Commit Graph

4575 Commits

Author SHA1 Message Date
Linus Torvalds
694b37a5dd Input updates for 6.1 merge window:
- a new driver for IBM Operational Panel
 
 - a new driver for PinePhone keyboards
 
 - RT5120 PMIC power key support
 
 - various enhancements and support for new models in xpad (Xbox) driver
 
 - a new compatible ID for Elan touchscreen driver
 
 - rework of adp5588-keys driver to support configuring via device
   properties (OF, ACPI, etc) instead of platform data, and proper support
   of optional gpiochip functionality (and removal of gpio-adp5588 driver)
 
 - improvements to firmware update handling in Synaptics RMI4 driver
 
 - support for double key matrix in mt6779-keypad
 
 - support for polled mode in adc-joystick driver
 
 - other assorted driver fixes, cleanups and improvements.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCY0O9YwAKCRBAj56VGEWX
 nICKAQD6/pS5tIWFCyYrM/A0xbkYuPWtmXqJTSGANlevU7nypwEAqaH2tYSDAdxM
 NylDCPvvduHVmA2ewXgvIlUzjCLr6As=
 =cUmW
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v6.1-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input updates from Dmitry Torokhov:

 - a new driver for IBM Operational Panel

 - a new driver for PinePhone keyboards

 - RT5120 PMIC power key support

 - various enhancements and support for new models in xpad (Xbox) driver

 - a new compatible ID for Elan touchscreen driver

 - rework of adp5588-keys driver to support configuring via device
   properties (OF, ACPI, etc) instead of platform data, and proper
   support of optional gpiochip functionality (and removal of
   gpio-adp5588 driver)

 - improvements to firmware update handling in Synaptics RMI4 driver

 - support for double key matrix in mt6779-keypad

 - support for polled mode in adc-joystick driver

 - other assorted driver fixes, cleanups and improvements

* tag 'input-for-v6.1-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (90 commits)
  Input: i8042 - fix refount leak on sparc
  Input: i8042 - add LoongArch support in i8042-acpipnpio.h
  Input: i8042 - rename i8042-x86ia64io.h to i8042-acpipnpio.h
  Input: pinephone-keyboard - support the proxied I2C bus
  Input: pinephone-keyboard - add PinePhone keyboard driver
  dt-bindings: input: Add the PinePhone keyboard binding
  dt-bindings: input: Convert hid-over-i2c to DT schema
  input: drop empty comment blocks
  Input: xpad - add X-Box Adaptive Profile button
  Input: add ABS_PROFILE to uapi and documentation
  Input: xpad - add X-Box Adaptive XBox button
  Input: xpad - add X-Box Adaptive support
  Input: ims-pcu - fix spelling mistake "BOOLTLOADER" -> "BOOTLOADER"
  Input: ibm-panel - add missing MODULE_DEVICE_TABLE
  Input: icn8505 - utilize acpi_get_subsystem_id()
  Input: xpad - decipher xpadone packages with GIP defines
  Input: xpad - refactor using BIT() macro
  Input: synaptics-rmi4 - convert to use sysfs_emit() APIs
  Input: twl4030-pwrbutton - add missing of.h include
  Input: applespi - replace zero-length array with DECLARE_FLEX_ARRAY() helper
  ...
2022-10-11 10:53:25 -07:00
Linus Torvalds
79d11de963 Assorted HID drivers updates and fixes for 6.1
-----BEGIN PGP SIGNATURE-----
 
