drivers/media/cec/cec-adap.c

   1 /*
   2  * cec-adap.c - HDMI Consumer Electronics Control framework - CEC adapter
   3  *
   4  * Copyright 2016 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
   5  *
   6  * This program is free software; you may redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; version 2 of the License.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  11  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  12  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  13  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  14  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  15  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  16  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  17  * SOFTWARE.
  18  */
  19
  20 #include <linux/errno.h>
  21 #include <linux/init.h>
  22 #include <linux/module.h>
  23 #include <linux/kernel.h>
  24 #include <linux/kmod.h>
  25 #include <linux/ktime.h>
  26 #include <linux/slab.h>
  27 #include <linux/mm.h>
  28 #include <linux/string.h>
  29 #include <linux/types.h>
  30
  31 #include "cec-priv.h"
  32
  33 static int cec_report_features(struct cec_adapter *adap, unsigned int la_idx);
  34 static int cec_report_phys_addr(struct cec_adapter *adap, unsigned int la_idx);
  35
  36 /*
  37  * 400 ms is the time it takes for one 16 byte message to be
  38  * transferred and 5 is the maximum number of retries. Add
  39  * another 100 ms as a margin. So if the transmit doesn't
  40  * finish before that time something is really wrong and we
  41  * have to time out.
  42  *
  43  * This is a sign that something it really wrong and a warning
  44  * will be issued.
  45  */
  46 #define CEC_XFER_TIMEOUT_MS (5 * 400 + 100)
  47
  48 #define call_op(adap, op, arg...) \
  49         (adap->ops->op ? adap->ops->op(adap, ## arg) : 0)
  50
  51 #define call_void_op(adap, op, arg...)                  \
  52         do {                                            \
  53                 if (adap->ops->op)                      \
  54                         adap->ops->op(adap, ## arg);    \
  55         } while (0)
  56
  57 static int cec_log_addr2idx(const struct cec_adapter *adap, u8 log_addr)
  58 {
  59         int i;
  60
  61         for (i = 0; i < adap->log_addrs.num_log_addrs; i++)
  62                 if (adap->log_addrs.log_addr[i] == log_addr)
  63                         return i;
  64         return -1;
  65 }
  66
  67 static unsigned int cec_log_addr2dev(const struct cec_adapter *adap, u8 log_addr)
  68 {
  69         int i = cec_log_addr2idx(adap, log_addr);
  70
  71         return adap->log_addrs.primary_device_type[i < 0 ? 0 : i];
  72 }
  73
  74 /*
  75  * Queue a new event for this filehandle. If ts == 0, then set it
  76  * to the current time.
  77  *
  78  * The two events that are currently defined do not need to keep track
  79  * of intermediate events, so no actual queue of events is needed,
  80  * instead just store the latest state and the total number of lost
  81  * messages.
  82  *
  83  * Should new events be added in the future that require intermediate
  84  * results to be queued as well, then a proper queue data structure is
  85  * required. But until then, just keep it simple.
  86  */
  87 void cec_queue_event_fh(struct cec_fh *fh,
  88                         const struct cec_event *new_ev, u64 ts)
  89 {
  90         struct cec_event *ev = &fh->events[new_ev->event - 1];
  91
  92         if (ts == 0)
  93                 ts = ktime_get_ns();
  94
  95         mutex_lock(&fh->lock);
  96         if (new_ev->event == CEC_EVENT_LOST_MSGS &&
  97             fh->pending_events & (1 << new_ev->event)) {
  98                 /*
  99                  * If there is already a lost_msgs event, then just
 100                  * update the lost_msgs count. This effectively
 101                  * merges the old and new events into one.
 102                  */
 103                 ev->lost_msgs.lost_msgs += new_ev->lost_msgs.lost_msgs;
 104                 goto unlock;
 105         }
 106
 107         /*
 108          * Intermediate states are not interesting, so just
 109          * overwrite any older event.
 110          */
 111         *ev = *new_ev;
 112         ev->ts = ts;
 113         fh->pending_events |= 1 << new_ev->event;
 114
 115 unlock:
 116         mutex_unlock(&fh->lock);
 117         wake_up_interruptible(&fh->wait);
 118 }
 119
 120 /* Queue a new event for all open filehandles. */
 121 static void cec_queue_event(struct cec_adapter *adap,
 122                             const struct cec_event *ev)
 123 {
 124         u64 ts = ktime_get_ns();
 125         struct cec_fh *fh;
 126
 127         mutex_lock(&adap->devnode.lock);
 128         list_for_each_entry(fh, &adap->devnode.fhs, list)
 129                 cec_queue_event_fh(fh, ev, ts);
 130         mutex_unlock(&adap->devnode.lock);
 131 }
 132
 133 /*
 134  * Queue a new message for this filehandle. If there is no more room
 135  * in the queue, then send the LOST_MSGS event instead.
 136  */
 137 static void cec_queue_msg_fh(struct cec_fh *fh, const struct cec_msg *msg)
 138 {
 139         static const struct cec_event ev_lost_msg = {
 140                 .ts = 0,
 141                 .event = CEC_EVENT_LOST_MSGS,
 142                 .flags = 0,
 143                 {
 144                         .lost_msgs.lost_msgs = 1,
 145                 },
 146         };
 147         struct cec_msg_entry *entry;
 148
 149         mutex_lock(&fh->lock);
 150         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
 151         if (!entry)
 152                 goto lost_msgs;
 153
 154         entry->msg = *msg;
 155         /* Add new msg at the end of the queue */
 156         list_add_tail(&entry->list, &fh->msgs);
 157
 158         /*
 159          * if the queue now has more than CEC_MAX_MSG_RX_QUEUE_SZ
 160          * messages, drop the oldest one and send a lost message event.
 161          */
 162         if (fh->queued_msgs == CEC_MAX_MSG_RX_QUEUE_SZ) {
 163                 list_del(&entry->list);
 164                 goto lost_msgs;
 165         }
 166         fh->queued_msgs++;
 167         mutex_unlock(&fh->lock);
 168         wake_up_interruptible(&fh->wait);
 169         return;
 170
 171 lost_msgs:
 172         mutex_unlock(&fh->lock);
 173         cec_queue_event_fh(fh, &ev_lost_msg, 0);
 174 }
 175
 176 /*
 177  * Queue the message for those filehandles that are in monitor mode.
 178  * If valid_la is true (this message is for us or was sent by us),
 179  * then pass it on to any monitoring filehandle. If this message
 180  * isn't for us or from us, then only give it to filehandles that
 181  * are in MONITOR_ALL mode.
 182  *
 183  * This can only happen if the CEC_CAP_MONITOR_ALL capability is
 184  * set and the CEC adapter was placed in 'monitor all' mode.
 185  */
 186 static void cec_queue_msg_monitor(struct cec_adapter *adap,
 187                                   const struct cec_msg *msg,
 188                                   bool valid_la)
 189 {
 190         struct cec_fh *fh;
 191         u32 monitor_mode = valid_la ? CEC_MODE_MONITOR :
 192                                       CEC_MODE_MONITOR_ALL;
 193
 194         mutex_lock(&adap->devnode.lock);
 195         list_for_each_entry(fh, &adap->devnode.fhs, list) {
 196                 if (fh->mode_follower >= monitor_mode)
 197                         cec_queue_msg_fh(fh, msg);
 198         }
 199         mutex_unlock(&adap->devnode.lock);
 200 }
 201
 202 /*
 203  * Queue the message for follower filehandles.
 204  */
 205 static void cec_queue_msg_followers(struct cec_adapter *adap,
 206                                     const struct cec_msg *msg)
 207 {
 208         struct cec_fh *fh;
 209
 210         mutex_lock(&adap->devnode.lock);
 211         list_for_each_entry(fh, &adap->devnode.fhs, list) {
 212                 if (fh->mode_follower == CEC_MODE_FOLLOWER)
 213                         cec_queue_msg_fh(fh, msg);
 214         }
 215         mutex_unlock(&adap->devnode.lock);
 216 }
 217
 218 /* Notify userspace of an adapter state change. */
 219 static void cec_post_state_event(struct cec_adapter *adap)
 220 {
 221         struct cec_event ev = {
 222                 .event = CEC_EVENT_STATE_CHANGE,
 223         };
 224
 225         ev.state_change.phys_addr = adap->phys_addr;
 226         ev.state_change.log_addr_mask = adap->log_addrs.log_addr_mask;
 227         cec_queue_event(adap, &ev);
 228 }
 229
 230 /*
 231  * A CEC transmit (and a possible wait for reply) completed.
 232  * If this was in blocking mode, then complete it, otherwise
 233  * queue the message for userspace to dequeue later.
 234  *
 235  * This function is called with adap->lock held.
 236  */
 237 static void cec_data_completed(struct cec_data *data)
 238 {
 239         /*
 240          * Delete this transmit from the filehandle's xfer_list since
 241          * we're done with it.
 242          *
 243          * Note that if the filehandle is closed before this transmit
 244          * finished, then the release() function will set data->fh to NULL.
 245          * Without that we would be referring to a closed filehandle.
 246          */
 247         if (data->fh)
 248                 list_del(&data->xfer_list);
 249
 250         if (data->blocking) {
 251                 /*
 252                  * Someone is blocking so mark the message as completed
 253                  * and call complete.
 254                  */
 255                 data->completed = true;
 256                 complete(&data->c);
 257         } else {
 258                 /*
 259                  * No blocking, so just queue the message if needed and
 260                  * free the memory.
 261                  */
 262                 if (data->fh)
 263                         cec_queue_msg_fh(data->fh, &data->msg);
 264                 kfree(data);
 265         }
 266 }
 267
 268 /*
 269  * A pending CEC transmit needs to be cancelled, either because the CEC
 270  * adapter is disabled or the transmit takes an impossibly long time to
 271  * finish.
 272  *
 273  * This function is called with adap->lock held.
 274  */
 275 static void cec_data_cancel(struct cec_data *data)
 276 {
 277         /*
 278          * It's either the current transmit, or it is a pending
 279          * transmit. Take the appropriate action to clear it.
