Fix for non-working buttons on knock-off USB dongles for Sony
controllers. These USB dongles are used to connect older Sony DA/DS1/DS2
controllers via USB and are common on Amazon, AliExpress, etc.  Without
the patch, the square, X, and circle buttons do not function.  These
dongles used to work prior to kernel 4.10 but removing the global DS3
report fixup in commit e19a267b ("HID: sony: DS3 comply to Linux gamepad
spec") exposed the problem.

Many people reported the problem on the Ubuntu forums and are working
around the problem by falling back to the 4.9 hid-sony driver.

The problem stems from these dongles incorrectly reporting their button
count as 13 instead of 16.  This patch fixes up the report descriptor by
changing the button report count to 16 and removing 3 padding bits.

Cc: stable@vger.kernel.org
Fixes: e19a267b ("HID: sony: DS3 comply to Linux gamepad spec")
Signed-off-by: NScott Shumate <scott.shumate@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The syzbot fuzzer found a slab-out-of-bounds write bug in the hid-gaff
driver.  The problem is caused by the driver's assumption that the
device must have an input report.  While this will be true for all
normal HID input devices, a suitably malicious device can violate the
assumption.

The same assumption is present in over a dozen other HID drivers.
This patch fixes them by checking that the list of hid_inputs for the
hid_device is nonempty before allowing it to be used.

Reported-and-tested-by: syzbot+403741a091bf41d4ae79@syzkaller.appspotmail.com
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>

The sony driver is not properly cleaning up from potential failures in
sony_input_configured. Currently it calls hid_hw_stop, while hid_connect
is still running. This is not a good idea, instead hid_hw_stop should
be moved to sony_probe. Similar changes were recently made to Logitech
drivers, which were also doing improper cleanup.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
CC: stable@vger.kernel.org
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Valve reported a kernel crash on Ubuntu 18.04 when disconnecting a DS4
gamepad while rumble is enabled. This issue is reproducible with a
frequency of 1 in 3 times in the game Borderlands 2 when using an
automatic weapon, which triggers many rumble operations.

We found the issue to be a race condition between sony_remove and the
final device destruction by the HID / input system. The problem was
that sony_remove didn't clean some of its work_item state in
"struct sony_sc". After sony_remove work, the corresponding evdev
node was around for sufficient time for applications to still queue
rumble work after "sony_remove".

On pre-4.19 kernels the race condition caused a kernel crash due to a
NULL-pointer dereference as "sc->output_report_dmabuf" got freed during
sony_remove. On newer kernels this crash doesn't happen due the buffer
now being allocated using devm_kzalloc. However we can still queue work,
while the driver is an undefined state.

This patch fixes the described problem, by guarding the work_item
"state_worker" with an initialized variable, which we are setting back
to 0 on cleanup.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
CC: stable@vger.kernel.org
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Based on 1 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license as published by
  the free software foundation either version 2 of the license or at
  your option any later version

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 3029 file(s).
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Reviewed-by: NAllison Randal <allison@lohutok.net>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070032.746973796@linutronix.deSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Rumble support on SHANWAN PS3 gamepad is not working when a user
program has asked it to. If a HID Output Reports is sent via Control
Channel then it will be discard by gamepad, thus rumble motor and led
settings in Output Report are ignored.

This patch therefore sends HID Output Report via Interrupt Channel to
SHANWAN gamepad instead of Control Channel, fixing rumble motor and
led settings.
Signed-off-by: NHongye Yuan <outmatch@gmail.com>
Reviewed-by: NBastien Nocera <hadess@hadess.net>
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>

Transform the one-time check for a SHANWAN PS3 clone gamepad into a
quirk, to avoid doing the same string comparison in multiple places.
Signed-off-by: NHongye Yuan <outmatch@gmail.com>
Reviewed-by: NBastien Nocera <hadess@hadess.net>
Signed-off-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>

HID: hid-sony.c: Use devm_ api to simplify sc->output_report_dmabuf

Using devm_ calls, the resources of the Sony game devices's features are
tied to the main device handle, making it easier to handle errors and
teardown inside the device driver. Altogether, this reduces complexity
of the driver source.
Signed-off-by: NHanno Zulla <kontakt@hanno.de>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

HID: hid-sony.c: Use devm_ api to simplify sony_battery_probe()

Using devm_ calls, the resources of the Sony game devices's features are
tied to the main device handle, making it easier to handle errors and
teardown inside the device driver. Altogether, this reduces complexity
of the driver source.
Signed-off-by: NHanno Zulla <kontakt@hanno.de>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

[PATCH 3/5] HID: hid-sony.c: Use devm_ api to simplify sony_leds_init()

Using devm_ calls, the resources of the Sony game devices's features are
tied to the main device handle, making it easier to handle errors and
teardown inside the device driver. Altogether, this reduces complexity
of the driver source.
Signed-off-by: NHanno Zulla <kontakt@hanno.de>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

[PATCH 2/5] HID: hid-sony.c: Use devm_ api to simplify sony_register_sensors()

Using devm_ calls, the resources of the Sony game devices's features are
tied to the main device handle, making it easier to handle errors and
teardown inside the device driver. Altogether, this reduces complexity
of the driver source.
Signed-off-by: NHanno Zulla <kontakt@hanno.de>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

HID: hid-sony.c: Use devm_ api to simplify sony_register_touchpad()

Using devm_ calls, the resources of the Sony game devices's features are
tied to the main device handle, making it easier to handle errors and
teardown inside the device driver. Altogether, this reduces complexity
of the driver source.
Signed-off-by: NHanno Zulla <kontakt@hanno.de>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Sony's NSG-MR5U and NSG-MR7U remote controls have a full keyboard and a
touchpad.  The keyboard is already supported by the existing Linux
kernel and drivers but the touchpad is not recognized.  This patch adds
the coded needed to bring full functionality to the touchpad.

Note that these remotes use the vendor code for SMK even though they are
Sony branded.

Known limitations
- The built-in accelerometers are not supported by these changes
- When the Drag (Fn) key is used as a mouse button, the button is
automatically released when the key begins repeating.  There are two
  workarounds for this 1) Use the button behind the touchpad instead of
  the Drag (Fn) key or 2) Disable the key repeat functionality or
  increase the key repeat delay.
Signed-off-by: NTodd Kelner <tsopdump@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Report DS4 firmware and hardware version through sysfs for both
USB and Bluetooth. This information is important for userspace
in particular for device specific quirks (e.g. in Bluetooth stacks).
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Reversed MAC addresses can be printed directly using %pMR specifier.
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: NRoderick Colenbrander <roderick.colenbranderer@sony.com>
Acked-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The SHANWAN PS3 clone joypad will start its rumble motors as soon as
it is plugged in via USB. As the additional USB interrupt does nothing on
the original PS3 Sixaxis joypads, and makes a number of other
clone joypads actually start sending data, disable that call for
the SHANWAN so the rumble motors aren't started on plug.
Signed-off-by: NBastien Nocera <hadess@hadess.net>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

err is being checked for failure each time it is being updated
so this err check is totally redundant and can be removed

Detected with CoverityScan, CID#1420665 ("Logically dead code")
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Make sure we sure register any sensor when sony_input_configured failes.
Somehow this line got lost during resolving of merge conflicts in the
motion sensor patch series and a redudant remove was added as well later
on.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

By default when using bluetooth the DS4 reports data at about 1kHz,
which is quite fast especially on weak devices. We now make the
device use the USB poll interval, which is a fixed 4ms. In addition
we make the value adjustable through sysfs.

The error handling in sony_input_configured is a little tricky. It
is not easy to add other goto's as not all codepaths have logic
for adding this attribute. Luckily we are setting the value for the
attribute to a default value, so we can use that to detect if we need
to remove the file.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Only set bit flags for the portions of the DS4 output report
for which we have data.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

These colors are more the default colors normally used on the DS4.
The previous ones were faint and not so noticeable.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The navigation controller is a DS3 (sixaxis) with fewer physical
axes and buttons. It utilizes the same HID report as the DS3 and
thus reports axes/buttons which aren't physically present.
Currently many non-existing buttons and axes are reported, which
we are now removing.

For the axes/buttons which do exist, we make the axis/button mapping
similar to the DS3.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The DS3 MAC address is reported as a unique identified when
using Bluetooth. For USB there is no unique identifier reported
yet, so use the MAC address.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Game controllers can be connected twice through USB and BT. Only
one connection is allowed. Currently we perform a check for duplicate
controllers halfway through device initialization. To prevent
'transient' devices, we should do this check as early as we can.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This patch adds a separate evdev node for the DS3 its motion
sensors. We only expose the accelerometers as the gyroscope
is extremely difficult to manage and behavior varies a lot
between hardware revisions.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This patch adds printing when we failed to activate DS3 / Nagivation
controllers and checks the return value for these failures earlier
in sony_input_configured. This paves the way for other configuration
logic for these devices, which we don't want to call if for example
the activation failed.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The axis and button mapping for the DS3 is strange. This is mostly
due to the device reporting many axes as for every digital button
it also has an analog button. Due to amount of analog values it
is even leaking well into the MT axes range.

We felt it is best to remove the many analog buttons and just report
digital and comply to the Linux gamepad spec. The analog buttons are
rarely used on the official platform, let alone on Linux.

This patch does remove motion sensor support (added back in another
patch).
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Currently the DS4 touchpad device is neither classified as a direct
input device nor as a pointer device. It makes most sense to mark
it as a pointer device.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The DualShock 4 dongle isn't connected to a real DualShock 4 at
time of driver loading. When a DualShock 4 is plugged in, we
need to obtain calibration data (the dongle would have zeros).

This patch adds calibration logic, which we schedule on a hotplug
from sony_raw_event. In addition this patch adds dongle state
handling.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The driver currently uses sony_schedule_work to submit output
reports for the different devices for LEDs or rumble.

This patch adds a new parameter to sony_schedule_work to allow
scheduling for other types of work. The next patch in this series
will utilize this functionality. Considering the driver structure
and all error handling it felt best to reuse sony_schedule_work
and sony_cancel_work. The idea was inspired by the wacom driver
which does something similar.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This patch adds a new quirk, which allows us to differentiate
between the DualShock 4 USB and the dongle. So far they have
been treated the same, but handling of calibration data differs
as the dongle behaves like Bluetooth, for other requests it
behaves like USB.

In addition this patches changes usb/dongle/bt handling in
sony_raw_event, which makes the code cleaner to read. In addition
another patch in this series will add more dongle logic, so this
change paves the road for that.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The DS4 in BT mode sends initial input reports through report 1, which
is described in the HID report descriptors. When activated after sending
a certain feature report, the device uses report 17.

Currently the hid-sony driver fixes up the BT HID report descriptors,
so the HID layer can manage input reports for report 17.

We think it is best to eliminate this fixup and do the handling ourselves,
which is what this patch does. The main motivation is that there are
various users of DS4 through hidraw, including various cross-platform
applications/games, which have their own HID parsing across Linux/Win/OSX.
Due to the fixup the descriptors differ, which is causing pain for many
developers including major game publishers (who reached out privately).
Without the fixup, the Windows titles also have a fighting chance for
working on Wine, which provides HID support now. Overall it felt
best because of these reasons to remove the fixup.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Report the hardware timestamp inside each HID report through
MSC_TIMESTAMP for motion sensor values.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The DS4 motion sensors require calibration for accurate operation.
This patch adds calibration for both the accelerometer and the
gyroscope. Calibration requires reading device specific scaling
factors and offsets. For precision reasons we store these values
as a numerator and denominator and apply the values when processing
the data.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The DS4 motion sensors are currently mapped by the hid-core driver
to non-existing axes in between ABS_MISC and ABS_MT_SLOT, because
the device already exhausted ABS_X-ABS_RZ. For a part the mapping
by hid-core is accomplished by a fixup in hid-sony as the motion
axes actually use vendor specific usage pages.

This patch makes the DS4 use a separate input device for the motion
sensors and reports acceleration data through ABS_X-ABS_Z and
gyroscope data through ABS_RX-ABS_RZ. In addition it extends the
event spec to allow gyroscope data through ABS_RX-ABS_RZ when
INPUT_PROP_ACCELEROMETER is set. This change was suggested by
Peter Hutterer during a discussion on linux-input.

[jkosina@suse.cz: rebase onto slightly newer codebase]
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

When a user connects a DS4 twice using USB and BT, we reject the
second device connection after the setup work. We then perform
a cleanup, but during cleanup we are not removing the touchpad
device. This leads to leakage of an input device, which we would
never remove. It can likely result into a kernel oops as well
when the touchpad evdev node is accessed and the underlaying HID
device has been removed from the system.

[jkosina@suse.cz: added stable annotation]
Fixes: ac797b95 ("HID: sony: Make the DS4 touchpad a separate device")
Cc: stable@vger.kernel.org
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The LED subsystem provides the LED_CORE_SUSPENDRESUME flag to handle
automatically turning off and restoring the state of device LEDs during
suspend/resume.  Use this flag instead of saving and restoring the state
locally.
Signed-off-by: NFrank Praznik <frank.praznik@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

When the DS4 dongle is connected, it always generates HID reports
even when no DS4 is paired to it. This patch adds logic to ignore
HID reports from the dongle if there is no DS4 currently attached.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The DS4 MAC address is reported as a unique identified when
using Bluetooth. For USB there is no unique identifier reported
yet, so use the MAC address.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

The error handling code in sony_input_configured in general uses goto
based cleanup. Recently we migrated code from sony_probe to here, but
we didn't update the existing touchpad registration code, which was
already here to use the goto.
Signed-off-by: NRoderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>