 iQJSBAABCAA8FiEEoEVH9lhNrxiMPSyI7MXwXhnZSjYFAmM9UhweHGJlbmphbWlu
 LnRpc3NvaXJlc0ByZWRoYXQuY29tAAoJEOzF8F4Z2Uo2pE8P/23iRM/+kO2KDeU8
 3lp6z1Ny/Hp0HPAsWCgAywgPcNoG+JaxBdAFv2YXky0RI3/OMtI+6FK36XJs63E5
 twjFwySxupY2CXLIXjSkLunAWlZUwtpRLnrBpPwgG87wKkI8IvPmv1AwkiYO9GD9
 Q0vtd+GaE7Bx33XBga4IcVx1hODL/SDeT1ozS1czhv4NNutRsR7lxCsn6qKly9WK
 zwoTHEOIJnq4oLZElmnxuJeUU1vvRXy4g+xPV+rfqbnlZUh0zQeD//1G7lRchEel
 t6l5SDR9pZ+zbWUw7gtU/KoUtf4eJ5+4fX9ejMqtEvoQLquePYQOD6Pyzjqlq7ND
 x31MjTmVHaav4GZiON7ztkbUncnERYRVRiLr5iDw9xcS5MVnMg2a07VgY6Ld5Xnl
 FQ0ZaO7T1HUxl2Lig7kRdX/kIDVNMIgfS1e0H6yJC3b5sbouwSRknu6EoumK/6tG
 nx8njAYi8t+2DN7d/82Ck1Z3CfY100WONahBAVZeyNtu0p9QH1k0b6srZiCpFTvQ
 ffl6lXboiYYx3hV/HNoDiIJPTh/zJhjEAzi1MgUKlbt5ImYWJQ0tAnhY16e3+xt5
 83ryRFdUmjwxE/0Oh0yi1Nk8VWid+40DCpay9Qm6veyRr+ECviChwoI0OUFsTrfR
 p2+2ghZHwFf4JTpUNlHdV0Kz0OJ9
 =lo26
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-2022100501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

Pull HID updates from Benjamin Tissoires:

 - handle of all Logitech Bluetooth HID++ devices in the Logitech HID++
   drivers (Bastien Nocera)

 - fix broken atomic checks in hid-multitouch by adding memory barriers
   (Andri Yngvason)

 - better handling of devices with AMD SFH1.1 (Basavaraj Natikar)

 - better support of Nintendo clone controllers (Icenowy Zheng and
   Johnothan King)

 - Support for various RC controllers (Marcus Folkesson)

 - Add UGEEv2 support in hid-uclogic (XP-PEN Deco Pro S and Parblo A610
   PRO) (José Expósito)

 - some conversions to use dev_groups (Greg Kroah-Hartman)

 - HID-BPF preparatory patches, mostly to convert blank defines as enums
   (Benjamin Tissoires)

* tag 'for-linus-2022100501' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (38 commits)
  HID: wacom: add three styli to wacom_intuos_get_tool_type
  HID: amd_sfh: Handle condition of "no sensors" for SFH1.1
  HID: amd_sfh: Change dev_err to dev_dbg for additional debug info
  HID: nintendo: check analog user calibration for plausibility
  HID: nintendo: deregister home LED when it fails
  HID: roccat: Fix use-after-free in roccat_read()
  hid: topre: Add driver fixing report descriptor
  HID: multitouch: Add memory barriers
  HID: convert defines of HID class requests into a proper enum
  HID: export hid_report_type to uapi
  HID: core: store the unique system identifier in hid_device
  HID: Add driver for PhoenixRC Flight Controller
  HID: Add driver for VRC-2 Car Controller
  HID: sony: Fix double word in comments
  hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event
  HID: logitech-hidpp: Detect hi-res scrolling support
  HID: logitech-hidpp: Remove hard-coded "Sw. Id." for HID++ 2.0 commands
  HID: logitech-hidpp: Fix "Sw. Id." for HID++ 2.0 commands
  HID: logitech-hidpp: Remove special-casing of Bluetooth devices
  HID: logitech-hidpp: Enable HID++ for all the Logitech Bluetooth devices
  ...
2022-10-07 11:13:42 -07:00
Benjamin Tissoires
cb7c02e91c Merge branch 'for-6.1/google' into for-linus
- convert to use dev_groups (Greg Kroah-Hartman)
2022-10-05 10:38:35 +01:00
Benjamin Tissoires
1145c3d5e7 Merge branch 'for-6.1/rmi' into for-linus
- compilation warning fix (Jiangshan Yi)
2022-10-05 10:37:17 +01:00
Benjamin Tissoires
1af52d6b35 Merge branch 'for-6.1/wacom' into for-linus
- Simplify comments (Christophe JAILLET)
2022-10-05 10:36:30 +01:00
Benjamin Tissoires
430257d832 Merge branch 'for-6.1/uclogic' into for-linus
- Add UGEEv2 support (XP-PEN Deco Pro S and Parblo A610 PRO) (José
  Expósito)
2022-10-05 10:34:48 +01:00
Benjamin Tissoires
d7ae8ff97e Merge branch 'for-6.1/rc-controllers' into for-linus
- Support for various RC controllers (Marcus Folkesson)
2022-10-05 10:31:33 +01:00
Benjamin Tissoires
b0400ff294 Merge branch 'for-6.1/topre' into for-linus
- Fix Topre REALFORCE R2 keyboard so it can send more than 6 keys at the
  time (Harry Stern)
2022-10-05 10:30:18 +01:00
Benjamin Tissoires
2f5b0059b3 Merge branch 'for-6.1/nintendo' into for-linus
- better support of Nintendo clone controllers (Icenowy Zheng and
  Johnothan King)
2022-10-05 10:28:48 +01:00
Benjamin Tissoires
599fb2ab2a Merge branch 'for-6.1/amd_sfh' into for-linus
- reduce verbosity of amd_sfh driver (Basavaraj Natikar)
- better handling of devices with SFH1.1 (Basavaraj Natikar)
2022-10-05 10:27:18 +01:00
Benjamin Tissoires
b320467e27 Merge branch 'for-6.1/multitouch' into for-linus
- fix broken atomic checks by adding memory barriers (Andri Yngvason)
2022-10-05 10:26:15 +01:00
Benjamin Tissoires
684e00cfc6 Merge branch 'for-6.1/sony' into for-linus
- playstation: convert to use dev_groups (Greg Kroah-Hartman)
2022-10-05 10:25:06 +01:00
Benjamin Tissoires
edd1533d3c Merge branch 'for-6.1/logitech' into for-linus
- Add hanlding of all Bluetooth HID++ devices and fixes in hid++
  (Bastien Nocera)
2022-10-05 10:21:55 +01:00
Benjamin Tissoires
7d8fe4cfc5 Merge branch 'for-6.1/core' into for-linus
- move from strlcpy with unused retval to strscpy (Wolfram Sang)
- Kconfig fixes (Randy Dunlap)
- HID-BPF preparatory patches, convert blank defines as enums (Benjamin
  Tissoires)
2022-10-05 10:19:06 +01:00
Ping Cheng
bfdc750c4c HID: wacom: add three styli to wacom_intuos_get_tool_type
We forgot to add the 3D pen ID a year ago. There are two new pro pen
IDs to be added.

Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-09-30 11:08:15 +02:00
Basavaraj Natikar
68266bdcce HID: amd_sfh: Handle condition of "no sensors" for SFH1.1
Based on num_hid_devices, each sensor device registers to HID. If
"no sensors" then amd_sfh work initialization and scheduling
doesn’t make sense and return ENODEV to stop driver probe.
Hence add a check for num_hid_devices to handle special
case in the situation of "no sensors" for SFH1.1.

Fixes: 93ce5e0231 ("HID: amd_sfh: Implement SFH1.1 functionality")
Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-09-30 10:31:18 +02:00
Basavaraj Natikar
beb18bb22c HID: amd_sfh: Change dev_err to dev_dbg for additional debug info
Users should only be notified at most one time on systems doesn't have
any sensors connected or non-supported systems.

Check the return code and don't display error messages in those
conditions.

Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-09-30 10:31:18 +02:00
Nate Yocom
1260cd04a6 Input: add ABS_PROFILE to uapi and documentation
Define new ABS_PROFILE axis for input devices which need it, e.g. X-Box
Adaptive Controller and X-Box Elite 2.

Signed-off-by: Nate Yocom <nate@yocom.org>
Link: https://lore.kernel.org/r/20220908173930.28940-4-nate@yocom.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2022-09-28 18:31:37 -07:00
Johnothan King
50503e360e HID: nintendo: check analog user calibration for plausibility
Arne Wendt writes:
  Cheap clone controllers may (falsely) report as having a user
  calibration for the analog sticks in place, but return
  wrong/impossible values for the actual calibration data.
  In the present case at mine, the controller reports having a
  user calibration in place and successfully executes the read
  commands. The reported user calibration however is
  min = center = max = 0.

  This pull request addresses problems of this kind by checking the
  provided user calibration-data for plausibility (min < center < max)
  and falling back to the default values if implausible.

