Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'char-misc-5.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc driver fixes from Greg KH:
"Here are some small char/misc driver fixes for 5.4-rc3.
Nothing huge here. Some binder driver fixes (although it is still
being discussed if these all fix the reported issues or not, so more
might be coming later), some mei device ids and fixes, and a google
firmware driver bugfix that fixes a regression, as well as some other
tiny fixes.
All have been in linux-next with no reported issues"
* tag 'char-misc-5.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
firmware: google: increment VPD key_len properly
w1: ds250x: Fix build error without CRC16
virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr
binder: Fix comment headers on binder_alloc_prepare_to_free()
binder: prevent UAF read in print_binder_transaction_log_entry()
misc: fastrpc: prevent memory leak in fastrpc_dma_buf_attach
mei: avoid FW version request on Ibex Peak and earlier
mei: me: add comet point (lake) LP device ids
+60
-18
+3
-1
drivers/android/binder.c
+3
-1
drivers/android/binder.c
···
57
57
#include <linux/sched/signal.h>
58
58
#include <linux/sched/mm.h>
59
59
#include <linux/seq_file.h>
60
+
#include <linux/string.h>
60
61
#include <linux/uaccess.h>
61
62
#include <linux/pid_namespace.h>
62
63
#include <linux/security.h>
···
67
66
#include <linux/task_work.h>
68
67
69
68
#include <uapi/linux/android/binder.h>
69
+
#include <uapi/linux/android/binderfs.h>
70
70
71
71
#include <asm/cacheflush.h>
72
72
···
2878
2876
e->target_handle = tr->target.handle;
2879
2877
e->data_size = tr->data_size;
2880
2878
e->offsets_size = tr->offsets_size;
2881
-
e->context_name = proc->context->name;
2879
+
strscpy(e->context_name, proc->context->name, BINDERFS_MAX_NAME);
2882
2880
2883
2881
if (reply) {
2884
2882
binder_inner_proc_lock(proc);
+1
-1
drivers/android/binder_alloc.c
+1
-1
drivers/android/binder_alloc.c
+1
-1
drivers/android/binder_internal.h
+1
-1
drivers/android/binder_internal.h
+1
-1
drivers/firmware/google/vpd_decode.c
+1
-1
drivers/firmware/google/vpd_decode.c
+1
drivers/misc/fastrpc.c
+1
drivers/misc/fastrpc.c
+11
-3
drivers/misc/mei/bus-fixup.c
+11
-3
drivers/misc/mei/bus-fixup.c
···
218
218
{
219
219
int ret;
220
220
221
+
/* No need to enable the client if nothing is needed from it */
222
+
if (!cldev->bus->fw_f_fw_ver_supported &&
223
+
!cldev->bus->hbm_f_os_supported)
224
+
return;
225
+
221
226
ret = mei_cldev_enable(cldev);
222
227
if (ret)
223
228
return;
224
229
225
-
ret = mei_fwver(cldev);
226
-
if (ret < 0)
227
-
dev_err(&cldev->dev, "FW version command failed %d\n", ret);
230
+
if (cldev->bus->fw_f_fw_ver_supported) {
231
+
ret = mei_fwver(cldev);
232
+
if (ret < 0)
233
+
dev_err(&cldev->dev, "FW version command failed %d\n",
234
+
ret);
235
+
}
228
236
229
237
if (cldev->bus->hbm_f_os_supported) {
230
238
ret = mei_osver(cldev);
+3
drivers/misc/mei/hw-me-regs.h
+3
drivers/misc/mei/hw-me-regs.h
···
79
79
#define MEI_DEV_ID_CNP_H 0xA360 /* Cannon Point H */
80
80
#define MEI_DEV_ID_CNP_H_4 0xA364 /* Cannon Point H 4 (iTouch) */
81
81
82
+
#define MEI_DEV_ID_CMP_LP 0x02e0 /* Comet Point LP */
83
+
#define MEI_DEV_ID_CMP_LP_3 0x02e4 /* Comet Point LP 3 (iTouch) */
84
+
82
85
