Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'char-misc-6.10-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char / misc driver fixes from Greg KH:
"Here are some small remaining driver fixes for 6.10-final that have
all been in linux-next for a while and resolve reported issues.
Included in here are:
- mei driver fixes (and a spelling fix at the end just to be clean)
- iio driver fixes for reported problems
- fastrpc bugfixes
- nvmem small fixes"
* tag 'char-misc-6.10-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
mei: vsc: Fix spelling error
mei: vsc: Enhance SPI transfer of IVSC ROM
mei: vsc: Utilize the appropriate byte order swap function
mei: vsc: Prevent timeout error with added delay post-firmware download
mei: vsc: Enhance IVSC chipset stability during warm reboot
nvmem: core: limit cell sysfs permissions to main attribute ones
nvmem: core: only change name to fram for current attribute
nvmem: meson-efuse: Fix return value of nvmem callbacks
nvmem: rmem: Fix return value of rmem_read()
misc: microchip: pci1xxxx: Fix return value of nvmem callbacks
hpet: Support 32-bit userspace
misc: fastrpc: Restrict untrusted app to attach to privileged PD
misc: fastrpc: Fix ownership reassignment of remote heap
misc: fastrpc: Fix memory leak in audio daemon attach operation
misc: fastrpc: Avoid updating PD type for capability request
misc: fastrpc: Copy the complete capability structure to user
misc: fastrpc: Fix DSP capabilities request
iio: light: apds9306: Fix error handing
iio: trigger: Fix condition for own trigger
+103
-35
+29
-5
drivers/char/hpet.c
+29
-5
drivers/char/hpet.c
···
269
269
if (!devp->hd_ireqfreq)
270
270
return -EIO;
271
271
272
-
if (count < sizeof(unsigned long))
273
-
return -EINVAL;
272
+
if (in_compat_syscall()) {
273
+
if (count < sizeof(compat_ulong_t))
274
+
return -EINVAL;
275
+
} else {
276
+
if (count < sizeof(unsigned long))
277
+
return -EINVAL;
278
+
}
274
279
275
280
add_wait_queue(&devp->hd_waitqueue, &wait);
276
281
···
299
294
schedule();
300
295
}
301
296
302
-
retval = put_user(data, (unsigned long __user *)buf);
303
-
if (!retval)
304
-
retval = sizeof(unsigned long);
297
+
if (in_compat_syscall()) {
298
+
retval = put_user(data, (compat_ulong_t __user *)buf);
299
+
if (!retval)
300
+
retval = sizeof(compat_ulong_t);
301
+
} else {
302
+
retval = put_user(data, (unsigned long __user *)buf);
303
+
if (!retval)
304
+
retval = sizeof(unsigned long);
305
+
}
306
+
305
307
out:
306
308
__set_current_state(TASK_RUNNING);
307
309
remove_wait_queue(&devp->hd_waitqueue, &wait);
···
663
651
unsigned short hi_timer;
664
652
};
665
653
654
+
/* 32-bit types would lead to different command codes which should be
655
+
* translated into 64-bit ones before passed to hpet_ioctl_common
656
+
*/
657
+
#define COMPAT_HPET_INFO _IOR('h', 0x03, struct compat_hpet_info)
658
+
#define COMPAT_HPET_IRQFREQ _IOW('h', 0x6, compat_ulong_t)
659
+
666
660
static long
667
661
hpet_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
668
662
{
669
663
struct hpet_info info;
670
664
int err;
665
+
666
+
if (cmd == COMPAT_HPET_INFO)
667
+
cmd = HPET_INFO;
668
+
669
+
if (cmd == COMPAT_HPET_IRQFREQ)
670
+
cmd = HPET_IRQFREQ;
671
671
672
672
mutex_lock(&hpet_mutex);
673
673
err = hpet_ioctl_common(file->private_data, cmd, arg, &info);
+1
-1
drivers/iio/industrialio-trigger.c
+1
-1
drivers/iio/industrialio-trigger.c
···
315
315
* this is the case if the IIO device and the trigger device share the
316
316
* same parent device.
317
317
*/
318
-
if (iio_validate_own_trigger(pf->indio_dev, trig))
318
+
if (!iio_validate_own_trigger(pf->indio_dev, trig))
319
319
trig->attached_own_device = true;
320
320
321
321
return ret;
+2
-2
drivers/iio/light/apds9306.c
+2
-2
drivers/iio/light/apds9306.c
+32
-9
drivers/misc/fastrpc.c
+32
-9
drivers/misc/fastrpc.c
···
1238
1238
struct fastrpc_phy_page pages[1];
1239
1239
char *name;
1240
1240
int err;
1241
+
bool scm_done = false;
1241
1242
struct {
1242
1243
int pgid;
1243
1244
u32 namelen;
···
1290
1289
fl->cctx->remote_heap->phys, fl->cctx->remote_heap->size, err);
1291
1290
goto err_map;
1292
1291
}
1292
+
scm_done = true;
1293
1293
}
1294
1294
}
1295
1295
···
1322
1320
goto err_invoke;
1323
1321
1324
1322
kfree(args);
1323
+
kfree(name);
1325
1324
1326
1325
return 0;
1327
1326
err_invoke:
1328
-
if (fl->cctx->vmcount) {
1327
+
if (fl->cctx->vmcount && scm_done) {
1329
1328
u64 src_perms = 0;
1330
1329
struct qcom_scm_vmperm dst_perms;
1331
1330
u32 i;
···
1696
1693
{
1697
1694
struct fastrpc_invoke_args args[2] = { 0 };
1698
1695
1699
-
/* Capability filled in userspace */
1696
+
/*
1697
+
* Capability filled in userspace. This carries the information
1698
+
* about the remoteproc support which is fetched from the remoteproc
1699
+
* sysfs node by userspace.
1700
+
*/
1700
1701
dsp_attr_buf[0] = 0;
1702
+
dsp_attr_buf_len -= 1;
1701
1703
1702
1704
args[0].ptr = (u64)(uintptr_t)&dsp_attr_buf_len;
1703
1705
args[0].length = sizeof(dsp_attr_buf_len);
1704
1706
args[0].fd = -1;
1705
1707
args[1].ptr = (u64)(uintptr_t)&dsp_attr_buf[1];
1706
-
args[1].length = dsp_attr_buf_len;
1708
+
args[1].length = dsp_attr_buf_len * sizeof(u32);
1707
1709
args[1].fd = -1;
1708
-
fl->pd = USER_PD;
1709
1710
1710
1711
return fastrpc_internal_invoke(fl, true, FASTRPC_DSP_UTILITIES_HANDLE,
1711
1712
FASTRPC_SCALARS(0, 1, 1), args);
···
1737
1730
if (!dsp_attributes)
1738
1731
return -ENOMEM;
1739
1732
1740
-
err = fastrpc_get_info_from_dsp(fl, dsp_attributes, FASTRPC_MAX_DSP_ATTRIBUTES_LEN);
1733
+
err = fastrpc_get_info_from_dsp(fl, dsp_attributes, FASTRPC_MAX_DSP_ATTRIBUTES);
1741
1734
if (err == DSP_UNSUPPORTED_API) {
1742
1735
dev_info(&cctx->rpdev->dev,
1743
1736
"Warning: DSP capabilities not supported on domain: %d\n", domain);
···
1790
1783
if (err)
1791
1784
return err;
1792
1785
1793
-
if (copy_to_user(argp, &cap.capability, sizeof(cap.capability)))
1786
+
if (copy_to_user(argp, &cap, sizeof(cap)))
1794
1787
return -EFAULT;
1795
1788
1796
1789
return 0;
···
2087
2080
return err;
2088
2081
}
2089
2082
2083
+
static int is_attach_rejected(struct fastrpc_user *fl)
2084
+
{
2085
+
/* Check if the device node is non-secure */
2086
+
if (!fl->is_secure_dev) {
2087
+
dev_dbg(&fl->cctx->rpdev->dev, "untrusted app trying to attach to privileged DSP PD\n");
2088
+
return -EACCES;
2089
+
}
2090
+
return 0;
2091
+
}
2092
+
2090
2093
static long fastrpc_device_ioctl(struct file *file, unsigned int cmd,
2091
2094
unsigned long arg)
2092
2095
{
···
2109
2092
err = fastrpc_invoke(fl, argp);
2110
2093
break;
2111
2094
case FASTRPC_IOCTL_INIT_ATTACH:
2112
-
err = fastrpc_init_attach(fl, ROOT_PD);
2095
+
err = is_attach_rejected(fl);
2096
+
if (!err)
2097
+
err = fastrpc_init_attach(fl, ROOT_PD);
2113
2098
break;
2114
2099
case FASTRPC_IOCTL_INIT_ATTACH_SNS:
2115
-
err = fastrpc_init_attach(fl, SENSORS_PD);
2100
+
err = is_attach_rejected(fl);
2101
+
if (!err)
2102
+
err = fastrpc_init_attach(fl, SENSORS_PD);
2116
2103
break;
2117
2104
case FASTRPC_IOCTL_INIT_CREATE_STATIC:
2118
-
err = fastrpc_init_create_static_process(fl, argp);
2105
+
err = is_attach_rejected(fl);
2106
+
if (!err)
2107
+
err = fastrpc_init_create_static_process(fl, argp);
2119
2108
break;
2120
2109
case FASTRPC_IOCTL_INIT_CREATE:
2121
2110
err = fastrpc_init_create_process(fl, argp);
-4
drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c
-4
drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c
···
153
153
154
154
buf[byte] = readl(rb + MMAP_EEPROM_OFFSET(EEPROM_DATA_REG));
155
155
}
156
-
ret = byte;
157
156
error:
158
157
release_sys_lock(priv);
159
158
return ret;
···
196
197
goto error;
197
198
}
198
199
}
199
-
ret = byte;
200
200
error:
201
201
release_sys_lock(priv);
202
202
return ret;
···
256
258
257
259
buf[byte] = readl(rb + MMAP_OTP_OFFSET(OTP_RD_DATA_OFFSET));
258
260
}
259
-
ret = byte;
260
261
error:
261
262
release_sys_lock(priv);
262
263
return ret;
···
312
315
goto error;
313
316
}
314
317
}
315
-
ret = byte;
316
318
error:
317
319
release_sys_lock(priv);
318
320
return ret;
+2
-2
drivers/misc/mei/platform-vsc.c
+2
-2
drivers/misc/mei/platform-vsc.c
···
28
28
29
29
#define MEI_VSC_MAX_MSG_SIZE 512
30
30
31
-
#define MEI_VSC_POLL_DELAY_US (50 * USEC_PER_MSEC)
32
-
#define MEI_VSC_POLL_TIMEOUT_US (200 * USEC_PER_MSEC)
31
+
#define MEI_VSC_POLL_DELAY_US (100 * USEC_PER_MSEC)
32
+
#define MEI_VSC_POLL_TIMEOUT_US (400 * USEC_PER_MSEC)
33
33
34
34
#define mei_dev_to_vsc_hw(dev) ((struct mei_vsc_hw *)((dev)->hw))
35
35
+1
-1
drivers/misc/mei/vsc-fw-loader.c
+1
-1
drivers/misc/mei/vsc-fw-loader.c
+16
-2
drivers/misc/mei/vsc-tp.c
+16
-2
drivers/misc/mei/vsc-tp.c
···
331
331
return ret;
332
332
}
333
333
334
-
ret = vsc_tp_dev_xfer(tp, tp->tx_buf, tp->rx_buf, len);
334
+
ret = vsc_tp_dev_xfer(tp, tp->tx_buf, ibuf ? tp->rx_buf : NULL, len);
335
335
if (ret)
336
336
return ret;
337
337
338
338
if (ibuf)
339
-
cpu_to_be32_array(ibuf, tp->rx_buf, words);
339
+
be32_to_cpu_array(ibuf, tp->rx_buf, words);
340
340
341
341
return ret;
342
342
}
···
568
568
free_irq(spi->irq, tp);
569
569
}
570
570
571
+
static void vsc_tp_shutdown(struct spi_device *spi)
572
+
{
573
+
struct vsc_tp *tp = spi_get_drvdata(spi);
574
+
575
+
platform_device_unregister(tp->pdev);
576
+
577
+
mutex_destroy(&tp->mutex);
578
+
579
+
vsc_tp_reset(tp);
580
+
581
+
free_irq(spi->irq, tp);
582
+
}
583
+
571
584
static const struct acpi_device_id vsc_tp_acpi_ids[] = {
572
585
{ "INTC1009" }, /* Raptor Lake */
573
586
{ "INTC1058" }, /* Tiger Lake */
···
593
580
static struct spi_driver vsc_tp_driver = {
594
581
.probe = vsc_tp_probe,
595
582
.remove = vsc_tp_remove,
583
+
.shutdown = vsc_tp_shutdown,
596
584
.driver = {
597
585
.name = "vsc-tp",
598
586
.acpi_match_table = vsc_tp_acpi_ids,
+3
-4
drivers/nvmem/core.c
+3
-4
drivers/nvmem/core.c
···
396
396
if (!config->base_dev)
397
397
return -EINVAL;
398
398
399
-
if (config->type == NVMEM_TYPE_FRAM)
400
-
bin_attr_nvmem_eeprom_compat.attr.name = "fram";
401
-
402
399
nvmem->eeprom = bin_attr_nvmem_eeprom_compat;
400
+
if (config->type == NVMEM_TYPE_FRAM)
401
+
nvmem->eeprom.attr.name = "fram";
403
402
nvmem->eeprom.attr.mode = nvmem_bin_attr_get_umode(nvmem);
404
403
nvmem->eeprom.size = nvmem->size;
405
404
#ifdef CONFIG_DEBUG_LOCK_ALLOC
···
462
463
"%s@%x,%x", entry->name,
463
464
entry->offset,
464
465
entry->bit_offset);
465
-
attrs[i].attr.mode = 0444;
466
+
attrs[i].attr.mode = 0444 & nvmem_bin_attr_get_umode(nvmem);
466
467
attrs[i].size = entry->bytes;
467
468
attrs[i].read = &nvmem_cell_attr_read;
468
469
attrs[i].private = entry;
+10
-4
drivers/nvmem/meson-efuse.c
+10
-4
drivers/nvmem/meson-efuse.c
···
18
18
void *val, size_t bytes)
19
19
{
20
20
struct meson_sm_firmware *fw = context;
21
+
int ret;
21
22
22
-
return meson_sm_call_read(fw, (u8 *)val, bytes, SM_EFUSE_READ, offset,
23
-
bytes, 0, 0, 0);
23
+
ret = meson_sm_call_read(fw, (u8 *)val, bytes, SM_EFUSE_READ, offset,
24
+
bytes, 0, 0, 0);
25
+
26
+
return ret < 0 ? ret : 0;
24
27
}
25
28
26
29
static int meson_efuse_write(void *context, unsigned int offset,
27
30
void *val, size_t bytes)
28
31
{
29
32
struct meson_sm_firmware *fw = context;
33
+
int ret;
30
34
31
-
return meson_sm_call_write(fw, (u8 *)val, bytes, SM_EFUSE_WRITE, offset,
32
-
bytes, 0, 0, 0);
35
+
ret = meson_sm_call_write(fw, (u8 *)val, bytes, SM_EFUSE_WRITE, offset,
36
+
bytes, 0, 0, 0);
37
+
38
+
return ret < 0 ? ret : 0;
33
39
}
34
40
35
41
static const struct of_device_id meson_efuse_match[] = {
+4
-1
drivers/nvmem/rmem.c
+4
-1
drivers/nvmem/rmem.c
+3
include/uapi/misc/fastrpc.h
+3
include/uapi/misc/fastrpc.h
···
8
8
#define FASTRPC_IOCTL_ALLOC_DMA_BUFF _IOWR('R', 1, struct fastrpc_alloc_dma_buf)
9
9
#define FASTRPC_IOCTL_FREE_DMA_BUFF _IOWR('R', 2, __u32)
10
10
#define FASTRPC_IOCTL_INVOKE _IOWR('R', 3, struct fastrpc_invoke)
11
+
/* This ioctl is only supported with secure device nodes */
11
12
#define FASTRPC_IOCTL_INIT_ATTACH _IO('R', 4)
12
13
#define FASTRPC_IOCTL_INIT_CREATE _IOWR('R', 5, struct fastrpc_init_create)
13
14
#define FASTRPC_IOCTL_MMAP _IOWR('R', 6, struct fastrpc_req_mmap)
14
15
#define FASTRPC_IOCTL_MUNMAP _IOWR('R', 7, struct fastrpc_req_munmap)
16
+
/* This ioctl is only supported with secure device nodes */
15
17
#define FASTRPC_IOCTL_INIT_ATTACH_SNS _IO('R', 8)
18
+
/* This ioctl is only supported with secure device nodes */
16
19
#define FASTRPC_IOCTL_INIT_CREATE_STATIC _IOWR('R', 9, struct fastrpc_init_create_static)
17
20
#define FASTRPC_IOCTL_MEM_MAP _IOWR('R', 10, struct fastrpc_mem_map)
18
21
#define FASTRPC_IOCTL_MEM_UNMAP _IOWR('R', 11, struct fastrpc_mem_unmap)