linux/drivers/gpio, branch v4.19

gpio: Assign gpio_irq_chip::parents to non-stack pointer

2018-10-10T12:03:27Z

gpiochip_set_cascaded_irqchip() is passed 'parent_irq' as an argument and then the address of that argument is assigned to the gpio chips gpio_irq_chip 'parents' pointer shortly thereafter. This can't ever work, because we've just assigned some stack address to a pointer that we plan to dereference later in gpiochip_irq_map(). I ran into this issue with the KASAN report below when gpiochip_irq_map() tried to setup the parent irq with a total junk pointer for the 'parents' array. BUG: KASAN: stack-out-of-bounds in gpiochip_irq_map+0x228/0x248 Read of size 4 at addr ffffffc0dde472e0 by task swapper/0/1 CPU: 7 PID: 1 Comm: swapper/0 Not tainted 4.14.72 #34 Call trace: [] dump_backtrace+0x0/0x718 [] show_stack+0x20/0x2c [] __dump_stack+0x20/0x28 [] dump_stack+0x80/0xbc [] print_address_description+0x70/0x238 [] kasan_report+0x1cc/0x260 [] __asan_report_load4_noabort+0x2c/0x38 [] gpiochip_irq_map+0x228/0x248 [] irq_domain_associate+0x114/0x2ec [] irq_create_mapping+0x120/0x234 [] irq_create_fwspec_mapping+0x4c8/0x88c [] irq_create_of_mapping+0x180/0x210 [] of_irq_get+0x138/0x198 [] spi_drv_probe+0x94/0x178 [] driver_probe_device+0x51c/0x824 [] __device_attach_driver+0x148/0x20c [] bus_for_each_drv+0x120/0x188 [] __device_attach+0x19c/0x2dc [] device_initial_probe+0x20/0x2c [] bus_probe_device+0x80/0x154 [] device_add+0x9b8/0xbdc [] spi_add_device+0x1b8/0x380 [] spi_register_controller+0x111c/0x1378 [] spi_geni_probe+0x4dc/0x6f8 [] platform_drv_probe+0xdc/0x130 [] driver_probe_device+0x51c/0x824 [] __driver_attach+0x100/0x194 [] bus_for_each_dev+0x104/0x16c [] driver_attach+0x48/0x54 [] bus_add_driver+0x274/0x498 [] driver_register+0x1ac/0x230 [] __platform_driver_register+0xcc/0xdc [] spi_geni_driver_init+0x1c/0x24 [] do_one_initcall+0x240/0x3dc [] kernel_init_freeable+0x378/0x468 [] kernel_init+0x14/0x110 [] ret_from_fork+0x10/0x18 The buggy address belongs to the page: page:ffffffbf037791c0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x4000000000000000() raw: 4000000000000000 0000000000000000 0000000000000000 00000000ffffffff raw: ffffffbf037791e0 ffffffbf037791e0 0000000000000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffffc0dde47180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffc0dde47200: f1 f1 f1 f1 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 >ffffffc0dde47280: f2 f2 00 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 ^ ffffffc0dde47300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffc0dde47380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Let's leave around one unsigned int in the gpio_irq_chip struct for the single parent irq case and repoint the 'parents' array at it. This way code is left mostly intact to setup parents and we waste an extra few bytes per structure of which there should be only a handful in a system. Cc: Evan Green Cc: Thierry Reding Cc: Grygorii Strashko Fixes: e0d897289813 ("gpio: Implement tighter IRQ chip integration") Signed-off-by: Stephen Boyd Signed-off-by: Linus Walleij

gpiolib: Free the last requested descriptor

2018-09-18T23:36:05Z

The current code only frees N-1 gpios if an error occurs during gpiod_set_transitory, gpiod_direction_output or gpiod_direction_input. Leading to gpios that cannot be used by userspace nor other drivers. Cc: Timur Tabi Cc: stable@vger.kernel.org Fixes: ab3dbcf78f60f46d ("gpioib: do not free unrequested descriptors) Reported-by: Jan Lorenzen Reported-by: Jim Paris Signed-off-by: Ricardo Ribalda Delgado Signed-off-by: Linus Walleij

