drivers/hid/hid-uclogic-params.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  *  HID driver for UC-Logic devices not fully compliant with HID standard
   4  *  - tablet initialization and parameter retrieval
   5  *
   6  *  Copyright (c) 2018 Nikolai Kondrashov
   7  */
   8
   9 /*
  10  * This program is free software; you can redistribute it and/or modify it
  11  * under the terms of the GNU General Public License as published by the Free
  12  * Software Foundation; either version 2 of the License, or (at your option)
  13  * any later version.
  14  */
  15
  16 #include "hid-uclogic-params.h"
  17 #include "hid-uclogic-rdesc.h"
  18 #include "usbhid/usbhid.h"
  19 #include "hid-ids.h"
  20 #include <linux/ctype.h>
  21 #include <asm/unaligned.h>
  22
  23 /**
  24  * uclogic_params_pen_inrange_to_str() - Convert a pen in-range reporting type
  25  *                                       to a string.
  26  * @inrange:    The in-range reporting type to convert.
  27  *
  28  * Return:
  29  * * The string representing the type, or
  30  * * %NULL if the type is unknown.
  31  */
  32 static const char *uclogic_params_pen_inrange_to_str(
  33                                 enum uclogic_params_pen_inrange inrange)
  34 {
  35         switch (inrange) {
  36         case UCLOGIC_PARAMS_PEN_INRANGE_NORMAL:
  37                 return "normal";
  38         case UCLOGIC_PARAMS_PEN_INRANGE_INVERTED:
  39                 return "inverted";
  40         case UCLOGIC_PARAMS_PEN_INRANGE_NONE:
  41                 return "none";
  42         default:
  43                 return NULL;
  44         }
  45 }
  46
  47 /**
  48  * uclogic_params_pen_hid_dbg() - Dump tablet interface pen parameters
  49  * @hdev:       The HID device the pen parameters describe.
  50  * @pen:        The pen parameters to dump.
  51  *
  52  * Dump tablet interface pen parameters with hid_dbg(). The dump is indented
  53  * with a tab.
  54  */
  55 static void uclogic_params_pen_hid_dbg(const struct hid_device *hdev,
  56                                         const struct uclogic_params_pen *pen)
  57 {
  58         size_t i;
  59
  60         hid_dbg(hdev, "\t.usage_invalid = %s\n",
  61                 (pen->usage_invalid ? "true" : "false"));
  62         hid_dbg(hdev, "\t.desc_ptr = %p\n", pen->desc_ptr);
  63         hid_dbg(hdev, "\t.desc_size = %u\n", pen->desc_size);
  64         hid_dbg(hdev, "\t.id = %u\n", pen->id);
  65         hid_dbg(hdev, "\t.subreport_list = {\n");
  66         for (i = 0; i < ARRAY_SIZE(pen->subreport_list); i++) {
  67                 hid_dbg(hdev, "\t\t{0x%02hhx, %hhu}%s\n",
  68                         pen->subreport_list[i].value,
  69                         pen->subreport_list[i].id,
  70                         i < (ARRAY_SIZE(pen->subreport_list) - 1) ? "," : "");
  71         }
  72         hid_dbg(hdev, "\t}\n");
  73         hid_dbg(hdev, "\t.inrange = %s\n",
  74                 uclogic_params_pen_inrange_to_str(pen->inrange));
  75         hid_dbg(hdev, "\t.fragmented_hires = %s\n",
  76                 (pen->fragmented_hires ? "true" : "false"));
  77         hid_dbg(hdev, "\t.tilt_y_flipped = %s\n",
  78                 (pen->tilt_y_flipped ? "true" : "false"));
  79 }
  80
  81 /**
  82  * uclogic_params_frame_hid_dbg() - Dump tablet interface frame parameters
  83  * @hdev:       The HID device the pen parameters describe.
  84  * @frame:      The frame parameters to dump.
  85  *
  86  * Dump tablet interface frame parameters with hid_dbg(). The dump is
  87  * indented with two tabs.
  88  */
  89 static void uclogic_params_frame_hid_dbg(
  90                                 const struct hid_device *hdev,
  91                                 const struct uclogic_params_frame *frame)
  92 {
  93         hid_dbg(hdev, "\t\t.desc_ptr = %p\n", frame->desc_ptr);
  94         hid_dbg(hdev, "\t\t.desc_size = %u\n", frame->desc_size);
  95         hid_dbg(hdev, "\t\t.id = %u\n", frame->id);
  96         hid_dbg(hdev, "\t\t.suffix = %s\n", frame->suffix);
  97         hid_dbg(hdev, "\t\t.re_lsb = %u\n", frame->re_lsb);
  98         hid_dbg(hdev, "\t\t.dev_id_byte = %u\n", frame->dev_id_byte);
  99         hid_dbg(hdev, "\t\t.touch_byte = %u\n", frame->touch_byte);
 100         hid_dbg(hdev, "\t\t.touch_max = %hhd\n", frame->touch_max);
 101         hid_dbg(hdev, "\t\t.touch_flip_at = %hhd\n",
 102                 frame->touch_flip_at);
 103         hid_dbg(hdev, "\t\t.bitmap_dial_byte = %u\n",
 104                 frame->bitmap_dial_byte);
 105 }
 106
 107 /**
 108  * uclogic_params_hid_dbg() - Dump tablet interface parameters
 109  * @hdev:       The HID device the parameters describe.
 110  * @params:     The parameters to dump.
 111  *
 112  * Dump tablet interface parameters with hid_dbg().
 113  */
 114 void uclogic_params_hid_dbg(const struct hid_device *hdev,
 115                                 const struct uclogic_params *params)
 116 {
 117         size_t i;
 118
 119         hid_dbg(hdev, ".invalid = %s\n",
 120                 params->invalid ? "true" : "false");
 121         hid_dbg(hdev, ".desc_ptr = %p\n", params->desc_ptr);
 122         hid_dbg(hdev, ".desc_size = %u\n", params->desc_size);
 123         hid_dbg(hdev, ".pen = {\n");
 124         uclogic_params_pen_hid_dbg(hdev, &params->pen);
 125         hid_dbg(hdev, "\t}\n");
 126         hid_dbg(hdev, ".frame_list = {\n");
 127         for (i = 0; i < ARRAY_SIZE(params->frame_list); i++) {
 128                 hid_dbg(hdev, "\t{\n");
 129                 uclogic_params_frame_hid_dbg(hdev, &params->frame_list[i]);
 130                 hid_dbg(hdev, "\t}%s\n",
 131                         i < (ARRAY_SIZE(params->frame_list) - 1) ? "," : "");
 132         }
 133         hid_dbg(hdev, "}\n");
 134 }
 135
 136 /**
 137  * uclogic_params_get_str_desc - retrieve a string descriptor from a HID
 138  * device interface, putting it into a kmalloc-allocated buffer as is, without
 139  * character encoding conversion.
 140  *
 141  * @pbuf:       Location for the kmalloc-allocated buffer pointer containing
 142  *              the retrieved descriptor. Not modified in case of error.
 143  *              Can be NULL to have retrieved descriptor discarded.
 144  * @hdev:       The HID device of the tablet interface to retrieve the string
 145  *              descriptor from. Cannot be NULL.
 146  * @idx:        Index of the string descriptor to request from the device.
 147  * @len:        Length of the buffer to allocate and the data to retrieve.
 148  *
 149  * Returns:
 150  *      number of bytes retrieved (<= len),
 151  *      -EPIPE, if the descriptor was not found, or
 152  *      another negative errno code in case of other error.
 153  */
 154 static int uclogic_params_get_str_desc(__u8 **pbuf, struct hid_device *hdev,
 155                                         __u8 idx, size_t len)
 156 {
 157         int rc;
 158         struct usb_device *udev;
 159         __u8 *buf = NULL;
 160
 161         /* Check arguments */
 162         if (hdev == NULL) {
 163                 rc = -EINVAL;
 164                 goto cleanup;
 165         }
 166
 167         udev = hid_to_usb_dev(hdev);
 168
 169         buf = kmalloc(len, GFP_KERNEL);
 170         if (buf == NULL) {
 171                 rc = -ENOMEM;
 172                 goto cleanup;
 173         }
 174
 175         rc = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 176                                 USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,
 177                                 (USB_DT_STRING << 8) + idx,
 178                                 0x0409, buf, len,
 179                                 USB_CTRL_GET_TIMEOUT);
 180         if (rc == -EPIPE) {
 181                 hid_dbg(hdev, "string descriptor #%hhu not found\n", idx);
 182                 goto cleanup;
 183         } else if (rc < 0) {
 184                 hid_err(hdev,
 185                         "failed retrieving string descriptor #%u: %d\n",
 186                         idx, rc);
 187                 goto cleanup;
 188         }
 189
 190         if (pbuf != NULL) {
 191                 *pbuf = buf;
 192                 buf = NULL;
 193         }
 194
 195 cleanup:
 196         kfree(buf);
 197         return rc;
 198 }
 199
 200 /**
 201  * uclogic_params_pen_cleanup - free resources used by struct
 202  * uclogic_params_pen (tablet interface's pen input parameters).