I'll note that I was experiencing a crash because of this bug when using
the GuliKit KingKong 2 controller. The crash manifests as a divide by
zero error in the kernel logs:
kernel: divide error: 0000 [#1] PREEMPT SMP NOPTI

Link: https://github.com/nicman23/dkms-hid-nintendo/pull/25
Link: https://github.com/DanielOgorchock/linux/issues/36
Co-authored-by: Arne Wendt <arne.wendt@tuhh.de>
Signed-off-by: Johnothan King <johnothanking@protonmail.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/gvpL2G6VwXGJPvxX5KRiu9pVjvTivgayug_jdKDY6zfuAaAqncP9BkKLosjwUXNlgVVTMfJSKfwPF1K79cKAkwGComyC21vCV3q9B3EXNkE=@protonmail.com
2022-09-21 13:25:26 +01:00
Icenowy Zheng
8b30fb40f8 HID: nintendo: deregister home LED when it fails
Some Pro Controller compatible controllers do not support home LED, and
will fail when setting it. Currently this leads to probe failure.

Change the code that fails probing to deregistering home LED.

Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
Reviewed-by: Daniel J. Ogorchock <djogorchock@gmail.com>
Reviewed-by: Silvan Jegen <s.jegen@gmail.com>
[bentiss: changed "dflt" to "default"]
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20220415100432.23453-1-icenowy@aosc.io
2022-09-21 09:48:23 +01:00
Hyunwoo Kim
cacdb14b1c HID: roccat: Fix use-after-free in roccat_read()
roccat_report_event() is responsible for registering
roccat-related reports in struct roccat_device.

int roccat_report_event(int minor, u8 const *data)
{
	struct roccat_device *device;
	struct roccat_reader *reader;
	struct roccat_report *report;
	uint8_t *new_value;

	device = devices[minor];

	new_value = kmemdup(data, device->report_size, GFP_ATOMIC);
	if (!new_value)
		return -ENOMEM;

	report = &device->cbuf[device->cbuf_end];

	/* passing NULL is safe */
	kfree(report->value);
	...

The registered report is stored in the struct roccat_device member
"struct roccat_report cbuf[ROCCAT_CBUF_SIZE];".
If more reports are received than the "ROCCAT_CBUF_SIZE" value,
kfree() the saved report from cbuf[0] and allocates a new reprot.
Since there is no lock when this kfree() is performed,
kfree() can be performed even while reading the saved report.

static ssize_t roccat_read(struct file *file, char __user *buffer,
		size_t count, loff_t *ppos)
{
	struct roccat_reader *reader = file->private_data;
	struct roccat_device *device = reader->device;
	struct roccat_report *report;
	ssize_t retval = 0, len;
	DECLARE_WAITQUEUE(wait, current);

	mutex_lock(&device->cbuf_lock);

	...

	report = &device->cbuf[reader->cbuf_start];
	/*
	 * If report is larger than requested amount of data, rest of report
	 * is lost!
	 */
	len = device->report_size > count ? count : device->report_size;

	if (copy_to_user(buffer, report->value, len)) {
		retval = -EFAULT;
		goto exit_unlock;
	}
	...

The roccat_read() function receives the device->cbuf report and
delivers it to the user through copy_to_user().
If the N+ROCCAT_CBUF_SIZE th report is received while copying of
the Nth report->value is in progress, the pointer that copy_to_user()
is working on is kfree()ed and UAF read may occur. (race condition)

Since the device node of this driver does not set separate permissions,
this is not a security vulnerability, but because it is used for
requesting screen display of profile or dpi settings,
a user using the roccat device can apply udev to this device node or
There is a possibility to use it by giving.

Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-09-20 14:49:15 +02:00
Harry Stern
a109d5c45b hid: topre: Add driver fixing report descriptor
The Topre REALFORCE R2 firmware incorrectly reports that interface
descriptor number 1, input report descriptor 2's events are array events
rather than variable events. That particular report descriptor is used
to report keypresses when there are more than 6 keys held at a time.
This bug prevents events from this interface from being registered
properly, so only 6 keypresses (from a different interface) can be
registered at once, rather than full n-key rollover.

This commit fixes the bug by setting the correct value in a report_fixup
function.

The original bug report can be found here:
Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/804

Thanks to Benjamin Tissoires for diagnosing the issue with the report
descriptor.

Signed-off-by: Harry Stern <harry@harrystern.net>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20220911003614.297613-1-harry@harrystern.net
2022-09-20 12:16:25 +01:00
Andri Yngvason
be6e2b5734 HID: multitouch: Add memory barriers
This fixes broken atomic checks which cause a race between the
release-timer and processing of hid input.

I noticed that contacts were sometimes sticking, even with the "sticky
fingers" quirk enabled. This fixes that problem.

Cc: stable@vger.kernel.org
Fixes: 9609827458 ("HID: multitouch: optimize the sticky fingers timer")
Signed-off-by: Andri Yngvason <andri@yngvason.is>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20220907150159.2285460-1-andri@yngvason.is
2022-09-20 12:13:40 +01:00
Benjamin Tissoires
735e1bb1b8 HID: convert defines of HID class requests into a proper enum
This allows to export the type in BTF and so in the automatically
generated vmlinux.h. It will also add some static checks on the users
when we change the ll driver API (see not below).

Note that we need to also do change in the ll_driver API, but given
that this will have a wider impact outside of this tree, we leave this
as a TODO for the future.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20220902132938.2409206-11-benjamin.tissoires@redhat.com
2022-09-20 11:53:32 +01:00
Benjamin Tissoires
ead77b65ae HID: export hid_report_type to uapi
When we are dealing with eBPF, we need to have access to the report type.
Currently our implementation differs from the USB standard, making it
impossible for users to know the exact value besides hardcoding it
themselves.

And instead of a blank define, convert it as an enum.

Note that we need to also do change in the ll_driver API, but given
that this will have a wider impact outside of this tree, we leave this
as a TODO for the future.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20220902132938.2409206-10-benjamin.tissoires@redhat.com
2022-09-20 11:53:32 +01:00
Benjamin Tissoires
1e839143d6 HID: core: store the unique system identifier in hid_device
This unique identifier is currently used only for ensuring uniqueness in
sysfs. However, this could be handful for userspace to refer to a specific
hid_device by this id.

2 use cases are in my mind: LEDs (and their naming convention), and
HID-BPF.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20220902132938.2409206-9-benjamin.tissoires@redhat.com
2022-09-20 11:53:32 +01:00
Marcus Folkesson
acc3e34613 HID: Add driver for PhoenixRC Flight Controller
The PhoenixRC is a controller with 8 channels for use in flight
simulators.

Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20220914184345.270456-1-marcus.folkesson@gmail.com
2022-09-20 11:36:21 +01:00
Marcus Folkesson
2c5e8e6140 HID: Add driver for VRC-2 Car Controller
VRC-2 is 2-axis controller often used in car simulators.

Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20220902082552.2433744-2-marcus.folkesson@gmail.com
2022-09-20 11:35:00 +01:00
Shaomin Deng
454d243a00 HID: sony: Fix double word in comments
Remove the repeated word "not" in comments.

Signed-off-by: Shaomin Deng <dengshaomin@cdjrlc.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20220904154515.25143-1-dengshaomin@cdjrlc.com
2022-09-20 11:27:29 +01:00
Hangyu Hua
98d67f2504 hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event
hidpp->delayed_input can't be assigned to an object that already call
input_free_device when input_register_device fails.

Fixes: c39e3d5fc9 ("HID: logitech-hidpp: late bind the input device on wireless connection")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20220812025515.19467-1-hbh25y@gmail.com
2022-09-20 11:24:30 +01:00
Bastien Nocera
908d325e16 HID: logitech-hidpp: Detect hi-res scrolling support
Rather than relying on a never-ending stream of patches for quirks.

This change will detect whether HID++ 1.0 hi-res scroll, HID++ 2.0
hi-res scroll or HID++ 2.0 hi-res scroll wheel is supported, and enable
the feature without the need for quirks.

Tested on a Logitech M705 mouse that was unsupported before this change.

[    9.365324] logitech-hidpp-device 0003:046D:406D.0006: input,hidraw3: USB HID v1.11 Mouse [Logitech M705] on usb-0000:00:14.0-4/input2:3
[   57.472434] logitech-hidpp-device 0003:046D:406D.0006: HID++ 4.5 device connected.
[   57.616429] logitech-hidpp-device 0003:046D:406D.0006: Detected HID++ 2.0 hi-res scroll wheel
[   57.712424] logitech-hidpp-device 0003:046D:406D.0006: wheel multiplier = 8

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216480
Signed-off-by: Bastien Nocera <hadess@hadess.net>
Reviewed-by: Harry Cutts <hcutts@chromium.org>
Tested-by: Peter F. Patel-Schneider <pfpschneider@gmail.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20220914132146.6435-1-hadess@hadess.net
2022-09-20 11:15:03 +01:00
Wolfram Sang
d819524d31 Merge tag 'v6.0-rc5' into i2c/for-mergewindow
Linux 6.0-rc5
2022-09-16 20:42:18 +01:00
Bastien Nocera
0799617f38 HID: logitech-hidpp: Remove hard-coded "Sw. Id." for HID++ 2.0 commands
Some HID++ 2.0 commands had correctly set a non-zero software identifier
directly as part of their function identifiers, but it's more correct to
define the function identifier and the software identifier separately
before combined them when the command is sent.

