* Re: [PATCH] HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
From: Benjamin Tissoires @ 2025-12-19 13:06 UTC (permalink / raw)
To: Benjamin Tissoires, DaytonCL; +Cc: jikos, linux-input, linux-kernel
In-Reply-To: <20251214133648.307106-2-artem749507@gmail.com>
On Sun, 14 Dec 2025 14:34:36 +0100, DaytonCL wrote:
> Some VTL-class touchpads (e.g. TOPS0102:00 35CC:0104) intermittently
> fail to release a finger contact. A previous slot remains logically
> active, accompanied by stale BTN_TOOL_DOUBLETAP state, causing
> gestures to stay latched and resulting in stuck two-finger
> scrolling and false right-clicks.
>
> Apply MT_QUIRK_STICKY_FINGERS to handle the unreleased contact correctly.
>
> [...]
Applied to hid/hid.git (for-6.19/upstream-fixes), thanks!
[1/1] HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
https://git.kernel.org/hid/hid/c/ff3f234ff1dc
Cheers,
--
Benjamin Tissoires <bentiss@kernel.org>
^ permalink raw reply
* Re: [PATCH] HID: intel-ish-hid: Reset enum_devices_done before enumeration
From: Benjamin Tissoires @ 2025-12-19 13:06 UTC (permalink / raw)
To: linux-input, srinivas.pandruvada, jikos, Benjamin Tissoires,
Zhang Lixu
Cc: selina.wang, wenji1.yang, chee.yau.chan
In-Reply-To: <20251212025150.1390294-1-lixu.zhang@intel.com>
On Fri, 12 Dec 2025 10:51:50 +0800, Zhang Lixu wrote:
> Some systems have enabled ISH without any sensors. In this case sending
> HOSTIF_DM_ENUM_DEVICES results in 0 sensors. This triggers ISH hardware
> reset on subsequent enumeration after S3/S4 resume.
>
> The enum_devices_done flag was not reset before sending the
> HOSTIF_DM_ENUM_DEVICES command. On subsequent enumeration calls (such as
> after S3/S4 resume), this flag retains its previous true value, causing the
> wait loop to be skipped and returning prematurely to hid_ishtp_cl_init().
> If 0 HID devices are found, hid_ishtp_cl_init() skips getting HID device
> descriptors and sets init_done to true. When the delayed enumeration
> response arrives with init_done already true, the driver treats it as a bad
> packet and triggers an ISH hardware reset.
>
> [...]
Applied to hid/hid.git (for-6.19/upstream-fixes), thanks!
[1/1] HID: intel-ish-hid: Reset enum_devices_done before enumeration
https://git.kernel.org/hid/hid/c/56e230723e3a
Cheers,
--
Benjamin Tissoires <bentiss@kernel.org>
^ permalink raw reply
* Re: [PATCH] HID: intel-ish-hid: Update ishtp bus match to support device ID table
From: Benjamin Tissoires @ 2025-12-19 13:06 UTC (permalink / raw)
To: linux-input, srinivas.pandruvada, jikos, Benjamin Tissoires,
Zhang Lixu
In-Reply-To: <20251210025328.638436-1-lixu.zhang@intel.com>
On Wed, 10 Dec 2025 10:53:28 +0800, Zhang Lixu wrote:
> The ishtp_cl_bus_match() function previously only checked the first entry
> in the driver's device ID table. Update it to iterate over the entire
> table, allowing proper matching for drivers with multiple supported
> protocol GUIDs.
>
>
Applied to hid/hid.git (for-6.19/upstream-fixes), thanks!
[1/1] HID: intel-ish-hid: Update ishtp bus match to support device ID table
https://git.kernel.org/hid/hid/c/daeed86b6868
Cheers,
--
Benjamin Tissoires <bentiss@kernel.org>
^ permalink raw reply
* Re: [PATCH] HID: Intel-thc-hid: Intel-thc: fix dma_unmap_sg() nents value
From: Benjamin Tissoires @ 2025-12-19 13:05 UTC (permalink / raw)
To: Thomas Fourier
Cc: Even Xu, Xinpeng Sun, Jiri Kosina, Andy Shevchenko, Mark Pearson,
Srinivas Pandruvada, linux-input, linux-kernel
In-Reply-To: <20251203165651.69215-2-fourier.thomas@gmail.com>
On Wed, 03 Dec 2025 17:56:35 +0100, Thomas Fourier wrote:
> The `dma_unmap_sg()` functions should be called with the same nents as the
> `dma_map_sg()`, not the value the map function returned.
>
> Save the number of entries in struct thc_dma_configuration.
>
>
Applied to hid/hid.git (for-6.19/upstream-fixes), thanks!
[1/1] HID: Intel-thc-hid: Intel-thc: fix dma_unmap_sg() nents value
https://git.kernel.org/hid/hid/c/0e13150c1a13
Cheers,
--
Benjamin Tissoires <bentiss@kernel.org>
^ permalink raw reply
* Re: [PATCH v2] HID: playstation: Center initial joystick axes to prevent spurious events
From: Benjamin Tissoires @ 2025-12-19 13:05 UTC (permalink / raw)
To: Jiri Kosina, Roderick Colenbrander, linux-input, linux-kernel,
Siarhei Vishniakou
In-Reply-To: <20251111234519.369652-1-svv@google.com>
On Tue, 11 Nov 2025 15:45:19 -0800, Siarhei Vishniakou wrote:
> When a new PlayStation gamepad (DualShock 4 or DualSense) is initialized,
> the input subsystem sets the default value for its absolute axes (e.g.,
> ABS_X, ABS_Y) to 0.
>
> However, the hardware's actual neutral/resting state for these joysticks
> is 128 (0x80). This creates a mismatch.
>
> [...]
Applied to hid/hid.git (for-6.19/upstream-fixes), thanks!
[1/1] HID: playstation: Center initial joystick axes to prevent spurious events
https://git.kernel.org/hid/hid/c/e9143268d259
Cheers,
--
Benjamin Tissoires <bentiss@kernel.org>
^ permalink raw reply
* Re: [PATCH] Input: xpad - Add support for CRKD Guitars
From: Dmitry Torokhov @ 2025-12-19 5:51 UTC (permalink / raw)
To: Sanjay Govind
Cc: Vicki Pfau, Pavel Rojtberg, Nilton Perim Neto,
Antheas Kapenekakis, Pierre-Loup A. Griffais, Mario Limonciello,
winston.tan, linux-input, linux-kernel
In-Reply-To: <20251129073720.2750-2-sanjay.govind9@gmail.com>
On Sat, Nov 29, 2025 at 08:37:11PM +1300, Sanjay Govind wrote:
> This commit adds support for various CRKD Guitar Controllers
>
> Signed-off-by: Sanjay Govind <sanjay.govind9@gmail.com>
Applied, thank you.
--
Dmitry
^ permalink raw reply
* Re: [PATCH v4 2/8] Input: ilitek_ts_i2c: fix warning with gpio controllers that sleep
From: Dmitry Torokhov @ 2025-12-19 5:47 UTC (permalink / raw)
To: Josua Mayer
Cc: Rob Herring, Krzysztof Kozlowski, Conor Dooley, Shawn Guo,
Sascha Hauer, Pengutronix Kernel Team, Fabio Estevam,
Jon Nettleton, Mikhail Anikin, Yazan Shhady, devicetree,
linux-kernel, linux-input, imx, linux-arm-kernel
In-Reply-To: <20251201-imx8mp-hb-iiot-v4-2-53a4cd6c21bf@solid-run.com>
On Mon, Dec 01, 2025 at 02:07:21PM +0100, Josua Mayer wrote:
> The ilitek touchscreen driver uses the non-sleeping gpiod_set_value
> function for reset.
>
> Switch to using gpiod_set_value_cansleep() when controlling reset_gpio to
> support GPIO providers that may sleep, such as I2C GPIO expanders.
>
> Further switch the mdelay calls on the reset path to fsleep (preferred
> in non-atomic contexts).
>
> This fixes noisy complaints in kernel log for gpio providers that do
> sleep.
>
> Signed-off-by: Josua Mayer <josua@solid-run.com>
Applied, thank you.
--
Dmitry
^ permalink raw reply
* Re: [PATCH] HID: intel-ish-hid: loader: Add PRODUCT_FAMILY-based firmware matching
From: Vishnu Sankar @ 2025-12-19 5:39 UTC (permalink / raw)
To: Zhang, Lixu
Cc: srinivas pandruvada, jikos@kernel.org, bentiss@kernel.org,
Sankar, Vishnu, Xu, Even, linux-input@vger.kernel.org,
linux-kernel@vger.kernel.org, Mark Pearson, Richie Roy Jayme
In-Reply-To: <SJ0PR11MB5613BDF3C10AE8093404639A93A9A@SJ0PR11MB5613.namprd11.prod.outlook.com>
Hi Lixu,
Thank you for the comments.
On Fri, Dec 19, 2025 at 10:26 AM Zhang, Lixu <lixu.zhang@intel.com> wrote:
>
> >-----Original Message-----
> >From: srinivas pandruvada <srinivas.pandruvada@linux.intel.com>
> >Sent: Thursday, December 18, 2025 11:55 PM
> >To: Vishnu Sankar <vishnuocv@gmail.com>; jikos@kernel.org;
> >bentiss@kernel.org; Sankar, Vishnu <vsankar@lenovo.com>; Zhang, Lixu
> ><lixu.zhang@intel.com>; Xu, Even <even.xu@intel.com>
> >Cc: linux-input@vger.kernel.org; linux-kernel@vger.kernel.org; Mark Pearson
> ><mpearson-lenovo@squebb.ca>; Richie Roy Jayme <rjayme.jp@gmail.com>
> >Subject: Re: [PATCH] HID: intel-ish-hid: loader: Add PRODUCT_FAMILY-based
> >firmware matching
> >
> >+ Lixu
> >+ Even
> >
> >
> >On Thu, 2025-12-18 at 23:00 +0900, Vishnu Sankar wrote:
> >> Add support for firmware filenames that include the CRC32 checksum of
> >> the DMI product_family field. Several OEMs ship ISH firmware variants
> >> shared across a product family while product_name or product_sku may
> >> differ.
> >> This
> >> intermediate matching granularity reduces duplication and improves
> >> firmware selection for vendor-customized platforms.
>
> ...
>
> >> +
> >> + if (sys_vendor && product_family) {
> >> + snprintf(filename, sizeof(filename),
> >> + ISH_FW_FILE_VENDOR_FAMILY_FMT,
> >> + gen, vendor_crc, family_crc);
> >> + ret = _request_ish_firmware(firmware_p, filename,
> >> dev);
> >> + if (!ret)
> >> + return 0;
> >> +}
> Indent issue.
>
> Hi Vishnu,
> Thanks for your patch.
> 1. Please run the ` ./scripts/checkpatch.pl --strict --codespell [PATCH FILE]`, and fix the issue.
Acked
> 2. Could you please also update the document `Documentation/hid/intel-ish-hid.rst`?
Will update the document in v2.
>
> Thanks,
> Lixu
>
> >>
> >> if (sys_vendor && product_name && product_sku) {
> >> snprintf(filename, sizeof(filename),
> >> ISH_FW_FILE_VENDOR_NAME_SKU_FMT, gen,
--
Regards,
Vishnu Sankar
+817015150407 (Japan)
^ permalink raw reply
* Re: [PATCH v8 1/2] Input: add ABS_SND_PROFILE
From: Dmitry Torokhov @ 2025-12-19 5:35 UTC (permalink / raw)
To: david
Cc: Jonathan Corbet, Jiri Kosina, Benjamin Tissoires, Bjorn Andersson,
Konrad Dybcio, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Casey Connolly, Guido Günther, linux-input, linux-doc,
linux-kernel, linux-arm-msm, devicetree, phone-devel,
Gergo Koteles
In-Reply-To: <20251113-op6-tri-state-v8-1-54073f3874bc@ixit.cz>
On Thu, Nov 13, 2025 at 05:02:58PM +0100, David Heidelberg via B4 Relay wrote:
> From: Gergo Koteles <soyer@irl.hu>
>
> ABS_SND_PROFILE used to describe the state of a multi-value sound profile
> switch. This will be used for the alert-slider on OnePlus phones or other
> phones.
>
> Profile values added as SND_PROFLE_(SILENT|VIBRATE|RING) identifiers
> to input-event-codes.h so they can be used from DTS.
>
> Signed-off-by: Gergo Koteles <soyer@irl.hu>
> Reviewed-by: Bjorn Andersson <andersson@kernel.org>
> Tested-by: Guido Günther <agx@sigxcpu.org> # oneplus,fajita & oneplus,enchilada
> Reviewed-by: Guido Günther <agx@sigxcpu.org>
> Signed-off-by: David Heidelberg <david@ixit.cz>
Applied, thank you.
--
Dmitry
^ permalink raw reply
* Re: [PATCH v4 2/3] Input: twl4030 - add TWL603x power button
From: Dmitry Torokhov @ 2025-12-19 5:23 UTC (permalink / raw)
Cc: Lee Jones, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Andreas Kemnade, Tony Lindgren, Kevin Hilman, devicetree,
linux-kernel, linux-input, linux-omap
In-Reply-To: <20251106-twl6030-button-v4-2-fdf1aa6e1e9a@kernel.org>
On Thu, Nov 06, 2025 at 10:00:26AM +0100, akemnade@kernel.org wrote:
> From: Andreas Kemnade <andreas@kemnade.info>
>
> Like the TWL4030, these PMICs also have a power button feature, so extend
> the TWL4030 power button driver. As the irqchip of the TWL6030 mfd driver
> does not provide mask, unmask finctions, do it manually.
>
> Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Applied, thank you.
--
Dmitry
^ permalink raw reply
* Re: [PATCH] Input: xpad - add support for the ZD O+ Excellence controller
From: Dmitry Torokhov @ 2025-12-19 5:08 UTC (permalink / raw)
To: Philippos Boon Alexaki; +Cc: linux-input, linux-kernel
In-Reply-To: <aQPtBpx6bQMCw1tF@htpc>
Hi Philippos,
On Thu, Oct 30, 2025 at 11:56:06PM +0100, Philippos Boon Alexaki wrote:
> Adds support for the ZD O+ Excellence controller.
> Tested with a wired connection.
>
> Signed-off-by: Philippos Boon Alexaki <palexaki@xs4all.nl>
> ---
> drivers/input/joystick/xpad.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
> index 4c94297e17e6..3805780d5be3 100644
> --- a/drivers/input/joystick/xpad.c
> +++ b/drivers/input/joystick/xpad.c
> @@ -296,6 +296,7 @@ static const struct xpad_device {
> { 0x10f5, 0x7005, "Turtle Beach Recon Controller", 0, XTYPE_XBOXONE },
> { 0x10f5, 0x7008, "Turtle Beach Recon Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
> { 0x10f5, 0x7073, "Turtle Beach Stealth Ultra Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
> + { 0x11c0, 0x5505, "ZD O+ Excellence", 0, XTYPE_XBOX360 },
> { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
> { 0x11ff, 0x0511, "PXN V900", 0, XTYPE_XBOX360 },
> { 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 },
> @@ -541,6 +542,7 @@ static const struct usb_device_id xpad_table[] = {
> XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori controllers */
> XPAD_XBOX360_VENDOR(0x1038), /* SteelSeries controllers */
> XPAD_XBOXONE_VENDOR(0x10f5), /* Turtle Beach Controllers */
> + XPAD_XBOXONE_VENDOR(0x11c0), /* ZD O+ Excellence */
It is really weird that the matching is added for XboxOne but the type
is set for Xbox360...
> XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */
> XPAD_XBOX360_VENDOR(0x11ff), /* PXN V900 */
> XPAD_XBOX360_VENDOR(0x1209), /* Ardwiino Controllers */
Thanks.
--
Dmitry
^ permalink raw reply
* RE: [PATCH] HID: intel-ish-hid: loader: Add PRODUCT_FAMILY-based firmware matching
From: Zhang, Lixu @ 2025-12-19 1:26 UTC (permalink / raw)
To: srinivas pandruvada, Vishnu Sankar, jikos@kernel.org,
bentiss@kernel.org, Sankar, Vishnu, Xu, Even
Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org,
Mark Pearson, Richie Roy Jayme
In-Reply-To: <950d627dc280af94a1073da7938a6f2a09e31e34.camel@linux.intel.com>
>-----Original Message-----
>From: srinivas pandruvada <srinivas.pandruvada@linux.intel.com>
>Sent: Thursday, December 18, 2025 11:55 PM
>To: Vishnu Sankar <vishnuocv@gmail.com>; jikos@kernel.org;
>bentiss@kernel.org; Sankar, Vishnu <vsankar@lenovo.com>; Zhang, Lixu
><lixu.zhang@intel.com>; Xu, Even <even.xu@intel.com>
>Cc: linux-input@vger.kernel.org; linux-kernel@vger.kernel.org; Mark Pearson
><mpearson-lenovo@squebb.ca>; Richie Roy Jayme <rjayme.jp@gmail.com>
>Subject: Re: [PATCH] HID: intel-ish-hid: loader: Add PRODUCT_FAMILY-based
>firmware matching
>
>+ Lixu
>+ Even
>
>
>On Thu, 2025-12-18 at 23:00 +0900, Vishnu Sankar wrote:
>> Add support for firmware filenames that include the CRC32 checksum of
>> the DMI product_family field. Several OEMs ship ISH firmware variants
>> shared across a product family while product_name or product_sku may
>> differ.
>> This
>> intermediate matching granularity reduces duplication and improves
>> firmware selection for vendor-customized platforms.
...
>> +
>> + if (sys_vendor && product_family) {
>> + snprintf(filename, sizeof(filename),
>> + ISH_FW_FILE_VENDOR_FAMILY_FMT,
>> + gen, vendor_crc, family_crc);
>> + ret = _request_ish_firmware(firmware_p, filename,
>> dev);
>> + if (!ret)
>> + return 0;
>> +}
Indent issue.
Hi Vishnu,
Thanks for your patch.
1. Please run the ` ./scripts/checkpatch.pl --strict --codespell [PATCH FILE]`, and fix the issue.
2. Could you please also update the document `Documentation/hid/intel-ish-hid.rst`?
Thanks,
Lixu
>>
>> if (sys_vendor && product_name && product_sku) {
>> snprintf(filename, sizeof(filename),
>> ISH_FW_FILE_VENDOR_NAME_SKU_FMT, gen,
^ permalink raw reply
* [PATCH] HID: Intel-thc-hid: Intel-thc: Fix wrong register reading
From: Even Xu @ 2025-12-19 1:14 UTC (permalink / raw)
To: jikos, bentiss; +Cc: srinivas.pandruvada, linux-input, linux-kernel, Even Xu
Correct the read register for the setting of max input size and
interrupt delay.
Fixes: 22da60f0304b ("HID: Intel-thc-hid: Intel-thc: Introduce interrupt delay control")
Fixes: 45e92a093099 ("HID: Intel-thc-hid: Intel-thc: Introduce max input size control")
Signed-off-by: Even Xu <even.xu@intel.com>
---
drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c b/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c
index 636a68306501..7e220a4c5ded 100644
--- a/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c
+++ b/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c
@@ -1593,7 +1593,7 @@ int thc_i2c_set_rx_max_size(struct thc_device *dev, u32 max_rx_size)
if (!max_rx_size)
return -EOPNOTSUPP;
- ret = regmap_read(dev->thc_regmap, THC_M_PRT_SW_SEQ_STS_OFFSET, &val);
+ ret = regmap_read(dev->thc_regmap, THC_M_PRT_SPI_ICRRD_OPCODE_OFFSET, &val);
if (ret)
return ret;
@@ -1662,7 +1662,7 @@ int thc_i2c_set_rx_int_delay(struct thc_device *dev, u32 delay_us)
if (!delay_us)
return -EOPNOTSUPP;
- ret = regmap_read(dev->thc_regmap, THC_M_PRT_SW_SEQ_STS_OFFSET, &val);
+ ret = regmap_read(dev->thc_regmap, THC_M_PRT_SPI_ICRRD_OPCODE_OFFSET, &val);
if (ret)
return ret;
--
2.40.1
^ permalink raw reply related
* Re: [PATCH] Input: apple_z2: Fix reading incorrect reports after exiting sleep
From: Dmitry Torokhov @ 2025-12-18 22:19 UTC (permalink / raw)
To: fnkl.kernel
Cc: Sven Peter, Janne Grunau, Neal Gompa, asahi, linux-arm-kernel,
linux-input, linux-kernel, pitust
In-Reply-To: <20251218-z2-init-fix-v1-1-48e3aa239caf@gmail.com>
On Thu, Dec 18, 2025 at 09:11:26AM +0100, Sasha Finkelstein via B4 Relay wrote:
> From: Sasha Finkelstein <fnkl.kernel@gmail.com>
>
> Under certain conditions (more prevalent after a suspend/resume cycle),
> the touchscreen controller can send the "boot complete" interrupt before
> it actually finished booting. In those cases, attempting to read touch
> data resuls in a stream of "not ready" messages being read and
> interpreted as a touch report. Check that the response is in fact a
> touch report and discard it otherwise.
>
> Reported-by: pitust <piotr@stelmaszek.com>
> Closes: https://oftc.catirclogs.org/asahi/2025-12-17#34878715;
> Fixes: 471a92f8a21a ("Input: apple_z2 - add a driver for Apple Z2 touchscreens")
> Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com>
Applied, thank you.
--
Dmitry
^ permalink raw reply
* Re: [PATCH] HID: intel-ish-hid: loader: Add PRODUCT_FAMILY-based firmware matching
From: srinivas pandruvada @ 2025-12-18 15:54 UTC (permalink / raw)
To: Vishnu Sankar, jikos, bentiss, vsankar, Zhang, Lixu, Even Xu
Cc: linux-input, linux-kernel, Mark Pearson, Richie Roy Jayme
In-Reply-To: <20251218140003.636901-1-vishnuocv@gmail.com>
+ Lixu
+ Even
On Thu, 2025-12-18 at 23:00 +0900, Vishnu Sankar wrote:
> Add support for firmware filenames that include the CRC32 checksum of
> the
> DMI product_family field. Several OEMs ship ISH firmware variants
> shared
> across a product family while product_name or product_sku may differ.
> This
> intermediate matching granularity reduces duplication and improves
> firmware
> selection for vendor-customized platforms.
>
> The newly supported filename forms are checked before existing
> patterns:
>
> ish_${gen}_${vendor}_${family}_${name}_${sku}.bin
> ish_${gen}_${vendor}_${family}_${sku}.bin
> ish_${gen}_${vendor}_${family}_${name}.bin
> ish_${gen}_${vendor}_${family}.bin
>
> The legacy product_name/product_sku rules remain unchanged and
> continue
> to provide fallback matching.
>
> ISH_FW_FILENAME_LEN_MAX is changed to 72 to accommodate the
> product_family.
>
> Tested with X9 series and X1 series.
>
> Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
> Tested-by: Richie Roy Jayme <rjayme.jp@gmail.com>
> Signed-off-by: Vishnu Sankar <vishnuocv@gmail.com>
> ---
> drivers/hid/intel-ish-hid/ishtp/loader.c | 50
> +++++++++++++++++++++++-
> 1 file changed, 48 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/hid/intel-ish-hid/ishtp/loader.c
> b/drivers/hid/intel-ish-hid/ishtp/loader.c
> index f34086b29cf0..4559d460fd83 100644
> --- a/drivers/hid/intel-ish-hid/ishtp/loader.c
> +++ b/drivers/hid/intel-ish-hid/ishtp/loader.c
> @@ -194,6 +194,11 @@ static int prepare_dma_bufs(struct ishtp_device
> *dev,
>
> return 0;
> }
> +/* Patterns with PRODUCT_FAMILY */
> +#define ISH_FW_FILE_VENDOR_FAMILY_NAME_SKU_FMT
> "intel/ish/ish_%s_%08x_%08x_%08x_%08x.bin"
> +#define ISH_FW_FILE_VENDOR_FAMILY_SKU_FMT
> "intel/ish/ish_%s_%08x_%08x_%08x.bin"
> +#define ISH_FW_FILE_VENDOR_FAMILY_NAME_FMT
> "intel/ish/ish_%s_%08x_%08x_%08x.bin"
> +#define ISH_FW_FILE_VENDOR_FAMILY_FMT
> "intel/ish/ish_%s_%08x_%08x.bin"
>
> #define ISH_FW_FILE_VENDOR_NAME_SKU_FMT
> "intel/ish/ish_%s_%08x_%08x_%08x.bin"
> #define ISH_FW_FILE_VENDOR_SKU_FMT "intel/ish/ish_%s_%08x_%08x.bin"
> @@ -201,7 +206,7 @@ static int prepare_dma_bufs(struct ishtp_device
> *dev,
> #define ISH_FW_FILE_VENDOR_FMT "intel/ish/ish_%s_%08x.bin"
> #define ISH_FW_FILE_DEFAULT_FMT "intel/ish/ish_%s.bin"
>
> -#define ISH_FW_FILENAME_LEN_MAX 56
> +#define ISH_FW_FILENAME_LEN_MAX 72
>
> #define ISH_CRC_INIT (~0u)
> #define ISH_CRC_XOROUT (~0u)
> @@ -256,8 +261,9 @@ static int request_ish_firmware(const struct
> firmware **firmware_p,
> struct device *dev)
> {
> const char *gen, *sys_vendor, *product_name, *product_sku;
> + const char *product_family;
> struct ishtp_device *ishtp = dev_get_drvdata(dev);
> - u32 vendor_crc, name_crc, sku_crc;
> + u32 vendor_crc, name_crc, sku_crc, family_crc;
> char filename[ISH_FW_FILENAME_LEN_MAX];
> int ret;
>
> @@ -265,6 +271,7 @@ static int request_ish_firmware(const struct
> firmware **firmware_p,
> sys_vendor = dmi_get_system_info(DMI_SYS_VENDOR);
> product_name = dmi_get_system_info(DMI_PRODUCT_NAME);
> product_sku = dmi_get_system_info(DMI_PRODUCT_SKU);
> + product_family = dmi_get_system_info(DMI_PRODUCT_FAMILY);
>
> if (sys_vendor)
> vendor_crc = crc32(ISH_CRC_INIT, sys_vendor,
> strlen(sys_vendor)) ^ ISH_CRC_XOROUT;
> @@ -272,6 +279,45 @@ static int request_ish_firmware(const struct
> firmware **firmware_p,
> name_crc = crc32(ISH_CRC_INIT, product_name,
> strlen(product_name)) ^ ISH_CRC_XOROUT;
> if (product_sku)
> sku_crc = crc32(ISH_CRC_INIT, product_sku,
> strlen(product_sku)) ^ ISH_CRC_XOROUT;
> + if (product_family)
> + family_crc = crc32(ISH_CRC_INIT, product_family,
> strlen(product_family)) ^ ISH_CRC_XOROUT;
> +
> + /* PRODUCT_FAMILY-extended matching */
> + if (sys_vendor && product_family && product_name &&
> product_sku) {
> + snprintf(filename, sizeof(filename),
> + ISH_FW_FILE_VENDOR_FAMILY_NAME_SKU_FMT,
> + gen, vendor_crc, family_crc, name_crc,
> sku_crc);
> + ret = _request_ish_firmware(firmware_p, filename,
> dev);
> + if (!ret)
> + return 0;
> + }
> +
> + if (sys_vendor && product_family && product_sku) {
> + snprintf(filename, sizeof(filename),
> + ISH_FW_FILE_VENDOR_FAMILY_SKU_FMT,
> + gen, vendor_crc, family_crc, sku_crc);
> + ret = _request_ish_firmware(firmware_p, filename,
> dev);
> + if (!ret)
> + return 0;
> + }
> +
> + if (sys_vendor && product_family && product_name) {
> + snprintf(filename, sizeof(filename),
> + ISH_FW_FILE_VENDOR_FAMILY_NAME_FMT,
> + gen, vendor_crc, family_crc, name_crc);
> + ret = _request_ish_firmware(firmware_p, filename,
> dev);
> + if (!ret)
> + return 0;
> + }
> +
> + if (sys_vendor && product_family) {
> + snprintf(filename, sizeof(filename),
> + ISH_FW_FILE_VENDOR_FAMILY_FMT,
> + gen, vendor_crc, family_crc);
> + ret = _request_ish_firmware(firmware_p, filename,
> dev);
> + if (!ret)
> + return 0;
> +}
>
> if (sys_vendor && product_name && product_sku) {
> snprintf(filename, sizeof(filename),
> ISH_FW_FILE_VENDOR_NAME_SKU_FMT, gen,
^ permalink raw reply
* Re: [PATCH v2 RESEND 2/2] Input: psmouse - Replace flush_workqueue() with disable_delayed_work_sync()
From: duoming @ 2025-12-18 14:25 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: linux-input, linux-kernel, pali, kuba, alexander.deucher, akpm,
johannes.berg, pkshih, hverkuil+cisco, andriy.shevchenko, tglx,
mingo
In-Reply-To: <ho33u6epmzsojiw5zvqksskpzo3f6z2lykvhgektf65stqj6sr@5hq6qd76ezxg>
On Wed, 17 Dec 2025 22:58:33 -0800 Dmitry Torokhov wrote:
> > > > The original code uses flush_workqueue() in psmouse_disconnect() to
> > > > ensure the completion of both resync_work and dev3_register_work.
> > > > Given that alps_disconnect() already uses disable_delayed_work_sync()
> > > > to cancel dev3_register_work, replacing flush_workqueue() with
> > > > disable_delayed_work_sync(&psmouse->resync_work) is more robust
> > > > and efficient.
> > > >
> > > > Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
> > > > ---
> > > > Changes in v2:
> > > > - focus on the robustness and efficiency improvements of disable_delayed_work_sync(), not on the UAF aspect.
> > > >
> > > > drivers/input/mouse/psmouse-base.c | 2 +-
> > > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > > >
> > > > diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
> > > > index 77ea7da3b1c..eb41c553e80 100644
> > > > --- a/drivers/input/mouse/psmouse-base.c
> > > > +++ b/drivers/input/mouse/psmouse-base.c
> > > > @@ -1484,7 +1484,7 @@ static void psmouse_disconnect(struct serio *serio)
> > > >
> > > > /* make sure we don't have a resync in progress */
> > > > mutex_unlock(&psmouse_mutex);
> > > > - flush_workqueue(kpsmoused_wq);
> > > > + disable_delayed_work_sync(&psmouse->resync_work);
> > >
> > > Before we replace flush_workqueue() with disable_delayed_work_sync() we
> > > need to also add disable_delayed_work_sync() to
> > > drivers/input/mouse/hgpk.c that also queues work to psmouse workqueue
> > > and relies on flushing it when disconnecting.
> >
> > The delayed work item recalib_wq could never be scheduled due to the
> > touchpad driver only supports mouse mode and the hgpk_init() function
> > remains disabled.
>
> What do you mean? If you enable OLPC support the option to enable hgpk
> protocol driver should become available, right?
The hgpk_init() function is never called by any other function in the
kernel and is therefore dead code. Since the delayed work item recalib_wq
is initialized within this function, it is consequently never scheduled
during runtime.
Best regards,
Duoming Zhou
^ permalink raw reply
* [PATCH] HID: intel-ish-hid: loader: Add PRODUCT_FAMILY-based firmware matching
From: Vishnu Sankar @ 2025-12-18 14:00 UTC (permalink / raw)
To: srinivas.pandruvada, jikos, bentiss, vsankar
Cc: linux-input, linux-kernel, Vishnu Sankar, Mark Pearson,
Richie Roy Jayme
Add support for firmware filenames that include the CRC32 checksum of the
DMI product_family field. Several OEMs ship ISH firmware variants shared
across a product family while product_name or product_sku may differ. This
intermediate matching granularity reduces duplication and improves firmware
selection for vendor-customized platforms.
The newly supported filename forms are checked before existing patterns:
ish_${gen}_${vendor}_${family}_${name}_${sku}.bin
ish_${gen}_${vendor}_${family}_${sku}.bin
ish_${gen}_${vendor}_${family}_${name}.bin
ish_${gen}_${vendor}_${family}.bin
The legacy product_name/product_sku rules remain unchanged and continue
to provide fallback matching.
ISH_FW_FILENAME_LEN_MAX is changed to 72 to accommodate the product_family.
Tested with X9 series and X1 series.
Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Tested-by: Richie Roy Jayme <rjayme.jp@gmail.com>
Signed-off-by: Vishnu Sankar <vishnuocv@gmail.com>
---
drivers/hid/intel-ish-hid/ishtp/loader.c | 50 +++++++++++++++++++++++-
1 file changed, 48 insertions(+), 2 deletions(-)
diff --git a/drivers/hid/intel-ish-hid/ishtp/loader.c b/drivers/hid/intel-ish-hid/ishtp/loader.c
index f34086b29cf0..4559d460fd83 100644
--- a/drivers/hid/intel-ish-hid/ishtp/loader.c
+++ b/drivers/hid/intel-ish-hid/ishtp/loader.c
@@ -194,6 +194,11 @@ static int prepare_dma_bufs(struct ishtp_device *dev,
return 0;
}
+/* Patterns with PRODUCT_FAMILY */
+#define ISH_FW_FILE_VENDOR_FAMILY_NAME_SKU_FMT "intel/ish/ish_%s_%08x_%08x_%08x_%08x.bin"
+#define ISH_FW_FILE_VENDOR_FAMILY_SKU_FMT "intel/ish/ish_%s_%08x_%08x_%08x.bin"
+#define ISH_FW_FILE_VENDOR_FAMILY_NAME_FMT "intel/ish/ish_%s_%08x_%08x_%08x.bin"
+#define ISH_FW_FILE_VENDOR_FAMILY_FMT "intel/ish/ish_%s_%08x_%08x.bin"
#define ISH_FW_FILE_VENDOR_NAME_SKU_FMT "intel/ish/ish_%s_%08x_%08x_%08x.bin"
#define ISH_FW_FILE_VENDOR_SKU_FMT "intel/ish/ish_%s_%08x_%08x.bin"
@@ -201,7 +206,7 @@ static int prepare_dma_bufs(struct ishtp_device *dev,
#define ISH_FW_FILE_VENDOR_FMT "intel/ish/ish_%s_%08x.bin"
#define ISH_FW_FILE_DEFAULT_FMT "intel/ish/ish_%s.bin"
-#define ISH_FW_FILENAME_LEN_MAX 56
+#define ISH_FW_FILENAME_LEN_MAX 72
#define ISH_CRC_INIT (~0u)
#define ISH_CRC_XOROUT (~0u)
@@ -256,8 +261,9 @@ static int request_ish_firmware(const struct firmware **firmware_p,
struct device *dev)
{
const char *gen, *sys_vendor, *product_name, *product_sku;
+ const char *product_family;
struct ishtp_device *ishtp = dev_get_drvdata(dev);
- u32 vendor_crc, name_crc, sku_crc;
+ u32 vendor_crc, name_crc, sku_crc, family_crc;
char filename[ISH_FW_FILENAME_LEN_MAX];
int ret;
@@ -265,6 +271,7 @@ static int request_ish_firmware(const struct firmware **firmware_p,
sys_vendor = dmi_get_system_info(DMI_SYS_VENDOR);
product_name = dmi_get_system_info(DMI_PRODUCT_NAME);
product_sku = dmi_get_system_info(DMI_PRODUCT_SKU);
+ product_family = dmi_get_system_info(DMI_PRODUCT_FAMILY);
if (sys_vendor)
vendor_crc = crc32(ISH_CRC_INIT, sys_vendor, strlen(sys_vendor)) ^ ISH_CRC_XOROUT;
@@ -272,6 +279,45 @@ static int request_ish_firmware(const struct firmware **firmware_p,
name_crc = crc32(ISH_CRC_INIT, product_name, strlen(product_name)) ^ ISH_CRC_XOROUT;
if (product_sku)
sku_crc = crc32(ISH_CRC_INIT, product_sku, strlen(product_sku)) ^ ISH_CRC_XOROUT;
+ if (product_family)
+ family_crc = crc32(ISH_CRC_INIT, product_family, strlen(product_family)) ^ ISH_CRC_XOROUT;
+
+ /* PRODUCT_FAMILY-extended matching */
+ if (sys_vendor && product_family && product_name && product_sku) {
+ snprintf(filename, sizeof(filename),
+ ISH_FW_FILE_VENDOR_FAMILY_NAME_SKU_FMT,
+ gen, vendor_crc, family_crc, name_crc, sku_crc);
+ ret = _request_ish_firmware(firmware_p, filename, dev);
+ if (!ret)
+ return 0;
+ }
+
+ if (sys_vendor && product_family && product_sku) {
+ snprintf(filename, sizeof(filename),
+ ISH_FW_FILE_VENDOR_FAMILY_SKU_FMT,
+ gen, vendor_crc, family_crc, sku_crc);
+ ret = _request_ish_firmware(firmware_p, filename, dev);
+ if (!ret)
+ return 0;
+ }
+
+ if (sys_vendor && product_family && product_name) {
+ snprintf(filename, sizeof(filename),
+ ISH_FW_FILE_VENDOR_FAMILY_NAME_FMT,
+ gen, vendor_crc, family_crc, name_crc);
+ ret = _request_ish_firmware(firmware_p, filename, dev);
+ if (!ret)
+ return 0;
+ }
+
+ if (sys_vendor && product_family) {
+ snprintf(filename, sizeof(filename),
+ ISH_FW_FILE_VENDOR_FAMILY_FMT,
+ gen, vendor_crc, family_crc);
+ ret = _request_ish_firmware(firmware_p, filename, dev);
+ if (!ret)
+ return 0;
+}
if (sys_vendor && product_name && product_sku) {
snprintf(filename, sizeof(filename), ISH_FW_FILE_VENDOR_NAME_SKU_FMT, gen,
--
2.51.0
^ permalink raw reply related
* Re: [PATCH v2] Input: pixcir_i2c_ts - add support for one-time total calibration
From: Michal Vokáč @ 2025-12-18 10:22 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input, linux-kernel, Fabio Estevam
In-Reply-To: <20251119175113.39216-1-michal.vokac@ysoft.com>
Hi Dmitry,
gentle ping on this.
On 19. 11. 25 18:51, Michal Vokáč wrote:
> The Pixcir Tango controller has support for a one-time total calibration
> (manual calibration) procedure. Its purpose is to measure the capacitance
> offsets of the electrode system and to store these values into EEPROM.
>
> During normal operation this calibration data is subtracted from the values
> measured. This calibration should be necessary only once in the product
> lifetime. It should be performed as part of the final adjustment after
> the panel is mounted in the product.
>
> Add support for the calibration with sysfs interface.
>
> Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com>
> ---
> changes in v2:
> - Removed redundant lock from calibrate_store().
>
> drivers/input/touchscreen/pixcir_i2c_ts.c | 26 +++++++++++++++++++++++
> 1 file changed, 26 insertions(+)
>
> diff --git a/drivers/input/touchscreen/pixcir_i2c_ts.c b/drivers/input/touchscreen/pixcir_i2c_ts.c
> index dad5786e82a4..e52ec8d8e392 100644
> --- a/drivers/input/touchscreen/pixcir_i2c_ts.c
> +++ b/drivers/input/touchscreen/pixcir_i2c_ts.c
> @@ -24,6 +24,7 @@
> */
> #define PIXCIR_REG_POWER_MODE 51
> #define PIXCIR_REG_INT_MODE 52
> +#define PIXCIR_REG_SPECOP 58
>
> /*
> * Power modes:
> @@ -462,6 +463,30 @@ static int pixcir_i2c_ts_resume(struct device *dev)
> static DEFINE_SIMPLE_DEV_PM_OPS(pixcir_dev_pm_ops,
> pixcir_i2c_ts_suspend, pixcir_i2c_ts_resume);
>
> +static ssize_t calibrate_store(struct device *dev,
> + struct device_attribute *attr,
> + const char *buf, size_t count)
> +{
> + struct i2c_client *client = to_i2c_client(dev);
> + struct pixcir_i2c_ts_data *ts = i2c_get_clientdata(client);
> + static const u8 cmd = 0x03;
> + int error;
> +
> + error = i2c_smbus_write_byte_data(ts->client, PIXCIR_REG_SPECOP, cmd);
> + if (error)
> + dev_err(dev, "calibrate command failed: %d\n", error);
> +
> + return error ?: count;
> +}
> +
> +static DEVICE_ATTR_WO(calibrate);
> +
> +static struct attribute *pixcir_i2c_ts_attrs[] = {
> + &dev_attr_calibrate.attr,
> + NULL,
> +};
> +ATTRIBUTE_GROUPS(pixcir_i2c_ts);
> +
> static int pixcir_i2c_ts_probe(struct i2c_client *client)
> {
> const struct i2c_device_id *id = i2c_client_get_device_id(client);
> @@ -600,6 +625,7 @@ MODULE_DEVICE_TABLE(of, pixcir_of_match);
> static struct i2c_driver pixcir_i2c_ts_driver = {
> .driver = {
> .name = "pixcir_ts",
> + .dev_groups = pixcir_i2c_ts_groups,
> .pm = pm_sleep_ptr(&pixcir_dev_pm_ops),
> .of_match_table = of_match_ptr(pixcir_of_match),
> },
Best regards,
Michal
^ permalink raw reply
* [PATCH] Input: apple_z2: Fix reading incorrect reports after exiting sleep
From: Sasha Finkelstein via B4 Relay @ 2025-12-18 8:11 UTC (permalink / raw)
To: Sven Peter, Janne Grunau, Neal Gompa, Dmitry Torokhov
Cc: asahi, linux-arm-kernel, linux-input, linux-kernel, pitust,
Sasha Finkelstein
From: Sasha Finkelstein <fnkl.kernel@gmail.com>
Under certain conditions (more prevalent after a suspend/resume cycle),
the touchscreen controller can send the "boot complete" interrupt before
it actually finished booting. In those cases, attempting to read touch
data resuls in a stream of "not ready" messages being read and
interpreted as a touch report. Check that the response is in fact a
touch report and discard it otherwise.
Reported-by: pitust <piotr@stelmaszek.com>
Closes: https://oftc.catirclogs.org/asahi/2025-12-17#34878715;
Fixes: 471a92f8a21a ("Input: apple_z2 - add a driver for Apple Z2 touchscreens")
Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com>
---
drivers/input/touchscreen/apple_z2.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/input/touchscreen/apple_z2.c b/drivers/input/touchscreen/apple_z2.c
index 0de161eae59a..271ababf0ad5 100644
--- a/drivers/input/touchscreen/apple_z2.c
+++ b/drivers/input/touchscreen/apple_z2.c
@@ -21,6 +21,7 @@
#define APPLE_Z2_TOUCH_STARTED 3
#define APPLE_Z2_TOUCH_MOVED 4
#define APPLE_Z2_CMD_READ_INTERRUPT_DATA 0xEB
+#define APPLE_Z2_REPLY_INTERRUPT_DATA 0xE1
#define APPLE_Z2_HBPP_CMD_BLOB 0x3001
#define APPLE_Z2_FW_MAGIC 0x5746325A
#define LOAD_COMMAND_INIT_PAYLOAD 0
@@ -142,6 +143,9 @@ static int apple_z2_read_packet(struct apple_z2 *z2)
if (error)
return error;
+ if (z2->rx_buf[0] != APPLE_Z2_REPLY_INTERRUPT_DATA)
+ return 0;
+
pkt_len = (get_unaligned_le16(z2->rx_buf + 1) + 8) & 0xfffffffc;
error = spi_read(z2->spidev, z2->rx_buf, pkt_len);
---
base-commit: ea1013c1539270e372fc99854bc6e4d94eaeff66
change-id: 20251217-z2-init-fix-3b14ef4c6890
Best regards,
--
Sasha Finkelstein <fnkl.kernel@gmail.com>
^ permalink raw reply related
* Re: [PATCH v2 RESEND 2/2] Input: psmouse - Replace flush_workqueue() with disable_delayed_work_sync()
From: Dmitry Torokhov @ 2025-12-18 6:58 UTC (permalink / raw)
To: duoming
Cc: linux-input, linux-kernel, pali, kuba, alexander.deucher, akpm,
johannes.berg, pkshih, hverkuil+cisco, andriy.shevchenko, tglx,
mingo
In-Reply-To: <2e74b4a1.464cb.19b30013387.Coremail.duoming@zju.edu.cn>
On Thu, Dec 18, 2025 at 01:49:03PM +0800, duoming@zju.edu.cn wrote:
> On Wed, 17 Dec 2025 10:13:16 -0800 Dmitry Torokhov wrote:
> > > The original code uses flush_workqueue() in psmouse_disconnect() to
> > > ensure the completion of both resync_work and dev3_register_work.
> > > Given that alps_disconnect() already uses disable_delayed_work_sync()
> > > to cancel dev3_register_work, replacing flush_workqueue() with
> > > disable_delayed_work_sync(&psmouse->resync_work) is more robust
> > > and efficient.
> > >
> > > Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
> > > ---
> > > Changes in v2:
> > > - focus on the robustness and efficiency improvements of disable_delayed_work_sync(), not on the UAF aspect.
> > >
> > > drivers/input/mouse/psmouse-base.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
> > > index 77ea7da3b1c..eb41c553e80 100644
> > > --- a/drivers/input/mouse/psmouse-base.c
> > > +++ b/drivers/input/mouse/psmouse-base.c
> > > @@ -1484,7 +1484,7 @@ static void psmouse_disconnect(struct serio *serio)
> > >
> > > /* make sure we don't have a resync in progress */
> > > mutex_unlock(&psmouse_mutex);
> > > - flush_workqueue(kpsmoused_wq);
> > > + disable_delayed_work_sync(&psmouse->resync_work);
> >
> > Before we replace flush_workqueue() with disable_delayed_work_sync() we
> > need to also add disable_delayed_work_sync() to
> > drivers/input/mouse/hgpk.c that also queues work to psmouse workqueue
> > and relies on flushing it when disconnecting.
>
> The delayed work item recalib_wq could never be scheduled due to the
> touchpad driver only supports mouse mode and the hgpk_init() function
> remains disabled.
What do you mean? If you enable OLPC support the option to enable hgpk
protocol driver should become available, right?
Thanks.
--
Dmitry
^ permalink raw reply
* Re: [PATCH v2 RESEND 2/2] Input: psmouse - Replace flush_workqueue() with disable_delayed_work_sync()
From: duoming @ 2025-12-18 5:49 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: linux-input, linux-kernel, pali, kuba, alexander.deucher, akpm,
johannes.berg, pkshih, hverkuil+cisco, andriy.shevchenko, tglx,
mingo
In-Reply-To: <joqpa647tq7mh3lyl27zjv3wr4xbixuuvq7ifti3isifz3gfxg@p3ibbvrsuxud>
On Wed, 17 Dec 2025 10:13:16 -0800 Dmitry Torokhov wrote:
> > The original code uses flush_workqueue() in psmouse_disconnect() to
> > ensure the completion of both resync_work and dev3_register_work.
> > Given that alps_disconnect() already uses disable_delayed_work_sync()
> > to cancel dev3_register_work, replacing flush_workqueue() with
> > disable_delayed_work_sync(&psmouse->resync_work) is more robust
> > and efficient.
> >
> > Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
> > ---
> > Changes in v2:
> > - focus on the robustness and efficiency improvements of disable_delayed_work_sync(), not on the UAF aspect.
> >
> > drivers/input/mouse/psmouse-base.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
> > index 77ea7da3b1c..eb41c553e80 100644
> > --- a/drivers/input/mouse/psmouse-base.c
> > +++ b/drivers/input/mouse/psmouse-base.c
> > @@ -1484,7 +1484,7 @@ static void psmouse_disconnect(struct serio *serio)
> >
> > /* make sure we don't have a resync in progress */
> > mutex_unlock(&psmouse_mutex);
> > - flush_workqueue(kpsmoused_wq);
> > + disable_delayed_work_sync(&psmouse->resync_work);
>
> Before we replace flush_workqueue() with disable_delayed_work_sync() we
> need to also add disable_delayed_work_sync() to
> drivers/input/mouse/hgpk.c that also queues work to psmouse workqueue
> and relies on flushing it when disconnecting.
The delayed work item recalib_wq could never be scheduled due to the
touchpad driver only supports mouse mode and the hgpk_init() function
remains disabled.
Best regards,
Duoming Zhou
^ permalink raw reply
* Re: [PATCH] dt-bindings: input: touchscreen: sitronix,st1232: Add Sitronix ST1624
From: Dmitry Torokhov @ 2025-12-17 18:14 UTC (permalink / raw)
To: Krzysztof Kozlowski
Cc: Rob Herring (Arm), Krzysztof Kozlowski, Conor Dooley,
Bastian Hecht, linux-input, devicetree, linux-kernel
In-Reply-To: <20251217-intelligent-herring-of-defiance-3753db@quoll>
On Wed, Dec 17, 2025 at 09:40:43AM +0100, Krzysztof Kozlowski wrote:
> On Mon, Dec 15, 2025 at 03:25:24PM -0600, Rob Herring (Arm) wrote:
> > Add the Sitronix ST1624 which is compatible with ST1633.
> >
> > Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
> > ---
> > .../bindings/input/touchscreen/sitronix,st1232.yaml | 10 +++++++---
> > 1 file changed, 7 insertions(+), 3 deletions(-)
>
> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Sorry Krzysztof, I already applied Rob's patch but neglected to mention
this on the list...
--
Dmitry
^ permalink raw reply
* Re: [PATCH v2 RESEND 2/2] Input: psmouse - Replace flush_workqueue() with disable_delayed_work_sync()
From: Dmitry Torokhov @ 2025-12-17 18:13 UTC (permalink / raw)
To: Duoming Zhou
Cc: linux-input, linux-kernel, pali, kuba, alexander.deucher, akpm,
johannes.berg, pkshih, hverkuil+cisco, andriy.shevchenko, tglx,
mingo
In-Reply-To: <6e40a46e5d9e6e3237702958b8f641263c28d2e4.1765939397.git.duoming@zju.edu.cn>
On Wed, Dec 17, 2025 at 11:00:18AM +0800, Duoming Zhou wrote:
> The original code uses flush_workqueue() in psmouse_disconnect() to
> ensure the completion of both resync_work and dev3_register_work.
> Given that alps_disconnect() already uses disable_delayed_work_sync()
> to cancel dev3_register_work, replacing flush_workqueue() with
> disable_delayed_work_sync(&psmouse->resync_work) is more robust
> and efficient.
>
> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
> ---
> Changes in v2:
> - focus on the robustness and efficiency improvements of disable_delayed_work_sync(), not on the UAF aspect.
>
> drivers/input/mouse/psmouse-base.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
> index 77ea7da3b1c..eb41c553e80 100644
> --- a/drivers/input/mouse/psmouse-base.c
> +++ b/drivers/input/mouse/psmouse-base.c
> @@ -1484,7 +1484,7 @@ static void psmouse_disconnect(struct serio *serio)
>
> /* make sure we don't have a resync in progress */
> mutex_unlock(&psmouse_mutex);
> - flush_workqueue(kpsmoused_wq);
> + disable_delayed_work_sync(&psmouse->resync_work);
Before we replace flush_workqueue() with disable_delayed_work_sync() we
need to also add disable_delayed_work_sync() to
drivers/input/mouse/hgpk.c that also queues work to psmouse workqueue
and relies on flushing it when disconnecting.
Thanks.
--
Dmitry
^ permalink raw reply
* Re: [PATCH v2 RESEND 1/2] Input: alps - fix use-after-free bugs caused by dev3_register_work
From: Dmitry Torokhov @ 2025-12-17 18:08 UTC (permalink / raw)
To: Duoming Zhou
Cc: linux-input, linux-kernel, pali, kuba, alexander.deucher, akpm,
johannes.berg, pkshih, hverkuil+cisco, andriy.shevchenko, tglx,
mingo, stable
In-Reply-To: <b57b0a9ccca51a3f06be141bfc02b9ffe69d1845.1765939397.git.duoming@zju.edu.cn>
On Wed, Dec 17, 2025 at 11:00:17AM +0800, Duoming Zhou wrote:
> The dev3_register_work delayed work item is initialized within
> alps_reconnect() and scheduled upon receipt of the first bare
> PS/2 packet from an external PS/2 device connected to the ALPS
> touchpad. During device detachment, the original implementation
> calls flush_workqueue() in psmouse_disconnect() to ensure
> completion of dev3_register_work. However, the flush_workqueue()
> in psmouse_disconnect() only blocks and waits for work items that
> were already queued to the workqueue prior to its invocation. Any
> work items submitted after flush_workqueue() is called are not
> included in the set of tasks that the flush operation awaits.
> This means that after flush_workqueue() has finished executing,
> the dev3_register_work could still be scheduled. Although the
> psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(),
> the scheduling of dev3_register_work remains unaffected.
>
> The race condition can occur as follows:
>
> CPU 0 (cleanup path) | CPU 1 (delayed work)
> psmouse_disconnect() |
> psmouse_set_state() |
> flush_workqueue() | alps_report_bare_ps2_packet()
> alps_disconnect() | psmouse_queue_work()
> kfree(priv); // FREE | alps_register_bare_ps2_mouse()
> | priv = container_of(work...); // USE
> | priv->dev3 // USE
>
> Add disable_delayed_work_sync() in alps_disconnect() to ensure
> that dev3_register_work is properly canceled and prevented from
> executing after the alps_data structure has been deallocated.
>
> This bug is identified by static analysis.
>
> Fixes: 04aae283ba6a ("Input: ALPS - do not mix trackstick and external PS/2 mouse data")
> Cc: stable@kernel.org
> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Applied, thank you.
--
Dmitry
^ permalink raw reply
* Re: [PATCH v1 3/3] dt-bindings: google,cros-ec-keyb: add fn-key and f-keymap props
From: Dmitry Torokhov @ 2025-12-17 18:05 UTC (permalink / raw)
To: Fabio Baltieri
Cc: Rob Herring, Krzysztof Kozlowski, Conor Dooley, Benson Leung,
Guenter Roeck, Tzung-Bi Shih, Simon Glass, linux-input,
devicetree, chrome-platform, linux-kernel
In-Reply-To: <aUFPKni-iFkxQQGu@google.com>
Hi Fabio,
On Tue, Dec 16, 2025 at 12:23:06PM +0000, Fabio Baltieri wrote:
> Hi Dmitry,
>
> On Thu, Dec 11, 2025 at 08:44:02PM -0800, Dmitry Torokhov wrote:
> > On Wed, Dec 10, 2025 at 06:00:29PM +0000, Fabio Baltieri wrote:
> > > Hey Rob, thanks for the review.
> > >
> > > On Tue, Dec 09, 2025 at 01:22:43PM -0600, Rob Herring wrote:
> > > > On Tue, Dec 09, 2025 at 03:47:06PM +0000, Fabio Baltieri wrote:
> > > > > + fn-key:
> > > > > + $ref: /schemas/types.yaml#/definitions/uint32
> > > > > + description: |
> > > > > + An u32 containing the coordinate of the Fn key, use the MATRIX_KEY(row,
> > > > > + col, code) macro, code is ignored.
> > > > > +
> > > > > + fn-keymap:
> > > >
> > > > If keymap is linux,keymap, then this should perhaps be linux,fn-keymap.
> > > > Depends if we still think linux,keymap is Linux specific?
> > >
> > > I'm open for suggestions, trying to understand the pattern, these are
> > > specific to this binding I think if anything they should be
> > > google,fn-key and google,fn-keymap, similarly to the existing
> > > google,needs-ghost-filter -- no idea why function-row-physmap was not
> > > prefixed but I guess it slipped in and now it's not worth changing it.
> >
> > Just double the number of rows in the regular keymap to accommodate the
> > FN modifier, no need for separate keymap. Also no need to have fn-key
> > property, use whatever key that reports KEY_FN. See how it is done in
> > drivers/input/keyboard/tegra-kbc.c
>
> Had a look at the tegra-kbc driver as you suggested, first thing it
> seems like the fn-key functionality there is dead code since 2013,
> `use_fn_map` could only be enabled with platform data, not OF, and that
> has been removed in 3a495aeada2b, as it stands kbc->use_fn_map can only
> be false. I could send a patch to rip off that code if you want me to,
> clearly it hasn't been used in a while (unless I'm missing something).
I guess you are right, we shoudl clean that up. We have another newer
driver that uses the same approach:
drivers/input/keyboard/pinephone-keyboard.c
> About the extended fn map, I've two problems with it:
> - it seems very wasteful: the normal map is loaded in a linear array
> so it can be access directly, which make sense as that's typically
> very densely populated, but in the case of the fn keys that's going to
> be mostly empty, I'd expect ~20 keys top from a 18x8 matrix. So that
> would waste load of space, direct access is good but for ~20 keys I
> think it's fine to scan it, especially since it only happens when Fn
> is pressed.
I am not concerned with this, as this is a singleton device. You
probably "waste" as much space in the code segment by implementing the
custom scanning logic. Additionally with the consolidated keymap
approach you are not breaking ioctls dealing with setting and retrieving
key codes.
> - I'd end up with two values for cols kicking around the driver, the
> real one and the one used in the map, which I feel adds confusing in
> the code.
Not sure I follow. You still have the same row and col reported, just
when figuring out the final keycode you need to add an offset.
> - more importantly, one would have to keep the offset in mind when
> setting the keys in dt, we rely on OEM doing this and I think having a
Do we now? I thought we retain greater control over this. Maybe we
should sync internally.
> separate property with a meaningful name and a map with the same
> row,col and different code is more intuitive and would make their life
> easier, especially since we ship with keyboard of different size
> and the offset would be different depending on the device.
>
> As for the fn-key property, unfortunately based on past experience I'd
> expect such OEM to want to change that code, I could specify the code
> rather than the row,col but I would not plain hardcode. Even my
> (thinkpad) laptop sends KEY_WAKEUP for Fn.
Again, we need to make sure we control OEMs better. On Lenovo Fn sends
wakeup only if it is not combined with another key, so it really has
custom logic with events delivered either through the main AT keyboard
or through custom interface in thinkpad platform driver. We do not need
this in oiur designs.
Thanks.
--
Dmitry
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox