Properly initialize input_device_id structure in
input_test_match_device_id test to make sure it contains no garbage
causing the test to randomly fail.

Fixes: fdefcbdd ("Input: Add KUnit tests for some of the input core helper functions")
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://lore.kernel.org/r/ZFLI7T2qZTGJ1UUK@google.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

input_abs_set_val() can nominally call input_alloc_absinfo() which may
allocate memory with GFP_KERNEL flag. This does not happen when
input_abs_set_val() is called by the input core to set current MT slot when
handling a new input event, but it trips certain static analyzers.

Rearrange the code to access the relevant structures directly.
Reported-by: Teng Qi <starmiku1207184332@gmail.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Link: https://lore.kernel.org/r/ZFBg379uuHjf+YEM@google.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

While KUnit tests that cannot be built as a loadable module must depend
on "KUNIT=y", this is not true for modular tests, where it adds an
unnecessary limitation.

Fix this by relaxing the dependency to "KUNIT".

Fixes: fdefcbdd ("Input: Add KUnit tests for some of the input core helper functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://lore.kernel.org/r/483c4f520e4acc6357ebba3e605977b4c56374df.1683022164.git.geert+renesas@glider.beSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

With CONFIG_DEBUG_SLAB=y:

        # Subtest: input_core
        1..3
    input: Test input device as /devices/virtual/input/input1
    8<--- cut here ---
    Unable to handle kernel paging request at virtual address 6b6b6dd7 when read
    ...
     __lock_acquire from lock_acquire+0x26c/0x300
     lock_acquire from _raw_spin_lock_irqsave+0x50/0x64
     _raw_spin_lock_irqsave from devres_remove+0x20/0x7c
     devres_remove from devres_destroy+0x8/0x24
     devres_destroy from input_free_device+0x2c/0x60
     input_free_device from kunit_try_run_case+0x70/0x94 [kunit]

Without CONFIG_DEBUG_SLAB=y:

	KTAP version 1
	# Subtest: input_core
	1..3
    input: Test input device as /devices/virtual/input/input1
    ------------[ cut here ]------------
    WARNING: CPU: 0 PID: 694 at lib/refcount.c:28 refcount_warn_saturate+0x54/0x100
    refcount_t: underflow; use-after-free.
    ...
    Call Trace: [<0037cad4>] dump_stack+0xc/0x10
     [<00377614>] __warn+0x7e/0xb4
     [<0037768c>] warn_slowpath_fmt+0x42/0x62
     [<001eee1c>] refcount_warn_saturate+0x54/0x100
     [<000b1d34>] kfree_const+0x0/0x20
     [<0036290a>] __kobject_del+0x0/0x6e
     [<001eee1c>] refcount_warn_saturate+0x54/0x100
     [<00362a1a>] kobject_put+0xa2/0xb6
     [<11965770>] kunit_generic_run_threadfn_adapter+0x0/0x1c [kunit]

As per the comments for input_allocate_device() and
input_register_device(), input_free_device() must be called only to free
devices that have not been registered.  input_unregister_device()
already calls input_put_device(), thus leading to a use-after-free.

Moreover, the kunit_suite.exit() method is called after every test case,
even on failures.  As the test itself already does cleanups in its
failure paths, this may lead to a second use-after-free.

Fix the first issue by dropping the call to input_allocate_device() from
input_test_exit().
Fix the second issue by making the cleanup code conditional on a
successful test.

Fixes: fdefcbdd ("Input: Add KUnit tests for some of the input core helper functions")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://lore.kernel.org/r/957b3b309a44d39fb6e38b2a526b250f69ea3d2c.1683022164.git.geert+renesas@glider.beSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Currently, uinput doesn't use the input_set_timestamp API, so any
event injected using uinput is not accurately timestamped in terms of
measuring when the actual event happened. Hence, call the
input_set_timestamp API from uinput in order to provide a more
accurate sense of time for the event. Propagate only the timestamps
which are a) positive, b) within a pre-defined offset (10 secs) from
the current time, and c) not in the future.
Signed-off-by: Biswarup Pal <biswarupp@google.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Siarhei Vishniakou <svv@google.com>
Link: https://lore.kernel.org/r/20230427000152.1407471-1-biswarupp@google.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Add support for touch keys found in some Atmel touch controller
configurations.
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: André Apitzsch <git@apitzsch.eu>
Link: https://lore.kernel.org/r/20230407-atmel_keys-v2-2-92446a4343cb@apitzsch.euSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

In some configurations the touch controller can support the touch keys.
Document the linux,keycodes property that enables those keys and
specifies the keycodes that should be used to report the key events.
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: André Apitzsch <git@apitzsch.eu>
Link: https://lore.kernel.org/r/20230407-atmel_keys-v2-1-92446a4343cb@apitzsch.euSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

<linux/i8042.h> include uses ENODEV when included with
!IS_ENABLED(CONFIG_SERIO_I8042) and so need to include it.
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Link: https://lore.kernel.org/r/49fd4d400d1ab62095e5ed75a6637f883c0d071b.1682795105.git.mirq-linux@rere.qmqm.plSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The watchdog_timer can schedule tx_timeout_task and watchdog_work
can also arm watchdog_timer. The process is shown below:

----------- timer schedules work ------------
cyttsp4_watchdog_timer() //timer handler
  schedule_work(&cd->watchdog_work)

----------- work arms timer ------------
cyttsp4_watchdog_work() //workqueue callback function
  cyttsp4_start_wd_timer()
    mod_timer(&cd->watchdog_timer, ...)

Although del_timer_sync() and cancel_work_sync() are called in
cyttsp4_remove(), the timer and workqueue could still be rearmed.
As a result, the possible use after free bugs could happen. The
process is shown below:

  (cleanup routine)           |  (timer and workqueue routine)
cyttsp4_remove()              | cyttsp4_watchdog_timer() //timer
  cyttsp4_stop_wd_timer()     |   schedule_work()
    del_timer_sync()          |
                              | cyttsp4_watchdog_work() //worker
                              |   cyttsp4_start_wd_timer()
                              |     mod_timer()
    cancel_work_sync()        |
                              | cyttsp4_watchdog_timer() //timer
                              |   schedule_work()
    del_timer_sync()          |
  kfree(cd) //FREE            |
                              | cyttsp4_watchdog_work() // reschedule!
                              |   cd-> //USE

This patch changes del_timer_sync() to timer_shutdown_sync(),
which could prevent rearming of the timer from the workqueue.

Fixes: 17fb1563 ("Input: cyttsp4 - add core driver for Cypress TMA4XX touchscreen devices")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://lore.kernel.org/r/20230421082919.8471-1-duoming@zju.edu.cnSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The touchscreen can be used to wake up systems from sleep and therefore
the wakeup-source entry should be included in the documentation.
Signed-off-by: Maximilian Weigand <mweigand@mweigand.net>
Reviewed-by: Alistair Francis <alistair@alistair23.me>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20230501113010.891786-6-mweigand@mweigand.netSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The removed lines are remnants of the vendor driver and are not used in
the upstream driver.
Signed-off-by: Maximilian Weigand <mweigand@mweigand.net>
Reviewed-by: Alistair Francis <alistair@alistair23.me>
Link: https://lore.kernel.org/r/20230501113010.891786-3-mweigand@mweigand.netSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

First of all, previously the 16-bit magnitude was written as-is to the
device which actually discarded the upper 8 bits since the device has
8-bit registers only. This meant that a strong_magnitude of 0xFF00 would
result in 0. To correct this shift the strong_magnitude / weak_magnitude
input values so we discard the lower 8 bits and keep the upper bits
instead.

Secondly the RTP mode that is used by default interprets the values as
signed (2s complement), so 0x81 = 0%, 0x00 = 50%, 0x7F = 100%. This
doesn't match the FF_RUMBLE interface at all, so let's tell the device
to interpret the data as unsigned instead which gets us 0x00 = 0% and
0xFF = 100%.

As last change switch ERM to using "Closed-Loop Mode, Unidirectional"
instead of "Open-Loop Mode" since it's recommended by the datasheet
compared to open loop and better matches our use case of 0% - 100%
vibration.
Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
Link: https://lore.kernel.org/r/20230430-drv260x-improvements-v1-4-1fb28b4cc698@z3ntu.xyzSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Since the driver has disabled regmap caching with REGCACHE_NONE, it's
warning us that we provide defaults that are not used. Remove them.

  [    0.561159] drv260x-haptics 0-005a: No cache used with register defaults set!

Fixes: 7132fe4f ("Input: drv260x - add TI drv260x haptics driver")
Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
Link: https://lore.kernel.org/r/20230430-drv260x-improvements-v1-3-1fb28b4cc698@z3ntu.xyzSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

When doing the initial startup there's no need to poll without any
delay and spam the I2C bus.

Let's sleep 15ms between each attempt, which is the same time as used
in the vendor driver.

Fixes: 7132fe4f ("Input: drv260x - add TI drv260x haptics driver")
Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
Link: https://lore.kernel.org/r/20230430-drv260x-improvements-v1-2-1fb28b4cc698@z3ntu.xyzSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

ANANLOG should be ANALOG. Fix the typo.

Fixes: 7132fe4f ("Input: drv260x - add TI drv260x haptics driver")
Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
Link: https://lore.kernel.org/r/20230430-drv260x-improvements-v1-1-1fb28b4cc698@z3ntu.xyzSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

This reverts commit db7220c4 because it
causes crashes when trying to dereference xpad->dev->dev in xpad_probe()
which has not been set up yet.

Reported-by: syzbot+a3f758b8d8cb7e49afec@syzkaller.appspotmail.com
Reported-by: Dongliang Mu <dzm91@hust.edu.cn>
Link: https://groups.google.com/g/syzkaller-bugs/c/iMhTgpGuIbMSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Convert the binding doc to dt schema, and also fixed the
example from fixed-regulator to regulator-fixed.
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20230407075259.1593739-1-peng.fan@oss.nxp.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

This commit explicitly disables the audio interface the same way the official
driver does. This is needed for some controllers, such as the PowerA Enhanced
Wired Controller for Series X|S (0x20d6:0x200e) to report the guide button.
Signed-off-by: Vicki Pfau <vi@endrift.com>
Link: https://lore.kernel.org/r/20230411031650.960322-3-vi@endrift.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Wired GIP devices present multiple interfaces with the same USB identification
other than the interface number. This adds constants for differentiating two of
them and uses them where appropriate
Signed-off-by: Vicki Pfau <vi@endrift.com>
Link: https://lore.kernel.org/r/20230411031650.960322-2-vi@endrift.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

No functional modification involved.

drivers/input/rmi4/rmi_bus.c:300: warning: expecting prototype for rmi_register_function_handler(). Prototype was for __rmi_register_function_handler() instead.
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Link: https://lore.kernel.org/r/20230209040710.111456-1-jiapeng.chong@linux.alibaba.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

rpi_firmware_get() take reference, we need to release it in error paths
as well. Use devm_rpi_firmware_get() helper to handling the resources.
Also remove the existing rpi_firmware_put().

Fixes: 0b9f28fe ("Input: add official Raspberry Pi's touchscreen driver")
Fixes: 3b8ddff7 ("input: raspberrypi-ts: Release firmware handle when not needed")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
Link: https://lore.kernel.org/r/20221223074657.810346-1-linmq006@gmail.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

After starting to use regmap API to access registers the edt-ft5x06
driver depends on symbols provided by REGMAP_I2C:

edt-ft5x06.o: in function `edt_ft5x06_ts_probe':
edt-ft5x06.c:1154: undefined reference to `__regmap_init_i2c'
edt-ft5x06.o: in function `edt_ft5x06_ts_identify':
edt-ft5x06.c:897: undefined reference to `__regmap_init_i2c'

Make sure support for I2C regmap is actually selected by adding this
dependency to Kconfig.

Fixes: 9dfd9708 ("Input: edt-ft5x06 - convert to use regmap API")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Link: https://lore.kernel.org/r/ZDRBExF1xmxalMZc@makrotopia.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The driver had the code to differentiate between finger and palm touches,
but did not use this information when reporting contacts. Change it so that
proper "tool" type is assigned to reported contacts.
Signed-off-by: JungHoon Hyun <hyunjunghoon@melfas.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Function input_set_abs_params() has already set EV_ABS bit for us.

drivers/input/misc/cma3000_d0x.c:328 cma3000_init() warn: inconsistent indenting.
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Link: https://lore.kernel.org/r/20230407021343.63512-1-jiapeng.chong@linux.alibaba.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

It is pointless and expensive to calculate data in the interrupt that
depends on the type of touchscreen, which is detected on the driver
probe and cannot then be changed.
So calculate the size of the data buffer on the driver probe, as well as
the data retrieval command, and then use them in the ISR.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Link: https://lore.kernel.org/r/20230402200951.1032513-10-dario.binacchi@amarulasolutions.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

With this patch, the CRC is always verified by the same function, even in
the case of accessing registers where the number of bytes is minimal.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Link: https://lore.kernel.org/r/20230402200951.1032513-9-dario.binacchi@amarulasolutions.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

It replaces custom read/write functions with regmap API, making the
driver code more generic.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Link: https://lore.kernel.org/r/20230402200951.1032513-8-dario.binacchi@amarulasolutions.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

In some parts of the code, error messages were improperly printed with
dev_dbg() calls. In those cases, dev_dbg() has been replaced with
dev_err().
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Link: https://lore.kernel.org/r/20230402200951.1032513-7-dario.binacchi@amarulasolutions.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The use of the macros M06_REG_ADDR and M06_REG_CMD avoids code
duplication without impacting the application load, and reduces the
chances of errors or mistakes.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Link: https://lore.kernel.org/r/20230402200951.1032513-6-dario.binacchi@amarulasolutions.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

There is no need to recalculate the CRC when the data has not changed.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Link: https://lore.kernel.org/r/20230402200951.1032513-5-dario.binacchi@amarulasolutions.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

It adds spaces around '-' as recommended by the Linux coding style.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Link: https://lore.kernel.org/r/20230402200951.1032513-4-dario.binacchi@amarulasolutions.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

It removes unnecessary blank lines so that checkpatch doesn't complain
anymore.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Link: https://lore.kernel.org/r/20230402200951.1032513-3-dario.binacchi@amarulasolutions.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Matches the alignment to the open parenthesis as suggested by
checkpatch.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Link: https://lore.kernel.org/r/20230402200951.1032513-2-dario.binacchi@amarulasolutions.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

When a hard IRQ is triggered, the soft IRQ, which decides if an actual
pen down happened, should always be triggered. This enables the usage of
"can_sleep" GPIO chips as "pen down" GPIO, as the value is not read
during the hard IRQ anymore. This might be the case if the GPIO chip is
an expander behind i2c.
Signed-off-by: Benjamin Bara <benjamin.bara@skidata.com>
Signed-off-by: Richard Leitner <richard.leitner@skidata.com>
Link: https://lore.kernel.org/r/20230328-tsc2007-sleep-v5-1-fc55e76d0ced@skidata.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The input subsystem doesn't currently have any unit tests, let's add a
CONFIG_INPUT_KUNIT_TEST option that builds a test suite to be executed
with the KUnit test infrastructure.

For now, only three tests were added for some of the input core helper
functions that are trivial to test:

  * input_test_polling: set/get poll interval and set-up a poll handler.

  * input_test_timestamp: set/get input event timestamps.

  * input_test_match_device_id: match a device by bus, vendor, product,
                                version and events capable of handling.

But having the minimal KUnit support allows to add more tests and suites
as follow-up changes. The tests can be run with the following command:

  $ ./tools/testing/kunit/kunit.py run --kunitconfig=drivers/input/tests/
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Tested-by: Enric Balletbo i Serra <eballetbo@redhat.com>
config: powerpc-allnoconfig (https://download.01.org/0day-ci/archive/20230330/202303301815.kRKFM3NH-lkp@intel.com/config)
Link: https://lore.kernel.org/r/20230330081831.2291351-1-javierm@redhat.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Add a new driver for the Novatek i2c touchscreen controller as found
on the Acer Iconia One 7 B1-750 tablet. Unfortunately the touchscreen
controller model-number is unknown. Even with the tablet opened up it
is impossible to read the model-number.

Android calls this a "NVT-ts" touchscreen, but that may apply to other
Novatek controller models too.

This appears to be the same controller as the one supported by
https://github.com/advx9600/android/blob/master/touchscreen/NVTtouch_Android4.0/NVTtouch.c
but unfortunately that does not give us a model-number either.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Jeff LaBundy <jeff@labundy.com>
Link: https://lore.kernel.org/r/20230326212308.55730-1-hdegoede@redhat.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Some third-party controllers, such as the HORPIAD FPS for Nintendo Switch and
Gamesir-G3w, require a specific packet that the first-party XInput driver sends
before it will start sending reports. It's not currently known what this packet
does, but since the first-party driver always sends it's unlikely that this
could cause issues with existing controllers.
Co-authored-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Vicki Pfau <vi@endrift.com>
Link: https://lore.kernel.org/r/20230324040446.3487725-3-vi@endrift.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

They act that way in PC mode.
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Pierre-Loup A. Griffais <pgriffais@valvesoftware.com>
Signed-off-by: Vicki Pfau <vi@endrift.com>
Link: https://lore.kernel.org/r/20230324040446.3487725-2-vi@endrift.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Cleanup bindings dropping unneeded quotes. Once all these are fixed,
checking for this can be enabled in yamllint.
Signed-off-by: Rob Herring <robh@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@baylibre.com> # for mediatek,mt6779-keypad.yaml
Link: https://lore.kernel.org/r/20230320234718.2930154-1-robh@kernel.orgSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

This adds support for the Turtle Beach REACT-R and Recon Xbox controllers
Signed-off-by: Vicki Pfau <vi@endrift.com>
Link: https://lore.kernel.org/r/20230225012147.276489-4-vi@endrift.comSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>