| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
- support for newer AMD SoCs (Basavaraj Natikar)
- sysfs attributes of operating-mode telemetry (Basavaraj Natikar)
|
|
- power management fix for Apple Touch Bar (Andre Eikmeyer)
- fix for trackpad hanling on T2 Macs (Aditya Garg)
|
|
- SG Mobile LED support (Denis Benato)
- power management fix for ROG Ally (Deni Benato)
- asus_work() hardening (Denis Benato)
- fix for invalid keyboard feature reports being sent on ASUS laptops
with I2C/HID touchpads (Panz Dev)
|
|
- OOB fix in s32ton() (Alan Stern)
- switch to named initializers for acpi_device_id (Pawel Zalewski)
- UAF fix in hiddev (Yousef Alhouseen)
|
|
- power management fix for i2c-hid, removing bus timeout
from every reboot (Justin Yeh)
|
|
- conversion of intel-thc-hid to hid_safe_input_report() (Even Xu)
|
|
- various functionality fixes and code cleanups of lenovo-go-s
driver (Derek J. Clark)
|
|
- support for Switch 2 controller (Vicki Pfau)
- support for PDP Afterglow controller (Aiman Najjar)
|
|
|
|
- fixed handling of short reports (Jiale Yao)
|
|
- UAF fixes (Lee Jones)
- SW_MUTE_DEVICE semantics fix (Lee Jones, Ping Cheng)
|
|
- switch to scoped_guard (Rafael Passos)
- LED-indicated controller ID support (Rafael Passos)
|
|
hid-nintendo does depend on USB_HID. Reflect that in Kconfig.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202610171559.gZ0QBMFv-lkp@intel.com/
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
synonym reports: "The dock (USB 0b05:182f) reports brightness on the ASUS
vendor usage page 0xff31, usages 0x10 and 0x20, which hid-asus already maps to
KEY_BRIGHTNESSDOWN / KEY_BRIGHTNESSUP. Because the device is not in
asus_devices[], it is claimed by hid-generic, which ignores the vendor page
entirely, so Fn+F5 and Fn+F6 produce no input events at all - not even a
scancode. Keys on the standard consumer page (volume) on the same device work
fine, which makes this look like a backlight or ACPI problem rather than a HID
one."
Add the device ID.
Reported-by: synonym <20000l@pm.me>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
Currently, wacom_intuos_irq() passes the parent of wacom_wac's
pen_input to the dev_dbg() in the unknown report path. However,
pen_input can be NULL on interfaces without a pen, causing a
NULL pointer dereference.
Get the HID device from the enclosing struct wacom and use hid_dbg()
instead.
Fixes: eb71d1bb270e ("Input: wacom - use dev_xxx() instead of naked printk()s and dbg()s")
Reported-by: syzbot+b5a7cd83622c747977de@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b5a7cd83622c747977de
Signed-off-by: Matheus Alves de Almeida <matheus.aalmeida@inf.ufrgs.br>
Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
Changes drvdata from static global to devm allocation per device.
Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
In the next patch I will switch drvdata from static global to a
devm_kzalloc struct. In preparation for that, move the led_classdev_mc
to be a member of the gos_cfg_drvdata struct. As part of that effort,
provide a constant name when accessing it and access the led_classdev
through the led_classdev_mc.
Fixes: be6d7dbb368ba840d7 ("HID: hid-lenovo-go-s: Add RGB LED control interface")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
Renames hid_gos_cfg struct to gos_cfg_drvdata in preparation for later
fixes.
This is a prerequisite for later fixes. No functional change intended.
Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
Currently this driver registers attributes before the MCU is ready to
accept commands. This can lead to attribute access that blocks the MCU
in some rare cases.
Move attribute construction to gos_cfg_setup, after the device has been
queried. Gate creation to drvdata.gp_registered and
drvdata.rgb_registered so a resume before setup has run doesn't prevent
attribute creation or attempt to re-register the same attributes.
Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
Currently a device can suspend while delayed work is pending or
executing. Cancel delayed work if it was pending and restart it if it
hasn't run yet. Gate access to show/store functions behind a bool to
prevent access prior to cfg_setup() being completed.
Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
Adds kobject_uevent notification after setting os_mode attribute on resume.
Fixes: 3524900cc571bd922a ("HID: hid-lenovo-go-s: restore OS_TYPE after resume from s2idle")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
Adds missing pm_ptr to the .reset_resume callback for hid-lenovo-go-s
Fixes: 3524900cc571bd922a ("HID: hid-lenovo-go-s: restore OS_TYPE after resume from s2idle")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
hid_gos_cfg_remove() calls a mutex before canceling delayed work. That
delayed work function calls mcu_property_out(), which holds the same mutex.
Prevent deadlock my removing the mutex prior to stopping the work.
Additionally, since cancel_delayed_work has the potential to re-arm,
switch to disable_delayed_work.
Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
mcu_property_out() reinits send_cmd_complete immediately after a
timeout is detected, before the next command that reuses it is sent.
If the MCU's reply to the timed-out command arrives after this reinit
but before the next command's wait begins, it silently satisfies the
next, unrelated command's wait instead of the one it actually answers,
handing that caller stale data with no way to detect the mismatch.
Track when a command has timed out via cmd_orphaned. Before the next
command reuses the completion, wait a bounded 25ms for a stale reply
to arrive and be consumed, then unconditionally clear the flag and
reinit the completion. This does not fully eliminate the window in
which an unrelated reply could still be received, but bounds it to
a short interval right before a new command is sent. Behavior matches
the solution to the same problem in hid-msi.
Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
Currently mcu_property_out() blanket returns 0, discarding the ret
value and any errors with it. Wait completion returns a positive value
when it is not timed out, which would error on all successes, so if it
is positive return the ret value from the raw event handler. Only if
it is 0 set it to -EBUSY, otherwise pass the actual error.
Fixes: a23f3497bf208c59ad ("HID: hid-lenovo-go-s: Add Lenovo Legion Go S Series HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The probe error path cancels hidpp->work before freeing the HID++ device
data, but does not cancel reset_hi_res_work.
reset_hi_res_work can be scheduled while probing the device. If probe
subsequently fails, the work can run after the driver data has been
freed.
Cancel reset_hi_res_work in the probe error path to prevent a potential
use-after-free.
Fixes: ed80cc4667ac ("HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL")
Signed-off-by: Dmitriy Geels <dmitriy.geels@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The trackpad on T2 Macs is incorrectly bound by the hid-apple driver.
This is due to both trackpad and keyboard sharing the same VID/PID.
Use the existing APPLE_IGNORE_MOUSE quirk for the same.
Signed-off-by: Aditya Garg <aditya.garg@linux.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
usbhid starts polling a device's interrupt IN endpoint on open
(usbhid_open() -> hid_start_in()). If the report descriptor declares no
input reports there is nothing to read there, so the poll is useless,
and on some composite devices it is also harmful.
The ASUS ROG N-Key keyboards expose a second, input-less interface used
only for RGB control via feature reports. Opening its hidraw node (any
hidraw reader does, including SDL/Steam Input or a plain cat) starts the
pointless IN poll and keypress reports on the keyboard interface get
dropped for as long as the node stays open: a lost key-down drops a
letter, a lost key-up leaves the key stuck. usbmon shows the dropped
reports never reach the URB layer.
The useless poll itself is long-standing; commit 4ac74ea68f64 ("HID:
asus: early return for ROG devices") is what exposes it on these
devices by keeping the input-less interface alive instead of ejecting
it, so its hidraw node can be opened and the poll started.
Skip the poll in usbhid_open() when the device has no input reports.
Feature reports and hidraw output keep working over the control and OUT
endpoints, so the interface is otherwise unaffected.
Fixes: 4ac74ea68f64 ("HID: asus: early return for ROG devices")
Link: https://discuss.cachyos.org/t/keyboard-input-issues-on-asus-rog-strix-16-2025-with-cachyos-during-gaming/30823
Link: https://github.com/ublue-os/bazzite/issues/4590
Cc: stable@vger.kernel.org
Tested-by: Kerim Kabirov <the.privat33r+linux@pm.me>
Tested-by: GameBurrow <gameburrow@pm.me>
Signed-off-by: Ahmed Yaseen <yaseen@ghoul.dev>
Reviewed-by: Denis Benato <denis.benato@linux.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The writable gpio_mode_enforce parameter can change between probe and
remove.
If it changes from false to true after probe, remove skips cancellation
of init_work. Pending or running work can then access devm-managed
driver state after teardown. Changing it from true to false can make
remove cancel an uninitialized delayed work item.
Initialize init_work whenever IIO is reachable and cancel it
unconditionally on remove. Keep the parameter check only for scheduling
the initialization.
The false-to-true cancellation gap was previously reported by Sashiko.
We also encountered this issue during our static-analysis research.
Fixes: 200e6c6e94fa ("HID: mcp2221: Add module parameter to enfoce GPIO mode")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/linux-input/20260715143415.916A21F00A3A@smtp.kernel.org/
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
Add a guard clause to check if 'msc' and 'msc->input' is NULL
before attempting to access its fields, preventing a general
protection fault.
Fixes: b8d56ef91cc3 ("HID: magicmouse: Apple Magic Mouse 2 USB-C support")
Reported-by: syzbot+5ad4fc9c8360b68e353f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5ad4fc9c8360b68e353f
Signed-off-by: Nehuen Lian Bova <nehuenlian.kernel@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
Syzbot reported an out-of-bounds shift (32-bit integer shifted left by
32) in the s32ton() routine in the HID core. This routine converts a
signed 32-bit integer to a signed n-bit integer, and it caps the value
of n at 32. But when n == 32 there's no need to do anything; it can
simply return the input value. This will avoid calculating (1 << n)
when n is 32, which was the cause of the invalid shift.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 69c02ffde6ed ("HID: core: clamp report_size in s32ton() to avoid undefined shift")
Reported-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/6ac9cbd8.a150a118.27e199.0025.GAE@google.com/
Tested-by: syzbot+25a1d2907885b2182275@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/dfa0aa1c-e55e-4316-8307-f72a07383634@rowland.harvard.edu
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
|
|
XG mobile stations have very bright leds behind the fan that can be
turned either ON or OFF: add a cled interface to allow controlling the
brightness of those red leds.
Let the led core manage the power transitions: the classdev is flagged
with LED_CORE_SUSPENDRESUME, so it is switched off at suspend and its
last brightness is restored at resume. The EC drives its own blinking
pattern during s2idle anyway, so the led state while the machine is
asleep is not meaningful.
Signed-off-by: Denis Benato <denis.benato@linux.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The ROG ally needs to have the EC string sent back after resuming from
s2idle since the USB device can be turned completely off by the firmware
when mcu_powersave firmware-attribute is set to 1.
This may also be true for other laptops and certain features might stop
working after the device exit from sleep.
Assisted-by: opencode:glm-5.2
Signed-off-by: Denis Benato <denis.benato@linux.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
asus_work() executes actions against the device: they send feature
reports with hid_hw_raw_request() and, for the Fn+F5 fan key fallback,
re-inject the raw report into the HID core with hid_report_raw_event().
For this reason the worker must be quiesced before hid_hw_stop(): after
the low level driver has stopped, the transport is gone (usbhid_stop()
frees the URBs and the I/O buffers) and re-injected reports would race
against the input devices being unregistered by hid_disconnect().
Make so that the teardown cannot race to a use-after-free: every site
queueing an action holds worker->lock across the .removed check, the
list insertion and schedule_work(), and asus_worker_stop() sets .removed
and drains the queue under that same lock before calling
cancel_work_sync(). An action that passed the check is caught by the
latter while any later attempt is discarded by asus_worker_schedule().
Closes: https://lore.kernel.org/all/20260908180032.34C2D1F00A3A@smtp.kernel.org/
Fixes: 47669bec44fe ("HID: asus: refactor the two workqueues and init sequence")
Assisted-by: zcode:glm-5.3-flash
Signed-off-by: Denis Benato <denis.benato@linux.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The HID core invokes raw_event callbacks before validating the report
length. zc_raw_event() verifies the report ID in byte zero and then reads
the key code from byte one for report IDs 0x02 and 0x03 without checking
that the second byte is present.
A one-byte report reproduced the issue under KASAN:
BUG: KASAN: slab-out-of-bounds in zc_raw_event+0x54c/0x580
Read of size 1 by task hidtrigger/93
Call Trace:
zc_raw_event+0x54c/0x580
__hid_input_report+0x2ef/0x3a0
inject_store+0x479/0x490 [faketrans]
Require both the report ID and key code before processing the report.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: d0742abaa1c3 ("HID: add omitted hid-zydacron.c file")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The HID core invokes raw_event callbacks before validating the report
length. pxrc_raw_event() reads byte seven and writes bytes one and seven
without checking that the report contains those bytes.
A one-byte input report reproduced the first invalid access under KASAN:
BUG: KASAN: slab-out-of-bounds in pxrc_raw_event+0x161/0x260
Read of size 1 by task hidtrigger/90
Call Trace:
pxrc_raw_event+0x161/0x260
kasan_report+0x139/0x170
Require all eight bytes before reading or rewriting the report.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: acc3e34613da ("HID: Add driver for PhoenixRC Flight Controller")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The HID core invokes raw_event callbacks before validating the report
length. Prodikeys reports 0x01 and 0x04 are passed to handlers that always
read bytes one through three, regardless of the supplied size. A truncated
report can therefore cause an out-of-bounds read.
Require four bytes for the two fixed-format reports. Keep report 0x03 on
its existing variable-length path, which derives the number of note pairs
from size and only accesses complete pairs.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: 3a370ca1dcf8 ("HID: Prodikeys PC-MIDI HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
MCP2221 responses are 64-byte reports, but mcp2221_raw_event() currently
accepts any report of at least four bytes. Several response handlers read
far beyond that minimum. In particular, the I2C status response reads
offset 20 and copies ADC samples starting at offset 50. Other GPIO, SRAM,
and flash response handlers also access fixed offsets beyond byte three.
The HID core invokes raw_event callbacks before validating the report
length, so a truncated response can cause an out-of-bounds read. Require a
complete protocol report before dispatching any response handler.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: 67a95c21463d ("HID: mcp2221: add usb to i2c-smbus host bridge")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The HID core invokes raw_event callbacks before validating the report
length. mcp2200_raw_event() casts a READ_ALL response to struct
mcp_read_all_resp and reads fields through offset ten without checking that
the response contains the structure.
A one-byte READ_ALL response reproduced the issue under KASAN:
BUG: KASAN: slab-out-of-bounds in mcp2200_raw_event+0x24b/0x3a0
Read of size 1 by task hidtrigger/89
Call Trace:
mcp2200_raw_event+0x24b/0x3a0
kasan_report+0x139/0x170
Reject an incomplete READ_ALL response with a protocol error before reading
its fields. The common completion path then wakes the command waiter with
the error instead of leaving it to time out.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: 740329d7120f ("HID: mcp2200: added driver for GPIOs of MCP2200")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The HID core invokes raw_event callbacks before validating the report
length. For an unnumbered keyboard report, logi_dj_raw_event() uses the
second byte as temporary storage while prepending a report ID. A one-byte
report therefore makes both the initial write and the later restoration
access data beyond the received report.
Reject unnumbered keyboard reports that do not provide the temporary byte.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: 74808f9115ce ("HID: logitech-dj: add support for non unifying receivers")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The HID core invokes raw_event callbacks before validating the report
length. elo_raw_event() only checks the first-byte packet marker before
elo_process_data() reads coordinates, flags, and pressure through offset
seven. A truncated packet beginning with the expected marker can therefore
cause an out-of-bounds read.
Require the complete eight-byte SmartSet packet before parsing it.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: d23efc19478a ("HID: add driver for ELO 4000/4500")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The HID core invokes raw_event callbacks before validating the report
length. cp2112_raw_event() reads every field of a transfer status response
without checking size. For a data response, it reads the length at offset
two and copies that many bytes from offset three, again without ensuring
that the input report contains them.
Require a complete transfer status structure. For data responses, first
require the header and then ensure the clamped payload length fits in the
received report before copying it.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: e932d8178667 ("HID: add hid-cp2112 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The HID core invokes raw_event callbacks before validating the report
length. cougar_raw_event() reads the key code and action from offsets one
and two without checking that those bytes are present. A short report on
the special interface can therefore cause an out-of-bounds read.
Consume reports that do not contain the action field before accessing the
fixed offsets, consistent with the callback's handling of other reports on
the special interface.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: b8e759b8f6da ("HID: cougar: Add support for the Cougar 500k Gaming Keyboard")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The M600V2 has a different HID ID on the wireless dongle.
Signed-off-by: Tjark Effenberger <mail@teffenberger.de>
Tested-by: Iwan Schadrin <schadrin0108@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The GANSS GS3104T PRO is a tri-mode mechanical keyboard that reports
Apple's vendor and product IDs (05ac:024f) over USB, over its 2.4 GHz
receiver and over Bluetooth, so that macOS recognises it without a
vendor driver. hid->name is built from the product string only and it
differs per connection mode:
USB: "HFD GS3104T PRO" (iManufacturer is "HFD")
2.4 GHz: "GS3104T-PRO 2.4G" (no iManufacturer)
Bluetooth: "GS3104T PRO"
All three descriptors carry the Apple Fn key usage (Usage Page 0xFF00,
Usage 0x03), so hid-apple claims the device in every mode and applies
the Apple function key layout: with the default fnmode=3,
hidinput_apple_event() resolves real_fnmode to 1 (fkeyslast), so the
F-row sends the media keys and Fn has to be held down to get F1-F12.
That is not the behaviour the keyboard has on other operating systems.
hid-apple already keeps a list of such keyboards and switches them to
the fnmode=2 (fkeysfirst) behaviour, but the match is a case-sensitive
strncmp() prefix test against hid->name and none of the three names
matches an existing entry: the "GANSS" one misses because the brand does
not appear in any of the descriptors, and "hfd.cn" does not match
either. The non-Apple handling is thus never enabled and users have to
pass hid_apple.fnmode=2 on the kernel command line to get the expected
default.
Add all three names to non_apple_keyboards[].
Signed-off-by: DemonPlayer <a18165943161@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The 2.4 GHz receiver in EWEADN G5 wireless mice (YJX-CHIP A8A5:2255)
presents its mouse data on a standard interrupt IN endpoint. usbhid
only submits read URBs for an input device while a userspace consumer
holds it open, so on boot or replug the mouse pointer stays dead until
something opens the node.
The same receiver ships with a number of other EWEADN models (A6, A7,
E7, E9, E11, G2SE A, GS02 Pro, S7, S9SE, X23), so the quirk covers
the whole family.
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <bentiss@kernel.org>
Cc: linux-input@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Liang Haowen <nbg2974@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The wired Anne Pro 2 identifying as 04d9:a292 stops delivering keyboard
input after a period of inactivity. Unplugging and reconnecting the
keyboard restores input.
Keeping ObinsKit running prevents the problem. A read-only userspace
reader that keeps USB HID interface 1 open also prevents it, as does
usbhid.quirks=0x04d9:0xa292:0x00000400 without either application running.
Commit ca28aff0e1dc ("HID: quirks: Always poll Obins Anne Pro 2
keyboard") added HID_QUIRK_ALWAYS_POLL for product ID a293.
The variant identifying as 04d9:a292 exhibits the same symptom.
Apply the quirk to this product ID as well.
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Gabor Tanz <gabor.tanz@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
The refactored SW_MUTE_DEVICE code assumed that stylus will be
the first regiestered input. In reality, touch can be registered
before stylus, such as the Wacom Cintiq Pro 13 and 16.
This patch covers both touch-first and stylus-first cases.
Cc: stable@vger.kernel.org
Fixes: ba16e5ffbaa1 ("HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration")
Reviewed-by: Lee Jones <lee@kernel.org>
Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
For consistency with how the shared has_mute_touch_switch is handled
during registration, let's apply WRITE_ONCE to is_touch_on too.
Cc: stable@vger.kernel.org
Fixes: ba16e5ffbaa1 ("HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration")
Reviewed-by: Lee Jones <lee@kernel.org>
Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
Use report type from request node while sending feature and input reports
to HID core. The cli_data report type array is never assigned and
feature reports are sent as input reports.
Fixes: 1434f9fc0e47 ("SFH: Create HID report to Enable support of AMD sensor fusion Hub (SFH)")
Closes: https://github.com/ublue-os/bazzite/issues/5796
Cc: stable@vger.kernel.org
Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
