8936 Commits
Author SHA1 Message Date
Linus Torvalds 8623551a42 Merge tag 'input-for-v7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:

 - A fix for the Samsung S6SY761 touchscreen driver to power on the
   controller before unmasking interrupts during resume and to re-enable
   touch sensing when the device is open

 - Updates to the Synaptics touchpad driver to enable SMBus/RMI4 mode on
   Lenovo ThinkPad T490 and restrict the ThinkPad T440p InterTouch
   disable quirk to LEN0036 so that ThinkPad L440 retains SMBus support

 - A quirk for the AT keyboard driver (atkbd) to skip keyboard
   deactivation on Lenovo IdeaPad Slim 3 15IWC11 so the internal
   keyboard functions properly

 - A DMI quirk for the i8042 controller to disable active multiplexing
   on Fujitsu LIFEBOOK U7410, preventing the internal keyboard and
   touchpad from dying shortly after boot.

* tag 'input-for-v7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
  Input: s6sy761 - fix resume ordering and restore sensing
  Input: synaptics - limit T440p InterTouch quirk to LEN0036
  Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
  Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
2026-10-03 08:10:37 -07:00
Martino Papero 3bf8d603fd Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
The internal keyboard on the Lenovo IdeaPad Slim 3 15IWC11 (83RR)
does not work correctly with the default i8042 settings. Using
i8042.nopnp=1 and i8042.dumbkbd=1 restores keyboard input, but prevents
the Caps Lock LED from working. Using i8042.nopnp=1 alone does not fix
the keyboard.

The laptop works correctly when atkbd_deactivate_fixup is used instead.
Add a DMI quirk for the 83RR to enable it.

This was tested without any i8042 command-line parameters. Keyboard
input and the Caps Lock LED work correctly, including after suspend
and resume and after a cold boot.

Link: https://lore.kernel.org/all/[email protected]/
Signed-off-by: Martino Papero <[email protected]>
Reviewed-by: Hans de Goede <[email protected]>
Link: https://patch.msgid.link/[email protected]
Cc: [email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-10-02 22:07:54 -07:00
David Heidelberg a215720959 Input: s6sy761 - fix resume ordering and restore sensing
System suspend powers the controller off and resume powers it back on,
but the resume path enables the interrupt before s6sy761_power_on()
checks the boot. The firmware raises its boot-complete event on the
interrupt line, the threaded handler consumes it, s6sy761_power_on()
then reads an empty event and resume fails with -ENODEV, skipping the
touch function setup:

s6sy761 2-0048: PM: dpm_run_callback(): s6sy761_resume [s6sy761] returns -19

Power the chip on first and only then unmask the interrupt. Once resume
completes the boot handshake the chip comes back with sensing off, as
at probe where input_open() turns it on, so the touchscreen stays dead
after resume. Send SENSE_ON again when the input device is open.

Tested on a Pixel 3 XL over several s2idle cycles: resume succeeds and
the touch function and sense status match the pre-suspend state.

Assisted-by: LLM
Cc: [email protected]
Fixes: 0145a7141e ("Input: add support for the Samsung S6SY761 touchscreen")
Signed-off-by: David Heidelberg <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-27 21:38:32 -07:00
Raphaël Larocque f0fd899308 Input: synaptics - limit T440p InterTouch quirk to LEN0036
The ThinkPad L440 also uses board id 2722, but does not have the SMBus
initialization problem seen on the T440p. On the L440, the SMBus
companion becomes available shortly after psmouse probes, allowing the
touchpad to use SMBus/RMI4 normally.

The T440p's quirk is currently applied to all Synaptics touchpads with
board id 2722, unnecessarily disabling SMBus InterTouch on the L440,
as reported by Daniel Salmun.

Restrict the quirk to PNP ID LEN0036, which identifies the T440p, so
that other devices sharing board id 2722 retain their normal
SMBus/RMI4 operation.

Reported-by: Daniel Salmun <[email protected]>
Link: https://lore.kernel.org/all/[email protected]/
Fixes: 26eb3d92c7 ("Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)")
Cc: [email protected]
Signed-off-by: Raphaël Larocque <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-27 21:38:02 -07:00
Lovekesh Solanki 495cd7f858 Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
On the Fujitsu LIFEBOOK U7410 the internal keyboard and touchpad die
shortly after boot if i8042 multiplexing controller is probed and
switched to muxed mode. These multiplexing setup commands disturb the EC
emulated keyboard and atkbd reports "Spurious ACK" and "Unknown key
pressed" warnings, after which both keyboard and touchpad stop
delivering events. Both touchpad and keyboard work in BIOS and GRUB.

Disabling multiplexer using i8042.nomux=1 makes both devices work on
warm/cold boot.

Add a DMI quirk to force nomux mode for this model.

Reported-by: Heiko Brey <[email protected]>
Link: https://lore.kernel.org/all/[email protected]/
Signed-off-by: Lovekesh Solanki <[email protected]>
Link: https://patch.msgid.link/[email protected]
Cc: [email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-20 19:54:13 -07:00
Lovekesh Solanki a961417c5a Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
Lenovo ThinkPad T490 has a Synaptics Touchpad that supports SMBus/RMI4
mode, but is not listed in smbus_pnp_ids table.

Add LEN205b to smbus_pnp_ids[] passlist.

Reported-by: John Rosencutter <[email protected]>
Closes: https://lore.kernel.org/all/CAOGuaRh025eKcBf9P8UrvtXNp68vQ0HVF2EbNMp-kpdaC1HNpA@mail.gmail.com/
Signed-off-by: Lovekesh Solanki <[email protected]>
Link: https://patch.msgid.link/[email protected]
Cc: [email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-20 19:52:27 -07:00
Linus Torvalds b12dd0fa48 Merge tag 'input-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:

 - Fixes for evdev and input compat handling to zero-initialize on-stack
   absinfo and force-feedback effect structures before partial or compat
   copies from userspace, preventing kernel stack memory disclosure

 - Fixes for the Synaptics RMI4 driver to prevent an out-of-bounds read
   when writing multi-chunk blocks over SMBus and to avoid a NULL
   pointer dereference during suspend/resume when the RMI device is
   unbound

 - Fixes for the soc_button_array driver to propagate -EPROBE_DEFER on
   non-Bay Trail/Cherry Trail platforms (fixing broken power and volume
   buttons on the Microsoft Surface Pro 11) and to validate the ACPI
   package element count before dereferencing

 - A fix for the adp5588-keys driver to cache the initial GPIO hardware
   state before registering the gpiochip so pre-configured pin states
   are not clobbered by GPIO hogs during registration

 - A fix for the cyttsp5 touchscreen driver to clamp the device-supplied
   HID report size before copying into the response buffer, preventing a
   buffer overflow

 - A fix for the HP SDC serio driver to use timer_shutdown_sync() on
   module exit so the periodic kicker timer cannot rearm itself during
   teardown

 - A fix for the eeti_ts touchscreen driver to export its OF module
   alias so the module autoloads on Device Tree platforms

 - Updates to the xpad joystick driver adding support for the Victrix
   Pro BFG controller and Azeron devices, and fixing the device type
   classification for the PDP Marvel Xbox 360 controller

 - Quirks for the i8042 and atkbd drivers to keep the built-in keyboards
   functional on the Acer Aspire Go 15 AG15-42P and Xiaomi Redmi Book
   Pro 16 2026

 - A quirk for the Synaptics PS/2 touchpad driver disabling SMBus
   InterTouch on the Lenovo ThinkPad T440p (board ID 2722) so the
   touchpad and TrackPoint respond immediately at boot

 - Other minor updates and documentation fixes, including reading the
   "ti,poll-period" property as u32 in tsc2007, adding the mt6572
   compatible to the MediaTek keypad Device Tree binding, fixing an
   attribute name typo in the trackpoint sysfs ABI documentation, and
   documenting that no new LED codes should be added to the input
   subsystem

* tag 'input-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: hp_sdc - shut down kicker timer on module exit
  Input: xpad - add support for Victrix Pro BFG Controller
  Input: tsc2007 - read "ti,poll-period" as u32
  Input: trackpoint - fix the inertia attribute name in the ABI document
  Input: eeti_ts - publish the OF module alias
  Input: xpad - add support for Azeron devices
  Input: xpad - fix PDP Marvel Xbox 360 controller
  Input: document that no new LED codes should be added
  Input: soc_button_array - check btns_desc->package.count
  Input: soc_button_array - fix MS Surface Pro 11 probe failure
  Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
  Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
  Input: cyttsp5 - clamp the HID report size before memcpy
  Input: zero ff_effect before compat copy in input_ff_effect_from_user
  Input: evdev - zero absinfo before partial copy in EVIOCSABS
  Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
  Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
  Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
  dt-bindings: input: mediatek,mt6779-keypad: add mt6572
  Input: adp5588-keys - cache GPIO state before registering the gpiochip
2026-09-20 07:02:34 -07:00
Runyu Xiao 309731e959 Input: hp_sdc - shut down kicker timer on module exit
hp_sdc_kicker() rearms hp_sdc.kicker with mod_timer() after scheduling the
tasklet.  The module exit path uses timer_delete_sync().  That waits for a
callback already running but can still leave the timer rearmed.

A callback can therefore leave the timer pending while hp_sdc_exit() tears
down the driver, allowing timer activity to access dismantled driver state.

Use timer_shutdown_sync() for final teardown.  It waits for a running
callback and prevents rearming after module exit begins.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: [email protected]
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <[email protected]>
Acked-by: Helge Deller <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-13 18:23:13 -07:00
Erich Sartison 971fa7ea86 Input: xpad - add support for Victrix Pro BFG Controller
The controller doesn't currently work via USB-cable.

Signed-off-by: Erich Sartison <[email protected]>
Link: https://patch.msgid.link/[email protected]
Cc: [email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-13 18:21:29 -07:00
Rob Herring (Arm) 55fc280e95 Input: tsc2007 - read "ti,poll-period" as u32
The "ti,poll-period" property is documented as a normal uint32 cell.
The driver used a u64 helper, which makes the helper type disagree with
the schema even though the stored value is still small.

Read "ti,poll-period" with the u32 helper matching the documented DT
cell size.

Assisted-by: Codex:gpt-5-5
Signed-off-by: Rob Herring (Arm) <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-13 18:17:31 -07:00
hpp.iscas a52ae68a93 Input: eeti_ts - publish the OF module alias
The EETI driver matches eeti,exc3000-i2c Device Tree clients, but only
publishes the legacy eeti_ts I2C ID. The I2C core emits an OF modalias
for a Device Tree client.

Publish the existing OF match table within its CONFIG_OF guard.

Fixes: e32d7f1b24 ("Input: eeti - add device tree matching table")
Signed-off-by: hpp.iscas <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-13 18:13:05 -07:00
Roberts Kursitis cba76c0f47 Input: xpad - add support for Azeron devices
Azeron controllers (Cyro, Cyborg, Classic/Compact, Cyro Lefty,
Cyborg II and Keyzen) present a standard Xbox 360 controller
interface, so they work with the existing xpad driver once their
USB IDs are added.

The 0x16d0 vendor ID is a shared block, but this is safe because
xpad only binds interfaces that match the Xbox 360 signature.

Tested with an Azeron Keyzen.

Signed-off-by: Roberts Kursitis <[email protected]>
Cc: [email protected]
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-13 18:08:01 -07:00
Jeremy Nyberg 7bc369cb3d Input: xpad - fix PDP Marvel Xbox 360 controller
The PDP Marvel Xbox 360 controller with USB ID 0e6f:0147 is
incorrectly classified as an Xbox One controller.

With the current XTYPE_XBOXONE classification, the controller is
detected but produces no input, while its four player LEDs continue
blinking indefinitely.

Classify USB ID 0e6f:0147 as an Xbox 360 controller instead.

Tested on a PDP Marvel Xbox 360 controller with USB ID 0e6f:0147.
All inputs register correctly and the player LED indicates the
current player.

Fixes: c225370e01 ("Input: xpad - sync supported devices with 360Controller")
Cc: [email protected]
Signed-off-by: Jeremy Nyberg <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-13 17:46:25 -07:00
Hans de Goede fb5022278b Input: soc_button_array - check btns_desc->package.count
Check that btns_desc->package.count is not 0 before accessing
btns_desc->package.elements[0].

Fixes: 4c3362f449 ("Input: soc_button_array - add support for ACPI 6.0 Generic Button Device")
Cc: [email protected]
Reported-by: Shashiko <[email protected]>
Closes: https://lore.kernel.org/linux-input/[email protected]/
Signed-off-by: Hans de Goede <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-13 16:42:49 -07:00
Hans de Goede ed22ad5fdb Input: soc_button_array - fix MS Surface Pro 11 probe failure
On the MS Surface Pro 11 soc_button_array probing races with the GPIO
driver probing. If soc_button_array wins the race then gpiod_get() returns
EPROBE_DEFER, which should normally take care of retrying later, but
the soc_button_array code deliberately ignores EPROBE_DEFER causing it
to fail its probe() which causes the volume and power buttons to now work.

The ignoring of EPROBE_DEFER is there to deal with a problem specific to
older Bay Trail (BYT) and Cherry Trail (CHT) tablets which often use this
driver. Modify the error handling to only ignore EPROBE_DEFER on BYT and
CHT platforms and propagate EPROBE_DEFER normally on other platforms.

Fixes: bcf0595789 ("Input: soc_button_array - partial revert of support for newer surface devices")
Cc: [email protected]
Reported-by: Sergey Lebedev <[email protected]>
Closes: https://lore.kernel.org/lkml/[email protected]/
Signed-off-by: Hans de Goede <[email protected]>
Tested-by: Sergey Lebedev <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-13 16:42:49 -07:00
Chris Sommers 25e424eb4a Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
On the Acer Aspire Go 15 (AG15-42P), the internal keyboard drops out
~5 seconds after boot on both Linux and Linux-LTS kernels. Keystrokes on
the built-in keyboard stop registering while the trackpad and external
keyboards remain functional.

Testing confirms that booting with the i8042.reset kernel parameter
resolves the issue and keeps the internal keyboard responsive.

Add SERIO_QUIRK_RESET_ALWAYS to i8042_dmi_quirk_table for the Acer
Aspire AG15-42P to automatically apply this quirk on boot.

Signed-off-by: Chris Sommers <[email protected]>
Link: https://patch.msgid.link/[email protected]
Cc: [email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-13 16:27:45 -07:00
Raphaël Larocque 26eb3d92c7 Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
The Lenovo ThinkPad T440p (PNP ID LEN0036, board id 2722) has a
Synaptics touchpad whose SMBus companion is not ready at boot and
takes roughly 200 seconds to appear. During this window the touchpad
and TrackPoint are completely unresponsive on approximately 50% of
boots, making the machine unusable until the companion finally
registers.

The device is in the topbuttonpad_pnp_ids[] SMBus allowlist, so the
kernel attempts to use SMBus/RMI4 mode by default. When the companion
is not ready, psmouse_smbus_init() leaves breadcrumbs and returns
-EAGAIN, the PS/2 fallback path is taken, but the device does not
function properly until the companion appears and RMI4 takes over.

Disable SMBus InterTouch for board id 2722 so the touchpad and
TrackPoint work immediately via PS/2 from boot. Users can still force
SMBus with psmouse.synaptics_intertouch=1 if needed.

Tested-by: Raphaël Larocque <[email protected]>
Signed-off-by: Raphaël Larocque <[email protected]>
Link: https://patch.msgid.link/[email protected]
Cc: [email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-13 16:13:56 -07:00
Kees Cook 3a2c4d55e3 treewide: refresh kmalloc_obj() conversions
This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci

This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.

Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.

Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook <[email protected]>
2026-09-04 21:37:00 -07:00
Linkai Gong 85f080fb87 Input: cyttsp5 - clamp the HID report size before memcpy
The size field comes from the device and is used as the memcpy()
length into response_buf, which is CY_MAX_INPUT bytes.

Fixes: 5b0c03e24a ("Input: Add driver for Cypress Generation 5 touchscreen")
Signed-off-by: Linkai Gong <[email protected]>
Link: https://patch.msgid.link/[email protected]
Cc: [email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-01 07:40:51 -07:00
Iván Ezequiel Rodriguez f84819ef8d Input: zero ff_effect before compat copy in input_ff_effect_from_user
In the compat path input_ff_effect_from_user() aliases the caller's
native struct ff_effect with the smaller struct ff_effect_compat and
copies only the compat sized prefix:

	compat_effect = (struct ff_effect_compat *)effect;

	if (copy_from_user(compat_effect, buffer,
			   sizeof(struct ff_effect_compat)))

The tail of the native structure is never written. Callers pass an
uninitialized on-stack object, for example evdev_do_ioctl() for
EVIOCSFF, so those bytes keep their previous stack contents.
input_ff_upload() then stores the full native structure in
ff->effects[id], from where a uinput based force feedback daemon can
read it back via UI_BEGIN_FF_UPLOAD, disclosing kernel stack memory to
userspace.

Zero the effect before the compat copy.

Fixes: 2d56f3a32c ("Input: refactor evdev 32bit compat to be shareable with uinput")
Cc: [email protected]
Signed-off-by: Iván Ezequiel Rodriguez <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-01 07:38:07 -07:00
Iván Ezequiel Rodriguez 8b852965b8 Input: evdev - zero absinfo before partial copy in EVIOCSABS
The EVIOCSABS handler copies at most the user supplied ioctl size into
an uninitialized on-stack struct input_absinfo:

	if (copy_from_user(&abs, p, min_t(size_t,
			size, sizeof(struct input_absinfo))))

The size comes from _IOC_SIZE() of the ioctl command and is therefore
fully controlled by userspace. A short size leaves the trailing part of
the structure holding whatever was on the kernel stack, and the whole
structure is then stored into the device:

	dev->absinfo[t] = abs;

EVIOCGABS hands that back to userspace, disclosing the stale stack
bytes. Only the resolution field is currently cleared, which covers the
legacy struct layout but not an arbitrarily short size.

Zero the structure before the copy so any part not supplied by the
caller reads back as zero. The existing resolution fixup is kept, since
it also handles a size that partially overlaps that field.

Fixes: 448cd1664a ("Input: evdev - rearrange ioctl handling")
Cc: [email protected]
Signed-off-by: Iván Ezequiel Rodriguez <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-09-01 07:38:07 -07:00
Dmitry Torokhov fe10579b6d Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
Transport drivers (such as rmi_i2c and rmi_spi) invoke
rmi_driver_suspend() and rmi_driver_resume() on their child rmi_dev
device during system power management events. However, transport drivers
are fully registered and operational even if the physical RMI driver
failed to bind or probe the rmi_dev device.

When rmi_driver_suspend() or rmi_driver_resume() is called on an unbound
rmi_dev, dev_get_drvdata() returns NULL. Calling rmi_disable_irq() or
rmi_enable_irq() without driver data attached causes a NULL pointer
dereference and General Protection Fault when attempting to lock
data->enabled_mutex.

Fix this by checking if driver data is attached to rmi_dev in
rmi_driver_suspend() and rmi_driver_resume(), exiting early if
no driver data is present.

Fixes: 2b6a321da9 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=09103639e39c989e3ed3
Cc: [email protected]
Assisted-by: LLM
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-30 14:56:26 -07:00
Dmitry Torokhov 51cfe54f81 Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
When chunking writes into SMBus blocks in rmi_smb_write_block(), the
loop calculates block_len using the original total length (len) instead
of the remaining length (cur_len).

