linux.git/drivers/input, branch v4.14-rc4

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2017-09-23T03:23:41+00:00

Pull input fixes from Dmitry Torokhov:

 - fixes for two long standing issues (lock up and a crash) in force
   feedback handling in uinput driver

 - tweak to firmware update timing in Elan I2C touchpad driver.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: elan_i2c - extend Flash-Write delay
  Input: uinput - avoid crash when sending FF request to device going away
  Input: uinput - avoid FF flush when destroying device

Input: elan_i2c - extend Flash-Write delay

2017-09-22T17:07:38+00:00

The original 20ms delay is only marginally enough delay after a block write
operation during firmware update. Let's increase the delay to ensure that
the controller finishes up storing the page to avoid failures in the
firmware updates.

Signed-off-by: KT Liao 
Signed-off-by: Dmitry Torokhov

Input: uinput - avoid crash when sending FF request to device going away

2017-09-21T23:31:23+00:00

If FF request comes in while uinput device is going away,
uinput_request_send() will fail with -ENODEV, and uinput_request_submit()
will attempt to mark the slot as unused by calling uinput_request_done().
Unfortunately in this case we haven't initialized request->done completion
yet, and we get a crash:

[   39.402036] BUG: spinlock bad magic on CPU#1, fftest/3108
[   39.402046]  lock: 0xffff88006a93bb00, .magic: 00000000, .owner: /39, .owner_cpu: 1217155072
[   39.402055] CPU: 1 PID: 3108 Comm: fftest Tainted: G        W 4.13.0+ #15
[   39.402059] Hardware name: LENOVO 20HQS0EG02/20HQS0EG02, BIOS N1MET37W (1.22 ) 07/04/2017
[   39.402064]  0000000000000086 f0fad82f3ceaa120 ffff88006a93b9a0 ffffffff9de941bb
[   39.402077]  ffff88026df8ae00 ffff88006a93bb00 ffff88006a93b9c0 ffffffff9dca62b7
[   39.402088]  ffff88006a93bb00 ffff88006a93baf8 ffff88006a93b9e0 ffffffff9dca62e7
[   39.402099] Call Trace:
[   39.402112]  [] dump_stack+0x4d/0x63
[   39.402123]  [] spin_dump+0x97/0x9c
[   39.402130]  [] spin_bug+0x2b/0x2d
[   39.402138]  [] do_raw_spin_lock+0x28/0xfd
[   39.402147]  [] _raw_spin_lock_irqsave+0x19/0x1f
[   39.402154]  [] complete+0x1d/0x48
[   39.402162]  [] 0xffffffffc04f30af
[   39.402167]  [] 0xffffffffc04f468c
[   39.402177]  [] ? __slab_free+0x22f/0x359
[   39.402184]  [] ? tk_clock_read+0xc/0xe
[   39.402189]  [] 0xffffffffc04f471f
[   39.402195]  [] ? __wake_up+0x44/0x4b
[   39.402200]  [] ? 0xffffffffc04f3240
[   39.402207]  [] erase_effect+0xa1/0xd2
[   39.402214]  [] input_ff_flush+0x43/0x5c
[   39.402219]  [] 0xffffffffc04f32ad
[   39.402227]  [] input_flush_device+0x3d/0x51
[   39.402234]  [] evdev_flush+0x49/0x5c
[   39.402243]  [] filp_close+0x3f/0x65
[   39.402253]  [] put_files_struct+0x66/0xc1
[   39.402261]  [] exit_files+0x47/0x4e
[   39.402270]  [] do_exit+0x483/0x969
[   39.402278]  [] ? recalc_sigpending_tsk+0x3d/0x44
[   39.402285]  [] do_group_exit+0x42/0xb0
[   39.402293]  [] get_signal+0x58d/0x5bf
[   39.402300]  [] do_signal+0x37/0x53e
[   39.402307]  [] ? evdev_ioctl_handler+0xac8/0xb04
[   39.402314]  [] ? evdev_ioctl+0x10/0x12
[   39.402321]  [] ? do_vfs_ioctl+0x42e/0x501
[   39.402328]  [] prepare_exit_to_usermode+0x66/0x90
[   39.402333]  [] syscall_return_slowpath+0xe3/0xec
[   39.402339]  [] int_ret_from_sys_call+0x25/0x8f

While we could solve this by simply initializing the completion earlier, we
are better off rearranging the code a bit so we avoid calling complete() on
requests that we did not send out. This patch consolidates marking request
slots as free in one place (in uinput_request_submit(), the same place
where we acquire them) and having everyone else simply signal completion
of the requests.

