* Re: [PATCH] Input: ads7846 - don't use scratch for tx_buf when clearing register
From: Kris Bahnsen @ 2026-04-27 16:20 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Marek Vasut, stable, Mark Featherston, linux-input, linux-kernel
In-Reply-To: <ae2YWxew6M03MFfN@google.com>
On 4/25/26 9:51 PM, Dmitry Torokhov wrote:
> Hi Kris,
>
> On Fri, Apr 24, 2026 at 07:25:34PM +0000, Kris Bahnsen wrote:
>> The workaround for XPT2046 clears the command register, giving the
>> touchscreen controller a NOP. The change incorrectly re-uses the
>> req->scratch variable which is used as rx_buf for xfer[5], so by
>> the time xfer[6] occurs, the contents of req->scratch may not be
>> 0. It was found that the touchscreen controller can end up in
>> a completely unresponsive state due to it being given a command
>> the driver does not expect.
>>
>> Instead, rely on the spi_transfer behavior of tx_buf being NULL to
>> transmit all 0 bits, moving the 3 bytes to a single message.
>>
>> This change was tested on real TSC2046 and ADS7843 controllers,
>> but not the XPT2046 the workaround was originally created for.
>> Confirming that the original modification to clear the command
>> register does not impact either real controller.
>>
>> Fixes: 781a07da9bb94 ("Input: ads7846 - add dummy command register clearing cycle")
>> Cc: stable@vger.kernel.org
>> Co-developed-by: Mark Featherston <mark@embeddedTS.com>
>> Signed-off-by: Mark Featherston <mark@embeddedTS.com>
>> Signed-off-by: Kris Bahnsen <kris@embeddedTS.com>
>> ---
>> drivers/input/touchscreen/ads7846.c | 13 ++++---------
>> 1 file changed, 4 insertions(+), 9 deletions(-)
>>
>> diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
>> index 4b39f7212d35c..599793d27129e 100644
>> --- a/drivers/input/touchscreen/ads7846.c
>> +++ b/drivers/input/touchscreen/ads7846.c
>> @@ -327,7 +327,7 @@ struct ser_req {
>> u8 ref_off;
>> u16 scratch;
>> struct spi_message msg;
>> - struct spi_transfer xfer[8];
>> + struct spi_transfer xfer[7];
>> /*
>> * DMA (thus cache coherency maintenance) requires the
>> * transfer buffers to live in their own cache lines.
>> @@ -403,16 +403,11 @@ static int ads7846_read12_ser(struct device *dev, unsigned command)
>> spi_message_add_tail(&req->xfer[5], &req->msg);
>>
>> /* clear the command register */
>> - req->scratch = 0;
>> - req->xfer[6].tx_buf = &req->scratch;
>> - req->xfer[6].len = 1;
>> + req->xfer[6].rx_buf = &req->scratch;
>> + req->xfer[6].len = 3;
>
> Doesn't this overflow "scratch" which is only 2 bytes? I guess there is
> a hole in ser_req between "scratch" and "msg" but I do not think we
> should rely on this.
>
> Can we also set rx_buf to NULL to discard incoming data?
Well spotted! I'm quite annoyed with myself that I fixed one pointer
use bug to introduce a buffer overflow.
Will send a v2 patch later today.
> [credit to sashiko].
>
> Thanks.
>
--
Kris Bahnsen
Software Engineer
embeddedTS
^ permalink raw reply
* [PATCH v2] Input: ads7846 - don't use scratch for tx_buf when clearing register
From: Kris Bahnsen @ 2026-04-27 17:46 UTC (permalink / raw)
To: Dmitry Torokhov, Marek Vasut
Cc: Kris Bahnsen, stable, Mark Featherston, linux-input, linux-kernel
The workaround for XPT2046 clears the command register, giving the
touchscreen controller a NOP. The change incorrectly re-uses the
req->scratch variable which is used as rx_buf for xfer[5], so by
the time xfer[6] occurs, the contents of req->scratch may not be
0. It was found that the touchscreen controller can end up in
a completely unresponsive state due to it being given a command
the driver does not expect.
Instead, rely on the spi_transfer behavior of tx_buf being NULL to
transmit all 0 bits. Also set rx_buf to NULL because the value
returned does not matter. Thus moving the 3 byte pattern to clear
the command register to a single message.
This change was tested on real TSC2046 and ADS7843 controllers,
but not the XPT2046 the workaround was originally created for.
Confirming that the original modification to clear the command
register does not impact either real controller.
Fixes: 781a07da9bb94 ("Input: ads7846 - add dummy command register clearing cycle")
Cc: stable@vger.kernel.org
Co-developed-by: Mark Featherston <mark@embeddedTS.com>
Signed-off-by: Mark Featherston <mark@embeddedTS.com>
Signed-off-by: Kris Bahnsen <kris@embeddedTS.com>
---
V1 -> V2: Don't use rx_buf when clearing command reg
drivers/input/touchscreen/ads7846.c | 12 +++---------
1 file changed, 3 insertions(+), 9 deletions(-)
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 4b39f7212d35c..93edd2419db5b 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -327,7 +327,7 @@ struct ser_req {
u8 ref_off;
u16 scratch;
struct spi_message msg;
- struct spi_transfer xfer[8];
+ struct spi_transfer xfer[7];
/*
* DMA (thus cache coherency maintenance) requires the
* transfer buffers to live in their own cache lines.
@@ -403,16 +403,10 @@ static int ads7846_read12_ser(struct device *dev, unsigned command)
spi_message_add_tail(&req->xfer[5], &req->msg);
/* clear the command register */
- req->scratch = 0;
- req->xfer[6].tx_buf = &req->scratch;
- req->xfer[6].len = 1;
+ req->xfer[6].len = 3;
+ CS_CHANGE(req->xfer[6]);
spi_message_add_tail(&req->xfer[6], &req->msg);
- req->xfer[7].rx_buf = &req->scratch;
- req->xfer[7].len = 2;
- CS_CHANGE(req->xfer[7]);
- spi_message_add_tail(&req->xfer[7], &req->msg);
-
scoped_guard(mutex, &ts->lock) {
ads7846_stop(ts);
status = spi_sync(spi, &req->msg);
base-commit: dd6c438c3e64a5ff0b5d7e78f7f9be547803ef1b
--
2.34.1
^ permalink raw reply related
* [dtor-input:for-linus] BUILD SUCCESS 6cdc46b38cf146ce81d4831b6472dbf7731849a2
From: kernel test robot @ 2026-04-27 18:16 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git for-linus
branch HEAD: 6cdc46b38cf146ce81d4831b6472dbf7731849a2 Input: xpad - fix out-of-bounds access for Share button
elapsed time: 812m
configs tested: 188
configs skipped: 2
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-15.2.0
alpha allyesconfig gcc-15.2.0
alpha defconfig gcc-15.2.0
arc allmodconfig gcc-15.2.0
arc allnoconfig gcc-15.2.0
arc allyesconfig gcc-15.2.0
arc defconfig gcc-15.2.0
arc randconfig-001-20260428 gcc-9.5.0
arc randconfig-002-20260428 gcc-14.3.0
arm allnoconfig clang-23
arm allyesconfig gcc-15.2.0
arm randconfig-001-20260428 gcc-7.5.0
arm randconfig-002-20260428 clang-23
arm randconfig-003-20260428 gcc-7.5.0
arm randconfig-004-20260428 gcc-15.2.0
arm64 allmodconfig clang-19
arm64 allnoconfig gcc-15.2.0
arm64 randconfig-001 gcc-8.5.0
arm64 randconfig-001-20260427 clang-23
arm64 randconfig-002 gcc-14.3.0
arm64 randconfig-002-20260427 clang-23
arm64 randconfig-003 clang-23
arm64 randconfig-003-20260427 clang-23
arm64 randconfig-004 clang-23
arm64 randconfig-004-20260427 clang-23
csky allmodconfig gcc-15.2.0
csky allnoconfig gcc-15.2.0
csky defconfig gcc-15.2.0
csky randconfig-001 gcc-10.5.0
csky randconfig-001-20260427 gcc-12.5.0
csky randconfig-002 gcc-10.5.0
csky randconfig-002-20260427 gcc-15.2.0
hexagon allmodconfig clang-17
hexagon allnoconfig clang-23
hexagon defconfig clang-23
hexagon randconfig-001-20260427 clang-23
hexagon randconfig-002-20260427 clang-23
i386 allmodconfig gcc-14
i386 allnoconfig gcc-14
i386 allyesconfig gcc-14
i386 buildonly-randconfig-001-20260428 gcc-14
i386 buildonly-randconfig-002-20260428 clang-23
