1. 21 Oct, 2021 5 commits
  2. 20 Oct, 2021 27 commits
  3. 19 Oct, 2021 8 commits
    • Manivannan Sadhasivam's avatar
      MAINTAINERS: Update the entry for MHI bus · 8135cc5b
      Manivannan Sadhasivam authored
      Since Hemant is not carrying out any maintainership duties let's make
      him as a dedicated reviewer. Also add the new mailing lists dedicated
      for MHI in subspace mailing list server.
      Reviewed-by: default avatarHemant Kumar <hemantk@codeaurora.org>
      Signed-off-by: default avatarManivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
      Link: https://lore.kernel.org/r/20211019133901.173966-1-manivannan.sadhasivam@linaro.orgSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      8135cc5b
    • Greg Kroah-Hartman's avatar
      Merge tag 'iio-for-5.16a-split-take4' of... · 6bce28cb
      Greg Kroah-Hartman authored
      Merge tag 'iio-for-5.16a-split-take4' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next
      
      Jonathan writes:
      
      First set of IIO new device and feature support for the 5.16 cycle
      
      Counter subsystem changes now sent separately.
      
      This has been a busy cycle, so lots here and a few more stragglers to
      come next week.
      
      Big new feature in this cycle is probably output buffer support.
      This has been in the works for a very long time so it's great to see
      Mihail pick up the challenge and build upon his predecessors work to finally
      bring this feature to mainline.
      
      New device support
      ------------------
      
      * adi,adxl313
        - New driver and dt bindings for this low power accelerometer.
      * adi,adxl355
        - New driver and dt bindings for this accelerometer.
        - Later series adds buffer support.
      * asahi-kasei,ak8975
        - Minor additions to driver to support ak09916
      * aspeed,aspeed-adc
        - Substantial rework plus feature additions to add support for the
          ast2600 including a new dt bindings doc.
      * atmel,at91_sama5d2
        - Rework and support introduced for the sama7g5 parts.
      * maxim,max31865
        - New driver and bindings for this RTD temperature sensor chip.
      * nxp,imx8qxp
        - New driver and bindings for the ADC found on the i.MX 8QuadXPlus Soc.
      * senseair,sunrise
        - New driver and bindings for this family of carbon dioxide gas sensors.
      * sensiron,scd4x
        - New driver and bindings for this carbon dioxide gas sensor.
      
      New features
      ------------
      
      * Output buffer support.  Works in a similar fashion to input buffers, but
        in this case userspace pushes data into the kfifo which is then drained
        to the device when a trigger occurs.  Support added to the ad5766 DAC
        driver.
      * Core, devm_iio_map_array_register() to avoid need for
        devm_add_action_or_reset() based cleanup in fully managed allocation
        drivers.
      * Core iio_push_to_buffers_with_ts_unaligned() function to safely handle a
        few drivers where it really hard to ensure the correct data alignment in
        an iio_push_to_buffers_with_timestamp() call. Note this uses a bounce
        buffer so should be avoided whenever possible.  Used in the ti,adc108s102,
        invense,mpu3050 and adi,adis16400.  This closes the last   known set
        of drivers with alignment issues at this interface.
      * maxim,max1027
        - Substantial rework to this driver main target of which was supporting
          use of other triggers than it's own EOC interrupt.
        - Transfer optimization.
      * nxp,fxls8962af
        - Threshold even support including using it as a wakeup source.
      
      Cleanups, minor fixes etc
      -------------------------
      
      Chances of a common type to multiple drivers:
      
      * devm_ conversion and drop of .remove() callbacks in:
        - adi,ad5064
        - adi,ad7291
        - adi,ad7303
        - adi,ad7746
        - adi,ad9832
        - adi,adis16080
        - dialog,da9150-gpadc
        - intel,mrfld_adc
        - marvell,berlin2
        - maxim,max1363
        - maxim,max44000
        - nuvoton,nau7802
        - st_sensors (includes a lot of rework!)
        - ti,ads8344
        - ti,lp8788
      
      * devm_platform_ioremap_resource() used to reduce boilerplate
        - cirrus,ep93xx
        - rockchip,saradc
        - stm,stm32-dac
      
      * Use dev_err_probe() in more places to both not print on deferred probe and
        ensure a reason for the deferral is available for debug purposes.
        - adi,ad8801
        - capella,cm36651
        - linear,ltc1660
        - maxim,ds4424
        - maxim,max5821
        - microchip,mcp4922
        - nxp,lpc18xx
        - onnn,noa1305
        - st,lsm9ds0
        - st,st_sensors
        - st,stm32-dac
        - ti,afe4403
        - ti,afe4404
        - ti,dac7311
      
      * Drop error returns in SPI and I2C remove() functions as they are ignored and
        long term plan is to change these all over to returning void. In some cases
        these patches just make it 'obvious' they always return 0 where it was the
        case before but not easy to tell.
        - adi,ad5380
        - adi,ad5446
        - adi,ad5686
        - adi,ad5592r
        - bosch,bma400
        - bosch,bmc150
        - fsl,mma7455
        - honeywell,hmc5843
        - kionix,kxsd9
        - maxim,max5487
        - meas,ms5611
        - ti,afe4403
      
      Driver specific changes
      
      * adi,ad5770r
        - Bring driver inline with documented bindings.
      * adi,ad7746
        - Trivial style fix
      * adi,ad7949
        - Express some magic values as the underlying parts via new #defines.
        - Make it work with SPI controllers that don't support 14 or 16 bit messages
        - Support selection of voltage reference from dt including expanding the
          dt-bindings to cover this new functionality.
      * adi,ad799x
        - Implement selection of external reference voltage on AD7991, AD7995 and
          AD7999.
        - Add missing dt-bindings doc for devices supported by this driver.
      * adi,adislib
        - Move interrupt startup to better location in startup flow.
        - Handle devices that cannot mask/unmask the drdy pin and must instead mask
          at the interrupt controller.  Applies to the adis16460 and adis16475 from
          which we then drop equivalent code.
      * adi,ltc2983
        - Add support for optional reset pin.
        - Fail to probe if no channels specified in dt binding.
      * asahi-kasei,ak8975
        - dt-binding additions of missing vid-supply regulator.
      * aspeed,aspeed-adc
        - Typo fix.
      * fsl,mma7660
        - Mark acpi_device_id table __maybe_unused to avoid build warning.
      * fsl,imx25-gcq
        - Avoid initializing regulators that aren't used.
      * invensense,mpu3050
        - Drop a dead protection against a clash with the old input driver.
      * invensense,mpu6050
        - Rework code to not use strcpy() and hence avoid possibility of wrong sized
          buffers. Note this wasn't a bug, but the new code is a lot more readable.
        - Mark acpi_device_id table __maybe_unused to avoid build warning.
      * kionix,kxcjk1013
        - dt-binding addition to note it supports interrupts.
      * marvell,berlin2-adc
        - Enable COMPILE_TEST building.
      * maxim,max1027
        - Avoid returning success in an error path.
      * nxp,imx8qxp
        - Fix warning when runtime pm not enabled via __maybe_unused.
      * ricoh,rn5t618
        - Use the new devm_iio_map_array_register() instead of open coding the same.
      * samsung,exynos_adc
        - Improve kconfig help text.
      * st,lsm6dsx
        - Move max_fifo_size into the fifo_ops structure where the other configuration
          parameters are found.
      * st,st_sensors:
        - Reorder to ensure we turn the power off after removing userspace interfaces.
      * senseair,sunrise
        - Add missing I2C dependency.
      * ti,twl6030
        - Small code tidy up.
      