 280          */
 281         if (data->adap->transmitting == data) {
 282                 data->adap->transmitting = NULL;
 283         } else {
 284                 list_del_init(&data->list);
 285                 if (!(data->msg.tx_status & CEC_TX_STATUS_OK))
 286                         data->adap->transmit_queue_sz--;
 287         }
 288
 289         /* Mark it as an error */
 290         data->msg.tx_ts = ktime_get_ns();
 291         data->msg.tx_status = CEC_TX_STATUS_ERROR |
 292                               CEC_TX_STATUS_MAX_RETRIES;
 293         data->attempts = 0;
 294         data->msg.tx_error_cnt = 1;
 295         /* Queue transmitted message for monitoring purposes */
 296         cec_queue_msg_monitor(data->adap, &data->msg, 1);
 297
 298         cec_data_completed(data);
 299 }
 300
 301 /*
 302  * Main CEC state machine
 303  *
 304  * Wait until the thread should be stopped, or we are not transmitting and
 305  * a new transmit message is queued up, in which case we start transmitting
 306  * that message. When the adapter finished transmitting the message it will
 307  * call cec_transmit_done().
 308  *
 309  * If the adapter is disabled, then remove all queued messages instead.
 310  *
 311  * If the current transmit times out, then cancel that transmit.
 312  */
 313 int cec_thread_func(void *_adap)
 314 {
 315         struct cec_adapter *adap = _adap;
 316
 317         for (;;) {
 318                 unsigned int signal_free_time;
 319                 struct cec_data *data;
 320                 bool timeout = false;
 321                 u8 attempts;
 322
 323                 if (adap->transmitting) {
 324                         int err;
 325
 326                         /*
 327                          * We are transmitting a message, so add a timeout
 328                          * to prevent the state machine to get stuck waiting
 329                          * for this message to finalize and add a check to
 330                          * see if the adapter is disabled in which case the
 331                          * transmit should be canceled.
 332                          */
 333                         err = wait_event_interruptible_timeout(adap->kthread_waitq,
 334                                 kthread_should_stop() ||
 335                                 (!adap->is_configured && !adap->is_configuring) ||
 336                                 (!adap->transmitting &&
 337                                  !list_empty(&adap->transmit_queue)),
 338                                 msecs_to_jiffies(CEC_XFER_TIMEOUT_MS));
 339                         timeout = err == 0;
 340                 } else {
 341                         /* Otherwise we just wait for something to happen. */
 342                         wait_event_interruptible(adap->kthread_waitq,
 343                                 kthread_should_stop() ||
 344                                 (!adap->transmitting &&
 345                                  !list_empty(&adap->transmit_queue)));
 346                 }
 347
 348                 mutex_lock(&adap->lock);
 349
 350                 if ((!adap->is_configured && !adap->is_configuring) ||
 351                     kthread_should_stop()) {
 352                         /*
 353                          * If the adapter is disabled, or we're asked to stop,
 354                          * then cancel any pending transmits.
 355                          */
 356                         while (!list_empty(&adap->transmit_queue)) {
 357                                 data = list_first_entry(&adap->transmit_queue,
 358                                                         struct cec_data, list);
 359                                 cec_data_cancel(data);
 360                         }
 361                         if (adap->transmitting)
 362                                 cec_data_cancel(adap->transmitting);
 363
 364                         /*
 365                          * Cancel the pending timeout work. We have to unlock
 366                          * the mutex when flushing the work since
 367                          * cec_wait_timeout() will take it. This is OK since
 368                          * no new entries can be added to wait_queue as long
 369                          * as adap->transmitting is NULL, which it is due to
 370                          * the cec_data_cancel() above.
 371                          */
 372                         while (!list_empty(&adap->wait_queue)) {
 373                                 data = list_first_entry(&adap->wait_queue,
 374                                                         struct cec_data, list);
 375
 376                                 if (!cancel_delayed_work(&data->work)) {
 377                                         mutex_unlock(&adap->lock);
 378                                         flush_scheduled_work();
 379                                         mutex_lock(&adap->lock);
 380                                 }
 381                                 cec_data_cancel(data);
 382                         }
 383                         goto unlock;
 384                 }
 385
 386                 if (adap->transmitting && timeout) {
 387                         /*
 388                          * If we timeout, then log that. This really shouldn't
 389                          * happen and is an indication of a faulty CEC adapter
 390                          * driver, or the CEC bus is in some weird state.
 391                          */
 392                         dprintk(0, "message %*ph timed out!\n",
 393                                 adap->transmitting->msg.len,
 394                                 adap->transmitting->msg.msg);
 395                         /* Just give up on this. */
 396                         cec_data_cancel(adap->transmitting);
 397                         goto unlock;
 398                 }
 399
 400                 /*
 401                  * If we are still transmitting, or there is nothing new to
 402                  * transmit, then just continue waiting.
 403                  */
 404                 if (adap->transmitting || list_empty(&adap->transmit_queue))
 405                         goto unlock;
 406
 407                 /* Get a new message to transmit */
 408                 data = list_first_entry(&adap->transmit_queue,
 409                                         struct cec_data, list);
 410                 list_del_init(&data->list);
 411                 adap->transmit_queue_sz--;
 412                 /* Make this the current transmitting message */
 413                 adap->transmitting = data;
 414
 415                 /*
 416                  * Suggested number of attempts as per the CEC 2.0 spec:
 417                  * 4 attempts is the default, except for 'secondary poll
 418                  * messages', i.e. poll messages not sent during the adapter
 419                  * configuration phase when it allocates logical addresses.
 420                  */
 421                 if (data->msg.len == 1 && adap->is_configured)
 422                         attempts = 2;
 423                 else
 424                         attempts = 4;
 425
 426                 /* Set the suggested signal free time */
 427                 if (data->attempts) {
 428                         /* should be >= 3 data bit periods for a retry */
 429                         signal_free_time = CEC_SIGNAL_FREE_TIME_RETRY;
 430                 } else if (data->new_initiator) {
 431                         /* should be >= 5 data bit periods for new initiator */
 432                         signal_free_time = CEC_SIGNAL_FREE_TIME_NEW_INITIATOR;
 433                 } else {
 434                         /*
 435                          * should be >= 7 data bit periods for sending another
 436                          * frame immediately after another.
 437                          */
 438                         signal_free_time = CEC_SIGNAL_FREE_TIME_NEXT_XFER;
 439                 }
 440                 if (data->attempts == 0)
 441                         data->attempts = attempts;
 442
 443                 /* Tell the adapter to transmit, cancel on error */
 444                 if (adap->ops->adap_transmit(adap, data->attempts,
 445                                              signal_free_time, &data->msg))
 446                         cec_data_cancel(data);
 447
 448 unlock:
 449                 mutex_unlock(&adap->lock);
 450
 451                 if (kthread_should_stop())
 452                         break;
 453         }
 454         return 0;
 455 }
 456
 457 /*
 458  * Called by the CEC adapter if a transmit finished.
 459  */
 460 void cec_transmit_done(struct cec_adapter *adap, u8 status, u8 arb_lost_cnt,
 461                        u8 nack_cnt, u8 low_drive_cnt, u8 error_cnt)
 462 {
 463         struct cec_data *data;
 464         struct cec_msg *msg;
 465         u64 ts = ktime_get_ns();
 466
 467         dprintk(2, "cec_transmit_done %02x\n", status);
 468         mutex_lock(&adap->lock);
 469         data = adap->transmitting;
 470         if (!data) {
 471                 /*
 472                  * This can happen if a transmit was issued and the cable is
 473                  * unplugged while the transmit is ongoing. Ignore this
 474                  * transmit in that case.
 475                  */
 476                 dprintk(1, "cec_transmit_done without an ongoing transmit!\n");
 477                 goto unlock;
 478         }
 479
 480         msg = &data->msg;
 481
 482         /* Drivers must fill in the status! */
 483         WARN_ON(status == 0);
 484         msg->tx_ts = ts;
 485         msg->tx_status |= status;
 486         msg->tx_arb_lost_cnt += arb_lost_cnt;
 487         msg->tx_nack_cnt += nack_cnt;
 488         msg->tx_low_drive_cnt += low_drive_cnt;
 489         msg->tx_error_cnt += error_cnt;
 490
 491         /* Mark that we're done with this transmit */
 492         adap->transmitting = NULL;
 493
 494         /*
 495          * If there are still retry attempts left and there was an error and
 496          * the hardware didn't signal that it retried itself (by setting
 497          * CEC_TX_STATUS_MAX_RETRIES), then we will retry ourselves.
 498          */
 499         if (data->attempts > 1 &&
 500             !(status & (CEC_TX_STATUS_MAX_RETRIES | CEC_TX_STATUS_OK))) {
 501                 /* Retry this message */
 502                 data->attempts--;
 503                 /* Add the message in front of the transmit queue */
 504                 list_add(&data->list, &adap->transmit_queue);
 505                 adap->transmit_queue_sz++;
 506                 goto wake_thread;
 507         }
 508
 509         data->attempts = 0;
 510
 511         /* Always set CEC_TX_STATUS_MAX_RETRIES on error */
 512         if (!(status & CEC_TX_STATUS_OK))
 513                 msg->tx_status |= CEC_TX_STATUS_MAX_RETRIES;
 514
 515         /* Queue transmitted message for monitoring purposes */
 516         cec_queue_msg_monitor(adap, msg, 1);
 517
 518         if ((status & CEC_TX_STATUS_OK) && adap->is_configured &&
 519             msg->timeout) {
 520                 /*
 521                  * Queue the message into the wait queue if we want to wait
 522                  * for a reply.
 523                  */
 524                 list_add_tail(&data->list, &adap->wait_queue);
 525                 schedule_delayed_work(&data->work,
 526                                       msecs_to_jiffies(msg->timeout));
 527         } else {
 528                 /* Otherwise we're done */
 529                 cec_data_completed(data);
 530         }
 531
 532 wake_thread:
 533         /*
 534          * Wake up the main thread to see if another message is ready
 535          * for transmitting or to retry the current message.
 536          */
 537         wake_up_interruptible(&adap->kthread_waitq);
 538 unlock:
 539         mutex_unlock(&adap->lock);
 540 }
 541 EXPORT_SYMBOL_GPL(cec_transmit_done);
 542
 543 /*
 544  * Called when waiting for a reply times out.
