[ Upstream commit 8725aa4fa7 ]
In the event that the RMI device is unreachable, the calls to rmi_set_mode() or
rmi_set_page() will fail before registering the RMI transport device. When the
device is removed, rmi_remove() will call rmi_unregister_transport_device()
which will attempt to access the rmi_dev pointer which was not set.
This patch adds a check of the RMI_STARTED bit before calling
rmi_unregister_transport_device(). The RMI_STARTED bit is only set
after rmi_register_transport_device() completes successfully.
The kernel oops was reported in this message:
https://www.spinics.net/lists/linux-input/msg58433.html
[jkosina@suse.cz: reworded changelog as agreed with Andrew]
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Reported-by: Federico Cerutti <federico@ceres-c.it>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Pull HID fixes from Jiri Kosina:
- regression fixes (reverts) for module loading changes that turned out
to be incompatible with some userspace, from Benjamin Tissoires
- regression fix for special Logitech unifiying receiver 0xc52f, from
Hans de Goede
- a few device ID additions to logitech driver, from Hans de Goede
- fix for Bluetooth support on 2nd-gen Wacom Intuos Pro, from Jason
Gerecke
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
HID: logitech-dj: Fix 064d:c52f receiver support
Revert "HID: core: Call request_module before doing device_add"
Revert "HID: core: Do not call request_module() in async context"
Revert "HID: Increase maximum report size allowed by hid_field_extract()"
HID: a4tech: fix horizontal scrolling
HID: hyperv: Add a module description line
HID: logitech-hidpp: Add support for the S510 remote control
HID: multitouch: handle faulty Elo touch device
HID: wacom: Sync INTUOSP2_BT touch state after each frame if necessary
HID: wacom: Correct button numbering 2nd-gen Intuos Pro over Bluetooth
HID: wacom: Send BTN_TOUCH in response to INTUOSP2_BT eraser contact
HID: wacom: Don't report anything prior to the tool entering range
HID: wacom: Don't set tool type until we're in range
HID: rmi: Use SET_REPORT request on control endpoint for Acer Switch 3 and 5
HID: logitech-hidpp: add support for the MX5500 keyboard
HID: logitech-dj: add support for the Logitech MX5500's Bluetooth Mini-Receiver
HID: i2c-hid: add iBall Aer3 to descriptor override
Based on 1 normalized pattern(s):
this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license as published by
the free software foundation either version 2 of the license or at
your option any later version
extracted by the scancode license scanner the SPDX license identifier
GPL-2.0-or-later
has been chosen to replace the boilerplate/reference in 3029 file(s).
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Allison Randal <allison@lohutok.net>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070032.746973796@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The touchpad on the cover keyboard for the Acer Switch 3 and 5 does not
work as-is under Linux. Both devices have the same usb id for the cover
keyboard.
The kernel correctly assigns the hid-rmi driver to the device using usbhid
for transport.
Any attempts of hid-rmi to talk to the device using hid_hw_output_report
fail however as usbhid does not have a working urbout due to the lack of
any out endpoints.
Looking through Wireshark usbmon recordings from the Windows Synaptics
driver for this computer running inside of QEMU shows that it should be
using SET_REPORT requests instead.
This replaces the hid_hw_output_report in hid-rmi with a
hid_hw_raw_request for this device, which is at least enough to enable
the kernel to get working multi-touch input.
Signed-off-by: Tobias Auerochs <tobi291019@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
When we receive a RMI4 report, we should not unconditionally send an
input_sync event. Instead, we should let the rmi4 transport layer do it
for us.
This fixes a situation where we might receive X in a report and the rest
in a subsequent one. And this messes up user space.
Link: https://bugs.freedesktop.org/show_bug.cgi?id=100436
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Oscar Morante <spacepluk@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Follow the change of return type u32 of hid_report_len,
fix all the types of variables those get the return value of
hid_report_len to u32, and all other code already uses u32.
Cc: stable@vger.kernel.org
Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The Fujitsu R726 Pad has an optional USB keyboard dock which contains
a Synaptics touchpad. The dock identifies itself as a
Primax Rezel Tablet Keyboard.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The hid-rmi driver may handle non rmi devices on composite USB devices.
Callbacks need to make sure that the current device is a RMI device before
calling RMI specific functions. Most callbacks already have this check, but
this patch adds checks to the remaining callbacks.
Reported-by: Hendrik Langer <hendrik.langer@gmx.de>
Tested-by: Hendrik Langer <hendrik.langer@gmx.de>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
So it looks like that suspend/resume has actually always been broken on
hid-rmi. The fact it worked was a rather silly coincidence that was
relying on the HID device to already be opened upon resume. This means
that so long as anything was reading the /dev/input/eventX node for for
an RMI device, it would suspend and resume correctly. As well, if
nothing happened to be keeping the HID device away it would shut off,
then the RMI driver would get confused on resume when it stopped
responding and explode.
So, call hid_hw_open() in rmi_post_resume() so we make sure that the
device is alive before we try talking to it.
This fixes RMI device suspend/resume over HID.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=196851
[jkosina@suse.cz: removed useless hunk that was zero-initializing 'ret']
Signed-off-by: Lyude <lyude@redhat.com>
Cc: Andrew Duggan <aduggan@synaptics.com>
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The Synaptics RMI4 driver provides support for RMI4 devices. Instead of
duplicating the RMI4 processing code, make hid-rmi a transport driver
and register it with the Synaptics RMI4 core.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Kernel v4.9 strictly enforces DMA capable buffers, so we need to remove
buffers allocated on the stack.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Commit 0925636042 ("HID: rmi: Disable scanning if the device is not a wake
source") introduced a regression for devices which use hid-rmi to handle
composite USB devices. The suspend or resume callbacks are not checking
that the device is a RMI device before calling rmi_read or rmi_write.
This results in dereferencing uninitialized variables on non RMI devices. This
patch checks that the RMI_DEVICE flag is set before sending RMI commands to the
device.
Reported-by: Rodrigo Gomes <rodrigo.toste.gomes@gmail.com>
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
When configuring input device via input_configured callback we may
encounter errors (for example input_mt_init_slots() may fail). Instead
of continuing with half-initialized input device let's allow driver
indicate failures.
Signed-off-by: Jaikumar Ganesh <jaikumarg@android.com>
Signed-off-by: Arve Hjønnevåg <arve@android.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
Acked-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
A firmware bug in some touchpads causes the F01 interrupt enable register
to be cleared on reset. This register controls which RMI functions generate
interrupts and when it is cleared, the touchpad stops reporting all data.
This patch looks for the cleared F01 control register and writes the
correct value based on interrupt mask computed while scanning the PDT.
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=91102
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
When a device is reset the values of control registers will be reset to
the defaults. This patch reapplies the control register values set for F11
by the driver.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Tested-by: Gabriele Mazzotta <gabriele.mzt@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Some touchpads are configured with firmware which continues to scan for
fingers at a minimal scan rate even after receiving the HID power sleep
command. This allows a finger touching the touchpad to genrate a wake
event. This patch ensures that scanning is disabled if the touchpad is
not a wake source and ensures scanning is enabled on resume.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Physical buttons do not use F30 to report their state and in some cases the
data reported in F30 is incorrect and inconsistent with what is reported by
the HID descriptor. When physical buttons are present, ignore F30 and let
hid-input report buttons based on what is defined in the HID descriptor.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
These defines are used like this:
if (!(test_bit(RMI_STARTED, &hdata->flags)))
So the intent was to use bits 0, 1 and 2 but because of the extra BIT()
shifts we're actually using 1, 2 and 4. It's harmless because it's done
consistently but static checkers will complain.
Fixes: 9fb6bf02e3 ('HID: rmi: introduce RMI driver for Synaptics touchpads')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
A touchpad may have firmware based palm detection code enabled which
suppresses 2D data from being reported when the firmware believes a palm is
on the touchpad. This functionality is meant to be used in mouse mode without
a driver. When a driver is present, the driver can do a better job of
determining if a contact is a palm. If this gesture is enabled on a touchpad
operating in rmi mode then the firmware will not properly clear the palm detect
interrupt, causing the touchpad to interrupt indefinately. This patch disables
the palm detect gesture when the touchpad is operating in rmi mode.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Tested-by: Gabriele Mazzotta <gabriele.mzt@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
When a finger is lifted from a Synaptics touchpad the firmware will continue
to interrupts for up to a second. These additional interrupts are know and
dribble interrupts. Since the data read from the touchpad does not change
the input subsystem only reports a single event. This makes the servicing of
dribble interrupts on Linux unnecessary. This patch simply disables dribble
interupts when configuring the touchpad.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Tested-by: Gabriele Mazzotta <gabriele.mzt@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Knowing the firmware id is extremely useful when debugging issues related to
the touchpad. It can be used to determine the hardware, firmware version,
and configuation of the touchpad. This patch queries the firmware id and
prints it as the touchpad is starting so that it will show up in the dmesg
output included in bug reports.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Have hid-rmi handle all of the Razer Blade HID devices that are part of the
composite USB device. This will allow hid-rmi to operate the touchpad in rmi
mode while passing events from the other devices to hid-input.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The external buttons on HID touchpads are connected as pass through devices and
button events are not reported in the rmi registers. As a result on these
devices we need to allow the HID generic desktop button events to be processed
by hid-input. Unfortunately, there is no way to query the touchpad to determine
that it has pass through buttons so the RMI_DEVICE_HAS_PHYS_BUTTONS should be
set manually when adding the device to rmi_id[].
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Now that hid_report_len is in hid.h we can use this function instead of
duplicating the code which computes it.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Allowing hid-rmi to bind to non rmi devices allows us to support composite USB
devices which contain several HID devices one of which is a HID touchpad.
Since all of the devices have the same VID and PID we can add the device
to the hid_have_special_driver list and have hid-rmi handle all of the devices.
Then hid-rmi's probe can look for the rmi specific HID report IDs and decide if
it should handle the device as a rmi device or simply report that the events
needs additional processing.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
If a touchpad does not report relative data then query 6 will not be present and the address
of query 8 will be one less. This patches calculates the location of query 8 instead of
hardcoding the offset.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
If a touchpad reports the F11 data40 register then this indicates that the touchpad reports
additional ACM (Accidental Contact Mitigation) data after the F11 data in the HID attention
report. These additional bytes shift the position of the F30 button data causing the driver
to incorrectly report button state when this functionality is present. This patch accounts
for the additional data in the report.
Fixes:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1398533
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
In the Dell XPS 13 9333, it appears that sometimes the bus get confused
and corrupts the incoming data. It fills the input report with the
sentinel value "ff". Synaptics told us that such behavior does not comes
from the touchpad itself, so we filter out such reports here.
Unfortunately, we can not simply discard the incoming data because they
may contain useful information. Most of the time, the misbehavior is
quite near the end of the report, so we can still use the valid part of
it.
Fixes:
https://bugzilla.redhat.com/show_bug.cgi?id=1123584
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Currently rmi_probe will return -EIO if the device doesn't report that it has F11.
This would indicate that something happened and the device is in the bootloader.
We can recover the device using a userspace firmware update tool, but it needs
access to the device through the hidraw device file. If the probe returns -EIO
the hidraw device won't be created. So instead of failing the probe, just print
an error message, but leave the device accessible from userspace.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
It is possible that the hid-rmi driver could get loaded onto a device which does not have the
expected report ids. This should not happen because it would indicate that the hid-rmi driver is
not compatible with that device. However, if it does happen it should return an error from probe
instead of dereferencing a null pointer.
related bug:
https://bugzilla.kernel.org/show_bug.cgi?id=80091
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Userspace tools may use hidraw to perform operations on the device from userspace while
hid-rmi is bound to the device. This can cause hid-rmi to print error messages when its
->raw_event() callback gets called as the reports pass through the HID stack. In this case
receiving responses which were not initiated by hid-rmi is not actually an error so the resulting
error messages are incorrect and misleading. This patch changes the log messages to debug so
that the messages can be turned on in the event that there is a problem and there is not
a userspace tool running.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
There are additional queries which are optional and may not be present
depending on the configuration of the firmware. Knowing which queries are
present is needed to properly compute the address of Query 12 and all
subsequent queries. Additional bits in Query 1 are used to indicate the
presence of these optional queries.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
If CONFIG_PM=n:
drivers/hid/hid-rmi.c:432: warning: ‘rmi_post_reset’ defined but not used
drivers/hid/hid-rmi.c:437: warning: ‘rmi_post_resume’ defined but not used
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Currently, hid-rmi drives every Synaptics product, but the touchscreens
on the Windows tablets should be handled through hid-multitouch.
Instead of providing a long list of PIDs, rely on the scan_report
capability to detect which should go to hid-multitouch, and which
should not go to hid-rmi.
related bug:
https://bugzilla.kernel.org/show_bug.cgi?id=74241https://bugzilla.redhat.com/show_bug.cgi?id=1089583
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The F11 data in the HID report contains four bits of data for w_x and the least significant bits
of x. Currently only the first three bits are being used which is resulting in small jumps in
the position data on the x axis and in the w_x data.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
x_size_mm should be y_size_mm, otherwise neither the duplicated
condition nor the assignment make any sense whatsoever.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
A firmware bug is present on the XPS Haswell edition which silently
split the request in two responses when the caller ask for a read of
more than 16 bytes.
The FW sends the first 16 then the 4 next, but it says that it answered
the 20 bytes in the first report.
This occurs only on the retrieving of the min/max of X and Y of the F11
function.
We only use the first 10 bytes of the Ctrl register, so we can get only
those 10 bytes to prevent the bug from happening.
Resolves:
https://bugzilla.redhat.com/show_bug.cgi?id=1090161
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The rmi4 spec defines some optional query registers in F11 which appear before
query 12. This patch checks for the existence of some of the lesser used queries to
compute the location of query12 and all subsequent query registers.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Well, this is embarrassing, if the device is stopped at the end of probe,
we get into big trouble.
This was a leftover of an attempt to be smart when sending the patch,
I deeply apologies.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This driver add support for RMI4 over USB or I2C.
The current state is that it uses its own RMI4 implementation, but once
RMI4 is merged upstream, the driver will be a transport driver for the
RMI4 library.
Part of this driver should be considered as temporary. Most of the RMI4
processing and input handling will be deleted at some point.
I based my work on Andrew's regarding its port of RMI4 over HID (see
https://github.com/mightybigcar/synaptics-rmi4/tree/rmihid )
This repo presents how the driver may looks like at the end:
https://github.com/mightybigcar/synaptics-rmi4/blob/rmihid/drivers/input/rmi4/rmi_hid.c
Without this temporary solution, the workaround we gave to users
is to disable i2c-hid, which leads to disabling the touchscreen on the
XPS 11 and 12 (Haswell generation).
Related bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1048314https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1218973
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Andrew Duggan