* Re: [PATCH] Input: ads7846 - don't use scratch for tx_buf when clearing register
From: Kris Bahnsen @ 2026-04-27 16:20 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Marek Vasut, stable, Mark Featherston, linux-input, linux-kernel
In-Reply-To: <ae2YWxew6M03MFfN@google.com>
On 4/25/26 9:51 PM, Dmitry Torokhov wrote:
> Hi Kris,
>
> On Fri, Apr 24, 2026 at 07:25:34PM +0000, Kris Bahnsen wrote:
>> The workaround for XPT2046 clears the command register, giving the
>> touchscreen controller a NOP. The change incorrectly re-uses the
>> req->scratch variable which is used as rx_buf for xfer[5], so by
>> the time xfer[6] occurs, the contents of req->scratch may not be
>> 0. It was found that the touchscreen controller can end up in
>> a completely unresponsive state due to it being given a command
>> the driver does not expect.
>>
>> Instead, rely on the spi_transfer behavior of tx_buf being NULL to
>> transmit all 0 bits, moving the 3 bytes to a single message.
>>
>> This change was tested on real TSC2046 and ADS7843 controllers,
>> but not the XPT2046 the workaround was originally created for.
>> Confirming that the original modification to clear the command
>> register does not impact either real controller.
>>
>> Fixes: 781a07da9bb94 ("Input: ads7846 - add dummy command register clearing cycle")
>> Cc: stable@vger.kernel.org
>> Co-developed-by: Mark Featherston <mark@embeddedTS.com>
>> Signed-off-by: Mark Featherston <mark@embeddedTS.com>
>> Signed-off-by: Kris Bahnsen <kris@embeddedTS.com>
>> ---
>> drivers/input/touchscreen/ads7846.c | 13 ++++---------
>> 1 file changed, 4 insertions(+), 9 deletions(-)
>>
>> diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
>> index 4b39f7212d35c..599793d27129e 100644
>> --- a/drivers/input/touchscreen/ads7846.c
>> +++ b/drivers/input/touchscreen/ads7846.c
>> @@ -327,7 +327,7 @@ struct ser_req {
>> u8 ref_off;
>> u16 scratch;
>> struct spi_message msg;
>> - struct spi_transfer xfer[8];
>> + struct spi_transfer xfer[7];
>> /*
>> * DMA (thus cache coherency maintenance) requires the
>> * transfer buffers to live in their own cache lines.
>> @@ -403,16 +403,11 @@ static int ads7846_read12_ser(struct device *dev, unsigned command)
>> spi_message_add_tail(&req->xfer[5], &req->msg);
>>
>> /* clear the command register */
>> - req->scratch = 0;
>> - req->xfer[6].tx_buf = &req->scratch;
>> - req->xfer[6].len = 1;
>> + req->xfer[6].rx_buf = &req->scratch;
>> + req->xfer[6].len = 3;
>
> Doesn't this overflow "scratch" which is only 2 bytes? I guess there is
> a hole in ser_req between "scratch" and "msg" but I do not think we
> should rely on this.
>
> Can we also set rx_buf to NULL to discard incoming data?
Well spotted! I'm quite annoyed with myself that I fixed one pointer
use bug to introduce a buffer overflow.
Will send a v2 patch later today.
> [credit to sashiko].
>
> Thanks.
>
--
Kris Bahnsen
Software Engineer
embeddedTS
^ permalink raw reply
* [PATCH] [v2] input: gpio-keys: make legacy gpiolib optional
From: Arnd Bergmann @ 2026-04-27 14:33 UTC (permalink / raw)
To: Dmitry Torokhov, Matti Vaittinen, Lee Jones
Cc: Arnd Bergmann, Gatien Chevallier, Marco Crivellari,
Fabrice Gasnier, Andreas Kemnade, Krzysztof Kozlowski,
Charles Keepax, Christophe JAILLET, linux-input, linux-kernel
From: Arnd Bergmann <arnd@arndb.de>
Most users of gpio-keys and gpio-keys-polled use modern gpiolib
interfaces, but there are still number of ancient sh, arm32 and x86
machines that have never been converted.
Add an #ifdef block for the parts of the driver that are only used on
those legacy machines.
The two Rohm PMIC drivers use a gpio-keys device without an actual GPIO,
passing an IRQ number instead. In order to keep this working both with
and with CONFIG_GPIOLIB_LEGACY, change the gpio-keys driver to ignore
the gpio number if an IRQ is passed.
Link: https://lore.kernel.org/all/b3c94552-c104-42e3-be15-7e8362e8039e@gmail.com/
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
v2: skip the fake GPIO number passing from mfd
---
drivers/input/keyboard/gpio_keys.c | 7 ++++---
drivers/input/keyboard/gpio_keys_polled.c | 2 ++
drivers/mfd/rohm-bd71828.c | 1 -
drivers/mfd/rohm-bd718x7.c | 1 -
include/linux/gpio_keys.h | 2 ++
5 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
index aed4c9be35d2..e988657f97cb 100644
--- a/drivers/input/keyboard/gpio_keys.c
+++ b/drivers/input/keyboard/gpio_keys.c
@@ -528,7 +528,8 @@ static int gpio_keys_setup_key(struct platform_device *pdev,
*/
bdata->gpiod = NULL;
}
- } else if (gpio_is_valid(button->gpio)) {
+#ifdef CONFIG_GPIOLIB_LEGACY
+ } else if (!button->irq && gpio_is_valid(button->gpio)) {
/*
* Legacy GPIO number, so request the GPIO here and
* convert it to descriptor.
@@ -546,6 +547,7 @@ static int gpio_keys_setup_key(struct platform_device *pdev,
if (button->active_low ^ gpiod_is_active_low(bdata->gpiod))
gpiod_toggle_active_low(bdata->gpiod);
+#endif
}
if (bdata->gpiod) {
@@ -583,8 +585,7 @@ static int gpio_keys_setup_key(struct platform_device *pdev,
if (irq < 0) {
error = irq;
dev_err_probe(dev, error,
- "Unable to get irq number for GPIO %d\n",
- button->gpio);
+ "Unable to get irq number for GPIO\n");
return error;
}
bdata->irq = irq;
diff --git a/drivers/input/keyboard/gpio_keys_polled.c b/drivers/input/keyboard/gpio_keys_polled.c
index c7aea2cdd712..4e7a366ff05b 100644
--- a/drivers/input/keyboard/gpio_keys_polled.c
+++ b/drivers/input/keyboard/gpio_keys_polled.c
@@ -301,6 +301,7 @@ static int gpio_keys_polled_probe(struct platform_device *pdev)
return dev_err_probe(dev, PTR_ERR(bdata->gpiod),
"failed to get gpio\n");
}
+#ifdef CONFIG_GPIOLIB_LEGACY
} else if (gpio_is_valid(button->gpio)) {
/*
* Legacy GPIO number so request the GPIO here and
@@ -323,6 +324,7 @@ static int gpio_keys_polled_probe(struct platform_device *pdev)
if (button->active_low ^ gpiod_is_active_low(bdata->gpiod))
gpiod_toggle_active_low(bdata->gpiod);
+#endif
}
bdata->last_state = -1;
diff --git a/drivers/mfd/rohm-bd71828.c b/drivers/mfd/rohm-bd71828.c
index a79f354bf5cb..df6dad762ec9 100644
--- a/drivers/mfd/rohm-bd71828.c
+++ b/drivers/mfd/rohm-bd71828.c
@@ -39,7 +39,6 @@
static struct gpio_keys_button button = {
.code = KEY_POWER,
- .gpio = -1,
.type = EV_KEY,
.wakeup = 1,
};
diff --git a/drivers/mfd/rohm-bd718x7.c b/drivers/mfd/rohm-bd718x7.c
index ff714fd4f54d..dd774aa8828b 100644
--- a/drivers/mfd/rohm-bd718x7.c
+++ b/drivers/mfd/rohm-bd718x7.c
@@ -20,7 +20,6 @@
static struct gpio_keys_button button = {
.code = KEY_POWER,
- .gpio = -1,
.type = EV_KEY,
};
diff --git a/include/linux/gpio_keys.h b/include/linux/gpio_keys.h
index 80fa930b04c6..e8d6dc290efb 100644
--- a/include/linux/gpio_keys.h
+++ b/include/linux/gpio_keys.h
@@ -25,7 +25,9 @@ struct device;
*/
struct gpio_keys_button {
unsigned int code;
+#ifdef CONFIG_GPIOLIB_LEGACY
int gpio;
+#endif
int active_low;
const char *desc;
unsigned int type;
--
2.39.5
^ permalink raw reply related
* Re: [PATCH] Input: xpad - reject short Xbox One packets before len-relative share-button index
From: Greg Kroah-Hartman @ 2026-04-27 11:15 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input, linux-kernel, stable
In-Reply-To: <ae7kWV1Km1qoEeq3@google.com>
On Sun, Apr 26, 2026 at 09:22:21PM -0700, Dmitry Torokhov wrote:
> Hi Greg,
>
> On Mon, Apr 20, 2026 at 05:53:15PM +0200, Greg Kroah-Hartman wrote:
> > xpadone_process_packet() receives len directly from urb->actual_length
> > and uses it to index the share-button byte at data[len - 18] or
> > data[len - 26]. Since both len and data[0] are under the device's
> > control, a broken controller can send a GIP_CMD_INPUT packet with
> > actual_length < 18 (e.g. 5 bytes) and reach this code path, causing
> > accesses beyond the actual array.
> >
> > Since len is u32, 5 - 26 wraps to 0xFFFFFFEB, and data[0xFFFFFFEB] can
> > dereference about 4 GiB past the 64-byte usb_alloc_coherent() idata
> > buffer. On a KASAN system this is an immediate splat otherwise the read
> > will either fault on an unmapped page (DoS) or pull a bit from arbitrary
> > kernel memory and report it as KEY_RECORD.
> >
> > Fix this all up by properly bounds checking the value provided by the
> > device.
> >
> > Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> > Fixes: 4ef46367073b ("Input: xpad - fix Share button on Xbox One controllers")
> > Cc: stable <stable@kernel.org>
> > Assisted-by: gkh_clanker_t1000
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > ---
> > drivers/input/joystick/xpad.c | 11 +++++++----
> > 1 file changed, 7 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
> > index d6fc3d6006bb..7d99fe0ecf91 100644
> > --- a/drivers/input/joystick/xpad.c
> > +++ b/drivers/input/joystick/xpad.c
> > @@ -1110,10 +1110,13 @@ static void xpadone_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char
> > input_report_key(dev, BTN_START, data[4] & BIT(2));
> > input_report_key(dev, BTN_SELECT, data[4] & BIT(3));
> > if (xpad->mapping & MAP_SHARE_BUTTON) {
> > - if (xpad->mapping & MAP_SHARE_OFFSET)
> > - input_report_key(dev, KEY_RECORD, data[len - 26] & BIT(0));
> > - else
> > - input_report_key(dev, KEY_RECORD, data[len - 18] & BIT(0));
> > + if (xpad->mapping & MAP_SHARE_OFFSET) {
> > + if (len >= 26)
> > + input_report_key(dev, KEY_RECORD, data[len - 26] & BIT(0));
> > + } else {
> > + if (len >= 18)
> > + input_report_key(dev, KEY_RECORD, data[len - 18] & BIT(0));
> > + }
>
> Thank you for the report, but this is quite ugly. I committed an
> alternative version of the fix.
Not a problem at all, thanks for doing this, all I want is to see the
issue fixed :)
thanks,
greg k-h
^ permalink raw reply
* [dtor-input:next] BUILD SUCCESS 26b760d0f8148e4ee73936577b8b3be51dbb64d7
From: kernel test robot @ 2026-04-27 9:56 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git next
branch HEAD: 26b760d0f8148e4ee73936577b8b3be51dbb64d7 Input: stmfts - fix formatting issues
elapsed time: 736m
configs tested: 55
configs skipped: 0
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-15.2.0
alpha allyesconfig gcc-15.2.0
arc allmodconfig gcc-15.2.0
arc allnoconfig gcc-15.2.0
arc allyesconfig gcc-15.2.0
arm allnoconfig clang-23
arm allyesconfig gcc-15.2.0
arm64 allmodconfig clang-19
arm64 allnoconfig gcc-15.2.0
csky allmodconfig gcc-15.2.0
csky allnoconfig gcc-15.2.0
hexagon allmodconfig clang-17
hexagon allnoconfig clang-23
i386 allmodconfig gcc-14
i386 allnoconfig gcc-14
i386 allyesconfig gcc-14
loongarch allmodconfig clang-19
loongarch allnoconfig clang-23
m68k allmodconfig gcc-15.2.0
m68k allnoconfig gcc-15.2.0
m68k allyesconfig gcc-15.2.0
microblaze allnoconfig gcc-15.2.0
microblaze allyesconfig gcc-15.2.0
mips allmodconfig gcc-15.2.0
mips allnoconfig gcc-15.2.0
mips allyesconfig gcc-15.2.0
nios2 allmodconfig gcc-11.5.0
nios2 allnoconfig gcc-11.5.0
openrisc allmodconfig gcc-15.2.0
openrisc allnoconfig gcc-15.2.0
parisc allmodconfig gcc-15.2.0
parisc allnoconfig gcc-15.2.0
parisc allyesconfig gcc-15.2.0
powerpc allmodconfig gcc-15.2.0
powerpc allnoconfig gcc-15.2.0
riscv allmodconfig clang-23
riscv allnoconfig gcc-15.2.0
riscv allyesconfig clang-16
s390 allmodconfig clang-18
s390 allnoconfig clang-23
s390 allyesconfig gcc-15.2.0
sh allmodconfig gcc-15.2.0
sh allnoconfig gcc-15.2.0
sh allyesconfig gcc-15.2.0
sparc allnoconfig gcc-15.2.0
sparc64 allmodconfig clang-23
um allmodconfig clang-19
um allnoconfig clang-23
um allyesconfig gcc-14
x86_64 allmodconfig clang-20
x86_64 allnoconfig clang-20
x86_64 allyesconfig clang-20
x86_64 rhel-9.4-rust clang-20
xtensa allnoconfig gcc-15.2.0
xtensa allyesconfig gcc-15.2.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH v2 1/7] iio: HID: Add helper method hid_sensor_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-27 9:39 UTC (permalink / raw)
To: Jonathan Cameron
Cc: Natália Salvino André, andy, bentiss, dlechner, jikos,
nuno.sa, srinivas.pandruvada, Pietro Di Consolo Gregorio,
linux-iio, linux-input
In-Reply-To: <20260424200155.61b6f273@jic23-huawei>
On Fri, Apr 24, 2026 at 08:01:55PM +0100, Jonathan Cameron wrote:
> On Wed, 22 Apr 2026 12:03:12 +0300
> Andy Shevchenko <andriy.shevchenko@intel.com> wrote:
> > On Tue, Apr 21, 2026 at 07:20:33PM -0300, Natália Salvino André wrote:
> > > Add helper method to deduplicate code in HID sensors.
...
> > > + channels[channel].scan_type.realbits = size * BITS_PER_BYTE;
> >
> > BITS_TO_BYTES(size)
>
> BYTES_TO_BITS(size)
Indeed.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 2/7] iio: accel: HID: Replace method accel_3d_adjust_channel_bit_mask()
From: Andy Shevchenko @ 2026-04-27 9:38 UTC (permalink / raw)
To: Jonathan Cameron
Cc: Natália Salvino André, andy, bentiss, dlechner, jikos,
nuno.sa, srinivas.pandruvada, Pietro Di Consolo Gregorio,
linux-iio, linux-input
In-Reply-To: <20260424200847.78494f27@jic23-huawei>
On Fri, Apr 24, 2026 at 08:08:47PM +0100, Jonathan Cameron wrote:
> On Wed, 22 Apr 2026 12:07:07 +0300
> Andy Shevchenko <andriy.shevchenko@intel.com> wrote:
> > On Tue, Apr 21, 2026 at 07:20:34PM -0300, Natália Salvino André wrote:
...
> > > - accel_3d_adjust_channel_bit_mask(channels,
> > > - CHANNEL_SCAN_INDEX_X + i,
> > > - st->accel[CHANNEL_SCAN_INDEX_X + i].size);
> > > + hid_sensor_adjust_channel_bit_mask(channels,
> > > + CHANNEL_SCAN_INDEX_X + i,
> > > + st->accel[CHANNEL_SCAN_INDEX_X + i].size);
> >
> > Indentation is broken. Taking into account that the last line is too long when
> > properly indented, perhaps
> >
> > hid_sensor_adjust_channel_bit_mask(channels,
> > CHANNEL_SCAN_INDEX_X + i,
> > st->accel[CHANNEL_SCAN_INDEX_X + i].size);
> >
> > Which makes it most right and under 80 limit.
> Why the double tab? Maybe just go long on this one and align after the (
I never know when you are strict about 80 limit :-)
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: HID: pidff: Fix integer overflow in pidff_rescale
From: Markus Elfring @ 2026-04-27 7:03 UTC (permalink / raw)
To: Tomasz Pakuła, linux-input, Benjamin Tissoires, Jiri Kosina
Cc: LKML, Oleg Makarenko
In-Reply-To: <25715cc23884f74a7417ba53ba144cbb7f675293.camel@gmail.com>
…
> As far as the other stuff you mentioned, I don't get it. I don't think
> it would make sense to mention the 20 yo commit that added this driver.
I imagine that a Fixes tag can also become helpful here.
…
> Maybe I'm not seeing something here, please elaborate so I can fix it :D
I indicated another possibility to avoid a typo in the change description.
Regards,
Markus
^ permalink raw reply
* [PATCH] amd-sfh-hid: tablet mode switch and asus quirk
From: Helge Bahmann @ 2026-04-27 6:22 UTC (permalink / raw)
To: Nehal Bakulchandra Shah, Sandeep Singh, Basavaraj Natikar, jikos,
bentiss
Cc: linux-hid, linux-input
Add an input driver that interprets the "operation mode" sensor offered
by the amd sfh on some laptop models.
Add a quirk to make the driver work again with the Asus VivoBook
VivoBook (turn off the "disable interrupts" flag).
Expose the intr_disable flag as a module parameter in case it turns out
to be needed on further laptop models.
Signed-off-by: Helge Bahmann <hcb@chaoticmind.net>
---
drivers/hid/amd-sfh-hid/amd_sfh_client.c | 25 ++++++++------
drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 43 ++++++++++++++++++++++++
drivers/hid/amd-sfh-hid/amd_sfh_hid.h | 6 ++++
drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 9 +++++
drivers/hid/amd-sfh-hid/amd_sfh_pcie.h | 3 ++
5 files changed, 75 insertions(+), 11 deletions(-)
diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_client.c b/drivers/hid/amd-sfh-hid/amd_sfh_client.c
index 7017bfa59093..a24757c5a203 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_client.c
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_client.c
@@ -128,10 +128,16 @@ void amd_sfh_work_buffer(struct work_struct *work)
guard(mutex)(&mp2->lock);
for (i = 0; i < cli_data->num_hid_devices; i++) {
if (cli_data->sensor_sts[i] == SENSOR_ENABLED) {
- report_size = mp2->mp2_ops->get_in_rep(i, cli_data->sensor_idx[i],
- cli_data->report_id[i], in_data);
- hid_input_report(cli_data->hid_sensor_hubs[i], HID_INPUT_REPORT,
- in_data->input_report[i], report_size, 0);
+ if (cli_data->hid_sensor_hubs[i]) {
+ report_size = mp2->mp2_ops->get_in_rep(i, cli_data->sensor_idx[i],
+ cli_data->report_id[i],
+ in_data);
+ hid_input_report(cli_data->hid_sensor_hubs[i], HID_INPUT_REPORT,
+ in_data->input_report[i], report_size, 0);
+ } else if (cli_data->sensor_idx[i] == op_idx &&
+ cli_data->modeswitch_input) {
+ amdtp_modeswitch_report(i, cli_data->modeswitch_input, in_data);
+ }
}
}
schedule_delayed_work(&cli_data->work_buffer, msecs_to_jiffies(AMD_SFH_IDLE_LOOP));
@@ -327,15 +333,12 @@ int amd_sfh_hid_client_init(struct amd_mp2_dev *privdata)
for (i = 0; i < cl_data->num_hid_devices; i++) {
cl_data->cur_hid_dev = i;
- if (cl_data->sensor_idx[i] == op_idx) {
- dev_dbg(dev, "sid 0x%x (%s) status 0x%x\n",
- cl_data->sensor_idx[i], get_sensor_name(cl_data->sensor_idx[i]),
- cl_data->sensor_sts[i]);
- continue;
- }
if (cl_data->sensor_sts[i] == SENSOR_ENABLED) {
- rc = amdtp_hid_probe(i, cl_data);
+ if (cl_data->sensor_idx[i] != op_idx)
+ rc = amdtp_hid_probe(i, cl_data);
+ else
+ rc = amdtp_modeswitch_probe(i, cl_data);
if (rc)
goto cleanup;
} else {
diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_hid.c b/drivers/hid/amd-sfh-hid/amd_sfh_hid.c
index 81f3024b7b1b..44008c02b63c 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_hid.c
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_hid.c
@@ -181,4 +181,47 @@ void amdtp_hid_remove(struct amdtp_cl_data *cli_data)
cli_data->hid_sensor_hubs[i] = NULL;
}
}
+
+ /* note: cli_data->modeswitch_input implicitly cleaned by devres */
+}
+
+int amdtp_modeswitch_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data)
+{
+ struct amd_mp2_dev *mp2 = container_of(cli_data->in_data, struct amd_mp2_dev, in_data);
+ struct device *dev = &mp2->pdev->dev;
+ struct input_dev *input;
+ int rc;
+
+ input = devm_input_allocate_device(dev);
+ if (IS_ERR(input))
+ return PTR_ERR(input);
+
+ input->name = "AMD SFH tablet mode switch sensor";
+ input->id.bustype = BUS_PCI;
+
+ input_set_capability(input, EV_SW, SW_TABLET_MODE);
+
+ rc = input_register_device(input);
+ if (rc)
+ goto cleanup;
+
+ cli_data->modeswitch_input = input;
+
+ return 0;
+
+cleanup:
+ return rc;
+}
+
+void amdtp_modeswitch_report(u32 index, struct input_dev *input, struct amd_input_data *in_data)
+{
+ u32 *sensor_virt_addr = in_data->sensor_virt_addr[index];
+ u32 value = sensor_virt_addr[0];
+
+ if (value == AMD_SFH_OP_IDX_MODE_TABLET)
+ input_report_switch(input, SW_TABLET_MODE, 1);
+ else
+ input_report_switch(input, SW_TABLET_MODE, 0);
+
+ input_sync(input);
}
diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_hid.h b/drivers/hid/amd-sfh-hid/amd_sfh_hid.h
index 7452b0302953..20aff7b75fbd 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_hid.h
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_hid.h
@@ -11,6 +11,8 @@
#ifndef AMDSFH_HID_H
#define AMDSFH_HID_H
+#include <linux/input.h>
+
#define MAX_HID_DEVICES 7
#define AMD_SFH_HID_VENDOR 0x1022
#define AMD_SFH_HID_PRODUCT 0x0001
@@ -50,6 +52,7 @@ struct amdtp_cl_data {
u8 sensor_idx[MAX_HID_DEVICES];
u8 *feature_report[MAX_HID_DEVICES];
u8 request_done[MAX_HID_DEVICES];
+ struct input_dev *modeswitch_input;
struct amd_input_data *in_data;
struct delayed_work work;
struct delayed_work work_buffer;
@@ -78,4 +81,7 @@ void amdtp_hid_remove(struct amdtp_cl_data *cli_data);
int amd_sfh_get_report(struct hid_device *hid, int report_id, int report_type);
void amd_sfh_set_report(struct hid_device *hid, int report_id, int report_type);
void amdtp_hid_wakeup(struct hid_device *hid);
+int amdtp_modeswitch_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data);
+void amdtp_modeswitch_report(u32 index, struct input_dev *input, struct amd_input_data *in_data);
+
#endif
diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
index 1d9f955573aa..cd9cff75f114 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
@@ -39,6 +39,8 @@ module_param_named(sensor_mask, sensor_mask_override, int, 0444);
MODULE_PARM_DESC(sensor_mask, "override the detected sensors mask");
static bool intr_disable = true;
+module_param_named(intr_disable, intr_disable, bool, 0444);
+MODULE_PARM_DESC(intr_disable, "override the interrupt disable sensor bit");
static int amd_sfh_wait_response_v2(struct amd_mp2_dev *mp2, u8 sid, u32 sensor_sts)
{
@@ -317,6 +319,13 @@ static const struct dmi_system_id dmi_sfh_table[] = {
DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook x360 435 G7"),
},
},
+ {
+ .callback = mp2_disable_intr,
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "VivoBook_ASUSLaptop TP420UA_TM420UA"),
+ }
+ },
{}
};
diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h
index 2eb61f4e8434..5e968894ebe4 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h
@@ -83,6 +83,9 @@ enum sensor_idx {
als_idx = 19
};
+#define AMD_SFH_OP_IDX_MODE_LAPTOP 1
+#define AMD_SFH_OP_IDX_MODE_TABLET 3
+
enum mem_use_type {
USE_DRAM,
USE_C2P_REG,
--
2.47.3
^ permalink raw reply related
* [PATCH v5 1/2] dt-bindings: input: Add PixArt PAJ7620 gesture sensor
From: Harpreet Saini via B4 Relay @ 2026-04-27 4:46 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Harpreet Saini
Cc: linux-input, devicetree, linux-kernel, Krzysztof Kozlowski
In-Reply-To: <20260427-paj7620-v5-v5-0-6f9bbe7b4ce3@yahoo.com>
From: Harpreet Saini <sainiharpreet29@yahoo.com>
Add Device Tree bindings for Pixart PAJ7620 gesture sensor.
The sensor supports 9 hand gestures via I2C interface.