 545  */
 546 static void cec_wait_timeout(struct work_struct *work)
 547 {
 548         struct cec_data *data = container_of(work, struct cec_data, work.work);
 549         struct cec_adapter *adap = data->adap;
 550
 551         mutex_lock(&adap->lock);
 552         /*
 553          * Sanity check in case the timeout and the arrival of the message
 554          * happened at the same time.
 555          */
 556         if (list_empty(&data->list))
 557                 goto unlock;
 558
 559         /* Mark the message as timed out */
 560         list_del_init(&data->list);
 561         data->msg.rx_ts = ktime_get_ns();
 562         data->msg.rx_status = CEC_RX_STATUS_TIMEOUT;
 563         cec_data_completed(data);
 564 unlock:
 565         mutex_unlock(&adap->lock);
 566 }
 567
 568 /*
 569  * Transmit a message. The fh argument may be NULL if the transmit is not
 570  * associated with a specific filehandle.
 571  *
 572  * This function is called with adap->lock held.
 573  */
 574 int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
 575                         struct cec_fh *fh, bool block)
 576 {
 577         struct cec_data *data;
 578         u8 last_initiator = 0xff;
 579         unsigned int timeout;
 580         int res = 0;
 581
 582         msg->rx_ts = 0;
 583         msg->tx_ts = 0;
 584         msg->rx_status = 0;
 585         msg->tx_status = 0;
 586         msg->tx_arb_lost_cnt = 0;
 587         msg->tx_nack_cnt = 0;
 588         msg->tx_low_drive_cnt = 0;
 589         msg->tx_error_cnt = 0;
 590         msg->sequence = ++adap->sequence;
 591         if (!msg->sequence)
 592                 msg->sequence = ++adap->sequence;
 593
 594         if (msg->reply && msg->timeout == 0) {
 595                 /* Make sure the timeout isn't 0. */
 596                 msg->timeout = 1000;
 597         }
 598         if (msg->timeout)
 599                 msg->flags &= CEC_MSG_FL_REPLY_TO_FOLLOWERS;
 600         else
 601                 msg->flags = 0;
 602
 603         /* Sanity checks */
 604         if (msg->len == 0 || msg->len > CEC_MAX_MSG_SIZE) {
 605                 dprintk(1, "cec_transmit_msg: invalid length %d\n", msg->len);
 606                 return -EINVAL;
 607         }
 608         if (msg->timeout && msg->len == 1) {
 609                 dprintk(1, "cec_transmit_msg: can't reply for poll msg\n");
 610                 return -EINVAL;
 611         }
 612         memset(msg->msg + msg->len, 0, sizeof(msg->msg) - msg->len);
 613         if (msg->len == 1) {
 614                 if (cec_msg_initiator(msg) != 0xf ||
 615                     cec_msg_destination(msg) == 0xf) {
 616                         dprintk(1, "cec_transmit_msg: invalid poll message\n");
 617                         return -EINVAL;
 618                 }
 619                 if (cec_has_log_addr(adap, cec_msg_destination(msg))) {
 620                         /*
 621                          * If the destination is a logical address our adapter
 622                          * has already claimed, then just NACK this.
 623                          * It depends on the hardware what it will do with a
 624                          * POLL to itself (some OK this), so it is just as
 625                          * easy to handle it here so the behavior will be
 626                          * consistent.
 627                          */
 628                         msg->tx_ts = ktime_get_ns();
 629                         msg->tx_status = CEC_TX_STATUS_NACK |
 630                                          CEC_TX_STATUS_MAX_RETRIES;
 631                         msg->tx_nack_cnt = 1;
 632                         return 0;
 633                 }
 634         }
 635         if (msg->len > 1 && !cec_msg_is_broadcast(msg) &&
 636             cec_has_log_addr(adap, cec_msg_destination(msg))) {
 637                 dprintk(1, "cec_transmit_msg: destination is the adapter itself\n");
 638                 return -EINVAL;
 639         }
 640         if (cec_msg_initiator(msg) != 0xf &&
 641             !cec_has_log_addr(adap, cec_msg_initiator(msg))) {
 642                 dprintk(1, "cec_transmit_msg: initiator has unknown logical address %d\n",
 643                         cec_msg_initiator(msg));
 644                 return -EINVAL;
 645         }
 646         if (!adap->is_configured && !adap->is_configuring)
 647                 return -ENONET;
 648
 649         if (adap->transmit_queue_sz >= CEC_MAX_MSG_TX_QUEUE_SZ)
 650                 return -EBUSY;
 651
 652         data = kzalloc(sizeof(*data), GFP_KERNEL);
 653         if (!data)
 654                 return -ENOMEM;
 655
 656         if (msg->len > 1 && msg->msg[1] == CEC_MSG_CDC_MESSAGE) {
 657                 msg->msg[2] = adap->phys_addr >> 8;
 658                 msg->msg[3] = adap->phys_addr & 0xff;
 659         }
 660
 661         if (msg->timeout)
 662                 dprintk(2, "cec_transmit_msg: %*ph (wait for 0x%02x%s)\n",
 663                         msg->len, msg->msg, msg->reply, !block ? ", nb" : "");
 664         else
 665                 dprintk(2, "cec_transmit_msg: %*ph%s\n",
 666                         msg->len, msg->msg, !block ? " (nb)" : "");
 667
 668         data->msg = *msg;
 669         data->fh = fh;
 670         data->adap = adap;
 671         data->blocking = block;
 672
 673         /*
 674          * Determine if this message follows a message from the same
 675          * initiator. Needed to determine the free signal time later on.
 676          */
 677         if (msg->len > 1) {
 678                 if (!(list_empty(&adap->transmit_queue))) {
 679                         const struct cec_data *last;
 680
 681                         last = list_last_entry(&adap->transmit_queue,
 682                                                const struct cec_data, list);
 683                         last_initiator = cec_msg_initiator(&last->msg);
 684                 } else if (adap->transmitting) {
 685                         last_initiator =
 686                                 cec_msg_initiator(&adap->transmitting->msg);
 687                 }
 688         }
 689         data->new_initiator = last_initiator != cec_msg_initiator(msg);
 690         init_completion(&data->c);
 691         INIT_DELAYED_WORK(&data->work, cec_wait_timeout);
 692
 693         if (fh)
 694                 list_add_tail(&data->xfer_list, &fh->xfer_list);
 695         list_add_tail(&data->list, &adap->transmit_queue);
 696         adap->transmit_queue_sz++;
 697         if (!adap->transmitting)
 698                 wake_up_interruptible(&adap->kthread_waitq);
 699
 700         /* All done if we don't need to block waiting for completion */
 701         if (!block)
 702                 return 0;
 703
 704         /*
 705          * If we don't get a completion before this time something is really
 706          * wrong and we time out.
 707          */
 708         timeout = CEC_XFER_TIMEOUT_MS;
 709         /* Add the requested timeout if we have to wait for a reply as well */
 710         if (msg->timeout)
 711                 timeout += msg->timeout;
 712
 713         /*
 714          * Release the lock and wait, retake the lock afterwards.
 715          */
 716         mutex_unlock(&adap->lock);
 717         res = wait_for_completion_killable_timeout(&data->c,
 718                                                    msecs_to_jiffies(timeout));
 719         mutex_lock(&adap->lock);
 720
 721         if (data->completed) {
 722                 /* The transmit completed (possibly with an error) */
 723                 *msg = data->msg;
 724                 kfree(data);
 725                 return 0;
 726         }
 727         /*
 728          * The wait for completion timed out or was interrupted, so mark this
 729          * as non-blocking and disconnect from the filehandle since it is
 730          * still 'in flight'. When it finally completes it will just drop the
 731          * result silently.
 732          */
 733         data->blocking = false;
 734         if (data->fh)
 735                 list_del(&data->xfer_list);
 736         data->fh = NULL;
 737
 738         if (res == 0) { /* timed out */
 739                 /* Check if the reply or the transmit failed */
 740                 if (msg->timeout && (msg->tx_status & CEC_TX_STATUS_OK))
 741                         msg->rx_status = CEC_RX_STATUS_TIMEOUT;
 742                 else
 743                         msg->tx_status = CEC_TX_STATUS_MAX_RETRIES;
 744         }
 745         return res > 0 ? 0 : res;
 746 }
 747
 748 /* Helper function to be used by drivers and this framework. */
 749 int cec_transmit_msg(struct cec_adapter *adap, struct cec_msg *msg,
 750                      bool block)
 751 {
 752         int ret;
 753
 754         mutex_lock(&adap->lock);
 755         ret = cec_transmit_msg_fh(adap, msg, NULL, block);
 756         mutex_unlock(&adap->lock);
 757         return ret;
 758 }
 759 EXPORT_SYMBOL_GPL(cec_transmit_msg);
 760
 761 /*
 762  * I don't like forward references but without this the low-level
 763  * cec_received_msg() function would come after a bunch of high-level
 764  * CEC protocol handling functions. That was very confusing.
 765  */
 766 static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
 767                               bool is_reply);
 768
 769 #define DIRECTED        0x80
 770 #define BCAST1_4        0x40
 771 #define BCAST2_0        0x20    /* broadcast only allowed for >= 2.0 */
 772 #define BCAST           (BCAST1_4 | BCAST2_0)
 773 #define BOTH            (BCAST | DIRECTED)
 774
 775 /*
 776  * Specify minimum length and whether the message is directed, broadcast
 777  * or both. Messages that do not match the criteria are ignored as per
 778  * the CEC specification.