i386 buildonly-randconfig-003-20260428 gcc-14
i386 buildonly-randconfig-004-20260428 gcc-14
i386 buildonly-randconfig-005-20260428 gcc-14
i386 buildonly-randconfig-006-20260428 gcc-12
i386 randconfig-001 clang-23
i386 randconfig-001-20260427 gcc-14
i386 randconfig-002 gcc-14
i386 randconfig-002-20260427 clang-23
i386 randconfig-003 gcc-14
i386 randconfig-003-20260427 gcc-13
i386 randconfig-004 clang-23
i386 randconfig-004-20260427 clang-23
i386 randconfig-005 gcc-14
i386 randconfig-005-20260427 clang-23
i386 randconfig-006 gcc-14
i386 randconfig-006-20260427 gcc-14
i386 randconfig-007 gcc-14
i386 randconfig-007-20260427 clang-23
i386 randconfig-011-20260427 gcc-14
i386 randconfig-012-20260427 gcc-14
i386 randconfig-013-20260427 clang-23
i386 randconfig-014-20260427 gcc-14
i386 randconfig-015-20260427 clang-23
i386 randconfig-016-20260427 gcc-14
i386 randconfig-017-20260427 clang-23
loongarch allmodconfig clang-19
loongarch allnoconfig clang-23
loongarch defconfig clang-23
loongarch randconfig-001-20260427 clang-23
loongarch randconfig-002-20260427 gcc-15.2.0
m68k allmodconfig gcc-15.2.0
m68k allnoconfig gcc-15.2.0
m68k allyesconfig gcc-15.2.0
m68k defconfig gcc-15.2.0
microblaze allnoconfig gcc-15.2.0
microblaze allyesconfig gcc-15.2.0
microblaze defconfig gcc-15.2.0
mips allmodconfig gcc-15.2.0
mips allnoconfig gcc-15.2.0
mips allyesconfig gcc-15.2.0
nios2 allmodconfig gcc-11.5.0
nios2 allnoconfig gcc-11.5.0
nios2 defconfig gcc-11.5.0
nios2 randconfig-001-20260427 gcc-6.5.0
nios2 randconfig-002-20260427 gcc-11.5.0
openrisc allmodconfig gcc-15.2.0
openrisc allnoconfig gcc-15.2.0
openrisc defconfig gcc-15.2.0
parisc allmodconfig gcc-15.2.0
parisc allnoconfig gcc-15.2.0
parisc allyesconfig gcc-15.2.0
parisc defconfig gcc-15.2.0
parisc randconfig-001 gcc-13.4.0
parisc randconfig-001-20260427 gcc-5.5.0
parisc randconfig-002 gcc-6.5.0
parisc randconfig-002-20260427 gcc-5.5.0
parisc64 defconfig gcc-15.2.0
powerpc allmodconfig gcc-15.2.0
powerpc allnoconfig gcc-15.2.0
powerpc randconfig-001 gcc-13.4.0
powerpc randconfig-001-20260427 clang-23
powerpc randconfig-002 gcc-10.5.0
powerpc randconfig-002-20260427 clang-23
powerpc64 randconfig-001 clang-23
powerpc64 randconfig-001-20260427 clang-23
powerpc64 randconfig-002 clang-23
powerpc64 randconfig-002-20260427 clang-23
riscv allmodconfig clang-23
riscv allnoconfig gcc-15.2.0
riscv allyesconfig clang-23
riscv defconfig clang-23
riscv randconfig-001-20260427 gcc-12.5.0
riscv randconfig-002-20260427 gcc-14.3.0
s390 allmodconfig clang-23
s390 allnoconfig clang-23
s390 allyesconfig gcc-15.2.0
s390 defconfig clang-23
s390 randconfig-001-20260427 clang-23
s390 randconfig-002-20260427 clang-23
sh allmodconfig gcc-15.2.0
sh allnoconfig gcc-15.2.0
sh allyesconfig gcc-15.2.0
sh defconfig gcc-15.2.0
sh randconfig-001-20260427 gcc-7.5.0
sh randconfig-002-20260427 gcc-15.2.0
sparc allnoconfig gcc-15.2.0
sparc defconfig gcc-15.2.0
sparc randconfig-001 gcc-6.5.0
sparc randconfig-001-20260427 gcc-6.5.0
sparc randconfig-002 gcc-15.2.0
sparc randconfig-002-20260427 gcc-8.5.0
sparc64 allmodconfig clang-23
sparc64 randconfig-001 gcc-8.5.0
sparc64 randconfig-001-20260427 gcc-7.5.0
sparc64 randconfig-002 clang-23
sparc64 randconfig-002-20260427 gcc-13.4.0
um allmodconfig clang-19
um allmodconfig clang-23
um allnoconfig clang-23
um allyesconfig gcc-14
um defconfig clang-23
um i386_defconfig gcc-14
um randconfig-001 clang-23
um randconfig-001-20260427 gcc-14
um randconfig-002 clang-23
um randconfig-002-20260427 gcc-14
x86_64 allmodconfig clang-23
x86_64 allnoconfig clang-20
x86_64 allyesconfig clang-23
x86_64 buildonly-randconfig-001 gcc-12
x86_64 buildonly-randconfig-001-20260427 clang-23
x86_64 buildonly-randconfig-002 clang-23
x86_64 buildonly-randconfig-002-20260427 clang-23
x86_64 buildonly-randconfig-003 gcc-14
x86_64 buildonly-randconfig-003-20260427 gcc-14
x86_64 buildonly-randconfig-004 gcc-14
x86_64 buildonly-randconfig-004-20260427 clang-23
x86_64 buildonly-randconfig-005 gcc-14
x86_64 buildonly-randconfig-005-20260427 clang-23
x86_64 buildonly-randconfig-006 clang-23
x86_64 buildonly-randconfig-006-20260427 clang-23
x86_64 randconfig-001-20260427 clang-23
x86_64 randconfig-002-20260427 clang-23
x86_64 randconfig-003-20260427 gcc-14
x86_64 randconfig-004-20260427 clang-23
x86_64 randconfig-005-20260427 clang-23
x86_64 randconfig-006-20260427 clang-23
x86_64 randconfig-011-20260428 gcc-14
x86_64 randconfig-012-20260428 gcc-14
x86_64 randconfig-013-20260428 gcc-14
x86_64 randconfig-014-20260428 gcc-14
x86_64 randconfig-015-20260428 clang-23
x86_64 randconfig-016-20260428 clang-23
x86_64 randconfig-071-20260427 gcc-14
x86_64 randconfig-072-20260427 clang-23
x86_64 randconfig-073-20260427 clang-23
x86_64 randconfig-074-20260427 gcc-14
x86_64 randconfig-075-20260427 clang-23
x86_64 randconfig-076-20260427 gcc-14
x86_64 rhel-9.4-rust clang-23
xtensa allnoconfig gcc-15.2.0
xtensa allyesconfig gcc-15.2.0
xtensa randconfig-001 gcc-7.5.0
xtensa randconfig-001-20260427 gcc-10.5.0
xtensa randconfig-002 gcc-15.2.0
xtensa randconfig-002-20260427 gcc-14.3.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH v2 1/7] iio: HID: Add helper method hid_sensor_adjust_channel_bit_mask()
From: srinivas pandruvada @ 2026-04-27 18:26 UTC (permalink / raw)
To: Jonathan Cameron, Natália Salvino André
Cc: andy, bentiss, dlechner, jikos, nuno.sa,
Pietro Di Consolo Gregorio, linux-iio, linux-input
In-Reply-To: <20260424202337.530d5aad@jic23-huawei>
On Fri, 2026-04-24 at 20:23 +0100, Jonathan Cameron wrote:
> On Tue, 21 Apr 2026 19:20:33 -0300
> Natália Salvino André <natalia.andre@ime.usp.br> wrote:
>
> > Add helper method to deduplicate code in HID sensors.
> >
> > Signed-off-by: Natália Salvino André <natalia.andre@ime.usp.br>
> > Co-developed-by: Pietro Di Consolo Gregorio
> > <pietro.gregorio@usp.br>
> > Signed-off-by: Pietro Di Consolo Gregorio <pietro.gregorio@usp.br>
> > ---
> > .../iio/common/hid-sensors/hid-sensor-attributes.c | 12
> > ++++++++++++
> > include/linux/hid-sensor-hub.h | 3 +++
> > 2 files changed, 15 insertions(+)
> >
> > diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > index c115a72832b2..3ee6e83c6cac 100644
> > --- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > +++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
> > @@ -3,6 +3,7 @@
> > * HID Sensors Driver
> > * Copyright (c) 2012, Intel Corporation.
> > */
> > +#include <linux/bits.h>
> > #include <linux/module.h>
> > #include <linux/kernel.h>
> > #include <linux/time.h>
> > @@ -589,6 +590,17 @@ int hid_sensor_parse_common_attributes(struct
> > hid_sensor_hub_device *hsdev,
> > }
> > EXPORT_SYMBOL_NS(hid_sensor_parse_common_attributes, "IIO_HID");
> >
> > +void hid_sensor_adjust_channel_bit_mask(struct iio_chan_spec
> > *channels,
> > + int channel, int size)
> > +{
> > + channels[channel].scan_type.format = 's';
> > + /* Real storage bits will change based on the report desc.
> > */
> > + channels[channel].scan_type.realbits = size *
> > BITS_PER_BYTE;
> > + /* Maximum size of a sample to capture is u32 */
> > + channels[channel].scan_type.storagebits = sizeof(u32) *
> > BITS_PER_BYTE;
> > +}
> > +EXPORT_SYMBOL_NS(hid_sensor_adjust_channel_bit_mask, "IIO_HID");
> > +
> Looking at this again:
>
> This feels like a helper that doesn't necessarily add much value.
