linux.git/drivers/hid/wacom_sys.c, branch v4.16

HID: wacom: EKR: ensure devres groups at higher indexes are released

2018-01-23T14:30:23+00:00

Background: ExpressKey Remotes communicate their events via usb dongle.
Each dongle can hold up to 5 pairings at one time and one EKR (identified
by its serial number) can unfortunately be paired with its dongle
more than once. The pairing takes place in a round-robin fashion.

Input devices are only created once per EKR, when a new serial number
is seen in the list of pairings. However, if a device is created for
a "higher" paring index and subsequently a second pairing occurs at a
lower pairing index, unpairing the remote with that serial number from
any pairing index will currently cause a driver crash. This occurs
infrequently, as two remotes are necessary to trigger this bug and most
users have only one remote.

As an illustration, to trigger the bug you need to have two remotes,
and pair them in this order:

1. slot 0 -> remote 1 (input device created for remote 1)
2. slot 1 -> remote 1 (duplicate pairing - no device created)
3. slot 2 -> remote 1 (duplicate pairing - no device created)
4. slot 3 -> remote 1 (duplicate pairing - no device created)
5. slot 4 -> remote 2 (input device created for remote 2)

6. slot 0 -> remote 2 (1 destroyed and recreated at slot 1)
7. slot 1 -> remote 2 (1 destroyed and recreated at slot 2)
8. slot 2 -> remote 2 (1 destroyed and recreated at slot 3)
9. slot 3 -> remote 2 (1 destroyed and not recreated)
10. slot 4 -> remote 2 (2 was already in this slot so no changes)

11. slot 0 -> remote 1 (The current code sees remote 2 was paired over in
                        one of the dongle slots it occupied and attempts
                        to remove all information about remote 2 [1]. It
                        calls wacom_remote_destroy_one for remote 2, but
                        the destroy function assumes the lowest index is
                        where the remote's input device was created. The
                        code "cleans up" the other remote 2 pairings
                        including the one which the input device was based
                        on, assuming they were were just duplicate
                        pairings. However, the cleanup doesn't call the
                        devres release function for the input device that
                        was created in slot 4).

This issue is fixed by this commit.

[1] Remote 2 should subsequently be re-created on the next packet from the
EKR at the lowest numbered slot that it occupies (here slot 1).

Fixes: f9036bd43602 ("HID: wacom: EKR: use devres groups to manage resources")
Cc: stable  #4.9
Signed-off-by: Aaron Armstrong Skomra 
Signed-off-by: Jiri Kosina

HID: wacom: Queue events with missing type/serial data for later processing

2017-11-21T12:04:35+00:00

Userspace expects to receive tool type and serial number information
for the active pen in the very first kernel report, if such data is
supported by the hardware. While this expectation is not an issue for
EMR devices, AES sensors will often send several packets worth of in-
range data before relaying type/serial data to the kernel. Sending this
data "late" can result in proximity-tracking issues by xf86-input-wacom,
or an inability to distinguish different pens by input-wacom.

Options for dealing with this situation include ignoring reports from
the tablet until we get the necessary data, or using the information
from the last-seen pen instead of the (eventual) real data. Neither
option is particularly attractive: the former results in truncated
strokes and the latter causes issues with switching between pens.

This commit instead opts to queue up events with missing information
until we receive a report which contains it. At that point, we can
update the driver's state variables (id[0] and serial[0]) and replay
the queued events.

Signed-off-by: Jason Gerecke 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

Merge branch 'for-4.15/wacom' into for-linus

2017-11-15T10:14:23+00:00

- High resolution mode for DEll canvas support, from Benjamin Tissoires
- A lot of improvements to pen handling in the Wacom driver, from Jason Gerecke

Signed-off-by: Jiri Kosina

HID: Wacom: switch Dell canvas into highres mode

2017-11-10T08:39:44+00:00

The Dell Canvas exports 2 collections for the Pen part. The only
difference between the 2 is that the default one has half the resolution
of the second one.

The Windows driver switches the tablet into the second mode, so we should
behave the same.

Signed-off-by: Benjamin Tissoires 
Reviewed-by: Jason Gerecke

HID: wacom: Always increment hdev refcount within wacom_get_hdev_data

2017-10-02T09:45:29+00:00

The wacom_get_hdev_data function is used to find and return a reference to
the "other half" of a Wacom device (i.e., the touch device associated with
a pen, or vice-versa). To ensure these references are properly accounted
for, the function is supposed to automatically increment the refcount before
returning. This was not done, however, for devices which have pen & touch
on different interfaces of the same USB device. This can lead to a WARNING
("refcount_t: underflow; use-after-free") when removing the module or device
as we call kref_put() more times than kref_get(). Triggering an "actual" use-
after-free would be difficult since both devices will disappear nearly-
simultaneously. To silence this warning and prevent the potential error, we
need to increment the refcount for all cases within wacom_get_hdev_data.

Fixes: 41372d5d40 ("HID: wacom: Augment 'oVid' and 'oPid' with heuristics for HID_GENERIC")
Cc:  # v4.9+
Signed-off-by: Jason Gerecke 
Reviewed-by: Ping Cheng 
Signed-off-by: Jiri Kosina

HID: wacom: leds: Don't try to control the EKR's read-only LEDs

2017-09-06T08:47:37+00:00

Commit a50aac7193f1 introduces 'led.groups' and adds EKR support
for these groups. However, unlike the other devices with LEDs,
the EKR's LEDs are read-only and we shouldn't attempt to control
them in wacom_led_control().

See bug: https://sourceforge.net/p/linuxwacom/bugs/342/

Fixes: a50aac7193f1 ("HID: wacom: leds: dynamically allocate LED groups")
Cc: stable      # 4.9
Signed-off-by: Aaron Armstrong Skomra 
Reviewed-by: Jason Gerecke 
Signed-off-by: Jiri Kosina

HID: wacom: Improve generic name generation

2017-07-27T13:14:29+00:00

The 'wacom_update_name' function is responsible for producing names for
the input device nodes based on the hardware device name. Commit f2209d4
added the ability to strip off prefixes like "Wacom Co.,Ltd." where the
prefix was immediately (and redundantly) followed by "Wacom". The
2nd-generation Intuos Pro 2 has such a prefix, but with a small error
(the period and comma are swapped) that prevents the existing code from
matching it. We're loath to extend the number of cases out endlessly and
so instead try to be smarter about name generation.

We observe that the cause of the redundant prefixes is HID combining the
manufacturer and product strings of USB devices together. By using the
original product name (with "Wacom" prefixed, if it does not already
exist in the string) we can bypass the gyrations to find and remove
redundant prefixes. Other devices either don't have a manufacturer string
that needs to be removed (Bluetooth, uhid) or should have their name
generated from scratch (I2C).

Signed-off-by: Jason Gerecke 
Acked-By: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

HID: wacom: Remove comparison of u8 mode with zero and simplify.

2017-07-20T13:43:01+00:00

Variable mode in method wacom_show_remote_mode() is defined as u8, thus
statement (mode >= 0) is always true and should be removed, simplifying
the logic.

Signed-off-by: Christos Gkekas 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

HID: wacom: Add ability to provide explicit battery status info

2017-05-05T19:46:10+00:00

At the moment, our driver relies on 'wacom_battery_get_property()' to
determine the most likely battery state (e.g charging, discharging, or
full) based on the information available. It is not always possible
for the function to properly determine this, however. For instance,
whenever an AES pen leaves proximity the battery state becomes
indeterminite. This commit adds the ability to provide it with explict
state information if desired. Whenever explicit state is not required
(the majority of circumstances), WACOM_POWER_SUPPLY_STATUS_AUTO can
be used in its place.

Three uses of explicit battery status are added: two wireless disconnect
paths and the AES case mentioned above.

Signed-off-by: Jason Gerecke 
Reviewed-by: Ping Cheng 
Signed-off-by: Jiri Kosina

Merge branches 'for-4.11/upstream-fixes', 'for-4.12/accutouch', 'for-4.12/cp2112', 'for-4.12/hid-core-null-state-handling', 'for-4.12/hiddev', 'for-4.12/i2c-hid', 'for-4.12/innomedia', 'for-4.12/logitech-hidpp-battery-power-supply', 'for-4.12/multitouch', 'for-4.12/nti', 'for-4.12/upstream' and 'for-4.12/wacom' into for-linus

2017-05-02T09:01:10+00:00