1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * cec-adap.c - HDMI Consumer Electronics Control framework - CEC adapter
4  *
5  * Copyright 2016 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
6  */
7 
8 #include <linux/errno.h>
9 #include <linux/init.h>
10 #include <linux/module.h>
11 #include <linux/kernel.h>
12 #include <linux/kmod.h>
13 #include <linux/ktime.h>
14 #include <linux/slab.h>
15 #include <linux/mm.h>
16 #include <linux/string.h>
17 #include <linux/types.h>
18 
19 #include <drm/drm_connector.h>
20 #include <drm/drm_device.h>
21 #include <drm/drm_edid.h>
22 #include <drm/drm_file.h>
23 
24 #include "cec-priv.h"
25 
26 static void cec_fill_msg_report_features(struct cec_adapter *adap,
27 					 struct cec_msg *msg,
28 					 unsigned int la_idx);
29 
cec_log_addr2idx(const struct cec_adapter * adap,u8 log_addr)30 static int cec_log_addr2idx(const struct cec_adapter *adap, u8 log_addr)
31 {
32 	int i;
33 
34 	for (i = 0; i < adap->log_addrs.num_log_addrs; i++)
35 		if (adap->log_addrs.log_addr[i] == log_addr)
36 			return i;
37 	return -1;
38 }
39 
cec_log_addr2dev(const struct cec_adapter * adap,u8 log_addr)40 static unsigned int cec_log_addr2dev(const struct cec_adapter *adap, u8 log_addr)
41 {
42 	int i = cec_log_addr2idx(adap, log_addr);
43 
44 	return adap->log_addrs.primary_device_type[i < 0 ? 0 : i];
45 }
46 
cec_get_edid_phys_addr(const u8 * edid,unsigned int size,unsigned int * offset)47 u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
48 			   unsigned int *offset)
49 {
50 	unsigned int loc = cec_get_edid_spa_location(edid, size);
51 
52 	if (offset)
53 		*offset = loc;
54 	if (loc == 0)
55 		return CEC_PHYS_ADDR_INVALID;
56 	return (edid[loc] << 8) | edid[loc + 1];
57 }
58 EXPORT_SYMBOL_GPL(cec_get_edid_phys_addr);
59 
cec_fill_conn_info_from_drm(struct cec_connector_info * conn_info,const struct drm_connector * connector)60 void cec_fill_conn_info_from_drm(struct cec_connector_info *conn_info,
61 				 const struct drm_connector *connector)
62 {
63 	memset(conn_info, 0, sizeof(*conn_info));
64 	conn_info->type = CEC_CONNECTOR_TYPE_DRM;
65 	conn_info->drm.card_no = connector->dev->primary->index;
66 	conn_info->drm.connector_id = connector->base.id;
67 }
68 EXPORT_SYMBOL_GPL(cec_fill_conn_info_from_drm);
69 
70 /*
71  * Queue a new event for this filehandle. If ts == 0, then set it
72  * to the current time.
73  *
74  * We keep a queue of at most max_event events where max_event differs
75  * per event. If the queue becomes full, then drop the oldest event and
76  * keep track of how many events we've dropped.
77  */
cec_queue_event_fh(struct cec_fh * fh,const struct cec_event * new_ev,u64 ts)78 void cec_queue_event_fh(struct cec_fh *fh,
79 			const struct cec_event *new_ev, u64 ts)
80 {
81 	static const u16 max_events[CEC_NUM_EVENTS] = {
82 		1, 1, 800, 800, 8, 8, 8, 8
83 	};
84 	struct cec_event_entry *entry;
85 	unsigned int ev_idx = new_ev->event - 1;
86 
87 	if (WARN_ON(ev_idx >= ARRAY_SIZE(fh->events)))
88 		return;
89 
90 	if (ts == 0)
91 		ts = ktime_get_ns();
92 
93 	mutex_lock(&fh->lock);
94 	if (ev_idx < CEC_NUM_CORE_EVENTS)
95 		entry = &fh->core_events[ev_idx];
96 	else
97 		entry = kmalloc(sizeof(*entry), GFP_KERNEL);
98 	if (entry) {
99 		if (new_ev->event == CEC_EVENT_LOST_MSGS &&
100 		    fh->queued_events[ev_idx]) {
101 			entry->ev.lost_msgs.lost_msgs +=
102 				new_ev->lost_msgs.lost_msgs;
103 			goto unlock;
104 		}
105 		entry->ev = *new_ev;
106 		entry->ev.ts = ts;
107 
108 		if (fh->queued_events[ev_idx] < max_events[ev_idx]) {
109 			/* Add new msg at the end of the queue */
110 			list_add_tail(&entry->list, &fh->events[ev_idx]);
111 			fh->queued_events[ev_idx]++;
112 			fh->total_queued_events++;
113 			goto unlock;
114 		}
115 
116 		if (ev_idx >= CEC_NUM_CORE_EVENTS) {
117 			list_add_tail(&entry->list, &fh->events[ev_idx]);
118 			/* drop the oldest event */
119 			entry = list_first_entry(&fh->events[ev_idx],
120 						 struct cec_event_entry, list);
121 			list_del(&entry->list);
122 			kfree(entry);
123 		}
124 	}
125 	/* Mark that events were lost */
126 	entry = list_first_entry_or_null(&fh->events[ev_idx],
127 					 struct cec_event_entry, list);
128 	if (entry)
129 		entry->ev.flags |= CEC_EVENT_FL_DROPPED_EVENTS;
130 
131 unlock:
132 	mutex_unlock(&fh->lock);
133 	wake_up_interruptible(&fh->wait);
134 }
135 
136 /* Queue a new event for all open filehandles. */
cec_queue_event(struct cec_adapter * adap,const struct cec_event * ev)137 static void cec_queue_event(struct cec_adapter *adap,
138 			    const struct cec_event *ev)
139 {
140 	u64 ts = ktime_get_ns();
141 	struct cec_fh *fh;
142 
143 	mutex_lock(&adap->devnode.lock_fhs);
144 	list_for_each_entry(fh, &adap->devnode.fhs, list)
145 		cec_queue_event_fh(fh, ev, ts);
146 	mutex_unlock(&adap->devnode.lock_fhs);
147 }
148 
149 /* Notify userspace that the CEC pin changed state at the given time. */
cec_queue_pin_cec_event(struct cec_adapter * adap,bool is_high,bool dropped_events,ktime_t ts)150 void cec_queue_pin_cec_event(struct cec_adapter *adap, bool is_high,
151 			     bool dropped_events, ktime_t ts)
152 {
153 	struct cec_event ev = {
154 		.event = is_high ? CEC_EVENT_PIN_CEC_HIGH :
155 				   CEC_EVENT_PIN_CEC_LOW,
156 		.flags = dropped_events ? CEC_EVENT_FL_DROPPED_EVENTS : 0,
157 	};
158 	struct cec_fh *fh;
159 
160 	mutex_lock(&adap->devnode.lock_fhs);
161 	list_for_each_entry(fh, &adap->devnode.fhs, list) {
162 		if (fh->mode_follower == CEC_MODE_MONITOR_PIN)
163 			cec_queue_event_fh(fh, &ev, ktime_to_ns(ts));
164 	}
165 	mutex_unlock(&adap->devnode.lock_fhs);
166 }
167 EXPORT_SYMBOL_GPL(cec_queue_pin_cec_event);
168 
169 /* Notify userspace that the HPD pin changed state at the given time. */
cec_queue_pin_hpd_event(struct cec_adapter * adap,bool is_high,ktime_t ts)170 void cec_queue_pin_hpd_event(struct cec_adapter *adap, bool is_high, ktime_t ts)
171 {
172 	struct cec_event ev = {
173 		.event = is_high ? CEC_EVENT_PIN_HPD_HIGH :
174 				   CEC_EVENT_PIN_HPD_LOW,
175 	};
176 	struct cec_fh *fh;
177 
178 	mutex_lock(&adap->devnode.lock_fhs);
179 	list_for_each_entry(fh, &adap->devnode.fhs, list)
180 		cec_queue_event_fh(fh, &ev, ktime_to_ns(ts));
181 	mutex_unlock(&adap->devnode.lock_fhs);
182 }
183 EXPORT_SYMBOL_GPL(cec_queue_pin_hpd_event);
184 
185 /* Notify userspace that the 5V pin changed state at the given time. */
cec_queue_pin_5v_event(struct cec_adapter * adap,bool is_high,ktime_t ts)186 void cec_queue_pin_5v_event(struct cec_adapter *adap, bool is_high, ktime_t ts)
187 {
188 	struct cec_event ev = {
189 		.event = is_high ? CEC_EVENT_PIN_5V_HIGH :
190 				   CEC_EVENT_PIN_5V_LOW,
191 	};
192 	struct cec_fh *fh;
193 
194 	mutex_lock(&adap->devnode.lock_fhs);
195 	list_for_each_entry(fh, &adap->devnode.fhs, list)
196 		cec_queue_event_fh(fh, &ev, ktime_to_ns(ts));
197 	mutex_unlock(&adap->devnode.lock_fhs);
198 }
199 EXPORT_SYMBOL_GPL(cec_queue_pin_5v_event);
200 
201 /*
202  * Queue a new message for this filehandle.
203  *
204  * We keep a queue of at most CEC_MAX_MSG_RX_QUEUE_SZ messages. If the
205  * queue becomes full, then drop the oldest message and keep track
206  * of how many messages we've dropped.
207  */
cec_queue_msg_fh(struct cec_fh * fh,const struct cec_msg * msg)208 static void cec_queue_msg_fh(struct cec_fh *fh, const struct cec_msg *msg)
209 {
210 	static const struct cec_event ev_lost_msgs = {
211 		.event = CEC_EVENT_LOST_MSGS,
212 		.flags = 0,
213 		{
214 			.lost_msgs = { 1 },
215 		},
216 	};
217 	struct cec_msg_entry *entry;
218 
219 	mutex_lock(&fh->lock);
220 	entry = kmalloc(sizeof(*entry), GFP_KERNEL);
221 	if (entry) {
222 		entry->msg = *msg;
223 		/* Add new msg at the end of the queue */
224 		list_add_tail(&entry->list, &fh->msgs);
225 
226 		if (fh->queued_msgs < CEC_MAX_MSG_RX_QUEUE_SZ) {
227 			/* All is fine if there is enough room */
228 			fh->queued_msgs++;
229 			mutex_unlock(&fh->lock);
230 			wake_up_interruptible(&fh->wait);
231 			return;
232 		}
233 
234 		/*
235 		 * if the message queue is full, then drop the oldest one and
236 		 * send a lost message event.
237 		 */
238 		entry = list_first_entry(&fh->msgs, struct cec_msg_entry, list);
239 		list_del(&entry->list);
240 		kfree(entry);
241 	}
242 	mutex_unlock(&fh->lock);
243 
244 	/*
245 	 * We lost a message, either because kmalloc failed or the queue
246 	 * was full.
247 	 */
248 	cec_queue_event_fh(fh, &ev_lost_msgs, ktime_get_ns());
249 }
250 
251 /*
252  * Queue the message for those filehandles that are in monitor mode.
253  * If valid_la is true (this message is for us or was sent by us),
254  * then pass it on to any monitoring filehandle. If this message
255  * isn't for us or from us, then only give it to filehandles that
256  * are in MONITOR_ALL mode.
257  *
258  * This can only happen if the CEC_CAP_MONITOR_ALL capability is
259  * set and the CEC adapter was placed in 'monitor all' mode.
260  */
cec_queue_msg_monitor(struct cec_adapter * adap,const struct cec_msg * msg,bool valid_la)261 static void cec_queue_msg_monitor(struct cec_adapter *adap,
262 				  const struct cec_msg *msg,
263 				  bool valid_la)
264 {
265 	struct cec_fh *fh;
266 	u32 monitor_mode = valid_la ? CEC_MODE_MONITOR :
267 				      CEC_MODE_MONITOR_ALL;
268 
269 	mutex_lock(&adap->devnode.lock_fhs);
270 	list_for_each_entry(fh, &adap->devnode.fhs, list) {
271 		if (fh->mode_follower >= monitor_mode)
272 			cec_queue_msg_fh(fh, msg);
273 	}
274 	mutex_unlock(&adap->devnode.lock_fhs);
275 }
276 
277 /*
278  * Queue the message for follower filehandles.
279  */
cec_queue_msg_followers(struct cec_adapter * adap,const struct cec_msg * msg)280 static void cec_queue_msg_followers(struct cec_adapter *adap,
281 				    const struct cec_msg *msg)
282 {
283 	struct cec_fh *fh;
284 
285 	mutex_lock(&adap->devnode.lock_fhs);
286 	list_for_each_entry(fh, &adap->devnode.fhs, list) {
287 		if (fh->mode_follower == CEC_MODE_FOLLOWER)
288 			cec_queue_msg_fh(fh, msg);
289 	}
290 	mutex_unlock(&adap->devnode.lock_fhs);
291 }
292 
293 /* Notify userspace of an adapter state change. */
cec_post_state_event(struct cec_adapter * adap)294 static void cec_post_state_event(struct cec_adapter *adap)
295 {
296 	struct cec_event ev = {
297 		.event = CEC_EVENT_STATE_CHANGE,
298 	};
299 
300 	ev.state_change.phys_addr = adap->phys_addr;
301 	ev.state_change.log_addr_mask = adap->log_addrs.log_addr_mask;
302 	ev.state_change.have_conn_info =
303 		adap->conn_info.type != CEC_CONNECTOR_TYPE_NO_CONNECTOR;
304 	cec_queue_event(adap, &ev);
305 }
306 
307 /*
308  * A CEC transmit (and a possible wait for reply) completed.