 203  * Can be called repeatedly.
 204  *
 205  * @pen:        Pen input parameters to cleanup. Cannot be NULL.
 206  */
 207 static void uclogic_params_pen_cleanup(struct uclogic_params_pen *pen)
 208 {
 209         kfree(pen->desc_ptr);
 210         memset(pen, 0, sizeof(*pen));
 211 }
 212
 213 /**
 214  * uclogic_params_pen_init_v1() - initialize tablet interface pen
 215  * input and retrieve its parameters from the device, using v1 protocol.
 216  *
 217  * @pen:        Pointer to the pen parameters to initialize (to be
 218  *              cleaned up with uclogic_params_pen_cleanup()). Not modified in
 219  *              case of error, or if parameters are not found. Cannot be NULL.
 220  * @pfound:     Location for a flag which is set to true if the parameters
 221  *              were found, and to false if not (e.g. device was
 222  *              incompatible). Not modified in case of error. Cannot be NULL.
 223  * @hdev:       The HID device of the tablet interface to initialize and get
 224  *              parameters from. Cannot be NULL.
 225  *
 226  * Returns:
 227  *      Zero, if successful. A negative errno code on error.
 228  */
 229 static int uclogic_params_pen_init_v1(struct uclogic_params_pen *pen,
 230                                       bool *pfound,
 231                                       struct hid_device *hdev)
 232 {
 233         int rc;
 234         bool found = false;
 235         /* Buffer for (part of) the string descriptor */
 236         __u8 *buf = NULL;
 237         /* Minimum descriptor length required, maximum seen so far is 18 */
 238         const int len = 12;
 239         s32 resolution;
 240         /* Pen report descriptor template parameters */
 241         s32 desc_params[UCLOGIC_RDESC_PH_ID_NUM];
 242         __u8 *desc_ptr = NULL;
 243
 244         /* Check arguments */
 245         if (pen == NULL || pfound == NULL || hdev == NULL) {
 246                 rc = -EINVAL;
 247                 goto cleanup;
 248         }
 249
 250         /*
 251          * Read string descriptor containing pen input parameters.
 252          * The specific string descriptor and data were discovered by sniffing
 253          * the Windows driver traffic.
 254          * NOTE: This enables fully-functional tablet mode.
 255          */
 256         rc = uclogic_params_get_str_desc(&buf, hdev, 100, len);
 257         if (rc == -EPIPE) {
 258                 hid_dbg(hdev,
 259                         "string descriptor with pen parameters not found, assuming not compatible\n");
 260                 goto finish;
 261         } else if (rc < 0) {
 262                 hid_err(hdev, "failed retrieving pen parameters: %d\n", rc);
 263                 goto cleanup;
 264         } else if (rc != len) {
 265                 hid_dbg(hdev,
 266                         "string descriptor with pen parameters has invalid length (got %d, expected %d), assuming not compatible\n",
 267                         rc, len);
 268                 goto finish;
 269         }
 270
 271         /*
 272          * Fill report descriptor parameters from the string descriptor
 273          */
 274         desc_params[UCLOGIC_RDESC_PEN_PH_ID_X_LM] =
 275                 get_unaligned_le16(buf + 2);
 276         desc_params[UCLOGIC_RDESC_PEN_PH_ID_Y_LM] =
 277                 get_unaligned_le16(buf + 4);
 278         desc_params[UCLOGIC_RDESC_PEN_PH_ID_PRESSURE_LM] =
 279                 get_unaligned_le16(buf + 8);
 280         resolution = get_unaligned_le16(buf + 10);
 281         if (resolution == 0) {
 282                 desc_params[UCLOGIC_RDESC_PEN_PH_ID_X_PM] = 0;
 283                 desc_params[UCLOGIC_RDESC_PEN_PH_ID_Y_PM] = 0;
 284         } else {
 285                 desc_params[UCLOGIC_RDESC_PEN_PH_ID_X_PM] =
 286                         desc_params[UCLOGIC_RDESC_PEN_PH_ID_X_LM] * 1000 /
 287                         resolution;
 288                 desc_params[UCLOGIC_RDESC_PEN_PH_ID_Y_PM] =
 289                         desc_params[UCLOGIC_RDESC_PEN_PH_ID_Y_LM] * 1000 /
 290                         resolution;
 291         }
 292         kfree(buf);
 293         buf = NULL;
 294
 295         /*
 296          * Generate pen report descriptor
 297          */
 298         desc_ptr = uclogic_rdesc_template_apply(
 299                                 uclogic_rdesc_v1_pen_template_arr,
 300                                 uclogic_rdesc_v1_pen_template_size,
 301                                 desc_params, ARRAY_SIZE(desc_params));
 302         if (desc_ptr == NULL) {
 303                 rc = -ENOMEM;
 304                 goto cleanup;
 305         }
 306
 307         /*
 308          * Fill-in the parameters
 309          */
 310         memset(pen, 0, sizeof(*pen));
 311         pen->desc_ptr = desc_ptr;
 312         desc_ptr = NULL;
 313         pen->desc_size = uclogic_rdesc_v1_pen_template_size;
 314         pen->id = UCLOGIC_RDESC_V1_PEN_ID;
 315         pen->inrange = UCLOGIC_PARAMS_PEN_INRANGE_INVERTED;
 316         found = true;
 317 finish:
 318         *pfound = found;
 319         rc = 0;
 320 cleanup:
 321         kfree(desc_ptr);
 322         kfree(buf);
 323         return rc;
 324 }
 325
 326 /**
 327  * uclogic_params_get_le24() - get a 24-bit little-endian number from a
 328  * buffer.
 329  *
 330  * @p:  The pointer to the number buffer.
 331  *
 332  * Returns:
 333  *      The retrieved number
 334  */
 335 static s32 uclogic_params_get_le24(const void *p)
 336 {
 337         const __u8 *b = p;
 338         return b[0] | (b[1] << 8UL) | (b[2] << 16UL);
 339 }
 340
 341 /**
 342  * uclogic_params_pen_init_v2() - initialize tablet interface pen
 343  * input and retrieve its parameters from the device, using v2 protocol.
 344  *
 345  * @pen:                Pointer to the pen parameters to initialize (to be
 346  *                      cleaned up with uclogic_params_pen_cleanup()). Not
 347  *                      modified in case of error, or if parameters are not
 348  *                      found. Cannot be NULL.
 349  * @pfound:             Location for a flag which is set to true if the
 350  *                      parameters were found, and to false if not (e.g.
 351  *                      device was incompatible). Not modified in case of
 352  *                      error. Cannot be NULL.
 353  * @pparams_ptr:        Location for a kmalloc'ed pointer to the retrieved raw
 354  *                      parameters, which could be used to identify the tablet
 355  *                      to some extent. Should be freed with kfree after use.
 356  *                      NULL, if not needed. Not modified in case of error.
 357  *                      Only set if *pfound is set to true.
 358  * @pparams_len:        Location for the length of the retrieved raw
 359  *                      parameters. NULL, if not needed. Not modified in case
 360  *                      of error. Only set if *pfound is set to true.
 361  * @hdev:               The HID device of the tablet interface to initialize
 362  *                      and get parameters from. Cannot be NULL.
 363  *
 364  * Returns:
 365  *      Zero, if successful. A negative errno code on error.
 366  */
 367 static int uclogic_params_pen_init_v2(struct uclogic_params_pen *pen,
 368                                         bool *pfound,
 369                                         __u8 **pparams_ptr,
 370                                         size_t *pparams_len,
 371                                         struct hid_device *hdev)
 372 {
 373         int rc;
 374         bool found = false;
 375         /* Buffer for (part of) the parameter string descriptor */
 376         __u8 *buf = NULL;
 377         /* Parameter string descriptor required length */
 378         const int params_len_min = 18;
 379         /* Parameter string descriptor accepted length */
 380         const int params_len_max = 32;
 381         /* Parameter string descriptor received length */
 382         int params_len;
 383         size_t i;
 384         s32 resolution;
 385         /* Pen report descriptor template parameters */
 386         s32 desc_params[UCLOGIC_RDESC_PH_ID_NUM];
 387         __u8 *desc_ptr = NULL;
 388
 389         /* Check arguments */
 390         if (pen == NULL || pfound == NULL || hdev == NULL) {
 391                 rc = -EINVAL;
 392                 goto cleanup;
 393         }
 394
 395         /*
 396          * Read string descriptor containing pen input parameters.
 397          * The specific string descriptor and data were discovered by sniffing
 398          * the Windows driver traffic.
 399          * NOTE: This enables fully-functional tablet mode.
 400          */
 401         rc = uclogic_params_get_str_desc(&buf, hdev, 200, params_len_max);
 402         if (rc == -EPIPE) {
 403                 hid_dbg(hdev,
 404                         "string descriptor with pen parameters not found, assuming not compatible\n");
 405                 goto finish;
 406         } else if (rc < 0) {
 407                 hid_err(hdev, "failed retrieving pen parameters: %d\n", rc);
 408                 goto cleanup;
 409         } else if (rc < params_len_min) {
 410                 hid_dbg(hdev,
 411                         "string descriptor with pen parameters is too short (got %d, expected at least %d), assuming not compatible\n",
 412                         rc, params_len_min);
 413                 goto finish;
 414         }
 415
 416         params_len = rc;
 417
 418         /*
 419          * Check it's not just a catch-all UTF-16LE-encoded ASCII
 420          * string (such as the model name) some tablets put into all
 421          * unknown string descriptors.
