1. 05 Sep, 2022 1 commit
  2. 03 Sep, 2022 23 commits
    • Andy Shevchenko's avatar
      platform/x86: p2sb: Fix UAF when caller uses resource name · f98d67ac
      Andy Shevchenko authored
      We have to copy only selected fields from the original resource.
      Because a PCI device will be removed immediately after getting
      its resources, we may not use any allocated data, hence we may
      not copy any pointers.
      
      Consider the following scenario:
      
        1/ a caller of p2sb_bar() gets the resource;
      
        2/ the resource has been copied by platform_device_add_data()
           in order to create a platform device;
      
        3/ the platform device creation will call for the device driver's
           ->probe() as soon as a match found;
      
        4/ the ->probe() takes given resources (see 2/) and tries to
           access one of its field, i.e. 'name', in the
           __devm_ioremap_resource() to create a pretty looking output;
      
        5/ but the 'name' is a dangling pointer because p2sb_bar()
           removed a PCI device, which 'name' had been copied to
           the caller's memory.
      
        6/ UAF (Use-After-Free) as a result.
      
      Kudos to Mika for the initial analisys of the issue.
      
      Fixes: 9745fb07 ("platform/x86/intel: Add Primary to Sideband (P2SB) bridge support")
      Reported-by: default avatarkernel test robot <oliver.sang@intel.com>
      Suggested-by: default avatarMika Westerberg <mika.westerberg@linux.intel.com>
      Link: https://lore.kernel.org/linux-i2c/YvPCbnKqDiL2XEKp@xsang-OptiPlex-9020/
      Link: https://lore.kernel.org/linux-i2c/YtjAswDKfiuDfWYs@xsang-OptiPlex-9020/Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Link: https://lore.kernel.org/r/20220901113406.65876-1-andriy.shevchenko@linux.intel.comReviewed-by: default avatarHans de Goede <hdegoede@redhat.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      f98d67ac
    • Mario Limonciello's avatar
      platform/x86: wmi: Allow duplicate GUIDs for drivers that use struct wmi_driver · 134038b0
      Mario Limonciello authored
      The WMI subsystem in the kernel currently tracks WMI devices by
      a GUID string not by ACPI device.  The GUID used by the `wmi-bmof`
      module however is available from many devices on nearly every machine.
      
      This originally was thought to be a bug, but as it happens on most
      machines it is a design mistake.  It has been fixed by tying an ACPI
      device to the driver with struct wmi_driver. So drivers that have
      moved over to struct wmi_driver can actually support multiple
      instantiations of a GUID without any problem.
      
      Add an allow list into wmi.c for GUIDs that the drivers that are known
      to use struct wmi_driver.  The list is populated with `wmi-bmof` right
      now. The additional instances of that in sysfs with be suffixed with -%d
      Signed-off-by: default avatarMario Limonciello <mario.limonciello@amd.com>
      Link: https://lore.kernel.org/r/20220829201500.6341-1-mario.limonciello@amd.comReviewed-by: default avatarHans de Goede <hdegoede@redhat.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      134038b0
    • Hans de Goede's avatar
      drm/todo: Add entry about dealing with brightness control on devices with > 1 panel · 4f96b1bc
      Hans de Goede authored
      Add an entry summarizing the discussion about dealing with brightness
      control on devices with more then 1 internal panel.
      
      The original discussion can be found here:
      https://lore.kernel.org/dri-devel/20220517152331.16217-1-hdegoede@redhat.com/Reviewed-by: default avatarLyude Paul <lyude@redhat.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      4f96b1bc
    • Hans de Goede's avatar
      ACPI: video: Fix indentation of video_detect_dmi_table[] entries · c2d6920e
      Hans de Goede authored
      The video_detect_dmi_table[] uses an unusual indentation for
      before the ".name = ..." named struct initializers.
      
      Instead of being indented with an extra tab compared to
      the previous line's '{' these are indented to with only
      a single space to allow for long DMI_MATCH() lines without
      wrapping.
      
      But over time some entries did not event have the single space
      indent in front of the ".name = ..." lines.
      
      Make things consistent by using a single space indent for these
      lines everywhere.
      Acked-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      c2d6920e
    • Hans de Goede's avatar
      ACPI: video: Drop NL5x?U, PF4NU1F and PF5?U?? acpi_backlight=native quirks · 10212754
      Hans de Goede authored
      acpi_backlight=native is the default for these, but as the comment
      explains the quirk was still necessary because even briefly registering
      the acpi_video0 backlight; and then unregistering it once the native
      driver showed up, was leading to issues.
      