309  * If this was in blocking mode, then complete it, otherwise
310  * queue the message for userspace to dequeue later.
311  *
312  * This function is called with adap->lock held.
313  */
cec_data_completed(struct cec_data * data)314 static void cec_data_completed(struct cec_data *data)
315 {
316 	/*
317 	 * Delete this transmit from the filehandle's xfer_list since
318 	 * we're done with it.
319 	 *
320 	 * Note that if the filehandle is closed before this transmit
321 	 * finished, then the release() function will set data->fh to NULL.
322 	 * Without that we would be referring to a closed filehandle.
323 	 */
324 	if (data->fh)
325 		list_del_init(&data->xfer_list);
326 
327 	if (data->blocking) {
328 		/*
329 		 * Someone is blocking so mark the message as completed
330 		 * and call complete.
331 		 */
332 		data->completed = true;
333 		complete(&data->c);
334 	} else {
335 		/*
336 		 * No blocking, so just queue the message if needed and
337 		 * free the memory.
338 		 */
339 		if (data->fh)
340 			cec_queue_msg_fh(data->fh, &data->msg);
341 		kfree(data);
342 	}
343 }
344 
345 /*
346  * A pending CEC transmit needs to be cancelled, either because the CEC
347  * adapter is disabled or the transmit takes an impossibly long time to
348  * finish, or the reply timed out.
349  *
350  * This function is called with adap->lock held.
351  */
cec_data_cancel(struct cec_data * data,u8 tx_status,u8 rx_status)352 static void cec_data_cancel(struct cec_data *data, u8 tx_status, u8 rx_status)
353 {
354 	struct cec_adapter *adap = data->adap;
355 
356 	/*
357 	 * It's either the current transmit, or it is a pending
358 	 * transmit. Take the appropriate action to clear it.
359 	 */
360 	if (adap->transmitting == data) {
361 		adap->transmitting = NULL;
362 	} else {
363 		list_del_init(&data->list);
364 		if (!(data->msg.tx_status & CEC_TX_STATUS_OK))
365 			if (!WARN_ON(!adap->transmit_queue_sz))
366 				adap->transmit_queue_sz--;
367 	}
368 
369 	if (data->msg.tx_status & CEC_TX_STATUS_OK) {
370 		data->msg.rx_ts = ktime_get_ns();
371 		data->msg.rx_status = rx_status;
372 		if (!data->blocking)
373 			data->msg.tx_status = 0;
374 	} else {
375 		data->msg.tx_ts = ktime_get_ns();
376 		data->msg.tx_status |= tx_status |
377 				       CEC_TX_STATUS_MAX_RETRIES;
378 		data->msg.tx_error_cnt++;
379 		data->attempts = 0;
380 		if (!data->blocking)
381 			data->msg.rx_status = 0;
382 	}
383 
384 	/* Queue transmitted message for monitoring purposes */
385 	cec_queue_msg_monitor(adap, &data->msg, 1);
386 
387 	if (!data->blocking && data->msg.sequence)
388 		/* Allow drivers to react to a canceled transmit */
389 		call_void_op(adap, adap_nb_transmit_canceled, &data->msg);
390 
391 	cec_data_completed(data);
392 }
393 
394 /*
395  * Flush all pending transmits and cancel any pending timeout work.
396  *
397  * This function is called with adap->lock held.
398  */
cec_flush(struct cec_adapter * adap)399 static void cec_flush(struct cec_adapter *adap)
400 {
401 	struct cec_data *data, *n;
402 
403 	/*
404 	 * If the adapter is disabled, or we're asked to stop,
405 	 * then cancel any pending transmits.
406 	 */
407 	while (!list_empty(&adap->transmit_queue)) {
408 		data = list_first_entry(&adap->transmit_queue,
409 					struct cec_data, list);
410 		cec_data_cancel(data, CEC_TX_STATUS_ABORTED, 0);
411 	}
412 	if (adap->transmitting)
413 		adap->transmit_in_progress_aborted = true;
414 
415 	/* Cancel the pending timeout work. */
416 	list_for_each_entry_safe(data, n, &adap->wait_queue, list) {
417 		if (cancel_delayed_work(&data->work))
418 			cec_data_cancel(data, CEC_TX_STATUS_OK, CEC_RX_STATUS_ABORTED);
419 		/*
420 		 * If cancel_delayed_work returned false, then
421 		 * the cec_wait_timeout function is running,
422 		 * which will call cec_data_completed. So no
423 		 * need to do anything special in that case.
424 		 */
425 	}
426 	/*
427 	 * If something went wrong and this counter isn't what it should
428 	 * be, then this will reset it back to 0. Warn if it is not 0,
429 	 * since it indicates a bug, either in this framework or in a
430 	 * CEC driver.
431 	 */
432 	if (WARN_ON(adap->transmit_queue_sz))
433 		adap->transmit_queue_sz = 0;
434 }
435 
436 /*
437  * Main CEC state machine
438  *
439  * Wait until the thread should be stopped, or we are not transmitting and
440  * a new transmit message is queued up, in which case we start transmitting
441  * that message. When the adapter finished transmitting the message it will
442  * call cec_transmit_done().
443  *
444  * If the adapter is disabled, then remove all queued messages instead.
445  *
446  * If the current transmit times out, then cancel that transmit.
447  */
cec_thread_func(void * _adap)448 int cec_thread_func(void *_adap)
449 {
450 	struct cec_adapter *adap = _adap;
451 
452 	for (;;) {
453 		unsigned int signal_free_time;
454 		struct cec_data *data;
455 		bool timeout = false;
456 		u8 attempts;
457 
458 		if (adap->transmit_in_progress) {
459 			int err;
460 
461 			/*
462 			 * We are transmitting a message, so add a timeout
463 			 * to prevent the state machine to get stuck waiting
464 			 * for this message to finalize and add a check to
465 			 * see if the adapter is disabled in which case the
466 			 * transmit should be canceled.
467 			 */
468 			err = wait_event_interruptible_timeout(adap->kthread_waitq,
469 				(adap->needs_hpd &&
470 				 (!adap->is_configured && !adap->is_configuring)) ||
471 				kthread_should_stop() ||
472 				(!adap->transmit_in_progress &&
473 				 !list_empty(&adap->transmit_queue)),
474 				msecs_to_jiffies(adap->xfer_timeout_ms));
475 			timeout = err == 0;
476 		} else {
477 			/* Otherwise we just wait for something to happen. */
478 			wait_event_interruptible(adap->kthread_waitq,
479 				kthread_should_stop() ||
480 				(!adap->transmit_in_progress &&
481 				 !list_empty(&adap->transmit_queue)));
482 		}
483 
484 		mutex_lock(&adap->lock);
485 
486 		if ((adap->needs_hpd &&
487 		     (!adap->is_configured && !adap->is_configuring)) ||
488 		    kthread_should_stop()) {
489 			cec_flush(adap);
490 			goto unlock;
491 		}
492 
493 		if (adap->transmit_in_progress && timeout) {
494 			/*
495 			 * If we timeout, then log that. Normally this does
496 			 * not happen and it is an indication of a faulty CEC
497 			 * adapter driver, or the CEC bus is in some weird
498 			 * state. On rare occasions it can happen if there is
499 			 * so much traffic on the bus that the adapter was
500 			 * unable to transmit for xfer_timeout_ms (2.1s by
501 			 * default).
502 			 */
503 			if (adap->transmitting) {
504 				pr_warn("cec-%s: message %*ph timed out\n", adap->name,
505 					adap->transmitting->msg.len,
506 					adap->transmitting->msg.msg);
507 				/* Just give up on this. */
508 				cec_data_cancel(adap->transmitting,
509 						CEC_TX_STATUS_TIMEOUT, 0);
510 			} else {
511 				pr_warn("cec-%s: transmit timed out\n", adap->name);
512 			}
513 			adap->transmit_in_progress = false;
514 			adap->tx_timeouts++;
515 			goto unlock;
516 		}
517 
518 		/*
519 		 * If we are still transmitting, or there is nothing new to
520 		 * transmit, then just continue waiting.
521 		 */
522 		if (adap->transmit_in_progress || list_empty(&adap->transmit_queue))
523 			goto unlock;
524 
525 		/* Get a new message to transmit */
526 		data = list_first_entry(&adap->transmit_queue,
527 					struct cec_data, list);
528 		list_del_init(&data->list);
529 		if (!WARN_ON(!data->adap->transmit_queue_sz))
530 			adap->transmit_queue_sz--;
531 
532 		/* Make this the current transmitting message */
533 		adap->transmitting = data;
534 
535 		/*
536 		 * Suggested number of attempts as per the CEC 2.0 spec:
537 		 * 4 attempts is the default, except for 'secondary poll
538 		 * messages', i.e. poll messages not sent during the adapter
539 		 * configuration phase when it allocates logical addresses.
540 		 */
541 		if (data->msg.len == 1 && adap->is_configured)
542 			attempts = 2;
543 		else
544 			attempts = 4;
545 
546 		/* Set the suggested signal free time */
547 		if (data->attempts) {
548 			/* should be >= 3 data bit periods for a retry */
549 			signal_free_time = CEC_SIGNAL_FREE_TIME_RETRY;
550 		} else if (adap->last_initiator !=
551 			   cec_msg_initiator(&data->msg)) {
552 			/* should be >= 5 data bit periods for new initiator */
553 			signal_free_time = CEC_SIGNAL_FREE_TIME_NEW_INITIATOR;
554 			adap->last_initiator = cec_msg_initiator(&data->msg);
555 		} else {
556 			/*
557 			 * should be >= 7 data bit periods for sending another
558 			 * frame immediately after another.
559 			 */
560 			signal_free_time = CEC_SIGNAL_FREE_TIME_NEXT_XFER;
561 		}
562 		if (data->attempts == 0)
563 			data->attempts = attempts;
564 
565 		adap->transmit_in_progress_aborted = false;
566 		/* Tell the adapter to transmit, cancel on error */
567 		if (call_op(adap, adap_transmit, data->attempts,
568 			    signal_free_time, &data->msg))
569 			cec_data_cancel(data, CEC_TX_STATUS_ABORTED, 0);
570 		else
571 			adap->transmit_in_progress = true;
572 
573 unlock:
574 		mutex_unlock(&adap->lock);
575 
576 		if (kthread_should_stop())
577 			break;
578 	}
579 	return 0;
580 }
581 
582 /*
583  * Called by the CEC adapter if a transmit finished.
584  */
cec_transmit_done_ts(struct cec_adapter * adap,u8 status,u8 arb_lost_cnt,u8 nack_cnt,u8 low_drive_cnt,u8 error_cnt,ktime_t ts)585 void cec_transmit_done_ts(struct cec_adapter *adap, u8 status,
586 			  u8 arb_lost_cnt, u8 nack_cnt, u8 low_drive_cnt,
587 			  u8 error_cnt, ktime_t ts)
588 {
589 	struct cec_data *data;
590 	struct cec_msg *msg;
591 	unsigned int attempts_made = arb_lost_cnt + nack_cnt +
592 				     low_drive_cnt + error_cnt;
593 	bool done = status & (CEC_TX_STATUS_MAX_RETRIES | CEC_TX_STATUS_OK);
594 	bool aborted = adap->transmit_in_progress_aborted;
595 
596 	dprintk(2, "%s: status 0x%02x\n", __func__, status);
597 	if (attempts_made < 1)
598 		attempts_made = 1;
599 
600 	mutex_lock(&adap->lock);
601 	data = adap->transmitting;
602 	if (!data) {
603 		/*
604 		 * This might happen if a transmit was issued and the cable is
605 		 * unplugged while the transmit is ongoing. Ignore this
606 		 * transmit in that case.
607 		 */
608 		if (!adap->transmit_in_progress)
609 			dprintk(1, "%s was called without an ongoing transmit!\n",
610 				__func__);
611 		adap->transmit_in_progress = false;
612 		goto wake_thread;
613 	}
614 	adap->transmit_in_progress = false;
615 	adap->transmit_in_progress_aborted = false;
616 
617 	msg = &data->msg;
618 
619 	/* Drivers must fill in the status! */
620 	WARN_ON(status == 0);
621 	msg->tx_ts = ktime_to_ns(ts);
622 	msg->tx_status |= status;
623 	msg->tx_arb_lost_cnt += arb_lost_cnt;
624 	msg->tx_nack_cnt += nack_cnt;
625 	msg->tx_low_drive_cnt += low_drive_cnt;
626 	msg->tx_error_cnt += error_cnt;
627 
628 	/* Mark that we're done with this transmit */
629 	adap->transmitting = NULL;
630 
631 	/*
632 	 * If there are still retry attempts left and there was an error and
633 	 * the hardware didn't signal that it retried itself (by setting
634 	 * CEC_TX_STATUS_MAX_RETRIES), then we will retry ourselves.
635 	 */
636 	if (!aborted && data->attempts > attempts_made && !done) {
637 		/* Retry this message */
638 		data->attempts -= attempts_made;
639 		if (msg->timeout)
640 			dprintk(2, "retransmit: %*ph (attempts: %d, wait for 0x%02x)\n",
641 				msg->len, msg->msg, data->attempts, msg->reply);
642 		else
643 			dprintk(2, "retransmit: %*ph (attempts: %d)\n",
644 				msg->len, msg->msg, data->attempts);
645 		/* Add the message in front of the transmit queue */
646 		list_add(&data->list, &adap->transmit_queue);
647 		adap->transmit_queue_sz++;
648 		goto wake_thread;
649 	}
650 
651 	if (aborted && !done)
652 		status |= CEC_TX_STATUS_ABORTED;
653 	data->attempts = 0;
654 
655 	/* Always set CEC_TX_STATUS_MAX_RETRIES on error */
656 	if (!(status & CEC_TX_STATUS_OK))
657 		msg->tx_status |= CEC_TX_STATUS_MAX_RETRIES;
658 
659 	/* Queue transmitted message for monitoring purposes */
660 	cec_queue_msg_monitor(adap, msg, 1);
661 
662 	if ((status & CEC_TX_STATUS_OK) && adap->is_configured &&
663 	    msg->timeout) {
664 		/*
665 		 * Queue the message into the wait queue if we want to wait
666 		 * for a reply.
667 		 */
668 		list_add_tail(&data->list, &adap->wait_queue);
669 		schedule_delayed_work(&data->work,
670 				      msecs_to_jiffies(msg->timeout));
671 	} else {
672 		/* Otherwise we're done */
673 		cec_data_completed(data);
674 	}
675 
676 wake_thread:
677 	/*
678 	 * Wake up the main thread to see if another message is ready
679 	 * for transmitting or to retry the current message.
680 	 */
681 	wake_up_interruptible(&adap->kthread_waitq);
682 	mutex_unlock(&adap->lock);
683 }
684 EXPORT_SYMBOL_GPL(cec_transmit_done_ts);
685 
cec_transmit_attempt_done_ts(struct cec_adapter * adap,u8 status,ktime_t ts)686 void cec_transmit_attempt_done_ts(struct cec_adapter *adap,
687 				  u8 status, ktime_t ts)
688 {
689 	switch (status & ~CEC_TX_STATUS_MAX_RETRIES) {
690 	case CEC_TX_STATUS_OK:
691 		cec_transmit_done_ts(adap, status, 0, 0, 0, 0, ts);
692 		return;
693 	case CEC_TX_STATUS_ARB_LOST:
694 		cec_transmit_done_ts(adap, status, 1, 0, 0, 0, ts);
695 		return;
696 	case CEC_TX_STATUS_NACK:
697 		cec_transmit_done_ts(adap, status, 0, 1, 0, 0, ts);
698 		return;
699 	case CEC_TX_STATUS_LOW_DRIVE:
700 		cec_transmit_done_ts(adap, status, 0, 0, 1, 0, ts);
701 		return;
702 	case CEC_TX_STATUS_ERROR:
703 		cec_transmit_done_ts(adap, status, 0, 0, 0, 1, ts);
704 		return;
705 	default:
706 		/* Should never happen */
707 		WARN(1, "cec-%s: invalid status 0x%02x\n", adap->name, status);
708 		return;
709 	}
710 }
711 EXPORT_SYMBOL_GPL(cec_transmit_attempt_done_ts);
712 
713 /*
714  * Called when waiting for a reply times out.
715  */
cec_wait_timeout(struct work_struct * work)716 static void cec_wait_timeout(struct work_struct *work)
717 {
718 	struct cec_data *data = container_of(work, struct cec_data, work.work);
719 	struct cec_adapter *adap = data->adap;
720 
721 	mutex_lock(&adap->lock);
722 	/*
723 	 * Sanity check in case the timeout and the arrival of the message
724 	 * happened at the same time.
725 	 */
726 	if (list_empty(&data->list))
727 		goto unlock;
728 
729 	/* Mark the message as timed out */
730 	list_del_init(&data->list);
731 	cec_data_cancel(data, CEC_TX_STATUS_OK, CEC_RX_STATUS_TIMEOUT);
732 unlock:
733 	mutex_unlock(&adap->lock);
734 }
735 
736 /*
737  * Transmit a message. The fh argument may be NULL if the transmit is not
738  * associated with a specific filehandle.
739  *
740  * This function is called with adap->lock held.
741  */
cec_transmit_msg_fh(struct cec_adapter * adap,struct cec_msg * msg,struct cec_fh * fh,bool block)742 int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
743 			struct cec_fh *fh, bool block)
744 {
745 	struct cec_data *data;
746 	bool is_raw = msg_is_raw(msg);
747 
748 	if (adap->devnode.unregistered)
749 		return -ENODEV;
750 
751 	msg->rx_ts = 0;
752 	msg->tx_ts = 0;
753 	msg->rx_status = 0;
754 	msg->tx_status = 0;
755 	msg->tx_arb_lost_cnt = 0;
756 	msg->tx_nack_cnt = 0;
757 	msg->tx_low_drive_cnt = 0;
758 	msg->tx_error_cnt = 0;
759 	msg->sequence = 0;
760 
761 	if (msg->reply && msg->timeout == 0) {
762 		/* Make sure the timeout isn't 0. */
763 		msg->timeout = 1000;
764 	}
765 	msg->flags &= CEC_MSG_FL_REPLY_TO_FOLLOWERS | CEC_MSG_FL_RAW;
766 
767 	if (!msg->timeout)
768 		msg->flags &= ~CEC_MSG_FL_REPLY_TO_FOLLOWERS;
769 
770 	/* Sanity checks */
771 	if (msg->len == 0 || msg->len > CEC_MAX_MSG_SIZE) {
772 		dprintk(1, "%s: invalid length %d\n", __func__, msg->len);
773 		return -EINVAL;
774 	}
775 
776 	memset(msg->msg + msg->len, 0, sizeof(msg->msg) - msg->len);
777 
778 	if (msg->timeout)
779 		dprintk(2, "%s: %*ph (wait for 0x%02x%s)\n",
780 			__func__, msg->len, msg->msg, msg->reply,
781 			!block ? ", nb" : "");
782 	else
783 		dprintk(2, "%s: %*ph%s\n",
784 			__func__, msg->len, msg->msg, !block ? " (nb)" : "");
785 
786 	if (msg->timeout && msg->len == 1) {
787 		dprintk(1, "%s: can't reply to poll msg\n", __func__);
788 		return -EINVAL;
789 	}
790 
791 	if (is_raw) {
792 		if (!capable(CAP_SYS_RAWIO))
793 			return -EPERM;
794 	} else {
795 		/* A CDC-Only device can only send CDC messages */
796 		if ((adap->log_addrs.flags & CEC_LOG_ADDRS_FL_CDC_ONLY) &&
797 		    (msg->len == 1 || msg->msg[1] != CEC_MSG_CDC_MESSAGE)) {
798 			dprintk(1, "%s: not a CDC message\n", __func__);
799 			return -EINVAL;
800 		}
801 
802 		if (msg->len >= 4 && msg->msg[1] == CEC_MSG_CDC_MESSAGE) {
803 			msg->msg[2] = adap->phys_addr >> 8;
804 			msg->msg[3] = adap->phys_addr & 0xff;
805 		}
806 
807 		if (msg->len == 1) {
808 			if (cec_msg_destination(msg) == 0xf) {
809 				dprintk(1, "%s: invalid poll message\n",
810 					__func__);
811 				return -EINVAL;
812 			}
813 			if (cec_has_log_addr(adap, cec_msg_destination(msg))) {
814 				/*
815 				 * If the destination is a logical address our
816 				 * adapter has already claimed, then just NACK
817 				 * this. It depends on the hardware what it will
818 				 * do with a POLL to itself (some OK this), so
819 				 * it is just as easy to handle it here so the
820 				 * behavior will be consistent.
821 				 */
822 				msg->tx_ts = ktime_get_ns();
823 				msg->tx_status = CEC_TX_STATUS_NACK |
824 					CEC_TX_STATUS_MAX_RETRIES;
825 				msg->tx_nack_cnt = 1;
826 				msg->sequence = ++adap->sequence;
827 				if (!msg->sequence)
828 					msg->sequence = ++adap->sequence;
829 				return 0;
830 			}
831 		}
832 		if (msg->len > 1 && !cec_msg_is_broadcast(msg) &&
833 		    cec_has_log_addr(adap, cec_msg_destination(msg))) {
834 			dprintk(1, "%s: destination is the adapter itself\n",
835 				__func__);
836 			return -EINVAL;
837 		}
838 		if (msg->len > 1 && adap->is_configured &&
839 		    !cec_has_log_addr(adap, cec_msg_initiator(msg))) {
840 			dprintk(1, "%s: initiator has unknown logical address %d\n",
841 				__func__, cec_msg_initiator(msg));
842 			return -EINVAL;
843 		}
844 		/*
845 		 * Special case: allow Ping and IMAGE/TEXT_VIEW_ON to be
846 		 * transmitted to a TV, even if the adapter is unconfigured.
847 		 * This makes it possible to detect or wake up displays that
848 		 * pull down the HPD when in standby.
849 		 */
850 		if (!adap->is_configured && !adap->is_configuring &&
851 		    (msg->len > 2 ||
852 		     cec_msg_destination(msg) != CEC_LOG_ADDR_TV ||
853 		     (msg->len == 2 && msg->msg[1] != CEC_MSG_IMAGE_VIEW_ON &&
854 		      msg->msg[1] != CEC_MSG_TEXT_VIEW_ON))) {
855 			dprintk(1, "%s: adapter is unconfigured\n", __func__);
856 			return -ENONET;
857 		}
858 	}
859 
860 	if (!adap->is_configured && !adap->is_configuring) {
861 		if (adap->needs_hpd) {
862 			dprintk(1, "%s: adapter is unconfigured and needs HPD\n",
863 				__func__);
864 			return -ENONET;
865 		}
866 		if (msg->reply) {
867 			dprintk(1, "%s: invalid msg->reply\n", __func__);
868 			return -EINVAL;
869 		}
870 	}
871 
872 	if (adap->transmit_queue_sz >= CEC_MAX_MSG_TX_QUEUE_SZ) {
873 		dprintk(2, "%s: transmit queue full\n", __func__);
874 		return -EBUSY;
875 	}
876 
877 	data = kzalloc(sizeof(*data), GFP_KERNEL);
878 	if (!data)
879 		return -ENOMEM;
880 
881 	msg->sequence = ++adap->sequence;
882 	if (!msg->sequence)
883 		msg->sequence = ++adap->sequence;
884 
885 	data->msg = *msg;
886 	data->fh = fh;
887 	data->adap = adap;
888 	data->blocking = block;
889 
890 	init_completion(&data->c);
891 	INIT_DELAYED_WORK(&data->work, cec_wait_timeout);
892 
893 	if (fh)
894 		list_add_tail(&data->xfer_list, &fh->xfer_list);
895 	else
896 		INIT_LIST_HEAD(&data->xfer_list);
897 
898 	list_add_tail(&data->list, &adap->transmit_queue);
899 	adap->transmit_queue_sz++;
900 	if (!adap->transmitting)
901 		wake_up_interruptible(&adap->kthread_waitq);
902 
903 	/* All done if we don't need to block waiting for completion */
904 	if (!block)
905 		return 0;
906 
907 	/*
908 	 * Release the lock and wait, retake the lock afterwards.
909 	 */
910 	mutex_unlock(&adap->lock);
911 	wait_for_completion_killable(&data->c);
912 	if (!data->completed)
913 		cancel_delayed_work_sync(&data->work);
914 	mutex_lock(&adap->lock);
915 
916 	/* Cancel the transmit if it was interrupted */
917 	if (!data->completed) {
918 		if (data->msg.tx_status & CEC_TX_STATUS_OK)
919 			cec_data_cancel(data, CEC_TX_STATUS_OK, CEC_RX_STATUS_ABORTED);
920 		else
921 			cec_data_cancel(data, CEC_TX_STATUS_ABORTED, 0);
922 	}
923 
924 	/* The transmit completed (possibly with an error) */
925 	*msg = data->msg;
926 	if (WARN_ON(!list_empty(&data->list)))
927 		list_del(&data->list);
928 	if (WARN_ON(!list_empty(&data->xfer_list)))
929 		list_del(&data->xfer_list);
930 	kfree(data);
931 	return 0;
932 }
933 
934 /* Helper function to be used by drivers and this framework. */
cec_transmit_msg(struct cec_adapter * adap,struct cec_msg * msg,bool block)935 int cec_transmit_msg(struct cec_adapter *adap, struct cec_msg *msg,
936 		     bool block)
937 {
938 	int ret;
939 
940 	mutex_lock(&adap->lock);
941 	ret = cec_transmit_msg_fh(adap, msg, NULL, block);
942 	mutex_unlock(&adap->lock);
943 	return ret;
944 }
945 EXPORT_SYMBOL_GPL(cec_transmit_msg);
946 
947 /*
948  * I don't like forward references but without this the low-level
949  * cec_received_msg() function would come after a bunch of high-level
950  * CEC protocol handling functions. That was very confusing.
951  */
952 static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
953 			      bool is_reply);
954 
955 #define DIRECTED	0x80
956 #define BCAST1_4	0x40
957 #define BCAST2_0	0x20	/* broadcast only allowed for >= 2.0 */
958 #define BCAST		(BCAST1_4 | BCAST2_0)
959 #define BOTH		(BCAST | DIRECTED)
960 
961 /*
962  * Specify minimum length and whether the message is directed, broadcast
963  * or both. Messages that do not match the criteria are ignored as per
964  * the CEC specification.
965  */
966 static const u8 cec_msg_size[256] = {
967 	[CEC_MSG_ACTIVE_SOURCE] = 4 | BCAST,
968 	[CEC_MSG_IMAGE_VIEW_ON] = 2 | DIRECTED,
969 	[CEC_MSG_TEXT_VIEW_ON] = 2 | DIRECTED,
970 	[CEC_MSG_INACTIVE_SOURCE] = 4 | DIRECTED,
971 	[CEC_MSG_REQUEST_ACTIVE_SOURCE] = 2 | BCAST,
972 	[CEC_MSG_ROUTING_CHANGE] = 6 | BCAST,
973 	[CEC_MSG_ROUTING_INFORMATION] = 4 | BCAST,
974 	[CEC_MSG_SET_STREAM_PATH] = 4 | BCAST,
975 	[CEC_MSG_STANDBY] = 2 | BOTH,
976 	[CEC_MSG_RECORD_OFF] = 2 | DIRECTED,
977 	[CEC_MSG_RECORD_ON] = 3 | DIRECTED,
978 	[CEC_MSG_RECORD_STATUS] = 3 | DIRECTED,
979 	[CEC_MSG_RECORD_TV_SCREEN] = 2 | DIRECTED,
980 	[CEC_MSG_CLEAR_ANALOGUE_TIMER] = 13 | DIRECTED,
981 	[CEC_MSG_CLEAR_DIGITAL_TIMER] = 16 | DIRECTED,
982 	[CEC_MSG_CLEAR_EXT_TIMER] = 13 | DIRECTED,
983 	[CEC_MSG_SET_ANALOGUE_TIMER] = 13 | DIRECTED,
984 	[CEC_MSG_SET_DIGITAL_TIMER] = 16 | DIRECTED,
985 	[CEC_MSG_SET_EXT_TIMER] = 13 | DIRECTED,
986 	[CEC_MSG_SET_TIMER_PROGRAM_TITLE] = 2 | DIRECTED,
987 	[CEC_MSG_TIMER_CLEARED_STATUS] = 3 | DIRECTED,
988 	[CEC_MSG_TIMER_STATUS] = 3 | DIRECTED,
989 	[CEC_MSG_CEC_VERSION] = 3 | DIRECTED,
990 	[CEC_MSG_GET_CEC_VERSION] = 2 | DIRECTED,
991 	[CEC_MSG_GIVE_PHYSICAL_ADDR] = 2 | DIRECTED,
992 	[CEC_MSG_GET_MENU_LANGUAGE] = 2 | DIRECTED,
993 	[CEC_MSG_REPORT_PHYSICAL_ADDR] = 5 | BCAST,
994 	[CEC_MSG_SET_MENU_LANGUAGE] = 5 | BCAST,
995 	[CEC_MSG_REPORT_FEATURES] = 6 | BCAST,
996 	[CEC_MSG_GIVE_FEATURES] = 2 | DIRECTED,
997 	[CEC_MSG_DECK_CONTROL] = 3 | DIRECTED,
998 	[CEC_MSG_DECK_STATUS] = 3 | DIRECTED,
999 	[CEC_MSG_GIVE_DECK_STATUS] = 3 | DIRECTED,
1000 	[CEC_MSG_PLAY] = 3 | DIRECTED,
1001 	[CEC_MSG_GIVE_TUNER_DEVICE_STATUS] = 3 | DIRECTED,
1002 	[CEC_MSG_SELECT_ANALOGUE_SERVICE] = 6 | DIRECTED,
1003 	[CEC_MSG_SELECT_DIGITAL_SERVICE] = 9 | DIRECTED,
1004 	[CEC_MSG_TUNER_DEVICE_STATUS] = 7 | DIRECTED,
1005 	[CEC_MSG_TUNER_STEP_DECREMENT] = 2 | DIRECTED,
1006 	[CEC_MSG_TUNER_STEP_INCREMENT] = 2 | DIRECTED,
1007 	[CEC_MSG_DEVICE_VENDOR_ID] = 5 | BCAST,
1008 	[CEC_MSG_GIVE_DEVICE_VENDOR_ID] = 2 | DIRECTED,
1009 	[CEC_MSG_VENDOR_COMMAND] = 2 | DIRECTED,
1010 	[CEC_MSG_VENDOR_COMMAND_WITH_ID] = 5 | BOTH,
1011 	[CEC_MSG_VENDOR_REMOTE_BUTTON_DOWN] = 2 | BOTH,
1012 	[CEC_MSG_VENDOR_REMOTE_BUTTON_UP] = 2 | BOTH,
1013 	[CEC_MSG_SET_OSD_STRING] = 3 | DIRECTED,
1014 	[CEC_MSG_GIVE_OSD_NAME] = 2 | DIRECTED,
1015 	[CEC_MSG_SET_OSD_NAME] = 2 | DIRECTED,
1016 	[CEC_MSG_MENU_REQUEST] = 3 | DIRECTED,
1017 	[CEC_MSG_MENU_STATUS] = 3 | DIRECTED,
1018 	[CEC_MSG_USER_CONTROL_PRESSED] = 3 | DIRECTED,
1019 	[CEC_MSG_USER_CONTROL_RELEASED] = 2 | DIRECTED,
1020 	[CEC_MSG_GIVE_DEVICE_POWER_STATUS] = 2 | DIRECTED,
1021 	[CEC_MSG_REPORT_POWER_STATUS] = 3 | DIRECTED | BCAST2_0,
1022 	[CEC_MSG_FEATURE_ABORT] = 4 | DIRECTED,
1023 	[CEC_MSG_ABORT] = 2 | DIRECTED,
1024 	[CEC_MSG_GIVE_AUDIO_STATUS] = 2 | DIRECTED,
1025 	[CEC_MSG_GIVE_SYSTEM_AUDIO_MODE_STATUS] = 2 | DIRECTED,
1026 	[CEC_MSG_REPORT_AUDIO_STATUS] = 3 | DIRECTED,
1027 	[CEC_MSG_REPORT_SHORT_AUDIO_DESCRIPTOR] = 2 | DIRECTED,
1028 	[CEC_MSG_REQUEST_SHORT_AUDIO_DESCRIPTOR] = 2 | DIRECTED,
1029 	[CEC_MSG_SET_SYSTEM_AUDIO_MODE] = 3 | BOTH,
1030 	[CEC_MSG_SET_AUDIO_VOLUME_LEVEL] = 3 | DIRECTED,
1031 	[CEC_MSG_SYSTEM_AUDIO_MODE_REQUEST] = 2 | DIRECTED,
1032 	[CEC_MSG_SYSTEM_AUDIO_MODE_STATUS] = 3 | DIRECTED,
1033 	[CEC_MSG_SET_AUDIO_RATE] = 3 | DIRECTED,
1034 	[CEC_MSG_INITIATE_ARC] = 2 | DIRECTED,
1035 	[CEC_MSG_REPORT_ARC_INITIATED] = 2 | DIRECTED,
1036 	[CEC_MSG_REPORT_ARC_TERMINATED] = 2 | DIRECTED,
1037 	[CEC_MSG_REQUEST_ARC_INITIATION] = 2 | DIRECTED,
1038 	[CEC_MSG_REQUEST_ARC_TERMINATION] = 2 | DIRECTED,
1039 	[CEC_MSG_TERMINATE_ARC] = 2 | DIRECTED,
1040 	[CEC_MSG_REQUEST_CURRENT_LATENCY] = 4 | BCAST,
1041 	[CEC_MSG_REPORT_CURRENT_LATENCY] = 6 | BCAST,
1042 	[CEC_MSG_CDC_MESSAGE] = 2 | BCAST,
1043 };
1044 
1045 /* Called by the CEC adapter if a message is received */
cec_received_msg_ts(struct cec_adapter * adap,struct cec_msg * msg,ktime_t ts)1046 void cec_received_msg_ts(struct cec_adapter *adap,
1047 			 struct cec_msg *msg, ktime_t ts)
1048 {
1049 	struct cec_data *data;
1050 	u8 msg_init = cec_msg_initiator(msg);
1051 	u8 msg_dest = cec_msg_destination(msg);
1052 	u8 cmd = msg->msg[1];
1053 	bool is_reply = false;
1054 	bool valid_la = true;
1055 	bool monitor_valid_la = true;
1056 	u8 min_len = 0;
1057 
1058 	if (WARN_ON(!msg->len || msg->len > CEC_MAX_MSG_SIZE))
1059 		return;
1060 
1061 	if (adap->devnode.unregistered)
1062 		return;
1063 
1064 	/*
1065 	 * Some CEC adapters will receive the messages that they transmitted.
1066 	 * This test filters out those messages by checking if we are the
1067 	 * initiator, and just returning in that case.
1068 	 *
1069 	 * Note that this won't work if this is an Unregistered device.
1070 	 *
1071 	 * It is bad practice if the hardware receives the message that it
1072 	 * transmitted and luckily most CEC adapters behave correctly in this
1073 	 * respect.
1074 	 */
1075 	if (msg_init != CEC_LOG_ADDR_UNREGISTERED &&
1076 	    cec_has_log_addr(adap, msg_init))
1077 		return;
1078 
1079 	msg->rx_ts = ktime_to_ns(ts);
1080 	msg->rx_status = CEC_RX_STATUS_OK;
1081 	msg->sequence = msg->reply = msg->timeout = 0;
1082 	msg->tx_status = 0;
1083 	msg->tx_ts = 0;
1084 	msg->tx_arb_lost_cnt = 0;
1085 	msg->tx_nack_cnt = 0;
1086 	msg->tx_low_drive_cnt = 0;
1087 	msg->tx_error_cnt = 0;
1088 	msg->flags = 0;
1089 	memset(msg->msg + msg->len, 0, sizeof(msg->msg) - msg->len);
1090 
1091 	mutex_lock(&adap->lock);
1092 	dprintk(2, "%s: %*ph\n", __func__, msg->len, msg->msg);
1093 
1094 	if (!adap->transmit_in_progress)
1095 		adap->last_initiator = 0xff;
1096 
1097 	/* Check if this message was for us (directed or broadcast). */
1098 	if (!cec_msg_is_broadcast(msg)) {
1099 		valid_la = cec_has_log_addr(adap, msg_dest);
1100 		monitor_valid_la = valid_la;
1101 	}
1102 
1103 	/*
1104 	 * Check if the length is not too short or if the message is a
1105 	 * broadcast message where a directed message was expected or
1106 	 * vice versa. If so, then the message has to be ignored (according
1107 	 * to section CEC 7.3 and CEC 12.2).
1108 	 */
1109 	if (valid_la && msg->len > 1 && cec_msg_size[cmd]) {
1110 		u8 dir_fl = cec_msg_size[cmd] & BOTH;
1111 
1112 		min_len = cec_msg_size[cmd] & 0x1f;
1113 		if (msg->len < min_len)
1114 			valid_la = false;
1115 		else if (!cec_msg_is_broadcast(msg) && !(dir_fl & DIRECTED))
1116 			valid_la = false;
1117 		else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST))
1118 			valid_la = false;
1119 		else if (cec_msg_is_broadcast(msg) &&
1120 			 adap->log_addrs.cec_version < CEC_OP_CEC_VERSION_2_0 &&
1121 			 !(dir_fl & BCAST1_4))
1122 			valid_la = false;
1123 	}
1124 	if (valid_la && min_len) {
1125 		/* These messages have special length requirements */
1126 		switch (cmd) {
1127 		case CEC_MSG_TIMER_STATUS:
1128 			if (msg->msg[2] & 0x10) {
1129 				switch (msg->msg[2] & 0xf) {
1130 				case CEC_OP_PROG_INFO_NOT_ENOUGH_SPACE:
1131 				case CEC_OP_PROG_INFO_MIGHT_NOT_BE_ENOUGH_SPACE:
1132 					if (msg->len < 5)
1133 						valid_la = false;
1134 					break;
1135 				}
1136 			} else if ((msg->msg[2] & 0xf) == CEC_OP_PROG_ERROR_DUPLICATE) {
1137 				if (msg->len < 5)
1138 					valid_la = false;
1139 			}
1140 			break;
1141 		case CEC_MSG_RECORD_ON:
1142 			switch (msg->msg[2]) {
1143 			case CEC_OP_RECORD_SRC_OWN:
1144 				break;
1145 			case CEC_OP_RECORD_SRC_DIGITAL:
1146 				if (msg->len < 10)
1147 					valid_la = false;
1148 				break;
1149 			case CEC_OP_RECORD_SRC_ANALOG:
1150 				if (msg->len < 7)
1151 					valid_la = false;
1152 				break;
1153 			case CEC_OP_RECORD_SRC_EXT_PLUG:
1154 				if (msg->len < 4)
1155 					valid_la = false;
1156 				break;
1157 			case CEC_OP_RECORD_SRC_EXT_PHYS_ADDR:
1158 				if (msg->len < 5)
1159 					valid_la = false;
1160 				break;
1161 			}
1162 			break;
1163 		}
1164 	}
1165 
1166 	/* It's a valid message and not a poll or CDC message */
1167 	if (valid_la && msg->len > 1 && cmd != CEC_MSG_CDC_MESSAGE) {
1168 		bool abort = cmd == CEC_MSG_FEATURE_ABORT;
1169 
1170 		/* The aborted command is in msg[2] */
1171 		if (abort)
1172 			cmd = msg->msg[2];
1173 
1174 		/*
1175 		 * Walk over all transmitted messages that are waiting for a
1176 		 * reply.