 422          */
 423         for (i = 2;
 424              i < params_len &&
 425                 (buf[i] >= 0x20 && buf[i] < 0x7f && buf[i + 1] == 0);
 426              i += 2);
 427         if (i >= params_len) {
 428                 hid_dbg(hdev,
 429                         "string descriptor with pen parameters seems to contain only text, assuming not compatible\n");
 430                 goto finish;
 431         }
 432
 433         /*
 434          * Fill report descriptor parameters from the string descriptor
 435          */
 436         desc_params[UCLOGIC_RDESC_PEN_PH_ID_X_LM] =
 437                 uclogic_params_get_le24(buf + 2);
 438         desc_params[UCLOGIC_RDESC_PEN_PH_ID_Y_LM] =
 439                 uclogic_params_get_le24(buf + 5);
 440         desc_params[UCLOGIC_RDESC_PEN_PH_ID_PRESSURE_LM] =
 441                 get_unaligned_le16(buf + 8);
 442         resolution = get_unaligned_le16(buf + 10);
 443         if (resolution == 0) {
 444                 desc_params[UCLOGIC_RDESC_PEN_PH_ID_X_PM] = 0;
 445                 desc_params[UCLOGIC_RDESC_PEN_PH_ID_Y_PM] = 0;
 446         } else {
 447                 desc_params[UCLOGIC_RDESC_PEN_PH_ID_X_PM] =
 448                         desc_params[UCLOGIC_RDESC_PEN_PH_ID_X_LM] * 1000 /
 449                         resolution;
 450                 desc_params[UCLOGIC_RDESC_PEN_PH_ID_Y_PM] =
 451                         desc_params[UCLOGIC_RDESC_PEN_PH_ID_Y_LM] * 1000 /
 452                         resolution;
 453         }
 454
 455         /*
 456          * Generate pen report descriptor
 457          */
 458         desc_ptr = uclogic_rdesc_template_apply(
 459                                 uclogic_rdesc_v2_pen_template_arr,
 460                                 uclogic_rdesc_v2_pen_template_size,
 461                                 desc_params, ARRAY_SIZE(desc_params));
 462         if (desc_ptr == NULL) {
 463                 rc = -ENOMEM;
 464                 goto cleanup;
 465         }
 466
 467         /*
 468          * Fill-in the parameters
 469          */
 470         memset(pen, 0, sizeof(*pen));
 471         pen->desc_ptr = desc_ptr;
 472         desc_ptr = NULL;
 473         pen->desc_size = uclogic_rdesc_v2_pen_template_size;
 474         pen->id = UCLOGIC_RDESC_V2_PEN_ID;
 475         pen->inrange = UCLOGIC_PARAMS_PEN_INRANGE_NONE;
 476         pen->fragmented_hires = true;
 477         pen->tilt_y_flipped = true;
 478         found = true;
 479         if (pparams_ptr != NULL) {
 480                 *pparams_ptr = buf;
 481                 buf = NULL;
 482         }
 483         if (pparams_len != NULL)
 484                 *pparams_len = params_len;
 485
 486 finish:
 487         *pfound = found;
 488         rc = 0;
 489 cleanup:
 490         kfree(desc_ptr);
 491         kfree(buf);
 492         return rc;
 493 }
 494
 495 /**
 496  * uclogic_params_frame_cleanup - free resources used by struct
 497  * uclogic_params_frame (tablet interface's frame controls input parameters).
 498  * Can be called repeatedly.
 499  *
 500  * @frame:      Frame controls input parameters to cleanup. Cannot be NULL.
 501  */
 502 static void uclogic_params_frame_cleanup(struct uclogic_params_frame *frame)
 503 {
 504         kfree(frame->desc_ptr);
 505         memset(frame, 0, sizeof(*frame));
 506 }
 507
 508 /**
 509  * uclogic_params_frame_init_with_desc() - initialize tablet's frame control
 510  * parameters with a static report descriptor.
 511  *
 512  * @frame:      Pointer to the frame parameters to initialize (to be cleaned
 513  *              up with uclogic_params_frame_cleanup()). Not modified in case
 514  *              of error. Cannot be NULL.
 515  * @desc_ptr:   Report descriptor pointer. Can be NULL, if desc_size is zero.
 516  * @desc_size:  Report descriptor size.
 517  * @id:         Report ID used for frame reports, if they should be tweaked,
 518  *              zero if not.
 519  *
 520  * Returns:
 521  *      Zero, if successful. A negative errno code on error.
 522  */
 523 static int uclogic_params_frame_init_with_desc(
 524                                         struct uclogic_params_frame *frame,
 525                                         const __u8 *desc_ptr,
 526                                         size_t desc_size,
 527                                         unsigned int id)
 528 {
 529         __u8 *copy_desc_ptr;
 530
 531         if (frame == NULL || (desc_ptr == NULL && desc_size != 0))
 532                 return -EINVAL;
 533
 534         copy_desc_ptr = kmemdup(desc_ptr, desc_size, GFP_KERNEL);
 535         if (copy_desc_ptr == NULL)
 536                 return -ENOMEM;
 537
 538         memset(frame, 0, sizeof(*frame));
 539         frame->desc_ptr = copy_desc_ptr;
 540         frame->desc_size = desc_size;
 541         frame->id = id;
 542         return 0;
 543 }
 544
 545 /**
 546  * uclogic_params_frame_init_v1() - initialize v1 tablet interface frame
 547  * controls.
 548  *
 549  * @frame:      Pointer to the frame parameters to initialize (to be cleaned
 550  *              up with uclogic_params_frame_cleanup()). Not modified in case
 551  *              of error, or if parameters are not found. Cannot be NULL.
 552  * @pfound:     Location for a flag which is set to true if the parameters
 553  *              were found, and to false if not (e.g. device was
 554  *              incompatible). Not modified in case of error. Cannot be NULL.
 555  * @hdev:       The HID device of the tablet interface to initialize and get
 556  *              parameters from. Cannot be NULL.
 557  *
 558  * Returns:
 559  *      Zero, if successful. A negative errno code on error.
 560  */
 561 static int uclogic_params_frame_init_v1(struct uclogic_params_frame *frame,
 562                                         bool *pfound,
 563                                         struct hid_device *hdev)
 564 {
 565         int rc;
 566         bool found = false;
 567         struct usb_device *usb_dev;
 568         char *str_buf = NULL;
 569         const size_t str_len = 16;
 570
 571         /* Check arguments */
 572         if (frame == NULL || pfound == NULL || hdev == NULL) {
 573                 rc = -EINVAL;
 574                 goto cleanup;
 575         }
 576
 577         usb_dev = hid_to_usb_dev(hdev);
 578
 579         /*
 580          * Enable generic button mode
 581          */
 582         str_buf = kzalloc(str_len, GFP_KERNEL);
 583         if (str_buf == NULL) {
 584                 rc = -ENOMEM;
 585                 goto cleanup;
 586         }
 587
 588         rc = usb_string(usb_dev, 123, str_buf, str_len);
 589         if (rc == -EPIPE) {
 590                 hid_dbg(hdev,
 591                         "generic button -enabling string descriptor not found\n");
 592         } else if (rc < 0) {
 593                 goto cleanup;
 594         } else if (strncmp(str_buf, "HK On", rc) != 0) {
 595                 hid_dbg(hdev,
 596                         "invalid response to enabling generic buttons: \"%s\"\n",
 597                         str_buf);
 598         } else {
 599                 hid_dbg(hdev, "generic buttons enabled\n");
 600                 rc = uclogic_params_frame_init_with_desc(
 601                                 frame,
 602                                 uclogic_rdesc_v1_frame_arr,
 603                                 uclogic_rdesc_v1_frame_size,
 604                                 UCLOGIC_RDESC_V1_FRAME_ID);
 605                 if (rc != 0)
 606                         goto cleanup;
 607                 found = true;
 608         }
 609
 610         *pfound = found;
 611         rc = 0;
 612 cleanup:
 613         kfree(str_buf);
 614         return rc;
 615 }
 616
 617 /**
 618  * uclogic_params_cleanup - free resources used by struct uclogic_params
 619  * (tablet interface's parameters).
 620  * Can be called repeatedly.
 621  *
 622  * @params:     Input parameters to cleanup. Cannot be NULL.
 623  */
 624 void uclogic_params_cleanup(struct uclogic_params *params)
 625 {
 626         if (!params->invalid) {
 627                 size_t i;
 628                 kfree(params->desc_ptr);
 629                 uclogic_params_pen_cleanup(&params->pen);
 630                 for (i = 0; i < ARRAY_SIZE(params->frame_list); i++)
 631                         uclogic_params_frame_cleanup(&params->frame_list[i]);
 632
 633                 memset(params, 0, sizeof(*params));
 634         }
 635 }
 636
 637 /**
 638  * uclogic_params_get_desc() - Get a replacement report descriptor for a
 639  *                             tablet's interface.
 640  *
 641  * @params:     The parameters of a tablet interface to get report
 642  *              descriptor for. Cannot be NULL.
 643  * @pdesc:      Location for the resulting, kmalloc-allocated report
 644  *              descriptor pointer, or for NULL, if there's no replacement
 645  *              report descriptor. Not modified in case of error. Cannot be
 646  *              NULL.
 647  * @psize:      Location for the resulting report descriptor size, not set if
 648  *              there's no replacement report descriptor. Not modified in case
 649  *              of error. Cannot be NULL.
 650  *
 651  * Returns:
 652  *      Zero, if successful.
 653  *      -EINVAL, if invalid arguments are supplied.
 654  *      -ENOMEM, if failed to allocate memory.
 655  */
 656 int uclogic_params_get_desc(const struct uclogic_params *params,
 657                                 __u8 **pdesc,
 658                                 unsigned int *psize)
 659 {
 660         int rc = -ENOMEM;
 661         bool present = false;
 662         unsigned int size = 0;
 663         __u8 *desc = NULL;
 664         size_t i;
 665
 666         /* Check arguments */
 667         if (params == NULL || pdesc == NULL || psize == NULL)
 668                 return -EINVAL;
 669
 670         /* Concatenate descriptors */
 671 #define ADD_DESC(_desc_ptr, _desc_size) \
 672         do {                                                        \
 673                 unsigned int new_size;                              \
 674                 __u8 *new_desc;                                     \
 675                 if ((_desc_ptr) == NULL) {                          \
 676                         break;                                      \
 677                 }                                                   \
 678                 new_size = size + (_desc_size);                     \
 679                 new_desc = krealloc(desc, new_size, GFP_KERNEL);    \
 680                 if (new_desc == NULL) {                             \
 681                         goto cleanup;                               \
 682                 }                                                   \
 683                 memcpy(new_desc + size, (_desc_ptr), (_desc_size)); \
 684                 desc = new_desc;                                    \
 685                 size = new_size;                                    \
 686                 present = true;                                     \
 687         } while (0)
 688
 689         ADD_DESC(params->desc_ptr, params->desc_size);
 690         ADD_DESC(params->pen.desc_ptr, params->pen.desc_size);
 691         for (i = 0; i < ARRAY_SIZE(params->frame_list); i++) {
 692                 ADD_DESC(params->frame_list[i].desc_ptr,
 693                                 params->frame_list[i].desc_size);
 694         }
 695
 696 #undef ADD_DESC
 697
 698         if (present) {
 699                 *pdesc = desc;
 700                 *psize = size;
 701                 desc = NULL;
 702         }
 703         rc = 0;
 704 cleanup:
 705         kfree(desc);
 706         return rc;
 707 }
 708
 709 /**
 710  * uclogic_params_init_invalid() - initialize tablet interface parameters,
 711  * specifying the interface is invalid.
 712  *
 713  * @params:             Parameters to initialize (to be cleaned with
 714  *                      uclogic_params_cleanup()). Cannot be NULL.
 715  */
 716 static void uclogic_params_init_invalid(struct uclogic_params *params)
 717 {
 718         params->invalid = true;
 719 }
 720
 721 /**
 722  * uclogic_params_init_with_opt_desc() - initialize tablet interface
 723  * parameters with an optional replacement report descriptor. Only modify
 724  * report descriptor, if the original report descriptor matches the expected
 725  * size.
 726  *
 727  * @params:             Parameters to initialize (to be cleaned with
 728  *                      uclogic_params_cleanup()). Not modified in case of
 729  *                      error. Cannot be NULL.
 730  * @hdev:               The HID device of the tablet interface create the
 731  *                      parameters for. Cannot be NULL.
 732  * @orig_desc_size:     Expected size of the original report descriptor to
 733  *                      be replaced.
 734  * @desc_ptr:           Pointer to the replacement report descriptor.
 735  *                      Can be NULL, if desc_size is zero.
 736  * @desc_size:          Size of the replacement report descriptor.
 737  *
 738  * Returns:
 739  *      Zero, if successful. -EINVAL if an invalid argument was passed.
 740  *      -ENOMEM, if failed to allocate memory.
 741  */
 742 static int uclogic_params_init_with_opt_desc(struct uclogic_params *params,
 743                                              struct hid_device *hdev,
 744                                              unsigned int orig_desc_size,
 745                                              __u8 *desc_ptr,
 746                                              unsigned int desc_size)
 747 {
 748         __u8 *desc_copy_ptr = NULL;
 749         unsigned int desc_copy_size;
 750         int rc;
 751
 752         /* Check arguments */
 753         if (params == NULL || hdev == NULL ||
 754             (desc_ptr == NULL && desc_size != 0)) {
 755                 rc = -EINVAL;
 756                 goto cleanup;
 757         }
 758
 759         /* Replace report descriptor, if it matches */
 760         if (hdev->dev_rsize == orig_desc_size) {
 761                 hid_dbg(hdev,
 762                         "device report descriptor matches the expected size, replacing\n");
 763                 desc_copy_ptr = kmemdup(desc_ptr, desc_size, GFP_KERNEL);
 764                 if (desc_copy_ptr == NULL) {
 765                         rc = -ENOMEM;
 766                         goto cleanup;
 767                 }
 768                 desc_copy_size = desc_size;
 769         } else {
 770                 hid_dbg(hdev,
 771                         "device report descriptor doesn't match the expected size (%u != %u), preserving\n",
 772                         hdev->dev_rsize, orig_desc_size);
 773                 desc_copy_ptr = NULL;
 774                 desc_copy_size = 0;
 775         }
 776
 777         /* Output parameters */
 778         memset(params, 0, sizeof(*params));
 779         params->desc_ptr = desc_copy_ptr;
 780         desc_copy_ptr = NULL;
 781         params->desc_size = desc_copy_size;
 782
 783         rc = 0;
 784 cleanup:
 785         kfree(desc_copy_ptr);
 786         return rc;
 787 }
 788
 789 /**
 790  * uclogic_params_huion_init() - initialize a Huion tablet interface and discover
 791  * its parameters.
 792  *
 793  * @params:     Parameters to fill in (to be cleaned with
 794  *              uclogic_params_cleanup()). Not modified in case of error.
 795  *              Cannot be NULL.
 796  * @hdev:       The HID device of the tablet interface to initialize and get
 797  *              parameters from. Cannot be NULL.
 798  *
 799  * Returns:
 800  *      Zero, if successful. A negative errno code on error.