As this is now done in the previous commit, remove the hard-coded 0x1
software identifiers in the function definitions.

Signed-off-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-09-07 22:07:49 +02:00
Bastien Nocera
f7b7393cc3 HID: logitech-hidpp: Fix "Sw. Id." for HID++ 2.0 commands
Always set a non-zero "Sw. Id." in the lower nibble of the Function/ASE
and Software Identifier byte in HID++ 2.0 commands.

As per the "Protocol HID++2.0 essential features" section in
https://lekensteyn.nl/files/logitech/logitech_hidpp_2.0_specification_draft_2012-06-04.pdf
"
Software identifier (4 bits, unsigned)

A number uniquely defining the software that sends a request. The
firmware must copy the software identifier in the response but does
not use it in any other ways.

0 Do not use (allows to distinguish a notification from a response).
"

Link: https://bugzilla.kernel.org/show_bug.cgi?id=215699
Signed-off-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-09-07 22:07:49 +02:00
Bastien Nocera
8544c812e4 HID: logitech-hidpp: Remove special-casing of Bluetooth devices
Now that all the Logitech Bluetooth devices are probed for HID++
support, remove the handling of those 2 devices without any quirks, as
they're duplicates.

Signed-off-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-09-07 22:07:49 +02:00
Bastien Nocera
532223c8ac HID: logitech-hidpp: Enable HID++ for all the Logitech Bluetooth devices
Probe for HID++ support over Bluetooth for all the Logitech Bluetooth
devices. As Logitech doesn't have a list of Bluetooth devices that
support HID++ over Bluetooth, probe every device. The HID++ driver
will fall back to plain HID if the device does not support HID++,
or to a another device-specific driver if it is part of the
unhandled_hidpp_devices array, used in the match function.

Note that this change might cause upower to export 2 batteries for
certain Bluetooth LE devices which export their battery information
through the Bluetooth BATT profile. This particular bug is tracked at:
https://gitlab.freedesktop.org/upower/upower/-/issues/166

Tested with a Logitech Signature M650 mouse, over Bluetooth

Signed-off-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-09-07 22:07:49 +02:00
Bastien Nocera
80305f97c3 HID: core: Export hid_match_id()
Export hid_match_id() so it can be used in device-specific drivers to
implement their own matching with open-coding a match function.

Signed-off-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-09-07 22:07:49 +02:00
Ping Cheng
0627f3df95 HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs
Add the new PIDs to wacom_wac.c to support the new model in the Intuos Pro series.

Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
Tested-by: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-09-02 12:00:24 +02:00
Linus Torvalds
a1f764268f for-linus-2022083101
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIVAwUAYw88R6Zi849r7WBJAQIXvQ/9EceSzn/m8bUV01Pzf6wmJs/vKprm0BJt
 6MPON2bDlBDVn2GgivoA7+Kya7awAyE+4498djR/Qg6W3MX3yp6x6/aD6jj0bZrR
 GV2quGw9MiShydOosFcBVoYy5TFgUS3F8otQ3sf8uJMlyzt7I7b9hsnY1MbkG9He
 hhGNBuzVw07OPQnSm6hebqrpfOZUsFVqxzjhzrcYkq35bnMiIyx9hYypdld77tSp
 9w1BGcxk//i7SIo7wLoHqPg2xnC4yxwdspim/dLy91twqnJAAbQlnQeDcmlhe03G
 IeBfvLEyatQ7A/lFzFQkssRKyxfnvvrNOrSvj5T3TeaHDl0vUCWEB6n105MWEbHR
 YvgNywl8kAw/s6Abf+qQ3KQDcPyS5PMVJV2toNK64KLePaKnkkUyobROiHNMVKtQ
 /4Skv/8AQGua7XO6DeOPf9yEM8JO1uHtpcNoOJn6vkBGNiI4NfYOx126LMO879gp
 darAowkN13fLbhUHyeQ4SsXB/inM6RxaR977Lx685I54S5JjYtYaGZ3BNzcj7w7D
 c07uNG74FWJG5ZWY2/34I/p3UocsYY7JnbKqaJp9WtWl1OxXRMraSfI9oMeAHRXD
 Mq/vuu2kVybUYOKsLimBlodMBcaptH5L4CX7zE1vv3LBD7dAy3uhIf0CrCVmrpC7
 rvcKioCNaPQ=
 =ckOe
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-2022083101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

