Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   "Leo L. Schwab" <ewhac@ewhac.org>
To:     Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc:     ewhac@ewhac.org, linux-input@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: [PATCH] Input: spaceball - fix parsing of movement data packets
Date:   Mon, 26 Jul 2021 21:06:24 -0700
Message-Id: <20210727040625.2159196-1-ewhac@ewhac.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender:  "Leo L. Schwab" <ewhac@ewhac.org>
Precedence: bulk

The spaceball.c module was not properly parsing the movement reports
coming from the device.  The code read axis data as signed 16-bit
little-endian values starting at offset 2.

In fact, axis data in Spaceball movement reports are signed 16-bit
big-endian values starting at offset 3.  This was determined first by
visually inspecting the data packets, and later verified by consulting:
http://spacemice.org/pdf/SpaceBall_2003-3003_Protocol.pdf

If this ever worked properly, it was in the time before Git...

Signed-off-by: Leo L. Schwab <ewhac@ewhac.org>
---
 drivers/input/joystick/spaceball.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/input/joystick/spaceball.c b/drivers/input/joystick/spaceball.c
index 429411c6c0a8..43bfb3d2fa8a 100644
--- a/drivers/input/joystick/spaceball.c
+++ b/drivers/input/joystick/spaceball.c
@@ -74,10 +74,20 @@ static void spaceball_process_packet(struct spaceball* spaceball)
 	switch (spaceball->data[0]) {
 
 		case 'D':					/* Ball data */
+			/*
+			 * Skip first three bytes; read six axes worth of data.
+			 * Axis values are signed 16-bit big-endian.
+			 */
 			if (spaceball->idx != 15) return;
-			for (i = 0; i < 6; i++)
-				input_report_abs(dev, spaceball_axes[i],
-					(__s16)((data[2 * i + 3] << 8) | data[2 * i + 2]));
+			data += 3;
+			for (i = 0;
+			     i < ARRAY_SIZE(spaceball_axes);
+			     ++i, data += sizeof(__s16)) {
+				input_report_abs(
+					dev,
+					spaceball_axes[i],
+					(__s16)((data[0] << 8) | data[1]));
+			}
 			break;
 
 		case 'K':					/* Button data */
-- 
2.32.0