Current names are reported as "K750", "M705", and it can be misleading
for the users when they look at their input device list.

Prefixing the names with "Logitech " makes things better.
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: NPeter Wu <peter@lekensteyn.nl>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Add a return to avoid a fall-through. Introduced in commit
57ac86cf ("HID: logitech-hidpp: add
support of the first Logitech Wireless Touchpad").
Signed-off-by: NPeter Wu <peter@lekensteyn.nl>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Allows for HID_BATTERY_STRENGTH config be enabled without the need for HID
module to be built-in, prior to this HID and POWER_SUPPLY had to be equal, and
now we only select POWER_SUPPLY and depend on the HID module.
Signed-off-by: NDaniel Nicoletti <dantti12@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

When a hid driver that uses i2c-hid as transport is unloaded, the hid core
will call i2c_hid_stop() which releases all the buffers associated with the
device. This includes also the command buffer.

Now, when the i2c-hid driver itself is unloaded it tries to power down the
device by sending it PWR_SLEEP command. Since the command buffer is already
released we get following crash:

 [   79.691459] BUG: unable to handle kernel NULL pointer dereference at           (null)
 [   79.691532] IP: [<ffffffffa05bc049>] __i2c_hid_command+0x49/0x310 [i2c_hid]
 ...
 [   79.693467] Call Trace:
 [   79.693494]  [<ffffffff810424e1>] ? __unmask_ioapic+0x21/0x30
 [   79.693537]  [<ffffffff81042855>] ? unmask_ioapic+0x25/0x40
 [   79.693581]  [<ffffffffa05bc35b>] ? i2c_hid_set_power+0x4b/0xa0 [i2c_hid]
 [   79.693632]  [<ffffffffa05bc3cf>] ? i2c_hid_runtime_resume+0x1f/0x30 [i2c_hid]
 [   79.693689]  [<ffffffff814c08fb>] ? __rpm_callback+0x2b/0x70
 [   79.693733]  [<ffffffff814c0961>] ? rpm_callback+0x21/0x90
 [   79.693776]  [<ffffffff814c0dec>] ? rpm_resume+0x41c/0x600
 [   79.693820]  [<ffffffff814c1e1c>] ? __pm_runtime_resume+0x4c/0x80
 [   79.693868]  [<ffffffff814b8588>] ? __device_release_driver+0x28/0x100
 [   79.693917]  [<ffffffff814b8d90>] ? driver_detach+0xa0/0xb0
 [   79.693959]  [<ffffffff814b82cc>] ? bus_remove_driver+0x4c/0xb0
 [   79.694006]  [<ffffffff810d1cfd>] ? SyS_delete_module+0x11d/0x1d0
 [   79.694054]  [<ffffffff8165f107>] ? int_signal+0x12/0x17
 [   79.694095]  [<ffffffff8165ee69>] ? system_call_fastpath+0x12/0x17

Fix this so that we only free buffers when the i2c-hid driver itself is
removed.

Fixes: 34f439e4 ("HID: i2c-hid: add runtime PM support")
Reported-by: NGabriele Mazzotta <gabriele.mzt@gmail.com>
Signed-off-by: NMika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Apple bluetooth wireless keyboard (sold in UK) has always reported zero
for battery strength no matter what condition the batteries are actually
in. With this patch applied (applying same quirk as other Apple
keyboards), the battery strength is now correctly reported.
Signed-off-by: NKarl Relton <karllinuxtest.relton@ntlworld.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Malicious USB devices can send bogus reports smaller than the expected
buffer size. Ensure that the length for WTP reports is valid to avoid
reading out of bounds.
Signed-off-by: NPeter Wu <peter@lekensteyn.nl>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Malicious USB devices can send bogus reports smaller than the expected
buffer size. Ensure that the length is valid to avoid reading out of
bounds.
Signed-off-by: NPeter Wu <peter@lekensteyn.nl>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

If a touchpad does not report relative data then query 6 will not be present and the address
of query 8 will be one less. This patches calculates the location of query 8 instead of
hardcoding the offset.
Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

If a touchpad reports the F11 data40 register then this indicates that the touchpad reports
additional ACM (Accidental Contact Mitigation) data after the F11 data in the HID attention
report. These additional bytes shift the position of the F30 button data causing the driver
to incorrectly report button state when this functionality is present. This patch accounts
for the additional data in the report.

Fixes:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1398533Signed-off-by: NAndrew Duggan <aduggan@synaptics.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Before ->start() is called, bufsize size is set to HID_MIN_BUFFER_SIZE,
64 bytes. While processing the IRQ, we were asking to receive up to
wMaxInputLength bytes, which can be bigger than 64 bytes.

Later, when ->start is run, a proper bufsize will be calculated.

Given wMaxInputLength is said to be unreliable in other part of the
code, set to receive only what we can even if it results in truncated
reports.
Signed-off-by: NGwendal Grignou <gwendal@chromium.org>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Balance a hid_device_io_start() call with hid_device_io_stop() in the
error path. This avoids processing of HID reports when the probe fails
which possibly leads to invalid memory access in hid_device_probe() as
report_enum->report_id_hash might already be freed via
hid_close_report().

hid_set_drvdata() is called before wtp_allocate, be consistent and clear
drvdata too on the error path of wtp_allocate.
Signed-off-by: NPeter Wu <peter@lekensteyn.nl>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The HID response has a limited size. Do not trust the value returned by
hardware, check that it really fits in the message.
Signed-off-by: NPeter Wu <peter@lekensteyn.nl>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

hidpp_devicenametype_get_device_name() may return a negative value on
protocol errors (for example, when the device is powered off).
Explicitly check this condition to avoid a long-running loop.

(0 cannot be returned as __name_length - index > 0, but check for it
anyway as it would otherwise result in an infinite loop.)
Signed-off-by: NPeter Wu <peter@lekensteyn.nl>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

We do not make any use of the actual name length get through
hidpp_get_device_name(). Original patch by Benjamin Tissoires, this
patch also replaces a (now) unnecessary goto by return NULL.
Signed-off-by: NPeter Wu <peter@lekensteyn.nl>
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The existing generic touch code only reports events after reading an
entire HID report, which practically means that only data about the last
contact in a report will ever be provided to userspace. This patch uses
a trick from hid-multitouch.c to discover what type of field is at the
end of each contact; when such a field is encountered all the stored
contact data will be reported.
Signed-off-by: NJason Gerecke <killertofu@gmail.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

If a HID descriptor places HID_DG_CONTACTID before HID_DG_X and HID_DG_Y then
the ABS_X and ABS_Y will not be automatically initialized by the call to
input_mt_init_slots. To ensure that this is not a problem, we relocate that
call to occur after HID parsing has been completed and we've initalized all the
multitouch axes.
Signed-off-by: NJason Gerecke <killertofu@gmail.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Defined outbound offset for DTU and Cintiq. But didn't update
the relevant maximum values. Oops...
Signed-off-by: NPing Cheng <pingc@wacom.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Signed-off-by: NPing Cheng <pingc@wacom.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

After commit b2b49ccb (PM: Kconfig: Set PM_RUNTIME if PM_SLEEP is
selected) PM_RUNTIME is always set if PM is set, so #ifdef blocks
depending on CONFIG_PM_RUNTIME may now be changed to depend on
CONFIG_PM.

Replace CONFIG_PM_RUNTIME with CONFIG_PM in drivers/hid/i2c-hid/i2c-hid.c.
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: NJiri Kosina <jkosina@suse.cz>
Reviewed-by: NMika Westerberg <mika.westerberg@linux.intel.com>

There are screen to tablet offsets for newer Cintiq and DTU models.
These offsets serve as outbound tracking for those display tablets.

Use defines instead of hardcoded numbers for the offsets.
Signed-off-by: NPing Cheng <pingc@wacom.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Since the conversion from USB to HID (in v3.17), some people reported a
freeze on boot with the wacom driver. Hans managed to get a stacktrace:

[  240.272331] Call Trace:
[  240.272338]  [<ffffffff813de7b9>] ? usb_hcd_submit_urb+0xa9/0xb10
[  240.272347]  [<ffffffff81555579>] schedule+0x29/0x70
[  240.272355]  [<ffffffff815559e6>] schedule_preempt_disabled+0x16/0x20
[  240.272363]  [<ffffffff81557365>] __mutex_lock_slowpath+0xe5/0x230
[  240.272372]  [<ffffffff815574c7>] mutex_lock+0x17/0x30
[  240.272380]  [<ffffffffa063c1d2>] wacom_resume+0x22/0x50 [wacom]
[  240.272396]  [<ffffffffa01aea8a>] hid_resume_common+0xba/0x110 [usbhid]
[  240.272404]  [<ffffffff813e5890>] ? usb_runtime_suspend+0x80/0x80
[  240.272417]  [<ffffffffa01aeb1d>] hid_resume+0x3d/0x70 [usbhid]
[  240.272425]  [<ffffffff813e44a6>] usb_resume_interface.isra.6+0xb6/0x120
[  240.272432]  [<ffffffff813e4774>] usb_resume_both+0x74/0x140
[  240.272439]  [<ffffffff813e58aa>] usb_runtime_resume+0x1a/0x20
[  240.272446]  [<ffffffff813b1912>] __rpm_callback+0x32/0x70
[  240.272453]  [<ffffffff813b1976>] rpm_callback+0x26/0xa0
[  240.272460]  [<ffffffff813b2d71>] rpm_resume+0x4b1/0x690
[  240.272468]  [<ffffffff812ab992>] ? radix_tree_lookup_slot+0x22/0x50
[  240.272475]  [<ffffffff813b2c1a>] rpm_resume+0x35a/0x690
[  240.272482]  [<ffffffff8116e9c9>] ? zone_statistics+0x89/0xa0
[  240.272489]  [<ffffffff813b2f90>] __pm_runtime_resume+0x40/0x60
[  240.272497]  [<ffffffff813e4272>] usb_autopm_get_interface+0x22/0x60
[  240.272509]  [<ffffffffa01ae8d9>] usbhid_open+0x59/0xe0 [usbhid]
[  240.272517]  [<ffffffffa063ac85>] wacom_open+0x35/0x50 [wacom]
[  240.272525]  [<ffffffff813f37b9>] input_open_device+0x79/0xa0
[  240.272534]  [<ffffffffa048d1c1>] evdev_open+0x1b1/0x200 [evdev]
[  240.272543]  [<ffffffff811c899e>] chrdev_open+0xae/0x1f0
[  240.272549]  [<ffffffff811c88f0>] ? cdev_put+0x30/0x30
[  240.272556]  [<ffffffff811c17e2>] do_dentry_open+0x1d2/0x320
[  240.272562]  [<ffffffff811c1cd1>] finish_open+0x31/0x50
[  240.272571]  [<ffffffff811d2202>] do_last.isra.36+0x652/0xe50
[  240.272579]  [<ffffffff811d2ac7>] path_openat+0xc7/0x6f0
[  240.272586]  [<ffffffff811cf012>] ? final_putname+0x22/0x50
[  240.272594]  [<ffffffff811d42d2>] ? user_path_at_empty+0x72/0xd0
[  240.272602]  [<ffffffff811d43fd>] do_filp_open+0x4d/0xc0
[...]

So here, wacom_open is called, and then wacom_resume is called by the
PM system. However, wacom_open already took the lock when wacom_resume
tries to get it. Freeze.

A little bit of history shows that this already happened in the past
- commit f6cd3783 ("Input: wacom - fix runtime PM related deadlock"),
and the solution was to call first the PM function before taking the lock.

The lock was introduced in commit commit e7224094 ("Input: wacom -
implement suspend and autosuspend") when the autosuspend feature has
been added. Given that usbhid already takes care of this very same
locking between suspend/resume, I think we can simply kill the lock
in open/close.

The lock is now used also with LEDs, so we can not remove it completely.
Reported-by: NHans Spath <inbox-546@hans-spath.de>
Tested-by: NHans Spath <inbox-546@hans-spath.de>
CC: stable@vger.kernel.org # v3.17+
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Dropped in the following commit:

commit a3e6f654 ("Input: wacom - keep wacom_ids ordered")
Reported-by: NHans Spath <inbox-546@hans-spath.de>
CC: stable@vger.kernel.org    # v3.17+
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

In several hid drivers it is necessary to calculate the length of an
hid_report. This patch exports the existing static function hid_report_len of
hid-core.c as an inline function in hid.h
Signed-off-by: NMathieu Magnaudet <mathieu.magnaudet@enac.fr>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: NDavid Herrmann <dh.herrmann@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

It is not necessarily sufficient to look only at the physical and logical
usages when determining if a field is for the pen or touch. Some fields
are not contained in a sub-collection and thus only have an application
usage. Not checking the application usage in such cases causes us to
ignore the field entirely, which may lead to incorrect behavior.
Signed-off-by: NJason Gerecke <killertofu@gmail.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

PAD can be on pen interface (Intuos Pro and Cintiq series) or touch
interface (Bamboo PT and Intuos PT series) or its own interface
(Bamboo pen-only and Intuos Pen M/S). We need to mark it independently.
Signed-off-by: NPing Cheng <pingc@wacom.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Use mfd_add_hotplug_devices() helper to register the subdevices.

Compile-only tested.
Signed-off-by: NJohan Hovold <johan@kernel.org>
Acked-by: NJiri Kosina <jkosina@suse.cz>
Signed-off-by: NLee Jones <lee.jones@linaro.org>

VTL panels do not switch to the multitouch mode until the input mode
feature is read by the host. This should normally be done by
usbhid, but it looks like an other bug prevents usbhid to properly
retrieve the feature state. As a workaround, we force the reading of
the feature in mt_set_input_mode for such devices.
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NMathieu Magnaudet <mathieu.magnaudet@enac.fr>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Current driver uses a common buffer for reading reports either
synchronously in i2c_hid_get_raw_report() and asynchronously in
the interrupt handler.
There is race condition if an interrupt arrives immediately after
the report is received in i2c_hid_get_raw_report(); the common
buffer is modified by the interrupt handler with the new report
and then i2c_hid_get_raw_report() proceed using wrong data.

Fix it by using a separate buffers for synchronous reports.
Signed-off-by: NJean-Baptiste Maneyrol <jmaneyrol@invensense.com>
[Antonio Borneo: cleanup, rebase to v3.17, submit mainline]
Signed-off-by: NAntonio Borneo <borneo.antonio@gmail.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Provide the resolution of several angular axes (tilt, pen rotation, puck
rotation) to userspace. Because these values are natively degree-based, we
need to convert them to into units/radian as required by the input_absinfo
struct. To ensure wraparound behaves properly for the rotation axes, the
converted value was rounded up rather than rounded nearest.

Notably, the touchring axes (ABS_WHEEL and ABS_THROTTLE) are left without a
a declared resolution because the their low resolution cannot be accurately
represented (the worst-case rounding-induced error would be ~16 degrees).
Pre-scaling the values and range by at least 10x would reduce the error in
the resolution to acceptable levels, but the xf86-input-wacom driver is not
able to use pre-scaled values for these axes at this time.
Signed-off-by: NJason Gerecke <killertofu@gmail.com>
Reviewed-by: NPing Cheng <pingc@wacom.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Centers the ABS_TILT_{X,Y} axes so that a value of zero is reported when
the pen is vertical. Combined with resolution information in the next
patch, this makes it possible for userspace to calculate the pen angle
without needing hardware-specific knowledge. The xf86-input-wacom driver
was updated to support signed tilt values in late-2012 (2f2acec).
Signed-off-by: NJason Gerecke <killertofu@gmail.com>
Reviewed-by: NPing Cheng <pingc@wacom.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Bamboo models do not support HID_DG_CONTACTMAX. Plus, Bamboo pen-only
has touch descriptor. This leads to some complications in the code.

This patch also fixes duplicated PAD interfeaces for Intuos Pen
models.
Signed-off-by: NPing Cheng <pingc@wacom.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Graphire 4 only has two tablet buttons; Bamboo Fun touch ring is only
for PAD.
Signed-off-by: NPing Cheng <pingc@wacom.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

ENODEV indicates no device is added. Hence, the associated pad input device
is simply freed.
Signed-off-by: NPing Cheng <pingc@wacom.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Add vid/pid for the SMK branded third-party PS3 Bluetooth remote and enable
support in the hid-sony driver.
Signed-off-by: NFrank Praznik <frank.praznik@oh.rr.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The touchscreen needs the same quirk as the other models.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Reported-by: NBryan Poling <poli0048@umn.edu>
CC: stable@vger.kernel.org
Acked-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Replace stack buffers with kernel allocated buffers for sending
and receiving HID reports to prevent issues with DMA transfers
on certain hardware.

Output report buffers are allocated at initialization time to avoid
excessive calls to kmalloc and kfree.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=87991Signed-off-by: NFrank Praznik <frank.praznik@oh.rr.com>
Reviewed-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Report is received in "buffer"; fix the following i2c_hid_dbg()
to dump data from the correct pointer.
Signed-off-by: NJean-Baptiste Maneyrol <jmaneyrol@invensense.com>
[Antonio Borneo: cleanup and rebase to v3.17]
Signed-off-by: NAntonio Borneo <borneo.antonio@gmail.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Signed-off-by: NPing Cheng <pingc@wacom.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

On the USB keyboard, the VENDOR hotkeys share the same device as the
mouse. Setting EV_REP also affects mouse buttons, so leave it off.

The bluetooth keyboard still has autorepeating mouse buttons, as it
only has one device and is set by the KEYBOARD pages.
Signed-off-by: NJamie Lentin <jm@lentin.co.uk>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The bluetooth keyboard also generates 0x00fa when the middle button is
pressed. Move the made-up report out of the way so we don't trigger
KEY_FILE when middle button is pressed
Signed-off-by: NJamie Lentin <jm@lentin.co.uk>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>