There is an error in the report descriptor of the Thinkpad Helix 2 where
logical minimum value (557376) is greater than logical maximum (491200)
for all of the magnetic flux axis data fields. This error results in a
report descriptor parsing failure that causes the sensors attached to the
hub not to be detected.

dmesg excerpt:
[   19.866905] drivers/hid/hid-core.c: logical range invalid 0x88140 0x77ec0
[   19.866914] hid-sensor-hub 0018:2047:0855.0007: item 0 1 0 8 parsing failed
[   19.866926] hid-sensor-hub 0018:2047:0855.0007: parse failed
[   19.866933] hid-sensor-hub: probe of 0018:2047:0855.0007 failed with error -22

Add a report fixup to change magnetic flux logical minimums to -557376
for the parsing to succeed and the sensors to get detected.
After applying the fix the sensors get detected, with corresponding drivers
(hid-accel-3d,hid-gyro-3d,etc) loaded, and its possible to read their values.
Signed-off-by: NFernando D S Lima <fernandodsl@gmail.com>
Reviewed-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Like yogas with TEXAS_INSTRUMENTS, yogas with ITE chips needs
to be initialized with enumeration quirks.
Signed-off-by: NJiri Kosina <jkosina@suse.com>

When CONFIG_DEBUG_LOCK_ALLOC is defined, mutex magic is compared and
warned for (l->magic != l), here l is the address of mutex pointer.
In hid-sensor-hub as part of hsdev creation, a per hsdev mutex is
initialized during MFD cell creation. This hsdev, which contains, mutex
is part of platform data for the a cell. But platform_data is copied
in platform_device_add_data() in platform.c. This copy will copy the
whole hsdev structure including mutex. But once copied the magic
will no longer match. So when client driver call
sensor_hub_input_attr_get_raw_value, this will trigger mutex warning.
So to avoid this allocate mutex dynamically. This will be same even
after copy.
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Since I can't change the type of hid_set_field argument 3, using __force __s32 to remove
this warning.
Reported-by: Nkbuild test robot <fengguang.wu@intel.com>
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

For defining enumeration values like report or power status events, the
enumeration usage ids are enclosed in a logical collection.  In this case we
need to match logical usage id for pending read on this usage id. For example,
in the below field, when read is requested for 0319, the report will
contain one of the status usages like 850, 851 etc. In this case the raw
event will not match 0319. So when logical collection matches, then wake
up the pending thread.

      Physical(Sensor.OtherCustom)
      Logical(Sensor.0319)
      Application(Sensor.Sensor)
      Usage(6)
        Sensor.0850
        Sensor.0851
        Sensor.0852
        Sensor.0853
        Sensor.0854
        Sensor.0855
      Logical Minimum(1)
      Logical Maximum(5)
      Report Size(8)
      Report Count(1)
      Report Offset(24)
      Flags( Array Absolute )
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Current API only allows setting one offset in the field. This API
is extended to set multiple offsets in the field report.
Also update parameters in the users of this API.
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Reviewed-by: NJonathan Cameron <jic23@kernel.org>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Some hid sensor feature report can contain more than one reports.
This API can now support receiving multiple values from the feature
report.
Also update the parameters in the users of this API.
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Acked-by: NJonathan Cameron <jic23@kernel.org>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Add additional flag to read in async mode. In this mode the caller will get
reply via registered callback for capture_sample. Callbacks can be registered
using sensor_hub_register_callback function. The usage id parameter of the
capture_sample can be matched with the usage id of the requested attribute.
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Acked-by: NJonathan Cameron <jic23@kernel.org>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Section 4.2.5 of HID Sensor hub specification allows two methods
defining sensor devices.
- Each sensor device by its own collection
- A top level application collection object, including multiple
sensors.
In the first method, each sensor can be in its own sensor application
collection without a physical collection.
In the second method there is a usage id for collection type, which
is defined as an application collection, with multiple physical
collections in it. It is possible to define fusion sensor with this
and may have its own handler. If there is a callback registered
for the collection type, then forward all reports for sensors in
its collection to this handler.
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Current implementation only allows one outstanding synchronous read.
This is a performance hit when user mode is requesting raw reads
of sensor attributes on multiple sensors together.
This change changes the mutex lock to per hid sensor hub device instead
of global lock. Although request to hid sensor hub is serialized, there
can be multiple outstanding read requests pending for responses via
hid reports.
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Acked-by: NJonathan Cameron <jic23@kernel.org>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Commit 0ccf091d ("HID: sensor-hub:
make dyn_callback_lock IRQ-safe) was supposed to change locks
in sensor_hub_get_callback(), but missed.
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Use mfd_add_hotplug_devices() helper to register the subdevices.

Compile-only tested.
Signed-off-by: NJohan Hovold <johan@kernel.org>
Acked-by: NJiri Kosina <jkosina@suse.cz>
Signed-off-by: NLee Jones <lee.jones@linaro.org>

Adding USB_DEVICE_ID_STM_HID_SENSOR again in the quirk table. During 3.16 merge
cycle somehow quirk for device id USB_DEVICE_ID_STM_HID_SENSOR is missing.
I see commit dde3b45c ("HID: hid-sensor-hub: new device id and quirk
for STM Sensor hub") added new id USB_DEVICE_ID_STM_HID_SENSOR_1,
but didn't really delete the old device id.
Anyway we need to add this back, otherwise it breaks ST sensor hubs.
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Use devm_kzalloc for all calls to kzalloc and not just the first.  Use
devm functions for other allocations as well. The calls to free the
allocated memory in the probe and remove functions are done away with
and a label is removed in the probe function.

The semantic match that finds the inconsistency is as follows:

// <smpl>
@@
@@

*devm_kzalloc(...)
...
*kzalloc(...)
// </smpl>
Signed-off-by: NHimangi Saraogi <himangi774@gmail.com>
Acked-by: NJulia Lawall <julia.lawall@lip6.fr>
Reviewed-by: NSrinivas Pandruvada <srinivas.pandruvada@intel.com>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

Use devm_kzalloc for all calls to kzalloc and not just the first.  Use
devm functions for other allocations as well. The calls to free the
allocated memory in the probe and remove functions are done away with
and a label is removed in the probe function.

The semantic match that finds the inconsistency is as follows:

// <smpl>
@@
@@

*devm_kzalloc(...)
...
*kzalloc(...)
// </smpl>
Signed-off-by: NHimangi Saraogi <himangi774@gmail.com>
Acked-by: NJulia Lawall <julia.lawall@lip6.fr>
Reviewed-by: NSrinivas Pandruvada <srinivas.pandruvada@intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

hsdev is not freed in sensor_hub_probe when kasprintf inside the for
loop fails. This is because hsdev is not set to platform_data yet (to
be freed by the code in the err_no_mem label). So free the memory
explicitly in the 'if' branch, as this is the only place where this is
(and will) be needed.

Reported-by: coverity
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: srinivas pandruvada <srinivas.pandruvada@intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

dyn_callback_lock is being taken from IRQ context through hid_irq_in() ->
hid_input_report() -> sensor_hub_raw_event() -> sensor_hub_get_callback(),
therefore anyone else acquiring it needs to disable IRQs to disable deadlocks.
Reported-by: NAlexander Holler <holler@ahsoftware.de>
Tested-by: NAlexander Holler <holler@ahsoftware.de>
Reported-by: NReyad Attiyat <reyad.attiyat@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Added STM sensor hub new device id. Also added this new device
in HID_SENSOR_HUB_ENUM_QUIRK to fix report descriptors.
These devices uses old FW which uses logical 0 as minimum.
In these, HID reports are not using proper collection classes.
So we need to fix report descriptors,for such devices. This
will not have any impact, if the FW uses logical 1 as minimum.
Signed-off-by: NArchana Patni <archana.patni@intel.com>
Signed-off-by: NSubramony Sesha <subramony.sesha@intel.com>
Reviewed-by: NSrinivas Pandruvada <srinivas.pandruvada@intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Add the Microsoft Surface Pro 2 Type/Touch and default device hardware ID's
Set report quirk for the device in hid-sensor-hub
Signed-off-by: NReyad Attiyat <reyad.attiyat@gmail.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The sensor hub in Lenovo Yogas needs the enumeration quirk.  I've been running
the patch for over a month with no problems, whereas the unpatched drivers
reliably mis-initialized the sensors.
Signed-off-by: NPeter F. Patel-Schneider <pfpschneider@gmail.com>
Acked-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Just like some of the other laptops/tablets on the market with ultrabook
sensors, the ThinkPad Helix's sensor hub requires a special quirk in
order for it to power on properly. Without it the sensors are detected
by the kernel and set up as usual, but they won't output any data. This
will also fix the sensors on any other laptops with the same model of
sensor hub.
Signed-off-by: NStephen Chandler Paul <thatslyude@gmail.com>
Acked-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Fix issue with the sleeping calling hid_hw_request under spinlock.
When i2c is used as HID transport, this is calling kmalloc, which
can sleep. So remove call to this function while under spinlock.
 [ 1067.021961] Call Trace:
 [ 1067.021970]  [<ffffffff8192f5f2>] dump_stack+0x4d/0x6f
 [ 1067.021976]  [<ffffffff811109f2>] __might_sleep+0xd2/0xf0
 [ 1067.021981]  [<ffffffff811ea15b>] __kmalloc+0xeb/0x200
 [ 1067.021989]  [<ffffffff816e0cb3>] ? hid_alloc_report_buf+0x23/0x30
 [ 1067.021993]  [<ffffffff816e0cb3>] hid_alloc_report_buf+0x23/0x30
 [ 1067.021997]  [<ffffffff816f4cb7>] i2c_hid_request+0x57/0x110
 [ 1067.022006]  [<ffffffffa02bc61c>] sensor_hub_input_attr_get_raw_value+0xbc/0x100 [hid_sensor_hub]
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

In HID sensor hub, HID physical ids are used to represent different sensors.
For example physical id of 0x73 in usage page = 0x20, represents an
accelerometer. The HID sensor hub driver uses this physical ids to create
platform devices using MFD. There is 1:1 correspondence between an phy id and a
client driver.

But in some cases these physical ids are reused. There is a phy id 0xe1, which
specifies a custom sensor, which can exist multiple times to represent various
custom sensors. In this case there can be multiple instances of client MFD
drivers, processing specific custom sensor. In this case when client driver
looks for report id or a field index, it should still get the report id
specific to its own type. This is also true for reports, they should be
directed towards correct instance.  This change introduce a way to parse and
tie physical devices to their correct instance.

Summary of changes:
- To get physical ids, use collections. If a collection of type=physical
  exist then use usage id as in the name of platform device name
- As part of the platform data, we assign a hdsev instance, which has
  start and end of collection indexes. Using these indexes attributes
  can be tied to correct MFD client instances
- When a report is received, call callback with correct hsdev instance.
  In this way using its private data stored as part of its registry, it
  can distinguish different sensors even when they have same physical and
  logical ids.

  This patch is co-authored with Archana Patni <archna.patni@intel.com>.
Reported-by: NArchana Patni <archana.patni@intel.com>
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NArchana Patni <archana.patni@intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

In some report descriptors, they leave holes in the selectors. In
this case if we use hardcoded selector values, this will result
in invalid values. For example, if there is selectors defined for
Power State from OFF to D0 to D3. We can't use indexes of these states
if some states are not implemented or not present in the report decriptors.
In this case, we need to get the indexes from report descriptors.

One API is added to get the index of a selector. This API will
search for usage id in the field usage list and return the index.
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Added STM sensor hub vendor id in HID_SENSOR_HUB_ENUM_QUIRK to
fix report descriptors. These devices uses old FW which uses
logical 0 as minimum. In these, HID reports are not using proper
collection classes. So we need to fix report descriptors,for
such devices. This will not have any impact, if the FW uses
logical 1 as minimum.

We look for usage id for "power and report state", and modify
logical minimum value to 1.

This is a follow-up patch to commit id 875e36f8.
Signed-off-by: NArchana Patni <archana.patni@linux.intel.com>
Reviewed-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This addresses regression caused by commit id "751d17e2"
 iio: hid-sensors: Fix power and report state.
This commit removed a quirk, to change the enumeration base
to 1 from 0 based on an CONFIG paramter. There was objection to
add more changes under this quirk, instead suggested to add an
HID quirk. But there is no easy way to add HID qurik as the
reports are not properly using collection class.

The solution was to use logical minimum, which is a correct way.
There were changes done in firmware to address this.

Unfortunately some devices, still use old FW and can't be upgraded
to newer version on Linux devices as there is no FW upgrade tool
available for Linux devices. So we need to fix report descriptors,
for such devices. This will not have any impact, if the FW uses
logical 1 as minimum.

In this patch we look for usage id for "power and report state", and
modify logical minimum value to 1.

Background on enum:
In the original HID sensor hub firmwares all Named array enums were
to 0-based. But the most recent hub implemented as 1-based,
because of the implementation by one of the major OS vendor.
Using logical minimum for the field as the base of enum. So we add
logical minimum to the selector values before setting those fields.
Some sensor hub FWs already changed logical minimum from 0 to 1
to reflect this and hope every other vendor will follow.
There is no easy way to add a common HID quirk for NAry elements,
even if the standard specifies these field as NAry, the collection
used to describe selectors is still just "logical".
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Fix kernel warning and failure to register sensor hub devices with MFD.  Now
many devices has in-built sensor hubs. So by default this HID hub, is properly
parsed and register individual sensors as platform device using MFD framework.
But if a second sensor hub is attached via USB, which has same sensors, it will
result in kernel warning and failure to register MFD cell as the platform
device sysfs file name will be same as created by in-built sensor hubs. This
patch sets MFD cell id to PLATFORM_DEVID_AUTO. In this way there will never be
duplicate sysfs file names.
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Exporting logical minimum and maximum of HID fields as part of the
hid sensor attribute info. This can be used for range checking and
to calculate enumeration base for NAry fields of HID sensor hub.
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

Most of the hid sensor field size is reported in report_size field
in the report descriptor. For rotation fusion sensor the quaternion
data is 16 byte field, the report size was set to 4 and report
count field is set to 4. So the total size is 16 bytes. But the current
driver has a bug and not taking account for report count field. This
causes user space to see only 4 bytes of data sent via IIO interface.
The number of bytes in a field needs to take account of report_count
field. Need to multiply report_size and report_count to get total
number of bytes.
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Don't call hid_open_device till there is actually an user. This saves
power by not opening underlying transport for HID. Also close device
if there are no active mfd client using HID sensor hub.
Signed-off-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

The patch substitutes kmemdup for kmalloc followed by memcpy.
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

devm_kzalloc() will manage resources freeing and allows to make error path
smaller and nicer.
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Patch just rearranges lines to be more compact and/or readable. Additionally it
converts double space to one in several places.

There is no functional change.
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: NSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

A HID device could send a malicious feature report that would cause the
sensor-hub HID driver to read past the end of heap allocation, leaking
kernel memory contents to the caller.

CVE-2013-2898
Signed-off-by: NKees Cook <keescook@chromium.org>
Cc: stable@kernel.org
Reviewed-by: NMika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This patch fixes the style of the comments to be like following
	/* The commentary */

There is no functional change.
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This removes most of the dependencies between hid drivers and usbhid.

The patch was constructed by replacing all occurences of
usbhid_wait_io() by its hid_hw_wait() counterpart.
Then, drivers not requiring USB_HID anymore have their USB_HID
dependency cleaned in the Kconfig file.

As of today, few drivers are still requiring an explicit USB layer
dependency:
* ntrig (a patch is on its way)
* multitouch (one patch following and another on its way)
* lenovo tpkbd
* roccat
* sony

The last three are two deeply using direct calls to the usb subsystem
to be able to be cleaned right now.
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: NMika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This allows the hid drivers to be independent from the transport layer.

The patch was constructed by replacing all occurences of
usbhid_submit_report() by its hid_hw_request() counterpart.
Then, drivers not requiring USB_HID anymore have their USB_HID
dependency cleaned in the Kconfig file.

Finally, few drivers still depends on USB_HID. Many of them
are requiring the io wait callback. They are found in the next patch.
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: NMika Westerberg <mika.westerberg@linux.intel.com>

For the sensor-hub part:
Tested-by: NMika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

We now have two transport mediums: USB and I2C, where sensor hubs can
exists. So instead of constraining the driver to only these two we let it
to match any HID bus as long as the group is HID_GROUP_SENSOR_HUB.
Signed-off-by: NMika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This table is not used anywhere in the driver so kill it.
Signed-off-by: NMika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Use the new module_hid_driver macro in all HID drivers that have
a simple register/unregister init/exit.

This also converts the hid drivers that test for a failure of
hid_register_driver() and report the failure. Using module_hid_driver
in those drivers removes the failure message.
Signed-off-by: NH Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>