summaryrefslogtreecommitdiffstats
path: root/drivers/hid/hid-core.c
Commit message (Collapse)AuthorAgeFilesLines
* HID: provide a helper for validating hid reportsKees Cook2013-09-131-0/+58
| | | | | | | | | | | | Many drivers need to validate the characteristics of their HID report during initialization to avoid misusing the reports. This adds a common helper to perform validation of the report exisitng, the field existing, and the expected number of values within the field. Signed-off-by: Kees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* Merge branch 'for-linus' of ↵Linus Torvalds2013-09-061-44/+115
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID updates from Jiri Kosina: "Highlights: - conversion of HID subsystem to use devm-based resource management, from Benjamin Tissoires - i2c-hid support for DT bindings, from Benjamin Tissoires - much improved support for Win8-multitouch devices, from Benjamin Tissoires - cleanup of core code using common hidinput_input_event(), from David Herrmann - fix for bug in implement() access to the bit stream (causing oops) that has been present in the code for ages, but devices that are able to trigger it have started to appear only now, from Jiri Kosina - fixes for CVE-2013-2899, CVE-2013-2898, CVE-2013-2896, CVE-2013-2892, CVE-2013-2888 (all triggerable only by specially crafted malicious HW devices plugged into the system), from Kees Cook - hidraw oops fix, from Manoj Chourasia - various smaller fixes here and there, support for a bunch of new devices by various contributors" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (53 commits) HID: MAINTAINERS: add roccat drivers HID: hid-sensor-hub: change kmalloc + memcpy by kmemdup HID: hid-sensor-hub: move to devm_kzalloc HID: hid-sensor-hub: fix indentation accross the code HID: move HID_REPORT_TYPES closer to the report-definitions HID: check for NULL field when setting values HID: picolcd_core: validate output report details HID: sensor-hub: validate feature report details HID: ntrig: validate feature report details HID: pantherlord: validate output report details HID: hid-wiimote: print small buffers via %*phC HID: uhid: improve uhid example client HID: Correct the USB IDs for the new Macbook Air 6 HID: wiimote: add support for Guitar-Hero guitars HID: wiimote: add support for Guitar-Hero drums Input: introduce BTN/ABS bits for drums and guitars HID: battery: don't do DMA from stack HID: roccat: add support for KonePureOptical v2 HID: picolcd: Prevent NULL pointer dereference on _remove() HID: usbhid: quirk for N-Trig DuoSense Touch Screen ...
| *-----. Merge branches 'for-3.12/devm', 'for-3.12/i2c-hid', 'for-3.12/i2c-hid-dt', ↵Jiri Kosina2013-09-061-44/+115
| |\ \ \ \ | | | | | | | | | | | | | | | | | | 'for-3.12/logitech', 'for-3.12/multitouch-win8', 'for-3.12/trasnport-driver-cleanup', 'for-3.12/uhid', 'for-3.12/upstream' and 'for-3.12/wiimote' into for-linus
| | | | * \ Merge branch 'for-3.11/CVE-2013-2888' into for-3.12/upstreamJiri Kosina2013-09-041-3/+7
| | | | |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This one didn't make it for 3.11 due to being applied too close to release, queue it for 3.12 merge window. Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | | * | HID: validate HID report id sizeKees Cook2013-08-291-3/+7
| | |_|_|/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "Report ID" field of a HID report is used to build indexes of reports. The kernel's index of these is limited to 256 entries, so any malicious device that sets a Report ID greater than 255 will trigger memory corruption on the host: [ 1347.156239] BUG: unable to handle kernel paging request at ffff88094958a878 [ 1347.156261] IP: [<ffffffff813e4da0>] hid_register_report+0x2a/0x8b CVE-2013-2888 Signed-off-by: Kees Cook <keescook@chromium.org> Cc: stable@kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * | HID: check for NULL field when setting valuesKees Cook2013-09-041-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Defensively check that the field to be worked on is not NULL. Signed-off-by: Kees Cook <keescook@chromium.org> Cc: stable@kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * | Merge branch 'master' into for-3.12/upstreamJiri Kosina2013-09-041-0/+6
| | | | |\ \ | | |_|_|/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | Sync with Linus' tree to be able to apply fixup patch on top of 9d9a04ee75 ("HID: apple: Add support for the 2013 Macbook Air") Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * | HID: roccat: add support for KonePureOptical v2Stefan Achatz2013-09-021-0/+1
| | | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | KonePureOptical is a KonePure with different sensor. Signed-off-by: Stefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * HID: Add new driver for non-compliant Xin-Mo devices.Olivier Scherler2013-07-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The driver currently only supports the Dual Arcade controller. It fixes the negative axis event values (the devices sends -2) to match the logical axis minimum of the HID report descriptor (the report announces -1). It is needed because hid-input discards out of bounds values. Signed-off-by: Olivier Scherler <oscherler@ithink.ch> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * HID: fix data access in implement()Jiri Kosina2013-07-221-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | implement() is setting bytes in LE data stream. In case the data is not aligned to 64bits, it reads past the allocated buffer. It doesn't really change any value there (it's properly bitmasked), but in case that this read past the boundary hits a page boundary, pagefault happens when accessing 64bits of 'x' in implement(), and kernel oopses. This happens much more often when numbered reports are in use, as the initial 8bit skip in the buffer makes the whole process work on values which are not aligned to 64bits. This problem dates back to attempts in 2005 and 2006 to make implement() and extract() as generic as possible, and even back then the problem was realized by Adam Kroperlin, but falsely assumed to be impossible to cause any harm: http://www.mail-archive.com/linux-usb-devel@lists.sourceforge.net/msg47690.html I have made several attempts at fixing it "on the spot" directly in implement(), but the results were horrible; the special casing for processing last 64bit chunk and switching to different math makes it unreadable mess. I therefore took a path to allocate a few bytes more which will never make it into final report, but are there as a cushion for all the 64bit math operations happening in implement() and extract(). All callers of hid_output_report() are converted at the same time to allocate the buffer by newly introduced hid_alloc_report_buf() helper. Bruno noticed that the whole raw_size test can be dropped as well, as hid_alloc_report_buf() makes sure that the buffer is always of a proper size. Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Acked-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * HID: kye: Add report fixup for Genius Gx Imperator KeyboardBenjamin Tissoires2013-07-151-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Genius Gx Imperator Keyboard presents the same problem in its report descriptors than Genius Gila Gaming Mouse. Use the same fixup for both. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=928561 Reported-and-tested-by: Honza Brazdil <jbrazdil@redhat.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | | * HID: core: fix hid delimiter local tag parsing.Paul Chavent2013-07-131-1/+1
| | | |/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When device with the DELIMITER tag in its report descriptor is encountered during parsing, it's mistakenly immediately refused by HID core for no justifiable reason. [jkosina@suse.cz: polish changelog] Signed-off-by: Paul Chavent <paul.chavent@onera.fr> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: detect Win 8 multitouch devices in coreBenjamin Tissoires2013-08-271-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Detecting Win 8 multitouch devices in core allows us to set quirks before the device is parsed through hid_hw_start(). It also simplifies the detection of those devices in hid-multitouch and makes the handling of those devices cleaner. As Win 8 multitouch panels are in the group multitouch and rely on a special feature to be detected, this patch adds a bitfield in the parser. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Reviewed-by: Henrik Rydberg <rydberg@euromail.se> Tested-by: Srinivas Pandruvada<srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: Use hid_parser for pre-scanning the report descriptorsBenjamin Tissoires2013-08-271-38/+64
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Win 8 detection is sufficiently complex to warrant use of the full parser code, in spite of the inferred memory usage. Therefore, we can use the existing HID parser in hid-core for hid_scan_report() by re-using the code from hid_open_report(). hid_parser_global, hid_parser_local and hid_parser_reserved does not have any side effects. We just need to reimplement the MAIN_ITEM callback to have a proper parsing without side effects. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Reviewed-by: Henrik Rydberg <rydberg@euromail.se> Tested-by: Srinivas Pandruvada<srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | / HID: convert bus code to use dev_groupsGreg Kroah-Hartman2013-08-261-4/+6
|/ / | | | | | | | | | | | | | | | | The dev_attrs field of struct bus_type is going away soon, dev_groups should be used instead. This converts the HID bus code to use the correct field. Acked-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | Merge branch 'for-linus' of ↵Linus Torvalds2013-07-051-0/+6
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: "First round of updates for the input subsystem. You will get a new touchsreen driver for Cypress 4th generation devices, a driver for a special controller implementing PS/2 protocol in OLPC devices, and a driver for power key for SiRFprimaII PWRC. HID and bcm5497 now support for the 2013 MacBook Air. EVIOCGKEY and the rest of evdev ioctls now flush events of matching type from the client's event queue so that clients can be sure any events received after issuing EVIOCG* ioctl are new events. And a host of cleanups and improvements in other drivers" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (87 commits) Input: cyttsp4 - kfree xfer_buf on error path in probe() Input: tps6507x-ts - select INPUT_POLLDEV Input: bcm5974 - add support for the 2013 MacBook Air HID: apple: Add support for the 2013 Macbook Air Input: cyttsp4 - leak on error path in probe() Input: cyttsp4 - silence NULL dereference warning Input: cyttsp4 - silence shift wrap warning Input: tps6507x-ts - convert to polled input device infrastructure ARM: davinci: da850-evm: remove vref from touchscreen platform data Input: cyttsp4 - SPI driver for Cypress TMA4XX touchscreen devices Input: cyttsp4 - I2C driver for Cypress TMA4XX touchscreen devices Input: cyttsp4 - add core driver for Cypress TMA4XX touchscreen devices Input: cyttsp - I2C driver split into two modules Input: add OLPC AP-SP driver Input: nspire-keypad - remove redundant dev_err call in nspire_keypad_probe() Input: tps6507x-ts - remove vref from platform data Input: tps6507x-ts - use bool for booleans Input: tps6507x-ts - remove bogus unreachable code Input: samsung-keypad - let device core setup the default pin configuration Input: wacom_i2c - implement hovering capability ...
| * HID: apple: Add support for the 2013 Macbook AirDmitry Torokhov2013-07-031-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | This patch adds keyboard support for MacbookAir6,2 as WELLSPRING8 (0x0291, 0x0292, 0x0293). The touchpad is handled in a separate bcm5974 patch, as usual. Cc: stable@vger.kernel.org Reported-and-tested-by: Brad Ford <plymouthffl@gmail.com> Signed-off-by: Henrik Rydberg <rydberg@euromail.se> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| |
| \
| \
| \
*---. \ Merge branches 'for-3.11/multitouch', 'for-3.11/sony' and ↵Jiri Kosina2013-07-041-1/+7
|\ \ \ \ | | |_|/ | |/| | | | | | | | | | | | | | | | | | 'for-3.11/upstream' into for-linus Conflicts: drivers/hid/hid-core.c
| | | * HID: kye: Add report fixup for Genius Gila Gaming mouseBenjamin Tissoires2013-07-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Genius Gila Gaming Mouse presents an obviously wrong report descriptor. the Consumer control (report ID 3) is the following: 0x05, 0x0c, // Usage Page (Consumer Devices) 105 0x09, 0x01, // Usage (Consumer Control) 107 0xa1, 0x01, // Collection (Application) 109 0x85, 0x03, // Report ID (3) 111 0x19, 0x00, // Usage Minimum (0) 113 0x2a, 0xff, 0x7f, // Usage Maximum (32767) 115 0x15, 0x00, // Logical Minimum (0) 118 0x26, 0xff, 0x7f, // Logical Maximum (32767) 120 0x75, 0x10, // Report Size (16) 123 0x95, 0x03, // Report Count (3) 125 0x81, 0x00, // Input (Data,Arr,Abs) 127 0x75, 0x08, // Report Size (8) 129 0x95, 0x01, // Report Count (1) 131 0x81, 0x01, // Input (Cnst,Arr,Abs) 133 0xc0, // End Collection 135 So the first input whithin this report has a count of 3 but a usage range of 32768. So this value is obviously wrong as it should not be greater than the report count. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=959721 Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: core: fix reporting of raw eventsJiri Kosina2013-06-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | hdrw->raw event can return three different return value types: - ret < 0 indicates that the hdrv driver found an error while parsing - ret == 0 indicates no error has been encountered, and the driver has processed the report - ret > 0 indicates that there was no parsing error, and the driver hasn't processed the event. Calling hid_report_raw_event() has to be called appropriately so that it reflects what has been done by ->raw_event() callback, otherwise we might updates of the in-kernel structure are lost upon arrival of the report, which is wrong. Reported-and-tested-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Reported-and-tested-by: Daniel Leung <daniel.leung@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: add support for Huion 580 tabletMartin Rusko2013-05-281-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add hid-huion.c with support for Huion 580 tablet, which is simple 8x5" tablet with 4000LPI resolution and 2048 levels pressure-sensitive pen manufactured by the Chinese company Huion. The driver fixes incorrect report descriptor sent by the device, performs custom initialization required to switch the tablet into its native resolution mode and inverts the in-range bit. Signed-off-by: Martin Rusko <martin.rusko@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: ignore Jabra speakerphones HID interfaceVincent Palatin2013-05-231-0/+2
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a quirk to ignore Jabra speakerphone 410 and 510 devices HID interface. On those devices, the USB audio interface is working nicely, but the HID interface is not working with the kernel usbhid driver, and it requires a specific userspace program. We could unbind it from userspace but just attaching the usbhid driver has sometimes nasty effects: either confusing the device state machine or triggering a storm of volume key events making eventual sound UI blinking like crazy. Signed-off-by: Vincent Palatin <vpalatin@chromium.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * HID: driver for PS2/3 Buzz controllersColin Leitner2013-05-281-0/+2
| |/ | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for PS2/3 Buzz controllers into hid-sony It has been tested on Debian 7 with kernel version 3.10.0-rc2. Unfortunately I can't test the patch with a regular six-axis controller myself. Signed-off-by: Colin Leitner <colin.leitner@gmail.com> Cc: Jiri Kosina <jkosina@suse.cz> Cc: linux-input@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| |
| \
*-. \ Merge branches 'for-3.11/battery', 'for-3.11/elo', 'for-3.11/holtek' and ↵Jiri Kosina2013-07-041-0/+4
|\ \ \ | |_|/ |/| | | | | 'for-3.11/i2c-hid-fixed' into for-linus
| | * HID: holtek: PIDs 0xa04a and 0xa067 need to be in hid_have_special_driver[]Jiri Kosina2013-05-281-0/+2
| |/ |/| | | | | | | | | | | Add device IDs of devices driven by hid-holtek-mouse to hid_have_special_driver[]. Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * HID: add driver for ELO 4000/4500Jiri Slaby2013-05-291-0/+2
|/ | | | | | | | | | | | | | | | | | | | | | | | This is a driver for ELO 4000/4500 devices which report themselves as HID devices, but do not really send HID events on touch. So we introduce a new HID 'quirk' driver with a raw_event handler where we take care of those events. What we need additionally is an input_configured hook, because the device does not mention anything about PRESSURE and TOUCH in its report descriptor, but it actually generate those. So we set the bits in the corresponding input_dev in that hook. Thanks to Petr Ostadal who was willing to test the driver. The rest of Cc's listed below had something to do with that driver over the years in our enterprise tree. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Tested-by: Petr Ostadal <postadal@suse.cz> Cc: Oliver Neukum <oliver@neukum.org> Cc: Vojtech Pavlik <vojtech@suse.cz> Cc: Egbert Eich <eich@suse.com> Cc: Libor Pechacek <lpechacek@suse.cz> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* HID: debug: fix RCU preemption issueJiri Kosina2013-05-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 2353f2bea ("HID: protect hid_debug_list") introduced mutex locking around debug_list access to prevent SMP races when debugfs nodes are being operated upon by multiple userspace processess. mutex is not a proper synchronization primitive though, as the hid-debug callbacks are being called from atomic contexts. We also have to be careful about disabling IRQs when taking the lock to prevent deadlock against IRQ handlers. Benjamin reports this has also been reported in RH bugzilla as bug #958935. =============================== [ INFO: suspicious RCU usage. ] 3.9.0+ #94 Not tainted ------------------------------- include/linux/rcupdate.h:476 Illegal context switch in RCU read-side critical section! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 4 locks held by Xorg/5502: #0: (&evdev->mutex){+.+...}, at: [<ffffffff81512c3d>] evdev_write+0x6d/0x160 #1: (&(&dev->event_lock)->rlock#2){-.-...}, at: [<ffffffff8150dd9b>] input_inject_event+0x5b/0x230 #2: (rcu_read_lock){.+.+..}, at: [<ffffffff8150dd82>] input_inject_event+0x42/0x230 #3: (&(&usbhid->lock)->rlock){-.....}, at: [<ffffffff81565289>] usb_hidinput_input_event+0x89/0x120 stack backtrace: CPU: 0 PID: 5502 Comm: Xorg Not tainted 3.9.0+ #94 Hardware name: Dell Inc. OptiPlex 390/0M5DCD, BIOS A09 07/24/2012 0000000000000001 ffff8800689c7c38 ffffffff816f249f ffff8800689c7c68 ffffffff810acb1d 0000000000000000 ffffffff81a03ac7 000000000000019d 0000000000000000 ffff8800689c7c90 ffffffff8107cda7 0000000000000000 Call Trace: [<ffffffff816f249f>] dump_stack+0x19/0x1b [<ffffffff810acb1d>] lockdep_rcu_suspicious+0xfd/0x130 [<ffffffff8107cda7>] __might_sleep+0xc7/0x230 [<ffffffff816f7770>] mutex_lock_nested+0x40/0x3a0 [<ffffffff81312ac4>] ? vsnprintf+0x354/0x640 [<ffffffff81553cc4>] hid_debug_event+0x34/0x100 [<ffffffff81554197>] hid_dump_input+0x67/0xa0 [<ffffffff81556430>] hid_set_field+0x50/0x120 [<ffffffff8156529a>] usb_hidinput_input_event+0x9a/0x120 [<ffffffff8150d89e>] input_handle_event+0x8e/0x530 [<ffffffff8150df10>] input_inject_event+0x1d0/0x230 [<ffffffff8150dd82>] ? input_inject_event+0x42/0x230 [<ffffffff81512cae>] evdev_write+0xde/0x160 [<ffffffff81185038>] vfs_write+0xc8/0x1f0 [<ffffffff81185535>] SyS_write+0x55/0xa0 [<ffffffff81704482>] system_call_fastpath+0x16/0x1b BUG: sleeping function called from invalid context at kernel/mutex.c:413 in_atomic(): 1, irqs_disabled(): 1, pid: 5502, name: Xorg INFO: lockdep is turned off. irq event stamp: 1098574 hardirqs last enabled at (1098573): [<ffffffff816fb53f>] _raw_spin_unlock_irqrestore+0x3f/0x70 hardirqs last disabled at (1098574): [<ffffffff816faaf5>] _raw_spin_lock_irqsave+0x25/0xa0 softirqs last enabled at (1098306): [<ffffffff8104971f>] __do_softirq+0x18f/0x3c0 softirqs last disabled at (1097867): [<ffffffff81049ad5>] irq_exit+0xa5/0xb0 CPU: 0 PID: 5502 Comm: Xorg Not tainted 3.9.0+ #94 Hardware name: Dell Inc. OptiPlex 390/0M5DCD, BIOS A09 07/24/2012 ffffffff81a03ac7 ffff8800689c7c68 ffffffff816f249f ffff8800689c7c90 ffffffff8107ce60 0000000000000000 ffff8800689c7fd8 ffff88006a62c800 ffff8800689c7d10 ffffffff816f7770 ffff8800689c7d00 ffffffff81312ac4 Call Trace: [<ffffffff816f249f>] dump_stack+0x19/0x1b [<ffffffff8107ce60>] __might_sleep+0x180/0x230 [<ffffffff816f7770>] mutex_lock_nested+0x40/0x3a0 [<ffffffff81312ac4>] ? vsnprintf+0x354/0x640 [<ffffffff81553cc4>] hid_debug_event+0x34/0x100 [<ffffffff81554197>] hid_dump_input+0x67/0xa0 [<ffffffff81556430>] hid_set_field+0x50/0x120 [<ffffffff8156529a>] usb_hidinput_input_event+0x9a/0x120 [<ffffffff8150d89e>] input_handle_event+0x8e/0x530 [<ffffffff8150df10>] input_inject_event+0x1d0/0x230 [<ffffffff8150dd82>] ? input_inject_event+0x42/0x230 [<ffffffff81512cae>] evdev_write+0xde/0x160 [<ffffffff81185038>] vfs_write+0xc8/0x1f0 [<ffffffff81185535>] SyS_write+0x55/0xa0 [<ffffffff81704482>] system_call_fastpath+0x16/0x1b Reported-by: majianpeng <majianpeng@gmail.com> Reported-by: Benjamin Tissoires <benjamin.tissoires@gmail.com> Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* HID: reintroduce fix-up for certain Sony RF receiversFernando Luis Vázquez Cao2013-05-011-0/+1
| | | | | | | | | | | | | It looks like the manual merge 0d69a3c731e120b05b7da9fb976830475a3fbc01 ("Merge branches 'for-3.9/sony' and 'for-3.9/steelseries' into for-linus") accidentally removed Sony RF receiver with USB product id 0x0374 from the "have special driver" list, effectively nullifying a464918419f94a0043d2f549d6defb4c3f69f68a ("HID: add support for Sony RF receiver with USB product id 0x0374"). Add the device back to the list. Cc: stable@vger.kernel.org Signed-off-by: Fernando Luis Vazquez Cao <fernando@oss.ntt.co.jp> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* Merge branches 'for-3.10/wiimote' and 'for-3.9/upstream-fixes' into for-linusJiri Kosina2013-04-301-0/+1
|\
| * HID: wiimote: add 2nd generation Wii Remote IDsDavid Herrmann2013-04-041-0/+1
| | | | | | | | | | | | | | | | | | | | This adds the 2nd generation Wii Remote IDs. They have a different Bluetooth chipset (CSR instead of Broadcom) and are more restrictive in what they accept as input. Hence, you need up-to-date BlueZ and Bluetooth HIDP modules to use these devices. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| |
| \
*-. \ Merge branches 'for-3.10/multitouch', 'for-3.10/roccat' and ↵Jiri Kosina2013-04-301-0/+2
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | 'for-3.10/upstream' into for-linus Conflicts: drivers/hid/Kconfig
| | * | HID: Add PID for Japanese version of NE4K keyboardAdam Jiang2013-04-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patche adds PID of Japanese Natual Ergonomic Keyboard 4000. HID NE4K driver depends on this PID for determining its quirks. F14-F18 keys would not work without the patch. Signed-off-by: Adam Jiang <jiang.adam@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: roccat: add support for Roccat Kone Pure gaming mouseStefan Achatz2013-03-141-0/+1
| | |/ | |/| | | | | | | | | | | | | | | | Userland-tools can already be found at http://sourceforge.net/projects/roccat Signed-off-by: Stefan Achatz <erazor_de@users.sourceforge.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | |
| \ \
| \ \
| \ \
*---. \ \ Merge branches 'for-3.10/appleir', 'for-3.10/hid-debug', ↵Jiri Kosina2013-04-301-28/+25Star
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | 'for-3.10/hid-driver-transport-cleanups', 'for-3.10/i2c-hid' and 'for-3.10/logitech' into for-linus
| | | * | | HID: Separate struct hid_device's driver_lock into two locks.Andrew de los Reyes2013-03-011-3/+21
| | | | |/ | | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch separates struct hid_device's driver_lock into two. The goal is to allow hid device drivers to receive input during their probe() or remove() function calls. This is necessary because some drivers need to communicate with the device to determine parameters needed during probe (e.g., size of a multi-touch surface), and if possible, may perfer to communicate with a device on host-initiated disconnect (e.g., to put it into a low-power state). Historically, three functions used driver_lock: - hid_device_probe: blocks to acquire lock - hid_device_remove: blocks to acquire lock - hid_input_report: if locked returns -EBUSY, else acquires lock This patch adds another lock (driver_input_lock) which is used to block input from occurring. The lock behavior is now: - hid_device_probe: blocks to acq. driver_lock, then driver_input_lock - hid_device_remove: blocks to acq. driver_lock, then driver_input_lock - hid_input_report: if driver_input_lock locked returns -EBUSY, else acquires driver_input_lock This patch also adds two helper functions to be called during probe() or remove(): hid_device_io_start() and hid_device_io_stop(). These functions lock and unlock, respectively, driver_input_lock; they also make a note of whether they did so that hid-core knows if a driver has changed the lock state. This patch results in no behavior change for existing devices and drivers. However, during a probe() or remove() function call in a driver, that driver may now selectively call hid_device_io_start() to let input events come through, then optionally call hid_device_io_stop() to stop them. Signed-off-by: Andrew de los Reyes <adlr@chromium.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: Merge branch 'master' into for-3.10/hid-driver-transport-cleanupsJiri Kosina2013-03-091-0/+1
| | |\ \ \ | | | | |/ | | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sync with Linus' tree. This is necessary to resolve build conflict caused by dcd9006b1b053c7b ("HID: logitech-dj: do not directly call hid_output_raw_report() during probe") which issues direct call to usbhid_submit_report(), but that is gone in this branch and hid_hw_request() has to be used instead. Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | * | | HID: make sensor autodetection independent of underlying busMika Westerberg2013-02-251-2/+1Star
| | | |/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of limiting HID sensors to USB and I2C busses we can just make everything that has usage page of HID_UP_SENSOR to be included in HID_GROUP_SENSOR_HUB group. This allows the sensor-hub to work over bluetooth (and other transports) as well. Reported-by: Alexander Holler <holler@ahsoftware.de> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com> Reviewed-By: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: protect hid_debug_listJiri Kosina2013-04-301-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Accesses to hid_device->hid_debug_list are not serialized properly, which could result in SMP concurrency issues when HID debugfs events are accessesed by multiple userspace processess. Serialize all the list operations by a mutex. Spotted by Al Viro. Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | HID: debug: break out hid_dump_report() into hid-debugBenjamin Tissoires2013-04-301-23/+2Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | No semantic changes, but hid_dump_report should be in hid-debug.c, not in hid-core.c Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | | | HID: appleir: add support for Apple ir devicesBenjamin Tissoires2013-04-191-2/+5
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This driver was originally written by James McKenzie, updated by Greg Kroah-Hartman, further updated by Bastien Nocera, with suspend support added. I ported it to the HID subsystem, in order to simplify it a litle and allow lirc to use it through hiddev. More recent versions of the IR receiver are also supported through a patch by Alex Karpenko. The patch also adds support for the 2nd and 5th generation of the controller, and the menu key on newer brushed metal remotes. Tested-by: Fabien André <fabien.andre@gmail.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | / HID: fix Masterkit MA901 hid quirksAlexey Klimov2013-03-291-1/+12
| |/ |/| | | | | | | | | | | | | | | | | | | This patch reverts commit 0322bd3980 ("usb hid quirks for Masterkit MA901 usb radio") and adds checks in hid_ignore() for Masterkit MA901 usb radio device. This usb radio device shares USB ID with many Atmel V-USB (and probably other) devices so patch sorts things out by checking name, vendor, product of hid device. Signed-off-by: Alexey Klimov <klimov.linux@gmail.com> Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | Merge branch 'v4l_for_linus' of ↵Linus Torvalds2013-02-251-0/+1
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - Some cleanups at V4L2 documentation - new drivers: ts2020 frontend, ov9650 sensor, s5c73m3 sensor, sh-mobile veu mem2mem driver, radio-ma901, davinci_vpfe staging driver - Lots of missing MAINTAINERS entries added - several em28xx driver improvements, including its conversion to videobuf2 - several fixups on drivers to make them to better comply with the API - DVB core: add support for DVBv5 stats, allowing the implementation of statistics for new standards like ISDB - mb86a20s: add statistics to the driver - lots of new board additions, cleanups, and driver improvements. * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (596 commits) [media] media: Add 0x3009 USB PID to ttusb2 driver (fixed diff) [media] rtl28xxu: Add USB IDs for Compro VideoMate U620F [media] em28xx: add usb id for terratec h5 rev. 3 [media] media: rc: gpio-ir-recv: add support for device tree parsing [media] mceusb: move check earlier to make smatch happy [media] radio-si470x doc: add info about v4l2-ctl and sox+alsa [media] staging: media: Remove unnecessary OOM messages [media] sh_vou: Use vou_dev instead of vou_file wherever possible [media] sh_vou: Use video_drvdata() [media] drivers/media/platform/soc_camera/pxa_camera.c: use devm_ functions [media] mt9t112: mt9t111 format set up differs from mt9t112 [media] sh-mobile-ceu-camera: fix SHARPNESS control default Revert "[media] fc0011: Return early, if the frequency is already tuned" [media] cx18/ivtv: fix regression: remove __init from a non-init function [media] em28xx: fix analog streaming with USB bulk transfers [media] stv0900: remove unnecessary null pointer check [media] fc0011: Return early, if the frequency is already tuned [media] fc0011: Add some sanity checks and cleanups [media] fc0011: Fix xin value clamping Revert "[media] [PATH,1/2] mxl5007 move reset to attach" ...
| * [hid] usb hid quirks for Masterkit MA901 usb radioAlexey Klimov2012-12-281-0/+1
| | | | | | | | | | | | | | | | | | | | Don't let Masterkit MA901 USB radio be handled by usb hid drivers. This device will be handled by radio-ma901.c driver. Signed-off-by: Alexey Klimov <klimov.linux@gmail.com> Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| |
| \
*-. \ Merge branches 'for-3.9/sony' and 'for-3.9/steelseries' into for-linusJiri Kosina2013-02-211-0/+1
|\ \ \ | | | | | | | | | | | | | | | | Conflicts: drivers/hid/hid-core.c
| | * | USB: HID: SRW-S1 Gaming Wheel DriverSimon Wood2013-01-311-0/+1
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support the SRW-S1 by patching HID descriptor to read axis as Generic Desktop X, Y and Z (rather than Usage page being 'Simulation'). Signed-off-by: Simon Wood <simon@mungewell.org> Tested-by: John Murphy <rosegardener@freeode.co.uk> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * / HID: add support for Sony RF receiver with USB product id 0x0374Fernando Luis Vázquez Cao2013-01-151-0/+1
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some Vaio desktop computers, among them the VGC-LN51JGB multimedia PC, have a RF receiver, multi-interface USB device 054c:0374, that is used to connect a wireless keyboard and a wireless mouse. The keyboard works flawlessly, but the mouse (VGP-WMS3 in my case) does not seem to be generating any pointer events. The problem is that the mouse pointer is wrongly declared as a constant non-data variable in the report descriptor (see lsusb and usbhid-dump output below), with the consequence that it is ignored by the HID code. Add this device to the have-special-driver list and fix up the report descriptor in the Sony-specific driver which happens to already have a fixup for a similar firmware bug. # lsusb -vd 054C:0374 Bus 003 Device 002: ID 054c:0374 Sony Corp. Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 8 idVendor 0x054c Sony Corp. idProduct 0x0374 iSerial 0 [...] Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 3 Human Interface Device bInterfaceSubClass 1 Boot Interface Subclass bInterfaceProtocol 2 Mouse iInterface 2 RF Receiver [...] Report Descriptor: (length is 100) [...] Item(Global): Usage Page, data= [ 0x01 ] 1 Generic Desktop Controls Item(Local ): Usage, data= [ 0x30 ] 48 Direction-X Item(Local ): Usage, data= [ 0x31 ] 49 Direction-Y Item(Global): Report Count, data= [ 0x02 ] 2 Item(Global): Report Size, data= [ 0x08 ] 8 Item(Global): Logical Minimum, data= [ 0x81 ] 129 Item(Global): Logical Maximum, data= [ 0x7f ] 127 Item(Main ): Input, data= [ 0x07 ] 7 Constant Variable Relative No_Wrap Linear Preferred_State No_Null_Position Non_Volatile Bitfield # usbhid-dump 003:002:001:DESCRIPTOR 1357910009.758544 05 01 09 02 A1 01 05 01 09 02 A1 02 85 01 09 01 A1 00 05 09 19 01 29 05 95 05 75 01 15 00 25 01 81 02 75 03 95 01 81 01 05 01 09 30 09 31 95 02 75 08 15 81 25 7F 81 07 A1 02 85 01 09 38 35 00 45 00 15 81 25 7F 95 01 75 08 81 06 C0 A1 02 85 01 05 0C 15 81 25 7F 95 01 75 08 0A 38 02 81 06 C0 C0 C0 C0 Cc: linux-input@vger.kernel.org Cc: linux-usb@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Fernando Luis Vazquez Cao <fernando@oss.ntt.co.jp> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| |
| \
| \
| \
*---. \ Merge branches 'for-3.9/logitech', 'for-3.9/multitouch', 'for-3.9/ntrig', ↵Jiri Kosina2013-02-211-0/+14
|\ \ \ \ | | |_|/ | |/| | | | | | 'for-3.9/thingm' and 'for-3.9/upstream' into for-linus
| | | * HID: add ThingM blink(1) USB RGB LED supportVivien Didelot2013-02-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ThingM blink(1) is an open source hardware USB RGB LED. It contains an internal EEPROM, allowing to configure up to 12 light patterns. A light pattern is a RGB color plus a fade time. This driver registers a LED class instance with additional sysfs attributes to support basic functions such as setting RGB colors, fade and playing. Other functions are still accessible through the hidraw interface. At this time, the only documentation for the device is the firmware source code from ThingM, plus a few schematics. They are available at: https://github.com/todbot/blink1 This patch is version 3. It updates the name of the source file, the driver and the led sysfs entry, according to comments from Jiri Kosina and Simon Wood. Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: blacklist Velleman data acquisition boardsIan Abbott2013-02-181-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These are simple data acquistion boards, not HID devices and are handled by the vmk80xx comedi driver. At least one of them (10cf:5500) misidentifies itself as a HID in its USB interface descriptor. Ignore all these devices. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| | | * HID: Support Jess/Saitek Color Rumble PadMichael Karcher2013-01-171-0/+1
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for another gamepad to the hid-pl driver. The "color rumble pad P580" marketed using the "Saitek" brand in Germany, and using a USB Vendor ID attributed to "Jess" seems to be electronically identical to the 4-field variant of the "Green Asia" gamepad. The pad has been tested to support rumble strengths up to 255, not just 127. Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-01-22 06:04:48 +0100