Input: elan_i2c - add new trackpoint report type 0x5F

The 0x5F is a new trackpoint report type used by some modules.

Signed-off-by: Jingle Wu <jingle.wu@emc.com.tw>
Link: https://lore.kernel.org/r/20201211071511.32349-1-jingle.wu@emc.com.tw
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c - fix firmware update on newer ICs

The argument to iap page type command depends on the firmware page size.

Fixes: bfd9b92bc8f9 ("Input: elan_i2c - handle firmware updated on newer ICs")
Signed-off-by: Jingle Wu <jingle.wu@emc.com.tw>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c - add support for high resolution reports

Newer controllers (identified as "pattern" version 2) send higher
resolution reports, with 16-bit X and Y coordinates (previous generations
used 12-bit values). These new high resolution reports use report ID of
0x60.

SMbus controllers use the same buffer size for both the new and old
reports, and because of that high resolution reports no longer carry
area of contact data with SMbus.

Signed-off-by: Jingle Wu <jingle.wu@emc.com.tw>
Link: https://lore.kernel.org/r/20200710054116.5529-1-jingle.wu@emc.com.tw
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c - do not constantly re-query pattern ID

We do not need to constantly re-query pattern ID, we can instead query it
once and then pass to methods that need it.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c - handle firmware updated on newer ICs

Newer ICs with IC type value starting with 0x0D and newer bootloader code
use 128-byte firmware pages. Their bootloader also needs to be switched to
proper mode before executing firmware update.

Signed-off-by: Jingle Wu <jingle.wu@emc.com.tw>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c - add support for different firmware page sizes

Prepare driver for devices that use different sizes of firmware pages.

Signed-off-by: Jingle Wu <jingle.wu@emc.com.tw>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

Based on 2 normalized pattern(s):

this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license version 2 as
published by the free software foundation

this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license version 2 as
published by the free software foundation #

extracted by the scancode license scanner the SPDX license identifier

GPL-2.0-only

has been chosen to replace the boilerplate/reference in 4122 file(s).

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Enrico Weigelt <info@metux.net>
Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org>
Reviewed-by: Allison Randal <allison@lohutok.net>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190604081206.933168790@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Input: elan_i2c_smbus - cast sizeof to int for comparison

Comparing an int to a size, which is unsigned, causes the int to become
unsigned, giving the wrong result. i2c_smbus_read_block_data can return the
result of i2c_smbus_xfer, whih can return a negative error code.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
int x;
expression e,e1;
identifier f;
@@

*x = f(...);
... when != x = e1
when != if (x < 0 || ...) { ... return ...; }
*x < sizeof(e)
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c_smbus - fix more potential stack buffer overflows

Commit 40f7090bb1b4 ("Input: elan_i2c_smbus - fix corrupted stack")
fixed most of the functions using i2c_smbus_read_block_data() to
allocate a buffer with the maximum block size. However three
functions were left unchanged:

* In elan_smbus_initialize(), increase the buffer size in the same
way.
* In elan_smbus_calibrate_result(), the buffer is provided by the
caller (calibrate_store()), so introduce a bounce buffer. Also
name the result buffer size.
* In elan_smbus_get_report(), the buffer is provided by the caller
but happens to be the right length. Add a compile-time assertion
to ensure this remains the case.

Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c_smbus - fix corrupted stack

New ICs (like the one on the Lenovo T480s) answer to
ETP_SMBUS_IAP_VERSION_CMD 4 bytes instead of 3. This corrupts the stack
as i2c_smbus_read_block_data() uses the values returned by the i2c
device to know how many data it need to return.

i2c_smbus_read_block_data() can read up to 32 bytes (I2C_SMBUS_BLOCK_MAX)
and there is no safeguard on how many bytes are provided in the return
value. Ensure we always have enough space for any future firmware.
Also 0-initialize the values to prevent any access to uninitialized memory.

Cc: <stable@vger.kernel.org> # v4.4.x, v4.9.x, v4.14.x, v4.15.x, v4.16.x
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: KT Liao <kt.liao@emc.com.tw>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c - support touchpads with two physical buttons

Elan touchpads on Asus ROG G752xx series laptops have 2 physical buttons.
Luckily we can query the touchpad to see if it is a clickpad variant and
adjust the behavior accordingly.

Signed-off-by: KT Liao <kt.liao@emc.com.tw>
Tested-by: Maxime Bellengé <maxime.bellenge@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c - add support for fetching chip type on newer hardware

Newer Elantech hardware requires different way of fetching chip type and
version data.

Signed-off-by: KT Liao <kt.liao@emc.com.tw>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c - fix return tests of i2c_smbus_read_block_data()

i2c_smbus_read_block_data() returns negative errno else the number of
data bytes in the slave's response.

Checking for error not null means the function always fails if the device
answers properly.

So given that we read 3 bytes and access those, better check that we
actually read those 3 bytes.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c - expand maximum product_id form 0xFF to 0xFFFF

In order to support more projects in the future, we expand the
maximum product_id value form 0xFF to 0xFFFF.

Signed-off by: Duson Lin <dusonlin@emc.com.tw>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c - add support for multi IC type and iap format

In order to support multiple IC types for i2c/smbus protocol, add get ic
type command and use this data when checking firmware page count and
signature address.

Signed-off-by: Duson Lin <dusonlin@emc.com.tw>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c - fix calculating number of x and y traces.

According to Elan's firmware engineers we should not be subtracting 1 form
the raw number of x and y traces so that the pitch size is correct. For
example, if the touchpad x resolution is 2800 and x trace number is 20,
the pitch size of x should be 2800/20 = 140, not 2800/19 = 147.36.

Signed-off-by: Duson Lin <dusonlin@emc.com.tw>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c - adjust for newer firmware pressure reporting

Get pressure format flag from firmware to check if we need to normalize
pressure data before reporting it.

Signed-off-by: Duson Lin <dusonlin@emc.com.tw>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c - fix wrong %p extension

There's no %px extension. From the context I think the intention was to
dump the five bytes which were not as expected, and for that one should use
%ph.

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: elan_i2c - verify firmware signature applying it

To allow for different firmware sizes let's replace the original size check
with with checking the signature in the firmware data.

Signed-off-by: Duson Lin <dusonlin@emc.com.tw>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: add driver for Elan I2C/SMbus touchpad

This driver supports Elan I2C/SMbus touchpads found in some laptops and
also in many Chromebooks.

Signed-off-by: Duson Lin <dusonlin@emc.com.tw>
Reviewed-by: Benson Leung <bleung@chromium.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>