* Re: [PATCH v2 1/2] dt-bindings: input: Add PixArt PAJ7620 gesture sensor
From: Krzysztof Kozlowski @ 2026-04-17 9:34 UTC (permalink / raw)
To: Harpreet Saini
Cc: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
David Lechner, devicetree, linux-input, linux-kernel
In-Reply-To: <20260417052527.62535-2-sainiharpreet29@yahoo.com>
On Fri, Apr 17, 2026 at 01:25:26AM -0400, Harpreet Saini wrote:
> Signed-off-by: Harpreet Saini <sainiharpreet29@yahoo.com>
> ---
> .../bindings/input/pixart,paj7620.yaml | 70 +++++++++++++++++++
> .../devicetree/bindings/vendor-prefixes.yaml | 2 +
> 2 files changed, 72 insertions(+)
> create mode 100644 Documentation/devicetree/bindings/input/pixart,paj7620.yaml
>
Comments from v1 apply. Respond to the instead of ignoring.
> diff --git a/Documentation/devicetree/bindings/input/pixart,paj7620.yaml b/Documentation/devicetree/bindings/input/pixart,paj7620.yaml
> new file mode 100644
> index 000000000000..d4f58b712810
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/input/pixart,paj7620.yaml
> @@ -0,0 +1,70 @@
> +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +%YAML 1.2
> +---
> +$id: http://devicetree.org
> +$schema: http://devicetree.org
There is no such syntax. Don't invent own coding style.
Best regards,
Krzysztof
^ permalink raw reply
* [PATCH v4 6/6] mfd: motorola-cpcap: add support for Mot CPCAP composition
From: Svyatoslav Ryhel @ 2026-04-17 7:11 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Lee Jones, Pavel Machek, Svyatoslav Ryhel, David Lechner,
Tony Lindgren
Cc: linux-input, devicetree, linux-kernel, linux-leds
In-Reply-To: <20260417071106.21984-1-clamor95@gmail.com>
Add a MFD subdevice composition used in Tegra20 based Mot board
(Motorola Atrix 4G and Droid X2).
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
---
drivers/mfd/motorola-cpcap.c | 50 ++++++++++++++++++++++++++++++++++++
1 file changed, 50 insertions(+)
diff --git a/drivers/mfd/motorola-cpcap.c b/drivers/mfd/motorola-cpcap.c
index 516d1e33affa..fdec92f5c6b0 100644
--- a/drivers/mfd/motorola-cpcap.c
+++ b/drivers/mfd/motorola-cpcap.c
@@ -335,6 +335,54 @@ static const struct cpcap_chip_data cpcap_mapphone_data = {
.num_devices = ARRAY_SIZE(cpcap_mapphone_mfd_devices),
};
+/*
+ * The Mot board features a USB-PHY and charger similar to the ones in
+ * Mapphone; however, because Mot is based on Tegra20, it is incompatible
+ * with the existing implementation, which is tightly interconnected with
+ * the OMAP USB PHY.
+ */
+static const struct mfd_cell cpcap_mot_mfd_devices[] = {
+ {
+ .name = "cpcap_adc",
+ .of_compatible = "motorola,mot-cpcap-adc",
+ }, {
+ .name = "cpcap_battery",
+ .of_compatible = "motorola,cpcap-battery",
+ }, {
+ .name = "cpcap-regulator",
+ .of_compatible = "motorola,mot-cpcap-regulator",
+ }, {
+ .name = "cpcap-rtc",
+ .of_compatible = "motorola,cpcap-rtc",
+ }, {
+ .name = "cpcap-pwrbutton",
+ .of_compatible = "motorola,cpcap-pwrbutton",
+ }, {
+ .name = "cpcap-led",
+ .id = 0,
+ .of_compatible = "motorola,cpcap-led-red",
+ }, {
+ .name = "cpcap-led",
+ .id = 1,
+ .of_compatible = "motorola,cpcap-led-green",
+ }, {
+ .name = "cpcap-led",
+ .id = 2,
+ .of_compatible = "motorola,cpcap-led-blue",
+ }, {
+ .name = "cpcap-led",
+ .id = 3,
+ .of_compatible = "motorola,cpcap-led-adl",
+ }, {
+ .name = "cpcap-codec",
+ },
+};
+
+static const struct cpcap_chip_data cpcap_mot_data = {
+ .mfd_devices = cpcap_mot_mfd_devices,
+ .num_devices = ARRAY_SIZE(cpcap_mot_mfd_devices),
+};
+
static int cpcap_probe(struct spi_device *spi)
{
struct cpcap_ddata *cpcap;
@@ -389,6 +437,7 @@ static int cpcap_probe(struct spi_device *spi)
static const struct of_device_id cpcap_of_match[] = {
{ .compatible = "motorola,cpcap", .data = &cpcap_default_data },
{ .compatible = "motorola,mapphone-cpcap", .data = &cpcap_mapphone_data },
+ { .compatible = "motorola,mot-cpcap", .data = &cpcap_mot_data },
{ /* sentinel */ }
};
MODULE_DEVICE_TABLE(of, cpcap_of_match);
@@ -396,6 +445,7 @@ MODULE_DEVICE_TABLE(of, cpcap_of_match);
static const struct spi_device_id cpcap_spi_ids[] = {
{ .name = "cpcap", .driver_data = (kernel_ulong_t)&cpcap_default_data },
{ .name = "mapphone-cpcap", .driver_data = (kernel_ulong_t)&cpcap_mapphone_data },
+ { .name = "mot-cpcap", .driver_data = (kernel_ulong_t)&cpcap_mot_data },
{ /* sentinel */ }
};
MODULE_DEVICE_TABLE(spi, cpcap_spi_ids);
--
2.51.0
^ permalink raw reply related
* [PATCH v4 5/6] mfd: motorola-cpcap: diverge configuration per-board
From: Svyatoslav Ryhel @ 2026-04-17 7:11 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Lee Jones, Pavel Machek, Svyatoslav Ryhel, David Lechner,
Tony Lindgren
Cc: linux-input, devicetree, linux-kernel, linux-leds
In-Reply-To: <20260417071106.21984-1-clamor95@gmail.com>
MFD have rigid subdevice structure which does not allow flexible dynamic
subdevice linking. Address this by diverging CPCAP subdevice composition
to take into account board specific configuration.
Create a common default subdevice composition, rename existing subdevice
composition into cpcap_mapphone_mfd_devices since it targets mainly
Mapphone board.
Removed st,6556002 as it is no longer applicable to all cases and
duplicates motorola,cpcap, which is used as the default composition.
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
---
drivers/mfd/motorola-cpcap.c | 101 ++++++++++++++++++++++++++++-------
1 file changed, 83 insertions(+), 18 deletions(-)
diff --git a/drivers/mfd/motorola-cpcap.c b/drivers/mfd/motorola-cpcap.c
index d8243b956f87..516d1e33affa 100644
--- a/drivers/mfd/motorola-cpcap.c
+++ b/drivers/mfd/motorola-cpcap.c
@@ -12,6 +12,7 @@
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/mod_devicetable.h>
+#include <linux/property.h>
#include <linux/regmap.h>
#include <linux/sysfs.h>
@@ -24,10 +25,16 @@
#define CPCAP_REGISTER_SIZE 4
#define CPCAP_REGISTER_BITS 16
+struct cpcap_chip_data {
+ const struct mfd_cell *mfd_devices;
+ unsigned int num_devices;
+};
+
struct cpcap_ddata {
struct spi_device *spi;
struct regmap_irq *irqs;
struct regmap_irq_chip_data *irqdata[CPCAP_NR_IRQ_CHIPS];
+ const struct cpcap_chip_data *cdata;
const struct regmap_config *regmap_conf;
struct regmap *regmap;
};
@@ -195,20 +202,6 @@ static int cpcap_init_irq(struct cpcap_ddata *cpcap)
return 0;
}
-static const struct of_device_id cpcap_of_match[] = {
- { .compatible = "motorola,cpcap", },
- { .compatible = "st,6556002", },
- {},
-};
-MODULE_DEVICE_TABLE(of, cpcap_of_match);
-
-static const struct spi_device_id cpcap_spi_ids[] = {
- { .name = "cpcap", },
- { .name = "6556002", },
- {},
-};
-MODULE_DEVICE_TABLE(spi, cpcap_spi_ids);
-
static const struct regmap_config cpcap_regmap_config = {
.reg_bits = 16,
.reg_stride = 4,
@@ -241,7 +234,56 @@ static int cpcap_resume(struct device *dev)
static DEFINE_SIMPLE_DEV_PM_OPS(cpcap_pm, cpcap_suspend, cpcap_resume);
-static const struct mfd_cell cpcap_mfd_devices[] = {
+static const struct mfd_cell cpcap_default_mfd_devices[] = {
+ {
+ .name = "cpcap_adc",
+ .of_compatible = "motorola,cpcap-adc",
+ }, {
+ .name = "cpcap_battery",
+ .of_compatible = "motorola,cpcap-battery",
+ }, {
+ .name = "cpcap-regulator",
+ .of_compatible = "motorola,cpcap-regulator",
+ }, {
+ .name = "cpcap-rtc",
+ .of_compatible = "motorola,cpcap-rtc",
+ }, {
+ .name = "cpcap-pwrbutton",
+ .of_compatible = "motorola,cpcap-pwrbutton",
+ }, {
+ .name = "cpcap-usb-phy",
+ .of_compatible = "motorola,cpcap-usb-phy",
+ }, {
+ .name = "cpcap-led",
+ .id = 0,
+ .of_compatible = "motorola,cpcap-led-red",
+ }, {
+ .name = "cpcap-led",
+ .id = 1,
+ .of_compatible = "motorola,cpcap-led-green",
+ }, {
+ .name = "cpcap-led",
+ .id = 2,
+ .of_compatible = "motorola,cpcap-led-blue",
+ }, {
+ .name = "cpcap-led",
+ .id = 3,
+ .of_compatible = "motorola,cpcap-led-adl",
+ }, {
+ .name = "cpcap-led",
+ .id = 4,
+ .of_compatible = "motorola,cpcap-led-cp",
+ }, {
+ .name = "cpcap-codec",
+ },
+};
+
+static const struct cpcap_chip_data cpcap_default_data = {
+ .mfd_devices = cpcap_default_mfd_devices,
+ .num_devices = ARRAY_SIZE(cpcap_default_mfd_devices),
+};
+
+static const struct mfd_cell cpcap_mapphone_mfd_devices[] = {
{
.name = "cpcap_adc",
.of_compatible = "motorola,mapphone-cpcap-adc",
@@ -285,7 +327,12 @@ static const struct mfd_cell cpcap_mfd_devices[] = {
.of_compatible = "motorola,cpcap-led-cp",
}, {
.name = "cpcap-codec",
- }
+ },
+};
+
+static const struct cpcap_chip_data cpcap_mapphone_data = {
+ .mfd_devices = cpcap_mapphone_mfd_devices,
+ .num_devices = ARRAY_SIZE(cpcap_mapphone_mfd_devices),
};
static int cpcap_probe(struct spi_device *spi)
@@ -297,6 +344,10 @@ static int cpcap_probe(struct spi_device *spi)
if (!cpcap)
return -ENOMEM;
+ cpcap->cdata = device_get_match_data(&spi->dev);
+ if (!cpcap->cdata)
+ return -ENODEV;
+
cpcap->spi = spi;
spi_set_drvdata(spi, cpcap);
@@ -331,10 +382,24 @@ static int cpcap_probe(struct spi_device *spi)
spi->dev.coherent_dma_mask = 0;
spi->dev.dma_mask = &spi->dev.coherent_dma_mask;
- return devm_mfd_add_devices(&spi->dev, 0, cpcap_mfd_devices,
- ARRAY_SIZE(cpcap_mfd_devices), NULL, 0, NULL);
+ return devm_mfd_add_devices(&spi->dev, 0, cpcap->cdata->mfd_devices,
+ cpcap->cdata->num_devices, NULL, 0, NULL);
}
+static const struct of_device_id cpcap_of_match[] = {
+ { .compatible = "motorola,cpcap", .data = &cpcap_default_data },
+ { .compatible = "motorola,mapphone-cpcap", .data = &cpcap_mapphone_data },
+ { /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, cpcap_of_match);
+
+static const struct spi_device_id cpcap_spi_ids[] = {
+ { .name = "cpcap", .driver_data = (kernel_ulong_t)&cpcap_default_data },
+ { .name = "mapphone-cpcap", .driver_data = (kernel_ulong_t)&cpcap_mapphone_data },
+ { /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(spi, cpcap_spi_ids);
+
static struct spi_driver cpcap_driver = {
.driver = {
.name = "cpcap-core",
--
2.51.0
^ permalink raw reply related
* [PATCH v4 4/6] dt-bindings: mfd: motorola-cpcap: document Mapphone and Mot CPCAP
From: Svyatoslav Ryhel @ 2026-04-17 7:11 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Lee Jones, Pavel Machek, Svyatoslav Ryhel, David Lechner,
Tony Lindgren
Cc: linux-input, devicetree, linux-kernel, linux-leds
In-Reply-To: <20260417071106.21984-1-clamor95@gmail.com>
Add compatibles for Mapphone and Mot CPCAP subdevice compositions. Both
variations cannot use st,6556002 fallback since they may be based on
different controllers.
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
---
.../devicetree/bindings/mfd/motorola,cpcap.yaml | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/Documentation/devicetree/bindings/mfd/motorola,cpcap.yaml b/Documentation/devicetree/bindings/mfd/motorola,cpcap.yaml
index eea5b2efa80c..487e5456864b 100644
--- a/Documentation/devicetree/bindings/mfd/motorola,cpcap.yaml
+++ b/Documentation/devicetree/bindings/mfd/motorola,cpcap.yaml
@@ -14,9 +14,14 @@ allOf:
properties:
compatible:
- items:
- - const: motorola,cpcap
- - const: st,6556002
+ oneOf:
+ - enum:
+ - motorola,mapphone-cpcap
+ - motorola,mot-cpcap
+
+ - items:
+ - const: motorola,cpcap
+ - const: st,6556002
reg:
maxItems: 1
--
2.51.0
^ permalink raw reply related
* [PATCH v4 3/6] dt-bindings: mfd: motorola-cpcap: convert to DT schema
From: Svyatoslav Ryhel @ 2026-04-17 7:11 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Lee Jones, Pavel Machek, Svyatoslav Ryhel, David Lechner,
Tony Lindgren
Cc: linux-input, devicetree, linux-kernel, linux-leds
In-Reply-To: <20260417071106.21984-1-clamor95@gmail.com>
Convert devicetree bindings for the Motorola CPCAP MFD from TXT to YAML.
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
---
.../bindings/mfd/motorola,cpcap.yaml | 411 ++++++++++++++++++
.../bindings/mfd/motorola-cpcap.txt | 78 ----
2 files changed, 411 insertions(+), 78 deletions(-)
create mode 100644 Documentation/devicetree/bindings/mfd/motorola,cpcap.yaml
delete mode 100644 Documentation/devicetree/bindings/mfd/motorola-cpcap.txt
diff --git a/Documentation/devicetree/bindings/mfd/motorola,cpcap.yaml b/Documentation/devicetree/bindings/mfd/motorola,cpcap.yaml
new file mode 100644
index 000000000000..eea5b2efa80c
--- /dev/null
+++ b/Documentation/devicetree/bindings/mfd/motorola,cpcap.yaml
@@ -0,0 +1,411 @@
+# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/mfd/motorola,cpcap.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Motorola CPCAP PMIC MFD
+
+maintainers:
+ - Svyatoslav Ryhel <clamor95@gmail.com>
+
+allOf:
+ - $ref: /schemas/spi/spi-peripheral-props.yaml#
+
+properties:
+ compatible:
+ items:
+ - const: motorola,cpcap
+ - const: st,6556002
+
+ reg:
+ maxItems: 1
+
+ interrupts:
+ maxItems: 1
+
+ interrupt-controller: true
+
+ "#interrupt-cells":
+ const: 2
+
+ "#address-cells":
+ const: 1
+
+ "#size-cells":
+ const: 0
+
+ spi-max-frequency:
+ maximum: 9600000
+
+ spi-cs-high: true
+ spi-cpol: true
+ spi-cpha: true
+
+ adc:
+ $ref: /schemas/iio/adc/motorola,cpcap-adc.yaml
+
+ audio-codec:
+ type: object
+ additionalProperties: false
+
+ properties:
+ interrupts:
+ items:
+ - description: headset detect interrupt
+ - description: microphone bias 2 detect interrupt
+
+ interrupt-names:
+ items:
+ - const: hs
+ - const: mb2
+
+ "#sound-dai-cells":
+ const: 1
+
+ VAUDIO-supply:
+ description:
+ Codec power supply, usually VAUDIO regulator of CPCAP.
+
+ ports:
+ $ref: /schemas/graph.yaml#/properties/ports
+
+ properties:
+ port@0:
+ $ref: /schemas/graph.yaml#/properties/port
+ description: port connected to the Stereo HiFi DAC
+
+ port@1:
+ $ref: /schemas/graph.yaml#/properties/port
+ description: port connected to the Voice DAC
+
+ required:
+ - port@0
+ - port@1
+
+ required:
+ - interrupts
+ - interrupt-names
+ - "#sound-dai-cells"
+
+ battery:
+ $ref: /schemas/power/supply/cpcap-battery.yaml
+
+ charger:
+ $ref: /schemas/power/supply/cpcap-charger.yaml
+
+ key-power:
+ $ref: /schemas/input/motorola,cpcap-pwrbutton.yaml
+
+ phy:
+ $ref: /schemas/phy/motorola,cpcap-usb-phy.yaml
+
+ regulator:
+ $ref: /schemas/regulator/motorola,cpcap-regulator.yaml
+
+ rtc:
+ $ref: /schemas/rtc/motorola,cpcap-rtc.yaml
+
+patternProperties:
+ "^led(-[a-z]+)?$":
+ $ref: /schemas/leds/motorola,cpcap-leds.yaml
+
+required:
+ - compatible
+ - reg
+ - interrupts
+ - "#address-cells"
+ - "#size-cells"
+
+additionalProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/gpio/gpio.h>
+ #include <dt-bindings/interrupt-controller/irq.h>
+ #include <dt-bindings/input/linux-event-codes.h>
+
+ spi {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ cpcap: pmic@0 {
+ compatible = "motorola,cpcap", "st,6556002";
+ reg = <0>; /* cs0 */
+
+ interrupt-parent = <&gpio1>;
+ interrupts = <7 IRQ_TYPE_EDGE_RISING>;
+
+ interrupt-controller;
+ #interrupt-cells = <2>;
+
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ spi-max-frequency = <3000000>;
+ spi-cs-high;
+
+ spi-cpol;
+ spi-cpha;
+
+ cpcap_adc: adc {
+ compatible = "motorola,cpcap-adc";
+
+ interrupt-parent = <&cpcap>;
+ interrupts = <8 IRQ_TYPE_NONE>;
+ interrupt-names = "adcdone";
+
+ #io-channel-cells = <1>;
+ };
+
+ cpcap_audio: audio-codec {
+ interrupt-parent = <&cpcap>;
+ interrupts = <9 IRQ_TYPE_NONE>, <10 IRQ_TYPE_NONE>;
+ interrupt-names = "hs", "mb2";
+
+ VAUDIO-supply = <&vdd_audio>;
+
+ #sound-dai-cells = <1>;
+
+ ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ /* HiFi */
+ port@0 {
+ reg = <0>;
+
+ cpcap_audio_codec0: endpoint {
+ };
+ };
+
+ /* Voice */
+ port@1 {
+ reg = <1>;
+
+ cpcap_audio_codec1: endpoint {
+ };
+ };
+ };
+ };
+
+ cpcap_battery: battery {
+ compatible = "motorola,cpcap-battery";
+
+ interrupt-parent = <&cpcap>;
+ interrupts = <6 IRQ_TYPE_NONE>, <5 IRQ_TYPE_NONE>,
+ <3 IRQ_TYPE_NONE>, <20 IRQ_TYPE_NONE>,
+ <54 IRQ_TYPE_NONE>, <57 IRQ_TYPE_NONE>;
+ interrupt-names = "eol", "lowbph", "lowbpl",
+ "chrgcurr1", "battdetb", "cccal";
+
+ io-channels = <&cpcap_adc 0>, <&cpcap_adc 1>,
+ <&cpcap_adc 5>, <&cpcap_adc 6>;
+ io-channel-names = "battdetb", "battp",
+ "chg_isense", "batti";
+ power-supplies = <&cpcap_charger>;
+ };
+
+ cpcap_charger: charger {
+ compatible = "motorola,mapphone-cpcap-charger";
+
+ interrupt-parent = <&cpcap>;
+ interrupts = <13 IRQ_TYPE_NONE>, <12 IRQ_TYPE_NONE>,
+ <29 IRQ_TYPE_NONE>, <28 IRQ_TYPE_NONE>,
+ <22 IRQ_TYPE_NONE>, <21 IRQ_TYPE_NONE>,
+ <20 IRQ_TYPE_NONE>, <19 IRQ_TYPE_NONE>,
+ <54 IRQ_TYPE_NONE>;
+ interrupt-names = "chrg_det", "rvrs_chrg", "chrg_se1b",
+ "se0conn", "rvrs_mode", "chrgcurr2",
+ "chrgcurr1", "vbusvld", "battdetb";
+
+ mode-gpios = <&gpio3 29 GPIO_ACTIVE_LOW>,
+ <&gpio3 23 GPIO_ACTIVE_LOW>;
+
+ io-channels = <&cpcap_adc 0>, <&cpcap_adc 1>,
+ <&cpcap_adc 2>, <&cpcap_adc 5>,
+ <&cpcap_adc 6>;
+ io-channel-names = "battdetb", "battp",
+ "vbus", "chg_isense",
+ "batti";
+ };
+
+ key-power {
+ compatible = "motorola,cpcap-pwrbutton";
+
+ interrupt-parent = <&cpcap>;
+ interrupts = <23 IRQ_TYPE_NONE>;
+ };
+
+ led-red {
+ compatible = "motorola,cpcap-led-red";
+ vdd-supply = <&vdd_led>;
+ label = "status-led::red";
+ };
+
+ led-green {
+ compatible = "motorola,cpcap-led-green";
+ vdd-supply = <&vdd_led>;
+ label = "status-led::green";
+ };
+
+ led-blue {
+ compatible = "motorola,cpcap-led-blue";
+ vdd-supply = <&vdd_led>;
+ label = "status-led::blue";
+ };
+
+ cpcap_usb2_phy: phy {
+ compatible = "motorola,cpcap-usb-phy";
+
+ pinctrl-0 = <&usb_gpio_mux_sel1>, <&usb_gpio_mux_sel2>;
+ pinctrl-1 = <&usb_ulpi_pins>;
+ pinctrl-2 = <&usb_utmi_pins>;
+ pinctrl-3 = <&uart3_pins>;
+ pinctrl-names = "default", "ulpi", "utmi", "uart";
+ #phy-cells = <0>;
+
+ interrupts-extended =
+ <&cpcap 15 IRQ_TYPE_NONE>, <&cpcap 14 IRQ_TYPE_NONE>,
+ <&cpcap 28 IRQ_TYPE_NONE>, <&cpcap 19 IRQ_TYPE_NONE>,
+ <&cpcap 18 IRQ_TYPE_NONE>, <&cpcap 17 IRQ_TYPE_NONE>,
+ <&cpcap 16 IRQ_TYPE_NONE>, <&cpcap 49 IRQ_TYPE_NONE>,
+ <&cpcap 48 IRQ_TYPE_NONE>;
+ interrupt-names = "id_ground", "id_float", "se0conn",
+ "vbusvld", "sessvld", "sessend",
+ "se1", "dm", "dp";
+
+ mode-gpios = <&gpio2 28 GPIO_ACTIVE_HIGH>,
+ <&gpio1 0 GPIO_ACTIVE_HIGH>;
+
+ io-channels = <&cpcap_adc 2>, <&cpcap_adc 7>;
+ io-channel-names = "vbus", "id";
+
+ vusb-supply = <&avdd_usb>;
+ };
+
+ regulator {
+ compatible = "motorola,cpcap-regulator";
+
+ regulators {
+ vdd_cpu: SW1 {
+ regulator-name = "vdd_cpu";
+ regulator-min-microvolt = <750000>;
+ regulator-max-microvolt = <1125000>;
+ regulator-enable-ramp-delay = <1500>;
+ regulator-always-on;
+ regulator-boot-on;
+ };
+
+ vdd_core: SW2 {
+ regulator-name = "vdd_core";
+ regulator-min-microvolt = <950000>;
+ regulator-max-microvolt = <1300000>;
+ regulator-enable-ramp-delay = <1500>;
+ regulator-always-on;
+ regulator-boot-on;
+ };
+
+ vdd_1v8_vio: SW3 {
+ regulator-name = "vdd_1v8_vio";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ regulator-enable-ramp-delay = <0>;
+ regulator-always-on;
+ regulator-boot-on;
+ };
+
+ vdd_aon: SW4 {
+ regulator-name = "vdd_aon";
+ regulator-min-microvolt = <950000>;
+ regulator-max-microvolt = <1300000>;
+ regulator-enable-ramp-delay = <1500>;
+ regulator-always-on;
+ regulator-boot-on;
+ };
+
+ vdd_led: SW5 {
+ regulator-name = "vdd_led";
+ regulator-min-microvolt = <5050000>;
+ regulator-max-microvolt = <5050000>;
+ regulator-enable-ramp-delay = <1500>;
+ regulator-boot-on;
+ };
+
+ vdd_hvio: VHVIO {
+ regulator-name = "vdd_hvio";
+ regulator-min-microvolt = <2775000>;
+ regulator-max-microvolt = <2775000>;
+ regulator-enable-ramp-delay = <1000>;
+ };
+
+ vcore_emmc: VSDIO {
+ regulator-name = "vcore_emmc";
+ regulator-min-microvolt = <1500000>;
+ regulator-max-microvolt = <3000000>;
+ regulator-enable-ramp-delay = <1000>;
+ regulator-always-on;
+ regulator-boot-on;
+ };
+
+ avdd_dsi_csi: VCSI {
+ regulator-name = "avdd_dsi_csi";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <1200000>;
+ regulator-enable-ramp-delay = <1000>;
+ regulator-boot-on;
+ };
+
+ avdd_3v3_periph: VWLAN2 {
+ regulator-name = "avdd_3v3_periph";
+ regulator-min-microvolt = <2775000>;
+ regulator-max-microvolt = <3300000>;
+ regulator-enable-ramp-delay = <1000>;
+ regulator-boot-on;
+ };
+
+ vddio_usd: VSIMCARD {
+ regulator-name = "vddio_usd";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <2900000>;
+ regulator-enable-ramp-delay = <1000>;
+ regulator-boot-on;
+ };
+
+ vdd_haptic: VVIB {
+ regulator-name = "vdd_haptic";
+ regulator-min-microvolt = <1300000>;
+ regulator-max-microvolt = <3000000>;
+ regulator-enable-ramp-delay = <1000>;
+ };
+
+ avdd_usb: VUSB {
+ regulator-name = "avdd_usb";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+ regulator-enable-ramp-delay = <1000>;
+ regulator-always-on;
+ regulator-boot-on;
+ };
+
+ vdd_audio: VAUDIO {
+ regulator-name = "vdd_audio";
+ regulator-min-microvolt = <2775000>;
+ regulator-max-microvolt = <2775000>;
+ regulator-enable-ramp-delay = <1000>;
+ regulator-always-on;
+ regulator-boot-on;
+ };
+ };
+ };
+
+ cpcap_rtc: rtc {
+ compatible = "motorola,cpcap-rtc";
+
+ interrupt-parent = <&cpcap>;
+ interrupts = <39 IRQ_TYPE_NONE>, <26 IRQ_TYPE_NONE>;
+ };
+ };
+ };
+
+...
diff --git a/Documentation/devicetree/bindings/mfd/motorola-cpcap.txt b/Documentation/devicetree/bindings/mfd/motorola-cpcap.txt
deleted file mode 100644
index 18c3fc26ca93..000000000000
--- a/Documentation/devicetree/bindings/mfd/motorola-cpcap.txt
+++ /dev/null
@@ -1,78 +0,0 @@
-Motorola CPCAP PMIC device tree binding
-
-Required properties:
-- compatible : One or both of "motorola,cpcap" or "ste,6556002"
-- reg : SPI chip select
-- interrupts : The interrupt line the device is connected to
-- interrupt-controller : Marks the device node as an interrupt controller
-- #interrupt-cells : The number of cells to describe an IRQ, should be 2
-- #address-cells : Child device offset number of cells, should be 1
-- #size-cells : Child device size number of cells, should be 0
-- spi-max-frequency : Typically set to 3000000
-- spi-cs-high : SPI chip select direction
-
-Optional subnodes:
-
-The sub-functions of CPCAP get their own node with their own compatible values,
-which are described in the following files:
-
-- Documentation/devicetree/bindings/power/supply/cpcap-battery.yaml
-- Documentation/devicetree/bindings/power/supply/cpcap-charger.yaml
-- Documentation/devicetree/bindings/regulator/cpcap-regulator.txt
-- Documentation/devicetree/bindings/phy/motorola,cpcap-usb-phy.yaml
-- Documentation/devicetree/bindings/input/cpcap-pwrbutton.txt
-- Documentation/devicetree/bindings/rtc/cpcap-rtc.txt
-- Documentation/devicetree/bindings/leds/leds-cpcap.txt
-- Documentation/devicetree/bindings/iio/adc/motorola,cpcap-adc.yaml
-
-The only exception is the audio codec. Instead of a compatible value its
-node must be named "audio-codec".
-
-Required properties for the audio-codec subnode:
-
-- #sound-dai-cells = <1>;
-- interrupts : should contain jack detection interrupts, with headset
- detect interrupt matching "hs" and microphone bias 2
- detect interrupt matching "mb2" in interrupt-names.
-- interrupt-names : Contains "hs", "mb2"
-
-The audio-codec provides two DAIs. The first one is connected to the
-Stereo HiFi DAC and the second one is connected to the Voice DAC.
-
-Example:
-
-&mcspi1 {
- cpcap: pmic@0 {
- compatible = "motorola,cpcap", "ste,6556002";
- reg = <0>; /* cs0 */
- interrupt-parent = <&gpio1>;
- interrupts = <7 IRQ_TYPE_EDGE_RISING>;
- interrupt-controller;
- #interrupt-cells = <2>;
- #address-cells = <1>;
- #size-cells = <0>;
- spi-max-frequency = <3000000>;
- spi-cs-high;
-
- audio-codec {
- #sound-dai-cells = <1>;
- interrupts-extended = <&cpcap 9 0>, <&cpcap 10 0>;
- interrupt-names = "hs", "mb2";
-
- /* HiFi */
- port@0 {
- endpoint {
- remote-endpoint = <&cpu_dai1>;
- };
- };
-
- /* Voice */
- port@1 {
- endpoint {
- remote-endpoint = <&cpu_dai2>;
- };
- };
- };
- };
-};
-
--
2.51.0
^ permalink raw reply related
* [PATCH v4 2/6] dt-bindings: input: cpcap-pwrbutton: convert to DT schema
From: Svyatoslav Ryhel @ 2026-04-17 7:11 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Lee Jones, Pavel Machek, Svyatoslav Ryhel, David Lechner,
Tony Lindgren
Cc: linux-input, devicetree, linux-kernel, linux-leds
In-Reply-To: <20260417071106.21984-1-clamor95@gmail.com>
Convert power button devicetree bindings for the Motorola CPCAP MFD from
TXT to YAML format. This patch does not change any functionality; the
bindings remain the same.
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
---
.../bindings/input/cpcap-pwrbutton.txt | 20 ------------
.../input/motorola,cpcap-pwrbutton.yaml | 32 +++++++++++++++++++
2 files changed, 32 insertions(+), 20 deletions(-)
delete mode 100644 Documentation/devicetree/bindings/input/cpcap-pwrbutton.txt
create mode 100644 Documentation/devicetree/bindings/input/motorola,cpcap-pwrbutton.yaml
diff --git a/Documentation/devicetree/bindings/input/cpcap-pwrbutton.txt b/Documentation/devicetree/bindings/input/cpcap-pwrbutton.txt
deleted file mode 100644
index 0dd0076daf71..000000000000
--- a/Documentation/devicetree/bindings/input/cpcap-pwrbutton.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-Motorola CPCAP on key
-
-This module is part of the CPCAP. For more details about the whole
-chip see Documentation/devicetree/bindings/mfd/motorola-cpcap.txt.
-
-This module provides a simple power button event via an Interrupt.
-
-Required properties:
-- compatible: should be one of the following
- - "motorola,cpcap-pwrbutton"
-- interrupts: irq specifier for CPCAP's ON IRQ
-
-Example:
-
-&cpcap {
- cpcap_pwrbutton: pwrbutton {
- compatible = "motorola,cpcap-pwrbutton";
- interrupts = <23 IRQ_TYPE_NONE>;
- };
-};
diff --git a/Documentation/devicetree/bindings/input/motorola,cpcap-pwrbutton.yaml b/Documentation/devicetree/bindings/input/motorola,cpcap-pwrbutton.yaml
new file mode 100644
index 000000000000..77a3e5a47d1a
--- /dev/null
+++ b/Documentation/devicetree/bindings/input/motorola,cpcap-pwrbutton.yaml
@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/input/motorola,cpcap-pwrbutton.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Motorola CPCAP PMIC power key
+
+maintainers:
+ - Svyatoslav Ryhel <clamor95@gmail.com>
+
+description:
+ This module is part of the Motorola CPCAP MFD device. For more details
+ see Documentation/devicetree/bindings/mfd/motorola,cpcap.yaml. The
+ power key is represented as a sub-node of the PMIC node on the device
+ tree.
+
+properties:
+ compatible:
+ const: motorola,cpcap-pwrbutton
+
+ interrupts:
+ items:
+ - description: CPCAP's ON interrupt
+
+required:
+ - compatible
+ - interrupts
+
+additionalProperties: false
+
+...
--
2.51.0
^ permalink raw reply related
* [PATCH v4 1/6] dt-bindings: leds: leds-cpcap: convert to DT schema
From: Svyatoslav Ryhel @ 2026-04-17 7:11 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Lee Jones, Pavel Machek, Svyatoslav Ryhel, David Lechner,
Tony Lindgren
Cc: linux-input, devicetree, linux-kernel, linux-leds
In-Reply-To: <20260417071106.21984-1-clamor95@gmail.com>
Convert LEDs devicetree bindings for the Motorola CPCAP MFD from TXT to
YAML format. This patch does not change any functionality; the bindings
remain the same.
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
---
.../devicetree/bindings/leds/leds-cpcap.txt | 29 -------------
.../bindings/leds/motorola,cpcap-leds.yaml | 42 +++++++++++++++++++
2 files changed, 42 insertions(+), 29 deletions(-)
delete mode 100644 Documentation/devicetree/bindings/leds/leds-cpcap.txt
create mode 100644 Documentation/devicetree/bindings/leds/motorola,cpcap-leds.yaml
diff --git a/Documentation/devicetree/bindings/leds/leds-cpcap.txt b/Documentation/devicetree/bindings/leds/leds-cpcap.txt
deleted file mode 100644
index ebf7cdc7f70c..000000000000
--- a/Documentation/devicetree/bindings/leds/leds-cpcap.txt
+++ /dev/null
@@ -1,29 +0,0 @@
-Motorola CPCAP PMIC LEDs
-------------------------
-
-This module is part of the CPCAP. For more details about the whole
-chip see Documentation/devicetree/bindings/mfd/motorola-cpcap.txt.
-
-Requires node properties:
-- compatible: should be one of
- * "motorola,cpcap-led-mdl" (Main Display Lighting)
- * "motorola,cpcap-led-kl" (Keyboard Lighting)
- * "motorola,cpcap-led-adl" (Aux Display Lighting)
- * "motorola,cpcap-led-red" (Red Triode)
- * "motorola,cpcap-led-green" (Green Triode)
- * "motorola,cpcap-led-blue" (Blue Triode)
- * "motorola,cpcap-led-cf" (Camera Flash)
- * "motorola,cpcap-led-bt" (Bluetooth)
- * "motorola,cpcap-led-cp" (Camera Privacy LED)
-- label: see Documentation/devicetree/bindings/leds/common.txt
-- vdd-supply: A phandle to the regulator powering the LED
-
-Example:
-
-&cpcap {
- cpcap_led_red: red-led {
- compatible = "motorola,cpcap-led-red";
- label = "cpcap:red";
- vdd-supply = <&sw5>;
- };
-};
diff --git a/Documentation/devicetree/bindings/leds/motorola,cpcap-leds.yaml b/Documentation/devicetree/bindings/leds/motorola,cpcap-leds.yaml
new file mode 100644
index 000000000000..c8e7b88a05cc
--- /dev/null
+++ b/Documentation/devicetree/bindings/leds/motorola,cpcap-leds.yaml
@@ -0,0 +1,42 @@
+# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/leds/motorola,cpcap-leds.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Motorola CPCAP PMIC LEDs
+
+maintainers:
+ - Svyatoslav Ryhel <clamor95@gmail.com>
+
+description:
+ This module is part of the Motorola CPCAP MFD device. For more details
+ see Documentation/devicetree/bindings/mfd/motorola,cpcap.yaml. LEDs are
+ represented as sub-nodes of the PMIC node on the device tree.
+
+allOf:
+ - $ref: /schemas/leds/common.yaml#
+
+properties:
+ compatible:
+ enum:
+ - motorola,cpcap-led-adl # Display Lighting
+ - motorola,cpcap-led-blue # Blue Triode
+ - motorola,cpcap-led-bt # Bluetooth
+ - motorola,cpcap-led-cf # Camera Flash
+ - motorola,cpcap-led-cp # Camera Privacy LED
+ - motorola,cpcap-led-green # Green Triode
+ - motorola,cpcap-led-kl # Keyboard Lighting
+ - motorola,cpcap-led-mdl # Main Display Lighting
+ - motorola,cpcap-led-red # Red Triode
+
+ vdd-supply: true
+
+required:
+ - compatible
+ - label
+ - vdd-supply
+
+unevaluatedProperties: false
+
+...
--
2.51.0
^ permalink raw reply related
* [PATCH v4 0/6] mfd: cpcap: convert documentation to schema and add Mot board support
From: Svyatoslav Ryhel @ 2026-04-17 7:11 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Lee Jones, Pavel Machek, Svyatoslav Ryhel, David Lechner,
Tony Lindgren
Cc: linux-input, devicetree, linux-kernel, linux-leds
The initial goal was only to add support for the CPCAP used in the Mot
Tegra20 board; however, since the documentation was already partially
converted, I decided to complete the conversion to schema too.
The CPCAP regulator, leds, rtc, pwrbutton and core files were converted
from TXT to YAML while preserving the original structure. Mot board
compatibility was added to the regulator and core schema. Since these
were one-line patches, they were not separated into dedicated commits;
however, the commit message notes this for both cases.
Finally, the CPCAP MFD was slightly refactored to improve support for
multiple subcell compositions.
---
Changes in v2:
- fixed code style
- rtc conversion was picked, so patch dropped
- added audio ports description into mfd schema
- splitted schema conversion and compatible addition
- minor style improvements and typo fixes
Changes in v3:
- added regulator node names list into pattern
- filled spi_device_id with driver data
- ADC patches were picked, so changes dropped
Changes in v4:
- dropped regulator patches (applied)
---
Svyatoslav Ryhel (6):
dt-bindings: leds: leds-cpcap: convert to DT schema
dt-bindings: input: cpcap-pwrbutton: convert to DT schema
dt-bindings: mfd: motorola-cpcap: convert to DT schema
dt-bindings: mfd: motorola-cpcap: document Mapphone and Mot CPCAP
mfd: motorola-cpcap: diverge configuration per-board
mfd: motorola-cpcap: add support for Mot CPCAP composition
.../bindings/input/cpcap-pwrbutton.txt | 20 -
.../input/motorola,cpcap-pwrbutton.yaml | 32 ++
.../devicetree/bindings/leds/leds-cpcap.txt | 29 --
.../bindings/leds/motorola,cpcap-leds.yaml | 42 ++
.../bindings/mfd/motorola,cpcap.yaml | 416 ++++++++++++++++++
.../bindings/mfd/motorola-cpcap.txt | 78 ----
drivers/mfd/motorola-cpcap.c | 151 ++++++-
7 files changed, 623 insertions(+), 145 deletions(-)
delete mode 100644 Documentation/devicetree/bindings/input/cpcap-pwrbutton.txt
create mode 100644 Documentation/devicetree/bindings/input/motorola,cpcap-pwrbutton.yaml
delete mode 100644 Documentation/devicetree/bindings/leds/leds-cpcap.txt
create mode 100644 Documentation/devicetree/bindings/leds/motorola,cpcap-leds.yaml
create mode 100644 Documentation/devicetree/bindings/mfd/motorola,cpcap.yaml
delete mode 100644 Documentation/devicetree/bindings/mfd/motorola-cpcap.txt
--
2.51.0
^ permalink raw reply
* [PATCH v2 2/2] input: misc: Add PixArt PAJ7620 gesture sensor driver
From: Harpreet Saini @ 2026-04-17 5:25 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley
Cc: David Lechner, Harpreet Saini, devicetree, linux-input,
linux-kernel
In-Reply-To: <20260417052527.62535-1-sainiharpreet29@yahoo.com>
This driver adds support for the PixArt PAJ7620 gesture sensor.
It implements hand gesture recognition (up, down, left, right,
etc.) and reports them as standard input key events. The driver
includes power management support via Runtime PM.
Signed-off-by: Harpreet Saini <sainiharpreet29@yahoo.com>
---
drivers/input/misc/Kconfig | 12 ++
drivers/input/misc/Makefile | 1 +
drivers/input/misc/paj7620.c | 350 +++++++++++++++++++++++++++++++++++
3 files changed, 363 insertions(+)
create mode 100644 drivers/input/misc/paj7620.c
diff --git a/drivers/input/misc/Kconfig b/drivers/input/misc/Kconfig
index 94a753fcb64f..de4206c297f2 100644
--- a/drivers/input/misc/Kconfig
+++ b/drivers/input/misc/Kconfig
@@ -453,6 +453,18 @@ config INPUT_KXTJ9
To compile this driver as a module, choose M here: the module will
be called kxtj9.
+config INPUT_PAJ7620
+ tristate "PixArt PAJ7620 Gesture Sensor"
+ depends on I2C
+ select REGMAP_I2C
+ help
+ Say Y here if you want to support the PixArt PAJ7620 gesture
+ sensor. This sensor supports 9 hand gestures and communicates
+ over the I2C bus.
+
+ To compile this driver as a module, choose M here: the
+ module will be called paj7620.
+
config INPUT_POWERMATE
tristate "Griffin PowerMate and Contour Jog support"
depends on USB_ARCH_HAS_HCD
diff --git a/drivers/input/misc/Makefile b/drivers/input/misc/Makefile
index 415fc4e2918b..dec8b8d0cdf4 100644
--- a/drivers/input/misc/Makefile
+++ b/drivers/input/misc/Makefile
@@ -67,6 +67,7 @@ obj-$(CONFIG_INPUT_PF1550_ONKEY) += pf1550-onkey.o
obj-$(CONFIG_INPUT_PM8941_PWRKEY) += pm8941-pwrkey.o
obj-$(CONFIG_INPUT_PM8XXX_VIBRATOR) += pm8xxx-vibrator.o
obj-$(CONFIG_INPUT_PMIC8XXX_PWRKEY) += pmic8xxx-pwrkey.o
+obj-$(CONFIG_INPUT_PAJ7620) += paj7620.o
obj-$(CONFIG_INPUT_POWERMATE) += powermate.o
obj-$(CONFIG_INPUT_PWM_BEEPER) += pwm-beeper.o
obj-$(CONFIG_INPUT_PWM_VIBRA) += pwm-vibra.o
diff --git a/drivers/input/misc/paj7620.c b/drivers/input/misc/paj7620.c
new file mode 100644
index 000000000000..632a77ce4085
--- /dev/null
+++ b/drivers/input/misc/paj7620.c
@@ -0,0 +1,350 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * PixArt PAJ7620 Gesture Sensor - Input driver
+ *
+ * Copyright (C) 2026 Harpreet Saini <sainiharpreet29@yahoo.com>
+ */
+
+#include <linux/delay.h>
+#include <linux/i2c.h>
+#include <linux/input.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+#include <linux/regulator/consumer.h>
+
+/* Registers */
+#define PAJ7620_REG_BANK_SEL 0xEF
+#define PAJ7620_REG_GES_RESULT1 0x43
+#define PAJ7620_REG_GES_RESULT2 0x44
+#define PAJ7620_REG_SLEEP_BANK0 0x65
+#define PAJ7620_REG_SLEEP_BANK1 0x05
+#define PAJ7620_REG_AUTO_STANDBY 0x073
+
+/* Gesture bits */
+#define PAJ_UP BIT(0)
+#define PAJ_DOWN BIT(1)
+#define PAJ_LEFT BIT(2)
+#define PAJ_RIGHT BIT(3)
+#define PAJ_FORWARD BIT(4)
+#define PAJ_BACKWARD BIT(5)
+#define PAJ_CLOCKWISE BIT(6)
+#define PAJ_ANTICLOCK BIT(7)
+#define PAJ_WAVE BIT(8)
+
+struct paj7620_data {
+ struct i2c_client *client;
+ struct regmap *regmap;
+ struct input_dev *idev;
+ struct regulator_bulk_data supplies[3];
+};
+
+/*
+ * The following arrays contain undocumented register sequences required to
+ * initialize the sensor's internal DSP and gesture engine.
+ * These were derived from vendor reference code and verified via testing.
+ */
+static const struct reg_sequence Init_Register[] = {
+ { 0xEF, 0x00 }, { 0x37, 0x07 }, { 0x38, 0x17 }, { 0x39, 0x06 },
+ { 0x41, 0x00 }, { 0x42, 0x00 }, { 0x46, 0x2D }, { 0x47, 0x0F },
+ { 0x48, 0x3C }, { 0x49, 0x00 }, { 0x4A, 0x1E }, { 0x4C, 0x20 },
+ { 0x51, 0x10 }, { 0x5E, 0x10 }, { 0x60, 0x27 }, { 0x80, 0x42 },
+ { 0x81, 0x44 }, { 0x82, 0x04 }, { 0x8B, 0x01 }, { 0x90, 0x06 },
+ { 0x95, 0x0A }, { 0x96, 0x0C }, { 0x97, 0x05 }, { 0x9A, 0x14 },
+ { 0x9C, 0x3F }, { 0xA5, 0x19 }, { 0xCC, 0x19 }, { 0xCD, 0x0B },
+ { 0xCE, 0x13 }, { 0xCF, 0x64 }, { 0xD0, 0x21 }, { 0xEF, 0x01 },
+ { 0x02, 0x0F }, { 0x03, 0x10 }, { 0x04, 0x02 }, { 0x25, 0x01 },
+ { 0x27, 0x39 }, { 0x28, 0x7F }, { 0x29, 0x08 }, { 0x3E, 0xFF },
+ { 0x5E, 0x3D }, { 0x65, 0x96 }, { 0x67, 0x97 }, { 0x69, 0xCD },
+ { 0x6A, 0x01 }, { 0x6D, 0x2C }, { 0x6E, 0x01 }, { 0x72, 0x01 },
+ { 0x73, 0x35 }, { 0x74, 0x00 }, { 0x77, 0x01 },
+};
+
+/*
+ * Specific configuration overrides required to enable the internal
+ * 8-gesture state machine.
+ */
+static const struct reg_sequence Init_Gesture_Array[] = {
+ { 0xEF, 0x00 }, { 0x41, 0x00 }, { 0x42, 0x00 }, { 0xEF, 0x00 },
+ { 0x48, 0x3C }, { 0x49, 0x00 }, { 0x51, 0x10 }, { 0x83, 0x20 },
+ { 0x9F, 0xF9 }, { 0xEF, 0x01 }, { 0x01, 0x1E }, { 0x02, 0x0F },
+ { 0x03, 0x10 }, { 0x04, 0x02 }, { 0x41, 0x40 }, { 0x43, 0x30 },
+ { 0x65, 0x96 }, { 0x66, 0x00 }, { 0x67, 0x97 }, { 0x68, 0x01 },
+ { 0x69, 0xCD }, { 0x6A, 0x01 }, { 0x6B, 0xB0 }, { 0x6C, 0x04 },
+ { 0x6D, 0x2C }, { 0x6E, 0x01 }, { 0x74, 0x00 }, { 0xEF, 0x00 },
+ { 0x41, 0xFF }, { 0x42, 0x01 },
+};
+
+static void paj7620_report_keys(struct input_dev *idev, int gesture)
+{
+ static const struct { int bit; int key; } map[] = {
+ { PAJ_UP, KEY_UP },
+ { PAJ_DOWN, KEY_DOWN },
+ { PAJ_LEFT, KEY_LEFT },
+ { PAJ_RIGHT, KEY_RIGHT },
+ { PAJ_FORWARD, KEY_ENTER },
+ { PAJ_BACKWARD, KEY_BACK },
+ { PAJ_CLOCKWISE, KEY_NEXT },
+ { PAJ_ANTICLOCK, KEY_PREVIOUS },
+ { PAJ_WAVE, KEY_MENU },
+ };
+ // gesture mode does not support key hold, so pulse event
+ for (int i = 0; i < ARRAY_SIZE(map); i++) {
+ if (gesture & map[i].bit) {
+ input_report_key(idev, map[i].key, 1);
+ input_sync(idev);
+ input_report_key(idev, map[i].key, 0);
+ input_sync(idev);
+ }
+ }
+}
+
+static irqreturn_t paj7620_irq_thread(int irq, void *ptr)
+{
+ struct paj7620_data *data = ptr;
+ unsigned int g1, g2;
+ int ret;
+
+ /* 2. RUNTIME PM: Force awake to read registers */
+ pm_runtime_get_sync(&data->client->dev);
+
+ regmap_write(data->regmap, PAJ7620_REG_BANK_SEL, 0);
+ ret = regmap_read(data->regmap, PAJ7620_REG_GES_RESULT1, &g1);
+ ret |= regmap_read(data->regmap, PAJ7620_REG_GES_RESULT2, &g2);
+
+ if (!ret && (g1 || g2))
+ paj7620_report_keys(data->idev, (g2 << 8) | g1);
+
+ pm_runtime_mark_last_busy(&data->client->dev);
+ pm_runtime_put_autosuspend(&data->client->dev);
+
+ return IRQ_HANDLED;
+}
+
+static int paj7620_init(struct paj7620_data *data)
+{
+ int state = 0, ret, i;
+
+ /* 1. Wake-up sequence: Read register 0x00 until it returns 0x20 */
+ for (i = 0; i < 10; i++) {
+ ret = regmap_read(data->regmap, 0x00, &state);
+ if (ret >= 0 && state == 0x20)
+ break;
+ usleep_range(1000, 2000);
+ }
+
+ if (state != 0x20) {
+ dev_err(&data->client->dev, "Sensor wake-up failed (0x%02x)\n", state);
+ return -ENODEV;
+ }
+
+ /* 2. Blast full register array into PAJ7620 instantly */
+ ret = regmap_multi_reg_write(data->regmap, Init_Register,
+ ARRAY_SIZE(Init_Register));
+ if (ret < 0) {
+ dev_err(&data->client->dev, "Multi-reg write failed (%d)\n", ret);
+ return ret;
+ }
+
+ ret = regmap_write(data->regmap, PAJ7620_REG_BANK_SEL, 0x00);
+ if (ret < 0)
+ return ret;
+
+ ret = regmap_multi_reg_write(data->regmap, Init_Gesture_Array,
+ ARRAY_SIZE(Init_Gesture_Array));
+ if (ret < 0) {
+ dev_err(&data->client->dev, "Multi-reg write failed (%d)\n", ret);
+ return ret;
+ }
+
+ dev_info(&data->client->dev, "Gesture Sensor Registers Initialized\n");
+ return 0;
+}
+
+static int paj7620_power_down(struct paj7620_data *data)
+{
+ int ret;
+ /* Deep sleep sequence */
+ ret = regmap_write(data->regmap, PAJ7620_REG_BANK_SEL, 0x00);
+ if (ret)
+ return ret;
+
+ ret = regmap_write(data->regmap, PAJ7620_REG_SLEEP_BANK0, 0x01);
+ if (ret)
+ return ret;
+
+ ret = regmap_write(data->regmap, PAJ7620_REG_BANK_SEL, 0x01);
+ if (ret)
+ return ret;
+
+ ret = regmap_write(data->regmap, PAJ7620_REG_SLEEP_BANK1, 0x01);
+ if (ret)
+ return ret;
+
+ return 0;
+}
+
+static int paj7620_runtime_suspend(struct device *dev)
+{
+ int ret;
+ struct paj7620_data *data = dev_get_drvdata(dev);
+
+ ret = regmap_write(data->regmap, PAJ7620_REG_BANK_SEL, 0x01);
+ if (ret)
+ return ret;
+
+ ret = regmap_write(data->regmap, PAJ7620_REG_AUTO_STANDBY, 0x30);
+ if (ret)
+ return ret;
+
+ return 0;
+}
+
+static int paj7620_runtime_resume(struct device *dev)
+{
+ int ret;
+ struct paj7620_data *data = dev_get_drvdata(dev);
+
+ ret = regmap_write(data->regmap, PAJ7620_REG_BANK_SEL, 0x01);
+ if (ret)
+ return ret;
+
+ ret = regmap_write(data->regmap, PAJ7620_REG_AUTO_STANDBY, 0x00);
+ if (ret)
+ return ret;
+
+ ret = regmap_write(data->regmap, PAJ7620_REG_BANK_SEL, 0x00);
+ if (ret)
+ return ret;
+
+ usleep_range(1000, 2000); // Stabilization delay (1ms minimum)
+ return 0;
+}
+
+static const struct dev_pm_ops paj7620_pm_ops = {
+ SET_RUNTIME_PM_OPS(paj7620_runtime_suspend, paj7620_runtime_resume, NULL)
+ SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
+};
+
+static const struct regmap_config paj7620_reg_config = {
+ .reg_bits = 8, .val_bits = 8, .max_register = 0xEF,
+};
+
+static int paj7620_probe(struct i2c_client *client)
+{
+ struct paj7620_data *data;
+ int ret;
+
+ data = devm_kzalloc(&client->dev, sizeof(*data), GFP_KERNEL);
+ if (!data)
+ return -ENOMEM;
+
+ data->client = client;
+ i2c_set_clientdata(client, data);
+
+ data->supplies[0].supply = "vdd";
+ data->supplies[1].supply = "vbus";
+ data->supplies[2].supply = "vled";
+
+ ret = devm_regulator_bulk_get(&client->dev, ARRAY_SIZE(data->supplies), data->supplies);
+ if (ret)
+ return dev_err_probe(&client->dev, ret, "Failed to get regulators\n");
+
+ ret = regulator_bulk_enable(ARRAY_SIZE(data->supplies), data->supplies);
+ if (ret)
+ return ret;
+
+ data->regmap = devm_regmap_init_i2c(client, &paj7620_reg_config);
+ if (IS_ERR(data->regmap))
+ return PTR_ERR(data->regmap);
+
+ ret = paj7620_init(data);
+ if (ret)
+ goto err_reg;
+
+ data->idev = devm_input_allocate_device(&client->dev);
+ if (!data->idev) {
+ ret = -ENOMEM; goto err_reg;
+ }
+
+ data->idev->name = "PAJ7620 Gesture Sensor";
+ data->idev->id.bustype = BUS_I2C;
+
+ input_set_capability(data->idev, EV_KEY, KEY_UP);
+ input_set_capability(data->idev, EV_KEY, KEY_DOWN);
+ input_set_capability(data->idev, EV_KEY, KEY_LEFT);
+ input_set_capability(data->idev, EV_KEY, KEY_RIGHT);
+ input_set_capability(data->idev, EV_KEY, KEY_ENTER);
+ input_set_capability(data->idev, EV_KEY, KEY_BACK);
+ input_set_capability(data->idev, EV_KEY, KEY_NEXT);
+ input_set_capability(data->idev, EV_KEY, KEY_PREVIOUS);
+ input_set_capability(data->idev, EV_KEY, KEY_MENU);
+
+ ret = input_register_device(data->idev);
+ if (ret)
+ goto err_reg;
+
+ pm_runtime_set_active(&client->dev);
+ pm_runtime_enable(&client->dev);
+ pm_runtime_set_autosuspend_delay(&client->dev, 2000);
+ pm_runtime_use_autosuspend(&client->dev);
+
+ ret = devm_request_threaded_irq(&client->dev, client->irq, NULL,
+ paj7620_irq_thread, IRQF_ONESHOT,
+ "paj7620", data);
+ if (ret)
+ goto err_reg;
+
+ dev_info(&client->dev, "Gesture Sensor Initialized\n");
+ return 0;
+
+err_reg:
+ dev_err_probe(&client->dev, ret, "%s: failed with error %d\n", __func__, ret);
+ if (pm_runtime_enabled(&client->dev)) {
+ pm_runtime_disable(&client->dev);
+ pm_runtime_dont_use_autosuspend(&client->dev);
+ }
+ regulator_bulk_disable(ARRAY_SIZE(data->supplies), data->supplies);
+ return ret;
+}
+
+static void paj7620_remove(struct i2c_client *client)
+{
+ int ret;
+ struct paj7620_data *data = i2c_get_clientdata(client);
+
+ pm_runtime_get_sync(&client->dev);
+ pm_runtime_disable(&client->dev);
+ pm_runtime_dont_use_autosuspend(&client->dev);
+ pm_runtime_put_noidle(&client->dev);
+
+ ret = paj7620_power_down(data);
+ if (ret)
+ dev_err(&data->client->dev, "Sensor power down failed\n");
+
+ ret = regulator_bulk_disable(ARRAY_SIZE(data->supplies), data->supplies);
+ if (ret)
+ dev_err(&data->client->dev, "Sensor regulator disable failed\n");
+}
+
+static const struct of_device_id paj7620_of_match[] = {
+ { .compatible = "pixart,paj7620" },
+ { }
+};
+MODULE_DEVICE_TABLE(of, paj7620_of_match);
+
+static struct i2c_driver paj7620_driver = {
+ .driver = {
+ .name = "paj7620",
+ .of_match_table = paj7620_of_match,
+ .pm = &paj7620_pm_ops,
+ },
+ .probe = paj7620_probe,
+ .remove = paj7620_remove,
+};
+module_i2c_driver(paj7620_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Harpreet Saini");
+MODULE_DESCRIPTION("PAJ7620 Gesture Input Driver");
--
2.43.0
^ permalink raw reply related
* [PATCH v2 1/2] dt-bindings: input: Add PixArt PAJ7620 gesture sensor
From: Harpreet Saini @ 2026-04-17 5:25 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley
Cc: David Lechner, Harpreet Saini, devicetree, linux-input,
linux-kernel
In-Reply-To: <20260417052527.62535-1-sainiharpreet29@yahoo.com>
Signed-off-by: Harpreet Saini <sainiharpreet29@yahoo.com>
---
.../bindings/input/pixart,paj7620.yaml | 70 +++++++++++++++++++
.../devicetree/bindings/vendor-prefixes.yaml | 2 +
2 files changed, 72 insertions(+)
create mode 100644 Documentation/devicetree/bindings/input/pixart,paj7620.yaml
diff --git a/Documentation/devicetree/bindings/input/pixart,paj7620.yaml b/Documentation/devicetree/bindings/input/pixart,paj7620.yaml
new file mode 100644
index 000000000000..d4f58b712810
--- /dev/null
+++ b/Documentation/devicetree/bindings/input/pixart,paj7620.yaml
@@ -0,0 +1,70 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org
+$schema: http://devicetree.org
+
+title: PixArt PAJ7620 Gesture Sensor
+
+maintainers:
+ - Harpreet Saini <sainiharpreet29@yahoo.com>
+
+description: |
+ The PixArt PAJ7620 is a gesture recognition sensor with an integrated
+ infrared LED and CMOS array. It communicates over an I2C interface and
+ provides gesture data via a dedicated interrupt pin.
+
+properties:
+ compatible:
+ const: pixart,paj7620
+
+ reg:
+ maxItems: 1
+
+ interrupts:
+ maxItems: 1
+
+ vdd-supply:
+ description: Main power supply.
+
+ vbus-supply:
+ description: I/O and I2C bus power supply.
+
+ vled-supply:
+ description: Power for the integrated IR LED.
+
+ # Added per reviewer request for completeness
+ gpio-controller: true
+
+ "#gpio-cells":
+ const: 2
+
+required:
+ - compatible
+ - reg
+ - interrupts
+ - vdd-supply
+ - vbus-supply
+ - vled-supply
+
+additionalProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/interrupt-controller/irq.h>
+ i2c {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ gesture@73 {
+ compatible = "pixart,paj7620";
+ reg = <0x73>;
+ interrupt-parent = <&gpio>;
+ interrupts = <4 IRQ_TYPE_EDGE_FALLING>;
+ vdd-supply = <®_3v3>;
+ vbus-supply = <®_1v8>;
+ vled-supply = <®_3v3>;
+ gpio-controller;
+ #gpio-cells = <2>;
+ };
+ };
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml
index ee7fd3cfe203..d73a0bf62b62 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
+++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
@@ -1273,6 +1273,8 @@ patternProperties:
description: Pine64
"^pineriver,.*":
description: Shenzhen PineRiver Designs Co., Ltd.
+ "^pixart,.*":
+ description: PixArt Imaging Inc.
"^pixcir,.*":
description: PIXCIR MICROELECTRONICS Co., Ltd
"^plantower,.*":
--
2.43.0
^ permalink raw reply related
* [PATCH v2 0/2] input: misc: Add PixArt PAJ7620 gesture sensor
From: Harpreet Saini @ 2026-04-17 5:25 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley
Cc: David Lechner, Harpreet Saini, devicetree, linux-input,
linux-kernel
In-Reply-To: <20260417052527.62535-1-sainiharpreet29.ref@yahoo.com>
This series adds support for the PixArt PAJ7620 gesture sensor.
Following review feedback on v1, the driver has been moved from IIO
to the Input subsystem as gestures are user-interaction events.
The bindings have been updated to include mandatory power supplies
and GPIO controller properties.
Changes in v2:
- Moved driver from drivers/iio/light to drivers/input/misc
- Updated DT bindings to include mandatory vdd, vbus, and vled supplies
- Added Runtime PM support with autosuspend logic
- Combined bindings and driver into a single series
Harpreet Saini (2):
dt-bindings: input: Add PixArt PAJ7620 gesture sensor
input: misc: Add PixArt PAJ7620 gesture sensor driver
.../bindings/input/pixart,paj7620.yaml | 70 ++++
.../devicetree/bindings/vendor-prefixes.yaml | 2 +
drivers/input/misc/Kconfig | 12 +
drivers/input/misc/Makefile | 1 +
drivers/input/misc/paj7620.c | 350 ++++++++++++++++++
5 files changed, 435 insertions(+)
create mode 100644 Documentation/devicetree/bindings/input/pixart,paj7620.yaml
create mode 100644 drivers/input/misc/paj7620.c
--
2.43.0
^ permalink raw reply
* [PATCH] dt-bindings: Remove the redundant 'type: boolean'
From: phucduc.bui @ 2026-04-17 2:18 UTC (permalink / raw)
To: robh, krzk+dt, conor+dt
Cc: nick, dmitry.torokhov, nicolas.ferre, alexandre.belloni,
claudiu.beznea, lee, heiko, gregkh, linusw, zyw, zhangqing,
gene_chen, linux-input, devicetree, linux-arm-kernel, linux-usb,
bui duc phuc
From: bui duc phuc <phucduc.bui@gmail.com>
The 'wakeup-source' property already has its type defined in the core
schema. Remove the redundant 'type: boolean' from the binding file to
clean up the binding files.
Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
---
Documentation/devicetree/bindings/input/atmel,maxtouch.yaml | 3 +--
Documentation/devicetree/bindings/mfd/rockchip,rk816.yaml | 3 +--
Documentation/devicetree/bindings/usb/richtek,rt1711h.yaml | 3 +--
3 files changed, 3 insertions(+), 6 deletions(-)
diff --git a/Documentation/devicetree/bindings/input/atmel,maxtouch.yaml b/Documentation/devicetree/bindings/input/atmel,maxtouch.yaml
index 9bf07acea599..26ea78df27c4 100644
--- a/Documentation/devicetree/bindings/input/atmel,maxtouch.yaml
+++ b/Documentation/devicetree/bindings/input/atmel,maxtouch.yaml
@@ -88,8 +88,7 @@ properties:
- 2 # ATMEL_MXT_WAKEUP_GPIO
default: 0
- wakeup-source:
- type: boolean
+ wakeup-source: true
required:
- compatible
diff --git a/Documentation/devicetree/bindings/mfd/rockchip,rk816.yaml b/Documentation/devicetree/bindings/mfd/rockchip,rk816.yaml
index 0676890f101e..a58d9455a1a5 100644
--- a/Documentation/devicetree/bindings/mfd/rockchip,rk816.yaml
+++ b/Documentation/devicetree/bindings/mfd/rockchip,rk816.yaml
@@ -44,8 +44,7 @@ properties:
description:
Telling whether or not this PMIC is controlling the system power.
- wakeup-source:
- type: boolean
+ wakeup-source: true
vcc1-supply:
description:
diff --git a/Documentation/devicetree/bindings/usb/richtek,rt1711h.yaml b/Documentation/devicetree/bindings/usb/richtek,rt1711h.yaml
index ae611f7e57ca..ec0d83220527 100644
--- a/Documentation/devicetree/bindings/usb/richtek,rt1711h.yaml
+++ b/Documentation/devicetree/bindings/usb/richtek,rt1711h.yaml
@@ -33,8 +33,7 @@ properties:
vbus-supply:
description: VBUS power supply
- wakeup-source:
- type: boolean
+ wakeup-source: true
connector:
type: object
--
2.43.0
^ permalink raw reply related
* Re: [PATCH v2 1/3] HID: nintendo: Add preliminary Switch 2 controller driver
From: Silvan Jegen @ 2026-04-16 17:38 UTC (permalink / raw)
To: Vicki Pfau; +Cc: Dmitry Torokhov, Jiri Kosina, Benjamin Tissoires, linux-input
In-Reply-To: <092fa3e7-da59-4b3a-b3e4-c412e391fd3d@endrift.com>
Vicki Pfau <vi@endrift.com> wrote:
>
>
> On 4/11/26 8:29 AM, Silvan Jegen wrote:
> > Vicki Pfau <vi@endrift.com> wrote:
> >> On 4/10/26 12:44, Silvan Jegen wrote:
> >>> Vicki Pfau <vi@endrift.com> wrote:
> >>>> Replies inline
> >>>>
> >>>> On 4/8/26 12:51, Silvan Jegen wrote:
> >>>>> Heyhey!
> >>>>>
> >>>>> Vicki Pfau <vi@endrift.com> wrote:
> >>>>>> Hi,
> >>>>>>
> >>>>>> Replies inline
> >>>>>>
> >>>>>> On 4/2/26 12:09 PM, Silvan Jegen wrote:
> >>>>>>> Hi
> >>>>>>>
> >>>>>>> Thanks for the patch!
> >>>>>>>
> >>>>>>> Just some comments and questions inline below.
> >>>>>>>
> >>>>>>> Vicki Pfau <vi@endrift.com> wrote:
> >>>>>>>>
> >>>>>>>> [...]
> >>>>>>>>
> >>>>>>>> +
> >>>>>>>> +static int switch2_set_report_format(struct switch2_controller *ns2, enum switch2_report_id fmt)
> >>>>>>>> +{
> >>>>>>>> + __le32 format_id = __cpu_to_le32(fmt);
> >>>>>>>> +
> >>>>>>>> + if (!ns2->cfg)
> >>>>>>>> + return -ENOTCONN;
> >>>>>>>> + return ns2->cfg->send_command(NS2_CMD_INIT, NS2_SUBCMD_INIT_SELECT_REPORT,
> >>>>>>>> + &format_id, sizeof(format_id),
> >>>>>>>> + ns2->cfg);
> >>>>>>>> +}
> >>>>>>>> +
> >>>>>>>> +static int switch2_init_controller(struct switch2_controller *ns2)
> >>>>>>>
> >>>>>>> This is now a recursive call while in v1 it wasn't. I think I preferred
> >>>>>>> the non-recursive version as there was one place where init_step
> >>>>>>> state was changed while now I am not sure where it happens (and whether
> >>>>>>> there is a code path where we end up in an infinite recursion)
> >>>>>>>
> >>>>>>> What is the advantage of the recursive version compared to the
> >>>>>>> non-recursive one?
> >>>>> >
> >>>>>>
> >>>>>> The old version incremented the step regardless of whether or not it
> >>>>>> could confirm it had happened. Since the confirmation is now handled
> >>>>>> with an external step, calling into switch2_init_step_done, the loop
> >>>>>> condition would become somewhat complicated.
> >>>>>> I replaced it with explicit tail calls since that make the
> >>>>>> control flow simplier, and it is always matched with a call to
> >>>>>> switch2_init_step_done to ensure that the state is always advanced. As
> >>>>>
> >>>>> From what I can tell switch2_init_step_done currently only advances
> >>>>> the state if the current state is the expected one. This seems fine,
> >>>>> but it also means that if the state is not the expected one, the
> >>>>> state is not advanced and the recursive call continues anyway (in the
> >>>>> NS2_INIT_READ_USER_SECONDARY_CALIB case, for example). I assume this
> >>>>> should never happen but if we end up in this case for some reason we
> >>>>> will recurse forever.
> >>>>
> >>>> That's correct, and the only way it would happen forever is if there's a
> >>>> bug. The same would be true in a loop version if it doesn't advance the
> >>>> state properly either, fwiw, which happened during development of this
> >>>> version. Regardless, I can reduce the chance of introducing such a bug
> >>>> by passing ns2->init_step instead of a constant, so I'll make that
> >>>> change in v4.
> >>>>
> >>>>>
> >>>>> The same case also potentially calls switch2_read_flash and it isn't
> >>>>> clear to me if this means that the initialisation is done (as there
> >>>>> is no switch2_init_step_done call and we are not in the FINISH state
> >>>>> either). There is also the possibility of switch2_read_flash calling
> >>>>> switch2_init_controller again, which one then has to check ... (note
> >>>>> that this is not the case here though)
> >>>>
> >>>> switch2_handle_flash_read will advance the state once it's verified that
> >>>> the read actually happened. If the step failed for whatever reason, this
> >>>> same codepath will retry the specific read, as the caller
> >>>> (switch2_receive_command) will always call into switch2_init_controller
> >>>> if setup isn't done. This is how the retry logic works.
> >>>
> >>> Ah, so the call chain looks something like the below?
> >>>
> >>> switch2_read_flash->
> >>> switch2_usb_send_cmd->
> >>> switch2_usb_message_in_work (?)->
> >>> switch2_receive_command->
> >>> switch2_handle_flash_read->
> >>> switch2_init_step_done
> >>
> >> Yes, and then switch2_init_controller is called again at the end of
> >> switch2_receive_command
> >>>
> >>>>
> >>>>>
> >>>>> To me it seems like it would be clearer to do a `ns2->init_step++` and
> >>>>> then `continue` to make the progress of the state more visible and to
> >>>>> do an explicit `break` when we are supposed to stop the initialisation.
> >>>>>
> >>>>
> >>>> The problem with the loop approach, in my opinion is due to the fact
> >>>> that the loop is the *exception*, not the rule. The loop idiom makes it
> >>>> look like a loop is expected. Further the ns2->init_step++ in the
> >>>> previous version means that the verification does not occur, so in the
> >>>> case of any sort of failure it'll plow ahead anyway instead of retrying.
> >>>> The point of this approach is to avoid that.
> >>>
> >>> In my mind a while-loop like you mentioned it above would make the state
> >>> changes more obvious (since they could all be done in the loop body), while
> >>> still allowing for retries. Something like the below, perhaps (untested).
> >>>
> >>> while (ns2->init_step < NS2_INIT_DONE) {
> >>> switch (ns2->init_step) {
> >>> ...
> >>> case NS2_INIT_READ_FACTORY_TRIGGER_CALIB:
> >>> if (ns2->ctlr_type != NS2_CTLR_TYPE_GC) {
> >>> ns->init_step++
> >>> continue;
> >>> }
> >>>
> >>> ret = switch2_read_flash(ns2, NS2_FLASH_ADDR_FACTORY_TRIGGER_CALIB,
> >>> NS2_FLASH_SIZE_FACTORY_TRIGGER_CALIB);
> >>> if (ret) {
> >>> // if it makes sense to retry here
> >>> continue;
> >>> }
> >>>
> >>> ns->init_step++
> >>> break;
> >>>
> >>> case ...
> >>> }
> >>> }
> >>>
> >>
> >> This can't be done because the process is fundamentally asynchronous.
> >> We'd have to block on waiting for a reply to the USB packet, which is
> >> not a good idea. This is why switch2_receive_command calls into
> >> switch2_init_controller at the end: it's resuming where it left off.
> >
> > Ah, that wasn't clear to me either.
> >
> > I assume having the code wait for the reply is not allowed because
> > otherwise it would stall the whole bootup process (or will there be some
> > sort of dedicated Kthread for this)?
>
> I'm not sure there is a synchronous USB API at all, but if there is it
> should really only be used when absolutely necessary. If you can get
> away without blocking, do.
Makes sense!
> >
> > Are you aware of any documentation where I can read up on how the probing
> > of USB HID devices work in the Linux Kernel?
>
> This has nothing to do with HID, actually. The Switch 2 controllers
> have a proprietary side-channel interface that we need to poke at here
> to get it to do anything. It's called cfg in the code and over USB
> it uses a bulk interface, which is unusual. Presumably because the
I have seen this part of the code, but have assumed that it's actually
part of the regular HID spec ...
> side-channel doesn't care about latency, whereas the HID interface
> does. Something similar happens over bluetooth where they're accessed
> through disparate attributes. The latter isn't handled here yet,
> though.
>
> >
> > Thanks for the help!
> >
> >> Each of those returns is a step that interacts with the hardware, and we
> >> need to wait for the hardware to reply.
> >>
> >> There is a potential weird interaction here whereby if we get an
> >> unprompted command and/or reply from the controller it will retry a step
> >> before it gets a reply for it, but in practice this doesn't happen. The
> >> controllers, as far as we know, only reply and never initiate any
> >> commands. Furthermore, all of these steps are also idempotent, so it's
> >> not a big deal of they get repeated erroneously.
> >
> > Could there be another reply incoming while the driver is still processing
> > the previous one? I assume at least at probing time that shouldn't be
> > the case. I wouldn't expect an USB HID device to send unsolicited replies
> > in general ...
>
> Replies only come in one at a time. Unless we send multiple messages
> without waiting for a reply first, which this code is specifically
> designed *not* to do, I don't think it will happen in practice.
That's what I would have expected as well. Thanks for clearing that up!
Cheers,
Silvan
^ permalink raw reply
* Non-functional keyboard on Lenovo 14IPH11 (Panther-lake)
From: Thomas Gillespie @ 2026-04-16 15:56 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input
[-- Attachment #1.1: Type: text/plain, Size: 639 bytes --]
The built-in keyboard on my Lenovo 14IPH11 laptop is completely non-functional under Linux. The device does not appear in `/proc/bus/input/devices`, suggesting it is not being enumerated by the kernel at all. The keyboard works correctly in the BIOS and GRUB, and an external USB keyboard functions normally under Linux.
I have tested this under NixOS with kernel versions 6.9.11 and 7.0.0-rc. I've also tested with an Arch Linux live ISO.
I've attached a collection of diagnostic output, which is hopefully helpful. Please let me know if there's anything else I can send, or if there's anything that you'd like me to run as a test.
Tom
[-- Attachment #1.2: Type: text/html, Size: 1691 bytes --]
[-- Attachment #2: diag.tar.gz --]
[-- Type: application/gzip, Size: 32070 bytes --]
^ permalink raw reply
* [PATCH v2 4/4] HID: wacom: use __free(kfree) to clean up temporary buffers
From: Benjamin Tissoires @ 2026-04-16 14:48 UTC (permalink / raw)
To: Jiri Kosina, Filipe Laíns, Bastien Nocera, Ping Cheng,
Jason Gerecke, Viresh Kumar, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Lee Jones
Cc: linux-input, linux-kernel, greybus-dev, linux-staging, linux-usb,
Benjamin Tissoires
In-Reply-To: <20260416-wip-fix-core-v2-0-be92570e5627@kernel.org>
This simplifies error handling and protects against memory leaks.
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
drivers/hid/wacom_sys.c | 40 +++++++++++++---------------------------
1 file changed, 13 insertions(+), 27 deletions(-)
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index a32320b351e3..adb31f54e524 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -70,11 +70,10 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
{
while (!kfifo_is_empty(fifo)) {
int size = kfifo_peek_len(fifo);
- u8 *buf;
unsigned int count;
int err;
- buf = kzalloc(size, GFP_KERNEL);
+ u8 *buf __free(kfree) = kzalloc(size, GFP_KERNEL);
if (!buf) {
kfifo_skip(fifo);
continue;
@@ -87,7 +86,6 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
// to flush seems reasonable enough, however.
hid_warn(hdev, "%s: removed fifo entry with unexpected size\n",
__func__);
- kfree(buf);
continue;
}
err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, size, false);
@@ -95,8 +93,6 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
hid_warn(hdev, "%s: unable to flush event due to error %d\n",
__func__, err);
}
-
- kfree(buf);
}
}
@@ -311,7 +307,6 @@ static void wacom_feature_mapping(struct hid_device *hdev,
struct wacom_features *features = &wacom->wacom_wac.features;
struct hid_data *hid_data = &wacom->wacom_wac.hid_data;
unsigned int equivalent_usage = wacom_equivalent_usage(usage->hid);
- u8 *data;
int ret;
u32 n;
@@ -325,10 +320,11 @@ static void wacom_feature_mapping(struct hid_device *hdev,
/* leave touch_max as is if predefined */
if (!features->touch_max) {
/* read manually */
- n = hid_report_len(field->report);
- data = hid_alloc_report_buf(field->report, GFP_KERNEL);
+ u8 *data __free(kfree) = hid_alloc_report_buf(field->report, GFP_KERNEL);
+
if (!data)
break;
+ n = hid_report_len(field->report);
data[0] = field->report->id;
ret = wacom_get_report(hdev, HID_FEATURE_REPORT,
data, n, WAC_CMD_RETRIES);
@@ -344,7 +340,6 @@ static void wacom_feature_mapping(struct hid_device *hdev,
"defaulting to %d\n",
features->touch_max);
}
- kfree(data);
}
break;
case HID_DG_INPUTMODE:
@@ -386,10 +381,11 @@ static void wacom_feature_mapping(struct hid_device *hdev,
case WACOM_HID_WD_OFFSETRIGHT:
case WACOM_HID_WD_OFFSETBOTTOM:
/* read manually */
- n = hid_report_len(field->report);
- data = hid_alloc_report_buf(field->report, GFP_KERNEL);
+ u8 *data __free(kfree) = hid_alloc_report_buf(field->report, GFP_KERNEL);
+
if (!data)
break;
+ n = hid_report_len(field->report);
data[0] = field->report->id;
ret = wacom_get_report(hdev, HID_FEATURE_REPORT,
data, n, WAC_CMD_RETRIES);
@@ -400,7 +396,6 @@ static void wacom_feature_mapping(struct hid_device *hdev,
hid_warn(hdev, "%s: could not retrieve sensor offsets\n",
__func__);
}
- kfree(data);
break;
}
}
@@ -581,7 +576,6 @@ static int wacom_hid_set_device_mode(struct hid_device *hdev)
static int wacom_set_device_mode(struct hid_device *hdev,
struct wacom_wac *wacom_wac)
{
- u8 *rep_data;
struct hid_report *r;
struct hid_report_enum *re;
u32 length;
@@ -595,7 +589,7 @@ static int wacom_set_device_mode(struct hid_device *hdev,
if (!r)
return -EINVAL;
- rep_data = hid_alloc_report_buf(r, GFP_KERNEL);
+ u8 *rep_data __free(kfree) = hid_alloc_report_buf(r, GFP_KERNEL);
if (!rep_data)
return -ENOMEM;
@@ -614,8 +608,6 @@ static int wacom_set_device_mode(struct hid_device *hdev,
rep_data[1] != wacom_wac->mode_report &&
limit++ < WAC_MSG_RETRIES);
- kfree(rep_data);
-
return error < 0 ? error : 0;
}
@@ -921,7 +913,6 @@ static int wacom_add_shared_data(struct hid_device *hdev)
static int wacom_led_control(struct wacom *wacom)
{
- unsigned char *buf;
int retval;
unsigned char report_id = WAC_CMD_LED_CONTROL;
int buf_size = 9;
@@ -940,7 +931,8 @@ static int wacom_led_control(struct wacom *wacom)
report_id = WAC_CMD_WL_INTUOSP2;
buf_size = 51;
}
- buf = kzalloc(buf_size, GFP_KERNEL);
+
+ unsigned char *buf __free(kfree) = kzalloc(buf_size, GFP_KERNEL);
if (!buf)
return -ENOMEM;
@@ -996,7 +988,6 @@ static int wacom_led_control(struct wacom *wacom)
retval = wacom_set_report(wacom->hdev, HID_FEATURE_REPORT, buf, buf_size,
WAC_CMD_RETRIES);
- kfree(buf);
return retval;
}
@@ -1004,11 +995,10 @@ static int wacom_led_control(struct wacom *wacom)
static int wacom_led_putimage(struct wacom *wacom, int button_id, u8 xfer_id,
const unsigned len, const void *img)
{
- unsigned char *buf;
int i, retval;
const unsigned chunk_len = len / 4; /* 4 chunks are needed to be sent */
- buf = kzalloc(chunk_len + 3 , GFP_KERNEL);
+ unsigned char *buf __free(kfree) = kzalloc(chunk_len + 3, GFP_KERNEL);
if (!buf)
return -ENOMEM;
@@ -1018,7 +1008,7 @@ static int wacom_led_putimage(struct wacom *wacom, int button_id, u8 xfer_id,
retval = wacom_set_report(wacom->hdev, HID_FEATURE_REPORT, buf, 2,
WAC_CMD_RETRIES);
if (retval < 0)
- goto out;
+ return retval;
buf[0] = xfer_id;
buf[1] = button_id & 0x07;
@@ -1038,8 +1028,6 @@ static int wacom_led_putimage(struct wacom *wacom, int button_id, u8 xfer_id,
wacom_set_report(wacom->hdev, HID_FEATURE_REPORT, buf, 2,
WAC_CMD_RETRIES);
-out:
- kfree(buf);
return retval;
}
@@ -1948,10 +1936,9 @@ static int wacom_remote_create_attr_group(struct wacom *wacom, __u32 serial,
static int wacom_cmd_unpair_remote(struct wacom *wacom, unsigned char selector)
{
const size_t buf_size = 2;
- unsigned char *buf;
int retval;
- buf = kzalloc(buf_size, GFP_KERNEL);
+ unsigned char *buf __free(kfree) = kzalloc(buf_size, GFP_KERNEL);
if (!buf)
return -ENOMEM;
@@ -1960,7 +1947,6 @@ static int wacom_cmd_unpair_remote(struct wacom *wacom, unsigned char selector)
retval = wacom_set_report(wacom->hdev, HID_OUTPUT_REPORT, buf,
buf_size, WAC_CMD_RETRIES);
- kfree(buf);
return retval;
}
--
2.53.0
^ permalink raw reply related
* [PATCH v2 3/4] HID: multitouch: use __free(kfree) to clean up temporary buffers
From: Benjamin Tissoires @ 2026-04-16 14:48 UTC (permalink / raw)
To: Jiri Kosina, Filipe Laíns, Bastien Nocera, Ping Cheng,
Jason Gerecke, Viresh Kumar, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Lee Jones
Cc: linux-input, linux-kernel, greybus-dev, linux-staging, linux-usb,
Benjamin Tissoires
In-Reply-To: <20260416-wip-fix-core-v2-0-be92570e5627@kernel.org>
This simplifies error handling and protects against memory leaks.
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
drivers/hid/hid-multitouch.c | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index eeab0b6e32cc..b19463e545d6 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -507,7 +507,6 @@ static void mt_get_feature(struct hid_device *hdev, struct hid_report *report)
{
int ret;
u32 size = hid_report_len(report);
- u8 *buf;
/*
* Do not fetch the feature report if the device has been explicitly
@@ -516,7 +515,7 @@ static void mt_get_feature(struct hid_device *hdev, struct hid_report *report)
if (hdev->quirks & HID_QUIRK_NO_INIT_REPORTS)
return;
- buf = hid_alloc_report_buf(report, GFP_KERNEL);
+ u8 *buf __free(kfree) = hid_alloc_report_buf(report, GFP_KERNEL);
if (!buf)
return;
@@ -529,7 +528,7 @@ static void mt_get_feature(struct hid_device *hdev, struct hid_report *report)
/* The report ID in the request and the response should match */
if (report->id != buf[0]) {
hid_err(hdev, "Returned feature report did not match the request\n");
- goto free;
+ return;
}
ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf,
@@ -537,9 +536,6 @@ static void mt_get_feature(struct hid_device *hdev, struct hid_report *report)
if (ret)
dev_warn(&hdev->dev, "failed to report feature\n");
}
-
-free:
- kfree(buf);
}
static void mt_feature_mapping(struct hid_device *hdev,
@@ -1658,7 +1654,6 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev,
struct mt_class *cls = &td->mtclass;
struct hid_report *report = field->report;
unsigned int index = usage->usage_index;
- char *buf;
u32 report_len;
int max;
@@ -1673,17 +1668,18 @@ static bool mt_need_to_apply_feature(struct hid_device *hdev,
return false;
if (cls->quirks & MT_QUIRK_FORCE_GET_FEATURE) {
- report_len = hid_report_len(report);
- buf = hid_alloc_report_buf(report, GFP_KERNEL);
+ char *buf __free(kfree) = hid_alloc_report_buf(report, GFP_KERNEL);
+
if (!buf) {
hid_err(hdev,
"failed to allocate buffer for report\n");
return false;
}
+
+ report_len = hid_report_len(report);
hid_hw_raw_request(hdev, report->id, buf, report_len,
HID_FEATURE_REPORT,
HID_REQ_GET_REPORT);
- kfree(buf);
}
field->value[index] = td->inputmode_value;
--
2.53.0
^ permalink raw reply related
* [PATCH v2 2/4] HID: core: introduce hid_safe_input_report()
From: Benjamin Tissoires @ 2026-04-16 14:48 UTC (permalink / raw)
To: Jiri Kosina, Filipe Laíns, Bastien Nocera, Ping Cheng,
Jason Gerecke, Viresh Kumar, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Lee Jones
Cc: linux-input, linux-kernel, greybus-dev, linux-staging, linux-usb,
Benjamin Tissoires, stable
In-Reply-To: <20260416-wip-fix-core-v2-0-be92570e5627@kernel.org>
hid_input_report() is used in too many places to have a commit that
doesn't cross subsystem borders. Instead of changing the API, introduce
a new one when things matters in the transport layers:
- usbhid
- i2chid
This effectively revert to the old behavior for those two transport
layers.
Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
drivers/hid/hid-core.c | 25 +++++++++++++++++++++++++
drivers/hid/i2c-hid/i2c-hid-core.c | 7 ++++---
drivers/hid/usbhid/hid-core.c | 11 ++++++-----
include/linux/hid.h | 2 ++
4 files changed, 37 insertions(+), 8 deletions(-)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index a806820df7e5..b3596851c719 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2181,6 +2181,7 @@ static int __hid_input_report(struct hid_device *hid, enum hid_report_type type,
* @interrupt: distinguish between interrupt and control transfers
*
* This is data entry for lower layers.
+ * Legacy, please use hid_safe_input_report() instead.
*/
int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
int interrupt)
@@ -2191,6 +2192,30 @@ int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data
}
EXPORT_SYMBOL_GPL(hid_input_report);
+/**
+ * hid_safe_input_report - report data from lower layer (usb, bt...)
+ *
+ * @hid: hid device
+ * @type: HID report type (HID_*_REPORT)
+ * @data: report contents
+ * @bufsize: allocated size of the data buffer
+ * @size: useful size of data parameter
+ * @interrupt: distinguish between interrupt and control transfers
+ *
+ * This is data entry for lower layers.
+ * Please use this function instead of the non safe version because we provide
+ * here the size of the buffer, allowing hid-core to make smarter decisions
+ * regarding the incoming buffer.
+ */
+int hid_safe_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data,
+ size_t bufsize, u32 size, int interrupt)
+{
+ return __hid_input_report(hid, type, data, bufsize, size, interrupt, 0,
+ false, /* from_bpf */
+ false /* lock_already_taken */);
+}
+EXPORT_SYMBOL_GPL(hid_safe_input_report);
+
bool hid_match_one_id(const struct hid_device *hdev,
const struct hid_device_id *id)
{
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 5a183af3d5c6..e0a302544cef 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -574,9 +574,10 @@ static void i2c_hid_get_input(struct i2c_hid *ihid)
if (ihid->hid->group != HID_GROUP_RMI)
pm_wakeup_event(&ihid->client->dev, 0);
- hid_input_report(ihid->hid, HID_INPUT_REPORT,
- ihid->inbuf + sizeof(__le16),
- ret_size - sizeof(__le16), 1);
+ hid_safe_input_report(ihid->hid, HID_INPUT_REPORT,
+ ihid->inbuf + sizeof(__le16),
+ ihid->bufsize - sizeof(__le16),
+ ret_size - sizeof(__le16), 1);
}
return;
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index fbbfc0f60829..5af93b9b1fb5 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -283,9 +283,9 @@ static void hid_irq_in(struct urb *urb)
break;
usbhid_mark_busy(usbhid);
if (!test_bit(HID_RESUME_RUNNING, &usbhid->iofl)) {
- hid_input_report(urb->context, HID_INPUT_REPORT,
- urb->transfer_buffer,
- urb->actual_length, 1);
+ hid_safe_input_report(urb->context, HID_INPUT_REPORT,
+ urb->transfer_buffer, urb->transfer_buffer_length,
+ urb->actual_length, 1);
/*
* autosuspend refused while keys are pressed
* because most keyboards don't wake up when
@@ -482,9 +482,10 @@ static void hid_ctrl(struct urb *urb)
switch (status) {
case 0: /* success */
if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_IN)
- hid_input_report(urb->context,
+ hid_safe_input_report(urb->context,
usbhid->ctrl[usbhid->ctrltail].report->type,
- urb->transfer_buffer, urb->actual_length, 0);
+ urb->transfer_buffer, urb->transfer_buffer_length,
+ urb->actual_length, 0);
break;
case -ESHUTDOWN: /* unplug */
unplug = 1;
diff --git a/include/linux/hid.h b/include/linux/hid.h
index ac432a2ef415..bfb9859f391e 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -1030,6 +1030,8 @@ struct hid_field *hid_find_field(struct hid_device *hdev, unsigned int report_ty
int hid_set_field(struct hid_field *, unsigned, __s32);
int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
int interrupt);
+int hid_safe_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data,
+ size_t bufsize, u32 size, int interrupt);
struct hid_field *hidinput_get_led_field(struct hid_device *hid);
unsigned int hidinput_count_leds(struct hid_device *hid);
__s32 hidinput_calc_abs_res(const struct hid_field *field, __u16 code);
--
2.53.0
^ permalink raw reply related
* [PATCH v2 1/4] HID: pass the buffer size to hid_report_raw_event
From: Benjamin Tissoires @ 2026-04-16 14:48 UTC (permalink / raw)
To: Jiri Kosina, Filipe Laíns, Bastien Nocera, Ping Cheng,
Jason Gerecke, Viresh Kumar, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Lee Jones
Cc: linux-input, linux-kernel, greybus-dev, linux-staging, linux-usb,
Benjamin Tissoires, stable
In-Reply-To: <20260416-wip-fix-core-v2-0-be92570e5627@kernel.org>
commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
bogus memset()") enforced the provided data to be at least the size of
the declared buffer in the report descriptor to prevent a buffer
overflow. However, we can try to be smarter by providing both the buffer
size and the data size, meaning that hid_report_raw_event() can make
better decision whether we should plaining reject the buffer (buffer
overflow attempt) or if we can safely memset it to 0 and pass it to the
rest of the stack.
Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
drivers/hid/bpf/hid_bpf_dispatch.c | 6 ++++--
drivers/hid/hid-core.c | 42 +++++++++++++++++++++++++-------------
drivers/hid/hid-gfrm.c | 4 ++--
drivers/hid/hid-logitech-hidpp.c | 2 +-
drivers/hid/hid-multitouch.c | 2 +-
drivers/hid/hid-primax.c | 2 +-
drivers/hid/hid-vivaldi-common.c | 2 +-
drivers/hid/wacom_sys.c | 6 +++---
drivers/staging/greybus/hid.c | 2 +-
include/linux/hid.h | 4 ++--
include/linux/hid_bpf.h | 14 ++++++++-----
11 files changed, 53 insertions(+), 33 deletions(-)
diff --git a/drivers/hid/bpf/hid_bpf_dispatch.c b/drivers/hid/bpf/hid_bpf_dispatch.c
index 50c7b45c59e3..d0130658091b 100644
--- a/drivers/hid/bpf/hid_bpf_dispatch.c
+++ b/drivers/hid/bpf/hid_bpf_dispatch.c
@@ -24,7 +24,8 @@ EXPORT_SYMBOL(hid_ops);
u8 *
dispatch_hid_bpf_device_event(struct hid_device *hdev, enum hid_report_type type, u8 *data,
- u32 *size, int interrupt, u64 source, bool from_bpf)
+ size_t *buf_size, u32 *size, int interrupt, u64 source,
+ bool from_bpf)
{
struct hid_bpf_ctx_kern ctx_kern = {
.ctx = {
@@ -74,6 +75,7 @@ dispatch_hid_bpf_device_event(struct hid_device *hdev, enum hid_report_type type
*size = ret;
}
+ *buf_size = ctx_kern.ctx.allocated_size;
return ctx_kern.data;
}
EXPORT_SYMBOL_GPL(dispatch_hid_bpf_device_event);
@@ -505,7 +507,7 @@ __hid_bpf_input_report(struct hid_bpf_ctx *ctx, enum hid_report_type type, u8 *b
if (ret)
return ret;
- return hid_ops->hid_input_report(ctx->hid, type, buf, size, 0, (u64)(long)ctx, true,
+ return hid_ops->hid_input_report(ctx->hid, type, buf, size, size, 0, (u64)(long)ctx, true,
lock_already_taken);
}
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 61afec5915ec..a806820df7e5 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2033,24 +2033,32 @@ int __hid_request(struct hid_device *hid, struct hid_report *report,
}
EXPORT_SYMBOL_GPL(__hid_request);
-int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
- int interrupt)
+int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data,
+ size_t bufsize, u32 size, int interrupt)
{
struct hid_report_enum *report_enum = hid->report_enum + type;
struct hid_report *report;
struct hid_driver *hdrv;
int max_buffer_size = HID_MAX_BUFFER_SIZE;
u32 rsize, csize = size;
+ size_t bsize = bufsize;
u8 *cdata = data;
int ret = 0;
report = hid_get_report(report_enum, data);
if (!report)
- goto out;
+ return 0;
+
+ if (unlikely(bsize < csize)) {
+ hid_warn_ratelimited(hid, "Event data for report %d is incorrect (%d vs %ld)\n",
+ report->id, csize, bsize);
+ return -EINVAL;
+ }
if (report_enum->numbered) {
cdata++;
csize--;
+ bsize--;
}
rsize = hid_compute_report_size(report);
@@ -2063,11 +2071,16 @@ int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *
else if (rsize > max_buffer_size)
rsize = max_buffer_size;
+ if (bsize < rsize) {
+ hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %ld)\n",
+ report->id, rsize, bsize);
+ return -EINVAL;
+ }
+
if (csize < rsize) {
- hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %d)\n",
- report->id, rsize, csize);
- ret = -EINVAL;
- goto out;
+ dbg_hid("report %d is too short, (%d < %d)\n", report->id,
+ csize, rsize);
+ memset(cdata + csize, 0, rsize - csize);
}
if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)
@@ -2075,7 +2088,7 @@ int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *
if (hid->claimed & HID_CLAIMED_HIDRAW) {
ret = hidraw_report_event(hid, data, size);
if (ret)
- goto out;
+ return ret;
}
if (hid->claimed != HID_CLAIMED_HIDRAW && report->maxfield) {
@@ -2087,15 +2100,15 @@ int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *
if (hid->claimed & HID_CLAIMED_INPUT)
hidinput_report_event(hid, report);
-out:
+
return ret;
}
EXPORT_SYMBOL_GPL(hid_report_raw_event);
static int __hid_input_report(struct hid_device *hid, enum hid_report_type type,
- u8 *data, u32 size, int interrupt, u64 source, bool from_bpf,
- bool lock_already_taken)
+ u8 *data, size_t bufsize, u32 size, int interrupt, u64 source,
+ bool from_bpf, bool lock_already_taken)
{
struct hid_report_enum *report_enum;
struct hid_driver *hdrv;
@@ -2120,7 +2133,8 @@ static int __hid_input_report(struct hid_device *hid, enum hid_report_type type,
report_enum = hid->report_enum + type;
hdrv = hid->driver;
- data = dispatch_hid_bpf_device_event(hid, type, data, &size, interrupt, source, from_bpf);
+ data = dispatch_hid_bpf_device_event(hid, type, data, &bufsize, &size, interrupt,
+ source, from_bpf);
if (IS_ERR(data)) {
ret = PTR_ERR(data);
goto unlock;
@@ -2149,7 +2163,7 @@ static int __hid_input_report(struct hid_device *hid, enum hid_report_type type,
goto unlock;
}
- ret = hid_report_raw_event(hid, type, data, size, interrupt);
+ ret = hid_report_raw_event(hid, type, data, bufsize, size, interrupt);
unlock:
if (!lock_already_taken)
@@ -2171,7 +2185,7 @@ static int __hid_input_report(struct hid_device *hid, enum hid_report_type type,
int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
int interrupt)
{
- return __hid_input_report(hid, type, data, size, interrupt, 0,
+ return __hid_input_report(hid, type, data, size, size, interrupt, 0,
false, /* from_bpf */
false /* lock_already_taken */);
}
diff --git a/drivers/hid/hid-gfrm.c b/drivers/hid/hid-gfrm.c
index 699186ff2349..d2a56bf92b41 100644
--- a/drivers/hid/hid-gfrm.c
+++ b/drivers/hid/hid-gfrm.c
@@ -66,7 +66,7 @@ static int gfrm_raw_event(struct hid_device *hdev, struct hid_report *report,
switch (data[1]) {
case GFRM100_SEARCH_KEY_DOWN:
ret = hid_report_raw_event(hdev, HID_INPUT_REPORT, search_key_dn,
- sizeof(search_key_dn), 1);
+ sizeof(search_key_dn), sizeof(search_key_dn), 1);
break;
case GFRM100_SEARCH_KEY_AUDIO_DATA:
@@ -74,7 +74,7 @@ static int gfrm_raw_event(struct hid_device *hdev, struct hid_report *report,
case GFRM100_SEARCH_KEY_UP:
ret = hid_report_raw_event(hdev, HID_INPUT_REPORT, search_key_up,
- sizeof(search_key_up), 1);
+ sizeof(search_key_up), sizeof(search_key_up), 1);
break;
default:
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index b1330d23bd2d..b3ff9265377b 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3673,7 +3673,7 @@ static int hidpp10_consumer_keys_raw_event(struct hidpp_device *hidpp,
memcpy(&consumer_report[1], &data[3], 4);
/* We are called from atomic context */
hid_report_raw_event(hidpp->hid_dev, HID_INPUT_REPORT,
- consumer_report, 5, 1);
+ consumer_report, sizeof(consumer_report), 5, 1);
return 1;
}
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index e82a3c4e5b44..eeab0b6e32cc 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -533,7 +533,7 @@ static void mt_get_feature(struct hid_device *hdev, struct hid_report *report)
}
ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf,
- size, 0);
+ size, size, 0);
if (ret)
dev_warn(&hdev->dev, "failed to report feature\n");
}
diff --git a/drivers/hid/hid-primax.c b/drivers/hid/hid-primax.c
index e44d79dff8de..8db054280afb 100644
--- a/drivers/hid/hid-primax.c
+++ b/drivers/hid/hid-primax.c
@@ -44,7 +44,7 @@ static int px_raw_event(struct hid_device *hid, struct hid_report *report,
data[0] |= (1 << (data[idx] - 0xE0));
data[idx] = 0;
}
- hid_report_raw_event(hid, HID_INPUT_REPORT, data, size, 0);
+ hid_report_raw_event(hid, HID_INPUT_REPORT, data, size, size, 0);
return 1;
default: /* unknown report */
diff --git a/drivers/hid/hid-vivaldi-common.c b/drivers/hid/hid-vivaldi-common.c
index bf734055d4b6..b12bb5cc091a 100644
--- a/drivers/hid/hid-vivaldi-common.c
+++ b/drivers/hid/hid-vivaldi-common.c
@@ -85,7 +85,7 @@ void vivaldi_feature_mapping(struct hid_device *hdev,
}
ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, report_data,
- report_len, 0);
+ report_len, report_len, 0);
if (ret) {
dev_warn(&hdev->dev, "failed to report feature %d\n",
field->report->id);
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 0d1c6d90fe21..a32320b351e3 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -90,7 +90,7 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
kfree(buf);
continue;
}
- err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, false);
+ err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, size, false);
if (err) {
hid_warn(hdev, "%s: unable to flush event due to error %d\n",
__func__, err);
@@ -334,7 +334,7 @@ static void wacom_feature_mapping(struct hid_device *hdev,
data, n, WAC_CMD_RETRIES);
if (ret == n && features->type == HID_GENERIC) {
ret = hid_report_raw_event(hdev,
- HID_FEATURE_REPORT, data, n, 0);
+ HID_FEATURE_REPORT, data, n, n, 0);
} else if (ret == 2 && features->type != HID_GENERIC) {
features->touch_max = data[1];
} else {
@@ -395,7 +395,7 @@ static void wacom_feature_mapping(struct hid_device *hdev,
data, n, WAC_CMD_RETRIES);
if (ret == n) {
ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT,
- data, n, 0);
+ data, n, n, 0);
} else {
hid_warn(hdev, "%s: could not retrieve sensor offsets\n",
__func__);
diff --git a/drivers/staging/greybus/hid.c b/drivers/staging/greybus/hid.c
index 1f58c907c036..37e8605c6767 100644
--- a/drivers/staging/greybus/hid.c
+++ b/drivers/staging/greybus/hid.c
@@ -201,7 +201,7 @@ static void gb_hid_init_report(struct gb_hid *ghid, struct hid_report *report)
* we just need to setup the input fields, so using
* hid_report_raw_event is safe.
*/
- hid_report_raw_event(ghid->hid, report->type, ghid->inbuf, size, 1);
+ hid_report_raw_event(ghid->hid, report->type, ghid->inbuf, ghib->bufsize, size, 1);
}
static void gb_hid_init_reports(struct gb_hid *ghid)
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 442a80d79e89..ac432a2ef415 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -1298,8 +1298,8 @@ static inline u32 hid_report_len(struct hid_report *report)
return DIV_ROUND_UP(report->size, 8) + (report->id > 0);
}
-int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
- int interrupt);
+int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data,
+ size_t bufsize, u32 size, int interrupt);
/* HID quirks API */
unsigned long hid_lookup_quirk(const struct hid_device *hdev);
diff --git a/include/linux/hid_bpf.h b/include/linux/hid_bpf.h
index a2e47dbcf82c..19fffa4574a4 100644
--- a/include/linux/hid_bpf.h
+++ b/include/linux/hid_bpf.h
@@ -72,8 +72,8 @@ struct hid_ops {
int (*hid_hw_output_report)(struct hid_device *hdev, __u8 *buf, size_t len,
u64 source, bool from_bpf);
int (*hid_input_report)(struct hid_device *hid, enum hid_report_type type,
- u8 *data, u32 size, int interrupt, u64 source, bool from_bpf,
- bool lock_already_taken);
+ u8 *data, size_t bufsize, u32 size, int interrupt, u64 source,
+ bool from_bpf, bool lock_already_taken);
struct module *owner;
const struct bus_type *bus_type;
};
@@ -200,7 +200,8 @@ struct hid_bpf {
#ifdef CONFIG_HID_BPF
u8 *dispatch_hid_bpf_device_event(struct hid_device *hid, enum hid_report_type type, u8 *data,
- u32 *size, int interrupt, u64 source, bool from_bpf);
+ size_t *buf_size, u32 *size, int interrupt, u64 source,
+ bool from_bpf);
int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
unsigned char reportnum, __u8 *buf,
u32 size, enum hid_report_type rtype,
@@ -215,8 +216,11 @@ int hid_bpf_device_init(struct hid_device *hid);
const u8 *call_hid_bpf_rdesc_fixup(struct hid_device *hdev, const u8 *rdesc, unsigned int *size);
#else /* CONFIG_HID_BPF */
static inline u8 *dispatch_hid_bpf_device_event(struct hid_device *hid, enum hid_report_type type,
- u8 *data, u32 *size, int interrupt,
- u64 source, bool from_bpf) { return data; }
+ u8 *data, size_t *buf_size, u32 *size,
+ int interrupt, u64 source, bool from_bpf)
+{
+ return data;
+}
static inline int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
unsigned char reportnum, u8 *buf,
u32 size, enum hid_report_type rtype,
--
2.53.0
^ permalink raw reply related
* [PATCH v2 0/4] HID: Proper fix for OOM in hid-core
From: Benjamin Tissoires @ 2026-04-16 14:48 UTC (permalink / raw)
To: Jiri Kosina, Filipe Laíns, Bastien Nocera, Ping Cheng,
Jason Gerecke, Viresh Kumar, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Lee Jones
Cc: linux-input, linux-kernel, greybus-dev, linux-staging, linux-usb,
Benjamin Tissoires, stable
Commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
bogus memset()") enforced the provided data to be at least the size of
the declared buffer in the report descriptor to prevent a buffer
overflow.
We only had corner cases of malicious devices exposing the OOM because
in most cases, the buffer provided by the transport layer needs to be
allocated at probe time and is large enough to handle all the possible
reports.
However, the patch from above, which enforces the spec a little bit more
introduced both regressions for devices not following the spec (not
necesserally malicious), but also a stream of errors for those devices.
Let's revert to the old behavior by giving more information to HID core
to be able to decide whether it can or not memset the rest of the buffer
to 0 and continue the processing.
Note that the first commit makes an API change, but the callers are
relatively limited, so it should be fine on its own. The second patch
can't really make the same kind of API change because we have too many
callers in various subsystems. We can switch them one by one to the safe
approach when needed.
The last 2 patches are small cleanups I initially put together with the
2 first patches, but they can be applied on their own and don't need to
be pulled in stable like the first 2.
Cheers,
Benjamin
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
---
Changes in v2:
- added a small blurb explaining the difference between the safe and the
non safe version of hid_safe_input_report
- Link to v1: https://lore.kernel.org/r/20260415-wip-fix-core-v1-0-ed3c4c823175@kernel.org
---
Benjamin Tissoires (4):
HID: pass the buffer size to hid_report_raw_event
HID: core: introduce hid_safe_input_report()
HID: multitouch: use __free(kfree) to clean up temporary buffers
HID: wacom: use __free(kfree) to clean up temporary buffers
drivers/hid/bpf/hid_bpf_dispatch.c | 6 ++--
drivers/hid/hid-core.c | 67 ++++++++++++++++++++++++++++++--------
drivers/hid/hid-gfrm.c | 4 +--
drivers/hid/hid-logitech-hidpp.c | 2 +-
drivers/hid/hid-multitouch.c | 18 ++++------
drivers/hid/hid-primax.c | 2 +-
drivers/hid/hid-vivaldi-common.c | 2 +-
drivers/hid/i2c-hid/i2c-hid-core.c | 7 ++--
drivers/hid/usbhid/hid-core.c | 11 ++++---
drivers/hid/wacom_sys.c | 46 +++++++++-----------------
drivers/staging/greybus/hid.c | 2 +-
include/linux/hid.h | 6 ++--
include/linux/hid_bpf.h | 14 +++++---
13 files changed, 109 insertions(+), 78 deletions(-)
---
base-commit: 7df6572f1cb381d6b89ceed58e3b076c233c2cd0
change-id: 20260415-wip-fix-core-7d85c8516ed0
Best regards,
--
Benjamin Tissoires <bentiss@kernel.org>
^ permalink raw reply
* Re: [PATCH 2/4] HID: core: introduce hid_safe_input_report()
From: Benjamin Tissoires @ 2026-04-16 14:46 UTC (permalink / raw)
To: Bastien Nocera
Cc: Benjamin Tissoires, Jiri Kosina, Filipe Laíns, Ping Cheng,
Jason Gerecke, Viresh Kumar, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Lee Jones, linux-input, linux-kernel,
greybus-dev, linux-staging, linux-usb, stable
In-Reply-To: <8fedad8e9caecd379f2296562cd6abd37f7cee46.camel@hadess.net>
On Thu, Apr 16, 2026 at 11:41 AM Bastien Nocera <hadess@hadess.net> wrote:
>
> On Wed, 2026-04-15 at 11:38 +0200, Benjamin Tissoires wrote:
> > hid_input_report() is used in too many places to have a commit that
> > doesn't cross subsystem borders. Instead of changing the API,
> > introduce
> > a new one when things matters in the transport layers:
> > - usbhid
> > - i2chid
> >
> > This effectively revert to the old behavior for those two transport
> > layers.
> >
> > Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
> > bogus memset()")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
> > ---
> > drivers/hid/hid-core.c | 21 +++++++++++++++++++++
> > drivers/hid/i2c-hid/i2c-hid-core.c | 7 ++++---
> > drivers/hid/usbhid/hid-core.c | 11 ++++++-----
> > include/linux/hid.h | 2 ++
> > 4 files changed, 33 insertions(+), 8 deletions(-)
> >
> > diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
> > index a806820df7e5..cb0ad99e7a0a 100644
> > --- a/drivers/hid/hid-core.c
> > +++ b/drivers/hid/hid-core.c
> > @@ -2191,6 +2191,27 @@ int hid_input_report(struct hid_device *hid,
> > enum hid_report_type type, u8 *data
> > }
> > EXPORT_SYMBOL_GPL(hid_input_report);
> >
> > +/**
> > + * hid_safe_input_report - report data from lower layer (usb, bt...)
> > + *
> > + * @hid: hid device
> > + * @type: HID report type (HID_*_REPORT)
> > + * @data: report contents
> > + * @bufsize: allocated size of the data buffer
> > + * @size: useful size of data parameter
> > + * @interrupt: distinguish between interrupt and control transfers
> > + *
> > + * This is data entry for lower layers.
>
> You probably want to explain why it should be used instead of
> hid_input_report() in this doc blurb, and modify the hid_input_report()
> docs to mention that this should be used.
Good point. Sending v2 ASAP.
>
> Maybe hid_input_report() should also be marked as deprecated somehow,
> to avoid new users?
Well, it's not entirely deprecated because, for instance, in uhid we
only have the buffer with the provided size around. So we can't be
less restrictive in that precise case, and then switching to _safe
will not change a bit.
Cheers,
Benjamin
>
> Cheers
>
> > + */
> > +int hid_safe_input_report(struct hid_device *hid, enum
> > hid_report_type type, u8 *data,
> > + size_t bufsize, u32 size, int interrupt)
> > +{
> > + return __hid_input_report(hid, type, data, bufsize, size,
> > interrupt, 0,
> > + false, /* from_bpf */
> > + false /* lock_already_taken */);
> > +}
> > +EXPORT_SYMBOL_GPL(hid_safe_input_report);
> > +
> > bool hid_match_one_id(const struct hid_device *hdev,
> > const struct hid_device_id *id)
> > {
> > diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-
> > hid/i2c-hid-core.c
> > index 5a183af3d5c6..e0a302544cef 100644
> > --- a/drivers/hid/i2c-hid/i2c-hid-core.c
> > +++ b/drivers/hid/i2c-hid/i2c-hid-core.c
> > @@ -574,9 +574,10 @@ static void i2c_hid_get_input(struct i2c_hid
> > *ihid)
> > if (ihid->hid->group != HID_GROUP_RMI)
> > pm_wakeup_event(&ihid->client->dev, 0);
> >
> > - hid_input_report(ihid->hid, HID_INPUT_REPORT,
> > - ihid->inbuf + sizeof(__le16),
> > - ret_size - sizeof(__le16), 1);
> > + hid_safe_input_report(ihid->hid, HID_INPUT_REPORT,
> > + ihid->inbuf + sizeof(__le16),
> > + ihid->bufsize -
> > sizeof(__le16),
> > + ret_size - sizeof(__le16), 1);
> > }
> >
> > return;
> > diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-
> > core.c
> > index fbbfc0f60829..5af93b9b1fb5 100644
> > --- a/drivers/hid/usbhid/hid-core.c
> > +++ b/drivers/hid/usbhid/hid-core.c
> > @@ -283,9 +283,9 @@ static void hid_irq_in(struct urb *urb)
> > break;
> > usbhid_mark_busy(usbhid);
> > if (!test_bit(HID_RESUME_RUNNING, &usbhid->iofl)) {
> > - hid_input_report(urb->context,
> > HID_INPUT_REPORT,
> > - urb->transfer_buffer,
> > - urb->actual_length, 1);
> > + hid_safe_input_report(urb->context,
> > HID_INPUT_REPORT,
> > + urb->transfer_buffer,
> > urb->transfer_buffer_length,
> > + urb->actual_length,
> > 1);
> > /*
> > * autosuspend refused while keys are
> > pressed
> > * because most keyboards don't wake up when
> > @@ -482,9 +482,10 @@ static void hid_ctrl(struct urb *urb)
> > switch (status) {
> > case 0: /* success */
> > if (usbhid->ctrl[usbhid->ctrltail].dir ==
> > USB_DIR_IN)
> > - hid_input_report(urb->context,
> > + hid_safe_input_report(urb->context,
> > usbhid->ctrl[usbhid-
> > >ctrltail].report->type,
> > - urb->transfer_buffer, urb-
> > >actual_length, 0);
> > + urb->transfer_buffer, urb-
> > >transfer_buffer_length,
> > + urb->actual_length, 0);
> > break;
> > case -ESHUTDOWN: /* unplug */
> > unplug = 1;
> > diff --git a/include/linux/hid.h b/include/linux/hid.h
> > index ac432a2ef415..bfb9859f391e 100644
> > --- a/include/linux/hid.h
> > +++ b/include/linux/hid.h
> > @@ -1030,6 +1030,8 @@ struct hid_field *hid_find_field(struct
> > hid_device *hdev, unsigned int report_ty
> > int hid_set_field(struct hid_field *, unsigned, __s32);
> > int hid_input_report(struct hid_device *hid, enum hid_report_type
> > type, u8 *data, u32 size,
> > int interrupt);
> > +int hid_safe_input_report(struct hid_device *hid, enum
> > hid_report_type type, u8 *data,
> > + size_t bufsize, u32 size, int interrupt);
> > struct hid_field *hidinput_get_led_field(struct hid_device *hid);
> > unsigned int hidinput_count_leds(struct hid_device *hid);
> > __s32 hidinput_calc_abs_res(const struct hid_field *field, __u16
> > code);
>
^ permalink raw reply
* Re: [PATCH v2] HID: core: downgrade short report warning to debug level
From: Lee Jones @ 2026-04-16 14:44 UTC (permalink / raw)
To: Anj Duvnjak; +Cc: linux-input, benjamin.tissoires, jikos, Oleksandr Natalenko
In-Reply-To: <20260414230017.30217-1-avian@extremenerds.net>
On Wed, 15 Apr 2026, Anj Duvnjak wrote:
> Commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus
> memset()") replaced the silent memset() with hid_warn_ratelimited(), which
> causes dmesg flooding on devices that legitimately send short reports,
> such as the APC UPS (051D:0002).
>
> Downgrade to hid_dbg_ratelimited() to restore the previous behaviour of
> only reporting under HID_DEBUG, while preserving the security fix of
> removing the bogus memset() and keeping rate limiting in place.
>
> Fixes: 0a3fe972a7cb14 ("HID: core: Mitigate potential OOB by removing bogus memset()")
> Reported-by: Anj Duvnjak <avian@extremenerds.net>
That's weird. You reported it to yourself?
> Link: https://lore.kernel.org/linux-input/MW5PR84MB135613E7947113897DD9FDA4C7272@MW5PR84MB1356.NAMPRD84.PROD.OUTLOOK.COM/
> Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name>
> Link: https://lore.kernel.org/linux-input/6256259.lOV4Wx5bFT@natalenko.name/
> Signed-off-by: Anj Duvnjak <avian@extremenerds.net>
> ---
> drivers/hid/hid-core.c | 4 ++--
Anyway, thanks for your efforts, but this fix appears to be superseded by:
https://lore.kernel.org/all/20260415-wip-fix-core-v1-1-ed3c4c823175@kernel.org/
--
Lee Jones [李琼斯]
^ permalink raw reply
* [PATCH v6] HID: magicmouse: add battery reporting for Magic Trackpad v1
From: Damiano Gragnaniello @ 2026-04-16 14:33 UTC (permalink / raw)
To: jikos; +Cc: benjamin.tissoires, linux-input, linux-kernel,
Damiano Gragnaniello
In-Reply-To: <20260415155548.927385-1-damianogragnaniello@gmail.com>
This patch adds battery reporting support for the original Magic Trackpad.
The device uses report ID 0x47 for battery level notifications.
Signed-off-by: Damiano Gragnaniello <damianogragnaniello@gmail.com>
---
v6:
- Changed SPDX-License-Identifier comment style from /* */ to // for C files.
- Resolved patch application issues by generating a clean diff against origin/for-next.
- Final checkpatch.pl validation: 0 errors, 0 warnings.
v5:
- Rebased on current upstream hid-magicmouse.c (post-timer_container_of
refactor). Previous versions failed to apply due to context drift.
- Removed spurious TRACKPAD_V1_BATTERY_TIMEOUT_SEC define (unused).
- Removed space-aligned assignments in probe() in favor of plain
single-tab assignments to satisfy checkpatch.pl --strict.
- Added kernel-doc comment entries for new struct fields.
- Preserved all original driver logic and comments without modification.
v4:
- Fixed patch formatting and spacing issues to ensure clean application.
- Removed local path references and non-technical notes.
- Corrected diff headers.
v3:
- Fixed changelog language (translated from Italian to English).
- Standardized patch naming for upstream submission.
v2:
- Rename macros to TRACKPAD_V1_BATTERY_REPORT_ID for clarity.
- Add clamp_val() to ensure battery capacity stays within 0-100 range.
- Restore original driver comments.
drivers/hid/hid-magicmouse.c | 287 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++----------------------------------------------------------
1 file changed, 150 insertions(+), 137 deletions(-)
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index 1d5ea678d..33b9bad99 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -1,15 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-only
/*
- * Apple "Magic" Wireless Mouse driver
+ * Apple "Magic" Wireless Mouse driver
*
- * Copyright (c) 2010 Michael Poole <mdpoole@troilus.org>
- * Copyright (c) 2010 Chase Douglas <chase.douglas@canonical.com>
- */
-
-/*
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation; either version 2 of the License, or (at your option)
- * any later version.
+ * Copyright (c) 2010 Michael Poole <mdpoole@troilus.org>
+ * Copyright (c) 2010 Chase Douglas <chase.douglas@canonical.com>
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -18,6 +12,7 @@
#include <linux/hid.h>
#include <linux/input/mt.h>
#include <linux/module.h>
+#include <linux/power_supply.h>
#include <linux/slab.h>
#include "hid-ids.h"
@@ -27,7 +22,7 @@ module_param(emulate_3button, bool, 0644);
MODULE_PARM_DESC(emulate_3button, "Emulate a middle button");
static int middle_button_start = -350;
-static int middle_button_stop = +350;
+static int middle_button_stop = 350;
static bool emulate_scroll_wheel = true;
module_param(emulate_scroll_wheel, bool, 0644);
@@ -35,17 +30,20 @@ MODULE_PARM_DESC(emulate_scroll_wheel, "Emulate a scroll wheel");
static unsigned int scroll_speed = 32;
static int param_set_scroll_speed(const char *val,
- const struct kernel_param *kp) {
+ const struct kernel_param *kp)
+{
unsigned long speed;
+
if (!val || kstrtoul(val, 0, &speed) || speed > 63)
return -EINVAL;
scroll_speed = speed;
return 0;
}
-module_param_call(scroll_speed, param_set_scroll_speed, param_get_uint, &scroll_speed, 0644);
+module_param_call(scroll_speed, param_set_scroll_speed, param_get_uint,
+ &scroll_speed, 0644);
MODULE_PARM_DESC(scroll_speed, "Scroll speed, value from 0 (slow) to 63 (fast)");
-static bool scroll_acceleration = false;
+static bool scroll_acceleration;
module_param(scroll_acceleration, bool, 0644);
MODULE_PARM_DESC(scroll_acceleration, "Accelerate sequential scroll events");
@@ -58,12 +56,8 @@ MODULE_PARM_DESC(report_undeciphered, "Report undeciphered multi-touch state fie
#define TRACKPAD2_BT_REPORT_ID 0x31
#define MOUSE_REPORT_ID 0x29
#define DOUBLE_REPORT_ID 0xf7
-/* These definitions are not precise, but they're close enough. (Bits
- * 0x03 seem to indicate the aspect ratio of the touch, bits 0x70 seem
- * to be some kind of bit mask -- 0x20 may be a near-field reading,
- * and 0x40 is actual contact, and 0x10 may be a start/stop or change
- * indication.)
- */
+#define TRACKPAD_V1_BATTERY_REPORT_ID 0x47
+
#define TOUCH_STATE_MASK 0xf0
#define TOUCH_STATE_NONE 0x00
#define TOUCH_STATE_START 0x30
@@ -72,7 +66,8 @@ MODULE_PARM_DESC(report_undeciphered, "Report undeciphered multi-touch state fie
#define SCROLL_ACCEL_DEFAULT 7
/* Touch surface information. Dimension is in hundredths of a mm, min and max
- * are in units. */
+ * are in units.
+ */
#define MOUSE_DIMENSION_X (float)9056
#define MOUSE_MIN_X -1100
#define MOUSE_MAX_X 1258
@@ -113,6 +108,10 @@ MODULE_PARM_DESC(report_undeciphered, "Report undeciphered multi-touch state fie
* @scroll_jiffies: Time of last scroll motion.
* @touches: Most recent data for a touch, indexed by tracking ID.
* @tracking_ids: Mapping of current touch input data to @touches.
+ * @battery: Power supply instance for Magic Trackpad v1.
+ * @battery_desc: Descriptor for the power_supply registration.
+ * @battery_name: Name buffer for the power_supply instance.
+ * @battery_capacity: Last known battery level (0-100%).
*/
struct magicmouse_sc {
struct input_dev *input;
@@ -130,26 +129,62 @@ struct magicmouse_sc {
u8 size;
} touches[16];
int tracking_ids[16];
+
+ struct power_supply *battery;
+ struct power_supply_desc battery_desc;
+ char battery_name[64];
+ int battery_capacity;
};
+static const enum power_supply_property magicmouse_v1_battery_props[] = {
+ POWER_SUPPLY_PROP_PRESENT,
+ POWER_SUPPLY_PROP_CAPACITY,
+ POWER_SUPPLY_PROP_SCOPE,
+ POWER_SUPPLY_PROP_STATUS,
+};
+
+static int magicmouse_v1_battery_get_property(struct power_supply *psy,
+ enum power_supply_property psp,
+ union power_supply_propval *val)
+{
+ struct magicmouse_sc *msc = power_supply_get_drvdata(psy);
+
+ switch (psp) {
+ case POWER_SUPPLY_PROP_PRESENT:
+ val->intval = 1;
+ break;
+ case POWER_SUPPLY_PROP_CAPACITY:
+ val->intval = msc->battery_capacity;
+ break;
+ case POWER_SUPPLY_PROP_SCOPE:
+ val->intval = POWER_SUPPLY_SCOPE_DEVICE;
+ break;
+ case POWER_SUPPLY_PROP_STATUS:
+ val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
+ break;
+ default:
+ return -EINVAL;
+ }
+ return 0;
+}
+
static int magicmouse_firm_touch(struct magicmouse_sc *msc)
{
int touch = -1;
int ii;
- /* If there is only one "firm" touch, set touch to its
- * tracking ID.
- */
for (ii = 0; ii < msc->ntouches; ii++) {
int idx = msc->tracking_ids[ii];
- if (msc->touches[idx].size < 8) {
- /* Ignore this touch. */
- } else if (touch >= 0) {
+
+ if (msc->touches[idx].size < 8)
+ continue;
+
+ if (touch >= 0) {
touch = -1;
break;
- } else {
- touch = idx;
}
+
+ touch = idx;
}
return touch;
@@ -164,23 +199,23 @@ static void magicmouse_emit_buttons(struct magicmouse_sc *msc, int state)
if (emulate_3button) {
int id;
- /* If some button was pressed before, keep it held
- * down. Otherwise, if there's exactly one firm
- * touch, use that to override the mouse's guess.
- */
if (state == 0) {
- /* The button was released. */
+ /* No buttons pressed */
} else if (last_state != 0) {
state = last_state;
- } else if ((id = magicmouse_firm_touch(msc)) >= 0) {
- int x = msc->touches[id].x;
- if (x < middle_button_start)
- state = 1;
- else if (x > middle_button_stop)
- state = 2;
- else
- state = 4;
- } /* else: we keep the mouse's guess */
+ } else {
+ id = magicmouse_firm_touch(msc);
+ if (id >= 0) {
+ int x = msc->touches[id].x;
+
+ if (x < middle_button_start)
+ state = 1;
+ else if (x > middle_button_stop)
+ state = 2;
+ else
+ state = 4;
+ }
+ }
input_report_key(msc->input, BTN_MIDDLE, state & 4);
}
@@ -192,7 +227,8 @@ static void magicmouse_emit_buttons(struct magicmouse_sc *msc, int state)
msc->scroll_accel = SCROLL_ACCEL_DEFAULT;
}
-static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id, u8 *tdata)
+static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id,
+ u8 *tdata)
{
struct input_dev *input = msc->input;
int id, x, y, size, orientation, touch_major, touch_minor, state, down;
@@ -231,32 +267,27 @@ static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id, u8 *tda
down = state != TOUCH_STATE_NONE;
}
- /* Store tracking ID and other fields. */
msc->tracking_ids[raw_id] = id;
msc->touches[id].x = x;
msc->touches[id].y = y;
msc->touches[id].size = size;
- /* If requested, emulate a scroll wheel by detecting small
- * vertical touch motions.
- */
- if (emulate_scroll_wheel && (input->id.product !=
- USB_DEVICE_ID_APPLE_MAGICTRACKPAD2)) {
+ if (emulate_scroll_wheel &&
+ input->id.product != USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
unsigned long now = jiffies;
int step_x = msc->touches[id].scroll_x - x;
int step_y = msc->touches[id].scroll_y - y;
- /* Calculate and apply the scroll motion. */
switch (state) {
case TOUCH_STATE_START:
msc->touches[id].scroll_x = x;
msc->touches[id].scroll_y = y;
- /* Reset acceleration after half a second. */
- if (scroll_acceleration && time_before(now,
- msc->scroll_jiffies + HZ / 2))
+ if (scroll_acceleration &&
+ time_before(now, msc->scroll_jiffies + HZ / 2))
msc->scroll_accel = max_t(int,
- msc->scroll_accel - 1, 1);
+ msc->scroll_accel - 1,
+ 1);
else
msc->scroll_accel = SCROLL_ACCEL_DEFAULT;
@@ -287,7 +318,6 @@ static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id, u8 *tda
input_mt_slot(input, id);
input_mt_report_slot_state(input, MT_TOOL_FINGER, down);
- /* Generate the input events for this touch. */
if (down) {
input_report_abs(input, ABS_MT_TOUCH_MAJOR, touch_major << 2);
input_report_abs(input, ABS_MT_TOUCH_MINOR, touch_minor << 2);
@@ -309,101 +339,84 @@ static void magicmouse_emit_touch(struct magicmouse_sc *msc, int raw_id, u8 *tda
}
static int magicmouse_raw_event(struct hid_device *hdev,
- struct hid_report *report, u8 *data, int size)
+ struct hid_report *report, u8 *data, int size)
{
struct magicmouse_sc *msc = hid_get_drvdata(hdev);
struct input_dev *input = msc->input;
- int x = 0, y = 0, ii, clicks = 0, npoints;
+ int x = 0, y = 0, ii, npoints;
switch (data[0]) {
+ case TRACKPAD_V1_BATTERY_REPORT_ID:
+ if (size < 2)
+ return 0;
+ if (msc->battery) {
+ msc->battery_capacity = clamp_val((int)data[1], 0, 100);
+ power_supply_changed(msc->battery);
+ }
+ return 0;
case TRACKPAD_REPORT_ID:
case TRACKPAD2_BT_REPORT_ID:
- /* Expect four bytes of prefix, and N*9 bytes of touch data. */
if (size < 4 || ((size - 4) % 9) != 0)
return 0;
npoints = (size - 4) / 9;
if (npoints > 15) {
hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n",
- size);
+ size);
return 0;
}
msc->ntouches = 0;
for (ii = 0; ii < npoints; ii++)
magicmouse_emit_touch(msc, ii, data + ii * 9 + 4);
- clicks = data[1];
-
- /* The following bits provide a device specific timestamp. They
- * are unused here.
- *
- * ts = data[1] >> 6 | data[2] << 2 | data[3] << 10;
- */
break;
case TRACKPAD2_USB_REPORT_ID:
- /* Expect twelve bytes of prefix and N*9 bytes of touch data. */
if (size < 12 || ((size - 12) % 9) != 0)
return 0;
npoints = (size - 12) / 9;
if (npoints > 15) {
hid_warn(hdev, "invalid size value (%d) for TRACKPAD2_USB_REPORT_ID\n",
- size);
+ size);
return 0;
}
msc->ntouches = 0;
for (ii = 0; ii < npoints; ii++)
magicmouse_emit_touch(msc, ii, data + ii * 9 + 12);
- clicks = data[1];
break;
case MOUSE_REPORT_ID:
- /* Expect six bytes of prefix, and N*8 bytes of touch data. */
if (size < 6 || ((size - 6) % 8) != 0)
return 0;
npoints = (size - 6) / 8;
if (npoints > 15) {
hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n",
- size);
+ size);
return 0;
}
msc->ntouches = 0;
for (ii = 0; ii < npoints; ii++)
magicmouse_emit_touch(msc, ii, data + ii * 8 + 6);
- /* When emulating three-button mode, it is important
- * to have the current touch information before
- * generating a click event.
- */
x = (int)(((data[3] & 0x0c) << 28) | (data[1] << 22)) >> 22;
y = (int)(((data[3] & 0x30) << 26) | (data[2] << 22)) >> 22;
- clicks = data[3];
-
- /* The following bits provide a device specific timestamp. They
- * are unused here.
- *
- * ts = data[3] >> 6 | data[4] << 2 | data[5] << 10;
- */
break;
case DOUBLE_REPORT_ID:
- /* Sometimes the trackpad sends two touch reports in one
- * packet.
- */
magicmouse_raw_event(hdev, report, data + 2, data[1]);
magicmouse_raw_event(hdev, report, data + 2 + data[1],
- size - 2 - data[1]);
+ size - 2 - data[1]);
break;
default:
return 0;
}
if (input->id.product == USB_DEVICE_ID_APPLE_MAGICMOUSE) {
- magicmouse_emit_buttons(msc, clicks & 3);
+ magicmouse_emit_buttons(msc, data[3] & 3);
input_report_rel(input, REL_X, x);
input_report_rel(input, REL_Y, y);
} else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
input_mt_sync_frame(input);
- input_report_key(input, BTN_MOUSE, clicks & 1);
+ input_report_key(input, BTN_MOUSE, data[1] & 1);
} else { /* USB_DEVICE_ID_APPLE_MAGICTRACKPAD */
- input_report_key(input, BTN_MOUSE, clicks & 1);
+ input_report_key(input, BTN_MOUSE, data[1] & 1);
input_mt_report_pointer_emulation(input, true);
}
@@ -411,7 +424,8 @@ static int magicmouse_raw_event(struct hid_device *hdev,
return 1;
}
-static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hdev)
+static int magicmouse_setup_input(struct input_dev *input,
+ struct hid_device *hdev)
{
int error;
int mt_flags = 0;
@@ -432,9 +446,6 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd
__set_bit(REL_HWHEEL, input->relbit);
}
} else if (input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
- /* setting the device name to ensure the same driver settings
- * get loaded, whether connected through bluetooth or USB
- */
input->name = "Apple Inc. Magic Trackpad 2";
__clear_bit(EV_MSC, input->evbit);
@@ -448,11 +459,6 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd
mt_flags = INPUT_MT_POINTER | INPUT_MT_DROP_UNUSED |
INPUT_MT_TRACK;
} else { /* USB_DEVICE_ID_APPLE_MAGICTRACKPAD */
- /* input->keybit is initialized with incorrect button info
- * for Magic Trackpad. There really is only one physical
- * button (BTN_LEFT == BTN_MOUSE). Make sure we don't
- * advertise buttons that don't exist...
- */
__clear_bit(BTN_RIGHT, input->keybit);
__clear_bit(BTN_MIDDLE, input->keybit);
__set_bit(BTN_MOUSE, input->keybit);
@@ -466,7 +472,6 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd
__set_bit(INPUT_PROP_BUTTONPAD, input->propbit);
}
-
__set_bit(EV_ABS, input->evbit);
error = input_mt_init_slots(input, 16, mt_flags);
@@ -477,12 +482,6 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd
input_set_abs_params(input, ABS_MT_TOUCH_MINOR, 0, 255 << 2,
4, 0);
- /* Note: Touch Y position from the device is inverted relative
- * to how pointer motion is reported (and relative to how USB
- * HID recommends the coordinates work). This driver keeps
- * the origin at the same position, and just uses the additive
- * inverse of the reported Y.
- */
if (input->id.product == USB_DEVICE_ID_APPLE_MAGICMOUSE) {
input_set_abs_params(input, ABS_MT_ORIENTATION, -31, 32, 1, 0);
input_set_abs_params(input, ABS_MT_POSITION_X,
@@ -542,15 +541,16 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd
}
static int magicmouse_input_mapping(struct hid_device *hdev,
- struct hid_input *hi, struct hid_field *field,
- struct hid_usage *usage, unsigned long **bit, int *max)
+ struct hid_input *hi,
+ struct hid_field *field,
+ struct hid_usage *usage,
+ unsigned long **bit, int *max)
{
struct magicmouse_sc *msc = hid_get_drvdata(hdev);
if (!msc->input)
msc->input = hi->input;
- /* Magic Trackpad does not give relative data after switching to MT */
if ((hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD ||
hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) &&
field->flags & HID_MAIN_ITEM_RELATIVE)
@@ -560,8 +560,7 @@ static int magicmouse_input_mapping(struct hid_device *hdev,
}
static int magicmouse_input_configured(struct hid_device *hdev,
- struct hid_input *hi)
-
+ struct hid_input *hi)
{
struct magicmouse_sc *msc = hid_get_drvdata(hdev);
int ret;
@@ -569,7 +568,6 @@ static int magicmouse_input_configured(struct hid_device *hdev,
ret = magicmouse_setup_input(msc->input, hdev);
if (ret) {
hid_err(hdev, "magicmouse setup input failed (%d)\n", ret);
- /* clean msc->input to notify probe() of the failure */
msc->input = NULL;
return ret;
}
@@ -577,9 +575,8 @@ static int magicmouse_input_configured(struct hid_device *hdev,
return 0;
}
-
static int magicmouse_probe(struct hid_device *hdev,
- const struct hid_device_id *id)
+ const struct hid_device_id *id)
{
const u8 *feature;
const u8 feature_mt[] = { 0xD7, 0x01 };
@@ -597,13 +594,10 @@ static int magicmouse_probe(struct hid_device *hdev,
return 0;
msc = devm_kzalloc(&hdev->dev, sizeof(*msc), GFP_KERNEL);
- if (msc == NULL) {
- hid_err(hdev, "can't alloc magicmouse descriptor\n");
+ if (!msc)
return -ENOMEM;
- }
msc->scroll_accel = SCROLL_ACCEL_DEFAULT;
-
msc->quirks = id->driver_data;
hid_set_drvdata(hdev, msc);
@@ -625,21 +619,22 @@ static int magicmouse_probe(struct hid_device *hdev,
goto err_stop_hw;
}
- if (id->product == USB_DEVICE_ID_APPLE_MAGICMOUSE)
+ if (id->product == USB_DEVICE_ID_APPLE_MAGICMOUSE) {
report = hid_register_report(hdev, HID_INPUT_REPORT,
- MOUSE_REPORT_ID, 0);
- else if (id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
+ MOUSE_REPORT_ID, 0);
+ } else if (id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD2) {
if (id->vendor == BT_VENDOR_ID_APPLE)
report = hid_register_report(hdev, HID_INPUT_REPORT,
- TRACKPAD2_BT_REPORT_ID, 0);
- else /* USB_VENDOR_ID_APPLE */
+ TRACKPAD2_BT_REPORT_ID, 0);
+ else
report = hid_register_report(hdev, HID_INPUT_REPORT,
- TRACKPAD2_USB_REPORT_ID, 0);
- } else { /* USB_DEVICE_ID_APPLE_MAGICTRACKPAD */
+ TRACKPAD2_USB_REPORT_ID,
+ 0);
+ } else {
report = hid_register_report(hdev, HID_INPUT_REPORT,
- TRACKPAD_REPORT_ID, 0);
+ TRACKPAD_REPORT_ID, 0);
report = hid_register_report(hdev, HID_INPUT_REPORT,
- DOUBLE_REPORT_ID, 0);
+ DOUBLE_REPORT_ID, 0);
}
if (!report) {
@@ -653,7 +648,7 @@ static int magicmouse_probe(struct hid_device *hdev,
if (id->vendor == BT_VENDOR_ID_APPLE) {
feature_size = sizeof(feature_mt_trackpad2_bt);
feature = feature_mt_trackpad2_bt;
- } else { /* USB_VENDOR_ID_APPLE */
+ } else {
feature_size = sizeof(feature_mt_trackpad2_usb);
feature = feature_mt_trackpad2_usb;
}
@@ -668,22 +663,40 @@ static int magicmouse_probe(struct hid_device *hdev,
goto err_stop_hw;
}
- /*
- * Some devices repond with 'invalid report id' when feature
- * report switching it into multitouch mode is sent to it.
- *
- * This results in -EIO from the _raw low-level transport callback,
- * but there seems to be no other way of switching the mode.
- * Thus the super-ugly hacky success check below.
- */
ret = hid_hw_raw_request(hdev, buf[0], buf, feature_size,
- HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
+ HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
kfree(buf);
if (ret != -EIO && ret != feature_size) {
hid_err(hdev, "unable to request touch data (%d)\n", ret);
goto err_stop_hw;
}
+ if (id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD &&
+ id->vendor == USB_VENDOR_ID_APPLE) {
+ struct power_supply_config psy_cfg = {};
+
+ psy_cfg.drv_data = msc;
+ msc->battery_capacity = 0;
+ snprintf(msc->battery_name, sizeof(msc->battery_name),
+ "hid-magictrackpad-v1-%s", dev_name(&hdev->dev));
+
+ msc->battery_desc.name = msc->battery_name;
+ msc->battery_desc.type = POWER_SUPPLY_TYPE_BATTERY;
+ msc->battery_desc.properties = magicmouse_v1_battery_props;
+ msc->battery_desc.num_properties =
+ ARRAY_SIZE(magicmouse_v1_battery_props);
+ msc->battery_desc.get_property =
+ magicmouse_v1_battery_get_property;
+
+ msc->battery = devm_power_supply_register(&hdev->dev,
+ &msc->battery_desc,
+ &psy_cfg);
+ if (IS_ERR(msc->battery)) {
+ hid_err(hdev, "can't register battery device\n");
+ msc->battery = NULL;
+ }
+ }
+
return 0;
err_stop_hw:
hid_hw_stop(hdev);
^ permalink raw reply related
* Re: [PATCH v2 1/1] HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
From: Günther Noack @ 2026-04-16 14:22 UTC (permalink / raw)
To: Lee Jones; +Cc: Jiri Kosina, Benjamin Tissoires, linux-input, linux-kernel
In-Reply-To: <20260416131655.2279756-1-lee@kernel.org>
On Thu, Apr 16, 2026 at 02:16:54PM +0100, Lee Jones wrote:
> It is currently possible for a malicious or misconfigured USB device to
> cause an out-of-bounds (OOB) read when submitting reports using
> DOUBLE_REPORT_ID by specifying a large report length and providing a
> smaller one.
>
> Let's prevent that by comparing the specified report length with the
> actual size of the data read in from userspace. If the actual data
> length ends up being smaller than specified, we'll politely warn the
> user and prevent any further processing.
>
> Signed-off-by: Lee Jones <lee@kernel.org>
> ---
> v1 => v2: Add more size checks to protect against issues during recursion
>
> drivers/hid/hid-magicmouse.c | 16 ++++++++++++++++
> 1 file changed, 16 insertions(+)
>
> diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
> index 91f621ceb924..e84e6b21d113 100644
> --- a/drivers/hid/hid-magicmouse.c
> +++ b/drivers/hid/hid-magicmouse.c
> @@ -390,6 +390,10 @@ static int magicmouse_raw_event(struct hid_device *hdev,
> struct input_dev *input = msc->input;
> int x = 0, y = 0, ii, clicks = 0, npoints;
>
> + /* Protect against zero sized recursive calls from DOUBLE_REPORT_ID */
> + if (size < 1)
> + return 0;
> +
> switch (data[0]) {
> case TRACKPAD_REPORT_ID:
> case TRACKPAD2_BT_REPORT_ID:
> @@ -490,6 +494,18 @@ static int magicmouse_raw_event(struct hid_device *hdev,
> /* Sometimes the trackpad sends two touch reports in one
> * packet.
> */
> +
> + /* Ensure that we have at least 2 elements (report type and size) */
> + if (size < 2)
> + return 0;
> +
> + if (size < data[1] + 2) {
> + hid_warn(hdev,
> + "received report length (%d) was smaller than specified (%d)",
> + size, data[1] + 2);
> + return 0;
> + }
> +
> magicmouse_raw_event(hdev, report, data + 2, data[1]);
> magicmouse_raw_event(hdev, report, data + 2 + data[1],
> size - 2 - data[1]);
> --
> 2.54.0.rc1.513.gad8abe7a5a-goog
>
Thank you! This looks correct now.
Reviewed-by: Günther Noack <gnoack@google.com>
—Günther
^ permalink raw reply
* [PATCH v2 1/1] HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
From: Lee Jones @ 2026-04-16 13:16 UTC (permalink / raw)
To: lee, Jiri Kosina, Benjamin Tissoires, linux-input, linux-kernel; +Cc: gnoack
It is currently possible for a malicious or misconfigured USB device to
cause an out-of-bounds (OOB) read when submitting reports using
DOUBLE_REPORT_ID by specifying a large report length and providing a
smaller one.
Let's prevent that by comparing the specified report length with the
actual size of the data read in from userspace. If the actual data
length ends up being smaller than specified, we'll politely warn the
user and prevent any further processing.
Signed-off-by: Lee Jones <lee@kernel.org>
---
v1 => v2: Add more size checks to protect against issues during recursion
drivers/hid/hid-magicmouse.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index 91f621ceb924..e84e6b21d113 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -390,6 +390,10 @@ static int magicmouse_raw_event(struct hid_device *hdev,
struct input_dev *input = msc->input;
int x = 0, y = 0, ii, clicks = 0, npoints;
+ /* Protect against zero sized recursive calls from DOUBLE_REPORT_ID */
+ if (size < 1)
+ return 0;
+
switch (data[0]) {
case TRACKPAD_REPORT_ID:
case TRACKPAD2_BT_REPORT_ID:
@@ -490,6 +494,18 @@ static int magicmouse_raw_event(struct hid_device *hdev,
/* Sometimes the trackpad sends two touch reports in one
* packet.
*/
+
+ /* Ensure that we have at least 2 elements (report type and size) */
+ if (size < 2)
+ return 0;
+
+ if (size < data[1] + 2) {
+ hid_warn(hdev,
+ "received report length (%d) was smaller than specified (%d)",
+ size, data[1] + 2);
+ return 0;
+ }
+
magicmouse_raw_event(hdev, report, data + 2, data[1]);
magicmouse_raw_event(hdev, report, data + 2 + data[1],
size - 2 - data[1]);
--
2.54.0.rc1.513.gad8abe7a5a-goog
^ permalink raw reply related
* [PATCH v5] HID: magicmouse: add battery reporting for Magic Trackpad v1
From: Damiano Gragnaniello @ 2026-04-16 12:53 UTC (permalink / raw)
To: jikos; +Cc: bentiss, linux-input, Damiano Gragnaniello
In-Reply-To: <20260415155548.927385-1-damianogragnaniello@gmail.com>
The Magic Trackpad v1 (A1339) reports battery level via Bluetooth using
Report ID 0x47. This patch adds support for parsing this report and
registering a power_supply interface so that userspace (upower) can
correctly display the battery percentage for this legacy device.
Signed-off-by: Damiano Gragnaniello <damianogragnaniello@gmail.com>
---
v5:
- Rebased on current upstream hid-magicmouse.c (post-timer_container_of
refactor). Previous versions failed to apply due to context drift.
- Removed spurious TRACKPAD_V1_BATTERY_TIMEOUT_SEC define (unused).
- Removed space-aligned assignments in probe() in favor of plain
single-tab assignments to satisfy checkpatch.pl --strict.
- Added kernel-doc comment entries for new struct fields.
- Preserved all original driver logic and comments without modification.
v4:
- Fixed patch formatting and spacing issues to ensure clean application.
- Removed local path references and non-technical notes.
- Corrected diff headers.
v3:
- Fixed changelog language (translated from Italian to English).
- Standardized patch naming for upstream submission.
v2:
- Rename macros to TRACKPAD_V1_BATTERY_REPORT_ID for clarity.
- Add clamp_val() to ensure battery capacity stays within 0-100 range.
- Restore original driver comments.
drivers/hid/hid-magicmouse.c | 82 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 82 insertions(+)
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -15,6 +15,7 @@
#include <linux/hid.h>
#include <linux/input/mt.h>
#include <linux/module.h>
+#include <linux/power_supply.h>
#include <linux/slab.h>
#include <linux/workqueue.h>
@@ -60,6 +61,7 @@
#define MOUSE_REPORT_ID 0x29
#define MOUSE2_REPORT_ID 0x12
#define DOUBLE_REPORT_ID 0xf7
+#define TRACKPAD_V1_BATTERY_REPORT_ID 0x47
#define USB_BATTERY_TIMEOUT_SEC 60
/* These definitions are not precise, but they're close enough. (Bits
@@ -124,6 +126,10 @@
* @hdev: Pointer to the underlying HID device.
* @work: Workqueue to handle initialization retry for quirky devices.
* @battery_timer: Timer for obtaining battery level information.
+ * @battery: Power supply instance for Magic Trackpad v1 AA battery reporting.
+ * @battery_desc: Descriptor for the power_supply registration.
+ * @battery_name: Name buffer for the power_supply instance.
+ * @battery_capacity: Last known battery level (0-100%) for Magic Trackpad v1.
*/
struct magicmouse_sc {
struct input_dev *input;
@@ -149,8 +155,46 @@
struct hid_device *hdev;
struct delayed_work work;
struct timer_list battery_timer;
+
+ /* Magic Trackpad v1 (AA battery) power_supply support */
+ struct power_supply *battery;
+ struct power_supply_desc battery_desc;
+ char battery_name[64];
+ int battery_capacity;
+};
+
+static const enum power_supply_property magicmouse_v1_battery_props[] = {
+ POWER_SUPPLY_PROP_PRESENT,
+ POWER_SUPPLY_PROP_CAPACITY,
+ POWER_SUPPLY_PROP_SCOPE,
+ POWER_SUPPLY_PROP_STATUS,
+};
+
+static int magicmouse_v1_battery_get_property(struct power_supply *psy,
+ enum power_supply_property psp,
+ union power_supply_propval *val)
+{
+ struct magicmouse_sc *msc = power_supply_get_drvdata(psy);
+
+ switch (psp) {
+ case POWER_SUPPLY_PROP_PRESENT:
+ val->intval = 1;
+ break;
+ case POWER_SUPPLY_PROP_CAPACITY:
+ val->intval = msc->battery_capacity;
+ break;
+ case POWER_SUPPLY_PROP_SCOPE:
+ val->intval = POWER_SUPPLY_SCOPE_DEVICE;
+ break;
+ case POWER_SUPPLY_PROP_STATUS:
+ val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
+ break;
+ default:
+ return -EINVAL;
+ }
+ return 0;
}
static int magicmouse_firm_touch(struct magicmouse_sc *msc)
@@ -391,6 +435,19 @@
int x = 0, y = 0, ii, clicks = 0, npoints;
switch (data[0]) {
+ case TRACKPAD_V1_BATTERY_REPORT_ID:
+ /*
+ * Magic Trackpad v1 (A1339, BT) sends battery level in byte 1,
+ * already expressed as a percentage (0-100) by the firmware.
+ * Clamp defensively and notify the power_supply framework.
+ */
+ if (size < 2)
+ return 0;
+ if (msc->battery) {
+ msc->battery_capacity = clamp_val((int)data[1], 0, 100);
+ power_supply_changed(msc->battery);
+ }
+ return 0;
case TRACKPAD_REPORT_ID:
case TRACKPAD2_BT_REPORT_ID:
/* Expect four bytes of prefix, and N*9 bytes of touch data. */
@@ -890,6 +947,31 @@
magicmouse_fetch_battery(hdev);
}
+ /* Register power_supply for Magic Trackpad v1 (AA battery, BT only) */
+ if (id->product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD &&
+ id->vendor == USB_VENDOR_ID_APPLE) {
+ struct power_supply_config psy_cfg = {};
+
+ psy_cfg.drv_data = msc;
+ msc->battery_capacity = 0;
+ snprintf(msc->battery_name, sizeof(msc->battery_name),
+ "hid-magictrackpad-v1-%s", dev_name(&hdev->dev));
+
+ msc->battery_desc.name = msc->battery_name;
+ msc->battery_desc.type = POWER_SUPPLY_TYPE_BATTERY;
+ msc->battery_desc.properties = magicmouse_v1_battery_props;
+ msc->battery_desc.num_properties = ARRAY_SIZE(magicmouse_v1_battery_props);
+ msc->battery_desc.get_property = magicmouse_v1_battery_get_property;
+
+ msc->battery = devm_power_supply_register(&hdev->dev,
+ &msc->battery_desc,
+ &psy_cfg);
+ if (IS_ERR(msc->battery)) {
+ hid_err(hdev, "can't register battery device\n");
+ msc->battery = NULL;
+ }
+ }
+
if (is_usb_magicmouse2(id->vendor, id->product) ||
(is_usb_magictrackpad2(id->vendor, id->product) &&
hdev->type != HID_TYPE_USBMOUSE))
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox