
    540		v = pin->state == CEC_ST_TX_DATA_BIT_1_LOW;
    541		is_ack_bit = pin->tx_bit % 10 == ACK_BIT;
    542		if (v && (pin->tx_bit < 4 || is_ack_bit)) {
    543			pin->state = CEC_ST_TX_DATA_BIT_1_HIGH_PRE_SAMPLE;
    544		} else if (!is_ack_bit && tx_short_bit(pin)) {
    545			/* Error Injection: send an invalid (too short) bit */
    546			pin->state = v ? CEC_ST_TX_DATA_BIT_1_HIGH_SHORT :
    547					 CEC_ST_TX_DATA_BIT_0_HIGH_SHORT;
    548		} else if (!is_ack_bit && tx_long_bit(pin)) {
    549			/* Error Injection: send an invalid (too long) bit */
    550			pin->state = v ? CEC_ST_TX_DATA_BIT_1_HIGH_LONG :
    551					 CEC_ST_TX_DATA_BIT_0_HIGH_LONG;
    552		} else {
    553			pin->state = v ? CEC_ST_TX_DATA_BIT_1_HIGH :
    554					 CEC_ST_TX_DATA_BIT_0_HIGH;
    555		}
    556		cec_pin_high(pin);
    557		break;
    558
    559	case CEC_ST_TX_DATA_BIT_LOW_CUSTOM:
    560		pin->state = CEC_ST_TX_DATA_BIT_HIGH_CUSTOM;
    561		cec_pin_high(pin);
    562		break;
    563
    564	case CEC_ST_TX_DATA_BIT_1_HIGH_PRE_SAMPLE:
    565		/* Read the CEC value at the sample time */
    566		v = cec_pin_read(pin);
    567		is_ack_bit = pin->tx_bit % 10 == ACK_BIT;
    568		/*
    569		 * If v == 0 and we're within the first 4 bits
    570		 * of the initiator, then someone else started
    571		 * transmitting and we lost the arbitration
    572		 * (i.e. the logical address of the other
    573		 * transmitter has more leading 0 bits in the
    574		 * initiator).
    575		 */
    576		if (!v && !is_ack_bit && !pin->tx_generated_poll) {
    577			pin->tx_msg.len = 0;
    578			pin->work_tx_ts = ts;
    579			pin->work_tx_status = CEC_TX_STATUS_ARB_LOST;
    580			wake_up_interruptible(&pin->kthread_waitq);
    581			pin->rx_bit = pin->tx_bit;
    582			pin->tx_bit = 0;
    583			memset(pin->rx_msg.msg, 0, sizeof(pin->rx_msg.msg));
    584			pin->rx_msg.msg[0] = pin->tx_msg.msg[0];
    585			pin->rx_msg.msg[0] &= (0xff << (8 - pin->rx_bit));
    586			pin->rx_msg.len = 0;
    587			pin->ts = ktime_sub_us(ts, CEC_TIM_DATA_BIT_SAMPLE);
    588			pin->state = CEC_ST_RX_DATA_POST_SAMPLE;
    589			pin->rx_bit++;
    590			break;
    591		}
    592		pin->state = CEC_ST_TX_DATA_BIT_1_HIGH_POST_SAMPLE;
    593		if (!is_ack_bit && tx_short_bit(pin)) {
    594			/* Error Injection: send an invalid (too short) bit */
    595			pin->state = CEC_ST_TX_DATA_BIT_1_HIGH_POST_SAMPLE_SHORT;
    596		} else if (!is_ack_bit && tx_long_bit(pin)) {
    597			/* Error Injection: send an invalid (too long) bit */
    598			pin->state = CEC_ST_TX_DATA_BIT_1_HIGH_POST_SAMPLE_LONG;
    599		}
    600		if (!is_ack_bit)
    601			break;
    602		/* Was the message ACKed? */
    603		ack = cec_msg_is_broadcast(&pin->tx_msg) ? v : !v;
    604		if (!ack && (!pin->tx_ignore_nack_until_eom ||
    605		    pin->tx_bit / 10 == pin->tx_msg.len - 1) &&
    606		    !pin->tx_post_eom) {
    607			/*
    608			 * Note: the CEC spec is ambiguous regarding
    609			 * what action to take when a NACK appears
    610			 * before the last byte of the payload was
    611			 * transmitted: either stop transmitting
    612			 * immediately, or wait until the last byte
    613			 * was transmitted.
    614			 *
    615			 * Most CEC implementations appear to stop
    616			 * immediately, and that's what we do here
    617			 * as well.
