| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
A HID device could send a malicious feature report that would cause the
ntrig HID driver to trigger a NULL dereference during initialization:
[57383.031190] usb 3-1: New USB device found, idVendor=1b96, idProduct=0001
...
[57383.315193] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
[57383.315308] IP: [<ffffffffa08102de>] ntrig_probe+0x25e/0x420 [hid_ntrig]
CVE-2013-2896
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@kernel.org
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
The usage of strict_strtoul() is not preferred, because
strict_strtoul() is obsolete. Thus, kstrtoul() should be
used.
Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
This removes most of the dependencies between hid drivers and usbhid.
The patch was constructed by replacing all occurences of
usbhid_wait_io() by its hid_hw_wait() counterpart.
Then, drivers not requiring USB_HID anymore have their USB_HID
dependency cleaned in the Kconfig file.
As of today, few drivers are still requiring an explicit USB layer
dependency:
* ntrig (a patch is on its way)
* multitouch (one patch following and another on its way)
* lenovo tpkbd
* roccat
* sony
The last three are two deeply using direct calls to the usb subsystem
to be able to be cleaned right now.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
This allows the hid drivers to be independent from the transport layer.
The patch was constructed by replacing all occurences of
usbhid_submit_report() by its hid_hw_request() counterpart.
Then, drivers not requiring USB_HID anymore have their USB_HID
dependency cleaned in the Kconfig file.
Finally, few drivers still depends on USB_HID. Many of them
are requiring the io wait callback. They are found in the next patch.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
For the sensor-hub part:
Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
'for-3.9/thingm' and 'for-3.9/upstream' into for-linus
|
|
The use of input_configured() allows the ntrig driver to actually
change the name of the input and its bitmask before it is added to the
input subsystem. Thus, the logs are coherents and udev catch the real
bitmask when the device is added.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Use the new module_hid_driver macro in all HID drivers that have
a simple register/unregister init/exit.
This also converts the hid drivers that test for a failure of
hid_register_driver() and report the failure. Using module_hid_driver
in those drivers removes the failure message.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Since something will be divided by these variables in
show_min_width()/show_min_height() and show_activate_width()/
show_activate_height(), a divided error would be triggered if
they are zero.
Signed-off-by: Wen-chien Jesse Sung <jesse.sung@canonical.com>
Acked-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Adding a wait before the wakeup signal.
As a precautionary measure sanity check the current sensor mode. If
needed reset it to "dual".
When the device is responding poorly and needs the wakeup call, it was
missing it. Giving it a chance to settle first improves the chances
that signal gets through.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Probing reports does bad things with some ntrig firmwares, better to
just leave them alone.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Check before dereferencing field->hidinput to fix a reported invalid
deference bug.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Neaten current uses of dev_<level> by adding and using
hid specific hid_<level> macros.
Convert existing uses of dev_<level> uses to hid_<level>.
Convert hid-pidff printk uses to hid_<level>.
Remove err_hid and use hid_err instead.
Add missing newlines to logging messages where necessary.
Coalesce format strings.
Add and use pr_fmt(fmt) KBUILD_MODNAME ": " fmt
Other miscellaneous changes:
Add const struct hid_device * argument to hid-core functions
extract() and implement() so hid_<level> can be used by them.
Fix bad indentation in hid-core hid_input_field function
that calls extract() function above.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
This adds firmware version polling to the end of probe and reports the
version both in the raw form and proccessed to match the formatting used
by N-Trig.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Acked-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Signed-off-by: Micki Balanga <micki@n-trig.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
This should make it a little more convenient to tweak the filtering
parameters on the fly. Also unlike load-time parameters, this provides
independent tuning for each device conntected.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
The old rejection size thresholds were too high for the 12" devices.
Larger surfaces like the Dell Studio17 exacerbated the problem since
contact size is reported on the same logical scale, making a contact
look smaller to the larger screen.
Since we have observed erroneous ghost events from these devices we
still need to filter the incoming stream.
The prior size threshold filter is still in place, though with
defaults set to leave it off.
This patch adds the two new classes of filters, those that reject
live frames before activation, and those that reject empty frames
until deactivation. These filters are expressed in terms of a
simple state machine for clarity (I hope).
The activation filter has two components, slack and size, events
are discarded until either is satisfied. Slack is defined as
the number of seemingly good contacts to read before accepting the
stream as valid (if the threshold is reached in the middle of a frame
the remainder of that frame is still discarded).
