From: Hilgad Montelo <hilgad.montelo@gmail.com>
To: kenneth.t.chan@gmail.com, hansg@kernel.org,
ilpo.jarvinen@linux.intel.com
Cc: platform-driver-x86@vger.kernel.org,
linux-kernel@vger.kernel.org,
Hilgad Montelo <hilgad.montelo@gmail.com>
Subject: [PATCH v2 0/3] platform/x86: panasonic-laptop: CF-33 hotkey fixes
Date: Thu, 13 Aug 2026 19:17:41 -0300 [thread overview]
Message-ID: <20260813221744.25668-1-hilgad.montelo@gmail.com> (raw)
This series fixes two non-working buttons on the Panasonic Toughbook
CF-33 Mk1 and an independent bug found along the way, all in
drivers/platform/x86/panasonic-laptop.c.
Patch 1 fixes the bezel Rotation Lock button, which turns out to
signal via raw i8042 scancodes that alias the real Left-GUI key,
rather than via ACPI notify like the driver's other hotkeys.
Patch 2 adds support for the bezel A1/A2 buttons, which are wired to a
second ACPI device (MAT003C/TBTN) that nothing currently binds to.
Found by disassembling the platform's ACPI tables, since these buttons
produced no signal through any of evdev, ACPI notify, WMI, or ACPI GPE
interrupt counters.
Patch 3 fixes a latent off-by-one heap overflow in the existing HKEY
SINF-parsing code, independently triggered by this hardware's exact
SQTY/SINF sizes and caught via UBSan while testing patch 2. It's
unrelated to the CF-33-specific work but is included here since it was
found in the course of it and touches the same file.
Changes in v2:
- Patch 1: fix a bug in panasonic_i8042_filter() found after this
series was first posted. The filter's scancode switch masked off
the top bit (data & 0x7f) so a key's make and break codes share a
case label; that's correct for the volume keys (both make and
break are meant to be fully swallowed there) but it also made the
genuine Left-GUI/Meta break code (0xdb) collide with its make code
(0x5b), since 0xdb & 0x7f == 0x5b too. The filter misidentified
every real release of the physical Left-GUI/Meta key as a possible
start of the rotate-lock sequence, silently dropped it, and left
the kernel's input core believing the key was still held -
reproducible on hardware as GNOME/Mutter treating every subsequent
keystroke as a stuck-Super-modified shortcut. Fixed by requiring an
exact match against the make code before entering the wait state;
any other byte (i.e. the real break code) now falls through to the
default path and is replayed untouched, as it always should have
been.
All three verified on real CF-33 Mk1 hardware, including across a
reboot with the combined patch set installed via DKMS, and v2's fix
specifically verified via raw i8042 event capture on
/dev/input/event3 across five separate Windows-key taps interleaved
with normal typing, confirming clean make/break pairs and no more
stuck-modifier behavior.
Hilgad Montelo (3):
platform/x86: panasonic-laptop: Handle CF-33 rotation-lock button
platform/x86: panasonic-laptop: Add driver for CF-33 A1/A2 buttons
(TBTN)
platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]
drivers/platform/x86/panasonic-laptop.c | 264 +++++++++++++++++++++++-
1 file changed, 261 insertions(+), 3 deletions(-)
--
2.53.0
next reply other threads:[~2026-08-13 22:17 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-13 22:17 Hilgad Montelo [this message]
2026-08-13 22:17 ` [PATCH v2 1/3] platform/x86: panasonic-laptop: Handle CF-33 rotation-lock button Hilgad Montelo
2026-09-17 12:31 ` Ilpo Järvinen
2026-08-13 22:17 ` [PATCH v2 2/3] platform/x86: panasonic-laptop: Add driver for CF-33 A1/A2 buttons (TBTN) Hilgad Montelo
2026-09-17 12:27 ` Ilpo Järvinen
2026-08-13 22:17 ` [PATCH v2 3/3] platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] Hilgad Montelo
2026-08-18 11:09 ` Ilpo Järvinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260813221744.25668-1-hilgad.montelo@gmail.com \
--to=hilgad.montelo@gmail.com \
--cc=hansg@kernel.org \
--cc=ilpo.jarvinen@linux.intel.com \
--cc=kenneth.t.chan@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=platform-driver-x86@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®