aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/input/rmi4/rmi_driver.c (follow)
AgeCommit message (Collapse)AuthorFilesLines
2018-02-01Merge branch 'next' into for-linusDmitry Torokhov1-7/+7
Prepare input updates for 4.16 merge window.
2018-01-22Input: synaptics-rmi4 - do not delete interrupt memory too earlyDmitry Torokhov1-7/+7
We want to free memory reserved for interrupt mask handling only after we free functions, as function drivers might want to mask interrupts. This is needed for the followup patch to the F03 that would implement unmasking and masking interrupts from the serio pass-through port open() and close() methods. Cc: stable@vger.kernel.org Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2018-01-18Input: synaptics-rmi4 - prevent UAF reported by KASANNick Desaulniers1-1/+3
KASAN found a UAF due to dangling pointer. As the report below says, rmi_f11_attention() accesses drvdata->attn_data.data, which was freed in rmi_irq_fn. [ 311.424062] BUG: KASAN: use-after-free in rmi_f11_attention+0x526/0x5e0 [rmi_core] [ 311.424067] Read of size 27 at addr ffff88041fd610db by task irq/131-i2c_hid/1162 [ 311.424075] CPU: 0 PID: 1162 Comm: irq/131-i2c_hid Not tainted 4.15.0-rc8+ #2 [ 311.424076] Hardware name: Razer Blade Stealth/Razer, BIOS 6.05 01/26/2017 [ 311.424078] Call Trace: [ 311.424086] dump_stack+0xae/0x12d [ 311.424090] ? _atomic_dec_and_lock+0x103/0x103 [ 311.424094] ? show_regs_print_info+0xa/0xa [ 311.424099] ? input_handle_event+0x10b/0x810 [ 311.424104] print_address_description+0x65/0x229 [ 311.424108] kasan_report.cold.5+0xa7/0x281 [ 311.424117] rmi_f11_attention+0x526/0x5e0 [rmi_core] [ 311.424123] ? memcpy+0x1f/0x50 [ 311.424132] ? rmi_f11_attention+0x526/0x5e0 [rmi_core] [ 311.424143] ? rmi_f11_probe+0x1e20/0x1e20 [rmi_core] [ 311.424153] ? rmi_process_interrupt_requests+0x220/0x2a0 [rmi_core] [ 311.424163] ? rmi_irq_fn+0x22c/0x270 [rmi_core] [ 311.424173] ? rmi_process_interrupt_requests+0x2a0/0x2a0 [rmi_core] [ 311.424177] ? free_irq+0xa0/0xa0 [ 311.424180] ? irq_finalize_oneshot.part.39+0xeb/0x180 [ 311.424190] ? rmi_process_interrupt_requests+0x2a0/0x2a0 [rmi_core] [ 311.424193] ? irq_thread_fn+0x3d/0x80 [ 311.424197] ? irq_finalize_oneshot.part.39+0x180/0x180 [ 311.424200] ? irq_thread+0x21d/0x290 [ 311.424203] ? irq_thread_check_affinity+0x170/0x170 [ 311.424207] ? remove_wait_queue+0x150/0x150 [ 311.424212] ? kasan_unpoison_shadow+0x30/0x40 [ 311.424214] ? __init_waitqueue_head+0xa0/0xd0 [ 311.424218] ? task_non_contending.cold.55+0x18/0x18 [ 311.424221] ? irq_forced_thread_fn+0xa0/0xa0 [ 311.424226] ? irq_thread_check_affinity+0x170/0x170 [ 311.424230] ? kthread+0x19e/0x1c0 [ 311.424233] ? kthread_create_worker_on_cpu+0xc0/0xc0 [ 311.424237] ? ret_from_fork+0x32/0x40 [ 311.424244] Allocated by task 899: [ 311.424249] kasan_kmalloc+0xbf/0xe0 [ 311.424252] __kmalloc_track_caller+0xd9/0x1f0 [ 311.424255] kmemdup+0x17/0x40 [ 311.424264] rmi_set_attn_data+0xa4/0x1b0 [rmi_core] [ 311.424269] rmi_raw_event+0x10b/0x1f0 [hid_rmi] [ 311.424278] hid_input_report+0x1a8/0x2c0 [hid] [ 311.424283] i2c_hid_irq+0x146/0x1d0 [i2c_hid] [ 311.424286] irq_thread_fn+0x3d/0x80 [ 311.424288] irq_thread+0x21d/0x290 [ 311.424291] kthread+0x19e/0x1c0 [ 311.424293] ret_from_fork+0x32/0x40 [ 311.424296] Freed by task 1162: [ 311.424300] kasan_slab_free+0x71/0xc0 [ 311.424303] kfree+0x90/0x190 [ 311.424311] rmi_irq_fn+0x1b2/0x270 [rmi_core] [ 311.424319] rmi_irq_fn+0x257/0x270 [rmi_core] [ 311.424322] irq_thread_fn+0x3d/0x80 [ 311.424324] irq_thread+0x21d/0x290 [ 311.424327] kthread+0x19e/0x1c0 [ 311.424330] ret_from_fork+0x32/0x40 [ 311.424334] The buggy address belongs to the object at ffff88041fd610c0 which belongs to the cache kmalloc-64 of size 64 [ 311.424340] The buggy address is located 27 bytes inside of 64-byte region [ffff88041fd610c0, ffff88041fd61100) [ 311.424344] The buggy address belongs to the page: [ 311.424348] page:ffffea00107f5840 count:1 mapcount:0 mapping: (null) index:0x0 [ 311.424353] flags: 0x17ffffc0000100(slab) [ 311.424358] raw: 0017ffffc0000100 0000000000000000 0000000000000000 00000001802a002a [ 311.424363] raw: dead000000000100 dead000000000200 ffff8804228036c0 0000000000000000 [ 311.424366] page dumped because: kasan: bad access detected [ 311.424369] Memory state around the buggy address: [ 311.424373] ffff88041fd60f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 311.424377] ffff88041fd61000: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb [ 311.424381] >ffff88041fd61080: fb fb fb fb fc fc fc fc fb fb fb fb fb fb fb fb [ 311.424384] ^ [ 311.424387] ffff88041fd61100: fc fc fc fc fb fb fb fb fb fb fb fb fc fc fc fc [ 311.424391] ffff88041fd61180: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb Cc: stable@vger.kernel.org Signed-off-by: Nick Desaulniers <nick.desaulniers@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-04-14Input: synaptics-rmi4 - use dev_driver_string when registering interruptNick Dyer1-1/+1
When IRQ handling was moved to rmi_driver in 3aeed5b the naming of the interrupt changed from "rmi4_i2c" to "2-0020" (or similar). This patch restores the previous behaviour and makes the interrupt easier to identify in /proc/interrupts. Signed-off-by: Nick Dyer <nick@shmanahar.org> Tested-by: Chris Healy <cphealy@gmail.com> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-04-03Input: synaptics-rmi4 - fix handling failures from rmi_enable_sensorDmitry Torokhov1-3/+8
If rmi_enable_sensor() fails in rmi_driver_probe(), we should not return immediately, but disable IRQs and tear down function list. Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-03-09Merge branch 'ib/4.10-sparse-keymap-managed' into nextDmitry Torokhov1-2/+2
This brings in version of sparse keymap code that uses managed memory.
2017-02-07Input: synaptics-rmi4 - fix error return code in rmi_probe_interrupts()Wei Yongjun1-1/+1
Fix to return error code -ENOMEM from the devm_kzalloc() error handling case instead of 0, as done elsewhere in this function. Fixes: 6bd0dcfacf28 ("Input: synaptics-rmi4 - factor out functions from probe") Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-02-06Merge branch 'synaptics-rmi4' into nextDmitry Torokhov1-3/+16
Bring in latest RMI4 support in preparation to the merge window.
