[PATCH v2 0/3] platform/x86: panasonic-laptop: CF-33 hotkey fixes

Hilgad Montelo <[email protected]>
Newsgroups org.kernel.vger.linux-kernel,org.kernel.vger.platform-driver-x86
Message-ID <[email protected]>
This series fixes two non-working buttons on the Panasonic Toughbook
CF-33 Mk1 and an independent bug found along the way, all in
drivers/platform/x86/panasonic-laptop.c.

Patch 1 fixes the bezel Rotation Lock button, which turns out to
signal via raw i8042 scancodes that alias the real Left-GUI key,
rather than via ACPI notify like the driver's other hotkeys.

Patch 2 adds support for the bezel A1/A2 buttons, which are wired to a
second ACPI device (MAT003C/TBTN) that nothing currently binds to.
Found by disassembling the platform's ACPI tables, since these buttons
produced no signal through any of evdev, ACPI notify, WMI, or ACPI GPE
interrupt counters.

Patch 3 fixes a latent off-by-one heap overflow in the existing HKEY
SINF-parsing code, independently triggered by this hardware's exact
SQTY/SINF sizes and caught via UBSan while testing patch 2. It's
unrelated to the CF-33-specific work but is included here since it was
found in the course of it and touches the same file.

Changes in v2:
- Patch 1: fix a bug in panasonic_i8042_filter() found after this
  series was first posted. The filter's scancode switch masked off
  the top bit (data & 0x7f) so a key's make and break codes share a
  case label; that's correct for the volume keys (both make and
  break are meant to be fully swallowed there) but it also made the
  genuine Left-GUI/Meta break code (0xdb) collide with its make code
  (0x5b), since 0xdb & 0x7f == 0x5b too. The filter misidentified
  every real release of the physical Left-GUI/Meta key as a possible
  start of the rotate-lock sequence, silently dropped it, and left
  the kernel's input core believing the key was still held -
  reproducible on hardware as GNOME/Mutter treating every subsequent
  keystroke as a stuck-Super-modified shortcut. Fixed by requiring an
  exact match against the make code before entering the wait state;
  any other byte (i.e. the real break code) now falls through to the
  default path and is replayed untouched, as it always should have
  been.

All three verified on real CF-33 Mk1 hardware, including across a
reboot with the combined patch set installed via DKMS, and v2's fix
specifically verified via raw i8042 event capture on
/dev/input/event3 across five separate Windows-key taps interleaved
with normal typing, confirming clean make/break pairs and no more
stuck-modifier behavior.

Hilgad Montelo (3):
  platform/x86: panasonic-laptop: Handle CF-33 rotation-lock button
  platform/x86: panasonic-laptop: Add driver for CF-33 A1/A2 buttons
    (TBTN)
  platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]

 drivers/platform/x86/panasonic-laptop.c | 264 +++++++++++++++++++++++-
 1 file changed, 261 insertions(+), 3 deletions(-)

-- 
2.53.0
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.