cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

asus-tf103c-dock.c (27719B)


      1// SPDX-License-Identifier: GPL-2.0+
      2/*
      3 * This is a driver for the keyboard, touchpad and USB port of the
      4 * keyboard dock for the Asus TF103C 2-in-1 tablet.
      5 *
      6 * This keyboard dock has its own I2C attached embedded controller
      7 * and the keyboard and touchpad are also connected over I2C,
      8 * instead of using the usual USB connection. This means that the
      9 * keyboard dock requires this special driver to function.
     10 *
     11 * Copyright (C) 2021 Hans de Goede <hdegoede@redhat.com>
     12 */
     13
     14#include <linux/acpi.h>
     15#include <linux/delay.h>
     16#include <linux/dmi.h>
     17#include <linux/gpio/consumer.h>
     18#include <linux/gpio/machine.h>
     19#include <linux/hid.h>
     20#include <linux/i2c.h>
     21#include <linux/input.h>
     22#include <linux/irq.h>
     23#include <linux/irqdomain.h>
     24#include <linux/mod_devicetable.h>
     25#include <linux/moduleparam.h>
     26#include <linux/module.h>
     27#include <linux/pm.h>
     28#include <linux/workqueue.h>
     29#include <asm/unaligned.h>
     30
     31static bool fnlock;
     32module_param(fnlock, bool, 0644);
     33MODULE_PARM_DESC(fnlock,
     34		 "By default the kbd toprow sends multimedia key presses. AltGr "
     35		 "can be pressed to change this to F1-F12. Set this to 1 to "
     36		 "change the default. Press AltGr + Esc to toggle at runtime.");
     37
     38#define TF103C_DOCK_DEV_NAME				"NPCE69A:00"
     39
     40#define TF103C_DOCK_HPD_DEBOUNCE			msecs_to_jiffies(20)
     41
     42/*** Touchpad I2C device defines ***/
     43#define TF103C_DOCK_TP_ADDR				0x15
     44
     45/*** Keyboard I2C device defines **A*/
     46#define TF103C_DOCK_KBD_ADDR				0x16
     47
     48#define TF103C_DOCK_KBD_DATA_REG			0x73
     49#define TF103C_DOCK_KBD_DATA_MIN_LENGTH			4
     50#define TF103C_DOCK_KBD_DATA_MAX_LENGTH			11
     51#define TF103C_DOCK_KBD_DATA_MODIFIERS			3
     52#define TF103C_DOCK_KBD_DATA_KEYS			5
     53#define TF103C_DOCK_KBD_CMD_REG				0x75
     54
     55#define TF103C_DOCK_KBD_CMD_ENABLE			0x0800
     56
     57/*** EC innterrupt data I2C device defines ***/
     58#define TF103C_DOCK_INTR_ADDR				0x19
     59#define TF103C_DOCK_INTR_DATA_REG			0x6a
     60
     61#define TF103C_DOCK_INTR_DATA1_OBF_MASK			0x01
     62#define TF103C_DOCK_INTR_DATA1_KEY_MASK			0x04
     63#define TF103C_DOCK_INTR_DATA1_KBC_MASK			0x08
     64#define TF103C_DOCK_INTR_DATA1_AUX_MASK			0x20
     65#define TF103C_DOCK_INTR_DATA1_SCI_MASK			0x40
     66#define TF103C_DOCK_INTR_DATA1_SMI_MASK			0x80
     67/* Special values for the OOB data on kbd_client / tp_client */
     68#define TF103C_DOCK_INTR_DATA1_OOB_VALUE		0xc1
     69#define TF103C_DOCK_INTR_DATA2_OOB_VALUE		0x04
     70
     71#define TF103C_DOCK_SMI_AC_EVENT			0x31
     72#define TF103C_DOCK_SMI_HANDSHAKING			0x50
     73#define TF103C_DOCK_SMI_EC_WAKEUP			0x53
     74#define TF103C_DOCK_SMI_BOOTBLOCK_RESET			0x5e
     75#define TF103C_DOCK_SMI_WATCHDOG_RESET			0x5f
     76#define TF103C_DOCK_SMI_ADAPTER_CHANGE			0x60
     77#define TF103C_DOCK_SMI_DOCK_INSERT			0x61
     78#define TF103C_DOCK_SMI_DOCK_REMOVE			0x62
     79#define TF103C_DOCK_SMI_PAD_BL_CHANGE			0x63
     80#define TF103C_DOCK_SMI_HID_STATUS_CHANGED		0x64
     81#define TF103C_DOCK_SMI_HID_WAKEUP			0x65
     82#define TF103C_DOCK_SMI_S3				0x83
     83#define TF103C_DOCK_SMI_S5				0x85
     84#define TF103C_DOCK_SMI_NOTIFY_SHUTDOWN			0x90
     85#define TF103C_DOCK_SMI_RESUME				0x91
     86
     87/*** EC (dockram) I2C device defines ***/
     88#define TF103C_DOCK_EC_ADDR				0x1b
     89
     90#define TF103C_DOCK_EC_CMD_REG				0x0a
     91#define TF103C_DOCK_EC_CMD_LEN				9
     92
     93enum {
     94	TF103C_DOCK_FLAG_HID_OPEN,
     95};
     96
     97struct tf103c_dock_data {
     98	struct delayed_work hpd_work;
     99	struct irq_chip tp_irqchip;
    100	struct irq_domain *tp_irq_domain;
    101	struct i2c_client *ec_client;
    102	struct i2c_client *intr_client;
    103	struct i2c_client *kbd_client;
    104	struct i2c_client *tp_client;
    105	struct gpio_desc *pwr_en;
    106	struct gpio_desc *irq_gpio;
    107	struct gpio_desc *hpd_gpio;
    108	struct input_dev *input;
    109	struct hid_device *hid;
    110	unsigned long flags;
    111	int board_rev;
    112	int irq;
    113	int hpd_irq;
    114	int tp_irq;
    115	int last_press_0x13;
    116	int last_press_0x14;
    117	bool enabled;
    118	bool tp_enabled;
    119	bool altgr_pressed;
    120	bool esc_pressed;
    121	bool filter_esc;
    122	u8 kbd_buf[TF103C_DOCK_KBD_DATA_MAX_LENGTH];
    123};
    124
    125static struct gpiod_lookup_table tf103c_dock_gpios = {
    126	.dev_id = "i2c-" TF103C_DOCK_DEV_NAME,
    127	.table = {
    128		GPIO_LOOKUP("INT33FC:00",      55, "dock_pwr_en", GPIO_ACTIVE_HIGH),
    129		GPIO_LOOKUP("INT33FC:02",       1, "dock_irq", GPIO_ACTIVE_HIGH),
    130		GPIO_LOOKUP("INT33FC:02",      29, "dock_hpd", GPIO_ACTIVE_HIGH),
    131		GPIO_LOOKUP("gpio_crystalcove", 2, "board_rev", GPIO_ACTIVE_HIGH),
    132		{}
    133	},
    134};
    135
    136/* Byte 0 is the length of the rest of the packet */
    137static const u8 tf103c_dock_enable_cmd[9] = { 8, 0x20, 0, 0, 0, 0, 0x20, 0, 0 };
    138static const u8 tf103c_dock_usb_enable_cmd[9] = { 8, 0, 0, 0, 0, 0, 0, 0x40, 0 };
    139static const u8 tf103c_dock_suspend_cmd[9] = { 8, 0, 0x20, 0, 0, 0x22, 0, 0, 0 };
    140
    141/*** keyboard related code ***/
    142
    143static u8 tf103c_dock_kbd_hid_desc[] = {
    144	0x05, 0x01,         /*  Usage Page (Desktop),               */
    145	0x09, 0x06,         /*  Usage (Keyboard),                   */
    146	0xA1, 0x01,         /*  Collection (Application),           */
    147	0x85, 0x11,         /*      Report ID (17),                 */
    148	0x95, 0x08,         /*      Report Count (8),               */
    149	0x75, 0x01,         /*      Report Size (1),                */
    150	0x15, 0x00,         /*      Logical Minimum (0),            */
    151	0x25, 0x01,         /*      Logical Maximum (1),            */
    152	0x05, 0x07,         /*      Usage Page (Keyboard),          */
    153	0x19, 0xE0,         /*      Usage Minimum (KB Leftcontrol), */
    154	0x29, 0xE7,         /*      Usage Maximum (KB Right GUI),   */
    155	0x81, 0x02,         /*      Input (Variable),               */
    156	0x95, 0x01,         /*      Report Count (1),               */
    157	0x75, 0x08,         /*      Report Size (8),                */
    158	0x81, 0x01,         /*      Input (Constant),               */
    159	0x95, 0x06,         /*      Report Count (6),               */
    160	0x75, 0x08,         /*      Report Size (8),                */
    161	0x15, 0x00,         /*      Logical Minimum (0),            */
    162	0x26, 0xFF, 0x00,   /*      Logical Maximum (255),          */
    163	0x05, 0x07,         /*      Usage Page (Keyboard),          */
    164	0x19, 0x00,         /*      Usage Minimum (None),           */
    165	0x2A, 0xFF, 0x00,   /*      Usage Maximum (FFh),            */
    166	0x81, 0x00,         /*      Input,                          */
    167	0xC0                /*  End Collection                      */
    168};
    169
    170static int tf103c_dock_kbd_read(struct tf103c_dock_data *dock)
    171{
    172	struct i2c_client *client = dock->kbd_client;
    173	struct device *dev = &dock->ec_client->dev;
    174	struct i2c_msg msgs[2];
    175	u8 reg[2];
    176	int ret;
    177
    178	reg[0] = TF103C_DOCK_KBD_DATA_REG & 0xff;
    179	reg[1] = TF103C_DOCK_KBD_DATA_REG >> 8;
    180
    181	msgs[0].addr = client->addr;
    182	msgs[0].flags = 0;
    183	msgs[0].len = sizeof(reg);
    184	msgs[0].buf = reg;
    185
    186	msgs[1].addr = client->addr;
    187	msgs[1].flags = I2C_M_RD;
    188	msgs[1].len = TF103C_DOCK_KBD_DATA_MAX_LENGTH;
    189	msgs[1].buf = dock->kbd_buf;
    190
    191	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
    192	if (ret != ARRAY_SIZE(msgs)) {
    193		dev_err(dev, "error %d reading kbd data\n", ret);
    194		return -EIO;
    195	}
    196
    197	return 0;
    198}
    199
    200static void tf103c_dock_kbd_write(struct tf103c_dock_data *dock, u16 cmd)
    201{
    202	struct device *dev = &dock->ec_client->dev;
    203	u8 buf[4];
    204	int ret;
    205
    206	put_unaligned_le16(TF103C_DOCK_KBD_CMD_REG, &buf[0]);
    207	put_unaligned_le16(cmd, &buf[2]);
    208
    209	ret = i2c_master_send(dock->kbd_client, buf, sizeof(buf));
    210	if (ret != sizeof(buf))
    211		dev_err(dev, "error %d writing kbd cmd\n", ret);
    212}
    213
    214/* HID ll_driver functions for forwarding input-reports from the kbd_client */
    215static int tf103c_dock_hid_parse(struct hid_device *hid)
    216{
    217	return hid_parse_report(hid, tf103c_dock_kbd_hid_desc,
    218				sizeof(tf103c_dock_kbd_hid_desc));
    219}
    220
    221static int tf103c_dock_hid_start(struct hid_device *hid)
    222{
    223	return 0;
    224}
    225
    226static void tf103c_dock_hid_stop(struct hid_device *hid)
    227{
    228	hid->claimed = 0;
    229}
    230
    231static int tf103c_dock_hid_open(struct hid_device *hid)
    232{
    233	struct tf103c_dock_data *dock = hid->driver_data;
    234
    235	set_bit(TF103C_DOCK_FLAG_HID_OPEN, &dock->flags);
    236	return 0;
    237}
    238
    239static void tf103c_dock_hid_close(struct hid_device *hid)
    240{
    241	struct tf103c_dock_data *dock = hid->driver_data;
    242
    243	clear_bit(TF103C_DOCK_FLAG_HID_OPEN, &dock->flags);
    244}
    245
    246/* Mandatory, but not used */
    247static int tf103c_dock_hid_raw_request(struct hid_device *hid, u8 reportnum,
    248				       u8 *buf, size_t len, u8 rtype, int reqtype)
    249{
    250	return 0;
    251}
    252
    253static struct hid_ll_driver tf103c_dock_hid_ll_driver = {
    254	.parse = tf103c_dock_hid_parse,
    255	.start = tf103c_dock_hid_start,
    256	.stop = tf103c_dock_hid_stop,
    257	.open = tf103c_dock_hid_open,
    258	.close = tf103c_dock_hid_close,
    259	.raw_request = tf103c_dock_hid_raw_request,
    260};
    261
    262static int tf103c_dock_toprow_codes[13][2] = {
    263	/* Normal,            AltGr pressed */
    264	{ KEY_POWER,          KEY_F1 },
    265	{ KEY_RFKILL,         KEY_F2 },
    266	{ KEY_F21,            KEY_F3 }, /* Touchpad toggle, userspace expects F21 */
    267	{ KEY_BRIGHTNESSDOWN, KEY_F4 },
    268	{ KEY_BRIGHTNESSUP,   KEY_F5 },
    269	{ KEY_CAMERA,         KEY_F6 },
    270	{ KEY_CONFIG,         KEY_F7 },
    271	{ KEY_PREVIOUSSONG,   KEY_F8 },
    272	{ KEY_PLAYPAUSE,      KEY_F9 },
    273	{ KEY_NEXTSONG,       KEY_F10 },
    274	{ KEY_MUTE,           KEY_F11 },
    275	{ KEY_VOLUMEDOWN,     KEY_F12 },
    276	{ KEY_VOLUMEUP,       KEY_SYSRQ },
    277};
    278
    279static void tf103c_dock_report_toprow_kbd_hook(struct tf103c_dock_data *dock)
    280{
    281	u8 *esc, *buf = dock->kbd_buf;
    282	int size;
    283
    284	/*
    285	 * Stop AltGr reports from getting reported on the "Asus TF103C Dock
    286	 * Keyboard" input_dev, since this gets used as "Fn" key for the toprow
    287	 * keys. Instead we report this on the "Asus TF103C Dock Top Row Keys"
    288	 * input_dev, when not used to modify the toprow keys.
    289	 */
    290	dock->altgr_pressed = buf[TF103C_DOCK_KBD_DATA_MODIFIERS] & 0x40;
    291	buf[TF103C_DOCK_KBD_DATA_MODIFIERS] &= ~0x40;
    292
    293	input_report_key(dock->input, KEY_RIGHTALT, dock->altgr_pressed);
    294	input_sync(dock->input);
    295
    296	/* Toggle fnlock on AltGr + Esc press */
    297	buf = buf + TF103C_DOCK_KBD_DATA_KEYS;
    298	size = TF103C_DOCK_KBD_DATA_MAX_LENGTH - TF103C_DOCK_KBD_DATA_KEYS;
    299	esc = memchr(buf, 0x29, size);
    300	if (!dock->esc_pressed && esc) {
    301		if (dock->altgr_pressed) {
    302			fnlock = !fnlock;
    303			dock->filter_esc = true;
    304		}
    305	}
    306	if (esc && dock->filter_esc)
    307		*esc = 0;
    308	else
    309		dock->filter_esc = false;
    310
    311	dock->esc_pressed = esc != NULL;
    312}
    313
    314static void tf103c_dock_toprow_press(struct tf103c_dock_data *dock, int key_code)
    315{
    316	/*
    317	 * Release AltGr before reporting the toprow key, so that userspace
    318	 * sees e.g. just KEY_SUSPEND and not AltGr + KEY_SUSPEND.
    319	 */
    320	if (dock->altgr_pressed) {
    321		input_report_key(dock->input, KEY_RIGHTALT, false);
    322		input_sync(dock->input);
    323	}
    324
    325	input_report_key(dock->input, key_code, true);
    326	input_sync(dock->input);
    327}
    328
    329static void tf103c_dock_toprow_release(struct tf103c_dock_data *dock, int key_code)
    330{
    331	input_report_key(dock->input, key_code, false);
    332	input_sync(dock->input);
    333
    334	if (dock->altgr_pressed) {
    335		input_report_key(dock->input, KEY_RIGHTALT, true);
    336		input_sync(dock->input);
    337	}
    338}
    339
    340static void tf103c_dock_toprow_event(struct tf103c_dock_data *dock,
    341					    int toprow_index, int *last_press)
    342{
    343	int key_code, fn = dock->altgr_pressed ^ fnlock;
    344
    345	if (last_press && *last_press) {
    346		tf103c_dock_toprow_release(dock, *last_press);
    347		*last_press = 0;
    348	}
    349
    350	if (toprow_index < 0)
    351		return;
    352
    353	key_code = tf103c_dock_toprow_codes[toprow_index][fn];
    354	tf103c_dock_toprow_press(dock, key_code);
    355
    356	if (last_press)
    357		*last_press = key_code;
    358	else
    359		tf103c_dock_toprow_release(dock, key_code);
    360}
    361
    362/*
    363 * The keyboard sends what appears to be standard I2C-HID input-reports,
    364 * except that a 16 bit register address of where the I2C-HID format
    365 * input-reports are stored must be send before reading it in a single
    366 * (I2C repeated-start) I2C transaction.
    367 *
    368 * Its unknown how to get the HID descriptors but they are easy to reconstruct:
    369 *
    370 * Input report id 0x11 is 8 bytes long and contain standard USB HID intf-class,
    371 * Boot Interface Subclass reports.
    372 * Input report id 0x13 is 2 bytes long and sends Consumer Control events
    373 * Input report id 0x14 is 1 byte long and sends System Control events
    374 *
    375 * However the top row keys (where a normal keyboard has F1-F12 + Print-Screen)
    376 * are a mess, using a mix of the 0x13 and 0x14 input reports as well as EC SCI
    377 * events; and these need special handling to allow actually sending F1-F12,
    378 * since the Fn key on the keyboard only works on the cursor keys and the top
    379 * row keys always send their special "Multimedia hotkey" codes.
    380 *
    381 * So only forward the 0x11 reports to HID and handle the top-row keys here.
    382 */
    383static void tf103c_dock_kbd_interrupt(struct tf103c_dock_data *dock)
    384{
    385	struct device *dev = &dock->ec_client->dev;
    386	u8 *buf = dock->kbd_buf;
    387	int size;
    388
    389	if (tf103c_dock_kbd_read(dock))
    390		return;
    391
    392	size = buf[0] | buf[1] << 8;
    393	if (size < TF103C_DOCK_KBD_DATA_MIN_LENGTH ||
    394	    size > TF103C_DOCK_KBD_DATA_MAX_LENGTH) {
    395		dev_err(dev, "error reported kbd pkt size %d is out of range %d-%d\n", size,
    396			TF103C_DOCK_KBD_DATA_MIN_LENGTH,
    397			TF103C_DOCK_KBD_DATA_MAX_LENGTH);
    398		return;
    399	}
    400
    401	switch (buf[2]) {
    402	case 0x11:
    403		if (size != 11)
    404			break;
    405
    406		tf103c_dock_report_toprow_kbd_hook(dock);
    407
    408		if (test_bit(TF103C_DOCK_FLAG_HID_OPEN, &dock->flags))
    409			hid_input_report(dock->hid, HID_INPUT_REPORT, buf + 2, size - 2, 1);
    410		return;
    411	case 0x13:
    412		if (size != 5)
    413			break;
    414
    415		switch (buf[3] | buf[4] << 8) {
    416		case 0:
    417			tf103c_dock_toprow_event(dock, -1, &dock->last_press_0x13);
    418			return;
    419		case 0x70:
    420			tf103c_dock_toprow_event(dock, 3, &dock->last_press_0x13);
    421			return;
    422		case 0x6f:
    423			tf103c_dock_toprow_event(dock, 4, &dock->last_press_0x13);
    424			return;
    425		case 0xb6:
    426			tf103c_dock_toprow_event(dock, 7, &dock->last_press_0x13);
    427			return;
    428		case 0xcd:
    429			tf103c_dock_toprow_event(dock, 8, &dock->last_press_0x13);
    430			return;
    431		case 0xb5:
    432			tf103c_dock_toprow_event(dock, 9, &dock->last_press_0x13);
    433			return;
    434		case 0xe2:
    435			tf103c_dock_toprow_event(dock, 10, &dock->last_press_0x13);
    436			return;
    437		case 0xea:
    438			tf103c_dock_toprow_event(dock, 11, &dock->last_press_0x13);
    439			return;
    440		case 0xe9:
    441			tf103c_dock_toprow_event(dock, 12, &dock->last_press_0x13);
    442			return;
    443		}
    444		break;
    445	case 0x14:
    446		if (size != 4)
    447			break;
    448
    449		switch (buf[3]) {
    450		case 0:
    451			tf103c_dock_toprow_event(dock, -1, &dock->last_press_0x14);
    452			return;
    453		case 1:
    454			tf103c_dock_toprow_event(dock, 0, &dock->last_press_0x14);
    455			return;
    456		}
    457		break;
    458	}
    459
    460	dev_warn(dev, "warning unknown kbd data: %*ph\n", size, buf);
    461}
    462
    463/*** touchpad related code ***/
    464
    465static const struct property_entry tf103c_dock_touchpad_props[] = {
    466	PROPERTY_ENTRY_BOOL("elan,clickpad"),
    467	{ }
    468};
    469
    470static const struct software_node tf103c_dock_touchpad_sw_node = {
    471	.properties = tf103c_dock_touchpad_props,
    472};
    473
    474/*
    475 * tf103c_enable_touchpad() is only called from the threaded interrupt handler
    476 * and tf103c_disable_touchpad() is only called after the irq is disabled,
    477 * so no locking is necessary.
    478 */
    479static void tf103c_dock_enable_touchpad(struct tf103c_dock_data *dock)
    480{
    481	struct i2c_board_info board_info = { };
    482	struct device *dev = &dock->ec_client->dev;
    483	int ret;
    484
    485	if (dock->tp_enabled) {
    486		/* Happens after resume, the tp needs to be reinitialized */
    487		ret = device_reprobe(&dock->tp_client->dev);
    488		if (ret)
    489			dev_err_probe(dev, ret, "reprobing tp-client\n");
    490		return;
    491	}
    492
    493	strscpy(board_info.type, "elan_i2c", I2C_NAME_SIZE);
    494	board_info.addr = TF103C_DOCK_TP_ADDR;
    495	board_info.dev_name = TF103C_DOCK_DEV_NAME "-tp";
    496	board_info.irq = dock->tp_irq;
    497	board_info.swnode = &tf103c_dock_touchpad_sw_node;
    498
    499	dock->tp_client = i2c_new_client_device(dock->ec_client->adapter, &board_info);
    500	if (IS_ERR(dock->tp_client)) {
    501		dev_err(dev, "error %ld creating tp client\n", PTR_ERR(dock->tp_client));
    502		return;
    503	}
    504
    505	dock->tp_enabled = true;
    506}
    507
    508static void tf103c_dock_disable_touchpad(struct tf103c_dock_data *dock)
    509{
    510	if (!dock->tp_enabled)
    511		return;
    512
    513	i2c_unregister_device(dock->tp_client);
    514
    515	dock->tp_enabled = false;
    516}
    517
    518/*** interrupt handling code ***/
    519static void tf103c_dock_ec_cmd(struct tf103c_dock_data *dock, const u8 *cmd)
    520{
    521	struct device *dev = &dock->ec_client->dev;
    522	int ret;
    523
    524	ret = i2c_smbus_write_i2c_block_data(dock->ec_client, TF103C_DOCK_EC_CMD_REG,
    525					     TF103C_DOCK_EC_CMD_LEN, cmd);
    526	if (ret)
    527		dev_err(dev, "error %d sending %*ph cmd\n", ret,
    528			TF103C_DOCK_EC_CMD_LEN, cmd);
    529}
    530
    531static void tf103c_dock_sci(struct tf103c_dock_data *dock, u8 val)
    532{
    533	struct device *dev = &dock->ec_client->dev;
    534
    535	switch (val) {
    536	case 2:
    537		tf103c_dock_toprow_event(dock, 1, NULL);
    538		return;
    539	case 4:
    540		tf103c_dock_toprow_event(dock, 2, NULL);
    541		return;
    542	case 8:
    543		tf103c_dock_toprow_event(dock, 5, NULL);
    544		return;
    545	case 17:
    546		tf103c_dock_toprow_event(dock, 6, NULL);
    547		return;
    548	}
    549
    550	dev_warn(dev, "warning unknown SCI value: 0x%02x\n", val);
    551}
    552
    553static void tf103c_dock_smi(struct tf103c_dock_data *dock, u8 val)
    554{
    555	struct device *dev = &dock->ec_client->dev;
    556
    557	switch (val) {
    558	case TF103C_DOCK_SMI_EC_WAKEUP:
    559		tf103c_dock_ec_cmd(dock, tf103c_dock_enable_cmd);
    560		tf103c_dock_ec_cmd(dock, tf103c_dock_usb_enable_cmd);
    561		tf103c_dock_kbd_write(dock, TF103C_DOCK_KBD_CMD_ENABLE);
    562		break;
    563	case TF103C_DOCK_SMI_PAD_BL_CHANGE:
    564		/* There is no backlight, but the EC still sends this */
    565		break;
    566	case TF103C_DOCK_SMI_HID_STATUS_CHANGED:
    567		tf103c_dock_enable_touchpad(dock);
    568		break;
    569	default:
    570		dev_warn(dev, "warning unknown SMI value: 0x%02x\n", val);
    571		break;
    572	}
    573}
    574
    575static irqreturn_t tf103c_dock_irq(int irq, void *data)
    576{
    577	struct tf103c_dock_data *dock = data;
    578	struct device *dev = &dock->ec_client->dev;
    579	u8 intr_data[8];
    580	int ret;
    581
    582	ret = i2c_smbus_read_i2c_block_data(dock->intr_client, TF103C_DOCK_INTR_DATA_REG,
    583					    sizeof(intr_data), intr_data);
    584	if (ret != sizeof(intr_data)) {
    585		dev_err(dev, "error %d reading intr data\n", ret);
    586		return IRQ_NONE;
    587	}
    588
    589	if (!(intr_data[1] & TF103C_DOCK_INTR_DATA1_OBF_MASK))
    590		return IRQ_NONE;
    591
    592	/* intr_data[0] is the length of the rest of the packet */
    593	if (intr_data[0] == 3 && intr_data[1] == TF103C_DOCK_INTR_DATA1_OOB_VALUE &&
    594				 intr_data[2] == TF103C_DOCK_INTR_DATA2_OOB_VALUE) {
    595		/* intr_data[3] seems to contain a HID input report id */
    596		switch (intr_data[3]) {
    597		case 0x01:
    598			handle_nested_irq(dock->tp_irq);
    599			break;
    600		case 0x11:
    601		case 0x13:
    602		case 0x14:
    603			tf103c_dock_kbd_interrupt(dock);
    604			break;
    605		default:
    606			dev_warn(dev, "warning unknown intr_data[3]: 0x%02x\n", intr_data[3]);
    607			break;
    608		}
    609		return IRQ_HANDLED;
    610	}
    611
    612	if (intr_data[1] & TF103C_DOCK_INTR_DATA1_SCI_MASK) {
    613		tf103c_dock_sci(dock, intr_data[2]);
    614		return IRQ_HANDLED;
    615	}
    616
    617	if (intr_data[1] & TF103C_DOCK_INTR_DATA1_SMI_MASK) {
    618		tf103c_dock_smi(dock, intr_data[2]);
    619		return IRQ_HANDLED;
    620	}
    621
    622	dev_warn(dev, "warning unknown intr data: %*ph\n", 8, intr_data);
    623	return IRQ_NONE;
    624}
    625
    626/*
    627 * tf103c_dock_[dis|en]able only run from hpd_work or at times when
    628 * hpd_work cannot run (hpd_irq disabled), so no locking is necessary.
    629 */
    630static void tf103c_dock_enable(struct tf103c_dock_data *dock)
    631{
    632	if (dock->enabled)
    633		return;
    634
    635	if (dock->board_rev != 2)
    636		gpiod_set_value(dock->pwr_en, 1);
    637
    638	msleep(500);
    639	enable_irq(dock->irq);
    640
    641	dock->enabled = true;
    642}
    643
    644static void tf103c_dock_disable(struct tf103c_dock_data *dock)
    645{
    646	if (!dock->enabled)
    647		return;
    648
    649	disable_irq(dock->irq);
    650	tf103c_dock_disable_touchpad(dock);
    651	if (dock->board_rev != 2)
    652		gpiod_set_value(dock->pwr_en, 0);
    653
    654	dock->enabled = false;
    655}
    656
    657static void tf103c_dock_hpd_work(struct work_struct *work)
    658{
    659	struct tf103c_dock_data *dock =
    660		container_of(work, struct tf103c_dock_data, hpd_work.work);
    661
    662	if (gpiod_get_value(dock->hpd_gpio))
    663		tf103c_dock_enable(dock);
    664	else
    665		tf103c_dock_disable(dock);
    666}
    667
    668static irqreturn_t tf103c_dock_hpd_irq(int irq, void *data)
    669{
    670	struct tf103c_dock_data *dock = data;
    671
    672	mod_delayed_work(system_long_wq, &dock->hpd_work, TF103C_DOCK_HPD_DEBOUNCE);
    673	return IRQ_HANDLED;
    674}
    675
    676static void tf103c_dock_start_hpd(struct tf103c_dock_data *dock)
    677{
    678	enable_irq(dock->hpd_irq);
    679	/* Sync current HPD status */
    680	queue_delayed_work(system_long_wq, &dock->hpd_work, TF103C_DOCK_HPD_DEBOUNCE);
    681}
    682
    683static void tf103c_dock_stop_hpd(struct tf103c_dock_data *dock)
    684{
    685	disable_irq(dock->hpd_irq);
    686	cancel_delayed_work_sync(&dock->hpd_work);
    687}
    688
    689/*** probe ***/
    690
    691static const struct dmi_system_id tf103c_dock_dmi_ids[] = {
    692	{
    693		.matches = {
    694			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
    695			DMI_MATCH(DMI_PRODUCT_NAME, "TF103C"),
    696		},
    697	},
    698	{ }
    699};
    700
    701static void tf103c_dock_non_devm_cleanup(void *data)
    702{
    703	struct tf103c_dock_data *dock = data;
    704
    705	if (dock->tp_irq_domain)
    706		irq_domain_remove(dock->tp_irq_domain);
    707
    708	if (!IS_ERR_OR_NULL(dock->hid))
    709		hid_destroy_device(dock->hid);
    710
    711	i2c_unregister_device(dock->kbd_client);
    712	i2c_unregister_device(dock->intr_client);
    713	gpiod_remove_lookup_table(&tf103c_dock_gpios);
    714}
    715
    716static int tf103c_dock_probe(struct i2c_client *client)
    717{
    718	struct i2c_board_info board_info = { };
    719	struct device *dev = &client->dev;
    720	struct gpio_desc *board_rev_gpio;
    721	struct tf103c_dock_data *dock;
    722	enum gpiod_flags flags;
    723	int i, ret;
    724
    725	/* GPIOs are hardcoded for the Asus TF103C, don't bind on other devs */
    726	if (!dmi_check_system(tf103c_dock_dmi_ids))
    727		return -ENODEV;
    728
    729	dock = devm_kzalloc(dev, sizeof(*dock), GFP_KERNEL);
    730	if (!dock)
    731		return -ENOMEM;
    732
    733	INIT_DELAYED_WORK(&dock->hpd_work, tf103c_dock_hpd_work);
    734
    735	/* 1. Get GPIOs and their IRQs */
    736	gpiod_add_lookup_table(&tf103c_dock_gpios);
    737
    738	ret = devm_add_action_or_reset(dev, tf103c_dock_non_devm_cleanup, dock);
    739	if (ret)
    740		return ret;
    741
    742	/*
    743	 * The pin is configured as input by default, use ASIS because otherwise
    744	 * the gpio-crystalcove.c switches off the internal pull-down replacing
    745	 * it with a pull-up.
    746	 */
    747	board_rev_gpio = gpiod_get(dev, "board_rev", GPIOD_ASIS);
    748	if (IS_ERR(board_rev_gpio))
    749		return dev_err_probe(dev, PTR_ERR(board_rev_gpio), "requesting board_rev GPIO\n");
    750	dock->board_rev = gpiod_get_value_cansleep(board_rev_gpio) + 1;
    751	gpiod_put(board_rev_gpio);
    752
    753	/*
    754	 * The Android driver drives the dock-pwr-en pin high at probe for
    755	 * revision 2 boards and then never touches it again?
    756	 * This code has only been tested on a revision 1 board, so for now
    757	 * just mimick what Android does on revision 2 boards.
    758	 */
    759	flags = (dock->board_rev == 2) ? GPIOD_OUT_HIGH : GPIOD_OUT_LOW;
    760	dock->pwr_en = devm_gpiod_get(dev, "dock_pwr_en", flags);
    761	if (IS_ERR(dock->pwr_en))
    762		return dev_err_probe(dev, PTR_ERR(dock->pwr_en), "requesting pwr_en GPIO\n");
    763
    764	dock->irq_gpio = devm_gpiod_get(dev, "dock_irq", GPIOD_IN);
    765	if (IS_ERR(dock->irq_gpio))
    766		return dev_err_probe(dev, PTR_ERR(dock->irq_gpio), "requesting IRQ GPIO\n");
    767
    768	dock->irq = gpiod_to_irq(dock->irq_gpio);
    769	if (dock->irq < 0)
    770		return dev_err_probe(dev, dock->irq, "getting dock IRQ");
    771
    772	ret = devm_request_threaded_irq(dev, dock->irq, NULL, tf103c_dock_irq,
    773					IRQF_TRIGGER_LOW | IRQF_ONESHOT | IRQF_NO_AUTOEN,
    774					"dock_irq", dock);
    775	if (ret)
    776		return dev_err_probe(dev, ret, "requesting dock IRQ");
    777
    778	dock->hpd_gpio = devm_gpiod_get(dev, "dock_hpd", GPIOD_IN);
    779	if (IS_ERR(dock->hpd_gpio))
    780		return dev_err_probe(dev, PTR_ERR(dock->hpd_gpio), "requesting HPD GPIO\n");
    781
    782	dock->hpd_irq = gpiod_to_irq(dock->hpd_gpio);
    783	if (dock->hpd_irq < 0)
    784		return dev_err_probe(dev, dock->hpd_irq, "getting HPD IRQ");
    785
    786	ret = devm_request_irq(dev, dock->hpd_irq, tf103c_dock_hpd_irq,
    787			       IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
    788			       "dock_hpd", dock);
    789	if (ret)
    790		return ret;
    791
    792	/*
    793	 * 2. Create I2C clients. The dock uses 4 different i2c addresses,
    794	 * the ACPI NPCE69A node being probed points to the EC address.
    795	 */
    796	dock->ec_client = client;
    797
    798	strscpy(board_info.type, "tf103c-dock-intr", I2C_NAME_SIZE);
    799	board_info.addr = TF103C_DOCK_INTR_ADDR;
    800	board_info.dev_name = TF103C_DOCK_DEV_NAME "-intr";
    801
    802	dock->intr_client = i2c_new_client_device(client->adapter, &board_info);
    803	if (IS_ERR(dock->intr_client))
    804		return dev_err_probe(dev, PTR_ERR(dock->intr_client), "creating intr client\n");
    805
    806	strscpy(board_info.type, "tf103c-dock-kbd", I2C_NAME_SIZE);
    807	board_info.addr = TF103C_DOCK_KBD_ADDR;
    808	board_info.dev_name = TF103C_DOCK_DEV_NAME "-kbd";
    809
    810	dock->kbd_client = i2c_new_client_device(client->adapter, &board_info);
    811	if (IS_ERR(dock->kbd_client))
    812		return dev_err_probe(dev, PTR_ERR(dock->kbd_client), "creating kbd client\n");
    813
    814	/* 3. Create input_dev for the top row of the keyboard */
    815	dock->input = devm_input_allocate_device(dev);
    816	if (!dock->input)
    817		return -ENOMEM;
    818
    819	dock->input->name = "Asus TF103C Dock Top Row Keys";
    820	dock->input->phys = dev_name(dev);
    821	dock->input->dev.parent = dev;
    822	dock->input->id.bustype = BUS_I2C;
    823	dock->input->id.vendor = /* USB_VENDOR_ID_ASUSTEK */
    824	dock->input->id.product = /* From TF-103-C */
    825	dock->input->id.version = 0x0100;  /* 1.0 */
    826
    827	for (i = 0; i < ARRAY_SIZE(tf103c_dock_toprow_codes); i++) {
    828		input_set_capability(dock->input, EV_KEY, tf103c_dock_toprow_codes[i][0]);
    829		input_set_capability(dock->input, EV_KEY, tf103c_dock_toprow_codes[i][1]);
    830	}
    831	input_set_capability(dock->input, EV_KEY, KEY_RIGHTALT);
    832
    833	ret = input_register_device(dock->input);
    834	if (ret)
    835		return ret;
    836
    837	/* 4. Create HID device for the keyboard */
    838	dock->hid = hid_allocate_device();
    839	if (IS_ERR(dock->hid))
    840		return dev_err_probe(dev, PTR_ERR(dock->hid), "allocating hid dev\n");
    841
    842	dock->hid->driver_data = dock;
    843	dock->hid->ll_driver = &tf103c_dock_hid_ll_driver;
    844	dock->hid->dev.parent = &client->dev;
    845	dock->hid->bus = BUS_I2C;
    846	dock->hid->vendor = 0x0b05;  /* USB_VENDOR_ID_ASUSTEK */
    847	dock->hid->product = 0x0103; /* From TF-103-C */
    848	dock->hid->version = 0x0100; /* 1.0 */
    849	strscpy(dock->hid->name, "Asus TF103C Dock Keyboard", sizeof(dock->hid->name));
    850	strscpy(dock->hid->phys, dev_name(dev), sizeof(dock->hid->phys));
    851
    852	ret = hid_add_device(dock->hid);
    853	if (ret)
    854		return dev_err_probe(dev, ret, "adding hid dev\n");
    855
    856	/* 5. Setup irqchip for touchpad IRQ pass-through */
    857	dock->tp_irqchip.name = KBUILD_MODNAME;
    858
    859	dock->tp_irq_domain = irq_domain_add_linear(NULL, 1, &irq_domain_simple_ops, NULL);
    860	if (!dock->tp_irq_domain)
    861		return -ENOMEM;
    862
    863	dock->tp_irq = irq_create_mapping(dock->tp_irq_domain, 0);
    864	if (!dock->tp_irq)
    865		return -ENOMEM;
    866
    867	irq_set_chip_data(dock->tp_irq, dock);
    868	irq_set_chip_and_handler(dock->tp_irq, &dock->tp_irqchip, handle_simple_irq);
    869	irq_set_nested_thread(dock->tp_irq, true);
    870	irq_set_noprobe(dock->tp_irq);
    871
    872	dev_info(dev, "Asus TF103C board-revision: %d\n", dock->board_rev);
    873
    874	tf103c_dock_start_hpd(dock);
    875
    876	device_init_wakeup(dev, true);
    877	i2c_set_clientdata(client, dock);
    878	return 0;
    879}
    880
    881static int tf103c_dock_remove(struct i2c_client *client)
    882{
    883	struct tf103c_dock_data *dock = i2c_get_clientdata(client);
    884
    885	tf103c_dock_stop_hpd(dock);
    886	tf103c_dock_disable(dock);
    887
    888	return 0;
    889}
    890
    891static int __maybe_unused tf103c_dock_suspend(struct device *dev)
    892{
    893	struct tf103c_dock_data *dock = dev_get_drvdata(dev);
    894
    895	tf103c_dock_stop_hpd(dock);
    896
    897	if (dock->enabled) {
    898		tf103c_dock_ec_cmd(dock, tf103c_dock_suspend_cmd);
    899
    900		if (device_may_wakeup(dev))
    901			enable_irq_wake(dock->irq);
    902	}
    903
    904	return 0;
    905}
    906
    907static int __maybe_unused tf103c_dock_resume(struct device *dev)
    908{
    909	struct tf103c_dock_data *dock = dev_get_drvdata(dev);
    910
    911	if (dock->enabled) {
    912		if (device_may_wakeup(dev))
    913			disable_irq_wake(dock->irq);
    914
    915		/* Don't try to resume if the dock was unplugged during suspend */
    916		if (gpiod_get_value(dock->hpd_gpio))
    917			tf103c_dock_ec_cmd(dock, tf103c_dock_enable_cmd);
    918	}
    919
    920	tf103c_dock_start_hpd(dock);
    921	return 0;
    922}
    923
    924static SIMPLE_DEV_PM_OPS(tf103c_dock_pm_ops, tf103c_dock_suspend, tf103c_dock_resume);
    925
    926static const struct acpi_device_id tf103c_dock_acpi_match[] = {
    927	{"NPCE69A"},
    928	{ }
    929};
    930MODULE_DEVICE_TABLE(acpi, tf103c_dock_acpi_match);
    931
    932static struct i2c_driver tf103c_dock_driver = {
    933	.driver = {
    934		.name = "asus-tf103c-dock",
    935		.pm = &tf103c_dock_pm_ops,
    936		.acpi_match_table = tf103c_dock_acpi_match,
    937	},
    938	.probe_new = tf103c_dock_probe,
    939	.remove	= tf103c_dock_remove,
    940};
    941module_i2c_driver(tf103c_dock_driver);
    942
    943MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com");
    944MODULE_DESCRIPTION("X86 Android tablets DSDT fixups driver");
    945MODULE_LICENSE("GPL");