The GPIO controller properties are included to describe the
hardware's ability to repurpose SPI pins as GPIOs when the
sensor is used in I2C mode.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Harpreet Saini <sainiharpreet29@yahoo.com>
---
.../devicetree/bindings/input/pixart,paj7620.yaml | 84 ++++++++++++++++++++++
.../devicetree/bindings/vendor-prefixes.yaml | 2 +
2 files changed, 86 insertions(+)
diff --git a/Documentation/devicetree/bindings/input/pixart,paj7620.yaml b/Documentation/devicetree/bindings/input/pixart,paj7620.yaml
new file mode 100644
index 000000000000..089e864e82ea
--- /dev/null
+++ b/Documentation/devicetree/bindings/input/pixart,paj7620.yaml
@@ -0,0 +1,84 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/input/pixart,paj7620.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: PixArt PAJ7620 Gesture Sensor
+
+maintainers:
+ - Harpreet Saini <sainiharpreet29@yahoo.com>
+
+description:
+ The PixArt PAJ7620 is a gesture recognition sensor with an integrated
+ infrared LED and CMOS array. It communicates over an I2C interface and
+ provides gesture data via a dedicated interrupt pin. When operating in
+ I2C mode, the unused SPI pins can be repurposed as GPIOs.
+
+allOf:
+ - $ref: input.yaml#
+ - $ref: /schemas/spi/spi-peripheral-props.yaml#
+
+properties:
+ compatible:
+ const: pixart,paj7620
+
+ reg:
+ maxItems: 1
+
+ interrupts:
+ maxItems: 1
+
+ vdd-supply:
+ description: Main power supply.
+
+ vbus-supply:
+ description: I/O and I2C bus power supply.
+
+ vled-supply:
+ description: Power for the integrated IR LED.
+
+ linux,keycodes:
+ minItems: 9
+ maxItems: 9
+ description:
+ List of keycodes mapping to the 9 supported gestures.
+
+ gpio-controller: true
+
+ "#gpio-cells":
+ const: 2
+
+required:
+ - compatible
+ - reg
+ - interrupts
+ - vdd-supply
+ - vbus-supply
+ - vled-supply
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/interrupt-controller/irq.h>
+ #include <dt-bindings/input/input.h>
+ i2c {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ gesture@73 {
+ compatible = "pixart,paj7620";
+ reg = <0x73>;
+ interrupt-parent = <&gpio>;
+ interrupts = <4 IRQ_TYPE_EDGE_FALLING>;
+ vdd-supply = <®_3v3>;
+ vbus-supply = <®_1v8>;
+ vled-supply = <®_3v3>;
+ linux,keycodes = <KEY_UP KEY_DOWN KEY_LEFT KEY_RIGHT
+ KEY_ENTER KEY_BACK KEY_NEXT KEY_PREVIOUS
+ KEY_MENU>;
+ gpio-controller;
+ #gpio-cells = <2>;
+ };
+ };
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml
index ee7fd3cfe203..d73a0bf62b62 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
+++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
@@ -1273,6 +1273,8 @@ patternProperties:
description: Pine64
"^pineriver,.*":
description: Shenzhen PineRiver Designs Co., Ltd.
+ "^pixart,.*":
+ description: PixArt Imaging Inc.
"^pixcir,.*":
description: PIXCIR MICROELECTRONICS Co., Ltd
"^plantower,.*":
--
2.43.0
^ permalink raw reply related
* [PATCH v5 2/2] input: misc: Add PixArt PAJ7620 gesture sensor driver
From: Harpreet Saini via B4 Relay @ 2026-04-27 4:46 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Harpreet Saini
Cc: linux-input, devicetree, linux-kernel
In-Reply-To: <20260427-paj7620-v5-v5-0-6f9bbe7b4ce3@yahoo.com>
From: Harpreet Saini <sainiharpreet29@yahoo.com>
This driver adds support for the PixArt PAJ7620 gesture sensor.
It implements hand gesture recognition (up, down, left, right,
etc.) and reports them as standard input key events. The driver
includes power management support via Runtime PM.
Signed-off-by: Harpreet Saini <sainiharpreet29@yahoo.com>
---
drivers/input/misc/Kconfig | 12 ++
drivers/input/misc/Makefile | 1 +
drivers/input/misc/paj7620.c | 338 +++++++++++++++++++++++++++++++++++++++++++
3 files changed, 351 insertions(+)
diff --git a/drivers/input/misc/Kconfig b/drivers/input/misc/Kconfig
index 94a753fcb64f..de4206c297f2 100644
--- a/drivers/input/misc/Kconfig
+++ b/drivers/input/misc/Kconfig
@@ -453,6 +453,18 @@ config INPUT_KXTJ9
To compile this driver as a module, choose M here: the module will
be called kxtj9.
+config INPUT_PAJ7620
+ tristate "PixArt PAJ7620 Gesture Sensor"
+ depends on I2C
+ select REGMAP_I2C
+ help
+ Say Y here if you want to support the PixArt PAJ7620 gesture
+ sensor. This sensor supports 9 hand gestures and communicates
+ over the I2C bus.
+
+ To compile this driver as a module, choose M here: the
+ module will be called paj7620.
+
config INPUT_POWERMATE
tristate "Griffin PowerMate and Contour Jog support"
depends on USB_ARCH_HAS_HCD
diff --git a/drivers/input/misc/Makefile b/drivers/input/misc/Makefile
index 415fc4e2918b..dec8b8d0cdf4 100644
--- a/drivers/input/misc/Makefile
+++ b/drivers/input/misc/Makefile
@@ -67,6 +67,7 @@ obj-$(CONFIG_INPUT_PF1550_ONKEY) += pf1550-onkey.o
obj-$(CONFIG_INPUT_PM8941_PWRKEY) += pm8941-pwrkey.o
obj-$(CONFIG_INPUT_PM8XXX_VIBRATOR) += pm8xxx-vibrator.o
obj-$(CONFIG_INPUT_PMIC8XXX_PWRKEY) += pmic8xxx-pwrkey.o
+obj-$(CONFIG_INPUT_PAJ7620) += paj7620.o
obj-$(CONFIG_INPUT_POWERMATE) += powermate.o
obj-$(CONFIG_INPUT_PWM_BEEPER) += pwm-beeper.o
obj-$(CONFIG_INPUT_PWM_VIBRA) += pwm-vibra.o
diff --git a/drivers/input/misc/paj7620.c b/drivers/input/misc/paj7620.c
new file mode 100644
index 000000000000..8738c174bcc1
--- /dev/null
+++ b/drivers/input/misc/paj7620.c
@@ -0,0 +1,338 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * PixArt PAJ7620 Gesture Sensor - Input driver
+ *
+ * Copyright (C) 2026 Harpreet Saini <sainiharpreet29@yahoo.com>
+ */
+
+#include <linux/delay.h>
+#include <linux/i2c.h>
+#include <linux/input.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+#include <linux/regulator/consumer.h>
+
+/* Registers */
+#define PAJ7620_REG_BANK_SEL 0xEF
+#define PAJ7620_REG_GES_RESULT1 0x43
+#define PAJ7620_REG_GES_RESULT2 0x44
+#define PAJ7620_REG_SLEEP_BANK0 0x65
+#define PAJ7620_REG_SLEEP_BANK1 0x05
+#define PAJ7620_REG_AUTO_STANDBY 0x073
+
+/* Gesture bits */
+#define PAJ_UP BIT(0)
+#define PAJ_DOWN BIT(1)
+#define PAJ_LEFT BIT(2)
+#define PAJ_RIGHT BIT(3)
+#define PAJ_FORWARD BIT(4)
+#define PAJ_BACKWARD BIT(5)
+#define PAJ_CLOCKWISE BIT(6)
+#define PAJ_ANTICLOCK BIT(7)
+#define PAJ_WAVE BIT(8)
+#define PAJ_MAX_GESTURES 9
+
+struct paj7620_data {
+ struct i2c_client *client;
+ struct regmap *regmap;
+ struct input_dev *idev;
+ struct regulator_bulk_data supplies[3];
+ u32 keymap[PAJ_MAX_GESTURES];
+};
+
+/*
+ * The following arrays contain undocumented register sequences required to
+ * initialize the sensor's internal DSP and gesture engine.
+ * These were derived from vendor reference code and verified via testing.
+ */
+static const struct reg_sequence init_register[] = {
+ { 0xEF, 0x00 }, { 0x37, 0x07 }, { 0x38, 0x17 }, { 0x39, 0x06 },
+ { 0x41, 0x00 }, { 0x42, 0x00 }, { 0x46, 0x2D }, { 0x47, 0x0F },
+ { 0x48, 0x3C }, { 0x49, 0x00 }, { 0x4A, 0x1E }, { 0x4C, 0x20 },
+ { 0x51, 0x10 }, { 0x5E, 0x10 }, { 0x60, 0x27 }, { 0x80, 0x42 },
+ { 0x81, 0x44 }, { 0x82, 0x04 }, { 0x8B, 0x01 }, { 0x90, 0x06 },
+ { 0x95, 0x0A }, { 0x96, 0x0C }, { 0x97, 0x05 }, { 0x9A, 0x14 },
+ { 0x9C, 0x3F }, { 0xA5, 0x19 }, { 0xCC, 0x19 }, { 0xCD, 0x0B },
+ { 0xCE, 0x13 }, { 0xCF, 0x64 }, { 0xD0, 0x21 }, { 0xEF, 0x01 },
+ { 0x02, 0x0F }, { 0x03, 0x10 }, { 0x04, 0x02 }, { 0x25, 0x01 },
+ { 0x27, 0x39 }, { 0x28, 0x7F }, { 0x29, 0x08 }, { 0x3E, 0xFF },
+ { 0x5E, 0x3D }, { 0x65, 0x96 }, { 0x67, 0x97 }, { 0x69, 0xCD },
+ { 0x6A, 0x01 }, { 0x6D, 0x2C }, { 0x6E, 0x01 }, { 0x72, 0x01 },
+ { 0x73, 0x35 }, { 0x74, 0x00 }, { 0x77, 0x01 },
+};
+
+/*
+ * Specific configuration overrides required to enable the internal
+ * 8-gesture state machine.
