From 6155d86923c39e05f0af14dbf14bbff865dc3921 Mon Sep 17 00:00:00 2001 From: Thomas Hindoe Paaboel Andersen Date: Tue, 15 Sep 2015 20:07:24 +0200 Subject: [PATCH 1/3] hidpp10/20: retry on usb timeout On the M705 I frequently get usb timeouts here if the device has not been active for a while. Retrying after 10 ms seems to reliably fix the timeout problem. We could have just added the 10 ms sleep directly but it does not seem to be neccesary on wired devices so I chose not to. Setting the ret value to a face positive number and looping would also work but we risk an endless loop. In the end I just went for a single retry as that fixed the problem for me. --- src/hidpp10.c | 6 ++++++ src/hidpp20.c | 7 +++++++ 2 files changed, 13 insertions(+) diff --git a/src/hidpp10.c b/src/hidpp10.c index 3f4a9eeb..55b4679c 100644 --- a/src/hidpp10.c +++ b/src/hidpp10.c @@ -138,6 +138,12 @@ hidpp10_request_command(struct hidpp10_device *dev, union hidpp10_message *msg) do { ret = ratbag_hidraw_read_input_report(device, read_buffer.data, LONG_MESSAGE_LENGTH); + /* Wait and retry if the USB timed out */ + if (ret == -ETIMEDOUT) { + msleep(10); + ret = ratbag_hidraw_read_input_report(device, read_buffer.data, LONG_MESSAGE_LENGTH); + } + /* Overwrite the return device index with ours. The kernel * sets our device index on write, but gives us the real * device index on reply. Overwrite it with our index so the diff --git a/src/hidpp20.c b/src/hidpp20.c index 2630f33f..466c0af5 100644 --- a/src/hidpp20.c +++ b/src/hidpp20.c @@ -116,6 +116,13 @@ hidpp20_request_command_allow_error(struct ratbag_device *device, union hidpp20_ */ do { ret = ratbag_hidraw_read_input_report(device, read_buffer.data, LONG_MESSAGE_LENGTH); + + /* Wait and retry if the USB timed out */ + if (ret == -ETIMEDOUT) { + msleep(10); + ret = ratbag_hidraw_read_input_report(device, read_buffer.data, LONG_MESSAGE_LENGTH); + } + log_buf_raw(ratbag, " *** received: ", read_buffer.data, ret); if (read_buffer.msg.report_id != REPORT_ID_SHORT && From a85a40b7134aa5fa3ff01a83eca37c851e391b57 Mon Sep 17 00:00:00 2001 From: Thomas Hindoe Paaboel Andersen Date: Tue, 15 Sep 2015 20:10:12 +0200 Subject: [PATCH 2/3] hidpp10: add G9 --- src/driver-hidpp10.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/driver-hidpp10.c b/src/driver-hidpp10.c index a7a4febc..3fc1f442 100644 --- a/src/driver-hidpp10.c +++ b/src/driver-hidpp10.c @@ -285,6 +285,9 @@ static const struct ratbag_id hidpp10drv_table[] = { /* G5 */ { .id = LOGITECH_DEVICE(BUS_USB, 0xc041) }, + /* G9 */ + { .id = LOGITECH_DEVICE(BUS_USB, 0xc048) }, + /* G500s */ { .id = LOGITECH_DEVICE(BUS_USB, 0xc24e), .svg_filename = "logitech-g500s.svg" }, From ab7b620dd4966119b269064e0d421bb07135ffee Mon Sep 17 00:00:00 2001 From: Thomas Hindoe Paaboel Andersen Date: Tue, 15 Sep 2015 20:13:54 +0200 Subject: [PATCH 3/3] hidpp10/20: fix a buffer overflow We pass a negative length into log_buffer which expects a size_t. This causes it to write past the allocated output_buf. --- src/hidpp10.c | 2 +- src/hidpp20.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/hidpp10.c b/src/hidpp10.c index 55b4679c..29af0ee1 100644 --- a/src/hidpp10.c +++ b/src/hidpp10.c @@ -151,7 +151,7 @@ hidpp10_request_command(struct hidpp10_device *dev, union hidpp10_message *msg) */ read_buffer.msg.device_idx = msg->msg.device_idx; - log_buf_raw(ratbag, " *** received: ", read_buffer.data, ret); + log_buf_raw(ratbag, " *** received: ", read_buffer.data, ret > 0 ? ret : 0); /* actual answer */ diff --git a/src/hidpp20.c b/src/hidpp20.c index 466c0af5..54fff8b0 100644 --- a/src/hidpp20.c +++ b/src/hidpp20.c @@ -123,7 +123,7 @@ hidpp20_request_command_allow_error(struct ratbag_device *device, union hidpp20_ ret = ratbag_hidraw_read_input_report(device, read_buffer.data, LONG_MESSAGE_LENGTH); } - log_buf_raw(ratbag, " *** received: ", read_buffer.data, ret); + log_buf_raw(ratbag, " *** received: ", read_buffer.data, ret > 0 ? ret : 0); if (read_buffer.msg.report_id != REPORT_ID_SHORT && read_buffer.msg.report_id != REPORT_ID_LONG)