When dealing with usage_index, be sure to properly use unsigned instead of
int to avoid overflows.
When working on report fields, always validate that their report_counts are
in bounds.
Without this, a HID device could report a malicious feature report that
could trick the driver into a heap overflow:
[ 634.885003] usb 1-1: New USB device found, idVendor=0596, idProduct=0500
...
[ 676.469629] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten
CVE-2013-2897
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Instead of using data from stack for DMA in hidinput_get_battery_property(),
allocate the buffer dynamically.
Cc: stable@kernel.org
Reported-by: Richard Ryniker <ryniker@alum.mit.edu>
Reported-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
The hidinput_input_event() callback converts input events written from
userspace into HID reports and sends them to the device. We currently
implement this in every HID transport driver, even though most of them do
the same.
This provides a generic hidinput_input_event() implementation which is
mostly copied from usbhid. It uses a delayed worker to allow multiple LED
events to be collected into a single output event.
We use the custom ->request() transport driver callback to allow drivers
to adjust the outgoing report and handle the request asynchronously. If no
custom ->request() callback is available, we fall back to the generic raw
output report handler (which is synchronous).
Drivers can still provide custom hidinput_input_event() handlers (see
logitech-dj) if the generic implementation doesn't fit their needs.
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Extend the comment explaining the condition for discarding
out-of-range values to clarify the cases in which devices don't
provide any logical min/max.
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Commit 6da7066906 introduced in 3.3
"HID: ignore absolute values which don't fit between logical min and max"
prevents some Posiflex touch screen to work because they do not provide
logical min and max for their buttons.
Thus, logical min and max are at 0, discarding the buttons events, and
preventing the device to report appropriate X Y.
Adding a check on "min < max" solves the problem.
Reported-by: Jan Kandziora <jjj@gmx.de>
Tested-by: Jan Kandziora <jjj@gmx.de>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
power_supply core has the bad habit of calling our battery callbacks
from within power_supply_register(). Furthermore, if the callbacks
fail with an unhandled error code, it will skip any uevent that it
might currently process.
So if HID-core registers battery devices, an "add" uevent is generated
and the battery callbacks are called. These will gracefully fail due
to timeouts as they might still hold locks on event processing. One
could argue that this should be fixed in power_supply core, but the
least we can do is to signal ENODATA so power_supply core will just
skip the property and continue with the uevent.
This fixes a bug where "add" and "remove" uevents are skipped for
battery devices. upower is unable to track these devices and currently
needs to ignore them.
This patch also overwrites any other error code. I cannot see any reason
why we should forward protocol- or I/O-errors to the power_supply core.
We handle these errors in hid_ll_driver later, anyway, so just skip
them. power_supply core cannot do anything useful with them, anyway,
and we avoid skipping important uevents and confusing user-space.
Thanks a lot to Daniel Nicoletti for pushing and investigating
on this.
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Anton Vorontsov <cbou@mail.ru>
Cc: David Woodhouse <dwmw2@infradead.org>
Reported-by: Daniel Nicoletti <dantti12@gmail.com>
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
There is no need to register an input device containing no events.
This allows drivers using the quirk MULTI_INPUT to register one input
per report effectively used.
For backward compatibility, we need to add a quirk to request
this behavior.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This just refactors the allocation of hid_input.
No semantic changes.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: Henrik Rydberg <rydberg@euromail.se>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
HID spec details special values for the HID field unit exponent.
Basically, the range [0x8..0xf] correspond to [-8..-1], so this is
a standard two's complement on a half-byte.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
hidinput_calc_abs_res should return the closest int in the division
instead of the floor.
On a device with a logical_max of 3008 and a physical_max of 255mm,
previous implementation gave a resolution of 11 instead of 12.
With 11, user-space computes a physical size of 273.5mm and the
round_closest results gives 250.6mm.
The old implementation introduced an error of 2cm in this example.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Exporting the function allows us to calculate the resolution in third
party drivers like hid-multitouch.
This patch also complete the function with additional valid axes.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Button names for USB gamepads are currently assigned incorrectly, as the evdev
code assigned to buttons is "BTN_GAMEPAD + code", which on devices with more
then 16 buttons bleeds over into button names reserved for graphic tablets
(BTN_TOOL_PEN, etc.). This causes problems further down the line as the device
are now no longer detected as joystick. This patch fixes that by assigning
buttons outside the range to BTN_TRIGGER_HAPPY (as is already the case for USB
joysticks).
Furthermore this patch corrects the assignment to BTN_TRIGGER_HAPPY, as
currently the first button over 16 is assigned to BTN_TRIGGER_HAPPY17 (i.e.
BTN_TRIGGER_HAPPY+0x10) not BTN_TRIGGER_HAPPY.
Signed-off-by: Ingo Ruhnke <grumbel@gmail.com>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
A hid device may create several input devices, and a driver may need
to prepare or finalize the configuration per input device. Currently,
there is no sane way for a driver to know when a device has been
configured. This patch adds a callback providing that information.
Reviewed-and-tested-by: Benjamin Tissoires <benjamin.tissoires@enac.fr>
Tested-by: Ping Cheng <pingc@wacom.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
The keys are found on the keyboards bundled with HP All-In-One machines
with USB VID/PID of 04ca:004d and 04f2:1061.
Signed-off-by: Keng-Yu Lin <kengyu@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Add USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI, to the quirk list since it report
wrong feature type and wrong percentage range.
Signed-off-by: Daniel Nicoletti <dantti12@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Switch the driver over to device group handling. By adding the
HID_GROUP_MULTITOUCH group to hid-core, hid-generic will no longer
match multitouch devices. By adding the HID_GROUP_MULTITOUCH entry to
the device list, hid-multitouch will match all unknown multitouch
devices, and udev will automatically load the module.
Since HID_QUIRK_MULTITOUCH never gets set, the special quirks handling
can be removed. Since all HID MT devices have HID_DG_CONTACTID, they
can be removed from the hid_have_special_driver list.
With this patch, the unknown device ids are no longer NULL, so the code
is modified to check for the generic entry instead.
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
Acked-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Add digitizer X Tilt and Y Tilt usage support along with resolution calculation.
Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Allow array field values out of range as per HID 1.11 specification,
section 6.2.25:
Rather than returning a single bit for each button in the group, an
array returns an index in each field that corresponds to the pressed
button (like keyboard scan codes). An out-of range value in and array
field is considered no controls asserted.
Apparently, "and" above is a typo and should be "an".
This fixes at least Waltop tablet pen clicks - otherwise BTN_TOUCH is never
released.
The relevant part of Waltop tablet report descriptors is this:
0x09, 0x42, /* Usage (Tip Switch), */
0x09, 0x44, /* Usage (Barrel Switch), */
0x09, 0x46, /* Usage (Tablet Pick), */
0x15, 0x01, /* Logical Minimum (1), */
0x25, 0x03, /* Logical Maximum (3), */
0x75, 0x04, /* Report Size (4), */
0x95, 0x01, /* Report Count (1), */
0x80, /* Input, */
This is a regression fix for commit b4b583d ("HID: be more strict when
ignoring out-of-range fields").
Signed-off-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Set the battery's power supply scope to "Device" and point the power
supply to the powered device.
Signed-off-by: Jeremy Fitzhardinge <jeremy@goop.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Apple keyboards require a FEATURE report to query the battery state,
even though they list as an input. Without this, it returns an error.
Signed-off-by: Jeremy Fitzhardinge <jeremy@goop.org>
hidinput_get_battery_property() now directly polls the device for the
current battery strength, so there's no need for battery_val, or the
code to set it on the input event path.
Signed-off-by: Jeremy Fitzhardinge <jeremy@goop.org>
It just isn't a battery which is powering the computer. upower needs
a more nuanced understanding of this.
Signed-off-by: Jeremy Fitzhardinge <jeremy@goop.org>
Some devices always report percentage, despite having 0/255 as their
min/max, so add a quirk for them.
Signed-off-by: Jeremy Fitzhardinge <jeremy@goop.org>
I've sent an email earlier asking for help with a GetFeature code, and now I
have a second patch on top of Jeremy's to provide the battery functionality
for devices that support reporting it.
If I understood correctly when talking to Jeremy he said his device
never actually reported the status as an input event (sorry if I didn't
understand it correctly), and after reading HID specs I believe it's
really because it was meant to be probed, I have an Apple Keyboard and
Magic Trackpad both bluetooth batteries operated, so using PacketLogger
I saw that Mac OSX always ask the battery status using the so called
GetFeature.
What my patch does is basically:
- store the report id that matches the battery_strength
- setup the battery if 0x6.0x20 is found, even if that is reported as a feature
(as it was meant to be but only the MagicTrackpad does)
- when upower or someone access /sys/class/power_supply/hid-*/capacity it
will probe the device and return it's status.
It works great for both devices, but I have two concerns:
- the report_features function has a duplicated code
- it would be nice if it was possible for specific drivers to provide their own
probe as there might be some strange devices... (but maybe it's
already possible)
I've talked to the upower dev and he fixed it to be able to show the
right percentage.
Here how the uevent file (in /sys/class/power_supply/hid-*/) looks like:
POWER_SUPPLY_NAME=hid-00:22:41:D9:18:E7-battery
POWER_SUPPLY_PRESENT=1
POWER_SUPPLY_ONLINE=1
POWER_SUPPLY_CAPACITY=66
POWER_SUPPLY_MODEL_NAME=MacAdmin’s keyboard
POWER_SUPPLY_STATUS=Discharging
POWER_SUPPLY_NAME=hid-70:CD:60:F5:FF:3F-battery
POWER_SUPPLY_PRESENT=1
POWER_SUPPLY_ONLINE=1
POWER_SUPPLY_CAPACITY=62
POWER_SUPPLY_MODEL_NAME=nexx’s Trackpad
POWER_SUPPLY_STATUS=Discharging
Signed-off-by: Daniel Nicoletti <dantti12@gmail.com>
Defer LED setting action to a workqueue.
This is more likely to send all LED change events in a single URB.
Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Acked-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
As reported by Stephen Rothwell:
drivers/hid/hid-input.c: In function 'hidinput_hid_event':
drivers/hid/hid-input.c:865:6: error: 'struct hid_device' has no member
named 'battery_val'
drivers/hid/hid-input.c:866:3: error: 'struct hid_device' has no member
named 'battery_min'
drivers/hid/hid-input.c:866:3: error: 'struct hid_device' has no member
named 'battery_max'
Signed-off-by: Jeremy Fitzhardinge <jeremy@goop.org>
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Some HID devices, such as my Bluetooth mouse, report their battery
strength as an event. Rather than passing it through as a strange
absolute input event, this patch registers it with the power_supply
subsystem as a battery, so that the device's Battery Strength can be
reported to usermode.
The battery appears in sysfs names
/sys/class/power_supply/hid-<UNIQ>-battery, and it is a child of the
battery-containing device, so it should be clear what it's the battery of.
Unfortunately on my current Fedora 16 system, while the battery does
appear in the UI, it is listed as a Laptop Battery with 0% charge (since
it ignores the "capacity" property of the battery and instead computes
it from the "energy*" fields, which we can't supply given the limited
information contained within the HID Report).
Still, this patch is the first step.
Signed-off-by: Jeremy Fitzhardinge <jeremy@goop.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
HID 1.11 specification, section 5.10 tells us:
HID class devices support the ability to ignore selected fields in a
report at run- time. This is accomplished by declaring bit field in a
report that is capable of containing a range of values larger than
those actually generated by the control. If the host or the device
receives an out-of-range value then the current value for the
respective control will not be modified.
So we shouldn't be restricted to EV_ABS only.
Reported-by: Denilson Figueiredo de Sá <denilsonsa@gmail.com>
Tested-by: Denilson Figueiredo de Sá <denilsonsa@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Linux should ignore values outside logical min/max range, as they are not
meaningful. This is what at least some of other OSes do, and it also makes
sense (currently the value gets misinterpreted larger up the stack).
Reported-by: Denilson Figueiredo de Sá <denilsonsa@gmail.com>
Tested-by: Denilson Figueiredo de Sá <denilsonsa@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
As mentioned by http://www.microsoft.com/whdc/device/input/DigitizerDrvs_touch.mspx
multitouch devices are those that have the input report HID_CONTACTID.
This patch detects this and unloads the generic-usb driver.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@enac.fr>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
I've got a Tivo Slide bluetooth remote/dongle, which uses a fair number
of hid usages that aren't currently mapped in hid-input.c. I'd initially
written additions to hid-input.c with just this device in mind,
including some bits that were specific to the device. This go around,
I'm looking at adding/correcting as many generic HID usages from the HID
Usage Tables, version 1.12, as I can -- which also serves to enable all
but four of the buttons on the Tivo Slide remote[*].
Outside of fixing the obviously incorrect mapping of 0xc 0x45 from
KEY_RADIO to KEY_RIGHT, and making use of the new KEY_IMAGES (just added
in 2.6.39-rc4) for AL Image Browser instead of KEY_MEDIA, these are
purely additions, and thus should have no negative impact on any already
functional HID devices. Most of the added mappings seemed to be
perfectly logical to me, but there were a few that were mapped on more
of an "I think this makes the most sense" basis.
[*] I'll handle the last four tivo buttons via an hid-tivo.c follow-up.
CC: Dmitry Torokhov <dmitry.torokhov@gmail.com>
CC: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (64 commits)
Input: tsc2005 - remove 'disable' sysfs attribute
Input: tsc2005 - add open/close
Input: tsc2005 - handle read errors from SPI layer
Input: tsc2005 - do not rearm timer in hardirq handler
Input: tsc2005 - don't use work for 'pen up' handling
Input: tsc2005 - do not use 0 in place of NULL
Input: tsc2005 - use true/false for boolean variables
Input: tsc2005 - hide selftest attribute if we can't reset
Input: tsc2005 - rework driver initialization code
Input: tsc2005 - set up bus type in input device
Input: tsc2005 - set up parent device
Input: tsc2005 - clear driver data after unbinding
Input: tsc2005 - add module description
Input: tsc2005 - remove driver banner message
Input: tsc2005 - remove incorrect module alias
Input: tsc2005 - convert to using dev_pm_ops
Input: tsc2005 - use spi_get/set_drvdata()
Input: introduce tsc2005 driver
Input: xen-kbdfront - move to drivers/input/misc
Input: xen-kbdfront - add grant reference for shared page
...
When the multi input quirk is set, there is a new input device
created for every feature report. Since the idea is to present
features per hid device, not per input device, revert back to
the original report loop and change the feature_mapping() callback
to not take the input device as argument.
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
Tested-by: Benjamin Tissoires <benjmain.tissoires@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Goto out_cleanup infers a kernel oops: hidinput_disconnect calls
input_unregister_driver to all members of hid->inputs.
However, hidinput already has been added to hid->inputs even
though input_register_device was not called.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@enac.fr>
Reviewed-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
All users of old style get/setkeycode methids have been converted so
it is time to retire them.
Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: hid-multitouch: minor fixes based on additional review
HID: Switch turbox/mosart touchscreen to hid-mosart
HID: add Add Cando touch screen 10.1-inch product id
HID: hid-mulitouch: add support for the 'Sensing Win7-TwoFinger'
HID: hid-multitouch: add support for Cypress TrueTouch panels
HID: hid-multitouch: support for PixCir-based panels
HID: set HID_MAX_FIELD at 128
HID: add feature_mapping callback
Currently hid doesn't export the features it knows to the specific modules.
Some information can be really important in such features: MosArt and
Cypress devices are by default not in a multitouch mode.
We have to send the value 2 on the right feature.
This patch exports to the module the features report so they can find the
right feature to set up the correct mode.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@enac.fr>
Acked-by: Henrik Rydberg <rydberg@euromail.se>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Instead of using magic values, use their corresponding BTN_* defines
from linux/input.h.
Signed-off-by: Florian Fainelli <ffainelli@freebox.fr>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Benjamin Tissoires