aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--Documentation/hid/uhid.txt179
-rw-r--r--drivers/hid/Kconfig11
-rw-r--r--drivers/hid/Makefile1
-rw-r--r--drivers/hid/hid-core.c4
-rw-r--r--drivers/hid/hid-holtek-mouse.c4
-rw-r--r--drivers/hid/hid-ids.h7
-rw-r--r--drivers/hid/hid-input.c6
-rw-r--r--drivers/hid/hid-logitech-dj.c35
-rw-r--r--drivers/hid/hid-penmount.c49
-rw-r--r--drivers/hid/hid-picolcd_core.c4
-rw-r--r--drivers/hid/hid-rmi.c44
-rw-r--r--drivers/hid/hid-sensor-hub.c3
-rw-r--r--drivers/hid/hid-sony.c100
-rw-r--r--drivers/hid/hid-thingm.c7
-rw-r--r--drivers/hid/uhid.c394
-rw-r--r--drivers/hid/usbhid/hid-core.c60
-rw-r--r--drivers/hid/usbhid/hid-quirks.c3
-rw-r--r--include/linux/hid.h1
-rw-r--r--include/uapi/linux/uhid.h120
19 files changed, 637 insertions, 395 deletions
diff --git a/Documentation/hid/uhid.txt b/Documentation/hid/uhid.txt
index 54c8f9706a95..c8656dd029a9 100644
--- a/Documentation/hid/uhid.txt
+++ b/Documentation/hid/uhid.txt
@@ -1,28 +1,13 @@
1 UHID - User-space I/O driver support for HID subsystem 1 UHID - User-space I/O driver support for HID subsystem
2 ======================================================== 2 ========================================================
3 3
4The HID subsystem needs two kinds of drivers. In this document we call them: 4UHID allows user-space to implement HID transport drivers. Please see
5hid-transport.txt for an introduction into HID transport drivers. This document
6relies heavily on the definitions declared there.
5 7
6 1. The "HID I/O Driver" is the driver that performs raw data I/O to the 8With UHID, a user-space transport driver can create kernel hid-devices for each
7 low-level device. Internally, they register an hid_ll_driver structure with 9device connected to the user-space controlled bus. The UHID API defines the I/O
8 the HID core. They perform device setup, read raw data from the device and 10events provided from the kernel to user-space and vice versa.
9 push it into the HID subsystem and they provide a callback so the HID
10 subsystem can send data to the device.
11
12 2. The "HID Device Driver" is the driver that parses HID reports and reacts on
13 them. There are generic drivers like "generic-usb" and "generic-bluetooth"
14 which adhere to the HID specification and provide the standardizes features.
15 But there may be special drivers and quirks for each non-standard device out
16 there. Internally, they use the hid_driver structure.
17
18Historically, the USB stack was the first subsystem to provide an HID I/O
19Driver. However, other standards like Bluetooth have adopted the HID specs and
20may provide HID I/O Drivers, too. The UHID driver allows to implement HID I/O
21Drivers in user-space and feed the data into the kernel HID-subsystem.
22
23This allows user-space to operate on the same level as USB-HID, Bluetooth-HID
24and similar. It does not provide a way to write HID Device Drivers, though. Use
25hidraw for this purpose.
26 11
27There is an example user-space application in ./samples/uhid/uhid-example.c 12There is an example user-space application in ./samples/uhid/uhid-example.c
28 13
@@ -42,8 +27,9 @@ by setting O_NONBLOCK.
42struct uhid_event { 27struct uhid_event {
43 __u32 type; 28 __u32 type;
44 union { 29 union {
45 struct uhid_create_req create; 30 struct uhid_create2_req create2;
46 struct uhid_data_req data; 31 struct uhid_output_req output;
32 struct uhid_input2_req input2;
47 ... 33 ...
48 } u; 34 } u;
49}; 35};
@@ -54,8 +40,11 @@ multiple write()'s. A single event must always be sent as a whole. Furthermore,
54only a single event can be sent per read() or write(). Pending data is ignored. 40only a single event can be sent per read() or write(). Pending data is ignored.
55If you want to handle multiple events in a single syscall, then use vectored 41If you want to handle multiple events in a single syscall, then use vectored
56I/O with readv()/writev(). 42I/O with readv()/writev().
43The "type" field defines the payload. For each type, there is a
44payload-structure available in the union "u" (except for empty payloads). This
45payload contains management and/or device data.
57 46
58The first thing you should do is sending an UHID_CREATE event. This will 47The first thing you should do is sending an UHID_CREATE2 event. This will
59register the device. UHID will respond with an UHID_START event. You can now 48register the device. UHID will respond with an UHID_START event. You can now
60start sending data to and reading data from UHID. However, unless UHID sends the 49start sending data to and reading data from UHID. However, unless UHID sends the
61UHID_OPEN event, the internally attached HID Device Driver has no user attached. 50UHID_OPEN event, the internally attached HID Device Driver has no user attached.
@@ -69,12 +58,20 @@ ref-counting for you.
69You may decide to ignore UHID_OPEN/UHID_CLOSE, though. I/O is allowed even 58You may decide to ignore UHID_OPEN/UHID_CLOSE, though. I/O is allowed even
70though the device may have no users. 59though the device may have no users.
71 60
72If you want to send data to the HID subsystem, you send an HID_INPUT event with 61If you want to send data on the interrupt channel to the HID subsystem, you send
73your raw data payload. If the kernel wants to send data to the device, you will 62an HID_INPUT2 event with your raw data payload. If the kernel wants to send data
74read an UHID_OUTPUT or UHID_OUTPUT_EV event. 63on the interrupt channel to the device, you will read an UHID_OUTPUT event.
64Data requests on the control channel are currently limited to GET_REPORT and
65SET_REPORT (no other data reports on the control channel are defined so far).
66Those requests are always synchronous. That means, the kernel sends
67UHID_GET_REPORT and UHID_SET_REPORT events and requires you to forward them to
68the device on the control channel. Once the device responds, you must forward
69the response via UHID_GET_REPORT_REPLY and UHID_SET_REPORT_REPLY to the kernel.
70The kernel blocks internal driver-execution during such round-trips (times out
71after a hard-coded period).
75 72
76If your device disconnects, you should send an UHID_DESTROY event. This will 73If your device disconnects, you should send an UHID_DESTROY event. This will
77unregister the device. You can now send UHID_CREATE again to register a new 74unregister the device. You can now send UHID_CREATE2 again to register a new
78device. 75device.
79If you close() the fd, the device is automatically unregistered and destroyed 76If you close() the fd, the device is automatically unregistered and destroyed
80internally. 77internally.
@@ -82,73 +79,79 @@ internally.
82write() 79write()
83------- 80-------
84write() allows you to modify the state of the device and feed input data into 81write() allows you to modify the state of the device and feed input data into
85the kernel. The following types are supported: UHID_CREATE, UHID_DESTROY and 82the kernel. The kernel will parse the event immediately and if the event ID is
86UHID_INPUT. The kernel will parse the event immediately and if the event ID is
87not supported, it will return -EOPNOTSUPP. If the payload is invalid, then 83not supported, it will return -EOPNOTSUPP. If the payload is invalid, then
88-EINVAL is returned, otherwise, the amount of data that was read is returned and 84-EINVAL is returned, otherwise, the amount of data that was read is returned and
89the request was handled successfully. 85the request was handled successfully. O_NONBLOCK does not affect write() as
86writes are always handled immediately in a non-blocking fashion. Future requests
87might make use of O_NONBLOCK, though.
90 88
91 UHID_CREATE: 89 UHID_CREATE2:
92 This creates the internal HID device. No I/O is possible until you send this 90 This creates the internal HID device. No I/O is possible until you send this
93 event to the kernel. The payload is of type struct uhid_create_req and 91 event to the kernel. The payload is of type struct uhid_create2_req and
94 contains information about your device. You can start I/O now. 92 contains information about your device. You can start I/O now.
95 93
96 UHID_CREATE2:
97 Same as UHID_CREATE, but the HID report descriptor data (rd_data) is an array
98 inside struct uhid_create2_req, instead of a pointer to a separate array.
99 Enables use from languages that don't support pointers, e.g. Python.
100
101 UHID_DESTROY: 94 UHID_DESTROY:
102 This destroys the internal HID device. No further I/O will be accepted. There 95 This destroys the internal HID device. No further I/O will be accepted. There
103 may still be pending messages that you can receive with read() but no further 96 may still be pending messages that you can receive with read() but no further
104 UHID_INPUT events can be sent to the kernel. 97 UHID_INPUT events can be sent to the kernel.
105 You can create a new device by sending UHID_CREATE again. There is no need to 98 You can create a new device by sending UHID_CREATE2 again. There is no need to
106 reopen the character device. 99 reopen the character device.
107 100
108 UHID_INPUT:
109 You must send UHID_CREATE before sending input to the kernel! This event
110 contains a data-payload. This is the raw data that you read from your device.
111 The kernel will parse the HID reports and react on it.
112
113 UHID_INPUT2: 101 UHID_INPUT2:
114 Same as UHID_INPUT, but the data array is the last field of uhid_input2_req. 102 You must send UHID_CREATE2 before sending input to the kernel! This event
115 Enables userspace to write only the required bytes to kernel (ev.type + 103 contains a data-payload. This is the raw data that you read from your device
116 ev.u.input2.size + the part of the data array that matters), instead of 104 on the interrupt channel. The kernel will parse the HID reports.
117 the entire struct uhid_input2_req. 105
118 106 UHID_GET_REPORT_REPLY:
119 UHID_FEATURE_ANSWER: 107 If you receive a UHID_GET_REPORT request you must answer with this request.
120 If you receive a UHID_FEATURE request you must answer with this request. You 108 You must copy the "id" field from the request into the answer. Set the "err"
121 must copy the "id" field from the request into the answer. Set the "err" field 109 field to 0 if no error occurred or to EIO if an I/O error occurred.
122 to 0 if no error occurred or to EIO if an I/O error occurred.
123 If "err" is 0 then you should fill the buffer of the answer with the results 110 If "err" is 0 then you should fill the buffer of the answer with the results
124 of the feature request and set "size" correspondingly. 111 of the GET_REPORT request and set "size" correspondingly.
112
113 UHID_SET_REPORT_REPLY:
114 This is the SET_REPORT equivalent of UHID_GET_REPORT_REPLY. Unlike GET_REPORT,
115 SET_REPORT never returns a data buffer, therefore, it's sufficient to set the
116 "id" and "err" fields correctly.
125 117
126read() 118read()
127------ 119------
128read() will return a queued output report. These output reports can be of type 120read() will return a queued output report. No reaction is required to any of
129UHID_START, UHID_STOP, UHID_OPEN, UHID_CLOSE, UHID_OUTPUT or UHID_OUTPUT_EV. No 121them but you should handle them according to your needs.
130reaction is required to any of them but you should handle them according to your
131needs. Only UHID_OUTPUT and UHID_OUTPUT_EV have payloads.
132 122
133 UHID_START: 123 UHID_START:
134 This is sent when the HID device is started. Consider this as an answer to 124 This is sent when the HID device is started. Consider this as an answer to
135 UHID_CREATE. This is always the first event that is sent. 125 UHID_CREATE2. This is always the first event that is sent. Note that this
126 event might not be available immediately after write(UHID_CREATE2) returns.
127 Device drivers might required delayed setups.
128 This event contains a payload of type uhid_start_req. The "dev_flags" field
129 describes special behaviors of a device. The following flags are defined:
130 UHID_DEV_NUMBERED_FEATURE_REPORTS:
131 UHID_DEV_NUMBERED_OUTPUT_REPORTS:
132 UHID_DEV_NUMBERED_INPUT_REPORTS:
133 Each of these flags defines whether a given report-type uses numbered
134 reports. If numbered reports are used for a type, all messages from
135 the kernel already have the report-number as prefix. Otherwise, no
136 prefix is added by the kernel.
