The problem here is that "len" might be less than "joydev->nabs" so the
loops which verfy abspam[i] and keypam[] might read beyond the buffer.

Fixes: 999b874f ("Input: joydev - validate axis/button maps before clobbering current ones")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YCyzR8WvFRw4HWw6@mwanda
[dtor: additional check for len being even in joydev_handle_JSIOCSBTNMAP]
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

If elo_setup_10() fails then this should return an error code instead
of success.

Fixes: fae3006e ("Input: elo - add support for non-pressure-sensitive touchscreens")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YBKFd5CvDu+jVmfW@mwandaSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

If v4l2_ctrl_handler_setup() fails then probe() should return an error
code instead of returning success.

Fixes: cee1e3e2 ("media: add video control handlers using V4L2 control framework")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YBKFkbATXa5fA3xj@mwandaSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

If an enum value were to get added without updating this switch
statement, the unreachable() annotation would trigger undefined
behavior, causing execution to fall through the end of the function,
into the next one.

Make the error handling more robust for an unexpected enum value, by
doing BUG() instead of unreachable().

Fixes the following objtool warning:

  drivers/input/touchscreen/elants_i2c.o: warning: objtool: elants_i2c_initialize() falls through to next function elants_i2c_resume()
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Reviewed-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Link: https://lore.kernel.org/r/59e2e82d1e40df11ab38874c03556a31c6b2f484.1612974132.git.jpoimboe@redhat.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Eliminate the following coccicheck warning:
./drivers/input/touchscreen/zinitix.c:164:31-32: Unneeded semicolon
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
Link: https://lore.kernel.org/r/1612319443-115831-1-git-send-email-yang.lee@linux.alibaba.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

If execution jumps to the err_kfree label, error_bl is evaluated
before it is initialized. Fix this by initializing it to zero.

Fixes: 2539da66 ("Input: iqs5xx - preserve bootloader errors")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Link: https://lore.kernel.org/r/1611592500-32209-1-git-send-email-jeff@labundy.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

This adds support for the four built-in controller
ports on the Nintendo 64 console. The N64 controller
includes an analog stick, a d-pad, and several buttons.

No module support as the target has only 8mb ram.
Signed-off-by: Lauri Kasanen <cand@gmx.com>
Link: https://lore.kernel.org/r/20210115133408.0acd70163b582b77ad0a029b@gmx.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Avoid placing the device in suspend mode (from which it cannot
generate interrupts) if it is defined as a wake-up source. The
device is still permitted to enter a low-power sensing mode on
its own.
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Link: https://lore.kernel.org/r/1611002626-5889-11-git-send-email-jeff@labundy.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

After the device is initialized, it runs ATI (calibration) during
which it cannot readily respond to I2C communication. To keep the
open and close callbacks from writing to the device too soon, the
driver waits 100 ms before returning from probe.

The vendor reports that ATI may actually take up to 250 ms to run
(including margin), so increase the delay accordingly. Update the
comments to clarify the reason for the delay as well.
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Link: https://lore.kernel.org/r/1611002626-5889-9-git-send-email-jeff@labundy.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Instead of relying on firmware to enable important register fields
and performing read-modify-write operations to additionally enable
the fields the driver cares about, it's much simpler just to write
all of the pertinent fields explicitly.

This avoids an unnecessary register read operation at start-up and
makes way for the iqs5xx_read_byte() helper to be dropped.
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Link: https://lore.kernel.org/r/1611002626-5889-8-git-send-email-jeff@labundy.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The present implementation manipulates axis swap and inversion fields
in the device to more or less duplicate what touchscreen_report_pos()
does. The resulting logic is convoluted and difficult to follow.

Instead report the maximum X and Y coordinates in earnest as they are
read from the device, then let touchscreen_parse_properties() fix the
axes up as necessary. Finally, use touchscreen_report_pos() to report
the transformed coordinates.

Last but not least, the maximum X and Y coordinates are not functions
of the number of rows/columns that comprise the touch surface. Either
coordinate is simply limited to 1 below what is reported for absolute
X or Y coordinates when no fingers are present (0xFFFF).
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Link: https://lore.kernel.org/r/1611002626-5889-7-git-send-email-jeff@labundy.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The device may be inadvertently reset during runtime in the event
of ESD strike, etc. To protect against this case, acknowledge the
SHOW_RESET interrupt and re-initialize the device.

To facilitate this change, expand the range of registers that are
read in the interrupt handler to include the system status fields.

Also, update the unrelated (but nearby) SUSPEND register field to
use the BIT() macro. The remaining register fields are cleaned up
in another patch.
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Link: https://lore.kernel.org/r/1611002626-5889-6-git-send-email-jeff@labundy.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The bootloader NAK's all I2C communication after the first 64-byte
bulk write if the bus frequency is equal to 400 kHz. This prevents
the platform from pushing updated firmware to the device.

The vendor's USB bootloader programming dongle appears to insert a
delay between the "open" command and the first 64-byte bulk write.
Adding a similar delay to the driver seems to eliminate the issue.

Furthermore, the dongle does not access the bootloader immediately
after powering up the device. Follow suit by adding a delay before
the "open" command to avoid wasted retries at 400 kHz.
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Link: https://lore.kernel.org/r/1611002626-5889-4-git-send-email-jeff@labundy.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

After user space writes the fw_file attribute to push new firmware
to the device, the driver calls iqs5xx_dev_init() to re-initialize
the device with the updated firmware or recover the device in case
the update failed.

In the case of the latter, however, iqs5xx_fw_file_write() returns
zero (success) so long as iqs5xx_dev_init() does not fail, and any
error encountered during the update process is lost. Solve this by
saving the error before calling iqs5xx_dev_init().
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Link: https://lore.kernel.org/r/1611002626-5889-3-git-send-email-jeff@labundy.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Copyrights are generally followed by the name of a person or a
company (i.e. the copyright holder) but that was not done here.
Fix this by squashing the 'copyright' and 'author' lines.

Also, trim some leading whitespace ahead of the parameters for
the fw_file_store() function and re-align them for readability.
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Link: https://lore.kernel.org/r/1611002626-5889-2-git-send-email-jeff@labundy.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Add ELAN KTF3624 touchscreen support to the elants_i2c driver.
The eKTF3624 TS is found on a series of ASUS Transformer tablet devices,
Nexus 7 tablet and etc. The firmware interface of eKTF3624 is nearly
identical to eKTH3500, which is already supported by the driver.
The minor differences of the firmware interface are now handled by
the driver. The eKTF3624 support was tested on ASUS Transformer TF700T,
TF300T and Nexus 7 tablets.
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Link: https://lore.kernel.org/r/20210124195414.27333-1-digetx@gmail.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Convert multiple full duplex transfers in to a single transfer to reduce
CPU load.

Current driver version support following filtering modes:
- ads7846_no_filter() - not filtered
- ads7846_debounce_filter() - driver specific debounce filter
- pdata->filter - platform specific debounce filter (do any platform
	provides such filter?)

Without filter this HW is not really usable, since the physic of
resistive touchscreen can provide some bounce effects. With driver internal
filter, we have constant amount of retries + debounce retries if some anomaly
was detected.

High amount of tiny SPI transfers is the primer reason of high CPU load
and interrupt frequency.

This patch create one SPI transfer with all fields and not optional retires. If
bounce anomaly was detected, we will make more transfer if needed.

Without this patch, we will get about 10% CPU load on iMX6S on pen-down event.
For example by holding stylus on the screen.

With this patch, depending in the amount of retries, the CPU load will
be 1% with "ti,debounce-rep = <3>".

One buffer transfer allows us to use PIO FIFO or DMA engine, depending
on the platform.
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20201110085041.16303-3-o.rempel@pengutronix.deSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/touchscreen/stmpe-ts.c:82: warning: Function parameter or member 'prop' not described in 'stmpe_touch'
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20210114152323.2382283-6-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/touchscreen/surface3_spi.c: In function ‘surface3_spi_process_touch’:
 drivers/input/touchscreen/surface3_spi.c:97:6: warning: variable ‘timestamp’ set but not used [-Wunused-but-set-variable]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20210114152323.2382283-5-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/touchscreen/usbtouchscreen.c: In function ‘nexio_read_data’:
 drivers/input/touchscreen/usbtouchscreen.c:1052:50: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20210114152323.2382283-4-lee.jones@linaro.org
[dtor: log error code as well]
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Dmitry requested to keep these around for the purposes of documentation.

Fixes the following W=1 kernel build warning(s):

 drivers/input/touchscreen/melfas_mip4.c: In function ‘mip4_report_touch’:
 drivers/input/touchscreen/melfas_mip4.c:474:5: warning: variable ‘size’ set but not used [-Wunused-but-set-variable]
 drivers/input/touchscreen/melfas_mip4.c:472:5: warning: variable ‘pressure_stage’ set but not used [-Wunused-but-set-variable]
 drivers/input/touchscreen/melfas_mip4.c:469:7: warning: variable ‘palm’ set but not used [-Wunused-but-set-variable]
 drivers/input/touchscreen/melfas_mip4.c:468:7: warning: variable ‘hover’ set but not used [-Wunused-but-set-variable]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20210114152323.2382283-3-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Fixes the following W=1 kernel build warning(s):

 drivers/input/mouse/synaptics.c: In function ‘synaptics_process_packet’:
 drivers/input/mouse/synaptics.c:1110:6: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20210114152323.2382283-2-lee.jones@linaro.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

We are still missing handling for errata i689 related issues for the
case where we never see a key up interrupt for the last pressed key.

To fix the issue, we must scan the key state again after the keyboard
controller has idled to check if a key up event was missed. This is
described in the omap4 silicon errata documentation for Errata ID i689
"1.32 Keyboard Key Up Event Can Be Missed":

"When a key is released for a time shorter than the debounce time,
 in-between 2 key press (KP1 and KP2), the keyboard state machine will go
 to idle mode and will never detect the key release (after KP1, and also
 after KP2), and thus will never generate a new IRQ indicating the key
 release."

We can use PM runtime autosuspend features to check the keyboard state
after it enters idle.
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/X/vrygoBxzGyXhfc@atomide.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Implement PM runtime autosuspend support to prepare for adding handling to
clear stuck last pressed key in the following patches. The hardware has
support for autoidle and can wake up to keypress events.

Let's also update omap4_keypad_probe() to use dev instead of &pdev->dev
since we already have it from the earlier changes.
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/X/vqCs5/EDURprAJ@atomide.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Let's move rest of the key scanning code to omap4_keypad_scan_keys().
We will use omap4_keypad_scan_keys() also for implementing errata
handling to clear the stuck last key in the following patch.
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210110190529.46135-4-tony@atomide.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Because of errata i689 the keyboard can idle with state where no key
up interrupts are seen until after the next key press.

This means we need to first check for any lost key up events before
scanning for new down events.

For example, rapidly pressing shift-shift-j can sometimes produce a J
instead of j. Let's fix the issue by scanning the keyboard in two
phases. First we scan for any key up events that we may have missed,
and then we scan for key down events.

Let's also simplify things with for_each_set_bit() as suggested by
Dmitry Torokhov <dmitry.torokhov@gmail.com>.
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210110190529.46135-3-tony@atomide.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

We are not using the long events and they produce extra interrupts.
Let's not enable them at all.

Note that also the v3.0.8 Linux Android kernel has long interrupts
disabled.
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210110190529.46135-2-tony@atomide.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Now that input core supports devres-managed input devices we can clean
up this driver a bit.

Link: https://lore.kernel.org/r/X/qfJKiM21uyksYl@google.comTested-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

devm_platform_ioremap_resource() depends on CONFIG_HAS_IOMEM, so let's add
it to the dependencies when COMPILE_TEST is enabled.
Reported-by: kernel test robot <lkp@intel.com>
Fixes: c8834032 ("Input: imx_keypad - add COMPILE_TEST support")
Link: https://lore.kernel.org/r/X9llpA3w1zlZCHXU@google.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The OF match table is only used when OF is enabled.

Fixes: cd3f6098 ("Input: new da7280 haptic driver")
Reported-by: kernel test robot <lkp@intel.com>
Acked-by: Roy Im <roy.im.opensource@diasemi.com>
Link: https://lore.kernel.org/r/X9xRLVPt9eBi0CT6@google.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Add default write command package to prevent i2c quirk error of zero
data length as Raydium touch firmware update is executed.
Signed-off-by: jeffrey.lin <jeffrey.lin@rad-ic.com>
Link: https://lore.kernel.org/r/1608031217-7247-1-git-send-email-jeffrey.lin@raydium.corp-partner.google.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

An "if" testing for error condition has accidentally been dropped from
the code.
Reported-by: kernel test robot <lkp@intel.com>
Fixes: cd3f6098 ("Input: new da7280 haptic driver")
Reviewed-by: Roy Im <Roy.Im.Opensource@diasemi.com>
Link: https://lore.kernel.org/r/X9j8lGFgijzHyYZZ@google.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

There is a spelling mistake in a dev_err message. Fix it.
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20201214223109.82924-1-colin.king@canonical.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

gcc -Warray-bounds warns about a serious bug in
cyapa_pip_retrieve_data_structure:

drivers/input/mouse/cyapa_gen6.c: In function 'cyapa_pip_retrieve_data_structure.constprop':
include/linux/unaligned/access_ok.h:40:17: warning: array subscript -1 is outside array bounds of 'struct retrieve_data_struct_cmd[1]' [-Warray-bounds]
   40 |  *((__le16 *)p) = cpu_to_le16(val);
drivers/input/mouse/cyapa_gen6.c:569:13: note: while referencing 'cmd'
  569 |  } __packed cmd;
      |             ^~~

Apparently the '-2' was added to the pointer instead of the value,
writing garbage into the stack next to this variable.

Fixes: c2c06c41 ("Input: cyapa - add gen6 device module support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20201026161332.3708389-1-arnd@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Add new compatible strings and match data to support sc2730 and sc2721
which are two varieties of SC27XX family.
Signed-off-by: Nemo Han <nemo.han@unisoc.com>
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Link: https://lore.kernel.org/r/20201117034949.47877-2-zhang.lyra@gmail.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Add new compatible strings to support sc2730 and sc2721 which are
two varieties of SC27XX family.
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20201117034949.47877-4-zhang.lyra@gmail.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Convert the sprd sc27xx vibrator binding to DT schema using json-schema.
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20201117034949.47877-3-zhang.lyra@gmail.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Make use of generic touchscreen_properties structure to add axis
inversion and swapping capabilities. It's configurable via devicetree
properties:
  touchscreen-inverted-x
  touchscreen-inverted-y
  touchscreen-swapped-x-y
Signed-off-by: Stefan Riedmueller <s.riedmueller@phytec.de>
Link: https://lore.kernel.org/r/20200922093903.157232-1-s.riedmueller@phytec.deSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

If device is set up as a wakeup source, I2C core configures the interrupt
line as wake IRQ and PM core automatically configures it for waking up the
system on system suspend transition, so we do not have to explicitly call
enable_irq_wake() and disable_irq_wake() in suspend/resume.

Link: https://lore.kernel.org/r/20201120073920.3214492-2-dmitry.torokhov@gmail.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

We should not be configuring the controller as a wakeup source in the
driver, but rather rely on I2C core to mark it as such by either
instantiating as I2C_CLIENT_WAKEUP or specifying "wakeup-source" device
property.

Link: https://lore.kernel.org/r/20201120073920.3214492-1-dmitry.torokhov@gmail.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>