mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-10-28 12:53:14 +01:00
The hid-rmi driver sizes its writeReport/readReport buffer purely from
the report descriptor supplied by the device, with no minimum bound:
data->input_report_size = hid_report_len(input_report);
data->output_report_size = hid_report_len(output_report);
alloc_size = data->output_report_size + data->input_report_size;
data->writeReport = devm_kzalloc(&hdev->dev, alloc_size, GFP_KERNEL);
data->readReport = data->writeReport + data->output_report_size;
but then reads and writes fixed offsets into it. A device declaring a
1-byte output and a 1-byte input report makes hid_report_len() return 2
for each, so alloc_size is 4, while rmi_set_page() -- reached
unconditionally at probe time through rmi_input_configured() -- stores
writeReport[4] and rmi_hid_read_block() stores writeReport[0..5]. Since
readReport lives at writeReport + output_report_size, those stores also
corrupt the window the next reply is parsed out of.
The read path is worse: the copy length comes from readReport[1], which
the device fills in and can be up to 255, and the copy starts at
&readReport[2] with no regard for input_report_size, so it runs past the
end of the allocation into adjacent slab objects. This does not even
need a lying device -- rmi_f01_probe() issues a fixed 21-byte register
read, so any device declaring an input report smaller than 23 bytes
reads out of bounds even when it answers truthfully. Those bytes become
the register values the RMI core acts on: rmi_f01_probe() prints them to
the kernel log as the product id and exports them through the mode 0444
sysfs attribute of the same name, and rmi_driver_set_irq_bits() sends
them back to the device as the interrupt mask, so an undersized report
descriptor leaks heap contents both to unprivileged userspace and to the
device itself.
The write path has no bound either: rmi_hid_write_block() copies an
unbounded len to &writeReport[4], and the largest caller a device can
drive at probe time is rmi_driver_set_irq_bits(), whose length is
derived from the interrupt source counts the device declares in its Page
Description Table.
Finally, the read loop cannot terminate on a zero-length reply: such a
reply copies nothing and advances neither bytes_read nor bytes_needed,
and because a reply did arrive the one second wait_event_timeout() does
not fire either, so a device answering 0 forever keeps the loop running
inside the probe worker with page_mutex held. khungtaskd does not
notice, because every reply wakes the task.
Reject reports too small for what the driver builds -- 6 output bytes
for the write reports and 3 input bytes for the read handshake -- at
probe time, clamp the write and the read copy to the report sizes the
device declared, and treat a zero-length reply as an error. A device
refused this way is started as an ordinary HID device, like one that
does not carry the RMI report ids at all.
RMI_DEVICE must not be left set in device_flags on that path, because
rmi_input_configured() would then run the RMI setup and reach
rmi_set_page(), which writes the writeReport buffer the refusal just
skipped allocating. The bit can arrive set: rmi_probe() copies
id->driver_data into device_flags before the report checks, and a bind
through the new_id sysfs attribute can supply driver_data with
RMI_DEVICE (BIT(0)) set. Strip the bit where driver_data is copied, so
RMI_DEVICE keeps meaning exactly "this probe validated the reports"; the
three jumps to start that predate this patch are covered as well.
The error path also clears RMI_READ_DATA_PENDING on its way out, because
that flag is what the wait at the top of the loop tests: leaving it set
would make every later wait_event_timeout() return immediately on the
stale reply and kill the read path for the rest of the device's life.
Clamping does not regress working hardware: the read loop already
handles a reply carrying fewer bytes than requested, and a write longer
than the output report was overrunning the buffer already.
Verified on v6.12.69 and on v6.12.105 built with CONFIG_KASAN=y and
booted kasan_multi_shot, whose hid-rmi.c is identical to mainline here.
An emulated RMI4 device driven over /dev/uhid, and the same device again
over dummy_hcd plus raw-gadget, give identical results:
BUG: KASAN: slab-out-of-bounds in rmi_hid_read_block+0x409/0x750 [hid_rmi]
Read of size 21 at addr ffff88800bf33bba by task kworker/0:3/285
__asan_memcpy+0x23/0x60
rmi_hid_read_block+0x409/0x750 [hid_rmi]
rmi_f01_probe+0x5dd/0x1dc0 [rmi_core]
BUG: KASAN: slab-out-of-bounds in rmi_hid_write_block+0x1a9/0x350 [hid_rmi]
Write of size 35 at addr ffff88810a2b24ac by task kworker/1:10/666
__asan_memcpy+0x3c/0x60
rmi_hid_write_block+0x1a9/0x350 [hid_rmi]
rmi_driver_set_irq_bits+0x1f6/0x4d0 [rmi_core]
rmi_driver_probe+0x636/0xbf0 [rmi_core]
rmi_input_configured+0x184/0x2e0 [hid_rmi]
rmi_probe+0x952/0xcf0 [hid_rmi]
and, for the zero-length reply, a probe worker left in D state in
rmi_hid_read_block() after 225 replies at 200 ms intervals.