137 For messages sent by user-space to the kernel, you must adjust the
138 prefixes according to these flags.
136 139
137 UHID_STOP: 140 UHID_STOP:
138 This is sent when the HID device is stopped. Consider this as an answer to 141 This is sent when the HID device is stopped. Consider this as an answer to
139 UHID_DESTROY. 142 UHID_DESTROY.
140 If the kernel HID device driver closes the device manually (that is, you 143 If you didn't destroy your device via UHID_DESTROY, but the kernel sends an
141 didn't send UHID_DESTROY) then you should consider this device closed and send 144 UHID_STOP event, this should usually be ignored. It means that the kernel
142 an UHID_DESTROY event. You may want to reregister your device, though. This is 145 reloaded/changed the device driver loaded on your HID device (or some other
143 always the last message that is sent to you unless you reopen the device with 146 maintenance actions happened).
144 UHID_CREATE. 147 You can usually ignored any UHID_STOP events safely.
145 148
146 UHID_OPEN: 149 UHID_OPEN:
147 This is sent when the HID device is opened. That is, the data that the HID 150 This is sent when the HID device is opened. That is, the data that the HID
148 device provides is read by some other process. You may ignore this event but 151 device provides is read by some other process. You may ignore this event but
149 it is useful for power-management. As long as you haven't received this event 152 it is useful for power-management. As long as you haven't received this event
150 there is actually no other process that reads your data so there is no need to 153 there is actually no other process that reads your data so there is no need to
151 send UHID_INPUT events to the kernel. 154 send UHID_INPUT2 events to the kernel.
152 155
153 UHID_CLOSE: 156 UHID_CLOSE:
154 This is sent when there are no more processes which read the HID data. It is 157 This is sent when there are no more processes which read the HID data. It is
@@ -156,27 +159,29 @@ needs. Only UHID_OUTPUT and UHID_OUTPUT_EV have payloads.
156 159
157 UHID_OUTPUT: 160 UHID_OUTPUT:
158 This is sent if the HID device driver wants to send raw data to the I/O 161 This is sent if the HID device driver wants to send raw data to the I/O
159 device. You should read the payload and forward it to the device. The payload 162 device on the interrupt channel. You should read the payload and forward it to
160 is of type "struct uhid_data_req". 163 the device. The payload is of type "struct uhid_data_req".
161 This may be received even though you haven't received UHID_OPEN, yet. 164 This may be received even though you haven't received UHID_OPEN, yet.
162 165
163 UHID_OUTPUT_EV (obsolete): 166 UHID_GET_REPORT:
164 Same as UHID_OUTPUT but this contains a "struct input_event" as payload. This 167 This event is sent if the kernel driver wants to perform a GET_REPORT request
165 is called for force-feedback, LED or similar events which are received through 168 on the control channeld as described in the HID specs. The report-type and
166 an input device by the HID subsystem. You should convert this into raw reports 169 report-number are available in the payload.
167 and send them to your device similar to events of type UHID_OUTPUT. 170 The kernel serializes GET_REPORT requests so there will never be two in
168 This is no longer sent by newer kernels. Instead, HID core converts it into a 171 parallel. However, if you fail to respond with a UHID_GET_REPORT_REPLY, the
169 raw output report and sends it via UHID_OUTPUT. 172 request might silently time out.
170 173 Once you read a GET_REPORT request, you shall forward it to the hid device and
171 UHID_FEATURE: 174 remember the "id" field in the payload. Once your hid device responds to the
172 This event is sent if the kernel driver wants to perform a feature request as 175 GET_REPORT (or if it fails), you must send a UHID_GET_REPORT_REPLY to the
173 described in the HID specs. The report-type and report-number are available in 176 kernel with the exact same "id" as in the request. If the request already
174 the payload. 177 timed out, the kernel will ignore the response silently. The "id" field is
175 The kernel serializes feature requests so there will never be two in parallel. 178 never re-used, so conflicts cannot happen.
176 However, if you fail to respond with a UHID_FEATURE_ANSWER in a time-span of 5 179
177 seconds, then the requests will be dropped and a new one might be sent. 180 UHID_SET_REPORT:
178 Therefore, the payload also contains an "id" field that identifies every 181 This is the SET_REPORT equivalent of UHID_GET_REPORT. On receipt, you shall
179 request. 182 send a SET_REPORT request to your hid device. Once it replies, you must tell
180 183 the kernel about it via UHID_SET_REPORT_REPLY.
181Document by: 184 The same restrictions as for UHID_GET_REPORT apply.
182 David Herrmann <dh.herrmann@googlemail.com> 185
186----------------------------------------------------
187Written 2012, David Herrmann <dh.herrmann@gmail.com>
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index c18d5d71062d..f42df4dd58d2 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -530,6 +530,17 @@ config PANTHERLORD_FF
530 Say Y here if you have a PantherLord/GreenAsia based game controller 530 Say Y here if you have a PantherLord/GreenAsia based game controller
531 or adapter and want to enable force feedback support for it. 531 or adapter and want to enable force feedback support for it.
532 532
533config HID_PENMOUNT
534 tristate "Penmount touch device"
535 depends on USB_HID
536 ---help---
537 This selects a driver for the PenMount 6000 touch controller.
538
539 The driver works around a problem in the report descript allowing
540 the userspace to touch events instead of mouse events.
541
542 Say Y here if you have a Penmount based touch controller.
543
533config HID_PETALYNX 544config HID_PETALYNX
534 tristate "Petalynx Maxter remote control" 545 tristate "Petalynx Maxter remote control"
535 depends on HID 546 depends on HID
diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
index 4dbac7f8530c..e2850d8af9ca 100644
--- a/drivers/hid/Makefile
+++ b/drivers/hid/Makefile
@@ -71,6 +71,7 @@ obj-$(CONFIG_HID_NTRIG) += hid-ntrig.o
71obj-$(CONFIG_HID_ORTEK) += hid-ortek.o 71obj-$(CONFIG_HID_ORTEK) += hid-ortek.o
72obj-$(CONFIG_HID_PRODIKEYS) += hid-prodikeys.o 72obj-$(CONFIG_HID_PRODIKEYS) += hid-prodikeys.o
73obj-$(CONFIG_HID_PANTHERLORD) += hid-pl.o 73obj-$(CONFIG_HID_PANTHERLORD) += hid-pl.o
74obj-$(CONFIG_HID_PENMOUNT) += hid-penmount.o
74obj-$(CONFIG_HID_PETALYNX) += hid-petalynx.o 75obj-$(CONFIG_HID_PETALYNX) += hid-petalynx.o
75obj-$(CONFIG_HID_PICOLCD) += hid-picolcd.o 76obj-$(CONFIG_HID_PICOLCD) += hid-picolcd.o
76hid-picolcd-y += hid-picolcd_core.o 77hid-picolcd-y += hid-picolcd_core.o
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 583344dba3c6..73bd9e2e42bc 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -52,7 +52,7 @@ EXPORT_SYMBOL_GPL(hid_debug);
52 52
53static int hid_ignore_special_drivers = 0; 53static int hid_ignore_special_drivers = 0;
54module_param_named(ignore_special_drivers, hid_ignore_special_drivers, int, 0600); 54module_param_named(ignore_special_drivers, hid_ignore_special_drivers, int, 0600);
55MODULE_PARM_DESC(debug, "Ignore any special drivers and handle all devices by generic driver"); 55MODULE_PARM_DESC(ignore_special_drivers, "Ignore any special drivers and handle all devices by generic driver");
56 56
57/* 57/*
58 * Register a new report for a device. 58 * Register a new report for a device.
@@ -1796,6 +1796,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
1796 { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A070) }, 1796 { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A070) },
1797 { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072) }, 1797 { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072) },
1798 { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) }, 1798 { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
1799 { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2) },
1799 { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_TABLET) }, 1800 { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_TABLET) },
1800 { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) }, 1801 { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
1801 { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) }, 1802 { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) },
@@ -1883,6 +1884,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
1883 { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18) }, 1884 { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18) },
1884 { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_PKB1700) }, 1885 { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_PKB1700) },
1885 { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) }, 1886 { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) },
1887 { HID_USB_DEVICE(USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_6000) },
1886 { HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) }, 1888 { HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) },
1887 { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_KEYBOARD) }, 1889 { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_KEYBOARD) },
1888#if IS_ENABLED(CONFIG_HID_ROCCAT) 1890#if IS_ENABLED(CONFIG_HID_ROCCAT)
diff --git a/drivers/hid/hid-holtek-mouse.c b/drivers/hid/hid-holtek-mouse.c
index d60fbd0adc0c..78b3a0c76775 100644
--- a/drivers/hid/hid-holtek-mouse.c
+++ b/drivers/hid/hid-holtek-mouse.c
@@ -29,6 +29,7 @@
29 * and Zalman ZM-GM1 29 * and Zalman ZM-GM1
30 * - USB ID 04d9:a081, sold as SHARKOON DarkGlider Gaming mouse 30 * - USB ID 04d9:a081, sold as SHARKOON DarkGlider Gaming mouse
31 * - USB ID 04d9:a072, sold as LEETGION Hellion Gaming Mouse 31 * - USB ID 04d9:a072, sold as LEETGION Hellion Gaming Mouse
32 * - USB ID 04d9:a0c2, sold as ETEKCITY Scroll T-140 Gaming Mouse
32 */ 33 */
33 34
34static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc, 35static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
@@ -42,6 +43,7 @@ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
42 switch (hdev->product) { 43 switch (hdev->product) {
43 case USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067: 44 case USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067:
44 case USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072: 45 case USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072:
46 case USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2:
45 if (*rsize >= 122 && rdesc[115] == 0xff && rdesc[116] == 0x7f 47 if (*rsize >= 122 && rdesc[115] == 0xff && rdesc[116] == 0x7f
46 && rdesc[120] == 0xff && rdesc[121] == 0x7f) { 48 && rdesc[120] == 0xff && rdesc[121] == 0x7f) {
47 hid_info(hdev, "Fixing up report descriptor\n"); 49 hid_info(hdev, "Fixing up report descriptor\n");
@@ -74,6 +76,8 @@ static const struct hid_device_id holtek_mouse_devices[] = {
74 USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072) }, 76 USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072) },
75 { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, 77 { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
76 USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) }, 78 USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
79 { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
80 USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2) },
77 { } 81 { }
78}; 82};
79MODULE_DEVICE_TABLE(hid, holtek_mouse_devices); 83MODULE_DEVICE_TABLE(hid, holtek_mouse_devices);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 25cd674d6064..cd9c9e96cf0e 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -296,6 +296,9 @@
296#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7 296#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7
297#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001 297#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
298 298
299#define USB_VENDOR_ID_ELAN 0x04f3
300#define USB_DEVICE_ID_ELAN_TOUCHSCREEN 0x0089
301
299#define USB_VENDOR_ID_ELECOM 0x056e 302#define USB_VENDOR_ID_ELECOM 0x056e
300#define USB_DEVICE_ID_ELECOM_BM084 0x0061 303#define USB_DEVICE_ID_ELECOM_BM084 0x0061
301 304
@@ -479,6 +482,7 @@
479#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A070 0xa070 482#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A070 0xa070
480#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072 0xa072 483#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072 0xa072
481#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081 0xa081 484#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081 0xa081
485#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2 0xa0c2
482#define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096 0xa096 486#define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096 0xa096
483 487
484#define USB_VENDOR_ID_IMATION 0x0718 488#define USB_VENDOR_ID_IMATION 0x0718
@@ -722,6 +726,7 @@
722#define USB_DEVICE_ID_PENMOUNT_PCI 0x3500 726#define USB_DEVICE_ID_PENMOUNT_PCI 0x3500
723#define USB_DEVICE_ID_PENMOUNT_1610 0x1610 727#define USB_DEVICE_ID_PENMOUNT_1610 0x1610
724#define USB_DEVICE_ID_PENMOUNT_1640 0x1640 728#define USB_DEVICE_ID_PENMOUNT_1640 0x1640
729#define USB_DEVICE_ID_PENMOUNT_6000 0x6000
725 730
726#define USB_VENDOR_ID_PETALYNX 0x18b1 731#define USB_VENDOR_ID_PETALYNX 0x18b1
727#define USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE 0x0037 732#define USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE 0x0037
@@ -733,6 +738,8 @@
733#define USB_DEVICE_ID_PI_ENGINEERING_VEC_USB_FOOTPEDAL 0xff 738#define USB_DEVICE_ID_PI_ENGINEERING_VEC_USB_FOOTPEDAL 0xff
734 739
735#define USB_VENDOR_ID_PIXART 0x093a 740#define USB_VENDOR_ID_PIXART 0x093a
741#define USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE_ID2 0x0137
742#define USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE 0x2510
736#define USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN 0x8001 743#define USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN 0x8001
737#define USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1 0x8002 744#define USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1 0x8002
738#define USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2 0x8003 745#define USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2 0x8003
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 2619f7f4517a..2df7fddbd119 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -599,6 +599,12 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
599 /* These usage IDs map directly to the usage codes. */ 599 /* These usage IDs map directly to the usage codes. */
600 case HID_GD_X: case HID_GD_Y: case HID_GD_Z: 600 case HID_GD_X: case HID_GD_Y: case HID_GD_Z:
601 case HID_GD_RX: case HID_GD_RY: case HID_GD_RZ: 601 case HID_GD_RX: case HID_GD_RY: case HID_GD_RZ:
602 if (field->flags & HID_MAIN_ITEM_RELATIVE)
603 map_rel(usage->hid & 0xf);
604 else
605 map_abs_clear(usage->hid & 0xf);
606 break;
607
602 case HID_GD_SLIDER: case HID_GD_DIAL: case HID_GD_WHEEL: 608 case HID_GD_SLIDER: case HID_GD_DIAL: case HID_GD_WHEEL:
603 if (field->flags & HID_MAIN_ITEM_RELATIVE) 609 if (field->flags & HID_MAIN_ITEM_RELATIVE)
604 map_rel(usage->hid & 0xf); 610 map_rel(usage->hid & 0xf);
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 9bf8637747a5..71f569292cab 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -385,18 +385,6 @@ static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,
385 385
386 djdev = djrcv_dev->paired_dj_devices[dj_report->device_index]; 386 djdev = djrcv_dev->paired_dj_devices[dj_report->device_index];
387 387
388 if (!djdev) {
389 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
390 " is NULL, index %d\n", dj_report->device_index);
391 kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
392
393 if (schedule_work(&djrcv_dev->work) == 0) {
394 dbg_hid("%s: did not schedule the work item, was already "
395 "queued\n", __func__);
396 }
397 return;
398 }
399
400 memset(reportbuffer, 0, sizeof(reportbuffer)); 388 memset(reportbuffer, 0, sizeof(reportbuffer));
401 389
402 for (i = 0; i < NUMBER_OF_HID_REPORTS; i++) { 390 for (i = 0; i < NUMBER_OF_HID_REPORTS; i++) {
@@ -421,18 +409,6 @@ static void logi_dj_recv_forward_report(struct dj_receiver_dev *djrcv_dev,
421 409
422 dj_device = djrcv_dev->paired_dj_devices[dj_report->device_index]; 410 dj_device = djrcv_dev->paired_dj_devices[dj_report->device_index];
423 411
424 if (dj_device == NULL) {
425 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
426 " is NULL, index %d\n", dj_report->device_index);
427 kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
428
429 if (schedule_work(&djrcv_dev->work) == 0) {
430 dbg_hid("%s: did not schedule the work item, was already "
431 "queued\n", __func__);
432 }
433 return;
434 }
435
436 if ((dj_report->report_type > ARRAY_SIZE(hid_reportid_size_map) - 1) || 412 if ((dj_report->report_type > ARRAY_SIZE(hid_reportid_size_map) - 1) ||
437 (hid_reportid_size_map[dj_report->report_type] == 0)) { 413 (hid_reportid_size_map[dj_report->report_type] == 0)) {
438 dbg_hid("invalid report type:%x\n", dj_report->report_type); 414 dbg_hid("invalid report type:%x\n", dj_report->report_type);
@@ -701,8 +677,17 @@ static int logi_dj_raw_event(struct hid_device *hdev,
701 } 677 }
702 678
703 spin_lock_irqsave(&djrcv_dev->lock, flags); 679 spin_lock_irqsave(&djrcv_dev->lock, flags);
680
681 if (!djrcv_dev->paired_dj_devices[dj_report->device_index]) {
682 /* received an event for an unknown device, bail out */
683 logi_dj_recv_queue_notification(djrcv_dev, dj_report);
684 goto out;
685 }
686
704 switch (dj_report->report_type) { 687 switch (dj_report->report_type) {
705 case REPORT_TYPE_NOTIF_DEVICE_PAIRED: 688 case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
689 /* pairing notifications are handled above the switch */
690 break;
706 case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED: 691 case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
707 logi_dj_recv_queue_notification(djrcv_dev, dj_report); 692 logi_dj_recv_queue_notification(djrcv_dev, dj_report);
708 break; 693 break;
@@ -715,6 +700,8 @@ static int logi_dj_raw_event(struct hid_device *hdev,
715 default: 700 default:
716 logi_dj_recv_forward_report(djrcv_dev, dj_report); 701 logi_dj_recv_forward_report(djrcv_dev, dj_report);
717 } 702 }
703
704out:
718 spin_unlock_irqrestore(&djrcv_dev->lock, flags); 705 spin_unlock_irqrestore(&djrcv_dev->lock, flags);
719 706
720 return true; 707 return true;
diff --git a/drivers/hid/hid-penmount.c b/drivers/hid/hid-penmount.c
new file mode 100644
index 000000000000..c11dce85cd18
--- /dev/null
+++ b/drivers/hid/hid-penmount.c
@@ -0,0 +1,49 @@
1/*
2 * HID driver for PenMount touchscreens
3 *
4 * Copyright (c) 2014 Christian Gmeiner <christian.gmeiner <at> gmail.com>
5 *
6 * based on hid-penmount copyrighted by
7 * PenMount Touch Solutions <penmount <at> seed.net.tw>
8 */
9
10/*
11 * This program is free software; you can redistribute it and/or modify it
12 * under the terms of the GNU General Public License as published by the Free
13 * Software Foundation; either version 2 of the License, or (at your option)
14 * any later version.
15 */
16
17#include <linux/module.h>
18#include <linux/hid.h>
19#include "hid-ids.h"
20
21static int penmount_input_mapping(struct hid_device *hdev,
22 struct hid_input *hi, struct hid_field *field,
23 struct hid_usage *usage, unsigned long **bit, int *max)
24{
25 if ((usage->hid & HID_USAGE_PAGE) == HID_UP_BUTTON) {
26 hid_map_usage(hi, usage, bit, max, EV_KEY, BTN_TOUCH);
27 return 1;
28 }
29
30 return 0;
31}
32
33static const struct hid_device_id penmount_devices[] = {
34 { HID_USB_DEVICE(USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_6000) },
35 { }
36};
37MODULE_DEVICE_TABLE(hid, penmount_devices);
38
39static struct hid_driver penmount_driver = {
40 .name = "hid-penmount",
41 .id_table = penmount_devices,
42 .input_mapping = penmount_input_mapping,
43};
44
45module_hid_driver(penmount_driver);
46
47MODULE_AUTHOR("Christian Gmeiner <christian.gmeiner@gmail.com>");
48MODULE_DESCRIPTION("PenMount HID TouchScreen driver");
49MODULE_LICENSE("GPL");
diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
index 020df3c2e8b4..c1b29a9eb41a 100644
--- a/drivers/hid/hid-picolcd_core.c
+++ b/drivers/hid/hid-picolcd_core.c
@@ -351,8 +351,8 @@ static int picolcd_raw_event(struct hid_device *hdev,
351 return 1; 351 return 1;
352 352
353 if (size > 64) { 353 if (size > 64) {
354 hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n", 354 hid_warn(hdev, "invalid size value (%d) for picolcd raw event (%d)\n",
355 size); 355 size, report->id);
356 return 0; 356 return 0;
357 } 357 }
358 358
diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
index 8389e8109218..3cccff73b9b9 100644
--- a/drivers/hid/hid-rmi.c
+++ b/drivers/hid/hid-rmi.c
@@ -320,10 +320,7 @@ static int rmi_f11_input_event(struct hid_device *hdev, u8 irq, u8 *data,
320 int offset; 320 int offset;
321 int i; 321 int i;
322 322
323 if (size < hdata->f11.report_size) 323 if (!(irq & hdata->f11.irq_mask) || size <= 0)
324 return 0;
325
326 if (!(irq & hdata->f11.irq_mask))
327 return 0; 324 return 0;
328 325
329 offset = (hdata->max_fingers >> 2) + 1; 326 offset = (hdata->max_fingers >> 2) + 1;
@@ -332,9 +329,19 @@ static int rmi_f11_input_event(struct hid_device *hdev, u8 irq, u8 *data,
332 int fs_bit_position = (i & 0x3) << 1; 329 int fs_bit_position = (i & 0x3) << 1;
333 int finger_state = (data[fs_byte_position] >> fs_bit_position) & 330 int finger_state = (data[fs_byte_position] >> fs_bit_position) &
334 0x03; 331 0x03;
332 int position = offset + 5 * i;
333
334 if (position + 5 > size) {
335 /* partial report, go on with what we received */
336 printk_once(KERN_WARNING
337 "%s %s: Detected incomplete finger report. Finger reports may occasionally get dropped on this platform.\n",
338 dev_driver_string(&hdev->dev),
339 dev_name(&hdev->dev));
340 hid_dbg(hdev, "Incomplete finger report\n");
341 break;
342 }
335 343
336 rmi_f11_process_touch(hdata, i, finger_state, 344 rmi_f11_process_touch(hdata, i, finger_state, &data[position]);
337 &data[offset + 5 * i]);
338 } 345 }
339 input_mt_sync_frame(hdata->input); 346 input_mt_sync_frame(hdata->input);
340 input_sync(hdata->input); 347 input_sync(hdata->input);
@@ -352,6 +359,11 @@ static int rmi_f30_input_event(struct hid_device *hdev, u8 irq, u8 *data,
352 if (!(irq & hdata->f30.irq_mask)) 359 if (!(irq & hdata->f30.irq_mask))
353 return 0; 360 return 0;
354 361
362 if (size < (int)hdata->f30.report_size) {
363 hid_warn(hdev, "Click Button pressed, but the click data is missing\n");
364 return 0;
365 }
366
355 for (i = 0; i < hdata->gpio_led_count; i++) { 367 for (i = 0; i < hdata->gpio_led_count; i++) {
356 if (test_bit(i, &hdata->button_mask)) { 368 if (test_bit(i, &hdata->button_mask)) {
357 value = (data[i / 8] >> (i & 0x07)) & BIT(0); 369 value = (data[i / 8] >> (i & 0x07)) & BIT(0);
@@ -412,9 +424,29 @@ static int rmi_read_data_event(struct hid_device *hdev, u8 *data, int size)
412 return 1; 424 return 1;
413} 425}
414 426
427static int rmi_check_sanity(struct hid_device *hdev, u8 *data, int size)
428{
429 int valid_size = size;
430 /*
431 * On the Dell XPS 13 9333, the bus sometimes get confused and fills
432 * the report with a sentinel value "ff". Synaptics told us that such
433 * behavior does not comes from the touchpad itself, so we filter out
434 * such reports here.
