Commit graph

1,768 commits

Author SHA1 Message Date
Linus Torvalds
7711f4417f gpio updates for v7.3-rc1
GPIO core:
 - extend the gpio-regmap abstraction layer with more features allowing users
   to override configuration setting, translate register values and masks and
   enable/disable interrupts
 - extend GPIO kunit tests with suites verifying probe ordering by software
   node devlink support and software node hogs
 - shrink GPIO kunit initialization code
 - coding style updates (remove commas from sentinels where applicable)
 - with all users now converted treewide to using real firmware node links for
   software node GPIO lookup: remove the deprecated label-matching mechanism
   from from GPIO core
 - drop redundant return value check of nonseekable_open() in gpiolib-cdev
 - use IRQ trigger helpers where applicable
 
 Driver updates:
 - refactor error paths and logging in gpio-nomadik
 - use more modern interfaces for getting resources in gpio-rockchip,
   gpio-bt8xx and gpio-pca9570
 - add missing MODULE_DEVICE_TABLE() to gpio-sifive and gpio-vf610
 - drop unused FILONOFF macro from gpio-rcar
 - extend build coverage of ioport GPIO drivers with COMPILE_TEST=y
 - only enable the gpio-rtd driver by default with ARCH_REALTEK=y to avoid
   bloating the build
 - refactor coding style in several drivers
 - use correct endianess translation in gpio-pcf85x
 - add wake-up interrupt support to gpio-mvebu
 - apply initial value in direction output setter in gpio-by-pinctrl
 
 Misc:
 - replace linux/gpio.h inclusions treewide with linux/gpio/legacy.h which now
   exports all the deprecated APIs
 - select GPIOLIB_LEGACY in Kconfig where required treewide
 - use software nodes for gpio-keys in MFD drivers
 
 Devicetree bindings:
 - describe the realtek rtd1625 GPIO controller
 - document new models for gpio-pca95xx and gpio-cadence
 - document new property in gpio-rockchip
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmqET1QACgkQBZ0uy/82
 hMMXLRAArm8tuPq9ehmJIBwSxXmK4HGM9x2PBXBOtv7NZ4x5skSpsMOmJBlb9r3S
 EJ7IK7DIqb1XIilRxgfLwmza9e4wXEQ3OK7lrxx/9qW52XKvJ0JxoUhEw4vn9etJ
 N3qc4p2EByR98PLWrnPmcDyG8oZDzBixcDsaeuvulIDtFklTpTRH0FHuEJQ1sEfa
 2y7/K6/n2Gru56u2iTjW8AIIfG18h2SG9Pm92UL006O6Xl8bKHexrmb98WEpIKoU
 UzKGgQ/alnOFsevt6zuB30StX6qKmagdu1+dRpVypczBaoUjs6YG4EfJQJ0mw/vR
 qBzui/HsGwYlkMmHgVoqSbm0khIS9vd85NSVTk/jC45+ZGyJRmdCJh30VBpXjOy4
 3zEVrZUo0kMIW/foszAqCZrn1P5kpmlwXR3oP89NwMzzEQQFzVjdirXih+dmhq0e
 /nxUjAY2CmEXd4wep183Swobqadi2tyuktWnE1mz/YH2Tv/KlMzzwIQEXyd4jSOc
 gOh8ACVp/wdsvihF+E/kjuRaLs3JX5nvoIMQu0CZAAl6TAYmCrXJbMDSLncY/4jv
 sCWuUVEowR3V+1RpVD++eIOsrD8ItNdn0aY3aXL1ez7oUCsisI651oRUCS/is1S/
 fw4DN5gTdNt+iNUWHIJM3lOPjTPO6hCPXAyht3B6pibCibiI1Dk=
 =rUDt
 -----END PGP SIGNATURE-----

Merge tag 'gpio-updates-for-v7.3-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio updates from Bartosz Golaszewski:
 "GPIO core:
   - extend the gpio-regmap abstraction layer with more features
     allowing users to override configuration setting, translate
     register values and masks and enable/disable interrupts
   - extend GPIO kunit tests with suites verifying probe ordering by
     software node devlink support and software node hogs
   - shrink GPIO kunit initialization code
   - coding style updates (remove commas from sentinels where
     applicable)
   - with all users now converted treewide to using real firmware node
     links for software node GPIO lookup: remove the deprecated
     label-matching mechanism from from GPIO core
   - drop redundant return value check of nonseekable_open() in
     gpiolib-cdev
   - use IRQ trigger helpers where applicable

  Driver updates:
   - refactor error paths and logging in gpio-nomadik
   - use more modern interfaces for getting resources in gpio-rockchip,
     gpio-bt8xx and gpio-pca9570
   - add missing MODULE_DEVICE_TABLE() to gpio-sifive and gpio-vf610
   - drop unused FILONOFF macro from gpio-rcar
   - extend build coverage of ioport GPIO drivers with COMPILE_TEST=y
   - only enable the gpio-rtd driver by default with ARCH_REALTEK=y to
     avoid bloating the build
   - refactor coding style in several drivers
   - use correct endianess translation in gpio-pcf85x
   - add wake-up interrupt support to gpio-mvebu
   - apply initial value in direction output setter in gpio-by-pinctrl

