* RE: [PATCH v2] iio: orientation: hid-sensor-rotation: use ext_scan_type
From: Zhang, Lixu @ 2026-04-22 1:08 UTC (permalink / raw)
To: srinivas pandruvada, Jonathan Cameron, Lechner, David
Cc: Jiri Kosina, Nuno Sá, Andy Shevchenko,
linux-input@vger.kernel.org, linux-iio@vger.kernel.org,
linux-kernel@vger.kernel.org
In-Reply-To: <ff6d54f76139c43642f15ef21da6997145bca8e3.camel@linux.intel.com>
Tested-by: Lixu Zhang <lixu.zhang@intel.com>
>-----Original Message-----
>From: srinivas pandruvada <srinivas.pandruvada@linux.intel.com>
>Sent: Monday, April 20, 2026 11:46 PM
>To: Jonathan Cameron <jic23@kernel.org>; Lechner, David
><dlechner@baylibre.com>; Zhang, Lixu <lixu.zhang@intel.com>
>Cc: Jiri Kosina <jikos@kernel.org>; Nuno Sá <nuno.sa@analog.com>; Andy
>Shevchenko <andy@kernel.org>; linux-input@vger.kernel.org; linux-
>iio@vger.kernel.org; linux-kernel@vger.kernel.org
>Subject: Re: [PATCH v2] iio: orientation: hid-sensor-rotation: use ext_scan_type
>
>+Lixu
>
>On Sun, 2026-04-12 at 15:26 +0100, Jonathan Cameron wrote:
>> On Sun, 01 Mar 2026 17:46:48 -0600
>> David Lechner <dlechner@baylibre.com> wrote:
>>
>> > Make use of ext_scan_type to handle the dynamic realbits size of the
>> > quaternion data. This lets us implement it using static data rather
>> > than having to duplicate the channel info for each driver instance.
>> >
>> > Signed-off-by: David Lechner <dlechner@baylibre.com>
>> > ---
>> I'm going to apply this now, but would welcome any additional feedback
>> from Srinivas or others.
>>
>> Note, given this is next cycle material now I'll only push the tree
>> out as testing until I can rebase on rc1.
>>
>
>In real world I think report size is always 16 copying from spec.
Yes, it's always 16 for Intel ISH.
Thanks,
Lixu
>
> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
>
>Thanks,
>Srinivas
>
>
>> Thanks,
>>
>> Jonathan
>>
^ permalink raw reply
* Re: [PATCH 0/2] HID: appletb-kbd: fix UAF and mutex-in-atomic in inactivity timer
From: Sangyun Kim @ 2026-04-22 6:01 UTC (permalink / raw)
To: Aditya Garg; +Cc: jikos, bentiss, qasdev00, linux-input, linux-kernel
In-Reply-To: <MAUPR01MB115460F44776CC8E5E5EE7DC4B82F2@MAUPR01MB11546.INDPRD01.PROD.OUTLOOK.COM>
On Mon, Apr 20, 2026 at 06:17:36 PM +0530, Aditya Garg wrote:
>
>
>On 4/20/26 10:43, Sangyun Kim wrote:
>>This series addresses two defects in hid-appletb-kbd's inactivity
>>timer subsystem. The two patches target different bugs and are
>>logically independent; they are sent together because they touch the
>>same tear-down code and because the same maintainer will review both.
>>
>>Patch 1 fixes a slab use-after-free with two related tear-down windows
>>introduced by commit 38224c472a03 ("HID: appletb-kbd: fix slab
>>use-after-free bug in appletb_kbd_probe"):
>>
>> A) Within "if (kbd->backlight_dev)" the order was
>> put_device() then timer_delete_sync(). A concurrent
>> hid_appletb_bl unbind between those two calls can drop the last
>> devm reference and free the backlight_device; the still-armed
>> inactivity timer softirq then dereferences the freed object
>> through backlight_device_set_brightness() -> mutex_lock(&ops_lock).
>>
>> B) The "if (kbd->backlight_dev)" block ran before
>> hid_hw_close()/hid_hw_stop(), so even after window A is closed a
>> late ".event" callback from the HID core (USB URB completion on
>> real hardware) can arrive between timer_delete_sync() and
>> put_device(), reach reset_inactivity_timer(), re-arm the timer
>> via mod_timer(), and reopen the same UAF.
>>
>>Both windows produce the same KASAN slab-use-after-free on the object
>>allocated by devm_backlight_device_register(). Patch 1 closes them
>>together by moving hid_hw_close()/hid_hw_stop() before the backlight
>>cleanup and, inside that cleanup block, calling timer_delete_sync()
>>before put_device(). Shipping both as one commit avoids leaving
>>stable kernels in a half-fixed state where only window A is closed.
>>
>>Patch 2 fixes a separate "sleeping function called from invalid
>>context" bug in the same subsystem. The inactivity timer is a
>>struct timer_list, so the callback runs in softirq context and calls
>>backlight_device_set_brightness() -> mutex_lock() from atomic
>>context; reset_inactivity_timer() has the same issue on the
>>brightness-restore path (it is called from appletb_kbd_hid_event()
>>and appletb_kbd_inp_event(), which run in softirq/IRQ context on
>>real USB hardware). Convert the inactivity timer to a delayed_work
>>and defer the brightness-restore call to a dedicated work_struct so
>>both sleeping calls run in process context.
>>
>>Sangyun Kim (2):
>> HID: appletb-kbd: fix UAF in inactivity-timer cleanup path
>> HID: appletb-kbd: run inactivity autodim from workqueues
>>
>> drivers/hid/hid-appletb-kbd.c | 56 ++++++++++++++++++++++-------------
>> 1 file changed, 36 insertions(+), 20 deletions(-)
>>
>
>I had a very weird bug just once. And that was when I pressed fn key,
>upon releasing, the touchbar mode did not restore to normal.
>
>Although it was just once, and I was never able to reproduce it again.
>
>Have you tested it on your Machine btw?
>
>
Hi,
I have not tested this series on actual Apple Touch Bar hardware on my
side, as I do not have access to such a machine locally. All testing on
my side was done under QEMU with a uhid-based setup.
Because of that, I cannot say much about the one-off case where the
Touch Bar did not restore the normal mode after releasing Fn. I have not
been able to reproduce that specific behavior in my setup.
For patch 1, however, I was able to reproduce the teardown UAF in the
uhid/QEMU setup and got the following KASAN report.
[ 56.040407] ==================================================================
[ 56.042444] BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x861/0x910
[ 56.044962] Write of size 8 at addr ffff88801b7e8958 by task swapper/0/0
[ 56.049092] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G N 7.0.0-dirty #2 PREEMPT(full)
[ 56.049967] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 56.050843] Call Trace:
[ 56.051146] <IRQ>
[ 56.052394] __run_timer_base.part.0+0x861/0x910
[ 56.053123] run_timer_softirq+0xd1/0x190
[ 56.075012] Allocated by task 11:
[ 56.077221] devm_kmalloc+0x70/0x1d0
[ 56.077545] appletb_kbd_probe+0x65/0x470 [hid_appletb_kbd]
[ 56.085606] uhid_device_add_worker+0x3b/0x100
[ 56.088719] Freed by task 11:
[ 56.091296] devres_release_group+0x1fd/0x3d0
[ 56.091844] hid_device_probe+0x4db/0x7d0
[ 56.096916] uhid_device_add_worker+0x3b/0x100
[ 56.123572] backlight_device_set_brightness+0x77/0x280
[ 56.123902] appletb_inactivity_timer+0xe9/0x190 [hid_appletb_kbd]
[ 56.123967] call_timer_fn+0x163/0x4a0
[ 56.124338] __run_timer_base.part.0+0x575/0x910
[ 56.124711] run_timer_softirq+0xd1/0x190
Patch 2 also matches what I saw in the same setup. On the unpatched
tree, I can reproduce:
[ 56.120488] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591
[ 56.121118] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0
[ 56.123080] __mutex_lock+0xda/0x21c0
[ 56.123572] backlight_device_set_brightness+0x77/0x280
[ 56.123902] appletb_inactivity_timer+0xe9/0x190 [hid_appletb_kbd]
[ 56.124338] __run_timer_base.part.0+0x575/0x910
[ 56.124711] run_timer_softirq+0xd1/0x190
After applying patch 2, that warning no longer appeared in the timer
reproducer in my uhi/QEMU runs. I also added a small UHID input trigger
to exercise appletb_kbd_hid_event(), and in that setup brightness
restored from 1 back to 2 in 5/5 iterations after the synthetic key
event.
The limitation is that this is still UHID-only coverage. I do not have
native Touch Bar hardware, and pure UHID does not model a real internal
Apple keyboard/trackpad closely enough for me to claim coverage of the
appletb_kbd_inp_event() path or real USB IRQ-context behavior.
Thanks,
Sangyun
^ permalink raw reply
* Re: [PATCH v2 1/7] iio: HID: Add helper method hid_sensor_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:03 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, Pietro Di Consolo Gregorio, linux-iio,
linux-input
In-Reply-To: <20260421222210.16016-2-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:33PM -0300, Natália Salvino André wrote:
> Add helper method to deduplicate code in HID sensors.
...
> +#include <linux/bits.h>
Will need bitops.h instead (see below why).
...
