commit 248d3a73a0167dce15ba100477c3e778c4787178 upstream.

The current validation 'wire_order[i] > ARRAY_SIZE(config_pins)' allows
wire_order[i] to equal ARRAY_SIZE(config_pins), which causes out-of-bounds
access when used as index in 'config_pins[wire_order[i]]'.

Since config_pins has 4 elements (indices 0-3), the valid range for
wire_order should be 0-3. Fix the off-by-one error by using >= instead
of > in the validation check.

Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Link: https://patch.msgid.link/20251114062817.852698-1-junjie.cao@intel.com
Fixes: bb76dc09ddfc ("input: ti_am33x_tsc: Order of TSC wires, made configurable")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d579478cee228bdc0029a0c12a1f6a63ea9d1c77 upstream.

Under certain conditions (more prevalent after a suspend/resume cycle),
the touchscreen controller can send the "boot complete" interrupt before
it actually finished booting. In those cases, attempting to read touch
data resuls in a stream of "not ready" messages being read and
interpreted as a touch report. Check that the response is in fact a
touch report and discard it otherwise.

Reported-by: pitust <piotr@stelmaszek.com>
Closes: https://oftc.catirclogs.org/asahi/2025-12-17#34878715;
Fixes: 471a92f8a21a ("Input: apple_z2 - add a driver for Apple Z2 touchscreens")
Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com>
Link: https://patch.msgid.link/20251218-z2-init-fix-v1-1-48e3aa239caf@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Sync up with the mainline to bring in definition of
INPUT_PROP_HAPTIC_TOUCHPAD.

The reset line is being set to input on non-ACPI devices apparently to
save power. This isn't being done on ACPI devices as it's been found
that some ACPI devices don't have a pull-up resistor fitted. This can
also be the case for non-ACPI devices, resulting in:

[  941.672207] Goodix-TS 1-0014: Error reading 10 bytes from 0x814e: -110
[  942.696168] Goodix-TS 1-0014: Error reading 10 bytes from 0x814e: -110
[  945.832208] Goodix-TS 1-0014: Error reading 10 bytes from 0x814e: -110

This behaviour appears to have been initialing introduced in
ec6e1b4082d9. This doesn't seem to be based on information in either the
GT911 or GT9271 datasheets cited as sources of information for this
change. Thus it seems likely that it is based on functionality in the
Android driver which it also lists. This behaviour may be viable in very
specific instances where the hardware is well known, but seems unwise in
the upstream kernel where such hardware requirements can't be
guaranteed.

Remove this over optimisation to improve reliability on non-ACPI
devices.

Signed-off-by: Martyn Welch <martyn.welch@collabora.com>
Reviewed-by: Hans de Goede <hansg@kernel.org>
Link: https://lore.kernel.org/r/20251009134138.686215-1-martyn.welch@collabora.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Some newer devices use an ACPI hardware ID of GDIX1003 for their Goodix
touchscreen controller, instead of GDIX1001 / GDIX1002. Add GDIX1003
to the goodix_acpi_match[] table.

Reported-by: Weikang Guo <guoweikang.kernel@gmail.com>
Closes: https://lore.kernel.org/linux-input/20250225024409.1467040-1-guoweikang.kernel@gmail.com/
Tested-by: Weikang Guo <guoweikang.kernel@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20251013121022.44333-1-hansg@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Pull input updates from Dmitry Torokhov:

 - Conversions to yaml/json schema and fixes for input-related device
   tree bindings

 - New drivers:
     - Awinic AW86927 haptic chip
     - Hynitron CST816x series controller
     - Himax HX852x(ES) touchscreen controller

 - Fix uinput to not leak kernel memory via a gap in
   uinput_ff_upload_compat structure

 - Prevent overflow in pressure calculation in tsc2007 driver causing
   phantom touches

 - Make the Atmel maxTouch driver support generic touchscreen
   configuration (flip, rotate, etc)

 - Drop support for platform data in tca8418_keypad, pxa27x-keypad,
   spear-keyboard and twl4030_keypad drivers, they all now rely on
   generic device properties for configuration

 - Other assorted changes and fixes

* tag 'input-for-v6.18-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (50 commits)
  Input: atmel_mxt_ts - allow reset GPIO to sleep
  Input: aw86927 - fix error code in probe()
  Input: psxpad-spi - add a check for the return value of spi_setup()
  Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
  Input: aw86927 - add driver for Awinic AW86927
  dt-bindings: input: Add Awinic AW86927
  dt-bindings: touchscreen: remove touchscreen.txt
  dt-bindings: arm: bcm: raspberrypi,bcm2835-firmware: Add touchscreen child node
  dt-bindings: touchscreen: convert eeti bindings to json schema
  Input: pm8941-pwrkey - disable wakeup for resin by default
  dt-bindings: input: pm8941-pwrkey: Document wakeup-source property
  Input: add driver for Hynitron CST816x series
  dt-bindings: input: touchscreen: add hynitron cst816x series
  Input: imx6ul_tsc - set glitch threshold by DTS property
  dt-bindings: touchscreen: fsl,imx6ul-tsc: support glitch thresold
  dt-bindings: touchscreen: add debounce-delay-us property
  Input: ps2-gpio - fix typo
  Input: atmel_mxt_ts - add support for generic touchscreen configurations
  dt-bindings: input: maxtouch: add common touchscreen properties
  dt-bindings: touchscreen: convert zet6223 bindings to json schema
  ...

The reset GPIO is not toggled in any critical section where it couldn't
sleep, allow the reset GPIO to sleep. This allows the driver to operate
reset GPIOs connected to I2C GPIO expanders.

Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
Link: https://lore.kernel.org/r/20251005023335.166483-1-marek.vasut@mailbox.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Introduce support for the Hynitron CST816x series touchscreen controller
used for 240×240 1.28-inch Round LCD Display Module manufactured
by Waveshare Electronics. The driver is designed based on an Arduino
implementation marked as under MIT License. This driver is written
for a particular round display based on the CST816S controller, which
is not compatiable with existing driver for Hynitron controllers.

Signed-off-by: Oleh Kuzhylnyi <kuzhylol@gmail.com>
Link: https://lore.kernel.org/r/20250921125939.249788-2-kuzhylol@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Set the glitch threshold by DTS property and keep the existing default
behavior if the 'debounce-delay-us' is not present.

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://lore.kernel.org/r/20250923143746.2857292-7-dario.binacchi@amarulasolutions.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

This provides support for generic touchscreen configuration options like
swapped-x-y, min-x, min-y, size-x, size-y, etc.

Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Link: https://lore.kernel.org/r/20250909054903.11519-3-clamor95@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>