Commit Graph

3326 Commits

Author SHA1 Message Date
Linus Torvalds 24dc83635f This is the bulk of GPIO changes for the v4.21 kernel series:
Core changes:
 
 - Some core changes are already in outside of this pull
   request as they came through the regulator tree, most
   notably devm_gpiod_unhinge() that removes devres refcount
   management from a GPIO descriptor. This is needed in
   subsystems such as regulators where the regulator core
   need to take over the reference counting and lifecycle
   management for a GPIO descriptor.
 
 - We dropped devm_gpiochip_remove() and devm_gpio_chip_match()
   as nothing needs it. We can bring it back if need be.
 
 - Add a global TODO so people see where we are going. This
   helps setting the direction now that we are two GPIO
   maintainers.
 
 - Handle the MMC CD/WP properties in the device tree core.
   (The bulk of patches activating this code is already
   merged through the MMC/SD tree.)
 
 - Augment gpiochip_request_own_desc() to pass a flag so
   we as gpiochips can request lines as active low or open
   drain etc even from ourselves.
 
 New drivers:
 
 - New driver for Cadence GPIO blocks.
 
 - New driver for Atmel SAMA5D2 PIOBU GPIO lines.
 
 Driver improvements:
 
 - A major refactoring of the PCA953x driver - this driver has
   been around for ages, and is now modernized to reduce code
   duplication that has stacked up and is using regmap to read
   write and cache registers.
 
 - Intel drivers are now maintained in a separate tree and
   start with a round of cleanups and unifications.
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJcJJcmAAoJEEEQszewGV1zdCoQAMSLPh+4QdYLFS3ZmnsPvZkg
 Zkz94RVT+uLLmHpR8XBl0wl4mmYCiwB50IwsXwlvJGceSXjCn6hLg9BZBP5hFMCb
 yFk3fgXQSh7TOnpjgbCWSssCjpejQ0cOb/2nWHz5s/fbYKYlh3VXckW9hhW+R+b3
 6+Mno1SzmBkpVVQ21ISlZeLoNDynkCW6DfjiKMuHAyxzxa0oZ9Qid+tnVDnQM4rD
 rCnvYLuvxlXw97W+LI7AU9KoCITdO+2M/0dtGVEEYKfHseRReSy2Oo3nlqCglygX
 cNkBe9RYU1CJdas1P/c18wjDAqWp/pbugzHDkYF5Y3tBtB2rQSftjtnQngiVMXMt
 De7ejPvL7/OLECvI2WUD6y9NAduw/HE4FO8BBdn0gP/a9svJpVZ993yPd3F9n7EZ
 ZIBpycDZVtkcE7dwQgek17bFILRY5nBBMB9oCLL2wk48qdmjpcAbxVfGSsYOe6wO
 +cZRZuj/eR3i9gHRugfFx7Evoc7l4erihTpES/YAy3De1s3uV8KjT4zE7Jh+M9LW
 GM797BcXJJeb5toC7HZ/G2UAVMyWEhY0n7PGG616CS8IrzmzIZpJOL9kUVOWPb0F
 9CPt6qhVbUl9rxp1H/Z3TxvYqIw6icn/z5YewZxLU1zaBlpE3jc7PhZb5hOGnFUf
 /DWwe4n99JsjHTrGx1ra
 =05LW
 -----END PGP SIGNATURE-----

Merge tag 'gpio-v4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio

Pull GPIO updates from Linus Walleij:
 "This is the bulk of GPIO changes for the v4.21 kernel series.

  Core changes:

   - Some core changes are already in outside of this pull request as
     they came through the regulator tree, most notably
     devm_gpiod_unhinge() that removes devres refcount management from a
     GPIO descriptor. This is needed in subsystems such as regulators
     where the regulator core need to take over the reference counting
     and lifecycle management for a GPIO descriptor.

   - We dropped devm_gpiochip_remove() and devm_gpio_chip_match() as
     nothing needs it. We can bring it back if need be.

   - Add a global TODO so people see where we are going. This helps
     setting the direction now that we are two GPIO maintainers.

   - Handle the MMC CD/WP properties in the device tree core. (The bulk
     of patches activating this code is already merged through the
     MMC/SD tree.)

   - Augment gpiochip_request_own_desc() to pass a flag so we as
     gpiochips can request lines as active low or open drain etc even
     from ourselves.

  New drivers:

   - New driver for Cadence GPIO blocks.

   - New driver for Atmel SAMA5D2 PIOBU GPIO lines.

  Driver improvements:

   - A major refactoring of the PCA953x driver - this driver has been
     around for ages, and is now modernized to reduce code duplication
     that has stacked up and is using regmap to read write and cache
     registers.

   - Intel drivers are now maintained in a separate tree and start with
     a round of cleanups and unifications"

* tag 'gpio-v4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (99 commits)
  gpio: sama5d2-piobu: Depend on OF_GPIO
  gpio: Add Cadence GPIO driver
  dt-bindings: gpio: Add bindings for Cadence GPIO
  gpiolib-acpi: remove unused variable 'err', cleans up build warning
  gpio: mxs: read pin level directly instead of using .get
  gpio: aspeed: remove duplicated statement
  gpio: add driver for SAMA5D2 PIOBU pins
  dt-bindings: arm: atmel: describe SECUMOD usage as a GPIO controller
  gpio/mmc/of: Respect polarity in the device tree
  dt-bindings: gpio: rcar: Add r8a774c0 (RZ/G2E) support
  memory: omap-gpmc: Get the header of the enum
  ARM: omap1: Fix new user of gpiochip_request_own_desc()
  gpio: pca953x: Add regmap dependency for PCA953x driver
  gpio: raspberrypi-exp: decrease refcount on firmware dt node
  gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB
  gpio: pca953x: Restore registers after suspend/resume cycle
  gpio: pca953x: Zap single use of pca953x_read_single()
  gpio: pca953x: Zap ad-hoc reg_output cache
  gpio: pca953x: Zap ad-hoc reg_direction cache
  gpio: pca953x: Perform basic regmap conversion
  ...
2018-12-28 20:00:21 -08:00
Linus Walleij 21abf10381 gpio: Pass a flag to gpiochip_request_own_desc()
Before things go out of hand, make it possible to pass
flags when requesting "own" descriptors from a gpio_chip.
This is necessary if the chip wants to request a GPIO with
active low semantics, for example.

Cc: Janusz Krzysztofik <jmkrzyszt@gmail.com>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Jason Cooper <jason@lakedaemon.net>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Roger Quadros <rogerq@ti.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2018-12-14 14:24:33 +01:00
Linus Torvalds f5d582777b Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
Pull HID subsystem fixes from Jiri Kosina:

 - two device-specific quirks from Hans de Goede and Nic Soudée

 - reintroduction of (mistakenly remocved) ABS_RESERVED from Peter
   Hutterer

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
  Input: restore EV_ABS ABS_RESERVED
  HID: quirks: fix RetroUSB.com devices
  HID: ite: Add USB id match for another ITE based keyboard rfkill key quirk
2018-12-10 11:04:41 -08:00
Nic Soudée 868613f1c0 HID: quirks: fix RetroUSB.com devices
SNES RetroPort and RetroPad register only 4 gamepad buttons
when they should register all 8 buttons. This is described here:

https://ask.fedoraproject.org/en/question/128102

This is happening because of:

Commit 190d7f02ce ("HID: input: do not increment usages when
    duplicate is found")

Here, I add the quirk HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE
(created for backward compatibility with the change in 190d7f02ce)
for the two products.

Tested with both RetroPort and RetroPad.

Cc: stable@vger.kernel.org  # v4.18+

Signed-off-by: Nic Soudée <nsoudee@gmail.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
2018-12-07 14:12:34 +01:00
Linus Torvalds adac0753c2 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input updates from Dmitry Torokhov:
 "Mostly new IDs for Elan/Synaptics touchpads, plus a few small fixups"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: omap-keypad - fix keyboard debounce configuration
  Input: xpad - quirk all PDP Xbox One gamepads
  Input: synaptics - enable SMBus for HP 15-ay000
  Input: synaptics - add PNP ID for ThinkPad P50 to SMBus
  Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15ARR
  Input: elan_i2c - add support for ELAN0621 touchpad
  Input: hyper-v - fix wakeup from suspend-to-idle
  Input: atkbd - clean up indentation issue
  Input: st1232 - convert to SPDX identifiers
  Input: migor_ts - convert to SPDX identifiers
  Input: dt-bindings - fix a typo in file input-reset.txt
  Input: cros_ec_keyb - fix button/switch capability reports
  Input: elan_i2c - add ELAN0620 to the ACPI table
  Input: matrix_keypad - check for errors from of_get_named_gpio()
2018-12-04 08:47:04 -08:00
Linus Torvalds cd9a043323 Staging and IIO driver fixes for 4.20-rc5
Here are some small IIO and Staging driver fixes for 4.20-rc5.
 
 Nothing major, the IIO fix ended up touching the HID drivers at the same
 time, but the HID maintainer acked it.  The staging fixes are all minor
 patches for reported issues and regressions, full details are in the
 shortlog.
 
 All of these have been in linux-next for a while with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCXAFeeA8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ykZSQCgm8wafCzK2b9YjeUmAxFJQCKkK7YAnjHSqa8N
 FwSpP/zei0mtZgw6Rzj9
 =cBhw
 -----END PGP SIGNATURE-----

Merge tag 'staging-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging and IIO driver fixes from Greg KH:
 "Here are some small IIO and staging driver fixes for 4.20-rc5.

  Nothing major, the IIO fix ended up touching the HID drivers at the
  same time, but the HID maintainer acked it. The staging fixes are all
  minor patches for reported issues and regressions, full details are in
  the shortlog.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'staging-4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed numbers
  staging: vchiq_arm: fix compat VCHIQ_IOC_AWAIT_COMPLETION
  staging: mt7621-pinctrl: fix uninitialized variable ngroups
  staging: rtl8723bs: Add missing return for cfg80211_rtw_get_station
  staging: most: use format specifier "%s" in snprintf
  staging: rtl8723bs: Fix incorrect sense of ether_addr_equal
  staging: mt7621-dma: fix potentially dereferencing uninitialized 'tx_desc'
  staging: comedi: clarify/unify macros for NI macro-defined terminals
  drivers: staging: cedrus: find ctx before dereferencing it ctx
  staging: rtl8723bs: Fix the return value in case of error in 'rtw_wx_read32()'
  staging: comedi: ni_mio_common: scale ao INSN_CONFIG_GET_CMD_TIMING_CONSTRAINTS
  iio:st_magn: Fix enable device after trigger
2018-11-30 12:23:44 -08:00
Hans de Goede 4050207485 HID: ite: Add USB id match for another ITE based keyboard rfkill key quirk
The 258a:6a88 keyboard-dock shipped with the Prowise PT301 tablet is
likely another ITE based design. The controller die is directly bonded
to the PCB with a blob of black glue on top so there are no markings and
the 258a vendor-id used is unknown anywhere. But the keyboard has the
exact same hotkeys mapped to Fn+F1 - F10 as the other ITE8595 keyboard
I have *and* it has the same quirky behavior wrt the rfkill hotkey.

Either way as said this keyboard has the same quirk for its rfkill /
airplane mode hotkey as the ITE 8595 chip, it only sends a single release
event when pressed and released, it never sends a press event.

This commit adds the 258a:6a88 USB id to the hid-ite id-table, fixing
the rfkill key not working on this keyboard.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
2018-11-30 14:12:07 +01:00
Greg Kroah-Hartman c648284f6c First set of IIO fixes for the 4.20 cycle.
* st_magn
   - Avoid an ordering issue that lead to large numbers of unhandled
     interrupts whilst enabling buffered capture.
 * hid-sensors
   - Fix a long running problem with signed values reading wrong from
     sysfs on these sensors.   It appears people were only using the
     buffered interface.  These typically occur in laptops so chances
     are everyone was using the sensor-proxy which will use the buffered
     interface by default.
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCAAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAlv1r1ARHGppYzIzQGtl
 cm5lbC5vcmcACgkQVIU0mcT0FoihlRAAqx5iw5FZIQaWtrjJ2FTF4TvJ0aXOtQng
 vnDi8ofOCOZR7TIv/MWGMlOt0dX0ncnDvyGRzXSJi06+UtiyQDBPQ3anDsY3kTsO
 hhlt8QU5Z7Pwtma7jCP0hHtBH3R1/+EbIQd48UrpyhfLl4ZYm2zPoYOeTdbwuXiZ
 moecxZ3+Vd+jwVJXmAo5swvjbk4BNWD9rRPquYkaOGtKv6JeNyfbsjKSHfCuAzt9
 yYVzIay9ASQ+n7KH0BwtzIcoFZ0DUIPDbH6FbYBP5AUtGK1CX5s5Fng65dUljeXZ
 QqV2hOtLfL3ZMCVx+mdeIO+lczXkV69yqnWyQu5H+c46XzxbpNeGc6QFM4sVCgWX
 qFiW7vDZD8eu69KttFQMpz0qpVIh8Tyo4T/16J6E8QEJ2PwiJ87cnjmjjsuBujDW
 ijNLIop2+wE6OLeHUSRUQJm+cLOB5LhXAeIFxLVIzIpINOboAYdn6REOExXW7rvv
 TGWIMN1umN+9wBN+wNrJ4OmsnIDYtFTcsRVUtSzeg3axYnsweswGsLyOllxq0u6N
 viwtJdONYapNrf3Y4sUKlUUqR/DhDDJBGslhsgLxmtmf8vAojebG9XB3+RzAGXG7
 MlJRn5GQRnNiMr3D5x2NVCX2bkR0tg4n4ihYT9kXjJO0NtnBWRReRe1XkgYlH+JW
 UzZIgz2fCIw=
 =nVLE
 -----END PGP SIGNATURE-----

Merge tag 'iio-fixes-for-4.20a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus

Jonathan writes:

First set of IIO fixes for the 4.20 cycle.

* st_magn
  - Avoid an ordering issue that lead to large numbers of unhandled
    interrupts whilst enabling buffered capture.
* hid-sensors
  - Fix a long running problem with signed values reading wrong from
    sysfs on these sensors.   It appears people were only using the
    buffered interface.  These typically occur in laptops so chances
    are everyone was using the sensor-proxy which will use the buffered
    interface by default.

* tag 'iio-fixes-for-4.20a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio:
  iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed numbers
  iio:st_magn: Fix enable device after trigger
2018-11-22 09:37:36 +01:00
Benjamin Tissoires f1539a0c25 Revert "HID: input: Create a utility class for counting scroll events"
This reverts commit 1ff2e1a44e.

It turns out the current API is not that compatible with
some Microsoft mice, so better start again from scratch.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Harry Cutts <hcutts@chromium.org>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
2018-11-22 08:57:38 +01:00
Benjamin Tissoires 00acc9e2c4 Revert "HID: logitech: Add function to enable HID++ 1.0 "scrolling acceleration""
This reverts commit 051dc9b057.

It turns out the current API is not that compatible with
some Microsoft mice, so better start again from scratch.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Harry Cutts <hcutts@chromium.org>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
2018-11-22 08:57:33 +01:00
Benjamin Tissoires 5372fc3797 Revert "HID: logitech: Enable high-resolution scrolling on Logitech mice"
This reverts commit d56ca9855b.

It turns out the current API is not that compatible with
some Microsoft mice, so better start again from scratch.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Harry Cutts <hcutts@chromium.org>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
2018-11-22 08:57:27 +01:00
Benjamin Tissoires a69616d5b3 Revert "HID: logitech: Use LDJ_DEVICE macro for existing Logitech mice"
This reverts commit 3fe1d6bbcd.

It turns out the current API is not that compatible with
some Microsoft mice, so better start again from scratch.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Harry Cutts <hcutts@chromium.org>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
2018-11-22 08:57:21 +01:00
Benjamin Tissoires d0341efe74 Revert "HID: logitech: fix a used uninitialized GCC warning"
This reverts commit 5fe2ccbef9.

It turns out the current API is not that compatible with
some Microsoft mice, so better start again from scratch.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Harry Cutts <hcutts@chromium.org>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
2018-11-22 08:57:03 +01:00
Benjamin Tissoires e2b95b2719 Revert "HID: input: simplify/fix high-res scroll event handling"
This reverts commit 044ee89028.

It turns out the current API is not that compatible with
some Microsoft mice, so better start again from scratch.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Harry Cutts <hcutts@chromium.org>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
2018-11-22 08:56:04 +01:00
Sebastian Parschauer fb862c3b19 HID: Add quirk for Primax PIXART OEM mice
The PixArt OEM mice are known for disconnecting every minute in
runlevel 1 or 3 if they are not always polled. So add quirk
ALWAYS_POLL for two Primax mice as well.

0x4e22 is the Dell MS111-P and 0x4d0f is the unbranded HP Portia
mouse HP 697738-001. Both were built until approx. 2014.
Those were the standard mice from those vendors and are still
around - even as new old stock.

Reference: https://github.com/sriemer/fix-linux-mouse/issues/11

Signed-off-by: Sebastian Parschauer <sparschauer@suse.de>
CC: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-11-20 13:07:52 +01:00
Kai-Heng Feng 86c31524b2 HID: i2c-hid: Disable runtime PM for LG touchscreen
LG touchscreen (1fd2:8001) stops working after reboot:
[ 4.859153] i2c_hid i2c-SAPS2101:00: i2c_hid_get_input: incomplete report (64/66)
[ 4.936070] i2c_hid i2c-SAPS2101:00: i2c_hid_get_input: incomplete report (64/66)
[ 9.948224] i2c_hid i2c-SAPS2101:00: failed to reset device.

The device in question stops working after receives SLEEP, ON, SLEEP
commands in a short period. The scenario is like this:
- Once the desktop session closes, it also closed the hid device, so the
device gets runtime suspended and receives a SLEEP command.
- Before calling shutdown callback, it gets runtime resumed and received
an ON command.
- In the shutdown callback, it receives another SLEEP command.

I failed to find a reliable interval between ON/SLEEP commands that can
make it work, so let's simply disable runtime PM for the device.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-11-19 16:27:00 +01:00
Kai-Heng Feng 12d43aacf9 HID: multitouch: Add pointstick support for Cirque Touchpad
Cirque Touchpad/Pointstick combo is similar to Alps devices, it requires
MT_CLS_WIN_8_DUAL to expose its pointstick as a mouse.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-11-19 16:26:59 +01:00
Rodrigo Rivas Costa 385a488677 HID: steam: remove input device when a hid client is running.
Previously, when a HID client such as the Steam Client was running, this
driver disabled its input device to avoid doubling the input events.

While it worked mostly fine, some games got confused by the idle gamepad,
and switched to two player mode, or asked the user to choose which gamepad
to use. Other games just crashed, probably a bug in Unity [1].

With this commit, when a HID client starts, the input device is removed;
when the HID client ends the input device is recreated.

[1]: https://github.com/ValveSoftware/steam-for-linux/issues/5645

Signed-off-by: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-11-19 16:19:51 +01:00
David Herrmann 4d26d1d1e8 Revert "HID: uhid: use strlcpy() instead of strncpy()"
This reverts commit 336fd4f5f2.

Please note that `strlcpy()` does *NOT* do what you think it does.
strlcpy() *ALWAYS* reads the full input string, regardless of the
'length' parameter. That is, if the input is not zero-terminated,
strlcpy() will *READ* beyond input boundaries. It does this, because it
always returns the size it *would* copy if the target was big enough,
not the truncated size it actually copied.

The original code was perfectly fine. The hid device is
zero-initialized and the strncpy() functions copied up to n-1
characters. The result is always zero-terminated this way.

This is the third time someone tried to replace strncpy with strlcpy in
this function, and gets it wrong. I now added a comment that should at
least make people reconsider.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-11-19 14:32:27 +01:00
Eric Biggers 8c01db7619 HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges
When a UHID_CREATE command is written to the uhid char device, a
copy_from_user() is done from a user pointer embedded in the command.
When the address limit is KERNEL_DS, e.g. as is the case during
sys_sendfile(), this can read from kernel memory.  Alternatively,
information can be leaked from a setuid binary that is tricked to write
to the file descriptor.  Therefore, forbid UHID_CREATE in these cases.

No other commands in uhid_char_write() are affected by this bug and
UHID_CREATE is marked as "obsolete", so apply the restriction to
UHID_CREATE only rather than to uhid_char_write() entirely.

Thanks to Dmitry Vyukov for adding uhid definitions to syzkaller and to
Jann Horn for commit 9da3f2b740 ("x86/fault: BUG() when uaccess
helpers fault on kernel addresses"), allowing this bug to be found.

Reported-by: syzbot+72473edc9bf4eb1c6556@syzkaller.appspotmail.com
Fixes: d365c6cfd3 ("HID: uhid: add UHID_CREATE and UHID_DESTROY events")
Cc: <stable@vger.kernel.org> # v3.6+
Cc: Jann Horn <jannh@google.com>
Cc: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-11-19 14:25:15 +01:00
Hans de Goede 0145b50566 iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed numbers
Before this commit sensor_hub_input_attr_get_raw_value() failed to take
the signedness of 16 and 8 bit values into account, returning e.g.
65436 instead of -100 for the z-axis reading of an accelerometer.

This commit adds a new is_signed parameter to the function and makes all
callers pass the appropriate value for this.

While at it, this commit also fixes up some neighboring lines where
statements were needlessly split over 2 lines to improve readability.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2018-11-16 11:42:12 +00:00
Vitaly Kuznetsov 10f91c73cc Input: hyper-v - fix wakeup from suspend-to-idle
It makes little sense but still possible to put Hyper-V guests into
suspend-to-idle state. To wake them up two wakeup sources were registered
in the past: hyperv-keyboard and hid-hyperv. However, since
commit eed4d47efe ("ACPI / sleep: Ignore spurious SCI wakeups from
suspend-to-idle") pm_wakeup_event() from these devices is ignored. Switch
to pm_wakeup_hard_event() API as these devices are actually the only
possible way to wakeup Hyper-V guests.

Fixes: eed4d47efe (ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle)
Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: K. Y. Srinivasan <kys@microsoft.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2018-11-15 11:05:53 -08:00
Benson Leung 0fd791841a HID: input: Ignore battery reported by Symbol DS4308
The Motorola/Zebra Symbol DS4308-HD is a handheld USB barcode scanner
which does not have a battery, but reports one anyway that always has
capacity 2.

Let's apply the IGNORE quirk to prevent it from being treated like a
power supply so that userspaces don't get confused that this
accessory is almost out of power and warn the user that they need to charge
their wired barcode scanner.

Reported here: https://bugs.chromium.org/p/chromium/issues/detail?id=804720

Signed-off-by: Benson Leung <bleung@chromium.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
2018-11-12 10:08:46 +01:00
Sebastian Parschauer e82e62e390 HID: Add quirk for Microsoft PIXART OEM mouse
The PixArt OEM mice are known for disconnecting every minute in
runlevel 1 or 3 if they are not always polled. So add quirk
ALWAYS_POLL for this one as well.

References:
https://www.spinics.net/lists/linux-usb/msg88965.html
http://linet.gr.jp/~kojima/PlamoWeb/ML/htdocs/201808/msg00019.html

Signed-off-by: Sebastian Parschauer <sparschauer@suse.de>
CC: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-11-08 12:09:02 +01:00
Arnd Bergmann 3fc202e81d HID: asus: fix build warning wiht CONFIG_ASUS_WMI disabled
asus_wmi_evaluate_method() is an empty dummy function when CONFIG_ASUS_WMI
is disabled, or not reachable from a built-in device driver. This leads to
a theoretical evaluation of an uninitialized variable that the compiler
complains about, failing to check that the hardcoded return value makes
this an unreachable code path:

In file included from include/linux/printk.h:336,
                 from include/linux/kernel.h:14,
                 from include/linux/list.h:9,
                 from include/linux/dmi.h:5,
                 from drivers/hid/hid-asus.c:29:
drivers/hid/hid-asus.c: In function 'asus_input_configured':
include/linux/dynamic_debug.h:135:3: error: 'value' may be used uninitialized in this function [-Werror=maybe-uninitialized]
   __dynamic_dev_dbg(&descriptor, dev, fmt, \
   ^~~~~~~~~~~~~~~~~
drivers/hid/hid-asus.c:359:6: note: 'value' was declared here
  u32 value;
      ^~~~~

With an extra IS_ENABLED() check, the warning goes away.

Fixes: 3b692c55e5 ("HID: asus: only support backlight when it's not driven by WMI")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-11-06 13:57:42 +01:00
Jiri Kosina 0c72442095 Merge branch 'master' into for-4.20/upstream-fixes
Pull in a merge commit that brought in 3b692c55e5 ("HID: asus: only
support backlight when it's not driven by WMI") so that fixup could be
applied on top of it.
2018-11-06 13:57:02 +01:00
Linus Torvalds eb7046e9bf platform-drivers-x86 for v4.20-1
Move the Dell dcdbas and dell_rbu drivers into platform/drivers/x86 as
 they are closely coupled with other drivers in this location.
 
 Improve _init* usage for acerhdf and fix some usage issues with messages
 and module parameters.
 
 Simplify asus-wmi by calling ACPI/WMI methods directly, eliminating
 workqueue overhead, eliminate double reporting of keyboard backlight.
 
 Fix wake from USB failure on Bay Trail devices (intel_int0002_vgpio).
 
 Notify intel_telemetry users when IPC1 device is not enabled.
 
 Update various drivers with new laptop model IDs.
 
 Update several intel drivers to use SPDX identifers and order headers
 alphabetically.
 
 The following is an automated git shortlog grouped by driver:
 
 Add Intel AtomISP2 dummy / power-management driver:
  - Add Intel AtomISP2 dummy / power-management driver
 
 lg-laptop:
  - Add LG Gram laptop special features driver
 
 HID:
  -  asus: only support backlight when it's not driven by WMI
 
 MAINTAINERS:
  -  intel_telemetry: Update maintainers info
  -  intel_pmc_core: Update MAINTAINERS
  -  Update maintainer for dcdbas and dell_rbu
  -  Use my infradead account exclusively for PDx86 work
 
 acerhdf:
  -  restructure to allow large BIOS table be __initconst
  -  mark appropriate content with __init prefix
  -  Add BIOS entry for Gateway LT31 v1.3307
  -  Remove cut-and-paste trap from instructions
  -  Enable ability to list supported systems
  -  clarify modinfo messages for BIOS override
 
 asus-wmi:
  -  export function for evaluating WMI methods
  -  Only notify kbd LED hw_change by fn-key pressed
  -  Simplify the keyboard brightness updating process
 
 firmware:
  -  dcdbas: include linux/io.h
  -  dcdbas: Move dcdbas to drivers/platform/x86
  -  dell_rbu: Move dell_rbu to drivers/platform/x86
  -  dcdbas: Add support for WSMT ACPI table
  -  dell_rbu: Make payload memory uncachable
 
 ideapad-laptop:
  -  Add Y530-15ICH to no_hw_rfkill
  -  Use __func__ instead of read_ec_cmd in pr_err
 
 intel-hid:
  -  Convert to use SPDX identifier
 
 intel-ips:
  -  Convert to use SPDX identifier
 
 intel-rst:
  -  Convert to use SPDX identifier
  -  Sort headers alphabetically
 
 intel-smartconnect:
  -  Convert to use SPDX identifier
  -  Sort headers alphabetically
 
 intel-wmi-thunderbolt:
  -  Add dynamic debugging
  -  Convert to use SPDX identifier
 
 intel_bxtwc_tmu:
  -  Convert to use SPDX identifier
 
 intel_cht_int33fe:
  -  Convert to use SPDX identifier
 
 intel_chtdc_ti_pwrbtn:
  -  Add SPDX identifier
 
 intel_int0002_vgpio:
  -  Convert to use SPDX identifier
  -  Implement irq_set_wake
  -  Enable the driver on Bay Trail platforms
 
 intel_menlow:
  -  Convert to use SPDX identifier
  -  Sort headers alphabetically
 
 intel_mid_powerbtn:
  -  Convert to use SPDX identifier
  -  Remove unnecessary init.h inclusion
  -  Get rid of custom ICPU() macro
 
 intel_mid_thermal:
  -  Convert to use SPDX identifier
  -  Sort headers alphabetically
 
 intel_oaktrail:
  -  Convert to use SPDX identifier
  -  Sort headers alphabetically
 
 intel_pmc:
  -  Convert to use SPDX identifier
  -  Sort headers alphabetically
 
 intel_punit_ipc:
  -  Convert to use SPDX identifier
  -  Sort headers alphabetically
 
 intel_scu_ipc:
  -  Convert to use SPDX identifier
  -  Sort headers alphabetically
 
 intel_telemetry:
  -  Get rid of custom macro
  -  report debugfs failure
  -  Convert to use SPDX identifier
 
 intel_turbo_max_3:
  -  Convert to use SPDX identifier
  -  Sort headers alphabetically
 
 mlx-platform:
  -  Properly use mlxplat_mlxcpld_msn201x_items
 
 touchscreen_dmi:
  -  Add min-x and min-y settings for various models
  -  Add info for the Onda V80 Plus v3 tablet
  -  Add info for the Trekstor Primetab T13B tablet
  -  Add info for the Trekstor Primebook C11 convertible
 
 tracing:
  -  Trivia spelling fix containerof() -> container_of()
 
 wmi:
  -  declare device_type structure as constant
 -----BEGIN PGP SIGNATURE-----
 
 iQEcBAABAgAGBQJb2mDCAAoJEKbMaAwKp364KdkH/Rar8cenw7uFeVzT5o4fGzTn
 0Oo1Pnwh+hPgmQwmf8O/mHsa/1Zb9nX4nNLU/ysDUjAAZ9wZLoB57HlImQquPA74
 c8lXTz5MVF140WB1f1Ck5PmeonJR2Xve7HTYCoBmGo71jOxHxCgJbp1Giiho0Imd
 3NXzzahEnAiy/L5PhqqYTmIfTeAHQ2Fo7GkHCjMnS20FP2fBtvPrc7db03F+FZ4y
 QTfbT0oR42NdeW21AbCRGY3P47axB3xDJX4LOYrb4uo4CIzd1yatlHk407NRRyv8
 pab6aeJR23FouA/tcvv+T36D3vqRw78e6BWdoyowWOd7CUOgjtSC3lKGzfT6hSY=
 =0BDZ
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v4.20-1' of git://git.infradead.org/linux-platform-drivers-x86

Pull x86 platform driver updates from Darren Hart:

 - Move the Dell dcdbas and dell_rbu drivers into platform/drivers/x86
   as they are closely coupled with other drivers in this location.

 - Improve _init* usage for acerhdf and fix some usage issues with
   messages and module parameters.

 - Simplify asus-wmi by calling ACPI/WMI methods directly, eliminating
   workqueue overhead, eliminate double reporting of keyboard backlight.

 - Fix wake from USB failure on Bay Trail devices (intel_int0002_vgpio).

 - Notify intel_telemetry users when IPC1 device is not enabled.

 - Update various drivers with new laptop model IDs.

 - Update several intel drivers to use SPDX identifers and order headers
   alphabetically.

* tag 'platform-drivers-x86-v4.20-1' of git://git.infradead.org/linux-platform-drivers-x86: (64 commits)
  HID: asus: only support backlight when it's not driven by WMI
  platform/x86: asus-wmi: export function for evaluating WMI methods
  platform/x86: asus-wmi: Only notify kbd LED hw_change by fn-key pressed
  platform/x86: wmi: declare device_type structure as constant
  platform/x86: ideapad: Add Y530-15ICH to no_hw_rfkill
  platform/x86: Add Intel AtomISP2 dummy / power-management driver
  platform/x86: touchscreen_dmi: Add min-x and min-y settings for various models
  platform/x86: touchscreen_dmi: Add info for the Onda V80 Plus v3 tablet
  platform/x86: touchscreen_dmi: Add info for the Trekstor Primetab T13B tablet
  platform/x86: intel_telemetry: Get rid of custom macro
  platform/x86: intel_telemetry: report debugfs failure
  MAINTAINERS: intel_telemetry: Update maintainers info
  platform/x86: Add LG Gram laptop special features driver
  platform/x86: asus-wmi: Simplify the keyboard brightness updating process
  platform/x86: touchscreen_dmi: Add info for the Trekstor Primebook C11 convertible
  platform/x86: mlx-platform: Properly use mlxplat_mlxcpld_msn201x_items
  MAINTAINERS: intel_pmc_core: Update MAINTAINERS
  firmware: dcdbas: include linux/io.h
  platform/x86: intel-wmi-thunderbolt: Add dynamic debugging
  platform/x86: intel-wmi-thunderbolt: Convert to use SPDX identifier
  ...
2018-11-01 08:42:21 -07:00
Daniel Drake 3b692c55e5 HID: asus: only support backlight when it's not driven by WMI
The Asus GL502VSK has the same 0B05:1837 keyboard as we've seen in
several Republic of Gamers laptops.

However, in this model, the keybard backlight control exposed by hid-asus
has no effect on the keyboard backlight. Instead, the keyboard
backlight is correctly driven by asus-wmi.

With two keyboard backlight devices available (and only the acer-wmi
one working), GNOME is picking the wrong one to drive in the UI.

Avoid this problem by not creating the backlight interface when we
detect a WMI-driven keyboard backlight.

We have also tested Asus GL702VMK which does have the hid-asus
backlight present, and it still works fine with this patch (WMI method
call returns UNSUPPORTED_METHOD).

A direct "depends on ASUS_WMI" is intentionally avoided so that HID_ASUS
users who have ASUS_WMI=n will not quietly lose their HID_ASUS driver on
a kernel upgrade.

Signed-off-by: Daniel Drake <drake@endlessm.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2018-10-31 16:11:40 +02:00
Julian Sax 399474e4c1 HID: i2c-hid: add Direkt-Tek DTLAPY133-1 to descriptor override
This device uses the SIPODEV SP1064 touchpad, which does not
supply descriptors, so it has to be added to the override list.

Reported-by: Tim Aldridge <taldridge@mac.com>
Signed-off-by: Julian Sax <jsbc@gmx.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-10-31 13:00:02 +01:00
Linus Torvalds 134bf98c55 media updates for v4.20-rc1
-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJb12wyAAoJEAhfPr2O5OEVQG4P/3QlXjec6qlhbo6UPs54E2sC
 bVdZfp3mobo8NmLRt791Yh9cc0rN45Tlf2BT8XEmCyI6+NB++obU/j0LW5XT7sp7
 oE8IgeRraVFWH/Xl9lTgP15Cs6v43eyvP12xgRWBmr+TYugLHDVTheGBvU/COb3d
 yaykUULezuOMLA3HsPbz5EJOmU5rZ/Wa1w1sAiNJY/cRohfVb3kO4593enwUTMSx
 yHJ+AVjl/Dn3RV4yLwoybpxPH6XIb3KoLg/6Fx8bOlKy1sg0mcWpzQ1CvMUNpXTF
 kdwTw3ri1bfYnjChZewuKoJU8Wcw0Gt7pkqAhULN1ieo84MNA3bNor56pdRPaOZW
 KxzlXZRS6xgYW8bzZ51N0Ku6fwSt3AWRE7TeKcrHF84Yb8vOtPS15sp3qc+9o9rb
 EDV/lJLcz4bbi3W28di5WMFaN7LHxCHnRV7GvrcNQm6Im62CBFZHiI7jKjMv3tXp
 Taes0utMPGfWuY6fv4LmuBzFG4nGB6/H4RiVvL1cLkjnx/FJtWGH+1uOcKDraKeI
 ENBrK0VYrNH7nCDGNehiamStcVK+27tS+xsuqoZkGz6RA8vAxYBXTIZULXA98BPA
 f6NC32ZNJaruxh4qh5tUy+LKPGzXs0sWa9kfgKmFfaOndFLMjGTXHpAT5AYJMbNe
 iqKi/4aXD4aKAWTA7PPg
 =Cc6D
 -----END PGP SIGNATURE-----

Merge tag 'media/v4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media updates from Mauro Carvalho Chehab:

 - new dvb frontend driver: lnbh29

 - new sensor drivers: imx319 and imx 355

 - some old soc_camera driver renames to avoid conflict with new
   drivers

 - new i.MX Pixel Pipeline (PXP) mem-to-mem platform driver

 - a new V4L2 frontend for the FWHT codec

 - several other improvements, bug fixes, code cleanups, etc

* tag 'media/v4.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (289 commits)
  media: rename soc_camera I2C drivers
  media: cec: forgot to cancel delayed work
  media: vivid: Support 480p for webcam capture
  media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD
  media: vivid: Add 16-bit bayer to format list
  media: v4l2-tpg-core: Add 16-bit bayer
  media: pvrusb2: replace `printk` with `pr_*`
  media: venus: vdec: fix decoded data size
  media: cx231xx: fix potential sign-extension overflow on large shift
  media: dt-bindings: media: rcar_vin: add device tree support for r8a7744
  media: isif: fix a NULL pointer dereference bug
  media: exynos4-is: make const array config_ids static
  media: cx23885: make const array addr_list static
  media: ivtv: make const array addr_list static
  media: bttv-input: make const array addr_list static
  media: cx18: Don't check for address of video_dev
  media: dw9807-vcm: Fix probe error handling
  media: dw9714: Remove useless error message
  media: dw9714: Fix error handling in probe function
  media: cec: name for RC passthrough device does not need 'RC for'
  ...
2018-10-29 14:29:58 -07:00
Linus Torvalds 044ee89028 HID: input: simplify/fix high-res scroll event handling
Commit 1ff2e1a44e ("HID: input: Create a utility class for counting
scroll events") created the helper function

    hid_scroll_counter_handle_scroll()

to handle high-res scroll events and also expose them as regular wheel
events.

But the resulting algorithm was unstable, and causes scrolling to be
very unreliable.  When you hit the half-way mark of the highres
multiplier, small highres movements will incorrectly translate into big
traditional wheel movements, causing odd jitters.

Simplify the code and make the output stable.

NOTE! I'm pretty sure this will need further tweaking.  But this at
least turns a unusable mouse wheel on my Logitech MX Anywhere 2S into
a usable one.

Cc: Jiri Kosina <jikos@kernel.org>
Cc: Harry Cutts <hcutts@chromium.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-10-29 11:25:24 -07:00
Linus Torvalds 69d5b97c59 HID: we do not randomly make new drivers 'default y'
.. even when that "default y" is hidden syntactically as a

	default !EXPERT

it's wrong.

The only reason something should be 'default y' is if it used to be
built-in, and it was made configurable, and the 'default y' is just
retaining the status quo.

Altheratively, the hardware for the driver has become _so_ common that
it really makes sense for everybody to build it.  Finally, one possible
reason for 'default y' is because the option is not enabling any new
code at all, but is just enabling other options (the networking people
do this for vendor options, for example, so that you can disable whole
vendors at a time).

Clearly, none of these cases hold for the BigBen Interactive Kids'
gamepad, and HID_BIGBEN_FF should thus most definitely not default
to on for everybody.

Cc: Hanno Zulla <kontakt@hanno.de>
Cc: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-10-27 11:03:27 -07:00
Linus Torvalds b59dfdaef1 i2c-hid: properly terminate i2c_hid_dmi_desc_override_table[] array
Commit 9ee3e06610 ("HID: i2c-hid: override HID descriptors for certain
devices") added a new dmi_system_id quirk table to override certain HID
report descriptors for some systems that lack them.

But the table wasn't properly terminated, causing the dmi matching to
walk off into la-la-land, and starting to treat random data as dmi
descriptor pointers, causing boot-time oopses if you were at all
unlucky.

Terminate the array.

We really should have some way to just statically check that arrays that
should be terminated by an empty entry actually are so.  But the HID
people really should have caught this themselves, rather than have me
deal with an oops during the merge window.  Tssk, tssk.

Cc: Julian Sax <jsbc@gmx.de>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-10-27 09:10:48 -07:00
Benjamin Tissoires 7dd8db6894 HID: alps: allow incoming reports when only the trackstick is opened
If userspace only reads the trackstick node, and no one is listening to
the touchpad nor the hidraw node then, the device is not powered on.

Add open/close callbacks to allow users to disable the touchpad in Gnome
while keeping the trackstick active.

Link: https://bugzilla.redhat.com/show_bug.cgi?id=1559632
Link: https://gitlab.gnome.org/GNOME/mutter/issues/128
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-10-26 17:27:13 +02:00
Benjamin Tissoires 6298944d8f Revert "HID: add NOGET quirk for Eaton Ellipse MAX UPS"
This reverts commit 67ddbb3e65.

67ddbb3e65 ("HID: add NOGET quirk for Eaton Ellipse MAX UPS") was reported
by Laurent Bigonville. It turns out that a later model Laurent got
doesn't need the quirk after all.

My take is that Eaton upgraded their firmwares, so we don't need it
anymore.

The old model was from 2012, so better make sure the new line works
properly by removing the quirk. This allows upower to actually fetch
the current data.

