4460 Commits

Author SHA1 Message Date
Jiri Kosina
ac89895213 HID: elo: Revert USB reference counting
Commit 817b8b9c539 ("HID: elo: fix memory leak in elo_probe") introduced
memory leak on error path, but more importantly the whole USB reference
counting is not needed at all in the first place, as the driver itself
doesn't change the reference counting in any way, and the associated
usb_device is guaranteed to be kept around by USB core as long as the
driver binding exists.

Reported-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: fbf42729d0e ("HID: elo: update the reference count of the usb device structure")
Fixes: 817b8b9c539 ("HID: elo: fix memory leak in elo_probe")
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-17 14:14:41 +01:00
Jiri Kosina
ed9f4f9612 HID: apple: properly reflect LEDS dependency
Since hid-apple driver now makes use of LEDS functionality, reflect this
properly in Kconfig.

Reported-by: kernel test robot <lkp@intel.com>
Fixes: 9018eacbe623b ("HID: apple: Add support for keyboard backlight on certain T2 Macs.")
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-17 13:54:56 +01:00
Jelle van der Waa
047b6188b6 HID: Add driver for Razer Blackwidow keyboards
Add a driver to enable the macro keys (M1 - M5) by default, these are
mapped to XF86Tools and XF86Launch5 - XF86Launch8. The driver remaps
them by default to macro keys with an option to retain the old mapping
which users most likely already use as there are many scripts to enable
the macro keys available on Github and other websites.

Signed-off-by: Jelle van der Waa <jvanderwaa@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 17:12:14 +01:00
Michael Hübner
0a5a587501 HID: Add support for open wheel and no attachment to T300
Different add ons to the wheel base report different models. Having
no wheel mounted to the base and using the open wheel attachment is
added here.

Signed-off-by: Michael Hübner <michaelh.95@t-online.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 17:09:33 +01:00
Aditya Garg
c5f09b1b45 HID: apple: Add fn mapping for MacBook Pros with Touch Bar
This patch adds the Fn mapping for keyboards on certain T2 Macs.

[jkosina@suse.cz: rebase on top of apple_setup_input() refactoring]
Signed-off-by: Aditya Garg <gargaditya08@live.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:57:39 +01:00
Aun-Ali Zaidi
42f6a2d300 HID: apple: Add necessary IDs and configuration for T2 Macs.
This patch adds the necessary IDs and configuration for Macs with
the T2 Security chip.

Signed-off-by: Aun-Ali Zaidi <admin@kodeit.net>
Signed-off-by: Aditya Garg <gargaditya08@live.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:55:00 +01:00
Paul Pawlowski
9018eacbe6 HID: apple: Add support for keyboard backlight on certain T2 Macs.
This patch introduces the requisite plumbing for supporting keyboard
backlight on T2-attached, USB exposed models. The quirk mechanism was
used to reuse the existing hid-apple driver.

Signed-off-by: Paul Pawlowski <paul@mrarm.io>
Signed-off-by: Aun-Ali Zaidi <admin@kodeit.net>
Signed-off-by: Aditya Garg <gargaditya08@live.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:54:48 +01:00
José Expósito
cbfcfbfc38 HID: apple: Report Magic Keyboard 2021 with fingerprint reader battery over USB
Like the Apple Magic Keyboard 2015, when connected over USB, the 2021
version with fingerprint reader registers 2 different interfaces. One of
them is used to report the battery level.

However, unlike when connected over Bluetooth, the battery level is not
reported automatically and it is required to fetch it manually.

Add the APPLE_RDESC_BATTERY quirk to fix the battery report descriptor
and manually fetch the battery level.

Tested with the ANSI variant of the keyboard with and without numpad.

Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:49:45 +01:00
José Expósito
8ae5c16c9d HID: apple: Report Magic Keyboard 2021 battery over USB
Like the Apple Magic Keyboard 2015, when connected over USB, the 2021
version registers 2 different interfaces. One of them is used to report
the battery level.

However, unlike when connected over Bluetooth, the battery level is not
reported automatically and it is required to fetch it manually.

Add the APPLE_RDESC_BATTERY quirk to fix the battery report descriptor
and manually fetch the battery level.

Tested with the ANSI, ISO and JIS variants of the keyboard.

Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:49:45 +01:00
José Expósito
250b369ed2 HID: apple: Magic Keyboard 2015 FN key mapping
The Magic Keyboard 2015 function key mapping was not present and the
default mapping was used.
While this worked for most keys, the F5 and F6 keys were sending
KEY_KBDILLUMDOWN and KEY_KBDILLUMUP; however, the keyboard is not
backlited.

Add a custom translation table for the keyboard leaving F5 and F6
unassigned to mimic the default behavior on macOS.

Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:49:45 +01:00
José Expósito
0fea6fe7d5 HID: apple: Magic Keyboard first generation FN key mapping
The function key mapping for the Magic Keyboard first generation (2007,
2009 and 2011 aluminum wireless models) was not present and the default
one was used instead.

This caused two main issues:

 - The F5 and F6 keys were sending KEY_KBDILLUMDOWN and KEY_KBDILLUMUP;
   however, the keyboard is not backlited.

 - The keyboard has the APPLE_NUMLOCK_EMULATION quirk with F6 set as
   the KEY_NUMLOCK key by "powerbook_numlock_keys". However, because F6
   was mapped to KEY_KBDILLUMUP by the default mapping it was not
   possible to switch the numlock status.
   This means that, if numlock was enabled on session startup, it was
   not possible to disable it without connecting another keyboard.

Add a custom translation table for the device leaving F5 unassigned and
using F6 as the KEY_NUMLOCK key.

Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:49:45 +01:00
José Expósito
f1d1b3a9b4 HID: apple: Refactor key translation setup
The code used to map the apple_key_translation structs is duplicated.
Extract it to a common function.

Refactor, no functional changes.

Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:49:45 +01:00
Nikolai Kondrashov
044fa8162d HID: uclogic: Handle virtual frame reports
Explicitly change report ID to virtual ID and handle virtual frame
reports as real for consistency.

Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:41:54 +01:00
Nikolai Kondrashov
fea53b9f15 HID: uclogic: Skip non-input raw events earlier
Early return when a non-input raw event is received to simplify the
logic present in uclogic_raw_event.

Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:41:54 +01:00
Nikolai Kondrashov
7f12dd2469 HID: uclogic: Access pen/frame params directly in raw_event handling
Simplify the raw event handling code by accessing the
uclogic_params_pen/uclogic_params_frame structs directly.

Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:41:54 +01:00
Nikolai Kondrashov
7e418667f2 HID: uclogic: Split pen and frame raw event handling
In order to avoid ending up with  a big uclogic_raw_event function,
split it in two smaller functions: uclogic_raw_event_pen for the pen
events and uclogic_raw_event_frame for the pad events.

Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:41:54 +01:00
Nikolai Kondrashov
5591403cd6 HID: uclogic: Support Huion 13th frame button
Support reporting 13th frame button for Huion tablets. This supports
reporting the button in the center of the dial for Huion HS610.

Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:41:54 +01:00
Nikolai Kondrashov
85e860715e HID: uclogic: Rename Huion HS64 PID to Huion Tablet 2
Since the 006d Huion PID is used by multiple tablets (at least HS64 and
HS610), rename its constant to a more general
"USB_DEVICE_ID_HUION_TABLET2".

Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:41:54 +01:00
Nikolai Kondrashov
1324c5ac76 HID: uclogic: Support Huion tilt reporting
Add support for Huion v2 protocol tilt reporting. Describe reports as
angles in degrees, which is not exactly true, but there doesn't seem to
be a straightforward, consistent conversion possible, and what's
reported would have to be enough.

Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:41:54 +01:00
Yang Li
269ecc0c89 HID: i2c-hid: remove unneeded semicolon
Eliminate the following coccicheck warning:
./drivers/hid/i2c-hid/i2c-hid-core.c:357:56-57: Unneeded semicolon

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:30:00 +01:00
Lucas Zampieri
25666e8ccd HID: logitech-dj: add new lightspeed receiver id
As of logitech lightspeed receiver fw version 04.02.B0009,
HIDPP_PARAM_DEVICE_INFO is being reported as 0x11.

With patch "HID: logitech-dj: add support for the new lightspeed receiver
iteration", the mouse starts to error out with:
  logitech-djreceiver: unusable device of type UNKNOWN (0x011) connected on
  slot 1
and becomes unusable.

This has been noticed on a Logitech G Pro X Superlight fw MPM 25.01.B0018.

Signed-off-by: Lucas Zampieri <lzampier@redhat.com>
Acked-by: Nestor Lopez Casado <nlopezcasad@logitech.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-16 16:26:21 +01:00
Basavaraj Natikar
7f016b35ca HID: amd_sfh: Add interrupt handler to process interrupts
On newer AMD platforms with SFH, it is observed that random interrupts
get generated on the SFH hardware and until this is cleared the firmware
sensor processing is stalled, resulting in no data been received to
driver side.

Add routines to handle these interrupts, so that firmware operations are
not stalled.

Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 16:28:51 +01:00
Basavaraj Natikar
fb75a3791a HID: amd_sfh: Add functionality to clear interrupts
Newer AMD platforms with SFH may generate interrupts on some events
which are unwarranted. Until this is cleared the actual MP2 data
processing maybe stalled in some cases.

Add a mechanism to clear the pending interrupts (if any) during the
driver initialization and sensor command operations.

Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 16:28:51 +01:00
Basavaraj Natikar
b300667b33 HID: amd_sfh: Disable the interrupt for all command
Sensor data is processed in polling mode. Hence disable the interrupt
for all sensor command.

Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 16:28:51 +01:00
Basavaraj Natikar
aa0b724a2b HID: amd_sfh: Correct the structure field name
Misinterpreted intr_enable field name. Hence correct the structure
field name accordingly to reflect the functionality.

Fixes: f264481ad614 ("HID: amd_sfh: Extend driver capabilities for multi-generation support")
Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 16:28:51 +01:00
Basavaraj Natikar
0cf74235f4 HID: amd_sfh: Handle amd_sfh work buffer in PM ops
Since in the current amd_sfh design the sensor data is periodically
obtained in the form of poll data, during the suspend/resume cycle,
scheduling a delayed work adds no value.

So, cancel the work and restart back during the suspend/resume cycle
respectively.

Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 16:28:51 +01:00
Dmitry Torokhov
1c4d6cd4cb HID: i2c-hid: note that I2C xfer buffers are DMA-safe
All I2C communications in the driver use driver-private buffers that are
DMA-safe, so mark them as such.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 10:52:29 +01:00
Dmitry Torokhov
551117c522 HID: i2c-hid: no longer need raw access to HID descriptor structure
We can stop defining a union for HID descriptor data as we now only access
individual members of it by names and using proper types instead of
accessing by offset from the beginning of the data structure.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 10:52:29 +01:00
Dmitry Torokhov
86fc3fd281 HID: i2c-hid: use helpers to do endian conversion in i2c_hid_get_input()
It is better to use helpers to do endian conversion as it documents
and draws attention to it, and might be a bit more performant as
well.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 10:52:29 +01:00
Dmitry Torokhov
85df713377 HID: i2c-hid: rework i2c_hid_get_report() to use i2c_hid_xfer()
Explicitly prepare command for i2c_hid_get_report() which makes the logic
clearer and allows us to get rid of __i2c_hid_command() and related command
definitions.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 10:51:08 +01:00
Dmitry Torokhov
50c5249fca HID: i2c-hid: convert i2c_hid_execute_reset() to use i2c_hid_xfer()
This will allow us to drop i2c_hid_command() wrapper and get close
to removing __i2c_hid_command().

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 10:51:08 +01:00
Dmitry Torokhov
acb8dd9597 HID: i2c-hid: create a helper for SET_POWER command
Another case where creating a dedicated helper allows for cleaner code that
shows exactly what communication happens with the device when toggling its
power.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 10:51:08 +01:00
Dmitry Torokhov
8399bd0102 HID: i2c-hid: define i2c_hid_read_register() and use it
Handling simple read of device registers in __i2c_hid_command() makes it
too complicated and the need of special handling for the HID descriptor
register adds even more complexity. Instead, let's create simple
i2c_hid_read_register() helper on base of i2c_hid_xfer() and use it.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 10:51:07 +01:00
Dmitry Torokhov
dbe0dd5fd2 HID: i2c-hid: explicitly code setting and sending reports
Instead of relying on __i2c_hid_command() that tries to handle all
commands and because of that is very complicated, let's define a
new dumb helper i2c_hid_xfer() that actually transfers (write and
read) data, and use it when sending and setting reports. By doing
that we can save on number of copy operations we have to execute,
and make logic of sending reports much clearer.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 10:51:07 +01:00
Dmitry Torokhov
b26fc3161b HID: i2c-hid: refactor reset command
"Reset" is the only command that needs to wait for interrupt from
the device before continuing, so let's factor our waiting logic from
__i2c_hid_command() to make it simpler.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 10:51:07 +01:00
Dmitry Torokhov
d34c610549 HID: i2c-hid: use "struct i2c_hid" as argument in most calls
The main object in the driver is struct i2c_hid so it makes more sense
to pass it around instead of passing i2c_client and then fetching
i2c_hid associated with it.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 10:51:07 +01:00
Dmitry Torokhov
a5e5e03e94 HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
Internally kernel prepends all report buffers, for both numbered and
unnumbered reports, with report ID, therefore to properly handle unnumbered
reports we should prepend it ourselves.

For the same reason we should skip the first byte of the buffer when
calling i2c_hid_set_or_send_report() which then will take care of properly
formatting the transfer buffer based on its separate report ID argument
along with report payload.

[jkosina@suse.cz: finalize trimmed sentence in changelog as spotted by Benjamin]
Fixes: 9b5a9ae88573 ("HID: i2c-hid: implement ll_driver transport-layer callbacks")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 10:50:55 +01:00
Angela Czubak
cf5b2fb012 HID: i2c-hid: fix handling numbered reports with IDs of 15 and above
Special handling of numbered reports with IDs of 15 and above is only
needed when executing what HID-I2C spec is calling "Class Specific
Requests", and not when simply sending output reports.

Additionally, our mangling of report ID in i2c_hid_set_or_send_report()
resulted in incorrect report ID being written into SET_REPORT command
payload.

To solve it let's move all the report ID manipulation into
__i2c_hid_command() where we form the command data structure.

Signed-off-by: Angela Czubak <acz@semihalf.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-14 10:50:55 +01:00
Sergio Costas
fd5dd6acd8 HID:Add support for UGTABLET WP5540
This patch adds support for the UGTABLET WP5540 digitizer tablet
devices. Without it, the pen moves the cursor, but neither the
buttons nor the tap sensor in the tip do work.

Signed-off-by: Sergio Costas <rastersoft@gmail.com>
Link: https://lore.kernel.org/r/63dece1d-91ca-1b1b-d90d-335be66896be@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
2022-02-05 11:59:24 +01:00
Desmond Lim
976734041b HID: add SiGma Micro driver
Fix for SiGma Micro-based keyboards where all the modifier keys mapped
to Shift_L.

Co-developed-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Desmond Lim <peckishrine@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-02 15:12:22 +01:00
Gustavo A. R. Silva
01f1269fbb HID: google: Use struct_size() helper in kzalloc()
Make use of the struct_size() helper instead of an open-coded version,
in order to avoid any potential type mistakes or integer overflows that,
in the worst scenario, could lead to heap overflows.

Also, address the following sparse warnings:
drivers/hid/hid-google-hammer.c:61:23: warning: using sizeof on a flexible structure

Link: https://github.com/KSPP/linux/issues/174
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-02 15:09:39 +01:00
Basavaraj Natikar
91aaea527b HID: amd_sfh: Add illuminance mask to limit ALS max value
ALS illuminance value present only in first 15 bits from SFH firmware
for V2 platforms. Hence added a mask of 15 bit to limit ALS max
illuminance values to get correct illuminance value.

Fixes: 0aad9c95eb9a ("HID: amd_sfh: Extend ALS support for newer AMD platform")
Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-02 15:04:26 +01:00
Basavaraj Natikar
a7072c01c3 HID: amd_sfh: Increase sensor command timeout
HPD sensors take more time to initialize. Hence increasing sensor
command timeout to get response with status within a max timeout.

Fixes: 173709f50e98 ("HID: amd_sfh: Add command response to check command status")
Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-02 15:04:26 +01:00
Daniel Thompson
2787710f73 HID: i2c-hid: goodix: Fix a lockdep splat
I'm was on the receiving end of a lockdep splat from this driver and after
scratching my head I couldn't be entirely sure it was a false positive
given we would also have to think about whether the regulator locking is
safe (since the notifier is called whilst holding regulator locks which
are also needed for regulator_is_enabled() ).

Regardless of whether it is a real bug or not, the mutex isn't needed.
We can use reference counting tricks instead to avoid races with the
notifier calls.

The observed splat follows:

------------------------------------------------------
kworker/u16:3/127 is trying to acquire lock:
ffff00008021fb20 (&ihid_goodix->regulator_mutex){+.+.}-{4:4}, at: ihid_goodix_vdd_notify+0x30/0x94

but task is already holding lock:
ffff0000835c60c0 (&(&rdev->notifier)->rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x30/0x70

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 (&(&rdev->notifier)->rwsem){++++}-{4:4}:
       down_write+0x68/0x8c
       blocking_notifier_chain_register+0x54/0x70
       regulator_register_notifier+0x1c/0x24
       devm_regulator_register_notifier+0x58/0x98
       i2c_hid_of_goodix_probe+0xdc/0x158
       i2c_device_probe+0x25d/0x270
       really_probe+0x174/0x2cc
       __driver_probe_device+0xc0/0xd8
       driver_probe_device+0x50/0xe4
       __device_attach_driver+0xa8/0xc0
       bus_for_each_drv+0x9c/0xc0
       __device_attach_async_helper+0x6c/0xbc
       async_run_entry_fn+0x38/0x100
       process_one_work+0x294/0x438
       worker_thread+0x180/0x258
       kthread+0x120/0x130
       ret_from_fork+0x10/0x20

-> #0 (&ihid_goodix->regulator_mutex){+.+.}-{4:4}:
       __lock_acquire+0xd24/0xfe8
       lock_acquire+0x288/0x2f4
       __mutex_lock+0xa0/0x338
       mutex_lock_nested+0x3c/0x5c
       ihid_goodix_vdd_notify+0x30/0x94
       notifier_call_chain+0x6c/0x8c
       blocking_notifier_call_chain+0x48/0x70
       _notifier_call_chain.isra.0+0x18/0x20
       _regulator_enable+0xc0/0x178
       regulator_enable+0x40/0x7c
       goodix_i2c_hid_power_up+0x18/0x20
       i2c_hid_core_power_up.isra.0+0x1c/0x2c
       i2c_hid_core_probe+0xd8/0x3d4
       i2c_hid_of_goodix_probe+0x14c/0x158
       i2c_device_probe+0x25c/0x270
       really_probe+0x174/0x2cc
       __driver_probe_device+0xc0/0xd8
       driver_probe_device+0x50/0xe4
       __device_attach_driver+0xa8/0xc0
       bus_for_each_drv+0x9c/0xc0
       __device_attach_async_helper+0x6c/0xbc
       async_run_entry_fn+0x38/0x100
       process_one_work+0x294/0x438
       worker_thread+0x180/0x258
       kthread+0x120/0x130
       ret_from_fork+0x10/0x20

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&(&rdev->notifier)->rwsem);
                               lock(&ihid_goodix->regulator_mutex);
                               lock(&(&rdev->notifier)->rwsem);
  lock(&ihid_goodix->regulator_mutex);

 *** DEADLOCK ***

Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Fixes: 18eeef46d359 ("HID: i2c-hid: goodix: Tie the reset line to true state of the regulator")
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-02-02 14:47:46 +01:00
Christophe JAILLET
0f20394823 HID: amd_sfh: Remove useless DMA-32 fallback configuration
As stated in [1], dma_set_mask() with a 64-bit mask never fails if
dev->dma_mask is non-NULL.
So, if it fails, the 32 bits case will also fail for the same reason.

Simplify code and remove some dead code accordingly.

[1]: https://lore.kernel.org/linux-kernel/YL3vSPK5DXTNvgdx@infradead.org/#t

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-01-24 09:14:02 +01:00
Dongliang Mu
817b8b9c53 HID: elo: fix memory leak in elo_probe
When hid_parse() in elo_probe() fails, it forgets to call usb_put_dev to
decrease the refcount.

Fix this by adding usb_put_dev() in the error handling code of elo_probe().

Fixes: fbf42729d0e9 ("HID: elo: update the reference count of the usb device structure")
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-01-24 09:03:21 +01:00
Alex Henrie
e26a78057c HID: apple: Set the tilde quirk flag on the Wellspring 5 and later
Markus reports that his 2011 MacBook with a German ISO keyboard (USB
product code 05ac:0246, HID country code 13) has the tilde key quirk.
Seeing as all of the standalone Apple ISO keyboards since about 2008
have the quirk, it seems reasonable to assume that once the integrated
laptop keyboards started having the quirk, they likewise never stopped
having it.

Reported-by: Markus Wageringel <markus.wageringel@gmail.com>
Signed-off-by: Alex Henrie <alexhenrie24@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-01-21 16:16:27 +01:00
Jason Gerecke
20f3cf5f86 HID: wacom: Avoid using stale array indicies to read contact count
If we ever see a touch report with contact count data we initialize
several variables used to read the contact count in the pre-report
phase. These variables are never reset if we process a report which
doesn't contain a contact count, however. This can cause the pre-
report function to trigger a read of arbitrary memory (e.g. NULL
if we're lucky) and potentially crash the driver.

This commit restores resetting of the variables back to default
"none" values that were used prior to the commit mentioned
below.

Link: https://github.com/linuxwacom/input-wacom/issues/276
Fixes: 003f50ab673c (HID: wacom: Update last_slot_field during pre_report phase)
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-01-21 15:10:02 +01:00
Jason Gerecke
df03e9bd6d HID: wacom: Ignore the confidence flag when a touch is removed
AES hardware may internally re-classify a contact that it thought was
intentional as a palm. Intentional contacts are reported as "down" with
the confidence bit set. When this re-classification occurs, however, the
state transitions to "up" with the confidence bit cleared. This kind of
transition appears to be legal according to Microsoft docs, but we do
not handle it correctly. Because the confidence bit is clear, we don't
call `wacom_wac_finger_slot` and update userspace. This causes hung
touches that confuse userspace and interfere with pen arbitration.

This commit adds a special case to ignore the confidence flag if a contact
is reported as removed. This ensures we do not leave a hung touch if one
of these re-classification events occured. Ideally we'd have some way to
also let userspace know that the touch has been re-classified as a palm
and needs to be canceled, but that's not possible right now :)

Link: https://github.com/linuxwacom/input-wacom/issues/288
Fixes: 7fb0413baa7f (HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts)
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-01-21 15:10:02 +01:00
Jason Gerecke
546e41ac99 HID: wacom: Reset expected and received contact counts at the same time
These two values go hand-in-hand and must be valid for the driver to
behave correctly. We are currently lazy about updating the values and
rely on the "expected" code flow to take care of making sure they're
valid at the point they're needed. The "expected" flow changed somewhat
with commit f8b6a74719b5 ("HID: wacom: generic: Support multiple tools
per report"), however. This led to problems with the DTH-2452 due (in
part) to *all* contacts being fully processed -- even those past the
expected contact count. Specifically, the received count gets reset to
0 once all expected fingers are processed, but not the expected count.
The rest of the contacts in the report are then *also* processed since
now the driver thinks we've only processed 0 of N expected contacts.

Later commits such as 7fb0413baa7f (HID: wacom: Use "Confidence" flag to
prevent reporting invalid contacts) worked around the DTH-2452 issue by
skipping the invalid contacts at the end of the report, but this is not
a complete fix. The confidence flag cannot be relied on when a contact
is removed (see the following patch), and dealing with that condition
re-introduces the DTH-2452 issue unless we also address this contact
count laziness. By resetting expected and received counts at the same
time we ensure the driver understands that there are 0 more contacts
expected in the report. Similarly, we also make sure to reset the
received count if for some reason we're out of sync in the pre-report
phase.

Link: https://github.com/linuxwacom/input-wacom/issues/288
Fixes: f8b6a74719b5 ("HID: wacom: generic: Support multiple tools per report")
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-01-21 15:10:02 +01:00