  Misc:
   - replace linux/gpio.h inclusions treewide with linux/gpio/legacy.h
     which now exports all the deprecated APIs
   - select GPIOLIB_LEGACY in Kconfig where required treewide
   - use software nodes for gpio-keys in MFD drivers

  Devicetree bindings:
   - describe the realtek rtd1625 GPIO controller
   - document new models for gpio-pca95xx and gpio-cadence
   - document new property in gpio-rockchip"

* tag 'gpio-updates-for-v7.3-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (61 commits)
  gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper
  dt-bindings: gpio: rockchip,gpio-bank: Add rockchip,grf property
  gpio: Use IRQ trigger mask helpers
  gpio: allow COMPILE_TEST for IOPORT drivers
  gpio: realtek: Add driver for Realtek DHC RTD1625 SoC
  gpio: regmap: Add IRQ enable/disable helpers
  gpio: regmap: Add set_config callback
  gpio: regmap: Add value_xlate callback
  gpio: regmap: Add gpio_regmap_operation to extend reg_mask_xlate callback
  gpio: regmap: Order kernel-doc descriptions with the actual appearance
  gpio: regmap: Apply default resource callbacks for regmap IRQ chip
  gpio: regmap: Provide default IRQ resource request and release callbacks
  Revert "gpio: realtek: Add driver for Realtek DHC RTD1625 SoC"
  gpib: gpio: replace linux/gpio.h inclusion
  Input: matrix_keyboard - replace linux/gpio.h inclusion
  phy: replace linux/gpio.h inclusions
  pcmcia: replace linux/gpio.h inclusions
  ASoC: replace linux/gpio.h inclusions
  mfd: replace linux/gpio.h inclusions
  sh: replace linux/gpio.h inclusions
  ...
2026-08-19 09:10:07 -07:00
Bartosz Golaszewski
146cc263e4 Linux 7.2
-----BEGIN PGP SIGNATURE-----
 
 iQFSBAABCgA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmqCLGoeHHRvcnZhbGRz
 QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGJzYH/0SFjcgnk1Z3Km+3
 2kEeGAMETajW41W7+5QQkuHk83UXDxigDRoD857/d8utK90GrZAoTMS9/6zF3tra
 ht4G1yc2x7/xgVLkWii54d/sp1LEWTRDntN95fzYZwbeAXwd0AcYBlKXZYHKl4t/
 4yZCgYPmYTkewaYdbyWNPiZvCwhBUl5k1E9i/drh5IJXdgXRcqoO86FY9JX+Ks9x
 r0g+d6RIiSbDfwzgRpkBn0TRnqzh2OeBfgyrsgGZO2axwlKcA7SP0vwwT6c6nOUI
 s8F2xXrqrUI75JbSI4YbdwOSvktwbtkz83idlRAYBOdxof3LJ6i2YaxrT8iG+KUH
 l7+e18M=
 =eQMh
 -----END PGP SIGNATURE-----

Merge tag 'v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-next

Linux 7.2
2026-08-18 14:21:04 +02:00
Dmitry Torokhov
b4d85f863e Merge branch 'next' into for-linus
Prepare input updates for 7.3 merge window.
2026-08-14 21:26:07 -07:00
Linus Torvalds
7d8c681eef Input updates for v7.2-rc6
- Fixes for information leaks and OOB accesses across several drivers,
   including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra
 
 - Improvements to the synaptics-rmi4 driver to properly handle F54
   worker errors and prevent buffer overflows
 
 - Input validation fixes in the hynitron_cstxxx touchscreen driver to
   prevent issues with invalid finger IDs and touch counts
 
 - Fixes for use-after-free and initialization bugs in the byd mouse
   and psxpad-spi drivers
 
 - New quirks for the atkbd driver to make keyboard work on HONOR and
   Xiaomi laptops
 
 - Support for the ZENAIM LEVERLESS controller in the xpad driver.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCana8zQAKCRBAj56VGEWX
 nAIMAQCFKhBk3M4Q+625XmMMcb9AV+Bl0TTCxXBbdrA8bYJ+IQEA0C9AQXCmIGzC
 lwr7jlgTET8vN/NrEVD+WN9jNzFmZgA=
 =jcbm
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input updates from Dmitry Torokhov:

 - Fixes for information leaks and OOB accesses across several drivers,
   including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra

 - Improvements to the synaptics-rmi4 driver to properly handle F54
   worker errors and prevent buffer overflows

 - Input validation fixes in the hynitron_cstxxx touchscreen driver to
   prevent issues with invalid finger IDs and touch counts

 - Fixes for use-after-free and initialization bugs in the byd mouse and
   psxpad-spi drivers

 - New quirks for the atkbd driver to make keyboard work on HONOR and
   Xiaomi laptops

 - Support for the ZENAIM LEVERLESS controller in the xpad driver.

* tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: evdev - sanitize event type index when fetching event masks
  Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
  Input: synaptics-rmi4 - block s_input when F54 queue is busy
  Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
  Input: synaptics-rmi4 - zero report size on F54 work error
  Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
  Input: hynitron_cstxxx - validate touch count and finger IDs
  Input: evdev - fix information leak in evdev_pass_values()
  fixp-arith: convert comments to kernel-doc format
  Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
  Input: atkbd - skip deactivate for HONOR ZQC-P
  Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
  Input: iforce - validate input packet lengths
  Input: psxpad-spi - set driver data before use
  Input: cs40l50-vibra - validate custom data from user space
  Input: xpad - add support for ZENAIM LEVERLESS
  Input: edt-ft5x06 - ignore contacts with an out-of-range slot id
  Input: byd - synchronize timer deletion before freeing private data
2026-08-08 07:09:35 -07:00
Dmitry Torokhov
e07c509ad6 Input: gscps2 - supply PA-RISC keyboard keymap via device property
Instead of hardcoding PA-RISC specific keycode tables into atkbd via
compile-time inclusion, have the gscps2 PS/2 port driver attach a
linux,keymap software node device property to the serio device when
a keyboard port is registered. This allows atkbd to dynamically fetch
and apply the custom keymap when probing the port using generic
firmware property helpers, removing architecture-specific hacks from
generic keyboard driver code.

Co-locate the keymap definitions with the serio port driver by moving
hpps2atkbd.h from drivers/input/keyboard/ to drivers/input/serio/.
To handle the five conflicting keys on RDI PrecisionBook laptops without
runtime model string checks or duplicate keymap tables in memory, add
CONFIG_SERIO_GSCPS2_RDI_KEYCODES to drivers/input/serio/Kconfig and
resolve the conflicting keycodes at compile time via preprocessor
macros.

Link: https://patch.msgid.link/am_9BvmZu9g4RlUM@google.com
Acked-by: Helge Deller <deller@gmx.de>
Tested-by: Helge Deller <deller@gmx.de>
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-05 22:45:01 -07:00
Sang-Heon Jeon
f6efbdcecd Input: pmic8xxx-keypad - remove conditional return with no effect
Both branches of the check return the same value, so the check has no
effect. Remove it and return the value directly.

This is the result of running the Coccinelle script from
scripts/coccinelle/misc/cond_return_no_effect.cocci.

Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Link: https://patch.msgid.link/20260729171001.260698-2-ekffu200098@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-04 21:27:53 -07:00
Dmitry Torokhov
50411cada0 Input: samsung-keypad - use pm_runtime_active guard
Simplify the driver by using the block-scope guard(pm_runtime_active)
instead of manually invoking pm_runtime_get_sync() and
pm_runtime_put().

Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260713-samsung-kp-irq-v2-3-acc84b6daf9a@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-02 18:29:01 -07:00
Dmitry Torokhov
9ce8270e30 Input: samsung-keypad - keep interrupt disabled while closed
The driver requests the interrupt during probe, which by default enables
it. If the bootloader left the keypad interrupts enabled, or if a
spurious interrupt fires early before the driver is fully initialized
and clocks are enabled, the interrupt handler will attempt to read
registers and may cause a synchronous external abort.

Fix this by requesting the interrupt with IRQF_NO_AUTOEN, keeping it
disabled during probe. Enable the interrupt in samsung_keypad_start()
when the device is opened and ready, and disable it in
samsung_keypad_stop() when the device is closed. Remove the redundant
re-enabling of the interrupt at the end of samsung_keypad_stop().

Additionally, manually clear the pending interrupt status during system
resume when the device is closed to avoid immediate resume.

Fixes: 0fffed27f9 ("Input: samsung-keypad - Add samsung keypad driver")
Assisted-by: Antigravity:gemini-3.1-pro
Link: https://patch.msgid.link/20260713-samsung-kp-irq-v2-2-acc84b6daf9a@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-02 18:29:01 -07:00
Dmitry Torokhov
116087d9db Input: samsung-keypad - clean up wakeup configuration logic
When checking if the device can wake the system, we should pull the
device_may_wakeup() check to the caller instead of repeating it inside
the toggle_wakeup() handler. Furthermore, when configuring the wakeup,
we should safely ensure we write to the registers in the correct order:
configure the interrupt receiver before enabling the peripheral's wake
functionality, and vice-versa.

Assisted-by: Antigravity:gemini-3.1-pro
Link: https://patch.msgid.link/20260713-samsung-kp-irq-v2-1-acc84b6daf9a@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-02 18:29:01 -07:00
Donglin Lyu
410c44b109 Input: atkbd - skip deactivate for HONOR ZQC-P
The internal keyboard on the HONOR ZQC-P (HONOR MagicBook Pro 14 2026)
does not work after boot.

Using the kernel command line 'i8042.dumbkbd=1' makes the keyboard
functional, but the CapsLock LED does not work. Adding the
'atkbd_deactivate_fixup' quirk fixes the keyboard and CapsLock LED
natively without requiring boot parameters.

DMI: HONOR ZQC-P/ZQC-P-PCB, BIOS 1.09 03/19/2026

Fixes: 9cf6e24c9f ("Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID")
Signed-off-by: Donglin Lyu <donglin_lyu@outlook.com>
Tested-by: Ruslan Shevchenko <adefka@gmail.com>
Link: https://patch.msgid.link/20260801151115.52709-1-donglin_lyu@outlook.com
Cc: stable@vger.kernel.org
[dtor: keep all HONOR entries together]
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-02 15:42:03 -07:00
Zhefu Zhang
3a046db33b Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
The internal keyboard of the Xiaomi Book Pro 14 does not work unless
atkbd skips deactivating it at the end of atkbd_probe().

