summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-09-24Merge branch 'net_sched-fix-a-UAF-in-tcf_action_init'David S. Miller
Cong Wang says: ==================== net_sched: fix a UAF in tcf_action_init() This patchset fixes a use-after-free triggered by syzbot. Please find more details in each patch description. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2020-09-24net_sched: commit action insertions togetherCong Wang
syzbot is able to trigger a failure case inside the loop in tcf_action_init(), and when this happens we clean up with tcf_action_destroy(). But, as these actions are already inserted into the global IDR, other parallel process could free them before tcf_action_destroy(), then we will trigger a use-after-free. Fix this by deferring the insertions even later, after the loop, and committing all the insertions in a separate loop, so we will never fail in the middle of the insertions any more. One side effect is that the window between alloction and final insertion becomes larger, now it is more likely that the loop in tcf_del_walker() sees the placeholder -EBUSY pointer. So we have to check for error pointer in tcf_del_walker(). Reported-and-tested-by: syzbot+2287853d392e4b42374a@syzkaller.appspotmail.com Fixes: 0190c1d452a9 ("net: sched: atomically check-allocate action") Cc: Vlad Buslov <vladbu@mellanox.com> Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-09-24net_sched: defer tcf_idr_insert() in tcf_action_init_1()Cong Wang
All TC actions call tcf_idr_insert() for new action at the end of their ->init(), so we can actually move it to a central place in tcf_action_init_1(). And once the action is inserted into the global IDR, other parallel process could free it immediately as its refcnt is still 1, so we can not fail after this, we need to move it after the goto action validation to avoid handling the failure case after insertion. This is found during code review, is not directly triggered by syzbot. And this prepares for the next patch. Cc: Vlad Buslov <vladbu@mellanox.com> Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-09-25Merge tag 'drm-misc-fixes-2020-09-24' of ↵Dave Airlie
git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.9: - Single null pointer deref fix for dma-buf. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/4106c21e-f52c-4c05-6cdb-daa743bb8617@linux.intel.com
2020-09-25Merge tag 'drm-intel-fixes-2020-09-24' of ↵Dave Airlie
git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.9-rc7: - Fix selftest reference to stack data out of scope - Fix GVT null pointer dereference - Backmerge from Linus' master to fix build Signed-off-by: Dave Airlie <airlied@redhat.com> From: Jani Nikula <jani.nikula@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/87zh5fpmha.fsf@intel.com
2020-09-25BackMerge commit '98477740630f270aecf648f1d6a9dbc6027d4ff1' into drm-fixesDave Airlie
The dax mess had some fallout, and i915 used a later base to fix their CI. Signed-off-by: Dave Airlie <airlied@redhat.com>
2020-09-24ep_create_wakeup_source(): dentry name can change under you...Al Viro
or get freed, for that matter, if it's a long (separately stored) name. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2020-09-24timers: Mask invalid flags in do_init_timer()Qianli Zhao
do_init_timer() accepts any combination of timer flags handed in by the caller without a sanity check, but only TIMER_DEFFERABLE, TIMER_PINNED and TIMER_IRQSAFE are valid. If the supplied flags have other bits set, this could result in malfunction. If bits are set in TIMER_CPUMASK the first timer usage could deference a cpu base which is outside the range of possible CPUs. If TIMER_MIGRATION is set, then the switch_timer_base() will live lock. Prevent that with a sanity check which warns when invalid flags are supplied and masks them out. [ tglx: Made it WARN_ON_ONCE() and added context to the changelog ] Signed-off-by: Qianli Zhao <zhaoqianli@xiaomi.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/r/9d79a8aa4eb56713af7379f99f062dedabcde140.1597326756.git.zhaoqianli@xiaomi.com
