UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity
OpenCloudOS-Kernel/drivers/char/applicom.c

857 lines
24 KiB
C
Raw Permalink Normal View History

treewide: Add SPDX license identifier for more missed files Add SPDX license identifiers to all files which: - Have no license information of any form - Have MODULE_LICENCE("GPL*") inside which was used in the initial scan/conversion to ignore the file These files fall under the project license, GPL v2 only. The resulting SPDX license identifier is: GPL-2.0-only Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-19 20:08:20 +08:00
// SPDX-License-Identifier: GPL-2.0-only
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
/* Derived from Applicom driver ac.c for SCO Unix */
/* Ported by David Woodhouse, Axiom (Cambridge) Ltd. */
/* dwmw2@infradead.org 30/8/98 */
/* $Id: ac.c,v 1.30 2000/03/22 16:03:57 dwmw2 Exp $ */
/* This module is for Linux 2.1 and 2.2 series kernels. */
/*****************************************************************************/
/* J PAGET 18/02/94 passage V2.4.2 ioctl avec code 2 reset to les interrupt */
/* ceci pour reseter correctement apres une sortie sauvage */
/* J PAGET 02/05/94 passage V2.4.3 dans le traitement de d'interruption, */
/* LoopCount n'etait pas initialise a 0. */
/* F LAFORSE 04/07/95 version V2.6.0 lecture bidon apres acces a une carte */
/* pour liberer le bus */
/* J.PAGET 19/11/95 version V2.6.1 Nombre, addresse,irq n'est plus configure */
/* et passe en argument a acinit, mais est scrute sur le bus pour s'adapter */
/* au nombre de cartes presentes sur le bus. IOCL code 6 affichait V2.4.3 */
/* F.LAFORSE 28/11/95 creation de fichiers acXX.o avec les differentes */
tree-wide: Assorted spelling fixes In particular, several occurances of funny versions of 'success', 'unknown', 'therefore', 'acknowledge', 'argument', 'achieve', 'address', 'beginning', 'desirable', 'separate' and 'necessary' are fixed. Signed-off-by: Daniel Mack <daniel@caiaq.de> Cc: Joe Perches <joe@perches.com> Cc: Junio C Hamano <gitster@pobox.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2010-02-03 08:01:28 +08:00
/* addresses de base des cartes, IOCTL 6 plus complet */
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
/* J.PAGET le 19/08/96 copie de la version V2.6 en V2.8.0 sans modification */
/* de code autre que le texte V2.6.1 en V2.8.0 */
/*****************************************************************************/
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/interrupt.h>
sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h> Fix up affected files that include this signal functionality via sched.h. Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Mike Galbraith <efault@gmx.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-02-03 02:15:33 +08:00
#include <linux/sched/signal.h>
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
#include <linux/slab.h>
#include <linux/errno.h>
drivers: autoconvert trivial BKL users to private mutex All these files use the big kernel lock in a trivial way to serialize their private file operations, typically resulting from an earlier semi-automatic pushdown from VFS. None of these drivers appears to want to lock against other code, and they all use the BKL as the top-level lock in their file operations, meaning that there is no lock-order inversion problem. Consequently, we can remove the BKL completely, replacing it with a per-file mutex in every case. Using a scripted approach means we can avoid typos. These drivers do not seem to be under active maintainance from my brief investigation. Apologies to those maintainers that I have missed. file=$1 name=$2 if grep -q lock_kernel ${file} ; then if grep -q 'include.*linux.mutex.h' ${file} ; then sed -i '/include.*<linux\/smp_lock.h>/d' ${file} else sed -i 's/include.*<linux\/smp_lock.h>.*$/include <linux\/mutex.h>/g' ${file} fi sed -i ${file} \ -e "/^#include.*linux.mutex.h/,$ { 1,/^\(static\|int\|long\)/ { /^\(static\|int\|long\)/istatic DEFINE_MUTEX(${name}_mutex); } }" \ -e "s/\(un\)*lock_kernel\>[ ]*()/mutex_\1lock(\&${name}_mutex)/g" \ -e '/[ ]*cycle_kernel_lock();/d' else sed -i -e '/include.*\<smp_lock.h\>/d' ${file} \ -e '/cycle_kernel_lock()/d' fi Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2010-06-02 20:28:52 +08:00
#include <linux/mutex.h>
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
#include <linux/miscdevice.h>
#include <linux/pci.h>
#include <linux/wait.h>
#include <linux/init.h>
#include <linux/fs.h>
applicom: Fix potential Spectre v1 vulnerabilities IndexCard is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: drivers/char/applicom.c:418 ac_write() warn: potential spectre issue 'apbs' [r] drivers/char/applicom.c:728 ac_ioctl() warn: potential spectre issue 'apbs' [r] (local cap) Fix this by sanitizing IndexCard before using it to index apbs. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-10 06:05:10 +08:00
#include <linux/nospec.h>
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
#include <asm/io.h>
Replace <asm/uaccess.h> with <linux/uaccess.h> globally This was entirely automated, using the script by Al: PATT='^[[:blank:]]*#[[:blank:]]*include[[:blank:]]*<asm/uaccess.h>' sed -i -e "s!$PATT!#include <linux/uaccess.h>!" \ $(git grep -l "$PATT"|grep -v ^include/linux/uaccess.h) to do the replacement at the end of the merge window. Requested-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-12-25 03:46:01 +08:00
#include <linux/uaccess.h>
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
#include "applicom.h"
/* NOTE: We use for loops with {write,read}b() instead of
memcpy_{from,to}io throughout this driver. This is because
the board doesn't correctly handle word accesses - only
bytes.
*/
#undef DEBUG
#define MAX_BOARD 8 /* maximum of pc board possible */
#define MAX_ISA_BOARD 4
#define LEN_RAM_IO 0x800
#define AC_MINOR 157
#ifndef PCI_VENDOR_ID_APPLICOM
#define PCI_VENDOR_ID_APPLICOM 0x1389
#define PCI_DEVICE_ID_APPLICOM_PCIGENERIC 0x0001
#define PCI_DEVICE_ID_APPLICOM_PCI2000IBS_CAN 0x0002
#define PCI_DEVICE_ID_APPLICOM_PCI2000PFB 0x0003
#endif
drivers: autoconvert trivial BKL users to private mutex All these files use the big kernel lock in a trivial way to serialize their private file operations, typically resulting from an earlier semi-automatic pushdown from VFS. None of these drivers appears to want to lock against other code, and they all use the BKL as the top-level lock in their file operations, meaning that there is no lock-order inversion problem. Consequently, we can remove the BKL completely, replacing it with a per-file mutex in every case. Using a scripted approach means we can avoid typos. These drivers do not seem to be under active maintainance from my brief investigation. Apologies to those maintainers that I have missed. file=$1 name=$2 if grep -q lock_kernel ${file} ; then if grep -q 'include.*linux.mutex.h' ${file} ; then sed -i '/include.*<linux\/smp_lock.h>/d' ${file} else sed -i 's/include.*<linux\/smp_lock.h>.*$/include <linux\/mutex.h>/g' ${file} fi sed -i ${file} \ -e "/^#include.*linux.mutex.h/,$ { 1,/^\(static\|int\|long\)/ { /^\(static\|int\|long\)/istatic DEFINE_MUTEX(${name}_mutex); } }" \ -e "s/\(un\)*lock_kernel\>[ ]*()/mutex_\1lock(\&${name}_mutex)/g" \ -e '/[ ]*cycle_kernel_lock();/d' else sed -i -e '/include.*\<smp_lock.h\>/d' ${file} \ -e '/cycle_kernel_lock()/d' fi Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2010-06-02 20:28:52 +08:00
static DEFINE_MUTEX(ac_mutex);
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
static char *applicom_pci_devnames[] = {
"PCI board",
"PCI2000IBS / PCI2000CAN",
"PCI2000PFB"
};
applicom: constify pci_device_id. pci_device_id are not supposed to change at runtime. All functions working with pci_device_id provided by <linux/pci.h> work with const pci_device_id. So mark the non-const structs as const. Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-08-02 00:01:57 +08:00
static const struct pci_device_id applicom_pci_tbl[] = {
Char: applicom, use pci_match_id Instead of testing hardcoded values, use pci_match_id to reference the pci_device_id table. Sideways, it allows easy new additions to the table. [akpm@linux-foundation.org: remove wrongly-added semicolon] Signed-off-by: Jiri Slaby <jirislaby@gmail.com> Cc: WANG Cong <xiyou.wangcong@gmail.com> Cc: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-02-08 20:21:51 +08:00
{ PCI_VDEVICE(APPLICOM, PCI_DEVICE_ID_APPLICOM_PCIGENERIC) },
{ PCI_VDEVICE(APPLICOM, PCI_DEVICE_ID_APPLICOM_PCI2000IBS_CAN) },
{ PCI_VDEVICE(APPLICOM, PCI_DEVICE_ID_APPLICOM_PCI2000PFB) },
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
{ 0 }
};
MODULE_DEVICE_TABLE(pci, applicom_pci_tbl);
MODULE_AUTHOR("David Woodhouse & Applicom International");
MODULE_DESCRIPTION("Driver for Applicom Profibus card");
MODULE_LICENSE("GPL");
applicom: Auto-load applicom module when device opened. The applicom module is missing the char-major-10-157 alias that would cause it to be auto-loaded when a device of that type is opened. This patch adds the alias. Signed-off-by: Scott James Remnant <scott@canonical.com> Signed-off-by: Tim Gardner <tim.gardner@canonical.com> Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-04-07 00:32:58 +08:00
MODULE_ALIAS_MISCDEV(AC_MINOR);
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
MODULE_SUPPORTED_DEVICE("ac");
static struct applicom_board {
unsigned long PhysIO;
void __iomem *RamIO;
wait_queue_head_t FlagSleepSend;
long irq;
spinlock_t mutex;
} apbs[MAX_BOARD];
static unsigned int irq = 0; /* interrupt number IRQ */
static unsigned long mem = 0; /* physical segment of board */
Annotate hardware config module parameters in drivers/char/ When the kernel is running in secure boot mode, we lock down the kernel to prevent userspace from modifying the running kernel image. Whilst this includes prohibiting access to things like /dev/mem, it must also prevent access by means of configuring driver modules in such a way as to cause a device to access or modify the kernel image. To this end, annotate module_param* statements that refer to hardware configuration and indicate for future reference what type of parameter they specify. The parameter parser in the core sees this information and can skip such parameters with an error message if the kernel is locked down. The module initialisation then runs as normal, but just sees whatever the default values for those parameters is. Note that we do still need to do the module initialisation because some drivers have viable defaults set in case parameters aren't specified and some drivers support automatic configuration (e.g. PNP or PCI) in addition to manually coded parameters. This patch annotates drivers in drivers/char/. Suggested-by: Alan Cox <gnomes@lxorguk.ukuu.org.uk> Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> cc: Arnd Bergmann <arnd@arndb.de>
2017-04-04 23:54:22 +08:00
module_param_hw(irq, uint, irq, 0);
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
MODULE_PARM_DESC(irq, "IRQ of the Applicom board");
Annotate hardware config module parameters in drivers/char/ When the kernel is running in secure boot mode, we lock down the kernel to prevent userspace from modifying the running kernel image. Whilst this includes prohibiting access to things like /dev/mem, it must also prevent access by means of configuring driver modules in such a way as to cause a device to access or modify the kernel image. To this end, annotate module_param* statements that refer to hardware configuration and indicate for future reference what type of parameter they specify. The parameter parser in the core sees this information and can skip such parameters with an error message if the kernel is locked down. The module initialisation then runs as normal, but just sees whatever the default values for those parameters is. Note that we do still need to do the module initialisation because some drivers have viable defaults set in case parameters aren't specified and some drivers support automatic configuration (e.g. PNP or PCI) in addition to manually coded parameters. This patch annotates drivers in drivers/char/. Suggested-by: Alan Cox <gnomes@lxorguk.ukuu.org.uk> Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> cc: Arnd Bergmann <arnd@arndb.de>
2017-04-04 23:54:22 +08:00
module_param_hw(mem, ulong, iomem, 0);
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
MODULE_PARM_DESC(mem, "Shared Memory Address of Applicom board");
static unsigned int numboards; /* number of installed boards */
static volatile unsigned char Dummy;
static DECLARE_WAIT_QUEUE_HEAD(FlagSleepRec);
static unsigned int WriteErrorCount; /* number of write error */
static unsigned int ReadErrorCount; /* number of read error */
static unsigned int DeviceErrorCount; /* number of device error */
static ssize_t ac_read (struct file *, char __user *, size_t, loff_t *);
static ssize_t ac_write (struct file *, const char __user *, size_t, loff_t *);
drivers: Push down BKL into various drivers These are the last remaining device drivers using the ->ioctl file operation in the drivers directory (except from v4l drivers). [fweisbec: drop i8k pushdown as it has been done from procfs pushdown branch already] Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
2010-04-27 06:24:05 +08:00
static long ac_ioctl(struct file *, unsigned int, unsigned long);
IRQ: Maintain regs pointer globally rather than passing to IRQ handlers Maintain a per-CPU global "struct pt_regs *" variable which can be used instead of passing regs around manually through all ~1800 interrupt handlers in the Linux kernel. The regs pointer is used in few places, but it potentially costs both stack space and code to pass it around. On the FRV arch, removing the regs parameter from all the genirq function results in a 20% speed up of the IRQ exit path (ie: from leaving timer_interrupt() to leaving do_IRQ()). Where appropriate, an arch may override the generic storage facility and do something different with the variable. On FRV, for instance, the address is maintained in GR28 at all times inside the kernel as part of general exception handling. Having looked over the code, it appears that the parameter may be handed down through up to twenty or so layers of functions. Consider a USB character device attached to a USB hub, attached to a USB controller that posts its interrupts through a cascaded auxiliary interrupt controller. A character device driver may want to pass regs to the sysrq handler through the input layer which adds another few layers of parameter passing. I've build this code with allyesconfig for x86_64 and i386. I've runtested the main part of the code on FRV and i386, though I can't test most of the drivers. I've also done partial conversion for powerpc and MIPS - these at least compile with minimal configurations. This will affect all archs. Mostly the changes should be relatively easy. Take do_IRQ(), store the regs pointer at the beginning, saving the old one: struct pt_regs *old_regs = set_irq_regs(regs); And put the old one back at the end: set_irq_regs(old_regs); Don't pass regs through to generic_handle_irq() or __do_IRQ(). In timer_interrupt(), this sort of change will be necessary: - update_process_times(user_mode(regs)); - profile_tick(CPU_PROFILING, regs); + update_process_times(user_mode(get_irq_regs())); + profile_tick(CPU_PROFILING); I'd like to move update_process_times()'s use of get_irq_regs() into itself, except that i386, alone of the archs, uses something other than user_mode(). Some notes on the interrupt handling in the drivers: (*) input_dev() is now gone entirely. The regs pointer is no longer stored in the input_dev struct. (*) finish_unlinks() in drivers/usb/host/ohci-q.c needs checking. It does something different depending on whether it's been supplied with a regs pointer or not. (*) Various IRQ handler function pointers have been moved to type irq_handler_t. Signed-Off-By: David Howells <dhowells@redhat.com> (cherry picked from 1b16e7ac850969f38b375e511e3fa2f474a33867 commit)
2006-10-05 21:55:46 +08:00
static irqreturn_t ac_interrupt(int, void *);
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
[PATCH] make more file_operation structs static Mark the static struct file_operations in drivers/char as const. Making them const prevents accidental bugs, and moves them to the .rodata section so that they no longer do any false sharing; in addition with the proper debug option they are then protected against corruption.. [akpm@osdl.org: build fix] Signed-off-by: Arjan van de Ven <arjan@linux.intel.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-03 15:24:21 +08:00
static const struct file_operations ac_fops = {
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
.owner = THIS_MODULE,
.llseek = no_llseek,
.read = ac_read,
.write = ac_write,
drivers: Push down BKL into various drivers These are the last remaining device drivers using the ->ioctl file operation in the drivers directory (except from v4l drivers). [fweisbec: drop i8k pushdown as it has been done from procfs pushdown branch already] Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
2010-04-27 06:24:05 +08:00
.unlocked_ioctl = ac_ioctl,
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
};
static struct miscdevice ac_miscdev = {
AC_MINOR,
"ac",
&ac_fops
};
static int dummy; /* dev_id for request_irq() */
static int ac_register_board(unsigned long physloc, void __iomem *loc,
unsigned char boardno)
{
volatile unsigned char byte_reset_it;
if((readb(loc + CONF_END_TEST) != 0x00) ||
(readb(loc + CONF_END_TEST + 1) != 0x55) ||
(readb(loc + CONF_END_TEST + 2) != 0xAA) ||
(readb(loc + CONF_END_TEST + 3) != 0xFF))
return 0;
if (!boardno)
boardno = readb(loc + NUMCARD_OWNER_TO_PC);
[PATCH] Wrong out of range check in drivers/char/applicom.c This fixes coverity bug id #469. The out of range check didnt work as intended, as seen by the printk(), which states that boardno has to be 1 <= boardno <= MAX_BOARD. Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-04-11 13:54:36 +08:00
if (!boardno || boardno > MAX_BOARD) {
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
printk(KERN_WARNING "Board #%d (at 0x%lx) is out of range (1 <= x <= %d).\n",
boardno, physloc, MAX_BOARD);
return 0;
}
if (apbs[boardno - 1].RamIO) {
printk(KERN_WARNING "Board #%d (at 0x%lx) conflicts with previous board #%d (at 0x%lx)\n",
boardno, physloc, boardno, apbs[boardno-1].PhysIO);
return 0;
}
boardno--;
apbs[boardno].PhysIO = physloc;
apbs[boardno].RamIO = loc;
init_waitqueue_head(&apbs[boardno].FlagSleepSend);
spin_lock_init(&apbs[boardno].mutex);
byte_reset_it = readb(loc + RAM_IT_TO_PC);
numboards++;
return boardno + 1;
}
[PATCH] drivers/char/applicom.c: proper module_{init,exit} Convert the driver to use module_{init,exit}. Signed-off-by: Adrian Bunk <bunk@stusta.de> Acked-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-25 20:47:34 +08:00
static void __exit applicom_exit(void)
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
{
[PATCH] applicom: fix error handling misc_register() can fail. Signed-off-by: Christophe Lucas <clucas@rotomalug.org> Signed-off-by: Domen Puncer <domen@coderock.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-10 15:26:29 +08:00