    618			 */
    619			pin->tx_nacked = true;
    620		}
    621		break;
    622
    623	case CEC_ST_TX_PULSE_LOW_CUSTOM:
    624		cec_pin_high(pin);
    625		pin->state = CEC_ST_TX_PULSE_HIGH_CUSTOM;
    626		break;
    627
    628	case CEC_ST_TX_PULSE_HIGH_CUSTOM:
    629		cec_pin_to_idle(pin);
    630		break;
    631
    632	default:
    633		break;
    634	}
    635}
    636
    637/*
    638 * Handle Receive-related states
    639 *
    640 * Basic state changes when receiving:
    641 *
    642 *	Rx Start Bit Low -> Rx Start Bit High ->
    643 *   Regular data bits + EOM:
    644 *	Rx Data Sample -> Rx Data Post Sample -> Rx Data High ->
    645 *   Ack bit 0:
    646 *	Rx Ack Low -> Rx Ack Low Post -> Rx Data High ->
    647 *   Ack bit 1:
    648 *	Rx Ack High Post -> Rx Data High ->
    649 *   Ack bit 0 && EOM:
    650 *	Rx Ack Low -> Rx Ack Low Post -> Rx Ack Finish -> Idle
    651 */
    652static void cec_pin_rx_states(struct cec_pin *pin, ktime_t ts)
    653{
    654	s32 delta;
    655	bool v;
    656	bool ack;
    657	bool bcast, for_us;
    658	u8 dest;
    659	u8 poll;
    660
    661	switch (pin->state) {
    662	/* Receive states */
    663	case CEC_ST_RX_START_BIT_LOW:
    664		v = cec_pin_read(pin);
    665		if (!v)
    666			break;
    667		pin->state = CEC_ST_RX_START_BIT_HIGH;
    668		delta = ktime_us_delta(ts, pin->ts);
    669		/* Start bit low is too short, go back to idle */
    670		if (delta < CEC_TIM_START_BIT_LOW_MIN - CEC_TIM_IDLE_SAMPLE) {
    671			if (!pin->rx_start_bit_low_too_short_cnt++) {
    672				pin->rx_start_bit_low_too_short_ts = ktime_to_ns(pin->ts);
    673				pin->rx_start_bit_low_too_short_delta = delta;
    674			}
    675			cec_pin_to_idle(pin);
    676			break;
    677		}
    678		if (rx_arb_lost(pin, &poll)) {
    679			cec_msg_init(&pin->tx_msg, poll >> 4, poll & 0xf);
    680			pin->tx_generated_poll = true;
    681			pin->tx_extra_bytes = 0;
    682			pin->state = CEC_ST_TX_START_BIT_HIGH;
    683			pin->ts = ts;
    684		}
    685		break;
    686
    687	case CEC_ST_RX_START_BIT_HIGH:
    688		v = cec_pin_read(pin);
    689		delta = ktime_us_delta(ts, pin->ts);
    690		/*
    691		 * Unfortunately the spec does not specify when to give up
    692		 * and go to idle. We just pick TOTAL_LONG.
    693		 */
    694		if (v && delta > CEC_TIM_START_BIT_TOTAL_LONG) {
    695			pin->rx_start_bit_too_long_cnt++;
    696			cec_pin_to_idle(pin);
    697			break;
    698		}
    699		if (v)
    700			break;
    701		/* Start bit is too short, go back to idle */
    702		if (delta < CEC_TIM_START_BIT_TOTAL_MIN - CEC_TIM_IDLE_SAMPLE) {
    703			if (!pin->rx_start_bit_too_short_cnt++) {
    704				pin->rx_start_bit_too_short_ts = ktime_to_ns(pin->ts);
    705				pin->rx_start_bit_too_short_delta = delta;
    706			}
    707			cec_pin_to_idle(pin);
    708			break;
    709		}
    710		if (rx_low_drive(pin)) {
    711			/* Error injection: go to low drive */
    712			cec_pin_low(pin);
    713			pin->state = CEC_ST_RX_LOW_DRIVE;
    714			pin->rx_low_drive_cnt++;
    715			break;
    716		}
    717		pin->state = CEC_ST_RX_DATA_SAMPLE;
    718		pin->ts = ts;
    719		pin->rx_eom = false;
    720		break;
    721
    722	case CEC_ST_RX_DATA_SAMPLE:
    723		v = cec_pin_read(pin);
    724		pin->state = CEC_ST_RX_DATA_POST_SAMPLE;
    725		switch (pin->rx_bit % 10) {
    726		default:
    727			if (pin->rx_bit / 10 < CEC_MAX_MSG_SIZE)
    728				pin->rx_msg.msg[pin->rx_bit / 10] |=
    729					v << (7 - (pin->rx_bit % 10));
    730			break;
    731		case EOM_BIT:
    732			pin->rx_eom = v;
    733			pin->rx_msg.len = pin->rx_bit / 10 + 1;
    734			break;
    735		case ACK_BIT:
    736			break;
    737		}
    738		pin->rx_bit++;
    739		break;
    740
    741	case CEC_ST_RX_DATA_POST_SAMPLE:
    742		pin->state = CEC_ST_RX_DATA_WAIT_FOR_LOW;
    743		break;
    744
    745	case CEC_ST_RX_DATA_WAIT_FOR_LOW:
    746		v = cec_pin_read(pin);
    747		delta = ktime_us_delta(ts, pin->ts);
    748		/*
    749		 * Unfortunately the spec does not specify when to give up
    750		 * and go to idle. We just pick TOTAL_LONG.
