1. 08 10月, 2017 2 次提交
  2. 20 9月, 2017 2 次提交
    • S
      ACPI: properties: Return _DSD hierarchical extension (data) sub-nodes correctly · 0c0bceb7
      Sakari Ailus 提交于
      The recently merged patch "ACPI: Prepare for constifying
      acpi_get_next_subnode() fwnode argument" was part of a patchset
      constifying the fwnode arguments across the fwnode property API. The
      purpose of the patch was to allow returning non-const fwnodes from a data
      structure the root of which is const.
      
      Unfortunately the patch introduced the functionality, in particular when
      starting parsed from an ACPI device node, the hierarchical data extension
      nodes would not be enumerated.
      
      Restore the old behaviour while still retaining constness properties of
      the patch.
      
      Fixes: 01c1da28 "ACPI: Prepare for constifying acpi_get_next_subnode() fwnode argument"
      Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
      Acked-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      0c0bceb7
    • J
      ACPI / bus: Make ACPI_HANDLE() work for non-GPL code again · 9e987b70
      John Hubbard 提交于
      Due to commit db3e50f3 (device property: Get rid of struct
      fwnode_handle type field), ACPI_HANDLE() inadvertently became
      a GPL-only call. The call path that led to that was:
      
      ACPI_HANDLE()
          ACPI_COMPANION()
              to_acpi_device_node()
                  is_acpi_device_node()
                      acpi_device_fwnode_ops
                          DECLARE_ACPI_FWNODE_OPS(acpi_device_fwnode_ops);
      
      ...and the new DECLARE_ACPI_FWNODE_OPS() includes
      EXPORT_SYMBOL_GPL, whereas previously it was a static struct.
      
      In order to avoid changing any of that, let's instead provide ever
      so slightly better encapsulation of those struct fwnode_operations
      instances. Those do not really need to be directly used in
      inline function calls in header files. Simply moving two small
      functions (is_acpi_device_node and is_acpi_data_node) out of
      acpi_bus.h, and into a .c file, does that.
      
      That leaves the internals of struct fwnode_operations as GPL-only
      (which I think was the intent all along), but un-breaks any driver
      code out there that relies on the ACPI subsystem's being (historically)
      an EXPORT_SYMBOL-usable system. By that, I mean, ACPI_HANDLE() and
      other basic ACPI calls were non-GPL-protected.
      
      Also, while I'm there, remove a tiny bit of redundancy that was missed
      in the earlier commit, by having is_acpi_node() use the other two
      routines, instead of checking fwnode directly.
      
      Fixes: db3e50f3 (device property: Get rid of struct fwnode_handle type field)
      Signed-off-by: NJohn Hubbard <jhubbard@nvidia.com>
      Acked-by: NSakari Ailus <sakari.ailus@linux.intel.com>
      Acked-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      9e987b70
  3. 19 9月, 2017 1 次提交
    • A
      ACPI / watchdog: properly initialize resources · 6ce14f64
      Arnd Bergmann 提交于
      We copy a local resource structure into a list, but only
      initialize some of its members, as pointed out by gcc-4.4:
      
      drivers/acpi/acpi_watchdog.c: In function 'acpi_watchdog_init':
      drivers/acpi/acpi_watchdog.c:105: error: 'res.child' may be used uninitialized in this function
      drivers/acpi/acpi_watchdog.c:105: error: 'res.sibling' may be used uninitialized in this function
      drivers/acpi/acpi_watchdog.c:105: error: 'res.parent' may be used uninitialized in this function
      drivers/acpi/acpi_watchdog.c:105: error: 'res.desc' may be used uninitialized in this function
      drivers/acpi/acpi_watchdog.c:105: error: 'res.name' may be used uninitialized in this function
      
      Newer compilers can presumably optimize the uninitialized access
      away entirely and don't warn at all, but rely on the kzalloc()
      to zero the structure first. This adds an explicit initialization
      to force consistent behavior.
      
      Fixes: 058dfc76 (ACPI / watchdog: Add support for WDAT hardware watchdog)
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Acked-by: NGuenter Roeck <linux@roeck-us.net>
      Acked-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      6ce14f64
  4. 14 9月, 2017 1 次提交
  5. 05 9月, 2017 1 次提交
    • M
      libnvdimm, nfit: move the check on nd_reserved2 to the endpoint · 9edcad53
      Meng Xu 提交于
      Delay the check of nd_reserved2 to the actual endpoint (acpi_nfit_ctl)
      that uses it, as a prevention of a potential double-fetch bug.
      
      While examining the kernel source code, I found a dangerous operation that
      could turn into a double-fetch situation (a race condition bug) where
      the same userspace memory region are fetched twice into kernel with sanity
      checks after the first fetch while missing checks after the second fetch.
      
      In the case of _IOC_NR(ioctl_cmd) == ND_CMD_CALL:
      
      1. The first fetch happens in line 935 copy_from_user(&pkg, p, sizeof(pkg)
      
      2. subsequently `pkg.nd_reserved2` is asserted to be all zeroes
      (line 984 to 986).
      
      3. The second fetch happens in line 1022 copy_from_user(buf, p, buf_len)
      
      4. Given that `p` can be fully controlled in userspace, an attacker can
      race condition to override the header part of `p`, say,
      `((struct nd_cmd_pkg *)p)->nd_reserved2` to arbitrary value
      (say nine 0xFFFFFFFF for `nd_reserved2`) after the first fetch but before the
      second fetch. The changed value will be copied to `buf`.
      
      5. There is no checks on the second fetches until the use of it in
      line 1034: nd_cmd_clear_to_send(nvdimm_bus, nvdimm, cmd, buf) and
      line 1038: nd_desc->ndctl(nd_desc, nvdimm, cmd, buf, buf_len, &cmd_rc)
      which means that the assumed relation, `p->nd_reserved2` are all zeroes might
      not hold after the second fetch. And once the control goes to these functions
      we lose the context to assert the assumed relation.
      
      6. Based on my manual analysis, `p->nd_reserved2` is not used in function
      `nd_cmd_clear_to_send` and potential implementations of `nd_desc->ndctl`
      so there is no working exploit against it right now. However, this could
      easily turns to an exploitable one if careless developers start to use
      `p->nd_reserved2` later and assume that they are all zeroes.
      
      Move the validation of the nd_reserved2 field to the ->ndctl()
      implementation where it has a stable buffer to evaluate.
      Signed-off-by: NMeng Xu <mengxu.gatech@gmail.com>
      Signed-off-by: NDan Williams <dan.j.williams@intel.com>
      9edcad53
  6. 01 9月, 2017 2 次提交
    • R
      libnvdimm, nd_blk: remove mmio_flush_range() · 5deb67f7
      Robin Murphy 提交于
      mmio_flush_range() suffers from a lack of clearly-defined semantics,
      and is somewhat ambiguous to port to other architectures where the
      scope of the writeback implied by "flush" and ordering might matter,
      but MMIO would tend to imply non-cacheable anyway. Per the rationale
      in 67a3e8fe ("nd_blk: change aperture mapping from WC to WB"), the
      only existing use is actually to invalidate clean cache lines for
      ARCH_MEMREMAP_PMEM type mappings *without* writeback. Since the recent
      cleanup of the pmem API, that also now happens to be the exact purpose
      of arch_invalidate_pmem(), which would be a far more well-defined tool
      for the job.
      
      Rather than risk potentially inconsistent implementations of
      mmio_flush_range() for the sake of one callsite, streamline things by
      removing it entirely and instead move the ARCH_MEMREMAP_PMEM related
      definitions up to the libnvdimm level, so they can be shared by NFIT
      as well. This allows NFIT to be enabled for arm64.
      Signed-off-by: NRobin Murphy <robin.murphy@arm.com>
      Signed-off-by: NDan Williams <dan.j.williams@intel.com>
      5deb67f7
    • D
      libnvdimm, nfit: export an 'ecc_unit_size' sysfs attribute · a15797f4
      Dan Williams 提交于
      When the nfit driver initializes it runs an ARS (Address Range Scrub)
      operation across every pmem range. Part of that process involves
      determining the ARS capabilities of a given address range. One of the
      capabilities that is reported is the 'Clear Uncorrectable Error Range
      Length Unit Size' (see: ACPI 6.2 section 9.20.7.4 Function Index 1 -
      Query ARS Capabilities). This property is of interest to userspace
      software as it indicates the boundary at which the NVDIMM may need to
      perform read-modify-write cycles to maintain ECC blocks.
      
      Cc: Vishal Verma <vishal.l.verma@intel.com>
      Signed-off-by: NDan Williams <dan.j.williams@intel.com>
      a15797f4
  7. 30 8月, 2017 3 次提交
  8. 29 8月, 2017 3 次提交
  9. 24 8月, 2017 4 次提交
  10. 23 8月, 2017 2 次提交
  11. 20 8月, 2017 1 次提交
  12. 18 8月, 2017 8 次提交
  13. 17 8月, 2017 1 次提交
  14. 15 8月, 2017 1 次提交
  15. 11 8月, 2017 4 次提交
  16. 10 8月, 2017 1 次提交
    • R
      ACPI / LPSS: Don't abort ACPI scan on missing mem resource · a4bb2b49
      Ronald Tschalär 提交于
      The keyboard and touchpad on MacBook's from 2015 onwards are connected
      via an SPI bus. On MacBook8's (2015) the ACPI device for the SPI master
      for this bus has _CID "INT33C1", and hence the acpi-lpss handler here is
      triggered for it. However, the DSDT lists no memory resources for this
      device, resulting in an error being returned by the attach callback and
      therefore the SPI master device being ignored. This prevents us from
      being able to register the keyboard and touchpad driver.
      
      Furthermore, the controller (a Wildcat Point-LP controller) does not
      appear to need the functionality provided by the apci-lpss handler.
      Therefore we now just skip the handler if no memory resources are found
      and let the ACPI scan complete successfully for this device.
      
      All of this is not an issue on later MacBook(Pro)'s because their ACPI
      SPI devices don't have any _CID and therefore no attempt is made to attach
      this handler.
      
      Returning an error was introduced in commit d3e13ff3 - this restores
      the original behaviour.
      
      Link: https://github.com/cb22/macbook12-spi-driverSigned-off-by: NRonald Tschalär <ronald@innovation.ch>
      Acked-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      a4bb2b49
  17. 08 8月, 2017 3 次提交