I think so.
>
> channels[CHANNEL_SCAN_INDEX_X + i].scan_type =
> (struct iio_scan_type) {
> .format = 's',
> .real_bits = BYTES_TO_BITS(st-
> >accel[CHANNEL_SCAN_INDEX_X + i].size),
> .storage_bits = BITS_PER_TYPE(u32),
> };
>
> Maybe with local variables to help a touch. such as
> unsigned int ch = CHANNEL_SCAN_INDEX_X + i];
>
> channels[ch].scan_type = (struct iio_scan_type) {
> .format = 's',
> .real_bits = BYTES_TO_BITS(st-
> >accel[ch].size),
> .storage_bits = BITS_PER_TYPE(u32),
> };
> Whilst it technically sets other parts of scan_type to 0, they are 0
> anyway
> so that's harmless given readability improvements.
>
> There is another two uses for ch just above as well so makes this
> even easier to
> argue in favour of as a change as it'll be (this is effectively
> replacing patch 2)
>
> for (unsigned int i = 0; i <= CHANNEL_SCAN_INDEX_Z; ++i) {
> unsigned int ch = CHANNEL_SCAN_INDEX_X + i;
>
> ret = sensor_hub_input_get_attribute_info(hsdev,
> HID_INPUT_REPORT,
> usage_id, ch,
> &st->accel[ch]);
>
> if (ret < 0)
> break;
> channels[ch].scan_type = (struct iio_scan_type) {
> .format = 's',
> .real_bits = BYTES_TO_BITS(st-
> >accel[ch].size),
> .storage_bits = BITS_PER_TYPE(u32),
> };
> }
>
> Hmm. That's also an odd loop as the use assumes CHANNEL_SCAN_INDEX_X
> = 0
> (which is true) but then uses an offset that implies it isn't.
> Clearer to
> just loop over the actual enum values.
>
> So probably wants to be something like.
>
> for (unsigned int ch = CHANNEL_SCAN_INDEX_X;
> i <= CHANNEL_SCAN_INDEX_Z; ch++) { //maybe on a long
> single line.
> ret = sensor_hub_input_get_attribute_info(hsdev,
>
> HID_INPUT_REPORT,
> usage_id,
> ch,
> &st-
> >accel[ch]);
> if (ret < 0)
> break;
>
> channels[ch].scan_type = (struct iio_scan_type) {
> .format = 's',
> .real_bits = BYTES_TO_BITS(st-
> >accel[ch].size),
> .storage_bits = BITS_PER_TYPE(u32),
> };
> }
>
>
This change is better than adding another export function.
Thanks,
Srinivas
>
> > MODULE_AUTHOR("Srinivas Pandruvada
> > <srinivas.pandruvada@intel.com>");
> > MODULE_DESCRIPTION("HID Sensor common attribute processing");
> > MODULE_LICENSE("GPL");
> > diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-
> > sensor-hub.h
> > index e71056553108..6523d46c63e0 100644
> > --- a/include/linux/hid-sensor-hub.h
> > +++ b/include/linux/hid-sensor-hub.h
> > @@ -281,4 +281,7 @@ bool hid_sensor_batch_mode_supported(struct
> > hid_sensor_common *st);
> > int hid_sensor_set_report_latency(struct hid_sensor_common *st,
> > int latency);
> > int hid_sensor_get_report_latency(struct hid_sensor_common *st);
> >
> > +void hid_sensor_adjust_channel_bit_mask(struct iio_chan_spec
> > *channels,
> > + int channel, int size);
> > +
> > #endif
^ permalink raw reply
* [PATCH 1/2] Input: rmi4 - refactor register descriptor parsing
From: Dmitry Torokhov @ 2026-04-28 1:09 UTC (permalink / raw)
To: linux-input; +Cc: Marge Yang, Greg Kroah-Hartman, linux-kernel, stable
Factor out parsing a register descriptor item from
rmi_read_register_desc() and ensure there are no out-of-bounds accesses.
Use get_unaligned_le16() and get_unaligned_le32() for reading multi-byte
values.
Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/input/rmi4/rmi_driver.c | 119 ++++++++++++++++++++------------
1 file changed, 73 insertions(+), 46 deletions(-)
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index ccd9338a44db..9871e9b816dc 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -22,6 +22,7 @@
#include <uapi/linux/input.h>
#include <linux/rmi.h>
#include <linux/export.h>
+#include <linux/unaligned.h>
#include "rmi_bus.h"
#include "rmi_driver.h"
@@ -558,30 +559,74 @@ int rmi_scan_pdt(struct rmi_device *rmi_dev, void *ctx,
return retval < 0 ? retval : 0;
}
+static int rmi_parse_register_desc_item(struct rmi_register_desc_item *item,
+ const u8 *buf, size_t size)
+{
+ int offset = 0;
+ int map_offset = 0;
+ int b;
+
+ if (offset >= size)
+ return -EIO;
+
+ item->reg_size = buf[offset++];
+ if (item->reg_size == 0) {
+ if (size - offset < 2)
+ return -EIO;
+ item->reg_size = get_unaligned_le16(&buf[offset]);
+ offset += 2;
+ }
+
+ if (item->reg_size == 0) {
+ if (size - offset < 4)
+ return -EIO;
+ item->reg_size = get_unaligned_le32(&buf[offset]);
+ offset += 4;
+ }
+
+ do {
+ if (offset >= size)
+ return -EIO;
+
+ for (b = 0; b < 7; b++) {
+ if (buf[offset] & BIT(b)) {
+ if (map_offset >= RMI_REG_DESC_SUBPACKET_BITS)
+ return -EIO;
+ bitmap_set(item->subpacket_map, map_offset, 1);
+ }
+ ++map_offset;
+ }
+ } while (buf[offset++] & 0x80);
+
+ item->num_subpackets = bitmap_weight(item->subpacket_map,
+ RMI_REG_DESC_SUBPACKET_BITS);
+
+ return offset;
+}
+
int rmi_read_register_desc(struct rmi_device *d, u16 addr,
- struct rmi_register_descriptor *rdesc)
+ struct rmi_register_descriptor *rdesc)
{
int ret;
u8 size_presence_reg;
u8 buf[35];
- int presense_offset = 1;
- u8 *struct_buf;
+ int presence_offset;
int reg;
int offset = 0;
- int map_offset = 0;
+ int map_offset;
int i;
int b;
/*
* The first register of the register descriptor is the size of
- * the register descriptor's presense register.
+ * the register descriptor's presence register.
*/
ret = rmi_read(d, addr, &size_presence_reg);
if (ret)
return ret;
++addr;
- if (size_presence_reg < 0 || size_presence_reg > 35)
+ if (size_presence_reg < 1 || size_presence_reg > 35)
return -EIO;
memset(buf, 0, sizeof(buf));
@@ -597,16 +642,23 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
++addr;
if (buf[0] == 0) {
- presense_offset = 3;
- rdesc->struct_size = buf[1] | (buf[2] << 8);
+ if (size_presence_reg < 3)
+ return -EIO;
+ presence_offset = 3;
+ rdesc->struct_size = get_unaligned_le16(&buf[1]);
} else {
+ presence_offset = 1;
rdesc->struct_size = buf[0];
}
- for (i = presense_offset; i < size_presence_reg; i++) {
+ map_offset = 0;
+ for (i = presence_offset; i < size_presence_reg; i++) {
for (b = 0; b < 8; b++) {
- if (buf[i] & (0x1 << b))
+ if (buf[i] & BIT(b)) {
+ if (map_offset >= RMI_REG_DESC_PRESENSE_BITS)
+ return -EIO;
bitmap_set(rdesc->presense_map, map_offset, 1);
+ }
++map_offset;
}
}
@@ -626,7 +678,7 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
* I'm not using devm_kzalloc here since it will not be retained
* after exiting this function
*/
- struct_buf = kzalloc(rdesc->struct_size, GFP_KERNEL);
+ u8 *struct_buf __free(kfree) = kzalloc(rdesc->struct_size, GFP_KERNEL);
if (!struct_buf)
return -ENOMEM;
@@ -638,56 +690,31 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
*/
ret = rmi_read_block(d, addr, struct_buf, rdesc->struct_size);
if (ret)
- goto free_struct_buff;
+ return ret;
reg = find_first_bit(rdesc->presense_map, RMI_REG_DESC_PRESENSE_BITS);
for (i = 0; i < rdesc->num_registers; i++) {
struct rmi_register_desc_item *item = &rdesc->registers[i];
- int reg_size = struct_buf[offset];
+ int item_size;
- ++offset;
- if (reg_size == 0) {
- reg_size = struct_buf[offset] |
- (struct_buf[offset + 1] << 8);
- offset += 2;
- }
-
- if (reg_size == 0) {
- reg_size = struct_buf[offset] |
- (struct_buf[offset + 1] << 8) |
- (struct_buf[offset + 2] << 16) |
- (struct_buf[offset + 3] << 24);
- offset += 4;
- }
+ item_size = rmi_parse_register_desc_item(item,
+ &struct_buf[offset],
+ rdesc->struct_size - offset);
+ if (item_size < 0)
+ return item_size;
item->reg = reg;
- item->reg_size = reg_size;
-
- map_offset = 0;
-
- do {
- for (b = 0; b < 7; b++) {
- if (struct_buf[offset] & (0x1 << b))
- bitmap_set(item->subpacket_map,
- map_offset, 1);
- ++map_offset;
- }
- } while (struct_buf[offset++] & 0x80);
-
- item->num_subpackets = bitmap_weight(item->subpacket_map,
- RMI_REG_DESC_SUBPACKET_BITS);
+ offset += item_size;
rmi_dbg(RMI_DEBUG_CORE, &d->dev,
"%s: reg: %d reg size: %ld subpackets: %d\n", __func__,
item->reg, item->reg_size, item->num_subpackets);
reg = find_next_bit(rdesc->presense_map,
- RMI_REG_DESC_PRESENSE_BITS, reg + 1);
+ RMI_REG_DESC_PRESENSE_BITS, reg + 1);
}
-free_struct_buff:
- kfree(struct_buf);
- return ret;
+ return 0;
}
const struct rmi_register_desc_item *rmi_get_register_desc_item(
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH 2/2] Input: rmi4 - fix num_subpackets overflow in register descriptor
From: Dmitry Torokhov @ 2026-04-28 1:09 UTC (permalink / raw)
To: linux-input; +Cc: Marge Yang, Greg Kroah-Hartman, linux-kernel, stable
In-Reply-To: <20260428010917.1320927-1-dmitry.torokhov@gmail.com>
RMI_REG_DESC_SUBPACKET_BITS is defined as 296 (37 * BITS_PER_BYTE). This
may overflow num_subpackets in struct rmi_register_desc_item which is
defined as a u8.
Fix this by changing the type of num_subpackets to u16.
Pack the structure by rearranging the members to avoid holes, change
reg_size from unsigned long to u32 to save space and ensure consistent
size across 32-bit and 64-bit architectures, and use DECLARE_BITMAP()
for subpacket_map.
Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/input/rmi4/rmi_driver.h | 8 ++++----
drivers/input/rmi4/rmi_f12.c | 2 +-
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/input/rmi4/rmi_driver.h b/drivers/input/rmi4/rmi_driver.h
index e84495caab15..865ffc7882f3 100644
--- a/drivers/input/rmi4/rmi_driver.h
+++ b/drivers/input/rmi4/rmi_driver.h
@@ -11,6 +11,7 @@
#include <linux/hrtimer.h>
#include <linux/ktime.h>
#include <linux/input.h>
+#include <linux/types.h>
#include "rmi_bus.h"
#define SYNAPTICS_INPUT_DEVICE_NAME "Synaptics RMI4 Touch Sensor"
@@ -52,10 +53,9 @@ struct pdt_entry {
/* describes a single packet register */
struct rmi_register_desc_item {
u16 reg;
- unsigned long reg_size;
- u8 num_subpackets;
- unsigned long subpacket_map[BITS_TO_LONGS(
- RMI_REG_DESC_SUBPACKET_BITS)];
+ u16 num_subpackets;
+ u32 reg_size;
+ DECLARE_BITMAP(subpacket_map, RMI_REG_DESC_SUBPACKET_BITS);
};
/*
diff --git a/drivers/input/rmi4/rmi_f12.c b/drivers/input/rmi4/rmi_f12.c
index 8246fe77114b..9bcc27e9d308 100644
--- a/drivers/input/rmi4/rmi_f12.c
+++ b/drivers/input/rmi4/rmi_f12.c
@@ -88,7 +88,7 @@ static int rmi_f12_read_sensor_tuning(struct f12_data *f12)
if (item->reg_size > sizeof(buf)) {
dev_err(&fn->dev,
- "F12 control8 should be no bigger than %zd bytes, not: %ld\n",
+ "F12 control8 should be no bigger than %zd bytes, not: %d\n",
sizeof(buf), item->reg_size);
return -ENODEV;
}
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH] hwmon: prevent packets from going to driver for probe
From: Edward Adam Davis @ 2026-04-28 4:12 UTC (permalink / raw)
To: syzbot+9eebf5f6544c5e873858
Cc: bentiss, jikos, linux-input, linux-kernel, linux-usb,
syzkaller-bugs
In-Reply-To: <69eed7e0.a00a0220.7773.0026.GAE@google.com>
A race condition exists between hid_input_report() and the point
immediately following the execution of hid_device_io_start() within
corsairpsu_probe(). If the probe operation fails after "io start" has
been initiated, this race condition will result in a uaf vulnerability
[1].
CPU0 CPU1
==== ====
corsairpsu_probe()
hid_device_io_start()
... unlock driver_input_lock
hid_hw_stop()
kfree(hidraw) __hid_input_report()
... acquire driver_input_lock
hid_report_raw_event()
hidraw_report_event()
... access hidraw's list_lock // trigger uaf
Consequently, when corsairpsu_probe() fails and hid_hw_stop() needs to
be executed, the io_started flag is first cleared while holding the
driver_input_lock to prevent potential race conditions involving input
reports.
[1]
BUG: KASAN: slab-use-after-free in rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
Call Trace:
hidraw_report_event+0x5d/0x3a0 drivers/hid/hidraw.c:577
hid_report_raw_event+0x311/0x1730 drivers/hid/hid-core.c:2076
__hid_input_report drivers/hid/hid-core.c:2152 [inline]
hid_input_report+0x44e/0x580 drivers/hid/hid-core.c:2174
hid_irq_in+0x47e/0x6d0 drivers/hid/usbhid/hid-core.c:286
__usb_hcd_giveback_urb+0x3b3/0x5e0 drivers/usb/core/hcd.c:1657
dummy_timer+0x8a9/0x47d0 drivers/usb/gadget/udc/dummy_hcd.c:2005
Allocated by task 10:
hidraw_connect+0x57/0x430 drivers/hid/hidraw.c:606
hid_connect+0x5bf/0x19d0 drivers/hid/hid-core.c:2277
hid_hw_start+0xa8/0x120 drivers/hid/hid-core.c:2387
corsairpsu_probe+0xd9/0x3c0 drivers/hwmon/corsair-psu.c:782
Freed by task 10:
hidraw_disconnect+0x4f/0x60 drivers/hid/hidraw.c:662
hid_disconnect drivers/hid/hid-core.c:2362 [inline]
hid_hw_stop+0x101/0x1e0 drivers/hid/hid-core.c:2407
corsairpsu_probe+0x327/0x3c0 drivers/hwmon/corsair-psu.c:826
Fixes: d115b51e0e56 ("hwmon: add Corsair PSU HID controller driver")
Reported-by: syzbot+9eebf5f6544c5e873858@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9eebf5f6544c5e873858
Tested-by: syzbot+9eebf5f6544c5e873858@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
drivers/hwmon/corsair-psu.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hwmon/corsair-psu.c b/drivers/hwmon/corsair-psu.c
index dddbd2463f8d..4e766bf32189 100644
--- a/drivers/hwmon/corsair-psu.c
+++ b/drivers/hwmon/corsair-psu.c
@@ -823,6 +823,7 @@ static int corsairpsu_probe(struct hid_device *hdev, const struct hid_device_id
fail_and_close:
hid_hw_close(hdev);
fail_and_stop:
+ hid_device_io_stop(hdev);
hid_hw_stop(hdev);
return ret;
}
--
2.43.0
^ permalink raw reply related
* Re: [PATCH] [v2] input: gpio-keys: make legacy gpiolib optional
From: Dmitry Torokhov @ 2026-04-28 4:14 UTC (permalink / raw)
To: Arnd Bergmann
Cc: Matti Vaittinen, Lee Jones, Arnd Bergmann, Gatien Chevallier,
Marco Crivellari, Fabrice Gasnier, Andreas Kemnade,
Krzysztof Kozlowski, Charles Keepax, Christophe JAILLET,
linux-input, linux-kernel
In-Reply-To: <20260427143406.3020992-1-arnd@kernel.org>
On Mon, Apr 27, 2026 at 04:33:49PM +0200, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@arndb.de>
>
> Most users of gpio-keys and gpio-keys-polled use modern gpiolib
> interfaces, but there are still number of ancient sh, arm32 and x86
> machines that have never been converted.
>
> Add an #ifdef block for the parts of the driver that are only used on
> those legacy machines.
>
> The two Rohm PMIC drivers use a gpio-keys device without an actual GPIO,
> passing an IRQ number instead. In order to keep this working both with
> and with CONFIG_GPIOLIB_LEGACY, change the gpio-keys driver to ignore
> the gpio number if an IRQ is passed.
>
> Link: https://lore.kernel.org/all/b3c94552-c104-42e3-be15-7e8362e8039e@gmail.com/
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
> v2: skip the fake GPIO number passing from mfd
> ---
> drivers/input/keyboard/gpio_keys.c | 7 ++++---
> drivers/input/keyboard/gpio_keys_polled.c | 2 ++
> drivers/mfd/rohm-bd71828.c | 1 -
> drivers/mfd/rohm-bd718x7.c | 1 -
Let's see if my patches to rohm drivers will get accepted and then maybe
we can remove legacy gpio API from gpio-keys altogether.
Thanks.
--
Dmitry
^ permalink raw reply
* [bug report] Potential order bug in 'drivers/input/misc', particularly 'ati_remote2.c', 'cm109.c', 'keyspan_remote.c'
From: Ginger @ 2026-04-28 4:18 UTC (permalink / raw)
To: dmitry.torokhov; +Cc: linux-input
Dear Linux kernel maintainers,
My research-based static analyzer found a potential order bug within
the ' drivers/input/misc' subsystem. I will use the potential bug
found in 'drivers/input/misc/ati_remote2.c' as the typical example.
The similar potential bug patterns are also observed in 'cm109.c' and
'keyspan_remote.c'.
Kernel version: long-term kernel v6.18.9
Potential issue:
T0:
ati_remote2_disconnect
--> ar2 = usb_get_intfdata(interface);
--> usb_set_intfdata(interface, NULL);
--> input_unregister_device(ar2->idev);
--> usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]);
--> kfree(ar2)
T1:
ati_remote2_store_channel_mask (registered as the device attribute
function and exposed via the sysfs)
--> struct ati_remote2 *ar2 = usb_get_intfdata(intf);
--> ar2->mode_mask = mask;
In T0, the interface is nullified before its get deregistered. Thus,
it is possible for T1 to still get the usb dev and access it via the
interface, which, however, has been already nullified or even freed.
This similar pattern is also observed in 'cm109_usb_disconnect()' of
file 'cm109.c' and 'keyspan_disconnect()' of file 'keyspan_remote.c'.
Thank you for your time and consideration.
Sincerely,
Ginger
^ permalink raw reply
* Re: [PATCH] [v2] input: gpio-keys: make legacy gpiolib optional
From: Arnd Bergmann @ 2026-04-28 6:12 UTC (permalink / raw)
To: Dmitry Torokhov, Arnd Bergmann
Cc: Matti Vaittinen, Lee Jones, Gatien Chevallier, Marco Crivellari,
Fabrice GASNIER, Andreas Kemnade, Krzysztof Kozlowski,
Charles Keepax, Christophe JAILLET, linux-input, linux-kernel
In-Reply-To: <afAz-UQY0aCaThV3@google.com>
On Tue, Apr 28, 2026, at 06:14, Dmitry Torokhov wrote:
> On Mon, Apr 27, 2026 at 04:33:49PM +0200, Arnd Bergmann wrote:
>>
>> The two Rohm PMIC drivers use a gpio-keys device without an actual GPIO,
>> passing an IRQ number instead. In order to keep this working both with
>> and with CONFIG_GPIOLIB_LEGACY, change the gpio-keys driver to ignore
>> the gpio number if an IRQ is passed.
>>
>> Link: https://lore.kernel.org/all/b3c94552-c104-42e3-be15-7e8362e8039e@gmail.com/
>> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
>> ---
>> v2: skip the fake GPIO number passing from mfd
>> ---
>> drivers/input/keyboard/gpio_keys.c | 7 ++++---
>> drivers/input/keyboard/gpio_keys_polled.c | 2 ++
>> drivers/mfd/rohm-bd71828.c | 1 -
>> drivers/mfd/rohm-bd718x7.c | 1 -
>
> Let's see if my patches to rohm drivers will get accepted and then maybe
> we can remove legacy gpio API from gpio-keys altogether.
I think it would be good to still merge the drivers/input
parts of my patch. Since CONFIG_GPIOLIB_LEGACY is still set
unconditionally at the moment, that should work fine as long
as your patches for the rohm drivers get merged before
we turn off CONFIG_GPIOLIB_LEGACY for modern platforms.
In linux-next, I see these users of the legacy gpio-keys platform
data remaining:
arch/arm/mach-mv78xx0/buffalo-wxl-setup.c
arch/arm/mach-orion5x/dns323-setup.c
arch/arm/mach-orion5x/mv2120-setup.c
arch/arm/mach-orion5x/net2big-setup.c
arch/arm/mach-orion5x/ts209-setup.c
arch/arm/mach-orion5x/ts409-setup.c
arch/arm/mach-s3c/mach-crag6410.c
arch/arm/mach-sa1100/assabet.c
arch/arm/mach-sa1100/collie.c
arch/arm/mach-sa1100/h3xxx.c
arch/mips/alchemy/devboards/db1300.c
arch/mips/bcm47xx/buttons.c
arch/sh/boards/mach-rsk/devices-rsk7203.c
arch/sh/boards/mach-x3proto/setup.c
drivers/input/misc/soc_button_array.c
drivers/mfd/ucb1x00-assabet.c
Do you already have patches for more of these? I would like to
kill off mv78xx0, orion5x and sa1100 board files (including
the ucb1x00-assabet mfd driver) soon, but that still leaves s3c,
alchemy, bcm47xx, rsk and x3proto. These platforms are in
varying states of disrepair, maybe a few more of those
can be removed instead of converted. I know that Mark
Brown is still using the s3c board, and Waldemar Brodkorb
was recently working on restoring bcm47xx into a usable
state.
I assume you'll take care of the soc_button_array one.
Arnd
^ permalink raw reply
* [PATCH 00/10] iio: drop redundant iio_dev argument from hid_sensor_remove_trigger()
From: Sanjay Chitroda @ 2026-04-28 7:16 UTC (permalink / raw)
To: jikos, jic23, srinivas.pandruvada
Cc: dlechner, nuno.sa, andy, sakari.ailus, sanjayembeddedse,
linux-input, linux-iio, linux-kernel
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
The iio_dev argument has been unused since buffer cleanup moved out of
hid_sensor_remove_trigger(). All required resources are tracked via
hid_sensor_common, making the extra argument redundant and allowing
future devm conversion.
This is a mechanical change with no functional impact.
Testing:
- Compiled with W=1
- Build-tested on QEMU x86_64
Feedback and reviews are very welcome.
Thanks,
Sanjay Chitroda
Sanjay Chitroda (10):
iio: hid-sensors: drop redundant iio_dev argument
iio: orientation: adapt to hid_sensor_remove_trigger() API change
iio: gyro: adapt to hid_sensor_remove_trigger() API change
iio: pressure: adapt to hid_sensor_remove_trigger() API change
iio: temperature: adapt to hid_sensor_remove_trigger() API change
iio: humidity: adapt to hid_sensor_remove_trigger() API change
iio: light: adapt to hid_sensor_remove_trigger() API change
iio: magnetometer: adapt to hid_sensor_remove_trigger() API change
iio: position: adapt to hid_sensor_remove_trigger() API change
iio: accel: adapt to hid_sensor_remove_trigger() API change
drivers/iio/accel/hid-sensor-accel-3d.c | 4 ++--
drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 3 +--
drivers/iio/common/hid-sensors/hid-sensor-trigger.h | 3 +--
drivers/iio/gyro/hid-sensor-gyro-3d.c | 4 ++--
drivers/iio/humidity/hid-sensor-humidity.c | 4 ++--
drivers/iio/light/hid-sensor-als.c | 4 ++--
drivers/iio/light/hid-sensor-prox.c | 4 ++--
drivers/iio/magnetometer/hid-sensor-magn-3d.c | 4 ++--
drivers/iio/orientation/hid-sensor-incl-3d.c | 4 ++--
drivers/iio/orientation/hid-sensor-rotation.c | 4 ++--
drivers/iio/position/hid-sensor-custom-intel-hinge.c | 4 ++--
drivers/iio/pressure/hid-sensor-press.c | 4 ++--
drivers/iio/temperature/hid-sensor-temperature.c | 4 ++--
13 files changed, 24 insertions(+), 26 deletions(-)
base-commit: eade2b843d9b1f668fc1775f15611bb0a1999cd9
--
2.34.1
^ permalink raw reply
* [PATCH 01/10] iio: hid-sensors: drop redundant iio_dev argument
From: Sanjay Chitroda @ 2026-04-28 7:16 UTC (permalink / raw)
To: jikos, jic23, srinivas.pandruvada
Cc: dlechner, nuno.sa, andy, sakari.ailus, sanjayembeddedse,
linux-input, linux-iio, linux-kernel
In-Reply-To: <20260428071613.1134053-1-sanjayembedded@gmail.com>
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
hid_sensor_remove_trigger() uses struct hid_sensor_common to release
resources acquired during trigger setup.
Earlier implementations required struct iio_dev to clean up buffers,
but with the current code this argument is no longer used and is
redundant.
Removing it simplifies the API and is a preparatory step toward
converting the trigger handling to a devm-based API.
