aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2022-02-11i2c: piix4: Add EFCH MMIO support to region request and releaseTerry Bowman1-8/+58
EFCH cd6h/cd7h port I/O may no longer be available on later AMD processors and it is recommended to use MMIO instead. Update the request and release functions to support MMIO. MMIO request/release and mmapping require details during cleanup. Add a MMIO configuration structure containing resource and vaddress details for mapping the region, accessing the region, and releasing the region. Signed-off-by: Terry Bowman <terry.bowman@amd.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Reviewed-by: Jean Delvare <jdelvare@suse.de> [wsa: rebased after fixup in previous patch] Signed-off-by: Wolfram Sang <wsa@kernel.org>
2022-02-11i2c: piix4: Move SMBus port selection into functionTerry Bowman1-10/+17
Move port selection code into a separate function. Refactor is in preparation for following MMIO changes. Signed-off-by: Terry Bowman <terry.bowman@amd.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Reviewed-by: Jean Delvare <jdelvare@suse.de> Signed-off-by: Wolfram Sang <wsa@kernel.org>
2022-02-11i2c: piix4: Move SMBus controller base address detect into functionTerry Bowman1-25/+44
Move SMBus controller base address detection into function. Refactor is in preparation for following MMIO changes. Signed-off-by: Terry Bowman <terry.bowman@amd.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Reviewed-by: Jean Delvare <jdelvare@suse.de> Signed-off-by: Wolfram Sang <wsa@kernel.org>
2022-02-11i2c: piix4: Move port I/O region request/release code into functionsTerry Bowman1-17/+31
Move duplicated region request and release code into a function. Move is in preparation for following MMIO changes. Signed-off-by: Terry Bowman <terry.bowman@amd.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Reviewed-by: Jean Delvare <jdelvare@suse.de> [wsa: added missing curly brace] Signed-off-by: Wolfram Sang <wsa@kernel.org>
2022-02-11Merge tag 'wireless-next-2022-02-11' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-nextDavid S. Miller129-3739/+6053
wireless-next patches for v5.18 First set of patches for v5.18, with both wireless and stack patches. rtw89 now has AP mode support and wcn36xx has survey support. But otherwise pretty normal. Major changes: ath11k * add LDPC FEC type in 802.11 radiotap header * enable RX PPDU stats in monitor co-exist mode wcn36xx * implement survey reporting brcmfmac * add CYW43570 PCIE device rtw88 * rtw8821c: enable RFE 6 devices rtw89 * AP mode support mt76 * mt7916 support * background radar detection support
2022-02-11Merge tag 'wireless-2022-02-11' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wirelessDavid S. Miller21-609/+85
wireless fixes for v5.17 Second set of fixes for v5.17. This is the first pull request with both driver and stack patches. Most important here are a regression fix for brcmfmac USB devices and an iwlwifi fix for use after free when the firmware was missing. We have new maintainers for ath9k and wcn36xx as well as ath6kl is now orphaned. Also smaller fixes to iwlwifi and stack.