      After the "ACPI: video: Make backlight class device registration
      a separate step" patch from earlier in this patch-series, we no
      longer briefly register the acpi_video0 backlight on systems where
      the native driver should be used.
      
      So this is no longer an issue an the quirks are no longer needed.
      
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=215683Tested-by: default avatarWerner Sembach <wse@tuxedocomputers.com>
      Acked-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      10212754
    • Hans de Goede's avatar
      ACPI: video: Drop "Samsung X360" acpi_backlight=native quirk · de6f3121
      Hans de Goede authored
      acpi_backlight=native is the default for the "Samsung X360", but as
      the comment explains the quirk was still necessary because even
      briefly registering the acpi_video0 backlight; and then unregistering
      it once the native driver showed up, was leading to issues.
      
      After the "ACPI: video: Make backlight class device registration
      a separate step" patch from earlier in this patch-series, we no
      longer briefly register the acpi_video0 backlight on systems where
      the native driver should be used.
      
      So this is no longer an issue an the quirk is no longer needed.
      Acked-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      de6f3121
    • Hans de Goede's avatar
      ACPI: video: Remove acpi_video_set_dmi_backlight_type() · 77ab9d4d
      Hans de Goede authored
      acpi_video_set_dmi_backlight_type() is troublesome because it may end
      up getting called after other backlight drivers have already called
      acpi_video_get_backlight_type() resulting in the other drivers
      already being registered even though they should not.
      
      In case of the acpi_video backlight, acpi_video_set_dmi_backlight_type()
      actually calls acpi_video_unregister_backlight() since that is often
      probed earlier, leading to userspace seeing the acpi_video0 class
      device being briefly available, leading to races in userspace where
      udev probe-rules try to access the device and it is already gone.
      
      All callers have been fixed to no longer call it, so remove
      acpi_video_set_dmi_backlight_type() now.
      
      This means we now also no longer need acpi_video_unregister_backlight()
      for the remove acpi_video backlight after it was wrongly registered hack,
      so remove that too.
      Acked-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      77ab9d4d
    • Hans de Goede's avatar
      platform/x86: samsung-laptop: Move acpi_backlight=[vendor|native] quirks to ACPI video_detect.c · 8991d7d9
      Hans de Goede authored
      acpi_video_set_dmi_backlight_type() is troublesome because it may end up
      getting called after other backlight drivers have already called
      acpi_video_get_backlight_type() resulting in the other drivers
      already being registered even though they should not.
      
      Move all the acpi_backlight=[vendor|native] quirks from samsung-laptop to
      drivers/acpi/video_detect.c .
      
      Note the X360 -> acpi_backlight=native quirk is not moved because that
      already was present in drivers/acpi/video_detect.c .
      Acked-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      8991d7d9
    • Hans de Goede's avatar
      platform/x86: asus-wmi: Move acpi_backlight=native quirks to ACPI video_detect.c · 1e3344d6
      Hans de Goede authored
      Remove the asus-wmi quirk_entry.wmi_backlight_native quirk-flag, which
      called acpi_video_set_dmi_backlight_type(acpi_backlight_native) and replace
      it with acpi/video_detect.c video_detect_dmi_table[] entries using the
      video_detect_force_native callback.
      
      acpi_video_set_dmi_backlight_type() is troublesome because it may end up
      getting called after other backlight drivers have already called
      acpi_video_get_backlight_type() resulting in the other drivers
      already being registered even though they should not.
      Acked-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      1e3344d6
    • Hans de Goede's avatar
      platform/x86: asus-wmi: Move acpi_backlight=vendor quirks to ACPI video_detect.c · 52796b30
      Hans de Goede authored
      Remove the asus-wmi quirk_entry.wmi_backlight_power quirk-flag, which
      called acpi_video_set_dmi_backlight_type(acpi_backlight_vendor) and replace
      it with acpi/video_detect.c video_detect_dmi_table[] entries using the
      video_detect_force_vendor callback.
      
      acpi_video_set_dmi_backlight_type() is troublesome because it may end up
      getting called after other backlight drivers have already called
      acpi_video_get_backlight_type() resulting in the other drivers
      already being registered even though they should not.
      
      Note no entries are dropped from the dmi_system_id table in asus-nb-wmi.c.
      This is because the entries using the removed wmi_backlight_power flag
      also use other model specific quirks from the asus-wmi quirk_entry struct.
      So the quirk_asus_x55u struct and the entries pointing to it cannot be
      dropped.
      Acked-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      52796b30
    • Hans de Goede's avatar
      platform/x86: asus-wmi: Drop DMI chassis-type check from backlight handling · 2603c681
      Hans de Goede authored
      Remove this check from the asus-wmi backlight handling:
      
      	/* Some Asus desktop boards export an acpi-video backlight interface,
      	   stop this from showing up */
      	chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
      	if (chassis_type && !strcmp(chassis_type, "3"))
      		acpi_video_set_dmi_backlight_type(acpi_backlight_vendor);
      
      This acpi_video_set_dmi_backlight_type(acpi_backlight_vendor) call must be
      removed because other changes in this series change the native backlight
      drivers to no longer unconditionally register their backlight. Instead
      these drivers now do this check:
      
              if (acpi_video_get_backlight_type(false) != acpi_backlight_native)
                      return 0; /* bail */
      
      So leaving this in place can break things on laptops with a broken
      DMI chassis-type, which would have GPU native brightness control before
      the addition of the acpi_video_get_backlight_type() != native check.
      
      Removing this should be ok now, since the ACPI video code has improved
      heuristics for this itself now (which includes a chassis-type check).
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      2603c681
    • Hans de Goede's avatar
      platform/x86: acer-wmi: Move backlight DMI quirks to acpi/video_detect.c · 0172df18
      Hans de Goede authored
      Move the backlight DMI quirks to acpi/video_detect.c, so that
      the driver no longer needs to call acpi_video_set_dmi_backlight_type().
      
      acpi_video_set_dmi_backlight_type() is troublesome because it may end up
      getting called after other backlight drivers have already called
      acpi_video_get_backlight_type() resulting in the other drivers
      already being registered even though they should not.
      
      Note that even though the DMI quirk table name was video_vendor_dmi_table,
      5/6 quirks were actually quirks to use the GPU native backlight.
      
      These 5 quirks also had a callback in their dmi_system_id entry which
      disabled the acer-wmi vendor driver; and any DMI match resulted in:
      
      	acpi_video_set_dmi_backlight_type(acpi_backlight_vendor);
      
      which disabled the acpi_video driver, so only the native driver was left.
      The new entries for these 5/6 devices correctly marks these as needing
      the native backlight driver.
      
      Also note that other changes in this series change the native backlight
      drivers to no longer unconditionally register their backlight. Instead
      these drivers now do this check:
      
      	if (acpi_video_get_backlight_type(false) != acpi_backlight_native)
      		return 0; /* bail */
      
      which without this patch would have broken these 5/6 "special" quirks.
      
      Since I had to look at all the commits adding the quirks anyways, to make
      sure that I understood the code correctly, I've also added links to
      the various original bugzillas for these quirks to the new entries.
      Acked-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      0172df18
    • Hans de Goede's avatar
      platform/x86: toshiba_acpi: Stop using acpi_video_set_dmi_backlight_type() · a2ed70d0
      Hans de Goede authored
      acpi_video_set_dmi_backlight_type() is troublesome because it may end up
      getting called after other backlight drivers have already called
      acpi_video_get_backlight_type() resulting in the other drivers
      already being registered even though they should not.
      
      In case of the acpi_video backlight, acpi_video_set_dmi_backlight_type()
      actually calls acpi_video_unregister_backlight() since that is often
      probed earlier, leading to userspace seeing the acpi_video0 class
      device being briefly available, leading to races in userspace where
      udev probe-rules try to access the device and it is already gone.
      
      In case of toshiba_acpi there are no DMI quirks to move to
      acpi/video_detect.c, but it also (ab)uses it for transflective
      displays. Adding transflective display support to video_detect.c would
      be quite involved. But luckily there are only 2 known models with
      a transflective display, so we can just add DMI quirks for those.
      Acked-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      a2ed70d0
    • Hans de Goede's avatar
      platform/x86: apple-gmux: Stop calling acpi/video.h functions · 4f04c7dc
      Hans de Goede authored
      Now that acpi_video_get_backlight_type() has apple-gmux detection (using
      apple_gmux_present()), it is no longer necessary for the apple-gmux code
      to manually remove possibly conflicting drivers.
      
      So remove the handling for this from the apple-gmux driver.
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      4f04c7dc
    • Hans de Goede's avatar
      platform/x86: nvidia-wmi-ec-backlight: Use acpi_video_get_backlight_type() · 8d0ca287
      Hans de Goede authored
      Add an acpi_video_get_backlight_type() == acpi_backlight_nvidia_wmi_ec
      check. This will make nvidia-wmi-ec-backlight properly honor the user
      selecting a different backlight driver through the acpi_backlight=...
      kernel commandline option.
      
      Since the auto-detect code check for nvidia-wmi-ec-backlight in
      drivers/acpi/video_detect.c already checks that the WMI advertised
      brightness-source is the embedded controller, this new check makes it
      unnecessary for nvidia_wmi_ec_backlight_probe() to check this itself.
      Suggested-by: default avatarDaniel Dadap <ddadap@nvidia.com>
      Reviewed-by: default avatarDaniel Dadap <ddadap@nvidia.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      8d0ca287
    • Hans de Goede's avatar
      ACPI: video: Add Apple GMUX brightness control detection · 21245df3
      Hans de Goede authored
      On Apple laptops with an Apple GMUX using this for brightness control,
      should take precedence of any other brightness control methods.
      
      Add apple-gmux detection to acpi_video_get_backlight_type() using
      the already existing apple_gmux_present() helper function.
      
      This will allow removig the (ab)use of:
      
      	acpi_video_set_dmi_backlight_type(acpi_backlight_vendor);
      
      Inside the apple-gmux driver.
      Acked-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      21245df3
    • Hans de Goede's avatar
      ACPI: video: Add Nvidia WMI EC brightness control detection (v3) · fe7aebb4
      Hans de Goede authored
      On some new laptop designs a new Nvidia specific WMI interface is present
      which gives info about panel brightness control and may allow controlling
      the brightness through this interface when the embedded controller is used
      for brightness control.
      
      When this WMI interface is present and indicates that the EC is used,
      then this interface should be used for brightness control.
      
      Changes in v2:
      - Use the new shared nvidia-wmi-ec-backlight.h header for the
        WMI firmware API definitions
      - ACPI_VIDEO can now be enabled on non X86 too,
        adjust the Kconfig changes to match this.
      
      Changes in v3:
      - Use WMI_BRIGHTNESS_GUID define
      Acked-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Reviewed-by: default avatarDaniel Dadap <ddadap@nvidia.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      fe7aebb4
    • Hans de Goede's avatar
      ACPI: video: Refactor acpi_video_get_backlight_type() a bit · b39be9f4
      Hans de Goede authored
      Refactor acpi_video_get_backlight_type() so that the heuristics /
      detection steps are stricly in order of descending precedence.
      
      Also move the comments describing the steps to when the various steps are
      actually done, to avoid the comments getting out of sync with the code.
      Acked-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      b39be9f4
    • Hans de Goede's avatar
      platform/x86: nvidia-wmi-ec-backlight: Move fw interface definitions to a header (v2) · 3db2aeb1
      Hans de Goede authored
      Move the WMI interface definitions to a header, so that the definitions
      can be shared with drivers/acpi/video_detect.c .
      
      Changes in v2:
      - Add missing Nvidia copyright header
      - Move WMI_BRIGHTNESS_GUID to nvidia-wmi-ec-backlight.h as well
      Suggested-by: default avatarDaniel Dadap <ddadap@nvidia.com>
      Reviewed-by: default avatarDaniel Dadap <ddadap@nvidia.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      3db2aeb1
    • Hans de Goede's avatar
      drm/radeon: Register ACPI video backlight when skipping radeon backlight registration · 5e0e33f9
      Hans de Goede authored
      Typically the acpi_video driver will initialize before radeon, which
      used to cause /sys/class/backlight/acpi_video0 to get registered and then
      radeon would register its own radeon_bl# device later. After which
      the drivers/acpi/video_detect.c code unregistered the acpi_video0 device
      to avoid there being 2 backlight devices.
      
      This means that userspace used to briefly see 2 devices and the
      disappearing of acpi_video0 after a brief time confuses the systemd
      backlight level save/restore code, see e.g.:
      https://bbs.archlinux.org/viewtopic.php?id=269920
      
      To fix this the ACPI video code has been modified to make backlight class
      device registration a separate step, relying on the drm/kms driver to
      ask for the acpi_video backlight registration after it is done setting up
      its native backlight device.
      
