[PATCH v10 fixup 2/2] input: serio: asus-transformer-ec: fix keyboard response framing

[Florian Krischer]

Real SL101 hardware exposes two issues in the v10 keyboard response
handling.

First, keyboard command responses may carry OBF without KEY or KBC.
The downstream ASUS driver treats valid non-AUX OBF responses as
keyboard data. Dropping these packets prevents PS/2 ACK responses from
reaching atkbd.

Second, the EC count byte is the number of bytes following the count
byte, not the total packet size. For example, the SL101 returns the
keyboard reset response:

  03 09 fa aa

where 03 counts status 09, ACK fa and BAT-success aa.

v9 used data[0] - 1 after skipping the count and status bytes. v10
changed this to data[0] - 2 while tightening the packet bound, which
drops the final payload byte. Keep the v10 bound but restore the
correct payload count.

Tested on an ASUS Eee Pad Slider SL101 with EC firmware SL101-0202.
Together with the SL101 8-byte event-read fixup, the physical sliding
keyboard completes atkbd initialization and works.

Signed-off-by: Florian Krischer <florian.krischer@xxxxxxx>
---
 drivers/input/serio/asus-transformer-ec-kbc.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

--- a/drivers/input/serio/asus-transformer-ec-kbc.c
+++ b/drivers/input/serio/asus-transformer-ec-kbc.c
@@ -26,20 +26,26 @@
 		return NOTIFY_DONE;
 	else if (action & ASUSEC_AUX_MASK)
 		port_idx = 1;
-	else if (action & (ASUSEC_KBC_MASK | ASUSEC_KEY_MASK))
+	else if (action & ASUSEC_OBF_MASK)
+		/*
+		 * Keyboard command responses can carry only OBF, without KEY or
+		 * KBC set. The original SL101 driver treated every valid non-AUX,
+		 * non-SMI/SCI OBF packet as keyboard data, including PS/2 ACKs.
+		 */
 		port_idx = 0;
 	else
 		return NOTIFY_DONE;

 	/*
-	 * The data[0] is the length of the packet including itself. The data[]
-	 * buffer has to be at least 3 bytes (length + ctrl + 1 data byte) and
-	 * must not exceed the EC entry size.
+	 * data[0] is the number of bytes following the count byte: one status
+	 * byte plus the payload. The SL101 EC, for example, reports keyboard
+	 * reset as 03 09 fa aa (status 09, ACK fa, BAT aa). Skip the count and
+	 * status bytes and forward every payload byte to serio.
 	 */
 	if (data[0] < 2 || data[0] > ASUSEC_ENTRY_SIZE)
 		return NOTIFY_BAD;

-	n = data[0] - 2;
+	n = data[0] - 1;
 	data += 2;

 	if (port_idx == 0) {
--