From b73a36606c5d2bcc86bf971f016117ee7470f861 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Mon, 25 Jan 2016 08:11:15 -0500 Subject: [PATCH] Add patch to fix some Elan touchpads (rhbz 1296677) --- ...ix-input-mode-switching-on-some-Elan.patch | 94 +++++++++++++++++++ kernel.spec | 6 ++ 2 files changed, 100 insertions(+) create mode 100644 HID-multitouch-fix-input-mode-switching-on-some-Elan.patch diff --git a/HID-multitouch-fix-input-mode-switching-on-some-Elan.patch b/HID-multitouch-fix-input-mode-switching-on-some-Elan.patch new file mode 100644 index 000000000..c469460e5 --- /dev/null +++ b/HID-multitouch-fix-input-mode-switching-on-some-Elan.patch @@ -0,0 +1,94 @@ +From cd1e1e286bb3c4fa8714c1e571ae082e510efd5d Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Tue, 1 Dec 2015 12:41:38 +0100 +Subject: [PATCH] HID: multitouch: fix input mode switching on some Elan panels + +as reported by https://bugzilla.kernel.org/show_bug.cgi?id=108481 + +This bug reports mentions 6d4f5440 ("HID: multitouch: Fetch feature +reports on demand for Win8 devices") as the origin of the problem but this +commit actually masked 2 firmware bugs that are annihilating each other: + +The report descriptor declares two features in reports 3 and 5: + +0x05, 0x0d, // Usage Page (Digitizers) 318 +0x09, 0x0e, // Usage (Device Configuration) 320 +0xa1, 0x01, // Collection (Application) 322 +0x85, 0x03, // Report ID (3) 324 +0x09, 0x22, // Usage (Finger) 326 +0xa1, 0x00, // Collection (Physical) 328 +0x09, 0x52, // Usage (Inputmode) 330 +0x15, 0x00, // Logical Minimum (0) 332 +0x25, 0x0a, // Logical Maximum (10) 334 +0x75, 0x08, // Report Size (8) 336 +0x95, 0x02, // Report Count (2) 338 +0xb1, 0x02, // Feature (Data,Var,Abs) 340 +0xc0, // End Collection 342 +0x09, 0x22, // Usage (Finger) 343 +0xa1, 0x00, // Collection (Physical) 345 +0x85, 0x05, // Report ID (5) 347 +0x09, 0x57, // Usage (Surface Switch) 349 +0x09, 0x58, // Usage (Button Switch) 351 +0x15, 0x00, // Logical Minimum (0) 353 +0x75, 0x01, // Report Size (1) 355 +0x95, 0x02, // Report Count (2) 357 +0x25, 0x03, // Logical Maximum (3) 359 +0xb1, 0x02, // Feature (Data,Var,Abs) 361 +0x95, 0x0e, // Report Count (14) 363 +0xb1, 0x03, // Feature (Cnst,Var,Abs) 365 +0xc0, // End Collection 367 + +The report ID 3 presents 2 input mode features, while only the first one +is handled by the device. Given that we did not checked if one was +previously assigned, we were dealing with the ignored featured and we +should never have been able to switch this panel into the multitouch mode. + +However, the firmware presents an other bugs which allowed 6d4f5440 +to counteract the faulty report descriptor. When we request the values +of the feature 5, the firmware answers "03 03 00". The fields are correct +but the report id is wrong. Before 6d4f5440, we retrieved all the features +and injected them in the system. So when we called report 5, we injected +in the system the report 3 with the values "03 00". +Setting the second input mode to 03 in this report changed it to "03 03" +and the touchpad switched to the mt mode. We could have set anything +in the second field because the actual value (the first 03 in this report) +was given by the query of report ID 5. + +To sum up: 2 bugs in the firmware were hiding that we were accessing the +wrong feature. + +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +--- + drivers/hid/hid-multitouch.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index ba94044cb859..d866720412cd 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -357,8 +357,19 @@ static void mt_feature_mapping(struct hid_device *hdev, + break; + } + +- td->inputmode = field->report->id; +- td->inputmode_index = usage->usage_index; ++ if (td->inputmode < 0) { ++ td->inputmode = field->report->id; ++ td->inputmode_index = usage->usage_index; ++ } else { ++ /* ++ * Some elan panels wrongly declare 2 input mode ++ * features, and silently ignore when we set the ++ * value in the second field. Skip the second feature ++ * and hope for the best. ++ */ ++ dev_info(&hdev->dev, ++ "Ignoring the extra HID_DG_INPUTMODE\n"); ++ } + + break; + case HID_DG_CONTACTMAX: +-- +2.5.0 + diff --git a/kernel.spec b/kernel.spec index 06d495674..a6e13172d 100644 --- a/kernel.spec +++ b/kernel.spec @@ -603,6 +603,9 @@ Patch603: ptrace-being-capable-wrt-a-process-requires-mapped-u.patch Patch604: drm-i915-shut-up-gen8-SDE-irq-dmesg-noise-again.patch +#rhbz 1296677 +Patch641: HID-multitouch-fix-input-mode-switching-on-some-Elan.patch + #CVE-2016-0728 rhbz 1296623 1297475 Patch634: KEYS-Fix-keyring-ref-leak-in-join_session_keyring.patch @@ -2064,6 +2067,9 @@ fi # # %changelog +* Mon Jan 25 2016 Josh Boyer +- Add patch to fix some Elan touchpads (rhbz 1296677) + * Fri Jan 22 2016 Josh Boyer - Fix backtrace from PNP conflict on Haswell-ULT (rhbz 1300955) - Fix backtrace from PNP conflict on Broadwell (rhbz 1083853)