HID: roccat: potential out of bounds in pyra_sysfs_write_settings()
[pandora-kernel.git] / drivers / hid / hid-magicmouse.c
1 /*
2  *   Apple "Magic" Wireless Mouse driver
3  *
4  *   Copyright (c) 2010 Michael Poole <mdpoole@troilus.org>
5  *   Copyright (c) 2010 Chase Douglas <chase.douglas@canonical.com>
6  */
7
8 /*
9  * This program is free software; you can redistribute it and/or modify it
10  * under the terms of the GNU General Public License as published by the Free
11  * Software Foundation; either version 2 of the License, or (at your option)
12  * any later version.
13  */
14
15 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
16
17 #include <linux/device.h>
18 #include <linux/hid.h>
19 #include <linux/input/mt.h>
20 #include <linux/module.h>
21 #include <linux/slab.h>
22
23 #include "hid-ids.h"
24
25 static bool emulate_3button = true;
26 module_param(emulate_3button, bool, 0644);
27 MODULE_PARM_DESC(emulate_3button, "Emulate a middle button");
28
29 static int middle_button_start = -350;
30 static int middle_button_stop = +350;
31
32 static bool emulate_scroll_wheel = true;
33 module_param(emulate_scroll_wheel, bool, 0644);
34 MODULE_PARM_DESC(emulate_scroll_wheel, "Emulate a scroll wheel");
35
36 static unsigned int scroll_speed = 32;
37 static int param_set_scroll_speed(const char *val, struct kernel_param *kp) {
38         unsigned long speed;
39         if (!val || kstrtoul(val, 0, &speed) || speed > 63)
40                 return -EINVAL;
41         scroll_speed = speed;
42         return 0;
43 }
44 module_param_call(scroll_speed, param_set_scroll_speed, param_get_uint, &scroll_speed, 0644);
45 MODULE_PARM_DESC(scroll_speed, "Scroll speed, value from 0 (slow) to 63 (fast)");
46
47 static bool scroll_acceleration = false;
48 module_param(scroll_acceleration, bool, 0644);
49 MODULE_PARM_DESC(scroll_acceleration, "Accelerate sequential scroll events");
50
51 static bool report_undeciphered;
52 module_param(report_undeciphered, bool, 0644);
53 MODULE_PARM_DESC(report_undeciphered, "Report undeciphered multi-touch state field using a MSC_RAW event");
54
55 #define TRACKPAD_REPORT_ID 0x28
56 #define MOUSE_REPORT_ID    0x29
57 #define DOUBLE_REPORT_ID   0xf7
58 /* These definitions are not precise, but they're close enough.  (Bits
59  * 0x03 seem to indicate the aspect ratio of the touch, bits 0x70 seem
60  * to be some kind of bit mask -- 0x20 may be a near-field reading,
61  * and 0x40 is actual contact, and 0x10 may be a start/stop or change
62  * indication.)
63  */
64 #define TOUCH_STATE_MASK  0xf0
65 #define TOUCH_STATE_NONE  0x00
66 #define TOUCH_STATE_START 0x30
67 #define TOUCH_STATE_DRAG  0x40
68
69 #define SCROLL_ACCEL_DEFAULT 7
70
71 /* Touch surface information. Dimension is in hundredths of a mm, min and max
72  * are in units. */
73 #define MOUSE_DIMENSION_X (float)9056
74 #define MOUSE_MIN_X -1100
75 #define MOUSE_MAX_X 1258
76 #define MOUSE_RES_X ((MOUSE_MAX_X - MOUSE_MIN_X) / (MOUSE_DIMENSION_X / 100))
77 #define MOUSE_DIMENSION_Y (float)5152
78 #define MOUSE_MIN_Y -1589
79 #define MOUSE_MAX_Y 2047
80 #define MOUSE_RES_Y ((MOUSE_MAX_Y - MOUSE_MIN_Y) / (MOUSE_DIMENSION_Y / 100))
81
82 #define TRACKPAD_DIMENSION_X (float)13000
83 #define TRACKPAD_MIN_X -2909
84 #define TRACKPAD_MAX_X 3167
85 #define TRACKPAD_RES_X \
86         ((TRACKPAD_MAX_X - TRACKPAD_MIN_X) / (TRACKPAD_DIMENSION_X / 100))
87 #define TRACKPAD_DIMENSION_Y (float)11000
88 #define TRACKPAD_MIN_Y -2456
89 #define TRACKPAD_MAX_Y 2565
90 #define TRACKPAD_RES_Y \
91         ((TRACKPAD_MAX_Y - TRACKPAD_MIN_Y) / (TRACKPAD_DIMENSION_Y / 100))
92
93 /**
94  * struct magicmouse_sc - Tracks Magic Mouse-specific data.
