1. 21 Sep, 2017 2 commits
    • Dmitry Torokhov's avatar
      Input: uinput - avoid crash when sending FF request to device going away · 6b4877c7
      Dmitry Torokhov authored
      If FF request comes in while uinput device is going away,
      uinput_request_send() will fail with -ENODEV, and uinput_request_submit()
      will attempt to mark the slot as unused by calling uinput_request_done().
      Unfortunately in this case we haven't initialized request->done completion
      yet, and we get a crash:
      
      [   39.402036] BUG: spinlock bad magic on CPU#1, fftest/3108
      [   39.402046]  lock: 0xffff88006a93bb00, .magic: 00000000, .owner: /39, .owner_cpu: 1217155072
      [   39.402055] CPU: 1 PID: 3108 Comm: fftest Tainted: G        W 4.13.0+ #15
      [   39.402059] Hardware name: LENOVO 20HQS0EG02/20HQS0EG02, BIOS N1MET37W (1.22 ) 07/04/2017
      [   39.402064]  0000000000000086 f0fad82f3ceaa120 ffff88006a93b9a0 ffffffff9de941bb
      [   39.402077]  ffff88026df8ae00 ffff88006a93bb00 ffff88006a93b9c0 ffffffff9dca62b7
      [   39.402088]  ffff88006a93bb00 ffff88006a93baf8 ffff88006a93b9e0 ffffffff9dca62e7
      [   39.402099] Call Trace:
      [   39.402112]  [<ffffffff9de941bb>] dump_stack+0x4d/0x63
      [   39.402123]  [<ffffffff9dca62b7>] spin_dump+0x97/0x9c
      [   39.402130]  [<ffffffff9dca62e7>] spin_bug+0x2b/0x2d
      [   39.402138]  [<ffffffff9dca6373>] do_raw_spin_lock+0x28/0xfd
      [   39.402147]  [<ffffffff9e3055cd>] _raw_spin_lock_irqsave+0x19/0x1f
      [   39.402154]  [<ffffffff9dca05b7>] complete+0x1d/0x48
      [   39.402162]  [<ffffffffc04f30af>] 0xffffffffc04f30af
      [   39.402167]  [<ffffffffc04f468c>] 0xffffffffc04f468c
      [   39.402177]  [<ffffffff9dd59c16>] ? __slab_free+0x22f/0x359
      [   39.402184]  [<ffffffff9dcc13e9>] ? tk_clock_read+0xc/0xe
      [   39.402189]  [<ffffffffc04f471f>] 0xffffffffc04f471f
      [   39.402195]  [<ffffffff9dc9ffe5>] ? __wake_up+0x44/0x4b
      [   39.402200]  [<ffffffffc04f3240>] ? 0xffffffffc04f3240
      [   39.402207]  [<ffffffff9e0f57f3>] erase_effect+0xa1/0xd2
      [   39.402214]  [<ffffffff9e0f58c6>] input_ff_flush+0x43/0x5c
      [   39.402219]  [<ffffffffc04f32ad>] 0xffffffffc04f32ad
      [   39.402227]  [<ffffffff9e0f174f>] input_flush_device+0x3d/0x51
      [   39.402234]  [<ffffffff9e0f69ae>] evdev_flush+0x49/0x5c
      [   39.402243]  [<ffffffff9dd62d6e>] filp_close+0x3f/0x65
      [   39.402253]  [<ffffffff9dd7dcf7>] put_files_struct+0x66/0xc1
      [   39.402261]  [<ffffffff9dd7ddeb>] exit_files+0x47/0x4e
      [   39.402270]  [<ffffffff9dc6b329>] do_exit+0x483/0x969
      [   39.402278]  [<ffffffff9dc73211>] ? recalc_sigpending_tsk+0x3d/0x44
      [   39.402285]  [<ffffffff9dc6c7a2>] do_group_exit+0x42/0xb0
      [   39.402293]  [<ffffffff9dc767e1>] get_signal+0x58d/0x5bf
      [   39.402300]  [<ffffffff9dc03701>] do_signal+0x37/0x53e
      [   39.402307]  [<ffffffff9e0f8401>] ? evdev_ioctl_handler+0xac8/0xb04
      [   39.402314]  [<ffffffff9e0f8464>] ? evdev_ioctl+0x10/0x12
      [   39.402321]  [<ffffffff9dd74cfa>] ? do_vfs_ioctl+0x42e/0x501
      [   39.402328]  [<ffffffff9dc0170e>] prepare_exit_to_usermode+0x66/0x90
      [   39.402333]  [<ffffffff9dc0181b>] syscall_return_slowpath+0xe3/0xec
      [   39.402339]  [<ffffffff9e305b7b>] int_ret_from_sys_call+0x25/0x8f
      
      While we could solve this by simply initializing the completion earlier, we
      are better off rearranging the code a bit so we avoid calling complete() on
      requests that we did not send out. This patch consolidates marking request
      slots as free in one place (in uinput_request_submit(), the same place
      where we acquire them) and having everyone else simply signal completion
      of the requests.
      
      Fixes: 00ce756c ("Input: uinput - mark failed submission requests as free")
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      6b4877c7
    • Dmitry Torokhov's avatar
      Input: uinput - avoid FF flush when destroying device · e8b95728
      Dmitry Torokhov authored
      Normally, when input device supporting force feedback effects is being
      destroyed, we try to "flush" currently playing effects, so that the
      physical device does not continue vibrating (or executing other effects).
      Unfortunately this does not work well for uinput as flushing of the effects
      deadlocks with the destroy action:
      
      - if device is being destroyed because the file descriptor is being closed,
        then there is noone to even service FF requests;
      
      - if device is being destroyed because userspace sent UI_DEV_DESTROY,
        while theoretically it could be possible to service FF requests,
        userspace is unlikely to do so (they'd need to make sure FF handling
        happens on a separate thread) even if kernel solves the issue with FF
        ioctls deadlocking with UI_DEV_DESTROY ioctl on udev->mutex.
      
      To avoid lockups like the one below, let's install a custom input device
      flush handler, and avoid trying to flush force feedback effects when we
      destroying the device, and instead rely on uinput to shut off the device
      properly.
      
      NMI watchdog: Watchdog detected hard LOCKUP on cpu 3
      ...
       <<EOE>>  [<ffffffff817a0307>] _raw_spin_lock_irqsave+0x37/0x40
       [<ffffffff810e633d>] complete+0x1d/0x50
       [<ffffffffa00ba08c>] uinput_request_done+0x3c/0x40 [uinput]
       [<ffffffffa00ba587>] uinput_request_submit.part.7+0x47/0xb0 [uinput]
       [<ffffffffa00bb62b>] uinput_dev_erase_effect+0x5b/0x76 [uinput]
       [<ffffffff815d91ad>] erase_effect+0xad/0xf0
       [<ffffffff815d929d>] flush_effects+0x4d/0x90
       [<ffffffff815d4cc0>] input_flush_device+0x40/0x60
       [<ffffffff815daf1c>] evdev_cleanup+0xac/0xc0
       [<ffffffff815daf5b>] evdev_disconnect+0x2b/0x60
       [<ffffffff815d74ac>] __input_unregister_device+0xac/0x150
       [<ffffffff815d75f7>] input_unregister_device+0x47/0x70
       [<ffffffffa00bac45>] uinput_destroy_device+0xb5/0xc0 [uinput]
       [<ffffffffa00bb2de>] uinput_ioctl_handler.isra.9+0x65e/0x740 [uinput]
       [<ffffffff811231ab>] ? do_futex+0x12b/0xad0
       [<ffffffffa00bb3f8>] uinput_ioctl+0x18/0x20 [uinput]
       [<ffffffff81241248>] do_vfs_ioctl+0x298/0x480
       [<ffffffff81337553>] ? security_file_ioctl+0x43/0x60
       [<ffffffff812414a9>] SyS_ioctl+0x79/0x90
       [<ffffffff817a04ee>] entry_SYSCALL_64_fastpath+0x12/0x71
      Reported-by: default avatarRodrigo Rivas Costa <rodrigorivascosta@gmail.com>
      Reported-by: default avatarClément VUCHENER <clement.vuchener@gmail.com>
      Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=193741Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      e8b95728
  2. 15 Sep, 2017 2 commits
  3. 12 Sep, 2017 1 commit
  4. 11 Sep, 2017 5 commits
  5. 04 Sep, 2017 3 commits
  6. 01 Sep, 2017 1 commit
  7. 31 Aug, 2017 4 commits
  8. 28 Aug, 2017 3 commits
    • Anthony Martin's avatar
      Input: synaptics - fix device info appearing different on reconnect · 3f9db52d
      Anthony Martin authored
      User-modified input settings no longer survive a suspend/resume cycle.
      Starting with 4.12, the touchpad is reinitialized on every reconnect
      because the hardware appears to be different. This can be reproduced
      by running the following as root:
      
          echo -n reconnect >/sys/devices/platform/i8042/serio1/drvctl
      
      A line like the following will show up in dmesg:
      
          [30378.295794] psmouse serio1: synaptics: hardware appears to be
                         different: id(149271-149271), model(114865-114865),
                         caps(d047b3-d047b1), ext(b40000-b40000).
      
      Note the single bit difference in caps: bit 1 (SYN_CAP_MULTIFINGER).
      
      This happens because we modify our stored copy of the device info
      capabilities when we enable advanced gesture mode but this change is
      not reflected in the actual hardware capabilities.
      
      It worked in the past because synaptics_query_hardware used to modify
      the stored synaptics_device_info struct instead of filling in a new
      one, as it does now.
      
      Fix it by no longer faking the SYN_CAP_MULTIFINGER bit when setting
      advanced gesture mode. This necessitated a small refactoring.
      
      Fixes: 6c53694f ("Input: synaptics - split device info into a separate structure")
      Signed-off-by: default avatarAnthony Martin <ality@pbrane.org>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      3f9db52d
    • Danilo Krummrich's avatar
      Input: PS/2 gpio bit banging driver for serio bus · 9ee0a055
      Danilo Krummrich authored
      This driver provides PS/2 serio bus support by implementing bit banging
      with the GPIO API. The GPIO pins, data and clock, can be configured with
      a node in the device tree or by generic device properties (GDP).
      
      Writing to a device is supported as well, though it is possible timings
      can not be halt as they are tough and difficult to reach with bit banging.
      Therefore it can be configured (also in DT and GDP) whether the serio
      write function should be available for clients.
      
      This driver is for development purposes and not recommended for productive
      use. However, this driver can be useful e.g. when no USB port is available
      or using old peripherals is desired as PS/2 controller chips getting rare.
      
      This driver was tested on bcm2825 and on Kirin 960 and it worked well
      together with the atkbd and psmouse driver.
      Signed-off-by: default avatarDanilo Krummrich <danilokrummrich@dk-develop.de>
      Reviewed-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Acked-by: default avatarRob Herring <robh@kernel.org>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      9ee0a055
    • Liang Yan's avatar
      Input: xen-kbdfront - enable auto repeat for xen keyboard frontend driver · 0ca06810
      Liang Yan authored
      Long pressed key could not show right in XEN vncviewer after tigervnc
      client changed the way how to send repeat keys, from "Down Up Down Up
      ..." to "Down Down ... Up". This will report autorepeat to input by
      checking if same key being pressed, and let handler process it finally.
      Signed-off-by: default avatarLiang Yan <lyan@suse.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      0ca06810
  9. 24 Aug, 2017 2 commits
  10. 21 Aug, 2017 2 commits
  11. 20 Aug, 2017 1 commit
  12. 19 Aug, 2017 14 commits