After this change the undersized descriptor is refused at probe with
"rmi reports too small (out=2 in=2)", the oversized read and write are
both rejected, the zero-length reply fails the read with -EIO while
later reads on the same device keep working, and a device declaring
reports large enough for a 21-byte register read still probes normally
and reports its real product id. A device bound through new_id with
RMI_DEVICE in its driver_data no longer reaches rmi_set_page() with an
unallocated writeReport either.
Link: https://lore.kernel.org/linux-input/[email protected]/
Link: https://lore.kernel.org/linux-input/00a489f38b240624dcb5a4bae36a53fcba9cfb47.1787549195.git.98lawweijie@gmail.com/
Link: https://lore.kernel.org/linux-input/[email protected]/
Link: https://lore.kernel.org/linux-input/[email protected]/
Fixes: 9fb6bf02e3 ("HID: rmi: introduce RMI driver for Synaptics touchpads")
Cc: [email protected]
Assisted-by: Claude:claude-opus-5
Assisted-by: GLM:glm-5.3
Signed-off-by: Wei Jie Law <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
825 lines
20 KiB
C
825 lines
20 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* Copyright (c) 2013 Andrew Duggan <[email protected]>
|
|
* Copyright (c) 2013 Synaptics Incorporated
|
|
* Copyright (c) 2014 Benjamin Tissoires <[email protected]>
|
|
* Copyright (c) 2014 Red Hat, Inc
|
|
*/
|
|
|
|
#include <linux/kernel.h>
|
|
#include <linux/hid.h>
|
|
#include <linux/input.h>
|
|
#include <linux/input/mt.h>
|
|
#include <linux/irq.h>
|
|
#include <linux/irqdomain.h>
|
|
#include <linux/module.h>
|
|
#include <linux/pm.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/wait.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/rmi.h>
|
|
#include "hid-ids.h"
|
|
|
|
#define RMI_MOUSE_REPORT_ID 0x01 /* Mouse emulation Report */
|
|
#define RMI_WRITE_REPORT_ID 0x09 /* Output Report */
|
|
#define RMI_READ_ADDR_REPORT_ID 0x0a /* Output Report */
|
|
#define RMI_READ_DATA_REPORT_ID 0x0b /* Input Report */
|
|
#define RMI_ATTN_REPORT_ID 0x0c /* Input Report */
|
|
#define RMI_SET_RMI_MODE_REPORT_ID 0x0f /* Feature Report */
|
|
|
|
/* flags */
|
|
#define RMI_READ_REQUEST_PENDING 0
|
|
#define RMI_READ_DATA_PENDING 1
|
|
#define RMI_STARTED 2
|
|
|
|
/* device flags */
|
|
#define RMI_DEVICE BIT(0)
|
|
#define RMI_DEVICE_HAS_PHYS_BUTTONS BIT(1)
|
|
#define RMI_DEVICE_OUTPUT_SET_REPORT BIT(2)
|
|
|
|
/*
|
|
* retrieve the ctrl registers
|
|
* the ctrl register has a size of 20 but a fw bug split it into 16 + 4,
|
|
* and there is no way to know if the first 20 bytes are here or not.
|
|
* We use only the first 12 bytes, so get only them.
|
|
*/
|
|
#define RMI_F11_CTRL_REG_COUNT 12
|
|
|
|
enum rmi_mode_type {
|
|
RMI_MODE_OFF = 0,
|
|
RMI_MODE_ATTN_REPORTS = 1,
|
|
RMI_MODE_NO_PACKED_ATTN_REPORTS = 2,
|
|
};
|
|
|
|
/**
|
|
* struct rmi_data - stores information for hid communication
|
|
*
|
|
* @page_mutex: Locks current page to avoid changing pages in unexpected ways.
|
|
* @page: Keeps track of the current virtual page
|
|
* @xport: transport device to be registered with the RMI4 core.
|
|
*
|
|
* @wait: Used for waiting for read data
|
|
*
|
|
* @writeReport: output buffer when writing RMI registers
|
|
* @readReport: input buffer when reading RMI registers
|
|
*
|
|
* @input_report_size: size of an input report (advertised by HID)
|
|
* @output_report_size: size of an output report (advertised by HID)
|
|
*
|
|
* @flags: flags for the current device (started, reading, etc...)