435 */
436
437 while ((data[valid_size - 1] == 0xff) && valid_size > 0)
438 valid_size--;
439
440 return valid_size;
441}
442
415static int rmi_raw_event(struct hid_device *hdev, 443static int rmi_raw_event(struct hid_device *hdev,
416 struct hid_report *report, u8 *data, int size) 444 struct hid_report *report, u8 *data, int size)
417{ 445{
446 size = rmi_check_sanity(hdev, data, size);
447 if (size < 2)
448 return 0;
449
418 switch (data[0]) { 450 switch (data[0]) {
419 case RMI_READ_DATA_REPORT_ID: 451 case RMI_READ_DATA_REPORT_ID:
420 return rmi_read_data_event(hdev, data, size); 452 return rmi_read_data_event(hdev, data, size);
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 2ac25760a9a9..e6d8e18dae97 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -709,6 +709,9 @@ static const struct hid_device_id sensor_hub_devices[] = {
709 USB_DEVICE_ID_MS_TYPE_COVER_2), 709 USB_DEVICE_ID_MS_TYPE_COVER_2),
710 .driver_data = HID_SENSOR_HUB_ENUM_QUIRK}, 710 .driver_data = HID_SENSOR_HUB_ENUM_QUIRK},
711 { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_STM_0, 711 { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_STM_0,
712 USB_DEVICE_ID_STM_HID_SENSOR),
713 .driver_data = HID_SENSOR_HUB_ENUM_QUIRK},
714 { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_STM_0,
712 USB_DEVICE_ID_STM_HID_SENSOR_1), 715 USB_DEVICE_ID_STM_HID_SENSOR_1),
713 .driver_data = HID_SENSOR_HUB_ENUM_QUIRK}, 716 .driver_data = HID_SENSOR_HUB_ENUM_QUIRK},
714 { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_TEXAS_INSTRUMENTS, 717 { HID_DEVICE(HID_BUS_ANY, HID_GROUP_SENSOR_HUB, USB_VENDOR_ID_TEXAS_INSTRUMENTS,
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index c372368e438c..bc4269e559f1 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -1,5 +1,5 @@
1/* 1/*
2 * HID driver for Sony / PS2 / PS3 BD devices. 2 * HID driver for Sony / PS2 / PS3 / PS4 BD devices.
3 * 3 *
4 * Copyright (c) 1999 Andreas Gal 4 * Copyright (c) 1999 Andreas Gal
5 * Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz> 5 * Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
@@ -8,6 +8,7 @@
8 * Copyright (c) 2012 David Dillow <dave@thedillows.org> 8 * Copyright (c) 2012 David Dillow <dave@thedillows.org>
9 * Copyright (c) 2006-2013 Jiri Kosina 9 * Copyright (c) 2006-2013 Jiri Kosina
10 * Copyright (c) 2013 Colin Leitner <colin.leitner@gmail.com> 10 * Copyright (c) 2013 Colin Leitner <colin.leitner@gmail.com>
11 * Copyright (c) 2014 Frank Praznik <frank.praznik@gmail.com>
11 */ 12 */
12 13
13/* 14/*
@@ -176,7 +177,7 @@ static u8 dualshock4_usb_rdesc[] = {
176 0x75, 0x06, /* Report Size (6), */ 177 0x75, 0x06, /* Report Size (6), */
177 0x95, 0x01, /* Report Count (1), */ 178 0x95, 0x01, /* Report Count (1), */
178 0x15, 0x00, /* Logical Minimum (0), */ 179 0x15, 0x00, /* Logical Minimum (0), */
179 0x25, 0x7F, /* Logical Maximum (127), */ 180 0x25, 0x3F, /* Logical Maximum (63), */
180 0x81, 0x02, /* Input (Variable), */ 181 0x81, 0x02, /* Input (Variable), */
181 0x05, 0x01, /* Usage Page (Desktop), */ 182 0x05, 0x01, /* Usage Page (Desktop), */
182 0x09, 0x33, /* Usage (Rx), */ 183 0x09, 0x33, /* Usage (Rx), */
@@ -200,14 +201,14 @@ static u8 dualshock4_usb_rdesc[] = {
200 0x81, 0x02, /* Input (Variable), */ 201 0x81, 0x02, /* Input (Variable), */
201 0x19, 0x43, /* Usage Minimum (43h), */ 202 0x19, 0x43, /* Usage Minimum (43h), */
202 0x29, 0x45, /* Usage Maximum (45h), */ 203 0x29, 0x45, /* Usage Maximum (45h), */
203 0x16, 0xFF, 0xBF, /* Logical Minimum (-16385), */ 204 0x16, 0x00, 0xE0, /* Logical Minimum (-8192), */
204 0x26, 0x00, 0x40, /* Logical Maximum (16384), */ 205 0x26, 0xFF, 0x1F, /* Logical Maximum (8191), */
205 0x95, 0x03, /* Report Count (3), */ 206 0x95, 0x03, /* Report Count (3), */
206 0x81, 0x02, /* Input (Variable), */ 207 0x81, 0x02, /* Input (Variable), */
207 0x06, 0x00, 0xFF, /* Usage Page (FF00h), */ 208 0x06, 0x00, 0xFF, /* Usage Page (FF00h), */
208 0x09, 0x21, /* Usage (21h), */ 209 0x09, 0x21, /* Usage (21h), */
209 0x15, 0x00, /* Logical Minimum (0), */ 210 0x15, 0x00, /* Logical Minimum (0), */
210 0x25, 0xFF, /* Logical Maximum (255), */ 211 0x26, 0xFF, 0x00, /* Logical Maximum (255), */
211 0x75, 0x08, /* Report Size (8), */ 212 0x75, 0x08, /* Report Size (8), */
212 0x95, 0x27, /* Report Count (39), */ 213 0x95, 0x27, /* Report Count (39), */
213 0x81, 0x02, /* Input (Variable), */ 214 0x81, 0x02, /* Input (Variable), */
@@ -395,11 +396,11 @@ static u8 dualshock4_usb_rdesc[] = {
395 396
396/* 397/*
397 * The default behavior of the Dualshock 4 is to send reports using report 398 * The default behavior of the Dualshock 4 is to send reports using report
398 * type 1 when running over Bluetooth. However, as soon as it receives a 399 * type 1 when running over Bluetooth. However, when feature report 2 is
399 * report of type 17 to set the LEDs or rumble it starts returning it's state 400 * requested during the controller initialization it starts sending input
400 * in report 17 instead of 1. Since report 17 is undefined in the default HID 401 * reports in report 17. Since report 17 is undefined in the default HID
401 * descriptor the button and axis definitions must be moved to report 17 or 402 * descriptor the button and axis definitions must be moved to report 17 or
402 * the HID layer won't process the received input once a report is sent. 403 * the HID layer won't process the received input.
403 */ 404 */
404static u8 dualshock4_bt_rdesc[] = { 405static u8 dualshock4_bt_rdesc[] = {
405 0x05, 0x01, /* Usage Page (Desktop), */ 406 0x05, 0x01, /* Usage Page (Desktop), */
@@ -509,8 +510,8 @@ static u8 dualshock4_bt_rdesc[] = {
509 0x81, 0x02, /* Input (Variable), */ 510 0x81, 0x02, /* Input (Variable), */
510 0x19, 0x43, /* Usage Minimum (43h), */ 511 0x19, 0x43, /* Usage Minimum (43h), */
511 0x29, 0x45, /* Usage Maximum (45h), */ 512 0x29, 0x45, /* Usage Maximum (45h), */
512 0x16, 0xFF, 0xBF, /* Logical Minimum (-16385), */ 513 0x16, 0x00, 0xE0, /* Logical Minimum (-8192), */
513 0x26, 0x00, 0x40, /* Logical Maximum (16384), */ 514 0x26, 0xFF, 0x1F, /* Logical Maximum (8191), */
514 0x95, 0x03, /* Report Count (3), */ 515 0x95, 0x03, /* Report Count (3), */
515 0x81, 0x02, /* Input (Variable), */ 516 0x81, 0x02, /* Input (Variable), */
516 0x06, 0x00, 0xFF, /* Usage Page (FF00h), */ 517 0x06, 0x00, 0xFF, /* Usage Page (FF00h), */
@@ -935,12 +936,13 @@ static void sixaxis_parse_report(struct sony_sc *sc, __u8 *rd, int size)
935 if (rd[30] >= 0xee) { 936 if (rd[30] >= 0xee) {
936 battery_capacity = 100; 937 battery_capacity = 100;
937 battery_charging = !(rd[30] & 0x01); 938 battery_charging = !(rd[30] & 0x01);
939 cable_state = 1;
938 } else { 940 } else {
939 __u8 index = rd[30] <= 5 ? rd[30] : 5; 941 __u8 index = rd[30] <= 5 ? rd[30] : 5;
940 battery_capacity = sixaxis_battery_capacity[index]; 942 battery_capacity = sixaxis_battery_capacity[index];
941 battery_charging = 0; 943 battery_charging = 0;
944 cable_state = 0;
942 } 945 }
943 cable_state = !(rd[31] & 0x04);
944 946
945 spin_lock_irqsave(&sc->lock, flags); 947 spin_lock_irqsave(&sc->lock, flags);
946 sc->cable_state = cable_state; 948 sc->cable_state = cable_state;
@@ -1082,6 +1084,38 @@ static int sony_mapping(struct hid_device *hdev, struct hid_input *hi,
1082 return 0; 1084 return 0;
1083} 1085}
1084 1086
1087static int sony_register_touchpad(struct hid_input *hi, int touch_count,
1088 int w, int h)
1089{
1090 struct input_dev *input_dev = hi->input;
1091 int ret;
1092
1093 ret = input_mt_init_slots(input_dev, touch_count, 0);
1094 if (ret < 0)
1095 return ret;
1096
1097 input_set_abs_params(input_dev, ABS_MT_POSITION_X, 0, w, 0, 0);
1098 input_set_abs_params(input_dev, ABS_MT_POSITION_Y, 0, h, 0, 0);
1099
1100 return 0;
1101}
1102
1103static void sony_input_configured(struct hid_device *hdev,
1104 struct hid_input *hidinput)
1105{
1106 struct sony_sc *sc = hid_get_drvdata(hdev);
1107
1108 /*
1109 * The Dualshock 4 touchpad supports 2 touches and has a
1110 * resolution of 1920x942 (44.86 dots/mm).
1111 */
1112 if (sc->quirks & DUALSHOCK4_CONTROLLER) {
1113 if (sony_register_touchpad(hidinput, 2, 1920, 942) != 0)
1114 hid_err(sc->hdev,
1115 "Unable to initialize multi-touch slots\n");
1116 }
1117}
1118
1085/* 1119/*
1086 * Sending HID_REQ_GET_REPORT changes the operation mode of the ps3 controller 1120 * Sending HID_REQ_GET_REPORT changes the operation mode of the ps3 controller
1087 * to "operational". Without this, the ps3 controller will not report any 1121 * to "operational". Without this, the ps3 controller will not report any
@@ -1654,26 +1688,6 @@ static void sony_battery_remove(struct sony_sc *sc)
1654 sc->battery.name = NULL; 1688 sc->battery.name = NULL;
1655} 1689}
1656 1690
1657static int sony_register_touchpad(struct sony_sc *sc, int touch_count,
1658 int w, int h)
1659{
1660 struct hid_input *hidinput = list_entry(sc->hdev->inputs.next,
1661 struct hid_input, list);
1662 struct input_dev *input_dev = hidinput->input;
1663 int ret;
1664
1665 ret = input_mt_init_slots(input_dev, touch_count, 0);
1666 if (ret < 0) {
1667 hid_err(sc->hdev, "Unable to initialize multi-touch slots\n");
1668 return ret;
1669 }
1670
1671 input_set_abs_params(input_dev, ABS_MT_POSITION_X, 0, w, 0, 0);
1672 input_set_abs_params(input_dev, ABS_MT_POSITION_Y, 0, h, 0, 0);
1673
1674 return 0;
1675}
1676
1677/* 1691/*
1678 * If a controller is plugged in via USB while already connected via Bluetooth 1692 * If a controller is plugged in via USB while already connected via Bluetooth
1679 * it will show up as two devices. A global list of connected controllers and 1693 * it will show up as two devices. A global list of connected controllers and
@@ -1923,13 +1937,6 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
1923 goto err_stop; 1937 goto err_stop;
1924 } 1938 }
1925 } 1939 }
1926 /*
1927 * The Dualshock 4 touchpad supports 2 touches and has a
1928 * resolution of 1920x940.
1929 */
1930 ret = sony_register_touchpad(sc, 2, 1920, 940);
1931 if (ret < 0)
1932 goto err_stop;
1933 1940
1934 sony_init_work(sc, dualshock4_state_worker); 1941 sony_init_work(sc, dualshock4_state_worker);
1935 } else { 1942 } else {
@@ -2037,13 +2044,14 @@ static const struct hid_device_id sony_devices[] = {
2037MODULE_DEVICE_TABLE(hid, sony_devices); 2044MODULE_DEVICE_TABLE(hid, sony_devices);
2038 2045
2039static struct hid_driver sony_driver = { 2046static struct hid_driver sony_driver = {
2040 .name = "sony", 2047 .name = "sony",
2041 .id_table = sony_devices, 2048 .id_table = sony_devices,
2042 .input_mapping = sony_mapping, 2049 .input_mapping = sony_mapping,
2043 .probe = sony_probe, 2050 .input_configured = sony_input_configured,
2044 .remove = sony_remove, 2051 .probe = sony_probe,
2045 .report_fixup = sony_report_fixup, 2052 .remove = sony_remove,
2046 .raw_event = sony_raw_event 2053 .report_fixup = sony_report_fixup,
2054 .raw_event = sony_raw_event
2047}; 2055};
2048 2056
2049static int __init sony_init(void) 2057static int __init sony_init(void)
diff --git a/drivers/hid/hid-thingm.c b/drivers/hid/hid-thingm.c
index 134be89b15ea..b95d3978c272 100644
--- a/drivers/hid/hid-thingm.c
+++ b/drivers/hid/hid-thingm.c
@@ -208,10 +208,10 @@ unregister_red:
208 208
209static void thingm_remove_rgb(struct thingm_rgb *rgb) 209static void thingm_remove_rgb(struct thingm_rgb *rgb)
210{ 210{
211 flush_work(&rgb->work);
212 led_classdev_unregister(&rgb->red.ldev); 211 led_classdev_unregister(&rgb->red.ldev);
213 led_classdev_unregister(&rgb->green.ldev); 212 led_classdev_unregister(&rgb->green.ldev);
214 led_classdev_unregister(&rgb->blue.ldev); 213 led_classdev_unregister(&rgb->blue.ldev);
214 flush_work(&rgb->work);
215} 215}
216 216
217static int thingm_probe(struct hid_device *hdev, const struct hid_device_id *id) 217static int thingm_probe(struct hid_device *hdev, const struct hid_device_id *id)
@@ -250,6 +250,7 @@ static int thingm_probe(struct hid_device *hdev, const struct hid_device_id *id)
250 250
251 if (!tdev->fwinfo) { 251 if (!tdev->fwinfo) {
252 hid_err(hdev, "unsupported firmware %c\n", tdev->version.major); 252 hid_err(hdev, "unsupported firmware %c\n", tdev->version.major);
253 err = -ENODEV;
253 goto stop; 254 goto stop;
254 } 255 }
255 256
@@ -286,10 +287,10 @@ static void thingm_remove(struct hid_device *hdev)
286 struct thingm_device *tdev = hid_get_drvdata(hdev); 287 struct thingm_device *tdev = hid_get_drvdata(hdev);
287 int i; 288 int i;
288 289
290 hid_hw_stop(hdev);
291
289 for (i = 0; i < tdev->fwinfo->numrgb; ++i) 292 for (i = 0; i < tdev->fwinfo->numrgb; ++i)
290 thingm_remove_rgb(tdev->rgb + i); 293 thingm_remove_rgb(tdev->rgb + i);
291
292 hid_hw_stop(hdev);
293} 294}
294 295
295static const struct hid_device_id thingm_table[] = { 296static const struct hid_device_id thingm_table[] = {
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 0cb92e347258..e094c572b86e 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -44,10 +44,12 @@ struct uhid_device {
44 __u8 tail; 44 __u8 tail;
45 struct uhid_event *outq[UHID_BUFSIZE]; 45 struct uhid_event *outq[UHID_BUFSIZE];
46 46
47 /* blocking GET_REPORT support; state changes protected by qlock */
47 struct mutex report_lock; 48 struct mutex report_lock;
48 wait_queue_head_t report_wait; 49 wait_queue_head_t report_wait;
49 atomic_t report_done; 50 bool report_running;
50 atomic_t report_id; 51 u32 report_id;
52 u32 report_type;
51 struct uhid_event report_buf; 53 struct uhid_event report_buf;
52}; 54};
53 55
@@ -90,8 +92,27 @@ static int uhid_queue_event(struct uhid_device *uhid, __u32 event)
90static int uhid_hid_start(struct hid_device *hid) 92static int uhid_hid_start(struct hid_device *hid)
91{ 93{
92 struct uhid_device *uhid = hid->driver_data; 94 struct uhid_device *uhid = hid->driver_data;
95 struct uhid_event *ev;
96 unsigned long flags;
97
98 ev = kzalloc(sizeof(*ev), GFP_KERNEL);
99 if (!ev)
100 return -ENOMEM;
101
102 ev->type = UHID_START;
93 103
94 return uhid_queue_event(uhid, UHID_START); 104 if (hid->report_enum[HID_FEATURE_REPORT].numbered)
105 ev->u.start.dev_flags |= UHID_DEV_NUMBERED_FEATURE_REPORTS;
106 if (hid->report_enum[HID_OUTPUT_REPORT].numbered)
107 ev->u.start.dev_flags |= UHID_DEV_NUMBERED_OUTPUT_REPORTS;
108 if (hid->report_enum[HID_INPUT_REPORT].numbered)
109 ev->u.start.dev_flags |= UHID_DEV_NUMBERED_INPUT_REPORTS;
110
111 spin_lock_irqsave(&uhid->qlock, flags);
112 uhid_queue(uhid, ev);
113 spin_unlock_irqrestore(&uhid->qlock, flags);
114
115 return 0;
95} 116}
96 117
97static void uhid_hid_stop(struct hid_device *hid) 118static void uhid_hid_stop(struct hid_device *hid)
@@ -123,87 +144,169 @@ static int uhid_hid_parse(struct hid_device *hid)
123 return hid_parse_report(hid, uhid->rd_data, uhid->rd_size); 144 return hid_parse_report(hid, uhid->rd_data, uhid->rd_size);
124} 145}
125 146
126static int uhid_hid_get_raw(struct hid_device *hid, unsigned char rnum, 147/* must be called with report_lock held */
127 __u8 *buf, size_t count, unsigned char rtype) 148static int __uhid_report_queue_and_wait(struct uhid_device *uhid,
149 struct uhid_event *ev,
150 __u32 *report_id)
151{
152 unsigned long flags;
153 int ret;
154
155 spin_lock_irqsave(&uhid->qlock, flags);
156 *report_id = ++uhid->report_id;
157 uhid->report_type = ev->type + 1;
158 uhid->report_running = true;
159 uhid_queue(uhid, ev);
160 spin_unlock_irqrestore(&uhid->qlock, flags);
161
162 ret = wait_event_interruptible_timeout(uhid->report_wait,
163 !uhid->report_running || !uhid->running,
164 5 * HZ);
165 if (!ret || !uhid->running || uhid->report_running)
166 ret = -EIO;
167 else if (ret < 0)
168 ret = -ERESTARTSYS;
169 else
170 ret = 0;
171
172 uhid->report_running = false;
173
174 return ret;
175}
176
177static void uhid_report_wake_up(struct uhid_device *uhid, u32 id,
178 const struct uhid_event *ev)
179{
180 unsigned long flags;
181
182 spin_lock_irqsave(&uhid->qlock, flags);
183
184 /* id for old report; drop it silently */
185 if (uhid->report_type != ev->type || uhid->report_id != id)
186 goto unlock;
187 if (!uhid->report_running)
188 goto unlock;
189
190 memcpy(&uhid->report_buf, ev, sizeof(*ev));
191 uhid->report_running = false;
192 wake_up_interruptible(&uhid->report_wait);
193
194unlock:
195 spin_unlock_irqrestore(&uhid->qlock, flags);
196}
197
198static int uhid_hid_get_report(struct hid_device *hid, unsigned char rnum,
199 u8 *buf, size_t count, u8 rtype)
128{ 200{
129 struct uhid_device *uhid = hid->driver_data; 201 struct uhid_device *uhid = hid->driver_data;
130 __u8 report_type; 202 struct uhid_get_report_reply_req *req;
131 struct uhid_event *ev; 203 struct uhid_event *ev;
132 unsigned long flags;
133 int ret; 204 int ret;
134 size_t uninitialized_var(len);
135 struct uhid_feature_answer_req *req;
136 205
137 if (!uhid->running) 206 if (!uhid->running)
138 return -EIO; 207 return -EIO;
139 208
140 switch (rtype) { 209 ev = kzalloc(sizeof(*ev), GFP_KERNEL);
141 case HID_FEATURE_REPORT: 210 if (!ev)
142 report_type = UHID_FEATURE_REPORT; 211 return -ENOMEM;
143 break; 212
144 case HID_OUTPUT_REPORT: 213 ev->type = UHID_GET_REPORT;
145 report_type = UHID_OUTPUT_REPORT; 214 ev->u.get_report.rnum = rnum;
146 break; 215 ev->u.get_report.rtype = rtype;
147 case HID_INPUT_REPORT:
148 report_type = UHID_INPUT_REPORT;
149 break;
150 default:
151 return -EINVAL;
152 }
153 216
154 ret = mutex_lock_interruptible(&uhid->report_lock); 217 ret = mutex_lock_interruptible(&uhid->report_lock);
155 if (ret) 218 if (ret) {
219 kfree(ev);
156 return ret; 220 return ret;
221 }
157 222
158 ev = kzalloc(sizeof(*ev), GFP_KERNEL); 223 /* this _always_ takes ownership of @ev */
159 if (!ev) { 224 ret = __uhid_report_queue_and_wait(uhid, ev, &ev->u.get_report.id);
160 ret = -ENOMEM; 225 if (ret)
161 goto unlock; 226 goto unlock;
227
228 req = &uhid->report_buf.u.get_report_reply;
229 if (req->err) {
230 ret = -EIO;
231 } else {
232 ret = min3(count, (size_t)req->size, (size_t)UHID_DATA_MAX);
233 memcpy(buf, req->data, ret);
162 } 234 }
163 235
164 spin_lock_irqsave(&uhid->qlock, flags); 236unlock:
165 ev->type = UHID_FEATURE; 237 mutex_unlock(&uhid->report_lock);
166 ev->u.feature.id = atomic_inc_return(&uhid->report_id); 238 return ret;
167 ev->u.feature.rnum = rnum; 239}
168 ev->u.feature.rtype = report_type;
169 240
170 atomic_set(&uhid->report_done, 0); 241static int uhid_hid_set_report(struct hid_device *hid, unsigned char rnum,
171 uhid_queue(uhid, ev); 242 const u8 *buf, size_t count, u8 rtype)
172 spin_unlock_irqrestore(&uhid->qlock, flags); 243{
244 struct uhid_device *uhid = hid->driver_data;
245 struct uhid_event *ev;
246 int ret;
173 247
174 ret = wait_event_interruptible_timeout(uhid->report_wait, 248 if (!uhid->running || count > UHID_DATA_MAX)
175 atomic_read(&uhid->report_done), 5 * HZ); 249 return -EIO;
176
177 /*
178 * Make sure "uhid->running" is cleared on shutdown before
179 * "uhid->report_done" is set.