1177 		 */
1178 		list_for_each_entry(data, &adap->wait_queue, list) {
1179 			struct cec_msg *dst = &data->msg;
1180 
1181 			/*
1182 			 * The *only* CEC message that has two possible replies
1183 			 * is CEC_MSG_INITIATE_ARC.
1184 			 * In this case allow either of the two replies.
1185 			 */
1186 			if (!abort && dst->msg[1] == CEC_MSG_INITIATE_ARC &&
1187 			    (cmd == CEC_MSG_REPORT_ARC_INITIATED ||
1188 			     cmd == CEC_MSG_REPORT_ARC_TERMINATED) &&
1189 			    (dst->reply == CEC_MSG_REPORT_ARC_INITIATED ||
1190 			     dst->reply == CEC_MSG_REPORT_ARC_TERMINATED))
1191 				dst->reply = cmd;
1192 
1193 			/* Does the command match? */
1194 			if ((abort && cmd != dst->msg[1]) ||
1195 			    (!abort && cmd != dst->reply))
1196 				continue;
1197 
1198 			/* Does the addressing match? */
1199 			if (msg_init != cec_msg_destination(dst) &&
1200 			    !cec_msg_is_broadcast(dst))
1201 				continue;
1202 
1203 			/* We got a reply */
1204 			memcpy(dst->msg, msg->msg, msg->len);
1205 			dst->len = msg->len;
1206 			dst->rx_ts = msg->rx_ts;
1207 			dst->rx_status = msg->rx_status;
1208 			if (abort)
1209 				dst->rx_status |= CEC_RX_STATUS_FEATURE_ABORT;
1210 			msg->flags = dst->flags;
1211 			msg->sequence = dst->sequence;
1212 			/* Remove it from the wait_queue */
1213 			list_del_init(&data->list);
1214 
1215 			/* Cancel the pending timeout work */
1216 			if (!cancel_delayed_work(&data->work)) {
1217 				mutex_unlock(&adap->lock);
1218 				cancel_delayed_work_sync(&data->work);
1219 				mutex_lock(&adap->lock);
1220 			}
1221 			/*
1222 			 * Mark this as a reply, provided someone is still
1223 			 * waiting for the answer.
1224 			 */
1225 			if (data->fh)
1226 				is_reply = true;
1227 			cec_data_completed(data);
1228 			break;
1229 		}
1230 	}
1231 	mutex_unlock(&adap->lock);
1232 
1233 	/* Pass the message on to any monitoring filehandles */
1234 	cec_queue_msg_monitor(adap, msg, monitor_valid_la);
1235 
1236 	/* We're done if it is not for us or a poll message */
1237 	if (!valid_la || msg->len <= 1)
1238 		return;
1239 
1240 	if (adap->log_addrs.log_addr_mask == 0)
1241 		return;
1242 
1243 	/*
1244 	 * Process the message on the protocol level. If is_reply is true,
1245 	 * then cec_receive_notify() won't pass on the reply to the listener(s)
1246 	 * since that was already done by cec_data_completed() above.
1247 	 */
1248 	cec_receive_notify(adap, msg, is_reply);
1249 }
1250 EXPORT_SYMBOL_GPL(cec_received_msg_ts);
1251 
1252 /* Logical Address Handling */
1253 
1254 /*
1255  * Attempt to claim a specific logical address.
1256  *
1257  * This function is called with adap->lock held.
1258  */
cec_config_log_addr(struct cec_adapter * adap,unsigned int idx,unsigned int log_addr)1259 static int cec_config_log_addr(struct cec_adapter *adap,
1260 			       unsigned int idx,
1261 			       unsigned int log_addr)
1262 {
1263 	struct cec_log_addrs *las = &adap->log_addrs;
1264 	struct cec_msg msg = { };
1265 	const unsigned int max_retries = 2;
1266 	unsigned int i;
1267 	int err;
1268 
1269 	if (cec_has_log_addr(adap, log_addr))
1270 		return 0;
1271 
1272 	/* Send poll message */
1273 	msg.len = 1;
1274 	msg.msg[0] = (log_addr << 4) | log_addr;
1275 
1276 	for (i = 0; i < max_retries; i++) {
1277 		err = cec_transmit_msg_fh(adap, &msg, NULL, true);
1278 
1279 		/*
1280 		 * While trying to poll the physical address was reset
1281 		 * and the adapter was unconfigured, so bail out.
1282 		 */
1283 		if (adap->phys_addr == CEC_PHYS_ADDR_INVALID)
1284 			return -EINTR;
1285 
1286 		/* Also bail out if the PA changed while configuring. */
1287 		if (adap->must_reconfigure)
1288 			return -EINTR;
1289 
1290 		if (err)
1291 			return err;
1292 
1293 		/*
1294 		 * The message was aborted or timed out due to a disconnect or
1295 		 * unconfigure, just bail out.
1296 		 */
1297 		if (msg.tx_status &
1298 		    (CEC_TX_STATUS_ABORTED | CEC_TX_STATUS_TIMEOUT))
1299 			return -EINTR;
1300 		if (msg.tx_status & CEC_TX_STATUS_OK)
1301 			return 0;
1302 		if (msg.tx_status & CEC_TX_STATUS_NACK)
1303 			break;
1304 		/*
1305 		 * Retry up to max_retries times if the message was neither
1306 		 * OKed or NACKed. This can happen due to e.g. a Lost
1307 		 * Arbitration condition.
1308 		 */
1309 	}
1310 
1311 	/*
1312 	 * If we are unable to get an OK or a NACK after max_retries attempts
1313 	 * (and note that each attempt already consists of four polls), then
1314 	 * we assume that something is really weird and that it is not a
1315 	 * good idea to try and claim this logical address.
1316 	 */
1317 	if (i == max_retries) {
1318 		dprintk(0, "polling for LA %u failed with tx_status=0x%04x\n",
1319 			log_addr, msg.tx_status);
1320 		return 0;
1321 	}
1322 
1323 	/*
1324 	 * Message not acknowledged, so this logical
1325 	 * address is free to use.
1326 	 */
1327 	err = call_op(adap, adap_log_addr, log_addr);
1328 	if (err)
1329 		return err;
1330 
1331 	las->log_addr[idx] = log_addr;
1332 	las->log_addr_mask |= 1 << log_addr;
1333 	return 1;
1334 }
1335 
1336 /*
1337  * Unconfigure the adapter: clear all logical addresses and send
1338  * the state changed event.
1339  *
1340  * This function is called with adap->lock held.
1341  */
cec_adap_unconfigure(struct cec_adapter * adap)1342 static void cec_adap_unconfigure(struct cec_adapter *adap)
1343 {
1344 	if (!adap->needs_hpd || adap->phys_addr != CEC_PHYS_ADDR_INVALID)
1345 		WARN_ON(call_op(adap, adap_log_addr, CEC_LOG_ADDR_INVALID));
1346 	adap->log_addrs.log_addr_mask = 0;
1347 	adap->is_configured = false;
1348 	cec_flush(adap);
1349 	wake_up_interruptible(&adap->kthread_waitq);
1350 	cec_post_state_event(adap);
1351 	call_void_op(adap, adap_unconfigured);
1352 }
1353 
1354 /*
1355  * Attempt to claim the required logical addresses.
1356  */
cec_config_thread_func(void * arg)1357 static int cec_config_thread_func(void *arg)
1358 {
1359 	/* The various LAs for each type of device */
1360 	static const u8 tv_log_addrs[] = {
1361 		CEC_LOG_ADDR_TV, CEC_LOG_ADDR_SPECIFIC,
1362 		CEC_LOG_ADDR_INVALID
1363 	};
1364 	static const u8 record_log_addrs[] = {
1365 		CEC_LOG_ADDR_RECORD_1, CEC_LOG_ADDR_RECORD_2,
1366 		CEC_LOG_ADDR_RECORD_3,
1367 		CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1368 		CEC_LOG_ADDR_INVALID
1369 	};
1370 	static const u8 tuner_log_addrs[] = {
1371 		CEC_LOG_ADDR_TUNER_1, CEC_LOG_ADDR_TUNER_2,
1372 		CEC_LOG_ADDR_TUNER_3, CEC_LOG_ADDR_TUNER_4,
1373 		CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1374 		CEC_LOG_ADDR_INVALID
1375 	};
1376 	static const u8 playback_log_addrs[] = {
1377 		CEC_LOG_ADDR_PLAYBACK_1, CEC_LOG_ADDR_PLAYBACK_2,
1378 		CEC_LOG_ADDR_PLAYBACK_3,
1379 		CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1380 		CEC_LOG_ADDR_INVALID
1381 	};
1382 	static const u8 audiosystem_log_addrs[] = {
1383 		CEC_LOG_ADDR_AUDIOSYSTEM,
1384 		CEC_LOG_ADDR_INVALID
1385 	};
1386 	static const u8 specific_use_log_addrs[] = {
1387 		CEC_LOG_ADDR_SPECIFIC,
1388 		CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1389 		CEC_LOG_ADDR_INVALID
1390 	};
1391 	static const u8 *type2addrs[6] = {
1392 		[CEC_LOG_ADDR_TYPE_TV] = tv_log_addrs,
1393 		[CEC_LOG_ADDR_TYPE_RECORD] = record_log_addrs,
1394 		[CEC_LOG_ADDR_TYPE_TUNER] = tuner_log_addrs,
1395 		[CEC_LOG_ADDR_TYPE_PLAYBACK] = playback_log_addrs,
1396 		[CEC_LOG_ADDR_TYPE_AUDIOSYSTEM] = audiosystem_log_addrs,
1397 		[CEC_LOG_ADDR_TYPE_SPECIFIC] = specific_use_log_addrs,
1398 	};
1399 	static const u16 type2mask[] = {
1400 		[CEC_LOG_ADDR_TYPE_TV] = CEC_LOG_ADDR_MASK_TV,
1401 		[CEC_LOG_ADDR_TYPE_RECORD] = CEC_LOG_ADDR_MASK_RECORD,
1402 		[CEC_LOG_ADDR_TYPE_TUNER] = CEC_LOG_ADDR_MASK_TUNER,
1403 		[CEC_LOG_ADDR_TYPE_PLAYBACK] = CEC_LOG_ADDR_MASK_PLAYBACK,
1404 		[CEC_LOG_ADDR_TYPE_AUDIOSYSTEM] = CEC_LOG_ADDR_MASK_AUDIOSYSTEM,
1405 		[CEC_LOG_ADDR_TYPE_SPECIFIC] = CEC_LOG_ADDR_MASK_SPECIFIC,
1406 	};
1407 	struct cec_adapter *adap = arg;
1408 	struct cec_log_addrs *las = &adap->log_addrs;
1409 	int err;
1410 	int i, j;
1411 
1412 	mutex_lock(&adap->lock);
1413 	dprintk(1, "physical address: %x.%x.%x.%x, claim %d logical addresses\n",
1414 		cec_phys_addr_exp(adap->phys_addr), las->num_log_addrs);
1415 	las->log_addr_mask = 0;
1416 
1417 	if (las->log_addr_type[0] == CEC_LOG_ADDR_TYPE_UNREGISTERED)
1418 		goto configured;
1419 
1420 reconfigure:
1421 	for (i = 0; i < las->num_log_addrs; i++) {
1422 		unsigned int type = las->log_addr_type[i];
1423 		const u8 *la_list;
1424 		u8 last_la;
1425 
1426 		/*
1427 		 * The TV functionality can only map to physical address 0.
1428 		 * For any other address, try the Specific functionality
1429 		 * instead as per the spec.
