touch: KW patch has been fixed

Applied all the changes from the patch.
Tested the code on target for touch to wake functionality.

Change-Id: I393b29ab570fc70c564dfc069864f1b627f5d389
Signed-off-by: Surya Teja Kudiri <[email protected]>
Signed-off-by: Surya Teja Kudiri <[email protected]>

pt/pt_core.c

@@ -570,6 +570,9 @@ static int pt_hid_exec_cmd_(struct pt_core_data *cd,
 		+ (hid_cmd->has_data_register ? 2 : 0)	/* Data register */
 		+ hid_cmd->write_length;                /* Data length */
 
+	if (cmd_length < 4 || cmd_length > PT_MAX_PIP1_MSG_SIZE)
+		return -EPROTO;
+
 	cmd = kzalloc(cmd_length, GFP_KERNEL);
 	if (!cmd)
 		return -ENOMEM;
@@ -2122,13 +2125,16 @@ static int _pt_request_pip2_send_cmd(struct device *dev,
 	struct pt_core_data *cd = dev_get_drvdata(dev);
 	struct pip2_cmd_structure pip2_cmd;
 	int rc = 0;
-	int i = 0;
-	int j = 0;
+	u16 i = 0;
+	u16 j = 0;
 	u16 write_len;
 	u8 *write_buf = NULL;
 	u16 read_len;
 	u8 extra_bytes;
 
+	if (report_body_len > 247)
+		return -EPROTO;
+
 	memset(&pip2_cmd, 0, sizeof(pip2_cmd));
 	/* Hard coded register for PIP2.x */
 	pip2_cmd.reg[0] = 0x01;
@@ -2255,8 +2261,8 @@ static int _pt_pip2_send_cmd_no_int(struct device *dev,
 	int max_retry = 0;
 	int retry = 0;
 	int rc = 0;
-	int i = 0;
-	int j = 0;
+	u16 i = 0;
+	u16 j = 0;
 	u16 write_len;
 	u8 *write_buf = NULL;
 	u16 read_len;
@@ -2270,6 +2276,9 @@ static int _pt_pip2_send_cmd_no_int(struct device *dev,
 	struct pt_core_data *cd = dev_get_drvdata(dev);
 	struct pip2_cmd_structure pip2_cmd;
 
+	if (report_body_len > 247)
+		return -EPROTO;
+
 	if (protect == PT_CORE_CMD_PROTECTED) {
 		rc = request_exclusive(cd,
 			cd->dev, PT_REQUEST_EXCLUSIVE_TIMEOUT);
@@ -3776,7 +3785,8 @@ static int pt_pip1_read_data_block_(struct pt_core_data *cd,
 	if (length == 0 || *actual_read_len == 0)
 		return 0;
 
-	if (read_buf_size >= *actual_read_len)
+	if (read_buf_size >= *actual_read_len &&
+	    *actual_read_len < PT_MAX_PIP2_MSG_SIZE)
 		memcpy(read_buf, &cd->response_buf[10], *actual_read_len);
 	else
 		return -EPROTO;
@@ -3848,7 +3858,7 @@ static int pt_pip1_write_data_block_(struct pt_core_data *cd,
 		u8 *security_key, u16 *actual_write_len)
 {
 	/* row_number + write_len + ebid + security_key + crc */
-	int full_write_length = 2 + 2 + 1 + write_length + 8 + 2;
+	u16 full_write_length = 2 + 2 + 1 + write_length + 8 + 2;
 	u8 *full_write_buf;
 	u8 cmd_offset = 0;
 	u16 crc;
@@ -3862,6 +3872,9 @@ static int pt_pip1_write_data_block_(struct pt_core_data *cd,
 		.timeout_ms = PT_PIP1_CMD_WRITE_CONF_BLOCK_TIMEOUT,
 	};
 
+	if (write_length > PT_CAL_DATA_ROW_SIZE)
+		return -EINVAL;
+
 	full_write_buf = kzalloc(full_write_length, GFP_KERNEL);
 	if (!full_write_buf)
 		return -ENOMEM;
@@ -4792,7 +4805,7 @@ static int pt_pip_calibrate_ext_(struct pt_core_data *cd,
 	 * When doing a calibration on a flashless DUT, save CAL data in
 	 * the TTDL cache on any successful calibration
 	 */
-	if (*status == 0 && cd->cal_cache_in_host) {
+	if (cd->response_buf[5] == 0 && cd->cal_cache_in_host) {
 		pt_debug(cd->dev, DL_INFO, "%s: Retrieve and Save CAL\n",
 			__func__);
 		rc = _pt_manage_local_cal_data(cd->dev, PT_CAL_DATA_SAVE,
@@ -6982,6 +6995,7 @@ static int _pt_request_hw_version(struct device *dev, char *hw_version)
 		goto exit_error;
 	}
 
+	memset(return_data, 0, ARRAY_SIZE(return_data));
 	/* For Parade TC or TT parts */
 	if (cd->active_dut_generation == DUT_PIP2_CAPABLE) {
 		rc = _pt_request_pip2_send_cmd(dev,
@@ -8410,7 +8424,7 @@ static int pt_parse_input(struct pt_core_data *cd)
 		pt_debug(cd->dev, DL_WARN,
 			"%s: DUT - Empty buffer detected\n", __func__);
 		return 0;
-	} else if (size > PT_MAX_INPUT) {
+	} else if (size > PT_MAX_INPUT || size < 0) {
 		pt_debug(cd->dev, DL_ERROR,
 			"%s: DUT - Unexpected len field in active bus data!\n",
 			__func__);
@@ -13613,7 +13627,7 @@ static ssize_t pt_pip2_cmd_rsp_store(struct device *dev,
 
 	length = _pt_ic_parse_input_hex(dev, buf, size,
 			input_data, PT_MAX_PIP2_MSG_SIZE);
-	if (length <= 0 || length > PT_MAX_PIP2_MSG_SIZE) {
+	if (length <= 0 || length > (PT_MAX_PIP2_MSG_SIZE - 2)) {
 		pt_debug(dev, DL_ERROR, "%s: Invalid number of arguments\n",
 			__func__);
 		rc = -EINVAL;
@@ -16273,11 +16287,12 @@ exit:
 	if (boot_err)
 		*boot_err = last_err;
 
-	pt_debug(cd->dev, DL_INFO, "%s: %s=0x%02X, %s=0x%02X, %s=0x%02X\n",
-			__func__,
-			"Detected", detected,
-			"slave_irq_toggled", *slave_irq_toggled,
-			"slave_bus_toggled", *slave_bus_toggled);
+	if (slave_irq_toggled && slave_bus_toggled)
+		pt_debug(cd->dev, DL_INFO, "%s: %s=0x%02X, %s=0x%02X, %s=0x%02X\n",
+				__func__,
+				"Detected", detected,
+				"slave_irq_toggled", *slave_irq_toggled,
+				"slave_bus_toggled", *slave_bus_toggled);
 	return rc;
 }
 

pt/pt_device_access.c

@@ -1238,27 +1238,27 @@ static int  pt_get_cmcp_info(struct pt_device_access_data *dad,
 		}
 		cm_ave_data_panel /= (tx_num * rx_num);
 		cmcp_info->cm_ave_data_panel = cm_ave_data_panel;
-	}
 
-	/* Calculate gradient panel sensor column/row here */
-	calculate_gd_info(gd_sensor_col, gd_sensor_row, tx_num, rx_num,
-		cm_data_panel, 1, 1);
-	for (i = 0; i < tx_num; i++) {
-		pt_debug(dev, DL_DEBUG,
-			"i=%d max=%d,min=%d,ave=%d, gradient=%d", i,
-			gd_sensor_col[i].cm_max,
-			gd_sensor_col[i].cm_min,
-			gd_sensor_col[i].cm_ave,
-			gd_sensor_col[i].gradient_val);
-	}
+		/* Calculate gradient panel sensor column/row here */
+		calculate_gd_info(gd_sensor_col, gd_sensor_row, tx_num, rx_num,
+			cm_data_panel, 1, 1);
+		for (i = 0; i < tx_num; i++) {
+			pt_debug(dev, DL_DEBUG,
+				"i=%d max=%d,min=%d,ave=%d, gradient=%d", i,
+				gd_sensor_col[i].cm_max,
+				gd_sensor_col[i].cm_min,
+				gd_sensor_col[i].cm_ave,
+				gd_sensor_col[i].gradient_val);
+		}
 
-	for (i = 0; i < rx_num; i++) {
-		pt_debug(dev, DL_DEBUG,
-			"i=%d max=%d,min=%d,ave=%d, gradient=%d", i,
-			gd_sensor_row[i].cm_max,
-			gd_sensor_row[i].cm_min,
-			gd_sensor_row[i].cm_ave,
-			gd_sensor_row[i].gradient_val);
+		for (i = 0; i < rx_num; i++) {
+			pt_debug(dev, DL_DEBUG,
+				"i=%d max=%d,min=%d,ave=%d, gradient=%d", i,
+				gd_sensor_row[i].cm_max,
+				gd_sensor_row[i].cm_min,
+				gd_sensor_row[i].cm_ave,
+				gd_sensor_row[i].gradient_val);
+		}
 	}
 
 	/*Get cp data*/
@@ -1294,12 +1294,12 @@ static int  pt_get_cmcp_info(struct pt_device_access_data *dad,
 			pt_debug(dev, DL_DEBUG, "cp_tx_cal_data_panel[%d]=%d\n",
 				i, cp_tx_cal_data_panel[i]);
 		}
-	}
 
-	/*get cp_sensor_tx_delta,using the first sensor cal value for temp */
-	/*multiple 1000 to increase accuracy*/
-	cmcp_info->cp_sensor_tx_delta = ABS((cp_tx_cal_data_panel[0]
-		- cp_tx_ave_data_panel) * 1000 / cp_tx_ave_data_panel);
+		/*get cp_sensor_tx_delta,using the first sensor cal value for temp */
+		/*multiple 1000 to increase accuracy*/
+		cmcp_info->cp_sensor_tx_delta = ABS((cp_tx_cal_data_panel[0]
+			- cp_tx_ave_data_panel) * 1000 / cp_tx_ave_data_panel);
+	}
 
 	/*Get cp_rx_data_panel*/
 	if (cp_rx_data_panel != NULL) {
@@ -1327,12 +1327,12 @@ static int  pt_get_cmcp_info(struct pt_device_access_data *dad,
 				"cp_rx_cal_data_panel[%d]=%d\n", i,
 				cp_rx_cal_data_panel[i]);
 		}
-	}
 
-	/*get cp_sensor_rx_delta,using the first sensor cal value for temp */
-	/*multiple 1000 to increase accuracy*/
-	cmcp_info->cp_sensor_rx_delta = ABS((cp_rx_cal_data_panel[0]
-		- cp_rx_ave_data_panel) * 1000 / cp_rx_ave_data_panel);
+		/*get cp_sensor_rx_delta,using the first sensor cal value for temp */
+		/*multiple 1000 to increase accuracy*/
+		cmcp_info->cp_sensor_rx_delta = ABS((cp_rx_cal_data_panel[0]
+			- cp_rx_ave_data_panel) * 1000 / cp_rx_ave_data_panel);
+	}
 
 	if (btn_num == 0) {
 		pt_debug(dev, DL_INFO, "%s: Skip Button Test\n", __func__);
@@ -2101,9 +2101,9 @@ int save_engineering_data(struct device *dev, char *out_buf, int index,
 {
 	int i;
 	int j;
-	int tx_num = cmcp_info->tx_num;
-	int rx_num = cmcp_info->rx_num;
-	int btn_num = cmcp_info->btn_num;
+	int tx_num = 0;
+	int rx_num = 0;
+	int btn_num = 0;
 	int tmp = 0;
 	uint32_t fw_revision_control;
 	uint32_t fw_config_ver;
@@ -2111,6 +2111,13 @@ int save_engineering_data(struct device *dev, char *out_buf, int index,
 	struct pt_device_access_data *dad
 		= pt_get_device_access_data(dev);
 
+	if ((result == NULL) || (cmcp_info == NULL))
+		return -EINVAL;
+
+	tx_num = cmcp_info->tx_num;
+	rx_num = cmcp_info->rx_num;
+	btn_num = cmcp_info->btn_num;
+
 	fw_revision_control = dad->si->ttdata.revctrl;
 	fw_config_ver = dad->si->ttdata.fw_ver_conf;
 	/*calculate silicon id*/
@@ -2950,12 +2957,18 @@ int result_save(struct device *dev, char *buf,
 	int byte_left;
 
 	out_buf = kzalloc(MAX_BUF_LEN, GFP_KERNEL);
-	if (configuration == NULL)
+	if (configuration == NULL) {
 		pt_debug(dev, DL_WARN, "config is NULL");
-	if (result == NULL)
+		return -ENOMEM;
+	}
+	if (result == NULL) {
 		pt_debug(dev, DL_WARN, "result is NULL");
-	if (cmcp_info == NULL)
+		return -ENOMEM;
+	}
+	if (cmcp_info == NULL) {
 		pt_debug(dev, DL_WARN, "cmcp_info is NULL");
+		return -ENOMEM;
+	}
 
 	index = save_header(out_buf, index, result);
 	index = save_engineering_data(dev, out_buf, index,
@@ -3292,7 +3305,8 @@ int cmcp_return_one_value(struct device *dev, const char *buf, u32 *offset,
 		}
 	} else {
 		/* Multiple line: line count */
-		*line_num = line_count;
+		if (line_num)
+			*line_num = line_count;
 		/* Reset for next case */
 		line_count = 1;
 	}

pt/pt_devtree.c

@@ -1106,8 +1106,8 @@ int pt_devtree_clean_pdata(struct device *adap_dev)
 
 	pdata = dev_get_platdata(adap_dev);
 	set_pdata_ptr(pdata);
+	free_core_pdata(pdata->core_pdata);
 	for_each_child_of_node(adap_dev->of_node, core_node) {
-		free_core_pdata(pdata->core_pdata);
 		of_node_put(core_node);
 		for_each_child_of_node(core_node, dev_node) {
 			rc = get_device_type(dev_node, &type);