summaryrefslogtreecommitdiffstats
path: root/drivers/hid (follow)
Commit message (Collapse)AuthorAgeFilesLines
* HID: amd_sfh: Fix potential NULL pointer dereferenceBasavaraj Natikar2021-09-271-8/+4
| | | | | | | | | | | The cl_data field of a privdata must be allocated and updated before using in amd_sfh_hid_client_init() function. Hence handling NULL pointer cl_data accordingly. Fixes: d46ef750ed58 ("HID: amd_sfh: Fix potential NULL pointer dereference") Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* HID: u2fzero: ignore incomplete packets without dataAndrej Shadura2021-09-221-1/+3
| | | | | | | | | | | Since the actual_length calculation is performed unsigned, packets shorter than 7 bytes (e.g. packets without data or otherwise truncated) or non-received packets ("zero" bytes) can cause buffer overflow. Link: https://bugzilla.kernel.org/show_bug.cgi?id=214437 Fixes: 42337b9d4d958("HID: add driver for U2F Zero built-in LED and RNG") Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* HID: amd_sfh: Fix potential NULL pointer dereferenceEvgeny Novikov2021-09-161-1/+5
| | | | | | | | | | | | | | devm_add_action_or_reset() can suddenly invoke amd_mp2_pci_remove() at registration that will cause NULL pointer dereference since corresponding data is not initialized yet. The patch moves initialization of data before devm_add_action_or_reset(). Found by Linux Driver Verification project (linuxtesting.org). [jkosina@suse.cz: rebase] Signed-off-by: Evgeny Novikov <novikov@ispras.ru> Acked-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDsJoshua-Dickens2021-09-151-0/+8
| | | | | | | | | Add the new PIDs to wacom_wac.c to support the new models in the Intuos series. [jkosina@suse.cz: fix changelog] Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com> Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JISMizuho Mori2021-09-151-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Apple Magic Keyboard(JIS)'s Logical Maximum and Usage Maximum are wrong. Below is a report descriptor. 0x05, 0x01, /* Usage Page (Desktop), */ 0x09, 0x06, /* Usage (Keyboard), */ 0xA1, 0x01, /* Collection (Application), */ 0x85, 0x01, /* Report ID (1), */ 0x05, 0x07, /* Usage Page (Keyboard), */ 0x15, 0x00, /* Logical Minimum (0), */ 0x25, 0x01, /* Logical Maximum (1), */ 0x19, 0xE0, /* Usage Minimum (KB Leftcontrol), */ 0x29, 0xE7, /* Usage Maximum (KB Right GUI), */ 0x75, 0x01, /* Report Size (1), */ 0x95, 0x08, /* Report Count (8), */ 0x81, 0x02, /* Input (Variable), */ 0x95, 0x05, /* Report Count (5), */ 0x75, 0x01, /* Report Size (1), */ 0x05, 0x08, /* Usage Page (LED), */ 0x19, 0x01, /* Usage Minimum (01h), */ 0x29, 0x05, /* Usage Maximum (05h), */ 0x91, 0x02, /* Output (Variable), */ 0x95, 0x01, /* Report Count (1), */ 0x75, 0x03, /* Report Size (3), */ 0x91, 0x03, /* Output (Constant, Variable), */ 0x95, 0x08, /* Report Count (8), */ 0x75, 0x01, /* Report Size (1), */ 0x15, 0x00, /* Logical Minimum (0), */ 0x25, 0x01, /* Logical Maximum (1), */ here is a report descriptor which is parsed one in kernel. see sys/kernel/debug/hid/<dev>/rdesc 05 01 09 06 a1 01 85 01 05 07 15 00 25 01 19 e0 29 e7 75 01 95 08 81 02 95 05 75 01 05 08 19 01 29 05 91 02 95 01 75 03 91 03 95 08 75 01 15 00 25 01 06 00 ff 09 03 81 03 95 06 75 08 15 00 25 [65] 05 07 19 00 29 [65] 81 00 95 01 75 01 15 00 25 01 05 0c 09 b8 81 02 95 01 75 01 06 01 ff 09 03 81 02 95 01 75 06 81 03 06 02 ff 09 55 85 55 15 00 26 ff 00 75 08 95 40 b1 a2 c0 06 00 ff 09 14 a1 01 85 90 05 84 75 01 95 03 15 00 25 01 09 61 05 85 09 44 09 46 81 02 95 05 81 01 75 08 95 01 15 00 26 ff 00 09 65 81 02 c0 00 Position 64(Logical Maximum) and 70(Usage Maximum) are 101. Both should be 0xE7 to support JIS specific keys(ろ, Eisu, Kana, |) support. position 117 is also 101 but not related(it is Usage 65h). There are no difference of product id between JIS and ANSI. They are same 0x0267. Signed-off-by: Mizuho Mori <morimolymoly@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* HID: betop: fix slab-out-of-bounds Write in betop_probeF.A.Sulaiman2021-09-151-3/+10
| | | | | | | | | | | | | Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver. The problem is the driver assumes the device must have an input report but some malicious devices violate this assumption. So this patch checks hid_device's input is non empty before it's been used. Reported-by: syzbot+07efed3bc5a1407bd742@syzkaller.appspotmail.com Signed-off-by: F.A. SULAIMAN <asha.16@itfac.mrt.ac.lk> Reviewed-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* Merge branch 'for-linus' of ↵Linus Torvalds2021-09-0222-96/+564
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - Fix in i2c-hid driver for Elan touchpad quirk regression (Jim Broadus) - Quirk preventing ASUS Claymore from accidentally suspending whole system (Luke D. Jones) - Updates to the existing FW reporting mechanism, MP2 FW status checks, adding proper power management support for amd-sfh (Basavaraj Natikar) - Regression fix for an issue in HID core that got uncovered by recent USB core cleanup leading to issues when transfer_buffer_length is not in line with wLength (Alan Stern) - Memory leak fix in USB HID core (Anirudh Rayabharam) - Improvement of stylus battery reporting (Dmitry Torokhov) - Power management improvement for Goodix driver (Douglas Anderson) - High-resolution scroll support for Magicmouse devices (José Expósito) - Support for GHLive PS4 dongles (Daniel Nguyen) - Support proper EV_MSC emissions to hid-apple (Vincent Lefevre) * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (31 commits) HID: usbhid: Simplify code in hid_submit_ctrl() HID: usbhid: Fix warning caused by 0-length input reports HID: usbhid: Fix flood of "control queue full" messages HID: sony: Fix more ShanWan clone gamepads to not rumble when plugged in. HID: sony: support for the ghlive ps4 dongles HID: thrustmaster: clean up Makefile and adapt quirks HID: i2c-hid: Fix Elan touchpad regression HID: asus: Prevent Claymore sending suspend event HID: amd_sfh: Add dyndbg prints for debugging HID: amd_sfh: Add support for PM suspend and resume HID: amd_sfh: Move hid probe after sensor is enabled HID: amd_sfh: Add command response to check command status HID: amd_sfh: Fix period data field to enable sensor HID: logitech-hidpp: battery: provide CAPACITY property for newer devices HID: thrustmaster: Fix memory leak in thrustmaster_interrupts() HID: thrustmaster: Fix memory leak in remove HID: thrustmaster: Fix memory leaks in probe HID: elo: update the reference count of the usb device structure HID: logitech-hidpp: Use 'atomic_inc_return' instead of hand-writing it HID: apple: Add missing scan code event for keys handled by hid-apple ...
| * Merge branch 'for-5.15/apple' into for-linusJiri Kosina2021-09-011-9/+23
| |\ | | | | | | | | | - Support proper EV_MSC emissions to hid-apple (Vincent Lefevre)
| | * HID: apple: Add missing scan code event for keys handled by hid-appleVincent Lefevre2021-07-281-9/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When an EV_KEY event is generated by hid-apple due to special key mapping, the usual associated scan code event (EV_MSC) is missing. This issue can be seen with the evtest utility. Add the scan code event for these special keys. BugLink: https://bugs.debian.org/757356 Co-developed-by: Daniel Lin <ephemient@gmail.com> Signed-off-by: Daniel Lin <ephemient@gmail.com> Signed-off-by: Vincent Lefevre <vincent@vinc17.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | Merge branch 'for-5.15/wacom' into for-linusJiri Kosina2021-09-013-13/+48
| |\ \
| | * | HID: wacom: Refactor touch input mute checks into a common functionJason Gerecke2021-07-281-15/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We perform this same set of tests to see if touch input is muted in several places. We might as well replace these independent copies with an inline function. Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | HID: wacom: Avoid sending empty sync eventsJason Gerecke2021-07-281-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Empty sync events clutter up logs and are a waste of CPU cycles. We can avoid sending mt_sync events if touch is disabled or a specific slot is unused. We can avoid sending full sync events if no events were generated. Signed-off-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | HID: wacom: Short-circuit processing of touch when it is disabledJason Gerecke2021-07-283-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Avoid doing unnecessary work when touch is disabled by detecting this condition and returning early. Note that the probe process sends GET FEATURE requests to discover e.g. HID_DG_CONTACTMAX, so we can't start ignoring touch reports until probe finishes. Signed-off-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | HID: wacom: set initial hardware touch switch state to 'off'Ping Cheng2021-07-283-5/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Wacom touch devices have two types of touch switches: softkey touch toggle and hardware touch switch. For softkey toggle, we assume touch is on by default in the driver. However the hardware touch switch is controlled by end users. We don't know if it's on or off before getting the status event. This patch sets touch off for devices with a hardware switch until we get the status. This is a bit safer for users who leave the switch "off" and don't want any accidental touches. The tradeoff is a slight delay between device connection and touch becoming enabled for users who leave the switch "on". Signed-off-by: Ping Cheng <ping.cheng@wacom.com> Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com> Tested-by: Jason Gerecke <jason.gerecke@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | Merge branch 'for-5.15/thrustmaster' into for-linusJiri Kosina2021-09-011-1/+6
| |\ \ \ | | | | | | | | | | | | | | | - Fixes for memory leaks
| | * | | HID: thrustmaster: Fix memory leak in thrustmaster_interrupts()Evgeny Novikov2021-08-201-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | thrustmaster_interrupts() does not free memory for send_buf when usb_interrupt_msg() fails. This is fixed by the given patch. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Evgeny Novikov <novikov@ispras.ru> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: thrustmaster: Fix memory leak in removeEvgeny Novikov2021-08-201-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | thrustmaster_remove() does not release memory for tm_wheel->change_request. This is fixed by the patch. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Evgeny Novikov <novikov@ispras.ru> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: thrustmaster: Fix memory leaks in probeEvgeny Novikov2021-08-201-1/+4
| | | |/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When thrustmaster_probe() handles errors of usb_submit_urb() it does not free allocated resources and fails. The patch fixes that. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Evgeny Novikov <novikov@ispras.ru> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | Merge branch 'for-5.15/sony' into for-linusJiri Kosina2021-09-013-17/+38
| |\ \ \ | | | | | | | | | | | | | | | - Support for GHLive PS4 dongles
| | * | | HID: sony: support for the ghlive ps4 donglesDaniel Nguyen2021-08-203-17/+38
| | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds support for the Guitar Hero Live PS4 dongles. These dongles require a "magic" USB control message to be sent every 8 seconds otherwise the dongle will not report events where the strumbar is hit while a fret is being held. Note that the GHL_GUITAR_POKE_INTERVAL is reduced to 8 seconds in order to support PS3, Wii U, and PS4 GHL dongles. Also note that the constant for vendor id 0x1430 has been renamed from Activision to RedOctane as self-declared by the device. Co-developed-by: Pascal Giard <pascal.giard@etsmtl.ca> Signed-off-by: Pascal Giard <pascal.giard@etsmtl.ca> Signed-off-by: Daniel Nguyen <daniel.nguyen.1@ens.etsmtl.ca> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | Merge branch 'for-5.15/magicmouse' into for-linusJiri Kosina2021-09-011-0/+52
| |\ \ \ | | | | | | | | | | | | | | | - High-resolution scroll support for Magicmouse devices
| | * | | HID: magicmouse: high-resolution scroll thresholdJosé Expósito2021-07-151-2/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to avoid triggering involuntary high-resolution scroll events due to tiny touch movement deltas, add a movement threshold. The value chosen for the threshold, about 1.5 ~ 2 mm, is similar to the threshold used on touchpads by libinput (see libinput evdev-mt-touchpad-gestures.c) to try to keep the scroll experience consistent. Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: magicmouse: enable high-resolution scrollJosé Expósito2021-07-151-0/+31
| | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Magic Mouse, generations 1 and 2, doesn't have a physical scroll wheel, instead, the REL_WHEEL and REL_HWHEEL events are emulated when sliding a finger on the surface of the mouse. However, the smooth movement of the finger is transformed into a step based scroll on the screen, leading to a suboptimal user experience. Emulate high-resolution scroll by sending REL_WHEEL_HI_RES and REL_HWHEEL_HI_RES events so the scroll on the screen is closer to the finger movement. Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | Merge branch 'for-5.15/logitech' into for-linusJiri Kosina2021-09-011-3/+44
| |\ \ \
| | * | | HID: logitech-hidpp: battery: provide CAPACITY property for newer devicesHamza Mahfooz2021-08-201-1/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For devices that only support the BATTERY_VOLTAGE (0x1001) feature, UPower requires the additional information provided by this patch, to set them up. Signed-off-by: Hamza Mahfooz <someguy@effective-light.com> Reviewed-by: Filipe Laíns <lains@riseup.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: logitech-hidpp: Use 'atomic_inc_return' instead of hand-writing itChristophe JAILLET2021-08-201-2/+1
| | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This function logs a warning if the workqueue gets too big. In order to save a few cycles, use 'atomic_inc_return()' instead of an 'atomic_inc()/atomic_read()' sequence. This axes a line of code and saves a 'atomic_read()' call. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | Merge branch 'for-5.15/goodix' into for-linusJiri Kosina2021-09-011-13/+79
| |\ \ \ | | | | | | | | | | | | | | | - power management improvement for Goodix driver
| | * | | HID: i2c-hid: goodix: Use the devm variant of regulator_register_notifier()Douglas Anderson2021-07-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In commit 18eeef46d359 ("HID: i2c-hid: goodix: Tie the reset line to true state of the regulator") I added a call to regulator_register_notifier() but no call to unregister. That's a bug. Let's use the devm variant to handle the unregistering. Fixes: 18eeef46d359 ("HID: i2c-hid: goodix: Tie the reset line to true state of the regulator") Signed-off-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: i2c-hid: goodix: Tie the reset line to true state of the regulatorDouglas Anderson2021-07-151-13/+79
| | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The regulator for the touchscreen could be: * A dedicated regulator just for the touchscreen. * A regulator shared with something else in the system. * An always-on regulator. How we want the "reset" line to behave depends a bit on which of those three cases we're in. Currently the code is written with the assumption that it has a dedicated regulator, but that's not really guaranteed to be the case. The problem we run into is that if we leave the touchscreen powered on (because someone else is requesting the regulator or it's an always-on regulator) and we assert reset then we apparently burn an extra 67 mW of power. That's not great. Let's instead tie the control of the reset line to the true state of the regulator as reported by regulator notifiers. If we have an always-on regulator our notifier will never be called. If we have a shared regulator then our notifier will be called when the touchscreen is truly turned on or truly turned off. Using notifiers like this nicely handles all the cases without resorting to hacks like pretending that there is no "reset" GPIO if we have an always-on regulator. NOTE: if the regulator is on a shared line it's still possible that things could be a little off. Specifically, this case is not handled even after this patch: 1. Suspend goodix (send "sleep", goodix stops requesting regulator on) 2. Other regulator user turns off (regulator fully turns off). 3. Goodix driver gets notified and asserts reset. 4. Other regulator user turns on. 5. Goodix driver gets notified and deasserts reset. 6. Nobody resumes goodix. With that set of steps we'll have reset deasserted but we will have lost the results of the I2C_HID_PWR_SLEEP from the suspend path. That means we might be in higher power than we could be even if the goodix driver thinks things are suspended. Presumably, however, we're still in better shape than if we were asserting "reset" the whole time. If somehow the above situation is actually affecting someone and we want to do better we can deal with it when we have a real use case. Signed-off-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | Merge branch 'for-5.15/core' into for-linusJiri Kosina2021-09-012-13/+18
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Regression fix for an issue in HID core that got uncovered by recent USB core cleanup leading to issues when transfer_buffer_length is not in line with wLength - Memory leak fix in USB HID core - Improvement of stylus battery reporting
| | * | | HID: usbhid: Simplify code in hid_submit_ctrl()Alan Stern2021-09-011-8/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch makes a small simplification to the code in hid_submit_ctrl(). The test for maxpacket being > 0 is unnecessary, because endpoint 0 always has a maxpacket value which is >= 8. Furthermore, endpoint 0's maxpacket value is always a power of 2, so instead of open-coding the round-to-next-multiple computation we can call the optimized round_up() routine. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: usbhid: Fix warning caused by 0-length input reportsAlan Stern2021-09-011-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Syzbot found a warning caused by hid_submit_ctrl() submitting a control request to transfer a 0-length input report: usb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType a1 (The warning message is a little difficult to understand. It means that the control request claims to be for an IN transfer but this contradicts the USB spec, which requires 0-length control transfers always to be in the OUT direction.) Now, a zero-length report isn't good for anything and there's no reason for a device to have one, but the fuzzer likes to pick out these weird edge cases. In the future, perhaps we will decide to reject 0-length reports at probe time. For now, the simplest approach for avoiding these warnings is to pretend that the report actually has length 1. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Reported-and-tested-by: syzbot+9b57a46bf1801ce2a2ca@syzkaller.appspotmail.com Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name> Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: usbhid: Fix flood of "control queue full" messagesMichal Kubecek2021-09-011-8/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [patch description by Alan Stern] Commit 7652dd2c5cb7 ("USB: core: Check buffer length matches wLength for control transfers") causes control URB submissions to fail if the transfer_buffer_length value disagrees with the setup packet's wLength valuel. Unfortunately, it turns out that the usbhid can trigger this failure mode when it submits a control request for an input report: It pads the transfer buffer size to a multiple of the maxpacket value but does not increase wLength correspondingly. These failures have caused problems for people using an APS UPC, in the form of a flood of log messages resembling: hid-generic 0003:051D:0002.0002: control queue full This patch fixes the problem by setting the wLength value equal to the padded transfer_buffer_length value in hid_submit_ctrl(). As a nice bonus, the code which stores the transfer_buffer_length value is now shared between the two branches of an "if" statement, so it can be de-duplicated. Signed-off-by: Michal Kubecek <mkubecek@suse.cz> Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Fixes: 7652dd2c5cb7 ("USB: core: Check buffer length matches wLength for control transfers") Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name> Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: usbhid: free raw_report buffers in usbhid_stopAnirudh Rayabharam2021-07-281-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Free the unsent raw_report buffers when the device is removed. Fixes a memory leak reported by syzbot at: https://syzkaller.appspot.com/bug?id=7b4fa7cb1a7c2d3342a2a8a6c53371c8c418ab47 Reported-by: syzbot+47b26cd837ececfc666d@syzkaller.appspotmail.com Tested-by: syzbot+47b26cd837ececfc666d@syzkaller.appspotmail.com Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: input: do not report stylus battery state as "full"Dmitry Torokhov2021-07-151-2/+0
| | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The power supply states of discharging, charging, full, etc, represent state of charging, not the capacity level of the battery (for which we have a separate property). Current HID usage tables to not allow for expressing charging state of the batteries found in generic styli, so we should simply assume that the battery is discharging even if current capacity is at 100% when battery strength reporting is done via HID interface. In fact, we were doing just that before commit 581c4484769e. This change helps UIs to not mis-represent fully charged batteries in styli as being charging/topping-off. Fixes: 581c4484769e ("HID: input: map digitizer battery usage") Reported-by: Kenneth Albanowski <kenalba@google.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | Merge branch 'for-5.15/cmedia' into for-linusJiri Kosina2021-09-013-4/+92
| |\ \ \
| | * | | HID: cmedia: add support for HS-100B mute buttonThomas Weißschuh2021-07-283-4/+92
| | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These chips report mute button events in bit 4 of their report without it being part of the report descriptor. Use a custom descriptor that maps this bit. Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | Merge branch 'for-5.15/amd-sfh' into for-linusJiri Kosina2021-09-013-15/+139
| |\ \ \ | | | | | | | | | | | | | | | | | | | | - Updates to the existing FW reporting mechanism, MP2 FW status checks, adding proper power management support for amd-sfh
| | * | | HID: amd_sfh: Add dyndbg prints for debuggingBasavaraj Natikar2021-08-202-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add dynamic debug for debugging sensors states during initialization, stop, suspend and resume. Reviewed-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: amd_sfh: Add support for PM suspend and resumeBasavaraj Natikar2021-08-203-1/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for power management routines. Reviewed-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: amd_sfh: Move hid probe after sensor is enabledBasavaraj Natikar2021-08-201-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Earlier platforms don’t have sensor status checking mechanism. Sensors are always enabled without checking sensor status. Hence invoke hid probe only after the sensor is enabled by checking sensor status. Reviewed-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: amd_sfh: Add command response to check command statusBasavaraj Natikar2021-08-203-10/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sometimes sensor enable/disable may take time, without checking the actual status bits from MP2 FW can lead the amd-sfh to misbehave. Hence add a status check of enable/disable command by waiting on the command response before sending the next command to FW. Reviewed-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: amd_sfh: Fix period data field to enable sensorBasavaraj Natikar2021-08-201-1/+1
| | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Existing amd-sfh driver is programming the MP2 firmware period field in units of jiffies, but the MP2 firmware expects in milliseconds unit. Changing it to milliseconds. Fixes: 4b2c53d93a4b ("SFH:Transport Driver to add support of AMD Sensor Fusion Hub (SFH)") Reviewed-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: sony: Fix more ShanWan clone gamepads to not rumble when plugged in.Ulrich Spörlein2021-08-201-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The device string on these can differ, apparently, including typos. I've bought 2 of these in 2012 and googling shows many folks out there with that broken spelling in their dmesg. Signed-off-by: Ulrich Spörlein <uqs@FreeBSD.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: thrustmaster: clean up Makefile and adapt quirksLukas Bulwahn2021-08-202-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit c49c33637802 ("HID: support for initialization of some Thrustmaster wheels") messed up the Makefile and quirks during the refactoring of this commit. Luckily, ./scripts/checkkconfigsymbols.py warns on non-existing configs: HID_TMINIT Referencing files: drivers/hid/Makefile, drivers/hid/hid-quirks.c Following the discussion (see Link), CONFIG_HID_THRUSTMASTER is the intended config for CONFIG_HID_TMINIT and the file hid-tminit.c was actually added as hid-thrustmaster.c. So, clean up Makefile and adapt quirks to that refactoring. Fixes: c49c33637802 ("HID: support for initialization of some Thrustmaster wheels") Link: https://lore.kernel.org/linux-input/CAKXUXMx6dByO03f3dX0X5zjvQp0j2AhJBg0vQFDmhZUhtKxRxw@mail.gmail.com/ Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: i2c-hid: Fix Elan touchpad regressionJim Broadus2021-08-201-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A quirk was recently added for Elan devices that has same device match as an entry earlier in the list. The i2c_hid_lookup_quirk function will always return the last match in the list, so the new entry shadows the old entry. The quirk in the previous entry, I2C_HID_QUIRK_BOGUS_IRQ, silenced a flood of messages which have reappeared in the 5.13 kernel. This change moves the two quirk flags into the same entry. Fixes: ca66a6770bd9 (HID: i2c-hid: Skip ELAN power-on command after reset) Signed-off-by: Jim Broadus <jbroadus@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: asus: Prevent Claymore sending suspend eventLuke D. Jones2021-08-202-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prevent the ASUS Claymore keyboard from sending a suspend event when the device sleeps itself. The suspend event causes a system suspend if uncaught. Signed off by: Luke D Jones <luke@ljones.dev> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: elo: update the reference count of the usb device structureSalah Triki2021-08-201-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use usb_get_dev() to increment the reference count of the usb device structure in order to avoid releasing the structure while it is still in use. And use usb_put_dev() to decrement the reference count and thus, when it will be equal to 0 the structure will be released. Signed-off-by: Salah Triki <salah.triki@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | | | Merge 5.14-rc5 into driver-core-nextGreg Kroah-Hartman2021-08-0910-33/+55
|\| | | | | | | | | | | | | | | | | | | | | | | We need the driver core fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | HID: ft260: fix device removal due to USB disconnectMichael Zaidman2021-07-291-16/+7
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit fixes a functional regression introduced by the commit 82f09a637dd3 ("HID: ft260: improve error handling of ft260_hid_feature_report_get()") when upon USB disconnect, the FTDI FT260 i2c device is still available within the /dev folder. In my company's product, where the host USB to FT260 USB connection is hard-wired in the PCB, the issue is not reproducible. To reproduce it, I used the VirtualBox Ubuntu 20.04 VM and the UMFT260EV1A development module for the FTDI FT260 chip: Plug the UMFT260EV1A module into a USB port and attach it to VM. The VM shows 2 i2c devices under the /dev: michael@michael-VirtualBox:~$ ls /dev/i2c-* /dev/i2c-0 /dev/i2c-1 The i2c-0 is not related to the FTDI FT260: michael@michael-VirtualBox:~$ cat /sys/bus/i2c/devices/i2c-0/name SMBus PIIX4 adapter at 4100 The i2c-1 is created by hid-ft260.ko: michael@michael-VirtualBox:~$ cat /sys/bus/i2c/devices/i2c-1/name FT260 usb-i2c bridge on hidraw1 Now, detach the FTDI FT260 USB device from VM. We expect the /dev/i2c-1 to disappear, but it's still here: michael@michael-VirtualBox:~$ ls /dev/i2c-* /dev/i2c-0 /dev/i2c-1 And the kernel log shows: [ +0.001202] usb 2-2: USB disconnect, device number 3 [ +0.000109] ft260 0003:0403:6030.0002: failed to retrieve system status [ +0.000316] ft260 0003:0403:6030.0003: failed to retrieve system status It happens because the commit 82f09a637dd3 changed the ft260_get_system_config() return logic. This caused the ft260_is_interface_enabled() to exit with error upon the FT260 device USB disconnect, which in turn, aborted the ft260_remove() before deleting the FT260 i2c device and cleaning its sysfs stuff. This commit restores the FT260 USB removal functionality and improves the ft260_is_interface_enabled() code to handle correctly all chip modes defined by the device interface configuration pins DCNF0 and DCNF1. Signed-off-by: Michael Zaidman <michael.zaidman@gmail.com> Acked-by: Aaron Jones (FTDI-UK) <aaron.jones@ftdichip.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-19 05:24:09 +0100