2020-09-24treewide: Make all debug_obj_descriptors constStephen Boyd
This should make it harder for the kernel to corrupt the debug object descriptor, used to call functions to fixup state and track debug objects, by moving the structure to read-only memory. Signed-off-by: Stephen Boyd <swboyd@chromium.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20200815004027.2046113-3-swboyd@chromium.org
2020-09-24debugobjects: Allow debug_obj_descr to be constStephen Boyd
The debugobject core could be slightly harder to corrupt if the debug_obj_descr would be a pointer to const memory. Depending on the architecture, const data structures are placed into read-only memory and thus are harder to corrupt or hijack. This descriptor is used to fix up stuff like timers and workqueues when core kernel data structures are busted, so moving the descriptors to read-only memory will make debugobjects more resilient to something going wrong and then corrupting the function pointers inside struct debug_obj_descr. Signed-off-by: Stephen Boyd <swboyd@chromium.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20200815004027.2046113-2-swboyd@chromium.org
2020-09-24Merge tag 'nvme-5.9-2020-09-24' of git://git.infradead.org/nvme into block-5.9Jens Axboe
Pull NVMe fixes from Christoph: "nvme fixes for 5.9 - fix error during controller probe that cause double free irqs (Keith Busch) - FC connection establishment fix (James Smart) - properly handle completions for invalid tags (Xianting Tian) - pass the correct nsid to the command effects and supported log (Chaitanya Kulkarni)" * tag 'nvme-5.9-2020-09-24' of git://git.infradead.org/nvme: nvme-core: don't use NVME_NSID_ALL for command effects and supported log nvme-fc: fail new connections to a deleted host or remote port nvme-pci: fix NULL req in completion handler nvme: return errors for hwmon init
2020-09-24KVM: x86: fix MSR_IA32_TSC read for nested migrationMaxim Levitsky
MSR reads/writes should always access the L1 state, since the (nested) hypervisor should intercept all the msrs it wants to adjust, and these that it doesn't should be read by the guest as if the host had read it. However IA32_TSC is an exception. Even when not intercepted, guest still reads the value + TSC offset. The write however does not take any TSC offset into account. This is documented in Intel's SDM and seems also to happen on AMD as well. This creates a problem when userspace wants to read the IA32_TSC value and then write it. (e.g for migration) In this case it reads L2 value but write is interpreted as an L1 value. To fix this make the userspace initiated reads of IA32_TSC return L1 value as well. Huge thanks to Dave Gilbert for helping me understand this very confusing semantic of MSR writes. Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Message-Id: <20200921103805.9102-2-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-09-24libbpf: Fix XDP program load regression for old kernelsAndrii Nakryiko
Fix regression in libbpf, introduced by XDP link change, which causes XDP programs to fail to be loaded into kernel due to specified BPF_XDP expected_attach_type. While kernel doesn't enforce expected_attach_type for BPF_PROG_TYPE_XDP, some old kernels already support XDP program, but they don't yet recognize expected_attach_type field in bpf_attr, so setting it to non-zero value causes program load to fail. Luckily, libbpf already has a mechanism to deal with such cases, so just make expected_attach_type optional for XDP programs. Fixes: dc8698cac7aa ("libbpf: Add support for BPF XDP link") Reported-by: Nikita Shirokov <tehnerd@tehnerd.com> Reported-by: Udip Pant <udippant@fb.com> Signed-off-by: Andrii Nakryiko <andriin@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200924171705.3803628-1-andriin@fb.com