 801  */
 802 static int uclogic_params_huion_init(struct uclogic_params *params,
 803                                      struct hid_device *hdev)
 804 {
 805         int rc;
 806         struct usb_device *udev;
 807         struct usb_interface *iface;
 808         __u8 bInterfaceNumber;
 809         bool found;
 810         /* The resulting parameters (noop) */
 811         struct uclogic_params p = {0, };
 812         static const char transition_ver[] = "HUION_T153_160607";
 813         char *ver_ptr = NULL;
 814         const size_t ver_len = sizeof(transition_ver) + 1;
 815         __u8 *params_ptr = NULL;
 816         size_t params_len = 0;
 817         /* Parameters string descriptor of a model with touch ring (HS610) */
 818         const __u8 touch_ring_model_params_buf[] = {
 819                 0x13, 0x03, 0x70, 0xC6, 0x00, 0x06, 0x7C, 0x00,
 820                 0xFF, 0x1F, 0xD8, 0x13, 0x03, 0x0D, 0x10, 0x01,
 821                 0x04, 0x3C, 0x3E
 822         };
 823
 824         /* Check arguments */
 825         if (params == NULL || hdev == NULL) {
 826                 rc = -EINVAL;
 827                 goto cleanup;
 828         }
 829
 830         udev = hid_to_usb_dev(hdev);
 831         iface = to_usb_interface(hdev->dev.parent);
 832         bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber;
 833
 834         /* If it's a custom keyboard interface */
 835         if (bInterfaceNumber == 1) {
 836                 /* Keep everything intact, but mark pen usage invalid */
 837                 p.pen.usage_invalid = true;
 838                 goto output;
 839         /* Else, if it's not a pen interface */
 840         } else if (bInterfaceNumber != 0) {
 841                 uclogic_params_init_invalid(&p);
 842                 goto output;
 843         }
 844
 845         /* Try to get firmware version */
 846         ver_ptr = kzalloc(ver_len, GFP_KERNEL);
 847         if (ver_ptr == NULL) {
 848                 rc = -ENOMEM;
 849                 goto cleanup;
 850         }
 851         rc = usb_string(udev, 201, ver_ptr, ver_len);
 852         if (rc == -EPIPE) {
 853                 *ver_ptr = '\0';
 854         } else if (rc < 0) {
 855                 hid_err(hdev,
 856                         "failed retrieving Huion firmware version: %d\n", rc);
 857                 goto cleanup;
 858         }
 859
 860         /* If this is a transition firmware */
 861         if (strcmp(ver_ptr, transition_ver) == 0) {
 862                 hid_dbg(hdev,
 863                         "transition firmware detected, not probing pen v2 parameters\n");
 864         } else {
 865                 /* Try to probe v2 pen parameters */
 866                 rc = uclogic_params_pen_init_v2(&p.pen, &found,
 867                                                 &params_ptr, &params_len,
 868                                                 hdev);
 869                 if (rc != 0) {
 870                         hid_err(hdev,
 871                                 "failed probing pen v2 parameters: %d\n", rc);
 872                         goto cleanup;
 873                 } else if (found) {
 874                         hid_dbg(hdev, "pen v2 parameters found\n");
 875                         /* Create v2 frame button parameters */
 876                         rc = uclogic_params_frame_init_with_desc(
 877                                         &p.frame_list[0],
 878                                         uclogic_rdesc_v2_frame_buttons_arr,
 879                                         uclogic_rdesc_v2_frame_buttons_size,
 880                                         UCLOGIC_RDESC_V2_FRAME_BUTTONS_ID);
 881                         if (rc != 0) {
 882                                 hid_err(hdev,
 883                                         "failed creating v2 frame button parameters: %d\n",
 884                                         rc);
 885                                 goto cleanup;
 886                         }
 887
 888                         /* Link from pen sub-report */
 889                         p.pen.subreport_list[0].value = 0xe0;
 890                         p.pen.subreport_list[0].id =
 891                                 UCLOGIC_RDESC_V2_FRAME_BUTTONS_ID;
 892
 893                         /* If this is the model with touch ring */
 894                         if (params_ptr != NULL &&
 895                             params_len == sizeof(touch_ring_model_params_buf) &&
 896                             memcmp(params_ptr, touch_ring_model_params_buf,
 897                                    params_len) == 0) {
 898                                 /* Create touch ring parameters */
 899                                 rc = uclogic_params_frame_init_with_desc(
 900                                         &p.frame_list[1],
 901                                         uclogic_rdesc_v2_frame_touch_ring_arr,
 902                                         uclogic_rdesc_v2_frame_touch_ring_size,
 903                                         UCLOGIC_RDESC_V2_FRAME_TOUCH_ID);
 904                                 if (rc != 0) {
 905                                         hid_err(hdev,
 906                                                 "failed creating v2 frame touch ring parameters: %d\n",
 907                                                 rc);
 908                                         goto cleanup;
 909                                 }
 910                                 p.frame_list[1].suffix = "Touch Ring";
 911                                 p.frame_list[1].dev_id_byte =
 912                                         UCLOGIC_RDESC_V2_FRAME_TOUCH_DEV_ID_BYTE;
 913                                 p.frame_list[1].touch_byte = 5;
 914                                 p.frame_list[1].touch_max = 12;
 915                                 p.frame_list[1].touch_flip_at = 7;
 916                         } else {
 917                                 /* Create touch strip parameters */
 918                                 rc = uclogic_params_frame_init_with_desc(
 919                                         &p.frame_list[1],
 920                                         uclogic_rdesc_v2_frame_touch_strip_arr,
 921                                         uclogic_rdesc_v2_frame_touch_strip_size,
 922                                         UCLOGIC_RDESC_V2_FRAME_TOUCH_ID);
 923                                 if (rc != 0) {
 924                                         hid_err(hdev,
 925                                                 "failed creating v2 frame touch strip parameters: %d\n",
 926                                                 rc);
 927                                         goto cleanup;
 928                                 }
 929                                 p.frame_list[1].suffix = "Touch Strip";
 930                                 p.frame_list[1].dev_id_byte =
 931                                         UCLOGIC_RDESC_V2_FRAME_TOUCH_DEV_ID_BYTE;
 932                                 p.frame_list[1].touch_byte = 5;
 933                                 p.frame_list[1].touch_max = 8;
 934                         }
 935
 936                         /* Link from pen sub-report */
 937                         p.pen.subreport_list[1].value = 0xf0;
 938                         p.pen.subreport_list[1].id =
 939                                 UCLOGIC_RDESC_V2_FRAME_TOUCH_ID;
 940
 941                         /* Create v2 frame dial parameters */
 942                         rc = uclogic_params_frame_init_with_desc(
 943                                         &p.frame_list[2],
 944                                         uclogic_rdesc_v2_frame_dial_arr,
 945                                         uclogic_rdesc_v2_frame_dial_size,
 946                                         UCLOGIC_RDESC_V2_FRAME_DIAL_ID);
 947                         if (rc != 0) {
 948                                 hid_err(hdev,
 949                                         "failed creating v2 frame dial parameters: %d\n",
 950                                         rc);
 951                                 goto cleanup;
 952                         }
 953                         p.frame_list[2].suffix = "Dial";
 954                         p.frame_list[2].dev_id_byte =
 955                                 UCLOGIC_RDESC_V2_FRAME_DIAL_DEV_ID_BYTE;
 956                         p.frame_list[2].bitmap_dial_byte = 5;
 957
 958                         /* Link from pen sub-report */
 959                         p.pen.subreport_list[2].value = 0xf1;
 960                         p.pen.subreport_list[2].id =
 961                                 UCLOGIC_RDESC_V2_FRAME_DIAL_ID;
 962
 963                         goto output;
 964                 }
 965                 hid_dbg(hdev, "pen v2 parameters not found\n");
 966         }
 967
 968         /* Try to probe v1 pen parameters */
 969         rc = uclogic_params_pen_init_v1(&p.pen, &found, hdev);
 970         if (rc != 0) {
 971                 hid_err(hdev,
 972                         "failed probing pen v1 parameters: %d\n", rc);
 973                 goto cleanup;
 974         } else if (found) {
 975                 hid_dbg(hdev, "pen v1 parameters found\n");
 976                 /* Try to probe v1 frame */
 977                 rc = uclogic_params_frame_init_v1(&p.frame_list[0],
 978                                                   &found, hdev);
 979                 if (rc != 0) {
 980                         hid_err(hdev, "v1 frame probing failed: %d\n", rc);
 981                         goto cleanup;
 982                 }
 983                 hid_dbg(hdev, "frame v1 parameters%s found\n",
 984                         (found ? "" : " not"));
 985                 if (found) {
 986                         /* Link frame button subreports from pen reports */
 987                         p.pen.subreport_list[0].value = 0xe0;
 988                         p.pen.subreport_list[0].id =
 989                                 UCLOGIC_RDESC_V1_FRAME_ID;
 990                 }
 991                 goto output;
 992         }
 993         hid_dbg(hdev, "pen v1 parameters not found\n");
 994
 995         uclogic_params_init_invalid(&p);
 996
 997 output:
 998         /* Output parameters */
 999         memcpy(params, &p, sizeof(*params));
1000         memset(&p, 0, sizeof(p));
1001         rc = 0;
1002 cleanup:
1003         kfree(params_ptr);
1004         kfree(ver_ptr);
1005         uclogic_params_cleanup(&p);
1006         return rc;
1007 }
1008
1009 /**
1010  * uclogic_probe_interface() - some tablets, like the Parblo A610 PLUS V2 or
1011  * the XP-PEN Deco Mini 7, need to be initialized by sending them magic data.
1012  *
1013  * @hdev:       The HID device of the tablet interface to initialize and get
1014  *              parameters from. Cannot be NULL.
1015  * @magic_arr:  The magic data that should be sent to probe the interface.
1016  *              Cannot be NULL.
1017  * @magic_size: Size of the magic data.
1018  * @endpoint:   Endpoint where the magic data should be sent.
1019  *
1020  * Returns:
1021  *      Zero, if successful. A negative errno code on error.
1022  */
1023 static int uclogic_probe_interface(struct hid_device *hdev, u8 *magic_arr,
1024                                    int magic_size, int endpoint)
1025 {
1026         struct usb_device *udev;
1027         unsigned int pipe = 0;
1028         int sent;
1029         u8 *buf = NULL;
1030         int rc = 0;
1031
1032         if (!hdev || !magic_arr) {
1033                 rc = -EINVAL;
1034                 goto cleanup;
1035         }
1036
1037         buf = kmemdup(magic_arr, magic_size, GFP_KERNEL);
1038         if (!buf) {
1039                 rc = -ENOMEM;
1040                 goto cleanup;
1041         }
1042
1043         udev = hid_to_usb_dev(hdev);
1044         pipe = usb_sndintpipe(udev, endpoint);
1045
1046         rc = usb_interrupt_msg(udev, pipe, buf, magic_size, &sent, 1000);
1047         if (rc || sent != magic_size) {
1048                 hid_err(hdev, "Interface probing failed: %d\n", rc);
1049                 rc = -1;
1050                 goto cleanup;
1051         }
1052
1053         rc = 0;
1054 cleanup:
1055         kfree(buf);
1056         return rc;
1057 }
1058
1059 /**
1060  * uclogic_params_parse_ugee_v2_desc - parse the string descriptor containing
1061  * pen and frame parameters returned by UGEE v2 devices.
