linux-stable.git/drivers/platform/chrome/cros_ec_dev.c, branch linux-4.9.y

platform/chrome: cros_ec_dev - double fetch bug in ioctl

2016-07-05T21:01:52+00:00

We verify "u_cmd.outsize" and "u_cmd.insize" but we need to make sure
that those values have not changed between the two copy_from_user()
calls.  Otherwise it could lead to a buffer overflow.

Additionally, cros_ec_cmd_xfer() can set s_cmd->insize to a lower value.
We should use the new smaller value so we don't copy too much data to
the user.

Reported-by: Pengfei Wang 
Fixes: a841178445bb ('mfd: cros_ec: Use a zero-length array for command data')
Signed-off-by: Dan Carpenter 
Reviewed-by: Kees Cook 
Tested-by: Gwendal Grignou 
Cc:  # v4.2+
Signed-off-by: Olof Johansson

platform/chrome: cros_ec_dev - Populate compat_ioctl

2016-05-11T18:55:48+00:00

compat_ioctl has to be populated for 32 bit userspace applications to work
with 64 bit kernels.

Signed-off-by: Guenter Roeck 
Tested-by: Brian Norris 
Signed-off-by: Olof Johansson

platform/chrome: cros_ec_dev - Fix security issue

2016-05-11T18:55:47+00:00

Prevent memory scribble by checking that ioctl buffer size parameters
are sane.
Without this check, on 32 bits system, if .insize = 0xffffffff - 20 and
.outsize the amount to scribble, we would overflow, allocate a small
amounts and be able to write outside of the malloc'ed area.
Adding a hard limit allows argument checking of the ioctl. With the
current EC, it is expected .insize and .outsize to be at around 512 bytes
or less.

Signed-off-by: Gwendal Grignou 
Signed-off-by: Olof Johansson

platform/chrome: Support reading/writing the vboot context

2015-10-07T22:05:53+00:00

Some EC implementations include a small nvram space used to store
verified boot context data. This patch offers a way to expose this
data to userspace.

Reviewed-by: Javier Martinez Canillas 
Signed-off-by: Emilio López 
Signed-off-by: Olof Johansson

platform/chrome: cros_ec_dev - Add a platform device ID table

2015-10-07T21:34:26+00:00

If the cros_ec_dev driver is built as a module, modalias information is
not filled so the module is not autoloaded. Add a platform device table
and use the MODULE_DEVICE_TABLE() macro to export that information in
the module so user-space can match the modalias uevent and autoload it.

Signed-off-by: Javier Martinez Canillas 
Signed-off-by: Olof Johansson

mfd: cros_ec: Support multiple EC in a system

2015-06-15T12:18:23+00:00

Chromebooks can have more than one Embedded Controller so the
cros_ec device id has to be incremented for each EC registered.

Add a new structure to represent multiple EC as different char
devices (e.g: /dev/cros_ec, /dev/cros_pd). It connects to
cros_ec_device and allows sysfs inferface for cros_pd.

Also reduce number of allocated objects, make chromeos sysfs
class object a static and add refcounting to prevent object
deletion while command is in progress.

Signed-off-by: Gwendal Grignou 
Reviewed-by: Dmitry Torokhov 
Signed-off-by: Javier Martinez Canillas 
Tested-by: Heiko Stuebner 
Acked-by: Lee Jones 
Acked-by: Olof Johansson 
Signed-off-by: Lee Jones

mfd: cros_ec: Use a zero-length array for command data

2015-06-15T12:18:19+00:00

Commit 1b84f2a4cd4a ("mfd: cros_ec: Use fixed size arrays to transfer
data with the EC") modified the struct cros_ec_command fields to not
use pointers for the input and output buffers and use fixed length
arrays instead.

This change was made because the cros_ec ioctl API uses that struct
cros_ec_command to allow user-space to send commands to the EC and
to get data from the EC. So using pointers made the API not 64-bit
safe. Unfortunately this approach was not flexible enough for all
the use-cases since there may be a need to send larger commands
on newer versions of the EC command protocol.

So to avoid to choose a constant length that it may be too big for
most commands and thus wasting memory and CPU cycles on copy from
and to user-space or having a size that is too small for some big
commands, use a zero-length array that is both 64-bit safe and
flexible. The same buffer is used for both output and input data
so the maximum of these values should be used to allocate it.

Suggested-by: Gwendal Grignou 
Signed-off-by: Javier Martinez Canillas 
Tested-by: Heiko Stuebner 
Acked-by: Lee Jones 
Acked-by: Olof Johansson 
Signed-off-by: Lee Jones

platform/chrome: cros_ec_dev - fix Unknown escape '%' warning

2015-03-04T19:23:10+00:00

Fix the following sparse warning:

    drivers/platform/chrome/cros_ec_dev.c:64:45: sparse: Unknown escape '%'

Reported-by: Dan Carpenter 
Signed-off-by: Olof Johansson 
Reviewed-by: Gwendal Grignou 
Signed-off-by: Javier Martinez Canillas 
Signed-off-by: Olof Johansson

platform/chrome: Expose Chrome OS Lightbar to users

2015-02-26T23:45:16+00:00

This adds some sysfs entries to provide userspace control of the
four-element LED "lightbar" on the Chromebook Pixel. This only instantiates
the lightbar controls if the device actually exists.

To prevent DoS attacks, this interface is limited to 20 accesses/second,
although that rate can be adjusted by a privileged user.

On Chromebooks without a lightbar, this should have no effect. On the
Chromebook Pixel, you should be able to do things like this:

    $ cd /sys/devices/virtual/chromeos/cros_ec/lightbar
    $ echo 0x80 > brightness
    $ echo 255 > brightness
    $
    $ cat sequence
    S0
    $ echo konami > sequence
    $ cat sequence
    KONAMI
    $
    $ cat sequence
    S0

And

    $ cd /sys/devices/virtual/chromeos/cros_ec/lightbar
    $ echo stop > sequence
    $ echo "4 255 255 255" > led_rgb
    $ echo "0 255 0 0  1 0 255 0  2 0 0 255  3 255 255 0" > led_rgb
    $ echo run  > sequence

Test the DoS prevention with this:

    $ cd /sys/devices/virtual/chromeos/cros_ec/lightbar
    $ echo 500 > interval_msec
    $ time (cat version version version version version version version)

Signed-off-by: Bill Richardson 
Reviewed-by: Olof Johansson 
Tested-by: Doug Anderson 
Reviewed-by: Benson Leung 
Signed-off-by: Javier Martinez Canillas 
Tested-by: Gwendal Grignou 
Reviewed-by: Gwendal Grignou 
Signed-off-by: Olof Johansson

platform/chrome: Create sysfs attributes for the ChromeOS EC

2015-02-26T23:45:12+00:00

This adds the first few sysfs attributes for the Chrome OS EC. These
controls are made available under /sys/devices/virtual/chromeos/cros_ec

    flashinfo   - display current flash info
    reboot      - tell the EC to reboot in various ways
    version     - information about the EC software and hardware

Future changes will build on this to add additional controls.

From a root shell, you should be able to do things like this:

    cd /sys/devices/virtual/chromeos/cros_ec
    cat flashinfo
    cat version
    echo rw > reboot
    cat version
    echo ro > reboot
    cat version
    echo rw > reboot
    cat version
    echo cold > reboot

That last command will reboot the AP too.

Signed-off-by: Bill Richardson 
Reviewed-by: Olof Johansson 
Signed-off-by: Javier Martinez Canillas 
Tested-by: Gwendal Grignou 
Reviewed-by: Gwendal Grignou 
Signed-off-by: Olof Johansson