Makefile: fix mirror address

From some time, kernel tarballs seem to be served from cdn.kernel.org.

(cherry picked from commit adc4b705cd)

Makefile

@@ -34,7 +34,7 @@ endif
 
 all: help
 
-MIRROR := ftp.kernel.org
+MIRROR := cdn.kernel.org
 SRC_BASEURL := http://${MIRROR}/pub/linux/kernel/v$(shell echo $(VERSION) | sed 's/^\(2\.[0-9]*\).*/\1/;s/^3\..*/3.x/;s/^4\..*/4.x/')
 SRC_FILE := linux-${VERSION}.tar.xz
 ifeq ($(BUILD_FLAVOR),pvops)

config

@@ -2966,6 +2966,7 @@ CONFIG_MOUSE_PS2_SENTELIC=y
 # CONFIG_MOUSE_PS2_TOUCHKIT is not set
 CONFIG_MOUSE_PS2_FOCALTECH=y
 # CONFIG_MOUSE_PS2_VMMOUSE is not set
+CONFIG_MOUSE_PS2_BYD=y
 CONFIG_MOUSE_SERIAL=m
 CONFIG_MOUSE_APPLETOUCH=m
 CONFIG_MOUSE_BCM5974=m

patches.backports/0001-HID-core-prevent-out-of-bound-readings.patch

@@ -0,0 +1,50 @@
+From 50220dead1650609206efe91f0cc116132d59b3f Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Tue, 19 Jan 2016 12:34:58 +0100
+Subject: [PATCH] HID: core: prevent out-of-bound readings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Plugging a Logitech DJ receiver with KASAN activated raises a bunch of
+out-of-bound readings.
+
+The fields are allocated up to MAX_USAGE, meaning that potentially, we do
+not have enough fields to fit the incoming values.
+Add checks and silence KASAN.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+---
+ drivers/hid/hid-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 16c2c66..3f6ac5f 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1293,6 +1293,7 @@ static void hid_input_field(struct hid_device *hid, struct hid_field *field,
+ 		/* Ignore report if ErrorRollOver */
+ 		if (!(field->flags & HID_MAIN_ITEM_VARIABLE) &&
+ 		    value[n] >= min && value[n] <= max &&
++		    value[n] - min < field->maxusage &&
+ 		    field->usage[value[n] - min].hid == HID_UP_KEYBOARD + 1)
+ 			goto exit;
+ 	}
+@@ -1305,11 +1306,13 @@ static void hid_input_field(struct hid_device *hid, struct hid_field *field,
+ 		}
+ 
+ 		if (field->value[n] >= min && field->value[n] <= max
++			&& field->value[n] - min < field->maxusage
+ 			&& field->usage[field->value[n] - min].hid
+ 			&& search(value, field->value[n], count))
+ 				hid_process_event(hid, field, &field->usage[field->value[n] - min], 0, interrupt);
+ 
+ 		if (value[n] >= min && value[n] <= max
++			&& value[n] - min < field->maxusage
+ 			&& field->usage[value[n] - min].hid
+ 			&& search(field->value, value[n], count))
+ 				hid_process_event(hid, field, &field->usage[value[n] - min], 1, interrupt);
+-- 
+2.5.5
+

patches.backports/0001-HID-fix-out-of-bound-access-in-extract-and-implement.patch

@@ -0,0 +1,161 @@
+From 5137b354bc8a5c04edb10d83f8bdb0bf8896fd68 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dtor@chromium.org>
+Date: Mon, 18 Jan 2016 22:40:37 -0800
+Subject: [PATCH] HID: fix out of bound access in extract() and implement()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+extract() and implement() access buffer containing reports in 64-bit
+chunks, but there is no guarantee that buffers are padded to 64 bit
+boundary. In fact, KASAN has caught such OOB access with i2c-hid and
+Synaptics touch controller.
+
+Instead of trying to hunt all parties that allocate buffers and make
+sure they are padded, let's switch extract() and implement() to byte
+access. It is a bit slower, bit we are not dealing with super fast
+devices here.
+
+Also let's fix link to the HID spec while we are at it.
+
+Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+---
+ drivers/hid/hid-core.c | 90 ++++++++++++++++++++++++++++++++++++--------------
+ 1 file changed, 66 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 7e89288..16c2c66 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1075,7 +1075,7 @@ static u32 s32ton(__s32 value, unsigned n)
+  * Extract/implement a data field from/to a little endian report (bit array).
+  *
+  * Code sort-of follows HID spec:
+- *     http://www.usb.org/developers/devclass_docs/HID1_11.pdf
++ *     http://www.usb.org/developers/hidpage/HID1_11.pdf
+  *
+  * While the USB HID spec allows unlimited length bit fields in "report
+  * descriptors", most devices never use more than 16 bits.
+@@ -1083,20 +1083,37 @@ static u32 s32ton(__s32 value, unsigned n)
+  * Search linux-kernel and linux-usb-devel archives for "hid-core extract".
+  */
+ 
+-static __u32 extract(const struct hid_device *hid, __u8 *report,
+-		     unsigned offset, unsigned n)
+-{
+-	u64 x;
++static u32 __extract(u8 *report, unsigned offset, int n)
++{
++	unsigned int idx = offset / 8;
++	unsigned int bit_nr = 0;
++	unsigned int bit_shift = offset % 8;
++	int bits_to_copy = 8 - bit_shift;
++	u32 value = 0;
++	u32 mask = n < 32 ? (1U << n) - 1 : ~0U;
++
++	while (n > 0) {
++		value |= ((u32)report[idx] >> bit_shift) << bit_nr;
++		n -= bits_to_copy;
++		bit_nr += bits_to_copy;
++		bits_to_copy = 8;
++		bit_shift = 0;
++		idx++;
++	}
++
++	return value & mask;
++}
+ 
+-	if (n > 32)
++static u32 extract(const struct hid_device *hid, u8 *report,
++			unsigned offset, unsigned n)
++{
++	if (n > 32) {
+ 		hid_warn(hid, "extract() called with n (%d) > 32! (%s)\n",
+ 			 n, current->comm);
++		n = 32;
++	}
+ 
+-	report += offset >> 3;  /* adjust byte index */
+-	offset &= 7;            /* now only need bit offset into one byte */
+-	x = get_unaligned_le64(report);
+-	x = (x >> offset) & ((1ULL << n) - 1);  /* extract bit field */
+-	return (u32) x;
++	return __extract(report, offset, n);
+ }
+ 
+ /*
+@@ -1106,31 +1123,56 @@ EXPORT_SYMBOL_GPL(hid_field_extract);
+  * The data mangled in the bit stream remains in little endian
+  * order the whole time. It make more sense to talk about
+  * endianness of register values by considering a register
+- * a "cached" copy of the little endiad bit stream.
++ * a "cached" copy of the little endian bit stream.
+  */
+-static void implement(const struct hid_device *hid, __u8 *report,
+-		      unsigned offset, unsigned n, __u32 value)
++
++static void __implement(u8 *report, unsigned offset, int n, u32 value)
++{
++	unsigned int idx = offset / 8;
++	unsigned int size = offset + n;
++	unsigned int bit_shift = offset % 8;
++	int bits_to_set = 8 - bit_shift;
++	u8 bit_mask = 0xff << bit_shift;
++
++	while (n - bits_to_set >= 0) {
++		report[idx] &= ~bit_mask;
++		report[idx] |= value << bit_shift;
++		value >>= bits_to_set;
++		n -= bits_to_set;
++		bits_to_set = 8;
++		bit_mask = 0xff;
++		bit_shift = 0;
++		idx++;
++	}
++
++	/* last nibble */
++	if (n) {
++		if (size % 8)
++			bit_mask &= (1U << (size % 8)) - 1;
++		report[idx] &= ~bit_mask;
++		report[idx] |= (value << bit_shift) & bit_mask;
++	}
++}
++
++static void implement(const struct hid_device *hid, u8 *report,
++		      unsigned offset, unsigned n, u32 value)
+ {
+-	u64 x;
+-	u64 m = (1ULL << n) - 1;
++	u64 m;
+ 
+-	if (n > 32)
++	if (n > 32) {
+ 		hid_warn(hid, "%s() called with n (%d) > 32! (%s)\n",
+ 			 __func__, n, current->comm);
++		n = 32;
++	}
+ 
++	m = (1ULL << n) - 1;
+ 	if (value > m)
+ 		hid_warn(hid, "%s() called with too large value %d! (%s)\n",
+ 			 __func__, value, current->comm);
+ 	WARN_ON(value > m);
+ 	value &= m;
+ 
+-	report += offset >> 3;
+-	offset &= 7;
+-
+-	x = get_unaligned_le64(report);
+-	x &= ~(m << offset);
+-	x |= ((u64)value) << offset;
+-	put_unaligned_le64(x, report);
++	__implement(report, offset, n, value);
+ }
+ 
+ /*
+-- 
+2.5.5
+

patches.backports/0001-Input-byd-add-BYD-PS-2-touchpad-driver.patch

@@ -0,0 +1,487 @@
+From 98ee377144935857d8ad5d7d70cdab1da4ede32e Mon Sep 17 00:00:00 2001
+From: Chris Diamand <chris@diamand.org>
+Date: Wed, 27 Jan 2016 17:04:35 -0800
+Subject: [PATCH] Input: byd - add BYD PS/2 touchpad driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Driver for the BYD BTP10463 touchpad, found in PC Specialist `Lafite'
+laptops. This patch sends the magic command sequence which causes the
+touchpad to stream intellimouse-style packets.
+
+Gestures are detected inside the touchpad, and exposed as special
+values in the Z component of each packet - absolute coordinates are
+not supported, even in the Windows driver. At present, this supports
+two-finger vertical and horizontal scrolling, and provides the
+framework to expose the other gestures it can recognize.
+
+Signed-off-by: Chris Diamand <chris@diamand.org>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+[backport to 4.4]
+Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+---
+ drivers/input/mouse/Kconfig        |  10 ++
+ drivers/input/mouse/Makefile       |   1 +
+ drivers/input/mouse/byd.c          | 337 +++++++++++++++++++++++++++++++++++++
+ drivers/input/mouse/byd.h          |  18 ++
+ drivers/input/mouse/psmouse-base.c |  14 ++
+ drivers/input/mouse/psmouse.h      |   1 +
+ 6 files changed, 381 insertions(+)
+ create mode 100644 drivers/input/mouse/byd.c
+ create mode 100644 drivers/input/mouse/byd.h
+
+diff --git a/drivers/input/mouse/Kconfig b/drivers/input/mouse/Kconfig
+index 17f97e5..096abb4 100644
+--- a/drivers/input/mouse/Kconfig
++++ b/drivers/input/mouse/Kconfig
+@@ -48,6 +48,16 @@ config MOUSE_PS2_ALPS
+ 
+ 	  If unsure, say Y.
+ 
++config MOUSE_PS2_BYD
++	bool "BYD PS/2 mouse protocol extension" if EXPERT
++	default y
++	depends on MOUSE_PS2
++	help
++	  Say Y here if you have a BYD PS/2 touchpad connected to
++	  your system.
++
++	  If unsure, say Y.
++
+ config MOUSE_PS2_LOGIPS2PP
+ 	bool "Logitech PS/2++ mouse protocol extension" if EXPERT
+ 	default y
+diff --git a/drivers/input/mouse/Makefile b/drivers/input/mouse/Makefile
+index ee6a6e9..6168b13 100644
+--- a/drivers/input/mouse/Makefile
++++ b/drivers/input/mouse/Makefile
+@@ -28,6 +28,7 @@ cyapatp-objs := cyapa.o cyapa_gen3.o cyapa_gen5.o cyapa_gen6.o
+ psmouse-objs := psmouse-base.o synaptics.o focaltech.o
+ 
+ psmouse-$(CONFIG_MOUSE_PS2_ALPS)	+= alps.o
++psmouse-$(CONFIG_MOUSE_PS2_BYD)		+= byd.o
+ psmouse-$(CONFIG_MOUSE_PS2_ELANTECH)	+= elantech.o
+ psmouse-$(CONFIG_MOUSE_PS2_OLPC)	+= hgpk.o
+ psmouse-$(CONFIG_MOUSE_PS2_LOGIPS2PP)	+= logips2pp.o
+diff --git a/drivers/input/mouse/byd.c b/drivers/input/mouse/byd.c
+new file mode 100644
+index 0000000..9425e0f
+--- /dev/null
++++ b/drivers/input/mouse/byd.c
+@@ -0,0 +1,337 @@
++/*
++ * BYD TouchPad PS/2 mouse driver
++ *
++ * Copyright (C) 2015 Chris Diamand <chris@diamand.org>
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ */
++
++#include <linux/delay.h>
++#include <linux/input.h>
++#include <linux/libps2.h>
++#include <linux/serio.h>
++
++#include "psmouse.h"
++#include "byd.h"
++
++#define PS2_Y_OVERFLOW	BIT_MASK(7)
++#define PS2_X_OVERFLOW	BIT_MASK(6)
++#define PS2_Y_SIGN	BIT_MASK(5)
++#define PS2_X_SIGN	BIT_MASK(4)
++#define PS2_ALWAYS_1	BIT_MASK(3)
++#define PS2_MIDDLE	BIT_MASK(2)
++#define PS2_RIGHT	BIT_MASK(1)
++#define PS2_LEFT	BIT_MASK(0)
++
++/*
++ * The touchpad reports gestures in the last byte of each packet. It can take
++ * any of the following values:
++ */
++
++/* One-finger scrolling in one of the edge scroll zones. */
++#define BYD_SCROLLUP		0xCA
++#define BYD_SCROLLDOWN		0x36
++#define BYD_SCROLLLEFT		0xCB
++#define BYD_SCROLLRIGHT		0x35
++/* Two-finger scrolling. */
++#define BYD_2DOWN		0x2B
++#define BYD_2UP			0xD5
++#define BYD_2LEFT		0xD6
++#define BYD_2RIGHT		0x2A
++/* Pinching in or out. */
++#define BYD_ZOOMOUT		0xD8
++#define BYD_ZOOMIN		0x28
++/* Three-finger swipe. */
++#define BYD_3UP			0xD3
++#define BYD_3DOWN		0x2D
++#define BYD_3LEFT		0xD4
++#define BYD_3RIGHT		0x2C
++/* Four-finger swipe. */
++#define BYD_4UP			0xCD
++#define BYD_4DOWN		0x33
++
++int byd_detect(struct psmouse *psmouse, bool set_properties)
++{
++	struct ps2dev *ps2dev = &psmouse->ps2dev;
++	unsigned char param[4];
++
++	param[0] = 0x03;
++	param[1] = 0x00;
++	param[2] = 0x00;
++	param[3] = 0x00;
++
++	if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES))
++		return -1;
++	if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES))
++		return -1;
++	if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES))
++		return -1;
++	if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES))
++		return -1;
++	if (ps2_command(ps2dev, param, PSMOUSE_CMD_GETINFO))
++		return -1;
++
++	if (param[1] != 0x03 || param[2] != 0x64)
++		return -ENODEV;
++
++	psmouse_dbg(psmouse, "BYD touchpad detected\n");
++
++	if (set_properties) {
++		psmouse->vendor = "BYD";
++		psmouse->name = "TouchPad";
++	}
++
++	return 0;
++}
++
++static psmouse_ret_t byd_process_byte(struct psmouse *psmouse)
++{
++	struct input_dev *dev = psmouse->dev;
++	u8 *pkt = psmouse->packet;
++
++	if (psmouse->pktcnt > 0 && !(pkt[0] & PS2_ALWAYS_1)) {
++		psmouse_warn(psmouse, "Always_1 bit not 1. pkt[0] = %02x\n",
++			     pkt[0]);
++		return PSMOUSE_BAD_DATA;
++	}
++
++	if (psmouse->pktcnt < psmouse->pktsize)
++		return PSMOUSE_GOOD_DATA;
++
++	/* Otherwise, a full packet has been received */
++	switch (pkt[3]) {
++	case 0: {
++		/* Standard packet */
++		/* Sign-extend if a sign bit is set. */
++		unsigned int signx = pkt[0] & PS2_X_SIGN ? ~0xFF : 0;
++		unsigned int signy = pkt[0] & PS2_Y_SIGN ? ~0xFF : 0;
++		int dx = signx | (int) pkt[1];
++		int dy = signy | (int) pkt[2];
++
++		input_report_rel(psmouse->dev, REL_X, dx);
++		input_report_rel(psmouse->dev, REL_Y, -dy);
++
++		input_report_key(psmouse->dev, BTN_LEFT, pkt[0] & PS2_LEFT);
++		input_report_key(psmouse->dev, BTN_RIGHT, pkt[0] & PS2_RIGHT);
++		input_report_key(psmouse->dev, BTN_MIDDLE, pkt[0] & PS2_MIDDLE);
++		break;
++	}
++
++	case BYD_SCROLLDOWN:
++	case BYD_2DOWN:
++		input_report_rel(dev, REL_WHEEL, -1);
++		break;
++
++	case BYD_SCROLLUP:
++	case BYD_2UP:
++		input_report_rel(dev, REL_WHEEL, 1);
++		break;
++
++	case BYD_SCROLLLEFT:
++	case BYD_2LEFT:
++		input_report_rel(dev, REL_HWHEEL, -1);
++		break;
++
++	case BYD_SCROLLRIGHT:
++	case BYD_2RIGHT:
++		input_report_rel(dev, REL_HWHEEL, 1);
++		break;
++
++	case BYD_ZOOMOUT:
++	case BYD_ZOOMIN:
++	case BYD_3UP:
++	case BYD_3DOWN:
++	case BYD_3LEFT:
++	case BYD_3RIGHT:
++	case BYD_4UP:
++	case BYD_4DOWN:
++		break;
++
++	default:
++		psmouse_warn(psmouse,
++			     "Unrecognized Z: pkt = %02x %02x %02x %02x\n",
++			     psmouse->packet[0], psmouse->packet[1],
++			     psmouse->packet[2], psmouse->packet[3]);
++		return PSMOUSE_BAD_DATA;
++	}
++
++	input_sync(dev);
++
++	return PSMOUSE_FULL_PACKET;
++}
++
++/* Send a sequence of bytes, where each is ACKed before the next is sent. */
++static int byd_send_sequence(struct psmouse *psmouse, const u8 *seq, size_t len)
++{
++	unsigned int i;
++
++	for (i = 0; i < len; ++i) {
++		if (ps2_command(&psmouse->ps2dev, NULL, seq[i]))
++			return -1;
++	}
++	return 0;
++}
++
++/* Keep scrolling after fingers are removed. */
++#define SCROLL_INERTIAL		0x01
++#define SCROLL_NO_INERTIAL	0x02
++
++/* Clicking can be done by tapping or pressing. */
++#define CLICK_BOTH		0x01
++/* Clicking can only be done by pressing. */
++#define CLICK_PRESS_ONLY	0x02
++
++static int byd_enable(struct psmouse *psmouse)
++{
++	const u8 seq1[] = { 0xE2, 0x00, 0xE0, 0x02, 0xE0 };
++	const u8 seq2[] = {
++		0xD3, 0x01,
++		0xD0, 0x00,
++		0xD0, 0x04,
++		/* Whether clicking is done by tapping or pressing. */
++		0xD4, CLICK_PRESS_ONLY,
++		0xD5, 0x01,
++		0xD7, 0x03,
++		/* Vertical and horizontal one-finger scroll zone inertia. */
++		0xD8, SCROLL_INERTIAL,
++		0xDA, 0x05,
++		0xDB, 0x02,
++		0xE4, 0x05,
++		0xD6, 0x01,
++		0xDE, 0x04,
++		0xE3, 0x01,
++		0xCF, 0x00,
++		0xD2, 0x03,
++		/* Vertical and horizontal two-finger scrolling inertia. */
++		0xE5, SCROLL_INERTIAL,
++		0xD9, 0x02,
++		0xD9, 0x07,
++		0xDC, 0x03,
++		0xDD, 0x03,
++		0xDF, 0x03,
++		0xE1, 0x03,
++		0xD1, 0x00,
++		0xCE, 0x00,
++		0xCC, 0x00,
++		0xE0, 0x00,
++		0xE2, 0x01
++	};
++	u8 param[4];
++
++	if (byd_send_sequence(psmouse, seq1, ARRAY_SIZE(seq1)))
++		return -1;
++
++	/* Send a 0x01 command, which should return 4 bytes. */
++	if (ps2_command(&psmouse->ps2dev, param, 0x0401))
++		return -1;
++
++	if (byd_send_sequence(psmouse, seq2, ARRAY_SIZE(seq2)))
++		return -1;
++
++	return 0;
++}
++
++/*
++ * Send the set of PS/2 commands required to make it identify as an
++ * intellimouse with 4-byte instead of 3-byte packets.
++ */
++static int byd_send_intellimouse_sequence(struct psmouse *psmouse)
++{
++	struct ps2dev *ps2dev = &psmouse->ps2dev;
++	u8 param[4];
++	int i;
++	const struct {
++		u16 command;
++		u8 arg;
++	} seq[] = {
++		{ PSMOUSE_CMD_RESET_BAT, 0 },
++		{ PSMOUSE_CMD_RESET_BAT, 0 },
++		{ PSMOUSE_CMD_GETID, 0 },
++		{ PSMOUSE_CMD_SETSCALE11, 0 },
++		{ PSMOUSE_CMD_SETSCALE11, 0 },
++		{ PSMOUSE_CMD_SETSCALE11, 0 },
++		{ PSMOUSE_CMD_GETINFO, 0 },
++		{ PSMOUSE_CMD_SETRES, 0x03 },
++		{ PSMOUSE_CMD_SETRATE, 0xC8 },
++		{ PSMOUSE_CMD_SETRATE, 0x64 },
++		{ PSMOUSE_CMD_SETRATE, 0x50 },
++		{ PSMOUSE_CMD_GETID, 0 },
++		{ PSMOUSE_CMD_SETRATE, 0xC8 },
++		{ PSMOUSE_CMD_SETRATE, 0xC8 },
++		{ PSMOUSE_CMD_SETRATE, 0x50 },
++		{ PSMOUSE_CMD_GETID, 0 },
++		{ PSMOUSE_CMD_SETRATE, 0x64 },
++		{ PSMOUSE_CMD_SETRES, 0x03 },
++		{ PSMOUSE_CMD_ENABLE, 0 }
++	};
++
++	memset(param, 0, sizeof(param));
++	for (i = 0; i < ARRAY_SIZE(seq); ++i) {
++		param[0] = seq[i].arg;
++		if (ps2_command(ps2dev, param, seq[i].command))
++			return -1;
++	}
++
++	return 0;
++}
++
++static int byd_reset_touchpad(struct psmouse *psmouse)
++{
++	if (byd_send_intellimouse_sequence(psmouse))
++		return -EIO;
++
++	if (byd_enable(psmouse))
++		return -EIO;
++
++	return 0;
++}
++
++static int byd_reconnect(struct psmouse *psmouse)
++{
++	int retry = 0, error = 0;
++
++	psmouse_dbg(psmouse, "Reconnect\n");
++	do {
++		psmouse_reset(psmouse);
++		if (retry)
++			ssleep(1);
++		error = byd_detect(psmouse, 0);
++	} while (error && ++retry < 3);
++
++	if (error)
++		return error;
++
++	psmouse_dbg(psmouse, "Reconnected after %d attempts\n", retry);
++
++	error = byd_reset_touchpad(psmouse);
++	if (error) {
++		psmouse_err(psmouse, "Unable to initialize device\n");
++		return error;
++	}
++
++	return 0;
++}
++
++int byd_init(struct psmouse *psmouse)
++{
++	struct input_dev *dev = psmouse->dev;
++
++	if (psmouse_reset(psmouse))
++		return -EIO;
++
++	if (byd_reset_touchpad(psmouse))
++		return -EIO;
++
++	psmouse->reconnect = byd_reconnect;
++	psmouse->protocol_handler = byd_process_byte;
++	psmouse->pktsize = 4;
++	psmouse->resync_time = 0;
++
++	__set_bit(BTN_MIDDLE, dev->keybit);
++	__set_bit(REL_WHEEL, dev->relbit);
++	__set_bit(REL_HWHEEL, dev->relbit);
++
++	return 0;
++}
+diff --git a/drivers/input/mouse/byd.h b/drivers/input/mouse/byd.h
+new file mode 100644
+index 0000000..d6c120c
+--- /dev/null
++++ b/drivers/input/mouse/byd.h
+@@ -0,0 +1,18 @@
++#ifndef _BYD_H
++#define _BYD_H
++
++#ifdef CONFIG_MOUSE_PS2_BYD
++int byd_detect(struct psmouse *psmouse, bool set_properties);
++int byd_init(struct psmouse *psmouse);
++#else
++static inline int byd_detect(struct psmouse *psmouse, bool set_properties)
++{
++	return -ENOSYS;
++}
++static inline int byd_init(struct psmouse *psmouse)
++{
++	return -ENOSYS;
++}
++#endif /* CONFIG_MOUSE_PS2_BYD */
++
++#endif /* _BYD_H */
+diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
+index b9e4ee3..39d1bec 100644
+--- a/drivers/input/mouse/psmouse-base.c
++++ b/drivers/input/mouse/psmouse-base.c
+@@ -37,6 +37,7 @@
+ #include "cypress_ps2.h"
+ #include "focaltech.h"
+ #include "vmmouse.h"
++#include "byd.h"
+ 
+ #define DRIVER_DESC	"PS/2 mouse driver"
+ 
+@@ -920,6 +921,11 @@ static int psmouse_extensions(struct psm
+ 		if (psmouse_do_detect(touchkit_ps2_detect,
+ 				      psmouse, set_properties) == 0)
+ 			return PSMOUSE_TOUCHKIT_PS2;
++
++		if (psmouse_do_detect(byd_detect,
++				      psmouse, set_properties) == 0)
++			if (!set_properties || byd_init(psmouse) == 0)
++				return PSMOUSE_BYD;
+ 	}
+ 
+ /*
+@@ -1130,6 +1136,15 @@ static const struct psmouse_protocol psmouse_protocols[] = {
+ 		.init		= vmmouse_init,
+ 	},
+ #endif
++#ifdef CONFIG_MOUSE_PS2_BYD
++	{
++		.type		= PSMOUSE_BYD,
++		.name		= "BydPS/2",
++		.alias		= "byd",
++		.detect		= byd_detect,
++		.init		= byd_init,
++	},
++#endif
+ 	{
+ 		.type		= PSMOUSE_AUTO,
+ 		.name		= "auto",
+diff --git a/drivers/input/mouse/psmouse.h b/drivers/input/mouse/psmouse.h
+index ad5a5a1..e0ca6cd 100644
+--- a/drivers/input/mouse/psmouse.h
++++ b/drivers/input/mouse/psmouse.h
+@@ -104,6 +104,7 @@ enum psmouse_type {
+ 	PSMOUSE_CYPRESS,
+ 	PSMOUSE_FOCALTECH,
+ 	PSMOUSE_VMMOUSE,
++	PSMOUSE_BYD,
+ 	PSMOUSE_AUTO		/* This one should always be last */
+ };
+ 
+-- 
+2.5.5

patches.backports/0002-Input-byd-enable-absolute-mode.patch

@@ -0,0 +1,710 @@
+From 2d5f5611dd0de52e9a52b56391a7049a52184e72 Mon Sep 17 00:00:00 2001
+From: Richard Pospesel <pospeselr@gmail.com>
+Date: Mon, 14 Mar 2016 09:41:16 -0700
+Subject: [PATCH] Input: byd - enable absolute mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The Windows driver's settings dialog contains a visualization of the
+regions for the hardware edge scrolling capability, which uses a
+temporarily-enabled limited-resolution absolute mode.
+
+This patch enables this during normal operation, and combines the
+absolute packets with the existing relative packets to provide
+accurate absolute position and touch reporting.
+
+It also adds documentation for all known gesture packets and
+initialization commands.
+
+Reviewed-by: Chris Diamand <chris@diamand.org>
+Signed-off-by: Richard Pospesel <pospeselr@gmail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+---
+ drivers/input/mouse/byd.c          | 565 ++++++++++++++++++++++++-------------
+ drivers/input/mouse/psmouse-base.c |   2 +-
+ 2 files changed, 369 insertions(+), 198 deletions(-)
+
+diff --git a/drivers/input/mouse/byd.c b/drivers/input/mouse/byd.c
+index 9425e0f..fdc243c 100644
+--- a/drivers/input/mouse/byd.c
++++ b/drivers/input/mouse/byd.c
+@@ -12,10 +12,12 @@
+ #include <linux/input.h>
+ #include <linux/libps2.h>
+ #include <linux/serio.h>
++#include <linux/slab.h>
+ 
+ #include "psmouse.h"
+ #include "byd.h"
+ 
++/* PS2 Bits */
+ #define PS2_Y_OVERFLOW	BIT_MASK(7)
+ #define PS2_X_OVERFLOW	BIT_MASK(6)
+ #define PS2_Y_SIGN	BIT_MASK(5)
+@@ -26,69 +28,249 @@
+ #define PS2_LEFT	BIT_MASK(0)
+ 
+ /*
+- * The touchpad reports gestures in the last byte of each packet. It can take
+- * any of the following values:
++ * BYD pad constants
+  */
+ 
+-/* One-finger scrolling in one of the edge scroll zones. */
+-#define BYD_SCROLLUP		0xCA
+-#define BYD_SCROLLDOWN		0x36
+-#define BYD_SCROLLLEFT		0xCB
+-#define BYD_SCROLLRIGHT		0x35
+-/* Two-finger scrolling. */
+-#define BYD_2DOWN		0x2B
+-#define BYD_2UP			0xD5
+-#define BYD_2LEFT		0xD6
+-#define BYD_2RIGHT		0x2A
+-/* Pinching in or out. */
+-#define BYD_ZOOMOUT		0xD8
+-#define BYD_ZOOMIN		0x28
+-/* Three-finger swipe. */
+-#define BYD_3UP			0xD3
+-#define BYD_3DOWN		0x2D
+-#define BYD_3LEFT		0xD4
+-#define BYD_3RIGHT		0x2C
+-/* Four-finger swipe. */
+-#define BYD_4UP			0xCD
+-#define BYD_4DOWN		0x33
++/*
++ * True device resolution is unknown, however experiments show the
++ * resolution is about 111 units/mm.
++ * Absolute coordinate packets are in the range 0-255 for both X and Y
++ * we pick ABS_X/ABS_Y dimensions which are multiples of 256 and in
++ * the right ballpark given the touchpad's physical dimensions and estimate
++ * resolution per spec sheet, device active area dimensions are
++ * 101.6 x 60.1 mm.
++ */
++#define BYD_PAD_WIDTH		11264
++#define BYD_PAD_HEIGHT		6656
++#define BYD_PAD_RESOLUTION	111
+ 
+-int byd_detect(struct psmouse *psmouse, bool set_properties)
++/*
++ * Given the above dimensions, relative packets velocity is in multiples of
++ * 1 unit / 11 milliseconds.  We use this dt to estimate distance traveled
++ */
++#define BYD_DT			11
++/* Time in jiffies used to timeout various touch events (64 ms) */
++#define BYD_TOUCH_TIMEOUT	msecs_to_jiffies(64)
++
++/* BYD commands reverse engineered from windows driver */
++
++/*
++ * Swipe gesture from off-pad to on-pad
++ *  0 : disable
++ *  1 : enable
++ */
++#define BYD_CMD_SET_OFFSCREEN_SWIPE		0x10cc
++/*
++ * Tap and drag delay time
++ *  0 : disable
++ *  1 - 8 : least to most delay
++ */
++#define BYD_CMD_SET_TAP_DRAG_DELAY_TIME		0x10cf
++/*
++ * Physical buttons function mapping
++ *  0 : enable
++ *  4 : normal
++ *  5 : left button custom command
++ *  6 : right button custom command
++ *  8 : disable
++ */
++#define BYD_CMD_SET_PHYSICAL_BUTTONS		0x10d0
++/*
++ * Absolute mode (1 byte X/Y resolution)
++ *  0 : disable
++ *  2 : enable
++ */
++#define BYD_CMD_SET_ABSOLUTE_MODE		0x10d1
++/*
++ * Two finger scrolling
++ *  1 : vertical
++ *  2 : horizontal
++ *  3 : vertical + horizontal
++ *  4 : disable
++ */
++#define BYD_CMD_SET_TWO_FINGER_SCROLL		0x10d2
++/*
++ * Handedness
++ *  1 : right handed
++ *  2 : left handed
++ */
++#define BYD_CMD_SET_HANDEDNESS			0x10d3
++/*
++ * Tap to click
++ *  1 : enable
++ *  2 : disable
++ */
++#define BYD_CMD_SET_TAP				0x10d4
++/*
++ * Tap and drag
++ *  1 : tap and hold to drag
++ *  2 : tap and hold to drag + lock
++ *  3 : disable
++ */
++#define BYD_CMD_SET_TAP_DRAG			0x10d5
++/*
++ * Touch sensitivity
++ *  1 - 7 : least to most sensitive
++ */
++#define BYD_CMD_SET_TOUCH_SENSITIVITY		0x10d6
++/*
++ * One finger scrolling
++ *  1 : vertical
++ *  2 : horizontal
++ *  3 : vertical + horizontal
++ *  4 : disable
++ */
++#define BYD_CMD_SET_ONE_FINGER_SCROLL		0x10d7
++/*
++ * One finger scrolling function
++ *  1 : free scrolling
++ *  2 : edge motion
++ *  3 : free scrolling + edge motion
++ *  4 : disable
++ */
++#define BYD_CMD_SET_ONE_FINGER_SCROLL_FUNC	0x10d8
++/*
++ * Sliding speed
++ *  1 - 5 : slowest to fastest
++ */
++#define BYD_CMD_SET_SLIDING_SPEED		0x10da
++/*
++ * Edge motion
++ *  1 : disable
++ *  2 : enable when dragging
++ *  3 : enable when dragging and pointing
++ */
++#define BYD_CMD_SET_EDGE_MOTION			0x10db
++/*
++ * Left edge region size
++ *  0 - 7 : smallest to largest width
++ */
++#define BYD_CMD_SET_LEFT_EDGE_REGION		0x10dc
++/*
++ * Top edge region size
++ *  0 - 9 : smallest to largest height
++ */
++#define BYD_CMD_SET_TOP_EDGE_REGION		0x10dd
++/*
++ * Disregard palm press as clicks
++ *  1 - 6 : smallest to largest
++ */
++#define BYD_CMD_SET_PALM_CHECK			0x10de
++/*
++ * Right edge region size
++ *  0 - 7 : smallest to largest width
++ */
++#define BYD_CMD_SET_RIGHT_EDGE_REGION		0x10df
++/*
++ * Bottom edge region size
++ *  0 - 9 : smallest to largest height
++ */
++#define BYD_CMD_SET_BOTTOM_EDGE_REGION		0x10e1
++/*
++ * Multitouch gestures
++ *  1 : enable
++ *  2 : disable
++ */
++#define BYD_CMD_SET_MULTITOUCH			0x10e3
++/*
++ * Edge motion speed
++ *  0 : control with finger pressure
++ *  1 - 9 : slowest to fastest
++ */
++#define BYD_CMD_SET_EDGE_MOTION_SPEED		0x10e4
++/*
++ * Two finger scolling function
++ *  0 : free scrolling
++ *  1 : free scrolling (with momentum)
++ *  2 : edge motion
++ *  3 : free scrolling (with momentum) + edge motion
++ *  4 : disable
++ */
++#define BYD_CMD_SET_TWO_FINGER_SCROLL_FUNC	0x10e5
++
++/*
++ * The touchpad generates a mixture of absolute and relative packets, indicated
++ * by the the last byte of each packet being set to one of the following:
++ */
++#define BYD_PACKET_ABSOLUTE			0xf8
++#define BYD_PACKET_RELATIVE			0x00
++/* Multitouch gesture packets */
++#define BYD_PACKET_PINCH_IN			0xd8
++#define BYD_PACKET_PINCH_OUT			0x28
++#define BYD_PACKET_ROTATE_CLOCKWISE		0x29
++#define BYD_PACKET_ROTATE_ANTICLOCKWISE		0xd7
++#define BYD_PACKET_TWO_FINGER_SCROLL_RIGHT	0x2a
++#define BYD_PACKET_TWO_FINGER_SCROLL_DOWN	0x2b
++#define BYD_PACKET_TWO_FINGER_SCROLL_UP		0xd5
++#define BYD_PACKET_TWO_FINGER_SCROLL_LEFT	0xd6
++#define BYD_PACKET_THREE_FINGER_SWIPE_RIGHT	0x2c
++#define BYD_PACKET_THREE_FINGER_SWIPE_DOWN	0x2d
++#define BYD_PACKET_THREE_FINGER_SWIPE_UP	0xd3
++#define BYD_PACKET_THREE_FINGER_SWIPE_LEFT	0xd4
++#define BYD_PACKET_FOUR_FINGER_DOWN		0x33
++#define BYD_PACKET_FOUR_FINGER_UP		0xcd
++#define BYD_PACKET_REGION_SCROLL_RIGHT		0x35
++#define BYD_PACKET_REGION_SCROLL_DOWN		0x36
++#define BYD_PACKET_REGION_SCROLL_UP		0xca
++#define BYD_PACKET_REGION_SCROLL_LEFT		0xcb
++#define BYD_PACKET_RIGHT_CORNER_CLICK		0xd2
++#define BYD_PACKET_LEFT_CORNER_CLICK		0x2e
++#define BYD_PACKET_LEFT_AND_RIGHT_CORNER_CLICK	0x2f
++#define BYD_PACKET_ONTO_PAD_SWIPE_RIGHT		0x37
++#define BYD_PACKET_ONTO_PAD_SWIPE_DOWN		0x30
++#define BYD_PACKET_ONTO_PAD_SWIPE_UP		0xd0
++#define BYD_PACKET_ONTO_PAD_SWIPE_LEFT		0xc9
++
++struct byd_data {
++	struct timer_list timer;
++	s32 abs_x;
++	s32 abs_y;
++	typeof(jiffies) last_touch_time;
++	bool btn_left;
++	bool btn_right;
++	bool touch;
++};
++
++static void byd_report_input(struct psmouse *psmouse)
+ {
+-	struct ps2dev *ps2dev = &psmouse->ps2dev;
+-	unsigned char param[4];
++	struct byd_data *priv = psmouse->private;
++	struct input_dev *dev = psmouse->dev;
+ 
+-	param[0] = 0x03;
+-	param[1] = 0x00;
+-	param[2] = 0x00;
+-	param[3] = 0x00;
++	input_report_key(dev, BTN_TOUCH, priv->touch);
++	input_report_key(dev, BTN_TOOL_FINGER, priv->touch);
+ 
+-	if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES))
+-		return -1;
+-	if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES))
+-		return -1;
+-	if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES))
+-		return -1;
+-	if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES))
+-		return -1;
+-	if (ps2_command(ps2dev, param, PSMOUSE_CMD_GETINFO))
+-		return -1;
++	input_report_abs(dev, ABS_X, priv->abs_x);
++	input_report_abs(dev, ABS_Y, priv->abs_y);
++	input_report_key(dev, BTN_LEFT, priv->btn_left);
++	input_report_key(dev, BTN_RIGHT, priv->btn_right);
+ 
+-	if (param[1] != 0x03 || param[2] != 0x64)
+-		return -ENODEV;
++	input_sync(dev);
++}
+ 
+-	psmouse_dbg(psmouse, "BYD touchpad detected\n");
++static void byd_clear_touch(unsigned long data)
++{
++	struct psmouse *psmouse = (struct psmouse *)data;
++	struct byd_data *priv = psmouse->private;
+ 
+-	if (set_properties) {
+-		psmouse->vendor = "BYD";
+-		psmouse->name = "TouchPad";
+-	}
++	serio_pause_rx(psmouse->ps2dev.serio);
++	priv->touch = false;
+ 
+-	return 0;
++	byd_report_input(psmouse);
++
++	serio_continue_rx(psmouse->ps2dev.serio);
++
++	/*
++	 * Move cursor back to center of pad when we lose touch - this
++	 * specifically improves user experience when moving cursor with one
++	 * finger, and pressing a button with another.
++	 */
++	priv->abs_x = BYD_PAD_WIDTH / 2;
++	priv->abs_y = BYD_PAD_HEIGHT / 2;
+ }
+ 
+ static psmouse_ret_t byd_process_byte(struct psmouse *psmouse)
+ {
+-	struct input_dev *dev = psmouse->dev;
++	struct byd_data *priv = psmouse->private;
+ 	u8 *pkt = psmouse->packet;
+ 
+ 	if (psmouse->pktcnt > 0 && !(pkt[0] & PS2_ALWAYS_1)) {
+@@ -102,53 +284,34 @@ static psmouse_ret_t byd_process_byte(struct psmouse *psmouse)
+ 
+ 	/* Otherwise, a full packet has been received */
+ 	switch (pkt[3]) {
+-	case 0: {
++	case BYD_PACKET_ABSOLUTE:
++		/* Only use absolute packets for the start of movement. */
++		if (!priv->touch) {
++			/* needed to detect tap */
++			typeof(jiffies) tap_time =
++				priv->last_touch_time + BYD_TOUCH_TIMEOUT;
++			priv->touch = time_after(jiffies, tap_time);
++
++			/* init abs position */
++			priv->abs_x = pkt[1] * (BYD_PAD_WIDTH / 256);
++			priv->abs_y = (255 - pkt[2]) * (BYD_PAD_HEIGHT / 256);
++		}
++		break;
++	case BYD_PACKET_RELATIVE: {
+ 		/* Standard packet */
+ 		/* Sign-extend if a sign bit is set. */
+-		unsigned int signx = pkt[0] & PS2_X_SIGN ? ~0xFF : 0;
+-		unsigned int signy = pkt[0] & PS2_Y_SIGN ? ~0xFF : 0;
+-		int dx = signx | (int) pkt[1];
+-		int dy = signy | (int) pkt[2];
++		u32 signx = pkt[0] & PS2_X_SIGN ? ~0xFF : 0;
++		u32 signy = pkt[0] & PS2_Y_SIGN ? ~0xFF : 0;
++		s32 dx = signx | (int) pkt[1];
++		s32 dy = signy | (int) pkt[2];
+ 
+-		input_report_rel(psmouse->dev, REL_X, dx);
+-		input_report_rel(psmouse->dev, REL_Y, -dy);
++		/* Update position based on velocity */
++		priv->abs_x += dx * BYD_DT;
++		priv->abs_y -= dy * BYD_DT;
+ 
+-		input_report_key(psmouse->dev, BTN_LEFT, pkt[0] & PS2_LEFT);
+-		input_report_key(psmouse->dev, BTN_RIGHT, pkt[0] & PS2_RIGHT);
+-		input_report_key(psmouse->dev, BTN_MIDDLE, pkt[0] & PS2_MIDDLE);
++		priv->touch = true;
+ 		break;
+ 	}
+-
+-	case BYD_SCROLLDOWN:
+-	case BYD_2DOWN:
+-		input_report_rel(dev, REL_WHEEL, -1);
+-		break;
+-
+-	case BYD_SCROLLUP:
+-	case BYD_2UP:
+-		input_report_rel(dev, REL_WHEEL, 1);
+-		break;
+-
+-	case BYD_SCROLLLEFT:
+-	case BYD_2LEFT:
+-		input_report_rel(dev, REL_HWHEEL, -1);
+-		break;
+-
+-	case BYD_SCROLLRIGHT:
+-	case BYD_2RIGHT:
+-		input_report_rel(dev, REL_HWHEEL, 1);
+-		break;
+-
+-	case BYD_ZOOMOUT:
+-	case BYD_ZOOMIN:
+-	case BYD_3UP:
+-	case BYD_3DOWN:
+-	case BYD_3LEFT:
+-	case BYD_3RIGHT:
+-	case BYD_4UP:
+-	case BYD_4DOWN:
+-		break;
+-
+ 	default:
+ 		psmouse_warn(psmouse,
+ 			     "Unrecognized Z: pkt = %02x %02x %02x %02x\n",
+@@ -157,134 +320,76 @@ static psmouse_ret_t byd_process_byte(struct psmouse *psmouse)
+ 		return PSMOUSE_BAD_DATA;
+ 	}
+ 
+-	input_sync(dev);
++	priv->btn_left = pkt[0] & PS2_LEFT;
++	priv->btn_right = pkt[0] & PS2_RIGHT;
+ 
+-	return PSMOUSE_FULL_PACKET;
+-}
++	byd_report_input(psmouse);
+ 
+-/* Send a sequence of bytes, where each is ACKed before the next is sent. */
+-static int byd_send_sequence(struct psmouse *psmouse, const u8 *seq, size_t len)
+-{
+-	unsigned int i;
+-
+-	for (i = 0; i < len; ++i) {
+-		if (ps2_command(&psmouse->ps2dev, NULL, seq[i]))
+-			return -1;
++	/* Reset time since last touch. */
++	if (priv->touch) {
++		priv->last_touch_time = jiffies;
++		mod_timer(&priv->timer, jiffies + BYD_TOUCH_TIMEOUT);
+ 	}
+-	return 0;
+-}
+-
+-/* Keep scrolling after fingers are removed. */
+-#define SCROLL_INERTIAL		0x01
+-#define SCROLL_NO_INERTIAL	0x02
+-
+-/* Clicking can be done by tapping or pressing. */
+-#define CLICK_BOTH		0x01
+-/* Clicking can only be done by pressing. */
+-#define CLICK_PRESS_ONLY	0x02
+ 
+-static int byd_enable(struct psmouse *psmouse)
+-{
+-	const u8 seq1[] = { 0xE2, 0x00, 0xE0, 0x02, 0xE0 };
+-	const u8 seq2[] = {
+-		0xD3, 0x01,
+-		0xD0, 0x00,
+-		0xD0, 0x04,
+-		/* Whether clicking is done by tapping or pressing. */
+-		0xD4, CLICK_PRESS_ONLY,
+-		0xD5, 0x01,
+-		0xD7, 0x03,
+-		/* Vertical and horizontal one-finger scroll zone inertia. */
+-		0xD8, SCROLL_INERTIAL,
+-		0xDA, 0x05,
+-		0xDB, 0x02,
+-		0xE4, 0x05,
+-		0xD6, 0x01,
+-		0xDE, 0x04,
+-		0xE3, 0x01,
+-		0xCF, 0x00,
+-		0xD2, 0x03,
+-		/* Vertical and horizontal two-finger scrolling inertia. */
+-		0xE5, SCROLL_INERTIAL,
+-		0xD9, 0x02,
+-		0xD9, 0x07,
+-		0xDC, 0x03,
+-		0xDD, 0x03,
+-		0xDF, 0x03,
+-		0xE1, 0x03,
+-		0xD1, 0x00,
+-		0xCE, 0x00,
+-		0xCC, 0x00,
+-		0xE0, 0x00,
+-		0xE2, 0x01
+-	};
+-	u8 param[4];
+-
+-	if (byd_send_sequence(psmouse, seq1, ARRAY_SIZE(seq1)))
+-		return -1;
+-
+-	/* Send a 0x01 command, which should return 4 bytes. */
+-	if (ps2_command(&psmouse->ps2dev, param, 0x0401))
+-		return -1;
+-
+-	if (byd_send_sequence(psmouse, seq2, ARRAY_SIZE(seq2)))
+-		return -1;
+-
+-	return 0;
++	return PSMOUSE_FULL_PACKET;
+ }
+ 
+-/*
+- * Send the set of PS/2 commands required to make it identify as an
+- * intellimouse with 4-byte instead of 3-byte packets.
+- */
+-static int byd_send_intellimouse_sequence(struct psmouse *psmouse)
++static int byd_reset_touchpad(struct psmouse *psmouse)
+ {
+ 	struct ps2dev *ps2dev = &psmouse->ps2dev;
+ 	u8 param[4];
+-	int i;
++	size_t i;
++
+ 	const struct {
+ 		u16 command;
+ 		u8 arg;
+ 	} seq[] = {
+-		{ PSMOUSE_CMD_RESET_BAT, 0 },
+-		{ PSMOUSE_CMD_RESET_BAT, 0 },
+-		{ PSMOUSE_CMD_GETID, 0 },
+-		{ PSMOUSE_CMD_SETSCALE11, 0 },
+-		{ PSMOUSE_CMD_SETSCALE11, 0 },
+-		{ PSMOUSE_CMD_SETSCALE11, 0 },
+-		{ PSMOUSE_CMD_GETINFO, 0 },
+-		{ PSMOUSE_CMD_SETRES, 0x03 },
++		/*
++		 * Intellimouse initialization sequence, to get 4-byte instead
++		 * of 3-byte packets.
++		 */
+ 		{ PSMOUSE_CMD_SETRATE, 0xC8 },
+ 		{ PSMOUSE_CMD_SETRATE, 0x64 },
+ 		{ PSMOUSE_CMD_SETRATE, 0x50 },
+ 		{ PSMOUSE_CMD_GETID, 0 },
+-		{ PSMOUSE_CMD_SETRATE, 0xC8 },
+-		{ PSMOUSE_CMD_SETRATE, 0xC8 },
+-		{ PSMOUSE_CMD_SETRATE, 0x50 },
+-		{ PSMOUSE_CMD_GETID, 0 },
+-		{ PSMOUSE_CMD_SETRATE, 0x64 },
+-		{ PSMOUSE_CMD_SETRES, 0x03 },
+-		{ PSMOUSE_CMD_ENABLE, 0 }
++		{ PSMOUSE_CMD_ENABLE, 0 },
++		/*
++		 * BYD-specific initialization, which enables absolute mode and
++		 * (if desired), the touchpad's built-in gesture detection.
++		 */
++		{ 0x10E2, 0x00 },
++		{ 0x10E0, 0x02 },
++		/* The touchpad should reply with 4 seemingly-random bytes */
++		{ 0x14E0, 0x01 },
++		/* Pairs of parameters and values. */
++		{ BYD_CMD_SET_HANDEDNESS, 0x01 },
++		{ BYD_CMD_SET_PHYSICAL_BUTTONS, 0x04 },
++		{ BYD_CMD_SET_TAP, 0x02 },
++		{ BYD_CMD_SET_ONE_FINGER_SCROLL, 0x04 },
++		{ BYD_CMD_SET_ONE_FINGER_SCROLL_FUNC, 0x04 },
++		{ BYD_CMD_SET_EDGE_MOTION, 0x01 },
++		{ BYD_CMD_SET_PALM_CHECK, 0x00 },
++		{ BYD_CMD_SET_MULTITOUCH, 0x02 },
++		{ BYD_CMD_SET_TWO_FINGER_SCROLL, 0x04 },
++		{ BYD_CMD_SET_TWO_FINGER_SCROLL_FUNC, 0x04 },
++		{ BYD_CMD_SET_LEFT_EDGE_REGION, 0x00 },
++		{ BYD_CMD_SET_TOP_EDGE_REGION, 0x00 },
++		{ BYD_CMD_SET_RIGHT_EDGE_REGION, 0x00 },
++		{ BYD_CMD_SET_BOTTOM_EDGE_REGION, 0x00 },
++		{ BYD_CMD_SET_ABSOLUTE_MODE, 0x02 },
++		/* Finalize initialization. */
++		{ 0x10E0, 0x00 },
++		{ 0x10E2, 0x01 },
+ 	};
+ 
+-	memset(param, 0, sizeof(param));
+ 	for (i = 0; i < ARRAY_SIZE(seq); ++i) {
++		memset(param, 0, sizeof(param));
+ 		param[0] = seq[i].arg;
+ 		if (ps2_command(ps2dev, param, seq[i].command))
+-			return -1;
++			return -EIO;
+ 	}
+ 
+-	return 0;
+-}
+-
+-static int byd_reset_touchpad(struct psmouse *psmouse)
+-{
+-	if (byd_send_intellimouse_sequence(psmouse))
+-		return -EIO;
+-
+-	if (byd_enable(psmouse))
+-		return -EIO;
+-
++	psmouse_set_state(psmouse, PSMOUSE_ACTIVATED);
+ 	return 0;
+ }
+ 
+@@ -314,9 +419,50 @@ static int byd_reconnect(struct psmouse *psmouse)
+ 	return 0;
+ }
+ 
++static void byd_disconnect(struct psmouse *psmouse)
++{
++	struct byd_data *priv = psmouse->private;
++
++	if (priv) {
++		del_timer(&priv->timer);
++		kfree(psmouse->private);
++		psmouse->private = NULL;
++	}
++}
++
++int byd_detect(struct psmouse *psmouse, bool set_properties)
++{
++	struct ps2dev *ps2dev = &psmouse->ps2dev;
++	u8 param[4] = {0x03, 0x00, 0x00, 0x00};
++
++	if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES))
++		return -1;
++	if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES))
++		return -1;
++	if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES))
++		return -1;
++	if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES))
++		return -1;
++	if (ps2_command(ps2dev, param, PSMOUSE_CMD_GETINFO))
++		return -1;
++
++	if (param[1] != 0x03 || param[2] != 0x64)
++		return -ENODEV;
++
++	psmouse_dbg(psmouse, "BYD touchpad detected\n");
++
++	if (set_properties) {
++		psmouse->vendor = "BYD";
++		psmouse->name = "TouchPad";
++	}
++
++	return 0;
++}
++
+ int byd_init(struct psmouse *psmouse)
+ {
+ 	struct input_dev *dev = psmouse->dev;
++	struct byd_data *priv;
+ 
+ 	if (psmouse_reset(psmouse))
+ 		return -EIO;
+@@ -324,14 +470,39 @@ int byd_init(struct psmouse *psmouse)
+ 	if (byd_reset_touchpad(psmouse))
+ 		return -EIO;
+ 
++	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	memset(priv, 0, sizeof(*priv));
++	setup_timer(&priv->timer, byd_clear_touch, (unsigned long) psmouse);
++
++	psmouse->private = priv;
++	psmouse->disconnect = byd_disconnect;
+ 	psmouse->reconnect = byd_reconnect;
+ 	psmouse->protocol_handler = byd_process_byte;
+ 	psmouse->pktsize = 4;
+ 	psmouse->resync_time = 0;
+ 
+-	__set_bit(BTN_MIDDLE, dev->keybit);
+-	__set_bit(REL_WHEEL, dev->relbit);
+-	__set_bit(REL_HWHEEL, dev->relbit);
++	__set_bit(INPUT_PROP_POINTER, dev->propbit);
++	/* Touchpad */
++	__set_bit(BTN_TOUCH, dev->keybit);
++	__set_bit(BTN_TOOL_FINGER, dev->keybit);
++	/* Buttons */
++	__set_bit(BTN_LEFT, dev->keybit);
++	__set_bit(BTN_RIGHT, dev->keybit);
++	__clear_bit(BTN_MIDDLE, dev->keybit);
++
++	/* Absolute position */
++	__set_bit(EV_ABS, dev->evbit);
++	input_set_abs_params(dev, ABS_X, 0, BYD_PAD_WIDTH, 0, 0);
++	input_set_abs_params(dev, ABS_Y, 0, BYD_PAD_HEIGHT, 0, 0);
++	input_abs_set_res(dev, ABS_X, BYD_PAD_RESOLUTION);
++	input_abs_set_res(dev, ABS_Y, BYD_PAD_RESOLUTION);
++	/* No relative support */
++	__clear_bit(EV_REL, dev->evbit);
++	__clear_bit(REL_X, dev->relbit);
++	__clear_bit(REL_Y, dev->relbit);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
+index 39d1bec..5784e20 100644
+--- a/drivers/input/mouse/psmouse-base.c
++++ b/drivers/input/mouse/psmouse-base.c
+@@ -846,7 +846,7 @@ static const struct psmouse_protocol psmouse_protocols[] = {
+ #ifdef CONFIG_MOUSE_PS2_BYD
+ 	{
+ 		.type		= PSMOUSE_BYD,
+-		.name		= "BydPS/2",
++		.name		= "BYDPS/2",
+ 		.alias		= "byd",
+ 		.detect		= byd_detect,
+ 		.init		= byd_init,
+-- 
+2.5.5
+

patches.backports/0003-Input-byd-don-t-wipe-dynamically-allocated-memory-tw.patch

@@ -0,0 +1,32 @@
+From 5ad629a82de37cbcaffc17861e07b5ec68ab75f4 Mon Sep 17 00:00:00 2001
+From: Vladimir Zapolskiy <vz@mleia.com>
+Date: Tue, 26 Apr 2016 09:50:31 -0700
+Subject: [PATCH] Input: byd - don't wipe dynamically allocated memory twice
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Since memory for a private data is allocated by kzalloc() there is no
+need to fill it with zeroes immediately after the allocation.
+
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+---
+ drivers/input/mouse/byd.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/input/mouse/byd.c b/drivers/input/mouse/byd.c
+index fdc243c..ec73f75 100644
+--- a/drivers/input/mouse/byd.c
++++ b/drivers/input/mouse/byd.c
+@@ -474,7 +474,6 @@ int byd_init(struct psmouse *psmouse)
+ 	if (!priv)
+ 		return -ENOMEM;
+ 
+-	memset(priv, 0, sizeof(*priv));
+ 	setup_timer(&priv->timer, byd_clear_touch, (unsigned long) psmouse);
+ 
+ 	psmouse->private = priv;
+-- 
+2.5.5
+

patches.backports/0004-Input-byd-update-copyright-header.patch

@@ -0,0 +1,35 @@
+From 82aaa086019ce0e6fcd3a44c0a2e4329afe988b6 Mon Sep 17 00:00:00 2001
+From: Chris Diamand <chris@diamand.org>
+Date: Mon, 9 May 2016 09:30:39 -0700
+Subject: [PATCH] Input: byd - update copyright header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+As pointed out by Richard, the changes to the comment got missed off
+the absolute mode patch somehow.
+
+Signed-off-by: Chris Diamand <chris@diamand.org>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+---
+ drivers/input/mouse/byd.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/input/mouse/byd.c b/drivers/input/mouse/byd.c
+index fdc243c..e583f8b 100644
+--- a/drivers/input/mouse/byd.c
++++ b/drivers/input/mouse/byd.c
+@@ -2,6 +2,10 @@
+  * BYD TouchPad PS/2 mouse driver
+  *
+  * Copyright (C) 2015 Chris Diamand <chris@diamand.org>
++ * Copyright (C) 2015 Richard Pospesel
++ * Copyright (C) 2015 Tai Chi Minh Ralph Eastwood
++ * Copyright (C) 2015 Martin Wimpress
++ * Copyright (C) 2015 Jay Kuri
+  *
+  * This program is free software; you can redistribute it and/or modify it
+  * under the terms of the GNU General Public License version 2 as published by
+-- 
+2.5.5
+

rel

@@ -1 +1 @@
-9
+10

series.conf

@@ -6,6 +6,15 @@ patches.xen/xen-netfront-detach-crash.patch
 patches.xen/0001-mce-hide-EBUSY-initialization-error-on-Xen.patch
 patches.xen/irq-bind-debug-log.patch
 
+# Backports
+patches.backports/0001-HID-core-prevent-out-of-bound-readings.patch
+patches.backports/0001-HID-fix-out-of-bound-access-in-extract-and-implement.patch
+# Touchpad driver for Purism laptops
+patches.backports/0001-Input-byd-add-BYD-PS-2-touchpad-driver.patch
+patches.backports/0002-Input-byd-enable-absolute-mode.patch
+patches.backports/0003-Input-byd-don-t-wipe-dynamically-allocated-memory-tw.patch
+patches.backports/0004-Input-byd-update-copyright-header.patch
+
 # Additional features
 #patches.xen/pvops-0100-usb-xen-pvusb-driver.patch
 patches.xen/pvops-blkfront-removable-flag.patch

version

@@ -1 +1 @@
-4.1.20
+4.1.24