summaryrefslogtreecommitdiffstats
path: root/drivers/gpio
Commit message (Collapse)AuthorAgeFilesLines
* gpio: davinci: fix lazy disableEmanuele Ghidoli2024-10-101-4/+4
| | | | | | | | | | | | | | | | | | | | | | commit 3360d41f4ac490282fddc3ccc0b58679aa5c065d upstream. On a few platforms such as TI's AM69 device, disable_irq() fails to keep track of the interrupts that happen between disable_irq() and enable_irq() and those interrupts are missed. Use the ->irq_unmask() and ->irq_mask() methods instead of ->irq_enable() and ->irq_disable() to correctly keep track of edges when disable_irq is called. This solves the issue of disable_irq() not working as expected on such platforms. Fixes: 23265442b02b ("ARM: davinci: irq_data conversion.") Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com> Signed-off-by: Parth Pancholi <parth.pancholi@toradex.com> Acked-by: Keerthy <j-keerthy@ti.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240828133207.493961-1-parth105105@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* gpio: modepin: Enable module autoloadingLiao Chen2024-09-121-0/+1
| | | | | | | | | | | | | | [ Upstream commit a5135526426df5319d5f4bcd15ae57c45a97714b ] Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table. Fixes: 7687a5b0ee93 ("gpio: modepin: Add driver support for modepin GPIO controller") Signed-off-by: Liao Chen <liaochen4@huawei.com> Reviewed-by: Michal Simek <michal.simek@amd.com> Link: https://lore.kernel.org/r/20240902115848.904227-1-liaochen4@huawei.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
* gpio: rockchip: fix OF node leak in probe()Krzysztof Kozlowski2024-09-121-0/+1
| | | | | | | | | | | | | | | [ Upstream commit adad2e460e505a556f5ea6f0dc16fe95e62d5d76 ] Driver code is leaking OF node reference from of_get_parent() in probe(). Fixes: 936ee2675eee ("gpio/rockchip: add driver for rockchip gpio") Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Reviewed-by: Heiko Stuebner <heiko@sntech.de> Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com> Link: https://lore.kernel.org/r/20240826150832.65657-1-krzysztof.kozlowski@linaro.org Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
* gpio: mlxbf3: Support shutdown() functionAsmaa Mnebhi2024-08-291-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit aad41832326723627ad8ac9ee8a543b6dca4454d ] During Linux graceful reboot, the GPIO interrupts are not disabled. Since the drivers are not removed during graceful reboot, the logic to call mlxbf3_gpio_irq_disable() is not triggered. Interrupts that remain enabled can cause issues on subsequent boots. For example, the mlxbf-gige driver contains PHY logic to bring up the link. If the gpio-mlxbf3 driver loads first, the mlxbf-gige driver will use a GPIO interrupt to bring up the link. Otherwise, it will use polling. The next time Linux boots and loads the drivers in this order, we encounter the issue: - mlxbf-gige loads first and uses polling while the GPIO10 interrupt is still enabled from the previous boot. So if the interrupt triggers, there is nothing to clear it. - gpio-mlxbf3 loads. - i2c-mlxbf loads. The interrupt doesn't trigger for I2C because it is shared with the GPIO interrupt line which was not cleared. The solution is to add a shutdown function to the GPIO driver to clear and disable all interrupts. Also clear the interrupt after disabling it in mlxbf3_gpio_irq_disable(). Fixes: 38a700efc510 ("gpio: mlxbf3: Add gpio driver support") Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com> Reviewed-by: David Thompson <davthompson@nvidia.com> Reviewed-by: Andy Shevchenko <andy@kernel.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://lore.kernel.org/r/20240611171509.22151-1-asmaa@nvidia.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
* gpio: prevent potential speculation leaks in gpio_device_get_desc()Hagar Hemdan2024-08-141-1/+2
| | | | | | | | | | | | | | | | | | | | | | [ Upstream commit d795848ecce24a75dfd46481aee066ae6fe39775 ] Userspace may trigger a speculative read of an address outside the gpio descriptor array. Users can do that by calling gpio_ioctl() with an offset out of range. Offset is copied from user and then used as an array index to get the gpio descriptor without sanitization in gpio_device_get_desc(). This change ensures that the offset is sanitized by using array_index_nospec() to mitigate any possibility of speculative information leaks. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Signed-off-by: Hagar Hemdan <hagarhem@amazon.com> Link: https://lore.kernel.org/r/20240523085332.1801-1-hagarhem@amazon.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
* gpiolib: of: add polarity quirk for TSC2005Dmitry Torokhov2024-07-051-0/+8
| | | | | | | | | | | | | DTS for Nokia N900 incorrectly specifies "active high" polarity for the reset line, while the chip documentation actually specifies it as "active low". In the past the driver fudged gpiod API and inverted the logic internally, but it was changed in d0d89493bff8. Fixes: d0d89493bff8 ("Input: tsc2004/5 - switch to using generic device properties") Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Acked-by: Linus Walleij <linus.walleij@linaro.org> Link: https://lore.kernel.org/r/ZoWXwYtwgJIxi-hD@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* gpio: mmio: do not calculate bgpio_bits via "ngpios"Shiji Yang2024-07-031-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | bgpio_bits must be aligned with the data bus width. For example, on a 32 bit big endian system and we only have 16 GPIOs. If we only assume bgpio_bits=16 we can never control the GPIO because the base address is the lowest address. low address high address ------------------------------------------------- | byte3 | byte2 | byte1 | byte0 | ------------------------------------------------- | NaN | NaN | gpio8-15 | gpio0-7 | ------------------------------------------------- Fixes: 55b2395e4e92 ("gpio: mmio: handle "ngpios" properly in bgpio_init()") Fixes: https://github.com/openwrt/openwrt/issues/15739 Reported-by: Mark Mentovai <mark@mentovai.com> Signed-off-by: Shiji Yang <yangshiji66@outlook.com> Suggested-By: Mark Mentovai <mark@mentovai.com> Reviewed-by: Jonas Gorski <jonas.gorski@gmail.com> Tested-by: Lóránd Horváth <lorand.horvath82@gmail.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://lore.kernel.org/r/TYCP286MB089577B47D70F0AB25ABA6F5BCD52@TYCP286MB0895.JPNP286.PROD.OUTLOOK.COM Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* gpiolib: of: fix lookup quirk for MIPS LantiqDmitry Torokhov2024-07-021-2/+12
| | | | | | | | | | | | | | | | | | | | | | | As it turns out, there is a large number of out-of-tree DTSes (in OpenWrt project) that used to specify incorrect (active high) polarity for the Lantiq reset GPIO, so to keep compatibility while they are being updated a quirk for force the polarity low is needed. Luckily these old DTSes used nonstandard name for the property ("gpio-reset" vs "reset-gpios") so the quirk will not hurt if there are any new devices that need inverted polarity as they can specify the right polarity in their DTS when using the standard "reset-gpios" property. Additionally the condition to enable the transition from standard to non-standard reset GPIO property name was inverted and the replacement name for the property was not correct. Fix this as well. Fixes: fbbbcd177a27 ("gpiolib: of: add quirk for locating reset lines with legacy bindings") Fixes: 90c2d2eb7ab5 ("MIPS: pci: lantiq: switch to using gpiod API") Reported-by: Martin Schiller <ms@dev.tdt.de> Acked-by: Martin Schiller <ms@dev.tdt.de> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Link: https://lore.kernel.org/r/ZoLpqv1PN08xHioh@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* gpiolib: cdev: Ignore reconfiguration without directionKent Gibson2024-06-271-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | linereq_set_config() behaves badly when direction is not set. The configuration validation is borrowed from linereq_create(), where, to verify the intent of the user, the direction must be set to in order to effect a change to the electrical configuration of a line. But, when applied to reconfiguration, that validation does not allow for the unset direction case, making it possible to clear flags set previously without specifying the line direction. Adding to the inconsistency, those changes are not immediately applied by linereq_set_config(), but will take effect when the line value is next get or set. For example, by requesting a configuration with no flags set, an output line with GPIO_V2_LINE_FLAG_ACTIVE_LOW and GPIO_V2_LINE_FLAG_OPEN_DRAIN set could have those flags cleared, inverting the sense of the line and changing the line drive to push-pull on the next line value set. Skip the reconfiguration of lines for which the direction is not set, and only reconfigure the lines for which direction is set. Fixes: a54756cb24ea ("gpiolib: cdev: support GPIO_V2_LINE_SET_CONFIG_IOCTL") Signed-off-by: Kent Gibson <warthog618@gmail.com> Link: https://lore.kernel.org/r/20240626052925.174272-3-warthog618@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)Kent Gibson2024-06-271-6/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | linehandle_set_config() behaves badly when direction is not set. The configuration validation is borrowed from linehandle_create(), where, to verify the intent of the user, the direction must be set to in order to effect a change to the electrical configuration of a line. But, when applied to reconfiguration, that validation does not allow for the unset direction case, making it possible to clear flags set previously without specifying the line direction. Adding to the inconsistency, those changes are not immediately applied by linehandle_set_config(), but will take effect when the line value is next get or set. For example, by requesting a configuration with no flags set, an output line with GPIOHANDLE_REQUEST_ACTIVE_LOW and GPIOHANDLE_REQUEST_OPEN_DRAIN requested could have those flags cleared, inverting the sense of the line and changing the line drive to push-pull on the next line value set. Ensure the intent of the user by disallowing configurations which do not have direction set, returning an error to userspace to indicate that the configuration is invalid. And, for clarity, use lflags, a local copy of gcnf.flags, throughout when dealing with the requested flags, rather than a mixture of both. Fixes: e588bb1eae31 ("gpio: add new SET_CONFIG ioctl() to gpio chardev") Signed-off-by: Kent Gibson <warthog618@gmail.com> Link: https://lore.kernel.org/r/20240626052925.174272-2-warthog618@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* gpio: graniterapids: Add missing raw_spinlock_init()Aapo Vienamo2024-06-261-0/+2
| | | | | | | | | | Add the missing raw_spin_lock_init() call to gnr_gpio_probe(). Fixes: ecc4b1418e23 ("gpio: Add Intel Granite Rapids-D vGPIO driver") Signed-off-by: Aapo Vienamo <aapo.vienamo@linux.intel.com> Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Link: https://lore.kernel.org/r/20240625135343.673745-1-aapo.vienamo@linux.intel.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* gpio: davinci: Validate the obtained number of IRQsAleksandr Mishin2024-06-241-0/+5
| | | | | | | | | | | | | | | | | Value of pdata->gpio_unbanked is taken from Device Tree. In case of broken DT due to any error this value can be any. Without this value validation there can be out of chips->irqs array boundaries access in davinci_gpio_probe(). Validate the obtained nirq value so that it won't exceed the maximum number of IRQs per bank. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering") Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru> Link: https://lore.kernel.org/r/20240618144344.16943-1-amishin@t-argos.ru Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* gpio: pca953x: fix pca953x_irq_bus_sync_unlock raceIan Ray2024-06-211-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ensure that `i2c_lock' is held when setting interrupt latch and mask in pca953x_irq_bus_sync_unlock() in order to avoid races. The other (non-probe) call site pca953x_gpio_set_multiple() ensures the lock is held before calling pca953x_write_regs(). The problem occurred when a request raced against irq_bus_sync_unlock() approximately once per thousand reboots on an i.MX8MP based system. * Normal case 0-0022: write register AI|3a {03,02,00,00,01} Input latch P0 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0 0-0022: write register AI|08 {ff,00,00,00,00} Output P3 0-0022: write register AI|12 {fc,00,00,00,00} Config P3 * Race case 0-0022: write register AI|08 {ff,00,00,00,00} Output P3 0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register *** 0-0022: write register AI|12 {fc,00,00,00,00} Config P3 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0 Signed-off-by: Ian Ray <ian.ray@gehealthcare.com> Link: https://lore.kernel.org/r/20240620042915.2173-1-ian.ray@gehealthcare.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* gpio: add missing MODULE_DESCRIPTION() macrosJeff Johnson2024-06-074-0/+4
| | | | | | | | | | | | | | On x86, make allmodconfig && make W=1 C=1 reports: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpio/gpio-gw-pld.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpio/gpio-mc33880.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpio/gpio-pcf857x.o Add the missing invocations of the MODULE_DESCRIPTION() macro, including the one missing in gpio-pl061.c, which is not built for x86. Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com> Link: https://lore.kernel.org/r/20240606-md-drivers-gpio-v1-1-cb42d240ca5c@quicinc.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* gpio: tqmx86: fix broken IRQ_TYPE_EDGE_BOTH interrupt typeMatthias Schiffer2024-06-031-4/+42
| | | | | | | | | | | | | The TQMx86 GPIO controller only supports falling and rising edge triggers, but not both. Fix this by implementing a software both-edge mode that toggles the edge type after every interrupt. Fixes: b868db94a6a7 ("gpio: tqmx86: Add GPIO from for this IO controller") Co-developed-by: Gregor Herburger <gregor.herburger@tq-group.com> Signed-off-by: Gregor Herburger <gregor.herburger@tq-group.com> Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com> Link: https://lore.kernel.org/r/515324f0491c4d44f4ef49f170354aca002d81ef.1717063994.git.matthias.schiffer@ew.tq-group.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* gpio: tqmx86: store IRQ trigger type and unmask status separatelyMatthias Schiffer2024-06-031-20/+28
| | | | | | | | | | | | | | irq_set_type() should not implicitly unmask the IRQ. All accesses to the interrupt configuration register are moved to a new helper tqmx86_gpio_irq_config(). We also introduce the new rule that accessing irq_type must happen while locked, which will become significant for fixing EDGE_BOTH handling. Fixes: b868db94a6a7 ("gpio: tqmx86: Add GPIO from for this IO controller") Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com> Link: https://lore.kernel.org/r/6aa4f207f77cb58ef64ffb947e91949b0f753ccd.1717063994.git.matthias.schiffer@ew.tq-group.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* gpio: tqmx86: introduce shadow register for GPIO output valueMatthias Schiffer2024-06-031-7/+11
| | | | | | | | | | | | | | | | | | | | | | | The TQMx86 GPIO controller uses the same register address for input and output data. Reading the register will always return current inputs rather than the previously set outputs (regardless of the current direction setting). Therefore, using a RMW pattern does not make sense when setting output values. Instead, the previously set output register value needs to be stored as a shadow register. As there is no reliable way to get the current output values from the hardware, also initialize all channels to 0, to ensure that stored and actual output values match. This should usually not have any effect in practise, as the TQMx86 UEFI sets all outputs to 0 during boot. Also prepare for extension of the driver to more than 8 GPIOs by using DECLARE_BITMAP. Fixes: b868db94a6a7 ("gpio: tqmx86: Add GPIO from for this IO controller") Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://lore.kernel.org/r/d0555933becd45fa92a85675d26e4d59343ddc01.1717063994.git.matthias.schiffer@ew.tq-group.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* gpio: tqmx86: fix typo in Kconfig labelGregor Herburger2024-06-031-1/+1
| | | | | | | | | | | Fix description for GPIO_TQMX86 from QTMX86 to TQMx86. Fixes: b868db94a6a7 ("gpio: tqmx86: Add GPIO from for this IO controller") Signed-off-by: Gregor Herburger <gregor.herburger@tq-group.com> Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://lore.kernel.org/r/e0e38c9944ad6d281d9a662a45d289b88edc808e.1717063994.git.matthias.schiffer@ew.tq-group.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhostLinus Torvalds2024-05-231-1/+0
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull virtio updates from Michael Tsirkin: "Several new features here: - virtio-net is finally supported in vduse - virtio (balloon and mem) interaction with suspend is improved - vhost-scsi now handles signals better/faster And fixes, cleanups all over the place" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (48 commits) virtio-pci: Check if is_avq is NULL virtio: delete vq in vp_find_vqs_msix() when request_irq() fails MAINTAINERS: add Eugenio Pérez as reviewer vhost-vdpa: Remove usage of the deprecated ida_simple_xx() API vp_vdpa: don't allocate unused msix vectors sound: virtio: drop owner assignment fuse: virtio: drop owner assignment scsi: virtio: drop owner assignment rpmsg: virtio: drop owner assignment nvdimm: virtio_pmem: drop owner assignment wifi: mac80211_hwsim: drop owner assignment vsock/virtio: drop owner assignment net: 9p: virtio: drop owner assignment net: virtio: drop owner assignment net: caif: virtio: drop owner assignment misc: nsm: drop owner assignment iommu: virtio: drop owner assignment drm/virtio: drop owner assignment gpio: virtio: drop owner assignment firmware: arm_scmi: virtio: drop owner assignment ...
| * gpio: virtio: drop owner assignmentKrzysztof Kozlowski2024-05-221-1/+0
| | | | | | | | | | | | | | | | | | | | | | virtio core already sets the .owner, so driver does not need to. Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Message-Id: <20240331-module-owner-virtio-v2-12-98f04bfaf46a@linaro.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Linus Walleij <linus.walleij@linaro.org>
* | gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node matchDevyn Liu2024-05-211-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previous patch modified the standard used by acpi_gpiochip_find() to match device nodes. Using the device node set in gc->gpiodev->d- ev instead of gc->parent. However, there is a situation in gpio-dwapb where the GPIO device driver will set gc->fwnode for each port corresponding to a child node under a GPIO device, so gc->gpiodev->dev will be assigned the value of each child node in gpiochip_add_data(). gpio-dwapb.c: 128,31 static int dwapb_gpio_add_port(struct dwapb_gpio *gpio, struct dwapb_port_property *pp, unsigned int offs); port->gc.fwnode = pp->fwnode; 693,39 static int dwapb_gpio_probe; err = dwapb_gpio_add_port(gpio, &pdata->properties[i], i); When other drivers request GPIO pin resources through the GPIO device node provided by ACPI (corresponding to the parent node), the change of the matching object to gc->gpiodev->dev in acpi_gpiochip_find() only allows finding the value of each port (child node), resulting in a failed request. Reapply the condition of using gc->parent for match in acpi_gpio- chip_find() in the code can compatible with the problem of gpio-dwapb, and will not affect the two cases mentioned in the patch: 1. There is no setting for gc->fwnode. 2. The case that depends on using gc->fwnode for match. Fixes: 5062e4c14b75 ("gpiolib: acpi: use the fwnode in acpi_gpiochip_find()") Fixes: 067dbc1ea5ce ("gpiolib: acpi: Don't use GPIO chip fwnode in acpi_gpiochip_find()") Signed-off-by: Devyn Liu <liudingyuan@huawei.com> Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com> Tested-by: Benjamin Tissoires <bentiss@kernel.org> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
* | gpiolib: acpi: Move ACPI device NULL check to acpi_can_fallback_to_crs()Laura Nao2024-05-211-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Following the relocation of the function call outside of __acpi_find_gpio(), move the ACPI device NULL check to acpi_can_fallback_to_crs(). Signed-off-by: Laura Nao <laura.nao@collabora.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reported-by: kernelci.org bot <bot@kernelci.org> Closes: https://lore.kernel.org/all/20240426154208.81894-1-laura.nao@collabora.com/ Fixes: 49c02f6e901c ("gpiolib: acpi: Move acpi_can_fallback_to_crs() out of __acpi_find_gpio()") Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
* | Merge tag 'gpio-updates-for-v6.10-rc1' of ↵Linus Torvalds2024-05-1416-123/+528
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski "This was a quiet release cycle for the GPIO tree and so this pull-request is relatively small. We have one new driver, some minor improvements to the GPIO core code and across several drivers, some DT and documentation updates but in general nothing stands out or is controversial. All changes have spent time in next with no reported issues (or ones that were quickly fixed). GPIO core: - remove more unused legacy interfaces (after converting the last remaining users to better alternatives) - update kerneldocs - improve error handling and log messages in GPIO ACPI code - remove dead code (always true checks) from GPIOLIB New drivers: - add a driver for Intel Granite Rapids-D vGPIO Driver improvements: - use -ENOTSUPP consistently in gpio-regmap and gpio-pcie-idio-24 - provide an ID table for gpio-cros-ec to avoid a driver name fallback check - add support for gpio-ranges for GPIO drivers supporting multiple GPIO banks - switch to using dynamic GPIO base in gpio-brcmstb - fix irq handling in gpio-npcm-sgpio - switch to memory mapped IO accessors in gpio-sch DT bindings: - add support for gpio-ranges to gpio-brcmstb - add support for a new model and the gpio-line-names property to gpio-mpfs Documentation: - replace leading tabs with spaces in code blocks - fix typos" * tag 'gpio-updates-for-v6.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (30 commits) gpio: nuvoton: Fix sgpio irq handle error gpiolib: Discourage to use formatting strings in line names gpio: brcmstb: add support for gpio-ranges gpio: of: support gpio-ranges for multiple gpiochip devices dt-bindings: gpio: brcmstb: add gpio-ranges gpio: Add Intel Granite Rapids-D vGPIO driver gpio: brcmstb: Use dynamic GPIO base numbers gpiolib: acpi: Set label for IRQ only lines gpiolib: acpi: Add fwnode name to the GPIO interrupt label gpiolib: Get rid of never false gpio_is_valid() calls gpiolib: acpi: Pass con_id instead of property into acpi_dev_gpio_irq_get_by() gpiolib: acpi: Move acpi_can_fallback_to_crs() out of __acpi_find_gpio() gpiolib: acpi: Simplify error handling in __acpi_find_gpio() gpiolib: acpi: Extract __acpi_find_gpio() helper gpio: sch: Utilise temporary variable for struct device gpio: sch: Switch to memory mapped IO accessors gpio: regmap: Use -ENOTSUPP consistently gpio: pcie-idio-24: Use -ENOTSUPP consistently Documentation: gpio: Replace leading TABs by spaces in code blocks gpiolib: acpi: Check for errors first in acpi_find_gpio() ...
| * | gpio: nuvoton: Fix sgpio irq handle errorJim Liu2024-05-071-6/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The generic_handle_domain_irq() function calls irq_resolve_mapping(). Thus delete a duplicative irq_find_mapping() call so that a stack trace and an RCU stall will be avoided. Fixes: c4f8457d17ce ("gpio: nuvoton: Add Nuvoton NPCM sgpio driver") Signed-off-by: Jim Liu <JJLIU0@nuvoton.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/20240506064244.1645922-1-JJLIU0@nuvoton.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
| * | Merge tag 'intel-gpio-v6.10-1' of ↵Bartosz Golaszewski2024-05-078-45/+463
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel into gpio/for-next intel-gpio for v6.10-1 * New driver for vGPIO controller on Intel Granite Rapids-D * Update ACPI GPIO library to unify the IRQ code path * Better GPIO IRQ line labeling for ACPI * Switched Intel SCH driver to use "mapped" I/O accessors The following is an automated git shortlog grouped by driver: Add Intel Granite Rapids-D vGPIO driver: - Add Intel Granite Rapids-D vGPIO driver crystalcove: - Use -ENOTSUPP consistently gpiolib: - acpi: Set label for IRQ only lines - acpi: Add fwnode name to the GPIO interrupt label - acpi: Pass con_id instead of property into acpi_dev_gpio_irq_get_by() - acpi: Move acpi_can_fallback_to_crs() out of __acpi_find_gpio() - acpi: Simplify error handling in __acpi_find_gpio() - acpi: Extract __acpi_find_gpio() helper - acpi: Check for errors first in acpi_find_gpio() - acpi: Remove never true check in acpi_get_gpiod_by_index() sch: - Utilise temporary variable for struct device - Switch to memory mapped IO accessors wcove: - Use -ENOTSUPP consistently
| | * | gpio: Add Intel Granite Rapids-D vGPIO driverAapo Vienamo2024-04-253-0/+402
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This driver provides a basic GPIO driver for the Intel Granite Rapids-D virtual GPIOs. On SoCs with limited physical pins on the package, the physical pins controlled by this driver would be exposed on an external device such as a BMC or CPLD. The virtual GPIO registers are an interface to firmware, which communicates with the external device that implements the GPIO hardware functionality. Signed-off-by: Aapo Vienamo <aapo.vienamo@linux.intel.com> Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
| | * | gpiolib: acpi: Set label for IRQ only linesAndy Shevchenko2024-04-181-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When line locked as IRQ it has no label assigned. Assign the meaningful value to it. Ex. (for the PCA9355 and MAX3111e chips connected to the system): === Before === PCA953x: interrupt MAX3111e: interrupt === After === PCA953x: NIO1 GpioInt(0) MAX3111e: URT0 GpioInt(0) Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
| | * | gpiolib: acpi: Add fwnode name to the GPIO interrupt labelAndy Shevchenko2024-04-181-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's ambiguous to have a device-related index in the GPIO interrupt label as most of the devices will have it the same or very similar. Extend label with fwnode name for better granularity. It significantly reduces the scope of searching among devices. Ex. (for the PCA9355 and MAX3111e chips connected to the system): === Before === PCA953x: GpioInt() 0 MAX3111e: GpioInt() 0 === After === PCA953x: NIO1 GpioInt(0) MAX3111e: URT0 GpioInt(0) Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
| | * | gpiolib: acpi: Pass con_id instead of property into acpi_dev_gpio_irq_get_by()Andy Shevchenko2024-04-152-7/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pass the con_id instead of property so that callers won't repeat the GPIO suffixes to try. Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
| | * | gpiolib: acpi: Move acpi_can_fallback_to_crs() out of __acpi_find_gpio()Andy Shevchenko2024-04-151-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New coming user may need to check for _CRS fallback slightly differently. Move the current check out of the helper function to allow that user to use it. Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
| | * | gpiolib: acpi: Simplify error handling in __acpi_find_gpio()Andy Shevchenko2024-04-151-10/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that we don't perform anything on the GPIO descriptor, we may simplify the error path in newly introduced helper. Do it so. Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
| | * | gpiolib: acpi: Extract __acpi_find_gpio() helperAndy Shevchenko2024-04-151-9/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We want to reuse it later on in the code. In particular, it helps to clean up the users of acpi_dev_gpio_irq_wake_get_by(). Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
| | * | gpio: sch: Utilise temporary variable for struct deviceAndy Shevchenko2024-04-151-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We have a temporary variable to keep a pointer to struct device. Utilise it where it makes sense. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
| | * | gpio: sch: Switch to memory mapped IO accessorsAndy Shevchenko2024-04-151-10/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Convert driver to use memory mapped IO accessors. Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com> Acked-by: William Breathitt Gray <wbg@kernel.org> Acked-by: Linus Walleij <linus.walleij@linaro.org>
| | * | gpiolib: acpi: Check for errors first in acpi_find_gpio()Andy Shevchenko2024-04-111-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's better to parse the code when the usual pattern is being used, i.e. checking for error condition first. There is no functional or code generation change (tested in LLVM). Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
| | * | gpiolib: acpi: Remove never true check in acpi_get_gpiod_by_index()Andy Shevchenko2024-04-111-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The acpi_get_gpiod_by_index() never is called with adev being NULL. Remove the redundant check. Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
| * | | gpio: brcmstb: add support for gpio-rangesDoug Berger2024-04-261-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A pin controller device mapped with the gpio-ranges property will need implementations of the .request and .free members of the gpiochip. Signed-off-by: Doug Berger <opendmb@gmail.com> Tested-by: Phil Elwell <phil@raspberrypi.com> Acked-by: Florian Fainelli <florian.fainelli@broadcom.com> Link: https://lore.kernel.org/r/20240424185039.1707812-4-opendmb@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
| * | | gpio: of: support gpio-ranges for multiple gpiochip devicesDoug Berger2024-04-261-2/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some drivers (e.g. gpio-mt7621 and gpio-brcmstb) have multiple gpiochip banks within a single device. Unfortunately, the gpio-ranges property of the device node was being applied to every gpiochip of the device with device relative GPIO offset values rather than gpiochip relative GPIO offset values. This commit makes use of the gpio_chip offset value which can be non-zero for such devices to split the device node gpio-ranges property into GPIO offset ranges that can be applied to each of the relevant gpiochips of the device. Signed-off-by: Doug Berger <opendmb@gmail.com> Acked-by: Florian Fainelli <florian.fainelli@broadcom.com> Link: https://lore.kernel.org/r/20240424185039.1707812-3-opendmb@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
| * | | gpio: brcmstb: Use dynamic GPIO base numbersDoug Berger2024-04-241-11/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Forcing a gpiochip to have a fixed base number now leads to a warning message. Remove the need to do so by using the offset value of the gpiochip. Signed-off-by: Phil Elwell <phil@raspberrypi.com> Signed-off-by: Doug Berger <opendmb@gmail.com> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://lore.kernel.org/r/20240423184605.2094376-1-opendmb@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
| * | | gpiolib: Get rid of never false gpio_is_valid() callsAndy Shevchenko2024-04-174-17/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the cases when gpio_is_valid() is called with unsigned parameter the result is always true in the GPIO library code, hence the check for false won't ever be true. Get rid of such calls. While at it, move GPIO device base to be unsigned to clearly show it won't ever be negative. This requires a new definition for the maximum GPIO number in the system. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
| * | | gpio: regmap: Use -ENOTSUPP consistentlyAndy Shevchenko2024-04-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The GPIO library expects the drivers to return -ENOTSUPP in some cases and not using analogue POSIX code. Make the driver to follow this. Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com> Reviewed-by: Michael Walle <mwalle@kernel.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
| * | | gpio: pcie-idio-24: Use -ENOTSUPP consistentlyAndy Shevchenko2024-04-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The GPIO library expects the drivers to return -ENOTSUPP in some cases and not using analogue POSIX code. Make the driver to follow this. Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com> Acked-by: William Breathitt Gray <wbg@kernel.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
| * | | gpiolib: Do not mention legacy GPIOF_* in the codeAndy Shevchenko2024-04-031-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We are going to remove legacy API from kernel, don't mention it in the code that does not use it already for a while. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
| * | | gpiolib: legacy: Remove unused gpio_request_array() and gpio_free_array()Andy Shevchenko2024-04-031-39/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | No more users. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Yanteng Si <siyanteng@loongson.cn> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
| * | | gpio: cros-ec: provide ID table for avoiding fallback matchTzung-Bi Shih2024-04-021-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of using fallback driver name match, provide ID table[1] for the primary match. Also allow automatic module loading by adding MODULE_DEVICE_TABLE(). [1]: https://elixir.bootlin.com/linux/v6.8/source/drivers/base/platform.c#L1353 Reviewed-by: Benson Leung <bleung@chromium.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
| * | | gpiolib: use dev_err() when gpiod_configure_flags failedPeng Fan2024-04-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When gpio-ranges property was missed to be added in the gpio node, using dev_err() to show an error message will helping to locate issues easier. Signed-off-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* | | | Merge tag 'spi-v6.10' of ↵Linus Torvalds2024-05-142-0/+53
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "The diffstat for this release is dominated by the new Airoha driver, mainly as a result of this being a generally quite quiet release. There were a couple of cleanups in the core but nothing substantial, the updates here are almost all driver specific ones. - Support for multi-word mode in the OMAP2 McSPI driver - Overhaul of the PXA2xx driver, mostly API updates - A number of DT binding conversions - Support for Airoha NAND controllers, Cirrus Logic CS35L56, Mobileye EYEQ5 and Renesas R8A779H0" * tag 'spi-v6.10' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (87 commits) spi: dw: Bail out early on unsupported target mode spi: Remove unneded check for orig_nents MAINTAINERS: repair file entry in AIROHA SPI SNFI DRIVER spi: pxa2xx: Drop the stale entry in documentation TOC spi: pxa2xx: Don't provide struct chip_data for others spi: pxa2xx: Remove timeout field from struct chip_data spi: pxa2xx: Remove DMA parameters from struct chip_data spi: pxa2xx: Drop struct pxa2xx_spi_chip spi: pxa2xx: Don't use "proxy" headers spi: pxa2xx: Remove outdated documentation spi: pxa2xx: Move contents of linux/spi/pxa2xx_spi.h to a local one spi: pxa2xx: Provide num-cs for Sharp PDAs via device properties spi: pxa2xx: Allow number of chip select pins to be read from property spi: dt-bindings: ti,qspi: convert to dtschema spi: bitbang: Add missing MODULE_DESCRIPTION() spi: bitbang: Use NSEC_PER_*SEC rather than hard coding spi: dw: Drop default number of CS setting spi: dw: Convert dw_spi::num_cs to u32 spi: dw: Add a number of native CS auto-detection spi: dw: Convert to using BITS_TO_BYTES() macro ...
| * | | | gpio: swnode: Add ability to specify native chip selects for SPICharles Keepax2024-04-162-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SPI devices can specify a cs-gpios property to enumerate their chip selects. Under device tree, a zero entry in this property can be used to specify that a particular chip select is using the SPI controllers native chip select, for example: cs-gpios = <&gpio1 0 0>, <0>; Here, the second chip select is native. However, when using swnodes there is currently no way to specify a native chip select. The proposal here is to register a swnode_gpio_undefined software node, that can be specified to allow the indication of a native chip select. For example: static const struct software_node_ref_args device_cs_refs[] = { { .node = &device_gpiochip_swnode, .nargs = 2, .args = { 0, GPIO_ACTIVE_LOW }, }, { .node = &swnode_gpio_undefined, .nargs = 0, }, }; Register the swnode as the gpiolib is initialised and check in swnode_get_gpio_device() if the returned node matches swnode_gpio_undefined and return -ENOENT, which matches the behaviour of the device tree system when it encounters a 0 phandle. Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Andy Shevchenko <andy@kernel.org> Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://lore.kernel.org/r/20240416100904.3738093-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
* | | | | gpiolib: cdev: fix uninitialised kfifoKent Gibson2024-05-101-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a line is requested with debounce, and that results in debouncing in software, and the line is subsequently reconfigured to enable edge detection then the allocation of the kfifo to contain edge events is overlooked. This results in events being written to and read from an uninitialised kfifo. Read events are returned to userspace. Initialise the kfifo in the case where the software debounce is already active. Fixes: 65cff7046406 ("gpiolib: cdev: support setting debounce") Signed-off-by: Kent Gibson <warthog618@gmail.com> Link: https://lore.kernel.org/r/20240510065342.36191-1-warthog618@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
* | | | | gpiolib: cdev: Fix use after free in lineinfo_changed_notifyZhongqiu Han2024-05-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The use-after-free issue occurs as follows: when the GPIO chip device file is being closed by invoking gpio_chrdev_release(), watched_lines is freed by bitmap_free(), but the unregistration of lineinfo_changed_nb notifier chain failed due to waiting write rwsem. Additionally, one of the GPIO chip's lines is also in the release process and holds the notifier chain's read rwsem. Consequently, a race condition leads to the use-after-free of watched_lines. Here is the typical stack when issue happened: [free] gpio_chrdev_release() --> bitmap_free(cdev->watched_lines) <-- freed --> blocking_notifier_chain_unregister() --> down_write(&nh->rwsem) <-- waiting rwsem --> __down_write_common() --> rwsem_down_write_slowpath() --> schedule_preempt_disabled() --> schedule() [use] st54spi_gpio_dev_release() --> gpio_free() --> gpiod_free() --> gpiod_free_commit() --> gpiod_line_state_notify() --> blocking_notifier_call_chain() --> down_read(&nh->rwsem); <-- held rwsem --> notifier_call_chain() --> lineinfo_changed_notify() --> test_bit(xxxx, cdev->watched_lines) <-- use after free The side effect of the use-after-free issue is that a GPIO line event is being generated for userspace where it shouldn't. However, since the chrdev is being closed, userspace won't have the chance to read that event anyway. To fix the issue, call the bitmap_free() function after the unregistration of lineinfo_changed_nb notifier chain. Fixes: 51c1064e82e7 ("gpiolib: add new ioctl() for monitoring changes in line info") Signed-off-by: Zhongqiu Han <quic_zhonhan@quicinc.com> Link: https://lore.kernel.org/r/20240505141156.2944912-1-quic_zhonhan@quicinc.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
generated by cgit v1.2.3 (git 2.25.1) at 2025-03-20 14:08:54 +0000