1430 		 */
1431 		if (adap->phys_addr && type == CEC_LOG_ADDR_TYPE_TV)
1432 			type = CEC_LOG_ADDR_TYPE_SPECIFIC;
1433 
1434 		la_list = type2addrs[type];
1435 		last_la = las->log_addr[i];
1436 		las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1437 		if (last_la == CEC_LOG_ADDR_INVALID ||
1438 		    last_la == CEC_LOG_ADDR_UNREGISTERED ||
1439 		    !((1 << last_la) & type2mask[type]))
1440 			last_la = la_list[0];
1441 
1442 		err = cec_config_log_addr(adap, i, last_la);
1443 
1444 		if (adap->must_reconfigure) {
1445 			adap->must_reconfigure = false;
1446 			las->log_addr_mask = 0;
1447 			goto reconfigure;
1448 		}
1449 
1450 		if (err > 0) /* Reused last LA */
1451 			continue;
1452 
1453 		if (err < 0)
1454 			goto unconfigure;
1455 
1456 		for (j = 0; la_list[j] != CEC_LOG_ADDR_INVALID; j++) {
1457 			/* Tried this one already, skip it */
1458 			if (la_list[j] == last_la)
1459 				continue;
1460 			/* The backup addresses are CEC 2.0 specific */
1461 			if ((la_list[j] == CEC_LOG_ADDR_BACKUP_1 ||
1462 			     la_list[j] == CEC_LOG_ADDR_BACKUP_2) &&
1463 			    las->cec_version < CEC_OP_CEC_VERSION_2_0)
1464 				continue;
1465 
1466 			err = cec_config_log_addr(adap, i, la_list[j]);
1467 			if (err == 0) /* LA is in use */
1468 				continue;
1469 			if (err < 0)
1470 				goto unconfigure;
1471 			/* Done, claimed an LA */
1472 			break;
1473 		}
1474 
1475 		if (la_list[j] == CEC_LOG_ADDR_INVALID)
1476 			dprintk(1, "could not claim LA %d\n", i);
1477 	}
1478 
1479 	if (adap->log_addrs.log_addr_mask == 0 &&
1480 	    !(las->flags & CEC_LOG_ADDRS_FL_ALLOW_UNREG_FALLBACK))
1481 		goto unconfigure;
1482 
1483 configured:
1484 	if (adap->log_addrs.log_addr_mask == 0) {
1485 		/* Fall back to unregistered */
1486 		las->log_addr[0] = CEC_LOG_ADDR_UNREGISTERED;
1487 		las->log_addr_mask = 1 << las->log_addr[0];
1488 		for (i = 1; i < las->num_log_addrs; i++)
1489 			las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1490 	}
1491 	for (i = las->num_log_addrs; i < CEC_MAX_LOG_ADDRS; i++)
1492 		las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1493 	adap->is_configured = true;
1494 	adap->is_configuring = false;
1495 	adap->must_reconfigure = false;
1496 	cec_post_state_event(adap);
1497 
1498 	/*
1499 	 * Now post the Report Features and Report Physical Address broadcast
1500 	 * messages. Note that these are non-blocking transmits, meaning that
1501 	 * they are just queued up and once adap->lock is unlocked the main
1502 	 * thread will kick in and start transmitting these.
1503 	 *
1504 	 * If after this function is done (but before one or more of these
1505 	 * messages are actually transmitted) the CEC adapter is unconfigured,
1506 	 * then any remaining messages will be dropped by the main thread.
1507 	 */
1508 	for (i = 0; i < las->num_log_addrs; i++) {
1509 		struct cec_msg msg = {};
1510 
1511 		if (las->log_addr[i] == CEC_LOG_ADDR_INVALID ||
1512 		    (las->flags & CEC_LOG_ADDRS_FL_CDC_ONLY))
1513 			continue;
1514 
1515 		msg.msg[0] = (las->log_addr[i] << 4) | 0x0f;
1516 
1517 		/* Report Features must come first according to CEC 2.0 */
1518 		if (las->log_addr[i] != CEC_LOG_ADDR_UNREGISTERED &&
1519 		    adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0) {
1520 			cec_fill_msg_report_features(adap, &msg, i);
1521 			cec_transmit_msg_fh(adap, &msg, NULL, false);
1522 		}
1523 
1524 		/* Report Physical Address */
1525 		cec_msg_report_physical_addr(&msg, adap->phys_addr,
1526 					     las->primary_device_type[i]);
1527 		dprintk(1, "config: la %d pa %x.%x.%x.%x\n",
1528 			las->log_addr[i],
1529 			cec_phys_addr_exp(adap->phys_addr));
1530 		cec_transmit_msg_fh(adap, &msg, NULL, false);
1531 
1532 		/* Report Vendor ID */
1533 		if (adap->log_addrs.vendor_id != CEC_VENDOR_ID_NONE) {
1534 			cec_msg_device_vendor_id(&msg,
1535 						 adap->log_addrs.vendor_id);
1536 			cec_transmit_msg_fh(adap, &msg, NULL, false);
1537 		}
1538 	}
1539 	adap->kthread_config = NULL;
1540 	complete(&adap->config_completion);
1541 	mutex_unlock(&adap->lock);
1542 	call_void_op(adap, configured);
1543 	return 0;
1544 
1545 unconfigure:
1546 	for (i = 0; i < las->num_log_addrs; i++)
1547 		las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1548 	cec_adap_unconfigure(adap);
1549 	adap->is_configuring = false;
1550 	adap->must_reconfigure = false;
1551 	adap->kthread_config = NULL;
1552 	complete(&adap->config_completion);
1553 	mutex_unlock(&adap->lock);
1554 	return 0;
1555 }
1556 
1557 /*
1558  * Called from either __cec_s_phys_addr or __cec_s_log_addrs to claim the
1559  * logical addresses.
1560  *
1561  * This function is called with adap->lock held.
1562  */
cec_claim_log_addrs(struct cec_adapter * adap,bool block)1563 static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
1564 {
1565 	if (WARN_ON(adap->is_configuring || adap->is_configured))
1566 		return;
1567 
1568 	init_completion(&adap->config_completion);
1569 
1570 	/* Ready to kick off the thread */
1571 	adap->is_configuring = true;
1572 	adap->kthread_config = kthread_run(cec_config_thread_func, adap,
1573 					   "ceccfg-%s", adap->name);
1574 	if (IS_ERR(adap->kthread_config)) {
1575 		adap->kthread_config = NULL;
1576 		adap->is_configuring = false;
1577 	} else if (block) {
1578 		mutex_unlock(&adap->lock);
1579 		wait_for_completion(&adap->config_completion);
1580 		mutex_lock(&adap->lock);
1581 	}
1582 }
1583 
1584 /*
1585  * Helper function to enable/disable the CEC adapter.
1586  *
1587  * This function is called with adap->lock held.
1588  */
cec_adap_enable(struct cec_adapter * adap)1589 int cec_adap_enable(struct cec_adapter *adap)
1590 {
1591 	bool enable;
1592 	int ret = 0;
1593 
1594 	enable = adap->monitor_all_cnt || adap->monitor_pin_cnt ||
1595 		 adap->log_addrs.num_log_addrs;
1596 	if (adap->needs_hpd)
1597 		enable = enable && adap->phys_addr != CEC_PHYS_ADDR_INVALID;
1598 
1599 	if (adap->devnode.unregistered)
1600 		enable = false;
1601 
1602 	if (enable == adap->is_enabled)
1603 		return 0;
1604 
1605 	/* serialize adap_enable */
1606 	mutex_lock(&adap->devnode.lock);
1607 	if (enable) {
1608 		adap->last_initiator = 0xff;
1609 		adap->transmit_in_progress = false;
1610 		ret = adap->ops->adap_enable(adap, true);
1611 		if (!ret) {
1612 			/*
1613 			 * Enable monitor-all/pin modes if needed. We warn, but
1614 			 * continue if this fails as this is not a critical error.
1615 			 */
1616 			if (adap->monitor_all_cnt)
1617 				WARN_ON(call_op(adap, adap_monitor_all_enable, true));
1618 			if (adap->monitor_pin_cnt)
1619 				WARN_ON(call_op(adap, adap_monitor_pin_enable, true));
1620 		}
1621 	} else {
1622 		/* Disable monitor-all/pin modes if needed (needs_hpd == 1) */
1623 		if (adap->monitor_all_cnt)
1624 			WARN_ON(call_op(adap, adap_monitor_all_enable, false));
1625 		if (adap->monitor_pin_cnt)
1626 			WARN_ON(call_op(adap, adap_monitor_pin_enable, false));
1627 		WARN_ON(adap->ops->adap_enable(adap, false));
1628 		adap->last_initiator = 0xff;
1629 		adap->transmit_in_progress = false;
1630 		adap->transmit_in_progress_aborted = false;
1631 		if (adap->transmitting)
1632 			cec_data_cancel(adap->transmitting, CEC_TX_STATUS_ABORTED, 0);
1633 	}
1634 	if (!ret)
1635 		adap->is_enabled = enable;
1636 	wake_up_interruptible(&adap->kthread_waitq);
1637 	mutex_unlock(&adap->devnode.lock);
1638 	return ret;
1639 }
1640 
1641 /* Set a new physical address and send an event notifying userspace of this.
1642  *
1643  * This function is called with adap->lock held.
1644  */
__cec_s_phys_addr(struct cec_adapter * adap,u16 phys_addr,bool block)1645 void __cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)
1646 {
1647 	bool becomes_invalid = phys_addr == CEC_PHYS_ADDR_INVALID;
1648 	bool is_invalid = adap->phys_addr == CEC_PHYS_ADDR_INVALID;
1649 
1650 	if (phys_addr == adap->phys_addr)
1651 		return;
1652 	if (!becomes_invalid && adap->devnode.unregistered)
1653 		return;
1654 
1655 	dprintk(1, "new physical address %x.%x.%x.%x\n",
1656 		cec_phys_addr_exp(phys_addr));
1657 	if (becomes_invalid || !is_invalid) {
1658 		adap->phys_addr = CEC_PHYS_ADDR_INVALID;
1659 		cec_post_state_event(adap);
1660 		cec_adap_unconfigure(adap);
1661 		if (becomes_invalid) {
1662 			cec_adap_enable(adap);
1663 			return;
1664 		}
1665 	}
1666 
1667 	adap->phys_addr = phys_addr;
1668 	if (is_invalid)
1669 		cec_adap_enable(adap);
1670 
1671 	cec_post_state_event(adap);
1672 	if (!adap->log_addrs.num_log_addrs)
1673 		return;
1674 	if (adap->is_configuring)
1675 		adap->must_reconfigure = true;
1676 	else
1677 		cec_claim_log_addrs(adap, block);
1678 }
1679 
cec_s_phys_addr(struct cec_adapter * adap,u16 phys_addr,bool block)1680 void cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)
1681 {
1682 	if (IS_ERR_OR_NULL(adap))
1683 		return;
1684 
1685 	mutex_lock(&adap->lock);
1686 	__cec_s_phys_addr(adap, phys_addr, block);
1687 	mutex_unlock(&adap->lock);
1688 }
1689 EXPORT_SYMBOL_GPL(cec_s_phys_addr);
1690 
cec_s_phys_addr_from_edid(struct cec_adapter * adap,const struct edid * edid)1691 void cec_s_phys_addr_from_edid(struct cec_adapter *adap,
1692 			       const struct edid *edid)
1693 {
1694 	u16 pa = CEC_PHYS_ADDR_INVALID;
1695 
1696 	if (edid && edid->extensions)
1697 		pa = cec_get_edid_phys_addr((const u8 *)edid,
1698 				EDID_LENGTH * (edid->extensions + 1), NULL);
1699 	cec_s_phys_addr(adap, pa, false);
1700 }
1701 EXPORT_SYMBOL_GPL(cec_s_phys_addr_from_edid);
1702 
cec_s_conn_info(struct cec_adapter * adap,const struct cec_connector_info * conn_info)1703 void cec_s_conn_info(struct cec_adapter *adap,
1704 		     const struct cec_connector_info *conn_info)
1705 {
1706 	if (IS_ERR_OR_NULL(adap))
1707 		return;
1708 
1709 	if (!(adap->capabilities & CEC_CAP_CONNECTOR_INFO))
1710 		return;
1711 
1712 	mutex_lock(&adap->lock);
1713 	if (conn_info)
1714 		adap->conn_info = *conn_info;
1715 	else
1716 		memset(&adap->conn_info, 0, sizeof(adap->conn_info));
1717 	cec_post_state_event(adap);
1718 	mutex_unlock(&adap->lock);
1719 }
1720 EXPORT_SYMBOL_GPL(cec_s_conn_info);
1721 
1722 /*
1723  * Called from either the ioctl or a driver to set the logical addresses.
1724  *
1725  * This function is called with adap->lock held.