Using 'i8042.dumbkbd=1' also makes the keyboard work, but then the driver
never writes to the keyboard at all, so the Caps Lock LED is lost. The
atkbd_deactivate_fixup quirk fixes both without a boot parameter.

DMI: XIAOMI Xiaomi Book Pro 14/TM2424, BIOS XMAPT4B0P0909 05/06/2026

Signed-off-by: Zhefu Zhang <a723356@gmail.com>
Reviewed-by: Andrew Zhou <zhoulol888@gmail.com>
Link: https://patch.msgid.link/20260802031559.19701-1-a723356@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-02 15:42:02 -07:00
Bartosz Golaszewski
8bdba6f6cf gpio: legacy interface cleanups for 7.3
These are the remaining patches for legacy gpio interface
 cleanup, ensuring that files referencing them are sure to
 have CONFIG_GPIOLIB_LEGACY set, and use linux/gpio/legacy.h
 instead of the old linux/gpio.h header.
 
 There are a few more patches already merged in other
 branches for 7.3, including soc, led, net and media. Once
 everything is in, we can apply the final patches to turn
 off CONFIG_GPIOLIB_LEGACY by default and remove the obsolete
 header file.
 
 This branch is based on the immutable ib-mfd-legacy-gpio-7.3
 branch from mfd.git to avoid a conflict in the rohm drivers.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpjrCwACgkQmmx57+YA
 GNlhuA//eRNxgyDFRUtuRchUUnIjpCzPdZOXTvnTmDTVYIsHaKS6J/KTBZcxRG7g
 tA749mgpQ2tT0hZFhT1XHCaxHwwBfmV0lomIO65pNcmqmEAUODxTwEy3t4ON4loi
 Ee0SqEXhI+NhMbEoQkrpcCk5y+89Xo+iABbEv12UL/V/K0PKfRDCRs2ZbARnE0yu
 L9wiqt2TJn3baHMabxBZJSWXrYpHCaPqm+vQgIhELQZ4TGswfi6OvCEPhUkk1QUa
 mVvWH7LtUi1A0Ya1HvAhgncvboY6LZYjDHMw7meQmUOSTIu7XoQ6+XjEJ6LJSgtH
 rLAdrFUHFezoHd0UaklnB3taEa7KOZIljNIY8IGRMSqv7jYF8fYXTPuxnS9fuj2o
 u+GxDriWYLp1DfH7HlkrVbmVeX6zunH8qYx91z5aRl7YHNKfwg0wRv8mxAgeBTJy
 1HO/su+ZT0X21hvVibiQNy08VWiQ5+9F5DV+SPTKtaT8chGjjx6uw7oyZkgvzWyu
 xdHuwOzH9WAhL7WnGcJ7PkJzWDoLVkl3KzRCCaYMXBCyLRwCIJTfC5CH7hJNh41i
 fW8b5Nfh7DRAhEuapQk87/NE/sRIFKZW2kfyzbCzsJHm+TW/5X+O6OwoJ+KUSdWQ
 SqVJOVUKDWjg0S8+jxu0mr1ikzwKgrFv2gzWFxaffb6Oi0rqBc4=
 =Ybrr
 -----END PGP SIGNATURE-----

Merge tag 'config-gpio-legacy-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground into gpio/for-next

gpio: legacy interface cleanups for 7.3

These are the remaining patches for legacy gpio interface
cleanup, ensuring that files referencing them are sure to
have CONFIG_GPIOLIB_LEGACY set, and use linux/gpio/legacy.h
instead of the old linux/gpio.h header.

There are a few more patches already merged in other
branches for 7.3, including soc, led, net and media. Once
everything is in, we can apply the final patches to turn
off CONFIG_GPIOLIB_LEGACY by default and remove the obsolete
header file.

This branch is based on the immutable ib-mfd-legacy-gpio-7.3
branch from mfd.git to avoid a conflict in the rohm drivers.
2026-07-27 09:56:49 +02:00
Surendra Singh Chouhan
e640910640 Input: charlieplex_keypad - check gpiod_direction_output() return value
charlieplex_keypad_scan_line() currently ignores the return value of
gpiod_direction_output() when setting the active output line for scanning.

If setting the GPIO direction fails (e.g. on I2C/SPI GPIO expanders or
hardware errors), the function continues to sleep and read input values
from an improperly configured GPIO line.

Fix this by capturing the return value of gpiod_direction_output() and
returning the error code immediately if it fails.

Fixes: 2ca45e57ea ("Input: charlieplex_keypad - add GPIO charlieplex keypad")
Signed-off-by: Surendra Singh Chouhan <kr494167@gmail.com>
Link: https://patch.msgid.link/20260723022943.9337-1-kr494167@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-24 18:18:47 -07:00
Arnd Bergmann
2e0e536fb6 Input: matrix_keyboard - replace linux/gpio.h inclusion
linux/gpio.h is going away, so remove that since the driver already
includes linux/gpio/consumer.h.

Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-07-24 20:12:48 +02:00
Arnd Bergmann
0b333ae1a5 Input: gpio-keys: make legacy gpiolib optional
Most users of gpio-keys and gpio-keys-polled use modern gpiolib
interfaces, but there are still number of ancient sh, arm32 and x86
machines that have never been converted.

Add an #ifdef block for the parts of the driver that are only used on
those legacy machines.

Link: https://lore.kernel.org/all/b3c94552-c104-42e3-be15-7e8362e8039e@gmail.com/
Link: https://lore.kernel.org/all/afJXG4_rtaj3l2Dk@google.com/
Link: https://lore.kernel.org/all/ajQ-CtU131FAJ9ES@google.com/
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> # for input
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-07-24 20:12:40 +02:00
Joy Zou
29fb42d56f Input: snvs_pwrkey - add press event reporting to avoid event loss during suspend
The driver implements debounce protection using a timer-based mechanism:
when a key interrupt occurs, a timer is scheduled to verify the key state
after DEBOUNCE_TIME before reporting the event. This works well during
normal operation.

However, key press events can be lost during system resume on platforms
like i.MX8MQ-EVK because:
1. During the no_irq resume phase, PCIe driver restoration can take up to
200ms with IRQs disabled.
2. The power key interrupt remains pending during the no_irq phase.
3. If the key is released before IRQs are re-enabled, the timer eventually
runs but sees the key as released and skips reporting the event.

To prevent event loss during system suspend, set a pending_press flag in
the interrupt handler and report the press event from the timer callback
when the flag is set. This avoids out-of-order event delivery and keeps
the existing timer-based debounce mechanism for normal operation.

Signed-off-by: Joy Zou <joy.zou@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260715-b4-pwrkey-v5-4-07e7353c319e@oss.nxp.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-17 09:53:55 -07:00
Joy Zou
5a040cd37f Input: snvs_pwrkey - use local device pointer to simple code
Use local struct device pointer to avoid reference the platform_device
pointer every time.

No functional change.

Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Joy Zou <joy.zou@nxp.com>
Link: https://patch.msgid.link/20260715-b4-pwrkey-v5-3-07e7353c319e@oss.nxp.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-16 12:03:11 -07:00
Joy Zou
7ef54727f5 Input: snvs_pwrkey - propagate error code of platform_get_irq()
Hardcoding -EINVAL discards the actual error code, which breaks probe
deferral (-EPROBE_DEFER) and loses critical diagnostic information
needed for proper kernel error handling.

Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Joy Zou <joy.zou@nxp.com>
Link: https://patch.msgid.link/20260715-b4-pwrkey-v5-2-07e7353c319e@oss.nxp.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-16 12:03:11 -07:00
Joy Zou
a1445ec0be Input: snvs_pwrkey - make use of dev_err_probe()
Add dev_err_probe() at return path of probe() to support users to
identify issues easier.

Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Joy Zou <joy.zou@nxp.com>
Link: https://patch.msgid.link/20260715-b4-pwrkey-v5-1-07e7353c319e@oss.nxp.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-16 12:03:11 -07:00
Zhian Liang
1cd52a99c8 Input: tca8418_keypad - enable overflow mode per datasheet (SCPS215G)
The driver currently sets only the overflow interrupt enable bit
(OVR_FLOW_IEN) in the configuration register, leaving the overflow
mode bit (OVR_FLOW_M) at its default value of 0.

According to the TCA8418 datasheet (SCPS215G, Section 8.6.4.1
"Overflow Errata - Description"), both OVR_FLOW_M (Bit_5) and
OVR_FLOW_IEN (Bit_3) must be set high for the overflow interrupt
to be generated. If only OVR_FLOW_IEN is set, FIFO overflow events
are silently lost without notifying the host.

Fix this by setting OVR_FLOW_M alongside OVR_FLOW_IEN in the
configuration register.

Signed-off-by: Zhian Liang <liangzhan5dev@gmail.com>
Link: https://patch.msgid.link/20260529013900.43854-1-liangzhan5dev@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-15 13:57:14 -07:00
Dmitry Torokhov
76904fccf8 Linux 7.2-rc3
-----BEGIN PGP SIGNATURE-----
 
 iQFSBAABCgA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmpUBDceHHRvcnZhbGRz
 QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGgyoH/ivB80eG0N5qxekB
 0w6Xwa5EXEcZrWOXFgYs+ur2D+KMIy8c1Q540ysYmu9OGjZjL+rtNE/czWsBtD57
 9gv4Cxs1Ak+V3pfxXdwjeXzGZwtL0ysAmfbQAo5LeYbcwEmjCm26giU5pYlwqTf5
 oggkS13GuDEtF/+2bTUFbBVPTMFd6xgZFAOLJkZrfNm3bGOWtqJRDVweVz0IR5Bv
 ZVq1WvgrTpsf34ORrYXqyDtxIBxBRM9Dz5O2H5srOnG9yGtk691j1Ud6u8oftDBx
 w0UYd1WQDaKYRM/A/mVGHgvwuk5dOThdN5IBXq6R9JC4QgBqFOk0srmJ6JtMWGw7
 q8B/WiE=
 =IBMl
 -----END PGP SIGNATURE-----

Merge tag 'v7.2-rc3' into next

Sync up with mainline to pull in stable fixes to avoid merge conflicts.
2026-07-13 19:06:00 -07:00
Linus Torvalds
44696aa3a4 Input updates for v7.2-rc2
- A fix for MELFAS MMS114 touchscreen driver to reject invalid touch IDs
   and avoid multi-touch slot corruption
 
 - A fix for a crash in Sega Dreamcast (Maple) mouse driver when opening
   the device, caused by missing driver data
 
 - Fixes for Maple drivers (keyboard, mouse, joystick) to properly order
   setting driver data and device registration to avoid races.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCalLC2QAKCRBAj56VGEWX
 nLLwAQDExlB/cWm2Hpmim13SIetpNbnRNDDUBXZqlx26U6tCUgD9Ek85LvbRiWOJ
 dTqs7ieSn2iPQxHFvHOAZD5ohSGj/wI=
 =g2px
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:

 - fix MELFAS MMS114 touchscreen driver to reject invalid touch IDs and
   avoid multi-touch slot corruption

 - fix a crash in the Sega Dreamcast (Maple) mouse driver when opening
   the device, caused by missing driver data

 - fixes for Maple drivers (keyboard, mouse, joystick) to properly order
   setting driver data and device registration to avoid races

* tag 'input-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: mms114 - fix multi-touch slot corruption
  Input: maple_keyb - set driver data before registering input device
  Input: maplecontrol - set driver data before registering input device
  Input: maplemouse - set driver data before registering input device
  Input: maplemouse - fix NULL pointer dereference in open()
2026-07-11 15:42:55 -07:00
Arnd Bergmann
8760a10464 Input: matrix_keyboard - remove linux/gpio.h inclusion
linux/gpio.h is going away, so remove that since the driver already
includes linux/gpio/consumer.h.

Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260710211954.1373336-10-arnd@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-10 21:47:59 -07:00
Dmitry Torokhov
536394ec81 Input: maple_keyb - set driver data before registering input device
Set maple driver data before calling input_register_device() to
ensure that it is available if the device is opened immediately and
the callback is triggered.

Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-07-02 22:50:19 -07:00
Uwe Kleine-König (The Capable Hub)
995832b2ce Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
Replace the #include of <linux/mod_devicetable.h> by the more specific
<linux/device-id/*.h> where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:17 +02:00
Jun Yan
0c9245c455 Input: cap11xx - add support for CAP1114
CAP1114 is a 14-channel capacitive touch sensor with 11 LED outputs
and hardware reset support.

The CAP1114 uses two control registers for LED output management and
requires two button status registers for touch input state reporting.

By default, channels CS8~CS14 operate as a single grouped block.
Set the corresponding register enable bit to enable these channels as
independent touch inputs. Note these channels share the input threshold
of the eighth entry, causing num_sensor_thresholds to differ from
num_channels.

Signed-off-by: Jun Yan <jerrysteve1101@gmail.com>
Link: https://patch.msgid.link/20260617150318.753148-11-jerrysteve1101@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-22 23:19:41 -07:00
Jun Yan
a9a7baeb3a Input: cap11xx - guard unsupported DT properties before parsing
Check of_property_present() before parsing microchip,calib-sensitivity
and microchip,signal-guard, so that models which do not support these
properties (e.g. CAP1114) skip the parsing entirely.

This prevents a potential buffer overflow in calib_sensitivities[8] and
signal_guard_inputs_mask when a model with more than 8 channels
(CAP1114 has 14) would otherwise call of_property_read_u32_array()
with num_channels as the element count.

Signed-off-by: Jun Yan <jerrysteve1101@gmail.com>
Link: https://patch.msgid.link/20260617150318.753148-9-jerrysteve1101@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-22 23:19:40 -07:00
Jun Yan
6ddb3d0c90 Input: cap11xx - refactor code for better CAP1114 support.
Extend cap11xx_hw_model structure to support CAP1114 with
different register offsets and hardware characteristics:

- led_output_control_reg_base: different address on CAP1114
- sensor_input_reg_base: different address on CAP1114
- num_sensor_thresholds: separate value from num_channels for CAP1114
- has_repeat_en: repeat enable support, disabled by default on CAP1114

Include linux/bits.h, update the register operations related to LEDs.

Signed-off-by: Jun Yan <jerrysteve1101@gmail.com>
Link: https://patch.msgid.link/20260617150318.753148-8-jerrysteve1101@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-22 23:19:40 -07:00
Jun Yan
e40bdf042d Input: cap11xx - add reset gpio support
Some CAP11xx devices (CAP1126/CAP1188) have a dedicated RESET pin.
Add hardware reset operation to improve device reliability and
ensure proper initialization on probe.

Signed-off-by: Jun Yan <jerrysteve1101@gmail.com>
Link: https://patch.msgid.link/20260617150318.753148-7-jerrysteve1101@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-22 23:19:39 -07:00
Jun Yan
32964d017e Input: cap11xx - remove unused register macros
Remove unused register address macros and their corresponding
definitions in the cap11xx_reg_defaults array.

This cleanup reduces code clutter and makes the driver easier to
maintain without affecting functionality.

Signed-off-by: Jun Yan <jerrysteve1101@gmail.com>
Link: https://patch.msgid.link/20260617150318.753148-3-jerrysteve1101@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-22 23:19:37 -07:00
Jun Yan
d3b78c9e1f Input: cap11xx - clean up duplicate log and add probe error logs
Duplicated device detection log exists at line 537 and line 542,
which brings redundant kernel print messages. Drop one redundant
log entry to clean up dmesg output.

Meanwhile add missing error logs when I2C communication fails
during driver probe(), helping debug.

Signed-off-by: Jun Yan <jerrysteve1101@gmail.com>
Link: https://patch.msgid.link/20260617150318.753148-2-jerrysteve1101@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-22 23:19:37 -07:00
Dmitry Torokhov
7a0e692a03 Merge branch 'next' into for-linus
Prepare input updates for 7.2 merge window.
2026-06-22 23:10:08 -07:00
Dmitry Torokhov
ff25a3b1cd Input: ipaq-micro-keys - add length check in micro_key_receive
The driver accesses the message payload (msg[0]) without checking if
the length is greater than zero. The parent MFD driver can produce a
payload with a length of 0, in which case msg[0] would be uninitialized
or stale.

Add a check to return early if len is less than 1.

Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/aintAvTyw4CVb5hG@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-11 13:52:18 -07:00
Dmitry Torokhov
ed0428e928 Input: ipaq-micro-keys - fix potential deadlock
The driver acquires the micro->lock spinlock in process context (in
micro_key_start() and micro_key_stop()) without disabling interrupts.
However, this lock is also acquired in hardirq context by the MFD core
rx handler (micro_rx_msg()) which is called from the serial ISR.

This can lead to a lock inversion deadlock if the interrupt fires on the
same CPU while the process context holds the lock.

Fix this by using guard(spinlock_irq) instead of guard(spinlock) in
micro_key_start() and micro_key_stop() to disable interrupts while
holding the lock.

Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/aij-pfaKK-Nna7wf@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-11 13:52:09 -07:00
Rosen Penev
ead5622914 Input: ipaq-micro-keys - simplify allocation
Embed the keycode array in the struct to have a single allocation.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260609213532.25181-1-rosenp@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-09 23:06:27 -07:00
Cryolitia PukNgae
fb402386af Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
After commit 9cf6e24c9f ("Input: atkbd -
do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID"), HONOR
BCC-N, aka HONOR MagicBook 14 2026's internal keyboard stops
working. Adding the atkbd_deactivate_fixup quirk fixes it.

DMI: HONOR BCC-N/BCC-N-PCB, BIOS 1.04 04/07/2026

Fixes: 9cf6e24c9f ("Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID")
Reported-by: Hongfei Ren <lcrhf@outlook.com>
Link: https://github.com/colorcube/Linux-on-Honor-Magicbook-14-Pro/issues/1#issuecomment-4562679891
Tested-by: Hongfei Ren <lcrhf@outlook.com>
Cc: stable@kernel.org
Signed-off-by: Cryolitia PukNgae <cryolitia.pukngae@linux.dev>
Link: https://patch.msgid.link/20260605-honor-v1-1-78e05e491193@linux.dev
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-06 12:57:41 -07:00
Zeyu WANG
ad0979fe05 Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
The Lenovo Yoga Air 14 (83QK) laptop keyboard becomes unresponsive
after the standard atkbd init sequence. Controlled testing on the
actual hardware shows the F5 (ATKBD_CMD_RESET_DIS / deactivate)
command specifically corrupts the EC state, causing zero IRQ1
interrupts after init.

Skipping only the deactivate command (while keeping F4 ENABLE)
resolves the issue completely: both keystroke input and CapsLock
LED toggle work correctly. The reverse test - skipping only F4
while keeping F5 - makes the problem worse (zero keystroke
interrupts), confirming F5 is the sole culprit.

Add a DMI quirk entry for LENOVO/83QK using the existing
atkbd_deactivate_fixup callback, consistent with the existing
entries for LG Electronics and HONOR FMB-P that address the
same EC F5 deactivate issue.

Signed-off-by: Zeyu WANG <zeyu.thomas.wang@gmail.com>
Link: https://patch.msgid.link/20260602170909.14725-1-zeyu.thomas.wang@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-06-02 16:33:40 -07:00
Uwe Kleine-König (The Capable Hub)
47ceab218c Input: Use named initializers for arrays of i2c_device_data
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.

The mentioned robustness is relevant for a planned change to struct
i2c_device_id that replaces .driver_data by an anonymous union.

This patch doesn't modify the compiled arrays, only their representation
in source form benefits. The former was confirmed with x86 and arm64
builds.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260515164848.497608-2-u.kleine-koenig@baylibre.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-30 22:10:47 -07:00
Colin Ian King
fc59cad7e8 Input: lm8323 - remove space before newline
There is an extraneous space before a newline in a dev_err message.
Remove it

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Link: https://patch.msgid.link/20250729113147.1924862-1-colin.i.king@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-20 10:22:52 -07:00
Hugo Villeneuve
2ca45e57ea Input: charlieplex_keypad - add GPIO charlieplex keypad
Add support for GPIO-based charlieplex keypad, allowing to control
N^2-N keys using N GPIO lines.

