aboutsummaryrefslogtreecommitdiff
path: root/drivers/hid
AgeCommit message (Collapse)Author
2013-09-26HID: usbhid: quirk for N-Trig DuoSense Touch ScreenVasily Titskiy
commit 9e0bf92c223dabe0789714f8f85f6e26f8f9cda4 upstream. The DuoSense touchscreen device causes a 10 second timeout. This fix removes the delay. Signed-off-by: Vasily Titskiy <qehgt0@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26HID: check for NULL field when setting valuesKees Cook
commit be67b68d52fa28b9b721c47bb42068f0c1214855 upstream. Defensively check that the field to be worked on is not NULL. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26HID: hidraw: correctly deallocate memory on device disconnectManoj Chourasia
commit 212a871a3934beccf43431608c27ed2e05a476ec upstream. This changes puts the commit 4fe9f8e203f back in place with the fixes for slab corruption because of the commit. When a device is unplugged, wait for all processes that have opened the device to close before deallocating the device. This commit was solving kernel crash because of the corruption in rb tree of vmalloc. The rootcause was the device data pointer was geting excessed after the memory associated with hidraw was freed. The commit 4fe9f8e203f was buggy as it was also freeing the hidraw first and then calling delete operation on the list associated with that hidraw leading to slab corruption. Signed-off-by: Manoj Chourasia <mchourasia@nvidia.com> Tested-by: Peter Wu <lekensteyn@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26HID: battery: don't do DMA from stackJiri Kosina
commit 6c2794a2984f4c17a58117a68703cc7640f01c5a upstream. Instead of using data from stack for DMA in hidinput_get_battery_property(), allocate the buffer dynamically. Reported-by: Richard Ryniker <ryniker@alum.mit.edu> Reported-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26HID: picolcd: Prevent NULL pointer dereference on _remove()Bruno Prémont
commit 1cde501bb4655e98fb832194beb88ac73be5a05d upstream. When picolcd is switched into bootloader mode (for FW flashing) make sure not to try to dereference NULL-pointers of feature-devices during unplug/unbind. This fixes following BUG: BUG: unable to handle kernel NULL pointer dereference at 00000298 IP: [<f811f56b>] picolcd_exit_framebuffer+0x1b/0x80 [hid_picolcd] *pde = 00000000 Oops: 0000 [#1] Modules linked in: hid_picolcd syscopyarea sysfillrect sysimgblt fb_sys_fops CPU: 0 PID: 15 Comm: khubd Not tainted 3.11.0-rc7-00002-g50d62d4 #2 EIP: 0060:[<f811f56b>] EFLAGS: 00010292 CPU: 0 EIP is at picolcd_exit_framebuffer+0x1b/0x80 [hid_picolcd] Call Trace: [<f811d1ab>] picolcd_remove+0xcb/0x120 [hid_picolcd] [<c1469b09>] hid_device_remove+0x59/0xc0 [<c13464ca>] __device_release_driver+0x5a/0xb0 [<c134653f>] device_release_driver+0x1f/0x30 [<c134603d>] bus_remove_device+0x9d/0xd0 [<c13439a5>] device_del+0xd5/0x150 [<c14696a4>] hid_destroy_device+0x24/0x60 [<c1474cbb>] usbhid_disconnect+0x1b/0x40 ... Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26HID: ntrig: validate feature report detailsKees Cook
commit 875b4e3763dbc941f15143dd1a18d10bb0be303b upstream. A HID device could send a malicious feature report that would cause the ntrig HID driver to trigger a NULL dereference during initialization: [57383.031190] usb 3-1: New USB device found, idVendor=1b96, idProduct=0001 ... [57383.315193] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 [57383.315308] IP: [<ffffffffa08102de>] ntrig_probe+0x25e/0x420 [hid_ntrig] CVE-2013-2896 Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26HID: picolcd_core: validate output report detailsKees Cook
commit 1e87a2456b0227ca4ab881e19a11bb99d164e792 upstream. A HID device could send a malicious output report that would cause the picolcd HID driver to trigger a NULL dereference during attr file writing. [jkosina@suse.cz: changed report->maxfield < 1 to report->maxfield != 1 as suggested by Bruno]. CVE-2013-2899 Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Bruno Prémont <bonbons@linux-vserver.org> Acked-by: Bruno Prémont <bonbons@linux-vserver.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26HID: validate HID report id sizeKees Cook
commit 43622021d2e2b82ea03d883926605bdd0525e1d1 upstream. The "Report ID" field of a HID report is used to build indexes of reports. The kernel's index of these is limited to 256 entries, so any malicious device that sets a Report ID greater than 255 will trigger memory corruption on the host: [ 1347.156239] BUG: unable to handle kernel paging request at ffff88094958a878 [ 1347.156261] IP: [<ffffffff813e4da0>] hid_register_report+0x2a/0x8b CVE-2013-2888 Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26HID: sensor-hub: validate feature report detailsKees Cook
