When the setup of the GHL fails, we are not calling hid_hw_stop().
This leads to the hidraw node not being released, meaning a crash
whenever somebody attempts to open the file.

Cc: stable@vger.kernel.org
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20211202095334.14399-2-benjamin.tissoires@redhat.com

Many HID drivers assume that the HID device assigned to them is a USB
device as that was the only way HID devices used to be able to be
created in Linux.  However, with the additional ways that HID devices
can be created for many different bus types, that is no longer true, so
properly check that we have a USB device associated with the HID device
before allowing a driver that makes this assumption to claim it.

Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: Michael Zaidman <michael.zaidman@gmail.com>
Cc: Stefan Achatz <erazor_de@users.sourceforge.net>
Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Cc: linux-input@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tested-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
[bentiss: amended for thrustmater.c hunk to apply]
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211201183503.2373082-3-gregkh@linuxfoundation.org

The device string on these can differ, apparently, including typos. I've
bought 2 of these in 2012 and googling shows many folks out there with
that broken spelling in their dmesg.
Signed-off-by: NUlrich Spörlein <uqs@FreeBSD.org>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This commit adds support for the Guitar Hero Live PS4 dongles.

These dongles require a "magic" USB control message to be sent
every 8 seconds otherwise the dongle will not report events where
the strumbar is hit while a fret is being held.

Note that the GHL_GUITAR_POKE_INTERVAL is reduced to 8 seconds in order
to support PS3, Wii U, and PS4 GHL dongles.

Also note that the constant for vendor id 0x1430 has been renamed from
Activision to RedOctane as self-declared by the device.
Co-developed-by: NPascal Giard <pascal.giard@etsmtl.ca>
Signed-off-by: NPascal Giard <pascal.giard@etsmtl.ca>
Signed-off-by: NDaniel Nguyen <daniel.nguyen.1@ens.etsmtl.ca>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This commit fixes a freeze on insertion of a Guitar Hero Live PS3/WiiU
USB dongle. Indeed, with the current implementation, inserting one of
those USB dongles will lead to a hard freeze. I apologize for not
catching this earlier, it didn't occur on my old laptop.

While the issue was isolated to memory alloc/free, I could not figure
out why it causes a freeze. So this patch fixes this issue by
simplifying memory allocation and usage.

We remind that for the dongle to work properly, a control URB needs to
be sent periodically. We used to alloc/free the URB each time this URB
needed to be sent.

With this patch, the memory for the URB is allocated on the probe, reused
for as long as the dongle is plugged in, and freed once the dongle is
unplugged.
Signed-off-by: NPascal Giard <pascal.giard@etsmtl.ca>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This commit adds support for tilt on Standard Guitar Hero PS3 Guitars, and GH3
PC Guitars, mapping it to ABS_RY.

Note that GH3 PC Guitars are identical, only they use different VID and PIDs.

Also note that vendor id 0x12ba is used by a variety of different rhythm
controllers on the ps3.
Signed-off-by: NSanjay Govind <sanjay.govind9@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This commit adds support for the Guitar Hero Live PS3 and Wii U dongles.

These dongles require a "magic" USB control message [1] to be sent
approximately every 10 seconds otherwise the dongle will not report
events where the strumbar is hit while a fret is being held.

Also, inspired by a patch sent on linux-input by Sanjay Govind [2], the
accelerometer is mapped to ABS_RY for tilt.

Interestingly, the Wii U and PS3 dongles share the same VID and PID.

[1] https://github.com/ghlre/GHLtarUtility/
[2] https://marc.info/?l=linux-input&m=157242835928542&w=2Signed-off-by: NPascal Giard <pascal.giard@etsmtl.ca>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The hid-sony driver has custom DS4 connect/disconnect logic for the
DS4 dongle, which is a USB dongle acting as a proxy to Bluetooth
connected DS4.

The connect/disconnect logic works fine generally, however not in
conjunction with Steam. Steam implements its own DS4 driver using
hidraw. Both hid-sony and Steam are issuing their own HID requests
and are racing each other during DS4 dongle connect/disconnect
resulting in a kernel crash in hid-sony.