1062  *
1063  * @str_desc:           String descriptor, cannot be NULL.
1064  * @str_desc_size:      Size of the string descriptor.
1065  * @desc_params:        Output description params list.
1066  * @desc_params_size:   Size of the output description params list.
1067  * @frame_type:         Output frame type.
1068  *
1069  * Returns:
1070  *      Zero, if successful. A negative errno code on error.
1071  */
1072 static int uclogic_params_parse_ugee_v2_desc(const __u8 *str_desc,
1073                                              size_t str_desc_size,
1074                                              s32 *desc_params,
1075                                              size_t desc_params_size,
1076                                              enum uclogic_params_frame_type *frame_type)
1077 {
1078         s32 pen_x_lm, pen_y_lm;
1079         s32 pen_x_pm, pen_y_pm;
1080         s32 pen_pressure_lm;
1081         s32 frame_num_buttons;
1082         s32 resolution;
1083
1084         /* Minimum descriptor length required, maximum seen so far is 14 */
1085         const int min_str_desc_size = 12;
1086
1087         if (!str_desc || str_desc_size < min_str_desc_size)
1088                 return -EINVAL;
1089
1090         if (desc_params_size != UCLOGIC_RDESC_PH_ID_NUM)
1091                 return -EINVAL;
1092
1093         pen_x_lm = get_unaligned_le16(str_desc + 2);
1094         pen_y_lm = get_unaligned_le16(str_desc + 4);
1095         frame_num_buttons = str_desc[6];
1096         *frame_type = str_desc[7];
1097         pen_pressure_lm = get_unaligned_le16(str_desc + 8);
1098
1099         resolution = get_unaligned_le16(str_desc + 10);
1100         if (resolution == 0) {
1101                 pen_x_pm = 0;
1102                 pen_y_pm = 0;
1103         } else {
1104                 pen_x_pm = pen_x_lm * 1000 / resolution;
1105                 pen_y_pm = pen_y_lm * 1000 / resolution;
1106         }
1107
1108         desc_params[UCLOGIC_RDESC_PEN_PH_ID_X_LM] = pen_x_lm;
1109         desc_params[UCLOGIC_RDESC_PEN_PH_ID_X_PM] = pen_x_pm;
1110         desc_params[UCLOGIC_RDESC_PEN_PH_ID_Y_LM] = pen_y_lm;
1111         desc_params[UCLOGIC_RDESC_PEN_PH_ID_Y_PM] = pen_y_pm;
1112         desc_params[UCLOGIC_RDESC_PEN_PH_ID_PRESSURE_LM] = pen_pressure_lm;
1113         desc_params[UCLOGIC_RDESC_FRAME_PH_ID_UM] = frame_num_buttons;
1114
1115         return 0;
1116 }
1117
1118 /**
1119  * uclogic_params_ugee_v2_init_frame_buttons() - initialize a UGEE v2 frame with
1120  * buttons.
1121  * @p:                  Parameters to fill in, cannot be NULL.
1122  * @desc_params:        Device description params list.
1123  * @desc_params_size:   Size of the description params list.
1124  *
1125  * Returns:
1126  *      Zero, if successful. A negative errno code on error.
1127  */
1128 static int uclogic_params_ugee_v2_init_frame_buttons(struct uclogic_params *p,
1129                                                      const s32 *desc_params,
1130                                                      size_t desc_params_size)
1131 {
1132         __u8 *rdesc_frame = NULL;
1133         int rc = 0;
1134
1135         if (!p || desc_params_size != UCLOGIC_RDESC_PH_ID_NUM)
1136                 return -EINVAL;
1137
1138         rdesc_frame = uclogic_rdesc_template_apply(
1139                                 uclogic_rdesc_ugee_v2_frame_btn_template_arr,
1140                                 uclogic_rdesc_ugee_v2_frame_btn_template_size,
1141                                 desc_params, UCLOGIC_RDESC_PH_ID_NUM);
1142         if (!rdesc_frame)
1143                 return -ENOMEM;
1144
1145         rc = uclogic_params_frame_init_with_desc(&p->frame_list[0],
1146                                                  rdesc_frame,
1147                                                  uclogic_rdesc_ugee_v2_frame_btn_template_size,
1148                                                  UCLOGIC_RDESC_V1_FRAME_ID);
1149         kfree(rdesc_frame);
1150         return rc;
1151 }
1152
1153 /**
1154  * uclogic_params_ugee_v2_init_frame_dial() - initialize a UGEE v2 frame with a
1155  * bitmap dial.
1156  * @p:                  Parameters to fill in, cannot be NULL.
1157  * @desc_params:        Device description params list.
1158  * @desc_params_size:   Size of the description params list.
1159  *
1160  * Returns:
1161  *      Zero, if successful. A negative errno code on error.
1162  */
1163 static int uclogic_params_ugee_v2_init_frame_dial(struct uclogic_params *p,
1164                                                   const s32 *desc_params,
1165                                                   size_t desc_params_size)
1166 {
1167         __u8 *rdesc_frame = NULL;
1168         int rc = 0;
1169
1170         if (!p || desc_params_size != UCLOGIC_RDESC_PH_ID_NUM)
1171                 return -EINVAL;
1172
1173         rdesc_frame = uclogic_rdesc_template_apply(
1174                                 uclogic_rdesc_ugee_v2_frame_dial_template_arr,
1175                                 uclogic_rdesc_ugee_v2_frame_dial_template_size,
1176                                 desc_params, UCLOGIC_RDESC_PH_ID_NUM);
1177         if (!rdesc_frame)
1178                 return -ENOMEM;
1179
1180         rc = uclogic_params_frame_init_with_desc(&p->frame_list[0],
1181                                                  rdesc_frame,
1182                                                  uclogic_rdesc_ugee_v2_frame_dial_template_size,
1183                                                  UCLOGIC_RDESC_V1_FRAME_ID);
1184         kfree(rdesc_frame);
1185         if (rc)
1186                 return rc;
1187
1188         p->frame_list[0].bitmap_dial_byte = 7;
1189         return 0;
1190 }
1191
1192 /**
1193  * uclogic_params_ugee_v2_init_frame_mouse() - initialize a UGEE v2 frame with a
1194  * mouse.
1195  * @p:                  Parameters to fill in, cannot be NULL.
1196  *
1197  * Returns:
1198  *      Zero, if successful. A negative errno code on error.
1199  */
1200 static int uclogic_params_ugee_v2_init_frame_mouse(struct uclogic_params *p)
1201 {
1202         int rc = 0;
1203
1204         if (!p)
1205                 return -EINVAL;
1206
1207         rc = uclogic_params_frame_init_with_desc(&p->frame_list[1],
1208                                                  uclogic_rdesc_ugee_v2_frame_mouse_template_arr,
1209                                                  uclogic_rdesc_ugee_v2_frame_mouse_template_size,
1210                                                  UCLOGIC_RDESC_V1_FRAME_ID);
1211         return rc;
1212 }
1213
1214 /**
1215  * uclogic_params_ugee_v2_init() - initialize a UGEE graphics tablets by
1216  * discovering their parameters.
1217  *
1218  * These tables, internally designed as v2 to differentiate them from older
1219  * models, expect a payload of magic data in orther to be switched to the fully
1220  * functional mode and expose their parameters in a similar way to the
1221  * information present in uclogic_params_pen_init_v1() but with some
1222  * differences.
1223  *
1224  * @params:     Parameters to fill in (to be cleaned with
1225  *              uclogic_params_cleanup()). Not modified in case of error.
1226  *              Cannot be NULL.
1227  * @hdev:       The HID device of the tablet interface to initialize and get
1228  *              parameters from. Cannot be NULL.
1229  *
1230  * Returns:
1231  *      Zero, if successful. A negative errno code on error.
1232  */
1233 static int uclogic_params_ugee_v2_init(struct uclogic_params *params,
1234                                        struct hid_device *hdev)
1235 {
1236         int rc = 0;
1237         struct usb_interface *iface;
1238         __u8 bInterfaceNumber;
1239         const int str_desc_len = 12;
1240         __u8 *str_desc = NULL;
1241         __u8 *rdesc_pen = NULL;
1242         s32 desc_params[UCLOGIC_RDESC_PH_ID_NUM];
1243         enum uclogic_params_frame_type frame_type;
1244         __u8 magic_arr[] = {
1245                 0x02, 0xb0, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
1246         };
1247         /* The resulting parameters (noop) */
1248         struct uclogic_params p = {0, };
1249
1250         if (!params || !hdev) {
1251                 rc = -EINVAL;
1252                 goto cleanup;
1253         }
1254
1255         iface = to_usb_interface(hdev->dev.parent);
1256         bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber;
1257
1258         if (bInterfaceNumber == 0) {
1259                 rc = uclogic_params_ugee_v2_init_frame_mouse(&p);
1260                 if (rc)
1261                         goto cleanup;
1262
1263                 goto output;
1264         }
1265
1266         if (bInterfaceNumber != 2) {
1267                 uclogic_params_init_invalid(&p);
1268                 goto output;
1269         }
1270
1271         /*
1272          * Initialize the interface by sending magic data.