Pull HID fixes from Jiri Kosina:

 - NULL pointer dereference fix for Steam driver (Lee Jones)

 - memory leak fix for hidraw (Karthik Alapati)

 - regression fix for functionality of some UCLogic tables (Benjamin
   Tissoires)

 - a few new device IDs and device-specific quirks

* tag 'for-linus-2022083101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  HID: nintendo: fix rumble worker null pointer deref
  HID: intel-ish-hid: ipc: Add Meteor Lake PCI device ID
  HID: input: fix uclogic tablets
  HID: Add Apple Touchbar on T2 Macs in hid_have_special_driver list
  HID: add Lenovo Yoga C630 battery quirk
  HID: AMD_SFH: Add a DMI quirk entry for Chromebooks
  HID: thrustmaster: Add sparco wheel and fix array length
  hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message
  HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo
  HID: asus: ROG NKey: Ignore portion of 0x5a report
  HID: hidraw: fix memory leak in hidraw_release()
  HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
2022-08-31 09:54:14 -07:00
Daniel J. Ogorchock
1ff89e06c2 HID: nintendo: fix rumble worker null pointer deref
We can dereference a null pointer trying to queue work to a destroyed
workqueue.

If the device is disconnected, nintendo_hid_remove is called, in which
the rumble_queue is destroyed. Avoid using that queue to defer rumble
work once the controller state is set to JOYCON_CTLR_STATE_REMOVED.

This eliminates the null pointer dereference.

Signed-off-by: Daniel J. Ogorchock <djogorchock@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25 15:15:17 +02:00
Even Xu
467249a7df HID: intel-ish-hid: ipc: Add Meteor Lake PCI device ID
Add device ID of Meteor Lake P into ishtp support list.

Signed-off-by: Even Xu <even.xu@intel.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25 15:03:15 +02:00
Benjamin Tissoires
8db8be9cfc HID: input: fix uclogic tablets
commit 87562fcd13 ("HID: input: remove the need for HID_QUIRK_INVERT")
made the assumption that it was the only one handling tablets and thus
kept an internal state regarding the tool.

Turns out that the uclogic driver has a timer to release the in range
bit, effectively making hid-input ignoring all in range information
after the very first one.

Fix that by having a more rationale approach which consists in forwarding
every event and let the input stack filter out the duplicates.

Reported-by: Stefan Hansson <newbie13xd@gmail.com>
Fixes: 87562fcd13 ("HID: input: remove the need for HID_QUIRK_INVERT")
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25 11:46:55 +02:00
Aditya Garg
750ec97728 HID: Add Apple Touchbar on T2 Macs in hid_have_special_driver list
The touchbar on Apple T2 Macs has 2 modes, one that shows the function
keys and other that shows the media controls. The user can use the fn
key on his keyboard to switch between the 2 modes.

On Linux, if people were using an external keyboard or mouse, the
touchbar failed to change modes on pressing the fn key with the following
in dmesg :-

[   10.661445] apple-ib-als 0003:05AC:8262.0001: : USB HID v1.01 Device [Apple Inc. Ambient Light Sensor] on usb-bce-vhci-3/input0
[   11.830992] apple-ib-touchbar 0003:05AC:8302.0007: input: USB HID v1.01 Keyboard [Apple Inc. Touch Bar Display] on usb-bce-vhci-6/input0
[   12.139407] apple-ib-touchbar 0003:05AC:8102.0008: : USB HID v1.01 Device [Apple Inc. Touch Bar Backlight] on usb-bce-vhci-7/input0
[   12.211824] apple-ib-touchbar 0003:05AC:8102.0009: : USB HID v1.01 Device [Apple Inc. Touch Bar Backlight] on usb-bce-vhci-7/input1
[   14.219759] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 2 (-110)
[   24.395670] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 2 (-110)
[   34.635791] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 2 (-110)
[  269.579233] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 1 (-110)

Add the USB IDs of the touchbar found in T2 Macs to HID have special
driver list to fix the issue.

