diff --git a/Documentation/devicetree/bindings/input/touchscreen/msg21xx-ts.txt b/Documentation/devicetree/bindings/input/touchscreen/msg21xx-ts.txt deleted file mode 100644 index 0d6289779d8cc..0000000000000 --- a/Documentation/devicetree/bindings/input/touchscreen/msg21xx-ts.txt +++ /dev/null @@ -1,71 +0,0 @@ -Mstar touch controller - -The mstar controller is connected to host processor -via i2c. The controller generates interrupts when the -user touches the panel. The host controller is expected -to read the touch coordinates over i2c and pass the coordinates -to the rest of the system. - -Required properties: - - - compatible : should be "mstar,msg21xx" - - reg : i2c slave address of the device - - interrupt-parent : parent of interrupt - - interrupts : touch sample interrupt to indicate presense or release - of fingers on the panel. - - vdd-supply : Power supply needed to power up the device - - vcc_i2c-supply : Power source required to power up i2c bus - - mstar,irq-gpio : irq gpio which is to provide interrupts to host, - same as "interrupts" node. It will also - contain active low or active high information. - - mstar,reset-gpio : reset gpio to control the reset of chip - - mstar,display-coords : display coords in pixels. It is a four - tuple consisting of min x, min y, max x and - max y values - - pinctrl-names : This should be defined if a target uses pinctrl framework. - See "pinctrl" in Documentation/devicetree/bindings/pinctrl/msm-pinctrl.txt. - Specify the names of the configs that pinctrl can install in driver. - Following are the pinctrl configs that can be installed: - "pmx_ts_active" : Active configuration of pins, this should specify active - config defined in pin groups of interrupt and reset gpio. - "pmx_ts_suspend" : Disabled configuration of pins, this should specify sleep - config defined in pin groups of interrupt and reset gpio. - "pmx_ts_release" : Release configuration of pins, this should specify - release config defined in pin groups of interrupt and reset gpio. - - mstar,num-max-touches: It defines the maximum number of touch supported by the controller. - - mstar,hard-reset-delay-ms : hard reset delay in ms - - mstar,post-hard-reset-delay-ms : post hard reset delay in ms - -Optional properties: - - - mstar,button-map : button map of key codes. It is a three tuple consisting of key codes. - - mstar,panel-coords : panel coords for the chip in pixels. - It is a four tuple consisting of min x, - min y, max x and max y values - - mstar,ic-type : It defines the ic-type of the controller. Values are as folows: - 1 -> msg2133. - 2 -> msg21xxA. - 3 -> msg26xxM. - -Example: - i2c@78b9000 { /* BLSP1 QUP5 */ - mstar@26 { - compatible = "mstar,msg21xx"; - reg = <0x26>; - interrupt-parent = <&msm_gpio>; - interrupts = <13 0x2008>; - mstar,irq-gpio = <&msm_gpio 13 0x00000001>; - mstar,reset-gpio = <&msm_gpio 12 0x0>; - vdd-supply = <&pm8916_l17>; - vcc_i2c-supply = <&pm8916_l6>; - mstar,display-coords = <0 0 480 854>; - pinctrl-names = "pmx_ts_active","pmx_ts_suspend"; - pinctrl-0 = <&ts_int_active &ts_reset_active>; - pinctrl-1 = <&ts_int_suspend &ts_reset_suspend>; - mstar,button-map = <172 139 158>; - mstar,ic-type = <2>; - mstar,num_max_touches = <2>; - mstar,hard-reset-delay-ms = <100>; - mstar,post-hard-reset-delay-ms = <100>; - }; - }; diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c index 1283f1384d4b2..60cd004009a0a 100644 --- a/arch/arm64/kernel/setup.c +++ b/arch/arm64/kernel/setup.c @@ -501,7 +501,8 @@ static const char *compat_hwcap_str[] = { "idivt", "vfpd32", "lpae", - "evtstrm" + "evtstrm", + NULL }; #endif /* CONFIG_COMPAT */ diff --git a/drivers/base/dma-contiguous.c b/drivers/base/dma-contiguous.c index 0fb097be082b0..5d17ebeb12957 100755 --- a/drivers/base/dma-contiguous.c +++ b/drivers/base/dma-contiguous.c @@ -651,6 +651,9 @@ unsigned long dma_alloc_from_contiguous(struct device *dev, size_t count, if (!count) return 0; + if (count > cma->count) + return 0; + mask = (1 << align) - 1; diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index 3a08b6cb2f7f3..815d822565a7f 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -465,6 +465,11 @@ static int context_build_overlap(struct smq_invoke_ctx *ctx) for (i = 0; i < nbufs; ++i) { ctx->overs[i].start = (uintptr_t)pra[i].buf.pv; ctx->overs[i].end = ctx->overs[i].start + pra[i].buf.len; + if (pra[i].buf.len) { + VERIFY(err, ctx->overs[i].end > ctx->overs[i].start); + if (err) + goto bail; + } ctx->overs[i].raix = i; ctx->overps[i] = &ctx->overs[i]; } @@ -835,9 +840,9 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx, void *args; remote_arg_t *pra = ctx->pra; remote_arg_t *rpra = ctx->rpra; - ssize_t rlen, used, size; + ssize_t rlen, used, size, copylen = 0; uint32_t sc = ctx->sc, start; - int i, inh, bufs = 0, err = 0, oix, copylen = 0; + int i, inh, bufs = 0, err = 0, oix; int inbufs = REMOTE_SCALARS_INBUFS(sc); int outbufs = REMOTE_SCALARS_OUTBUFS(sc); int cid = ctx->fdata->cid; @@ -886,13 +891,23 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx, /* calculate len requreed for copying */ for (oix = 0; oix < inbufs + outbufs; ++oix) { int i = ctx->overps[oix]->raix; + uintptr_t mstart, mend; + if (!pra[i].buf.len) continue; if (list[i].num) continue; if (ctx->overps[oix]->offset == 0) copylen = ALIGN(copylen, BALIGN); - copylen += ctx->overps[oix]->mend - ctx->overps[oix]->mstart; + mstart = ctx->overps[oix]->mstart; + mend = ctx->overps[oix]->mend; + VERIFY(err, (mend - mstart) <= LONG_MAX); + if (err) + goto bail; + copylen += mend - mstart; + VERIFY(err, copylen >= 0); + if (err) + goto bail; } /* alocate new buffer */ @@ -918,7 +933,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx, /* copy non ion buffers */ for (oix = 0; oix < inbufs + outbufs; ++oix) { int i = ctx->overps[oix]->raix; - int mlen = ctx->overps[oix]->mend - ctx->overps[oix]->mstart; + ssize_t mlen = ctx->overps[oix]->mend - ctx->overps[oix]->mstart; if (!pra[i].buf.len) continue; if (list[i].num) diff --git a/drivers/crypto/msm/ota_crypto.c b/drivers/crypto/msm/ota_crypto.c index 9fc548d73e608..80e810dbeb644 100644 --- a/drivers/crypto/msm/ota_crypto.c +++ b/drivers/crypto/msm/ota_crypto.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2010-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2010-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -880,8 +880,8 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf, int len; len = _disp_stats(); - - rc = simple_read_from_buffer((void __user *) buf, len, + if (len <= count) + rc = simple_read_from_buffer((void __user *) buf, len, ppos, (void *) _debug_read_buf, len); return rc; diff --git a/drivers/crypto/msm/qcedev.c b/drivers/crypto/msm/qcedev.c index d8b6c2e1c85d5..f72bddeb56ba5 100644 --- a/drivers/crypto/msm/qcedev.c +++ b/drivers/crypto/msm/qcedev.c @@ -1456,6 +1456,15 @@ static int qcedev_check_cipher_params(struct qcedev_cipher_op_req *req, pr_err("%s: Invalid byte offset\n", __func__); goto error; } + total = req->byteoffset; + for (i = 0; i < req->entries; i++) { + if (total > U32_MAX - req->vbuf.src[i].len) { + pr_err("%s:Integer overflow on total src len\n", + __func__); + goto error; + } + total += req->vbuf.src[i].len; + } } if (req->data_len < req->byteoffset) { @@ -1491,7 +1500,7 @@ static int qcedev_check_cipher_params(struct qcedev_cipher_op_req *req, } } /* Check for sum of all dst length is equal to data_len */ - for (i = 0; i < req->entries; i++) { + for (i = 0, total = 0; i < req->entries; i++) { if (req->vbuf.dst[i].len >= U32_MAX - total) { pr_err("%s: Integer overflow on total req dst vbuf length\n", __func__); @@ -2052,9 +2061,9 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf, len = _disp_stats(qcedev); - rc = simple_read_from_buffer((void __user *) buf, len, + if (len <= count) + rc = simple_read_from_buffer((void __user *) buf, len, ppos, (void *) _debug_read_buf, len); - return rc; } diff --git a/drivers/crypto/msm/qcrypto.c b/drivers/crypto/msm/qcrypto.c index 359e56bbcb9c6..9c5c38531573e 100644 --- a/drivers/crypto/msm/qcrypto.c +++ b/drivers/crypto/msm/qcrypto.c @@ -1,6 +1,6 @@ /* Qualcomm Crypto driver * - * Copyright (c) 2010-2015, The Linux Foundation. All rights reserved. + * Copyright (c) 2010-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -5052,9 +5052,9 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf, len = _disp_stats(qcrypto); - rc = simple_read_from_buffer((void __user *) buf, len, + if (len <= count) + rc = simple_read_from_buffer((void __user *) buf, len, ppos, (void *) _debug_read_buf, len); - return rc; } diff --git a/drivers/input/misc/hbtp_input.c b/drivers/input/misc/hbtp_input.c index ef17d386644c9..7877e9b9f5162 100644 --- a/drivers/input/misc/hbtp_input.c +++ b/drivers/input/misc/hbtp_input.c @@ -129,9 +129,13 @@ static int hbtp_input_create_input_dev(struct hbtp_input_absinfo *absinfo) input_mt_init_slots(input_dev, HBTP_MAX_FINGER, 0); for (i = 0; i <= ABS_MT_LAST - ABS_MT_FIRST; i++) { abs = absinfo + i; - if (abs->active) - input_set_abs_params(input_dev, abs->code, + if (abs->active) { + if (abs->code >= 0 && abs->code < ABS_CNT) + input_set_abs_params(input_dev, abs->code, abs->minimum, abs->maximum, 0, 0); + else + pr_err("%s: ABS code out of bound\n", __func__); + } } error = input_register_device(input_dev); diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig index 94dca1d04966e..4e038ec2ecc8c 100644 --- a/drivers/input/touchscreen/Kconfig +++ b/drivers/input/touchscreen/Kconfig @@ -955,16 +955,15 @@ config TOUCHSCREEN_FT5X06_GESTURE If unsure, say N. -config TOUCHSCREEN_MSTAR21XX - tristate "mstar touchscreens" - depends on I2C - help - Say Y here if you have a mstar touchscreen. - - If unsure, say N. +config TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS + bool "Synaptics DSX firmware update extra sysfs attributes" + depends on TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE + help + Say Y here to enable support for extra sysfs attributes + supporting firmware update in a development environment. + This does not affect the core or other subsystem attributes. - To compile this driver as a module, choose M here: the - module will be called msg21xx_ts. + If unsure, say N. config TOUCHSCREEN_GEN_VKEYS tristate "Touchscreen Virtual Keys Driver" diff --git a/drivers/input/touchscreen/Makefile b/drivers/input/touchscreen/Makefile index 3be9b493abd38..21a0e8417b6aa 100644 --- a/drivers/input/touchscreen/Makefile +++ b/drivers/input/touchscreen/Makefile @@ -88,7 +88,6 @@ obj-$(CONFIG_TOUCHSCREEN_WM97XX_ZYLONITE) += zylonite-wm97xx.o obj-$(CONFIG_TOUCHSCREEN_W90X900) += w90p910_ts.o obj-$(CONFIG_TOUCHSCREEN_TPS6507X) += tps6507x-ts.o obj-$(CONFIG_TOUCHSCREEN_FT5X06) += ft5x06_ts.o -obj-$(CONFIG_TOUCHSCREEN_MSTAR21XX) += msg21xx_ts.o obj-$(CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_RMI4_DEV) += synaptics_rmi_dev.o obj-$(CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE) += synaptics_fw_update.o obj-$(CONFIG_TOUCHSCREEN_SYNAPTICS_I2C_RMI4) += synaptics_i2c_rmi4.o diff --git a/drivers/input/touchscreen/gt9xx/goodix_tool.c b/drivers/input/touchscreen/gt9xx/goodix_tool.c index 8e202fc00dcde..905e74792beed 100644 --- a/drivers/input/touchscreen/gt9xx/goodix_tool.c +++ b/drivers/input/touchscreen/gt9xx/goodix_tool.c @@ -1,7 +1,7 @@ /* drivers/input/touchscreen/goodix_tool.c * * 2010 - 2012 Goodix Technology. - * Copyright (c) 2013, The Linux Foundation. All rights reserved. + * Copyright (c) 2013-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -311,6 +311,7 @@ static s32 goodix_tool_write(struct file *filp, const char __user *userbuf, size_t count, loff_t *ppos) { s32 ret = 0; + u8 *dataptr = NULL; mutex_lock(&lock); ret = copy_from_user(&cmd_head, userbuf, CMD_HEAD_LENGTH); @@ -463,6 +464,11 @@ static s32 goodix_tool_write(struct file *filp, const char __user *userbuf, ret = CMD_HEAD_LENGTH; exit: + dataptr = cmd_head.data; + memset(&cmd_head, 0, sizeof(cmd_head)); + cmd_head.wr = 0xFF; + cmd_head.data = dataptr; + mutex_unlock(&lock); return ret; } diff --git a/drivers/input/touchscreen/msg21xx_ts.c b/drivers/input/touchscreen/msg21xx_ts.c deleted file mode 100644 index 0b72cac518409..0000000000000 --- a/drivers/input/touchscreen/msg21xx_ts.c +++ /dev/null @@ -1,2162 +0,0 @@ -/* - * MStar MSG21XX touchscreen driver - * - * Copyright (c) 2006-2012 MStar Semiconductor, Inc. - * - * Copyright (C) 2012 Bruce Ding - * - * Copyright (c) 2014, The Linux Foundation. All rights reserved. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - */ - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#if defined(CONFIG_FB) -#include -#include -#endif -#ifdef CONFIG_TOUCHSCREEN_PROXIMITY_SENSOR -#include -#endif - -/* Constant Value & Variable Definition*/ - -#define MSTAR_VTG_MIN_UV 2800000 -#define MSTAR_VTG_MAX_UV 3300000 -#define MSTAR_I2C_VTG_MIN_UV 1800000 -#define MSTAR_I2C_VTG_MAX_UV 1800000 - -#define MAX_BUTTONS 4 -#define FT_COORDS_ARR_SIZE 4 -#define MSTAR_FW_NAME_MAX_LEN 50 - -#define MSTAR_CHIPTOP_REGISTER_BANK 0x1E -#define MSTAR_CHIPTOP_REGISTER_ICTYPE 0xCC -#define MSTAR_INIT_SW_ID 0x7FF -#define MSTAR_DEBUG_DIR_NAME "ts_debug" - -#define MSG_FW_FILE_MAJOR_VERSION(x) \ - (((x)->data[0x7f4f] << 8) + ((x)->data[0x7f4e])) - -#define MSG_FW_FILE_MINOR_VERSION(x) \ - (((x)->data[0x7f51] << 8) + ((x)->data[0x7f50])) - -/* - * Note. - * Please do not change the below setting. - */ -#define TPD_WIDTH (2048) -#define TPD_HEIGHT (2048) - -#define PINCTRL_STATE_ACTIVE "pmx_ts_active" -#define PINCTRL_STATE_SUSPEND "pmx_ts_suspend" -#define PINCTRL_STATE_RELEASE "pmx_ts_release" - -#define SLAVE_I2C_ID_DBBUS (0xC4>>1) - -#define DEMO_MODE_PACKET_LENGTH (8) - -#define TP_PRINT - -/*store the frimware binary data*/ -static unsigned char fw_bin_data[94][1024]; -static unsigned int crc32_table[256]; - -static unsigned short fw_file_major, fw_file_minor; -static unsigned short main_sw_id = MSTAR_INIT_SW_ID; -static unsigned short info_sw_id = MSTAR_INIT_SW_ID; -static unsigned int bin_conf_crc32; - -struct msg21xx_ts_platform_data { - const char *name; - char fw_name[MSTAR_FW_NAME_MAX_LEN]; - u8 fw_version_major; - u8 fw_version_minor; - u32 irq_gpio; - u32 irq_gpio_flags; - u32 reset_gpio; - u32 reset_gpio_flags; - u32 x_max; - u32 y_max; - u32 x_min; - u32 y_min; - u32 panel_minx; - u32 panel_miny; - u32 panel_maxx; - u32 panel_maxy; - u32 num_max_touches; - u8 ic_type; - u32 button_map[MAX_BUTTONS]; - u32 num_buttons; - u32 hard_reset_delay_ms; - u32 post_hard_reset_delay_ms; - bool updating_fw; -}; - -/* Touch Data Type Definition */ -struct touchPoint_t { - unsigned short x; - unsigned short y; -}; - -struct touchInfo_t { - struct touchPoint_t *point; - unsigned char count; - unsigned char keycode; -}; - -struct msg21xx_ts_data { - struct i2c_client *client; - struct input_dev *input_dev; - struct msg21xx_ts_platform_data *pdata; - struct regulator *vdd; - struct regulator *vcc_i2c; - bool suspended; -#if defined(CONFIG_FB) - struct notifier_block fb_notif; -#endif - struct pinctrl *ts_pinctrl; - struct pinctrl_state *pinctrl_state_active; - struct pinctrl_state *pinctrl_state_suspend; - struct pinctrl_state *pinctrl_state_release; - struct mutex ts_mutex; - struct touchInfo_t info; -}; - -#if defined(CONFIG_FB) -static int fb_notifier_callback(struct notifier_block *self, - unsigned long event, void *data); -#endif - -#ifdef CONFIG_TOUCHSCREEN_PROXIMITY_SENSOR -static unsigned char bEnableTpProximity; -static unsigned char bFaceClosingTp; -#endif - -#ifdef TP_PRINT -static int tp_print_proc_read(struct msg21xx_ts_data *ts_data); -static void tp_print_create_entry(struct msg21xx_ts_data *ts_data); -#endif - -static void _ReadBinConfig(struct msg21xx_ts_data *ts_data); -static unsigned int _CalMainCRC32(struct msg21xx_ts_data *ts_data); - -static struct mutex msg21xx_mutex; - -enum EMEM_TYPE_t { - EMEM_ALL = 0, - EMEM_MAIN, - EMEM_INFO, -}; - -/* Function Definition */ - -static unsigned int _CRC_doReflect(unsigned int ref, signed char ch) -{ - unsigned int value = 0; - unsigned int i = 0; - - for (i = 1; i < (ch + 1); i++) { - if (ref & 1) - value |= 1 << (ch - i); - ref >>= 1; - } - - return value; -} - -static unsigned int _CRC_getValue(unsigned int text, unsigned int prevCRC) -{ - unsigned int ulCRC = prevCRC; - - ulCRC = (ulCRC >> 8) ^ crc32_table[(ulCRC & 0xFF) ^ text]; - - return ulCRC; -} - -static void _CRC_initTable(void) -{ - unsigned int magic_number = 0x04c11db7; - unsigned int i, j; - - for (i = 0; i <= 0xFF; i++) { - crc32_table[i] = _CRC_doReflect(i, 8) << 24; - for (j = 0; j < 8; j++) - crc32_table[i] = (crc32_table[i] << 1) ^ - (crc32_table[i] & (0x80000000L) ? - magic_number : 0); - crc32_table[i] = _CRC_doReflect(crc32_table[i], 32); - } -} - -static void msg21xx_reset_hw(struct msg21xx_ts_platform_data *pdata) -{ - gpio_direction_output(pdata->reset_gpio, 1); - gpio_set_value_cansleep(pdata->reset_gpio, 0); - /* Note that the RST must be in LOW 10ms at least */ - usleep(pdata->hard_reset_delay_ms * 1000); - gpio_set_value_cansleep(pdata->reset_gpio, 1); - /* Enable the interrupt service thread/routine for INT after 50ms */ - usleep(pdata->post_hard_reset_delay_ms * 1000); -} - -static int read_i2c_seq(struct msg21xx_ts_data *ts_data, unsigned char addr, - unsigned char *buf, unsigned short size) -{ - int rc = 0; - struct i2c_msg msgs[] = { - { - .addr = addr, - .flags = I2C_M_RD, /* read flag */ - .len = size, - .buf = buf, - }, - }; - - /* If everything went ok (i.e. 1 msg transmitted), return #bytes - transmitted, else error code. */ - if (ts_data->client != NULL) { - rc = i2c_transfer(ts_data->client->adapter, msgs, 1); - if (rc < 0) - dev_err(&ts_data->client->dev, - "%s error %d\n", __func__, rc); - } else { - dev_err(&ts_data->client->dev, "ts_data->client is NULL\n"); - } - - return rc; -} - -static int write_i2c_seq(struct msg21xx_ts_data *ts_data, unsigned char addr, - unsigned char *buf, unsigned short size) -{ - int rc = 0; - struct i2c_msg msgs[] = { - { - .addr = addr, - /* - * if read flag is undefined, - * then it means write flag. - */ - .flags = 0, - .len = size, - .buf = buf, - }, - }; - - /* - * If everything went ok (i.e. 1 msg transmitted), return #bytes - * transmitted, else error code. - */ - if (ts_data->client != NULL) { - rc = i2c_transfer(ts_data->client->adapter, msgs, 1); - if (rc < 0) - dev_err(&ts_data->client->dev, - "%s error %d\n", __func__, rc); - } else { - dev_err(&ts_data->client->dev, "ts_data->client is NULL\n"); - } - - return rc; -} - -static unsigned short read_reg(struct msg21xx_ts_data *ts_data, - unsigned char bank, unsigned char addr) -{ - unsigned char tx_data[3] = {0x10, bank, addr}; - unsigned char rx_data[2] = {0}; - - write_i2c_seq(ts_data, SLAVE_I2C_ID_DBBUS, tx_data, sizeof(tx_data)); - read_i2c_seq(ts_data, SLAVE_I2C_ID_DBBUS, rx_data, sizeof(rx_data)); - - return rx_data[1] << 8 | rx_data[0]; -} - -static void write_reg(struct msg21xx_ts_data *ts_data, unsigned char bank, - unsigned char addr, - unsigned short data) -{ - unsigned char tx_data[5] = {0x10, bank, addr, data & 0xFF, data >> 8}; - write_i2c_seq(ts_data, SLAVE_I2C_ID_DBBUS, tx_data, sizeof(tx_data)); -} - -static void write_reg_8bit(struct msg21xx_ts_data *ts_data, unsigned char bank, - unsigned char addr, - unsigned char data) -{ - unsigned char tx_data[4] = {0x10, bank, addr, data}; - write_i2c_seq(ts_data, SLAVE_I2C_ID_DBBUS, tx_data, sizeof(tx_data)); -} - -static void dbbusDWIICEnterSerialDebugMode(struct msg21xx_ts_data *ts_data) -{ - unsigned char data[5]; - - /* Enter the Serial Debug Mode */ - data[0] = 0x53; - data[1] = 0x45; - data[2] = 0x52; - data[3] = 0x44; - data[4] = 0x42; - - write_i2c_seq(ts_data, SLAVE_I2C_ID_DBBUS, data, sizeof(data)); -} - -static void dbbusDWIICStopMCU(struct msg21xx_ts_data *ts_data) -{ - unsigned char data[1]; - - /* Stop the MCU */ - data[0] = 0x37; - - write_i2c_seq(ts_data, SLAVE_I2C_ID_DBBUS, data, sizeof(data)); -} - -static void dbbusDWIICIICUseBus(struct msg21xx_ts_data *ts_data) -{ - unsigned char data[1]; - - /* IIC Use Bus */ - data[0] = 0x35; - - write_i2c_seq(ts_data, SLAVE_I2C_ID_DBBUS, data, sizeof(data)); -} - -static void dbbusDWIICIICReshape(struct msg21xx_ts_data *ts_data) -{ - unsigned char data[1]; - - /* IIC Re-shape */ - data[0] = 0x71; - - write_i2c_seq(ts_data, SLAVE_I2C_ID_DBBUS, data, sizeof(data)); -} - -static unsigned char msg21xx_get_ic_type(struct msg21xx_ts_data *ts_data) -{ - unsigned char ic_type = 0; - unsigned char bank; - unsigned char addr; - - msg21xx_reset_hw(ts_data->pdata); - dbbusDWIICEnterSerialDebugMode(ts_data); - dbbusDWIICStopMCU(ts_data); - dbbusDWIICIICUseBus(ts_data); - dbbusDWIICIICReshape(ts_data); - msleep(300); - - /* stop mcu */ - write_reg_8bit(ts_data, 0x0F, 0xE6, 0x01); - /* disable watch dog */ - write_reg(ts_data, 0x3C, 0x60, 0xAA55); - /* get ic type */ - bank = MSTAR_CHIPTOP_REGISTER_BANK; - addr = MSTAR_CHIPTOP_REGISTER_ICTYPE; - ic_type = (0xff)&(read_reg(ts_data, bank, addr)); - - if (ic_type != ts_data->pdata->ic_type) - ic_type = 0; - - msg21xx_reset_hw(ts_data->pdata); - - return ic_type; -} - -static int msg21xx_read_firmware_id(struct msg21xx_ts_data *ts_data) -{ - unsigned char command[3] = { 0x53, 0x00, 0x2A}; - unsigned char response[4] = { 0 }; - - mutex_lock(&msg21xx_mutex); - write_i2c_seq(ts_data, ts_data->client->addr, command, sizeof(command)); - read_i2c_seq(ts_data, ts_data->client->addr, response, - sizeof(response)); - mutex_unlock(&msg21xx_mutex); - ts_data->pdata->fw_version_major = (response[1]<<8) + response[0]; - ts_data->pdata->fw_version_minor = (response[3]<<8) + response[2]; - - dev_info(&ts_data->client->dev, "major num = %d, minor num = %d\n", - ts_data->pdata->fw_version_major, - ts_data->pdata->fw_version_minor); - - return 0; -} - -static int firmware_erase_c33(struct msg21xx_ts_data *ts_data, - enum EMEM_TYPE_t emem_type) -{ - /* stop mcu */ - write_reg(ts_data, 0x0F, 0xE6, 0x0001); - - /* disable watch dog */ - write_reg_8bit(ts_data, 0x3C, 0x60, 0x55); - write_reg_8bit(ts_data, 0x3C, 0x61, 0xAA); - - /* set PROGRAM password */ - write_reg_8bit(ts_data, 0x16, 0x1A, 0xBA); - write_reg_8bit(ts_data, 0x16, 0x1B, 0xAB); - - write_reg_8bit(ts_data, 0x16, 0x18, 0x80); - - if (emem_type == EMEM_ALL) - write_reg_8bit(ts_data, 0x16, 0x08, 0x10); - - write_reg_8bit(ts_data, 0x16, 0x18, 0x40); - msleep(20); - - /* clear pce */ - write_reg_8bit(ts_data, 0x16, 0x18, 0x80); - - /* erase trigger */ - if (emem_type == EMEM_MAIN) - write_reg_8bit(ts_data, 0x16, 0x0E, 0x04); /* erase main */ - else - write_reg_8bit(ts_data, 0x16, 0x0E, 0x08); /* erase all block */ - - return 0; -} - -static ssize_t firmware_update_c33(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t size, - enum EMEM_TYPE_t emem_type, - bool isForce) { - unsigned int i, j; - unsigned int crc_main, crc_main_tp; - unsigned int crc_info, crc_info_tp; - unsigned short reg_data = 0; - int update_pass = 1; - bool fw_upgrade = false; - struct msg21xx_ts_data *ts_data = dev_get_drvdata(dev); - - crc_main = 0xffffffff; - crc_info = 0xffffffff; - - msg21xx_reset_hw(ts_data->pdata); - - msg21xx_read_firmware_id(ts_data); - _ReadBinConfig(ts_data); - if ((main_sw_id == info_sw_id) && - (_CalMainCRC32(ts_data) == bin_conf_crc32) && - (fw_file_major == ts_data->pdata->fw_version_major) && - (fw_file_minor > ts_data->pdata->fw_version_minor)) { - fw_upgrade = true; - } - - if (!fw_upgrade && !isForce) { - dev_dbg(dev, "no need to update\n"); - msg21xx_reset_hw(ts_data->pdata); - return size; - } - msg21xx_reset_hw(ts_data->pdata); - msleep(300); - - dbbusDWIICEnterSerialDebugMode(ts_data); - dbbusDWIICStopMCU(ts_data); - dbbusDWIICIICUseBus(ts_data); - dbbusDWIICIICReshape(ts_data); - msleep(300); - - /* erase main */ - firmware_erase_c33(ts_data, EMEM_MAIN); - msleep(1000); - - msg21xx_reset_hw(ts_data->pdata); - dbbusDWIICEnterSerialDebugMode(ts_data); - dbbusDWIICStopMCU(ts_data); - dbbusDWIICIICUseBus(ts_data); - dbbusDWIICIICReshape(ts_data); - msleep(300); - - /* - * Program - */ - - /* polling 0x3CE4 is 0x1C70 */ - if ((emem_type == EMEM_ALL) || (emem_type == EMEM_MAIN)) { - do { - reg_data = read_reg(ts_data, 0x3C, 0xE4); - } while (reg_data != 0x1C70); - } - - switch (emem_type) { - case EMEM_ALL: - write_reg(ts_data, 0x3C, 0xE4, 0xE38F); /* for all-blocks */ - break; - case EMEM_MAIN: - write_reg(ts_data, 0x3C, 0xE4, 0x7731); /* for main block */ - break; - case EMEM_INFO: - write_reg(ts_data, 0x3C, 0xE4, 0x7731); /* for info block */ - - write_reg_8bit(ts_data, 0x0F, 0xE6, 0x01); - - write_reg_8bit(ts_data, 0x3C, 0xE4, 0xC5); - write_reg_8bit(ts_data, 0x3C, 0xE5, 0x78); - - write_reg_8bit(ts_data, MSTAR_CHIPTOP_REGISTER_BANK, - 0x04, 0x9F); - write_reg_8bit(ts_data, MSTAR_CHIPTOP_REGISTER_BANK, - 0x05, 0x82); - - write_reg_8bit(ts_data, 0x0F, 0xE6, 0x00); - msleep(100); - break; - } - - /* polling 0x3CE4 is 0x2F43 */ - do { - reg_data = read_reg(ts_data, 0x3C, 0xE4); - } while (reg_data != 0x2F43); - - /* calculate CRC 32 */ - _CRC_initTable(); - - /* total 32 KB : 2 byte per R/W */ - for (i = 0; i < 32; i++) { - if (i == 31) { - fw_bin_data[i][1014] = 0x5A; - fw_bin_data[i][1015] = 0xA5; - - for (j = 0; j < 1016; j++) - crc_main = _CRC_getValue(fw_bin_data[i][j], - crc_main); - } else { - for (j = 0; j < 1024; j++) - crc_main = _CRC_getValue(fw_bin_data[i][j], - crc_main); - } - - for (j = 0; j < 8; j++) - write_i2c_seq(ts_data, ts_data->client->addr, - &fw_bin_data[i][j * 128], 128); - msleep(100); - - /* polling 0x3CE4 is 0xD0BC */ - do { - reg_data = read_reg(ts_data, 0x3C, 0xE4); - } while (reg_data != 0xD0BC); - - write_reg(ts_data, 0x3C, 0xE4, 0x2F43); - } - - if ((emem_type == EMEM_ALL) || (emem_type == EMEM_MAIN)) { - /* write file done and check crc */ - write_reg(ts_data, 0x3C, 0xE4, 0x1380); - } - msleep(20); - - if ((emem_type == EMEM_ALL) || (emem_type == EMEM_MAIN)) { - /* polling 0x3CE4 is 0x9432 */ - do { - reg_data = read_reg(ts_data, 0x3C, 0xE4); - } while (reg_data != 0x9432); - } - - crc_main = crc_main ^ 0xffffffff; - crc_info = crc_info ^ 0xffffffff; - - if ((emem_type == EMEM_ALL) || (emem_type == EMEM_MAIN)) { - /* CRC Main from TP */ - crc_main_tp = read_reg(ts_data, 0x3C, 0x80); - crc_main_tp = (crc_main_tp << 16) | - read_reg(ts_data, 0x3C, 0x82); - - /* CRC Info from TP */ - crc_info_tp = read_reg(ts_data, 0x3C, 0xA0); - crc_info_tp = (crc_info_tp << 16) | - read_reg(ts_data, 0x3C, 0xA2); - } - - update_pass = 1; - if ((emem_type == EMEM_ALL) || (emem_type == EMEM_MAIN)) { - if (crc_main_tp != crc_main) - update_pass = 0; - } - - if (!update_pass) { - dev_err(dev, "update_C33 failed\n"); - msg21xx_reset_hw(ts_data->pdata); - return 0; - } - - dev_dbg(dev, "update_C33 OK\n"); - msg21xx_reset_hw(ts_data->pdata); - return size; -} - -static unsigned int _CalMainCRC32(struct msg21xx_ts_data *ts_data) -{ - unsigned int ret = 0; - unsigned short reg_data = 0; - - msg21xx_reset_hw(ts_data->pdata); - - dbbusDWIICEnterSerialDebugMode(ts_data); - dbbusDWIICStopMCU(ts_data); - dbbusDWIICIICUseBus(ts_data); - dbbusDWIICIICReshape(ts_data); - msleep(100); - - /* Stop MCU */ - write_reg(ts_data, 0x0F, 0xE6, 0x0001); - - /* Stop Watchdog */ - write_reg_8bit(ts_data, 0x3C, 0x60, 0x55); - write_reg_8bit(ts_data, 0x3C, 0x61, 0xAA); - - /* cmd */ - write_reg(ts_data, 0x3C, 0xE4, 0xDF4C); - write_reg(ts_data, MSTAR_CHIPTOP_REGISTER_BANK, 0x04, 0x7d60); - /* TP SW reset */ - write_reg(ts_data, MSTAR_CHIPTOP_REGISTER_BANK, 0x04, 0x829F); - - /* MCU run */ - write_reg(ts_data, 0x0F, 0xE6, 0x0000); - - /* polling 0x3CE4 */ - do { - reg_data = read_reg(ts_data, 0x3C, 0xE4); - } while (reg_data != 0x9432); - - /* Cal CRC Main from TP */ - ret = read_reg(ts_data, 0x3C, 0x80); - ret = (ret << 16) | read_reg(ts_data, 0x3C, 0x82); - - dev_dbg(&ts_data->client->dev, - "[21xxA]:Current main crc32=0x%x\n", ret); - return ret; -} - -static void _ReadBinConfig(struct msg21xx_ts_data *ts_data) -{ - unsigned char dbbus_tx_data[5] = {0}; - unsigned char dbbus_rx_data[4] = {0}; - unsigned short reg_data = 0; - - msg21xx_reset_hw(ts_data->pdata); - - dbbusDWIICEnterSerialDebugMode(ts_data); - dbbusDWIICStopMCU(ts_data); - dbbusDWIICIICUseBus(ts_data); - dbbusDWIICIICReshape(ts_data); - msleep(100); - - /* Stop MCU */ - write_reg(ts_data, 0x0F, 0xE6, 0x0001); - - /* Stop Watchdog */ - write_reg_8bit(ts_data, 0x3C, 0x60, 0x55); - write_reg_8bit(ts_data, 0x3C, 0x61, 0xAA); - - /* cmd */ - write_reg(ts_data, 0x3C, 0xE4, 0xA4AB); - write_reg(ts_data, MSTAR_CHIPTOP_REGISTER_BANK, 0x04, 0x7d60); - - /* TP SW reset */ - write_reg(ts_data, MSTAR_CHIPTOP_REGISTER_BANK, 0x04, 0x829F); - - /* MCU run */ - write_reg(ts_data, 0x0F, 0xE6, 0x0000); - - /* polling 0x3CE4 */ - do { - reg_data = read_reg(ts_data, 0x3C, 0xE4); - } while (reg_data != 0x5B58); - - dbbus_tx_data[0] = 0x72; - dbbus_tx_data[1] = 0x7F; - dbbus_tx_data[2] = 0x55; - dbbus_tx_data[3] = 0x00; - dbbus_tx_data[4] = 0x04; - write_i2c_seq(ts_data, ts_data->client->addr, &dbbus_tx_data[0], 5); - read_i2c_seq(ts_data, ts_data->client->addr, &dbbus_rx_data[0], 4); - if ((dbbus_rx_data[0] >= 0x30 && dbbus_rx_data[0] <= 0x39) - && (dbbus_rx_data[1] >= 0x30 && dbbus_rx_data[1] <= 0x39) - && (dbbus_rx_data[2] >= 0x31 && dbbus_rx_data[2] <= 0x39)) { - main_sw_id = (dbbus_rx_data[0] - 0x30) * 100 + - (dbbus_rx_data[1] - 0x30) * 10 + - (dbbus_rx_data[2] - 0x30); - } - - dbbus_tx_data[0] = 0x72; - dbbus_tx_data[1] = 0x7F; - dbbus_tx_data[2] = 0xFC; - dbbus_tx_data[3] = 0x00; - dbbus_tx_data[4] = 0x04; - write_i2c_seq(ts_data, ts_data->client->addr, &dbbus_tx_data[0], 5); - read_i2c_seq(ts_data, ts_data->client->addr, &dbbus_rx_data[0], 4); - bin_conf_crc32 = (dbbus_rx_data[0] << 24) | - (dbbus_rx_data[1] << 16) | - (dbbus_rx_data[2] << 8) | - (dbbus_rx_data[3]); - - dbbus_tx_data[0] = 0x72; - dbbus_tx_data[1] = 0x83; - dbbus_tx_data[2] = 0x00; - dbbus_tx_data[3] = 0x00; - dbbus_tx_data[4] = 0x04; - write_i2c_seq(ts_data, ts_data->client->addr, &dbbus_tx_data[0], 5); - read_i2c_seq(ts_data, ts_data->client->addr, &dbbus_rx_data[0], 4); - if ((dbbus_rx_data[0] >= 0x30 && dbbus_rx_data[0] <= 0x39) - && (dbbus_rx_data[1] >= 0x30 && dbbus_rx_data[1] <= 0x39) - && (dbbus_rx_data[2] >= 0x31 && dbbus_rx_data[2] <= 0x39)) { - info_sw_id = (dbbus_rx_data[0] - 0x30) * 100 + - (dbbus_rx_data[1] - 0x30) * 10 + - (dbbus_rx_data[2] - 0x30); - } - - dev_dbg(&ts_data->client->dev, - "[21xxA]:main_sw_id = %d, info_sw_id = %d, bin_conf_crc32 = 0x%x\n", - main_sw_id, info_sw_id, bin_conf_crc32); -} - -static ssize_t firmware_update_show(struct device *dev, - struct device_attribute *attr, - char *buf) -{ - struct msg21xx_ts_data *ts_data = dev_get_drvdata(dev); - return snprintf(buf, 3, "%d\n", ts_data->pdata->updating_fw); -} - -static ssize_t firmware_update_store(struct device *dev, - struct device_attribute *attr, - const char *buf, - size_t size) -{ - struct msg21xx_ts_data *ts_data = dev_get_drvdata(dev); - - ts_data->pdata->updating_fw = true; - disable_irq(ts_data->client->irq); - - size = firmware_update_c33(dev, attr, buf, size, EMEM_MAIN, false); - - enable_irq(ts_data->client->irq); - ts_data->pdata->updating_fw = false; - - return size; -} - -static DEVICE_ATTR(update, (S_IRUGO | S_IWUSR), - firmware_update_show, - firmware_update_store); - -static int prepare_fw_data(struct device *dev) -{ - int count; - int i; - int ret; - const struct firmware *fw = NULL; - struct msg21xx_ts_data *ts_data = dev_get_drvdata(dev); - - ret = request_firmware(&fw, ts_data->pdata->fw_name, dev); - if (ret < 0) { - dev_err(dev, "Request firmware failed - %s (%d)\n", - ts_data->pdata->fw_name, ret); - return ret; - } - - count = fw->size / 1024; - - for (i = 0; i < count; i++) - memcpy(fw_bin_data[i], fw->data + (i * 1024), 1024); - - fw_file_major = MSG_FW_FILE_MAJOR_VERSION(fw); - fw_file_minor = MSG_FW_FILE_MINOR_VERSION(fw); - dev_dbg(dev, "New firmware: %d.%d", - fw_file_major, fw_file_minor); - - return fw->size; -} - -static ssize_t firmware_update_smart_store(struct device *dev, - struct device_attribute *attr, - const char *buf, - size_t size) -{ - int ret; - struct msg21xx_ts_data *ts_data = dev_get_drvdata(dev); - - ret = prepare_fw_data(dev); - if (ret < 0) { - dev_err(dev, "Request firmware failed -(%d)\n", ret); - return ret; - } - ts_data->pdata->updating_fw = true; - disable_irq(ts_data->client->irq); - - ret = firmware_update_c33(dev, attr, buf, size, EMEM_MAIN, false); - if (ret == 0) - dev_err(dev, "firmware_update_c33 ret = %d\n", ret); - - enable_irq(ts_data->client->irq); - ts_data->pdata->updating_fw = false; - - return ret; -} - -static ssize_t firmware_force_update_smart_store(struct device *dev, - struct device_attribute *attr, - const char *buf, - size_t size) -{ - int ret; - struct msg21xx_ts_data *ts_data = dev_get_drvdata(dev); - - ret = prepare_fw_data(dev); - if (ret < 0) { - dev_err(dev, "Request firmware failed -(%d)\n", ret); - return ret; - } - ts_data->pdata->updating_fw = true; - disable_irq(ts_data->client->irq); - - ret = firmware_update_c33(dev, attr, buf, size, EMEM_MAIN, true); - if (ret == 0) - dev_err(dev, "firmware_update_c33 et = %d\n", ret); - - enable_irq(ts_data->client->irq); - ts_data->pdata->updating_fw = false; - - return ret; -} - -static DEVICE_ATTR(update_fw, (S_IRUGO | S_IWUSR), - firmware_update_show, - firmware_update_smart_store); - -static DEVICE_ATTR(force_update_fw, (S_IRUGO | S_IWUSR), - firmware_update_show, - firmware_force_update_smart_store); - -static ssize_t firmware_version_show(struct device *dev, - struct device_attribute *attr, - char *buf) -{ - struct msg21xx_ts_data *ts_data = dev_get_drvdata(dev); - msg21xx_read_firmware_id(ts_data); - return snprintf(buf, sizeof(char) * 8, "%03d%03d\n", - ts_data->pdata->fw_version_major, - ts_data->pdata->fw_version_minor); -} - -static DEVICE_ATTR(version, S_IRUGO, - firmware_version_show, - NULL); - - -static ssize_t msg21xx_fw_name_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct msg21xx_ts_data *ts_data = dev_get_drvdata(dev); - return snprintf(buf, MSTAR_FW_NAME_MAX_LEN - 1, - "%s\n", ts_data->pdata->fw_name); -} - -static ssize_t msg21xx_fw_name_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t size) -{ - struct msg21xx_ts_data *ts_data = dev_get_drvdata(dev); - - if (size > MSTAR_FW_NAME_MAX_LEN - 1) - return -EINVAL; - - strlcpy(ts_data->pdata->fw_name, buf, size); - if (ts_data->pdata->fw_name[size - 1] == '\n') - ts_data->pdata->fw_name[size - 1] = 0; - - return size; -} - -static DEVICE_ATTR(fw_name, (S_IRUGO | S_IWUSR), - msg21xx_fw_name_show, msg21xx_fw_name_store); - -static ssize_t firmware_data_store(struct device *dev, - struct device_attribute *attr, - const char *buf, - size_t size) -{ - int count = size / 1024; - int i; - - for (i = 0; i < count; i++) - memcpy(fw_bin_data[i], buf + (i * 1024), 1024); - - if (buf != NULL) - dev_dbg(dev, "buf[0] = %c\n", buf[0]); - - return size; -} - -static DEVICE_ATTR(data, S_IWUSR, NULL, firmware_data_store); - -static ssize_t tp_print_show(struct device *dev, - struct device_attribute *attr, - char *buf) -{ - struct msg21xx_ts_data *ts_data = dev_get_drvdata(dev); - tp_print_proc_read(ts_data); - - return snprintf(buf, 3, "%d\n", ts_data->suspended); -} - -static ssize_t tp_print_store(struct device *dev, - struct device_attribute *attr, - const char *buf, - size_t size) -{ - return size; -} - -static DEVICE_ATTR(tpp, (S_IRUGO | S_IWUSR), - tp_print_show, tp_print_store); - -#ifdef CONFIG_TOUCHSCREEN_PROXIMITY_SENSOR -static void _msg_enable_proximity(void) -{ - unsigned char tx_data[4] = {0}; - - tx_data[0] = 0x52; - tx_data[1] = 0x00; - tx_data[2] = 0x47; - tx_data[3] = 0xa0; - mutex_lock(&msg21xx_mutex); - write_i2c_seq(ts_data->client->addr, &tx_data[0], 4); - mutex_unlock(&msg21xx_mutex); - - bEnableTpProximity = 1; -} - -static void _msg_disable_proximity(void) -{ - unsigned char tx_data[4] = {0}; - - tx_data[0] = 0x52; - tx_data[1] = 0x00; - tx_data[2] = 0x47; - tx_data[3] = 0xa1; - mutex_lock(&msg21xx_mutex); - write_i2c_seq(ts_data->client->addr, &tx_data[0], 4); - mutex_unlock(&msg21xx_mutex); - - bEnableTpProximity = 0; - bFaceClosingTp = 0; -} - -static void tsps_msg21xx_enable(int en) -{ - if (en) - _msg_enable_proximity(); - else - _msg_disable_proximity(); -} - -static int tsps_msg21xx_data(void) -{ - return bFaceClosingTp; -} -#endif - -static int msg21xx_pinctrl_init(struct msg21xx_ts_data *ts_data) -{ - int retval; - - /* Get pinctrl if target uses pinctrl */ - ts_data->ts_pinctrl = devm_pinctrl_get(&(ts_data->client->dev)); - if (IS_ERR_OR_NULL(ts_data->ts_pinctrl)) { - retval = PTR_ERR(ts_data->ts_pinctrl); - dev_dbg(&ts_data->client->dev, - "Target does not use pinctrl %d\n", retval); - goto err_pinctrl_get; - } - - ts_data->pinctrl_state_active = pinctrl_lookup_state( - ts_data->ts_pinctrl, PINCTRL_STATE_ACTIVE); - if (IS_ERR_OR_NULL(ts_data->pinctrl_state_active)) { - retval = PTR_ERR(ts_data->pinctrl_state_active); - dev_dbg(&ts_data->client->dev, - "Can't lookup %s pinstate %d\n", - PINCTRL_STATE_ACTIVE, retval); - goto err_pinctrl_lookup; - } - - ts_data->pinctrl_state_suspend = pinctrl_lookup_state( - ts_data->ts_pinctrl, PINCTRL_STATE_SUSPEND); - if (IS_ERR_OR_NULL(ts_data->pinctrl_state_suspend)) { - retval = PTR_ERR(ts_data->pinctrl_state_suspend); - dev_dbg(&ts_data->client->dev, - "Can't lookup %s pinstate %d\n", - PINCTRL_STATE_SUSPEND, retval); - goto err_pinctrl_lookup; - } - - ts_data->pinctrl_state_release = pinctrl_lookup_state( - ts_data->ts_pinctrl, PINCTRL_STATE_RELEASE); - if (IS_ERR_OR_NULL(ts_data->pinctrl_state_release)) { - retval = PTR_ERR(ts_data->pinctrl_state_release); - dev_dbg(&ts_data->client->dev, - "Can't lookup %s pinstate %d\n", - PINCTRL_STATE_RELEASE, retval); - } - - return 0; - -err_pinctrl_lookup: - devm_pinctrl_put(ts_data->ts_pinctrl); -err_pinctrl_get: - ts_data->ts_pinctrl = NULL; - return retval; -} - -static unsigned char calculate_checksum(unsigned char *msg, int length) -{ - int checksum = 0, i; - - for (i = 0; i < length; i++) - checksum += msg[i]; - - return (unsigned char)((-checksum) & 0xFF); -} - -static int parse_info(struct msg21xx_ts_data *ts_data) -{ - unsigned char data[DEMO_MODE_PACKET_LENGTH] = {0}; - unsigned char checksum = 0; - unsigned int x = 0, y = 0; - unsigned int x2 = 0, y2 = 0; - unsigned int delta_x = 0, delta_y = 0; - - mutex_lock(&msg21xx_mutex); - read_i2c_seq(ts_data, ts_data->client->addr, &data[0], - DEMO_MODE_PACKET_LENGTH); - mutex_unlock(&msg21xx_mutex); - checksum = calculate_checksum(&data[0], (DEMO_MODE_PACKET_LENGTH-1)); - dev_dbg(&ts_data->client->dev, "check sum: [%x] == [%x]?\n", - data[DEMO_MODE_PACKET_LENGTH-1], checksum); - - if (data[DEMO_MODE_PACKET_LENGTH-1] != checksum) { - dev_err(&ts_data->client->dev, "WRONG CHECKSUM\n"); - return -EINVAL; - } - - if (data[0] != 0x52) { - dev_err(&ts_data->client->dev, "WRONG HEADER\n"); - return -EINVAL; - } - - ts_data->info.keycode = 0xFF; - if ((data[1] == 0xFF) && (data[2] == 0xFF) && - (data[3] == 0xFF) && (data[4] == 0xFF) && - (data[6] == 0xFF)) { - if ((data[5] == 0xFF) || (data[5] == 0)) { - ts_data->info.keycode = 0xFF; - } else if ((data[5] == 1) || (data[5] == 2) || - (data[5] == 4) || (data[5] == 8)) { - ts_data->info.keycode = data[5] >> 1; - - dev_dbg(&ts_data->client->dev, - "ts_data->info.keycode index %d\n", - ts_data->info.keycode); - } - #ifdef CONFIG_TOUCHSCREEN_PROXIMITY_SENSOR - else if (bEnableTpProximity && ((data[5] == 0x80) || - (data[5] == 0x40))) { - if (data[5] == 0x80) - bFaceClosingTp = 1; - else if (data[5] == 0x40) - bFaceClosingTp = 0; - - return -EINVAL; - } - #endif - else { - dev_err(&ts_data->client->dev, "WRONG KEY\n"); - return -EINVAL; - } - } else { - x = (((data[1] & 0xF0) << 4) | data[2]); - y = (((data[1] & 0x0F) << 8) | data[3]); - delta_x = (((data[4] & 0xF0) << 4) | data[5]); - delta_y = (((data[4] & 0x0F) << 8) | data[6]); - - if ((delta_x == 0) && (delta_y == 0)) { - ts_data->info.point[0].x = - x * ts_data->pdata->x_max / TPD_WIDTH; - ts_data->info.point[0].y = - y * ts_data->pdata->y_max / TPD_HEIGHT; - ts_data->info.count = 1; - } else { - if (delta_x > 2048) - delta_x -= 4096; - - if (delta_y > 2048) - delta_y -= 4096; - - x2 = (unsigned int)((signed short)x + - (signed short)delta_x); - y2 = (unsigned int)((signed short)y + - (signed short)delta_y); - ts_data->info.point[0].x = - x * ts_data->pdata->x_max / TPD_WIDTH; - ts_data->info.point[0].y = - y * ts_data->pdata->y_max / TPD_HEIGHT; - ts_data->info.point[1].x = - x2 * ts_data->pdata->x_max / TPD_WIDTH; - ts_data->info.point[1].y = - y2 * ts_data->pdata->y_max / TPD_HEIGHT; - ts_data->info.count = ts_data->pdata->num_max_touches; - } - } - - return 0; -} - -static void touch_driver_touch_released(struct msg21xx_ts_data *ts_data) -{ - int i; - - for (i = 0; i < ts_data->pdata->num_max_touches; i++) { - input_mt_slot(ts_data->input_dev, i); - input_mt_report_slot_state(ts_data->input_dev, - MT_TOOL_FINGER, 0); - } - - input_report_key(ts_data->input_dev, BTN_TOUCH, 0); - input_report_key(ts_data->input_dev, BTN_TOOL_FINGER, 0); - input_sync(ts_data->input_dev); -} - -/* read data through I2C then report data to input -sub-system when interrupt occurred */ -static irqreturn_t msg21xx_ts_interrupt(int irq, void *dev_id) -{ - int i = 0; - static int last_keycode = 0xFF; - static int last_count; - struct msg21xx_ts_data *ts_data = dev_id; - - ts_data->info.count = 0; - if (0 == parse_info(ts_data)) { - if (ts_data->info.keycode != 0xFF) { /* key touch pressed */ - if (ts_data->info.keycode < - ts_data->pdata->num_buttons) { - if (ts_data->info.keycode != last_keycode) { - dev_dbg(&ts_data->client->dev, - "key touch pressed"); - - input_report_key(ts_data->input_dev, - BTN_TOUCH, 1); - input_report_key(ts_data->input_dev, - ts_data->pdata->button_map[ - ts_data->info.keycode], 1); - - last_keycode = ts_data->info.keycode; - } else { - /* pass duplicate key-pressing */ - dev_dbg(&ts_data->client->dev, - "REPEATED KEY\n"); - } - } else { - dev_dbg(&ts_data->client->dev, "WRONG KEY\n"); - } - } else { /* key touch released */ - if (last_keycode != 0xFF) { - dev_dbg(&ts_data->client->dev, "key touch released"); - - input_report_key(ts_data->input_dev, - BTN_TOUCH, 0); - input_report_key(ts_data->input_dev, - ts_data->pdata->button_map[last_keycode], - 0); - - last_keycode = 0xFF; - } - } - - if (ts_data->info.count > 0) { /* point touch pressed */ - for (i = 0; i < ts_data->info.count; i++) { - input_mt_slot(ts_data->input_dev, i); - input_mt_report_slot_state(ts_data->input_dev, - MT_TOOL_FINGER, 1); - input_report_abs(ts_data->input_dev, - ABS_MT_TOUCH_MAJOR, 1); - input_report_abs(ts_data->input_dev, - ABS_MT_POSITION_X, - ts_data->info.point[i].x); - input_report_abs(ts_data->input_dev, - ABS_MT_POSITION_Y, - ts_data->info.point[i].y); - } - } - - if (last_count > ts_data->info.count) { - for (i = ts_data->info.count; - i < ts_data->pdata->num_max_touches; - i++) { - input_mt_slot(ts_data->input_dev, i); - input_mt_report_slot_state(ts_data->input_dev, - MT_TOOL_FINGER, 0); - } - } - last_count = ts_data->info.count; - - input_report_key(ts_data->input_dev, BTN_TOUCH, - ts_data->info.count > 0); - input_report_key(ts_data->input_dev, BTN_TOOL_FINGER, - ts_data->info.count > 0); - - input_sync(ts_data->input_dev); - } - - return IRQ_HANDLED; -} - -static int msg21xx_ts_power_init(struct msg21xx_ts_data *ts_data, bool init) -{ - int rc; - - if (init) { - ts_data->vdd = regulator_get(&ts_data->client->dev, - "vdd"); - if (IS_ERR(ts_data->vdd)) { - rc = PTR_ERR(ts_data->vdd); - dev_err(&ts_data->client->dev, - "Regulator get failed vdd rc=%d\n", rc); - return rc; - } - - if (regulator_count_voltages(ts_data->vdd) > 0) { - rc = regulator_set_voltage(ts_data->vdd, - MSTAR_VTG_MIN_UV, - MSTAR_VTG_MAX_UV); - if (rc) { - dev_err(&ts_data->client->dev, - "Regulator set_vtg failed vdd rc=%d\n", - rc); - goto reg_vdd_put; - } - } - - ts_data->vcc_i2c = regulator_get(&ts_data->client->dev, - "vcc_i2c"); - if (IS_ERR(ts_data->vcc_i2c)) { - rc = PTR_ERR(ts_data->vcc_i2c); - dev_err(&ts_data->client->dev, - "Regulator get failed vcc_i2c rc=%d\n", rc); - goto reg_vdd_set_vtg; - } - - if (regulator_count_voltages(ts_data->vcc_i2c) > 0) { - rc = regulator_set_voltage(ts_data->vcc_i2c, - MSTAR_I2C_VTG_MIN_UV, - MSTAR_I2C_VTG_MAX_UV); - if (rc) { - dev_err(&ts_data->client->dev, - "Regulator set_vtg failed vcc_i2c rc=%d\n", rc); - goto reg_vcc_i2c_put; - } - } - } else { - if (regulator_count_voltages(ts_data->vdd) > 0) - regulator_set_voltage(ts_data->vdd, 0, - MSTAR_VTG_MAX_UV); - - regulator_put(ts_data->vdd); - - if (regulator_count_voltages(ts_data->vcc_i2c) > 0) - regulator_set_voltage(ts_data->vcc_i2c, 0, - MSTAR_I2C_VTG_MAX_UV); - - regulator_put(ts_data->vcc_i2c); - } - - return 0; - -reg_vcc_i2c_put: - regulator_put(ts_data->vcc_i2c); -reg_vdd_set_vtg: - if (regulator_count_voltages(ts_data->vdd) > 0) - regulator_set_voltage(ts_data->vdd, 0, MSTAR_VTG_MAX_UV); -reg_vdd_put: - regulator_put(ts_data->vdd); - return rc; -} - -static int msg21xx_ts_power_on(struct msg21xx_ts_data *ts_data, bool on) -{ - int rc; - - if (!on) - goto power_off; - - rc = regulator_enable(ts_data->vdd); - if (rc) { - dev_err(&ts_data->client->dev, - "Regulator vdd enable failed rc=%d\n", rc); - return rc; - } - - rc = regulator_enable(ts_data->vcc_i2c); - if (rc) { - dev_err(&ts_data->client->dev, - "Regulator vcc_i2c enable failed rc=%d\n", rc); - regulator_disable(ts_data->vdd); - } - - return rc; - -power_off: - rc = regulator_disable(ts_data->vdd); - if (rc) { - dev_err(&ts_data->client->dev, - "Regulator vdd disable failed rc=%d\n", rc); - return rc; - } - - rc = regulator_disable(ts_data->vcc_i2c); - if (rc) { - dev_err(&ts_data->client->dev, - "Regulator vcc_i2c disable failed rc=%d\n", rc); - rc = regulator_enable(ts_data->vdd); - } - - return rc; -} - -static int msg21xx_ts_gpio_configure(struct msg21xx_ts_data *ts_data, bool on) -{ - int ret = 0; - - if (!on) - goto pwr_deinit; - - if (gpio_is_valid(ts_data->pdata->irq_gpio)) { - ret = gpio_request(ts_data->pdata->irq_gpio, - "msg21xx_irq_gpio"); - if (ret) { - dev_err(&ts_data->client->dev, - "Failed to request GPIO[%d], %d\n", - ts_data->pdata->irq_gpio, ret); - goto err_irq_gpio_req; - } - ret = gpio_direction_input(ts_data->pdata->irq_gpio); - if (ret) { - dev_err(&ts_data->client->dev, - "Failed to set direction for gpio[%d], %d\n", - ts_data->pdata->irq_gpio, ret); - goto err_irq_gpio_dir; - } - gpio_set_value_cansleep(ts_data->pdata->irq_gpio, 1); - } else { - dev_err(&ts_data->client->dev, "irq gpio not provided\n"); - goto err_irq_gpio_req; - } - - if (gpio_is_valid(ts_data->pdata->reset_gpio)) { - ret = gpio_request(ts_data->pdata->reset_gpio, - "msg21xx_reset_gpio"); - if (ret) { - dev_err(&ts_data->client->dev, - "Failed to request GPIO[%d], %d\n", - ts_data->pdata->reset_gpio, ret); - goto err_reset_gpio_req; - } - - /* power on TP */ - ret = gpio_direction_output( - ts_data->pdata->reset_gpio, 1); - if (ret) { - dev_err(&ts_data->client->dev, - "Failed to set direction for GPIO[%d], %d\n", - ts_data->pdata->reset_gpio, ret); - goto err_reset_gpio_dir; - } - msleep(100); - gpio_set_value_cansleep(ts_data->pdata->reset_gpio, 0); - msleep(20); - gpio_set_value_cansleep(ts_data->pdata->reset_gpio, 1); - msleep(200); - } else { - dev_err(&ts_data->client->dev, "reset gpio not provided\n"); - goto err_reset_gpio_req; - } - - return 0; - -err_reset_gpio_dir: - if (gpio_is_valid(ts_data->pdata->reset_gpio)) - gpio_free(ts_data->pdata->irq_gpio); -err_reset_gpio_req: -err_irq_gpio_dir: - if (gpio_is_valid(ts_data->pdata->irq_gpio)) - gpio_free(ts_data->pdata->irq_gpio); -err_irq_gpio_req: - return ret; - -pwr_deinit: - if (gpio_is_valid(ts_data->pdata->irq_gpio)) - gpio_free(ts_data->pdata->irq_gpio); - if (gpio_is_valid(ts_data->pdata->reset_gpio)) { - gpio_set_value_cansleep(ts_data->pdata->reset_gpio, 0); - ret = gpio_direction_input(ts_data->pdata->reset_gpio); - if (ret) - dev_err(&ts_data->client->dev, - "Unable to set direction for gpio [%d]\n", - ts_data->pdata->reset_gpio); - gpio_free(ts_data->pdata->reset_gpio); - } - return 0; -} - -#ifdef CONFIG_PM -static int msg21xx_ts_resume(struct device *dev) -{ - int retval; - struct msg21xx_ts_data *ts_data = dev_get_drvdata(dev); - - if (!ts_data->suspended) { - dev_info(dev, "msg21xx_ts already in resume\n"); - return 0; - } - - mutex_lock(&ts_data->ts_mutex); - - retval = msg21xx_ts_power_on(ts_data, true); - if (retval) { - dev_err(dev, "msg21xx_ts power on failed"); - mutex_unlock(&ts_data->ts_mutex); - return retval; - } - - if (ts_data->ts_pinctrl) { - retval = pinctrl_select_state(ts_data->ts_pinctrl, - ts_data->pinctrl_state_active); - if (retval < 0) { - dev_err(dev, "Cannot get active pinctrl state\n"); - mutex_unlock(&ts_data->ts_mutex); - return retval; - } - } - - retval = msg21xx_ts_gpio_configure(ts_data, true); - if (retval) { - dev_err(dev, "Failed to put gpios in active state %d", - retval); - mutex_unlock(&ts_data->ts_mutex); - return retval; - } - - enable_irq(ts_data->client->irq); - ts_data->suspended = false; - - mutex_unlock(&ts_data->ts_mutex); - - return 0; -} - -static int msg21xx_ts_suspend(struct device *dev) -{ - int retval; - struct msg21xx_ts_data *ts_data = dev_get_drvdata(dev); - - if (ts_data->pdata->updating_fw) { - dev_info(dev, "Firmware loading in progress\n"); - return 0; - } - - if (ts_data->suspended) { - dev_info(dev, "msg21xx_ts already in suspend\n"); - return 0; - } - -#ifdef CONFIG_TOUCHSCREEN_PROXIMITY_SENSOR - if (bEnableTpProximity) { - dev_dbg(dev, "suspend bEnableTpProximity=%d\n", - bEnableTpProximity); - return 0; - } -#endif - - mutex_lock(&ts_data->ts_mutex); - - disable_irq(ts_data->client->irq); - - touch_driver_touch_released(ts_data); - - if (ts_data->ts_pinctrl) { - retval = pinctrl_select_state(ts_data->ts_pinctrl, - ts_data->pinctrl_state_suspend); - if (retval < 0) { - dev_err(dev, "Cannot get idle pinctrl state %d\n", - retval); - mutex_unlock(&ts_data->ts_mutex); - return retval; - } - } - - retval = msg21xx_ts_gpio_configure(ts_data, false); - if (retval) { - dev_err(dev, "Failed to put gpios in idle state %d", - retval); - mutex_unlock(&ts_data->ts_mutex); - return retval; - } - - retval = msg21xx_ts_power_on(ts_data, false); - if (retval) { - dev_err(dev, "msg21xx_ts power off failed"); - mutex_unlock(&ts_data->ts_mutex); - return retval; - } - - ts_data->suspended = true; - - mutex_unlock(&ts_data->ts_mutex); - - return 0; -} -#else -static int msg21xx_ts_resume(struct device *dev) -{ - return 0; -} -static int msg21xx_ts_suspend(struct device *dev) -{ - return 0; -} -#endif - -static int msg21xx_debug_suspend_set(void *_data, u64 val) -{ - struct msg21xx_ts_data *data = _data; - - mutex_lock(&data->input_dev->mutex); - - if (val) - msg21xx_ts_suspend(&data->client->dev); - else - msg21xx_ts_resume(&data->client->dev); - - mutex_unlock(&data->input_dev->mutex); - - return 0; -} - -static int msg21xx_debug_suspend_get(void *_data, u64 *val) -{ - struct msg21xx_ts_data *data = _data; - - mutex_lock(&data->input_dev->mutex); - *val = data->suspended; - mutex_unlock(&data->input_dev->mutex); - - return 0; -} - -DEFINE_SIMPLE_ATTRIBUTE(debug_suspend_fops, msg21xx_debug_suspend_get, - msg21xx_debug_suspend_set, "%lld\n"); - - -#if defined(CONFIG_FB) -static int fb_notifier_callback(struct notifier_block *self, - unsigned long event, void *data) -{ - struct fb_event *evdata = data; - int *blank; - struct msg21xx_ts_data *ts_data = - container_of(self, struct msg21xx_ts_data, fb_notif); - - if (evdata && evdata->data && event == FB_EVENT_BLANK) { - blank = evdata->data; - if (*blank == FB_BLANK_UNBLANK) - msg21xx_ts_resume(&ts_data->client->dev); - else if (*blank == FB_BLANK_POWERDOWN) - msg21xx_ts_suspend(&ts_data->client->dev); - } - - return 0; -} -#endif - -static int msg21xx_get_dt_coords(struct device *dev, char *name, - struct msg21xx_ts_platform_data *pdata) -{ - u32 coords[FT_COORDS_ARR_SIZE]; - struct property *prop; - struct device_node *np = dev->of_node; - int coords_size, rc; - - prop = of_find_property(np, name, NULL); - if (!prop) - return -EINVAL; - if (!prop->value) - return -ENODATA; - - coords_size = prop->length / sizeof(u32); - if (coords_size != FT_COORDS_ARR_SIZE) { - dev_err(dev, "invalid %s\n", name); - return -EINVAL; - } - - rc = of_property_read_u32_array(np, name, coords, coords_size); - if (rc && (rc != -EINVAL)) { - dev_err(dev, "Unable to read %s\n", name); - return rc; - } - - if (!strcmp(name, "mstar,panel-coords")) { - pdata->panel_minx = coords[0]; - pdata->panel_miny = coords[1]; - pdata->panel_maxx = coords[2]; - pdata->panel_maxy = coords[3]; - } else if (!strcmp(name, "mstar,display-coords")) { - pdata->x_min = coords[0]; - pdata->y_min = coords[1]; - pdata->x_max = coords[2]; - pdata->y_max = coords[3]; - } else { - dev_err(dev, "unsupported property %s\n", name); - return -EINVAL; - } - - return 0; -} - -static int msg21xx_parse_dt(struct device *dev, - struct msg21xx_ts_platform_data *pdata) -{ - int rc; - struct device_node *np = dev->of_node; - struct property *prop; - u32 temp_val; - - rc = msg21xx_get_dt_coords(dev, "mstar,panel-coords", pdata); - if (rc && (rc != -EINVAL)) - return rc; - - rc = msg21xx_get_dt_coords(dev, "mstar,display-coords", pdata); - if (rc) - return rc; - - rc = of_property_read_u32(np, "mstar,hard-reset-delay-ms", - &temp_val); - if (!rc) - pdata->hard_reset_delay_ms = temp_val; - else - return rc; - - rc = of_property_read_u32(np, "mstar,post-hard-reset-delay-ms", - &temp_val); - if (!rc) - pdata->post_hard_reset_delay_ms = temp_val; - else - return rc; - - /* reset, irq gpio info */ - pdata->reset_gpio = of_get_named_gpio_flags(np, "mstar,reset-gpio", - 0, &pdata->reset_gpio_flags); - if (pdata->reset_gpio < 0) - return pdata->reset_gpio; - - pdata->irq_gpio = of_get_named_gpio_flags(np, "mstar,irq-gpio", - 0, &pdata->irq_gpio_flags); - if (pdata->irq_gpio < 0) - return pdata->irq_gpio; - - rc = of_property_read_u32(np, "mstar,ic-type", &temp_val); - if (rc && (rc != -EINVAL)) - return rc; - - pdata->ic_type = temp_val; - - rc = of_property_read_u32(np, "mstar,num-max-touches", &temp_val); - if (!rc) - pdata->num_max_touches = temp_val; - else - return rc; - - prop = of_find_property(np, "mstar,button-map", NULL); - if (prop) { - pdata->num_buttons = prop->length / sizeof(temp_val); - if (pdata->num_buttons > MAX_BUTTONS) - return -EINVAL; - - rc = of_property_read_u32_array(np, - "mstar,button-map", pdata->button_map, - pdata->num_buttons); - if (rc) { - dev_err(dev, "Unable to read key codes\n"); - return rc; - } - } - - return 0; -} - -/* probe function is used for matching and initializing input device */ -static int msg21xx_ts_probe(struct i2c_client *client, - const struct i2c_device_id *id) { - - int ret = 0, i; - struct dentry *temp, *dir; - struct input_dev *input_dev; - struct msg21xx_ts_data *ts_data; - struct msg21xx_ts_platform_data *pdata; - - if (client->dev.of_node) { - pdata = devm_kzalloc(&client->dev, - sizeof(struct msg21xx_ts_platform_data), GFP_KERNEL); - if (!pdata) { - dev_err(&client->dev, "Failed to allocate memory\n"); - return -ENOMEM; - } - - ret = msg21xx_parse_dt(&client->dev, pdata); - if (ret) { - dev_err(&client->dev, "DT parsing failed\n"); - return ret; - } - } else - pdata = client->dev.platform_data; - - if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) { - dev_err(&client->dev, "I2C not supported\n"); - return -ENODEV; - } - - ts_data = devm_kzalloc(&client->dev, - sizeof(struct msg21xx_ts_data), GFP_KERNEL); - if (!ts_data) { - dev_err(&client->dev, "Not enough memory\n"); - return -ENOMEM; - } - - ts_data->client = client; - ts_data->info.point = devm_kzalloc(&client->dev, - sizeof(struct touchPoint_t) * pdata->num_max_touches, - GFP_KERNEL); - if (!ts_data->info.point) { - dev_err(&client->dev, "Not enough memory\n"); - return -ENOMEM; - } - - /* allocate an input device */ - input_dev = input_allocate_device(); - if (!input_dev) { - ret = -ENOMEM; - dev_err(&client->dev, "input device allocation failed\n"); - goto err_input_allocate_dev; - } - - input_dev->name = client->name; - input_dev->phys = "I2C"; - input_dev->dev.parent = &client->dev; - input_dev->id.bustype = BUS_I2C; - - ts_data->input_dev = input_dev; - ts_data->client = client; - ts_data->pdata = pdata; - - input_set_drvdata(input_dev, ts_data); - i2c_set_clientdata(client, ts_data); - - ret = msg21xx_ts_power_init(ts_data, true); - if (ret) { - dev_err(&client->dev, "Mstar power init failed\n"); - return ret; - } - - ret = msg21xx_ts_power_on(ts_data, true); - if (ret) { - dev_err(&client->dev, "Mstar power on failed\n"); - goto exit_deinit_power; - } - - ret = msg21xx_pinctrl_init(ts_data); - if (!ret && ts_data->ts_pinctrl) { - /* - * Pinctrl handle is optional. If pinctrl handle is found - * let pins to be configured in active state. If not - * found continue further without error. - */ - ret = pinctrl_select_state(ts_data->ts_pinctrl, - ts_data->pinctrl_state_active); - if (ret < 0) - dev_err(&client->dev, - "Failed to select %s pinatate %d\n", - PINCTRL_STATE_ACTIVE, ret); - } - - ret = msg21xx_ts_gpio_configure(ts_data, true); - if (ret) { - dev_err(&client->dev, "Failed to configure gpio %d\n", ret); - goto exit_gpio_config; - } - - if (msg21xx_get_ic_type(ts_data) == 0) { - dev_err(&client->dev, "The current IC is not Mstar\n"); - ret = -1; - goto err_wrong_ic_type; - } - - mutex_init(&msg21xx_mutex); - mutex_init(&ts_data->ts_mutex); - - /* set the supported event type for input device */ - set_bit(EV_ABS, input_dev->evbit); - set_bit(EV_SYN, input_dev->evbit); - set_bit(EV_KEY, input_dev->evbit); - set_bit(BTN_TOUCH, input_dev->keybit); - set_bit(BTN_TOOL_FINGER, input_dev->keybit); - set_bit(INPUT_PROP_DIRECT, input_dev->propbit); - - for (i = 0; i < pdata->num_buttons; i++) - input_set_capability(input_dev, EV_KEY, pdata->button_map[i]); - - input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR, 0, 2, 0, 0); - input_set_abs_params(input_dev, ABS_MT_POSITION_X, - 0, pdata->x_max, 0, 0); - input_set_abs_params(input_dev, ABS_MT_POSITION_Y, - 0, pdata->y_max, 0, 0); - ret = input_mt_init_slots(input_dev, pdata->num_max_touches, 0); - if (ret) { - dev_err(&client->dev, - "Error %d initialising slots\n", ret); - goto err_free_mem; - } - - /* register the input device to input sub-system */ - ret = input_register_device(input_dev); - if (ret < 0) { - dev_err(&client->dev, - "Unable to register ms-touchscreen input device\n"); - goto err_input_reg_dev; - } - - /* version */ - if (device_create_file(&client->dev, &dev_attr_version) < 0) { - dev_err(&client->dev, - "Failed to create device file(%s)!\n", - dev_attr_version.attr.name); - goto err_create_fw_ver_file; - } - /* update */ - if (device_create_file(&client->dev, &dev_attr_update) < 0) { - dev_err(&client->dev, - "Failed to create device file(%s)!\n", - dev_attr_update.attr.name); - goto err_create_fw_update_file; - } - /* data */ - if (device_create_file(&client->dev, &dev_attr_data) < 0) { - dev_err(&client->dev, - "Failed to create device file(%s)!\n", - dev_attr_data.attr.name); - goto err_create_fw_data_file; - } - /* fw name */ - if (device_create_file(&client->dev, &dev_attr_fw_name) < 0) { - dev_err(&client->dev, - "Failed to create device file(%s)!\n", - dev_attr_fw_name.attr.name); - goto err_create_fw_name_file; - } - /* smart fw update */ - if (device_create_file(&client->dev, &dev_attr_update_fw) < 0) { - dev_err(&client->dev, - "Failed to create device file(%s)!\n", - dev_attr_update_fw.attr.name); - goto err_create_update_fw_file; - } - /* smart fw force update */ - if (device_create_file(&client->dev, - &dev_attr_force_update_fw) < 0) { - dev_err(&client->dev, - "Failed to create device file(%s)!\n", - dev_attr_force_update_fw.attr.name); - goto err_create_force_update_fw_file; - } - dir = debugfs_create_dir(MSTAR_DEBUG_DIR_NAME, NULL); - temp = debugfs_create_file("suspend", S_IRUSR | S_IWUSR, dir, - ts_data, &debug_suspend_fops); - if (temp == NULL || IS_ERR(temp)) { - dev_err(&client->dev, - "debugfs_create_file failed: rc=%ld\n", PTR_ERR(temp)); - goto free_debug_dir; - } - -#ifdef TP_PRINT - tp_print_create_entry(ts_data); -#endif - - ret = request_threaded_irq(client->irq, NULL, - msg21xx_ts_interrupt, - pdata->irq_gpio_flags | IRQF_ONESHOT, - "msg21xx", ts_data); - if (ret) - goto err_req_irq; - - disable_irq(client->irq); - -#if defined(CONFIG_FB) - ts_data->fb_notif.notifier_call = fb_notifier_callback; - ret = fb_register_client(&ts_data->fb_notif); -#endif - -#ifdef CONFIG_TOUCHSCREEN_PROXIMITY_SENSOR - tsps_assist_register_callback("msg21xx", &tsps_msg21xx_enable, - &tsps_msg21xx_data); -#endif - - dev_dbg(&client->dev, "mstar touch screen registered\n"); - enable_irq(client->irq); - return 0; - -err_req_irq: - free_irq(client->irq, ts_data); - device_remove_file(&client->dev, &dev_attr_data); -free_debug_dir: - debugfs_remove_recursive(dir); -err_create_fw_data_file: - device_remove_file(&client->dev, &dev_attr_update); -err_create_fw_update_file: - device_remove_file(&client->dev, &dev_attr_version); -err_create_fw_name_file: - device_remove_file(&client->dev, &dev_attr_fw_name); -err_create_update_fw_file: - device_remove_file(&client->dev, &dev_attr_update_fw); -err_create_force_update_fw_file: - device_remove_file(&client->dev, &dev_attr_force_update_fw); -err_create_fw_ver_file: - input_unregister_device(input_dev); - -err_input_reg_dev: - input_free_device(input_dev); - input_dev = NULL; -err_input_allocate_dev: - mutex_destroy(&msg21xx_mutex); - mutex_destroy(&ts_data->ts_mutex); - -err_wrong_ic_type: - msg21xx_ts_gpio_configure(ts_data, false); -exit_gpio_config: - if (ts_data->ts_pinctrl) { - if (IS_ERR_OR_NULL(ts_data->pinctrl_state_release)) { - devm_pinctrl_put(ts_data->ts_pinctrl); - ts_data->ts_pinctrl = NULL; - } else { - ret = pinctrl_select_state(ts_data->ts_pinctrl, - ts_data->pinctrl_state_release); - if (ret < 0) - dev_err(&ts_data->client->dev, - "Cannot get release pinctrl state\n"); - } - } - msg21xx_ts_power_on(ts_data, false); -exit_deinit_power: - msg21xx_ts_power_init(ts_data, false); -err_free_mem: - input_free_device(input_dev); - - return ret; -} - -/* remove function is triggered when the input device is removed -from input sub-system */ -static int touch_driver_remove(struct i2c_client *client) -{ - int retval = 0; - struct msg21xx_ts_data *ts_data = i2c_get_clientdata(client); - - free_irq(ts_data->client->irq, ts_data); - gpio_free(ts_data->pdata->irq_gpio); - gpio_free(ts_data->pdata->reset_gpio); - - if (ts_data->ts_pinctrl) { - if (IS_ERR_OR_NULL(ts_data->pinctrl_state_release)) { - devm_pinctrl_put(ts_data->ts_pinctrl); - ts_data->ts_pinctrl = NULL; - } else { - retval = pinctrl_select_state(ts_data->ts_pinctrl, - ts_data->pinctrl_state_release); - if (retval < 0) - dev_err(&ts_data->client->dev, - "Cannot get release pinctrl state\n"); - } - } - - input_unregister_device(ts_data->input_dev); - mutex_destroy(&msg21xx_mutex); - mutex_destroy(&ts_data->ts_mutex); - - return retval; -} - -/* The I2C device list is used for matching I2C device -and I2C device driver. */ -static const struct i2c_device_id touch_device_id[] = { - {"msg21xx", 0}, - {}, /* should not omitted */ -}; - -static struct of_device_id msg21xx_match_table[] = { - { .compatible = "mstar,msg21xx", }, - { }, -}; - -MODULE_DEVICE_TABLE(i2c, touch_device_id); - -static struct i2c_driver touch_device_driver = { - .driver = { - .name = "ms-msg21xx", - .owner = THIS_MODULE, - .of_match_table = msg21xx_match_table, - }, - .probe = msg21xx_ts_probe, - .remove = touch_driver_remove, - .id_table = touch_device_id, -}; - -module_i2c_driver(touch_device_driver); - -#ifdef TP_PRINT -#include - -static unsigned short InfoAddr = 0x0F, PoolAddr = 0x10, TransLen = 256; -static unsigned char row, units, cnt; - -static int tp_print_proc_read(struct msg21xx_ts_data *ts_data) -{ - unsigned short i, j; - unsigned short left, offset = 0; - unsigned char dbbus_tx_data[3] = {0}; - unsigned char u8Data; - signed short s16Data; - int s32Data; - char *buf = NULL; - - left = cnt*row*units; - if ((ts_data->suspended == 0) && - (InfoAddr != 0x0F) && - (PoolAddr != 0x10) && - (left > 0)) { - buf = kmalloc(left, GFP_KERNEL); - if (buf != NULL) { - - while (left > 0) { - dbbus_tx_data[0] = 0x53; - dbbus_tx_data[1] = ((PoolAddr + offset) >> 8) - & 0xFF; - dbbus_tx_data[2] = (PoolAddr + offset) & 0xFF; - mutex_lock(&msg21xx_mutex); - write_i2c_seq(ts_data, ts_data->client->addr, - &dbbus_tx_data[0], 3); - read_i2c_seq(ts_data, ts_data->client->addr, - &buf[offset], - left > TransLen ? TransLen : left); - mutex_unlock(&msg21xx_mutex); - - if (left > TransLen) { - left -= TransLen; - offset += TransLen; - } else { - left = 0; - } - } - - for (i = 0; i < cnt; i++) { - for (j = 0; j < row; j++) { - if (units == 1) { - u8Data = buf[i * row * units + - j * units]; - } else if (units == 2) { - s16Data = buf[i * row * units + - j * units] + - (buf[i * row * units + - j * units + 1] << 8); - } else if (units == 4) { - s32Data = buf[i * row * units + - j * units] + - (buf[i * row * units + - j * units + 1] << 8) + - (buf[i * row * units + - j * units + 2] << 16) + - (buf[i * row * units + - j * units + 3] << 24); - } - } - } - - kfree(buf); - } - } - - return 0; -} - -static void tp_print_create_entry(struct msg21xx_ts_data *ts_data) -{ - unsigned char dbbus_tx_data[3] = {0}; - unsigned char dbbus_rx_data[8] = {0}; - - dbbus_tx_data[0] = 0x53; - dbbus_tx_data[1] = 0x00; - dbbus_tx_data[2] = 0x58; - mutex_lock(&msg21xx_mutex); - write_i2c_seq(ts_data, ts_data->client->addr, &dbbus_tx_data[0], 3); - read_i2c_seq(ts_data, ts_data->client->addr, &dbbus_rx_data[0], 4); - mutex_unlock(&msg21xx_mutex); - InfoAddr = (dbbus_rx_data[1]<<8) + dbbus_rx_data[0]; - PoolAddr = (dbbus_rx_data[3]<<8) + dbbus_rx_data[2]; - - if ((InfoAddr != 0x0F) && (PoolAddr != 0x10)) { - msleep(20); - dbbus_tx_data[0] = 0x53; - dbbus_tx_data[1] = (InfoAddr >> 8) & 0xFF; - dbbus_tx_data[2] = InfoAddr & 0xFF; - mutex_lock(&msg21xx_mutex); - write_i2c_seq(ts_data, ts_data->client->addr, - &dbbus_tx_data[0], 3); - read_i2c_seq(ts_data, ts_data->client->addr, - &dbbus_rx_data[0], 8); - mutex_unlock(&msg21xx_mutex); - - units = dbbus_rx_data[0]; - row = dbbus_rx_data[1]; - cnt = dbbus_rx_data[2]; - TransLen = (dbbus_rx_data[7]<<8) + dbbus_rx_data[6]; - - if (device_create_file(&ts_data->client->dev, - &dev_attr_tpp) < 0) - dev_err(&ts_data->client->dev, "Failed to create device file(%s)!\n", - dev_attr_tpp.attr.name); - } -} -#endif - -MODULE_AUTHOR("MStar Semiconductor, Inc."); -MODULE_LICENSE("GPL v2"); diff --git a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c index 82ad5673ac295..2eea4a214e305 100644 --- a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c +++ b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c @@ -89,6 +89,7 @@ #define MIN_SLEEP_TIME_US 50 #define MAX_SLEEP_TIME_US 100 +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS static ssize_t fwu_sysfs_show_image(struct file *data_file, struct kobject *kobj, struct bin_attribute *attributes, char *buf, loff_t pos, size_t count); @@ -144,6 +145,7 @@ static ssize_t fwu_sysfs_config_id_show(struct device *dev, static ssize_t fwu_sysfs_package_id_show(struct device *dev, struct device_attribute *attr, char *buf); +#endif enum bl_version { V5 = 5, @@ -283,6 +285,7 @@ struct synaptics_rmi4_fwu_handle { struct synaptics_rmi4_data *rmi4_data; }; +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS static struct bin_attribute dev_attr_data = { .attr = { .name = "data", @@ -292,9 +295,11 @@ static struct bin_attribute dev_attr_data = { .read = fwu_sysfs_show_image, .write = fwu_sysfs_store_image, }; +#endif static struct device_attribute attrs[] = { +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS __ATTR(force_update_fw, S_IWUSR | S_IWGRP, NULL, fwu_sysfs_force_reflash_store), @@ -340,6 +345,7 @@ static struct device_attribute attrs[] = { __ATTR(package_id, S_IRUGO, fwu_sysfs_package_id_show, synaptics_rmi4_store_error), +#endif }; static struct synaptics_rmi4_fwu_handle *fwu; @@ -1144,6 +1150,7 @@ static int fwu_do_write_config(void) return retval; } +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS static int fwu_start_write_config(void) { int retval; @@ -1319,6 +1326,7 @@ static int fwu_do_read_config(void) return retval; } +#endif static int fwu_do_lockdown(void) { @@ -1509,6 +1517,7 @@ int synaptics_dsx_fw_updater(unsigned char *fw_data) } EXPORT_SYMBOL(synaptics_dsx_fw_updater); +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS static ssize_t fwu_sysfs_show_image(struct file *data_file, struct kobject *kobj, struct bin_attribute *attributes, char *buf, loff_t pos, size_t count) @@ -1896,6 +1905,7 @@ static ssize_t fwu_sysfs_package_id_show(struct device *dev, (package_id[1] << 8) | package_id[0], (package_id[3] << 8) | package_id[2]); } +#endif static void synaptics_rmi4_fwu_attn(struct synaptics_rmi4_data *rmi4_data, unsigned char intr_mask) @@ -1969,6 +1979,7 @@ static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data) fwu->do_lockdown = DO_LOCKDOWN; fwu->initialized = true; +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS retval = sysfs_create_bin_file(&rmi4_data->input_dev->dev.kobj, &dev_attr_data); if (retval < 0) { @@ -1977,6 +1988,7 @@ static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data) __func__); goto exit_free_fwu; } +#endif for (attr_count = 0; attr_count < ARRAY_SIZE(attrs); attr_count++) { retval = sysfs_create_file(&rmi4_data->input_dev->dev.kobj, @@ -1998,7 +2010,9 @@ static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data) &attrs[attr_count].attr); } +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS sysfs_remove_bin_file(&rmi4_data->input_dev->dev.kobj, &dev_attr_data); +#endif exit_free_fwu: kfree(fwu); @@ -2020,7 +2034,9 @@ static void synaptics_rmi4_fwu_remove(struct synaptics_rmi4_data *rmi4_data) &attrs[attr_count].attr); } +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS sysfs_remove_bin_file(&rmi4_data->input_dev->dev.kobj, &dev_attr_data); +#endif kfree(fwu->read_config_buf); kfree(fwu); diff --git a/drivers/input/touchscreen/synaptics_fw_update.c b/drivers/input/touchscreen/synaptics_fw_update.c index c25a47528c417..cac9c7a29a19c 100644 --- a/drivers/input/touchscreen/synaptics_fw_update.c +++ b/drivers/input/touchscreen/synaptics_fw_update.c @@ -258,6 +258,7 @@ struct synaptics_rmi4_fwu_handle { bool interrupt_flag; bool polling_mode; char product_id[SYNAPTICS_RMI4_PRODUCT_ID_SIZE + 1]; + unsigned int full_update_size; unsigned int image_size; unsigned int data_pos; unsigned char intr_mask; @@ -297,6 +298,22 @@ static struct synaptics_rmi4_fwu_handle *fwu; DECLARE_COMPLETION(fwu_remove_complete); DEFINE_MUTEX(fwu_sysfs_mutex); +/* Check offset + size <= bound. 1 if in bounds, 0 otherwise. */ +static bool in_bounds(unsigned long offset, + unsigned long size, + unsigned long bound) +{ + if (offset > bound || size > bound) { + pr_err("%s: %lu or %lu > %lu\n", __func__, offset, size, bound); + return 0; + } + if (offset > (bound - size)) { + pr_err("%s: %lu > %lu - %lu\n", __func__, offset, size, bound); + return 0; + } + return 1; +} + static unsigned int extract_uint(const unsigned char *ptr) { return (unsigned int)ptr[0] + @@ -333,11 +350,17 @@ static void synaptics_rmi4_update_debug_info(void) pkg_id[3] << 8 | pkg_id[2], build_id); } -static void parse_header(void) +static int parse_header(void) { struct image_content *img = &fwu->image_content; struct image_header_data *data = (struct image_header_data *)fwu->data_buffer; + if (fwu->full_update_size < sizeof(*data)) { + dev_err(&fwu->rmi4_data->i2c_client->dev, + "Provided update too small"); + return -EINVAL; + } + img->checksum = extract_uint(data->file_checksum); img->bootloader_version = data->bootloader_version; img->image_size = extract_uint(data->firmware_size); @@ -374,12 +397,29 @@ static void parse_header(void) img->config_size); /* get UI firmware offset */ - if (img->image_size) + if (img->image_size) { + if (!in_bounds(FW_IMAGE_OFFSET, img->image_size, + fwu->full_update_size)) { + dev_err(&fwu->rmi4_data->i2c_client->dev, + "%s: image size out of bounds\n", + __func__); + return -EINVAL; + } img->firmware_data = fwu->data_buffer + FW_IMAGE_OFFSET; + } /* get config offset*/ - if (img->config_size) + if (img->config_size) { + // FW_IMAGE_OFFSET + image_size was ok as above + if (!in_bounds(FW_IMAGE_OFFSET + img->image_size, + img->config_size, fwu->full_update_size)) { + dev_err(&fwu->rmi4_data->i2c_client->dev, + "%s: config size out of bounds\n", + __func__); + return -EINVAL; + } img->config_data = fwu->data_buffer + FW_IMAGE_OFFSET + img->image_size; + } /* get lockdown offset*/ switch (img->bootloader_version) { case 3: @@ -398,6 +438,14 @@ static void parse_header(void) img->lockdown_data = NULL; } + if (img->lockdown_block_count * fwu->block_size > FW_IMAGE_OFFSET) { + dev_err(&fwu->rmi4_data->i2c_client->dev, + "%s: lockdown size too big\n", + __func__); + return -EINVAL; + } + if (fwu->full_update_size < FW_IMAGE_OFFSET) + return -EINVAL; img->lockdown_data = fwu->data_buffer + FW_IMAGE_OFFSET - img->lockdown_block_count * fwu->block_size; @@ -406,7 +454,7 @@ static void parse_header(void) fwu->lockdown_data = img->lockdown_data; fwu->config_data = img->config_data; fwu->firmware_data = img->firmware_data; - return; + return 0; } static int fwu_read_f01_device_status(struct f01_device_status *status) @@ -1257,6 +1305,7 @@ static int fwu_do_write_config(void) return retval; } +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS static int fwu_start_write_config(void) { int retval; @@ -1290,8 +1339,8 @@ static int fwu_start_write_config(void) "%s: write config from config file\n", __func__); fwu->config_data = fwu->data_buffer; - } else { - parse_header(); + } else if (parse_header()) { + return -EINVAL; } pr_notice("%s: Start of write config process\n", __func__); @@ -1309,6 +1358,7 @@ static int fwu_start_write_config(void) return retval; } +#endif static int fwu_do_write_lockdown(bool reset) { @@ -1356,9 +1406,11 @@ static int fwu_do_write_lockdown(bool reset) return retval; } +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS static int fwu_start_write_lockdown(void) { - parse_header(); + if (parse_header()) + return -EINVAL; return fwu_do_write_lockdown(true); } @@ -1458,6 +1510,7 @@ static int fwu_do_read_config(void) exit: return retval; } +#endif static int fwu_do_reflash(void) { @@ -1580,9 +1633,13 @@ static int fwu_start_reflash(void) __func__, fw_entry->size); fwu->data_buffer = fw_entry->data; + fwu->full_update_size = fw_entry->size; } - parse_header(); + if (parse_header()) { + retval = -EINVAL; + goto exit; + } flash_area = fwu_go_nogo(); if (fwu->rmi4_data->sensor_sleep) { @@ -1679,6 +1736,7 @@ int synaptics_fw_updater(void) } EXPORT_SYMBOL(synaptics_fw_updater); +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS static ssize_t fwu_sysfs_show_image(struct file *data_file, struct kobject *kobj, struct bin_attribute *attributes, char *buf, loff_t pos, size_t count) @@ -2021,6 +2079,7 @@ static ssize_t fwu_sysfs_image_size_store(struct device *dev, if (!mutex_trylock(&fwu_sysfs_mutex)) return -EBUSY; + fwu->full_update_size = size; fwu->image_size = size; fwu->data_pos = 0; @@ -2101,6 +2160,7 @@ static ssize_t fwu_sysfs_package_id_show(struct device *dev, (pkg_id[1] << 8) | pkg_id[0], (pkg_id[3] << 8) | pkg_id[2]); } +#endif static int synaptics_rmi4_debug_dump_info(struct seq_file *m, void *v) { @@ -2134,6 +2194,7 @@ static void synaptics_rmi4_fwu_attn(struct synaptics_rmi4_data *rmi4_data, return; } +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS static struct bin_attribute dev_attr_data = { .attr = { .name = "data", @@ -2143,8 +2204,10 @@ static struct bin_attribute dev_attr_data = { .read = fwu_sysfs_show_image, .write = fwu_sysfs_store_image, }; +#endif static struct device_attribute attrs[] = { +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS __ATTR(fw_name, S_IRUGO | S_IWUSR | S_IWGRP, fwu_sysfs_image_name_show, fwu_sysfs_image_name_store), @@ -2193,6 +2256,7 @@ static struct device_attribute attrs[] = { __ATTR(package_id, S_IRUGO, fwu_sysfs_package_id_show, synaptics_rmi4_store_error), +#endif }; @@ -2278,6 +2342,7 @@ static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data) fwu->initialized = true; fwu->polling_mode = false; +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS retval = sysfs_create_bin_file(&rmi4_data->i2c_client->dev.kobj, &dev_attr_data); if (retval < 0) { @@ -2286,6 +2351,7 @@ static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data) __func__); goto exit_free_mem; } +#endif for (attr_count = 0; attr_count < ARRAY_SIZE(attrs); attr_count++) { retval = sysfs_create_file(&rmi4_data->i2c_client->dev.kobj, @@ -2335,7 +2401,9 @@ static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data) &attrs[attr_count].attr); } +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS sysfs_remove_bin_file(&rmi4_data->input_dev->dev.kobj, &dev_attr_data); +#endif exit_free_mem: kfree(fwu->fn_ptr); @@ -2352,7 +2420,9 @@ static void synaptics_rmi4_fwu_remove(struct synaptics_rmi4_data *rmi4_data) { unsigned char attr_count; +#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS sysfs_remove_bin_file(&rmi4_data->input_dev->dev.kobj, &dev_attr_data); +#endif for (attr_count = 0; attr_count < ARRAY_SIZE(attrs); attr_count++) { sysfs_remove_file(&rmi4_data->input_dev->dev.kobj, diff --git a/drivers/input/touchscreen/synaptics_rmi_dev.c b/drivers/input/touchscreen/synaptics_rmi_dev.c index ff4f426df7d55..64f051e70e6af 100644 --- a/drivers/input/touchscreen/synaptics_rmi_dev.c +++ b/drivers/input/touchscreen/synaptics_rmi_dev.c @@ -299,18 +299,26 @@ static ssize_t rmidev_read(struct file *filp, char __user *buf, return -EBADF; } - if (count == 0) - return 0; + mutex_lock(&(dev_data->file_mutex)); if (count > (REG_ADDR_LIMIT - *f_pos)) count = REG_ADDR_LIMIT - *f_pos; - tmpbuf = kzalloc(count + 1, GFP_KERNEL); - if (!tmpbuf) - return -ENOMEM; + if (count == 0) { + retval = 0; + goto unlock; + } - mutex_lock(&(dev_data->file_mutex)); + if (*f_pos > REG_ADDR_LIMIT) { + retval = -EFAULT; + goto unlock; + } + tmpbuf = kzalloc(count + 1, GFP_KERNEL); + if (!tmpbuf) { + retval = -ENOMEM; + goto unlock; + } retval = rmidev->fn_ptr->read(rmidev->rmi4_data, *f_pos, tmpbuf, @@ -324,8 +332,9 @@ static ssize_t rmidev_read(struct file *filp, char __user *buf, *f_pos += retval; clean_up: - mutex_unlock(&(dev_data->file_mutex)); kfree(tmpbuf); +unlock: + mutex_unlock(&(dev_data->file_mutex)); return retval; } @@ -349,23 +358,32 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf, return -EBADF; } - if (count == 0) - return 0; + mutex_lock(&(dev_data->file_mutex)); + + if (*f_pos > REG_ADDR_LIMIT) { + retval = -EFAULT; + goto unlock; + } if (count > (REG_ADDR_LIMIT - *f_pos)) count = REG_ADDR_LIMIT - *f_pos; + if (count == 0) { + retval = 0; + goto unlock; + } + tmpbuf = kzalloc(count + 1, GFP_KERNEL); - if (!tmpbuf) - return -ENOMEM; + if (!tmpbuf) { + retval = -ENOMEM; + goto unlock; + } if (copy_from_user(tmpbuf, buf, count)) { - kfree(tmpbuf); - return -EFAULT; + retval = -EFAULT; + goto clean_up; } - mutex_lock(&(dev_data->file_mutex)); - retval = rmidev->fn_ptr->write(rmidev->rmi4_data, *f_pos, tmpbuf, @@ -373,8 +391,10 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf, if (retval >= 0) *f_pos += retval; - mutex_unlock(&(dev_data->file_mutex)); +clean_up: kfree(tmpbuf); +unlock: + mutex_unlock(&(dev_data->file_mutex)); return retval; } diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c index 9dd71985cc8e0..12d7a58ba4e5b 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2015,2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -521,6 +521,12 @@ static int msm_isp_stats_update_cgc_override(struct vfe_device *vfe_dev, int i; uint32_t stats_mask = 0, idx; + if (stream_cfg_cmd->num_streams > MSM_ISP_STATS_MAX) { + pr_err("%s invalid num_streams %d\n", __func__, + stream_cfg_cmd->num_streams); + return -EINVAL; + } + for (i = 0; i < stream_cfg_cmd->num_streams; i++) { idx = STATS_IDX(stream_cfg_cmd->stream_handle[i]); @@ -594,6 +600,12 @@ static int msm_isp_start_stats_stream(struct vfe_device *vfe_dev, struct msm_vfe_stats_stream *stream_info; struct msm_vfe_stats_shared_data *stats_data = &vfe_dev->stats_data; + if (stream_cfg_cmd->num_streams > MSM_ISP_STATS_MAX) { + pr_err("%s invalid num_streams %d\n", __func__, + stream_cfg_cmd->num_streams); + return -EINVAL; + } + num_stats_comp_mask = vfe_dev->hw_info->stats_hw_info->num_stats_comp_mask; rc = vfe_dev->hw_info->vfe_ops.stats_ops.check_streams( diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c index 54f162ac0519f..f58619e822e54 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -21,6 +21,7 @@ #include "msm_camera_io_util.h" #define MAX_ISP_V4l2_EVENTS 100 +#define MAX_ISP_REG_LIST 100 static DEFINE_MUTEX(bandwidth_mgr_mutex); static struct msm_isp_bandwidth_mgr isp_bandwidth_mgr; @@ -590,6 +591,7 @@ int msm_isp_cfg_input(struct vfe_device *vfe_dev, void *arg) static int msm_isp_proc_cmd_list_unlocked(struct vfe_device *vfe_dev, void *arg) { int rc = 0; + uint32_t count = 0; struct msm_vfe_cfg_cmd_list *proc_cmd = (struct msm_vfe_cfg_cmd_list *)arg; struct msm_vfe_cfg_cmd_list cmd, cmd_next; @@ -613,6 +615,12 @@ static int msm_isp_proc_cmd_list_unlocked(struct vfe_device *vfe_dev, void *arg) sizeof(struct msm_vfe_cfg_cmd_list)); break; } + if (++count >= MAX_ISP_REG_LIST) { + pr_err("%s:%d Error exceeding the max register count:%u\n", + __func__, __LINE__, count); + rc = -EINVAL; + break; + } if (copy_from_user(&cmd_next, (void __user *)cmd.next, sizeof(struct msm_vfe_cfg_cmd_list))) { rc = -EFAULT; @@ -659,6 +667,7 @@ static void msm_isp_compat_to_proc_cmd(struct msm_vfe_cfg_cmd2 *proc_cmd, static int msm_isp_proc_cmd_list_compat(struct vfe_device *vfe_dev, void *arg) { int rc = 0; + uint32_t count = 0; struct msm_vfe_cfg_cmd_list_32 *proc_cmd = (struct msm_vfe_cfg_cmd_list_32 *)arg; struct msm_vfe_cfg_cmd_list_32 cmd, cmd_next; @@ -683,6 +692,12 @@ static int msm_isp_proc_cmd_list_compat(struct vfe_device *vfe_dev, void *arg) sizeof(struct msm_vfe_cfg_cmd_list)); break; } + if (++count >= MAX_ISP_REG_LIST) { + pr_err("%s:%d Error exceeding the max register count:%u\n", + __func__, __LINE__, count); + rc = -EINVAL; + break; + } if (copy_from_user(&cmd_next, compat_ptr(cmd.next), sizeof(struct msm_vfe_cfg_cmd_list_32))) { rc = -EFAULT; diff --git a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c index 48d357c9a96c7..3e8317a5e6100 100644 --- a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c +++ b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c @@ -1888,7 +1888,7 @@ static int msm_cpp_cfg_frame(struct cpp_device *cpp_dev, struct msm_buf_mngr_info buff_mgr_info, dup_buff_mgr_info; int32_t in_fd; int32_t i = 0, num_output_bufs = 1; - uint32_t stripe_base = 0; + int32_t stripe_base = 0; uint32_t rd_pntr, wr_0_pntr, wr_1_pntr, wr_2_pntr, wr_3_pntr; uint32_t wr_0_meta_data_wr_pntr, wr_1_meta_data_wr_pntr, wr_2_meta_data_wr_pntr, wr_3_meta_data_wr_pntr; @@ -1924,26 +1924,21 @@ static int msm_cpp_cfg_frame(struct cpp_device *cpp_dev, return -EINVAL; } - if (cpp_frame_msg[new_frame->msg_len - 1] != - MSM_CPP_MSG_ID_TRAILER) { - pr_err("Invalid frame message\n"); - return -EINVAL; - } - - if (stripe_base == UINT_MAX || new_frame->num_strips > - (UINT_MAX - 1 - stripe_base) / stripe_size) { - pr_err("Invalid frame message,num_strips %d is large\n", - new_frame->num_strips); - return -EINVAL; - } + if (!new_frame->partial_frame_indicator) { + if (cpp_frame_msg[new_frame->msg_len - 1] != + MSM_CPP_MSG_ID_TRAILER) { + pr_err("Invalid frame message\n"); + return -EINVAL; + } - if ((stripe_base + new_frame->num_strips * stripe_size + 1) != - new_frame->msg_len) { - pr_err("Invalid frame message,len=%d,expected=%d\n", - new_frame->msg_len, - (stripe_base + - new_frame->num_strips * stripe_size + 1)); - return -EINVAL; + if ((stripe_base + new_frame->num_strips * stripe_size + 1) != + new_frame->msg_len) { + pr_err("Invalid frame message,len=%d,expected=%d\n", + new_frame->msg_len, + (stripe_base + + new_frame->num_strips * stripe_size + 1)); + return -EINVAL; + } } if (cpp_dev->iommu_state != CPP_IOMMU_STATE_ATTACHED) { @@ -2201,12 +2196,9 @@ static int msm_cpp_cfg(struct cpp_device *cpp_dev, struct msm_camera_v4l2_ioctl_t *ioctl_ptr) { struct msm_cpp_frame_info_t *frame = NULL; - struct msm_cpp_frame_info_t k_frame_info; + struct msm_cpp_frame_info_t *u_frame_info = + (struct msm_cpp_frame_info_t *)ioctl_ptr->ioctl_ptr; int32_t rc = 0; - if (copy_from_user(&k_frame_info, - (void __user *)ioctl_ptr->ioctl_ptr, - sizeof(k_frame_info))) - return -EFAULT; frame = msm_cpp_get_frame(ioctl_ptr); if (!frame) { @@ -2218,7 +2210,7 @@ static int msm_cpp_cfg(struct cpp_device *cpp_dev, ioctl_ptr->trans_code = rc; - if (copy_to_user((void __user *)k_frame_info.status, &rc, + if (copy_to_user((void __user *)u_frame_info->status, &rc, sizeof(int32_t))) pr_err("error cannot copy error\n"); @@ -2295,16 +2287,11 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd, struct msm_camera_v4l2_ioctl_t *ioctl_ptr = arg; int rc = 0; - if ((sd == NULL) || (ioctl_ptr == NULL)) { + if ((sd == NULL) || (ioctl_ptr == NULL) || + (ioctl_ptr->ioctl_ptr == NULL)) { pr_err("Wrong ioctl_ptr %p, sd %p\n", ioctl_ptr, sd); return -EINVAL; } - - if (_IOC_DIR(cmd) == _IOC_NONE) { - pr_err("Invalid ioctl/subdev cmd %u", cmd); - return -EINVAL; - } - cpp_dev = v4l2_get_subdevdata(sd); if (cpp_dev == NULL) { pr_err("cpp_dev is null\n"); @@ -2507,7 +2494,8 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd, uint32_t identity; struct msm_cpp_buff_queue_info_t *buff_queue_info; CPP_DBG("VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO\n"); - if (ioctl_ptr->len != sizeof(uint32_t)) { + if ((ioctl_ptr->len == 0) || + (ioctl_ptr->len > sizeof(uint32_t))) { mutex_unlock(&cpp_dev->mutex); return -EINVAL; } diff --git a/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c b/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c index 4613c44640a82..a4bffaf022c95 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c +++ b/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2015, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -602,6 +602,12 @@ static int32_t msm_actuator_piezo_move_focus( return -EFAULT; } + if (dest_step_position > a_ctrl->total_steps) { + pr_err("Step pos greater than total steps = %d\n", + dest_step_position); + return -EFAULT; + } + a_ctrl->i2c_tbl_index = 0; a_ctrl->func_tbl->actuator_parse_i2c_params(a_ctrl, (num_steps * diff --git a/drivers/media/platform/msm/vidc/msm_v4l2_vidc.c b/drivers/media/platform/msm/vidc/msm_v4l2_vidc.c index 2e06ce1d8d33c..d42356e8c45c6 100644 --- a/drivers/media/platform/msm/vidc/msm_v4l2_vidc.c +++ b/drivers/media/platform/msm/vidc/msm_v4l2_vidc.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -734,6 +734,8 @@ static int __init msm_vidc_init(void) if (rc) { dprintk(VIDC_ERR, "Failed to register platform driver\n"); + msm_vidc_debugfs_deinit_drv(); + debugfs_remove_recursive(vidc_driver->debugfs_root); kfree(vidc_driver); vidc_driver = NULL; } @@ -744,6 +746,7 @@ static int __init msm_vidc_init(void) static void __exit msm_vidc_exit(void) { platform_driver_unregister(&msm_vidc_driver); + msm_vidc_debugfs_deinit_drv(); debugfs_remove_recursive(vidc_driver->debugfs_root); kfree(vidc_driver); vidc_driver = NULL; diff --git a/drivers/media/platform/msm/vidc/msm_vidc.c b/drivers/media/platform/msm/vidc/msm_vidc.c index 60133e8b6b92e..201effe3e6ab3 100644 --- a/drivers/media/platform/msm/vidc/msm_vidc.c +++ b/drivers/media/platform/msm/vidc/msm_vidc.c @@ -990,7 +990,7 @@ int msm_vidc_dqbuf(void *instance, struct v4l2_buffer *b) if (rc) return rc; - for (i = 0; i < b->length; i++) { + for (i = b->length - 1; i >= 0 ; i--) { if (!inst->map_output_buffer) continue; if (EXTRADATA_IDX(b->length) && @@ -1424,7 +1424,8 @@ static void cleanup_instance(struct msm_vidc_inst *inst) debugfs_remove_recursive(inst->debugfs_root); mutex_lock(&inst->pending_getpropq.lock); - WARN_ON(!list_empty(&inst->pending_getpropq.list)); + WARN_ON(!list_empty(&inst->pending_getpropq.list) + && (msm_vidc_debug & VIDC_INFO)); mutex_unlock(&inst->pending_getpropq.lock); } } diff --git a/drivers/media/platform/msm/vidc/msm_vidc_debug.c b/drivers/media/platform/msm/vidc/msm_vidc_debug.c index d2b5d38d1edc6..47a380c2fd80c 100644 --- a/drivers/media/platform/msm/vidc/msm_vidc_debug.c +++ b/drivers/media/platform/msm/vidc/msm_vidc_debug.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -31,6 +31,7 @@ u32 msm_vidc_firmware_unload_delay = 15000; int msm_vidc_thermal_mitigation_disabled = 0x0; struct debug_buffer { + struct mutex lock; char ptr[MAX_DBG_BUF_SIZE]; char *curr; u32 filled_size; @@ -57,8 +58,12 @@ static u32 write_str(struct debug_buffer *buffer, const char *fmt, ...) { va_list args; u32 size; + + char *curr = buffer->curr; + char *end = buffer->ptr + MAX_DBG_BUF_SIZE; + va_start(args, fmt); - size = vscnprintf(buffer->curr, MAX_DBG_BUF_SIZE - 1, fmt, args); + size = vscnprintf(curr, end - curr, fmt, args); va_end(args); buffer->curr += size; buffer->filled_size += size; @@ -72,12 +77,15 @@ static ssize_t core_info_read(struct file *file, char __user *buf, struct hfi_device *hdev; struct hal_fw_info fw_info; int i = 0, rc = 0; + ssize_t len = 0; if (!core || !core->device) { dprintk(VIDC_ERR, "Invalid params, core: %pK\n", core); return 0; } hdev = core->device; + + mutex_lock(&dbg_buf.lock); INIT_DBG_BUF(dbg_buf); write_str(&dbg_buf, "===============================\n"); write_str(&dbg_buf, "CORE %d: 0x%pK\n", core->id, core); @@ -101,8 +109,11 @@ static ssize_t core_info_read(struct file *file, char __user *buf, completion_done(&core->completions[SYS_MSG_INDEX(i)]) ? "pending" : "done"); } - return simple_read_from_buffer(buf, count, ppos, + len = simple_read_from_buffer(buf, count, ppos, dbg_buf.ptr, dbg_buf.filled_size); + + mutex_unlock(&dbg_buf.lock); + return len; } static const struct file_operations core_info_fops = { @@ -139,7 +150,10 @@ static const struct file_operations ssr_fops = { struct dentry *msm_vidc_debugfs_init_drv(void) { - struct dentry *dir = debugfs_create_dir("msm_vidc", NULL); + struct dentry *dir = NULL; + + mutex_init(&dbg_buf.lock); + dir = debugfs_create_dir("msm_vidc", NULL); if (IS_ERR_OR_NULL(dir)) { dir = NULL; goto failed_create_dir; @@ -238,6 +252,7 @@ struct dentry *msm_vidc_debugfs_init_core(struct msm_vidc_core *core, dprintk(VIDC_ERR, "Failed to create debugfs for msm_vidc\n"); goto failed_create_dir; } + if (!debugfs_create_file("info", S_IRUGO, dir, core, &core_info_fops)) { dprintk(VIDC_ERR, "debugfs_create_file: fail\n"); goto failed_create_dir; @@ -291,10 +306,14 @@ static ssize_t inst_info_read(struct file *file, char __user *buf, { struct msm_vidc_inst *inst = file->private_data; int i, j; + ssize_t len = 0; + if (!inst) { dprintk(VIDC_ERR, "Invalid params, core: %pK\n", inst); return 0; } + + mutex_lock(&dbg_buf.lock); INIT_DBG_BUF(dbg_buf); write_str(&dbg_buf, "===============================\n"); write_str(&dbg_buf, "INSTANCE: 0x%pK (%s)\n", inst, @@ -351,9 +370,10 @@ static ssize_t inst_info_read(struct file *file, char __user *buf, write_str(&dbg_buf, "FBD Count: %d\n", inst->count.fbd); publish_unreleased_reference(inst); - - return simple_read_from_buffer(buf, count, ppos, + len = simple_read_from_buffer(buf, count, ppos, dbg_buf.ptr, dbg_buf.filled_size); + mutex_unlock(&dbg_buf.lock); + return len; } static const struct file_operations inst_info_fops = { @@ -434,3 +454,8 @@ void msm_vidc_debugfs_update(struct msm_vidc_inst *inst, } } +void msm_vidc_debugfs_deinit_drv(void) +{ + mutex_destroy(&dbg_buf.lock); +} + diff --git a/drivers/media/platform/msm/vidc/msm_vidc_debug.h b/drivers/media/platform/msm/vidc/msm_vidc_debug.h index d0faae8941f20..4bda44bb7c255 100644 --- a/drivers/media/platform/msm/vidc/msm_vidc_debug.h +++ b/drivers/media/platform/msm/vidc/msm_vidc_debug.h @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2014, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -123,6 +123,7 @@ struct dentry *msm_vidc_debugfs_init_inst(struct msm_vidc_inst *inst, struct dentry *parent); void msm_vidc_debugfs_update(struct msm_vidc_inst *inst, enum msm_vidc_debugfs_event e); +void msm_vidc_debugfs_deinit_drv(void); static inline void tic(struct msm_vidc_inst *i, enum profiling_points p, char *b) diff --git a/drivers/media/platform/msm/vidc/venus_hfi.c b/drivers/media/platform/msm/vidc/venus_hfi.c index 84c42374aec16..8b98c41d3e3e0 100644 --- a/drivers/media/platform/msm/vidc/venus_hfi.c +++ b/drivers/media/platform/msm/vidc/venus_hfi.c @@ -262,7 +262,7 @@ static int venus_hfi_acquire_regulator(struct regulator_info *rinfo) rinfo->name); } } - WARN_ON(!regulator_is_enabled(rinfo->regulator)); + WARN_ON(!regulator_is_enabled(rinfo->regulator) && (msm_vidc_debug & VIDC_INFO)); return rc; } @@ -929,15 +929,12 @@ static int venus_hfi_vote_active_buses(void *dev, return -EINVAL; } - /* (Re-)alloc memory to store the new votes (in case we internally - * re-vote after power collapse, which is transparent to client) */ - cached_vote_data = krealloc(device->bus_load.vote_data, num_data * - sizeof(*cached_vote_data), GFP_KERNEL); - if (!cached_vote_data) { - dprintk(VIDC_ERR, "Can't alloc memory to cache bus votes\n"); - rc = -ENOMEM; - goto err_no_mem; - } + cached_vote_data = device->bus_load.vote_data; + if (!cached_vote_data) { + dprintk(VIDC_ERR,"Invalid bus load vote data\n"); + rc = -ENOMEM; + goto err_no_mem; + } /* Alloc & init the load table */ num_bus = device->res->bus_set.count; @@ -3746,9 +3743,15 @@ static int venus_hfi_init_bus(struct venus_hfi_device *device) dprintk(VIDC_DBG, "Registered bus client %s\n", name); } - device->bus_load.vote_data = NULL; - device->bus_load.vote_data_count = 0; + device->bus_load.vote_data = (struct vidc_bus_vote_data *) + kzalloc(sizeof(struct vidc_bus_vote_data)*MAX_SUPPORTED_INSTANCES_COUNT, GFP_KERNEL); + if (device->bus_load.vote_data == NULL) { + dprintk(VIDC_ERR,"Failed to allocate memory for vote_data\n"); + rc = -ENOMEM; + goto err_init_bus; + } + device->bus_load.vote_data_count = 0; return rc; err_init_bus: venus_hfi_deinit_bus(device); @@ -3954,7 +3957,7 @@ static int venus_hfi_disable_regulator(struct regulator_info *rinfo) disable_regulator_failed: /* Bring attention to this issue */ - WARN_ON(1); + WARN_ON(msm_vidc_debug & VIDC_INFO); return rc; } diff --git a/drivers/mfd/wcd9xxx-slimslave.c b/drivers/mfd/wcd9xxx-slimslave.c index 1480d8b7df16f..5c2a124a2d02d 100644 --- a/drivers/mfd/wcd9xxx-slimslave.c +++ b/drivers/mfd/wcd9xxx-slimslave.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2015, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -87,6 +87,10 @@ int wcd9xxx_init_slimslave(struct wcd9xxx *wcd9xxx, u8 wcd9xxx_pgd_la, goto err; } + if (!rx_num || rx_num > wcd9xxx->num_rx_port) { + pr_err("%s: invalid rx num %d\n", __func__, rx_num); + return -EINVAL; + } if (wcd9xxx->rx_chs) { wcd9xxx->num_rx_port = rx_num; for (i = 0; i < rx_num; i++) { @@ -109,6 +113,10 @@ int wcd9xxx_init_slimslave(struct wcd9xxx *wcd9xxx, u8 wcd9xxx_pgd_la, wcd9xxx->num_rx_port); } + if (!tx_num || tx_num > wcd9xxx->num_tx_port) { + pr_err("%s: invalid tx num %d\n", __func__, tx_num); + return -EINVAL; + } if (wcd9xxx->tx_chs) { wcd9xxx->num_tx_port = tx_num; for (i = 0; i < tx_num; i++) { diff --git a/drivers/misc/qcom/qdsp6v2/aac_in.c b/drivers/misc/qcom/qdsp6v2/aac_in.c index bfe50f63ad233..20513478674f1 100644 --- a/drivers/misc/qcom/qdsp6v2/aac_in.c +++ b/drivers/misc/qcom/qdsp6v2/aac_in.