1273          * The specific data was discovered by sniffing the Windows driver
1274          * traffic.
1275          */
1276         rc = uclogic_probe_interface(hdev, magic_arr, sizeof(magic_arr), 0x03);
1277         if (rc) {
1278                 uclogic_params_init_invalid(&p);
1279                 goto output;
1280         }
1281
1282         /*
1283          * Read the string descriptor containing pen and frame parameters.
1284          * The specific string descriptor and data were discovered by sniffing
1285          * the Windows driver traffic.
1286          */
1287         rc = uclogic_params_get_str_desc(&str_desc, hdev, 100, str_desc_len);
1288         if (rc != str_desc_len) {
1289                 hid_err(hdev, "failed retrieving pen and frame parameters: %d\n", rc);
1290                 uclogic_params_init_invalid(&p);
1291                 goto output;
1292         }
1293
1294         rc = uclogic_params_parse_ugee_v2_desc(str_desc, str_desc_len,
1295                                                desc_params,
1296                                                ARRAY_SIZE(desc_params),
1297                                                &frame_type);
1298         if (rc)
1299                 goto cleanup;
1300
1301         kfree(str_desc);
1302         str_desc = NULL;
1303
1304         /* Initialize the pen interface */
1305         rdesc_pen = uclogic_rdesc_template_apply(
1306                                 uclogic_rdesc_ugee_v2_pen_template_arr,
1307                                 uclogic_rdesc_ugee_v2_pen_template_size,
1308                                 desc_params, ARRAY_SIZE(desc_params));
1309         if (!rdesc_pen) {
1310                 rc = -ENOMEM;
1311                 goto cleanup;
1312         }
1313
1314         p.pen.desc_ptr = rdesc_pen;
1315         p.pen.desc_size = uclogic_rdesc_ugee_v2_pen_template_size;
1316         p.pen.id = 0x02;
1317         p.pen.subreport_list[0].value = 0xf0;
1318         p.pen.subreport_list[0].id = UCLOGIC_RDESC_V1_FRAME_ID;
1319
1320         /* Initialize the frame interface */
1321         switch (frame_type) {
1322         case UCLOGIC_PARAMS_FRAME_DIAL:
1323         case UCLOGIC_PARAMS_FRAME_MOUSE:
1324                 rc = uclogic_params_ugee_v2_init_frame_dial(&p, desc_params,
1325                                                             ARRAY_SIZE(desc_params));
1326                 break;
1327         case UCLOGIC_PARAMS_FRAME_BUTTONS:
1328         default:
1329                 rc = uclogic_params_ugee_v2_init_frame_buttons(&p, desc_params,
1330                                                                ARRAY_SIZE(desc_params));
1331                 break;
1332         }
1333
1334         if (rc)
1335                 goto cleanup;
1336
1337 output:
1338         /* Output parameters */
1339         memcpy(params, &p, sizeof(*params));
1340         memset(&p, 0, sizeof(p));
1341         rc = 0;
1342 cleanup:
1343         kfree(str_desc);
1344         uclogic_params_cleanup(&p);
1345         return rc;
1346 }
1347
1348 /**
1349  * uclogic_params_init() - initialize a tablet interface and discover its
1350  * parameters.
1351  *
1352  * @params:     Parameters to fill in (to be cleaned with
1353  *              uclogic_params_cleanup()). Not modified in case of error.
1354  *              Cannot be NULL.
1355  * @hdev:       The HID device of the tablet interface to initialize and get
1356  *              parameters from. Cannot be NULL. Must be using the USB low-level
1357  *              driver, i.e. be an actual USB tablet.
1358  *
1359  * Returns:
1360  *      Zero, if successful. A negative errno code on error.
1361  */
1362 int uclogic_params_init(struct uclogic_params *params,
1363                         struct hid_device *hdev)
1364 {
1365         int rc;
1366         struct usb_device *udev;
1367         __u8  bNumInterfaces;
1368         struct usb_interface *iface;
1369         __u8 bInterfaceNumber;
1370         bool found;
1371         /* The resulting parameters (noop) */
1372         struct uclogic_params p = {0, };
1373
1374         /* Check arguments */
1375         if (params == NULL || hdev == NULL || !hid_is_usb(hdev)) {
1376                 rc = -EINVAL;
1377                 goto cleanup;
1378         }
1379
1380         udev = hid_to_usb_dev(hdev);
1381         bNumInterfaces = udev->config->desc.bNumInterfaces;
1382         iface = to_usb_interface(hdev->dev.parent);
1383         bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber;
1384
1385         /*
1386          * Set replacement report descriptor if the original matches the
1387          * specified size. Otherwise keep interface unchanged.
1388          */
1389 #define WITH_OPT_DESC(_orig_desc_token, _new_desc_token) \
1390         uclogic_params_init_with_opt_desc(                  \
1391                 &p, hdev,                                   \
1392                 UCLOGIC_RDESC_##_orig_desc_token##_SIZE,    \
1393                 uclogic_rdesc_##_new_desc_token##_arr,      \
1394                 uclogic_rdesc_##_new_desc_token##_size)
1395
1396 #define VID_PID(_vid, _pid) \
1397         (((__u32)(_vid) << 16) | ((__u32)(_pid) & U16_MAX))
1398
1399         /*
1400          * Handle specific interfaces for specific tablets.
1401          *
1402          * Observe the following logic:
1403          *
1404          * If the interface is recognized as producing certain useful input:
1405          *      Mark interface as valid.
1406          *      Output interface parameters.
1407          * Else, if the interface is recognized as *not* producing any useful
1408          * input:
1409          *      Mark interface as invalid.
1410          * Else:
1411          *      Mark interface as valid.
1412          *      Output noop parameters.
1413          *
1414          * Rule of thumb: it is better to disable a broken interface than let
1415          *                it spew garbage input.
1416          */
1417
1418         switch (VID_PID(hdev->vendor, hdev->product)) {
1419         case VID_PID(USB_VENDOR_ID_UCLOGIC,
1420                      USB_DEVICE_ID_UCLOGIC_TABLET_PF1209):
1421                 rc = WITH_OPT_DESC(PF1209_ORIG, pf1209_fixed);
1422                 if (rc != 0)
1423                         goto cleanup;
1424                 break;
1425         case VID_PID(USB_VENDOR_ID_UCLOGIC,
1426                      USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U):
1427                 rc = WITH_OPT_DESC(WPXXXXU_ORIG, wp4030u_fixed);
1428                 if (rc != 0)
1429                         goto cleanup;
1430                 break;
1431         case VID_PID(USB_VENDOR_ID_UCLOGIC,
1432                      USB_DEVICE_ID_UCLOGIC_TABLET_WP5540U):
1433                 if (hdev->dev_rsize == UCLOGIC_RDESC_WP5540U_V2_ORIG_SIZE) {
1434                         if (bInterfaceNumber == 0) {
1435                                 /* Try to probe v1 pen parameters */
1436                                 rc = uclogic_params_pen_init_v1(&p.pen,
1437                                                                 &found, hdev);
1438                                 if (rc != 0) {
1439                                         hid_err(hdev,
1440                                                 "pen probing failed: %d\n",
1441                                                 rc);
1442                                         goto cleanup;
1443                                 }
1444                                 if (!found) {
1445                                         hid_warn(hdev,
1446                                                  "pen parameters not found");
1447                                 }
1448                         } else {
1449                                 uclogic_params_init_invalid(&p);
1450                         }
1451                 } else {
1452                         rc = WITH_OPT_DESC(WPXXXXU_ORIG, wp5540u_fixed);
1453                         if (rc != 0)
1454                                 goto cleanup;
1455                 }
1456                 break;
1457         case VID_PID(USB_VENDOR_ID_UCLOGIC,
1458                      USB_DEVICE_ID_UCLOGIC_TABLET_WP8060U):
1459                 rc = WITH_OPT_DESC(WPXXXXU_ORIG, wp8060u_fixed);
1460                 if (rc != 0)
1461                         goto cleanup;
1462                 break;
1463         case VID_PID(USB_VENDOR_ID_UCLOGIC,
1464                      USB_DEVICE_ID_UCLOGIC_TABLET_WP1062):
1465                 rc = WITH_OPT_DESC(WP1062_ORIG, wp1062_fixed);
1466                 if (rc != 0)
1467                         goto cleanup;
1468                 break;
1469         case VID_PID(USB_VENDOR_ID_UCLOGIC,
1470                      USB_DEVICE_ID_UCLOGIC_WIRELESS_TABLET_TWHL850):
1471                 switch (bInterfaceNumber) {
1472                 case 0:
1473                         rc = WITH_OPT_DESC(TWHL850_ORIG0, twhl850_fixed0);
1474                         if (rc != 0)
1475                                 goto cleanup;
1476                         break;
1477                 case 1:
1478                         rc = WITH_OPT_DESC(TWHL850_ORIG1, twhl850_fixed1);
1479                         if (rc != 0)
1480                                 goto cleanup;
1481                         break;
1482                 case 2:
1483                         rc = WITH_OPT_DESC(TWHL850_ORIG2, twhl850_fixed2);
1484                         if (rc != 0)
1485                                 goto cleanup;
1486                         break;
1487                 }
1488                 break;
1489         case VID_PID(USB_VENDOR_ID_UCLOGIC,
1490                      USB_DEVICE_ID_UCLOGIC_TABLET_TWHA60):
1491                 /*
1492                  * If it is not a three-interface version, which is known to
1493                  * respond to initialization.
1494                  */
1495                 if (bNumInterfaces != 3) {
1496                         switch (bInterfaceNumber) {
1497                         case 0:
1498                                 rc = WITH_OPT_DESC(TWHA60_ORIG0,
1499                                                         twha60_fixed0);
1500                                 if (rc != 0)
1501                                         goto cleanup;
1502                                 break;
1503                         case 1:
1504                                 rc = WITH_OPT_DESC(TWHA60_ORIG1,
1505                                                         twha60_fixed1);
1506                                 if (rc != 0)
1507                                         goto cleanup;
1508                                 break;
1509                         }
1510                         break;
1511                 }
1512                 fallthrough;
1513         case VID_PID(USB_VENDOR_ID_HUION,
1514                      USB_DEVICE_ID_HUION_TABLET):
1515         case VID_PID(USB_VENDOR_ID_HUION,
1516                      USB_DEVICE_ID_HUION_TABLET2):
1517         case VID_PID(USB_VENDOR_ID_UCLOGIC,
1518                      USB_DEVICE_ID_HUION_TABLET):
1519         case VID_PID(USB_VENDOR_ID_UCLOGIC,
1520                      USB_DEVICE_ID_YIYNOVA_TABLET):
1521         case VID_PID(USB_VENDOR_ID_UCLOGIC,
1522                      USB_DEVICE_ID_UCLOGIC_UGEE_TABLET_81):
1523         case VID_PID(USB_VENDOR_ID_UCLOGIC,
1524                      USB_DEVICE_ID_UCLOGIC_DRAWIMAGE_G3):
1525         case VID_PID(USB_VENDOR_ID_UCLOGIC,
1526                      USB_DEVICE_ID_UCLOGIC_UGEE_TABLET_45):
1527         case VID_PID(USB_VENDOR_ID_UCLOGIC,
1528                      USB_DEVICE_ID_UCLOGIC_UGEE_TABLET_47):
1529                 rc = uclogic_params_huion_init(&p, hdev);
1530                 if (rc != 0)
1531                         goto cleanup;
1532                 break;
1533         case VID_PID(USB_VENDOR_ID_UGTIZER,
1534                      USB_DEVICE_ID_UGTIZER_TABLET_GP0610):
1535         case VID_PID(USB_VENDOR_ID_UGTIZER,
1536                      USB_DEVICE_ID_UGTIZER_TABLET_GT5040):
1537         case VID_PID(USB_VENDOR_ID_UGEE,
1538                      USB_DEVICE_ID_UGEE_XPPEN_TABLET_G540):
1539         case VID_PID(USB_VENDOR_ID_UGEE,
1540                      USB_DEVICE_ID_UGEE_XPPEN_TABLET_G640):
1541         case VID_PID(USB_VENDOR_ID_UGEE,
1542                      USB_DEVICE_ID_UGEE_XPPEN_TABLET_STAR06):
1543         case VID_PID(USB_VENDOR_ID_UGEE,
1544                      USB_DEVICE_ID_UGEE_TABLET_RAINBOW_CV720):
1545                 /* If this is the pen interface */
1546                 if (bInterfaceNumber == 1) {
1547                         /* Probe v1 pen parameters */
1548                         rc = uclogic_params_pen_init_v1(&p.pen, &found, hdev);
1549                         if (rc != 0) {
1550                                 hid_err(hdev, "pen probing failed: %d\n", rc);
1551                                 goto cleanup;
1552                         }
1553                         if (!found) {
1554                                 hid_warn(hdev, "pen parameters not found");
1555                                 uclogic_params_init_invalid(&p);
1556                         }
1557                 } else {
1558                         uclogic_params_init_invalid(&p);
1559                 }
1560                 break;
1561         case VID_PID(USB_VENDOR_ID_UGEE,
1562                      USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01):
1563                 /* If this is the pen and frame interface */
1564                 if (bInterfaceNumber == 1) {
1565                         /* Probe v1 pen parameters */
1566                         rc = uclogic_params_pen_init_v1(&p.pen, &found, hdev);
1567                         if (rc != 0) {
1568                                 hid_err(hdev, "pen probing failed: %d\n", rc);
1569                                 goto cleanup;
1570                         }
1571                         /* Initialize frame parameters */
1572                         rc = uclogic_params_frame_init_with_desc(
1573                                 &p.frame_list[0],
1574                                 uclogic_rdesc_xppen_deco01_frame_arr,
1575                                 uclogic_rdesc_xppen_deco01_frame_size,
1576                                 0);
1577                         if (rc != 0)
1578                                 goto cleanup;
1579                 } else {
1580                         uclogic_params_init_invalid(&p);
1581                 }
1582                 break;
1583         case VID_PID(USB_VENDOR_ID_UGEE,
1584                      USB_DEVICE_ID_UGEE_PARBLO_A610_PRO):
1585         case VID_PID(USB_VENDOR_ID_UGEE,
1586                      USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L):
1587         case VID_PID(USB_VENDOR_ID_UGEE,
1588                      USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S):
1589                 rc = uclogic_params_ugee_v2_init(&p, hdev);
1590                 if (rc != 0)
1591                         goto cleanup;
1592                 break;
1593         case VID_PID(USB_VENDOR_ID_TRUST,
1594                      USB_DEVICE_ID_TRUST_PANORA_TABLET):
1595         case VID_PID(USB_VENDOR_ID_UGEE,
1596                      USB_DEVICE_ID_UGEE_TABLET_G5):
1597                 /* Ignore non-pen interfaces */
1598                 if (bInterfaceNumber != 1) {
1599                         uclogic_params_init_invalid(&p);
1600                         break;
1601                 }
1602
1603                 rc = uclogic_params_pen_init_v1(&p.pen, &found, hdev);
1604                 if (rc != 0) {
1605                         hid_err(hdev, "pen probing failed: %d\n", rc);
1606                         goto cleanup;
1607                 } else if (found) {
1608                         rc = uclogic_params_frame_init_with_desc(
1609                                 &p.frame_list[0],
1610                                 uclogic_rdesc_ugee_g5_frame_arr,
1611                                 uclogic_rdesc_ugee_g5_frame_size,
1612                                 UCLOGIC_RDESC_UGEE_G5_FRAME_ID);
1613                         if (rc != 0) {
1614                                 hid_err(hdev,
1615                                         "failed creating frame parameters: %d\n",
1616                                         rc);
1617                                 goto cleanup;
1618                         }
1619                         p.frame_list[0].re_lsb =
1620                                 UCLOGIC_RDESC_UGEE_G5_FRAME_RE_LSB;
1621                         p.frame_list[0].dev_id_byte =
1622                                 UCLOGIC_RDESC_UGEE_G5_FRAME_DEV_ID_BYTE;
1623                 } else {
1624                         hid_warn(hdev, "pen parameters not found");
1625                         uclogic_params_init_invalid(&p);
1626                 }
1627
1628                 break;
1629         case VID_PID(USB_VENDOR_ID_UGEE,
1630                      USB_DEVICE_ID_UGEE_TABLET_EX07S):
1631                 /* Ignore non-pen interfaces */
1632                 if (bInterfaceNumber != 1) {
1633                         uclogic_params_init_invalid(&p);
1634                         break;
1635                 }
1636
1637                 rc = uclogic_params_pen_init_v1(&p.pen, &found, hdev);
1638                 if (rc != 0) {
1639                         hid_err(hdev, "pen probing failed: %d\n", rc);
1640                         goto cleanup;
1641                 } else if (found) {
1642                         rc = uclogic_params_frame_init_with_desc(
1643                                 &p.frame_list[0],
1644                                 uclogic_rdesc_ugee_ex07_frame_arr,
1645                                 uclogic_rdesc_ugee_ex07_frame_size,
1646                                 0);
1647                         if (rc != 0) {
1648                                 hid_err(hdev,
1649                                         "failed creating frame parameters: %d\n",
1650                                         rc);
1651                                 goto cleanup;
1652                         }
1653                 } else {
1654                         hid_warn(hdev, "pen parameters not found");
1655                         uclogic_params_init_invalid(&p);
1656                 }
1657
1658                 break;
1659         }
1660
1661 #undef VID_PID
1662 #undef WITH_OPT_DESC
1663
1664         /* Output parameters */
1665         memcpy(params, &p, sizeof(*params));
1666         memset(&p, 0, sizeof(p));
1667         rc = 0;
1668 cleanup:
1669         uclogic_params_cleanup(&p);
1670         return rc;
1671 }
1672
1673 #ifdef CONFIG_HID_KUNIT_TEST
1674 #include "hid-uclogic-params-test.c"
1675 #endif