+ */
+static const struct reg_sequence init_gesture_array[] = {
+ { 0xEF, 0x00 }, { 0x41, 0x00 }, { 0x42, 0x00 }, { 0xEF, 0x00 },
+ { 0x48, 0x3C }, { 0x49, 0x00 }, { 0x51, 0x10 }, { 0x83, 0x20 },
+ { 0x9F, 0xF9 }, { 0xEF, 0x01 }, { 0x01, 0x1E }, { 0x02, 0x0F },
+ { 0x03, 0x10 }, { 0x04, 0x02 }, { 0x41, 0x40 }, { 0x43, 0x30 },
+ { 0x65, 0x96 }, { 0x66, 0x00 }, { 0x67, 0x97 }, { 0x68, 0x01 },
+ { 0x69, 0xCD }, { 0x6A, 0x01 }, { 0x6B, 0xB0 }, { 0x6C, 0x04 },
+ { 0x6D, 0x2C }, { 0x6E, 0x01 }, { 0x74, 0x00 }, { 0xEF, 0x00 },
+ { 0x41, 0xFF }, { 0x42, 0x01 },
+};
+
+static const struct reg_sequence paj7620_suspend_regs[] = {
+ { PAJ7620_REG_BANK_SEL, 0x00 },
+ { PAJ7620_REG_SLEEP_BANK0, 0x01 },
+ { PAJ7620_REG_BANK_SEL, 0x01 },
+ { PAJ7620_REG_SLEEP_BANK1, 0x01 },
+};
+
+static void paj7620_report_keys(struct paj7620_data *data, int gesture)
+{
+ int i;
+
+ for (i = 0; i < PAJ_MAX_GESTURES; i++) {
+ if (gesture & BIT(i)) {
+ int key = data->keymap[i];
+
+ input_report_key(data->idev, key, 1);
+ input_sync(data->idev);
+ input_report_key(data->idev, key, 0);
+ input_sync(data->idev);
+ }
+ }
+}
+
+static irqreturn_t paj7620_irq_thread(int irq, void *ptr)
+{
+ struct paj7620_data *data = ptr;
+ unsigned int g1, g2;
+ int error;
+
+ /* 2. RUNTIME PM: Force awake to read registers */
+ pm_runtime_get_sync(&data->client->dev);
+
+ regmap_write(data->regmap, PAJ7620_REG_BANK_SEL, 0);
+ error = regmap_read(data->regmap, PAJ7620_REG_GES_RESULT1, &g1);
+ error |= regmap_read(data->regmap, PAJ7620_REG_GES_RESULT2, &g2);
+
+ if (!error && (g1 || g2))
+ paj7620_report_keys(data, (g2 << 8) | g1);
+
+ pm_runtime_mark_last_busy(&data->client->dev);
+ pm_runtime_put_autosuspend(&data->client->dev);
+
+ return IRQ_HANDLED;
+}
+
+static int paj7620_init(struct paj7620_data *data)
+{
+ int state = 0, error, i;
+
+ /* 1. Wake-up sequence: Read register 0x00 until it returns 0x20 */
+ for (i = 0; i < 10; i++) {
+ error = regmap_read(data->regmap, 0x00, &state);
+ if (error >= 0 && state == 0x20)
+ break;
+ usleep_range(1000, 2000);
+ }
+
+ if (state != 0x20) {
+ dev_err(&data->client->dev, "Sensor wake-up failed (0x%02x)\n", state);
+ return -ENODEV;
+ }
+
+ /* 2. Blast full register array into PAJ7620 instantly */
+ error = regmap_multi_reg_write(data->regmap, init_register,
+ ARRAY_SIZE(init_register));
+ if (error < 0) {
+ dev_err(&data->client->dev, "Multi-reg write failed (%d)\n", error);
+ return error;
+ }
+
+ error = regmap_write(data->regmap, PAJ7620_REG_BANK_SEL, 0x00);
+ if (error < 0)
+ return error;
+
+ error = regmap_multi_reg_write(data->regmap, init_gesture_array,
+ ARRAY_SIZE(init_gesture_array));
+ if (error < 0) {
+ dev_err(&data->client->dev, "Multi-reg write failed (%d)\n", error);
+ return error;
+ }
+
+ return 0;
+}
+
+static int paj7620_input_open(struct input_dev *idev)
+{
+ int error;
+ struct paj7620_data *data = input_get_drvdata(idev);
+
+ error = regulator_bulk_enable(ARRAY_SIZE(data->supplies), data->supplies);
+ if (error)
+ return error;
+
+ error = paj7620_init(data);
+ if (error) {
+ regulator_bulk_disable(ARRAY_SIZE(data->supplies), data->supplies);
+ return error;
+ }
+
+ return 0;
+}
+
+static void paj7620_input_close(struct input_dev *idev)
+{
+ struct paj7620_data *data = input_get_drvdata(idev);
+
+ regmap_multi_reg_write(data->regmap, paj7620_suspend_regs,
+ ARRAY_SIZE(paj7620_suspend_regs));
+
+ regulator_bulk_disable(ARRAY_SIZE(data->supplies), data->supplies);
+}
+
+static int paj7620_runtime_suspend(struct device *dev)
+{
+ int error;
+ struct paj7620_data *data = dev_get_drvdata(dev);
+
+ error = regmap_write(data->regmap, PAJ7620_REG_BANK_SEL, 0x01);
+ if (error)
+ return error;
+
+ error = regmap_write(data->regmap, PAJ7620_REG_AUTO_STANDBY, 0x30);
+ if (error)
+ return error;
+
+ return 0;
+}
+
+static int paj7620_runtime_resume(struct device *dev)
+{
+ int error;
+ struct paj7620_data *data = dev_get_drvdata(dev);
+
+ error = regmap_write(data->regmap, PAJ7620_REG_BANK_SEL, 0x01);
+ if (error)
+ return error;
+
+ error = regmap_write(data->regmap, PAJ7620_REG_AUTO_STANDBY, 0x00);
+ if (error)
+ return error;
+
+ error = regmap_write(data->regmap, PAJ7620_REG_BANK_SEL, 0x00);
+ if (error)
+ return error;
+
+ usleep_range(1000, 2000); // Stabilization delay (1ms minimum)
+ return 0;
+}
+
+static const struct dev_pm_ops paj7620_pm_ops = {
+ SET_RUNTIME_PM_OPS(paj7620_runtime_suspend, paj7620_runtime_resume, NULL)
+ SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
+};
+
+static const struct regmap_config paj7620_reg_config = {
+ .reg_bits = 8, .val_bits = 8, .max_register = 0xEF,
+};
+
+static void paj7620_disable_pm(void *dev)
+{
+ pm_runtime_disable(dev);
+ pm_runtime_dont_use_autosuspend(dev);
+}
+
+static int paj7620_probe(struct i2c_client *client)
+{
+ struct paj7620_data *data;
+ int error, i;
+
+ data = devm_kzalloc(&client->dev, sizeof(*data), GFP_KERNEL);
+ if (!data)
+ return -ENOMEM;
+
+ data->client = client;
+ i2c_set_clientdata(client, data);
+
+ data->supplies[0].supply = "vdd";
+ data->supplies[1].supply = "vbus";
+ data->supplies[2].supply = "vled";
+
+ error = devm_regulator_bulk_get(&client->dev, ARRAY_SIZE(data->supplies), data->supplies);
+ if (error)
+ return dev_err_probe(&client->dev, error, "Failed to get regulators\n");
+
+ error = device_property_read_u32_array(&client->dev, "linux,keycodes",
+ data->keymap, ARRAY_SIZE(data->keymap));
+
+ if (error) {
+ data->keymap[0] = KEY_UP;
+ data->keymap[1] = KEY_DOWN;
+ data->keymap[2] = KEY_LEFT;
+ data->keymap[3] = KEY_RIGHT;
+ data->keymap[4] = KEY_ENTER;
+ data->keymap[5] = KEY_BACK;
+ data->keymap[6] = KEY_NEXT;
+ data->keymap[7] = KEY_PREVIOUS;
+ data->keymap[8] = KEY_MENU;
+ }
+
+ data->regmap = devm_regmap_init_i2c(client, &paj7620_reg_config);
+ if (IS_ERR(data->regmap))
+ return PTR_ERR(data->regmap);
+
+ data->idev = devm_input_allocate_device(&client->dev);
+ if (!data->idev)
+ return -ENOMEM;
+
+ data->idev->name = "PAJ7620 Gesture Sensor";
+ data->idev->id.bustype = BUS_I2C;
+ data->idev->open = paj7620_input_open;
+ data->idev->close = paj7620_input_close;
+ data->idev->keycode = data->keymap;
+ data->idev->keycodemax = ARRAY_SIZE(data->keymap);
+ data->idev->keycodesize = sizeof(u32);
+
+ for (i = 0; i < ARRAY_SIZE(data->keymap); i++)
+ input_set_capability(data->idev, EV_KEY, data->keymap[i]);
+
+ input_set_drvdata(data->idev, data);
+
+ error = input_register_device(data->idev);
+ if (error)
+ return error;
+
+ pm_runtime_set_active(&client->dev);
+ pm_runtime_enable(&client->dev);
+ pm_runtime_set_autosuspend_delay(&client->dev, 2000);
+ pm_runtime_use_autosuspend(&client->dev);
+
+ error = devm_add_action_or_reset(&client->dev, paj7620_disable_pm, &client->dev);
+ if (error)
+ return error;
+
+ return devm_request_threaded_irq(&client->dev, client->irq,
+ NULL, paj7620_irq_thread,
+ IRQF_ONESHOT, "paj7620",
+ data);
+}
+
+static const struct of_device_id paj7620_of_match[] = {
+ { .compatible = "pixart,paj7620" },
+ { }
+};
+MODULE_DEVICE_TABLE(of, paj7620_of_match);
+
+static struct i2c_driver paj7620_driver = {
+ .driver = {
+ .name = "paj7620",
+ .of_match_table = paj7620_of_match,
+ .pm = &paj7620_pm_ops,
+ },
+ .probe = paj7620_probe,
+};
+module_i2c_driver(paj7620_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Harpreet Saini");
+MODULE_DESCRIPTION("PAJ7620 Gesture Input Driver");
--
2.43.0
^ permalink raw reply related
* [PATCH v5 0/2] input: misc: Add PixArt PAJ7620 gesture sensor
From: Harpreet Saini via B4 Relay @ 2026-04-27 4:46 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Harpreet Saini
Cc: linux-input, devicetree, linux-kernel, Krzysztof Kozlowski
Add support for PixArt PAJ7620 gesture sensor
This series adds support for the PixArt PAJ7620 hand gesture sensor.
The sensor is connected via I2C and supports 9 different gestures.
The first patch adds the DT bindings, and the second patch adds the
driver itself.
Changes in v5:
- Added this missing cover letter.
- Included Reviewed-by tag for the bindings patch.
- Linked to previous v4 discussion.
- No functional changes since v4.
Changes in v4:
- In pixart,paj7620.yaml dt-binding file added allOf: with $ref and
unevaluatedProperties
- No changes in other files
- Link to v4: https://lore.kernel.org/all/20260421041505.4548-2-sainiharpreet29@yahoo.com
Changes in v3:
- Moved sensor power-up and paj7620_init() to input open/close callbacks
- Implemented dynamic keymap support via 'linux,keycodes' DT property
and enabled userspace adjustment via EVIOCSKEYCODE.
- Updated YAML bindings to include mandatory vdd, vbus, and vled
supplies.
- Added gpio-controller properties to YAML for hardware completeness.
- Link to v3: https://lore.kernel.org/all/20260418062241.104697-1-sainiharpreet29@yahoo.com
Changes in v2:
- Moved driver from drivers/iio/light to drivers/input/misc
- Updated DT bindings to include mandatory vdd, vbus, and vled supplies
- Added Runtime PM support with autosuspend logic
- Combined bindings and driver into a single series
- Link to v2: https://lore.kernel.org/all/20260417052527.62535-1-sainiharpreet29@yahoo.com
Changes in v1:
- Initial patch for dt-binding and driver was added to iio/light
subsystem.
- Link to v1: https://lore.kernel.org/all/20260413000308.7618-1-sainiharpreet29@yahoo.com
Testing:
- Hardware: Raspberry Pi 3
- Method: Verified all hand gestures using 'evtest' to confirm correct
input event reporting.
Signed-off-by: Harpreet Saini <sainiharpreet29@yahoo.com>
---
Harpreet Saini (2):
dt-bindings: input: Add PixArt PAJ7620 gesture sensor
input: misc: Add PixArt PAJ7620 gesture sensor driver
.../devicetree/bindings/input/pixart,paj7620.yaml | 84 +++++
.../devicetree/bindings/vendor-prefixes.yaml | 2 +
drivers/input/misc/Kconfig | 12 +
drivers/input/misc/Makefile | 1 +
drivers/input/misc/paj7620.c | 338 +++++++++++++++++++++
5 files changed, 437 insertions(+)
---
base-commit: bf9c95f3eeefb7fc4b4a6380cc23f1dca744e379
change-id: 20260426-paj7620-v5-79ab28a3b2e4
Best regards,
--
Harpreet Saini <sainiharpreet29@yahoo.com>
^ permalink raw reply
* Re: [PATCH] Input: xpad - reject short Xbox One packets before len-relative share-button index
From: Dmitry Torokhov @ 2026-04-27 4:22 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-input, linux-kernel, stable
In-Reply-To: <2026042014-freestyle-deluxe-48e4@gregkh>
Hi Greg,
On Mon, Apr 20, 2026 at 05:53:15PM +0200, Greg Kroah-Hartman wrote:
> xpadone_process_packet() receives len directly from urb->actual_length
> and uses it to index the share-button byte at data[len - 18] or
> data[len - 26]. Since both len and data[0] are under the device's
> control, a broken controller can send a GIP_CMD_INPUT packet with
> actual_length < 18 (e.g. 5 bytes) and reach this code path, causing
> accesses beyond the actual array.
>
> Since len is u32, 5 - 26 wraps to 0xFFFFFFEB, and data[0xFFFFFFEB] can
> dereference about 4 GiB past the 64-byte usb_alloc_coherent() idata
> buffer. On a KASAN system this is an immediate splat otherwise the read
> will either fault on an unmapped page (DoS) or pull a bit from arbitrary
> kernel memory and report it as KEY_RECORD.
>
> Fix this all up by properly bounds checking the value provided by the
> device.
>
> Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Fixes: 4ef46367073b ("Input: xpad - fix Share button on Xbox One controllers")
> Cc: stable <stable@kernel.org>
> Assisted-by: gkh_clanker_t1000
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> drivers/input/joystick/xpad.c | 11 +++++++----
> 1 file changed, 7 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
> index d6fc3d6006bb..7d99fe0ecf91 100644
> --- a/drivers/input/joystick/xpad.c
> +++ b/drivers/input/joystick/xpad.c
> @@ -1110,10 +1110,13 @@ static void xpadone_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char
> input_report_key(dev, BTN_START, data[4] & BIT(2));
> input_report_key(dev, BTN_SELECT, data[4] & BIT(3));
> if (xpad->mapping & MAP_SHARE_BUTTON) {
> - if (xpad->mapping & MAP_SHARE_OFFSET)
> - input_report_key(dev, KEY_RECORD, data[len - 26] & BIT(0));
> - else
> - input_report_key(dev, KEY_RECORD, data[len - 18] & BIT(0));
> + if (xpad->mapping & MAP_SHARE_OFFSET) {
> + if (len >= 26)
> + input_report_key(dev, KEY_RECORD, data[len - 26] & BIT(0));
> + } else {
> + if (len >= 18)
> + input_report_key(dev, KEY_RECORD, data[len - 18] & BIT(0));
> + }
Thank you for the report, but this is quite ugly. I committed an
alternative version of the fix.
Thanks.
--
Dmitry
^ permalink raw reply
* Re: [PATCH] Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
From: Dmitry Torokhov @ 2026-04-27 4:00 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-input, linux-kernel, stable
In-Reply-To: <2026042026-chlorine-epidermis-fd6d@gregkh>
On Mon, Apr 20, 2026 at 06:00:27PM +0200, Greg Kroah-Hartman wrote:
> nexio_read_data() pulls data_len and x_len from a packed __be16 header
> in the device's interrupt packet and then walks packet->data[0..x_len)
> and packet->data[x_len..data_len) comparing each byte against a
> threshold.
>
> Both fields are 16-bit on the wire (max 65535). The existing
> adjustments shave at most 0x100 / 0x80 off, so the loop bound can still
> reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size
> (1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the
> packed header — so packet->data[] has 1017 valid bytes. read_data()
> callbacks are not given urb->actual_length, and nothing else bounds the
> walk.
>
> A device that lies about its length can get a ~64 KiB out-of-bounds read
> past the coherent DMA allocation. The first index whose byte exceeds
> NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the
> reported touch coordinates, so adjacent kernel memory contents leak to
> userspace as ABS_X / ABS_Y events. Far enough out, the read can also
> hit an unmapped page and fault.
>
> Fix this all by clamping data_len to the buffer's data[] capacity and
> x_len to data_len.
>
> Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Fixes: 5197424cdccc ("Input: usbtouchscreen - add NEXIO (or iNexio) support")
> Cc: stable <stable@kernel.org>
> Assisted-by: gkh_clanker_t1000
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Applied, thank you.
--
Dmitry
^ permalink raw reply
* Re: [PATCH] Input: ims-pcu - bound frame parser write index against read_buf size
From: Greg Kroah-Hartman @ 2026-04-26 21:18 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input, linux-kernel, stable
In-Reply-To: <ae2ePyF_jDzVhgLf@google.com>
On Sat, Apr 25, 2026 at 10:12:51PM -0700, Dmitry Torokhov wrote:
> On Fri, Apr 24, 2026 at 06:16:57AM +0200, Greg Kroah-Hartman wrote:
> > On Thu, Apr 23, 2026 at 10:24:08AM -0700, Dmitry Torokhov wrote:
> > > On Thu, Apr 23, 2026 at 06:52:23AM +0200, Greg Kroah-Hartman wrote:
> > > > On Wed, Apr 22, 2026 at 06:36:24PM -0700, Dmitry Torokhov wrote:
> > > > > Hi Greg,
> > > > >
> > > > > On Mon, Apr 20, 2026 at 09:05:31PM +0200, Greg Kroah-Hartman wrote:
> > > > > > ims_pcu_process_data() implements a STX/DLE/ETX byte-stuffing parser
> > > > > > that accumulates frame payload into pcu->read_buf[] using the running
> > > > > > index pcu->read_pos. read_buf is IMS_PCU_BUF_SIZE (128) bytes and
> > > > > > read_pos is u8 but of course, we don't check the index before actually
> > > > > > writing the data :(
> > > > > >
> > > > > > Fix this up by properly rejecting the frame at the first attempt to
> > > > > > write past read_buf and resync on the next STX, mirroring how the parser
> > > > > > handles short and bad-checksum frames on ETX.
> > > > > >
> > > > > > Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> > > > > > Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
> > > > > > Cc: stable <stable@kernel.org>
> > > > > > Assisted-by: gkh_clanker_t1000
> > > > > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > > > >
> > > > > I already have a patch for this, thanks.
> > > >
> > > > Ah, missed that, sorry, I was working against Linus's tree. I am
> > > > guessing you are referring to commit 875115b82c29 ("Input: ims-pcu - fix
> > > > heap-buffer-overflow in ims_pcu_process_data()")? If so, why wasn't
> > > > that tagged for stable inclusion?
> > >
> > > I do not believe it is worth it. The driver is for specialized hardware,
> > > so common distros will not be enabling it, and systems where it is used
> > > likely do not allow plugging weird stuff into them and probably do not
> > > use stable either.
> >
> > Android allows a lot of odd things to be plugged into it :(
>
> Well, that's on them. Do they enable drivers blindly?
>
> >
> > > I actually wonder if we need to carry the driver or if we should simply
> > > drop it. The only non-cleanup change to it was done in 2014.
> >
> > I'll gladly send a patch to delete it if you want me to.
>
> Sure, let's do it. It's easy to restore it if it is actually needed.
Ok, will work on that after -rc1 is out.
greg k-h
^ permalink raw reply
* [syzbot] [input?] [usb?] KASAN: slab-use-after-free Read in hidraw_report_event
From: syzbot @ 2026-04-27 3:28 UTC (permalink / raw)
To: bentiss, jikos, linux-input, linux-kernel, linux-usb,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 7080e32d3f09 Add linux-next specific files for 20260424
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=13d8b2d2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d941ac7f11ceb230
dashboard link: https://syzkaller.appspot.com/bug?extid=9eebf5f6544c5e873858
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14d309ba580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a082ce580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9bbfdd86f73d/disk-7080e32d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1257e4300d9e/vmlinux-7080e32d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c2588b431811/bzImage-7080e32d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9eebf5f6544c5e873858@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
Read of size 1 at addr ffff888039a26d08 by task ktimers/0/16
CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
__kasan_check_byte+0x2a/0x40 mm/kasan/common.c:574
kasan_check_byte include/linux/kasan.h:402 [inline]
lock_acquire+0x84/0x350 kernel/locking/lockdep.c:5844
rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
spin_lock include/linux/spinlock_rt.h:45 [inline]
hidraw_report_event+0x5d/0x3a0 drivers/hid/hidraw.c:577
hid_report_raw_event+0x311/0x1730 drivers/hid/hid-core.c:2076
__hid_input_report drivers/hid/hid-core.c:2152 [inline]
hid_input_report+0x44e/0x580 drivers/hid/hid-core.c:2174
hid_irq_in+0x47e/0x6d0 drivers/hid/usbhid/hid-core.c:286
__usb_hcd_giveback_urb+0x3b3/0x5e0 drivers/usb/core/hcd.c:1657
dummy_timer+0x8a9/0x47d0 drivers/usb/gadget/udc/dummy_hcd.c:2005
__run_hrtimer kernel/time/hrtimer.c:1930 [inline]
__hrtimer_run_queues+0x405/0xb10 kernel/time/hrtimer.c:1994
hrtimer_run_softirq+0x18f/0x260 kernel/time/hrtimer.c:2011
handle_softirqs+0x1de/0x6d0 kernel/softirq.c:626
__do_softirq kernel/softirq.c:660 [inline]
run_ktimerd+0x69/0x100 kernel/softirq.c:1155
smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 10:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x3a6/0x690 mm/slub.c:5415
kmalloc_noprof include/linux/slab.h:950 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
hidraw_connect+0x57/0x430 drivers/hid/hidraw.c:606
hid_connect+0x5bf/0x19d0 drivers/hid/hid-core.c:2277
hid_hw_start+0xa8/0x120 drivers/hid/hid-core.c:2387
corsairpsu_probe+0xd9/0x3c0 drivers/hwmon/corsair-psu.c:782
__hid_device_probe drivers/hid/hid-core.c:2783 [inline]
hid_device_probe+0x416/0x7a0 drivers/hid/hid-core.c:2820
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:709
__driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871
driver_probe_device+0x4f/0x240 drivers/base/dd.c:901
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1029
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1101
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1156
bus_probe_device+0x12d/0x220 drivers/base/bus.c:613
device_add+0x7e9/0xbb0 drivers/base/core.c:3706
hid_add_device+0x272/0x3e0 drivers/hid/hid-core.c:2964
usbhid_probe+0xbb3/0x1080 drivers/hid/usbhid/hid-core.c:1448
usb_probe_interface+0x659/0xc70 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:709
__driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871
driver_probe_device+0x4f/0x240 drivers/base/dd.c:901
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1029
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1101
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1156
bus_probe_device+0x12d/0x220 drivers/base/bus.c:613
device_add+0x7e9/0xbb0 drivers/base/core.c:3706
usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:709
__driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871
driver_probe_device+0x4f/0x240 drivers/base/dd.c:901
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1029
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1101
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1156
bus_probe_device+0x12d/0x220 drivers/base/bus.c:613
device_add+0x7e9/0xbb0 drivers/base/core.c:3706
usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953
process_one_work+0x9a3/0x1710 kernel/workqueue.c:3312
process_scheduled_works kernel/workqueue.c:3403 [inline]
worker_thread+0xba8/0x11e0 kernel/workqueue.c:3489
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 10:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2689 [inline]
slab_free mm/slub.c:6246 [inline]
kfree+0x1c5/0x6c0 mm/slub.c:6561
hidraw_disconnect+0x4f/0x60 drivers/hid/hidraw.c:662
hid_disconnect drivers/hid/hid-core.c:2362 [inline]
hid_hw_stop+0x101/0x1e0 drivers/hid/hid-core.c:2407
corsairpsu_probe+0x327/0x3c0 drivers/hwmon/corsair-psu.c:826
__hid_device_probe drivers/hid/hid-core.c:2783 [inline]
hid_device_probe+0x416/0x7a0 drivers/hid/hid-core.c:2820
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:709
__driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871
driver_probe_device+0x4f/0x240 drivers/base/dd.c:901
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1029
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1101
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1156
bus_probe_device+0x12d/0x220 drivers/base/bus.c:613
device_add+0x7e9/0xbb0 drivers/base/core.c:3706
hid_add_device+0x272/0x3e0 drivers/hid/hid-core.c:2964
usbhid_probe+0xbb3/0x1080 drivers/hid/usbhid/hid-core.c:1448
usb_probe_interface+0x659/0xc70 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:709
__driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871
driver_probe_device+0x4f/0x240 drivers/base/dd.c:901
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1029
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1101
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1156
bus_probe_device+0x12d/0x220 drivers/base/bus.c:613
device_add+0x7e9/0xbb0 drivers/base/core.c:3706
usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x267/0xaf0 drivers/base/dd.c:709
__driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871
driver_probe_device+0x4f/0x240 drivers/base/dd.c:901
__device_attach_driver+0x279/0x430 drivers/base/dd.c:1029
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c8/0x450 drivers/base/dd.c:1101
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1156
bus_probe_device+0x12d/0x220 drivers/base/bus.c:613
device_add+0x7e9/0xbb0 drivers/base/core.c:3706
usb_new_device+0x9f8/0x16e0 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x2a49/0x4f60 drivers/usb/core/hub.c:5953
process_one_work+0x9a3/0x1710 kernel/workqueue.c:3312
process_scheduled_works kernel/workqueue.c:3403 [inline]
worker_thread+0xba8/0x11e0 kernel/workqueue.c:3489
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff888039a26c00
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 264 bytes inside of
freed 512-byte region [ffff888039a26c00, ffff888039a26e00)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x39a24
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x80000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000040 ffff88813fe14c80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0080000000000040 ffff88813fe14c80 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0080000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5865, tgid 5865 (syz-executor), ts 158390292947, free_ts 156250708543
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x22d/0x280 mm/page_alloc.c:1858
prep_new_page mm/page_alloc.c:1866 [inline]
get_page_from_freelist+0x27d6/0x2850 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5226
alloc_slab_page mm/slub.c:3278 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3467
new_slab mm/slub.c:3525 [inline]
refill_objects+0x33c/0x3d0 mm/slub.c:7251
refill_sheaf mm/slub.c:2816 [inline]
__pcs_replace_empty_main+0x373/0x720 mm/slub.c:4651
alloc_from_pcs mm/slub.c:4749 [inline]
slab_alloc_node mm/slub.c:4883 [inline]
__kmalloc_cache_noprof+0x44e/0x690 mm/slub.c:5410
kmalloc_noprof include/linux/slab.h:950 [inline]
tc_action_net_init include/net/act_api.h:163 [inline]
nat_init_net+0x65/0x1a0 net/sched/act_nat.c:332
ops_init+0x35c/0x5c0 net/core/net_namespace.c:137
setup_net+0x118/0x340 net/core/net_namespace.c:446
copy_net_ns+0x50e/0x730 net/core/net_namespace.c:579
create_new_namespaces+0x3e7/0x6a0 kernel/nsproxy.c:132
unshare_nsproxy_namespaces+0x149/0x190 kernel/nsproxy.c:234
ksys_unshare+0x57d/0x9f0 kernel/fork.c:3244
__do_sys_unshare kernel/fork.c:3318 [inline]
__se_sys_unshare kernel/fork.c:3316 [inline]
__x64_sys_unshare+0x38/0x50 kernel/fork.c:3316
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
page last free pid 5848 tgid 5848 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1402 [inline]
__free_frozen_pages+0xf9b/0x10f0 mm/page_alloc.c:2943
__folio_put+0x2eb/0x3a0 mm/swap.c:112
folio_put include/linux/mm.h:2090 [inline]
put_page include/linux/mm.h:2159 [inline]
put_netmem include/net/netmem.h:394 [inline]
skb_page_unref include/linux/skbuff_ref.h:43 [inline]
__skb_frag_unref include/linux/skbuff_ref.h:56 [inline]
skb_release_data+0x544/0xa60 net/core/skbuff.c:1108
skb_release_all net/core/skbuff.c:1189 [inline]
__kfree_skb+0x5d/0x210 net/core/skbuff.c:1203
tcp_clean_rtx_queue net/ipv4/tcp_input.c:3698 [inline]
tcp_ack+0x284f/0x7e00 net/ipv4/tcp_input.c:4370
tcp_rcv_established+0x8c4/0x2800 net/ipv4/tcp_input.c:6645
tcp_v4_do_rcv+0x755/0x13f0 net/ipv4/tcp_ipv4.c:1852
sk_backlog_rcv include/net/sock.h:1190 [inline]
__release_sock+0x285/0x3d0 net/core/sock.c:3216
__sk_flush_backlog+0x4b/0xe0 net/core/sock.c:3239
sk_flush_backlog include/net/sock.h:1253 [inline]
tcp_sendmsg_locked+0x4167/0x5370 net/ipv4/tcp.c:1256
tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1455
sock_sendmsg_nosec+0xf9/0x150 net/socket.c:797
__sock_sendmsg net/socket.c:812 [inline]
sock_write_iter+0x308/0x410 net/socket.c:1269
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x629/0xba0 fs/read_write.c:688
ksys_write+0x156/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
Memory state around the buggy address:
ffff888039a26c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888039a26c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888039a26d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888039a26d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888039a26e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply
* Re: [PATCH] dt-bindings: Remove the redundant 'type: boolean'
From: Bui Duc Phuc @ 2026-04-27 0:19 UTC (permalink / raw)
To: Krzysztof Kozlowski
Cc: robh, krzk+dt, conor+dt, nick, dmitry.torokhov, nicolas.ferre,
alexandre.belloni, claudiu.beznea, lee, heiko, gregkh, linusw,
zyw, zhangqing, gene_chen, linux-input, devicetree,
linux-arm-kernel, linux-usb
In-Reply-To: <a145db93-a8ad-4bee-8404-21f356d7d4ab@kernel.org>
Hi Krzysztof,
> Why did you change one file and ignore the rest?
I'm processing the remaining files with caution. Files without
significant descriptions or context will be updated in the upcoming
patches.
Those with specific descriptions require deeper review and will be
handled in separate patch series later.
> Why did you not mention previous feedback I gave you on your patches
> (some time ago), that there are TWO TYPES defined for wakeup-source.
Thanks for mentioning this.
In v2 of the patch, I reviewed the previous discussion between you and
Connor regarding the two types for wakeup-source.
https://lore.kernel.org/all/20260316034606.11304-1-phucduc.bui@gmail.com/
When moving to v3, I followed Rob’s suggestion to use true. I also
sent a follow-up email to confirm this approach,
and since I did not receive further comments, I assumed this direction
was acceptable.
https://lore.kernel.org/all/CAABR9nH3hr+Y5ksD0cn3Gd9XUvmb07X7zJw0b4k_yVbnAuz9=w@mail.gmail.com/
Best Regards,
Phuc
^ permalink raw reply
* Re: [PATCH v6 2/2] Input: Add support for Wacom W9000-series penabled touchscreens
From: Dmitry Torokhov @ 2026-04-26 23:40 UTC (permalink / raw)
To: Hendrik Noack
Cc: Rob Herring, Krzysztof Kozlowski, Conor Dooley, Ferass El Hafidi,
linux-input, devicetree, linux-kernel
In-Reply-To: <20260426135232.371272-3-hendrik-noack@gmx.de>
Hi Hendrik,
On Sun, Apr 26, 2026 at 03:52:32PM +0200, Hendrik Noack wrote:
> Add driver for Wacom W9002 and two Wacom W9007A variants. These are
> penabled touchscreens supporting passive Wacom Pens and use I2C.
>
> Co-developed-by: Ferass El Hafidi <funderscore@postmarketos.org>
> Signed-off-by: Ferass El Hafidi <funderscore@postmarketos.org>
> Signed-off-by: Hendrik Noack <hendrik-noack@gmx.de>
Some of sashiko's comments sem valid, please address them:
https://sashiko.dev/#/patchset/20260426135232.371272-1-hendrik-noack@gmx.de
Thanks.
--
Dmitry
^ permalink raw reply
* Re: [PATCH] HID: pidff: Fix integer overflow in pidff_rescale
From: Tomasz Pakuła @ 2026-04-26 19:57 UTC (permalink / raw)
To: Markus Elfring, linux-input, Benjamin Tissoires, Jiri Kosina
Cc: LKML, Oleg Makarenko
In-Reply-To: <dd6e5b2c-700e-444d-a9e5-8794c0ff8e34@web.de>
On Sun, 2026-04-26 at 12:48 +0200, Markus Elfring wrote:
> > Rescaling values close to the max (U16_MAX) temporairly creates values
> …
> temporarily?
>
>
> See also:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.0#n145
>
> Regards,
> Markus
I don't quite understand the point. I'm aware of the error but didn't
have time to look onto it yet. I probably just need to switch to the
division functions exposed by the kernel.
As far as the other stuff you mentioned, I don't get it. I don't think
it would make sense to mention the 20 yo commit that added this driver.
As far as the temporary status of the value. It only exceeds the s32
range after the multiplication, and is reduced right after, during
division. I think "temporarily" applies here perfectly?
Maybe I'm not seeing something here, please elaborate so I can fix it :D
Tomasz
^ permalink raw reply
* [PATCH v6 2/2] Input: Add support for Wacom W9000-series penabled touchscreens
From: Hendrik Noack @ 2026-04-26 13:52 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley
Cc: Hendrik Noack, Ferass El Hafidi, linux-input, devicetree,
linux-kernel
In-Reply-To: <20260426135232.371272-1-hendrik-noack@gmx.de>
Add driver for Wacom W9002 and two Wacom W9007A variants. These are
penabled touchscreens supporting passive Wacom Pens and use I2C.
Co-developed-by: Ferass El Hafidi <funderscore@postmarketos.org>
Signed-off-by: Ferass El Hafidi <funderscore@postmarketos.org>
Signed-off-by: Hendrik Noack <hendrik-noack@gmx.de>
---
drivers/input/touchscreen/Kconfig | 12 +
drivers/input/touchscreen/Makefile | 1 +
drivers/input/touchscreen/wacom_w9000.c | 438 ++++++++++++++++++++++++
3 files changed, 451 insertions(+)
create mode 100644 drivers/input/touchscreen/wacom_w9000.c
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index aeaf9a9cbb41..6714c1e451a6 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -610,6 +610,18 @@ config TOUCHSCREEN_WACOM_I2C
To compile this driver as a module, choose M here: the module
will be called wacom_i2c.
+config TOUCHSCREEN_WACOM_W9000
+ tristate "Wacom W9000-series penabled touchscreen (I2C)"
+ depends on I2C
+ help
+ Say Y here if you have a Wacom W9000-series penabled I2C touchscreen.
+ This driver supports models W9002 and W9007A.
+
+ If unsure, say N.
+
+ To compile this driver as a module, choose M here: the module
+ will be called wacom_w9000.
+
config TOUCHSCREEN_LPC32XX
tristate "LPC32XX touchscreen controller"
depends on ARCH_LPC32XX
diff --git a/drivers/input/touchscreen/Makefile b/drivers/input/touchscreen/Makefile
index f2b002abebe8..6db05b4a2ee5 100644
--- a/drivers/input/touchscreen/Makefile
+++ b/drivers/input/touchscreen/Makefile
@@ -101,6 +101,7 @@ tsc2007-$(CONFIG_TOUCHSCREEN_TSC2007_IIO) += tsc2007_iio.o
obj-$(CONFIG_TOUCHSCREEN_TSC2007) += tsc2007.o
obj-$(CONFIG_TOUCHSCREEN_WACOM_W8001) += wacom_w8001.o
obj-$(CONFIG_TOUCHSCREEN_WACOM_I2C) += wacom_i2c.o
+obj-$(CONFIG_TOUCHSCREEN_WACOM_W9000) += wacom_w9000.o
obj-$(CONFIG_TOUCHSCREEN_WDT87XX_I2C) += wdt87xx_i2c.o
obj-$(CONFIG_TOUCHSCREEN_WM831X) += wm831x-ts.o
obj-$(CONFIG_TOUCHSCREEN_WM97XX) += wm97xx-ts.o
diff --git a/drivers/input/touchscreen/wacom_w9000.c b/drivers/input/touchscreen/wacom_w9000.c
new file mode 100644
index 000000000000..3ef32dba35ab
--- /dev/null
+++ b/drivers/input/touchscreen/wacom_w9000.c
@@ -0,0 +1,438 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Wacom W9000-series penabled I2C touchscreen driver
+ *
+ * Copyright (c) 2026 Hendrik Noack <hendrik-noack@gmx.de>
+ *
+ * Partially based on vendor driver:
+ * Copyright (C) 2012, Samsung Electronics Co. Ltd.
+ */
+
+#include <linux/delay.h>
+#include <linux/gpio/consumer.h>
+#include <linux/i2c.h>
+#include <linux/input.h>
+#include <linux/input/touchscreen.h>
+#include <linux/unaligned.h>
+
+/* Some chips have flaky firmware that requires many retries before responding. */
+#define CMD_QUERY_RETRIES 8
+
+/* Message length */
+#define CMD_QUERY_NUM_MAX 9
+#define MSG_COORD_NUM_MAX 12
+
+/* Commands */
+#define CMD_QUERY 0x2a
+
+struct wacom_w9000_variant {
+ const unsigned int cmd_query_num;
+ const unsigned int msg_coord_num;
+ const char *name;
+};
+
+struct wacom_w9000_data {
+ struct i2c_client *client;
+ struct input_dev *input_dev;
+ const struct wacom_w9000_variant *variant;
+ unsigned int fw_version;
+
+ struct touchscreen_properties prop;
+ unsigned int max_pressure;
+
+ struct regulator *regulator;
+ bool powered;
+
+ struct gpio_desc *flash_mode_gpio;
+ struct gpio_desc *reset_gpio;
+
+ unsigned int irq;
+
+ bool pen_proximity;
+};
+
+static int wacom_w9000_read(struct i2c_client *client, u8 command, int len, char *data)
+{
+ int error, res;
+ struct i2c_msg msg[] = {
+ {
+ .addr = client->addr,
+ .flags = 0,
+ .buf = &command,
+ .len = sizeof(command),
+ }, {
+ .addr = client->addr,
+ .flags = I2C_M_RD,
+ .buf = data,
+ .len = len,
+ }
+ };
+
+ res = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg));
+ if (res != ARRAY_SIZE(msg)) {
+ error = res < 0 ? res : -EIO;
+ dev_err(&client->dev, "%s: i2c transfer failed: %d (%d)\n", __func__, error, res);
+ return error;
+ }
+
+ return 0;
+}
+
+static int wacom_w9000_query(struct wacom_w9000_data *wacom_data)
+{
+ struct i2c_client *client = wacom_data->client;
+ struct device *dev = &wacom_data->client->dev;
+ int error;
+ int retry = 0;
+ u8 data[CMD_QUERY_NUM_MAX];
+
+ for (; retry < CMD_QUERY_RETRIES; retry++) {
+ error = wacom_w9000_read(client, CMD_QUERY, wacom_data->variant->cmd_query_num,
+ data);
+
+ if (!error && (data[0] == 0x0f))
+ break;
+ }
+
+ if (error)
+ return error;
+
+ dev_dbg(dev, "query: %*ph, %d\n", wacom_data->variant->cmd_query_num, data, retry);
+
+ wacom_data->prop.max_x = get_unaligned_be16(&data[1]);
+ wacom_data->prop.max_y = get_unaligned_be16(&data[3]);
+ wacom_data->max_pressure = get_unaligned_be16(&data[5]);
+ wacom_data->fw_version = get_unaligned_be16(&data[7]);
+
+ dev_dbg(dev, "max_x:%d, max_y:%d, max_pressure:%d, fw:%#x", wacom_data->prop.max_x,
+ wacom_data->prop.max_y, wacom_data->max_pressure,
+ wacom_data->fw_version);
+
+ return 0;
+}
+
+/* Must be called with wacom_data->input_dev->mutex held */
+static int wacom_w9000_power_on(struct wacom_w9000_data *wacom_data)
+{
+ int error;
+
+ if (wacom_data->powered)
+ return 0;
+
+ error = regulator_enable(wacom_data->regulator);
+ if (error) {
+ dev_err(&wacom_data->client->dev, "Failed to enable regulators: %d\n", error);
+ return error;
+ }
+
+ msleep(200);
+
+ gpiod_set_value_cansleep(wacom_data->reset_gpio, 0);
+ enable_irq(wacom_data->irq);
+
+ wacom_data->powered = true;
+
+ return error;
+}
+
+/* Must be called with wacom_data->input_dev->mutex held */
+static int wacom_w9000_power_off(struct wacom_w9000_data *wacom_data)
+{
+ if (!wacom_data->powered)
+ return 0;
+
+ disable_irq(wacom_data->irq);
+ gpiod_set_value_cansleep(wacom_data->reset_gpio, 1);
+ regulator_disable(wacom_data->regulator);
+
+ wacom_data->powered = false;
+
+ return 0;
+}
+
+static void wacom_w9000_coord(struct wacom_w9000_data *wacom_data)
+{
+ struct i2c_client *client = wacom_data->client;
+ struct device *dev = &wacom_data->client->dev;
+ int error;
+ u8 data[MSG_COORD_NUM_MAX];
+ bool touch, rubber, side_button;
+ u16 x, y, pressure;
+ u8 distance = 0;
+
+ error = i2c_master_recv(client, data, wacom_data->variant->msg_coord_num);
+ if (error != wacom_data->variant->msg_coord_num) {
+ if (error >= 0)
+ error = -EIO;
+ dev_err(dev, "%s: i2c receive failed (%d)\n", __func__, error);
+ return;
+ }
+
+ dev_dbg(dev, "data: %*ph", wacom_data->variant->msg_coord_num, data);
+
+ if (data[0] & BIT(7)) {
+ wacom_data->pen_proximity = true;
+
+ touch = !!(data[0] & BIT(4));
+ side_button = !!(data[0] & BIT(5));
+ rubber = !!(data[0] & BIT(6));
+
+ x = get_unaligned_be16(&data[1]);
+ y = get_unaligned_be16(&data[3]);
+ pressure = get_unaligned_be16(&data[5]);
+
+ if (wacom_data->variant->msg_coord_num > 7)
+ distance = data[7];
+
+ if (x > wacom_data->prop.max_x || y > wacom_data->prop.max_y) {
+ dev_warn(dev, "Coordinates out of range x=%d, y=%d", x, y);
+ return;
+ }
+
+ if (pressure > wacom_data->max_pressure) {
+ dev_warn(dev, "Pressure out of range %d", pressure);
+ return;
+ }
+
+ touchscreen_report_pos(wacom_data->input_dev, &wacom_data->prop, x, y, false);
+ input_report_abs(wacom_data->input_dev, ABS_PRESSURE, pressure);
+
+ if (wacom_data->variant->msg_coord_num > 7)
+ input_report_abs(wacom_data->input_dev, ABS_DISTANCE, distance);
+
+ input_report_key(wacom_data->input_dev, BTN_STYLUS, side_button);
+ input_report_key(wacom_data->input_dev, BTN_TOUCH, touch);
+ input_report_key(wacom_data->input_dev, BTN_TOOL_PEN, !rubber);
+ input_report_key(wacom_data->input_dev, BTN_TOOL_RUBBER, rubber);
+ input_sync(wacom_data->input_dev);
+ } else if (wacom_data->pen_proximity) {
+ input_report_abs(wacom_data->input_dev, ABS_PRESSURE, 0);
+
+ if (wacom_data->variant->msg_coord_num > 7)
+ input_report_abs(wacom_data->input_dev, ABS_DISTANCE, 255);
+
+ input_report_key(wacom_data->input_dev, BTN_STYLUS, 0);
+ input_report_key(wacom_data->input_dev, BTN_TOUCH, 0);
+ input_report_key(wacom_data->input_dev, BTN_TOOL_PEN, 0);
+ input_report_key(wacom_data->input_dev, BTN_TOOL_RUBBER, 0);
+ input_sync(wacom_data->input_dev);
+
+ wacom_data->pen_proximity = false;
+ }
+}
+
+static irqreturn_t wacom_w9000_interrupt(int irq, void *dev_id)
+{
+ struct wacom_w9000_data *wacom_data = dev_id;
+
+ wacom_w9000_coord(wacom_data);
+
+ return IRQ_HANDLED;
+}
+
+static int wacom_w9000_open(struct input_dev *dev)
+{
+ struct wacom_w9000_data *wacom_data = input_get_drvdata(dev);
+
+ return wacom_w9000_power_on(wacom_data);
+}
+
+static void wacom_w9000_close(struct input_dev *dev)
+{
+ struct wacom_w9000_data *wacom_data = input_get_drvdata(dev);
+
+ wacom_w9000_power_off(wacom_data);
+}
+
+static int wacom_w9000_probe(struct i2c_client *client)
+{
+ struct device *dev = &client->dev;
+ struct wacom_w9000_data *wacom_data;
+ struct input_dev *input_dev;
+ int error;
+ u32 val;
+
+ if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+ dev_err(dev, "i2c_check_functionality error\n");
+ return -EIO;
+ }
+
+ wacom_data = devm_kzalloc(dev, sizeof(*wacom_data), GFP_KERNEL);
+ if (!wacom_data)
+ return -ENOMEM;
+
+ wacom_data->variant = i2c_get_match_data(client);
+
+ if (wacom_data->variant->cmd_query_num > CMD_QUERY_NUM_MAX ||
+ wacom_data->variant->msg_coord_num > MSG_COORD_NUM_MAX) {
+ dev_err(dev, "Length of message for %s exceeds the maximum\n",
+ wacom_data->variant->name);
+ return -EINVAL;
+ }
+
+ if (wacom_data->variant->msg_coord_num < 7) {
+ dev_err(dev, "Length of coordinates message for %s too short\n",
+ wacom_data->variant->name);
+ return -EINVAL;
+ }
+
+ wacom_data->client = client;
+
+ input_dev = devm_input_allocate_device(dev);
+ if (!input_dev)
+ return -ENOMEM;
+
+ wacom_data->input_dev = input_dev;
+ input_set_drvdata(input_dev, wacom_data);
+
+ wacom_data->irq = client->irq;
+ i2c_set_clientdata(client, wacom_data);
+
+ wacom_data->regulator = devm_regulator_get(dev, "vdd");
+ if (IS_ERR(wacom_data->regulator))
+ return dev_err_probe(dev, PTR_ERR(wacom_data->regulator),
+ "Failed to get regulators\n");
+
+ wacom_data->flash_mode_gpio = devm_gpiod_get_optional(dev, "flash-mode", GPIOD_OUT_LOW);
+ if (IS_ERR(wacom_data->flash_mode_gpio))
+ return dev_err_probe(dev, PTR_ERR(wacom_data->flash_mode_gpio),
+ "Failed to get flash-mode gpio\n");
+
+ wacom_data->reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
+ if (IS_ERR(wacom_data->reset_gpio))
+ return dev_err_probe(dev, PTR_ERR(wacom_data->reset_gpio),
+ "Failed to get reset gpio\n");
+
+ error = regulator_enable(wacom_data->regulator);
+ if (error)
+ return dev_err_probe(dev, error, "Failed to enable regulators\n");
+
+ msleep(200);
+
+ gpiod_set_value_cansleep(wacom_data->reset_gpio, 0);
+
+ error = wacom_w9000_query(wacom_data);
+
+ gpiod_set_value_cansleep(wacom_data->reset_gpio, 1);
+ regulator_disable(wacom_data->regulator);
+
+ wacom_data->powered = false;
+
+ if (error)
+ return dev_err_probe(dev, error, "Failed to query\n");
+
+ input_dev->name = wacom_data->variant->name;
+ input_dev->id.bustype = BUS_I2C;
+ input_dev->dev.parent = dev;
+ input_dev->id.vendor = 0x56a;
+ input_dev->id.version = wacom_data->fw_version;
+ input_dev->open = wacom_w9000_open;
+ input_dev->close = wacom_w9000_close;
+
+ input_set_capability(input_dev, EV_KEY, BTN_TOUCH);
+ input_set_capability(input_dev, EV_KEY, BTN_TOOL_PEN);
+ input_set_capability(input_dev, EV_KEY, BTN_TOOL_RUBBER);
+ input_set_capability(input_dev, EV_KEY, BTN_STYLUS);
+
+ input_set_abs_params(input_dev, ABS_X, 0, wacom_data->prop.max_x, 4, 0);
+ input_set_abs_params(input_dev, ABS_Y, 0, wacom_data->prop.max_y, 4, 0);
+ input_set_abs_params(input_dev, ABS_PRESSURE, 0, wacom_data->max_pressure, 0, 0);
+
+ if (wacom_data->variant->msg_coord_num > 7)
+ input_set_abs_params(input_dev, ABS_DISTANCE, 0, 255, 0, 0);
+
+ touchscreen_parse_properties(input_dev, false, &wacom_data->prop);
+
+ dev_info(dev, "%s size X%uY%u\n", wacom_data->variant->name,
+ wacom_data->prop.max_x, wacom_data->prop.max_y);
+
+ error = device_property_read_u32(dev, "touchscreen-x-mm", &val);
+ if (!error)
+ input_abs_set_res(input_dev, ABS_X, wacom_data->prop.max_x / val);
+ error = device_property_read_u32(dev, "touchscreen-y-mm", &val);
+ if (!error)
+ input_abs_set_res(input_dev, ABS_Y, wacom_data->prop.max_y / val);
+
+ error = devm_request_threaded_irq(dev, wacom_data->irq, NULL, wacom_w9000_interrupt,
+ IRQF_ONESHOT | IRQF_NO_AUTOEN, client->name, wacom_data);
+ if (error)
+ return dev_err_probe(dev, error, "Failed to register interrupt\n");
+
+ error = input_register_device(wacom_data->input_dev);
+ if (error)
+ return dev_err_probe(dev, error, "Failed to register input device\n");
+
+ return 0;
+}
+
+static int wacom_w9000_suspend(struct device *dev)
+{
+ struct i2c_client *client = to_i2c_client(dev);
+ struct wacom_w9000_data *wacom_data = i2c_get_clientdata(client);
+
+ guard(mutex)(&wacom_data->input_dev->mutex);
+
+ return wacom_w9000_power_off(wacom_data);
+}
+
+static int wacom_w9000_resume(struct device *dev)
+{
+ struct i2c_client *client = to_i2c_client(dev);
+ struct wacom_w9000_data *wacom_data = i2c_get_clientdata(client);
+
+ guard(mutex)(&wacom_data->input_dev->mutex);
+
+ return wacom_w9000_power_on(wacom_data);
+}
+
+static DEFINE_SIMPLE_DEV_PM_OPS(wacom_w9000_pm, wacom_w9000_suspend, wacom_w9000_resume);
+
+static const struct wacom_w9000_variant w9002 = {
+ .cmd_query_num = 9,
+ .msg_coord_num = 7,
+ .name = "Wacom W9002 Digitizer",
+};
+
+static const struct wacom_w9000_variant w9007a_lt03 = {
+ .cmd_query_num = 9,
+ .msg_coord_num = 8,
+ .name = "Wacom W9007A LT03 Digitizer",
+};
+
+static const struct wacom_w9000_variant w9007a_v1 = {
+ .cmd_query_num = 9,
+ .msg_coord_num = 12,
+ .name = "Wacom W9007A V1 Digitizer",
+};
+
+static const struct of_device_id wacom_w9000_of_match[] = {
+ { .compatible = "wacom,w9002", .data = &w9002 },
+ { .compatible = "wacom,w9007a-lt03", .data = &w9007a_lt03, },
+ { .compatible = "wacom,w9007a-v1", .data = &w9007a_v1, },
+ { }
+};
+MODULE_DEVICE_TABLE(of, wacom_w9000_of_match);
+
+static const struct i2c_device_id wacom_w9000_id[] = {
+ { .name = "w9002", .driver_data = (kernel_ulong_t)&w9002 },
+ { .name = "w9007a-lt03", .driver_data = (kernel_ulong_t)&w9007a_lt03 },
+ { .name = "w9007a-v1", .driver_data = (kernel_ulong_t)&w9007a_v1 },
+ { }
+};
+MODULE_DEVICE_TABLE(i2c, wacom_w9000_id);
+
+static struct i2c_driver wacom_w9000_driver = {
+ .driver = {
+ .name = "wacom_w9000",
+ .of_match_table = wacom_w9000_of_match,
+ .pm = pm_sleep_ptr(&wacom_w9000_pm),
+ },
+ .probe = wacom_w9000_probe,
+ .id_table = wacom_w9000_id,
+};
+module_i2c_driver(wacom_w9000_driver);
+
+/* Module information */
+MODULE_AUTHOR("Hendrik Noack <hendrik-noack@gmx.de>");
+MODULE_DESCRIPTION("Wacom W9000-series penabled touchscreen driver");
+MODULE_LICENSE("GPL");
--
2.43.0
^ permalink raw reply related
* [PATCH v6 1/2] dt-bindings: Input: Add Wacom W9000-series penabled touchscreens
From: Hendrik Noack @ 2026-04-26 13:52 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley
Cc: Hendrik Noack, Ferass El Hafidi, linux-input, devicetree,
linux-kernel, Conor Dooley
In-Reply-To: <20260426135232.371272-1-hendrik-noack@gmx.de>
Add bindings for Wacom W9002 and two Wacom W9007 variants which can be
found in tablets.
W9002, W9007A LT03, and W9007A V1 differ in the length of the return
message containing coordinates, distance, pressure and button status.
Co-developed-by: Ferass El Hafidi <funderscore@postmarketos.org>
Signed-off-by: Ferass El Hafidi <funderscore@postmarketos.org>
Signed-off-by: Hendrik Noack <hendrik-noack@gmx.de>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
---
.../input/touchscreen/wacom,w9007a-lt03.yaml | 73 +++++++++++++++++++
1 file changed, 73 insertions(+)
create mode 100644 Documentation/devicetree/bindings/input/touchscreen/wacom,w9007a-lt03.yaml
diff --git a/Documentation/devicetree/bindings/input/touchscreen/wacom,w9007a-lt03.yaml b/Documentation/devicetree/bindings/input/touchscreen/wacom,w9007a-lt03.yaml
new file mode 100644
index 000000000000..6d1da6a435d3
--- /dev/null
+++ b/Documentation/devicetree/bindings/input/touchscreen/wacom,w9007a-lt03.yaml
@@ -0,0 +1,73 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/input/touchscreen/wacom,w9007a-lt03.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Wacom W9000-series penabled I2C touchscreen
+
+maintainers:
+ - Hendrik Noack <hendrik-noack@gmx.de>
+
+description: |
+ The W9000-series are penabled touchscreen controllers by Wacom.
+
+ The firmware of controllers in different devices may differ. This can also
+ affect the controller's behavior.
+
+allOf:
+ - $ref: touchscreen.yaml#
+
+properties:
+ compatible:
+ enum:
+ - wacom,w9002
+ - wacom,w9007a-lt03
+ - wacom,w9007a-v1
+
+ reg:
+ maxItems: 1
+
+ interrupts:
+ maxItems: 1
+
+ vdd-supply: true
+
+ flash-mode-gpios:
+ maxItems: 1
+
+ reset-gpios:
+ maxItems: 1
+
+required:
+ - compatible
+ - reg
+ - interrupts
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/gpio/gpio.h>
+ #include <dt-bindings/interrupt-controller/irq.h>
+
+ i2c {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ digitizer@56 {
+ compatible = "wacom,w9007a-lt03";
+ reg = <0x56>;
+ interrupt-parent = <&gpd1>;
+ interrupts = <1 IRQ_TYPE_EDGE_RISING>;
+
+ vdd-supply = <&stylus_reg>;
+
+ flash-mode-gpios = <&gpd1 3 GPIO_ACTIVE_HIGH>;
+ reset-gpios = <&gpx0 1 GPIO_ACTIVE_LOW>;
+
+ touchscreen-x-mm = <216>;
+ touchscreen-y-mm = <135>;
+ touchscreen-inverted-x;
+ };
+ };
--
2.43.0
^ permalink raw reply related
* [PATCH v6 0/2] Add support for Wacom W9000-series penabled touchscreens
From: Hendrik Noack @ 2026-04-26 13:52 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley
Cc: Hendrik Noack, Ferass El Hafidi, linux-input, devicetree,
linux-kernel
Add devicetree bindings and a driver for the Wacom W9000-series penabled
touchscreens.
The driver currently only contains the information for the W9002 and
W9007A, which I or Ferass could test on devices. It should also work with
other chips, such as W9001 or W9010. However, I couldn't test it on these
and the message length would need to be added.
Signed-off-by: Hendrik Noack <hendrik-noack@gmx.de>
---
Changes in v2:
- remove pdct-gpios, as it's unnecessary
- fix devicetree example
- adopt to kernel coding style
---
Changes in v3:
- fix missing include (thanks lkp@intel.com)
---
Changes in v4:
- adopt to feedback (thanks dmitry.torokhov@gmail.com)
- add W9002 support (thanks funderscore@postmarketos.org)
- add reset-gpios, necessary for some chips
- remove R-b from krzk due to changes in dt-bindings
---
Changes in v5:
- adopt dt-bindings format to suggestion (thanks krzk@kernel.org)
- remove pen-inserted functionality as suggested (thanks dmitry.torokhov@gmail.com)
---
Changes in v6:
- add info on difference between variants
- add A-b from conor
- add warning for out of range pressure
---
Hendrik Noack (2):
dt-bindings: Input: Add Wacom W9000-series penabled touchscreens
Input: Add support for Wacom W9000-series penabled touchscreens
.../input/touchscreen/wacom,w9007a-lt03.yaml | 73 +++
drivers/input/touchscreen/Kconfig | 12 +
drivers/input/touchscreen/Makefile | 1 +
drivers/input/touchscreen/wacom_w9000.c | 438 ++++++++++++++++++
4 files changed, 524 insertions(+)
create mode 100644 Documentation/devicetree/bindings/input/touchscreen/wacom,w9007a-lt03.yaml
create mode 100644 drivers/input/touchscreen/wacom_w9000.c
--
2.43.0
^ permalink raw reply
* Re: [PATCH] HID: pidff: Fix integer overflow in pidff_rescale
From: kernel test robot @ 2026-04-26 12:35 UTC (permalink / raw)
To: Tomasz Pakuła, jikos, bentiss
Cc: oe-kbuild-all, oleg, linux-input, linux-kernel,
tomasz.pakula.oficjalny
In-Reply-To: <20260421194941.1422722-1-tomasz.pakula.oficjalny@gmail.com>
Hi Tomasz,
kernel test robot noticed the following build errors:
[auto build test ERROR on hid/for-next]
[also build test ERROR on linus/master v7.0 next-20260424]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Tomasz-Paku-a/HID-pidff-Fix-integer-overflow-in-pidff_rescale/20260424-133424
base: https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git for-next
patch link: https://lore.kernel.org/r/20260421194941.1422722-1-tomasz.pakula.oficjalny%40gmail.com
patch subject: [PATCH] HID: pidff: Fix integer overflow in pidff_rescale
config: openrisc-allmodconfig (https://download.01.org/0day-ci/archive/20260426/202604262019.iRp09hay-lkp@intel.com/config)
compiler: or1k-linux-gcc (GCC) 15.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260426/202604262019.iRp09hay-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604262019.iRp09hay-lkp@intel.com/
All errors (new ones prefixed by >>, old ones prefixed by <<):
WARNING: modpost: drivers/net/ethernet/intel/ice/ice: section mismatch in reference: ice_adv_lnk_speed_maps+0x14 (section: .data) -> ice_adv_lnk_speed_100 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/intel/ice/ice: section mismatch in reference: ice_adv_lnk_speed_maps+0x30 (section: .data) -> ice_adv_lnk_speed_1000 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/intel/ice/ice: section mismatch in reference: ice_adv_lnk_speed_maps+0x4c (section: .data) -> ice_adv_lnk_speed_2500 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/intel/ice/ice: section mismatch in reference: ice_adv_lnk_speed_maps+0x68 (section: .data) -> ice_adv_lnk_speed_5000 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/intel/ice/ice: section mismatch in reference: ice_adv_lnk_speed_maps+0x84 (section: .data) -> ice_adv_lnk_speed_10000 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/intel/ice/ice: section mismatch in reference: ice_adv_lnk_speed_maps+0xa0 (section: .data) -> ice_adv_lnk_speed_25000 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/intel/ice/ice: section mismatch in reference: ice_adv_lnk_speed_maps+0xbc (section: .data) -> ice_adv_lnk_speed_40000 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/intel/ice/ice: section mismatch in reference: ice_adv_lnk_speed_maps+0xd8 (section: .data) -> ice_adv_lnk_speed_50000 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/intel/ice/ice: section mismatch in reference: ice_adv_lnk_speed_maps+0xf4 (section: .data) -> ice_adv_lnk_speed_100000 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/intel/ice/ice: section mismatch in reference: ice_adv_lnk_speed_maps+0x110 (section: .data) -> ice_adv_lnk_speed_200000 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_ext_maps+0x14 (section: .data) -> qed_mfw_ext_1g (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_ext_maps+0x30 (section: .data) -> qed_mfw_ext_10g (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_ext_maps+0x4c (section: .data) -> qed_mfw_ext_25g (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_ext_maps+0x68 (section: .data) -> qed_mfw_ext_40g (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_ext_maps+0x84 (section: .data) -> qed_mfw_ext_50g_base_r (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_ext_maps+0xa0 (section: .data) -> qed_mfw_ext_50g_base_r2 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_ext_maps+0xbc (section: .data) -> qed_mfw_ext_100g_base_r2 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_ext_maps+0xd8 (section: .data) -> qed_mfw_ext_100g_base_r4 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_legacy_maps+0x14 (section: .data) -> qed_mfw_legacy_1g (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_legacy_maps+0x30 (section: .data) -> qed_mfw_legacy_10g (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_legacy_maps+0x4c (section: .data) -> qed_mfw_legacy_20g (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_legacy_maps+0x68 (section: .data) -> qed_mfw_legacy_25g (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_legacy_maps+0x84 (section: .data) -> qed_mfw_legacy_40g (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_legacy_maps+0xa0 (section: .data) -> qed_mfw_legacy_50g (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qed/qed: section mismatch in reference: qed_mfw_legacy_maps+0xbc (section: .data) -> qed_mfw_legacy_bb_100g (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qede/qede: section mismatch in reference: qede_forced_speed_maps+0x14 (section: .data) -> qede_forced_speed_1000 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qede/qede: section mismatch in reference: qede_forced_speed_maps+0x30 (section: .data) -> qede_forced_speed_10000 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qede/qede: section mismatch in reference: qede_forced_speed_maps+0x4c (section: .data) -> qede_forced_speed_20000 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qede/qede: section mismatch in reference: qede_forced_speed_maps+0x68 (section: .data) -> qede_forced_speed_25000 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qede/qede: section mismatch in reference: qede_forced_speed_maps+0x84 (section: .data) -> qede_forced_speed_40000 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qede/qede: section mismatch in reference: qede_forced_speed_maps+0xa0 (section: .data) -> qede_forced_speed_50000 (section: .init.rodata)
WARNING: modpost: drivers/net/ethernet/qlogic/qede/qede: section mismatch in reference: qede_forced_speed_maps+0xbc (section: .data) -> qede_forced_speed_100000 (section: .init.rodata)
>> ERROR: modpost: "__divdi3" [drivers/hid/usbhid/usbhid.ko] undefined!
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH] HID: pidff: Fix integer overflow in pidff_rescale
From: Markus Elfring @ 2026-04-26 10:48 UTC (permalink / raw)
To: Tomasz Pakuła, linux-input, Benjamin Tissoires, Jiri Kosina
Cc: LKML, Oleg Makarenko
In-Reply-To: <20260421194941.1422722-1-tomasz.pakula.oficjalny@gmail.com>
> Rescaling values close to the max (U16_MAX) temporairly creates values
…
temporarily?
See also:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.0#n145
Regards,
Markus
^ permalink raw reply
* Re: [PATCH] HID: pidff: Fix integer overflow in pidff_rescale
From: kernel test robot @ 2026-04-26 5:31 UTC (permalink / raw)
To: Tomasz Pakuła, jikos, bentiss
Cc: oe-kbuild-all, oleg, linux-input, linux-kernel,
tomasz.pakula.oficjalny
In-Reply-To: <20260421194941.1422722-1-tomasz.pakula.oficjalny@gmail.com>
Hi Tomasz,
kernel test robot noticed the following build errors:
[auto build test ERROR on hid/for-next]
[also build test ERROR on linus/master v7.0 next-20260424]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Tomasz-Paku-a/HID-pidff-Fix-integer-overflow-in-pidff_rescale/20260424-133424
base: https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git for-next
patch link: https://lore.kernel.org/r/20260421194941.1422722-1-tomasz.pakula.oficjalny%40gmail.com
patch subject: [PATCH] HID: pidff: Fix integer overflow in pidff_rescale
config: microblaze-allyesconfig (https://download.01.org/0day-ci/archive/20260426/202604261334.MiQX0gtI-lkp@intel.com/config)
compiler: microblaze-linux-gcc (GCC) 15.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260426/202604261334.MiQX0gtI-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604261334.MiQX0gtI-lkp@intel.com/
All errors (new ones prefixed by >>):
microblaze-linux-ld: drivers/hid/usbhid/hid-pidff.o: in function `pidff_set':
>> hid-pidff.o:(.text+0x6f4): undefined reference to `__divdi3'
microblaze-linux-ld: drivers/hid/usbhid/hid-pidff.o: in function `pidff_set_signed':
hid-pidff.o:(.text+0xb0c): undefined reference to `__divdi3'
microblaze-linux-ld: drivers/hid/usbhid/hid-pidff.o: in function `pidff_set_envelope_report':
hid-pidff.o:(.text+0x2094): undefined reference to `__divdi3'
>> microblaze-linux-ld: hid-pidff.o:(.text+0x2104): undefined reference to `__divdi3'
microblaze-linux-ld: drivers/hid/usbhid/hid-pidff.o: in function `pidff_upload_effect':
hid-pidff.o:(.text+0x25c0): undefined reference to `__divdi3'
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH] Input: ims-pcu - bound frame parser write index against read_buf size
From: Dmitry Torokhov @ 2026-04-26 5:12 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-input, linux-kernel, stable
In-Reply-To: <2026042414-demeanor-dimple-83b0@gregkh>
On Fri, Apr 24, 2026 at 06:16:57AM +0200, Greg Kroah-Hartman wrote:
> On Thu, Apr 23, 2026 at 10:24:08AM -0700, Dmitry Torokhov wrote:
> > On Thu, Apr 23, 2026 at 06:52:23AM +0200, Greg Kroah-Hartman wrote:
> > > On Wed, Apr 22, 2026 at 06:36:24PM -0700, Dmitry Torokhov wrote:
> > > > Hi Greg,
> > > >
> > > > On Mon, Apr 20, 2026 at 09:05:31PM +0200, Greg Kroah-Hartman wrote:
> > > > > ims_pcu_process_data() implements a STX/DLE/ETX byte-stuffing parser
> > > > > that accumulates frame payload into pcu->read_buf[] using the running
> > > > > index pcu->read_pos. read_buf is IMS_PCU_BUF_SIZE (128) bytes and
> > > > > read_pos is u8 but of course, we don't check the index before actually
> > > > > writing the data :(
> > > > >
> > > > > Fix this up by properly rejecting the frame at the first attempt to
> > > > > write past read_buf and resync on the next STX, mirroring how the parser
> > > > > handles short and bad-checksum frames on ETX.
> > > > >
> > > > > Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> > > > > Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
> > > > > Cc: stable <stable@kernel.org>
> > > > > Assisted-by: gkh_clanker_t1000
> > > > > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > > >
> > > > I already have a patch for this, thanks.
> > >
> > > Ah, missed that, sorry, I was working against Linus's tree. I am
> > > guessing you are referring to commit 875115b82c29 ("Input: ims-pcu - fix
> > > heap-buffer-overflow in ims_pcu_process_data()")? If so, why wasn't
> > > that tagged for stable inclusion?
> >
> > I do not believe it is worth it. The driver is for specialized hardware,
> > so common distros will not be enabling it, and systems where it is used
> > likely do not allow plugging weird stuff into them and probably do not
> > use stable either.
>
> Android allows a lot of odd things to be plugged into it :(
Well, that's on them. Do they enable drivers blindly?
>
> > I actually wonder if we need to carry the driver or if we should simply
> > drop it. The only non-cleanup change to it was done in 2014.
>
> I'll gladly send a patch to delete it if you want me to.
Sure, let's do it. It's easy to restore it if it is actually needed.
Thanks.
--
Dmitry
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox