linux-toradex.git/drivers/hid/i2c-hid, branch v4.10

HID: i2c-hid: Add sleep between POWER ON and RESET

2017-01-11T20:55:35+00:00

Support for the Asus Touchpad was recently added. It turns out this
device can fail initialisation (and become unusable) when the RESET
command is sent too soon after the POWER ON command.

Unfortunately the i2c-hid specification does not specify the need for
a delay between these two commands. But it was discovered the Windows
driver has a 1ms delay.

As a result, this patch modifies the i2c-hid module to add a sleep
inbetween the POWER ON and RESET commands which lasts between 1ms and 5ms.

See https://github.com/vlasenko/hid-asus-dkms/issues/24 for further
details.

Signed-off-by: Brendan McGrath 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

HID: fix missing irq field

2016-12-12T08:47:31+00:00

commit ba18a9314a94 ("Revert "HID: i2c-hid: Add support for ACPI GPIO
interrupts"") removed the need for storing the irq in struct i2c_hid.

But then commit de3c99488609 ("HID: i2c-hid: Disable IRQ before freeing
buffers") forgot to update the location of the irq.

Fix this by using the actual I2C client irq.

Reported-by: kbuild test robot 
Signed-off-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

HID: i2c-hid: fix build

2016-12-12T08:47:01+00:00

Add a forgotten include that I've by mistake omitted when resolving
merge conflict in ead0687fe30 ("HID: i2c-hid: support regulator power
on/off").

Fixes: ead0687fe30 ("HID: i2c-hid: support regulator power on/off")
Reported-by: kbuild test robot 
Signed-off-by: Jiri Kosina

HID: i2c-hid: Disable IRQ before freeing buffers

2016-12-12T08:47:01+00:00

The HID report buffers that are initially allocated on i2c_hid_probe()
might not be big enough to hold the HID reports from a specific device,
in which case they will be freed and new ones will be allocated in
i2c_hid_start(), at point which the device's report size is known. But
at this point ihid->irq is already running, and may call
i2c_hid_get_input() which passes ihid->inbuf to i2c_master_recv(). Since
this handler runs in a separate thread, ihid->inbuf may be freed at this
very moment, and i2c_master_recv() will write on memory which may be
already owned by a different part of the kernel, corrupting its data.

This problem has been observed on an Asus UX360UA laptop which has an
I2C touchpad, and results in a complete system freeze or an unusable
slowness with a lof of "BUG: unable to handle kernel paging request at
" warnings. Enabling SLUB debugging shows a use-after-free
warning on memory allocated in i2c_hid_alloc_buffers() and freed in
i2c_hid_free_buffers():

=============================================================================
BUG kmalloc-64 (Not tainted): Poison overwritten
-----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: 0xffff880264083273-0xffff88026408329e. first byte 0x0 instead of 0x6b
INFO: Allocated in i2c_hid_alloc_buffers+0x25/0xa0 [i2c_hid] age=35793 cpu=2 pid=430
	___slab_alloc+0x41e/0x460
	__slab_alloc+0x20/0x40
	__kmalloc+0x210/0x280
	i2c_hid_alloc_buffers+0x25/0xa0 [i2c_hid]
	i2c_hid_probe+0x12f/0x5e0 [i2c_hid]
	i2c_device_probe+0x10a/0x1b0
	driver_probe_device+0x220/0x4a0
	__device_attach_driver+0x71/0xa0
	bus_for_each_drv+0x67/0xb0
	__device_attach+0xdc/0x170
	device_initial_probe+0x13/0x20
	bus_probe_device+0x92/0xa0
	device_add+0x4aa/0x670
	device_register+0x1a/0x20
	i2c_new_device+0x18e/0x230
	acpi_i2c_add_device+0x1a0/0x210
INFO: Freed in i2c_hid_free_buffers+0x16/0x60 [i2c_hid] age=7552 cpu=1 pid=1473
	__slab_free+0x221/0x330
	kfree+0x139/0x160
	i2c_hid_free_buffers+0x16/0x60 [i2c_hid]
	i2c_hid_start+0x2a9/0x2df [i2c_hid]
	mt_probe+0x160/0x22e [hid_multitouch]
	hid_device_probe+0xd7/0x150 [hid]
	driver_probe_device+0x220/0x4a0
	__driver_attach+0x84/0x90
	bus_for_each_dev+0x6c/0xc0
	driver_attach+0x1e/0x20
	bus_add_driver+0x1c3/0x280
	driver_register+0x60/0xe0
	__hid_register_driver+0x53/0x90 [hid]
	0xffffffffc004f01e
	do_one_initcall+0xb3/0x1f0
	do_init_module+0x5f/0x1d0
INFO: Slab 0xffffea0009902080 objects=20 used=20 fp=0x          (null) flags=0x17fff8000004080
INFO: Object 0xffff880264083260 @offset=4704 fp=0x          (null)
Bytes b4 ffff880264083250: 8d e6 fe ff 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a  ........ZZZZZZZZ
Object ffff880264083260: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Object ffff880264083270: 6b 6b 6b 00 00 00 00 00 00 00 00 00 00 00 00 00  kkk.............
Object ffff880264083280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
Object ffff880264083290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
Redzone ffff8802640832a0: bb bb bb bb bb bb bb bb                          ........
Padding ffff8802640833e0: 5a 5a 5a 5a 5a 5a 5a 5a                          ZZZZZZZZ
CPU: 1 PID: 1503 Comm: python3 Tainted: G    B           4.4.21+ #10
Hardware name: ASUSTeK COMPUTER INC. UX360UA/UX360UA, BIOS UX360UA.200 05/05/2016
 0000000000000086 00000000622d48a2 ffff88026061ba38 ffffffff813f6044
 ffff880264082010 ffff880264083260 ffff88026061ba78 ffffffff811e8eab
 0000000000000008 ffff880200000001 ffff88026408329f ffff88026a007700
Call Trace:
 [] dump_stack+0x63/0x8f
 [] print_trailer+0x14b/0x1f0
 [] check_bytes_and_report+0xc1/0x100
 [] check_object+0x1c4/0x240
 [] ? ext4_htree_store_dirent+0x3e/0x120
 [] alloc_debug_processing+0x104/0x180
 [] ___slab_alloc+0x41e/0x460
 [] ? ext4_htree_store_dirent+0x3e/0x120
 [] ? __getblk_gfp+0x2b/0x60
 [] ? ext4_getblk+0xa9/0x190
 [] __slab_alloc+0x20/0x40
 [] __kmalloc+0x210/0x280
 [] ? ext4_htree_store_dirent+0x3e/0x120
 [] ? ext4fs_dirhash+0xc2/0x2a0
 [] ext4_htree_store_dirent+0x3e/0x120
 [] htree_dirblock_to_tree+0x187/0x1b0
 [] ext4_htree_fill_tree+0xb2/0x2e0
 [] ? kmem_cache_alloc_trace+0x1fa/0x220
 [] ? ext4_readdir+0x775/0x8b0
 [] ext4_readdir+0x5e1/0x8b0
 [] iterate_dir+0x92/0x120
 [] SyS_getdents+0x98/0x110
 [] ? iterate_dir+0x120/0x120
 [] entry_SYSCALL_64_fastpath+0x16/0x71
FIX kmalloc-64: Restoring 0xffff880264083273-0xffff88026408329e=0x6b
FIX kmalloc-64: Marking all objects used

Signed-off-by: João Paulo Rechi Vita 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

HID: i2c-hid: force the IRQ level trigger only when not set

2016-11-28T13:42:53+00:00

Instead of forcing the level trigger of the IRQ, we can count
on ACPI or OF to set it up for us.

The first release of the HID over I2C specification mentioned
that the level trigger needed to be active low. In the latest
version of the specification, there is no such explicit mention,
so it's better to not assume one.

Signed-off-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

HID: i2c-hid: add a simple quirk to fix device defects

2016-11-10T09:23:31+00:00

Certain devices produced by Weida Tech need to have a wakeup command sent to
them before powering on. The call itself will come back with error, but the
device can be powered on afterwards.

[jkosina@suse.cz: rewrite changelog]
[jkosina@suse.cz: remove unused device ID addition]
Signed-off-by: HungNien Chen 
Reviewed-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

HID: i2c-hid: exit if the IRQ is not valid

2016-10-14T14:02:05+00:00

When i2c-core doesn't find the IRQ associated to the GPIO because
the gpiochip is not available, it assigns -EPROBE_DEFER to the irq.
We need to bail out there and on any other error in an IRQ.

Signed-off-by: David Arcari 
Signed-off-by: Benjamin Tissoires 
Reviewed-by: Mika Westerberg 
Signed-off-by: Jiri Kosina

Revert "HID: i2c-hid: Add support for ACPI GPIO interrupts"

2016-10-14T14:02:05+00:00

This reverts commit a485923efbb8 ("HID: i2c-hid: Add support for ACPI
GPIO interrupts") and commit a7d2bf25a483 ("HID: i2c-hid: Do not fail
probing if gpiolib is not enabled") at the same time.

Since commit c884fbd45214 ("gpio / ACPI: Add support for retrieving
GpioInt resources from a device") i2c_core already set the IRQ by
looking into the ACPI tree and retrieving the gpioInt. So we just
have some boiler-plate here that is not needed anymore.

The only downside effect here is that now we are not exiting early
enough if the irq is set to -EPROBE_DEFER or any other error, but
this is going to be fixed in the following patch.

Signed-off-by: David Arcari 
Signed-off-by: Benjamin Tissoires 
Reviewed-by: Mika Westerberg 
Signed-off-by: Jiri Kosina

HID: i2c-hid: set power sleep before shutdown

2016-06-21T11:07:15+00:00

Add i2c_hid_shutdown for i2c-hid driver to send suspend cmd & free
irq before device shutdown.

Some HW design (i.e. Umaro, a chromebook model) is that the power to
i2c hid device won't down after device shutdown. Also the i2c-hid driver
do not send suspend cmd to the hid i2c device and free its irq before
shutdown.So if We touch the touchscreen or some other i2c hid device,
the power consumtion will be go up even when the device is in shutdown
state.

Though the root cause maybe a HW issue. But it seems that it is a
good pratice to set power sleep for i2c-hid device before shutdown.

Signed-off-by: Guohua Zhong 
Acked-By: Benjamin Tissoires 
Signed-off-by: Jiri Kosina

HID: i2c_hid: enable i2c-hid devices to suspend/resume asynchronously

2016-06-06T08:40:59+00:00

i2c-hid devices' suspend/resume are usually time-consuming process.
For example, the touch controller(i2c-ATML1000:00) on ASUS T100 tablet
takes about 160ms for suspending and 120ms for resuming. This patch
enables i2c-hid devices to suspend/resume asynchronously. This will
take advantage of multicore and speed up system suspend/resume process.

Signed-off-by: Zhonghui Fu 
Acked-by: Benjamin Tissoires 
Signed-off-by: Jiri Kosina