If len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32
for every iteration, even on the final partial chunk where fewer than 32
bytes remain. This causes smb_block_write() to read 32 bytes from the
advanced data buffer pointer, reading past the end of the input buffer.

Fix this by calculating block_len using cur_len and advancing the buffer
and address pointers by block_len.

Fixes: 82264d0cf7 ("Input: synaptics-rmi4 - add SMBus support")
Cc: [email protected]
Reported-by: [email protected]
Assisted-by: LLM
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-30 14:42:00 -07:00
Alexei Turtanov aefbda23ee Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
The internal keyboard of the Xiaomi Redmi Book Pro 16 2026 (board TM2425)
does not work: atkbd_probe() succeeds and every command is ACKed, but no
scancodes ever arrive afterwards.

Testing on the hardware through serio_raw shows that ATKBD_CMD_RESET_DIS
(0xF5) is the culprit. After 0xF5 the embedded controller keeps ACKing
commands but stops delivering scancodes, and neither ATKBD_CMD_ENABLE
(0xF4) nor ATKBD_CMD_RESET_BAT (0xFF) bring them back. Only re-enabling
the keyboard interface at the controller level (i8042 command 0xAE, or
rewriting the command byte as i8042_port_close() does) revives it.
Running the init sequence without 0xF5 (0xED 0x00, 0xF3 0x00, 0xF4)
keeps the keyboard working.

'i8042.dumbkbd=1' also works around this, but then the driver never
writes to the keyboard and the LEDs cannot be controlled. Use the
existing atkbd_deactivate_fixup quirk instead, as done for the sibling
TM2424 by commit 3a046db33b ("Input: atkbd - skip deactivate for
Xiaomi Book Pro 14's internal keyboard"). Tested on v7.2: keyboard,
Caps Lock LED and s2idle suspend/resume all work.

DMI: XIAOMI REDMI Book Pro 16 2026/TM2425, BIOS RMAPT6B0P0909 05/22/2026

Fixes: 9cf6e24c9f ("Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID")
Cc: [email protected]
Signed-off-by: Alexei Turtanov <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-28 05:03:22 -07:00
Alvin Šipraga 21efadc622 Input: adp5588-keys - cache GPIO state before registering the gpiochip
So as not to clobber any pre-programmed GPIO state in the execution
of its gpiochip ops, the driver caches things during probe time.
However, since those ops can be called both during and immediately after
the call to devm_gpiochip_add_data(), it is imperative that things are
cached before that. That's not the case right now, so reorder the two
steps to prevent any clobbering.

In the concrete example which motivated this change, a bootloader was
preconfiguring an important GPIO output to HIGH before booting the
kernel. Linux would then inadvertently set that output to LOW while
configuring a GPIO hog on a discrete GPIO line within the same 8-bit
bank (because the cached value was 0=LOW).

Fixes: ba9f507a1b ("Input: adp5588-keys - export unused GPIO pins")
Signed-off-by: Alvin Šipraga <[email protected]>
Reviewed-by: Nuno Sá <[email protected]>
Link: https://patch.msgid.link/[email protected]
Cc: [email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-26 05:23:44 -07:00
Linus Torvalds 93e4b3076b Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc/IIO/etc driver updates from Greg KH:
 "Here is the big set of char, misc, iio, counter, fpga, and other small
  driver subsystems for 7.3-rc1.

  Overall, due to some driver removals we only added a bit more code
  than removed, which was a nice change. Highlights in this merge
  request are:

   - Loads of IIO driver updates and additions

   - binder driver updates (more on that below...)

   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall

   - Removal of the obsolete ibmasm driver as it's not being used
     anymore

   - Coresight driver updates and additions

   - Mei driver udpates

   - Counter driver updates

   - FPGA driver updates

   - ICC driver updates

   - lots and lots of other tiny driver updates to resolve reported
     issues

  All of these have been in linux-next for a while"

* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
  iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
  iio: adc: pac1921: fix wrong channel used in trigger handler read
  iio: light: gp2ap002: re-enable irq if runtime suspend fails
  iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
  iio: light: apds9306: fix PM reference leak in apds9306_read_data()
  iio: gyro: mpu3050: fix sign of raw angular velocity readings
  iio: srf04: fix pm_runtime handling on probe error path
  iio: adc: ad4080: configure backend data size
  iio: adc: adi-axi-adc: add data size support for AD408X backend
  iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
  iio: dac: ad5446: fix OF module device table
  iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
  iio: light: opt4001: Reject integration times with a non-zero seconds part
  iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
  iio: light: opt4001: Fix power down clearing bits of the wrong register
  iio: light: opt4060: Fix incorrect register name in threshold read error message
  iio: light: opt4060: Fix pointer type passed to div_u64_rem()
  iio: light: opt4060: Reject integration times with a non-zero seconds part
  iio: light: ltrf216a: fix runtime PM reference leak in error path
  iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
  ...
2026-08-25 09:38:50 -07:00
Linus Torvalds a93f3bf4e1 Merge tag 'hid-for-linus-2026081901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
Pull HID updates from Jiri Kosina:
 "Core:
   - fix long-standing force-feedback initialization race across the
     subsystem (Dmitry Torokhov)
   - switch to system_dfl_wq (Marco Crivellari)

  AMD-SFH:
   - support for tablet-mode switch for AMD SFH-based systems (Basavaraj
     Natikar)

  HyperX:
   - support for HyperX QuadCast 2 (Benjamin Blume)

  I2C-HID:
   - support for devices that provide HID descriptor solely through
     the ACPI _DSM method (XIE Zhibang)

  Intel-THC-HID:
   - support for full I2C bus config parameters (Even Xu)

  Logitech:
   - HID++ 2.0 repogrammable button support (Elliot Douglas)
   - Bolt receiver support for HID++ devices (Erik Håkansson)

  MSI:
   - support for MSI Claw (Derek J. Clark)

  Steam:
   - initial support for 2026 Steam Controller (Vicki Pfau)
   - support for sensor events on the 2025 Steam Controller (Vicki Pfau)

  And many, many other fixes for various long standing issues that were
  found by new modern tools, and quite a few device ID additions"

* tag 'hid-for-linus-2026081901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (146 commits)
  HID: tmff: Use 64-bit arithmetic for force feedback scaling
  HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU
  HID: sensor: custom: Fix field sysfs group cleanup on failure
  HID: sensor: custom: Fix use-after-free in enable_sensor
  HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
  HID: haptic: don't write an uninitialized value to unhandled usages
  HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown
  HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown
  HID: steam: Zero out inputs when disabling gamepad mode
  HID: steam: Clean up locking
  HID: steam: Don't set feature reports when disconnecting
  HID: steam: Fix wording of connect/disconnect logs
  HID: steam: Initial 2026 Steam Controller support
  HID: steam: Refactor registration
  HID: logitech: add Bolt receiver support for Logitech HID++ devices
  HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
  HID: universal-pidff: stop the device when force-feedback init fails
  HID: haptic: move FF initialization into .input_configured()
  HID: logitech-hidpp: move FF initialization to .input_configured()
  HID: megaworld: move FF initialization to .input_configured()
  ...
2026-08-19 10:00:31 -07:00
Linus Torvalds 7711f4417f Merge tag 'gpio-updates-for-v7.3-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio updates from Bartosz Golaszewski:
 "GPIO core:
   - extend the gpio-regmap abstraction layer with more features
     allowing users to override configuration setting, translate
     register values and masks and enable/disable interrupts
   - extend GPIO kunit tests with suites verifying probe ordering by
     software node devlink support and software node hogs
   - shrink GPIO kunit initialization code
   - coding style updates (remove commas from sentinels where
     applicable)
   - with all users now converted treewide to using real firmware node
     links for software node GPIO lookup: remove the deprecated
     label-matching mechanism from from GPIO core
   - drop redundant return value check of nonseekable_open() in
     gpiolib-cdev
   - use IRQ trigger helpers where applicable

  Driver updates:
   - refactor error paths and logging in gpio-nomadik
   - use more modern interfaces for getting resources in gpio-rockchip,
     gpio-bt8xx and gpio-pca9570
   - add missing MODULE_DEVICE_TABLE() to gpio-sifive and gpio-vf610
   - drop unused FILONOFF macro from gpio-rcar
   - extend build coverage of ioport GPIO drivers with COMPILE_TEST=y
   - only enable the gpio-rtd driver by default with ARCH_REALTEK=y to
     avoid bloating the build
   - refactor coding style in several drivers
   - use correct endianess translation in gpio-pcf85x
   - add wake-up interrupt support to gpio-mvebu
   - apply initial value in direction output setter in gpio-by-pinctrl

  Misc:
   - replace linux/gpio.h inclusions treewide with linux/gpio/legacy.h
     which now exports all the deprecated APIs
   - select GPIOLIB_LEGACY in Kconfig where required treewide
   - use software nodes for gpio-keys in MFD drivers

  Devicetree bindings:
   - describe the realtek rtd1625 GPIO controller
   - document new models for gpio-pca95xx and gpio-cadence
   - document new property in gpio-rockchip"

* tag 'gpio-updates-for-v7.3-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (61 commits)
  gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper
  dt-bindings: gpio: rockchip,gpio-bank: Add rockchip,grf property
  gpio: Use IRQ trigger mask helpers
  gpio: allow COMPILE_TEST for IOPORT drivers
  gpio: realtek: Add driver for Realtek DHC RTD1625 SoC
  gpio: regmap: Add IRQ enable/disable helpers
  gpio: regmap: Add set_config callback
  gpio: regmap: Add value_xlate callback
  gpio: regmap: Add gpio_regmap_operation to extend reg_mask_xlate callback
  gpio: regmap: Order kernel-doc descriptions with the actual appearance
  gpio: regmap: Apply default resource callbacks for regmap IRQ chip
  gpio: regmap: Provide default IRQ resource request and release callbacks
  Revert "gpio: realtek: Add driver for Realtek DHC RTD1625 SoC"
  gpib: gpio: replace linux/gpio.h inclusion
  Input: matrix_keyboard - replace linux/gpio.h inclusion
  phy: replace linux/gpio.h inclusions
  pcmcia: replace linux/gpio.h inclusions
  ASoC: replace linux/gpio.h inclusions
  mfd: replace linux/gpio.h inclusions
  sh: replace linux/gpio.h inclusions
  ...
2026-08-19 09:10:07 -07:00
Greg Kroah-Hartman 258ad62593 Merge tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next
Jonathan writes:

IIO new device support, features, cleanup for 7.3

Includes a merge of 7.2-rc2 to pick up the changes around
mod_devicetable.h and reduce resulting conflicts around includes.

New device support
------------------

adi,ad3530R
- Add support for the AD3532R and AD3532 16 channel DACs.
adi,ad4080
- Add support for the AD4883 ADC.
adi,ad5686
- Add support for AD5313R, AD5317R, AD5674, AD5687R, AD5689, AD5689R DACs
  over SPI
- Add support for AD5316R, AD5674, AD5697R and AD5696 DACs over I2C
- Significant driver refactoring prior to these additions, partly to reduce
  bus traffic and to add triggered buffer and gain control support. An
  earlier set added support for missing supplies, reset and LDAC GPIO.
adi,adf41513
- New driver to support this PLL frequency synthesizer that runs up to
  26.5 GHz.
- Included infrastructure to handle higher precision attributes with
  extensive tests
adi,ltc2378-20
- New driver supporting LTC2338, LTC2364, LTC2367, LTC2368, LT2369, LTC2370
  LTC2376, LTC2377, LTC2378, LTC2379 and LTC23980 ADCs with both high speed
  capture via appropriate backend and conventional triggered buffer SPI
  capture.
invensense,icm42607
- New driver for this IMU.
mediateck,mt6323
- New driver for this PMIC ADC.
microchip,mcp47a1
- New driver for this I2C 6 bit DAC.
nxp,mcf54415-dac
- New driver for this DAC found in NXP SoCs.
qst,qmc5884l
- New driver for this 3 axis magnetometer. Included dt vendor entry for qst.
qst,qmc6308
- New driver for this 3 axis magnetometer.
sensiron,slf3s
- New driver for this liquid flow sensor. Includes adding IIO_VOLUMEFLOW
  channel type.
st,vl53l1x
- Refactors to improve readability.
ti,ads112c14
- New driver supporting the ADS112C14 and ADS122C14 ADCs. These bring
  some new ABI for input chopping, particular useful for resistive sensors
  like thermocouples or Wheatstone bridges.
- Support CRC8 detection of corruption on the bus.
- Support buffered reads.
ti,tmp117
- (trivial) Add support for the tmp119 temperature sensor.
xilinx,versal-sysmon
- New ADC driver for this block found on various FPGAs including various
  bus interfaces, threshold and oversampling support.

dt binding updates
------------------
new shared bindings
- excitation-channels and excitation-current-nanoamp allow per channel
  specification of currents used for resistive sensor measurement.
- reference-sources property to allow selection of a per channel reference.
rockchip,saradc
- Add RV1106 which is compatible with the RV3588.

Features
--------

buffer-dmaengine
- Allow cyclic buffers, useful for repeating sequence generation with DACs.
devantech,dmard09
- Implement read back of channel scale - previously interface always
  returned an error.
hid,sensors-als
- Enable separate channel scaling for hardware that supports it.
invensense,timestamp library
- Various precision improvements.
invensense,icm42600
- Add support for hwfifo watermark interfaces.
taos,tcs3472
- Support wait time and sampling frequency control.

Cleanups, minor fixes
---------------------

Minor cleanups not mentioned at all in this summary such
as white space fixes or typos.

Affecting various drivers
- Cleanup of conditionals that had no affect.
- Drop some runtime pm local wrappers as now runtime_pm does the
  mark_last_busy part inside the put, these provide no useful code
  deduplication or readability advantages over directly calling the
  runtime_pm functions.
- Return 0 from write_raw() on success.
- Use of dev_err_probe() to simplify code and sometimes provide useful
  info for deferred probe debugging.
- Drop some redundant error prints where the called function already
  provides information on errors.
- Make some read only arrays in functions static.
- Fix up missing handling of regcache_sync() errors.
- Drop some false kernel-doc markings.
- Add missing MODULE_DEVICE_TABLE for some of_match_id tables.
- Use local variables for things like the struct device to shorten and
  improve readability of code.
- Drop some unused structure elements.
- Reorder dds.h macro parameters to be inline with others.
- Header reorders and IWYU. Often part of a more significant series.
- Remove abstractions designed to allow a driver to support multiple device
  types, when they have been around a long time and only the original part
  showed up.
- Initialize spi_device_id arrays using member names following dropping of
  driver data from drivers that didn't actually use it.
- Catch up with i2c_device_id tables added since previous effort to use
  named initializers for all those.
- Use kernel types in a few places instead of standard C ones or bare
  unsigned.

Misc
- Update Xilinx AMS maintainer.
- Update email address for Maxwell Doose.
- Update email address for Siratul Islam.
- Update email address for Tomasz Duszynski and re-add Tomasz to
  various maintainer entries.
Docs
- Encourage use of differential channel naming even when there is no
  flexibility in input to differential pair mapping. Intended to
  provide a strong signal to userspace that a channel is differential.
adi,ad_sigma_delta
- Allow COMPILE_TEST without any users.
adi,ad2s1201
- Refactor trigger handler to avoid mix of guard() and goto.
adi,ad5686
- Avoid potential NULL dereference is user forces a driver bind.
adi,ad5696
- Add a couple of missing entries to the of_match_id table and update
  binding to match.
atmel,ad91_adc
- Use const char * for DT string property allowing a cast to be dropped.
avia,hx711
- Various refactors and cleanup to enable support of additional parts
  (to come)
- Add missing supply and gpio dt-bindings.
bosch,bmc150
- Harden against device reporting too large a FIFO sample count.
- Use FIELD_PREP() / FIELD_GET() to improve readability.
freescale,fxls8962af
- Harden against device reporting too large a FIFO sample count.
hid-sensors-*
- Reorder probe to not expose userspace interfaces until the rest of
  the setup is done to avoid potentially dropping data.
honeywell,abp2030pa
- Drop an unreachable return.
invensens,icm45600
- Harden against bad value of FIFO sample count from device.
- Use i2c_match_data if firmware table sourced match data isn't available.
nxp,mpl1115
- Ensure runtime_pm is balanced on error in probe.
rohm,bm1390
- Make the driver slightly more likely to recover from transient errors.
sensiron,sgp30
- Handle thread creation errors.
st,lsm6dsx
- Update the enable mask when doing sensor fusion to avoid incorrect fifo
  data handling.
st,stm32-dfsdm
- Treat dt flags as booleans.
ti,ads1015
- Switch to devm helpers which simplified code and closed a resource leak.
ti,opt3001
- Split complicated opt3001_get_processed() logic into irq an no irq
  helper functions.
- Use devm to simplify code.
- Use guard() to simplify code.
- Reorder probe so final call exposes userspace interfaces.
- Various other more minor cleanup
taos,tsl2772
- Fix calibscale readback to check right channel type.
taos,tsl2583
- Use sysfs_emit() and sysfs_emit_at() to replace open coded equivalents.

* tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (232 commits)
  iio: dac: mcp47a1: add support for new device
  dt-bindings: iio: dac: add support for mcp47a1
  iio: Update email for Maxwell Doose
  iio: imu: st_lsm6dsx: Update enable mask when using sensor fusion
  iio: light: cm32181: return zero after writing calibscale
  iio: flow: add Sensirion SLF3S liquid flow sensor driver
  iio: core: add IIO_VAL_DECIMAL64_FEMTO format type
  dt-bindings: iio: flow: add Sensirion SLF3S liquid flow sensor
  iio: types: add IIO_VOLUMEFLOW channel type
  iio: ABI: Encourage differential voltage ABI usage
  iio: adc: ltc2378: Add support for LTC2338-18
  iio: adc: ltc2378: Enable triggered buffer data capture
  iio: adc: ltc2378: Enable high-speed data capture
  iio: adc: ltc2378: Add support for LTC2378-20 and similar ADCs
  dt-bindings: iio: adc: Add ltc2378
  iio: magnetometer: ak8974: remove conditional return with no effect
  iio: light: tsl2583: remove conditional return with no effect
  iio: adc: rcar-gyroadc: remove rcar_gyroadc_set_power() helper
  iio: light: vcnl4000: remove vcnl4000_set_pm_runtime_state() helper
  iio: light: vcnl4035: remove vcnl4035_set_pm_runtime_state() helper
  ...
2026-08-19 09:45:01 +02:00
Bartosz Golaszewski 146cc263e4 Merge tag 'v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-next
Linux 7.2
2026-08-18 14:21:04 +02:00
Linus Torvalds 15ef2f78c4 Merge tag 'input-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:

 - A couple of fixes to the sur40 touchscreen driver to correct
   registration and teardown ordering, and to fix error path
   unwinding when video device registration fails.

* tag 'input-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: sur40 - fix V4L error path cleanup
  Input: sur40 - fix input device registration ordering
2026-08-14 21:51:26 -07:00
Dmitry Torokhov b4d85f863e Merge branch 'next' into for-linus
Prepare input updates for 7.3 merge window.
2026-08-14 21:26:07 -07:00
Basavaraj Natikar b472474e28 Input: misc: Add AMD SFH tablet-mode switch driver
Report whether an AMD convertible is in laptop or tablet mode using the
operating-mode sensor provided by the Sensor Fusion Hub, and expose it
to userspace as SW_TABLET_MODE, so userspace can react to the device
being folded into tablet posture.

Cc: Helge Bahmann <[email protected]>
Signed-off-by: Basavaraj Natikar <[email protected]>
Acked-by: Dmitry Torokhov <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
2026-08-14 14:43:46 +02:00
David Heidelberg 9a29ee801f Input: rmi4 - use platform data instead of query, when available
Platform data may define touchscreen-x-mm and touchscreen-y-mm, but
these were quietly overridden by data provided by sensor.

Signed-off-by: David Heidelberg <[email protected]>
Link: https://patch.msgid.link/[email protected]
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-13 12:13:43 -07:00
Dmitry Torokhov 062dc4693e Input: sur40 - fix V4L error path cleanup
In sur40_probe(), if video_register_device() fails, the error path jumps to
err_unreg_video. This incorrectly attempts to unregister a video device
that was never successfully registered, and fails to free the V4L2 control
handler (v4l2_ctrl_handler_free) that was initialized immediately prior.

Fix this by introducing an err_free_ctrl label to properly free the V4L2
control handler and bypass video_unregister_device() when video device
registration fails.

Reported-by: [email protected]
Cc: [email protected]
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-12 17:51:54 -07:00
Dmitry Torokhov 9da976eb64 Input: sur40 - fix input device registration ordering
In sur40_probe(), input_register_device() was previously called early before
the V4L2 video device and vb2_queue components were fully initialized. If
userspace opened the input device immediately upon registration, sur40_open()
would trigger and start the sur40_poll() worker thread. This worker thread
invokes sur40_process_video() and accesses the uninitialized vb2_queue
structure, leading to a data race and potential system crash.

Furthermore, if V4L2 or video registration failed after input_register_device()
succeeded, the error path fell through to calling input_free_device() on a
successfully registered device instead of input_unregister_device(), corrupting
input core state.

Move input_register_device() to the very end of sur40_probe(). This ensures
the V4L2 and video queue structures are fully initialized before polling can
start, and naturally resolves the error path bug since input_free_device()
is now only called when input registration has not yet occurred.

To maintain strict LIFO (Last-In, First-Out) teardown ordering, also move
input_unregister_device() to the very beginning of sur40_disconnect(). This
guarantees that the input polling worker thread is stopped before V4L2
video components or control handlers are unregistered.

Reported-by: [email protected]
Cc: [email protected]
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-12 17:51:48 -07:00
Chen-Yu Tsai c91d080c4e Input: elan_i2c - sort include statements
Sort the include statements before adding new ones in the next change.

Reviewed-by: Andy Shevchenko <[email protected]>
Signed-off-by: Chen-Yu Tsai <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-12 17:44:06 -07:00
Jingle Wu 吳金國 ad255410cb Input: elan_i2c - optimize update speed for IC Type 0x19.
Reduce update time by optimizing the update sequence and removing
unnecessary delays.

Signed-off-by: [email protected]
Link: https://patch.msgid.link/KL1PR01MB5116A253A126179473EDB7ACDCCA2@KL1PR01MB5116.apcprd01.prod.exchangelabs.com
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-12 17:37:45 -07:00
Linus Torvalds 7d8c681eef Merge tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input updates from Dmitry Torokhov:

 - Fixes for information leaks and OOB accesses across several drivers,
   including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra

 - Improvements to the synaptics-rmi4 driver to properly handle F54
   worker errors and prevent buffer overflows

 - Input validation fixes in the hynitron_cstxxx touchscreen driver to
   prevent issues with invalid finger IDs and touch counts

 - Fixes for use-after-free and initialization bugs in the byd mouse and
   psxpad-spi drivers

 - New quirks for the atkbd driver to make keyboard work on HONOR and
   Xiaomi laptops

 - Support for the ZENAIM LEVERLESS controller in the xpad driver.

* tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: evdev - sanitize event type index when fetching event masks
  Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
  Input: synaptics-rmi4 - block s_input when F54 queue is busy
  Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
  Input: synaptics-rmi4 - zero report size on F54 work error
  Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
  Input: hynitron_cstxxx - validate touch count and finger IDs
  Input: evdev - fix information leak in evdev_pass_values()
  fixp-arith: convert comments to kernel-doc format
  Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
  Input: atkbd - skip deactivate for HONOR ZQC-P
  Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
  Input: iforce - validate input packet lengths
  Input: psxpad-spi - set driver data before use
  Input: cs40l50-vibra - validate custom data from user space
  Input: xpad - add support for ZENAIM LEVERLESS
  Input: edt-ft5x06 - ignore contacts with an out-of-range slot id
  Input: byd - synchronize timer deletion before freeing private data
2026-08-08 07:09:35 -07:00
Dmitry Torokhov 3abd29c61d Input: evdev - sanitize event type index when fetching event masks
The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK
ioctls is used to index the static counts array in evdev_get_mask_cnt()
and client evmasks array in evdev_get_mask().

While the event type is architecturally bounded by EV_CNT, speculative
execution may mispredict bounds checks and perform out-of-bounds loads.

Sanitize the event type index in evdev_get_mask_cnt() branchlessly using
array_index_mask_nospec(). This clamps the index to 0 for safe array
access and forces the returned count to 0 speculatively when the index
is out of bounds.

We do not need additional array_index_nospec() calls in evdev_get_mask()
because evdev_get_mask_cnt() speculatively forces the count (and
resulting xfer_size) to 0 for out-of-bounds types, preventing any
speculative memory access to client evmasks array.

Reported-by: "Wagenaar, C.C.J. (Chris)" <[email protected]>
Cc: [email protected]
Assisted-by: Antigravity:gemini-3.6-flash
Acked-by: Greg Kroah-Hartman <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-05 23:04:05 -07:00
Dmitry Torokhov 8c3ff3164b Input: reject inhibit and uninhibit requests on unregistering devices
When an input device is being unregistered via input_unregister_device(),
input_disconnect_device() sets dev->going_away = true under dev->mutex
and releases the mutex.

If a concurrent sysfs write to the inhibited attribute executes
input_inhibit_device() or input_uninhibit_device(), it acquires
dev->mutex. Because neither function checks dev->going_away (unlike
input_open_device()), input_uninhibit_device() proceeds to call
dev->open() and start polling on a device that is in the middle of being
unregistered and torn down.

