Input - HID - fix find_next_zero usage [1/5]

diff -Nru a/drivers/usb/input/hid-input.c b/drivers/usb/input/hid-input.c
@@ -348,7 +348,7 @@
 	set_bit(usage->type, input->evbit);
 
 	while (usage->code <= max && test_and_set_bit(usage->code, bit)) {
-		usage->code = find_next_zero_bit(bit, max + 1, usage->code);
+		usage->code = find_next_zero_bit(bit, usage->code, max + 1);
 	}
 
 	if (usage->code > max) return;

diff -Nru a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
@@ -244,8 +244,9 @@
 
 	while (atkbd->cmdcnt && timeout--) udelay(10);
 
-	for (i = 0; i < receive; i++)
-		param[i] = atkbd->cmdbuf[(receive - 1) - i];
+	if (param)
+		for (i = 0; i < receive; i++)
+			param[i] = atkbd->cmdbuf[(receive - 1) - i];
 
 	if (atkbd->cmdcnt) 
 		return (atkbd->cmdcnt = 0) - 1;

diff -Nru a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
@@ -26,14 +26,16 @@
 MODULE_LICENSE("GPL");
 
 MODULE_PARM(i8042_noaux, "1i");
+MODULE_PARM(i8042_nomux, "1i");
 MODULE_PARM(i8042_unlock, "1i");
 MODULE_PARM(i8042_reset, "1i");
 MODULE_PARM(i8042_direct, "1i");
 MODULE_PARM(i8042_dumbkbd, "1i");
 
+static int i8042_reset;
 static int i8042_noaux;
+static int i8042_nomux;
 static int i8042_unlock;
-static int i8042_reset;
 static int i8042_direct;
 static int i8042_dumbkbd;
 

@@ -220,7 +222,6 @@
 	return retval;
 }
 
-
 /*
  * i8042_open() is called when a port is open by the higher layer.
  * It allocates the interrupt and enables in in the chip.

@@ -323,8 +324,8 @@
 
 static struct i8042_values i8042_mux_values[4];
 static struct serio i8042_mux_port[4];
-static char i8042_mux_names[4][16];
-static char i8042_mux_short[4][8];
+static char i8042_mux_names[4][32];
+static char i8042_mux_short[4][16];
 static char i8042_mux_phys[4][32];
 
 /*

@@ -364,15 +365,15 @@
 		dfl = ((str & I8042_STR_PARITY) ? SERIO_PARITY : 0) |
 		      ((str & I8042_STR_TIMEOUT) ? SERIO_TIMEOUT : 0);
 
-		if (i8042_mux_values[0].exists && (buffer[i].str & I8042_STR_AUXDATA)) {
+		if (i8042_mux_values[0].exists && (str & I8042_STR_AUXDATA)) {
 
-			if (buffer[i].str & I8042_STR_MUXERR) {
-				switch (buffer[i].data) {
+			if (str & I8042_STR_MUXERR) {
+				switch (data) {
 					case 0xfd:
 					case 0xfe: dfl = SERIO_TIMEOUT; break;
 					case 0xff: dfl = SERIO_PARITY; break;
 				}
-				buffer[i].data = 0xfe;
+				data = 0xfe;
 			} else dfl = 0;
 
 			dbg("%02x <- i8042 (interrupt, aux%d, %d%s%s)",

@@ -380,8 +381,7 @@
 				dfl & SERIO_PARITY ? ", bad parity" : "",
 				dfl & SERIO_TIMEOUT ? ", timeout" : "");
 
-			if (i8042_mux_values[(str >> 6)].exists)
-				serio_interrupt(i8042_mux_port + (str >> 6), buffer[i].data, dfl);
+			serio_interrupt(i8042_mux_port + ((str >> 6) & 3), data, dfl);
 			continue;
 		}
 

@@ -390,8 +390,8 @@
 			dfl & SERIO_PARITY ? ", bad parity" : "",
 			dfl & SERIO_TIMEOUT ? ", timeout" : "");
 
-		if (i8042_aux_values.exists && (buffer[i].str & I8042_STR_AUXDATA)) {
-			serio_interrupt(&i8042_aux_port, buffer[i].data, dfl);
+		if (i8042_aux_values.exists && (str & I8042_STR_AUXDATA)) {
+			serio_interrupt(&i8042_aux_port, data, dfl);
 			continue;
 		}
 

@@ -602,8 +602,14 @@
 	if (i8042_command(&param, I8042_CMD_AUX_LOOP) || param == 0x5b)
 		return -1;
 
-	printk(KERN_INFO "i8042.c: Detected active multiplexing controller, rev%d.%d.\n",
-		~param >> 4, ~param & 0xf);
+	printk(KERN_INFO "i8042.c: Detected active multiplexing controller, rev %d.%d.\n",
+		(~param >> 4) & 0xf, ~param & 0xf);
+
+/*
+ * In MUX mode the keyboard translation seems to be always off.
+ */
+ 
+	i8042_direct = 1;
 
 /*
  * Disable all muxed ports by disabling AUX.

@@ -742,6 +748,12 @@
 static int __init i8042_setup_noaux(char *str)
 {
 	i8042_noaux = 1;
+	i8042_nomux = 1;
+	return 1;
+}
+static int __init i8042_setup_nomux(char *str)
+{
+	i8042_nomux = 1;
 	return 1;
 }
 static int __init i8042_setup_unlock(char *str)

@@ -762,6 +774,7 @@
 
 __setup("i8042_reset", i8042_setup_reset);
 __setup("i8042_noaux", i8042_setup_noaux);
+__setup("i8042_nomux", i8042_setup_nomux);
 __setup("i8042_unlock", i8042_setup_unlock);
 __setup("i8042_direct", i8042_setup_direct);
 __setup("i8042_dumbkbd", i8042_setup_dumbkbd);

@@ -796,6 +809,7 @@
 	sprintf(i8042_mux_short[index], "AUX%d", index);
 	port->name = i8042_mux_names[index];
 	port->phys = i8042_mux_phys[index];
+	port->driver = values;
 	values->name = i8042_mux_short[index];
 	values->mux = index;
 }

@@ -809,8 +823,8 @@
 	if (i8042_platform_init())
 		return -EBUSY;
 
-	i8042_aux_values.irq =	I8042_AUX_IRQ;
-	i8042_kbd_values.irq =	I8042_KBD_IRQ;
+	i8042_aux_values.irq = I8042_AUX_IRQ;
+	i8042_kbd_values.irq = I8042_KBD_IRQ;
 
 	if (i8042_controller_init())
 		return -ENODEV;

@@ -821,7 +835,7 @@
 	for (i = 0; i < 4; i++)
 		i8042_init_mux_values(i8042_mux_values + i, i8042_mux_port + i, i);
 
-	if (!i8042_noaux && !i8042_check_mux(&i8042_aux_values))
+	if (!i8042_nomux && !i8042_check_mux(&i8042_aux_values))
 		for (i = 0; i < 4; i++)
 			i8042_port_register(i8042_mux_values + i, i8042_mux_port + i);
 	else 

diff -Nru a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
@@ -49,7 +49,7 @@
 
 	udev = (struct uinput_device *)dev->private;
 
-	udev->head = (udev->head + 1) & 0xF;
+	udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE;
 	udev->buff[udev->head].type = type;
 	udev->buff[udev->head].code = code;
 	udev->buff[udev->head].value = value;

@@ -87,14 +87,14 @@
 
 	input_register_device(udev->dev);
 
-	udev->state |= UIST_CREATED;
+	set_bit(UIST_CREATED, &(udev->state));
 
 	return 0;
 }
 
 static int uinput_destroy_device(struct uinput_device *udev)
 {
-	if (!(udev->state & UIST_CREATED)) {
+	if (!test_bit(UIST_CREATED, &(udev->state))) {
 		printk(KERN_WARNING "%s: create the device first\n", UINPUT_NAME);
 		return -EINVAL;
 	}

@@ -135,6 +135,39 @@
 	return -ENOMEM;
 }
 
+static int uinput_validate_absbits(struct input_dev *dev)
+{
+	unsigned int cnt;
+	int retval = 0;
+	
+	for (cnt = 0; cnt < ABS_MAX; cnt++) {
+		if (!test_bit(cnt, dev->absbit)) 
+			continue;
+		
+		if (/*!dev->absmin[cnt] || !dev->absmax[cnt] || */
+		    (dev->absmax[cnt] <= dev->absmin[cnt])) {
+			printk(KERN_DEBUG 
+				"%s: invalid abs[%02x] min:%d max:%d\n",
+				UINPUT_NAME, cnt, 
+				dev->absmin[cnt], dev->absmax[cnt]);
+			retval = -EINVAL;
+			break;
+		}
+
+		if ((dev->absflat[cnt] < dev->absmin[cnt]) ||
+		    (dev->absflat[cnt] > dev->absmax[cnt])) {
+			printk(KERN_DEBUG 
+				"%s: absflat[%02x] out of range: %d "
+				"(min:%d/max:%d)\n",
+				UINPUT_NAME, cnt, dev->absflat[cnt],
+				dev->absmin[cnt], dev->absmax[cnt]);
+			retval = -EINVAL;
+			break;
+		}
+	}
+	return retval;
+}
+
 static int uinput_alloc_device(struct file *file, const char *buffer, size_t count)
 {
 	struct uinput_user_dev	user_dev;

@@ -145,14 +178,17 @@
 
 	retval = count;
 
+	udev = (struct uinput_device *)file->private_data;
+	dev = udev->dev;
+
 	if (copy_from_user(&user_dev, buffer, sizeof(struct uinput_user_dev))) {
 		retval = -EFAULT;
 		goto exit;
 	}
 
-	udev = (struct uinput_device *)file->private_data;
-	dev = udev->dev;
-
+	if (NULL != dev->name) 
+		kfree(dev->name);
+		
 	size = strnlen(user_dev.name, UINPUT_MAX_NAME_SIZE);
 	dev->name = kmalloc(size + 1, GFP_KERNEL);
 	if (!dev->name) {

@@ -168,7 +204,7 @@
 	dev->id.version	= user_dev.id.version;
 	dev->ff_effects_max = user_dev.ff_effects_max;
 
-	size = sizeof(unsigned long) * NBITS(ABS_MAX + 1);
+	size = sizeof(int) * (ABS_MAX + 1);
 	memcpy(dev->absmax, user_dev.absmax, size);
 	memcpy(dev->absmin, user_dev.absmin, size);
 	memcpy(dev->absfuzz, user_dev.absfuzz, size);

@@ -177,33 +213,20 @@
 	/* check if absmin/absmax/absfuzz/absflat are filled as
 	 * told in Documentation/input/input-programming.txt */
 	if (test_bit(EV_ABS, dev->evbit)) {
-		unsigned int cnt;
-		for (cnt = 1; cnt < ABS_MAX; cnt++)
-			if (test_bit(cnt, dev->absbit) &&
-					(!dev->absmin[cnt] ||
-					 !dev->absmax[cnt] ||
-					 !dev->absfuzz[cnt] ||
-					 !dev->absflat[cnt])) {
-				printk(KERN_DEBUG "%s: set abs fields "
-					"first\n", UINPUT_NAME);
-				retval = -EINVAL;
-				goto free_name;
-			}
+		retval = uinput_validate_absbits(dev);
+		if (retval < 0)
+			kfree(dev->name);
 	}
 
 exit:
 	return retval;
-free_name:
-	kfree(dev->name);
-	goto exit;
 }
 
 static int uinput_write(struct file *file, const char *buffer, size_t count, loff_t *ppos)
 {
 	struct uinput_device	*udev = file->private_data;
 	
-
-	if (udev->state & UIST_CREATED) {
+	if (test_bit(UIST_CREATED, &(udev->state))) {
 		struct input_event	ev;
 
 		if (copy_from_user(&ev, buffer, sizeof(struct input_event)))

@@ -220,23 +243,28 @@
 {
 	struct uinput_device *udev = file->private_data;
 	int retval = 0;
+	
+	if (!test_bit(UIST_CREATED, &(udev->state)))
+		return -ENODEV;
 
-	if (udev->head == udev->tail && (udev->state & UIST_CREATED) && (file->f_flags & O_NONBLOCK))
+	if ((udev->head == udev->tail) && (file->f_flags & O_NONBLOCK))
 		return -EAGAIN;
 
 	retval = wait_event_interruptible(udev->waitq,
-		udev->head != udev->tail && (udev->state & UIST_CREATED));
-
+			(udev->head != udev->tail) || 
+			!test_bit(UIST_CREATED, &(udev->state)));
+	
 	if (retval)
 		return retval;
 
-	if (!(udev->state & UIST_CREATED))
+	if (!test_bit(UIST_CREATED, &(udev->state)))
 		return -ENODEV;
 
-	while (udev->head != udev->tail && retval + sizeof(struct uinput_device) <= count) {
+	while ((udev->head != udev->tail) && 
+	    (retval + sizeof(struct uinput_device) <= count)) {
 		if (copy_to_user(buffer + retval, &(udev->buff[udev->tail]),
 		    sizeof(struct input_event))) return -EFAULT;
-		udev->tail = (udev->tail + 1) % (UINPUT_BUFFER_SIZE - 1);
+		udev->tail = (udev->tail + 1) % UINPUT_BUFFER_SIZE;
 		retval += sizeof(struct input_event);
 	}
 

@@ -245,7 +273,7 @@
 
 static unsigned int uinput_poll(struct file *file, poll_table *wait)
 {
-        struct uinput_device *udev = file->private_data;
+	struct uinput_device *udev = file->private_data;
 
 	poll_wait(file, &udev->waitq, wait);
 

@@ -257,7 +285,7 @@
 
 static int uinput_burn_device(struct uinput_device *udev)
 {
-	if (udev->state & UIST_CREATED)
+	if (test_bit(UIST_CREATED, &(udev->state)))
 		uinput_destroy_device(udev);
 
 	kfree(udev->dev);

@@ -282,50 +310,52 @@
 
 	udev = (struct uinput_device *)file->private_data;
 
-	if (cmd >= UI_SET_EVBIT && (udev->state & UIST_CREATED))
+	/* device attributes can not be changed after the device is created */
+	if (cmd >= UI_SET_EVBIT && test_bit(UIST_CREATED, &(udev->state)))
 		return -EINVAL;
 
 	switch (cmd) {
 		case UI_DEV_CREATE:
 			retval = uinput_create_device(udev);
-
 			break;
+			
 		case UI_DEV_DESTROY:
 			retval = uinput_destroy_device(udev);
-
 			break;
+
+
 		case UI_SET_EVBIT:
 			set_bit(arg, udev->dev->evbit);
-
-		break;
+			break;
+			
 		case UI_SET_KEYBIT:
 			set_bit(arg, udev->dev->keybit);
-
-		break;
+			break;
+			
 		case UI_SET_RELBIT:
 			set_bit(arg, udev->dev->relbit);
-
-		break;
+			break;
+			
 		case UI_SET_ABSBIT:
 			set_bit(arg, udev->dev->absbit);
-
-		break;
+			break;
+			
 		case UI_SET_MSCBIT:
 			set_bit(arg, udev->dev->mscbit);
-
-		break;
+			break;
+			
 		case UI_SET_LEDBIT:
 			set_bit(arg, udev->dev->ledbit);
-
-		break;
+			break;
+			
 		case UI_SET_SNDBIT:
 			set_bit(arg, udev->dev->sndbit);
-
-		break;
+			break;
+			
 		case UI_SET_FFBIT:
 			set_bit(arg, udev->dev->ffbit);
-
-		break;
+			break;
+			
 		default:
 			retval = -EFAULT;
 	}

diff -Nru a/include/linux/uinput.h b/include/linux/uinput.h
@@ -29,9 +29,9 @@
 #define UINPUT_MINOR		223
 #define UINPUT_NAME		"uinput"
 #define UINPUT_BUFFER_SIZE	16
-#define U_MAX_NAME_SIZE		50
 
-#define UIST_CREATED		1
+/* state flags => bit index for {set|clear|test}_bit ops */
+#define UIST_CREATED		0
 
 struct uinput_device {
 	struct input_dev	*dev;

diff -Nru a/drivers/char/keyboard.c b/drivers/char/keyboard.c
@@ -264,23 +264,34 @@
 /*
  * Setting the keyboard rate.
  */
+static inline unsigned int ms_to_jiffies(unsigned int ms) {
+	unsigned int j;
+
+	j = (ms * HZ + 500) / 1000;
+	return (j > 0) ? j : 1;
+}
+
 int kbd_rate(struct kbd_repeat *rep)
 {
-	struct list_head * node;
-
-	if (rep->rate < 0 || rep->delay < 0)
-		return -EINVAL;
+	struct list_head *node;
+	unsigned int d = 0;
+	unsigned int p = 0;
 
 	list_for_each(node,&kbd_handler.h_list) {
 		struct input_handle *handle = to_handle_h(node);
-		if (test_bit(EV_REP, handle->dev->evbit)) {
-			if (rep->rate > HZ) rep->rate = HZ;
-			handle->dev->rep[REP_PERIOD] = rep->rate ? (HZ / rep->rate) : 0;
-			handle->dev->rep[REP_DELAY] = rep->delay * HZ / 1000;
-			if (handle->dev->rep[REP_DELAY] < handle->dev->rep[REP_PERIOD])
-				handle->dev->rep[REP_DELAY] = handle->dev->rep[REP_PERIOD];
+		struct input_dev *dev = handle->dev;
+
+		if (test_bit(EV_REP, dev->evbit)) {
+			if (rep->delay > 0)
+				dev->rep[REP_DELAY] = ms_to_jiffies(rep->delay);
+			if (rep->period > 0)
+				dev->rep[REP_PERIOD] = ms_to_jiffies(rep->period);
+			d = dev->rep[REP_DELAY]  * 1000 / HZ;
+			p = dev->rep[REP_PERIOD] * 1000 / HZ;
 		}
 	}
+	rep->delay  = d;
+	rep->period = p;
 	return 0;
 }
 

diff -Nru a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
@@ -430,6 +430,7 @@
 	case KDKBDREP:
 	{
 		struct kbd_repeat kbrep;
+		int err;
 		
 		if (!capable(CAP_SYS_TTY_CONFIG))
 			return -EPERM;

@@ -437,8 +438,9 @@
 		if (copy_from_user(&kbrep, (void *)arg,
 				   sizeof(struct kbd_repeat)))
 			return -EFAULT;
-		if ((i = kbd_rate( &kbrep )))
-			return i;
+		err = kbd_rate(&kbrep);
+		if (err)
+			return err;
 		if (copy_to_user((void *)arg, &kbrep,
 				 sizeof(struct kbd_repeat)))
 			return -EFAULT;

diff -Nru a/drivers/sbus/char/uctrl.c b/drivers/sbus/char/uctrl.c
@@ -107,7 +107,7 @@
 	u8 speaker_volume; /* 0x23 */
 	u8 control_tft_brightness; /* 0x24 */
 	u8 control_kbd_repeat_delay; /* 0x28 */
-	u8 control_kbd_repeat_rate; /* 0x29 */
+	u8 control_kbd_repeat_period; /* 0x29 */
 	u8 control_screen_contrast; /* 0x2F */
 };
 

diff -Nru a/include/linux/kd.h b/include/linux/kd.h
@@ -134,7 +134,8 @@
 
 struct kbd_repeat {
 	int delay;	/* in msec; <= 0: don't change */
-	int rate;	/* in msec; <= 0: don't change */
+	int period;	/* in msec; <= 0: don't change */
+			/* earlier this field was misnamed "rate" */
 };
 
 #define KDKBDREP        0x4B52  /* set keyboard delay/repeat rate;