95  * @input: Input device through which we report events.
96  * @quirks: Currently unused.
97  * @ntouches: Number of touches in most recent touch report.
98  * @scroll_accel: Number of consecutive scroll motions.
99  * @scroll_jiffies: Time of last scroll motion.
100  * @touches: Most recent data for a touch, indexed by tracking ID.
101  * @tracking_ids: Mapping of current touch input data to @touches.
102  */
103 struct magicmouse_sc {
104         struct input_dev *input;
105         unsigned long quirks;
106
107         int ntouches;
108         int scroll_accel;
109         unsigned long scroll_jiffies;
110
111         struct {
112                 short x;
113                 short y;
114                 short scroll_x;
115                 short scroll_y;
116                 u8 size;
117         } touches[16];
118         int tracking_ids[16];
119 };
120
121 static int magicmouse_firm_touch(struct magicmouse_sc *msc)
122 {
123         int touch = -1;
124         int ii;
125
126         /* If there is only one "firm" touch, set touch to its
127          * tracking ID.
128          */
129         for (ii = 0; ii < msc->ntouches; ii++) {
130                 int idx = msc->tracking_ids[ii];
131                 if (msc->touches[idx].size < 8) {
132                         /* Ignore this touch. */
133                 } else if (touch >= 0) {
134                         touch = -1;
135                         break;
136                 } else {
137                         touch = idx;
138                 }
139         }
140
141         return touch;
142 }
143
144 static void magicmouse_emit_buttons(struct magicmouse_sc *msc, int state)
145 {
146         int last_state = test_bit(BTN_LEFT, msc->input->key) << 0 |
147                 test_bit(BTN_RIGHT, msc->input->key) << 1 |
148                 test_bit(BTN_MIDDLE, msc->input->key) << 2;
149
150         if (emulate_3button) {
151                 int id;
152
153                 /* If some button was pressed before, keep it held
154                  * down.  Otherwise, if there's exactly one firm
155                  * touch, use that to override the mouse's guess.
156                  */
157                 if (state == 0) {
158                         /* The button was released. */
159                 } else if (last_state != 0) {
160                         state = last_state;
161                 } else if ((id = magicmouse_firm_touch(msc)) >= 0) {
162                         int x = msc->touches[id].x;
163                         if (x < middle_button_start)
164                                 state = 1;
165                         else if (x > middle_button_stop)
166                                 state = 2;
167                         else
168                                 state = 4;
169                 } /* else: we keep the mouse's guess */
170
171                 input_report_key(msc->input, BTN_MIDDLE, state & 4);
172         }
173
174         input_report_key(msc->input, BTN_LEFT, state & 1);
175         input_report_key(msc->input, BTN_RIGHT, state & 2);
176
177         if (state != last_state)
178                 msc->scroll_accel = SCROLL_ACCEL_DEFAULT;
179 }
180
181 static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id, u8 *tdata)
182 {
183         struct input_dev *input = msc->input;
184         int id, x, y, size, orientation, touch_major, touch_minor, state, down;
185
186         if (input->id.product == USB_DEVICE_ID_APPLE_MAGICMOUSE) {
187                 id = (tdata[6] << 2 | tdata[5] >> 6) & 0xf;
188                 x = (tdata[1] << 28 | tdata[0] << 20) >> 20;
189                 y = -((tdata[2] << 24 | tdata[1] << 16) >> 20);
190                 size = tdata[5] & 0x3f;
191                 orientation = (tdata[6] >> 2) - 32;
192                 touch_major = tdata[3];
193                 touch_minor = tdata[4];
194                 state = tdata[7] & TOUCH_STATE_MASK;
195                 down = state != TOUCH_STATE_NONE;
196         } else { /* USB_DEVICE_ID_APPLE_MAGICTRACKPAD */
197                 id = (tdata[7] << 2 | tdata[6] >> 6) & 0xf;
198                 x = (tdata[1] << 27 | tdata[0] << 19) >> 19;
199                 y = -((tdata[3] << 30 | tdata[2] << 22 | tdata[1] << 14) >> 19);
200                 size = tdata[6] & 0x3f;
201                 orientation = (tdata[7] >> 2) - 32;
202                 touch_major = tdata[4];
203                 touch_minor = tdata[5];
204                 state = tdata[8] & TOUCH_STATE_MASK;
205                 down = state != TOUCH_STATE_NONE;
206         }
207
208         /* Store tracking ID and other fields. */
209         msc->tracking_ids[raw_id] = id;
210         msc->touches[id].x = x;
211         msc->touches[id].y = y;
212         msc->touches[id].size = size;
213
214         /* If requested, emulate a scroll wheel by detecting small
215          * vertical touch motions.
216          */
217         if (emulate_scroll_wheel) {
218                 unsigned long now = jiffies;
219                 int step_x = msc->touches[id].scroll_x - x;
220                 int step_y = msc->touches[id].scroll_y - y;
221
222                 /* Calculate and apply the scroll motion. */
223                 switch (state) {
224                 case TOUCH_STATE_START:
225                         msc->touches[id].scroll_x = x;
226                         msc->touches[id].scroll_y = y;
227
228                         /* Reset acceleration after half a second. */
229                         if (scroll_acceleration && time_before(now,
230                                                 msc->scroll_jiffies + HZ / 2))
231                                 msc->scroll_accel = max_t(int,
232                                                 msc->scroll_accel - 1, 1);
233                         else
234                                 msc->scroll_accel = SCROLL_ACCEL_DEFAULT;
235
236                         break;
237                 case TOUCH_STATE_DRAG:
238                         step_x /= (64 - (int)scroll_speed) * msc->scroll_accel;
239                         if (step_x != 0) {
240                                 msc->touches[id].scroll_x -= step_x *
241                                         (64 - scroll_speed) * msc->scroll_accel;
242                                 msc->scroll_jiffies = now;
243                                 input_report_rel(input, REL_HWHEEL, -step_x);
244                         }
245
246                         step_y /= (64 - (int)scroll_speed) * msc->scroll_accel;
247                         if (step_y != 0) {
248                                 msc->touches[id].scroll_y -= step_y *
249                                         (64 - scroll_speed) * msc->scroll_accel;
250                                 msc->scroll_jiffies = now;
251                                 input_report_rel(input, REL_WHEEL, step_y);
252                         }
253                         break;
254                 }
255         }
256
257         if (down)
258                 msc->ntouches++;
259
260         input_mt_slot(input, id);
261         input_mt_report_slot_state(input, MT_TOOL_FINGER, down);
262
263         /* Generate the input events for this touch. */
264         if (down) {
265                 input_report_abs(input, ABS_MT_TOUCH_MAJOR, touch_major << 2);
266                 input_report_abs(input, ABS_MT_TOUCH_MINOR, touch_minor << 2);
267                 input_report_abs(input, ABS_MT_ORIENTATION, -orientation);
268                 input_report_abs(input, ABS_MT_POSITION_X, x);
269                 input_report_abs(input, ABS_MT_POSITION_Y, y);
270
271                 if (report_undeciphered) {
272                         if (input->id.product == USB_DEVICE_ID_APPLE_MAGICMOUSE)
273                                 input_event(input, EV_MSC, MSC_RAW, tdata[7]);
274                         else /* USB_DEVICE_ID_APPLE_MAGICTRACKPAD */
275                                 input_event(input, EV_MSC, MSC_RAW, tdata[8]);
276                 }
277         }
278 }
279
280 static int magicmouse_raw_event(struct hid_device *hdev,
281                 struct hid_report *report, u8 *data, int size)
282 {
283         struct magicmouse_sc *msc = hid_get_drvdata(hdev);
284         struct input_dev *input = msc->input;
285         int x = 0, y = 0, ii, clicks = 0, npoints;
286
287         switch (data[0]) {
288         case TRACKPAD_REPORT_ID:
289                 /* Expect four bytes of prefix, and N*9 bytes of touch data. */
290                 if (size < 4 || ((size - 4) % 9) != 0)
291                         return 0;
292                 npoints = (size - 4) / 9;
293                 if (npoints > 15) {
294                         hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n",
295                                         size);
296                         return 0;
297                 }
298                 msc->ntouches = 0;
299                 for (ii = 0; ii < npoints; ii++)
300                         magicmouse_emit_touch(msc, ii, data + ii * 9 + 4);
301
302                 clicks = data[1];
303
304                 /* The following bits provide a device specific timestamp. They
305                  * are unused here.
306                  *
307                  * ts = data[1] >> 6 | data[2] << 2 | data[3] << 10;
308                  */
309                 break;
310         case MOUSE_REPORT_ID:
311                 /* Expect six bytes of prefix, and N*8 bytes of touch data. */
312                 if (size < 6 || ((size - 6) % 8) != 0)
313                         return 0;
314                 npoints = (size - 6) / 8;
315                 if (npoints > 15) {
316                         hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n",
317                                         size);
318                         return 0;
319                 }
320                 msc->ntouches = 0;
321                 for (ii = 0; ii < npoints; ii++)
322                         magicmouse_emit_touch(msc, ii, data + ii * 8 + 6);
323
324                 /* When emulating three-button mode, it is important
325                  * to have the current touch information before
326                  * generating a click event.
327                  */
328                 x = (int)(((data[3] & 0x0c) << 28) | (data[1] << 22)) >> 22;
329                 y = (int)(((data[3] & 0x30) << 26) | (data[2] << 22)) >> 22;
330                 clicks = data[3];
331
332                 /* The following bits provide a device specific timestamp. They
333                  * are unused here.
334                  *
335                  * ts = data[3] >> 6 | data[4] << 2 | data[5] << 10;
336                  */
337                 break;
338         case DOUBLE_REPORT_ID:
339                 /* Sometimes the trackpad sends two touch reports in one
340                  * packet.
341                  */
342                 magicmouse_raw_event(hdev, report, data + 2, data[1]);
343                 magicmouse_raw_event(hdev, report, data + 2 + data[1],
344                         size - 2 - data[1]);
345                 break;
346         default:
347                 return 0;
348         }
349
350         if (input->id.product == USB_DEVICE_ID_APPLE_MAGICMOUSE) {
351                 magicmouse_emit_buttons(msc, clicks & 3);
352                 input_report_rel(input, REL_X, x);
353                 input_report_rel(input, REL_Y, y);
354         } else { /* USB_DEVICE_ID_APPLE_MAGICTRACKPAD */
355                 input_report_key(input, BTN_MOUSE, clicks & 1);
356                 input_mt_report_pointer_emulation(input, true);
357         }
358
359         input_sync(input);
360         return 1;
361 }
362
363 static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hdev)
364 {
365         int error;
366
367         __set_bit(EV_KEY, input->evbit);
368
369         if (input->id.product == USB_DEVICE_ID_APPLE_MAGICMOUSE) {
370                 __set_bit(BTN_LEFT, input->keybit);
371                 __set_bit(BTN_RIGHT, input->keybit);
372                 if (emulate_3button)
373                         __set_bit(BTN_MIDDLE, input->keybit);
374
375                 __set_bit(EV_REL, input->evbit);
376                 __set_bit(REL_X, input->relbit);
377                 __set_bit(REL_Y, input->relbit);
378                 if (emulate_scroll_wheel) {
379                         __set_bit(REL_WHEEL, input->relbit);
380                         __set_bit(REL_HWHEEL, input->relbit);
381                 }
382         } else { /* USB_DEVICE_ID_APPLE_MAGICTRACKPAD */
383                 /* input->keybit is initialized with incorrect button info
384                  * for Magic Trackpad. There really is only one physical
385                  * button (BTN_LEFT == BTN_MOUSE). Make sure we don't
386                  * advertise buttons that don't exist...
387                  */
388                 __clear_bit(BTN_RIGHT, input->keybit);
389                 __clear_bit(BTN_MIDDLE, input->keybit);
390                 __set_bit(BTN_MOUSE, input->keybit);
391                 __set_bit(BTN_TOOL_FINGER, input->keybit);
392                 __set_bit(BTN_TOOL_DOUBLETAP, input->keybit);
393                 __set_bit(BTN_TOOL_TRIPLETAP, input->keybit);
394                 __set_bit(BTN_TOOL_QUADTAP, input->keybit);
395                 __set_bit(BTN_TOOL_QUINTTAP, input->keybit);
396                 __set_bit(BTN_TOUCH, input->keybit);
397                 __set_bit(INPUT_PROP_POINTER, input->propbit);
398                 __set_bit(INPUT_PROP_BUTTONPAD, input->propbit);
399         }
400
401
402         __set_bit(EV_ABS, input->evbit);
403
404         error = input_mt_init_slots(input, 16, 0);
405         if (error)
406                 return error;
407         input_set_abs_params(input, ABS_MT_TOUCH_MAJOR, 0, 255 << 2,
408                              4, 0);
409         input_set_abs_params(input, ABS_MT_TOUCH_MINOR, 0, 255 << 2,
410                              4, 0);
411         input_set_abs_params(input, ABS_MT_ORIENTATION, -31, 32, 1, 0);
412
413         /* Note: Touch Y position from the device is inverted relative
414          * to how pointer motion is reported (and relative to how USB
415          * HID recommends the coordinates work).  This driver keeps
416          * the origin at the same position, and just uses the additive
417          * inverse of the reported Y.
418          */
419         if (input->id.product == USB_DEVICE_ID_APPLE_MAGICMOUSE) {
420                 input_set_abs_params(input, ABS_MT_POSITION_X,
421                                      MOUSE_MIN_X, MOUSE_MAX_X, 4, 0);
422                 input_set_abs_params(input, ABS_MT_POSITION_Y,
423                                      MOUSE_MIN_Y, MOUSE_MAX_Y, 4, 0);
424
425                 input_abs_set_res(input, ABS_MT_POSITION_X,
426                                   MOUSE_RES_X);
427                 input_abs_set_res(input, ABS_MT_POSITION_Y,
428                                   MOUSE_RES_Y);
429         } else { /* USB_DEVICE_ID_APPLE_MAGICTRACKPAD */
430                 input_set_abs_params(input, ABS_X, TRACKPAD_MIN_X,
431                                      TRACKPAD_MAX_X, 4, 0);
432                 input_set_abs_params(input, ABS_Y, TRACKPAD_MIN_Y,
433                                      TRACKPAD_MAX_Y, 4, 0);
434                 input_set_abs_params(input, ABS_MT_POSITION_X,
435                                      TRACKPAD_MIN_X, TRACKPAD_MAX_X, 4, 0);
436                 input_set_abs_params(input, ABS_MT_POSITION_Y,
437                                      TRACKPAD_MIN_Y, TRACKPAD_MAX_Y, 4, 0);
438
439                 input_abs_set_res(input, ABS_X, TRACKPAD_RES_X);
440                 input_abs_set_res(input, ABS_Y, TRACKPAD_RES_Y);
441                 input_abs_set_res(input, ABS_MT_POSITION_X,
442                                   TRACKPAD_RES_X);
443                 input_abs_set_res(input, ABS_MT_POSITION_Y,
444                                   TRACKPAD_RES_Y);
445         }
446
447         input_set_events_per_packet(input, 60);
448
449         if (report_undeciphered) {
450                 __set_bit(EV_MSC, input->evbit);
451                 __set_bit(MSC_RAW, input->mscbit);
452         }
453
454         return 0;
455 }
456
457 static int magicmouse_input_mapping(struct hid_device *hdev,
458                 struct hid_input *hi, struct hid_field *field,
459                 struct hid_usage *usage, unsigned long **bit, int *max)
460 {
461         struct magicmouse_sc *msc = hid_get_drvdata(hdev);
462
463         if (!msc->input)
464                 msc->input = hi->input;
465
466         /* Magic Trackpad does not give relative data after switching to MT */
467         if (hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD &&
468             field->flags & HID_MAIN_ITEM_RELATIVE)
469                 return -1;
470
471         return 0;
472 }
473