gpio: Fix crash due to registration race

2018-08-31T09:30:45Z

gpiochip_add_data_with_key() adds the gpiochip to the gpio_devices list before of_gpiochip_add() is called, but it's only the latter which sets the ->of_xlate function pointer. gpiochip_find() can be called by someone else between these two actions, and it can find the chip and call of_gpiochip_match_node_and_xlate() which leads to the following crash due to a NULL ->of_xlate(). Unhandled prefetch abort: page domain fault (0x01b) at 0x00000000 Modules linked in: leds_gpio(+) gpio_generic(+) CPU: 0 PID: 830 Comm: insmod Not tainted 4.18.0+ #43 Hardware name: ARM-Versatile Express PC is at (null) LR is at of_gpiochip_match_node_and_xlate+0x2c/0x38 Process insmod (pid: 830, stack limit = 0x(ptrval)) (of_gpiochip_match_node_and_xlate) from (gpiochip_find+0x48/0x84) (gpiochip_find) from (of_get_named_gpiod_flags+0xa8/0x238) (of_get_named_gpiod_flags) from (gpiod_get_from_of_node+0x2c/0xc8) (gpiod_get_from_of_node) from (devm_fwnode_get_index_gpiod_from_child+0xb8/0x144) (devm_fwnode_get_index_gpiod_from_child) from (gpio_led_probe+0x208/0x3c4 [leds_gpio]) (gpio_led_probe [leds_gpio]) from (platform_drv_probe+0x48/0x9c) (platform_drv_probe) from (really_probe+0x1d0/0x3d4) (really_probe) from (driver_probe_device+0x78/0x1c0) (driver_probe_device) from (__driver_attach+0x120/0x13c) (__driver_attach) from (bus_for_each_dev+0x68/0xb4) (bus_for_each_dev) from (bus_add_driver+0x1a8/0x268) (bus_add_driver) from (driver_register+0x78/0x10c) (driver_register) from (do_one_initcall+0x54/0x1fc) (do_one_initcall) from (do_init_module+0x64/0x1f4) (do_init_module) from (load_module+0x2198/0x26ac) (load_module) from (sys_finit_module+0xe0/0x110) (sys_finit_module) from (ret_fast_syscall+0x0/0x54) One way to fix this would be to rework the hairy registration sequence in gpiochip_add_data_with_key(), but since I'd probably introduce a couple of new bugs if I attempted that, simply add a check for a non-NULL of_xlate function pointer in of_gpiochip_match_node_and_xlate(). This works since the driver looking for the gpio will simply fail to find the gpio and defer its probe and be reprobed when the driver which is registering the gpiochip has fully completed its probe. Signed-off-by: Vincent Whitchurch Signed-off-by: Linus Walleij

gpio: dwapb: Fix error handling in dwapb_gpio_probe()

2018-08-29T12:04:04Z

If dwapb_gpio_add_port() fails in dwapb_gpio_probe(), gpio->clk is left undisabled. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: Linus Walleij

gpiolib-acpi: Register GpioInt ACPI event handlers from a late_initcall

2018-08-29T11:32:00Z

GpioInt ACPI event handlers may see there IRQ triggered immediately after requesting the IRQ (esp. level triggered ones). This means that they may run before any other (builtin) drivers have had a chance to register their OpRegion handlers, leading to errors like this: [ 1.133274] ACPI Error: No handler for Region [PMOP] ((____ptrval____)) [UserDefinedRegion] (20180531/evregion-132) [ 1.133286] ACPI Error: Region UserDefinedRegion (ID=141) has no handler (20180531/exfldio-265) [ 1.133297] ACPI Error: Method parse/execution failed \_SB.GPO2._L01, AE_NOT_EXIST (20180531/psparse-516) We already defer the manual initial trigger of edge triggered interrupts by running it from a late_initcall handler, this commit replaces this with deferring the entire acpi_gpiochip_request_interrupts() call till then, fixing the problem of some OpRegions not being registered yet. Note that this removes the need to have a list of edge triggered handlers which need to run, since the entire acpi_gpiochip_request_interrupts() call is now delayed, acpi_gpiochip_request_interrupt() can call these directly now. Acked-by: Mika Westerberg Signed-off-by: Hans de Goede Signed-off-by: Linus Walleij

gpiolib: acpi: Switch to cansleep version of GPIO library call

2018-08-29T11:29:01Z

The commit ca876c7483b6 ("gpiolib-acpi: make sure we trigger edge events at least once on boot") added a initial value check for pin which is about to be locked as IRQ. Unfortunately, not all GPIO drivers can do that atomically. Thus, switch to cansleep version of the call. Otherwise we have a warning: ... WARNING: CPU: 2 PID: 1408 at drivers/gpio/gpiolib.c:2883 gpiod_get_value+0x46/0x50 ... RIP: 0010:gpiod_get_value+0x46/0x50 ... The change tested on Intel Broxton with Whiskey Cove PMIC GPIO controller. Fixes: ca876c7483b6 ("gpiolib-acpi: make sure we trigger edge events at least once on boot") Signed-off-by: Andy Shevchenko Cc: Hans de Goede Cc: Benjamin Tissoires Acked-by: Mika Westerberg Signed-off-by: Linus Walleij

gpio: adp5588: Fix sleep-in-atomic-context bug

2018-08-29T08:54:38Z

This fixes: [BUG] gpio: gpio-adp5588: A possible sleep-in-atomic-context bug in adp5588_gpio_write() [BUG] gpio: gpio-adp5588: A possible sleep-in-atomic-context bug in adp5588_gpio_direction_input() Reported-by: Jia-Ju Bai Signed-off-by: Michael Hennerich Signed-off-by: Linus Walleij

Merge tag 'mfd-next-4.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd

2018-08-20T22:38:44Z

Pull MFD updates from Lee Jones: "New Drivers: - Add Cirrus Logic Madera Codec (CS47L35, CS47L85 and CS47L90/91) driver - Add ChromeOS EC CEC driver - Add ROHM BD71837 PMIC driver New Device Support: - Add support for Dialog Semi DA9063L PMIC variant to DA9063 - Add support for Intel Ice Lake to Intel-PLSS-PCI - Add support for X-Powers AXP806 to AXP20x New Functionality: - Add support for USB Charging to the ChromeOS Embedded Controller - Add support for HDMI CEC to the ChromeOS Embedded Controller - Add support for HDMI CEC to Intel HDMI - Add support for accessory detection to Madera devices - Allow individual pins to be configured via DT' wlf,csnaddr-pd - Provide legacy platform specific EEPROM/Watchdog commands; rave-sp Fix-upsL - Trivial renaming/spelling fixes; cros_ec, da9063-* - Convert to Managed Resources (devm_*); da9063-*, ti_am335x_tscadc - Transition to helper macros/functions; da9063-* - Constify; kempld-core - Improve error path/messages; wm8994-core - Disable IRQs locally instead of relying on USB subsystem; dln2 - Remove unused code; rave-sp - New exports; sec-core Bug Fixes: - Fix possible false I2C transaction error; arizona-core - Fix declared memory area size; hi655x-pmic - Fix checksum type; rave-sp - Fix incorrect default serial port configuration: rave-sp - Fix incorrect coherent DMA mask for sub-devices; sm501" * tag 'mfd-next-4.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (60 commits) mfd: madera: Add register definitions for accessory detect mfd: sm501: Set coherent_dma_mask when creating subdevices mfd: bd71837: Devicetree bindings for ROHM BD71837 PMIC mfd: bd71837: Core driver for ROHM BD71837 PMIC media: platform: cros-ec-cec: Fix dependency on MFD_CROS_EC mfd: sec-core: Export OF module alias table mfd: as3722: Disable auto-power-on when AC OK mfd: axp20x: Support AXP806 in I2C mode mfd: axp20x: Add self-working mode support for AXP806 dt-bindings: mfd: axp20x: Add "self-working" mode for AXP806 mfd: wm8994: Allow to configure CS/ADDR Pulldown from dts mfd: wm8994: Allow to configure Speaker Mode Pullup from dts mfd: rave-sp: Emulate CMD_GET_STATUS on device that don't support it mfd: rave-sp: Add legacy watchdog ping command translation mfd: rave-sp: Add legacy EEPROM access command translation mfd: rave-sp: Initialize flow control and parity of the port mfd: rave-sp: Fix incorrectly specified checksum type mfd: rave-sp: Remove unused defines mfd: hi655x: Fix regmap area declared size for hi655x mfd: ti_am335x_tscadc: Fix struct clk memory leak ...

Merge tag 'gpio-v4.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio

2018-08-16T04:35:38Z

Pull GPIO updates from Linus Walleij: "This is the bulk of GPIO changes for the v4.19 kernel cycle. I don't know if anything in particular stands out. Maybe the Aspeed coprocessor thing from Benji: Aspeed is doing baseboard management chips (BMC's) for servers etc. These Aspeed's are ARM processors that exist inside (I guess) Intel servers, and they are moving forward to using mainline Linux in those. This is one of the pieces of the puzzle to achive that. They are doing OpenBMC, it's pretty cool: https://lwn.net/Articles/683320/ Summary: Core changes: - Add a new API for explicitly naming GPIO consumers, when needed. - Don't let userspace set values on input lines. While we do not think anyone would do this crazy thing we better plug the hole before someone uses it and think it's a nifty feature. - Avoid calling chip->request() for unused GPIOs. New drivers/subdrivers: - The Mediatek MT7621 is supported which is a big win for OpenWRT and similar router distributions using this chip, as it seems every major router manufacturer on the planet has made products using this chip: https://wikidevi.com/wiki/MediaTek_MT7621 - The Tegra 194 is now supported. - The IT87 driver now supports IT8786E and IT8718F super-IO chips. - Add support for Rockchip RK3328 in the syscon GPIO driver. Driver changes: - Handle the get/set_multiple() properly on MMIO chips with inverted direction registers. We didn't have this problem until a new chip appear that has get/set registers AND inverted direction bits, OK now we handle it. - A patch series making more error codes percolate upward properly for different errors on gpiochip_lock_as_irq(). - Get/set multiple for the OMAP driver, accelerating these multiple line operations if possible. - A coprocessor interface for the Aspeed driver. Sometimes a few GPIO lines need to be grabbed by a co-processor for doing automated tasks, sometimes they are available as GPIO lines. By adding an explicit API in this driver we make it possible for the two line consumers to coexist. (This work was made available on the ib-aspeed branch, which may be appearing in other pull requests.) - Implemented .get_direction() and open drain in the SCH311x driver. - Continuing cleanup of included headers in GPIO drivers" * tag 'gpio-v4.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (80 commits) gpio: it87: Add support for IT8613 gpio: it87: add support for IT8718F Super I/O. gpiolib: Avoid calling chip->request() for unused gpios gpio: tegra: Include the right header gpio: mmio: Fix up inverted direction registers gpio: xilinx: Use the right include gpio: timberdale: Include the right header gpio: tb10x: Use the right include gpiolib: Fix of_node inconsistency gpio: vr41xx: Bail out on gpiochip_lock_as_irq() error gpio: uniphier: Bail out on gpiochip_lock_as_irq() error gpio: xgene-sb: Don't shadow error code of gpiochip_lock_as_irq() gpio: em: Don't shadow error code of gpiochip_lock_as_irq() gpio: dwapb: Don't shadow error code of gpiochip_lock_as_irq() gpio: bcm-kona: Don't shadow error code of gpiochip_lock_as_irq() gpiolib: Don't shadow error code of gpiochip_lock_as_irq() gpio: syscon: rockchip: add GRF GPIO support for rk3328 gpio: omap: Add get/set_multiple() callbacks gpio: pxa: remove set but not used variable 'gpio_offset' gpio-it87: add support for IT8786E Super I/O ...

Merge tag 'acpi-4.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

2018-08-14T20:39:52Z

Pull ACPI updates from Rafael Wysocki: "These revert two ACPICA commits that are not needed any more, rework the property graphs support in ACPI to be more aligned with the analogous DT code, add some new quirks and remove one that isn't needed any more, add a special platform driver to enumerate multiple I2C devices hooked up to the same device object in the ACPI tables and update the battery and button drivers. Specifics: - Revert two ACPICA commits that are not needed any more (Erik Schmauss). - Rework property graph support in the ACPI device properties framework to make it behave more like the analogous DT code and update the documentation of it (Sakari Ailus). - Change the default ACPI device status after initialization to ACPI_STA_DEFAULT instead of 0 (Hans de Goede). - Add a special platform driver for enumerating multiple I2C devices hooked up to the same object in the ACPI tables (Hans de Goede). - Fix the ACPI battery driver to avoid reporting full capacity on systems without support for that and clean it up (Hans de Goede, Dmitry Rozhkov, Lucas Rangit Magasweran). - Add two system wakeup quirks to the ACPI EC driver (Aaron Ma, Mika Westerberg). - Add the touchscreen on Dell Venue Pro 7139 to the list of "always present" devices to make it work (Tristian Celestin). - Revert a special tables handling quirk for Dell XPS 9570 and Precision M5530 which is not needed any more (Kai Heng Feng). - Add support for a new OEM _OSI string to allow system vendors to work around issues with NVidia HDMI audio (Alex Hung). - Prevent the ACPI button driver from reporting excessive system wakeup events and clean it up (Ravi Chandra Sadineni, Randy Dunlap). - Clean up two minor code style issues in the ACPI core and GHES handling on ARM64 (Dongjiu Geng, John Garry, Tom Todd)" * tag 'acpi-4.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (34 commits) platform/x86: Add ACPI i2c-multi-instantiate pseudo driver ACPI / x86: utils: Remove status workaround from acpi_device_always_present() ACPI / scan: Create platform device for fwnodes with multiple i2c devices ACPI / scan: Initialize status to ACPI_STA_DEFAULT ACPI / EC: Add another entry for Thinkpad X1 Carbon 6th ACPI: bus: Fix a pointer coding style issue arm64 / ACPI: clean the additional checks before calling ghes_notify_sea() ACPI / scan: Add static attribute to indirect_io_hosts[] ACPI / battery: Do not export energy_full[_design] on devices without full_charge_capacity ACPI / EC: Use ec_no_wakeup on ThinkPad X1 Yoga 3rd ACPI / battery: get rid of negations in conditions ACPI / battery: use specialized print macros ACPI / battery: reorder headers alphabetically ACPI / battery: drop inclusion of init.h ACPI: battery: remove redundant old_present check on insertion ACPI: property: graph: Update graph documentation to use generic references ACPI: property: graph: Improve graph documentation for port/ep numbering ACPI: property: graph: Fix graph documentation ACPI: property: Update documentation for hierarchical data extension 1.1 ACPI: property: Document key numbering for hierarchical data extension refs ...