Signed-off-by: Aditya Garg <gargaditya08@live.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25 11:46:15 +02:00
Steev Klimaszewski
3a47fa7b14 HID: add Lenovo Yoga C630 battery quirk
Similar to the Surface Go devices, the Elantech touchscreen/digitizer in
the Lenovo Yoga C630 mistakenly reports the battery of the stylus, and
always reports an empty battery.

Apply the HID_BATTERY_QUIRK_IGNORE quirk to ignore this battery and
prevent the erroneous low battery warnings.

Signed-off-by: Steev Klimaszewski <steev@kali.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25 11:45:14 +02:00
Wolfram Sang
eeeec27d68 HID: move from strlcpy with unused retval to strscpy
Follow the advice of the below link and prefer 'strscpy' in this
subsystem. Conversion is 1:1 because the return value is not used.
Generated by a coccinelle script.

Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25 11:44:27 +02:00
Akihiko Odaki
adada3f493 HID: AMD_SFH: Add a DMI quirk entry for Chromebooks
Google Chromebooks use Chrome OS Embedded Controller Sensor Hub instead
of Sensor Hub Fusion and leaves MP2 uninitialized, which disables all
functionalities, even including the registers necessary for feature
detections.

The behavior was observed with Lenovo ThinkPad C13 Yoga.

Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com>
Suggested-by: Mario Limonciello <mario.limonciello@amd.com>
Acked-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25 11:42:54 +02:00
Michael Hübner
d9a17651f3 HID: thrustmaster: Add sparco wheel and fix array length
Add device id for the Sparco R383 Mod wheel.

Fix wheel info array length to match actual wheel count present in the array.

Signed-off-by: Michael Hübner <michaelh.95@t-online.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25 11:38:55 +02:00
Greg Kroah-Hartman
9f4441fcbb HID: vivaldi: convert to use dev_groups
There is no need for a driver to individually add/create device groups,
the driver core will do it automatically for you.  Convert the
hid-vivaldi core driver to use the dev_groups pointer instead of
manually calling the driver core to create the group and have it be
cleaned up later on by the devm core.

Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: linux-input@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25 11:37:21 +02:00
Even Xu
e1fa076706 hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message
There is a timing issue captured during ishtp client sending stress tests.
It was observed during stress tests that ISH firmware is getting out of
ordered messages. This is a rare scenario as the current set of ISH client
drivers don't send much data to firmware. But this may not be the case
going forward.

When message size is bigger than IPC MTU, ishtp splits the message into
fragments and uses serialized async method to send message fragments.
The call stack:
ishtp_cl_send_msg_ipc->ipc_tx_callback(first fregment)->
ishtp_send_msg(with callback)->write_ipc_to_queue->
write_ipc_from_queue->callback->ipc_tx_callback(next fregment)......

When an ipc write complete interrupt is received, driver also calls
write_ipc_from_queue->ipc_tx_callback in ISR to start sending of next fragment.

Through ipc_tx_callback uses spin_lock to protect message splitting, as the
serialized sending method will call back to ipc_tx_callback again, so it doesn't
put sending under spin_lock, it causes driver cannot guarantee all fragments
be sent in order.

Considering this scenario:
ipc_tx_callback just finished a fragment splitting, and not call ishtp_send_msg
yet, there is a write complete interrupt happens, then ISR->write_ipc_from_queue
->ipc_tx_callback->ishtp_send_msg->write_ipc_to_queue......

Because ISR has higher exec priority than normal thread, this causes the new
fragment be sent out before previous fragment. This disordered message causes
invalid message to firmware.

The solution is, to send fragments synchronously:
Use ishtp_write_message writing fragments into tx queue directly one by one,
instead of ishtp_send_msg only writing one fragment with completion callback.
As no completion callback be used, so change ipc_tx_callback to ipc_tx_send.

Signed-off-by: Even Xu <even.xu@intel.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25 11:35:44 +02:00
Jason Wang
94553f8a21 HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo
The double `like' is duplicated in the comment, remove one.

Signed-off-by: Jason Wang <wangborong@cdjrlc.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2022-08-25 11:35:44 +02:00