Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag

syzbot is reporting hung task at __input_unregister_device() [1], for
iforce_close() waiting at wait_event_interruptible() with dev->mutex held
is blocking input_disconnect_device() from __input_unregister_device().

It seems that the cause is simply that commit c2b27ef672992a20 ("Input:
iforce - wait for command completion when closing the device") forgot to
call wake_up() after clear_bit().

Fix this problem by introducing a helper that calls clear_bit() followed
by wake_up_all().

Reported-by: syzbot <syzbot+deb6abc36aad4008f407@syzkaller.appspotmail.com>
Fixes: c2b27ef672992a20 ("Input: iforce - wait for command completion when closing the device")
Tested-by: syzbot <syzbot+deb6abc36aad4008f407@syzkaller.appspotmail.com>
Suggested-by: Fabio M. De Francesco <fmdefrancesco@gmail.com>
Co-developed-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://lore.kernel.org/r/887021c3-4f13-40ce-c8b9-aa6e09faa3a7@I-love.SAKURA.ne.jp
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - fix control-message timeout

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.

Fixes: 487358627825 ("Input: iforce - use DMA-safe buffer when getting IDs from USB")
Signed-off-by: Johan Hovold <johan@kernel.org>
Cc: stable@vger.kernel.org # 5.3
Link: https://lore.kernel.org/r/20211025115501.5190-1-johan@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - add sanity checks

The endpoint type should also be checked before a device
is accepted.

Reported-by: syzbot+5efc10c005014d061a74@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - remove empty multiline comments

Those are remnants of the SPDX identifier migration, which haven't been
removed properly.

Signed-off-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - add the Saitek R440 Force Wheel

This is added based on the fact that this is an iforce-based device and
that the Windows driver for the R440 works for the Logitech WingMan Formula
Force after replacing the device/vendor IDs.

Signed-off-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - drop couple of temps from transport code

Transport initialization code now deals mostly with transport-specific
data, so we can drop couple of temporary variables.

Tested-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - drop bus type from iforce structure

It is not needed anymore as behavior is controlled by the transport
operations set up for given device.

Tested-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - use DMA-safe buffores for USB transfers

USB transport has to use cache line-aligned buffers for transfers to avoid
DMA issues; serio doe snot have such restrictions. Let's move "data_in"
buffer from main driver structure into transport modules and make sure USB
requirements are respected.

Tested-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - allow callers supply data buffer when fetching device IDs

We want to move buffer handling into transport layers as the properties of
buffers (DMA-safety, alignment, etc) are different for different
transports. To allow this, let's allow caller to specify their own buffers
for the results of iforce_get_id_packet() and let transport drivers to
figure what buffers they need to use for transfers.

Tested-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - do not combine arguments for iforce_process_packet()

Current code combines packet type and data length into single argument to
iforce_process_packet() and then has to untangle it. It is much clearer to
simply use separate arguments.

Tested-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - use DMA-safe buffer when getting IDs from USB

When working with USB devices we need to use DMA-safe buffers,
and iforce->edata is not one. Let's rework the code to allocate
temporary buffer (iforce_get_id() is called only during initialization
so there is no reason to have permanent buffer) and use it. While at it,
let's utilize usb_control_msg() API which simplifies code.

Tested-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - split into core and transport modules

Now that we have moved enough transport details into separate source files
we can change them into transport modules so that they are only loaded when
needed.

Tested-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - move transport data into transport modules

This moves transport-specific data from main iforce structure into
transport modules.

Tested-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - add bus type and parent arguments to iforce_init_device()

Note that the parent device for the USB-connected controllers is now
USB interface instead of USB device.

Tested-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - introduce start and stop io transport ops

Add start_io() and stop_io() transport methods so that core
does not have to know the details.

Tested-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - move get_id to the transport operations

To avoid #ifdef-ing out parts of the code and having conditionals in normal
control flow, let's define "get_id" transport method and move
implementation into respective transport modules.

Tested-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - introduce transport ops

In order to tease apart the driver into core and transport modules, let's
introduce transport operations and make "xmit" the very first one such
operation.

Tested-by: Tim Schumacher <timschumi@gmx.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156

Based on 1 normalized pattern(s):

this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license as published by
the free software foundation either version 2 of the license or at
your option any later version this program is distributed in the
hope that it will be useful but without any warranty without even
the implied warranty of merchantability or fitness for a particular
purpose see the gnu general public license for more details you
should have received a copy of the gnu general public license along
with this program if not write to the free software foundation inc
59 temple place suite 330 boston ma 02111 1307 usa

extracted by the scancode license scanner the SPDX license identifier

GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 1334 file(s).

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Allison Randal <allison@lohutok.net>
Reviewed-by: Richard Fontana <rfontana@redhat.com>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070033.113240726@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Input: stop telling users to snail-mail Vojtech

I do not think Vojtech wants snail mail these days (and he mentioned that
nobody has ever sent him snail mail), and the address is not even valid
anymore, so let's remove snail-mail instructions from the sources.

Acked-by: Vojtech Pavlik <vojtech@suse.cz>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - constify usb_device_id and fix space before '[' error

usb_device_id are not supposed to change at runtime. All functions
working with usb_device_id provided by <linux/usb.h> work with
const usb_device_id. So mark the non-const structs as const.

Fix checkpatch.pl error:
ERROR: space prohibited before open square bracket '['.

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: iforce - validate number of endpoints before using them

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory that lie beyond the end of the endpoint
array should a malicious device lack the expected endpoints.

Signed-off-by: Johan Hovold <johan@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

USB: input: iforce: fix up dev_* messages

Previously I had made the struct device point to the input device, but
after talking with Dmitry, he said that the USB device would make more
sense for this driver to point to. So converted it to use that instead.

Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: iforce: remove dbg() usage

dbg() was a very old USB-specific macro that should no longer
be used. This patch removes it from being used in the driver
and uses dev_dbg() instead.

Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: input: joystick: iforce: fix up dev_err() usages

We should always reference the input device for dev_err(), not the USB
device. Fix up the places where I got this wrong.

Reported-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

USB: iforce: remove err() usage

err() was a very old USB-specific macro that I thought had gone away.
This patch removes it from being used in the driver and uses dev_err()
instead.

Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Input: iforce - add Guillemot Jet Leader Force Feedback

This device features a RUDDER on the knob.

Signed-off-by: Marek Vasut <marek.vasut@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Input: iforce - wait for command completion when closing the device

We need to wait for the command to disable FF effects to complete before
continuing with closing the device.

Tested-by: Johannes Ebke <johannes.ebke@physik.uni-muenchen.de>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Input: iforce - fix oops on device disconnect

Do not try to free iforce device when we closing input device; disconnect
is the only place where it should be deleted.

Reported-by: Johannes Ebke <johannes.ebke@physik.uni-muenchen.de>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Input: iforce - support new revision of ACT LABS Force RS

Reported-by: cemede@gmail.com
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

USB: remove warn() macro from usb input drivers

USB should not be having it's own printk macros, so remove warn() and
use the system-wide standard of dev_warn() wherever possible. In the
few places that will not work out, use a basic printk().

Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Input: remove CVS keywords

This patch removes CVS keywords that weren't updated for a long time
from comments.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Input: replace remaining __FUNCTION__ occurrences

__FUNCTION__ is gcc-specific, use __func__

Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

usb input endianness annotations and fixes

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Input: iforce - fix force feedback not working

Use an interrupt URB to send force-feedback data to the device
instead of a bulk URB. This was broken since 2.6.18.

Signed-off-by: Johann Deneux <johann.deneux@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Input: iforce - use usb_kill_urb instead of usb_unlink_urb

Using usb_unlink_urb can cause iforce_open to fail when called
soon after iforce_release. Also updated my email address and
replaced calls to printk() by dbg(), warn(), info(), err()...

Signed-off-by: Johann Deneux <johann.deneux@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

usb: iforce-usb free urb cleanup

- usb_free_urb() cleanup

Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

IRQ: Maintain regs pointer globally rather than passing to IRQ handlers

Maintain a per-CPU global "struct pt_regs *" variable which can be used instead
of passing regs around manually through all ~1800 interrupt handlers in the
Linux kernel.

The regs pointer is used in few places, but it potentially costs both stack
space and code to pass it around. On the FRV arch, removing the regs parameter
from all the genirq function results in a 20% speed up of the IRQ exit path
(ie: from leaving timer_interrupt() to leaving do_IRQ()).

Where appropriate, an arch may override the generic storage facility and do
something different with the variable. On FRV, for instance, the address is
maintained in GR28 at all times inside the kernel as part of general exception
handling.

Having looked over the code, it appears that the parameter may be handed down
through up to twenty or so layers of functions. Consider a USB character
device attached to a USB hub, attached to a USB controller that posts its
interrupts through a cascaded auxiliary interrupt controller. A character
device driver may want to pass regs to the sysrq handler through the input
layer which adds another few layers of parameter passing.

I've build this code with allyesconfig for x86_64 and i386. I've runtested the
main part of the code on FRV and i386, though I can't test most of the drivers.
I've also done partial conversion for powerpc and MIPS - these at least compile
with minimal configurations.

This will affect all archs. Mostly the changes should be relatively easy.
Take do_IRQ(), store the regs pointer at the beginning, saving the old one:

struct pt_regs *old_regs = set_irq_regs(regs);

And put the old one back at the end:

set_irq_regs(old_regs);

Don't pass regs through to generic_handle_irq() or __do_IRQ().

In timer_interrupt(), this sort of change will be necessary:

- update_process_times(user_mode(regs));
- profile_tick(CPU_PROFILING, regs);
+ update_process_times(user_mode(get_irq_regs()));
+ profile_tick(CPU_PROFILING);

I'd like to move update_process_times()'s use of get_irq_regs() into itself,
except that i386, alone of the archs, uses something other than user_mode().

Some notes on the interrupt handling in the drivers:

(*) input_dev() is now gone entirely. The regs pointer is no longer stored in
the input_dev struct.

(*) finish_unlinks() in drivers/usb/host/ohci-q.c needs checking. It does
something different depending on whether it's been supplied with a regs
pointer or not.

(*) Various IRQ handler function pointers have been moved to type
irq_handler_t.

Signed-Off-By: David Howells <dhowells@redhat.com>
(cherry picked from 1b16e7ac850969f38b375e511e3fa2f474a33867 commit)

Input: iforce - fix detection of USB devices

Recent conversion to wait_event_interruptible_timeout() caused
USB detection routine erroneously report timeouts for perfectly
working devices.

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

[PATCH] USB: remove .owner field from struct usb_driver

It is no longer needed, so let's remove it, saving a bit of memory.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

[PATCH] drivers/input/joystick: convert to dynamic input_dev allocation

Input: convert drivers/input/joystick to dynamic input_dev allocation

This is required for input_dev sysfs integration

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Input: iforce - use wait_event_interruptible_timeout

The timeout while() loops in iforce-packets.c lack a
set_current_state(TASK_INTERRUPTIBLE); call. The right solution is
to replace them with wait_event_interruptible_timeout().

Reported-by: Nishanth Aravamudan <nacc@us.ibm.com>
Signed-off-by: Vojtech Pavlik <vojtech@suse.cz>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Input: Add a new I-Force device to the iforce driver.

Signed-off-by: Vojtech Pavlik <vojtech@suse.cz>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Linux-2.6.12-rc2

Initial git repository build. I'm not bothering with the full history,
even though we have it. We can create a separate "historical" git
archive of that later if we want to, and in the meantime it's about
3.2GB when imported into git - space that would just make the early
git days unnecessarily complicated, when we don't have a lot of good
infrastructure for it.

Let it rip!