    751		 */
    752		if (v && delta > CEC_TIM_DATA_BIT_TOTAL_LONG) {
    753			pin->rx_data_bit_too_long_cnt++;
    754			cec_pin_to_idle(pin);
    755			break;
    756		}
    757		if (v)
    758			break;
    759
    760		if (rx_low_drive(pin)) {
    761			/* Error injection: go to low drive */
    762			cec_pin_low(pin);
    763			pin->state = CEC_ST_RX_LOW_DRIVE;
    764			pin->rx_low_drive_cnt++;
    765			break;
    766		}
    767
    768		/*
    769		 * Go to low drive state when the total bit time is
    770		 * too short.
    771		 */
    772		if (delta < CEC_TIM_DATA_BIT_TOTAL_MIN) {
    773			if (!pin->rx_data_bit_too_short_cnt++) {
    774				pin->rx_data_bit_too_short_ts = ktime_to_ns(pin->ts);
    775				pin->rx_data_bit_too_short_delta = delta;
    776			}
    777			cec_pin_low(pin);
    778			pin->state = CEC_ST_RX_LOW_DRIVE;
    779			pin->rx_low_drive_cnt++;
    780			break;
    781		}
    782		pin->ts = ts;
    783		if (pin->rx_bit % 10 != 9) {
    784			pin->state = CEC_ST_RX_DATA_SAMPLE;
    785			break;
    786		}
    787
    788		dest = cec_msg_destination(&pin->rx_msg);
    789		bcast = dest == CEC_LOG_ADDR_BROADCAST;
    790		/* for_us == broadcast or directed to us */
    791		for_us = bcast || (pin->la_mask & (1 << dest));
    792		/* ACK bit value */
    793		ack = bcast ? 1 : !for_us;
    794
    795		if (for_us && rx_nack(pin)) {
    796			/* Error injection: toggle the ACK bit */
    797			ack = !ack;
    798		}
    799
    800		if (ack) {
    801			/* No need to write to the bus, just wait */
    802			pin->state = CEC_ST_RX_ACK_HIGH_POST;
    803			break;
    804		}
    805		cec_pin_low(pin);
    806		pin->state = CEC_ST_RX_ACK_LOW;
    807		break;
    808
    809	case CEC_ST_RX_ACK_LOW:
    810		cec_pin_high(pin);
    811		pin->state = CEC_ST_RX_ACK_LOW_POST;
    812		break;
    813
    814	case CEC_ST_RX_ACK_LOW_POST:
    815	case CEC_ST_RX_ACK_HIGH_POST:
    816		v = cec_pin_read(pin);
    817		if (v && pin->rx_eom) {
    818			pin->work_rx_msg = pin->rx_msg;
    819			pin->work_rx_msg.rx_ts = ktime_to_ns(ts);
    820			wake_up_interruptible(&pin->kthread_waitq);
    821			pin->ts = ts;
    822			pin->state = CEC_ST_RX_ACK_FINISH;
    823			break;
    824		}
    825		pin->rx_bit++;
    826		pin->state = CEC_ST_RX_DATA_WAIT_FOR_LOW;
    827		break;
    828
    829	case CEC_ST_RX_ACK_FINISH:
    830		cec_pin_to_idle(pin);
    831		break;
    832
    833	default:
    834		break;
    835	}
    836}
    837
    838/*
    839 * Main timer function
    840 *
    841 */
    842static enum hrtimer_restart cec_pin_timer(struct hrtimer *timer)
    843{
    844	struct cec_pin *pin = container_of(timer, struct cec_pin, timer);
    845	struct cec_adapter *adap = pin->adap;
    846	ktime_t ts;
    847	s32 delta;
    848	u32 usecs;
    849
    850	ts = ktime_get();
    851	if (ktime_to_ns(pin->timer_ts)) {
    852		delta = ktime_us_delta(ts, pin->timer_ts);
    853		pin->timer_cnt++;
    854		if (delta > 100 && pin->state != CEC_ST_IDLE) {
    855			/* Keep track of timer overruns */
    856			pin->timer_sum_overrun += delta;
    857			pin->timer_100us_overruns++;
    858			if (delta > 300)
    859				pin->timer_300us_overruns++;
    860			if (delta > pin->timer_max_overrun)
    861				pin->timer_max_overrun = delta;
    862		}
    863	}
    864	if (adap->monitor_pin_cnt)
    865		cec_pin_read(pin);
    866
    867	if (pin->wait_usecs) {
    868		/*
    869		 * If we are monitoring the pin, then we have to
    870		 * sample at regular intervals.
    871		 */
    872		if (pin->wait_usecs > 150) {
    873			pin->wait_usecs -= 100;
    874			pin->timer_ts = ktime_add_us(ts, 100);
    875			hrtimer_forward_now(timer, ns_to_ktime(100000));
    876			return HRTIMER_RESTART;
    877		}
    878		if (pin->wait_usecs > 100) {
    879			pin->wait_usecs /= 2;
    880			pin->timer_ts = ktime_add_us(ts, pin->wait_usecs);
    881			hrtimer_forward_now(timer,
    882					ns_to_ktime(pin->wait_usecs * 1000));
    883			return HRTIMER_RESTART;
    884		}
    885		pin->timer_ts = ktime_add_us(ts, pin->wait_usecs);
    886		hrtimer_forward_now(timer,
    887				    ns_to_ktime(pin->wait_usecs * 1000));
    888		pin->wait_usecs = 0;
    889		return HRTIMER_RESTART;
    890	}
    891
    892	switch (pin->state) {
    893	/* Transmit states */
    894	case CEC_ST_TX_WAIT_FOR_HIGH:
    895	case CEC_ST_TX_START_BIT_LOW:
    896	case CEC_ST_TX_START_BIT_HIGH:
    897	case CEC_ST_TX_START_BIT_HIGH_SHORT:
    898	case CEC_ST_TX_START_BIT_HIGH_LONG:
    899	case CEC_ST_TX_START_BIT_LOW_CUSTOM:
    900	case CEC_ST_TX_START_BIT_HIGH_CUSTOM:
    901	case CEC_ST_TX_DATA_BIT_0_LOW:
    902	case CEC_ST_TX_DATA_BIT_0_HIGH:
    903	case CEC_ST_TX_DATA_BIT_0_HIGH_SHORT:
    904	case CEC_ST_TX_DATA_BIT_0_HIGH_LONG:
    905	case CEC_ST_TX_DATA_BIT_1_LOW:
    906	case CEC_ST_TX_DATA_BIT_1_HIGH:
    907	case CEC_ST_TX_DATA_BIT_1_HIGH_SHORT:
    908	case CEC_ST_TX_DATA_BIT_1_HIGH_LONG:
    909	case CEC_ST_TX_DATA_BIT_1_HIGH_PRE_SAMPLE:
    910	case CEC_ST_TX_DATA_BIT_1_HIGH_POST_SAMPLE:
    911	case CEC_ST_TX_DATA_BIT_1_HIGH_POST_SAMPLE_SHORT:
    912	case CEC_ST_TX_DATA_BIT_1_HIGH_POST_SAMPLE_LONG:
    913	case CEC_ST_TX_DATA_BIT_LOW_CUSTOM:
    914	case CEC_ST_TX_DATA_BIT_HIGH_CUSTOM:
    915	case CEC_ST_TX_PULSE_LOW_CUSTOM:
    916	case CEC_ST_TX_PULSE_HIGH_CUSTOM:
    917		cec_pin_tx_states(pin, ts);
    918		break;
    919
    920	/* Receive states */
    921	case CEC_ST_RX_START_BIT_LOW:
    922	case CEC_ST_RX_START_BIT_HIGH:
    923	case CEC_ST_RX_DATA_SAMPLE:
    924	case CEC_ST_RX_DATA_POST_SAMPLE:
    925	case CEC_ST_RX_DATA_WAIT_FOR_LOW:
    926	case CEC_ST_RX_ACK_LOW:
    927	case CEC_ST_RX_ACK_LOW_POST:
    928	case CEC_ST_RX_ACK_HIGH_POST:
    929	case CEC_ST_RX_ACK_FINISH:
    930		cec_pin_rx_states(pin, ts);
    931		break;
    932
    933	case CEC_ST_IDLE:
    934	case CEC_ST_TX_WAIT:
    935		if (!cec_pin_high(pin)) {
    936			/* Start bit, switch to receive state */
    937			pin->ts = ts;
    938			pin->state = CEC_ST_RX_START_BIT_LOW;
    939			/*
    940			 * If a transmit is pending, then that transmit should
    941			 * use a signal free time of no more than
    942			 * CEC_SIGNAL_FREE_TIME_NEW_INITIATOR since it will
    943			 * have a new initiator due to the receive that is now
    944			 * starting.
    945			 */
    946			if (pin->tx_msg.len && pin->tx_signal_free_time >
    947			    CEC_SIGNAL_FREE_TIME_NEW_INITIATOR)
    948				pin->tx_signal_free_time =
    949					CEC_SIGNAL_FREE_TIME_NEW_INITIATOR;
    950			break;
    951		}
    952		if (ktime_to_ns(pin->ts) == 0)
    953			pin->ts = ts;
    954		if (pin->tx_msg.len) {
    955			/*
    956			 * Check if the bus has been free for long enough
    957			 * so we can kick off the pending transmit.