|
|
*
|
|
* @reset_work: worker which will be called in case of a mouse report
|
|
* @hdev: pointer to the struct hid_device
|
|
*
|
|
* @device_flags: flags which describe the device
|
|
*
|
|
* @domain: the IRQ domain allocated for this RMI4 device
|
|
* @rmi_irq: the irq that will be used to generate events to rmi-core
|
|
*/
|
|
struct rmi_data {
|
|
struct mutex page_mutex;
|
|
int page;
|
|
struct rmi_transport_dev xport;
|
|
|
|
wait_queue_head_t wait;
|
|
|
|
u8 *writeReport;
|
|
u8 *readReport;
|
|
|
|
u32 input_report_size;
|
|
u32 output_report_size;
|
|
|
|
unsigned long flags;
|
|
|
|
struct work_struct reset_work;
|
|
struct hid_device *hdev;
|
|
|
|
unsigned long device_flags;
|
|
|
|
struct irq_domain *domain;
|
|
int rmi_irq;
|
|
};
|
|
|
|
#define RMI_PAGE(addr) (((addr) >> 8) & 0xff)
|
|
|
|
static int rmi_write_report(struct hid_device *hdev, u8 *report, int len);
|
|
|
|
/**
|
|
* rmi_set_page - Set RMI page
|
|
* @hdev: The pointer to the hid_device struct
|
|
* @page: The new page address.
|
|
*
|
|
* RMI devices have 16-bit addressing, but some of the physical
|
|
* implementations (like SMBus) only have 8-bit addressing. So RMI implements
|
|
* a page address at 0xff of every page so we can reliable page addresses
|
|
* every 256 registers.
|
|
*
|
|
* The page_mutex lock must be held when this function is entered.
|
|
*
|
|
* Returns zero on success, non-zero on failure.
|
|
*/
|
|
static int rmi_set_page(struct hid_device *hdev, u8 page)
|
|
{
|
|
struct rmi_data *data = hid_get_drvdata(hdev);
|
|
int retval;
|
|
|
|
data->writeReport[0] = RMI_WRITE_REPORT_ID;
|
|
data->writeReport[1] = 1;
|
|
data->writeReport[2] = 0xFF;
|
|
data->writeReport[4] = page;
|
|
|
|
retval = rmi_write_report(hdev, data->writeReport,
|
|
data->output_report_size);
|
|
if (retval != data->output_report_size) {
|
|
dev_err(&hdev->dev,
|
|
"%s: set page failed: %d.", __func__, retval);
|
|
return retval;
|
|
}
|
|
|
|
data->page = page;
|
|
return 0;
|
|
}
|
|
|
|
static int rmi_set_mode(struct hid_device *hdev, u8 mode)
|
|
{
|
|
int ret;
|
|
const u8 txbuf[2] = {RMI_SET_RMI_MODE_REPORT_ID, mode};
|
|
u8 *buf;
|
|
|
|
buf = kmemdup(txbuf, sizeof(txbuf), GFP_KERNEL);
|
|
if (!buf)
|
|
return -ENOMEM;
|
|
|
|
ret = hid_hw_raw_request(hdev, RMI_SET_RMI_MODE_REPORT_ID, buf,
|
|
sizeof(txbuf), HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
|
|
kfree(buf);
|
|
if (ret < 0) {
|
|
dev_err(&hdev->dev, "unable to set rmi mode to %d (%d)\n", mode,
|
|
ret);
|
|
return ret;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int rmi_write_report(struct hid_device *hdev, u8 *report, int len)
|
|
{
|
|
struct rmi_data *data = hid_get_drvdata(hdev);
|
|
int ret;
|
|
|
|
if (data->device_flags & RMI_DEVICE_OUTPUT_SET_REPORT) {
|
|
/*
|
|
* Talk to device by using SET_REPORT requests instead.
