summaryrefslogtreecommitdiff
path: root/drivers/misc
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/misc')
-rw-r--r--drivers/misc/lkdtm/fortify.c36
-rw-r--r--drivers/misc/open-dice.c19
-rw-r--r--drivers/misc/pci_endpoint_test.c34
-rw-r--r--drivers/misc/sgi-gru/grumain.c2
4 files changed, 48 insertions, 43 deletions
diff --git a/drivers/misc/lkdtm/fortify.c b/drivers/misc/lkdtm/fortify.c
index 00ed2147113e..7615a02dfc47 100644
--- a/drivers/misc/lkdtm/fortify.c
+++ b/drivers/misc/lkdtm/fortify.c
@@ -10,30 +10,6 @@
static volatile int fortify_scratch_space;
-static void lkdtm_FORTIFY_STR_OBJECT(void)
-{
- struct target {
- char a[10];
- int foo;
- } target[3] = {};
- /*
- * Using volatile prevents the compiler from determining the value of
- * 'size' at compile time. Without that, we would get a compile error
- * rather than a runtime error.
- */
- volatile int size = 20;
-
- pr_info("trying to strcmp() past the end of a struct\n");
-
- strncpy(target[0].a, target[1].a, size);
-
- /* Store result to global to prevent the code from being eliminated */
- fortify_scratch_space = target[0].a[3];
-
- pr_err("FAIL: fortify did not block a strncpy() object write overflow!\n");
- pr_expected_config(CONFIG_FORTIFY_SOURCE);
-}
-
static void lkdtm_FORTIFY_STR_MEMBER(void)
{
struct target {
@@ -47,22 +23,23 @@ static void lkdtm_FORTIFY_STR_MEMBER(void)
if (!src)
return;
+ /* 15 bytes: past end of a[] but not target. */
strscpy(src, "over ten bytes", size);
size = strlen(src) + 1;
- pr_info("trying to strncpy() past the end of a struct member...\n");
+ pr_info("trying to strscpy() past the end of a struct member...\n");
/*
- * strncpy(target.a, src, 20); will hit a compile error because the
- * compiler knows at build time that target.a < 20 bytes. Use a
+ * strscpy(target.a, src, 15); will hit a compile error because the
+ * compiler knows at build time that target.a < 15 bytes. Use a
* volatile to force a runtime error.
*/
- strncpy(target.a, src, size);
+ strscpy(target.a, src, size);
/* Store result to global to prevent the code from being eliminated */
fortify_scratch_space = target.a[3];
- pr_err("FAIL: fortify did not block a strncpy() struct member write overflow!\n");
+ pr_err("FAIL: fortify did not block a strscpy() struct member write overflow!\n");
pr_expected_config(CONFIG_FORTIFY_SOURCE);
kfree(src);
@@ -210,7 +187,6 @@ static void lkdtm_FORTIFY_STRSCPY(void)
}
static struct crashtype crashtypes[] = {
- CRASHTYPE(FORTIFY_STR_OBJECT),
CRASHTYPE(FORTIFY_STR_MEMBER),
CRASHTYPE(FORTIFY_MEM_OBJECT),
CRASHTYPE(FORTIFY_MEM_MEMBER),
diff --git a/drivers/misc/open-dice.c b/drivers/misc/open-dice.c
index 24c29e0f00ef..45060fb4ea27 100644
--- a/drivers/misc/open-dice.c
+++ b/drivers/misc/open-dice.c
@@ -86,29 +86,32 @@ static ssize_t open_dice_write(struct file *filp, const char __user *ptr,
/*
* Creates a mapping of the reserved memory region in user address space.
