| 035ec4a7 | 06-Aug-2026 |
HyeongJun An <sammiee5311@gmail.com> |
HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
quickspi_hid_raw_request() receives the caller's buffer length in len, but
quickspi_get_report() never sees it and
HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
quickspi_hid_raw_request() receives the caller's buffer length in len, but
quickspi_get_report() never sees it and copies the whole device-supplied
response into buf regardless:
memcpy(buf, qsdev->report_buf, qsdev->report_len);
qsdev->report_len comes from the input report the touch controller returns,
while buf is sized to whatever the caller asked hidraw for through
HIDIOCGFEATURE or HIDIOCGINPUT. A response larger than that overflows buf
with device-controlled content.
The intel-quicki2c sibling already passes the caller length down to
quicki2c_get_report() and validates the response against it before the
copy. Do the same here.
Fixes: 4138f21115ae ("HID: intel-thc-hid: intel-quickspi: Complete THC QuickSPI driver")
Suggested-by: Sashiko AI <sashiko-bot@kernel.org>
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Reviewed-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| 05dffa55 | 08-Aug-2026 |
Guangshuo Li <lgs201920130244@gmail.com> |
HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown
quickspi_probe() calls pm_runtime_use_autosuspend(), but
quickspi_remove() does not call the matching
pm_runtime_dont_use_
HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown
quickspi_probe() calls pm_runtime_use_autosuspend(), but
quickspi_remove() does not call the matching
pm_runtime_dont_use_autosuspend() during teardown.
If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during teardown, this reference is not dropped.
The documentation for pm_runtime_use_autosuspend() also notes that it
is important to undo it with pm_runtime_dont_use_autosuspend() at
driver exit time, unless runtime PM was initially enabled with
devm_pm_runtime_enable().
Add the missing pm_runtime_dont_use_autosuspend() call to the driver
remove path.
This issue was found by manual code inspection.
Fixes: 6912aaf3fd24 ("HID: intel-thc-hid: intel-quickspi: Add PM implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| 42a941e3 | 08-Aug-2026 |
Guangshuo Li <lgs201920130244@gmail.com> |
HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown
quicki2c_probe() calls pm_runtime_use_autosuspend(), but
quicki2c_remove() does not call the matching
pm_runtime_dont_use_
HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown
quicki2c_probe() calls pm_runtime_use_autosuspend(), but
quicki2c_remove() does not call the matching
pm_runtime_dont_use_autosuspend() during teardown.
If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during teardown, this reference is not dropped.
The documentation for pm_runtime_use_autosuspend() also notes that it
is important to undo it with pm_runtime_dont_use_autosuspend() at
driver exit time, unless runtime PM was initially enabled with
devm_pm_runtime_enable().
Add the missing pm_runtime_dont_use_autosuspend() call to the driver
remove path.
This issue was found by manual code inspection.
Fixes: 5f420e8215c6 ("HID: intel-thc-hid: intel-quicki2c: Add PM implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| b6fc74d8 | 29-Jul-2026 |
Even Xu <even.xu@intel.com> |
HID: Intel-thc-hid: Intel-quickspi: Refine recover callback
Refine recover flow:
1. Use workqueue to handle recover flow instead of processing in irq
handler.
2. Call thc_rxdma_reset() API to sim
HID: Intel-thc-hid: Intel-quickspi: Refine recover callback
Refine recover flow:
1. Use workqueue to handle recover flow instead of processing in irq
handler.
2. Call thc_rxdma_reset() API to simplify the recover operation.
3. Disable interrupt during whole recover flow.
4. If recover fails, disable interrupt to avoid interrupt storm.
Signed-off-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| 2e045a14 | 29-Jul-2026 |
Even Xu <even.xu@intel.com> |
HID: Intel-thc-hid: Intel-quicki2c: Refine recover callback
Refine recover flow:
1. Use workqueue to handle recover flow instead of processing in irq
handler.
2. Call thc_rxdma_reset() API to sim
HID: Intel-thc-hid: Intel-quicki2c: Refine recover callback
Refine recover flow:
1. Use workqueue to handle recover flow instead of processing in irq
handler.
2. Call thc_rxdma_reset() API to simplify the recover operation.
3. Disable interrupt during whole recover flow.
4. If recover fails, disable interrupt to avoid interrupt storm.
Signed-off-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| 1d46b8d4 | 29-Jul-2026 |
Even Xu <even.xu@intel.com> |
HID: Intel-thc-hid: Intel-thc: Add API to reset read DMA
Add a helper function thc_rxdma_reset() to do read DMA reset, it can be
called when fatal DMA error happens.
Signed-off-by: Even Xu <even.xu
HID: Intel-thc-hid: Intel-thc: Add API to reset read DMA
Add a helper function thc_rxdma_reset() to do read DMA reset, it can be
called when fatal DMA error happens.
Signed-off-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| 447c7737 | 27-Jul-2026 |
Even Xu <even.xu@intel.com> |
HID: Intel-thc-hid: Intel-quicki2c: Support full I2C BUS config parameters
Read complete I2C bus configuration parameters from ACPI and passes them
to thc_i2c_subip_init() to properly initialize the
HID: Intel-thc-hid: Intel-quicki2c: Support full I2C BUS config parameters
Read complete I2C bus configuration parameters from ACPI and passes them
to thc_i2c_subip_init() to properly initialize the THC I2C subip with
platform-specific settings.
This change enhances hardware compatibility by allowing full
platform-specific I2C bus configurations.
Signed-off-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| b7799c3b | 01-Jun-2026 |
Danny D. <d3z.the.dev@gmail.com> |
HID: intel-thc-hid: intel-quickspi: reset touch IC on system resume
On the Surface Pro 10 (Meteor Lake) the touchscreen stops working after a
suspend/resume cycle and only recovers after a reboot. T
HID: intel-thc-hid: intel-quickspi: reset touch IC on system resume
On the Surface Pro 10 (Meteor Lake) the touchscreen stops working after a
suspend/resume cycle and only recovers after a reboot. The driver logs
"GET_DEVICE_INFO: recv failed: -11" on resume.
This platform suspends through s2idle: /sys/power/mem_sleep exposes
"[s2idle]" as the only state, there is no "deep"/S3 entry at all. The
touch IC nonetheless loses power across that s2idle suspend, the same
way it does across hibernation. quickspi_resume() only re-selects the
THC port, restores interrupts and DMA and sends a HIDSPI_ON command,
assuming the touch IC kept its power and state. When it has actually
lost power the HIDSPI_ON command is never acknowledged and the
descriptor read fails, leaving the touchscreen dead until the module is
reloaded.
quickspi_restore() already handles this for hibernation by
reconfiguring the THC SPI/LTR settings and running reset_tic() to
re-enumerate the device. Make quickspi_resume() do the same when the
device is not a wake source. A wake-enabled device keeps its power and
state across suspend, so it stays on the light restore path: resetting
it would discard a pending wake touch event and break wake-on-touch.
The non-wake path mirrors the existing quickspi_restore() sequence,
including enabling interrupts before reset_tic(), so it introduces no
new ordering relative to code already in the driver.
This change has been validated on a Surface Pro 10 running the
linux-surface kernel across multiple s2idle suspend/resume cycles; it
has not been tested on a mainline build.
Closes: https://github.com/linux-surface/linux-surface/issues/1799
Signed-off-by: Danny D. <d3z.the.dev@gmail.com>
Reviewed-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| 88919bed | 18-Mar-2026 |
Even Xu <even.xu@intel.com> |
HID: intel-thc-hid: Intel-thc: Add more frequency support for SPI
The Nova Lake platform enhances THC with half divider capability for
clock division, allowing more granular frequency control for th
HID: intel-thc-hid: Intel-thc: Add more frequency support for SPI
The Nova Lake platform enhances THC with half divider capability for
clock division, allowing more granular frequency control for the THC
SPI port.
Supported frequencies include 50MHz (125MHz/2.5), 35MHz (125MHz/3.5),
and 10MHz (125MHz/8/1.5).
Signed-off-by: Even Xu <even.xu@intel.com>
Tested-by: Rui Zhang <rui1.zhang@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| 6761f9cc | 22-Dec-2025 |
Even Xu <even.xu@intel.com> |
HID: Intel-thc-hid: Intel-quicki2c: Add power management for touch device
Send POWER_SLEEP command to touch device when system enters into sleep
mode or hibernate mode to save more power; and send P
HID: Intel-thc-hid: Intel-quicki2c: Add power management for touch device
Send POWER_SLEEP command to touch device when system enters into sleep
mode or hibernate mode to save more power; and send POWER_ON command to
take device back when system exits sleep mode.
Signed-off-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| a788b205 | 09-Dec-2025 |
Even Xu <even.xu@intel.com> |
HID: Intel-thc-hid: Intel-quicki2c: Add output report support
Add support for HID output reports in the intel-quicki2c driver by
implementing the output_report callback in the HID low-level driver
i
HID: Intel-thc-hid: Intel-quicki2c: Add output report support
Add support for HID output reports in the intel-quicki2c driver by
implementing the output_report callback in the HID low-level driver
interface.
This enables proper communication with HID devices that require
output report functionality, such as setting device configuration or
updating device firmware.
Tested-by: Rui Zhang <rui1.zhang@intel.com>
Signed-off-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|
| e149af9c | 09-Dec-2025 |
Even Xu <even.xu@intel.com> |
HID: Intel-thc-hid: Intel-quicki2c: Support writing output report format
There are two output formats requested in the HID-over-I2C specification:
- Command format (set feature/set report): encoded
HID: Intel-thc-hid: Intel-quicki2c: Support writing output report format
There are two output formats requested in the HID-over-I2C specification:
- Command format (set feature/set report): encoded command written to
command register, followed by data written to data register
- Output report format: all data written directly to output register
Current quicki2c_init_write_buf() implementation only supports the
command format.
Extend quicki2c_init_write_buf() to automatically detect the output
format based on the presence of command parameters and prepare the
appropriate output buffer accordingly.
Tested-by: Rui Zhang <rui1.zhang@intel.com>
Signed-off-by: Even Xu <even.xu@intel.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
show more ...
|