If a touchpad does not report relative data then query 6 will not be present and the address
of query 8 will be one less. This patches calculates the location of query 8 instead of
hardcoding the offset.
Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

If a touchpad reports the F11 data40 register then this indicates that the touchpad reports
additional ACM (Accidental Contact Mitigation) data after the F11 data in the HID attention
report. These additional bytes shift the position of the F30 button data causing the driver
to incorrectly report button state when this functionality is present. This patch accounts
for the additional data in the report.

Fixes:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1398533Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Before ->start() is called, bufsize size is set to HID_MIN_BUFFER_SIZE,
64 bytes. While processing the IRQ, we were asking to receive up to
wMaxInputLength bytes, which can be bigger than 64 bytes.

Later, when ->start is run, a proper bufsize will be calculated.

Given wMaxInputLength is said to be unreliable in other part of the
code, set to receive only what we can even if it results in truncated
reports.
Signed-off-by: NGwendal Grignou <gwendal@chromium.org>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Balance a hid_device_io_start() call with hid_device_io_stop() in the
error path. This avoids processing of HID reports when the probe fails
which possibly leads to invalid memory access in hid_device_probe() as
report_enum->report_id_hash might already be freed via
hid_close_report().

hid_set_drvdata() is called before wtp_allocate, be consistent and clear
drvdata too on the error path of wtp_allocate.
Signed-off-by: NPeter Wu <peter@lekensteyn.nl>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The HID response has a limited size. Do not trust the value returned by
hardware, check that it really fits in the message.
Signed-off-by: NPeter Wu <peter@lekensteyn.nl>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

hidpp_devicenametype_get_device_name() may return a negative value on
protocol errors (for example, when the device is powered off).
Explicitly check this condition to avoid a long-running loop.

(0 cannot be returned as __name_length - index > 0, but check for it
anyway as it would otherwise result in an infinite loop.)
Signed-off-by: NPeter Wu <peter@lekensteyn.nl>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

We do not make any use of the actual name length get through
hidpp_get_device_name(). Original patch by Benjamin Tissoires, this
patch also replaces a (now) unnecessary goto by return NULL.
Signed-off-by: NPeter Wu <peter@lekensteyn.nl>
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The existing generic touch code only reports events after reading an
entire HID report, which practically means that only data about the last
contact in a report will ever be provided to userspace. This patch uses
a trick from hid-multitouch.c to discover what type of field is at the
end of each contact; when such a field is encountered all the stored
contact data will be reported.
Signed-off-by: NJason Gerecke <killertofu@gmail.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

If a HID descriptor places HID_DG_CONTACTID before HID_DG_X and HID_DG_Y then
the ABS_X and ABS_Y will not be automatically initialized by the call to
input_mt_init_slots. To ensure that this is not a problem, we relocate that
call to occur after HID parsing has been completed and we've initalized all the
multitouch axes.
Signed-off-by: NJason Gerecke <killertofu@gmail.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Defined outbound offset for DTU and Cintiq. But didn't update
the relevant maximum values. Oops...
Signed-off-by: NPing Cheng <pingc@wacom.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Signed-off-by: NPing Cheng <pingc@wacom.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

After commit b2b49ccb (PM: Kconfig: Set PM_RUNTIME if PM_SLEEP is
selected) PM_RUNTIME is always set if PM is set, so #ifdef blocks
depending on CONFIG_PM_RUNTIME may now be changed to depend on
CONFIG_PM.

Replace CONFIG_PM_RUNTIME with CONFIG_PM in drivers/hid/i2c-hid/i2c-hid.c.
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: NJiri Kosina <jkosina@suse.cz>
Reviewed-by: NMika Westerberg <mika.westerberg@linux.intel.com>

There are screen to tablet offsets for newer Cintiq and DTU models.
These offsets serve as outbound tracking for those display tablets.

Use defines instead of hardcoded numbers for the offsets.
Signed-off-by: NPing Cheng <pingc@wacom.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Since the conversion from USB to HID (in v3.17), some people reported a
freeze on boot with the wacom driver. Hans managed to get a stacktrace:

[  240.272331] Call Trace:
[  240.272338]  [<ffffffff813de7b9>] ? usb_hcd_submit_urb+0xa9/0xb10
[  240.272347]  [<ffffffff81555579>] schedule+0x29/0x70
[  240.272355]  [<ffffffff815559e6>] schedule_preempt_disabled+0x16/0x20
[  240.272363]  [<ffffffff81557365>] __mutex_lock_slowpath+0xe5/0x230
[  240.272372]  [<ffffffff815574c7>] mutex_lock+0x17/0x30
[  240.272380]  [<ffffffffa063c1d2>] wacom_resume+0x22/0x50 [wacom]
[  240.272396]  [<ffffffffa01aea8a>] hid_resume_common+0xba/0x110 [usbhid]
[  240.272404]  [<ffffffff813e5890>] ? usb_runtime_suspend+0x80/0x80
[  240.272417]  [<ffffffffa01aeb1d>] hid_resume+0x3d/0x70 [usbhid]
[  240.272425]  [<ffffffff813e44a6>] usb_resume_interface.isra.6+0xb6/0x120
[  240.272432]  [<ffffffff813e4774>] usb_resume_both+0x74/0x140
[  240.272439]  [<ffffffff813e58aa>] usb_runtime_resume+0x1a/0x20
[  240.272446]  [<ffffffff813b1912>] __rpm_callback+0x32/0x70
[  240.272453]  [<ffffffff813b1976>] rpm_callback+0x26/0xa0
[  240.272460]  [<ffffffff813b2d71>] rpm_resume+0x4b1/0x690
[  240.272468]  [<ffffffff812ab992>] ? radix_tree_lookup_slot+0x22/0x50
[  240.272475]  [<ffffffff813b2c1a>] rpm_resume+0x35a/0x690
[  240.272482]  [<ffffffff8116e9c9>] ? zone_statistics+0x89/0xa0
[  240.272489]  [<ffffffff813b2f90>] __pm_runtime_resume+0x40/0x60
[  240.272497]  [<ffffffff813e4272>] usb_autopm_get_interface+0x22/0x60
[  240.272509]  [<ffffffffa01ae8d9>] usbhid_open+0x59/0xe0 [usbhid]
[  240.272517]  [<ffffffffa063ac85>] wacom_open+0x35/0x50 [wacom]
[  240.272525]  [<ffffffff813f37b9>] input_open_device+0x79/0xa0
[  240.272534]  [<ffffffffa048d1c1>] evdev_open+0x1b1/0x200 [evdev]
[  240.272543]  [<ffffffff811c899e>] chrdev_open+0xae/0x1f0
[  240.272549]  [<ffffffff811c88f0>] ? cdev_put+0x30/0x30
[  240.272556]  [<ffffffff811c17e2>] do_dentry_open+0x1d2/0x320
[  240.272562]  [<ffffffff811c1cd1>] finish_open+0x31/0x50
[  240.272571]  [<ffffffff811d2202>] do_last.isra.36+0x652/0xe50
[  240.272579]  [<ffffffff811d2ac7>] path_openat+0xc7/0x6f0
[  240.272586]  [<ffffffff811cf012>] ? final_putname+0x22/0x50
[  240.272594]  [<ffffffff811d42d2>] ? user_path_at_empty+0x72/0xd0
[  240.272602]  [<ffffffff811d43fd>] do_filp_open+0x4d/0xc0
[...]

So here, wacom_open is called, and then wacom_resume is called by the
PM system. However, wacom_open already took the lock when wacom_resume
tries to get it. Freeze.

A little bit of history shows that this already happened in the past
- commit f6cd3783 ("Input: wacom - fix runtime PM related deadlock"),
and the solution was to call first the PM function before taking the lock.

The lock was introduced in commit commit e7224094 ("Input: wacom -
implement suspend and autosuspend") when the autosuspend feature has
been added. Given that usbhid already takes care of this very same
locking between suspend/resume, I think we can simply kill the lock
in open/close.

The lock is now used also with LEDs, so we can not remove it completely.
Reported-by: NHans Spath <inbox-546@hans-spath.de>
Tested-by: NHans Spath <inbox-546@hans-spath.de>
CC: stable@vger.kernel.org # v3.17+
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Dropped in the following commit:

commit a3e6f654 ("Input: wacom - keep wacom_ids ordered")
Reported-by: NHans Spath <inbox-546@hans-spath.de>
CC: stable@vger.kernel.org    # v3.17+
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

In several hid drivers it is necessary to calculate the length of an
hid_report. This patch exports the existing static function hid_report_len of
hid-core.c as an inline function in hid.h
Signed-off-by: NMathieu Magnaudet <mathieu.magnaudet@enac.fr>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: NDavid Herrmann <dh.herrmann@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

It is not necessarily sufficient to look only at the physical and logical
usages when determining if a field is for the pen or touch. Some fields
are not contained in a sub-collection and thus only have an application
usage. Not checking the application usage in such cases causes us to
ignore the field entirely, which may lead to incorrect behavior.
Signed-off-by: NJason Gerecke <killertofu@gmail.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

PAD can be on pen interface (Intuos Pro and Cintiq series) or touch
interface (Bamboo PT and Intuos PT series) or its own interface
(Bamboo pen-only and Intuos Pen M/S). We need to mark it independently.
Signed-off-by: NPing Cheng <pingc@wacom.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Use mfd_add_hotplug_devices() helper to register the subdevices.

Compile-only tested.
Signed-off-by: NJohan Hovold <johan@kernel.org>
Acked-by: NJiri Kosina <jkosina@suse.cz>
Signed-off-by: NLee Jones <lee.jones@linaro.org>

VTL panels do not switch to the multitouch mode until the input mode
feature is read by the host. This should normally be done by
usbhid, but it looks like an other bug prevents usbhid to properly
retrieve the feature state. As a workaround, we force the reading of
the feature in mt_set_input_mode for such devices.
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NMathieu Magnaudet <mathieu.magnaudet@enac.fr>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Current driver uses a common buffer for reading reports either
synchronously in i2c_hid_get_raw_report() and asynchronously in
the interrupt handler.
There is race condition if an interrupt arrives immediately after
the report is received in i2c_hid_get_raw_report(); the common
buffer is modified by the interrupt handler with the new report
and then i2c_hid_get_raw_report() proceed using wrong data.

Fix it by using a separate buffers for synchronous reports.
Signed-off-by: NJean-Baptiste Maneyrol <jmaneyrol@invensense.com>
[Antonio Borneo: cleanup, rebase to v3.17, submit mainline]
Signed-off-by: NAntonio Borneo <borneo.antonio@gmail.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Provide the resolution of several angular axes (tilt, pen rotation, puck
rotation) to userspace. Because these values are natively degree-based, we
need to convert them to into units/radian as required by the input_absinfo
struct. To ensure wraparound behaves properly for the rotation axes, the
converted value was rounded up rather than rounded nearest.

Notably, the touchring axes (ABS_WHEEL and ABS_THROTTLE) are left without a
a declared resolution because the their low resolution cannot be accurately
represented (the worst-case rounding-induced error would be ~16 degrees).
Pre-scaling the values and range by at least 10x would reduce the error in
the resolution to acceptable levels, but the xf86-input-wacom driver is not
able to use pre-scaled values for these axes at this time.
Signed-off-by: NJason Gerecke <killertofu@gmail.com>
Reviewed-by: NPing Cheng <pingc@wacom.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Centers the ABS_TILT_{X,Y} axes so that a value of zero is reported when
the pen is vertical. Combined with resolution information in the next
patch, this makes it possible for userspace to calculate the pen angle
without needing hardware-specific knowledge. The xf86-input-wacom driver
was updated to support signed tilt values in late-2012 (2f2acec).
Signed-off-by: NJason Gerecke <killertofu@gmail.com>
Reviewed-by: NPing Cheng <pingc@wacom.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Bamboo models do not support HID_DG_CONTACTMAX. Plus, Bamboo pen-only
has touch descriptor. This leads to some complications in the code.

This patch also fixes duplicated PAD interfeaces for Intuos Pen
models.
Signed-off-by: NPing Cheng <pingc@wacom.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Graphire 4 only has two tablet buttons; Bamboo Fun touch ring is only
for PAD.
Signed-off-by: NPing Cheng <pingc@wacom.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

ENODEV indicates no device is added. Hence, the associated pad input device
is simply freed.
Signed-off-by: NPing Cheng <pingc@wacom.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Add vid/pid for the SMK branded third-party PS3 Bluetooth remote and enable
support in the hid-sony driver.
Signed-off-by: NFrank Praznik <frank.praznik@oh.rr.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The touchscreen needs the same quirk as the other models.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Reported-by: NBryan Poling <poli0048@umn.edu>
CC: stable@vger.kernel.org
Acked-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Replace stack buffers with kernel allocated buffers for sending
and receiving HID reports to prevent issues with DMA transfers
on certain hardware.

Output report buffers are allocated at initialization time to avoid
excessive calls to kmalloc and kfree.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=87991Signed-off-by: NFrank Praznik <frank.praznik@oh.rr.com>
Reviewed-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Report is received in "buffer"; fix the following i2c_hid_dbg()
to dump data from the correct pointer.
Signed-off-by: NJean-Baptiste Maneyrol <jmaneyrol@invensense.com>
[Antonio Borneo: cleanup and rebase to v3.17]
Signed-off-by: NAntonio Borneo <borneo.antonio@gmail.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Signed-off-by: NPing Cheng <pingc@wacom.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

On the USB keyboard, the VENDOR hotkeys share the same device as the
mouse. Setting EV_REP also affects mouse buttons, so leave it off.

The bluetooth keyboard still has autorepeating mouse buttons, as it
only has one device and is set by the KEYBOARD pages.
Signed-off-by: NJamie Lentin <jm@lentin.co.uk>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The bluetooth keyboard also generates 0x00fa when the middle button is
pressed. Move the made-up report out of the way so we don't trigger
KEY_FILE when middle button is pressed
Signed-off-by: NJamie Lentin <jm@lentin.co.uk>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Surface Pro 3 Type Cover that works with Ubuntu (and possibly Arch) from this thread. Both trackpad and keyboard work after compiling my own kernel.
http://ubuntuforums.org/showthread.php?t=2231207&page=2&s=44910e0c56047e4f93dfd9fea58121ef

Also includes Jarrad Whitaker's message which sources
http://winaero.com/blog/how-to-install-linux-on-surface-pro-3/
which he says is sourced from a Russian site
Signed-off-by: NAlan Wu <alan.c.wu@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

touch_input is stored in wacom_shared for pen data to report touch
switch status. It is possible, although we didn't see it happen on
Linux yet, that pen data is procesed before touch interface is
fully probed.

As a by-product of this patch, it fixes the FreeBSD issue reported
by Denis Akiyakov http://www.spinics.net/lists/linux-input/msg33971.htmlReviewed-by: NHans Petter Selasky <hps@selasky.org>
Tested-by: NDenis Akiyakov <d.akiyakov@gmail.com>
Signed-off-by: NPing Cheng <pingc@wacom.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

I have tested HID quirk for Saitek R.A.T.7 with my R.A.T. 9. It works fine for
me. Attached patch makes the necessary changes to use the quirk on the R.A.T.9
too, and necessary Kconfig changes too.

I have stylized the Kconfig option name to include Mad Catz in the option name,
as (at least some of) the devices are marketed under Mad Catz brand.
Signed-off-by: NVille Aakko <ville.aakko@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

- remove the constant '1'
- when the device is not connected, the protocol error
  HIDPP_ERROR_RESOURCE_ERROR is raised. We should not warn the user about
  it because it is somewhat expected as an answer when we check if the
  device is connected.
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Reported by Dan Carpenter:

drivers/hid/hid-logitech-hidpp.c:359 hidpp_root_get_protocol_version() warn: should this return really be negated?
drivers/hid/hid-logitech-hidpp.c:398 hidpp_devicenametype_get_count() warn: should this return really be negated?
drivers/hid/hid-logitech-hidpp.c:417 hidpp_devicenametype_get_device_name() warn: should this return really be negated?
drivers/hid/hid-logitech-hidpp.c:524 hidpp_touchpad_get_raw_info() warn: should this return really be negated?

The problem lies in hidpp_send_message_sync() which can return 2 types of
errors depending of their sign. Adding a comment there to clarify what is
happening.

To solve that, print an error in case of a protocol problem, and raise
-EPROTO instead.
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

When a subdriver is rmmod-ed then re-insmod-ed, the hid device is not
destroyed as it is owned by the transport layer.
So when we re-probed the device, the hid device is assumed to be already
claimed, and can lead to page faults if hid-core tries to forward the
emitted data to the to-be-created claimed node.
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Yet another device that needs this quirk.
Reported-by: NTanguy de Baritault <tdebaritault@gmail.com>
Signed-off-by: NAdel Gadllah <adel.gadllah@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>