*/
-static int open_dice_mmap(struct file *filp, struct vm_area_struct *vma)
+static int open_dice_mmap_prepare(struct vm_area_desc *desc)
{
+ struct file *filp = desc->file;
struct open_dice_drvdata *drvdata = to_open_dice_drvdata(filp);
- if (vma->vm_flags & VM_MAYSHARE) {
+ if (vma_desc_test(desc, VMA_MAYSHARE_BIT)) {
/* Do not allow userspace to modify the underlying data. */
- if (vma->vm_flags & VM_WRITE)
+ if (vma_desc_test(desc, VMA_WRITE_BIT))
return -EPERM;
/* Ensure userspace cannot acquire VM_WRITE later. */
- vm_flags_clear(vma, VM_MAYWRITE);
+ vma_desc_clear_flags(desc, VMA_MAYWRITE_BIT);
}
/* Create write-combine mapping so all clients observe a wipe. */
- vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
- vm_flags_set(vma, VM_DONTCOPY | VM_DONTDUMP);
- return vm_iomap_memory(vma, drvdata->rmem->base, drvdata->rmem->size);
+ desc->page_prot = pgprot_writecombine(desc->page_prot);
+ vma_desc_set_flags(desc, VMA_DONTCOPY_BIT, VMA_DONTDUMP_BIT);
+ mmap_action_simple_ioremap(desc, drvdata->rmem->base,
+ drvdata->rmem->size);
+ return 0;
}
static const struct file_operations open_dice_fops = {
.owner = THIS_MODULE,
.read = open_dice_read,
.write = open_dice_write,
- .mmap = open_dice_mmap,
+ .mmap_prepare = open_dice_mmap_prepare,
};
static int __init open_dice_probe(struct platform_device *pdev)
diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
index 74ab5b5b9011..dbd017cabbb9 100644
--- a/drivers/misc/pci_endpoint_test.c
+++ b/drivers/misc/pci_endpoint_test.c
@@ -61,6 +61,7 @@
#define STATUS_BAR_SUBRANGE_SETUP_FAIL BIT(15)
#define STATUS_BAR_SUBRANGE_CLEAR_SUCCESS BIT(16)
#define STATUS_BAR_SUBRANGE_CLEAR_FAIL BIT(17)
+#define STATUS_NO_RESOURCE BIT(18)
#define PCI_ENDPOINT_TEST_LOWER_SRC_ADDR 0x0c
#define PCI_ENDPOINT_TEST_UPPER_SRC_ADDR 0x10
@@ -84,6 +85,13 @@
#define CAP_MSIX BIT(2)
#define CAP_INTX BIT(3)
#define CAP_SUBRANGE_MAPPING BIT(4)
+#define CAP_DYNAMIC_INBOUND_MAPPING BIT(5)
+#define CAP_BAR0_RESERVED BIT(6)
+#define CAP_BAR1_RESERVED BIT(7)
+#define CAP_BAR2_RESERVED BIT(8)
+#define CAP_BAR3_RESERVED BIT(9)
+#define CAP_BAR4_RESERVED BIT(10)
+#define CAP_BAR5_RESERVED BIT(11)
#define PCI_ENDPOINT_TEST_DB_BAR 0x34
#define PCI_ENDPOINT_TEST_DB_OFFSET 0x38
@@ -107,6 +115,9 @@
#define PCI_DEVICE_ID_ROCKCHIP_RK3588 0x3588
+#define PCI_DEVICE_ID_NVIDIA_TEGRA194_EP 0x1ad4
+#define PCI_DEVICE_ID_NVIDIA_TEGRA234_EP 0x229b
+
#define PCI_ENDPOINT_TEST_BAR_SUBRANGE_NSUB 2
static DEFINE_IDA(pci_endpoint_test_ida);
@@ -275,6 +286,11 @@ fail:
return ret;
}
+static bool bar_is_reserved(struct pci_endpoint_test *test, enum pci_barno bar)
+{
+ return test->ep_caps & BIT(bar + __fls(CAP_BAR0_RESERVED));
+}
+
static const u32 bar_test_pattern[] = {
0xA0A0A0A0,
0xA1A1A1A1,
@@ -403,7 +419,7 @@ static int pci_endpoint_test_bars(struct pci_endpoint_test *test)
/* Write all BARs in order (without reading). */
for (bar = 0; bar < PCI_STD_NUM_BARS; bar++)
- if (test->bar[bar])
+ if (test->bar[bar] && !bar_is_reserved(test, bar))
pci_endpoint_test_bars_write_bar(test, bar);
/*
@@ -413,7 +429,7 @@ static int pci_endpoint_test_bars(struct pci_endpoint_test *test)
* (Reading back the BAR directly after writing can not detect this.)
*/
for (bar = 0; bar < PCI_STD_NUM_BARS; bar++) {
- if (test->bar[bar]) {
+ if (test->bar[bar] && !bar_is_reserved(test, bar)) {
ret = pci_endpoint_test_bars_read_bar(test, bar);
if (ret)
return ret;
@@ -465,7 +481,7 @@ static int pci_endpoint_test_bar_subrange_cmd(struct pci_endpoint_test *test,
status = pci_endpoint_test_readl(test, PCI_ENDPOINT_TEST_STATUS);
if (status & fail_bit)
- return -EIO;
+ return (status & STATUS_NO_RESOURCE) ? -ENOSPC : -EIO;
if (!(status & ok_bit))
return -EIO;
@@ -535,7 +551,7 @@ static int pci_endpoint_test_bar_subrange(struct pci_endpoint_test *test,
sub_size = bar_size / nsub;
if (sub_size < sizeof(u32)) {
- ret = -ENOSPC;
+ ret = -EINVAL;
goto out_clear;
}
@@ -1060,6 +1076,9 @@ static int pci_endpoint_test_doorbell(struct pci_endpoint_test *test)
u32 addr;
int left;
+ if (!(test->ep_caps & CAP_DYNAMIC_INBOUND_MAPPING))
+ return -EOPNOTSUPP;
+
if (irq_type < PCITEST_IRQ_TYPE_INTX ||
irq_type > PCITEST_IRQ_TYPE_MSIX) {
dev_err(dev, "Invalid IRQ type\n");
@@ -1139,6 +1158,11 @@ static long pci_endpoint_test_ioctl(struct file *file, unsigned int cmd,
if (is_am654_pci_dev(pdev) && bar == BAR_0)
goto ret;
+ if (bar_is_reserved(test, bar)) {
+ ret = -ENOBUFS;
+ goto ret;
+ }
+
if (cmd == PCITEST_BAR)
ret = pci_endpoint_test_bar(test, bar);
else
@@ -1418,6 +1442,8 @@ static const struct pci_device_id pci_endpoint_test_tbl[] = {
{ PCI_DEVICE(PCI_VENDOR_ID_ROCKCHIP, PCI_DEVICE_ID_ROCKCHIP_RK3588),
.driver_data = (kernel_ulong_t)&rk3588_data,
},
+ { PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_TEGRA194_EP),},
+ { PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_TEGRA234_EP),},
{ }
};
MODULE_DEVICE_TABLE(pci, pci_endpoint_test_tbl);
diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c
index 8d749f345246..278b76cbd281 100644
--- a/drivers/misc/sgi-gru/grumain.c
+++ b/drivers/misc/sgi-gru/grumain.c
@@ -542,7 +542,7 @@ void gru_unload_context(struct gru_thread_state *gts, int savestate)
int ctxnum = gts->ts_ctxnum;
if (!is_kernel_context(gts))
- zap_vma_ptes(gts->ts_vma, UGRUADDR(gts), GRU_GSEG_PAGESIZE);
+ zap_special_vma_range(gts->ts_vma, UGRUADDR(gts), GRU_GSEG_PAGESIZE);
cch = get_cch(gru->gs_gru_base_vaddr, ctxnum);
gru_dbg(grudev, "gts %p, cbrmap 0x%lx, dsrmap 0x%lx\n",
generated by cgit v1.2.3 (git 2.0.4) at 2026-04-18 13:56:59 +0000