2020-09-24Merge tag 'mmc-v5.9-rc4-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fix from Ulf Hansson: "Fix build warning in mmc_spi when CONFIG_HAS_DMA is unset" * tag 'mmc-v5.9-rc4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: mmc_spi: Fix mmc_spi_dma_alloc() return type for !HAS_DMA
2020-09-24Merge tag 'media/v5.9-3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - fix a regression at the CEC adapter core - two uAPI patches (one revert) for changes in this development cycle * tag 'media/v5.9-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: dt-bindings: media: imx274: Convert to json-schema media: media/v4l2: remove V4L2_FLAG_MEMORY_NON_CONSISTENT flag media: cec-adap.c: don't use flush_scheduled_work()
2020-09-24Merge tag 'sound-5.9-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Just a handful small device-specific fixes including a couple of reverts" * tag 'sound-5.9-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: Revert "ALSA: usb-audio: Disable Lenovo P620 Rear line-in volume control" Revert "ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO" ALSA: usb-audio: Add delay quirk for H570e USB headsets ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged ALSA: asihpi: fix iounmap in error handler
2020-09-25scripts/kallsyms: skip ppc compiler stub *.long_branch.* / *.plt_branch.*Masahiro Yamada
PowerPC allmodconfig often fails to build as follows: LD .tmp_vmlinux.kallsyms1 KSYM .tmp_vmlinux.kallsyms1.o LD .tmp_vmlinux.kallsyms2 KSYM .tmp_vmlinux.kallsyms2.o LD .tmp_vmlinux.kallsyms3 KSYM .tmp_vmlinux.kallsyms3.o LD vmlinux SORTTAB vmlinux SYSMAP System.map Inconsistent kallsyms data Try make KALLSYMS_EXTRA_PASS=1 as a workaround make[2]: *** [../Makefile:1162: vmlinux] Error 1 Setting KALLSYMS_EXTRA_PASS=1 does not help. This is caused by the compiler inserting stubs such as *.long_branch.* and *.plt_branch.* $ powerpc-linux-nm -n .tmp_vmlinux.kallsyms2 [ snip ] c00000000210c010 t 00000075.plt_branch.da9:19 c00000000210c020 t 00000075.plt_branch.1677:5 c00000000210c030 t 00000075.long_branch.memmove c00000000210c034 t 00000075.plt_branch.9e0:5 c00000000210c044 t 00000075.plt_branch.free_initrd_mem ... Actually, the problem mentioned in scripts/link-vmlinux.sh comments; "In theory it's possible this results in even more stubs, but unlikely" is happening here, and ends up with another kallsyms step required. scripts/kallsyms.c already ignores various compiler stubs. Let's do similar to make kallsysms for PowerPC always succeed in 2 steps. Reported-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> Tested-by: Guenter Roeck <linux@roeck-us.net>
2020-09-24mm: fix misplaced unlock_page in do_wp_page()Linus Torvalds
Commit 09854ba94c6a ("mm: do_wp_page() simplification") reorganized all the code around the page re-use vs copy, but in the process also moved the final unlock_page() around to after the wp_page_reuse() call. That normally doesn't matter - but it means that the unlock_page() is now done after releasing the page table lock. Again, not a big deal, you'd think. But it turns out that it's very wrong indeed, because once we've released the page table lock, we've basically lost our only reference to the page - the page tables - and it could now be free'd at any time. We do hold the mmap_sem, so no actual unmap() can happen, but madvise can come in and a MADV_DONTNEED will zap the page range - and free the page. So now the page may be free'd just as we're unlocking it, which in turn will usually trigger a "Bad page state" error in the freeing path. To make matters more confusing, by the time the debug code prints out the page state, the unlock has typically completed and everything looks fine again. This all doesn't happen in any normal situations, but it does trigger with the dirtyc0w_child LTP test. And it seems to trigger much more easily (but not expclusively) on s390 than elsewhere, probably because s390 doesn't do the "batch pages up for freeing after the TLB flush" that gives the unlock_page() more time to complete and makes the race harder to hit. Fixes: 09854ba94c6a ("mm: do_wp_page() simplification") Link: https://lore.kernel.org/lkml/a46e9bbef2ed4e17778f5615e818526ef848d791.camel@redhat.com/ Link: https://lore.kernel.org/linux-mm/c41149a8-211e-390b-af1d-d5eee690fecb@linux.alibaba.com/ Reported-by: Qian Cai <cai@redhat.com> Reported-by: Alex Shi <alex.shi@linux.alibaba.com> Bisected-and-analyzed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Tested-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-09-24gpio: aspeed: fix ast2600 bank propertiesTao Ren
