From 660ee6792edfe498e35ec17b1b34bb6704e74f4f Mon Sep 17 00:00:00 2001 From: Fenglin Wu Date: Thu, 6 Aug 2026 23:21:40 -0700 Subject: [PATCH 1/3] dt-bindings: input: Add Qualcomm SPMI PMIC haptics Add binding document for the haptics module inside Qualcomm PMIC PMIH0108. Assisted-by: Claude:claude-4-8-opus Reviewed-by: Krzysztof Kozlowski Signed-off-by: Fenglin Wu Link: https://patch.msgid.link/20260806-qcom-spmi-haptics-v6-1-19fcecd5204f@oss.qualcomm.com [robh: Drop example] Signed-off-by: Rob Herring (Arm) --- .../bindings/input/qcom,spmi-haptics.yaml | 116 ++++++++++++++++++ 1 file changed, 116 insertions(+) create mode 100644 Documentation/devicetree/bindings/input/qcom,spmi-haptics.yaml diff --git a/Documentation/devicetree/bindings/input/qcom,spmi-haptics.yaml b/Documentation/devicetree/bindings/input/qcom,spmi-haptics.yaml new file mode 100644 index 000000000000..e6cdaed9ce5b --- /dev/null +++ b/Documentation/devicetree/bindings/input/qcom,spmi-haptics.yaml @@ -0,0 +1,116 @@ +# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/input/qcom,spmi-haptics.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: Haptics device inside Qualcomm Technologies, Inc. PMIC + +maintainers: + - Fenglin Wu + +description: | + Certain Qualcomm PMICs integrate a haptics module, such as the HAP530_HV haptics + module in the PMIH0108 PMIC, which drives an LRA (Linear Resonant Actuator) with + an output voltage up to 10 V. Several play modes are supported in HAP530_HV: + + DIRECT_PLAY: The hardware outputs sinusoidal waveforms whose period is + defined by qcom,lra-period-us and whose peak voltage is defined by + qcom,vmax-microvolt. The driving amplitude can be scaled in the range + [0, 255] via a single register byte. Hardware-based LRA auto-resonance + tracking is enabled by default in this mode, allowing the haptics engine + to follow the actual resonant frequency of the LRA and update the driving + period accordingly to achieve stronger vibration magnitude. + + FIFO: The hardware can play an arbitrary waveform composed of a sequence + of 8-bit samples at a configurable play rate. Samples are pre-filled + into the internal FIFO memory of the haptics module and continuously + replenished via the FIFO-empty IRQ until all samples have been played. + An 8K-byte FIFO memory bank is available in the HAP530_HV haptics module, + shared between the FIFO and PAT_MEM play modes. The memory partition + between the two modes is configurable via registers, and FIFO mode always + uses the 1st partition starting from offset 0. + + PAT_MEM: This mode is very similar to FIFO streaming mode but without the + data refilling capability. It is designed mainly for short, latency-critical + vibrations. The memory space for PAT_MEM mode must be reserved for dedicated + usage, and the waveform data should be preloaded and remain unchanged + thereafter. The haptics module can play the waveform data from the memory + region specified by the PAT_MEM play start address and length registers. + + In either FIFO mode or PAT_MEM mode, the following play rates are supported: + -- 0(T_LRA): each FIFO byte drives one full sinusoidal cycle with the + period defined in qcom,lra-period-us. + -- 1/2/3(T_LRA_DIV_2/4/8): each FIFO byte drives a half/quarter/eighth + sinusoidal cycle with the period defined in qcom,lra-period-us. + -- 4/5/6(T_LRA_X_2/4/8): each FIFO byte drives 2/4/8 sinusoidal cycles + with the period defined in qcom,lra-period-us. + -- 8/9/10/11/12/13(8KHz/16KHz/24KHz/32KHz/44.1KHz/48KHz): the FIFO + data is treated as PCM samples and drives the output with an + arbitrarily shaped waveform. This mode is typically used to define + custom driving waveforms for specific vibration effects such as fast + attack, crisp brake, etc. + + The drive voltage in FIFO or PAT_MEM mode can exceed the value defined in + qcom,vmax-microvolt to achieve a special vibration effect, but the waveform + must be short enough to prevent the LRA from being damaged by operating at + an overvoltage. + + Also, hardware-based LRA auto-resonance tracking is normally disabled in + FIFO or PAT_MEM mode, as these modes are intended to drive arbitrary + waveforms that may not follow the resonant frequency; autonomous hardware + resonance correction would interfere with the intended output. + +properties: + compatible: + items: + - const: qcom,pmih0108-haptics + - const: qcom,spmi-haptics + + reg: + items: + - description: HAP_CFG module base address + - description: HAP_PTN module base address + + reg-names: + items: + - const: cfg + - const: ptn + + interrupts: + maxItems: 1 + + interrupt-names: + items: + - const: fifo-empty + + qcom,vmax-microvolt: + description: + Maximum allowed output driving voltage in microvolts, must be a multiple + of 50,000 uV. This is the peak driving voltage in DIRECT_PLAY mode, + which outputs sinusoidal waveforms. The value should be equal to the + square root of 2 times the Vrms voltage of the LRA. + minimum: 50000 + maximum: 10000000 + multipleOf: 50000 + + qcom,lra-period-us: + description: + LRA actuator initial resonance period in microseconds + (1,000,000 / resonant_freq_hz). Used to configure T_LRA-based play + rates and the auto-resonance zero-crossing window. It could be also used + as the initial period if the LRA wants to be driven off resonance. + minimum: 5 + maximum: 20475 + multipleOf: 5 + +required: + - compatible + - reg + - reg-names + - interrupts + - interrupt-names + - qcom,vmax-microvolt + - qcom,lra-period-us + +additionalProperties: false From fe66c3ff85e85d492673c6dc95c3d624a63e0282 Mon Sep 17 00:00:00 2001 From: Fuad Tabba Date: Wed, 26 Aug 2026 12:22:34 +0100 Subject: [PATCH 2/3] of/irq: Fix device node refcount leak in of_irq_get_affinity() of_irq_parse_one() raises the refcount of the interrupt controller node on success, and of_irq_get_affinity() returns without putting it, so every call past the parse leaks one reference. It is reached from platform_get_irq_affinity(), used by arm_pmu, arm_spe_pmu and coresight-trbe. Put it once irq_populate_fwspec_info() has run: no in-tree ->get_fwspec_info() returns a mask that lives in the node. Fixes: 5404f5c06dd4 ("of/irq: Add interrupt affinity reporting interface") Signed-off-by: Fuad Tabba Link: https://patch.msgid.link/20260826112234.1033974-1-fuad.tabba@linux.dev Signed-off-by: Rob Herring (Arm) --- drivers/of/irq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index 967c19100879..ec035367c950 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -563,7 +563,9 @@ const struct cpumask *of_irq_get_affinity(struct device_node *dev, int index) of_phandle_args_to_fwspec(oirq.np, oirq.args, oirq.args_count, &fwspec); - if (irq_populate_fwspec_info(&fwspec, &info)) + rc = irq_populate_fwspec_info(&fwspec, &info); + of_node_put(oirq.np); + if (rc) return NULL; return info.affinity; From 5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f Mon Sep 17 00:00:00 2001 From: Abdurrahman Hussain Date: Wed, 5 Aug 2026 13:31:00 -0700 Subject: [PATCH 3/3] of: fix out-of-bounds read in of_alias_scan() stem parser The stem parser tests isdigit(*(end - 1)) before checking end > start and so reads one byte before the property name when the name is empty or all digits. Check the bound first. Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-fable-5 [Claude Code] Signed-off-by: Abdurrahman Hussain Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260805-nh-of-alias-overlay-v6-1-74f21d440819@nexthop.ai Signed-off-by: Rob Herring (Arm) --- drivers/of/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/of/base.c b/drivers/of/base.c index dd7dda0e0a57..378703dbc11f 100644 --- a/drivers/of/base.c +++ b/drivers/of/base.c @@ -1971,7 +1971,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align)) /* walk the alias backwards to extract the id and work out * the 'stem' string */ - while (isdigit(*(end-1)) && end > start) + while (end > start && isdigit(*(end - 1))) end--; len = end - start;