The problem is that upon a DS4 connect to the dongle, hid-sony kicks
of 'ds4_get_calibration_data' from within its dongle hotplug code.
The calibration code issues raw HID feature report for reportID 0x02.
When Steam is running, it issues a feature report for reportID 0x12
typically just prior to hid-sony requesting feature reportID 0x02.
The result is that 'ds4_get_calibration_data' receives the data Steam
requested as that's the HID report returing first. Currently this
results in it processing invalid data, which ultimately results in a
divide by zero upon a future 'dualshock4_parse_report'.

The solution for now is to check within 'ds4_get_calibration_data' to
check if we received data for the feature report we issued and if not
retry. This fixes bug 206785.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The DS4 dongle reports fw_version and hw_version as 0 when no actual
DS4 is connected to it. This prevents cleaning up sysfs nodes upon
device remove.

This patch decouples sysfs cleanup from the fw_version and hw_version
values by introducing boolean values.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This patch moves the power supply status logic to DS3/DS4 parse_report,
to allow for more accurate DS4 status reporting.

The DS4 power status code was actually incorrect, but reported okay'ish
data in most cases. There was a different interpretation of the battery_info
values 0-10 or 0-9 depending on cable state. It added +1 to extend the range
to 0-10. This is actually incorrect, there is no different range. Values
higher than 11 actually indicates 'full' and 14/15 'error' for which we
reported 100% and a valid power state.

Moving the status logic to parse_report avoids having to pass more state
to the generic sony_battery_get_property and simplifies the code.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Fix for non-working buttons on knock-off USB dongles for Sony
controllers. These USB dongles are used to connect older Sony DA/DS1/DS2
controllers via USB and are common on Amazon, AliExpress, etc.  Without
the patch, the square, X, and circle buttons do not function.  These
dongles used to work prior to kernel 4.10 but removing the global DS3
report fixup in commit e19a267b ("HID: sony: DS3 comply to Linux gamepad
spec") exposed the problem.

Many people reported the problem on the Ubuntu forums and are working
around the problem by falling back to the 4.9 hid-sony driver.

The problem stems from these dongles incorrectly reporting their button
count as 13 instead of 16.  This patch fixes up the report descriptor by
changing the button report count to 16 and removing 3 padding bits.

Cc: stable@vger.kernel.org
Fixes: e19a267b ("HID: sony: DS3 comply to Linux gamepad spec")
Signed-off-by: NScott Shumate <scott.shumate@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The syzbot fuzzer found a slab-out-of-bounds write bug in the hid-gaff
driver.  The problem is caused by the driver's assumption that the
device must have an input report.  While this will be true for all
normal HID input devices, a suitably malicious device can violate the
assumption.

The same assumption is present in over a dozen other HID drivers.
This patch fixes them by checking that the list of hid_inputs for the
hid_device is nonempty before allowing it to be used.

Reported-and-tested-by: syzbot+403741a091bf41d4ae79@syzkaller.appspotmail.com
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>

The sony driver is not properly cleaning up from potential failures in
sony_input_configured. Currently it calls hid_hw_stop, while hid_connect
is still running. This is not a good idea, instead hid_hw_stop should
be moved to sony_probe. Similar changes were recently made to Logitech
drivers, which were also doing improper cleanup.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
CC: stable@vger.kernel.org
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Valve reported a kernel crash on Ubuntu 18.04 when disconnecting a DS4
gamepad while rumble is enabled. This issue is reproducible with a
frequency of 1 in 3 times in the game Borderlands 2 when using an
automatic weapon, which triggers many rumble operations.

We found the issue to be a race condition between sony_remove and the
final device destruction by the HID / input system. The problem was
that sony_remove didn't clean some of its work_item state in
"struct sony_sc". After sony_remove work, the corresponding evdev
node was around for sufficient time for applications to still queue
rumble work after "sony_remove".

On pre-4.19 kernels the race condition caused a kernel crash due to a
NULL-pointer dereference as "sc->output_report_dmabuf" got freed during
sony_remove. On newer kernels this crash doesn't happen due the buffer
now being allocated using devm_kzalloc. However we can still queue work,
while the driver is an undefined state.

This patch fixes the described problem, by guarding the work_item
"state_worker" with an initialized variable, which we are setting back
to 0 on cleanup.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
CC: stable@vger.kernel.org
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Based on 1 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license as published by
  the free software foundation either version 2 of the license or at
  your option any later version

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 3029 file(s).
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Reviewed-by: NAllison Randal <allison@lohutok.net>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070032.746973796@linutronix.deSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Rumble support on SHANWAN PS3 gamepad is not working when a user
program has asked it to. If a HID Output Reports is sent via Control
Channel then it will be discard by gamepad, thus rumble motor and led
settings in Output Report are ignored.

This patch therefore sends HID Output Report via Interrupt Channel to
SHANWAN gamepad instead of Control Channel, fixing rumble motor and
led settings.
Signed-off-by: NHongye Yuan <outmatch@gmail.com>
Reviewed-by: NBastien Nocera <hadess@hadess.net>
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>

Transform the one-time check for a SHANWAN PS3 clone gamepad into a
quirk, to avoid doing the same string comparison in multiple places.
Signed-off-by: NHongye Yuan <outmatch@gmail.com>
Reviewed-by: NBastien Nocera <hadess@hadess.net>
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>

HID: hid-sony.c: Use devm_ api to simplify sc->output_report_dmabuf

Using devm_ calls, the resources of the Sony game devices's features are
tied to the main device handle, making it easier to handle errors and
teardown inside the device driver. Altogether, this reduces complexity
of the driver source.
Signed-off-by: NHanno Zulla <kontakt@hanno.de>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

HID: hid-sony.c: Use devm_ api to simplify sony_battery_probe()

Using devm_ calls, the resources of the Sony game devices's features are
tied to the main device handle, making it easier to handle errors and
teardown inside the device driver. Altogether, this reduces complexity
of the driver source.
Signed-off-by: NHanno Zulla <kontakt@hanno.de>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

[PATCH 3/5] HID: hid-sony.c: Use devm_ api to simplify sony_leds_init()

Using devm_ calls, the resources of the Sony game devices's features are
tied to the main device handle, making it easier to handle errors and
teardown inside the device driver. Altogether, this reduces complexity
of the driver source.
Signed-off-by: NHanno Zulla <kontakt@hanno.de>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

[PATCH 2/5] HID: hid-sony.c: Use devm_ api to simplify sony_register_sensors()

Using devm_ calls, the resources of the Sony game devices's features are
tied to the main device handle, making it easier to handle errors and
teardown inside the device driver. Altogether, this reduces complexity
of the driver source.
Signed-off-by: NHanno Zulla <kontakt@hanno.de>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

HID: hid-sony.c: Use devm_ api to simplify sony_register_touchpad()

Using devm_ calls, the resources of the Sony game devices's features are
tied to the main device handle, making it easier to handle errors and
teardown inside the device driver. Altogether, this reduces complexity
of the driver source.
Signed-off-by: NHanno Zulla <kontakt@hanno.de>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Sony's NSG-MR5U and NSG-MR7U remote controls have a full keyboard and a
touchpad.  The keyboard is already supported by the existing Linux
kernel and drivers but the touchpad is not recognized.  This patch adds
the coded needed to bring full functionality to the touchpad.

Note that these remotes use the vendor code for SMK even though they are
Sony branded.

Known limitations
- The built-in accelerometers are not supported by these changes
- When the Drag (Fn) key is used as a mouse button, the button is
automatically released when the key begins repeating.  There are two
  workarounds for this 1) Use the button behind the touchpad instead of
  the Drag (Fn) key or 2) Disable the key repeat functionality or
  increase the key repeat delay.
Signed-off-by: NTodd Kelner <tsopdump@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Report DS4 firmware and hardware version through sysfs for both
USB and Bluetooth. This information is important for userspace
in particular for device specific quirks (e.g. in Bluetooth stacks).
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Reversed MAC addresses can be printed directly using %pMR specifier.
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: NRoderick Colenbrander <roderick.colenbranderer@sony.com>
Acked-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The SHANWAN PS3 clone joypad will start its rumble motors as soon as
it is plugged in via USB. As the additional USB interrupt does nothing on
the original PS3 Sixaxis joypads, and makes a number of other
clone joypads actually start sending data, disable that call for
the SHANWAN so the rumble motors aren't started on plug.
Signed-off-by: NBastien Nocera <hadess@hadess.net>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

err is being checked for failure each time it is being updated
so this err check is totally redundant and can be removed

Detected with CoverityScan, CID#1420665 ("Logically dead code")
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Make sure we sure register any sensor when sony_input_configured failes.
Somehow this line got lost during resolving of merge conflicts in the
motion sensor patch series and a redudant remove was added as well later
on.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

By default when using bluetooth the DS4 reports data at about 1kHz,
which is quite fast especially on weak devices. We now make the
device use the USB poll interval, which is a fixed 4ms. In addition
we make the value adjustable through sysfs.

The error handling in sony_input_configured is a little tricky. It
is not easy to add other goto's as not all codepaths have logic
for adding this attribute. Luckily we are setting the value for the
attribute to a default value, so we can use that to detect if we need
to remove the file.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Only set bit flags for the portions of the DS4 output report
for which we have data.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

These colors are more the default colors normally used on the DS4.
The previous ones were faint and not so noticeable.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The navigation controller is a DS3 (sixaxis) with fewer physical
axes and buttons. It utilizes the same HID report as the DS3 and
thus reports axes/buttons which aren't physically present.
Currently many non-existing buttons and axes are reported, which
we are now removing.

For the axes/buttons which do exist, we make the axis/button mapping
similar to the DS3.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The DS3 MAC address is reported as a unique identified when
using Bluetooth. For USB there is no unique identifier reported
yet, so use the MAC address.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Game controllers can be connected twice through USB and BT. Only
one connection is allowed. Currently we perform a check for duplicate
controllers halfway through device initialization. To prevent
'transient' devices, we should do this check as early as we can.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This patch adds a separate evdev node for the DS3 its motion
sensors. We only expose the accelerometers as the gyroscope
is extremely difficult to manage and behavior varies a lot
between hardware revisions.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This patch adds printing when we failed to activate DS3 / Nagivation
controllers and checks the return value for these failures earlier
in sony_input_configured. This paves the way for other configuration
logic for these devices, which we don't want to call if for example
the activation failed.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The axis and button mapping for the DS3 is strange. This is mostly
due to the device reporting many axes as for every digital button
it also has an analog button. Due to amount of analog values it
is even leaking well into the MT axes range.

We felt it is best to remove the many analog buttons and just report
digital and comply to the Linux gamepad spec. The analog buttons are
rarely used on the official platform, let alone on Linux.

This patch does remove motion sensor support (added back in another
patch).
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Currently the DS4 touchpad device is neither classified as a direct
input device nor as a pointer device. It makes most sense to mark
it as a pointer device.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The DualShock 4 dongle isn't connected to a real DualShock 4 at
time of driver loading. When a DualShock 4 is plugged in, we
need to obtain calibration data (the dongle would have zeros).

This patch adds calibration logic, which we schedule on a hotplug
from sony_raw_event. In addition this patch adds dongle state
handling.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The driver currently uses sony_schedule_work to submit output
reports for the different devices for LEDs or rumble.

This patch adds a new parameter to sony_schedule_work to allow
scheduling for other types of work. The next patch in this series
will utilize this functionality. Considering the driver structure
and all error handling it felt best to reuse sony_schedule_work
and sony_cancel_work. The idea was inspired by the wacom driver
which does something similar.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>