1726  */
__cec_s_log_addrs(struct cec_adapter * adap,struct cec_log_addrs * log_addrs,bool block)1727 int __cec_s_log_addrs(struct cec_adapter *adap,
1728 		      struct cec_log_addrs *log_addrs, bool block)
1729 {
1730 	u16 type_mask = 0;
1731 	int err;
1732 	int i;
1733 
1734 	if (adap->devnode.unregistered)
1735 		return -ENODEV;
1736 
1737 	if (!log_addrs || log_addrs->num_log_addrs == 0) {
1738 		if (!adap->log_addrs.num_log_addrs)
1739 			return 0;
1740 		if (adap->is_configuring || adap->is_configured)
1741 			cec_adap_unconfigure(adap);
1742 		adap->log_addrs.num_log_addrs = 0;
1743 		for (i = 0; i < CEC_MAX_LOG_ADDRS; i++)
1744 			adap->log_addrs.log_addr[i] = CEC_LOG_ADDR_INVALID;
1745 		adap->log_addrs.osd_name[0] = '\0';
1746 		adap->log_addrs.vendor_id = CEC_VENDOR_ID_NONE;
1747 		adap->log_addrs.cec_version = CEC_OP_CEC_VERSION_2_0;
1748 		cec_adap_enable(adap);
1749 		return 0;
1750 	}
1751 
1752 	if (log_addrs->flags & CEC_LOG_ADDRS_FL_CDC_ONLY) {
1753 		/*
1754 		 * Sanitize log_addrs fields if a CDC-Only device is
1755 		 * requested.
1756 		 */
1757 		log_addrs->num_log_addrs = 1;
1758 		log_addrs->osd_name[0] = '\0';
1759 		log_addrs->vendor_id = CEC_VENDOR_ID_NONE;
1760 		log_addrs->log_addr_type[0] = CEC_LOG_ADDR_TYPE_UNREGISTERED;
1761 		/*
1762 		 * This is just an internal convention since a CDC-Only device
1763 		 * doesn't have to be a switch. But switches already use
1764 		 * unregistered, so it makes some kind of sense to pick this
1765 		 * as the primary device. Since a CDC-Only device never sends
1766 		 * any 'normal' CEC messages this primary device type is never
1767 		 * sent over the CEC bus.
1768 		 */
1769 		log_addrs->primary_device_type[0] = CEC_OP_PRIM_DEVTYPE_SWITCH;
1770 		log_addrs->all_device_types[0] = 0;
1771 		log_addrs->features[0][0] = 0;
1772 		log_addrs->features[0][1] = 0;
1773 	}
1774 
1775 	/* Ensure the osd name is 0-terminated */
1776 	log_addrs->osd_name[sizeof(log_addrs->osd_name) - 1] = '\0';
1777 
1778 	/* Sanity checks */
1779 	if (log_addrs->num_log_addrs > adap->available_log_addrs) {
1780 		dprintk(1, "num_log_addrs > %d\n", adap->available_log_addrs);
1781 		return -EINVAL;
1782 	}
1783 
1784 	/*
1785 	 * Vendor ID is a 24 bit number, so check if the value is
1786 	 * within the correct range.
1787 	 */
1788 	if (log_addrs->vendor_id != CEC_VENDOR_ID_NONE &&
1789 	    (log_addrs->vendor_id & 0xff000000) != 0) {
1790 		dprintk(1, "invalid vendor ID\n");
1791 		return -EINVAL;
1792 	}
1793 
1794 	if (log_addrs->cec_version != CEC_OP_CEC_VERSION_1_4 &&
1795 	    log_addrs->cec_version != CEC_OP_CEC_VERSION_2_0) {
1796 		dprintk(1, "invalid CEC version\n");
1797 		return -EINVAL;
1798 	}
1799 
1800 	if (log_addrs->num_log_addrs > 1)
1801 		for (i = 0; i < log_addrs->num_log_addrs; i++)
1802 			if (log_addrs->log_addr_type[i] ==
1803 					CEC_LOG_ADDR_TYPE_UNREGISTERED) {
1804 				dprintk(1, "num_log_addrs > 1 can't be combined with unregistered LA\n");
1805 				return -EINVAL;
1806 			}
1807 
1808 	for (i = 0; i < log_addrs->num_log_addrs; i++) {
1809 		const u8 feature_sz = ARRAY_SIZE(log_addrs->features[0]);
1810 		u8 *features = log_addrs->features[i];
1811 		bool op_is_dev_features = false;
1812 		unsigned int j;
1813 
1814 		log_addrs->log_addr[i] = CEC_LOG_ADDR_INVALID;
1815 		if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) {
1816 			dprintk(1, "unknown logical address type\n");
1817 			return -EINVAL;
1818 		}
1819 		if (type_mask & (1 << log_addrs->log_addr_type[i])) {
1820 			dprintk(1, "duplicate logical address type\n");
1821 			return -EINVAL;
1822 		}
1823 		type_mask |= 1 << log_addrs->log_addr_type[i];
1824 		if ((type_mask & (1 << CEC_LOG_ADDR_TYPE_RECORD)) &&
1825 		    (type_mask & (1 << CEC_LOG_ADDR_TYPE_PLAYBACK))) {
1826 			/* Record already contains the playback functionality */
1827 			dprintk(1, "invalid record + playback combination\n");
1828 			return -EINVAL;
1829 		}
1830 		if (log_addrs->primary_device_type[i] >
1831 					CEC_OP_PRIM_DEVTYPE_PROCESSOR) {
1832 			dprintk(1, "unknown primary device type\n");
1833 			return -EINVAL;
1834 		}
1835 		if (log_addrs->primary_device_type[i] == 2) {
1836 			dprintk(1, "invalid primary device type\n");
1837 			return -EINVAL;
1838 		}
1839 		for (j = 0; j < feature_sz; j++) {
1840 			if ((features[j] & 0x80) == 0) {
1841 				if (op_is_dev_features)
1842 					break;
1843 				op_is_dev_features = true;
1844 			}
1845 		}
1846 		if (!op_is_dev_features || j == feature_sz) {
1847 			dprintk(1, "malformed features\n");
1848 			return -EINVAL;
1849 		}
1850 		/* Zero unused part of the feature array */
1851 		memset(features + j + 1, 0, feature_sz - j - 1);
1852 	}
1853 
1854 	if (log_addrs->cec_version >= CEC_OP_CEC_VERSION_2_0) {
1855 		if (log_addrs->num_log_addrs > 2) {
1856 			dprintk(1, "CEC 2.0 allows no more than 2 logical addresses\n");
1857 			return -EINVAL;
1858 		}
1859 		if (log_addrs->num_log_addrs == 2) {
1860 			if (!(type_mask & ((1 << CEC_LOG_ADDR_TYPE_AUDIOSYSTEM) |
1861 					   (1 << CEC_LOG_ADDR_TYPE_TV)))) {
1862 				dprintk(1, "two LAs is only allowed for audiosystem and TV\n");
1863 				return -EINVAL;
1864 			}
1865 			if (!(type_mask & ((1 << CEC_LOG_ADDR_TYPE_PLAYBACK) |
1866 					   (1 << CEC_LOG_ADDR_TYPE_RECORD)))) {
1867 				dprintk(1, "an audiosystem/TV can only be combined with record or playback\n");
1868 				return -EINVAL;
1869 			}
1870 		}
1871 	}
1872 
1873 	/* Zero unused LAs */
1874 	for (i = log_addrs->num_log_addrs; i < CEC_MAX_LOG_ADDRS; i++) {
1875 		log_addrs->primary_device_type[i] = 0;
1876 		log_addrs->log_addr_type[i] = 0;
1877 		log_addrs->all_device_types[i] = 0;
1878 		memset(log_addrs->features[i], 0,
1879 		       sizeof(log_addrs->features[i]));
1880 	}
1881 
1882 	log_addrs->log_addr_mask = adap->log_addrs.log_addr_mask;
1883 	adap->log_addrs = *log_addrs;
1884 	err = cec_adap_enable(adap);
1885 	if (!err && adap->phys_addr != CEC_PHYS_ADDR_INVALID)
1886 		cec_claim_log_addrs(adap, block);
1887 	return err;
1888 }
1889 
cec_s_log_addrs(struct cec_adapter * adap,struct cec_log_addrs * log_addrs,bool block)1890 int cec_s_log_addrs(struct cec_adapter *adap,
1891 		    struct cec_log_addrs *log_addrs, bool block)
1892 {
1893 	int err;
1894 
1895 	mutex_lock(&adap->lock);
1896 	err = __cec_s_log_addrs(adap, log_addrs, block);
1897 	mutex_unlock(&adap->lock);
1898 	return err;
1899 }
1900 EXPORT_SYMBOL_GPL(cec_s_log_addrs);
1901 
1902 /* High-level core CEC message handling */
1903 
1904 /* Fill in the Report Features message */
cec_fill_msg_report_features(struct cec_adapter * adap,struct cec_msg * msg,unsigned int la_idx)1905 static void cec_fill_msg_report_features(struct cec_adapter *adap,
1906 					 struct cec_msg *msg,
1907 					 unsigned int la_idx)
1908 {
1909 	const struct cec_log_addrs *las = &adap->log_addrs;
1910 	const u8 *features = las->features[la_idx];
1911 	bool op_is_dev_features = false;
1912 	unsigned int idx;
1913 
1914 	/* Report Features */
1915 	msg->msg[0] = (las->log_addr[la_idx] << 4) | 0x0f;
1916 	msg->len = 4;
1917 	msg->msg[1] = CEC_MSG_REPORT_FEATURES;
1918 	msg->msg[2] = adap->log_addrs.cec_version;
1919 	msg->msg[3] = las->all_device_types[la_idx];
1920 
1921 	/* Write RC Profiles first, then Device Features */
1922 	for (idx = 0; idx < ARRAY_SIZE(las->features[0]); idx++) {
1923 		msg->msg[msg->len++] = features[idx];
1924 		if ((features[idx] & CEC_OP_FEAT_EXT) == 0) {
1925 			if (op_is_dev_features)
1926 				break;
1927 			op_is_dev_features = true;
1928 		}
1929 	}
1930 }
1931 
1932 /* Transmit the Feature Abort message */
cec_feature_abort_reason(struct cec_adapter * adap,struct cec_msg * msg,u8 reason)1933 static int cec_feature_abort_reason(struct cec_adapter *adap,
1934 				    struct cec_msg *msg, u8 reason)
1935 {
1936 	struct cec_msg tx_msg = { };
1937 
1938 	/*
1939 	 * Don't reply with CEC_MSG_FEATURE_ABORT to a CEC_MSG_FEATURE_ABORT
1940 	 * message!
1941 	 */
1942 	if (msg->msg[1] == CEC_MSG_FEATURE_ABORT)
1943 		return 0;
1944 	/* Don't Feature Abort messages from 'Unregistered' */
1945 	if (cec_msg_initiator(msg) == CEC_LOG_ADDR_UNREGISTERED)
1946 		return 0;
1947 	cec_msg_set_reply_to(&tx_msg, msg);
1948 	cec_msg_feature_abort(&tx_msg, msg->msg[1], reason);
1949 	return cec_transmit_msg(adap, &tx_msg, false);
1950 }
1951 
cec_feature_abort(struct cec_adapter * adap,struct cec_msg * msg)1952 static int cec_feature_abort(struct cec_adapter *adap, struct cec_msg *msg)
1953 {
1954 	return cec_feature_abort_reason(adap, msg,
1955 					CEC_OP_ABORT_UNRECOGNIZED_OP);
1956 }
1957 
cec_feature_refused(struct cec_adapter * adap,struct cec_msg * msg)1958 static int cec_feature_refused(struct cec_adapter *adap, struct cec_msg *msg)
1959 {
1960 	return cec_feature_abort_reason(adap, msg,
1961 					CEC_OP_ABORT_REFUSED);
1962 }
1963 
1964 /*
1965  * Called when a CEC message is received. This function will do any
1966  * necessary core processing. The is_reply bool is true if this message
1967  * is a reply to an earlier transmit.
1968  *
1969  * The message is either a broadcast message or a valid directed message.
1970  */
cec_receive_notify(struct cec_adapter * adap,struct cec_msg * msg,bool is_reply)1971 static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
1972 			      bool is_reply)
1973 {
1974 	bool is_broadcast = cec_msg_is_broadcast(msg);
1975 	u8 dest_laddr = cec_msg_destination(msg);
1976 	u8 init_laddr = cec_msg_initiator(msg);
1977 	u8 devtype = cec_log_addr2dev(adap, dest_laddr);
1978 	int la_idx = cec_log_addr2idx(adap, dest_laddr);
1979 	bool from_unregistered = init_laddr == 0xf;
1980 	struct cec_msg tx_cec_msg = { };
1981 
1982 	dprintk(2, "%s: %*ph\n", __func__, msg->len, msg->msg);
1983 
1984 	/* If this is a CDC-Only device, then ignore any non-CDC messages */
1985 	if (cec_is_cdc_only(&adap->log_addrs) &&
1986 	    msg->msg[1] != CEC_MSG_CDC_MESSAGE)
1987 		return 0;
1988 
1989 	/* Allow drivers to process the message first */
1990 	if (adap->ops->received && !adap->devnode.unregistered &&
1991 	    adap->ops->received(adap, msg) != -ENOMSG)
1992 		return 0;
1993 
1994 	/*
1995 	 * REPORT_PHYSICAL_ADDR, CEC_MSG_USER_CONTROL_PRESSED and
1996 	 * CEC_MSG_USER_CONTROL_RELEASED messages always have to be
1997 	 * handled by the CEC core, even if the passthrough mode is on.
1998 	 * The others are just ignored if passthrough mode is on.
1999 	 */
2000 	switch (msg->msg[1]) {
2001 	case CEC_MSG_GET_CEC_VERSION:
2002 	case CEC_MSG_ABORT:
2003 	case CEC_MSG_GIVE_DEVICE_POWER_STATUS:
2004 	case CEC_MSG_GIVE_OSD_NAME:
2005 		/*
2006 		 * These messages reply with a directed message, so ignore if
2007 		 * the initiator is Unregistered.
2008 		 */
2009 		if (!adap->passthrough && from_unregistered)
2010 			return 0;
2011 		fallthrough;
2012 	case CEC_MSG_GIVE_DEVICE_VENDOR_ID:
2013 	case CEC_MSG_GIVE_FEATURES:
2014 	case CEC_MSG_GIVE_PHYSICAL_ADDR:
2015 		/*
2016 		 * Skip processing these messages if the passthrough mode
2017 		 * is on.
2018 		 */
2019 		if (adap->passthrough)
2020 			goto skip_processing;
2021 		/* Ignore if addressing is wrong */
2022 		if (is_broadcast)
2023 			return 0;
2024 		break;
2025 
2026 	case CEC_MSG_USER_CONTROL_PRESSED:
2027 	case CEC_MSG_USER_CONTROL_RELEASED:
2028 		/* Wrong addressing mode: don't process */
2029 		if (is_broadcast || from_unregistered)
2030 			goto skip_processing;
2031 		break;
2032 
2033 	case CEC_MSG_REPORT_PHYSICAL_ADDR:
2034 		/*
2035 		 * This message is always processed, regardless of the
2036 		 * passthrough setting.
2037 		 *
2038 		 * Exception: don't process if wrong addressing mode.
2039 		 */
2040 		if (!is_broadcast)
2041 			goto skip_processing;
2042 		break;
2043 
2044 	default:
2045 		break;
2046 	}
2047 
2048 	cec_msg_set_reply_to(&tx_cec_msg, msg);
2049 
2050 	switch (msg->msg[1]) {
2051 	/* The following messages are processed but still passed through */
2052 	case CEC_MSG_REPORT_PHYSICAL_ADDR: {
2053 		u16 pa = (msg->msg[2] << 8) | msg->msg[3];
2054 
2055 		dprintk(1, "reported physical address %x.%x.%x.%x for logical address %d\n",
2056 			cec_phys_addr_exp(pa), init_laddr);
2057 		break;
2058 	}
2059 
2060 	case CEC_MSG_USER_CONTROL_PRESSED:
2061 		if (!(adap->capabilities & CEC_CAP_RC) ||
2062 		    !(adap->log_addrs.flags & CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU))
2063 			break;
2064 
2065 #ifdef CONFIG_MEDIA_CEC_RC
2066 		switch (msg->msg[2]) {
2067 		/*
2068 		 * Play function, this message can have variable length
2069 		 * depending on the specific play function that is used.
2070 		 */
2071 		case CEC_OP_UI_CMD_PLAY_FUNCTION:
2072 			if (msg->len == 2)
2073 				rc_keydown(adap->rc, RC_PROTO_CEC,
2074 					   msg->msg[2], 0);
2075 			else
2076 				rc_keydown(adap->rc, RC_PROTO_CEC,
2077 					   msg->msg[2] << 8 | msg->msg[3], 0);
2078 			break;
2079 		/*
2080 		 * Other function messages that are not handled.
2081 		 * Currently the RC framework does not allow to supply an
2082 		 * additional parameter to a keypress. These "keys" contain
2083 		 * other information such as channel number, an input number
2084 		 * etc.
2085 		 * For the time being these messages are not processed by the
2086 		 * framework and are simply forwarded to the user space.
2087 		 */
2088 		case CEC_OP_UI_CMD_SELECT_BROADCAST_TYPE:
2089 		case CEC_OP_UI_CMD_SELECT_SOUND_PRESENTATION:
2090 		case CEC_OP_UI_CMD_TUNE_FUNCTION:
2091 		case CEC_OP_UI_CMD_SELECT_MEDIA_FUNCTION:
2092 		case CEC_OP_UI_CMD_SELECT_AV_INPUT_FUNCTION:
2093 		case CEC_OP_UI_CMD_SELECT_AUDIO_INPUT_FUNCTION:
2094 			break;
2095 		default:
2096 			rc_keydown(adap->rc, RC_PROTO_CEC, msg->msg[2], 0);
2097 			break;
2098 		}
2099 #endif
2100 		break;
2101 
2102 	case CEC_MSG_USER_CONTROL_RELEASED:
2103 		if (!(adap->capabilities & CEC_CAP_RC) ||
2104 		    !(adap->log_addrs.flags & CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU))
2105 			break;
2106 #ifdef CONFIG_MEDIA_CEC_RC
2107 		rc_keyup(adap->rc);
2108 #endif
2109 		break;
2110 
2111 	/*
2112 	 * The remaining messages are only processed if the passthrough mode
2113 	 * is off.
2114 	 */
2115 	case CEC_MSG_GET_CEC_VERSION:
2116 		cec_msg_cec_version(&tx_cec_msg, adap->log_addrs.cec_version);
2117 		return cec_transmit_msg(adap, &tx_cec_msg, false);
2118 
2119 	case CEC_MSG_GIVE_PHYSICAL_ADDR:
2120 		/* Do nothing for CEC switches using addr 15 */
2121 		if (devtype == CEC_OP_PRIM_DEVTYPE_SWITCH && dest_laddr == 15)
2122 			return 0;
2123 		cec_msg_report_physical_addr(&tx_cec_msg, adap->phys_addr, devtype);
2124 		return cec_transmit_msg(adap, &tx_cec_msg, false);
2125 
2126 	case CEC_MSG_GIVE_DEVICE_VENDOR_ID:
2127 		if (adap->log_addrs.vendor_id == CEC_VENDOR_ID_NONE)
2128 			return cec_feature_abort(adap, msg);
2129 		cec_msg_device_vendor_id(&tx_cec_msg, adap->log_addrs.vendor_id);
2130 		return cec_transmit_msg(adap, &tx_cec_msg, false);
2131 
2132 	case CEC_MSG_ABORT:
2133 		/* Do nothing for CEC switches */
2134 		if (devtype == CEC_OP_PRIM_DEVTYPE_SWITCH)
2135 			return 0;
2136 		return cec_feature_refused(adap, msg);
2137 
2138 	case CEC_MSG_GIVE_OSD_NAME: {
2139 		if (adap->log_addrs.osd_name[0] == 0)
2140 			return cec_feature_abort(adap, msg);
2141 		cec_msg_set_osd_name(&tx_cec_msg, adap->log_addrs.osd_name);
2142 		return cec_transmit_msg(adap, &tx_cec_msg, false);
2143 	}
2144 
2145 	case CEC_MSG_GIVE_FEATURES:
2146 		if (adap->log_addrs.cec_version < CEC_OP_CEC_VERSION_2_0)
2147 			return cec_feature_abort(adap, msg);
2148 		cec_fill_msg_report_features(adap, &tx_cec_msg, la_idx);
2149 		return cec_transmit_msg(adap, &tx_cec_msg, false);
2150 
2151 	default:
2152 		/*
2153 		 * Unprocessed messages are aborted if userspace isn't doing
2154 		 * any processing either.
2155 		 */
2156 		if (!is_broadcast && !is_reply && !adap->follower_cnt &&
2157 		    !adap->cec_follower && msg->msg[1] != CEC_MSG_FEATURE_ABORT)
2158 			return cec_feature_abort(adap, msg);
2159 		break;
2160 	}
2161 
2162 skip_processing:
2163 	/* If this was a reply, then we're done, unless otherwise specified */
2164 	if (is_reply && !(msg->flags & CEC_MSG_FL_REPLY_TO_FOLLOWERS))
2165 		return 0;
2166 
2167 	/*
2168 	 * Send to the exclusive follower if there is one, otherwise send
2169 	 * to all followers.
2170 	 */
2171 	if (adap->cec_follower)
2172 		cec_queue_msg_fh(adap->cec_follower, msg);
2173 	else
2174 		cec_queue_msg_followers(adap, msg);
2175 	return 0;
2176 }
2177 
2178 /*
2179  * Helper functions to keep track of the 'monitor all' use count.
2180  *
2181  * These functions are called with adap->lock held.
2182  */
cec_monitor_all_cnt_inc(struct cec_adapter * adap)2183 int cec_monitor_all_cnt_inc(struct cec_adapter *adap)
2184 {
2185 	int ret;
2186 
2187 	if (adap->monitor_all_cnt++)
2188 		return 0;
2189 
2190 	ret = cec_adap_enable(adap);
2191 	if (ret)
2192 		adap->monitor_all_cnt--;
2193 	return ret;
2194 }
2195 
cec_monitor_all_cnt_dec(struct cec_adapter * adap)2196 void cec_monitor_all_cnt_dec(struct cec_adapter *adap)
2197 {
2198 	if (WARN_ON(!adap->monitor_all_cnt))
2199 		return;
2200 	if (--adap->monitor_all_cnt)
2201 		return;
2202 	WARN_ON(call_op(adap, adap_monitor_all_enable, false));
2203 	cec_adap_enable(adap);
2204 }
2205 
2206 /*
2207  * Helper functions to keep track of the 'monitor pin' use count.
2208  *
2209  * These functions are called with adap->lock held.
2210  */
cec_monitor_pin_cnt_inc(struct cec_adapter * adap)2211 int cec_monitor_pin_cnt_inc(struct cec_adapter *adap)
2212 {
2213 	int ret;
2214 
2215 	if (adap->monitor_pin_cnt++)
2216 		return 0;
2217 
2218 	ret = cec_adap_enable(adap);
2219 	if (ret)
2220 		adap->monitor_pin_cnt--;
2221 	return ret;
2222 }
2223 
cec_monitor_pin_cnt_dec(struct cec_adapter * adap)2224 void cec_monitor_pin_cnt_dec(struct cec_adapter *adap)
2225 {
2226 	if (WARN_ON(!adap->monitor_pin_cnt))
2227 		return;
2228 	if (--adap->monitor_pin_cnt)
2229 		return;
2230 	WARN_ON(call_op(adap, adap_monitor_pin_enable, false));
2231 	cec_adap_enable(adap);
2232 }
2233 
2234 #ifdef CONFIG_DEBUG_FS
2235 /*
2236  * Log the current state of the CEC adapter.
2237  * Very useful for debugging.
2238  */
cec_adap_status(struct seq_file * file,void * priv)2239 int cec_adap_status(struct seq_file *file, void *priv)
2240 {
2241 	struct cec_adapter *adap = dev_get_drvdata(file->private);
2242 	struct cec_data *data;
2243 
2244 	mutex_lock(&adap->lock);
2245 	seq_printf(file, "enabled: %d\n", adap->is_enabled);
2246 	seq_printf(file, "configured: %d\n", adap->is_configured);
2247 	seq_printf(file, "configuring: %d\n", adap->is_configuring);
2248 	seq_printf(file, "phys_addr: %x.%x.%x.%x\n",
2249 		   cec_phys_addr_exp(adap->phys_addr));
2250 	seq_printf(file, "number of LAs: %d\n", adap->log_addrs.num_log_addrs);
2251 	seq_printf(file, "LA mask: 0x%04x\n", adap->log_addrs.log_addr_mask);
2252 	if (adap->cec_follower)
2253 		seq_printf(file, "has CEC follower%s\n",
2254 			   adap->passthrough ? " (in passthrough mode)" : "");
2255 	if (adap->cec_initiator)
2256 		seq_puts(file, "has CEC initiator\n");
2257 	if (adap->monitor_all_cnt)
2258 		seq_printf(file, "file handles in Monitor All mode: %u\n",
2259 			   adap->monitor_all_cnt);
2260 	if (adap->monitor_pin_cnt)
2261 		seq_printf(file, "file handles in Monitor Pin mode: %u\n",
2262 			   adap->monitor_pin_cnt);
2263 	if (adap->tx_timeouts) {
2264 		seq_printf(file, "transmit timeouts: %u\n",
2265 			   adap->tx_timeouts);
2266 		adap->tx_timeouts = 0;
2267 	}
2268 	data = adap->transmitting;
2269 	if (data)
2270 		seq_printf(file, "transmitting message: %*ph (reply: %02x, timeout: %ums)\n",
2271 			   data->msg.len, data->msg.msg, data->msg.reply,
2272 			   data->msg.timeout);
2273 	seq_printf(file, "pending transmits: %u\n", adap->transmit_queue_sz);
2274 	list_for_each_entry(data, &adap->transmit_queue, list) {
2275 		seq_printf(file, "queued tx message: %*ph (reply: %02x, timeout: %ums)\n",
2276 			   data->msg.len, data->msg.msg, data->msg.reply,
2277 			   data->msg.timeout);
2278 	}
2279 	list_for_each_entry(data, &adap->wait_queue, list) {
2280 		seq_printf(file, "message waiting for reply: %*ph (reply: %02x, timeout: %ums)\n",
2281 			   data->msg.len, data->msg.msg, data->msg.reply,
2282 			   data->msg.timeout);
2283 	}
2284 
2285 	call_void_op(adap, adap_status, file);
2286 	mutex_unlock(&adap->lock);
2287 	return 0;
2288 }
2289 #endif
2290