Merge branches 'for-3.19/hid-report-len', 'for-3.19/i2c-hid', 'for-3.19/lenovo', 'for-3.19/logitech', 'for-3.19/microsoft', 'for-3.19/plantronics', 'for-3.19/rmi', 'for-3.19/sony' and 'for-3.19/wacom' into for-linus

If a touchpad does not report relative data then query 6 will not be present and the address
of query 8 will be one less. This patches calculates the location of query 8 instead of
hardcoding the offset.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

If a touchpad reports the F11 data40 register then this indicates that the touchpad reports
additional ACM (Accidental Contact Mitigation) data after the F11 data in the HID attention
report. These additional bytes shift the position of the F30 button data causing the driver
to incorrectly report button state when this functionality is present. This patch accounts
for the additional data in the report.

Fixes:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1398533Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Conflicts:
	drivers/hid/hid-input.c

Before ->start() is called, bufsize size is set to HID_MIN_BUFFER_SIZE,
64 bytes. While processing the IRQ, we were asking to receive up to
wMaxInputLength bytes, which can be bigger than 64 bytes.

Later, when ->start is run, a proper bufsize will be calculated.

Given wMaxInputLength is said to be unreliable in other part of the
code, set to receive only what we can even if it results in truncated
reports.
Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Balance a hid_device_io_start() call with hid_device_io_stop() in the
error path. This avoids processing of HID reports when the probe fails
which possibly leads to invalid memory access in hid_device_probe() as
report_enum->report_id_hash might already be freed via
hid_close_report().

hid_set_drvdata() is called before wtp_allocate, be consistent and clear
drvdata too on the error path of wtp_allocate.
Signed-off-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

The HID response has a limited size. Do not trust the value returned by
hardware, check that it really fits in the message.
Signed-off-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

hidpp_devicenametype_get_device_name() may return a negative value on
protocol errors (for example, when the device is powered off).
Explicitly check this condition to avoid a long-running loop.

(0 cannot be returned as __name_length - index > 0, but check for it
anyway as it would otherwise result in an infinite loop.)
Signed-off-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

We do not make any use of the actual name length get through
hidpp_get_device_name(). Original patch by Benjamin Tissoires, this
patch also replaces a (now) unnecessary goto by return NULL.
Signed-off-by: Peter Wu <peter@lekensteyn.nl>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

The existing generic touch code only reports events after reading an
entire HID report, which practically means that only data about the last
contact in a report will ever be provided to userspace. This patch uses
a trick from hid-multitouch.c to discover what type of field is at the
end of each contact; when such a field is encountered all the stored
contact data will be reported.
Signed-off-by: Jason Gerecke <killertofu@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

If a HID descriptor places HID_DG_CONTACTID before HID_DG_X and HID_DG_Y then
the ABS_X and ABS_Y will not be automatically initialized by the call to
input_mt_init_slots. To ensure that this is not a problem, we relocate that
call to occur after HID parsing has been completed and we've initalized all the
multitouch axes.
Signed-off-by: Jason Gerecke <killertofu@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Defined outbound offset for DTU and Cintiq. But didn't update
the relevant maximum values. Oops...
Signed-off-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Signed-off-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

There are screen to tablet offsets for newer Cintiq and DTU models.
These offsets serve as outbound tracking for those display tablets.

Use defines instead of hardcoded numbers for the offsets.
Signed-off-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Since the conversion from USB to HID (in v3.17), some people reported a
freeze on boot with the wacom driver. Hans managed to get a stacktrace:

[  240.272331] Call Trace:
[  240.272338]  [<ffffffff813de7b9>] ? usb_hcd_submit_urb+0xa9/0xb10
[  240.272347]  [<ffffffff81555579>] schedule+0x29/0x70
[  240.272355]  [<ffffffff815559e6>] schedule_preempt_disabled+0x16/0x20
[  240.272363]  [<ffffffff81557365>] __mutex_lock_slowpath+0xe5/0x230
[  240.272372]  [<ffffffff815574c7>] mutex_lock+0x17/0x30
[  240.272380]  [<ffffffffa063c1d2>] wacom_resume+0x22/0x50 [wacom]
[  240.272396]  [<ffffffffa01aea8a>] hid_resume_common+0xba/0x110 [usbhid]
[  240.272404]  [<ffffffff813e5890>] ? usb_runtime_suspend+0x80/0x80
[  240.272417]  [<ffffffffa01aeb1d>] hid_resume+0x3d/0x70 [usbhid]
[  240.272425]  [<ffffffff813e44a6>] usb_resume_interface.isra.6+0xb6/0x120
[  240.272432]  [<ffffffff813e4774>] usb_resume_both+0x74/0x140
[  240.272439]  [<ffffffff813e58aa>] usb_runtime_resume+0x1a/0x20
[  240.272446]  [<ffffffff813b1912>] __rpm_callback+0x32/0x70
[  240.272453]  [<ffffffff813b1976>] rpm_callback+0x26/0xa0
[  240.272460]  [<ffffffff813b2d71>] rpm_resume+0x4b1/0x690
[  240.272468]  [<ffffffff812ab992>] ? radix_tree_lookup_slot+0x22/0x50
[  240.272475]  [<ffffffff813b2c1a>] rpm_resume+0x35a/0x690
[  240.272482]  [<ffffffff8116e9c9>] ? zone_statistics+0x89/0xa0
[  240.272489]  [<ffffffff813b2f90>] __pm_runtime_resume+0x40/0x60
[  240.272497]  [<ffffffff813e4272>] usb_autopm_get_interface+0x22/0x60
[  240.272509]  [<ffffffffa01ae8d9>] usbhid_open+0x59/0xe0 [usbhid]
[  240.272517]  [<ffffffffa063ac85>] wacom_open+0x35/0x50 [wacom]
[  240.272525]  [<ffffffff813f37b9>] input_open_device+0x79/0xa0
[  240.272534]  [<ffffffffa048d1c1>] evdev_open+0x1b1/0x200 [evdev]
[  240.272543]  [<ffffffff811c899e>] chrdev_open+0xae/0x1f0
[  240.272549]  [<ffffffff811c88f0>] ? cdev_put+0x30/0x30
[  240.272556]  [<ffffffff811c17e2>] do_dentry_open+0x1d2/0x320
[  240.272562]  [<ffffffff811c1cd1>] finish_open+0x31/0x50
[  240.272571]  [<ffffffff811d2202>] do_last.isra.36+0x652/0xe50
[  240.272579]  [<ffffffff811d2ac7>] path_openat+0xc7/0x6f0
[  240.272586]  [<ffffffff811cf012>] ? final_putname+0x22/0x50
[  240.272594]  [<ffffffff811d42d2>] ? user_path_at_empty+0x72/0xd0
[  240.272602]  [<ffffffff811d43fd>] do_filp_open+0x4d/0xc0
[...]

So here, wacom_open is called, and then wacom_resume is called by the
PM system. However, wacom_open already took the lock when wacom_resume
tries to get it. Freeze.

A little bit of history shows that this already happened in the past
- commit f6cd3783 ("Input: wacom - fix runtime PM related deadlock"),
and the solution was to call first the PM function before taking the lock.

The lock was introduced in commit commit e7224094 ("Input: wacom -
implement suspend and autosuspend") when the autosuspend feature has
been added. Given that usbhid already takes care of this very same
locking between suspend/resume, I think we can simply kill the lock
in open/close.

The lock is now used also with LEDs, so we can not remove it completely.
Reported-by: Hans Spath <inbox-546@hans-spath.de>
Tested-by: Hans Spath <inbox-546@hans-spath.de>
CC: stable@vger.kernel.org # v3.17+
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Dropped in the following commit:

commit a3e6f654 ("Input: wacom - keep wacom_ids ordered")
Reported-by: Hans Spath <inbox-546@hans-spath.de>
CC: stable@vger.kernel.org    # v3.17+
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

In several hid drivers it is necessary to calculate the length of an
hid_report. This patch exports the existing static function hid_report_len of
hid-core.c as an inline function in hid.h
Signed-off-by: Mathieu Magnaudet <mathieu.magnaudet@enac.fr>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

It is not necessarily sufficient to look only at the physical and logical
usages when determining if a field is for the pen or touch. Some fields
are not contained in a sub-collection and thus only have an application
usage. Not checking the application usage in such cases causes us to
ignore the field entirely, which may lead to incorrect behavior.
Signed-off-by: Jason Gerecke <killertofu@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

PAD can be on pen interface (Intuos Pro and Cintiq series) or touch
interface (Bamboo PT and Intuos PT series) or its own interface
(Bamboo pen-only and Intuos Pen M/S). We need to mark it independently.
Signed-off-by: Ping Cheng <pingc@wacom.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

VTL panels do not switch to the multitouch mode until the input mode
feature is read by the host. This should normally be done by
usbhid, but it looks like an other bug prevents usbhid to properly
retrieve the feature state. As a workaround, we force the reading of
the feature in mt_set_input_mode for such devices.
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Mathieu Magnaudet <mathieu.magnaudet@enac.fr>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Current driver uses a common buffer for reading reports either
synchronously in i2c_hid_get_raw_report() and asynchronously in
the interrupt handler.
There is race condition if an interrupt arrives immediately after
the report is received in i2c_hid_get_raw_report(); the common
buffer is modified by the interrupt handler with the new report
and then i2c_hid_get_raw_report() proceed using wrong data.

Fix it by using a separate buffers for synchronous reports.
Signed-off-by: Jean-Baptiste Maneyrol <jmaneyrol@invensense.com>
[Antonio Borneo: cleanup, rebase to v3.17, submit mainline]
Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Provide the resolution of several angular axes (tilt, pen rotation, puck
rotation) to userspace. Because these values are natively degree-based, we
need to convert them to into units/radian as required by the input_absinfo
struct. To ensure wraparound behaves properly for the rotation axes, the
converted value was rounded up rather than rounded nearest.

Notably, the touchring axes (ABS_WHEEL and ABS_THROTTLE) are left without a
a declared resolution because the their low resolution cannot be accurately
represented (the worst-case rounding-induced error would be ~16 degrees).
Pre-scaling the values and range by at least 10x would reduce the error in
the resolution to acceptable levels, but the xf86-input-wacom driver is not
able to use pre-scaled values for these axes at this time.
Signed-off-by: Jason Gerecke <killertofu@gmail.com>
Reviewed-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Centers the ABS_TILT_{X,Y} axes so that a value of zero is reported when
the pen is vertical. Combined with resolution information in the next
patch, this makes it possible for userspace to calculate the pen angle
without needing hardware-specific knowledge. The xf86-input-wacom driver
was updated to support signed tilt values in late-2012 (2f2acec).
Signed-off-by: Jason Gerecke <killertofu@gmail.com>
Reviewed-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Bamboo models do not support HID_DG_CONTACTMAX. Plus, Bamboo pen-only
has touch descriptor. This leads to some complications in the code.

This patch also fixes duplicated PAD interfeaces for Intuos Pen
models.
Signed-off-by: Ping Cheng <pingc@wacom.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Graphire 4 only has two tablet buttons; Bamboo Fun touch ring is only
for PAD.
Signed-off-by: Ping Cheng <pingc@wacom.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

ENODEV indicates no device is added. Hence, the associated pad input device
is simply freed.
Signed-off-by: Ping Cheng <pingc@wacom.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Add vid/pid for the SMK branded third-party PS3 Bluetooth remote and enable
support in the hid-sony driver.
Signed-off-by: Frank Praznik <frank.praznik@oh.rr.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

The touchscreen needs the same quirk as the other models.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Reported-by: Bryan Poling <poli0048@umn.edu>
CC: stable@vger.kernel.org
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Replace stack buffers with kernel allocated buffers for sending
and receiving HID reports to prevent issues with DMA transfers
on certain hardware.

Output report buffers are allocated at initialization time to avoid
excessive calls to kmalloc and kfree.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=87991Signed-off-by: Frank Praznik <frank.praznik@oh.rr.com>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Report is received in "buffer"; fix the following i2c_hid_dbg()
to dump data from the correct pointer.
Signed-off-by: Jean-Baptiste Maneyrol <jmaneyrol@invensense.com>
[Antonio Borneo: cleanup and rebase to v3.17]
Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Pull HID fixes from Jiri Kosina:

 - fix for an oops in HID core upon repeated subdriver insertion/removal
   under certain circumstances, by Benjamin Tissoires

 - quirk for another Elan Touchscreen device, by Adel Gadllah

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: core: cleanup .claimed field on disconnect
  HID: usbhid: enable always-poll quirk for Elan Touchscreen 0103

Pull sound fixes from Takashi Iwai:
 "Things get calming down, now we have only a few fix patches: a trivial
  fix for memory leak in usb-audio, a patch for the new HD-audio PCI id,
  a device-specific mute-LED fix, and a slightly big patch to cover the
  missing COEF inits of various Realtek codecs"

* tag 'sound-3.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda - Add mute LED control for Lenovo Ideapad Z560
  ALSA: hda/realtek - Change EAPD to verb control
  ALSA: usb-audio: Fix memory leak in FTU quirk
  ALSA: hda_intel: Add DeviceIDs for Sunrise Point-LP

Pull SELinux fixlet from James Morris:
 "WARN_ONCE() here will unnecessarily terrify users"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  selinux: convert WARN_ONCE() to printk() in selinux_nlmsg_perm()

Pull audit fixes from Paul Moore:
 "After he sent the initial audit pull request for 3.18, Eric asked me
  to take over the management of the audit tree, hence this pull request
  to fix a couple of problems with audit.

  As you can see below, the changes are minimal: adding some whitespace
  to a string so userspace parses it correctly, and fixing a problem
  with audit's usage of fsnotify that was causing audit watch rules to
  be lost.  Neither of these patches were very controversial on the
  mailing lists and they fix real problems, getting them into 3.18 would
  be a good thing"

* 'stable-3.18' of git://git.infradead.org/users/pcmoore/audit:
  audit: keep inode pinned
  audit: AUDIT_FEATURE_CHANGE message format missing delimiting space

Pull device mapper fixes from Mike Snitzer:

 - stable fix for dm-thin that avoids normal IO racing with discard

 - stable fix for a dm-cache related bug in dm-btree walking code that
   results from using very large fast device (eg 4T) with a very small
   cache blocksize (eg 32K) -- this is a very uncommon configuration

 - a couple fixes for dm-raid (one for stable and the other addresses a
   crash in 3.18-rc1 code)

 - stable fix for dm-thinp that addresses a very rare dm-bufio bug
   having to do with memory reclaimation (via shrinker) when using
   dm-thinp ontop of loopback devices

 - fix a leak in dm-stripe target constructor's error path

* tag 'dm-3.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm btree: fix a recursion depth bug in btree walking code
  dm thin: grab a virtual cell before looking up the mapping
  dm raid: fix inaccessible superblocks causing oops in configure_discard_support
  dm raid: ensure superblock's size matches device's logical block size
  dm bufio: change __GFP_IO to __GFP_FS in shrinker callbacks
  dm stripe: fix potential for leak in stripe_ctr error path

Lenovo Ideapad Z560 has a mute LED that is controlled via EAPD pin
0x1b on CX20585 codec.  (EAPD bit on corresponds to mute LED on.)
The machine doesn't need other EAPD, so the fixup concentrates on
controlling EAPD 0x1b following the vmaster state (but inversely).

Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=665315Reported-by: Szymon Kowalczyk <fazerxlo@o2.pl>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Pull kvm fixes from Paolo Bonzini:
 "Two fixes --- one of them not exactly a one liner, but things are
  calming down on the KVM front at last"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: x86: Fix uninitialized op->type for some immediate values
  KVM: s390: virtio_ccw: remove unused variable

Pull Xtensa fixes from Chris Zankel:
 - fix umount syscall
 - fix ISS and xtfpga Kconfig dependencies so that more randconfigs are
   buildable
 - add seccomp, getrandom, and memfd_create syscalls
 - add defconfigs for KC705 and SMP LX200
 - implement pgprot_noncached

* tag 'xtensa-20141109' of git://github.com/czankel/xtensa-linux:
  xtensa: xtfpga: add lx200 SMP DTS and defconfig
  xtensa: xtfpga: add generic KC705 board config
  xtensa: re-wire umount syscall to sys_oldumount
  xtensa: xtfpga: only select ethoc when ethernet is available
  xtensa: add seccomp, getrandom, and memfd_create syscalls
  xtensa: ISS: add BLOCK dependency to BLK_DEV_SIMDISK
  xtensa: implement pgprot_noncached
  xtensa/uapi: Add definition of TIOC[SG]RS485

Pull crypto fixes from Herbert Xu:
 - stack corruption fix for pseries hwrng driver
 - add missing DMA unmap in caam crypto driver
 - fix NUMA crash in qat crypto driver
 - fix buggy mapping of zero-length associated data in qat crypto driver

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  hwrng: pseries - port to new read API and fix stack corruption
  crypto: caam - fix missing dma unmap on error path
  crypto: qat - Enforce valid numa configuration
  crypto: qat - Prevent dma mapping zero length assoc data