    958			 */
    959			delta = ktime_us_delta(ts, pin->ts);
    960			if (delta / CEC_TIM_DATA_BIT_TOTAL >=
    961			    pin->tx_signal_free_time) {
    962				pin->tx_nacked = false;
    963				if (tx_custom_start(pin))
    964					pin->state = CEC_ST_TX_START_BIT_LOW_CUSTOM;
    965				else
    966					pin->state = CEC_ST_TX_START_BIT_LOW;
    967				/* Generate start bit */
    968				cec_pin_low(pin);
    969				break;
    970			}
    971			if (delta / CEC_TIM_DATA_BIT_TOTAL >=
    972			    pin->tx_signal_free_time - 1)
    973				pin->state = CEC_ST_TX_WAIT;
    974			break;
    975		}
    976		if (pin->tx_custom_pulse && pin->state == CEC_ST_IDLE) {
    977			pin->tx_custom_pulse = false;
    978			/* Generate custom pulse */
    979			cec_pin_low(pin);
    980			pin->state = CEC_ST_TX_PULSE_LOW_CUSTOM;
    981			break;
    982		}
    983		if (pin->state != CEC_ST_IDLE || pin->ops->enable_irq == NULL ||
    984		    pin->enable_irq_failed || adap->is_configuring ||
    985		    adap->is_configured || adap->monitor_all_cnt)
    986			break;
    987		/* Switch to interrupt mode */
    988		atomic_set(&pin->work_irq_change, CEC_PIN_IRQ_ENABLE);
    989		pin->state = CEC_ST_RX_IRQ;
    990		wake_up_interruptible(&pin->kthread_waitq);
    991		return HRTIMER_NORESTART;
    992
    993	case CEC_ST_TX_LOW_DRIVE:
    994	case CEC_ST_RX_LOW_DRIVE:
    995		cec_pin_high(pin);
    996		cec_pin_to_idle(pin);
    997		break;
    998
    999	default:
   1000		break;
   1001	}
   1002
   1003	switch (pin->state) {
   1004	case CEC_ST_TX_START_BIT_LOW_CUSTOM:
   1005	case CEC_ST_TX_DATA_BIT_LOW_CUSTOM:
   1006	case CEC_ST_TX_PULSE_LOW_CUSTOM:
   1007		usecs = pin->tx_custom_low_usecs;
   1008		break;
   1009	case CEC_ST_TX_START_BIT_HIGH_CUSTOM:
   1010	case CEC_ST_TX_DATA_BIT_HIGH_CUSTOM:
   1011	case CEC_ST_TX_PULSE_HIGH_CUSTOM:
   1012		usecs = pin->tx_custom_high_usecs;
   1013		break;
   1014	default:
   1015		usecs = states[pin->state].usecs;
   1016		break;
   1017	}
   1018
   1019	if (!adap->monitor_pin_cnt || usecs <= 150) {
   1020		pin->wait_usecs = 0;
   1021		pin->timer_ts = ktime_add_us(ts, usecs);
   1022		hrtimer_forward_now(timer,
   1023				ns_to_ktime(usecs * 1000));
   1024		return HRTIMER_RESTART;
   1025	}
   1026	pin->wait_usecs = usecs - 100;
   1027	pin->timer_ts = ktime_add_us(ts, 100);
   1028	hrtimer_forward_now(timer, ns_to_ktime(100000));
   1029	return HRTIMER_RESTART;
   1030}
   1031
   1032static int cec_pin_thread_func(void *_adap)
   1033{
   1034	struct cec_adapter *adap = _adap;
   1035	struct cec_pin *pin = adap->pin;
   1036	bool irq_enabled = false;
   1037
   1038	for (;;) {
   1039		wait_event_interruptible(pin->kthread_waitq,
   1040					 kthread_should_stop() ||
   1041					 pin->work_rx_msg.len ||
   1042					 pin->work_tx_status ||
   1043					 atomic_read(&pin->work_irq_change) ||
   1044					 atomic_read(&pin->work_pin_num_events));
   1045
   1046		if (kthread_should_stop())
   1047			break;
   1048
   1049		if (pin->work_rx_msg.len) {
   1050			struct cec_msg *msg = &pin->work_rx_msg;
   1051
   1052			if (msg->len > 1 && msg->len < CEC_MAX_MSG_SIZE &&
   1053			    rx_add_byte(pin)) {
   1054				/* Error injection: add byte to the message */
   1055				msg->msg[msg->len++] = 0x55;
   1056			}
   1057			if (msg->len > 2 && rx_remove_byte(pin)) {
   1058				/* Error injection: remove byte from message */
   1059				msg->len--;
   1060			}
   1061			if (msg->len > CEC_MAX_MSG_SIZE)
   1062				msg->len = CEC_MAX_MSG_SIZE;
   1063			cec_received_msg_ts(adap, msg,
   1064				ns_to_ktime(pin->work_rx_msg.rx_ts));
   1065			msg->len = 0;
   1066		}
   1067
   1068		if (pin->work_tx_status) {
   1069			unsigned int tx_status = pin->work_tx_status;
   1070
   1071			pin->work_tx_status = 0;
   1072			cec_transmit_attempt_done_ts(adap, tx_status,
   1073						     pin->work_tx_ts);
   1074		}
   1075
   1076		while (atomic_read(&pin->work_pin_num_events)) {
   1077			unsigned int idx = pin->work_pin_events_rd;
   1078			u8 v = pin->work_pin_events[idx];
   1079
   1080			cec_queue_pin_cec_event(adap,
   1081						v & CEC_PIN_EVENT_FL_IS_HIGH,
   1082						v & CEC_PIN_EVENT_FL_DROPPED,
   1083						pin->work_pin_ts[idx]);
   1084			pin->work_pin_events_rd = (idx + 1) % CEC_NUM_PIN_EVENTS;
   1085			atomic_dec(&pin->work_pin_num_events);
   1086		}
   1087
   1088		switch (atomic_xchg(&pin->work_irq_change,
   1089				    CEC_PIN_IRQ_UNCHANGED)) {
   1090		case CEC_PIN_IRQ_DISABLE:
   1091			if (irq_enabled) {
   1092				call_void_pin_op(pin, disable_irq);
   1093				irq_enabled = false;
   1094			}
   1095			cec_pin_high(pin);
   1096			if (pin->state == CEC_ST_OFF)
   1097				break;
   1098			cec_pin_to_idle(pin);
   1099			hrtimer_start(&pin->timer, ns_to_ktime(0),
   1100				      HRTIMER_MODE_REL);
   1101			break;
   1102		case CEC_PIN_IRQ_ENABLE:
   1103			if (irq_enabled)
   1104				break;
   1105			pin->enable_irq_failed = !call_pin_op(pin, enable_irq);
   1106			if (pin->enable_irq_failed) {
   1107				cec_pin_to_idle(pin);
   1108				hrtimer_start(&pin->timer, ns_to_ktime(0),
   1109					      HRTIMER_MODE_REL);
   1110			} else {
   1111				irq_enabled = true;
   1112			}
   1113			break;
   1114		default:
   1115			break;
   1116		}
   1117	}
   1118	return 0;
   1119}
   1120
   1121static int cec_pin_adap_enable(struct cec_adapter *adap, bool enable)
   1122{
   1123	struct cec_pin *pin = adap->pin;
   1124
   1125	if (enable) {
   1126		cec_pin_read(pin);
   1127		cec_pin_to_idle(pin);
   1128		pin->tx_msg.len = 0;
   1129		pin->timer_ts = ns_to_ktime(0);
   1130		atomic_set(&pin->work_irq_change, CEC_PIN_IRQ_UNCHANGED);
   1131		if (!pin->kthread) {
   1132			pin->kthread = kthread_run(cec_pin_thread_func, adap,
   1133						   "cec-pin");
   1134			if (IS_ERR(pin->kthread)) {
   1135				int err = PTR_ERR(pin->kthread);
   1136
   1137				pr_err("cec-pin: kernel_thread() failed\n");
   1138				pin->kthread = NULL;
   1139				return err;
   1140			}
   1141		}
   1142		hrtimer_start(&pin->timer, ns_to_ktime(0),
   1143			      HRTIMER_MODE_REL);
   1144	} else if (pin->kthread) {
   1145		hrtimer_cancel(&pin->timer);
   1146		cec_pin_high(pin);
   1147		cec_pin_to_idle(pin);
   1148		pin->state = CEC_ST_OFF;
   1149		pin->work_tx_status = 0;
   1150		atomic_set(&pin->work_irq_change, CEC_PIN_IRQ_DISABLE);
   1151		wake_up_interruptible(&pin->kthread_waitq);
   1152	}
   1153	return 0;
   1154}
   1155
   1156static int cec_pin_adap_log_addr(struct cec_adapter *adap, u8 log_addr)
   1157{
   1158	struct cec_pin *pin = adap->pin;
   1159
   1160	if (log_addr == CEC_LOG_ADDR_INVALID)
   1161		pin->la_mask = 0;
   1162	else
   1163		pin->la_mask |= (1 << log_addr);
   1164	return 0;
   1165}
   1166
   1167void cec_pin_start_timer(struct cec_pin *pin)
   1168{
   1169	if (pin->state != CEC_ST_RX_IRQ)
   1170		return;
   1171
   1172	atomic_set(&pin->work_irq_change, CEC_PIN_IRQ_DISABLE);
   1173	wake_up_interruptible(&pin->kthread_waitq);
   1174}
   1175
   1176static int cec_pin_adap_transmit(struct cec_adapter *adap, u8 attempts,
   1177				      u32 signal_free_time, struct cec_msg *msg)
   1178{
   1179	struct cec_pin *pin = adap->pin;
   1180
   1181	/*
   1182	 * If a receive is in progress, then this transmit should use
   1183	 * a signal free time of max CEC_SIGNAL_FREE_TIME_NEW_INITIATOR
   1184	 * since when it starts transmitting it will have a new initiator.