180 */
181 smp_rmb();
182 if (!ret || !uhid->running) {
183 ret = -EIO;
184 } else if (ret < 0) {
185 ret = -ERESTARTSYS;
186 } else {
187 spin_lock_irqsave(&uhid->qlock, flags);
188 req = &uhid->report_buf.u.feature_answer;
189 250
190 if (req->err) { 251 ev = kzalloc(sizeof(*ev), GFP_KERNEL);
191 ret = -EIO; 252 if (!ev)
192 } else { 253 return -ENOMEM;
193 ret = 0; 254
194 len = min(count, 255 ev->type = UHID_SET_REPORT;
195 min_t(size_t, req->size, UHID_DATA_MAX)); 256 ev->u.set_report.rnum = rnum;
196 memcpy(buf, req->data, len); 257 ev->u.set_report.rtype = rtype;
197 } 258 ev->u.set_report.size = count;
259 memcpy(ev->u.set_report.data, buf, count);
198 260
199 spin_unlock_irqrestore(&uhid->qlock, flags); 261 ret = mutex_lock_interruptible(&uhid->report_lock);
262 if (ret) {
263 kfree(ev);
264 return ret;
200 } 265 }
201 266
202 atomic_set(&uhid->report_done, 1); 267 /* this _always_ takes ownership of @ev */
268 ret = __uhid_report_queue_and_wait(uhid, ev, &ev->u.set_report.id);
269 if (ret)
270 goto unlock;
271
272 if (uhid->report_buf.u.set_report_reply.err)
273 ret = -EIO;
274 else
275 ret = count;
203 276
204unlock: 277unlock:
205 mutex_unlock(&uhid->report_lock); 278 mutex_unlock(&uhid->report_lock);
206 return ret ? ret : len; 279 return ret;
280}
281
282static int uhid_hid_raw_request(struct hid_device *hid, unsigned char reportnum,
283 __u8 *buf, size_t len, unsigned char rtype,
284 int reqtype)
285{
286 u8 u_rtype;
287
288 switch (rtype) {
289 case HID_FEATURE_REPORT:
290 u_rtype = UHID_FEATURE_REPORT;
291 break;
292 case HID_OUTPUT_REPORT:
293 u_rtype = UHID_OUTPUT_REPORT;
294 break;
295 case HID_INPUT_REPORT:
296 u_rtype = UHID_INPUT_REPORT;
297 break;
298 default:
299 return -EINVAL;
300 }
301
302 switch (reqtype) {
303 case HID_REQ_GET_REPORT:
304 return uhid_hid_get_report(hid, reportnum, buf, len, u_rtype);
305 case HID_REQ_SET_REPORT:
306 return uhid_hid_set_report(hid, reportnum, buf, len, u_rtype);
307 default:
308 return -EIO;
309 }
207} 310}
208 311
209static int uhid_hid_output_raw(struct hid_device *hid, __u8 *buf, size_t count, 312static int uhid_hid_output_raw(struct hid_device *hid, __u8 *buf, size_t count,
@@ -250,29 +353,14 @@ static int uhid_hid_output_report(struct hid_device *hid, __u8 *buf,
250 return uhid_hid_output_raw(hid, buf, count, HID_OUTPUT_REPORT); 353 return uhid_hid_output_raw(hid, buf, count, HID_OUTPUT_REPORT);
251} 354}
252 355
253static int uhid_raw_request(struct hid_device *hid, unsigned char reportnum,
254 __u8 *buf, size_t len, unsigned char rtype,
255 int reqtype)
256{
257 switch (reqtype) {
258 case HID_REQ_GET_REPORT:
259 return uhid_hid_get_raw(hid, reportnum, buf, len, rtype);
260 case HID_REQ_SET_REPORT:
261 /* TODO: implement proper SET_REPORT functionality */
262 return -ENOSYS;
263 default:
264 return -EIO;
265 }
266}
267
268static struct hid_ll_driver uhid_hid_driver = { 356static struct hid_ll_driver uhid_hid_driver = {
269 .start = uhid_hid_start, 357 .start = uhid_hid_start,
270 .stop = uhid_hid_stop, 358 .stop = uhid_hid_stop,
271 .open = uhid_hid_open, 359 .open = uhid_hid_open,
272 .close = uhid_hid_close, 360 .close = uhid_hid_close,
273 .parse = uhid_hid_parse, 361 .parse = uhid_hid_parse,
362 .raw_request = uhid_hid_raw_request,
274 .output_report = uhid_hid_output_report, 363 .output_report = uhid_hid_output_report,
275 .raw_request = uhid_raw_request,
276}; 364};
277 365
278#ifdef CONFIG_COMPAT 366#ifdef CONFIG_COMPAT
@@ -363,28 +451,27 @@ static int uhid_event_from_user(const char __user *buffer, size_t len,
363} 451}
364#endif 452#endif
365 453
366static int uhid_dev_create(struct uhid_device *uhid, 454static int uhid_dev_create2(struct uhid_device *uhid,
367 const struct uhid_event *ev) 455 const struct uhid_event *ev)
368{ 456{
369 struct hid_device *hid; 457 struct hid_device *hid;
458 size_t rd_size, len;
459 void *rd_data;
370 int ret; 460 int ret;
371 461
372 if (uhid->running) 462 if (uhid->running)
373 return -EALREADY; 463 return -EALREADY;
374 464
375 uhid->rd_size = ev->u.create.rd_size; 465 rd_size = ev->u.create2.rd_size;
376 if (uhid->rd_size <= 0 || uhid->rd_size > HID_MAX_DESCRIPTOR_SIZE) 466 if (rd_size <= 0 || rd_size > HID_MAX_DESCRIPTOR_SIZE)
377 return -EINVAL; 467 return -EINVAL;
378 468
379 uhid->rd_data = kmalloc(uhid->rd_size, GFP_KERNEL); 469 rd_data = kmemdup(ev->u.create2.rd_data, rd_size, GFP_KERNEL);
380 if (!uhid->rd_data) 470 if (!rd_data)
381 return -ENOMEM; 471 return -ENOMEM;
382 472
383 if (copy_from_user(uhid->rd_data, ev->u.create.rd_data, 473 uhid->rd_size = rd_size;
384 uhid->rd_size)) { 474 uhid->rd_data = rd_data;
385 ret = -EFAULT;
386 goto err_free;
387 }
388 475
389 hid = hid_allocate_device(); 476 hid = hid_allocate_device();
390 if (IS_ERR(hid)) { 477 if (IS_ERR(hid)) {
@@ -392,19 +479,19 @@ static int uhid_dev_create(struct uhid_device *uhid,
392 goto err_free; 479 goto err_free;
393 } 480 }
394 481
395 strncpy(hid->name, ev->u.create.name, 127); 482 len = min(sizeof(hid->name), sizeof(ev->u.create2.name)) - 1;
396 hid->name[127] = 0; 483 strncpy(hid->name, ev->u.create2.name, len);
397 strncpy(hid->phys, ev->u.create.phys, 63); 484 len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys)) - 1;
398 hid->phys[63] = 0; 485 strncpy(hid->phys, ev->u.create2.phys, len);
399 strncpy(hid->uniq, ev->u.create.uniq, 63); 486 len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq)) - 1;
400 hid->uniq[63] = 0; 487 strncpy(hid->uniq, ev->u.create2.uniq, len);
401 488
402 hid->ll_driver = &uhid_hid_driver; 489 hid->ll_driver = &uhid_hid_driver;
403 hid->bus = ev->u.create.bus; 490 hid->bus = ev->u.create2.bus;
404 hid->vendor = ev->u.create.vendor; 491 hid->vendor = ev->u.create2.vendor;
405 hid->product = ev->u.create.product; 492 hid->product = ev->u.create2.product;
406 hid->version = ev->u.create.version; 493 hid->version = ev->u.create2.version;
407 hid->country = ev->u.create.country; 494 hid->country = ev->u.create2.country;
408 hid->driver_data = uhid; 495 hid->driver_data = uhid;
409 hid->dev.parent = uhid_misc.this_device; 496 hid->dev.parent = uhid_misc.this_device;
410 497
@@ -425,67 +512,34 @@ err_hid:
425 uhid->running = false; 512 uhid->running = false;
426err_free: 513err_free:
427 kfree(uhid->rd_data); 514 kfree(uhid->rd_data);
515 uhid->rd_data = NULL;
516 uhid->rd_size = 0;
428 return ret; 517 return ret;
429} 518}
430 519
431static int uhid_dev_create2(struct uhid_device *uhid, 520static int uhid_dev_create(struct uhid_device *uhid,
432 const struct uhid_event *ev) 521 struct uhid_event *ev)
433{ 522{
434 struct hid_device *hid; 523 struct uhid_create_req orig;
435 int ret;
436 524
437 if (uhid->running) 525 orig = ev->u.create;
438 return -EALREADY;
439 526
440 uhid->rd_size = ev->u.create2.rd_size; 527 if (orig.rd_size <= 0 || orig.rd_size > HID_MAX_DESCRIPTOR_SIZE)
441 if (uhid->rd_size <= 0 || uhid->rd_size > HID_MAX_DESCRIPTOR_SIZE)
442 return -EINVAL; 528 return -EINVAL;
529 if (copy_from_user(&ev->u.create2.rd_data, orig.rd_data, orig.rd_size))
530 return -EFAULT;
443 531
444 uhid->rd_data = kmemdup(ev->u.create2.rd_data, uhid->rd_size, 532 memcpy(ev->u.create2.name, orig.name, sizeof(orig.name));
445 GFP_KERNEL); 533 memcpy(ev->u.create2.phys, orig.phys, sizeof(orig.phys));
446 if (!uhid->rd_data) 534 memcpy(ev->u.create2.uniq, orig.uniq, sizeof(orig.uniq));
447 return -ENOMEM; 535 ev->u.create2.rd_size = orig.rd_size;
448 536 ev->u.create2.bus = orig.bus;
449 hid = hid_allocate_device(); 537 ev->u.create2.vendor = orig.vendor;
450 if (IS_ERR(hid)) { 538 ev->u.create2.product = orig.product;
451 ret = PTR_ERR(hid); 539 ev->u.create2.version = orig.version;
452 goto err_free; 540 ev->u.create2.country = orig.country;
453 } 541
454 542 return uhid_dev_create2(uhid, ev);
455 strncpy(hid->name, ev->u.create2.name, 127);
456 hid->name[127] = 0;
457 strncpy(hid->phys, ev->u.create2.phys, 63);
458 hid->phys[63] = 0;
459 strncpy(hid->uniq, ev->u.create2.uniq, 63);
460 hid->uniq[63] = 0;
461
462 hid->ll_driver = &uhid_hid_driver;
463 hid->bus = ev->u.create2.bus;
464 hid->vendor = ev->u.create2.vendor;
465 hid->product = ev->u.create2.product;
466 hid->version = ev->u.create2.version;
