Add patch to fix some Elan touchpads (rhbz 1296677)
This commit is contained in:
parent
982c66e8c8
commit
b73a36606c
|
@ -0,0 +1,94 @@
|
|||
From cd1e1e286bb3c4fa8714c1e571ae082e510efd5d Mon Sep 17 00:00:00 2001
|
||||
From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
|
||||
Date: Tue, 1 Dec 2015 12:41:38 +0100
|
||||
Subject: [PATCH] HID: multitouch: fix input mode switching on some Elan panels
|
||||
|
||||
as reported by https://bugzilla.kernel.org/show_bug.cgi?id=108481
|
||||
|
||||
This bug reports mentions 6d4f5440 ("HID: multitouch: Fetch feature
|
||||
reports on demand for Win8 devices") as the origin of the problem but this
|
||||
commit actually masked 2 firmware bugs that are annihilating each other:
|
||||
|
||||
The report descriptor declares two features in reports 3 and 5:
|
||||
|
||||
0x05, 0x0d, // Usage Page (Digitizers) 318
|
||||
0x09, 0x0e, // Usage (Device Configuration) 320
|
||||
0xa1, 0x01, // Collection (Application) 322
|
||||
0x85, 0x03, // Report ID (3) 324
|
||||
0x09, 0x22, // Usage (Finger) 326
|
||||
0xa1, 0x00, // Collection (Physical) 328
|
||||
0x09, 0x52, // Usage (Inputmode) 330
|
||||
0x15, 0x00, // Logical Minimum (0) 332
|
||||
0x25, 0x0a, // Logical Maximum (10) 334
|
||||
0x75, 0x08, // Report Size (8) 336
|
||||
0x95, 0x02, // Report Count (2) 338
|
||||
0xb1, 0x02, // Feature (Data,Var,Abs) 340
|
||||
0xc0, // End Collection 342
|
||||
0x09, 0x22, // Usage (Finger) 343
|
||||
0xa1, 0x00, // Collection (Physical) 345
|
||||
0x85, 0x05, // Report ID (5) 347
|
||||
0x09, 0x57, // Usage (Surface Switch) 349
|
||||
0x09, 0x58, // Usage (Button Switch) 351
|
||||
0x15, 0x00, // Logical Minimum (0) 353
|
||||
0x75, 0x01, // Report Size (1) 355
|
||||
0x95, 0x02, // Report Count (2) 357
|
||||
0x25, 0x03, // Logical Maximum (3) 359
|
||||
0xb1, 0x02, // Feature (Data,Var,Abs) 361
|
||||
0x95, 0x0e, // Report Count (14) 363
|
||||
0xb1, 0x03, // Feature (Cnst,Var,Abs) 365
|
||||
0xc0, // End Collection 367
|
||||
|
||||
The report ID 3 presents 2 input mode features, while only the first one
|
||||
is handled by the device. Given that we did not checked if one was
|
||||
previously assigned, we were dealing with the ignored featured and we
|
||||
should never have been able to switch this panel into the multitouch mode.
|
||||
|
||||
However, the firmware presents an other bugs which allowed 6d4f5440
|
||||
to counteract the faulty report descriptor. When we request the values
|
||||
of the feature 5, the firmware answers "03 03 00". The fields are correct
|
||||
but the report id is wrong. Before 6d4f5440, we retrieved all the features
|
||||
and injected them in the system. So when we called report 5, we injected
|
||||
in the system the report 3 with the values "03 00".
|
||||
Setting the second input mode to 03 in this report changed it to "03 03"
|
||||
and the touchpad switched to the mt mode. We could have set anything
|
||||
in the second field because the actual value (the first 03 in this report)
|
||||
was given by the query of report ID 5.
|
||||
|
||||
To sum up: 2 bugs in the firmware were hiding that we were accessing the
|
||||
wrong feature.
|
||||
|
||||
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
|
||||
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
||||
---
|
||||
drivers/hid/hid-multitouch.c | 15 +++++++++++++--
|
||||
1 file changed, 13 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
|
||||
index ba94044cb859..d866720412cd 100644
|
||||
--- a/drivers/hid/hid-multitouch.c
|
||||
+++ b/drivers/hid/hid-multitouch.c
|
||||
@@ -357,8 +357,19 @@ static void mt_feature_mapping(struct hid_device *hdev,
|
||||
break;
|
||||
}
|
||||
|
||||
- td->inputmode = field->report->id;
|
||||
- td->inputmode_index = usage->usage_index;
|
||||
+ if (td->inputmode < 0) {
|
||||
+ td->inputmode = field->report->id;
|
||||
+ td->inputmode_index = usage->usage_index;
|
||||
+ } else {
|
||||
+ /*
|
||||
+ * Some elan panels wrongly declare 2 input mode
|
||||
+ * features, and silently ignore when we set the
|
||||
+ * value in the second field. Skip the second feature
|
||||
+ * and hope for the best.
|
||||
+ */
|
||||
+ dev_info(&hdev->dev,
|
||||
+ "Ignoring the extra HID_DG_INPUTMODE\n");
|
||||
+ }
|
||||
|
||||
break;
|
||||
case HID_DG_CONTACTMAX:
|
||||
--
|
||||
2.5.0
|
||||
|
|
@ -603,6 +603,9 @@ Patch603: ptrace-being-capable-wrt-a-process-requires-mapped-u.patch
|
|||
|
||||
Patch604: drm-i915-shut-up-gen8-SDE-irq-dmesg-noise-again.patch
|
||||
|
||||
#rhbz 1296677
|
||||
Patch641: HID-multitouch-fix-input-mode-switching-on-some-Elan.patch
|
||||
|
||||
#CVE-2016-0728 rhbz 1296623 1297475
|
||||
Patch634: KEYS-Fix-keyring-ref-leak-in-join_session_keyring.patch
|
||||
|
||||
|
@ -2064,6 +2067,9 @@ fi
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Mon Jan 25 2016 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
- Add patch to fix some Elan touchpads (rhbz 1296677)
|
||||
|
||||
* Fri Jan 22 2016 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
- Fix backtrace from PNP conflict on Haswell-ULT (rhbz 1300955)
|
||||
- Fix backtrace from PNP conflict on Broadwell (rhbz 1083853)
|
||||
|
|
Loading…
Reference in New Issue