> +void hid_sensor_adjust_channel_bit_mask(struct iio_chan_spec *channels,
> + int channel, int size)
> +{
> + channels[channel].scan_type.format = 's';
> + /* Real storage bits will change based on the report desc. */
> + channels[channel].scan_type.realbits = size * BITS_PER_BYTE;
BITS_TO_BYTES(size)
> + /* Maximum size of a sample to capture is u32 */
> + channels[channel].scan_type.storagebits = sizeof(u32) * BITS_PER_BYTE;
BITS_PER_TYPE(u32)
> +}
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 2/7] iio: accel: HID: Replace method accel_3d_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:07 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, Pietro Di Consolo Gregorio, linux-iio,
linux-input
In-Reply-To: <20260421222210.16016-3-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:34PM -0300, Natália Salvino André wrote:
> Replace method accel_3d_adjust_channel_bit_mask()
> with helper method hid_sensor_adjust_channel_bit_mask().
...
> - accel_3d_adjust_channel_bit_mask(channels,
> - CHANNEL_SCAN_INDEX_X + i,
> - st->accel[CHANNEL_SCAN_INDEX_X + i].size);
> + hid_sensor_adjust_channel_bit_mask(channels,
> + CHANNEL_SCAN_INDEX_X + i,
> + st->accel[CHANNEL_SCAN_INDEX_X + i].size);
Indentation is broken. Taking into account that the last line is too long when
properly indented, perhaps
hid_sensor_adjust_channel_bit_mask(channels,
CHANNEL_SCAN_INDEX_X + i,
st->accel[CHANNEL_SCAN_INDEX_X + i].size);
Which makes it most right and under 80 limit.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 3/7] iio: gyro: HID: Replace method gyro_3d_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:14 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, Pietro Di Consolo Gregorio, linux-iio,
linux-input
In-Reply-To: <20260421222210.16016-4-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:35PM -0300, Natália Salvino André wrote:
> Replace method gyro_3d_adjust_channel_bit_mask()
> with helper method hid_sensor_adjust_channel_bit_mask().
...
> + hid_sensor_adjust_channel_bit_mask(channels,
> + CHANNEL_SCAN_INDEX_X + i,
> + st->gyro[CHANNEL_SCAN_INDEX_X + i].size);
Same, at least one more tab for indentation.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH 0/2] HID: appletb-kbd: fix UAF and mutex-in-atomic in inactivity timer
From: Aditya Garg @ 2026-04-22 9:15 UTC (permalink / raw)
To: Sangyun Kim
Cc: jikos@kernel.org, bentiss@kernel.org, qasdev00@gmail.com,
linux-input@vger.kernel.org, linux-kernel@vger.kernel.org
In-Reply-To: <20260422060104.jbimo4nm6pat3f53@nunu>
I got the bug just once so it's possible that it was a firmware related bug in the touchbar as well.
> On 22 Apr 2026, at 11:31 AM, Sangyun Kim <sangyun.kim@snu.ac.kr> wrote:
>
> On Mon, Apr 20, 2026 at 06:17:36 PM +0530, Aditya Garg wrote:
>
>>
>>
>>> On 4/20/26 10:43, Sangyun Kim wrote:
>>> This series addresses two defects in hid-appletb-kbd's inactivity
>>> timer subsystem. The two patches target different bugs and are
>>> logically independent; they are sent together because they touch the
>>> same tear-down code and because the same maintainer will review both.
>>>
>>> Patch 1 fixes a slab use-after-free with two related tear-down windows
>>> introduced by commit 38224c472a03 ("HID: appletb-kbd: fix slab
>>> use-after-free bug in appletb_kbd_probe"):
>>>
>>> A) Within "if (kbd->backlight_dev)" the order was
>>> put_device() then timer_delete_sync(). A concurrent
>>> hid_appletb_bl unbind between those two calls can drop the last
>>> devm reference and free the backlight_device; the still-armed
>>> inactivity timer softirq then dereferences the freed object
>>> through backlight_device_set_brightness() -> mutex_lock(&ops_lock).
>>>
>>> B) The "if (kbd->backlight_dev)" block ran before
>>> hid_hw_close()/hid_hw_stop(), so even after window A is closed a
>>> late ".event" callback from the HID core (USB URB completion on
>>> real hardware) can arrive between timer_delete_sync() and
>>> put_device(), reach reset_inactivity_timer(), re-arm the timer
>>> via mod_timer(), and reopen the same UAF.
>>>
>>> Both windows produce the same KASAN slab-use-after-free on the object
>>> allocated by devm_backlight_device_register(). Patch 1 closes them
>>> together by moving hid_hw_close()/hid_hw_stop() before the backlight
>>> cleanup and, inside that cleanup block, calling timer_delete_sync()
>>> before put_device(). Shipping both as one commit avoids leaving
>>> stable kernels in a half-fixed state where only window A is closed.
>>>
>>> Patch 2 fixes a separate "sleeping function called from invalid
>>> context" bug in the same subsystem. The inactivity timer is a
>>> struct timer_list, so the callback runs in softirq context and calls
>>> backlight_device_set_brightness() -> mutex_lock() from atomic
>>> context; reset_inactivity_timer() has the same issue on the
>>> brightness-restore path (it is called from appletb_kbd_hid_event()
>>> and appletb_kbd_inp_event(), which run in softirq/IRQ context on
>>> real USB hardware). Convert the inactivity timer to a delayed_work
>>> and defer the brightness-restore call to a dedicated work_struct so
>>> both sleeping calls run in process context.
>>>
>>> Sangyun Kim (2):
>>> HID: appletb-kbd: fix UAF in inactivity-timer cleanup path
>>> HID: appletb-kbd: run inactivity autodim from workqueues
>>>
>>> drivers/hid/hid-appletb-kbd.c | 56 ++++++++++++++++++++++-------------
>>> 1 file changed, 36 insertions(+), 20 deletions(-)
>>>
>>
>> I had a very weird bug just once. And that was when I pressed fn key, upon releasing, the touchbar mode did not restore to normal.
>>
>> Although it was just once, and I was never able to reproduce it again.
>>
>> Have you tested it on your Machine btw?
>>
>>
>
> Hi,
>
> I have not tested this series on actual Apple Touch Bar hardware on my
> side, as I do not have access to such a machine locally. All testing on
> my side was done under QEMU with a uhid-based setup.
>
> Because of that, I cannot say much about the one-off case where the
> Touch Bar did not restore the normal mode after releasing Fn. I have not
> been able to reproduce that specific behavior in my setup.
>
> For patch 1, however, I was able to reproduce the teardown UAF in the
> uhid/QEMU setup and got the following KASAN report.
>
> [ 56.040407] ==================================================================
> [ 56.042444] BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x861/0x910
> [ 56.044962] Write of size 8 at addr ffff88801b7e8958 by task swapper/0/0
> [ 56.049092] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G N 7.0.0-dirty #2 PREEMPT(full)
> [ 56.049967] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> [ 56.050843] Call Trace:
> [ 56.051146] <IRQ>
> [ 56.052394] __run_timer_base.part.0+0x861/0x910
> [ 56.053123] run_timer_softirq+0xd1/0x190
>
> [ 56.075012] Allocated by task 11:
> [ 56.077221] devm_kmalloc+0x70/0x1d0
> [ 56.077545] appletb_kbd_probe+0x65/0x470 [hid_appletb_kbd]
> [ 56.085606] uhid_device_add_worker+0x3b/0x100
>
> [ 56.088719] Freed by task 11:
> [ 56.091296] devres_release_group+0x1fd/0x3d0
> [ 56.091844] hid_device_probe+0x4db/0x7d0
> [ 56.096916] uhid_device_add_worker+0x3b/0x100
>
> [ 56.123572] backlight_device_set_brightness+0x77/0x280
> [ 56.123902] appletb_inactivity_timer+0xe9/0x190 [hid_appletb_kbd]
> [ 56.123967] call_timer_fn+0x163/0x4a0
> [ 56.124338] __run_timer_base.part.0+0x575/0x910
> [ 56.124711] run_timer_softirq+0xd1/0x190
>
> Patch 2 also matches what I saw in the same setup. On the unpatched
> tree, I can reproduce:
>
> [ 56.120488] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591
> [ 56.121118] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0
> [ 56.123080] __mutex_lock+0xda/0x21c0
> [ 56.123572] backlight_device_set_brightness+0x77/0x280
> [ 56.123902] appletb_inactivity_timer+0xe9/0x190 [hid_appletb_kbd]
> [ 56.124338] __run_timer_base.part.0+0x575/0x910
> [ 56.124711] run_timer_softirq+0xd1/0x190
>
> After applying patch 2, that warning no longer appeared in the timer
> reproducer in my uhi/QEMU runs. I also added a small UHID input trigger
> to exercise appletb_kbd_hid_event(), and in that setup brightness
> restored from 1 back to 2 in 5/5 iterations after the synthetic key
> event.
>
> The limitation is that this is still UHID-only coverage. I do not have
> native Touch Bar hardware, and pure UHID does not model a real internal
> Apple keyboard/trackpad closely enough for me to claim coverage of the
> appletb_kbd_inp_event() path or real USB IRQ-context behavior.
>
> Thanks,
> Sangyun
^ permalink raw reply
* Re: [PATCH v2 5/7] iio: light: HID: Replace method prox_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:16 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, Pietro Di Consolo Gregorio, linux-iio,
linux-input
In-Reply-To: <20260421222210.16016-6-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:37PM -0300, Natália Salvino André wrote:
> Replace method prox_adjust_channel_bit_mask()
> with helper method hid_sensor_adjust_channel_bit_mask().
...
> + hid_sensor_adjust_channel_bit_mask(channels, index,
> + st->prox_attr[index].size);
This fits 80 when indented properly.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 4/7] iio: light: HID: Replace method als_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:17 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, Pietro Di Consolo Gregorio, linux-iio,
linux-input
In-Reply-To: <20260421222210.16016-5-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:36PM -0300, Natália Salvino André wrote:
> Replace method als_adjust_channel_bit_mask()
> with helper method hid_sensor_adjust_channel_bit_mask().
...
> - als_adjust_channel_bit_mask(channels, index, st->als[i].size);
> + hid_sensor_adjust_channel_bit_mask(channels, index, st->als[i].size);
Indent to next line
hid_sensor_adjust_channel_bit_mask(channels, index,
st->als[i].size);
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 6/7] iio: magnetometer: HID: Replace method magn_3d_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:18 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, Pietro Di Consolo Gregorio, linux-iio,
linux-input
In-Reply-To: <20260421222210.16016-7-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:38PM -0300, Natália Salvino André wrote:
> Replace method magn_3d_adjust_channel_bit_mask()
> with helper method hid_sensor_adjust_channel_bit_mask().
...
> - magn_3d_adjust_channel_bit_mask(_channels,
> - *chan_count,
> - st->magn[i].size);
> + hid_sensor_adjust_channel_bit_mask(_channels,
> + *chan_count,
> + st->magn[i].size);
Fix the indentation accordingly.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 7/7] iio: pressure: HID: Replace method press_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:18 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, Pietro Di Consolo Gregorio, linux-iio,
linux-input
In-Reply-To: <20260421222210.16016-8-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:39PM -0300, Natália Salvino André wrote:
> Replace method press_adjust_channel_bit_mask()
> with helper method hid_sensor_adjust_channel_bit_mask().
...
> - press_adjust_channel_bit_mask(channels, CHANNEL_SCAN_INDEX_PRESSURE,
> - st->press_attr.size);
> + hid_sensor_adjust_channel_bit_mask(channels, CHANNEL_SCAN_INDEX_PRESSURE,
> + st->press_attr.size);
Ouch!
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 0/7] Add helper method hid_sensor_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-22 9:21 UTC (permalink / raw)
To: Natália Salvino André
Cc: andy, bentiss, dlechner, jic23, jikos, nuno.sa,
srinivas.pandruvada, linux-iio, linux-input
In-Reply-To: <20260421222210.16016-1-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:32PM -0300, Natália Salvino André wrote:
> This patch series introduces a generic helper function to handle channel bit mask adjustments
> for HID sensors. Currently, multiple drivers implement identical logic for this task
This message should be wrapped on ~72 characters. Some of the maintainers may
use cover letter as fake-merge commit message. And even if not, the standards
in the kernel for the cover letter and commit messages are the same in terms of
writing rules.
Basically this is the biggest issue in the whole series: missed proper
indentation / wrapping.
Code wise looks good, thanks for doing this!
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* [git pull] Input updates for v7.1-rc0
From: Dmitry Torokhov @ 2026-04-22 15:05 UTC (permalink / raw)
To: Linus Torvalds; +Cc: linux-kernel, linux-input
Hi Linus,
Please pull from:
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git tags/input-for-v7.1-rc0
to receive updates for the input subsystem. You will get:
- a new charlieplex GPIO keypad driver
- an update to aw86927 driver to support 86938 chip
- an update for Chrome OS EC keyboard driver to support Fn-<key> keymap
extension
- an UAF fix in debugfs teardown in EDT touchscreen driver
- a number of conversions for input drivers to use guard() and __free()
cleanup primitives
- several drivers for bus mice (inport, logibm) and other very old
devices have been removed
- OLPC HGPK PS/2 protocol has been removed as it's been broken and
inactive for 10 something years
- dedicated kpsmoused has been removed from psmouse driver
- other assorted cleanups and fixups.
Changelog:
---------
Ariel Silver (1):
Input: atkbd - validate scancode in firmware keymap entries
Bhushan Shah (1):
dt-bindings: input: touchscreen: edt-ft5x06: Add FocalTech FT3519
Dmitry Torokhov (57):
Input: cros_ec_keyb - use u8 instead of uint8_t
Input: cros_ec_keyb - use BIT() macro instead of open-coding shifts
Input: cros_ec_keyb - simplify cros_ec_keyb_work()
Input: cros_ec_keyb - do not allocate keyboard state separately
Input: cros_ec_keyb - factor out column processing
Input: atkbd - use __free() cleanup facility in when parsing FW keymap
Input: atkbd - use dev_warn_ratelimited()
Input: atkbd - switch to using explicitly sized types
Input: atkbd - fix various formatting issues
Input: hgpk - remove protocol support
Input: alps - use standard workqueue when registering supplemental device
Input: psmouse - remove dedicated kpsmoused workqueue
Input: ad7877 - use guard notation when acquiring mutexes/locks
Input: ad7879 - use guard notation when acquiring mutexes
Input: ads7846 - switch to using cleanup functions
Input: atmel_mxt_ts - switch to using cleanup functions
Input: auo-pixcir-ts - use guard notation when acquiring mutexes
Input: bu21029_ts - use guard notation when acquiring mutex
Input: chipone_icn8318 - use guard notation when acquiring mutex
Input: cyttsp - use guard notation when acquiring mutex
Input: edt-ft5x06 - use guard notation when acquiring mutex
Input: eeti_ts - use guard notation when acquiring mutexes
Input: ektf2127 - use guard notation when acquiring mutex
Input: elants_i2c - switch to using cleanup facilities
Input: elo - use guard notation when acquiring mutex
Input: exc3000 - use guard notation when acquiring mutex
Input: goodix - switch to using cleanup functions in firmware code
Input: hideep - switch to using cleanup functions
Input: hycon-hy46xx - use guard notation when acquiring mutex
Input: imagis - use guard notation when acquiring mutex
Input: imx6ul_tsc - use guard notation when acquiring mutex
Input: ipaq-micro-ts - use guard notation when acquiring mutex/spinlock
Input: iqs5xx - switch to using cleanup functions
Input: iqs5xx - simplify parsing of firmware blob
Input: iqs7211 - use cleanup facility for fwnodes
Input: lpc32xx_ts - use guard notation when acquiring mutex
Input: melfas_mip4 - switch to using cleanup functions
Input: mk712 - use guard notation when acquiring spinlock
Input: mms114 - use guard notation when acquiring mutex
Input: msg2638 - use guard notation when acquiring mutex
Input: mxs-lradc-ts - use guard notation when acquiring spinlock
Input: novatek-nvt-ts - use guard notation when acquiring mutex
Input: pixcir_i2c_ts - use guard notation when acquiring mutex
Input: raydium_i2c_ts - switch to using cleanup functions
Input: stmfts - use guard notation when acquiring mutex
Input: sur40 - use guard notation when acquiring spinlock
Input: sx8654 - use guard notation when acquiring spinlock
Input: sx8654 - use IRQF_NOAUTOEN when requesting interrupt
Input: tsc2007 - use guard notation when acquiring mutexes
Input: wdt87xx_i2c - switch to using cleanup functions
Input: wm97xx - use guard notation when acquiring mutex
Input: zinitix - use guard notation when acquiring mutex
Input: inport - remove driver
Input: logibm - remove driver
Input: mk712 - remove driver
Input: ct82c710 - remove driver
Input: edt-ft5x06 - fix use-after-free in debugfs teardown
Duoming Zhou (1):
Input: psmouse - replace flush_workqueue() with disable_delayed_work_sync()
Eduard Bostina (1):
dt-bindings: input: touchscreen: Convert TS-4800 to DT schema
Elliot Tester (1):
Input: xpad - remove stale TODO and changelog header
Ethan Carter Edwards (1):
Input: imx_keypad - fix spelling mistake "Colums" -> "Columns"
Fabio Baltieri (2):
Input: export input_default_setkeycode
Input: cros_ec_keyb - add function key support
Griffin Kroah-Hartman (3):
Input: aw86927 - respect vibration magnitude levels
dt-bindings: input: awinic,aw86927: Add Awinic AW86938
Input: aw86927 - add support for Awinic AW86938
Hugo Villeneuve (5):
dt-bindings: input: matrix-keymap: fix key board wording
dt-bindings: input: add debounce-delay-ms common property
dt-bindings: input: add settling-time-us common property
dt-bindings: input: add GPIO charlieplex keypad
Input: charlieplex_keypad - add GPIO charlieplex keypad
Johan Hovold (4):
Input: keyspan-remote - refactor endpoint lookup
Input: appletouch - refactor endpoint lookup
Input: synaptics_usb - refactor endpoint lookup
Input: usbtouchscreen - refactor endpoint lookup
Langyan Ye (2):
dt-bindings: input: Add Parade TC3408 touchscreen controller
HID: i2c-hid: elan: Add parade-tc3408 timing
Marek Vasut (1):
dt-bindings: touchscreen: trivial-touch: Move allOf: after required:
Max Brener (1):
Input: libps2 - embed WARN_ON(1) macros into their enclosing if statements
Michael Tretter (2):
Input: st1232 - read firmware version and revision
Input: st1232 - expose firmware version via sysfs
Oliver Neukum (2):
Input: aiptek - use HID headers
Input: pegasus_notetaker - use HID defines
Pengpeng Hou (2):
Input: gf2k - skip invalid hat lookup values
Input: aiptek - validate raw macro indices before updating state
Rafael J. Wysocki (1):
Input: atlas - convert ACPI driver to a platform one
Sanjay Govind (1):
Input: xpad - add RedOctane Games vendor id
Seungjin Bae (1):
Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
Thorsten Blum (3):
Input: adxl34x - drop redundant error variable in adxl34x_i2c_probe
Input: qt1050 - inline i2c_check_functionality check
Input: qt1070 - inline i2c_check_functionality check
Val Packett (1):
Input: goodix-berlin - report a resolution of 10 units/mm
Yauhen Kharuzhy (5):
Input: drv260x - add I2C IDs for all device variants
Input: drv260x - sort all #include alphabetically
Input: drv260x - add support for ACPI-enumerated devices
Input: drv260x - handle calibration timeout
Input: drv260x - fix unbalanced regulator_disable() call
bui duc phuc (2):
dt-bindings: input: touchscreen: sitronix,st1232: Add wakeup-source
Input: mpr121 - drop redundant wakeup handling
Diffstat:
--------
.../bindings/auxdisplay/holtek,ht16k33.yaml | 5 +-
.../devicetree/bindings/input/awinic,aw86927.yaml | 7 +-
.../bindings/input/cirrus,ep9307-keypad.yaml | 7 +-
.../bindings/input/gpio-charlieplex-keypad.yaml | 108 ++
.../bindings/input/gpio-matrix-keypad.yaml | 5 +-
Documentation/devicetree/bindings/input/input.yaml | 16 +
.../devicetree/bindings/input/matrix-keymap.yaml | 4 +-
.../bindings/input/mediatek,mt6779-keypad.yaml | 1 +
.../devicetree/bindings/input/parade,tc3408.yaml | 68 ++
.../bindings/input/touchscreen/edt-ft5x06.yaml | 30 +-
.../input/touchscreen/sitronix,st1232.yaml | 4 +
.../input/touchscreen/technologic,ts4800-ts.yaml | 42 +
.../bindings/input/touchscreen/trivial-touch.yaml | 6 +-
.../bindings/input/touchscreen/ts4800-ts.txt | 11 -
.../devicetree/bindings/mfd/fsl,mc13xxx.yaml | 2 -
MAINTAINERS | 7 +
drivers/hid/i2c-hid/i2c-hid-of-elan.c | 8 +
drivers/input/input.c | 23 +-
drivers/input/joystick/gf2k.c | 6 +-
drivers/input/joystick/xpad.c | 35 +-
drivers/input/keyboard/Kconfig | 14 +
drivers/input/keyboard/Makefile | 1 +
drivers/input/keyboard/atkbd.c | 133 ++-
drivers/input/keyboard/charlieplex_keypad.c | 232 +++++
drivers/input/keyboard/cros_ec_keyb.c | 261 +++--
drivers/input/keyboard/imx_keypad.c | 4 +-
drivers/input/keyboard/mpr121_touchkey.c | 8 -
drivers/input/keyboard/qt1050.c | 3 +-
drivers/input/keyboard/qt1070.c | 3 +-
drivers/input/misc/adxl34x-i2c.c | 5 +-
drivers/input/misc/atlas_btns.c | 22 +-
drivers/input/misc/aw86927.c | 66 +-
drivers/input/misc/drv260x.c | 50 +-
drivers/input/misc/ims-pcu.c | 32 +-
drivers/input/misc/keyspan_remote.c | 22 +-
drivers/input/mouse/Kconfig | 36 -
drivers/input/mouse/Makefile | 3 -
drivers/input/mouse/alps.c | 11 +-
drivers/input/mouse/alps.h | 4 +-
drivers/input/mouse/appletouch.c | 21 +-
drivers/input/mouse/hgpk.c | 1063 --------------------
drivers/input/mouse/hgpk.h | 61 --
drivers/input/mouse/inport.c | 177 ----
drivers/input/mouse/logibm.c | 166 ---
drivers/input/mouse/psmouse-base.c | 51 +-
drivers/input/mouse/psmouse.h | 6 +-
drivers/input/mouse/synaptics_usb.c | 23 +-
drivers/input/serio/Kconfig | 13 -
drivers/input/serio/Makefile | 1 -
drivers/input/serio/ct82c710.c | 239 -----
drivers/input/serio/libps2.c | 12 +-
drivers/input/tablet/aiptek.c | 20 +-
drivers/input/tablet/pegasus_notetaker.c | 7 +-
drivers/input/touchscreen/Kconfig | 12 -
drivers/input/touchscreen/Makefile | 1 -
drivers/input/touchscreen/ad7877.c | 32 +-
drivers/input/touchscreen/ad7879.c | 46 +-
drivers/input/touchscreen/ads7846.c | 44 +-
drivers/input/touchscreen/atmel_mxt_ts.c | 290 +++---
drivers/input/touchscreen/auo-pixcir-ts.c | 43 +-
drivers/input/touchscreen/bu21029_ts.c | 8 +-
drivers/input/touchscreen/chipone_icn8318.c | 8 +-
drivers/input/touchscreen/cyttsp_core.c | 20 +-
drivers/input/touchscreen/edt-ft5x06.c | 90 +-
drivers/input/touchscreen/eeti_ts.c | 27 +-
drivers/input/touchscreen/ektf2127.c | 8 +-
drivers/input/touchscreen/elants_i2c.c | 91 +-
drivers/input/touchscreen/elo.c | 32 +-
drivers/input/touchscreen/exc3000.c | 31 +-
drivers/input/touchscreen/goodix_berlin_core.c | 8 +
drivers/input/touchscreen/goodix_fwupload.c | 29 +-
drivers/input/touchscreen/hideep.c | 54 +-
drivers/input/touchscreen/hycon-hy46xx.c | 31 +-
drivers/input/touchscreen/imagis.c | 30 +-
drivers/input/touchscreen/imx6ul_tsc.c | 19 +-
drivers/input/touchscreen/ipaq-micro-ts.c | 8 +-
drivers/input/touchscreen/iqs5xx.c | 190 ++--
drivers/input/touchscreen/iqs7211.c | 24 +-
drivers/input/touchscreen/lpc32xx_ts.c | 8 +-
drivers/input/touchscreen/melfas_mip4.c | 121 +--
drivers/input/touchscreen/mk712.c | 215 ----
drivers/input/touchscreen/mms114.c | 20 +-
drivers/input/touchscreen/msg2638.c | 19 +-
drivers/input/touchscreen/mxs-lradc-ts.c | 7 +-
drivers/input/touchscreen/novatek-nvt-ts.c | 8 +-
drivers/input/touchscreen/pixcir_i2c_ts.c | 38 +-
drivers/input/touchscreen/raydium_i2c_ts.c | 56 +-
drivers/input/touchscreen/st1232.c | 67 +-
drivers/input/touchscreen/stmfts.c | 63 +-
drivers/input/touchscreen/sur40.c | 23 +-
drivers/input/touchscreen/sx8654.c | 20 +-
drivers/input/touchscreen/tsc2007_core.c | 7 +-
drivers/input/touchscreen/tsc2007_iio.c | 9 +-
drivers/input/touchscreen/usbtouchscreen.c | 43 +-
drivers/input/touchscreen/wdt87xx_i2c.c | 44 +-
drivers/input/touchscreen/wm97xx-core.c | 57 +-
drivers/input/touchscreen/zinitix.c | 19 +-
include/linux/input.h | 4 +
98 files changed, 1815 insertions(+), 3374 deletions(-)
create mode 100644 Documentation/devicetree/bindings/input/gpio-charlieplex-keypad.yaml
create mode 100644 Documentation/devicetree/bindings/input/parade,tc3408.yaml
create mode 100644 Documentation/devicetree/bindings/input/touchscreen/technologic,ts4800-ts.yaml
delete mode 100644 Documentation/devicetree/bindings/input/touchscreen/ts4800-ts.txt
create mode 100644 drivers/input/keyboard/charlieplex_keypad.c
delete mode 100644 drivers/input/mouse/hgpk.c
delete mode 100644 drivers/input/mouse/hgpk.h
delete mode 100644 drivers/input/mouse/inport.c
delete mode 100644 drivers/input/mouse/logibm.c
delete mode 100644 drivers/input/serio/ct82c710.c
delete mode 100644 drivers/input/touchscreen/mk712.c
Thanks.
--
Dmitry
^ permalink raw reply
* Re: [PATCH] Input: ims-pcu - bound frame parser write index against read_buf size
From: Dmitry Torokhov @ 2026-04-23 1:36 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-input, linux-kernel, stable
In-Reply-To: <2026042030-mobilize-suspense-88f9@gregkh>
Hi Greg,
On Mon, Apr 20, 2026 at 09:05:31PM +0200, Greg Kroah-Hartman wrote:
> ims_pcu_process_data() implements a STX/DLE/ETX byte-stuffing parser
> that accumulates frame payload into pcu->read_buf[] using the running
> index pcu->read_pos. read_buf is IMS_PCU_BUF_SIZE (128) bytes and
> read_pos is u8 but of course, we don't check the index before actually
> writing the data :(
>
> Fix this up by properly rejecting the frame at the first attempt to
> write past read_buf and resync on the next STX, mirroring how the parser
> handles short and bad-checksum frames on ETX.
>
> Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
> Cc: stable <stable@kernel.org>
> Assisted-by: gkh_clanker_t1000
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
I already have a patch for this, thanks.
--
Dmitry
^ permalink raw reply
* Re: [PATCH 2/2] Input: synaptics-rmi4 - use u32 for reg_size to avoid sign extension into item->reg_size
From: Dmitry Torokhov @ 2026-04-23 1:59 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-input, linux-kernel, stable
In-Reply-To: <2026042046-clad-aspect-e8f9@gregkh>
On Mon, Apr 20, 2026 at 08:59:46PM +0200, Greg Kroah-Hartman wrote:
> rmi_read_register_desc() builds the 4-byte register size from device
> bytes:
>
> reg_size = struct_buf[offset] |
> (struct_buf[offset + 1] << 8) |
> (struct_buf[offset + 2] << 16) |
> (struct_buf[offset + 3] << 24);
>
> struct_buf is u8 *, so each byte is promoted to int before the shift. A
> device that supplies a top byte with bit 7 set (e.g. 00 00 00 00 00 00
> 80 in struct_buf to reach the 4-byte path with offset+3 = 0x80) makes
> (0x80 << 24) overflow into the int sign bit, and the OR result is
> negative. reg_size is then assigned to item->reg_size, which is
> unsigned long, so the negative int sign-extends to a value near
> ULONG_MAX.
>
> After this, bad things happen when numbers start wrapping and buffers
> are allocatged based on those numbers, and then accessed based on those
> buffers assuming to be a sane size (bigger or smaller).
>
> Fix this all up by just properly making reg_size be a u32.
Shouldn't it be replaced with get_unaligned_le32() instead?
Thanks.
--
Dmitry
^ permalink raw reply
* Re: [PATCH v2 1/7] iio: HID: Add helper method hid_sensor_adjust_channel_bit_mask()
From: Zhang Lixu @ 2026-04-23 3:20 UTC (permalink / raw)
To: natalia.andre
Cc: linux-input, linux-iio, andy, bentiss, dlechner, jic23, jikos,
nuno.sa, srinivas.pandruvada
In-Reply-To: <20260421222210.16016-2-natalia.andre@ime.usp.br>
On Tue, Apr 21, 2026 at 07:20:33PM -0300, Natália Salvino André wrote:
> Add helper method to deduplicate code in HID sensors.
>
> Signed-off-by: Natália Salvino André <natalia.andre@ime.usp.br>
> Co-developed-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
> Signed-off-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
> ---
> .../iio/common/hid-sensors/hid-sensor-attributes.c | 12 ++++++++++++
> include/linux/hid-sensor-hub.h | 3 +++
> 2 files changed, 15 insertions(+)
>
> diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> index c115a72832b2..3ee6e83c6cac 100644
> --- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> +++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> @@ -3,6 +3,7 @@
> * HID Sensors Driver
> * Copyright (c) 2012, Intel Corporation.
> */
> +#include <linux/bits.h>
> #include <linux/module.h>
> #include <linux/kernel.h>
> #include <linux/time.h>
> @@ -589,6 +590,17 @@ int hid_sensor_parse_common_attributes(struct hid_sensor_hub_device *hsdev,
> }
> EXPORT_SYMBOL_NS(hid_sensor_parse_common_attributes, "IIO_HID");
>
> +void hid_sensor_adjust_channel_bit_mask(struct iio_chan_spec *channels,
> + int channel, int size)
> +{
> + channels[channel].scan_type.format = 's';
There is no 'format' field in struct iio_scan_type. This should be:
channels[channel].scan_type.sign = 's';
Thanks,
Lixu
> + /* Real storage bits will change based on the report desc. */
> + channels[channel].scan_type.realbits = size * BITS_PER_BYTE;
> + /* Maximum size of a sample to capture is u32 */
> + channels[channel].scan_type.storagebits = sizeof(u32) * BITS_PER_BYTE;
> +}
> +EXPORT_SYMBOL_NS(hid_sensor_adjust_channel_bit_mask, "IIO_HID");
> +
> MODULE_AUTHOR("Srinivas Pandruvada <srinivas.pandruvada@intel.com>");
> MODULE_DESCRIPTION("HID Sensor common attribute processing");
> MODULE_LICENSE("GPL");
> diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-sensor-hub.h
> index e71056553108..6523d46c63e0 100644
> --- a/include/linux/hid-sensor-hub.h
> +++ b/include/linux/hid-sensor-hub.h
> @@ -281,4 +281,7 @@ bool hid_sensor_batch_mode_supported(struct hid_sensor_common *st);
> int hid_sensor_set_report_latency(struct hid_sensor_common *st, int latency);
> int hid_sensor_get_report_latency(struct hid_sensor_common *st);
>
> +void hid_sensor_adjust_channel_bit_mask(struct iio_chan_spec *channels,
> + int channel, int size);
> +
> #endif
^ permalink raw reply
* [dtor-input:next] BUILD SUCCESS fc59cad7e896fdb7a07bd91f7c0952e2a0e12b36
From: kernel test robot @ 2026-04-23 3:34 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git next
branch HEAD: fc59cad7e896fdb7a07bd91f7c0952e2a0e12b36 Input: lm8323 - remove space before newline
elapsed time: 724m
configs tested: 56
configs skipped: 0
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-15.2.0
alpha allyesconfig gcc-15.2.0
arc allmodconfig gcc-15.2.0
arc allnoconfig gcc-15.2.0
arc allyesconfig gcc-15.2.0
arm allnoconfig clang-23
arm allyesconfig gcc-15.2.0
arm64 allmodconfig clang-19
arm64 allnoconfig gcc-15.2.0
csky allmodconfig gcc-15.2.0
csky allnoconfig gcc-15.2.0
hexagon allmodconfig clang-17
hexagon allnoconfig clang-23
i386 allmodconfig gcc-14
i386 allnoconfig gcc-14
i386 allyesconfig gcc-14
loongarch allmodconfig clang-19
loongarch allnoconfig clang-23
m68k allmodconfig gcc-15.2.0
m68k allnoconfig gcc-15.2.0
m68k allyesconfig gcc-15.2.0
microblaze allnoconfig gcc-15.2.0
microblaze allyesconfig gcc-15.2.0
mips allmodconfig gcc-15.2.0
mips allnoconfig gcc-15.2.0
mips allyesconfig gcc-15.2.0
nios2 allmodconfig gcc-11.5.0
nios2 allnoconfig gcc-11.5.0
openrisc allmodconfig gcc-15.2.0
openrisc allnoconfig gcc-15.2.0
parisc allmodconfig gcc-15.2.0
parisc allnoconfig gcc-15.2.0
parisc allyesconfig gcc-15.2.0
powerpc allmodconfig gcc-15.2.0
powerpc allnoconfig gcc-15.2.0
riscv allmodconfig clang-23
riscv allnoconfig gcc-15.2.0
riscv allyesconfig clang-16
s390 alldefconfig gcc-15.2.0
s390 allmodconfig clang-18
s390 allnoconfig clang-23
s390 allyesconfig gcc-15.2.0
sh allmodconfig gcc-15.2.0
sh allnoconfig gcc-15.2.0
sh allyesconfig gcc-15.2.0
sparc allnoconfig gcc-15.2.0
sparc64 allmodconfig clang-23
um allmodconfig clang-19
um allnoconfig clang-23
um allyesconfig gcc-14
x86_64 allmodconfig clang-20
x86_64 allnoconfig clang-20
x86_64 allyesconfig clang-20
x86_64 rhel-9.4-rust clang-20
xtensa allnoconfig gcc-15.2.0
xtensa allyesconfig gcc-15.2.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH 2/2] Input: synaptics-rmi4 - use u32 for reg_size to avoid sign extension into item->reg_size
From: Greg Kroah-Hartman @ 2026-04-23 4:50 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input, linux-kernel, stable
In-Reply-To: <ael3yDbI3_1oarHN@google.com>
On Wed, Apr 22, 2026 at 06:59:31PM -0700, Dmitry Torokhov wrote:
> On Mon, Apr 20, 2026 at 08:59:46PM +0200, Greg Kroah-Hartman wrote:
> > rmi_read_register_desc() builds the 4-byte register size from device
> > bytes:
> >
> > reg_size = struct_buf[offset] |
> > (struct_buf[offset + 1] << 8) |
> > (struct_buf[offset + 2] << 16) |
> > (struct_buf[offset + 3] << 24);
> >
> > struct_buf is u8 *, so each byte is promoted to int before the shift. A
> > device that supplies a top byte with bit 7 set (e.g. 00 00 00 00 00 00
> > 80 in struct_buf to reach the 4-byte path with offset+3 = 0x80) makes
> > (0x80 << 24) overflow into the int sign bit, and the OR result is
> > negative. reg_size is then assigned to item->reg_size, which is
> > unsigned long, so the negative int sign-extends to a value near
> > ULONG_MAX.
> >
> > After this, bad things happen when numbers start wrapping and buffers
> > are allocatged based on those numbers, and then accessed based on those
> > buffers assuming to be a sane size (bigger or smaller).
> >
> > Fix this all up by just properly making reg_size be a u32.
>
> Shouldn't it be replaced with get_unaligned_le32() instead?
Sure, be glad to do that instead, this was just a "simpler" solution :)
I'll respin that after -rc1 is out.
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH] Input: ims-pcu - bound frame parser write index against read_buf size
From: Greg Kroah-Hartman @ 2026-04-23 4:52 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input, linux-kernel, stable
In-Reply-To: <ael3agFzDEV0SgxT@google.com>
On Wed, Apr 22, 2026 at 06:36:24PM -0700, Dmitry Torokhov wrote:
> Hi Greg,
>
> On Mon, Apr 20, 2026 at 09:05:31PM +0200, Greg Kroah-Hartman wrote:
> > ims_pcu_process_data() implements a STX/DLE/ETX byte-stuffing parser
> > that accumulates frame payload into pcu->read_buf[] using the running
> > index pcu->read_pos. read_buf is IMS_PCU_BUF_SIZE (128) bytes and
> > read_pos is u8 but of course, we don't check the index before actually
> > writing the data :(
> >
> > Fix this up by properly rejecting the frame at the first attempt to
> > write past read_buf and resync on the next STX, mirroring how the parser
> > handles short and bad-checksum frames on ETX.
> >
> > Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> > Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
> > Cc: stable <stable@kernel.org>
> > Assisted-by: gkh_clanker_t1000
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> I already have a patch for this, thanks.
Ah, missed that, sorry, I was working against Linus's tree. I am
guessing you are referring to commit 875115b82c29 ("Input: ims-pcu - fix
heap-buffer-overflow in ims_pcu_process_data()")? If so, why wasn't
that tagged for stable inclusion?
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH] HID: usbhid: sanitize hid->uniq against non-printable bytes
From: Eric Naim @ 2026-04-23 5:55 UTC (permalink / raw)
To: Greg KH, Taylor Hewetson
Cc: Jiri Kosina, Benjamin Tissoires, linux-usb, linux-input,
linux-kernel
In-Reply-To: <2026041845-approve-pelvis-9845@gregkh>
On 4/18/26 3:14 PM, Greg KH wrote:
> On Sat, Apr 18, 2026 at 02:58:23PM +1200, Taylor Hewetson wrote:
>> Some USB HID devices (observed on ASUS ROG Azoth via its 2.4GHz
>> dongle, USB ID 0b05:1a85) report an iSerialNumber string whose
>> USB string descriptor declares a longer length than the actual
>> serial, leaving uninitialized firmware memory - including control
>> characters such as 0x18 - appended to the returned string.
>>
>> These non-printable bytes propagate into hid->uniq, which in turn
>> populates /sys/class/input/inputN/uniq. Downstream userspace
>> components (systemd sd-device property_is_valid(), and by extension
>> mutter input enumeration on GNOME Wayland sessions) reject devices
>> with control characters in their uniq, rendering otherwise-
>> functional input devices unusable in graphical sessions despite
>> the kernel input layer correctly translating keypresses.
>>
>> Truncate hid->uniq at the first byte outside the printable ASCII
>> range (0x20..0x7e) after the serial is read.
>
> Why aren't we doing this in the USB core instead of forcing all users of
> this to do it instead?
Should it be up to the kernel to do this as well? Currently this is only a
problem with systemd because they added this check, and it looks like they
have something in mind to fix it as well [1].
[1] https://github.com/systemd/systemd/issues/41339#issuecomment-4266429563
>
> thanks,
>
> greg k-h
--
Regards,
Eric
^ permalink raw reply
* [PATCH] HID: intel-thc-hid: Intel-quickspi: Fix some error codes
From: Dan Carpenter @ 2026-04-23 7:10 UTC (permalink / raw)
To: Even Xu
Cc: Xinpeng Sun, Jiri Kosina, Benjamin Tissoires, Mark Pearson,
Srinivas Pandruvada, linux-input, linux-kernel, kernel-janitors
If we have a partial read that is supposed to be treated as failure but
in this code we forgot to set the error code. Return -EINVAL.
Fixes: 9d8d51735a3a ("HID: intel-thc-hid: intel-quickspi: Add HIDSPI protocol implementation")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
index 16f780bc879b..cb19057f1191 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.c
@@ -94,7 +94,7 @@ static int quickspi_get_device_descriptor(struct quickspi_device *qsdev)
dev_err_once(qsdev->dev, "Read DEVICE_DESCRIPTOR failed, ret = %d\n", ret);
dev_err_once(qsdev->dev, "DEVICE_DESCRIPTOR expected len = %u, actual read = %u\n",
input_len, read_len);
- return ret;
+ return ret ?: -EINVAL;
}
input_rep_type = ((struct input_report_body_header *)read_buf)->input_report_type;
@@ -318,7 +318,7 @@ int reset_tic(struct quickspi_device *qsdev)
dev_err_once(qsdev->dev, "Read RESET_RESPONSE body failed, ret = %d\n", ret);
dev_err_once(qsdev->dev, "RESET_RESPONSE body expected len = %u, actual = %u\n",
read_len, actual_read_len);
- return ret;
+ return ret ?: -EINVAL;
}
input_rep_type = FIELD_GET(HIDSPI_IN_REP_BDY_HDR_REP_TYPE, reset_response);
--
2.53.0
^ permalink raw reply related
* Re: [PATCH v2 1/7] iio: HID: Add helper method hid_sensor_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-23 7:54 UTC (permalink / raw)
To: Zhang Lixu
Cc: natalia.andre, linux-input, linux-iio, andy, bentiss, dlechner,
jic23, jikos, nuno.sa, srinivas.pandruvada
In-Reply-To: <20260423032038.233475-1-lixu.zhang@intel.com>
On Thu, Apr 23, 2026 at 11:20:38AM +0800, Zhang Lixu wrote:
> On Tue, Apr 21, 2026 at 07:20:33PM -0300, Natália Salvino André wrote:
> > Add helper method to deduplicate code in HID sensors.
...
> > +void hid_sensor_adjust_channel_bit_mask(struct iio_chan_spec *channels,
> > + int channel, int size)
> > +{
> > + channels[channel].scan_type.format = 's';
>
> There is no 'format' field in struct iio_scan_type. This should be:
> channels[channel].scan_type.sign = 's';
Your information is outdated, I believe.
> > + /* Real storage bits will change based on the report desc. */
> > + channels[channel].scan_type.realbits = size * BITS_PER_BYTE;
> > + /* Maximum size of a sample to capture is u32 */
> > + channels[channel].scan_type.storagebits = sizeof(u32) * BITS_PER_BYTE;
> > +}
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* [dtor-input:for-linus] BUILD SUCCESS f4b369c6fe0ceaba2da2daff8c9eb415f85926dd
From: kernel test robot @ 2026-04-23 8:32 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git for-linus
branch HEAD: f4b369c6fe0ceaba2da2daff8c9eb415f85926dd Merge branch 'next' into for-linus
elapsed time: 1022m
configs tested: 88
configs skipped: 3
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-15.2.0
alpha allyesconfig gcc-15.2.0
arc allmodconfig gcc-15.2.0
arc allnoconfig gcc-15.2.0
arc allyesconfig gcc-15.2.0
arc hsdk_defconfig gcc-15.2.0
arc randconfig-001-20260423 gcc-15.2.0
arc randconfig-002-20260423 gcc-8.5.0
arm allnoconfig clang-23
arm allyesconfig gcc-15.2.0
arm randconfig-001-20260423 gcc-10.5.0
arm randconfig-003-20260423 clang-23
arm64 allmodconfig clang-19
arm64 allnoconfig gcc-15.2.0
arm64 randconfig-003-20260423 gcc-14.3.0
csky allmodconfig gcc-15.2.0
csky allnoconfig gcc-15.2.0
csky randconfig-001-20260423 gcc-10.5.0
hexagon allmodconfig clang-17
hexagon allnoconfig clang-23
hexagon randconfig-001-20260423 clang-16
i386 allmodconfig gcc-14
i386 allnoconfig gcc-14
i386 allyesconfig gcc-14
i386 randconfig-011-20260423 gcc-14
i386 randconfig-012-20260423 gcc-14
loongarch allmodconfig clang-19
loongarch allnoconfig clang-23
m68k allmodconfig gcc-15.2.0
m68k allnoconfig gcc-15.2.0
m68k allyesconfig gcc-15.2.0
microblaze allnoconfig gcc-15.2.0
microblaze allyesconfig gcc-15.2.0
mips allnoconfig gcc-15.2.0
mips allyesconfig gcc-15.2.0
nios2 allmodconfig gcc-11.5.0
nios2 allnoconfig gcc-11.5.0
openrisc allmodconfig gcc-15.2.0
openrisc allnoconfig gcc-15.2.0
parisc allnoconfig gcc-15.2.0
parisc allyesconfig gcc-15.2.0
parisc randconfig-001-20260423 gcc-9.5.0
parisc randconfig-002-20260423 gcc-13.4.0
powerpc allmodconfig gcc-15.2.0
powerpc allnoconfig gcc-15.2.0
powerpc randconfig-001-20260423 clang-23
powerpc randconfig-002-20260423 clang-23
powerpc64 randconfig-001-20260423 clang-23
powerpc64 randconfig-002-20260423 gcc-10.5.0
riscv allmodconfig clang-23
riscv allnoconfig gcc-15.2.0
riscv allyesconfig clang-16
riscv randconfig-001-20260423 clang-17
riscv randconfig-002-20260423 gcc-12.5.0
s390 allmodconfig clang-18
s390 allnoconfig clang-23
s390 allyesconfig gcc-15.2.0
s390 randconfig-001-20260423 clang-23
s390 randconfig-002-20260423 gcc-10.5.0
sh allmodconfig gcc-15.2.0
sh allnoconfig gcc-15.2.0
sh allyesconfig gcc-15.2.0
sh defconfig gcc-15.2.0
sh randconfig-001-20260423 gcc-15.2.0
sh randconfig-002-20260423 gcc-15.2.0
sparc allnoconfig gcc-15.2.0
sparc randconfig-001-20260423 gcc-11.5.0
sparc randconfig-002-20260423 gcc-8.5.0
sparc64 allmodconfig clang-23
sparc64 defconfig clang-20
sparc64 randconfig-001-20260423 clang-23
sparc64 randconfig-002-20260423 gcc-10.5.0
um allmodconfig clang-19
um allnoconfig clang-23
um allyesconfig gcc-14
um defconfig clang-23
um i386_defconfig gcc-14
um randconfig-001-20260423 clang-18
um randconfig-002-20260423 gcc-14
um x86_64_defconfig clang-23
x86_64 allmodconfig clang-20
x86_64 allnoconfig clang-20
x86_64 allyesconfig clang-20
x86_64 defconfig gcc-14
x86_64 rhel-9.4-rust clang-20
xtensa allnoconfig gcc-15.2.0
xtensa randconfig-001-20260423 gcc-8.5.0
xtensa randconfig-002-20260423 gcc-8.5.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* RE: [PATCH v2 1/7] iio: HID: Add helper method hid_sensor_adjust_channel_bit_mask()
From: Zhang, Lixu @ 2026-04-23 8:48 UTC (permalink / raw)
To: Shevchenko, Andriy, natalia.andre@ime.usp.br
Cc: linux-input@vger.kernel.org, linux-iio@vger.kernel.org,
andy@kernel.org, bentiss@kernel.org, Lechner, David,
jic23@kernel.org, jikos@kernel.org, nuno.sa@analog.com,
srinivas.pandruvada@linux.intel.com
In-Reply-To: <aenQNrLHqGxbiipb@ashevche-desk.local>
>-----Original Message-----
>From: Shevchenko, Andriy <andriy.shevchenko@intel.com>
>Sent: Thursday, April 23, 2026 3:55 PM
>To: Zhang, Lixu <lixu.zhang@intel.com>
>Cc: natalia.andre@ime.usp.br; linux-input@vger.kernel.org; linux-
>iio@vger.kernel.org; andy@kernel.org; bentiss@kernel.org; Lechner, David
><dlechner@baylibre.com>; jic23@kernel.org; jikos@kernel.org;
>nuno.sa@analog.com; srinivas.pandruvada@linux.intel.com
>Subject: Re: [PATCH v2 1/7] iio: HID: Add helper method
>hid_sensor_adjust_channel_bit_mask()
>
>On Thu, Apr 23, 2026 at 11:20:38AM +0800, Zhang Lixu wrote:
>> On Tue, Apr 21, 2026 at 07:20:33PM -0300, Natália Salvino André wrote:
>> > Add helper method to deduplicate code in HID sensors.
>
>...
>
>> > +void hid_sensor_adjust_channel_bit_mask(struct iio_chan_spec
>*channels,
>> > + int channel, int size)
>> > +{
>> > + channels[channel].scan_type.format = 's';
>>
>> There is no 'format' field in struct iio_scan_type. This should be:
>> channels[channel].scan_type.sign = 's';
>
>Your information is outdated, I believe.
You are right. I checked commit 3253477893b2 ("iio: Replace 'sign' field
with union in struct iio_scan_type") in the IIO testing branch, which
deprecates the 'sign' field and introduces 'format' as its replacement.
My apologies for the incorrect review comment.
Thanks,
Lixu
>
>> > + /* Real storage bits will change based on the report desc. */
>> > + channels[channel].scan_type.realbits = size * BITS_PER_BYTE;
>> > + /* Maximum size of a sample to capture is u32 */
>> > + channels[channel].scan_type.storagebits = sizeof(u32) *
>> > +BITS_PER_BYTE; }
>
>With Best Regards,
>Andy Shevchenko
>
^ permalink raw reply
* [PATCH v2] HID: sony: use dedicated raw_event() handlers in sony_raw_event()
From: Rosalie Wanders @ 2026-04-23 8:46 UTC (permalink / raw)
To: Jiri Kosina, Benjamin Tissoires
Cc: Rosalie Wanders, linux-input, linux-kernel
This commit changes the way sony_raw_event() works by adding a function
pointer to a raw_event() handler in the sc struct instead of manually
checking the quirk in order to call the right function, this simplifies
the sony_raw_event() function alongside making the raw_event() handlers
more self-contained, thus making the code more readable.
The raw_event() handler should be configured using the new
sony_init_raw_event_handler() function in sony_input_configured(), where
we already check for quirks and apply device specific workarounds.
Signed-off-by: Rosalie Wanders <rosalie@mailbox.org>
---
v2: add an additional unlikely() in sony_raw_event()
This patch depends on the following patches:
- 'HID: sony: add missing size validation for SMK-Link remotes'
- 'HID: sony: add missing size validation for Rock Band 3 Pro instruments'
drivers/hid/hid-sony.c | 145 +++++++++++++++++++++++++----------------
1 file changed, 90 insertions(+), 55 deletions(-)
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index e75246d29e16..2d9a5261b63f 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -81,6 +81,7 @@
#define SONY_FF_SUPPORT (SIXAXIS_CONTROLLER | MOTION_CONTROLLER)
#define SONY_BT_DEVICE (SIXAXIS_CONTROLLER_BT | MOTION_CONTROLLER_BT | NAVIGATION_CONTROLLER_BT)
#define NSG_MRXU_REMOTE (NSG_MR5U_REMOTE_BT | NSG_MR7U_REMOTE_BT)
+#define RB4_GUITAR_PS4 (RB4_GUITAR_PS4_USB | RB4_GUITAR_PS4_BT)
#define MAX_LEDS 4
#define NSG_MRXU_MAX_X 1667
@@ -534,6 +535,7 @@ struct sony_sc {
struct input_dev *sensor_dev;
struct led_classdev *leds[MAX_LEDS];
unsigned long quirks;
+ int (*raw_event)(struct sony_sc *sc, u8 *rd, int size);
struct work_struct state_worker;
void (*send_output_report)(struct sony_sc *sc);
struct power_supply *battery;
@@ -946,7 +948,7 @@ static const u8 *sony_report_fixup(struct hid_device *hdev, u8 *rdesc,
return rdesc;
}
-static void sixaxis_parse_report(struct sony_sc *sc, u8 *rd, int size)
+static int sixaxis_raw_event(struct sony_sc *sc, u8 *rd, int size)
{
static const u8 sixaxis_battery_capacity[] = { 0, 1, 25, 50, 75, 100 };
unsigned long flags;
@@ -955,6 +957,31 @@ static void sixaxis_parse_report(struct sony_sc *sc, u8 *rd, int size)
u8 battery_capacity;
int battery_status;
+ if (unlikely(size != 49 || rd[0] != 0x01))
+ return 0;
+
+ if (sc->quirks & SIXAXIS_CONTROLLER) {
+ /*
+ * When connected via Bluetooth the Sixaxis occasionally sends
+ * a report with the second byte 0xff and the rest zeroed.
+ *
+ * This report does not reflect the actual state of the
+ * controller must be ignored to avoid generating false input
+ * events.
+ */
+ if (rd[1] == 0xff)
+ return -EINVAL;
+
+ /*
+ * Sixaxis HID report has acclerometers/gyro with MSByte first, this
+ * has to be BYTE_SWAPPED before passing up to joystick interface
+ */
+ swap(rd[41], rd[42]);
+ swap(rd[43], rd[44]);
+ swap(rd[45], rd[46]);
+ swap(rd[47], rd[48]);
+ }
+
/*
* The sixaxis is charging if the battery value is 0xee
* and it is fully charged if the value is 0xef.
@@ -993,13 +1020,18 @@ static void sixaxis_parse_report(struct sony_sc *sc, u8 *rd, int size)
input_sync(sc->sensor_dev);
}
+
+ return 0;
}
-static void nsg_mrxu_parse_report(struct sony_sc *sc, u8 *rd, int size)
+static int nsg_mrxu_raw_event(struct sony_sc *sc, u8 *rd, int size)
{
int n, offset, relx, rely;
u8 active;
+ if (unlikely(size < 12 || rd[0] != 0x02))
+ return 0;
+
/*
* The NSG-MRxU multi-touch trackpad data starts at offset 1 and
* the touch-related data starts at offset 2.
@@ -1067,10 +1099,33 @@ static void nsg_mrxu_parse_report(struct sony_sc *sc, u8 *rd, int size)
input_mt_sync_frame(sc->touchpad);
input_sync(sc->touchpad);
+ return 0;
+}
+
+static int rb3_pro_instrument_raw_event(struct sony_sc *sc, u8 *rd, int size)
+{
+ /* Rock Band 3 PS3 Pro instruments set rd[24] to 0xE0 when they're
+ * sending full reports, and 0x02 when only sending navigation.
+ */
+ if (size < 25 || rd[24] != 0x02)
+ return 0;
+
+ /* Only attempt to enable full report every 8 seconds */
+ if (time_after(jiffies, sc->rb3_pro_poke_jiffies)) {
+ sc->rb3_pro_poke_jiffies = jiffies + secs_to_jiffies(8);
+ rb3_pro_instrument_enable_full_report(sc);
+ }
+
+ return 0;
}
-static void rb4_ps4_guitar_parse_report(struct sony_sc *sc, u8 *rd, int size)
+static int rb4_ps4_guitar_raw_event(struct sony_sc *sc, u8 *rd, int size)
{
+ const int expected_size = (sc->quirks & RB4_GUITAR_PS4_BT) ? 78 : 64;
+
+ if (unlikely(size != expected_size || rd[0] != 0x01))
+ return 0;
+
/*
* Rock Band 4 PS4 guitars have whammy and
* tilt functionality, they're located at
@@ -1084,9 +1139,10 @@ static void rb4_ps4_guitar_parse_report(struct sony_sc *sc, u8 *rd, int size)
input_report_abs(sc->input_dev, ABS_RZ, rd[45]);
input_sync(sc->input_dev);
+ return 0;
}
-static void rb4_ps5_guitar_parse_report(struct sony_sc *sc, u8 *rd, int size)
+static int rb4_ps5_guitar_raw_event(struct sony_sc *sc, u8 *rd, int size)
{
u8 charging_status;
u8 battery_data;
@@ -1094,6 +1150,9 @@ static void rb4_ps5_guitar_parse_report(struct sony_sc *sc, u8 *rd, int size)
u8 battery_status;
unsigned long flags;
+ if (unlikely(size != 64 || rd[0] != 0x01))
+ return 0;
+
/*
* Rock Band 4 PS5 guitars have whammy and
* tilt functionality, they're located at
@@ -1138,65 +1197,22 @@ static void rb4_ps5_guitar_parse_report(struct sony_sc *sc, u8 *rd, int size)
spin_unlock_irqrestore(&sc->lock, flags);
input_sync(sc->input_dev);
+ return 0;
}
static int sony_raw_event(struct hid_device *hdev, struct hid_report *report,
u8 *rd, int size)
{
struct sony_sc *sc = hid_get_drvdata(hdev);
+ int ret;
- /*
- * Sixaxis HID report has acclerometers/gyro with MSByte first, this
- * has to be BYTE_SWAPPED before passing up to joystick interface
- */
- if ((sc->quirks & SIXAXIS_CONTROLLER) && rd[0] == 0x01 && size == 49) {
- /*
- * When connected via Bluetooth the Sixaxis occasionally sends
- * a report with the second byte 0xff and the rest zeroed.
- *
- * This report does not reflect the actual state of the
- * controller must be ignored to avoid generating false input
- * events.
- */
- if (rd[1] == 0xff)
- return -EINVAL;
-
- swap(rd[41], rd[42]);
- swap(rd[43], rd[44]);
- swap(rd[45], rd[46]);
- swap(rd[47], rd[48]);
-
- sixaxis_parse_report(sc, rd, size);
- } else if ((sc->quirks & MOTION_CONTROLLER_BT) && rd[0] == 0x01 && size == 49) {
- sixaxis_parse_report(sc, rd, size);
- } else if ((sc->quirks & NAVIGATION_CONTROLLER) && rd[0] == 0x01 && size == 49) {
- sixaxis_parse_report(sc, rd, size);
- } else if ((sc->quirks & NSG_MRXU_REMOTE) && rd[0] == 0x02 && size >= 12) {
- nsg_mrxu_parse_report(sc, rd, size);
- return 1;
- } else if ((sc->quirks & RB4_GUITAR_PS4_USB) && rd[0] == 0x01 && size == 64) {
- rb4_ps4_guitar_parse_report(sc, rd, size);
- return 1;
- } else if ((sc->quirks & RB4_GUITAR_PS4_BT) && rd[0] == 0x01 && size == 78) {
- rb4_ps4_guitar_parse_report(sc, rd, size);
- return 1;
- } else if ((sc->quirks & RB4_GUITAR_PS5) && rd[0] == 0x01 && size == 64) {
- rb4_ps5_guitar_parse_report(sc, rd, size);
- return 1;
- }
-
- /* Rock Band 3 PS3 Pro instruments set rd[24] to 0xE0 when they're
- * sending full reports, and 0x02 when only sending navigation.
- */
- if ((sc->quirks & RB3_PRO_INSTRUMENT) && size >= 25 && rd[24] == 0x02) {
- /* Only attempt to enable full report every 8 seconds */
- if (time_after(jiffies, sc->rb3_pro_poke_jiffies)) {
- sc->rb3_pro_poke_jiffies = jiffies + secs_to_jiffies(8);
- rb3_pro_instrument_enable_full_report(sc);
- }
+ if (sc->raw_event) {
+ ret = sc->raw_event(sc, rd, size);
+ if (unlikely(ret < 0))
+ return ret;
}
- if (sc->defer_initialization) {
+ if (unlikely(sc->defer_initialization)) {
sc->defer_initialization = 0;
sony_schedule_work(sc, SONY_WORKER_STATE);
}
@@ -1256,7 +1272,7 @@ static int sony_mapping(struct hid_device *hdev, struct hid_input *hi,
if (sc->quirks & DJH_TURNTABLE)
return djh_turntable_mapping(hdev, hi, field, usage, bit, max);
- if (sc->quirks & (RB4_GUITAR_PS4_USB | RB4_GUITAR_PS4_BT))
+ if (sc->quirks & RB4_GUITAR_PS4)
return rb4_guitar_mapping(hdev, hi, field, usage, bit, max);
if (sc->quirks & RB4_GUITAR_PS5)
@@ -2110,6 +2126,12 @@ static void sony_release_device_id(struct sony_sc *sc)
}
}
+static inline void sony_init_raw_event_handler(struct sony_sc *sc,
+ int (*raw_event)(struct sony_sc *, u8 *, int))
+{
+ sc->raw_event = raw_event;
+}
+
static inline void sony_init_output_report(struct sony_sc *sc,
void (*send_output_report)(struct sony_sc *))
{
@@ -2185,6 +2207,7 @@ static int sony_input_configured(struct hid_device *hdev,
goto err_stop;
}
+ sony_init_raw_event_handler(sc, sixaxis_raw_event);
sony_init_output_report(sc, sixaxis_send_output_report);
} else if (sc->quirks & NAVIGATION_CONTROLLER_BT) {
/*
@@ -2199,6 +2222,7 @@ static int sony_input_configured(struct hid_device *hdev,
goto err_stop;
}
+ sony_init_raw_event_handler(sc, sixaxis_raw_event);
sony_init_output_report(sc, sixaxis_send_output_report);
} else if (sc->quirks & RB3_PRO_INSTRUMENT) {
/*
@@ -2213,6 +2237,8 @@ static int sony_input_configured(struct hid_device *hdev,
*/
hdev->quirks |= HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP;
hdev->quirks |= HID_QUIRK_SKIP_OUTPUT_REPORT_ID;
+
+ sony_init_raw_event_handler(sc, rb3_pro_instrument_raw_event);
} else if (sc->quirks & SIXAXIS_CONTROLLER_USB) {
/*
* The Sony Sixaxis does not handle HID Output Reports on the
@@ -2237,6 +2263,7 @@ static int sony_input_configured(struct hid_device *hdev,
goto err_stop;
}
+ sony_init_raw_event_handler(sc, sixaxis_raw_event);
sony_init_output_report(sc, sixaxis_send_output_report);
} else if (sc->quirks & SIXAXIS_CONTROLLER_BT) {
/*
@@ -2258,6 +2285,7 @@ static int sony_input_configured(struct hid_device *hdev,
goto err_stop;
}
+ sony_init_raw_event_handler(sc, sixaxis_raw_event);
sony_init_output_report(sc, sixaxis_send_output_report);
} else if (sc->quirks & NSG_MRXU_REMOTE) {
/*
@@ -2273,8 +2301,15 @@ static int sony_input_configured(struct hid_device *hdev,
goto err_stop;
}
+ sony_init_raw_event_handler(sc, nsg_mrxu_raw_event);
} else if (sc->quirks & MOTION_CONTROLLER) {
+ if (sc->quirks & MOTION_CONTROLLER_BT)
+ sony_init_raw_event_handler(sc, sixaxis_raw_event);
sony_init_output_report(sc, motion_send_output_report);
+ } else if (sc->quirks & RB4_GUITAR_PS4) {
+ sony_init_raw_event_handler(sc, rb4_ps4_guitar_raw_event);
+ } else if (sc->quirks & RB4_GUITAR_PS5) {
+ sony_init_raw_event_handler(sc, rb4_ps5_guitar_raw_event);
}
if (sc->quirks & SONY_LED_SUPPORT) {
--
2.53.0
^ permalink raw reply related
* Re: [PATCH] dt-bindings: Remove the redundant 'type: boolean'
From: Krzysztof Kozlowski @ 2026-04-23 9:20 UTC (permalink / raw)
To: phucduc.bui, robh, krzk+dt, conor+dt
Cc: nick, dmitry.torokhov, nicolas.ferre, alexandre.belloni,
claudiu.beznea, lee, heiko, gregkh, linusw, zyw, zhangqing,
gene_chen, linux-input, devicetree, linux-arm-kernel, linux-usb
In-Reply-To: <20260417021858.6582-1-phucduc.bui@gmail.com>
On 17/04/2026 04:18, phucduc.bui@gmail.com wrote:
> From: bui duc phuc <phucduc.bui@gmail.com>
>
> The 'wakeup-source' property already has its type defined in the core
> schema. Remove the redundant 'type: boolean' from the binding file to
> clean up the binding files.
>
> Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
> ---
> Documentation/devicetree/bindings/input/atmel,maxtouch.yaml | 3 +--
> Documentation/devicetree/bindings/mfd/rockchip,rk816.yaml | 3 +--
Why did you change one file and ignore the rest?
Why did you not mention previous feedback I gave you on your patches
(some time ago), that there are TWO TYPES defined for wakeup-source.
Best regards,
Krzysztof
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox