4 files changed, 48 insertions, 17 deletions

diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index a0e2e797c6d5..070d75330afd 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -470,7 +470,7 @@ int alps_init(struct psmouse *psmouse)
                 dev1->keybit[LONG(BTN_BACK)] |= BIT(BTN_BACK);
         }
 
-        sprintf(priv->phys, "%s/input1", psmouse->ps2dev.serio->phys);
+        snprintf(priv->phys, sizeof(priv->phys), "%s/input1", psmouse->ps2dev.serio->phys);
         dev2->phys = priv->phys;
         dev2->name = (priv->i->flags & ALPS_DUALPOINT) ? "DualPoint Stick" : "PS/2 Mouse";
         dev2->id.bustype = BUS_I8042;
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 136321a2cfdb..8bc9f51ae6c2 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -150,9 +150,20 @@ static psmouse_ret_t psmouse_process_byte(struct psmouse *psmouse, struct pt_reg
  */
 
         if (psmouse->type == PSMOUSE_IMEX) {
-                input_report_rel(dev, REL_WHEEL, (int) (packet[3] & 8) - (int) (packet[3] & 7));
-                input_report_key(dev, BTN_SIDE, (packet[3] >> 4) & 1);
-                input_report_key(dev, BTN_EXTRA, (packet[3] >> 5) & 1);
+                switch (packet[3] & 0xC0) {
+                        case 0x80: /* vertical scroll on IntelliMouse Explorer 4.0 */
+                                input_report_rel(dev, REL_WHEEL, (int) (packet[3] & 32) - (int) (packet[3] & 31));
+                                break;
+                        case 0x40: /* horizontal scroll on IntelliMouse Explorer 4.0 */
+                                input_report_rel(dev, REL_HWHEEL, (int) (packet[3] & 32) - (int) (packet[3] & 31));
+                                break;
+                        case 0x00:
+                        case 0xC0:
+                                input_report_rel(dev, REL_WHEEL, (int) (packet[3] & 8) - (int) (packet[3] & 7));
+                                input_report_key(dev, BTN_SIDE, (packet[3] >> 4) & 1);
+                                input_report_key(dev, BTN_EXTRA, (packet[3] >> 5) & 1);
+                                break;
+                }
         }
 
 /*
@@ -466,9 +477,25 @@ static int im_explorer_detect(struct psmouse *psmouse, int set_properties)
         if (param[0] != 4)
                 return -1;
 
+/* Magic to enable horizontal scrolling on IntelliMouse 4.0 */
+        param[0] = 200;
+        ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
+        param[0] =  80;
+        ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
+        param[0] =  40;
+        ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
+
+        param[0] = 200;
+        ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
+        param[0] = 200;
+        ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
+        param[0] =  60;
+        ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE);
+
         if (set_properties) {
                 set_bit(BTN_MIDDLE, psmouse->dev->keybit);
                 set_bit(REL_WHEEL, psmouse->dev->relbit);
+                set_bit(REL_HWHEEL, psmouse->dev->relbit);
                 set_bit(BTN_SIDE, psmouse->dev->keybit);
                 set_bit(BTN_EXTRA, psmouse->dev->keybit);
 
@@ -1057,8 +1084,8 @@ static int psmouse_switch_protocol(struct psmouse *psmouse, struct psmouse_proto
         if (psmouse->resync_time && psmouse->poll(psmouse))
                 psmouse->resync_time = 0;
 
-        sprintf(psmouse->devname, "%s %s %s",
-                psmouse_protocol_by_type(psmouse->type)->name, psmouse->vendor, psmouse->name);
+        snprintf(psmouse->devname, sizeof(psmouse->devname), "%s %s %s",
+                 psmouse_protocol_by_type(psmouse->type)->name, psmouse->vendor, psmouse->name);
 
         input_dev->name = psmouse->devname;
         input_dev->phys = psmouse->phys;
@@ -1099,7 +1126,7 @@ static int psmouse_connect(struct serio *serio, struct serio_driver *drv)
         ps2_init(&psmouse->ps2dev, serio);
         INIT_WORK(&psmouse->resync_work, psmouse_resync, psmouse);
         psmouse->dev = input_dev;
-        sprintf(psmouse->phys, "%s/input0", serio->phys);
+        snprintf(psmouse->phys, sizeof(psmouse->phys), "%s/input0", serio->phys);
 
         psmouse_set_state(psmouse, PSMOUSE_INITIALIZING);
 
diff --git a/drivers/input/mouse/sermouse.c b/drivers/input/mouse/sermouse.c
index 2f9a04ae725f..a89742431717 100644
--- a/drivers/input/mouse/sermouse.c
+++ b/drivers/input/mouse/sermouse.c
@@ -254,7 +254,7 @@ static int sermouse_connect(struct serio *serio, struct serio_driver *drv)
                 goto fail;
 
         sermouse->dev = input_dev;
-        sprintf(sermouse->phys, "%s/input0", serio->phys);
+        snprintf(sermouse->phys, sizeof(sermouse->phys), "%s/input0", serio->phys);
         sermouse->type = serio->id.proto;
 
         input_dev->name = sermouse_protocols[sermouse->type];
diff --git a/drivers/input/mouse/vsxxxaa.c b/drivers/input/mouse/vsxxxaa.c
index 36e9442a16b2..7b85bc21ae4a 100644
--- a/drivers/input/mouse/vsxxxaa.c
+++ b/drivers/input/mouse/vsxxxaa.c
@@ -153,22 +153,25 @@ vsxxxaa_detection_done (struct vsxxxaa *mouse)
 {
         switch (mouse->type) {
                 case 0x02:
-                        sprintf (mouse->name, "DEC VSXXX-AA/-GA mouse");
+                        strlcpy (mouse->name, "DEC VSXXX-AA/-GA mouse",
+                                 sizeof (mouse->name));
                         break;
 
                 case 0x04:
-                        sprintf (mouse->name, "DEC VSXXX-AB digitizer");
+                        strlcpy (mouse->name, "DEC VSXXX-AB digitizer",
+                                 sizeof (mouse->name));
                         break;
 
                 default:
-                        sprintf (mouse->name, "unknown DEC pointer device "
-                                        "(type = 0x%02x)", mouse->type);
+                        snprintf (mouse->name, sizeof (mouse->name),
+                                  "unknown DEC pointer device (type = 0x%02x)",
+                                  mouse->type);
                         break;
         }
 
-        printk (KERN_INFO "Found %s version 0x%02x from country 0x%02x "
-                        "on port %s\n", mouse->name, mouse->version,
-                        mouse->country, mouse->phys);
+        printk (KERN_INFO
+                "Found %s version 0x%02x from country 0x%02x on port %s\n",
+                mouse->name, mouse->version, mouse->country, mouse->phys);
 }
 
 /*
@@ -503,8 +506,9 @@ vsxxxaa_connect (struct serio *serio, struct serio_driver *drv)
 
         mouse->dev = input_dev;
         mouse->serio = serio;
-        sprintf (mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer");
-        sprintf (mouse->phys, "%s/input0", serio->phys);
+        strlcat (mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer",
+                 sizeof (mouse->name));
+        snprintf (mouse->phys, sizeof (mouse->phys), "%s/input0", serio->phys);
 
         input_dev->name = mouse->name;
         input_dev->phys = mouse->phys;