474 static void magicmouse_input_configured(struct hid_device *hdev,
475                 struct hid_input *hi)
476
477 {
478         struct magicmouse_sc *msc = hid_get_drvdata(hdev);
479
480         int ret = magicmouse_setup_input(msc->input, hdev);
481         if (ret) {
482                 hid_err(hdev, "magicmouse setup input failed (%d)\n", ret);
483                 /* clean msc->input to notify probe() of the failure */
484                 msc->input = NULL;
485         }
486 }
487
488
489 static int magicmouse_probe(struct hid_device *hdev,
490         const struct hid_device_id *id)
491 {
492         __u8 feature[] = { 0xd7, 0x01 };
493         struct magicmouse_sc *msc;
494         struct hid_report *report;
495         int ret;
496
497         msc = devm_kzalloc(&hdev->dev, sizeof(*msc), GFP_KERNEL);
498         if (msc == NULL) {
499                 hid_err(hdev, "can't alloc magicmouse descriptor\n");
500                 return -ENOMEM;
501         }
502
503         msc->scroll_accel = SCROLL_ACCEL_DEFAULT;
504
505         msc->quirks = id->driver_data;
506         hid_set_drvdata(hdev, msc);
507
508         ret = hid_parse(hdev);
509         if (ret) {
510                 hid_err(hdev, "magicmouse hid parse failed\n");
511                 return ret;
512         }
513
514         ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
515         if (ret) {
516                 hid_err(hdev, "magicmouse hw start failed\n");
517                 return ret;
518         }
519
520         if (!msc->input) {
521                 hid_err(hdev, "magicmouse input not registered\n");
522                 ret = -ENOMEM;
523                 goto err_stop_hw;
524         }
525
526         if (id->product == USB_DEVICE_ID_APPLE_MAGICMOUSE)
527                 report = hid_register_report(hdev, HID_INPUT_REPORT,
528                         MOUSE_REPORT_ID);
529         else { /* USB_DEVICE_ID_APPLE_MAGICTRACKPAD */
530                 report = hid_register_report(hdev, HID_INPUT_REPORT,
531                         TRACKPAD_REPORT_ID);
532                 report = hid_register_report(hdev, HID_INPUT_REPORT,
533                         DOUBLE_REPORT_ID);
534         }
535
536         if (!report) {
537                 hid_err(hdev, "unable to register touch report\n");
538                 ret = -ENOMEM;
539                 goto err_stop_hw;
540         }
541         report->size = 6;
542
543         /*
544          * Some devices repond with 'invalid report id' when feature
545          * report switching it into multitouch mode is sent to it.
546          *
547          * This results in -EIO from the _raw low-level transport callback,
548          * but there seems to be no other way of switching the mode.
549          * Thus the super-ugly hacky success check below.
550          */
551         ret = hid_hw_raw_request(hdev, feature[0], feature, sizeof(feature),
552                                 HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
553         if (ret != -EIO && ret != sizeof(feature)) {
554                 hid_err(hdev, "unable to request touch data (%d)\n", ret);
555                 goto err_stop_hw;
556         }
557
558         return 0;
559 err_stop_hw:
560         hid_hw_stop(hdev);
561         return ret;
562 }
563
564 static const struct hid_device_id magic_mice[] = {
565         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
566                 USB_DEVICE_ID_APPLE_MAGICMOUSE), .driver_data = 0 },
567         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
568                 USB_DEVICE_ID_APPLE_MAGICTRACKPAD), .driver_data = 0 },
569         { }
570 };
571 MODULE_DEVICE_TABLE(hid, magic_mice);
572
573 static struct hid_driver magicmouse_driver = {
574         .name = "magicmouse",
575         .id_table = magic_mice,
576         .probe = magicmouse_probe,
577         .raw_event = magicmouse_raw_event,
578         .input_mapping = magicmouse_input_mapping,
579         .input_configured = magicmouse_input_configured,
580 };
581 module_hid_driver(magicmouse_driver);
582
583 MODULE_LICENSE("GPL");