467 hid->country = ev->u.create2.country;
468 hid->driver_data = uhid;
469 hid->dev.parent = uhid_misc.this_device;
470
471 uhid->hid = hid;
472 uhid->running = true;
473
474 ret = hid_add_device(hid);
475 if (ret) {
476 hid_err(hid, "Cannot register HID device\n");
477 goto err_hid;
478 }
479
480 return 0;
481
482err_hid:
483 hid_destroy_device(hid);
484 uhid->hid = NULL;
485 uhid->running = false;
486err_free:
487 kfree(uhid->rd_data);
488 return ret;
489} 543}
490 544
491static int uhid_dev_destroy(struct uhid_device *uhid) 545static int uhid_dev_destroy(struct uhid_device *uhid)
@@ -493,10 +547,7 @@ static int uhid_dev_destroy(struct uhid_device *uhid)
493 if (!uhid->running) 547 if (!uhid->running)
494 return -EINVAL; 548 return -EINVAL;
495 549
496 /* clear "running" before setting "report_done" */
497 uhid->running = false; 550 uhid->running = false;
498 smp_wmb();
499 atomic_set(&uhid->report_done, 1);
500 wake_up_interruptible(&uhid->report_wait); 551 wake_up_interruptible(&uhid->report_wait);
501 552
502 hid_destroy_device(uhid->hid); 553 hid_destroy_device(uhid->hid);
@@ -527,28 +578,23 @@ static int uhid_dev_input2(struct uhid_device *uhid, struct uhid_event *ev)
527 return 0; 578 return 0;
528} 579}
529 580
530static int uhid_dev_feature_answer(struct uhid_device *uhid, 581static int uhid_dev_get_report_reply(struct uhid_device *uhid,
531 struct uhid_event *ev) 582 struct uhid_event *ev)
532{ 583{
533 unsigned long flags;
534
535 if (!uhid->running) 584 if (!uhid->running)
536 return -EINVAL; 585 return -EINVAL;
537 586
538 spin_lock_irqsave(&uhid->qlock, flags); 587 uhid_report_wake_up(uhid, ev->u.get_report_reply.id, ev);
539 588 return 0;
540 /* id for old report; drop it silently */ 589}
541 if (atomic_read(&uhid->report_id) != ev->u.feature_answer.id)
542 goto unlock;
543 if (atomic_read(&uhid->report_done))
544 goto unlock;
545 590
546 memcpy(&uhid->report_buf, ev, sizeof(*ev)); 591static int uhid_dev_set_report_reply(struct uhid_device *uhid,
547 atomic_set(&uhid->report_done, 1); 592 struct uhid_event *ev)
548 wake_up_interruptible(&uhid->report_wait); 593{
594 if (!uhid->running)
595 return -EINVAL;
549 596
550unlock: 597 uhid_report_wake_up(uhid, ev->u.set_report_reply.id, ev);
551 spin_unlock_irqrestore(&uhid->qlock, flags);
552 return 0; 598 return 0;
553} 599}
554 600
@@ -566,7 +612,6 @@ static int uhid_char_open(struct inode *inode, struct file *file)
566 init_waitqueue_head(&uhid->waitq); 612 init_waitqueue_head(&uhid->waitq);
567 init_waitqueue_head(&uhid->report_wait); 613 init_waitqueue_head(&uhid->report_wait);
568 uhid->running = false; 614 uhid->running = false;
569 atomic_set(&uhid->report_done, 1);
570 615
571 file->private_data = uhid; 616 file->private_data = uhid;
572 nonseekable_open(inode, file); 617 nonseekable_open(inode, file);
@@ -675,8 +720,11 @@ static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
675 case UHID_INPUT2: 720 case UHID_INPUT2:
676 ret = uhid_dev_input2(uhid, &uhid->input_buf); 721 ret = uhid_dev_input2(uhid, &uhid->input_buf);
677 break; 722 break;
678 case UHID_FEATURE_ANSWER: 723 case UHID_GET_REPORT_REPLY:
679 ret = uhid_dev_feature_answer(uhid, &uhid->input_buf); 724 ret = uhid_dev_get_report_reply(uhid, &uhid->input_buf);
725 break;
726 case UHID_SET_REPORT_REPLY:
727 ret = uhid_dev_set_report_reply(uhid, &uhid->input_buf);
680 break; 728 break;
681 default: 729 default:
682 ret = -EOPNOTSUPP; 730 ret = -EOPNOTSUPP;
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 79cf503e37bf..ca6849a0121e 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -82,7 +82,7 @@ static int hid_start_in(struct hid_device *hid)
82 struct usbhid_device *usbhid = hid->driver_data; 82 struct usbhid_device *usbhid = hid->driver_data;
83 83
84 spin_lock_irqsave(&usbhid->lock, flags); 84 spin_lock_irqsave(&usbhid->lock, flags);
85 if (hid->open > 0 && 85 if ((hid->open > 0 || hid->quirks & HID_QUIRK_ALWAYS_POLL) &&
86 !test_bit(HID_DISCONNECTED, &usbhid->iofl) && 86 !test_bit(HID_DISCONNECTED, &usbhid->iofl) &&
87 !test_bit(HID_SUSPENDED, &usbhid->iofl) && 87 !test_bit(HID_SUSPENDED, &usbhid->iofl) &&
88 !test_and_set_bit(HID_IN_RUNNING, &usbhid->iofl)) { 88 !test_and_set_bit(HID_IN_RUNNING, &usbhid->iofl)) {
@@ -116,40 +116,24 @@ static void hid_reset(struct work_struct *work)
116 struct usbhid_device *usbhid = 116 struct usbhid_device *usbhid =
117 container_of(work, struct usbhid_device, reset_work); 117 container_of(work, struct usbhid_device, reset_work);
118 struct hid_device *hid = usbhid->hid; 118 struct hid_device *hid = usbhid->hid;
119 int rc = 0; 119 int rc;
120 120
121 if (test_bit(HID_CLEAR_HALT, &usbhid->iofl)) { 121 if (test_bit(HID_CLEAR_HALT, &usbhid->iofl)) {
122 dev_dbg(&usbhid->intf->dev, "clear halt\n"); 122 dev_dbg(&usbhid->intf->dev, "clear halt\n");
123 rc = usb_clear_halt(hid_to_usb_dev(hid), usbhid->urbin->pipe); 123 rc = usb_clear_halt(hid_to_usb_dev(hid), usbhid->urbin->pipe);
124 clear_bit(HID_CLEAR_HALT, &usbhid->iofl); 124 clear_bit(HID_CLEAR_HALT, &usbhid->iofl);
125 hid_start_in(hid);
126 }
127
128 else if (test_bit(HID_RESET_PENDING, &usbhid->iofl)) {
129 dev_dbg(&usbhid->intf->dev, "resetting device\n");
130 rc = usb_lock_device_for_reset(hid_to_usb_dev(hid), usbhid->intf);
131 if (rc == 0) { 125 if (rc == 0) {
132 rc = usb_reset_device(hid_to_usb_dev(hid)); 126 hid_start_in(hid);
133 usb_unlock_device(hid_to_usb_dev(hid)); 127 } else {
128 dev_dbg(&usbhid->intf->dev,
129 "clear-halt failed: %d\n", rc);
130 set_bit(HID_RESET_PENDING, &usbhid->iofl);
134 } 131 }
135 clear_bit(HID_RESET_PENDING, &usbhid->iofl);
136 } 132 }
137 133
138 switch (rc) { 134 if (test_bit(HID_RESET_PENDING, &usbhid->iofl)) {
139 case 0: 135 dev_dbg(&usbhid->intf->dev, "resetting device\n");
140 if (!test_bit(HID_IN_RUNNING, &usbhid->iofl)) 136 usb_queue_reset_device(usbhid->intf);
141 hid_io_error(hid);
142 break;
143 default:
144 hid_err(hid, "can't reset device, %s-%s/input%d, status %d\n",
145 hid_to_usb_dev(hid)->bus->bus_name,
146 hid_to_usb_dev(hid)->devpath,
147 usbhid->ifnum, rc);
148 /* FALLTHROUGH */
149 case -EHOSTUNREACH:
150 case -ENODEV:
151 case -EINTR:
152 break;
153 } 137 }
154} 138}
155 139
@@ -292,6 +276,8 @@ static void hid_irq_in(struct urb *urb)
292 case 0: /* success */ 276 case 0: /* success */
293 usbhid_mark_busy(usbhid); 277 usbhid_mark_busy(usbhid);
294 usbhid->retry_delay = 0; 278 usbhid->retry_delay = 0;
279 if ((hid->quirks & HID_QUIRK_ALWAYS_POLL) && !hid->open)
280 break;
295 hid_input_report(urb->context, HID_INPUT_REPORT, 281 hid_input_report(urb->context, HID_INPUT_REPORT,
296 urb->transfer_buffer, 282 urb->transfer_buffer,
297 urb->actual_length, 1); 283 urb->actual_length, 1);
@@ -735,8 +721,10 @@ void usbhid_close(struct hid_device *hid)
735 if (!--hid->open) { 721 if (!--hid->open) {
736 spin_unlock_irq(&usbhid->lock); 722 spin_unlock_irq(&usbhid->lock);
737 hid_cancel_delayed_stuff(usbhid); 723 hid_cancel_delayed_stuff(usbhid);
738 usb_kill_urb(usbhid->urbin); 724 if (!(hid->quirks & HID_QUIRK_ALWAYS_POLL)) {
739 usbhid->intf->needs_remote_wakeup = 0; 725 usb_kill_urb(usbhid->urbin);
726 usbhid->intf->needs_remote_wakeup = 0;
727 }
740 } else { 728 } else {
741 spin_unlock_irq(&usbhid->lock); 729 spin_unlock_irq(&usbhid->lock);
742 } 730 }
@@ -1134,6 +1122,19 @@ static int usbhid_start(struct hid_device *hid)
1134 1122
1135 set_bit(HID_STARTED, &usbhid->iofl); 1123 set_bit(HID_STARTED, &usbhid->iofl);
1136 1124
1125 if (hid->quirks & HID_QUIRK_ALWAYS_POLL) {
1126 ret = usb_autopm_get_interface(usbhid->intf);
1127 if (ret)
1128 goto fail;
1129 usbhid->intf->needs_remote_wakeup = 1;
1130 ret = hid_start_in(hid);
1131 if (ret) {
1132 dev_err(&hid->dev,
1133 "failed to start in urb: %d\n", ret);
1134 }
1135 usb_autopm_put_interface(usbhid->intf);
1136 }
1137
1137 /* Some keyboards don't work until their LEDs have been set. 1138 /* Some keyboards don't work until their LEDs have been set.
1138 * Since BIOSes do set the LEDs, it must be safe for any device 1139 * Since BIOSes do set the LEDs, it must be safe for any device
1139 * that supports the keyboard boot protocol. 1140 * that supports the keyboard boot protocol.