2017-02-06Input: synaptics-rmi4 - add rmi_find_function()Benjamin Tissoires1-0/+13
If a function needs to communicate with an other, it's better to have a way to retrieve this other. Reviewed-by: Andrew Duggan <aduggan@synaptics.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-01-31Input: synaptics-rmi4 - add sysfs interfaces for hardware IDsNick Dyer1-1/+1
These attributes provide various bits of information which may be enumerated under the RMI4 protocol to user space. This may be useful for displaying the particular version which is in use, or selecting the correct firmware to flash. Signed-off-by: Nick Dyer <nick@shmanahar.org> Tested-by: Chris Healy <cphealy@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-01-31Input: synaptics-rmi4 - fix reversed conditions in enable/disable_irq_wakeChristophe JAILLET1-2/+2
These tests are reversed. A warning should be displayed if an error is returned, not on success. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2017-01-21Input: synaptics-rmi4 - use local variables consistentlyGuenter Roeck1-2/+2
If a function declares a variable to access a structure element, use it conssistently. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-12-17Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/inputLinus Torvalds1-101/+319
Pull input subsystem updates from Dmitry Torokhov: - updated support for Synaptics RMI4 devices, including support for SMBus controllers, firmware update support, sensor tuning, and PS/2 guest support - ALPS driver now supports tracksticks on SS5 controllers - i8042 now uses chassis info to skip selftest on Asus laptops as list of individual models became too unwieldy - miscellaneous fixes to other drivers * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (67 commits) Input: imx6ul_tsc - generalize the averaging property Input: drv260x - use generic device properties Input: drv260x - use temporary for &client->dev Input: drv260x - fix input device's parent assignment Input: synaptics-rmi4 - add support for F34 V7 bootloader Input: drv260x - fix initializing overdrive voltage Input: ALPS - fix protcol -> protocol Input: i8042 - comment #else/#endif of CONFIG_PNP Input: lpc32xx-keys - fix invalid error handling of a requested irq Input: synaptics-rmi4 - fix debug for sensor clip Input: synaptics-rmi4 - store the attn data in the driver Input: synaptics-rmi4 - allow to add attention data Input: synaptics-rmi4 - f03 - grab data passed by transport device Input: synaptics-rmi4 - add support for F03 Input: imx6ul_tsc - convert int to u32 Input: imx6ul_tsc - add mask when set REG_ADC_CFG Input: synaptics-rmi4 - have only one struct platform data Input: synaptics-rmi4 - remove EXPORT_SYMBOL_GPL for internal functions Input: synaptics-rmi4 - remove mutex calls while updating the firmware Input: drv2667 - fix misuse of regmap_update_bits ...
2016-12-12Input: synaptics-rmi4 - add support for F34 V7 bootloaderNick Dyer1-23/+33
Port firmware update code from Samsung Galaxy S7 driver into mainline framework. This patch has been tested on Synaptics S7813. Signed-off-by: Nick Dyer <nick@shmanahar.org> Tested-by: Chris Healy <cphealy@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-12-02Input: synaptics-rmi4 - store the attn data in the driverBenjamin Tissoires1-3/+2
Now that we have a proper API to set the attention data, there is no point in keeping it in the transport driver. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Reviewed-by: Andrew Duggan <aduggan@synaptics.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-12-02Input: synaptics-rmi4 - allow to add attention dataBenjamin Tissoires1-2/+47
The HID implementation of RMI4 provides the data during the interrupt (in the input report). We need to provide a way for this transport driver to provide the attention data while calling an IRQ. We use a fifo in rmi_core to not lose any incoming event. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Reviewed-by: Andrew Duggan <aduggan@synaptics.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-11-30Input: synaptics-rmi4 - remove EXPORT_SYMBOL_GPL for internal functionsBenjamin Tissoires1-13/+2
those functions should not be used outside of rmi_core.ko. There is no point in exporting them to the world. It looks like rmi_read_pdt_entry() should be static too. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-11-30Input: synaptics-rmi4 - remove mutex calls while updating the firmwareBenjamin Tissoires1-32/+8
This partially reverts commit 29fd0ec2bdbe ("Input: synaptics-rmi4 - add support for F34 device reflash") irq_mutex should be used only to protect data->current_irq_mask, not preventing incoming input to be processed while the upgrade of the firmware is happening. We can simply disable the irqs when we don't want them to interfere with the upgrade process. Tested on S7300 and S7800 (with F34 v7 patch added) Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Nick Dyer <nick@shmanahar.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-11-30Input: synaptics-rmi4 - add rmi_enable/disable_irqBenjamin Tissoires1-19/+64
