27QHD has the same x_min/y_min (WACOM_CINTIQ_OFFSET) as other Cintiqs.

ABS_MISC event is required for PAD packet to work properly with
xf86-input-wacom.

Signed-off-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

kobject_init_and_add() takes expects format string for a name, so we
better provide it in order to avoid infoleaks if modules craft their
mod->name in a special way.

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reported-by: Kees Cook <keescook@chromium.org>
Acked-by: Seth Jennings <sjenning@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

The Microsoft HID over I2C specification says two things regarding the
interrupt:

 1) The interrupt should be level sensitive
 2) The device keeps the interrupt asserted as long as it has more reports
    available.

We've seen that at least some Atmel and N-Trig panels keep the line low as
long as they have something to send. The current version of the driver only
detects the first edge but then fails to read rest of the reports (as the
line is still asserted).

Make the driver follow the specification and configure the HID interrupt to
be level sensitive.

The Windows HID over I2C driver also seems to do the same.

Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Signed-off-by: Darren Salt <devspam@moreofthesa.me.uk>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

During changes to the interface, some documentation field comments
were missed. Added missing comments.

Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Commit 0ccf091 ("HID: sensor-hub:
make dyn_callback_lock IRQ-safe) was supposed to change locks
in sensor_hub_get_callback(), but missed.

Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

ida_destroy() must be called _after_ all the devices have been
unregistered; otherwise, when calling "rmmod hid_sony" with devices
still plugged in, the following warning would show up because of calls
to ida_simple_remove() on a destroyed ID allocator:

------------[ cut here ]------------
WARNING: CPU: 0 PID: 5509 at lib/idr.c:1052 ida_simple_remove+0x26/0x50()
ida_remove called for id=0 which is not allocated.
Modules linked in: ...
CPU: 0 PID: 5509 Comm: rmmod Not tainted 3.19.0-rc6-ao2 #35
Hardware name: System manufacturer System Product Name/M2N-MX SE, BIOS 0501    03/20/2008
 0000000000000000 ffffffff8176320d ffffffff815b3a88 ffff880036f7fdd8
 ffffffff8106ce01 0000000000000000 ffffffffa07658e0 0000000000000246
 ffff88005077d8b8 ffff88005077d8d0 ffffffff8106ce7a ffffffff81763260
Call Trace:
 [<ffffffff815b3a88>] ? dump_stack+0x40/0x50
 [<ffffffff8106ce01>] ? warn_slowpath_common+0x81/0xb0
 [<ffffffff8106ce7a>] ? warn_slowpath_fmt+0x4a/0x50
 [<ffffffff812ccb86>] ? ida_simple_remove+0x26/0x50
 [<ffffffffa0762dc8>] ? sony_remove+0x58/0xe0 [hid_sony]
 [<ffffffffa00fff15>] ? hid_device_remove+0x65/0xd0 [hid]
 [<ffffffff8140425e>] ? __device_release_driver+0x7e/0x100
 [<ffffffff81404c70>] ? driver_detach+0xa0/0xb0
 [<ffffffff81403ee5>] ? bus_remove_driver+0x55/0xe0
 [<ffffffffa01000ff>] ? hid_unregister_driver+0x2f/0xa0 [hid]
 [<ffffffff810e45bf>] ? SyS_delete_module+0x1bf/0x270
 [<ffffffff81014089>] ? do_notify_resume+0x69/0xa0
 [<ffffffff815b952d>] ? system_call_fastpath+0x16/0x1b
---[ end trace bc794b3d22c30ede ]---

Signed-off-by: Antonio Ospite <ao2@ao2.it>
Acked-by: Frank Praznik <frank.praznik@oh.rr.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Reported-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

We now add about 10k, not 6k, when lguest support is compiled in.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

…ftrace_handler()

func->new_func has been accessed after rcu_read_unlock() in klp_ftrace_handler()
and therefore the access was not protected.

Signed-off-by: Petr Mladek <pmladek@suse.cz>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

sony_dev_list_lock spinlock (which was introduced in d2d782f ("HID: sony:
Prevent duplicate controller connections") is not being initialized properly.
Fix that.

Reported-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Per-controller spinlock needs to be properly initialized during device probe.

[jkosina@suse.cz: massage changelog]
[jkosina@suse.cz: drop hunk that has already been applied by previous
 patch]
Signed-off-by: Frank Praznik <frank.praznik@oh.rr.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

d1c7e29 (HID: i2c-hid: prevent buffer overflow in early IRQ)
changed hid_get_input() to read ihid->bufsize bytes, which can be
more than wMaxInputLength. This is the case with the Dell XPS 13
9343, and it is causing events to be missed. In some cases the
missed events are releases, which can cause the cursor to jump or
freeze, among other problems. Limit the number of bytes read to
min(wMaxInputLength, ihid->bufsize) to prevent such problems.

Fixes: d1c7e29 "HID: i2c-hid: prevent buffer overflow in early IRQ"
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Microsoft Natural Wireless Ergonomic Keyboard 7000 has special My
Favorites 1..5 keys which are handled through a vendor-defined usage
page (0xff05).

Apply MS_ERGONOMY quirks handling to USB PID 0x071d (Microsoft Microsoft
2.4GHz Transceiver V1.0) so that the My Favorites 1..5 keys are reported
as KEY_F14..18 events.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=52841
Signed-off-by: Jakub Sitnicki <jsitnicki@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Commit d524165 ("x86/apic: Check x2apic early") tests X2APIC_ENABLE
bit of MSR_IA32_APICBASE when CONFIG_X86_X2APIC is off and panics
the kernel when this bit is set.

Xen's PV guests will pass this MSR read to the hypervisor which will
return its version of the MSR, where this bit might be set. Make sure
we clear it before returning MSR value to the caller.

Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

Hypercalls submitted by user space tools via the privcmd driver can
take a long time (potentially many 10s of seconds) if the hypercall
has many sub-operations.

A fully preemptible kernel may deschedule such as task in any upcall
called from a hypercall continuation.

However, in a kernel with voluntary or no preemption, hypercall
continuations in Xen allow event handlers to be run but the task
issuing the hypercall will not be descheduled until the hypercall is
complete and the ioctl returns to user space.  These long running
tasks may also trigger the kernel's soft lockup detection.

Add xen_preemptible_hcall_begin() and xen_preemptible_hcall_end() to
bracket hypercalls that may be preempted.  Use these in the privcmd
driver.

When returning from an upcall, call xen_maybe_preempt_hcall() which
adds a schedule point if if the current task was within a preemptible
hypercall.

Since _cond_resched() can move the task to a different CPU, clear and
set xen_in_preemptible_hcall around the call.

Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>

A request in the ring buffer mustn't be read after it has been marked
as consumed. Otherwise it might already have been reused by the
frontend without violating the ring protocol.

To avoid inconsistencies in the backend only work on a private copy
of the request. This will ensure a malicious guest not being able to
bypass consistency checks of the backend by modifying an active
request.

Signed-off-by: Juergen Gross <jgross@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

Commit 1e02ce4 ("x86: Store a per-cpu shadow copy of CR4")
introduced CR4 shadows.

These shadows are initialized in early boot code. The commit missed
initialization for 64-bit PV(H) guests that this patch adds.

Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

…/git/jikos/hid

Pull HID fixes from Jiri Kosina:

 - a few fixes to Sony driver (rmmod breakage, spinlock initialization),
   by Antonio Ospite, Frank Praznik and Jiri Kosina

 - fix for wMaxInputLength handling regression in i2c-hid, by Seth
   Forshee

 - IRQ safety spinlock fix in sensor hub driver, by Srinivas Pandruvada

 - IRQ level sensitivity fix to i2c-hid to be compliant with the spec,
   by Mika Westerberg

 - a couple device ID additions piggy-backing on top of that

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: microsoft: Add ID for NE7K wireless keyboard
  HID: i2c-hid: Limit reads to wMaxInputLength bytes for input events
  HID: sony: fix uninitialized per-controller spinlock
  HID: sony: initialize sony_dev_list_lock properly
  HID: sony: Fix a WARNING shown when rmmod-ing the driver
  HID: sensor-hub: correct dyn_callback_lock IRQ-safe change
  HID: hid-sensor-hub: Correct documentation
  HID: saitek: add USB ID for older R.A.T. 7
  HID: i2c-hid: The interrupt should be level sensitive
  HID: wacom: Add missing ABS_MISC event and feature declaration for 27QHD

…/git/jikos/livepatching

Pull livepatching fixes from Jiri Kosina:
 "Two tiny fixes for livepatching infrastructure:

   - extending RCU critical section to cover all accessess to
     RCU-protected variable, by Petr Mladek

   - proper format string passing to kobject_init_and_add(), by Jiri
     Kosina"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching:
  livepatch: RCU protect struct klp_func all the time when used in klp_ftrace_handler()
  livepatch: fix format string in kobject_init_and_add()

…nel/git/rusty/linux

Pull lguest fixes from Rusty Russell:
 "Lguest weird config build fix, and update to the documentation"

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
  lguest: update help text.
  lguest: now depends on PCI

…scm/linux/kernel/git/xen/tip

Pull xen bugfixes from David Vrabel:
 "Xen regression and bug fixes for 4.0-rc1

   - Fix two regressions introduced in 4.0-rc1 affecting PV/PVH guests
     in certain configurations.

   - Prevent pvscsi frontends bypassing backend checks.

   - Allow privcmd hypercalls to be preempted even on kernel with
     voluntary preemption.  This fixes soft-lockups with long running
     toolstack hypercalls (e.g., when creating/destroying large
     domains)"

* tag 'stable/for-linus-4.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  x86/xen: Initialize cr4 shadow for 64-bit PV(H) guests
  xen-scsiback: mark pvscsi frontend request consumed only after last read
  x86/xen: allow privcmd hypercalls to be preempted
  x86/xen: Make sure X2APIC_ENABLE bit of MSR_IA32_APICBASE is not set