Fixes: 00ce756ce53a ("Input: uinput - mark failed submission requests as free")
Signed-off-by: Dmitry Torokhov

Input: uinput - avoid FF flush when destroying device

2017-09-21T23:31:22+00:00

Normally, when input device supporting force feedback effects is being
destroyed, we try to "flush" currently playing effects, so that the
physical device does not continue vibrating (or executing other effects).
Unfortunately this does not work well for uinput as flushing of the effects
deadlocks with the destroy action:

- if device is being destroyed because the file descriptor is being closed,
  then there is noone to even service FF requests;

- if device is being destroyed because userspace sent UI_DEV_DESTROY,
  while theoretically it could be possible to service FF requests,
  userspace is unlikely to do so (they'd need to make sure FF handling
  happens on a separate thread) even if kernel solves the issue with FF
  ioctls deadlocking with UI_DEV_DESTROY ioctl on udev->mutex.

To avoid lockups like the one below, let's install a custom input device
flush handler, and avoid trying to flush force feedback effects when we
destroying the device, and instead rely on uinput to shut off the device
properly.

NMI watchdog: Watchdog detected hard LOCKUP on cpu 3
...
 <>  [] _raw_spin_lock_irqsave+0x37/0x40
 [] complete+0x1d/0x50
 [] uinput_request_done+0x3c/0x40 [uinput]
 [] uinput_request_submit.part.7+0x47/0xb0 [uinput]
 [] uinput_dev_erase_effect+0x5b/0x76 [uinput]
 [] erase_effect+0xad/0xf0
 [] flush_effects+0x4d/0x90
 [] input_flush_device+0x40/0x60
 [] evdev_cleanup+0xac/0xc0
 [] evdev_disconnect+0x2b/0x60
 [] __input_unregister_device+0xac/0x150
 [] input_unregister_device+0x47/0x70
 [] uinput_destroy_device+0xb5/0xc0 [uinput]
 [] uinput_ioctl_handler.isra.9+0x65e/0x740 [uinput]
 [] ? do_futex+0x12b/0xad0
 [] uinput_ioctl+0x18/0x20 [uinput]
 [] do_vfs_ioctl+0x298/0x480
 [] ? security_file_ioctl+0x43/0x60
 [] SyS_ioctl+0x79/0x90
 [] entry_SYSCALL_64_fastpath+0x12/0x71

Reported-by: Rodrigo Rivas Costa 
Reported-by: Clément VUCHENER 
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=193741
Signed-off-by: Dmitry Torokhov

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2017-09-16T18:24:26+00:00

Pull more input updates from Dmitry Torokhov:
 "A second round of updates for the input subsystem:

   - a new driver for PWM-controlled vibrators

   - ucb1400 touchscreen driver had completely busted suspend/resume
     handling

   - we now handle "home" button found on some devices with Goodix
     touchscreens

   - assorted other fixups"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: i8042 - add Gigabyte P57 to the keyboard reset table
  Input: xpad - validate USB endpoint type during probe
  Input: ucb1400_ts - fix suspend and resume handling
  Input: edt-ft5x06 - fix access to non-existing register
  Input: elantech - make arrays debounce_packet static, reduces object code size
  Input: surface3_spi - make const array header static, reduces object code size
  Input: goodix - add support for capacitive home button
  Input: add a driver for PWM controllable vibrators
  Input: adi - make array seq static, reduces object code size

Merge branch 'next' into for-linus

2017-09-15T16:52:21+00:00

Prepare second round of input updates for 4.14 merge window.

Input: i8042 - add Gigabyte P57 to the keyboard reset table

2017-09-15T16:51:22+00:00

Similar to other Gigabyte laptops, the touchpad on P57 requires a
keyboard reset to detect Elantech touchpad correctly.

BugLink: https://bugs.launchpad.net/bugs/1594214
Signed-off-by: Kai-Heng Feng 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov

dmi: Mark all struct dmi_system_id instances const

2017-09-14T09:59:30+00:00

... and __initconst if applicable.

Based on similar work for an older kernel in the Grsecurity patch.

[JD: fix toshiba-wmi build]
[JD: add htcpen]
[JD: move __initconst where checkscript wants it]

Signed-off-by: Christoph Hellwig 
Signed-off-by: Jean Delvare

Input: xpad - validate USB endpoint type during probe

2017-09-12T18:45:59+00:00

We should only see devices with interrupt endpoints. Ignore any other
endpoints that we find, so we don't send try to send them interrupt URBs
and trigger a WARN down in the USB stack.

Reported-by: Andrey Konovalov 
Tested-by: Andrey Konovalov 
Cc:  # c01b5e7464f0 Input: xpad - don't depend on endpoint order
Signed-off-by: Cameron Gutman 
Signed-off-by: Dmitry Torokhov

Input: ucb1400_ts - fix suspend and resume handling

2017-09-11T21:23:56+00:00

Instead of stopping the touchscreen we were starting it in suspend, and
disabling it in resume.

Fixes: c899afedf168 ("Input: ucb1400_ts - convert to threaded IRQ")
Reported-by: Anton Volkov 
Signed-off-by: Dmitry Torokhov