Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: xen-kbdfront - fix mouse getting stuck after save/restore
  Input: estimate number of events per packet
  Input: evdev - indicate buffer overrun with SYN_DROPPED
  Input: document event types and codes and their intended use
  Input: add KEY_IMAGES specifically for AL Image Browser
  Input: twl4030_keypad - fix potential NULL dereference in twl4030_kp_probe()
  Input: h3600_ts - fix error handling at connect
  Input: twl4030_keypad - avoid potential NULL-pointer dereference

5 files changed, 87 insertions, 22 deletions

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 7f42d3a454d2..88d8e4cb419a 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -39,13 +39,13 @@ struct evdev {
 };
 
 struct evdev_client {
-        int head;
-        int tail;
+        unsigned int head;
+        unsigned int tail;
         spinlock_t buffer_lock; /* protects access to buffer, head and tail */
         struct fasync_struct *fasync;
         struct evdev *evdev;
         struct list_head node;
-        int bufsize;
+        unsigned int bufsize;
         struct input_event buffer[];
 };
 
@@ -55,16 +55,25 @@ static DEFINE_MUTEX(evdev_table_mutex);
 static void evdev_pass_event(struct evdev_client *client,
                              struct input_event *event)
 {
-        /*
-         * Interrupts are disabled, just acquire the lock.
-         * Make sure we don't leave with the client buffer
-         * "empty" by having client->head == client->tail.
-         */
+        /* Interrupts are disabled, just acquire the lock. */
         spin_lock(&client->buffer_lock);
-        do {
-                client->buffer[client->head++] = *event;
-                client->head &= client->bufsize - 1;
-        } while (client->head == client->tail);
+
+        client->buffer[client->head++] = *event;
+        client->head &= client->bufsize - 1;
+
+        if (unlikely(client->head == client->tail)) {
+                /*
+                 * This effectively "drops" all unconsumed events, leaving
+                 * EV_SYN/SYN_DROPPED plus the newest event in the queue.
+                 */
+                client->tail = (client->head - 2) & (client->bufsize - 1);
+
+                client->buffer[client->tail].time = event->time;
+                client->buffer[client->tail].type = EV_SYN;
+                client->buffer[client->tail].code = SYN_DROPPED;
+                client->buffer[client->tail].value = 0;
+        }
+
         spin_unlock(&client->buffer_lock);
 
         if (event->type == EV_SYN)
diff --git a/drivers/input/input.c b/drivers/input/input.c
index d6e8bd8a851c..ebbceedc92f4 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1746,6 +1746,42 @@ void input_set_capability(struct input_dev *dev, unsigned int type, unsigned int
 }
 EXPORT_SYMBOL(input_set_capability);
 
+static unsigned int input_estimate_events_per_packet(struct input_dev *dev)
+{
+        int mt_slots;
+        int i;
+        unsigned int events;
+
+        if (dev->mtsize) {
+                mt_slots = dev->mtsize;
+        } else if (test_bit(ABS_MT_TRACKING_ID, dev->absbit)) {
+                mt_slots = dev->absinfo[ABS_MT_TRACKING_ID].maximum -
+                           dev->absinfo[ABS_MT_TRACKING_ID].minimum + 1,
+                clamp(mt_slots, 2, 32);
+        } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+                mt_slots = 2;
+        } else {
+                mt_slots = 0;
+        }
+
+        events = mt_slots + 1; /* count SYN_MT_REPORT and SYN_REPORT */
+
+        for (i = 0; i < ABS_CNT; i++) {
+                if (test_bit(i, dev->absbit)) {
+                        if (input_is_mt_axis(i))
+                                events += mt_slots;
+                        else
+                                events++;
+                }
+        }
+
+        for (i = 0; i < REL_CNT; i++)
+                if (test_bit(i, dev->relbit))
+                        events++;
+
+        return events;
+}
+
 #define INPUT_CLEANSE_BITMASK(dev, type, bits)                          \
         do {                                                            \
                 if (!test_bit(EV_##type, dev->evbit))                   \
@@ -1793,6 +1829,10 @@ int input_register_device(struct input_dev *dev)
         /* Make sure that bitmasks not mentioned in dev->evbit are clean. */
         input_cleanse_bitmasks(dev);
 
+        if (!dev->hint_events_per_packet)
+                dev->hint_events_per_packet =
+                                input_estimate_events_per_packet(dev);
+
         /*
          * If delay and period are pre-set by the driver, then autorepeating
          * is handled by the driver itself and we don't do it in input.c.
diff --git a/drivers/input/keyboard/twl4030_keypad.c b/drivers/input/keyboard/twl4030_keypad.c
index 09bef79d9da1..a26922cf0e84 100644
--- a/drivers/input/keyboard/twl4030_keypad.c
+++ b/drivers/input/keyboard/twl4030_keypad.c
@@ -332,18 +332,20 @@ static int __devinit twl4030_kp_program(struct twl4030_keypad *kp)
 static int __devinit twl4030_kp_probe(struct platform_device *pdev)
 {
         struct twl4030_keypad_data *pdata = pdev->dev.platform_data;
-        const struct matrix_keymap_data *keymap_data = pdata->keymap_data;
+        const struct matrix_keymap_data *keymap_data;
         struct twl4030_keypad *kp;
         struct input_dev *input;
         u8 reg;
         int error;
 
-        if (!pdata || !pdata->rows || !pdata->cols ||
+        if (!pdata || !pdata->rows || !pdata->cols || !pdata->keymap_data ||
             pdata->rows > TWL4030_MAX_ROWS || pdata->cols > TWL4030_MAX_COLS) {
                 dev_err(&pdev->dev, "Invalid platform_data\n");
                 return -EINVAL;
         }
 
+        keymap_data = pdata->keymap_data;
+
         kp = kzalloc(sizeof(*kp), GFP_KERNEL);
         input = input_allocate_device();
         if (!kp || !input) {
diff --git a/drivers/input/misc/xen-kbdfront.c b/drivers/input/misc/xen-kbdfront.c
index 7077f9bf5ead..62bae99424e6 100644
--- a/drivers/input/misc/xen-kbdfront.c
+++ b/drivers/input/misc/xen-kbdfront.c
@@ -303,7 +303,7 @@ static void xenkbd_backend_changed(struct xenbus_device *dev,
                                    enum xenbus_state backend_state)
 {
         struct xenkbd_info *info = dev_get_drvdata(&dev->dev);
-        int val;
+        int ret, val;
 
         switch (backend_state) {
         case XenbusStateInitialising:
@@ -316,6 +316,17 @@ static void xenkbd_backend_changed(struct xenbus_device *dev,
 
         case XenbusStateInitWait:
 InitWait:
+                ret = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
+                                   "feature-abs-pointer", "%d", &val);
+                if (ret < 0)
+                        val = 0;
+                if (val) {
+                        ret = xenbus_printf(XBT_NIL, info->xbdev->nodename,
+                                            "request-abs-pointer", "1");
+                        if (ret)
+                                pr_warning("xenkbd: can't request abs-pointer");
+                }
+
                 xenbus_switch_state(dev, XenbusStateConnected);
                 break;
 
diff --git a/drivers/input/touchscreen/h3600_ts_input.c b/drivers/input/touchscreen/h3600_ts_input.c
index efa06882de00..45f93d0f5592 100644
--- a/drivers/input/touchscreen/h3600_ts_input.c
+++ b/drivers/input/touchscreen/h3600_ts_input.c
@@ -399,31 +399,34 @@ static int h3600ts_connect(struct serio *serio, struct serio_driver *drv)
                         IRQF_SHARED | IRQF_DISABLED, "h3600_action", &ts->dev)) {
                 printk(KERN_ERR "h3600ts.c: Could not allocate Action Button IRQ!\n");
                 err = -EBUSY;
-                goto fail2;
+                goto fail1;
         }
 
         if (request_irq(IRQ_GPIO_BITSY_NPOWER_BUTTON, npower_button_handler,
                         IRQF_SHARED | IRQF_DISABLED, "h3600_suspend", &ts->dev)) {
                 printk(KERN_ERR "h3600ts.c: Could not allocate Power Button IRQ!\n");
                 err = -EBUSY;
-                goto fail3;
+                goto fail2;
         }
 
         serio_set_drvdata(serio, ts);
 
         err = serio_open(serio, drv);
         if (err)
-                return err;
+                goto fail3;
 
         //h3600_flite_control(1, 25);     /* default brightness */
-        input_register_device(ts->dev);
+        err = input_register_device(ts->dev);
+        if (err)
+                goto fail4;
 
         return 0;
 
-fail3:  free_irq(IRQ_GPIO_BITSY_NPOWER_BUTTON, ts->dev);
+fail4:  serio_close(serio);
+fail3:  serio_set_drvdata(serio, NULL);
+        free_irq(IRQ_GPIO_BITSY_NPOWER_BUTTON, ts->dev);
 fail2:  free_irq(IRQ_GPIO_BITSY_ACTION_BUTTON, ts->dev);
-fail1:  serio_set_drvdata(serio, NULL);
-        input_free_device(input_dev);
+fail1:  input_free_device(input_dev);
         kfree(ts);
         return err;
 }