 779  */
 780 static const u8 cec_msg_size[256] = {
 781         [CEC_MSG_ACTIVE_SOURCE] = 4 | BCAST,
 782         [CEC_MSG_IMAGE_VIEW_ON] = 2 | DIRECTED,
 783         [CEC_MSG_TEXT_VIEW_ON] = 2 | DIRECTED,
 784         [CEC_MSG_INACTIVE_SOURCE] = 4 | DIRECTED,
 785         [CEC_MSG_REQUEST_ACTIVE_SOURCE] = 2 | BCAST,
 786         [CEC_MSG_ROUTING_CHANGE] = 6 | BCAST,
 787         [CEC_MSG_ROUTING_INFORMATION] = 4 | BCAST,
 788         [CEC_MSG_SET_STREAM_PATH] = 4 | BCAST,
 789         [CEC_MSG_STANDBY] = 2 | BOTH,
 790         [CEC_MSG_RECORD_OFF] = 2 | DIRECTED,
 791         [CEC_MSG_RECORD_ON] = 3 | DIRECTED,
 792         [CEC_MSG_RECORD_STATUS] = 3 | DIRECTED,
 793         [CEC_MSG_RECORD_TV_SCREEN] = 2 | DIRECTED,
 794         [CEC_MSG_CLEAR_ANALOGUE_TIMER] = 13 | DIRECTED,
 795         [CEC_MSG_CLEAR_DIGITAL_TIMER] = 16 | DIRECTED,
 796         [CEC_MSG_CLEAR_EXT_TIMER] = 13 | DIRECTED,
 797         [CEC_MSG_SET_ANALOGUE_TIMER] = 13 | DIRECTED,
 798         [CEC_MSG_SET_DIGITAL_TIMER] = 16 | DIRECTED,
 799         [CEC_MSG_SET_EXT_TIMER] = 13 | DIRECTED,
 800         [CEC_MSG_SET_TIMER_PROGRAM_TITLE] = 2 | DIRECTED,
 801         [CEC_MSG_TIMER_CLEARED_STATUS] = 3 | DIRECTED,
 802         [CEC_MSG_TIMER_STATUS] = 3 | DIRECTED,
 803         [CEC_MSG_CEC_VERSION] = 3 | DIRECTED,
 804         [CEC_MSG_GET_CEC_VERSION] = 2 | DIRECTED,
 805         [CEC_MSG_GIVE_PHYSICAL_ADDR] = 2 | DIRECTED,
 806         [CEC_MSG_GET_MENU_LANGUAGE] = 2 | DIRECTED,
 807         [CEC_MSG_REPORT_PHYSICAL_ADDR] = 5 | BCAST,
 808         [CEC_MSG_SET_MENU_LANGUAGE] = 5 | BCAST,
 809         [CEC_MSG_REPORT_FEATURES] = 6 | BCAST,
 810         [CEC_MSG_GIVE_FEATURES] = 2 | DIRECTED,
 811         [CEC_MSG_DECK_CONTROL] = 3 | DIRECTED,
 812         [CEC_MSG_DECK_STATUS] = 3 | DIRECTED,
 813         [CEC_MSG_GIVE_DECK_STATUS] = 3 | DIRECTED,
 814         [CEC_MSG_PLAY] = 3 | DIRECTED,
 815         [CEC_MSG_GIVE_TUNER_DEVICE_STATUS] = 3 | DIRECTED,
 816         [CEC_MSG_SELECT_ANALOGUE_SERVICE] = 6 | DIRECTED,
 817         [CEC_MSG_SELECT_DIGITAL_SERVICE] = 9 | DIRECTED,
 818         [CEC_MSG_TUNER_DEVICE_STATUS] = 7 | DIRECTED,
 819         [CEC_MSG_TUNER_STEP_DECREMENT] = 2 | DIRECTED,
 820         [CEC_MSG_TUNER_STEP_INCREMENT] = 2 | DIRECTED,
 821         [CEC_MSG_DEVICE_VENDOR_ID] = 5 | BCAST,
 822         [CEC_MSG_GIVE_DEVICE_VENDOR_ID] = 2 | DIRECTED,
 823         [CEC_MSG_VENDOR_COMMAND] = 2 | DIRECTED,
 824         [CEC_MSG_VENDOR_COMMAND_WITH_ID] = 5 | BOTH,
 825         [CEC_MSG_VENDOR_REMOTE_BUTTON_DOWN] = 2 | BOTH,
 826         [CEC_MSG_VENDOR_REMOTE_BUTTON_UP] = 2 | BOTH,
 827         [CEC_MSG_SET_OSD_STRING] = 3 | DIRECTED,
 828         [CEC_MSG_GIVE_OSD_NAME] = 2 | DIRECTED,
 829         [CEC_MSG_SET_OSD_NAME] = 2 | DIRECTED,
 830         [CEC_MSG_MENU_REQUEST] = 3 | DIRECTED,
 831         [CEC_MSG_MENU_STATUS] = 3 | DIRECTED,
 832         [CEC_MSG_USER_CONTROL_PRESSED] = 3 | DIRECTED,
 833         [CEC_MSG_USER_CONTROL_RELEASED] = 2 | DIRECTED,
 834         [CEC_MSG_GIVE_DEVICE_POWER_STATUS] = 2 | DIRECTED,
 835         [CEC_MSG_REPORT_POWER_STATUS] = 3 | DIRECTED | BCAST2_0,
 836         [CEC_MSG_FEATURE_ABORT] = 4 | DIRECTED,
 837         [CEC_MSG_ABORT] = 2 | DIRECTED,
 838         [CEC_MSG_GIVE_AUDIO_STATUS] = 2 | DIRECTED,
 839         [CEC_MSG_GIVE_SYSTEM_AUDIO_MODE_STATUS] = 2 | DIRECTED,
 840         [CEC_MSG_REPORT_AUDIO_STATUS] = 3 | DIRECTED,
 841         [CEC_MSG_REPORT_SHORT_AUDIO_DESCRIPTOR] = 2 | DIRECTED,
 842         [CEC_MSG_REQUEST_SHORT_AUDIO_DESCRIPTOR] = 2 | DIRECTED,
 843         [CEC_MSG_SET_SYSTEM_AUDIO_MODE] = 3 | BOTH,
 844         [CEC_MSG_SYSTEM_AUDIO_MODE_REQUEST] = 2 | DIRECTED,
 845         [CEC_MSG_SYSTEM_AUDIO_MODE_STATUS] = 3 | DIRECTED,
 846         [CEC_MSG_SET_AUDIO_RATE] = 3 | DIRECTED,
 847         [CEC_MSG_INITIATE_ARC] = 2 | DIRECTED,
 848         [CEC_MSG_REPORT_ARC_INITIATED] = 2 | DIRECTED,
 849         [CEC_MSG_REPORT_ARC_TERMINATED] = 2 | DIRECTED,
 850         [CEC_MSG_REQUEST_ARC_INITIATION] = 2 | DIRECTED,
 851         [CEC_MSG_REQUEST_ARC_TERMINATION] = 2 | DIRECTED,
 852         [CEC_MSG_TERMINATE_ARC] = 2 | DIRECTED,
 853         [CEC_MSG_REQUEST_CURRENT_LATENCY] = 4 | BCAST,
 854         [CEC_MSG_REPORT_CURRENT_LATENCY] = 7 | BCAST,
 855         [CEC_MSG_CDC_MESSAGE] = 2 | BCAST,
 856 };
 857
 858 /* Called by the CEC adapter if a message is received */
 859 void cec_received_msg(struct cec_adapter *adap, struct cec_msg *msg)
 860 {
 861         struct cec_data *data;
 862         u8 msg_init = cec_msg_initiator(msg);
 863         u8 msg_dest = cec_msg_destination(msg);
 864         u8 cmd = msg->msg[1];
 865         bool is_reply = false;
 866         bool valid_la = true;
 867         u8 min_len = 0;
 868
 869         if (WARN_ON(!msg->len || msg->len > CEC_MAX_MSG_SIZE))
 870                 return;
 871
 872         /*
 873          * Some CEC adapters will receive the messages that they transmitted.
 874          * This test filters out those messages by checking if we are the
 875          * initiator, and just returning in that case.
 876          *
 877          * Note that this won't work if this is an Unregistered device.
 878          *
 879          * It is bad practice if the hardware receives the message that it
 880          * transmitted and luckily most CEC adapters behave correctly in this
 881          * respect.
 882          */
 883         if (msg_init != CEC_LOG_ADDR_UNREGISTERED &&
 884             cec_has_log_addr(adap, msg_init))
 885                 return;
 886
 887         msg->rx_ts = ktime_get_ns();
 888         msg->rx_status = CEC_RX_STATUS_OK;
 889         msg->sequence = msg->reply = msg->timeout = 0;
 890         msg->tx_status = 0;
 891         msg->tx_ts = 0;
 892         msg->tx_arb_lost_cnt = 0;
 893         msg->tx_nack_cnt = 0;
 894         msg->tx_low_drive_cnt = 0;
 895         msg->tx_error_cnt = 0;
 896         msg->flags = 0;
 897         memset(msg->msg + msg->len, 0, sizeof(msg->msg) - msg->len);
 898
 899         mutex_lock(&adap->lock);
 900         dprintk(2, "cec_received_msg: %*ph\n", msg->len, msg->msg);
 901
 902         /* Check if this message was for us (directed or broadcast). */
 903         if (!cec_msg_is_broadcast(msg))
 904                 valid_la = cec_has_log_addr(adap, msg_dest);
 905
 906         /*
 907          * Check if the length is not too short or if the message is a
 908          * broadcast message where a directed message was expected or
 909          * vice versa. If so, then the message has to be ignored (according
 910          * to section CEC 7.3 and CEC 12.2).
 911          */
 912         if (valid_la && msg->len > 1 && cec_msg_size[cmd]) {
 913                 u8 dir_fl = cec_msg_size[cmd] & BOTH;
 914
 915                 min_len = cec_msg_size[cmd] & 0x1f;
 916                 if (msg->len < min_len)
 917                         valid_la = false;
 918                 else if (!cec_msg_is_broadcast(msg) && !(dir_fl & DIRECTED))
 919                         valid_la = false;
 920                 else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST1_4))
 921                         valid_la = false;
 922                 else if (cec_msg_is_broadcast(msg) &&
 923                          adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0 &&
 924                          !(dir_fl & BCAST2_0))
 925                         valid_la = false;
 926         }
 927         if (valid_la && min_len) {
 928                 /* These messages have special length requirements */
 929                 switch (cmd) {
 930                 case CEC_MSG_TIMER_STATUS:
 931                         if (msg->msg[2] & 0x10) {
 932                                 switch (msg->msg[2] & 0xf) {
 933                                 case CEC_OP_PROG_INFO_NOT_ENOUGH_SPACE:
 934                                 case CEC_OP_PROG_INFO_MIGHT_NOT_BE_ENOUGH_SPACE:
 935                                         if (msg->len < 5)
 936                                                 valid_la = false;
 937                                         break;
 938                                 }
 939                         } else if ((msg->msg[2] & 0xf) == CEC_OP_PROG_ERROR_DUPLICATE) {
 940                                 if (msg->len < 5)
 941                                         valid_la = false;
 942                         }
 943                         break;
 944                 case CEC_MSG_RECORD_ON:
 945                         switch (msg->msg[2]) {
 946                         case CEC_OP_RECORD_SRC_OWN:
 947                                 break;
 948                         case CEC_OP_RECORD_SRC_DIGITAL:
 949                                 if (msg->len < 10)
 950                                         valid_la = false;
 951                                 break;
 952                         case CEC_OP_RECORD_SRC_ANALOG:
 953                                 if (msg->len < 7)
 954                                         valid_la = false;
 955                                 break;
 956                         case CEC_OP_RECORD_SRC_EXT_PLUG:
 957                                 if (msg->len < 4)
 958                                         valid_la = false;
 959                                 break;
 960                         case CEC_OP_RECORD_SRC_EXT_PHYS_ADDR:
 961                                 if (msg->len < 5)
 962                                         valid_la = false;
 963                                 break;
 964                         }
 965                         break;
 966                 }
 967         }
 968
 969         /* It's a valid message and not a poll or CDC message */
 970         if (valid_la && msg->len > 1 && cmd != CEC_MSG_CDC_MESSAGE) {
 971                 bool abort = cmd == CEC_MSG_FEATURE_ABORT;
 972
 973                 /* The aborted command is in msg[2] */
 974                 if (abort)
 975                         cmd = msg->msg[2];
 976
 977                 /*
 978                  * Walk over all transmitted messages that are waiting for a
 979                  * reply.