2022-02-11drm/i915: Extract skl_crtc_calc_dbuf_bw()Ville Syrjälä1-38/+44
Extract the dbuf slice data_rate calculation into a small helper. Should make it a bit easier to handle the different color planes of planar formats correctly. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220118092354.11631-7-ville.syrjala@linux.intel.com Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
2022-02-11drm/i915: Extract skl_allocate_plane_ddb()Ville Syrjälä1-17/+24
Replace some copy-pasta with a function. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220118092354.11631-6-ville.syrjala@linux.intel.com Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
2022-02-11drm/i915: Introduce skl_plane_ddb_iterVille Syrjälä1-48/+49
Collect a bit of the stuff used during the plane ddb allocation into a struct we can pass around. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220118092354.11631-5-ville.syrjala@linux.intel.com Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
2022-02-11drm/i915: Fix plane relative_data_rate calculationVille Syrjälä1-61/+2
We are currently computing the relative data rates as src_size * scale_factor where scale_factor is src_size / dst_size. Thus relative data rate is src_size * src_size / dst_size, which is just utter nonsense. What we really seem to want is just a reasonable estimate on how much data will be fetched which is just src_size. So let's do that instead. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220118092354.11631-4-ville.syrjala@linux.intel.com Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
2022-02-11drm/i915: Extract skl_ddb_entry_init()Ville Syrjälä1-19/+25
Extract a small helper to populate a ddb entry. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220118092354.11631-3-ville.syrjala@linux.intel.com Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
2022-02-11drm/i915: Drop pointless dev_priv argumentVille Syrjälä1-6/+5
skl_ddb_entry_init_from_hw() has no need for dev_priv. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220118092354.11631-2-ville.syrjala@linux.intel.com Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
2022-02-11loop: revert "make autoclear operation asynchronous"Tetsuo Handa2-37/+29
The kernel test robot is reporting that xfstest which does umount ext2 on xfs umount xfs sequence started failing, for commit 322c4293ecc58110 ("loop: make autoclear operation asynchronous") removed a guarantee that fput() of backing file is processed before lo_release() from close() returns to user mode. And syzbot is reporting that deferring destroy_workqueue() from __loop_clr_fd() to a WQ context did not help [1]. Revert that commit. Link: https://syzkaller.appspot.com/bug?extid=831661966588c802aae9 [1] Reported-by: kernel test robot <oliver.sang@intel.com> Acked-by: Jan Kara <jack@suse.cz> Reviewed-by: Christoph Hellwig <hch@lst.de> Reported-by: syzbot <syzbot+831661966588c802aae9@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Link: https://lore.kernel.org/r/20220211071554.3424-1-penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Jens Axboe <axboe@kernel.dk>
2022-02-11drm/i915: split out gem/i915_gem_create.h from i915_drv.hJani Nikula4-4/+19
We already have the gem/i915_gem_create.c file. Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Acked-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/f4d5108498ce10fff8577520276d40e86b2d5a16.1644507885.git.jani.nikula@intel.com
2022-02-11drm/i915: split out gem/i915_gem_dmabuf.h from i915_drv.hJani Nikula6-5/+24
We already have the gem/i915_gem_dmabuf.c file. Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Acked-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/2f3fa0fb7cd78c204e27b2454410b6530289efdc.1644507885.git.jani.nikula@intel.com
2022-02-11drm/i915/dg2: Add Wa_22011100796Bruce Chang1-0/+9
Whenever Full soft reset is required, reset all individual engines first, and then do a full soft reset. Signed-off-by: Bruce Chang <yu.bruce.chang@intel.com> cc: Matt Roper <matthew.d.roper@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Signed-off-by: Ramalingam C <ramalingam.c@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220128185209.18077-5-ramalingam.c@intel.com
2022-02-11drm/i915: More gt idling time with guc submissionRamalingam C1-1/+1
On i915_selftest@live@gt_timelines, we create many contexts in loop and create and submit request and then destoy contexts. Destroying the context needs to disable scheduling, wait for G2H, deregister context and wait for G2H to destroy each context. Idling of the gt has to wait for all this to complete which is taking ~3sec for this test. Hence we are increasing the igt_flush_test's timeout for gt idling to 3Sec. Signed-off-by: Ramalingam C <ramalingam.c@intel.com> cc: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220128185209.18077-4-ramalingam.c@intel.com
2022-02-11drm/i915: align the plane_vma to min_page_size of stolen memRamalingam C1-2/+3