Fix this by checking dev->going_away in input_inhibit_device() and
input_uninhibit_device() under dev->mutex and returning -ENODEV if the
device is going away.

Fixes: a181616487 ("Input: Add "inhibited" property")
Reported-by: [email protected]
Assisted-by: Antigravity:gemini-3.6-flash
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-05 23:01:44 -07:00
Dmitry Torokhov 876848ad22 Input: defer handler's start() until device is opened
When registering an input handle, handler->start() is currently called
immediately. However, the input device might not be fully opened or
ready to process events at this stage, meaning any state synchronization
events (like setting LED states) injected by the handler's start method
might be dropped.

Move the handler->start() invocation to input_open_device(). If it is
the first handle opening the device, start() is called after the driver's
open() method has successfully completed and the device is fully prepared.

To facilitate this, factor out the device startup logic (calling driver's
open and starting polling) into input_start_device().

For passive observer handlers, their start() method is also deferred
until the handle is opened. Since opening a passive observer handle does
not start the underlying hardware device, their start() method is called
immediately upon opening, regardless of whether the device is active.

Fixes: c7e8dc6ee6 ("Input: add start() method to input handlers")
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-05 23:01:44 -07:00
Dmitry Torokhov ceda733d49 Input: call handler->start() when uninhibiting device
When an input device is inhibited via input_inhibit_device(), the driver
is closed and physical feedback (like LEDs and sounds) is toggled off.
However, from the input core's perspective, the handles remain open.

When the device is later uninhibited, the driver is re-opened. While the
core restores simple LED states via input_dev_toggle(), complex handlers
(such as vt/keyboard) may need to re-synchronize their broader logical
state with the hardware.

Fixes: a181616487 ("Input: Add "inhibited" property")
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-05 23:01:44 -07:00
Dmitry Torokhov 34135f0540 Input: clear inhibited flag before re-opening device on uninhibit
When uninhibiting a device, we previously called dev->open() and started
the poller before clearing dev->inhibited. Since drivers (like
gpio_keys) often report initial state during open(), and pollers report
events immediately upon starting, these initial events were dropped by
input_get_disposition() because dev->inhibited was still true.

Fix this by clearing dev->inhibited before calling dev->open(), ensuring
initial events are delivered to handlers, and restoring dev->inhibited =
true if dev->open() fails.

Fixes: a181616487 ("Input: Add "inhibited" property")
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-05 23:01:44 -07:00
Dmitry Torokhov 35f0a0dced Input: ensure device is ready before delivering events
When a device is opened via input_open_device(), the driver's open()
callback is invoked. Some drivers, like cm109, submit URBs or perform
other hardware initialization in their open() callbacks.

However, the input core does not prevent dev->event() from being called
concurrently during the driver's open() execution. For instance, if a
console beep occurs, the kbd handler might inject an EV_SND event. This
can lead to double list_add BUGs if the driver submits the same URB in
both open() and event() paths without adequate synchronization.

To fix this, introduce a ready flag in the input_dev structure.
For complex devices (where dev->open is defined), this flag is set to true
only after the driver's open() method successfully completes. The core now
checks ready in input_event_dispose() and input_dev_toggle()
to prevent events from reaching the hardware before it is fully prepared.
For simple devices (no open callback), events are delivered immediately.

We also replay the logical state in input_open_device() by calling
input_dev_toggle() right after marking the device ready, ensuring no
events are permanently lost.

In the inhibit path, we ensure that physical feedback (LEDs/sounds) is
turned off before the device is closed, and we synchronize the inhibited
state transition under the event lock to prevent races with incoming events.

Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-05 23:01:44 -07:00
Dmitry Torokhov e07c509ad6 Input: gscps2 - supply PA-RISC keyboard keymap via device property
Instead of hardcoding PA-RISC specific keycode tables into atkbd via
compile-time inclusion, have the gscps2 PS/2 port driver attach a
linux,keymap software node device property to the serio device when
a keyboard port is registered. This allows atkbd to dynamically fetch
and apply the custom keymap when probing the port using generic
firmware property helpers, removing architecture-specific hacks from
generic keyboard driver code.

Co-locate the keymap definitions with the serio port driver by moving
hpps2atkbd.h from drivers/input/keyboard/ to drivers/input/serio/.
To handle the five conflicting keys on RDI PrecisionBook laptops without
runtime model string checks or duplicate keymap tables in memory, add
CONFIG_SERIO_GSCPS2_RDI_KEYCODES to drivers/input/serio/Kconfig and
resolve the conflicting keycodes at compile time via preprocessor
macros.

Link: https://patch.msgid.link/[email protected]
Acked-by: Helge Deller <[email protected]>
Tested-by: Helge Deller <[email protected]>
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-05 22:45:01 -07:00
Dmitry Torokhov 8786d74bf5 Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Previously, rmi_f54_buffer_queue() waited for the worker thread to
finish but ignored whether it succeeded. If the worker failed (e.g.,
due to a timeout or register read failure), the queue thread would
silently return success, delivering stale or uninitialized memory to
userspace.

Add a 'report_error' field to struct f54_data to store the worker's exit
status. Check this field in rmi_f54_buffer_queue() after the worker
finishes, and mark the buffer as VB2_BUF_STATE_ERROR if an error
occurred.

Fixes: 3a762dbd53 ("[media] Input: synaptics-rmi4 - add support for F54 diagnostics")
Reported-by: [email protected]
Cc: [email protected]
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-05 10:09:53 -07:00
Sang-Heon Jeon f523729aa1 Input: synaptics_i2c - return 0 explicitly on success
error is always zero at the last return in synaptics_i2c_reg_set().
Explicitly return 0 on the success path instead of returning error,
which is the preferred way when there are multiple failure points.

No functional change.

Signed-off-by: Sang-Heon Jeon <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-04 21:27:53 -07:00
Sang-Heon Jeon 5005fa1445 Input: rmi_smbus - remove conditional return with no effect
Both branches of the check return the same value, so the check has no
effect. Remove it and return the value directly.

This is the result of running the Coccinelle script from
scripts/coccinelle/misc/cond_return_no_effect.cocci.

Signed-off-by: Sang-Heon Jeon <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-04 21:27:53 -07:00
Sang-Heon Jeon f6efbdcecd Input: pmic8xxx-keypad - remove conditional return with no effect
Both branches of the check return the same value, so the check has no
effect. Remove it and return the value directly.

This is the result of running the Coccinelle script from
scripts/coccinelle/misc/cond_return_no_effect.cocci.

Signed-off-by: Sang-Heon Jeon <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
2026-08-04 21:27:53 -07:00