unsigned int i;
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
misc_deregister(&ac_miscdev);
for (i = 0; i < MAX_BOARD; i++) {
if (!apbs[i].RamIO)
continue;
if (apbs[i].irq)
free_irq(apbs[i].irq, &dummy);
iounmap(apbs[i].RamIO);
}
}
[PATCH] drivers/char/applicom.c: proper module_{init,exit} Convert the driver to use module_{init,exit}. Signed-off-by: Adrian Bunk <bunk@stusta.de> Acked-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-25 20:47:34 +08:00
static int __init applicom_init(void)
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
{
int i, numisa = 0;
struct pci_dev *dev = NULL;
void __iomem *RamIO;
[PATCH] applicom: fix error handling misc_register() can fail. Signed-off-by: Christophe Lucas <clucas@rotomalug.org> Signed-off-by: Domen Puncer <domen@coderock.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-10 15:26:29 +08:00
int boardno, ret;
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
printk(KERN_INFO "Applicom driver: $Id: ac.c,v 1.30 2000/03/22 16:03:57 dwmw2 Exp $\n");
/* No mem and irq given - check for a PCI card */
while ( (dev = pci_get_class(PCI_CLASS_OTHERS << 16, dev))) {
Char: applicom, use pci_match_id Instead of testing hardcoded values, use pci_match_id to reference the pci_device_id table. Sideways, it allows easy new additions to the table. [akpm@linux-foundation.org: remove wrongly-added semicolon] Signed-off-by: Jiri Slaby <jirislaby@gmail.com> Cc: WANG Cong <xiyou.wangcong@gmail.com> Cc: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-02-08 20:21:51 +08:00
if (!pci_match_id(applicom_pci_tbl, dev))
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
continue;
if (pci_enable_device(dev))
return -EIO;
char serial: switch drivers to ioremap_nocache Simple search/replace except for synclink.c where I noticed a real bug and fixed it too. It was doing NULL + offset, then checking for NULL if the remap failed. Signed-off-by: Alan Cox <alan@redhat.com> Cc: Paul Fulghum <paulkf@microgate.com> Acked-by: Jiri Slaby <jirislaby@gmail.com> Cc: Ingo Molnar <mingo@elte.hu> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-30 15:54:19 +08:00
RamIO = ioremap_nocache(pci_resource_start(dev, 0), LEN_RAM_IO);
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
if (!RamIO) {
[PATCH] 64bit resource: fix up printks for resources in misc drivers This is needed if we wish to change the size of the resource structures. Based on an original patch from Vivek Goyal <vgoyal@in.ibm.com> Cc: Vivek Goyal <vgoyal@in.ibm.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-06-13 06:20:16 +08:00
printk(KERN_INFO "ac.o: Failed to ioremap PCI memory "
"space at 0x%llx\n",
Char: applicom, use pci_resource_start Use pci_resource_start instead of accessing pci_dev struct internals. Signed-off-by: Jiri Slaby <jirislaby@gmail.com> Cc: WANG Cong <xiyou.wangcong@gmail.com> Cc: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-02-08 20:21:50 +08:00
(unsigned long long)pci_resource_start(dev, 0));
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
pci_disable_device(dev);
return -EIO;
}
[PATCH] 64bit resource: fix up printks for resources in misc drivers This is needed if we wish to change the size of the resource structures. Based on an original patch from Vivek Goyal <vgoyal@in.ibm.com> Cc: Vivek Goyal <vgoyal@in.ibm.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-06-13 06:20:16 +08:00
printk(KERN_INFO "Applicom %s found at mem 0x%llx, irq %d\n",
applicom_pci_devnames[dev->device-1],
Char: applicom, use pci_resource_start Use pci_resource_start instead of accessing pci_dev struct internals. Signed-off-by: Jiri Slaby <jirislaby@gmail.com> Cc: WANG Cong <xiyou.wangcong@gmail.com> Cc: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-02-08 20:21:50 +08:00
(unsigned long long)pci_resource_start(dev, 0),
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
dev->irq);
Char: applicom, use pci_resource_start Use pci_resource_start instead of accessing pci_dev struct internals. Signed-off-by: Jiri Slaby <jirislaby@gmail.com> Cc: WANG Cong <xiyou.wangcong@gmail.com> Cc: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-02-08 20:21:50 +08:00
boardno = ac_register_board(pci_resource_start(dev, 0),
RamIO, 0);
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
if (!boardno) {
printk(KERN_INFO "ac.o: PCI Applicom device doesn't have correct signature.\n");
iounmap(RamIO);
pci_disable_device(dev);
continue;
}
[PATCH] irq-flags: drivers/char: Use the new IRQF_ constants Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@elte.hu> Cc: "David S. Miller" <davem@davemloft.net> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-02 10:29:33 +08:00
if (request_irq(dev->irq, &ac_interrupt, IRQF_SHARED, "Applicom PCI", &dummy)) {
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
printk(KERN_INFO "Could not allocate IRQ %d for PCI Applicom device.\n", dev->irq);
iounmap(RamIO);
pci_disable_device(dev);
apbs[boardno - 1].RamIO = NULL;
continue;
}
/* Enable interrupts. */
writeb(0x40, apbs[boardno - 1].RamIO + RAM_IT_FROM_PC);
apbs[boardno - 1].irq = dev->irq;
}
/* Finished with PCI cards. If none registered,
* and there was no mem/irq specified, exit */
if (!mem || !irq) {
if (numboards)
goto fin;
else {
printk(KERN_INFO "ac.o: No PCI boards found.\n");
printk(KERN_INFO "ac.o: For an ISA board you must supply memory and irq parameters.\n");
return -ENXIO;
}
}
/* Now try the specified ISA cards */
for (i = 0; i < MAX_ISA_BOARD; i++) {
char serial: switch drivers to ioremap_nocache Simple search/replace except for synclink.c where I noticed a real bug and fixed it too. It was doing NULL + offset, then checking for NULL if the remap failed. Signed-off-by: Alan Cox <alan@redhat.com> Cc: Paul Fulghum <paulkf@microgate.com> Acked-by: Jiri Slaby <jirislaby@gmail.com> Cc: Ingo Molnar <mingo@elte.hu> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-30 15:54:19 +08:00
RamIO = ioremap_nocache(mem + (LEN_RAM_IO * i), LEN_RAM_IO);
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
if (!RamIO) {
printk(KERN_INFO "ac.o: Failed to ioremap the ISA card's memory space (slot #%d)\n", i + 1);
continue;
}
if (!(boardno = ac_register_board((unsigned long)mem+ (LEN_RAM_IO*i),
RamIO,i+1))) {
iounmap(RamIO);
continue;
}
printk(KERN_NOTICE "Applicom ISA card found at mem 0x%lx, irq %d\n", mem + (LEN_RAM_IO*i), irq);
if (!numisa) {
[PATCH] irq-flags: drivers/char: Use the new IRQF_ constants Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@elte.hu> Cc: "David S. Miller" <davem@davemloft.net> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-07-02 10:29:33 +08:00
if (request_irq(irq, &ac_interrupt, IRQF_SHARED, "Applicom ISA", &dummy)) {
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
printk(KERN_WARNING "Could not allocate IRQ %d for ISA Applicom device.\n", irq);
iounmap(RamIO);
apbs[boardno - 1].RamIO = NULL;
}
else
apbs[boardno - 1].irq = irq;
}
else
apbs[boardno - 1].irq = 0;
numisa++;
}
if (!numisa)
[PATCH] applicom: fix error handling misc_register() can fail. Signed-off-by: Christophe Lucas <clucas@rotomalug.org> Signed-off-by: Domen Puncer <domen@coderock.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-10 15:26:29 +08:00
printk(KERN_WARNING "ac.o: No valid ISA Applicom boards found "
"at mem 0x%lx\n", mem);
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
fin:
init_waitqueue_head(&FlagSleepRec);
WriteErrorCount = 0;
ReadErrorCount = 0;
DeviceErrorCount = 0;
if (numboards) {
[PATCH] applicom: fix error handling misc_register() can fail. Signed-off-by: Christophe Lucas <clucas@rotomalug.org> Signed-off-by: Domen Puncer <domen@coderock.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-10 15:26:29 +08:00
ret = misc_register(&ac_miscdev);
if (ret) {
printk(KERN_WARNING "ac.o: Unable to register misc device\n");
goto out;
}
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
for (i = 0; i < MAX_BOARD; i++) {
int serial;
char boardname[(SERIAL_NUMBER - TYPE_CARD) + 1];
if (!apbs[i].RamIO)
continue;
for (serial = 0; serial < SERIAL_NUMBER - TYPE_CARD; serial++)
boardname[serial] = readb(apbs[i].RamIO + TYPE_CARD + serial);
boardname[serial] = 0;
printk(KERN_INFO "Applicom board %d: %s, PROM V%d.%d",
i+1, boardname,
(int)(readb(apbs[i].RamIO + VERS) >> 4),
(int)(readb(apbs[i].RamIO + VERS) & 0xF));
serial = (readb(apbs[i].RamIO + SERIAL_NUMBER) << 16) +
(readb(apbs[i].RamIO + SERIAL_NUMBER + 1) << 8) +
(readb(apbs[i].RamIO + SERIAL_NUMBER + 2) );
if (serial != 0)
printk(" S/N %d\n", serial);
else
printk("\n");
}
return 0;
}
else
return -ENXIO;
[PATCH] applicom: fix error handling misc_register() can fail. Signed-off-by: Christophe Lucas <clucas@rotomalug.org> Signed-off-by: Domen Puncer <domen@coderock.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-10 15:26:29 +08:00
out:
for (i = 0; i < MAX_BOARD; i++) {
if (!apbs[i].RamIO)
continue;
if (apbs[i].irq)
free_irq(apbs[i].irq, &dummy);
iounmap(apbs[i].RamIO);
}
return ret;
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
}
[PATCH] drivers/char/applicom.c: proper module_{init,exit} Convert the driver to use module_{init,exit}. Signed-off-by: Adrian Bunk <bunk@stusta.de> Acked-by: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-25 20:47:34 +08:00
module_init(applicom_init);
module_exit(applicom_exit);
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
static ssize_t ac_write(struct file *file, const char __user *buf, size_t count, loff_t * ppos)
{
unsigned int NumCard; /* Board number 1 -> 8 */
unsigned int IndexCard; /* Index board number 0 -> 7 */
unsigned char TicCard; /* Board TIC to send */
unsigned long flags; /* Current priority */
struct st_ram_io st_loc;
struct mailbox tmpmailbox;
#ifdef DEBUG
int c;
#endif
DECLARE_WAITQUEUE(wait, current);
if (count != sizeof(struct st_ram_io) + sizeof(struct mailbox)) {
static int warncount = 5;
if (warncount) {
printk(KERN_INFO "Hmmm. write() of Applicom card, length %zd != expected %zd\n",
count, sizeof(struct st_ram_io) + sizeof(struct mailbox));
warncount--;
}
return -EINVAL;
}
if(copy_from_user(&st_loc, buf, sizeof(struct st_ram_io)))
return -EFAULT;
if(copy_from_user(&tmpmailbox, &buf[sizeof(struct st_ram_io)],
sizeof(struct mailbox)))
return -EFAULT;
NumCard = st_loc.num_card; /* board number to send */
TicCard = st_loc.tic_des_from_pc; /* tic number to send */
IndexCard = NumCard - 1;
applicom: Fix potential Spectre v1 vulnerabilities IndexCard is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: drivers/char/applicom.c:418 ac_write() warn: potential spectre issue 'apbs' [r] drivers/char/applicom.c:728 ac_ioctl() warn: potential spectre issue 'apbs' [r] (local cap) Fix this by sanitizing IndexCard before using it to index apbs. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-10 06:05:10 +08:00
if (IndexCard >= MAX_BOARD)
return -EINVAL;
IndexCard = array_index_nospec(IndexCard, MAX_BOARD);
if (!apbs[IndexCard].RamIO)
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
return -EINVAL;
#ifdef DEBUG
printk("Write to applicom card #%d. struct st_ram_io follows:",
IndexCard+1);
for (c = 0; c < sizeof(struct st_ram_io);) {
printk("\n%5.5X: %2.2X", c, ((unsigned char *) &st_loc)[c]);
for (c++; c % 8 && c < sizeof(struct st_ram_io); c++) {
printk(" %2.2X", ((unsigned char *) &st_loc)[c]);
}
}
printk("\nstruct mailbox follows:");
for (c = 0; c < sizeof(struct mailbox);) {
printk("\n%5.5X: %2.2X", c, ((unsigned char *) &tmpmailbox)[c]);
for (c++; c % 8 && c < sizeof(struct mailbox); c++) {
printk(" %2.2X", ((unsigned char *) &tmpmailbox)[c]);
}
}
printk("\n");
#endif
spin_lock_irqsave(&apbs[IndexCard].mutex, flags);
/* Test octet ready correct */
if(readb(apbs[IndexCard].RamIO + DATA_FROM_PC_READY) > 2) {
Dummy = readb(apbs[IndexCard].RamIO + VERS);
spin_unlock_irqrestore(&apbs[IndexCard].mutex, flags);
printk(KERN_WARNING "APPLICOM driver write error board %d, DataFromPcReady = %d\n",
IndexCard,(int)readb(apbs[IndexCard].RamIO + DATA_FROM_PC_READY));
DeviceErrorCount++;
return -EIO;
}
/* Place ourselves on the wait queue */
set_current_state(TASK_INTERRUPTIBLE);
add_wait_queue(&apbs[IndexCard].FlagSleepSend, &wait);
/* Check whether the card is ready for us */
while (readb(apbs[IndexCard].RamIO + DATA_FROM_PC_READY) != 0) {
Dummy = readb(apbs[IndexCard].RamIO + VERS);
/* It's busy. Sleep. */
spin_unlock_irqrestore(&apbs[IndexCard].mutex, flags);
schedule();
if (signal_pending(current)) {
remove_wait_queue(&apbs[IndexCard].FlagSleepSend,
&wait);
return -EINTR;
}
spin_lock_irqsave(&apbs[IndexCard].mutex, flags);
set_current_state(TASK_INTERRUPTIBLE);
}
/* We may not have actually slept */
set_current_state(TASK_RUNNING);
remove_wait_queue(&apbs[IndexCard].FlagSleepSend, &wait);
writeb(1, apbs[IndexCard].RamIO + DATA_FROM_PC_READY);
/* Which is best - lock down the pages with rawio and then
copy directly, or use bounce buffers? For now we do the latter
because it works with 2.2 still */
{
unsigned char *from = (unsigned char *) &tmpmailbox;
void __iomem *to = apbs[IndexCard].RamIO + RAM_FROM_PC;
int c;
for (c = 0; c < sizeof(struct mailbox); c++)
writeb(*(from++), to++);
}
writeb(0x20, apbs[IndexCard].RamIO + TIC_OWNER_FROM_PC);
writeb(0xff, apbs[IndexCard].RamIO + NUMCARD_OWNER_FROM_PC);
writeb(TicCard, apbs[IndexCard].RamIO + TIC_DES_FROM_PC);
writeb(NumCard, apbs[IndexCard].RamIO + NUMCARD_DES_FROM_PC);
writeb(2, apbs[IndexCard].RamIO + DATA_FROM_PC_READY);
writeb(1, apbs[IndexCard].RamIO + RAM_IT_FROM_PC);
Dummy = readb(apbs[IndexCard].RamIO + VERS);
spin_unlock_irqrestore(&apbs[IndexCard].mutex, flags);
return 0;
}
static int do_ac_read(int IndexCard, char __user *buf,
struct st_ram_io *st_loc, struct mailbox *mailbox)
{
void __iomem *from = apbs[IndexCard].RamIO + RAM_TO_PC;
applicom.c: fix apparently-broken code in do_ac_read() The code scriblles over a local pointer whereas it appears to be trying to write to the memory at which that pointer points. Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11397 Nobody we know can test this change. Reported-by: Zvonimir Rakamaric <zrakamar@cs.ubc.ca> Cc: Jesse Barnes <jbarnes@virtuousgeek.org> Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jiri Slaby <jirislaby@gmail.com> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-10-16 13:04:18 +08:00
unsigned char *to = (unsigned char *)mailbox;
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
#ifdef DEBUG
int c;
#endif
st_loc->tic_owner_to_pc = readb(apbs[IndexCard].RamIO + TIC_OWNER_TO_PC);
st_loc->numcard_owner_to_pc = readb(apbs[IndexCard].RamIO + NUMCARD_OWNER_TO_PC);
{
int c;
for (c = 0; c < sizeof(struct mailbox); c++)
*(to++) = readb(from++);
}
writeb(1, apbs[IndexCard].RamIO + ACK_FROM_PC_READY);
writeb(1, apbs[IndexCard].RamIO + TYP_ACK_FROM_PC);
writeb(IndexCard+1, apbs[IndexCard].RamIO + NUMCARD_ACK_FROM_PC);
writeb(readb(apbs[IndexCard].RamIO + TIC_OWNER_TO_PC),
apbs[IndexCard].RamIO + TIC_ACK_FROM_PC);
writeb(2, apbs[IndexCard].RamIO + ACK_FROM_PC_READY);
writeb(0, apbs[IndexCard].RamIO + DATA_TO_PC_READY);
writeb(2, apbs[IndexCard].RamIO + RAM_IT_FROM_PC);
Dummy = readb(apbs[IndexCard].RamIO + VERS);
#ifdef DEBUG
printk("Read from applicom card #%d. struct st_ram_io follows:", NumCard);
for (c = 0; c < sizeof(struct st_ram_io);) {
printk("\n%5.5X: %2.2X", c, ((unsigned char *)st_loc)[c]);
for (c++; c % 8 && c < sizeof(struct st_ram_io); c++) {
printk(" %2.2X", ((unsigned char *)st_loc)[c]);
}
}
printk("\nstruct mailbox follows:");
for (c = 0; c < sizeof(struct mailbox);) {
printk("\n%5.5X: %2.2X", c, ((unsigned char *)mailbox)[c]);
for (c++; c % 8 && c < sizeof(struct mailbox); c++) {
printk(" %2.2X", ((unsigned char *)mailbox)[c]);
}
}
printk("\n");
#endif
return (sizeof(struct st_ram_io) + sizeof(struct mailbox));
}
static ssize_t ac_read (struct file *filp, char __user *buf, size_t count, loff_t *ptr)
{
unsigned long flags;
unsigned int i;
unsigned char tmp;
int ret = 0;
DECLARE_WAITQUEUE(wait, current);
#ifdef DEBUG
int loopcount=0;
#endif
/* No need to ratelimit this. Only root can trigger it anyway */
if (count != sizeof(struct st_ram_io) + sizeof(struct mailbox)) {
printk( KERN_WARNING "Hmmm. read() of Applicom card, length %zd != expected %zd\n",
count,sizeof(struct st_ram_io) + sizeof(struct mailbox));
return -EINVAL;
}
while(1) {
/* Stick ourself on the wait queue */
set_current_state(TASK_INTERRUPTIBLE);
add_wait_queue(&FlagSleepRec, &wait);
/* Scan each board, looking for one which has a packet for us */
for (i=0; i < MAX_BOARD; i++) {
if (!apbs[i].RamIO)
continue;
spin_lock_irqsave(&apbs[i].mutex, flags);
tmp = readb(apbs[i].RamIO + DATA_TO_PC_READY);
if (tmp == 2) {
struct st_ram_io st_loc;
struct mailbox mailbox;
/* Got a packet for us */
drivers/char/applicom.c: fix information leak to userland Structure st_loc is copied to userland with some fields unitialized. It leads to leaking of stack memory. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-10-28 06:34:21 +08:00
memset(&st_loc, 0, sizeof(st_loc));
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
ret = do_ac_read(i, buf, &st_loc, &mailbox);
spin_unlock_irqrestore(&apbs[i].mutex, flags);
set_current_state(TASK_RUNNING);
remove_wait_queue(&FlagSleepRec, &wait);
if (copy_to_user(buf, &st_loc, sizeof(st_loc)))
return -EFAULT;
if (copy_to_user(buf + sizeof(st_loc), &mailbox, sizeof(mailbox)))
return -EFAULT;
return tmp;
}
if (tmp > 2) {
/* Got an error */
Dummy = readb(apbs[i].RamIO + VERS);
spin_unlock_irqrestore(&apbs[i].mutex, flags);
set_current_state(TASK_RUNNING);
remove_wait_queue(&FlagSleepRec, &wait);
printk(KERN_WARNING "APPLICOM driver read error board %d, DataToPcReady = %d\n",
i,(int)readb(apbs[i].RamIO + DATA_TO_PC_READY));
DeviceErrorCount++;
return -EIO;
}
/* Nothing for us. Try the next board */
Dummy = readb(apbs[i].RamIO + VERS);
spin_unlock_irqrestore(&apbs[i].mutex, flags);
} /* per board */
/* OK - No boards had data for us. Sleep now */
schedule();
remove_wait_queue(&FlagSleepRec, &wait);
if (signal_pending(current))
return -EINTR;
#ifdef DEBUG
if (loopcount++ > 2) {
[PATCH] printk: drivers/char/applicom.c printk() calls should include appropriate KERN_* constant. Signed-off-by: Christophe Lucas <clucas@rotomalug.org> Signed-off-by: Domen Puncer <domen@coderock.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-06-26 05:58:56 +08:00
printk(KERN_DEBUG "Looping in ac_read. loopcount %d\n", loopcount);
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
}
#endif
}
}
IRQ: Maintain regs pointer globally rather than passing to IRQ handlers Maintain a per-CPU global "struct pt_regs *" variable which can be used instead of passing regs around manually through all ~1800 interrupt handlers in the Linux kernel. The regs pointer is used in few places, but it potentially costs both stack space and code to pass it around. On the FRV arch, removing the regs parameter from all the genirq function results in a 20% speed up of the IRQ exit path (ie: from leaving timer_interrupt() to leaving do_IRQ()). Where appropriate, an arch may override the generic storage facility and do something different with the variable. On FRV, for instance, the address is maintained in GR28 at all times inside the kernel as part of general exception handling. Having looked over the code, it appears that the parameter may be handed down through up to twenty or so layers of functions. Consider a USB character device attached to a USB hub, attached to a USB controller that posts its interrupts through a cascaded auxiliary interrupt controller. A character device driver may want to pass regs to the sysrq handler through the input layer which adds another few layers of parameter passing. I've build this code with allyesconfig for x86_64 and i386. I've runtested the main part of the code on FRV and i386, though I can't test most of the drivers. I've also done partial conversion for powerpc and MIPS - these at least compile with minimal configurations. This will affect all archs. Mostly the changes should be relatively easy. Take do_IRQ(), store the regs pointer at the beginning, saving the old one: struct pt_regs *old_regs = set_irq_regs(regs); And put the old one back at the end: set_irq_regs(old_regs); Don't pass regs through to generic_handle_irq() or __do_IRQ(). In timer_interrupt(), this sort of change will be necessary: - update_process_times(user_mode(regs)); - profile_tick(CPU_PROFILING, regs); + update_process_times(user_mode(get_irq_regs())); + profile_tick(CPU_PROFILING); I'd like to move update_process_times()'s use of get_irq_regs() into itself, except that i386, alone of the archs, uses something other than user_mode(). Some notes on the interrupt handling in the drivers: (*) input_dev() is now gone entirely. The regs pointer is no longer stored in the input_dev struct. (*) finish_unlinks() in drivers/usb/host/ohci-q.c needs checking. It does something different depending on whether it's been supplied with a regs pointer or not. (*) Various IRQ handler function pointers have been moved to type irq_handler_t. Signed-Off-By: David Howells <dhowells@redhat.com> (cherry picked from 1b16e7ac850969f38b375e511e3fa2f474a33867 commit)
2006-10-05 21:55:46 +08:00
static irqreturn_t ac_interrupt(int vec, void *dev_instance)
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
{
unsigned int i;
unsigned int FlagInt;
unsigned int LoopCount;
int handled = 0;
// printk("Applicom interrupt on IRQ %d occurred\n", vec);
LoopCount = 0;
do {
FlagInt = 0;
for (i = 0; i < MAX_BOARD; i++) {
/* Skip if this board doesn't exist */
if (!apbs[i].RamIO)
continue;
spin_lock(&apbs[i].mutex);
/* Skip if this board doesn't want attention */
if(readb(apbs[i].RamIO + RAM_IT_TO_PC) == 0) {
spin_unlock(&apbs[i].mutex);
continue;
}
handled = 1;
FlagInt = 1;
writeb(0, apbs[i].RamIO + RAM_IT_TO_PC);
if (readb(apbs[i].RamIO + DATA_TO_PC_READY) > 2) {
printk(KERN_WARNING "APPLICOM driver interrupt err board %d, DataToPcReady = %d\n",
i+1,(int)readb(apbs[i].RamIO + DATA_TO_PC_READY));
DeviceErrorCount++;
}
if((readb(apbs[i].RamIO + DATA_FROM_PC_READY) > 2) &&
(readb(apbs[i].RamIO + DATA_FROM_PC_READY) != 6)) {
printk(KERN_WARNING "APPLICOM driver interrupt err board %d, DataFromPcReady = %d\n",
i+1,(int)readb(apbs[i].RamIO + DATA_FROM_PC_READY));
DeviceErrorCount++;
}
if (readb(apbs[i].RamIO + DATA_TO_PC_READY) == 2) { /* mailbox sent by the card ? */
if (waitqueue_active(&FlagSleepRec)) {
wake_up_interruptible(&FlagSleepRec);
}
}
if (readb(apbs[i].RamIO + DATA_FROM_PC_READY) == 0) { /* ram i/o free for write by pc ? */
if (waitqueue_active(&apbs[i].FlagSleepSend)) { /* process sleep during read ? */
wake_up_interruptible(&apbs[i].FlagSleepSend);
}
}
Dummy = readb(apbs[i].RamIO + VERS);
if(readb(apbs[i].RamIO + RAM_IT_TO_PC)) {
/* There's another int waiting on this card */
spin_unlock(&apbs[i].mutex);
i--;
} else {
spin_unlock(&apbs[i].mutex);
}
}
if (FlagInt)
LoopCount = 0;
else
LoopCount++;
} while(LoopCount < 2);
return IRQ_RETVAL(handled);
}
drivers: Push down BKL into various drivers These are the last remaining device drivers using the ->ioctl file operation in the drivers directory (except from v4l drivers). [fweisbec: drop i8k pushdown as it has been done from procfs pushdown branch already] Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
2010-04-27 06:24:05 +08:00
static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
{ /* @ ADG ou ATO selon le cas */
int i;
unsigned char IndexCard;
void __iomem *pmem;
int ret = 0;
applicom: Fix potential Spectre v1 vulnerabilities IndexCard is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: drivers/char/applicom.c:418 ac_write() warn: potential spectre issue 'apbs' [r] drivers/char/applicom.c:728 ac_ioctl() warn: potential spectre issue 'apbs' [r] (local cap) Fix this by sanitizing IndexCard before using it to index apbs. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-10 06:05:10 +08:00
static int warncount = 10;
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
volatile unsigned char byte_reset_it;
struct st_ram_io *adgl;
void __user *argp = (void __user *)arg;
/* In general, the device is only openable by root anyway, so we're not
particularly concerned that bogus ioctls can flood the console. */
drivers/char/applicom.c: use memdup_user Use memdup_user when user data is immediately copied into the allocated region. The semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression from,to,size,flag; position p; identifier l1,l2; @@ - to = \(kmalloc@p\|kzalloc@p\)(size,flag); + to = memdup_user(from,size); if ( - to==NULL + IS_ERR(to) || ...) { <+... when != goto l1; - -ENOMEM + PTR_ERR(to) ...+> } - if (copy_from_user(to, from, size) != 0) { - <+... when != goto l2; - -EFAULT - ...+> - } // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-05-27 05:43:56 +08:00
adgl = memdup_user(argp, sizeof(struct st_ram_io));
if (IS_ERR(adgl))
return PTR_ERR(adgl);
drivers: Push down BKL into various drivers These are the last remaining device drivers using the ->ioctl file operation in the drivers directory (except from v4l drivers). [fweisbec: drop i8k pushdown as it has been done from procfs pushdown branch already] Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
2010-04-27 06:24:05 +08:00
drivers: autoconvert trivial BKL users to private mutex All these files use the big kernel lock in a trivial way to serialize their private file operations, typically resulting from an earlier semi-automatic pushdown from VFS. None of these drivers appears to want to lock against other code, and they all use the BKL as the top-level lock in their file operations, meaning that there is no lock-order inversion problem. Consequently, we can remove the BKL completely, replacing it with a per-file mutex in every case. Using a scripted approach means we can avoid typos. These drivers do not seem to be under active maintainance from my brief investigation. Apologies to those maintainers that I have missed. file=$1 name=$2 if grep -q lock_kernel ${file} ; then if grep -q 'include.*linux.mutex.h' ${file} ; then sed -i '/include.*<linux\/smp_lock.h>/d' ${file} else sed -i 's/include.*<linux\/smp_lock.h>.*$/include <linux\/mutex.h>/g' ${file} fi sed -i ${file} \ -e "/^#include.*linux.mutex.h/,$ { 1,/^\(static\|int\|long\)/ { /^\(static\|int\|long\)/istatic DEFINE_MUTEX(${name}_mutex); } }" \ -e "s/\(un\)*lock_kernel\>[ ]*()/mutex_\1lock(\&${name}_mutex)/g" \ -e '/[ ]*cycle_kernel_lock();/d' else sed -i -e '/include.*\<smp_lock.h\>/d' ${file} \ -e '/cycle_kernel_lock()/d' fi Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2010-06-02 20:28:52 +08:00
mutex_lock(&ac_mutex);
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
IndexCard = adgl->num_card-1;
applicom: Fix potential Spectre v1 vulnerabilities IndexCard is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: drivers/char/applicom.c:418 ac_write() warn: potential spectre issue 'apbs' [r] drivers/char/applicom.c:728 ac_ioctl() warn: potential spectre issue 'apbs' [r] (local cap) Fix this by sanitizing IndexCard before using it to index apbs. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-10 06:05:10 +08:00
if (cmd != 6 && IndexCard >= MAX_BOARD)
goto err;
IndexCard = array_index_nospec(IndexCard, MAX_BOARD);
if (cmd != 6 && !apbs[IndexCard].RamIO)
goto err;
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
switch (cmd) {
case 0:
pmem = apbs[IndexCard].RamIO;
for (i = 0; i < sizeof(struct st_ram_io); i++)
((unsigned char *)adgl)[i]=readb(pmem++);
if (copy_to_user(argp, adgl, sizeof(struct st_ram_io)))
ret = -EFAULT;
break;
case 1:
pmem = apbs[IndexCard].RamIO + CONF_END_TEST;
for (i = 0; i < 4; i++)
adgl->conf_end_test[i] = readb(pmem++);
for (i = 0; i < 2; i++)
adgl->error_code[i] = readb(pmem++);
for (i = 0; i < 4; i++)
adgl->parameter_error[i] = readb(pmem++);
pmem = apbs[IndexCard].RamIO + VERS;
adgl->vers = readb(pmem);
pmem = apbs[IndexCard].RamIO + TYPE_CARD;
for (i = 0; i < 20; i++)
adgl->reserv1[i] = readb(pmem++);
*(int *)&adgl->reserv1[20] =
(readb(apbs[IndexCard].RamIO + SERIAL_NUMBER) << 16) +
(readb(apbs[IndexCard].RamIO + SERIAL_NUMBER + 1) << 8) +
(readb(apbs[IndexCard].RamIO + SERIAL_NUMBER + 2) );
if (copy_to_user(argp, adgl, sizeof(struct st_ram_io)))
ret = -EFAULT;
break;
case 2:
pmem = apbs[IndexCard].RamIO + CONF_END_TEST;
for (i = 0; i < 10; i++)
writeb(0xff, pmem++);
writeb(adgl->data_from_pc_ready,
apbs[IndexCard].RamIO + DATA_FROM_PC_READY);
writeb(1, apbs[IndexCard].RamIO + RAM_IT_FROM_PC);
for (i = 0; i < MAX_BOARD; i++) {
if (apbs[i].RamIO) {
byte_reset_it = readb(apbs[i].RamIO + RAM_IT_TO_PC);
}
}
break;
case 3:
pmem = apbs[IndexCard].RamIO + TIC_DES_FROM_PC;
writeb(adgl->tic_des_from_pc, pmem);
break;
case 4:
pmem = apbs[IndexCard].RamIO + TIC_OWNER_TO_PC;
adgl->tic_owner_to_pc = readb(pmem++);
adgl->numcard_owner_to_pc = readb(pmem);
if (copy_to_user(argp, adgl,sizeof(struct st_ram_io)))
ret = -EFAULT;
break;
case 5:
writeb(adgl->num_card, apbs[IndexCard].RamIO + NUMCARD_OWNER_TO_PC);
writeb(adgl->num_card, apbs[IndexCard].RamIO + NUMCARD_DES_FROM_PC);
writeb(adgl->num_card, apbs[IndexCard].RamIO + NUMCARD_ACK_FROM_PC);
writeb(4, apbs[IndexCard].RamIO + DATA_FROM_PC_READY);
writeb(1, apbs[IndexCard].RamIO + RAM_IT_FROM_PC);
break;
case 6:
printk(KERN_INFO "APPLICOM driver release .... V2.8.0 ($Revision: 1.30 $)\n");
printk(KERN_INFO "Number of installed boards . %d\n", (int) numboards);
printk(KERN_INFO "Segment of board ........... %X\n", (int) mem);
printk(KERN_INFO "Interrupt IRQ number ....... %d\n", (int) irq);
for (i = 0; i < MAX_BOARD; i++) {
int serial;
char boardname[(SERIAL_NUMBER - TYPE_CARD) + 1];
if (!apbs[i].RamIO)
continue;
for (serial = 0; serial < SERIAL_NUMBER - TYPE_CARD; serial++)
boardname[serial] = readb(apbs[i].RamIO + TYPE_CARD + serial);
boardname[serial] = 0;
printk(KERN_INFO "Prom version board %d ....... V%d.%d %s",
i+1,
applicom: use correct array offset We're iterating through abps[] printing information, but here we use the wrong array index. IndexCard comes from the user and in this case it was specifically not range checked because we didn't expect to use it. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-02 04:31:46 +08:00
(int)(readb(apbs[i].RamIO + VERS) >> 4),
(int)(readb(apbs[i].RamIO + VERS) & 0xF),
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
boardname);
serial = (readb(apbs[i].RamIO + SERIAL_NUMBER) << 16) +
(readb(apbs[i].RamIO + SERIAL_NUMBER + 1) << 8) +
(readb(apbs[i].RamIO + SERIAL_NUMBER + 2) );
if (serial != 0)
printk(" S/N %d\n", serial);
else
printk("\n");
}
if (DeviceErrorCount != 0)
printk(KERN_INFO "DeviceErrorCount ........... %d\n", DeviceErrorCount);
if (ReadErrorCount != 0)
printk(KERN_INFO "ReadErrorCount ............. %d\n", ReadErrorCount);
if (WriteErrorCount != 0)
printk(KERN_INFO "WriteErrorCount ............ %d\n", WriteErrorCount);
if (waitqueue_active(&FlagSleepRec))
printk(KERN_INFO "Process in read pending\n");
for (i = 0; i < MAX_BOARD; i++) {
if (apbs[i].RamIO && waitqueue_active(&apbs[i].FlagSleepSend))
printk(KERN_INFO "Process in write pending board %d\n",i+1);
}
break;
default:
applicom: Fix an unchecked user ioctl range and an error return Closes bug #11408 by checking the card index range for command 0 Fixes the ioctl to return ENOTTY which is correct for unknown ioctls Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-10-13 17:45:17 +08:00
ret = -ENOTTY;
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
break;
}
Dummy = readb(apbs[IndexCard].RamIO + VERS);
kfree(adgl);
drivers: autoconvert trivial BKL users to private mutex All these files use the big kernel lock in a trivial way to serialize their private file operations, typically resulting from an earlier semi-automatic pushdown from VFS. None of these drivers appears to want to lock against other code, and they all use the BKL as the top-level lock in their file operations, meaning that there is no lock-order inversion problem. Consequently, we can remove the BKL completely, replacing it with a per-file mutex in every case. Using a scripted approach means we can avoid typos. These drivers do not seem to be under active maintainance from my brief investigation. Apologies to those maintainers that I have missed. file=$1 name=$2 if grep -q lock_kernel ${file} ; then if grep -q 'include.*linux.mutex.h' ${file} ; then sed -i '/include.*<linux\/smp_lock.h>/d' ${file} else sed -i 's/include.*<linux\/smp_lock.h>.*$/include <linux\/mutex.h>/g' ${file} fi sed -i ${file} \ -e "/^#include.*linux.mutex.h/,$ { 1,/^\(static\|int\|long\)/ { /^\(static\|int\|long\)/istatic DEFINE_MUTEX(${name}_mutex); } }" \ -e "s/\(un\)*lock_kernel\>[ ]*()/mutex_\1lock(\&${name}_mutex)/g" \ -e '/[ ]*cycle_kernel_lock();/d' else sed -i -e '/include.*\<smp_lock.h\>/d' ${file} \ -e '/cycle_kernel_lock()/d' fi Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2010-06-02 20:28:52 +08:00
mutex_unlock(&ac_mutex);
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
return 0;
applicom: Fix potential Spectre v1 vulnerabilities IndexCard is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: drivers/char/applicom.c:418 ac_write() warn: potential spectre issue 'apbs' [r] drivers/char/applicom.c:728 ac_ioctl() warn: potential spectre issue 'apbs' [r] (local cap) Fix this by sanitizing IndexCard before using it to index apbs. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-10 06:05:10 +08:00
err:
if (warncount) {
pr_warn("APPLICOM driver IOCTL, bad board number %d\n",
(int)IndexCard + 1);
warncount--;
}
kfree(adgl);
mutex_unlock(&ac_mutex);
return -EINVAL;
Linux-2.6.12-rc2 Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
2005-04-17 06:20:36 +08:00
}