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010-2016, The Linux Foundation. All rights reserved. + * Copyright (c) 2010-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -34,6 +34,8 @@ #define AAC_FORMAT_ADTS 65535 +#define MAX_SAMPLE_RATE_384K 384000 + static long aac_in_ioctl_shared(struct file *file, unsigned int cmd, void *arg) { struct q6audio_in *audio = file->private_data; @@ -233,6 +235,13 @@ static long aac_in_ioctl_shared(struct file *file, unsigned int cmd, void *arg) break; } + if (cfg->sample_rate > MAX_SAMPLE_RATE_384K) { + pr_err("%s: ERROR: invalid sample rate = %u", + __func__, cfg->sample_rate); + rc = -EINVAL; + break; + } + min_bitrate = ((cfg->sample_rate)*(cfg->channels))/2; /* This calculation should be based on AAC mode. But we cannot * get AAC mode in this setconfig. min_bitrate's logical max diff --git a/drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c b/drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c index 7a8e6f8de8853..20ca3581dd79e 100644 --- a/drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c +++ b/drivers/misc/qcom/qdsp6v2/audio_hwacc_effects.c @@ -148,6 +148,8 @@ static int audio_effects_shared_ioctl(struct file *file, unsigned cmd, case AUDIO_START: { pr_debug("%s: AUDIO_START\n", __func__); + mutex_lock(&effects->lock); + rc = q6asm_open_read_write_v2(effects->ac, FORMAT_LINEAR_PCM, FORMAT_MULTI_CHANNEL_LINEAR_PCM, @@ -159,6 +161,7 @@ static int audio_effects_shared_ioctl(struct file *file, unsigned cmd, pr_err("%s: Open failed for hw accelerated effects:rc=%d\n", __func__, rc); rc = -EINVAL; + mutex_unlock(&effects->lock); goto ioctl_fail; } effects->opened = 1; @@ -175,6 +178,7 @@ static int audio_effects_shared_ioctl(struct file *file, unsigned cmd, pr_err("%s: Write buffer Allocation failed rc = %d\n", __func__, rc); rc = -ENOMEM; + mutex_unlock(&effects->lock); goto ioctl_fail; } atomic_set(&effects->in_count, effects->config.input.num_buf); @@ -185,6 +189,7 @@ static int audio_effects_shared_ioctl(struct file *file, unsigned cmd, pr_err("%s: Read buffer Allocation failed rc = %d\n", __func__, rc); rc = -ENOMEM; + mutex_unlock(&effects->lock); goto readbuf_fail; } atomic_set(&effects->out_count, effects->config.output.num_buf); @@ -200,6 +205,7 @@ static int audio_effects_shared_ioctl(struct file *file, unsigned cmd, if (rc < 0) { pr_err("%s: pcm read block config failed\n", __func__); rc = -EINVAL; + mutex_unlock(&effects->lock); goto cfg_fail; } pr_debug("%s: dec: sample_rate: %d, num_channels: %d, bit_width: %d\n", @@ -214,6 +220,7 @@ static int audio_effects_shared_ioctl(struct file *file, unsigned cmd, pr_err("%s: pcm write format block config failed\n", __func__); rc = -EINVAL; + mutex_unlock(&effects->lock); goto cfg_fail; } @@ -226,6 +233,7 @@ static int audio_effects_shared_ioctl(struct file *file, unsigned cmd, effects->started = 0; pr_err("%s: ASM run state failed\n", __func__); } + mutex_unlock(&effects->lock); break; } case AUDIO_EFFECTS_WRITE: { @@ -287,8 +295,11 @@ static int audio_effects_shared_ioctl(struct file *file, unsigned cmd, uint32_t idx = 0; uint32_t size = 0; + mutex_lock(&effects->lock); + if (!effects->started) { rc = -EFAULT; + mutex_unlock(&effects->lock); goto ioctl_fail; } @@ -305,11 +316,13 @@ static int audio_effects_shared_ioctl(struct file *file, unsigned cmd, if (!rc) { pr_err("%s: read wait_event_timeout\n", __func__); rc = -EFAULT; + mutex_unlock(&effects->lock); goto ioctl_fail; } if (!atomic_read(&effects->in_count)) { pr_err("%s: pcm stopped in_count 0\n", __func__); rc = -EFAULT; + mutex_unlock(&effects->lock); goto ioctl_fail; } @@ -317,15 +330,18 @@ static int audio_effects_shared_ioctl(struct file *file, unsigned cmd, if (bufptr) { if (!((void *)arg)) { rc = -EFAULT; + mutex_unlock(&effects->lock); goto ioctl_fail; } if ((effects->config.buf_cfg.input_len > size) || copy_to_user((void *)arg, bufptr, effects->config.buf_cfg.input_len)) { rc = -EFAULT; + mutex_unlock(&effects->lock); goto ioctl_fail; } } + mutex_unlock(&effects->lock); break; } default: @@ -448,6 +464,7 @@ static long audio_effects_ioctl(struct file *file, unsigned int cmd, switch (cmd) { case AUDIO_SET_EFFECTS_CONFIG: { pr_debug("%s: AUDIO_SET_EFFECTS_CONFIG\n", __func__); + mutex_lock(&effects->lock); memset(&effects->config, 0, sizeof(effects->config)); if (copy_from_user(&effects->config, (void *)arg, sizeof(effects->config))) { @@ -465,6 +482,7 @@ static long audio_effects_ioctl(struct file *file, unsigned int cmd, effects->config.input.num_buf, effects->config.input.sample_rate, effects->config.input.num_channels); + mutex_unlock(&effects->lock); break; } case AUDIO_EFFECTS_SET_BUF_LEN: { @@ -486,6 +504,7 @@ static long audio_effects_ioctl(struct file *file, unsigned int cmd, buf_avail.input_num_avail = atomic_read(&effects->in_count); buf_avail.output_num_avail = atomic_read(&effects->out_count); + mutex_lock(&effects->lock); pr_debug("%s: write buf avail: %d, read buf avail: %d\n", __func__, buf_avail.output_num_avail, buf_avail.input_num_avail); @@ -495,16 +514,20 @@ static long audio_effects_ioctl(struct file *file, unsigned int cmd, __func__); rc = -EFAULT; } + mutex_unlock(&effects->lock); break; } case AUDIO_EFFECTS_SET_PP_PARAMS: { + mutex_lock(&effects->lock); if (copy_from_user(argvalues, (void *)arg, MAX_PP_PARAMS_SZ*sizeof(long))) { pr_err("%s: copy from user for pp params failed\n", __func__); + mutex_unlock(&effects->lock); return -EFAULT; } rc = audio_effects_set_pp_param(effects, argvalues); + mutex_unlock(&effects->lock); break; } default: @@ -570,12 +593,14 @@ static long audio_effects_compat_ioctl(struct file *file, unsigned int cmd, case AUDIO_SET_EFFECTS_CONFIG32: { struct msm_hwacc_effects_config32 config32; struct msm_hwacc_effects_config *config = &effects->config; + mutex_lock(&effects->lock); memset(&effects->config, 0, sizeof(effects->config)); if (copy_from_user(&config32, (void *)arg, sizeof(config32))) { pr_err("%s: copy to user for AUDIO_SET_EFFECTS_CONFIG failed\n", __func__); rc = -EFAULT; + mutex_unlock(&effects->lock); break; } config->input.buf_size = config32.input.buf_size; @@ -612,16 +637,19 @@ static long audio_effects_compat_ioctl(struct file *file, unsigned int cmd, effects->config.input.num_buf, effects->config.input.sample_rate, effects->config.input.num_channels); + mutex_unlock(&effects->lock); break; } case AUDIO_EFFECTS_SET_BUF_LEN32: { struct msm_hwacc_buf_cfg32 buf_cfg32; struct msm_hwacc_effects_config *config = &effects->config; + mutex_lock(&effects->lock); if (copy_from_user(&buf_cfg32, (void *)arg, sizeof(buf_cfg32))) { pr_err("%s: copy from user for AUDIO_EFFECTS_SET_BUF_LEN failed\n", __func__); rc = -EFAULT; + mutex_unlock(&effects->lock); break; } config->buf_cfg.input_len = buf_cfg32.input_len; @@ -629,6 +657,7 @@ static long audio_effects_compat_ioctl(struct file *file, unsigned int cmd, pr_debug("%s: write buf len: %d, read buf len: %d\n", __func__, effects->config.buf_cfg.output_len, effects->config.buf_cfg.input_len); + mutex_unlock(&effects->lock); break; } case AUDIO_EFFECTS_GET_BUF_AVAIL32: { @@ -636,6 +665,7 @@ static long audio_effects_compat_ioctl(struct file *file, unsigned int cmd, memset(&buf_avail, 0, sizeof(buf_avail)); + mutex_lock(&effects->lock); buf_avail.input_num_avail = atomic_read(&effects->in_count); buf_avail.output_num_avail = atomic_read(&effects->out_count); pr_debug("%s: write buf avail: %d, read buf avail: %d\n", @@ -647,22 +677,26 @@ static long audio_effects_compat_ioctl(struct file *file, unsigned int cmd, __func__); rc = -EFAULT; } + mutex_unlock(&effects->lock); break; } case AUDIO_EFFECTS_SET_PP_PARAMS32: { long argvalues[MAX_PP_PARAMS_SZ] = {0}; int argvalues32[MAX_PP_PARAMS_SZ] = {0}; + mutex_lock(&effects->lock); if (copy_from_user(argvalues32, (void *)arg, MAX_PP_PARAMS_SZ*sizeof(int))) { pr_err("%s: copy from user failed for pp params\n", __func__); + mutex_unlock(&effects->lock); return -EFAULT; } for (i = 0; i < MAX_PP_PARAMS_SZ; i++) argvalues[i] = argvalues32[i]; rc = audio_effects_set_pp_param(effects, argvalues); + mutex_unlock(&effects->lock); break; } case AUDIO_START32: { diff --git a/drivers/misc/qcom/qdsp6v2/audio_utils_aio.c b/drivers/misc/qcom/qdsp6v2/audio_utils_aio.c index 2eb9b28ad82b4..5b2dbe702f943 100644 --- a/drivers/misc/qcom/qdsp6v2/audio_utils_aio.c +++ b/drivers/misc/qcom/qdsp6v2/audio_utils_aio.c @@ -1,6 +1,6 @@ /* Copyright (C) 2008 Google, Inc. * Copyright (C) 2008 HTC Corporation - * Copyright (c) 2009-2016, The Linux Foundation. All rights reserved. + * Copyright (c) 2009-2017, The Linux Foundation. All rights reserved. * * This software is licensed under the terms of the GNU General Public * License version 2, as published by the Free Software Foundation, and @@ -120,7 +120,10 @@ static int audio_aio_ion_lookup_vaddr(struct q6audio_aio *audio, void *addr, list_for_each_entry(region_elt, &audio->ion_region_queue, list) { if (addr >= region_elt->vaddr && addr < region_elt->vaddr + region_elt->len && - addr + len <= region_elt->vaddr + region_elt->len) { + addr + len <= region_elt->vaddr + region_elt->len && + addr + len > addr) { + /* to avoid integer addition overflow */ + /* offset since we could pass vaddr inside a registerd * ion buffer */ diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c index fe9781a7483f4..931235bdf885d 100644 --- a/drivers/misc/qseecom.c +++ b/drivers/misc/qseecom.c @@ -1,6 +1,6 @@ /*Qualcomm Secure Execution Environment Communicator (QSEECOM) driver * - * Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. + * Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -109,6 +109,35 @@ static DEFINE_MUTEX(qsee_bw_mutex); static DEFINE_MUTEX(app_access_lock); static DEFINE_MUTEX(clk_access_lock); +struct sglist_info { + uint32_t indexAndFlags; + uint32_t sizeOrCount; +}; + +/* + * The 31th bit indicates only one or multiple physical address inside + * the request buffer. If it is set, the index locates a single physical addr + * inside the request buffer, and `sizeOrCount` is the size of the memory being + * shared at that physical address. + * Otherwise, the index locates an array of {start, len} pairs (a + * "scatter/gather list"), and `sizeOrCount` gives the number of entries in + * that array. + * + * The 30th bit indicates 64 or 32bit address; when it is set, physical addr + * and scatter gather entry sizes are 64-bit values. Otherwise, 32-bit values. + * + * The bits [0:29] of `indexAndFlags` hold an offset into the request buffer. + */ +#define SGLISTINFO_SET_INDEX_FLAG(c, s, i) \ + ((uint32_t)(((c & 1) << 31) | ((s & 1) << 30) | (i & 0x3fffffff))) + +#define SGLISTINFO_TABLE_SIZE (sizeof(struct sglist_info) * MAX_ION_FD) + +#define FEATURE_ID_WHITELIST 15 /*whitelist feature id*/ + +#define MAKE_WHITELIST_VERSION(major, minor, patch) \ + (((major & 0x3FF) << 22) | ((minor & 0x3FF) << 12) | (patch & 0xFFF)) + struct qseecom_registered_listener_list { struct list_head list; struct qseecom_register_listener_req svc; @@ -120,6 +149,8 @@ struct qseecom_registered_listener_list { wait_queue_head_t rcv_req_wq; int rcv_req_flag; + struct sglist_info sglistinfo_ptr[MAX_ION_FD]; + uint32_t sglist_cnt; }; struct qseecom_registered_app_list { @@ -168,6 +199,7 @@ struct qseecom_control { uint32_t qseos_version; uint32_t qsee_version; struct device *pdev; + bool whitelist_support; bool commonlib_loaded; struct ion_handle *cmnlib_ion_handle; struct ce_hw_usage_info ce_info; @@ -223,6 +255,9 @@ struct qseecom_dev_handle { bool perf_enabled; bool fast_load_enabled; enum qseecom_bandwidth_request_mode mode; + struct sglist_info sglistinfo_ptr[MAX_ION_FD]; + uint32_t sglist_cnt; + bool use_legacy_cmd; }; struct qseecom_sg_entry { @@ -436,6 +471,21 @@ static int qseecom_scm_call2(uint32_t svc_id, uint32_t tz_cmd_id, ret = scm_call2(smc_id, &desc); break; } + case QSEOS_LISTENER_DATA_RSP_COMMAND_WHITELIST: { + struct qseecom_client_listener_data_irsp *req; + req = (struct qseecom_client_listener_data_irsp *) + req_buf; + smc_id = + TZ_OS_LISTENER_RESPONSE_HANDLER_WITH_WHITELIST_ID; + desc.arginfo = + TZ_OS_LISTENER_RESPONSE_HANDLER_WITH_WHITELIST_PARAM_ID; + desc.args[0] = req->listener_id; + desc.args[1] = req->status; + desc.args[2] = req->sglistinfo_ptr; + desc.args[3] = req->sglistinfo_len; + ret = scm_call2(smc_id, &desc); + break; + } case QSEOS_LOAD_EXTERNAL_ELF_COMMAND: { struct qseecom_load_app_ireq *req; req = (struct qseecom_load_app_ireq *)req_buf; @@ -467,6 +517,22 @@ static int qseecom_scm_call2(uint32_t svc_id, uint32_t tz_cmd_id, ret = scm_call2(smc_id, &desc); break; } + case QSEOS_CLIENT_SEND_DATA_COMMAND_WHITELIST: { + struct qseecom_client_send_data_ireq *req; + req = (struct qseecom_client_send_data_ireq *)req_buf; + smc_id = TZ_APP_QSAPP_SEND_DATA_WITH_WHITELIST_ID; + desc.arginfo = + TZ_APP_QSAPP_SEND_DATA_WITH_WHITELIST_ID_PARAM_ID; + desc.args[0] = req->app_id; + desc.args[1] = req->req_ptr; + desc.args[2] = req->req_len; + desc.args[3] = req->rsp_ptr; + desc.args[4] = req->rsp_len; + desc.args[5] = req->sglistinfo_ptr; + desc.args[6] = req->sglistinfo_len; + ret = scm_call2(smc_id, &desc); + break; + } case QSEOS_RPMB_PROVISION_KEY_COMMAND: { struct qseecom_client_send_service_ireq *req; req = (struct qseecom_client_send_service_ireq *) @@ -577,6 +643,22 @@ static int qseecom_scm_call2(uint32_t svc_id, uint32_t tz_cmd_id, ret = scm_call2(smc_id, &desc); break; } + case QSEOS_TEE_OPEN_SESSION_WHITELIST: { + struct qseecom_qteec_ireq *req; + req = (struct qseecom_qteec_ireq *)req_buf; + smc_id = TZ_APP_GPAPP_OPEN_SESSION_WITH_WHITELIST_ID; + desc.arginfo = + TZ_APP_GPAPP_OPEN_SESSION_WITH_WHITELIST_ID_PARAM_ID; + desc.args[0] = req->app_id; + desc.args[1] = req->req_ptr; + desc.args[2] = req->req_len; + desc.args[3] = req->resp_ptr; + desc.args[4] = req->resp_len; + desc.args[5] = req->sglistinfo_ptr; + desc.args[6] = req->sglistinfo_len; + ret = scm_call2(smc_id, &desc); + break; + } case QSEOS_TEE_INVOKE_COMMAND: { struct qseecom_qteec_ireq *req; req = (struct qseecom_qteec_ireq *)req_buf; @@ -590,6 +672,22 @@ static int qseecom_scm_call2(uint32_t svc_id, uint32_t tz_cmd_id, ret = scm_call2(smc_id, &desc); break; } + case QSEOS_TEE_INVOKE_COMMAND_WHITELIST: { + struct qseecom_qteec_ireq *req; + req = (struct qseecom_qteec_ireq *)req_buf; + smc_id = TZ_APP_GPAPP_INVOKE_COMMAND_WITH_WHITELIST_ID; + desc.arginfo = + TZ_APP_GPAPP_INVOKE_COMMAND_WITH_WHITELIST_ID_PARAM_ID; + desc.args[0] = req->app_id; + desc.args[1] = req->req_ptr; + desc.args[2] = req->req_len; + desc.args[3] = req->resp_ptr; + desc.args[4] = req->resp_len; + desc.args[5] = req->sglistinfo_ptr; + desc.args[6] = req->sglistinfo_len; + ret = scm_call2(smc_id, &desc); + break; + } case QSEOS_TEE_CLOSE_SESSION: { struct qseecom_qteec_ireq *req; req = (struct qseecom_qteec_ireq *)req_buf; @@ -774,7 +872,7 @@ static int qseecom_register_listener(struct qseecom_dev_handle *data, return -EBUSY; } - new_entry = kmalloc(sizeof(*new_entry), GFP_KERNEL); + new_entry = kzalloc(sizeof(*new_entry), GFP_KERNEL); if (!new_entry) { pr_err("kmalloc failed\n"); return -ENOMEM; @@ -901,9 +999,11 @@ static int __qseecom_set_msm_bus_request(uint32_t mode) pr_err("Bandwidth req failed(%d) MODE (%d)\n", ret, mode); if (qclk->ce_core_src_clk != NULL) { - if (mode == INACTIVE) - __qseecom_enable_clk(CLK_QSEE); - else + if (mode == INACTIVE) { + ret = __qseecom_enable_clk(CLK_QSEE); + if (ret) + pr_err("CLK enable failed\n"); + } else __qseecom_disable_clk(CLK_QSEE); } } @@ -1186,6 +1286,16 @@ static int __qseecom_listener_has_sent_rsp(struct qseecom_dev_handle *data) return ret || data->abort; } +static void __qseecom_clean_listener_sglistinfo( + struct qseecom_registered_listener_list *ptr_svc) +{ + if (ptr_svc->sglist_cnt) { + memset(ptr_svc->sglistinfo_ptr, 0, + SGLISTINFO_TABLE_SIZE); + ptr_svc->sglist_cnt = 0; + } +} + static int __qseecom_process_incomplete_cmd(struct qseecom_dev_handle *data, struct qseecom_command_scm_resp *resp) { @@ -1197,6 +1307,7 @@ static int __qseecom_process_incomplete_cmd(struct qseecom_dev_handle *data, struct qseecom_registered_listener_list *ptr_svc = NULL; sigset_t new_sigset; sigset_t old_sigset; + struct sglist_info *table = NULL; while (resp->result == QSEOS_RESULT_INCOMPLETE) { lstnr = resp->data; @@ -1255,20 +1366,41 @@ static int __qseecom_process_incomplete_cmd(struct qseecom_dev_handle *data, } qseecom.send_resp_flag = 0; - send_data_rsp.qsee_cmd_id = QSEOS_LISTENER_DATA_RSP_COMMAND; + table = ptr_svc->sglistinfo_ptr; + if (qseecom.whitelist_support == false) + send_data_rsp.qsee_cmd_id = + QSEOS_LISTENER_DATA_RSP_COMMAND; + else + send_data_rsp.qsee_cmd_id = + QSEOS_LISTENER_DATA_RSP_COMMAND_WHITELIST; + send_data_rsp.listener_id = lstnr; - if (ptr_svc) + send_data_rsp.sglistinfo_ptr = + (uint32_t)virt_to_phys(table); + send_data_rsp.sglistinfo_len = + SGLISTINFO_TABLE_SIZE; + dmac_flush_range((void *)table, + (void *)table + SGLISTINFO_TABLE_SIZE); + if (ptr_svc) { msm_ion_do_cache_op(qseecom.ion_clnt, ptr_svc->ihandle, ptr_svc->sb_virt, ptr_svc->sb_length, - ION_IOC_CLEAN_INV_CACHES); - - if (lstnr == RPMB_SERVICE) - __qseecom_enable_clk(CLK_QSEE); + ION_IOC_CLEAN_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + return ret; + } + } + if (lstnr == RPMB_SERVICE) { + ret = __qseecom_enable_clk(CLK_QSEE); + if (ret) + return ret; + } ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, (const void *)&send_data_rsp, sizeof(send_data_rsp), resp, sizeof(*resp)); + __qseecom_clean_listener_sglistinfo(ptr_svc); if (ret) { pr_err("scm_call() failed with err: %d (app_id = %d)\n", ret, data->client.app_id); @@ -1413,6 +1545,10 @@ static int qseecom_load_app(struct qseecom_dev_handle *data, void __user *argp) load_req.phy_addr = (uint32_t)pa; msm_ion_do_cache_op(qseecom.ion_clnt, ihandle, NULL, len, ION_IOC_CLEAN_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + goto loadapp_err; + } /* SCM_CALL to load the app and get the app_id back */ ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, &load_req, @@ -1675,11 +1811,6 @@ int __qseecom_process_rpmb_svc_cmd(struct qseecom_dev_handle *data_ptr, return -EINVAL; } - if ((!req_ptr->cmd_req_buf) || (!req_ptr->resp_buf)) { - pr_err("Invalid req/resp buffer, exiting\n"); - return -EINVAL; - } - /* Clients need to ensure req_buf is at base offset of shared buffer */ if ((uintptr_t)req_ptr->cmd_req_buf != data_ptr->client.user_virt_sb_base) { @@ -1687,15 +1818,11 @@ int __qseecom_process_rpmb_svc_cmd(struct qseecom_dev_handle *data_ptr, return -EINVAL; } - if (((uintptr_t)req_ptr->resp_buf < - data_ptr->client.user_virt_sb_base) || - ((uintptr_t)req_ptr->resp_buf >= - (data_ptr->client.user_virt_sb_base + - data_ptr->client.sb_length))){ - pr_err("response buffer address not within shared bufffer\n"); + if (data_ptr->client.sb_length < + sizeof(struct qseecom_rpmb_provision_key)) { + pr_err("shared buffer is too small to hold key type\n"); return -EINVAL; } - req_buf = data_ptr->client.sb_virt; send_svc_ireq_ptr->qsee_cmd_id = req_ptr->cmd_id; @@ -1722,36 +1849,6 @@ int __qseecom_process_fsm_key_svc_cmd(struct qseecom_dev_handle *data_ptr, return -EINVAL; } - if (((uintptr_t)req_ptr->cmd_req_buf < - data_ptr->client.user_virt_sb_base) || - ((uintptr_t)req_ptr->cmd_req_buf >= - (data_ptr->client.user_virt_sb_base + - data_ptr->client.sb_length))) { - pr_err("cmd buffer address not within shared bufffer\n"); - return -EINVAL; - } - - if (((uintptr_t)req_ptr->resp_buf < - data_ptr->client.user_virt_sb_base) || - ((uintptr_t)req_ptr->resp_buf >= - (data_ptr->client.user_virt_sb_base + - data_ptr->client.sb_length))){ - pr_err("response buffer address not within shared bufffer\n"); - return -EINVAL; - } - - if ((req_ptr->cmd_req_len == 0) || (req_ptr->resp_len == 0) || - req_ptr->cmd_req_len > data_ptr->client.sb_length || - req_ptr->resp_len > data_ptr->client.sb_length) { - pr_err("cmd buffer length or response buffer length not valid\n"); - return -EINVAL; - } - - if (req_ptr->cmd_req_len > UINT_MAX - req_ptr->resp_len) { - pr_err("Integer overflow detected in req_len & rsp_len, exiting now\n"); - return -EINVAL; - } - reqd_len_sb_in = req_ptr->cmd_req_len + req_ptr->resp_len; if (reqd_len_sb_in > data_ptr->client.sb_length) { pr_err("Not enough memory to fit cmd_buf and resp_buf. "); @@ -1773,28 +1870,11 @@ int __qseecom_process_fsm_key_svc_cmd(struct qseecom_dev_handle *data_ptr, return ret; } -static int qseecom_send_service_cmd(struct qseecom_dev_handle *data, - void __user *argp) +static int __validate_send_service_cmd_inputs(struct qseecom_dev_handle *data, + struct qseecom_send_svc_cmd_req *req) { - int ret = 0; - struct qseecom_client_send_service_ireq send_svc_ireq; - struct qseecom_client_send_fsm_key_req send_fsm_key_svc_ireq; - struct qseecom_command_scm_resp resp; - struct qseecom_send_svc_cmd_req req; - void *send_req_ptr; - size_t req_buf_size; - - /*struct qseecom_command_scm_resp resp;*/ - - if (copy_from_user(&req, - (void __user *)argp, - sizeof(req))) { - pr_err("copy_from_user failed\n"); - return -EFAULT; - } - - if ((req.resp_buf == NULL) || (req.cmd_req_buf == NULL)) { - pr_err("cmd buffer or response buffer is null\n"); + if (!req || !req->resp_buf || !req->cmd_req_buf) { + pr_err("req or cmd buffer or response buffer is null\n"); return -EINVAL; } @@ -1818,6 +1898,86 @@ static int qseecom_send_service_cmd(struct qseecom_dev_handle *data, return -EINVAL; } + if (((uintptr_t)req->cmd_req_buf < + data->client.user_virt_sb_base) || + ((uintptr_t)req->cmd_req_buf >= + (data->client.user_virt_sb_base + data->client.sb_length))) { + pr_err("cmd buffer address not within shared bufffer\n"); + return -EINVAL; + } + if (((uintptr_t)req->resp_buf < + data->client.user_virt_sb_base) || + ((uintptr_t)req->resp_buf >= + (data->client.user_virt_sb_base + data->client.sb_length))) { + pr_err("response buffer address not within shared bufffer\n"); + return -EINVAL; + } + if ((req->cmd_req_len == 0) || (req->resp_len == 0) || + (req->cmd_req_len > data->client.sb_length) || + (req->resp_len > data->client.sb_length)) { + pr_err("cmd buf length or response buf length not valid\n"); + return -EINVAL; + } + if (req->cmd_req_len > UINT_MAX - req->resp_len) { + pr_err("Integer overflow detected in req_len & rsp_len\n"); + return -EINVAL; + } + + if ((req->cmd_req_len + req->resp_len) > data->client.sb_length) { + pr_debug("Not enough memory to fit cmd_buf.\n"); + pr_debug("resp_buf. Required: %u, Available: %zu\n", + (req->cmd_req_len + req->resp_len), + data->client.sb_length); + return -ENOMEM; + } + if ((uintptr_t)req->cmd_req_buf > (ULONG_MAX - req->cmd_req_len)) { + pr_err("Integer overflow in req_len & cmd_req_buf\n"); + return -EINVAL; + } + if ((uintptr_t)req->resp_buf > (ULONG_MAX - req->resp_len)) { + pr_err("Integer overflow in resp_len & resp_buf\n"); + return -EINVAL; + } + if (data->client.user_virt_sb_base > + (ULONG_MAX - data->client.sb_length)) { + pr_err("Integer overflow in user_virt_sb_base & sb_length\n"); + return -EINVAL; + } + if ((((uintptr_t)req->cmd_req_buf + req->cmd_req_len) > + ((uintptr_t)data->client.user_virt_sb_base + + data->client.sb_length)) || + (((uintptr_t)req->resp_buf + req->resp_len) > + ((uintptr_t)data->client.user_virt_sb_base + + data->client.sb_length))) { + pr_err("cmd buf or resp buf is out of shared buffer region\n"); + return -EINVAL; + } + return 0; +} + +static int qseecom_send_service_cmd(struct qseecom_dev_handle *data, + void __user *argp) +{ + int ret = 0; + struct qseecom_client_send_service_ireq send_svc_ireq; + struct qseecom_client_send_fsm_key_req send_fsm_key_svc_ireq; + struct qseecom_command_scm_resp resp; + struct qseecom_send_svc_cmd_req req; + void *send_req_ptr; + size_t req_buf_size; + + /*struct qseecom_command_scm_resp resp;*/ + + if (copy_from_user(&req, + (void __user *)argp, + sizeof(req))) { + pr_err("copy_from_user failed\n"); + return -EFAULT; + } + + if (__validate_send_service_cmd_inputs(data, &req)) + return -EINVAL; + data->type = QSEECOM_SECURE_SERVICE; switch (req.cmd_id) { @@ -1868,15 +2028,16 @@ static int qseecom_send_service_cmd(struct qseecom_dev_handle *data, } } - msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, + ret = msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, data->client.sb_virt, data->client.sb_length, ION_IOC_CLEAN_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + goto exit; + } ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, (const void *)send_req_ptr, req_buf_size, &resp, sizeof(resp)); - msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, - data->client.sb_virt, data->client.sb_length, - ION_IOC_INV_CACHES); if (ret) { pr_err("qseecom_scm_call failed with err: %d\n", ret); if (!qseecom.support_bus_scaling) { @@ -1888,7 +2049,13 @@ static int qseecom_send_service_cmd(struct qseecom_dev_handle *data, } goto exit; } - + ret = msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, + data->client.sb_virt, data->client.sb_length, + ION_IOC_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + goto exit; + } switch (resp.result) { case QSEOS_RESULT_SUCCESS: break; @@ -1996,12 +2163,13 @@ static int __qseecom_send_cmd(struct qseecom_dev_handle *data, { int ret = 0; u32 reqd_len_sb_in = 0; - struct qseecom_client_send_data_ireq send_data_req; + struct qseecom_client_send_data_ireq send_data_req = {0}; struct qseecom_command_scm_resp resp; unsigned long flags; struct qseecom_registered_app_list *ptr_app; bool found_app = false; int name_len = 0; + struct sglist_info *table = data->sglistinfo_ptr; reqd_len_sb_in = req->cmd_req_len + req->resp_len; /* find app_id & img_name from list */ @@ -2025,7 +2193,11 @@ static int __qseecom_send_cmd(struct qseecom_dev_handle *data, return -EINVAL; } - send_data_req.qsee_cmd_id = QSEOS_CLIENT_SEND_DATA_COMMAND; + if (qseecom.whitelist_support == false || data->use_legacy_cmd == true) + send_data_req.qsee_cmd_id = QSEOS_CLIENT_SEND_DATA_COMMAND; + else + send_data_req.qsee_cmd_id = + QSEOS_CLIENT_SEND_DATA_COMMAND_WHITELIST; send_data_req.app_id = data->client.app_id; send_data_req.req_ptr = (uint32_t)(__qseecom_uvirt_to_kphys(data, (uintptr_t)req->cmd_req_buf)); @@ -2033,11 +2205,20 @@ static int __qseecom_send_cmd(struct qseecom_dev_handle *data, send_data_req.rsp_ptr = (uint32_t)(__qseecom_uvirt_to_kphys(data, (uintptr_t)req->resp_buf)); send_data_req.rsp_len = req->resp_len; + send_data_req.sglistinfo_ptr = + (uint32_t)virt_to_phys(table); + send_data_req.sglistinfo_len = SGLISTINFO_TABLE_SIZE; + dmac_flush_range((void *)table, + (void *)table + SGLISTINFO_TABLE_SIZE); - msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, + ret = msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, data->client.sb_virt, reqd_len_sb_in, ION_IOC_CLEAN_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + return ret; + } ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, (const void *)&send_data_req, @@ -2061,9 +2242,11 @@ static int __qseecom_send_cmd(struct qseecom_dev_handle *data, ret = -EINVAL; } } - msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, + ret = msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, data->client.sb_virt, data->client.sb_length, ION_IOC_INV_CACHES); + if (ret) + pr_err("cache operation failed %d\n", ret); return ret; } @@ -2128,6 +2311,8 @@ static int __qseecom_update_cmd_buf(void *msg, bool cleanup, struct qseecom_send_modfd_cmd_req *req = NULL; struct qseecom_send_modfd_listener_resp *lstnr_resp = NULL; struct qseecom_registered_listener_list *this_lstnr = NULL; + uint32_t offset; + struct sg_table *sg_ptr; if ((data->type != QSEECOM_LISTENER_SERVICE) && (data->type != QSEECOM_CLIENT_APP)) @@ -2149,7 +2334,6 @@ static int __qseecom_update_cmd_buf(void *msg, bool cleanup, } for (i = 0; i < MAX_ION_FD; i++) { - struct sg_table *sg_ptr = NULL; if ((data->type != QSEECOM_LISTENER_SERVICE) && (req->ifd_data[i].fd > 0)) { ihandle = ion_import_dma_buf(qseecom.ion_clnt, @@ -2175,7 +2359,7 @@ static int __qseecom_update_cmd_buf(void *msg, bool cleanup, } /* Populate the cmd data structure with the phys_addr */ sg_ptr = ion_sg_table(qseecom.ion_clnt, ihandle); - if (sg_ptr == NULL) { + if (IS_ERR_OR_NULL(sg_ptr)) { pr_err("IOn client could not retrieve sg table\n"); goto err; } @@ -2245,14 +2429,44 @@ static int __qseecom_update_cmd_buf(void *msg, bool cleanup, sg = sg_next(sg); } } - if (cleanup) - msm_ion_do_cache_op(qseecom.ion_clnt, + if (cleanup) { + ret = msm_ion_do_cache_op(qseecom.ion_clnt, ihandle, NULL, len, ION_IOC_INV_CACHES); - else - msm_ion_do_cache_op(qseecom.ion_clnt, + if (ret) { + pr_err("cache operation failed %d\n", ret); + goto err; + } + } else { + ret = msm_ion_do_cache_op(qseecom.ion_clnt, ihandle, NULL, len, ION_IOC_CLEAN_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + goto err; + } + if (data->type == QSEECOM_CLIENT_APP) { + offset = req->ifd_data[i].cmd_buf_offset; + data->sglistinfo_ptr[i].indexAndFlags = + SGLISTINFO_SET_INDEX_FLAG( + (sg_ptr->nents == 1), 0, offset); + data->sglistinfo_ptr[i].sizeOrCount = + (sg_ptr->nents == 1) ? + sg->length : sg_ptr->nents; + data->sglist_cnt = i + 1; + } else { + offset = (lstnr_resp->ifd_data[i].cmd_buf_offset + + (uintptr_t)lstnr_resp->resp_buf_ptr - + (uintptr_t)this_lstnr->sb_virt); + this_lstnr->sglistinfo_ptr[i].indexAndFlags = + SGLISTINFO_SET_INDEX_FLAG( + (sg_ptr->nents == 1), 0, offset); + this_lstnr->sglistinfo_ptr[i].sizeOrCount = + (sg_ptr->nents == 1) ? + sg->length : sg_ptr->nents; + this_lstnr->sglist_cnt = i + 1; + } + } /* Deallocate the handle */ if (!IS_ERR_OR_NULL(ihandle)) ion_free(qseecom.ion_clnt, ihandle); @@ -2585,9 +2799,13 @@ static int __qseecom_load_fw(struct qseecom_dev_handle *data, char *appname) goto exit_unregister_bus_bw_need; } - msm_ion_do_cache_op(qseecom.ion_clnt, ihandle, + ret = msm_ion_do_cache_op(qseecom.ion_clnt, ihandle, img_data, fw_size, ION_IOC_CLEAN_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + goto exit_disable_clk_vote; + } /* SCM_CALL to load the image */ ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, &load_req, @@ -2677,9 +2895,13 @@ static int qseecom_load_commonlib_image(struct qseecom_dev_handle *data) goto exit_unregister_bus_bw_need; } - msm_ion_do_cache_op(qseecom.ion_clnt, qseecom.cmnlib_ion_handle, + ret = msm_ion_do_cache_op(qseecom.ion_clnt, qseecom.cmnlib_ion_handle, img_data, fw_size, ION_IOC_CLEAN_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + goto exit_disable_clk_vote; + } /* SCM_CALL to load the image */ ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, &load_req, @@ -3051,8 +3273,11 @@ int qseecom_send_command(struct qseecom_handle *handle, void *send_buf, } perf_enabled = true; } + if (!strcmp(data->client.app_name, "securemm")) + data->use_legacy_cmd = true; ret = __qseecom_send_cmd(data, &req); + data->use_legacy_cmd = false; if (qseecom.support_bus_scaling) __qseecom_add_bw_scale_down_timer( QSEECOM_SEND_CMD_CRYPTO_TIMEOUT); @@ -3244,9 +3469,10 @@ static int __qseecom_enable_clk(enum qseecom_ce_hw_instance ce) } mutex_lock(&clk_access_lock); - if (qclk->clk_access_cnt == ULONG_MAX) + if (qclk->clk_access_cnt == ULONG_MAX) { + pr_err("clk_access_cnt beyond limitation\n"); goto err; - + } if (qclk->clk_access_cnt > 0) { qclk->clk_access_cnt++; mutex_unlock(&clk_access_lock); @@ -3560,8 +3786,12 @@ static int qseecom_load_external_elf(struct qseecom_dev_handle *data, ret = -EIO; goto exit_register_bus_bandwidth_needs; } - msm_ion_do_cache_op(qseecom.ion_clnt, ihandle, NULL, len, + ret = msm_ion_do_cache_op(qseecom.ion_clnt, ihandle, NULL, len, ION_IOC_CLEAN_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + goto exit_disable_clock; + } /* SCM_CALL to load the external elf */ ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, &load_req, sizeof(struct qseecom_load_app_ireq), @@ -3820,7 +4050,9 @@ static int __qseecom_generate_and_save_key(struct qseecom_dev_handle *data, pr_err("Error:: unsupported usage %d\n", usage); return -EFAULT; } - __qseecom_enable_clk(CLK_QSEE); + ret = __qseecom_enable_clk(CLK_QSEE); + if (ret) + return ret; ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, ireq, sizeof(struct qseecom_key_generate_ireq), @@ -3878,7 +4110,9 @@ static int __qseecom_delete_saved_key(struct qseecom_dev_handle *data, pr_err("Error:: unsupported usage %d\n", usage); return -EFAULT; } - __qseecom_enable_clk(CLK_QSEE); + ret = __qseecom_enable_clk(CLK_QSEE); + if (ret) + return ret; ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, ireq, sizeof(struct qseecom_key_delete_ireq), @@ -3937,10 +4171,15 @@ static int __qseecom_set_clear_ce_key(struct qseecom_dev_handle *data, pr_err("Error:: unsupported usage %d\n", usage); return -EFAULT; } + ret = __qseecom_enable_clk(CLK_QSEE); + if (ret) + return ret; - __qseecom_enable_clk(CLK_QSEE); - if (qseecom.qsee.instance != qseecom.ce_drv.instance) - __qseecom_enable_clk(CLK_CE_DRV); + if (qseecom.qsee.instance != qseecom.ce_drv.instance) { + ret = __qseecom_enable_clk(CLK_CE_DRV); + if (ret) + return ret; + } ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, ireq, sizeof(struct qseecom_key_select_ireq), @@ -4002,8 +4241,9 @@ static int __qseecom_update_current_key_user_info( pr_err("Error:: unsupported usage %d\n", usage); return -EFAULT; } - - __qseecom_enable_clk(CLK_QSEE); + ret = __qseecom_enable_clk(CLK_QSEE); + if (ret) + return ret; ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, ireq, sizeof(struct qseecom_key_userinfo_update_ireq), @@ -4481,7 +4721,7 @@ static int __qseecom_update_qteec_req_buf(struct qseecom_qteec_modfd_req *req, } /* Populate the cmd data structure with the phys_addr */ sg_ptr = ion_sg_table(qseecom.ion_clnt, ihandle); - if (sg_ptr == NULL) { + if (IS_ERR_OR_NULL(sg_ptr)) { pr_err("IOn client could not retrieve sg table\n"); goto err; } @@ -4496,14 +4736,31 @@ static int __qseecom_update_qteec_req_buf(struct qseecom_qteec_modfd_req *req, else *update = (uint32_t)sg_dma_address(sg_ptr->sgl); - if (cleanup) - msm_ion_do_cache_op(qseecom.ion_clnt, - ihandle, NULL, sg->length, - ION_IOC_INV_CACHES); - else - msm_ion_do_cache_op(qseecom.ion_clnt, - ihandle, NULL, sg->length, - ION_IOC_CLEAN_INV_CACHES); + if (cleanup) { + ret = msm_ion_do_cache_op(qseecom.ion_clnt, + ihandle, NULL, sg->length, + ION_IOC_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + goto err; + } + } else { + ret = msm_ion_do_cache_op(qseecom.ion_clnt, + ihandle, NULL, sg->length, + ION_IOC_CLEAN_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + goto err; + } + data->sglistinfo_ptr[i].indexAndFlags = + SGLISTINFO_SET_INDEX_FLAG( + (sg_ptr->nents == 1), 0, + req->ifd_data[i].cmd_buf_offset); + data->sglistinfo_ptr[i].sizeOrCount = + (sg_ptr->nents == 1) ? + sg->length : sg_ptr->nents; + data->sglist_cnt = i + 1; + } /* Deallocate the handle */ if (!IS_ERR_OR_NULL(ihandle)) ion_free(qseecom.ion_clnt, ihandle); @@ -4522,18 +4779,11 @@ static int __qseecom_qteec_issue_cmd(struct qseecom_dev_handle *data, struct qseecom_qteec_ireq ireq; int ret = 0; uint32_t reqd_len_sb_in = 0; + struct sglist_info *table = data->sglistinfo_ptr; ret = __qseecom_qteec_validate_msg(data, req); if (ret) return ret; - ireq.qsee_cmd_id = cmd_id; - ireq.app_id = data->client.app_id; - ireq.req_ptr = (uint32_t)__qseecom_uvirt_to_kphys(data, - (uintptr_t)req->req_ptr); - ireq.req_len = req->req_len; - ireq.resp_ptr = (uint32_t)__qseecom_uvirt_to_kphys(data, - (uintptr_t)req->resp_ptr); - ireq.resp_len = req->resp_len; if ((cmd_id == QSEOS_TEE_OPEN_SESSION) || (cmd_id == QSEOS_TEE_REQUEST_CANCELLATION)) { @@ -4542,11 +4792,33 @@ static int __qseecom_qteec_issue_cmd(struct qseecom_dev_handle *data, if (ret) return ret; } + + if (qseecom.whitelist_support == true + && cmd_id == QSEOS_TEE_OPEN_SESSION) + ireq.qsee_cmd_id = QSEOS_TEE_OPEN_SESSION_WHITELIST; + else + ireq.qsee_cmd_id = cmd_id; + ireq.app_id = data->client.app_id; + ireq.req_ptr = (uint32_t)__qseecom_uvirt_to_kphys(data, + (uintptr_t)req->req_ptr); + ireq.req_len = req->req_len; + ireq.resp_ptr = (uint32_t)__qseecom_uvirt_to_kphys(data, + (uintptr_t)req->resp_ptr); + ireq.resp_len = req->resp_len; + ireq.sglistinfo_ptr = (uint32_t)virt_to_phys(table); + ireq.sglistinfo_len = SGLISTINFO_TABLE_SIZE; + dmac_flush_range((void *)table, + (void *)table + SGLISTINFO_TABLE_SIZE); + reqd_len_sb_in = req->req_len + req->resp_len; - msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, + ret = msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, data->client.sb_virt, reqd_len_sb_in, ION_IOC_CLEAN_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + return ret; + } ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, (const void *) &ireq, sizeof(ireq), @@ -4570,9 +4842,13 @@ static int __qseecom_qteec_issue_cmd(struct qseecom_dev_handle *data, ret = -EINVAL; } } - msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, + ret = msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, data->client.sb_virt, data->client.sb_length, ION_IOC_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + return ret; + } if ((cmd_id == QSEOS_TEE_OPEN_SESSION) || (cmd_id == QSEOS_TEE_REQUEST_CANCELLATION)) { @@ -4626,6 +4902,9 @@ static int qseecom_qteec_invoke_modfd_cmd(struct qseecom_dev_handle *data, int ret = 0; int i = 0; uint32_t reqd_len_sb_in = 0; + struct sglist_info *table = data->sglistinfo_ptr; + void *req_ptr = NULL; + void *resp_ptr = NULL; ret = copy_from_user(&req, argp, sizeof(struct qseecom_qteec_modfd_req)); @@ -4637,16 +4916,8 @@ static int qseecom_qteec_invoke_modfd_cmd(struct qseecom_dev_handle *data, (struct qseecom_qteec_req *)(&req)); if (ret) return ret; - - ireq.qsee_cmd_id = QSEOS_TEE_INVOKE_COMMAND; - ireq.app_id = data->client.app_id; - ireq.req_ptr = (uint32_t)__qseecom_uvirt_to_kphys(data, - (uintptr_t)req.req_ptr); - ireq.req_len = req.req_len; - ireq.resp_ptr = (uint32_t)__qseecom_uvirt_to_kphys(data, - (uintptr_t)req.resp_ptr); - ireq.resp_len = req.resp_len; - reqd_len_sb_in = req.req_len + req.resp_len; + req_ptr = req.req_ptr; + resp_ptr = req.resp_ptr; /* validate offsets */ for (i = 0; i < MAX_ION_FD; i++) { @@ -4662,10 +4933,32 @@ static int qseecom_qteec_invoke_modfd_cmd(struct qseecom_dev_handle *data, ret = __qseecom_update_qteec_req_buf(&req, data, false); if (ret) return ret; - msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, + + if (qseecom.whitelist_support == true) + ireq.qsee_cmd_id = QSEOS_TEE_INVOKE_COMMAND_WHITELIST; + else + ireq.qsee_cmd_id = QSEOS_TEE_INVOKE_COMMAND; + ireq.app_id = data->client.app_id; + ireq.req_ptr = (uint32_t)__qseecom_uvirt_to_kphys(data, + (uintptr_t)req_ptr); + ireq.req_len = req.req_len; + ireq.resp_ptr = (uint32_t)__qseecom_uvirt_to_kphys(data, + (uintptr_t)resp_ptr); + ireq.resp_len = req.resp_len; + ireq.sglistinfo_ptr = (uint32_t)virt_to_phys(table); + ireq.sglistinfo_len = SGLISTINFO_TABLE_SIZE; + dmac_flush_range((void *)table, + (void *)table + SGLISTINFO_TABLE_SIZE); + reqd_len_sb_in = req.req_len + req.resp_len; + + ret = msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, data->client.sb_virt, reqd_len_sb_in, ION_IOC_CLEAN_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + return ret; + } ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, (const void *) &ireq, sizeof(ireq), @@ -4693,9 +4986,13 @@ static int qseecom_qteec_invoke_modfd_cmd(struct qseecom_dev_handle *data, if (ret) return ret; - msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, + ret = msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle, data->client.sb_virt, data->client.sb_length, ION_IOC_INV_CACHES); + if (ret) { + pr_err("cache operation failed %d\n", ret); + return ret; + } return 0; } @@ -4717,6 +5014,15 @@ static int qseecom_qteec_request_cancellation(struct qseecom_dev_handle *data, return ret; } +static void __qseecom_clean_data_sglistinfo(struct qseecom_dev_handle *data) +{ + if (data->sglist_cnt) { + memset(data->sglistinfo_ptr, 0, + SGLISTINFO_TABLE_SIZE); + data->sglist_cnt = 0; + } +} + long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg) { int ret = 0; @@ -4888,6 +5194,7 @@ long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg) mutex_unlock(&app_access_lock); if (ret) pr_err("failed qseecom_send_cmd: %d\n", ret); + __qseecom_clean_data_sglistinfo(data); break; } case QSEECOM_IOCTL_RECEIVE_REQ: { @@ -5242,6 +5549,7 @@ long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg) wake_up_all(&data->abort_wq); if (ret) pr_err("failed qseecom_send_mod_resp: %d\n", ret); + __qseecom_clean_data_sglistinfo(data); break; } case QSEECOM_QTEEC_IOCTL_OPEN_SESSION_REQ: { @@ -5266,6 +5574,7 @@ long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg) mutex_unlock(&app_access_lock); if (ret) pr_err("failed open_session_cmd: %d\n", ret); + __qseecom_clean_data_sglistinfo(data); break; } case QSEECOM_QTEEC_IOCTL_CLOSE_SESSION_REQ: { @@ -5314,6 +5623,7 @@ long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg) mutex_unlock(&app_access_lock); if (ret) pr_err("failed Invoke cmd: %d\n", ret); + __qseecom_clean_data_sglistinfo(data); break; } case QSEECOM_QTEEC_IOCTL_REQUEST_CANCELLATION_REQ: { @@ -5365,7 +5675,6 @@ static int qseecom_open(struct inode *inode, struct file *file) data->mode = INACTIVE; init_waitqueue_head(&data->abort_wq); atomic_set(&data->ioctl_count, 0); - return ret; } @@ -5571,10 +5880,20 @@ static void __qseecom_deinit_clk(enum qseecom_ce_hw_instance ce) qclk->instance = CLK_INVALID; } +/* + * Check whitelist feature, and if TZ feature version is < 1.0.0, + * then whitelist feature is not supported. + */ +static int qseecom_check_whitelist_feature(void) +{ + int version = scm_get_feat_version(FEATURE_ID_WHITELIST); + + return version >= MAKE_WHITELIST_VERSION(1, 0, 0); +} + static int qseecom_probe(struct platform_device *pdev) { int rc; - int ret = 0; struct device *class_dev; char qsee_not_legacy = 0; struct msm_bus_scale_pdata *qseecom_platform_support = NULL; @@ -5606,6 +5925,7 @@ static int qseecom_probe(struct platform_device *pdev) qseecom.ce_ice.ce_core_src_clk = NULL; qseecom.ce_ice.ce_bus_clk = NULL; qseecom.ce_ice.clk_access_cnt = 0; + qseecom.whitelist_support = true; rc = alloc_chrdev_region(&qseecom_device_no, 0, 1, QSEECOM_DEV); if (rc < 0) { @@ -5622,7 +5942,7 @@ static int qseecom_probe(struct platform_device *pdev) class_dev = device_create(driver_class, NULL, qseecom_device_no, NULL, QSEECOM_DEV); - if (!class_dev) { + if (IS_ERR(class_dev)) { pr_err("class_device_create failed %d\n", rc); rc = -ENOMEM; goto exit_destroy_class; @@ -5674,7 +5994,7 @@ static int qseecom_probe(struct platform_device *pdev) qseecom.pdev = class_dev; /* Create ION msm client */ qseecom.ion_clnt = msm_ion_client_create("qseecom-kernel"); - if (qseecom.ion_clnt == NULL) { + if (IS_ERR_OR_NULL(qseecom.ion_clnt)) { pr_err("Ion client cannot be created\n"); rc = -ENOMEM; goto exit_del_cdev; @@ -5812,14 +6132,14 @@ static int qseecom_probe(struct platform_device *pdev) pr_info("CE operating frequency is not defined, setting to default 100MHZ\n"); qseecom.ce_opp_freq_hz = QSEE_CE_CLK_100MHZ; } - ret = __qseecom_init_clk(CLK_QSEE); - if (ret) + rc = __qseecom_init_clk(CLK_QSEE); + if (rc) goto exit_destroy_hw_instance_list; if ((qseecom.qsee.instance != qseecom.ce_drv.instance) && (qseecom.support_pfe || qseecom.support_fde)) { - ret = __qseecom_init_clk(CLK_CE_DRV); - if (ret) { + rc = __qseecom_init_clk(CLK_CE_DRV); + if (rc) { __qseecom_deinit_clk(CLK_QSEE); goto exit_destroy_hw_instance_list; } @@ -5852,7 +6172,7 @@ static int qseecom_probe(struct platform_device *pdev) } else { pr_err("Fail to get secure app region info\n"); rc = -EINVAL; - goto exit_destroy_hw_instance_list; + goto exit_deinit_clock; } rc = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, &req, sizeof(req), @@ -5861,7 +6181,7 @@ static int qseecom_probe(struct platform_device *pdev) pr_err("send secapp reg fail %d resp.res %d\n", rc, resp.result); rc = -EINVAL; - goto exit_destroy_hw_instance_list; + goto exit_deinit_clock; } } } else { @@ -5879,10 +6199,19 @@ static int qseecom_probe(struct platform_device *pdev) qseecom.qsee_perf_client = msm_bus_scale_register_client( qseecom_platform_support); + qseecom.whitelist_support = qseecom_check_whitelist_feature(); + pr_warn("qseecom.whitelist_support = %d\n", + qseecom.whitelist_support); + if (!qseecom.qsee_perf_client) pr_err("Unable to register bus client\n"); return 0; +exit_deinit_clock: + __qseecom_deinit_clk(CLK_QSEE); + if ((qseecom.qsee.instance != qseecom.ce_drv.instance) && + (qseecom.support_pfe || qseecom.support_fde)) + __qseecom_deinit_clk(CLK_CE_DRV); exit_destroy_hw_instance_list: kzfree(qseecom.ce_info.hlos_ce_hw_instance); exit_destroy_ion_client: diff --git a/drivers/net/ethernet/msm/ecm_ipa.c b/drivers/net/ethernet/msm/ecm_ipa.c index ce9cf6383bd0a..8de016da517e2 100644 --- a/drivers/net/ethernet/msm/ecm_ipa.c +++ b/drivers/net/ethernet/msm/ecm_ipa.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -9,7 +9,6 @@ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. */ - #include #include #include @@ -106,10 +105,6 @@ enum ecm_ipa_operation { * struct ecm_ipa_dev - main driver context parameters * @net: network interface struct implemented by this driver * @directory: debugfs directory for various debuging switches - * @tx_enable: flag that enable/disable Tx path to continue to IPA - * @rx_enable: flag that enable/disable Rx path to continue to IPA - * @rm_enable: flag that enable/disable Resource manager request prior to Tx - * @dma_enable: flag that allow on-the-fly DMA mode for IPA * @eth_ipv4_hdr_hdl: saved handle for ipv4 header-insertion table * @eth_ipv6_hdr_hdl: saved handle for ipv6 header-insertion table * @usb_to_ipa_hdl: save handle for IPA pipe operations @@ -129,10 +124,6 @@ enum ecm_ipa_operation { */ struct ecm_ipa_dev { struct net_device *net; - u32 tx_enable; - u32 rx_enable; - u32 rm_enable; - bool dma_enable; struct dentry *directory; uint32_t eth_ipv4_hdr_hdl; uint32_t eth_ipv6_hdr_hdl; @@ -167,32 +158,16 @@ static void ecm_ipa_rm_notify(void *user_data, enum ipa_rm_event event, static struct net_device_stats *ecm_ipa_get_stats(struct net_device *net); static int ecm_ipa_create_rm_resource(struct ecm_ipa_dev *ecm_ipa_ctx); static void ecm_ipa_destory_rm_resource(struct ecm_ipa_dev *ecm_ipa_ctx); -static bool rx_filter(struct sk_buff *skb); -static bool tx_filter(struct sk_buff *skb); -static bool rm_enabled(struct ecm_ipa_dev *ecm_ipa_ctx); static int resource_request(struct ecm_ipa_dev *ecm_ipa_ctx); static void resource_release(struct ecm_ipa_dev *ecm_ipa_ctx); static netdev_tx_t ecm_ipa_start_xmit(struct sk_buff *skb, struct net_device *net); -static int ecm_ipa_debugfs_stall_open(struct inode *inode, - struct file *file); -static ssize_t ecm_ipa_debugfs_stall_write(struct file *file, - const char __user *buf, size_t count, loff_t *ppos); static int ecm_ipa_debugfs_atomic_open(struct inode *inode, struct file *file); -static ssize_t ecm_ipa_debugfs_enable_write_dma(struct file *file, - const char __user *buf, size_t count, loff_t *ppos); -static int ecm_ipa_debugfs_dma_open(struct inode *inode, struct file *file); -static ssize_t ecm_ipa_debugfs_enable_write(struct file *file, - const char __user *buf, size_t count, loff_t *ppos); -static ssize_t ecm_ipa_debugfs_enable_read(struct file *file, - char __user *ubuf, size_t count, loff_t *ppos); static ssize_t ecm_ipa_debugfs_atomic_read(struct file *file, char __user *ubuf, size_t count, loff_t *ppos); static int ecm_ipa_debugfs_init(struct ecm_ipa_dev *ecm_ipa_ctx); static void ecm_ipa_debugfs_destroy(struct ecm_ipa_dev *ecm_ipa_ctx); static int ecm_ipa_ep_registers_cfg(u32 usb_to_ipa_hdl, u32 ipa_to_usb_hdl); -static int ecm_ipa_ep_registers_dma_cfg(u32 usb_to_ipa_hdl, - enum ipa_client_type prod_client); static int ecm_ipa_set_device_ethernet_addr(u8 *dev_ethaddr, u8 device_ethaddr[]); static enum ecm_ipa_state ecm_ipa_next_state(enum ecm_ipa_state current_state, @@ -210,22 +185,11 @@ static const struct net_device_ops ecm_ipa_netdev_ops = { .ndo_get_stats = ecm_ipa_get_stats, }; -const struct file_operations ecm_ipa_debugfs_dma_ops = { - .open = ecm_ipa_debugfs_dma_open, - .read = ecm_ipa_debugfs_enable_read, - .write = ecm_ipa_debugfs_enable_write_dma, -}; - const struct file_operations ecm_ipa_debugfs_atomic_ops = { .open = ecm_ipa_debugfs_atomic_open, .read = ecm_ipa_debugfs_atomic_read, }; -const struct file_operations ecm_ipa_debugfs_stall_ops = { - .open = ecm_ipa_debugfs_stall_open, - .write = ecm_ipa_debugfs_stall_write, -}; - static void ecm_ipa_msg_free_cb(void *buff, u32 len, u32 type) { kfree(buff); @@ -286,9 +250,6 @@ int ecm_ipa_init(struct ecm_ipa_params *params) ECM_IPA_DEBUG("ecm_ipa_ctx (private) = %p\n", ecm_ipa_ctx); ecm_ipa_ctx->net = net; - ecm_ipa_ctx->tx_enable = true; - ecm_ipa_ctx->rx_enable = true; - ecm_ipa_ctx->rm_enable = true; ecm_ipa_ctx->outstanding_high = DEFAULT_OUTSTANDING_HIGH; ecm_ipa_ctx->outstanding_low = DEFAULT_OUTSTANDING_LOW; atomic_set(&ecm_ipa_ctx->outstanding_pkts, 0); @@ -604,12 +565,6 @@ static netdev_tx_t ecm_ipa_start_xmit(struct sk_buff *skb, return NETDEV_TX_BUSY; } - if (unlikely(tx_filter(skb))) { - dev_kfree_skb_any(skb); - ECM_IPA_DEBUG("packet got filtered out on Tx path\n"); - status = NETDEV_TX_OK; - goto out; - } ret = resource_request(ecm_ipa_ctx); if (ret) { ECM_IPA_DEBUG("Waiting to resource\n"); @@ -681,11 +636,6 @@ static void ecm_ipa_packet_receive_notify(void *priv, skb->dev = ecm_ipa_ctx->net; skb->protocol = eth_type_trans(skb, ecm_ipa_ctx->net); - if (rx_filter(skb)) { - ECM_IPA_DEBUG("packet got filtered out on Rx path\n"); - dev_kfree_skb_any(skb); - return; - } result = netif_rx(skb); if (result) @@ -1148,42 +1098,15 @@ static void ecm_ipa_destory_rm_resource(struct ecm_ipa_dev *ecm_ipa_ctx) ECM_IPA_LOG_EXIT(); } -static bool rx_filter(struct sk_buff *skb) -{ - struct ecm_ipa_dev *ecm_ipa_ctx = netdev_priv(skb->dev); - return !ecm_ipa_ctx->rx_enable; -} - -static bool tx_filter(struct sk_buff *skb) -{ - struct ecm_ipa_dev *ecm_ipa_ctx = netdev_priv(skb->dev); - return !ecm_ipa_ctx->tx_enable; -} - -static bool rm_enabled(struct ecm_ipa_dev *ecm_ipa_ctx) -{ - return ecm_ipa_ctx->rm_enable; -} - static int resource_request(struct ecm_ipa_dev *ecm_ipa_ctx) { - int result = 0; - - if (!rm_enabled(ecm_ipa_ctx)) - goto out; - result = ipa_rm_inactivity_timer_request_resource( - IPA_RM_RESOURCE_STD_ECM_PROD); -out: - return result; + return ipa_rm_inactivity_timer_request_resource( + IPA_RM_RESOURCE_STD_ECM_PROD); } static void resource_release(struct ecm_ipa_dev *ecm_ipa_ctx) { - if (!rm_enabled(ecm_ipa_ctx)) - goto out; ipa_rm_inactivity_timer_release_resource(IPA_RM_RESOURCE_STD_ECM_PROD); -out: - return; } /** @@ -1255,45 +1178,6 @@ static void ecm_ipa_tx_timeout(struct net_device *net) net->stats.tx_errors++; } -static int ecm_ipa_debugfs_stall_open(struct inode *inode, - struct file *file) -{ - ECM_IPA_LOG_ENTRY(); - - ECM_IPA_LOG_EXIT(); - - return 0; -} - -static ssize_t ecm_ipa_debugfs_stall_write(struct file *file, - const char __user *buf, size_t count, loff_t *ppos) -{ - u32 cmdq_cfg_mmio_phy = 0xFD4E3038; - void *cmdq_cfg_mmio_virt; - int result; - bool val = 0; - - ECM_IPA_LOG_ENTRY(); - - file->private_data = &val; - result = ecm_ipa_debugfs_enable_write(file, buf, count, ppos); - - cmdq_cfg_mmio_virt = ioremap(cmdq_cfg_mmio_phy, sizeof(u32)); - if (!cmdq_cfg_mmio_virt) { - ECM_IPA_ERROR("fail on mmio for cmdq_cfg_mmio_phy=0x%x", - cmdq_cfg_mmio_phy); - return result; - } - - iowrite32(val, cmdq_cfg_mmio_virt); - ECM_IPA_DEBUG("Value %d was written to cfgq", val); - - ECM_IPA_LOG_EXIT(); - - return result; - -} - static int ecm_ipa_debugfs_atomic_open(struct inode *inode, struct file *file) { struct ecm_ipa_dev *ecm_ipa_ctx = inode->i_private; @@ -1303,78 +1187,6 @@ static int ecm_ipa_debugfs_atomic_open(struct inode *inode, struct file *file) return 0; } -static ssize_t ecm_ipa_debugfs_enable_write_dma(struct file *file, - const char __user *buf, size_t count, loff_t *ppos) -{ - struct ecm_ipa_dev *ecm_ipa_ctx = file->private_data; - int result; - ECM_IPA_LOG_ENTRY(); - file->private_data = &ecm_ipa_ctx->dma_enable; - result = ecm_ipa_debugfs_enable_write(file, buf, count, ppos); - if (ecm_ipa_ctx->dma_enable) - ecm_ipa_ep_registers_dma_cfg(ecm_ipa_ctx->usb_to_ipa_hdl, - ecm_ipa_ctx->ipa_to_usb_client); - else - ecm_ipa_ep_registers_cfg(ecm_ipa_ctx->usb_to_ipa_hdl, - ecm_ipa_ctx->usb_to_ipa_hdl); - ECM_IPA_LOG_EXIT(); - return result; -} - -static int ecm_ipa_debugfs_dma_open(struct inode *inode, struct file *file) -{ - struct ecm_ipa_dev *ecm_ipa_ctx = inode->i_private; - ECM_IPA_LOG_ENTRY(); - file->private_data = ecm_ipa_ctx; - ECM_IPA_LOG_EXIT(); - return 0; -} - -static ssize_t ecm_ipa_debugfs_enable_write(struct file *file, - const char __user *buf, size_t count, loff_t *ppos) -{ - unsigned long missing; - char input; - bool *enable = file->private_data; - if (count != sizeof(input) + 1) { - ECM_IPA_ERROR("wrong input length(%zd)\n", count); - return -EINVAL; - } - if (!buf) { - ECM_IPA_ERROR("Bad argument\n"); - return -EINVAL; - } - missing = copy_from_user(&input, buf, 1); - if (missing) - return -EFAULT; - ECM_IPA_DEBUG("input received %c\n", input); - *enable = input - '0'; - ECM_IPA_DEBUG("value was set to %d\n", *enable); - return count; -} - -static ssize_t ecm_ipa_debugfs_enable_read(struct file *file, - char __user *ubuf, size_t count, loff_t *ppos) -{ - int nbytes; - int size = 0; - int ret; - loff_t pos; - u8 enable_str[sizeof(char)*3] = {0}; - bool *enable = file->private_data; - pos = *ppos; - nbytes = scnprintf(enable_str, sizeof(enable_str), "%d\n", *enable); - ret = simple_read_from_buffer(ubuf, count, ppos, enable_str, nbytes); - if (ret < 0) { - ECM_IPA_ERROR("simple_read_from_buffer problem\n"); - return ret; - } - size += ret; - count -= nbytes; - *ppos = pos + size; - return size; -} - static ssize_t ecm_ipa_debugfs_atomic_read(struct file *file, char __user *ubuf, size_t count, loff_t *ppos) { @@ -1391,7 +1203,6 @@ static int ecm_ipa_debugfs_init(struct ecm_ipa_dev *ecm_ipa_ctx) { const mode_t flags_read_write = S_IRUGO | S_IWUGO; const mode_t flags_read_only = S_IRUGO; - const mode_t flags_write_only = S_IWUGO; struct dentry *file; ECM_IPA_LOG_ENTRY(); @@ -1404,24 +1215,6 @@ static int ecm_ipa_debugfs_init(struct ecm_ipa_dev *ecm_ipa_ctx) ECM_IPA_ERROR("could not create debugfs directory entry\n"); goto fail_directory; } - file = debugfs_create_bool("tx_enable", flags_read_write, - ecm_ipa_ctx->directory, &ecm_ipa_ctx->tx_enable); - if (!file) { - ECM_IPA_ERROR("could not create debugfs tx file\n"); - goto fail_file; - } - file = debugfs_create_bool("rx_enable", flags_read_write, - ecm_ipa_ctx->directory, &ecm_ipa_ctx->rx_enable); - if (!file) { - ECM_IPA_ERROR("could not create debugfs rx file\n"); - goto fail_file; - } - file = debugfs_create_bool("rm_enable", flags_read_write, - ecm_ipa_ctx->directory, &ecm_ipa_ctx->rm_enable); - if (!file) { - ECM_IPA_ERROR("could not create debugfs rm file\n"); - goto fail_file; - } file = debugfs_create_u8("outstanding_high", flags_read_write, ecm_ipa_ctx->directory, &ecm_ipa_ctx->outstanding_high); if (!file) { @@ -1434,13 +1227,6 @@ static int ecm_ipa_debugfs_init(struct ecm_ipa_dev *ecm_ipa_ctx) ECM_IPA_ERROR("could not create outstanding_low file\n"); goto fail_file; } - file = debugfs_create_file("dma_enable", flags_read_write, - ecm_ipa_ctx->directory, - ecm_ipa_ctx, &ecm_ipa_debugfs_dma_ops); - if (!file) { - ECM_IPA_ERROR("could not create debugfs dma file\n"); - goto fail_file; - } file = debugfs_create_file("outstanding", flags_read_only, ecm_ipa_ctx->directory, ecm_ipa_ctx, &ecm_ipa_debugfs_atomic_ops); @@ -1449,14 +1235,7 @@ static int ecm_ipa_debugfs_init(struct ecm_ipa_dev *ecm_ipa_ctx) goto fail_file; } - file = debugfs_create_file("stall_ipa_rx_proc", flags_write_only, - ecm_ipa_ctx->directory, - ecm_ipa_ctx, &ecm_ipa_debugfs_stall_ops); - if (!file) { - ECM_IPA_ERROR("could not create stall_ipa_rx_proc file\n"); - goto fail_file; - } - + ECM_IPA_DEBUG("debugfs entries were created\n"); ECM_IPA_LOG_EXIT(); return 0; @@ -1519,46 +1298,6 @@ static int ecm_ipa_ep_registers_cfg(u32 usb_to_ipa_hdl, u32 ipa_to_usb_hdl) return result; } -/** - * ecm_ipa_ep_registers_dma_cfg() - configure the USB endpoints for ECM - * DMA - * @usb_to_ipa_hdl: handle received from ipa_connect - * - * This function will override the previous configuration - * which is needed for cores that does not support blocks logic - * Note that client handles are the actual pipe index - */ -static int ecm_ipa_ep_registers_dma_cfg(u32 usb_to_ipa_hdl, - enum ipa_client_type prod_client) -{ - int result = 0; - struct ipa_ep_cfg_mode cfg_mode; - u32 apps_to_ipa_hdl = 2; - - ECM_IPA_LOG_ENTRY(); - - memset(&cfg_mode, 0 , sizeof(cfg_mode)); - cfg_mode.mode = IPA_DMA; - cfg_mode.dst = prod_client; - result = ipa_cfg_ep_mode(apps_to_ipa_hdl, &cfg_mode); - if (result) { - ECM_IPA_ERROR("failed to configure Apps to IPA\n"); - goto out; - } - memset(&cfg_mode, 0 , sizeof(cfg_mode)); - cfg_mode.mode = IPA_DMA; - cfg_mode.dst = IPA_CLIENT_A5_LAN_WAN_CONS; - result = ipa_cfg_ep_mode(usb_to_ipa_hdl, &cfg_mode); - if (result) { - ECM_IPA_ERROR("failed to configure USB to IPA\n"); - goto out; - } - ECM_IPA_DEBUG("end-point registers successfully configured\n"); -out: - ECM_IPA_LOG_EXIT(); - return result; -} - /** * ecm_ipa_set_device_ethernet_addr() - set device etherenet address * @dev_ethaddr: device etherenet address diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c index b1897c7afdd8d..ea0a686a09ebd 100644 --- a/drivers/net/usb/cdc_ether.c +++ b/drivers/net/usb/cdc_ether.c @@ -191,7 +191,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf) info->u->bSlaveInterface0); if (!info->control || !info->data) { dev_dbg(&intf->dev, - "master #%u/%p slave #%u/%p\n", + "master #%u/%pK slave #%u/%pK\n", info->u->bMasterInterface0, info->control, info->u->bSlaveInterface0, @@ -287,7 +287,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf) info->data = usb_ifnum_to_if(dev->udev, 1); if (!info->control || !info->data || info->control != intf) { dev_dbg(&intf->dev, - "rndis: master #0/%p slave #1/%p\n", + "rndis: master #0/%pK slave #1/%pK\n", info->control, info->data); goto bad_desc; diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c index 7cabe4583904c..5b04430bfac3a 100644 --- a/drivers/net/usb/cdc_mbim.c +++ b/drivers/net/usb/cdc_mbim.c @@ -305,7 +305,7 @@ static int cdc_mbim_rx_fixup(struct usbnet *dev, struct sk_buff *skb_in) /* sanity checking */ if (((offset + len) > skb_in->len) || (len > ctx->rx_max)) { netif_dbg(dev, rx_err, dev->net, - "invalid frame detected (ignored) offset[%u]=%u, length=%u, skb=%p\n", + "invalid frame detected (ignored) offset[%u]=%u, length=%u, skb=%pK\n", x, offset, len, skb_in); if (!x) goto err_ndp; diff --git a/drivers/net/usb/rmnet_usb_ctrl.c b/drivers/net/usb/rmnet_usb_ctrl.c index f44d4dcb9075c..58fd1f68636c2 100644 --- a/drivers/net/usb/rmnet_usb_ctrl.c +++ b/drivers/net/usb/rmnet_usb_ctrl.c @@ -982,7 +982,7 @@ static ssize_t rmnet_usb_ctrl_read_stats(struct file *file, char __user *ubuf, cdev = &ctrl_devs[i][n]; dev = cdev->cudev; temp += scnprintf(buf + temp, DEBUG_BUF_SIZE - temp, - "\n#ctrl_dev: %p Name: %s#\n" + "\n#ctrl_dev: %pK Name: %s#\n" "snd encap cmd cnt %u\n" "resp avail cnt: %u\n" "get encap resp cnt: %u\n" diff --git a/drivers/platform/msm/ipa/ipa.c b/drivers/platform/msm/ipa/ipa.c index ec050e95d09a5..a6334d4b2bd4f 100644 --- a/drivers/platform/msm/ipa/ipa.c +++ b/drivers/platform/msm/ipa/ipa.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -431,7 +431,8 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) retval = -EFAULT; break; } - if (ipa_del_hdr((struct ipa_ioc_del_hdr *)param)) { + if (ipa_del_hdr_by_user((struct ipa_ioc_del_hdr *)param, + true)) { retval = -EFAULT; break; } @@ -1112,8 +1113,8 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) retval = -EFAULT; break; } - if (ipa_del_hdr_proc_ctx( - (struct ipa_ioc_del_hdr_proc_ctx *)param)) { + if (ipa_del_hdr_proc_ctx_by_user( + (struct ipa_ioc_del_hdr_proc_ctx *)param, true)) { retval = -EFAULT; break; } @@ -2266,7 +2267,7 @@ static int ipa_setup_apps_pipes(void) if (ipa_ctx->dflt_v4_rt_rule_hdl) __ipa_del_rt_rule(ipa_ctx->dflt_v4_rt_rule_hdl); if (ipa_ctx->excp_hdr_hdl) - __ipa_del_hdr(ipa_ctx->excp_hdr_hdl); + __ipa_del_hdr(ipa_ctx->excp_hdr_hdl, false); ipa_teardown_sys_pipe(ipa_ctx->clnt_hdl_cmd); fail_cmd: return result; @@ -2278,7 +2279,7 @@ static void ipa_teardown_apps_pipes(void) ipa_teardown_sys_pipe(ipa_ctx->clnt_hdl_data_in); __ipa_del_rt_rule(ipa_ctx->dflt_v6_rt_rule_hdl); __ipa_del_rt_rule(ipa_ctx->dflt_v4_rt_rule_hdl); - __ipa_del_hdr(ipa_ctx->excp_hdr_hdl); + __ipa_del_hdr(ipa_ctx->excp_hdr_hdl, false); ipa_teardown_sys_pipe(ipa_ctx->clnt_hdl_cmd); } diff --git a/drivers/platform/msm/ipa/ipa_hdr.c b/drivers/platform/msm/ipa/ipa_hdr.c index c1e920539b0e2..1426e4bc66e2b 100644 --- a/drivers/platform/msm/ipa/ipa_hdr.c +++ b/drivers/platform/msm/ipa/ipa_hdr.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -719,7 +719,8 @@ static int __ipa_add_hdr(struct ipa_hdr_add *hdr) return -EPERM; } -static int __ipa_del_hdr_proc_ctx(u32 proc_ctx_hdl, bool release_hdr) +static int __ipa_del_hdr_proc_ctx(u32 proc_ctx_hdl, + bool release_hdr, bool by_user) { struct ipa_hdr_proc_ctx_entry *entry; struct ipa_hdr_proc_ctx_tbl *htbl = &ipa_ctx->hdr_proc_ctx_tbl; @@ -733,6 +734,14 @@ static int __ipa_del_hdr_proc_ctx(u32 proc_ctx_hdl, bool release_hdr) IPADBG("del ctx proc cnt=%d ofst=%d\n", htbl->proc_ctx_cnt, entry->offset_entry->offset); + if (by_user && entry->user_deleted) { + IPAERR("proc_ctx already deleted by user\n"); + return -EINVAL; + } + + if (by_user) + entry->user_deleted = true; + if (--entry->ref_cnt) { IPADBG("proc_ctx_hdl %x ref_cnt %d\n", proc_ctx_hdl, entry->ref_cnt); @@ -740,7 +749,7 @@ static int __ipa_del_hdr_proc_ctx(u32 proc_ctx_hdl, bool release_hdr) } if (release_hdr) - __ipa_release_hdr(entry->hdr->id); + __ipa_del_hdr(entry->hdr->id, false); /* move the offset entry to appropriate free list */ list_move(&entry->offset_entry->link, @@ -757,7 +766,7 @@ static int __ipa_del_hdr_proc_ctx(u32 proc_ctx_hdl, bool release_hdr) } -int __ipa_del_hdr(u32 hdr_hdl) +int __ipa_del_hdr(u32 hdr_hdl, bool by_user) { struct ipa_hdr_entry *entry; struct ipa_hdr_tbl *htbl = &ipa_ctx->hdr_tbl; @@ -776,6 +785,14 @@ int __ipa_del_hdr(u32 hdr_hdl) IPADBG("del hdr of sz=%d hdr_cnt=%d ofst=%d\n", entry->hdr_len, htbl->hdr_cnt, entry->offset_entry->offset); + if (by_user && entry->user_deleted) { + IPAERR("hdr already deleted by user\n"); + return -EINVAL; + } + + if (by_user) + entry->user_deleted = true; + if (--entry->ref_cnt) { IPADBG("hdr_hdl %x ref_cnt %d\n", hdr_hdl, entry->ref_cnt); return 0; @@ -786,7 +803,7 @@ int __ipa_del_hdr(u32 hdr_hdl) entry->phys_base, entry->hdr_len, DMA_TO_DEVICE); - __ipa_del_hdr_proc_ctx(entry->proc_ctx->id, false); + __ipa_del_hdr_proc_ctx(entry->proc_ctx->id, false, false); } else { /* move the offset entry to appropriate free list */ list_move(&entry->offset_entry->link, @@ -849,15 +866,16 @@ int ipa_add_hdr(struct ipa_ioc_add_hdr *hdrs) EXPORT_SYMBOL(ipa_add_hdr); /** - * ipa_del_hdr() - Remove the specified headers from SW and optionally commit them - * to IPA HW + * ipa_del_hdr_by_user() - Remove the specified headers + * from SW and optionally commit them to IPA HW * @hdls: [inout] set of headers to delete + * @by_user: Operation requested by user? * * Returns: 0 on success, negative on failure * * Note: Should not be called from atomic context */ -int ipa_del_hdr(struct ipa_ioc_del_hdr *hdls) +int ipa_del_hdr_by_user(struct ipa_ioc_del_hdr *hdls, bool by_user) { int i; int result = -EFAULT; @@ -869,7 +887,7 @@ int ipa_del_hdr(struct ipa_ioc_del_hdr *hdls) mutex_lock(&ipa_ctx->lock); for (i = 0; i < hdls->num_hdls; i++) { - if (__ipa_del_hdr(hdls->hdl[i].hdl)) { + if (__ipa_del_hdr(hdls->hdl[i].hdl, by_user)) { IPAERR("failed to del hdr %i\n", i); hdls->hdl[i].status = -1; } else { @@ -888,6 +906,20 @@ int ipa_del_hdr(struct ipa_ioc_del_hdr *hdls) mutex_unlock(&ipa_ctx->lock); return result; } + +/** + * ipa_del_hdr() - Remove the specified headers from SW and optionally commit them + * to IPA HW + * @hdls: [inout] set of headers to delete + * + * Returns: 0 on success, negative on failure + * + * Note: Should not be called from atomic context + */ +int ipa_del_hdr(struct ipa_ioc_del_hdr *hdls) +{ + return ipa_del_hdr_by_user(hdls, false); +} EXPORT_SYMBOL(ipa_del_hdr); /** @@ -936,16 +968,18 @@ int ipa_add_hdr_proc_ctx(struct ipa_ioc_add_hdr_proc_ctx *proc_ctxs) EXPORT_SYMBOL(ipa_add_hdr_proc_ctx); /** - * ipa_del_hdr_proc_ctx() - + * ipa_del_hdr_proc_ctx_by_user() - * Remove the specified processing context headers from SW and * optionally commit them to IPA HW. * @hdls: [inout] set of processing context headers to delete + * @by_user: Operation requested by user? * * Returns: 0 on success, negative on failure * * Note: Should not be called from atomic context */ -int ipa_del_hdr_proc_ctx(struct ipa_ioc_del_hdr_proc_ctx *hdls) +int ipa_del_hdr_proc_ctx_by_user(struct ipa_ioc_del_hdr_proc_ctx *hdls, + bool by_user) { int i; int result; @@ -957,7 +991,7 @@ int ipa_del_hdr_proc_ctx(struct ipa_ioc_del_hdr_proc_ctx *hdls) mutex_lock(&ipa_ctx->lock); for (i = 0; i < hdls->num_hdls; i++) { - if (__ipa_del_hdr_proc_ctx(hdls->hdl[i].hdl, true)) { + if (__ipa_del_hdr_proc_ctx(hdls->hdl[i].hdl, true, by_user)) { IPAERR("failed to del hdr %i\n", i); hdls->hdl[i].status = -1; } else { @@ -976,6 +1010,21 @@ int ipa_del_hdr_proc_ctx(struct ipa_ioc_del_hdr_proc_ctx *hdls) mutex_unlock(&ipa_ctx->lock); return result; } + +/** + * ipa_del_hdr_proc_ctx() - + * Remove the specified processing context headers from SW and + * optionally commit them to IPA HW. + * @hdls: [inout] set of processing context headers to delete + * + * Returns: 0 on success, negative on failure + * + * Note: Should not be called from atomic context + */ +int ipa_del_hdr_proc_ctx(struct ipa_ioc_del_hdr_proc_ctx *hdls) +{ + return ipa_del_hdr_proc_ctx_by_user(hdls, false); +} EXPORT_SYMBOL(ipa_del_hdr_proc_ctx); /** @@ -1197,7 +1246,7 @@ int __ipa_release_hdr(u32 hdr_hdl) { int result = 0; - if (__ipa_del_hdr(hdr_hdl)) { + if (__ipa_del_hdr(hdr_hdl, false)) { IPADBG("fail to del hdr %x\n", hdr_hdl); result = -EFAULT; goto bail; @@ -1225,7 +1274,7 @@ int __ipa_release_hdr_proc_ctx(u32 proc_ctx_hdl) { int result = 0; - if (__ipa_del_hdr_proc_ctx(proc_ctx_hdl, true)) { + if (__ipa_del_hdr_proc_ctx(proc_ctx_hdl, true, false)) { IPADBG("fail to del hdr %x\n", proc_ctx_hdl); result = -EFAULT; goto bail; diff --git a/drivers/platform/msm/ipa/ipa_i.h b/drivers/platform/msm/ipa/ipa_i.h index 9ff220bac6c5d..0342ad1ff05da 100644 --- a/drivers/platform/msm/ipa/ipa_i.h +++ b/drivers/platform/msm/ipa/ipa_i.h @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -226,6 +226,7 @@ struct ipa_rt_tbl { * @id: header entry id * @is_eth2_ofst_valid: is eth2_ofst field valid? * @eth2_ofst: offset to start of Ethernet-II/802.3 header + * @user_deleted: is the header deleted by the user? */ struct ipa_hdr_entry { struct list_head link; @@ -243,6 +244,7 @@ struct ipa_hdr_entry { int id; u8 is_eth2_ofst_valid; u16 eth2_ofst; + bool user_deleted; }; /** @@ -318,6 +320,7 @@ struct ipa_hdr_proc_ctx_add_hdr_cmd_seq { * @cookie: cookie used for validity check * @ref_cnt: reference counter of routing table * @id: processing context header entry id + * @user_deleted: is the hdr processing context deleted by the user? */ struct ipa_hdr_proc_ctx_entry { struct list_head link; @@ -327,6 +330,7 @@ struct ipa_hdr_proc_ctx_entry { u32 cookie; u32 ref_cnt; int id; + bool user_deleted; }; /** @@ -1410,8 +1414,11 @@ void ipa_inc_client_enable_clks(void); int ipa_inc_client_enable_clks_no_block(void); void ipa_dec_client_disable_clks(void); int ipa_interrupts_init(u32 ipa_irq, u32 ee, struct device *ipa_dev); +int ipa_del_hdr_by_user(struct ipa_ioc_del_hdr *hdls, bool by_user); +int ipa_del_hdr_proc_ctx_by_user(struct ipa_ioc_del_hdr_proc_ctx *hdls, + bool by_user); int __ipa_del_rt_rule(u32 rule_hdl); -int __ipa_del_hdr(u32 hdr_hdl); +int __ipa_del_hdr(u32 hdr_hdl, bool by_user); int __ipa_release_hdr(u32 hdr_hdl); int __ipa_release_hdr_proc_ctx(u32 proc_ctx_hdl); int _ipa_read_gen_reg_v1_1(char *buff, int max_len); diff --git a/drivers/platform/msm/ipa/ipa_intf.c b/drivers/platform/msm/ipa/ipa_intf.c index 535ea84297474..63adbfa3b5a72 100644 --- a/drivers/platform/msm/ipa/ipa_intf.c +++ b/drivers/platform/msm/ipa/ipa_intf.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -265,6 +265,14 @@ int ipa_query_intf_tx_props(struct ipa_ioc_query_intf_tx_props *tx) mutex_lock(&ipa_ctx->lock); list_for_each_entry(entry, &ipa_ctx->intf_list, link) { if (!strncmp(entry->name, tx->name, IPA_RESOURCE_NAME_MAX)) { + /* add the entry check */ + if (entry->num_tx_props != tx->num_tx_props) { + IPAERR("invalid entry number(%u %u)\n", + entry->num_tx_props, + tx->num_tx_props); + mutex_unlock(&ipa_ctx->lock); + return result; + } memcpy(tx->tx, entry->tx, entry->num_tx_props * sizeof(struct ipa_ioc_tx_intf_prop)); result = 0; @@ -298,6 +306,14 @@ int ipa_query_intf_rx_props(struct ipa_ioc_query_intf_rx_props *rx) mutex_lock(&ipa_ctx->lock); list_for_each_entry(entry, &ipa_ctx->intf_list, link) { if (!strncmp(entry->name, rx->name, IPA_RESOURCE_NAME_MAX)) { + /* add the entry check */ + if (entry->num_rx_props != rx->num_rx_props) { + IPAERR("invalid entry number(%u %u)\n", + entry->num_rx_props, + rx->num_rx_props); + mutex_unlock(&ipa_ctx->lock); + return result; + } memcpy(rx->rx, entry->rx, entry->num_rx_props * sizeof(struct ipa_ioc_rx_intf_prop)); result = 0; @@ -331,6 +347,14 @@ int ipa_query_intf_ext_props(struct ipa_ioc_query_intf_ext_props *ext) mutex_lock(&ipa_ctx->lock); list_for_each_entry(entry, &ipa_ctx->intf_list, link) { if (!strcmp(entry->name, ext->name)) { + /* add the entry check */ + if (entry->num_ext_props != ext->num_ext_props) { + IPAERR("invalid entry number(%u %u)\n", + entry->num_ext_props, + ext->num_ext_props); + mutex_unlock(&ipa_ctx->lock); + return result; + } memcpy(ext->ext, entry->ext, entry->num_ext_props * sizeof(struct ipa_ioc_ext_intf_prop)); result = 0; diff --git a/drivers/platform/msm/pft.c b/drivers/platform/msm/pft.c index 47f1ace0eba99..15b8c3eaa78c7 100644 --- a/drivers/platform/msm/pft.c +++ b/drivers/platform/msm/pft.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014, The Linux Foundation. All rights reserved. + * Copyright (c) 2014-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -217,12 +217,14 @@ static int __init pft_lsm_init(struct pft_device *dev) ret = register_security(&pft_security_ops); if (ret) { pr_err("pft lsm registeration failed, ret=%d.\n", ret); - return 0; + return ret; } + dev->is_chosen_lsm = true; pr_debug("pft is the chosen lsm, registered sucessfully !\n"); } else { - pr_debug("pft is not the chosen lsm.\n"); + pr_err("pft is not the chosen lsm.\n"); + return -ENODEV; } return 0; diff --git a/drivers/platform/msm/usb_bam.c b/drivers/platform/msm/usb_bam.c index 1f04dc681924c..a38565ed1ce1e 100644 --- a/drivers/platform/msm/usb_bam.c +++ b/drivers/platform/msm/usb_bam.c @@ -228,10 +228,10 @@ void msm_bam_set_hsic_host_dev(struct device *dev) if (dev) { /* Hold the device until allowing lpm */ info[HSIC_CTRL].in_lpm = false; - pr_debug("%s: Getting hsic device %p\n", __func__, dev); + pr_debug("%s: Getting hsic device %pK\n", __func__, dev); pm_runtime_get(dev); } else if (host_info[HSIC_CTRL].dev) { - pr_debug("%s: Try Putting hsic device %p, lpm:%d\n", __func__, + pr_debug("%s: Try Putting hsic device %pK, lpm:%d\n", __func__, host_info[HSIC_CTRL].dev, info[HSIC_CTRL].in_lpm); /* Just release previous device if not already done */ if (!info[HSIC_CTRL].in_lpm) { @@ -821,7 +821,7 @@ static bool _hsic_host_bam_resume_core(void) /* Exit from "full suspend" in case of hsic host */ if (host_info[HSIC_CTRL].dev && info[HSIC_CTRL].in_lpm) { - pr_debug("%s: Getting hsic device %p\n", __func__, + pr_debug("%s: Getting hsic device %pK\n", __func__, host_info[HSIC_CTRL].dev); pm_runtime_get(host_info[HSIC_CTRL].dev); info[HSIC_CTRL].in_lpm = false; @@ -872,7 +872,7 @@ static void _hsic_host_bam_suspend_core(void) pr_debug("%s: enter\n", __func__); if (host_info[HSIC_CTRL].dev && !info[HSIC_CTRL].in_lpm) { - pr_debug("%s: Putting hsic host device %p\n", __func__, + pr_debug("%s: Putting hsic host device %pK\n", __func__, host_info[HSIC_CTRL].dev); pm_runtime_put(host_info[HSIC_CTRL].dev); info[HSIC_CTRL].in_lpm = true; @@ -1734,7 +1734,7 @@ static bool check_pipes_empty(u8 src_idx, u8 dst_idx) /* If we have any remaints in the pipes we don't go to sleep */ prod_pipe = ctx.usb_bam_sps.sps_pipes[src_idx]; cons_pipe = ctx.usb_bam_sps.sps_pipes[dst_idx]; - pr_debug("prod_pipe=%p, cons_pipe=%p", prod_pipe, cons_pipe); + pr_debug("prod_pipe=%pK, cons_pipe=%pK", prod_pipe, cons_pipe); if (!cons_pipe || (!prod_pipe && prod_pipe_connect->pipe_type == USB_BAM_PIPE_BAM2BAM)) { @@ -2079,7 +2079,7 @@ bool msm_bam_host_lpm_ok(enum usb_ctrl bam_type) } /* HSIC host will go now to lpm */ - pr_debug("%s: vote for suspend hsic %p\n", + pr_debug("%s: vote for suspend hsic %pK\n", __func__, host_info[bam_type].dev); for (i = 0; i < ctx.max_connections; i++) { @@ -2473,7 +2473,7 @@ static void usb_bam_work(struct work_struct *w) pipe_iter->dir == PEER_PERIPHERAL_TO_USB && pipe_iter->enabled) { - pr_debug("%s: Register wakeup on pipe %p\n", + pr_debug("%s: Register wakeup on pipe %pK\n", __func__, pipe_iter); __usb_bam_register_wake_cb(i, pipe_iter->activity_notify, diff --git a/drivers/power/qcom/msm-pm.c b/drivers/power/qcom/msm-pm.c index 775fabb135150..f36757be250fd 100755 --- a/drivers/power/qcom/msm-pm.c +++ b/drivers/power/qcom/msm-pm.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2010-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2010-2015,2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -90,6 +90,7 @@ static long *msm_pc_debug_counters; static cpumask_t retention_cpus; static DEFINE_SPINLOCK(retention_lock); +static DEFINE_MUTEX(msm_pc_debug_mutex); static bool msm_pm_is_L1_writeback(void) { @@ -717,33 +718,48 @@ static ssize_t msm_pc_debug_counters_file_read(struct file *file, char __user *bufu, size_t count, loff_t *ppos) { struct msm_pc_debug_counters_buffer *data; + ssize_t ret; + mutex_lock(&msm_pc_debug_mutex); data = file->private_data; - if (!data) - return -EINVAL; + if (!data) { + ret = -EINVAL; + goto exit; + } - if (!bufu) - return -EINVAL; + if (!bufu) { + ret = -EINVAL; + goto exit; + } - if (!access_ok(VERIFY_WRITE, bufu, count)) - return -EFAULT; + if (!access_ok(VERIFY_WRITE, bufu, count)) { + ret = -EFAULT; + goto exit; + } if (*ppos >= data->len && data->len == 0) data->len = msm_pc_debug_counters_copy(data); - return simple_read_from_buffer(bufu, count, ppos, + ret = simple_read_from_buffer(bufu, count, ppos, data->buf, data->len); +exit: + mutex_unlock(&msm_pc_debug_mutex); + return ret; } static int msm_pc_debug_counters_file_open(struct inode *inode, struct file *file) { struct msm_pc_debug_counters_buffer *buf; + int ret = 0; + mutex_lock(&msm_pc_debug_mutex); - if (!inode->i_private) - return -EINVAL; + if (!inode->i_private) { + ret = -EINVAL; + goto exit; + } file->private_data = kzalloc( sizeof(struct msm_pc_debug_counters_buffer), GFP_KERNEL); @@ -752,19 +768,24 @@ static int msm_pc_debug_counters_file_open(struct inode *inode, pr_err("%s: ERROR kmalloc failed to allocate %zu bytes\n", __func__, sizeof(struct msm_pc_debug_counters_buffer)); - return -ENOMEM; + ret = -ENOMEM; + goto exit; } buf = file->private_data; buf->reg = (long *)inode->i_private; - return 0; +exit: + mutex_unlock(&msm_pc_debug_mutex); + return ret; } static int msm_pc_debug_counters_file_close(struct inode *inode, struct file *file) { + mutex_lock(&msm_pc_debug_mutex); kfree(file->private_data); + mutex_unlock(&msm_pc_debug_mutex); return 0; } diff --git a/drivers/power/qpnp-fg.c b/drivers/power/qpnp-fg.c index 0b01129fc8b79..1f3e5f743d15e 100755 --- a/drivers/power/qpnp-fg.c +++ b/drivers/power/qpnp-fg.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -579,6 +579,7 @@ struct fg_trans { struct fg_chip *chip; struct fg_log_buffer *log; /* log buffer */ u8 *data; /* fg data that is read */ + struct mutex memif_dfs_lock; /* Prevent thread concurrency */ }; struct fg_dbgfs { @@ -5395,6 +5396,7 @@ static int fg_memif_data_open(struct inode *inode, struct file *file) trans->addr = dbgfs_data.addr; trans->chip = dbgfs_data.chip; trans->offset = trans->addr; + mutex_init(&trans->memif_dfs_lock); file->private_data = trans; return 0; @@ -5406,6 +5408,7 @@ static int fg_memif_dfs_close(struct inode *inode, struct file *file) if (trans && trans->log && trans->data) { file->private_data = NULL; + mutex_destroy(&trans->memif_dfs_lock); kfree(trans->log); kfree(trans->data); kfree(trans); @@ -5563,10 +5566,13 @@ static ssize_t fg_memif_dfs_reg_read(struct file *file, char __user *buf, size_t ret; size_t len; + mutex_lock(&trans->memif_dfs_lock); /* Is the the log buffer empty */ if (log->rpos >= log->wpos) { - if (get_log_data(trans) <= 0) - return 0; + if (get_log_data(trans) <= 0) { + len = 0; + goto unlock_mutex; + } } len = min(count, log->wpos - log->rpos); @@ -5574,7 +5580,8 @@ static ssize_t fg_memif_dfs_reg_read(struct file *file, char __user *buf, ret = copy_to_user(buf, &log->data[log->rpos], len); if (ret == len) { pr_err("error copy sram register values to user\n"); - return -EFAULT; + len = -EFAULT; + goto unlock_mutex; } /* 'ret' is the number of bytes not copied */ @@ -5582,6 +5589,9 @@ static ssize_t fg_memif_dfs_reg_read(struct file *file, char __user *buf, *ppos += len; log->rpos += len; + +unlock_mutex: + mutex_unlock(&trans->memif_dfs_lock); return len; } @@ -5602,14 +5612,20 @@ static ssize_t fg_memif_dfs_reg_write(struct file *file, const char __user *buf, int cnt = 0; u8 *values; size_t ret = 0; + char *kbuf; + u32 offset; struct fg_trans *trans = file->private_data; - u32 offset = trans->offset; + + mutex_lock(&trans->memif_dfs_lock); + offset = trans->offset; /* Make a copy of the user data */ - char *kbuf = kmalloc(count + 1, GFP_KERNEL); - if (!kbuf) - return -ENOMEM; + kbuf = kmalloc(count + 1, GFP_KERNEL); + if (!kbuf) { + ret = -ENOMEM; + goto unlock_mutex; + } ret = copy_from_user(kbuf, buf, count); if (ret == count) { @@ -5648,6 +5664,8 @@ static ssize_t fg_memif_dfs_reg_write(struct file *file, const char __user *buf, free_buf: kfree(kbuf); +unlock_mutex: + mutex_unlock(&trans->memif_dfs_lock); return ret; } diff --git a/drivers/soc/qcom/peripheral-loader.c b/drivers/soc/qcom/peripheral-loader.c index 2b04dfcc4f3ec..300688a2b4663 100644 --- a/drivers/soc/qcom/peripheral-loader.c +++ b/drivers/soc/qcom/peripheral-loader.c @@ -498,6 +498,13 @@ static int pil_init_mmap(struct pil_desc *desc, const struct pil_mdt *mdt) return pil_init_entry_addr(priv, mdt); } +struct pil_map_fw_info { + void *region; + struct dma_attrs attrs; + phys_addr_t base_addr; + struct device *dev; +}; + static void pil_release_mmap(struct pil_desc *desc) { struct pil_priv *priv = desc->priv; @@ -516,14 +523,30 @@ static void pil_release_mmap(struct pil_desc *desc) } } -#define IOMAP_SIZE SZ_1M +static void pil_clear_segment(struct pil_desc *desc) +{ + struct pil_priv *priv = desc->priv; + u8 __iomem *buf; -struct pil_map_fw_info { - void *region; - struct dma_attrs attrs; - phys_addr_t base_addr; - struct device *dev; -}; + struct pil_map_fw_info map_fw_info = { + .attrs = desc->attrs, + .region = priv->region, + .base_addr = priv->region_start, + .dev = desc->dev, + }; + + void *map_data = desc->map_data ? desc->map_data : &map_fw_info; + + /* Clear memory so that unauthorized ELF code is not left behind */ + buf = desc->map_fw_mem(priv->region_start, (priv->region_end - + priv->region_start), map_data); + pil_memset_io(buf, 0, (priv->region_end - priv->region_start)); + desc->unmap_fw_mem(buf, (priv->region_end - priv->region_start), + map_data); + +} + +#define IOMAP_SIZE SZ_1M static void *map_fw_mem(phys_addr_t paddr, size_t size, void *data) { @@ -752,6 +775,8 @@ int pil_boot(struct pil_desc *desc) &desc->attrs); priv->region = NULL; } + if (desc->clear_fw_region && priv->region_start) + pil_clear_segment(desc); pil_release_mmap(desc); } return ret; diff --git a/drivers/soc/qcom/peripheral-loader.h b/drivers/soc/qcom/peripheral-loader.h index e8b7ac3092879..50c42511f96eb 100644 --- a/drivers/soc/qcom/peripheral-loader.h +++ b/drivers/soc/qcom/peripheral-loader.h @@ -1,4 +1,4 @@ -/* Copyright (c) 2010-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2010-2015,2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -36,6 +36,7 @@ struct pil_priv; * @unmap_fw_mem: Custom function used to undo mapping by map_fw_mem. * This defaults to iounmap if not specified. * @shutdown_fail: Set if PIL op for shutting down subsystem fails. + * @clear_fw_region: Clear fw region on failure in loading. */ struct pil_desc { const char *name; @@ -53,6 +54,7 @@ struct pil_desc { void (*unmap_fw_mem)(void *virt, size_t size, void *data); void *map_data; bool shutdown_fail; + bool clear_fw_region; }; /** diff --git a/drivers/soc/qcom/pil-q6v5.c b/drivers/soc/qcom/pil-q6v5.c index d832a5ca6360a..81966541b21c6 100644 --- a/drivers/soc/qcom/pil-q6v5.c +++ b/drivers/soc/qcom/pil-q6v5.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012-2014, The Linux Foundation. All rights reserved. + * Copyright (c) 2012-2014,2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -419,6 +419,7 @@ struct q6v5_data *pil_q6v5_init(struct platform_device *pdev) if (ret) return ERR_PTR(ret); + desc->clear_fw_region = false; desc->dev = &pdev->dev; drv->qdsp6v5_2_0 = of_device_is_compatible(pdev->dev.of_node, diff --git a/drivers/soc/qcom/qdsp6v2/voice_svc.c b/drivers/soc/qcom/qdsp6v2/voice_svc.c index 50dd9256b270f..fe54589744061 100644 --- a/drivers/soc/qcom/qdsp6v2/voice_svc.c +++ b/drivers/soc/qcom/qdsp6v2/voice_svc.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -42,6 +42,12 @@ struct voice_svc_prvt { struct list_head response_queue; wait_queue_head_t response_wait; spinlock_t response_lock; + /* + * This mutex ensures responses are processed in sequential order and + * that no two threads access and free the same response at the same + * time. + */ + struct mutex response_mutex_lock; }; struct apr_data { @@ -362,6 +368,9 @@ static ssize_t voice_svc_write(struct file *file, const char __user *buf, struct voice_svc_prvt *prtd; struct voice_svc_write_msg *data = NULL; uint32_t cmd; + struct voice_svc_register *register_data = NULL; + struct voice_svc_cmd_request *request_data = NULL; + uint32_t request_payload_size; pr_debug("%s\n", __func__); @@ -410,12 +419,19 @@ static ssize_t voice_svc_write(struct file *file, const char __user *buf, */ if (count == (sizeof(struct voice_svc_write_msg) + sizeof(struct voice_svc_register))) { - ret = process_reg_cmd( - (struct voice_svc_register *)data->payload, prtd); + register_data = + (struct voice_svc_register *)data->payload; + if (register_data == NULL) { + pr_err("%s: register data is NULL", __func__); + ret = -EINVAL; + goto done; + } + ret = process_reg_cmd(register_data, prtd); if (!ret) ret = count; } else { - pr_err("%s: invalid payload size\n", __func__); + pr_err("%s: invalid data payload size for register command\n", + __func__); ret = -EINVAL; goto done; } @@ -424,19 +440,40 @@ static ssize_t voice_svc_write(struct file *file, const char __user *buf, /* * Check that count reflects the expected size to ensure * sufficient memory was allocated. Since voice_svc_cmd_request - * has a variable size, check the minimum value count must be. + * has a variable size, check the minimum value count must be to + * parse the message request then check the minimum size to hold + * the payload of the message request. */ if (count >= (sizeof(struct voice_svc_write_msg) + sizeof(struct voice_svc_cmd_request))) { - ret = voice_svc_send_req( - (struct voice_svc_cmd_request *)data->payload, prtd); - if (!ret) - ret = count; - } else { - pr_err("%s: invalid payload size\n", __func__); - ret = -EINVAL; - goto done; - } + request_data = + (struct voice_svc_cmd_request *)data->payload; + if (request_data == NULL) { + pr_err("%s: request data is NULL", __func__); + ret = -EINVAL; + goto done; + } + + request_payload_size = request_data->payload_size; + + if (count >= (sizeof(struct voice_svc_write_msg) + + sizeof(struct voice_svc_cmd_request) + + request_payload_size)) { + ret = voice_svc_send_req(request_data, prtd); + if (!ret) + ret = count; + } else { + pr_err("%s: invalid request payload size\n", + __func__); + ret = -EINVAL; + goto done; + } + } else { + pr_err("%s: invalid data payload size for request command\n", + __func__); + ret = -EINVAL; + goto done; + } break; default: pr_debug("%s: Invalid command: %u\n", __func__, cmd); @@ -467,6 +504,7 @@ static ssize_t voice_svc_read(struct file *file, char __user *arg, goto done; } + mutex_lock(&prtd->response_mutex_lock); spin_lock_irqsave(&prtd->response_lock, spin_flags); if (list_empty(&prtd->response_queue)) { @@ -480,7 +518,7 @@ static ssize_t voice_svc_read(struct file *file, char __user *arg, pr_debug("%s: Read timeout\n", __func__); ret = -ETIMEDOUT; - goto done; + goto unlock; } else if (ret > 0 && !list_empty(&prtd->response_queue)) { pr_debug("%s: Interrupt recieved for response\n", __func__); @@ -488,7 +526,7 @@ static ssize_t voice_svc_read(struct file *file, char __user *arg, pr_debug("%s: Interrupted by SIGNAL %d\n", __func__, ret); - goto done; + goto unlock; } spin_lock_irqsave(&prtd->response_lock, spin_flags); @@ -507,7 +545,7 @@ static ssize_t voice_svc_read(struct file *file, char __user *arg, __func__, count, size); ret = -ENOMEM; - goto done; + goto unlock; } if (!access_ok(VERIFY_WRITE, arg, size)) { @@ -515,7 +553,7 @@ static ssize_t voice_svc_read(struct file *file, char __user *arg, __func__); ret = -EPERM; - goto done; + goto unlock; } ret = copy_to_user(arg, &resp->resp, @@ -525,7 +563,7 @@ static ssize_t voice_svc_read(struct file *file, char __user *arg, pr_err("%s: copy_to_user failed %d\n", __func__, ret); ret = -EPERM; - goto done; + goto unlock; } spin_lock_irqsave(&prtd->response_lock, spin_flags); @@ -539,6 +577,8 @@ static ssize_t voice_svc_read(struct file *file, char __user *arg, ret = count; +unlock: + mutex_unlock(&prtd->response_mutex_lock); done: return ret; } @@ -594,6 +634,7 @@ static int voice_svc_open(struct inode *inode, struct file *file) INIT_LIST_HEAD(&prtd->response_queue); init_waitqueue_head(&prtd->response_wait); spin_lock_init(&prtd->response_lock); + mutex_init(&prtd->response_mutex_lock); file->private_data = (void *)prtd; /* Current APR implementation doesn't support session based @@ -644,6 +685,7 @@ static int voice_svc_release(struct inode *inode, struct file *file) pr_err("%s: Failed to dereg MVM %d\n", __func__, ret); } + mutex_lock(&prtd->response_mutex_lock); spin_lock_irqsave(&prtd->response_lock, spin_flags); while (!list_empty(&prtd->response_queue)) { @@ -657,6 +699,9 @@ static int voice_svc_release(struct inode *inode, struct file *file) } spin_unlock_irqrestore(&prtd->response_lock, spin_flags); + mutex_unlock(&prtd->response_mutex_lock); + + mutex_destroy(&prtd->response_mutex_lock); kfree(file->private_data); file->private_data = NULL; diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c index 74468b8f25c8e..80858a34202f7 100644 --- a/drivers/soc/qcom/smem.c +++ b/drivers/soc/qcom/smem.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2014,2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -361,7 +361,7 @@ static void *__smem_get_entry_secure(unsigned id, uint32_t a_hdr_size; int rc; - SMEM_DBG("%s(%u, %u, %u, %u, %d, %d)\n", __func__, id, *size, to_proc, + SMEM_DBG("%s(%u, %u, %u, %d, %d)\n", __func__, id, to_proc, flags, skip_init_check, use_rspinlock); if (!skip_init_check && !smem_initialized_check()) @@ -776,7 +776,7 @@ EXPORT_SYMBOL(smem_alloc); void *smem_get_entry(unsigned id, unsigned *size, unsigned to_proc, unsigned flags) { - SMEM_DBG("%s(%u, %u, %u, %u)\n", __func__, id, *size, to_proc, flags); + SMEM_DBG("%s(%u, %u, %u)\n", __func__, id, to_proc, flags); /* * Handle the circular dependecy between SMEM and software implemented diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c index f0a21b8fe652b..87ab9013395f6 100644 --- a/drivers/soc/qcom/socinfo.c +++ b/drivers/soc/qcom/socinfo.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2009-2015, The Linux Foundation. All rights reserved. + * Copyright (c) 2009-2015,2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -44,6 +44,7 @@ #define SMEM_IMAGE_VERSION_OEM_OFFSET 96 #define SMEM_IMAGE_VERSION_PARTITION_APPS 10 +static DECLARE_RWSEM(current_image_rwsem); enum { HW_PLATFORM_UNKNOWN = 0, HW_PLATFORM_SURF = 1, @@ -788,7 +789,9 @@ msm_get_image_version(struct device *dev, __func__); return snprintf(buf, SMEM_IMAGE_VERSION_NAME_SIZE, "Unknown"); } + down_read(¤t_image_rwsem); string_address += current_image * SMEM_IMAGE_VERSION_SINGLE_BLOCK_SIZE; + up_read(¤t_image_rwsem); return snprintf(buf, SMEM_IMAGE_VERSION_NAME_SIZE, "%-.75s\n", string_address); } @@ -801,15 +804,20 @@ msm_set_image_version(struct device *dev, { char *store_address; - if (current_image != SMEM_IMAGE_VERSION_PARTITION_APPS) + down_read(¤t_image_rwsem); + if (current_image != SMEM_IMAGE_VERSION_PARTITION_APPS) { + up_read(¤t_image_rwsem); return count; + } store_address = socinfo_get_image_version_base_address(); if (IS_ERR_OR_NULL(store_address)) { pr_err("%s : Failed to get image version base address", __func__); + up_read(¤t_image_rwsem); return count; } store_address += current_image * SMEM_IMAGE_VERSION_SINGLE_BLOCK_SIZE; + up_read(¤t_image_rwsem); snprintf(store_address, SMEM_IMAGE_VERSION_NAME_SIZE, "%-.75s", buf); return count; } @@ -828,7 +836,9 @@ msm_get_image_variant(struct device *dev, return snprintf(buf, SMEM_IMAGE_VERSION_VARIANT_SIZE, "Unknown"); } + down_read(¤t_image_rwsem); string_address += current_image * SMEM_IMAGE_VERSION_SINGLE_BLOCK_SIZE; + up_read(¤t_image_rwsem); string_address += SMEM_IMAGE_VERSION_VARIANT_OFFSET; return snprintf(buf, SMEM_IMAGE_VERSION_VARIANT_SIZE, "%-.20s\n", string_address); @@ -842,15 +852,20 @@ msm_set_image_variant(struct device *dev, { char *store_address; - if (current_image != SMEM_IMAGE_VERSION_PARTITION_APPS) + down_read(¤t_image_rwsem); + if (current_image != SMEM_IMAGE_VERSION_PARTITION_APPS) { + up_read(¤t_image_rwsem); return count; + } store_address = socinfo_get_image_version_base_address(); if (IS_ERR_OR_NULL(store_address)) { pr_err("%s : Failed to get image version base address", __func__); + up_read(¤t_image_rwsem); return count; } store_address += current_image * SMEM_IMAGE_VERSION_SINGLE_BLOCK_SIZE; + up_read(¤t_image_rwsem); store_address += SMEM_IMAGE_VERSION_VARIANT_OFFSET; snprintf(store_address, SMEM_IMAGE_VERSION_VARIANT_SIZE, "%-.20s", buf); return count; @@ -869,7 +884,9 @@ msm_get_image_crm_version(struct device *dev, __func__); return snprintf(buf, SMEM_IMAGE_VERSION_OEM_SIZE, "Unknown"); } + down_read(¤t_image_rwsem); string_address += current_image * SMEM_IMAGE_VERSION_SINGLE_BLOCK_SIZE; + up_read(¤t_image_rwsem); string_address += SMEM_IMAGE_VERSION_OEM_OFFSET; return snprintf(buf, SMEM_IMAGE_VERSION_OEM_SIZE, "%-.32s\n", string_address); @@ -883,15 +900,20 @@ msm_set_image_crm_version(struct device *dev, { char *store_address; - if (current_image != SMEM_IMAGE_VERSION_PARTITION_APPS) + down_read(¤t_image_rwsem); + if (current_image != SMEM_IMAGE_VERSION_PARTITION_APPS) { + up_read(¤t_image_rwsem); return count; + } store_address = socinfo_get_image_version_base_address(); if (IS_ERR_OR_NULL(store_address)) { pr_err("%s : Failed to get image version base address", __func__); + up_read(¤t_image_rwsem); return count; } store_address += current_image * SMEM_IMAGE_VERSION_SINGLE_BLOCK_SIZE; + up_read(¤t_image_rwsem); store_address += SMEM_IMAGE_VERSION_OEM_OFFSET; snprintf(store_address, SMEM_IMAGE_VERSION_OEM_SIZE, "%-.32s", buf); return count; @@ -902,8 +924,14 @@ msm_get_image_number(struct device *dev, struct device_attribute *attr, char *buf) { - return snprintf(buf, PAGE_SIZE, "%d\n", + int ret; + + down_read(¤t_image_rwsem); + ret = snprintf(buf, PAGE_SIZE, "%d\n", current_image); + up_read(¤t_image_rwsem); + return ret; + } static ssize_t @@ -915,10 +943,12 @@ msm_select_image(struct device *dev, struct device_attribute *attr, ret = kstrtoint(buf, 10, &digit); if (ret) return ret; + down_write(¤t_image_rwsem); if (0 <= digit && digit < SMEM_IMAGE_VERSION_BLOCKS_COUNT) current_image = digit; else current_image = 0; + up_write(¤t_image_rwsem); return count; } diff --git a/drivers/soc/qcom/subsys-pil-tz.c b/drivers/soc/qcom/subsys-pil-tz.c index f37db457dd430..001cc25bd4e3a 100644 --- a/drivers/soc/qcom/subsys-pil-tz.c +++ b/drivers/soc/qcom/subsys-pil-tz.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014-2015,2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -912,6 +912,7 @@ static int pil_tz_driver_probe(struct platform_device *pdev) d->desc.ops = &pil_ops_trusted; d->desc.proxy_timeout = PROXY_TIMEOUT_MS; + d->desc.clear_fw_region = true; rc = of_property_read_u32(pdev->dev.of_node, "qcom,proxy-timeout-ms", &proxy_timeout); diff --git a/drivers/soc/qcom/subsystem_restart.c b/drivers/soc/qcom/subsystem_restart.c index 0337a2cd7cdef..317335287c06e 100644 --- a/drivers/soc/qcom/subsystem_restart.c +++ b/drivers/soc/qcom/subsystem_restart.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1070,8 +1070,9 @@ int subsystem_restart_dev(struct subsys_device *dev) pr_info("Restart sequence requested for %s, restart_level = %s.\n", name, restart_levels[dev->restart_level]); - if (WARN(disable_restart_work == DISABLE_SSR, - "subsys-restart: Ignoring restart request for %s.\n", name)) { + if (disable_restart_work == DISABLE_SSR) { + pr_warn("subsys-restart: Ignoring restart request for %s.\n", + name); return 0; } diff --git a/drivers/spmi/Kconfig b/drivers/spmi/Kconfig index c32978e8cc647..15499c7d0d161 100644 --- a/drivers/spmi/Kconfig +++ b/drivers/spmi/Kconfig @@ -27,4 +27,11 @@ config MSM_QPNP_INT help Say 'y' here to include support for the Qualcomm QPNP interrupt support. QPNP is a SPMI based PMIC implementation. + +config MSM_SPMI_DEBUGFS_RO + depends on DEBUG_FS + depends on SPMI + bool "Disable SPMI debugfs write" + help + Say 'y' here to disable the SPMI debugfs register write operation. endif diff --git a/drivers/spmi/spmi-dbgfs.c b/drivers/spmi/spmi-dbgfs.c index b0a354b59a502..363a0697164d5 100644 --- a/drivers/spmi/spmi-dbgfs.c +++ b/drivers/spmi/spmi-dbgfs.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2014, 2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -46,6 +46,12 @@ static const char *DFS_ROOT_NAME = "spmi"; static const mode_t DFS_MODE = S_IRUSR | S_IWUSR; +#ifndef CONFIG_MSM_SPMI_DEBUGFS_RO +static const mode_t DFS_DATA_MODE = S_IRUSR | S_IWUSR; +#else +static const mode_t DFS_DATA_MODE = S_IRUSR; +#endif + /* Log buffer */ struct spmi_log_buffer { size_t rpos; /* Current 'read' position in buffer */ @@ -69,6 +75,7 @@ struct spmi_trans { u32 addr; /* 20-bit address: SID + PID + Register offset */ u32 offset; /* Offset of last read data */ bool raw_data; /* Set to true for raw data dump */ + struct mutex spmi_dfs_lock; /* Prevent thread concurrency */ struct spmi_controller *ctrl; struct spmi_log_buffer *log; /* log buffer */ }; @@ -168,6 +175,7 @@ static int spmi_dfs_open(struct spmi_ctrl_data *ctrl_data, struct file *file) trans->addr = ctrl_data->addr; trans->ctrl = ctrl_data->ctrl; trans->offset = trans->addr; + mutex_init(&trans->spmi_dfs_lock); file->private_data = trans; return 0; @@ -197,6 +205,7 @@ static int spmi_dfs_close(struct inode *inode, struct file *file) if (trans && trans->log) { file->private_data = NULL; + mutex_destroy(&trans->spmi_dfs_lock); kfree(trans->log); kfree(trans); } @@ -241,6 +250,7 @@ spmi_read_data(struct spmi_controller *ctrl, uint8_t *buf, int offset, int cnt) return ret; } +#ifndef CONFIG_MSM_SPMI_DEBUGFS_RO /** * spmi_write_data: writes data across the SPMI bus * @ctrl: The SPMI controller @@ -277,6 +287,7 @@ spmi_write_data(struct spmi_controller *ctrl, uint8_t *buf, int offset, int cnt) done: return ret; } +#endif /** * print_to_log: format a string and place into the log buffer @@ -456,6 +467,7 @@ static int get_log_data(struct spmi_trans *trans) return total_items_read; } +#ifndef CONFIG_MSM_SPMI_DEBUGFS_RO /** * spmi_dfs_reg_write: write user's byte array (coded as string) over SPMI. * @file: file pointer @@ -473,14 +485,20 @@ static ssize_t spmi_dfs_reg_write(struct file *file, const char __user *buf, int cnt = 0; u8 *values; size_t ret = 0; - + u32 offset; + char *kbuf; struct spmi_trans *trans = file->private_data; - u32 offset = trans->offset; + + mutex_lock(&trans->spmi_dfs_lock); + + offset = trans->offset; /* Make a copy of the user data */ - char *kbuf = kmalloc(count + 1, GFP_KERNEL); - if (!kbuf) - return -ENOMEM; + kbuf = kmalloc(count + 1, GFP_KERNEL); + if (!kbuf) { + ret = -ENOMEM; + goto unlock_mutex; + } ret = copy_from_user(kbuf, buf, count); if (ret == count) { @@ -517,8 +535,13 @@ static ssize_t spmi_dfs_reg_write(struct file *file, const char __user *buf, free_buf: kfree(kbuf); +unlock_mutex: + mutex_unlock(&trans->spmi_dfs_lock); return ret; } +#else +#define spmi_dfs_reg_write NULL +#endif /** * spmi_dfs_reg_read: reads value(s) over SPMI and fill user's buffer a @@ -537,10 +560,13 @@ static ssize_t spmi_dfs_reg_read(struct file *file, char __user *buf, size_t ret; size_t len; + mutex_lock(&trans->spmi_dfs_lock); /* Is the the log buffer empty */ if (log->rpos >= log->wpos) { - if (get_log_data(trans) <= 0) - return 0; + if (get_log_data(trans) <= 0) { + len = 0; + goto unlock_mutex; + } } len = min(count, log->wpos - log->rpos); @@ -548,7 +574,8 @@ static ssize_t spmi_dfs_reg_read(struct file *file, char __user *buf, ret = copy_to_user(buf, &log->data[log->rpos], len); if (ret == len) { pr_err("error copy SPMI register values to user\n"); - return -EFAULT; + len = -EFAULT; + goto unlock_mutex; } /* 'ret' is the number of bytes not copied */ @@ -556,6 +583,9 @@ static ssize_t spmi_dfs_reg_read(struct file *file, char __user *buf, *ppos += len; log->rpos += len; + +unlock_mutex: + mutex_unlock(&trans->spmi_dfs_lock); return len; } @@ -671,14 +701,14 @@ int spmi_dfs_add_controller(struct spmi_controller *ctrl) goto err_remove_fs; } - file = debugfs_create_file("data", DFS_MODE, dir, ctrl_data, + file = debugfs_create_file("data", DFS_DATA_MODE, dir, ctrl_data, &spmi_dfs_reg_fops); if (!file) { pr_err("error creating 'data' entry\n"); goto err_remove_fs; } - file = debugfs_create_file("data_raw", DFS_MODE, dir, ctrl_data, + file = debugfs_create_file("data_raw", DFS_DATA_MODE, dir, ctrl_data, &spmi_dfs_raw_data_fops); if (!file) { pr_err("error creating 'data' entry\n"); diff --git a/drivers/staging/android/fiq_debugger/fiq_debugger.c b/drivers/staging/android/fiq_debugger/fiq_debugger.c index 1d733624d70a2..ceb45bc9e2a8a 100644 --- a/drivers/staging/android/fiq_debugger/fiq_debugger.c +++ b/drivers/staging/android/fiq_debugger/fiq_debugger.c @@ -30,6 +30,7 @@ #include #include #include +#include #include #include #include @@ -395,7 +396,7 @@ static void fiq_debugger_work(struct work_struct *work) cmd += 6; while (*cmd == ' ') cmd++; - if (cmd != '\0') + if ((cmd != '\0') && sysrq_on()) kernel_restart(cmd); else kernel_restart(NULL); @@ -425,30 +426,39 @@ static void fiq_debugger_irq_exec(struct fiq_debugger_state *state, char *cmd) static void fiq_debugger_help(struct fiq_debugger_state *state) { fiq_debugger_printf(&state->output, - "FIQ Debugger commands:\n" - " pc PC status\n" - " regs Register dump\n" - " allregs Extended Register dump\n" - " bt Stack trace\n"); - fiq_debugger_printf(&state->output, - " reboot [] Reboot with command \n" - " reset [] Hard reset with command \n" - " irqs Interupt status\n" - " kmsg Kernel log\n" - " version Kernel version\n"); - fiq_debugger_printf(&state->output, - " sleep Allow sleep while in FIQ\n" - " nosleep Disable sleep while in FIQ\n" - " console Switch terminal to console\n" - " cpu Current CPU\n" - " cpu Switch to CPU\n"); + "FIQ Debugger commands:\n"); + if (sysrq_on()) { + fiq_debugger_printf(&state->output, + " pc PC status\n" + " regs Register dump\n" + " allregs Extended Register dump\n" + " bt Stack trace\n"); + fiq_debugger_printf(&state->output, + " reboot [] Reboot with command \n" + " reset [] Hard reset with command \n" + " irqs Interrupt status\n" + " kmsg Kernel log\n" + " version Kernel version\n"); + fiq_debugger_printf(&state->output, + " cpu Current CPU\n" + " cpu Switch to CPU\n" + " sysrq sysrq options\n" + " sysrq Execute sysrq with \n"); + } else { + fiq_debugger_printf(&state->output, + " reboot Reboot\n" + " reset Hard reset\n" + " irqs Interrupt status\n"); + } fiq_debugger_printf(&state->output, - " ps Process list\n" - " sysrq sysrq options\n" - " sysrq Execute sysrq with \n"); + " sleep Allow sleep while in FIQ\n" + " nosleep Disable sleep while in FIQ\n" + " console Switch terminal to console\n" + " ps Process list\n"); #ifdef CONFIG_KGDB - fiq_debugger_printf(&state->output, - " kgdb Enter kernel debugger\n"); + if (fiq_kgdb_enable) { + fiq_debugger_printf(&state->output, + " kgdb Enter kernel debugger\n"); #endif } @@ -480,18 +490,23 @@ static bool fiq_debugger_fiq_exec(struct fiq_debugger_state *state, if (!strcmp(cmd, "help") || !strcmp(cmd, "?")) { fiq_debugger_help(state); } else if (!strcmp(cmd, "pc")) { - fiq_debugger_dump_pc(&state->output, regs); + if (sysrq_on()) + fiq_debugger_dump_pc(&state->output, regs); } else if (!strcmp(cmd, "regs")) { - fiq_debugger_dump_regs(&state->output, regs); + if (sysrq_on()) + fiq_debugger_dump_regs(&state->output, regs); } else if (!strcmp(cmd, "allregs")) { - fiq_debugger_dump_allregs(&state->output, regs); + if (sysrq_on()) + fiq_debugger_dump_allregs(&state->output, regs); } else if (!strcmp(cmd, "bt")) { - fiq_debugger_dump_stacktrace(&state->output, regs, 100, svc_sp); + if (sysrq_on()) + fiq_debugger_dump_stacktrace(&state->output, regs, + 100, svc_sp); } else if (!strncmp(cmd, "reset", 5)) { cmd += 5; while (*cmd == ' ') cmd++; - if (*cmd) { + if (*cmd && sysrq_on()) { char tmp_cmd[32]; strlcpy(tmp_cmd, cmd, sizeof(tmp_cmd)); machine_restart(tmp_cmd); @@ -501,9 +516,12 @@ static bool fiq_debugger_fiq_exec(struct fiq_debugger_state *state, } else if (!strcmp(cmd, "irqs")) { fiq_debugger_dump_irqs(state); } else if (!strcmp(cmd, "kmsg")) { - fiq_debugger_dump_kernel_log(state); + if (sysrq_on()) + fiq_debugger_dump_kernel_log(state); } else if (!strcmp(cmd, "version")) { - fiq_debugger_printf(&state->output, "%s\n", linux_banner); + if (sysrq_on()) + fiq_debugger_printf(&state->output, "%s\n", + linux_banner); } else if (!strcmp(cmd, "sleep")) { state->no_sleep = false; fiq_debugger_printf(&state->output, "enabling sleep\n"); @@ -515,14 +533,17 @@ static bool fiq_debugger_fiq_exec(struct fiq_debugger_state *state, fiq_debugger_uart_flush(state); state->console_enable = true; } else if (!strcmp(cmd, "cpu")) { - fiq_debugger_printf(&state->output, "cpu %d\n", state->current_cpu); - } else if (!strncmp(cmd, "cpu ", 4)) { + if (sysrq_on()) + fiq_debugger_printf(&state->output, "cpu %d\n", + state->current_cpu); + } else if (!strncmp(cmd, "cpu ", 4) && sysrq_on()) { unsigned long cpu = 0; if (strict_strtoul(cmd + 4, 10, &cpu) == 0) fiq_debugger_switch_cpu(state, cpu); else fiq_debugger_printf(&state->output, "invalid cpu\n"); - fiq_debugger_printf(&state->output, "cpu %d\n", state->current_cpu); + fiq_debugger_printf(&state->output, "cpu %d\n", + state->current_cpu); } else { if (state->debug_busy) { fiq_debugger_printf(&state->output, diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c old mode 100644 new mode 100755 index 1e27e3dff41b9..bcf0deafe3334 --- a/drivers/staging/android/ion/ion.c +++ b/drivers/staging/android/ion/ion.c @@ -16,6 +16,8 @@ * */ +#include +#include #include #include #include @@ -402,13 +404,31 @@ static void ion_handle_get(struct ion_handle *handle) kref_get(&handle->ref); } +/* Must hold the client lock */ +static struct ion_handle* ion_handle_get_check_overflow(struct ion_handle *handle) +{ + if (atomic_read(&handle->ref.refcount) + 1 == 0) + return ERR_PTR(-EOVERFLOW); + ion_handle_get(handle); + return handle; +} + +static int ion_handle_put_nolock(struct ion_handle *handle) +{ + int ret; + + ret = kref_put(&handle->ref, ion_handle_destroy); + + return ret; +} + int ion_handle_put(struct ion_handle *handle) { struct ion_client *client = handle->client; int ret; mutex_lock(&client->lock); - ret = kref_put(&handle->ref, ion_handle_destroy); + ret = ion_handle_put_nolock(handle); mutex_unlock(&client->lock); return ret; @@ -432,18 +452,28 @@ static struct ion_handle *ion_handle_lookup(struct ion_client *client, return ERR_PTR(-EINVAL); } -struct ion_handle *ion_handle_get_by_id(struct ion_client *client, +static struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client, int id) { struct ion_handle *handle; - mutex_lock(&client->lock); handle = idr_find(&client->idr, id); if (handle) - ion_handle_get(handle); + return ion_handle_get_check_overflow(handle); + + return ERR_PTR(-EINVAL); +} + +struct ion_handle *ion_handle_get_by_id(struct ion_client *client, + int id) +{ + struct ion_handle *handle; + + mutex_lock(&client->lock); + handle = ion_handle_get_by_id_nolock(client, id); mutex_unlock(&client->lock); - return handle ? handle : ERR_PTR(-EINVAL); + return handle; } static bool ion_handle_validate(struct ion_client *client, @@ -484,9 +514,9 @@ static int ion_handle_add(struct ion_client *client, struct ion_handle *handle) return 0; } -struct ion_handle *ion_alloc(struct ion_client *client, size_t len, +static struct ion_handle *__ion_alloc(struct ion_client *client, size_t len, size_t align, unsigned int heap_id_mask, - unsigned int flags) + unsigned int flags, bool grab_handle) { struct ion_handle *handle; struct ion_device *dev = client->dev; @@ -586,6 +616,8 @@ struct ion_handle *ion_alloc(struct ion_client *client, size_t len, return handle; mutex_lock(&client->lock); + if (grab_handle) + ion_handle_get(handle); ret = ion_handle_add(client, handle); mutex_unlock(&client->lock); if (ret) { @@ -595,23 +627,36 @@ struct ion_handle *ion_alloc(struct ion_client *client, size_t len, return handle; } + +struct ion_handle *ion_alloc(struct ion_client *client, size_t len, + size_t align, unsigned int heap_id_mask, + unsigned int flags) +{ + return __ion_alloc(client, len, align, heap_id_mask, flags, false); +} EXPORT_SYMBOL(ion_alloc); -void ion_free(struct ion_client *client, struct ion_handle *handle) +static void ion_free_nolock(struct ion_client *client, struct ion_handle *handle) { bool valid_handle; BUG_ON(client != handle->client); - mutex_lock(&client->lock); valid_handle = ion_handle_validate(client, handle); if (!valid_handle) { WARN(1, "%s: invalid handle passed to free.\n", __func__); - mutex_unlock(&client->lock); return; } + ion_handle_put_nolock(handle); +} + +void ion_free(struct ion_client *client, struct ion_handle *handle) +{ + BUG_ON(client != handle->client); + + mutex_lock(&client->lock); + ion_free_nolock(client, handle); mutex_unlock(&client->lock); - ion_handle_put(handle); } EXPORT_SYMBOL(ion_free); @@ -778,7 +823,7 @@ static int ion_debug_client_show(struct seq_file *s, void *unused) struct ion_handle *handle = rb_entry(n, struct ion_handle, node); - seq_printf(s, "%16.16s: %16zx : %16d : %12p", + seq_printf(s, "%16.16s: %16zx : %16d : %12pK", handle->buffer->heap->name, handle->buffer->size, atomic_read(&handle->ref.refcount), @@ -1335,7 +1380,7 @@ struct ion_handle *ion_import_dma_buf(struct ion_client *client, int fd) /* if a handle exists for this buffer just take a reference to it */ handle = ion_handle_lookup(client, buffer); if (!IS_ERR(handle)) { - ion_handle_get(handle); + handle = ion_handle_get_check_overflow(handle); mutex_unlock(&client->lock); goto end; } @@ -1425,10 +1470,10 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) { struct ion_handle *handle; - handle = ion_alloc(client, data.allocation.len, + handle = __ion_alloc(client, data.allocation.len, data.allocation.align, data.allocation.heap_id_mask, - data.allocation.flags); + data.allocation.flags, true); if (IS_ERR(handle)) return PTR_ERR(handle); @@ -1441,11 +1486,15 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) { struct ion_handle *handle; - handle = ion_handle_get_by_id(client, data.handle.handle); - if (IS_ERR(handle)) + mutex_lock(&client->lock); + handle = ion_handle_get_by_id_nolock(client, data.handle.handle); + if (IS_ERR(handle)) { + mutex_unlock(&client->lock); return PTR_ERR(handle); - ion_free(client, handle); - ion_handle_put(handle); + } + ion_free_nolock(client, handle); + ion_handle_put_nolock(handle); + mutex_unlock(&client->lock); break; } case ION_IOC_SHARE: @@ -1501,11 +1550,15 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) if (dir & _IOC_READ) { if (copy_to_user((void __user *)arg, &data, _IOC_SIZE(cmd))) { - if (cleanup_handle) + if (cleanup_handle) { ion_free(client, cleanup_handle); + ion_handle_put(cleanup_handle); + } return -EFAULT; } } + if (cleanup_handle) + ion_handle_put(cleanup_handle); return ret; } diff --git a/drivers/thermal/msm_thermal-dev.c b/drivers/thermal/msm_thermal-dev.c index 0c50df36e19a9..eb0490a9cad81 100644 --- a/drivers/thermal/msm_thermal-dev.c +++ b/drivers/thermal/msm_thermal-dev.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -35,6 +35,7 @@ static unsigned int freq_table_len[NR_CPUS], freq_table_set[NR_CPUS]; static unsigned int voltage_table_set[NR_CPUS]; static unsigned int *freq_table_ptr[NR_CPUS]; static uint32_t *voltage_table_ptr[NR_CPUS]; +static DEFINE_MUTEX(ioctl_access_mutex); static int msm_thermal_ioctl_open(struct inode *node, struct file *filep) { @@ -290,8 +291,9 @@ static long msm_thermal_ioctl_process(struct file *filep, unsigned int cmd, ret = validate_and_copy(&cmd, &arg, &query); if (ret) - goto process_exit; + return ret; + mutex_lock(&ioctl_access_mutex); switch (cmd) { case MSM_THERMAL_SET_CPU_MAX_FREQUENCY: ret = msm_thermal_set_frequency(query.cpu_freq.cpu_num, @@ -320,6 +322,7 @@ static long msm_thermal_ioctl_process(struct file *filep, unsigned int cmd, goto process_exit; } process_exit: + mutex_unlock(&ioctl_access_mutex); return ret; } diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c index b51c15408ff31..08c9406ca6f86 100644 --- a/drivers/tty/sysrq.c +++ b/drivers/tty/sysrq.c @@ -55,10 +55,11 @@ static bool __read_mostly sysrq_always_enabled; unsigned short platform_sysrq_reset_seq[] __weak = { KEY_RESERVED }; int sysrq_reset_downtime_ms __weak; -static bool sysrq_on(void) +bool sysrq_on(void) { return sysrq_enabled || sysrq_always_enabled; } +EXPORT_SYMBOL(sysrq_on); /* * A value of 1 means 'all', other nonzero values are an op mask: diff --git a/drivers/uio/msm_sharedmem/sharedmem_qmi.c b/drivers/uio/msm_sharedmem/sharedmem_qmi.c index 3b04c582cb3bb..cc8f7cd83421f 100644 --- a/drivers/uio/msm_sharedmem/sharedmem_qmi.c +++ b/drivers/uio/msm_sharedmem/sharedmem_qmi.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014, 2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -221,6 +221,7 @@ static int sharedmem_qmi_req_cb(struct qmi_handle *handle, void *conn_h, #define DEBUG_BUF_SIZE (2048) static char *debug_buffer; static u32 debug_data_size; +static struct mutex dbg_buf_lock; /* mutex for debug_buffer */ static ssize_t debug_read(struct file *file, char __user *buf, size_t count, loff_t *file_pos) @@ -276,21 +277,30 @@ static u32 fill_debug_info(char *buffer, u32 buffer_size) static int debug_open(struct inode *inode, struct file *file) { u32 buffer_size; - if (debug_buffer != NULL) + + mutex_lock(&dbg_buf_lock); + if (debug_buffer != NULL) { + mutex_unlock(&dbg_buf_lock); return -EBUSY; + } buffer_size = DEBUG_BUF_SIZE; debug_buffer = kzalloc(buffer_size, GFP_KERNEL); - if (debug_buffer == NULL) + if (debug_buffer == NULL) { + mutex_unlock(&dbg_buf_lock); return -ENOMEM; + } debug_data_size = fill_debug_info(debug_buffer, buffer_size); + mutex_unlock(&dbg_buf_lock); return 0; } static int debug_close(struct inode *inode, struct file *file) { + mutex_lock(&dbg_buf_lock); kfree(debug_buffer); debug_buffer = NULL; debug_data_size = 0; + mutex_unlock(&dbg_buf_lock); return 0; } @@ -321,6 +331,7 @@ static void debugfs_init(void) { struct dentry *f_ent; + mutex_init(&dbg_buf_lock); dir_ent = debugfs_create_dir("rmt_storage", NULL); if (IS_ERR(dir_ent)) { pr_err("Failed to create debug_fs directory\n"); @@ -349,6 +360,7 @@ static void debugfs_init(void) static void debugfs_exit(void) { debugfs_remove_recursive(dir_ent); + mutex_destroy(&dbg_buf_lock); } static void sharedmem_qmi_svc_recv_msg(struct work_struct *work) diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index 4ccdd01fd0b74..dc8f384b68506 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -373,11 +373,11 @@ static void snoop_urb(struct usb_device *udev, if (userurb) { /* Async */ if (when == SUBMIT) - dev_info(&udev->dev, "userurb %p, ep%d %s-%s, " + dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, " "length %u\n", userurb, ep, t, d, length); else - dev_info(&udev->dev, "userurb %p, ep%d %s-%s, " + dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, " "actual_length %u status %d\n", userurb, ep, t, d, length, timeout_or_status); diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c index d350a4e3e8210..704fe9aa02c8c 100644 --- a/drivers/usb/core/hcd.c +++ b/drivers/usb/core/hcd.c @@ -1626,7 +1626,7 @@ int usb_hcd_unlink_urb (struct urb *urb, int status) if (retval == 0) retval = -EINPROGRESS; else if (retval != -EIDRM && retval != -EBUSY) - dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n", + dev_dbg(&udev->dev, "hcd_unlink_urb %pK fail %d\n", urb, retval); usb_put_dev(udev); } @@ -1710,7 +1710,7 @@ void usb_hcd_flush_endpoint(struct usb_device *udev, /* kick hcd */ unlink1(hcd, urb, -ESHUTDOWN); dev_dbg (hcd->self.controller, - "shutdown urb %p ep%d%s%s\n", + "shutdown urb %pK ep%d%s%s\n", urb, usb_endpoint_num(&ep->desc), is_in ? "in" : "out", ({ char *s; diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c index 16927fa88fbd6..6c7a59560fa3f 100644 --- a/drivers/usb/core/urb.c +++ b/drivers/usb/core/urb.c @@ -324,7 +324,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags) if (!urb || !urb->complete) return -EINVAL; if (urb->hcpriv) { - WARN_ONCE(1, "URB %p submitted while active\n", urb); + WARN_ONCE(1, "URB %pK submitted while active\n", urb); return -EBUSY; } diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c index d456751b9932b..ec7cfdce337f2 100644 --- a/drivers/usb/dwc3/core.c +++ b/drivers/usb/dwc3/core.c @@ -326,7 +326,7 @@ int dwc3_event_buffers_setup(struct dwc3 *dwc) for (n = 0; n < dwc->num_event_buffers; n++) { evt = dwc->ev_buffs[n]; - dev_dbg(dwc->dev, "Event buf %p dma %08llx length %d\n", + dev_dbg(dwc->dev, "Event buf %pK dma %08llx length %d\n", evt->buf, (unsigned long long) evt->dma, evt->length); diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c index fc3f959bde80f..e95c0cfbfcde9 100644 --- a/drivers/usb/dwc3/debugfs.c +++ b/drivers/usb/dwc3/debugfs.c @@ -692,7 +692,7 @@ static int dwc3_ep_req_list_show(struct seq_file *s, void *unused) req = list_entry(ptr, struct dwc3_request, list); seq_printf(s, - "req:0x%p len: %d sts: %d dma:0x%pa num_sgs: %d\n", + "req:0x%pK len: %d sts: %d dma:0x%pKa num_sgs: %d\n", req, req->request.length, req->request.status, &req->request.dma, req->request.num_sgs); } @@ -731,7 +731,7 @@ static int dwc3_ep_queued_req_show(struct seq_file *s, void *unused) req = list_entry(ptr, struct dwc3_request, list); seq_printf(s, - "req:0x%p len:%d sts:%d dma:%pa nsg:%d trb:0x%p\n", + "req:0x%pK len:%d sts:%d dma:%pKa nsg:%d trb:0x%pK\n", req, req->request.length, req->request.status, &req->request.dma, req->request.num_sgs, req->trb); } @@ -771,7 +771,7 @@ static int dwc3_ep_trbs_show(struct seq_file *s, void *unused) dep->name, dep->flags, dep->free_slot, dep->busy_slot); for (j = 0; j < DWC3_TRB_NUM; j++) { trb = &dep->trb_pool[j]; - seq_printf(s, "trb:0x%p bph:0x%x bpl:0x%x size:0x%x ctrl: %x\n", + seq_printf(s, "trb:0x%pK bph:0x%x bpl:0x%x size:0x%x ctrl: %x\n", trb, trb->bph, trb->bpl, trb->size, trb->ctrl); } spin_unlock_irqrestore(&dwc->lock, flags); @@ -998,22 +998,30 @@ void dbg_print_reg(const char *name, int reg) static ssize_t dwc3_store_events(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { - unsigned tty; + int ret; + u8 tty; if (buf == NULL) { pr_err("[%s] EINVAL\n", __func__); - goto done; + ret = -EINVAL; + return ret; } - if (sscanf(buf, "%u", &tty) != 1 || tty > 1) { + ret = kstrtou8_from_user(buf, count, 0, &tty); + if (ret < 0) { + pr_err("can't get enter value.\n"); + return ret; + } + + if (tty > 1) { pr_err("<1|0>: enable|disable console log\n"); - goto done; + ret = -EINVAL; + return ret; } dbg_dwc3_data.tty = tty; pr_info("tty = %u", dbg_dwc3_data.tty); - done: return count; } @@ -1054,21 +1062,30 @@ const struct file_operations dwc3_gadget_dbg_data_fops = { static ssize_t dwc3_store_int_events(struct file *file, const char __user *ubuf, size_t count, loff_t *ppos) { - int clear_stats, i; + int i, ret; unsigned long flags; struct seq_file *s = file->private_data; struct dwc3 *dwc = s->private; struct dwc3_ep *dep; struct timespec ts; + u8 clear_stats; if (ubuf == NULL) { pr_err("[%s] EINVAL\n", __func__); - goto done; + ret = -EINVAL; + return ret; + } + + ret = kstrtou8_from_user(ubuf, count, 0, &clear_stats); + if (ret < 0) { + pr_err("can't get enter value.\n"); + return ret; } - if (sscanf(ubuf, "%u", &clear_stats) != 1 || clear_stats != 0) { + if (clear_stats != 0) { pr_err("Wrong value. To clear stats, enter value as 0.\n"); - goto done; + ret = -EINVAL; + return ret; } spin_lock_irqsave(&dwc->lock, flags); @@ -1085,7 +1102,6 @@ static ssize_t dwc3_store_int_events(struct file *file, spin_unlock_irqrestore(&dwc->lock, flags); -done: return count; } diff --git a/drivers/usb/dwc3/dwc3-msm.c b/drivers/usb/dwc3/dwc3-msm.c index 3df58e9b98179..7628ac6144578 100755 --- a/drivers/usb/dwc3/dwc3-msm.c +++ b/drivers/usb/dwc3/dwc3-msm.c @@ -701,14 +701,14 @@ static int dwc3_msm_ep_queue(struct usb_ep *ep, if (!dep->endpoint.desc) { dev_err(mdwc->dev, - "%s: trying to queue request %p to disabled ep %s\n", + "%s: trying to queue request %pK to disabled ep %s\n", __func__, request, ep->name); return -EPERM; } if (dep->number == 0 || dep->number == 1) { dev_err(mdwc->dev, - "%s: trying to queue dbm request %p to control ep %s\n", + "%s: trying to queue dbm request %pK to control ep %s\n", __func__, request, ep->name); return -EPERM; } @@ -717,7 +717,7 @@ static int dwc3_msm_ep_queue(struct usb_ep *ep, if (dep->busy_slot != dep->free_slot || !list_empty(&dep->request_list) || !list_empty(&dep->req_queued)) { dev_err(mdwc->dev, - "%s: trying to queue dbm request %p tp ep %s\n", + "%s: trying to queue dbm request %pK tp ep %s\n", __func__, request, ep->name); return -EPERM; } else { @@ -762,7 +762,7 @@ static int dwc3_msm_ep_queue(struct usb_ep *ep, return ret; } - dev_vdbg(dwc->dev, "%s: queing request %p to ep %s length %d\n", + dev_vdbg(dwc->dev, "%s: queing request %pK to ep %s length %d\n", __func__, request, ep->name, request->length); dbm_event_buffer_config(mdwc->dbm, @@ -979,7 +979,7 @@ EXPORT_SYMBOL(msm_dwc3_restart_usb_session); */ int msm_register_usb_ext_notification(struct usb_ext_notification *info) { - pr_debug("%s usb_ext: %p\n", __func__, info); + pr_debug("%s usb_ext: %pK\n", __func__, info); if (info) { if (usb_ext) { diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c index fed1aa12c394d..b8d4b6256e36a 100644 --- a/drivers/usb/dwc3/ep0.c +++ b/drivers/usb/dwc3/ep0.c @@ -243,7 +243,7 @@ int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request, spin_lock_irqsave(&dwc->lock, flags); if (!dep->endpoint.desc) { - dev_dbg(dwc->dev, "trying to queue request %p to disabled %s\n", + dev_dbg(dwc->dev, "trying to queue request %pK to disabled %s\n", request, dep->name); ret = -ESHUTDOWN; goto out; @@ -255,7 +255,7 @@ int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request, goto out; } - dev_vdbg(dwc->dev, "queueing request %p to %s length %d, state '%s'\n", + dev_vdbg(dwc->dev, "queueing request %pK to %s length %d, state '%s'\n", request, dep->name, request->length, dwc3_ep0_state_string(dwc->ep0state)); diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 134c7505f84a4..44bafcca47911 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -332,7 +332,7 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req, usb_gadget_unmap_request(&dwc->gadget, &req->request, req->direction); - dev_dbg(dwc->dev, "request %p from %s completed %d/%d ===> %d\n", + dev_dbg(dwc->dev, "request %pK from %s completed %d/%d ===> %d\n", req, dep->name, req->request.actual, req->request.length, status); @@ -753,7 +753,7 @@ static int dwc3_gadget_ep_enable(struct usb_ep *ep, int ret; if (!ep || !desc || desc->bDescriptorType != USB_DT_ENDPOINT) { - pr_debug("dwc3: invalid parameters. ep=%p, desc=%p, DT=%d\n", + pr_debug("dwc3: invalid parameters. ep=%pK, desc=%pK, DT=%d\n", ep, desc, desc ? desc->bDescriptorType : 0); return -EINVAL; } @@ -875,7 +875,7 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep, bool zlp_appended = false; unsigned rlen; - dev_vdbg(dwc->dev, "%s: req %p dma %08llx length %d%s%s\n", + dev_vdbg(dwc->dev, "%s: req %pK dma %08llx length %d%s%s\n", dep->name, req, (unsigned long long) dma, length, last ? " last" : "", chain ? " chain" : ""); @@ -1356,7 +1356,7 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req) if (req->request.status == -EINPROGRESS) { ret = -EBUSY; - dev_err(dwc->dev, "%s: %p request already in queue", + dev_err(dwc->dev, "%s: %pK request already in queue", dep->name, req); return ret; } @@ -1486,7 +1486,7 @@ static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request, if (!dep->endpoint.desc) { spin_unlock_irqrestore(&dwc->lock, flags); - dev_dbg(dwc->dev, "trying to queue request %p to disabled %s\n", + dev_dbg(dwc->dev, "trying to queue request %pK to disabled %s\n", request, ep->name); return -ESHUTDOWN; } @@ -1498,7 +1498,7 @@ static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request, return dwc->gadget.remote_wakeup ? -EAGAIN : -ENOTSUPP; } - dev_vdbg(dwc->dev, "queing request %p to %s length %d\n", + dev_vdbg(dwc->dev, "queing request %pK to %s length %d\n", request, ep->name, request->length); WARN(!dep->direction && (request->length % ep->desc->wMaxPacketSize), @@ -1545,7 +1545,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep, dwc3_stop_active_transfer(dwc, dep->number); goto out1; } - dev_err(dwc->dev, "request %p was not queued to %s\n", + dev_err(dwc->dev, "request %pK was not queued to %s\n", request, ep->name); ret = -EINVAL; goto out0; @@ -2492,7 +2492,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, * would help. Lets hope that if this occurs, someone * fixes the root cause instead of looking away :) */ - dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n", + dev_err(dwc->dev, "%s's TRB (%pK) still owned by HW\n", dep->name, trb); count = trb->size & DWC3_TRB_SIZE_MASK; diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c index 5e29ddeb4d33d..318db26f0296d 100644 --- a/drivers/usb/early/ehci-dbgp.c +++ b/drivers/usb/early/ehci-dbgp.c @@ -892,7 +892,7 @@ int __init early_dbgp_init(char *s) set_fixmap_nocache(FIX_DBGP_BASE, bar_val & PAGE_MASK); ehci_bar = (void __iomem *)__fix_to_virt(FIX_DBGP_BASE); ehci_bar += bar_val & ~PAGE_MASK; - dbgp_printk("ehci_bar: %p\n", ehci_bar); + dbgp_printk("ehci_bar: %pK\n", ehci_bar); ehci_caps = ehci_bar; ehci_regs = ehci_bar + EARLY_HC_LENGTH(readl(&ehci_caps->hc_capbase)); diff --git a/drivers/usb/gadget/android.c b/drivers/usb/gadget/android.c index c3015f1ca3598..35e598553c374 100644 --- a/drivers/usb/gadget/android.c +++ b/drivers/usb/gadget/android.c @@ -473,7 +473,7 @@ static void android_work(struct work_struct *data) } pr_info("%s: sent uevent %s\n", __func__, uevent_envp[0]); } else { - pr_info("%s: did not send uevent (%d %d %p)\n", __func__, + pr_info("%s: did not send uevent (%d %d %pK)\n", __func__, dev->connected, dev->sw_connected, cdev->config); } } @@ -3845,7 +3845,7 @@ static int usb_diag_update_pid_and_serial_num(u32 pid, const char *snum) return -ENODEV; } - pr_debug("%s: dload:%p pid:%x serial_num:%s\n", + pr_debug("%s: dload:%pK pid:%x serial_num:%s\n", __func__, diag_dload, pid, snum); /* update pid */ diff --git a/drivers/usb/gadget/ci13xxx_msm_hsic.c b/drivers/usb/gadget/ci13xxx_msm_hsic.c index 4148531f385c0..4353e84d8a039 100644 --- a/drivers/usb/gadget/ci13xxx_msm_hsic.c +++ b/drivers/usb/gadget/ci13xxx_msm_hsic.c @@ -814,7 +814,7 @@ static int msm_hsic_probe(struct platform_device *pdev) ret = -ENOMEM; goto error; } - dev_info(&pdev->dev, "HSIC Peripheral regs = %p\n", mhsic->regs); + dev_info(&pdev->dev, "HSIC Peripheral regs = %pK\n", mhsic->regs); ret = msm_hsic_config_gdsc(pdev, mhsic, true); if (ret) { diff --git a/drivers/usb/gadget/ci13xxx_udc.c b/drivers/usb/gadget/ci13xxx_udc.c index 0ace4b929feb9..93da4f23cd0aa 100644 --- a/drivers/usb/gadget/ci13xxx_udc.c +++ b/drivers/usb/gadget/ci13xxx_udc.c @@ -875,7 +875,7 @@ static ssize_t show_device(struct device *dev, struct device_attribute *attr, struct usb_gadget *gadget = &udc->gadget; int n = 0; - dbg_trace("[%s] %p\n", __func__, buf); + dbg_trace("[%s] %pK\n", __func__, buf); if (attr == NULL || buf == NULL) { dev_err(dev, "[%s] EINVAL\n", __func__); return 0; @@ -917,7 +917,7 @@ static ssize_t show_driver(struct device *dev, struct device_attribute *attr, struct usb_gadget_driver *driver = udc->driver; int n = 0; - dbg_trace("[%s] %p\n", __func__, buf); + dbg_trace("[%s] %pK\n", __func__, buf); if (attr == NULL || buf == NULL) { dev_err(dev, "[%s] EINVAL\n", __func__); return 0; @@ -1132,7 +1132,7 @@ static void dbg_usb_op_fail(u8 addr, const char *name, list_for_each(ptr, &mep->qh.queue) { req = list_entry(ptr, struct ci13xxx_req, queue); scnprintf(msg, sizeof(msg), - "%pa:%08X:%08X\n", + "%pKa:%08X:%08X\n", &req->dma, req->ptr->next, req->ptr->token); dbg_print(addr, "REQ", 0, msg); @@ -1155,7 +1155,7 @@ static ssize_t show_events(struct device *dev, struct device_attribute *attr, unsigned long flags; unsigned i, j, n = 0; - dbg_trace("[%s] %p\n", __func__, buf); + dbg_trace("[%s] %pK\n", __func__, buf); if (attr == NULL || buf == NULL) { dev_err(dev, "[%s] EINVAL\n", __func__); return 0; @@ -1190,7 +1190,7 @@ static ssize_t store_events(struct device *dev, struct device_attribute *attr, { unsigned tty; - dbg_trace("[%s] %p, %d\n", __func__, buf, count); + dbg_trace("[%s] %pK, %d\n", __func__, buf, count); if (attr == NULL || buf == NULL) { dev_err(dev, "[%s] EINVAL\n", __func__); goto done; @@ -1222,7 +1222,7 @@ static ssize_t show_inters(struct device *dev, struct device_attribute *attr, u32 intr; unsigned i, j, n = 0; - dbg_trace("[%s] %p\n", __func__, buf); + dbg_trace("[%s] %pK\n", __func__, buf); if (attr == NULL || buf == NULL) { dev_err(dev, "[%s] EINVAL\n", __func__); return 0; @@ -1295,7 +1295,7 @@ static ssize_t store_inters(struct device *dev, struct device_attribute *attr, unsigned long flags; unsigned en, bit; - dbg_trace("[%s] %p, %d\n", __func__, buf, count); + dbg_trace("[%s] %pK, %d\n", __func__, buf, count); if (attr == NULL || buf == NULL) { dev_err(dev, "[%s] EINVAL\n", __func__); goto done; @@ -1335,7 +1335,7 @@ static ssize_t show_port_test(struct device *dev, unsigned long flags; unsigned mode; - dbg_trace("[%s] %p\n", __func__, buf); + dbg_trace("[%s] %pK\n", __func__, buf); if (attr == NULL || buf == NULL) { dev_err(dev, "[%s] EINVAL\n", __func__); return 0; @@ -1361,7 +1361,7 @@ static ssize_t store_port_test(struct device *dev, unsigned long flags; unsigned mode; - dbg_trace("[%s] %p, %d\n", __func__, buf, count); + dbg_trace("[%s] %pK, %d\n", __func__, buf, count); if (attr == NULL || buf == NULL) { dev_err(dev, "[%s] EINVAL\n", __func__); goto done; @@ -1395,7 +1395,7 @@ static ssize_t show_qheads(struct device *dev, struct device_attribute *attr, unsigned long flags; unsigned i, j, n = 0; - dbg_trace("[%s] %p\n", __func__, buf); + dbg_trace("[%s] %pK\n", __func__, buf); if (attr == NULL || buf == NULL) { dev_err(dev, "[%s] EINVAL\n", __func__); return 0; @@ -1435,7 +1435,7 @@ static ssize_t show_registers(struct device *dev, u32 *dump; unsigned i, k, n = 0; - dbg_trace("[%s] %p\n", __func__, buf); + dbg_trace("[%s] %pK\n", __func__, buf); if (attr == NULL || buf == NULL) { dev_err(dev, "[%s] EINVAL\n", __func__); return 0; @@ -1473,7 +1473,7 @@ static ssize_t store_registers(struct device *dev, struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev); unsigned long addr, data, flags; - dbg_trace("[%s] %p, %d\n", __func__, buf, count); + dbg_trace("[%s] %pK, %d\n", __func__, buf, count); if (attr == NULL || buf == NULL) { dev_err(dev, "[%s] EINVAL\n", __func__); goto done; @@ -1509,7 +1509,7 @@ static ssize_t show_requests(struct device *dev, struct device_attribute *attr, struct ci13xxx_req *req = NULL; unsigned i, j, n = 0, qSize = sizeof(struct ci13xxx_td)/sizeof(u32); - dbg_trace("[%s] %p\n", __func__, buf); + dbg_trace("[%s] %pK\n", __func__, buf); if (attr == NULL || buf == NULL) { dev_err(dev, "[%s] EINVAL\n", __func__); return 0; @@ -1620,7 +1620,7 @@ static ssize_t print_dtds(struct device *dev, list_for_each(ptr, &mEp->qh.queue) { req = list_entry(ptr, struct ci13xxx_req, queue); - pr_info("\treq:%pa next:%08x token:%08x page0:%08x status:%d\n", + pr_info("\treq:%pKa next:%08x token:%08x page0:%08x status:%d\n", &req->dma, req->ptr->next, req->ptr->token, req->ptr->page[0], req->req.status); } @@ -1924,7 +1924,7 @@ static void ep_prime_timer_func(unsigned long data) mep->qh.ptr->td.next, mep->qh.ptr->td.token); list_for_each(ptr, &mep->qh.queue) { req = list_entry(ptr, struct ci13xxx_req, queue); - pr_info("\treq:%pa:%08xtkn:%08xpage0:%08xsts:%d\n", + pr_info("\treq:%pKa:%08xtkn:%08xpage0:%08xsts:%d\n", &req->dma, req->ptr->next, req->ptr->token, req->ptr->page[0], req->req.status); @@ -1958,7 +1958,7 @@ static int _hardware_enqueue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq) unsigned length = mReq->req.length; struct ci13xxx *udc = _udc; - trace("%p, %p", mEp, mReq); + trace("%pK, %pK", mEp, mReq); /* don't queue twice */ if (mReq->req.status == -EALREADY) @@ -2158,7 +2158,7 @@ static int _hardware_enqueue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq) */ static int _hardware_dequeue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq) { - trace("%p, %p", mEp, mReq); + trace("%pK, %pK", mEp, mReq); if (mReq->req.status != -EALREADY) return -EINVAL; @@ -2360,7 +2360,7 @@ static int _ep_nuke(struct ci13xxx_ep *mEp) __releases(mEp->lock) __acquires(mEp->lock) { - trace("%p", mEp); + trace("%pK", mEp); if (mEp == NULL) return -EINVAL; @@ -2407,7 +2407,7 @@ static int _gadget_stop_activity(struct usb_gadget *gadget) struct ci13xxx *udc = container_of(gadget, struct ci13xxx, gadget); unsigned long flags; - trace("%p", gadget); + trace("%pK", gadget); if (gadget == NULL) return -EINVAL; @@ -2456,7 +2456,7 @@ __acquires(udc->lock) { int retval; - trace("%p", udc); + trace("%pK", udc); if (udc == NULL) { err("EINVAL"); @@ -2555,7 +2555,7 @@ static void isr_suspend_handler(struct ci13xxx *udc) */ static void isr_get_status_complete(struct usb_ep *ep, struct usb_request *req) { - trace("%p, %p", ep, req); + trace("%pK, %pK", ep, req); if (ep == NULL || req == NULL) { err("EINVAL"); @@ -2582,7 +2582,7 @@ __acquires(mEp->lock) struct usb_request *req = udc->status; int dir, num, retval; - trace("%p, %p", mEp, setup); + trace("%pK, %pK", mEp, setup); if (mEp == NULL || setup == NULL) return -EINVAL; @@ -2631,7 +2631,7 @@ isr_setup_status_complete(struct usb_ep *ep, struct usb_request *req) struct ci13xxx *udc = req->context; unsigned long flags; - trace("%p, %p", ep, req); + trace("%pK, %pK", ep, req); spin_lock_irqsave(udc->lock, flags); if (udc->test_mode) @@ -2652,7 +2652,7 @@ __acquires(mEp->lock) int retval; struct ci13xxx_ep *mEp; - trace("%p", udc); + trace("%pK", udc); mEp = (udc->ep0_dir == TX) ? &udc->ep0out : &udc->ep0in; udc->status->context = udc; @@ -2683,7 +2683,7 @@ __acquires(mEp->lock) int req_dequeue = 1; struct ci13xxx *udc = _udc; - trace("%p", mEp); + trace("%pK", mEp); if (list_empty(&mEp->qh.queue)) return 0; @@ -2781,7 +2781,7 @@ __acquires(udc->lock) unsigned i; u8 tmode = 0; - trace("%p", udc); + trace("%pK", udc); if (udc == NULL) { err("EINVAL"); @@ -3067,7 +3067,7 @@ static int ep_enable(struct usb_ep *ep, unsigned long flags; unsigned mult = 0; - trace("ep = %p, desc = %p", ep, desc); + trace("ep = %pK, desc = %pK", ep, desc); if (ep == NULL || desc == NULL) return -EINVAL; @@ -3130,7 +3130,7 @@ static int ep_disable(struct usb_ep *ep) int direction, retval = 0; unsigned long flags; - trace("%p", ep); + trace("%pK", ep); if (ep == NULL) return -EINVAL; @@ -3177,7 +3177,7 @@ static struct usb_request *ep_alloc_request(struct usb_ep *ep, gfp_t gfp_flags) struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep); struct ci13xxx_req *mReq = NULL; - trace("%p, %i", ep, gfp_flags); + trace("%pK, %i", ep, gfp_flags); if (ep == NULL) { err("EINVAL"); @@ -3213,7 +3213,7 @@ static void ep_free_request(struct usb_ep *ep, struct usb_request *req) struct ci13xxx_req *mReq = container_of(req, struct ci13xxx_req, req); unsigned long flags; - trace("%p, %p", ep, req); + trace("%pK, %pK", ep, req); if (ep == NULL || req == NULL) { err("EINVAL"); @@ -3248,7 +3248,7 @@ static int ep_queue(struct usb_ep *ep, struct usb_request *req, unsigned long flags; struct ci13xxx *udc = _udc; - trace("%p, %p, %X", ep, req, gfp_flags); + trace("%pK, %pK, %X", ep, req, gfp_flags); spin_lock_irqsave(mEp->lock, flags); if (ep == NULL || req == NULL || mEp->desc == NULL) { @@ -3374,7 +3374,7 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req) struct ci13xxx_req *mReq = container_of(req, struct ci13xxx_req, req); unsigned long flags; - trace("%p, %p", ep, req); + trace("%pK, %pK", ep, req); spin_lock_irqsave(mEp->lock, flags); /* @@ -3445,7 +3445,7 @@ static int ep_set_halt(struct usb_ep *ep, int value) int direction, retval = 0; unsigned long flags; - trace("%p, %i", ep, value); + trace("%pK, %i", ep, value); if (ep == NULL || mEp->desc == NULL) return -EINVAL; @@ -3490,7 +3490,7 @@ static int ep_set_wedge(struct usb_ep *ep) struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep); unsigned long flags; - trace("%p", ep); + trace("%pK", ep); if (ep == NULL || mEp->desc == NULL) return -EINVAL; @@ -3515,7 +3515,7 @@ static void ep_fifo_flush(struct usb_ep *ep) struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep); unsigned long flags; - trace("%p", ep); + trace("%pK", ep); if (ep == NULL) { err("%02X: -EINVAL", _usb_addr(mEp)); @@ -3670,7 +3670,7 @@ static int ci13xxx_start(struct usb_gadget *gadget, int retval = -ENOMEM; bool put = false; - trace("%p", driver); + trace("%pK", driver); if (driver == NULL || driver->setup == NULL || @@ -3762,7 +3762,7 @@ static int ci13xxx_stop(struct usb_gadget *gadget, struct ci13xxx *udc = _udc; unsigned long flags; - trace("%p", driver); + trace("%pK", driver); if (driver == NULL || driver->unbind == NULL || @@ -3893,7 +3893,7 @@ static int udc_probe(struct ci13xxx_udc_driver *driver, struct device *dev, struct ci13xxx_platform_data *pdata; int retval = 0, i, j; - trace("%p, %p, %p", dev, regs, driver->name); + trace("%pK, %pK, %pK", dev, regs, driver->name); if (dev == NULL || regs == NULL || driver == NULL || driver->name == NULL) diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index 64dbaaafe881b..6bfa5073d01d4 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -181,7 +181,7 @@ int usb_add_function(struct usb_configuration *config, { int value = -EINVAL; - DBG(config->cdev, "adding '%s'/%p to config '%s'/%p\n", + DBG(config->cdev, "adding '%s'/%pK to config '%s'/%pK\n", function->name, function, config->label, config); @@ -215,7 +215,7 @@ int usb_add_function(struct usb_configuration *config, done: if (value) - DBG(config->cdev, "adding '%s'/%p --> %d\n", + DBG(config->cdev, "adding '%s'/%pK --> %d\n", function->name, function, value); return value; } @@ -765,7 +765,7 @@ static int set_config(struct usb_composite_dev *cdev, result = f->set_alt(f, tmp, 0); if (result < 0) { - DBG(cdev, "interface %d (%s/%p) alt 0 --> %d\n", + DBG(cdev, "interface %d (%s/%pK) alt 0 --> %d\n", tmp, f->name, f, result); reset_config(cdev); @@ -840,7 +840,7 @@ int usb_add_config(struct usb_composite_dev *cdev, if (!bind) goto done; - DBG(cdev, "adding config #%u '%s'/%p\n", + DBG(cdev, "adding config #%u '%s'/%pK\n", config->bConfigurationValue, config->label, config); @@ -857,7 +857,7 @@ int usb_add_config(struct usb_composite_dev *cdev, struct usb_function, list); list_del(&f->list); if (f->unbind) { - DBG(cdev, "unbind function '%s'/%p\n", + DBG(cdev, "unbind function '%s'/%pK\n", f->name, f); f->unbind(config, f); /* may free memory for "f" */ @@ -868,7 +868,7 @@ int usb_add_config(struct usb_composite_dev *cdev, } else { unsigned i; - DBG(cdev, "cfg %d/%p speeds:%s%s%s\n", + DBG(cdev, "cfg %d/%pK speeds:%s%s%s\n", config->bConfigurationValue, config, config->superspeed ? " super" : "", config->highspeed ? " high" : "", @@ -883,7 +883,7 @@ int usb_add_config(struct usb_composite_dev *cdev, if (!f) continue; - DBG(cdev, " interface %d = %s/%p\n", + DBG(cdev, " interface %d = %s/%pK\n", i, f->name, f); } } @@ -911,13 +911,13 @@ static void unbind_config(struct usb_composite_dev *cdev, struct usb_function, list); list_del(&f->list); if (f->unbind) { - DBG(cdev, "unbind function '%s'/%p\n", f->name, f); + DBG(cdev, "unbind function '%s'/%pK\n", f->name, f); f->unbind(config, f); /* may free memory for "f" */ } } if (config->unbind) { - DBG(cdev, "unbind config '%s'/%p\n", config->label, config); + DBG(cdev, "unbind config '%s'/%pK\n", config->label, config); config->unbind(config); /* may free memory for "c" */ } diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index 3dab424515efb..a520817fbc368 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -87,21 +87,28 @@ struct gadget_config_name { struct list_head list; }; +#define MAX_USB_STRING_LEN 126 +#define MAX_USB_STRING_WITH_NULL_LEN (MAX_USB_STRING_LEN+1) + static int usb_string_copy(const char *s, char **s_copy) { int ret; char *str; char *copy = *s_copy; ret = strlen(s); - if (ret > 126) + if (ret > MAX_USB_STRING_LEN) return -EOVERFLOW; - str = kstrdup(s, GFP_KERNEL); - if (!str) - return -ENOMEM; + if (copy) { + str = copy; + } else { + str = kmalloc(MAX_USB_STRING_WITH_NULL_LEN, GFP_KERNEL); + if (!str) + return -ENOMEM; + } + strncpy(str, s, MAX_USB_STRING_WITH_NULL_LEN); if (str[ret - 1] == '\n') str[ret - 1] = '\0'; - kfree(copy); *s_copy = str; return 0; } @@ -752,7 +759,7 @@ static void purge_configs_funcs(struct gadget_info *gi) list_move_tail(&f->list, &cfg->func_list); if (f->unbind) { dev_err(&gi->cdev.gadget->dev, "unbind function" - " '%s'/%p\n", f->name, f); + " '%s'/%pK\n", f->name, f); f->unbind(c, f); } } diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c index ac0e79e2c2e93..00457123eca1e 100644 --- a/drivers/usb/gadget/dummy_hcd.c +++ b/drivers/usb/gadget/dummy_hcd.c @@ -637,7 +637,7 @@ static int dummy_queue(struct usb_ep *_ep, struct usb_request *_req, return -ESHUTDOWN; #if 0 - dev_dbg(udc_dev(dum), "ep %p queue req %p to %s, len %d buf %p\n", + dev_dbg(udc_dev(dum), "ep %pK queue req %pK to %s, len %d buf %pK\n", ep, _req, _ep->name, _req->length, _req->buf); #endif _req->status = -EINPROGRESS; @@ -702,7 +702,7 @@ static int dummy_dequeue(struct usb_ep *_ep, struct usb_request *_req) if (retval == 0) { dev_dbg(udc_dev(dum), - "dequeued req %p from %s, len %d buf %p\n", + "dequeued req %pK from %s, len %d buf %pK\n", req, _ep->name, _req->length, _req->buf); _req->complete(_ep, _req); } @@ -1727,7 +1727,7 @@ static void dummy_timer(unsigned long _dum_hcd) if (!ep) { /* set_configuration() disagreement */ dev_dbg(dummy_dev(dum_hcd), - "no ep configured for urb %p\n", + "no ep configured for urb %pK\n", urb); status = -EPROTO; goto return_urb; @@ -1742,7 +1742,7 @@ static void dummy_timer(unsigned long _dum_hcd) } if (ep->halted && !ep->setup_stage) { /* NOTE: must not be iso! */ - dev_dbg(dummy_dev(dum_hcd), "ep %s halted, urb %p\n", + dev_dbg(dummy_dev(dum_hcd), "ep %s halted, urb %pK\n", ep->ep.name, urb); status = -EPIPE; goto return_urb; @@ -1759,7 +1759,7 @@ static void dummy_timer(unsigned long _dum_hcd) list_for_each_entry(req, &ep->queue, queue) { list_del_init(&req->queue); req->req.status = -EOVERFLOW; - dev_dbg(udc_dev(dum), "stale req = %p\n", + dev_dbg(udc_dev(dum), "stale req = %pK\n", req); spin_unlock(&dum->lock); @@ -2252,7 +2252,7 @@ static inline ssize_t show_urb(char *buf, size_t size, struct urb *urb) int ep = usb_pipeendpoint(urb->pipe); return snprintf(buf, size, - "urb/%p %s ep%d%s%s len %d/%d\n", + "urb/%pK %s ep%d%s%s len %d/%d\n", urb, ({ char *s; switch (urb->dev->speed) { diff --git a/drivers/usb/gadget/f_accessory.c b/drivers/usb/gadget/f_accessory.c index 137be79b3c292..700275c720b3e 100644 --- a/drivers/usb/gadget/f_accessory.c +++ b/drivers/usb/gadget/f_accessory.c @@ -539,7 +539,7 @@ static int create_bulk_endpoints(struct acc_dev *dev, struct usb_ep *ep; int i; - DBG(cdev, "create_bulk_endpoints dev: %p\n", dev); + DBG(cdev, "create_bulk_endpoints dev: %pK\n", dev); ep = usb_ep_autoconfig(cdev->gadget, in_desc); if (!ep) { @@ -641,7 +641,7 @@ static ssize_t acc_read(struct file *fp, char __user *buf, r = -EIO; goto done; } else { - pr_debug("rx %p queue\n", req); + pr_debug("rx %pK queue\n", req); } /* wait for a request to complete */ @@ -664,7 +664,7 @@ static ssize_t acc_read(struct file *fp, char __user *buf, if (req->actual == 0) goto requeue_req; - pr_debug("rx %p %u\n", req, req->actual); + pr_debug("rx %pK %u\n", req, req->actual); xfer = (req->actual < count) ? req->actual : count; r = xfer; if (copy_to_user(buf, req->buf, xfer)) @@ -960,7 +960,7 @@ acc_function_bind(struct usb_configuration *c, struct usb_function *f) int id; int ret; - DBG(cdev, "acc_function_bind dev: %p\n", dev); + DBG(cdev, "acc_function_bind dev: %pK\n", dev); ret = hid_register_driver(&acc_hid_driver); if (ret) @@ -1126,7 +1126,7 @@ static void acc_hid_work(struct work_struct *data) list_for_each_safe(entry, temp, &new_list) { hid = list_entry(entry, struct acc_hid_dev, list); if (acc_hid_init(hid)) { - pr_err("can't add HID device %p\n", hid); + pr_err("can't add HID device %pK\n", hid); acc_hid_delete(hid); } else { spin_lock_irqsave(&dev->lock, flags); diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c index a9cefda809ee6..fe0c6453a2111 100644 --- a/drivers/usb/gadget/f_acm.c +++ b/drivers/usb/gadget/f_acm.c @@ -137,7 +137,7 @@ static int acm_port_connect(struct f_acm *acm) port_num = gacm_ports[acm->port_num].client_port_num; - pr_debug("%s: transport:%s f_acm:%p gserial:%p port_num:%d cl_port_no:%d\n", + pr_debug("%s: transport:%s f_acm:%pK gserial:%pK port_num:%d cl_port_no:%d\n", __func__, xport_to_str(acm->transport), acm, &acm->port, acm->port_num, port_num); @@ -163,7 +163,7 @@ static int acm_port_disconnect(struct f_acm *acm) port_num = gacm_ports[acm->port_num].client_port_num; - pr_debug("%s: transport:%s f_acm:%p gserial:%p port_num:%d cl_pno:%d\n", + pr_debug("%s: transport:%s f_acm:%pK gserial:%pK port_num:%d cl_pno:%d\n", __func__, xport_to_str(acm->transport), acm, &acm->port, acm->port_num, port_num); @@ -827,7 +827,7 @@ acm_bind(struct usb_configuration *c, struct usb_function *f) if (acm->port.in) acm->port.in->driver_data = NULL; - ERROR(cdev, "%s/%p: can't bind, err %d\n", f->name, f, status); + ERROR(cdev, "%s/%pK: can't bind, err %d\n", f->name, f, status); return status; } diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c index a50b8e8e8ca47..5617e8e4c8852 100644 --- a/drivers/usb/gadget/f_fs.c +++ b/drivers/usb/gadget/f_fs.c @@ -1411,14 +1411,14 @@ static void ffs_data_clear(struct ffs_data *ffs) { ENTER(); - pr_debug("%s: ffs->gadget= %p, ffs->flags= %lu\n", __func__, + pr_debug("%s: ffs->gadget= %pK, ffs->flags= %lu\n", __func__, ffs->gadget, ffs->flags); if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags)) functionfs_closed_callback(ffs); /* Dump ffs->gadget and ffs->flags */ if (ffs->gadget) - pr_err("%s: ffs:%p ffs->gadget= %p, ffs->flags= %lu\n", + pr_err("%s: ffs:%pK ffs->gadget= %pK, ffs->flags= %lu\n", __func__, ffs, ffs->gadget, ffs->flags); BUG_ON(ffs->gadget); diff --git a/drivers/usb/gadget/f_gps.c b/drivers/usb/gadget/f_gps.c index ae34229ac3566..350bd1bf5bb9f 100644 --- a/drivers/usb/gadget/f_gps.c +++ b/drivers/usb/gadget/f_gps.c @@ -293,7 +293,7 @@ gps_set_alt(struct usb_function *f, unsigned intf, unsigned alt) int ret; struct list_head *cpkt; - pr_debug("%s:dev:%p\n", __func__, dev); + pr_debug("%s:dev:%pK\n", __func__, dev); if (dev->notify->driver_data) usb_ep_disable(dev->notify); @@ -334,7 +334,7 @@ static void gps_ctrl_response_available(struct f_gps *dev) int ret; struct rmnet_ctrl_pkt *cpkt; - pr_debug("%s:dev:%p\n", __func__, dev); + pr_debug("%s:dev:%pK\n", __func__, dev); spin_lock_irqsave(&dev->lock, flags); if (!atomic_read(&dev->online) || !req || !req->buf) { @@ -376,7 +376,7 @@ static void gps_connect(struct grmnet *gr) struct f_gps *dev; if (!gr) { - pr_err("%s: Invalid grmnet:%p\n", __func__, gr); + pr_err("%s: Invalid grmnet:%pK\n", __func__, gr); return; } @@ -392,7 +392,7 @@ static void gps_disconnect(struct grmnet *gr) int status; if (!gr) { - pr_err("%s: Invalid grmnet:%p\n", __func__, gr); + pr_err("%s: Invalid grmnet:%pK\n", __func__, gr); return; } @@ -434,7 +434,7 @@ gps_send_cpkt_response(void *gr, void *buf, size_t len) unsigned long flags; if (!gr || !buf) { - pr_err("%s: Invalid grmnet/buf, grmnet:%p buf:%p\n", + pr_err("%s: Invalid grmnet/buf, grmnet:%pK buf:%pK\n", __func__, gr, buf); return -ENODEV; } @@ -448,7 +448,7 @@ gps_send_cpkt_response(void *gr, void *buf, size_t len) dev = port_to_gps(gr); - pr_debug("%s: dev:%p\n", __func__, dev); + pr_debug("%s: dev:%pK\n", __func__, dev); if (!atomic_read(&dev->online) || !atomic_read(&dev->ctrl_online)) { gps_free_ctrl_pkt(cpkt); @@ -475,7 +475,7 @@ gps_cmd_complete(struct usb_ep *ep, struct usb_request *req) return; } - pr_debug("%s: dev:%p\n", __func__, dev); + pr_debug("%s: dev:%pK\n", __func__, dev); cdev = dev->cdev; @@ -490,7 +490,7 @@ static void gps_notify_complete(struct usb_ep *ep, struct usb_request *req) unsigned long flags; struct rmnet_ctrl_pkt *cpkt; - pr_debug("%s: dev:%p port#%d\n", __func__, dev, dev->port_num); + pr_debug("%s: dev:%pK port#%d\n", __func__, dev, dev->port_num); switch (status) { case -ECONNRESET: @@ -536,7 +536,7 @@ gps_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl) u16 w_length = le16_to_cpu(ctrl->wLength); int ret = -EOPNOTSUPP; - pr_debug("%s:dev:%p\n", __func__, dev); + pr_debug("%s:dev:%pK\n", __func__, dev); if (!atomic_read(&dev->online)) { pr_debug("%s: usb cable is not connected\n", __func__); @@ -706,7 +706,7 @@ static int gps_bind_config(struct usb_configuration *c) struct usb_function *f; unsigned long flags; - pr_debug("%s: usb config:%p\n", __func__, c); + pr_debug("%s: usb config:%pK\n", __func__, c); if (gps_string_defs[0].id == 0) { status = usb_string_id(c->cdev); diff --git a/drivers/usb/gadget/f_mtp.c b/drivers/usb/gadget/f_mtp.c index 9a9419d4a8368..5717c2087e8e6 100644 --- a/drivers/usb/gadget/f_mtp.c +++ b/drivers/usb/gadget/f_mtp.c @@ -554,7 +554,7 @@ static int mtp_create_bulk_endpoints(struct mtp_dev *dev, struct usb_ep *ep; int i; - DBG(cdev, "create_bulk_endpoints dev: %p\n", dev); + DBG(cdev, "create_bulk_endpoints dev: %pK\n", dev); ep = usb_ep_autoconfig(cdev->gadget, in_desc); if (!ep) { @@ -720,7 +720,7 @@ static ssize_t mtp_read(struct file *fp, char __user *buf, r = -EIO; goto done; } else { - DBG(cdev, "rx %p queue\n", req); + DBG(cdev, "rx %pK queue\n", req); } /* wait for a request to complete */ @@ -745,7 +745,7 @@ static ssize_t mtp_read(struct file *fp, char __user *buf, if (req->actual == 0) goto requeue_req; - DBG(cdev, "rx %p %d\n", req, req->actual); + DBG(cdev, "rx %pK %d\n", req, req->actual); xfer = (req->actual < count) ? req->actual : count; r = xfer; if (copy_to_user(buf, req->buf, xfer)) @@ -1005,7 +1005,7 @@ static void receive_file_work(struct work_struct *data) } if (write_req) { - DBG(cdev, "rx %p %d\n", write_req, write_req->actual); + DBG(cdev, "rx %pK %d\n", write_req, write_req->actual); ret = vfs_write(filp, write_req->buf, write_req->actual, &offset); DBG(cdev, "vfs_write %d\n", ret); @@ -1417,7 +1417,7 @@ mtp_function_bind(struct usb_configuration *c, struct usb_function *f) int ret; dev->cdev = cdev; - DBG(cdev, "mtp_function_bind dev: %p\n", dev); + DBG(cdev, "mtp_function_bind dev: %pK\n", dev); /* allocate interface ID(s) */ id = usb_interface_id(c, f); diff --git a/drivers/usb/gadget/f_qdss.c b/drivers/usb/gadget/f_qdss.c index 300ff343d08d3..ef933bbe103da 100644 --- a/drivers/usb/gadget/f_qdss.c +++ b/drivers/usb/gadget/f_qdss.c @@ -661,7 +661,7 @@ static void usb_qdss_connect_work(struct work_struct *work) dxport = qdss_ports[qdss->port_num].data_xport; ctrl_xport = qdss_ports[qdss->port_num].ctrl_xport; port_num = qdss_ports[qdss->port_num].data_xport_num; - pr_debug("%s: data xport: %s dev: %p portno: %d\n", + pr_debug("%s: data xport: %s dev: %pK portno: %d\n", __func__, xport_to_str(dxport), qdss, qdss->port_num); if (qdss->port_num >= nr_qdss_ports) { @@ -766,7 +766,7 @@ static int qdss_set_alt(struct usb_function *f, unsigned intf, unsigned alt) dxport = qdss_ports[qdss->port_num].data_xport; - pr_debug("qdss_set_alt qdss pointer = %p\n", qdss); + pr_debug("qdss_set_alt qdss pointer = %pK\n", qdss); if (alt != 0) goto fail; diff --git a/drivers/usb/gadget/f_rmnet.c b/drivers/usb/gadget/f_rmnet.c index bcee8345774cc..be8a0087c60cd 100644 --- a/drivers/usb/gadget/f_rmnet.c +++ b/drivers/usb/gadget/f_rmnet.c @@ -408,7 +408,7 @@ static int gport_rmnet_connect(struct f_rmnet *dev, unsigned intf) struct usb_gadget *gadget = dev->cdev->gadget; void *net; - pr_debug("%s: ctrl xport: %s data xport: %s dev: %p portno: %d\n", + pr_debug("%s: ctrl xport: %s data xport: %s dev: %pK portno: %d\n", __func__, xport_to_str(cxport), xport_to_str(dxport), dev, dev->port_num); @@ -558,7 +558,7 @@ static int gport_rmnet_disconnect(struct f_rmnet *dev) enum transport_type cxport = rmnet_ports[dev->port_num].ctrl_xport; enum transport_type dxport = rmnet_ports[dev->port_num].data_xport; - pr_debug("%s: ctrl xport: %s data xport: %s dev: %p portno: %d\n", + pr_debug("%s: ctrl xport: %s data xport: %s dev: %pK portno: %d\n", __func__, xport_to_str(cxport), xport_to_str(dxport), dev, dev->port_num); @@ -658,7 +658,7 @@ static void frmnet_suspend(struct usb_function *f) else remote_wakeup_allowed = f->config->cdev->gadget->remote_wakeup; - pr_debug("%s: data xport: %s dev: %p portno: %d remote_wakeup: %d\n", + pr_debug("%s: data xport: %s dev: %pK portno: %d remote_wakeup: %d\n", __func__, xport_to_str(dxport), dev, dev->port_num, remote_wakeup_allowed); @@ -683,7 +683,7 @@ static void frmnet_suspend(struct usb_function *f) */ dev->in_ep_desc_backup = dev->port.in->desc; dev->out_ep_desc_backup = dev->port.out->desc; - pr_debug("in_ep_desc_bkup = %p, out_ep_desc_bkup = %p", + pr_debug("in_ep_desc_bkup = %pK, out_ep_desc_bkup = %pK", dev->in_ep_desc_backup, dev->out_ep_desc_backup); pr_debug("%s(): Disconnecting\n", __func__); gport_rmnet_disconnect(dev); @@ -716,7 +716,7 @@ static void frmnet_resume(struct usb_function *f) else remote_wakeup_allowed = f->config->cdev->gadget->remote_wakeup; - pr_debug("%s: data xport: %s dev: %p portno: %d remote_wakeup: %d\n", + pr_debug("%s: data xport: %s dev: %pK portno: %d remote_wakeup: %d\n", __func__, xport_to_str(dxport), dev, dev->port_num, remote_wakeup_allowed); @@ -785,7 +785,7 @@ frmnet_set_alt(struct usb_function *f, unsigned intf, unsigned alt) int ret; struct list_head *cpkt; - pr_debug("%s:dev:%p port#%d\n", __func__, dev, dev->port_num); + pr_debug("%s:dev:%pK port#%d\n", __func__, dev, dev->port_num); if (dev->notify->driver_data) { pr_debug("%s: reset port:%d\n", __func__, dev->port_num); @@ -848,7 +848,7 @@ static void frmnet_ctrl_response_available(struct f_rmnet *dev) int ret; struct rmnet_ctrl_pkt *cpkt; - pr_debug("%s:dev:%p portno#%d\n", __func__, dev, dev->port_num); + pr_debug("%s:dev:%pK portno#%d\n", __func__, dev, dev->port_num); spin_lock_irqsave(&dev->lock, flags); if (!atomic_read(&dev->online) || !req || !req->buf) { @@ -897,7 +897,7 @@ static void frmnet_connect(struct grmnet *gr) struct f_rmnet *dev; if (!gr) { - pr_err("%s: Invalid grmnet:%p\n", __func__, gr); + pr_err("%s: Invalid grmnet:%pK\n", __func__, gr); return; } @@ -913,7 +913,7 @@ static void frmnet_disconnect(struct grmnet *gr) int status; if (!gr) { - pr_err("%s: Invalid grmnet:%p\n", __func__, gr); + pr_err("%s: Invalid grmnet:%pK\n", __func__, gr); return; } @@ -955,7 +955,7 @@ frmnet_send_cpkt_response(void *gr, void *buf, size_t len) unsigned long flags; if (!gr || !buf) { - pr_err("%s: Invalid grmnet/buf, grmnet:%p buf:%p\n", + pr_err("%s: Invalid grmnet/buf, grmnet:%pK buf:%pK\n", __func__, gr, buf); return -ENODEV; } @@ -969,7 +969,7 @@ frmnet_send_cpkt_response(void *gr, void *buf, size_t len) dev = port_to_rmnet(gr); - pr_debug("%s: dev:%p port#%d\n", __func__, dev, dev->port_num); + pr_debug("%s: dev:%pK port#%d\n", __func__, dev, dev->port_num); if (!atomic_read(&dev->online) || !atomic_read(&dev->ctrl_online)) { rmnet_free_ctrl_pkt(cpkt); @@ -997,7 +997,7 @@ frmnet_cmd_complete(struct usb_ep *ep, struct usb_request *req) return; } - pr_debug("%s: dev:%p port#%d\n", __func__, dev, dev->port_num); + pr_debug("%s: dev:%pK port#%d\n", __func__, dev, dev->port_num); cdev = dev->cdev; @@ -1014,7 +1014,7 @@ static void frmnet_notify_complete(struct usb_ep *ep, struct usb_request *req) unsigned long flags; struct rmnet_ctrl_pkt *cpkt; - pr_debug("%s: dev:%p port#%d\n", __func__, dev, dev->port_num); + pr_debug("%s: dev:%pK port#%d\n", __func__, dev, dev->port_num); switch (status) { case -ECONNRESET: @@ -1083,7 +1083,7 @@ frmnet_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl) u16 w_length = le16_to_cpu(ctrl->wLength); int ret = -EOPNOTSUPP; - pr_debug("%s:dev:%p port#%d\n", __func__, dev, dev->port_num); + pr_debug("%s:dev:%pK port#%d\n", __func__, dev, dev->port_num); if (!atomic_read(&dev->online)) { pr_warning("%s: usb cable is not connected\n", __func__); @@ -1308,7 +1308,7 @@ static int frmnet_bind_config(struct usb_configuration *c, unsigned portno) struct usb_function *f; unsigned long flags; - pr_debug("%s: usb config:%p\n", __func__, c); + pr_debug("%s: usb config:%pK\n", __func__, c); if (portno >= nr_rmnet_ports) { pr_err("%s: supporting ports#%u port_id:%u\n", __func__, diff --git a/drivers/usb/gadget/f_serial.c b/drivers/usb/gadget/f_serial.c index a5621f8fd005f..2dd6a44e7d552 100644 --- a/drivers/usb/gadget/f_serial.c +++ b/drivers/usb/gadget/f_serial.c @@ -413,7 +413,7 @@ static int gport_connect(struct f_gser *gser) unsigned port_num; int ret; - pr_debug("%s: transport: %s f_gser: %p gserial: %p port_num: %d\n", + pr_debug("%s: transport: %s f_gser: %pK gserial: %pK port_num: %d\n", __func__, xport_to_str(gser->transport), gser, &gser->port, gser->port_num); @@ -464,7 +464,7 @@ static int gport_disconnect(struct f_gser *gser) port_num = gserial_ports[gser->port_num].client_port_num; - pr_debug("%s: transport: %s f_gser: %p gserial: %p port_num: %d\n", + pr_debug("%s: transport: %s f_gser: %pK gserial: %pK port_num: %d\n", __func__, xport_to_str(gser->transport), gser, &gser->port, gser->port_num); @@ -656,6 +656,7 @@ static void gser_disable(struct usb_function *f) #endif gser->online = 0; } + #ifdef CONFIG_MODEM_SUPPORT static int gser_notify(struct f_gser *gser, u8 type, u16 value, void *data, unsigned length) diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c index b2bccd91e765b..ecedc8bc727de 100644 --- a/drivers/usb/gadget/inode.c +++ b/drivers/usb/gadget/inode.c @@ -310,7 +310,7 @@ get_ready_ep (unsigned f_flags, struct ep_data *epdata) // case STATE_EP_DISABLED: /* "can't happen" */ // case STATE_EP_READY: /* "can't happen" */ default: /* error! */ - pr_debug ("%s: ep %p not available, state %d\n", + pr_debug ("%s: ep %pK not available, state %d\n", shortname, epdata, epdata->state); // FALLTHROUGH case STATE_EP_UNBOUND: /* clean disconnect */ @@ -1937,7 +1937,7 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) fail: spin_unlock_irq (&dev->lock); - pr_debug ("%s: %s fail %Zd, %p\n", shortname, __func__, value, dev); + pr_debug ("%s: %s fail %Zd, %pK\n", shortname, __func__, value, dev); kfree (dev->buf); dev->buf = NULL; return value; diff --git a/drivers/usb/gadget/u_bam.c b/drivers/usb/gadget/u_bam.c index ed5ef735dfe1a..272738a8bf530 100644 --- a/drivers/usb/gadget/u_bam.c +++ b/drivers/usb/gadget/u_bam.c @@ -228,7 +228,7 @@ static int gbam_alloc_requests(struct usb_ep *ep, struct list_head *head, { int i; struct usb_request *req; - pr_debug("%s: ep:%p head:%p num:%d cb:%p", __func__, + pr_debug("%s: ep:%pK head:%pK num:%d cb:%pK", __func__, ep, head, num, cb); for (i = 0; i < num; i++) { @@ -467,7 +467,7 @@ void gbam_data_recv_cb(void *p, struct sk_buff *skb) if (!skb) return; - pr_debug("%s: p:%p#%d d:%p skb_len:%d\n", __func__, + pr_debug("%s: p:%pK#%d d:%pK skb_len:%d\n", __func__, port, port->port_num, d, skb->len); spin_lock_irqsave(&port->port_lock_dl, flags); @@ -508,7 +508,7 @@ void gbam_data_write_done(void *p, struct sk_buff *skb) d->pending_bytes_with_bam -= skb->len; gbam_free_skb_to_pool(port, skb); - pr_debug("%s:port:%p d:%p tom:%lu ppkt:%u pbytes:%u pno:%d\n", __func__, + pr_debug("%s:port:%pK d:%pK tom:%lu ppkt:%u pbytes:%u pno:%d\n", __func__, port, d, d->to_modem, d->pending_pkts_with_bam, d->pending_bytes_with_bam, port->port_num); @@ -583,7 +583,7 @@ static void gbam_data_write_tobam(struct work_struct *w) d->pending_bytes_with_bam += skb->len; d->to_modem++; - pr_debug("%s: port:%p d:%p tom:%lu ppkts:%u pbytes:%u pno:%d\n", + pr_debug("%s: port:%pK d:%pK tom:%lu ppkts:%u pbytes:%u pno:%d\n", __func__, port, d, d->to_modem, d->pending_pkts_with_bam, d->pending_bytes_with_bam, port->port_num); @@ -1086,7 +1086,7 @@ static void gbam_start_io(struct gbam_port *port) { unsigned long flags; - pr_debug("%s: port:%p\n", __func__, port); + pr_debug("%s: port:%pK\n", __func__, port); if (_gbam_start_io(port, true)) return; @@ -1854,7 +1854,7 @@ static int gbam_port_alloc(int portno) pdrv->driver.owner = THIS_MODULE; platform_driver_register(pdrv); - pr_debug("%s: port:%p portno:%d\n", __func__, port, portno); + pr_debug("%s: port:%pK portno:%d\n", __func__, port, portno); return 0; } @@ -1894,7 +1894,7 @@ static int gbam2bam_port_alloc(int portno) INIT_LIST_HEAD(&d->rx_idle); INIT_WORK(&d->write_tobam_w, gbam_data_write_tobam); - pr_debug("%s: port:%p portno:%d\n", __func__, port, portno); + pr_debug("%s: port:%pK portno:%d\n", __func__, port, portno); return 0; } @@ -1926,7 +1926,7 @@ static ssize_t gbam_read_stats(struct file *file, char __user *ubuf, d = &port->data_ch; temp += scnprintf(buf + temp, DEBUG_BUF_SIZE - temp, - "#PORT:%d port:%p data_ch:%p#\n" + "#PORT:%d port:%pK data_ch:%pK#\n" "dpkts_to_usbhost: %lu\n" "dpkts_to_modem: %lu\n" "dpkts_pwith_bam: %u\n" @@ -2049,7 +2049,7 @@ void gbam_disconnect(struct grmnet *gr, u8 port_num, enum transport_type trans) unsigned long flags, flags_ul; struct bam_ch_info *d; - pr_debug("%s: grmnet:%p port#%d\n", __func__, gr, port_num); + pr_debug("%s: grmnet:%pK port#%d\n", __func__, gr, port_num); if (trans == USB_GADGET_XPORT_BAM && port_num >= n_bam_ports) { @@ -2146,7 +2146,7 @@ int gbam_connect(struct grmnet *gr, u8 port_num, int ret; unsigned long flags, flags_ul; - pr_debug("%s: grmnet:%p port#%d\n", __func__, gr, port_num); + pr_debug("%s: grmnet:%pK port#%d\n", __func__, gr, port_num); if (!gr) { pr_err("%s: grmnet port is null\n", __func__); @@ -2254,7 +2254,7 @@ int gbam_connect(struct grmnet *gr, u8 port_num, ret = usb_ep_enable(gr->in); if (ret) { - pr_err("%s: usb_ep_enable failed eptype:IN ep:%p", + pr_err("%s: usb_ep_enable failed eptype:IN ep:%pK", __func__, gr->in); goto exit; } @@ -2268,7 +2268,7 @@ int gbam_connect(struct grmnet *gr, u8 port_num, if (gr->out) { ret = usb_ep_enable(gr->out); if (ret) { - pr_err("%s: usb_ep_enable failed eptype:OUT ep:%p", + pr_err("%s: usb_ep_enable failed eptype:OUT ep:%pK", __func__, gr->out); gr->in->driver_data = 0; goto exit; diff --git a/drivers/usb/gadget/u_bam_data.c b/drivers/usb/gadget/u_bam_data.c index 147c4fdb4f1e8..1e399f6477bcc 100644 --- a/drivers/usb/gadget/u_bam_data.c +++ b/drivers/usb/gadget/u_bam_data.c @@ -168,7 +168,7 @@ static int bam_data_alloc_requests(struct usb_ep *ep, struct list_head *head, struct bam_data_ch_info *d = &port->data_ch; struct usb_request *req; - pr_debug("%s: ep:%p head:%p num:%d cb:%p", __func__, + pr_debug("%s: ep:%pK head:%pK num:%d cb:%pK", __func__, ep, head, num, cb); if (d->alloc_rx_reqs) { @@ -294,7 +294,7 @@ static void bam_data_write_done(void *p, struct sk_buff *skb) d->pending_with_bam--; - pr_debug("%s: port:%p d:%p pbam:%u, pno:%d\n", __func__, + pr_debug("%s: port:%pK d:%pK pbam:%u, pno:%d\n", __func__, port, d, d->pending_with_bam, port->port_num); spin_unlock_irqrestore(&port->port_lock, flags); @@ -528,7 +528,7 @@ static void bam_data_write_toipa(struct work_struct *w) d->pending_with_bam++; - pr_debug("%s: port:%p d:%p pbam:%u pno:%d\n", __func__, + pr_debug("%s: port:%pK d:%pK pbam:%u pno:%d\n", __func__, port, d, d->pending_with_bam, port->port_num); spin_unlock_irqrestore(&port->port_lock, flags); @@ -819,7 +819,7 @@ static void bam2bam_data_disconnect_work(struct work_struct *w) port->is_ipa_connected = false; spin_unlock_irqrestore(&port->port_lock, flags); - pr_debug("Disconnect workqueue done (port %p)\n", port); + pr_debug("Disconnect workqueue done (port %pK)\n", port); } /* * This function configured data fifo based on index passed to get bam2bam @@ -1188,7 +1188,7 @@ static void bam2bam_data_connect_work(struct work_struct *w) } } - pr_debug("Connect workqueue done (port %p)", port); + pr_debug("Connect workqueue done (port %pK)", port); return; disconnect_ipa: @@ -1226,7 +1226,7 @@ void bam_data_start_rx_tx(u8 port_num) } if (!d->rx_req || !d->tx_req) { - pr_err("%s: No request d->rx_req=%p, d->tx_req=%p", __func__, + pr_err("%s: No request d->rx_req=%pK, d->tx_req=%pK", __func__, d->rx_req, d->tx_req); goto out; } @@ -1365,7 +1365,7 @@ void bam_data_disconnect(struct data_port *gr, enum function_type func, return; } - pr_debug("dev:%p port number:%d\n", gr, port_num); + pr_debug("dev:%pK port number:%d\n", gr, port_num); if (!gr) { pr_err("data port is null\n"); @@ -1491,7 +1491,7 @@ int bam_data_connect(struct data_port *gr, enum transport_type trans, return -EINVAL; } - pr_debug("dev:%p port#%d\n", gr, port_num); + pr_debug("dev:%pK port#%d\n", gr, port_num); bam_name = (trans == USB_GADGET_XPORT_BAM2BAM_IPA) ? IPA_P_BAM : A2_P_BAM; @@ -1578,7 +1578,7 @@ int bam_data_connect(struct data_port *gr, enum transport_type trans, ret = usb_ep_enable(gr->in); if (ret) { - pr_err("usb_ep_enable failed eptype:IN ep:%p", gr->in); + pr_err("usb_ep_enable failed eptype:IN ep:%pK", gr->in); goto exit; } @@ -1586,7 +1586,7 @@ int bam_data_connect(struct data_port *gr, enum transport_type trans, ret = usb_ep_enable(gr->out); if (ret) { - pr_err("usb_ep_enable failed eptype:OUT ep:%p", gr->out); + pr_err("usb_ep_enable failed eptype:OUT ep:%pK", gr->out); goto disable_in_ep; } @@ -1856,7 +1856,7 @@ void bam_data_suspend(struct data_port *port_usb, u8 dev_port_num, port_usb->in_ep_desc_backup = port_usb->in->desc; port_usb->out_ep_desc_backup = port_usb->out->desc; - pr_debug("in_ep_desc_backup = %p, out_ep_desc_backup = %p", + pr_debug("in_ep_desc_backup = %pK, out_ep_desc_backup = %pK", port_usb->in_ep_desc_backup, port_usb->out_ep_desc_backup); @@ -1897,7 +1897,7 @@ void bam_data_resume(struct data_port *port_usb, u8 dev_port_num, port_usb->in->desc = port_usb->in_ep_desc_backup; port_usb->out->desc = port_usb->out_ep_desc_backup; - pr_debug("in_ep_desc_backup = %p, out_ep_desc_backup = %p", + pr_debug("in_ep_desc_backup = %pK, out_ep_desc_backup = %pK", port_usb->in_ep_desc_backup, port_usb->out_ep_desc_backup); diff --git a/drivers/usb/gadget/u_ctrl_hsuart.c b/drivers/usb/gadget/u_ctrl_hsuart.c index c998a2d77e6be..f8722be9a2552 100644 --- a/drivers/usb/gadget/u_ctrl_hsuart.c +++ b/drivers/usb/gadget/u_ctrl_hsuart.c @@ -233,7 +233,7 @@ static void ghsuart_ctrl_connect_w(struct work_struct *w) if (!port || !test_bit(CH_READY, &port->channel_sts)) return; - pr_debug("%s: port:%p\n", __func__, port); + pr_debug("%s: port:%pK\n", __func__, port); if (test_bit(CH_OPENED, &port->channel_sts)) { retval = wait_for_completion_timeout( @@ -439,7 +439,7 @@ static int ghsuart_ctrl_port_alloc(int portno, enum gadget_type gtype) err = platform_driver_register(pdrv); if (unlikely(err < 0)) return err; - pr_debug("%s: port:%p portno:%d\n", __func__, port, portno); + pr_debug("%s: port:%pK portno:%d\n", __func__, port, portno); return 0; } @@ -502,7 +502,7 @@ static ssize_t ghsuart_ctrl_read_stats(struct file *file, char __user *ubuf, spin_lock_irqsave(&port->port_lock, flags); temp += scnprintf(buf + temp, DEBUG_BUF_SIZE - temp, - "#PORT:%d port: %p\n" + "#PORT:%d port: %pK\n" "to_usbhost: %lu\n" "to_modem: %lu\n" "cpkt_drp_cnt: %lu\n" diff --git a/drivers/usb/gadget/u_ctrl_qti.c b/drivers/usb/gadget/u_ctrl_qti.c index 08fe7e8e910ba..006e77dd82c11 100644 --- a/drivers/usb/gadget/u_ctrl_qti.c +++ b/drivers/usb/gadget/u_ctrl_qti.c @@ -83,7 +83,7 @@ static void qti_ctrl_queue_notify(struct qti_ctrl_port *port) spin_lock_irqsave(&port->lock, flags); if (!port->is_open) { - pr_err("%s: rmnet ctrl file handler %p is not open", + pr_err("%s: rmnet ctrl file handler %pK is not open", __func__, port); spin_unlock_irqrestore(&port->lock, flags); return; @@ -136,7 +136,7 @@ static int gqti_ctrl_send_cpkt_tomodem(u8 portno, void *buf, size_t len) /* drop cpkt if port is not open */ if (!port->is_open) { - pr_debug("rmnet file handler %p(index=%d) is not open", + pr_debug("rmnet file handler %pK(index=%d) is not open", port, port->index); spin_unlock_irqrestore(&port->lock, flags); free_rmnet_ctrl_pkt(cpkt); @@ -178,7 +178,7 @@ int gqti_ctrl_connect(void *gr, u8 port_num, unsigned intf, struct gqdss *g_dpl = NULL; unsigned long flags; - pr_debug("%s: gtype:%d gadget:%p\n", __func__, gtype, gr); + pr_debug("%s: gtype:%d gadget:%pK\n", __func__, gtype, gr); if (port_num >= NR_QTI_PORTS) { pr_err("%s: Invalid QTI port %d\n", __func__, port_num); return -ENODEV; @@ -249,7 +249,7 @@ void gqti_ctrl_disconnect(void *gr, u8 port_num) struct grmnet *g_rmnet = NULL; struct gqdss *g_dpl = NULL; - pr_debug("%s: gadget:%p\n", __func__, gr); + pr_debug("%s: gadget:%pK\n", __func__, gr); if (port_num >= NR_QTI_PORTS) { pr_err("%s: Invalid QTI port %d\n", __func__, port_num); diff --git a/drivers/usb/gadget/u_data_hsic.c b/drivers/usb/gadget/u_data_hsic.c index 07bb5a8fac5f1..c02c798a82ae7 100644 --- a/drivers/usb/gadget/u_data_hsic.c +++ b/drivers/usb/gadget/u_data_hsic.c @@ -156,7 +156,7 @@ static int ghsic_data_alloc_requests(struct usb_ep *ep, struct list_head *head, struct usb_request *req; unsigned long flags; - pr_debug("%s: ep:%s head:%p num:%d cb:%p", __func__, + pr_debug("%s: ep:%s head:%pK num:%d cb:%pK", __func__, ep->name, head, num, cb); for (i = 0; i < num; i++) { @@ -272,7 +272,7 @@ static int ghsic_data_receive(void *p, void *data, size_t len) return -ENOTCONN; } - pr_debug("%s: p:%p#%d skb_len:%d\n", __func__, + pr_debug("%s: p:%pK#%d skb_len:%d\n", __func__, port, port->port_num, skb->len); spin_lock_irqsave(&port->tx_lock, flags); @@ -316,7 +316,7 @@ static void ghsic_data_write_tomdm(struct work_struct *w) } while ((skb = __skb_dequeue(&port->rx_skb_q))) { - pr_debug("%s: port:%p tom:%lu pno:%d\n", __func__, + pr_debug("%s: port:%pK tom:%lu pno:%d\n", __func__, port, port->to_modem, port->port_num); info = (struct timestamp_info *)skb->cb; @@ -424,7 +424,7 @@ static void ghsic_data_start_rx(struct gdata_port *port) struct timestamp_info *info; unsigned int created; - pr_debug("%s: port:%p\n", __func__, port); + pr_debug("%s: port:%pK\n", __func__, port); if (!port) return; @@ -481,7 +481,7 @@ static void ghsic_data_start_io(struct gdata_port *port) struct usb_ep *ep_out, *ep_in; int ret; - pr_debug("%s: port:%p\n", __func__, port); + pr_debug("%s: port:%pK\n", __func__, port); if (!port) return; @@ -508,7 +508,7 @@ static void ghsic_data_start_io(struct gdata_port *port) spin_lock_irqsave(&port->tx_lock, flags); ep_in = port->in; spin_unlock_irqrestore(&port->tx_lock, flags); - pr_debug("%s: ep_in:%p\n", __func__, ep_in); + pr_debug("%s: ep_in:%pK\n", __func__, ep_in); if (!ep_in) { spin_lock_irqsave(&port->rx_lock, flags); @@ -543,7 +543,7 @@ static void ghsic_data_connect_w(struct work_struct *w) !test_bit(CH_READY, &port->bridge_sts)) return; - pr_debug("%s: port:%p\n", __func__, port); + pr_debug("%s: port:%pK\n", __func__, port); ret = data_bridge_open(&port->brdg); if (ret) { @@ -855,14 +855,14 @@ int ghsic_data_connect(void *gptr, int port_num) ret = usb_ep_enable(port->in); if (ret) { - pr_err("%s: usb_ep_enable failed eptype:IN ep:%p", + pr_err("%s: usb_ep_enable failed eptype:IN ep:%pK", __func__, port->in); goto fail; } if (port->out) { ret = usb_ep_enable(port->out); if (ret) { - pr_err("%s: usb_ep_enable failed eptype:OUT ep:%p", + pr_err("%s: usb_ep_enable failed eptype:OUT ep:%pK", __func__, port->out); usb_ep_disable(port->in); goto fail; @@ -939,7 +939,7 @@ static void dbg_timestamp(char *event, struct sk_buff * skb) write_lock_irqsave(&dbg_data.lck, flags); scnprintf(dbg_data.buf[dbg_data.idx], DBG_DATA_MSG, - "%p %u[%s] %u %u %u %u %u %u\n", + "%pK %u[%s] %u %u %u %u %u %u\n", skb, skb->len, event, info->created, info->rx_queued, info->rx_done, info->rx_done_sent, info->tx_queued, get_timestamp()); @@ -1013,7 +1013,7 @@ static ssize_t ghsic_data_read_stats(struct file *file, spin_lock_irqsave(&port->rx_lock, flags); temp += scnprintf(buf + temp, DEBUG_DATA_BUF_SIZE - temp, "\nName: %s\n" - "#PORT:%d port#: %p\n" + "#PORT:%d port#: %pK\n" "data_ch_open: %d\n" "data_ch_ready: %d\n" "\n******UL INFO*****\n\n" diff --git a/drivers/usb/gadget/u_data_hsuart.c b/drivers/usb/gadget/u_data_hsuart.c index a5c918281f256..f79978951577d 100644 --- a/drivers/usb/gadget/u_data_hsuart.c +++ b/drivers/usb/gadget/u_data_hsuart.c @@ -153,7 +153,7 @@ static int ghsuart_data_alloc_requests(struct usb_ep *ep, int i; struct usb_request *req; - pr_debug("%s: ep:%s head:%p num:%d cb:%p", __func__, + pr_debug("%s: ep:%s head:%pK num:%d cb:%pK", __func__, ep->name, head, num, cb); for (i = 0; i < num; i++) { @@ -244,7 +244,7 @@ static void ghsuart_data_write_tomdm(struct work_struct *w) } while ((skb = __skb_dequeue(&port->rx_skb_q))) { - pr_debug("%s: port:%p tom:%lu pno:%d\n", __func__, + pr_debug("%s: port:%pK tom:%lu pno:%d\n", __func__, port, port->to_modem, port->port_num); ret = msm_smux_write(port->ch_id, skb, skb->data, skb->len); @@ -345,7 +345,7 @@ static void ghsuart_data_start_rx(struct ghsuart_data_port *port) int ret; struct sk_buff *skb; - pr_debug("%s: port:%p\n", __func__, port); + pr_debug("%s: port:%pK\n", __func__, port); if (!port) return; @@ -398,7 +398,7 @@ static void ghsuart_data_start_io(struct ghsuart_data_port *port) struct usb_ep *ep; int ret; - pr_debug("%s: port:%p\n", __func__, port); + pr_debug("%s: port:%pK\n", __func__, port); if (!port) return; @@ -594,7 +594,7 @@ static void ghsuart_data_connect_w(struct work_struct *w) !test_bit(CH_READY, &port->channel_sts)) return; - pr_debug("%s: port:%p\n", __func__, port); + pr_debug("%s: port:%pK\n", __func__, port); if (test_bit(CH_OPENED, &port->channel_sts)) { ret = wait_for_completion_timeout( @@ -832,7 +832,7 @@ static int ghsuart_data_port_alloc(unsigned port_num, enum gadget_type gtype) platform_driver_register(pdrv); - pr_debug("%s: port:%p portno:%d\n", __func__, port, port_num); + pr_debug("%s: port:%pK portno:%d\n", __func__, port, port_num); return 0; } @@ -956,14 +956,14 @@ int ghsuart_data_connect(void *gptr, int port_num) ret = usb_ep_enable(port->in); if (ret) { - pr_err("%s: usb_ep_enable failed eptype:IN ep:%p", + pr_err("%s: usb_ep_enable failed eptype:IN ep:%pK", __func__, port->in); goto fail; } ret = usb_ep_enable(port->out); if (ret) { - pr_err("%s: usb_ep_enable failed eptype:OUT ep:%p", + pr_err("%s: usb_ep_enable failed eptype:OUT ep:%pK", __func__, port->out); usb_ep_disable(port->in); goto fail; @@ -1010,7 +1010,7 @@ static ssize_t ghsuart_data_read_stats(struct file *file, spin_lock_irqsave(&port->rx_lock, flags); temp += scnprintf(buf + temp, DEBUG_BUF_SIZE - temp, "\nName: %s\n" - "#PORT:%d port#: %p\n" + "#PORT:%d port#: %pK\n" "data_ch_open: %d\n" "data_ch_ready: %d\n" "data_ch_connected: %d\n" diff --git a/drivers/usb/gadget/u_data_ipa.c b/drivers/usb/gadget/u_data_ipa.c index 103d552a07471..89b3f69ab4a65 100644 --- a/drivers/usb/gadget/u_data_ipa.c +++ b/drivers/usb/gadget/u_data_ipa.c @@ -186,7 +186,7 @@ void ipa_data_disconnect(struct gadget_ipa_port *gp, u8 port_num) unsigned long flags; struct usb_gadget *gadget = NULL; - pr_debug("dev:%p port number:%d\n", gp, port_num); + pr_debug("dev:%pK port number:%d\n", gp, port_num); if (port_num >= n_ipa_ports) { pr_err("invalid ipa portno#%d\n", port_num); return; @@ -429,7 +429,7 @@ static void ipa_data_connect_work(struct work_struct *w) if (gport->in) ipa_data_start_endless_xfer(port, true); - pr_debug("Connect workqueue done (port %p)", port); + pr_debug("Connect workqueue done (port %pK)", port); return; disconnect_usb_bam_ipa_in: @@ -474,7 +474,7 @@ int ipa_data_connect(struct gadget_ipa_port *gp, u8 port_num, unsigned long flags; int ret; - pr_debug("dev:%p port#%d src_connection_idx:%d dst_connection_idx:%d\n", + pr_debug("dev:%pK port#%d src_connection_idx:%d dst_connection_idx:%d\n", gp, port_num, src_connection_idx, dst_connection_idx); if (port_num >= n_ipa_ports) { @@ -511,7 +511,7 @@ int ipa_data_connect(struct gadget_ipa_port *gp, u8 port_num, port->port_usb->in->endless = true; ret = usb_ep_enable(port->port_usb->in); if (ret) { - pr_err("usb_ep_enable failed eptype:IN ep:%p", + pr_err("usb_ep_enable failed eptype:IN ep:%pK", port->port_usb->in); port->port_usb->in->endless = false; goto err_usb_in; @@ -522,7 +522,7 @@ int ipa_data_connect(struct gadget_ipa_port *gp, u8 port_num, port->port_usb->out->endless = true; ret = usb_ep_enable(port->port_usb->out); if (ret) { - pr_err("usb_ep_enable failed eptype:OUT ep:%p", + pr_err("usb_ep_enable failed eptype:OUT ep:%pK", port->port_usb->out); port->port_usb->out->endless = false; goto err_usb_out; @@ -635,7 +635,7 @@ void ipa_data_suspend(struct gadget_ipa_port *gp, u8 port_num) struct ipa_data_ch_info *port; int ret; - pr_debug("dev:%p port number:%d\n", gp, port_num); + pr_debug("dev:%pK port number:%d\n", gp, port_num); if (port_num >= n_ipa_ports) { pr_err("invalid ipa portno#%d\n", port_num); @@ -682,7 +682,7 @@ void ipa_data_resume(struct gadget_ipa_port *gp, u8 port_num) struct usb_gadget *gadget = NULL; int ret; - pr_debug("dev:%p port number:%d\n", gp, port_num); + pr_debug("dev:%pK port number:%d\n", gp, port_num); if (port_num >= n_ipa_ports) { pr_err("invalid ipa portno#%d\n", port_num); @@ -755,7 +755,7 @@ static int ipa_data_port_alloc(int portno) ipa_data_ports[portno] = port; - pr_debug("port:%p with portno:%d allocated\n", port, portno); + pr_debug("port:%pK with portno:%d allocated\n", port, portno); return 0; } diff --git a/drivers/usb/gadget/u_rmnet_ctrl_smd.c b/drivers/usb/gadget/u_rmnet_ctrl_smd.c index 1fa27b0ed522b..b667eb416a2b1 100644 --- a/drivers/usb/gadget/u_rmnet_ctrl_smd.c +++ b/drivers/usb/gadget/u_rmnet_ctrl_smd.c @@ -142,7 +142,7 @@ static void grmnet_ctrl_smd_read_w(struct work_struct *w) (c->ch == 0))); if (read_avail < 0 || c->ch == 0) { - pr_err("%s:smd read_avail failure:%d or channel closed ch=%p", + pr_err("%s:smd read_avail failure:%d or channel closed ch=%pK", __func__, read_avail, c->ch); kfree(buf); return; @@ -435,7 +435,7 @@ int gsmd_ctrl_connect(struct grmnet *gr, int port_num) struct smd_ch_info *c; unsigned long flags; - pr_debug("%s: grmnet:%p port#%d\n", __func__, gr, port_num); + pr_debug("%s: grmnet:%pK port#%d\n", __func__, gr, port_num); if (!is_legal_port_num(port_num)) { pr_err("%s: Invalid port_num#%d\n", __func__, port_num); @@ -491,7 +491,7 @@ void gsmd_ctrl_disconnect(struct grmnet *gr, u8 port_num) struct rmnet_ctrl_pkt *cpkt; int clear_bits; - pr_debug("%s: grmnet:%p port#%d\n", __func__, gr, port_num); + pr_debug("%s: grmnet:%pK port#%d\n", __func__, gr, port_num); if (!is_legal_port_num(port_num)) { pr_err("%s: Invalid port_num#%d\n", __func__, port_num); @@ -646,7 +646,7 @@ static int grmnet_ctrl_smd_port_alloc(int portno) pdrv->driver.name = c->name; pdrv->driver.owner = THIS_MODULE; - pr_debug("%s: port:%p portno:%d\n", __func__, port, portno); + pr_debug("%s: port:%pK portno:%d\n", __func__, port, portno); return 0; } @@ -735,7 +735,7 @@ static ssize_t gsmd_ctrl_read_stats(struct file *file, char __user *ubuf, c = &port->ctrl_ch; temp += scnprintf(buf + temp, DEBUG_BUF_SIZE - temp, - "#PORT:%d port:%p ctrl_ch:%p#\n" + "#PORT:%d port:%pK ctrl_ch:%pK#\n" "to_usbhost: %lu\n" "to_modem: %lu\n" "DTR: %s\n" diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c index c4289a13a181b..7b352b58a85b1 100644 --- a/drivers/usb/gadget/u_serial.c +++ b/drivers/usb/gadget/u_serial.c @@ -870,7 +870,7 @@ static int gs_open(struct tty_struct *tty, struct file *file) spin_lock_irq(&port->port_lock); if (status) { - pr_debug("gs_open: ttyGS%d (%p,%p) no buffer\n", + pr_debug("gs_open: ttyGS%d (%pK,%pK) no buffer\n", port->port_num, tty, file); port->openclose = false; goto exit_unlock_port; @@ -905,7 +905,7 @@ static int gs_open(struct tty_struct *tty, struct file *file) gser->connect(gser); } - pr_debug("gs_open: ttyGS%d (%p,%p)\n", port->port_num, tty, file); + pr_debug("gs_open: ttyGS%d (%pK,%pK)\n", port->port_num, tty, file); status = 0; @@ -941,7 +941,7 @@ static void gs_close(struct tty_struct *tty, struct file *file) goto exit; } - pr_debug("gs_close: ttyGS%d (%p,%p) ...\n", port->port_num, tty, file); + pr_debug("gs_close: ttyGS%d (%pK,%pK) ...\n", port->port_num, tty, file); /* mark port as closing but in use; we can drop port lock * and sleep if necessary @@ -979,7 +979,7 @@ static void gs_close(struct tty_struct *tty, struct file *file) port->openclose = false; - pr_debug("gs_close: ttyGS%d (%p,%p) done!\n", + pr_debug("gs_close: ttyGS%d (%pK,%pK) done!\n", port->port_num, tty, file); wake_up(&port->port.close_wait); @@ -995,7 +995,7 @@ static int gs_write(struct tty_struct *tty, const unsigned char *buf, int count) if (!port) return 0; - pr_vdebug("gs_write: ttyGS%d (%p) writing %d bytes\n", + pr_vdebug("gs_write: ttyGS%d (%pK) writing %d bytes\n", port->port_num, tty, count); spin_lock_irqsave(&port->port_lock, flags); @@ -1017,7 +1017,7 @@ static int gs_put_char(struct tty_struct *tty, unsigned char ch) if (!port) return 0; - pr_vdebug("gs_put_char: (%d,%p) char=0x%x, called from %pf\n", + pr_vdebug("gs_put_char: (%d,%pK) char=0x%x, called from %pKf\n", port->port_num, tty, ch, __builtin_return_address(0)); spin_lock_irqsave(&port->port_lock, flags); @@ -1034,7 +1034,7 @@ static void gs_flush_chars(struct tty_struct *tty) if (!port) return; - pr_vdebug("gs_flush_chars: (%d,%p)\n", port->port_num, tty); + pr_vdebug("gs_flush_chars: (%d,%pK)\n", port->port_num, tty); spin_lock_irqsave(&port->port_lock, flags); if (port->port_usb) @@ -1055,7 +1055,7 @@ static int gs_write_room(struct tty_struct *tty) room = gs_buf_space_avail(&port->port_write_buf); spin_unlock_irqrestore(&port->port_lock, flags); - pr_vdebug("gs_write_room: (%d,%p) room=%d\n", + pr_vdebug("gs_write_room: (%d,%pK) room=%d\n", port->port_num, tty, room); return room; @@ -1073,7 +1073,7 @@ static int gs_chars_in_buffer(struct tty_struct *tty) chars = gs_buf_data_avail(&port->port_write_buf); spin_unlock_irqrestore(&port->port_lock, flags); - pr_vdebug("gs_chars_in_buffer: (%d,%p) chars=%d\n", + pr_vdebug("gs_chars_in_buffer: (%d,%pK) chars=%d\n", port->port_num, tty, chars); return chars; diff --git a/drivers/usb/gadget/u_smd.c b/drivers/usb/gadget/u_smd.c index 708d93bfe4669..b737ef4800dad 100644 --- a/drivers/usb/gadget/u_smd.c +++ b/drivers/usb/gadget/u_smd.c @@ -147,7 +147,7 @@ static int gsmd_alloc_requests(struct usb_ep *ep, struct list_head *head, int i; struct usb_request *req; - pr_debug("%s: ep:%p head:%p num:%d size:%d cb:%p", __func__, + pr_debug("%s: ep:%pK head:%pK num:%d size:%d cb:%pK", __func__, ep, head, num, size, cb); for (i = 0; i < num; i++) { @@ -197,7 +197,7 @@ static void gsmd_start_rx(struct gsmd_port *port) spin_lock_irqsave(&port->port_lock, flags); if (ret) { pr_err("%s: usb ep out queue failed" - "port:%p, port#%d\n", + "port:%pK, port#%d\n", __func__, port, port->port_num); list_add_tail(&req->list, pool); break; @@ -213,7 +213,7 @@ static void gsmd_rx_push(struct work_struct *w) struct smd_port_info *pi = port->pi; struct list_head *q; - pr_debug("%s: port:%p port#%d", __func__, port, port->port_num); + pr_debug("%s: port:%pK port#%d", __func__, port, port->port_num); spin_lock_irq(&port->port_lock); @@ -226,11 +226,11 @@ static void gsmd_rx_push(struct work_struct *w) switch (req->status) { case -ESHUTDOWN: - pr_debug("%s: req status shutdown portno#%d port:%p\n", + pr_debug("%s: req status shutdown portno#%d port:%pK\n", __func__, port->port_num, port); goto rx_push_end; default: - pr_warning("%s: port:%p port#%d" + pr_warning("%s: port:%pK port#%d" " Unexpected Rx Status:%d\n", __func__, port, port->port_num, req->status); case 0: @@ -300,7 +300,7 @@ static void gsmd_tx_pull(struct work_struct *w) struct smd_port_info *pi = port->pi; struct usb_ep *in; - pr_debug("%s: port:%p port#%d pool:%p\n", __func__, + pr_debug("%s: port:%pK port#%d pool:%pK\n", __func__, port, port->port_num, pool); spin_lock_irq(&port->port_lock); @@ -334,7 +334,7 @@ static void gsmd_tx_pull(struct work_struct *w) spin_lock_irq(&port->port_lock); if (ret) { pr_err("%s: usb ep out queue failed" - "port:%p, port#%d err:%d\n", + "port:%pK, port#%d err:%d\n", __func__, port, port->port_num, ret); /* could be usb disconnected */ if (!port->port_usb) @@ -361,7 +361,7 @@ static void gsmd_read_complete(struct usb_ep *ep, struct usb_request *req) { struct gsmd_port *port = ep->driver_data; - pr_debug("%s: ep:%p port:%p\n", __func__, ep, port); + pr_debug("%s: ep:%pK port:%pK\n", __func__, ep, port); if (!port) { pr_err("%s: port is null\n", __func__); @@ -387,7 +387,7 @@ static void gsmd_write_complete(struct usb_ep *ep, struct usb_request *req) { struct gsmd_port *port = ep->driver_data; - pr_debug("%s: ep:%p port:%p\n", __func__, ep, port); + pr_debug("%s: ep:%pK port:%pK\n", __func__, ep, port); if (!port) { pr_err("%s: port is null\n", __func__); @@ -403,7 +403,7 @@ static void gsmd_write_complete(struct usb_ep *ep, struct usb_request *req) } if (req->status) - pr_warning("%s: port:%p port#%d unexpected %s status %d\n", + pr_warning("%s: port:%pK port#%d unexpected %s status %d\n", __func__, port, port->port_num, ep->name, req->status); @@ -418,7 +418,7 @@ static void gsmd_start_io(struct gsmd_port *port) { int ret = -ENODEV; - pr_debug("%s: port: %p\n", __func__, port); + pr_debug("%s: port: %pK\n", __func__, port); spin_lock(&port->port_lock); @@ -570,7 +570,7 @@ static void gsmd_connect_work(struct work_struct *w) port = container_of(w, struct gsmd_port, connect_work.work); pi = port->pi; - pr_debug("%s: port:%p port#%d\n", __func__, port, port->port_num); + pr_debug("%s: port:%pK port#%d\n", __func__, port, port->port_num); if (!test_bit(CH_READY, &pi->flags)) return; @@ -599,7 +599,7 @@ static void gsmd_disconnect_work(struct work_struct *w) port = container_of(w, struct gsmd_port, disconnect_work); pi = port->pi; - pr_debug("%s: port:%p port#%d\n", __func__, port, port->port_num); + pr_debug("%s: port:%pK port#%d\n", __func__, port, port->port_num); smd_close(port->pi->ch); port->pi->ch = NULL; @@ -667,7 +667,7 @@ int gsmd_connect(struct gserial *gser, u8 portno) int ret; struct gsmd_port *port; - pr_debug("%s: gserial:%p portno:%u\n", __func__, gser, portno); + pr_debug("%s: gserial:%pK portno:%u\n", __func__, gser, portno); if (portno >= n_smd_ports) { pr_err("%s: Invalid port no#%d", __func__, portno); @@ -690,7 +690,7 @@ int gsmd_connect(struct gserial *gser, u8 portno) ret = usb_ep_enable(gser->in); if (ret) { - pr_err("%s: usb_ep_enable failed eptype:IN ep:%p, err:%d", + pr_err("%s: usb_ep_enable failed eptype:IN ep:%pK, err:%d", __func__, gser->in, ret); port->port_usb = 0; return ret; @@ -699,7 +699,7 @@ int gsmd_connect(struct gserial *gser, u8 portno) ret = usb_ep_enable(gser->out); if (ret) { - pr_err("%s: usb_ep_enable failed eptype:OUT ep:%p, err: %d", + pr_err("%s: usb_ep_enable failed eptype:OUT ep:%pK, err: %d", __func__, gser->out, ret); port->port_usb = 0; gser->in->driver_data = 0; @@ -717,7 +717,7 @@ void gsmd_disconnect(struct gserial *gser, u8 portno) unsigned long flags; struct gsmd_port *port; - pr_debug("%s: gserial:%p portno:%u\n", __func__, gser, portno); + pr_debug("%s: gserial:%pK portno:%u\n", __func__, gser, portno); if (portno >= n_smd_ports) { pr_err("%s: invalid portno#%d\n", __func__, portno); @@ -854,7 +854,7 @@ static int gsmd_port_alloc(int portno, struct usb_cdc_line_coding *coding) pdrv->driver.owner = THIS_MODULE; platform_driver_register(pdrv); - pr_debug("%s: port:%p portno:%d\n", __func__, port, portno); + pr_debug("%s: port:%pK portno:%d\n", __func__, port, portno); return 0; } @@ -958,10 +958,10 @@ int gsmd_setup(struct usb_gadget *g, unsigned count) int ret; int i; - pr_debug("%s: g:%p count: %d\n", __func__, g, count); + pr_debug("%s: g:%pK count: %d\n", __func__, g, count); if (!count || count > SMD_N_PORTS) { - pr_err("%s: Invalid num of ports count:%d gadget:%p\n", + pr_err("%s: Invalid num of ports count:%d gadget:%pK\n", __func__, count, g); return -EINVAL; } diff --git a/drivers/usb/host/ehci-dbg.c b/drivers/usb/host/ehci-dbg.c index 5429d2645bbc9..dc1c35b5a4f71 100644 --- a/drivers/usb/host/ehci-dbg.c +++ b/drivers/usb/host/ehci-dbg.c @@ -106,7 +106,7 @@ static inline void dbg_hcc_params (struct ehci_hcd *ehci, char *label) {} static void __maybe_unused dbg_qtd (const char *label, struct ehci_hcd *ehci, struct ehci_qtd *qtd) { - ehci_dbg(ehci, "%s td %p n%08x %08x t%08x p0=%08x\n", label, qtd, + ehci_dbg(ehci, "%s td %pK n%08x %08x t%08x p0=%08x\n", label, qtd, hc32_to_cpup(ehci, &qtd->hw_next), hc32_to_cpup(ehci, &qtd->hw_alt_next), hc32_to_cpup(ehci, &qtd->hw_token), @@ -124,7 +124,7 @@ dbg_qh (const char *label, struct ehci_hcd *ehci, struct ehci_qh *qh) { struct ehci_qh_hw *hw = qh->hw; - ehci_dbg (ehci, "%s qh %p n%08x info %x %x qtd %x\n", label, + ehci_dbg (ehci, "%s qh %pK n%08x info %x %x qtd %x\n", label, qh, hw->hw_next, hw->hw_info1, hw->hw_info2, hw->hw_current); dbg_qtd("overlay", ehci, (struct ehci_qtd *) &hw->hw_qtd_next); } @@ -132,7 +132,7 @@ dbg_qh (const char *label, struct ehci_hcd *ehci, struct ehci_qh *qh) static void __maybe_unused dbg_itd (const char *label, struct ehci_hcd *ehci, struct ehci_itd *itd) { - ehci_dbg (ehci, "%s [%d] itd %p, next %08x, urb %p\n", + ehci_dbg (ehci, "%s [%d] itd %pK, next %08x, urb %pK\n", label, itd->frame, itd, hc32_to_cpu(ehci, itd->hw_next), itd->urb); ehci_dbg (ehci, @@ -163,7 +163,7 @@ dbg_itd (const char *label, struct ehci_hcd *ehci, struct ehci_itd *itd) static void __maybe_unused dbg_sitd (const char *label, struct ehci_hcd *ehci, struct ehci_sitd *sitd) { - ehci_dbg (ehci, "%s [%d] sitd %p, next %08x, urb %p\n", + ehci_dbg (ehci, "%s [%d] sitd %pK, next %08x, urb %pK\n", label, sitd->frame, sitd, hc32_to_cpu(ehci, sitd->hw_next), sitd->urb); ehci_dbg (ehci, @@ -429,7 +429,7 @@ static void qh_lines ( scratch = hc32_to_cpup(ehci, &hw->hw_info1); hw_curr = (mark == '*') ? hc32_to_cpup(ehci, &hw->hw_current) : 0; temp = scnprintf (next, size, - "qh/%p dev%d %cs ep%d %08x %08x (%08x%c %s nak%d)", + "qh/%pK dev%d %cs ep%d %08x %08x (%08x%c %s nak%d)", qh, scratch & 0x007f, speed_char (scratch), (scratch >> 8) & 0x000f, @@ -457,7 +457,7 @@ static void qh_lines ( mark = '/'; } temp = snprintf (next, size, - "\n\t%p%c%s len=%d %08x urb %p", + "\n\t%pK%c%s len=%d %08x urb %pK", td, mark, ({ char *tmp; switch ((scratch>>8)&0x03) { case 0: tmp = "out"; break; @@ -571,7 +571,7 @@ static ssize_t fill_periodic_buffer(struct debug_buffer *buf) switch (hc32_to_cpu(ehci, tag)) { case Q_TYPE_QH: hw = p.qh->hw; - temp = scnprintf (next, size, " qh%d-%04x/%p", + temp = scnprintf (next, size, " qh%d-%04x/%pK", p.qh->period, hc32_to_cpup(ehci, &hw->hw_info2) @@ -632,20 +632,20 @@ static ssize_t fill_periodic_buffer(struct debug_buffer *buf) break; case Q_TYPE_FSTN: temp = scnprintf (next, size, - " fstn-%8x/%p", p.fstn->hw_prev, + " fstn-%8x/%pK", p.fstn->hw_prev, p.fstn); tag = Q_NEXT_TYPE(ehci, p.fstn->hw_next); p = p.fstn->fstn_next; break; case Q_TYPE_ITD: temp = scnprintf (next, size, - " itd/%p", p.itd); + " itd/%pK", p.itd); tag = Q_NEXT_TYPE(ehci, p.itd->hw_next); p = p.itd->itd_next; break; case Q_TYPE_SITD: temp = scnprintf (next, size, - " sitd%d-%04x/%p", + " sitd%d-%04x/%pK", p.sitd->stream->interval, hc32_to_cpup(ehci, &p.sitd->hw_uframe) & 0x0000ffff, @@ -817,7 +817,7 @@ static ssize_t fill_registers_buffer(struct debug_buffer *buf) } if (!list_empty(&ehci->async_unlink)) { - temp = scnprintf(next, size, "async unlink qh %p\n", + temp = scnprintf(next, size, "async unlink qh %pK\n", list_first_entry(&ehci->async_unlink, struct ehci_qh, unlink_node)); size -= temp; diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c index bfcf38383f742..b68f3662894b2 100644 --- a/drivers/usb/host/ehci-fsl.c +++ b/drivers/usb/host/ehci-fsl.c @@ -144,7 +144,7 @@ static int usb_hcd_fsl_probe(const struct hc_driver *driver, struct ehci_hcd *ehci = hcd_to_ehci(hcd); hcd->phy = usb_get_phy(USB_PHY_TYPE_USB2); - dev_dbg(&pdev->dev, "hcd=0x%p ehci=0x%p, phy=0x%p\n", + dev_dbg(&pdev->dev, "hcd=0x%pK ehci=0x%pK, phy=0x%pK\n", hcd, ehci, hcd->phy); if (!IS_ERR_OR_NULL(hcd->phy)) { diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c index 8db0e169543b7..58adbed2d3ede 100644 --- a/drivers/usb/host/ehci-hcd.c +++ b/drivers/usb/host/ehci-hcd.c @@ -1015,7 +1015,7 @@ ehci_endpoint_disable (struct usb_hcd *hcd, struct usb_host_endpoint *ep) /* caller was supposed to have unlinked any requests; * that's not our job. just leak this memory. */ - ehci_err (ehci, "qh %p (#%02x) state %d%s\n", + ehci_err (ehci, "qh %pK (#%02x) state %d%s\n", qh, ep->desc.bEndpointAddress, qh->qh_state, list_empty (&qh->qtd_list) ? "" : "(has tds)"); break; diff --git a/drivers/usb/host/ehci-msm-hsic.c b/drivers/usb/host/ehci-msm-hsic.c index 88d430db7355a..15c78b43ef08d 100644 --- a/drivers/usb/host/ehci-msm-hsic.c +++ b/drivers/usb/host/ehci-msm-hsic.c @@ -274,7 +274,7 @@ static void dbg_log_event(struct urb *urb, char * event, unsigned extra) if (!str_to_event(event)) { write_lock_irqsave(&dbg_hsic_ctrl.lck, flags); scnprintf(dbg_hsic_ctrl.buf[dbg_hsic_ctrl.idx], - DBG_MSG_LEN, "%s: [%s : %p]:[%s] " + DBG_MSG_LEN, "%s: [%s : %pK]:[%s] " "%02x %02x %04x %04x %04x %u %d %s", get_timestamp(tbuf), event, urb, usb_urb_dir_in(urb) ? "in" : "out", @@ -294,7 +294,7 @@ static void dbg_log_event(struct urb *urb, char * event, unsigned extra) } else { write_lock_irqsave(&dbg_hsic_ctrl.lck, flags); scnprintf(dbg_hsic_ctrl.buf[dbg_hsic_ctrl.idx], - DBG_MSG_LEN, "%s: [%s : %p]:[%s] %u %d %s", + DBG_MSG_LEN, "%s: [%s : %pK]:[%s] %u %d %s", get_timestamp(tbuf), event, urb, usb_urb_dir_in(urb) ? "in" : "out", urb->actual_length, extra, @@ -307,7 +307,7 @@ static void dbg_log_event(struct urb *urb, char * event, unsigned extra) } else { write_lock_irqsave(&dbg_hsic_data.lck, flags); scnprintf(dbg_hsic_data.buf[dbg_hsic_data.idx], DBG_MSG_LEN, - "%s: [%s : %p]:ep%d[%s] %u %d %s", + "%s: [%s : %pK]:ep%d[%s] %u %d %s", get_timestamp(tbuf), event, urb, ep_addr & 0x0f, usb_urb_dir_in(urb) ? "in" : "out", str_to_event(event) ? urb->actual_length : @@ -339,7 +339,7 @@ static void dump_hsic_regs(struct usb_hcd *hcd) return; for (i = USB_REG_START_OFFSET; i <= USB_REG_END_OFFSET; i += 0x10) - pr_info("%p: %08x\t%08x\t%08x\t%08x\n", hcd->regs + i, + pr_info("%pK: %08x\t%08x\t%08x\t%08x\n", hcd->regs + i, readl_relaxed(hcd->regs + i), readl_relaxed(hcd->regs + i + 4), readl_relaxed(hcd->regs + i + 8), @@ -1704,7 +1704,7 @@ static irqreturn_t hsic_peripheral_status_change(int irq, void *dev_id) { struct msm_hsic_hcd *mehci = dev_id; - pr_debug("%s: mehci:%p dev_id:%p\n", __func__, mehci, dev_id); + pr_debug("%s: mehci:%pK dev_id:%pK\n", __func__, mehci, dev_id); if (mehci) msm_hsic_config_gpios(mehci, 0); diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c index 402062973f032..52e7113759efc 100644 --- a/drivers/usb/host/ehci-mv.c +++ b/drivers/usb/host/ehci-mv.c @@ -263,7 +263,7 @@ static int mv_ehci_probe(struct platform_device *pdev) pdata->private_init(ehci_mv->op_regs, ehci_mv->phy_regs); dev_info(&pdev->dev, - "successful find EHCI device with regs 0x%p irq %d" + "successful find EHCI device with regs 0x%pK irq %d" " working in %s mode\n", hcd->regs, hcd->irq, ehci_mv->mode == MV_USB_MODE_OTG ? "OTG" : "Host"); diff --git a/drivers/usb/host/ehci-ps3.c b/drivers/usb/host/ehci-ps3.c index fd983771b0255..ffb3c15f9b851 100644 --- a/drivers/usb/host/ehci-ps3.c +++ b/drivers/usb/host/ehci-ps3.c @@ -216,7 +216,7 @@ static int ps3_ehci_remove(struct ps3_system_bus_device *dev) BUG_ON(!hcd); - dev_dbg(&dev->core, "%s:%d: regs %p\n", __func__, __LINE__, hcd->regs); + dev_dbg(&dev->core, "%s:%d: regs %pK\n", __func__, __LINE__, hcd->regs); dev_dbg(&dev->core, "%s:%d: irq %u\n", __func__, __LINE__, hcd->irq); tmp = hcd->irq; diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c index ecf0a4c875697..a523915a00d23 100644 --- a/drivers/usb/host/ehci-q.c +++ b/drivers/usb/host/ehci-q.c @@ -273,7 +273,7 @@ __acquires(ehci->lock) #ifdef EHCI_URB_TRACE ehci_dbg (ehci, - "%s %s urb %p ep%d%s status %d len %d/%d\n", + "%s %s urb %pK ep%d%s status %d len %d/%d\n", __func__, urb->dev->devpath, urb, usb_pipeendpoint (urb->pipe), usb_pipein (urb->pipe) ? "in" : "out", @@ -362,7 +362,7 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh) /* Report Data Buffer Error: non-fatal but useful */ if (token & QTD_STS_DBE) ehci_dbg(ehci, - "detected DataBufferErr for urb %p ep%d%s len %d, qtd %p [qh %p]\n", + "detected DataBufferErr for urb %pK ep%d%s len %d, qtd %pK [qh %pK]\n", urb, usb_endpoint_num(&urb->ep->desc), usb_endpoint_dir_in(&urb->ep->desc) ? "in" : "out", @@ -920,7 +920,7 @@ qh_make ( } break; default: - ehci_dbg(ehci, "bogus dev %p speed %d\n", urb->dev, + ehci_dbg(ehci, "bogus dev %pK speed %d\n", urb->dev, urb->dev->speed); done: qh_destroy(ehci, qh); @@ -1108,7 +1108,7 @@ submit_async ( struct ehci_qtd *qtd; qtd = list_entry(qtd_list->next, struct ehci_qtd, qtd_list); ehci_dbg(ehci, - "%s %s urb %p ep%d%s len %d, qtd %p [qh %p]\n", + "%s %s urb %pK ep%d%s len %d, qtd %pK [qh %pK]\n", __func__, urb->dev->devpath, urb, epnum & 0x0f, (epnum & USB_DIR_IN) ? "in" : "out", urb->transfer_buffer_length, diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c index 738d9ada620ba..32cea68fa71b8 100644 --- a/drivers/usb/host/ehci-sched.c +++ b/drivers/usb/host/ehci-sched.c @@ -492,7 +492,7 @@ static void qh_link_periodic(struct ehci_hcd *ehci, struct ehci_qh *qh) unsigned period = qh->period; dev_dbg (&qh->dev->dev, - "link qh%d-%04x/%p start %d [%d/%d us]\n", + "link qh%d-%04x/%pK start %d [%d/%d us]\n", period, hc32_to_cpup(ehci, &qh->hw->hw_info2) & (QH_CMASK | QH_SMASK), qh, qh->start, qh->usecs, qh->c_usecs); @@ -586,7 +586,7 @@ static void qh_unlink_periodic(struct ehci_hcd *ehci, struct ehci_qh *qh) : (qh->usecs * 8); dev_dbg (&qh->dev->dev, - "unlink qh%d-%04x/%p start %d [%d/%d us]\n", + "unlink qh%d-%04x/%pK start %d [%d/%d us]\n", qh->period, hc32_to_cpup(ehci, &qh->hw->hw_info2) & (QH_CMASK | QH_SMASK), qh, qh->start, qh->usecs, qh->c_usecs); @@ -658,7 +658,7 @@ static void end_unlink_intr(struct ehci_hcd *ehci, struct ehci_qh *qh) * FIXME kill the now-dysfunctional queued urbs */ else { - ehci_err(ehci, "can't reschedule qh %p, err %d\n", + ehci_err(ehci, "can't reschedule qh %pK, err %d\n", qh, rc); } } @@ -838,7 +838,7 @@ static int qh_schedule(struct ehci_hcd *ehci, struct ehci_qh *qh) : cpu_to_hc32(ehci, QH_SMASK); hw->hw_info2 |= c_mask; } else - ehci_dbg (ehci, "reused qh %p schedule\n", qh); + ehci_dbg (ehci, "reused qh %pK schedule\n", qh); done: return status; @@ -1385,7 +1385,7 @@ iso_stream_schedule ( /* Is the schedule already full? */ if (unlikely(start < period)) { - ehci_dbg(ehci, "iso sched full %p (%u-%u < %u mod %u)\n", + ehci_dbg(ehci, "iso sched full %pK (%u-%u < %u mod %u)\n", urb, stream->next_uframe, base, period, mod); status = -ENOSPC; @@ -1405,7 +1405,7 @@ iso_stream_schedule ( * no matter what. */ else if (start + span - period < now2) { - ehci_dbg(ehci, "iso underrun %p (%u+%u < %u)\n", + ehci_dbg(ehci, "iso underrun %pK (%u+%u < %u)\n", urb, start + base, span - period, now2 + base); } @@ -1451,7 +1451,7 @@ iso_stream_schedule ( /* no room in the schedule */ if (!done) { - ehci_dbg(ehci, "iso sched full %p", urb); + ehci_dbg(ehci, "iso sched full %pK", urb); status = -ENOSPC; goto fail; } @@ -1459,7 +1459,7 @@ iso_stream_schedule ( /* Tried to schedule too far into the future? */ if (unlikely(start - base + span - period >= mod)) { - ehci_dbg(ehci, "request %p would overflow (%u+%u >= %u)\n", + ehci_dbg(ehci, "request %pK would overflow (%u+%u >= %u)\n", urb, start - base, span - period, mod); status = -EFBIG; goto fail; @@ -1768,7 +1768,7 @@ static int itd_submit (struct ehci_hcd *ehci, struct urb *urb, #ifdef EHCI_URB_TRACE ehci_dbg (ehci, - "%s %s urb %p ep%d%s len %d, %d pkts %d uframes [%p]\n", + "%s %s urb %pK ep%d%s len %d, %d pkts %d uframes [%pK]\n", __func__, urb->dev->devpath, urb, usb_pipeendpoint (urb->pipe), usb_pipein (urb->pipe) ? "in" : "out", @@ -2156,7 +2156,7 @@ static int sitd_submit (struct ehci_hcd *ehci, struct urb *urb, #ifdef EHCI_URB_TRACE ehci_dbg (ehci, - "submit %p dev%s ep%d%s-iso len %d\n", + "submit %pK dev%s ep%d%s-iso len %d\n", urb, urb->dev->devpath, usb_pipeendpoint (urb->pipe), usb_pipein (urb->pipe) ? "in" : "out", @@ -2303,7 +2303,7 @@ static void scan_isoc(struct ehci_hcd *ehci) q = *q_p; break; default: - ehci_dbg(ehci, "corrupt type %d frame %d shadow %p\n", + ehci_dbg(ehci, "corrupt type %d frame %d shadow %pK\n", type, frame, q.ptr); // BUG (); /* FALL THROUGH */ diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c index 2f8c5362a77e2..74a332891f3df 100644 --- a/drivers/usb/host/xhci-dbg.c +++ b/drivers/usb/host/xhci-dbg.c @@ -31,10 +31,10 @@ void xhci_dbg_regs(struct xhci_hcd *xhci) { u32 temp; - xhci_dbg(xhci, "// xHCI capability registers at %p:\n", + xhci_dbg(xhci, "// xHCI capability registers at %pK:\n", xhci->cap_regs); temp = xhci_readl(xhci, &xhci->cap_regs->hc_capbase); - xhci_dbg(xhci, "// @%p = 0x%x (CAPLENGTH AND HCIVERSION)\n", + xhci_dbg(xhci, "// @%pK = 0x%x (CAPLENGTH AND HCIVERSION)\n", &xhci->cap_regs->hc_capbase, temp); xhci_dbg(xhci, "// CAPLENGTH: 0x%x\n", (unsigned int) HC_LENGTH(temp)); @@ -43,24 +43,24 @@ void xhci_dbg_regs(struct xhci_hcd *xhci) (unsigned int) HC_VERSION(temp)); #endif - xhci_dbg(xhci, "// xHCI operational registers at %p:\n", xhci->op_regs); + xhci_dbg(xhci, "// xHCI operational registers at %pK:\n", xhci->op_regs); temp = xhci_readl(xhci, &xhci->cap_regs->run_regs_off); - xhci_dbg(xhci, "// @%p = 0x%x RTSOFF\n", + xhci_dbg(xhci, "// @%pK = 0x%x RTSOFF\n", &xhci->cap_regs->run_regs_off, (unsigned int) temp & RTSOFF_MASK); - xhci_dbg(xhci, "// xHCI runtime registers at %p:\n", xhci->run_regs); + xhci_dbg(xhci, "// xHCI runtime registers at %pK:\n", xhci->run_regs); temp = xhci_readl(xhci, &xhci->cap_regs->db_off); - xhci_dbg(xhci, "// @%p = 0x%x DBOFF\n", &xhci->cap_regs->db_off, temp); - xhci_dbg(xhci, "// Doorbell array at %p:\n", xhci->dba); + xhci_dbg(xhci, "// @%pK = 0x%x DBOFF\n", &xhci->cap_regs->db_off, temp); + xhci_dbg(xhci, "// Doorbell array at %pK:\n", xhci->dba); } static void xhci_print_cap_regs(struct xhci_hcd *xhci) { u32 temp; - xhci_dbg(xhci, "xHCI capability registers at %p:\n", xhci->cap_regs); + xhci_dbg(xhci, "xHCI capability registers at %pK:\n", xhci->cap_regs); temp = xhci_readl(xhci, &xhci->cap_regs->hc_capbase); xhci_dbg(xhci, "CAPLENGTH AND HCIVERSION 0x%x:\n", @@ -141,7 +141,7 @@ static void xhci_print_status(struct xhci_hcd *xhci) static void xhci_print_op_regs(struct xhci_hcd *xhci) { - xhci_dbg(xhci, "xHCI operational registers at %p:\n", xhci->op_regs); + xhci_dbg(xhci, "xHCI operational registers at %pK:\n", xhci->op_regs); xhci_print_command_reg(xhci); xhci_print_status(xhci); } @@ -162,7 +162,7 @@ static void xhci_print_ports(struct xhci_hcd *xhci) addr = &xhci->op_regs->port_status_base; for (i = 0; i < ports; i++) { for (j = 0; j < NUM_PORT_REGS; ++j) { - xhci_dbg(xhci, "%p port %s reg = 0x%x\n", + xhci_dbg(xhci, "%pK port %s reg = 0x%x\n", addr, names[j], (unsigned int) xhci_readl(xhci, addr)); addr++; @@ -182,35 +182,35 @@ void xhci_print_ir_set(struct xhci_hcd *xhci, int set_num) if (temp == XHCI_INIT_VALUE) return; - xhci_dbg(xhci, " %p: ir_set[%i]\n", ir_set, set_num); + xhci_dbg(xhci, " %pK: ir_set[%i]\n", ir_set, set_num); - xhci_dbg(xhci, " %p: ir_set.pending = 0x%x\n", addr, + xhci_dbg(xhci, " %pK: ir_set.pending = 0x%x\n", addr, (unsigned int)temp); addr = &ir_set->irq_control; temp = xhci_readl(xhci, addr); - xhci_dbg(xhci, " %p: ir_set.control = 0x%x\n", addr, + xhci_dbg(xhci, " %pK: ir_set.control = 0x%x\n", addr, (unsigned int)temp); addr = &ir_set->erst_size; temp = xhci_readl(xhci, addr); - xhci_dbg(xhci, " %p: ir_set.erst_size = 0x%x\n", addr, + xhci_dbg(xhci, " %pK: ir_set.erst_size = 0x%x\n", addr, (unsigned int)temp); addr = &ir_set->rsvd; temp = xhci_readl(xhci, addr); if (temp != XHCI_INIT_VALUE) - xhci_dbg(xhci, " WARN: %p: ir_set.rsvd = 0x%x\n", + xhci_dbg(xhci, " WARN: %pK: ir_set.rsvd = 0x%x\n", addr, (unsigned int)temp); addr = &ir_set->erst_base; temp_64 = xhci_read_64(xhci, addr); - xhci_dbg(xhci, " %p: ir_set.erst_base = @%08llx\n", + xhci_dbg(xhci, " %pK: ir_set.erst_base = @%08llx\n", addr, temp_64); addr = &ir_set->erst_dequeue; temp_64 = xhci_read_64(xhci, addr); - xhci_dbg(xhci, " %p: ir_set.erst_dequeue = @%08llx\n", + xhci_dbg(xhci, " %pK: ir_set.erst_dequeue = @%08llx\n", addr, temp_64); } @@ -219,15 +219,15 @@ void xhci_print_run_regs(struct xhci_hcd *xhci) u32 temp; int i; - xhci_dbg(xhci, "xHCI runtime registers at %p:\n", xhci->run_regs); + xhci_dbg(xhci, "xHCI runtime registers at %pK:\n", xhci->run_regs); temp = xhci_readl(xhci, &xhci->run_regs->microframe_index); - xhci_dbg(xhci, " %p: Microframe index = 0x%x\n", + xhci_dbg(xhci, " %pK: Microframe index = 0x%x\n", &xhci->run_regs->microframe_index, (unsigned int) temp); for (i = 0; i < 7; ++i) { temp = xhci_readl(xhci, &xhci->run_regs->rsvd[i]); if (temp != XHCI_INIT_VALUE) - xhci_dbg(xhci, " WARN: %p: Rsvd[%i] = 0x%x\n", + xhci_dbg(xhci, " WARN: %pK: Rsvd[%i] = 0x%x\n", &xhci->run_regs->rsvd[i], i, (unsigned int) temp); } @@ -329,13 +329,13 @@ void xhci_debug_segment(struct xhci_hcd *xhci, struct xhci_segment *seg) void xhci_dbg_ring_ptrs(struct xhci_hcd *xhci, struct xhci_ring *ring) { - xhci_dbg(xhci, "Ring deq = %p (virt), 0x%llx (dma)\n", + xhci_dbg(xhci, "Ring deq = %pK (virt), 0x%llx (dma)\n", ring->dequeue, (unsigned long long)xhci_trb_virt_to_dma(ring->deq_seg, ring->dequeue)); xhci_dbg(xhci, "Ring deq updated %u times\n", ring->deq_updates); - xhci_dbg(xhci, "Ring enq = %p (virt), 0x%llx (dma)\n", + xhci_dbg(xhci, "Ring enq = %pK (virt), 0x%llx (dma)\n", ring->enqueue, (unsigned long long)xhci_trb_virt_to_dma(ring->enq_seg, ring->enqueue)); @@ -425,7 +425,7 @@ static void dbg_rsvd64(struct xhci_hcd *xhci, u64 *ctx, dma_addr_t dma) { int i; for (i = 0; i < 4; ++i) { - xhci_dbg(xhci, "@%p (virt) @%08llx " + xhci_dbg(xhci, "@%pK (virt) @%08llx " "(dma) %#08llx - rsvd64[%d]\n", &ctx[4 + i], (unsigned long long)dma, ctx[4 + i], i); @@ -464,24 +464,24 @@ static void xhci_dbg_slot_ctx(struct xhci_hcd *xhci, struct xhci_container_ctx * int csz = HCC_64BYTE_CONTEXT(xhci->hcc_params); xhci_dbg(xhci, "Slot Context:\n"); - xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - dev_info\n", + xhci_dbg(xhci, "@%pK (virt) @%08llx (dma) %#08x - dev_info\n", &slot_ctx->dev_info, (unsigned long long)dma, slot_ctx->dev_info); dma += field_size; - xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - dev_info2\n", + xhci_dbg(xhci, "@%pK (virt) @%08llx (dma) %#08x - dev_info2\n", &slot_ctx->dev_info2, (unsigned long long)dma, slot_ctx->dev_info2); dma += field_size; - xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - tt_info\n", + xhci_dbg(xhci, "@%pK (virt) @%08llx (dma) %#08x - tt_info\n", &slot_ctx->tt_info, (unsigned long long)dma, slot_ctx->tt_info); dma += field_size; - xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - dev_state\n", + xhci_dbg(xhci, "@%pK (virt) @%08llx (dma) %#08x - dev_state\n", &slot_ctx->dev_state, (unsigned long long)dma, slot_ctx->dev_state); dma += field_size; for (i = 0; i < 4; ++i) { - xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - rsvd[%d]\n", + xhci_dbg(xhci, "@%pK (virt) @%08llx (dma) %#08x - rsvd[%d]\n", &slot_ctx->reserved[i], (unsigned long long)dma, slot_ctx->reserved[i], i); dma += field_size; @@ -509,24 +509,24 @@ static void xhci_dbg_ep_ctx(struct xhci_hcd *xhci, ((unsigned long)ep_ctx - (unsigned long)ctx->bytes); xhci_dbg(xhci, "Endpoint %02d Context:\n", i); - xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - ep_info\n", + xhci_dbg(xhci, "@%pK (virt) @%08llx (dma) %#08x - ep_info\n", &ep_ctx->ep_info, (unsigned long long)dma, ep_ctx->ep_info); dma += field_size; - xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - ep_info2\n", + xhci_dbg(xhci, "@%pK (virt) @%08llx (dma) %#08x - ep_info2\n", &ep_ctx->ep_info2, (unsigned long long)dma, ep_ctx->ep_info2); dma += field_size; - xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08llx - deq\n", + xhci_dbg(xhci, "@%pK (virt) @%08llx (dma) %#08llx - deq\n", &ep_ctx->deq, (unsigned long long)dma, ep_ctx->deq); dma += 2*field_size; - xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - tx_info\n", + xhci_dbg(xhci, "@%pK (virt) @%08llx (dma) %#08x - tx_info\n", &ep_ctx->tx_info, (unsigned long long)dma, ep_ctx->tx_info); dma += field_size; for (j = 0; j < 3; ++j) { - xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - rsvd[%d]\n", + xhci_dbg(xhci, "@%pK (virt) @%08llx (dma) %#08x - rsvd[%d]\n", &ep_ctx->reserved[j], (unsigned long long)dma, ep_ctx->reserved[j], j); @@ -551,16 +551,16 @@ void xhci_dbg_ctx(struct xhci_hcd *xhci, if (ctx->type == XHCI_CTX_TYPE_INPUT) { struct xhci_input_control_ctx *ctrl_ctx = xhci_get_input_control_ctx(xhci, ctx); - xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - drop flags\n", + xhci_dbg(xhci, "@%pK (virt) @%08llx (dma) %#08x - drop flags\n", &ctrl_ctx->drop_flags, (unsigned long long)dma, ctrl_ctx->drop_flags); dma += field_size; - xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - add flags\n", + xhci_dbg(xhci, "@%pK (virt) @%08llx (dma) %#08x - add flags\n", &ctrl_ctx->add_flags, (unsigned long long)dma, ctrl_ctx->add_flags); dma += field_size; for (i = 0; i < 6; ++i) { - xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - rsvd2[%d]\n", + xhci_dbg(xhci, "@%pK (virt) @%08llx (dma) %#08x - rsvd2[%d]\n", &ctrl_ctx->rsvd2[i], (unsigned long long)dma, ctrl_ctx->rsvd2[i], i); dma += field_size; @@ -682,7 +682,7 @@ xhci_dbg_log_event(struct dbg_data *d, struct urb *urb, char *event, if (!xhci_str_to_event(event)) { write_lock_irqsave(&d->ctrl_lck, flags); scnprintf(d->ctrl_buf[d->ctrl_idx], - DBG_MSG_LEN, "%s: [%s : %p]:[%s] " + DBG_MSG_LEN, "%s: [%s : %pK]:[%s] " "%02x %02x %04x %04x %04x %u %d %s", get_timestamp(tbuf), event, urb, usb_urb_dir_in(urb) ? "in" : "out", @@ -702,7 +702,7 @@ xhci_dbg_log_event(struct dbg_data *d, struct urb *urb, char *event, } else { write_lock_irqsave(&d->ctrl_lck, flags); scnprintf(d->ctrl_buf[d->ctrl_idx], - DBG_MSG_LEN, "%s: [%s : %p]:[%s] %u %d %s", + DBG_MSG_LEN, "%s: [%s : %pK]:[%s] %u %d %s", get_timestamp(tbuf), event, urb, usb_urb_dir_in(urb) ? "in" : "out", urb->actual_length, extra, @@ -715,7 +715,7 @@ xhci_dbg_log_event(struct dbg_data *d, struct urb *urb, char *event, } else { write_lock_irqsave(&d->data_lck, flags); scnprintf(d->data_buf[d->data_idx], DBG_MSG_LEN, - "%s: [%s : %p]:ep%d[%s] %u %d %s", + "%s: [%s : %pK]:ep%d[%s] %u %d %s", get_timestamp(tbuf), event, urb, ep_addr & 0x0f, usb_urb_dir_in(urb) ? "in" : "out", xhci_str_to_event(event) ? urb->actual_length : diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c index 6a22eaf2f0ba3..591f8db7f326a 100644 --- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c @@ -542,7 +542,7 @@ static int xhci_test_radix_tree(struct xhci_hcd *xhci, if (cur_ring != mapped_ring) { xhci_warn(xhci, "WARN: DMA address 0x%08llx " "didn't map to stream ID %u; " - "mapped to ring %p\n", + "mapped to ring %pK\n", (unsigned long long) addr, cur_stream, mapped_ring); @@ -562,7 +562,7 @@ static int xhci_test_radix_tree(struct xhci_hcd *xhci, if (mapped_ring == cur_ring) { xhci_warn(xhci, "WARN: Bad DMA address 0x%08llx " "mapped to valid stream ID %u; " - "mapped ring = %p\n", + "mapped ring = %pK\n", (unsigned long long) addr, cur_stream, mapped_ring); @@ -1002,7 +1002,7 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, /* Point to output device context in dcbaa. */ xhci->dcbaa->dev_context_ptrs[slot_id] = cpu_to_le64(dev->out_ctx->dma); - xhci_dbg(xhci, "Set slot id %d dcbaa entry %p to 0x%llx\n", + xhci_dbg(xhci, "Set slot id %d dcbaa entry %pK to 0x%llx\n", slot_id, &xhci->dcbaa->dev_context_ptrs[slot_id], le64_to_cpu(xhci->dcbaa->dev_context_ptrs[slot_id])); @@ -1157,7 +1157,7 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud if (udev->tt->multi) slot_ctx->dev_info |= cpu_to_le32(DEV_MTT); } - xhci_dbg(xhci, "udev->tt = %p\n", udev->tt); + xhci_dbg(xhci, "udev->tt = %pK\n", udev->tt); xhci_dbg(xhci, "udev->ttport = 0x%x\n", udev->ttport); /* Step 4 - ring already allocated */ @@ -1904,15 +1904,15 @@ static int xhci_test_trb_in_td(struct xhci_hcd *xhci, if (seg != result_seg) { xhci_warn(xhci, "WARN: %s TRB math test %d failed!\n", test_name, test_number); - xhci_warn(xhci, "Tested TRB math w/ seg %p and " + xhci_warn(xhci, "Tested TRB math w/ seg %pK and " "input DMA 0x%llx\n", input_seg, (unsigned long long) input_dma); - xhci_warn(xhci, "starting TRB %p (0x%llx DMA), " - "ending TRB %p (0x%llx DMA)\n", + xhci_warn(xhci, "starting TRB %pK (0x%llx DMA), " + "ending TRB %pK (0x%llx DMA)\n", start_trb, start_dma, end_trb, end_dma); - xhci_warn(xhci, "Expected seg %p, got seg %p\n", + xhci_warn(xhci, "Expected seg %pK, got seg %pK\n", result_seg, seg); return -1; } @@ -2072,7 +2072,7 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports, if (major_revision > 0x03) { xhci_warn(xhci, "Ignoring unknown port speed, " - "Ext Cap %p, revision = 0x%x\n", + "Ext Cap %pK, revision = 0x%x\n", addr, major_revision); /* Ignoring port protocol we can't understand. FIXME */ return; @@ -2082,7 +2082,7 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports, temp = xhci_readl(xhci, addr + 2); port_offset = XHCI_EXT_PORT_OFF(temp); port_count = XHCI_EXT_PORT_COUNT(temp); - xhci_dbg(xhci, "Ext Cap %p, port offset = %u, " + xhci_dbg(xhci, "Ext Cap %pK, port offset = %u, " "count = %u, revision = 0x%x\n", addr, port_offset, port_count, major_revision); /* Port count includes the current port offset */ @@ -2110,7 +2110,7 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports, for (i = port_offset; i < (port_offset + port_count); i++) { /* Duplicate entry. Ignore the port if the revisions differ. */ if (xhci->port_array[i] != 0) { - xhci_warn(xhci, "Duplicate port entry, Ext Cap %p," + xhci_warn(xhci, "Duplicate port entry, Ext Cap %pK," " port %u\n", addr, i); xhci_warn(xhci, "Port was marked as USB %u, " "duplicated as USB %u\n", @@ -2242,7 +2242,7 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags) &xhci->op_regs->port_status_base + NUM_PORT_REGS*i; xhci_dbg(xhci, "USB 2.0 port at index %u, " - "addr = %p\n", i, + "addr = %pK\n", i, xhci->usb2_ports[port_index]); port_index++; if (port_index == xhci->num_usb2_ports) @@ -2262,7 +2262,7 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags) &xhci->op_regs->port_status_base + NUM_PORT_REGS*i; xhci_dbg(xhci, "USB 3.0 port at index %u, " - "addr = %p\n", i, + "addr = %pK\n", i, xhci->usb3_ports[port_index]); port_index++; if (port_index == xhci->num_usb3_ports) @@ -2324,7 +2324,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) goto fail; memset(xhci->dcbaa, 0, sizeof *(xhci->dcbaa)); xhci->dcbaa->dma = dma; - xhci_dbg(xhci, "// Device context base array address = 0x%llx (DMA), %p (virt)\n", + xhci_dbg(xhci, "// Device context base array address = 0x%llx (DMA), %pK (virt)\n", (unsigned long long)xhci->dcbaa->dma, xhci->dcbaa); xhci_write_64(xhci, dma, &xhci->op_regs->dcbaa_ptr); @@ -2363,7 +2363,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) xhci->cmd_ring = xhci_ring_alloc(xhci, 1, 1, TYPE_COMMAND, flags); if (!xhci->cmd_ring) goto fail; - xhci_dbg(xhci, "Allocated command ring at %p\n", xhci->cmd_ring); + xhci_dbg(xhci, "Allocated command ring at %pK\n", xhci->cmd_ring); xhci_dbg(xhci, "First segment DMA is 0x%llx\n", (unsigned long long)xhci->cmd_ring->first_seg->dma); @@ -2419,7 +2419,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) memset(xhci->erst.entries, 0, sizeof(struct xhci_erst_entry)*ERST_NUM_SEGS); xhci->erst.num_entries = ERST_NUM_SEGS; xhci->erst.erst_dma_addr = dma; - xhci_dbg(xhci, "Set ERST to 0; private num segs = %i, virt addr = %p, dma addr = 0x%llx\n", + xhci_dbg(xhci, "Set ERST to 0; private num segs = %i, virt addr = %pK, dma addr = 0x%llx\n", xhci->erst.num_entries, xhci->erst.entries, (unsigned long long)xhci->erst.erst_dma_addr); diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 676bf3a2fa8ab..15a9147968a47 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -610,7 +610,7 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci, xhci_dbg(xhci, "Cycle state = 0x%x\n", state->new_cycle_state); /* Don't update the ring cycle state for the producer (us). */ - xhci_dbg(xhci, "New dequeue segment = %p (virtual)\n", + xhci_dbg(xhci, "New dequeue segment = %pK (virtual)\n", state->new_deq_seg); addr = xhci_trb_virt_to_dma(state->new_deq_seg, state->new_deq_ptr); xhci_dbg(xhci, "New dequeue pointer = 0x%llx (DMA)\n", @@ -642,8 +642,8 @@ static void td_to_noop(struct xhci_hcd *xhci, struct xhci_ring *ep_ring, cur_trb->generic.field[3] ^= cpu_to_le32(TRB_CYCLE); xhci_dbg(xhci, "Cancel (unchain) link TRB\n"); - xhci_dbg(xhci, "Address = %p (0x%llx dma); " - "in seg %p (0x%llx dma)\n", + xhci_dbg(xhci, "Address = %pK (0x%llx dma); " + "in seg %pK (0x%llx dma)\n", cur_trb, (unsigned long long)xhci_trb_virt_to_dma(cur_seg, cur_trb), cur_seg, @@ -682,8 +682,8 @@ void xhci_queue_new_dequeue_state(struct xhci_hcd *xhci, { struct xhci_virt_ep *ep = &xhci->devs[slot_id]->eps[ep_index]; - xhci_dbg(xhci, "Set TR Deq Ptr cmd, new deq seg = %p (0x%llx dma), " - "new deq ptr = %p (0x%llx dma), new cycle = %u\n", + xhci_dbg(xhci, "Set TR Deq Ptr cmd, new deq seg = %pK (0x%llx dma), " + "new deq ptr = %pK (0x%llx dma), new cycle = %u\n", deq_state->new_deq_seg, (unsigned long long)deq_state->new_deq_seg->dma, deq_state->new_deq_ptr, @@ -841,7 +841,7 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci, * short, don't muck with the stream ID after * submission. */ - xhci_warn(xhci, "WARN Cancelled URB %p " + xhci_warn(xhci, "WARN Cancelled URB %pK " "has invalid stream ID %u.\n", cur_td->urb, cur_td->urb->stream_id); @@ -1168,7 +1168,7 @@ static void handle_set_deq_completion(struct xhci_hcd *xhci, } else { xhci_warn(xhci, "Mismatch between completed Set TR Deq " "Ptr command & xHCI internal state.\n"); - xhci_warn(xhci, "ep deq seg = %p, deq ptr = %p\n", + xhci_warn(xhci, "ep deq seg = %pK, deq ptr = %pK\n", dev->eps[ep_index].queued_deq_seg, dev->eps[ep_index].queued_deq_ptr); } @@ -1277,7 +1277,7 @@ static void xhci_cmd_to_noop(struct xhci_hcd *xhci, struct xhci_cd *cur_cd) xhci->cmd_ring->dequeue, &cycle_state); if (!cur_seg) { - xhci_warn(xhci, "Command ring mismatch, dequeue = %p %llx (dma)\n", + xhci_warn(xhci, "Command ring mismatch, dequeue = %pK %llx (dma)\n", xhci->cmd_ring->dequeue, (unsigned long long) xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg, @@ -2660,7 +2660,7 @@ static int handle_tx_event(struct xhci_hcd *xhci, URB_SHORT_NOT_OK)) || (status != 0 && !usb_endpoint_xfer_isoc(&urb->ep->desc))) - xhci_dbg(xhci, "Giveback URB %p, len = %d, " + xhci_dbg(xhci, "Giveback URB %pK, len = %d, " "expected = %d, status = %d\n", urb, urb->actual_length, urb->transfer_buffer_length, @@ -4198,7 +4198,7 @@ static int queue_set_tr_deq(struct xhci_hcd *xhci, int slot_id, addr = xhci_trb_virt_to_dma(deq_seg, deq_ptr); if (addr == 0) { xhci_warn(xhci, "WARN Cannot submit Set TR Deq Ptr\n"); - xhci_warn(xhci, "WARN deq seg = %p, deq pt = %p\n", + xhci_warn(xhci, "WARN deq seg = %pK, deq pt = %pK\n", deq_seg, deq_ptr); return 0; } diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 4ed056f04ecef..cf6e53d6b2c55 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -676,7 +676,7 @@ int xhci_run(struct usb_hcd *hcd) xhci_writel(xhci, temp, &xhci->op_regs->command); temp = xhci_readl(xhci, &xhci->ir_set->irq_pending); - xhci_dbg(xhci, "// Enabling event ring interrupter %p by writing 0x%x to irq_pending\n", + xhci_dbg(xhci, "// Enabling event ring interrupter %pK by writing 0x%x to irq_pending\n", xhci->ir_set, (unsigned int) ER_IRQ_ENABLE(temp)); xhci_writel(xhci, ER_IRQ_ENABLE(temp), &xhci->ir_set->irq_pending); @@ -1413,7 +1413,7 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags) exit: return ret; dying: - xhci_dbg(xhci, "Ep 0x%x: URB %p submitted for " + xhci_dbg(xhci, "Ep 0x%x: URB %pK submitted for " "non-responsive xHCI host.\n", urb->ep->desc.bEndpointAddress, urb); ret = -ESHUTDOWN; @@ -1534,7 +1534,7 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) } if ((xhci->xhc_state & XHCI_STATE_DYING) || (xhci->xhc_state & XHCI_STATE_HALTED)) { - xhci_dbg(xhci, "Ep 0x%x: URB %p to be canceled on " + xhci_dbg(xhci, "Ep 0x%x: URB %pK to be canceled on " "non-responsive xHCI host.\n", urb->ep->desc.bEndpointAddress, urb); /* Let the stop endpoint command watchdog timer (which set this @@ -1556,7 +1556,7 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) urb_priv = urb->hcpriv; i = urb_priv->td_cnt; if (i < urb_priv->length) - xhci_dbg(xhci, "Cancel URB %p, dev %s, ep 0x%x, " + xhci_dbg(xhci, "Cancel URB %pK, dev %s, ep 0x%x, " "starting at offset 0x%llx\n", urb, urb->dev->devpath, urb->ep->desc.bEndpointAddress, @@ -1620,7 +1620,7 @@ int xhci_drop_endpoint(struct usb_hcd *hcd, struct usb_device *udev, if (xhci->xhc_state & XHCI_STATE_DYING) return -ENODEV; - xhci_dbg(xhci, "%s called for udev %p\n", __func__, udev); + xhci_dbg(xhci, "%s called for udev %pK\n", __func__, udev); drop_flag = xhci_get_endpoint_flag(&ep->desc); if (drop_flag == SLOT_FLAG || drop_flag == EP0_FLAG) { xhci_dbg(xhci, "xHCI %s - can't drop slot or ep 0 %#x\n", @@ -1640,7 +1640,7 @@ int xhci_drop_endpoint(struct usb_hcd *hcd, struct usb_device *udev, cpu_to_le32(EP_STATE_DISABLED)) || le32_to_cpu(ctrl_ctx->drop_flags) & xhci_get_endpoint_flag(&ep->desc)) { - xhci_warn(xhci, "xHCI %s called with disabled ep %p\n", + xhci_warn(xhci, "xHCI %s called with disabled ep %pK\n", __func__, ep); return 0; } @@ -1744,7 +1744,7 @@ int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev, */ if (le32_to_cpu(ctrl_ctx->add_flags) & xhci_get_endpoint_flag(&ep->desc)) { - xhci_warn(xhci, "xHCI %s called with enabled ep %p\n", + xhci_warn(xhci, "xHCI %s called with enabled ep %pK\n", __func__, ep); return 0; } @@ -2710,7 +2710,7 @@ int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev) if (xhci->xhc_state & XHCI_STATE_DYING) return -ENODEV; - xhci_dbg(xhci, "%s called for udev %p\n", __func__, udev); + xhci_dbg(xhci, "%s called for udev %pK\n", __func__, udev); virt_dev = xhci->devs[udev->slot_id]; /* See section 4.6.6 - A0 = 1; A1 = D0 = D1 = 0 */ @@ -2778,7 +2778,7 @@ void xhci_reset_bandwidth(struct usb_hcd *hcd, struct usb_device *udev) return; xhci = hcd_to_xhci(hcd); - xhci_dbg(xhci, "%s called for udev %p\n", __func__, udev); + xhci_dbg(xhci, "%s called for udev %pK\n", __func__, udev); virt_dev = xhci->devs[udev->slot_id]; /* Free any rings allocated for added endpoints */ for (i = 0; i < 31; ++i) { @@ -2824,7 +2824,7 @@ static void xhci_setup_input_ctx_for_quirk(struct xhci_hcd *xhci, if (addr == 0) { xhci_warn(xhci, "WARN Cannot submit config ep after " "reset ep command\n"); - xhci_warn(xhci, "WARN deq seg = %p, deq ptr = %p\n", + xhci_warn(xhci, "WARN deq seg = %pK, deq ptr = %pK\n", deq_state->new_deq_seg, deq_state->new_deq_ptr); return; @@ -3809,7 +3809,7 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev) } temp_64 = xhci_read_64(xhci, &xhci->op_regs->dcbaa_ptr); xhci_dbg(xhci, "Op regs DCBAA ptr = %#016llx\n", temp_64); - xhci_dbg(xhci, "Slot ID %d dcbaa entry @%p = %#016llx\n", + xhci_dbg(xhci, "Slot ID %d dcbaa entry @%pK = %#016llx\n", udev->slot_id, &xhci->dcbaa->dev_context_ptrs[udev->slot_id], (unsigned long long) diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c index ad408251d9557..060d78d531181 100644 --- a/drivers/usb/mon/mon_text.c +++ b/drivers/usb/mon/mon_text.c @@ -347,7 +347,7 @@ static int mon_text_open(struct inode *inode, struct file *file) rp->r.rnf_error = mon_text_error; rp->r.rnf_complete = mon_text_complete; - snprintf(rp->slab_name, SLAB_NAME_SZ, "mon_text_%p", rp); + snprintf(rp->slab_name, SLAB_NAME_SZ, "mon_text_%pK", rp); rp->e_slab = kmem_cache_create(rp->slab_name, sizeof(struct mon_event_text), sizeof(long), 0, mon_text_ctor); diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c index 0c1b3848695d5..9f2fab605cfee 100644 --- a/drivers/usb/phy/phy-msm-usb.c +++ b/drivers/usb/phy/phy-msm-usb.c @@ -5263,7 +5263,7 @@ static int msm_otg_probe(struct platform_device *pdev) ret = -ENOMEM; goto devote_bus_bw; } - dev_info(&pdev->dev, "OTG regs = %p\n", motg->regs); + dev_info(&pdev->dev, "OTG regs = %pK\n", motg->regs); if (pdata->enable_sec_phy) { res = platform_get_resource_byname(pdev, diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c index 85a0c3f91267b..882187a1512f5 100644 --- a/drivers/usb/storage/scsiglue.c +++ b/drivers/usb/storage/scsiglue.c @@ -336,7 +336,7 @@ static int queuecommand_lck(struct scsi_cmnd *srb, /* check for state-transition errors */ if (us->srb != NULL) { - printk(KERN_ERR USB_STORAGE "Error in %s: us->srb = %p\n", + printk(KERN_ERR USB_STORAGE "Error in %s: us->srb = %pK\n", __func__, us->srb); return SCSI_MLQUEUE_HOST_BUSY; } diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c index d966b59f7d7b2..2778a1a93d767 100644 --- a/drivers/usb/storage/uas.c +++ b/drivers/usb/storage/uas.c @@ -235,7 +235,7 @@ static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *caller) { struct uas_cmd_info *ci = (void *)&cmnd->SCp; - scmd_printk(KERN_INFO, cmnd, "%s %p tag %d, inflight:" + scmd_printk(KERN_INFO, cmnd, "%s %pK tag %d, inflight:" "%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n", caller, cmnd, cmnd->request->tag, (ci->state & SUBMIT_STATUS_URB) ? " s-st" : "", diff --git a/drivers/video/msm/mdss/mdp3_ctrl.c b/drivers/video/msm/mdss/mdp3_ctrl.c index 38b1d24ea2c33..badbdfb9536b0 100644 --- a/drivers/video/msm/mdss/mdp3_ctrl.c +++ b/drivers/video/msm/mdss/mdp3_ctrl.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2015, 2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1953,8 +1953,10 @@ static int mdp3_ctrl_lut_config(struct msm_fb_data_type *mfd, dma = mdp3_session->dma; - if (cfg->cmap.start + cfg->cmap.len > MDP_LUT_SIZE) { - pr_err("Invalid arguments\n"); + if ((cfg->cmap.start > MDP_LUT_SIZE) || + (cfg->cmap.len > MDP_LUT_SIZE) || + (cfg->cmap.start + cfg->cmap.len > MDP_LUT_SIZE)) { + pr_err("Invalid arguments.\n"); return -EINVAL; } diff --git a/drivers/video/msm/mdss/mdss_debug.c b/drivers/video/msm/mdss/mdss_debug.c index b5ece8e67f97e..611a0954527dc 100644 --- a/drivers/video/msm/mdss/mdss_debug.c +++ b/drivers/video/msm/mdss/mdss_debug.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2009-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2009-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -38,6 +38,11 @@ #define PANEL_CMD_MIN_TX_COUNT 2 #define PANEL_DATA_NODE_LEN 80 +/* Hex number + whitespace */ +#define NEXT_VALUE_OFFSET 3 + +static DEFINE_MUTEX(mdss_debug_lock); + static char panel_reg[2] = {DEFAULT_READ_PANEL_POWER_MODE_REG, 0x00}; static int panel_debug_base_open(struct inode *inode, struct file *file) @@ -87,8 +92,10 @@ static ssize_t panel_debug_base_offset_write(struct file *file, if (cnt > (dbg->max_offset - off)) cnt = dbg->max_offset - off; + mutex_lock(&mdss_debug_lock); dbg->off = off; dbg->cnt = cnt; + mutex_unlock(&mdss_debug_lock); pr_debug("offset=%x cnt=%x\n", off, cnt); @@ -108,15 +115,21 @@ static ssize_t panel_debug_base_offset_read(struct file *file, if (*ppos) return 0; /* the end */ + mutex_lock(&mdss_debug_lock); len = snprintf(buf, sizeof(buf), "0x%02zx %zx\n", dbg->off, dbg->cnt); - if (len < 0 || len >= sizeof(buf)) + if (len < 0 || len >= sizeof(buf)) { + mutex_unlock(&mdss_debug_lock); return 0; + } - if ((count < sizeof(buf)) || copy_to_user(buff, buf, len)) + if ((count < sizeof(buf)) || copy_to_user(buff, buf, len)) { + mutex_unlock(&mdss_debug_lock); return -EFAULT; + } *ppos += len; /* increase offset */ + mutex_unlock(&mdss_debug_lock); return len; } @@ -124,32 +137,22 @@ static ssize_t panel_debug_base_reg_write(struct file *file, const char __user *user_buf, size_t count, loff_t *ppos) { struct mdss_debug_base *dbg = file->private_data; - - u32 cnt, tmp, i; - u32 len = 0; char buf[PANEL_TX_MAX_BUF] = {0x0}; - char *p = NULL; char reg[PANEL_TX_MAX_BUF] = {0x0}; + u32 len = 0, value = 0; + char *bufp; struct mdss_data_type *mdata = mdss_res; - struct mdss_mdp_ctl *ctl = mdata->ctl_off + 0; - struct mdss_panel_data *panel_data = ctl->panel_data; - struct mdss_dsi_ctrl_pdata *ctrl_pdata = container_of(panel_data, - struct mdss_dsi_ctrl_pdata, panel_data); - + struct mdss_mdp_ctl *ctl; + struct mdss_dsi_ctrl_pdata *ctrl_pdata; struct dsi_cmd_desc dsi_write_cmd = { - {DTYPE_GEN_LWRITE, 1, 0, 0, 0, 0/*len*/}, reg}; + {0/*data type*/, 1, 0, 0, 0, 0/* len */}, reg}; struct dcs_cmd_req cmdreq; - cmdreq.cmds = &dsi_write_cmd; - cmdreq.cmds_cnt = 1; - cmdreq.flags = CMD_REQ_COMMIT; - cmdreq.rlen = 0; - cmdreq.cb = NULL; - if (!dbg || !mdata) return -ENODEV; + /* get command string from user */ if (count >= sizeof(buf)) return -EFAULT; @@ -158,26 +161,46 @@ static ssize_t panel_debug_base_reg_write(struct file *file, buf[count] = 0; /* end of string */ - len = count / 3; - + bufp = buf; + /* End of a hex value in given string */ + bufp[NEXT_VALUE_OFFSET - 1] = 0; + while (kstrtouint(bufp, 16, &value) == 0) { + reg[len++] = value; + if (len >= PANEL_TX_MAX_BUF) { + pr_err("wrong input reg len\n"); + return -EFAULT; + } + bufp += NEXT_VALUE_OFFSET; + if ((bufp >= (buf + count)) || (bufp < buf)) { + pr_warn("%s,buffer out-of-bounds\n", __func__); + break; + } + /* End of a hex value in given string */ + bufp[NEXT_VALUE_OFFSET - 1] = 0; + } if (len < PANEL_CMD_MIN_TX_COUNT) { pr_err("wrong input reg len\n"); return -EFAULT; } - for (i = 0; i < len; i++) { - p = buf + i * 3; - p[2] = 0; - pr_debug("p[%d] = %pK:%s\n", i, p, p); - cnt = sscanf(p, "%x", &tmp); - reg[i] = tmp; - pr_debug("reg[%d] = %x\n", i, (int)reg[i]); - } + /* put command to cmdlist */ + dsi_write_cmd.dchdr.dtype = dbg->cmd_data_type; + dsi_write_cmd.dchdr.dlen = len; + dsi_write_cmd.payload = reg; + + cmdreq.cmds = &dsi_write_cmd; + cmdreq.cmds_cnt = 1; + cmdreq.flags = CMD_REQ_COMMIT; + cmdreq.rlen = 0; + cmdreq.cb = NULL; + + ctl = mdata->ctl_off + 0; + ctrl_pdata = container_of(ctl->panel_data, + struct mdss_dsi_ctrl_pdata, panel_data); if (mdata->debug_inf.debug_enable_clock) mdata->debug_inf.debug_enable_clock(1); - dsi_write_cmd.dchdr.dlen = len; mdss_dsi_cmdlist_put(ctrl_pdata, &cmdreq); if (mdata->debug_inf.debug_enable_clock) @@ -205,8 +228,16 @@ static ssize_t panel_debug_base_reg_read(struct file *file, if (!dbg) return -ENODEV; - if (*ppos) + mutex_lock(&mdss_debug_lock); + if (!dbg->cnt) { + mutex_unlock(&mdss_debug_lock); + return 0; + } + + if (*ppos) { + mutex_unlock(&mdss_debug_lock); return 0; /* the end */ + } if (mdata->debug_inf.debug_enable_clock) mdata->debug_inf.debug_enable_clock(1); @@ -231,14 +262,19 @@ static ssize_t panel_debug_base_reg_read(struct file *file, if (mdata->debug_inf.debug_enable_clock) mdata->debug_inf.debug_enable_clock(0); - if (len < 0 || len >= sizeof(to_user_buf)) + if (len < 0 || len >= sizeof(to_user_buf)) { + mutex_unlock(&mdss_debug_lock); return 0; + } if ((count < sizeof(to_user_buf)) - || copy_to_user(user_buf, to_user_buf, len)) + || copy_to_user(user_buf, to_user_buf, len)) { + mutex_unlock(&mdss_debug_lock); return -EFAULT; + } *ppos += len; /* increase offset */ + mutex_unlock(&mdss_debug_lock); return len; } @@ -262,7 +298,7 @@ int panel_debug_register_base(const char *name, void __iomem *base, struct mdss_data_type *mdata = mdss_res; struct mdss_debug_data *mdd; struct mdss_debug_base *dbg; - struct dentry *ent_off, *ent_reg; + struct dentry *ent_off, *ent_reg, *ent_type; char dn[PANEL_DATA_NODE_LEN] = ""; int prefix_len = 0; @@ -279,10 +315,20 @@ int panel_debug_register_base(const char *name, void __iomem *base, dbg->max_offset = max_offset; dbg->off = 0x0a; dbg->cnt = 0x01; + dbg->cmd_data_type = DTYPE_DCS_LWRITE; if (name) prefix_len = snprintf(dn, sizeof(dn), "%s_", name); + strlcpy(dn + prefix_len, "cmd_data_type", sizeof(dn) - prefix_len); + ent_type = debugfs_create_x8(dn, 0644, mdd->root, + (u8 *)&dbg->cmd_data_type); + + if (IS_ERR_OR_NULL(ent_type)) { + pr_err("debugfs_create_file: data_type fail\n"); + goto type_fail; + } + strlcpy(dn + prefix_len, "off", sizeof(dn) - prefix_len); ent_off = debugfs_create_file(dn, 0644, mdd->root, dbg, &panel_off_fops); @@ -303,9 +349,12 @@ int panel_debug_register_base(const char *name, void __iomem *base, list_add(&dbg->head, &mdd->base_list); return 0; + reg_fail: debugfs_remove(ent_off); off_fail: + debugfs_remove(ent_type); +type_fail: kfree(dbg); return -ENODEV; } @@ -356,8 +405,10 @@ static ssize_t mdss_debug_base_offset_write(struct file *file, if (cnt > (dbg->max_offset - off)) cnt = dbg->max_offset - off; + mutex_lock(&mdss_debug_lock); dbg->off = off; dbg->cnt = cnt; + mutex_unlock(&mdss_debug_lock); pr_debug("offset=%x cnt=%x\n", off, cnt); @@ -377,15 +428,21 @@ static ssize_t mdss_debug_base_offset_read(struct file *file, if (*ppos) return 0; /* the end */ + mutex_lock(&mdss_debug_lock); len = snprintf(buf, sizeof(buf), "0x%08zx %zx\n", dbg->off, dbg->cnt); - if (len < 0 || len >= sizeof(buf)) + if (len < 0 || len >= sizeof(buf)) { + mutex_unlock(&mdss_debug_lock); return 0; + } - if ((count < sizeof(buf)) || copy_to_user(buff, buf, len)) + if ((count < sizeof(buf)) || copy_to_user(buff, buf, len)) { + mutex_unlock(&mdss_debug_lock); return -EFAULT; + } *ppos += len; /* increase offset */ + mutex_unlock(&mdss_debug_lock); return len; } @@ -442,6 +499,8 @@ static ssize_t mdss_debug_base_reg_read(struct file *file, return -ENODEV; } + mutex_lock(&mdss_debug_lock); + if (!dbg->buf) { char dump_buf[64]; char *ptr; @@ -453,6 +512,7 @@ static ssize_t mdss_debug_base_reg_read(struct file *file, if (!dbg->buf) { pr_err("not enough memory to hold reg dump\n"); + mutex_unlock(&mdss_debug_lock); return -ENOMEM; } @@ -483,17 +543,21 @@ static ssize_t mdss_debug_base_reg_read(struct file *file, dbg->buf_len = tot; } - if (*ppos >= dbg->buf_len) + if (*ppos >= dbg->buf_len) { + mutex_unlock(&mdss_debug_lock); return 0; /* done reading */ + } len = min(count, dbg->buf_len - (size_t) *ppos); if (copy_to_user(user_buf, dbg->buf + *ppos, len)) { pr_err("failed to copy to user\n"); + mutex_unlock(&mdss_debug_lock); return -EFAULT; } *ppos += len; /* increase offset */ + mutex_unlock(&mdss_debug_lock); return len; } diff --git a/drivers/video/msm/mdss/mdss_debug.h b/drivers/video/msm/mdss/mdss_debug.h index 43bf454e8e122..9313482e81ce0 100644 --- a/drivers/video/msm/mdss/mdss_debug.h +++ b/drivers/video/msm/mdss/mdss_debug.h @@ -114,6 +114,7 @@ struct mdss_debug_base { void __iomem *base; size_t off; size_t cnt; + u8 cmd_data_type; size_t max_offset; char *buf; size_t buf_len; diff --git a/drivers/video/msm/mdss/mdss_fb.c b/drivers/video/msm/mdss/mdss_fb.c index f0e42fbd4fcf0..dba96ffeb750e 100755 --- a/drivers/video/msm/mdss/mdss_fb.c +++ b/drivers/video/msm/mdss/mdss_fb.c @@ -2,7 +2,7 @@ * Core MDSS framebuffer driver. * * Copyright (C) 2007 Google Incorporated - * Copyright (c) 2008-2016, The Linux Foundation. All rights reserved. + * Copyright (c) 2008-2017, The Linux Foundation. All rights reserved. * * This software is licensed under the terms of the GNU General Public * License version 2, as published by the Free Software Foundation, and @@ -3755,8 +3755,6 @@ static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data, goto buf_sync_err_2; } - sync_fence_install(rel_fence, rel_fen_fd); - ret = copy_to_user(buf_sync->rel_fen_fd, &rel_fen_fd, sizeof(int)); if (ret) { pr_err("%s: copy_to_user failed\n", sync_pt_data->fence_name); @@ -3793,8 +3791,6 @@ static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data, goto buf_sync_err_3; } - sync_fence_install(retire_fence, retire_fen_fd); - ret = copy_to_user(buf_sync->retire_fen_fd, &retire_fen_fd, sizeof(int)); if (ret) { @@ -3805,7 +3801,10 @@ static int mdss_fb_handle_buf_sync_ioctl(struct msm_sync_pt_data *sync_pt_data, goto buf_sync_err_3; } + sync_fence_install(retire_fence, retire_fen_fd); + skip_retire_fence: + sync_fence_install(rel_fence, rel_fen_fd); mutex_unlock(&sync_pt_data->sync_mutex); if (buf_sync->flags & MDP_BUF_SYNC_FLAG_WAIT) diff --git a/drivers/video/msm/mdss/mdss_mdp_overlay.c b/drivers/video/msm/mdss/mdss_mdp_overlay.c index 6b2f43003f4f0..55ea722a1bd22 100644 --- a/drivers/video/msm/mdss/mdss_mdp_overlay.c +++ b/drivers/video/msm/mdss/mdss_mdp_overlay.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -3529,6 +3529,10 @@ static int mdss_mdp_hw_cursor_update(struct msm_fb_data_type *mfd, if (cursor->set & FB_CUR_SETIMAGE) { u32 cursor_addr; + if (img->width * img->height * 4 > cursor_frame_size) { + pr_err("cursor image size is too large\n"); + return -EINVAL; + } ret = copy_from_user(mfd->cursor_buf, img->data, img->width * img->height * 4); if (ret) { diff --git a/fs/aio.c b/fs/aio.c index 9798d4edfd8f2..0f2c38f29c4a3 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -35,6 +35,7 @@ #include #include #include +#include #include #include @@ -153,6 +154,9 @@ static int aio_setup_ring(struct kioctx *ctx) unsigned long size, populate; int nr_pages; + if (current->personality & READ_IMPLIES_EXEC) + return -EPERM; + /* Compensate for the ring buffer's head/tail overlap entry */ nr_events += 2; /* 1 is required, 2 for good luck */ diff --git a/fs/proc/array.c b/fs/proc/array.c index 09f0d9c374a32..6ed95802239df 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -168,16 +168,16 @@ static inline void task_state(struct seq_file *m, struct pid_namespace *ns, int g; struct fdtable *fdt = NULL; const struct cred *cred; - pid_t ppid, tpid; + pid_t ppid = 0, tpid = 0; + struct task_struct *leader = NULL; rcu_read_lock(); - ppid = pid_alive(p) ? - task_tgid_nr_ns(rcu_dereference(p->real_parent), ns) : 0; - tpid = 0; if (pid_alive(p)) { struct task_struct *tracer = ptrace_parent(p); if (tracer) tpid = task_pid_nr_ns(tracer, ns); + ppid = task_tgid_nr_ns(rcu_dereference(p->real_parent), ns); + leader = p->group_leader; } cred = get_task_cred(p); seq_printf(m, @@ -189,7 +189,7 @@ static inline void task_state(struct seq_file *m, struct pid_namespace *ns, "Uid:\t%d\t%d\t%d\t%d\n" "Gid:\t%d\t%d\t%d\t%d\n", get_task_state(p), - task_tgid_nr_ns(p, ns), + leader ? task_pid_nr_ns(leader, ns) : 0, pid_nr_ns(pid, ns), ppid, tpid, from_kuid_munged(user_ns, cred->uid), diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h index 7faf933cced70..5a0bd938c6a2f 100644 --- a/include/linux/sysrq.h +++ b/include/linux/sysrq.h @@ -45,6 +45,7 @@ struct sysrq_key_op { * are available -- else NULL's). */ +bool sysrq_on(void); void handle_sysrq(int key); void __handle_sysrq(int key, bool check_mask); int register_sysrq_key(int key, struct sysrq_key_op *op); diff --git a/include/media/msmb_pproc.h b/include/media/msmb_pproc.h index 0e3cb8705688f..1e310d5a8c339 100644 --- a/include/media/msmb_pproc.h +++ b/include/media/msmb_pproc.h @@ -22,6 +22,7 @@ #define MSM_CPP_MAX_FRAME_LENGTH 4096 #define MSM_CPP_MAX_FW_NAME_LEN 32 #define MAX_FREQ_TBL 10 +#define MSM_OUTPUT_BUF_CNT 8 enum msm_cpp_frame_type { MSM_CPP_OFFLINE_FRAME, @@ -211,7 +212,7 @@ struct msm_cpp_frame_info_t { uint32_t feature_mask; uint8_t we_disable; struct msm_cpp_buffer_info_t input_buffer_info; - struct msm_cpp_buffer_info_t output_buffer_info[8]; + struct msm_cpp_buffer_info_t output_buffer_info[MSM_OUTPUT_BUF_CNT]; struct msm_cpp_buffer_info_t duplicate_buffer_info; struct msm_cpp_buffer_info_t tnr_scratch_buffer_info[2]; uint32_t reserved; @@ -407,7 +408,7 @@ struct msm_cpp_frame_info32_t { uint32_t feature_mask; uint8_t we_disable; struct msm_cpp_buffer_info_t input_buffer_info; - struct msm_cpp_buffer_info_t output_buffer_info[8]; + struct msm_cpp_buffer_info_t output_buffer_info[MSM_OUTPUT_BUF_CNT]; struct msm_cpp_buffer_info_t duplicate_buffer_info; struct msm_cpp_buffer_info_t tnr_scratch_buffer_info[2]; uint32_t reserved; diff --git a/include/soc/qcom/qseecomi.h b/include/soc/qcom/qseecomi.h index f380509a62823..9357e02529d5c 100644 --- a/include/soc/qcom/qseecomi.h +++ b/include/soc/qcom/qseecomi.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013-2014, The Linux Foundation. All rights reserved. + * Copyright (c) 2013-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -18,6 +18,7 @@ #define QSEECOM_KEY_ID_SIZE 32 +#define QSEOS_RESULT_FAIL_SEND_CMD_NO_THREAD -19 /*0xFFFFFFED*/ #define QSEOS_RESULT_FAIL_UNSUPPORTED_CE_PIPE -63 #define QSEOS_RESULT_FAIL_KS_OP -64 #define QSEOS_RESULT_FAIL_KEY_ID_EXISTS -65 @@ -61,6 +62,10 @@ enum qseecom_qceos_cmd_id { QSEOS_TEE_INVOKE_MODFD_COMMAND = QSEOS_TEE_INVOKE_COMMAND, QSEOS_TEE_CLOSE_SESSION, QSEOS_TEE_REQUEST_CANCELLATION, + QSEOS_CLIENT_SEND_DATA_COMMAND_WHITELIST = 0x1C, + QSEOS_TEE_OPEN_SESSION_WHITELIST = 0x1D, + QSEOS_TEE_INVOKE_COMMAND_WHITELIST = 0x1E, + QSEOS_LISTENER_DATA_RSP_COMMAND_WHITELIST = 0x1F, QSEOS_FSM_LTE_INIT_DB = 0x100, QSEOS_FSM_LTE_STORE_KENB = 0x101, QSEOS_FSM_LTE_GEN_KEYS = 0x102, @@ -145,6 +150,8 @@ __packed struct qseecom_client_send_data_ireq { uint32_t req_len; uint32_t rsp_ptr;/* First 4 bytes should be the return status */ uint32_t rsp_len; + uint32_t sglistinfo_ptr; + uint32_t sglistinfo_len; }; __packed struct qseecom_reg_log_buf_ireq { @@ -158,6 +165,8 @@ __packed struct qseecom_client_listener_data_irsp { uint32_t qsee_cmd_id; uint32_t listener_id; uint32_t status; + uint32_t sglistinfo_ptr; + uint32_t sglistinfo_len; }; /* @@ -233,6 +242,8 @@ __packed struct qseecom_qteec_ireq { uint32_t req_len; uint32_t resp_ptr; uint32_t resp_len; + uint32_t sglistinfo_ptr; + uint32_t sglistinfo_len; }; __packed struct qseecom_client_send_fsm_key_req { @@ -556,4 +567,45 @@ __packed struct qseecom_client_send_fsm_key_req { TZ_SYSCALL_PARAM_TYPE_VAL, TZ_SYSCALL_PARAM_TYPE_BUF_RW, \ TZ_SYSCALL_PARAM_TYPE_VAL) +#define TZ_APP_QSAPP_SEND_DATA_WITH_WHITELIST_ID \ + TZ_SYSCALL_CREATE_SMC_ID(TZ_OWNER_TZ_APPS, \ + TZ_SVC_APP_ID_PLACEHOLDER, 0x06) + +#define TZ_APP_QSAPP_SEND_DATA_WITH_WHITELIST_ID_PARAM_ID \ + TZ_SYSCALL_CREATE_PARAM_ID_7( \ + TZ_SYSCALL_PARAM_TYPE_VAL, TZ_SYSCALL_PARAM_TYPE_BUF_RW, \ + TZ_SYSCALL_PARAM_TYPE_VAL, TZ_SYSCALL_PARAM_TYPE_BUF_RW, \ + TZ_SYSCALL_PARAM_TYPE_VAL, TZ_SYSCALL_PARAM_TYPE_BUF_RW, \ + TZ_SYSCALL_PARAM_TYPE_VAL) + +#define TZ_APP_GPAPP_OPEN_SESSION_WITH_WHITELIST_ID \ + TZ_SYSCALL_CREATE_SMC_ID(TZ_OWNER_TZ_APPS, \ + TZ_SVC_APP_ID_PLACEHOLDER, 0x07) + +#define TZ_APP_GPAPP_OPEN_SESSION_WITH_WHITELIST_ID_PARAM_ID \ + TZ_SYSCALL_CREATE_PARAM_ID_7( \ + TZ_SYSCALL_PARAM_TYPE_VAL, TZ_SYSCALL_PARAM_TYPE_BUF_RW, \ + TZ_SYSCALL_PARAM_TYPE_VAL, TZ_SYSCALL_PARAM_TYPE_BUF_RW, \ + TZ_SYSCALL_PARAM_TYPE_VAL, TZ_SYSCALL_PARAM_TYPE_BUF_RW, \ + TZ_SYSCALL_PARAM_TYPE_VAL) + +#define TZ_APP_GPAPP_INVOKE_COMMAND_WITH_WHITELIST_ID \ + TZ_SYSCALL_CREATE_SMC_ID(TZ_OWNER_TZ_APPS, \ + TZ_SVC_APP_ID_PLACEHOLDER, 0x09) + +#define TZ_APP_GPAPP_INVOKE_COMMAND_WITH_WHITELIST_ID_PARAM_ID \ + TZ_SYSCALL_CREATE_PARAM_ID_7( \ + TZ_SYSCALL_PARAM_TYPE_VAL, TZ_SYSCALL_PARAM_TYPE_BUF_RW, \ + TZ_SYSCALL_PARAM_TYPE_VAL, TZ_SYSCALL_PARAM_TYPE_BUF_RW, \ + TZ_SYSCALL_PARAM_TYPE_VAL, TZ_SYSCALL_PARAM_TYPE_BUF_RW, \ + TZ_SYSCALL_PARAM_TYPE_VAL) + +#define TZ_OS_LISTENER_RESPONSE_HANDLER_WITH_WHITELIST_ID \ + TZ_SYSCALL_CREATE_SMC_ID(TZ_OWNER_QSEE_OS, TZ_SVC_LISTENER, 0x05) + +#define TZ_OS_LISTENER_RESPONSE_HANDLER_WITH_WHITELIST_PARAM_ID \ + TZ_SYSCALL_CREATE_PARAM_ID_4( \ + TZ_SYSCALL_PARAM_TYPE_VAL, TZ_SYSCALL_PARAM_TYPE_VAL, \ + TZ_SYSCALL_PARAM_TYPE_BUF_RW, TZ_SYSCALL_PARAM_TYPE_VAL) + #endif /* __QSEECOMI_H_ */ diff --git a/kernel/events/core.c b/kernel/events/core.c index 5c4b7f7ae69b2..a8bf970e8f689 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -1324,10 +1324,17 @@ static void perf_group_detach(struct perf_event *event) * If this was a group event with sibling events then * upgrade the siblings to singleton events by adding them * to whatever list we are on. + * If this isn't on a list, make sure we still remove the sibling's + * group_entry from this sibling_list; otherwise, when that sibling + * is later deallocated, it will try to remove itself from this + * sibling_list, which may well have been deallocated already, + * resulting in a use-after-free. */ list_for_each_entry_safe(sibling, tmp, &event->sibling_list, group_entry) { if (list) list_move_tail(&sibling->group_entry, list); + else + list_del_init(&sibling->group_entry); sibling->group_leader = sibling; /* Inherit group flags from the previous leader */ diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index af365ed7878eb..2fdfff0d2a340 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -1646,14 +1646,13 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size, !cpumask_test_cpu(cpu_id, buffer->cpumask)) return size; - size = DIV_ROUND_UP(size, BUF_PAGE_SIZE); - size *= BUF_PAGE_SIZE; + nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); /* we need a minimum of two pages */ - if (size < BUF_PAGE_SIZE * 2) - size = BUF_PAGE_SIZE * 2; + if (nr_pages < 2) + nr_pages = 2; - nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); + size = nr_pages * BUF_PAGE_SIZE; /* * Don't succeed if resizing is disabled, as a reader might be diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c index 5464c8744ea95..e24388a863a76 100644 --- a/lib/mpi/mpi-pow.c +++ b/lib/mpi/mpi-pow.c @@ -64,8 +64,13 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) if (!esize) { /* Exponent is zero, result is 1 mod MOD, i.e., 1 or 0 * depending on if MOD equals 1. */ - rp[0] = 1; res->nlimbs = (msize == 1 && mod->d[0] == 1) ? 0 : 1; + if (res->nlimbs) { + if (mpi_resize(res, 1) < 0) + goto enomem; + rp = res->d; + rp[0] = 1; + } res->sign = 0; goto leave; } diff --git a/mm/memory.c b/mm/memory.c index a9d76b56dde6d..d2dd092cd8ca8 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -3270,6 +3270,10 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, pte_unmap(page_table); + /* File mapping without ->vm_ops ? */ + if (vma->vm_flags & VM_SHARED) + return VM_FAULT_SIGBUS; + /* Check if we need to add a guard page to the stack */ if (check_stack_guard_page(vma, address) < 0) return VM_FAULT_SIGSEGV; @@ -3535,6 +3539,9 @@ static int do_linear_fault(struct mm_struct *mm, struct vm_area_struct *vma, - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff; pte_unmap(page_table); + /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */ + if (!vma->vm_ops->fault) + return VM_FAULT_SIGBUS; return __do_fault(mm, vma, address, pmd, pgoff, flags, orig_pte); } @@ -3746,11 +3753,9 @@ int handle_pte_fault(struct mm_struct *mm, entry = *pte; if (!pte_present(entry)) { if (pte_none(entry)) { - if (vma->vm_ops) { - if (likely(vma->vm_ops->fault)) - return do_linear_fault(mm, vma, address, + if (vma->vm_ops) + return do_linear_fault(mm, vma, address, pte, pmd, flags, entry); - } return do_anonymous_page(mm, vma, address, pte, pmd, flags); } diff --git a/net/core/sock.c b/net/core/sock.c index af65d17517b8e..de1074c637769 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -727,7 +727,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname, val = min_t(u32, val, sysctl_wmem_max); set_sndbuf: sk->sk_userlocks |= SOCK_SNDBUF_LOCK; - sk->sk_sndbuf = max_t(u32, val * 2, SOCK_MIN_SNDBUF); + sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF); /* Wake up sending tasks if we upped the value. */ sk->sk_write_space(sk); break; @@ -763,7 +763,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname, * returning the value we actually used in getsockopt * is the most desirable behavior. */ - sk->sk_rcvbuf = max_t(u32, val * 2, SOCK_MIN_RCVBUF); + sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF); break; case SO_RCVBUFFORCE: diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c index da1a1cee1a088..31317f0d6a5a7 100644 --- a/net/l2tp/l2tp_ip.c +++ b/net/l2tp/l2tp_ip.c @@ -249,8 +249,6 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) int ret; int chk_addr_ret; - if (!sock_flag(sk, SOCK_ZAPPED)) - return -EINVAL; if (addr_len < sizeof(struct sockaddr_l2tpip)) return -EINVAL; if (addr->l2tp_family != AF_INET) @@ -265,6 +263,9 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) read_unlock_bh(&l2tp_ip_lock); lock_sock(sk); + if (!sock_flag(sk, SOCK_ZAPPED)) + goto out; + if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_l2tpip)) goto out; diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c index 3b61ddd6e4a67..19705cbafdca8 100644 --- a/net/l2tp/l2tp_ip6.c +++ b/net/l2tp/l2tp_ip6.c @@ -264,8 +264,6 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) int addr_type; int err; - if (!sock_flag(sk, SOCK_ZAPPED)) - return -EINVAL; if (addr->l2tp_family != AF_INET6) return -EINVAL; if (addr_len < sizeof(*addr)) @@ -291,6 +289,9 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) lock_sock(sk); err = -EINVAL; + if (!sock_flag(sk, SOCK_ZAPPED)) + goto out_unlock; + if (sk->sk_state != TCP_CLOSE) goto out_unlock; diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 2db69993e53df..f5a6ec59971f0 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -3134,19 +3134,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv if (optlen != sizeof(val)) return -EINVAL; - if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) - return -EBUSY; if (copy_from_user(&val, optval, sizeof(val))) return -EFAULT; switch (val) { case TPACKET_V1: case TPACKET_V2: case TPACKET_V3: - po->tp_version = val; - return 0; + break; default: return -EINVAL; } + lock_sock(sk); + if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) { + ret = -EBUSY; + } else { + po->tp_version = val; + ret = 0; + } + release_sock(sk); + return ret; } case PACKET_RESERVE: { @@ -3601,6 +3607,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, /* Added to avoid minimal code churn */ struct tpacket_req *req = &req_u->req; + lock_sock(sk); /* Opening a Tx-ring is NOT supported in TPACKET_V3 */ if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) { WARN(1, "Tx-ring is not supported.\n"); @@ -3682,7 +3689,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, goto out; } - lock_sock(sk); /* Detach socket from network */ spin_lock(&po->bind_lock); @@ -3731,11 +3737,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, if (!tx_ring) prb_shutdown_retire_blk_timer(po, tx_ring, rb_queue); } - release_sock(sk); if (pg_vec) free_pg_vec(pg_vec, order, req->tp_block_nr); out: + release_sock(sk); return err; } diff --git a/net/rmnet_data/rmnet_data_config.c b/net/rmnet_data/rmnet_data_config.c index 6173d0bcc0830..fdb609b414aec 100644 --- a/net/rmnet_data/rmnet_data_config.c +++ b/net/rmnet_data/rmnet_data_config.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013-2014, The Linux Foundation. All rights reserved. + * Copyright (c) 2013-2014, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -530,6 +530,11 @@ void rmnet_config_netlink_msg_handler(struct sk_buff *skb) nlmsg_header = (struct nlmsghdr *) skb->data; rmnet_header = (struct rmnet_nl_msg_s *) nlmsg_data(nlmsg_header); + if (!nlmsg_header->nlmsg_pid || + (nlmsg_header->nlmsg_len < sizeof(struct nlmsghdr) + + sizeof(struct rmnet_nl_msg_s))) + return; + LOGL("Netlink message pid=%d, seq=%d, length=%d, rmnet_type=%d", nlmsg_header->nlmsg_pid, nlmsg_header->nlmsg_seq, diff --git a/net/wireless/db.txt b/net/wireless/db.txt index dca387d1c7a7a..b348a0aec0f8d 100644 --- a/net/wireless/db.txt +++ b/net/wireless/db.txt @@ -16,11 +16,11 @@ country 00: (57240 - 63720 @ 2160), (N/A, 0) -country AE: +country AE: DFS-ETSI (2402 - 2482 @ 40), (N/A, 20) - (5170 - 5250 @ 80), (6, 24) - (5250 - 5330 @ 80), (6, 24), DFS - (5490 - 5730 @ 80), (6, 24), DFS + (5170 - 5250 @ 80), (6, 24), AUTO-BW + (5250 - 5330 @ 80), (6, 24), DFS, AUTO-BW + (5490 - 5730 @ 160), (6, 24), DFS (5735 - 5835 @ 80), (6, 30) country AF: DFS-ETSI @@ -53,12 +53,11 @@ country AN: (5490 - 5710 @ 80), (N/A, 27), DFS country AR: - (2402 - 2482 @ 40), (N/A, 20) - (5170 - 5250 @ 80), (6, 24) - (5250 - 5330 @ 80), (6, 24), DFS - (5490 - 5590 @ 80), (6, 24), DFS - (5650 - 5730 @ 80), (6, 24), DFS - (5735 - 5835 @ 80), (6, 30) + (2402 - 2482 @ 40), (N/A, 36) + (5170 - 5330 @ 160), (6, 23) + (5490 - 5590 @ 80), (6, 36) + (5650 - 5730 @ 80), (6, 36) + (5735 - 5835 @ 80), (6, 36) country AS: (2402 - 2472 @ 40), (N/A, 30) @@ -137,9 +136,8 @@ country BG: DFS-ETSI country BH: (2402 - 2482 @ 40), (N/A, 20) - (5170 - 5250 @ 20), (N/A, 20) - (5250 - 5330 @ 20), (N/A, 20), DFS - (5735 - 5835 @ 20), (N/A, 20) + (5170 - 5330 @ 20), (N/A, 23) + (5735 - 5835 @ 20), (N/A, 33) country BL: (2402 - 2482 @ 40), (N/A, 20) @@ -192,8 +190,10 @@ country BY: (5490 - 5710 @ 80), (N/A, 27), DFS country BZ: - (2402 - 2482 @ 40), (N/A, 30) - (5735 - 5835 @ 80), (N/A, 30) + (2402 - 2482 @ 40), (N/A, 36) + (5170 - 5330 @ 160), (N/A, 27) + (5490 - 5730 @ 160), (N/A, 36) + (5735 - 5835 @ 80), (N/A, 36) country CA: (2402 - 2472 @ 40), (N/A, 30) @@ -225,8 +225,7 @@ country CI: country CL: (2402 - 2482 @ 40), (N/A, 20) - (5170 - 5250 @ 80), (N/A, 20) - (5250 - 5330 @ 80), (N/A, 20), DFS + (5170 - 5330 @ 160), (N/A, 20) (5735 - 5835 @ 80), (N/A, 20) country CN: @@ -345,8 +344,8 @@ country EE: DFS-ETSI country EG: (2402 - 2482 @ 40), (N/A, 20) - (5170 - 5250 @ 40), (N/A, 20) - (5250 - 5330 @ 40), (N/A, 20), DFS + (5170 - 5250 @ 40), (N/A, 23) + (5250 - 5330 @ 40), (N/A, 23), DFS country ES: DFS-ETSI (2402 - 2482 @ 40), (N/A, 20) @@ -466,9 +465,8 @@ country HK: country HN: (2402 - 2482 @ 40), (N/A, 20) - (5170 - 5250 @ 80), (6, 24) - (5250 - 5330 @ 80), (6, 24), DFS - (5490 - 5730 @ 80), (6, 24), DFS + (5170 - 5330 @ 160), (6, 24) + (5490 - 5730 @ 160), (6, 24) (5735 - 5835 @ 80), (6, 30) country HR: DFS-ETSI @@ -514,9 +512,8 @@ country IL: country IN: (2402 - 2482 @ 40), (N/A, 20) - (5170 - 5250 @ 80), (N/A, 20) - (5250 - 5330 @ 80), (N/A, 20), DFS - (5735 - 5835 @ 80), (N/A, 20) + (5170 - 5330 @ 160), (N/A, 23) + (5735 - 5835 @ 80), (N/A, 30) country IR: (2402 - 2482 @ 40), (N/A, 20) @@ -569,19 +566,22 @@ country KH: (5250 - 5330 @ 80), (N/A, 20), DFS (5490 - 5710 @ 80), (N/A, 27), DFS -country KN: +country KN: DFS-FCC (2402 - 2482 @ 40), (N/A, 20) - (5170 - 5250 @ 80), (6, 20) - (5250 - 5330 @ 80), (6, 20), DFS + (5170 - 5250 @ 80), (6, 23), AUTO-BW + (5250 - 5330 @ 80), (6, 23), DFS, AUTO-BW (5490 - 5710 @ 80), (6, 30), DFS (5735 - 5815 @ 80), (6, 30) -country KR: +country KR: DFS-ETSI (2402 - 2482 @ 40), (N/A, 20) - (5170 - 5250 @ 80), (6, 20) - (5250 - 5330 @ 80), (6, 20), DFS - (5490 - 5630 @ 80), (6, 30), DFS - (5735 - 5815 @ 80), (6, 30) + (5170 - 5250 @ 80), (6, 20), AUTO-BW + (5250 - 5330 @ 80), (6, 20), DFS, AUTO-BW + (5490 - 5710 @ 80), (6, 30), DFS + (5735 - 5835 @ 80), (6, 30) + # 60 GHz band channels 1-4, + # ref: http://www.law.go.kr/%ED%96%89%EC%A0%95%EA%B7%9C%EC%B9%99/%EB%AC%B4%EC%84%A0%EC%84%A4%EB%B9%84%EA%B7%9C%EC%B9%99 + (57000 - 66000 @ 2160), (6, 43) country KW: (2402 - 2482 @ 40), (N/A, 20) @@ -605,11 +605,11 @@ country LB: (5490 - 5730 @ 80), (6, 24), DFS (5735 - 5835 @ 80), (6, 30) -country LC: +country LC: DFS-FCC (2402 - 2482 @ 40), (N/A, 20) - (5170 - 5250 @ 80), (6, 20) - (5250 - 5330 @ 80), (6, 20), DFS - (5490 - 5710 @ 80), (6, 30), DFS + (5170 - 5250 @ 80), (6, 20), AUTO-BW + (5250 - 5330 @ 80), (6, 30), DFS, AUTO-BW + (5490 - 5710 @ 160), (6, 30), DFS (5735 - 5815 @ 80), (6, 30) country LI: DFS-ETSI @@ -799,8 +799,7 @@ country NO: DFS-ETSI country NP: (2402 - 2482 @ 40), (N/A, 20) - (5170 - 5250 @ 80), (N/A, 20) - (5250 - 5330 @ 80), (N/A, 20), DFS + (5170 - 5330 @ 160), (N/A, 20) (5735 - 5835 @ 80), (N/A, 20) country NZ: @@ -818,9 +817,9 @@ country OM: country PA: (2402 - 2472 @ 40), (N/A, 30) - (5170 - 5250 @ 80), (6, 17) - (5250 - 5330 @ 80), (6, 23), DFS - (5735 - 5835 @ 80), (6, 30) + (5170 - 5250 @ 80), (6, 23), AUT0-BW + (5250 - 5330 @ 80), (6, 30), AUT0-BW + (5735 - 5835 @ 80), (6, 36) country PE: (2402 - 2482 @ 40), (N/A, 20) @@ -933,10 +932,9 @@ country RS: country RU: (2402 - 2482 @ 40), (N/A, 20) - (5170 - 5250 @ 40), (N/A, 20) - (5250 - 5330 @ 40), (N/A, 20), DFS - (5650 - 5710 @ 40), (N/A, 30), DFS - (5735 - 5835 @ 40), (N/A, 30) + (5170 - 5330 @ 160), (N/A, 23) + (5490 - 5730 @ 160), (N/A, 30) + (5735 - 5835 @ 80), (N/A, 30) country RW: (2402 - 2482 @ 40), (N/A, 20) @@ -984,9 +982,8 @@ country SK: DFS-ETSI country SN: (2402 - 2482 @ 40), (N/A, 20) - (5170 - 5250 @ 80), (6, 24) - (5250 - 5330 @ 80), (6, 24), DFS - (5490 - 5730 @ 80), (6, 24), DFS + (5170 - 5330 @ 160), (6, 24) + (5490 - 5730 @ 160), (6, 24) (5735 - 5835 @ 80), (6, 30) country SR: DFS-ETSI @@ -1045,10 +1042,9 @@ country TR: DFS-ETSI country TT: (2402 - 2482 @ 40), (N/A, 20) - (5170 - 5250 @ 80), (6, 24) - (5250 - 5330 @ 80), (6, 24), DFS - (5490 - 5730 @ 80), (6, 24), DFS - (5735 - 5835 @ 80), (6, 30) + (5170 - 5330 @ 160), (6, 27) + (5490 - 5730 @ 160), (6, 36) + (5735 - 5835 @ 80), (6, 36) country TW: (2402 - 2472 @ 40), (N/A, 30) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 66c4482a1d082..7ff15d5bfe88e 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -84,7 +84,6 @@ #include #include #include -#include #include "avc.h" @@ -1677,14 +1676,8 @@ static int may_create(struct inode *dir, return rc; return avc_has_perm(newsid, sbsec->sid, - SECCLASS_FILESYSTEM, - FILESYSTEM__ASSOCIATE, &ad); - if (rc) - return rc; - - rc = pft_inode_mknod(dir, dentry, 0, 0); - - return rc; + SECCLASS_FILESYSTEM, + FILESYSTEM__ASSOCIATE, &ad); } /* Check whether a task can create a key. */ @@ -1740,14 +1733,7 @@ static int may_link(struct inode *dir, return 0; } - rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad); - if (rc) - return rc; - - if (kind == MAY_UNLINK) - rc = pft_inode_unlink(dir, dentry); - - return rc; + return avc_has_perm(sid, isec->sid, isec->sclass, av, &ad); } static inline int may_rename(struct inode *old_dir, @@ -2646,24 +2632,9 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode) { - int ret; - - ret = pft_inode_create(dir, dentry, mode); - if (ret < 0) - return ret; return may_create(dir, dentry, SECCLASS_FILE); } -static int selinux_inode_post_create(struct inode *dir, struct dentry *dentry, - umode_t mode) -{ - int ret; - - ret = pft_inode_post_create(dir, dentry, mode); - - return ret; -} - static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry) { return may_link(dir, old_dentry, MAY_LINK); @@ -2697,12 +2668,6 @@ static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry, struct inode *new_inode, struct dentry *new_dentry) { - int rc; - - rc = pft_inode_rename(old_inode, old_dentry, new_inode, new_dentry); - if (rc) - return rc; - return may_rename(old_inode, old_dentry, new_inode, new_dentry); } @@ -2821,9 +2786,6 @@ static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name) { const struct cred *cred = current_cred(); - if (pft_inode_set_xattr(dentry, name, NULL, 0, 0) < 0) - return -EACCES; - if (!strncmp(name, XATTR_SECURITY_PREFIX, sizeof XATTR_SECURITY_PREFIX - 1)) { if (!strcmp(name, XATTR_NAME_CAPS)) { @@ -3067,16 +3029,11 @@ static int selinux_file_permission(struct file *file, int mask) struct file_security_struct *fsec = file->f_security; struct inode_security_struct *isec = inode->i_security; u32 sid = current_sid(); - int ret; if (!mask) /* No permission to check. Existence test. */ return 0; - ret = pft_file_permission(file, mask); - if (ret < 0) - return ret; - if (sid == fsec->sid && fsec->isid == isec->sid && fsec->pseqno == avc_policy_seqno()) /* No change since file_open check. */ @@ -3370,11 +3327,6 @@ static int selinux_file_open(struct file *file, const struct cred *cred) { struct file_security_struct *fsec; struct inode_security_struct *isec; - int ret; - - ret = pft_file_open(file, cred); - if (ret < 0) - return ret; fsec = file->f_security; isec = file_inode(file)->i_security; @@ -3398,17 +3350,6 @@ static int selinux_file_open(struct file *file, const struct cred *cred) return path_has_perm(cred, &file->f_path, open_file_to_av(file)); } -static int selinux_file_close(struct file *file) -{ - return pft_file_close(file); -} - - -static bool selinux_allow_merge_bio(struct bio *bio1, struct bio *bio2) -{ - return pft_allow_merge_bio(bio1, bio2); -} - /* task security operations */ static int selinux_task_create(unsigned long clone_flags) @@ -5811,7 +5752,6 @@ static struct security_operations selinux_ops = { .inode_free_security = selinux_inode_free_security, .inode_init_security = selinux_inode_init_security, .inode_create = selinux_inode_create, - .inode_post_create = selinux_inode_post_create, .inode_link = selinux_inode_link, .inode_unlink = selinux_inode_unlink, .inode_symlink = selinux_inode_symlink, @@ -5848,8 +5788,6 @@ static struct security_operations selinux_ops = { .file_receive = selinux_file_receive, .file_open = selinux_file_open, - .file_close = selinux_file_close, - .allow_merge_bio = selinux_allow_merge_bio, .task_create = selinux_task_create, .cred_alloc_blank = selinux_cred_alloc_blank, diff --git a/sound/core/info.c b/sound/core/info.c index 08070e1eefeb2..332c9a1ef173c 100644 --- a/sound/core/info.c +++ b/sound/core/info.c @@ -253,6 +253,7 @@ static ssize_t snd_info_entry_write(struct file *file, const char __user *buffer struct snd_info_buffer *buf; ssize_t size = 0; loff_t pos; + unsigned long realloc_size; data = file->private_data; if (snd_BUG_ON(!data)) @@ -261,7 +262,8 @@ static ssize_t snd_info_entry_write(struct file *file, const char __user *buffer pos = *offset; if (pos < 0 || (long) pos != pos || (ssize_t) count < 0) return -EIO; - if ((unsigned long) pos + (unsigned long) count < (unsigned long) pos) + realloc_size = (unsigned long) pos + (unsigned long) count; + if (realloc_size < (unsigned long) pos || realloc_size > UINT_MAX) return -EIO; switch (entry->content) { case SNDRV_INFO_CONTENT_TEXT: diff --git a/sound/soc/codecs/msm8x16-wcd.c b/sound/soc/codecs/msm8x16-wcd.c index 1448f80a3bfd4..bb7584e28d048 100644 --- a/sound/soc/codecs/msm8x16-wcd.c +++ b/sound/soc/codecs/msm8x16-wcd.c @@ -2215,15 +2215,19 @@ static int msm8x16_wcd_codec_enable_micbias(struct snd_soc_dapm_widget *w, micbias2 = (snd_soc_read(codec, MSM8X16_WCD_A_ANALOG_MICB_2_EN) & 0x80); switch (event) { case SND_SOC_DAPM_PRE_PMU: - if (strnstr(w->name, internal1_text, 30)) { + if (strnstr(w->name, internal1_text, strlen(w->name))) { + if (get_codec_version(msm8x16_wcd) == CAJON) + snd_soc_update_bits(codec, + MSM8X16_WCD_A_ANALOG_TX_1_2_ATEST_CTL_2, + 0x02, 0x02); snd_soc_update_bits(codec, micb_int_reg, 0x80, 0x80); - } else if (strnstr(w->name, internal2_text, 30)) { + } else if (strnstr(w->name, internal2_text, strlen(w->name))) { snd_soc_update_bits(codec, micb_int_reg, 0x10, 0x10); snd_soc_update_bits(codec, w->reg, 0x60, 0x00); - } else if (strnstr(w->name, internal3_text, 30)) { + } else if (strnstr(w->name, internal3_text, strlen(w->name))) { snd_soc_update_bits(codec, micb_int_reg, 0x2, 0x2); } - if (!strnstr(w->name, external_text, 30)) + if (!strnstr(w->name, external_text, strlen(w->name))) snd_soc_update_bits(codec, MSM8X16_WCD_A_ANALOG_MICB_1_EN, 0x05, 0x04); if (w->reg == MSM8X16_WCD_A_ANALOG_MICB_1_EN) @@ -2232,28 +2236,28 @@ static int msm8x16_wcd_codec_enable_micbias(struct snd_soc_dapm_widget *w, break; case SND_SOC_DAPM_POST_PMU: usleep_range(20000, 20100); - if (strnstr(w->name, internal1_text, 30)) { + if (strnstr(w->name, internal1_text, strlen(w->name))) { snd_soc_update_bits(codec, micb_int_reg, 0x40, 0x40); - } else if (strnstr(w->name, internal2_text, 30)) { + } else if (strnstr(w->name, internal2_text, strlen(w->name))) { snd_soc_update_bits(codec, micb_int_reg, 0x08, 0x08); msm8x16_notifier_call(codec, WCD_EVENT_PRE_MICBIAS_2_ON); - } else if (strnstr(w->name, internal3_text, 30)) { + } else if (strnstr(w->name, internal3_text, strlen(w->name))) { snd_soc_update_bits(codec, micb_int_reg, 0x01, 0x01); - } else if (strnstr(w->name, external2_text, 30)) { + } else if (strnstr(w->name, external2_text, strlen(w->name))) { msm8x16_notifier_call(codec, WCD_EVENT_PRE_MICBIAS_2_ON); } break; case SND_SOC_DAPM_POST_PMD: - if (strnstr(w->name, internal1_text, 30)) { + if (strnstr(w->name, internal1_text, strlen(w->name))) { snd_soc_update_bits(codec, micb_int_reg, 0xC0, 0x40); - } else if (strnstr(w->name, internal2_text, 30)) { + } else if (strnstr(w->name, internal2_text, strlen(w->name))) { msm8x16_notifier_call(codec, WCD_EVENT_PRE_MICBIAS_2_OFF); - } else if (strnstr(w->name, internal3_text, 30)) { + } else if (strnstr(w->name, internal3_text, strlen(w->name))) { snd_soc_update_bits(codec, micb_int_reg, 0x2, 0x0); - } else if (strnstr(w->name, external2_text, 30)) { + } else if (strnstr(w->name, external2_text, strlen(w->name))) { /* * send micbias turn off event to mbhc driver and then * break, as no need to set MICB_1_EN register. diff --git a/sound/soc/msm/msm-cpe-lsm.c b/sound/soc/msm/msm-cpe-lsm.c index a05b7fd16db20..31f9eb7818201 100644 --- a/sound/soc/msm/msm-cpe-lsm.c +++ b/sound/soc/msm/msm-cpe-lsm.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013-2014, Linux Foundation. All rights reserved. + * Copyright (c) 2013-2014, 2017 Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -793,13 +793,6 @@ static int msm_cpe_lsm_ioctl_shared(struct snd_pcm_substream *substream, dev_dbg(rtd->dev, "%s: %s\n", __func__, "SNDRV_LSM_REG_SND_MODEL_V2"); - if (!arg) { - dev_err(rtd->dev, - "%s: Invalid argument to ioctl %s\n", - __func__, - "SNDRV_LSM_REG_SND_MODEL_V2"); - return -EINVAL; - } memcpy(&snd_model, arg, sizeof(struct snd_lsm_sound_model_v2)); @@ -926,13 +919,6 @@ static int msm_cpe_lsm_ioctl_shared(struct snd_pcm_substream *substream, dev_dbg(rtd->dev, "%s: %s\n", __func__, "SNDRV_LSM_EVENT_STATUS"); - if (!arg) { - dev_err(rtd->dev, - "%s: Invalid argument to ioctl %s\n", - __func__, - "SNDRV_LSM_EVENT_STATUS"); - return -EINVAL; - } user = arg; @@ -1035,12 +1021,6 @@ static int msm_cpe_lsm_ioctl_shared(struct snd_pcm_substream *substream, break; case SNDRV_LSM_SET_PARAMS: - if (!arg) { - dev_err(rtd->dev, - "%s: %s Invalid argument\n", - __func__, "SNDRV_LSM_SET_PARAMS"); - return -EINVAL; - } memcpy(&det_params, arg, sizeof(det_params)); if (det_params.num_confidence_levels <= 0) { @@ -1305,12 +1285,6 @@ static int msm_cpe_lsm_ioctl(struct snd_pcm_substream *substream, } #ifdef CONFIG_COMPAT -struct snd_lsm_event_status32 { - u16 status; - u16 payload_size; - u8 payload[0]; -}; - struct snd_lsm_sound_model_v2_32 { compat_uptr_t data; compat_uptr_t confidence_level; @@ -1328,8 +1302,6 @@ struct snd_lsm_detection_params_32 { }; enum { - SNDRV_LSM_EVENT_STATUS32 = - _IOW('U', 0x02, struct snd_lsm_event_status32), SNDRV_LSM_REG_SND_MODEL_V2_32 = _IOW('U', 0x07, struct snd_lsm_sound_model_v2_32), SNDRV_LSM_SET_PARAMS32 = @@ -1416,7 +1388,7 @@ static int msm_cpe_lsm_ioctl_compat(struct snd_pcm_substream *substream, err); } break; - case SNDRV_LSM_EVENT_STATUS32: { + case SNDRV_LSM_EVENT_STATUS: { struct snd_lsm_event_status *event_status = NULL; struct snd_lsm_event_status u_event_status32; struct snd_lsm_event_status *udata_32 = NULL; @@ -1458,7 +1430,6 @@ static int msm_cpe_lsm_ioctl_compat(struct snd_pcm_substream *substream, } else { event_status->payload_size = u_event_status32.payload_size; - cmd = SNDRV_LSM_EVENT_STATUS; err = msm_cpe_lsm_ioctl_shared(substream, cmd, event_status); if (err) @@ -1533,7 +1504,18 @@ static int msm_cpe_lsm_ioctl_compat(struct snd_pcm_substream *substream, break; } - + case SNDRV_LSM_REG_SND_MODEL_V2: + case SNDRV_LSM_SET_PARAMS: + /* + * In ideal cases, the compat_ioctl should never be called + * with the above unlocked ioctl commands. Print error + * and return error if it does. + */ + dev_err(rtd->dev, + "%s: Invalid cmd for compat_ioctl\n", + __func__); + err = -EINVAL; + break; default: err = msm_cpe_lsm_ioctl_shared(substream, cmd, arg); break; diff --git a/sound/soc/msm/qdsp6v2/audio_cal_utils.c b/sound/soc/msm/qdsp6v2/audio_cal_utils.c index 3fe659e80aea8..3ac81b2bc6858 100644 --- a/sound/soc/msm/qdsp6v2/audio_cal_utils.c +++ b/sound/soc/msm/qdsp6v2/audio_cal_utils.c @@ -536,7 +536,6 @@ static struct cal_block_data *create_cal_block(struct cal_type_data *cal_type, memset(cal_block, 0, sizeof(*cal_block)); INIT_LIST_HEAD(&cal_block->list); - list_add_tail(&cal_block->list, &cal_type->cal_blocks); cal_block->map_data.ion_map_handle = basic_cal->cal_data.mem_handle; if (basic_cal->cal_data.mem_handle > 0) { @@ -568,7 +567,8 @@ static struct cal_block_data *create_cal_block(struct cal_type_data *cal_type, goto err; } cal_block->buffer_number = basic_cal->cal_hdr.buffer_number; - pr_debug("%s: created block for cal type %d, buf num %d, map handle %d, map size %zd paddr 0x%pa!\n", + list_add_tail(&cal_block->list, &cal_type->cal_blocks); + pr_debug("%s: created block for cal type %d, buf num %d, map handle %d, map size %zd paddr 0x%pK!\n", __func__, cal_type->info.reg.cal_type, cal_block->buffer_number, cal_block->map_data.ion_map_handle, @@ -577,6 +577,8 @@ static struct cal_block_data *create_cal_block(struct cal_type_data *cal_type, done: return cal_block; err: + kfree(cal_block->cal_info); + kfree(cal_block->client_info); kfree(cal_block); cal_block = NULL; return cal_block; diff --git a/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c index 8eee5338eb0e8..a2df13ace3916 100644 --- a/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c @@ -1152,6 +1152,7 @@ static int msm_compr_free(struct snd_compr_stream *cstream) kfree(pdata->dec_params[soc_prtd->dai_link->be_id]); pdata->dec_params[soc_prtd->dai_link->be_id] = NULL; kfree(prtd); + runtime->private_data = NULL; return 0; } diff --git a/sound/soc/msm/qdsp6v2/msm-dai-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-dai-q6-v2.c index 1314b0cdb1002..22b9e4b48ea07 100644 --- a/sound/soc/msm/qdsp6v2/msm-dai-q6-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-dai-q6-v2.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2015, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1277,6 +1277,11 @@ static int msm_dai_q6_set_channel_map(struct snd_soc_dai *dai, pr_err("%s: rx slot not found\n", __func__); return -EINVAL; } + if (rx_num > AFE_PORT_MAX_AUDIO_CHAN_CNT) { + pr_err("%s: invalid rx num %d\n", __func__, rx_num); + return -EINVAL; + } + for (i = 0; i < rx_num; i++) { dai_data->port_config.slim_sch.shared_ch_mapping[i] = rx_slot[i]; @@ -1307,6 +1312,11 @@ static int msm_dai_q6_set_channel_map(struct snd_soc_dai *dai, pr_err("%s: tx slot not found\n", __func__); return -EINVAL; } + if (tx_num > AFE_PORT_MAX_AUDIO_CHAN_CNT) { + pr_err("%s: invalid tx num %d\n", __func__, tx_num); + return -EINVAL; + } + for (i = 0; i < tx_num; i++) { dai_data->port_config.slim_sch.shared_ch_mapping[i] = tx_slot[i]; diff --git a/sound/soc/msm/qdsp6v2/msm-dolby-dap-config.c b/sound/soc/msm/qdsp6v2/msm-dolby-dap-config.c index e894093c26a95..54788bd0cb905 100644 --- a/sound/soc/msm/qdsp6v2/msm-dolby-dap-config.c +++ b/sound/soc/msm/qdsp6v2/msm-dolby-dap-config.c @@ -681,7 +681,7 @@ int msm_dolby_dap_param_to_set_control_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) { int rc = 0, port_id, copp_idx; - uint32_t idx, j; + uint32_t idx, j, current_offset; uint32_t device = ucontrol->value.integer.value[0]; uint32_t param_id = ucontrol->value.integer.value[1]; uint32_t offset = ucontrol->value.integer.value[2]; @@ -758,6 +758,19 @@ int msm_dolby_dap_param_to_set_control_put(struct snd_kcontrol *kcontrol, default: { /* cache the parameters */ dolby_dap_params_modified[idx] += 1; + current_offset = dolby_dap_params_offset[idx] + offset; + if (current_offset >= TOTAL_LENGTH_DOLBY_PARAM) { + pr_err("%s: invalid offset %d at idx %d\n", + __func__, offset, idx); + return -EINVAL; + } + if ((0 == length) || (current_offset + length - 1 + < current_offset) || (current_offset + length + > TOTAL_LENGTH_DOLBY_PARAM)) { + pr_err("%s: invalid length %d at idx %d\n", + __func__, length, idx); + return -EINVAL; + } dolby_dap_params_length[idx] = length; pr_debug("%s: param recvd deviceId=0x%x paramId=0x%x offset=%d length=%d\n", __func__, device, param_id, offset, length); diff --git a/sound/soc/msm/qdsp6v2/msm-dts-eagle.c b/sound/soc/msm/qdsp6v2/msm-dts-eagle.c index 2ca9a3e099512..d691712257631 100644 --- a/sound/soc/msm/qdsp6v2/msm-dts-eagle.c +++ b/sound/soc/msm/qdsp6v2/msm-dts-eagle.c @@ -234,7 +234,8 @@ static s32 _volume_cmds_alloc1(s32 size) if (_vol_cmds) { _vol_cmds_d = kzalloc(_vol_cmd_cnt * sizeof(struct vol_cmds_d), GFP_KERNEL); - } + } else + _vol_cmd_cnt = 0; if (_vol_cmds_d) return 0; _volume_cmds_free(); diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-afe-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-afe-v2.c index d3d1891763dca..8ab83d2c64021 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-afe-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-afe-v2.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -499,6 +499,7 @@ static int msm_afe_close(struct snd_pcm_substream *substream) mutex_unlock(&prtd->lock); prtd->prepared--; kfree(prtd); + runtime->private_data = NULL; return 0; } static int msm_afe_prepare(struct snd_pcm_substream *substream) diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-loopback-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-loopback-v2.c index 5d24a0cd55b76..0f3e5123ae715 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-loopback-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-loopback-v2.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2014, 2017, The Linux Foundation. All rights reserved. * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -48,7 +48,7 @@ struct msm_pcm_loopback { int capture_start; int session_id; struct audio_client *audio_client; - int volume; + uint32_t volume; }; static void stop_pcm(struct msm_pcm_loopback *pcm); @@ -108,7 +108,8 @@ static void msm_pcm_loopback_event_handler(uint32_t opcode, uint32_t token, } } -static int pcm_loopback_set_volume(struct msm_pcm_loopback *prtd, int volume) +static int pcm_loopback_set_volume(struct msm_pcm_loopback *prtd, + uint32_t volume) { int rc = -EINVAL; @@ -354,10 +355,49 @@ static int msm_pcm_volume_ctl_put(struct snd_kcontrol *kcontrol, int rc = 0; struct snd_pcm_volume *vol = kcontrol->private_data; struct snd_pcm_substream *substream = vol->pcm->streams[0].substream; - struct msm_pcm_loopback *prtd = substream->runtime->private_data; + struct msm_pcm_loopback *prtd; int volume = ucontrol->value.integer.value[0]; + pr_debug("%s: volume : 0x%x\n", __func__, volume); + if ((!substream) || (!substream->runtime)) { + pr_err("%s substream or runtime not found\n", __func__); + rc = -ENODEV; + goto exit; + } + prtd = substream->runtime->private_data; + if (!prtd) { + rc = -ENODEV; + goto exit; + } rc = pcm_loopback_set_volume(prtd, volume); + +exit: + return rc; +} + +static int msm_pcm_volume_ctl_get(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_value *ucontrol) +{ + int rc = 0; + struct snd_pcm_volume *vol = snd_kcontrol_chip(kcontrol); + struct snd_pcm_substream *substream = + vol->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream; + struct msm_pcm_loopback *prtd; + + pr_debug("%s\n", __func__); + if ((!substream) || (!substream->runtime)) { + pr_err("%s substream or runtime not found\n", __func__); + rc = -ENODEV; + goto exit; + } + prtd = substream->runtime->private_data; + if (!prtd) { + rc = -ENODEV; + goto exit; + } + ucontrol->value.integer.value[0] = prtd->volume; + +exit: return rc; } @@ -377,6 +417,7 @@ static int msm_pcm_add_controls(struct snd_soc_pcm_runtime *rtd) return ret; kctl = volume_info->kctl; kctl->put = msm_pcm_volume_ctl_put; + kctl->get = msm_pcm_volume_ctl_get; kctl->tlv.p = loopback_rx_vol_gain; return 0; } diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-lpa-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-lpa-v2.c index 64d3fe086a6a1..507d01a009956 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-lpa-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-lpa-v2.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2014, 2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -497,6 +497,7 @@ static int msm_pcm_playback_close(struct snd_pcm_substream *substream) pr_debug("%s\n", __func__); kfree(prtd); + runtime->private_data = NULL; return 0; } diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-q6-noirq.c b/sound/soc/msm/qdsp6v2/msm-pcm-q6-noirq.c index 7c690812580d9..de126e1170f40 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-q6-noirq.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-q6-noirq.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -517,6 +517,7 @@ static int msm_pcm_close(struct snd_pcm_substream *substream) SNDRV_PCM_STREAM_PLAYBACK : SNDRV_PCM_STREAM_CAPTURE); kfree(prtd); + runtime->private_data = NULL; return 0; } diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c index 455607b349aa7..b8dbc6360a615 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -721,6 +721,8 @@ static int msm_pcm_playback_close(struct snd_pcm_substream *substream) msm_pcm_routing_dereg_phy_stream(soc_prtd->dai_link->be_id, SNDRV_PCM_STREAM_PLAYBACK); kfree(prtd); + runtime->private_data = NULL; + return 0; } @@ -824,6 +826,7 @@ static int msm_pcm_capture_close(struct snd_pcm_substream *substream) msm_pcm_routing_dereg_phy_stream(soc_prtd->dai_link->be_id, SNDRV_PCM_STREAM_CAPTURE); kfree(prtd); + runtime->private_data = NULL; return 0; } diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c index 4305679ab9f66..24a3a4cb33558 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1640,6 +1640,11 @@ static int msm_routing_ec_ref_rx_put(struct snd_kcontrol *kcontrol, int mux = ucontrol->value.enumerated.item[0]; struct soc_enum *e = (struct soc_enum *)kcontrol->private_value; + if (mux >= e->max) { + pr_err("%s: Invalid mux value %d\n", __func__, mux); + return -EINVAL; + } + mutex_lock(&routing_lock); switch (ucontrol->value.integer.value[0]) { case 0: @@ -1875,6 +1880,10 @@ static int msm_routing_ext_ec_put(struct snd_kcontrol *kcontrol, pr_debug("%s: msm_route_ec_ref_rx = %d value = %ld\n", __func__, msm_route_ext_ec_ref, ucontrol->value.integer.value[0]); + if (mux >= e->max) { + pr_err("%s: Invalid mux value %d\n", __func__, mux); + return -EINVAL; + } mutex_lock(&routing_lock); switch (ucontrol->value.integer.value[0]) { diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-voip-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-voip-v2.c index 08c4f2ac6401b..53f57cd39a949 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-voip-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-voip-v2.c @@ -827,6 +827,11 @@ static int msm_pcm_playback_copy(struct snd_pcm_substream *substream, int a, (sizeof(buf_node->frame.frm_hdr) + sizeof(buf_node->frame.pktlen)); } + if (ret) { + pr_err("%s: copy from user failed %d\n", + __func__, ret); + return -EFAULT; + } spin_lock_irqsave(&prtd->dsp_lock, dsp_flags); list_add_tail(&buf_node->list, &prtd->in_queue); spin_unlock_irqrestore(&prtd->dsp_lock, dsp_flags); diff --git a/sound/soc/msm/qdsp6v2/q6adm.c b/sound/soc/msm/qdsp6v2/q6adm.c index e2978dff78ca5..e4e62604ec92e 100644 --- a/sound/soc/msm/qdsp6v2/q6adm.c +++ b/sound/soc/msm/qdsp6v2/q6adm.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2015, 2016, 2017 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1067,9 +1067,10 @@ int adm_get_params(int port_id, int copp_idx, uint32_t module_id, uint32_t param_id, uint32_t params_length, char *params) { struct adm_cmd_get_pp_params_v5 *adm_params = NULL; - int sz, rc = 0, i = 0; + int rc = 0, i = 0; int port_idx, idx; int *params_data = (int *)params; + uint64_t sz = 0; port_id = afe_convert_virtual_to_portid(port_id); port_idx = adm_validate_and_get_port_index(port_id); @@ -1078,7 +1079,16 @@ int adm_get_params(int port_id, int copp_idx, uint32_t module_id, return -EINVAL; } - sz = sizeof(struct adm_cmd_get_pp_params_v5) + params_length; + sz = (uint64_t)sizeof(struct adm_cmd_get_pp_params_v5) + + (uint64_t)params_length; + /* + * Check if the value of "sz" (which is ultimately assigned to + * "hdr.pkt_size") crosses U16_MAX. + */ + if (sz > U16_MAX) { + pr_err("%s: Invalid params_length\n", __func__); + return -EINVAL; + } adm_params = kzalloc(sz, GFP_KERNEL); if (!adm_params) { pr_err("%s: adm params memory alloc failed", __func__); diff --git a/sound/soc/msm/qdsp6v2/q6afe.c b/sound/soc/msm/qdsp6v2/q6afe.c index a762ab505bf23..4f7a0147eaddd 100644 --- a/sound/soc/msm/qdsp6v2/q6afe.c +++ b/sound/soc/msm/qdsp6v2/q6afe.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2015, 2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -2533,8 +2533,9 @@ int q6afe_audio_client_buf_alloc_contiguous(unsigned int dir, struct afe_audio_buffer *buf; size_t len; - if (!(ac) || ((dir != IN) && (dir != OUT))) { - pr_err("%s: ac %p dir %d\n", __func__, ac, dir); + if (!(ac) || !(bufsz) || ((dir != IN) && (dir != OUT))) { + pr_err("%s: ac %p bufsz %d dir %d\n", __func__, ac, bufsz, + dir); return -EINVAL; } @@ -3176,7 +3177,7 @@ static ssize_t afe_debug_write(struct file *filp, lbuf[cnt] = '\0'; - if (!strncmp(lb_str, "afe_loopback", 12)) { + if (!strcmp(lb_str, "afe_loopback")) { rc = afe_get_parameters(lbuf, param, 3); if (!rc) { pr_info("%s: %lu %lu %lu\n", lb_str, param[0], param[1], @@ -3205,7 +3206,7 @@ static ssize_t afe_debug_write(struct file *filp, rc = -EINVAL; } - } else if (!strncmp(lb_str, "afe_loopback_gain", 17)) { + } else if (!strcmp(lb_str, "afe_loopback_gain")) { rc = afe_get_parameters(lbuf, param, 2); if (!rc) { pr_info("%s: %s %lu %lu\n", diff --git a/sound/soc/msm/qdsp6v2/q6asm.c b/sound/soc/msm/qdsp6v2/q6asm.c index 8381b0fbfe8e7..523b1ae61a473 100755 --- a/sound/soc/msm/qdsp6v2/q6asm.c +++ b/sound/soc/msm/qdsp6v2/q6asm.c @@ -2713,7 +2713,8 @@ int q6asm_set_shared_circ_buff(struct audio_client *ac, int dir) { struct audio_buffer *buf_circ; - int bytes_to_alloc, rc, len; + int bytes_to_alloc, rc; + size_t len; buf_circ = kzalloc(sizeof(struct audio_buffer), GFP_KERNEL); @@ -2732,7 +2733,7 @@ int q6asm_set_shared_circ_buff(struct audio_client *ac, rc = msm_audio_ion_alloc("audio_client", &buf_circ->client, &buf_circ->handle, bytes_to_alloc, (ion_phys_addr_t *)&buf_circ->phys, - (size_t *)&len, &buf_circ->data); + &len, &buf_circ->data); if (rc) { pr_err("%s: Audio ION alloc is failed, rc = %d\n", __func__, @@ -2774,7 +2775,8 @@ int q6asm_set_shared_pos_buff(struct audio_client *ac, int dir) { struct audio_buffer *buf_pos = &ac->shared_pos_buf; - int len, rc; + int rc; + size_t len; int bytes_to_alloc = sizeof(struct asm_shared_position_buffer); mutex_lock(&ac->cmd_lock); @@ -2783,7 +2785,7 @@ int q6asm_set_shared_pos_buff(struct audio_client *ac, rc = msm_audio_ion_alloc("audio_client", &buf_pos->client, &buf_pos->handle, bytes_to_alloc, - (ion_phys_addr_t *)&buf_pos->phys, (size_t *)&len, + (ion_phys_addr_t *)&buf_pos->phys, &len, &buf_pos->data); if (rc) { @@ -4837,7 +4839,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir, struct asm_buffer_node *buffer_node = NULL; int rc = 0; int i = 0; - int cmd_size = 0; + uint32_t cmd_size = 0; uint32_t bufcnt_t; uint32_t bufsz_t; @@ -4859,10 +4861,25 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir, bufsz_t = PAGE_ALIGN(bufsz_t); } + if (bufcnt_t > (UINT_MAX + - sizeof(struct avs_cmd_shared_mem_map_regions)) + / sizeof(struct avs_shared_map_region_payload)) { + pr_err("%s: Unsigned Integer Overflow. bufcnt_t = %u\n", + __func__, bufcnt_t); + return -EINVAL; + } + cmd_size = sizeof(struct avs_cmd_shared_mem_map_regions) + (sizeof(struct avs_shared_map_region_payload) * bufcnt_t); + + if (bufcnt > (UINT_MAX / sizeof(struct asm_buffer_node))) { + pr_err("%s: Unsigned Integer Overflow. bufcnt = %u\n", + __func__, bufcnt); + return -EINVAL; + } + buffer_node = kzalloc(sizeof(struct asm_buffer_node) * bufcnt, GFP_KERNEL); if (!buffer_node) { diff --git a/sound/soc/msm/qdsp6v2/q6voice.h b/sound/soc/msm/qdsp6v2/q6voice.h index 99bf206455f72..382a71d92b749 100644 --- a/sound/soc/msm/qdsp6v2/q6voice.h +++ b/sound/soc/msm/qdsp6v2/q6voice.h @@ -126,7 +126,7 @@ struct share_mem_buf { struct mem_map_table { dma_addr_t phys; void *data; - uint32_t size; /* size of buffer */ + size_t size; /* size of buffer */ struct ion_handle *handle; struct ion_client *client; }; diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c index 4300fe35882a0..add5b9776fc0f 100644 --- a/sound/soc/soc-compress.c +++ b/sound/soc/soc-compress.c @@ -569,6 +569,11 @@ static int soc_compr_set_params_fe(struct snd_compr_stream *cstream, cstream, &async_domain); } else { be_list[j++] = be; + if (j == DPCM_MAX_BE_USERS) { + dev_dbg(fe->dev, + "ASoC: MAX backend users!\n"); + break; + } } } for (i = 0; i < j; i++) { diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 0e928a7fcec43..8206c3f0b9b7f 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -1845,6 +1845,10 @@ void dpcm_be_dai_prepare_async(struct snd_soc_pcm_runtime *fe, int stream, dpcm, domain); } else { dpcm_async[i++] = dpcm; + if (i == DPCM_MAX_BE_USERS) { + dev_dbg(fe->dev, "ASoC: MAX backend users!\n"); + break; + } } } diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c index fa6ca030e3b83..4b8a6eb2e65d8 100644 --- a/sound/usb/endpoint.c +++ b/sound/usb/endpoint.c @@ -334,7 +334,7 @@ static void queue_pending_output_urbs(struct snd_usb_endpoint *ep) err = usb_submit_urb(ctx->urb, GFP_ATOMIC); if (err < 0) - snd_printk(KERN_ERR "Unable to submit urb #%d: %d (urb %p)\n", + snd_printk(KERN_ERR "Unable to submit urb #%d: %d (urb %pK)\n", ctx->index, err, ctx->urb); else set_bit(ctx->index, &ep->active_mask); @@ -430,7 +430,7 @@ struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip, if (ep->ep_num == ep_num && ep->iface == alts->desc.bInterfaceNumber && ep->alt_idx == alts->desc.bAlternateSetting) { - snd_printdd(KERN_DEBUG "Re-using EP %x in iface %d,%d @%p\n", + snd_printdd(KERN_DEBUG "Re-using EP %x in iface %d,%d @%pK\n", ep_num, ep->iface, ep->alt_idx, ep); goto __exit_unlock; } diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index 0d7a872dab36f..05f333ff9c7b0 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -228,7 +228,7 @@ static int start_endpoints(struct snd_usb_substream *subs, bool can_sleep) if (!test_and_set_bit(SUBSTREAM_FLAG_DATA_EP_STARTED, &subs->flags)) { struct snd_usb_endpoint *ep = subs->data_endpoint; - snd_printdd(KERN_DEBUG "Starting data EP @%p\n", ep); + snd_printdd(KERN_DEBUG "Starting data EP @%pK\n", ep); ep->data_subs = subs; err = snd_usb_endpoint_start(ep, can_sleep); @@ -257,7 +257,7 @@ static int start_endpoints(struct snd_usb_substream *subs, bool can_sleep) } } - snd_printdd(KERN_DEBUG "Starting sync EP @%p\n", ep); + snd_printdd(KERN_DEBUG "Starting sync EP @%pK\n", ep); ep->sync_slave = subs->data_endpoint; err = snd_usb_endpoint_start(ep, can_sleep); @@ -474,12 +474,12 @@ static int match_endpoint_audioformats(struct audioformat *fp, int score = 0; if (fp->channels < 1) { - snd_printdd("%s: (fmt @%p) no channels\n", __func__, fp); + snd_printdd("%s: (fmt @%pK) no channels\n", __func__, fp); return 0; } if (!(fp->formats & pcm_format_to_bits(pcm_format))) { - snd_printdd("%s: (fmt @%p) no match for format %d\n", __func__, + snd_printdd("%s: (fmt @%pK) no match for format %d\n", __func__, fp, pcm_format); return 0; } @@ -491,7 +491,7 @@ static int match_endpoint_audioformats(struct audioformat *fp, } } if (!score) { - snd_printdd("%s: (fmt @%p) no match for rate %d\n", __func__, + snd_printdd("%s: (fmt @%pK) no match for rate %d\n", __func__, fp, rate); return 0; } @@ -499,7 +499,7 @@ static int match_endpoint_audioformats(struct audioformat *fp, if (fp->channels == match->channels) score++; - snd_printdd("%s: (fmt @%p) score %d\n", __func__, fp, score); + snd_printdd("%s: (fmt @%pK) score %d\n", __func__, fp, score); return score; }