GPIO_U is mapped to the least significant byte of input/output mask, and the byte in "output" mask should be 0 because GPIO_U is input only. All the other bits need to be 1 because GPIO_V/W/X support both input and output modes. Similarly, GPIO_Y/Z are mapped to the 2 least significant bytes, and the according bits need to be 1 because GPIO_Y/Z support both input and output modes. Fixes: ab4a85534c3e ("gpio: aspeed: Add in ast2600 details to Aspeed driver") Signed-off-by: Tao Ren <rentao.bupt@gmail.com> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
2020-09-24mt76: mt7615: reduce maximum VHT MPDU length to 7991Felix Fietkau
After fixing mac80211 to allow larger A-MSDUs in some cases, there have been reports of performance regressions and packet loss with some clients. It appears that the issue occurs when the hardware is transmitting A-MSDUs bigger than 8k. Limit the local VHT MPDU size capability to 7991, matching the value used for MT7915 as well. Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200923052442.24141-1-nbd@nbd.name
2020-09-24gpio/aspeed-sgpio: don't enable all interrupts by defaultJeremy Kerr
Currently, the IRQ setup for the SGPIO driver enables all interrupts in dual-edge trigger mode. Since the default handler is handle_bad_irq, any state change on input GPIOs will trigger bad IRQ warnings. This change applies sensible IRQ defaults: single-edge trigger, and all IRQs disabled. Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Fixes: 7db47faae79b ("gpio: aspeed: Add SGPIO driver") Reviewed-by: Joel Stanley <joel@jms.id.au> Acked-by: Andrew Jeffery <andrew@aj.id.au> Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
2020-09-24gpio/aspeed-sgpio: enable access to all 80 input & output sgpiosJeremy Kerr
Currently, the aspeed-sgpio driver exposes up to 80 GPIO lines, corresponding to the 80 status bits available in hardware. Each of these lines can be configured as either an input or an output. However, each of these GPIOs is actually an input *and* an output; we actually have 80 inputs plus 80 outputs. This change expands the maximum number of GPIOs to 160; the lower half of this range are the input-only GPIOs, the upper half are the outputs. We fix the GPIO directions to correspond to this mapping. This also fixes a bug when setting GPIOs - we were reading from the input register, making it impossible to set more than one output GPIO. Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Fixes: 7db47faae79b ("gpio: aspeed: Add SGPIO driver") Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
2020-09-24gpio: pca953x: Fix uninitialized pending variableYe Li
When pca953x_irq_pending returns false, the pending parameter won't be set. But pca953x_irq_handler continues using this uninitialized variable as pending irqs and will cause problem. Fix the issue by initializing pending to 0. Fixes: 064c73afe738 ("gpio: pca953x: Synchronize interrupt handler properly") Signed-off-by: Ye Li <ye.li@nxp.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
2020-09-24spi: bcm-qspi: Fix probe regression on iProc platformsRay Jui
iProc chips have QSPI controller that does not have the MSPI_REV offset. Reading from that offset will cause a bus error. Fix it by having MSPI_REV query disabled in the generic compatible string. Fixes: 3a01f04d74ef ("spi: bcm-qspi: Handle lack of MSPI_REV offset") Link: https://lore.kernel.org/linux-arm-kernel/20200909211857.4144718-1-f.fainelli@gmail.com/T/#u Signed-off-by: Ray Jui <ray.jui@broadcom.com> Acked-by: Florian Fainelli <f.fainelli@gmail.com> Link: https://lore.kernel.org/r/20200910152539.45584-3-ray.jui@broadcom.com Signed-off-by: Mark Brown <broonie@kernel.org>
2020-09-24platform/x86: intel_pmc_core: do not create a static struct deviceGreg Kroah-Hartman
A struct device is a dynamic structure, with reference counting. "Tricking" the kernel to make a dynamic structure static, by working around the driver core release detection logic, is not nice. Because of this, this code has been used as an example for others on "how to do things", which is just about the worst thing possible to have happen. Fix this all up by making the platform device dynamic and providing a real release function. Cc: Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com> Cc: Vishwanath Somayaji <vishwanath.somayaji@intel.com> Cc: Darren Hart <dvhart@infradead.org> Cc: Andy Shevchenko <andy@infradead.org> Cc: Rajat Jain <rajatja@google.com> Cc: platform-driver-x86@vger.kernel.org Cc: linux-kernel@vger.kernel.org Reported-by: Maximilian Luz <luzmaximilian@gmail.com> Fixes: b02f6a2ef0a1 ("platform/x86: intel_pmc_core: Attach using APCI HID "INT33A1"") Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Rajat Jain <rajatja@google.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2020-09-24platform/x86: mlx-platform: Fix extended topology configuration for power ↵Vadim Pasternak
supply units Fix topology configuration for power supply units in structure 'mlxplat_mlxcpld_ext_pwr_items_data', due to hardware change. Note: no need to backport the fix, since there is no such hardware yet (equipped with four power) at the filed. Signed-off-by: Vadim Pasternak <vadimp@nvidia.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2020-09-24platform/x86: pcengines-apuv2: Fix typo on define of ↵Ed Wildgoose
AMD_FCH_GPIO_REG_GPIO55_DEVSLP0 Schematics show that the GPIO number is 55 (not 59). Trivial typo. Signed-off-by: Ed Wildgoose <lists@wildgooses.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2020-09-24platform/x86: fix kconfig dependency warning for FUJITSU_LAPTOPNecip Fazil Yildiran
When FUJITSU_LAPTOP is enabled and NEW_LEDS is disabled, it results in the following Kbuild warning: WARNING: unmet direct dependencies detected for LEDS_CLASS Depends on [n]: NEW_LEDS [=n] Selected by [y]: - FUJITSU_LAPTOP [=y] && X86 [=y] && X86_PLATFORM_DEVICES [=y] && ACPI [=y] && INPUT [=y] && BACKLIGHT_CLASS_DEVICE [=y] && (ACPI_VIDEO [=n] || ACPI_VIDEO [=n]=n) The reason is that FUJITSU_LAPTOP selects LEDS_CLASS without depending on or selecting NEW_LEDS while LEDS_CLASS is subordinate to NEW_LEDS. Honor the kconfig menu hierarchy to remove kconfig dependency warnings. Reported-by: Hans de Goede <hdegoede@redhat.com> Fixes: d89bcc83e709 ("platform/x86: fujitsu-laptop: select LEDS_CLASS") Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2020-09-24platform/x86: fix kconfig dependency warning for LG_LAPTOPNecip Fazil Yildiran
When LG_LAPTOP is enabled and NEW_LEDS is disabled, it results in the following Kbuild warning: WARNING: unmet direct dependencies detected for LEDS_CLASS Depends on [n]: NEW_LEDS [=n] Selected by [y]: - LG_LAPTOP [=y] && X86 [=y] && X86_PLATFORM_DEVICES [=y] && ACPI [=y] && ACPI_WMI [=y] && INPUT [=y] The reason is that LG_LAPTOP selects LEDS_CLASS without depending on or selecting NEW_LEDS while LEDS_CLASS is subordinate to NEW_LEDS. Honor the kconfig menu hierarchy to remove kconfig dependency warnings. Fixes: dbf0c5a6b1f8 ("platform/x86: Add LG Gram laptop special features driver") Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Acked-by: mark gross <mgross@linux.intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2020-09-24platform/x86: thinkpad_acpi: initialize tp_nvram_state variableTom Rix
clang static analysis flags this represenative problem thinkpad_acpi.c:2523:7: warning: Branch condition evaluates to a garbage value if (!oldn->mute || ^~~~~~~~~~~ In hotkey_kthread() mute is conditionally set by hotkey_read_nvram() but unconditionally checked by hotkey_compare_and_issue_event(). So the tp_nvram_state variable s[2] needs to be initialized. Fixes: 01e88f25985d ("ACPI: thinkpad-acpi: add CMOS NVRAM polling for hot keys (v9)") Signed-off-by: Tom Rix <trix@redhat.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Acked-by: mark gross <mgross@linux.intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2020-09-24platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on the HP ↵Hans de Goede
Pavilion 11 x360 Commit cfae58ed681c ("platform/x86: intel-vbtn: Only blacklist SW_TABLET_MODE on the 9 / "Laptop" chasis-type") restored SW_TABLET_MODE reporting on the HP stream x360 11 series on which it was previously broken by commit de9647efeaa9 ("platform/x86: intel-vbtn: Only activate tablet mode switch on 2-in-1's"). It turns out that enabling SW_TABLET_MODE reporting on devices with a chassis-type of 10 ("Notebook") causes SW_TABLET_MODE to always report 1 at boot on the HP Pavilion 11 x360, which causes libinput to disable the kbd and touchpad. The HP Pavilion 11 x360's ACPI VGBS method sets bit 4 instead of bit 6 when NOT in tablet mode at boot. Inspecting all the DSDTs in my DSDT collection shows only one other model, the Medion E1239T ever setting bit 4 and it always sets this together with bit 6. So lets treat bit 4 as a second bit which when set indicates the device not being in tablet-mode, as we already do for bit 6. While at it also prefix all VGBS constant defines with "VGBS_". Fixes: cfae58ed681c ("platform/x86: intel-vbtn: Only blacklist SW_TABLET_MODE on the 9 / "Laptop" chasis-type") Signed-off-by: Hans de Goede <hdegoede@redhat.com> Acked-by: Mark Gross <mgross@linux.intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2020-09-24platform/x86: asus-wmi: Add BATC battery name to the list of supportedMarius Iacob
The Intel Atom Cherry Trail platform reports a new battery name (BATC). Tested on ASUS Transformer Mini T103HAF. Signed-off-by: Marius Iacob <themariusus@gmail.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2020-09-24platform/x86: asus-nb-wmi: Revert "Do not load on Asus T100TA and T200TA"Hans de Goede
The WMI INIT method on for some reason turns on the camera LED on these 2-in-1s, without the WMI interface allowing further control over the LED. To fix this commit b5f7311d3a2e ("platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA") added a blacklist with these 2 models on it since the WMI driver did not add any extra functionality to these models. Recently I've been working on making more 2-in-1 models report their tablet-mode (SW_TABLET_MODE) to userspace; and I've found that these 2 Asus models report this through WMI. This commit reverts the adding of the blacklist, so that the Asus WMI driver can be used on these models to report their tablet-mode. I have another patch fixing the LED issue in a different manner. Note this is the second time the we revert the adding of the asus_nb_wmi_blacklist. It was reverted before in commit: aab9e7896ec9 ("platform/x86: asus-nb-wmi: Revert "Do not load on Asus T100TA and T200TA")" But some how (accidentally re-applying of the patch?) it got re-added again in commit 3bd12da7f50b ("platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA"), so now we need to revert it again. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2020-09-24platform/x86: touchscreen_dmi: Add info for the MPMAN Converter9 2-in-1Hans de Goede
Add touchscreen info for the MPMAN Converter9 2-in-1. This device uses the same case as the ITworks TW891, but it uses a different digitizer, so it needs its own firmware. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2020-09-24vhost-vdpa: fix backend feature ioctlsJason Wang
Commit 653055b9acd4 ("vhost-vdpa: support get/set backend features") introduces two malfunction backend features ioctls: 1) the ioctls was blindly added to vring ioctl instead of vdpa device ioctl 2) vhost_set_backend_features() was called when dev mutex has already been held which will lead a deadlock This patch fixes the above issues. Cc: Eli Cohen <elic@nvidia.com> Reported-by: Zhu Lingshan <lingshan.zhu@intel.com> Fixes: 653055b9acd4 ("vhost-vdpa: support get/set backend features") Signed-off-by: Jason Wang <jasowang@redhat.com> Link: https://lore.kernel.org/r/20200907104343.31141-1-jasowang@redhat.com Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-09-24vhost: Fix documentationEli Cohen
Fix documentation to match actual function prototypes "end" used instead of "last". Fix that. Signed-off-by: Eli Cohen <eli@mellanox.com> Link: https://lore.kernel.org/r/20200630052925.GA157062@mtl-vdi-166.wap.labs.mlnx Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-09-24Documentation: laptops: thinkpad-acpi: fix underline length build warningRandy Dunlap
Fix underline length build warning in thinkpad-acpi.rst documentation: Documentation/admin-guide/laptops/thinkpad-acpi.rst:1437: WARNING: Title underline too short. DYTC Lapmode sensor ------------------ Fixes: acf7f4a59114 ("platform/x86: thinkpad_acpi: lap or desk mode interface") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Nitin Joshi <njoshi1@lenovo.com> Cc: Sugumaran <slacshiminar@lenovo.com> Cc: Bastien Nocera <bnocera@redhat.com> Cc: Mark Pearson <markpearson@lenovo.com> Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Cc: Darren Hart <dvhart@infradead.org> Cc: Henrique de Moraes Holschuh <ibm-acpi@hmh.eng.br> Cc: ibm-acpi-devel@lists.sourceforge.net Cc: platform-driver-x86@vger.kernel.org Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2020-09-24Platform: OLPC: Fix memleak in olpc_ec_probeDinghao Liu
When devm_regulator_register() fails, ec should be freed just like when olpc_ec_cmd() fails. Fixes: 231c0c216172a ("Platform: OLPC: Add a regulator for the DCON") Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2020-09-24clocksource/drivers/sp804: Enable Hisilicon sp804 timer 64bit modeZhen Lei
A 100MHZ 32-bit timer will be wrapped up less than 43s. Although the kernel maintains a software high 32-bit count in the tick IRQ. But it's not applicable to the user mode APPs. Note: The kernel still uses the lower 32 bits of the timer. Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/20200918132237.3552-9-thunder.leizhen@huawei.com
2020-09-24clocksource/drivers/sp804: Add support for Hisilicon sp804 timerZhen Lei
The ARM SP804 supports a maximum of 32-bit counter, but Hisilicon extends it to 64-bit. That means, the registers: TimerXload, TimerXValue and TimerXBGLoad are 64bits, all other registers are the same as those in the SP804. The driver code can be completely reused except that the register offset is different. Use compatible = "hisilicon,sp804" mark as Hisilicon sp804 timer. Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/20200918132237.3552-8-thunder.leizhen@huawei.com
2020-09-24clocksource/drivers/sp804: Support non-standard register offsetZhen Lei
The ARM SP804 supports a maximum of 32-bit counter, but Hisilicon extends it to 64-bit. That means, the registers: TimerXload, TimerXValue and TimerXBGLoad are 64bits, all other registers are the same as those in the SP804. The driver code can be completely reused except that the register offset is different. Currently, we get a timer register address by: add the constant register offset to the timer base address. e.g. "base + TIMER_CTRL". It can not be dynamically adjusted at run time. So create a new structure "sp804_timer" to record the original registers offset, and create a new structure "sp804_clkevt" to record the calculated registers address. So the "base + TIMER_CTRL" is changed to "clkevt->ctrl", this will faster than "base + timer->ctrl". For example: struct sp804_timer arm_sp804_timer = { .ctrl = TIMER_CTRL, }; struct sp804_clkevt clkevt; clkevt.ctrl = base + arm_sp804_timer.ctrl. - writel(0, base + TIMER_CTRL); + writel(0, clkevt->ctrl); Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/20200918132237.3552-7-thunder.leizhen@huawei.com
2020-09-24clocksource/drivers/sp804: Prepare for support non-standard register offsetZhen Lei
Add two local variables: timer1_base and timer2_base in sp804_of_init(), to avoid repeatedly calculate the base address of timer2, and make it easier to recognize timer1. Hope to make the next patch looks more clear. No functional change. Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/20200918132237.3552-6-thunder.leizhen@huawei.com
2020-09-24clocksource/drivers/sp804: Remove a mismatched commentZhen Lei
writel(0, base + TIMER_CTRL); ... ... writel(xxx | TIMER_CTRL_PERIODIC, base + TIMER_CTRL); The timer is just temporarily disabled, and it will be set to periodic mode later. The description of the field TimerMode of the register TimerXControl as shown below: 0 = Timer module is in free-running mode (default) 1 = Timer module is in periodic mode. Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/20200918132237.3552-5-thunder.leizhen@huawei.com
2020-09-24clocksource/drivers/sp804: Delete the leading "__" of some functionsZhen Lei
Delete the leading "__" of __sp804_clocksource_and_sched_clock_init() and __sp804_clockevents_init(), make it looks a little more comfortable. Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/20200918132237.3552-4-thunder.leizhen@huawei.com
2020-09-24clocksource/drivers/sp804: Remove unused sp804_timer_disable() and timer-sp804.hZhen Lei
Since commit 7484c727b636 ("ARM: realview: delete the RealView board files") and commit 16956fed35fe ("ARM: versatile: switch to DT only booting and remove legacy code"), there's no one to use the functions defined or declared in include/clocksource/timer-sp804.h. Delete it. Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/20200918132237.3552-3-thunder.leizhen@huawei.com
2020-09-24clocksource/drivers/sp804: Cleanup clk_get_sys()Kefeng Wang
Move the clk_get_sys() part into sp804_get_clock_rate(), cleanup the same code. Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com> Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/20200918132237.3552-2-thunder.leizhen@huawei.com
2020-09-24dt-bindings: timer: renesas,cmt: Document r8a774e1 CMT supportLad Prabhakar
Document SoC specific bindings for RZ/G2H (r8a774e1) SoC. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/1594811350-14066-6-git-send-email-prabhakar.mahadev-lad.rj@bp.renesas.com
2020-09-24dt-bindings: timer: renesas,cmt: Document r8a7742 CMT supportLad Prabhakar
Document SoC specific compatible strings for r8a7742. No driver change is needed as the fallback strings will activate the right code. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Marian-Cristian Rotariu <marian-cristian.rotariu.rb@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/20200902091927.32211-1-prabhakar.mahadev-lad.rj@bp.renesas.com
2020-09-24iommu/exynos: add missing put_device() call in exynos_iommu_of_xlate()Yu Kuai
if of_find_device_by_node() succeed, exynos_iommu_of_xlate() doesn't have a corresponding put_device(). Thus add put_device() to fix the exception handling for this function implementation. Fixes: aa759fd376fb ("iommu/exynos: Add callback for initializing devices from device tree") Signed-off-by: Yu Kuai <yukuai3@huawei.com> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Link: https://lore.kernel.org/r/20200918011335.909141-1-yukuai3@huawei.com Signed-off-by: Joerg Roedel <jroedel@suse.de>
2020-09-24s390/zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctlChristian Borntraeger
reqcnt is an u32 pointer but we do copy sizeof(reqcnt) which is the size of the pointer. This means we only copy 8 byte. Let us copy the full monty. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Cc: Harald Freudenberger <freude@linux.ibm.com> Cc: stable@vger.kernel.org Fixes: af4a72276d49 ("s390/zcrypt: Support up to 256 crypto adapters.") Reviewed-by: Harald Freudenberger <freude@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
generated by cgit (git 2.34.1) at 2025-09-13 03:19:55 +0000