      Add a call to the new acpi_video_register_backlight() when radeon skips
      registering its own backlight device because of e.g. the firmware_flags
      or the acpi_video_get_backlight_type() return value. This ensures that
      if the acpi_video backlight device should be used, it will be available
      before the radeon drm_device gets registered with userspace.
      Acked-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      5e0e33f9
    • Hans de Goede's avatar
      drm/amdgpu: Register ACPI video backlight when skipping amdgpu backlight registration · c0f50c5d
      Hans de Goede authored
      Typically the acpi_video driver will initialize before amdgpu, which
      used to cause /sys/class/backlight/acpi_video0 to get registered and then
      amdgpu would register its own amdgpu_bl# device later. After which
      the drivers/acpi/video_detect.c code unregistered the acpi_video0 device
      to avoid there being 2 backlight devices.
      
      This means that userspace used to briefly see 2 devices and the
      disappearing of acpi_video0 after a brief time confuses the systemd
      backlight level save/restore code, see e.g.:
      https://bbs.archlinux.org/viewtopic.php?id=269920
      
      To fix this the ACPI video code has been modified to make backlight class
      device registration a separate step, relying on the drm/kms driver to
      ask for the acpi_video backlight registration after it is done setting up
      its native backlight device.
      
      Add a call to the new acpi_video_register_backlight() when amdgpu skips
      registering its own backlight device because of either the firmware_flags
      or the acpi_video_get_backlight_type() return value. This ensures that
      if the acpi_video backlight device should be used, it will be available
      before the amdgpu drm_device gets registered with userspace.
      Acked-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      c0f50c5d
    • Hans de Goede's avatar
      drm/nouveau: Register ACPI video backlight when nv_backlight registration fails (v2) · c0533838
      Hans de Goede authored
      Typically the acpi_video driver will initialize before nouveau, which
      used to cause /sys/class/backlight/acpi_video0 to get registered and then
      nouveau would register its own nv_backlight device later. After which
      the drivers/acpi/video_detect.c code unregistered the acpi_video0 device
      to avoid there being 2 backlight devices.
      
      This means that userspace used to briefly see 2 devices and the
      disappearing of acpi_video0 after a brief time confuses the systemd
      backlight level save/restore code, see e.g.:
      https://bbs.archlinux.org/viewtopic.php?id=269920
      
      To fix this the ACPI video code has been modified to make backlight class
      device registration a separate step, relying on the drm/kms driver to
      ask for the acpi_video backlight registration after it is done setting up
      its native backlight device.
      
      Add a call to the new acpi_video_register_backlight() when native backlight
      device registration has failed / was skipped to ensure that there is a
      backlight device available before the drm_device gets registered with
      userspace.
      
      Changes in v2:
      - Add nouveau_acpi_video_register_backlight() wrapper to avoid unresolved
        symbol errors on non X86
      Reviewed-by: default avatarLyude Paul <lyude@redhat.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      c0533838
    • Hans de Goede's avatar
      drm/i915: Call acpi_video_register_backlight() (v3) · 3c8b6a39
      Hans de Goede authored
      On machins without an i915 opregion the acpi_video driver immediately
      probes the ACPI video bus and used to also immediately register
      acpi_video# backlight devices when supported.
      
      Once the drm/kms driver then loaded later and possibly registered
      a native backlight device then the drivers/acpi/video_detect.c code
      unregistered the acpi_video0 device to avoid there being 2 backlight
      devices (when acpi_video_get_backlight_type()==native).
      
      This means that userspace used to briefly see 2 devices and the
      disappearing of acpi_video0 after a brief time confuses the systemd
      backlight level save/restore code, see e.g.:
      https://bbs.archlinux.org/viewtopic.php?id=269920
      
      To fix this the ACPI video code has been modified to make backlight class
      device registration a separate step, relying on the drm/kms driver to
      ask for the acpi_video backlight registration after it is done setting up
      its native backlight device.
      
      Add a call to the new acpi_video_register_backlight() after the i915 calls
      acpi_video_register() (after setting up the i915 opregion) so that the
      acpi_video backlight devices get registered on systems where the i915
      native backlight device is not registered.
      
      Changes in v2:
      -Only call acpi_video_register_backlight() when a panel is detected
      
      Changes in v3:
      -Add a new intel_acpi_video_register() helper which checks if a panel
       is present and then calls acpi_video_register_backlight()
      Reviewed-by: default avatarJani Nikula <jani.nikula@intel.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      3c8b6a39
  3. 02 Sep, 2022 6 commits
  4. 01 Sep, 2022 10 commits