      * tag 'iio-for-5.16a-split-take4' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (148 commits)
        iio: imx8qxp-adc: mark PM functions as __maybe_unused
        iio: pressure: ms5611: Make ms5611_remove() return void
        iio: potentiometer: max5487: Don't return an error in .remove()
        iio: magn: hmc5843: Make hmc5843_common_remove() return void
        iio: health: afe4403: Don't return an error in .remove()
        iio: dac: ad5686: Make ad5686_remove() return void
        iio: dac: ad5592r: Make ad5592r_remove() return void
        iio: dac: ad5446: Make ad5446_remove() return void
        iio: dac: ad5380: Make ad5380_remove() return void
        iio: accel: mma7455: Make mma7455_core_remove() return void
        iio: accel: kxsd9: Make kxsd9_common_remove() return void
        iio: accel: bmi088: Make bmi088_accel_core_remove() return void
        iio: accel: bmc150: Make bmc150_accel_core_remove() return void
        iio: accel: bma400: Make bma400_remove() return void
        drivers:iio:dac:ad5766.c: Add trigger buffer
        iio: triggered-buffer: extend support to configure output buffers
        iio: kfifo-buffer: Add output buffer support
        iio: Add output buffer support
        iio: documentation: Document scd4x calibration use
        drivers: iio: chemical: Add support for Sensirion SCD4x CO2 sensor
        ...
      6bce28cb
    • David Lechner's avatar
      counter: drop chrdev_lock · f5245a5f
      David Lechner authored
      This removes the chrdev_lock from the counter subsystem. This was
      intended to prevent opening the chrdev more than once. However, this
      doesn't work in practice since userspace can duplicate file descriptors
      and pass file descriptors to other processes. Since this protection
      can't be relied on, it is best to just remove it.
      Suggested-by: default avatarGreg KH <gregkh@linuxfoundation.org>
      Acked-by: default avatarWilliam Breathitt Gray <vilhelm.gray@gmail.com>
      Signed-off-by: default avatarDavid Lechner <david@lechnology.com>
      Link: https://lore.kernel.org/r/20211017185521.3468640-1-david@lechnology.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f5245a5f
    • David Lechner's avatar
      counter/counter-sysfs: use sysfs_emit everywhere · c3ed761c
      David Lechner authored
      In the counter subsystem, we are already using sysfs_emit(), but there
      were a few places where we were still using sprintf() in *_show()
      functions. For consistency and added protections, use sysfs_emit()
      everywhere.
      Suggested-by: default avatarGreg KH <gregkh@linuxfoundation.org>
      Acked-by: default avatarWilliam Breathitt Gray <vilhelm.gray@gmail.com>
      Signed-off-by: default avatarDavid Lechner <david@lechnology.com>
      Link: https://lore.kernel.org/r/20211017190106.3472645-1-david@lechnology.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c3ed761c
    • Ziyang Xuan's avatar
      char: xillybus: fix msg_ep UAF in xillyusb_probe() · 15c9a359
      Ziyang Xuan authored
      When endpoint_alloc() return failed in xillyusb_setup_base_eps(),
      'xdev->msg_ep' will be freed but not set to NULL. That lets program
      enter fail handling to cleanup_dev() in xillyusb_probe(). Check for
      'xdev->msg_ep' is invalid in cleanup_dev() because 'xdev->msg_ep' did
      not set to NULL when was freed. So the UAF problem for 'xdev->msg_ep'
      is triggered.
      
      ==================================================================
      BUG: KASAN: use-after-free in fifo_mem_release+0x1f4/0x210
      CPU: 0 PID: 166 Comm: kworker/0:2 Not tainted 5.15.0-rc5+ #19
      Call Trace:
       dump_stack_lvl+0xe2/0x152
       print_address_description.constprop.0+0x21/0x140
       ? fifo_mem_release+0x1f4/0x210
       kasan_report.cold+0x7f/0x11b
       ? xillyusb_probe+0x530/0x700
       ? fifo_mem_release+0x1f4/0x210
       fifo_mem_release+0x1f4/0x210
       ? __sanitizer_cov_trace_pc+0x1d/0x50
       endpoint_dealloc+0x35/0x2b0
       cleanup_dev+0x90/0x120
       xillyusb_probe+0x59a/0x700
      ...
      
      Freed by task 166:
       kasan_save_stack+0x1b/0x40
       kasan_set_track+0x1c/0x30
       kasan_set_free_info+0x20/0x30
       __kasan_slab_free+0x109/0x140
       kfree+0x117/0x4c0
       xillyusb_probe+0x606/0x700
      
      Set 'xdev->msg_ep' to NULL after being freed in xillyusb_setup_base_eps()
      to fix the UAF problem.
      
      Fixes: a53d1202 ("char: xillybus: Add driver for XillyUSB (Xillybus variant for USB)")
      Cc: stable <stable@vger.kernel.org>
      Acked-by: default avatarEli Billauer <eli.billauer@gmail.com>
      Signed-off-by: default avatarZiyang Xuan <william.xuanziyang@huawei.com>
      Link: https://lore.kernel.org/r/20211016052047.1611983-1-william.xuanziyang@huawei.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      15c9a359
    • Todd Kjos's avatar
      binder: don't detect sender/target during buffer cleanup · 32e9f56a
      Todd Kjos authored
      When freeing txn buffers, binder_transaction_buffer_release()
      attempts to detect whether the current context is the target by
      comparing current->group_leader to proc->tsk. This is an unreliable
      test. Instead explicitly pass an 'is_failure' boolean.
      