Align the plane vma size to the stolem memory regions' min_page_size. Signed-off-by: Ramalingam C <ramalingam.c@intel.com> cc: Matthew Auld <matthew.auld@intel.com> cc: Chris P Wilson <chris.p.wilson@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220128185209.18077-3-ramalingam.c@intel.com
2022-02-11drm/i915/dg2: Add Wa_22011450934Ramalingam C2-0/+32
An indirect ctx wabb is implemented as per Wa_22011450934 to avoid rcs restore hang during context restore of a preempted context in GPGPU mode Signed-off-by: Ramalingam C <ramalingam.c@intel.com> cc: Chris Wilson <chris.p.wilson@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220128185209.18077-2-ramalingam.c@intel.com
2022-02-11drm/i915/selftests: Disable runtime pm wakeref tracking for the mock deviceVille Syrjälä3-0/+6
commit c50df701d49e ("drm/i915: Enable rpm wakeref tracking whether runtime pm is enabled or not") enabled wakeref tracking even for the mock device. Turns out that has somewhat significant overhead, and on the glacial Core m3's we have in CI the vma selftests are now exceeding the allotted time budget. So let's disable the wakeref tracking once again for the mock device in order to avoid blowing up the selftest runtime. Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Acked-by: Tomi Sarvela <tomi.p.sarvela@intel.com> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220204171053.18409-1-ville.syrjala@linux.intel.com
2022-02-11dsa: mv88e6xxx: make serdes SGMII/Fiber tx amplitude configurableHolger Brunck4-0/+70
The mv88e6352, mv88e6240 and mv88e6176 have a serdes interface. This patch allows to configure the output swing to a desired value in the phy-handle of the port. The value which is peak to peak has to be specified in microvolts. As the chips only supports eight dedicated values we return EINVAL if the value in the DTS does not match one of these values. Signed-off-by: Holger Brunck <holger.brunck@hitachienergy.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Marek Behún <kabel@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2022-02-11iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTLMathias Krause1-3/+11
If we fail to copy the just created file descriptor to userland, we try to clean up by putting back 'fd' and freeing 'ib'. The code uses put_unused_fd() for the former which is wrong, as the file descriptor was already published by fd_install() which gets called internally by anon_inode_getfd(). This makes the error handling code leaving a half cleaned up file descriptor table around and a partially destructed 'file' object, allowing userland to play use-after-free tricks on us, by abusing the still usable fd and making the code operate on a dangling 'file->private_data' pointer. Instead of leaving the kernel in a partially corrupted state, don't attempt to explicitly clean up and leave this to the process exit path that'll release any still valid fds, including the one created by the previous call to anon_inode_getfd(). Simply return -EFAULT to indicate the error. Fixes: f73f7f4da581 ("iio: buffer: add ioctl() to support opening extra buffers for IIO device") Cc: stable@kernel.org Cc: Jonathan Cameron <jic23@kernel.org> Cc: Alexandru Ardelean <ardeleanalex@gmail.com> Cc: Lars-Peter Clausen <lars@metafoo.de> Cc: Nuno Sa <Nuno.Sa@analog.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mathias Krause <minipli@grsecurity.net> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-11drm/i915: remove leftover i915_gem_pm.h declarations from i915_drv.hJani Nikula2-3/+1
Remove the duplicates. Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Acked-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/48f5ace6393533372da5d13df3de0203c8db11b3.1644507885.git.jani.nikula@intel.com
2022-02-11tty: serial: imx: Add fast path when rs485 delays are 0Harald Seiler1-4/+14
Right now, even when `delay_rts_before_send` and `delay_rts_after_send` are 0, the hrtimer is triggered (with timeout 0) which can introduce a few 100us of additional overhead on slower i.MX platforms. Implement a fast path when the delays are 0, where the RTS signal is toggled immediately instead of going through an hrtimer. This fast path behaves identical to the code before delay support was implemented. Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Harald Seiler <hws@denx.de> Link: https://lore.kernel.org/r/20220119145204.238767-1-hws@denx.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-11usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)Souradeep Chowdhury3-0/+262
Add support for control peripheral of EUD (Embedded USB Debugger) to listen to events such as USB attach/detach, pet EUD to indicate software is functional.Reusing the platform device kobj, sysfs entry 'enable' is created to enable or disable EUD. To enable the eud the following needs to be done echo 1 > /sys/bus/platform/.../enable To disable eud, following is the command echo 0 > /sys/bus/platform/.../enable Signed-off-by: Souradeep Chowdhury <quic_schowdhu@quicinc.com> Link: https://lore.kernel.org/r/0ac5c2b2c8e4ce4f4f342a08b48cfc61aeaf7ee8.1644339918.git.quic_schowdhu@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-11usb: typec: rt1719: Add support for Richtek RT1719ChiYuan Huang3-0/+974
Richtek RT1719 is a sink-only Type-C PD controller it complies with latest USB Type-C and PD standards. It integrates the physical layer of USB power delivery protocol to allow up to 100W of power. Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Signed-off-by: ChiYuan Huang <cy_huang@richtek.com> Link: https://lore.kernel.org/r/1644421362-32104-3-git-send-email-u0084500@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-11drm/i915: split out i915_gem_internal.h from i915_drv.hJani Nikula31-16/+67
We already have the i915_gem_internal.c file. Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Acked-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/6715d1f3232c445990630bb3aac00f279f516fee.1644507885.git.jani.nikula@intel.com
2022-02-11firmware: arm_scmi: Remove space in MODULE_ALIAS nameAlyssa Ross1-1/+1
modprobe can't handle spaces in aliases. Get rid of it to fix the issue. Link: https://lore.kernel.org/r/20220211102704.128354-1-sudeep.holla@arm.com Fixes: aa4f886f3893 ("firmware: arm_scmi: add basic driver infrastructure for SCMI") Reviewed-by: Cristian Marussi <cristian.marussi@arm.com> Signed-off-by: Alyssa Ross <hi@alyssa.is> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
2022-02-11drm/syncobj: flatten dma_fence_chains on transferChristian König1-5/+56
It is illegal to add a dma_fence_chain as timeline point. Flatten out the fences into a dma_fence_array instead. Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Nirmoy Das <nirmoy.das@linux.intel.com> Cc: <stable@vger.kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20220209182600.434803-1-christian.koenig@amd.com
2022-02-11video: fbdev: udlfb: replace snprintf in show functions with sysfs_emitJing Yao1-4/+4
Use sysfs_emit instead of scnprintf, snprintf or sprintf. Reported-by: Zeal Robot <zealci@zte.com.cn> Signed-off-by: Jing Yao <yao.jing2@zte.com.cn> Signed-off-by: Helge Deller <deller@gmx.de>
2022-02-11video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf()Jing Yao1-2/+2
Use sysfs_emit instead of scnprintf, snprintf or sprintf. Reported-by: Zeal Robot <zealci@zte.com.cn> Signed-off-by: Jing Yao <yao.jing2@zte.com.cn> Signed-off-by: Helge Deller <deller@gmx.de>
2022-02-11video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf()Jing Yao1-4/+4
Use sysfs_emit instead of scnprintf, snprintf or sprintf. Reported-by: Zeal Robot <zealci@zte.com.cn> Signed-off-by: Jing Yao <yao.jing2@zte.com.cn> Signed-off-by: Helge Deller <deller@gmx.de>
2022-02-11usb: xhci-mtk: add support ip-sleep wakeup for mt8195Chunfeng Yun1-0/+37
Add support ip-sleep wakeup for mt8195, it's a specific revision for each USB controller, and not following IPM rule. Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com> Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com> Link: https://lore.kernel.org/r/20220128062902.26273-2-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-11usb: dwc2: Add platform specific data for Intel's AgilexDinh Nguyen1-0/+10
The DWC2 IP on the Agilex platform does not support clock-gating. Acked-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org> Link: https://lore.kernel.org/r/20220125161821.1951906-2-dinguyen@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-11video: fbdev: omapfb: Use sysfs_emit() instead of snprintf()Guo Zhengkui1-6/+7
Use sysfs_emit() instead of snprintf(). Signed-off-by: Guo Zhengkui <guozhengkui@vivo.com> Signed-off-by: Helge Deller <deller@gmx.de>
2022-02-11USB: usbfs: Use a spinlock instead of atomic accesses to tally used memory.Ingo Rohloff1-10/+22
While the existing code code imposes a limit on the used memory, it might be over pessimistic (even if this is unlikely). Example scenario: 8 threads running in parallel, all entering "usbfs_increase_memory_usage()" at the same time. The atomic accesses in "usbfs_increase_memory_usage()" could be serialized like this: 8 x "atomic64_add" 8 x "atomic64_read" If the 8 x "atomic64_add" raise "usbfs_memory_usage" above the limit, then all 8 calls of "usbfs_increase_memory_usage()" will return with -ENOMEM. If you instead serialize over the whole access to "usbfs_memory_usage" by using a spinlock, some of these calls will succeed. Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Ingo Rohloff <ingo.rohloff@lauterbach.com> Link: https://lore.kernel.org/r/20220209123303.103340-2-ingo.rohloff@lauterbach.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-11usb: dwc2: drd: fix soft connect when gadget is unconfiguredFabrice Gasnier1-2/+4
When the gadget driver hasn't been (yet) configured, and the cable is connected to a HOST, the SFTDISCON gets cleared unconditionally, so the HOST tries to enumerate it. At the host side, this can result in a stuck USB port or worse. When getting lucky, some dmesg can be observed at the host side: new high-speed USB device number ... device descriptor read/64, error -110 Fix it in drd, by checking the enabled flag before calling dwc2_hsotg_core_connect(). It will be called later, once configured, by the normal flow: - udc_bind_to_driver - usb_gadget_connect - dwc2_hsotg_pullup - dwc2_hsotg_core_connect Fixes: 17f934024e84 ("usb: dwc2: override PHY input signals with usb role switch support") Cc: stable@kernel.org Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com> Acked-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com> Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com> Link: https://lore.kernel.org/r/1644423353-17859-1-git-send-email-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-11usb: gadget: rndis: check size of RNDIS_MSG_SET commandGreg Kroah-Hartman1-3/+6
Check the size of the RNDIS_MSG_SET command given to us before attempting to respond to an invalid message size. Reported-by: Szymon Heidrich <szymon.heidrich@gmail.com> Cc: stable@kernel.org Tested-by: Szymon Heidrich <szymon.heidrich@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-11USB: gadget: validate interface OS descriptor requestsSzymon Heidrich1-0/+3
Stall the control endpoint in case provided index exceeds array size of MAX_CONFIG_INTERFACES or when the retrieved function pointer is null. Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com> Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-11usb: core: Unregister device on component_add() failureFabio M. De Francesco1-3/+6
Commit 8c67d06f3fd9 ("usb: Link the ports to the connectors they are attached to") creates a link to the USB Type-C connector for every new port that is added when possible. If component_add() fails, usb_hub_create_port_device() prints a warning but does not unregister the device and does not return errors to the callers. Syzbot reported a "WARNING in component_del()". Fix this issue in usb_hub_create_port_device by calling device_unregister() and returning the errors from component_add(). Fixes: 8c67d06f3fd9 ("usb: Link the ports to the connectors they are attached to") Reported-and-tested-by: syzbot+60df062e1c41940cae0f@syzkaller.appspotmail.com Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com> Link: https://lore.kernel.org/r/20220209164500.8769-1-fmdefrancesco@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-11net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixupJann Horn1-28/+38
ax88179_rx_fixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) USB device, in particular: - The metadata array (hdr_off..hdr_off+2*pkt_cnt) can be out of bounds, causing OOB reads and (on big-endian systems) OOB endianness flips. - A packet can overlap the metadata array, causing a later OOB endianness flip to corrupt data used by a cloned SKB that has already been handed off into the network stack. - A packet SKB can be constructed whose tail is far beyond its end, causing out-of-bounds heap data to be considered part of the SKB's data. I have tested that this can be used by a malicious USB device to send a bogus ICMPv6 Echo Request and receive an ICMPv6 Echo Reply in response that contains random kernel heap data. It's probably also possible to get OOB writes from this on a little-endian system somehow - maybe by triggering skb_cow() via IP options processing -, but I haven't tested that. Fixes: e2ca90c276e1 ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver") Cc: stable@kernel.org Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-11platform/x86: intel_cht_int33fe: Move to intel directoryHans de Goede5-24/+22
Now that there is only 1 c-file left of the intel_cht_int33fe code, move it to the intel directory instead of it having its own int33fe sub-directory. Note this also renames the module from intel_cht_int33fe_typec to intel_chtwc_int33fe, to better match the names of other PMIC related modules like the intel_chtdc_ti_pwrbtn module. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20220206220220.88491-4-hdegoede@redhat.com
2022-02-11platform/x86: intel_cht_int33fe: Drop Lenovo Yogabook YB1-X9x codeHans de Goede4-118/+35
Move the Lenovo Yogabook YB1-X9x fuel-gauge instantiation code over to the x86-android-tablets module, which already deals with this for various other devices. This removes the need to have a special intel_cht_int33fe_microb module just for Lenovo Yogabook YB1-X9x laptops. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20220206220220.88491-3-hdegoede@redhat.com
2022-02-11platform/x86: intel_cht_int33fe: Switch to DMI modalias based loadingHans de Goede5-171/+111
The intel_cht_int33fe driver is intended to deal with ACPI INT33FE firmware-nodes on Cherry Trail devices with a Whiskey Cove PMIC. The original version of the driver only dealt with the GPD win and GPD pocket boards where the WC PMIC is connected to a TI BQ24292i charger, paired with a Maxim MAX17047 fuelgauge + a FUSB302 USB Type-C Controller + a PI3USB30532 USB switch, for a fully functional Type-C port. Later it was split into a Type-C and a Micro-B variant to deal with the Lenovo Yoga Book YB1-X90 / Lenovo Yoga Book YB1-X91 boards where the ACPI INT33FE firmware-node only describes the TI BQ27542 fuelgauge. Currently the driver differentiates between these 2 models by counting the number of I2cSerialBus resources in the firmware-node. There are a number of problems with this approach: 1. The driver autoloads based on the acpi:INT33FE modalias causing it to get loaded on almost all Bay Trail and Cherry Trail devices. It checks for the presence of a WC PMIC, so it won't bind but the loading still wastes time and memory. 2. Both code paths in the driver are really only designed for a single board and have harcoded various assumptions about these boards, if another design matching the current checks ever shows up the driver may end up doing something completely wrong. Avoid both issues by switching to using DMI based autoloading of the module, which has neither of these problems. Note this splits the previous intel_cht_int33fe kernel module into two modules: intel_cht_int33fe_typec and intel_cht_int33fe_microb, one for each model. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20220206220220.88491-2-hdegoede@redhat.com
2022-02-11platform/x86: x86-android-tablets: Minor charger / fuel-gauge improvementsHans de Goede1-24/+23
Minor charger / fuel-gauge improvements: 1. Make some of the names of charger / fuel-gauge related globals more generic in preparation for also using them on other boards. 2. Update the dev_name on the Asus ME176C and TF103C to reflect that these are using the bq24297 variant of the bq24190 family. 3. During review of the ug3105 driver the "upi,rsns-microohm" property was renamed to "upisemi,rsns-microohm" as "upisemi" is the correct vendor prefix, update the ug3105 properties accordingly. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20220206220220.88491-1-hdegoede@redhat.com
2022-02-11platform/x86: x86-android-tablets: Add Nextbook Ares 8 dataHans de Goede1-1/+87
The Nextbook Ares 8 is a x86 ACPI tablet which ships with Android x86 as factory OS. Its DSDT contains a bunch of I2C devices which are not actually there, causing various resource conflicts. Enumeration of these is skipped through the acpi_quirk_skip_i2c_client_enumeration(). Add support for manually instantiating the I2C devices which are actually present on this tablet by adding the necessary device info to the x86-android-tablets module. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Link: https://lore.kernel.org/r/20220205191356.225505-6-hdegoede@redhat.com
2022-02-11platform/x86: x86-android-tablets: Add IRQ to Asus ME176C accelerometer infoHans de Goede1-0/+6
Add the IRQ for the accelerometer to the Asus ME176C board info. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Link: https://lore.kernel.org/r/20220205191356.225505-5-hdegoede@redhat.com
2022-02-11platform/x86: x86-android-tablets: Add lid-switch gpio-keys pdev to Asus ME176C + TF103CHans de Goede1-4/+53
The Asus ME176C + TF103C both have a lid-switch (for a cover in the ME176C case), add a gpio-keys platform-device and platform-data describing the lid-switch on both. Note the "intel-int3496" in the asus_me176c_tf103c_pdevs[] array is not new / not a change. This was already present in the generic int3496_pdevs[] array, to which pdev_info pointed before. The int3496_pdevs[] array contains just this entry for boards which only need that single pdev. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Link: https://lore.kernel.org/r/20220205191356.225505-4-hdegoede@redhat.com
2022-02-11platform/x86: x86-android-tablets: Add x86_android_tablet_get_gpiod() helperHans de Goede1-12/+23
Factor the code to go from a gpiochip label + pin-numer to a gpio_desc out of x86_acpi_irq_helper_get() and make it into a new x86_android_tablet_get_gpiod() helper, as this will be necessary in some x86_dev_info.init() functions too. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Link: https://lore.kernel.org/r/20220205191356.225505-3-hdegoede@redhat.com
2022-02-11platform/x86: x86-android-tablets: Add Asus ME176C/TF103C charger and fuelgauge propsHans de Goede1-11/+84
Add properties describing the battery on the Asus ME176C / TF103C tablets. The max constant charge volt / current settings were taken from the factory Android image on these tablets. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Link: https://lore.kernel.org/r/20220205191356.225505-2-hdegoede@redhat.com