[PATCH 0/3] Input: stmfts - event parsing and coordinate reporting fixes

[PATCH 0/3] Input: stmfts - event parsing and coordinate reporting fixes

[Dmitry Torokhov]

This series addresses a few issues in the stmfts touchscreen driver's
event handling and coordinate reporting for both FTS4 and FTS5
controllers.

First, it updates the FIFO event parsing loops so that non-touch events
(such as controller-ready, status, user-report, or debug events) do not
abort processing of subsequent touch events already read in the same
FIFO batch. Next, it validates the 4-bit slot ID extracted from event
payloads against STMFTS_MAX_FINGERS before calling input_mt_slot().
Finally, it switches contact and hover coordinate reporting to use
touchscreen_report_pos() so that axis inversion and swapping properties
parsed by touchscreen_parse_properties() are respected.

Dmitry Torokhov (3):
  Input: stmfts - do not abort event parsing on non-touch events
  Input: stmfts - validate slot ID in touch events
  Input: stmfts - use touchscreen_report_pos() for coordinates

 drivers/input/touchscreen/stmfts.c | 49 ++++++++++++++++++++++--------
 1 file changed, 36 insertions(+), 13 deletions(-)

-- 
2.56.0.385.gac671c819a-goog

[PATCH 1/3] Input: stmfts - do not abort event parsing on non-touch events

[Dmitry Torokhov]

When processing hardware interrupts, stmfts_read_events() reads a batch
of up to 32 events from the controller FIFO into the buffer. Only
STMFTS_EV_NO_EVENT (0x00) marks the end of valid events in this buffer.

Currently, both stmfts_parse_events() and stmfts5_parse_events() abort
the event parsing loop early upon encountering non-touch events such as
controller-ready, status, user-report, or debug events. This causes any
subsequent touch events that were already read from the FIFO in the same
batch to be discarded.

Update both event parsing loops so only STMFTS_EV_NO_EVENT terminates
processing, while non-touch events complete cmd_done when applicable and
continue processing the remaining entries in the FIFO buffer.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/input/touchscreen/stmfts.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c
index 727dc8041518..3613c7f2ab15 100644
--- a/drivers/input/touchscreen/stmfts.c
+++ b/drivers/input/touchscreen/stmfts.c
@@ -391,15 +391,17 @@ static void stmfts_parse_events(struct stmfts_data *sdata)
 		u8 *event = &sdata->data[i * STMFTS_EVENT_SIZE];
 
 		switch (event[0]) {
+		case STMFTS_EV_NO_EVENT:
+			return;
+
 		case STMFTS_EV_CONTROLLER_READY:
 		case STMFTS_EV_SLEEP_OUT_CONTROLLER_READY:
 		case STMFTS_EV_STATUS:
 			complete(&sdata->cmd_done);
 			fallthrough;
 
-		case STMFTS_EV_NO_EVENT:
 		case STMFTS_EV_DEBUG:
-			return;
+			continue;
 		}
 
 		switch (event[0] & STMFTS_MASK_EVENT_ID) {
@@ -442,19 +444,19 @@ static void stmfts5_parse_events(struct stmfts_data *sdata)
 		u8 *event = &sdata->data[i * STMFTS_EVENT_SIZE];
 
 		switch (event[0]) {
-		case STMFTS5_EV_CONTROLLER_READY:
-			complete(&sdata->cmd_done);
-			fallthrough;
-
 		case STMFTS_EV_NO_EVENT:
 			goto sync;
+
+		case STMFTS5_EV_CONTROLLER_READY:
+			complete(&sdata->cmd_done);
+			continue;
 		}
 
 		switch (event[0] & STMFTS5_MASK_EVENT_ID) {
 		case STMFTS5_EV_STATUS_UPDATE:
 		case STMFTS5_EV_USER_REPORT:
 		case STMFTS5_EV_DEBUG:
-			goto sync;
+			continue;
 
 		case STMFTS5_EV_MULTI_TOUCH_ENTER:
 		case STMFTS5_EV_MULTI_TOUCH_MOTION:
-- 
2.56.0.385.gac671c819a-goog

[PATCH 2/3] Input: stmfts - validate slot ID in touch events

[Dmitry Torokhov]

Both FTS4 and FTS5 contact and release reporting functions extract a
4-bit slot/touch ID (values 0 to 15) from the event payload. However,
the driver initializes only STMFTS_MAX_FINGERS (10) multi-touch slots.

Passing a slot ID greater than or equal to STMFTS_MAX_FINGERS to
input_mt_slot() is silently rejected by the input core without updating
mt->slot, which causes subsequent slot state, coordinate, or release
reports to corrupt or release the previously active slot.

Validate that the slot ID is strictly less than STMFTS_MAX_FINGERS in
stmfts_report_contact_event(), stmfts_report_contact_release(),
stmfts5_report_contact_event(), and stmfts5_report_contact_release(),
logging a warning and returning early when an invalid slot ID is
encountered.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/input/touchscreen/stmfts.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c
index 3613c7f2ab15..25d127aa8642 100644
--- a/drivers/input/touchscreen/stmfts.c
+++ b/drivers/input/touchscreen/stmfts.c
@@ -232,6 +232,12 @@ static void stmfts_report_contact_event(struct stmfts_data *sdata,
 	u8 orientation = event[6];
 	u8 area = event[7];
 
+	if (slot_id >= STMFTS_MAX_FINGERS) {
+		dev_warn(&sdata->client->dev,
+			 "invalid slot ID %u\n", slot_id);
+		return;
+	}
+
 	input_mt_slot(sdata->input, slot_id);
 
 	input_mt_report_slot_state(sdata->input, MT_TOOL_FINGER, true);
@@ -250,6 +256,12 @@ static void stmfts_report_contact_release(struct stmfts_data *sdata,
 {
 	u8 slot_id = (event[0] & STMFTS_MASK_TOUCH_ID) >> 4;
 
+	if (slot_id >= STMFTS_MAX_FINGERS) {
+		dev_warn(&sdata->client->dev,
+			 "invalid slot ID %u\n", slot_id);
+		return;
+	}
+
 	input_mt_slot(sdata->input, slot_id);
 	input_mt_report_slot_inactive(sdata->input);
 
@@ -282,6 +294,12 @@ static void stmfts5_report_contact_event(struct stmfts_data *sdata,
 	int distance = 0;
 	unsigned int tool;
 
+	if (touch_id >= STMFTS_MAX_FINGERS) {
+		dev_warn(&sdata->client->dev,
+			 "invalid slot ID %u\n", touch_id);
+		return;
+	}
+
 	switch (touch_type) {
 	case STMFTS_TOUCH_TYPE_STYLUS:
 		tool = MT_TOOL_PEN;
@@ -340,6 +358,12 @@ static void stmfts5_report_contact_release(struct stmfts_data *sdata,
 	/* format: touch ID is in high 4 bits of event[1] */
 	u8 touch_id = (event[1] & STMFTS_MASK_TOUCH_ID) >> 4;
 
+	if (touch_id >= STMFTS_MAX_FINGERS) {
+		dev_warn(&sdata->client->dev,
+			 "invalid slot ID %u\n", touch_id);
+		return;
+	}
+
 	input_mt_slot(sdata->input, touch_id);
 	input_mt_report_slot_inactive(sdata->input);
 }
-- 
2.56.0.385.gac671c819a-goog

[PATCH 3/3] Input: stmfts - use touchscreen_report_pos() for coordinates

[Dmitry Torokhov]

During driver initialization, stmfts_probe() invokes
touchscreen_parse_properties() to parse axis inversion and swapping
properties into sdata->prop.

However, stmfts_report_contact_event(), stmfts5_report_contact_event(),
and stmfts_report_hover_event() continue to report coordinates directly
using input_report_abs(), ignoring any configured axis inversion or
swapping settings in sdata->prop.

Update coordinate reporting across all three functions to use
touchscreen_report_pos() with &sdata->prop so that axis inversion and
swapping transformations are properly applied.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/input/touchscreen/stmfts.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c
index 25d127aa8642..f68da3e1309b 100644
--- a/drivers/input/touchscreen/stmfts.c
+++ b/drivers/input/touchscreen/stmfts.c
@@ -241,8 +241,7 @@ static void stmfts_report_contact_event(struct stmfts_data *sdata,
 	input_mt_slot(sdata->input, slot_id);
 
 	input_mt_report_slot_state(sdata->input, MT_TOOL_FINGER, true);
-	input_report_abs(sdata->input, ABS_MT_POSITION_X, x);
-	input_report_abs(sdata->input, ABS_MT_POSITION_Y, y);
+	touchscreen_report_pos(sdata->input, &sdata->prop, x, y, true);
 	input_report_abs(sdata->input, ABS_MT_TOUCH_MAJOR, maj);
 	input_report_abs(sdata->input, ABS_MT_TOUCH_MINOR, min);
 	input_report_abs(sdata->input, ABS_MT_PRESSURE, area);
@@ -344,8 +343,7 @@ static void stmfts5_report_contact_event(struct stmfts_data *sdata,
 	input_mt_slot(sdata->input, touch_id);
 	input_mt_report_slot_state(sdata->input, tool, true);
 
-	input_report_abs(sdata->input, ABS_MT_POSITION_X, x);
-	input_report_abs(sdata->input, ABS_MT_POSITION_Y, y);
+	touchscreen_report_pos(sdata->input, &sdata->prop, x, y, true);
 	input_report_abs(sdata->input, ABS_MT_TOUCH_MAJOR, maj);
 	input_report_abs(sdata->input, ABS_MT_TOUCH_MINOR, min);
 	input_report_abs(sdata->input, ABS_MT_PRESSURE, area);
@@ -375,8 +373,7 @@ static void stmfts_report_hover_event(struct stmfts_data *sdata,
 	u16 y = (event[3] << 4) | (event[4] & STMFTS_MASK_Y_LSB);
 	u8 z = event[5];
 
-	input_report_abs(sdata->input, ABS_X, x);
-	input_report_abs(sdata->input, ABS_Y, y);
+	touchscreen_report_pos(sdata->input, &sdata->prop, x, y, false);
 	input_report_abs(sdata->input, ABS_DISTANCE, z);
 
 	input_sync(sdata->input);
-- 
2.56.0.385.gac671c819a-goog