|
|
*/
|
|
ret = hid_hw_raw_request(hdev, report[0], report,
|
|
len, HID_OUTPUT_REPORT, HID_REQ_SET_REPORT);
|
|
} else {
|
|
ret = hid_hw_output_report(hdev, (void *)report, len);
|
|
}
|
|
|
|
if (ret < 0) {
|
|
dev_err(&hdev->dev, "failed to write hid report (%d)\n", ret);
|
|
return ret;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int rmi_hid_read_block(struct rmi_transport_dev *xport, u16 addr,
|
|
void *buf, size_t len)
|
|
{
|
|
struct rmi_data *data = container_of(xport, struct rmi_data, xport);
|
|
struct hid_device *hdev = data->hdev;
|
|
int ret;
|
|
int bytes_read;
|
|
int bytes_needed;
|
|
int retries;
|
|
int read_input_count;
|
|
|
|
mutex_lock(&data->page_mutex);
|
|
|
|
if (RMI_PAGE(addr) != data->page) {
|
|
ret = rmi_set_page(hdev, RMI_PAGE(addr));
|
|
if (ret < 0)
|
|
goto exit;
|
|
}
|
|
|
|
for (retries = 5; retries > 0; retries--) {
|
|
data->writeReport[0] = RMI_READ_ADDR_REPORT_ID;
|
|
data->writeReport[1] = 0; /* old 1 byte read count */
|
|
data->writeReport[2] = addr & 0xFF;
|
|
data->writeReport[3] = (addr >> 8) & 0xFF;
|
|
data->writeReport[4] = len & 0xFF;
|
|
data->writeReport[5] = (len >> 8) & 0xFF;
|
|
|
|
set_bit(RMI_READ_REQUEST_PENDING, &data->flags);
|
|
|
|
ret = rmi_write_report(hdev, data->writeReport,
|
|
data->output_report_size);
|
|
if (ret != data->output_report_size) {
|
|
dev_err(&hdev->dev,
|
|
"failed to write request output report (%d)\n",
|
|
ret);
|
|
goto exit;
|
|
}
|
|
|
|
bytes_read = 0;
|
|
bytes_needed = len;
|
|
while (bytes_read < len) {
|
|
if (!wait_event_timeout(data->wait,
|
|
test_bit(RMI_READ_DATA_PENDING, &data->flags),
|
|
msecs_to_jiffies(1000))) {
|
|
hid_warn(hdev, "%s: timeout elapsed\n",
|
|
__func__);
|
|
ret = -EAGAIN;
|
|
break;
|
|
}
|
|
|
|
read_input_count = min_t(int, data->readReport[1],
|
|
data->input_report_size - 2);
|
|
if (!read_input_count) {
|
|
/*
|
|
* A zero length reply advances neither
|
|
* bytes_read nor bytes_needed, and because a
|
|
* reply did arrive the wait above does not
|
|
* time out either, so a device answering 0
|
|
* forever would spin here indefinitely with
|
|
* page_mutex held.
|
|
*/
|
|
hid_warn(hdev, "%s: zero-length read reply\n",
|
|
__func__);
|
|
clear_bit(RMI_READ_DATA_PENDING, &data->flags);
|
|
ret = -EIO;
|
|
break;
|
|
}
|
|
memcpy(buf + bytes_read, &data->readReport[2],
|
|
min(read_input_count, bytes_needed));
|
|
|
|
bytes_read += read_input_count;
|
|
bytes_needed -= read_input_count;
|
|
clear_bit(RMI_READ_DATA_PENDING, &data->flags);
|
|
}
|
|
|
|
if (ret >= 0) {
|
|
ret = 0;
|
|
break;
|
|
}
|
|
}
|
|
|
|
exit:
|
|
clear_bit(RMI_READ_REQUEST_PENDING, &data->flags);
|
|
mutex_unlock(&data->page_mutex);
|
|
return ret;
|
|
}
|
|
|
|
static int rmi_hid_write_block(struct rmi_transport_dev *xport, u16 addr,
|
|
const void *buf, size_t len)
|
|
{
|
|
struct rmi_data *data = container_of(xport, struct rmi_data, xport);
|
|
struct hid_device *hdev = data->hdev;
|
|
int ret;
|
|
|
|
mutex_lock(&data->page_mutex);
|
|
|
|
if (RMI_PAGE(addr) != data->page) {
|
|
ret = rmi_set_page(hdev, RMI_PAGE(addr));
|
|
if (ret < 0)
|
|
goto exit;
|
|
}
|
|
|
|
if (len + 4 > data->output_report_size) {
|
|
ret = -EINVAL;
|
|
goto exit;
|
|
}
|
|
|
|
data->writeReport[0] = RMI_WRITE_REPORT_ID;
|
|
data->writeReport[1] = len;
|
|
data->writeReport[2] = addr & 0xFF;
|
|
data->writeReport[3] = (addr >> 8) & 0xFF;
|
|
memcpy(&data->writeReport[4], buf, len);
|
|
|
|
ret = rmi_write_report(hdev, data->writeReport,
|
|
data->output_report_size);
|
|
if (ret < 0) {
|
|
dev_err(&hdev->dev,
|
|
"failed to write request output report (%d)\n",
|
|
ret);
|
|
goto exit;
|
|
}
|
|
ret = 0;
|
|
|
|
exit:
|
|
mutex_unlock(&data->page_mutex);
|
|
return ret;
|
|
}
|
|
|
|
static int rmi_reset_attn_mode(struct hid_device *hdev)
|
|
{
|
|
struct rmi_data *data = hid_get_drvdata(hdev);
|
|
struct rmi_device *rmi_dev = data->xport.rmi_dev;
|
|
int ret;
|
|
|
|
ret = rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
|
|
if (ret)
|
|
return ret;
|
|
|
|
if (test_bit(RMI_STARTED, &data->flags))
|
|
ret = rmi_dev->driver->reset_handler(rmi_dev);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static void rmi_reset_work(struct work_struct *work)
|
|
{
|
|
struct rmi_data *hdata = container_of(work, struct rmi_data,
|
|
reset_work);
|
|
|
|
/* switch the device to RMI if we receive a generic mouse report */
|
|
rmi_reset_attn_mode(hdata->hdev);
|
|
}
|
|
|
|
static int rmi_input_event(struct hid_device *hdev, u8 *data, int size)
|
|
{
|
|
struct rmi_data *hdata = hid_get_drvdata(hdev);
|
|
struct rmi_device *rmi_dev = hdata->xport.rmi_dev;
|
|
unsigned long flags;
|
|
|
|
if (!(test_bit(RMI_STARTED, &hdata->flags)))
|
|
return 0;
|
|
|
|
pm_wakeup_event(hdev->dev.parent, 0);
|
|
|
|
local_irq_save(flags);
|
|
|
|
rmi_set_attn_data(rmi_dev, data[1], &data[2], size - 2);
|
|
|
|
generic_handle_irq(hdata->rmi_irq);
|
|
|
|
local_irq_restore(flags);
|
|
|
|
return 1;
|
|
}
|
|
|
|
static int rmi_read_data_event(struct hid_device *hdev, u8 *data, int size)
|
|
{
|
|
struct rmi_data *hdata = hid_get_drvdata(hdev);
|
|
|
|
if (!test_bit(RMI_READ_REQUEST_PENDING, &hdata->flags)) {
|
|
hid_dbg(hdev, "no read request pending\n");
|
|
return 0;
|
|
}
|
|
|
|
memcpy(hdata->readReport, data, min((u32)size, hdata->input_report_size));
|
|
set_bit(RMI_READ_DATA_PENDING, &hdata->flags);
|
|
wake_up(&hdata->wait);
|
|
|
|
return 1;
|
|
}
|
|
|
|
static int rmi_check_sanity(struct hid_device *hdev, u8 *data, int size)
|
|
{
|
|
int valid_size = size;
|
|
/*
|
|
* On the Dell XPS 13 9333, the bus sometimes get confused and fills
|
|
* the report with a sentinel value "ff". Synaptics told us that such
|
|
* behavior does not comes from the touchpad itself, so we filter out
|
|
* such reports here.
|
|
*/
|
|
|
|
while (valid_size > 0 && data[valid_size - 1] == 0xff)
|
|
valid_size--;
|
|
|
|
return valid_size;
|
|
}
|
|
|
|
static int rmi_raw_event(struct hid_device *hdev,
|
|
struct hid_report *report, u8 *data, int size)
|
|
{
|
|
struct rmi_data *hdata = hid_get_drvdata(hdev);
|
|
|
|
if (!(hdata->device_flags & RMI_DEVICE))
|
|
return 0;
|
|
|
|
size = rmi_check_sanity(hdev, data, size);
|
|
if (size < 2)
|
|
return 0;
|
|
|
|
switch (data[0]) {
|
|
case RMI_READ_DATA_REPORT_ID:
|
|
return rmi_read_data_event(hdev, data, size);
|
|
case RMI_ATTN_REPORT_ID:
|
|
return rmi_input_event(hdev, data, size);
|
|
default:
|
|
return 1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int rmi_event(struct hid_device *hdev, struct hid_field *field,
|
|
struct hid_usage *usage, __s32 value)
|
|
{
|
|
struct rmi_data *data = hid_get_drvdata(hdev);
|
|
|
|
if ((data->device_flags & RMI_DEVICE) &&
|
|
(field->application == HID_GD_POINTER ||
|
|
field->application == HID_GD_MOUSE)) {
|
|
if (data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS) {
|
|
if ((usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON)
|
|
return 0;
|
|
|
|
if ((usage->hid == HID_GD_X || usage->hid == HID_GD_Y)
|
|
&& !value)
|
|
return 1;
|
|
}
|
|
|
|
schedule_work(&data->reset_work);
|
|
return 1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void rmi_report(struct hid_device *hid, struct hid_report *report)
|
|
{
|
|
struct hid_field *field = report->field[0];
|
|
|
|
if (!(hid->claimed & HID_CLAIMED_INPUT))
|
|
return;
|
|
|
|
switch (report->id) {
|
|
case RMI_READ_DATA_REPORT_ID:
|
|
case RMI_ATTN_REPORT_ID:
|
|
return;
|
|
}
|
|
|
|
if (field && field->hidinput && field->hidinput->input)
|
|
input_sync(field->hidinput->input);
|
|
}
|
|
|
|
static int rmi_suspend(struct hid_device *hdev, pm_message_t message)
|
|
{
|
|
struct rmi_data *data = hid_get_drvdata(hdev);
|
|
struct rmi_device *rmi_dev = data->xport.rmi_dev;
|
|
int ret;
|
|
|
|
if (!(data->device_flags & RMI_DEVICE))
|
|
return 0;
|
|
|
|
ret = rmi_driver_suspend(rmi_dev, false);
|
|
if (ret) {
|
|
hid_warn(hdev, "Failed to suspend device: %d\n", ret);
|
|
return ret;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int rmi_post_resume(struct hid_device *hdev)
|
|
{
|
|
struct rmi_data *data = hid_get_drvdata(hdev);
|
|
struct rmi_device *rmi_dev = data->xport.rmi_dev;
|
|
int ret;
|
|
|
|
if (!(data->device_flags & RMI_DEVICE))
|
|
return 0;
|
|
|
|
/* Make sure the HID device is ready to receive events */
|
|
ret = hid_hw_open(hdev);
|
|
if (ret)
|
|
return ret;
|
|
|
|
ret = rmi_reset_attn_mode(hdev);
|
|
if (ret)
|
|
goto out;
|
|
|
|
ret = rmi_driver_resume(rmi_dev, false);
|
|
if (ret) {
|
|
hid_warn(hdev, "Failed to resume device: %d\n", ret);
|
|
goto out;
|
|
}
|
|
|
|
out:
|
|
hid_hw_close(hdev);
|
|
return ret;
|
|
}
|
|
|
|
static int rmi_hid_reset(struct rmi_transport_dev *xport, u16 reset_addr)
|
|
{
|
|
struct rmi_data *data = container_of(xport, struct rmi_data, xport);
|
|
struct hid_device *hdev = data->hdev;
|
|
|
|
return rmi_reset_attn_mode(hdev);
|
|
}
|
|
|
|
static int rmi_input_configured(struct hid_device *hdev, struct hid_input *hi)
|
|
{
|
|
struct rmi_data *data = hid_get_drvdata(hdev);
|
|
struct input_dev *input = hi->input;
|
|
int ret = 0;
|
|
|
|
if (!(data->device_flags & RMI_DEVICE))
|
|
return 0;
|
|
|
|
data->xport.input = input;
|
|
|
|
hid_dbg(hdev, "Opening low level driver\n");
|
|
ret = hid_hw_open(hdev);
|
|
if (ret)
|
|
return ret;
|
|
|
|
/* Allow incoming hid reports */
|
|
hid_device_io_start(hdev);
|
|
|
|
ret = rmi_set_mode(hdev, RMI_MODE_ATTN_REPORTS);
|
|
if (ret < 0) {
|
|
dev_err(&hdev->dev, "failed to set rmi mode\n");
|
|
goto exit;
|
|
}
|
|
|
|
ret = rmi_set_page(hdev, 0);
|
|
if (ret < 0) {
|
|
dev_err(&hdev->dev, "failed to set page select to 0.\n");
|
|
goto exit;
|
|
}
|
|
|
|
ret = rmi_register_transport_device(&data->xport);
|
|
if (ret < 0) {
|
|
dev_err(&hdev->dev, "failed to register transport driver\n");
|
|
goto exit;
|
|
}
|
|
|
|
set_bit(RMI_STARTED, &data->flags);
|
|
|
|
exit:
|
|
hid_device_io_stop(hdev);
|
|
hid_hw_close(hdev);
|
|
return ret;
|
|
}
|
|
|
|
static int rmi_input_mapping(struct hid_device *hdev,
|
|
struct hid_input *hi, struct hid_field *field,
|
|
struct hid_usage *usage, unsigned long **bit, int *max)
|
|
{
|
|
struct rmi_data *data = hid_get_drvdata(hdev);
|
|
|
|
/*
|
|
* we want to make HID ignore the advertised HID collection
|
|
* for RMI deivces
|
|
*/
|
|
if (data->device_flags & RMI_DEVICE) {
|
|
if ((data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS) &&
|
|
((usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON))
|
|
return 0;
|
|
|
|
return -1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int rmi_check_valid_report_id(struct hid_device *hdev, unsigned type,
|
|
unsigned id, struct hid_report **report)
|
|
{
|
|
int i;
|
|
|
|
*report = hdev->report_enum[type].report_id_hash[id];
|
|
if (*report) {
|
|
for (i = 0; i < (*report)->maxfield; i++) {
|
|
unsigned app = (*report)->field[i]->application;
|
|
if ((app & HID_USAGE_PAGE) >= HID_UP_MSVENDOR)
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static struct rmi_device_platform_data rmi_hid_pdata = {
|
|
.sensor_pdata = {
|
|
.sensor_type = rmi_sensor_touchpad,
|
|
.axis_align.flip_y = true,
|
|
.dribble = RMI_REG_STATE_ON,
|
|
.palm_detect = RMI_REG_STATE_OFF,
|
|
},
|
|
};
|
|
|
|
static const struct rmi_transport_ops hid_rmi_ops = {
|
|
.write_block = rmi_hid_write_block,
|
|
.read_block = rmi_hid_read_block,
|
|
.reset = rmi_hid_reset,
|
|
};
|
|
|
|
static void rmi_irq_teardown(void *data)
|
|
{
|
|
struct rmi_data *hdata = data;
|
|
struct irq_domain *domain = hdata->domain;
|
|
|
|
if (!domain)
|
|
return;
|
|
|
|
irq_dispose_mapping(irq_find_mapping(domain, 0));
|
|
|
|
irq_domain_remove(domain);
|
|
hdata->domain = NULL;
|
|
hdata->rmi_irq = 0;
|
|
}
|
|
|
|
static int rmi_irq_map(struct irq_domain *h, unsigned int virq,
|
|
irq_hw_number_t hw_irq_num)
|
|
{
|
|
irq_set_chip_and_handler(virq, &dummy_irq_chip, handle_simple_irq);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const struct irq_domain_ops rmi_irq_ops = {
|
|
.map = rmi_irq_map,
|
|
};
|
|
|
|
static int rmi_setup_irq_domain(struct hid_device *hdev)
|
|
{
|
|
struct rmi_data *hdata = hid_get_drvdata(hdev);
|
|
int ret;
|
|
|
|
hdata->domain = irq_domain_create_linear(hdev->dev.fwnode, 1,
|
|
&rmi_irq_ops, hdata);
|
|
if (!hdata->domain)
|
|
return -ENOMEM;
|
|
|
|
ret = devm_add_action_or_reset(&hdev->dev, &rmi_irq_teardown, hdata);
|
|
if (ret)
|
|
return ret;
|
|
|
|
hdata->rmi_irq = irq_create_mapping(hdata->domain, 0);
|
|
if (hdata->rmi_irq <= 0) {
|
|
hid_err(hdev, "Can't allocate an IRQ\n");
|
|
return hdata->rmi_irq < 0 ? hdata->rmi_irq : -ENXIO;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int rmi_probe(struct hid_device *hdev, const struct hid_device_id *id)
|
|
{
|
|
struct rmi_data *data = NULL;
|
|
int ret;
|
|
size_t alloc_size;
|
|
struct hid_report *input_report;
|
|
struct hid_report *output_report;
|
|
struct hid_report *feature_report;
|
|
|
|
data = devm_kzalloc(&hdev->dev, sizeof(struct rmi_data), GFP_KERNEL);
|
|
if (!data)
|
|
return -ENOMEM;
|
|
|
|
INIT_WORK(&data->reset_work, rmi_reset_work);
|
|
data->hdev = hdev;
|
|
|
|
hid_set_drvdata(hdev, data);
|
|
|
|
hdev->quirks |= HID_QUIRK_NO_INIT_REPORTS;
|
|
hdev->quirks |= HID_QUIRK_NO_INPUT_SYNC;
|
|
|
|
ret = hid_parse(hdev);
|
|
if (ret) {
|
|
hid_err(hdev, "parse failed\n");
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* RMI_DEVICE can only mean "this probe validated the RMI reports and
|
|
* allocated writeReport": every bail-out to start below skips that
|
|
* allocation, and device_flags left carrying RMI_DEVICE from
|
|
* driver_data would send rmi_input_configured() into rmi_set_page()
|
|
* with writeReport still NULL. A bind through the new_id sysfs
|
|
* attribute can supply driver_data with the bit set, so do not let
|
|
* driver_data grant it.
|
|
*/
|
|
data->device_flags = id->driver_data & ~RMI_DEVICE;
|
|
|
|
/*
|
|
* Check for the RMI specific report ids. If they are misisng
|
|
* simply return and let the events be processed by hid-input
|
|
*/
|
|
if (!rmi_check_valid_report_id(hdev, HID_FEATURE_REPORT,
|
|
RMI_SET_RMI_MODE_REPORT_ID, &feature_report)) {
|
|
hid_dbg(hdev, "device does not have set mode feature report\n");
|
|
goto start;
|
|
}
|
|
|
|
if (!rmi_check_valid_report_id(hdev, HID_INPUT_REPORT,
|
|
RMI_ATTN_REPORT_ID, &input_report)) {
|
|
hid_dbg(hdev, "device does not have attention input report\n");
|
|
goto start;
|
|
}
|
|
|
|
data->input_report_size = hid_report_len(input_report);
|
|
|
|
if (!rmi_check_valid_report_id(hdev, HID_OUTPUT_REPORT,
|
|
RMI_WRITE_REPORT_ID, &output_report)) {
|
|
hid_dbg(hdev,
|
|
"device does not have rmi write output report\n");
|
|
goto start;
|
|
}
|
|
|
|
data->output_report_size = hid_report_len(output_report);
|
|
|
|
/*
|
|
* The write reports built by this driver occupy 6 bytes and the read
|
|
* handshake looks at the first 3 bytes of an input report, so refuse
|
|
* to drive a device whose reports cannot hold them.
|
|
*/
|
|
if (data->output_report_size < 6 || data->input_report_size < 3) {
|
|
hid_err(hdev, "rmi reports too small (out=%u in=%u)\n",
|
|
data->output_report_size, data->input_report_size);
|
|
goto start;
|
|
}
|
|
|
|
data->device_flags |= RMI_DEVICE;
|
|
alloc_size = data->output_report_size + data->input_report_size;
|
|
|
|
data->writeReport = devm_kzalloc(&hdev->dev, alloc_size, GFP_KERNEL);
|
|
if (!data->writeReport) {
|
|
hid_err(hdev, "failed to allocate buffer for HID reports\n");
|
|
return -ENOMEM;
|
|
}
|
|
|
|
data->readReport = data->writeReport + data->output_report_size;
|
|
|
|
init_waitqueue_head(&data->wait);
|
|
|
|
mutex_init(&data->page_mutex);
|
|
|
|
ret = rmi_setup_irq_domain(hdev);
|
|
if (ret) {
|
|
hid_err(hdev, "failed to allocate IRQ domain\n");
|
|
return ret;
|
|
}
|
|
|
|
if (data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS)
|
|
rmi_hid_pdata.gpio_data.disable = true;
|
|
|
|
data->xport.dev = hdev->dev.parent;
|
|
data->xport.pdata = rmi_hid_pdata;
|
|
data->xport.pdata.irq = data->rmi_irq;
|
|
data->xport.proto_name = "hid";
|
|
data->xport.ops = &hid_rmi_ops;
|
|
|
|
start:
|
|
ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
|
|
if (ret) {
|
|
hid_err(hdev, "hw start failed\n");
|
|
return ret;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void rmi_remove(struct hid_device *hdev)
|
|
{
|
|
struct rmi_data *hdata = hid_get_drvdata(hdev);
|
|
|
|
if ((hdata->device_flags & RMI_DEVICE)
|
|
&& test_bit(RMI_STARTED, &hdata->flags)) {
|
|
clear_bit(RMI_STARTED, &hdata->flags);
|
|
cancel_work_sync(&hdata->reset_work);
|
|
rmi_unregister_transport_device(&hdata->xport);
|
|
}
|
|
|
|
hid_hw_stop(hdev);
|
|
}
|
|
|
|
static const struct hid_device_id rmi_id[] = {
|
|
{ HID_USB_DEVICE(USB_VENDOR_ID_RAZER, USB_DEVICE_ID_RAZER_BLADE_14),
|
|
.driver_data = RMI_DEVICE_HAS_PHYS_BUTTONS },
|
|
{ HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_COVER) },
|
|
{ HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_REZEL) },
|
|
{ HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5),
|
|
.driver_data = RMI_DEVICE_OUTPUT_SET_REPORT },
|
|
{ HID_DEVICE(HID_BUS_ANY, HID_GROUP_RMI, HID_ANY_ID, HID_ANY_ID) },
|
|
{ }
|
|
};
|
|
MODULE_DEVICE_TABLE(hid, rmi_id);
|
|
|
|
static struct hid_driver rmi_driver = {
|
|
.name = "hid-rmi",
|
|
.id_table = rmi_id,
|
|
.probe = rmi_probe,
|
|
.remove = rmi_remove,
|
|
.event = rmi_event,
|
|
.raw_event = rmi_raw_event,
|
|
.report = rmi_report,
|
|
.input_mapping = rmi_input_mapping,
|
|
.input_configured = rmi_input_configured,
|
|
.suspend = pm_ptr(rmi_suspend),
|
|
.resume = pm_ptr(rmi_post_resume),
|
|
.reset_resume = pm_ptr(rmi_post_resume),
|
|
};
|
|
|
|
module_hid_driver(rmi_driver);
|
|
|
|
MODULE_AUTHOR("Andrew Duggan <[email protected]>");
|
|
MODULE_DESCRIPTION("RMI HID driver");
|
|
MODULE_LICENSE("GPL");
|