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
---
drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 3 +--
drivers/iio/common/hid-sensors/hid-sensor-trigger.h | 3 +--
2 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index 417c4ab8c1b2..28d050b45c74 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -218,8 +218,7 @@ static const struct iio_buffer_setup_ops hid_sensor_buffer_ops = {
.predisable = buffer_predisable,
};
-void hid_sensor_remove_trigger(struct iio_dev *indio_dev,
- struct hid_sensor_common *attrb)
+void hid_sensor_remove_trigger(struct hid_sensor_common *attrb)
{
if (atomic_read(&attrb->runtime_pm_enable))
pm_runtime_disable(&attrb->pdev->dev);
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.h b/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
index f94fca4f1edf..afec46ecbe71 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.h
@@ -16,8 +16,7 @@ extern const struct dev_pm_ops hid_sensor_pm_ops;
int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name,
struct hid_sensor_common *attrb);
-void hid_sensor_remove_trigger(struct iio_dev *indio_dev,
- struct hid_sensor_common *attrb);
+void hid_sensor_remove_trigger(struct hid_sensor_common *attrb);
int hid_sensor_power_state(struct hid_sensor_common *st, bool state);
#endif
--
2.34.1
^ permalink raw reply related
* [PATCH 02/10] iio: orientation: adapt to hid_sensor_remove_trigger() API change
From: Sanjay Chitroda @ 2026-04-28 7:16 UTC (permalink / raw)
To: jikos, jic23, srinivas.pandruvada
Cc: dlechner, nuno.sa, andy, sakari.ailus, sanjayembeddedse,
linux-input, linux-iio, linux-kernel
In-Reply-To: <20260428071613.1134053-1-sanjayembedded@gmail.com>
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Update the driver to match the updated hid_sensor_remove_trigger()
prototype, which no longer requires struct iio_dev.
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
---
drivers/iio/orientation/hid-sensor-incl-3d.c | 4 ++--
drivers/iio/orientation/hid-sensor-rotation.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/iio/orientation/hid-sensor-incl-3d.c b/drivers/iio/orientation/hid-sensor-incl-3d.c
index 4e23a598a3fb..56fd9c53dfc2 100644
--- a/drivers/iio/orientation/hid-sensor-incl-3d.c
+++ b/drivers/iio/orientation/hid-sensor-incl-3d.c
@@ -378,7 +378,7 @@ static int hid_incl_3d_probe(struct platform_device *pdev)
error_iio_unreg:
iio_device_unregister(indio_dev);
error_remove_trigger:
- hid_sensor_remove_trigger(indio_dev, &incl_state->common_attributes);
+ hid_sensor_remove_trigger(&incl_state->common_attributes);
return ret;
}
@@ -391,7 +391,7 @@ static void hid_incl_3d_remove(struct platform_device *pdev)
sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_INCLINOMETER_3D);
iio_device_unregister(indio_dev);
- hid_sensor_remove_trigger(indio_dev, &incl_state->common_attributes);
+ hid_sensor_remove_trigger(&incl_state->common_attributes);
}
static const struct platform_device_id hid_incl_3d_ids[] = {
diff --git a/drivers/iio/orientation/hid-sensor-rotation.c b/drivers/iio/orientation/hid-sensor-rotation.c
index 4a11e4555099..56fdb3412fe3 100644
--- a/drivers/iio/orientation/hid-sensor-rotation.c
+++ b/drivers/iio/orientation/hid-sensor-rotation.c
@@ -353,7 +353,7 @@ static int hid_dev_rot_probe(struct platform_device *pdev)
error_iio_unreg:
iio_device_unregister(indio_dev);
error_remove_trigger:
- hid_sensor_remove_trigger(indio_dev, &rot_state->common_attributes);
+ hid_sensor_remove_trigger(&rot_state->common_attributes);
return ret;
}
@@ -366,7 +366,7 @@ static void hid_dev_rot_remove(struct platform_device *pdev)
sensor_hub_remove_callback(hsdev, hsdev->usage);
iio_device_unregister(indio_dev);
- hid_sensor_remove_trigger(indio_dev, &rot_state->common_attributes);
+ hid_sensor_remove_trigger(&rot_state->common_attributes);
}
static const struct platform_device_id hid_dev_rot_ids[] = {
--
2.34.1
^ permalink raw reply related
* [PATCH 03/10] iio: gyro: adapt to hid_sensor_remove_trigger() API change
From: Sanjay Chitroda @ 2026-04-28 7:16 UTC (permalink / raw)
To: jikos, jic23, srinivas.pandruvada
Cc: dlechner, nuno.sa, andy, sakari.ailus, sanjayembeddedse,
linux-input, linux-iio, linux-kernel
In-Reply-To: <20260428071613.1134053-1-sanjayembedded@gmail.com>
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Update the driver to match the updated hid_sensor_remove_trigger()
prototype, which no longer requires struct iio_dev.
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
---
drivers/iio/gyro/hid-sensor-gyro-3d.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c
index c340cc899a7c..fe663b19e902 100644
--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c
+++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c
@@ -354,7 +354,7 @@ static int hid_gyro_3d_probe(struct platform_device *pdev)
error_iio_unreg:
iio_device_unregister(indio_dev);
error_remove_trigger:
- hid_sensor_remove_trigger(indio_dev, &gyro_state->common_attributes);
+ hid_sensor_remove_trigger(&gyro_state->common_attributes);
return ret;
}
@@ -367,7 +367,7 @@ static void hid_gyro_3d_remove(struct platform_device *pdev)
sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_GYRO_3D);
iio_device_unregister(indio_dev);
- hid_sensor_remove_trigger(indio_dev, &gyro_state->common_attributes);
+ hid_sensor_remove_trigger(&gyro_state->common_attributes);
}
static const struct platform_device_id hid_gyro_3d_ids[] = {
--
2.34.1
^ permalink raw reply related
* [PATCH 04/10] iio: pressure: adapt to hid_sensor_remove_trigger() API change
From: Sanjay Chitroda @ 2026-04-28 7:16 UTC (permalink / raw)
To: jikos, jic23, srinivas.pandruvada
Cc: dlechner, nuno.sa, andy, sakari.ailus, sanjayembeddedse,
linux-input, linux-iio, linux-kernel
In-Reply-To: <20260428071613.1134053-1-sanjayembedded@gmail.com>
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Update the driver to match the updated hid_sensor_remove_trigger()
prototype, which no longer requires struct iio_dev.
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
---
drivers/iio/pressure/hid-sensor-press.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/pressure/hid-sensor-press.c b/drivers/iio/pressure/hid-sensor-press.c
index 5f1d6abda3e4..2bf5d055e175 100644
--- a/drivers/iio/pressure/hid-sensor-press.c
+++ b/drivers/iio/pressure/hid-sensor-press.c
@@ -319,7 +319,7 @@ static int hid_press_probe(struct platform_device *pdev)
error_iio_unreg:
iio_device_unregister(indio_dev);
error_remove_trigger:
- hid_sensor_remove_trigger(indio_dev, &press_state->common_attributes);
+ hid_sensor_remove_trigger(&press_state->common_attributes);
return ret;
}
@@ -332,7 +332,7 @@ static void hid_press_remove(struct platform_device *pdev)
sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_PRESSURE);
iio_device_unregister(indio_dev);
- hid_sensor_remove_trigger(indio_dev, &press_state->common_attributes);
+ hid_sensor_remove_trigger(&press_state->common_attributes);
}
static const struct platform_device_id hid_press_ids[] = {
--
2.34.1
^ permalink raw reply related
* [PATCH 05/10] iio: temperature: adapt to hid_sensor_remove_trigger() API change
From: Sanjay Chitroda @ 2026-04-28 7:16 UTC (permalink / raw)
To: jikos, jic23, srinivas.pandruvada
Cc: dlechner, nuno.sa, andy, sakari.ailus, sanjayembeddedse,
linux-input, linux-iio, linux-kernel
In-Reply-To: <20260428071613.1134053-1-sanjayembedded@gmail.com>
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Update the driver to match the updated hid_sensor_remove_trigger()
prototype, which no longer requires struct iio_dev.
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
---
drivers/iio/temperature/hid-sensor-temperature.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c
index 9f628a8e5cfb..60d4fcc8043b 100644
--- a/drivers/iio/temperature/hid-sensor-temperature.c
+++ b/drivers/iio/temperature/hid-sensor-temperature.c
@@ -253,7 +253,7 @@ static int hid_temperature_probe(struct platform_device *pdev)
error_remove_callback:
sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_TEMPERATURE);
error_remove_trigger:
- hid_sensor_remove_trigger(indio_dev, &temp_st->common_attributes);
+ hid_sensor_remove_trigger(&temp_st->common_attributes);
return ret;
}
@@ -265,7 +265,7 @@ static void hid_temperature_remove(struct platform_device *pdev)
struct temperature_state *temp_st = iio_priv(indio_dev);
sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_TEMPERATURE);
- hid_sensor_remove_trigger(indio_dev, &temp_st->common_attributes);
+ hid_sensor_remove_trigger(&temp_st->common_attributes);
}
static const struct platform_device_id hid_temperature_ids[] = {
--
2.34.1
^ permalink raw reply related
* [PATCH 06/10] iio: humidity: adapt to hid_sensor_remove_trigger() API change
From: Sanjay Chitroda @ 2026-04-28 7:16 UTC (permalink / raw)
To: jikos, jic23, srinivas.pandruvada
Cc: dlechner, nuno.sa, andy, sakari.ailus, sanjayembeddedse,
linux-input, linux-iio, linux-kernel
In-Reply-To: <20260428071613.1134053-1-sanjayembedded@gmail.com>
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Update the driver to match the updated hid_sensor_remove_trigger()
prototype, which no longer requires struct iio_dev.
