1
0
Files
Greg Kroah-Hartman 06a33ede12 Merge 4.9.208 into android-4.9-q
Changes in 4.9.208
	btrfs: skip log replay on orphaned roots
	btrfs: do not leak reloc root if we fail to read the fs root
	btrfs: handle ENOENT in btrfs_uuid_tree_iterate
	ALSA: pcm: Avoid possible info leaks from PCM stream buffers
	ALSA: hda/ca0132 - Keep power on during processing DSP response
	ALSA: hda/ca0132 - Avoid endless loop
	drm: mst: Fix query_payload ack reply struct
	drm/bridge: analogix-anx78xx: silence -EPROBE_DEFER warnings
	iio: light: bh1750: Resolve compiler warning and make code more readable
	spi: Add call to spi_slave_abort() function when spidev driver is released
	staging: rtl8192u: fix multiple memory leaks on error path
	staging: rtl8188eu: fix possible null dereference
	rtlwifi: prevent memory leak in rtl_usb_probe
	libertas: fix a potential NULL pointer dereference
	IB/iser: bound protection_sg size by data_sg size
	media: am437x-vpfe: Setting STD to current value is not an error
	media: i2c: ov2659: fix s_stream return value
	media: i2c: ov2659: Fix missing 720p register config
	media: ov6650: Fix stored frame format not in sync with hardware
	tools/power/cpupower: Fix initializer override in hsw_ext_cstates
	usb: renesas_usbhs: add suspend event support in gadget mode
	hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled
	regulator: max8907: Fix the usage of uninitialized variable in max8907_regulator_probe()
	media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()
	media: cec-funcs.h: add status_req checks
	samples: pktgen: fix proc_cmd command result check logic
	mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring
	media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format
	media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence number
	media: ti-vpe: vpe: Make sure YUYV is set as default format
	extcon: sm5502: Reset registers during initialization
	x86/mm: Use the correct function type for native_set_fixmap()
	perf test: Report failure for mmap events
	perf report: Add warning when libunwind not compiled in
	usb: usbfs: Suppress problematic bind and unbind uevents.
	iio: adc: max1027: Reset the device at probe time
	Bluetooth: hci_core: fix init for HCI_USER_CHANNEL
	x86/mce: Lower throttling MCE messages' priority to warning
	drm/gma500: fix memory disclosures due to uninitialized bytes
	rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot
	x86/ioapic: Prevent inconsistent state when moving an interrupt
	arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill()
	libata: Ensure ata_port probe has completed before detach
	pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B
	Bluetooth: Fix advertising duplicated flags
	bnx2x: Fix PF-VF communication over multi-cos queues.
	spi: img-spfi: fix potential double release
	ALSA: timer: Limit max amount of slave instances
	rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt()
	perf probe: Fix to find range-only function instance
	perf probe: Fix to list probe event with correct line number
	perf probe: Walk function lines in lexical blocks
	perf probe: Fix to probe an inline function which has no entry pc
	perf probe: Fix to show ranges of variables in functions without entry_pc
	perf probe: Fix to show inlined function callsite without entry_pc
	perf probe: Fix to probe a function which has no entry pc
	perf probe: Skip overlapped location on searching variables
	perf probe: Return a better scope DIE if there is no best scope
	perf probe: Fix to show calling lines of inlined functions
	perf probe: Skip end-of-sequence and non statement lines
	perf probe: Filter out instances except for inlined subroutine and subprogram
	ath10k: fix get invalid tx rate for Mesh metric
	media: pvrusb2: Fix oops on tear-down when radio support is not present
	media: si470x-i2c: add missed operations in remove
	EDAC/ghes: Fix grain calculation
	spi: pxa2xx: Add missed security checks
	ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile
	s390/disassembler: don't hide instruction addresses
	parport: load lowlevel driver if ports not found
	cpufreq: Register drivers only after CPU devices have been registered
	x86/crash: Add a forward declaration of struct kimage
	iwlwifi: mvm: fix unaligned read of rx_pkt_status
	spi: tegra20-slink: add missed clk_unprepare
	mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests
	btrfs: don't prematurely free work in end_workqueue_fn()
	btrfs: don't prematurely free work in run_ordered_work()
	spi: st-ssc4: add missed pm_runtime_disable
	x86/insn: Add some Intel instructions to the opcode map
	iwlwifi: check kasprintf() return value
	fbtft: Make sure string is NULL terminated
	crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c
	crypto: vmx - Avoid weird build failures
	libtraceevent: Fix memory leakage in copy_filter_type
	net: phy: initialise phydev speed and duplex sanely
	btrfs: don't prematurely free work in reada_start_machine_worker()
	Revert "mmc: sdhci: Fix incorrect switch to HS mode"
	usb: xhci: Fix build warning seen with CONFIG_PM=n
	btrfs: don't double lock the subvol_sem for rename exchange
	btrfs: do not call synchronize_srcu() in inode_tree_del
	btrfs: return error pointer from alloc_test_extent_buffer
	btrfs: abort transaction after failed inode updates in create_subvol
	Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues
	af_packet: set defaule value for tmo
	fjes: fix missed check in fjes_acpi_add
	mod_devicetable: fix PHY module format
	net: hisilicon: Fix a BUG trigered by wrong bytes_compl
	net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive()
	net: qlogic: Fix error paths in ql_alloc_large_buffers()
	net: usb: lan78xx: Fix suspend/resume PHY register access error
	sctp: fully initialize v4 addr in some functions
	net: dst: Force 4-byte alignment of dst_metrics
	usbip: Fix error path of vhci_recv_ret_submit()
	USB: EHCI: Do not return -EPIPE when hub is disconnected
	platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes
	staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value
	ext4: fix ext4_empty_dir() for directories with holes
	ext4: check for directory entries too close to block end
	powerpc/irq: fix stack overflow verification
	mmc: sdhci-of-esdhc: fix P2020 errata handling
	perf probe: Fix to show function entry line as probe-able
	scsi: mpt3sas: Fix clear pending bit in ioctl status
	scsi: lpfc: Fix locking on mailbox command completion
	Input: atmel_mxt_ts - disable IRQ across suspend
	iommu/tegra-smmu: Fix page tables in > 4 GiB memory
	scsi: target: compare full CHAP_A Algorithm strings
	scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices
	scsi: csiostor: Don't enable IRQs too early
	powerpc/pseries: Mark accumulate_stolen_time() as notrace
	powerpc/pseries: Don't fail hash page table insert for bolted mapping
	dma-debug: add a schedule point in debug_dma_dump_mappings()
	clocksource/drivers/asm9260: Add a check for of_clk_get
	powerpc/security/book3s64: Report L1TF status in sysfs
	powerpc/book3s64/hash: Add cond_resched to avoid soft lockup warning
	jbd2: Fix statistics for the number of logged blocks
	scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6)
	scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow
	clk: qcom: Allow constant ratio freq tables for rcg
	irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary
	irqchip: ingenic: Error out if IRQ domain creation failed
	fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
	scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences
	scsi: ufs: fix potential bug which ends in system hang
	powerpc/pseries/cmm: Implement release() function for sysfs device
	powerpc/security: Fix wrong message when RFI Flush is disable
	scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE
	clk: pxa: fix one of the pxa RTC clocks
	bcache: at least try to shrink 1 node in bch_mca_scan()
	HID: Improve Windows Precision Touchpad detection.
	ext4: work around deleting a file with i_nlink == 0 safely
	scsi: pm80xx: Fix for SATA device discovery
	scsi: scsi_debug: num_tgts must be >= 0
	scsi: target: iscsi: Wait for all commands to finish before freeing a session
	gpio: mpc8xxx: Don't overwrite default irq_set_type callback
	scripts/kallsyms: fix definitely-lost memory leak
	cdrom: respect device capabilities during opening action
	perf regs: Make perf_reg_name() return "unknown" instead of NULL
	libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
	s390/cpum_sf: Check for SDBT and SDB consistency
	ocfs2: fix passing zero to 'PTR_ERR' warning
	kernel: sysctl: make drop_caches write-only
	x86/mce: Fix possibly incorrect severity calculation on AMD
	net, sysctl: Fix compiler warning when only cBPF is present
	ALSA: hda - Downgrade error message for single-cmd fallback
	perf strbuf: Remove redundant va_end() in strbuf_addv()
	Make filldir[64]() verify the directory entry filename is valid
	filldir[64]: remove WARN_ON_ONCE() for bad directory entries
	netfilter: ebtables: compat: reject all padding in matches/watchers
	6pack,mkiss: fix possible deadlock
	netfilter: bridge: make sure to pull arp header in br_nf_forward_arp()
	net: icmp: fix data-race in cmp_global_allow()
	hrtimer: Annotate lockless access to timer->state
	tty/serial: atmel: fix out of range clock divider handling
	pinctrl: baytrail: Really serialize all register accesses
	mmc: sdhci: Update the tuning failed messages to pr_debug level
	net: ena: fix napi handler misbehavior when the napi budget is zero
	vhost/vsock: accept only packets with the right dst_cid
	tcp/dccp: fix possible race __inet_lookup_established()
	tcp: do not send empty skb from tcp_write_xmit()
	gtp: fix wrong condition in gtp_genl_dump_pdp()
	gtp: avoid zero size hashtable
	Linux 4.9.208

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-01-05 23:14:44 +03:00

488 lines
11 KiB
C

/*
* Copyright (C) 2015, Marvell International Ltd.
*
* This software file (the "File") is distributed by Marvell International
* Ltd. under the terms of the GNU General Public License Version 2, June 1991
* (the "License"). You may use, redistribute and/or modify this File in
* accordance with the terms and conditions of the License, a copy of which
* is available on the worldwide web at
* http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
*
* THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
* IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
* ARE EXPRESSLY DISCLAIMED. The License provides additional details about
* this warranty disclaimer.
*/
/* Inspired (hugely) by HCI LDISC implementation in Bluetooth.
*
* Copyright (C) 2000-2001 Qualcomm Incorporated
* Copyright (C) 2002-2003 Maxim Krasnyansky <maxk@qualcomm.com>
* Copyright (C) 2004-2005 Marcel Holtmann <marcel@holtmann.org>
*/
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/types.h>
#include <linux/fcntl.h>
#include <linux/interrupt.h>
#include <linux/ptrace.h>
#include <linux/poll.h>
#include <linux/slab.h>
#include <linux/tty.h>
#include <linux/errno.h>
#include <linux/string.h>
#include <linux/signal.h>
#include <linux/ioctl.h>
#include <linux/skbuff.h>
#include <net/nfc/nci.h>
#include <net/nfc/nci_core.h>
/* TX states */
#define NCI_UART_SENDING 1
#define NCI_UART_TX_WAKEUP 2
static struct nci_uart *nci_uart_drivers[NCI_UART_DRIVER_MAX];
static inline struct sk_buff *nci_uart_dequeue(struct nci_uart *nu)
{
struct sk_buff *skb = nu->tx_skb;
if (!skb)
skb = skb_dequeue(&nu->tx_q);
else
nu->tx_skb = NULL;
return skb;
}
static inline int nci_uart_queue_empty(struct nci_uart *nu)
{
if (nu->tx_skb)
return 0;
return skb_queue_empty(&nu->tx_q);
}
static int nci_uart_tx_wakeup(struct nci_uart *nu)
{
if (test_and_set_bit(NCI_UART_SENDING, &nu->tx_state)) {
set_bit(NCI_UART_TX_WAKEUP, &nu->tx_state);
return 0;
}
schedule_work(&nu->write_work);
return 0;
}
static void nci_uart_write_work(struct work_struct *work)
{
struct nci_uart *nu = container_of(work, struct nci_uart, write_work);
struct tty_struct *tty = nu->tty;
struct sk_buff *skb;
restart:
clear_bit(NCI_UART_TX_WAKEUP, &nu->tx_state);
if (nu->ops.tx_start)
nu->ops.tx_start(nu);
while ((skb = nci_uart_dequeue(nu))) {
int len;
set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
len = tty->ops->write(tty, skb->data, skb->len);
skb_pull(skb, len);
if (skb->len) {
nu->tx_skb = skb;
break;
}
kfree_skb(skb);
}
if (test_bit(NCI_UART_TX_WAKEUP, &nu->tx_state))
goto restart;
if (nu->ops.tx_done && nci_uart_queue_empty(nu))
nu->ops.tx_done(nu);
clear_bit(NCI_UART_SENDING, &nu->tx_state);
}
static int nci_uart_set_driver(struct tty_struct *tty, unsigned int driver)
{
struct nci_uart *nu = NULL;
int ret;
if (driver >= NCI_UART_DRIVER_MAX)
return -EINVAL;
if (!nci_uart_drivers[driver])
return -ENOENT;
nu = kzalloc(sizeof(*nu), GFP_KERNEL);
if (!nu)
return -ENOMEM;
memcpy(nu, nci_uart_drivers[driver], sizeof(struct nci_uart));
nu->tty = tty;
tty->disc_data = nu;
skb_queue_head_init(&nu->tx_q);
INIT_WORK(&nu->write_work, nci_uart_write_work);
spin_lock_init(&nu->rx_lock);
ret = nu->ops.open(nu);
if (ret) {
tty->disc_data = NULL;
kfree(nu);
} else if (!try_module_get(nu->owner)) {
nu->ops.close(nu);
tty->disc_data = NULL;
kfree(nu);
return -ENOENT;
}
return ret;
}
/* ------ LDISC part ------ */
/* nci_uart_tty_open
*
* Called when line discipline changed to NCI_UART.
*
* Arguments:
* tty pointer to tty info structure
* Return Value:
* 0 if success, otherwise error code
*/
static int nci_uart_tty_open(struct tty_struct *tty)
{
/* Error if the tty has no write op instead of leaving an exploitable
* hole
*/
if (!tty->ops->write)
return -EOPNOTSUPP;
tty->disc_data = NULL;
tty->receive_room = 65536;
/* Flush any pending characters in the driver */
tty_driver_flush_buffer(tty);
return 0;
}
/* nci_uart_tty_close()
*
* Called when the line discipline is changed to something
* else, the tty is closed, or the tty detects a hangup.
*/
static void nci_uart_tty_close(struct tty_struct *tty)
{
struct nci_uart *nu = (void *)tty->disc_data;
/* Detach from the tty */
tty->disc_data = NULL;
if (!nu)
return;
if (nu->tx_skb)
kfree_skb(nu->tx_skb);
if (nu->rx_skb)
kfree_skb(nu->rx_skb);
skb_queue_purge(&nu->tx_q);
nu->ops.close(nu);
nu->tty = NULL;
module_put(nu->owner);
cancel_work_sync(&nu->write_work);
kfree(nu);
}
/* nci_uart_tty_wakeup()
*
* Callback for transmit wakeup. Called when low level
* device driver can accept more send data.
*
* Arguments: tty pointer to associated tty instance data
* Return Value: None
*/
static void nci_uart_tty_wakeup(struct tty_struct *tty)
{
struct nci_uart *nu = (void *)tty->disc_data;
if (!nu)
return;
clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
if (tty != nu->tty)
return;
nci_uart_tx_wakeup(nu);
}
/* nci_uart_tty_receive()
*
* Called by tty low level driver when receive data is
* available.
*
* Arguments: tty pointer to tty isntance data
* data pointer to received data
* flags pointer to flags for data
* count count of received data in bytes
*
* Return Value: None
*/
static void nci_uart_tty_receive(struct tty_struct *tty, const u8 *data,
char *flags, int count)
{
struct nci_uart *nu = (void *)tty->disc_data;
if (!nu || tty != nu->tty)
return;
spin_lock(&nu->rx_lock);
nu->ops.recv_buf(nu, (void *)data, flags, count);
spin_unlock(&nu->rx_lock);
tty_unthrottle(tty);
}
/* nci_uart_tty_ioctl()
*
* Process IOCTL system call for the tty device.
*
* Arguments:
*
* tty pointer to tty instance data
* file pointer to open file object for device
* cmd IOCTL command code
* arg argument for IOCTL call (cmd dependent)
*
* Return Value: Command dependent
*/
static int nci_uart_tty_ioctl(struct tty_struct *tty, struct file *file,
unsigned int cmd, unsigned long arg)
{
struct nci_uart *nu = (void *)tty->disc_data;
int err = 0;
switch (cmd) {
case NCIUARTSETDRIVER:
if (!nu)
return nci_uart_set_driver(tty, (unsigned int)arg);
else
return -EBUSY;
break;
default:
err = n_tty_ioctl_helper(tty, file, cmd, arg);
break;
}
return err;
}
/* We don't provide read/write/poll interface for user space. */
static ssize_t nci_uart_tty_read(struct tty_struct *tty, struct file *file,
unsigned char __user *buf, size_t nr)
{
return 0;
}
static ssize_t nci_uart_tty_write(struct tty_struct *tty, struct file *file,
const unsigned char *data, size_t count)
{
return 0;
}
static unsigned int nci_uart_tty_poll(struct tty_struct *tty,
struct file *filp, poll_table *wait)
{
return 0;
}
static int nci_uart_send(struct nci_uart *nu, struct sk_buff *skb)
{
/* Queue TX packet */
skb_queue_tail(&nu->tx_q, skb);
/* Try to start TX (if possible) */
nci_uart_tx_wakeup(nu);
return 0;
}
/* -- Default recv_buf handler --
*
* This handler supposes that NCI frames are sent over UART link without any
* framing. It reads NCI header, retrieve the packet size and once all packet
* bytes are received it passes it to nci_uart driver for processing.
*/
static int nci_uart_default_recv_buf(struct nci_uart *nu, const u8 *data,
char *flags, int count)
{
int chunk_len;
if (!nu->ndev) {
nfc_err(nu->tty->dev,
"receive data from tty but no NCI dev is attached yet, drop buffer\n");
return 0;
}
/* Decode all incoming data in packets
* and enqueue then for processing.
*/
while (count > 0) {
/* If this is the first data of a packet, allocate a buffer */
if (!nu->rx_skb) {
nu->rx_packet_len = -1;
nu->rx_skb = nci_skb_alloc(nu->ndev,
NCI_MAX_PACKET_SIZE,
GFP_ATOMIC);
if (!nu->rx_skb)
return -ENOMEM;
}
/* Eat byte after byte till full packet header is received */
if (nu->rx_skb->len < NCI_CTRL_HDR_SIZE) {
*skb_put(nu->rx_skb, 1) = *data++;
--count;
continue;
}
/* Header was received but packet len was not read */
if (nu->rx_packet_len < 0)
nu->rx_packet_len = NCI_CTRL_HDR_SIZE +
nci_plen(nu->rx_skb->data);
/* Compute how many bytes are missing and how many bytes can
* be consumed.
*/
chunk_len = nu->rx_packet_len - nu->rx_skb->len;
if (count < chunk_len)
chunk_len = count;
memcpy(skb_put(nu->rx_skb, chunk_len), data, chunk_len);
data += chunk_len;
count -= chunk_len;
/* Chcek if packet is fully received */
if (nu->rx_packet_len == nu->rx_skb->len) {
/* Pass RX packet to driver */
if (nu->ops.recv(nu, nu->rx_skb) != 0)
nfc_err(nu->tty->dev, "corrupted RX packet\n");
/* Next packet will be a new one */
nu->rx_skb = NULL;
}
}
return 0;
}
/* -- Default recv handler -- */
static int nci_uart_default_recv(struct nci_uart *nu, struct sk_buff *skb)
{
return nci_recv_frame(nu->ndev, skb);
}
int nci_uart_register(struct nci_uart *nu)
{
if (!nu || !nu->ops.open ||
!nu->ops.recv || !nu->ops.close)
return -EINVAL;
/* Set the send callback */
nu->ops.send = nci_uart_send;
/* Install default handlers if not overridden */
if (!nu->ops.recv_buf)
nu->ops.recv_buf = nci_uart_default_recv_buf;
if (!nu->ops.recv)
nu->ops.recv = nci_uart_default_recv;
/* Add this driver in the driver list */
if (nci_uart_drivers[nu->driver]) {
pr_err("driver %d is already registered\n", nu->driver);
return -EBUSY;
}
nci_uart_drivers[nu->driver] = nu;
pr_info("NCI uart driver '%s [%d]' registered\n", nu->name, nu->driver);
return 0;
}
EXPORT_SYMBOL_GPL(nci_uart_register);
void nci_uart_unregister(struct nci_uart *nu)
{
pr_info("NCI uart driver '%s [%d]' unregistered\n", nu->name,
nu->driver);
/* Remove this driver from the driver list */
nci_uart_drivers[nu->driver] = NULL;
}
EXPORT_SYMBOL_GPL(nci_uart_unregister);
void nci_uart_set_config(struct nci_uart *nu, int baudrate, int flow_ctrl)
{
struct ktermios new_termios;
if (!nu->tty)
return;
down_read(&nu->tty->termios_rwsem);
new_termios = nu->tty->termios;
up_read(&nu->tty->termios_rwsem);
tty_termios_encode_baud_rate(&new_termios, baudrate, baudrate);
if (flow_ctrl)
new_termios.c_cflag |= CRTSCTS;
else
new_termios.c_cflag &= ~CRTSCTS;
tty_set_termios(nu->tty, &new_termios);
}
EXPORT_SYMBOL_GPL(nci_uart_set_config);
static struct tty_ldisc_ops nci_uart_ldisc = {
.magic = TTY_LDISC_MAGIC,
.owner = THIS_MODULE,
.name = "n_nci",
.open = nci_uart_tty_open,
.close = nci_uart_tty_close,
.read = nci_uart_tty_read,
.write = nci_uart_tty_write,
.poll = nci_uart_tty_poll,
.receive_buf = nci_uart_tty_receive,
.write_wakeup = nci_uart_tty_wakeup,
.ioctl = nci_uart_tty_ioctl,
};
static int __init nci_uart_init(void)
{
memset(nci_uart_drivers, 0, sizeof(nci_uart_drivers));
return tty_register_ldisc(N_NCI, &nci_uart_ldisc);
}
static void __exit nci_uart_exit(void)
{
tty_unregister_ldisc(N_NCI);
}
module_init(nci_uart_init);
module_exit(nci_uart_exit);
MODULE_AUTHOR("Marvell International Ltd.");
MODULE_DESCRIPTION("NFC NCI UART driver");
MODULE_LICENSE("GPL");
MODULE_ALIAS_LDISC(N_NCI);