 980                  */
 981                 list_for_each_entry(data, &adap->wait_queue, list) {
 982                         struct cec_msg *dst = &data->msg;
 983
 984                         /*
 985                          * The *only* CEC message that has two possible replies
 986                          * is CEC_MSG_INITIATE_ARC.
 987                          * In this case allow either of the two replies.
 988                          */
 989                         if (!abort && dst->msg[1] == CEC_MSG_INITIATE_ARC &&
 990                             (cmd == CEC_MSG_REPORT_ARC_INITIATED ||
 991                              cmd == CEC_MSG_REPORT_ARC_TERMINATED) &&
 992                             (dst->reply == CEC_MSG_REPORT_ARC_INITIATED ||
 993                              dst->reply == CEC_MSG_REPORT_ARC_TERMINATED))
 994                                 dst->reply = cmd;
 995
 996                         /* Does the command match? */
 997                         if ((abort && cmd != dst->msg[1]) ||
 998                             (!abort && cmd != dst->reply))
 999                                 continue;
1000
1001                         /* Does the addressing match? */
1002                         if (msg_init != cec_msg_destination(dst) &&
1003                             !cec_msg_is_broadcast(dst))
1004                                 continue;
1005
1006                         /* We got a reply */
1007                         memcpy(dst->msg, msg->msg, msg->len);
1008                         dst->len = msg->len;
1009                         dst->rx_ts = msg->rx_ts;
1010                         dst->rx_status = msg->rx_status;
1011                         if (abort)
1012                                 dst->rx_status |= CEC_RX_STATUS_FEATURE_ABORT;
1013                         msg->flags = dst->flags;
1014                         /* Remove it from the wait_queue */
1015                         list_del_init(&data->list);
1016
1017                         /* Cancel the pending timeout work */
1018                         if (!cancel_delayed_work(&data->work)) {
1019                                 mutex_unlock(&adap->lock);
1020                                 flush_scheduled_work();
1021                                 mutex_lock(&adap->lock);
1022                         }
1023                         /*
1024                          * Mark this as a reply, provided someone is still
1025                          * waiting for the answer.
1026                          */
1027                         if (data->fh)
1028                                 is_reply = true;
1029                         cec_data_completed(data);
1030                         break;
1031                 }
1032         }
1033         mutex_unlock(&adap->lock);
1034
1035         /* Pass the message on to any monitoring filehandles */
1036         cec_queue_msg_monitor(adap, msg, valid_la);
1037
1038         /* We're done if it is not for us or a poll message */
1039         if (!valid_la || msg->len <= 1)
1040                 return;
1041
1042         if (adap->log_addrs.log_addr_mask == 0)
1043                 return;
1044
1045         /*
1046          * Process the message on the protocol level. If is_reply is true,
1047          * then cec_receive_notify() won't pass on the reply to the listener(s)
1048          * since that was already done by cec_data_completed() above.
1049          */
1050         cec_receive_notify(adap, msg, is_reply);
1051 }
1052 EXPORT_SYMBOL_GPL(cec_received_msg);
1053
1054 /* Logical Address Handling */
1055
1056 /*
1057  * Attempt to claim a specific logical address.
1058  *
1059  * This function is called with adap->lock held.
1060  */
1061 static int cec_config_log_addr(struct cec_adapter *adap,
1062                                unsigned int idx,
1063                                unsigned int log_addr)
1064 {
1065         struct cec_log_addrs *las = &adap->log_addrs;
1066         struct cec_msg msg = { };
1067         int err;
1068
1069         if (cec_has_log_addr(adap, log_addr))
1070                 return 0;
1071
1072         /* Send poll message */
1073         msg.len = 1;
1074         msg.msg[0] = 0xf0 | log_addr;
1075         err = cec_transmit_msg_fh(adap, &msg, NULL, true);
1076
1077         /*
1078          * While trying to poll the physical address was reset
1079          * and the adapter was unconfigured, so bail out.
1080          */
1081         if (!adap->is_configuring)
1082                 return -EINTR;
1083
1084         if (err)
1085                 return err;
1086
1087         if (msg.tx_status & CEC_TX_STATUS_OK)
1088                 return 0;
1089
1090         /*
1091          * Message not acknowledged, so this logical
1092          * address is free to use.
1093          */
1094         err = adap->ops->adap_log_addr(adap, log_addr);
1095         if (err)
1096                 return err;
1097
1098         las->log_addr[idx] = log_addr;
1099         las->log_addr_mask |= 1 << log_addr;
1100         adap->phys_addrs[log_addr] = adap->phys_addr;
1101
1102         dprintk(2, "claimed addr %d (%d)\n", log_addr,
1103                 las->primary_device_type[idx]);
1104         return 1;
1105 }
1106
1107 /*
1108  * Unconfigure the adapter: clear all logical addresses and send
1109  * the state changed event.
1110  *
1111  * This function is called with adap->lock held.
1112  */
1113 static void cec_adap_unconfigure(struct cec_adapter *adap)
1114 {
1115         WARN_ON(adap->ops->adap_log_addr(adap, CEC_LOG_ADDR_INVALID));
1116         adap->log_addrs.log_addr_mask = 0;
1117         adap->is_configuring = false;
1118         adap->is_configured = false;
1119         memset(adap->phys_addrs, 0xff, sizeof(adap->phys_addrs));
1120         wake_up_interruptible(&adap->kthread_waitq);
1121         cec_post_state_event(adap);
1122 }
1123
1124 /*
1125  * Attempt to claim the required logical addresses.
1126  */
1127 static int cec_config_thread_func(void *arg)
1128 {
1129         /* The various LAs for each type of device */
1130         static const u8 tv_log_addrs[] = {
1131                 CEC_LOG_ADDR_TV, CEC_LOG_ADDR_SPECIFIC,
1132                 CEC_LOG_ADDR_INVALID
1133         };
1134         static const u8 record_log_addrs[] = {
1135                 CEC_LOG_ADDR_RECORD_1, CEC_LOG_ADDR_RECORD_2,
1136                 CEC_LOG_ADDR_RECORD_3,
1137                 CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1138                 CEC_LOG_ADDR_INVALID
1139         };
1140         static const u8 tuner_log_addrs[] = {
1141                 CEC_LOG_ADDR_TUNER_1, CEC_LOG_ADDR_TUNER_2,
1142                 CEC_LOG_ADDR_TUNER_3, CEC_LOG_ADDR_TUNER_4,
1143                 CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1144                 CEC_LOG_ADDR_INVALID
1145         };
1146         static const u8 playback_log_addrs[] = {
1147                 CEC_LOG_ADDR_PLAYBACK_1, CEC_LOG_ADDR_PLAYBACK_2,
1148                 CEC_LOG_ADDR_PLAYBACK_3,
1149                 CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1150                 CEC_LOG_ADDR_INVALID
1151         };
1152         static const u8 audiosystem_log_addrs[] = {
1153                 CEC_LOG_ADDR_AUDIOSYSTEM,
1154                 CEC_LOG_ADDR_INVALID
1155         };
1156         static const u8 specific_use_log_addrs[] = {
1157                 CEC_LOG_ADDR_SPECIFIC,
1158                 CEC_LOG_ADDR_BACKUP_1, CEC_LOG_ADDR_BACKUP_2,
1159                 CEC_LOG_ADDR_INVALID
1160         };
1161         static const u8 *type2addrs[6] = {
1162                 [CEC_LOG_ADDR_TYPE_TV] = tv_log_addrs,
1163                 [CEC_LOG_ADDR_TYPE_RECORD] = record_log_addrs,
1164                 [CEC_LOG_ADDR_TYPE_TUNER] = tuner_log_addrs,
1165                 [CEC_LOG_ADDR_TYPE_PLAYBACK] = playback_log_addrs,
1166                 [CEC_LOG_ADDR_TYPE_AUDIOSYSTEM] = audiosystem_log_addrs,
1167                 [CEC_LOG_ADDR_TYPE_SPECIFIC] = specific_use_log_addrs,
1168         };
1169         static const u16 type2mask[] = {
1170                 [CEC_LOG_ADDR_TYPE_TV] = CEC_LOG_ADDR_MASK_TV,
1171                 [CEC_LOG_ADDR_TYPE_RECORD] = CEC_LOG_ADDR_MASK_RECORD,
1172                 [CEC_LOG_ADDR_TYPE_TUNER] = CEC_LOG_ADDR_MASK_TUNER,
1173                 [CEC_LOG_ADDR_TYPE_PLAYBACK] = CEC_LOG_ADDR_MASK_PLAYBACK,
1174                 [CEC_LOG_ADDR_TYPE_AUDIOSYSTEM] = CEC_LOG_ADDR_MASK_AUDIOSYSTEM,
1175                 [CEC_LOG_ADDR_TYPE_SPECIFIC] = CEC_LOG_ADDR_MASK_SPECIFIC,
1176         };
1177         struct cec_adapter *adap = arg;
1178         struct cec_log_addrs *las = &adap->log_addrs;
1179         int err;
1180         int i, j;
1181
1182         mutex_lock(&adap->lock);
1183         dprintk(1, "physical address: %x.%x.%x.%x, claim %d logical addresses\n",
1184                 cec_phys_addr_exp(adap->phys_addr), las->num_log_addrs);
1185         las->log_addr_mask = 0;
1186
1187         if (las->log_addr_type[0] == CEC_LOG_ADDR_TYPE_UNREGISTERED)
1188                 goto configured;
1189
1190         for (i = 0; i < las->num_log_addrs; i++) {
1191                 unsigned int type = las->log_addr_type[i];
1192                 const u8 *la_list;
1193                 u8 last_la;
1194
1195                 /*
1196                  * The TV functionality can only map to physical address 0.
1197                  * For any other address, try the Specific functionality
1198                  * instead as per the spec.
1199                  */
1200                 if (adap->phys_addr && type == CEC_LOG_ADDR_TYPE_TV)
1201                         type = CEC_LOG_ADDR_TYPE_SPECIFIC;
1202
1203                 la_list = type2addrs[type];
1204                 last_la = las->log_addr[i];
1205                 las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1206                 if (last_la == CEC_LOG_ADDR_INVALID ||
1207                     last_la == CEC_LOG_ADDR_UNREGISTERED ||
1208                     !(last_la & type2mask[type]))
1209                         last_la = la_list[0];
1210
1211                 err = cec_config_log_addr(adap, i, last_la);
1212                 if (err > 0) /* Reused last LA */
1213                         continue;
1214
1215                 if (err < 0)
1216                         goto unconfigure;
1217
1218                 for (j = 0; la_list[j] != CEC_LOG_ADDR_INVALID; j++) {
1219                         /* Tried this one already, skip it */
1220                         if (la_list[j] == last_la)
1221                                 continue;
1222                         /* The backup addresses are CEC 2.0 specific */
1223                         if ((la_list[j] == CEC_LOG_ADDR_BACKUP_1 ||
1224                              la_list[j] == CEC_LOG_ADDR_BACKUP_2) &&
1225                             las->cec_version < CEC_OP_CEC_VERSION_2_0)
1226                                 continue;
1227
1228                         err = cec_config_log_addr(adap, i, la_list[j]);
1229                         if (err == 0) /* LA is in use */
1230                                 continue;
1231                         if (err < 0)
1232                                 goto unconfigure;
1233                         /* Done, claimed an LA */
1234                         break;
1235                 }
1236
1237                 if (la_list[j] == CEC_LOG_ADDR_INVALID)
1238                         dprintk(1, "could not claim LA %d\n", i);
1239         }
1240
1241         if (adap->log_addrs.log_addr_mask == 0 &&
1242             !(las->flags & CEC_LOG_ADDRS_FL_ALLOW_UNREG_FALLBACK))
1243                 goto unconfigure;
1244
1245 configured:
1246         if (adap->log_addrs.log_addr_mask == 0) {
1247                 /* Fall back to unregistered */
1248                 las->log_addr[0] = CEC_LOG_ADDR_UNREGISTERED;
1249                 las->log_addr_mask = 1 << las->log_addr[0];
1250                 for (i = 1; i < las->num_log_addrs; i++)
1251                         las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1252         }
1253         adap->is_configured = true;
1254         adap->is_configuring = false;
1255         cec_post_state_event(adap);
1256         mutex_unlock(&adap->lock);
1257
1258         for (i = 0; i < las->num_log_addrs; i++) {
1259                 if (las->log_addr[i] == CEC_LOG_ADDR_INVALID ||
1260                     (las->flags & CEC_LOG_ADDRS_FL_CDC_ONLY))
1261                         continue;
1262
1263                 /*
1264                  * Report Features must come first according
1265                  * to CEC 2.0
1266                  */
1267                 if (las->log_addr[i] != CEC_LOG_ADDR_UNREGISTERED)
1268                         cec_report_features(adap, i);
1269                 cec_report_phys_addr(adap, i);
1270         }
1271         for (i = las->num_log_addrs; i < CEC_MAX_LOG_ADDRS; i++)
1272                 las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1273         mutex_lock(&adap->lock);
1274         adap->kthread_config = NULL;
1275         mutex_unlock(&adap->lock);
1276         complete(&adap->config_completion);
1277         return 0;
1278
1279 unconfigure:
1280         for (i = 0; i < las->num_log_addrs; i++)
1281                 las->log_addr[i] = CEC_LOG_ADDR_INVALID;
1282         cec_adap_unconfigure(adap);
1283         adap->kthread_config = NULL;
1284         mutex_unlock(&adap->lock);
1285         complete(&adap->config_completion);
1286         return 0;
1287 }
1288
1289 /*
1290  * Called from either __cec_s_phys_addr or __cec_s_log_addrs to claim the
1291  * logical addresses.
1292  *
1293  * This function is called with adap->lock held.
1294  */
1295 static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
1296 {
1297         if (WARN_ON(adap->is_configuring || adap->is_configured))
1298                 return;
1299
1300         init_completion(&adap->config_completion);
1301
1302         /* Ready to kick off the thread */
1303         adap->is_configuring = true;
1304         adap->kthread_config = kthread_run(cec_config_thread_func, adap,
1305                                            "ceccfg-%s", adap->name);
1306         if (IS_ERR(adap->kthread_config)) {
1307                 adap->kthread_config = NULL;
1308         } else if (block) {
1309                 mutex_unlock(&adap->lock);
1310                 wait_for_completion(&adap->config_completion);
1311                 mutex_lock(&adap->lock);
1312         }
1313 }
1314
1315 /* Set a new physical address and send an event notifying userspace of this.
1316  *
1317  * This function is called with adap->lock held.
1318  */
1319 void __cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)
1320 {
1321         if (phys_addr == adap->phys_addr || adap->devnode.unregistered)
1322                 return;
1323
1324         if (phys_addr == CEC_PHYS_ADDR_INVALID ||
1325             adap->phys_addr != CEC_PHYS_ADDR_INVALID) {
1326                 adap->phys_addr = CEC_PHYS_ADDR_INVALID;
1327                 cec_post_state_event(adap);
1328                 cec_adap_unconfigure(adap);
1329                 /* Disabling monitor all mode should always succeed */
1330                 if (adap->monitor_all_cnt)
1331                         WARN_ON(call_op(adap, adap_monitor_all_enable, false));
1332                 WARN_ON(adap->ops->adap_enable(adap, false));
1333                 if (phys_addr == CEC_PHYS_ADDR_INVALID)
1334                         return;
1335         }
1336
1337         if (adap->ops->adap_enable(adap, true))
1338                 return;
1339
1340         if (adap->monitor_all_cnt &&
1341             call_op(adap, adap_monitor_all_enable, true)) {
1342                 WARN_ON(adap->ops->adap_enable(adap, false));
1343                 return;
1344         }
1345         adap->phys_addr = phys_addr;
1346         cec_post_state_event(adap);
1347         if (adap->log_addrs.num_log_addrs)
1348                 cec_claim_log_addrs(adap, block);
1349 }
1350
1351 void cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)
1352 {
1353         if (IS_ERR_OR_NULL(adap))
1354                 return;
1355
1356         mutex_lock(&adap->lock);
1357         __cec_s_phys_addr(adap, phys_addr, block);
1358         mutex_unlock(&adap->lock);
1359 }
1360 EXPORT_SYMBOL_GPL(cec_s_phys_addr);
1361
1362 /*
1363  * Called from either the ioctl or a driver to set the logical addresses.
1364  *
1365  * This function is called with adap->lock held.
1366  */
1367 int __cec_s_log_addrs(struct cec_adapter *adap,
1368                       struct cec_log_addrs *log_addrs, bool block)
1369 {
1370         u16 type_mask = 0;
1371         int i;
1372
1373         if (adap->devnode.unregistered)
1374                 return -ENODEV;
1375
1376         if (!log_addrs || log_addrs->num_log_addrs == 0) {
1377                 adap->log_addrs.num_log_addrs = 0;
1378                 cec_adap_unconfigure(adap);
1379                 return 0;
1380         }
1381
1382         if (log_addrs->flags & CEC_LOG_ADDRS_FL_CDC_ONLY) {
1383                 /*
1384                  * Sanitize log_addrs fields if a CDC-Only device is
1385                  * requested.
1386                  */
1387                 log_addrs->num_log_addrs = 1;
1388                 log_addrs->osd_name[0] = '\0';
1389                 log_addrs->vendor_id = CEC_VENDOR_ID_NONE;
1390                 log_addrs->log_addr_type[0] = CEC_LOG_ADDR_TYPE_UNREGISTERED;
1391                 /*
1392                  * This is just an internal convention since a CDC-Only device
1393                  * doesn't have to be a switch. But switches already use
1394                  * unregistered, so it makes some kind of sense to pick this
1395                  * as the primary device. Since a CDC-Only device never sends
1396                  * any 'normal' CEC messages this primary device type is never
1397                  * sent over the CEC bus.
1398                  */
1399                 log_addrs->primary_device_type[0] = CEC_OP_PRIM_DEVTYPE_SWITCH;
1400                 log_addrs->all_device_types[0] = 0;
1401                 log_addrs->features[0][0] = 0;
1402                 log_addrs->features[0][1] = 0;
1403         }
1404
1405         /* Ensure the osd name is 0-terminated */
1406         log_addrs->osd_name[sizeof(log_addrs->osd_name) - 1] = '\0';
1407
1408         /* Sanity checks */
1409         if (log_addrs->num_log_addrs > adap->available_log_addrs) {
1410                 dprintk(1, "num_log_addrs > %d\n", adap->available_log_addrs);
1411                 return -EINVAL;
1412         }
1413
1414         /*
1415          * Vendor ID is a 24 bit number, so check if the value is
1416          * within the correct range.