Reuse matrix keypad keymap to simplify, even if there is no concept
of rows and columns in this type of keyboard.

Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Link: https://patch.msgid.link/20260312180304.3865850-5-hugo@hugovil.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-19 18:27:01 -07:00
Ethan Carter Edwards
2e32d2ba17 Input: imx_keypad - fix spelling mistake "Colums" -> "Columns"
There is a spelling mistake in two comments. Fix them.

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
Link: https://patch.msgid.link/20260418-imx-typo-v1-1-2a15e54ad4e7@ethancedwards.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-19 17:55:20 -07:00
Thorsten Blum
16bbb59127 Input: qt1070 - inline i2c_check_functionality check
Inline the i2c_check_functionality() check, since the function returns a
boolean status rather than an error code.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20260408141926.1181389-4-thorsten.blum@linux.dev
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-08 07:46:01 -07:00
Thorsten Blum
512b0f41aa Input: qt1050 - inline i2c_check_functionality check
Inline the i2c_check_functionality() check, since the function returns a
boolean status rather than an error code.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20260408141926.1181389-3-thorsten.blum@linux.dev
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-08 07:46:01 -07:00
Dmitry Torokhov
0421ccdfad Linux 7.0-rc3
-----BEGIN PGP SIGNATURE-----
 
 iQFSBAABCgA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmmuDMYeHHRvcnZhbGRz
 QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGLO4IAJ5kpRUi1STiqseb
 bLawF3gehuZp8VPAYnJsACYXN7kMx9OQJ2SE4Y0Y16ZlHtS1TTvsEAhwSTyYH7Jc
 hb1iSfoN1kxgDh2U3yZZJz9+DzQh6/YCDXJjyhpSgWOejhaYe7r7er5xqdKpGgVx
 6hlvN92/c1m7aqMjKNXeD7YKoXn35FzwPYQAyksJdwMWbq27HE1Vb42PHht21yUX
 1ndEUw0UMYH3IrDON+7QtE/aXW1PlLLeQWPDpG9y5FhoseZFEcNkm5NVYshuZ8L4
 WZj3Q5IvQ/zj9DuwagW4Gab9XwzKIWSXuuSLRyQzv+OcAyITiC+Uo3z55TFmvXs7
 2DOHBkY=
 =depW
 -----END PGP SIGNATURE-----

Merge tag 'v7.0-rc3' into next

Sync up with the mainline to brig up the latest changes, specifically
changes to ALPS driver.
2026-03-12 10:44:42 -07:00
bui duc phuc
6d4b67a2a7 Input: mpr121 - drop redundant wakeup handling
The driver currently calls device_init_wakeup() and manually toggles
IRQ wake in suspend and resume paths. This is unnecessary since the
I2C core already handles wakeup configuration when the device is
described in Device Tree with the "wakeup-source" property.

Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
Link: https://patch.msgid.link/20260309071413.92709-1-phucduc.bui@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-03-10 17:05:50 -07:00
Dmitry Torokhov
3bf5404fc9 Input: atkbd - fix various formatting issues
Over the years we accumulated a number of formatting issues, fix them.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-02-28 18:20:49 -08:00
Dmitry Torokhov
b96fee7ddb Input: atkbd - switch to using explicitly sized types
Instead of using "unsigned short" and "unsigned char" for holding 16-bit
and 8-bit data, switch to using common in kernel u16 and u8.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-02-28 18:20:49 -08:00
Dmitry Torokhov
9df4a9d212 Input: atkbd - use dev_warn_ratelimited()
Instead of explicitly using printk_ratelimit() switch to using
dev_warn_ratelimited().

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-02-28 18:20:48 -08:00
Dmitry Torokhov
1fe01b8179 Input: atkbd - use __free() cleanup facility in when parsing FW keymap
Annotating the temporary keymap pointer as __free(kfree) ensures that it
will get released when exiting the function and explicit freeing in all
the return paths can be removed.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-02-28 18:20:48 -08:00
Ariel Silver
0c695e6b90 Input: atkbd - validate scancode in firmware keymap entries
The SCANCODE() macro extracts a 16-bit value (0..65535) from firmware
device property data, but atkbd_get_keymap_from_fwnode() uses it
directly to index atkbd->keycode[], which only has ATKBD_KEYMAP_SIZE
(512) elements. A firmware-supplied scancode >= 512 causes a heap
out-of-bounds write that can corrupt adjacent struct atkbd fields and
neighboring slab objects.

Add a bounds check that rejects the entire firmware keymap if any entry
contains an out-of-range scancode, consistent with the validation
performed by matrix_keypad_parse_keymap() in drivers/input/matrix-keymap.c
for the same "linux,keymap" property format. When rejected, the driver
falls back to the default keycode table.

Fixes: 9d17ad2369 ("Input: atkbd - receive and use physcode->keycode mapping from FW")
Signed-off-by: Ariel Silver <arielsilver77@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-02-28 18:16:35 -08:00