   1185	 */
   1186	if (pin->state != CEC_ST_IDLE &&
   1187	    signal_free_time > CEC_SIGNAL_FREE_TIME_NEW_INITIATOR)
   1188		signal_free_time = CEC_SIGNAL_FREE_TIME_NEW_INITIATOR;
   1189
   1190	pin->tx_signal_free_time = signal_free_time;
   1191	pin->tx_extra_bytes = 0;
   1192	pin->tx_msg = *msg;
   1193	if (msg->len > 1) {
   1194		/* Error injection: add byte to the message */
   1195		pin->tx_extra_bytes = tx_add_bytes(pin);
   1196	}
   1197	if (msg->len > 2 && tx_remove_byte(pin)) {
   1198		/* Error injection: remove byte from the message */
   1199		pin->tx_msg.len--;
   1200	}
   1201	pin->work_tx_status = 0;
   1202	pin->tx_bit = 0;
   1203	cec_pin_start_timer(pin);
   1204	return 0;
   1205}
   1206
   1207static void cec_pin_adap_status(struct cec_adapter *adap,
   1208				       struct seq_file *file)
   1209{
   1210	struct cec_pin *pin = adap->pin;
   1211
   1212	seq_printf(file, "state: %s\n", states[pin->state].name);
   1213	seq_printf(file, "tx_bit: %d\n", pin->tx_bit);
   1214	seq_printf(file, "rx_bit: %d\n", pin->rx_bit);
   1215	seq_printf(file, "cec pin: %d\n", call_pin_op(pin, read));
   1216	seq_printf(file, "cec pin events dropped: %u\n",
   1217		   pin->work_pin_events_dropped_cnt);
   1218	seq_printf(file, "irq failed: %d\n", pin->enable_irq_failed);
   1219	if (pin->timer_100us_overruns) {
   1220		seq_printf(file, "timer overruns > 100us: %u of %u\n",
   1221			   pin->timer_100us_overruns, pin->timer_cnt);
   1222		seq_printf(file, "timer overruns > 300us: %u of %u\n",
   1223			   pin->timer_300us_overruns, pin->timer_cnt);
   1224		seq_printf(file, "max timer overrun: %u usecs\n",
   1225			   pin->timer_max_overrun);
   1226		seq_printf(file, "avg timer overrun: %u usecs\n",
   1227			   pin->timer_sum_overrun / pin->timer_100us_overruns);
   1228	}
   1229	if (pin->rx_start_bit_low_too_short_cnt)
   1230		seq_printf(file,
   1231			   "rx start bit low too short: %u (delta %u, ts %llu)\n",
   1232			   pin->rx_start_bit_low_too_short_cnt,
   1233			   pin->rx_start_bit_low_too_short_delta,
   1234			   pin->rx_start_bit_low_too_short_ts);
   1235	if (pin->rx_start_bit_too_short_cnt)
   1236		seq_printf(file,
   1237			   "rx start bit too short: %u (delta %u, ts %llu)\n",
   1238			   pin->rx_start_bit_too_short_cnt,
   1239			   pin->rx_start_bit_too_short_delta,
   1240			   pin->rx_start_bit_too_short_ts);
   1241	if (pin->rx_start_bit_too_long_cnt)
   1242		seq_printf(file, "rx start bit too long: %u\n",
   1243			   pin->rx_start_bit_too_long_cnt);
   1244	if (pin->rx_data_bit_too_short_cnt)
   1245		seq_printf(file,
   1246			   "rx data bit too short: %u (delta %u, ts %llu)\n",
   1247			   pin->rx_data_bit_too_short_cnt,
   1248			   pin->rx_data_bit_too_short_delta,
   1249			   pin->rx_data_bit_too_short_ts);
   1250	if (pin->rx_data_bit_too_long_cnt)
   1251		seq_printf(file, "rx data bit too long: %u\n",
   1252			   pin->rx_data_bit_too_long_cnt);
   1253	seq_printf(file, "rx initiated low drive: %u\n", pin->rx_low_drive_cnt);
   1254	seq_printf(file, "tx detected low drive: %u\n", pin->tx_low_drive_cnt);
   1255	pin->work_pin_events_dropped_cnt = 0;
   1256	pin->timer_cnt = 0;
   1257	pin->timer_100us_overruns = 0;
   1258	pin->timer_300us_overruns = 0;
   1259	pin->timer_max_overrun = 0;
   1260	pin->timer_sum_overrun = 0;
