https://source.android.com/docs/security/bulletin/2023-12-01 * tag 'ASB-2023-12-05_4.14-stable' of https://android.googlesource.com/kernel/common: Linux 4.14.331 net: sched: fix race condition in qdisc_graft() scsi: virtio_scsi: limit number of hw queues by nr_cpu_ids ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks ext4: correct return value of ext4_convert_meta_bg ext4: correct offset of gdb backup in non meta_bg group to update_backups ext4: apply umask if ACL support is disabled media: venus: hfi: fix the check to handle session buffer requirement media: sharp: fix sharp encoding i2c: i801: fix potential race in i801_block_transaction_byte_by_byte net: dsa: lan9303: consequently nested-lock physical MDIO ALSA: info: Fix potential deadlock at disconnection parisc/pgtable: Do not drop upper 5 address bits of physical address parisc: Prevent booting 64-bit kernels on PA1.x machines mcb: fix error handling for different scenarios when parsing jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware mmc: meson-gx: Remove setting of CMD_CFG_ERROR PM: hibernate: Clean up sync_read handling in snapshot_write_next() PM: hibernate: Use __get_safe_page() rather than touching the list mmc: vub300: fix an error code PCI/sysfs: Protect driver's D3cold preference from user space hvc/xen: fix error path in xen_hvc_init() to always register frontend driver audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() audit: don't take task_lock() in audit_exe_compare() code path KVM: x86: Ignore MSR_AMD64_TW_CFG access randstruct: Fix gcc-plugin performance mode to stay in group media: venus: hfi: add checks to perform sanity on queue pointers pwm: Fix double shift bug gfs2: ignore negated quota changes media: vivid: avoid integer overflow media: gspca: cpia1: shift-out-of-bounds in set_flicker i2c: sun6i-p2wi: Prevent potential division by zero tty: vcc: Add check for kstrdup() in vcc_probe() scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() atm: iphase: Do PCI error checks on own line ALSA: hda: Fix possible null-ptr-deref when assigning a stream jfs: fix array-index-out-of-bounds in diAlloc jfs: fix array-index-out-of-bounds in dbFindLeaf fs/jfs: Add validity check for db_maxag and db_agpref fs/jfs: Add check for negative db_l2nbperpage RDMA/hfi1: Use FIELD_GET() to extract Link Width crypto: pcrypt - Fix hungtask for PADATA_RESET selftests/efivarfs: create-read: fix a resource leak drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 net: annotate data-races around sk->sk_dst_pending_confirm wifi: ath10k: fix clang-specific fortify warning wifi: ath9k: fix clang-specific fortify warnings wifi: mac80211: don't return unset power in ieee80211_get_tx_power() x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware clocksource/drivers/timer-imx-gpt: Fix potential memory leak locking/ww_mutex/test: Fix potential workqueue corruption Linux 4.14.330 btrfs: use u64 for buffer sizes in the tree search ioctls Revert "mmc: core: Capture correct oemid-bits for eMMC cards" fbdev: fsl-diu-fb: mark wr_reg_wa() static netfilter: xt_recent: fix (increase) ipv6 literal buffer length tg3: power down device only on SYSTEM_POWER_OFF dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. dccp: Call security_inet_conn_request() after setting IPv4 addresses. tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING llc: verify mac len before reading mac header pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume media: dvb-usb-v2: af9035: fix missing unlock media: s3c-camif: Avoid inappropriate kfree() pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() pcmcia: ds: fix refcount leak in pcmcia_device_add() pcmcia: cs: fix possible hung task and memory leak pccardd() dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() USB: usbip: fix stub_dev hub disconnect misc: st_core: Do not call kfree_skb() under spin_lock_irqsave() dmaengine: ti: edma: handle irq_of_parse_and_map() errors usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency tty: tty_jobctrl: fix pid memleak in disassociate_ctty() mfd: dln2: Fix double