#define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */
83
86
84
87
#define MEI_DEV_ID_TGP_LP 0xA0E0 /* Tiger Lake Point LP */
+18
-3
drivers/misc/mei/hw-me.c
+18
-3
drivers/misc/mei/hw-me.c
···
1355
1355
#define MEI_CFG_FW_SPS \
1356
1356
.quirk_probe = mei_me_fw_type_sps
1357
1357
1358
+
#define MEI_CFG_FW_VER_SUPP \
1359
+
.fw_ver_supported = 1
1358
1360
1359
1361
#define MEI_CFG_ICH_HFS \
1360
1362
.fw_status.count = 0
···
1394
1392
MEI_CFG_ICH10_HFS,
1395
1393
};
1396
1394
1397
-
/* PCH devices */
1398
-
static const struct mei_cfg mei_me_pch_cfg = {
1395
+
/* PCH6 devices */
1396
+
static const struct mei_cfg mei_me_pch6_cfg = {
1399
1397
MEI_CFG_PCH_HFS,
1398
+
};
1399
+
1400
+
/* PCH7 devices */
1401
+
static const struct mei_cfg mei_me_pch7_cfg = {
1402
+
MEI_CFG_PCH_HFS,
1403
+
MEI_CFG_FW_VER_SUPP,
1400
1404
};
1401
1405
1402
1406
/* PCH Cougar Point and Patsburg with quirk for Node Manager exclusion */
1403
1407
static const struct mei_cfg mei_me_pch_cpt_pbg_cfg = {
1404
1408
MEI_CFG_PCH_HFS,
1409
+
MEI_CFG_FW_VER_SUPP,
1405
1410
MEI_CFG_FW_NM,
1406
1411
};
1407
1412
1408
1413
/* PCH8 Lynx Point and newer devices */
1409
1414
static const struct mei_cfg mei_me_pch8_cfg = {
1410
1415
MEI_CFG_PCH8_HFS,
1416
+
MEI_CFG_FW_VER_SUPP,
1411
1417
};
1412
1418
1413
1419
/* PCH8 Lynx Point with quirk for SPS Firmware exclusion */
1414
1420
static const struct mei_cfg mei_me_pch8_sps_cfg = {
1415
1421
MEI_CFG_PCH8_HFS,
1422
+
MEI_CFG_FW_VER_SUPP,
1416
1423
MEI_CFG_FW_SPS,
1417
1424
};
1418
1425
1419
1426
/* Cannon Lake and newer devices */
1420
1427
static const struct mei_cfg mei_me_pch12_cfg = {
1421
1428
MEI_CFG_PCH8_HFS,
1429
+
MEI_CFG_FW_VER_SUPP,
1422
1430
MEI_CFG_DMA_128,
1423
1431
};
1424
1432
···
1440
1428
[MEI_ME_UNDEF_CFG] = NULL,
1441
1429
[MEI_ME_ICH_CFG] = &mei_me_ich_cfg,
1442
1430
[MEI_ME_ICH10_CFG] = &mei_me_ich10_cfg,
1443
-
[MEI_ME_PCH_CFG] = &mei_me_pch_cfg,
1431
+
[MEI_ME_PCH6_CFG] = &mei_me_pch6_cfg,
1432
+
[MEI_ME_PCH7_CFG] = &mei_me_pch7_cfg,
1444
1433
[MEI_ME_PCH_CPT_PBG_CFG] = &mei_me_pch_cpt_pbg_cfg,
1445
1434
[MEI_ME_PCH8_CFG] = &mei_me_pch8_cfg,
1446
1435
[MEI_ME_PCH8_SPS_CFG] = &mei_me_pch8_sps_cfg,
···
1485
1472
1486
1473
mei_device_init(dev, &pdev->dev, &mei_me_hw_ops);
1487
1474
hw->cfg = cfg;
1475
+
1476
+
dev->fw_f_fw_ver_supported = cfg->fw_ver_supported;
1488
1477
1489
1478
return dev;
1490
1479
}
+6
-2
drivers/misc/mei/hw-me.h
+6
-2
drivers/misc/mei/hw-me.h
···
20
20
* @fw_status: FW status
21
21
* @quirk_probe: device exclusion quirk
22
22
* @dma_size: device DMA buffers size
23
+
* @fw_ver_supported: is fw version retrievable from FW
23
24
*/
24
25
struct mei_cfg {
25
26
const struct mei_fw_status fw_status;
26
27
bool (*quirk_probe)(struct pci_dev *pdev);
27
28
size_t dma_size[DMA_DSCR_NUM];
29
+
u32 fw_ver_supported:1;
28
30
};
29
31
30
32
···
64
62
* @MEI_ME_UNDEF_CFG: Lower sentinel.
65
63
* @MEI_ME_ICH_CFG: I/O Controller Hub legacy devices.
66
64
* @MEI_ME_ICH10_CFG: I/O Controller Hub platforms Gen10
67
-
* @MEI_ME_PCH_CFG: Platform Controller Hub platforms (Up to Gen8).
65
+
* @MEI_ME_PCH6_CFG: Platform Controller Hub platforms (Gen6).
66
+
* @MEI_ME_PCH7_CFG: Platform Controller Hub platforms (Gen7).
68
67
* @MEI_ME_PCH_CPT_PBG_CFG:Platform Controller Hub workstations
69
68
* with quirk for Node Manager exclusion.
70
69
* @MEI_ME_PCH8_CFG: Platform Controller Hub Gen8 and newer
···
80
77
MEI_ME_UNDEF_CFG,
81
78
MEI_ME_ICH_CFG,
82
79
MEI_ME_ICH10_CFG,
83
-
MEI_ME_PCH_CFG,
80
+
MEI_ME_PCH6_CFG,
81
+
MEI_ME_PCH7_CFG,
84
82
MEI_ME_PCH_CPT_PBG_CFG,
85
83
MEI_ME_PCH8_CFG,
86
84
MEI_ME_PCH8_SPS_CFG,
+4
drivers/misc/mei/mei_dev.h
+4
drivers/misc/mei/mei_dev.h
···
426
426
*
427
427
* @fw_ver : FW versions
428
428
*
429
+
* @fw_f_fw_ver_supported : fw feature: fw version supported
430
+
*
429
431
* @me_clients_rwsem: rw lock over me_clients list
430
432
* @me_clients : list of FW clients
431
433
* @me_clients_map : FW clients bit map
···
507
505
unsigned int hbm_f_dr_supported:1;
508
506
509
507
struct mei_fw_version fw_ver[MEI_MAX_FW_VER_BLOCKS];
508
+
509
+
unsigned int fw_f_fw_ver_supported:1;
510
510
511
511
struct rw_semaphore me_clients_rwsem;
512
512
struct list_head me_clients;
+8
-5
drivers/misc/mei/pci-me.c
+8
-5
drivers/misc/mei/pci-me.c
···
61
61
{MEI_PCI_DEVICE(MEI_DEV_ID_ICH10_3, MEI_ME_ICH10_CFG)},
62
62
{MEI_PCI_DEVICE(MEI_DEV_ID_ICH10_4, MEI_ME_ICH10_CFG)},
63
63
64
-
{MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_1, MEI_ME_PCH_CFG)},
65
-
{MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_2, MEI_ME_PCH_CFG)},
64
+
{MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_1, MEI_ME_PCH6_CFG)},
65
+
{MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_2, MEI_ME_PCH6_CFG)},
66
66
{MEI_PCI_DEVICE(MEI_DEV_ID_CPT_1, MEI_ME_PCH_CPT_PBG_CFG)},
67
67
{MEI_PCI_DEVICE(MEI_DEV_ID_PBG_1, MEI_ME_PCH_CPT_PBG_CFG)},
68
-
{MEI_PCI_DEVICE(MEI_DEV_ID_PPT_1, MEI_ME_PCH_CFG)},
69
-
{MEI_PCI_DEVICE(MEI_DEV_ID_PPT_2, MEI_ME_PCH_CFG)},
70
-
{MEI_PCI_DEVICE(MEI_DEV_ID_PPT_3, MEI_ME_PCH_CFG)},
68
+
{MEI_PCI_DEVICE(MEI_DEV_ID_PPT_1, MEI_ME_PCH7_CFG)},
69
+
{MEI_PCI_DEVICE(MEI_DEV_ID_PPT_2, MEI_ME_PCH7_CFG)},
70
+
{MEI_PCI_DEVICE(MEI_DEV_ID_PPT_3, MEI_ME_PCH7_CFG)},
71
71
{MEI_PCI_DEVICE(MEI_DEV_ID_LPT_H, MEI_ME_PCH8_SPS_CFG)},
72
72
{MEI_PCI_DEVICE(MEI_DEV_ID_LPT_W, MEI_ME_PCH8_SPS_CFG)},
73
73
{MEI_PCI_DEVICE(MEI_DEV_ID_LPT_LP, MEI_ME_PCH8_CFG)},
···
95
95
{MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_4, MEI_ME_PCH8_CFG)},
96
96
{MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH12_CFG)},
97
97
{MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
98
+
99
+
{MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP, MEI_ME_PCH12_CFG)},
100
+
{MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP_3, MEI_ME_PCH8_CFG)},
98
101
99
102
{MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
100
103
+2
-1
drivers/virt/vboxguest/vboxguest_utils.c
+2
-1
drivers/virt/vboxguest/vboxguest_utils.c
···
220
220
if (!bounce_buf)
221
221
return -ENOMEM;
222
222
223
+
*bounce_buf_ret = bounce_buf;
224
+
223
225
if (copy_in) {
224
226
ret = copy_from_user(bounce_buf, (void __user *)buf, len);
225
227
if (ret)
···
230
228
memset(bounce_buf, 0, len);
231
229
}
232
230
233
-
*bounce_buf_ret = bounce_buf;
234
231
hgcm_call_add_pagelist_size(bounce_buf, len, extra);
235
232
return 0;
236
233
}