1417          */
1418         if (log_addrs->vendor_id != CEC_VENDOR_ID_NONE &&
1419             (log_addrs->vendor_id & 0xff000000) != 0)
1420                 return -EINVAL;
1421
1422         if (log_addrs->cec_version != CEC_OP_CEC_VERSION_1_4 &&
1423             log_addrs->cec_version != CEC_OP_CEC_VERSION_2_0)
1424                 return -EINVAL;
1425
1426         if (log_addrs->num_log_addrs > 1)
1427                 for (i = 0; i < log_addrs->num_log_addrs; i++)
1428                         if (log_addrs->log_addr_type[i] ==
1429                                         CEC_LOG_ADDR_TYPE_UNREGISTERED) {
1430                                 dprintk(1, "num_log_addrs > 1 can't be combined with unregistered LA\n");
1431                                 return -EINVAL;
1432                         }
1433
1434         for (i = 0; i < log_addrs->num_log_addrs; i++) {
1435                 const u8 feature_sz = ARRAY_SIZE(log_addrs->features[0]);
1436                 u8 *features = log_addrs->features[i];
1437                 bool op_is_dev_features = false;
1438                 unsigned j;
1439
1440                 log_addrs->log_addr[i] = CEC_LOG_ADDR_INVALID;
1441                 if (type_mask & (1 << log_addrs->log_addr_type[i])) {
1442                         dprintk(1, "duplicate logical address type\n");
1443                         return -EINVAL;
1444                 }
1445                 type_mask |= 1 << log_addrs->log_addr_type[i];
1446                 if ((type_mask & (1 << CEC_LOG_ADDR_TYPE_RECORD)) &&
1447                     (type_mask & (1 << CEC_LOG_ADDR_TYPE_PLAYBACK))) {
1448                         /* Record already contains the playback functionality */
1449                         dprintk(1, "invalid record + playback combination\n");
1450                         return -EINVAL;
1451                 }
1452                 if (log_addrs->primary_device_type[i] >
1453                                         CEC_OP_PRIM_DEVTYPE_PROCESSOR) {
1454                         dprintk(1, "unknown primary device type\n");
1455                         return -EINVAL;
1456                 }
1457                 if (log_addrs->primary_device_type[i] == 2) {
1458                         dprintk(1, "invalid primary device type\n");
1459                         return -EINVAL;
1460                 }
1461                 if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) {
1462                         dprintk(1, "unknown logical address type\n");
1463                         return -EINVAL;
1464                 }
1465                 for (j = 0; j < feature_sz; j++) {
1466                         if ((features[j] & 0x80) == 0) {
1467                                 if (op_is_dev_features)
1468                                         break;
1469                                 op_is_dev_features = true;
1470                         }
1471                 }
1472                 if (!op_is_dev_features || j == feature_sz) {
1473                         dprintk(1, "malformed features\n");
1474                         return -EINVAL;
1475                 }
1476                 /* Zero unused part of the feature array */
1477                 memset(features + j + 1, 0, feature_sz - j - 1);
1478         }
1479
1480         if (log_addrs->cec_version >= CEC_OP_CEC_VERSION_2_0) {
1481                 if (log_addrs->num_log_addrs > 2) {
1482                         dprintk(1, "CEC 2.0 allows no more than 2 logical addresses\n");
1483                         return -EINVAL;
1484                 }
1485                 if (log_addrs->num_log_addrs == 2) {
1486                         if (!(type_mask & ((1 << CEC_LOG_ADDR_TYPE_AUDIOSYSTEM) |
1487                                            (1 << CEC_LOG_ADDR_TYPE_TV)))) {
1488                                 dprintk(1, "Two LAs is only allowed for audiosystem and TV\n");
1489                                 return -EINVAL;
1490                         }
1491                         if (!(type_mask & ((1 << CEC_LOG_ADDR_TYPE_PLAYBACK) |
1492                                            (1 << CEC_LOG_ADDR_TYPE_RECORD)))) {
1493                                 dprintk(1, "An audiosystem/TV can only be combined with record or playback\n");
1494                                 return -EINVAL;
1495                         }
1496                 }
1497         }
1498
1499         /* Zero unused LAs */
1500         for (i = log_addrs->num_log_addrs; i < CEC_MAX_LOG_ADDRS; i++) {
1501                 log_addrs->primary_device_type[i] = 0;
1502                 log_addrs->log_addr_type[i] = 0;
1503                 log_addrs->all_device_types[i] = 0;
1504                 memset(log_addrs->features[i], 0,
1505                        sizeof(log_addrs->features[i]));
1506         }
1507
1508         log_addrs->log_addr_mask = adap->log_addrs.log_addr_mask;
1509         adap->log_addrs = *log_addrs;
1510         if (adap->phys_addr != CEC_PHYS_ADDR_INVALID)
1511                 cec_claim_log_addrs(adap, block);
1512         return 0;
1513 }
1514
1515 int cec_s_log_addrs(struct cec_adapter *adap,
1516                     struct cec_log_addrs *log_addrs, bool block)
1517 {
1518         int err;
1519
1520         mutex_lock(&adap->lock);
1521         err = __cec_s_log_addrs(adap, log_addrs, block);
1522         mutex_unlock(&adap->lock);
1523         return err;
1524 }
1525 EXPORT_SYMBOL_GPL(cec_s_log_addrs);
1526
1527 /* High-level core CEC message handling */
1528
1529 /* Transmit the Report Features message */
1530 static int cec_report_features(struct cec_adapter *adap, unsigned int la_idx)
1531 {
1532         struct cec_msg msg = { };
1533         const struct cec_log_addrs *las = &adap->log_addrs;
1534         const u8 *features = las->features[la_idx];
1535         bool op_is_dev_features = false;
1536         unsigned int idx;
1537
1538         /* This is 2.0 and up only */
1539         if (adap->log_addrs.cec_version < CEC_OP_CEC_VERSION_2_0)
1540                 return 0;
1541
1542         /* Report Features */
1543         msg.msg[0] = (las->log_addr[la_idx] << 4) | 0x0f;
1544         msg.len = 4;
1545         msg.msg[1] = CEC_MSG_REPORT_FEATURES;
1546         msg.msg[2] = adap->log_addrs.cec_version;
1547         msg.msg[3] = las->all_device_types[la_idx];
1548
1549         /* Write RC Profiles first, then Device Features */
1550         for (idx = 0; idx < ARRAY_SIZE(las->features[0]); idx++) {
1551                 msg.msg[msg.len++] = features[idx];
1552                 if ((features[idx] & CEC_OP_FEAT_EXT) == 0) {
1553                         if (op_is_dev_features)
1554                                 break;
1555                         op_is_dev_features = true;
1556                 }
1557         }
1558         return cec_transmit_msg(adap, &msg, false);
1559 }
1560
1561 /* Transmit the Report Physical Address message */
1562 static int cec_report_phys_addr(struct cec_adapter *adap, unsigned int la_idx)
1563 {
1564         const struct cec_log_addrs *las = &adap->log_addrs;
1565         struct cec_msg msg = { };
1566
1567         /* Report Physical Address */
1568         msg.msg[0] = (las->log_addr[la_idx] << 4) | 0x0f;
1569         cec_msg_report_physical_addr(&msg, adap->phys_addr,
1570                                      las->primary_device_type[la_idx]);
1571         dprintk(2, "config: la %d pa %x.%x.%x.%x\n",
1572                 las->log_addr[la_idx],
1573                         cec_phys_addr_exp(adap->phys_addr));
1574         return cec_transmit_msg(adap, &msg, false);
1575 }
1576
1577 /* Transmit the Feature Abort message */
1578 static int cec_feature_abort_reason(struct cec_adapter *adap,
1579                                     struct cec_msg *msg, u8 reason)
1580 {
1581         struct cec_msg tx_msg = { };
1582
1583         /*
1584          * Don't reply with CEC_MSG_FEATURE_ABORT to a CEC_MSG_FEATURE_ABORT
1585          * message!
1586          */
1587         if (msg->msg[1] == CEC_MSG_FEATURE_ABORT)
1588                 return 0;
1589         cec_msg_set_reply_to(&tx_msg, msg);
1590         cec_msg_feature_abort(&tx_msg, msg->msg[1], reason);
1591         return cec_transmit_msg(adap, &tx_msg, false);
1592 }
1593
1594 static int cec_feature_abort(struct cec_adapter *adap, struct cec_msg *msg)
1595 {
1596         return cec_feature_abort_reason(adap, msg,
1597                                         CEC_OP_ABORT_UNRECOGNIZED_OP);
1598 }
1599
1600 static int cec_feature_refused(struct cec_adapter *adap, struct cec_msg *msg)
1601 {
1602         return cec_feature_abort_reason(adap, msg,
1603                                         CEC_OP_ABORT_REFUSED);
1604 }
1605
1606 /*
1607  * Called when a CEC message is received. This function will do any
1608  * necessary core processing. The is_reply bool is true if this message
1609  * is a reply to an earlier transmit.
1610  *
1611  * The message is either a broadcast message or a valid directed message.
1612  */
1613 static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
1614                               bool is_reply)
1615 {
1616         bool is_broadcast = cec_msg_is_broadcast(msg);
1617         u8 dest_laddr = cec_msg_destination(msg);
1618         u8 init_laddr = cec_msg_initiator(msg);
1619         u8 devtype = cec_log_addr2dev(adap, dest_laddr);
1620         int la_idx = cec_log_addr2idx(adap, dest_laddr);
1621         bool from_unregistered = init_laddr == 0xf;
1622         struct cec_msg tx_cec_msg = { };
1623
1624         dprintk(1, "cec_receive_notify: %*ph\n", msg->len, msg->msg);
1625
1626         /* If this is a CDC-Only device, then ignore any non-CDC messages */
1627         if (cec_is_cdc_only(&adap->log_addrs) &&
1628             msg->msg[1] != CEC_MSG_CDC_MESSAGE)
1629                 return 0;
1630
1631         if (adap->ops->received) {
1632                 /* Allow drivers to process the message first */
1633                 if (adap->ops->received(adap, msg) != -ENOMSG)
1634                         return 0;
1635         }
1636
1637         /*
1638          * REPORT_PHYSICAL_ADDR, CEC_MSG_USER_CONTROL_PRESSED and
1639          * CEC_MSG_USER_CONTROL_RELEASED messages always have to be
1640          * handled by the CEC core, even if the passthrough mode is on.
1641          * The others are just ignored if passthrough mode is on.