   1261	pin->rx_start_bit_low_too_short_cnt = 0;
   1262	pin->rx_start_bit_too_short_cnt = 0;
   1263	pin->rx_start_bit_too_long_cnt = 0;
   1264	pin->rx_data_bit_too_short_cnt = 0;
   1265	pin->rx_data_bit_too_long_cnt = 0;
   1266	pin->rx_low_drive_cnt = 0;
   1267	pin->tx_low_drive_cnt = 0;
   1268	call_void_pin_op(pin, status, file);
   1269}
   1270
   1271static int cec_pin_adap_monitor_all_enable(struct cec_adapter *adap,
   1272						  bool enable)
   1273{
   1274	struct cec_pin *pin = adap->pin;
   1275
   1276	pin->monitor_all = enable;
   1277	return 0;
   1278}
   1279
   1280static void cec_pin_adap_free(struct cec_adapter *adap)
   1281{
   1282	struct cec_pin *pin = adap->pin;
   1283
   1284	if (pin->kthread)
   1285		kthread_stop(pin->kthread);
   1286	pin->kthread = NULL;
   1287	if (pin->ops->free)
   1288		pin->ops->free(adap);
   1289	adap->pin = NULL;
   1290	kfree(pin);
   1291}
   1292
   1293static int cec_pin_received(struct cec_adapter *adap, struct cec_msg *msg)
   1294{
   1295	struct cec_pin *pin = adap->pin;
   1296
   1297	if (pin->ops->received && !adap->devnode.unregistered)
   1298		return pin->ops->received(adap, msg);
   1299	return -ENOMSG;
   1300}
   1301
   1302void cec_pin_changed(struct cec_adapter *adap, bool value)
   1303{
   1304	struct cec_pin *pin = adap->pin;
   1305
   1306	cec_pin_update(pin, value, false);
   1307	if (!value && (adap->is_configuring || adap->is_configured ||
   1308		       adap->monitor_all_cnt))
   1309		atomic_set(&pin->work_irq_change, CEC_PIN_IRQ_DISABLE);
   1310}
   1311EXPORT_SYMBOL_GPL(cec_pin_changed);
   1312
   1313static const struct cec_adap_ops cec_pin_adap_ops = {
   1314	.adap_enable = cec_pin_adap_enable,
   1315	.adap_monitor_all_enable = cec_pin_adap_monitor_all_enable,
   1316	.adap_log_addr = cec_pin_adap_log_addr,
   1317	.adap_transmit = cec_pin_adap_transmit,
   1318	.adap_status = cec_pin_adap_status,
   1319	.adap_free = cec_pin_adap_free,
   1320#ifdef CONFIG_CEC_PIN_ERROR_INJ
   1321	.error_inj_parse_line = cec_pin_error_inj_parse_line,
   1322	.error_inj_show = cec_pin_error_inj_show,
   1323#endif
   1324	.received = cec_pin_received,
   1325};
   1326
   1327struct cec_adapter *cec_pin_allocate_adapter(const struct cec_pin_ops *pin_ops,
   1328					void *priv, const char *name, u32 caps)
   1329{
   1330	struct cec_adapter *adap;
   1331	struct cec_pin *pin = kzalloc(sizeof(*pin), GFP_KERNEL);
   1332
   1333	if (pin == NULL)
   1334		return ERR_PTR(-ENOMEM);
   1335	pin->ops = pin_ops;
   1336	hrtimer_init(&pin->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
   1337	atomic_set(&pin->work_pin_num_events, 0);
   1338	pin->timer.function = cec_pin_timer;
   1339	init_waitqueue_head(&pin->kthread_waitq);
   1340	pin->tx_custom_low_usecs = CEC_TIM_CUSTOM_DEFAULT;
   1341	pin->tx_custom_high_usecs = CEC_TIM_CUSTOM_DEFAULT;
   1342
   1343	adap = cec_allocate_adapter(&cec_pin_adap_ops, priv, name,
   1344			    caps | CEC_CAP_MONITOR_ALL | CEC_CAP_MONITOR_PIN,
   1345			    CEC_MAX_LOG_ADDRS);
   1346
   1347	if (IS_ERR(adap)) {
   1348		kfree(pin);
   1349		return adap;
   1350	}
   1351
   1352	adap->pin = pin;
   1353	pin->adap = adap;
   1354	cec_pin_update(pin, cec_pin_high(pin), true);
   1355	return adap;
   1356}
   1357EXPORT_SYMBOL_GPL(cec_pin_allocate_adapter);