put in dln2_probe ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails sh: bios: Revive earlyprintk support RDMA/hfi1: Workaround truncation compilation error ext4: move 'ix' sanity check to corrent position ARM: 9321/1: memset: cast the constant byte to unsigned char hwrng: geode - fix accessing registers firmware: ti_sci: Mark driver as non removable ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe() drm/radeon: possible buffer overflow drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs platform/x86: wmi: Fix probe failure when failing to register WMI devices clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data clk: keystone: pll: fix a couple NULL vs IS_ERR() checks clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies ipv6: avoid atomic fragment on GSO packets ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() thermal: core: prevent potential string overflow wifi: rtlwifi: fix EDCA limit set by BT coexistence tcp_metrics: do not create an entry from tcp_init_metrics() tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics() i40e: fix potential memory leaks in i40e_remove() Linux 4.14.329 tty: 8250: Add support for Intashield IS-100 tty: 8250: Add support for Brainboxes UP cards tty: 8250: Add support for additional Brainboxes UC cards tty: 8250: Remove UC-257 and UC-431 usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF remove the sx8 block driver ata: ahci: fix enum constants for gcc-13 net: chelsio: cxgb4: add an error code check in t4_load_phy_fw platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e scsi: mpt3sas: Fix in error path fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit() ASoC: rt5650: fix the wrong result of key button netfilter: nfnetlink_log: silence bogus compiler warning fbdev: atyfb: only use ioremap_uc() on i386 and ia64 Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe irqchip/stm32-exti: add missing DT IRQ flag translation ASoC: simple-card: fixup asoc_simple_probe() error handling x86: Fix .brk attribute in linker script rpmsg: Fix possible refcount leak in rpmsg_register_device_override() rpmsg: glink: Release driver_override rpmsg: Fix calling device_lock() on non-initialized device rpmsg: Fix kfree() of static memory on setting driver_override driver: platform: Add helper for safer setting of driver_override x86/mm: Fix RESERVE_BRK() for older binutils x86/mm: Simplify RESERVE_BRK() x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility nfsd: lock_rename() needs both directories to live on the same fs f2fs: fix to do sanity check on inode type during garbage collection kobject: Fix slab-out-of-bounds in fill_kobj_path() drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper() ARM: 8933/1: replace Sun/Solaris style flag on section directive NFS: Don't call generic_error_remove_page() while holding locks perf/core: Fix potential NULL deref i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node() i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node() i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR gtp: uapi: fix GTPA_MAX tcp: fix wrong RTO timeout when received SACK reneging r8152: Increase USB control msg timeout to 5000ms as per spec igb: Fix potential memory leak in igb_add_ethtool_nfc_entry treewide: Spelling fix in comment virtio_balloon: Fix endless deflation and inflation on arm64 mcb-lpc: Reallocate memory region to avoid memory overlapping mcb: Return actual parsed size when reading chameleon table Conflicts: drivers/thermal/thermal_core.c Change-Id: I64355614cacfe9ee917f28a539e83e28a555af58
325 lines
9.5 KiB
C
325 lines
9.5 KiB
C
/*
|
|
* Remote processor messaging
|
|
*
|
|
* Copyright (C) 2011 Texas Instruments, Inc.
|
|
* Copyright (C) 2011 Google, Inc.
|
|
* All rights reserved.
|
|
* Copyright (c) 2018, The Linux Foundation. All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
*
|
|
* * Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* * Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in
|
|
* the documentation and/or other materials provided with the
|
|
* distribution.
|
|
* * Neither the name Texas Instruments nor the names of its
|
|
* contributors may be used to endorse or promote products derived
|
|
* from this software without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
|
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
|
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
|
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#ifndef _LINUX_RPMSG_H
|
|
#define _LINUX_RPMSG_H
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/device.h>
|
|
#include <linux/err.h>
|
|
#include <linux/mod_devicetable.h>
|
|
#include <linux/kref.h>
|
|
#include <linux/mutex.h>
|
|
#include <linux/poll.h>
|
|
|
|
#define RPMSG_ADDR_ANY 0xFFFFFFFF
|
|
|
|
struct rpmsg_device;
|
|
struct rpmsg_endpoint;
|
|
struct rpmsg_device_ops;
|
|
struct rpmsg_endpoint_ops;
|
|
|
|
/**
|
|
* struct rpmsg_channel_info - channel info representation
|
|
* @name: name of service
|
|
* @src: local address
|
|
* @dst: destination address
|
|
*/
|
|
struct rpmsg_channel_info {
|
|
char name[RPMSG_NAME_SIZE];
|
|
u32 src;
|
|
u32 dst;
|
|
};
|
|
|
|
/**
|
|
* rpmsg_device - device that belong to the rpmsg bus
|
|
* @dev: the device struct
|
|
* @id: device id (used to match between rpmsg drivers and devices)
|
|
* @driver_override: driver name to force a match; do not set directly,
|
|
* because core frees it; use driver_set_override() to
|
|
* set or clear it.
|
|
* @src: local address
|
|
* @dst: destination address
|
|
* @ept: the rpmsg endpoint of this channel
|
|
* @announce: if set, rpmsg will announce the creation/removal of this channel
|
|
*/
|
|
struct rpmsg_device {
|
|
struct device dev;
|
|
struct rpmsg_device_id id;
|
|
const char *driver_override;
|
|
u32 src;
|
|
u32 dst;
|
|
struct rpmsg_endpoint *ept;
|
|
bool announce;
|
|
|
|
const struct rpmsg_device_ops *ops;
|
|
};
|
|
|
|
typedef int (*rpmsg_rx_cb_t)(struct rpmsg_device *, void *, int, void *, u32);
|
|
typedef int (*rpmsg_rx_sig_t)(struct rpmsg_device *, u32, u32);
|
|
|
|
/**
|
|
* struct rpmsg_endpoint - binds a local rpmsg address to its user
|
|
* @rpdev: rpmsg channel device
|
|
* @refcount: when this drops to zero, the ept is deallocated
|
|
* @cb: rx callback handler
|
|
* @sig_cb: rx serial signal handler
|
|
* @cb_lock: must be taken before accessing/changing @cb
|
|
* @addr: local rpmsg address
|
|
* @priv: private data for the driver's use
|
|
*
|
|
* In essence, an rpmsg endpoint represents a listener on the rpmsg bus, as
|
|
* it binds an rpmsg address with an rx callback handler.
|
|
*
|
|
* Simple rpmsg drivers shouldn't use this struct directly, because
|
|
* things just work: every rpmsg driver provides an rx callback upon
|
|
* registering to the bus, and that callback is then bound to its rpmsg
|
|
* address when the driver is probed. When relevant inbound messages arrive
|
|
* (i.e. messages which their dst address equals to the src address of
|
|
* the rpmsg channel), the driver's handler is invoked to process it.
|
|
*
|
|
* More complicated drivers though, that do need to allocate additional rpmsg
|
|
* addresses, and bind them to different rx callbacks, must explicitly
|
|
* create additional endpoints by themselves (see rpmsg_create_ept()).
|
|
*/
|
|
struct rpmsg_endpoint {
|
|
struct rpmsg_device *rpdev;
|
|
struct kref refcount;
|
|
rpmsg_rx_cb_t cb;
|
|
rpmsg_rx_sig_t sig_cb;
|
|
struct mutex cb_lock;
|
|
u32 addr;
|
|
void *priv;
|
|
|
|
const struct rpmsg_endpoint_ops *ops;
|
|
};
|
|
|
|
/**
|
|
* struct rpmsg_driver - rpmsg driver struct
|
|
* @drv: underlying device driver
|
|
* @id_table: rpmsg ids serviced by this driver
|
|
* @probe: invoked when a matching rpmsg channel (i.e. device) is found
|
|
* @remove: invoked when the rpmsg channel is removed
|
|
* @callback: invoked when an inbound message is received on the channel
|
|
* @signals: invoked when a serial signal change is received on the channel
|
|
*/
|
|
struct rpmsg_driver {
|
|
struct device_driver drv;
|
|
const struct rpmsg_device_id *id_table;
|
|
int (*probe)(struct rpmsg_device *dev);
|
|
void (*remove)(struct rpmsg_device *dev);
|
|
int (*callback)(struct rpmsg_device *, void *, int, void *, u32);
|
|
int (*signals)(struct rpmsg_device *, u32, u32);
|
|
};
|
|
|
|
#if IS_ENABLED(CONFIG_RPMSG)
|
|
|
|
int rpmsg_register_device_override(struct rpmsg_device *rpdev,
|
|
const char *driver_override);
|
|
int register_rpmsg_device(struct rpmsg_device *dev);
|
|
void unregister_rpmsg_device(struct rpmsg_device *dev);
|
|
int __register_rpmsg_driver(struct rpmsg_driver *drv, struct module *owner);
|
|
void unregister_rpmsg_driver(struct rpmsg_driver *drv);
|
|
void rpmsg_destroy_ept(struct rpmsg_endpoint *);
|
|
struct rpmsg_endpoint *rpmsg_create_ept(struct rpmsg_device *,
|
|
rpmsg_rx_cb_t cb, void *priv,
|
|
struct rpmsg_channel_info chinfo);
|
|
|
|
int rpmsg_send(struct rpmsg_endpoint *ept, void *data, int len);
|
|
int rpmsg_sendto(struct rpmsg_endpoint *ept, void *data, int len, u32 dst);
|
|
int rpmsg_send_offchannel(struct rpmsg_endpoint *ept, u32 src, u32 dst,
|
|
void *data, int len);
|
|
|
|
int rpmsg_trysend(struct rpmsg_endpoint *ept, void *data, int len);
|
|
int rpmsg_trysendto(struct rpmsg_endpoint *ept, void *data, int len, u32 dst);
|
|
int rpmsg_trysend_offchannel(struct rpmsg_endpoint *ept, u32 src, u32 dst,
|
|
void *data, int len);
|
|
|
|
unsigned int rpmsg_poll(struct rpmsg_endpoint *ept, struct file *filp,
|
|
poll_table *wait);
|
|
|
|
int rpmsg_get_sigs(struct rpmsg_endpoint *ept, u32 *lsigs, u32 *rsigs);
|
|
int rpmsg_set_sigs(struct rpmsg_endpoint *ept, u32 sigs);
|
|
|
|
#else
|
|
|
|
static inline int rpmsg_register_device_override(struct rpmsg_device *rpdev,
|
|
const char *driver_override)
|
|
{
|
|
return -ENXIO;
|
|
}
|
|
|
|
static inline int register_rpmsg_device(struct rpmsg_device *dev)
|
|
{
|
|
return -ENXIO;
|
|
}
|
|
|
|
static inline void unregister_rpmsg_device(struct rpmsg_device *dev)
|
|
{
|
|
/* This shouldn't be possible */
|
|
WARN_ON(1);
|
|
}
|
|
|
|
static inline int __register_rpmsg_driver(struct rpmsg_driver *drv,
|
|
struct module *owner)
|
|
{
|
|
/* This shouldn't be possible */
|
|
WARN_ON(1);
|
|
|
|
return -ENXIO;
|
|
}
|
|
|
|
static inline void unregister_rpmsg_driver(struct rpmsg_driver *drv)
|
|
{
|
|
/* This shouldn't be possible */
|
|
WARN_ON(1);
|
|
}
|
|
|
|
static inline void rpmsg_destroy_ept(struct rpmsg_endpoint *ept)
|
|
{
|
|
/* This shouldn't be possible */
|
|
WARN_ON(1);
|
|
}
|
|
|
|
static inline struct rpmsg_endpoint *rpmsg_create_ept(struct rpmsg_device *rpdev,
|
|
rpmsg_rx_cb_t cb,
|
|
void *priv,
|
|
struct rpmsg_channel_info chinfo)
|
|
{
|
|
/* This shouldn't be possible */
|
|
WARN_ON(1);
|
|
|
|
return NULL;
|
|
}
|
|
|
|
static inline int rpmsg_send(struct rpmsg_endpoint *ept, void *data, int len)
|
|
{
|
|
/* This shouldn't be possible */
|
|
WARN_ON(1);
|
|
|
|
return -ENXIO;
|
|
}
|
|
|
|
static inline int rpmsg_sendto(struct rpmsg_endpoint *ept, void *data, int len,
|
|
u32 dst)
|
|
{
|
|
/* This shouldn't be possible */
|
|
WARN_ON(1);
|
|
|
|
return -ENXIO;
|
|
|
|
}
|
|
|
|
static inline int rpmsg_send_offchannel(struct rpmsg_endpoint *ept, u32 src,
|
|
u32 dst, void *data, int len)
|
|
{
|
|
/* This shouldn't be possible */
|
|
WARN_ON(1);
|
|
|
|
return -ENXIO;
|
|
}
|
|
|
|
static inline int rpmsg_trysend(struct rpmsg_endpoint *ept, void *data, int len)
|
|
{
|
|
/* This shouldn't be possible */
|
|
WARN_ON(1);
|
|
|
|
return -ENXIO;
|
|
}
|
|
|
|
static inline int rpmsg_trysendto(struct rpmsg_endpoint *ept, void *data,
|
|
int len, u32 dst)
|
|
{
|
|
/* This shouldn't be possible */
|
|
WARN_ON(1);
|
|
|
|
return -ENXIO;
|
|
}
|
|
|
|
static inline int rpmsg_trysend_offchannel(struct rpmsg_endpoint *ept, u32 src,
|
|
u32 dst, void *data, int len)
|
|
{
|
|
/* This shouldn't be possible */
|
|
WARN_ON(1);
|
|
|
|
return -ENXIO;
|
|
}
|
|
|
|
static inline unsigned int rpmsg_poll(struct rpmsg_endpoint *ept,
|
|
struct file *filp, poll_table *wait)
|
|
{
|
|
/* This shouldn't be possible */
|
|
WARN_ON(1);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static inline int rpmsg_get_sigs(struct rpmsg_endpoint *ept, u32 *lsigs,
|
|
u32 *rsigs)
|
|
{
|
|
/* This shouldn't be possible */
|
|
WARN_ON(1);
|
|
|
|
return -ENXIO;
|
|
}
|
|
|
|
static inline int rpmsg_set_sigs(struct rpmsg_endpoint *ept, u32 sigs)
|
|
{
|
|
/* This shouldn't be possible */
|
|
WARN_ON(1);
|
|
|
|
return -ENXIO;
|
|
}
|
|
|
|
#endif /* IS_ENABLED(CONFIG_RPMSG) */
|
|
|
|
/* use a macro to avoid include chaining to get THIS_MODULE */
|
|
#define register_rpmsg_driver(drv) \
|
|
__register_rpmsg_driver(drv, THIS_MODULE)
|
|
|
|
/**
|
|
* module_rpmsg_driver() - Helper macro for registering an rpmsg driver
|
|
* @__rpmsg_driver: rpmsg_driver struct
|
|
*
|
|
* Helper macro for rpmsg drivers which do not do anything special in module
|
|
* init/exit. This eliminates a lot of boilerplate. Each module may only
|
|
* use this macro once, and calling it replaces module_init() and module_exit()
|
|
*/
|
|
#define module_rpmsg_driver(__rpmsg_driver) \
|
|
module_driver(__rpmsg_driver, register_rpmsg_driver, \
|
|
unregister_rpmsg_driver)
|
|
|
|
#endif /* _LINUX_RPMSG_H */
|