1642          */
1643         switch (msg->msg[1]) {
1644         case CEC_MSG_GET_CEC_VERSION:
1645         case CEC_MSG_GIVE_DEVICE_VENDOR_ID:
1646         case CEC_MSG_ABORT:
1647         case CEC_MSG_GIVE_DEVICE_POWER_STATUS:
1648         case CEC_MSG_GIVE_PHYSICAL_ADDR:
1649         case CEC_MSG_GIVE_OSD_NAME:
1650         case CEC_MSG_GIVE_FEATURES:
1651                 /*
1652                  * Skip processing these messages if the passthrough mode
1653                  * is on.
1654                  */
1655                 if (adap->passthrough)
1656                         goto skip_processing;
1657                 /* Ignore if addressing is wrong */
1658                 if (is_broadcast || from_unregistered)
1659                         return 0;
1660                 break;
1661
1662         case CEC_MSG_USER_CONTROL_PRESSED:
1663         case CEC_MSG_USER_CONTROL_RELEASED:
1664                 /* Wrong addressing mode: don't process */
1665                 if (is_broadcast || from_unregistered)
1666                         goto skip_processing;
1667                 break;
1668
1669         case CEC_MSG_REPORT_PHYSICAL_ADDR:
1670                 /*
1671                  * This message is always processed, regardless of the
1672                  * passthrough setting.
1673                  *
1674                  * Exception: don't process if wrong addressing mode.
1675                  */
1676                 if (!is_broadcast)
1677                         goto skip_processing;
1678                 break;
1679
1680         default:
1681                 break;
1682         }
1683
1684         cec_msg_set_reply_to(&tx_cec_msg, msg);
1685
1686         switch (msg->msg[1]) {
1687         /* The following messages are processed but still passed through */
1688         case CEC_MSG_REPORT_PHYSICAL_ADDR: {
1689                 u16 pa = (msg->msg[2] << 8) | msg->msg[3];
1690
1691                 if (!from_unregistered)
1692                         adap->phys_addrs[init_laddr] = pa;
1693                 dprintk(1, "Reported physical address %x.%x.%x.%x for logical address %d\n",
1694                         cec_phys_addr_exp(pa), init_laddr);
1695                 break;
1696         }
1697
1698         case CEC_MSG_USER_CONTROL_PRESSED:
1699                 if (!(adap->capabilities & CEC_CAP_RC) ||
1700                     !(adap->log_addrs.flags & CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU))
1701                         break;
1702
1703 #if IS_REACHABLE(CONFIG_RC_CORE)
1704                 switch (msg->msg[2]) {
1705                 /*
1706                  * Play function, this message can have variable length
1707                  * depending on the specific play function that is used.
1708                  */
1709                 case 0x60:
1710                         if (msg->len == 2)
1711                                 rc_keydown(adap->rc, RC_TYPE_CEC,
1712                                            msg->msg[2], 0);
1713                         else
1714                                 rc_keydown(adap->rc, RC_TYPE_CEC,
1715                                            msg->msg[2] << 8 | msg->msg[3], 0);
1716                         break;
1717                 /*
1718                  * Other function messages that are not handled.
1719                  * Currently the RC framework does not allow to supply an
1720                  * additional parameter to a keypress. These "keys" contain
1721                  * other information such as channel number, an input number
1722                  * etc.
1723                  * For the time being these messages are not processed by the
1724                  * framework and are simply forwarded to the user space.
1725                  */
1726                 case 0x56: case 0x57:
1727                 case 0x67: case 0x68: case 0x69: case 0x6a:
1728                         break;
1729                 default:
1730                         rc_keydown(adap->rc, RC_TYPE_CEC, msg->msg[2], 0);
1731                         break;
1732                 }
1733 #endif
1734                 break;
1735
1736         case CEC_MSG_USER_CONTROL_RELEASED:
1737                 if (!(adap->capabilities & CEC_CAP_RC) ||
1738                     !(adap->log_addrs.flags & CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU))
1739                         break;
1740 #if IS_REACHABLE(CONFIG_RC_CORE)
1741                 rc_keyup(adap->rc);
1742 #endif
1743                 break;
1744
1745         /*
1746          * The remaining messages are only processed if the passthrough mode
1747          * is off.
1748          */
1749         case CEC_MSG_GET_CEC_VERSION:
1750                 cec_msg_cec_version(&tx_cec_msg, adap->log_addrs.cec_version);
1751                 return cec_transmit_msg(adap, &tx_cec_msg, false);
1752
1753         case CEC_MSG_GIVE_PHYSICAL_ADDR:
1754                 /* Do nothing for CEC switches using addr 15 */
1755                 if (devtype == CEC_OP_PRIM_DEVTYPE_SWITCH && dest_laddr == 15)
1756                         return 0;
1757                 cec_msg_report_physical_addr(&tx_cec_msg, adap->phys_addr, devtype);
1758                 return cec_transmit_msg(adap, &tx_cec_msg, false);
1759
1760         case CEC_MSG_GIVE_DEVICE_VENDOR_ID:
1761                 if (adap->log_addrs.vendor_id == CEC_VENDOR_ID_NONE)
1762                         return cec_feature_abort(adap, msg);
1763                 cec_msg_device_vendor_id(&tx_cec_msg, adap->log_addrs.vendor_id);
1764                 return cec_transmit_msg(adap, &tx_cec_msg, false);
1765
1766         case CEC_MSG_ABORT:
1767                 /* Do nothing for CEC switches */
1768                 if (devtype == CEC_OP_PRIM_DEVTYPE_SWITCH)
1769                         return 0;
1770                 return cec_feature_refused(adap, msg);
1771
1772         case CEC_MSG_GIVE_OSD_NAME: {
1773                 if (adap->log_addrs.osd_name[0] == 0)
1774                         return cec_feature_abort(adap, msg);
1775                 cec_msg_set_osd_name(&tx_cec_msg, adap->log_addrs.osd_name);
1776                 return cec_transmit_msg(adap, &tx_cec_msg, false);
1777         }
1778
1779         case CEC_MSG_GIVE_FEATURES:
1780                 if (adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0)
1781                         return cec_report_features(adap, la_idx);
1782                 return 0;
1783
1784         default:
1785                 /*
1786                  * Unprocessed messages are aborted if userspace isn't doing
1787                  * any processing either.
1788                  */
1789                 if (!is_broadcast && !is_reply && !adap->follower_cnt &&
1790                     !adap->cec_follower && msg->msg[1] != CEC_MSG_FEATURE_ABORT)
1791                         return cec_feature_abort(adap, msg);
1792                 break;
1793         }
1794
1795 skip_processing:
1796         /* If this was a reply, then we're done, unless otherwise specified */
1797         if (is_reply && !(msg->flags & CEC_MSG_FL_REPLY_TO_FOLLOWERS))
1798                 return 0;
1799
1800         /*
1801          * Send to the exclusive follower if there is one, otherwise send
1802          * to all followers.
1803          */
1804         if (adap->cec_follower)
1805                 cec_queue_msg_fh(adap->cec_follower, msg);
1806         else
1807                 cec_queue_msg_followers(adap, msg);
1808         return 0;
1809 }
1810
1811 /*
1812  * Helper functions to keep track of the 'monitor all' use count.
1813  *
1814  * These functions are called with adap->lock held.
1815  */
1816 int cec_monitor_all_cnt_inc(struct cec_adapter *adap)
1817 {
1818         int ret = 0;
1819
1820         if (adap->monitor_all_cnt == 0)
1821                 ret = call_op(adap, adap_monitor_all_enable, 1);
1822         if (ret == 0)
1823                 adap->monitor_all_cnt++;
1824         return ret;
1825 }
1826
1827 void cec_monitor_all_cnt_dec(struct cec_adapter *adap)
1828 {
1829         adap->monitor_all_cnt--;
1830         if (adap->monitor_all_cnt == 0)
1831                 WARN_ON(call_op(adap, adap_monitor_all_enable, 0));
1832 }
1833
1834 #ifdef CONFIG_MEDIA_CEC_DEBUG
1835 /*
1836  * Log the current state of the CEC adapter.
1837  * Very useful for debugging.
1838  */
1839 int cec_adap_status(struct seq_file *file, void *priv)
1840 {
1841         struct cec_adapter *adap = dev_get_drvdata(file->private);
1842         struct cec_data *data;
1843
1844         mutex_lock(&adap->lock);
1845         seq_printf(file, "configured: %d\n", adap->is_configured);
1846         seq_printf(file, "configuring: %d\n", adap->is_configuring);
1847         seq_printf(file, "phys_addr: %x.%x.%x.%x\n",
1848                    cec_phys_addr_exp(adap->phys_addr));
1849         seq_printf(file, "number of LAs: %d\n", adap->log_addrs.num_log_addrs);
1850         seq_printf(file, "LA mask: 0x%04x\n", adap->log_addrs.log_addr_mask);
1851         if (adap->cec_follower)
1852                 seq_printf(file, "has CEC follower%s\n",
1853                            adap->passthrough ? " (in passthrough mode)" : "");
1854         if (adap->cec_initiator)
1855                 seq_puts(file, "has CEC initiator\n");
1856         if (adap->monitor_all_cnt)
1857                 seq_printf(file, "file handles in Monitor All mode: %u\n",
1858                            adap->monitor_all_cnt);
1859         data = adap->transmitting;
1860         if (data)
1861                 seq_printf(file, "transmitting message: %*ph (reply: %02x, timeout: %ums)\n",
1862                            data->msg.len, data->msg.msg, data->msg.reply,
1863                            data->msg.timeout);
1864         seq_printf(file, "pending transmits: %u\n", adap->transmit_queue_sz);
1865         list_for_each_entry(data, &adap->transmit_queue, list) {
1866                 seq_printf(file, "queued tx message: %*ph (reply: %02x, timeout: %ums)\n",
1867                            data->msg.len, data->msg.msg, data->msg.reply,
1868                            data->msg.timeout);
1869         }
1870         list_for_each_entry(data, &adap->wait_queue, list) {
1871                 seq_printf(file, "message waiting for reply: %*ph (reply: %02x, timeout: %ums)\n",
1872                            data->msg.len, data->msg.msg, data->msg.reply,
1873                            data->msg.timeout);
1874         }
1875
1876         call_void_op(adap, adap_status, file);
1877         mutex_unlock(&adap->lock);
1878         return 0;
1879 }
1880 #endif