The deactivation filter discards empty frames until hitting a
deactivate slack. This time measured in frames. N-Trig devices
emit 5-8 (observed so far) empty frames at the end of multitouch
activity. Ignoring the first few enables us to safely and gracefully
handle erroneous empty frames, thus preventing a change in the tool
state which would otherwise result in things like broken lines or
dragged objects being dropped in bad places.
Also, now that devices with different logical densities have
been observed, the aforementioned sizes are scaled from physical
to logical scales once those scales are identified. Hopefully this
should mean that a given threshold value means the same thing across
differing devices.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Removing the higher number taps. Their usage was incorrect
and even if correct they should not be used for a touch screen.
_MT_ events should be used to communicate multiple fingers.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Include TipSwitch in the touch detection decision for some single touch
firmwares. Confidence and InRange are high for all finger events
including those used to indicate the finger is no longer in contact with
the sensor.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
I squelched TipSwitch in a recent patch which resulted in the loss
of Touch events for single touch firmwares. This patch just puts Touch back
in for single touch, and bundles it with DoubleTap (like the multitouch code).
The two events are used to convey the same message to different drivers.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Commit 6549981bc54777c ("HID: fix N-trig touch panel with recent firmware")
adds a quirk that is needed for devices with more recent firmware so that
they become operational.
As it's not directly obvious from the code why is it needed, a comment
is worthwile.
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Added an init message that avoids device freeze with recent firmware.
Signed-off-by: Stephane Chatty <chatty@enac.fr>
Tested-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
implicit slab.h inclusion from percpu.h
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.
percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.
http://userweb.kernel.org/~tj/misc/slabh-sweep.py
The script does the followings.
* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.
* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.
* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.
The conversion was done in the following steps.
1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.
2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.
3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.
4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.
5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.
6. percpu.h was updated not to include slab.h.
7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).
* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig
8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.
Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.
Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
|
|
This reinstates the lost unpressing of BTN_TOUCH. To prevent undesireably
touch toggles this also deals with tip switch events.
Added a trap to prevent going out of bounds for hidinputs with empty reports.
Clear bits of unused buttons which result in misidentification.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Add DOUBLETAP to events emitted when in single touch only mode.
Users with a single touch firmware report not seeing the DOUBLETAP events; this
is a side effect of dropping old mapping for confidence. The confidence mapping
may be fine for singletouch mode but causes problems in multitouch mode.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
This cleans up the identification of multitouch groups and enables
the end of group sync.
Taps are now explicitly handled to adjust for the changes in the
event stream in multitouch mode. Added triple and quad tap for the
benefit of tools that recognize different tap types but do not have
full multi touch support.
This cleans up the behavior particularly for the latest firmware, which
didn't work particularly well with the older version of the driver.
In this form, when multitouch is active, both mt and st events will come out of
the "N-Trig MultiTouch" device. And when its not st events will come out of
"N-Trig Touchscreen".
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
With the pen and touch split apart, we no longer need to inject
additional tool switching events.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Added a quirk to enable distinct input devices. The digitizer utilizes
three inputs to represent pen, multitouch and a normal touch screen.
With the Pen partitioned, it behaves well and does not need special
handling.
Also, I set names to the input devices to clarify the functions of the
various inputs.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Trivial patch which adds the __init and __exit macros to the module_init /
module_exit functions of several HID drivers from drivers/hid/
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
When both touch and pen are active send a tool announcement before
sending any status changes so that event users may differentiate
which tool is changing.
Restored three usage codes used by the pen.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Acked-by: Stephane Chatty <chatty@enac.fr>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Adds support for multitouch interaction on the N-Trig touchscreen, using the
new ABS_MT_* input constants. Single touch support works as previously. This
code was tested against two versions of the N- Trig firmware: one that supports
dual pen/finger single touch, and one that supports finger multitouch but no
pen at all. Copyright notices that looked wrong were removed, as it seems that
there is only code written in 2009 by Rafin Rubin and Stephane Chatty in this
file.
Signed-off-by: Stephane Chatty <chatty@enac.fr>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
This removal was scheduled and there is no problem with later
distros to adapt for the new bus, thanks to aliases.
module-init-tools map files are deprecated nowadays, so that
the patch which introduced hid ones into the m-i-t won't be
accepted and hence there is no reason for leaving compat stuff in.
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
|
Added quirks for the N-Trig digitizer.
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