Reported-by: Laurent Bigonville <bigon@bigon.be>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-10-26 17:10:48 +02:00
Kai-Heng Feng 00b790ea54 HID: i2c-hid: Add a small delay after sleep command for Raydium touchpanel
Raydium touchpanel (2386:4B33) sometimes does not work in desktop session
although it works in display manager.

During user logging, the display manager exits, close the HID device,
then the device gets runtime suspended and powered off. The desktop
session begins shortly after, opens the HID device, then the device gets
runtime resumed and powered on.

If the trasition from display manager to desktop sesesion is fast, the
touchpanel cannot switch from powered off to powered on in short
timeframe. So add a small delay to workaround the issue.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-10-26 17:09:22 +02:00
Breno Leitao f11274396a HID: hiddev: fix potential Spectre v1
uref->usage_index can be indirectly controlled by userspace, hence leading
to a potential exploitation of the Spectre variant 1 vulnerability.

This field is used as an array index by the hiddev_ioctl_usage() function,
when 'cmd' is either HIDIOCGCOLLECTIONINDEX, HIDIOCGUSAGES or
HIDIOCSUSAGES.

For cmd == HIDIOCGCOLLECTIONINDEX case, uref->usage_index is compared to
field->maxusage and then used as an index to dereference field->usage
array. The same thing happens to the cmd == HIDIOC{G,S}USAGES cases, where
uref->usage_index is checked against an array maximum value and then it is
used as an index in an array.

This is a summary of the HIDIOCGCOLLECTIONINDEX case, which matches the
traditional Spectre V1 first load:

	copy_from_user(uref, user_arg, sizeof(*uref))
	if (uref->usage_index >= field->maxusage)
		goto inval;
	i = field->usage[uref->usage_index].collection_index;
	return i;

This patch fixes this by sanitizing field uref->usage_index before using it
to index field->usage (HIDIOCGCOLLECTIONINDEX) or field->value in
HIDIOC{G,S}USAGES arrays, thus, avoiding speculation in the first load.

Cc: <stable@vger.kernel.org>
Signed-off-by: Breno Leitao <leitao@debian.org>
--

v2: Contemplate cmd == HIDIOC{G,S}USAGES case
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-10-26 17:06:24 +02:00
Jiri Kosina 46011e9755 Merge branch 'for-4.20/multitouch' into for-linus
hid-multitouch driver cleanup
2018-10-23 13:36:28 +02:00
Jiri Kosina 5099bc83ba Merge branch 'for-4.20/microsoft' into for-linus
Rumble support for Xbox One S
2018-10-23 13:36:05 +02:00
Jiri Kosina 276e722761 Merge branch 'for-4.20/logitech-highres' into for-linus
High-resolution support for hid-logitech
2018-10-23 13:35:22 +02:00
Jiri Kosina 4e7be68e8d Merge branch 'for-4.20/i2c-hid' into for-linus
- general cleanups of hid-i2c driver
- SPIODEV device descriptor fixes
2018-10-23 13:34:28 +02:00
Jiri Kosina a600ffe6ec Merge branch 'for-4.20/google' into for-linus
Whisker device specific fixes to hid-google driver
2018-10-23 13:19:54 +02:00
Jiri Kosina d19031d32c Merge branch 'for-4.20/cougar' into for-linus
Functional fixes for hid-cougar driver
2018-10-23 13:19:03 +02:00
Jiri Kosina d93af50ed6 Merge branch 'for-4.20/core' into for-linus
Fixes and new features for driver core. Highlights:

- maximum global item tag report size gets increased to 256
- improved INPUT_PROP reporting for Digitizer devices
2018-10-23 13:17:27 +02:00
Jiri Kosina 037ad063f7 Merge branch 'for-4.20/bigbenff' into for-linus
Driver for BigBen Interactive PS3OFMINIPAD
2018-10-23 13:17:00 +02:00
Jiri Kosina 4724750009 Merge branch 'for-4.20/apple' into for-linus
Support for Apple Magic Trackpad 2
2018-10-23 13:16:33 +02:00
Kai-Heng Feng ce9d58d3ea HID: usbhid: Add quirk for Redragon/Dragonrise Seymur 2
Redragon Seymur 2 stops working since commit 190d7f02ce ("HID: input:
do not increment usages when a duplicate is found").

Use quirk HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE suggested by the commit
can solve the issue.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200995
BugLink: https://bugs.launchpad.net/bugs/1793846
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-10-11 22:03:13 +02:00
Jason Gerecke 11db8173db HID: wacom: Work around HID descriptor bug in DTK-2451 and DTH-2452
The DTK-2451 and DTH-2452 have a buggy HID descriptor which incorrectly
contains a Cintiq-like report, complete with pen tilt, rotation, twist, serial
number, etc. The hardware doesn't actually support this data but our driver
duitifully sets up the device as though it does. To ensure userspace has a
correct view of devices without updated firmware, we clean up this incorrect
data in wacom_setup_device_quirks.

We're also careful to clear the WACOM_QUIRK_TOOLSERIAL flag since its presence
causes the driver to wait for serial number information (via
wacom_wac_pen_serial_enforce) that never comes, resulting in
the pen being non-responsive.

Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Fixes: 8341720642 ("HID: wacom: Queue events with missing type/serial data for later processing")
Cc: stable@vger.kernel.org # v4.16+
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-10-11 14:32:01 +02:00
Dmitry Torokhov 23e542e5ba HID: google: add dependency on Cros EC for Hammer
Whiskers tablet mode support needs access to Chrome Embedded Controller,
so we need to add dependency on MFD_CROS_EC.

Reported-by: kbuild test robot <lkp@intel.com>
Fixes: eb1aac4c87 ("HID: google: add support tablet mode switch for Whiskers")
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-10-10 00:01:39 +02:00
Colin Ian King 14f39921c9 HID: elan: fix spelling mistake "registred" -> "registered"
Trivial fix to spelling mistake in hid_err error message

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-10-09 13:32:06 +02:00