commit 9e8910257397372633e74b333ef891f20c800ee4 upstream. A HID device could send a malicious feature report that would cause the sensor-hub HID driver to read past the end of heap allocation, leaking kernel memory contents to the caller. CVE-2013-2898 Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26HID: Fix Speedlink VAD Cezanne support for some devicesStefan Kriwanek
commit 06bb5219118fb098f4b0c7dcb484b28a52bf1c14 upstream. Some devices of the "Speedlink VAD Cezanne" model need more aggressive fixing than already done. I made sure through testing that this patch would not interfere with the proper working of a device that is bug-free. (The driver drops EV_REL events with abs(val) >= 256, which are not achievable even on the highest laser resolution hardware setting.) Signed-off-by: Stefan Kriwanek <mail@stefankriwanek.de> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26HID: wiimote: work around broken DRM_KAI on GEN10David Herrmann
commit a6be8569b6705cbc26e7ae1a8be476067cc5a78b upstream. GEN10 and earlier devices seem to not support DRM_KAI if we run in basic IR mode. Use DRM_KAIE instead. This might increases overhead slightly as the extension port is read and streamed but we stream accelerometer data constantly, too, so this is negligible. Note that our parsers are hardcoded on IR-formats, so we cannot actually use 96-bit IR DRMs for basic IR data. We would have to adjust the parsers. But as only GEN20 and newer support this, we simply avoid mixed DRMs. This fixes a bug where GEN10 devices didn't provide IR data if accelerometer and IR are enabled simultaneously. As a workaround, you can enable DRM_KAIE without this patch via (disables device power-management): echo "37" >/sys/kernel/debug/hid/<dev>/drm Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Reported-by: Nicolas Adenis-Lamarre <nicolas.adenis.lamarre@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26HID: kye: Add report fixup for Genius Gx Imperator KeyboardBenjamin Tissoires
commit 0adb9c2c5ed42f199cb2a630c37d18dee385fae2 upstream. Genius Gx Imperator Keyboard presents the same problem in its report descriptors than Genius Gila Gaming Mouse. Use the same fixup for both. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=928561 Reported-and-tested-by: Honza Brazdil <jbrazdil@redhat.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26HID: pantherlord: validate output report detailsKees Cook
commit 412f30105ec6735224535791eed5cdc02888ecb4 upstream. A HID device could send a malicious output report that would cause the pantherlord HID driver to write beyond the output report allocation during initialization, causing a heap overflow: [ 310.939483] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0003 ... [ 315.980774] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten CVE-2013-2892 Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26HID: Correct the USB IDs for the new Macbook Air 6Henrik Rydberg
commit 8c89cc17b91992845bd635813cd162fe8dfcec6e upstream. A recent patch (9d9a04ee) added support for the new machine, but got the sequence of USB ids wrong. Reports from both Ian and Linus T show that the 0x0291 id is for ISO, not ANSI, which should have the missing number 0x0290. This patchs moves the three numbers accordingly, fixing the problem. Reported-and-tested-by: Ian Munsie <darkstarsword@gmail.com> Tested-by: Linus G Thiel <linus@hanssonlarsson.se> Signed-off-by: Henrik Rydberg <rydberg@euromail.se> Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-08-09Revert "HID: hid-logitech-dj: querying_devices was never set"Jiri Kosina
This reverts commit 407a2c2a4d85100c8c67953e4bac2f4a6c942335. Explanation provided by Benjamin Tissoires: Commit "HID: hid-logitech-dj, querying_devices was never set" activate a flag which guarantees that we do not ask the receiver for too many enumeration. When the flag is set, each following enumeration call is discarded (the usb request is not forwarded to the receiver). The flag is then released when the driver receive a pairing information event, which normally follows the enumeration request. However, the USB3 bug makes the driver think the enumeration request has been forwarded to the receiver. However, it is actually not the case because the USB stack returns -EPIPE. So, when a new unknown device appears, the workaround consisting in asking for a new enumeration is not working anymore: this new enumeration is discarded because of the flag, which is never reset. A solution could be to trigger a timeout before releasing it, but for now, let's just revert the patch. Reported-by: Benjamin Tissoires <benjamin.tissoires@gmail.com> Tested-by: Sune Mølgaard <sune@molgaard.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-08-02Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID fixes from Jiri Kosina: - fix hid-sony PS3 sixaxxis breakage from Benjamin Tissories - fix hidraw race condition from Yonghua Zheng - fix/bandaid for rare device enumeration problems of Logitech Unifying receivers from Nestor Lopez Casado * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: hidraw: fix improper mutex release HID: sony: fix HID mapping for PS3 sixaxis controller HID: hid-logitech-dj: querying_devices was never set HID: Revert "Revert "HID: Fix logitech-dj: missing Unifying device issue""
2013-08-01Merge branches 'for-3.11/upstream-fixes' and ↵Jiri Kosina
'for-3.11/logitech-enumeration-fix' into for-linus
2013-07-31HID: hidraw: fix improper mutex releaseYonghua Zheng
Mutex can not be released unless all hid_device members are properly initialized. Otherwise it would result in a race condition that can cause NULL pointer kernel panic issue in hidraw_open where it uses uninitialized 'list' member in list_add_tail(). Signed-off-by: Yonghua Zheng <younghua.zheng@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-07-24HID: sony: fix HID mapping for PS3 sixaxis controllerBenjamin Tissoires
Commit f04d51404f51 (HID: driver for PS2/3 Buzz controllers) introduced an input_mapping() callback, but set the return value to -1 to all devices except the Buzz controllers. The result of this is that the Sixaxis input device is not populated, making it useless. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-07-22HID: hid-logitech-dj: querying_devices was never setNestor Lopez Casado
Set querying_devices flag to true when we start the enumeration process. This was missing from the original patch. It never produced undesirable effects as it is highly improbable to have a second enumeration triggered while a first one was still in progress. Signed-off-by: Nestor Lopez Casado <nlopezcasad@logitech.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-07-22HID: Revert "Revert "HID: Fix logitech-dj: missing Unifying device issue""Nestor Lopez Casado
This reverts commit 8af6c08830b1ae114d1a8b548b1f8b056e068887. This patch re-adds the workaround introduced by 596264082f10dd4 which was reverted by 8af6c08830b1ae114. The original patch 596264 was needed to overcome a situation where the hid-core would drop incoming reports while probe() was being executed. This issue was solved by c849a6143bec520af which added hid_device_io_start() and hid_device_io_stop() that enable a specific hid driver to opt-in for input reports while its probe() is being executed. Commit a9dd22b730857347 modified hid-logitech-dj so as to use the functionality added to hid-core. Having done that, workaround 596264 was no longer necessary and was reverted by 8af6c08. We now encounter a different problem that ends up 'again' thwarting the Unifying receiver enumeration. The problem is time and usb controller dependent. Ocasionally the reports sent to the usb receiver to start the paired devices enumeration fail with -EPIPE and the receiver never gets to enumerate the paired devices. With dcd9006b1b053c7b1c the problem was "hidden" as the call to the usb driver became asynchronous and none was catching the error from the failing URB. As the root cause for this failing SET_REPORT is not understood yet, -possibly a race on the usb controller drivers or a problem with the Unifying receiver- reintroducing this workaround solves the problem. Overall what this workaround does is: If an input report from an unknown device is received, then a (re)enumeration is performed. related bug: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1194649 Signed-off-by: Nestor Lopez Casado <nlopezcasad@logitech.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-07-04Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: "First round of updates for the input subsystem. You will get a new touchsreen driver for Cypress 4th generation devices, a driver for a special controller implementing PS/2 protocol in OLPC devices, and a driver for power key for SiRFprimaII PWRC. HID and bcm5497 now support for the 2013 MacBook Air. EVIOCGKEY and the rest of evdev ioctls now flush events of matching type from the client's event queue so that clients can be sure any events received after issuing EVIOCG* ioctl are new events. And a host of cleanups and improvements in other drivers" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (87 commits) Input: cyttsp4 - kfree xfer_buf on error path in probe() Input: tps6507x-ts - select INPUT_POLLDEV Input: bcm5974 - add support for the 2013 MacBook Air HID: apple: Add support for the 2013 Macbook Air Input: cyttsp4 - leak on error path in probe() Input: cyttsp4 - silence NULL dereference warning Input: cyttsp4 - silence shift wrap warning Input: tps6507x-ts - convert to polled input device infrastructure ARM: davinci: da850-evm: remove vref from touchscreen platform data Input: cyttsp4 - SPI driver for Cypress TMA4XX touchscreen devices Input: cyttsp4 - I2C driver for Cypress TMA4XX touchscreen devices Input: cyttsp4 - add core driver for Cypress TMA4XX touchscreen devices Input: cyttsp - I2C driver split into two modules Input: add OLPC AP-SP driver Input: nspire-keypad - remove redundant dev_err call in nspire_keypad_probe() Input: tps6507x-ts - remove vref from platform data Input: tps6507x-ts - use bool for booleans Input: tps6507x-ts - remove bogus unreachable code Input: samsung-keypad - let device core setup the default pin configuration Input: wacom_i2c - implement hovering capability ...
2013-07-04Merge branches 'for-3.11/wacom-fixed' and 'for-3.11/wiimote' into for-linusJiri Kosina
2013-07-04HID: wacom: Intuos4 battery charging changesPrzemo Firszt
Intuos4 WL is separately reporting power supply and battery charging status - now hid-wacom is using that information. Previously hid-wacom was wrongly treating "battery charging" bit as "power supply connected". Now it should report battery charging, battery discharging, battery full and power supply status. Intuos4 WL sends reports when is in use (obvious) and when unplugging power supply. If means that if the device is being charged, but it's not being used it will never report "battery full". The same problem happens after the device has been connected, but it's not in use - the battery/ac status will be incorrect. Currently there is no mechanism to ask the device to send a report containing battery/ac status. Signed-off-by: Przemo Firszt <przemo@firszt.eu> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-07-04Merge branches 'for-3.11/multitouch', 'for-3.11/sony' and ↵Jiri Kosina
'for-3.11/upstream' into for-linus Conflicts: drivers/hid/hid-core.c
2013-07-04Merge branches 'for-3.11/battery', 'for-3.11/elo', 'for-3.11/holtek' and ↵Jiri Kosina
'for-3.11/i2c-hid-fixed' into for-linus
2013-07-04HID: i2c-hid: support sending HID output reports using the output registerAndrew Duggan
The current i2c hid driver does not support sending HID output reports using the output register for devices which support receiving reports through this method. This patch determines which method to use to send output reports based on the value of wMaxOutputLength in the device's HID descriptor. Signed-off-by: Andrew Duggan <aduggan@synaptics.com> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-07-03HID: kye: Add report fixup for Genius Gila Gaming mouseBenjamin Tissoires
Genius Gila Gaming Mouse presents an obviously wrong report descriptor. the Consumer control (report ID 3) is the following: 0x05, 0x0c, // Usage Page (Consumer Devices) 105 0x09, 0x01, // Usage (Consumer Control) 107 0xa1, 0x01, // Collection (Application) 109 0x85, 0x03, // Report ID (3) 111 0x19, 0x00, // Usage Minimum (0) 113 0x2a, 0xff, 0x7f, // Usage Maximum (32767) 115 0x15, 0x00, // Logical Minimum (0) 118 0x26, 0xff, 0x7f, // Logical Maximum (32767) 120 0x75, 0x10, // Report Size (16) 123 0x95, 0x03, // Report Count (3) 125 0x81, 0x00, // Input (Data,Arr,Abs) 127 0x75, 0x08, // Report Size (8) 129 0x95, 0x01, // Report Count (1) 131 0x81, 0x01, // Input (Cnst,Arr,Abs) 133 0xc0, // End Collection 135 So the first input whithin this report has a count of 3 but a usage range of 32768. So this value is obviously wrong as it should not be greater than the report count. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=959721 Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-07-02HID: apple: Add support for the 2013 Macbook AirDmitry Torokhov
This patch adds keyboard support for MacbookAir6,2 as WELLSPRING8 (0x0291, 0x0292, 0x0293). The touchpad is handled in a separate bcm5974 patch, as usual. Cc: stable@vger.kernel.org Reported-and-tested-by: Brad Ford <plymouthffl@gmail.com> Signed-off-by: Henrik Rydberg <rydberg@euromail.se> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2013-06-27HID: wiimote: support Nintendo Wii U Pro ControllerDavid Herrmann
The Wii U Pro Controller is a new Nintendo remote device that looks very similar to the XBox controller. It has nearly the same features and uses the same protocol as the Wii Remote. We add a new wiimote extension device so the Pro Controller is properly detected and supported. The device reports MP support, which is odd and I couldn't get it working, yet. Hence, we disable MP registers for now. Further investigation is needed to see what extra capabilities are provided. There are some other unknown bits in the extension reports that I couldn't figure out what they do. You can use hidraw to access these if you're interested. We might want to hook up the "charging" and "USB" bits to the battery device so user-space can query whether it is currently charged via USB. Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-19HID: explain out-of-range check betterJiri Kosina
Extend the comment explaining the condition for discarding out-of-range values to clarify the cases in which devices don't provide any logical min/max. Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-19HID: fix false positive out of range valuesBenjamin Tissoires
Commit 6da7066906e977d42104a859c490f5f9a300488c introduced in 3.3 "HID: ignore absolute values which don't fit between logical min and max" prevents some Posiflex touch screen to work because they do not provide logical min and max for their buttons. Thus, logical min and max are at 0, discarding the buttons events, and preventing the device to report appropriate X Y. Adding a check on "min < max" solves the problem. Reported-by: Jan Kandziora <jjj@gmx.de> Tested-by: Jan Kandziora <jjj@gmx.de> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-18HID: wiimote: fix coccinelle warningsJiri Kosina
drivers/hid/hid-wiimote-modules.c:569:2-3: Unneeded semicolon Generated by: coccinelle/misc/semicolon.cocci Reported-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-18HID: roccat: check cdev_add return valueMichael Rissi
Return value of cdev_add in hid_roccat.c init was not checked. Signed-off-by: Michael Rissi <michael.rissi@dectris.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-13HID: fold ps3remote driver into generic Sony driverJiri Kosina
Let's follow the structure we are trying to keep for most of the specific HID drivers, and let the separation follow the producing vendor. Merge functionality provided by ps3remote driver into hid-sony. Tested-by: David Dillow <dave@thedillows.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-12HID: multitouch: prevent memleak with the allocated nameBenjamin Tissoires
mt_free_input_name() was never called during .remove(): hid_hw_stop() removes the hid_input items in hdev->inputs, and so the list is therefore empty after the call. In the end, we never free the special names that has been allocated during .probe(). Restore the original name before freeing it to avoid acessing already freed pointer. This fixes a regression introduced by 49a5a827a ("HID: multitouch: append " Pen" to the name of the stylus input") Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-03HID: hyperv: convert alloc+memcpy to memdupThomas Meyer
Signed-off-by: Thomas Meyer <thomas@m3y3r.de> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-03HID: core: fix reporting of raw eventsJiri Kosina
hdrw->raw event can return three different return value types: - ret < 0 indicates that the hdrv driver found an error while parsing - ret == 0 indicates no error has been encountered, and the driver has processed the report - ret > 0 indicates that there was no parsing error, and the driver hasn't processed the event. Calling hid_report_raw_event() has to be called appropriately so that it reflects what has been done by ->raw_event() callback, otherwise we might updates of the in-kernel structure are lost upon arrival of the report, which is wrong. Reported-and-tested-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Reported-and-tested-by: Daniel Leung <daniel.leung@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-03HID: wiimote: discard invalid EXT data reportsDavid Herrmann
If an extension device isn't initialized properly, or during hardware initialization, a device might send extension data which is all 0xff. This is ambigious because this is also a valid normal data report. But it is impossible, under normal conditions, to trigger valid reports with all 0xff. Hence, we can safely ignore them. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-03HID: wiimote: fix classic controller parsingDavid Herrmann
I finally got a "Classic Controller" and "Classic Controller Pro" in my hands and noticed that all analog data was incorrectly parsed. Fix this up so we report the data that we pretend we do. I really doubt that this breaks any backwards compatibility, but if we get any reports, we only need to revert this single patch. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-03HID: wiimote: init EXT/MP during device detectionDavid Herrmann
We normally get EXT hotplug events or poll for MP hotplugging so we don't need to force extension port initialization during device setup. But for gen20 devices, we disable MP polling because MP is always present. However, this prevents MP initialization during device setup and users need to plug another extension to trigger EXT/MP detection. Therefore, we now trigger EXT/MP detection during device setup automatically. This also avoids slightly delayed extension detection and provides sysfs child-devices prior to the "changed"-uevent during device setup. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-03HID: wiimote: fix DRM debug-attr to correctly parse inputDavid Herrmann
We need to correctly zero-terminate the input to parse it. Otherwise, we always end up interpreting it as numbers. Furthermore, we actually want hexadecimal numbers instead of decimal. As it is a debugfs interface, we can change the API at any time. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-03HID: wiimote: add MP quirksDavid Herrmann
Devices which have built-in motion plus ports don't need MP detection logic. The new WIIMOD_BUILTIN_MP modules sets the WIIPROTO_FLAG_BUILTIN_MP flag which disables polling for MP. Some other devices erroneously report that they support motion-plus. For these devices and all devices without extension ports, we load WIIMOD_NO_MP which sets WIIPROTO_FLAG_NO_MP. This effectively disables all MP detection logic. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-03HID: wiimote: remove old static extension supportDavid Herrmann
We now have dynamic hotplug support so the old static extensions are no longer needed nor used. Remove it along CONFIG_HID_WIIMOTE_EXT. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-03HID: wiimote: add "bboard_calib" attributeDavid Herrmann
Balance-Boards provide 3 16bit calibration values for each of the 4 sensors. We provide these now as 192bit value via a new "bboard_calib" sysfs attribute. We also re-read the calibration data from the device whenever user-space attempts to read this file. On normal Nintendo boards, this always produces the same results, however, on some 3rd party devices these values change until the device is fully initialized. As I have currently no idea how long to wait until it's ready (sometimes takes up to 10s?) we provide a simple workaround for users by reading this file. If we, at some point, figure out how it works, we can implement it in the kernel and provide offline data via "bboard_calib". This won't break user-space then. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-03HID: wiimote: add sysfs extension/device-type attrsDavid Herrmann
Two new attributes, "extension" and "devtype" now allow user-space to read the extension type and device type. As device detection is asynchronous, we send a CHANGED event after it is done. This also allows user-space to wait for a device to settle before opening its input event devices. The "extension" device is compatible with the old "extension" sysfs field (which was registered by the static extension support code). Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-03HID: wiimote: lock DRM mode during debugfs overwriteDavid Herrmann
If we write a DRM mode via debugfs, we shouldn't allow normal operations to overwrite this DRM mode. This is important if we want to debug 3rd-party devices and we want to see what data is sent on each mode. If we write NULL/0 as DRM, the lock is removed again so the best matching DRM is chosen by wiimote core. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-03HID: wiimote: fix ctx pointer in debugfs DRM-writeDavid Herrmann
single_open() stores the seq_file pointer in file->private_data. It stores our ctx pointer in seq_file->private. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-03HID: wiimote: add Motion Plus extension moduleDavid Herrmann
Add parsers for motion plus data so we can hotplug motion plus extensions and make use of them. This is mostly the same as the old static motion plus parser. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2013-06-03HID: wiimote: add Classic Controller extensionDavid Herrmann
Add a new extension module for the classic controller so we get hotplug support for this device. It is mostly the same as the old static classic controller parser. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>