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
---
drivers/iio/humidity/hid-sensor-humidity.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/humidity/hid-sensor-humidity.c b/drivers/iio/humidity/hid-sensor-humidity.c
index be2338d5f407..e580a2af9562 100644
--- a/drivers/iio/humidity/hid-sensor-humidity.c
+++ b/drivers/iio/humidity/hid-sensor-humidity.c
@@ -255,7 +255,7 @@ static int hid_humidity_probe(struct platform_device *pdev)
error_remove_callback:
sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_HUMIDITY);
error_remove_trigger:
- hid_sensor_remove_trigger(indio_dev, &humid_st->common_attributes);
+ hid_sensor_remove_trigger(&humid_st->common_attributes);
return ret;
}
@@ -268,7 +268,7 @@ static void hid_humidity_remove(struct platform_device *pdev)
iio_device_unregister(indio_dev);
sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_HUMIDITY);
- hid_sensor_remove_trigger(indio_dev, &humid_st->common_attributes);
+ hid_sensor_remove_trigger(&humid_st->common_attributes);
}
static const struct platform_device_id hid_humidity_ids[] = {
--
2.34.1
^ permalink raw reply related
* [PATCH 07/10] iio: light: adapt to hid_sensor_remove_trigger() API change
From: Sanjay Chitroda @ 2026-04-28 7:16 UTC (permalink / raw)
To: jikos, jic23, srinivas.pandruvada
Cc: dlechner, nuno.sa, andy, sakari.ailus, sanjayembeddedse,
linux-input, linux-iio, linux-kernel
In-Reply-To: <20260428071613.1134053-1-sanjayembedded@gmail.com>
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Update the driver to match the updated hid_sensor_remove_trigger()
prototype, which no longer requires struct iio_dev.
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
---
drivers/iio/light/hid-sensor-als.c | 4 ++--
drivers/iio/light/hid-sensor-prox.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
index 384572844162..9b57cdced18a 100644
--- a/drivers/iio/light/hid-sensor-als.c
+++ b/drivers/iio/light/hid-sensor-als.c
@@ -432,7 +432,7 @@ static int hid_als_probe(struct platform_device *pdev)
error_iio_unreg:
iio_device_unregister(indio_dev);
error_remove_trigger:
- hid_sensor_remove_trigger(indio_dev, &als_state->common_attributes);
+ hid_sensor_remove_trigger(&als_state->common_attributes);
return ret;
}
@@ -445,7 +445,7 @@ static void hid_als_remove(struct platform_device *pdev)
sensor_hub_remove_callback(hsdev, hsdev->usage);
iio_device_unregister(indio_dev);
- hid_sensor_remove_trigger(indio_dev, &als_state->common_attributes);
+ hid_sensor_remove_trigger(&als_state->common_attributes);
}
static const struct platform_device_id hid_als_ids[] = {
diff --git a/drivers/iio/light/hid-sensor-prox.c b/drivers/iio/light/hid-sensor-prox.c
index efa904a70d0e..473c45626487 100644
--- a/drivers/iio/light/hid-sensor-prox.c
+++ b/drivers/iio/light/hid-sensor-prox.c
@@ -340,7 +340,7 @@ static int hid_prox_probe(struct platform_device *pdev)
error_iio_unreg:
iio_device_unregister(indio_dev);
error_remove_trigger:
- hid_sensor_remove_trigger(indio_dev, &prox_state->common_attributes);
+ hid_sensor_remove_trigger(&prox_state->common_attributes);
return ret;
}
@@ -353,7 +353,7 @@ static void hid_prox_remove(struct platform_device *pdev)
sensor_hub_remove_callback(hsdev, hsdev->usage);
iio_device_unregister(indio_dev);
- hid_sensor_remove_trigger(indio_dev, &prox_state->common_attributes);
+ hid_sensor_remove_trigger(&prox_state->common_attributes);
}
static const struct platform_device_id hid_prox_ids[] = {
--
2.34.1
^ permalink raw reply related
* [PATCH 08/10] iio: magnetometer: adapt to hid_sensor_remove_trigger() API change
From: Sanjay Chitroda @ 2026-04-28 7:16 UTC (permalink / raw)
To: jikos, jic23, srinivas.pandruvada
Cc: dlechner, nuno.sa, andy, sakari.ailus, sanjayembeddedse,
linux-input, linux-iio, linux-kernel
In-Reply-To: <20260428071613.1134053-1-sanjayembedded@gmail.com>
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Update the driver to match the updated hid_sensor_remove_trigger()
prototype, which no longer requires struct iio_dev.
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
---
drivers/iio/magnetometer/hid-sensor-magn-3d.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/magnetometer/hid-sensor-magn-3d.c b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
index b01dd53eb100..8be3dfe4dd58 100644
--- a/drivers/iio/magnetometer/hid-sensor-magn-3d.c
+++ b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
@@ -542,7 +542,7 @@ static int hid_magn_3d_probe(struct platform_device *pdev)
error_iio_unreg:
iio_device_unregister(indio_dev);
error_remove_trigger:
- hid_sensor_remove_trigger(indio_dev, &magn_state->magn_flux_attributes);
+ hid_sensor_remove_trigger(&magn_state->magn_flux_attributes);
return ret;
}
@@ -555,7 +555,7 @@ static void hid_magn_3d_remove(struct platform_device *pdev)
sensor_hub_remove_callback(hsdev, HID_USAGE_SENSOR_COMPASS_3D);
iio_device_unregister(indio_dev);
- hid_sensor_remove_trigger(indio_dev, &magn_state->magn_flux_attributes);
+ hid_sensor_remove_trigger(&magn_state->magn_flux_attributes);
}
static const struct platform_device_id hid_magn_3d_ids[] = {
--
2.34.1
^ permalink raw reply related
* [PATCH 09/10] iio: position: adapt to hid_sensor_remove_trigger() API change
From: Sanjay Chitroda @ 2026-04-28 7:16 UTC (permalink / raw)
To: jikos, jic23, srinivas.pandruvada
Cc: dlechner, nuno.sa, andy, sakari.ailus, sanjayembeddedse,
linux-input, linux-iio, linux-kernel
In-Reply-To: <20260428071613.1134053-1-sanjayembedded@gmail.com>
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Update the driver to match the updated hid_sensor_remove_trigger()
prototype, which no longer requires struct iio_dev.
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
---
drivers/iio/position/hid-sensor-custom-intel-hinge.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/position/hid-sensor-custom-intel-hinge.c b/drivers/iio/position/hid-sensor-custom-intel-hinge.c
index a26d391661fd..5288b63f4e21 100644
--- a/drivers/iio/position/hid-sensor-custom-intel-hinge.c
+++ b/drivers/iio/position/hid-sensor-custom-intel-hinge.c
@@ -337,7 +337,7 @@ static int hid_hinge_probe(struct platform_device *pdev)
error_remove_callback:
sensor_hub_remove_callback(hsdev, hsdev->usage);
error_remove_trigger:
- hid_sensor_remove_trigger(indio_dev, &st->common_attributes);
+ hid_sensor_remove_trigger(&st->common_attributes);
return ret;
}
@@ -350,7 +350,7 @@ static void hid_hinge_remove(struct platform_device *pdev)
iio_device_unregister(indio_dev);
sensor_hub_remove_callback(hsdev, hsdev->usage);
- hid_sensor_remove_trigger(indio_dev, &st->common_attributes);
+ hid_sensor_remove_trigger(&st->common_attributes);
}
static const struct platform_device_id hid_hinge_ids[] = {
--
2.34.1
^ permalink raw reply related
* [PATCH 10/10] iio: accel: adapt to hid_sensor_remove_trigger() API change
From: Sanjay Chitroda @ 2026-04-28 7:16 UTC (permalink / raw)
To: jikos, jic23, srinivas.pandruvada
Cc: dlechner, nuno.sa, andy, sakari.ailus, sanjayembeddedse,
linux-input, linux-iio, linux-kernel
In-Reply-To: <20260428071613.1134053-1-sanjayembedded@gmail.com>
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Update the driver to match the updated hid_sensor_remove_trigger()
prototype, which no longer requires struct iio_dev.
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
---
drivers/iio/accel/hid-sensor-accel-3d.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
index 2ff591b3458f..a63dae90dadc 100644
--- a/drivers/iio/accel/hid-sensor-accel-3d.c
+++ b/drivers/iio/accel/hid-sensor-accel-3d.c
@@ -416,7 +416,7 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
error_iio_unreg:
iio_device_unregister(indio_dev);
error_remove_trigger:
- hid_sensor_remove_trigger(indio_dev, &accel_state->common_attributes);
+ hid_sensor_remove_trigger(&accel_state->common_attributes);
return ret;
}
@@ -429,7 +429,7 @@ static void hid_accel_3d_remove(struct platform_device *pdev)
sensor_hub_remove_callback(hsdev, hsdev->usage);
iio_device_unregister(indio_dev);
- hid_sensor_remove_trigger(indio_dev, &accel_state->common_attributes);
+ hid_sensor_remove_trigger(&accel_state->common_attributes);
}
static const struct platform_device_id hid_accel_3d_ids[] = {
--
2.34.1
^ permalink raw reply related
* Re: [PATCH 02/10] iio: orientation: adapt to hid_sensor_remove_trigger() API change
From: Andy Shevchenko @ 2026-04-28 8:22 UTC (permalink / raw)
To: Sanjay Chitroda
Cc: jikos, jic23, srinivas.pandruvada, dlechner, nuno.sa, andy,
sakari.ailus, linux-input, linux-iio, linux-kernel
In-Reply-To: <20260428071613.1134053-3-sanjayembedded@gmail.com>
On Tue, Apr 28, 2026 at 12:46:05PM +0530, Sanjay Chitroda wrote:
> Update the driver to match the updated hid_sensor_remove_trigger()
> prototype, which no longer requires struct iio_dev.
You haven't compiled the previous patch, right?
This is not the way how all this should be done.
Also NAK to the patch 1 as even unused parameter is there for the sake of
consistency. The prototype to allocate and other in the similar group all
have it.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* [PATCH] HID: uclogic: Fix regression of input name assignment
From: Takashi Iwai @ 2026-04-28 8:33 UTC (permalink / raw)
To: Jiri Kosina, Benjamin Tissoires; +Cc: Henry Martin, linux-input, linux-kernel
The previous fix for adding the devm_kasprintf() return check in the
commit bd07f751208b ("HID: uclogic: Add NULL check in
uclogic_input_configured()") changed the condition of hi->input->name
assignment, and it resulted in missing the proper input device name
when no custom suffix is defined.
Restore the conditional to the original content to address the
regression.
Fixes: bd07f751208b ("HID: uclogic: Add NULL check in uclogic_input_configured()")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
drivers/hid/hid-uclogic-core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c
index bd7f93e96e4e..b73f09d26688 100644
--- a/drivers/hid/hid-uclogic-core.c
+++ b/drivers/hid/hid-uclogic-core.c
@@ -184,7 +184,9 @@ static int uclogic_input_configured(struct hid_device *hdev,
suffix = "System Control";
break;
}
- } else {
+ }
+
+ if (suffix) {
hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
"%s %s", hdev->name, suffix);
if (!hi->input->name)
--
2.54.0
^ permalink raw reply related
* [PATCH v2 0/2] input: misc: add support for Imagis ISA1200 haptic motor driver
From: Svyatoslav Ryhel @ 2026-04-28 11:43 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Linus Walleij, Svyatoslav Ryhel
Cc: linux-input, devicetree, linux-kernel
The ISA1200 is a haptic feedback unit from Imagis Technology using two
motors for haptic feedback in mobile phones. Used in many mobile devices
c. 2012 including Samsung Galxy S Advance GT-I9070 (Janice), Samsung Beam
GT-I8350 (Gavini), LG Optimus 4X P880 and LG Optimus Vu P895.
The exact datasheet for the ISA1200 is not available; all data was modeled
based on available downstream kernel sources for various devices and
fragments of information scattered across the internet.
---
Changes in v2:
- imagis,clk-div switched to accept actual divider value
- dropped DT header
- adjusted imagis,period-ns range
- initiated hctrl0 and hctrl1 values in isa1200_start
- fixed situation when PWM might return -EPROBE_DEFER to be
treated properly
- added chech a clock or PWM is available
- fixed regulator voltages check being off by 10
- added chech if state.period is not zero
- added action call to disable clock and gpios on error
- used managed version of work init
- added work cancel on suspend
- PW calls are done under mutex lock
---
Linus Walleij (1):
Input: isa1200 - new driver for Imagis ISA1200
Svyatoslav Ryhel (1):
dt-bindings: input: Document Imagis ISA1200 haptic motor driver
.../bindings/input/imagis,isa1200.yaml | 140 +++++
drivers/input/misc/Kconfig | 11 +
drivers/input/misc/Makefile | 1 +
drivers/input/misc/isa1200.c | 507 ++++++++++++++++++
4 files changed, 659 insertions(+)
create mode 100644 Documentation/devicetree/bindings/input/imagis,isa1200.yaml
create mode 100644 drivers/input/misc/isa1200.c
--
2.51.0
^ permalink raw reply
* [PATCH v2 1/2] dt-bindings: input: Document Imagis ISA1200 haptic motor driver
From: Svyatoslav Ryhel @ 2026-04-28 11:43 UTC (permalink / raw)
To: Dmitry Torokhov, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Linus Walleij, Svyatoslav Ryhel
Cc: linux-input, devicetree, linux-kernel
In-Reply-To: <20260428114308.113253-1-clamor95@gmail.com>
Document the Imagis ISA1200 haptic motor driver, used primarily in mobile
handheld devices and capable of supporting up to two motors.
The exact datasheet for the ISA1200 is not available; all data was modeled
based on available downstream kernel sources for various devices and
fragments of information scattered across the internet.
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
---
.../bindings/input/imagis,isa1200.yaml | 140 ++++++++++++++++++
1 file changed, 140 insertions(+)
create mode 100644 Documentation/devicetree/bindings/input/imagis,isa1200.yaml
diff --git a/Documentation/devicetree/bindings/input/imagis,isa1200.yaml b/Documentation/devicetree/bindings/input/imagis,isa1200.yaml
new file mode 100644
index 000000000000..40a4c7fd78bc
--- /dev/null
+++ b/Documentation/devicetree/bindings/input/imagis,isa1200.yaml
@@ -0,0 +1,140 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/input/imagis,isa1200.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Imagis ISA1200 haptic motor driver
+
+maintainers:
+ - Svyatoslav Ryhel <clamor95@gmail.com>
+ - Linus Walleij <linusw@kernel.org>
+
+description:
+ The ISA1200 is a high-performance enhanced haptic motor driver designed
+ for mobile hand-held devices. It supports various voltages for both ERM
+ (Eccentric Rotating Mass) and LRA (Linear Resonant Actuator) type
+ actuators. Thanks to an embedded LDO, battery power can be used directly
+ in handheld applications.
+
+properties:
+ compatible:
+ const: imagis,isa1200
+
+ reg:
+ maxItems: 1
+
+ control-gpios:
+ description:
+ One or two GPIOs flagged as active high linked to HEN and LEN pins
+ maxItems: 2
+
+ clocks:
+ maxItems: 1
+
+ pwms:
+ maxItems: 1
+
+ vdd-supply:
+ description:
+ Regulator for 2.4V - 5.5V power supply
+
+ vddp-supply:
+ description:
+ Regulator for 2.4V - 3.6V IO power supply
+
+ imagis,clk-div:
+ $ref: /schemas/types.yaml#/definitions/uint32
+ description:
+ Divider for the external input clock/PWM
+ enum: [128, 256, 512, 1024]
+ default: 128
+
+ imagis,pll-div:
+ $ref: /schemas/types.yaml#/definitions/uint32
+ description:
+ Divider for the internal PLL clock
+ minimum: 1
+ maximum: 15
+ default: 1
+
+ imagis,mode:
+ $ref: /schemas/types.yaml#/definitions/uint32
+ description: |
+ Defines the motor type isa1200 drives
+ 0 - LRA (Linear Resonant Actuator)
+ 1 - ERM (Eccentric Rotating Mass)
+ enum: [0, 1]
+ default: 0
+
+ imagis,period-ns:
+ description:
+ Period of the internal PWM channel in nanoseconds.
+ minimum: 12800
+ maximum: 25400
+
+ imagis,duty-cycle-ns:
+ description:
+ Duty cycle of the external/internal PWM channel in nanoseconds,
+ defaults to 50% of the channel's period
+
+ ldo:
+ $ref: /schemas/regulator/regulator.yaml#
+ type: object
+ description:
+ Embedded LDO regulator with voltage range 2.3V - 3.8V
+ unevaluatedProperties: false
+
+ required:
+ - regulator-min-microvolt
+ - regulator-max-microvolt
+
+required:
+ - compatible
+ - reg
+ - ldo
+
+anyOf:
+ - required:
+ - clocks
+ - imagis,period-ns
+ - required:
+ - pwms
+
+additionalProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/gpio/gpio.h>
+
+ i2c {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ haptic-engine@49 {
+ compatible = "imagis,isa1200";
+ reg = <0x49>;
+
+ clocks = <&isa1200_refclk>;
+
+ control-gpios = <&gpio 22 GPIO_ACTIVE_HIGH>,
+ <&gpio 23 GPIO_ACTIVE_HIGH>;
+
+ vdd-supply = <&vdd_3v3_vbat>;
+ vddp-supply = <&vdd_2v8_vvib>;
+
+ imagis,clk-div = <256>;
+ imagis,pll-div = <2>;
+
+ imagis,mode = <0>; /* LRA_MODE */
+
+ imagis,period-ns = <13400>;
+ imagis,duty-cycle-ns = <100>;
+
+ ldo {
+ regulator-name = "vdd_vib";
+ regulator-min-microvolt = <2300000>;
+ regulator-max-microvolt = <2300000>;
+ };
+ };
+ };
--
2.51.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox