linux-toradex.git/drivers/hid/wacom_wac.c, branch v5.18

HID: wacom: Avoid using stale array indicies to read contact count

2022-01-21T14:10:02+00:00

If we ever see a touch report with contact count data we initialize
several variables used to read the contact count in the pre-report
phase. These variables are never reset if we process a report which
doesn't contain a contact count, however. This can cause the pre-
report function to trigger a read of arbitrary memory (e.g. NULL
if we're lucky) and potentially crash the driver.

This commit restores resetting of the variables back to default
"none" values that were used prior to the commit mentioned
below.

Link: https://github.com/linuxwacom/input-wacom/issues/276
Fixes: 003f50ab673c (HID: wacom: Update last_slot_field during pre_report phase)
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke 
Reviewed-by: Ping Cheng 
Signed-off-by: Jiri Kosina

HID: wacom: Ignore the confidence flag when a touch is removed

2022-01-21T14:10:02+00:00

AES hardware may internally re-classify a contact that it thought was
intentional as a palm. Intentional contacts are reported as "down" with
the confidence bit set. When this re-classification occurs, however, the
state transitions to "up" with the confidence bit cleared. This kind of
transition appears to be legal according to Microsoft docs, but we do
not handle it correctly. Because the confidence bit is clear, we don't
call `wacom_wac_finger_slot` and update userspace. This causes hung
touches that confuse userspace and interfere with pen arbitration.

This commit adds a special case to ignore the confidence flag if a contact
is reported as removed. This ensures we do not leave a hung touch if one
of these re-classification events occured. Ideally we'd have some way to
also let userspace know that the touch has been re-classified as a palm
and needs to be canceled, but that's not possible right now :)

Link: https://github.com/linuxwacom/input-wacom/issues/288
Fixes: 7fb0413baa7f (HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts)
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke 
Reviewed-by: Ping Cheng 
Signed-off-by: Jiri Kosina

HID: wacom: Reset expected and received contact counts at the same time

2022-01-21T14:10:02+00:00

These two values go hand-in-hand and must be valid for the driver to
behave correctly. We are currently lazy about updating the values and
rely on the "expected" code flow to take care of making sure they're
valid at the point they're needed. The "expected" flow changed somewhat
with commit f8b6a74719b5 ("HID: wacom: generic: Support multiple tools
per report"), however. This led to problems with the DTH-2452 due (in
part) to *all* contacts being fully processed -- even those past the
expected contact count. Specifically, the received count gets reset to
0 once all expected fingers are processed, but not the expected count.
The rest of the contacts in the report are then *also* processed since
now the driver thinks we've only processed 0 of N expected contacts.

Later commits such as 7fb0413baa7f (HID: wacom: Use "Confidence" flag to
prevent reporting invalid contacts) worked around the DTH-2452 issue by
skipping the invalid contacts at the end of the report, but this is not
a complete fix. The confidence flag cannot be relied on when a contact
is removed (see the following patch), and dealing with that condition
re-introduces the DTH-2452 issue unless we also address this contact
count laziness. By resetting expected and received counts at the same
time we ensure the driver understands that there are 0 more contacts
expected in the report. Similarly, we also make sure to reset the
received count if for some reason we're out of sync in the pre-report
phase.

Link: https://github.com/linuxwacom/input-wacom/issues/288
Fixes: f8b6a74719b5 ("HID: wacom: generic: Support multiple tools per report")
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke 
Reviewed-by: Ping Cheng 
Signed-off-by: Jiri Kosina

HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts

2021-11-10T09:02:06+00:00

The HID descriptor of many of Wacom's touch input devices include a
"Confidence" usage that signals if a particular touch collection contains
useful data. The driver does not look at this flag, however, which causes
even invalid contacts to be reported to userspace. A lucky combination of
kernel event filtering and device behavior (specifically: contact ID 0 ==
invalid, contact ID >0 == valid; and order all data so that all valid
contacts are reported before any invalid contacts) spare most devices from
any visibly-bad behavior.

The DTH-2452 is one example of an unlucky device that misbehaves. It uses
ID 0 for both the first valid contact and all invalid contacts. Because
we report both the valid and invalid contacts, the kernel reports that
contact 0 first goes down (valid) and then goes up (invalid) in every
report. This causes ~100 clicks per second simply by touching the screen.

This patch inroduces new `confidence` flag in our `hid_data` structure.
The value is initially set to `true` at the start of a report and can be
set to `false` if an invalid touch usage is seen.

Link: https://github.com/linuxwacom/input-wacom/issues/270
Fixes: f8b6a74719b5 ("HID: wacom: generic: Support multiple tools per report")
Signed-off-by: Jason Gerecke 
Tested-by: Joshua Dickens 
Cc: 
Signed-off-by: Jiri Kosina

HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs

2021-09-15T15:20:15+00:00

Add the new PIDs to wacom_wac.c to support the new models in the Intuos series.

[jkosina@suse.cz: fix changelog]
Signed-off-by: Joshua Dickens 
Reviewed-by: Ping Cheng 
Signed-off-by: Jiri Kosina

HID: wacom: Refactor touch input mute checks into a common function

2021-07-28T09:45:41+00:00

We perform this same set of tests to see if touch input is muted in
several places. We might as well replace these independent copies with
an inline function.

Signed-off-by: Jason Gerecke 
Signed-off-by: Jiri Kosina

HID: wacom: Avoid sending empty sync events

2021-07-28T09:45:40+00:00

Empty sync events clutter up logs and are a waste of CPU cycles. We can
avoid sending mt_sync events if touch is disabled or a specific slot is
unused. We can avoid sending full sync events if no events were generated.

Signed-off-by: Ping Cheng 
Signed-off-by: Jason Gerecke 
Signed-off-by: Jiri Kosina

HID: wacom: Short-circuit processing of touch when it is disabled

2021-07-28T09:45:40+00:00

Avoid doing unnecessary work when touch is disabled by detecting this
condition and returning early. Note that the probe process sends GET
FEATURE requests to discover e.g. HID_DG_CONTACTMAX, so we can't start
ignoring touch reports until probe finishes.

Signed-off-by: Ping Cheng 
Signed-off-by: Jason Gerecke 
Signed-off-by: Jiri Kosina

HID: wacom: set initial hardware touch switch state to 'off'

2021-07-28T09:45:40+00:00

Wacom touch devices have two types of touch switches: softkey touch
toggle and hardware touch switch. For softkey toggle, we assume
touch is on by default in the driver. However the hardware touch
switch is controlled by end users. We don't know if it's on or off
before getting the status event.

This patch sets touch off for devices with a hardware switch until we
get the status. This is a bit safer for users who leave the switch "off"
and don't want any accidental touches. The tradeoff is a slight delay
between device connection and touch becoming enabled for users who
leave the switch "on".

Signed-off-by: Ping Cheng 
Reviewed-by: Jason Gerecke 
Tested-by: Jason Gerecke 
Signed-off-by: Jiri Kosina

HID: wacom: Skip processing of touches with negative slot values

2021-07-28T09:43:48+00:00

The `input_mt_get_slot_by_key` function may return a negative value
if an error occurs (e.g. running out of slots). If this occurs we
should really avoid reporting any data for the slot.

Signed-off-by: Ping Cheng 
Signed-off-by: Jason Gerecke 
Signed-off-by: Jiri Kosina