Set the .enabled boolean and trigger an event processing when enabling for edge-triggered systems. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-11-22Input: synaptics-rmi4 - add support for F34 device reflashNick Dyer1-31/+74
Add support for updating firmware, triggered by a sysfs attribute. This patch has been tested on Synaptics S7300. Signed-off-by: Nick Dyer <nick@shmanahar.org> Tested-by: Chris Healy <cphealy@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-11-08Input: synaptics-rmi4 - move IRQ handling to rmi_driverBjorn Andersson1-4/+69
The attn IRQ is related to the chip, rather than the transport, so move all handling of interrupts to the core driver. This also makes sure that there are no races between interrupts and availability of the resources used by the core driver. Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-11-08Input: synaptics-rmi4 - add a couple of debug linesNick Dyer1-0/+1
Signed-off-by: Nick Dyer <nick@shmanahar.org> Tested-by: Chris Healy <cphealy@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-11-08Input: synaptics-rmi4 - factor out functions from probeNick Dyer1-53/+86
Signed-off-by: Nick Dyer <nick@shmanahar.org> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Tested-by: Chris Healy <cphealy@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-11-08Input: synaptics-rmi4 - stop scanning PDT after two empty pagesNick Dyer1-2/+14
We have encountered some RMI4 firmwares where there are blank pages in between PDT pages which contain functions. This change makes them correctly enumerate all functions on the device. Tested on S7817 (has empty page 2). Signed-off-by: Nick Dyer <nick@shmanahar.org> [Tested successfully on S7817 and S7300 Synaptics touch controllers] Tested-by: Chris Healy <cphealy@gmail.com> Reviewed-by: Andrew Duggan <aduggan@synaptics.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-10-11treewide: remove redundant #include <linux/kconfig.h>Masahiro Yamada1-1/+0
Kernel source files need not include <linux/kconfig.h> explicitly because the top Makefile forces to include it with: -include $(srctree)/include/linux/kconfig.h This commit removes explicit includes except the following: * arch/s390/include/asm/facilities_src.h * tools/testing/radix-tree/linux/kernel.h These two are used for host programs. Link: http://lkml.kernel.org/r/1473656164-11929-1-git-send-email-yamada.masahiro@socionext.com Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-08-22Input: synaptics-rmi4 - fix register descriptor subpacket map constructionAndrew Duggan1-1/+2
The map_offset variable is specific to the register and needs to be reset in the loop. Otherwise, subsequent register's subpacket maps will have their bits set at the wrong index. Signed-off-by: Andrew Duggan <aduggan@synaptics.com> Tested-by: Nitin Chaudhary <nitinchaudhary1289@gmail.com> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-03-17Input: synaptics-rmi4 - remove check of Non-NULL arrayAndrew Duggan1-3/+2
Originally the irq_mask member of rmi_function was a pointer. Then it was switched to being a zero length array. However, the checks for a NULL pointer where not removed. Signed-off-by: Andrew Duggan <aduggan@synaptics.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-03-10Input: synaptics-rmi4 - add device tree support for RMI4 I2C devicesAndrew Duggan1-0/+28
Add devicetree binding for I2C devices and add bindings for optional parameters in the function drivers. Parameters for function drivers are defined in child nodes for each of the functions. Signed-off-by: Andrew Duggan <aduggan@synaptics.com> Acked-by: Rob Herring <robh@kernel.org> Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Tested-by: Linus Walleij <linus.walleij@linaro.org> Tested-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2016-03-10Input: synaptics-rmi4 - add support for Synaptics RMI4 devicesAndrew Duggan1-0/+1027
Synaptics uses the Register Mapped Interface (RMI) protocol as a communications interface for their devices. This driver adds the core functionality needed to interface with RMI4 devices. RMI devices can be connected to the host via several transport protocols and can supports a wide variety of functionality defined by RMI functions. Support for transport protocols and RMI functions are implemented in individual drivers. The RMI4 core driver uses a bus architecture to facilitate the various combinations of transport and function drivers needed by a particular device. Signed-off-by: Andrew Duggan <aduggan@synaptics.com> Signed-off-by: Christopher Heiny <cheiny@synaptics.com> Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Tested-by: Linus Walleij <linus.walleij@linaro.org> Tested-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.