[PATCH] HID: input: do not run GET_REPORT unless there's a Resolution Multiplier

[PATCH] HID: input: do not run GET_REPORT unless there's a Resolution Multiplier

[Peter Hutterer]

hid-multitouch currently runs GET_REPORT for Contact Max and again to
retrieve the Win8 blob. If both are within the same report, the
Resolution Multiplier code calls GET_FEATURE again and this time,
possibly due to timing, it causes the ILITEK-TP device interpret the
GET_FEATURE as an instruction to change the mode and effectively stop
the device from functioning as expected.

Notably: the device doesn't even have a Resolution Multiplier so it
shouldn't be affected by any of this at all. 

Fix this by making sure we only execute GET_REPORT if there is 
a Resolution Multiplier in the respective report.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Wen He <wen.he_1@nxp.com>
---
 drivers/hid/hid-input.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git drivers/hid/hid-input.c drivers/hid/hid-input.c
index dea9cc65bf80..a54824d451bf 100644
--- drivers/hid/hid-input.c
+++ drivers/hid/hid-input.c
@@ -1560,21 +1560,12 @@ static bool __hidinput_change_resolution_multipliers(struct hid_device *hid,
 {
 	struct hid_usage *usage;
 	bool update_needed = false;
+	bool get_report_completed = false;
 	int i, j;
 
 	if (report->maxfield == 0)
 		return false;
 
-	/*
-	 * If we have more than one feature within this report we
-	 * need to fill in the bits from the others before we can
-	 * overwrite the ones for the Resolution Multiplier.
-	 */
-	if (report->maxfield > 1) {
-		hid_hw_request(hid, report, HID_REQ_GET_REPORT);
-		hid_hw_wait(hid);
-	}
-
 	for (i = 0; i < report->maxfield; i++) {
 		__s32 value = use_logical_max ?
 			      report->field[i]->logical_maximum :
@@ -1593,6 +1584,17 @@ static bool __hidinput_change_resolution_multipliers(struct hid_device *hid,
 			if (usage->hid != HID_GD_RESOLUTION_MULTIPLIER)
 				continue;
 
+			/*
+			 * If we have more than one feature within this report we
+			 * need to fill in the bits from the others before we can
+			 * overwrite the ones for the Resolution Multiplier.
+			 */
+			if (!get_report_completed && report->maxfield > 1) {
+				hid_hw_request(hid, report, HID_REQ_GET_REPORT);
+				hid_hw_wait(hid);
+				get_report_completed = true;
+			}
+
 			report->field[i]->value[j] = value;
 			update_needed = true;
 		}
-- 
2.26.2

Re: [PATCH] HID: input: do not run GET_REPORT unless there's a Resolution Multiplier

[Benjamin Tissoires]

Hey,

On Thu, May 14, 2020 at 1:14 PM Peter Hutterer <peter.hutterer@who-t.net> wrote:
>
> hid-multitouch currently runs GET_REPORT for Contact Max and again to
> retrieve the Win8 blob. If both are within the same report, the
> Resolution Multiplier code calls GET_FEATURE again and this time,
> possibly due to timing, it causes the ILITEK-TP device interpret the
> GET_FEATURE as an instruction to change the mode and effectively stop
> the device from functioning as expected.
>
> Notably: the device doesn't even have a Resolution Multiplier so it
> shouldn't be affected by any of this at all.
>
> Fix this by making sure we only execute GET_REPORT if there is
> a Resolution Multiplier in the respective report.
>
> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
> Tested-by: Wen He <wen.he_1@nxp.com>
> ---
>  drivers/hid/hid-input.c | 22 ++++++++++++----------
>  1 file changed, 12 insertions(+), 10 deletions(-)
>
> diff --git drivers/hid/hid-input.c drivers/hid/hid-input.c

Seems like you git format-patch is still busted, you are lacking the
'a/' and 'b/' in front of the files, and so the patch fails to apply
because 'hid/hid-input.c' is not in the tree.

Cheers,
Benjamin

> index dea9cc65bf80..a54824d451bf 100644
> --- drivers/hid/hid-input.c
> +++ drivers/hid/hid-input.c
> @@ -1560,21 +1560,12 @@ static bool __hidinput_change_resolution_multipliers(struct hid_device *hid,
>  {
>         struct hid_usage *usage;
>         bool update_needed = false;
> +       bool get_report_completed = false;
>         int i, j;
>
>         if (report->maxfield == 0)
>                 return false;
>
> -       /*
> -        * If we have more than one feature within this report we
> -        * need to fill in the bits from the others before we can
> -        * overwrite the ones for the Resolution Multiplier.
> -        */
> -       if (report->maxfield > 1) {
> -               hid_hw_request(hid, report, HID_REQ_GET_REPORT);
> -               hid_hw_wait(hid);
> -       }
> -
>         for (i = 0; i < report->maxfield; i++) {
>                 __s32 value = use_logical_max ?
>                               report->field[i]->logical_maximum :
> @@ -1593,6 +1584,17 @@ static bool __hidinput_change_resolution_multipliers(struct hid_device *hid,
>                         if (usage->hid != HID_GD_RESOLUTION_MULTIPLIER)
>                                 continue;
>
> +                       /*
> +                        * If we have more than one feature within this report we
> +                        * need to fill in the bits from the others before we can
> +                        * overwrite the ones for the Resolution Multiplier.
> +                        */
> +                       if (!get_report_completed && report->maxfield > 1) {
> +                               hid_hw_request(hid, report, HID_REQ_GET_REPORT);
> +                               hid_hw_wait(hid);
> +                               get_report_completed = true;
> +                       }
> +
>                         report->field[i]->value[j] = value;
>                         update_needed = true;
>                 }
> --
> 2.26.2
>

[PATCH RESEND] HID: input: do not run GET_REPORT unless there's a Resolution Multiplier

[Peter Hutterer]

hid-multitouch currently runs GET_REPORT for Contact Max and again to
retrieve the Win8 blob. If both are within the same report, the
Resolution Multiplier code calls GET_FEATURE again and this time,
possibly due to timing, it causes the ILITEK-TP device interpret the
GET_FEATURE as an instruction to change the mode and effectively stop
the device from functioning as expected.

Notably: the device doesn't even have a Resolution Multiplier so it
shouldn't be affected by any of this at all.

Fix this by making sure we only execute GET_REPORT if there is
a Resolution Multiplier in the respective report.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Wen He <wen.he_1@nxp.com>
---
Same patch as before, but this time with diff.noprefix set to false again.
Too bad that setting messes up format-patch :( Apologies for the broken
one.

 drivers/hid/hid-input.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index dea9cc65bf80..a54824d451bf 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -1560,21 +1560,12 @@ static bool __hidinput_change_resolution_multipliers(struct hid_device *hid,
 {
 	struct hid_usage *usage;
 	bool update_needed = false;
+	bool get_report_completed = false;
 	int i, j;
 
 	if (report->maxfield == 0)
 		return false;
 
-	/*
-	 * If we have more than one feature within this report we
-	 * need to fill in the bits from the others before we can
-	 * overwrite the ones for the Resolution Multiplier.
-	 */
-	if (report->maxfield > 1) {
-		hid_hw_request(hid, report, HID_REQ_GET_REPORT);
-		hid_hw_wait(hid);
-	}
-
 	for (i = 0; i < report->maxfield; i++) {
 		__s32 value = use_logical_max ?
 			      report->field[i]->logical_maximum :
@@ -1593,6 +1584,17 @@ static bool __hidinput_change_resolution_multipliers(struct hid_device *hid,
 			if (usage->hid != HID_GD_RESOLUTION_MULTIPLIER)
 				continue;
 
+			/*
+			 * If we have more than one feature within this report we
+			 * need to fill in the bits from the others before we can
+			 * overwrite the ones for the Resolution Multiplier.
+			 */
+			if (!get_report_completed && report->maxfield > 1) {
+				hid_hw_request(hid, report, HID_REQ_GET_REPORT);
+				hid_hw_wait(hid);
+				get_report_completed = true;
+			}
+
 			report->field[i]->value[j] = value;
 			update_needed = true;
 		}
-- 
2.26.2

Re: [PATCH RESEND] HID: input: do not run GET_REPORT unless there's a Resolution Multiplier

[Benjamin Tissoires]

Hi Peter,

On Fri, May 15, 2020 at 12:49 AM Peter Hutterer
<peter.hutterer@who-t.net> wrote:
>
> hid-multitouch currently runs GET_REPORT for Contact Max and again to
> retrieve the Win8 blob. If both are within the same report, the
> Resolution Multiplier code calls GET_FEATURE again and this time,
> possibly due to timing, it causes the ILITEK-TP device interpret the
> GET_FEATURE as an instruction to change the mode and effectively stop
> the device from functioning as expected.
>
> Notably: the device doesn't even have a Resolution Multiplier so it
> shouldn't be affected by any of this at all.
>
> Fix this by making sure we only execute GET_REPORT if there is
> a Resolution Multiplier in the respective report.
>
> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
> Tested-by: Wen He <wen.he_1@nxp.com>
> ---
> Same patch as before, but this time with diff.noprefix set to false again.
> Too bad that setting messes up format-patch :( Apologies for the broken
> one.

Thanks for the quick respin. I was about to apply it, and then I
realized that something was off (see inlined)

>
>  drivers/hid/hid-input.c | 22 ++++++++++++----------
>  1 file changed, 12 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
> index dea9cc65bf80..a54824d451bf 100644
> --- a/drivers/hid/hid-input.c
> +++ b/drivers/hid/hid-input.c
> @@ -1560,21 +1560,12 @@ static bool __hidinput_change_resolution_multipliers(struct hid_device *hid,
>  {
>         struct hid_usage *usage;
>         bool update_needed = false;
> +       bool get_report_completed = false;
>         int i, j;
>
>         if (report->maxfield == 0)
>                 return false;
>
> -       /*
> -        * If we have more than one feature within this report we
> -        * need to fill in the bits from the others before we can
> -        * overwrite the ones for the Resolution Multiplier.
> -        */
> -       if (report->maxfield > 1) {
> -               hid_hw_request(hid, report, HID_REQ_GET_REPORT);
> -               hid_hw_wait(hid);
> -       }
> -
>         for (i = 0; i < report->maxfield; i++) {
>                 __s32 value = use_logical_max ?
>                               report->field[i]->logical_maximum :
> @@ -1593,6 +1584,17 @@ static bool __hidinput_change_resolution_multipliers(struct hid_device *hid,
>                         if (usage->hid != HID_GD_RESOLUTION_MULTIPLIER)
>                                 continue;
>
> +                       /*
> +                        * If we have more than one feature within this report we
> +                        * need to fill in the bits from the others before we can
> +                        * overwrite the ones for the Resolution Multiplier.
> +                        */
> +                       if (!get_report_completed && report->maxfield > 1) {
> +                               hid_hw_request(hid, report, HID_REQ_GET_REPORT);

I think here we said that the reading of this particular feature was
mandatory by Microsoft, but what if a device doesn't like it.
I wonder if we should not guard this against HID_QUIRK_NO_INIT_REPORTS
too, in the event we need to quirk a particular device.

(BTW, I prefer this version compared to the first draft you sent me :-P )

Cheers,
Benjamin

> +                               hid_hw_wait(hid);
> +                               get_report_completed = true;
> +                       }
> +
>                         report->field[i]->value[j] = value;
>                         update_needed = true;
>                 }
> --
> 2.26.2
>

Re: [PATCH RESEND] HID: input: do not run GET_REPORT unless there's a Resolution Multiplier

[Peter Hutterer]

On Fri, May 15, 2020 at 09:48:18AM +0200, Benjamin Tissoires wrote:
> Hi Peter,
> 
> On Fri, May 15, 2020 at 12:49 AM Peter Hutterer
> <peter.hutterer@who-t.net> wrote:
> >
> > hid-multitouch currently runs GET_REPORT for Contact Max and again to
> > retrieve the Win8 blob. If both are within the same report, the
> > Resolution Multiplier code calls GET_FEATURE again and this time,
> > possibly due to timing, it causes the ILITEK-TP device interpret the
> > GET_FEATURE as an instruction to change the mode and effectively stop
> > the device from functioning as expected.
> >
> > Notably: the device doesn't even have a Resolution Multiplier so it
> > shouldn't be affected by any of this at all.
> >
> > Fix this by making sure we only execute GET_REPORT if there is
> > a Resolution Multiplier in the respective report.
> >
> > Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
> > Tested-by: Wen He <wen.he_1@nxp.com>
> > ---
> > Same patch as before, but this time with diff.noprefix set to false again.
> > Too bad that setting messes up format-patch :( Apologies for the broken
> > one.
> 
> Thanks for the quick respin. I was about to apply it, and then I
> realized that something was off (see inlined)
> 
> >
> >  drivers/hid/hid-input.c | 22 ++++++++++++----------
> >  1 file changed, 12 insertions(+), 10 deletions(-)
> >
> > diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
> > index dea9cc65bf80..a54824d451bf 100644
> > --- a/drivers/hid/hid-input.c
> > +++ b/drivers/hid/hid-input.c
> > @@ -1560,21 +1560,12 @@ static bool __hidinput_change_resolution_multipliers(struct hid_device *hid,
> >  {
> >         struct hid_usage *usage;
> >         bool update_needed = false;
> > +       bool get_report_completed = false;
> >         int i, j;
> >
> >         if (report->maxfield == 0)
> >                 return false;
> >
> > -       /*
> > -        * If we have more than one feature within this report we
> > -        * need to fill in the bits from the others before we can
> > -        * overwrite the ones for the Resolution Multiplier.
> > -        */
> > -       if (report->maxfield > 1) {
> > -               hid_hw_request(hid, report, HID_REQ_GET_REPORT);
> > -               hid_hw_wait(hid);
> > -       }
> > -
> >         for (i = 0; i < report->maxfield; i++) {
> >                 __s32 value = use_logical_max ?
> >                               report->field[i]->logical_maximum :
> > @@ -1593,6 +1584,17 @@ static bool __hidinput_change_resolution_multipliers(struct hid_device *hid,
> >                         if (usage->hid != HID_GD_RESOLUTION_MULTIPLIER)
> >                                 continue;
> >
> > +                       /*
> > +                        * If we have more than one feature within this report we
> > +                        * need to fill in the bits from the others before we can
> > +                        * overwrite the ones for the Resolution Multiplier.
> > +                        */
> > +                       if (!get_report_completed && report->maxfield > 1) {
> > +                               hid_hw_request(hid, report, HID_REQ_GET_REPORT);
> 
> I think here we said that the reading of this particular feature was
> mandatory by Microsoft, but what if a device doesn't like it.
> I wonder if we should not guard this against HID_QUIRK_NO_INIT_REPORTS
> too, in the event we need to quirk a particular device.

just to clarify: "I wonder if" means "please add this" here? :)

tbh I don't see how a device could function if one cannot read the report
with the RM - Windows reads and sets it unconditionally so that device would
break under Windows. Which, presumably, is motivation enough for a vendor to
fix it.

I'm not even sure there are devices where this is ever triggered now, having
two unrelated features in the same report seems a bit of a niche case.
We can easily add the check but whether it'll ever be needed is doubtful.

Cheers,
   Peter

[PATCH v2] HID: input: do not run GET_REPORT unless there's a Resolution Multiplier

[Peter Hutterer]

hid-multitouch currently runs GET_REPORT for Contact Max and again to
retrieve the Win8 blob. If both are within the same report, the
Resolution Multiplier code calls GET_FEATURE again and this time,
possibly due to timing, it causes the ILITEK-TP device interpret the
GET_FEATURE as an instruction to change the mode and effectively stop
the device from functioning as expected.

Notably: the device doesn't even have a Resolution Multiplier so it
shouldn't be affected by any of this at all.

Fix this by making sure we only execute GET_REPORT if there is
a Resolution Multiplier in the respective report. Where the
HID_QUIRK_NO_INIT_REPORTS field is set we just bail out immediately. This
shouldn't be triggered by any real device anyway.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Wen He <wen.he_1@nxp.com>
---
Changes to v1:
- bail out in case of HID_QUIRK_NO_INIT_REPORTS

 drivers/hid/hid-input.c | 30 ++++++++++++++++++++----------
 1 file changed, 20 insertions(+), 10 deletions(-)

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index dea9cc65bf80..c8633beae260 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -1560,21 +1560,12 @@ static bool __hidinput_change_resolution_multipliers(struct hid_device *hid,
 {
 	struct hid_usage *usage;
 	bool update_needed = false;
+	bool get_report_completed = false;
 	int i, j;
 
 	if (report->maxfield == 0)
 		return false;
 
-	/*
-	 * If we have more than one feature within this report we
-	 * need to fill in the bits from the others before we can
-	 * overwrite the ones for the Resolution Multiplier.
-	 */
-	if (report->maxfield > 1) {
-		hid_hw_request(hid, report, HID_REQ_GET_REPORT);
-		hid_hw_wait(hid);
-	}
-
 	for (i = 0; i < report->maxfield; i++) {
 		__s32 value = use_logical_max ?
 			      report->field[i]->logical_maximum :
@@ -1593,6 +1584,25 @@ static bool __hidinput_change_resolution_multipliers(struct hid_device *hid,
 			if (usage->hid != HID_GD_RESOLUTION_MULTIPLIER)
 				continue;
 
+			/*
+			 * If we have more than one feature within this
+			 * report we need to fill in the bits from the
+			 * others before we can overwrite the ones for the
+			 * Resolution Multiplier.
+			 *
+			 * But if we're not allowed to read from the device,
+			 * we just bail. Such a device should not exist
+			 * anyway.
+			 */
+			if (!get_report_completed && report->maxfield > 1) {
+				if (hid->quirks & HID_QUIRK_NO_INIT_REPORTS)
+					return update_needed;
+
+				hid_hw_request(hid, report, HID_REQ_GET_REPORT);
+				hid_hw_wait(hid);
+				get_report_completed = true;
+			}
+
 			report->field[i]->value[j] = value;
 			update_needed = true;
 		}
-- 
2.26.2

Re: [PATCH v2] HID: input: do not run GET_REPORT unless there's a Resolution Multiplier

[Jiri Kosina]

On Tue, 9 Jun 2020, Peter Hutterer wrote:

> hid-multitouch currently runs GET_REPORT for Contact Max and again to
> retrieve the Win8 blob. If both are within the same report, the
> Resolution Multiplier code calls GET_FEATURE again and this time,
> possibly due to timing, it causes the ILITEK-TP device interpret the
> GET_FEATURE as an instruction to change the mode and effectively stop
> the device from functioning as expected.
> 
> Notably: the device doesn't even have a Resolution Multiplier so it
> shouldn't be affected by any of this at all.
> 
> Fix this by making sure we only execute GET_REPORT if there is
> a Resolution Multiplier in the respective report. Where the
> HID_QUIRK_NO_INIT_REPORTS field is set we just bail out immediately. This
> shouldn't be triggered by any real device anyway.
> 
> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
> Tested-by: Wen He <wen.he_1@nxp.com>
> ---
> Changes to v1:
> - bail out in case of HID_QUIRK_NO_INIT_REPORTS

Applied, thanks Peter.

-- 
Jiri Kosina
SUSE Labs