      Detecting the sender was being used as a way to tell if the
      transaction failed to be sent.  When cleaning up after
      failing to send a transaction, there is no need to close
      the fds associated with a BINDER_TYPE_FDA object. Now
      'is_failure' can be used to accurately detect this case.
      
      Fixes: 44d8047f ("binder: use standard functions to allocate fds")
      Cc: stable <stable@vger.kernel.org>
      Acked-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
      Signed-off-by: default avatarTodd Kjos <tkjos@google.com>
      Link: https://lore.kernel.org/r/20211015233811.3532235-1-tkjos@google.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      32e9f56a
    • Greg Kroah-Hartman's avatar
      Merge tag 'misc-habanalabs-next-2021-10-18' of... · be24dd48
      Greg Kroah-Hartman authored
      Merge tag 'misc-habanalabs-next-2021-10-18' of https://git.kernel.org/pub/scm/linux/kernel/git/ogabbay/linux into char-misc-next
      
      Oded writes:
      
      This tag contains habanalabs driver changes for v5.16:
      
      - Add a new uAPI (under the memory ioctl) to request from the driver
        to export a DMA-BUF object that represents a memory region on
        the device's DRAM. This is needed to enable peer-to-peer over PCIe
        between habana device and an RDMA adapter (e.g. mlnx5 or efa
        rdma adapter).
      
      - Add debugfs node to dynamically configure CS timeout. Up until now,
        it was only configurable through kernel module parameter.
      
      - Fetch more comprehensive power information from the firmware.
      
      - Always take timestamp when waiting for user interrupt, as the user
        needs that information to optimize the graph runtime compilation.
      
      - Modify user interrupt to look on 64-bit user value as fence, instead
        of 32-bit.
      
      - Bypass reset in case of repeated h/w error event after device reset.
        This is to prevent endless loop of resets to the device.
      
      - Fix several bugs in multi CS completion code.
      
      - Fix race condition in fd close/open.
      
      - Update to latest firmware headers
      
      - Add select CRC32 in kconfig
      
      - Small fixes, cosmetics
      
      * tag 'misc-habanalabs-next-2021-10-18' of https://git.kernel.org/pub/scm/linux/kernel/git/ogabbay/linux: (25 commits)
        habanalabs: refactor fence handling in hl_cs_poll_fences
        habanalabs: context cleanup cosmetics
        habanalabs: simplify wait for interrupt with timestamp flow
        habanalabs: initialize hpriv fields before adding new node
        habanalabs: Unify frequency set/get functionality
        habanalabs: select CRC32
        habanalabs: add support for dma-buf exporter
        habanalabs: define uAPI to export FD for DMA-BUF
        habanalabs: fix NULL pointer dereference
        habanalabs: fix race condition in multi CS completion
        habanalabs: use only u32
        habanalabs: update firmware files
        habanalabs: bypass reset for continuous h/w error event
        habanalabs: take timestamp on wait for interrupt
        habanalabs: prevent race between fd close/open
        habanalabs: refactor reset log message
        habanalabs: define soft-reset as inference op
        habanalabs: fix debugfs device memory MMU VA translation
        habanalabs: add support for a long interrupt target value
        habanalabs: remove redundant cs validity checks
        ...
      be24dd48
    • Arnd Bergmann's avatar
      iio: imx8qxp-adc: mark PM functions as __maybe_unused · 0336d605
      Arnd Bergmann authored
      Without CONFIG_PM_SLEEP, the runtime suspend/resume functions
      are unused, producing a warning:
      
      drivers/iio/adc/imx8qxp-adc.c:433:12: error: 'imx8qxp_adc_runtime_resume' defined but not used [-Werror=unused-function]
        433 | static int imx8qxp_adc_runtime_resume(struct device *dev)
            |            ^~~~~~~~~~~~~~~~~~~~~~~~~~
      drivers/iio/adc/imx8qxp-adc.c:419:12: error: 'imx8qxp_adc_runtime_suspend' defined but not used [-Werror=unused-function]
        419 | static int imx8qxp_adc_runtime_suspend(struct device *dev)
            |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      Mark them as __maybe_unused to shut up the compiler.
      
      Fixes: 1e23dcaa ("iio: imx8qxp-adc: Add driver support for NXP IMX8QXP ADC")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Reviewed-by: default avatarCai Huoqing <caihuoqing@baidu.com>
      Link: https://lore.kernel.org/r/20211013144338.2261316-1-arnd@kernel.orgSigned-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
      0336d605