@@ -1166,6 +1167,9 @@ static void usbhid_stop(struct hid_device *hid)
1166 if (WARN_ON(!usbhid)) 1167 if (WARN_ON(!usbhid))
1167 return; 1168 return;
1168 1169
1170 if (hid->quirks & HID_QUIRK_ALWAYS_POLL)
1171 usbhid->intf->needs_remote_wakeup = 0;
1172
1169 clear_bit(HID_STARTED, &usbhid->iofl); 1173 clear_bit(HID_STARTED, &usbhid->iofl);
1170 spin_lock_irq(&usbhid->lock); /* Sync with error and led handlers */ 1174 spin_lock_irq(&usbhid->lock); /* Sync with error and led handlers */
1171 set_bit(HID_DISCONNECTED, &usbhid->iofl); 1175 set_bit(HID_DISCONNECTED, &usbhid->iofl);
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 15225f3eaed1..f3cb5b0a4345 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -70,6 +70,7 @@ static const struct hid_blacklist {
70 { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK, HID_QUIRK_NOGET }, 70 { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK, HID_QUIRK_NOGET },
71 { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET }, 71 { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
72 { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET }, 72 { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
73 { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
73 { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET }, 74 { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
74 { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS }, 75 { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
75 { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET }, 76 { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
@@ -79,6 +80,8 @@ static const struct hid_blacklist {
79 { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS }, 80 { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS },
80 { USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_1610, HID_QUIRK_NOGET }, 81 { USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_1610, HID_QUIRK_NOGET },
81 { USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_1640, HID_QUIRK_NOGET }, 82 { USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_1640, HID_QUIRK_NOGET },
83 { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
84 { USB_VENDOR_ID_KYE, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE_ID2, HID_QUIRK_ALWAYS_POLL },
82 { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS }, 85 { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
83 { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS }, 86 { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
84 { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2, HID_QUIRK_NO_INIT_REPORTS }, 87 { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 3dcd00496064..78ea9bf941cd 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -288,6 +288,7 @@ struct hid_item {
288#define HID_QUIRK_HIDINPUT_FORCE 0x00000080 288#define HID_QUIRK_HIDINPUT_FORCE 0x00000080
289#define HID_QUIRK_NO_EMPTY_INPUT 0x00000100 289#define HID_QUIRK_NO_EMPTY_INPUT 0x00000100
290#define HID_QUIRK_NO_INIT_INPUT_REPORTS 0x00000200 290#define HID_QUIRK_NO_INIT_INPUT_REPORTS 0x00000200
291#define HID_QUIRK_ALWAYS_POLL 0x00000400
291#define HID_QUIRK_SKIP_OUTPUT_REPORTS 0x00010000 292#define HID_QUIRK_SKIP_OUTPUT_REPORTS 0x00010000
292#define HID_QUIRK_SKIP_OUTPUT_REPORT_ID 0x00020000 293#define HID_QUIRK_SKIP_OUTPUT_REPORT_ID 0x00020000
293#define HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP 0x00040000 294#define HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP 0x00040000
diff --git a/include/uapi/linux/uhid.h b/include/uapi/linux/uhid.h
index 1e3b09c191cd..aaa86d6bd1dd 100644
--- a/include/uapi/linux/uhid.h
+++ b/include/uapi/linux/uhid.h
@@ -24,35 +24,23 @@
24#include <linux/hid.h> 24#include <linux/hid.h>
25 25
26enum uhid_event_type { 26enum uhid_event_type {
27 UHID_CREATE, 27 __UHID_LEGACY_CREATE,
28 UHID_DESTROY, 28 UHID_DESTROY,
29 UHID_START, 29 UHID_START,
30 UHID_STOP, 30 UHID_STOP,
31 UHID_OPEN, 31 UHID_OPEN,
32 UHID_CLOSE, 32 UHID_CLOSE,
33 UHID_OUTPUT, 33 UHID_OUTPUT,
34 UHID_OUTPUT_EV, /* obsolete! */ 34 __UHID_LEGACY_OUTPUT_EV,
35 UHID_INPUT, 35 __UHID_LEGACY_INPUT,
36 UHID_FEATURE, 36 UHID_GET_REPORT,
37 UHID_FEATURE_ANSWER, 37 UHID_GET_REPORT_REPLY,
38 UHID_CREATE2, 38 UHID_CREATE2,
39 UHID_INPUT2, 39 UHID_INPUT2,
40 UHID_SET_REPORT,
41 UHID_SET_REPORT_REPLY,
40}; 42};
41 43
42struct uhid_create_req {
43 __u8 name[128];
44 __u8 phys[64];
45 __u8 uniq[64];
46 __u8 __user *rd_data;
47 __u16 rd_size;
48
49 __u16 bus;
50 __u32 vendor;
51 __u32 product;
52 __u32 version;
53 __u32 country;
54} __attribute__((__packed__));
55
56struct uhid_create2_req { 44struct uhid_create2_req {
57 __u8 name[128]; 45 __u8 name[128];
58 __u8 phys[64]; 46 __u8 phys[64];
@@ -66,6 +54,16 @@ struct uhid_create2_req {
66 __u8 rd_data[HID_MAX_DESCRIPTOR_SIZE]; 54 __u8 rd_data[HID_MAX_DESCRIPTOR_SIZE];
67} __attribute__((__packed__)); 55} __attribute__((__packed__));
68 56
57enum uhid_dev_flag {
58 UHID_DEV_NUMBERED_FEATURE_REPORTS = (1ULL << 0),
59 UHID_DEV_NUMBERED_OUTPUT_REPORTS = (1ULL << 1),
60 UHID_DEV_NUMBERED_INPUT_REPORTS = (1ULL << 2),
61};
62
63struct uhid_start_req {
64 __u64 dev_flags;
65};
66
69#define UHID_DATA_MAX 4096 67#define UHID_DATA_MAX 4096
70 68
71enum uhid_report_type { 69enum uhid_report_type {
@@ -74,36 +72,94 @@ enum uhid_report_type {
74 UHID_INPUT_REPORT, 72 UHID_INPUT_REPORT,
75}; 73};
76 74
77struct uhid_input_req { 75struct uhid_input2_req {
76 __u16 size;
77 __u8 data[UHID_DATA_MAX];
78} __attribute__((__packed__));
79
80struct uhid_output_req {
78 __u8 data[UHID_DATA_MAX]; 81 __u8 data[UHID_DATA_MAX];
79 __u16 size; 82 __u16 size;
83 __u8 rtype;
80} __attribute__((__packed__)); 84} __attribute__((__packed__));
81 85
82struct uhid_input2_req { 86struct uhid_get_report_req {
87 __u32 id;
88 __u8 rnum;
89 __u8 rtype;
90} __attribute__((__packed__));
91
92struct uhid_get_report_reply_req {
93 __u32 id;
94 __u16 err;
83 __u16 size; 95 __u16 size;
84 __u8 data[UHID_DATA_MAX]; 96 __u8 data[UHID_DATA_MAX];
85} __attribute__((__packed__)); 97} __attribute__((__packed__));
86 98
87struct uhid_output_req { 99struct uhid_set_report_req {
100 __u32 id;
101 __u8 rnum;
102 __u8 rtype;
103 __u16 size;
104 __u8 data[UHID_DATA_MAX];
105} __attribute__((__packed__));
106
107struct uhid_set_report_reply_req {
108 __u32 id;
109 __u16 err;
110} __attribute__((__packed__));
111
112/*
113 * Compat Layer
114 * All these commands and requests are obsolete. You should avoid using them in
115 * new code. We support them for backwards-compatibility, but you might not get
116 * access to new feature in case you use them.
117 */
118
119enum uhid_legacy_event_type {
120 UHID_CREATE = __UHID_LEGACY_CREATE,
121 UHID_OUTPUT_EV = __UHID_LEGACY_OUTPUT_EV,
122 UHID_INPUT = __UHID_LEGACY_INPUT,
123 UHID_FEATURE = UHID_GET_REPORT,
124 UHID_FEATURE_ANSWER = UHID_GET_REPORT_REPLY,
125};
126
127/* Obsolete! Use UHID_CREATE2. */
128struct uhid_create_req {
129 __u8 name[128];
130 __u8 phys[64];
131 __u8 uniq[64];
132 __u8 __user *rd_data;
133 __u16 rd_size;
134
135 __u16 bus;
136 __u32 vendor;
137 __u32 product;
138 __u32 version;
139 __u32 country;
140} __attribute__((__packed__));
141
142/* Obsolete! Use UHID_INPUT2. */
143struct uhid_input_req {
88 __u8 data[UHID_DATA_MAX]; 144 __u8 data[UHID_DATA_MAX];
89 __u16 size; 145 __u16 size;
90 __u8 rtype;
91} __attribute__((__packed__)); 146} __attribute__((__packed__));
92 147
93/* Obsolete! Newer kernels will no longer send these events but instead convert 148/* Obsolete! Kernel uses UHID_OUTPUT exclusively now. */
94 * it into raw output reports via UHID_OUTPUT. */
95struct uhid_output_ev_req { 149struct uhid_output_ev_req {
96 __u16 type; 150 __u16 type;
97 __u16 code; 151 __u16 code;
98 __s32 value; 152 __s32 value;
99} __attribute__((__packed__)); 153} __attribute__((__packed__));
100 154
155/* Obsolete! Kernel uses ABI compatible UHID_GET_REPORT. */
101struct uhid_feature_req { 156struct uhid_feature_req {
102 __u32 id; 157 __u32 id;
103 __u8 rnum; 158 __u8 rnum;
104 __u8 rtype; 159 __u8 rtype;
105} __attribute__((__packed__)); 160} __attribute__((__packed__));
106 161
162/* Obsolete! Use ABI compatible UHID_GET_REPORT_REPLY. */
107struct uhid_feature_answer_req { 163struct uhid_feature_answer_req {
108 __u32 id; 164 __u32 id;
109 __u16 err; 165 __u16 err;
@@ -111,6 +167,15 @@ struct uhid_feature_answer_req {
111 __u8 data[UHID_DATA_MAX]; 167 __u8 data[UHID_DATA_MAX];
112} __attribute__((__packed__)); 168} __attribute__((__packed__));
113 169
170/*
171 * UHID Events
172 * All UHID events from and to the kernel are encoded as "struct uhid_event".
173 * The "type" field contains a UHID_* type identifier. All payload depends on
174 * that type and can be accessed via ev->u.XYZ accordingly.
175 * If user-space writes short events, they're extended with 0s by the kernel. If
176 * the kernel writes short events, user-space shall extend them with 0s.
177 */
178
114struct uhid_event { 179struct uhid_event {
115 __u32 type; 180 __u32 type;
116 181
@@ -120,9 +185,14 @@ struct uhid_event {
120 struct uhid_output_req output; 185 struct uhid_output_req output;
121 struct uhid_output_ev_req output_ev; 186 struct uhid_output_ev_req output_ev;
122 struct uhid_feature_req feature; 187 struct uhid_feature_req feature;
188 struct uhid_get_report_req get_report;
123 struct uhid_feature_answer_req feature_answer; 189 struct uhid_feature_answer_req feature_answer;
190 struct uhid_get_report_reply_req get_report_reply;
124 struct uhid_create2_req create2; 191 struct uhid_create2_req create2;
125 struct uhid_input2_req input2; 192 struct uhid_input2_req input2;
193 struct uhid_set_report_req set_report;
194 struct uhid_set_report_reply_req set_report_reply;
195 struct uhid_start_req start;
126 } u; 196 } u;
127} __attribute__((__packed__)); 197} __attribute__((__packed__));
128 198
generated by cgit v1.2.2 (git 2.25.0) at 2026-01-07 18:58:36 -0500